Extracting prog: 6h38m14.321830219s
Minimizing prog: 52m31.393810837s
Simplifying prog options: 14m49.569706591s
Extracting C: 5m12.142652309s
Simplifying C: 0s


extracting reproducer from 45 programs
first checking the prog from the crash report
single: executing 1 programs separately with timeout 30s
testing program (duration=30s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): mmap$auto-madvise$auto-openat$auto_clear_warn_once_fops_-openat$auto_tty_fops_tty_io-close_range$auto-socket-socket-mmap$auto-socket-bind$auto-ioctl$auto-ioctl$auto-mmap$auto-close_range$auto-socketpair$auto-openat$auto_force_devcoredump_fops_hci_vhci-write$auto-mremap$auto-mmap$auto-madvise$auto-openat$auto_proc_clear_refs_operations_internal-mmap$auto-setitimer$auto-openat$nci-bpf$auto-socket-sendmsg$auto_NL80211_CMD_GET_REG-recvmmsg$auto-write$auto_proc_clear_refs_operations_internal-socket
detailed listing:
executing program 0:
mmap$auto(0x0, 0x4020009, 0x8000000080000000, 0x17, 0x401, 0x8000)
madvise$auto(0x0, 0xffffffffffff0005, 0x17)
openat$auto_clear_warn_once_fops_(0xffffffffffffff9c, &(0x7f0000000100), 0x210800, 0x0)
r0 = openat$auto_tty_fops_tty_io(0xffffffffffffff9c, &(0x7f0000000000)='/dev/tty46\x00', 0x0, 0x0)
close_range$auto(0x2, 0x8, 0x0)
socket(0x10, 0x2, 0x0)
socket(0x2, 0x6, 0x0)
mmap$auto(0x0, 0x400005, 0xdf, 0x9b72, 0x2, 0x8000)
socket(0xa, 0x5, 0x84)
bind$auto(0x3, 0x0, 0x6a)
ioctl$auto(0x3, 0x800005411, 0x38)
ioctl$auto(r0, 0x5600, 0x0)
mmap$auto(0x6, 0x400005, 0xffffffffffffff00, 0x9b72, r0, 0x8000)
close_range$auto(0x2, 0x8, 0x0)
socketpair$auto(0x1, 0x2, 0x8000000000000000, 0x0)
r1 = openat$auto_force_devcoredump_fops_hci_vhci(0xffffffffffffff9c, &(0x7f0000000c40)='/sys/kernel/debug/bluetooth/hci0/force_devcoredump\x00', 0x2, 0x0)
write$auto(r1, 0x0, 0xe)
mremap$auto(0x0, 0xffffffffffffffff, 0x3fd6, 0x3, 0x7fffffffb000)
mmap$auto(0x0, 0x400005, 0x800000000000df, 0x9b72, 0x2, 0x8000)
madvise$auto(0x0, 0xffffffffffff0001, 0x15)
r2 = openat$auto_proc_clear_refs_operations_internal(0xffffffffffffff9c, &(0x7f0000000600)='/proc/thread-self/clear_refs\x00', 0x2, 0x0)
mmap$auto(0x0, 0x8, 0xdf, 0x9b72, 0x2, 0x8000)
setitimer$auto(0x4, &(0x7f0000000000)={{0x1ff, 0x10001}, {0x200000000004, 0x6}}, 0x0)
openat$nci(0xffffffffffffff9c, &(0x7f0000000000), 0x2, 0x0)
bpf$auto(0x12, &(0x7f0000000000)=@info={0x2800, 0x1ff, 0x2}, 0xcf)
r3 = socket(0x10, 0x2, 0x0)
sendmsg$auto_NL80211_CMD_GET_REG(r3, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000300)=ANY=[@ANYBLOB=' \x00\x00\x00', @ANYBLOB="1200", @ANYBLOB=']'], 0x1ac}}, 0x40000)
recvmmsg$auto(r3, &(0x7f0000000380)={{0x0, 0x1, &(0x7f0000000000)={0x0, 0x400}, 0x4, 0x0, 0x200002, 0x8}, 0x803}, 0xfffffff9, 0x10010, 0x0)
write$auto_proc_clear_refs_operations_internal(r2, 0x0, 0xffffff4b)
socket(0xa, 0x3, 0x3a)

program did not crash
single: failed to extract reproducer
bisect: bisecting 45 programs with base timeout 30s
testing program (duration=41s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): [3, 3, 22, 11, 30, 26, 26, 27, 21, 2, 4, 4, 30, 30, 30, 16, 30, 26, 15, 24, 24, 30, 5, 6, 30, 2, 30, 15, 30, 26, 5, 25, 6, 6, 25, 30, 5, 30, 27, 15, 30, 10, 6, 22, 30]
detailed listing:
executing program 1:
unshare$auto(0x8)
openat$auto_ftrace_set_event_notrace_pid_fops_trace_events(0xffffffffffffff9c, &(0x7f0000000000)='/sys/kernel/debug/tracing/set_event_notrace_pid\x00', 0x4000, 0x0)
vmsplice$auto(0x1, &(0x7f0000000040)={&(0x7f0000000040), 0x1ffc0}, 0xa, 0x6)
executing program 1:
unshare$auto(0x8)
openat$auto_ftrace_set_event_notrace_pid_fops_trace_events(0xffffffffffffff9c, &(0x7f0000000000)='/sys/kernel/debug/tracing/set_event_notrace_pid\x00', 0x4000, 0x0)
vmsplice$auto(0x1, &(0x7f0000000040)={&(0x7f0000000040), 0x1ffc0}, 0xa, 0x6) (fail_nth: 1)
executing program 1:
mmap$auto(0x0, 0x2000a, 0x10000000000df, 0xeb2, 0x401, 0x8000)
openat$auto_kernfs_file_fops_kernfs_internal(0xffffffffffffff9c, 0x0, 0x882, 0x0)
close_range$auto(0x2, 0x8, 0x0)
r0 = openat$auto_kvm_chardev_ops_kvm_main(0xffffffffffffff9c, &(0x7f00000011c0), 0xe0180, 0x0)
ioctl$auto_KVM_CREATE_VM(r0, 0xae01, 0x0)
bind$auto(0xffffffffffffffff, 0x0, 0x62)
ioctl$auto(0x3, 0xae60, 0x10000000000402)
socket(0x10, 0x2, 0x4)
mmap$auto(0x0, 0x2000d, 0x4000000200df, 0xeb1, 0x404, 0x8000)
sendmsg$auto_NL80211_CMD_GET_REG(0xffffffffffffffff, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000200)={0x0}}, 0x800)
sendmsg$auto_NL80211_CMD_SET_POWER_SAVE(0xffffffffffffffff, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000180)={0x14, 0x0, 0x200, 0x70bd29, 0x25dfdbfe}, 0x14}, 0x1, 0x0, 0x0, 0x20004800}, 0x48080)
sendmsg$auto_HWSIM_CMD_DEL_RADIO(0xffffffffffffffff, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000000180)=ANY=[@ANYBLOB="14000000", @ANYRES16, @ANYBLOB="01"], 0x14}, 0x1, 0x0, 0x0, 0x20040800}, 0x24004000)
sendmsg$auto_NL80211_CMD_GET_REG(0xffffffffffffffff, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000180)=ANY=[@ANYBLOB="72010000", @ANYBLOB="1200"], 0x1ac}}, 0x40000)
sendmmsg$auto(0x3, &(0x7f0000000080)={{0x0, 0x2, &(0x7f00000002c0)={0x0, 0xc4}, 0x1, 0x0, 0x0, 0x9}, 0x7}, 0x3, 0x0)
r1 = open(&(0x7f0000000100)='.\x00', 0x0, 0x110)
mmap$auto(0x0, 0x2020009, 0x3, 0xeb1, 0xfffffffffffffffa, 0x8000)
prctl$auto(0x1000000003b, 0x1, 0x4, 0x5, 0x7)
mmap$auto(0x0, 0x400008, 0xdf, 0x9b72, 0x2, 0x800008000)
madvise$auto(0x0, 0xffffffffffff0001, 0x15)
removexattr$auto(0x0, 0x0)
getdents64$auto(r1, 0x0, 0x400)
ioctl$auto(0x3, 0x4020aea5, 0x38)
executing program 1:
mmap$auto(0x0, 0x4, 0x4000000000df, 0x40eb1, 0x401, 0x300000000000)
close_range$auto(0x0, 0xfffffffffffff000, 0x0)
openat$auto_proc_single_file_operations_base(0xffffffffffffff9c, &(0x7f0000000180)='/proc/fs/ext4/sda1/mb_stats\x00', 0x109100, 0x0)
mmap$auto(0x0, 0x8, 0xdf, 0x9b72, 0x2, 0x8000)
socket(0x18, 0x5, 0x2)
getpeername$auto(0x3, 0x0, 0x0)
r0 = openat$auto_tty_fops_tty_io(0xffffffffffffff9c, &(0x7f0000000000)='/dev/tty12\x00', 0x800, 0x0)
socket(0x10, 0x2, 0x4)
r1 = socketpair$auto(0x1e, 0x4, 0x8000000000000000, 0x0)
ioctl$auto(r0, 0x541c, r1)
read$auto_proc_pid_maps_operations_internal(r1, &(0x7f0000000040)=""/136, 0x88)
executing program 1:
openat$auto_tty_fops_tty_io(0xffffffffffffff9c, &(0x7f0000000180)='/dev/ptyzf\x00', 0x90800, 0x0)
mmap$auto(0x0, 0xa00006, 0x2, 0x40eb1, 0x602, 0x300000000000)
quotactl_fd$auto(0xffffffffffffffff, 0x1, 0x0, 0x0)
socket(0x2, 0x3, 0xfffffff1)
adjtimex$auto(&(0x7f00000004c0)={0xf332b71, 0x0, 0x0, 0xfffffffffffffffd, 0x40000d4, 0x8000000000001, 0x6, 0x0, 0x8, 0x9, 0x100000000000002, {0x2100000000, 0x10000}, 0x5, 0x100000006, 0xfffffffffffffffd, 0x1008000, 0x0, 0x80000004, 0x3, 0xffffffffffff628e, 0xa747, 0xdeae, 0x804})
socket(0x2b, 0x1, 0x1)
openat$auto_seq_oss_f_ops_seq_oss(0xffffffffffffff9c, &(0x7f0000000080)='/dev/sequencer2\x00', 0x2, 0x0)
r0 = openat$auto_snd_rawmidi_f_ops_rawmidi(0xffffffffffffff9c, &(0x7f0000000000)='/dev/snd/midiC2D0\x00', 0x1, 0x0)
write$auto(r0, &(0x7f0000000400)='/dev/audio1\x00', 0xa3d9)
unshare$auto(0x40000080)
ustat$auto(0x45, &(0x7f0000000040)={0x200, 0x2, "84d1d3931a0f", "0fa1b61ca8fe"})
mmap$auto(0x0, 0x4, 0x4000000000df, 0x40eb1, 0x401, 0x300000000000)
epoll_create$auto(0x3e)
socket(0xf, 0x5, 0x200084)
open(0x0, 0x0, 0x408)
prctl$auto(0x4, 0x0, 0x0, 0xfffffffffffffffd, 0x2)
socket(0x2, 0x1, 0x0)
bind$auto(0x3, &(0x7f0000000040)=@ethernet={0x6, @broadcast}, 0x6e)
ioctl$auto_PAGEMAP_SCAN(0xffffffffffffffff, 0xc0606610, &(0x7f000000c380)={0x60, 0x0, 0x100000, 0x10000000000000, 0xfffffffffffffffe, 0x0, 0x4000, 0x50b301a, 0x2c, 0x24, 0xff, 0x2})
socket$nl_generic(0x10, 0x3, 0x10)
mmap$auto(0x0, 0x2020009, 0x3, 0xeb1, 0xfffffffffffffffa, 0x8000)
capset$auto(0x0, 0x0)
lsm_list_modules$auto(0x0, 0x0, 0x0)
read$auto(0x4, 0x0, 0xfdef)
close_range$auto(0x2, 0x8, 0x0)
openat$auto_console_fops_tty_io(0xffffffffffffff9c, 0x0, 0x40, 0x0)
r1 = openat$auto_dvb_demux_fops_dmxdev(0xffffffffffffff9c, &(0x7f0000000140), 0x8040, 0x0)
ioctl$auto_dvb_demux_fops_dmxdev(r1, 0x403c6f2b, 0x0)
ioctl$auto(0x3, 0x6f29, 0x10000000000402)
syz_genetlink_get_family_id$auto_nl802154(0x0, 0xffffffffffffffff)
executing program 1:
mmap$auto(0x0, 0x4020009, 0xdf, 0xeb2, 0x401, 0x8000)
close_range$auto(0x2, 0x8, 0x0)
openat$auto_console_fops_tty_io(0xffffffffffffff9c, &(0x7f0000000000)='/dev/tty0\x00', 0x0, 0x0)
r0 = openat$auto_dvb_demux_fops_dmxdev(0xffffffffffffff9c, &(0x7f0000000140), 0x8040, 0x0)
openat2$auto(0xffffffffffffff9c, 0x0, 0x0, 0xf6)
mmap$auto(0x0, 0x2020009, 0x3, 0xeb1, 0xfffffffffffffffa, 0x8000)
r1 = openat$auto_kernfs_file_fops_kernfs_internal(0xffffffffffffff9c, &(0x7f0000000000)='/sys/devices/virtual/net/bond0/flags\x00', 0x101142, 0x0)
write$auto(r1, 0x0, 0x4)
io_uring_setup$auto(0x101, 0x0)
ioctl$auto_dvb_demux_fops_dmxdev(r0, 0x403c6f2b, 0x0)
ioctl$auto(0x3, 0x6f2d, 0x10000000000402)
mmap$auto(0x0, 0x20009, 0x4000000000df, 0xeb1, 0x401, 0x8000)
r2 = syz_genetlink_get_family_id$auto_mac80211_hwsim(&(0x7f0000000c80), 0xffffffffffffffff)
sendmsg$auto_HWSIM_CMD_NEW_RADIO(0xffffffffffffffff, &(0x7f0000000d80)={&(0x7f0000000c40), 0xc, &(0x7f0000000d40)={&(0x7f0000000cc0)={0x48, r2, 0x200, 0x70bd2b, 0x25dfdbfe, {}, [@HWSIM_ATTR_RX_RATE={0x8, 0x5, 0x80000001}, @HWSIM_ATTR_REG_HINT_ALPHA2={0x9, 0xb, 'IPVS\x00'}, @HWSIM_ATTR_RADIO_ID={0x8, 0xa, 0x1}, @HWSIM_ATTR_RADIO_ID={0x8, 0xa, 0x2}, @HWSIM_ATTR_REG_HINT_ALPHA2={0x5, 0xb, '\x00'}, @HWSIM_ATTR_FLAGS={0x8, 0x4, 0x5}]}, 0x48}}, 0x40000)
move_pages$auto(0x1, 0x2000000000003, 0x0, 0x0, 0x0, 0x8000400000000000)
r3 = socket(0xa, 0x801, 0x84)
setsockopt$auto(r3, 0x10000000084, 0x9, 0x0, 0x98)
r4 = openat$auto_hwsim_fops_ps_(0xffffffffffffff9c, &(0x7f0000000180)='/sys/kernel/debug/ieee80211/phy16/hwsim/ps\x00', 0x200200, 0x0)
r5 = fcntl$auto_F_UNLCK(r4, 0xb4, 0x2)
r6 = syz_genetlink_get_family_id$auto_ipvs(&(0x7f0000000200), r5)
msgctl$auto_IPC_SET(0x8, 0x1, &(0x7f00000002c0)={{0x40, <r7=>0xffffffffffffffff, 0x0, 0x8000, 0xfff, 0x9}, &(0x7f0000000240)=0x42, &(0x7f0000000280)=0x2, 0x4, 0x8, 0x3, 0x0, 0xffff, 0x5, 0x6, 0x1, @inferred=0xffffffffffffffff})
lstat$auto(&(0x7f0000000340)='./file0\x00', &(0x7f0000000380)={0x40, 0x40, 0x53, 0x7, <r8=>0xffffffffffffffff, 0xee00, 0x0, 0x0, 0x4b47, 0x80000001, 0xfffffffffffffc00, 0x2e98, 0x7, 0x6, 0xb1, 0x2400000000000, 0x3000000})
sendmsg$auto_IPVS_CMD_FLUSH(r5, &(0x7f0000000c00)={&(0x7f00000001c0)={0x10, 0x0, 0x0, 0x40}, 0xc, &(0x7f0000000bc0)={&(0x7f0000000440)={0x774, r6, 0x400, 0x70bd2c, 0x25dfdbfd, {}, [@IPVS_CMD_ATTR_SERVICE={0x2d4, 0x1, 0x0, 0x1, [@nested={0x127, 0x17, 0x0, 0x1, [@generic="871704ea4aadd981495ab19b63975258ce6c9a1ea0a045402baef57bd7ee8f1eaba1fa1024b4c912432525763cd39440d0a14be8688b6a7693e0edd74cb581b9ebfe7ab321aac94541e0e3bf6801edc66adb6d206a6be8078a60c4d460e66db02a378dc2e89035f253cf80e9dcb9263a8fd34a7c494c06b71476c62553dc00317095d9288a0ded8e29d4c06f4d14117aaa63911b9ed5f04a65f3c454713dbf5b44301d1859572d40f7337a7af5aab2385db70d22818c86b0a74f7dfb6383effb053ab3b344308ace69dbb3a920441287fec0ed38d9a3e82c", @nested={0x4, 0x4}, @typed={0x8, 0x14c, 0x0, 0x0, @uid=r7}, @generic="c95aeded1f45e66228f9ef8f19300d7bf662441524a771572da1f7b8d87b34363643666451b7ef6b465da11f79653ae58f10c2086d673e0b755d52a8ff7aff"]}, @nested={0x190, 0x45, 0x0, 0x1, [@typed={0xc, 0x5c, 0x0, 0x0, @u64=0x800}, @nested={0x4, 0x48}, @generic="7ad7aada77683072504900f7e10b4ebc4b89c6acd80c98d4e030f91c8fa79845ceb71dcda68cb7151f6f1ab4823b47aba46dea150fd09804d24ed3aceb75cb0e2dc80a7e1fb6784038e7fd453f571e5e923cf332530cffa1a0a69bbbd3487f78baf74b90ab3ab31f1a8ebe2850521bfe64691d22c538bd9c51d7d8abeb2e460443ef0e82739fe4a43147dd4d608b9542a1c603cf16585dc0", @nested={0x4, 0x124}, @nested={0x4, 0x66}, @generic="ae750686f8df37eb967da4ddcb4c194cd5821fabf1cfc74bcf581da957a13350396043316cd2b2a81eee34c55395c6e4dbc2070688d9da5c19bd34f286e87cf049bd0edd47ce2e2e1d07e13509a809d2946e3c85ece0197803b1254b0199ab473fb3a0f33d60df73d4b7515963cdc6342a3df3ab6ec42b95ede1e318d50429fc4eeabfe60f4260664d2ffc31f15edccaa1233252248a82f6222ae7d94efd29cd4532d3fba9cb0751d8f8e97762711a3ab31f8ce5a38acc152e8459a16fa19062c839cc231fc1712d21a5c4957241a6329b99a7a6de99464335cc54dd"]}, @typed={0xc, 0x8a, 0x0, 0x0, @u64=0xffffffff}, @typed={0xc, 0x14b, 0x0, 0x0, @u64=0x2}]}, @IPVS_CMD_ATTR_SERVICE={0xc, 0x1, 0x0, 0x1, [@nested={0x8, 0xe7, 0x0, 0x1, [@typed={0x4, 0x5f}]}]}, @IPVS_CMD_ATTR_DEST={0x1dc, 0x2, 0x0, 0x1, [@typed={0xbd, 0x10a, 0x0, 0x0, @binary="1d471fef13d7d7927e06ae36aff425cec03d8513acc40bb7f6f8e6ac012402ee3f855cbefe9a0e85dc4009d8d5a0d7a4cf84be605244c567d491d75076a860a59eeae83209fa59ddcd1b1bc65be47e3f7d24f57e815ee49b17594743a15722e990e65fa77f7e00331f008bddc30bb388186df51b4f805426a80345ae62454bf2cbfe32e347a6c2ec38c612c0b860c6d383e9a4d61d9e6f26bf5e0955f0e1438fdc25b05ded7039e02cbc426c31ac782c6cf32faa97620bce00"}, @generic="787604329aba534bd23ccfb0611b3af32dc783b4f7b4f23b5467f0abced5ca601877127b81629eadf6d69bbd815d73ecdd2b3bd3b08f5954aa2b0e4f64824428744e9c559b91bef55dd7285b16aa3466514fc38d3223cfcd41a0d4e095313d27853f559528e48ae34393a46eec32fa0339d9d503009ccae727d1b2c32883c770", @nested={0x8, 0x114, 0x0, 0x1, [@nested={0x4, 0xc1}]}, @generic="1fc2a9dd22cce4bd589b96e22a700747618b61175621e8265018aeee41dd88270905b46fc763b0eccc001b1e1a675119ff6ee8b7e6a19fa62a65a0b5843daa7388206204066b2624f26870cb88eff2a399220d48c83cff24a4f52a55ac8edece16abcde074be5637fb228f1d1684e660349c455a20b2e53587c94ffd1b111cc4660df0ef3c47bec4bf43f6080d982494"]}, @IPVS_CMD_ATTR_SERVICE={0x2a4, 0x1, 0x0, 0x1, [@nested={0xce, 0x8d, 0x0, 0x1, [@nested={0x4, 0xde}, @typed={0xc, 0x4e, 0x0, 0x0, @u64=0x800}, @generic="2d44f369315f2f33fef807b381ec2d4034f68bdabbf611b16d9c357172445c3adc454588394d93215b1e581157e77304964f631faf38be93009b5830a17d3e3d765a6502029d985a6eacecf4ceef0e2570df8c16f2b27e9520aa8eee7cbe3d59710d187a23d765d6746ceddceb0d03490f8c45683b55bb50bf7b715f2cb8ee9146382e8e024444144dd2bf7e968841a33b2960eae965a1175eef4ce7d48ebbf36a51e91f5ee9b48b55d1d42a8e12ee1736aba38071df4f6818aa"]}, @typed={0x14, 0x145, 0x0, 0x0, @ipv6=@empty}, @generic="2c1fb0a79c0e9148a9e7cc25ac084a5429c0851a59368468f6f6f5a5b050b50c106bde6711a06879274f0b9f8a99634f2724e40ee32d8b34eb992bf29ea0fa45626a8e602e5d5f27b3e7f6acfaeed5541eeb03cb563ad36d242deefed41e681bf8f75ea3b9751678cff50badb26602138254fbd1a74824865be99c2d1726ff5466988c04996954ec5be7a0d0bcc1108fe3050611c93e77f1d32a498f19d1bf52e2c75e40137e5db13ada7509b7c313dfb60c370f0cd8da455b2c9c851b442570fb8361ba1209159202ed6ac91b0eb54bea815df544a7420138f9885f542e351a1c0ac072d145af01627997ae5c519818a286fe0e546c3de06a873311", @typed={0x8, 0x93, 0x0, 0x0, @u32=0xa3}, @typed={0x8, 0xc8, 0x0, 0x0, @ipv4=@remote}, @typed={0x8, 0x12b, 0x0, 0x0, @fd=r3}, @typed={0xa0, 0xce, 0x0, 0x0, @binary="8b0844668f85eacdff95824596f319b55483e8b53d0e6206073551a6d61ef21ca31dbcf58ed08eba8c854863f6c0e20c1906dd6d05d3b472918d2e5c86dfc6a937d8d71d98420265da4054cea8e4642f8a179333f0551fb8b981ab8cf636f99887eb53ef5351a9ef50c4d991e1ccc04f285f7060ba015d2efa2f270de77960127e0c583286619e371875056f57bf44976e46f685cc27988263e655e8"}, @typed={0x8, 0x140, 0x0, 0x0, @uid=r8}]}]}, 0x774}, 0x1, 0x0, 0x0, 0x8811}, 0x4000)
r9 = syz_genetlink_get_family_id$auto_nl80211(&(0x7f0000000080), 0xffffffffffffffff)
sendmsg$auto_NL80211_CMD_CONTROL_PORT_FRAME(r5, &(0x7f0000000140)={&(0x7f0000000040), 0xc, &(0x7f0000000100)={&(0x7f00000000c0)=ANY=[@ANYBLOB='\x00\x00\x00\x00', @ANYRES16=r9, @ANYBLOB="040027bd7000fbdbdf25810000000400ae0008007e0006000000"], 0x20}, 0x1, 0x0, 0x0, 0x20008010}, 0x20000000)
openat$auto_proc_reg_file_ops_compat_inode(0xffffffffffffff9c, &(0x7f0000000000)='/proc/thread-self/net/rpc/nfsd.export/channel\x00', 0x8f3b7a51b8162d21, 0x0)
executing program 32:
mmap$auto(0x0, 0x4020009, 0xdf, 0xeb2, 0x401, 0x8000)
close_range$auto(0x2, 0x8, 0x0)
openat$auto_console_fops_tty_io(0xffffffffffffff9c, &(0x7f0000000000)='/dev/tty0\x00', 0x0, 0x0)
r0 = openat$auto_dvb_demux_fops_dmxdev(0xffffffffffffff9c, &(0x7f0000000140), 0x8040, 0x0)
openat2$auto(0xffffffffffffff9c, 0x0, 0x0, 0xf6)
mmap$auto(0x0, 0x2020009, 0x3, 0xeb1, 0xfffffffffffffffa, 0x8000)
r1 = openat$auto_kernfs_file_fops_kernfs_internal(0xffffffffffffff9c, &(0x7f0000000000)='/sys/devices/virtual/net/bond0/flags\x00', 0x101142, 0x0)
write$auto(r1, 0x0, 0x4)
io_uring_setup$auto(0x101, 0x0)
ioctl$auto_dvb_demux_fops_dmxdev(r0, 0x403c6f2b, 0x0)
ioctl$auto(0x3, 0x6f2d, 0x10000000000402)
mmap$auto(0x0, 0x20009, 0x4000000000df, 0xeb1, 0x401, 0x8000)
r2 = syz_genetlink_get_family_id$auto_mac80211_hwsim(&(0x7f0000000c80), 0xffffffffffffffff)
sendmsg$auto_HWSIM_CMD_NEW_RADIO(0xffffffffffffffff, &(0x7f0000000d80)={&(0x7f0000000c40), 0xc, &(0x7f0000000d40)={&(0x7f0000000cc0)={0x48, r2, 0x200, 0x70bd2b, 0x25dfdbfe, {}, [@HWSIM_ATTR_RX_RATE={0x8, 0x5, 0x80000001}, @HWSIM_ATTR_REG_HINT_ALPHA2={0x9, 0xb, 'IPVS\x00'}, @HWSIM_ATTR_RADIO_ID={0x8, 0xa, 0x1}, @HWSIM_ATTR_RADIO_ID={0x8, 0xa, 0x2}, @HWSIM_ATTR_REG_HINT_ALPHA2={0x5, 0xb, '\x00'}, @HWSIM_ATTR_FLAGS={0x8, 0x4, 0x5}]}, 0x48}}, 0x40000)
move_pages$auto(0x1, 0x2000000000003, 0x0, 0x0, 0x0, 0x8000400000000000)
r3 = socket(0xa, 0x801, 0x84)
setsockopt$auto(r3, 0x10000000084, 0x9, 0x0, 0x98)
r4 = openat$auto_hwsim_fops_ps_(0xffffffffffffff9c, &(0x7f0000000180)='/sys/kernel/debug/ieee80211/phy16/hwsim/ps\x00', 0x200200, 0x0)
r5 = fcntl$auto_F_UNLCK(r4, 0xb4, 0x2)
r6 = syz_genetlink_get_family_id$auto_ipvs(&(0x7f0000000200), r5)
msgctl$auto_IPC_SET(0x8, 0x1, &(0x7f00000002c0)={{0x40, <r7=>0xffffffffffffffff, 0x0, 0x8000, 0xfff, 0x9}, &(0x7f0000000240)=0x42, &(0x7f0000000280)=0x2, 0x4, 0x8, 0x3, 0x0, 0xffff, 0x5, 0x6, 0x1, @inferred=0xffffffffffffffff})
lstat$auto(&(0x7f0000000340)='./file0\x00', &(0x7f0000000380)={0x40, 0x40, 0x53, 0x7, <r8=>0xffffffffffffffff, 0xee00, 0x0, 0x0, 0x4b47, 0x80000001, 0xfffffffffffffc00, 0x2e98, 0x7, 0x6, 0xb1, 0x2400000000000, 0x3000000})
sendmsg$auto_IPVS_CMD_FLUSH(r5, &(0x7f0000000c00)={&(0x7f00000001c0)={0x10, 0x0, 0x0, 0x40}, 0xc, &(0x7f0000000bc0)={&(0x7f0000000440)={0x774, r6, 0x400, 0x70bd2c, 0x25dfdbfd, {}, [@IPVS_CMD_ATTR_SERVICE={0x2d4, 0x1, 0x0, 0x1, [@nested={0x127, 0x17, 0x0, 0x1, [@generic="871704ea4aadd981495ab19b63975258ce6c9a1ea0a045402baef57bd7ee8f1eaba1fa1024b4c912432525763cd39440d0a14be8688b6a7693e0edd74cb581b9ebfe7ab321aac94541e0e3bf6801edc66adb6d206a6be8078a60c4d460e66db02a378dc2e89035f253cf80e9dcb9263a8fd34a7c494c06b71476c62553dc00317095d9288a0ded8e29d4c06f4d14117aaa63911b9ed5f04a65f3c454713dbf5b44301d1859572d40f7337a7af5aab2385db70d22818c86b0a74f7dfb6383effb053ab3b344308ace69dbb3a920441287fec0ed38d9a3e82c", @nested={0x4, 0x4}, @typed={0x8, 0x14c, 0x0, 0x0, @uid=r7}, @generic="c95aeded1f45e66228f9ef8f19300d7bf662441524a771572da1f7b8d87b34363643666451b7ef6b465da11f79653ae58f10c2086d673e0b755d52a8ff7aff"]}, @nested={0x190, 0x45, 0x0, 0x1, [@typed={0xc, 0x5c, 0x0, 0x0, @u64=0x800}, @nested={0x4, 0x48}, @generic="7ad7aada77683072504900f7e10b4ebc4b89c6acd80c98d4e030f91c8fa79845ceb71dcda68cb7151f6f1ab4823b47aba46dea150fd09804d24ed3aceb75cb0e2dc80a7e1fb6784038e7fd453f571e5e923cf332530cffa1a0a69bbbd3487f78baf74b90ab3ab31f1a8ebe2850521bfe64691d22c538bd9c51d7d8abeb2e460443ef0e82739fe4a43147dd4d608b9542a1c603cf16585dc0", @nested={0x4, 0x124}, @nested={0x4, 0x66}, @generic="ae750686f8df37eb967da4ddcb4c194cd5821fabf1cfc74bcf581da957a13350396043316cd2b2a81eee34c55395c6e4dbc2070688d9da5c19bd34f286e87cf049bd0edd47ce2e2e1d07e13509a809d2946e3c85ece0197803b1254b0199ab473fb3a0f33d60df73d4b7515963cdc6342a3df3ab6ec42b95ede1e318d50429fc4eeabfe60f4260664d2ffc31f15edccaa1233252248a82f6222ae7d94efd29cd4532d3fba9cb0751d8f8e97762711a3ab31f8ce5a38acc152e8459a16fa19062c839cc231fc1712d21a5c4957241a6329b99a7a6de99464335cc54dd"]}, @typed={0xc, 0x8a, 0x0, 0x0, @u64=0xffffffff}, @typed={0xc, 0x14b, 0x0, 0x0, @u64=0x2}]}, @IPVS_CMD_ATTR_SERVICE={0xc, 0x1, 0x0, 0x1, [@nested={0x8, 0xe7, 0x0, 0x1, [@typed={0x4, 0x5f}]}]}, @IPVS_CMD_ATTR_DEST={0x1dc, 0x2, 0x0, 0x1, [@typed={0xbd, 0x10a, 0x0, 0x0, @binary="1d471fef13d7d7927e06ae36aff425cec03d8513acc40bb7f6f8e6ac012402ee3f855cbefe9a0e85dc4009d8d5a0d7a4cf84be605244c567d491d75076a860a59eeae83209fa59ddcd1b1bc65be47e3f7d24f57e815ee49b17594743a15722e990e65fa77f7e00331f008bddc30bb388186df51b4f805426a80345ae62454bf2cbfe32e347a6c2ec38c612c0b860c6d383e9a4d61d9e6f26bf5e0955f0e1438fdc25b05ded7039e02cbc426c31ac782c6cf32faa97620bce00"}, @generic="787604329aba534bd23ccfb0611b3af32dc783b4f7b4f23b5467f0abced5ca601877127b81629eadf6d69bbd815d73ecdd2b3bd3b08f5954aa2b0e4f64824428744e9c559b91bef55dd7285b16aa3466514fc38d3223cfcd41a0d4e095313d27853f559528e48ae34393a46eec32fa0339d9d503009ccae727d1b2c32883c770", @nested={0x8, 0x114, 0x0, 0x1, [@nested={0x4, 0xc1}]}, @generic="1fc2a9dd22cce4bd589b96e22a700747618b61175621e8265018aeee41dd88270905b46fc763b0eccc001b1e1a675119ff6ee8b7e6a19fa62a65a0b5843daa7388206204066b2624f26870cb88eff2a399220d48c83cff24a4f52a55ac8edece16abcde074be5637fb228f1d1684e660349c455a20b2e53587c94ffd1b111cc4660df0ef3c47bec4bf43f6080d982494"]}, @IPVS_CMD_ATTR_SERVICE={0x2a4, 0x1, 0x0, 0x1, [@nested={0xce, 0x8d, 0x0, 0x1, [@nested={0x4, 0xde}, @typed={0xc, 0x4e, 0x0, 0x0, @u64=0x800}, @generic="2d44f369315f2f33fef807b381ec2d4034f68bdabbf611b16d9c357172445c3adc454588394d93215b1e581157e77304964f631faf38be93009b5830a17d3e3d765a6502029d985a6eacecf4ceef0e2570df8c16f2b27e9520aa8eee7cbe3d59710d187a23d765d6746ceddceb0d03490f8c45683b55bb50bf7b715f2cb8ee9146382e8e024444144dd2bf7e968841a33b2960eae965a1175eef4ce7d48ebbf36a51e91f5ee9b48b55d1d42a8e12ee1736aba38071df4f6818aa"]}, @typed={0x14, 0x145, 0x0, 0x0, @ipv6=@empty}, @generic="2c1fb0a79c0e9148a9e7cc25ac084a5429c0851a59368468f6f6f5a5b050b50c106bde6711a06879274f0b9f8a99634f2724e40ee32d8b34eb992bf29ea0fa45626a8e602e5d5f27b3e7f6acfaeed5541eeb03cb563ad36d242deefed41e681bf8f75ea3b9751678cff50badb26602138254fbd1a74824865be99c2d1726ff5466988c04996954ec5be7a0d0bcc1108fe3050611c93e77f1d32a498f19d1bf52e2c75e40137e5db13ada7509b7c313dfb60c370f0cd8da455b2c9c851b442570fb8361ba1209159202ed6ac91b0eb54bea815df544a7420138f9885f542e351a1c0ac072d145af01627997ae5c519818a286fe0e546c3de06a873311", @typed={0x8, 0x93, 0x0, 0x0, @u32=0xa3}, @typed={0x8, 0xc8, 0x0, 0x0, @ipv4=@remote}, @typed={0x8, 0x12b, 0x0, 0x0, @fd=r3}, @typed={0xa0, 0xce, 0x0, 0x0, @binary="8b0844668f85eacdff95824596f319b55483e8b53d0e6206073551a6d61ef21ca31dbcf58ed08eba8c854863f6c0e20c1906dd6d05d3b472918d2e5c86dfc6a937d8d71d98420265da4054cea8e4642f8a179333f0551fb8b981ab8cf636f99887eb53ef5351a9ef50c4d991e1ccc04f285f7060ba015d2efa2f270de77960127e0c583286619e371875056f57bf44976e46f685cc27988263e655e8"}, @typed={0x8, 0x140, 0x0, 0x0, @uid=r8}]}]}, 0x774}, 0x1, 0x0, 0x0, 0x8811}, 0x4000)
r9 = syz_genetlink_get_family_id$auto_nl80211(&(0x7f0000000080), 0xffffffffffffffff)
sendmsg$auto_NL80211_CMD_CONTROL_PORT_FRAME(r5, &(0x7f0000000140)={&(0x7f0000000040), 0xc, &(0x7f0000000100)={&(0x7f00000000c0)=ANY=[@ANYBLOB='\x00\x00\x00\x00', @ANYRES16=r9, @ANYBLOB="040027bd7000fbdbdf25810000000400ae0008007e0006000000"], 0x20}, 0x1, 0x0, 0x0, 0x20008010}, 0x20000000)
openat$auto_proc_reg_file_ops_compat_inode(0xffffffffffffff9c, &(0x7f0000000000)='/proc/thread-self/net/rpc/nfsd.export/channel\x00', 0x8f3b7a51b8162d21, 0x0)
executing program 3:
mmap$auto(0x0, 0x400008, 0xdf, 0x9b72, 0x2, 0x8000)
capset$auto(0x0, 0x0)
openat$auto_proc_reg_file_ops_compat_inode(0xffffffffffffff9c, 0x0, 0x101000, 0x0)
syz_open_procfs$namespace(0x0, &(0x7f0000000040)='ns/mnt\x00')
openat$auto_snd_rawmidi_f_ops_rawmidi(0xffffffffffffff9c, &(0x7f0000000000)='/dev/snd/midiC2D0\x00', 0x1, 0x0)
listen$auto(0x3, 0x81)
read$auto(0x3, 0x0, 0xf3c)
setresuid$auto(0x2, 0xffffffffffffffff, 0x200)
keyctl$auto(0x5, 0xfffffffd, 0x101, 0x1, 0x4000000000b8c)
sysinfo$auto(&(0x7f0000000180)={0xffffffffffffffff, [0x1, 0x3, 0x5], 0x5, 0x5, 0x6, 0x6, 0x4, 0x400, 0x6, 0x0, 0xe, 0xd, 0xd})
keyctl$auto(0xb, 0xfffffffd, 0x7, 0xfffffffffff00003, 0x6)
mmap$auto(0x0, 0x20009, 0x4000000000df, 0xeb1, 0x401, 0x8000)
socket(0x10, 0x2, 0x0)
sendmsg$auto_NL80211_CMD_GET_REG(0xffffffffffffffff, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000200)={0x0, 0x1ac}, 0x1, 0x0, 0x0, 0x4004810}, 0x8800)
sendmsg$auto_HWSIM_CMD_NEW_RADIO(0xffffffffffffffff, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000000000)={0x28, 0x0, 0x1, 0x70bd26, 0x25dfdbff, {}, [@HWSIM_ATTR_PMSR_SUPPORT={0x14, 0x1a, 0x0, 0x1, [@NL80211_PMSR_ATTR_TYPE_CAPA={0x10, 0x4, 0x0, 0x1, [@NL80211_PMSR_TYPE_FTM={0xc, 0x1, 0x0, 0x1, [@NL80211_PMSR_FTM_CAPA_ATTR_MAX_FTMS_PER_BURST={0x5, 0x8, 0x5}]}]}]}]}, 0x28}, 0x1, 0x0, 0x0, 0x894}, 0x4)
mbind$auto(0x2, 0x1, 0x80000001, &(0x7f0000000240)=0x1a, 0x100000000, 0xad4)
futex_waitv$auto(&(0x7f0000000000)={0xf, 0x5d94, 0x4002, 0x4}, 0x77, 0xfffffffc, 0x0, 0x62bd)
sendmmsg$auto(0x3, &(0x7f0000000080)={{0x0, 0x2, &(0x7f00000002c0)={0x0, 0xc4}, 0x1, 0x0, 0x0, 0x9}, 0x7}, 0x3, 0x0)
mmap$auto(0x0, 0x400008, 0xdf, 0x9b72, 0x2, 0x8000)
openat$auto_v4l2_fops_v4l2_dev(0xffffffffffffff9c, &(0x7f0000000280)='/dev/video42\x00', 0x12181, 0x0)
r0 = socket(0x10, 0x2, 0x6)
r1 = socket$nl_generic(0x10, 0x3, 0x10)
r2 = syz_genetlink_get_family_id$auto_wireguard(&(0x7f0000000080), r1)
ioctl$sock_SIOCGIFINDEX(r1, 0x8933, &(0x7f0000000040)={'wg1\x00', <r3=>0x0})
sendmsg$auto_WG_CMD_GET_DEVICE(r1, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000180)={&(0x7f00000000c0)={0x1c, r2, 0x703, 0x70bd27, 0x25dfd9fc, {}, [@WGDEVICE_A_IFINDEX={0x8, 0x1, r3}]}, 0x1c}, 0x1, 0x0, 0x0, 0x880}, 0x4)
r4 = syz_genetlink_get_family_id$auto_nl802154(&(0x7f0000000040), 0xffffffffffffffff)
sendmsg$auto_NL802154_CMD_SET_MAX_CSMA_BACKOFFS(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000380)={0x14, r4, 0x1, 0x70bd28, 0x25dfdbfd, {0x11, 0x0, 0xfc}}, 0x14}, 0x1, 0x0, 0x0, 0x20008000}, 0x8044)
executing program 3:
mmap$auto(0x0, 0x4020009, 0xdf, 0xeb1, 0x404, 0x8000)
r0 = openat$auto_tty_fops_tty_io(0xffffffffffffff9c, &(0x7f0000000000)='/dev/ptyxe\x00', 0x48140, 0x0)
ioctl$auto_TIOCVHANGUP2(r0, 0x5437, 0x0)
r1 = io_uring_setup$auto(0x85, 0x0)
bind$auto(r1, &(0x7f0000000040)=@ethernet={0x6, @broadcast}, 0x6a)
ioctl$auto_FITRIM(r1, 0xc0185879, &(0x7f0000000040)={0x1, 0x400, 0x1d800000000000})
read$auto(0x3, 0x0, 0x80)
r2 = openat$auto_drm_crtc_crc_data_fops_drm_debugfs_crc(0xffffffffffffff9c, &(0x7f00000000c0), 0x0, 0x0)
read$auto_drm_crtc_crc_data_fops_drm_debugfs_crc(r2, 0x0, 0x17)
mmap$auto(0x0, 0x2020009, 0x3, 0xeb1, 0xfffffffffffffffa, 0x8000)
statmount$auto(0x0, &(0x7f0000000180)={0xa, 0x7, 0x1977, 0x7, 0x5, 0x7181, 0x8002, 0x7, 0x3, 0x9, 0x5, 0x80003, 0x4, 0x200000000000, 0xb4, 0x9, 0x8, 0x10006, 0x4000080, 0x0, 0x0, 0xe, 0x22000, 0x200, 0x0, 0xd363, [0x4000000003, 0x2, 0x0, 0x2, 0xcb, 0x2000, 0x0, 0xe, 0x70624ce7, 0x0, 0xfffffffffffffffc, 0xffffffffffffffff, 0x8, 0x0, 0x8, 0x0, 0xfffffffffffbfffd, 0x2000000000000004, 0x10000000000001, 0x10000000000, 0xffffffffffffffff, 0x8005, 0xfffffffffffffe00, 0x3, 0x0, 0x5, 0x400000000005b8, 0x5, 0x0, 0x100, 0x0, 0x6, 0x100002, 0x88e, 0x40, 0xfffffffffffffffc, 0x8, 0xffff, 0x0, 0x3, 0xfffffffffffffffc, 0x9, 0x8, 0x7, 0xc567]}, 0x1fe, 0xd)
r3 = openat$auto__ctl_fops_dm_ioctl(0xffffffffffffff9c, &(0x7f0000000180), 0x1541, 0x0)
r4 = socket(0x10, 0x2, 0x0)
sendmsg$auto_ETHTOOL_MSG_DEBUG_SET(0xffffffffffffffff, &(0x7f0000000180)={0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x2000000}, 0x4)
sendmsg$auto_NL80211_CMD_GET_REG(r4, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000300)=ANY=[@ANYBLOB=' \x00\x00\x00', @ANYBLOB="1200", @ANYBLOB="5de1"], 0x1ac}}, 0x40000)
recvmmsg$auto(r4, &(0x7f0000000140)={{0x0, 0x2, 0x0, 0x4, 0x0, 0x5, 0x8}, 0x5}, 0xfffffff9, 0x10, 0x0)
ioctl$auto__ctl_fops_dm_ioctl(r3, 0xfffffffffffffd09, &(0x7f00000001c0))
close_range$auto(0x2, 0x8, 0x0)
r5 = openat$auto_kvm_chardev_ops_kvm_main(0xffffffffffffff9c, &(0x7f00000011c0), 0x8c00, 0x0)
ioctl$auto_KVM_CREATE_VM(r5, 0xae01, 0x0)
ioctl$auto(0x3, 0x4010ae42, 0x38)
executing program 3:
r0 = openat$auto_kernfs_file_fops_kernfs_internal(0xffffffffffffff9c, &(0x7f0000000080)='/sys/devices/virtual/block/nbd1/queue/zone_append_max_bytes\x00', 0x0, 0x0)
read$auto_kernfs_file_fops_kernfs_internal(r0, &(0x7f0000001180)=""/187, 0xbb) (fail_nth: 2)
executing program 3:
r0 = socket(0x10, 0x2, 0x0)
sendmsg$auto_NL80211_CMD_GET_REG(r0, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000300)=ANY=[@ANYBLOB="72010000", @ANYBLOB="120027", @ANYBLOB="5de1523353782950330a"], 0x1ac}}, 0x40000)
read$auto(r0, &(0x7f0000000000)='$-]&@\x00', 0x5)
sendmsg$auto_NL80211_CMD_COLOR_CHANGE_REQUEST(0xffffffffffffffff, 0x0, 0x24004000)
executing program 3:
r0 = socket(0x10, 0x2, 0x0)
sendmsg$auto_NL80211_CMD_GET_REG(r0, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000300)=ANY=[@ANYBLOB="72010000", @ANYBLOB="120027", @ANYBLOB="5de1523353782950330a"], 0x1ac}}, 0x40000)
read$auto(r0, &(0x7f0000000000)='$-]&@\x00', 0x5) (fail_nth: 3)
sendmsg$auto_NL80211_CMD_COLOR_CHANGE_REQUEST(0xffffffffffffffff, 0x0, 0x24004000)
executing program 3:
socket(0xa, 0x1, 0x84)
mmap$auto(0x0, 0x20009, 0x4000000000df, 0xeb1, 0x401, 0x8000)
move_pages$auto(0x1, 0x2000000000003, 0x0, 0x0, 0x0, 0x8000400000000000)
bpf$auto(0x0, &(0x7f00000001c0)=@task_fd_query={0x0, 0x4, 0x3, 0x2, 0x8, 0xc, 0xe3, 0x400000000a, 0x3}, 0x6f4)
mmap$auto(0x0, 0x2020009, 0x3, 0xeb1, 0xfffffffffffffffa, 0x8000)
init_module$auto(0x0, 0xffff9, 0x0)
prctl$auto(0xeca0, 0x13, 0x4, 0x5, 0x7)
madvise$auto(0x0, 0xffffffffffff0005, 0x19)
madvise$auto(0x0, 0x8000000000000000, 0x15)
lseek$auto(0x3, 0x7fffffffffffffff, 0x0)
madvise$auto(0x0, 0x2000000080000001, 0x3)
socket(0x2, 0x1, 0x106)
socket(0x2b, 0x1, 0x1)
mmap$auto(0x0, 0x4020009, 0xdf, 0xeb1, 0x404, 0x8000)
getsockopt$auto(0x4, 0x6, 0x15, 0xfffffffffffffffc, 0x0)
mmap$auto(0x0, 0x2020009, 0x3, 0xeb1, 0xfffffffffffffffa, 0x8000)
capget$auto(0x0, 0xfffffffffffffffe)
capset$auto(0x0, &(0x7f0000000000)={0x2, 0x10000002, 0x6})
mmap$auto(0x0, 0x20009, 0xdf, 0xeb1, 0x401, 0x8000)
prctl$auto(0x1000000003b, 0x1, 0x4, 0x5, 0x7)
mmap$auto(0x0, 0x400005, 0xdf, 0x9b72, 0x2, 0x8000)
mmap$auto(0x0, 0x4, 0x4000000000df, 0x40eb2, 0x402, 0x300000000000)
move_mount$auto(0xffffffffffffffff, 0x0, 0xffffffffffffffff, 0x0, 0x91e4)
mmap$auto(0x0, 0x2020009, 0x3, 0xeb1, 0xfffffffffffffffa, 0x8000)
r0 = socket(0x10, 0x2, 0x0)
statmount$auto(0x0, &(0x7f0000000180)={0x408, 0x7, 0x1, 0x7, 0x44, 0x4909b6f8, 0x201ffdf, 0x7, 0x200003, 0x2, 0xa121, 0x3, 0x6, 0x4, 0xb4, 0xa, 0x6, 0x10001, 0x80, 0x100000000, 0x0, 0x7, 0x2100, 0x200, 0x0, 0x84, [0x2, 0x0, 0x0, 0x50100000000000, 0x6, 0x2000, 0x0, 0x6, 0x70624ce7, 0x0, 0xfffffffffffffffd, 0xfffffffffffffffd, 0x0, 0x0, 0x5, 0xffffffffffff7ffe, 0xffffffffffffbfff, 0xfffffffffffffffd, 0x1, 0x0, 0xffffffffffffffff, 0x4, 0xfffffffffffffffe, 0x2000000000000000, 0x0, 0x0, 0x400000000005b8, 0xc, 0x0, 0x0, 0x40000, 0x6, 0x0, 0x88e, 0x8000000000008, 0xfffffffffffffffc, 0x9, 0xa38, 0x0, 0x3, 0xfffffffffffffffa, 0x8, 0x4000000000, 0x7]}, 0x1fe, 0xd)
sendmsg$auto_OVS_VPORT_CMD_DEL(0xffffffffffffffff, &(0x7f0000000200)={0x0, 0x0, &(0x7f00000001c0)={&(0x7f0000000180)=ANY=[@ANYBLOB='<\x00\x00\x00', @ANYBLOB="10002d"], 0x3c}, 0x1, 0x0, 0x0, 0x8000}, 0x8000)
sendmsg$auto_NL80211_CMD_GET_REG(0xffffffffffffffff, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000280)={&(0x7f0000000180)=ANY=[], 0x1ac}}, 0x40000)
sendmmsg$auto(r0, &(0x7f0000000200)={{0x0, 0x0, &(0x7f0000000000)={0x0, 0xfc2}, 0x2, 0x0, 0x7, 0xa505}, 0x800}, 0x7, 0x4008)
socket(0xf, 0x2, 0xfffffff8)
executing program 33:
socket(0xa, 0x1, 0x84)
mmap$auto(0x0, 0x20009, 0x4000000000df, 0xeb1, 0x401, 0x8000)
move_pages$auto(0x1, 0x2000000000003, 0x0, 0x0, 0x0, 0x8000400000000000)
bpf$auto(0x0, &(0x7f00000001c0)=@task_fd_query={0x0, 0x4, 0x3, 0x2, 0x8, 0xc, 0xe3, 0x400000000a, 0x3}, 0x6f4)
mmap$auto(0x0, 0x2020009, 0x3, 0xeb1, 0xfffffffffffffffa, 0x8000)
init_module$auto(0x0, 0xffff9, 0x0)
prctl$auto(0xeca0, 0x13, 0x4, 0x5, 0x7)
madvise$auto(0x0, 0xffffffffffff0005, 0x19)
madvise$auto(0x0, 0x8000000000000000, 0x15)
lseek$auto(0x3, 0x7fffffffffffffff, 0x0)
madvise$auto(0x0, 0x2000000080000001, 0x3)
socket(0x2, 0x1, 0x106)
socket(0x2b, 0x1, 0x1)
mmap$auto(0x0, 0x4020009, 0xdf, 0xeb1, 0x404, 0x8000)
getsockopt$auto(0x4, 0x6, 0x15, 0xfffffffffffffffc, 0x0)
mmap$auto(0x0, 0x2020009, 0x3, 0xeb1, 0xfffffffffffffffa, 0x8000)
capget$auto(0x0, 0xfffffffffffffffe)
capset$auto(0x0, &(0x7f0000000000)={0x2, 0x10000002, 0x6})
mmap$auto(0x0, 0x20009, 0xdf, 0xeb1, 0x401, 0x8000)
prctl$auto(0x1000000003b, 0x1, 0x4, 0x5, 0x7)
mmap$auto(0x0, 0x400005, 0xdf, 0x9b72, 0x2, 0x8000)
mmap$auto(0x0, 0x4, 0x4000000000df, 0x40eb2, 0x402, 0x300000000000)
move_mount$auto(0xffffffffffffffff, 0x0, 0xffffffffffffffff, 0x0, 0x91e4)
mmap$auto(0x0, 0x2020009, 0x3, 0xeb1, 0xfffffffffffffffa, 0x8000)
r0 = socket(0x10, 0x2, 0x0)
statmount$auto(0x0, &(0x7f0000000180)={0x408, 0x7, 0x1, 0x7, 0x44, 0x4909b6f8, 0x201ffdf, 0x7, 0x200003, 0x2, 0xa121, 0x3, 0x6, 0x4, 0xb4, 0xa, 0x6, 0x10001, 0x80, 0x100000000, 0x0, 0x7, 0x2100, 0x200, 0x0, 0x84, [0x2, 0x0, 0x0, 0x50100000000000, 0x6, 0x2000, 0x0, 0x6, 0x70624ce7, 0x0, 0xfffffffffffffffd, 0xfffffffffffffffd, 0x0, 0x0, 0x5, 0xffffffffffff7ffe, 0xffffffffffffbfff, 0xfffffffffffffffd, 0x1, 0x0, 0xffffffffffffffff, 0x4, 0xfffffffffffffffe, 0x2000000000000000, 0x0, 0x0, 0x400000000005b8, 0xc, 0x0, 0x0, 0x40000, 0x6, 0x0, 0x88e, 0x8000000000008, 0xfffffffffffffffc, 0x9, 0xa38, 0x0, 0x3, 0xfffffffffffffffa, 0x8, 0x4000000000, 0x7]}, 0x1fe, 0xd)
sendmsg$auto_OVS_VPORT_CMD_DEL(0xffffffffffffffff, &(0x7f0000000200)={0x0, 0x0, &(0x7f00000001c0)={&(0x7f0000000180)=ANY=[@ANYBLOB='<\x00\x00\x00', @ANYBLOB="10002d"], 0x3c}, 0x1, 0x0, 0x0, 0x8000}, 0x8000)
sendmsg$auto_NL80211_CMD_GET_REG(0xffffffffffffffff, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000280)={&(0x7f0000000180)=ANY=[], 0x1ac}}, 0x40000)
sendmmsg$auto(r0, &(0x7f0000000200)={{0x0, 0x0, &(0x7f0000000000)={0x0, 0xfc2}, 0x2, 0x0, 0x7, 0xa505}, 0x800}, 0x7, 0x4008)
socket(0xf, 0x2, 0xfffffff8)
executing program 2:
socket$nl_generic(0x10, 0x3, 0x10)
mmap$auto(0x0, 0x2020009, 0x3, 0xeb1, 0xfffffffffffffffa, 0x8000)
prctl$auto(0x1000000003b, 0x1, 0x4, 0x5, 0x7)
openat$auto(0xffffffffffffffff, 0x0, 0x8, 0x8001)
write$auto(0x1, 0x0, 0x80000000)
openat$auto_dvb_demux_fops_dmxdev(0xffffffffffffff9c, 0x0, 0x200, 0x0)
openat$auto_ppp_device_fops_ppp_generic(0xffffffffffffff9c, 0x0, 0x80080, 0x0)
setresgid$auto(0xffffffffffffffff, 0x28000000000000, 0x7)
r0 = syz_clone(0x11, 0x0, 0x0, 0x0, 0x0, 0x0)
r1 = getpgid(0x0)
kcmp$auto(r1, r0, 0x1, 0xffffffffffffffff, 0xffffffffffffffff)
r2 = openat$auto_tty_fops_tty_io(0xffffffffffffff9c, &(0x7f0000000100)='/dev/tty48\x00', 0x800, 0x0)
ioctl$auto(r2, 0x4b65, r2)
ioctl$sock_SIOCGIFINDEX(0xffffffffffffffff, 0x8933, 0x0)
mmap$auto(0x0, 0x2020009, 0x3, 0xeb1, r2, 0x8000)
sendmsg$auto_NETDEV_CMD_QUEUE_GET(0xffffffffffffffff, 0x0, 0x4000)
close_range$auto(0x2, 0x8, 0x0)
mmap$auto(0x0, 0x2020009, 0x3, 0xeb1, 0xfffffffffffffffa, 0x8000)
sendmsg$auto_NL80211_CMD_GET_REG(0xffffffffffffffff, &(0x7f00000000c0)={0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x4004810}, 0x800)
sendmmsg$auto(0x3, &(0x7f0000000080)={{0x0, 0x2, 0x0, 0x1, 0x0, 0x0, 0x9}, 0x7}, 0x3, 0x0)
r3 = openat$auto_kvm_chardev_ops_kvm_main(0xffffffffffffff9c, &(0x7f000000fc00), 0x3, 0x0)
mmap$auto(0x0, 0x400008, 0xdf, 0x9b72, 0x2, 0x8000)
r4 = socket(0x2, 0x1, 0x0)
bind$auto(0x3, &(0x7f0000000040)=@in={0x2, 0xffff, @remote}, 0x6a)
sendmmsg$auto(r4, &(0x7f0000000140)={{&(0x7f0000000040), 0x12, 0x0, 0x4, 0x0, 0x7fff, 0x4}, 0x80000b}, 0x5, 0x20000000)
write$auto(0x3, 0x0, 0x7fffffff)
recvfrom$auto(0x3, 0x0, 0x8000000017, 0x10e, 0x0, 0xfffffffffffffffd)
shutdown$auto(0x200000003, 0x2)
ioctl$auto_KVM_CREATE_VM(r3, 0xae01, 0x1)
mmap$auto(0x0, 0x400008, 0xdf, 0x9b72, 0x2, 0x18000)
executing program 2:
r0 = openat$auto_kernfs_file_fops_kernfs_internal(0xffffffffffffff9c, &(0x7f00000002c0)='/sys/devices/virtual/block/ram3/queue/iostats_passthrough\x00', 0x80302, 0x0)
r1 = socket$nl_generic(0x10, 0x3, 0x10)
r2 = socket$nl_generic(0x10, 0x3, 0x10)
r3 = syz_genetlink_get_family_id$auto_l2tp(&(0x7f0000000640), 0xffffffffffffffff)
sendmsg$auto_L2TP_CMD_TUNNEL_CREATE(r2, &(0x7f0000001040)={0x0, 0x0, &(0x7f0000000280)={&(0x7f0000000000)={0x5c, r3, 0x1, 0x70bd2d, 0x25dfdbfd, {0x1, 0x0, 0x3f00}, [@L2TP_ATTR_OFFSET={0x6, 0x3, 0x7}, @L2TP_ATTR_PROTO_VERSION={0x5, 0x7, 0x58}, @L2TP_ATTR_CONN_ID={0x8, 0x9, 0x8}, @L2TP_ATTR_PEER_CONN_ID={0x8, 0xa, 0x8}, @L2TP_ATTR_IP6_SADDR={0x14}, @L2TP_ATTR_IP6_DADDR={0x14, 0x20, @ipv4={'\x00', '\xff\xff', @local}}]}, 0x5c}, 0x1, 0x0, 0x0, 0x4c019}, 0x0)
r4 = getpid()
process_vm_readv$auto(r4, &(0x7f0000000080)={0x0, 0xfff}, 0x1, &(0x7f0000000280)={0x0, 0xffffffff}, 0x6, 0x0)
r5 = openat$auto_nvmf_dev_fops_fabrics(0xffffffffffffff9c, &(0x7f00000004c0), 0x101202, 0x0)
write$auto_nvmf_dev_fops_fabrics(r5, 0x0, 0x0)
write$auto_nvmf_dev_fops_fabrics(r5, 0x0, 0x0)
prctl$auto_PR_SET_MM_START_STACK(0x95, 0x5, 0x0, 0x0, 0x6)
stat$auto(&(0x7f00000000c0)='./file0\x00', &(0x7f0000000100)={0x9a, 0x100, 0x8, 0xb, <r6=>0xee00, 0x0, 0x0, 0x2, 0x3, 0x5, 0x3, 0x7, 0x5, 0x3, 0x0, 0x4, 0x6})
sendmsg$auto_TIPC_NL_KEY_SET(r1, &(0x7f0000000380)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x2000000}, 0xc, &(0x7f0000000340)={&(0x7f0000001080)={0x1810, 0x0, 0x800, 0x70bd28, 0x25dfdbfc, {}, [@TIPC_NLA_PUBL={0x1780, 0x3, 0x0, 0x1, [@typed={0x4, 0xa0}, @typed={0x8, 0x13e, 0x0, 0x0, @fd=r2}, @typed={0x8, 0x51, 0x0, 0x0, @pid=r4}, @nested={0x1ae, 0x134, 0x0, 0x1, [@generic="3f74007cf8216c93f7f106e28c20943f34e65ec832411016497e483652e7550fe0101174f511f2ed4c9f171e443ecf965a3393ce09132ebbe53e6507a8b14ec350bff171c838d43899f7d5d8fef51c2ab2d10a1b3845d9fa42a03ce6c6fefa2022d1879ab3a78248fed9e8dea2691a521a57e1e2aa1812c7b13b56b781ed7dadf92ed58728dfc3d9a8f70d2a65117d1d9b0346dfb5680f89128236a8f783953c6e64dbc879b166554bbec4343328e89bf966", @nested={0x4, 0xb2}, @nested={0x4, 0xe3}, @nested={0x4, 0x6f}, @nested={0xe4, 0x72, 0x0, 0x1, [@typed={0xdf, 0x5c, 0x0, 0x0, @binary="8639085f4dab6f652f0c8731f21b5f4ff470001bc7872f6a894ffd577d0c5128b65d6fb4b18be68f28113a0d9d7ef8781a8a996ad4d0f5bd89e31fe08798fc115855735af81c8790d23457d0d28915f4f13dba152d344d0ad27f602309a122a3ac1328226702917fee850b82a3a77b6c40f16c0c60b06f9b1da972938e3c909972fbba8a4db784634003a79b6b71cf0221443639ddf3b695c2d8d60693564eeab5454db2920546961073d1c329ccad9b99e19a6fdd105eb5d1b953b0924441d890ce9fcb2aa90211cf34e16864c975e821c44743d6c340aa392443"}]}, @typed={0x8, 0x68, 0x0, 0x0, @ipv4=@dev={0xac, 0x14, 0x14, 0x1d}}]}, @nested={0x15b7, 0x1, 0x0, 0x1, [@nested={0xea, 0x7f, 0x0, 0x1, [@generic="30f498d8ba7ccbb263ea2b1c70913a51bd4f945e562bbb203751f199f9311aa60fb5a2dab43c8f8b86483a132046a0da12eea866c552a027f855466c8f444b60d2d9d6665f6c2e6be94c87d88c31960151cb3b90e53b69ba5de75df1617bafeba6e850f7e2ede1fcc7c8dec6490f2e04ad7dadcd89ce6c67bd48a8e8242f7a9977878fa7444f9fe6555117a073c921160e4b3292d44e921bf94eb5cc7d0f51b8930bc53f2d3e6ac53aa3be3297f45e62f9f189b8c2b7dfd57005fb0c27576074c77fdd149ead1bfdfb4329b040cf16e285104a0c22e41008f7c224d3e12b", @typed={0x8, 0x62, 0x0, 0x0, @pid=r4}]}, @typed={0x9, 0x83, 0x0, 0x0, @str='\xf9})\xb5\x00'}, @typed={0x8, 0x136, 0x0, 0x0, @uid=r6}, @typed={0x8, 0x23, 0x0, 0x0, @fd=r2}, @nested={0xe2, 0xd, 0x0, 0x1, [@generic="45b415df6e1efa332ab11a6e453257f273132fa34bc8b77a0d6b0c7ace8513803f5a1cb1156876b226d39869c85fe3b170e9ad58466bde972b84191d99a5ab41cb05f0b588fc5619873d504c0835c7c9c23374340000030ad94793888c151a6b8cfe4dbeb7544d8d4ddc", @generic="5b1f3f84a94bbf3a01986e1334d365b98ddd4f9a80da80394ef62301da97aa0a0baed54b5dd24d9909ad25f3946e3012f8f6dde3c65f28d9c7955654a055980d47ef68a9c5755f56266527580e9500eae0f1c663f765769e83b92b32801eadfa2fc352f435f07e28874d9ca11884149f79583385"]}, @nested={0x1d4, 0x4b, 0x0, 0x1, [@generic="37e71a544d1fd1f6d3863c9044a067eedad18784b7347ca7d4a3ac6757b28a6ff331c3acf8ec679be8f9c2566a61d28bea9bbf4b9018566163bd231a424e35964da54e43e9b608ce1f224e35466f356904f4729773aa495d6628d74f309a09a4c4f7796e4ab435eef7424b582f8c273d8ab251499ead1f07d58abd38cce5314d120f98cbd9395e95449eecea5687e9a6197490813990534a179967bc6b689ef46551290c6efe80b25b3d44c7bb45a46276ec1edc9303f64c04935674aeff1f28b2eec759db3104917c24f49bff6678aeca5e0319332a01385a", @generic="8375f0b5247ed3d6921813a6a10f081d686680d361d51386e07c5f5a09d25806f67eee9e15ddb3ea11cb16a2df220bb34d166d70a42fb754c086f71405246cfb3d008917c29ea104205e2e521bbab2291970d68c45b5f3bea7720c966a1ce4d63f8f6ca0860b652b5497613e2eabee57cf1b335176110e32ab252ca7adbe0573ed48a31ea091cab9321eb6242a07357aaa9adfbeb9a36598697edfe70966877db021003a6d2efe1a0019bb8b144f59424c4d248b69c32400418c5f312dad674ccd07f7d35371bafc60d1bbd86334320c67ad33a4e51bd925628786", @nested={0x4, 0x1d}, @nested={0x4, 0x105}, @nested={0x4, 0x20}, @typed={0xc, 0xde, 0x0, 0x0, @u64=0xf202}, @nested={0x4, 0x1d}]}, @generic="3db2dea5ae6f1c330670f4c839e550fdd362b4fd3eb77a7f6720b6f8773053a3b5bf33e60485ddb9e8de06a9050e4dec0463807c383d24be4c90ae70c9b5e2ec6b640b7cc3de7b0b4313241a7ebc5e2f7314494657918f058c09927283cbacbb19f46b3890665b527c1c002ee94f491454377ef0281582edafc68ac8d76f8c2d340ad2f07d505d84d019c7e0cbbdf1df82adead52c7a8e33567a1e48376a9c9081e37131b8070db74a5a7f547be2adbc0271fcc7c6082ea6a92e22003b8362a77151f89b5f8924da98767d004dff7507b6c2928b28f48acc00a5b2c89dc4ec51c0679d2d0f3c7f5405fdc37f467df0d7a4e503958a0bd29405ec55cf737c94a258c775c3b8b126204d68752c8214d55970a029cac48b021f2a5374871fae934f1cfc15a3c49792ac84f89cdbed122fb91b648a91ea1eb807ba20397556e191c2ddb987ff500fcf3dd2f232bd79e61d486d3fc5e19049bff76a9e1df67285b2dc1e112a27fa42a35a1b2ee8b57d3618c3298a999aefe527e24a9122249be58c499e6cfa1d912c36e01c02e1457b0088fd03c04f87e33bf7cf906683e4c4a2fc804b2233f63b58ce259494a9ca378f39b7c4d25a8340ebb233e4f2083e59efd0f65f21128d917f3b4d5cce592a35b52dfd86300b9c01f7f2a2b97f7fe487cbb09707f130c08942f4a4878bb90122df1139754bd161510f7d0cb4372b70e6934bf8cf77397450866ba350dd50890280e442d5fcad909dde13aea60b6a1d72fca35a624977d5b6e36ba0fc683301a78b3caedb3a728649e03efa2b64522f753dcd6fa43d5e142aeed05a45f02cf89e909b65d24f492cb872db8457c0307fd78db25afb4be57450ac7dc5675e6657dbc382853fd20f68de75c20a7bd22760e5d1dace835c719d1fcc9e0fc1503b2832e8d291ad1fe8325ab6eb8271ca73aafa5decf4620f3d13655e463be3b58102a023d26f9595698b88ca5d5a2e27072c95e44a52ac2f0aeaea9c3e2f50e420f28da204242ede123aa3136ceb13e7963099c2e36208592088ec5f7bc3bc81604ba179ab3244f2c75c3a17764b1ea6d4f16cbf6f921de77d89685fc7c767348ba753944f4e6acb3fff7d7e2c14d272dd8b0d65275693ce970c19c1b9ab25240bb81de7035a1cf5d49fc941af6c46ae31d0c693ddfc15796781c2c93544f8eee398ac65157155a8d3e820fc83d5469ac0a0753332f32d471202dedf9329ecccecb293ace723fb2516a90053cca718dce686056f139e825476d4007021460217ad1472158bf6320eee5bbcd8d45930fac59209c4abb04a341e394129f3bd75a488ed9118a65a3328f1cd5c2556b1da01abf48752fff081bfbc63cd2b25788917dc8563aea774dd46c9facf127e88c07209bbd71aeba29028fba467daf489eef52c123021c0e62357e103c4e42e0c29406525ed9efaf75478e802b4093d0ae0c7700b81a5773365776bbd751a93abb97072e497238aaf6f7c59d17fb9cb89e32b9d13413b62ae869f6a98030c63722ba4089384cd7f0b4b4cb65de2bee537f700b053afd7cd5248e6dab99140d6ea7b235fca2cf75ee4e98e1d236f8ca0d4b29624c220597508efdad7afe0f18d3a3457ea5eaf36064a6d72facd8c6bf4c8104bdd8d11421defd8f5dbbfb43f6b4dab5546225240852f339122184a8c331a495cf36423a52a7dff9461d7ac1dae4a7da523607b4473a2a5189c4179daeabe10405887b70ad83fc390289ad89035a04ab077c2563d7d2bd14ee4e9c76e213fd8fc9a3ca4aaab98c2795b565a525c665361a0276f1d1622f6606b46620b1f12c1ab420548c00d8f8cbe0370cd11646b31e7f406efcbf823636f625659b44ae390da6200869c48b88d82b7fce5eca4df70795c36d6249d6a07a62757f77fcf20f48bf0aa0d2fffc3fd12a9f175580a04ddccf21c131f6aeb3ac670431859073d1e06cbb25e7b45c8b0288e9aa29ba172469022322748af09d787e7f1709a9db35e40100746b390233f4112c40e3cd83a77411ca321ef3e336840779e89ea83633b8feef38867b1dad8077a4315cd617ab409fd6898569857c512963fb63f469b176a57b70c62686ec7bbc29c954682029bf6c75df7caa85a943965290bfad738b7f8c5ead8e133af39bfa9a0c29bc751399e8ea401505af6cde1b39c7f4e0fd10adc4f31401578494ae72dc86bb9bcf9136d9fca5847b08f4f4821d19bf28aed830e6c57b59740d6692d693268d83c0b559a963a1a723ed9e189261fd6d97592d49d8b8d58960bc0c2e8aaeb3b268cf96059b0dd480726543be6155dfab263eacc4ed773c28a53cf62a584e55eac04c1ad91ea62d6e92ab5450af90d546d25849ee4a4636d89f735a8411febfdd40cc85767d494d4c5bedc70f59ff482f473cf3b2795cc7bee41871943f908de5fd4fe879a5a1aeae64c9b69f52be9cfb5a11411d9cc1dc20e5e88329cc17731447a7bf201c807ee13acd5e1c1884f08890e924e7883d89f15b9814f6ff919697647828dfe1a172b5d1167415cd8f32cf6b511ae2c03b1492bcd5a8a2fb85fba2e998d772e3cca76b4b81d62e628a7a25678cc3a6cf556d43087732077e3fa61d193d49efbd1c29432c211244e1731a08a171507f0d63ae4c60b01533cdf81713340c9f474c4fbaa6eb801212d2f0cf65b394da4a25ff89d5696b3123f56e26f5f1e95d2c055c73fbbaeb63fc5fcde99a88f959b109170fe1fa2b837fc07dff9f94c95fefa1a7a870bf4fedbd099176accf500534711e1c4d389bcef19e7144d8cf9519b2d44a8ebe5da7c4e89861261e69df204524db99530affcc3f890cd857028e8a5330cf3667118360f198d3211cef7d9bb02090eba7f36ec16f385978be0c486d46a1ca5c8de4822c2c70d8203edd983127bf1a37edc38e96ebb9fedc18e706a1bab959c07e282926c206f6e9f00c9b1f7cee5492cde227fd92483beed255913c301c9ed217c8b1bac85a1eef438094bcc64e6a9a4c7e2fbd0cdeed9cc68dc50b49694d78a3fbcd9e206d95fd081054ba543a6041122b702e84ef59bc6b3554dbb436cb7404ee5e6fb3410f2d5f94da1a43e170a5e7f9118e3a9f764b6d6b3e52f314aace23df883415e1bdeb96e8b21328987731192ccb7e785bcd43df7c6555a03255ae8eb28c5a20477e2c6b077c5a073a107333fb43c22d36fe4bf66a84b83efb424a2bfe5f406bd05e43baaf4c6cc4a96797d5da7c0782f048b071e974f419097ddd4785ba6e2b5e7088cfeb0ffad6a36989409666265bbcfece2d8eb601e6c95dc8aca77a2df99a46ea363a38144e7c957aa666bb42f2e97a0b3197cbbb3c0d5d35cd9b4044162738c47fcb8a78c46da6802dafedb8ba69f0a653bbb9649e77b1107b62e2357a8c11bcf82798b7db847de03589946089a66938d690f7c7ae20d1cb9c9401ae911f698f13e8090b9b09a40e7c7c1065ede2e72c369cdeb9d7501ab3d2190b566fada98efcdebbad6066c2f72ee3e4cc021e08d11f9378095f78532e1c994ede51792b32f76456af8b9fcc3b07f9e3a04f9e7e641e5454985f53ae0c2e1f5f3021eb1098c4ffb435c155fb34345771df10d9cffdd8840f2c1e7c41e85725c839111466f57fc1fea9753715cb05d354ac0c9ca3595854f4c2df213227d6e86b4ececce31d380caf0b36b252a0c39c73b9a6f6729dfcc4b49b450da30c9c29d7bcebc60a86faaf337bebccf8f5392c6cbf7c7fafe6c0b828c12a9eca2474bfdc0a29829a3f73fbfcd123a8afaee3f9f9ddff79683aa40ed943712544fc186eb066778090594571b074b5f2b3afbdb491a3f6dcfe4bd4b524391829dbbbd73e36e8bffcd22aaccb49a4f831fa6731f1d618354d4a700cc1ea0506bddf76f2fc720539981b00f1744ddc33bfc965599cc7c3cdbb2596684c300ae65703c1196659a6e15ebbde08e87ea889c00996054f9d99df98367df40342b75a7c142f13cc9b97c0dec556e69a9737c485ad6b0522944094de584661e5279eebdad5a48d822d74f37ab91e50d4aefbfcef9466132aba8875bd18d987bcc4edf6790c8eaf22dcef8a053a3d4d39218934bca578d708315aad24868c706fa34c85699a308ae39a881dfcf86fd1d0b30f6494180acadad637c72850c7be3a0dd3aa71614c566e17f3783653ae64dc1317b0069feb62c3b1a34ff18bc1f1013cec721338714afdf8a7db2f917e075f2de8a6ceba096bc4e6e142b0a335e6663fd82cb95265ca24375094570a4297a579b589849e14f0875cfbbb92c0f191e93bebfd158b56096b3b68e3273a497e7147cb148a65804d39cc3799d87ae26ad7a245f8a483dbaf10a5fd477927235cbfa0b31e1d633302f8989da5c9afd4ea6e93f6a017b3b9f45400f5b9c0115fbac884a33ea815ddae71327d0371eed762b56d0e5faafbc275726adc639645edc94bf28633f1bd30d62101edc959f312c14c65300586950c9eaf31426f1419f64e6f1918739b34a013df9fa724b14650c4c693823096bbfef32619a4f4aa4588c45d453485fd2234e8ca17bee9fad440631977682563033c153a709d794a788661348d28b97b1861adb7ad75177b1662363020587760f32ec937cf1073dce02721d3375370cc68366fc40226ca0c81ae4160e8eaeade80b673b0edd48c4bfc0663526df1eeb0c5391a9b1f2235e1731efe92aa6ff4f0363cce74128c347c0327bda48caa87f31bc5dd7528db4a81e923f546b4b760fd94562f750dc225b0caa149383ad7b6798d1d56cc17cea0ef5689abead36afa42792f44081823cbcf4fe7bfd15df6de5930f102130c3a749a1439e11bf34d024820c10d71b8c2cc8eb0e9ad587439c5a2e1aa2f32efd620c75a8bdb65fdf4f3494fb23241548321edcfa72573c29071d50cdf19adbe9f520d83dd45994b4bbd828bd157b5b9a1b42428118994a2ac14cadbea3446852db1ffd6f8e61471028243bb9355483fcb621feae842e94f94ec9f7bcdf9af6f8638c4949e612fb6d1d4e218be9487b77a5d2daaf68a6488a8f18ac9f37a25543dc6080dfd17903ed005273200371332ea51d75f7a7e2c8b413eaf099201b565653ce7a1e98dfd8ca953da58d5fa04c5cd3244c480c96f0c4e4c0f0284ed8c70b954e6a26c9a852437fd31df867892250af5db38d4fae3b5e7f55fc2b669004fb1fc46b1bacf522756ab6234e011a80043b39bcd60f991cf116a658b33c9960f6e8c6c63ab48415f2441896ce5fe302899964217054460192cad0926ee2374be57f500b5326c9272123b7d977251748a122597eb5d19382f7f4d6ac361f259a372fbb736e95dfed4a832b9d77a997598f431dbf615580f2ce4adc6f3cf72e4ef647cb870afbed67b803ba88e6ef4134454308e5d68fba6643cdf07170188ac36a165317e1e1ff1ccae0c04b6df2dfab2dd784e9e7f2194b8e85b1d98efb7e4885a55783995ba9e74f2b231ddc2d9c0c5d9322d0ec3ccb5510d75bc00c8a9fc2b9fd9c3f315e1b259e71cccb58645db60fcf550fd15bef87712f8b27aea1197b45afc78fa37679553bae82b9c913a8b9c742dff6e6f5f5bfcaf49b72812653a835ad59ccfb2b7be59301efecbbab8c758252f471dbcd38329059dde96b3a2160ec978eccbb2f017db037f26286ae64b988a1734f87503ca89407b7c7ea9855dbefebc49d1dc691c8521c76e3bc0d3bb2c6ff1ac90e441c228aa5b2453f6ad794bc9bb9c57d18b55f4203ded793600c76801524c5f96238176ed553887981ca2b29661c45b92f236f211cf5ad87eb7325df", @typed={0x8, 0x117, 0x0, 0x0, @pid=r4}, @generic="7848392974b3c06a0ee27f7affa7a40607c7f0a2361822dffd7623956feadd6cb6ff3739725ef9e7aa540617688bd74ba7d7a7a6b4b71e6c03fab9a092704f34e04a5fdd87c4a2ac2a20d547216225be36853e2e69269e1cd9e469fe0d95bcfe8ec6cebf55079a29d22173b07c5afaa1d9921b3fc953f1183b9473970bd1bd1b3a83207cb26476d651f45c72104a4a1b1b6a6b60fc06331dc917b25fd84c0c8ffb7d72b2134b2b05c805195a1629a79badb6e383dff974291f566e319a8dc5547e93590f67a23b80a5236d612e20bd291ac31a482a12964cbacaacf2f6d12077ebc28a593b25afcaad91c96b4e83e5d1164db2", @generic="c92ccdad86ab559b20c76a0e6876ad09b40528860beb76a40c3748f83b08735023fc623d3176c1ca2eaf02f52ea8a5f0a009cf3eaa69d978cfb3fb71657b0663d069ff3418702ebca2b92ca6f4718674028b5ee3a5e778175a3626fa95ee62389d30a8a8685bed79e6be1adf6d8e598c437b4976f0c6912f66a93b5a1bde97b1c8a7b472e42cad18992b00f5b7b9b1961e497d994a826760e18e76290b92ab3e8b25776a70a221d7d9ee9295c0a60e7ec0fc3171d07aa1b743f385f03d3ca6aebeac2b1bae4f0870f5a2c6289b7684cfe530d4abcbf1838ffea022b7c6ea68448ca7bac68359f9bdec78581c41cb7f1c751cfb1e8335946a"]}]}, @TIPC_NLA_NET={0x7a, 0x7, 0x0, 0x1, [@typed={0xc, 0x4b, 0x0, 0x0, @u64=0x2}, @generic="bb645bc1680e23ef9375f4ba97b28d2fa6883639aa178ff52e3f5816b4e289841d2f18d11780f0b2993944eeac4a6e1e0e24e1e7617241de0e34dfb219e277911f360a2049ad745e9562a0d645266e63fbca0d5e42d9fda7031dfb38300ff582707b8361c1560cbd8f62"]}]}, 0x1810}, 0x1, 0x0, 0x0, 0x4}, 0x4004810)
mmap$auto(0x0, 0x2020009, 0x3, 0xeb1, 0xfffffffffffffffa, 0x8000)
madvise$auto(0x108000, 0x800034, 0xa)
sendfile$auto(r0, r0, 0x0, 0x3)
executing program 2:
mmap$auto(0x0, 0xe983, 0xdf, 0xeb1, 0x401, 0x8000)
sendmsg$auto_NL80211_CMD_GET_REG(0xffffffffffffffff, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000200)={0x0, 0x1ac}, 0x1, 0x0, 0x0, 0x4004810}, 0x800)
bpf$auto(0x0, &(0x7f00000001c0)=@test={0xffffffffffffffff, 0xffff, 0xfffff0b6, 0x5, 0xff, 0xac1, 0x2, 0x36242398, 0xfffff5b2, 0x3bb, 0x7, 0xffff, 0x800, 0x81, 0x68198}, 0x6f3)
r0 = socket(0x2, 0x1, 0x0)
close_range$auto(0x2, 0xa, 0x0)
r1 = socket$nl_generic(0x10, 0x3, 0x10)
socket(0x2, 0x3, 0x2)
getsockopt$auto(r0, 0x0, 0xcf, 0x0, 0x0)
r2 = socket(0x2c, 0x8180b, 0x67)
sendmsg$auto_NL80211_CMD_START_AP(r1, &(0x7f0000000740)={&(0x7f0000000480)={0x10, 0x0, 0x0, 0x4}, 0xc, &(0x7f0000000700)={&(0x7f00000004c0)={0x228, 0x0, 0x200, 0x70bd29, 0x25dfdbfb, {}, [@NL80211_ATTR_TDLS_OPERATION={0x5}, @NL80211_ATTR_PROBE_RESP={0xc6, 0x91, "b115c623f370c56f66e456048653950cf0eeda7ef15a981dcf6426abe06771909f0c689d6916de5759cd95f560b5c3e6e15bff365d33dab578ca3c52377279aa39baa39fa37d74c2ca190fd0e761869db0b8a6d12c1d6fa32744fceae6bbcbf12289ec19320c66a94bf68f03959a45dbb0eb013b32aaea2d15c03b2528245c77ad243fae4279281e7efe2137d9a895c480d01daceeb32eb1544dbba3381907ebef1d013ebb918b442034d27b9086282d5b6e527edb6410e9c9a2a3e2eb7a154c979b"}, @NL80211_ATTR_SCHED_SCAN_RELATIVE_RSSI={0x5, 0xf6, 0x10}, @NL80211_ATTR_MU_MIMO_FOLLOW_MAC_ADDR={0xdd, 0xe8, "f7523d62b236edacfea193cc0643de264f4a95bc101466455723af7209299a6e8d10a673e95297c7bbdb2f0d795f264cc30ace286c314b2d2243ba81e6c6324471d7d3ef2ac8e5e911f3921e3d36b349665f09672808971993adacd8ceb6d503b959383e804ca42b50497c33bcf21a8d1e70a3ca3804800e4f8fd6267e07f191ee0851d48b8d379b7a6120fd13de484ac83b774ba13ebae2ac030db2d87697191f6ab3c4c76e5bf59711bda8fdf7804205254490d595036f47d602e4c3bac1ce35f7d2158e3edfd56e98fccdb024731d0409e9249d0da042ae"}, @NL80211_ATTR_LOCAL_STATE_CHANGE={0x4}, @NL80211_ATTR_CENTER_FREQ1={0x8}, @NL80211_ATTR_MESH_CONFIG={0x50, 0x23, 0x0, 0x1, [@typed={0x4a, 0x13f, 0x0, 0x0, @binary="24bf0b1e106524fe2723887c2b056908df8d79f4fc1dcbf7886d5fd573fbd665d81e86799e2a7e728ef1bf4c1c79c5bf5a3f378727468f4c213251f73759df25d357d3b6821d"}]}]}, 0x228}, 0x1, 0x0, 0x0, 0x4}, 0x20000040)
sendmsg$auto_ETHTOOL_MSG_EEE_SET(0xffffffffffffffff, &(0x7f0000001700)={0x0, 0x0, &(0x7f00000016c0)={&(0x7f0000000100)=ANY=[@ANYBLOB="d4000000", @ANYRES16=0x0, @ANYBLOB="100027bd7000fbdbdf2518000000200001800247eea41fac000014000200766574683100000000000000000000000800070063fbffff0500060001000000840002803d00488013b37090badc49d6dc93876646d25a4d297d01cd3b7da38d12889cc50d505f353dc42d0a3c0a14c7b46428910708003600", @ANYRES32=0x0, @ANYBLOB="0400b3800000003d003b800400a4800c009a00008000000000000004008680c16ab1b1b39dcaa14b6af7dcc011b43cf706e562811c62b28a702b72e0a87126700294f2350000000c000180080003"], 0xd4}, 0x1, 0x0, 0x0, 0x20000010}, 0x20008000)
r3 = clone$auto(0x20003b46, 0x2, 0x0, 0x0, 0x2)
socket(0x10, 0x3, 0x0)
openat$auto_adf_hb_cfg_fops_adf_heartbeat_dbgfs(0xffffffffffffff9c, &(0x7f0000000040)='/sys/kernel/debug/ieee80211/phy1/netdev:wlan1/smps\x00', 0x20a00, 0x0)
mmap$auto(0x0, 0x2020009, 0x3, 0xeb1, 0xfffffffffffffffa, 0x8000)
sendmsg$auto_NL80211_CMD_GET_REG(0xffffffffffffffff, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000200)={0x0, 0x1ac}, 0x1, 0x0, 0x0, 0x4004810}, 0x800)
sendmsg$auto_OVS_PACKET_CMD_EXECUTE(0xffffffffffffffff, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000240)={&(0x7f0000000040)=ANY=[@ANYBLOB='@\x00\x00\x00', @ANYRES16, @ANYBLOB="1b0026bd7400fddbdf250300000004000800100003800c000980"], 0x40}, 0x1, 0x0, 0x0, 0x4004040}, 0xc800)
sendmsg$auto_NETDEV_CMD_QUEUE_GET(0xffffffffffffffff, &(0x7f0000003040)={0x0, 0x0, &(0x7f0000003000)={&(0x7f0000000040)=ANY=[@ANYBLOB="1c000000", @ANYRES16=0x0, @ANYBLOB="010600bd7000fbdbdf250a"], 0x1c}, 0x1, 0x0, 0x0, 0x20040004}, 0x20008810)
syz_genetlink_get_family_id$auto_mac80211_hwsim(&(0x7f0000000040), 0xffffffffffffffff)
sendmsg$auto_NL80211_CMD_GET_REG(0xffffffffffffffff, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000280)={&(0x7f0000000340)=ANY=[@ANYRES16=r3, @ANYBLOB="1a00"], 0x1ac}, 0x1, 0x0, 0x0, 0x81c0}, 0x1)
sendmsg$auto_NL80211_CMD_GET_REG(0xffffffffffffffff, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000040)=ANY=[@ANYBLOB="72010000", @ANYBLOB="19"], 0x1ac}}, 0x40000)
r4 = syz_genetlink_get_family_id$auto_nl802154(&(0x7f0000000380), r2)
sendmsg$auto_NL802154_CMD_SET_CCA_ED_LEVEL(r2, &(0x7f0000000440)={&(0x7f0000000300)={0x10, 0x0, 0x0, 0x2}, 0xc, &(0x7f0000000400)={&(0x7f00000003c0)={0x14, r4, 0xf08, 0x70bd2a, 0x25dfdbfc}, 0x14}, 0x1, 0x0, 0x0, 0x894}, 0x40000)
sendmmsg$auto(0x3, &(0x7f0000000080)={{0x0, 0x1c03, &(0x7f0000000000)={0x0, 0xc4}, 0x1, 0x0, 0x0, 0x9}, 0x1}, 0x2, 0x0)
close_range$auto(0x2, 0x8, 0x0)
open(0x0, 0x22040, 0x75)
r5 = socket(0x10, 0x2, 0x4)
sendmsg$auto_ETHTOOL_MSG_WOL_SET(0xffffffffffffffff, &(0x7f0000002cc0)={0x0, 0x0, &(0x7f0000002c80)={&(0x7f0000000180)=ANY=[@ANYBLOB=',\x00\x00\x00', @ANYBLOB="010027"], 0x2c}, 0x1, 0x0, 0x0, 0x4801}, 0x0)
sendmsg$auto_NL80211_CMD_GET_REG(r5, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000180)=ANY=[@ANYBLOB="72010000", @ANYBLOB="12"], 0x1ac}}, 0x40000)
sendmmsg$auto(0x3, &(0x7f0000000080)={{0x0, 0x2, &(0x7f00000002c0)={0x0, 0xc4}, 0x1, 0x0, 0x0, 0x9}, 0x7}, 0x3, 0x0)
executing program 2:
r0 = openat$auto_bsg_fops_bsg(0xffffffffffffff9c, &(0x7f0000000100)='/dev/bsg/1:0:0:0\x00', 0x0, 0x0)
r1 = openat$auto_tracing_mark_fops_trace(0xffffffffffffff9c, &(0x7f0000000000)='/sys/kernel/debug/tracing/trace_marker\x00', 0x201, 0x0) (async)
mmap$auto(0x0, 0x400008, 0xdf, 0x9b72, 0x2, 0x8000)
r2 = open(&(0x7f00000020c0)='./cgroup\x00', 0x0, 0x408)
getdents$auto(r2, 0x0, 0x400018) (async)
write$auto_tracing_mark_fops_trace(r1, 0x0, 0x1f00)
close_range$auto(0xffffffffffffffff, 0x8000, 0x8000000) (async)
openat$auto_tracing_pipe_fops_trace(0xffffffffffffff9c, &(0x7f0000003fc0)='/sys/kernel/debug/tracing/trace_pipe\x00', 0x20a02, 0x0) (async)
sendfile$auto(0x1, 0x3, 0x0, 0xc01) (async)
write$auto(r0, 0x0, 0x100082) (async)
r3 = socket(0x22, 0x1, 0x1)
getsockopt$auto(r3, 0x84, 0x75, 0x0, &(0x7f0000000000)=0x9b) (async)
r4 = openat$auto_tty_fops_tty_io(0xffffffffffffff9c, &(0x7f0000000000)='/dev/ttyS0\x00', 0x801, 0x0)
ioctl$auto_TIOCVHANGUP2(r4, 0x5437, 0x0) (async)
mmap$auto(0x0, 0x400008, 0xa, 0x10, r0, 0x0)
unshare$auto(0x40000080) (async)
socket(0x18, 0x5, 0x2)
mmap$auto(0x0, 0x8, 0xdf, 0x9b72, 0x2, 0x8000)
openat$nci(0xffffffffffffff9c, &(0x7f0000000080), 0x2, 0x0)
sendmsg$auto_NETDEV_CMD_QUEUE_GET(0xffffffffffffffff, &(0x7f0000003040)={0x0, 0x0, &(0x7f0000003000)={&(0x7f0000000040)=ANY=[@ANYBLOB='$\x00', @ANYRES16=0x0, @ANYBLOB="41004bbd7000fbdbdf250a00"], 0x24}, 0x1, 0x0, 0x0, 0x44884}, 0x20008810) (async)
capset$auto(0x0, 0x0) (async)
semctl$auto_SEM_STAT(0x7ff, 0x0, 0x12, 0x7fff) (async)
close_range$auto(0x2, 0x8, 0x0) (async)
r5 = prctl$auto_PR_RISCV_V_GET_CONTROL(0x46, 0x7fffffffffffffff, 0xffffffffffffffff, 0x8, 0x919c)
syz_genetlink_get_family_id$auto_nl80211(&(0x7f00000011c0), r5)
openat$auto_tracing_saved_cmdlines_fops_trace(0xffffffffffffff9c, &(0x7f0000001200)='/sys/kernel/debug/tracing/saved_cmdlines\x00', 0x72d102, 0x0)
executing program 2:
close_range$auto(0x2, 0x8, 0x0)
mmap$auto(0x0, 0x8c7, 0xdf, 0x9b72, 0x2, 0x8000)
socketpair$auto(0x1, 0x2, 0x8000000000000000, 0x0)
close_range$auto(0x2, 0x8, 0x0)
open(0x0, 0x163340, 0x2a)
socket(0x2, 0x80802, 0x0)
setsockopt$auto(0x3, 0x1, 0x3e, 0x0, 0x9)
mmap$auto(0x0, 0x20009, 0xe2, 0xeb1, 0x405, 0x8000)
r0 = openat$auto_fb_fops_fb_chrdev(0xffffffffffffff9c, &(0x7f0000001c80)='/dev/fb0\x00', 0x20401, 0x0)
ioctl$sock_SIOCGIFINDEX(r0, 0x4600, 0x0)
r1 = openat$auto_fb_fops_fb_chrdev(0xffffffffffffff9c, &(0x7f0000001c80)='/dev/fb0\x00', 0x20401, 0x0)
ioctl$sock_SIOCGIFINDEX(r1, 0x4601, 0x0)
connect$auto(0x3, 0x0, 0x55)
setsockopt$auto(0x3, 0x0, 0x1, 0x0, 0x9)
sendmmsg$auto(0x3, 0x0, 0x3, 0x0)
executing program 2:
r0 = openat$auto_uinput_fops_uinput(0xffffffffffffff9c, &(0x7f0000000000), 0x101001, 0x0)
mmap$auto(0x0, 0x4020009, 0xdf, 0xeb1, 0x401, 0x8000)
r1 = clone$auto(0x4, 0x80000001, 0x0, 0x0, 0xfff)
move_pages$auto(r1, 0xd0, 0x0, 0x0, 0x0, 0x2)
mmap$auto(0x0, 0x4020009, 0xdf, 0xeb1, 0x401, 0x8000)
close_range$auto(r0, 0xffffffffffffffff, 0x2)
socket(0x10, 0x2, 0x0)
socketpair$auto(0x1, 0x1, 0x8000000000000000, 0x0)
socket(0x2, 0x1, 0x0)
r2 = openat$auto_kvm_chardev_ops_kvm_main(0xffffffffffffff9c, &(0x7f0000000000), 0x212480, 0x0)
ustat$auto(0x801, 0x0)
close_range$auto(0x2, 0x8000, 0x0)
r3 = openat$auto_kvm_chardev_ops_kvm_main(0xffffffffffffff9c, &(0x7f00000011c0), 0xe0180, 0x0)
ioctl$auto_KVM_CREATE_VM(r3, 0xae01, 0x0)
ioctl$auto(0x3, 0xae41, r3)
ioctl$auto_KVM_CREATE_VM(r2, 0x4008ae8a, 0x0)
r4 = openat$auto_rtc_dev_fops_dev(0xffffffffffffff9c, &(0x7f0000000100), 0x240, 0x0)
ioctl$auto_RTC_PIE_ON(r4, 0x7005, 0x0)
ioctl$auto_UI_DEV_SETUP(r0, 0x405c5503, &(0x7f00000000c0)={{0x9, 0xf2cf, 0x8, 0x80}, "6a034a07c7b82d90b69a39e32576f893fba86c9dd051a0094a3836d61c9100fefbbabea6ef9368c7996e841f3f1561d4992f726b0a6c36b0b2fd1678e816201cf562367fe6596824588a2e3d84ba165f", 0xa})
ioctl$auto_UI_DEV_CREATE(r0, 0x5501, 0x0)
mmap$auto(0x0, 0x400008, 0xdf, 0x9b72, 0x0, 0x100000000008000)
write$auto(0x3, 0x0, 0x7fffffff)
fsopen$auto(0x0, 0x2)
mmap$auto(0x0, 0x400008, 0xdf, 0x9b72, 0x2, 0x8000)
executing program 34:
r0 = openat$auto_uinput_fops_uinput(0xffffffffffffff9c, &(0x7f0000000000), 0x101001, 0x0)
mmap$auto(0x0, 0x4020009, 0xdf, 0xeb1, 0x401, 0x8000)
r1 = clone$auto(0x4, 0x80000001, 0x0, 0x0, 0xfff)
move_pages$auto(r1, 0xd0, 0x0, 0x0, 0x0, 0x2)
mmap$auto(0x0, 0x4020009, 0xdf, 0xeb1, 0x401, 0x8000)
close_range$auto(r0, 0xffffffffffffffff, 0x2)
socket(0x10, 0x2, 0x0)
socketpair$auto(0x1, 0x1, 0x8000000000000000, 0x0)
socket(0x2, 0x1, 0x0)
r2 = openat$auto_kvm_chardev_ops_kvm_main(0xffffffffffffff9c, &(0x7f0000000000), 0x212480, 0x0)
ustat$auto(0x801, 0x0)
close_range$auto(0x2, 0x8000, 0x0)
r3 = openat$auto_kvm_chardev_ops_kvm_main(0xffffffffffffff9c, &(0x7f00000011c0), 0xe0180, 0x0)
ioctl$auto_KVM_CREATE_VM(r3, 0xae01, 0x0)
ioctl$auto(0x3, 0xae41, r3)
ioctl$auto_KVM_CREATE_VM(r2, 0x4008ae8a, 0x0)
r4 = openat$auto_rtc_dev_fops_dev(0xffffffffffffff9c, &(0x7f0000000100), 0x240, 0x0)
ioctl$auto_RTC_PIE_ON(r4, 0x7005, 0x0)
ioctl$auto_UI_DEV_SETUP(r0, 0x405c5503, &(0x7f00000000c0)={{0x9, 0xf2cf, 0x8, 0x80}, "6a034a07c7b82d90b69a39e32576f893fba86c9dd051a0094a3836d61c9100fefbbabea6ef9368c7996e841f3f1561d4992f726b0a6c36b0b2fd1678e816201cf562367fe6596824588a2e3d84ba165f", 0xa})
ioctl$auto_UI_DEV_CREATE(r0, 0x5501, 0x0)
mmap$auto(0x0, 0x400008, 0xdf, 0x9b72, 0x0, 0x100000000008000)
write$auto(0x3, 0x0, 0x7fffffff)
fsopen$auto(0x0, 0x2)
mmap$auto(0x0, 0x400008, 0xdf, 0x9b72, 0x2, 0x8000)
executing program 6:
mmap$auto(0x0, 0x2020009, 0x3, 0xeb1, 0xfffffffffffffffa, 0x8000)
close_range$auto(0x0, 0xfffffffffffff000, 0x2)
mmap$auto(0x0, 0x20009, 0x4000000000df, 0xeb1, 0x401, 0x8000)
close_range$auto(0x2, 0x8, 0x0)
socket$nl_generic(0x10, 0x3, 0x10)
socket(0x11, 0x80003, 0x300)
sendto$auto(0x3, 0x0, 0x800013, 0xffffffbc, &(0x7f0000000440)=@tipc=@name={0x1e, 0x2, 0x0, {{0x41, 0x4}, 0x4}}, 0x22)
socket(0xa, 0x2, 0x73)
socketpair$auto(0x1, 0x5, 0x8000000000000000, 0x0)
socket(0x1, 0x3, 0x0)
bind$auto(0x3, 0x0, 0x6b)
connect$auto(0x3, 0x0, 0x6b)
readv$auto(0xffffffffffffffff, 0x0, 0x410)
sendmsg$auto_NL80211_CMD_SET_WIPHY(0xffffffffffffffff, 0x0, 0x4000000)
close_range$auto(0x0, 0xfffffffffffff001, 0x2)
openat$auto_adf_hb_cfg_fops_adf_heartbeat_dbgfs(0xffffffffffffff9c, &(0x7f0000000000)='/sys/kernel/debug/ieee80211/phy0/hw_conf\x00', 0x20486, 0x0)
openat$auto_def_blk_fops_fs(0xffffffffffffff9c, &(0x7f0000000040)='/dev/loop6\x00', 0x169780, 0x0)
socket(0x11, 0x80003, 0x0)
openat$auto_raw_fops_raw_gadget(0xffffffffffffff9c, &(0x7f00000000c0), 0x0, 0x0)
r0 = socket(0x29, 0x2, 0x0)
mmap$auto(0x0, 0x202000c, 0x3, 0xab1, 0xfffffffffffffffa, 0x8000)
mmap$auto(0x0, 0x400008, 0xdf, 0x9b72, 0x2, 0x8000)
prctl$auto(0x1000000003b, 0x1, 0x4, 0x5, 0x10004)
madvise$auto(0x0, 0xffffffffffff0001, 0x15)
madvise$auto(0x0, 0xffffffffffff0008, 0x19)
setsockopt$auto(r0, 0x119, 0x400000, 0x0, 0x802)
socket(0x10, 0x2, 0x6)
mmap$auto(0x0, 0x400008, 0xdf, 0x9b72, 0x1fe, 0x8000)
sendmsg$auto_NL80211_CMD_GET_REG(0xffffffffffffffff, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000200)={0x0}, 0x1, 0x0, 0x0, 0x40000}, 0x40805)
sendmsg$auto_L2TP_CMD_NOOP(0xffffffffffffffff, &(0x7f0000000280)={0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x40080}, 0x8c1)
executing program 4:
read$auto(0xffffffffffffffff, &(0x7f0000000000)='%:\x00', 0x7)
mmap$auto(0x0, 0x7, 0x8, 0xeb1, 0xfffffffffffffffa, 0x40000000008000)
r0 = openat$auto_proc_mem_operations_base(0xffffffffffffff9c, &(0x7f0000000300)='/proc/self/mem\x00', 0x100, 0x0)
read$auto_proc_mem_operations_base(r0, &(0x7f0000000340)=""/230, 0xe6)
bpf$auto(0x14, &(0x7f00000000c0)=@iter_create={0xffffffffffffffff, 0x4}, 0x7)
executing program 4:
r0 = socket(0x10, 0x2, 0x0)
close_range$auto(0x2, 0x8, 0x0)
socket(0x10, 0x2, 0x4)
socket(0x10, 0x3, 0x6)
sendmsg$auto_NL80211_CMD_GET_REG(r0, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000300)=ANY=[@ANYBLOB="72010000", @ANYBLOB="120027", @ANYBLOB="5de1"], 0x1ac}}, 0x40000)
read$auto(r0, &(0x7f0000000000)='$-]&@\x00', 0x5)
executing program 4:
mmap$auto(0x0, 0x2020009, 0x3, 0xeb2, 0xfffffffffffffffb, 0x8000)
close_range$auto(0x2, 0x8, 0x0)
r0 = openat$auto_tracing_err_log_fops_trace(0xffffffffffffff9c, &(0x7f0000000000)='/sys/kernel/debug/tracing/error_log\x00', 0xb01, 0x0)
socket(0x15, 0x5, 0x0)
connect$auto(0x3, &(0x7f0000000080)=@in={0x2, 0x3, @dev={0xac, 0x14, 0x14, 0x10}}, 0x54)
getsockopt$auto(0x3, 0x200000000001, 0x1c, 0x0, 0x0)
mmap$auto(0x0, 0x2020009, 0x9, 0xeb1, 0xfffefffffffffffa, 0x8000)
r1 = epoll_create$auto(0x4)
r2 = openat$auto_v4l2_fops_v4l2_dev(0xffffffffffffff9c, &(0x7f0000000000)='/dev/video2\x00', 0x101081, 0x0)
epoll_ctl$auto(r1, 0x1, r2, 0x0)
mmap$auto(0x0, 0x4020009, 0xdf, 0xeb1, 0x401, 0x8000)
r3 = socket(0x1, 0x3, 0x80000000)
r4 = getsockopt$auto(r3, 0x6, 0x25, 0x0, 0x0)
mmap$auto(0x40000000010000, 0x400008, 0xdf, 0x9b72, r0, 0x8000)
socketpair$auto(0x1, 0x1, 0x8000000000000000, 0x0)
socket(0x11, 0x80003, 0x300)
setsockopt$auto(r4, 0xffff6871, 0x8, 0x0, 0x3)
r5 = socket(0x10, 0x2, 0x4)
io_uring_setup$auto(0x4bf15e08, &(0x7f0000000000)={0x401, 0x8, 0xfe, 0x6fb3, 0x8a, 0x40000009, 0xffffffffffffffff, [0x100, 0x9, 0x7f], {0x6, 0x7, 0x3032, 0xe, 0xf, 0x5, 0x5, 0xfffffff9, 0xf08a2b3}, {0x0, 0xfc, 0x6, 0x1, 0x0, 0xf89, 0x9, 0x7fffffff, 0x8}})
r6 = socket$nl_generic(0x10, 0x3, 0x10)
ioctl$sock_SIOCGIFINDEX(r6, 0x8933, &(0x7f0000000000)={'dummy0\x00'})
syz_open_procfs$namespace(0x0, 0x0)
sendmsg$auto_NFSD_CMD_THREADS_SET(0xffffffffffffffff, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000000140)=ANY=[@ANYBLOB="1f9a81052a570148ea3acf23453bf490b45c8a1e9c681d666620c84499a29282c991", @ANYRESOCT=r4], 0x2c}, 0x1, 0x0, 0x0, 0x4000044}, 0x2404c000)
write$auto(r5, &(0x7f0000000000)='-\x00', 0x2fb)
r7 = openat$auto_kernfs_file_fops_kernfs_internal(0xffffffffffffff9c, 0x0, 0x500, 0x0)
read$auto_kernfs_file_fops_kernfs_internal(r7, &(0x7f0000000080)=""/23, 0x17)
openat$auto_proc_sys_file_operations_proc_sysctl(0xffffffffffffff9c, 0x0, 0x101202, 0x0)
close_range$auto(0x2, 0x8, 0x0)
openat$auto_proc_iter_file_ops_compat_inode(0xffffffffffffff9c, &(0x7f0000000040)='/proc/fs/netfs/cookies\x00', 0x40080, 0x0)
openat$auto_proc_sys_file_operations_proc_sysctl(0xffffffffffffff9c, &(0x7f0000000080)='/proc/sys/kernel/seccomp/actions_logged\x00', 0x8202, 0x0)
executing program 0:
r0 = socket(0xa, 0x2, 0x3a)
setsockopt$auto(r0, 0x29, 0x11, &(0x7f0000000240)='!\x00\xba\xe4\x8a\xf0t\xaf\x82\xd7{\x98\xdd\xee\xc2f\xcaH\x90\xc57M\x87<<\n\xf2L\"Y\xa9\f\n\xbd?\xdd\b\xf7vu:\x00\xeaP\xa7=\xef\xc3\xdc\xf3=J\xf9\x9e\xd9\x02\xbb\xd3\xf8\xff*\xc2\xd8w\xe9\x00\x00\x01\x00h\xe2\x0f\x1b\x95L\xbf\xa5\xacH\"xV#\xc7e\x12\x83\xed\xc7\xc5\x9e\x84?\xfa=\f\xd8\x14\x00\x9fJl\xdd)i\x9f(#\xb7\xff:\x94\x8bd,\xb2\xfc\xde32\x87;\tx\xffM\x1f\x1d\xd8b\xa5\r\xb7v;\xfd\xa14M\xd3\x95\x86\x04\xd4\xda}\xcat}\x18K\x85\x9bBj\x8e\x95\xca\x87\xfe\x125\x154\x83\x94X,\xa4\xf3\xf6\xef\x1a\xb5iX\x99\xa1NO\xc5R\xc9\xc7\xd6\x8d?\x13\x9f\xaf\xf4\xbc\xa3j\xefQ\x7f\xc4\x86\xe8\xc6\xf8\xfe\x115\xd7\x89\x86\xc6T\x14\x00\x13\xb9mf\xc0\xc2%_N\xed\xa9\x02\xe5\x83\xa0\x01O%NHKp\xe0\xb3u\xdc\x8bb\xfa\xabD\x1d\x8a\x1e\xb4C\x05R\xdco\xa5\xce\xc9+\xf8\xf2X#', 0x1fe)
executing program 0:
stat$auto(&(0x7f0000000300)='./cgroup\x00', &(0x7f0000000340)={0x7, 0x8000, 0x6, 0x8001, 0xee00, <r0=>0xee01, 0x0, 0x187, 0x2, 0x8, 0x3, 0x5fd0, 0x7f, 0x6, 0xfff, 0x3, 0x1})
mmap$auto(0x0, 0x20009, 0xdf, 0xeb1, 0x401, 0x8000)
close_range$auto(0x2, 0x8, 0x0)
sendmsg$auto_NL80211_CMD_GET_REG(0xffffffffffffffff, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000200)={0x0, 0x1ac}, 0x1, 0x0, 0x0, 0x4004810}, 0x800)
sendmsg$auto_HSR_C_GET_NODE_STATUS(0xffffffffffffffff, &(0x7f0000000200)={0x0, 0x0, &(0x7f00000001c0)={&(0x7f0000000140)=ANY=[@ANYBLOB='h\x00\x00\x00', @ANYRES16=<r1=>0x0, @ANYBLOB="000226bd7000fedbdf25030000000800030004020000060007000080000008000200", @ANYRES32=0x0, @ANYBLOB="0a00050000000000000000000a00010000000000000000000a0001000000000000000000060007000a00000008000200", @ANYRES32=0x0, @ANYBLOB="080140"], 0x68}}, 0x40090)
sendmsg$auto_NL80211_CMD_STOP_AP(0xffffffffffffffff, &(0x7f0000000d80)={0x0, 0x0, &(0x7f0000000d40)={&(0x7f0000000480)=ANY=[@ANYBLOB="140000008f68084197cad0a602aceff6e434f2a84c1f9a2b686c17575cce6e2cd51220266f0b04fe6d0d6755e40794c7abe48678c462385fa5f6513224e850eeda5ea0674056022442388de7dccbfa2d751c143291176413f704a2f4a993ee64456952edd4e6754a5a15e01f0af0c21460ba", @ANYRES16=0x0, @ANYBLOB="040029bd7000fedbdf2510000000"], 0x14}, 0x1, 0x0, 0x0, 0x4000001}, 0x40)
r2 = syz_genetlink_get_family_id$auto_nfsd(&(0x7f0000001440), 0xffffffffffffffff)
r3 = syz_genetlink_get_family_id$auto_nfc(&(0x7f00000015c0), 0xffffffffffffffff)
sendmsg$auto_NFC_CMD_STOP_POLL(0xffffffffffffffff, &(0x7f0000002680)={0x0, 0x0, &(0x7f0000002640)={&(0x7f0000000580)=ANY=[@ANYBLOB="a65115c4", @ANYRESHEX=r2, @ANYBLOB="20fa28bd7000ff08000000000000", @ANYRESHEX=r0, @ANYRES32=r1, @ANYBLOB="0e8ccd1998719890eacd4d3402f180541c0d46edfd51d271fc33418c4c593e56ad425d740f39db93ceccd1d5080384ccbae93ed6023dbe608b336fb2ab07c317034bb6502024c8ed3c37f4faa9f60e127fdd7dee19f9b9629e0e7e1557ede9db5ae05b584563f1a93b6a219e6180b2169ed686dedb69b3938d03d1811ad83d761ddf44eeb82bec8cf9393ae21418e7db49746d2169a15334ea7eba5e60fe201d46cd32d3ca0a8f7c5c34cef4371cc0e9", @ANYRES8=r1, @ANYRES8=r0, @ANYRES8=0x0], 0x14}, 0x1, 0x0, 0x0, 0x40008d5}, 0x4010)
sendmsg$auto_NFC_CMD_START_POLL(0xffffffffffffffff, &(0x7f0000000400)={&(0x7f0000000440)={0x10, 0x0, 0x0, 0x402}, 0xc, &(0x7f0000000280)={&(0x7f0000000240)=ANY=[@ANYBLOB='<\x00\x00\x00', @ANYRES16=r3, @ANYBLOB="08002bfd7000ffdbdf450600000020000200d65bced5efd32a94b7f5980a2f0965559f617873703100f47c78308008001e0080000000"], 0x3c}, 0x1, 0x0, 0x0, 0x20048895}, 0x40000)
r4 = socket(0x2, 0x3, 0x100)
socket(0x10, 0x2, 0x0)
sendmsg$auto_NL80211_CMD_GET_REG(0xffffffffffffffff, &(0x7f0000000100)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000180)=ANY=[@ANYBLOB="72010000", @ANYBLOB="13"], 0x1ac}, 0x1, 0x0, 0x0, 0x10008001}, 0x4004)
sendmmsg$auto(0x3, &(0x7f0000000080)={{0x0, 0x2, &(0x7f00000002c0)={0x0, 0xc4}, 0x1, 0x0, 0x0, 0x9}, 0x7}, 0x3, 0x0)
r5 = socket$nl_generic(0x10, 0x3, 0x10)
mmap$auto(0x0, 0xe983, 0xdf, 0xeb1, 0x401, 0x8000)
mmap$auto(0x0, 0x9, 0xdf, 0x9b72, 0x2, 0x8000)
io_uring_setup$auto(0x406, 0x0)
mmap$auto(0x0, 0x9, 0xffb, 0x8000000008011, 0x3, 0x0)
getrandom$auto(0x0, 0x6000000, 0x3)
io_uring_enter$auto(r4, 0xa84, 0x80000001, 0xe, 0x0, 0x46)
migrate_pages$auto(0x0, 0x99, 0x0, &(0x7f00000001c0)=0x3fe)
r6 = openat$auto_snd_pcm_oss_f_reg_pcm_oss(0xffffffffffffff9c, &(0x7f0000000100)='/dev/adsp1\x00', 0x40a140, 0x0)
ioctl$auto_SNDCTL_DSP_CHANNELS(r6, 0xc0045006, &(0x7f00000001c0))
getrandom$auto(&(0x7f0000000100)='..\x00k\xac\x8c\x1d\x0e\x98\x80\xd2\xaf\xa1\xf2\x1e\xe1R1\xa2\x8e\xce\xa0\x17\bI3\'\xc5tw\xd7\x1d\xa6\xf4#+\xfa\xd7\x01\xb9j<\v\xf47\n\xa7\xd2\x8b\x11e</\xfd\x9b\xe4\x99G\xeaS\x9a\xadu(:\x94:\xaf\x06c=3>1\xb3\xfdd\x04\xa9 1q\x97\xc4,\xa9^\xc1\xb6\xa1q\x0f\xd1\x013\x87l\xb9\x1e\x05\x90\xa2', 0xd5, 0x1)
move_pages$auto(0x0, 0x1002, 0x0, 0x0, 0x0, 0x2)
openat$auto_seq_oss_f_ops_seq_oss(0xffffffffffffff9c, &(0x7f0000000540)='/dev/sequencer2\x00', 0x0, 0x0)
io_uring_enter$auto(0x3, 0x5, 0xffffffff, 0x3, 0x0, 0x2)
getdents$auto(0xffffffffffffffff, 0x0, 0x100019)
syz_genetlink_get_family_id$auto_nl80211(&(0x7f0000000000), r5)
executing program 4:
openat$auto_snd_pcm_oss_f_reg_pcm_oss(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/dsp1\x00', 0x20b42, 0x0)
read$auto_proc_reg_file_ops_compat_inode(0xffffffffffffffff, &(0x7f0000000280)=""/65, 0x41)
mmap$auto(0x0, 0x4020009, 0x6, 0xeb1, 0x401, 0x8000)
prctl$auto(0x1000000003b, 0x1, 0x4, 0x5, 0x7)
socket$nl_generic(0x10, 0x3, 0x10)
close_range$auto(0x2, 0x8, 0x0)
sendmsg$auto_NETDEV_CMD_DEV_GET(0xffffffffffffffff, &(0x7f0000000080)={&(0x7f0000000140)={0x10, 0x0, 0x0, 0x400000}, 0xc, 0x0, 0x1, 0x0, 0x0, 0x48000}, 0x0)
mmap$auto(0x0, 0x400008, 0xdf, 0x9b72, 0x2, 0x8000)
close_range$auto(0x2, 0x8000, 0x0)
sendmsg$auto_HSR_C_GET_NODE_STATUS(0xffffffffffffffff, &(0x7f0000000200)={0x0, 0x0, &(0x7f00000001c0)={&(0x7f0000000140)={0x68, 0x0, 0x200, 0x70bd26, 0x25dfdbfe, {}, [@HSR_A_IF1_AGE={0x8, 0x3, 0x200}, @HSR_A_IF2_SEQ={0x6, 0x7, 0x4}, @HSR_A_IFINDEX={0x8}, @HSR_A_NODE_ADDR_B={0xa}, @HSR_A_NODE_ADDR={0xa, 0x1, @broadcast}, @HSR_A_NODE_ADDR={0xa}, @HSR_A_IF1_AGE={0x8, 0x3, 0x38}, @HSR_A_IFINDEX={0x8}, @HSR_A_IF2_AGE={0x8, 0x4, 0x4}]}, 0x68}, 0x1, 0x0, 0x0, 0x40080}, 0x40090)
socket(0x2, 0x3, 0x100)
socket(0x10, 0x2, 0x0)
sendmsg$auto_NL80211_CMD_GET_REG(0xffffffffffffffff, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000200)={0x0, 0x1ac}, 0x1, 0x0, 0x0, 0x4004810}, 0x800)
sendmsg$auto_NL80211_CMD_GET_REG(0xffffffffffffffff, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000180)=ANY=[@ANYBLOB="720100", @ANYBLOB="13"], 0x1ac}}, 0x4004)
sendmmsg$auto(0x3, &(0x7f0000000080)={{0x0, 0x2, &(0x7f00000002c0)={0x0, 0xc4}, 0x1, 0x0, 0x0, 0x9}, 0x7}, 0x3, 0x0)
executing program 0:
futex_waitv$auto(&(0x7f0000000180)={0x3fb, 0x6, 0x2, 0xfff}, 0x3, 0xbffffffc, 0x0, 0x81)
r0 = bpf$auto(0x5, &(0x7f00000001c0)=@task_fd_query={0x2, 0x2, 0x4, 0x0, 0x85, 0x4, 0x9, 0x6, 0x8001}, 0x101)
close_range$auto(0x2, 0xa, 0x0)
socket$nl_generic(0x10, 0x3, 0x10)
syz_clone(0x11, 0x0, 0x0, 0x0, 0x0, 0x0)
r1 = openat$auto_blk_mq_debugfs_fops_blk_mq_debugfs(0xffffffffffffff9c, &(0x7f00000000c0)='/sys/kernel/debug/block/mtdblock0/sched/read0_fifo_list\x00', 0x0, 0x0)
read$auto_blk_mq_debugfs_fops_blk_mq_debugfs(r1, &(0x7f0000000040)=""/124, 0x7c)
pipe$auto(&(0x7f0000000000)=<r2=>0xffffffffffffffff)
splice$auto(r2, 0x0, 0x2, 0x0, 0x9, 0x8)
mmap$auto(0x0, 0x7, 0xdf, 0x9b72, 0x2, 0x7ffc)
mmap$auto(0x0, 0x20009, 0x4000000000df, 0xeb1, 0x401, 0x8000)
mremap$auto(0x0, 0x4, 0x4, 0x7, 0x1000)
mmap$auto(0x0, 0x400008, 0xdf, 0x9b72, 0x2, 0x8000)
close_range$auto(0x2, r0, 0x0)
socketpair$auto(0x1e, 0x1, 0x8000000000000000, 0x0)
openat$auto_vhost_vsock_fops_vsock(0xffffffffffffff9c, &(0x7f0000000000), 0x121900, 0x0)
mmap$auto(0x0, 0x20009, 0xdf, 0xeb1, 0x401, 0x8000)
r3 = socket(0x2, 0x1, 0x0)
fcntl$auto(0x3, 0x4, 0xa553)
bind$auto(r2, &(0x7f0000000040)=@llc={0x1a, 0x301, 0x81, 0xe, 0x4, 0x2, @local}, 0x1)
sendmmsg$auto(r3, &(0x7f0000000140)={{&(0x7f0000000040), 0x12, 0x0, 0x101, 0x0, 0x5, 0x9ad}, 0x5}, 0x5, 0x20000000)
r4 = socketpair$auto(0x1, 0x5, 0x8000000000000000, 0x0)
syz_genetlink_get_family_id$auto_batadv(0x0, 0xffffffffffffffff)
mmap$auto(0x7, 0x202000c, 0x5, 0xfb1, r4, 0xa)
semctl$auto(0x9, 0xc1b8, 0x4, 0x1)
mmap$auto(0x7ffffffd, 0x400004, 0x7, 0x9b72, r3, 0x5)
dup2$auto(0xffffffffffffffff, 0xffffffffffffffff)
syz_genetlink_get_family_id$auto_nl80211(0x0, 0xffffffffffffffff)
sendmsg$auto_NL80211_CMD_SET_MULTICAST_TO_UNICAST(0xffffffffffffffff, 0x0, 0x0)
sendmsg$auto_NL80211_CMD_GET_STATION(0xffffffffffffffff, 0x0, 0x40)
executing program 6:
close_range$auto(0x2, 0x1d, 0x0)
r0 = syz_genetlink_get_family_id$auto_nl80211(&(0x7f0000000180), 0xffffffffffffffff)
sendmsg$auto_NL80211_CMD_SET_WIPHY(0xffffffffffffffff, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000080)=ANY=[@ANYBLOB='$\x00\x00\x00', @ANYRES16=r0, @ANYBLOB="011d3da4420008bd7100f9db5f250200000000000010", @ANYRES32], 0x24}, 0x1, 0x0, 0x0, 0x404c0c0}, 0x80)
mmap$auto(0x0, 0x3, 0x4000000200df, 0x40eb2, 0x402, 0x300000000000)
capget$auto(&(0x7f0000000100)={0x5}, &(0x7f0000000140)={0x7ff, 0xc, 0x800})
close_range$auto(0x2, 0xa, 0x0)
socket(0x10, 0x2, 0x4)
openat$auto_safesetid_uid_file_fops_securityfs(0xffffffffffffff9c, &(0x7f0000000080), 0x1, 0x0)
writev$auto(0x3, &(0x7f0000000100)={0x0, 0x7111}, 0x8)
r1 = socket(0x10, 0x2, 0x0)
sendmmsg$auto(r1, &(0x7f0000000200)={{0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000080), 0xfc2}, 0x2, &(0x7f00000001c0), 0x7, 0xa505}, 0x800}, 0x7, 0x4008)
socket(0x3, 0x800, 0x9)
r2 = openat$auto_kernfs_file_fops_kernfs_internal(0xffffffffffffff9c, &(0x7f0000000080)='/sys/module/apparmor/parameters/path_max\x00', 0x80, 0x0)
r3 = socket(0x1e, 0x4, 0x0)
setsockopt$auto(r3, 0x10f, 0x86, 0x0, 0x0)
read$auto_kernfs_file_fops_kernfs_internal(r2, &(0x7f00000000c0)=""/17, 0x11)
open(&(0x7f0000000000)='./file0\x00', 0x261c2, 0x84)
r4 = open(&(0x7f0000000080)='./file0\x00', 0xeee00, 0x31)
mmap$auto(0x3, 0x2020009, 0x7fffffff, 0xeb1, 0xfffffffffffffffa, 0x8000)
r5 = openat$auto_kernfs_file_fops_kernfs_internal(0xffffffffffffff9c, &(0x7f0000000040)='/sys/devices/virtual/block/ram6/queue/minimum_io_size\x00', 0x0, 0x0)
read$auto_kernfs_file_fops_kernfs_internal(r5, &(0x7f0000001540)=""/104, 0x68)
mmap$auto(0x0, 0x400008, 0xdf, 0x9b72, 0x2, 0x8000)
getcwd$auto(0x0, 0xffffffffffffffff)
rename$auto(0x0, &(0x7f0000000300)='v#\xd5\xaf>=\x14\xe6%\xf7\x8a\x8d\x9a\xae\x1a\xd6\xa8\xb8\x1d\xf5(\xb0\x1f\xbd\xcbV\n\"\xe3V\xfeP\xceN\xb2\xc32\xaf\xcc\x80\xfa\xf0\xd4\xd9|\xfe\x03y\xd16\x17\x99R\xca\xe5\xf4\xb4T\xfcv\xfc\xe6\x9cv\a\x00\xc2a\x16\xd1\x8a\x80\x90\x87\xa5s\x10\xed\x93\xd4\x15=\xc0\x1f\x0e\xb0\x18v}\x03!\xf0I\xe3}\x90\x9b\x92[\xfe2<7\xd3\x81\x9a~\xcd\r\x19\x9e\x10(5\xfd\x8b\x82\xd4\xc85\xc3\x93t\t\xd0\x9d\xca^n\xf3\xcb>\x1bO\xcej\xe0\xef\xf2\xd7\xc2}\x18\xd9`AO\x95<\x9aH\vu\xae\xd4\xea\x12\xb8\xd1\n\x01\x83r\x85\xbf*\x18\xa7 S:R\x14\x89Z3\x94\x8bP)')
write$auto(0x3, 0x0, 0x100082)
lseek$auto(r4, 0xc, 0x4)
executing program 4:
mmap$auto(0x0, 0x400008, 0xdf, 0x9b72, 0x2, 0x8000)
madvise$auto(0x0, 0xffffffffffff0005, 0x19)
madvise$auto(0x0, 0xffffffffffff0001, 0x15)
io_uring_setup$auto(0x6, 0x0)
madvise$auto(0x200000, 0x200007, 0x19)
executing program 5:
write$auto(0xffffffffffffffff, &(0x7f0000000000)='\'\x00', 0x4)
openat$auto_proc_reg_file_ops_compat_inode(0xffffffffffffff9c, &(0x7f0000000000)='/proc/thread-self/net/anycast6\x00', 0x0, 0x0)
mmap$auto(0x3, 0xb1, 0x3, 0xeb0, 0x401, 0xf8)
read$auto(0x3, 0x0, 0x80)
read$auto(0x3, 0x0, 0x80)
write$auto(0x3, 0x0, 0xfffffdef)
write$auto(0x3, 0x0, 0xfffffdef)
mmap$auto(0x0, 0x400008, 0xdf, 0x10, 0x2, 0x8000)
open(&(0x7f0000000000)='./file0\x00', 0x161342, 0x100)
msync$auto(0x1ffff000, 0x180000000000000, 0x400000004)
mmap$auto(0x0, 0x2020009, 0x3, 0x8011, 0xfffffffffffffffa, 0x8000)
mmap$auto(0x0, 0x2020009, 0x3, 0xeb1, 0xffffffffffffffff, 0x8000)
openat$auto_kernfs_file_fops_kernfs_internal(0xffffffffffffff9c, 0x0, 0x0, 0x0)
r0 = openat$auto_proc_fail_nth_operations_base(0xffffffffffffff9c, &(0x7f0000000000)='/proc/thread-self/fail-nth\x00', 0x20af83, 0x0)
writev$auto(r0, &(0x7f0000000200)={0x0, 0x7}, 0x3)
msync$auto(0x7, 0x45f8, 0x1)
open(0x0, 0x22240, 0x0)
socket$nl_generic(0x10, 0x3, 0x10)
socketpair$auto(0x1, 0x4, 0x8000000000000000, 0x0)
r1 = openat$auto_tty_fops_tty_io(0xffffffffffffff9c, &(0x7f0000000400)='/dev/ttyS2\x00', 0x101e81, 0x0)
ioctl$auto_TIOCSETD2(r1, 0x5423, 0x0)
openat$auto_mousedev_fops_mousedev(0xffffffffffffff9c, &(0x7f0000000040)='/dev/psaux\x00', 0x20000, 0x0)
io_uring_setup$auto(0x6, 0x0)
mmap$auto(0x0, 0x400008, 0xdf, 0x9b72, 0xffffffffffffffff, 0x8000)
close_range$auto(0x2, 0xa, 0x0)
executing program 0:
r0 = socket(0x10, 0x2, 0x0)
close_range$auto(0x2, 0x8, 0x0)
socket(0x10, 0x2, 0x4)
socket(0x10, 0x3, 0x6)
sendmsg$auto_NL80211_CMD_GET_REG(r0, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000300)=ANY=[@ANYBLOB="72010000", @ANYBLOB="120027", @ANYBLOB="5de1"], 0x1ac}}, 0x40000)
read$auto(r0, &(0x7f0000000000)='$-]&@\x00', 0x5)
executing program 6:
mmap$auto(0x0, 0x2020009, 0x3, 0xeb1, 0xfffffffffffffffa, 0x8000)
mmap$auto(0x0, 0x4, 0x4000000000df, 0x40eb2, 0x402, 0x300000000000)
socket(0xa, 0x801, 0x84)
msgsnd$auto(0x900, &(0x7f0000000000)={0x2, 0x5}, 0xf54, 0x80000001)
openat$auto_kernfs_file_fops_kernfs_internal(0xffffffffffffff9c, 0x0, 0x1c2b02, 0x0)
prctl$auto(0x12, 0x1, 0x6, 0xfffffffffffffffe, 0x4)
executing program 0:
unshare$auto(0x40000080)
socket$nl_generic(0x10, 0x3, 0x10)
socket$nl_generic(0x10, 0x3, 0x10)
mmap$auto(0x0, 0x400008, 0xdf, 0x9b72, 0x2, 0x8000)
close_range$auto(0x0, 0xfffffffffffff000, 0x2)
mmap$auto(0x0, 0x40009, 0xdf, 0x9b72, 0x7, 0x28000)
socketpair$auto(0xf, 0x7, 0x8, 0x0)
r0 = socket(0x10, 0x3, 0xb)
r1 = openat$auto_kernfs_file_fops_kernfs_internal(0xffffffffffffff9c, &(0x7f0000000080)='/sys/kernel/slab/kmalloc-64/total_objects\x00', 0x2400, 0x0)
read$auto_kernfs_file_fops_kernfs_internal(r1, &(0x7f0000000180)=""/250, 0xfa)
setsockopt$auto(r0, 0x104000000000010e, 0x1, 0x0, 0x16)
close_range$auto(0x0, 0xfffffffffffff000, 0x2)
openat$auto_proc_pid_numa_maps_operations_internal(0xffffffffffffff9c, &(0x7f0000000040)='/proc/thread-self/numa_maps\x00', 0x20000, 0x0)
open(&(0x7f0000000000)='./file0\x00', 0x161342, 0x100)
socket(0x1d, 0x2, 0x6)
futex_waitv$auto(&(0x7f0000000000)={0xfffffffffffffffd, 0x7e4, 0x2}, 0x1, 0x0, 0x0, 0x623d)
io_uring_setup$auto(0x2, 0x0)
r2 = openat$auto_tty_fops_tty_io(0xffffffffffffff9c, &(0x7f0000000400)='/dev/ttyS2\x00', 0x101e81, 0x0)
ioctl$auto_TIOCSETD2(r2, 0x5423, 0x0)
close_range$auto(0x2, 0x8, 0x0)
socket(0x23, 0x80805, 0x0)
socketpair$auto(0x4, 0x1, 0x20000, 0x0)
r3 = openat$auto_tty_fops_tty_io(0xffffffffffffff9c, &(0x7f0000000400)='/dev/ttyS2\x00', 0x101e81, 0x0)
ioctl$auto_TIOCSETD2(r3, 0x5423, 0x0)
ioctl$auto_TIOCVHANGUP2(r2, 0x5437, 0x0)
executing program 5:
r0 = semctl$auto_IPC_STAT(0xf, 0x2, 0x2, 0x8)
r1 = prctl$auto_PR_SET_NO_NEW_PRIVS(0x26, 0x9, r0, 0x6, 0xda8)
r2 = openat$auto_sg_fops_sg(0xffffffffffffff9c, &(0x7f0000000000)='/dev/sg0\x00', 0x400040, 0x0)
lseek$auto(r1, 0x4, 0x2)
r3 = prctl$auto_PR_SET_NAME(0xf, 0x4, r0, 0x4, 0x81)
r4 = syz_genetlink_get_family_id$auto_thermal(&(0x7f0000000080), r1)
sendmsg$auto_THERMAL_GENL_CMD_TZ_GET_TEMP(r3, &(0x7f0000000240)={&(0x7f0000000040)={0x10, 0x0, 0x0, 0x1000000}, 0xc, &(0x7f0000000200)={&(0x7f00000000c0)={0x110, r4, 0x200, 0x70bd26, 0x25dfdbfe, {}, [@THERMAL_GENL_ATTR_TZ_ID={0x8, 0x2, 0x2}, @THERMAL_GENL_ATTR_CDEV_MAX_STATE={0x8, 0x12, 0x2}, @THERMAL_GENL_ATTR_CDEV_CUR_STATE={0x8}, @THERMAL_GENL_ATTR_CDEV={0xcc, 0xf, 0x0, 0x1, [@nested={0x4, 0xd9}, @nested={0xc1, 0x76, 0x0, 0x1, [@generic="e67cbd765535320bb721f053ce5b6bf16aa71ebf81d4d5b0fa3b48c2041dadaf53333c066446b22b964d5ee30e9600f92198f80cf5ef55d87dc2c02358171d103e4417da88d25b864f66c730777d668d066bb96b175ab76bdb8a4ab173b78649b941bc899c5f388745ac343a5f8e85946c41ba14cda7e6acd76befeca2afda478efaa1ca27f711b41e85ef65debf32ccf2ffd8be145d9d59b3f290cf38c2ae0f858a972483d7da5fd9ca8d2fe6fcb6bdc6a62aa4db2c4d9367070742ba"]}]}, @THERMAL_GENL_ATTR_THRESHOLD_TEMP={0x8, 0x1a, 0x2}, @THERMAL_GENL_ATTR_TZ_GOV_NAME={0xf, 0xe, '-,{{\\(##.$*'}]}, 0x110}, 0x1, 0x0, 0x0, 0x80}, 0x850)
madvise$auto(0x1, 0xf, 0x9)
r5 = openat$auto_proc_fail_nth_operations_base(0xffffffffffffff9c, &(0x7f0000000280)='/proc/self/fail-nth\x00', 0x240042, 0x0)
fadvise64$auto_POSIX_FADV_DONTNEED(r3, 0x4, 0x6, 0x4)
r6 = getsockopt$auto_SO_MARK(r1, 0x7, 0x24, &(0x7f00000002c0)='/proc/self/fail-nth\x00', &(0x7f0000000300)=0x7fff)
setsockopt$auto_SO_ATTACH_REUSEPORT_EBPF(r6, 0xcf, 0x34, &(0x7f0000000340)='\x00', 0x3)
timer_create$auto_CLOCK_MONOTONIC(0x1, &(0x7f00000003c0)={@sival_ptr=&(0x7f0000000380)="be293c4f6a7407458de90e000146812641314dd429d426538eb87881a8dd", @raw, 0x4}, &(0x7f0000000400)=0xffffffff)
madvise$auto(0x4, 0x8, 0x5)
openat$auto_tracing_stats_fops_trace(0xffffffffffffff9c, &(0x7f0000000440)='/sys/kernel/debug/tracing/per_cpu/cpu0/stats\x00', 0x40000, 0x0)
ioctl$auto_BTRFS_IOC_SNAP_CREATE(r1, 0x50009401, &(0x7f0000000480)={@inferred=r5, "b054b7b57308300340ed802ae20ec1d8f00876883702f074918367146fee8b4026d4b0801429e78762e266570309f2b5fa0ceb5bfe5b79aa318b878efa9cba71dd2bf0e75e11949f89ad73b6aabdbd0d8d6a34fd54da1c02d5261271090e364dbefed860940ce2e47f1b7cbe11f28aed80064fc66b2911b0ba7e90b34e7eede686b1885aada364347e5ad87029dfd798741ba88aa50ecf5206d4acee8bb8101250c6cae9211900a0bb8a6a772b3088d8657950ce125c7855cfbaba7123376de40fdd812062ca46e11ec47c2c0b7b39a401f43eed39a3c369a888f067365b26b7f36145c8d54236904922bb04110b3575ad44ca2751e6c332b743d821fa3b342a769e0d9a4e7817965c8587fef82ede49b05f2fff436da9fb2a38fe344868fe26b6b03b427a36dbae88ef21c0c8627f5a79e883bf069ec10b0a39bdc631ce96219bf6c3a821a5861e855ed91af601a3fc2cc425ffdc3bf613bd2842a7b0e941eca9a6b5e61a1fa9e72d8ecc4be9a829737ca878ad1c4161434405f5c12de634c8723151394c437b19615ca9fa9dc53829c03f63695926409b81e81775269e13e46916c6dce115d7535ebb7986d04d0e6506707fce81bafa94fcbe9b0115a487e2051eb5c32aefb218d0e6a79ee7829bf1a384e6a529fa6a6eb2a846f97cd69ec1feceb3d100165362e28c5c8886f5dd9116eb18b7aab67cec251053b044266d9117cb02f463a151383afcd0c22ffa3d7bac9ddf3fe823a2ecbcb0143f777ad7bb6a8e5b8eabd38d5f900b1ef393d0e3e205f27e12c09f68a3b22125a2ab8b9b0c9e578028c7afb9a5aba4ee4dc621e5a6a9a1d8fa05a33464bfd87f9c09530f5451e47999080d3e37013d5225b571c131f51f2fede90b933b6b94a33c3975e850482c298dd703c9c426aa5df8ca1f9b2fd45d8c5094c6eeaca5e9eaa39757361554b027c17aeec6c949f49ec133e3aba14e9d131ab6fe17ac7a702d8395069acc64ded113db649e79b0797cadf4a09108e854e421ed3ba06c966199f61dd56821a32cdf93488d2ee9c88a196fd8546f13dda65859dfd0685a368f7be74097082d58e1d43ad1ab5637778f887ee1ccffd30b67991450dcf720f3f56ef3fa9cdf4c582ebd42092e04c1b039dc20bab01fd9b0a97b95316e3c36e88172544fba87d7444bbb5454f630b2c66e2636ade1014850697ed10e8ae170e883c5e889fa4c5b45b73b27731c3991ea46d778cae89cc0b481e3bd06b208696fff729a8db49878e13062aa24c5ba1c2a8c556b9fb8cf6238cbec2f2c980fd3fee3708ec6614137269805aef61ae4730a7e04e0a43a5462da7ab004fd710284f18c9c4eab74d0544704842e3a60e5453a47bb162bbf7a1674dc8ced553da7e37fa53aa994286803393a8d3165685502c83f5c36bb55fe2861069538ba8929b0d1df00400dec38d829a483396eb724c715b0154b344ffd0f9ed7af56f4cb4053f613919e2269af04f2c02bc40403f4c7069a935576958e82d13fd3e63c749cb66af73258f659721da7647a7cab85d11fc34409f94a2c4c9ec25d03650ad0e355c3191f6a5d1b721814535de27260c31b6db845f4e3c675f8f824f6244a1608f641fe864ef2a2a3074e0f0f8e90941199758ef3066a71979e6a6042224a8d686c3e4f2f00f73ac46eb9b8f4b4dee53eba78ec3136afab07ebd8fe930a522a7fa34c8a1a0d34b48fa6475413b8113ca903c143b151c06da5c57476f16e39cd9b50dade84f58b140fc3439e6a63f11e02ce8ddd9d05c92f583d60c58b22f75315fbebb2e2f38ef26b53d989c81027815273a570a13423b98d87763dbe3a3786639f374233ab52cf1b61ed6fea8bba9345f0cc72c1853eb4719858d6e118ffa46f8b29a091b12bdeb731aeb0d31c746a5e654184660bac656d50c4ffbd5a4c14df08ae3e2c4a905259a47f9797d41160085ae44b9800375cee7e80ae68aebe6980b610dbac4090c213ce27b66700534fd7b9301d1f40ff117b54b0caa541fdcdcbf91ae7e342c1f249dbea25b497197a3f2fdb6485dde2f88315d8388a023fbf56263e3dd5ba31fc074ca2142506268cbc69e92302e5f6d07543272a111a6a19a6190334de3f0658e586f6d6201633f3e9c5dd2f4923ad5b76478f30cd96fc00f200b1fd6b64660a677ed56674813ddbc62079ef93872ee35545cd898dc682290544ff41be4ca8f30ed48cfa6bf89a1dcb9ee7f3595f6acce6903e7a5d40c96276c595071c55aea7b8abd3e608468155a637cb85d64d072a06193844e98da59d1a2f4442c474f7e53e96f448392c1171dbf5b8c48961998d61f87c2fee8ca051b4fe6e75eaba6ae660e03eab726cb1b3318751a43123d51e45e40dfb9ca475ef0542b06276169a712f23b82a4750c6ceed8e3e23e02e6f0d910c38ed8bbe68fccf0248facee3f854119868351afc6302dbc3df8431b880a6f400719938701c2f83fd687071f58799d8c35337b8a2ae7cb21ba7f63a49b09df650e739f86aa39c6028150c30405e72ca300083e4ac7b3abb6aece2341b106ef53f7d6970c6acbc7f13aa93fdc73bbd899c9ae1419e022b2dc788b1937fb94db9824b7e68a4c6356ea57c6be8e574798f2a2fa8dd4e5ecb3003a2330de58506e419715e080099965092eaae79653f727ddfa20154100ff810c0a0e576e82e846db4d4b38271b274101237ec6fdb30b5ef4f6767bba91fe54180712ffb296fdc7fb9b71fc47210203f5a27e2565d018c50f395e017100ed35447c6176e237b07c1f42276849464a6d69ccc6b6d7181c9b211a3d0c29c1f7157b44ee0fb063fe7d39147d1e4d966e3b8eb9f8cc4c27b93741cb6d99a8bbff4e9b31b88b0700603ee888ef878b56f7a76cd038b39fb3cfa78e0769bd012e5e2cb3b8c9be91239e288a2688a86236bd161faa8c29d651717bb9854a36f975268266936ad78f398b001b1c6acfbacb8a84431fb66f099d79fd4af586c949c97b0fb4bd4c58f9640eac01e5bfc3eda4e51cbe2010d9774f0ec84ba7fe5df45dc60b6ca817e35a74895b84b692fc7d63a153c0f015e321edc3c59f9af3fac1c8e7e13f706914cd9a817462ec9c5a7840b96aad7888d84a9d02787529fc06645c8b7580ae0fe2f5d8708a689377e6ebdae290399898b8c6508ba9eb63c5ca29505409b8f6056cc06ffe3c12f40925c62edd36fc62a399b65eda0c8113db93d958d976b098fd1af9ae1c0788117537d0f7bc5369916919e4be23626a7b2d5493f845c08b5f0e4baa809cd06b1ce015a380fb5e513355b7ee1674a7af0d88387e9254695417eda7b1d0c0c182d318d138cc7d5668fd9a8a2008d707455e97f4eaa296ac3ec2835afa136cef0bce851d73738f7d810570506ed090a1bc0a13fa8ba150abbb8c53629a8e2e52b0123f0ac8c025b73615d7f467164d231532caaceca0268ddc4c194ddec6c95bfa57717e47251fc238f63ee76c052384175d6a71306503c994c0a957309b0b441f8b0a8c000db194943b959646fd004e8488a8c8f7db6bee9a37e0073baea766e7269bfcd550a1553d37cd032fdbcee322996fb3b7b482f54e1f525620a426c5a8031012c4eb6ccf293ebe62eb12732b40e622f638ce3d00cfdb184b41a53a32a491d3769aee55bf9d5205e553b72bcdea981919e79a9666934f43061bec93adbc1c2bc5dedcdde3235cd439cf6b18028ce06cc19d381b08981178a18a9047bf9034e6135be24a037c6776131eb9bafae6657b964bc19043364ab41173fd091ad844a2763148c7704647a629c41bf9e7d80a49387fef429c5a90ed672df226684f8ff275786724699d82bb12eb58b414417110cb37c234c48f855f285b6aa13579d71158262571b1f9b5aa20963f5346fc0de90ee9d6092e3cbc1ef00ac04895051785263ca93f2ceeb02b01f4ff744701db215db5cd31d0d5964c8a9da15021cfcee3d804711f306dc6f7ace3232c9bffa409746f4060fd7d3911b43b5b9cdbbec8cd0ed12b5e76996893eeabdd4f15a67a6bfcd6fee80ea592bec65541e33eb1e3cdef38c4d192d936d8f964e5e914b187bff52ea8538e7c2077ddd7eb72a02402283db9498b84a9f12b6d6fbdf2b23abd897a0b91b2d5528aa310a3bb9a1617d68b2f27371ff1868bf29237e894a828508d111895b21b8823ef680a84dd8cbaf0db81f4fd45ab89e51b0d7005097bb6d774dd281f13632c10edb5365837cfd2d69e843ec73fb5da0fd5ce08ec1c6d3f8dc1acf976c13d4e5d2844aec49213692b18a1cf0f8d4f3404a0860657f36dc7cfc461c653270b78f80e09c8be5b6e9e83596882d59f7ad7148da88fc125777f3a40244d083ab401072e2837ee773c26fa20197220d4f53902cf58b13baa21645791c4ea3d19f8ae897fcf9d5344364c3267414d7854153672a5dea2143515d821a775a3cbba2fb22b9d09ad8bbb9117d19a74e09b777cbd3a8352f05b06c386570860fbf65a5b5fb23c7d0299f0a7540e34246861414027586006d7df7974be30e062c9cdadb340c9921e8ecb8650c444265bfde678d5786c6dbec322976a7d17b268ca1ff5ddbd0296a59dc7c499a09ceac0bf62129fcaa2340c7ee1432e255e7cda55df0a75f08e1159bb0206f4a1e20402f5c0e71774f486ec50a8ac6a1db2538891119bd7e0117bde783cb032edba454cd8eaccb49e341ae9528cc29cefbf4e912ab79a1ef0363cd91330f69f4e90826659beca3479bb37b4679b35734a100909ef8b5f11b147f2da28f9d0bf48e98dde6e1969f8b8d99b64cf019a46116d902d0e8f5929ab82fd338ff23604e4bbf9bbe6c30c17e6a9c8803cda27ab35115609c54198e4a5defebebe8d26c58c5355d98c5a6cf3c3e3a0e85a51af9711b00b0b13406ff6d2d62ec558bb0e3b687c1029379b6076fa19c3070477d047d8744954f44164f4f5e04a459a45c2cb7c95457bb245949fdee86ff6538079ff573a16f6627237652a7db2d7b809076af4a07d940165c080f1f32049325fba2f552f032c98a7ec7f3b545c81612e25576ae9445885d6cd25ccfb1efbd371a8670a62976d5bec5de8c58be941319a4ca5738e337d686a6d641ed5f445c53f9e362d003d8bed2afc088191ffd688f9beae9e52b1d8197cca832651de09222c67987f0d5b44218524d2f0b6e364231a7038c97ac622f2adfa303e393b7d04a569a53f34e036c421870d2f14d2007eb4065ea5553ad83aaa36c1f77537affa68be9b2d1e18300696531b7d33b33e3b9e87fbc988f158836765a66988b4c0d98dd0d65d1ff1b3e4e1bb129287237092b008e81972f929e06bce222f89433a90a109491274f641720ca0f4521b6572804437cdfd8b6e7f67b3b25ebd9a749aa7318dc59bd5133751bf19015a9411af04c8a07e738b7b0103117d54dba9032fa40898927f1d520e787bb47a3853a0bcb3a80b4903f53356df6e8c188af988683284b871f3e058895c62d06df2302fbf57dc2430283113234cd432610d088e408f2563dc60f1eb42e9b554aaa492204635e25f4552c44a343eee39c3071b9045e0f5b75fe8080be0da8cccfa667b124eae0b44a845c1ab39f58e55f0b856d939abb427506ebe6f1a5389bbe819ea4f50a9db17f774aaec7659609f0bf508a8723fd5e4a95969a60fd7dc91113966bc34c30f92c59256cbe886f109a1cc6b07504aba6b3e096f8cbe6b795063f11e47f1c7c766959c684e729bdef064e7f2f3cfc43feb598e088671bfc7ba9534ec5fdd55b56cf641bbfe5ad2b226032b1"})
mmap$auto(0x8000000000000001, 0x7ff, 0x0, 0xfffffffffffffffb, r6, 0x7)
ioctl$IOCTL_GET_NCIDEV_IDX(r3, 0x0, &(0x7f0000001480)=<r7=>0x0)
connect$auto(r2, &(0x7f00000014c0)=@nfc={0x27, r7, 0xffffffffffffffff, 0x1}, 0x2)
r8 = semctl$auto_SETVAL(0xba, 0x2, 0x10, 0x8)
ptrace$auto(0x4, r8, 0x8, 0x5)
waitid$auto_P_PGID(0x2, r1, &(0x7f0000001500)={@siginfo_0_0={0x0, 0x3, 0x5, @_rt={0x0, 0x0, @sival_int=0xe}}}, 0x0, &(0x7f0000001580)={{0x253, 0x9}, {0x200, 0x4}, 0x8, 0x7f, 0x2, 0x0, 0x2, 0x1000, 0x8, 0x2, 0x3, 0x2, 0x9, 0x8, 0x1, 0x1})
mmap$auto(0x6, 0x3, 0x4, 0x3f, r6, 0x6dabfa32)
r9 = syz_genetlink_get_family_id$auto_nl80211(&(0x7f0000001680), 0xffffffffffffffff)
sendmsg$auto_NL80211_CMD_GET_REG(r1, &(0x7f0000001740)={&(0x7f0000001640)={0x10, 0x0, 0x0, 0x100000}, 0xc, &(0x7f0000001700)={&(0x7f00000016c0)={0x28, r9, 0x8, 0x70bd28, 0x25dfdbff, {}, [@NL80211_ATTR_STA_LISTEN_INTERVAL={0x6, 0x12, 0x6}, @NL80211_ATTR_WPA_VERSIONS={0x8, 0x4b, 0x8001}, @NL80211_ATTR_TX_NO_CCK_RATE={0x4}]}, 0x28}, 0x1, 0x0, 0x0, 0x80}, 0x0)
ioctl$auto_SG_GET_RESERVED_SIZE(r1, 0x2272, &(0x7f0000001780)="4d1d72bb5f31bf01a18b3b27c79a2cba6aa6c975293d02108bc87a736c3c79e63702debd8b1747a2e2953dc56c66b4f041e0c45415aab531e5dc1441ff6a6200067257abc735a5cb381dc2ed4faa395bc931e6ffeb68f9fd8273a3ba177cf025e9b31149a55323889681d7")
r10 = syz_genetlink_get_family_id$auto_netdev(&(0x7f0000001840), r1)
ioctl$sock_SIOCGIFINDEX(r3, 0x8933, &(0x7f0000001880)={'caif0\x00', <r11=>0x0})
ioctl$sock_SIOCGIFINDEX(r6, 0x8933, &(0x7f00000018c0)={'\x00', <r12=>0x0})
sendmsg$auto_NETDEV_CMD_DEV_GET(r3, &(0x7f0000001bc0)={&(0x7f0000001800)={0x10, 0x0, 0x0, 0x10000}, 0xc, &(0x7f0000001b80)={&(0x7f0000001b00)={0x64, r10, 0x4, 0x70bd2a, 0x25dfdbfc, {}, [@NETDEV_A_DEV_IFINDEX={0x8, 0x1, r11}, @NETDEV_A_DEV_IFINDEX={0x8, 0x1, r12}, @NETDEV_A_DEV_IFINDEX={0x8}, @NETDEV_A_DEV_IFINDEX={0x8}, @NETDEV_A_DEV_IFINDEX={0x8}, @NETDEV_A_DEV_IFINDEX={0x8}, @NETDEV_A_DEV_IFINDEX={0x8}, @NETDEV_A_DEV_IFINDEX={0x8}, @NETDEV_A_DEV_IFINDEX={0x8}, @NETDEV_A_DEV_IFINDEX={0x8}]}, 0x64}, 0x1, 0x0, 0x0, 0x40800}, 0x20000880)
executing program 6:
bpf$auto(0x5, &(0x7f0000000000)=@test={0x12, 0x1, 0x0, 0x9, 0x1, 0x3, 0x3da1, 0x0, 0xb4, 0x7, 0x140000000000, 0xdb, 0x7fffffff, 0x10, 0x1}, 0x171)
r0 = socket$nl_generic(0x10, 0x3, 0x10)
r1 = syz_genetlink_get_family_id$auto_batadv(&(0x7f0000000080), r0)
ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000240)={'batadv0\x00', <r2=>0x0})
sendmsg$auto_BATADV_CMD_GET_MCAST_FLAGS(r0, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000280)={&(0x7f0000000200)=ANY=[@ANYBLOB="1c000000", @ANYRES16=r1, @ANYBLOB="afa72db57000ffdbdf250e00000008000300", @ANYRES32=r2], 0x1c}, 0x1, 0x0, 0x0, 0x300}, 0x20000000)
executing program 4:
openat$auto_seq_oss_f_ops_seq_oss(0xffffffffffffff9c, &(0x7f0000000080)='/dev/sequencer2\x00', 0x2, 0x0)
r0 = socket(0x11, 0x3, 0x9)
capset$auto(0x0, &(0x7f0000000000)={0xb213, 0x2c, 0x800})
openat$auto_fb_fops_fb_chrdev(0xffffffffffffff9c, &(0x7f0000000100)='/dev/fb0\x00', 0x2, 0x0)
openat$auto_tty_fops_tty_io(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ttynull\x00', 0x201, 0x0)
r1 = openat$auto_loop_ctl_fops_loop(0xffffffffffffff9c, &(0x7f0000000440), 0x20100, 0x0)
ioctl$auto_LOOP_CTL_REMOVE(r1, 0x4c81, 0x0)
mmap$auto(0x0, 0x400008, 0xdf, 0x9b72, 0xffffffffffffffff, 0x0)
write$auto(0x3, 0x0, 0x7fffffff)
openat$auto_stat_fops_(0xffffffffffffff9c, &(0x7f0000000140)='/proc/stat\x00', 0x2, 0x0)
read$auto(0x3, 0x0, 0x80)
mmap$auto(0x0, 0x4020009, 0x6, 0xeb1, 0x401, 0x8000)
mmap$auto(0x0, 0x7, 0x1000000004, 0x9b72, 0x2, 0x100)
openat$auto_proc_iter_file_ops_compat_inode(0xffffffffffffff9c, 0x0, 0xc0000, 0x0)
listxattrat$auto(0xffffffffffffffff, 0x0, 0x7ffffffe, &(0x7f0000000380)='\xdf^\xe2o\x87D\x10\xa0\x0e1\xb5B\xd6k]Yh\x99\xf4\xbcy.8\xcd\xf2I\xcc\xf5\xc7\xee\xb8\xea\xb7+\xd8K\xf1\x1aI\xe6(\x9f\xaeS\xf1\x199\x1fk\x01\xf36\xe1 \x1a+\xcd\xfc6\xc7W\xeaw7\x1b\xf4\x01\xebQ\n\x94{\xb5\xa7/\xa3\xa7\x16\x82\x1c\rEqd\xf7~\xba{\x8f7S\x82\xed\x8es\x02W\xdc\x16l\xee\xf1\xd9\x83\xc8', 0xe9)
statmount$auto(0x0, &(0x7f0000000180)={0x8, 0x1, 0x1, 0x3, 0xf, 0x940, 0x1ffde, 0x3, 0x6, 0x8000002, 0xff, 0x5, 0x5, 0x4, 0xb0, 0x7, 0x2, 0x3, 0x5, 0x7, 0x0, 0x0, 0x0, 0x0, 0x0, 0x80000009, [0x0, 0x4000000000000000, 0x10000, 0x243efbdf, 0x0, 0x0, 0x4000000000000, 0x0, 0x0, 0xffffffffffffffff, 0x9, 0x0, 0x0, 0x0, 0x0, 0xfffffffffffffffd, 0x0, 0x9, 0x0, 0x0, 0x0, 0x0, 0x800, 0x0, 0x0, 0x9, 0x0, 0xfffffffffffffffc, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff, 0xfffffffffffffffc, 0x0, 0x0, 0x0, 0x0, 0x0, 0xe6e, 0x0, 0x0, 0xfffffffffffffffe]}, 0x1fe, 0x81)
close_range$auto(0x0, 0xffffffffffffffff, 0x2)
sendmsg$auto_OVS_VPORT_CMD_DEL(0xffffffffffffffff, &(0x7f0000000200)={0x0, 0x0, &(0x7f00000001c0)={&(0x7f0000000180)=ANY=[@ANYBLOB='<\x00\x00\x00', @ANYBLOB="11002d"], 0x3c}, 0x1, 0x0, 0x0, 0x8000}, 0x8000)
r2 = socket(0x10, 0x2, 0x0)
sendmsg$auto_NL80211_CMD_GET_REG(r2, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000280)={&(0x7f0000000180)=ANY=[], 0x1ac}, 0x1, 0x700}, 0x40000)
sendmsg$auto_NL80211_CMD_GET_REG(0xffffffffffffffff, 0x0, 0x40000)
sendmsg$auto_NETDEV_CMD_DEV_GET(0xffffffffffffffff, &(0x7f0000000080)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x400000}, 0xc, 0x0, 0x1, 0x0, 0x0, 0x24048000}, 0xc0)
ioctl$auto(0xffffffffffffffff, 0x13, 0xffffffffffffffff)
io_uring_register$auto(0x2, 0x0, &(0x7f0000000000), 0x3)
mmap$auto(0x0, 0x400008, 0xdf, 0x9b72, 0x2, 0x8000)
mbind$auto(0x2000, 0x100000004, 0x100000000, 0x0, 0x6, 0x2)
syz_clone3(&(0x7f0000000400)={0x9840100, 0x0, 0x0, 0x0, {0x31}, 0x0, 0x0, 0x0, 0x0}, 0x58)
mmap$auto(0x0, 0x40009, 0xe2, 0x9b72, 0x7, 0x28000)
openat$auto_kernfs_file_fops_kernfs_internal(0xffffffffffffff9c, &(0x7f0000000080)='/sys/devices/LNXSYSTM:00/LNXSYBUS:00/PNP0A03:00/device:08/adr\x00', 0x0, 0x0)
sendmmsg$auto(r0, &(0x7f0000000400)={{&(0x7f0000000000), 0x5aa, &(0x7f00000000c0)={&(0x7f0000000040)="661b", 0x49}, 0x1, &(0x7f0000000200), 0x5, 0x3}, 0x4}, 0x2, 0x100)
executing program 6:
sendmsg$auto_NL80211_CMD_GET_REG(0xffffffffffffffff, 0x0, 0x0)
socket(0x2, 0x80002, 0x73)
socket(0xa, 0x1, 0x84)
ioctl$auto(0x3, 0x8905, 0x38)
ioctl$auto_TIOCMSET2(0xffffffffffffffff, 0x5418, 0x0)
setsockopt$auto_SO_DETACH_FILTER(0xffffffffffffffff, 0x6, 0x1b, &(0x7f0000000140)='/dev/audio1\x00', 0xf)
r0 = openat$auto_tracing_pipe_fops_trace(0xffffffffffffff9c, &(0x7f0000000100)='/sys/kernel/debug/tracing/per_cpu/cpu0/trace_pipe\x00', 0x101801, 0x0)
setsockopt$auto_SO_DETACH_FILTER(r0, 0x6, 0x1b, &(0x7f0000000140)='/dev/audio1\x00', 0xf)
openat$auto_binder_fops_binder_internal(0xffffffffffffff9c, 0x0, 0x1, 0x0)
socket(0x28, 0x1, 0x0)
r1 = openat$auto_posix_clock_file_operations_posix_clock(0xffffffffffffff9c, &(0x7f0000000080), 0x40400, 0x0)
ioctl$auto_posix_clock_file_operations_posix_clock(r1, 0x40103d02, 0x0)
sendmsg$auto_NL80211_CMD_TRIGGER_SCAN(0xffffffffffffffff, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000240)={&(0x7f0000000180)=ANY=[], 0x14}}, 0x4000000)
openat$auto_seq_oss_f_ops_seq_oss(0xffffffffffffff9c, &(0x7f0000000080)='/dev/sequencer2\x00', 0x2, 0x0)
r2 = openat$auto_snd_rawmidi_f_ops_rawmidi(0xffffffffffffff9c, &(0x7f0000000000)='/dev/snd/midiC2D0\x00', 0x1, 0x0)
openat$auto_proc_sys_file_operations_proc_sysctl(0xffffffffffffff9c, &(0x7f0000000000)='/proc/sys/fs/pipe-max-size\x00', 0x382, 0x0)
sendmsg$auto_NFSD_CMD_THREADS_SET(0xffffffffffffffff, &(0x7f0000000100)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000040)=ANY=[@ANYBLOB='$\x00\x00\x00', @ANYRES16=0x0, @ANYBLOB="00042cbd7000fb3d89cb809172a33200030080004000880001"], 0x24}, 0x1, 0x0, 0x0, 0x20008010}, 0x400d0)
sendmsg$auto_NL80211_CMD_GET_REG(0xffffffffffffffff, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000040)=ANY=[@ANYBLOB="72010000", @ANYBLOB="1a0027"], 0x1ac}, 0x1, 0x0, 0x0, 0x4000804}, 0x40000)
r3 = socket(0x10, 0x2, 0x0)
sendmsg$auto_NL80211_CMD_GET_REG(0xffffffffffffffff, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000300)={&(0x7f0000000040)=ANY=[], 0x1ac}, 0x1, 0x0, 0x0, 0x44814}, 0x2004c0c4)
sendmmsg$auto(r3, &(0x7f0000000200)={{0x0, 0x0, &(0x7f0000000100)={&(0x7f0000000080), 0xfc2}, 0x2, &(0x7f00000001c0), 0x7, 0xa505}, 0x800}, 0x7, 0x8)
write$auto(r2, &(0x7f0000000400)='/dev/audio1\x00', 0xa3d9)
select$auto(0xe, 0x0, 0x0, &(0x7f00000002c0)={[0x1ff, 0x7, 0xd, 0xa00, 0x948b, 0x2, 0xfffffffffffffffc, 0x6, 0x3, 0x300000000000000, 0x80000001, 0x5, 0x6d3c, 0x5, 0x2]}, 0x0)
madvise$auto(0x108000, 0x800034, 0xa)
unshare$auto(0x40000080)
msgrcv$auto(0x0, 0x0, 0x2, 0x1, 0xb2)
msgsnd$auto(0x0, &(0x7f0000000000)={0x3, 0x45}, 0x8, 0x9)
executing program 5:
openat$auto_snd_pcm_oss_f_reg_pcm_oss(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/dsp1\x00', 0x20b42, 0x0)
read$auto_proc_reg_file_ops_compat_inode(0xffffffffffffffff, &(0x7f0000000280)=""/65, 0x41)
mmap$auto(0x0, 0x4020009, 0x6, 0xeb1, 0x401, 0x8000)
prctl$auto(0x1000000003b, 0x1, 0x4, 0x5, 0x7)
socket$nl_generic(0x10, 0x3, 0x10)
close_range$auto(0x2, 0x8, 0x0)
sendmsg$auto_NETDEV_CMD_DEV_GET(0xffffffffffffffff, &(0x7f0000000080)={&(0x7f0000000140)={0x10, 0x0, 0x0, 0x400000}, 0xc, 0x0, 0x1, 0x0, 0x0, 0x48000}, 0x0)
mmap$auto(0x0, 0x400008, 0xdf, 0x9b72, 0x2, 0x8000)
close_range$auto(0x2, 0x8000, 0x0)
sendmsg$auto_HSR_C_GET_NODE_STATUS(0xffffffffffffffff, &(0x7f0000000200)={0x0, 0x0, &(0x7f00000001c0)={&(0x7f0000000140)={0x68, 0x0, 0x200, 0x70bd26, 0x25dfdbfe, {}, [@HSR_A_IF1_AGE={0x8, 0x3, 0x200}, @HSR_A_IF2_SEQ={0x6, 0x7, 0x4}, @HSR_A_IFINDEX={0x8}, @HSR_A_NODE_ADDR_B={0xa}, @HSR_A_NODE_ADDR={0xa, 0x1, @broadcast}, @HSR_A_NODE_ADDR={0xa}, @HSR_A_IF1_AGE={0x8, 0x3, 0x38}, @HSR_A_IFINDEX={0x8}, @HSR_A_IF2_AGE={0x8, 0x4, 0x4}]}, 0x68}, 0x1, 0x0, 0x0, 0x40080}, 0x40090)
socket(0x2, 0x3, 0x100)
socket(0x10, 0x2, 0x0)
sendmsg$auto_NL80211_CMD_GET_REG(0xffffffffffffffff, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000200)={0x0, 0x1ac}, 0x1, 0x0, 0x0, 0x4004810}, 0x800)
sendmsg$auto_NL80211_CMD_GET_REG(0xffffffffffffffff, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000180)=ANY=[@ANYBLOB="720100", @ANYBLOB="13"], 0x1ac}}, 0x4004)
sendmmsg$auto(0x3, &(0x7f0000000080)={{0x0, 0x2, &(0x7f00000002c0)={0x0, 0xc4}, 0x1, 0x0, 0x0, 0x9}, 0x7}, 0x3, 0x0)
executing program 0:
mmap$auto(0x0, 0x20009, 0x4000000000df, 0xeb1, 0x401, 0x8000)
prctl$auto(0x22, 0x40, 0x0, 0x7, 0x7fffd)
clone$auto(0x20003b46, 0x2, 0x0, 0x0, 0x2)
prctl$auto(0x10000000024, 0x2, 0x2008, 0x4000000c, 0x80001)
openat$auto_vmwgfx_driver_fops_vmwgfx_drv(0xffffffffffffff9c, &(0x7f0000026d00)='/dev/dri/card1\x00', 0x2000, 0x0)
mmap$auto(0x0, 0x202000b, 0x3, 0xeb1, 0xfffffffffffffffa, 0x8000)
r0 = io_uring_setup$auto(0x401, 0x0)
socket(0x26, 0x80004, 0x73)
socket$nl_generic(0x10, 0x3, 0x10)
socket$nl_generic(0x10, 0x3, 0x10)
socket$nl_generic(0x10, 0x3, 0x10)
socket$nl_generic(0x10, 0x3, 0x10)
ioctl$auto_SNDCTL_DSP_SETTRIGGER(r0, 0x40045010, &(0x7f00000000c0))
clone$auto(0x4, 0x7, &(0x7f00000000c0)=0x1, &(0x7f0000000100)=0xff, 0x7ff)
mmap$auto(0x0, 0x2000b, 0xe2, 0xeb1, 0x405, 0xfffffffffffffff9)
clone$auto(0x3fff, 0xad3, 0x0, 0x0, 0x7fffffff)
wait4$auto(0xffffffffffffffff, 0x0, 0x80000001, 0x0)
sendmsg$auto_GTP_CMD_NEWPDP(0xffffffffffffffff, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000180)={0x0}, 0x1, 0x0, 0x0, 0x8000}, 0x4040804)
lstat$auto(0x0, &(0x7f0000000180)={0x4, 0xb, 0x6, 0x76402f57, 0x0, 0x0, 0x0, 0x4, 0x40000000000f, 0x400, 0x40000402, 0x4, 0x9, 0x4, 0x9, 0x7, 0x20000010010b})
r1 = socket$nl_generic(0x10, 0x3, 0x10)
dup3$auto(0x8000000000000001, 0x5, 0x800080000)
ioctl$sock_SIOCGIFINDEX(r1, 0x89fc, &(0x7f0000000040)={'bridge0\x00'})
socket$nl_generic(0x10, 0x3, 0x10)
socket$nl_generic(0x10, 0x3, 0x10)
eventfd$auto(0x3)
eventfd$auto(0x0)
r2 = socket(0xa, 0x2, 0x0)
bpf$auto(0x0, &(0x7f0000000000)=@link_update={r2, @new_prog_fd=0x4, 0x4}, 0xa3)
setsockopt$auto_SO_WIFI_STATUS(0xffffffffffffffff, 0x0, 0x29, 0x0, 0x9)
getsockopt$auto(0xffffffffffffffff, 0x6, 0x3, &(0x7f0000000140)='bridge0\x00', &(0x7f0000000240)=0x6b96)
executing program 5:
mmap$auto(0x0, 0x20009, 0xe2, 0xeb1, 0xffffffffffffffff, 0x8000)
close_range$auto(0x2, 0x8, 0x0)
socket(0x8, 0x2, 0x9)
r0 = socket(0x2, 0x1, 0x0)
r1 = socket(0x2, 0x1, 0x0)
bind$auto(0x3, &(0x7f0000000040)=@in={0x2, 0xffff, @remote}, 0x6a)
listen$auto(r0, 0x7)
sendmmsg$auto(r1, &(0x7f0000000140)={{&(0x7f0000000040), 0x12, 0x0, 0x9, 0x0, 0x1, 0xb}, 0x800009}, 0x5, 0x20000000)
r2 = openat$auto_proc_reg_file_ops_compat_inode(0xffffffffffffff9c, &(0x7f0000000000)='/proc/asound/card1/pcm0c/sub7/sw_params\x00', 0x0, 0x0)
pread64$auto(r2, 0x0, 0xffe, 0x0)
executing program 5:
r0 = socket(0x10, 0x2, 0x0)
close_range$auto(0x2, 0x8, 0x0)
socket(0x10, 0x2, 0x4)
socket(0x10, 0x3, 0x6)
sendmsg$auto_NL80211_CMD_GET_REG(r0, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000300)=ANY=[@ANYBLOB="72010000", @ANYBLOB="120027", @ANYBLOB="5de1"], 0x1ac}}, 0x40000)
read$auto(r0, &(0x7f0000000000)='$-]&@\x00', 0x5)
executing program 5:
mmap$auto(0x0, 0x400008, 0xdf, 0x9b72, 0x2, 0x8000)
socketpair$auto(0x1e, 0x5, 0x8000000000000000, 0x0)
r0 = openat$auto_vmuser_fops_vmci_host(0xffffffffffffff9c, &(0x7f0000000180), 0x6b2c03, 0x0)
ioctl$auto_IOCTL_VMCI_VERSION2(r0, 0x7a7, 0x0)
ioctl$auto_IOCTL_VMCI_INIT_CONTEXT(r0, 0x7a0, 0x6)
ioctl$auto_IOCTL_VMCI_CTX_ADD_NOTIFICATION(r0, 0x7af, 0x0)
ioctl$auto_IOCTL_VMCI_CTX_ADD_NOTIFICATION(r0, 0x7af, 0x0)
futex$auto(0x0, 0x6, 0x8, 0x0, 0x0, 0x80000001)
openat$auto_binder_fops_binder_internal(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/binderfs/binder0\x00', 0x80, 0x0)
mmap$auto(0x0, 0x2020009, 0x3, 0xeb1, 0xffffffffffffffff, 0x8000)
select$auto(0xfffffff3, &(0x7f0000000100)={[0x5, 0x400, 0x4, 0x3, 0xea47, 0x101, 0xa, 0x3ff, 0x4, 0xb4be, 0xfffffffffffffeff, 0x5, 0x3, 0xfffffffffffffffd, 0x40, 0x80]}, 0x0, 0x0, 0x0)
r1 = openat$auto_kernfs_file_fops_kernfs_internal(0xffffffffffffff9c, &(0x7f0000000080)='/sys/devices/LNXSYSTM:00/LNXSYBUS:00/PNP0A03:00/device:08/adr\x00', 0x0, 0x0)
read$auto(r1, 0x0, 0x20)
r2 = openat$auto_proc_fail_nth_operations_base(0xffffffffffffff9c, &(0x7f0000000000)='/proc/thread-self/fail-nth\x00', 0x802, 0x0)
writev$auto(r2, &(0x7f0000000200)={0x0, 0x7}, 0x3)
syz_genetlink_get_family_id$auto_tipcv2(&(0x7f0000000300), 0xffffffffffffffff)
mmap$auto(0x0, 0x4020009, 0x6, 0xeb1, 0x401, 0x8000)
r3 = openat$auto_proc_reg_file_ops_compat_inode(0xffffffffffffff9c, &(0x7f00000000c0)='/proc/self/net/fib_triestat\x00', 0x0, 0x0)
pread64$auto(r3, 0x0, 0x200000000006, 0x5)
r4 = openat$auto_kernfs_file_fops_kernfs_internal(0xffffffffffffff9c, &(0x7f0000000080)='/sys/devices/LNXSYSTM:00/LNXSYBUS:00/PNP0C0F:00/status\x00', 0xa140, 0x0)
read$auto_kernfs_file_fops_kernfs_internal(r4, &(0x7f0000000000)=""/112, 0x70)
sendmsg$auto_NL80211_CMD_GET_REG(0xffffffffffffffff, &(0x7f0000000240)={0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x40814}, 0x2004c0c4)
executing program 6:
mmap$auto(0x0, 0x4020009, 0x8000000080000000, 0x17, 0x401, 0x8000)
madvise$auto(0x0, 0xffffffffffff0005, 0x17)
openat$auto_clear_warn_once_fops_(0xffffffffffffff9c, &(0x7f0000000100), 0x210800, 0x0)
r0 = openat$auto_tty_fops_tty_io(0xffffffffffffff9c, &(0x7f0000000000)='/dev/tty46\x00', 0x0, 0x0)
close_range$auto(0x2, 0x8, 0x0)
socket(0x10, 0x2, 0x0)
socket(0x2, 0x6, 0x0)
mmap$auto(0x0, 0x400005, 0xdf, 0x9b72, 0x2, 0x8000)
socket(0xa, 0x5, 0x84)
bind$auto(0x3, 0x0, 0x6a)
ioctl$auto(0x3, 0x800005411, 0x38)
ioctl$auto(r0, 0x5600, 0x0)
mmap$auto(0x6, 0x400005, 0xffffffffffffff00, 0x9b72, r0, 0x8000)
close_range$auto(0x2, 0x8, 0x0)
socketpair$auto(0x1, 0x2, 0x8000000000000000, 0x0)
r1 = openat$auto_force_devcoredump_fops_hci_vhci(0xffffffffffffff9c, &(0x7f0000000c40)='/sys/kernel/debug/bluetooth/hci0/force_devcoredump\x00', 0x2, 0x0)
write$auto(r1, 0x0, 0xe)
mremap$auto(0x0, 0xffffffffffffffff, 0x3fd6, 0x3, 0x7fffffffb000)
mmap$auto(0x0, 0x400005, 0x800000000000df, 0x9b72, 0x2, 0x8000)
madvise$auto(0x0, 0xffffffffffff0001, 0x15)
r2 = openat$auto_proc_clear_refs_operations_internal(0xffffffffffffff9c, &(0x7f0000000600)='/proc/thread-self/clear_refs\x00', 0x2, 0x0)
mmap$auto(0x0, 0x8, 0xdf, 0x9b72, 0x2, 0x8000)
setitimer$auto(0x4, &(0x7f0000000000)={{0x1ff, 0x10001}, {0x200000000004, 0x6}}, 0x0)
openat$nci(0xffffffffffffff9c, &(0x7f0000000000), 0x2, 0x0)
bpf$auto(0x12, &(0x7f0000000000)=@info={0x2800, 0x1ff, 0x2}, 0xcf)
r3 = socket(0x10, 0x2, 0x0)
sendmsg$auto_NL80211_CMD_GET_REG(r3, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000300)=ANY=[@ANYBLOB=' \x00\x00\x00', @ANYBLOB="1200", @ANYBLOB=']'], 0x1ac}}, 0x40000)
recvmmsg$auto(r3, &(0x7f0000000380)={{0x0, 0x1, &(0x7f0000000000)={0x0, 0x400}, 0x4, 0x0, 0x200002, 0x8}, 0x803}, 0xfffffff9, 0x10010, 0x0)
write$auto_proc_clear_refs_operations_internal(r2, 0x0, 0xffffff4b)
socket(0xa, 0x3, 0x3a)

program did not crash
replaying the whole log did not cause a kernel crash
single: executing 1 programs separately with timeout 1m40s
testing program (duration=1m40s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): mmap$auto-madvise$auto-openat$auto_clear_warn_once_fops_-openat$auto_tty_fops_tty_io-close_range$auto-socket-socket-mmap$auto-socket-bind$auto-ioctl$auto-ioctl$auto-mmap$auto-close_range$auto-socketpair$auto-openat$auto_force_devcoredump_fops_hci_vhci-write$auto-mremap$auto-mmap$auto-madvise$auto-openat$auto_proc_clear_refs_operations_internal-mmap$auto-setitimer$auto-openat$nci-bpf$auto-socket-sendmsg$auto_NL80211_CMD_GET_REG-recvmmsg$auto-write$auto_proc_clear_refs_operations_internal-socket
detailed listing:
executing program 0:
mmap$auto(0x0, 0x4020009, 0x8000000080000000, 0x17, 0x401, 0x8000)
madvise$auto(0x0, 0xffffffffffff0005, 0x17)
openat$auto_clear_warn_once_fops_(0xffffffffffffff9c, &(0x7f0000000100), 0x210800, 0x0)
r0 = openat$auto_tty_fops_tty_io(0xffffffffffffff9c, &(0x7f0000000000)='/dev/tty46\x00', 0x0, 0x0)
close_range$auto(0x2, 0x8, 0x0)
socket(0x10, 0x2, 0x0)
socket(0x2, 0x6, 0x0)
mmap$auto(0x0, 0x400005, 0xdf, 0x9b72, 0x2, 0x8000)
socket(0xa, 0x5, 0x84)
bind$auto(0x3, 0x0, 0x6a)
ioctl$auto(0x3, 0x800005411, 0x38)
ioctl$auto(r0, 0x5600, 0x0)
mmap$auto(0x6, 0x400005, 0xffffffffffffff00, 0x9b72, r0, 0x8000)
close_range$auto(0x2, 0x8, 0x0)
socketpair$auto(0x1, 0x2, 0x8000000000000000, 0x0)
r1 = openat$auto_force_devcoredump_fops_hci_vhci(0xffffffffffffff9c, &(0x7f0000000c40)='/sys/kernel/debug/bluetooth/hci0/force_devcoredump\x00', 0x2, 0x0)
write$auto(r1, 0x0, 0xe)
mremap$auto(0x0, 0xffffffffffffffff, 0x3fd6, 0x3, 0x7fffffffb000)
mmap$auto(0x0, 0x400005, 0x800000000000df, 0x9b72, 0x2, 0x8000)
madvise$auto(0x0, 0xffffffffffff0001, 0x15)
r2 = openat$auto_proc_clear_refs_operations_internal(0xffffffffffffff9c, &(0x7f0000000600)='/proc/thread-self/clear_refs\x00', 0x2, 0x0)
mmap$auto(0x0, 0x8, 0xdf, 0x9b72, 0x2, 0x8000)
setitimer$auto(0x4, &(0x7f0000000000)={{0x1ff, 0x10001}, {0x200000000004, 0x6}}, 0x0)
openat$nci(0xffffffffffffff9c, &(0x7f0000000000), 0x2, 0x0)
bpf$auto(0x12, &(0x7f0000000000)=@info={0x2800, 0x1ff, 0x2}, 0xcf)
r3 = socket(0x10, 0x2, 0x0)
sendmsg$auto_NL80211_CMD_GET_REG(r3, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000300)=ANY=[@ANYBLOB=' \x00\x00\x00', @ANYBLOB="1200", @ANYBLOB=']'], 0x1ac}}, 0x40000)
recvmmsg$auto(r3, &(0x7f0000000380)={{0x0, 0x1, &(0x7f0000000000)={0x0, 0x400}, 0x4, 0x0, 0x200002, 0x8}, 0x803}, 0xfffffff9, 0x10010, 0x0)
write$auto_proc_clear_refs_operations_internal(r2, 0x0, 0xffffff4b)
socket(0xa, 0x3, 0x3a)

program did not crash
single: failed to extract reproducer
bisect: bisecting 45 programs with base timeout 1m40s
testing program (duration=1m51s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): [3, 3, 22, 11, 30, 26, 26, 27, 21, 2, 4, 4, 30, 30, 30, 16, 30, 26, 15, 24, 24, 30, 5, 6, 30, 2, 30, 15, 30, 26, 5, 25, 6, 6, 25, 30, 5, 30, 27, 15, 30, 10, 6, 22, 30]
detailed listing:
executing program 1:
unshare$auto(0x8)
openat$auto_ftrace_set_event_notrace_pid_fops_trace_events(0xffffffffffffff9c, &(0x7f0000000000)='/sys/kernel/debug/tracing/set_event_notrace_pid\x00', 0x4000, 0x0)
vmsplice$auto(0x1, &(0x7f0000000040)={&(0x7f0000000040), 0x1ffc0}, 0xa, 0x6)
executing program 1:
unshare$auto(0x8)
openat$auto_ftrace_set_event_notrace_pid_fops_trace_events(0xffffffffffffff9c, &(0x7f0000000000)='/sys/kernel/debug/tracing/set_event_notrace_pid\x00', 0x4000, 0x0)
vmsplice$auto(0x1, &(0x7f0000000040)={&(0x7f0000000040), 0x1ffc0}, 0xa, 0x6) (fail_nth: 1)
executing program 1:
mmap$auto(0x0, 0x2000a, 0x10000000000df, 0xeb2, 0x401, 0x8000)
openat$auto_kernfs_file_fops_kernfs_internal(0xffffffffffffff9c, 0x0, 0x882, 0x0)
close_range$auto(0x2, 0x8, 0x0)
r0 = openat$auto_kvm_chardev_ops_kvm_main(0xffffffffffffff9c, &(0x7f00000011c0), 0xe0180, 0x0)
ioctl$auto_KVM_CREATE_VM(r0, 0xae01, 0x0)
bind$auto(0xffffffffffffffff, 0x0, 0x62)
ioctl$auto(0x3, 0xae60, 0x10000000000402)
socket(0x10, 0x2, 0x4)
mmap$auto(0x0, 0x2000d, 0x4000000200df, 0xeb1, 0x404, 0x8000)
sendmsg$auto_NL80211_CMD_GET_REG(0xffffffffffffffff, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000200)={0x0}}, 0x800)
sendmsg$auto_NL80211_CMD_SET_POWER_SAVE(0xffffffffffffffff, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000180)={0x14, 0x0, 0x200, 0x70bd29, 0x25dfdbfe}, 0x14}, 0x1, 0x0, 0x0, 0x20004800}, 0x48080)
sendmsg$auto_HWSIM_CMD_DEL_RADIO(0xffffffffffffffff, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000000180)=ANY=[@ANYBLOB="14000000", @ANYRES16, @ANYBLOB="01"], 0x14}, 0x1, 0x0, 0x0, 0x20040800}, 0x24004000)
sendmsg$auto_NL80211_CMD_GET_REG(0xffffffffffffffff, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000180)=ANY=[@ANYBLOB="72010000", @ANYBLOB="1200"], 0x1ac}}, 0x40000)
sendmmsg$auto(0x3, &(0x7f0000000080)={{0x0, 0x2, &(0x7f00000002c0)={0x0, 0xc4}, 0x1, 0x0, 0x0, 0x9}, 0x7}, 0x3, 0x0)
r1 = open(&(0x7f0000000100)='.\x00', 0x0, 0x110)
mmap$auto(0x0, 0x2020009, 0x3, 0xeb1, 0xfffffffffffffffa, 0x8000)
prctl$auto(0x1000000003b, 0x1, 0x4, 0x5, 0x7)
mmap$auto(0x0, 0x400008, 0xdf, 0x9b72, 0x2, 0x800008000)
madvise$auto(0x0, 0xffffffffffff0001, 0x15)
removexattr$auto(0x0, 0x0)
getdents64$auto(r1, 0x0, 0x400)
ioctl$auto(0x3, 0x4020aea5, 0x38)
executing program 1:
mmap$auto(0x0, 0x4, 0x4000000000df, 0x40eb1, 0x401, 0x300000000000)
close_range$auto(0x0, 0xfffffffffffff000, 0x0)
openat$auto_proc_single_file_operations_base(0xffffffffffffff9c, &(0x7f0000000180)='/proc/fs/ext4/sda1/mb_stats\x00', 0x109100, 0x0)
mmap$auto(0x0, 0x8, 0xdf, 0x9b72, 0x2, 0x8000)
socket(0x18, 0x5, 0x2)
getpeername$auto(0x3, 0x0, 0x0)
r0 = openat$auto_tty_fops_tty_io(0xffffffffffffff9c, &(0x7f0000000000)='/dev/tty12\x00', 0x800, 0x0)
socket(0x10, 0x2, 0x4)
r1 = socketpair$auto(0x1e, 0x4, 0x8000000000000000, 0x0)
ioctl$auto(r0, 0x541c, r1)
read$auto_proc_pid_maps_operations_internal(r1, &(0x7f0000000040)=""/136, 0x88)
executing program 1:
openat$auto_tty_fops_tty_io(0xffffffffffffff9c, &(0x7f0000000180)='/dev/ptyzf\x00', 0x90800, 0x0)
mmap$auto(0x0, 0xa00006, 0x2, 0x40eb1, 0x602, 0x300000000000)
quotactl_fd$auto(0xffffffffffffffff, 0x1, 0x0, 0x0)
socket(0x2, 0x3, 0xfffffff1)
adjtimex$auto(&(0x7f00000004c0)={0xf332b71, 0x0, 0x0, 0xfffffffffffffffd, 0x40000d4, 0x8000000000001, 0x6, 0x0, 0x8, 0x9, 0x100000000000002, {0x2100000000, 0x10000}, 0x5, 0x100000006, 0xfffffffffffffffd, 0x1008000, 0x0, 0x80000004, 0x3, 0xffffffffffff628e, 0xa747, 0xdeae, 0x804})
socket(0x2b, 0x1, 0x1)
openat$auto_seq_oss_f_ops_seq_oss(0xffffffffffffff9c, &(0x7f0000000080)='/dev/sequencer2\x00', 0x2, 0x0)
r0 = openat$auto_snd_rawmidi_f_ops_rawmidi(0xffffffffffffff9c, &(0x7f0000000000)='/dev/snd/midiC2D0\x00', 0x1, 0x0)
write$auto(r0, &(0x7f0000000400)='/dev/audio1\x00', 0xa3d9)
unshare$auto(0x40000080)
ustat$auto(0x45, &(0x7f0000000040)={0x200, 0x2, "84d1d3931a0f", "0fa1b61ca8fe"})
mmap$auto(0x0, 0x4, 0x4000000000df, 0x40eb1, 0x401, 0x300000000000)
epoll_create$auto(0x3e)
socket(0xf, 0x5, 0x200084)
open(0x0, 0x0, 0x408)
prctl$auto(0x4, 0x0, 0x0, 0xfffffffffffffffd, 0x2)
socket(0x2, 0x1, 0x0)
bind$auto(0x3, &(0x7f0000000040)=@ethernet={0x6, @broadcast}, 0x6e)
ioctl$auto_PAGEMAP_SCAN(0xffffffffffffffff, 0xc0606610, &(0x7f000000c380)={0x60, 0x0, 0x100000, 0x10000000000000, 0xfffffffffffffffe, 0x0, 0x4000, 0x50b301a, 0x2c, 0x24, 0xff, 0x2})
socket$nl_generic(0x10, 0x3, 0x10)
mmap$auto(0x0, 0x2020009, 0x3, 0xeb1, 0xfffffffffffffffa, 0x8000)
capset$auto(0x0, 0x0)
lsm_list_modules$auto(0x0, 0x0, 0x0)
read$auto(0x4, 0x0, 0xfdef)
close_range$auto(0x2, 0x8, 0x0)
openat$auto_console_fops_tty_io(0xffffffffffffff9c, 0x0, 0x40, 0x0)
r1 = openat$auto_dvb_demux_fops_dmxdev(0xffffffffffffff9c, &(0x7f0000000140), 0x8040, 0x0)
ioctl$auto_dvb_demux_fops_dmxdev(r1, 0x403c6f2b, 0x0)
ioctl$auto(0x3, 0x6f29, 0x10000000000402)
syz_genetlink_get_family_id$auto_nl802154(0x0, 0xffffffffffffffff)
executing program 1:
mmap$auto(0x0, 0x4020009, 0xdf, 0xeb2, 0x401, 0x8000)
close_range$auto(0x2, 0x8, 0x0)
openat$auto_console_fops_tty_io(0xffffffffffffff9c, &(0x7f0000000000)='/dev/tty0\x00', 0x0, 0x0)
r0 = openat$auto_dvb_demux_fops_dmxdev(0xffffffffffffff9c, &(0x7f0000000140), 0x8040, 0x0)
openat2$auto(0xffffffffffffff9c, 0x0, 0x0, 0xf6)
mmap$auto(0x0, 0x2020009, 0x3, 0xeb1, 0xfffffffffffffffa, 0x8000)
r1 = openat$auto_kernfs_file_fops_kernfs_internal(0xffffffffffffff9c, &(0x7f0000000000)='/sys/devices/virtual/net/bond0/flags\x00', 0x101142, 0x0)
write$auto(r1, 0x0, 0x4)
io_uring_setup$auto(0x101, 0x0)
ioctl$auto_dvb_demux_fops_dmxdev(r0, 0x403c6f2b, 0x0)
ioctl$auto(0x3, 0x6f2d, 0x10000000000402)
mmap$auto(0x0, 0x20009, 0x4000000000df, 0xeb1, 0x401, 0x8000)
r2 = syz_genetlink_get_family_id$auto_mac80211_hwsim(&(0x7f0000000c80), 0xffffffffffffffff)
sendmsg$auto_HWSIM_CMD_NEW_RADIO(0xffffffffffffffff, &(0x7f0000000d80)={&(0x7f0000000c40), 0xc, &(0x7f0000000d40)={&(0x7f0000000cc0)={0x48, r2, 0x200, 0x70bd2b, 0x25dfdbfe, {}, [@HWSIM_ATTR_RX_RATE={0x8, 0x5, 0x80000001}, @HWSIM_ATTR_REG_HINT_ALPHA2={0x9, 0xb, 'IPVS\x00'}, @HWSIM_ATTR_RADIO_ID={0x8, 0xa, 0x1}, @HWSIM_ATTR_RADIO_ID={0x8, 0xa, 0x2}, @HWSIM_ATTR_REG_HINT_ALPHA2={0x5, 0xb, '\x00'}, @HWSIM_ATTR_FLAGS={0x8, 0x4, 0x5}]}, 0x48}}, 0x40000)
move_pages$auto(0x1, 0x2000000000003, 0x0, 0x0, 0x0, 0x8000400000000000)
r3 = socket(0xa, 0x801, 0x84)
setsockopt$auto(r3, 0x10000000084, 0x9, 0x0, 0x98)
r4 = openat$auto_hwsim_fops_ps_(0xffffffffffffff9c, &(0x7f0000000180)='/sys/kernel/debug/ieee80211/phy16/hwsim/ps\x00', 0x200200, 0x0)
r5 = fcntl$auto_F_UNLCK(r4, 0xb4, 0x2)
r6 = syz_genetlink_get_family_id$auto_ipvs(&(0x7f0000000200), r5)
msgctl$auto_IPC_SET(0x8, 0x1, &(0x7f00000002c0)={{0x40, <r7=>0xffffffffffffffff, 0x0, 0x8000, 0xfff, 0x9}, &(0x7f0000000240)=0x42, &(0x7f0000000280)=0x2, 0x4, 0x8, 0x3, 0x0, 0xffff, 0x5, 0x6, 0x1, @inferred=0xffffffffffffffff})
lstat$auto(&(0x7f0000000340)='./file0\x00', &(0x7f0000000380)={0x40, 0x40, 0x53, 0x7, <r8=>0xffffffffffffffff, 0xee00, 0x0, 0x0, 0x4b47, 0x80000001, 0xfffffffffffffc00, 0x2e98, 0x7, 0x6, 0xb1, 0x2400000000000, 0x3000000})
sendmsg$auto_IPVS_CMD_FLUSH(r5, &(0x7f0000000c00)={&(0x7f00000001c0)={0x10, 0x0, 0x0, 0x40}, 0xc, &(0x7f0000000bc0)={&(0x7f0000000440)={0x774, r6, 0x400, 0x70bd2c, 0x25dfdbfd, {}, [@IPVS_CMD_ATTR_SERVICE={0x2d4, 0x1, 0x0, 0x1, [@nested={0x127, 0x17, 0x0, 0x1, [@generic="871704ea4aadd981495ab19b63975258ce6c9a1ea0a045402baef57bd7ee8f1eaba1fa1024b4c912432525763cd39440d0a14be8688b6a7693e0edd74cb581b9ebfe7ab321aac94541e0e3bf6801edc66adb6d206a6be8078a60c4d460e66db02a378dc2e89035f253cf80e9dcb9263a8fd34a7c494c06b71476c62553dc00317095d9288a0ded8e29d4c06f4d14117aaa63911b9ed5f04a65f3c454713dbf5b44301d1859572d40f7337a7af5aab2385db70d22818c86b0a74f7dfb6383effb053ab3b344308ace69dbb3a920441287fec0ed38d9a3e82c", @nested={0x4, 0x4}, @typed={0x8, 0x14c, 0x0, 0x0, @uid=r7}, @generic="c95aeded1f45e66228f9ef8f19300d7bf662441524a771572da1f7b8d87b34363643666451b7ef6b465da11f79653ae58f10c2086d673e0b755d52a8ff7aff"]}, @nested={0x190, 0x45, 0x0, 0x1, [@typed={0xc, 0x5c, 0x0, 0x0, @u64=0x800}, @nested={0x4, 0x48}, @generic="7ad7aada77683072504900f7e10b4ebc4b89c6acd80c98d4e030f91c8fa79845ceb71dcda68cb7151f6f1ab4823b47aba46dea150fd09804d24ed3aceb75cb0e2dc80a7e1fb6784038e7fd453f571e5e923cf332530cffa1a0a69bbbd3487f78baf74b90ab3ab31f1a8ebe2850521bfe64691d22c538bd9c51d7d8abeb2e460443ef0e82739fe4a43147dd4d608b9542a1c603cf16585dc0", @nested={0x4, 0x124}, @nested={0x4, 0x66}, @generic="ae750686f8df37eb967da4ddcb4c194cd5821fabf1cfc74bcf581da957a13350396043316cd2b2a81eee34c55395c6e4dbc2070688d9da5c19bd34f286e87cf049bd0edd47ce2e2e1d07e13509a809d2946e3c85ece0197803b1254b0199ab473fb3a0f33d60df73d4b7515963cdc6342a3df3ab6ec42b95ede1e318d50429fc4eeabfe60f4260664d2ffc31f15edccaa1233252248a82f6222ae7d94efd29cd4532d3fba9cb0751d8f8e97762711a3ab31f8ce5a38acc152e8459a16fa19062c839cc231fc1712d21a5c4957241a6329b99a7a6de99464335cc54dd"]}, @typed={0xc, 0x8a, 0x0, 0x0, @u64=0xffffffff}, @typed={0xc, 0x14b, 0x0, 0x0, @u64=0x2}]}, @IPVS_CMD_ATTR_SERVICE={0xc, 0x1, 0x0, 0x1, [@nested={0x8, 0xe7, 0x0, 0x1, [@typed={0x4, 0x5f}]}]}, @IPVS_CMD_ATTR_DEST={0x1dc, 0x2, 0x0, 0x1, [@typed={0xbd, 0x10a, 0x0, 0x0, @binary="1d471fef13d7d7927e06ae36aff425cec03d8513acc40bb7f6f8e6ac012402ee3f855cbefe9a0e85dc4009d8d5a0d7a4cf84be605244c567d491d75076a860a59eeae83209fa59ddcd1b1bc65be47e3f7d24f57e815ee49b17594743a15722e990e65fa77f7e00331f008bddc30bb388186df51b4f805426a80345ae62454bf2cbfe32e347a6c2ec38c612c0b860c6d383e9a4d61d9e6f26bf5e0955f0e1438fdc25b05ded7039e02cbc426c31ac782c6cf32faa97620bce00"}, @generic="787604329aba534bd23ccfb0611b3af32dc783b4f7b4f23b5467f0abced5ca601877127b81629eadf6d69bbd815d73ecdd2b3bd3b08f5954aa2b0e4f64824428744e9c559b91bef55dd7285b16aa3466514fc38d3223cfcd41a0d4e095313d27853f559528e48ae34393a46eec32fa0339d9d503009ccae727d1b2c32883c770", @nested={0x8, 0x114, 0x0, 0x1, [@nested={0x4, 0xc1}]}, @generic="1fc2a9dd22cce4bd589b96e22a700747618b61175621e8265018aeee41dd88270905b46fc763b0eccc001b1e1a675119ff6ee8b7e6a19fa62a65a0b5843daa7388206204066b2624f26870cb88eff2a399220d48c83cff24a4f52a55ac8edece16abcde074be5637fb228f1d1684e660349c455a20b2e53587c94ffd1b111cc4660df0ef3c47bec4bf43f6080d982494"]}, @IPVS_CMD_ATTR_SERVICE={0x2a4, 0x1, 0x0, 0x1, [@nested={0xce, 0x8d, 0x0, 0x1, [@nested={0x4, 0xde}, @typed={0xc, 0x4e, 0x0, 0x0, @u64=0x800}, @generic="2d44f369315f2f33fef807b381ec2d4034f68bdabbf611b16d9c357172445c3adc454588394d93215b1e581157e77304964f631faf38be93009b5830a17d3e3d765a6502029d985a6eacecf4ceef0e2570df8c16f2b27e9520aa8eee7cbe3d59710d187a23d765d6746ceddceb0d03490f8c45683b55bb50bf7b715f2cb8ee9146382e8e024444144dd2bf7e968841a33b2960eae965a1175eef4ce7d48ebbf36a51e91f5ee9b48b55d1d42a8e12ee1736aba38071df4f6818aa"]}, @typed={0x14, 0x145, 0x0, 0x0, @ipv6=@empty}, @generic="2c1fb0a79c0e9148a9e7cc25ac084a5429c0851a59368468f6f6f5a5b050b50c106bde6711a06879274f0b9f8a99634f2724e40ee32d8b34eb992bf29ea0fa45626a8e602e5d5f27b3e7f6acfaeed5541eeb03cb563ad36d242deefed41e681bf8f75ea3b9751678cff50badb26602138254fbd1a74824865be99c2d1726ff5466988c04996954ec5be7a0d0bcc1108fe3050611c93e77f1d32a498f19d1bf52e2c75e40137e5db13ada7509b7c313dfb60c370f0cd8da455b2c9c851b442570fb8361ba1209159202ed6ac91b0eb54bea815df544a7420138f9885f542e351a1c0ac072d145af01627997ae5c519818a286fe0e546c3de06a873311", @typed={0x8, 0x93, 0x0, 0x0, @u32=0xa3}, @typed={0x8, 0xc8, 0x0, 0x0, @ipv4=@remote}, @typed={0x8, 0x12b, 0x0, 0x0, @fd=r3}, @typed={0xa0, 0xce, 0x0, 0x0, @binary="8b0844668f85eacdff95824596f319b55483e8b53d0e6206073551a6d61ef21ca31dbcf58ed08eba8c854863f6c0e20c1906dd6d05d3b472918d2e5c86dfc6a937d8d71d98420265da4054cea8e4642f8a179333f0551fb8b981ab8cf636f99887eb53ef5351a9ef50c4d991e1ccc04f285f7060ba015d2efa2f270de77960127e0c583286619e371875056f57bf44976e46f685cc27988263e655e8"}, @typed={0x8, 0x140, 0x0, 0x0, @uid=r8}]}]}, 0x774}, 0x1, 0x0, 0x0, 0x8811}, 0x4000)
r9 = syz_genetlink_get_family_id$auto_nl80211(&(0x7f0000000080), 0xffffffffffffffff)
sendmsg$auto_NL80211_CMD_CONTROL_PORT_FRAME(r5, &(0x7f0000000140)={&(0x7f0000000040), 0xc, &(0x7f0000000100)={&(0x7f00000000c0)=ANY=[@ANYBLOB='\x00\x00\x00\x00', @ANYRES16=r9, @ANYBLOB="040027bd7000fbdbdf25810000000400ae0008007e0006000000"], 0x20}, 0x1, 0x0, 0x0, 0x20008010}, 0x20000000)
openat$auto_proc_reg_file_ops_compat_inode(0xffffffffffffff9c, &(0x7f0000000000)='/proc/thread-self/net/rpc/nfsd.export/channel\x00', 0x8f3b7a51b8162d21, 0x0)
executing program 32:
mmap$auto(0x0, 0x4020009, 0xdf, 0xeb2, 0x401, 0x8000)
close_range$auto(0x2, 0x8, 0x0)
openat$auto_console_fops_tty_io(0xffffffffffffff9c, &(0x7f0000000000)='/dev/tty0\x00', 0x0, 0x0)
r0 = openat$auto_dvb_demux_fops_dmxdev(0xffffffffffffff9c, &(0x7f0000000140), 0x8040, 0x0)
openat2$auto(0xffffffffffffff9c, 0x0, 0x0, 0xf6)
mmap$auto(0x0, 0x2020009, 0x3, 0xeb1, 0xfffffffffffffffa, 0x8000)
r1 = openat$auto_kernfs_file_fops_kernfs_internal(0xffffffffffffff9c, &(0x7f0000000000)='/sys/devices/virtual/net/bond0/flags\x00', 0x101142, 0x0)
write$auto(r1, 0x0, 0x4)
io_uring_setup$auto(0x101, 0x0)
ioctl$auto_dvb_demux_fops_dmxdev(r0, 0x403c6f2b, 0x0)
ioctl$auto(0x3, 0x6f2d, 0x10000000000402)
mmap$auto(0x0, 0x20009, 0x4000000000df, 0xeb1, 0x401, 0x8000)
r2 = syz_genetlink_get_family_id$auto_mac80211_hwsim(&(0x7f0000000c80), 0xffffffffffffffff)
sendmsg$auto_HWSIM_CMD_NEW_RADIO(0xffffffffffffffff, &(0x7f0000000d80)={&(0x7f0000000c40), 0xc, &(0x7f0000000d40)={&(0x7f0000000cc0)={0x48, r2, 0x200, 0x70bd2b, 0x25dfdbfe, {}, [@HWSIM_ATTR_RX_RATE={0x8, 0x5, 0x80000001}, @HWSIM_ATTR_REG_HINT_ALPHA2={0x9, 0xb, 'IPVS\x00'}, @HWSIM_ATTR_RADIO_ID={0x8, 0xa, 0x1}, @HWSIM_ATTR_RADIO_ID={0x8, 0xa, 0x2}, @HWSIM_ATTR_REG_HINT_ALPHA2={0x5, 0xb, '\x00'}, @HWSIM_ATTR_FLAGS={0x8, 0x4, 0x5}]}, 0x48}}, 0x40000)
move_pages$auto(0x1, 0x2000000000003, 0x0, 0x0, 0x0, 0x8000400000000000)
r3 = socket(0xa, 0x801, 0x84)
setsockopt$auto(r3, 0x10000000084, 0x9, 0x0, 0x98)
r4 = openat$auto_hwsim_fops_ps_(0xffffffffffffff9c, &(0x7f0000000180)='/sys/kernel/debug/ieee80211/phy16/hwsim/ps\x00', 0x200200, 0x0)
r5 = fcntl$auto_F_UNLCK(r4, 0xb4, 0x2)
r6 = syz_genetlink_get_family_id$auto_ipvs(&(0x7f0000000200), r5)
msgctl$auto_IPC_SET(0x8, 0x1, &(0x7f00000002c0)={{0x40, <r7=>0xffffffffffffffff, 0x0, 0x8000, 0xfff, 0x9}, &(0x7f0000000240)=0x42, &(0x7f0000000280)=0x2, 0x4, 0x8, 0x3, 0x0, 0xffff, 0x5, 0x6, 0x1, @inferred=0xffffffffffffffff})
lstat$auto(&(0x7f0000000340)='./file0\x00', &(0x7f0000000380)={0x40, 0x40, 0x53, 0x7, <r8=>0xffffffffffffffff, 0xee00, 0x0, 0x0, 0x4b47, 0x80000001, 0xfffffffffffffc00, 0x2e98, 0x7, 0x6, 0xb1, 0x2400000000000, 0x3000000})
sendmsg$auto_IPVS_CMD_FLUSH(r5, &(0x7f0000000c00)={&(0x7f00000001c0)={0x10, 0x0, 0x0, 0x40}, 0xc, &(0x7f0000000bc0)={&(0x7f0000000440)={0x774, r6, 0x400, 0x70bd2c, 0x25dfdbfd, {}, [@IPVS_CMD_ATTR_SERVICE={0x2d4, 0x1, 0x0, 0x1, [@nested={0x127, 0x17, 0x0, 0x1, [@generic="871704ea4aadd981495ab19b63975258ce6c9a1ea0a045402baef57bd7ee8f1eaba1fa1024b4c912432525763cd39440d0a14be8688b6a7693e0edd74cb581b9ebfe7ab321aac94541e0e3bf6801edc66adb6d206a6be8078a60c4d460e66db02a378dc2e89035f253cf80e9dcb9263a8fd34a7c494c06b71476c62553dc00317095d9288a0ded8e29d4c06f4d14117aaa63911b9ed5f04a65f3c454713dbf5b44301d1859572d40f7337a7af5aab2385db70d22818c86b0a74f7dfb6383effb053ab3b344308ace69dbb3a920441287fec0ed38d9a3e82c", @nested={0x4, 0x4}, @typed={0x8, 0x14c, 0x0, 0x0, @uid=r7}, @generic="c95aeded1f45e66228f9ef8f19300d7bf662441524a771572da1f7b8d87b34363643666451b7ef6b465da11f79653ae58f10c2086d673e0b755d52a8ff7aff"]}, @nested={0x190, 0x45, 0x0, 0x1, [@typed={0xc, 0x5c, 0x0, 0x0, @u64=0x800}, @nested={0x4, 0x48}, @generic="7ad7aada77683072504900f7e10b4ebc4b89c6acd80c98d4e030f91c8fa79845ceb71dcda68cb7151f6f1ab4823b47aba46dea150fd09804d24ed3aceb75cb0e2dc80a7e1fb6784038e7fd453f571e5e923cf332530cffa1a0a69bbbd3487f78baf74b90ab3ab31f1a8ebe2850521bfe64691d22c538bd9c51d7d8abeb2e460443ef0e82739fe4a43147dd4d608b9542a1c603cf16585dc0", @nested={0x4, 0x124}, @nested={0x4, 0x66}, @generic="ae750686f8df37eb967da4ddcb4c194cd5821fabf1cfc74bcf581da957a13350396043316cd2b2a81eee34c55395c6e4dbc2070688d9da5c19bd34f286e87cf049bd0edd47ce2e2e1d07e13509a809d2946e3c85ece0197803b1254b0199ab473fb3a0f33d60df73d4b7515963cdc6342a3df3ab6ec42b95ede1e318d50429fc4eeabfe60f4260664d2ffc31f15edccaa1233252248a82f6222ae7d94efd29cd4532d3fba9cb0751d8f8e97762711a3ab31f8ce5a38acc152e8459a16fa19062c839cc231fc1712d21a5c4957241a6329b99a7a6de99464335cc54dd"]}, @typed={0xc, 0x8a, 0x0, 0x0, @u64=0xffffffff}, @typed={0xc, 0x14b, 0x0, 0x0, @u64=0x2}]}, @IPVS_CMD_ATTR_SERVICE={0xc, 0x1, 0x0, 0x1, [@nested={0x8, 0xe7, 0x0, 0x1, [@typed={0x4, 0x5f}]}]}, @IPVS_CMD_ATTR_DEST={0x1dc, 0x2, 0x0, 0x1, [@typed={0xbd, 0x10a, 0x0, 0x0, @binary="1d471fef13d7d7927e06ae36aff425cec03d8513acc40bb7f6f8e6ac012402ee3f855cbefe9a0e85dc4009d8d5a0d7a4cf84be605244c567d491d75076a860a59eeae83209fa59ddcd1b1bc65be47e3f7d24f57e815ee49b17594743a15722e990e65fa77f7e00331f008bddc30bb388186df51b4f805426a80345ae62454bf2cbfe32e347a6c2ec38c612c0b860c6d383e9a4d61d9e6f26bf5e0955f0e1438fdc25b05ded7039e02cbc426c31ac782c6cf32faa97620bce00"}, @generic="787604329aba534bd23ccfb0611b3af32dc783b4f7b4f23b5467f0abced5ca601877127b81629eadf6d69bbd815d73ecdd2b3bd3b08f5954aa2b0e4f64824428744e9c559b91bef55dd7285b16aa3466514fc38d3223cfcd41a0d4e095313d27853f559528e48ae34393a46eec32fa0339d9d503009ccae727d1b2c32883c770", @nested={0x8, 0x114, 0x0, 0x1, [@nested={0x4, 0xc1}]}, @generic="1fc2a9dd22cce4bd589b96e22a700747618b61175621e8265018aeee41dd88270905b46fc763b0eccc001b1e1a675119ff6ee8b7e6a19fa62a65a0b5843daa7388206204066b2624f26870cb88eff2a399220d48c83cff24a4f52a55ac8edece16abcde074be5637fb228f1d1684e660349c455a20b2e53587c94ffd1b111cc4660df0ef3c47bec4bf43f6080d982494"]}, @IPVS_CMD_ATTR_SERVICE={0x2a4, 0x1, 0x0, 0x1, [@nested={0xce, 0x8d, 0x0, 0x1, [@nested={0x4, 0xde}, @typed={0xc, 0x4e, 0x0, 0x0, @u64=0x800}, @generic="2d44f369315f2f33fef807b381ec2d4034f68bdabbf611b16d9c357172445c3adc454588394d93215b1e581157e77304964f631faf38be93009b5830a17d3e3d765a6502029d985a6eacecf4ceef0e2570df8c16f2b27e9520aa8eee7cbe3d59710d187a23d765d6746ceddceb0d03490f8c45683b55bb50bf7b715f2cb8ee9146382e8e024444144dd2bf7e968841a33b2960eae965a1175eef4ce7d48ebbf36a51e91f5ee9b48b55d1d42a8e12ee1736aba38071df4f6818aa"]}, @typed={0x14, 0x145, 0x0, 0x0, @ipv6=@empty}, @generic="2c1fb0a79c0e9148a9e7cc25ac084a5429c0851a59368468f6f6f5a5b050b50c106bde6711a06879274f0b9f8a99634f2724e40ee32d8b34eb992bf29ea0fa45626a8e602e5d5f27b3e7f6acfaeed5541eeb03cb563ad36d242deefed41e681bf8f75ea3b9751678cff50badb26602138254fbd1a74824865be99c2d1726ff5466988c04996954ec5be7a0d0bcc1108fe3050611c93e77f1d32a498f19d1bf52e2c75e40137e5db13ada7509b7c313dfb60c370f0cd8da455b2c9c851b442570fb8361ba1209159202ed6ac91b0eb54bea815df544a7420138f9885f542e351a1c0ac072d145af01627997ae5c519818a286fe0e546c3de06a873311", @typed={0x8, 0x93, 0x0, 0x0, @u32=0xa3}, @typed={0x8, 0xc8, 0x0, 0x0, @ipv4=@remote}, @typed={0x8, 0x12b, 0x0, 0x0, @fd=r3}, @typed={0xa0, 0xce, 0x0, 0x0, @binary="8b0844668f85eacdff95824596f319b55483e8b53d0e6206073551a6d61ef21ca31dbcf58ed08eba8c854863f6c0e20c1906dd6d05d3b472918d2e5c86dfc6a937d8d71d98420265da4054cea8e4642f8a179333f0551fb8b981ab8cf636f99887eb53ef5351a9ef50c4d991e1ccc04f285f7060ba015d2efa2f270de77960127e0c583286619e371875056f57bf44976e46f685cc27988263e655e8"}, @typed={0x8, 0x140, 0x0, 0x0, @uid=r8}]}]}, 0x774}, 0x1, 0x0, 0x0, 0x8811}, 0x4000)
r9 = syz_genetlink_get_family_id$auto_nl80211(&(0x7f0000000080), 0xffffffffffffffff)
sendmsg$auto_NL80211_CMD_CONTROL_PORT_FRAME(r5, &(0x7f0000000140)={&(0x7f0000000040), 0xc, &(0x7f0000000100)={&(0x7f00000000c0)=ANY=[@ANYBLOB='\x00\x00\x00\x00', @ANYRES16=r9, @ANYBLOB="040027bd7000fbdbdf25810000000400ae0008007e0006000000"], 0x20}, 0x1, 0x0, 0x0, 0x20008010}, 0x20000000)
openat$auto_proc_reg_file_ops_compat_inode(0xffffffffffffff9c, &(0x7f0000000000)='/proc/thread-self/net/rpc/nfsd.export/channel\x00', 0x8f3b7a51b8162d21, 0x0)
executing program 3:
mmap$auto(0x0, 0x400008, 0xdf, 0x9b72, 0x2, 0x8000)
capset$auto(0x0, 0x0)
openat$auto_proc_reg_file_ops_compat_inode(0xffffffffffffff9c, 0x0, 0x101000, 0x0)
syz_open_procfs$namespace(0x0, &(0x7f0000000040)='ns/mnt\x00')
openat$auto_snd_rawmidi_f_ops_rawmidi(0xffffffffffffff9c, &(0x7f0000000000)='/dev/snd/midiC2D0\x00', 0x1, 0x0)
listen$auto(0x3, 0x81)
read$auto(0x3, 0x0, 0xf3c)
setresuid$auto(0x2, 0xffffffffffffffff, 0x200)
keyctl$auto(0x5, 0xfffffffd, 0x101, 0x1, 0x4000000000b8c)
sysinfo$auto(&(0x7f0000000180)={0xffffffffffffffff, [0x1, 0x3, 0x5], 0x5, 0x5, 0x6, 0x6, 0x4, 0x400, 0x6, 0x0, 0xe, 0xd, 0xd})
keyctl$auto(0xb, 0xfffffffd, 0x7, 0xfffffffffff00003, 0x6)
mmap$auto(0x0, 0x20009, 0x4000000000df, 0xeb1, 0x401, 0x8000)
socket(0x10, 0x2, 0x0)
sendmsg$auto_NL80211_CMD_GET_REG(0xffffffffffffffff, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000200)={0x0, 0x1ac}, 0x1, 0x0, 0x0, 0x4004810}, 0x8800)
sendmsg$auto_HWSIM_CMD_NEW_RADIO(0xffffffffffffffff, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000000000)={0x28, 0x0, 0x1, 0x70bd26, 0x25dfdbff, {}, [@HWSIM_ATTR_PMSR_SUPPORT={0x14, 0x1a, 0x0, 0x1, [@NL80211_PMSR_ATTR_TYPE_CAPA={0x10, 0x4, 0x0, 0x1, [@NL80211_PMSR_TYPE_FTM={0xc, 0x1, 0x0, 0x1, [@NL80211_PMSR_FTM_CAPA_ATTR_MAX_FTMS_PER_BURST={0x5, 0x8, 0x5}]}]}]}]}, 0x28}, 0x1, 0x0, 0x0, 0x894}, 0x4)
mbind$auto(0x2, 0x1, 0x80000001, &(0x7f0000000240)=0x1a, 0x100000000, 0xad4)
futex_waitv$auto(&(0x7f0000000000)={0xf, 0x5d94, 0x4002, 0x4}, 0x77, 0xfffffffc, 0x0, 0x62bd)
sendmmsg$auto(0x3, &(0x7f0000000080)={{0x0, 0x2, &(0x7f00000002c0)={0x0, 0xc4}, 0x1, 0x0, 0x0, 0x9}, 0x7}, 0x3, 0x0)
mmap$auto(0x0, 0x400008, 0xdf, 0x9b72, 0x2, 0x8000)
openat$auto_v4l2_fops_v4l2_dev(0xffffffffffffff9c, &(0x7f0000000280)='/dev/video42\x00', 0x12181, 0x0)
r0 = socket(0x10, 0x2, 0x6)
r1 = socket$nl_generic(0x10, 0x3, 0x10)
r2 = syz_genetlink_get_family_id$auto_wireguard(&(0x7f0000000080), r1)
ioctl$sock_SIOCGIFINDEX(r1, 0x8933, &(0x7f0000000040)={'wg1\x00', <r3=>0x0})
sendmsg$auto_WG_CMD_GET_DEVICE(r1, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000180)={&(0x7f00000000c0)={0x1c, r2, 0x703, 0x70bd27, 0x25dfd9fc, {}, [@WGDEVICE_A_IFINDEX={0x8, 0x1, r3}]}, 0x1c}, 0x1, 0x0, 0x0, 0x880}, 0x4)
r4 = syz_genetlink_get_family_id$auto_nl802154(&(0x7f0000000040), 0xffffffffffffffff)
sendmsg$auto_NL802154_CMD_SET_MAX_CSMA_BACKOFFS(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000380)={0x14, r4, 0x1, 0x70bd28, 0x25dfdbfd, {0x11, 0x0, 0xfc}}, 0x14}, 0x1, 0x0, 0x0, 0x20008000}, 0x8044)
executing program 3:
mmap$auto(0x0, 0x4020009, 0xdf, 0xeb1, 0x404, 0x8000)
r0 = openat$auto_tty_fops_tty_io(0xffffffffffffff9c, &(0x7f0000000000)='/dev/ptyxe\x00', 0x48140, 0x0)
ioctl$auto_TIOCVHANGUP2(r0, 0x5437, 0x0)
r1 = io_uring_setup$auto(0x85, 0x0)
bind$auto(r1, &(0x7f0000000040)=@ethernet={0x6, @broadcast}, 0x6a)
ioctl$auto_FITRIM(r1, 0xc0185879, &(0x7f0000000040)={0x1, 0x400, 0x1d800000000000})
read$auto(0x3, 0x0, 0x80)
r2 = openat$auto_drm_crtc_crc_data_fops_drm_debugfs_crc(0xffffffffffffff9c, &(0x7f00000000c0), 0x0, 0x0)
read$auto_drm_crtc_crc_data_fops_drm_debugfs_crc(r2, 0x0, 0x17)
mmap$auto(0x0, 0x2020009, 0x3, 0xeb1, 0xfffffffffffffffa, 0x8000)
statmount$auto(0x0, &(0x7f0000000180)={0xa, 0x7, 0x1977, 0x7, 0x5, 0x7181, 0x8002, 0x7, 0x3, 0x9, 0x5, 0x80003, 0x4, 0x200000000000, 0xb4, 0x9, 0x8, 0x10006, 0x4000080, 0x0, 0x0, 0xe, 0x22000, 0x200, 0x0, 0xd363, [0x4000000003, 0x2, 0x0, 0x2, 0xcb, 0x2000, 0x0, 0xe, 0x70624ce7, 0x0, 0xfffffffffffffffc, 0xffffffffffffffff, 0x8, 0x0, 0x8, 0x0, 0xfffffffffffbfffd, 0x2000000000000004, 0x10000000000001, 0x10000000000, 0xffffffffffffffff, 0x8005, 0xfffffffffffffe00, 0x3, 0x0, 0x5, 0x400000000005b8, 0x5, 0x0, 0x100, 0x0, 0x6, 0x100002, 0x88e, 0x40, 0xfffffffffffffffc, 0x8, 0xffff, 0x0, 0x3, 0xfffffffffffffffc, 0x9, 0x8, 0x7, 0xc567]}, 0x1fe, 0xd)
r3 = openat$auto__ctl_fops_dm_ioctl(0xffffffffffffff9c, &(0x7f0000000180), 0x1541, 0x0)
r4 = socket(0x10, 0x2, 0x0)
sendmsg$auto_ETHTOOL_MSG_DEBUG_SET(0xffffffffffffffff, &(0x7f0000000180)={0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x2000000}, 0x4)
sendmsg$auto_NL80211_CMD_GET_REG(r4, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000300)=ANY=[@ANYBLOB=' \x00\x00\x00', @ANYBLOB="1200", @ANYBLOB="5de1"], 0x1ac}}, 0x40000)
recvmmsg$auto(r4, &(0x7f0000000140)={{0x0, 0x2, 0x0, 0x4, 0x0, 0x5, 0x8}, 0x5}, 0xfffffff9, 0x10, 0x0)
ioctl$auto__ctl_fops_dm_ioctl(r3, 0xfffffffffffffd09, &(0x7f00000001c0))
close_range$auto(0x2, 0x8, 0x0)
r5 = openat$auto_kvm_chardev_ops_kvm_main(0xffffffffffffff9c, &(0x7f00000011c0), 0x8c00, 0x0)
ioctl$auto_KVM_CREATE_VM(r5, 0xae01, 0x0)
ioctl$auto(0x3, 0x4010ae42, 0x38)
executing program 3:
r0 = openat$auto_kernfs_file_fops_kernfs_internal(0xffffffffffffff9c, &(0x7f0000000080)='/sys/devices/virtual/block/nbd1/queue/zone_append_max_bytes\x00', 0x0, 0x0)
read$auto_kernfs_file_fops_kernfs_internal(r0, &(0x7f0000001180)=""/187, 0xbb) (fail_nth: 2)
executing program 3:
r0 = socket(0x10, 0x2, 0x0)
sendmsg$auto_NL80211_CMD_GET_REG(r0, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000300)=ANY=[@ANYBLOB="72010000", @ANYBLOB="120027", @ANYBLOB="5de1523353782950330a"], 0x1ac}}, 0x40000)
read$auto(r0, &(0x7f0000000000)='$-]&@\x00', 0x5)
sendmsg$auto_NL80211_CMD_COLOR_CHANGE_REQUEST(0xffffffffffffffff, 0x0, 0x24004000)
executing program 3:
r0 = socket(0x10, 0x2, 0x0)
sendmsg$auto_NL80211_CMD_GET_REG(r0, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000300)=ANY=[@ANYBLOB="72010000", @ANYBLOB="120027", @ANYBLOB="5de1523353782950330a"], 0x1ac}}, 0x40000)
read$auto(r0, &(0x7f0000000000)='$-]&@\x00', 0x5) (fail_nth: 3)
sendmsg$auto_NL80211_CMD_COLOR_CHANGE_REQUEST(0xffffffffffffffff, 0x0, 0x24004000)
executing program 3:
socket(0xa, 0x1, 0x84)
mmap$auto(0x0, 0x20009, 0x4000000000df, 0xeb1, 0x401, 0x8000)
move_pages$auto(0x1, 0x2000000000003, 0x0, 0x0, 0x0, 0x8000400000000000)
bpf$auto(0x0, &(0x7f00000001c0)=@task_fd_query={0x0, 0x4, 0x3, 0x2, 0x8, 0xc, 0xe3, 0x400000000a, 0x3}, 0x6f4)
mmap$auto(0x0, 0x2020009, 0x3, 0xeb1, 0xfffffffffffffffa, 0x8000)
init_module$auto(0x0, 0xffff9, 0x0)
prctl$auto(0xeca0, 0x13, 0x4, 0x5, 0x7)
madvise$auto(0x0, 0xffffffffffff0005, 0x19)
madvise$auto(0x0, 0x8000000000000000, 0x15)
lseek$auto(0x3, 0x7fffffffffffffff, 0x0)
madvise$auto(0x0, 0x2000000080000001, 0x3)
socket(0x2, 0x1, 0x106)
socket(0x2b, 0x1, 0x1)
mmap$auto(0x0, 0x4020009, 0xdf, 0xeb1, 0x404, 0x8000)
getsockopt$auto(0x4, 0x6, 0x15, 0xfffffffffffffffc, 0x0)
mmap$auto(0x0, 0x2020009, 0x3, 0xeb1, 0xfffffffffffffffa, 0x8000)
capget$auto(0x0, 0xfffffffffffffffe)
capset$auto(0x0, &(0x7f0000000000)={0x2, 0x10000002, 0x6})
mmap$auto(0x0, 0x20009, 0xdf, 0xeb1, 0x401, 0x8000)
prctl$auto(0x1000000003b, 0x1, 0x4, 0x5, 0x7)
mmap$auto(0x0, 0x400005, 0xdf, 0x9b72, 0x2, 0x8000)
mmap$auto(0x0, 0x4, 0x4000000000df, 0x40eb2, 0x402, 0x300000000000)
move_mount$auto(0xffffffffffffffff, 0x0, 0xffffffffffffffff, 0x0, 0x91e4)
mmap$auto(0x0, 0x2020009, 0x3, 0xeb1, 0xfffffffffffffffa, 0x8000)
r0 = socket(0x10, 0x2, 0x0)
statmount$auto(0x0, &(0x7f0000000180)={0x408, 0x7, 0x1, 0x7, 0x44, 0x4909b6f8, 0x201ffdf, 0x7, 0x200003, 0x2, 0xa121, 0x3, 0x6, 0x4, 0xb4, 0xa, 0x6, 0x10001, 0x80, 0x100000000, 0x0, 0x7, 0x2100, 0x200, 0x0, 0x84, [0x2, 0x0, 0x0, 0x50100000000000, 0x6, 0x2000, 0x0, 0x6, 0x70624ce7, 0x0, 0xfffffffffffffffd, 0xfffffffffffffffd, 0x0, 0x0, 0x5, 0xffffffffffff7ffe, 0xffffffffffffbfff, 0xfffffffffffffffd, 0x1, 0x0, 0xffffffffffffffff, 0x4, 0xfffffffffffffffe, 0x2000000000000000, 0x0, 0x0, 0x400000000005b8, 0xc, 0x0, 0x0, 0x40000, 0x6, 0x0, 0x88e, 0x8000000000008, 0xfffffffffffffffc, 0x9, 0xa38, 0x0, 0x3, 0xfffffffffffffffa, 0x8, 0x4000000000, 0x7]}, 0x1fe, 0xd)
sendmsg$auto_OVS_VPORT_CMD_DEL(0xffffffffffffffff, &(0x7f0000000200)={0x0, 0x0, &(0x7f00000001c0)={&(0x7f0000000180)=ANY=[@ANYBLOB='<\x00\x00\x00', @ANYBLOB="10002d"], 0x3c}, 0x1, 0x0, 0x0, 0x8000}, 0x8000)
sendmsg$auto_NL80211_CMD_GET_REG(0xffffffffffffffff, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000280)={&(0x7f0000000180)=ANY=[], 0x1ac}}, 0x40000)
sendmmsg$auto(r0, &(0x7f0000000200)={{0x0, 0x0, &(0x7f0000000000)={0x0, 0xfc2}, 0x2, 0x0, 0x7, 0xa505}, 0x800}, 0x7, 0x4008)
socket(0xf, 0x2, 0xfffffff8)
executing program 33:
socket(0xa, 0x1, 0x84)
mmap$auto(0x0, 0x20009, 0x4000000000df, 0xeb1, 0x401, 0x8000)
move_pages$auto(0x1, 0x2000000000003, 0x0, 0x0, 0x0, 0x8000400000000000)
bpf$auto(0x0, &(0x7f00000001c0)=@task_fd_query={0x0, 0x4, 0x3, 0x2, 0x8, 0xc, 0xe3, 0x400000000a, 0x3}, 0x6f4)
mmap$auto(0x0, 0x2020009, 0x3, 0xeb1, 0xfffffffffffffffa, 0x8000)
init_module$auto(0x0, 0xffff9, 0x0)
prctl$auto(0xeca0, 0x13, 0x4, 0x5, 0x7)
madvise$auto(0x0, 0xffffffffffff0005, 0x19)
madvise$auto(0x0, 0x8000000000000000, 0x15)
lseek$auto(0x3, 0x7fffffffffffffff, 0x0)
madvise$auto(0x0, 0x2000000080000001, 0x3)
socket(0x2, 0x1, 0x106)
socket(0x2b, 0x1, 0x1)
mmap$auto(0x0, 0x4020009, 0xdf, 0xeb1, 0x404, 0x8000)
getsockopt$auto(0x4, 0x6, 0x15, 0xfffffffffffffffc, 0x0)
mmap$auto(0x0, 0x2020009, 0x3, 0xeb1, 0xfffffffffffffffa, 0x8000)
capget$auto(0x0, 0xfffffffffffffffe)
capset$auto(0x0, &(0x7f0000000000)={0x2, 0x10000002, 0x6})
mmap$auto(0x0, 0x20009, 0xdf, 0xeb1, 0x401, 0x8000)
prctl$auto(0x1000000003b, 0x1, 0x4, 0x5, 0x7)
mmap$auto(0x0, 0x400005, 0xdf, 0x9b72, 0x2, 0x8000)
mmap$auto(0x0, 0x4, 0x4000000000df, 0x40eb2, 0x402, 0x300000000000)
move_mount$auto(0xffffffffffffffff, 0x0, 0xffffffffffffffff, 0x0, 0x91e4)
mmap$auto(0x0, 0x2020009, 0x3, 0xeb1, 0xfffffffffffffffa, 0x8000)
r0 = socket(0x10, 0x2, 0x0)
statmount$auto(0x0, &(0x7f0000000180)={0x408, 0x7, 0x1, 0x7, 0x44, 0x4909b6f8, 0x201ffdf, 0x7, 0x200003, 0x2, 0xa121, 0x3, 0x6, 0x4, 0xb4, 0xa, 0x6, 0x10001, 0x80, 0x100000000, 0x0, 0x7, 0x2100, 0x200, 0x0, 0x84, [0x2, 0x0, 0x0, 0x50100000000000, 0x6, 0x2000, 0x0, 0x6, 0x70624ce7, 0x0, 0xfffffffffffffffd, 0xfffffffffffffffd, 0x0, 0x0, 0x5, 0xffffffffffff7ffe, 0xffffffffffffbfff, 0xfffffffffffffffd, 0x1, 0x0, 0xffffffffffffffff, 0x4, 0xfffffffffffffffe, 0x2000000000000000, 0x0, 0x0, 0x400000000005b8, 0xc, 0x0, 0x0, 0x40000, 0x6, 0x0, 0x88e, 0x8000000000008, 0xfffffffffffffffc, 0x9, 0xa38, 0x0, 0x3, 0xfffffffffffffffa, 0x8, 0x4000000000, 0x7]}, 0x1fe, 0xd)
sendmsg$auto_OVS_VPORT_CMD_DEL(0xffffffffffffffff, &(0x7f0000000200)={0x0, 0x0, &(0x7f00000001c0)={&(0x7f0000000180)=ANY=[@ANYBLOB='<\x00\x00\x00', @ANYBLOB="10002d"], 0x3c}, 0x1, 0x0, 0x0, 0x8000}, 0x8000)
sendmsg$auto_NL80211_CMD_GET_REG(0xffffffffffffffff, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000280)={&(0x7f0000000180)=ANY=[], 0x1ac}}, 0x40000)
sendmmsg$auto(r0, &(0x7f0000000200)={{0x0, 0x0, &(0x7f0000000000)={0x0, 0xfc2}, 0x2, 0x0, 0x7, 0xa505}, 0x800}, 0x7, 0x4008)
socket(0xf, 0x2, 0xfffffff8)
executing program 2:
socket$nl_generic(0x10, 0x3, 0x10)
mmap$auto(0x0, 0x2020009, 0x3, 0xeb1, 0xfffffffffffffffa, 0x8000)
prctl$auto(0x1000000003b, 0x1, 0x4, 0x5, 0x7)
openat$auto(0xffffffffffffffff, 0x0, 0x8, 0x8001)
write$auto(0x1, 0x0, 0x80000000)
openat$auto_dvb_demux_fops_dmxdev(0xffffffffffffff9c, 0x0, 0x200, 0x0)
openat$auto_ppp_device_fops_ppp_generic(0xffffffffffffff9c, 0x0, 0x80080, 0x0)
setresgid$auto(0xffffffffffffffff, 0x28000000000000, 0x7)
r0 = syz_clone(0x11, 0x0, 0x0, 0x0, 0x0, 0x0)
r1 = getpgid(0x0)
kcmp$auto(r1, r0, 0x1, 0xffffffffffffffff, 0xffffffffffffffff)
r2 = openat$auto_tty_fops_tty_io(0xffffffffffffff9c, &(0x7f0000000100)='/dev/tty48\x00', 0x800, 0x0)
ioctl$auto(r2, 0x4b65, r2)
ioctl$sock_SIOCGIFINDEX(0xffffffffffffffff, 0x8933, 0x0)
mmap$auto(0x0, 0x2020009, 0x3, 0xeb1, r2, 0x8000)
sendmsg$auto_NETDEV_CMD_QUEUE_GET(0xffffffffffffffff, 0x0, 0x4000)
close_range$auto(0x2, 0x8, 0x0)
mmap$auto(0x0, 0x2020009, 0x3, 0xeb1, 0xfffffffffffffffa, 0x8000)
sendmsg$auto_NL80211_CMD_GET_REG(0xffffffffffffffff, &(0x7f00000000c0)={0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x4004810}, 0x800)
sendmmsg$auto(0x3, &(0x7f0000000080)={{0x0, 0x2, 0x0, 0x1, 0x0, 0x0, 0x9}, 0x7}, 0x3, 0x0)
r3 = openat$auto_kvm_chardev_ops_kvm_main(0xffffffffffffff9c, &(0x7f000000fc00), 0x3, 0x0)
mmap$auto(0x0, 0x400008, 0xdf, 0x9b72, 0x2, 0x8000)
r4 = socket(0x2, 0x1, 0x0)
bind$auto(0x3, &(0x7f0000000040)=@in={0x2, 0xffff, @remote}, 0x6a)
sendmmsg$auto(r4, &(0x7f0000000140)={{&(0x7f0000000040), 0x12, 0x0, 0x4, 0x0, 0x7fff, 0x4}, 0x80000b}, 0x5, 0x20000000)
write$auto(0x3, 0x0, 0x7fffffff)
recvfrom$auto(0x3, 0x0, 0x8000000017, 0x10e, 0x0, 0xfffffffffffffffd)
shutdown$auto(0x200000003, 0x2)
ioctl$auto_KVM_CREATE_VM(r3, 0xae01, 0x1)
mmap$auto(0x0, 0x400008, 0xdf, 0x9b72, 0x2, 0x18000)
executing program 2:
r0 = openat$auto_kernfs_file_fops_kernfs_internal(0xffffffffffffff9c, &(0x7f00000002c0)='/sys/devices/virtual/block/ram3/queue/iostats_passthrough\x00', 0x80302, 0x0)
r1 = socket$nl_generic(0x10, 0x3, 0x10)
r2 = socket$nl_generic(0x10, 0x3, 0x10)
r3 = syz_genetlink_get_family_id$auto_l2tp(&(0x7f0000000640), 0xffffffffffffffff)
sendmsg$auto_L2TP_CMD_TUNNEL_CREATE(r2, &(0x7f0000001040)={0x0, 0x0, &(0x7f0000000280)={&(0x7f0000000000)={0x5c, r3, 0x1, 0x70bd2d, 0x25dfdbfd, {0x1, 0x0, 0x3f00}, [@L2TP_ATTR_OFFSET={0x6, 0x3, 0x7}, @L2TP_ATTR_PROTO_VERSION={0x5, 0x7, 0x58}, @L2TP_ATTR_CONN_ID={0x8, 0x9, 0x8}, @L2TP_ATTR_PEER_CONN_ID={0x8, 0xa, 0x8}, @L2TP_ATTR_IP6_SADDR={0x14}, @L2TP_ATTR_IP6_DADDR={0x14, 0x20, @ipv4={'\x00', '\xff\xff', @local}}]}, 0x5c}, 0x1, 0x0, 0x0, 0x4c019}, 0x0)
r4 = getpid()
process_vm_readv$auto(r4, &(0x7f0000000080)={0x0, 0xfff}, 0x1, &(0x7f0000000280)={0x0, 0xffffffff}, 0x6, 0x0)
r5 = openat$auto_nvmf_dev_fops_fabrics(0xffffffffffffff9c, &(0x7f00000004c0), 0x101202, 0x0)
write$auto_nvmf_dev_fops_fabrics(r5, 0x0, 0x0)
write$auto_nvmf_dev_fops_fabrics(r5, 0x0, 0x0)
prctl$auto_PR_SET_MM_START_STACK(0x95, 0x5, 0x0, 0x0, 0x6)
stat$auto(&(0x7f00000000c0)='./file0\x00', &(0x7f0000000100)={0x9a, 0x100, 0x8, 0xb, <r6=>0xee00, 0x0, 0x0, 0x2, 0x3, 0x5, 0x3, 0x7, 0x5, 0x3, 0x0, 0x4, 0x6})
sendmsg$auto_TIPC_NL_KEY_SET(r1, &(0x7f0000000380)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x2000000}, 0xc, &(0x7f0000000340)={&(0x7f0000001080)={0x1810, 0x0, 0x800, 0x70bd28, 0x25dfdbfc, {}, [@TIPC_NLA_PUBL={0x1780, 0x3, 0x0, 0x1, [@typed={0x4, 0xa0}, @typed={0x8, 0x13e, 0x0, 0x0, @fd=r2}, @typed={0x8, 0x51, 0x0, 0x0, @pid=r4}, @nested={0x1ae, 0x134, 0x0, 0x1, [@generic="3f74007cf8216c93f7f106e28c20943f34e65ec832411016497e483652e7550fe0101174f511f2ed4c9f171e443ecf965a3393ce09132ebbe53e6507a8b14ec350bff171c838d43899f7d5d8fef51c2ab2d10a1b3845d9fa42a03ce6c6fefa2022d1879ab3a78248fed9e8dea2691a521a57e1e2aa1812c7b13b56b781ed7dadf92ed58728dfc3d9a8f70d2a65117d1d9b0346dfb5680f89128236a8f783953c6e64dbc879b166554bbec4343328e89bf966", @nested={0x4, 0xb2}, @nested={0x4, 0xe3}, @nested={0x4, 0x6f}, @nested={0xe4, 0x72, 0x0, 0x1, [@typed={0xdf, 0x5c, 0x0, 0x0, @binary="8639085f4dab6f652f0c8731f21b5f4ff470001bc7872f6a894ffd577d0c5128b65d6fb4b18be68f28113a0d9d7ef8781a8a996ad4d0f5bd89e31fe08798fc115855735af81c8790d23457d0d28915f4f13dba152d344d0ad27f602309a122a3ac1328226702917fee850b82a3a77b6c40f16c0c60b06f9b1da972938e3c909972fbba8a4db784634003a79b6b71cf0221443639ddf3b695c2d8d60693564eeab5454db2920546961073d1c329ccad9b99e19a6fdd105eb5d1b953b0924441d890ce9fcb2aa90211cf34e16864c975e821c44743d6c340aa392443"}]}, @typed={0x8, 0x68, 0x0, 0x0, @ipv4=@dev={0xac, 0x14, 0x14, 0x1d}}]}, @nested={0x15b7, 0x1, 0x0, 0x1, [@nested={0xea, 0x7f, 0x0, 0x1, [@generic="30f498d8ba7ccbb263ea2b1c70913a51bd4f945e562bbb203751f199f9311aa60fb5a2dab43c8f8b86483a132046a0da12eea866c552a027f855466c8f444b60d2d9d6665f6c2e6be94c87d88c31960151cb3b90e53b69ba5de75df1617bafeba6e850f7e2ede1fcc7c8dec6490f2e04ad7dadcd89ce6c67bd48a8e8242f7a9977878fa7444f9fe6555117a073c921160e4b3292d44e921bf94eb5cc7d0f51b8930bc53f2d3e6ac53aa3be3297f45e62f9f189b8c2b7dfd57005fb0c27576074c77fdd149ead1bfdfb4329b040cf16e285104a0c22e41008f7c224d3e12b", @typed={0x8, 0x62, 0x0, 0x0, @pid=r4}]}, @typed={0x9, 0x83, 0x0, 0x0, @str='\xf9})\xb5\x00'}, @typed={0x8, 0x136, 0x0, 0x0, @uid=r6}, @typed={0x8, 0x23, 0x0, 0x0, @fd=r2}, @nested={0xe2, 0xd, 0x0, 0x1, [@generic="45b415df6e1efa332ab11a6e453257f273132fa34bc8b77a0d6b0c7ace8513803f5a1cb1156876b226d39869c85fe3b170e9ad58466bde972b84191d99a5ab41cb05f0b588fc5619873d504c0835c7c9c23374340000030ad94793888c151a6b8cfe4dbeb7544d8d4ddc", @generic="5b1f3f84a94bbf3a01986e1334d365b98ddd4f9a80da80394ef62301da97aa0a0baed54b5dd24d9909ad25f3946e3012f8f6dde3c65f28d9c7955654a055980d47ef68a9c5755f56266527580e9500eae0f1c663f765769e83b92b32801eadfa2fc352f435f07e28874d9ca11884149f79583385"]}, @nested={0x1d4, 0x4b, 0x0, 0x1, [@generic="37e71a544d1fd1f6d3863c9044a067eedad18784b7347ca7d4a3ac6757b28a6ff331c3acf8ec679be8f9c2566a61d28bea9bbf4b9018566163bd231a424e35964da54e43e9b608ce1f224e35466f356904f4729773aa495d6628d74f309a09a4c4f7796e4ab435eef7424b582f8c273d8ab251499ead1f07d58abd38cce5314d120f98cbd9395e95449eecea5687e9a6197490813990534a179967bc6b689ef46551290c6efe80b25b3d44c7bb45a46276ec1edc9303f64c04935674aeff1f28b2eec759db3104917c24f49bff6678aeca5e0319332a01385a", @generic="8375f0b5247ed3d6921813a6a10f081d686680d361d51386e07c5f5a09d25806f67eee9e15ddb3ea11cb16a2df220bb34d166d70a42fb754c086f71405246cfb3d008917c29ea104205e2e521bbab2291970d68c45b5f3bea7720c966a1ce4d63f8f6ca0860b652b5497613e2eabee57cf1b335176110e32ab252ca7adbe0573ed48a31ea091cab9321eb6242a07357aaa9adfbeb9a36598697edfe70966877db021003a6d2efe1a0019bb8b144f59424c4d248b69c32400418c5f312dad674ccd07f7d35371bafc60d1bbd86334320c67ad33a4e51bd925628786", @nested={0x4, 0x1d}, @nested={0x4, 0x105}, @nested={0x4, 0x20}, @typed={0xc, 0xde, 0x0, 0x0, @u64=0xf202}, @nested={0x4, 0x1d}]}, @generic="3db2dea5ae6f1c330670f4c839e550fdd362b4fd3eb77a7f6720b6f8773053a3b5bf33e60485ddb9e8de06a9050e4dec0463807c383d24be4c90ae70c9b5e2ec6b640b7cc3de7b0b4313241a7ebc5e2f7314494657918f058c09927283cbacbb19f46b3890665b527c1c002ee94f491454377ef0281582edafc68ac8d76f8c2d340ad2f07d505d84d019c7e0cbbdf1df82adead52c7a8e33567a1e48376a9c9081e37131b8070db74a5a7f547be2adbc0271fcc7c6082ea6a92e22003b8362a77151f89b5f8924da98767d004dff7507b6c2928b28f48acc00a5b2c89dc4ec51c0679d2d0f3c7f5405fdc37f467df0d7a4e503958a0bd29405ec55cf737c94a258c775c3b8b126204d68752c8214d55970a029cac48b021f2a5374871fae934f1cfc15a3c49792ac84f89cdbed122fb91b648a91ea1eb807ba20397556e191c2ddb987ff500fcf3dd2f232bd79e61d486d3fc5e19049bff76a9e1df67285b2dc1e112a27fa42a35a1b2ee8b57d3618c3298a999aefe527e24a9122249be58c499e6cfa1d912c36e01c02e1457b0088fd03c04f87e33bf7cf906683e4c4a2fc804b2233f63b58ce259494a9ca378f39b7c4d25a8340ebb233e4f2083e59efd0f65f21128d917f3b4d5cce592a35b52dfd86300b9c01f7f2a2b97f7fe487cbb09707f130c08942f4a4878bb90122df1139754bd161510f7d0cb4372b70e6934bf8cf77397450866ba350dd50890280e442d5fcad909dde13aea60b6a1d72fca35a624977d5b6e36ba0fc683301a78b3caedb3a728649e03efa2b64522f753dcd6fa43d5e142aeed05a45f02cf89e909b65d24f492cb872db8457c0307fd78db25afb4be57450ac7dc5675e6657dbc382853fd20f68de75c20a7bd22760e5d1dace835c719d1fcc9e0fc1503b2832e8d291ad1fe8325ab6eb8271ca73aafa5decf4620f3d13655e463be3b58102a023d26f9595698b88ca5d5a2e27072c95e44a52ac2f0aeaea9c3e2f50e420f28da204242ede123aa3136ceb13e7963099c2e36208592088ec5f7bc3bc81604ba179ab3244f2c75c3a17764b1ea6d4f16cbf6f921de77d89685fc7c767348ba753944f4e6acb3fff7d7e2c14d272dd8b0d65275693ce970c19c1b9ab25240bb81de7035a1cf5d49fc941af6c46ae31d0c693ddfc15796781c2c93544f8eee398ac65157155a8d3e820fc83d5469ac0a0753332f32d471202dedf9329ecccecb293ace723fb2516a90053cca718dce686056f139e825476d4007021460217ad1472158bf6320eee5bbcd8d45930fac59209c4abb04a341e394129f3bd75a488ed9118a65a3328f1cd5c2556b1da01abf48752fff081bfbc63cd2b25788917dc8563aea774dd46c9facf127e88c07209bbd71aeba29028fba467daf489eef52c123021c0e62357e103c4e42e0c29406525ed9efaf75478e802b4093d0ae0c7700b81a5773365776bbd751a93abb97072e497238aaf6f7c59d17fb9cb89e32b9d13413b62ae869f6a98030c63722ba4089384cd7f0b4b4cb65de2bee537f700b053afd7cd5248e6dab99140d6ea7b235fca2cf75ee4e98e1d236f8ca0d4b29624c220597508efdad7afe0f18d3a3457ea5eaf36064a6d72facd8c6bf4c8104bdd8d11421defd8f5dbbfb43f6b4dab5546225240852f339122184a8c331a495cf36423a52a7dff9461d7ac1dae4a7da523607b4473a2a5189c4179daeabe10405887b70ad83fc390289ad89035a04ab077c2563d7d2bd14ee4e9c76e213fd8fc9a3ca4aaab98c2795b565a525c665361a0276f1d1622f6606b46620b1f12c1ab420548c00d8f8cbe0370cd11646b31e7f406efcbf823636f625659b44ae390da6200869c48b88d82b7fce5eca4df70795c36d6249d6a07a62757f77fcf20f48bf0aa0d2fffc3fd12a9f175580a04ddccf21c131f6aeb3ac670431859073d1e06cbb25e7b45c8b0288e9aa29ba172469022322748af09d787e7f1709a9db35e40100746b390233f4112c40e3cd83a77411ca321ef3e336840779e89ea83633b8feef38867b1dad8077a4315cd617ab409fd6898569857c512963fb63f469b176a57b70c62686ec7bbc29c954682029bf6c75df7caa85a943965290bfad738b7f8c5ead8e133af39bfa9a0c29bc751399e8ea401505af6cde1b39c7f4e0fd10adc4f31401578494ae72dc86bb9bcf9136d9fca5847b08f4f4821d19bf28aed830e6c57b59740d6692d693268d83c0b559a963a1a723ed9e189261fd6d97592d49d8b8d58960bc0c2e8aaeb3b268cf96059b0dd480726543be6155dfab263eacc4ed773c28a53cf62a584e55eac04c1ad91ea62d6e92ab5450af90d546d25849ee4a4636d89f735a8411febfdd40cc85767d494d4c5bedc70f59ff482f473cf3b2795cc7bee41871943f908de5fd4fe879a5a1aeae64c9b69f52be9cfb5a11411d9cc1dc20e5e88329cc17731447a7bf201c807ee13acd5e1c1884f08890e924e7883d89f15b9814f6ff919697647828dfe1a172b5d1167415cd8f32cf6b511ae2c03b1492bcd5a8a2fb85fba2e998d772e3cca76b4b81d62e628a7a25678cc3a6cf556d43087732077e3fa61d193d49efbd1c29432c211244e1731a08a171507f0d63ae4c60b01533cdf81713340c9f474c4fbaa6eb801212d2f0cf65b394da4a25ff89d5696b3123f56e26f5f1e95d2c055c73fbbaeb63fc5fcde99a88f959b109170fe1fa2b837fc07dff9f94c95fefa1a7a870bf4fedbd099176accf500534711e1c4d389bcef19e7144d8cf9519b2d44a8ebe5da7c4e89861261e69df204524db99530affcc3f890cd857028e8a5330cf3667118360f198d3211cef7d9bb02090eba7f36ec16f385978be0c486d46a1ca5c8de4822c2c70d8203edd983127bf1a37edc38e96ebb9fedc18e706a1bab959c07e282926c206f6e9f00c9b1f7cee5492cde227fd92483beed255913c301c9ed217c8b1bac85a1eef438094bcc64e6a9a4c7e2fbd0cdeed9cc68dc50b49694d78a3fbcd9e206d95fd081054ba543a6041122b702e84ef59bc6b3554dbb436cb7404ee5e6fb3410f2d5f94da1a43e170a5e7f9118e3a9f764b6d6b3e52f314aace23df883415e1bdeb96e8b21328987731192ccb7e785bcd43df7c6555a03255ae8eb28c5a20477e2c6b077c5a073a107333fb43c22d36fe4bf66a84b83efb424a2bfe5f406bd05e43baaf4c6cc4a96797d5da7c0782f048b071e974f419097ddd4785ba6e2b5e7088cfeb0ffad6a36989409666265bbcfece2d8eb601e6c95dc8aca77a2df99a46ea363a38144e7c957aa666bb42f2e97a0b3197cbbb3c0d5d35cd9b4044162738c47fcb8a78c46da6802dafedb8ba69f0a653bbb9649e77b1107b62e2357a8c11bcf82798b7db847de03589946089a66938d690f7c7ae20d1cb9c9401ae911f698f13e8090b9b09a40e7c7c1065ede2e72c369cdeb9d7501ab3d2190b566fada98efcdebbad6066c2f72ee3e4cc021e08d11f9378095f78532e1c994ede51792b32f76456af8b9fcc3b07f9e3a04f9e7e641e5454985f53ae0c2e1f5f3021eb1098c4ffb435c155fb34345771df10d9cffdd8840f2c1e7c41e85725c839111466f57fc1fea9753715cb05d354ac0c9ca3595854f4c2df213227d6e86b4ececce31d380caf0b36b252a0c39c73b9a6f6729dfcc4b49b450da30c9c29d7bcebc60a86faaf337bebccf8f5392c6cbf7c7fafe6c0b828c12a9eca2474bfdc0a29829a3f73fbfcd123a8afaee3f9f9ddff79683aa40ed943712544fc186eb066778090594571b074b5f2b3afbdb491a3f6dcfe4bd4b524391829dbbbd73e36e8bffcd22aaccb49a4f831fa6731f1d618354d4a700cc1ea0506bddf76f2fc720539981b00f1744ddc33bfc965599cc7c3cdbb2596684c300ae65703c1196659a6e15ebbde08e87ea889c00996054f9d99df98367df40342b75a7c142f13cc9b97c0dec556e69a9737c485ad6b0522944094de584661e5279eebdad5a48d822d74f37ab91e50d4aefbfcef9466132aba8875bd18d987bcc4edf6790c8eaf22dcef8a053a3d4d39218934bca578d708315aad24868c706fa34c85699a308ae39a881dfcf86fd1d0b30f6494180acadad637c72850c7be3a0dd3aa71614c566e17f3783653ae64dc1317b0069feb62c3b1a34ff18bc1f1013cec721338714afdf8a7db2f917e075f2de8a6ceba096bc4e6e142b0a335e6663fd82cb95265ca24375094570a4297a579b589849e14f0875cfbbb92c0f191e93bebfd158b56096b3b68e3273a497e7147cb148a65804d39cc3799d87ae26ad7a245f8a483dbaf10a5fd477927235cbfa0b31e1d633302f8989da5c9afd4ea6e93f6a017b3b9f45400f5b9c0115fbac884a33ea815ddae71327d0371eed762b56d0e5faafbc275726adc639645edc94bf28633f1bd30d62101edc959f312c14c65300586950c9eaf31426f1419f64e6f1918739b34a013df9fa724b14650c4c693823096bbfef32619a4f4aa4588c45d453485fd2234e8ca17bee9fad440631977682563033c153a709d794a788661348d28b97b1861adb7ad75177b1662363020587760f32ec937cf1073dce02721d3375370cc68366fc40226ca0c81ae4160e8eaeade80b673b0edd48c4bfc0663526df1eeb0c5391a9b1f2235e1731efe92aa6ff4f0363cce74128c347c0327bda48caa87f31bc5dd7528db4a81e923f546b4b760fd94562f750dc225b0caa149383ad7b6798d1d56cc17cea0ef5689abead36afa42792f44081823cbcf4fe7bfd15df6de5930f102130c3a749a1439e11bf34d024820c10d71b8c2cc8eb0e9ad587439c5a2e1aa2f32efd620c75a8bdb65fdf4f3494fb23241548321edcfa72573c29071d50cdf19adbe9f520d83dd45994b4bbd828bd157b5b9a1b42428118994a2ac14cadbea3446852db1ffd6f8e61471028243bb9355483fcb621feae842e94f94ec9f7bcdf9af6f8638c4949e612fb6d1d4e218be9487b77a5d2daaf68a6488a8f18ac9f37a25543dc6080dfd17903ed005273200371332ea51d75f7a7e2c8b413eaf099201b565653ce7a1e98dfd8ca953da58d5fa04c5cd3244c480c96f0c4e4c0f0284ed8c70b954e6a26c9a852437fd31df867892250af5db38d4fae3b5e7f55fc2b669004fb1fc46b1bacf522756ab6234e011a80043b39bcd60f991cf116a658b33c9960f6e8c6c63ab48415f2441896ce5fe302899964217054460192cad0926ee2374be57f500b5326c9272123b7d977251748a122597eb5d19382f7f4d6ac361f259a372fbb736e95dfed4a832b9d77a997598f431dbf615580f2ce4adc6f3cf72e4ef647cb870afbed67b803ba88e6ef4134454308e5d68fba6643cdf07170188ac36a165317e1e1ff1ccae0c04b6df2dfab2dd784e9e7f2194b8e85b1d98efb7e4885a55783995ba9e74f2b231ddc2d9c0c5d9322d0ec3ccb5510d75bc00c8a9fc2b9fd9c3f315e1b259e71cccb58645db60fcf550fd15bef87712f8b27aea1197b45afc78fa37679553bae82b9c913a8b9c742dff6e6f5f5bfcaf49b72812653a835ad59ccfb2b7be59301efecbbab8c758252f471dbcd38329059dde96b3a2160ec978eccbb2f017db037f26286ae64b988a1734f87503ca89407b7c7ea9855dbefebc49d1dc691c8521c76e3bc0d3bb2c6ff1ac90e441c228aa5b2453f6ad794bc9bb9c57d18b55f4203ded793600c76801524c5f96238176ed553887981ca2b29661c45b92f236f211cf5ad87eb7325df", @typed={0x8, 0x117, 0x0, 0x0, @pid=r4}, @generic="7848392974b3c06a0ee27f7affa7a40607c7f0a2361822dffd7623956feadd6cb6ff3739725ef9e7aa540617688bd74ba7d7a7a6b4b71e6c03fab9a092704f34e04a5fdd87c4a2ac2a20d547216225be36853e2e69269e1cd9e469fe0d95bcfe8ec6cebf55079a29d22173b07c5afaa1d9921b3fc953f1183b9473970bd1bd1b3a83207cb26476d651f45c72104a4a1b1b6a6b60fc06331dc917b25fd84c0c8ffb7d72b2134b2b05c805195a1629a79badb6e383dff974291f566e319a8dc5547e93590f67a23b80a5236d612e20bd291ac31a482a12964cbacaacf2f6d12077ebc28a593b25afcaad91c96b4e83e5d1164db2", @generic="c92ccdad86ab559b20c76a0e6876ad09b40528860beb76a40c3748f83b08735023fc623d3176c1ca2eaf02f52ea8a5f0a009cf3eaa69d978cfb3fb71657b0663d069ff3418702ebca2b92ca6f4718674028b5ee3a5e778175a3626fa95ee62389d30a8a8685bed79e6be1adf6d8e598c437b4976f0c6912f66a93b5a1bde97b1c8a7b472e42cad18992b00f5b7b9b1961e497d994a826760e18e76290b92ab3e8b25776a70a221d7d9ee9295c0a60e7ec0fc3171d07aa1b743f385f03d3ca6aebeac2b1bae4f0870f5a2c6289b7684cfe530d4abcbf1838ffea022b7c6ea68448ca7bac68359f9bdec78581c41cb7f1c751cfb1e8335946a"]}]}, @TIPC_NLA_NET={0x7a, 0x7, 0x0, 0x1, [@typed={0xc, 0x4b, 0x0, 0x0, @u64=0x2}, @generic="bb645bc1680e23ef9375f4ba97b28d2fa6883639aa178ff52e3f5816b4e289841d2f18d11780f0b2993944eeac4a6e1e0e24e1e7617241de0e34dfb219e277911f360a2049ad745e9562a0d645266e63fbca0d5e42d9fda7031dfb38300ff582707b8361c1560cbd8f62"]}]}, 0x1810}, 0x1, 0x0, 0x0, 0x4}, 0x4004810)
mmap$auto(0x0, 0x2020009, 0x3, 0xeb1, 0xfffffffffffffffa, 0x8000)
madvise$auto(0x108000, 0x800034, 0xa)
sendfile$auto(r0, r0, 0x0, 0x3)
executing program 2:
mmap$auto(0x0, 0xe983, 0xdf, 0xeb1, 0x401, 0x8000)
sendmsg$auto_NL80211_CMD_GET_REG(0xffffffffffffffff, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000200)={0x0, 0x1ac}, 0x1, 0x0, 0x0, 0x4004810}, 0x800)
bpf$auto(0x0, &(0x7f00000001c0)=@test={0xffffffffffffffff, 0xffff, 0xfffff0b6, 0x5, 0xff, 0xac1, 0x2, 0x36242398, 0xfffff5b2, 0x3bb, 0x7, 0xffff, 0x800, 0x81, 0x68198}, 0x6f3)
r0 = socket(0x2, 0x1, 0x0)
close_range$auto(0x2, 0xa, 0x0)
r1 = socket$nl_generic(0x10, 0x3, 0x10)
socket(0x2, 0x3, 0x2)
getsockopt$auto(r0, 0x0, 0xcf, 0x0, 0x0)
r2 = socket(0x2c, 0x8180b, 0x67)
sendmsg$auto_NL80211_CMD_START_AP(r1, &(0x7f0000000740)={&(0x7f0000000480)={0x10, 0x0, 0x0, 0x4}, 0xc, &(0x7f0000000700)={&(0x7f00000004c0)={0x228, 0x0, 0x200, 0x70bd29, 0x25dfdbfb, {}, [@NL80211_ATTR_TDLS_OPERATION={0x5}, @NL80211_ATTR_PROBE_RESP={0xc6, 0x91, "b115c623f370c56f66e456048653950cf0eeda7ef15a981dcf6426abe06771909f0c689d6916de5759cd95f560b5c3e6e15bff365d33dab578ca3c52377279aa39baa39fa37d74c2ca190fd0e761869db0b8a6d12c1d6fa32744fceae6bbcbf12289ec19320c66a94bf68f03959a45dbb0eb013b32aaea2d15c03b2528245c77ad243fae4279281e7efe2137d9a895c480d01daceeb32eb1544dbba3381907ebef1d013ebb918b442034d27b9086282d5b6e527edb6410e9c9a2a3e2eb7a154c979b"}, @NL80211_ATTR_SCHED_SCAN_RELATIVE_RSSI={0x5, 0xf6, 0x10}, @NL80211_ATTR_MU_MIMO_FOLLOW_MAC_ADDR={0xdd, 0xe8, "f7523d62b236edacfea193cc0643de264f4a95bc101466455723af7209299a6e8d10a673e95297c7bbdb2f0d795f264cc30ace286c314b2d2243ba81e6c6324471d7d3ef2ac8e5e911f3921e3d36b349665f09672808971993adacd8ceb6d503b959383e804ca42b50497c33bcf21a8d1e70a3ca3804800e4f8fd6267e07f191ee0851d48b8d379b7a6120fd13de484ac83b774ba13ebae2ac030db2d87697191f6ab3c4c76e5bf59711bda8fdf7804205254490d595036f47d602e4c3bac1ce35f7d2158e3edfd56e98fccdb024731d0409e9249d0da042ae"}, @NL80211_ATTR_LOCAL_STATE_CHANGE={0x4}, @NL80211_ATTR_CENTER_FREQ1={0x8}, @NL80211_ATTR_MESH_CONFIG={0x50, 0x23, 0x0, 0x1, [@typed={0x4a, 0x13f, 0x0, 0x0, @binary="24bf0b1e106524fe2723887c2b056908df8d79f4fc1dcbf7886d5fd573fbd665d81e86799e2a7e728ef1bf4c1c79c5bf5a3f378727468f4c213251f73759df25d357d3b6821d"}]}]}, 0x228}, 0x1, 0x0, 0x0, 0x4}, 0x20000040)
sendmsg$auto_ETHTOOL_MSG_EEE_SET(0xffffffffffffffff, &(0x7f0000001700)={0x0, 0x0, &(0x7f00000016c0)={&(0x7f0000000100)=ANY=[@ANYBLOB="d4000000", @ANYRES16=0x0, @ANYBLOB="100027bd7000fbdbdf2518000000200001800247eea41fac000014000200766574683100000000000000000000000800070063fbffff0500060001000000840002803d00488013b37090badc49d6dc93876646d25a4d297d01cd3b7da38d12889cc50d505f353dc42d0a3c0a14c7b46428910708003600", @ANYRES32=0x0, @ANYBLOB="0400b3800000003d003b800400a4800c009a00008000000000000004008680c16ab1b1b39dcaa14b6af7dcc011b43cf706e562811c62b28a702b72e0a87126700294f2350000000c000180080003"], 0xd4}, 0x1, 0x0, 0x0, 0x20000010}, 0x20008000)
r3 = clone$auto(0x20003b46, 0x2, 0x0, 0x0, 0x2)
socket(0x10, 0x3, 0x0)
openat$auto_adf_hb_cfg_fops_adf_heartbeat_dbgfs(0xffffffffffffff9c, &(0x7f0000000040)='/sys/kernel/debug/ieee80211/phy1/netdev:wlan1/smps\x00', 0x20a00, 0x0)
mmap$auto(0x0, 0x2020009, 0x3, 0xeb1, 0xfffffffffffffffa, 0x8000)
sendmsg$auto_NL80211_CMD_GET_REG(0xffffffffffffffff, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000200)={0x0, 0x1ac}, 0x1, 0x0, 0x0, 0x4004810}, 0x800)
sendmsg$auto_OVS_PACKET_CMD_EXECUTE(0xffffffffffffffff, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000240)={&(0x7f0000000040)=ANY=[@ANYBLOB='@\x00\x00\x00', @ANYRES16, @ANYBLOB="1b0026bd7400fddbdf250300000004000800100003800c000980"], 0x40}, 0x1, 0x0, 0x0, 0x4004040}, 0xc800)
sendmsg$auto_NETDEV_CMD_QUEUE_GET(0xffffffffffffffff, &(0x7f0000003040)={0x0, 0x0, &(0x7f0000003000)={&(0x7f0000000040)=ANY=[@ANYBLOB="1c000000", @ANYRES16=0x0, @ANYBLOB="010600bd7000fbdbdf250a"], 0x1c}, 0x1, 0x0, 0x0, 0x20040004}, 0x20008810)
syz_genetlink_get_family_id$auto_mac80211_hwsim(&(0x7f0000000040), 0xffffffffffffffff)
sendmsg$auto_NL80211_CMD_GET_REG(0xffffffffffffffff, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000280)={&(0x7f0000000340)=ANY=[@ANYRES16=r3, @ANYBLOB="1a00"], 0x1ac}, 0x1, 0x0, 0x0, 0x81c0}, 0x1)
sendmsg$auto_NL80211_CMD_GET_REG(0xffffffffffffffff, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000040)=ANY=[@ANYBLOB="72010000", @ANYBLOB="19"], 0x1ac}}, 0x40000)
r4 = syz_genetlink_get_family_id$auto_nl802154(&(0x7f0000000380), r2)
sendmsg$auto_NL802154_CMD_SET_CCA_ED_LEVEL(r2, &(0x7f0000000440)={&(0x7f0000000300)={0x10, 0x0, 0x0, 0x2}, 0xc, &(0x7f0000000400)={&(0x7f00000003c0)={0x14, r4, 0xf08, 0x70bd2a, 0x25dfdbfc}, 0x14}, 0x1, 0x0, 0x0, 0x894}, 0x40000)
sendmmsg$auto(0x3, &(0x7f0000000080)={{0x0, 0x1c03, &(0x7f0000000000)={0x0, 0xc4}, 0x1, 0x0, 0x0, 0x9}, 0x1}, 0x2, 0x0)
close_range$auto(0x2, 0x8, 0x0)
open(0x0, 0x22040, 0x75)
r5 = socket(0x10, 0x2, 0x4)
sendmsg$auto_ETHTOOL_MSG_WOL_SET(0xffffffffffffffff, &(0x7f0000002cc0)={0x0, 0x0, &(0x7f0000002c80)={&(0x7f0000000180)=ANY=[@ANYBLOB=',\x00\x00\x00', @ANYBLOB="010027"], 0x2c}, 0x1, 0x0, 0x0, 0x4801}, 0x0)
sendmsg$auto_NL80211_CMD_GET_REG(r5, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000180)=ANY=[@ANYBLOB="72010000", @ANYBLOB="12"], 0x1ac}}, 0x40000)
sendmmsg$auto(0x3, &(0x7f0000000080)={{0x0, 0x2, &(0x7f00000002c0)={0x0, 0xc4}, 0x1, 0x0, 0x0, 0x9}, 0x7}, 0x3, 0x0)
executing program 2:
r0 = openat$auto_bsg_fops_bsg(0xffffffffffffff9c, &(0x7f0000000100)='/dev/bsg/1:0:0:0\x00', 0x0, 0x0)
r1 = openat$auto_tracing_mark_fops_trace(0xffffffffffffff9c, &(0x7f0000000000)='/sys/kernel/debug/tracing/trace_marker\x00', 0x201, 0x0) (async)
mmap$auto(0x0, 0x400008, 0xdf, 0x9b72, 0x2, 0x8000)
r2 = open(&(0x7f00000020c0)='./cgroup\x00', 0x0, 0x408)
getdents$auto(r2, 0x0, 0x400018) (async)
write$auto_tracing_mark_fops_trace(r1, 0x0, 0x1f00)
close_range$auto(0xffffffffffffffff, 0x8000, 0x8000000) (async)
openat$auto_tracing_pipe_fops_trace(0xffffffffffffff9c, &(0x7f0000003fc0)='/sys/kernel/debug/tracing/trace_pipe\x00', 0x20a02, 0x0) (async)
sendfile$auto(0x1, 0x3, 0x0, 0xc01) (async)
write$auto(r0, 0x0, 0x100082) (async)
r3 = socket(0x22, 0x1, 0x1)
getsockopt$auto(r3, 0x84, 0x75, 0x0, &(0x7f0000000000)=0x9b) (async)
r4 = openat$auto_tty_fops_tty_io(0xffffffffffffff9c, &(0x7f0000000000)='/dev/ttyS0\x00', 0x801, 0x0)
ioctl$auto_TIOCVHANGUP2(r4, 0x5437, 0x0) (async)
mmap$auto(0x0, 0x400008, 0xa, 0x10, r0, 0x0)
unshare$auto(0x40000080) (async)
socket(0x18, 0x5, 0x2)
mmap$auto(0x0, 0x8, 0xdf, 0x9b72, 0x2, 0x8000)
openat$nci(0xffffffffffffff9c, &(0x7f0000000080), 0x2, 0x0)
sendmsg$auto_NETDEV_CMD_QUEUE_GET(0xffffffffffffffff, &(0x7f0000003040)={0x0, 0x0, &(0x7f0000003000)={&(0x7f0000000040)=ANY=[@ANYBLOB='$\x00', @ANYRES16=0x0, @ANYBLOB="41004bbd7000fbdbdf250a00"], 0x24}, 0x1, 0x0, 0x0, 0x44884}, 0x20008810) (async)
capset$auto(0x0, 0x0) (async)
semctl$auto_SEM_STAT(0x7ff, 0x0, 0x12, 0x7fff) (async)
close_range$auto(0x2, 0x8, 0x0) (async)
r5 = prctl$auto_PR_RISCV_V_GET_CONTROL(0x46, 0x7fffffffffffffff, 0xffffffffffffffff, 0x8, 0x919c)
syz_genetlink_get_family_id$auto_nl80211(&(0x7f00000011c0), r5)
openat$auto_tracing_saved_cmdlines_fops_trace(0xffffffffffffff9c, &(0x7f0000001200)='/sys/kernel/debug/tracing/saved_cmdlines\x00', 0x72d102, 0x0)
executing program 2:
close_range$auto(0x2, 0x8, 0x0)
mmap$auto(0x0, 0x8c7, 0xdf, 0x9b72, 0x2, 0x8000)
socketpair$auto(0x1, 0x2, 0x8000000000000000, 0x0)
close_range$auto(0x2, 0x8, 0x0)
open(0x0, 0x163340, 0x2a)
socket(0x2, 0x80802, 0x0)
setsockopt$auto(0x3, 0x1, 0x3e, 0x0, 0x9)
mmap$auto(0x0, 0x20009, 0xe2, 0xeb1, 0x405, 0x8000)
r0 = openat$auto_fb_fops_fb_chrdev(0xffffffffffffff9c, &(0x7f0000001c80)='/dev/fb0\x00', 0x20401, 0x0)
ioctl$sock_SIOCGIFINDEX(r0, 0x4600, 0x0)
r1 = openat$auto_fb_fops_fb_chrdev(0xffffffffffffff9c, &(0x7f0000001c80)='/dev/fb0\x00', 0x20401, 0x0)
ioctl$sock_SIOCGIFINDEX(r1, 0x4601, 0x0)
connect$auto(0x3, 0x0, 0x55)
setsockopt$auto(0x3, 0x0, 0x1, 0x0, 0x9)
sendmmsg$auto(0x3, 0x0, 0x3, 0x0)
executing program 2:
r0 = openat$auto_uinput_fops_uinput(0xffffffffffffff9c, &(0x7f0000000000), 0x101001, 0x0)
mmap$auto(0x0, 0x4020009, 0xdf, 0xeb1, 0x401, 0x8000)
r1 = clone$auto(0x4, 0x80000001, 0x0, 0x0, 0xfff)
move_pages$auto(r1, 0xd0, 0x0, 0x0, 0x0, 0x2)
mmap$auto(0x0, 0x4020009, 0xdf, 0xeb1, 0x401, 0x8000)
close_range$auto(r0, 0xffffffffffffffff, 0x2)
socket(0x10, 0x2, 0x0)
socketpair$auto(0x1, 0x1, 0x8000000000000000, 0x0)
socket(0x2, 0x1, 0x0)
r2 = openat$auto_kvm_chardev_ops_kvm_main(0xffffffffffffff9c, &(0x7f0000000000), 0x212480, 0x0)
ustat$auto(0x801, 0x0)
close_range$auto(0x2, 0x8000, 0x0)
r3 = openat$auto_kvm_chardev_ops_kvm_main(0xffffffffffffff9c, &(0x7f00000011c0), 0xe0180, 0x0)
ioctl$auto_KVM_CREATE_VM(r3, 0xae01, 0x0)
ioctl$auto(0x3, 0xae41, r3)
ioctl$auto_KVM_CREATE_VM(r2, 0x4008ae8a, 0x0)
r4 = openat$auto_rtc_dev_fops_dev(0xffffffffffffff9c, &(0x7f0000000100), 0x240, 0x0)
ioctl$auto_RTC_PIE_ON(r4, 0x7005, 0x0)
ioctl$auto_UI_DEV_SETUP(r0, 0x405c5503, &(0x7f00000000c0)={{0x9, 0xf2cf, 0x8, 0x80}, "6a034a07c7b82d90b69a39e32576f893fba86c9dd051a0094a3836d61c9100fefbbabea6ef9368c7996e841f3f1561d4992f726b0a6c36b0b2fd1678e816201cf562367fe6596824588a2e3d84ba165f", 0xa})
ioctl$auto_UI_DEV_CREATE(r0, 0x5501, 0x0)
mmap$auto(0x0, 0x400008, 0xdf, 0x9b72, 0x0, 0x100000000008000)
write$auto(0x3, 0x0, 0x7fffffff)
fsopen$auto(0x0, 0x2)
mmap$auto(0x0, 0x400008, 0xdf, 0x9b72, 0x2, 0x8000)
executing program 34:
r0 = openat$auto_uinput_fops_uinput(0xffffffffffffff9c, &(0x7f0000000000), 0x101001, 0x0)
mmap$auto(0x0, 0x4020009, 0xdf, 0xeb1, 0x401, 0x8000)
r1 = clone$auto(0x4, 0x80000001, 0x0, 0x0, 0xfff)
move_pages$auto(r1, 0xd0, 0x0, 0x0, 0x0, 0x2)
mmap$auto(0x0, 0x4020009, 0xdf, 0xeb1, 0x401, 0x8000)
close_range$auto(r0, 0xffffffffffffffff, 0x2)
socket(0x10, 0x2, 0x0)
socketpair$auto(0x1, 0x1, 0x8000000000000000, 0x0)
socket(0x2, 0x1, 0x0)
r2 = openat$auto_kvm_chardev_ops_kvm_main(0xffffffffffffff9c, &(0x7f0000000000), 0x212480, 0x0)
ustat$auto(0x801, 0x0)
close_range$auto(0x2, 0x8000, 0x0)
r3 = openat$auto_kvm_chardev_ops_kvm_main(0xffffffffffffff9c, &(0x7f00000011c0), 0xe0180, 0x0)
ioctl$auto_KVM_CREATE_VM(r3, 0xae01, 0x0)
ioctl$auto(0x3, 0xae41, r3)
ioctl$auto_KVM_CREATE_VM(r2, 0x4008ae8a, 0x0)
r4 = openat$auto_rtc_dev_fops_dev(0xffffffffffffff9c, &(0x7f0000000100), 0x240, 0x0)
ioctl$auto_RTC_PIE_ON(r4, 0x7005, 0x0)
ioctl$auto_UI_DEV_SETUP(r0, 0x405c5503, &(0x7f00000000c0)={{0x9, 0xf2cf, 0x8, 0x80}, "6a034a07c7b82d90b69a39e32576f893fba86c9dd051a0094a3836d61c9100fefbbabea6ef9368c7996e841f3f1561d4992f726b0a6c36b0b2fd1678e816201cf562367fe6596824588a2e3d84ba165f", 0xa})
ioctl$auto_UI_DEV_CREATE(r0, 0x5501, 0x0)
mmap$auto(0x0, 0x400008, 0xdf, 0x9b72, 0x0, 0x100000000008000)
write$auto(0x3, 0x0, 0x7fffffff)
fsopen$auto(0x0, 0x2)
mmap$auto(0x0, 0x400008, 0xdf, 0x9b72, 0x2, 0x8000)
executing program 6:
mmap$auto(0x0, 0x2020009, 0x3, 0xeb1, 0xfffffffffffffffa, 0x8000)
close_range$auto(0x0, 0xfffffffffffff000, 0x2)
mmap$auto(0x0, 0x20009, 0x4000000000df, 0xeb1, 0x401, 0x8000)
close_range$auto(0x2, 0x8, 0x0)
socket$nl_generic(0x10, 0x3, 0x10)
socket(0x11, 0x80003, 0x300)
sendto$auto(0x3, 0x0, 0x800013, 0xffffffbc, &(0x7f0000000440)=@tipc=@name={0x1e, 0x2, 0x0, {{0x41, 0x4}, 0x4}}, 0x22)
socket(0xa, 0x2, 0x73)
socketpair$auto(0x1, 0x5, 0x8000000000000000, 0x0)
socket(0x1, 0x3, 0x0)
bind$auto(0x3, 0x0, 0x6b)
connect$auto(0x3, 0x0, 0x6b)
readv$auto(0xffffffffffffffff, 0x0, 0x410)
sendmsg$auto_NL80211_CMD_SET_WIPHY(0xffffffffffffffff, 0x0, 0x4000000)
close_range$auto(0x0, 0xfffffffffffff001, 0x2)
openat$auto_adf_hb_cfg_fops_adf_heartbeat_dbgfs(0xffffffffffffff9c, &(0x7f0000000000)='/sys/kernel/debug/ieee80211/phy0/hw_conf\x00', 0x20486, 0x0)
openat$auto_def_blk_fops_fs(0xffffffffffffff9c, &(0x7f0000000040)='/dev/loop6\x00', 0x169780, 0x0)
socket(0x11, 0x80003, 0x0)
openat$auto_raw_fops_raw_gadget(0xffffffffffffff9c, &(0x7f00000000c0), 0x0, 0x0)
r0 = socket(0x29, 0x2, 0x0)
mmap$auto(0x0, 0x202000c, 0x3, 0xab1, 0xfffffffffffffffa, 0x8000)
mmap$auto(0x0, 0x400008, 0xdf, 0x9b72, 0x2, 0x8000)
prctl$auto(0x1000000003b, 0x1, 0x4, 0x5, 0x10004)
madvise$auto(0x0, 0xffffffffffff0001, 0x15)
madvise$auto(0x0, 0xffffffffffff0008, 0x19)
setsockopt$auto(r0, 0x119, 0x400000, 0x0, 0x802)
socket(0x10, 0x2, 0x6)
mmap$auto(0x0, 0x400008, 0xdf, 0x9b72, 0x1fe, 0x8000)
sendmsg$auto_NL80211_CMD_GET_REG(0xffffffffffffffff, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000200)={0x0}, 0x1, 0x0, 0x0, 0x40000}, 0x40805)
sendmsg$auto_L2TP_CMD_NOOP(0xffffffffffffffff, &(0x7f0000000280)={0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x40080}, 0x8c1)
executing program 4:
read$auto(0xffffffffffffffff, &(0x7f0000000000)='%:\x00', 0x7)
mmap$auto(0x0, 0x7, 0x8, 0xeb1, 0xfffffffffffffffa, 0x40000000008000)
r0 = openat$auto_proc_mem_operations_base(0xffffffffffffff9c, &(0x7f0000000300)='/proc/self/mem\x00', 0x100, 0x0)
read$auto_proc_mem_operations_base(r0, &(0x7f0000000340)=""/230, 0xe6)
bpf$auto(0x14, &(0x7f00000000c0)=@iter_create={0xffffffffffffffff, 0x4}, 0x7)
executing program 4:
r0 = socket(0x10, 0x2, 0x0)
close_range$auto(0x2, 0x8, 0x0)
socket(0x10, 0x2, 0x4)
socket(0x10, 0x3, 0x6)
sendmsg$auto_NL80211_CMD_GET_REG(r0, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000300)=ANY=[@ANYBLOB="72010000", @ANYBLOB="120027", @ANYBLOB="5de1"], 0x1ac}}, 0x40000)
read$auto(r0, &(0x7f0000000000)='$-]&@\x00', 0x5)
executing program 4:
mmap$auto(0x0, 0x2020009, 0x3, 0xeb2, 0xfffffffffffffffb, 0x8000)
close_range$auto(0x2, 0x8, 0x0)
r0 = openat$auto_tracing_err_log_fops_trace(0xffffffffffffff9c, &(0x7f0000000000)='/sys/kernel/debug/tracing/error_log\x00', 0xb01, 0x0)
socket(0x15, 0x5, 0x0)
connect$auto(0x3, &(0x7f0000000080)=@in={0x2, 0x3, @dev={0xac, 0x14, 0x14, 0x10}}, 0x54)
getsockopt$auto(0x3, 0x200000000001, 0x1c, 0x0, 0x0)
mmap$auto(0x0, 0x2020009, 0x9, 0xeb1, 0xfffefffffffffffa, 0x8000)
r1 = epoll_create$auto(0x4)
r2 = openat$auto_v4l2_fops_v4l2_dev(0xffffffffffffff9c, &(0x7f0000000000)='/dev/video2\x00', 0x101081, 0x0)
epoll_ctl$auto(r1, 0x1, r2, 0x0)
mmap$auto(0x0, 0x4020009, 0xdf, 0xeb1, 0x401, 0x8000)
r3 = socket(0x1, 0x3, 0x80000000)
r4 = getsockopt$auto(r3, 0x6, 0x25, 0x0, 0x0)
mmap$auto(0x40000000010000, 0x400008, 0xdf, 0x9b72, r0, 0x8000)
socketpair$auto(0x1, 0x1, 0x8000000000000000, 0x0)
socket(0x11, 0x80003, 0x300)
setsockopt$auto(r4, 0xffff6871, 0x8, 0x0, 0x3)
r5 = socket(0x10, 0x2, 0x4)
io_uring_setup$auto(0x4bf15e08, &(0x7f0000000000)={0x401, 0x8, 0xfe, 0x6fb3, 0x8a, 0x40000009, 0xffffffffffffffff, [0x100, 0x9, 0x7f], {0x6, 0x7, 0x3032, 0xe, 0xf, 0x5, 0x5, 0xfffffff9, 0xf08a2b3}, {0x0, 0xfc, 0x6, 0x1, 0x0, 0xf89, 0x9, 0x7fffffff, 0x8}})
r6 = socket$nl_generic(0x10, 0x3, 0x10)
ioctl$sock_SIOCGIFINDEX(r6, 0x8933, &(0x7f0000000000)={'dummy0\x00'})
syz_open_procfs$namespace(0x0, 0x0)
sendmsg$auto_NFSD_CMD_THREADS_SET(0xffffffffffffffff, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000000140)=ANY=[@ANYBLOB="1f9a81052a570148ea3acf23453bf490b45c8a1e9c681d666620c84499a29282c991", @ANYRESOCT=r4], 0x2c}, 0x1, 0x0, 0x0, 0x4000044}, 0x2404c000)
write$auto(r5, &(0x7f0000000000)='-\x00', 0x2fb)
r7 = openat$auto_kernfs_file_fops_kernfs_internal(0xffffffffffffff9c, 0x0, 0x500, 0x0)
read$auto_kernfs_file_fops_kernfs_internal(r7, &(0x7f0000000080)=""/23, 0x17)
openat$auto_proc_sys_file_operations_proc_sysctl(0xffffffffffffff9c, 0x0, 0x101202, 0x0)
close_range$auto(0x2, 0x8, 0x0)
openat$auto_proc_iter_file_ops_compat_inode(0xffffffffffffff9c, &(0x7f0000000040)='/proc/fs/netfs/cookies\x00', 0x40080, 0x0)
openat$auto_proc_sys_file_operations_proc_sysctl(0xffffffffffffff9c, &(0x7f0000000080)='/proc/sys/kernel/seccomp/actions_logged\x00', 0x8202, 0x0)
executing program 0:
r0 = socket(0xa, 0x2, 0x3a)
setsockopt$auto(r0, 0x29, 0x11, &(0x7f0000000240)='!\x00\xba\xe4\x8a\xf0t\xaf\x82\xd7{\x98\xdd\xee\xc2f\xcaH\x90\xc57M\x87<<\n\xf2L\"Y\xa9\f\n\xbd?\xdd\b\xf7vu:\x00\xeaP\xa7=\xef\xc3\xdc\xf3=J\xf9\x9e\xd9\x02\xbb\xd3\xf8\xff*\xc2\xd8w\xe9\x00\x00\x01\x00h\xe2\x0f\x1b\x95L\xbf\xa5\xacH\"xV#\xc7e\x12\x83\xed\xc7\xc5\x9e\x84?\xfa=\f\xd8\x14\x00\x9fJl\xdd)i\x9f(#\xb7\xff:\x94\x8bd,\xb2\xfc\xde32\x87;\tx\xffM\x1f\x1d\xd8b\xa5\r\xb7v;\xfd\xa14M\xd3\x95\x86\x04\xd4\xda}\xcat}\x18K\x85\x9bBj\x8e\x95\xca\x87\xfe\x125\x154\x83\x94X,\xa4\xf3\xf6\xef\x1a\xb5iX\x99\xa1NO\xc5R\xc9\xc7\xd6\x8d?\x13\x9f\xaf\xf4\xbc\xa3j\xefQ\x7f\xc4\x86\xe8\xc6\xf8\xfe\x115\xd7\x89\x86\xc6T\x14\x00\x13\xb9mf\xc0\xc2%_N\xed\xa9\x02\xe5\x83\xa0\x01O%NHKp\xe0\xb3u\xdc\x8bb\xfa\xabD\x1d\x8a\x1e\xb4C\x05R\xdco\xa5\xce\xc9+\xf8\xf2X#', 0x1fe)
executing program 0:
stat$auto(&(0x7f0000000300)='./cgroup\x00', &(0x7f0000000340)={0x7, 0x8000, 0x6, 0x8001, 0xee00, <r0=>0xee01, 0x0, 0x187, 0x2, 0x8, 0x3, 0x5fd0, 0x7f, 0x6, 0xfff, 0x3, 0x1})
mmap$auto(0x0, 0x20009, 0xdf, 0xeb1, 0x401, 0x8000)
close_range$auto(0x2, 0x8, 0x0)
sendmsg$auto_NL80211_CMD_GET_REG(0xffffffffffffffff, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000200)={0x0, 0x1ac}, 0x1, 0x0, 0x0, 0x4004810}, 0x800)
sendmsg$auto_HSR_C_GET_NODE_STATUS(0xffffffffffffffff, &(0x7f0000000200)={0x0, 0x0, &(0x7f00000001c0)={&(0x7f0000000140)=ANY=[@ANYBLOB='h\x00\x00\x00', @ANYRES16=<r1=>0x0, @ANYBLOB="000226bd7000fedbdf25030000000800030004020000060007000080000008000200", @ANYRES32=0x0, @ANYBLOB="0a00050000000000000000000a00010000000000000000000a0001000000000000000000060007000a00000008000200", @ANYRES32=0x0, @ANYBLOB="080140"], 0x68}}, 0x40090)
sendmsg$auto_NL80211_CMD_STOP_AP(0xffffffffffffffff, &(0x7f0000000d80)={0x0, 0x0, &(0x7f0000000d40)={&(0x7f0000000480)=ANY=[@ANYBLOB="140000008f68084197cad0a602aceff6e434f2a84c1f9a2b686c17575cce6e2cd51220266f0b04fe6d0d6755e40794c7abe48678c462385fa5f6513224e850eeda5ea0674056022442388de7dccbfa2d751c143291176413f704a2f4a993ee64456952edd4e6754a5a15e01f0af0c21460ba", @ANYRES16=0x0, @ANYBLOB="040029bd7000fedbdf2510000000"], 0x14}, 0x1, 0x0, 0x0, 0x4000001}, 0x40)
r2 = syz_genetlink_get_family_id$auto_nfsd(&(0x7f0000001440), 0xffffffffffffffff)
r3 = syz_genetlink_get_family_id$auto_nfc(&(0x7f00000015c0), 0xffffffffffffffff)
sendmsg$auto_NFC_CMD_STOP_POLL(0xffffffffffffffff, &(0x7f0000002680)={0x0, 0x0, &(0x7f0000002640)={&(0x7f0000000580)=ANY=[@ANYBLOB="a65115c4", @ANYRESHEX=r2, @ANYBLOB="20fa28bd7000ff08000000000000", @ANYRESHEX=r0, @ANYRES32=r1, @ANYBLOB="0e8ccd1998719890eacd4d3402f180541c0d46edfd51d271fc33418c4c593e56ad425d740f39db93ceccd1d5080384ccbae93ed6023dbe608b336fb2ab07c317034bb6502024c8ed3c37f4faa9f60e127fdd7dee19f9b9629e0e7e1557ede9db5ae05b584563f1a93b6a219e6180b2169ed686dedb69b3938d03d1811ad83d761ddf44eeb82bec8cf9393ae21418e7db49746d2169a15334ea7eba5e60fe201d46cd32d3ca0a8f7c5c34cef4371cc0e9", @ANYRES8=r1, @ANYRES8=r0, @ANYRES8=0x0], 0x14}, 0x1, 0x0, 0x0, 0x40008d5}, 0x4010)
sendmsg$auto_NFC_CMD_START_POLL(0xffffffffffffffff, &(0x7f0000000400)={&(0x7f0000000440)={0x10, 0x0, 0x0, 0x402}, 0xc, &(0x7f0000000280)={&(0x7f0000000240)=ANY=[@ANYBLOB='<\x00\x00\x00', @ANYRES16=r3, @ANYBLOB="08002bfd7000ffdbdf450600000020000200d65bced5efd32a94b7f5980a2f0965559f617873703100f47c78308008001e0080000000"], 0x3c}, 0x1, 0x0, 0x0, 0x20048895}, 0x40000)
r4 = socket(0x2, 0x3, 0x100)
socket(0x10, 0x2, 0x0)
sendmsg$auto_NL80211_CMD_GET_REG(0xffffffffffffffff, &(0x7f0000000100)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000180)=ANY=[@ANYBLOB="72010000", @ANYBLOB="13"], 0x1ac}, 0x1, 0x0, 0x0, 0x10008001}, 0x4004)
sendmmsg$auto(0x3, &(0x7f0000000080)={{0x0, 0x2, &(0x7f00000002c0)={0x0, 0xc4}, 0x1, 0x0, 0x0, 0x9}, 0x7}, 0x3, 0x0)
r5 = socket$nl_generic(0x10, 0x3, 0x10)
mmap$auto(0x0, 0xe983, 0xdf, 0xeb1, 0x401, 0x8000)
mmap$auto(0x0, 0x9, 0xdf, 0x9b72, 0x2, 0x8000)
io_uring_setup$auto(0x406, 0x0)
mmap$auto(0x0, 0x9, 0xffb, 0x8000000008011, 0x3, 0x0)
getrandom$auto(0x0, 0x6000000, 0x3)
io_uring_enter$auto(r4, 0xa84, 0x80000001, 0xe, 0x0, 0x46)
migrate_pages$auto(0x0, 0x99, 0x0, &(0x7f00000001c0)=0x3fe)
r6 = openat$auto_snd_pcm_oss_f_reg_pcm_oss(0xffffffffffffff9c, &(0x7f0000000100)='/dev/adsp1\x00', 0x40a140, 0x0)
ioctl$auto_SNDCTL_DSP_CHANNELS(r6, 0xc0045006, &(0x7f00000001c0))
getrandom$auto(&(0x7f0000000100)='..\x00k\xac\x8c\x1d\x0e\x98\x80\xd2\xaf\xa1\xf2\x1e\xe1R1\xa2\x8e\xce\xa0\x17\bI3\'\xc5tw\xd7\x1d\xa6\xf4#+\xfa\xd7\x01\xb9j<\v\xf47\n\xa7\xd2\x8b\x11e</\xfd\x9b\xe4\x99G\xeaS\x9a\xadu(:\x94:\xaf\x06c=3>1\xb3\xfdd\x04\xa9 1q\x97\xc4,\xa9^\xc1\xb6\xa1q\x0f\xd1\x013\x87l\xb9\x1e\x05\x90\xa2', 0xd5, 0x1)
move_pages$auto(0x0, 0x1002, 0x0, 0x0, 0x0, 0x2)
openat$auto_seq_oss_f_ops_seq_oss(0xffffffffffffff9c, &(0x7f0000000540)='/dev/sequencer2\x00', 0x0, 0x0)
io_uring_enter$auto(0x3, 0x5, 0xffffffff, 0x3, 0x0, 0x2)
getdents$auto(0xffffffffffffffff, 0x0, 0x100019)
syz_genetlink_get_family_id$auto_nl80211(&(0x7f0000000000), r5)
executing program 4:
openat$auto_snd_pcm_oss_f_reg_pcm_oss(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/dsp1\x00', 0x20b42, 0x0)
read$auto_proc_reg_file_ops_compat_inode(0xffffffffffffffff, &(0x7f0000000280)=""/65, 0x41)
mmap$auto(0x0, 0x4020009, 0x6, 0xeb1, 0x401, 0x8000)
prctl$auto(0x1000000003b, 0x1, 0x4, 0x5, 0x7)
socket$nl_generic(0x10, 0x3, 0x10)
close_range$auto(0x2, 0x8, 0x0)
sendmsg$auto_NETDEV_CMD_DEV_GET(0xffffffffffffffff, &(0x7f0000000080)={&(0x7f0000000140)={0x10, 0x0, 0x0, 0x400000}, 0xc, 0x0, 0x1, 0x0, 0x0, 0x48000}, 0x0)
mmap$auto(0x0, 0x400008, 0xdf, 0x9b72, 0x2, 0x8000)
close_range$auto(0x2, 0x8000, 0x0)
sendmsg$auto_HSR_C_GET_NODE_STATUS(0xffffffffffffffff, &(0x7f0000000200)={0x0, 0x0, &(0x7f00000001c0)={&(0x7f0000000140)={0x68, 0x0, 0x200, 0x70bd26, 0x25dfdbfe, {}, [@HSR_A_IF1_AGE={0x8, 0x3, 0x200}, @HSR_A_IF2_SEQ={0x6, 0x7, 0x4}, @HSR_A_IFINDEX={0x8}, @HSR_A_NODE_ADDR_B={0xa}, @HSR_A_NODE_ADDR={0xa, 0x1, @broadcast}, @HSR_A_NODE_ADDR={0xa}, @HSR_A_IF1_AGE={0x8, 0x3, 0x38}, @HSR_A_IFINDEX={0x8}, @HSR_A_IF2_AGE={0x8, 0x4, 0x4}]}, 0x68}, 0x1, 0x0, 0x0, 0x40080}, 0x40090)
socket(0x2, 0x3, 0x100)
socket(0x10, 0x2, 0x0)
sendmsg$auto_NL80211_CMD_GET_REG(0xffffffffffffffff, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000200)={0x0, 0x1ac}, 0x1, 0x0, 0x0, 0x4004810}, 0x800)
sendmsg$auto_NL80211_CMD_GET_REG(0xffffffffffffffff, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000180)=ANY=[@ANYBLOB="720100", @ANYBLOB="13"], 0x1ac}}, 0x4004)
sendmmsg$auto(0x3, &(0x7f0000000080)={{0x0, 0x2, &(0x7f00000002c0)={0x0, 0xc4}, 0x1, 0x0, 0x0, 0x9}, 0x7}, 0x3, 0x0)
executing program 0:
futex_waitv$auto(&(0x7f0000000180)={0x3fb, 0x6, 0x2, 0xfff}, 0x3, 0xbffffffc, 0x0, 0x81)
r0 = bpf$auto(0x5, &(0x7f00000001c0)=@task_fd_query={0x2, 0x2, 0x4, 0x0, 0x85, 0x4, 0x9, 0x6, 0x8001}, 0x101)
close_range$auto(0x2, 0xa, 0x0)
socket$nl_generic(0x10, 0x3, 0x10)
syz_clone(0x11, 0x0, 0x0, 0x0, 0x0, 0x0)
r1 = openat$auto_blk_mq_debugfs_fops_blk_mq_debugfs(0xffffffffffffff9c, &(0x7f00000000c0)='/sys/kernel/debug/block/mtdblock0/sched/read0_fifo_list\x00', 0x0, 0x0)
read$auto_blk_mq_debugfs_fops_blk_mq_debugfs(r1, &(0x7f0000000040)=""/124, 0x7c)
pipe$auto(&(0x7f0000000000)=<r2=>0xffffffffffffffff)
splice$auto(r2, 0x0, 0x2, 0x0, 0x9, 0x8)
mmap$auto(0x0, 0x7, 0xdf, 0x9b72, 0x2, 0x7ffc)
mmap$auto(0x0, 0x20009, 0x4000000000df, 0xeb1, 0x401, 0x8000)
mremap$auto(0x0, 0x4, 0x4, 0x7, 0x1000)
mmap$auto(0x0, 0x400008, 0xdf, 0x9b72, 0x2, 0x8000)
close_range$auto(0x2, r0, 0x0)
socketpair$auto(0x1e, 0x1, 0x8000000000000000, 0x0)
openat$auto_vhost_vsock_fops_vsock(0xffffffffffffff9c, &(0x7f0000000000), 0x121900, 0x0)
mmap$auto(0x0, 0x20009, 0xdf, 0xeb1, 0x401, 0x8000)
r3 = socket(0x2, 0x1, 0x0)
fcntl$auto(0x3, 0x4, 0xa553)
bind$auto(r2, &(0x7f0000000040)=@llc={0x1a, 0x301, 0x81, 0xe, 0x4, 0x2, @local}, 0x1)
sendmmsg$auto(r3, &(0x7f0000000140)={{&(0x7f0000000040), 0x12, 0x0, 0x101, 0x0, 0x5, 0x9ad}, 0x5}, 0x5, 0x20000000)
r4 = socketpair$auto(0x1, 0x5, 0x8000000000000000, 0x0)
syz_genetlink_get_family_id$auto_batadv(0x0, 0xffffffffffffffff)
mmap$auto(0x7, 0x202000c, 0x5, 0xfb1, r4, 0xa)
semctl$auto(0x9, 0xc1b8, 0x4, 0x1)
mmap$auto(0x7ffffffd, 0x400004, 0x7, 0x9b72, r3, 0x5)
dup2$auto(0xffffffffffffffff, 0xffffffffffffffff)
syz_genetlink_get_family_id$auto_nl80211(0x0, 0xffffffffffffffff)
sendmsg$auto_NL80211_CMD_SET_MULTICAST_TO_UNICAST(0xffffffffffffffff, 0x0, 0x0)
sendmsg$auto_NL80211_CMD_GET_STATION(0xffffffffffffffff, 0x0, 0x40)
executing program 6:
close_range$auto(0x2, 0x1d, 0x0)
r0 = syz_genetlink_get_family_id$auto_nl80211(&(0x7f0000000180), 0xffffffffffffffff)
sendmsg$auto_NL80211_CMD_SET_WIPHY(0xffffffffffffffff, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000080)=ANY=[@ANYBLOB='$\x00\x00\x00', @ANYRES16=r0, @ANYBLOB="011d3da4420008bd7100f9db5f250200000000000010", @ANYRES32], 0x24}, 0x1, 0x0, 0x0, 0x404c0c0}, 0x80)
mmap$auto(0x0, 0x3, 0x4000000200df, 0x40eb2, 0x402, 0x300000000000)
capget$auto(&(0x7f0000000100)={0x5}, &(0x7f0000000140)={0x7ff, 0xc, 0x800})
close_range$auto(0x2, 0xa, 0x0)
socket(0x10, 0x2, 0x4)
openat$auto_safesetid_uid_file_fops_securityfs(0xffffffffffffff9c, &(0x7f0000000080), 0x1, 0x0)
writev$auto(0x3, &(0x7f0000000100)={0x0, 0x7111}, 0x8)
r1 = socket(0x10, 0x2, 0x0)
sendmmsg$auto(r1, &(0x7f0000000200)={{0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000080), 0xfc2}, 0x2, &(0x7f00000001c0), 0x7, 0xa505}, 0x800}, 0x7, 0x4008)
socket(0x3, 0x800, 0x9)
r2 = openat$auto_kernfs_file_fops_kernfs_internal(0xffffffffffffff9c, &(0x7f0000000080)='/sys/module/apparmor/parameters/path_max\x00', 0x80, 0x0)
r3 = socket(0x1e, 0x4, 0x0)
setsockopt$auto(r3, 0x10f, 0x86, 0x0, 0x0)
read$auto_kernfs_file_fops_kernfs_internal(r2, &(0x7f00000000c0)=""/17, 0x11)
open(&(0x7f0000000000)='./file0\x00', 0x261c2, 0x84)
r4 = open(&(0x7f0000000080)='./file0\x00', 0xeee00, 0x31)
mmap$auto(0x3, 0x2020009, 0x7fffffff, 0xeb1, 0xfffffffffffffffa, 0x8000)
r5 = openat$auto_kernfs_file_fops_kernfs_internal(0xffffffffffffff9c, &(0x7f0000000040)='/sys/devices/virtual/block/ram6/queue/minimum_io_size\x00', 0x0, 0x0)
read$auto_kernfs_file_fops_kernfs_internal(r5, &(0x7f0000001540)=""/104, 0x68)
mmap$auto(0x0, 0x400008, 0xdf, 0x9b72, 0x2, 0x8000)
getcwd$auto(0x0, 0xffffffffffffffff)
rename$auto(0x0, &(0x7f0000000300)='v#\xd5\xaf>=\x14\xe6%\xf7\x8a\x8d\x9a\xae\x1a\xd6\xa8\xb8\x1d\xf5(\xb0\x1f\xbd\xcbV\n\"\xe3V\xfeP\xceN\xb2\xc32\xaf\xcc\x80\xfa\xf0\xd4\xd9|\xfe\x03y\xd16\x17\x99R\xca\xe5\xf4\xb4T\xfcv\xfc\xe6\x9cv\a\x00\xc2a\x16\xd1\x8a\x80\x90\x87\xa5s\x10\xed\x93\xd4\x15=\xc0\x1f\x0e\xb0\x18v}\x03!\xf0I\xe3}\x90\x9b\x92[\xfe2<7\xd3\x81\x9a~\xcd\r\x19\x9e\x10(5\xfd\x8b\x82\xd4\xc85\xc3\x93t\t\xd0\x9d\xca^n\xf3\xcb>\x1bO\xcej\xe0\xef\xf2\xd7\xc2}\x18\xd9`AO\x95<\x9aH\vu\xae\xd4\xea\x12\xb8\xd1\n\x01\x83r\x85\xbf*\x18\xa7 S:R\x14\x89Z3\x94\x8bP)')
write$auto(0x3, 0x0, 0x100082)
lseek$auto(r4, 0xc, 0x4)
executing program 4:
mmap$auto(0x0, 0x400008, 0xdf, 0x9b72, 0x2, 0x8000)
madvise$auto(0x0, 0xffffffffffff0005, 0x19)
madvise$auto(0x0, 0xffffffffffff0001, 0x15)
io_uring_setup$auto(0x6, 0x0)
madvise$auto(0x200000, 0x200007, 0x19)
executing program 5:
write$auto(0xffffffffffffffff, &(0x7f0000000000)='\'\x00', 0x4)
openat$auto_proc_reg_file_ops_compat_inode(0xffffffffffffff9c, &(0x7f0000000000)='/proc/thread-self/net/anycast6\x00', 0x0, 0x0)
mmap$auto(0x3, 0xb1, 0x3, 0xeb0, 0x401, 0xf8)
read$auto(0x3, 0x0, 0x80)
read$auto(0x3, 0x0, 0x80)
write$auto(0x3, 0x0, 0xfffffdef)
write$auto(0x3, 0x0, 0xfffffdef)
mmap$auto(0x0, 0x400008, 0xdf, 0x10, 0x2, 0x8000)
open(&(0x7f0000000000)='./file0\x00', 0x161342, 0x100)
msync$auto(0x1ffff000, 0x180000000000000, 0x400000004)
mmap$auto(0x0, 0x2020009, 0x3, 0x8011, 0xfffffffffffffffa, 0x8000)
mmap$auto(0x0, 0x2020009, 0x3, 0xeb1, 0xffffffffffffffff, 0x8000)
openat$auto_kernfs_file_fops_kernfs_internal(0xffffffffffffff9c, 0x0, 0x0, 0x0)
r0 = openat$auto_proc_fail_nth_operations_base(0xffffffffffffff9c, &(0x7f0000000000)='/proc/thread-self/fail-nth\x00', 0x20af83, 0x0)
writev$auto(r0, &(0x7f0000000200)={0x0, 0x7}, 0x3)
msync$auto(0x7, 0x45f8, 0x1)
open(0x0, 0x22240, 0x0)
socket$nl_generic(0x10, 0x3, 0x10)
socketpair$auto(0x1, 0x4, 0x8000000000000000, 0x0)
r1 = openat$auto_tty_fops_tty_io(0xffffffffffffff9c, &(0x7f0000000400)='/dev/ttyS2\x00', 0x101e81, 0x0)
ioctl$auto_TIOCSETD2(r1, 0x5423, 0x0)
openat$auto_mousedev_fops_mousedev(0xffffffffffffff9c, &(0x7f0000000040)='/dev/psaux\x00', 0x20000, 0x0)
io_uring_setup$auto(0x6, 0x0)
mmap$auto(0x0, 0x400008, 0xdf, 0x9b72, 0xffffffffffffffff, 0x8000)
close_range$auto(0x2, 0xa, 0x0)
executing program 0:
r0 = socket(0x10, 0x2, 0x0)
close_range$auto(0x2, 0x8, 0x0)
socket(0x10, 0x2, 0x4)
socket(0x10, 0x3, 0x6)
sendmsg$auto_NL80211_CMD_GET_REG(r0, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000300)=ANY=[@ANYBLOB="72010000", @ANYBLOB="120027", @ANYBLOB="5de1"], 0x1ac}}, 0x40000)
read$auto(r0, &(0x7f0000000000)='$-]&@\x00', 0x5)
executing program 6:
mmap$auto(0x0, 0x2020009, 0x3, 0xeb1, 0xfffffffffffffffa, 0x8000)
mmap$auto(0x0, 0x4, 0x4000000000df, 0x40eb2, 0x402, 0x300000000000)
socket(0xa, 0x801, 0x84)
msgsnd$auto(0x900, &(0x7f0000000000)={0x2, 0x5}, 0xf54, 0x80000001)
openat$auto_kernfs_file_fops_kernfs_internal(0xffffffffffffff9c, 0x0, 0x1c2b02, 0x0)
prctl$auto(0x12, 0x1, 0x6, 0xfffffffffffffffe, 0x4)
executing program 0:
unshare$auto(0x40000080)
socket$nl_generic(0x10, 0x3, 0x10)
socket$nl_generic(0x10, 0x3, 0x10)
mmap$auto(0x0, 0x400008, 0xdf, 0x9b72, 0x2, 0x8000)
close_range$auto(0x0, 0xfffffffffffff000, 0x2)
mmap$auto(0x0, 0x40009, 0xdf, 0x9b72, 0x7, 0x28000)
socketpair$auto(0xf, 0x7, 0x8, 0x0)
r0 = socket(0x10, 0x3, 0xb)
r1 = openat$auto_kernfs_file_fops_kernfs_internal(0xffffffffffffff9c, &(0x7f0000000080)='/sys/kernel/slab/kmalloc-64/total_objects\x00', 0x2400, 0x0)
read$auto_kernfs_file_fops_kernfs_internal(r1, &(0x7f0000000180)=""/250, 0xfa)
setsockopt$auto(r0, 0x104000000000010e, 0x1, 0x0, 0x16)
close_range$auto(0x0, 0xfffffffffffff000, 0x2)
openat$auto_proc_pid_numa_maps_operations_internal(0xffffffffffffff9c, &(0x7f0000000040)='/proc/thread-self/numa_maps\x00', 0x20000, 0x0)
open(&(0x7f0000000000)='./file0\x00', 0x161342, 0x100)
socket(0x1d, 0x2, 0x6)
futex_waitv$auto(&(0x7f0000000000)={0xfffffffffffffffd, 0x7e4, 0x2}, 0x1, 0x0, 0x0, 0x623d)
io_uring_setup$auto(0x2, 0x0)
r2 = openat$auto_tty_fops_tty_io(0xffffffffffffff9c, &(0x7f0000000400)='/dev/ttyS2\x00', 0x101e81, 0x0)
ioctl$auto_TIOCSETD2(r2, 0x5423, 0x0)
close_range$auto(0x2, 0x8, 0x0)
socket(0x23, 0x80805, 0x0)
socketpair$auto(0x4, 0x1, 0x20000, 0x0)
r3 = openat$auto_tty_fops_tty_io(0xffffffffffffff9c, &(0x7f0000000400)='/dev/ttyS2\x00', 0x101e81, 0x0)
ioctl$auto_TIOCSETD2(r3, 0x5423, 0x0)
ioctl$auto_TIOCVHANGUP2(r2, 0x5437, 0x0)
executing program 5:
r0 = semctl$auto_IPC_STAT(0xf, 0x2, 0x2, 0x8)
r1 = prctl$auto_PR_SET_NO_NEW_PRIVS(0x26, 0x9, r0, 0x6, 0xda8)
r2 = openat$auto_sg_fops_sg(0xffffffffffffff9c, &(0x7f0000000000)='/dev/sg0\x00', 0x400040, 0x0)
lseek$auto(r1, 0x4, 0x2)
r3 = prctl$auto_PR_SET_NAME(0xf, 0x4, r0, 0x4, 0x81)
r4 = syz_genetlink_get_family_id$auto_thermal(&(0x7f0000000080), r1)
sendmsg$auto_THERMAL_GENL_CMD_TZ_GET_TEMP(r3, &(0x7f0000000240)={&(0x7f0000000040)={0x10, 0x0, 0x0, 0x1000000}, 0xc, &(0x7f0000000200)={&(0x7f00000000c0)={0x110, r4, 0x200, 0x70bd26, 0x25dfdbfe, {}, [@THERMAL_GENL_ATTR_TZ_ID={0x8, 0x2, 0x2}, @THERMAL_GENL_ATTR_CDEV_MAX_STATE={0x8, 0x12, 0x2}, @THERMAL_GENL_ATTR_CDEV_CUR_STATE={0x8}, @THERMAL_GENL_ATTR_CDEV={0xcc, 0xf, 0x0, 0x1, [@nested={0x4, 0xd9}, @nested={0xc1, 0x76, 0x0, 0x1, [@generic="e67cbd765535320bb721f053ce5b6bf16aa71ebf81d4d5b0fa3b48c2041dadaf53333c066446b22b964d5ee30e9600f92198f80cf5ef55d87dc2c02358171d103e4417da88d25b864f66c730777d668d066bb96b175ab76bdb8a4ab173b78649b941bc899c5f388745ac343a5f8e85946c41ba14cda7e6acd76befeca2afda478efaa1ca27f711b41e85ef65debf32ccf2ffd8be145d9d59b3f290cf38c2ae0f858a972483d7da5fd9ca8d2fe6fcb6bdc6a62aa4db2c4d9367070742ba"]}]}, @THERMAL_GENL_ATTR_THRESHOLD_TEMP={0x8, 0x1a, 0x2}, @THERMAL_GENL_ATTR_TZ_GOV_NAME={0xf, 0xe, '-,{{\\(##.$*'}]}, 0x110}, 0x1, 0x0, 0x0, 0x80}, 0x850)
madvise$auto(0x1, 0xf, 0x9)
r5 = openat$auto_proc_fail_nth_operations_base(0xffffffffffffff9c, &(0x7f0000000280)='/proc/self/fail-nth\x00', 0x240042, 0x0)
fadvise64$auto_POSIX_FADV_DONTNEED(r3, 0x4, 0x6, 0x4)
r6 = getsockopt$auto_SO_MARK(r1, 0x7, 0x24, &(0x7f00000002c0)='/proc/self/fail-nth\x00', &(0x7f0000000300)=0x7fff)
setsockopt$auto_SO_ATTACH_REUSEPORT_EBPF(r6, 0xcf, 0x34, &(0x7f0000000340)='\x00', 0x3)
timer_create$auto_CLOCK_MONOTONIC(0x1, &(0x7f00000003c0)={@sival_ptr=&(0x7f0000000380)="be293c4f6a7407458de90e000146812641314dd429d426538eb87881a8dd", @raw, 0x4}, &(0x7f0000000400)=0xffffffff)
madvise$auto(0x4, 0x8, 0x5)
openat$auto_tracing_stats_fops_trace(0xffffffffffffff9c, &(0x7f0000000440)='/sys/kernel/debug/tracing/per_cpu/cpu0/stats\x00', 0x40000, 0x0)
ioctl$auto_BTRFS_IOC_SNAP_CREATE(r1, 0x50009401, &(0x7f0000000480)={@inferred=r5, "b054b7b57308300340ed802ae20ec1d8f00876883702f074918367146fee8b4026d4b0801429e78762e266570309f2b5fa0ceb5bfe5b79aa318b878efa9cba71dd2bf0e75e11949f89ad73b6aabdbd0d8d6a34fd54da1c02d5261271090e364dbefed860940ce2e47f1b7cbe11f28aed80064fc66b2911b0ba7e90b34e7eede686b1885aada364347e5ad87029dfd798741ba88aa50ecf5206d4acee8bb8101250c6cae9211900a0bb8a6a772b3088d8657950ce125c7855cfbaba7123376de40fdd812062ca46e11ec47c2c0b7b39a401f43eed39a3c369a888f067365b26b7f36145c8d54236904922bb04110b3575ad44ca2751e6c332b743d821fa3b342a769e0d9a4e7817965c8587fef82ede49b05f2fff436da9fb2a38fe344868fe26b6b03b427a36dbae88ef21c0c8627f5a79e883bf069ec10b0a39bdc631ce96219bf6c3a821a5861e855ed91af601a3fc2cc425ffdc3bf613bd2842a7b0e941eca9a6b5e61a1fa9e72d8ecc4be9a829737ca878ad1c4161434405f5c12de634c8723151394c437b19615ca9fa9dc53829c03f63695926409b81e81775269e13e46916c6dce115d7535ebb7986d04d0e6506707fce81bafa94fcbe9b0115a487e2051eb5c32aefb218d0e6a79ee7829bf1a384e6a529fa6a6eb2a846f97cd69ec1feceb3d100165362e28c5c8886f5dd9116eb18b7aab67cec251053b044266d9117cb02f463a151383afcd0c22ffa3d7bac9ddf3fe823a2ecbcb0143f777ad7bb6a8e5b8eabd38d5f900b1ef393d0e3e205f27e12c09f68a3b22125a2ab8b9b0c9e578028c7afb9a5aba4ee4dc621e5a6a9a1d8fa05a33464bfd87f9c09530f5451e47999080d3e37013d5225b571c131f51f2fede90b933b6b94a33c3975e850482c298dd703c9c426aa5df8ca1f9b2fd45d8c5094c6eeaca5e9eaa39757361554b027c17aeec6c949f49ec133e3aba14e9d131ab6fe17ac7a702d8395069acc64ded113db649e79b0797cadf4a09108e854e421ed3ba06c966199f61dd56821a32cdf93488d2ee9c88a196fd8546f13dda65859dfd0685a368f7be74097082d58e1d43ad1ab5637778f887ee1ccffd30b67991450dcf720f3f56ef3fa9cdf4c582ebd42092e04c1b039dc20bab01fd9b0a97b95316e3c36e88172544fba87d7444bbb5454f630b2c66e2636ade1014850697ed10e8ae170e883c5e889fa4c5b45b73b27731c3991ea46d778cae89cc0b481e3bd06b208696fff729a8db49878e13062aa24c5ba1c2a8c556b9fb8cf6238cbec2f2c980fd3fee3708ec6614137269805aef61ae4730a7e04e0a43a5462da7ab004fd710284f18c9c4eab74d0544704842e3a60e5453a47bb162bbf7a1674dc8ced553da7e37fa53aa994286803393a8d3165685502c83f5c36bb55fe2861069538ba8929b0d1df00400dec38d829a483396eb724c715b0154b344ffd0f9ed7af56f4cb4053f613919e2269af04f2c02bc40403f4c7069a935576958e82d13fd3e63c749cb66af73258f659721da7647a7cab85d11fc34409f94a2c4c9ec25d03650ad0e355c3191f6a5d1b721814535de27260c31b6db845f4e3c675f8f824f6244a1608f641fe864ef2a2a3074e0f0f8e90941199758ef3066a71979e6a6042224a8d686c3e4f2f00f73ac46eb9b8f4b4dee53eba78ec3136afab07ebd8fe930a522a7fa34c8a1a0d34b48fa6475413b8113ca903c143b151c06da5c57476f16e39cd9b50dade84f58b140fc3439e6a63f11e02ce8ddd9d05c92f583d60c58b22f75315fbebb2e2f38ef26b53d989c81027815273a570a13423b98d87763dbe3a3786639f374233ab52cf1b61ed6fea8bba9345f0cc72c1853eb4719858d6e118ffa46f8b29a091b12bdeb731aeb0d31c746a5e654184660bac656d50c4ffbd5a4c14df08ae3e2c4a905259a47f9797d41160085ae44b9800375cee7e80ae68aebe6980b610dbac4090c213ce27b66700534fd7b9301d1f40ff117b54b0caa541fdcdcbf91ae7e342c1f249dbea25b497197a3f2fdb6485dde2f88315d8388a023fbf56263e3dd5ba31fc074ca2142506268cbc69e92302e5f6d07543272a111a6a19a6190334de3f0658e586f6d6201633f3e9c5dd2f4923ad5b76478f30cd96fc00f200b1fd6b64660a677ed56674813ddbc62079ef93872ee35545cd898dc682290544ff41be4ca8f30ed48cfa6bf89a1dcb9ee7f3595f6acce6903e7a5d40c96276c595071c55aea7b8abd3e608468155a637cb85d64d072a06193844e98da59d1a2f4442c474f7e53e96f448392c1171dbf5b8c48961998d61f87c2fee8ca051b4fe6e75eaba6ae660e03eab726cb1b3318751a43123d51e45e40dfb9ca475ef0542b06276169a712f23b82a4750c6ceed8e3e23e02e6f0d910c38ed8bbe68fccf0248facee3f854119868351afc6302dbc3df8431b880a6f400719938701c2f83fd687071f58799d8c35337b8a2ae7cb21ba7f63a49b09df650e739f86aa39c6028150c30405e72ca300083e4ac7b3abb6aece2341b106ef53f7d6970c6acbc7f13aa93fdc73bbd899c9ae1419e022b2dc788b1937fb94db9824b7e68a4c6356ea57c6be8e574798f2a2fa8dd4e5ecb3003a2330de58506e419715e080099965092eaae79653f727ddfa20154100ff810c0a0e576e82e846db4d4b38271b274101237ec6fdb30b5ef4f6767bba91fe54180712ffb296fdc7fb9b71fc47210203f5a27e2565d018c50f395e017100ed35447c6176e237b07c1f42276849464a6d69ccc6b6d7181c9b211a3d0c29c1f7157b44ee0fb063fe7d39147d1e4d966e3b8eb9f8cc4c27b93741cb6d99a8bbff4e9b31b88b0700603ee888ef878b56f7a76cd038b39fb3cfa78e0769bd012e5e2cb3b8c9be91239e288a2688a86236bd161faa8c29d651717bb9854a36f975268266936ad78f398b001b1c6acfbacb8a84431fb66f099d79fd4af586c949c97b0fb4bd4c58f9640eac01e5bfc3eda4e51cbe2010d9774f0ec84ba7fe5df45dc60b6ca817e35a74895b84b692fc7d63a153c0f015e321edc3c59f9af3fac1c8e7e13f706914cd9a817462ec9c5a7840b96aad7888d84a9d02787529fc06645c8b7580ae0fe2f5d8708a689377e6ebdae290399898b8c6508ba9eb63c5ca29505409b8f6056cc06ffe3c12f40925c62edd36fc62a399b65eda0c8113db93d958d976b098fd1af9ae1c0788117537d0f7bc5369916919e4be23626a7b2d5493f845c08b5f0e4baa809cd06b1ce015a380fb5e513355b7ee1674a7af0d88387e9254695417eda7b1d0c0c182d318d138cc7d5668fd9a8a2008d707455e97f4eaa296ac3ec2835afa136cef0bce851d73738f7d810570506ed090a1bc0a13fa8ba150abbb8c53629a8e2e52b0123f0ac8c025b73615d7f467164d231532caaceca0268ddc4c194ddec6c95bfa57717e47251fc238f63ee76c052384175d6a71306503c994c0a957309b0b441f8b0a8c000db194943b959646fd004e8488a8c8f7db6bee9a37e0073baea766e7269bfcd550a1553d37cd032fdbcee322996fb3b7b482f54e1f525620a426c5a8031012c4eb6ccf293ebe62eb12732b40e622f638ce3d00cfdb184b41a53a32a491d3769aee55bf9d5205e553b72bcdea981919e79a9666934f43061bec93adbc1c2bc5dedcdde3235cd439cf6b18028ce06cc19d381b08981178a18a9047bf9034e6135be24a037c6776131eb9bafae6657b964bc19043364ab41173fd091ad844a2763148c7704647a629c41bf9e7d80a49387fef429c5a90ed672df226684f8ff275786724699d82bb12eb58b414417110cb37c234c48f855f285b6aa13579d71158262571b1f9b5aa20963f5346fc0de90ee9d6092e3cbc1ef00ac04895051785263ca93f2ceeb02b01f4ff744701db215db5cd31d0d5964c8a9da15021cfcee3d804711f306dc6f7ace3232c9bffa409746f4060fd7d3911b43b5b9cdbbec8cd0ed12b5e76996893eeabdd4f15a67a6bfcd6fee80ea592bec65541e33eb1e3cdef38c4d192d936d8f964e5e914b187bff52ea8538e7c2077ddd7eb72a02402283db9498b84a9f12b6d6fbdf2b23abd897a0b91b2d5528aa310a3bb9a1617d68b2f27371ff1868bf29237e894a828508d111895b21b8823ef680a84dd8cbaf0db81f4fd45ab89e51b0d7005097bb6d774dd281f13632c10edb5365837cfd2d69e843ec73fb5da0fd5ce08ec1c6d3f8dc1acf976c13d4e5d2844aec49213692b18a1cf0f8d4f3404a0860657f36dc7cfc461c653270b78f80e09c8be5b6e9e83596882d59f7ad7148da88fc125777f3a40244d083ab401072e2837ee773c26fa20197220d4f53902cf58b13baa21645791c4ea3d19f8ae897fcf9d5344364c3267414d7854153672a5dea2143515d821a775a3cbba2fb22b9d09ad8bbb9117d19a74e09b777cbd3a8352f05b06c386570860fbf65a5b5fb23c7d0299f0a7540e34246861414027586006d7df7974be30e062c9cdadb340c9921e8ecb8650c444265bfde678d5786c6dbec322976a7d17b268ca1ff5ddbd0296a59dc7c499a09ceac0bf62129fcaa2340c7ee1432e255e7cda55df0a75f08e1159bb0206f4a1e20402f5c0e71774f486ec50a8ac6a1db2538891119bd7e0117bde783cb032edba454cd8eaccb49e341ae9528cc29cefbf4e912ab79a1ef0363cd91330f69f4e90826659beca3479bb37b4679b35734a100909ef8b5f11b147f2da28f9d0bf48e98dde6e1969f8b8d99b64cf019a46116d902d0e8f5929ab82fd338ff23604e4bbf9bbe6c30c17e6a9c8803cda27ab35115609c54198e4a5defebebe8d26c58c5355d98c5a6cf3c3e3a0e85a51af9711b00b0b13406ff6d2d62ec558bb0e3b687c1029379b6076fa19c3070477d047d8744954f44164f4f5e04a459a45c2cb7c95457bb245949fdee86ff6538079ff573a16f6627237652a7db2d7b809076af4a07d940165c080f1f32049325fba2f552f032c98a7ec7f3b545c81612e25576ae9445885d6cd25ccfb1efbd371a8670a62976d5bec5de8c58be941319a4ca5738e337d686a6d641ed5f445c53f9e362d003d8bed2afc088191ffd688f9beae9e52b1d8197cca832651de09222c67987f0d5b44218524d2f0b6e364231a7038c97ac622f2adfa303e393b7d04a569a53f34e036c421870d2f14d2007eb4065ea5553ad83aaa36c1f77537affa68be9b2d1e18300696531b7d33b33e3b9e87fbc988f158836765a66988b4c0d98dd0d65d1ff1b3e4e1bb129287237092b008e81972f929e06bce222f89433a90a109491274f641720ca0f4521b6572804437cdfd8b6e7f67b3b25ebd9a749aa7318dc59bd5133751bf19015a9411af04c8a07e738b7b0103117d54dba9032fa40898927f1d520e787bb47a3853a0bcb3a80b4903f53356df6e8c188af988683284b871f3e058895c62d06df2302fbf57dc2430283113234cd432610d088e408f2563dc60f1eb42e9b554aaa492204635e25f4552c44a343eee39c3071b9045e0f5b75fe8080be0da8cccfa667b124eae0b44a845c1ab39f58e55f0b856d939abb427506ebe6f1a5389bbe819ea4f50a9db17f774aaec7659609f0bf508a8723fd5e4a95969a60fd7dc91113966bc34c30f92c59256cbe886f109a1cc6b07504aba6b3e096f8cbe6b795063f11e47f1c7c766959c684e729bdef064e7f2f3cfc43feb598e088671bfc7ba9534ec5fdd55b56cf641bbfe5ad2b226032b1"})
mmap$auto(0x8000000000000001, 0x7ff, 0x0, 0xfffffffffffffffb, r6, 0x7)
ioctl$IOCTL_GET_NCIDEV_IDX(r3, 0x0, &(0x7f0000001480)=<r7=>0x0)
connect$auto(r2, &(0x7f00000014c0)=@nfc={0x27, r7, 0xffffffffffffffff, 0x1}, 0x2)
r8 = semctl$auto_SETVAL(0xba, 0x2, 0x10, 0x8)
ptrace$auto(0x4, r8, 0x8, 0x5)
waitid$auto_P_PGID(0x2, r1, &(0x7f0000001500)={@siginfo_0_0={0x0, 0x3, 0x5, @_rt={0x0, 0x0, @sival_int=0xe}}}, 0x0, &(0x7f0000001580)={{0x253, 0x9}, {0x200, 0x4}, 0x8, 0x7f, 0x2, 0x0, 0x2, 0x1000, 0x8, 0x2, 0x3, 0x2, 0x9, 0x8, 0x1, 0x1})
mmap$auto(0x6, 0x3, 0x4, 0x3f, r6, 0x6dabfa32)
r9 = syz_genetlink_get_family_id$auto_nl80211(&(0x7f0000001680), 0xffffffffffffffff)
sendmsg$auto_NL80211_CMD_GET_REG(r1, &(0x7f0000001740)={&(0x7f0000001640)={0x10, 0x0, 0x0, 0x100000}, 0xc, &(0x7f0000001700)={&(0x7f00000016c0)={0x28, r9, 0x8, 0x70bd28, 0x25dfdbff, {}, [@NL80211_ATTR_STA_LISTEN_INTERVAL={0x6, 0x12, 0x6}, @NL80211_ATTR_WPA_VERSIONS={0x8, 0x4b, 0x8001}, @NL80211_ATTR_TX_NO_CCK_RATE={0x4}]}, 0x28}, 0x1, 0x0, 0x0, 0x80}, 0x0)
ioctl$auto_SG_GET_RESERVED_SIZE(r1, 0x2272, &(0x7f0000001780)="4d1d72bb5f31bf01a18b3b27c79a2cba6aa6c975293d02108bc87a736c3c79e63702debd8b1747a2e2953dc56c66b4f041e0c45415aab531e5dc1441ff6a6200067257abc735a5cb381dc2ed4faa395bc931e6ffeb68f9fd8273a3ba177cf025e9b31149a55323889681d7")
r10 = syz_genetlink_get_family_id$auto_netdev(&(0x7f0000001840), r1)
ioctl$sock_SIOCGIFINDEX(r3, 0x8933, &(0x7f0000001880)={'caif0\x00', <r11=>0x0})
ioctl$sock_SIOCGIFINDEX(r6, 0x8933, &(0x7f00000018c0)={'\x00', <r12=>0x0})
sendmsg$auto_NETDEV_CMD_DEV_GET(r3, &(0x7f0000001bc0)={&(0x7f0000001800)={0x10, 0x0, 0x0, 0x10000}, 0xc, &(0x7f0000001b80)={&(0x7f0000001b00)={0x64, r10, 0x4, 0x70bd2a, 0x25dfdbfc, {}, [@NETDEV_A_DEV_IFINDEX={0x8, 0x1, r11}, @NETDEV_A_DEV_IFINDEX={0x8, 0x1, r12}, @NETDEV_A_DEV_IFINDEX={0x8}, @NETDEV_A_DEV_IFINDEX={0x8}, @NETDEV_A_DEV_IFINDEX={0x8}, @NETDEV_A_DEV_IFINDEX={0x8}, @NETDEV_A_DEV_IFINDEX={0x8}, @NETDEV_A_DEV_IFINDEX={0x8}, @NETDEV_A_DEV_IFINDEX={0x8}, @NETDEV_A_DEV_IFINDEX={0x8}]}, 0x64}, 0x1, 0x0, 0x0, 0x40800}, 0x20000880)
executing program 6:
bpf$auto(0x5, &(0x7f0000000000)=@test={0x12, 0x1, 0x0, 0x9, 0x1, 0x3, 0x3da1, 0x0, 0xb4, 0x7, 0x140000000000, 0xdb, 0x7fffffff, 0x10, 0x1}, 0x171)
r0 = socket$nl_generic(0x10, 0x3, 0x10)
r1 = syz_genetlink_get_family_id$auto_batadv(&(0x7f0000000080), r0)
ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000240)={'batadv0\x00', <r2=>0x0})
sendmsg$auto_BATADV_CMD_GET_MCAST_FLAGS(r0, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000280)={&(0x7f0000000200)=ANY=[@ANYBLOB="1c000000", @ANYRES16=r1, @ANYBLOB="afa72db57000ffdbdf250e00000008000300", @ANYRES32=r2], 0x1c}, 0x1, 0x0, 0x0, 0x300}, 0x20000000)
executing program 4:
openat$auto_seq_oss_f_ops_seq_oss(0xffffffffffffff9c, &(0x7f0000000080)='/dev/sequencer2\x00', 0x2, 0x0)
r0 = socket(0x11, 0x3, 0x9)
capset$auto(0x0, &(0x7f0000000000)={0xb213, 0x2c, 0x800})
openat$auto_fb_fops_fb_chrdev(0xffffffffffffff9c, &(0x7f0000000100)='/dev/fb0\x00', 0x2, 0x0)
openat$auto_tty_fops_tty_io(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ttynull\x00', 0x201, 0x0)
r1 = openat$auto_loop_ctl_fops_loop(0xffffffffffffff9c, &(0x7f0000000440), 0x20100, 0x0)
ioctl$auto_LOOP_CTL_REMOVE(r1, 0x4c81, 0x0)
mmap$auto(0x0, 0x400008, 0xdf, 0x9b72, 0xffffffffffffffff, 0x0)
write$auto(0x3, 0x0, 0x7fffffff)
openat$auto_stat_fops_(0xffffffffffffff9c, &(0x7f0000000140)='/proc/stat\x00', 0x2, 0x0)
read$auto(0x3, 0x0, 0x80)
mmap$auto(0x0, 0x4020009, 0x6, 0xeb1, 0x401, 0x8000)
mmap$auto(0x0, 0x7, 0x1000000004, 0x9b72, 0x2, 0x100)
openat$auto_proc_iter_file_ops_compat_inode(0xffffffffffffff9c, 0x0, 0xc0000, 0x0)
listxattrat$auto(0xffffffffffffffff, 0x0, 0x7ffffffe, &(0x7f0000000380)='\xdf^\xe2o\x87D\x10\xa0\x0e1\xb5B\xd6k]Yh\x99\xf4\xbcy.8\xcd\xf2I\xcc\xf5\xc7\xee\xb8\xea\xb7+\xd8K\xf1\x1aI\xe6(\x9f\xaeS\xf1\x199\x1fk\x01\xf36\xe1 \x1a+\xcd\xfc6\xc7W\xeaw7\x1b\xf4\x01\xebQ\n\x94{\xb5\xa7/\xa3\xa7\x16\x82\x1c\rEqd\xf7~\xba{\x8f7S\x82\xed\x8es\x02W\xdc\x16l\xee\xf1\xd9\x83\xc8', 0xe9)
statmount$auto(0x0, &(0x7f0000000180)={0x8, 0x1, 0x1, 0x3, 0xf, 0x940, 0x1ffde, 0x3, 0x6, 0x8000002, 0xff, 0x5, 0x5, 0x4, 0xb0, 0x7, 0x2, 0x3, 0x5, 0x7, 0x0, 0x0, 0x0, 0x0, 0x0, 0x80000009, [0x0, 0x4000000000000000, 0x10000, 0x243efbdf, 0x0, 0x0, 0x4000000000000, 0x0, 0x0, 0xffffffffffffffff, 0x9, 0x0, 0x0, 0x0, 0x0, 0xfffffffffffffffd, 0x0, 0x9, 0x0, 0x0, 0x0, 0x0, 0x800, 0x0, 0x0, 0x9, 0x0, 0xfffffffffffffffc, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff, 0xfffffffffffffffc, 0x0, 0x0, 0x0, 0x0, 0x0, 0xe6e, 0x0, 0x0, 0xfffffffffffffffe]}, 0x1fe, 0x81)
close_range$auto(0x0, 0xffffffffffffffff, 0x2)
sendmsg$auto_OVS_VPORT_CMD_DEL(0xffffffffffffffff, &(0x7f0000000200)={0x0, 0x0, &(0x7f00000001c0)={&(0x7f0000000180)=ANY=[@ANYBLOB='<\x00\x00\x00', @ANYBLOB="11002d"], 0x3c}, 0x1, 0x0, 0x0, 0x8000}, 0x8000)
r2 = socket(0x10, 0x2, 0x0)
sendmsg$auto_NL80211_CMD_GET_REG(r2, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000280)={&(0x7f0000000180)=ANY=[], 0x1ac}, 0x1, 0x700}, 0x40000)
sendmsg$auto_NL80211_CMD_GET_REG(0xffffffffffffffff, 0x0, 0x40000)
sendmsg$auto_NETDEV_CMD_DEV_GET(0xffffffffffffffff, &(0x7f0000000080)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x400000}, 0xc, 0x0, 0x1, 0x0, 0x0, 0x24048000}, 0xc0)
ioctl$auto(0xffffffffffffffff, 0x13, 0xffffffffffffffff)
io_uring_register$auto(0x2, 0x0, &(0x7f0000000000), 0x3)
mmap$auto(0x0, 0x400008, 0xdf, 0x9b72, 0x2, 0x8000)
mbind$auto(0x2000, 0x100000004, 0x100000000, 0x0, 0x6, 0x2)
syz_clone3(&(0x7f0000000400)={0x9840100, 0x0, 0x0, 0x0, {0x31}, 0x0, 0x0, 0x0, 0x0}, 0x58)
mmap$auto(0x0, 0x40009, 0xe2, 0x9b72, 0x7, 0x28000)
openat$auto_kernfs_file_fops_kernfs_internal(0xffffffffffffff9c, &(0x7f0000000080)='/sys/devices/LNXSYSTM:00/LNXSYBUS:00/PNP0A03:00/device:08/adr\x00', 0x0, 0x0)
sendmmsg$auto(r0, &(0x7f0000000400)={{&(0x7f0000000000), 0x5aa, &(0x7f00000000c0)={&(0x7f0000000040)="661b", 0x49}, 0x1, &(0x7f0000000200), 0x5, 0x3}, 0x4}, 0x2, 0x100)
executing program 6:
sendmsg$auto_NL80211_CMD_GET_REG(0xffffffffffffffff, 0x0, 0x0)
socket(0x2, 0x80002, 0x73)
socket(0xa, 0x1, 0x84)
ioctl$auto(0x3, 0x8905, 0x38)
ioctl$auto_TIOCMSET2(0xffffffffffffffff, 0x5418, 0x0)
setsockopt$auto_SO_DETACH_FILTER(0xffffffffffffffff, 0x6, 0x1b, &(0x7f0000000140)='/dev/audio1\x00', 0xf)
r0 = openat$auto_tracing_pipe_fops_trace(0xffffffffffffff9c, &(0x7f0000000100)='/sys/kernel/debug/tracing/per_cpu/cpu0/trace_pipe\x00', 0x101801, 0x0)
setsockopt$auto_SO_DETACH_FILTER(r0, 0x6, 0x1b, &(0x7f0000000140)='/dev/audio1\x00', 0xf)
openat$auto_binder_fops_binder_internal(0xffffffffffffff9c, 0x0, 0x1, 0x0)
socket(0x28, 0x1, 0x0)
r1 = openat$auto_posix_clock_file_operations_posix_clock(0xffffffffffffff9c, &(0x7f0000000080), 0x40400, 0x0)
ioctl$auto_posix_clock_file_operations_posix_clock(r1, 0x40103d02, 0x0)
sendmsg$auto_NL80211_CMD_TRIGGER_SCAN(0xffffffffffffffff, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000240)={&(0x7f0000000180)=ANY=[], 0x14}}, 0x4000000)
openat$auto_seq_oss_f_ops_seq_oss(0xffffffffffffff9c, &(0x7f0000000080)='/dev/sequencer2\x00', 0x2, 0x0)
r2 = openat$auto_snd_rawmidi_f_ops_rawmidi(0xffffffffffffff9c, &(0x7f0000000000)='/dev/snd/midiC2D0\x00', 0x1, 0x0)
openat$auto_proc_sys_file_operations_proc_sysctl(0xffffffffffffff9c, &(0x7f0000000000)='/proc/sys/fs/pipe-max-size\x00', 0x382, 0x0)
sendmsg$auto_NFSD_CMD_THREADS_SET(0xffffffffffffffff, &(0x7f0000000100)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000040)=ANY=[@ANYBLOB='$\x00\x00\x00', @ANYRES16=0x0, @ANYBLOB="00042cbd7000fb3d89cb809172a33200030080004000880001"], 0x24}, 0x1, 0x0, 0x0, 0x20008010}, 0x400d0)
sendmsg$auto_NL80211_CMD_GET_REG(0xffffffffffffffff, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000040)=ANY=[@ANYBLOB="72010000", @ANYBLOB="1a0027"], 0x1ac}, 0x1, 0x0, 0x0, 0x4000804}, 0x40000)
r3 = socket(0x10, 0x2, 0x0)
sendmsg$auto_NL80211_CMD_GET_REG(0xffffffffffffffff, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000300)={&(0x7f0000000040)=ANY=[], 0x1ac}, 0x1, 0x0, 0x0, 0x44814}, 0x2004c0c4)
sendmmsg$auto(r3, &(0x7f0000000200)={{0x0, 0x0, &(0x7f0000000100)={&(0x7f0000000080), 0xfc2}, 0x2, &(0x7f00000001c0), 0x7, 0xa505}, 0x800}, 0x7, 0x8)
write$auto(r2, &(0x7f0000000400)='/dev/audio1\x00', 0xa3d9)
select$auto(0xe, 0x0, 0x0, &(0x7f00000002c0)={[0x1ff, 0x7, 0xd, 0xa00, 0x948b, 0x2, 0xfffffffffffffffc, 0x6, 0x3, 0x300000000000000, 0x80000001, 0x5, 0x6d3c, 0x5, 0x2]}, 0x0)
madvise$auto(0x108000, 0x800034, 0xa)
unshare$auto(0x40000080)
msgrcv$auto(0x0, 0x0, 0x2, 0x1, 0xb2)
msgsnd$auto(0x0, &(0x7f0000000000)={0x3, 0x45}, 0x8, 0x9)
executing program 5:
openat$auto_snd_pcm_oss_f_reg_pcm_oss(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/dsp1\x00', 0x20b42, 0x0)
read$auto_proc_reg_file_ops_compat_inode(0xffffffffffffffff, &(0x7f0000000280)=""/65, 0x41)
mmap$auto(0x0, 0x4020009, 0x6, 0xeb1, 0x401, 0x8000)
prctl$auto(0x1000000003b, 0x1, 0x4, 0x5, 0x7)
socket$nl_generic(0x10, 0x3, 0x10)
close_range$auto(0x2, 0x8, 0x0)
sendmsg$auto_NETDEV_CMD_DEV_GET(0xffffffffffffffff, &(0x7f0000000080)={&(0x7f0000000140)={0x10, 0x0, 0x0, 0x400000}, 0xc, 0x0, 0x1, 0x0, 0x0, 0x48000}, 0x0)
mmap$auto(0x0, 0x400008, 0xdf, 0x9b72, 0x2, 0x8000)
close_range$auto(0x2, 0x8000, 0x0)
sendmsg$auto_HSR_C_GET_NODE_STATUS(0xffffffffffffffff, &(0x7f0000000200)={0x0, 0x0, &(0x7f00000001c0)={&(0x7f0000000140)={0x68, 0x0, 0x200, 0x70bd26, 0x25dfdbfe, {}, [@HSR_A_IF1_AGE={0x8, 0x3, 0x200}, @HSR_A_IF2_SEQ={0x6, 0x7, 0x4}, @HSR_A_IFINDEX={0x8}, @HSR_A_NODE_ADDR_B={0xa}, @HSR_A_NODE_ADDR={0xa, 0x1, @broadcast}, @HSR_A_NODE_ADDR={0xa}, @HSR_A_IF1_AGE={0x8, 0x3, 0x38}, @HSR_A_IFINDEX={0x8}, @HSR_A_IF2_AGE={0x8, 0x4, 0x4}]}, 0x68}, 0x1, 0x0, 0x0, 0x40080}, 0x40090)
socket(0x2, 0x3, 0x100)
socket(0x10, 0x2, 0x0)
sendmsg$auto_NL80211_CMD_GET_REG(0xffffffffffffffff, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000200)={0x0, 0x1ac}, 0x1, 0x0, 0x0, 0x4004810}, 0x800)
sendmsg$auto_NL80211_CMD_GET_REG(0xffffffffffffffff, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000180)=ANY=[@ANYBLOB="720100", @ANYBLOB="13"], 0x1ac}}, 0x4004)
sendmmsg$auto(0x3, &(0x7f0000000080)={{0x0, 0x2, &(0x7f00000002c0)={0x0, 0xc4}, 0x1, 0x0, 0x0, 0x9}, 0x7}, 0x3, 0x0)
executing program 0:
mmap$auto(0x0, 0x20009, 0x4000000000df, 0xeb1, 0x401, 0x8000)
prctl$auto(0x22, 0x40, 0x0, 0x7, 0x7fffd)
clone$auto(0x20003b46, 0x2, 0x0, 0x0, 0x2)
prctl$auto(0x10000000024, 0x2, 0x2008, 0x4000000c, 0x80001)
openat$auto_vmwgfx_driver_fops_vmwgfx_drv(0xffffffffffffff9c, &(0x7f0000026d00)='/dev/dri/card1\x00', 0x2000, 0x0)
mmap$auto(0x0, 0x202000b, 0x3, 0xeb1, 0xfffffffffffffffa, 0x8000)
r0 = io_uring_setup$auto(0x401, 0x0)
socket(0x26, 0x80004, 0x73)
socket$nl_generic(0x10, 0x3, 0x10)
socket$nl_generic(0x10, 0x3, 0x10)
socket$nl_generic(0x10, 0x3, 0x10)
socket$nl_generic(0x10, 0x3, 0x10)
ioctl$auto_SNDCTL_DSP_SETTRIGGER(r0, 0x40045010, &(0x7f00000000c0))
clone$auto(0x4, 0x7, &(0x7f00000000c0)=0x1, &(0x7f0000000100)=0xff, 0x7ff)
mmap$auto(0x0, 0x2000b, 0xe2, 0xeb1, 0x405, 0xfffffffffffffff9)
clone$auto(0x3fff, 0xad3, 0x0, 0x0, 0x7fffffff)
wait4$auto(0xffffffffffffffff, 0x0, 0x80000001, 0x0)
sendmsg$auto_GTP_CMD_NEWPDP(0xffffffffffffffff, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000180)={0x0}, 0x1, 0x0, 0x0, 0x8000}, 0x4040804)
lstat$auto(0x0, &(0x7f0000000180)={0x4, 0xb, 0x6, 0x76402f57, 0x0, 0x0, 0x0, 0x4, 0x40000000000f, 0x400, 0x40000402, 0x4, 0x9, 0x4, 0x9, 0x7, 0x20000010010b})
r1 = socket$nl_generic(0x10, 0x3, 0x10)
dup3$auto(0x8000000000000001, 0x5, 0x800080000)
ioctl$sock_SIOCGIFINDEX(r1, 0x89fc, &(0x7f0000000040)={'bridge0\x00'})
socket$nl_generic(0x10, 0x3, 0x10)
socket$nl_generic(0x10, 0x3, 0x10)
eventfd$auto(0x3)
eventfd$auto(0x0)
r2 = socket(0xa, 0x2, 0x0)
bpf$auto(0x0, &(0x7f0000000000)=@link_update={r2, @new_prog_fd=0x4, 0x4}, 0xa3)
setsockopt$auto_SO_WIFI_STATUS(0xffffffffffffffff, 0x0, 0x29, 0x0, 0x9)
getsockopt$auto(0xffffffffffffffff, 0x6, 0x3, &(0x7f0000000140)='bridge0\x00', &(0x7f0000000240)=0x6b96)
executing program 5:
mmap$auto(0x0, 0x20009, 0xe2, 0xeb1, 0xffffffffffffffff, 0x8000)
close_range$auto(0x2, 0x8, 0x0)
socket(0x8, 0x2, 0x9)
r0 = socket(0x2, 0x1, 0x0)
r1 = socket(0x2, 0x1, 0x0)
bind$auto(0x3, &(0x7f0000000040)=@in={0x2, 0xffff, @remote}, 0x6a)
listen$auto(r0, 0x7)
sendmmsg$auto(r1, &(0x7f0000000140)={{&(0x7f0000000040), 0x12, 0x0, 0x9, 0x0, 0x1, 0xb}, 0x800009}, 0x5, 0x20000000)
r2 = openat$auto_proc_reg_file_ops_compat_inode(0xffffffffffffff9c, &(0x7f0000000000)='/proc/asound/card1/pcm0c/sub7/sw_params\x00', 0x0, 0x0)
pread64$auto(r2, 0x0, 0xffe, 0x0)
executing program 5:
r0 = socket(0x10, 0x2, 0x0)
close_range$auto(0x2, 0x8, 0x0)
socket(0x10, 0x2, 0x4)
socket(0x10, 0x3, 0x6)
sendmsg$auto_NL80211_CMD_GET_REG(r0, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000300)=ANY=[@ANYBLOB="72010000", @ANYBLOB="120027", @ANYBLOB="5de1"], 0x1ac}}, 0x40000)
read$auto(r0, &(0x7f0000000000)='$-]&@\x00', 0x5)
executing program 5:
mmap$auto(0x0, 0x400008, 0xdf, 0x9b72, 0x2, 0x8000)
socketpair$auto(0x1e, 0x5, 0x8000000000000000, 0x0)
r0 = openat$auto_vmuser_fops_vmci_host(0xffffffffffffff9c, &(0x7f0000000180), 0x6b2c03, 0x0)
ioctl$auto_IOCTL_VMCI_VERSION2(r0, 0x7a7, 0x0)
ioctl$auto_IOCTL_VMCI_INIT_CONTEXT(r0, 0x7a0, 0x6)
ioctl$auto_IOCTL_VMCI_CTX_ADD_NOTIFICATION(r0, 0x7af, 0x0)
ioctl$auto_IOCTL_VMCI_CTX_ADD_NOTIFICATION(r0, 0x7af, 0x0)
futex$auto(0x0, 0x6, 0x8, 0x0, 0x0, 0x80000001)
openat$auto_binder_fops_binder_internal(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/binderfs/binder0\x00', 0x80, 0x0)
mmap$auto(0x0, 0x2020009, 0x3, 0xeb1, 0xffffffffffffffff, 0x8000)
select$auto(0xfffffff3, &(0x7f0000000100)={[0x5, 0x400, 0x4, 0x3, 0xea47, 0x101, 0xa, 0x3ff, 0x4, 0xb4be, 0xfffffffffffffeff, 0x5, 0x3, 0xfffffffffffffffd, 0x40, 0x80]}, 0x0, 0x0, 0x0)
r1 = openat$auto_kernfs_file_fops_kernfs_internal(0xffffffffffffff9c, &(0x7f0000000080)='/sys/devices/LNXSYSTM:00/LNXSYBUS:00/PNP0A03:00/device:08/adr\x00', 0x0, 0x0)
read$auto(r1, 0x0, 0x20)
r2 = openat$auto_proc_fail_nth_operations_base(0xffffffffffffff9c, &(0x7f0000000000)='/proc/thread-self/fail-nth\x00', 0x802, 0x0)
writev$auto(r2, &(0x7f0000000200)={0x0, 0x7}, 0x3)
syz_genetlink_get_family_id$auto_tipcv2(&(0x7f0000000300), 0xffffffffffffffff)
mmap$auto(0x0, 0x4020009, 0x6, 0xeb1, 0x401, 0x8000)
r3 = openat$auto_proc_reg_file_ops_compat_inode(0xffffffffffffff9c, &(0x7f00000000c0)='/proc/self/net/fib_triestat\x00', 0x0, 0x0)
pread64$auto(r3, 0x0, 0x200000000006, 0x5)
r4 = openat$auto_kernfs_file_fops_kernfs_internal(0xffffffffffffff9c, &(0x7f0000000080)='/sys/devices/LNXSYSTM:00/LNXSYBUS:00/PNP0C0F:00/status\x00', 0xa140, 0x0)
read$auto_kernfs_file_fops_kernfs_internal(r4, &(0x7f0000000000)=""/112, 0x70)
sendmsg$auto_NL80211_CMD_GET_REG(0xffffffffffffffff, &(0x7f0000000240)={0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x40814}, 0x2004c0c4)
executing program 6:
mmap$auto(0x0, 0x4020009, 0x8000000080000000, 0x17, 0x401, 0x8000)
madvise$auto(0x0, 0xffffffffffff0005, 0x17)
openat$auto_clear_warn_once_fops_(0xffffffffffffff9c, &(0x7f0000000100), 0x210800, 0x0)
r0 = openat$auto_tty_fops_tty_io(0xffffffffffffff9c, &(0x7f0000000000)='/dev/tty46\x00', 0x0, 0x0)
close_range$auto(0x2, 0x8, 0x0)
socket(0x10, 0x2, 0x0)
socket(0x2, 0x6, 0x0)
mmap$auto(0x0, 0x400005, 0xdf, 0x9b72, 0x2, 0x8000)
socket(0xa, 0x5, 0x84)
bind$auto(0x3, 0x0, 0x6a)
ioctl$auto(0x3, 0x800005411, 0x38)
ioctl$auto(r0, 0x5600, 0x0)
mmap$auto(0x6, 0x400005, 0xffffffffffffff00, 0x9b72, r0, 0x8000)
close_range$auto(0x2, 0x8, 0x0)
socketpair$auto(0x1, 0x2, 0x8000000000000000, 0x0)
r1 = openat$auto_force_devcoredump_fops_hci_vhci(0xffffffffffffff9c, &(0x7f0000000c40)='/sys/kernel/debug/bluetooth/hci0/force_devcoredump\x00', 0x2, 0x0)
write$auto(r1, 0x0, 0xe)
mremap$auto(0x0, 0xffffffffffffffff, 0x3fd6, 0x3, 0x7fffffffb000)
mmap$auto(0x0, 0x400005, 0x800000000000df, 0x9b72, 0x2, 0x8000)
madvise$auto(0x0, 0xffffffffffff0001, 0x15)
r2 = openat$auto_proc_clear_refs_operations_internal(0xffffffffffffff9c, &(0x7f0000000600)='/proc/thread-self/clear_refs\x00', 0x2, 0x0)
mmap$auto(0x0, 0x8, 0xdf, 0x9b72, 0x2, 0x8000)
setitimer$auto(0x4, &(0x7f0000000000)={{0x1ff, 0x10001}, {0x200000000004, 0x6}}, 0x0)
openat$nci(0xffffffffffffff9c, &(0x7f0000000000), 0x2, 0x0)
bpf$auto(0x12, &(0x7f0000000000)=@info={0x2800, 0x1ff, 0x2}, 0xcf)
r3 = socket(0x10, 0x2, 0x0)
sendmsg$auto_NL80211_CMD_GET_REG(r3, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000300)=ANY=[@ANYBLOB=' \x00\x00\x00', @ANYBLOB="1200", @ANYBLOB=']'], 0x1ac}}, 0x40000)
recvmmsg$auto(r3, &(0x7f0000000380)={{0x0, 0x1, &(0x7f0000000000)={0x0, 0x400}, 0x4, 0x0, 0x200002, 0x8}, 0x803}, 0xfffffff9, 0x10010, 0x0)
write$auto_proc_clear_refs_operations_internal(r2, 0x0, 0xffffff4b)
socket(0xa, 0x3, 0x3a)

program did not crash
replaying the whole log did not cause a kernel crash
single: executing 1 programs separately with timeout 6m0s
testing program (duration=6m0s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): mmap$auto-madvise$auto-openat$auto_clear_warn_once_fops_-openat$auto_tty_fops_tty_io-close_range$auto-socket-socket-mmap$auto-socket-bind$auto-ioctl$auto-ioctl$auto-mmap$auto-close_range$auto-socketpair$auto-openat$auto_force_devcoredump_fops_hci_vhci-write$auto-mremap$auto-mmap$auto-madvise$auto-openat$auto_proc_clear_refs_operations_internal-mmap$auto-setitimer$auto-openat$nci-bpf$auto-socket-sendmsg$auto_NL80211_CMD_GET_REG-recvmmsg$auto-write$auto_proc_clear_refs_operations_internal-socket
detailed listing:
executing program 0:
mmap$auto(0x0, 0x4020009, 0x8000000080000000, 0x17, 0x401, 0x8000)
madvise$auto(0x0, 0xffffffffffff0005, 0x17)
openat$auto_clear_warn_once_fops_(0xffffffffffffff9c, &(0x7f0000000100), 0x210800, 0x0)
r0 = openat$auto_tty_fops_tty_io(0xffffffffffffff9c, &(0x7f0000000000)='/dev/tty46\x00', 0x0, 0x0)
close_range$auto(0x2, 0x8, 0x0)
socket(0x10, 0x2, 0x0)
socket(0x2, 0x6, 0x0)
mmap$auto(0x0, 0x400005, 0xdf, 0x9b72, 0x2, 0x8000)
socket(0xa, 0x5, 0x84)
bind$auto(0x3, 0x0, 0x6a)
ioctl$auto(0x3, 0x800005411, 0x38)
ioctl$auto(r0, 0x5600, 0x0)
mmap$auto(0x6, 0x400005, 0xffffffffffffff00, 0x9b72, r0, 0x8000)
close_range$auto(0x2, 0x8, 0x0)
socketpair$auto(0x1, 0x2, 0x8000000000000000, 0x0)
r1 = openat$auto_force_devcoredump_fops_hci_vhci(0xffffffffffffff9c, &(0x7f0000000c40)='/sys/kernel/debug/bluetooth/hci0/force_devcoredump\x00', 0x2, 0x0)
write$auto(r1, 0x0, 0xe)
mremap$auto(0x0, 0xffffffffffffffff, 0x3fd6, 0x3, 0x7fffffffb000)
mmap$auto(0x0, 0x400005, 0x800000000000df, 0x9b72, 0x2, 0x8000)
madvise$auto(0x0, 0xffffffffffff0001, 0x15)
r2 = openat$auto_proc_clear_refs_operations_internal(0xffffffffffffff9c, &(0x7f0000000600)='/proc/thread-self/clear_refs\x00', 0x2, 0x0)
mmap$auto(0x0, 0x8, 0xdf, 0x9b72, 0x2, 0x8000)
setitimer$auto(0x4, &(0x7f0000000000)={{0x1ff, 0x10001}, {0x200000000004, 0x6}}, 0x0)
openat$nci(0xffffffffffffff9c, &(0x7f0000000000), 0x2, 0x0)
bpf$auto(0x12, &(0x7f0000000000)=@info={0x2800, 0x1ff, 0x2}, 0xcf)
r3 = socket(0x10, 0x2, 0x0)
sendmsg$auto_NL80211_CMD_GET_REG(r3, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000300)=ANY=[@ANYBLOB=' \x00\x00\x00', @ANYBLOB="1200", @ANYBLOB=']'], 0x1ac}}, 0x40000)
recvmmsg$auto(r3, &(0x7f0000000380)={{0x0, 0x1, &(0x7f0000000000)={0x0, 0x400}, 0x4, 0x0, 0x200002, 0x8}, 0x803}, 0xfffffff9, 0x10010, 0x0)
write$auto_proc_clear_refs_operations_internal(r2, 0x0, 0xffffff4b)
socket(0xa, 0x3, 0x3a)

program did not crash
single: failed to extract reproducer
bisect: bisecting 45 programs with base timeout 6m0s
testing program (duration=6m11s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): [3, 3, 22, 11, 30, 26, 26, 27, 21, 2, 4, 4, 30, 30, 30, 16, 30, 26, 15, 24, 24, 30, 5, 6, 30, 2, 30, 15, 30, 26, 5, 25, 6, 6, 25, 30, 5, 30, 27, 15, 30, 10, 6, 22, 30]
detailed listing:
executing program 1:
unshare$auto(0x8)
openat$auto_ftrace_set_event_notrace_pid_fops_trace_events(0xffffffffffffff9c, &(0x7f0000000000)='/sys/kernel/debug/tracing/set_event_notrace_pid\x00', 0x4000, 0x0)
vmsplice$auto(0x1, &(0x7f0000000040)={&(0x7f0000000040), 0x1ffc0}, 0xa, 0x6)
executing program 1:
unshare$auto(0x8)
openat$auto_ftrace_set_event_notrace_pid_fops_trace_events(0xffffffffffffff9c, &(0x7f0000000000)='/sys/kernel/debug/tracing/set_event_notrace_pid\x00', 0x4000, 0x0)
vmsplice$auto(0x1, &(0x7f0000000040)={&(0x7f0000000040), 0x1ffc0}, 0xa, 0x6) (fail_nth: 1)
executing program 1:
mmap$auto(0x0, 0x2000a, 0x10000000000df, 0xeb2, 0x401, 0x8000)
openat$auto_kernfs_file_fops_kernfs_internal(0xffffffffffffff9c, 0x0, 0x882, 0x0)
close_range$auto(0x2, 0x8, 0x0)
r0 = openat$auto_kvm_chardev_ops_kvm_main(0xffffffffffffff9c, &(0x7f00000011c0), 0xe0180, 0x0)
ioctl$auto_KVM_CREATE_VM(r0, 0xae01, 0x0)
bind$auto(0xffffffffffffffff, 0x0, 0x62)
ioctl$auto(0x3, 0xae60, 0x10000000000402)
socket(0x10, 0x2, 0x4)
mmap$auto(0x0, 0x2000d, 0x4000000200df, 0xeb1, 0x404, 0x8000)
sendmsg$auto_NL80211_CMD_GET_REG(0xffffffffffffffff, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000200)={0x0}}, 0x800)
sendmsg$auto_NL80211_CMD_SET_POWER_SAVE(0xffffffffffffffff, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000180)={0x14, 0x0, 0x200, 0x70bd29, 0x25dfdbfe}, 0x14}, 0x1, 0x0, 0x0, 0x20004800}, 0x48080)
sendmsg$auto_HWSIM_CMD_DEL_RADIO(0xffffffffffffffff, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000000180)=ANY=[@ANYBLOB="14000000", @ANYRES16, @ANYBLOB="01"], 0x14}, 0x1, 0x0, 0x0, 0x20040800}, 0x24004000)
sendmsg$auto_NL80211_CMD_GET_REG(0xffffffffffffffff, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000180)=ANY=[@ANYBLOB="72010000", @ANYBLOB="1200"], 0x1ac}}, 0x40000)
sendmmsg$auto(0x3, &(0x7f0000000080)={{0x0, 0x2, &(0x7f00000002c0)={0x0, 0xc4}, 0x1, 0x0, 0x0, 0x9}, 0x7}, 0x3, 0x0)
r1 = open(&(0x7f0000000100)='.\x00', 0x0, 0x110)
mmap$auto(0x0, 0x2020009, 0x3, 0xeb1, 0xfffffffffffffffa, 0x8000)
prctl$auto(0x1000000003b, 0x1, 0x4, 0x5, 0x7)
mmap$auto(0x0, 0x400008, 0xdf, 0x9b72, 0x2, 0x800008000)
madvise$auto(0x0, 0xffffffffffff0001, 0x15)
removexattr$auto(0x0, 0x0)
getdents64$auto(r1, 0x0, 0x400)
ioctl$auto(0x3, 0x4020aea5, 0x38)
executing program 1:
mmap$auto(0x0, 0x4, 0x4000000000df, 0x40eb1, 0x401, 0x300000000000)
close_range$auto(0x0, 0xfffffffffffff000, 0x0)
openat$auto_proc_single_file_operations_base(0xffffffffffffff9c, &(0x7f0000000180)='/proc/fs/ext4/sda1/mb_stats\x00', 0x109100, 0x0)
mmap$auto(0x0, 0x8, 0xdf, 0x9b72, 0x2, 0x8000)
socket(0x18, 0x5, 0x2)
getpeername$auto(0x3, 0x0, 0x0)
r0 = openat$auto_tty_fops_tty_io(0xffffffffffffff9c, &(0x7f0000000000)='/dev/tty12\x00', 0x800, 0x0)
socket(0x10, 0x2, 0x4)
r1 = socketpair$auto(0x1e, 0x4, 0x8000000000000000, 0x0)
ioctl$auto(r0, 0x541c, r1)
read$auto_proc_pid_maps_operations_internal(r1, &(0x7f0000000040)=""/136, 0x88)
executing program 1:
openat$auto_tty_fops_tty_io(0xffffffffffffff9c, &(0x7f0000000180)='/dev/ptyzf\x00', 0x90800, 0x0)
mmap$auto(0x0, 0xa00006, 0x2, 0x40eb1, 0x602, 0x300000000000)
quotactl_fd$auto(0xffffffffffffffff, 0x1, 0x0, 0x0)
socket(0x2, 0x3, 0xfffffff1)
adjtimex$auto(&(0x7f00000004c0)={0xf332b71, 0x0, 0x0, 0xfffffffffffffffd, 0x40000d4, 0x8000000000001, 0x6, 0x0, 0x8, 0x9, 0x100000000000002, {0x2100000000, 0x10000}, 0x5, 0x100000006, 0xfffffffffffffffd, 0x1008000, 0x0, 0x80000004, 0x3, 0xffffffffffff628e, 0xa747, 0xdeae, 0x804})
socket(0x2b, 0x1, 0x1)
openat$auto_seq_oss_f_ops_seq_oss(0xffffffffffffff9c, &(0x7f0000000080)='/dev/sequencer2\x00', 0x2, 0x0)
r0 = openat$auto_snd_rawmidi_f_ops_rawmidi(0xffffffffffffff9c, &(0x7f0000000000)='/dev/snd/midiC2D0\x00', 0x1, 0x0)
write$auto(r0, &(0x7f0000000400)='/dev/audio1\x00', 0xa3d9)
unshare$auto(0x40000080)
ustat$auto(0x45, &(0x7f0000000040)={0x200, 0x2, "84d1d3931a0f", "0fa1b61ca8fe"})
mmap$auto(0x0, 0x4, 0x4000000000df, 0x40eb1, 0x401, 0x300000000000)
epoll_create$auto(0x3e)
socket(0xf, 0x5, 0x200084)
open(0x0, 0x0, 0x408)
prctl$auto(0x4, 0x0, 0x0, 0xfffffffffffffffd, 0x2)
socket(0x2, 0x1, 0x0)
bind$auto(0x3, &(0x7f0000000040)=@ethernet={0x6, @broadcast}, 0x6e)
ioctl$auto_PAGEMAP_SCAN(0xffffffffffffffff, 0xc0606610, &(0x7f000000c380)={0x60, 0x0, 0x100000, 0x10000000000000, 0xfffffffffffffffe, 0x0, 0x4000, 0x50b301a, 0x2c, 0x24, 0xff, 0x2})
socket$nl_generic(0x10, 0x3, 0x10)
mmap$auto(0x0, 0x2020009, 0x3, 0xeb1, 0xfffffffffffffffa, 0x8000)
capset$auto(0x0, 0x0)
lsm_list_modules$auto(0x0, 0x0, 0x0)
read$auto(0x4, 0x0, 0xfdef)
close_range$auto(0x2, 0x8, 0x0)
openat$auto_console_fops_tty_io(0xffffffffffffff9c, 0x0, 0x40, 0x0)
r1 = openat$auto_dvb_demux_fops_dmxdev(0xffffffffffffff9c, &(0x7f0000000140), 0x8040, 0x0)
ioctl$auto_dvb_demux_fops_dmxdev(r1, 0x403c6f2b, 0x0)
ioctl$auto(0x3, 0x6f29, 0x10000000000402)
syz_genetlink_get_family_id$auto_nl802154(0x0, 0xffffffffffffffff)
executing program 1:
mmap$auto(0x0, 0x4020009, 0xdf, 0xeb2, 0x401, 0x8000)
close_range$auto(0x2, 0x8, 0x0)
openat$auto_console_fops_tty_io(0xffffffffffffff9c, &(0x7f0000000000)='/dev/tty0\x00', 0x0, 0x0)
r0 = openat$auto_dvb_demux_fops_dmxdev(0xffffffffffffff9c, &(0x7f0000000140), 0x8040, 0x0)
openat2$auto(0xffffffffffffff9c, 0x0, 0x0, 0xf6)
mmap$auto(0x0, 0x2020009, 0x3, 0xeb1, 0xfffffffffffffffa, 0x8000)
r1 = openat$auto_kernfs_file_fops_kernfs_internal(0xffffffffffffff9c, &(0x7f0000000000)='/sys/devices/virtual/net/bond0/flags\x00', 0x101142, 0x0)
write$auto(r1, 0x0, 0x4)
io_uring_setup$auto(0x101, 0x0)
ioctl$auto_dvb_demux_fops_dmxdev(r0, 0x403c6f2b, 0x0)
ioctl$auto(0x3, 0x6f2d, 0x10000000000402)
mmap$auto(0x0, 0x20009, 0x4000000000df, 0xeb1, 0x401, 0x8000)
r2 = syz_genetlink_get_family_id$auto_mac80211_hwsim(&(0x7f0000000c80), 0xffffffffffffffff)
sendmsg$auto_HWSIM_CMD_NEW_RADIO(0xffffffffffffffff, &(0x7f0000000d80)={&(0x7f0000000c40), 0xc, &(0x7f0000000d40)={&(0x7f0000000cc0)={0x48, r2, 0x200, 0x70bd2b, 0x25dfdbfe, {}, [@HWSIM_ATTR_RX_RATE={0x8, 0x5, 0x80000001}, @HWSIM_ATTR_REG_HINT_ALPHA2={0x9, 0xb, 'IPVS\x00'}, @HWSIM_ATTR_RADIO_ID={0x8, 0xa, 0x1}, @HWSIM_ATTR_RADIO_ID={0x8, 0xa, 0x2}, @HWSIM_ATTR_REG_HINT_ALPHA2={0x5, 0xb, '\x00'}, @HWSIM_ATTR_FLAGS={0x8, 0x4, 0x5}]}, 0x48}}, 0x40000)
move_pages$auto(0x1, 0x2000000000003, 0x0, 0x0, 0x0, 0x8000400000000000)
r3 = socket(0xa, 0x801, 0x84)
setsockopt$auto(r3, 0x10000000084, 0x9, 0x0, 0x98)
r4 = openat$auto_hwsim_fops_ps_(0xffffffffffffff9c, &(0x7f0000000180)='/sys/kernel/debug/ieee80211/phy16/hwsim/ps\x00', 0x200200, 0x0)
r5 = fcntl$auto_F_UNLCK(r4, 0xb4, 0x2)
r6 = syz_genetlink_get_family_id$auto_ipvs(&(0x7f0000000200), r5)
msgctl$auto_IPC_SET(0x8, 0x1, &(0x7f00000002c0)={{0x40, <r7=>0xffffffffffffffff, 0x0, 0x8000, 0xfff, 0x9}, &(0x7f0000000240)=0x42, &(0x7f0000000280)=0x2, 0x4, 0x8, 0x3, 0x0, 0xffff, 0x5, 0x6, 0x1, @inferred=0xffffffffffffffff})
lstat$auto(&(0x7f0000000340)='./file0\x00', &(0x7f0000000380)={0x40, 0x40, 0x53, 0x7, <r8=>0xffffffffffffffff, 0xee00, 0x0, 0x0, 0x4b47, 0x80000001, 0xfffffffffffffc00, 0x2e98, 0x7, 0x6, 0xb1, 0x2400000000000, 0x3000000})
sendmsg$auto_IPVS_CMD_FLUSH(r5, &(0x7f0000000c00)={&(0x7f00000001c0)={0x10, 0x0, 0x0, 0x40}, 0xc, &(0x7f0000000bc0)={&(0x7f0000000440)={0x774, r6, 0x400, 0x70bd2c, 0x25dfdbfd, {}, [@IPVS_CMD_ATTR_SERVICE={0x2d4, 0x1, 0x0, 0x1, [@nested={0x127, 0x17, 0x0, 0x1, [@generic="871704ea4aadd981495ab19b63975258ce6c9a1ea0a045402baef57bd7ee8f1eaba1fa1024b4c912432525763cd39440d0a14be8688b6a7693e0edd74cb581b9ebfe7ab321aac94541e0e3bf6801edc66adb6d206a6be8078a60c4d460e66db02a378dc2e89035f253cf80e9dcb9263a8fd34a7c494c06b71476c62553dc00317095d9288a0ded8e29d4c06f4d14117aaa63911b9ed5f04a65f3c454713dbf5b44301d1859572d40f7337a7af5aab2385db70d22818c86b0a74f7dfb6383effb053ab3b344308ace69dbb3a920441287fec0ed38d9a3e82c", @nested={0x4, 0x4}, @typed={0x8, 0x14c, 0x0, 0x0, @uid=r7}, @generic="c95aeded1f45e66228f9ef8f19300d7bf662441524a771572da1f7b8d87b34363643666451b7ef6b465da11f79653ae58f10c2086d673e0b755d52a8ff7aff"]}, @nested={0x190, 0x45, 0x0, 0x1, [@typed={0xc, 0x5c, 0x0, 0x0, @u64=0x800}, @nested={0x4, 0x48}, @generic="7ad7aada77683072504900f7e10b4ebc4b89c6acd80c98d4e030f91c8fa79845ceb71dcda68cb7151f6f1ab4823b47aba46dea150fd09804d24ed3aceb75cb0e2dc80a7e1fb6784038e7fd453f571e5e923cf332530cffa1a0a69bbbd3487f78baf74b90ab3ab31f1a8ebe2850521bfe64691d22c538bd9c51d7d8abeb2e460443ef0e82739fe4a43147dd4d608b9542a1c603cf16585dc0", @nested={0x4, 0x124}, @nested={0x4, 0x66}, @generic="ae750686f8df37eb967da4ddcb4c194cd5821fabf1cfc74bcf581da957a13350396043316cd2b2a81eee34c55395c6e4dbc2070688d9da5c19bd34f286e87cf049bd0edd47ce2e2e1d07e13509a809d2946e3c85ece0197803b1254b0199ab473fb3a0f33d60df73d4b7515963cdc6342a3df3ab6ec42b95ede1e318d50429fc4eeabfe60f4260664d2ffc31f15edccaa1233252248a82f6222ae7d94efd29cd4532d3fba9cb0751d8f8e97762711a3ab31f8ce5a38acc152e8459a16fa19062c839cc231fc1712d21a5c4957241a6329b99a7a6de99464335cc54dd"]}, @typed={0xc, 0x8a, 0x0, 0x0, @u64=0xffffffff}, @typed={0xc, 0x14b, 0x0, 0x0, @u64=0x2}]}, @IPVS_CMD_ATTR_SERVICE={0xc, 0x1, 0x0, 0x1, [@nested={0x8, 0xe7, 0x0, 0x1, [@typed={0x4, 0x5f}]}]}, @IPVS_CMD_ATTR_DEST={0x1dc, 0x2, 0x0, 0x1, [@typed={0xbd, 0x10a, 0x0, 0x0, @binary="1d471fef13d7d7927e06ae36aff425cec03d8513acc40bb7f6f8e6ac012402ee3f855cbefe9a0e85dc4009d8d5a0d7a4cf84be605244c567d491d75076a860a59eeae83209fa59ddcd1b1bc65be47e3f7d24f57e815ee49b17594743a15722e990e65fa77f7e00331f008bddc30bb388186df51b4f805426a80345ae62454bf2cbfe32e347a6c2ec38c612c0b860c6d383e9a4d61d9e6f26bf5e0955f0e1438fdc25b05ded7039e02cbc426c31ac782c6cf32faa97620bce00"}, @generic="787604329aba534bd23ccfb0611b3af32dc783b4f7b4f23b5467f0abced5ca601877127b81629eadf6d69bbd815d73ecdd2b3bd3b08f5954aa2b0e4f64824428744e9c559b91bef55dd7285b16aa3466514fc38d3223cfcd41a0d4e095313d27853f559528e48ae34393a46eec32fa0339d9d503009ccae727d1b2c32883c770", @nested={0x8, 0x114, 0x0, 0x1, [@nested={0x4, 0xc1}]}, @generic="1fc2a9dd22cce4bd589b96e22a700747618b61175621e8265018aeee41dd88270905b46fc763b0eccc001b1e1a675119ff6ee8b7e6a19fa62a65a0b5843daa7388206204066b2624f26870cb88eff2a399220d48c83cff24a4f52a55ac8edece16abcde074be5637fb228f1d1684e660349c455a20b2e53587c94ffd1b111cc4660df0ef3c47bec4bf43f6080d982494"]}, @IPVS_CMD_ATTR_SERVICE={0x2a4, 0x1, 0x0, 0x1, [@nested={0xce, 0x8d, 0x0, 0x1, [@nested={0x4, 0xde}, @typed={0xc, 0x4e, 0x0, 0x0, @u64=0x800}, @generic="2d44f369315f2f33fef807b381ec2d4034f68bdabbf611b16d9c357172445c3adc454588394d93215b1e581157e77304964f631faf38be93009b5830a17d3e3d765a6502029d985a6eacecf4ceef0e2570df8c16f2b27e9520aa8eee7cbe3d59710d187a23d765d6746ceddceb0d03490f8c45683b55bb50bf7b715f2cb8ee9146382e8e024444144dd2bf7e968841a33b2960eae965a1175eef4ce7d48ebbf36a51e91f5ee9b48b55d1d42a8e12ee1736aba38071df4f6818aa"]}, @typed={0x14, 0x145, 0x0, 0x0, @ipv6=@empty}, @generic="2c1fb0a79c0e9148a9e7cc25ac084a5429c0851a59368468f6f6f5a5b050b50c106bde6711a06879274f0b9f8a99634f2724e40ee32d8b34eb992bf29ea0fa45626a8e602e5d5f27b3e7f6acfaeed5541eeb03cb563ad36d242deefed41e681bf8f75ea3b9751678cff50badb26602138254fbd1a74824865be99c2d1726ff5466988c04996954ec5be7a0d0bcc1108fe3050611c93e77f1d32a498f19d1bf52e2c75e40137e5db13ada7509b7c313dfb60c370f0cd8da455b2c9c851b442570fb8361ba1209159202ed6ac91b0eb54bea815df544a7420138f9885f542e351a1c0ac072d145af01627997ae5c519818a286fe0e546c3de06a873311", @typed={0x8, 0x93, 0x0, 0x0, @u32=0xa3}, @typed={0x8, 0xc8, 0x0, 0x0, @ipv4=@remote}, @typed={0x8, 0x12b, 0x0, 0x0, @fd=r3}, @typed={0xa0, 0xce, 0x0, 0x0, @binary="8b0844668f85eacdff95824596f319b55483e8b53d0e6206073551a6d61ef21ca31dbcf58ed08eba8c854863f6c0e20c1906dd6d05d3b472918d2e5c86dfc6a937d8d71d98420265da4054cea8e4642f8a179333f0551fb8b981ab8cf636f99887eb53ef5351a9ef50c4d991e1ccc04f285f7060ba015d2efa2f270de77960127e0c583286619e371875056f57bf44976e46f685cc27988263e655e8"}, @typed={0x8, 0x140, 0x0, 0x0, @uid=r8}]}]}, 0x774}, 0x1, 0x0, 0x0, 0x8811}, 0x4000)
r9 = syz_genetlink_get_family_id$auto_nl80211(&(0x7f0000000080), 0xffffffffffffffff)
sendmsg$auto_NL80211_CMD_CONTROL_PORT_FRAME(r5, &(0x7f0000000140)={&(0x7f0000000040), 0xc, &(0x7f0000000100)={&(0x7f00000000c0)=ANY=[@ANYBLOB='\x00\x00\x00\x00', @ANYRES16=r9, @ANYBLOB="040027bd7000fbdbdf25810000000400ae0008007e0006000000"], 0x20}, 0x1, 0x0, 0x0, 0x20008010}, 0x20000000)
openat$auto_proc_reg_file_ops_compat_inode(0xffffffffffffff9c, &(0x7f0000000000)='/proc/thread-self/net/rpc/nfsd.export/channel\x00', 0x8f3b7a51b8162d21, 0x0)
executing program 32:
mmap$auto(0x0, 0x4020009, 0xdf, 0xeb2, 0x401, 0x8000)
close_range$auto(0x2, 0x8, 0x0)
openat$auto_console_fops_tty_io(0xffffffffffffff9c, &(0x7f0000000000)='/dev/tty0\x00', 0x0, 0x0)
r0 = openat$auto_dvb_demux_fops_dmxdev(0xffffffffffffff9c, &(0x7f0000000140), 0x8040, 0x0)
openat2$auto(0xffffffffffffff9c, 0x0, 0x0, 0xf6)
mmap$auto(0x0, 0x2020009, 0x3, 0xeb1, 0xfffffffffffffffa, 0x8000)
r1 = openat$auto_kernfs_file_fops_kernfs_internal(0xffffffffffffff9c, &(0x7f0000000000)='/sys/devices/virtual/net/bond0/flags\x00', 0x101142, 0x0)
write$auto(r1, 0x0, 0x4)
io_uring_setup$auto(0x101, 0x0)
ioctl$auto_dvb_demux_fops_dmxdev(r0, 0x403c6f2b, 0x0)
ioctl$auto(0x3, 0x6f2d, 0x10000000000402)
mmap$auto(0x0, 0x20009, 0x4000000000df, 0xeb1, 0x401, 0x8000)
r2 = syz_genetlink_get_family_id$auto_mac80211_hwsim(&(0x7f0000000c80), 0xffffffffffffffff)
sendmsg$auto_HWSIM_CMD_NEW_RADIO(0xffffffffffffffff, &(0x7f0000000d80)={&(0x7f0000000c40), 0xc, &(0x7f0000000d40)={&(0x7f0000000cc0)={0x48, r2, 0x200, 0x70bd2b, 0x25dfdbfe, {}, [@HWSIM_ATTR_RX_RATE={0x8, 0x5, 0x80000001}, @HWSIM_ATTR_REG_HINT_ALPHA2={0x9, 0xb, 'IPVS\x00'}, @HWSIM_ATTR_RADIO_ID={0x8, 0xa, 0x1}, @HWSIM_ATTR_RADIO_ID={0x8, 0xa, 0x2}, @HWSIM_ATTR_REG_HINT_ALPHA2={0x5, 0xb, '\x00'}, @HWSIM_ATTR_FLAGS={0x8, 0x4, 0x5}]}, 0x48}}, 0x40000)
move_pages$auto(0x1, 0x2000000000003, 0x0, 0x0, 0x0, 0x8000400000000000)
r3 = socket(0xa, 0x801, 0x84)
setsockopt$auto(r3, 0x10000000084, 0x9, 0x0, 0x98)
r4 = openat$auto_hwsim_fops_ps_(0xffffffffffffff9c, &(0x7f0000000180)='/sys/kernel/debug/ieee80211/phy16/hwsim/ps\x00', 0x200200, 0x0)
r5 = fcntl$auto_F_UNLCK(r4, 0xb4, 0x2)
r6 = syz_genetlink_get_family_id$auto_ipvs(&(0x7f0000000200), r5)
msgctl$auto_IPC_SET(0x8, 0x1, &(0x7f00000002c0)={{0x40, <r7=>0xffffffffffffffff, 0x0, 0x8000, 0xfff, 0x9}, &(0x7f0000000240)=0x42, &(0x7f0000000280)=0x2, 0x4, 0x8, 0x3, 0x0, 0xffff, 0x5, 0x6, 0x1, @inferred=0xffffffffffffffff})
lstat$auto(&(0x7f0000000340)='./file0\x00', &(0x7f0000000380)={0x40, 0x40, 0x53, 0x7, <r8=>0xffffffffffffffff, 0xee00, 0x0, 0x0, 0x4b47, 0x80000001, 0xfffffffffffffc00, 0x2e98, 0x7, 0x6, 0xb1, 0x2400000000000, 0x3000000})
sendmsg$auto_IPVS_CMD_FLUSH(r5, &(0x7f0000000c00)={&(0x7f00000001c0)={0x10, 0x0, 0x0, 0x40}, 0xc, &(0x7f0000000bc0)={&(0x7f0000000440)={0x774, r6, 0x400, 0x70bd2c, 0x25dfdbfd, {}, [@IPVS_CMD_ATTR_SERVICE={0x2d4, 0x1, 0x0, 0x1, [@nested={0x127, 0x17, 0x0, 0x1, [@generic="871704ea4aadd981495ab19b63975258ce6c9a1ea0a045402baef57bd7ee8f1eaba1fa1024b4c912432525763cd39440d0a14be8688b6a7693e0edd74cb581b9ebfe7ab321aac94541e0e3bf6801edc66adb6d206a6be8078a60c4d460e66db02a378dc2e89035f253cf80e9dcb9263a8fd34a7c494c06b71476c62553dc00317095d9288a0ded8e29d4c06f4d14117aaa63911b9ed5f04a65f3c454713dbf5b44301d1859572d40f7337a7af5aab2385db70d22818c86b0a74f7dfb6383effb053ab3b344308ace69dbb3a920441287fec0ed38d9a3e82c", @nested={0x4, 0x4}, @typed={0x8, 0x14c, 0x0, 0x0, @uid=r7}, @generic="c95aeded1f45e66228f9ef8f19300d7bf662441524a771572da1f7b8d87b34363643666451b7ef6b465da11f79653ae58f10c2086d673e0b755d52a8ff7aff"]}, @nested={0x190, 0x45, 0x0, 0x1, [@typed={0xc, 0x5c, 0x0, 0x0, @u64=0x800}, @nested={0x4, 0x48}, @generic="7ad7aada77683072504900f7e10b4ebc4b89c6acd80c98d4e030f91c8fa79845ceb71dcda68cb7151f6f1ab4823b47aba46dea150fd09804d24ed3aceb75cb0e2dc80a7e1fb6784038e7fd453f571e5e923cf332530cffa1a0a69bbbd3487f78baf74b90ab3ab31f1a8ebe2850521bfe64691d22c538bd9c51d7d8abeb2e460443ef0e82739fe4a43147dd4d608b9542a1c603cf16585dc0", @nested={0x4, 0x124}, @nested={0x4, 0x66}, @generic="ae750686f8df37eb967da4ddcb4c194cd5821fabf1cfc74bcf581da957a13350396043316cd2b2a81eee34c55395c6e4dbc2070688d9da5c19bd34f286e87cf049bd0edd47ce2e2e1d07e13509a809d2946e3c85ece0197803b1254b0199ab473fb3a0f33d60df73d4b7515963cdc6342a3df3ab6ec42b95ede1e318d50429fc4eeabfe60f4260664d2ffc31f15edccaa1233252248a82f6222ae7d94efd29cd4532d3fba9cb0751d8f8e97762711a3ab31f8ce5a38acc152e8459a16fa19062c839cc231fc1712d21a5c4957241a6329b99a7a6de99464335cc54dd"]}, @typed={0xc, 0x8a, 0x0, 0x0, @u64=0xffffffff}, @typed={0xc, 0x14b, 0x0, 0x0, @u64=0x2}]}, @IPVS_CMD_ATTR_SERVICE={0xc, 0x1, 0x0, 0x1, [@nested={0x8, 0xe7, 0x0, 0x1, [@typed={0x4, 0x5f}]}]}, @IPVS_CMD_ATTR_DEST={0x1dc, 0x2, 0x0, 0x1, [@typed={0xbd, 0x10a, 0x0, 0x0, @binary="1d471fef13d7d7927e06ae36aff425cec03d8513acc40bb7f6f8e6ac012402ee3f855cbefe9a0e85dc4009d8d5a0d7a4cf84be605244c567d491d75076a860a59eeae83209fa59ddcd1b1bc65be47e3f7d24f57e815ee49b17594743a15722e990e65fa77f7e00331f008bddc30bb388186df51b4f805426a80345ae62454bf2cbfe32e347a6c2ec38c612c0b860c6d383e9a4d61d9e6f26bf5e0955f0e1438fdc25b05ded7039e02cbc426c31ac782c6cf32faa97620bce00"}, @generic="787604329aba534bd23ccfb0611b3af32dc783b4f7b4f23b5467f0abced5ca601877127b81629eadf6d69bbd815d73ecdd2b3bd3b08f5954aa2b0e4f64824428744e9c559b91bef55dd7285b16aa3466514fc38d3223cfcd41a0d4e095313d27853f559528e48ae34393a46eec32fa0339d9d503009ccae727d1b2c32883c770", @nested={0x8, 0x114, 0x0, 0x1, [@nested={0x4, 0xc1}]}, @generic="1fc2a9dd22cce4bd589b96e22a700747618b61175621e8265018aeee41dd88270905b46fc763b0eccc001b1e1a675119ff6ee8b7e6a19fa62a65a0b5843daa7388206204066b2624f26870cb88eff2a399220d48c83cff24a4f52a55ac8edece16abcde074be5637fb228f1d1684e660349c455a20b2e53587c94ffd1b111cc4660df0ef3c47bec4bf43f6080d982494"]}, @IPVS_CMD_ATTR_SERVICE={0x2a4, 0x1, 0x0, 0x1, [@nested={0xce, 0x8d, 0x0, 0x1, [@nested={0x4, 0xde}, @typed={0xc, 0x4e, 0x0, 0x0, @u64=0x800}, @generic="2d44f369315f2f33fef807b381ec2d4034f68bdabbf611b16d9c357172445c3adc454588394d93215b1e581157e77304964f631faf38be93009b5830a17d3e3d765a6502029d985a6eacecf4ceef0e2570df8c16f2b27e9520aa8eee7cbe3d59710d187a23d765d6746ceddceb0d03490f8c45683b55bb50bf7b715f2cb8ee9146382e8e024444144dd2bf7e968841a33b2960eae965a1175eef4ce7d48ebbf36a51e91f5ee9b48b55d1d42a8e12ee1736aba38071df4f6818aa"]}, @typed={0x14, 0x145, 0x0, 0x0, @ipv6=@empty}, @generic="2c1fb0a79c0e9148a9e7cc25ac084a5429c0851a59368468f6f6f5a5b050b50c106bde6711a06879274f0b9f8a99634f2724e40ee32d8b34eb992bf29ea0fa45626a8e602e5d5f27b3e7f6acfaeed5541eeb03cb563ad36d242deefed41e681bf8f75ea3b9751678cff50badb26602138254fbd1a74824865be99c2d1726ff5466988c04996954ec5be7a0d0bcc1108fe3050611c93e77f1d32a498f19d1bf52e2c75e40137e5db13ada7509b7c313dfb60c370f0cd8da455b2c9c851b442570fb8361ba1209159202ed6ac91b0eb54bea815df544a7420138f9885f542e351a1c0ac072d145af01627997ae5c519818a286fe0e546c3de06a873311", @typed={0x8, 0x93, 0x0, 0x0, @u32=0xa3}, @typed={0x8, 0xc8, 0x0, 0x0, @ipv4=@remote}, @typed={0x8, 0x12b, 0x0, 0x0, @fd=r3}, @typed={0xa0, 0xce, 0x0, 0x0, @binary="8b0844668f85eacdff95824596f319b55483e8b53d0e6206073551a6d61ef21ca31dbcf58ed08eba8c854863f6c0e20c1906dd6d05d3b472918d2e5c86dfc6a937d8d71d98420265da4054cea8e4642f8a179333f0551fb8b981ab8cf636f99887eb53ef5351a9ef50c4d991e1ccc04f285f7060ba015d2efa2f270de77960127e0c583286619e371875056f57bf44976e46f685cc27988263e655e8"}, @typed={0x8, 0x140, 0x0, 0x0, @uid=r8}]}]}, 0x774}, 0x1, 0x0, 0x0, 0x8811}, 0x4000)
r9 = syz_genetlink_get_family_id$auto_nl80211(&(0x7f0000000080), 0xffffffffffffffff)
sendmsg$auto_NL80211_CMD_CONTROL_PORT_FRAME(r5, &(0x7f0000000140)={&(0x7f0000000040), 0xc, &(0x7f0000000100)={&(0x7f00000000c0)=ANY=[@ANYBLOB='\x00\x00\x00\x00', @ANYRES16=r9, @ANYBLOB="040027bd7000fbdbdf25810000000400ae0008007e0006000000"], 0x20}, 0x1, 0x0, 0x0, 0x20008010}, 0x20000000)
openat$auto_proc_reg_file_ops_compat_inode(0xffffffffffffff9c, &(0x7f0000000000)='/proc/thread-self/net/rpc/nfsd.export/channel\x00', 0x8f3b7a51b8162d21, 0x0)
executing program 3:
mmap$auto(0x0, 0x400008, 0xdf, 0x9b72, 0x2, 0x8000)
capset$auto(0x0, 0x0)
openat$auto_proc_reg_file_ops_compat_inode(0xffffffffffffff9c, 0x0, 0x101000, 0x0)
syz_open_procfs$namespace(0x0, &(0x7f0000000040)='ns/mnt\x00')
openat$auto_snd_rawmidi_f_ops_rawmidi(0xffffffffffffff9c, &(0x7f0000000000)='/dev/snd/midiC2D0\x00', 0x1, 0x0)
listen$auto(0x3, 0x81)
read$auto(0x3, 0x0, 0xf3c)
setresuid$auto(0x2, 0xffffffffffffffff, 0x200)
keyctl$auto(0x5, 0xfffffffd, 0x101, 0x1, 0x4000000000b8c)
sysinfo$auto(&(0x7f0000000180)={0xffffffffffffffff, [0x1, 0x3, 0x5], 0x5, 0x5, 0x6, 0x6, 0x4, 0x400, 0x6, 0x0, 0xe, 0xd, 0xd})
keyctl$auto(0xb, 0xfffffffd, 0x7, 0xfffffffffff00003, 0x6)
mmap$auto(0x0, 0x20009, 0x4000000000df, 0xeb1, 0x401, 0x8000)
socket(0x10, 0x2, 0x0)
sendmsg$auto_NL80211_CMD_GET_REG(0xffffffffffffffff, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000200)={0x0, 0x1ac}, 0x1, 0x0, 0x0, 0x4004810}, 0x8800)
sendmsg$auto_HWSIM_CMD_NEW_RADIO(0xffffffffffffffff, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000000000)={0x28, 0x0, 0x1, 0x70bd26, 0x25dfdbff, {}, [@HWSIM_ATTR_PMSR_SUPPORT={0x14, 0x1a, 0x0, 0x1, [@NL80211_PMSR_ATTR_TYPE_CAPA={0x10, 0x4, 0x0, 0x1, [@NL80211_PMSR_TYPE_FTM={0xc, 0x1, 0x0, 0x1, [@NL80211_PMSR_FTM_CAPA_ATTR_MAX_FTMS_PER_BURST={0x5, 0x8, 0x5}]}]}]}]}, 0x28}, 0x1, 0x0, 0x0, 0x894}, 0x4)
mbind$auto(0x2, 0x1, 0x80000001, &(0x7f0000000240)=0x1a, 0x100000000, 0xad4)
futex_waitv$auto(&(0x7f0000000000)={0xf, 0x5d94, 0x4002, 0x4}, 0x77, 0xfffffffc, 0x0, 0x62bd)
sendmmsg$auto(0x3, &(0x7f0000000080)={{0x0, 0x2, &(0x7f00000002c0)={0x0, 0xc4}, 0x1, 0x0, 0x0, 0x9}, 0x7}, 0x3, 0x0)
mmap$auto(0x0, 0x400008, 0xdf, 0x9b72, 0x2, 0x8000)
openat$auto_v4l2_fops_v4l2_dev(0xffffffffffffff9c, &(0x7f0000000280)='/dev/video42\x00', 0x12181, 0x0)
r0 = socket(0x10, 0x2, 0x6)
r1 = socket$nl_generic(0x10, 0x3, 0x10)
r2 = syz_genetlink_get_family_id$auto_wireguard(&(0x7f0000000080), r1)
ioctl$sock_SIOCGIFINDEX(r1, 0x8933, &(0x7f0000000040)={'wg1\x00', <r3=>0x0})
sendmsg$auto_WG_CMD_GET_DEVICE(r1, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000180)={&(0x7f00000000c0)={0x1c, r2, 0x703, 0x70bd27, 0x25dfd9fc, {}, [@WGDEVICE_A_IFINDEX={0x8, 0x1, r3}]}, 0x1c}, 0x1, 0x0, 0x0, 0x880}, 0x4)
r4 = syz_genetlink_get_family_id$auto_nl802154(&(0x7f0000000040), 0xffffffffffffffff)
sendmsg$auto_NL802154_CMD_SET_MAX_CSMA_BACKOFFS(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000380)={0x14, r4, 0x1, 0x70bd28, 0x25dfdbfd, {0x11, 0x0, 0xfc}}, 0x14}, 0x1, 0x0, 0x0, 0x20008000}, 0x8044)
executing program 3:
mmap$auto(0x0, 0x4020009, 0xdf, 0xeb1, 0x404, 0x8000)
r0 = openat$auto_tty_fops_tty_io(0xffffffffffffff9c, &(0x7f0000000000)='/dev/ptyxe\x00', 0x48140, 0x0)
ioctl$auto_TIOCVHANGUP2(r0, 0x5437, 0x0)
r1 = io_uring_setup$auto(0x85, 0x0)
bind$auto(r1, &(0x7f0000000040)=@ethernet={0x6, @broadcast}, 0x6a)
ioctl$auto_FITRIM(r1, 0xc0185879, &(0x7f0000000040)={0x1, 0x400, 0x1d800000000000})
read$auto(0x3, 0x0, 0x80)
r2 = openat$auto_drm_crtc_crc_data_fops_drm_debugfs_crc(0xffffffffffffff9c, &(0x7f00000000c0), 0x0, 0x0)
read$auto_drm_crtc_crc_data_fops_drm_debugfs_crc(r2, 0x0, 0x17)
mmap$auto(0x0, 0x2020009, 0x3, 0xeb1, 0xfffffffffffffffa, 0x8000)
statmount$auto(0x0, &(0x7f0000000180)={0xa, 0x7, 0x1977, 0x7, 0x5, 0x7181, 0x8002, 0x7, 0x3, 0x9, 0x5, 0x80003, 0x4, 0x200000000000, 0xb4, 0x9, 0x8, 0x10006, 0x4000080, 0x0, 0x0, 0xe, 0x22000, 0x200, 0x0, 0xd363, [0x4000000003, 0x2, 0x0, 0x2, 0xcb, 0x2000, 0x0, 0xe, 0x70624ce7, 0x0, 0xfffffffffffffffc, 0xffffffffffffffff, 0x8, 0x0, 0x8, 0x0, 0xfffffffffffbfffd, 0x2000000000000004, 0x10000000000001, 0x10000000000, 0xffffffffffffffff, 0x8005, 0xfffffffffffffe00, 0x3, 0x0, 0x5, 0x400000000005b8, 0x5, 0x0, 0x100, 0x0, 0x6, 0x100002, 0x88e, 0x40, 0xfffffffffffffffc, 0x8, 0xffff, 0x0, 0x3, 0xfffffffffffffffc, 0x9, 0x8, 0x7, 0xc567]}, 0x1fe, 0xd)
r3 = openat$auto__ctl_fops_dm_ioctl(0xffffffffffffff9c, &(0x7f0000000180), 0x1541, 0x0)
r4 = socket(0x10, 0x2, 0x0)
sendmsg$auto_ETHTOOL_MSG_DEBUG_SET(0xffffffffffffffff, &(0x7f0000000180)={0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x2000000}, 0x4)
sendmsg$auto_NL80211_CMD_GET_REG(r4, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000300)=ANY=[@ANYBLOB=' \x00\x00\x00', @ANYBLOB="1200", @ANYBLOB="5de1"], 0x1ac}}, 0x40000)
recvmmsg$auto(r4, &(0x7f0000000140)={{0x0, 0x2, 0x0, 0x4, 0x0, 0x5, 0x8}, 0x5}, 0xfffffff9, 0x10, 0x0)
ioctl$auto__ctl_fops_dm_ioctl(r3, 0xfffffffffffffd09, &(0x7f00000001c0))
close_range$auto(0x2, 0x8, 0x0)
r5 = openat$auto_kvm_chardev_ops_kvm_main(0xffffffffffffff9c, &(0x7f00000011c0), 0x8c00, 0x0)
ioctl$auto_KVM_CREATE_VM(r5, 0xae01, 0x0)
ioctl$auto(0x3, 0x4010ae42, 0x38)
executing program 3:
r0 = openat$auto_kernfs_file_fops_kernfs_internal(0xffffffffffffff9c, &(0x7f0000000080)='/sys/devices/virtual/block/nbd1/queue/zone_append_max_bytes\x00', 0x0, 0x0)
read$auto_kernfs_file_fops_kernfs_internal(r0, &(0x7f0000001180)=""/187, 0xbb) (fail_nth: 2)
executing program 3:
r0 = socket(0x10, 0x2, 0x0)
sendmsg$auto_NL80211_CMD_GET_REG(r0, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000300)=ANY=[@ANYBLOB="72010000", @ANYBLOB="120027", @ANYBLOB="5de1523353782950330a"], 0x1ac}}, 0x40000)
read$auto(r0, &(0x7f0000000000)='$-]&@\x00', 0x5)
sendmsg$auto_NL80211_CMD_COLOR_CHANGE_REQUEST(0xffffffffffffffff, 0x0, 0x24004000)
executing program 3:
r0 = socket(0x10, 0x2, 0x0)
sendmsg$auto_NL80211_CMD_GET_REG(r0, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000300)=ANY=[@ANYBLOB="72010000", @ANYBLOB="120027", @ANYBLOB="5de1523353782950330a"], 0x1ac}}, 0x40000)
read$auto(r0, &(0x7f0000000000)='$-]&@\x00', 0x5) (fail_nth: 3)
sendmsg$auto_NL80211_CMD_COLOR_CHANGE_REQUEST(0xffffffffffffffff, 0x0, 0x24004000)
executing program 3:
socket(0xa, 0x1, 0x84)
mmap$auto(0x0, 0x20009, 0x4000000000df, 0xeb1, 0x401, 0x8000)
move_pages$auto(0x1, 0x2000000000003, 0x0, 0x0, 0x0, 0x8000400000000000)
bpf$auto(0x0, &(0x7f00000001c0)=@task_fd_query={0x0, 0x4, 0x3, 0x2, 0x8, 0xc, 0xe3, 0x400000000a, 0x3}, 0x6f4)
mmap$auto(0x0, 0x2020009, 0x3, 0xeb1, 0xfffffffffffffffa, 0x8000)
init_module$auto(0x0, 0xffff9, 0x0)
prctl$auto(0xeca0, 0x13, 0x4, 0x5, 0x7)
madvise$auto(0x0, 0xffffffffffff0005, 0x19)
madvise$auto(0x0, 0x8000000000000000, 0x15)
lseek$auto(0x3, 0x7fffffffffffffff, 0x0)
madvise$auto(0x0, 0x2000000080000001, 0x3)
socket(0x2, 0x1, 0x106)
socket(0x2b, 0x1, 0x1)
mmap$auto(0x0, 0x4020009, 0xdf, 0xeb1, 0x404, 0x8000)
getsockopt$auto(0x4, 0x6, 0x15, 0xfffffffffffffffc, 0x0)
mmap$auto(0x0, 0x2020009, 0x3, 0xeb1, 0xfffffffffffffffa, 0x8000)
capget$auto(0x0, 0xfffffffffffffffe)
capset$auto(0x0, &(0x7f0000000000)={0x2, 0x10000002, 0x6})
mmap$auto(0x0, 0x20009, 0xdf, 0xeb1, 0x401, 0x8000)
prctl$auto(0x1000000003b, 0x1, 0x4, 0x5, 0x7)
mmap$auto(0x0, 0x400005, 0xdf, 0x9b72, 0x2, 0x8000)
mmap$auto(0x0, 0x4, 0x4000000000df, 0x40eb2, 0x402, 0x300000000000)
move_mount$auto(0xffffffffffffffff, 0x0, 0xffffffffffffffff, 0x0, 0x91e4)
mmap$auto(0x0, 0x2020009, 0x3, 0xeb1, 0xfffffffffffffffa, 0x8000)
r0 = socket(0x10, 0x2, 0x0)
statmount$auto(0x0, &(0x7f0000000180)={0x408, 0x7, 0x1, 0x7, 0x44, 0x4909b6f8, 0x201ffdf, 0x7, 0x200003, 0x2, 0xa121, 0x3, 0x6, 0x4, 0xb4, 0xa, 0x6, 0x10001, 0x80, 0x100000000, 0x0, 0x7, 0x2100, 0x200, 0x0, 0x84, [0x2, 0x0, 0x0, 0x50100000000000, 0x6, 0x2000, 0x0, 0x6, 0x70624ce7, 0x0, 0xfffffffffffffffd, 0xfffffffffffffffd, 0x0, 0x0, 0x5, 0xffffffffffff7ffe, 0xffffffffffffbfff, 0xfffffffffffffffd, 0x1, 0x0, 0xffffffffffffffff, 0x4, 0xfffffffffffffffe, 0x2000000000000000, 0x0, 0x0, 0x400000000005b8, 0xc, 0x0, 0x0, 0x40000, 0x6, 0x0, 0x88e, 0x8000000000008, 0xfffffffffffffffc, 0x9, 0xa38, 0x0, 0x3, 0xfffffffffffffffa, 0x8, 0x4000000000, 0x7]}, 0x1fe, 0xd)
sendmsg$auto_OVS_VPORT_CMD_DEL(0xffffffffffffffff, &(0x7f0000000200)={0x0, 0x0, &(0x7f00000001c0)={&(0x7f0000000180)=ANY=[@ANYBLOB='<\x00\x00\x00', @ANYBLOB="10002d"], 0x3c}, 0x1, 0x0, 0x0, 0x8000}, 0x8000)
sendmsg$auto_NL80211_CMD_GET_REG(0xffffffffffffffff, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000280)={&(0x7f0000000180)=ANY=[], 0x1ac}}, 0x40000)
sendmmsg$auto(r0, &(0x7f0000000200)={{0x0, 0x0, &(0x7f0000000000)={0x0, 0xfc2}, 0x2, 0x0, 0x7, 0xa505}, 0x800}, 0x7, 0x4008)
socket(0xf, 0x2, 0xfffffff8)
executing program 33:
socket(0xa, 0x1, 0x84)
mmap$auto(0x0, 0x20009, 0x4000000000df, 0xeb1, 0x401, 0x8000)
move_pages$auto(0x1, 0x2000000000003, 0x0, 0x0, 0x0, 0x8000400000000000)
bpf$auto(0x0, &(0x7f00000001c0)=@task_fd_query={0x0, 0x4, 0x3, 0x2, 0x8, 0xc, 0xe3, 0x400000000a, 0x3}, 0x6f4)
mmap$auto(0x0, 0x2020009, 0x3, 0xeb1, 0xfffffffffffffffa, 0x8000)
init_module$auto(0x0, 0xffff9, 0x0)
prctl$auto(0xeca0, 0x13, 0x4, 0x5, 0x7)
madvise$auto(0x0, 0xffffffffffff0005, 0x19)
madvise$auto(0x0, 0x8000000000000000, 0x15)
lseek$auto(0x3, 0x7fffffffffffffff, 0x0)
madvise$auto(0x0, 0x2000000080000001, 0x3)
socket(0x2, 0x1, 0x106)
socket(0x2b, 0x1, 0x1)
mmap$auto(0x0, 0x4020009, 0xdf, 0xeb1, 0x404, 0x8000)
getsockopt$auto(0x4, 0x6, 0x15, 0xfffffffffffffffc, 0x0)
mmap$auto(0x0, 0x2020009, 0x3, 0xeb1, 0xfffffffffffffffa, 0x8000)
capget$auto(0x0, 0xfffffffffffffffe)
capset$auto(0x0, &(0x7f0000000000)={0x2, 0x10000002, 0x6})
mmap$auto(0x0, 0x20009, 0xdf, 0xeb1, 0x401, 0x8000)
prctl$auto(0x1000000003b, 0x1, 0x4, 0x5, 0x7)
mmap$auto(0x0, 0x400005, 0xdf, 0x9b72, 0x2, 0x8000)
mmap$auto(0x0, 0x4, 0x4000000000df, 0x40eb2, 0x402, 0x300000000000)
move_mount$auto(0xffffffffffffffff, 0x0, 0xffffffffffffffff, 0x0, 0x91e4)
mmap$auto(0x0, 0x2020009, 0x3, 0xeb1, 0xfffffffffffffffa, 0x8000)
r0 = socket(0x10, 0x2, 0x0)
statmount$auto(0x0, &(0x7f0000000180)={0x408, 0x7, 0x1, 0x7, 0x44, 0x4909b6f8, 0x201ffdf, 0x7, 0x200003, 0x2, 0xa121, 0x3, 0x6, 0x4, 0xb4, 0xa, 0x6, 0x10001, 0x80, 0x100000000, 0x0, 0x7, 0x2100, 0x200, 0x0, 0x84, [0x2, 0x0, 0x0, 0x50100000000000, 0x6, 0x2000, 0x0, 0x6, 0x70624ce7, 0x0, 0xfffffffffffffffd, 0xfffffffffffffffd, 0x0, 0x0, 0x5, 0xffffffffffff7ffe, 0xffffffffffffbfff, 0xfffffffffffffffd, 0x1, 0x0, 0xffffffffffffffff, 0x4, 0xfffffffffffffffe, 0x2000000000000000, 0x0, 0x0, 0x400000000005b8, 0xc, 0x0, 0x0, 0x40000, 0x6, 0x0, 0x88e, 0x8000000000008, 0xfffffffffffffffc, 0x9, 0xa38, 0x0, 0x3, 0xfffffffffffffffa, 0x8, 0x4000000000, 0x7]}, 0x1fe, 0xd)
sendmsg$auto_OVS_VPORT_CMD_DEL(0xffffffffffffffff, &(0x7f0000000200)={0x0, 0x0, &(0x7f00000001c0)={&(0x7f0000000180)=ANY=[@ANYBLOB='<\x00\x00\x00', @ANYBLOB="10002d"], 0x3c}, 0x1, 0x0, 0x0, 0x8000}, 0x8000)
sendmsg$auto_NL80211_CMD_GET_REG(0xffffffffffffffff, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000280)={&(0x7f0000000180)=ANY=[], 0x1ac}}, 0x40000)
sendmmsg$auto(r0, &(0x7f0000000200)={{0x0, 0x0, &(0x7f0000000000)={0x0, 0xfc2}, 0x2, 0x0, 0x7, 0xa505}, 0x800}, 0x7, 0x4008)
socket(0xf, 0x2, 0xfffffff8)
executing program 2:
socket$nl_generic(0x10, 0x3, 0x10)
mmap$auto(0x0, 0x2020009, 0x3, 0xeb1, 0xfffffffffffffffa, 0x8000)
prctl$auto(0x1000000003b, 0x1, 0x4, 0x5, 0x7)
openat$auto(0xffffffffffffffff, 0x0, 0x8, 0x8001)
write$auto(0x1, 0x0, 0x80000000)
openat$auto_dvb_demux_fops_dmxdev(0xffffffffffffff9c, 0x0, 0x200, 0x0)
openat$auto_ppp_device_fops_ppp_generic(0xffffffffffffff9c, 0x0, 0x80080, 0x0)
setresgid$auto(0xffffffffffffffff, 0x28000000000000, 0x7)
r0 = syz_clone(0x11, 0x0, 0x0, 0x0, 0x0, 0x0)
r1 = getpgid(0x0)
kcmp$auto(r1, r0, 0x1, 0xffffffffffffffff, 0xffffffffffffffff)
r2 = openat$auto_tty_fops_tty_io(0xffffffffffffff9c, &(0x7f0000000100)='/dev/tty48\x00', 0x800, 0x0)
ioctl$auto(r2, 0x4b65, r2)
ioctl$sock_SIOCGIFINDEX(0xffffffffffffffff, 0x8933, 0x0)
mmap$auto(0x0, 0x2020009, 0x3, 0xeb1, r2, 0x8000)
sendmsg$auto_NETDEV_CMD_QUEUE_GET(0xffffffffffffffff, 0x0, 0x4000)
close_range$auto(0x2, 0x8, 0x0)
mmap$auto(0x0, 0x2020009, 0x3, 0xeb1, 0xfffffffffffffffa, 0x8000)
sendmsg$auto_NL80211_CMD_GET_REG(0xffffffffffffffff, &(0x7f00000000c0)={0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x4004810}, 0x800)
sendmmsg$auto(0x3, &(0x7f0000000080)={{0x0, 0x2, 0x0, 0x1, 0x0, 0x0, 0x9}, 0x7}, 0x3, 0x0)
r3 = openat$auto_kvm_chardev_ops_kvm_main(0xffffffffffffff9c, &(0x7f000000fc00), 0x3, 0x0)
mmap$auto(0x0, 0x400008, 0xdf, 0x9b72, 0x2, 0x8000)
r4 = socket(0x2, 0x1, 0x0)
bind$auto(0x3, &(0x7f0000000040)=@in={0x2, 0xffff, @remote}, 0x6a)
sendmmsg$auto(r4, &(0x7f0000000140)={{&(0x7f0000000040), 0x12, 0x0, 0x4, 0x0, 0x7fff, 0x4}, 0x80000b}, 0x5, 0x20000000)
write$auto(0x3, 0x0, 0x7fffffff)
recvfrom$auto(0x3, 0x0, 0x8000000017, 0x10e, 0x0, 0xfffffffffffffffd)
shutdown$auto(0x200000003, 0x2)
ioctl$auto_KVM_CREATE_VM(r3, 0xae01, 0x1)
mmap$auto(0x0, 0x400008, 0xdf, 0x9b72, 0x2, 0x18000)
executing program 2:
r0 = openat$auto_kernfs_file_fops_kernfs_internal(0xffffffffffffff9c, &(0x7f00000002c0)='/sys/devices/virtual/block/ram3/queue/iostats_passthrough\x00', 0x80302, 0x0)
r1 = socket$nl_generic(0x10, 0x3, 0x10)
r2 = socket$nl_generic(0x10, 0x3, 0x10)
r3 = syz_genetlink_get_family_id$auto_l2tp(&(0x7f0000000640), 0xffffffffffffffff)
sendmsg$auto_L2TP_CMD_TUNNEL_CREATE(r2, &(0x7f0000001040)={0x0, 0x0, &(0x7f0000000280)={&(0x7f0000000000)={0x5c, r3, 0x1, 0x70bd2d, 0x25dfdbfd, {0x1, 0x0, 0x3f00}, [@L2TP_ATTR_OFFSET={0x6, 0x3, 0x7}, @L2TP_ATTR_PROTO_VERSION={0x5, 0x7, 0x58}, @L2TP_ATTR_CONN_ID={0x8, 0x9, 0x8}, @L2TP_ATTR_PEER_CONN_ID={0x8, 0xa, 0x8}, @L2TP_ATTR_IP6_SADDR={0x14}, @L2TP_ATTR_IP6_DADDR={0x14, 0x20, @ipv4={'\x00', '\xff\xff', @local}}]}, 0x5c}, 0x1, 0x0, 0x0, 0x4c019}, 0x0)
r4 = getpid()
process_vm_readv$auto(r4, &(0x7f0000000080)={0x0, 0xfff}, 0x1, &(0x7f0000000280)={0x0, 0xffffffff}, 0x6, 0x0)
r5 = openat$auto_nvmf_dev_fops_fabrics(0xffffffffffffff9c, &(0x7f00000004c0), 0x101202, 0x0)
write$auto_nvmf_dev_fops_fabrics(r5, 0x0, 0x0)
write$auto_nvmf_dev_fops_fabrics(r5, 0x0, 0x0)
prctl$auto_PR_SET_MM_START_STACK(0x95, 0x5, 0x0, 0x0, 0x6)
stat$auto(&(0x7f00000000c0)='./file0\x00', &(0x7f0000000100)={0x9a, 0x100, 0x8, 0xb, <r6=>0xee00, 0x0, 0x0, 0x2, 0x3, 0x5, 0x3, 0x7, 0x5, 0x3, 0x0, 0x4, 0x6})
sendmsg$auto_TIPC_NL_KEY_SET(r1, &(0x7f0000000380)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x2000000}, 0xc, &(0x7f0000000340)={&(0x7f0000001080)={0x1810, 0x0, 0x800, 0x70bd28, 0x25dfdbfc, {}, [@TIPC_NLA_PUBL={0x1780, 0x3, 0x0, 0x1, [@typed={0x4, 0xa0}, @typed={0x8, 0x13e, 0x0, 0x0, @fd=r2}, @typed={0x8, 0x51, 0x0, 0x0, @pid=r4}, @nested={0x1ae, 0x134, 0x0, 0x1, [@generic="3f74007cf8216c93f7f106e28c20943f34e65ec832411016497e483652e7550fe0101174f511f2ed4c9f171e443ecf965a3393ce09132ebbe53e6507a8b14ec350bff171c838d43899f7d5d8fef51c2ab2d10a1b3845d9fa42a03ce6c6fefa2022d1879ab3a78248fed9e8dea2691a521a57e1e2aa1812c7b13b56b781ed7dadf92ed58728dfc3d9a8f70d2a65117d1d9b0346dfb5680f89128236a8f783953c6e64dbc879b166554bbec4343328e89bf966", @nested={0x4, 0xb2}, @nested={0x4, 0xe3}, @nested={0x4, 0x6f}, @nested={0xe4, 0x72, 0x0, 0x1, [@typed={0xdf, 0x5c, 0x0, 0x0, @binary="8639085f4dab6f652f0c8731f21b5f4ff470001bc7872f6a894ffd577d0c5128b65d6fb4b18be68f28113a0d9d7ef8781a8a996ad4d0f5bd89e31fe08798fc115855735af81c8790d23457d0d28915f4f13dba152d344d0ad27f602309a122a3ac1328226702917fee850b82a3a77b6c40f16c0c60b06f9b1da972938e3c909972fbba8a4db784634003a79b6b71cf0221443639ddf3b695c2d8d60693564eeab5454db2920546961073d1c329ccad9b99e19a6fdd105eb5d1b953b0924441d890ce9fcb2aa90211cf34e16864c975e821c44743d6c340aa392443"}]}, @typed={0x8, 0x68, 0x0, 0x0, @ipv4=@dev={0xac, 0x14, 0x14, 0x1d}}]}, @nested={0x15b7, 0x1, 0x0, 0x1, [@nested={0xea, 0x7f, 0x0, 0x1, [@generic="30f498d8ba7ccbb263ea2b1c70913a51bd4f945e562bbb203751f199f9311aa60fb5a2dab43c8f8b86483a132046a0da12eea866c552a027f855466c8f444b60d2d9d6665f6c2e6be94c87d88c31960151cb3b90e53b69ba5de75df1617bafeba6e850f7e2ede1fcc7c8dec6490f2e04ad7dadcd89ce6c67bd48a8e8242f7a9977878fa7444f9fe6555117a073c921160e4b3292d44e921bf94eb5cc7d0f51b8930bc53f2d3e6ac53aa3be3297f45e62f9f189b8c2b7dfd57005fb0c27576074c77fdd149ead1bfdfb4329b040cf16e285104a0c22e41008f7c224d3e12b", @typed={0x8, 0x62, 0x0, 0x0, @pid=r4}]}, @typed={0x9, 0x83, 0x0, 0x0, @str='\xf9})\xb5\x00'}, @typed={0x8, 0x136, 0x0, 0x0, @uid=r6}, @typed={0x8, 0x23, 0x0, 0x0, @fd=r2}, @nested={0xe2, 0xd, 0x0, 0x1, [@generic="45b415df6e1efa332ab11a6e453257f273132fa34bc8b77a0d6b0c7ace8513803f5a1cb1156876b226d39869c85fe3b170e9ad58466bde972b84191d99a5ab41cb05f0b588fc5619873d504c0835c7c9c23374340000030ad94793888c151a6b8cfe4dbeb7544d8d4ddc", @generic="5b1f3f84a94bbf3a01986e1334d365b98ddd4f9a80da80394ef62301da97aa0a0baed54b5dd24d9909ad25f3946e3012f8f6dde3c65f28d9c7955654a055980d47ef68a9c5755f56266527580e9500eae0f1c663f765769e83b92b32801eadfa2fc352f435f07e28874d9ca11884149f79583385"]}, @nested={0x1d4, 0x4b, 0x0, 0x1, [@generic="37e71a544d1fd1f6d3863c9044a067eedad18784b7347ca7d4a3ac6757b28a6ff331c3acf8ec679be8f9c2566a61d28bea9bbf4b9018566163bd231a424e35964da54e43e9b608ce1f224e35466f356904f4729773aa495d6628d74f309a09a4c4f7796e4ab435eef7424b582f8c273d8ab251499ead1f07d58abd38cce5314d120f98cbd9395e95449eecea5687e9a6197490813990534a179967bc6b689ef46551290c6efe80b25b3d44c7bb45a46276ec1edc9303f64c04935674aeff1f28b2eec759db3104917c24f49bff6678aeca5e0319332a01385a", @generic="8375f0b5247ed3d6921813a6a10f081d686680d361d51386e07c5f5a09d25806f67eee9e15ddb3ea11cb16a2df220bb34d166d70a42fb754c086f71405246cfb3d008917c29ea104205e2e521bbab2291970d68c45b5f3bea7720c966a1ce4d63f8f6ca0860b652b5497613e2eabee57cf1b335176110e32ab252ca7adbe0573ed48a31ea091cab9321eb6242a07357aaa9adfbeb9a36598697edfe70966877db021003a6d2efe1a0019bb8b144f59424c4d248b69c32400418c5f312dad674ccd07f7d35371bafc60d1bbd86334320c67ad33a4e51bd925628786", @nested={0x4, 0x1d}, @nested={0x4, 0x105}, @nested={0x4, 0x20}, @typed={0xc, 0xde, 0x0, 0x0, @u64=0xf202}, @nested={0x4, 0x1d}]}, @generic="3db2dea5ae6f1c330670f4c839e550fdd362b4fd3eb77a7f6720b6f8773053a3b5bf33e60485ddb9e8de06a9050e4dec0463807c383d24be4c90ae70c9b5e2ec6b640b7cc3de7b0b4313241a7ebc5e2f7314494657918f058c09927283cbacbb19f46b3890665b527c1c002ee94f491454377ef0281582edafc68ac8d76f8c2d340ad2f07d505d84d019c7e0cbbdf1df82adead52c7a8e33567a1e48376a9c9081e37131b8070db74a5a7f547be2adbc0271fcc7c6082ea6a92e22003b8362a77151f89b5f8924da98767d004dff7507b6c2928b28f48acc00a5b2c89dc4ec51c0679d2d0f3c7f5405fdc37f467df0d7a4e503958a0bd29405ec55cf737c94a258c775c3b8b126204d68752c8214d55970a029cac48b021f2a5374871fae934f1cfc15a3c49792ac84f89cdbed122fb91b648a91ea1eb807ba20397556e191c2ddb987ff500fcf3dd2f232bd79e61d486d3fc5e19049bff76a9e1df67285b2dc1e112a27fa42a35a1b2ee8b57d3618c3298a999aefe527e24a9122249be58c499e6cfa1d912c36e01c02e1457b0088fd03c04f87e33bf7cf906683e4c4a2fc804b2233f63b58ce259494a9ca378f39b7c4d25a8340ebb233e4f2083e59efd0f65f21128d917f3b4d5cce592a35b52dfd86300b9c01f7f2a2b97f7fe487cbb09707f130c08942f4a4878bb90122df1139754bd161510f7d0cb4372b70e6934bf8cf77397450866ba350dd50890280e442d5fcad909dde13aea60b6a1d72fca35a624977d5b6e36ba0fc683301a78b3caedb3a728649e03efa2b64522f753dcd6fa43d5e142aeed05a45f02cf89e909b65d24f492cb872db8457c0307fd78db25afb4be57450ac7dc5675e6657dbc382853fd20f68de75c20a7bd22760e5d1dace835c719d1fcc9e0fc1503b2832e8d291ad1fe8325ab6eb8271ca73aafa5decf4620f3d13655e463be3b58102a023d26f9595698b88ca5d5a2e27072c95e44a52ac2f0aeaea9c3e2f50e420f28da204242ede123aa3136ceb13e7963099c2e36208592088ec5f7bc3bc81604ba179ab3244f2c75c3a17764b1ea6d4f16cbf6f921de77d89685fc7c767348ba753944f4e6acb3fff7d7e2c14d272dd8b0d65275693ce970c19c1b9ab25240bb81de7035a1cf5d49fc941af6c46ae31d0c693ddfc15796781c2c93544f8eee398ac65157155a8d3e820fc83d5469ac0a0753332f32d471202dedf9329ecccecb293ace723fb2516a90053cca718dce686056f139e825476d4007021460217ad1472158bf6320eee5bbcd8d45930fac59209c4abb04a341e394129f3bd75a488ed9118a65a3328f1cd5c2556b1da01abf48752fff081bfbc63cd2b25788917dc8563aea774dd46c9facf127e88c07209bbd71aeba29028fba467daf489eef52c123021c0e62357e103c4e42e0c29406525ed9efaf75478e802b4093d0ae0c7700b81a5773365776bbd751a93abb97072e497238aaf6f7c59d17fb9cb89e32b9d13413b62ae869f6a98030c63722ba4089384cd7f0b4b4cb65de2bee537f700b053afd7cd5248e6dab99140d6ea7b235fca2cf75ee4e98e1d236f8ca0d4b29624c220597508efdad7afe0f18d3a3457ea5eaf36064a6d72facd8c6bf4c8104bdd8d11421defd8f5dbbfb43f6b4dab5546225240852f339122184a8c331a495cf36423a52a7dff9461d7ac1dae4a7da523607b4473a2a5189c4179daeabe10405887b70ad83fc390289ad89035a04ab077c2563d7d2bd14ee4e9c76e213fd8fc9a3ca4aaab98c2795b565a525c665361a0276f1d1622f6606b46620b1f12c1ab420548c00d8f8cbe0370cd11646b31e7f406efcbf823636f625659b44ae390da6200869c48b88d82b7fce5eca4df70795c36d6249d6a07a62757f77fcf20f48bf0aa0d2fffc3fd12a9f175580a04ddccf21c131f6aeb3ac670431859073d1e06cbb25e7b45c8b0288e9aa29ba172469022322748af09d787e7f1709a9db35e40100746b390233f4112c40e3cd83a77411ca321ef3e336840779e89ea83633b8feef38867b1dad8077a4315cd617ab409fd6898569857c512963fb63f469b176a57b70c62686ec7bbc29c954682029bf6c75df7caa85a943965290bfad738b7f8c5ead8e133af39bfa9a0c29bc751399e8ea401505af6cde1b39c7f4e0fd10adc4f31401578494ae72dc86bb9bcf9136d9fca5847b08f4f4821d19bf28aed830e6c57b59740d6692d693268d83c0b559a963a1a723ed9e189261fd6d97592d49d8b8d58960bc0c2e8aaeb3b268cf96059b0dd480726543be6155dfab263eacc4ed773c28a53cf62a584e55eac04c1ad91ea62d6e92ab5450af90d546d25849ee4a4636d89f735a8411febfdd40cc85767d494d4c5bedc70f59ff482f473cf3b2795cc7bee41871943f908de5fd4fe879a5a1aeae64c9b69f52be9cfb5a11411d9cc1dc20e5e88329cc17731447a7bf201c807ee13acd5e1c1884f08890e924e7883d89f15b9814f6ff919697647828dfe1a172b5d1167415cd8f32cf6b511ae2c03b1492bcd5a8a2fb85fba2e998d772e3cca76b4b81d62e628a7a25678cc3a6cf556d43087732077e3fa61d193d49efbd1c29432c211244e1731a08a171507f0d63ae4c60b01533cdf81713340c9f474c4fbaa6eb801212d2f0cf65b394da4a25ff89d5696b3123f56e26f5f1e95d2c055c73fbbaeb63fc5fcde99a88f959b109170fe1fa2b837fc07dff9f94c95fefa1a7a870bf4fedbd099176accf500534711e1c4d389bcef19e7144d8cf9519b2d44a8ebe5da7c4e89861261e69df204524db99530affcc3f890cd857028e8a5330cf3667118360f198d3211cef7d9bb02090eba7f36ec16f385978be0c486d46a1ca5c8de4822c2c70d8203edd983127bf1a37edc38e96ebb9fedc18e706a1bab959c07e282926c206f6e9f00c9b1f7cee5492cde227fd92483beed255913c301c9ed217c8b1bac85a1eef438094bcc64e6a9a4c7e2fbd0cdeed9cc68dc50b49694d78a3fbcd9e206d95fd081054ba543a6041122b702e84ef59bc6b3554dbb436cb7404ee5e6fb3410f2d5f94da1a43e170a5e7f9118e3a9f764b6d6b3e52f314aace23df883415e1bdeb96e8b21328987731192ccb7e785bcd43df7c6555a03255ae8eb28c5a20477e2c6b077c5a073a107333fb43c22d36fe4bf66a84b83efb424a2bfe5f406bd05e43baaf4c6cc4a96797d5da7c0782f048b071e974f419097ddd4785ba6e2b5e7088cfeb0ffad6a36989409666265bbcfece2d8eb601e6c95dc8aca77a2df99a46ea363a38144e7c957aa666bb42f2e97a0b3197cbbb3c0d5d35cd9b4044162738c47fcb8a78c46da6802dafedb8ba69f0a653bbb9649e77b1107b62e2357a8c11bcf82798b7db847de03589946089a66938d690f7c7ae20d1cb9c9401ae911f698f13e8090b9b09a40e7c7c1065ede2e72c369cdeb9d7501ab3d2190b566fada98efcdebbad6066c2f72ee3e4cc021e08d11f9378095f78532e1c994ede51792b32f76456af8b9fcc3b07f9e3a04f9e7e641e5454985f53ae0c2e1f5f3021eb1098c4ffb435c155fb34345771df10d9cffdd8840f2c1e7c41e85725c839111466f57fc1fea9753715cb05d354ac0c9ca3595854f4c2df213227d6e86b4ececce31d380caf0b36b252a0c39c73b9a6f6729dfcc4b49b450da30c9c29d7bcebc60a86faaf337bebccf8f5392c6cbf7c7fafe6c0b828c12a9eca2474bfdc0a29829a3f73fbfcd123a8afaee3f9f9ddff79683aa40ed943712544fc186eb066778090594571b074b5f2b3afbdb491a3f6dcfe4bd4b524391829dbbbd73e36e8bffcd22aaccb49a4f831fa6731f1d618354d4a700cc1ea0506bddf76f2fc720539981b00f1744ddc33bfc965599cc7c3cdbb2596684c300ae65703c1196659a6e15ebbde08e87ea889c00996054f9d99df98367df40342b75a7c142f13cc9b97c0dec556e69a9737c485ad6b0522944094de584661e5279eebdad5a48d822d74f37ab91e50d4aefbfcef9466132aba8875bd18d987bcc4edf6790c8eaf22dcef8a053a3d4d39218934bca578d708315aad24868c706fa34c85699a308ae39a881dfcf86fd1d0b30f6494180acadad637c72850c7be3a0dd3aa71614c566e17f3783653ae64dc1317b0069feb62c3b1a34ff18bc1f1013cec721338714afdf8a7db2f917e075f2de8a6ceba096bc4e6e142b0a335e6663fd82cb95265ca24375094570a4297a579b589849e14f0875cfbbb92c0f191e93bebfd158b56096b3b68e3273a497e7147cb148a65804d39cc3799d87ae26ad7a245f8a483dbaf10a5fd477927235cbfa0b31e1d633302f8989da5c9afd4ea6e93f6a017b3b9f45400f5b9c0115fbac884a33ea815ddae71327d0371eed762b56d0e5faafbc275726adc639645edc94bf28633f1bd30d62101edc959f312c14c65300586950c9eaf31426f1419f64e6f1918739b34a013df9fa724b14650c4c693823096bbfef32619a4f4aa4588c45d453485fd2234e8ca17bee9fad440631977682563033c153a709d794a788661348d28b97b1861adb7ad75177b1662363020587760f32ec937cf1073dce02721d3375370cc68366fc40226ca0c81ae4160e8eaeade80b673b0edd48c4bfc0663526df1eeb0c5391a9b1f2235e1731efe92aa6ff4f0363cce74128c347c0327bda48caa87f31bc5dd7528db4a81e923f546b4b760fd94562f750dc225b0caa149383ad7b6798d1d56cc17cea0ef5689abead36afa42792f44081823cbcf4fe7bfd15df6de5930f102130c3a749a1439e11bf34d024820c10d71b8c2cc8eb0e9ad587439c5a2e1aa2f32efd620c75a8bdb65fdf4f3494fb23241548321edcfa72573c29071d50cdf19adbe9f520d83dd45994b4bbd828bd157b5b9a1b42428118994a2ac14cadbea3446852db1ffd6f8e61471028243bb9355483fcb621feae842e94f94ec9f7bcdf9af6f8638c4949e612fb6d1d4e218be9487b77a5d2daaf68a6488a8f18ac9f37a25543dc6080dfd17903ed005273200371332ea51d75f7a7e2c8b413eaf099201b565653ce7a1e98dfd8ca953da58d5fa04c5cd3244c480c96f0c4e4c0f0284ed8c70b954e6a26c9a852437fd31df867892250af5db38d4fae3b5e7f55fc2b669004fb1fc46b1bacf522756ab6234e011a80043b39bcd60f991cf116a658b33c9960f6e8c6c63ab48415f2441896ce5fe302899964217054460192cad0926ee2374be57f500b5326c9272123b7d977251748a122597eb5d19382f7f4d6ac361f259a372fbb736e95dfed4a832b9d77a997598f431dbf615580f2ce4adc6f3cf72e4ef647cb870afbed67b803ba88e6ef4134454308e5d68fba6643cdf07170188ac36a165317e1e1ff1ccae0c04b6df2dfab2dd784e9e7f2194b8e85b1d98efb7e4885a55783995ba9e74f2b231ddc2d9c0c5d9322d0ec3ccb5510d75bc00c8a9fc2b9fd9c3f315e1b259e71cccb58645db60fcf550fd15bef87712f8b27aea1197b45afc78fa37679553bae82b9c913a8b9c742dff6e6f5f5bfcaf49b72812653a835ad59ccfb2b7be59301efecbbab8c758252f471dbcd38329059dde96b3a2160ec978eccbb2f017db037f26286ae64b988a1734f87503ca89407b7c7ea9855dbefebc49d1dc691c8521c76e3bc0d3bb2c6ff1ac90e441c228aa5b2453f6ad794bc9bb9c57d18b55f4203ded793600c76801524c5f96238176ed553887981ca2b29661c45b92f236f211cf5ad87eb7325df", @typed={0x8, 0x117, 0x0, 0x0, @pid=r4}, @generic="7848392974b3c06a0ee27f7affa7a40607c7f0a2361822dffd7623956feadd6cb6ff3739725ef9e7aa540617688bd74ba7d7a7a6b4b71e6c03fab9a092704f34e04a5fdd87c4a2ac2a20d547216225be36853e2e69269e1cd9e469fe0d95bcfe8ec6cebf55079a29d22173b07c5afaa1d9921b3fc953f1183b9473970bd1bd1b3a83207cb26476d651f45c72104a4a1b1b6a6b60fc06331dc917b25fd84c0c8ffb7d72b2134b2b05c805195a1629a79badb6e383dff974291f566e319a8dc5547e93590f67a23b80a5236d612e20bd291ac31a482a12964cbacaacf2f6d12077ebc28a593b25afcaad91c96b4e83e5d1164db2", @generic="c92ccdad86ab559b20c76a0e6876ad09b40528860beb76a40c3748f83b08735023fc623d3176c1ca2eaf02f52ea8a5f0a009cf3eaa69d978cfb3fb71657b0663d069ff3418702ebca2b92ca6f4718674028b5ee3a5e778175a3626fa95ee62389d30a8a8685bed79e6be1adf6d8e598c437b4976f0c6912f66a93b5a1bde97b1c8a7b472e42cad18992b00f5b7b9b1961e497d994a826760e18e76290b92ab3e8b25776a70a221d7d9ee9295c0a60e7ec0fc3171d07aa1b743f385f03d3ca6aebeac2b1bae4f0870f5a2c6289b7684cfe530d4abcbf1838ffea022b7c6ea68448ca7bac68359f9bdec78581c41cb7f1c751cfb1e8335946a"]}]}, @TIPC_NLA_NET={0x7a, 0x7, 0x0, 0x1, [@typed={0xc, 0x4b, 0x0, 0x0, @u64=0x2}, @generic="bb645bc1680e23ef9375f4ba97b28d2fa6883639aa178ff52e3f5816b4e289841d2f18d11780f0b2993944eeac4a6e1e0e24e1e7617241de0e34dfb219e277911f360a2049ad745e9562a0d645266e63fbca0d5e42d9fda7031dfb38300ff582707b8361c1560cbd8f62"]}]}, 0x1810}, 0x1, 0x0, 0x0, 0x4}, 0x4004810)
mmap$auto(0x0, 0x2020009, 0x3, 0xeb1, 0xfffffffffffffffa, 0x8000)
madvise$auto(0x108000, 0x800034, 0xa)
sendfile$auto(r0, r0, 0x0, 0x3)
executing program 2:
mmap$auto(0x0, 0xe983, 0xdf, 0xeb1, 0x401, 0x8000)
sendmsg$auto_NL80211_CMD_GET_REG(0xffffffffffffffff, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000200)={0x0, 0x1ac}, 0x1, 0x0, 0x0, 0x4004810}, 0x800)
bpf$auto(0x0, &(0x7f00000001c0)=@test={0xffffffffffffffff, 0xffff, 0xfffff0b6, 0x5, 0xff, 0xac1, 0x2, 0x36242398, 0xfffff5b2, 0x3bb, 0x7, 0xffff, 0x800, 0x81, 0x68198}, 0x6f3)
r0 = socket(0x2, 0x1, 0x0)
close_range$auto(0x2, 0xa, 0x0)
r1 = socket$nl_generic(0x10, 0x3, 0x10)
socket(0x2, 0x3, 0x2)
getsockopt$auto(r0, 0x0, 0xcf, 0x0, 0x0)
r2 = socket(0x2c, 0x8180b, 0x67)
sendmsg$auto_NL80211_CMD_START_AP(r1, &(0x7f0000000740)={&(0x7f0000000480)={0x10, 0x0, 0x0, 0x4}, 0xc, &(0x7f0000000700)={&(0x7f00000004c0)={0x228, 0x0, 0x200, 0x70bd29, 0x25dfdbfb, {}, [@NL80211_ATTR_TDLS_OPERATION={0x5}, @NL80211_ATTR_PROBE_RESP={0xc6, 0x91, "b115c623f370c56f66e456048653950cf0eeda7ef15a981dcf6426abe06771909f0c689d6916de5759cd95f560b5c3e6e15bff365d33dab578ca3c52377279aa39baa39fa37d74c2ca190fd0e761869db0b8a6d12c1d6fa32744fceae6bbcbf12289ec19320c66a94bf68f03959a45dbb0eb013b32aaea2d15c03b2528245c77ad243fae4279281e7efe2137d9a895c480d01daceeb32eb1544dbba3381907ebef1d013ebb918b442034d27b9086282d5b6e527edb6410e9c9a2a3e2eb7a154c979b"}, @NL80211_ATTR_SCHED_SCAN_RELATIVE_RSSI={0x5, 0xf6, 0x10}, @NL80211_ATTR_MU_MIMO_FOLLOW_MAC_ADDR={0xdd, 0xe8, "f7523d62b236edacfea193cc0643de264f4a95bc101466455723af7209299a6e8d10a673e95297c7bbdb2f0d795f264cc30ace286c314b2d2243ba81e6c6324471d7d3ef2ac8e5e911f3921e3d36b349665f09672808971993adacd8ceb6d503b959383e804ca42b50497c33bcf21a8d1e70a3ca3804800e4f8fd6267e07f191ee0851d48b8d379b7a6120fd13de484ac83b774ba13ebae2ac030db2d87697191f6ab3c4c76e5bf59711bda8fdf7804205254490d595036f47d602e4c3bac1ce35f7d2158e3edfd56e98fccdb024731d0409e9249d0da042ae"}, @NL80211_ATTR_LOCAL_STATE_CHANGE={0x4}, @NL80211_ATTR_CENTER_FREQ1={0x8}, @NL80211_ATTR_MESH_CONFIG={0x50, 0x23, 0x0, 0x1, [@typed={0x4a, 0x13f, 0x0, 0x0, @binary="24bf0b1e106524fe2723887c2b056908df8d79f4fc1dcbf7886d5fd573fbd665d81e86799e2a7e728ef1bf4c1c79c5bf5a3f378727468f4c213251f73759df25d357d3b6821d"}]}]}, 0x228}, 0x1, 0x0, 0x0, 0x4}, 0x20000040)
sendmsg$auto_ETHTOOL_MSG_EEE_SET(0xffffffffffffffff, &(0x7f0000001700)={0x0, 0x0, &(0x7f00000016c0)={&(0x7f0000000100)=ANY=[@ANYBLOB="d4000000", @ANYRES16=0x0, @ANYBLOB="100027bd7000fbdbdf2518000000200001800247eea41fac000014000200766574683100000000000000000000000800070063fbffff0500060001000000840002803d00488013b37090badc49d6dc93876646d25a4d297d01cd3b7da38d12889cc50d505f353dc42d0a3c0a14c7b46428910708003600", @ANYRES32=0x0, @ANYBLOB="0400b3800000003d003b800400a4800c009a00008000000000000004008680c16ab1b1b39dcaa14b6af7dcc011b43cf706e562811c62b28a702b72e0a87126700294f2350000000c000180080003"], 0xd4}, 0x1, 0x0, 0x0, 0x20000010}, 0x20008000)
r3 = clone$auto(0x20003b46, 0x2, 0x0, 0x0, 0x2)
socket(0x10, 0x3, 0x0)
openat$auto_adf_hb_cfg_fops_adf_heartbeat_dbgfs(0xffffffffffffff9c, &(0x7f0000000040)='/sys/kernel/debug/ieee80211/phy1/netdev:wlan1/smps\x00', 0x20a00, 0x0)
mmap$auto(0x0, 0x2020009, 0x3, 0xeb1, 0xfffffffffffffffa, 0x8000)
sendmsg$auto_NL80211_CMD_GET_REG(0xffffffffffffffff, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000200)={0x0, 0x1ac}, 0x1, 0x0, 0x0, 0x4004810}, 0x800)
sendmsg$auto_OVS_PACKET_CMD_EXECUTE(0xffffffffffffffff, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000240)={&(0x7f0000000040)=ANY=[@ANYBLOB='@\x00\x00\x00', @ANYRES16, @ANYBLOB="1b0026bd7400fddbdf250300000004000800100003800c000980"], 0x40}, 0x1, 0x0, 0x0, 0x4004040}, 0xc800)
sendmsg$auto_NETDEV_CMD_QUEUE_GET(0xffffffffffffffff, &(0x7f0000003040)={0x0, 0x0, &(0x7f0000003000)={&(0x7f0000000040)=ANY=[@ANYBLOB="1c000000", @ANYRES16=0x0, @ANYBLOB="010600bd7000fbdbdf250a"], 0x1c}, 0x1, 0x0, 0x0, 0x20040004}, 0x20008810)
syz_genetlink_get_family_id$auto_mac80211_hwsim(&(0x7f0000000040), 0xffffffffffffffff)
sendmsg$auto_NL80211_CMD_GET_REG(0xffffffffffffffff, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000280)={&(0x7f0000000340)=ANY=[@ANYRES16=r3, @ANYBLOB="1a00"], 0x1ac}, 0x1, 0x0, 0x0, 0x81c0}, 0x1)
sendmsg$auto_NL80211_CMD_GET_REG(0xffffffffffffffff, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000040)=ANY=[@ANYBLOB="72010000", @ANYBLOB="19"], 0x1ac}}, 0x40000)
r4 = syz_genetlink_get_family_id$auto_nl802154(&(0x7f0000000380), r2)
sendmsg$auto_NL802154_CMD_SET_CCA_ED_LEVEL(r2, &(0x7f0000000440)={&(0x7f0000000300)={0x10, 0x0, 0x0, 0x2}, 0xc, &(0x7f0000000400)={&(0x7f00000003c0)={0x14, r4, 0xf08, 0x70bd2a, 0x25dfdbfc}, 0x14}, 0x1, 0x0, 0x0, 0x894}, 0x40000)
sendmmsg$auto(0x3, &(0x7f0000000080)={{0x0, 0x1c03, &(0x7f0000000000)={0x0, 0xc4}, 0x1, 0x0, 0x0, 0x9}, 0x1}, 0x2, 0x0)
close_range$auto(0x2, 0x8, 0x0)
open(0x0, 0x22040, 0x75)
r5 = socket(0x10, 0x2, 0x4)
sendmsg$auto_ETHTOOL_MSG_WOL_SET(0xffffffffffffffff, &(0x7f0000002cc0)={0x0, 0x0, &(0x7f0000002c80)={&(0x7f0000000180)=ANY=[@ANYBLOB=',\x00\x00\x00', @ANYBLOB="010027"], 0x2c}, 0x1, 0x0, 0x0, 0x4801}, 0x0)
sendmsg$auto_NL80211_CMD_GET_REG(r5, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000180)=ANY=[@ANYBLOB="72010000", @ANYBLOB="12"], 0x1ac}}, 0x40000)
sendmmsg$auto(0x3, &(0x7f0000000080)={{0x0, 0x2, &(0x7f00000002c0)={0x0, 0xc4}, 0x1, 0x0, 0x0, 0x9}, 0x7}, 0x3, 0x0)
executing program 2:
r0 = openat$auto_bsg_fops_bsg(0xffffffffffffff9c, &(0x7f0000000100)='/dev/bsg/1:0:0:0\x00', 0x0, 0x0)
r1 = openat$auto_tracing_mark_fops_trace(0xffffffffffffff9c, &(0x7f0000000000)='/sys/kernel/debug/tracing/trace_marker\x00', 0x201, 0x0) (async)
mmap$auto(0x0, 0x400008, 0xdf, 0x9b72, 0x2, 0x8000)
r2 = open(&(0x7f00000020c0)='./cgroup\x00', 0x0, 0x408)
getdents$auto(r2, 0x0, 0x400018) (async)
write$auto_tracing_mark_fops_trace(r1, 0x0, 0x1f00)
close_range$auto(0xffffffffffffffff, 0x8000, 0x8000000) (async)
openat$auto_tracing_pipe_fops_trace(0xffffffffffffff9c, &(0x7f0000003fc0)='/sys/kernel/debug/tracing/trace_pipe\x00', 0x20a02, 0x0) (async)
sendfile$auto(0x1, 0x3, 0x0, 0xc01) (async)
write$auto(r0, 0x0, 0x100082) (async)
r3 = socket(0x22, 0x1, 0x1)
getsockopt$auto(r3, 0x84, 0x75, 0x0, &(0x7f0000000000)=0x9b) (async)
r4 = openat$auto_tty_fops_tty_io(0xffffffffffffff9c, &(0x7f0000000000)='/dev/ttyS0\x00', 0x801, 0x0)
ioctl$auto_TIOCVHANGUP2(r4, 0x5437, 0x0) (async)
mmap$auto(0x0, 0x400008, 0xa, 0x10, r0, 0x0)
unshare$auto(0x40000080) (async)
socket(0x18, 0x5, 0x2)
mmap$auto(0x0, 0x8, 0xdf, 0x9b72, 0x2, 0x8000)
openat$nci(0xffffffffffffff9c, &(0x7f0000000080), 0x2, 0x0)
sendmsg$auto_NETDEV_CMD_QUEUE_GET(0xffffffffffffffff, &(0x7f0000003040)={0x0, 0x0, &(0x7f0000003000)={&(0x7f0000000040)=ANY=[@ANYBLOB='$\x00', @ANYRES16=0x0, @ANYBLOB="41004bbd7000fbdbdf250a00"], 0x24}, 0x1, 0x0, 0x0, 0x44884}, 0x20008810) (async)
capset$auto(0x0, 0x0) (async)
semctl$auto_SEM_STAT(0x7ff, 0x0, 0x12, 0x7fff) (async)
close_range$auto(0x2, 0x8, 0x0) (async)
r5 = prctl$auto_PR_RISCV_V_GET_CONTROL(0x46, 0x7fffffffffffffff, 0xffffffffffffffff, 0x8, 0x919c)
syz_genetlink_get_family_id$auto_nl80211(&(0x7f00000011c0), r5)
openat$auto_tracing_saved_cmdlines_fops_trace(0xffffffffffffff9c, &(0x7f0000001200)='/sys/kernel/debug/tracing/saved_cmdlines\x00', 0x72d102, 0x0)
executing program 2:
close_range$auto(0x2, 0x8, 0x0)
mmap$auto(0x0, 0x8c7, 0xdf, 0x9b72, 0x2, 0x8000)
socketpair$auto(0x1, 0x2, 0x8000000000000000, 0x0)
close_range$auto(0x2, 0x8, 0x0)
open(0x0, 0x163340, 0x2a)
socket(0x2, 0x80802, 0x0)
setsockopt$auto(0x3, 0x1, 0x3e, 0x0, 0x9)
mmap$auto(0x0, 0x20009, 0xe2, 0xeb1, 0x405, 0x8000)
r0 = openat$auto_fb_fops_fb_chrdev(0xffffffffffffff9c, &(0x7f0000001c80)='/dev/fb0\x00', 0x20401, 0x0)
ioctl$sock_SIOCGIFINDEX(r0, 0x4600, 0x0)
r1 = openat$auto_fb_fops_fb_chrdev(0xffffffffffffff9c, &(0x7f0000001c80)='/dev/fb0\x00', 0x20401, 0x0)
ioctl$sock_SIOCGIFINDEX(r1, 0x4601, 0x0)
connect$auto(0x3, 0x0, 0x55)
setsockopt$auto(0x3, 0x0, 0x1, 0x0, 0x9)
sendmmsg$auto(0x3, 0x0, 0x3, 0x0)
executing program 2:
r0 = openat$auto_uinput_fops_uinput(0xffffffffffffff9c, &(0x7f0000000000), 0x101001, 0x0)
mmap$auto(0x0, 0x4020009, 0xdf, 0xeb1, 0x401, 0x8000)
r1 = clone$auto(0x4, 0x80000001, 0x0, 0x0, 0xfff)
move_pages$auto(r1, 0xd0, 0x0, 0x0, 0x0, 0x2)
mmap$auto(0x0, 0x4020009, 0xdf, 0xeb1, 0x401, 0x8000)
close_range$auto(r0, 0xffffffffffffffff, 0x2)
socket(0x10, 0x2, 0x0)
socketpair$auto(0x1, 0x1, 0x8000000000000000, 0x0)
socket(0x2, 0x1, 0x0)
r2 = openat$auto_kvm_chardev_ops_kvm_main(0xffffffffffffff9c, &(0x7f0000000000), 0x212480, 0x0)
ustat$auto(0x801, 0x0)
close_range$auto(0x2, 0x8000, 0x0)
r3 = openat$auto_kvm_chardev_ops_kvm_main(0xffffffffffffff9c, &(0x7f00000011c0), 0xe0180, 0x0)
ioctl$auto_KVM_CREATE_VM(r3, 0xae01, 0x0)
ioctl$auto(0x3, 0xae41, r3)
ioctl$auto_KVM_CREATE_VM(r2, 0x4008ae8a, 0x0)
r4 = openat$auto_rtc_dev_fops_dev(0xffffffffffffff9c, &(0x7f0000000100), 0x240, 0x0)
ioctl$auto_RTC_PIE_ON(r4, 0x7005, 0x0)
ioctl$auto_UI_DEV_SETUP(r0, 0x405c5503, &(0x7f00000000c0)={{0x9, 0xf2cf, 0x8, 0x80}, "6a034a07c7b82d90b69a39e32576f893fba86c9dd051a0094a3836d61c9100fefbbabea6ef9368c7996e841f3f1561d4992f726b0a6c36b0b2fd1678e816201cf562367fe6596824588a2e3d84ba165f", 0xa})
ioctl$auto_UI_DEV_CREATE(r0, 0x5501, 0x0)
mmap$auto(0x0, 0x400008, 0xdf, 0x9b72, 0x0, 0x100000000008000)
write$auto(0x3, 0x0, 0x7fffffff)
fsopen$auto(0x0, 0x2)
mmap$auto(0x0, 0x400008, 0xdf, 0x9b72, 0x2, 0x8000)
executing program 34:
r0 = openat$auto_uinput_fops_uinput(0xffffffffffffff9c, &(0x7f0000000000), 0x101001, 0x0)
mmap$auto(0x0, 0x4020009, 0xdf, 0xeb1, 0x401, 0x8000)
r1 = clone$auto(0x4, 0x80000001, 0x0, 0x0, 0xfff)
move_pages$auto(r1, 0xd0, 0x0, 0x0, 0x0, 0x2)
mmap$auto(0x0, 0x4020009, 0xdf, 0xeb1, 0x401, 0x8000)
close_range$auto(r0, 0xffffffffffffffff, 0x2)
socket(0x10, 0x2, 0x0)
socketpair$auto(0x1, 0x1, 0x8000000000000000, 0x0)
socket(0x2, 0x1, 0x0)
r2 = openat$auto_kvm_chardev_ops_kvm_main(0xffffffffffffff9c, &(0x7f0000000000), 0x212480, 0x0)
ustat$auto(0x801, 0x0)
close_range$auto(0x2, 0x8000, 0x0)
r3 = openat$auto_kvm_chardev_ops_kvm_main(0xffffffffffffff9c, &(0x7f00000011c0), 0xe0180, 0x0)
ioctl$auto_KVM_CREATE_VM(r3, 0xae01, 0x0)
ioctl$auto(0x3, 0xae41, r3)
ioctl$auto_KVM_CREATE_VM(r2, 0x4008ae8a, 0x0)
r4 = openat$auto_rtc_dev_fops_dev(0xffffffffffffff9c, &(0x7f0000000100), 0x240, 0x0)
ioctl$auto_RTC_PIE_ON(r4, 0x7005, 0x0)
ioctl$auto_UI_DEV_SETUP(r0, 0x405c5503, &(0x7f00000000c0)={{0x9, 0xf2cf, 0x8, 0x80}, "6a034a07c7b82d90b69a39e32576f893fba86c9dd051a0094a3836d61c9100fefbbabea6ef9368c7996e841f3f1561d4992f726b0a6c36b0b2fd1678e816201cf562367fe6596824588a2e3d84ba165f", 0xa})
ioctl$auto_UI_DEV_CREATE(r0, 0x5501, 0x0)
mmap$auto(0x0, 0x400008, 0xdf, 0x9b72, 0x0, 0x100000000008000)
write$auto(0x3, 0x0, 0x7fffffff)
fsopen$auto(0x0, 0x2)
mmap$auto(0x0, 0x400008, 0xdf, 0x9b72, 0x2, 0x8000)
executing program 6:
mmap$auto(0x0, 0x2020009, 0x3, 0xeb1, 0xfffffffffffffffa, 0x8000)
close_range$auto(0x0, 0xfffffffffffff000, 0x2)
mmap$auto(0x0, 0x20009, 0x4000000000df, 0xeb1, 0x401, 0x8000)
close_range$auto(0x2, 0x8, 0x0)
socket$nl_generic(0x10, 0x3, 0x10)
socket(0x11, 0x80003, 0x300)
sendto$auto(0x3, 0x0, 0x800013, 0xffffffbc, &(0x7f0000000440)=@tipc=@name={0x1e, 0x2, 0x0, {{0x41, 0x4}, 0x4}}, 0x22)
socket(0xa, 0x2, 0x73)
socketpair$auto(0x1, 0x5, 0x8000000000000000, 0x0)
socket(0x1, 0x3, 0x0)
bind$auto(0x3, 0x0, 0x6b)
connect$auto(0x3, 0x0, 0x6b)
readv$auto(0xffffffffffffffff, 0x0, 0x410)
sendmsg$auto_NL80211_CMD_SET_WIPHY(0xffffffffffffffff, 0x0, 0x4000000)
close_range$auto(0x0, 0xfffffffffffff001, 0x2)
openat$auto_adf_hb_cfg_fops_adf_heartbeat_dbgfs(0xffffffffffffff9c, &(0x7f0000000000)='/sys/kernel/debug/ieee80211/phy0/hw_conf\x00', 0x20486, 0x0)
openat$auto_def_blk_fops_fs(0xffffffffffffff9c, &(0x7f0000000040)='/dev/loop6\x00', 0x169780, 0x0)
socket(0x11, 0x80003, 0x0)
openat$auto_raw_fops_raw_gadget(0xffffffffffffff9c, &(0x7f00000000c0), 0x0, 0x0)
r0 = socket(0x29, 0x2, 0x0)
mmap$auto(0x0, 0x202000c, 0x3, 0xab1, 0xfffffffffffffffa, 0x8000)
mmap$auto(0x0, 0x400008, 0xdf, 0x9b72, 0x2, 0x8000)
prctl$auto(0x1000000003b, 0x1, 0x4, 0x5, 0x10004)
madvise$auto(0x0, 0xffffffffffff0001, 0x15)
madvise$auto(0x0, 0xffffffffffff0008, 0x19)
setsockopt$auto(r0, 0x119, 0x400000, 0x0, 0x802)
socket(0x10, 0x2, 0x6)
mmap$auto(0x0, 0x400008, 0xdf, 0x9b72, 0x1fe, 0x8000)
sendmsg$auto_NL80211_CMD_GET_REG(0xffffffffffffffff, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000200)={0x0}, 0x1, 0x0, 0x0, 0x40000}, 0x40805)
sendmsg$auto_L2TP_CMD_NOOP(0xffffffffffffffff, &(0x7f0000000280)={0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x40080}, 0x8c1)
executing program 4:
read$auto(0xffffffffffffffff, &(0x7f0000000000)='%:\x00', 0x7)
mmap$auto(0x0, 0x7, 0x8, 0xeb1, 0xfffffffffffffffa, 0x40000000008000)
r0 = openat$auto_proc_mem_operations_base(0xffffffffffffff9c, &(0x7f0000000300)='/proc/self/mem\x00', 0x100, 0x0)
read$auto_proc_mem_operations_base(r0, &(0x7f0000000340)=""/230, 0xe6)
bpf$auto(0x14, &(0x7f00000000c0)=@iter_create={0xffffffffffffffff, 0x4}, 0x7)
executing program 4:
r0 = socket(0x10, 0x2, 0x0)
close_range$auto(0x2, 0x8, 0x0)
socket(0x10, 0x2, 0x4)
socket(0x10, 0x3, 0x6)
sendmsg$auto_NL80211_CMD_GET_REG(r0, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000300)=ANY=[@ANYBLOB="72010000", @ANYBLOB="120027", @ANYBLOB="5de1"], 0x1ac}}, 0x40000)
read$auto(r0, &(0x7f0000000000)='$-]&@\x00', 0x5)
executing program 4:
mmap$auto(0x0, 0x2020009, 0x3, 0xeb2, 0xfffffffffffffffb, 0x8000)
close_range$auto(0x2, 0x8, 0x0)
r0 = openat$auto_tracing_err_log_fops_trace(0xffffffffffffff9c, &(0x7f0000000000)='/sys/kernel/debug/tracing/error_log\x00', 0xb01, 0x0)
socket(0x15, 0x5, 0x0)
connect$auto(0x3, &(0x7f0000000080)=@in={0x2, 0x3, @dev={0xac, 0x14, 0x14, 0x10}}, 0x54)
getsockopt$auto(0x3, 0x200000000001, 0x1c, 0x0, 0x0)
mmap$auto(0x0, 0x2020009, 0x9, 0xeb1, 0xfffefffffffffffa, 0x8000)
r1 = epoll_create$auto(0x4)
r2 = openat$auto_v4l2_fops_v4l2_dev(0xffffffffffffff9c, &(0x7f0000000000)='/dev/video2\x00', 0x101081, 0x0)
epoll_ctl$auto(r1, 0x1, r2, 0x0)
mmap$auto(0x0, 0x4020009, 0xdf, 0xeb1, 0x401, 0x8000)
r3 = socket(0x1, 0x3, 0x80000000)
r4 = getsockopt$auto(r3, 0x6, 0x25, 0x0, 0x0)
mmap$auto(0x40000000010000, 0x400008, 0xdf, 0x9b72, r0, 0x8000)
socketpair$auto(0x1, 0x1, 0x8000000000000000, 0x0)
socket(0x11, 0x80003, 0x300)
setsockopt$auto(r4, 0xffff6871, 0x8, 0x0, 0x3)
r5 = socket(0x10, 0x2, 0x4)
io_uring_setup$auto(0x4bf15e08, &(0x7f0000000000)={0x401, 0x8, 0xfe, 0x6fb3, 0x8a, 0x40000009, 0xffffffffffffffff, [0x100, 0x9, 0x7f], {0x6, 0x7, 0x3032, 0xe, 0xf, 0x5, 0x5, 0xfffffff9, 0xf08a2b3}, {0x0, 0xfc, 0x6, 0x1, 0x0, 0xf89, 0x9, 0x7fffffff, 0x8}})
r6 = socket$nl_generic(0x10, 0x3, 0x10)
ioctl$sock_SIOCGIFINDEX(r6, 0x8933, &(0x7f0000000000)={'dummy0\x00'})
syz_open_procfs$namespace(0x0, 0x0)
sendmsg$auto_NFSD_CMD_THREADS_SET(0xffffffffffffffff, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000000140)=ANY=[@ANYBLOB="1f9a81052a570148ea3acf23453bf490b45c8a1e9c681d666620c84499a29282c991", @ANYRESOCT=r4], 0x2c}, 0x1, 0x0, 0x0, 0x4000044}, 0x2404c000)
write$auto(r5, &(0x7f0000000000)='-\x00', 0x2fb)
r7 = openat$auto_kernfs_file_fops_kernfs_internal(0xffffffffffffff9c, 0x0, 0x500, 0x0)
read$auto_kernfs_file_fops_kernfs_internal(r7, &(0x7f0000000080)=""/23, 0x17)
openat$auto_proc_sys_file_operations_proc_sysctl(0xffffffffffffff9c, 0x0, 0x101202, 0x0)
close_range$auto(0x2, 0x8, 0x0)
openat$auto_proc_iter_file_ops_compat_inode(0xffffffffffffff9c, &(0x7f0000000040)='/proc/fs/netfs/cookies\x00', 0x40080, 0x0)
openat$auto_proc_sys_file_operations_proc_sysctl(0xffffffffffffff9c, &(0x7f0000000080)='/proc/sys/kernel/seccomp/actions_logged\x00', 0x8202, 0x0)
executing program 0:
r0 = socket(0xa, 0x2, 0x3a)
setsockopt$auto(r0, 0x29, 0x11, &(0x7f0000000240)='!\x00\xba\xe4\x8a\xf0t\xaf\x82\xd7{\x98\xdd\xee\xc2f\xcaH\x90\xc57M\x87<<\n\xf2L\"Y\xa9\f\n\xbd?\xdd\b\xf7vu:\x00\xeaP\xa7=\xef\xc3\xdc\xf3=J\xf9\x9e\xd9\x02\xbb\xd3\xf8\xff*\xc2\xd8w\xe9\x00\x00\x01\x00h\xe2\x0f\x1b\x95L\xbf\xa5\xacH\"xV#\xc7e\x12\x83\xed\xc7\xc5\x9e\x84?\xfa=\f\xd8\x14\x00\x9fJl\xdd)i\x9f(#\xb7\xff:\x94\x8bd,\xb2\xfc\xde32\x87;\tx\xffM\x1f\x1d\xd8b\xa5\r\xb7v;\xfd\xa14M\xd3\x95\x86\x04\xd4\xda}\xcat}\x18K\x85\x9bBj\x8e\x95\xca\x87\xfe\x125\x154\x83\x94X,\xa4\xf3\xf6\xef\x1a\xb5iX\x99\xa1NO\xc5R\xc9\xc7\xd6\x8d?\x13\x9f\xaf\xf4\xbc\xa3j\xefQ\x7f\xc4\x86\xe8\xc6\xf8\xfe\x115\xd7\x89\x86\xc6T\x14\x00\x13\xb9mf\xc0\xc2%_N\xed\xa9\x02\xe5\x83\xa0\x01O%NHKp\xe0\xb3u\xdc\x8bb\xfa\xabD\x1d\x8a\x1e\xb4C\x05R\xdco\xa5\xce\xc9+\xf8\xf2X#', 0x1fe)
executing program 0:
stat$auto(&(0x7f0000000300)='./cgroup\x00', &(0x7f0000000340)={0x7, 0x8000, 0x6, 0x8001, 0xee00, <r0=>0xee01, 0x0, 0x187, 0x2, 0x8, 0x3, 0x5fd0, 0x7f, 0x6, 0xfff, 0x3, 0x1})
mmap$auto(0x0, 0x20009, 0xdf, 0xeb1, 0x401, 0x8000)
close_range$auto(0x2, 0x8, 0x0)
sendmsg$auto_NL80211_CMD_GET_REG(0xffffffffffffffff, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000200)={0x0, 0x1ac}, 0x1, 0x0, 0x0, 0x4004810}, 0x800)
sendmsg$auto_HSR_C_GET_NODE_STATUS(0xffffffffffffffff, &(0x7f0000000200)={0x0, 0x0, &(0x7f00000001c0)={&(0x7f0000000140)=ANY=[@ANYBLOB='h\x00\x00\x00', @ANYRES16=<r1=>0x0, @ANYBLOB="000226bd7000fedbdf25030000000800030004020000060007000080000008000200", @ANYRES32=0x0, @ANYBLOB="0a00050000000000000000000a00010000000000000000000a0001000000000000000000060007000a00000008000200", @ANYRES32=0x0, @ANYBLOB="080140"], 0x68}}, 0x40090)
sendmsg$auto_NL80211_CMD_STOP_AP(0xffffffffffffffff, &(0x7f0000000d80)={0x0, 0x0, &(0x7f0000000d40)={&(0x7f0000000480)=ANY=[@ANYBLOB="140000008f68084197cad0a602aceff6e434f2a84c1f9a2b686c17575cce6e2cd51220266f0b04fe6d0d6755e40794c7abe48678c462385fa5f6513224e850eeda5ea0674056022442388de7dccbfa2d751c143291176413f704a2f4a993ee64456952edd4e6754a5a15e01f0af0c21460ba", @ANYRES16=0x0, @ANYBLOB="040029bd7000fedbdf2510000000"], 0x14}, 0x1, 0x0, 0x0, 0x4000001}, 0x40)
r2 = syz_genetlink_get_family_id$auto_nfsd(&(0x7f0000001440), 0xffffffffffffffff)
r3 = syz_genetlink_get_family_id$auto_nfc(&(0x7f00000015c0), 0xffffffffffffffff)
sendmsg$auto_NFC_CMD_STOP_POLL(0xffffffffffffffff, &(0x7f0000002680)={0x0, 0x0, &(0x7f0000002640)={&(0x7f0000000580)=ANY=[@ANYBLOB="a65115c4", @ANYRESHEX=r2, @ANYBLOB="20fa28bd7000ff08000000000000", @ANYRESHEX=r0, @ANYRES32=r1, @ANYBLOB="0e8ccd1998719890eacd4d3402f180541c0d46edfd51d271fc33418c4c593e56ad425d740f39db93ceccd1d5080384ccbae93ed6023dbe608b336fb2ab07c317034bb6502024c8ed3c37f4faa9f60e127fdd7dee19f9b9629e0e7e1557ede9db5ae05b584563f1a93b6a219e6180b2169ed686dedb69b3938d03d1811ad83d761ddf44eeb82bec8cf9393ae21418e7db49746d2169a15334ea7eba5e60fe201d46cd32d3ca0a8f7c5c34cef4371cc0e9", @ANYRES8=r1, @ANYRES8=r0, @ANYRES8=0x0], 0x14}, 0x1, 0x0, 0x0, 0x40008d5}, 0x4010)
sendmsg$auto_NFC_CMD_START_POLL(0xffffffffffffffff, &(0x7f0000000400)={&(0x7f0000000440)={0x10, 0x0, 0x0, 0x402}, 0xc, &(0x7f0000000280)={&(0x7f0000000240)=ANY=[@ANYBLOB='<\x00\x00\x00', @ANYRES16=r3, @ANYBLOB="08002bfd7000ffdbdf450600000020000200d65bced5efd32a94b7f5980a2f0965559f617873703100f47c78308008001e0080000000"], 0x3c}, 0x1, 0x0, 0x0, 0x20048895}, 0x40000)
r4 = socket(0x2, 0x3, 0x100)
socket(0x10, 0x2, 0x0)
sendmsg$auto_NL80211_CMD_GET_REG(0xffffffffffffffff, &(0x7f0000000100)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000180)=ANY=[@ANYBLOB="72010000", @ANYBLOB="13"], 0x1ac}, 0x1, 0x0, 0x0, 0x10008001}, 0x4004)
sendmmsg$auto(0x3, &(0x7f0000000080)={{0x0, 0x2, &(0x7f00000002c0)={0x0, 0xc4}, 0x1, 0x0, 0x0, 0x9}, 0x7}, 0x3, 0x0)
r5 = socket$nl_generic(0x10, 0x3, 0x10)
mmap$auto(0x0, 0xe983, 0xdf, 0xeb1, 0x401, 0x8000)
mmap$auto(0x0, 0x9, 0xdf, 0x9b72, 0x2, 0x8000)
io_uring_setup$auto(0x406, 0x0)
mmap$auto(0x0, 0x9, 0xffb, 0x8000000008011, 0x3, 0x0)
getrandom$auto(0x0, 0x6000000, 0x3)
io_uring_enter$auto(r4, 0xa84, 0x80000001, 0xe, 0x0, 0x46)
migrate_pages$auto(0x0, 0x99, 0x0, &(0x7f00000001c0)=0x3fe)
r6 = openat$auto_snd_pcm_oss_f_reg_pcm_oss(0xffffffffffffff9c, &(0x7f0000000100)='/dev/adsp1\x00', 0x40a140, 0x0)
ioctl$auto_SNDCTL_DSP_CHANNELS(r6, 0xc0045006, &(0x7f00000001c0))
getrandom$auto(&(0x7f0000000100)='..\x00k\xac\x8c\x1d\x0e\x98\x80\xd2\xaf\xa1\xf2\x1e\xe1R1\xa2\x8e\xce\xa0\x17\bI3\'\xc5tw\xd7\x1d\xa6\xf4#+\xfa\xd7\x01\xb9j<\v\xf47\n\xa7\xd2\x8b\x11e</\xfd\x9b\xe4\x99G\xeaS\x9a\xadu(:\x94:\xaf\x06c=3>1\xb3\xfdd\x04\xa9 1q\x97\xc4,\xa9^\xc1\xb6\xa1q\x0f\xd1\x013\x87l\xb9\x1e\x05\x90\xa2', 0xd5, 0x1)
move_pages$auto(0x0, 0x1002, 0x0, 0x0, 0x0, 0x2)
openat$auto_seq_oss_f_ops_seq_oss(0xffffffffffffff9c, &(0x7f0000000540)='/dev/sequencer2\x00', 0x0, 0x0)
io_uring_enter$auto(0x3, 0x5, 0xffffffff, 0x3, 0x0, 0x2)
getdents$auto(0xffffffffffffffff, 0x0, 0x100019)
syz_genetlink_get_family_id$auto_nl80211(&(0x7f0000000000), r5)
executing program 4:
openat$auto_snd_pcm_oss_f_reg_pcm_oss(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/dsp1\x00', 0x20b42, 0x0)
read$auto_proc_reg_file_ops_compat_inode(0xffffffffffffffff, &(0x7f0000000280)=""/65, 0x41)
mmap$auto(0x0, 0x4020009, 0x6, 0xeb1, 0x401, 0x8000)
prctl$auto(0x1000000003b, 0x1, 0x4, 0x5, 0x7)
socket$nl_generic(0x10, 0x3, 0x10)
close_range$auto(0x2, 0x8, 0x0)
sendmsg$auto_NETDEV_CMD_DEV_GET(0xffffffffffffffff, &(0x7f0000000080)={&(0x7f0000000140)={0x10, 0x0, 0x0, 0x400000}, 0xc, 0x0, 0x1, 0x0, 0x0, 0x48000}, 0x0)
mmap$auto(0x0, 0x400008, 0xdf, 0x9b72, 0x2, 0x8000)
close_range$auto(0x2, 0x8000, 0x0)
sendmsg$auto_HSR_C_GET_NODE_STATUS(0xffffffffffffffff, &(0x7f0000000200)={0x0, 0x0, &(0x7f00000001c0)={&(0x7f0000000140)={0x68, 0x0, 0x200, 0x70bd26, 0x25dfdbfe, {}, [@HSR_A_IF1_AGE={0x8, 0x3, 0x200}, @HSR_A_IF2_SEQ={0x6, 0x7, 0x4}, @HSR_A_IFINDEX={0x8}, @HSR_A_NODE_ADDR_B={0xa}, @HSR_A_NODE_ADDR={0xa, 0x1, @broadcast}, @HSR_A_NODE_ADDR={0xa}, @HSR_A_IF1_AGE={0x8, 0x3, 0x38}, @HSR_A_IFINDEX={0x8}, @HSR_A_IF2_AGE={0x8, 0x4, 0x4}]}, 0x68}, 0x1, 0x0, 0x0, 0x40080}, 0x40090)
socket(0x2, 0x3, 0x100)
socket(0x10, 0x2, 0x0)
sendmsg$auto_NL80211_CMD_GET_REG(0xffffffffffffffff, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000200)={0x0, 0x1ac}, 0x1, 0x0, 0x0, 0x4004810}, 0x800)
sendmsg$auto_NL80211_CMD_GET_REG(0xffffffffffffffff, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000180)=ANY=[@ANYBLOB="720100", @ANYBLOB="13"], 0x1ac}}, 0x4004)
sendmmsg$auto(0x3, &(0x7f0000000080)={{0x0, 0x2, &(0x7f00000002c0)={0x0, 0xc4}, 0x1, 0x0, 0x0, 0x9}, 0x7}, 0x3, 0x0)
executing program 0:
futex_waitv$auto(&(0x7f0000000180)={0x3fb, 0x6, 0x2, 0xfff}, 0x3, 0xbffffffc, 0x0, 0x81)
r0 = bpf$auto(0x5, &(0x7f00000001c0)=@task_fd_query={0x2, 0x2, 0x4, 0x0, 0x85, 0x4, 0x9, 0x6, 0x8001}, 0x101)
close_range$auto(0x2, 0xa, 0x0)
socket$nl_generic(0x10, 0x3, 0x10)
syz_clone(0x11, 0x0, 0x0, 0x0, 0x0, 0x0)
r1 = openat$auto_blk_mq_debugfs_fops_blk_mq_debugfs(0xffffffffffffff9c, &(0x7f00000000c0)='/sys/kernel/debug/block/mtdblock0/sched/read0_fifo_list\x00', 0x0, 0x0)
read$auto_blk_mq_debugfs_fops_blk_mq_debugfs(r1, &(0x7f0000000040)=""/124, 0x7c)
pipe$auto(&(0x7f0000000000)=<r2=>0xffffffffffffffff)
splice$auto(r2, 0x0, 0x2, 0x0, 0x9, 0x8)
mmap$auto(0x0, 0x7, 0xdf, 0x9b72, 0x2, 0x7ffc)
mmap$auto(0x0, 0x20009, 0x4000000000df, 0xeb1, 0x401, 0x8000)
mremap$auto(0x0, 0x4, 0x4, 0x7, 0x1000)
mmap$auto(0x0, 0x400008, 0xdf, 0x9b72, 0x2, 0x8000)
close_range$auto(0x2, r0, 0x0)
socketpair$auto(0x1e, 0x1, 0x8000000000000000, 0x0)
openat$auto_vhost_vsock_fops_vsock(0xffffffffffffff9c, &(0x7f0000000000), 0x121900, 0x0)
mmap$auto(0x0, 0x20009, 0xdf, 0xeb1, 0x401, 0x8000)
r3 = socket(0x2, 0x1, 0x0)
fcntl$auto(0x3, 0x4, 0xa553)
bind$auto(r2, &(0x7f0000000040)=@llc={0x1a, 0x301, 0x81, 0xe, 0x4, 0x2, @local}, 0x1)
sendmmsg$auto(r3, &(0x7f0000000140)={{&(0x7f0000000040), 0x12, 0x0, 0x101, 0x0, 0x5, 0x9ad}, 0x5}, 0x5, 0x20000000)
r4 = socketpair$auto(0x1, 0x5, 0x8000000000000000, 0x0)
syz_genetlink_get_family_id$auto_batadv(0x0, 0xffffffffffffffff)
mmap$auto(0x7, 0x202000c, 0x5, 0xfb1, r4, 0xa)
semctl$auto(0x9, 0xc1b8, 0x4, 0x1)
mmap$auto(0x7ffffffd, 0x400004, 0x7, 0x9b72, r3, 0x5)
dup2$auto(0xffffffffffffffff, 0xffffffffffffffff)
syz_genetlink_get_family_id$auto_nl80211(0x0, 0xffffffffffffffff)
sendmsg$auto_NL80211_CMD_SET_MULTICAST_TO_UNICAST(0xffffffffffffffff, 0x0, 0x0)
sendmsg$auto_NL80211_CMD_GET_STATION(0xffffffffffffffff, 0x0, 0x40)
executing program 6:
close_range$auto(0x2, 0x1d, 0x0)
r0 = syz_genetlink_get_family_id$auto_nl80211(&(0x7f0000000180), 0xffffffffffffffff)
sendmsg$auto_NL80211_CMD_SET_WIPHY(0xffffffffffffffff, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000080)=ANY=[@ANYBLOB='$\x00\x00\x00', @ANYRES16=r0, @ANYBLOB="011d3da4420008bd7100f9db5f250200000000000010", @ANYRES32], 0x24}, 0x1, 0x0, 0x0, 0x404c0c0}, 0x80)
mmap$auto(0x0, 0x3, 0x4000000200df, 0x40eb2, 0x402, 0x300000000000)
capget$auto(&(0x7f0000000100)={0x5}, &(0x7f0000000140)={0x7ff, 0xc, 0x800})
close_range$auto(0x2, 0xa, 0x0)
socket(0x10, 0x2, 0x4)
openat$auto_safesetid_uid_file_fops_securityfs(0xffffffffffffff9c, &(0x7f0000000080), 0x1, 0x0)
writev$auto(0x3, &(0x7f0000000100)={0x0, 0x7111}, 0x8)
r1 = socket(0x10, 0x2, 0x0)
sendmmsg$auto(r1, &(0x7f0000000200)={{0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000080), 0xfc2}, 0x2, &(0x7f00000001c0), 0x7, 0xa505}, 0x800}, 0x7, 0x4008)
socket(0x3, 0x800, 0x9)
r2 = openat$auto_kernfs_file_fops_kernfs_internal(0xffffffffffffff9c, &(0x7f0000000080)='/sys/module/apparmor/parameters/path_max\x00', 0x80, 0x0)
r3 = socket(0x1e, 0x4, 0x0)
setsockopt$auto(r3, 0x10f, 0x86, 0x0, 0x0)
read$auto_kernfs_file_fops_kernfs_internal(r2, &(0x7f00000000c0)=""/17, 0x11)
open(&(0x7f0000000000)='./file0\x00', 0x261c2, 0x84)
r4 = open(&(0x7f0000000080)='./file0\x00', 0xeee00, 0x31)
mmap$auto(0x3, 0x2020009, 0x7fffffff, 0xeb1, 0xfffffffffffffffa, 0x8000)
r5 = openat$auto_kernfs_file_fops_kernfs_internal(0xffffffffffffff9c, &(0x7f0000000040)='/sys/devices/virtual/block/ram6/queue/minimum_io_size\x00', 0x0, 0x0)
read$auto_kernfs_file_fops_kernfs_internal(r5, &(0x7f0000001540)=""/104, 0x68)
mmap$auto(0x0, 0x400008, 0xdf, 0x9b72, 0x2, 0x8000)
getcwd$auto(0x0, 0xffffffffffffffff)
rename$auto(0x0, &(0x7f0000000300)='v#\xd5\xaf>=\x14\xe6%\xf7\x8a\x8d\x9a\xae\x1a\xd6\xa8\xb8\x1d\xf5(\xb0\x1f\xbd\xcbV\n\"\xe3V\xfeP\xceN\xb2\xc32\xaf\xcc\x80\xfa\xf0\xd4\xd9|\xfe\x03y\xd16\x17\x99R\xca\xe5\xf4\xb4T\xfcv\xfc\xe6\x9cv\a\x00\xc2a\x16\xd1\x8a\x80\x90\x87\xa5s\x10\xed\x93\xd4\x15=\xc0\x1f\x0e\xb0\x18v}\x03!\xf0I\xe3}\x90\x9b\x92[\xfe2<7\xd3\x81\x9a~\xcd\r\x19\x9e\x10(5\xfd\x8b\x82\xd4\xc85\xc3\x93t\t\xd0\x9d\xca^n\xf3\xcb>\x1bO\xcej\xe0\xef\xf2\xd7\xc2}\x18\xd9`AO\x95<\x9aH\vu\xae\xd4\xea\x12\xb8\xd1\n\x01\x83r\x85\xbf*\x18\xa7 S:R\x14\x89Z3\x94\x8bP)')
write$auto(0x3, 0x0, 0x100082)
lseek$auto(r4, 0xc, 0x4)
executing program 4:
mmap$auto(0x0, 0x400008, 0xdf, 0x9b72, 0x2, 0x8000)
madvise$auto(0x0, 0xffffffffffff0005, 0x19)
madvise$auto(0x0, 0xffffffffffff0001, 0x15)
io_uring_setup$auto(0x6, 0x0)
madvise$auto(0x200000, 0x200007, 0x19)
executing program 5:
write$auto(0xffffffffffffffff, &(0x7f0000000000)='\'\x00', 0x4)
openat$auto_proc_reg_file_ops_compat_inode(0xffffffffffffff9c, &(0x7f0000000000)='/proc/thread-self/net/anycast6\x00', 0x0, 0x0)
mmap$auto(0x3, 0xb1, 0x3, 0xeb0, 0x401, 0xf8)
read$auto(0x3, 0x0, 0x80)
read$auto(0x3, 0x0, 0x80)
write$auto(0x3, 0x0, 0xfffffdef)
write$auto(0x3, 0x0, 0xfffffdef)
mmap$auto(0x0, 0x400008, 0xdf, 0x10, 0x2, 0x8000)
open(&(0x7f0000000000)='./file0\x00', 0x161342, 0x100)
msync$auto(0x1ffff000, 0x180000000000000, 0x400000004)
mmap$auto(0x0, 0x2020009, 0x3, 0x8011, 0xfffffffffffffffa, 0x8000)
mmap$auto(0x0, 0x2020009, 0x3, 0xeb1, 0xffffffffffffffff, 0x8000)
openat$auto_kernfs_file_fops_kernfs_internal(0xffffffffffffff9c, 0x0, 0x0, 0x0)
r0 = openat$auto_proc_fail_nth_operations_base(0xffffffffffffff9c, &(0x7f0000000000)='/proc/thread-self/fail-nth\x00', 0x20af83, 0x0)
writev$auto(r0, &(0x7f0000000200)={0x0, 0x7}, 0x3)
msync$auto(0x7, 0x45f8, 0x1)
open(0x0, 0x22240, 0x0)
socket$nl_generic(0x10, 0x3, 0x10)
socketpair$auto(0x1, 0x4, 0x8000000000000000, 0x0)
r1 = openat$auto_tty_fops_tty_io(0xffffffffffffff9c, &(0x7f0000000400)='/dev/ttyS2\x00', 0x101e81, 0x0)
ioctl$auto_TIOCSETD2(r1, 0x5423, 0x0)
openat$auto_mousedev_fops_mousedev(0xffffffffffffff9c, &(0x7f0000000040)='/dev/psaux\x00', 0x20000, 0x0)
io_uring_setup$auto(0x6, 0x0)
mmap$auto(0x0, 0x400008, 0xdf, 0x9b72, 0xffffffffffffffff, 0x8000)
close_range$auto(0x2, 0xa, 0x0)
executing program 0:
r0 = socket(0x10, 0x2, 0x0)
close_range$auto(0x2, 0x8, 0x0)
socket(0x10, 0x2, 0x4)
socket(0x10, 0x3, 0x6)
sendmsg$auto_NL80211_CMD_GET_REG(r0, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000300)=ANY=[@ANYBLOB="72010000", @ANYBLOB="120027", @ANYBLOB="5de1"], 0x1ac}}, 0x40000)
read$auto(r0, &(0x7f0000000000)='$-]&@\x00', 0x5)
executing program 6:
mmap$auto(0x0, 0x2020009, 0x3, 0xeb1, 0xfffffffffffffffa, 0x8000)
mmap$auto(0x0, 0x4, 0x4000000000df, 0x40eb2, 0x402, 0x300000000000)
socket(0xa, 0x801, 0x84)
msgsnd$auto(0x900, &(0x7f0000000000)={0x2, 0x5}, 0xf54, 0x80000001)
openat$auto_kernfs_file_fops_kernfs_internal(0xffffffffffffff9c, 0x0, 0x1c2b02, 0x0)
prctl$auto(0x12, 0x1, 0x6, 0xfffffffffffffffe, 0x4)
executing program 0:
unshare$auto(0x40000080)
socket$nl_generic(0x10, 0x3, 0x10)
socket$nl_generic(0x10, 0x3, 0x10)
mmap$auto(0x0, 0x400008, 0xdf, 0x9b72, 0x2, 0x8000)
close_range$auto(0x0, 0xfffffffffffff000, 0x2)
mmap$auto(0x0, 0x40009, 0xdf, 0x9b72, 0x7, 0x28000)
socketpair$auto(0xf, 0x7, 0x8, 0x0)
r0 = socket(0x10, 0x3, 0xb)
r1 = openat$auto_kernfs_file_fops_kernfs_internal(0xffffffffffffff9c, &(0x7f0000000080)='/sys/kernel/slab/kmalloc-64/total_objects\x00', 0x2400, 0x0)
read$auto_kernfs_file_fops_kernfs_internal(r1, &(0x7f0000000180)=""/250, 0xfa)
setsockopt$auto(r0, 0x104000000000010e, 0x1, 0x0, 0x16)
close_range$auto(0x0, 0xfffffffffffff000, 0x2)
openat$auto_proc_pid_numa_maps_operations_internal(0xffffffffffffff9c, &(0x7f0000000040)='/proc/thread-self/numa_maps\x00', 0x20000, 0x0)
open(&(0x7f0000000000)='./file0\x00', 0x161342, 0x100)
socket(0x1d, 0x2, 0x6)
futex_waitv$auto(&(0x7f0000000000)={0xfffffffffffffffd, 0x7e4, 0x2}, 0x1, 0x0, 0x0, 0x623d)
io_uring_setup$auto(0x2, 0x0)
r2 = openat$auto_tty_fops_tty_io(0xffffffffffffff9c, &(0x7f0000000400)='/dev/ttyS2\x00', 0x101e81, 0x0)
ioctl$auto_TIOCSETD2(r2, 0x5423, 0x0)
close_range$auto(0x2, 0x8, 0x0)
socket(0x23, 0x80805, 0x0)
socketpair$auto(0x4, 0x1, 0x20000, 0x0)
r3 = openat$auto_tty_fops_tty_io(0xffffffffffffff9c, &(0x7f0000000400)='/dev/ttyS2\x00', 0x101e81, 0x0)
ioctl$auto_TIOCSETD2(r3, 0x5423, 0x0)
ioctl$auto_TIOCVHANGUP2(r2, 0x5437, 0x0)
executing program 5:
r0 = semctl$auto_IPC_STAT(0xf, 0x2, 0x2, 0x8)
r1 = prctl$auto_PR_SET_NO_NEW_PRIVS(0x26, 0x9, r0, 0x6, 0xda8)
r2 = openat$auto_sg_fops_sg(0xffffffffffffff9c, &(0x7f0000000000)='/dev/sg0\x00', 0x400040, 0x0)
lseek$auto(r1, 0x4, 0x2)
r3 = prctl$auto_PR_SET_NAME(0xf, 0x4, r0, 0x4, 0x81)
r4 = syz_genetlink_get_family_id$auto_thermal(&(0x7f0000000080), r1)
sendmsg$auto_THERMAL_GENL_CMD_TZ_GET_TEMP(r3, &(0x7f0000000240)={&(0x7f0000000040)={0x10, 0x0, 0x0, 0x1000000}, 0xc, &(0x7f0000000200)={&(0x7f00000000c0)={0x110, r4, 0x200, 0x70bd26, 0x25dfdbfe, {}, [@THERMAL_GENL_ATTR_TZ_ID={0x8, 0x2, 0x2}, @THERMAL_GENL_ATTR_CDEV_MAX_STATE={0x8, 0x12, 0x2}, @THERMAL_GENL_ATTR_CDEV_CUR_STATE={0x8}, @THERMAL_GENL_ATTR_CDEV={0xcc, 0xf, 0x0, 0x1, [@nested={0x4, 0xd9}, @nested={0xc1, 0x76, 0x0, 0x1, [@generic="e67cbd765535320bb721f053ce5b6bf16aa71ebf81d4d5b0fa3b48c2041dadaf53333c066446b22b964d5ee30e9600f92198f80cf5ef55d87dc2c02358171d103e4417da88d25b864f66c730777d668d066bb96b175ab76bdb8a4ab173b78649b941bc899c5f388745ac343a5f8e85946c41ba14cda7e6acd76befeca2afda478efaa1ca27f711b41e85ef65debf32ccf2ffd8be145d9d59b3f290cf38c2ae0f858a972483d7da5fd9ca8d2fe6fcb6bdc6a62aa4db2c4d9367070742ba"]}]}, @THERMAL_GENL_ATTR_THRESHOLD_TEMP={0x8, 0x1a, 0x2}, @THERMAL_GENL_ATTR_TZ_GOV_NAME={0xf, 0xe, '-,{{\\(##.$*'}]}, 0x110}, 0x1, 0x0, 0x0, 0x80}, 0x850)
madvise$auto(0x1, 0xf, 0x9)
r5 = openat$auto_proc_fail_nth_operations_base(0xffffffffffffff9c, &(0x7f0000000280)='/proc/self/fail-nth\x00', 0x240042, 0x0)
fadvise64$auto_POSIX_FADV_DONTNEED(r3, 0x4, 0x6, 0x4)
r6 = getsockopt$auto_SO_MARK(r1, 0x7, 0x24, &(0x7f00000002c0)='/proc/self/fail-nth\x00', &(0x7f0000000300)=0x7fff)
setsockopt$auto_SO_ATTACH_REUSEPORT_EBPF(r6, 0xcf, 0x34, &(0x7f0000000340)='\x00', 0x3)
timer_create$auto_CLOCK_MONOTONIC(0x1, &(0x7f00000003c0)={@sival_ptr=&(0x7f0000000380)="be293c4f6a7407458de90e000146812641314dd429d426538eb87881a8dd", @raw, 0x4}, &(0x7f0000000400)=0xffffffff)
madvise$auto(0x4, 0x8, 0x5)
openat$auto_tracing_stats_fops_trace(0xffffffffffffff9c, &(0x7f0000000440)='/sys/kernel/debug/tracing/per_cpu/cpu0/stats\x00', 0x40000, 0x0)
ioctl$auto_BTRFS_IOC_SNAP_CREATE(r1, 0x50009401, &(0x7f0000000480)={@inferred=r5, "b054b7b57308300340ed802ae20ec1d8f00876883702f074918367146fee8b4026d4b0801429e78762e266570309f2b5fa0ceb5bfe5b79aa318b878efa9cba71dd2bf0e75e11949f89ad73b6aabdbd0d8d6a34fd54da1c02d5261271090e364dbefed860940ce2e47f1b7cbe11f28aed80064fc66b2911b0ba7e90b34e7eede686b1885aada364347e5ad87029dfd798741ba88aa50ecf5206d4acee8bb8101250c6cae9211900a0bb8a6a772b3088d8657950ce125c7855cfbaba7123376de40fdd812062ca46e11ec47c2c0b7b39a401f43eed39a3c369a888f067365b26b7f36145c8d54236904922bb04110b3575ad44ca2751e6c332b743d821fa3b342a769e0d9a4e7817965c8587fef82ede49b05f2fff436da9fb2a38fe344868fe26b6b03b427a36dbae88ef21c0c8627f5a79e883bf069ec10b0a39bdc631ce96219bf6c3a821a5861e855ed91af601a3fc2cc425ffdc3bf613bd2842a7b0e941eca9a6b5e61a1fa9e72d8ecc4be9a829737ca878ad1c4161434405f5c12de634c8723151394c437b19615ca9fa9dc53829c03f63695926409b81e81775269e13e46916c6dce115d7535ebb7986d04d0e6506707fce81bafa94fcbe9b0115a487e2051eb5c32aefb218d0e6a79ee7829bf1a384e6a529fa6a6eb2a846f97cd69ec1feceb3d100165362e28c5c8886f5dd9116eb18b7aab67cec251053b044266d9117cb02f463a151383afcd0c22ffa3d7bac9ddf3fe823a2ecbcb0143f777ad7bb6a8e5b8eabd38d5f900b1ef393d0e3e205f27e12c09f68a3b22125a2ab8b9b0c9e578028c7afb9a5aba4ee4dc621e5a6a9a1d8fa05a33464bfd87f9c09530f5451e47999080d3e37013d5225b571c131f51f2fede90b933b6b94a33c3975e850482c298dd703c9c426aa5df8ca1f9b2fd45d8c5094c6eeaca5e9eaa39757361554b027c17aeec6c949f49ec133e3aba14e9d131ab6fe17ac7a702d8395069acc64ded113db649e79b0797cadf4a09108e854e421ed3ba06c966199f61dd56821a32cdf93488d2ee9c88a196fd8546f13dda65859dfd0685a368f7be74097082d58e1d43ad1ab5637778f887ee1ccffd30b67991450dcf720f3f56ef3fa9cdf4c582ebd42092e04c1b039dc20bab01fd9b0a97b95316e3c36e88172544fba87d7444bbb5454f630b2c66e2636ade1014850697ed10e8ae170e883c5e889fa4c5b45b73b27731c3991ea46d778cae89cc0b481e3bd06b208696fff729a8db49878e13062aa24c5ba1c2a8c556b9fb8cf6238cbec2f2c980fd3fee3708ec6614137269805aef61ae4730a7e04e0a43a5462da7ab004fd710284f18c9c4eab74d0544704842e3a60e5453a47bb162bbf7a1674dc8ced553da7e37fa53aa994286803393a8d3165685502c83f5c36bb55fe2861069538ba8929b0d1df00400dec38d829a483396eb724c715b0154b344ffd0f9ed7af56f4cb4053f613919e2269af04f2c02bc40403f4c7069a935576958e82d13fd3e63c749cb66af73258f659721da7647a7cab85d11fc34409f94a2c4c9ec25d03650ad0e355c3191f6a5d1b721814535de27260c31b6db845f4e3c675f8f824f6244a1608f641fe864ef2a2a3074e0f0f8e90941199758ef3066a71979e6a6042224a8d686c3e4f2f00f73ac46eb9b8f4b4dee53eba78ec3136afab07ebd8fe930a522a7fa34c8a1a0d34b48fa6475413b8113ca903c143b151c06da5c57476f16e39cd9b50dade84f58b140fc3439e6a63f11e02ce8ddd9d05c92f583d60c58b22f75315fbebb2e2f38ef26b53d989c81027815273a570a13423b98d87763dbe3a3786639f374233ab52cf1b61ed6fea8bba9345f0cc72c1853eb4719858d6e118ffa46f8b29a091b12bdeb731aeb0d31c746a5e654184660bac656d50c4ffbd5a4c14df08ae3e2c4a905259a47f9797d41160085ae44b9800375cee7e80ae68aebe6980b610dbac4090c213ce27b66700534fd7b9301d1f40ff117b54b0caa541fdcdcbf91ae7e342c1f249dbea25b497197a3f2fdb6485dde2f88315d8388a023fbf56263e3dd5ba31fc074ca2142506268cbc69e92302e5f6d07543272a111a6a19a6190334de3f0658e586f6d6201633f3e9c5dd2f4923ad5b76478f30cd96fc00f200b1fd6b64660a677ed56674813ddbc62079ef93872ee35545cd898dc682290544ff41be4ca8f30ed48cfa6bf89a1dcb9ee7f3595f6acce6903e7a5d40c96276c595071c55aea7b8abd3e608468155a637cb85d64d072a06193844e98da59d1a2f4442c474f7e53e96f448392c1171dbf5b8c48961998d61f87c2fee8ca051b4fe6e75eaba6ae660e03eab726cb1b3318751a43123d51e45e40dfb9ca475ef0542b06276169a712f23b82a4750c6ceed8e3e23e02e6f0d910c38ed8bbe68fccf0248facee3f854119868351afc6302dbc3df8431b880a6f400719938701c2f83fd687071f58799d8c35337b8a2ae7cb21ba7f63a49b09df650e739f86aa39c6028150c30405e72ca300083e4ac7b3abb6aece2341b106ef53f7d6970c6acbc7f13aa93fdc73bbd899c9ae1419e022b2dc788b1937fb94db9824b7e68a4c6356ea57c6be8e574798f2a2fa8dd4e5ecb3003a2330de58506e419715e080099965092eaae79653f727ddfa20154100ff810c0a0e576e82e846db4d4b38271b274101237ec6fdb30b5ef4f6767bba91fe54180712ffb296fdc7fb9b71fc47210203f5a27e2565d018c50f395e017100ed35447c6176e237b07c1f42276849464a6d69ccc6b6d7181c9b211a3d0c29c1f7157b44ee0fb063fe7d39147d1e4d966e3b8eb9f8cc4c27b93741cb6d99a8bbff4e9b31b88b0700603ee888ef878b56f7a76cd038b39fb3cfa78e0769bd012e5e2cb3b8c9be91239e288a2688a86236bd161faa8c29d651717bb9854a36f975268266936ad78f398b001b1c6acfbacb8a84431fb66f099d79fd4af586c949c97b0fb4bd4c58f9640eac01e5bfc3eda4e51cbe2010d9774f0ec84ba7fe5df45dc60b6ca817e35a74895b84b692fc7d63a153c0f015e321edc3c59f9af3fac1c8e7e13f706914cd9a817462ec9c5a7840b96aad7888d84a9d02787529fc06645c8b7580ae0fe2f5d8708a689377e6ebdae290399898b8c6508ba9eb63c5ca29505409b8f6056cc06ffe3c12f40925c62edd36fc62a399b65eda0c8113db93d958d976b098fd1af9ae1c0788117537d0f7bc5369916919e4be23626a7b2d5493f845c08b5f0e4baa809cd06b1ce015a380fb5e513355b7ee1674a7af0d88387e9254695417eda7b1d0c0c182d318d138cc7d5668fd9a8a2008d707455e97f4eaa296ac3ec2835afa136cef0bce851d73738f7d810570506ed090a1bc0a13fa8ba150abbb8c53629a8e2e52b0123f0ac8c025b73615d7f467164d231532caaceca0268ddc4c194ddec6c95bfa57717e47251fc238f63ee76c052384175d6a71306503c994c0a957309b0b441f8b0a8c000db194943b959646fd004e8488a8c8f7db6bee9a37e0073baea766e7269bfcd550a1553d37cd032fdbcee322996fb3b7b482f54e1f525620a426c5a8031012c4eb6ccf293ebe62eb12732b40e622f638ce3d00cfdb184b41a53a32a491d3769aee55bf9d5205e553b72bcdea981919e79a9666934f43061bec93adbc1c2bc5dedcdde3235cd439cf6b18028ce06cc19d381b08981178a18a9047bf9034e6135be24a037c6776131eb9bafae6657b964bc19043364ab41173fd091ad844a2763148c7704647a629c41bf9e7d80a49387fef429c5a90ed672df226684f8ff275786724699d82bb12eb58b414417110cb37c234c48f855f285b6aa13579d71158262571b1f9b5aa20963f5346fc0de90ee9d6092e3cbc1ef00ac04895051785263ca93f2ceeb02b01f4ff744701db215db5cd31d0d5964c8a9da15021cfcee3d804711f306dc6f7ace3232c9bffa409746f4060fd7d3911b43b5b9cdbbec8cd0ed12b5e76996893eeabdd4f15a67a6bfcd6fee80ea592bec65541e33eb1e3cdef38c4d192d936d8f964e5e914b187bff52ea8538e7c2077ddd7eb72a02402283db9498b84a9f12b6d6fbdf2b23abd897a0b91b2d5528aa310a3bb9a1617d68b2f27371ff1868bf29237e894a828508d111895b21b8823ef680a84dd8cbaf0db81f4fd45ab89e51b0d7005097bb6d774dd281f13632c10edb5365837cfd2d69e843ec73fb5da0fd5ce08ec1c6d3f8dc1acf976c13d4e5d2844aec49213692b18a1cf0f8d4f3404a0860657f36dc7cfc461c653270b78f80e09c8be5b6e9e83596882d59f7ad7148da88fc125777f3a40244d083ab401072e2837ee773c26fa20197220d4f53902cf58b13baa21645791c4ea3d19f8ae897fcf9d5344364c3267414d7854153672a5dea2143515d821a775a3cbba2fb22b9d09ad8bbb9117d19a74e09b777cbd3a8352f05b06c386570860fbf65a5b5fb23c7d0299f0a7540e34246861414027586006d7df7974be30e062c9cdadb340c9921e8ecb8650c444265bfde678d5786c6dbec322976a7d17b268ca1ff5ddbd0296a59dc7c499a09ceac0bf62129fcaa2340c7ee1432e255e7cda55df0a75f08e1159bb0206f4a1e20402f5c0e71774f486ec50a8ac6a1db2538891119bd7e0117bde783cb032edba454cd8eaccb49e341ae9528cc29cefbf4e912ab79a1ef0363cd91330f69f4e90826659beca3479bb37b4679b35734a100909ef8b5f11b147f2da28f9d0bf48e98dde6e1969f8b8d99b64cf019a46116d902d0e8f5929ab82fd338ff23604e4bbf9bbe6c30c17e6a9c8803cda27ab35115609c54198e4a5defebebe8d26c58c5355d98c5a6cf3c3e3a0e85a51af9711b00b0b13406ff6d2d62ec558bb0e3b687c1029379b6076fa19c3070477d047d8744954f44164f4f5e04a459a45c2cb7c95457bb245949fdee86ff6538079ff573a16f6627237652a7db2d7b809076af4a07d940165c080f1f32049325fba2f552f032c98a7ec7f3b545c81612e25576ae9445885d6cd25ccfb1efbd371a8670a62976d5bec5de8c58be941319a4ca5738e337d686a6d641ed5f445c53f9e362d003d8bed2afc088191ffd688f9beae9e52b1d8197cca832651de09222c67987f0d5b44218524d2f0b6e364231a7038c97ac622f2adfa303e393b7d04a569a53f34e036c421870d2f14d2007eb4065ea5553ad83aaa36c1f77537affa68be9b2d1e18300696531b7d33b33e3b9e87fbc988f158836765a66988b4c0d98dd0d65d1ff1b3e4e1bb129287237092b008e81972f929e06bce222f89433a90a109491274f641720ca0f4521b6572804437cdfd8b6e7f67b3b25ebd9a749aa7318dc59bd5133751bf19015a9411af04c8a07e738b7b0103117d54dba9032fa40898927f1d520e787bb47a3853a0bcb3a80b4903f53356df6e8c188af988683284b871f3e058895c62d06df2302fbf57dc2430283113234cd432610d088e408f2563dc60f1eb42e9b554aaa492204635e25f4552c44a343eee39c3071b9045e0f5b75fe8080be0da8cccfa667b124eae0b44a845c1ab39f58e55f0b856d939abb427506ebe6f1a5389bbe819ea4f50a9db17f774aaec7659609f0bf508a8723fd5e4a95969a60fd7dc91113966bc34c30f92c59256cbe886f109a1cc6b07504aba6b3e096f8cbe6b795063f11e47f1c7c766959c684e729bdef064e7f2f3cfc43feb598e088671bfc7ba9534ec5fdd55b56cf641bbfe5ad2b226032b1"})
mmap$auto(0x8000000000000001, 0x7ff, 0x0, 0xfffffffffffffffb, r6, 0x7)
ioctl$IOCTL_GET_NCIDEV_IDX(r3, 0x0, &(0x7f0000001480)=<r7=>0x0)
connect$auto(r2, &(0x7f00000014c0)=@nfc={0x27, r7, 0xffffffffffffffff, 0x1}, 0x2)
r8 = semctl$auto_SETVAL(0xba, 0x2, 0x10, 0x8)
ptrace$auto(0x4, r8, 0x8, 0x5)
waitid$auto_P_PGID(0x2, r1, &(0x7f0000001500)={@siginfo_0_0={0x0, 0x3, 0x5, @_rt={0x0, 0x0, @sival_int=0xe}}}, 0x0, &(0x7f0000001580)={{0x253, 0x9}, {0x200, 0x4}, 0x8, 0x7f, 0x2, 0x0, 0x2, 0x1000, 0x8, 0x2, 0x3, 0x2, 0x9, 0x8, 0x1, 0x1})
mmap$auto(0x6, 0x3, 0x4, 0x3f, r6, 0x6dabfa32)
r9 = syz_genetlink_get_family_id$auto_nl80211(&(0x7f0000001680), 0xffffffffffffffff)
sendmsg$auto_NL80211_CMD_GET_REG(r1, &(0x7f0000001740)={&(0x7f0000001640)={0x10, 0x0, 0x0, 0x100000}, 0xc, &(0x7f0000001700)={&(0x7f00000016c0)={0x28, r9, 0x8, 0x70bd28, 0x25dfdbff, {}, [@NL80211_ATTR_STA_LISTEN_INTERVAL={0x6, 0x12, 0x6}, @NL80211_ATTR_WPA_VERSIONS={0x8, 0x4b, 0x8001}, @NL80211_ATTR_TX_NO_CCK_RATE={0x4}]}, 0x28}, 0x1, 0x0, 0x0, 0x80}, 0x0)
ioctl$auto_SG_GET_RESERVED_SIZE(r1, 0x2272, &(0x7f0000001780)="4d1d72bb5f31bf01a18b3b27c79a2cba6aa6c975293d02108bc87a736c3c79e63702debd8b1747a2e2953dc56c66b4f041e0c45415aab531e5dc1441ff6a6200067257abc735a5cb381dc2ed4faa395bc931e6ffeb68f9fd8273a3ba177cf025e9b31149a55323889681d7")
r10 = syz_genetlink_get_family_id$auto_netdev(&(0x7f0000001840), r1)
ioctl$sock_SIOCGIFINDEX(r3, 0x8933, &(0x7f0000001880)={'caif0\x00', <r11=>0x0})
ioctl$sock_SIOCGIFINDEX(r6, 0x8933, &(0x7f00000018c0)={'\x00', <r12=>0x0})
sendmsg$auto_NETDEV_CMD_DEV_GET(r3, &(0x7f0000001bc0)={&(0x7f0000001800)={0x10, 0x0, 0x0, 0x10000}, 0xc, &(0x7f0000001b80)={&(0x7f0000001b00)={0x64, r10, 0x4, 0x70bd2a, 0x25dfdbfc, {}, [@NETDEV_A_DEV_IFINDEX={0x8, 0x1, r11}, @NETDEV_A_DEV_IFINDEX={0x8, 0x1, r12}, @NETDEV_A_DEV_IFINDEX={0x8}, @NETDEV_A_DEV_IFINDEX={0x8}, @NETDEV_A_DEV_IFINDEX={0x8}, @NETDEV_A_DEV_IFINDEX={0x8}, @NETDEV_A_DEV_IFINDEX={0x8}, @NETDEV_A_DEV_IFINDEX={0x8}, @NETDEV_A_DEV_IFINDEX={0x8}, @NETDEV_A_DEV_IFINDEX={0x8}]}, 0x64}, 0x1, 0x0, 0x0, 0x40800}, 0x20000880)
executing program 6:
bpf$auto(0x5, &(0x7f0000000000)=@test={0x12, 0x1, 0x0, 0x9, 0x1, 0x3, 0x3da1, 0x0, 0xb4, 0x7, 0x140000000000, 0xdb, 0x7fffffff, 0x10, 0x1}, 0x171)
r0 = socket$nl_generic(0x10, 0x3, 0x10)
r1 = syz_genetlink_get_family_id$auto_batadv(&(0x7f0000000080), r0)
ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000240)={'batadv0\x00', <r2=>0x0})
sendmsg$auto_BATADV_CMD_GET_MCAST_FLAGS(r0, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000280)={&(0x7f0000000200)=ANY=[@ANYBLOB="1c000000", @ANYRES16=r1, @ANYBLOB="afa72db57000ffdbdf250e00000008000300", @ANYRES32=r2], 0x1c}, 0x1, 0x0, 0x0, 0x300}, 0x20000000)
executing program 4:
openat$auto_seq_oss_f_ops_seq_oss(0xffffffffffffff9c, &(0x7f0000000080)='/dev/sequencer2\x00', 0x2, 0x0)
r0 = socket(0x11, 0x3, 0x9)
capset$auto(0x0, &(0x7f0000000000)={0xb213, 0x2c, 0x800})
openat$auto_fb_fops_fb_chrdev(0xffffffffffffff9c, &(0x7f0000000100)='/dev/fb0\x00', 0x2, 0x0)
openat$auto_tty_fops_tty_io(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ttynull\x00', 0x201, 0x0)
r1 = openat$auto_loop_ctl_fops_loop(0xffffffffffffff9c, &(0x7f0000000440), 0x20100, 0x0)
ioctl$auto_LOOP_CTL_REMOVE(r1, 0x4c81, 0x0)
mmap$auto(0x0, 0x400008, 0xdf, 0x9b72, 0xffffffffffffffff, 0x0)
write$auto(0x3, 0x0, 0x7fffffff)
openat$auto_stat_fops_(0xffffffffffffff9c, &(0x7f0000000140)='/proc/stat\x00', 0x2, 0x0)
read$auto(0x3, 0x0, 0x80)
mmap$auto(0x0, 0x4020009, 0x6, 0xeb1, 0x401, 0x8000)
mmap$auto(0x0, 0x7, 0x1000000004, 0x9b72, 0x2, 0x100)
openat$auto_proc_iter_file_ops_compat_inode(0xffffffffffffff9c, 0x0, 0xc0000, 0x0)
listxattrat$auto(0xffffffffffffffff, 0x0, 0x7ffffffe, &(0x7f0000000380)='\xdf^\xe2o\x87D\x10\xa0\x0e1\xb5B\xd6k]Yh\x99\xf4\xbcy.8\xcd\xf2I\xcc\xf5\xc7\xee\xb8\xea\xb7+\xd8K\xf1\x1aI\xe6(\x9f\xaeS\xf1\x199\x1fk\x01\xf36\xe1 \x1a+\xcd\xfc6\xc7W\xeaw7\x1b\xf4\x01\xebQ\n\x94{\xb5\xa7/\xa3\xa7\x16\x82\x1c\rEqd\xf7~\xba{\x8f7S\x82\xed\x8es\x02W\xdc\x16l\xee\xf1\xd9\x83\xc8', 0xe9)
statmount$auto(0x0, &(0x7f0000000180)={0x8, 0x1, 0x1, 0x3, 0xf, 0x940, 0x1ffde, 0x3, 0x6, 0x8000002, 0xff, 0x5, 0x5, 0x4, 0xb0, 0x7, 0x2, 0x3, 0x5, 0x7, 0x0, 0x0, 0x0, 0x0, 0x0, 0x80000009, [0x0, 0x4000000000000000, 0x10000, 0x243efbdf, 0x0, 0x0, 0x4000000000000, 0x0, 0x0, 0xffffffffffffffff, 0x9, 0x0, 0x0, 0x0, 0x0, 0xfffffffffffffffd, 0x0, 0x9, 0x0, 0x0, 0x0, 0x0, 0x800, 0x0, 0x0, 0x9, 0x0, 0xfffffffffffffffc, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff, 0xfffffffffffffffc, 0x0, 0x0, 0x0, 0x0, 0x0, 0xe6e, 0x0, 0x0, 0xfffffffffffffffe]}, 0x1fe, 0x81)
close_range$auto(0x0, 0xffffffffffffffff, 0x2)
sendmsg$auto_OVS_VPORT_CMD_DEL(0xffffffffffffffff, &(0x7f0000000200)={0x0, 0x0, &(0x7f00000001c0)={&(0x7f0000000180)=ANY=[@ANYBLOB='<\x00\x00\x00', @ANYBLOB="11002d"], 0x3c}, 0x1, 0x0, 0x0, 0x8000}, 0x8000)
r2 = socket(0x10, 0x2, 0x0)
sendmsg$auto_NL80211_CMD_GET_REG(r2, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000280)={&(0x7f0000000180)=ANY=[], 0x1ac}, 0x1, 0x700}, 0x40000)
sendmsg$auto_NL80211_CMD_GET_REG(0xffffffffffffffff, 0x0, 0x40000)
sendmsg$auto_NETDEV_CMD_DEV_GET(0xffffffffffffffff, &(0x7f0000000080)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x400000}, 0xc, 0x0, 0x1, 0x0, 0x0, 0x24048000}, 0xc0)
ioctl$auto(0xffffffffffffffff, 0x13, 0xffffffffffffffff)
io_uring_register$auto(0x2, 0x0, &(0x7f0000000000), 0x3)
mmap$auto(0x0, 0x400008, 0xdf, 0x9b72, 0x2, 0x8000)
mbind$auto(0x2000, 0x100000004, 0x100000000, 0x0, 0x6, 0x2)
syz_clone3(&(0x7f0000000400)={0x9840100, 0x0, 0x0, 0x0, {0x31}, 0x0, 0x0, 0x0, 0x0}, 0x58)
mmap$auto(0x0, 0x40009, 0xe2, 0x9b72, 0x7, 0x28000)
openat$auto_kernfs_file_fops_kernfs_internal(0xffffffffffffff9c, &(0x7f0000000080)='/sys/devices/LNXSYSTM:00/LNXSYBUS:00/PNP0A03:00/device:08/adr\x00', 0x0, 0x0)
sendmmsg$auto(r0, &(0x7f0000000400)={{&(0x7f0000000000), 0x5aa, &(0x7f00000000c0)={&(0x7f0000000040)="661b", 0x49}, 0x1, &(0x7f0000000200), 0x5, 0x3}, 0x4}, 0x2, 0x100)
executing program 6:
sendmsg$auto_NL80211_CMD_GET_REG(0xffffffffffffffff, 0x0, 0x0)
socket(0x2, 0x80002, 0x73)
socket(0xa, 0x1, 0x84)
ioctl$auto(0x3, 0x8905, 0x38)
ioctl$auto_TIOCMSET2(0xffffffffffffffff, 0x5418, 0x0)
setsockopt$auto_SO_DETACH_FILTER(0xffffffffffffffff, 0x6, 0x1b, &(0x7f0000000140)='/dev/audio1\x00', 0xf)
r0 = openat$auto_tracing_pipe_fops_trace(0xffffffffffffff9c, &(0x7f0000000100)='/sys/kernel/debug/tracing/per_cpu/cpu0/trace_pipe\x00', 0x101801, 0x0)
setsockopt$auto_SO_DETACH_FILTER(r0, 0x6, 0x1b, &(0x7f0000000140)='/dev/audio1\x00', 0xf)
openat$auto_binder_fops_binder_internal(0xffffffffffffff9c, 0x0, 0x1, 0x0)
socket(0x28, 0x1, 0x0)
r1 = openat$auto_posix_clock_file_operations_posix_clock(0xffffffffffffff9c, &(0x7f0000000080), 0x40400, 0x0)
ioctl$auto_posix_clock_file_operations_posix_clock(r1, 0x40103d02, 0x0)
sendmsg$auto_NL80211_CMD_TRIGGER_SCAN(0xffffffffffffffff, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000240)={&(0x7f0000000180)=ANY=[], 0x14}}, 0x4000000)
openat$auto_seq_oss_f_ops_seq_oss(0xffffffffffffff9c, &(0x7f0000000080)='/dev/sequencer2\x00', 0x2, 0x0)
r2 = openat$auto_snd_rawmidi_f_ops_rawmidi(0xffffffffffffff9c, &(0x7f0000000000)='/dev/snd/midiC2D0\x00', 0x1, 0x0)
openat$auto_proc_sys_file_operations_proc_sysctl(0xffffffffffffff9c, &(0x7f0000000000)='/proc/sys/fs/pipe-max-size\x00', 0x382, 0x0)
sendmsg$auto_NFSD_CMD_THREADS_SET(0xffffffffffffffff, &(0x7f0000000100)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000040)=ANY=[@ANYBLOB='$\x00\x00\x00', @ANYRES16=0x0, @ANYBLOB="00042cbd7000fb3d89cb809172a33200030080004000880001"], 0x24}, 0x1, 0x0, 0x0, 0x20008010}, 0x400d0)
sendmsg$auto_NL80211_CMD_GET_REG(0xffffffffffffffff, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000040)=ANY=[@ANYBLOB="72010000", @ANYBLOB="1a0027"], 0x1ac}, 0x1, 0x0, 0x0, 0x4000804}, 0x40000)
r3 = socket(0x10, 0x2, 0x0)
sendmsg$auto_NL80211_CMD_GET_REG(0xffffffffffffffff, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000300)={&(0x7f0000000040)=ANY=[], 0x1ac}, 0x1, 0x0, 0x0, 0x44814}, 0x2004c0c4)
sendmmsg$auto(r3, &(0x7f0000000200)={{0x0, 0x0, &(0x7f0000000100)={&(0x7f0000000080), 0xfc2}, 0x2, &(0x7f00000001c0), 0x7, 0xa505}, 0x800}, 0x7, 0x8)
write$auto(r2, &(0x7f0000000400)='/dev/audio1\x00', 0xa3d9)
select$auto(0xe, 0x0, 0x0, &(0x7f00000002c0)={[0x1ff, 0x7, 0xd, 0xa00, 0x948b, 0x2, 0xfffffffffffffffc, 0x6, 0x3, 0x300000000000000, 0x80000001, 0x5, 0x6d3c, 0x5, 0x2]}, 0x0)
madvise$auto(0x108000, 0x800034, 0xa)
unshare$auto(0x40000080)
msgrcv$auto(0x0, 0x0, 0x2, 0x1, 0xb2)
msgsnd$auto(0x0, &(0x7f0000000000)={0x3, 0x45}, 0x8, 0x9)
executing program 5:
openat$auto_snd_pcm_oss_f_reg_pcm_oss(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/dsp1\x00', 0x20b42, 0x0)
read$auto_proc_reg_file_ops_compat_inode(0xffffffffffffffff, &(0x7f0000000280)=""/65, 0x41)
mmap$auto(0x0, 0x4020009, 0x6, 0xeb1, 0x401, 0x8000)
prctl$auto(0x1000000003b, 0x1, 0x4, 0x5, 0x7)
socket$nl_generic(0x10, 0x3, 0x10)
close_range$auto(0x2, 0x8, 0x0)
sendmsg$auto_NETDEV_CMD_DEV_GET(0xffffffffffffffff, &(0x7f0000000080)={&(0x7f0000000140)={0x10, 0x0, 0x0, 0x400000}, 0xc, 0x0, 0x1, 0x0, 0x0, 0x48000}, 0x0)
mmap$auto(0x0, 0x400008, 0xdf, 0x9b72, 0x2, 0x8000)
close_range$auto(0x2, 0x8000, 0x0)
sendmsg$auto_HSR_C_GET_NODE_STATUS(0xffffffffffffffff, &(0x7f0000000200)={0x0, 0x0, &(0x7f00000001c0)={&(0x7f0000000140)={0x68, 0x0, 0x200, 0x70bd26, 0x25dfdbfe, {}, [@HSR_A_IF1_AGE={0x8, 0x3, 0x200}, @HSR_A_IF2_SEQ={0x6, 0x7, 0x4}, @HSR_A_IFINDEX={0x8}, @HSR_A_NODE_ADDR_B={0xa}, @HSR_A_NODE_ADDR={0xa, 0x1, @broadcast}, @HSR_A_NODE_ADDR={0xa}, @HSR_A_IF1_AGE={0x8, 0x3, 0x38}, @HSR_A_IFINDEX={0x8}, @HSR_A_IF2_AGE={0x8, 0x4, 0x4}]}, 0x68}, 0x1, 0x0, 0x0, 0x40080}, 0x40090)
socket(0x2, 0x3, 0x100)
socket(0x10, 0x2, 0x0)
sendmsg$auto_NL80211_CMD_GET_REG(0xffffffffffffffff, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000200)={0x0, 0x1ac}, 0x1, 0x0, 0x0, 0x4004810}, 0x800)
sendmsg$auto_NL80211_CMD_GET_REG(0xffffffffffffffff, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000180)=ANY=[@ANYBLOB="720100", @ANYBLOB="13"], 0x1ac}}, 0x4004)
sendmmsg$auto(0x3, &(0x7f0000000080)={{0x0, 0x2, &(0x7f00000002c0)={0x0, 0xc4}, 0x1, 0x0, 0x0, 0x9}, 0x7}, 0x3, 0x0)
executing program 0:
mmap$auto(0x0, 0x20009, 0x4000000000df, 0xeb1, 0x401, 0x8000)
prctl$auto(0x22, 0x40, 0x0, 0x7, 0x7fffd)
clone$auto(0x20003b46, 0x2, 0x0, 0x0, 0x2)
prctl$auto(0x10000000024, 0x2, 0x2008, 0x4000000c, 0x80001)
openat$auto_vmwgfx_driver_fops_vmwgfx_drv(0xffffffffffffff9c, &(0x7f0000026d00)='/dev/dri/card1\x00', 0x2000, 0x0)
mmap$auto(0x0, 0x202000b, 0x3, 0xeb1, 0xfffffffffffffffa, 0x8000)
r0 = io_uring_setup$auto(0x401, 0x0)
socket(0x26, 0x80004, 0x73)
socket$nl_generic(0x10, 0x3, 0x10)
socket$nl_generic(0x10, 0x3, 0x10)
socket$nl_generic(0x10, 0x3, 0x10)
socket$nl_generic(0x10, 0x3, 0x10)
ioctl$auto_SNDCTL_DSP_SETTRIGGER(r0, 0x40045010, &(0x7f00000000c0))
clone$auto(0x4, 0x7, &(0x7f00000000c0)=0x1, &(0x7f0000000100)=0xff, 0x7ff)
mmap$auto(0x0, 0x2000b, 0xe2, 0xeb1, 0x405, 0xfffffffffffffff9)
clone$auto(0x3fff, 0xad3, 0x0, 0x0, 0x7fffffff)
wait4$auto(0xffffffffffffffff, 0x0, 0x80000001, 0x0)
sendmsg$auto_GTP_CMD_NEWPDP(0xffffffffffffffff, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000180)={0x0}, 0x1, 0x0, 0x0, 0x8000}, 0x4040804)
lstat$auto(0x0, &(0x7f0000000180)={0x4, 0xb, 0x6, 0x76402f57, 0x0, 0x0, 0x0, 0x4, 0x40000000000f, 0x400, 0x40000402, 0x4, 0x9, 0x4, 0x9, 0x7, 0x20000010010b})
r1 = socket$nl_generic(0x10, 0x3, 0x10)
dup3$auto(0x8000000000000001, 0x5, 0x800080000)
ioctl$sock_SIOCGIFINDEX(r1, 0x89fc, &(0x7f0000000040)={'bridge0\x00'})
socket$nl_generic(0x10, 0x3, 0x10)
socket$nl_generic(0x10, 0x3, 0x10)
eventfd$auto(0x3)
eventfd$auto(0x0)
r2 = socket(0xa, 0x2, 0x0)
bpf$auto(0x0, &(0x7f0000000000)=@link_update={r2, @new_prog_fd=0x4, 0x4}, 0xa3)
setsockopt$auto_SO_WIFI_STATUS(0xffffffffffffffff, 0x0, 0x29, 0x0, 0x9)
getsockopt$auto(0xffffffffffffffff, 0x6, 0x3, &(0x7f0000000140)='bridge0\x00', &(0x7f0000000240)=0x6b96)
executing program 5:
mmap$auto(0x0, 0x20009, 0xe2, 0xeb1, 0xffffffffffffffff, 0x8000)
close_range$auto(0x2, 0x8, 0x0)
socket(0x8, 0x2, 0x9)
r0 = socket(0x2, 0x1, 0x0)
r1 = socket(0x2, 0x1, 0x0)
bind$auto(0x3, &(0x7f0000000040)=@in={0x2, 0xffff, @remote}, 0x6a)
listen$auto(r0, 0x7)
sendmmsg$auto(r1, &(0x7f0000000140)={{&(0x7f0000000040), 0x12, 0x0, 0x9, 0x0, 0x1, 0xb}, 0x800009}, 0x5, 0x20000000)
r2 = openat$auto_proc_reg_file_ops_compat_inode(0xffffffffffffff9c, &(0x7f0000000000)='/proc/asound/card1/pcm0c/sub7/sw_params\x00', 0x0, 0x0)
pread64$auto(r2, 0x0, 0xffe, 0x0)
executing program 5:
r0 = socket(0x10, 0x2, 0x0)
close_range$auto(0x2, 0x8, 0x0)
socket(0x10, 0x2, 0x4)
socket(0x10, 0x3, 0x6)
sendmsg$auto_NL80211_CMD_GET_REG(r0, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000300)=ANY=[@ANYBLOB="72010000", @ANYBLOB="120027", @ANYBLOB="5de1"], 0x1ac}}, 0x40000)
read$auto(r0, &(0x7f0000000000)='$-]&@\x00', 0x5)
executing program 5:
mmap$auto(0x0, 0x400008, 0xdf, 0x9b72, 0x2, 0x8000)
socketpair$auto(0x1e, 0x5, 0x8000000000000000, 0x0)
r0 = openat$auto_vmuser_fops_vmci_host(0xffffffffffffff9c, &(0x7f0000000180), 0x6b2c03, 0x0)
ioctl$auto_IOCTL_VMCI_VERSION2(r0, 0x7a7, 0x0)
ioctl$auto_IOCTL_VMCI_INIT_CONTEXT(r0, 0x7a0, 0x6)
ioctl$auto_IOCTL_VMCI_CTX_ADD_NOTIFICATION(r0, 0x7af, 0x0)
ioctl$auto_IOCTL_VMCI_CTX_ADD_NOTIFICATION(r0, 0x7af, 0x0)
futex$auto(0x0, 0x6, 0x8, 0x0, 0x0, 0x80000001)
openat$auto_binder_fops_binder_internal(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/binderfs/binder0\x00', 0x80, 0x0)
mmap$auto(0x0, 0x2020009, 0x3, 0xeb1, 0xffffffffffffffff, 0x8000)
select$auto(0xfffffff3, &(0x7f0000000100)={[0x5, 0x400, 0x4, 0x3, 0xea47, 0x101, 0xa, 0x3ff, 0x4, 0xb4be, 0xfffffffffffffeff, 0x5, 0x3, 0xfffffffffffffffd, 0x40, 0x80]}, 0x0, 0x0, 0x0)
r1 = openat$auto_kernfs_file_fops_kernfs_internal(0xffffffffffffff9c, &(0x7f0000000080)='/sys/devices/LNXSYSTM:00/LNXSYBUS:00/PNP0A03:00/device:08/adr\x00', 0x0, 0x0)
read$auto(r1, 0x0, 0x20)
r2 = openat$auto_proc_fail_nth_operations_base(0xffffffffffffff9c, &(0x7f0000000000)='/proc/thread-self/fail-nth\x00', 0x802, 0x0)
writev$auto(r2, &(0x7f0000000200)={0x0, 0x7}, 0x3)
syz_genetlink_get_family_id$auto_tipcv2(&(0x7f0000000300), 0xffffffffffffffff)
mmap$auto(0x0, 0x4020009, 0x6, 0xeb1, 0x401, 0x8000)
r3 = openat$auto_proc_reg_file_ops_compat_inode(0xffffffffffffff9c, &(0x7f00000000c0)='/proc/self/net/fib_triestat\x00', 0x0, 0x0)
pread64$auto(r3, 0x0, 0x200000000006, 0x5)
r4 = openat$auto_kernfs_file_fops_kernfs_internal(0xffffffffffffff9c, &(0x7f0000000080)='/sys/devices/LNXSYSTM:00/LNXSYBUS:00/PNP0C0F:00/status\x00', 0xa140, 0x0)
read$auto_kernfs_file_fops_kernfs_internal(r4, &(0x7f0000000000)=""/112, 0x70)
sendmsg$auto_NL80211_CMD_GET_REG(0xffffffffffffffff, &(0x7f0000000240)={0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x40814}, 0x2004c0c4)
executing program 6:
mmap$auto(0x0, 0x4020009, 0x8000000080000000, 0x17, 0x401, 0x8000)
madvise$auto(0x0, 0xffffffffffff0005, 0x17)
openat$auto_clear_warn_once_fops_(0xffffffffffffff9c, &(0x7f0000000100), 0x210800, 0x0)
r0 = openat$auto_tty_fops_tty_io(0xffffffffffffff9c, &(0x7f0000000000)='/dev/tty46\x00', 0x0, 0x0)
close_range$auto(0x2, 0x8, 0x0)
socket(0x10, 0x2, 0x0)
socket(0x2, 0x6, 0x0)
mmap$auto(0x0, 0x400005, 0xdf, 0x9b72, 0x2, 0x8000)
socket(0xa, 0x5, 0x84)
bind$auto(0x3, 0x0, 0x6a)
ioctl$auto(0x3, 0x800005411, 0x38)
ioctl$auto(r0, 0x5600, 0x0)
mmap$auto(0x6, 0x400005, 0xffffffffffffff00, 0x9b72, r0, 0x8000)
close_range$auto(0x2, 0x8, 0x0)
socketpair$auto(0x1, 0x2, 0x8000000000000000, 0x0)
r1 = openat$auto_force_devcoredump_fops_hci_vhci(0xffffffffffffff9c, &(0x7f0000000c40)='/sys/kernel/debug/bluetooth/hci0/force_devcoredump\x00', 0x2, 0x0)
write$auto(r1, 0x0, 0xe)
mremap$auto(0x0, 0xffffffffffffffff, 0x3fd6, 0x3, 0x7fffffffb000)
mmap$auto(0x0, 0x400005, 0x800000000000df, 0x9b72, 0x2, 0x8000)
madvise$auto(0x0, 0xffffffffffff0001, 0x15)
r2 = openat$auto_proc_clear_refs_operations_internal(0xffffffffffffff9c, &(0x7f0000000600)='/proc/thread-self/clear_refs\x00', 0x2, 0x0)
mmap$auto(0x0, 0x8, 0xdf, 0x9b72, 0x2, 0x8000)
setitimer$auto(0x4, &(0x7f0000000000)={{0x1ff, 0x10001}, {0x200000000004, 0x6}}, 0x0)
openat$nci(0xffffffffffffff9c, &(0x7f0000000000), 0x2, 0x0)
bpf$auto(0x12, &(0x7f0000000000)=@info={0x2800, 0x1ff, 0x2}, 0xcf)
r3 = socket(0x10, 0x2, 0x0)
sendmsg$auto_NL80211_CMD_GET_REG(r3, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000300)=ANY=[@ANYBLOB=' \x00\x00\x00', @ANYBLOB="1200", @ANYBLOB=']'], 0x1ac}}, 0x40000)
recvmmsg$auto(r3, &(0x7f0000000380)={{0x0, 0x1, &(0x7f0000000000)={0x0, 0x400}, 0x4, 0x0, 0x200002, 0x8}, 0x803}, 0xfffffff9, 0x10010, 0x0)
write$auto_proc_clear_refs_operations_internal(r2, 0x0, 0xffffff4b)
socket(0xa, 0x3, 0x3a)

program crashed: KASAN: slab-use-after-free Read in force_devcd_write
bisect: bisecting 45 programs
bisect: split chunks (needed=false): <44>
bisect: split chunk #0 of len 44 into 3 parts
bisect: testing without sub-chunk 1/3
testing program (duration=6m7s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): [16, 30, 26, 15, 24, 24, 30, 5, 6, 30, 2, 30, 15, 30, 26, 5, 25, 6, 6, 25, 30, 5, 30, 27, 15, 30, 10, 6, 22, 30]
detailed listing:
executing program 2:
r0 = openat$auto_kernfs_file_fops_kernfs_internal(0xffffffffffffff9c, &(0x7f00000002c0)='/sys/devices/virtual/block/ram3/queue/iostats_passthrough\x00', 0x80302, 0x0)
r1 = socket$nl_generic(0x10, 0x3, 0x10)
r2 = socket$nl_generic(0x10, 0x3, 0x10)
r3 = syz_genetlink_get_family_id$auto_l2tp(&(0x7f0000000640), 0xffffffffffffffff)
sendmsg$auto_L2TP_CMD_TUNNEL_CREATE(r2, &(0x7f0000001040)={0x0, 0x0, &(0x7f0000000280)={&(0x7f0000000000)={0x5c, r3, 0x1, 0x70bd2d, 0x25dfdbfd, {0x1, 0x0, 0x3f00}, [@L2TP_ATTR_OFFSET={0x6, 0x3, 0x7}, @L2TP_ATTR_PROTO_VERSION={0x5, 0x7, 0x58}, @L2TP_ATTR_CONN_ID={0x8, 0x9, 0x8}, @L2TP_ATTR_PEER_CONN_ID={0x8, 0xa, 0x8}, @L2TP_ATTR_IP6_SADDR={0x14}, @L2TP_ATTR_IP6_DADDR={0x14, 0x20, @ipv4={'\x00', '\xff\xff', @local}}]}, 0x5c}, 0x1, 0x0, 0x0, 0x4c019}, 0x0)
r4 = getpid()
process_vm_readv$auto(r4, &(0x7f0000000080)={0x0, 0xfff}, 0x1, &(0x7f0000000280)={0x0, 0xffffffff}, 0x6, 0x0)
r5 = openat$auto_nvmf_dev_fops_fabrics(0xffffffffffffff9c, &(0x7f00000004c0), 0x101202, 0x0)
write$auto_nvmf_dev_fops_fabrics(r5, 0x0, 0x0)
write$auto_nvmf_dev_fops_fabrics(r5, 0x0, 0x0)
prctl$auto_PR_SET_MM_START_STACK(0x95, 0x5, 0x0, 0x0, 0x6)
stat$auto(&(0x7f00000000c0)='./file0\x00', &(0x7f0000000100)={0x9a, 0x100, 0x8, 0xb, <r6=>0xee00, 0x0, 0x0, 0x2, 0x3, 0x5, 0x3, 0x7, 0x5, 0x3, 0x0, 0x4, 0x6})
sendmsg$auto_TIPC_NL_KEY_SET(r1, &(0x7f0000000380)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x2000000}, 0xc, &(0x7f0000000340)={&(0x7f0000001080)={0x1810, 0x0, 0x800, 0x70bd28, 0x25dfdbfc, {}, [@TIPC_NLA_PUBL={0x1780, 0x3, 0x0, 0x1, [@typed={0x4, 0xa0}, @typed={0x8, 0x13e, 0x0, 0x0, @fd=r2}, @typed={0x8, 0x51, 0x0, 0x0, @pid=r4}, @nested={0x1ae, 0x134, 0x0, 0x1, [@generic="3f74007cf8216c93f7f106e28c20943f34e65ec832411016497e483652e7550fe0101174f511f2ed4c9f171e443ecf965a3393ce09132ebbe53e6507a8b14ec350bff171c838d43899f7d5d8fef51c2ab2d10a1b3845d9fa42a03ce6c6fefa2022d1879ab3a78248fed9e8dea2691a521a57e1e2aa1812c7b13b56b781ed7dadf92ed58728dfc3d9a8f70d2a65117d1d9b0346dfb5680f89128236a8f783953c6e64dbc879b166554bbec4343328e89bf966", @nested={0x4, 0xb2}, @nested={0x4, 0xe3}, @nested={0x4, 0x6f}, @nested={0xe4, 0x72, 0x0, 0x1, [@typed={0xdf, 0x5c, 0x0, 0x0, @binary="8639085f4dab6f652f0c8731f21b5f4ff470001bc7872f6a894ffd577d0c5128b65d6fb4b18be68f28113a0d9d7ef8781a8a996ad4d0f5bd89e31fe08798fc115855735af81c8790d23457d0d28915f4f13dba152d344d0ad27f602309a122a3ac1328226702917fee850b82a3a77b6c40f16c0c60b06f9b1da972938e3c909972fbba8a4db784634003a79b6b71cf0221443639ddf3b695c2d8d60693564eeab5454db2920546961073d1c329ccad9b99e19a6fdd105eb5d1b953b0924441d890ce9fcb2aa90211cf34e16864c975e821c44743d6c340aa392443"}]}, @typed={0x8, 0x68, 0x0, 0x0, @ipv4=@dev={0xac, 0x14, 0x14, 0x1d}}]}, @nested={0x15b7, 0x1, 0x0, 0x1, [@nested={0xea, 0x7f, 0x0, 0x1, [@generic="30f498d8ba7ccbb263ea2b1c70913a51bd4f945e562bbb203751f199f9311aa60fb5a2dab43c8f8b86483a132046a0da12eea866c552a027f855466c8f444b60d2d9d6665f6c2e6be94c87d88c31960151cb3b90e53b69ba5de75df1617bafeba6e850f7e2ede1fcc7c8dec6490f2e04ad7dadcd89ce6c67bd48a8e8242f7a9977878fa7444f9fe6555117a073c921160e4b3292d44e921bf94eb5cc7d0f51b8930bc53f2d3e6ac53aa3be3297f45e62f9f189b8c2b7dfd57005fb0c27576074c77fdd149ead1bfdfb4329b040cf16e285104a0c22e41008f7c224d3e12b", @typed={0x8, 0x62, 0x0, 0x0, @pid=r4}]}, @typed={0x9, 0x83, 0x0, 0x0, @str='\xf9})\xb5\x00'}, @typed={0x8, 0x136, 0x0, 0x0, @uid=r6}, @typed={0x8, 0x23, 0x0, 0x0, @fd=r2}, @nested={0xe2, 0xd, 0x0, 0x1, [@generic="45b415df6e1efa332ab11a6e453257f273132fa34bc8b77a0d6b0c7ace8513803f5a1cb1156876b226d39869c85fe3b170e9ad58466bde972b84191d99a5ab41cb05f0b588fc5619873d504c0835c7c9c23374340000030ad94793888c151a6b8cfe4dbeb7544d8d4ddc", @generic="5b1f3f84a94bbf3a01986e1334d365b98ddd4f9a80da80394ef62301da97aa0a0baed54b5dd24d9909ad25f3946e3012f8f6dde3c65f28d9c7955654a055980d47ef68a9c5755f56266527580e9500eae0f1c663f765769e83b92b32801eadfa2fc352f435f07e28874d9ca11884149f79583385"]}, @nested={0x1d4, 0x4b, 0x0, 0x1, [@generic="37e71a544d1fd1f6d3863c9044a067eedad18784b7347ca7d4a3ac6757b28a6ff331c3acf8ec679be8f9c2566a61d28bea9bbf4b9018566163bd231a424e35964da54e43e9b608ce1f224e35466f356904f4729773aa495d6628d74f309a09a4c4f7796e4ab435eef7424b582f8c273d8ab251499ead1f07d58abd38cce5314d120f98cbd9395e95449eecea5687e9a6197490813990534a179967bc6b689ef46551290c6efe80b25b3d44c7bb45a46276ec1edc9303f64c04935674aeff1f28b2eec759db3104917c24f49bff6678aeca5e0319332a01385a", @generic="8375f0b5247ed3d6921813a6a10f081d686680d361d51386e07c5f5a09d25806f67eee9e15ddb3ea11cb16a2df220bb34d166d70a42fb754c086f71405246cfb3d008917c29ea104205e2e521bbab2291970d68c45b5f3bea7720c966a1ce4d63f8f6ca0860b652b5497613e2eabee57cf1b335176110e32ab252ca7adbe0573ed48a31ea091cab9321eb6242a07357aaa9adfbeb9a36598697edfe70966877db021003a6d2efe1a0019bb8b144f59424c4d248b69c32400418c5f312dad674ccd07f7d35371bafc60d1bbd86334320c67ad33a4e51bd925628786", @nested={0x4, 0x1d}, @nested={0x4, 0x105}, @nested={0x4, 0x20}, @typed={0xc, 0xde, 0x0, 0x0, @u64=0xf202}, @nested={0x4, 0x1d}]}, @generic="3db2dea5ae6f1c330670f4c839e550fdd362b4fd3eb77a7f6720b6f8773053a3b5bf33e60485ddb9e8de06a9050e4dec0463807c383d24be4c90ae70c9b5e2ec6b640b7cc3de7b0b4313241a7ebc5e2f7314494657918f058c09927283cbacbb19f46b3890665b527c1c002ee94f491454377ef0281582edafc68ac8d76f8c2d340ad2f07d505d84d019c7e0cbbdf1df82adead52c7a8e33567a1e48376a9c9081e37131b8070db74a5a7f547be2adbc0271fcc7c6082ea6a92e22003b8362a77151f89b5f8924da98767d004dff7507b6c2928b28f48acc00a5b2c89dc4ec51c0679d2d0f3c7f5405fdc37f467df0d7a4e503958a0bd29405ec55cf737c94a258c775c3b8b126204d68752c8214d55970a029cac48b021f2a5374871fae934f1cfc15a3c49792ac84f89cdbed122fb91b648a91ea1eb807ba20397556e191c2ddb987ff500fcf3dd2f232bd79e61d486d3fc5e19049bff76a9e1df67285b2dc1e112a27fa42a35a1b2ee8b57d3618c3298a999aefe527e24a9122249be58c499e6cfa1d912c36e01c02e1457b0088fd03c04f87e33bf7cf906683e4c4a2fc804b2233f63b58ce259494a9ca378f39b7c4d25a8340ebb233e4f2083e59efd0f65f21128d917f3b4d5cce592a35b52dfd86300b9c01f7f2a2b97f7fe487cbb09707f130c08942f4a4878bb90122df1139754bd161510f7d0cb4372b70e6934bf8cf77397450866ba350dd50890280e442d5fcad909dde13aea60b6a1d72fca35a624977d5b6e36ba0fc683301a78b3caedb3a728649e03efa2b64522f753dcd6fa43d5e142aeed05a45f02cf89e909b65d24f492cb872db8457c0307fd78db25afb4be57450ac7dc5675e6657dbc382853fd20f68de75c20a7bd22760e5d1dace835c719d1fcc9e0fc1503b2832e8d291ad1fe8325ab6eb8271ca73aafa5decf4620f3d13655e463be3b58102a023d26f9595698b88ca5d5a2e27072c95e44a52ac2f0aeaea9c3e2f50e420f28da204242ede123aa3136ceb13e7963099c2e36208592088ec5f7bc3bc81604ba179ab3244f2c75c3a17764b1ea6d4f16cbf6f921de77d89685fc7c767348ba753944f4e6acb3fff7d7e2c14d272dd8b0d65275693ce970c19c1b9ab25240bb81de7035a1cf5d49fc941af6c46ae31d0c693ddfc15796781c2c93544f8eee398ac65157155a8d3e820fc83d5469ac0a0753332f32d471202dedf9329ecccecb293ace723fb2516a90053cca718dce686056f139e825476d4007021460217ad1472158bf6320eee5bbcd8d45930fac59209c4abb04a341e394129f3bd75a488ed9118a65a3328f1cd5c2556b1da01abf48752fff081bfbc63cd2b25788917dc8563aea774dd46c9facf127e88c07209bbd71aeba29028fba467daf489eef52c123021c0e62357e103c4e42e0c29406525ed9efaf75478e802b4093d0ae0c7700b81a5773365776bbd751a93abb97072e497238aaf6f7c59d17fb9cb89e32b9d13413b62ae869f6a98030c63722ba4089384cd7f0b4b4cb65de2bee537f700b053afd7cd5248e6dab99140d6ea7b235fca2cf75ee4e98e1d236f8ca0d4b29624c220597508efdad7afe0f18d3a3457ea5eaf36064a6d72facd8c6bf4c8104bdd8d11421defd8f5dbbfb43f6b4dab5546225240852f339122184a8c331a495cf36423a52a7dff9461d7ac1dae4a7da523607b4473a2a5189c4179daeabe10405887b70ad83fc390289ad89035a04ab077c2563d7d2bd14ee4e9c76e213fd8fc9a3ca4aaab98c2795b565a525c665361a0276f1d1622f6606b46620b1f12c1ab420548c00d8f8cbe0370cd11646b31e7f406efcbf823636f625659b44ae390da6200869c48b88d82b7fce5eca4df70795c36d6249d6a07a62757f77fcf20f48bf0aa0d2fffc3fd12a9f175580a04ddccf21c131f6aeb3ac670431859073d1e06cbb25e7b45c8b0288e9aa29ba172469022322748af09d787e7f1709a9db35e40100746b390233f4112c40e3cd83a77411ca321ef3e336840779e89ea83633b8feef38867b1dad8077a4315cd617ab409fd6898569857c512963fb63f469b176a57b70c62686ec7bbc29c954682029bf6c75df7caa85a943965290bfad738b7f8c5ead8e133af39bfa9a0c29bc751399e8ea401505af6cde1b39c7f4e0fd10adc4f31401578494ae72dc86bb9bcf9136d9fca5847b08f4f4821d19bf28aed830e6c57b59740d6692d693268d83c0b559a963a1a723ed9e189261fd6d97592d49d8b8d58960bc0c2e8aaeb3b268cf96059b0dd480726543be6155dfab263eacc4ed773c28a53cf62a584e55eac04c1ad91ea62d6e92ab5450af90d546d25849ee4a4636d89f735a8411febfdd40cc85767d494d4c5bedc70f59ff482f473cf3b2795cc7bee41871943f908de5fd4fe879a5a1aeae64c9b69f52be9cfb5a11411d9cc1dc20e5e88329cc17731447a7bf201c807ee13acd5e1c1884f08890e924e7883d89f15b9814f6ff919697647828dfe1a172b5d1167415cd8f32cf6b511ae2c03b1492bcd5a8a2fb85fba2e998d772e3cca76b4b81d62e628a7a25678cc3a6cf556d43087732077e3fa61d193d49efbd1c29432c211244e1731a08a171507f0d63ae4c60b01533cdf81713340c9f474c4fbaa6eb801212d2f0cf65b394da4a25ff89d5696b3123f56e26f5f1e95d2c055c73fbbaeb63fc5fcde99a88f959b109170fe1fa2b837fc07dff9f94c95fefa1a7a870bf4fedbd099176accf500534711e1c4d389bcef19e7144d8cf9519b2d44a8ebe5da7c4e89861261e69df204524db99530affcc3f890cd857028e8a5330cf3667118360f198d3211cef7d9bb02090eba7f36ec16f385978be0c486d46a1ca5c8de4822c2c70d8203edd983127bf1a37edc38e96ebb9fedc18e706a1bab959c07e282926c206f6e9f00c9b1f7cee5492cde227fd92483beed255913c301c9ed217c8b1bac85a1eef438094bcc64e6a9a4c7e2fbd0cdeed9cc68dc50b49694d78a3fbcd9e206d95fd081054ba543a6041122b702e84ef59bc6b3554dbb436cb7404ee5e6fb3410f2d5f94da1a43e170a5e7f9118e3a9f764b6d6b3e52f314aace23df883415e1bdeb96e8b21328987731192ccb7e785bcd43df7c6555a03255ae8eb28c5a20477e2c6b077c5a073a107333fb43c22d36fe4bf66a84b83efb424a2bfe5f406bd05e43baaf4c6cc4a96797d5da7c0782f048b071e974f419097ddd4785ba6e2b5e7088cfeb0ffad6a36989409666265bbcfece2d8eb601e6c95dc8aca77a2df99a46ea363a38144e7c957aa666bb42f2e97a0b3197cbbb3c0d5d35cd9b4044162738c47fcb8a78c46da6802dafedb8ba69f0a653bbb9649e77b1107b62e2357a8c11bcf82798b7db847de03589946089a66938d690f7c7ae20d1cb9c9401ae911f698f13e8090b9b09a40e7c7c1065ede2e72c369cdeb9d7501ab3d2190b566fada98efcdebbad6066c2f72ee3e4cc021e08d11f9378095f78532e1c994ede51792b32f76456af8b9fcc3b07f9e3a04f9e7e641e5454985f53ae0c2e1f5f3021eb1098c4ffb435c155fb34345771df10d9cffdd8840f2c1e7c41e85725c839111466f57fc1fea9753715cb05d354ac0c9ca3595854f4c2df213227d6e86b4ececce31d380caf0b36b252a0c39c73b9a6f6729dfcc4b49b450da30c9c29d7bcebc60a86faaf337bebccf8f5392c6cbf7c7fafe6c0b828c12a9eca2474bfdc0a29829a3f73fbfcd123a8afaee3f9f9ddff79683aa40ed943712544fc186eb066778090594571b074b5f2b3afbdb491a3f6dcfe4bd4b524391829dbbbd73e36e8bffcd22aaccb49a4f831fa6731f1d618354d4a700cc1ea0506bddf76f2fc720539981b00f1744ddc33bfc965599cc7c3cdbb2596684c300ae65703c1196659a6e15ebbde08e87ea889c00996054f9d99df98367df40342b75a7c142f13cc9b97c0dec556e69a9737c485ad6b0522944094de584661e5279eebdad5a48d822d74f37ab91e50d4aefbfcef9466132aba8875bd18d987bcc4edf6790c8eaf22dcef8a053a3d4d39218934bca578d708315aad24868c706fa34c85699a308ae39a881dfcf86fd1d0b30f6494180acadad637c72850c7be3a0dd3aa71614c566e17f3783653ae64dc1317b0069feb62c3b1a34ff18bc1f1013cec721338714afdf8a7db2f917e075f2de8a6ceba096bc4e6e142b0a335e6663fd82cb95265ca24375094570a4297a579b589849e14f0875cfbbb92c0f191e93bebfd158b56096b3b68e3273a497e7147cb148a65804d39cc3799d87ae26ad7a245f8a483dbaf10a5fd477927235cbfa0b31e1d633302f8989da5c9afd4ea6e93f6a017b3b9f45400f5b9c0115fbac884a33ea815ddae71327d0371eed762b56d0e5faafbc275726adc639645edc94bf28633f1bd30d62101edc959f312c14c65300586950c9eaf31426f1419f64e6f1918739b34a013df9fa724b14650c4c693823096bbfef32619a4f4aa4588c45d453485fd2234e8ca17bee9fad440631977682563033c153a709d794a788661348d28b97b1861adb7ad75177b1662363020587760f32ec937cf1073dce02721d3375370cc68366fc40226ca0c81ae4160e8eaeade80b673b0edd48c4bfc0663526df1eeb0c5391a9b1f2235e1731efe92aa6ff4f0363cce74128c347c0327bda48caa87f31bc5dd7528db4a81e923f546b4b760fd94562f750dc225b0caa149383ad7b6798d1d56cc17cea0ef5689abead36afa42792f44081823cbcf4fe7bfd15df6de5930f102130c3a749a1439e11bf34d024820c10d71b8c2cc8eb0e9ad587439c5a2e1aa2f32efd620c75a8bdb65fdf4f3494fb23241548321edcfa72573c29071d50cdf19adbe9f520d83dd45994b4bbd828bd157b5b9a1b42428118994a2ac14cadbea3446852db1ffd6f8e61471028243bb9355483fcb621feae842e94f94ec9f7bcdf9af6f8638c4949e612fb6d1d4e218be9487b77a5d2daaf68a6488a8f18ac9f37a25543dc6080dfd17903ed005273200371332ea51d75f7a7e2c8b413eaf099201b565653ce7a1e98dfd8ca953da58d5fa04c5cd3244c480c96f0c4e4c0f0284ed8c70b954e6a26c9a852437fd31df867892250af5db38d4fae3b5e7f55fc2b669004fb1fc46b1bacf522756ab6234e011a80043b39bcd60f991cf116a658b33c9960f6e8c6c63ab48415f2441896ce5fe302899964217054460192cad0926ee2374be57f500b5326c9272123b7d977251748a122597eb5d19382f7f4d6ac361f259a372fbb736e95dfed4a832b9d77a997598f431dbf615580f2ce4adc6f3cf72e4ef647cb870afbed67b803ba88e6ef4134454308e5d68fba6643cdf07170188ac36a165317e1e1ff1ccae0c04b6df2dfab2dd784e9e7f2194b8e85b1d98efb7e4885a55783995ba9e74f2b231ddc2d9c0c5d9322d0ec3ccb5510d75bc00c8a9fc2b9fd9c3f315e1b259e71cccb58645db60fcf550fd15bef87712f8b27aea1197b45afc78fa37679553bae82b9c913a8b9c742dff6e6f5f5bfcaf49b72812653a835ad59ccfb2b7be59301efecbbab8c758252f471dbcd38329059dde96b3a2160ec978eccbb2f017db037f26286ae64b988a1734f87503ca89407b7c7ea9855dbefebc49d1dc691c8521c76e3bc0d3bb2c6ff1ac90e441c228aa5b2453f6ad794bc9bb9c57d18b55f4203ded793600c76801524c5f96238176ed553887981ca2b29661c45b92f236f211cf5ad87eb7325df", @typed={0x8, 0x117, 0x0, 0x0, @pid=r4}, @generic="7848392974b3c06a0ee27f7affa7a40607c7f0a2361822dffd7623956feadd6cb6ff3739725ef9e7aa540617688bd74ba7d7a7a6b4b71e6c03fab9a092704f34e04a5fdd87c4a2ac2a20d547216225be36853e2e69269e1cd9e469fe0d95bcfe8ec6cebf55079a29d22173b07c5afaa1d9921b3fc953f1183b9473970bd1bd1b3a83207cb26476d651f45c72104a4a1b1b6a6b60fc06331dc917b25fd84c0c8ffb7d72b2134b2b05c805195a1629a79badb6e383dff974291f566e319a8dc5547e93590f67a23b80a5236d612e20bd291ac31a482a12964cbacaacf2f6d12077ebc28a593b25afcaad91c96b4e83e5d1164db2", @generic="c92ccdad86ab559b20c76a0e6876ad09b40528860beb76a40c3748f83b08735023fc623d3176c1ca2eaf02f52ea8a5f0a009cf3eaa69d978cfb3fb71657b0663d069ff3418702ebca2b92ca6f4718674028b5ee3a5e778175a3626fa95ee62389d30a8a8685bed79e6be1adf6d8e598c437b4976f0c6912f66a93b5a1bde97b1c8a7b472e42cad18992b00f5b7b9b1961e497d994a826760e18e76290b92ab3e8b25776a70a221d7d9ee9295c0a60e7ec0fc3171d07aa1b743f385f03d3ca6aebeac2b1bae4f0870f5a2c6289b7684cfe530d4abcbf1838ffea022b7c6ea68448ca7bac68359f9bdec78581c41cb7f1c751cfb1e8335946a"]}]}, @TIPC_NLA_NET={0x7a, 0x7, 0x0, 0x1, [@typed={0xc, 0x4b, 0x0, 0x0, @u64=0x2}, @generic="bb645bc1680e23ef9375f4ba97b28d2fa6883639aa178ff52e3f5816b4e289841d2f18d11780f0b2993944eeac4a6e1e0e24e1e7617241de0e34dfb219e277911f360a2049ad745e9562a0d645266e63fbca0d5e42d9fda7031dfb38300ff582707b8361c1560cbd8f62"]}]}, 0x1810}, 0x1, 0x0, 0x0, 0x4}, 0x4004810)
mmap$auto(0x0, 0x2020009, 0x3, 0xeb1, 0xfffffffffffffffa, 0x8000)
madvise$auto(0x108000, 0x800034, 0xa)
sendfile$auto(r0, r0, 0x0, 0x3)
executing program 2:
mmap$auto(0x0, 0xe983, 0xdf, 0xeb1, 0x401, 0x8000)
sendmsg$auto_NL80211_CMD_GET_REG(0xffffffffffffffff, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000200)={0x0, 0x1ac}, 0x1, 0x0, 0x0, 0x4004810}, 0x800)
bpf$auto(0x0, &(0x7f00000001c0)=@test={0xffffffffffffffff, 0xffff, 0xfffff0b6, 0x5, 0xff, 0xac1, 0x2, 0x36242398, 0xfffff5b2, 0x3bb, 0x7, 0xffff, 0x800, 0x81, 0x68198}, 0x6f3)
r0 = socket(0x2, 0x1, 0x0)
close_range$auto(0x2, 0xa, 0x0)
r1 = socket$nl_generic(0x10, 0x3, 0x10)
socket(0x2, 0x3, 0x2)
getsockopt$auto(r0, 0x0, 0xcf, 0x0, 0x0)
r2 = socket(0x2c, 0x8180b, 0x67)
sendmsg$auto_NL80211_CMD_START_AP(r1, &(0x7f0000000740)={&(0x7f0000000480)={0x10, 0x0, 0x0, 0x4}, 0xc, &(0x7f0000000700)={&(0x7f00000004c0)={0x228, 0x0, 0x200, 0x70bd29, 0x25dfdbfb, {}, [@NL80211_ATTR_TDLS_OPERATION={0x5}, @NL80211_ATTR_PROBE_RESP={0xc6, 0x91, "b115c623f370c56f66e456048653950cf0eeda7ef15a981dcf6426abe06771909f0c689d6916de5759cd95f560b5c3e6e15bff365d33dab578ca3c52377279aa39baa39fa37d74c2ca190fd0e761869db0b8a6d12c1d6fa32744fceae6bbcbf12289ec19320c66a94bf68f03959a45dbb0eb013b32aaea2d15c03b2528245c77ad243fae4279281e7efe2137d9a895c480d01daceeb32eb1544dbba3381907ebef1d013ebb918b442034d27b9086282d5b6e527edb6410e9c9a2a3e2eb7a154c979b"}, @NL80211_ATTR_SCHED_SCAN_RELATIVE_RSSI={0x5, 0xf6, 0x10}, @NL80211_ATTR_MU_MIMO_FOLLOW_MAC_ADDR={0xdd, 0xe8, "f7523d62b236edacfea193cc0643de264f4a95bc101466455723af7209299a6e8d10a673e95297c7bbdb2f0d795f264cc30ace286c314b2d2243ba81e6c6324471d7d3ef2ac8e5e911f3921e3d36b349665f09672808971993adacd8ceb6d503b959383e804ca42b50497c33bcf21a8d1e70a3ca3804800e4f8fd6267e07f191ee0851d48b8d379b7a6120fd13de484ac83b774ba13ebae2ac030db2d87697191f6ab3c4c76e5bf59711bda8fdf7804205254490d595036f47d602e4c3bac1ce35f7d2158e3edfd56e98fccdb024731d0409e9249d0da042ae"}, @NL80211_ATTR_LOCAL_STATE_CHANGE={0x4}, @NL80211_ATTR_CENTER_FREQ1={0x8}, @NL80211_ATTR_MESH_CONFIG={0x50, 0x23, 0x0, 0x1, [@typed={0x4a, 0x13f, 0x0, 0x0, @binary="24bf0b1e106524fe2723887c2b056908df8d79f4fc1dcbf7886d5fd573fbd665d81e86799e2a7e728ef1bf4c1c79c5bf5a3f378727468f4c213251f73759df25d357d3b6821d"}]}]}, 0x228}, 0x1, 0x0, 0x0, 0x4}, 0x20000040)
sendmsg$auto_ETHTOOL_MSG_EEE_SET(0xffffffffffffffff, &(0x7f0000001700)={0x0, 0x0, &(0x7f00000016c0)={&(0x7f0000000100)=ANY=[@ANYBLOB="d4000000", @ANYRES16=0x0, @ANYBLOB="100027bd7000fbdbdf2518000000200001800247eea41fac000014000200766574683100000000000000000000000800070063fbffff0500060001000000840002803d00488013b37090badc49d6dc93876646d25a4d297d01cd3b7da38d12889cc50d505f353dc42d0a3c0a14c7b46428910708003600", @ANYRES32=0x0, @ANYBLOB="0400b3800000003d003b800400a4800c009a00008000000000000004008680c16ab1b1b39dcaa14b6af7dcc011b43cf706e562811c62b28a702b72e0a87126700294f2350000000c000180080003"], 0xd4}, 0x1, 0x0, 0x0, 0x20000010}, 0x20008000)
r3 = clone$auto(0x20003b46, 0x2, 0x0, 0x0, 0x2)
socket(0x10, 0x3, 0x0)
openat$auto_adf_hb_cfg_fops_adf_heartbeat_dbgfs(0xffffffffffffff9c, &(0x7f0000000040)='/sys/kernel/debug/ieee80211/phy1/netdev:wlan1/smps\x00', 0x20a00, 0x0)
mmap$auto(0x0, 0x2020009, 0x3, 0xeb1, 0xfffffffffffffffa, 0x8000)
sendmsg$auto_NL80211_CMD_GET_REG(0xffffffffffffffff, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000200)={0x0, 0x1ac}, 0x1, 0x0, 0x0, 0x4004810}, 0x800)
sendmsg$auto_OVS_PACKET_CMD_EXECUTE(0xffffffffffffffff, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000240)={&(0x7f0000000040)=ANY=[@ANYBLOB='@\x00\x00\x00', @ANYRES16, @ANYBLOB="1b0026bd7400fddbdf250300000004000800100003800c000980"], 0x40}, 0x1, 0x0, 0x0, 0x4004040}, 0xc800)
sendmsg$auto_NETDEV_CMD_QUEUE_GET(0xffffffffffffffff, &(0x7f0000003040)={0x0, 0x0, &(0x7f0000003000)={&(0x7f0000000040)=ANY=[@ANYBLOB="1c000000", @ANYRES16=0x0, @ANYBLOB="010600bd7000fbdbdf250a"], 0x1c}, 0x1, 0x0, 0x0, 0x20040004}, 0x20008810)
syz_genetlink_get_family_id$auto_mac80211_hwsim(&(0x7f0000000040), 0xffffffffffffffff)
sendmsg$auto_NL80211_CMD_GET_REG(0xffffffffffffffff, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000280)={&(0x7f0000000340)=ANY=[@ANYRES16=r3, @ANYBLOB="1a00"], 0x1ac}, 0x1, 0x0, 0x0, 0x81c0}, 0x1)
sendmsg$auto_NL80211_CMD_GET_REG(0xffffffffffffffff, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000040)=ANY=[@ANYBLOB="72010000", @ANYBLOB="19"], 0x1ac}}, 0x40000)
r4 = syz_genetlink_get_family_id$auto_nl802154(&(0x7f0000000380), r2)
sendmsg$auto_NL802154_CMD_SET_CCA_ED_LEVEL(r2, &(0x7f0000000440)={&(0x7f0000000300)={0x10, 0x0, 0x0, 0x2}, 0xc, &(0x7f0000000400)={&(0x7f00000003c0)={0x14, r4, 0xf08, 0x70bd2a, 0x25dfdbfc}, 0x14}, 0x1, 0x0, 0x0, 0x894}, 0x40000)
sendmmsg$auto(0x3, &(0x7f0000000080)={{0x0, 0x1c03, &(0x7f0000000000)={0x0, 0xc4}, 0x1, 0x0, 0x0, 0x9}, 0x1}, 0x2, 0x0)
close_range$auto(0x2, 0x8, 0x0)
open(0x0, 0x22040, 0x75)
r5 = socket(0x10, 0x2, 0x4)
sendmsg$auto_ETHTOOL_MSG_WOL_SET(0xffffffffffffffff, &(0x7f0000002cc0)={0x0, 0x0, &(0x7f0000002c80)={&(0x7f0000000180)=ANY=[@ANYBLOB=',\x00\x00\x00', @ANYBLOB="010027"], 0x2c}, 0x1, 0x0, 0x0, 0x4801}, 0x0)
sendmsg$auto_NL80211_CMD_GET_REG(r5, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000180)=ANY=[@ANYBLOB="72010000", @ANYBLOB="12"], 0x1ac}}, 0x40000)
sendmmsg$auto(0x3, &(0x7f0000000080)={{0x0, 0x2, &(0x7f00000002c0)={0x0, 0xc4}, 0x1, 0x0, 0x0, 0x9}, 0x7}, 0x3, 0x0)
executing program 2:
r0 = openat$auto_bsg_fops_bsg(0xffffffffffffff9c, &(0x7f0000000100)='/dev/bsg/1:0:0:0\x00', 0x0, 0x0)
r1 = openat$auto_tracing_mark_fops_trace(0xffffffffffffff9c, &(0x7f0000000000)='/sys/kernel/debug/tracing/trace_marker\x00', 0x201, 0x0) (async)
mmap$auto(0x0, 0x400008, 0xdf, 0x9b72, 0x2, 0x8000)
r2 = open(&(0x7f00000020c0)='./cgroup\x00', 0x0, 0x408)
getdents$auto(r2, 0x0, 0x400018) (async)
write$auto_tracing_mark_fops_trace(r1, 0x0, 0x1f00)
close_range$auto(0xffffffffffffffff, 0x8000, 0x8000000) (async)
openat$auto_tracing_pipe_fops_trace(0xffffffffffffff9c, &(0x7f0000003fc0)='/sys/kernel/debug/tracing/trace_pipe\x00', 0x20a02, 0x0) (async)
sendfile$auto(0x1, 0x3, 0x0, 0xc01) (async)
write$auto(r0, 0x0, 0x100082) (async)
r3 = socket(0x22, 0x1, 0x1)
getsockopt$auto(r3, 0x84, 0x75, 0x0, &(0x7f0000000000)=0x9b) (async)
r4 = openat$auto_tty_fops_tty_io(0xffffffffffffff9c, &(0x7f0000000000)='/dev/ttyS0\x00', 0x801, 0x0)
ioctl$auto_TIOCVHANGUP2(r4, 0x5437, 0x0) (async)
mmap$auto(0x0, 0x400008, 0xa, 0x10, r0, 0x0)
unshare$auto(0x40000080) (async)
socket(0x18, 0x5, 0x2)
mmap$auto(0x0, 0x8, 0xdf, 0x9b72, 0x2, 0x8000)
openat$nci(0xffffffffffffff9c, &(0x7f0000000080), 0x2, 0x0)
sendmsg$auto_NETDEV_CMD_QUEUE_GET(0xffffffffffffffff, &(0x7f0000003040)={0x0, 0x0, &(0x7f0000003000)={&(0x7f0000000040)=ANY=[@ANYBLOB='$\x00', @ANYRES16=0x0, @ANYBLOB="41004bbd7000fbdbdf250a00"], 0x24}, 0x1, 0x0, 0x0, 0x44884}, 0x20008810) (async)
capset$auto(0x0, 0x0) (async)
semctl$auto_SEM_STAT(0x7ff, 0x0, 0x12, 0x7fff) (async)
close_range$auto(0x2, 0x8, 0x0) (async)
r5 = prctl$auto_PR_RISCV_V_GET_CONTROL(0x46, 0x7fffffffffffffff, 0xffffffffffffffff, 0x8, 0x919c)
syz_genetlink_get_family_id$auto_nl80211(&(0x7f00000011c0), r5)
openat$auto_tracing_saved_cmdlines_fops_trace(0xffffffffffffff9c, &(0x7f0000001200)='/sys/kernel/debug/tracing/saved_cmdlines\x00', 0x72d102, 0x0)
executing program 2:
close_range$auto(0x2, 0x8, 0x0)
mmap$auto(0x0, 0x8c7, 0xdf, 0x9b72, 0x2, 0x8000)
socketpair$auto(0x1, 0x2, 0x8000000000000000, 0x0)
close_range$auto(0x2, 0x8, 0x0)
open(0x0, 0x163340, 0x2a)
socket(0x2, 0x80802, 0x0)
setsockopt$auto(0x3, 0x1, 0x3e, 0x0, 0x9)
mmap$auto(0x0, 0x20009, 0xe2, 0xeb1, 0x405, 0x8000)
r0 = openat$auto_fb_fops_fb_chrdev(0xffffffffffffff9c, &(0x7f0000001c80)='/dev/fb0\x00', 0x20401, 0x0)
ioctl$sock_SIOCGIFINDEX(r0, 0x4600, 0x0)
r1 = openat$auto_fb_fops_fb_chrdev(0xffffffffffffff9c, &(0x7f0000001c80)='/dev/fb0\x00', 0x20401, 0x0)
ioctl$sock_SIOCGIFINDEX(r1, 0x4601, 0x0)
connect$auto(0x3, 0x0, 0x55)
setsockopt$auto(0x3, 0x0, 0x1, 0x0, 0x9)
sendmmsg$auto(0x3, 0x0, 0x3, 0x0)
executing program 2:
r0 = openat$auto_uinput_fops_uinput(0xffffffffffffff9c, &(0x7f0000000000), 0x101001, 0x0)
mmap$auto(0x0, 0x4020009, 0xdf, 0xeb1, 0x401, 0x8000)
r1 = clone$auto(0x4, 0x80000001, 0x0, 0x0, 0xfff)
move_pages$auto(r1, 0xd0, 0x0, 0x0, 0x0, 0x2)
mmap$auto(0x0, 0x4020009, 0xdf, 0xeb1, 0x401, 0x8000)
close_range$auto(r0, 0xffffffffffffffff, 0x2)
socket(0x10, 0x2, 0x0)
socketpair$auto(0x1, 0x1, 0x8000000000000000, 0x0)
socket(0x2, 0x1, 0x0)
r2 = openat$auto_kvm_chardev_ops_kvm_main(0xffffffffffffff9c, &(0x7f0000000000), 0x212480, 0x0)
ustat$auto(0x801, 0x0)
close_range$auto(0x2, 0x8000, 0x0)
r3 = openat$auto_kvm_chardev_ops_kvm_main(0xffffffffffffff9c, &(0x7f00000011c0), 0xe0180, 0x0)
ioctl$auto_KVM_CREATE_VM(r3, 0xae01, 0x0)
ioctl$auto(0x3, 0xae41, r3)
ioctl$auto_KVM_CREATE_VM(r2, 0x4008ae8a, 0x0)
r4 = openat$auto_rtc_dev_fops_dev(0xffffffffffffff9c, &(0x7f0000000100), 0x240, 0x0)
ioctl$auto_RTC_PIE_ON(r4, 0x7005, 0x0)
ioctl$auto_UI_DEV_SETUP(r0, 0x405c5503, &(0x7f00000000c0)={{0x9, 0xf2cf, 0x8, 0x80}, "6a034a07c7b82d90b69a39e32576f893fba86c9dd051a0094a3836d61c9100fefbbabea6ef9368c7996e841f3f1561d4992f726b0a6c36b0b2fd1678e816201cf562367fe6596824588a2e3d84ba165f", 0xa})
ioctl$auto_UI_DEV_CREATE(r0, 0x5501, 0x0)
mmap$auto(0x0, 0x400008, 0xdf, 0x9b72, 0x0, 0x100000000008000)
write$auto(0x3, 0x0, 0x7fffffff)
fsopen$auto(0x0, 0x2)
mmap$auto(0x0, 0x400008, 0xdf, 0x9b72, 0x2, 0x8000)
executing program 34:
r0 = openat$auto_uinput_fops_uinput(0xffffffffffffff9c, &(0x7f0000000000), 0x101001, 0x0)
mmap$auto(0x0, 0x4020009, 0xdf, 0xeb1, 0x401, 0x8000)
r1 = clone$auto(0x4, 0x80000001, 0x0, 0x0, 0xfff)
move_pages$auto(r1, 0xd0, 0x0, 0x0, 0x0, 0x2)
mmap$auto(0x0, 0x4020009, 0xdf, 0xeb1, 0x401, 0x8000)
close_range$auto(r0, 0xffffffffffffffff, 0x2)
socket(0x10, 0x2, 0x0)
socketpair$auto(0x1, 0x1, 0x8000000000000000, 0x0)
socket(0x2, 0x1, 0x0)
r2 = openat$auto_kvm_chardev_ops_kvm_main(0xffffffffffffff9c, &(0x7f0000000000), 0x212480, 0x0)
ustat$auto(0x801, 0x0)
close_range$auto(0x2, 0x8000, 0x0)
r3 = openat$auto_kvm_chardev_ops_kvm_main(0xffffffffffffff9c, &(0x7f00000011c0), 0xe0180, 0x0)
ioctl$auto_KVM_CREATE_VM(r3, 0xae01, 0x0)
ioctl$auto(0x3, 0xae41, r3)
ioctl$auto_KVM_CREATE_VM(r2, 0x4008ae8a, 0x0)
r4 = openat$auto_rtc_dev_fops_dev(0xffffffffffffff9c, &(0x7f0000000100), 0x240, 0x0)
ioctl$auto_RTC_PIE_ON(r4, 0x7005, 0x0)
ioctl$auto_UI_DEV_SETUP(r0, 0x405c5503, &(0x7f00000000c0)={{0x9, 0xf2cf, 0x8, 0x80}, "6a034a07c7b82d90b69a39e32576f893fba86c9dd051a0094a3836d61c9100fefbbabea6ef9368c7996e841f3f1561d4992f726b0a6c36b0b2fd1678e816201cf562367fe6596824588a2e3d84ba165f", 0xa})
ioctl$auto_UI_DEV_CREATE(r0, 0x5501, 0x0)
mmap$auto(0x0, 0x400008, 0xdf, 0x9b72, 0x0, 0x100000000008000)
write$auto(0x3, 0x0, 0x7fffffff)
fsopen$auto(0x0, 0x2)
mmap$auto(0x0, 0x400008, 0xdf, 0x9b72, 0x2, 0x8000)
executing program 6:
mmap$auto(0x0, 0x2020009, 0x3, 0xeb1, 0xfffffffffffffffa, 0x8000)
close_range$auto(0x0, 0xfffffffffffff000, 0x2)
mmap$auto(0x0, 0x20009, 0x4000000000df, 0xeb1, 0x401, 0x8000)
close_range$auto(0x2, 0x8, 0x0)
socket$nl_generic(0x10, 0x3, 0x10)
socket(0x11, 0x80003, 0x300)
sendto$auto(0x3, 0x0, 0x800013, 0xffffffbc, &(0x7f0000000440)=@tipc=@name={0x1e, 0x2, 0x0, {{0x41, 0x4}, 0x4}}, 0x22)
socket(0xa, 0x2, 0x73)
socketpair$auto(0x1, 0x5, 0x8000000000000000, 0x0)
socket(0x1, 0x3, 0x0)
bind$auto(0x3, 0x0, 0x6b)
connect$auto(0x3, 0x0, 0x6b)
readv$auto(0xffffffffffffffff, 0x0, 0x410)
sendmsg$auto_NL80211_CMD_SET_WIPHY(0xffffffffffffffff, 0x0, 0x4000000)
close_range$auto(0x0, 0xfffffffffffff001, 0x2)
openat$auto_adf_hb_cfg_fops_adf_heartbeat_dbgfs(0xffffffffffffff9c, &(0x7f0000000000)='/sys/kernel/debug/ieee80211/phy0/hw_conf\x00', 0x20486, 0x0)
openat$auto_def_blk_fops_fs(0xffffffffffffff9c, &(0x7f0000000040)='/dev/loop6\x00', 0x169780, 0x0)
socket(0x11, 0x80003, 0x0)
openat$auto_raw_fops_raw_gadget(0xffffffffffffff9c, &(0x7f00000000c0), 0x0, 0x0)
r0 = socket(0x29, 0x2, 0x0)
mmap$auto(0x0, 0x202000c, 0x3, 0xab1, 0xfffffffffffffffa, 0x8000)
mmap$auto(0x0, 0x400008, 0xdf, 0x9b72, 0x2, 0x8000)
prctl$auto(0x1000000003b, 0x1, 0x4, 0x5, 0x10004)
madvise$auto(0x0, 0xffffffffffff0001, 0x15)
madvise$auto(0x0, 0xffffffffffff0008, 0x19)
setsockopt$auto(r0, 0x119, 0x400000, 0x0, 0x802)
socket(0x10, 0x2, 0x6)
mmap$auto(0x0, 0x400008, 0xdf, 0x9b72, 0x1fe, 0x8000)
sendmsg$auto_NL80211_CMD_GET_REG(0xffffffffffffffff, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000200)={0x0}, 0x1, 0x0, 0x0, 0x40000}, 0x40805)
sendmsg$auto_L2TP_CMD_NOOP(0xffffffffffffffff, &(0x7f0000000280)={0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x40080}, 0x8c1)
executing program 4:
read$auto(0xffffffffffffffff, &(0x7f0000000000)='%:\x00', 0x7)
mmap$auto(0x0, 0x7, 0x8, 0xeb1, 0xfffffffffffffffa, 0x40000000008000)
r0 = openat$auto_proc_mem_operations_base(0xffffffffffffff9c, &(0x7f0000000300)='/proc/self/mem\x00', 0x100, 0x0)
read$auto_proc_mem_operations_base(r0, &(0x7f0000000340)=""/230, 0xe6)
bpf$auto(0x14, &(0x7f00000000c0)=@iter_create={0xffffffffffffffff, 0x4}, 0x7)
executing program 4:
r0 = socket(0x10, 0x2, 0x0)
close_range$auto(0x2, 0x8, 0x0)
socket(0x10, 0x2, 0x4)
socket(0x10, 0x3, 0x6)
sendmsg$auto_NL80211_CMD_GET_REG(r0, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000300)=ANY=[@ANYBLOB="72010000", @ANYBLOB="120027", @ANYBLOB="5de1"], 0x1ac}}, 0x40000)
read$auto(r0, &(0x7f0000000000)='$-]&@\x00', 0x5)
executing program 4:
mmap$auto(0x0, 0x2020009, 0x3, 0xeb2, 0xfffffffffffffffb, 0x8000)
close_range$auto(0x2, 0x8, 0x0)
r0 = openat$auto_tracing_err_log_fops_trace(0xffffffffffffff9c, &(0x7f0000000000)='/sys/kernel/debug/tracing/error_log\x00', 0xb01, 0x0)
socket(0x15, 0x5, 0x0)
connect$auto(0x3, &(0x7f0000000080)=@in={0x2, 0x3, @dev={0xac, 0x14, 0x14, 0x10}}, 0x54)
getsockopt$auto(0x3, 0x200000000001, 0x1c, 0x0, 0x0)
mmap$auto(0x0, 0x2020009, 0x9, 0xeb1, 0xfffefffffffffffa, 0x8000)
r1 = epoll_create$auto(0x4)
r2 = openat$auto_v4l2_fops_v4l2_dev(0xffffffffffffff9c, &(0x7f0000000000)='/dev/video2\x00', 0x101081, 0x0)
epoll_ctl$auto(r1, 0x1, r2, 0x0)
mmap$auto(0x0, 0x4020009, 0xdf, 0xeb1, 0x401, 0x8000)
r3 = socket(0x1, 0x3, 0x80000000)
r4 = getsockopt$auto(r3, 0x6, 0x25, 0x0, 0x0)
mmap$auto(0x40000000010000, 0x400008, 0xdf, 0x9b72, r0, 0x8000)
socketpair$auto(0x1, 0x1, 0x8000000000000000, 0x0)
socket(0x11, 0x80003, 0x300)
setsockopt$auto(r4, 0xffff6871, 0x8, 0x0, 0x3)
r5 = socket(0x10, 0x2, 0x4)
io_uring_setup$auto(0x4bf15e08, &(0x7f0000000000)={0x401, 0x8, 0xfe, 0x6fb3, 0x8a, 0x40000009, 0xffffffffffffffff, [0x100, 0x9, 0x7f], {0x6, 0x7, 0x3032, 0xe, 0xf, 0x5, 0x5, 0xfffffff9, 0xf08a2b3}, {0x0, 0xfc, 0x6, 0x1, 0x0, 0xf89, 0x9, 0x7fffffff, 0x8}})
r6 = socket$nl_generic(0x10, 0x3, 0x10)
ioctl$sock_SIOCGIFINDEX(r6, 0x8933, &(0x7f0000000000)={'dummy0\x00'})
syz_open_procfs$namespace(0x0, 0x0)
sendmsg$auto_NFSD_CMD_THREADS_SET(0xffffffffffffffff, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000000140)=ANY=[@ANYBLOB="1f9a81052a570148ea3acf23453bf490b45c8a1e9c681d666620c84499a29282c991", @ANYRESOCT=r4], 0x2c}, 0x1, 0x0, 0x0, 0x4000044}, 0x2404c000)
write$auto(r5, &(0x7f0000000000)='-\x00', 0x2fb)
r7 = openat$auto_kernfs_file_fops_kernfs_internal(0xffffffffffffff9c, 0x0, 0x500, 0x0)
read$auto_kernfs_file_fops_kernfs_internal(r7, &(0x7f0000000080)=""/23, 0x17)
openat$auto_proc_sys_file_operations_proc_sysctl(0xffffffffffffff9c, 0x0, 0x101202, 0x0)
close_range$auto(0x2, 0x8, 0x0)
openat$auto_proc_iter_file_ops_compat_inode(0xffffffffffffff9c, &(0x7f0000000040)='/proc/fs/netfs/cookies\x00', 0x40080, 0x0)
openat$auto_proc_sys_file_operations_proc_sysctl(0xffffffffffffff9c, &(0x7f0000000080)='/proc/sys/kernel/seccomp/actions_logged\x00', 0x8202, 0x0)
executing program 0:
r0 = socket(0xa, 0x2, 0x3a)
setsockopt$auto(r0, 0x29, 0x11, &(0x7f0000000240)='!\x00\xba\xe4\x8a\xf0t\xaf\x82\xd7{\x98\xdd\xee\xc2f\xcaH\x90\xc57M\x87<<\n\xf2L\"Y\xa9\f\n\xbd?\xdd\b\xf7vu:\x00\xeaP\xa7=\xef\xc3\xdc\xf3=J\xf9\x9e\xd9\x02\xbb\xd3\xf8\xff*\xc2\xd8w\xe9\x00\x00\x01\x00h\xe2\x0f\x1b\x95L\xbf\xa5\xacH\"xV#\xc7e\x12\x83\xed\xc7\xc5\x9e\x84?\xfa=\f\xd8\x14\x00\x9fJl\xdd)i\x9f(#\xb7\xff:\x94\x8bd,\xb2\xfc\xde32\x87;\tx\xffM\x1f\x1d\xd8b\xa5\r\xb7v;\xfd\xa14M\xd3\x95\x86\x04\xd4\xda}\xcat}\x18K\x85\x9bBj\x8e\x95\xca\x87\xfe\x125\x154\x83\x94X,\xa4\xf3\xf6\xef\x1a\xb5iX\x99\xa1NO\xc5R\xc9\xc7\xd6\x8d?\x13\x9f\xaf\xf4\xbc\xa3j\xefQ\x7f\xc4\x86\xe8\xc6\xf8\xfe\x115\xd7\x89\x86\xc6T\x14\x00\x13\xb9mf\xc0\xc2%_N\xed\xa9\x02\xe5\x83\xa0\x01O%NHKp\xe0\xb3u\xdc\x8bb\xfa\xabD\x1d\x8a\x1e\xb4C\x05R\xdco\xa5\xce\xc9+\xf8\xf2X#', 0x1fe)
executing program 0:
stat$auto(&(0x7f0000000300)='./cgroup\x00', &(0x7f0000000340)={0x7, 0x8000, 0x6, 0x8001, 0xee00, <r0=>0xee01, 0x0, 0x187, 0x2, 0x8, 0x3, 0x5fd0, 0x7f, 0x6, 0xfff, 0x3, 0x1})
mmap$auto(0x0, 0x20009, 0xdf, 0xeb1, 0x401, 0x8000)
close_range$auto(0x2, 0x8, 0x0)
sendmsg$auto_NL80211_CMD_GET_REG(0xffffffffffffffff, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000200)={0x0, 0x1ac}, 0x1, 0x0, 0x0, 0x4004810}, 0x800)
sendmsg$auto_HSR_C_GET_NODE_STATUS(0xffffffffffffffff, &(0x7f0000000200)={0x0, 0x0, &(0x7f00000001c0)={&(0x7f0000000140)=ANY=[@ANYBLOB='h\x00\x00\x00', @ANYRES16=<r1=>0x0, @ANYBLOB="000226bd7000fedbdf25030000000800030004020000060007000080000008000200", @ANYRES32=0x0, @ANYBLOB="0a00050000000000000000000a00010000000000000000000a0001000000000000000000060007000a00000008000200", @ANYRES32=0x0, @ANYBLOB="080140"], 0x68}}, 0x40090)
sendmsg$auto_NL80211_CMD_STOP_AP(0xffffffffffffffff, &(0x7f0000000d80)={0x0, 0x0, &(0x7f0000000d40)={&(0x7f0000000480)=ANY=[@ANYBLOB="140000008f68084197cad0a602aceff6e434f2a84c1f9a2b686c17575cce6e2cd51220266f0b04fe6d0d6755e40794c7abe48678c462385fa5f6513224e850eeda5ea0674056022442388de7dccbfa2d751c143291176413f704a2f4a993ee64456952edd4e6754a5a15e01f0af0c21460ba", @ANYRES16=0x0, @ANYBLOB="040029bd7000fedbdf2510000000"], 0x14}, 0x1, 0x0, 0x0, 0x4000001}, 0x40)
r2 = syz_genetlink_get_family_id$auto_nfsd(&(0x7f0000001440), 0xffffffffffffffff)
r3 = syz_genetlink_get_family_id$auto_nfc(&(0x7f00000015c0), 0xffffffffffffffff)
sendmsg$auto_NFC_CMD_STOP_POLL(0xffffffffffffffff, &(0x7f0000002680)={0x0, 0x0, &(0x7f0000002640)={&(0x7f0000000580)=ANY=[@ANYBLOB="a65115c4", @ANYRESHEX=r2, @ANYBLOB="20fa28bd7000ff08000000000000", @ANYRESHEX=r0, @ANYRES32=r1, @ANYBLOB="0e8ccd1998719890eacd4d3402f180541c0d46edfd51d271fc33418c4c593e56ad425d740f39db93ceccd1d5080384ccbae93ed6023dbe608b336fb2ab07c317034bb6502024c8ed3c37f4faa9f60e127fdd7dee19f9b9629e0e7e1557ede9db5ae05b584563f1a93b6a219e6180b2169ed686dedb69b3938d03d1811ad83d761ddf44eeb82bec8cf9393ae21418e7db49746d2169a15334ea7eba5e60fe201d46cd32d3ca0a8f7c5c34cef4371cc0e9", @ANYRES8=r1, @ANYRES8=r0, @ANYRES8=0x0], 0x14}, 0x1, 0x0, 0x0, 0x40008d5}, 0x4010)
sendmsg$auto_NFC_CMD_START_POLL(0xffffffffffffffff, &(0x7f0000000400)={&(0x7f0000000440)={0x10, 0x0, 0x0, 0x402}, 0xc, &(0x7f0000000280)={&(0x7f0000000240)=ANY=[@ANYBLOB='<\x00\x00\x00', @ANYRES16=r3, @ANYBLOB="08002bfd7000ffdbdf450600000020000200d65bced5efd32a94b7f5980a2f0965559f617873703100f47c78308008001e0080000000"], 0x3c}, 0x1, 0x0, 0x0, 0x20048895}, 0x40000)
r4 = socket(0x2, 0x3, 0x100)
socket(0x10, 0x2, 0x0)
sendmsg$auto_NL80211_CMD_GET_REG(0xffffffffffffffff, &(0x7f0000000100)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000180)=ANY=[@ANYBLOB="72010000", @ANYBLOB="13"], 0x1ac}, 0x1, 0x0, 0x0, 0x10008001}, 0x4004)
sendmmsg$auto(0x3, &(0x7f0000000080)={{0x0, 0x2, &(0x7f00000002c0)={0x0, 0xc4}, 0x1, 0x0, 0x0, 0x9}, 0x7}, 0x3, 0x0)
r5 = socket$nl_generic(0x10, 0x3, 0x10)
mmap$auto(0x0, 0xe983, 0xdf, 0xeb1, 0x401, 0x8000)
mmap$auto(0x0, 0x9, 0xdf, 0x9b72, 0x2, 0x8000)
io_uring_setup$auto(0x406, 0x0)
mmap$auto(0x0, 0x9, 0xffb, 0x8000000008011, 0x3, 0x0)
getrandom$auto(0x0, 0x6000000, 0x3)
io_uring_enter$auto(r4, 0xa84, 0x80000001, 0xe, 0x0, 0x46)
migrate_pages$auto(0x0, 0x99, 0x0, &(0x7f00000001c0)=0x3fe)
r6 = openat$auto_snd_pcm_oss_f_reg_pcm_oss(0xffffffffffffff9c, &(0x7f0000000100)='/dev/adsp1\x00', 0x40a140, 0x0)
ioctl$auto_SNDCTL_DSP_CHANNELS(r6, 0xc0045006, &(0x7f00000001c0))
getrandom$auto(&(0x7f0000000100)='..\x00k\xac\x8c\x1d\x0e\x98\x80\xd2\xaf\xa1\xf2\x1e\xe1R1\xa2\x8e\xce\xa0\x17\bI3\'\xc5tw\xd7\x1d\xa6\xf4#+\xfa\xd7\x01\xb9j<\v\xf47\n\xa7\xd2\x8b\x11e</\xfd\x9b\xe4\x99G\xeaS\x9a\xadu(:\x94:\xaf\x06c=3>1\xb3\xfdd\x04\xa9 1q\x97\xc4,\xa9^\xc1\xb6\xa1q\x0f\xd1\x013\x87l\xb9\x1e\x05\x90\xa2', 0xd5, 0x1)
move_pages$auto(0x0, 0x1002, 0x0, 0x0, 0x0, 0x2)
openat$auto_seq_oss_f_ops_seq_oss(0xffffffffffffff9c, &(0x7f0000000540)='/dev/sequencer2\x00', 0x0, 0x0)
io_uring_enter$auto(0x3, 0x5, 0xffffffff, 0x3, 0x0, 0x2)
getdents$auto(0xffffffffffffffff, 0x0, 0x100019)
syz_genetlink_get_family_id$auto_nl80211(&(0x7f0000000000), r5)
executing program 4:
openat$auto_snd_pcm_oss_f_reg_pcm_oss(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/dsp1\x00', 0x20b42, 0x0)
read$auto_proc_reg_file_ops_compat_inode(0xffffffffffffffff, &(0x7f0000000280)=""/65, 0x41)
mmap$auto(0x0, 0x4020009, 0x6, 0xeb1, 0x401, 0x8000)
prctl$auto(0x1000000003b, 0x1, 0x4, 0x5, 0x7)
socket$nl_generic(0x10, 0x3, 0x10)
close_range$auto(0x2, 0x8, 0x0)
sendmsg$auto_NETDEV_CMD_DEV_GET(0xffffffffffffffff, &(0x7f0000000080)={&(0x7f0000000140)={0x10, 0x0, 0x0, 0x400000}, 0xc, 0x0, 0x1, 0x0, 0x0, 0x48000}, 0x0)
mmap$auto(0x0, 0x400008, 0xdf, 0x9b72, 0x2, 0x8000)
close_range$auto(0x2, 0x8000, 0x0)
sendmsg$auto_HSR_C_GET_NODE_STATUS(0xffffffffffffffff, &(0x7f0000000200)={0x0, 0x0, &(0x7f00000001c0)={&(0x7f0000000140)={0x68, 0x0, 0x200, 0x70bd26, 0x25dfdbfe, {}, [@HSR_A_IF1_AGE={0x8, 0x3, 0x200}, @HSR_A_IF2_SEQ={0x6, 0x7, 0x4}, @HSR_A_IFINDEX={0x8}, @HSR_A_NODE_ADDR_B={0xa}, @HSR_A_NODE_ADDR={0xa, 0x1, @broadcast}, @HSR_A_NODE_ADDR={0xa}, @HSR_A_IF1_AGE={0x8, 0x3, 0x38}, @HSR_A_IFINDEX={0x8}, @HSR_A_IF2_AGE={0x8, 0x4, 0x4}]}, 0x68}, 0x1, 0x0, 0x0, 0x40080}, 0x40090)
socket(0x2, 0x3, 0x100)
socket(0x10, 0x2, 0x0)
sendmsg$auto_NL80211_CMD_GET_REG(0xffffffffffffffff, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000200)={0x0, 0x1ac}, 0x1, 0x0, 0x0, 0x4004810}, 0x800)
sendmsg$auto_NL80211_CMD_GET_REG(0xffffffffffffffff, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000180)=ANY=[@ANYBLOB="720100", @ANYBLOB="13"], 0x1ac}}, 0x4004)
sendmmsg$auto(0x3, &(0x7f0000000080)={{0x0, 0x2, &(0x7f00000002c0)={0x0, 0xc4}, 0x1, 0x0, 0x0, 0x9}, 0x7}, 0x3, 0x0)
executing program 0:
futex_waitv$auto(&(0x7f0000000180)={0x3fb, 0x6, 0x2, 0xfff}, 0x3, 0xbffffffc, 0x0, 0x81)
r0 = bpf$auto(0x5, &(0x7f00000001c0)=@task_fd_query={0x2, 0x2, 0x4, 0x0, 0x85, 0x4, 0x9, 0x6, 0x8001}, 0x101)
close_range$auto(0x2, 0xa, 0x0)
socket$nl_generic(0x10, 0x3, 0x10)
syz_clone(0x11, 0x0, 0x0, 0x0, 0x0, 0x0)
r1 = openat$auto_blk_mq_debugfs_fops_blk_mq_debugfs(0xffffffffffffff9c, &(0x7f00000000c0)='/sys/kernel/debug/block/mtdblock0/sched/read0_fifo_list\x00', 0x0, 0x0)
read$auto_blk_mq_debugfs_fops_blk_mq_debugfs(r1, &(0x7f0000000040)=""/124, 0x7c)
pipe$auto(&(0x7f0000000000)=<r2=>0xffffffffffffffff)
splice$auto(r2, 0x0, 0x2, 0x0, 0x9, 0x8)
mmap$auto(0x0, 0x7, 0xdf, 0x9b72, 0x2, 0x7ffc)
mmap$auto(0x0, 0x20009, 0x4000000000df, 0xeb1, 0x401, 0x8000)
mremap$auto(0x0, 0x4, 0x4, 0x7, 0x1000)
mmap$auto(0x0, 0x400008, 0xdf, 0x9b72, 0x2, 0x8000)
close_range$auto(0x2, r0, 0x0)
socketpair$auto(0x1e, 0x1, 0x8000000000000000, 0x0)
openat$auto_vhost_vsock_fops_vsock(0xffffffffffffff9c, &(0x7f0000000000), 0x121900, 0x0)
mmap$auto(0x0, 0x20009, 0xdf, 0xeb1, 0x401, 0x8000)
r3 = socket(0x2, 0x1, 0x0)
fcntl$auto(0x3, 0x4, 0xa553)
bind$auto(r2, &(0x7f0000000040)=@llc={0x1a, 0x301, 0x81, 0xe, 0x4, 0x2, @local}, 0x1)
sendmmsg$auto(r3, &(0x7f0000000140)={{&(0x7f0000000040), 0x12, 0x0, 0x101, 0x0, 0x5, 0x9ad}, 0x5}, 0x5, 0x20000000)
r4 = socketpair$auto(0x1, 0x5, 0x8000000000000000, 0x0)
syz_genetlink_get_family_id$auto_batadv(0x0, 0xffffffffffffffff)
mmap$auto(0x7, 0x202000c, 0x5, 0xfb1, r4, 0xa)
semctl$auto(0x9, 0xc1b8, 0x4, 0x1)
mmap$auto(0x7ffffffd, 0x400004, 0x7, 0x9b72, r3, 0x5)
dup2$auto(0xffffffffffffffff, 0xffffffffffffffff)
syz_genetlink_get_family_id$auto_nl80211(0x0, 0xffffffffffffffff)
sendmsg$auto_NL80211_CMD_SET_MULTICAST_TO_UNICAST(0xffffffffffffffff, 0x0, 0x0)
sendmsg$auto_NL80211_CMD_GET_STATION(0xffffffffffffffff, 0x0, 0x40)
executing program 6:
close_range$auto(0x2, 0x1d, 0x0)
r0 = syz_genetlink_get_family_id$auto_nl80211(&(0x7f0000000180), 0xffffffffffffffff)
sendmsg$auto_NL80211_CMD_SET_WIPHY(0xffffffffffffffff, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000080)=ANY=[@ANYBLOB='$\x00\x00\x00', @ANYRES16=r0, @ANYBLOB="011d3da4420008bd7100f9db5f250200000000000010", @ANYRES32], 0x24}, 0x1, 0x0, 0x0, 0x404c0c0}, 0x80)
mmap$auto(0x0, 0x3, 0x4000000200df, 0x40eb2, 0x402, 0x300000000000)
capget$auto(&(0x7f0000000100)={0x5}, &(0x7f0000000140)={0x7ff, 0xc, 0x800})
close_range$auto(0x2, 0xa, 0x0)
socket(0x10, 0x2, 0x4)
openat$auto_safesetid_uid_file_fops_securityfs(0xffffffffffffff9c, &(0x7f0000000080), 0x1, 0x0)
writev$auto(0x3, &(0x7f0000000100)={0x0, 0x7111}, 0x8)
r1 = socket(0x10, 0x2, 0x0)
sendmmsg$auto(r1, &(0x7f0000000200)={{0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000080), 0xfc2}, 0x2, &(0x7f00000001c0), 0x7, 0xa505}, 0x800}, 0x7, 0x4008)
socket(0x3, 0x800, 0x9)
r2 = openat$auto_kernfs_file_fops_kernfs_internal(0xffffffffffffff9c, &(0x7f0000000080)='/sys/module/apparmor/parameters/path_max\x00', 0x80, 0x0)
r3 = socket(0x1e, 0x4, 0x0)
setsockopt$auto(r3, 0x10f, 0x86, 0x0, 0x0)
read$auto_kernfs_file_fops_kernfs_internal(r2, &(0x7f00000000c0)=""/17, 0x11)
open(&(0x7f0000000000)='./file0\x00', 0x261c2, 0x84)
r4 = open(&(0x7f0000000080)='./file0\x00', 0xeee00, 0x31)
mmap$auto(0x3, 0x2020009, 0x7fffffff, 0xeb1, 0xfffffffffffffffa, 0x8000)
r5 = openat$auto_kernfs_file_fops_kernfs_internal(0xffffffffffffff9c, &(0x7f0000000040)='/sys/devices/virtual/block/ram6/queue/minimum_io_size\x00', 0x0, 0x0)
read$auto_kernfs_file_fops_kernfs_internal(r5, &(0x7f0000001540)=""/104, 0x68)
mmap$auto(0x0, 0x400008, 0xdf, 0x9b72, 0x2, 0x8000)
getcwd$auto(0x0, 0xffffffffffffffff)
rename$auto(0x0, &(0x7f0000000300)='v#\xd5\xaf>=\x14\xe6%\xf7\x8a\x8d\x9a\xae\x1a\xd6\xa8\xb8\x1d\xf5(\xb0\x1f\xbd\xcbV\n\"\xe3V\xfeP\xceN\xb2\xc32\xaf\xcc\x80\xfa\xf0\xd4\xd9|\xfe\x03y\xd16\x17\x99R\xca\xe5\xf4\xb4T\xfcv\xfc\xe6\x9cv\a\x00\xc2a\x16\xd1\x8a\x80\x90\x87\xa5s\x10\xed\x93\xd4\x15=\xc0\x1f\x0e\xb0\x18v}\x03!\xf0I\xe3}\x90\x9b\x92[\xfe2<7\xd3\x81\x9a~\xcd\r\x19\x9e\x10(5\xfd\x8b\x82\xd4\xc85\xc3\x93t\t\xd0\x9d\xca^n\xf3\xcb>\x1bO\xcej\xe0\xef\xf2\xd7\xc2}\x18\xd9`AO\x95<\x9aH\vu\xae\xd4\xea\x12\xb8\xd1\n\x01\x83r\x85\xbf*\x18\xa7 S:R\x14\x89Z3\x94\x8bP)')
write$auto(0x3, 0x0, 0x100082)
lseek$auto(r4, 0xc, 0x4)
executing program 4:
mmap$auto(0x0, 0x400008, 0xdf, 0x9b72, 0x2, 0x8000)
madvise$auto(0x0, 0xffffffffffff0005, 0x19)
madvise$auto(0x0, 0xffffffffffff0001, 0x15)
io_uring_setup$auto(0x6, 0x0)
madvise$auto(0x200000, 0x200007, 0x19)
executing program 5:
write$auto(0xffffffffffffffff, &(0x7f0000000000)='\'\x00', 0x4)
openat$auto_proc_reg_file_ops_compat_inode(0xffffffffffffff9c, &(0x7f0000000000)='/proc/thread-self/net/anycast6\x00', 0x0, 0x0)
mmap$auto(0x3, 0xb1, 0x3, 0xeb0, 0x401, 0xf8)
read$auto(0x3, 0x0, 0x80)
read$auto(0x3, 0x0, 0x80)
write$auto(0x3, 0x0, 0xfffffdef)
write$auto(0x3, 0x0, 0xfffffdef)
mmap$auto(0x0, 0x400008, 0xdf, 0x10, 0x2, 0x8000)
open(&(0x7f0000000000)='./file0\x00', 0x161342, 0x100)
msync$auto(0x1ffff000, 0x180000000000000, 0x400000004)
mmap$auto(0x0, 0x2020009, 0x3, 0x8011, 0xfffffffffffffffa, 0x8000)
mmap$auto(0x0, 0x2020009, 0x3, 0xeb1, 0xffffffffffffffff, 0x8000)
openat$auto_kernfs_file_fops_kernfs_internal(0xffffffffffffff9c, 0x0, 0x0, 0x0)
r0 = openat$auto_proc_fail_nth_operations_base(0xffffffffffffff9c, &(0x7f0000000000)='/proc/thread-self/fail-nth\x00', 0x20af83, 0x0)
writev$auto(r0, &(0x7f0000000200)={0x0, 0x7}, 0x3)
msync$auto(0x7, 0x45f8, 0x1)
open(0x0, 0x22240, 0x0)
socket$nl_generic(0x10, 0x3, 0x10)
socketpair$auto(0x1, 0x4, 0x8000000000000000, 0x0)
r1 = openat$auto_tty_fops_tty_io(0xffffffffffffff9c, &(0x7f0000000400)='/dev/ttyS2\x00', 0x101e81, 0x0)
ioctl$auto_TIOCSETD2(r1, 0x5423, 0x0)
openat$auto_mousedev_fops_mousedev(0xffffffffffffff9c, &(0x7f0000000040)='/dev/psaux\x00', 0x20000, 0x0)
io_uring_setup$auto(0x6, 0x0)
mmap$auto(0x0, 0x400008, 0xdf, 0x9b72, 0xffffffffffffffff, 0x8000)
close_range$auto(0x2, 0xa, 0x0)
executing program 0:
r0 = socket(0x10, 0x2, 0x0)
close_range$auto(0x2, 0x8, 0x0)
socket(0x10, 0x2, 0x4)
socket(0x10, 0x3, 0x6)
sendmsg$auto_NL80211_CMD_GET_REG(r0, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000300)=ANY=[@ANYBLOB="72010000", @ANYBLOB="120027", @ANYBLOB="5de1"], 0x1ac}}, 0x40000)
read$auto(r0, &(0x7f0000000000)='$-]&@\x00', 0x5)
executing program 6:
mmap$auto(0x0, 0x2020009, 0x3, 0xeb1, 0xfffffffffffffffa, 0x8000)
mmap$auto(0x0, 0x4, 0x4000000000df, 0x40eb2, 0x402, 0x300000000000)
socket(0xa, 0x801, 0x84)
msgsnd$auto(0x900, &(0x7f0000000000)={0x2, 0x5}, 0xf54, 0x80000001)
openat$auto_kernfs_file_fops_kernfs_internal(0xffffffffffffff9c, 0x0, 0x1c2b02, 0x0)
prctl$auto(0x12, 0x1, 0x6, 0xfffffffffffffffe, 0x4)
executing program 0:
unshare$auto(0x40000080)
socket$nl_generic(0x10, 0x3, 0x10)
socket$nl_generic(0x10, 0x3, 0x10)
mmap$auto(0x0, 0x400008, 0xdf, 0x9b72, 0x2, 0x8000)
close_range$auto(0x0, 0xfffffffffffff000, 0x2)
mmap$auto(0x0, 0x40009, 0xdf, 0x9b72, 0x7, 0x28000)
socketpair$auto(0xf, 0x7, 0x8, 0x0)
r0 = socket(0x10, 0x3, 0xb)
r1 = openat$auto_kernfs_file_fops_kernfs_internal(0xffffffffffffff9c, &(0x7f0000000080)='/sys/kernel/slab/kmalloc-64/total_objects\x00', 0x2400, 0x0)
read$auto_kernfs_file_fops_kernfs_internal(r1, &(0x7f0000000180)=""/250, 0xfa)
setsockopt$auto(r0, 0x104000000000010e, 0x1, 0x0, 0x16)
close_range$auto(0x0, 0xfffffffffffff000, 0x2)
openat$auto_proc_pid_numa_maps_operations_internal(0xffffffffffffff9c, &(0x7f0000000040)='/proc/thread-self/numa_maps\x00', 0x20000, 0x0)
open(&(0x7f0000000000)='./file0\x00', 0x161342, 0x100)
socket(0x1d, 0x2, 0x6)
futex_waitv$auto(&(0x7f0000000000)={0xfffffffffffffffd, 0x7e4, 0x2}, 0x1, 0x0, 0x0, 0x623d)
io_uring_setup$auto(0x2, 0x0)
r2 = openat$auto_tty_fops_tty_io(0xffffffffffffff9c, &(0x7f0000000400)='/dev/ttyS2\x00', 0x101e81, 0x0)
ioctl$auto_TIOCSETD2(r2, 0x5423, 0x0)
close_range$auto(0x2, 0x8, 0x0)
socket(0x23, 0x80805, 0x0)
socketpair$auto(0x4, 0x1, 0x20000, 0x0)
r3 = openat$auto_tty_fops_tty_io(0xffffffffffffff9c, &(0x7f0000000400)='/dev/ttyS2\x00', 0x101e81, 0x0)
ioctl$auto_TIOCSETD2(r3, 0x5423, 0x0)
ioctl$auto_TIOCVHANGUP2(r2, 0x5437, 0x0)
executing program 5:
r0 = semctl$auto_IPC_STAT(0xf, 0x2, 0x2, 0x8)
r1 = prctl$auto_PR_SET_NO_NEW_PRIVS(0x26, 0x9, r0, 0x6, 0xda8)
r2 = openat$auto_sg_fops_sg(0xffffffffffffff9c, &(0x7f0000000000)='/dev/sg0\x00', 0x400040, 0x0)
lseek$auto(r1, 0x4, 0x2)
r3 = prctl$auto_PR_SET_NAME(0xf, 0x4, r0, 0x4, 0x81)
r4 = syz_genetlink_get_family_id$auto_thermal(&(0x7f0000000080), r1)
sendmsg$auto_THERMAL_GENL_CMD_TZ_GET_TEMP(r3, &(0x7f0000000240)={&(0x7f0000000040)={0x10, 0x0, 0x0, 0x1000000}, 0xc, &(0x7f0000000200)={&(0x7f00000000c0)={0x110, r4, 0x200, 0x70bd26, 0x25dfdbfe, {}, [@THERMAL_GENL_ATTR_TZ_ID={0x8, 0x2, 0x2}, @THERMAL_GENL_ATTR_CDEV_MAX_STATE={0x8, 0x12, 0x2}, @THERMAL_GENL_ATTR_CDEV_CUR_STATE={0x8}, @THERMAL_GENL_ATTR_CDEV={0xcc, 0xf, 0x0, 0x1, [@nested={0x4, 0xd9}, @nested={0xc1, 0x76, 0x0, 0x1, [@generic="e67cbd765535320bb721f053ce5b6bf16aa71ebf81d4d5b0fa3b48c2041dadaf53333c066446b22b964d5ee30e9600f92198f80cf5ef55d87dc2c02358171d103e4417da88d25b864f66c730777d668d066bb96b175ab76bdb8a4ab173b78649b941bc899c5f388745ac343a5f8e85946c41ba14cda7e6acd76befeca2afda478efaa1ca27f711b41e85ef65debf32ccf2ffd8be145d9d59b3f290cf38c2ae0f858a972483d7da5fd9ca8d2fe6fcb6bdc6a62aa4db2c4d9367070742ba"]}]}, @THERMAL_GENL_ATTR_THRESHOLD_TEMP={0x8, 0x1a, 0x2}, @THERMAL_GENL_ATTR_TZ_GOV_NAME={0xf, 0xe, '-,{{\\(##.$*'}]}, 0x110}, 0x1, 0x0, 0x0, 0x80}, 0x850)
madvise$auto(0x1, 0xf, 0x9)
r5 = openat$auto_proc_fail_nth_operations_base(0xffffffffffffff9c, &(0x7f0000000280)='/proc/self/fail-nth\x00', 0x240042, 0x0)
fadvise64$auto_POSIX_FADV_DONTNEED(r3, 0x4, 0x6, 0x4)
r6 = getsockopt$auto_SO_MARK(r1, 0x7, 0x24, &(0x7f00000002c0)='/proc/self/fail-nth\x00', &(0x7f0000000300)=0x7fff)
setsockopt$auto_SO_ATTACH_REUSEPORT_EBPF(r6, 0xcf, 0x34, &(0x7f0000000340)='\x00', 0x3)
timer_create$auto_CLOCK_MONOTONIC(0x1, &(0x7f00000003c0)={@sival_ptr=&(0x7f0000000380)="be293c4f6a7407458de90e000146812641314dd429d426538eb87881a8dd", @raw, 0x4}, &(0x7f0000000400)=0xffffffff)
madvise$auto(0x4, 0x8, 0x5)
openat$auto_tracing_stats_fops_trace(0xffffffffffffff9c, &(0x7f0000000440)='/sys/kernel/debug/tracing/per_cpu/cpu0/stats\x00', 0x40000, 0x0)
ioctl$auto_BTRFS_IOC_SNAP_CREATE(r1, 0x50009401, &(0x7f0000000480)={@inferred=r5, "b054b7b57308300340ed802ae20ec1d8f00876883702f074918367146fee8b4026d4b0801429e78762e266570309f2b5fa0ceb5bfe5b79aa318b878efa9cba71dd2bf0e75e11949f89ad73b6aabdbd0d8d6a34fd54da1c02d5261271090e364dbefed860940ce2e47f1b7cbe11f28aed80064fc66b2911b0ba7e90b34e7eede686b1885aada364347e5ad87029dfd798741ba88aa50ecf5206d4acee8bb8101250c6cae9211900a0bb8a6a772b3088d8657950ce125c7855cfbaba7123376de40fdd812062ca46e11ec47c2c0b7b39a401f43eed39a3c369a888f067365b26b7f36145c8d54236904922bb04110b3575ad44ca2751e6c332b743d821fa3b342a769e0d9a4e7817965c8587fef82ede49b05f2fff436da9fb2a38fe344868fe26b6b03b427a36dbae88ef21c0c8627f5a79e883bf069ec10b0a39bdc631ce96219bf6c3a821a5861e855ed91af601a3fc2cc425ffdc3bf613bd2842a7b0e941eca9a6b5e61a1fa9e72d8ecc4be9a829737ca878ad1c4161434405f5c12de634c8723151394c437b19615ca9fa9dc53829c03f63695926409b81e81775269e13e46916c6dce115d7535ebb7986d04d0e6506707fce81bafa94fcbe9b0115a487e2051eb5c32aefb218d0e6a79ee7829bf1a384e6a529fa6a6eb2a846f97cd69ec1feceb3d100165362e28c5c8886f5dd9116eb18b7aab67cec251053b044266d9117cb02f463a151383afcd0c22ffa3d7bac9ddf3fe823a2ecbcb0143f777ad7bb6a8e5b8eabd38d5f900b1ef393d0e3e205f27e12c09f68a3b22125a2ab8b9b0c9e578028c7afb9a5aba4ee4dc621e5a6a9a1d8fa05a33464bfd87f9c09530f5451e47999080d3e37013d5225b571c131f51f2fede90b933b6b94a33c3975e850482c298dd703c9c426aa5df8ca1f9b2fd45d8c5094c6eeaca5e9eaa39757361554b027c17aeec6c949f49ec133e3aba14e9d131ab6fe17ac7a702d8395069acc64ded113db649e79b0797cadf4a09108e854e421ed3ba06c966199f61dd56821a32cdf93488d2ee9c88a196fd8546f13dda65859dfd0685a368f7be74097082d58e1d43ad1ab5637778f887ee1ccffd30b67991450dcf720f3f56ef3fa9cdf4c582ebd42092e04c1b039dc20bab01fd9b0a97b95316e3c36e88172544fba87d7444bbb5454f630b2c66e2636ade1014850697ed10e8ae170e883c5e889fa4c5b45b73b27731c3991ea46d778cae89cc0b481e3bd06b208696fff729a8db49878e13062aa24c5ba1c2a8c556b9fb8cf6238cbec2f2c980fd3fee3708ec6614137269805aef61ae4730a7e04e0a43a5462da7ab004fd710284f18c9c4eab74d0544704842e3a60e5453a47bb162bbf7a1674dc8ced553da7e37fa53aa994286803393a8d3165685502c83f5c36bb55fe2861069538ba8929b0d1df00400dec38d829a483396eb724c715b0154b344ffd0f9ed7af56f4cb4053f613919e2269af04f2c02bc40403f4c7069a935576958e82d13fd3e63c749cb66af73258f659721da7647a7cab85d11fc34409f94a2c4c9ec25d03650ad0e355c3191f6a5d1b721814535de27260c31b6db845f4e3c675f8f824f6244a1608f641fe864ef2a2a3074e0f0f8e90941199758ef3066a71979e6a6042224a8d686c3e4f2f00f73ac46eb9b8f4b4dee53eba78ec3136afab07ebd8fe930a522a7fa34c8a1a0d34b48fa6475413b8113ca903c143b151c06da5c57476f16e39cd9b50dade84f58b140fc3439e6a63f11e02ce8ddd9d05c92f583d60c58b22f75315fbebb2e2f38ef26b53d989c81027815273a570a13423b98d87763dbe3a3786639f374233ab52cf1b61ed6fea8bba9345f0cc72c1853eb4719858d6e118ffa46f8b29a091b12bdeb731aeb0d31c746a5e654184660bac656d50c4ffbd5a4c14df08ae3e2c4a905259a47f9797d41160085ae44b9800375cee7e80ae68aebe6980b610dbac4090c213ce27b66700534fd7b9301d1f40ff117b54b0caa541fdcdcbf91ae7e342c1f249dbea25b497197a3f2fdb6485dde2f88315d8388a023fbf56263e3dd5ba31fc074ca2142506268cbc69e92302e5f6d07543272a111a6a19a6190334de3f0658e586f6d6201633f3e9c5dd2f4923ad5b76478f30cd96fc00f200b1fd6b64660a677ed56674813ddbc62079ef93872ee35545cd898dc682290544ff41be4ca8f30ed48cfa6bf89a1dcb9ee7f3595f6acce6903e7a5d40c96276c595071c55aea7b8abd3e608468155a637cb85d64d072a06193844e98da59d1a2f4442c474f7e53e96f448392c1171dbf5b8c48961998d61f87c2fee8ca051b4fe6e75eaba6ae660e03eab726cb1b3318751a43123d51e45e40dfb9ca475ef0542b06276169a712f23b82a4750c6ceed8e3e23e02e6f0d910c38ed8bbe68fccf0248facee3f854119868351afc6302dbc3df8431b880a6f400719938701c2f83fd687071f58799d8c35337b8a2ae7cb21ba7f63a49b09df650e739f86aa39c6028150c30405e72ca300083e4ac7b3abb6aece2341b106ef53f7d6970c6acbc7f13aa93fdc73bbd899c9ae1419e022b2dc788b1937fb94db9824b7e68a4c6356ea57c6be8e574798f2a2fa8dd4e5ecb3003a2330de58506e419715e080099965092eaae79653f727ddfa20154100ff810c0a0e576e82e846db4d4b38271b274101237ec6fdb30b5ef4f6767bba91fe54180712ffb296fdc7fb9b71fc47210203f5a27e2565d018c50f395e017100ed35447c6176e237b07c1f42276849464a6d69ccc6b6d7181c9b211a3d0c29c1f7157b44ee0fb063fe7d39147d1e4d966e3b8eb9f8cc4c27b93741cb6d99a8bbff4e9b31b88b0700603ee888ef878b56f7a76cd038b39fb3cfa78e0769bd012e5e2cb3b8c9be91239e288a2688a86236bd161faa8c29d651717bb9854a36f975268266936ad78f398b001b1c6acfbacb8a84431fb66f099d79fd4af586c949c97b0fb4bd4c58f9640eac01e5bfc3eda4e51cbe2010d9774f0ec84ba7fe5df45dc60b6ca817e35a74895b84b692fc7d63a153c0f015e321edc3c59f9af3fac1c8e7e13f706914cd9a817462ec9c5a7840b96aad7888d84a9d02787529fc06645c8b7580ae0fe2f5d8708a689377e6ebdae290399898b8c6508ba9eb63c5ca29505409b8f6056cc06ffe3c12f40925c62edd36fc62a399b65eda0c8113db93d958d976b098fd1af9ae1c0788117537d0f7bc5369916919e4be23626a7b2d5493f845c08b5f0e4baa809cd06b1ce015a380fb5e513355b7ee1674a7af0d88387e9254695417eda7b1d0c0c182d318d138cc7d5668fd9a8a2008d707455e97f4eaa296ac3ec2835afa136cef0bce851d73738f7d810570506ed090a1bc0a13fa8ba150abbb8c53629a8e2e52b0123f0ac8c025b73615d7f467164d231532caaceca0268ddc4c194ddec6c95bfa57717e47251fc238f63ee76c052384175d6a71306503c994c0a957309b0b441f8b0a8c000db194943b959646fd004e8488a8c8f7db6bee9a37e0073baea766e7269bfcd550a1553d37cd032fdbcee322996fb3b7b482f54e1f525620a426c5a8031012c4eb6ccf293ebe62eb12732b40e622f638ce3d00cfdb184b41a53a32a491d3769aee55bf9d5205e553b72bcdea981919e79a9666934f43061bec93adbc1c2bc5dedcdde3235cd439cf6b18028ce06cc19d381b08981178a18a9047bf9034e6135be24a037c6776131eb9bafae6657b964bc19043364ab41173fd091ad844a2763148c7704647a629c41bf9e7d80a49387fef429c5a90ed672df226684f8ff275786724699d82bb12eb58b414417110cb37c234c48f855f285b6aa13579d71158262571b1f9b5aa20963f5346fc0de90ee9d6092e3cbc1ef00ac04895051785263ca93f2ceeb02b01f4ff744701db215db5cd31d0d5964c8a9da15021cfcee3d804711f306dc6f7ace3232c9bffa409746f4060fd7d3911b43b5b9cdbbec8cd0ed12b5e76996893eeabdd4f15a67a6bfcd6fee80ea592bec65541e33eb1e3cdef38c4d192d936d8f964e5e914b187bff52ea8538e7c2077ddd7eb72a02402283db9498b84a9f12b6d6fbdf2b23abd897a0b91b2d5528aa310a3bb9a1617d68b2f27371ff1868bf29237e894a828508d111895b21b8823ef680a84dd8cbaf0db81f4fd45ab89e51b0d7005097bb6d774dd281f13632c10edb5365837cfd2d69e843ec73fb5da0fd5ce08ec1c6d3f8dc1acf976c13d4e5d2844aec49213692b18a1cf0f8d4f3404a0860657f36dc7cfc461c653270b78f80e09c8be5b6e9e83596882d59f7ad7148da88fc125777f3a40244d083ab401072e2837ee773c26fa20197220d4f53902cf58b13baa21645791c4ea3d19f8ae897fcf9d5344364c3267414d7854153672a5dea2143515d821a775a3cbba2fb22b9d09ad8bbb9117d19a74e09b777cbd3a8352f05b06c386570860fbf65a5b5fb23c7d0299f0a7540e34246861414027586006d7df7974be30e062c9cdadb340c9921e8ecb8650c444265bfde678d5786c6dbec322976a7d17b268ca1ff5ddbd0296a59dc7c499a09ceac0bf62129fcaa2340c7ee1432e255e7cda55df0a75f08e1159bb0206f4a1e20402f5c0e71774f486ec50a8ac6a1db2538891119bd7e0117bde783cb032edba454cd8eaccb49e341ae9528cc29cefbf4e912ab79a1ef0363cd91330f69f4e90826659beca3479bb37b4679b35734a100909ef8b5f11b147f2da28f9d0bf48e98dde6e1969f8b8d99b64cf019a46116d902d0e8f5929ab82fd338ff23604e4bbf9bbe6c30c17e6a9c8803cda27ab35115609c54198e4a5defebebe8d26c58c5355d98c5a6cf3c3e3a0e85a51af9711b00b0b13406ff6d2d62ec558bb0e3b687c1029379b6076fa19c3070477d047d8744954f44164f4f5e04a459a45c2cb7c95457bb245949fdee86ff6538079ff573a16f6627237652a7db2d7b809076af4a07d940165c080f1f32049325fba2f552f032c98a7ec7f3b545c81612e25576ae9445885d6cd25ccfb1efbd371a8670a62976d5bec5de8c58be941319a4ca5738e337d686a6d641ed5f445c53f9e362d003d8bed2afc088191ffd688f9beae9e52b1d8197cca832651de09222c67987f0d5b44218524d2f0b6e364231a7038c97ac622f2adfa303e393b7d04a569a53f34e036c421870d2f14d2007eb4065ea5553ad83aaa36c1f77537affa68be9b2d1e18300696531b7d33b33e3b9e87fbc988f158836765a66988b4c0d98dd0d65d1ff1b3e4e1bb129287237092b008e81972f929e06bce222f89433a90a109491274f641720ca0f4521b6572804437cdfd8b6e7f67b3b25ebd9a749aa7318dc59bd5133751bf19015a9411af04c8a07e738b7b0103117d54dba9032fa40898927f1d520e787bb47a3853a0bcb3a80b4903f53356df6e8c188af988683284b871f3e058895c62d06df2302fbf57dc2430283113234cd432610d088e408f2563dc60f1eb42e9b554aaa492204635e25f4552c44a343eee39c3071b9045e0f5b75fe8080be0da8cccfa667b124eae0b44a845c1ab39f58e55f0b856d939abb427506ebe6f1a5389bbe819ea4f50a9db17f774aaec7659609f0bf508a8723fd5e4a95969a60fd7dc91113966bc34c30f92c59256cbe886f109a1cc6b07504aba6b3e096f8cbe6b795063f11e47f1c7c766959c684e729bdef064e7f2f3cfc43feb598e088671bfc7ba9534ec5fdd55b56cf641bbfe5ad2b226032b1"})
mmap$auto(0x8000000000000001, 0x7ff, 0x0, 0xfffffffffffffffb, r6, 0x7)
ioctl$IOCTL_GET_NCIDEV_IDX(r3, 0x0, &(0x7f0000001480)=<r7=>0x0)
connect$auto(r2, &(0x7f00000014c0)=@nfc={0x27, r7, 0xffffffffffffffff, 0x1}, 0x2)
r8 = semctl$auto_SETVAL(0xba, 0x2, 0x10, 0x8)
ptrace$auto(0x4, r8, 0x8, 0x5)
waitid$auto_P_PGID(0x2, r1, &(0x7f0000001500)={@siginfo_0_0={0x0, 0x3, 0x5, @_rt={0x0, 0x0, @sival_int=0xe}}}, 0x0, &(0x7f0000001580)={{0x253, 0x9}, {0x200, 0x4}, 0x8, 0x7f, 0x2, 0x0, 0x2, 0x1000, 0x8, 0x2, 0x3, 0x2, 0x9, 0x8, 0x1, 0x1})
mmap$auto(0x6, 0x3, 0x4, 0x3f, r6, 0x6dabfa32)
r9 = syz_genetlink_get_family_id$auto_nl80211(&(0x7f0000001680), 0xffffffffffffffff)
sendmsg$auto_NL80211_CMD_GET_REG(r1, &(0x7f0000001740)={&(0x7f0000001640)={0x10, 0x0, 0x0, 0x100000}, 0xc, &(0x7f0000001700)={&(0x7f00000016c0)={0x28, r9, 0x8, 0x70bd28, 0x25dfdbff, {}, [@NL80211_ATTR_STA_LISTEN_INTERVAL={0x6, 0x12, 0x6}, @NL80211_ATTR_WPA_VERSIONS={0x8, 0x4b, 0x8001}, @NL80211_ATTR_TX_NO_CCK_RATE={0x4}]}, 0x28}, 0x1, 0x0, 0x0, 0x80}, 0x0)
ioctl$auto_SG_GET_RESERVED_SIZE(r1, 0x2272, &(0x7f0000001780)="4d1d72bb5f31bf01a18b3b27c79a2cba6aa6c975293d02108bc87a736c3c79e63702debd8b1747a2e2953dc56c66b4f041e0c45415aab531e5dc1441ff6a6200067257abc735a5cb381dc2ed4faa395bc931e6ffeb68f9fd8273a3ba177cf025e9b31149a55323889681d7")
r10 = syz_genetlink_get_family_id$auto_netdev(&(0x7f0000001840), r1)
ioctl$sock_SIOCGIFINDEX(r3, 0x8933, &(0x7f0000001880)={'caif0\x00', <r11=>0x0})
ioctl$sock_SIOCGIFINDEX(r6, 0x8933, &(0x7f00000018c0)={'\x00', <r12=>0x0})
sendmsg$auto_NETDEV_CMD_DEV_GET(r3, &(0x7f0000001bc0)={&(0x7f0000001800)={0x10, 0x0, 0x0, 0x10000}, 0xc, &(0x7f0000001b80)={&(0x7f0000001b00)={0x64, r10, 0x4, 0x70bd2a, 0x25dfdbfc, {}, [@NETDEV_A_DEV_IFINDEX={0x8, 0x1, r11}, @NETDEV_A_DEV_IFINDEX={0x8, 0x1, r12}, @NETDEV_A_DEV_IFINDEX={0x8}, @NETDEV_A_DEV_IFINDEX={0x8}, @NETDEV_A_DEV_IFINDEX={0x8}, @NETDEV_A_DEV_IFINDEX={0x8}, @NETDEV_A_DEV_IFINDEX={0x8}, @NETDEV_A_DEV_IFINDEX={0x8}, @NETDEV_A_DEV_IFINDEX={0x8}, @NETDEV_A_DEV_IFINDEX={0x8}]}, 0x64}, 0x1, 0x0, 0x0, 0x40800}, 0x20000880)
executing program 6:
bpf$auto(0x5, &(0x7f0000000000)=@test={0x12, 0x1, 0x0, 0x9, 0x1, 0x3, 0x3da1, 0x0, 0xb4, 0x7, 0x140000000000, 0xdb, 0x7fffffff, 0x10, 0x1}, 0x171)
r0 = socket$nl_generic(0x10, 0x3, 0x10)
r1 = syz_genetlink_get_family_id$auto_batadv(&(0x7f0000000080), r0)
ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000240)={'batadv0\x00', <r2=>0x0})
sendmsg$auto_BATADV_CMD_GET_MCAST_FLAGS(r0, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000280)={&(0x7f0000000200)=ANY=[@ANYBLOB="1c000000", @ANYRES16=r1, @ANYBLOB="afa72db57000ffdbdf250e00000008000300", @ANYRES32=r2], 0x1c}, 0x1, 0x0, 0x0, 0x300}, 0x20000000)
executing program 4:
openat$auto_seq_oss_f_ops_seq_oss(0xffffffffffffff9c, &(0x7f0000000080)='/dev/sequencer2\x00', 0x2, 0x0)
r0 = socket(0x11, 0x3, 0x9)
capset$auto(0x0, &(0x7f0000000000)={0xb213, 0x2c, 0x800})
openat$auto_fb_fops_fb_chrdev(0xffffffffffffff9c, &(0x7f0000000100)='/dev/fb0\x00', 0x2, 0x0)
openat$auto_tty_fops_tty_io(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ttynull\x00', 0x201, 0x0)
r1 = openat$auto_loop_ctl_fops_loop(0xffffffffffffff9c, &(0x7f0000000440), 0x20100, 0x0)
ioctl$auto_LOOP_CTL_REMOVE(r1, 0x4c81, 0x0)
mmap$auto(0x0, 0x400008, 0xdf, 0x9b72, 0xffffffffffffffff, 0x0)
write$auto(0x3, 0x0, 0x7fffffff)
openat$auto_stat_fops_(0xffffffffffffff9c, &(0x7f0000000140)='/proc/stat\x00', 0x2, 0x0)
read$auto(0x3, 0x0, 0x80)
mmap$auto(0x0, 0x4020009, 0x6, 0xeb1, 0x401, 0x8000)
mmap$auto(0x0, 0x7, 0x1000000004, 0x9b72, 0x2, 0x100)
openat$auto_proc_iter_file_ops_compat_inode(0xffffffffffffff9c, 0x0, 0xc0000, 0x0)
listxattrat$auto(0xffffffffffffffff, 0x0, 0x7ffffffe, &(0x7f0000000380)='\xdf^\xe2o\x87D\x10\xa0\x0e1\xb5B\xd6k]Yh\x99\xf4\xbcy.8\xcd\xf2I\xcc\xf5\xc7\xee\xb8\xea\xb7+\xd8K\xf1\x1aI\xe6(\x9f\xaeS\xf1\x199\x1fk\x01\xf36\xe1 \x1a+\xcd\xfc6\xc7W\xeaw7\x1b\xf4\x01\xebQ\n\x94{\xb5\xa7/\xa3\xa7\x16\x82\x1c\rEqd\xf7~\xba{\x8f7S\x82\xed\x8es\x02W\xdc\x16l\xee\xf1\xd9\x83\xc8', 0xe9)
statmount$auto(0x0, &(0x7f0000000180)={0x8, 0x1, 0x1, 0x3, 0xf, 0x940, 0x1ffde, 0x3, 0x6, 0x8000002, 0xff, 0x5, 0x5, 0x4, 0xb0, 0x7, 0x2, 0x3, 0x5, 0x7, 0x0, 0x0, 0x0, 0x0, 0x0, 0x80000009, [0x0, 0x4000000000000000, 0x10000, 0x243efbdf, 0x0, 0x0, 0x4000000000000, 0x0, 0x0, 0xffffffffffffffff, 0x9, 0x0, 0x0, 0x0, 0x0, 0xfffffffffffffffd, 0x0, 0x9, 0x0, 0x0, 0x0, 0x0, 0x800, 0x0, 0x0, 0x9, 0x0, 0xfffffffffffffffc, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff, 0xfffffffffffffffc, 0x0, 0x0, 0x0, 0x0, 0x0, 0xe6e, 0x0, 0x0, 0xfffffffffffffffe]}, 0x1fe, 0x81)
close_range$auto(0x0, 0xffffffffffffffff, 0x2)
sendmsg$auto_OVS_VPORT_CMD_DEL(0xffffffffffffffff, &(0x7f0000000200)={0x0, 0x0, &(0x7f00000001c0)={&(0x7f0000000180)=ANY=[@ANYBLOB='<\x00\x00\x00', @ANYBLOB="11002d"], 0x3c}, 0x1, 0x0, 0x0, 0x8000}, 0x8000)
r2 = socket(0x10, 0x2, 0x0)
sendmsg$auto_NL80211_CMD_GET_REG(r2, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000280)={&(0x7f0000000180)=ANY=[], 0x1ac}, 0x1, 0x700}, 0x40000)
sendmsg$auto_NL80211_CMD_GET_REG(0xffffffffffffffff, 0x0, 0x40000)
sendmsg$auto_NETDEV_CMD_DEV_GET(0xffffffffffffffff, &(0x7f0000000080)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x400000}, 0xc, 0x0, 0x1, 0x0, 0x0, 0x24048000}, 0xc0)
ioctl$auto(0xffffffffffffffff, 0x13, 0xffffffffffffffff)
io_uring_register$auto(0x2, 0x0, &(0x7f0000000000), 0x3)
mmap$auto(0x0, 0x400008, 0xdf, 0x9b72, 0x2, 0x8000)
mbind$auto(0x2000, 0x100000004, 0x100000000, 0x0, 0x6, 0x2)
syz_clone3(&(0x7f0000000400)={0x9840100, 0x0, 0x0, 0x0, {0x31}, 0x0, 0x0, 0x0, 0x0}, 0x58)
mmap$auto(0x0, 0x40009, 0xe2, 0x9b72, 0x7, 0x28000)
openat$auto_kernfs_file_fops_kernfs_internal(0xffffffffffffff9c, &(0x7f0000000080)='/sys/devices/LNXSYSTM:00/LNXSYBUS:00/PNP0A03:00/device:08/adr\x00', 0x0, 0x0)
sendmmsg$auto(r0, &(0x7f0000000400)={{&(0x7f0000000000), 0x5aa, &(0x7f00000000c0)={&(0x7f0000000040)="661b", 0x49}, 0x1, &(0x7f0000000200), 0x5, 0x3}, 0x4}, 0x2, 0x100)
executing program 6:
sendmsg$auto_NL80211_CMD_GET_REG(0xffffffffffffffff, 0x0, 0x0)
socket(0x2, 0x80002, 0x73)
socket(0xa, 0x1, 0x84)
ioctl$auto(0x3, 0x8905, 0x38)
ioctl$auto_TIOCMSET2(0xffffffffffffffff, 0x5418, 0x0)
setsockopt$auto_SO_DETACH_FILTER(0xffffffffffffffff, 0x6, 0x1b, &(0x7f0000000140)='/dev/audio1\x00', 0xf)
r0 = openat$auto_tracing_pipe_fops_trace(0xffffffffffffff9c, &(0x7f0000000100)='/sys/kernel/debug/tracing/per_cpu/cpu0/trace_pipe\x00', 0x101801, 0x0)
setsockopt$auto_SO_DETACH_FILTER(r0, 0x6, 0x1b, &(0x7f0000000140)='/dev/audio1\x00', 0xf)
openat$auto_binder_fops_binder_internal(0xffffffffffffff9c, 0x0, 0x1, 0x0)
socket(0x28, 0x1, 0x0)
r1 = openat$auto_posix_clock_file_operations_posix_clock(0xffffffffffffff9c, &(0x7f0000000080), 0x40400, 0x0)
ioctl$auto_posix_clock_file_operations_posix_clock(r1, 0x40103d02, 0x0)
sendmsg$auto_NL80211_CMD_TRIGGER_SCAN(0xffffffffffffffff, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000240)={&(0x7f0000000180)=ANY=[], 0x14}}, 0x4000000)
openat$auto_seq_oss_f_ops_seq_oss(0xffffffffffffff9c, &(0x7f0000000080)='/dev/sequencer2\x00', 0x2, 0x0)
r2 = openat$auto_snd_rawmidi_f_ops_rawmidi(0xffffffffffffff9c, &(0x7f0000000000)='/dev/snd/midiC2D0\x00', 0x1, 0x0)
openat$auto_proc_sys_file_operations_proc_sysctl(0xffffffffffffff9c, &(0x7f0000000000)='/proc/sys/fs/pipe-max-size\x00', 0x382, 0x0)
sendmsg$auto_NFSD_CMD_THREADS_SET(0xffffffffffffffff, &(0x7f0000000100)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000040)=ANY=[@ANYBLOB='$\x00\x00\x00', @ANYRES16=0x0, @ANYBLOB="00042cbd7000fb3d89cb809172a33200030080004000880001"], 0x24}, 0x1, 0x0, 0x0, 0x20008010}, 0x400d0)
sendmsg$auto_NL80211_CMD_GET_REG(0xffffffffffffffff, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000040)=ANY=[@ANYBLOB="72010000", @ANYBLOB="1a0027"], 0x1ac}, 0x1, 0x0, 0x0, 0x4000804}, 0x40000)
r3 = socket(0x10, 0x2, 0x0)
sendmsg$auto_NL80211_CMD_GET_REG(0xffffffffffffffff, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000300)={&(0x7f0000000040)=ANY=[], 0x1ac}, 0x1, 0x0, 0x0, 0x44814}, 0x2004c0c4)
sendmmsg$auto(r3, &(0x7f0000000200)={{0x0, 0x0, &(0x7f0000000100)={&(0x7f0000000080), 0xfc2}, 0x2, &(0x7f00000001c0), 0x7, 0xa505}, 0x800}, 0x7, 0x8)
write$auto(r2, &(0x7f0000000400)='/dev/audio1\x00', 0xa3d9)
select$auto(0xe, 0x0, 0x0, &(0x7f00000002c0)={[0x1ff, 0x7, 0xd, 0xa00, 0x948b, 0x2, 0xfffffffffffffffc, 0x6, 0x3, 0x300000000000000, 0x80000001, 0x5, 0x6d3c, 0x5, 0x2]}, 0x0)
madvise$auto(0x108000, 0x800034, 0xa)
unshare$auto(0x40000080)
msgrcv$auto(0x0, 0x0, 0x2, 0x1, 0xb2)
msgsnd$auto(0x0, &(0x7f0000000000)={0x3, 0x45}, 0x8, 0x9)
executing program 5:
openat$auto_snd_pcm_oss_f_reg_pcm_oss(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/dsp1\x00', 0x20b42, 0x0)
read$auto_proc_reg_file_ops_compat_inode(0xffffffffffffffff, &(0x7f0000000280)=""/65, 0x41)
mmap$auto(0x0, 0x4020009, 0x6, 0xeb1, 0x401, 0x8000)
prctl$auto(0x1000000003b, 0x1, 0x4, 0x5, 0x7)
socket$nl_generic(0x10, 0x3, 0x10)
close_range$auto(0x2, 0x8, 0x0)
sendmsg$auto_NETDEV_CMD_DEV_GET(0xffffffffffffffff, &(0x7f0000000080)={&(0x7f0000000140)={0x10, 0x0, 0x0, 0x400000}, 0xc, 0x0, 0x1, 0x0, 0x0, 0x48000}, 0x0)
mmap$auto(0x0, 0x400008, 0xdf, 0x9b72, 0x2, 0x8000)
close_range$auto(0x2, 0x8000, 0x0)
sendmsg$auto_HSR_C_GET_NODE_STATUS(0xffffffffffffffff, &(0x7f0000000200)={0x0, 0x0, &(0x7f00000001c0)={&(0x7f0000000140)={0x68, 0x0, 0x200, 0x70bd26, 0x25dfdbfe, {}, [@HSR_A_IF1_AGE={0x8, 0x3, 0x200}, @HSR_A_IF2_SEQ={0x6, 0x7, 0x4}, @HSR_A_IFINDEX={0x8}, @HSR_A_NODE_ADDR_B={0xa}, @HSR_A_NODE_ADDR={0xa, 0x1, @broadcast}, @HSR_A_NODE_ADDR={0xa}, @HSR_A_IF1_AGE={0x8, 0x3, 0x38}, @HSR_A_IFINDEX={0x8}, @HSR_A_IF2_AGE={0x8, 0x4, 0x4}]}, 0x68}, 0x1, 0x0, 0x0, 0x40080}, 0x40090)
socket(0x2, 0x3, 0x100)
socket(0x10, 0x2, 0x0)
sendmsg$auto_NL80211_CMD_GET_REG(0xffffffffffffffff, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000200)={0x0, 0x1ac}, 0x1, 0x0, 0x0, 0x4004810}, 0x800)
sendmsg$auto_NL80211_CMD_GET_REG(0xffffffffffffffff, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000180)=ANY=[@ANYBLOB="720100", @ANYBLOB="13"], 0x1ac}}, 0x4004)
sendmmsg$auto(0x3, &(0x7f0000000080)={{0x0, 0x2, &(0x7f00000002c0)={0x0, 0xc4}, 0x1, 0x0, 0x0, 0x9}, 0x7}, 0x3, 0x0)
executing program 0:
mmap$auto(0x0, 0x20009, 0x4000000000df, 0xeb1, 0x401, 0x8000)
prctl$auto(0x22, 0x40, 0x0, 0x7, 0x7fffd)
clone$auto(0x20003b46, 0x2, 0x0, 0x0, 0x2)
prctl$auto(0x10000000024, 0x2, 0x2008, 0x4000000c, 0x80001)
openat$auto_vmwgfx_driver_fops_vmwgfx_drv(0xffffffffffffff9c, &(0x7f0000026d00)='/dev/dri/card1\x00', 0x2000, 0x0)
mmap$auto(0x0, 0x202000b, 0x3, 0xeb1, 0xfffffffffffffffa, 0x8000)
r0 = io_uring_setup$auto(0x401, 0x0)
socket(0x26, 0x80004, 0x73)
socket$nl_generic(0x10, 0x3, 0x10)
socket$nl_generic(0x10, 0x3, 0x10)
socket$nl_generic(0x10, 0x3, 0x10)
socket$nl_generic(0x10, 0x3, 0x10)
ioctl$auto_SNDCTL_DSP_SETTRIGGER(r0, 0x40045010, &(0x7f00000000c0))
clone$auto(0x4, 0x7, &(0x7f00000000c0)=0x1, &(0x7f0000000100)=0xff, 0x7ff)
mmap$auto(0x0, 0x2000b, 0xe2, 0xeb1, 0x405, 0xfffffffffffffff9)
clone$auto(0x3fff, 0xad3, 0x0, 0x0, 0x7fffffff)
wait4$auto(0xffffffffffffffff, 0x0, 0x80000001, 0x0)
sendmsg$auto_GTP_CMD_NEWPDP(0xffffffffffffffff, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000180)={0x0}, 0x1, 0x0, 0x0, 0x8000}, 0x4040804)
lstat$auto(0x0, &(0x7f0000000180)={0x4, 0xb, 0x6, 0x76402f57, 0x0, 0x0, 0x0, 0x4, 0x40000000000f, 0x400, 0x40000402, 0x4, 0x9, 0x4, 0x9, 0x7, 0x20000010010b})
r1 = socket$nl_generic(0x10, 0x3, 0x10)
dup3$auto(0x8000000000000001, 0x5, 0x800080000)
ioctl$sock_SIOCGIFINDEX(r1, 0x89fc, &(0x7f0000000040)={'bridge0\x00'})
socket$nl_generic(0x10, 0x3, 0x10)
socket$nl_generic(0x10, 0x3, 0x10)
eventfd$auto(0x3)
eventfd$auto(0x0)
r2 = socket(0xa, 0x2, 0x0)
bpf$auto(0x0, &(0x7f0000000000)=@link_update={r2, @new_prog_fd=0x4, 0x4}, 0xa3)
setsockopt$auto_SO_WIFI_STATUS(0xffffffffffffffff, 0x0, 0x29, 0x0, 0x9)
getsockopt$auto(0xffffffffffffffff, 0x6, 0x3, &(0x7f0000000140)='bridge0\x00', &(0x7f0000000240)=0x6b96)
executing program 5:
mmap$auto(0x0, 0x20009, 0xe2, 0xeb1, 0xffffffffffffffff, 0x8000)
close_range$auto(0x2, 0x8, 0x0)
socket(0x8, 0x2, 0x9)
r0 = socket(0x2, 0x1, 0x0)
r1 = socket(0x2, 0x1, 0x0)
bind$auto(0x3, &(0x7f0000000040)=@in={0x2, 0xffff, @remote}, 0x6a)
listen$auto(r0, 0x7)
sendmmsg$auto(r1, &(0x7f0000000140)={{&(0x7f0000000040), 0x12, 0x0, 0x9, 0x0, 0x1, 0xb}, 0x800009}, 0x5, 0x20000000)
r2 = openat$auto_proc_reg_file_ops_compat_inode(0xffffffffffffff9c, &(0x7f0000000000)='/proc/asound/card1/pcm0c/sub7/sw_params\x00', 0x0, 0x0)
pread64$auto(r2, 0x0, 0xffe, 0x0)
executing program 5:
r0 = socket(0x10, 0x2, 0x0)
close_range$auto(0x2, 0x8, 0x0)
socket(0x10, 0x2, 0x4)
socket(0x10, 0x3, 0x6)
sendmsg$auto_NL80211_CMD_GET_REG(r0, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000300)=ANY=[@ANYBLOB="72010000", @ANYBLOB="120027", @ANYBLOB="5de1"], 0x1ac}}, 0x40000)
read$auto(r0, &(0x7f0000000000)='$-]&@\x00', 0x5)
executing program 5:
mmap$auto(0x0, 0x400008, 0xdf, 0x9b72, 0x2, 0x8000)
socketpair$auto(0x1e, 0x5, 0x8000000000000000, 0x0)
r0 = openat$auto_vmuser_fops_vmci_host(0xffffffffffffff9c, &(0x7f0000000180), 0x6b2c03, 0x0)
ioctl$auto_IOCTL_VMCI_VERSION2(r0, 0x7a7, 0x0)
ioctl$auto_IOCTL_VMCI_INIT_CONTEXT(r0, 0x7a0, 0x6)
ioctl$auto_IOCTL_VMCI_CTX_ADD_NOTIFICATION(r0, 0x7af, 0x0)
ioctl$auto_IOCTL_VMCI_CTX_ADD_NOTIFICATION(r0, 0x7af, 0x0)
futex$auto(0x0, 0x6, 0x8, 0x0, 0x0, 0x80000001)
openat$auto_binder_fops_binder_internal(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/binderfs/binder0\x00', 0x80, 0x0)
mmap$auto(0x0, 0x2020009, 0x3, 0xeb1, 0xffffffffffffffff, 0x8000)
select$auto(0xfffffff3, &(0x7f0000000100)={[0x5, 0x400, 0x4, 0x3, 0xea47, 0x101, 0xa, 0x3ff, 0x4, 0xb4be, 0xfffffffffffffeff, 0x5, 0x3, 0xfffffffffffffffd, 0x40, 0x80]}, 0x0, 0x0, 0x0)
r1 = openat$auto_kernfs_file_fops_kernfs_internal(0xffffffffffffff9c, &(0x7f0000000080)='/sys/devices/LNXSYSTM:00/LNXSYBUS:00/PNP0A03:00/device:08/adr\x00', 0x0, 0x0)
read$auto(r1, 0x0, 0x20)
r2 = openat$auto_proc_fail_nth_operations_base(0xffffffffffffff9c, &(0x7f0000000000)='/proc/thread-self/fail-nth\x00', 0x802, 0x0)
writev$auto(r2, &(0x7f0000000200)={0x0, 0x7}, 0x3)
syz_genetlink_get_family_id$auto_tipcv2(&(0x7f0000000300), 0xffffffffffffffff)
mmap$auto(0x0, 0x4020009, 0x6, 0xeb1, 0x401, 0x8000)
r3 = openat$auto_proc_reg_file_ops_compat_inode(0xffffffffffffff9c, &(0x7f00000000c0)='/proc/self/net/fib_triestat\x00', 0x0, 0x0)
pread64$auto(r3, 0x0, 0x200000000006, 0x5)
r4 = openat$auto_kernfs_file_fops_kernfs_internal(0xffffffffffffff9c, &(0x7f0000000080)='/sys/devices/LNXSYSTM:00/LNXSYBUS:00/PNP0C0F:00/status\x00', 0xa140, 0x0)
read$auto_kernfs_file_fops_kernfs_internal(r4, &(0x7f0000000000)=""/112, 0x70)
sendmsg$auto_NL80211_CMD_GET_REG(0xffffffffffffffff, &(0x7f0000000240)={0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x40814}, 0x2004c0c4)
executing program 6:
mmap$auto(0x0, 0x4020009, 0x8000000080000000, 0x17, 0x401, 0x8000)
madvise$auto(0x0, 0xffffffffffff0005, 0x17)
openat$auto_clear_warn_once_fops_(0xffffffffffffff9c, &(0x7f0000000100), 0x210800, 0x0)
r0 = openat$auto_tty_fops_tty_io(0xffffffffffffff9c, &(0x7f0000000000)='/dev/tty46\x00', 0x0, 0x0)
close_range$auto(0x2, 0x8, 0x0)
socket(0x10, 0x2, 0x0)
socket(0x2, 0x6, 0x0)
mmap$auto(0x0, 0x400005, 0xdf, 0x9b72, 0x2, 0x8000)
socket(0xa, 0x5, 0x84)
bind$auto(0x3, 0x0, 0x6a)
ioctl$auto(0x3, 0x800005411, 0x38)
ioctl$auto(r0, 0x5600, 0x0)
mmap$auto(0x6, 0x400005, 0xffffffffffffff00, 0x9b72, r0, 0x8000)
close_range$auto(0x2, 0x8, 0x0)
socketpair$auto(0x1, 0x2, 0x8000000000000000, 0x0)
r1 = openat$auto_force_devcoredump_fops_hci_vhci(0xffffffffffffff9c, &(0x7f0000000c40)='/sys/kernel/debug/bluetooth/hci0/force_devcoredump\x00', 0x2, 0x0)
write$auto(r1, 0x0, 0xe)
mremap$auto(0x0, 0xffffffffffffffff, 0x3fd6, 0x3, 0x7fffffffb000)
mmap$auto(0x0, 0x400005, 0x800000000000df, 0x9b72, 0x2, 0x8000)
madvise$auto(0x0, 0xffffffffffff0001, 0x15)
r2 = openat$auto_proc_clear_refs_operations_internal(0xffffffffffffff9c, &(0x7f0000000600)='/proc/thread-self/clear_refs\x00', 0x2, 0x0)
mmap$auto(0x0, 0x8, 0xdf, 0x9b72, 0x2, 0x8000)
setitimer$auto(0x4, &(0x7f0000000000)={{0x1ff, 0x10001}, {0x200000000004, 0x6}}, 0x0)
openat$nci(0xffffffffffffff9c, &(0x7f0000000000), 0x2, 0x0)
bpf$auto(0x12, &(0x7f0000000000)=@info={0x2800, 0x1ff, 0x2}, 0xcf)
r3 = socket(0x10, 0x2, 0x0)
sendmsg$auto_NL80211_CMD_GET_REG(r3, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000300)=ANY=[@ANYBLOB=' \x00\x00\x00', @ANYBLOB="1200", @ANYBLOB=']'], 0x1ac}}, 0x40000)
recvmmsg$auto(r3, &(0x7f0000000380)={{0x0, 0x1, &(0x7f0000000000)={0x0, 0x400}, 0x4, 0x0, 0x200002, 0x8}, 0x803}, 0xfffffff9, 0x10010, 0x0)
write$auto_proc_clear_refs_operations_internal(r2, 0x0, 0xffffff4b)
socket(0xa, 0x3, 0x3a)

program crashed: KASAN: slab-use-after-free Read in force_devcd_write
bisect: the chunk can be dropped
bisect: testing without sub-chunk 2/3
testing program (duration=6m3s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): [5, 25, 6, 6, 25, 30, 5, 30, 27, 15, 30, 10, 6, 22, 30]
detailed listing:
executing program 4:
mmap$auto(0x0, 0x400008, 0xdf, 0x9b72, 0x2, 0x8000)
madvise$auto(0x0, 0xffffffffffff0005, 0x19)
madvise$auto(0x0, 0xffffffffffff0001, 0x15)
io_uring_setup$auto(0x6, 0x0)
madvise$auto(0x200000, 0x200007, 0x19)
executing program 5:
write$auto(0xffffffffffffffff, &(0x7f0000000000)='\'\x00', 0x4)
openat$auto_proc_reg_file_ops_compat_inode(0xffffffffffffff9c, &(0x7f0000000000)='/proc/thread-self/net/anycast6\x00', 0x0, 0x0)
mmap$auto(0x3, 0xb1, 0x3, 0xeb0, 0x401, 0xf8)
read$auto(0x3, 0x0, 0x80)
read$auto(0x3, 0x0, 0x80)
write$auto(0x3, 0x0, 0xfffffdef)
write$auto(0x3, 0x0, 0xfffffdef)
mmap$auto(0x0, 0x400008, 0xdf, 0x10, 0x2, 0x8000)
open(&(0x7f0000000000)='./file0\x00', 0x161342, 0x100)
msync$auto(0x1ffff000, 0x180000000000000, 0x400000004)
mmap$auto(0x0, 0x2020009, 0x3, 0x8011, 0xfffffffffffffffa, 0x8000)
mmap$auto(0x0, 0x2020009, 0x3, 0xeb1, 0xffffffffffffffff, 0x8000)
openat$auto_kernfs_file_fops_kernfs_internal(0xffffffffffffff9c, 0x0, 0x0, 0x0)
r0 = openat$auto_proc_fail_nth_operations_base(0xffffffffffffff9c, &(0x7f0000000000)='/proc/thread-self/fail-nth\x00', 0x20af83, 0x0)
writev$auto(r0, &(0x7f0000000200)={0x0, 0x7}, 0x3)
msync$auto(0x7, 0x45f8, 0x1)
open(0x0, 0x22240, 0x0)
socket$nl_generic(0x10, 0x3, 0x10)
socketpair$auto(0x1, 0x4, 0x8000000000000000, 0x0)
r1 = openat$auto_tty_fops_tty_io(0xffffffffffffff9c, &(0x7f0000000400)='/dev/ttyS2\x00', 0x101e81, 0x0)
ioctl$auto_TIOCSETD2(r1, 0x5423, 0x0)
openat$auto_mousedev_fops_mousedev(0xffffffffffffff9c, &(0x7f0000000040)='/dev/psaux\x00', 0x20000, 0x0)
io_uring_setup$auto(0x6, 0x0)
mmap$auto(0x0, 0x400008, 0xdf, 0x9b72, 0xffffffffffffffff, 0x8000)
close_range$auto(0x2, 0xa, 0x0)
executing program 0:
r0 = socket(0x10, 0x2, 0x0)
close_range$auto(0x2, 0x8, 0x0)
socket(0x10, 0x2, 0x4)
socket(0x10, 0x3, 0x6)
sendmsg$auto_NL80211_CMD_GET_REG(r0, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000300)=ANY=[@ANYBLOB="72010000", @ANYBLOB="120027", @ANYBLOB="5de1"], 0x1ac}}, 0x40000)
read$auto(r0, &(0x7f0000000000)='$-]&@\x00', 0x5)
executing program 6:
mmap$auto(0x0, 0x2020009, 0x3, 0xeb1, 0xfffffffffffffffa, 0x8000)
mmap$auto(0x0, 0x4, 0x4000000000df, 0x40eb2, 0x402, 0x300000000000)
socket(0xa, 0x801, 0x84)
msgsnd$auto(0x900, &(0x7f0000000000)={0x2, 0x5}, 0xf54, 0x80000001)
openat$auto_kernfs_file_fops_kernfs_internal(0xffffffffffffff9c, 0x0, 0x1c2b02, 0x0)
prctl$auto(0x12, 0x1, 0x6, 0xfffffffffffffffe, 0x4)
executing program 0:
unshare$auto(0x40000080)
socket$nl_generic(0x10, 0x3, 0x10)
socket$nl_generic(0x10, 0x3, 0x10)
mmap$auto(0x0, 0x400008, 0xdf, 0x9b72, 0x2, 0x8000)
close_range$auto(0x0, 0xfffffffffffff000, 0x2)
mmap$auto(0x0, 0x40009, 0xdf, 0x9b72, 0x7, 0x28000)
socketpair$auto(0xf, 0x7, 0x8, 0x0)
r0 = socket(0x10, 0x3, 0xb)
r1 = openat$auto_kernfs_file_fops_kernfs_internal(0xffffffffffffff9c, &(0x7f0000000080)='/sys/kernel/slab/kmalloc-64/total_objects\x00', 0x2400, 0x0)
read$auto_kernfs_file_fops_kernfs_internal(r1, &(0x7f0000000180)=""/250, 0xfa)
setsockopt$auto(r0, 0x104000000000010e, 0x1, 0x0, 0x16)
close_range$auto(0x0, 0xfffffffffffff000, 0x2)
openat$auto_proc_pid_numa_maps_operations_internal(0xffffffffffffff9c, &(0x7f0000000040)='/proc/thread-self/numa_maps\x00', 0x20000, 0x0)
open(&(0x7f0000000000)='./file0\x00', 0x161342, 0x100)
socket(0x1d, 0x2, 0x6)
futex_waitv$auto(&(0x7f0000000000)={0xfffffffffffffffd, 0x7e4, 0x2}, 0x1, 0x0, 0x0, 0x623d)
io_uring_setup$auto(0x2, 0x0)
r2 = openat$auto_tty_fops_tty_io(0xffffffffffffff9c, &(0x7f0000000400)='/dev/ttyS2\x00', 0x101e81, 0x0)
ioctl$auto_TIOCSETD2(r2, 0x5423, 0x0)
close_range$auto(0x2, 0x8, 0x0)
socket(0x23, 0x80805, 0x0)
socketpair$auto(0x4, 0x1, 0x20000, 0x0)
r3 = openat$auto_tty_fops_tty_io(0xffffffffffffff9c, &(0x7f0000000400)='/dev/ttyS2\x00', 0x101e81, 0x0)
ioctl$auto_TIOCSETD2(r3, 0x5423, 0x0)
ioctl$auto_TIOCVHANGUP2(r2, 0x5437, 0x0)
executing program 5:
r0 = semctl$auto_IPC_STAT(0xf, 0x2, 0x2, 0x8)
r1 = prctl$auto_PR_SET_NO_NEW_PRIVS(0x26, 0x9, r0, 0x6, 0xda8)
r2 = openat$auto_sg_fops_sg(0xffffffffffffff9c, &(0x7f0000000000)='/dev/sg0\x00', 0x400040, 0x0)
lseek$auto(r1, 0x4, 0x2)
r3 = prctl$auto_PR_SET_NAME(0xf, 0x4, r0, 0x4, 0x81)
r4 = syz_genetlink_get_family_id$auto_thermal(&(0x7f0000000080), r1)
sendmsg$auto_THERMAL_GENL_CMD_TZ_GET_TEMP(r3, &(0x7f0000000240)={&(0x7f0000000040)={0x10, 0x0, 0x0, 0x1000000}, 0xc, &(0x7f0000000200)={&(0x7f00000000c0)={0x110, r4, 0x200, 0x70bd26, 0x25dfdbfe, {}, [@THERMAL_GENL_ATTR_TZ_ID={0x8, 0x2, 0x2}, @THERMAL_GENL_ATTR_CDEV_MAX_STATE={0x8, 0x12, 0x2}, @THERMAL_GENL_ATTR_CDEV_CUR_STATE={0x8}, @THERMAL_GENL_ATTR_CDEV={0xcc, 0xf, 0x0, 0x1, [@nested={0x4, 0xd9}, @nested={0xc1, 0x76, 0x0, 0x1, [@generic="e67cbd765535320bb721f053ce5b6bf16aa71ebf81d4d5b0fa3b48c2041dadaf53333c066446b22b964d5ee30e9600f92198f80cf5ef55d87dc2c02358171d103e4417da88d25b864f66c730777d668d066bb96b175ab76bdb8a4ab173b78649b941bc899c5f388745ac343a5f8e85946c41ba14cda7e6acd76befeca2afda478efaa1ca27f711b41e85ef65debf32ccf2ffd8be145d9d59b3f290cf38c2ae0f858a972483d7da5fd9ca8d2fe6fcb6bdc6a62aa4db2c4d9367070742ba"]}]}, @THERMAL_GENL_ATTR_THRESHOLD_TEMP={0x8, 0x1a, 0x2}, @THERMAL_GENL_ATTR_TZ_GOV_NAME={0xf, 0xe, '-,{{\\(##.$*'}]}, 0x110}, 0x1, 0x0, 0x0, 0x80}, 0x850)
madvise$auto(0x1, 0xf, 0x9)
r5 = openat$auto_proc_fail_nth_operations_base(0xffffffffffffff9c, &(0x7f0000000280)='/proc/self/fail-nth\x00', 0x240042, 0x0)
fadvise64$auto_POSIX_FADV_DONTNEED(r3, 0x4, 0x6, 0x4)
r6 = getsockopt$auto_SO_MARK(r1, 0x7, 0x24, &(0x7f00000002c0)='/proc/self/fail-nth\x00', &(0x7f0000000300)=0x7fff)
setsockopt$auto_SO_ATTACH_REUSEPORT_EBPF(r6, 0xcf, 0x34, &(0x7f0000000340)='\x00', 0x3)
timer_create$auto_CLOCK_MONOTONIC(0x1, &(0x7f00000003c0)={@sival_ptr=&(0x7f0000000380)="be293c4f6a7407458de90e000146812641314dd429d426538eb87881a8dd", @raw, 0x4}, &(0x7f0000000400)=0xffffffff)
madvise$auto(0x4, 0x8, 0x5)
openat$auto_tracing_stats_fops_trace(0xffffffffffffff9c, &(0x7f0000000440)='/sys/kernel/debug/tracing/per_cpu/cpu0/stats\x00', 0x40000, 0x0)
ioctl$auto_BTRFS_IOC_SNAP_CREATE(r1, 0x50009401, &(0x7f0000000480)={@inferred=r5, "b054b7b57308300340ed802ae20ec1d8f00876883702f074918367146fee8b4026d4b0801429e78762e266570309f2b5fa0ceb5bfe5b79aa318b878efa9cba71dd2bf0e75e11949f89ad73b6aabdbd0d8d6a34fd54da1c02d5261271090e364dbefed860940ce2e47f1b7cbe11f28aed80064fc66b2911b0ba7e90b34e7eede686b1885aada364347e5ad87029dfd798741ba88aa50ecf5206d4acee8bb8101250c6cae9211900a0bb8a6a772b3088d8657950ce125c7855cfbaba7123376de40fdd812062ca46e11ec47c2c0b7b39a401f43eed39a3c369a888f067365b26b7f36145c8d54236904922bb04110b3575ad44ca2751e6c332b743d821fa3b342a769e0d9a4e7817965c8587fef82ede49b05f2fff436da9fb2a38fe344868fe26b6b03b427a36dbae88ef21c0c8627f5a79e883bf069ec10b0a39bdc631ce96219bf6c3a821a5861e855ed91af601a3fc2cc425ffdc3bf613bd2842a7b0e941eca9a6b5e61a1fa9e72d8ecc4be9a829737ca878ad1c4161434405f5c12de634c8723151394c437b19615ca9fa9dc53829c03f63695926409b81e81775269e13e46916c6dce115d7535ebb7986d04d0e6506707fce81bafa94fcbe9b0115a487e2051eb5c32aefb218d0e6a79ee7829bf1a384e6a529fa6a6eb2a846f97cd69ec1feceb3d100165362e28c5c8886f5dd9116eb18b7aab67cec251053b044266d9117cb02f463a151383afcd0c22ffa3d7bac9ddf3fe823a2ecbcb0143f777ad7bb6a8e5b8eabd38d5f900b1ef393d0e3e205f27e12c09f68a3b22125a2ab8b9b0c9e578028c7afb9a5aba4ee4dc621e5a6a9a1d8fa05a33464bfd87f9c09530f5451e47999080d3e37013d5225b571c131f51f2fede90b933b6b94a33c3975e850482c298dd703c9c426aa5df8ca1f9b2fd45d8c5094c6eeaca5e9eaa39757361554b027c17aeec6c949f49ec133e3aba14e9d131ab6fe17ac7a702d8395069acc64ded113db649e79b0797cadf4a09108e854e421ed3ba06c966199f61dd56821a32cdf93488d2ee9c88a196fd8546f13dda65859dfd0685a368f7be74097082d58e1d43ad1ab5637778f887ee1ccffd30b67991450dcf720f3f56ef3fa9cdf4c582ebd42092e04c1b039dc20bab01fd9b0a97b95316e3c36e88172544fba87d7444bbb5454f630b2c66e2636ade1014850697ed10e8ae170e883c5e889fa4c5b45b73b27731c3991ea46d778cae89cc0b481e3bd06b208696fff729a8db49878e13062aa24c5ba1c2a8c556b9fb8cf6238cbec2f2c980fd3fee3708ec6614137269805aef61ae4730a7e04e0a43a5462da7ab004fd710284f18c9c4eab74d0544704842e3a60e5453a47bb162bbf7a1674dc8ced553da7e37fa53aa994286803393a8d3165685502c83f5c36bb55fe2861069538ba8929b0d1df00400dec38d829a483396eb724c715b0154b344ffd0f9ed7af56f4cb4053f613919e2269af04f2c02bc40403f4c7069a935576958e82d13fd3e63c749cb66af73258f659721da7647a7cab85d11fc34409f94a2c4c9ec25d03650ad0e355c3191f6a5d1b721814535de27260c31b6db845f4e3c675f8f824f6244a1608f641fe864ef2a2a3074e0f0f8e90941199758ef3066a71979e6a6042224a8d686c3e4f2f00f73ac46eb9b8f4b4dee53eba78ec3136afab07ebd8fe930a522a7fa34c8a1a0d34b48fa6475413b8113ca903c143b151c06da5c57476f16e39cd9b50dade84f58b140fc3439e6a63f11e02ce8ddd9d05c92f583d60c58b22f75315fbebb2e2f38ef26b53d989c81027815273a570a13423b98d87763dbe3a3786639f374233ab52cf1b61ed6fea8bba9345f0cc72c1853eb4719858d6e118ffa46f8b29a091b12bdeb731aeb0d31c746a5e654184660bac656d50c4ffbd5a4c14df08ae3e2c4a905259a47f9797d41160085ae44b9800375cee7e80ae68aebe6980b610dbac4090c213ce27b66700534fd7b9301d1f40ff117b54b0caa541fdcdcbf91ae7e342c1f249dbea25b497197a3f2fdb6485dde2f88315d8388a023fbf56263e3dd5ba31fc074ca2142506268cbc69e92302e5f6d07543272a111a6a19a6190334de3f0658e586f6d6201633f3e9c5dd2f4923ad5b76478f30cd96fc00f200b1fd6b64660a677ed56674813ddbc62079ef93872ee35545cd898dc682290544ff41be4ca8f30ed48cfa6bf89a1dcb9ee7f3595f6acce6903e7a5d40c96276c595071c55aea7b8abd3e608468155a637cb85d64d072a06193844e98da59d1a2f4442c474f7e53e96f448392c1171dbf5b8c48961998d61f87c2fee8ca051b4fe6e75eaba6ae660e03eab726cb1b3318751a43123d51e45e40dfb9ca475ef0542b06276169a712f23b82a4750c6ceed8e3e23e02e6f0d910c38ed8bbe68fccf0248facee3f854119868351afc6302dbc3df8431b880a6f400719938701c2f83fd687071f58799d8c35337b8a2ae7cb21ba7f63a49b09df650e739f86aa39c6028150c30405e72ca300083e4ac7b3abb6aece2341b106ef53f7d6970c6acbc7f13aa93fdc73bbd899c9ae1419e022b2dc788b1937fb94db9824b7e68a4c6356ea57c6be8e574798f2a2fa8dd4e5ecb3003a2330de58506e419715e080099965092eaae79653f727ddfa20154100ff810c0a0e576e82e846db4d4b38271b274101237ec6fdb30b5ef4f6767bba91fe54180712ffb296fdc7fb9b71fc47210203f5a27e2565d018c50f395e017100ed35447c6176e237b07c1f42276849464a6d69ccc6b6d7181c9b211a3d0c29c1f7157b44ee0fb063fe7d39147d1e4d966e3b8eb9f8cc4c27b93741cb6d99a8bbff4e9b31b88b0700603ee888ef878b56f7a76cd038b39fb3cfa78e0769bd012e5e2cb3b8c9be91239e288a2688a86236bd161faa8c29d651717bb9854a36f975268266936ad78f398b001b1c6acfbacb8a84431fb66f099d79fd4af586c949c97b0fb4bd4c58f9640eac01e5bfc3eda4e51cbe2010d9774f0ec84ba7fe5df45dc60b6ca817e35a74895b84b692fc7d63a153c0f015e321edc3c59f9af3fac1c8e7e13f706914cd9a817462ec9c5a7840b96aad7888d84a9d02787529fc06645c8b7580ae0fe2f5d8708a689377e6ebdae290399898b8c6508ba9eb63c5ca29505409b8f6056cc06ffe3c12f40925c62edd36fc62a399b65eda0c8113db93d958d976b098fd1af9ae1c0788117537d0f7bc5369916919e4be23626a7b2d5493f845c08b5f0e4baa809cd06b1ce015a380fb5e513355b7ee1674a7af0d88387e9254695417eda7b1d0c0c182d318d138cc7d5668fd9a8a2008d707455e97f4eaa296ac3ec2835afa136cef0bce851d73738f7d810570506ed090a1bc0a13fa8ba150abbb8c53629a8e2e52b0123f0ac8c025b73615d7f467164d231532caaceca0268ddc4c194ddec6c95bfa57717e47251fc238f63ee76c052384175d6a71306503c994c0a957309b0b441f8b0a8c000db194943b959646fd004e8488a8c8f7db6bee9a37e0073baea766e7269bfcd550a1553d37cd032fdbcee322996fb3b7b482f54e1f525620a426c5a8031012c4eb6ccf293ebe62eb12732b40e622f638ce3d00cfdb184b41a53a32a491d3769aee55bf9d5205e553b72bcdea981919e79a9666934f43061bec93adbc1c2bc5dedcdde3235cd439cf6b18028ce06cc19d381b08981178a18a9047bf9034e6135be24a037c6776131eb9bafae6657b964bc19043364ab41173fd091ad844a2763148c7704647a629c41bf9e7d80a49387fef429c5a90ed672df226684f8ff275786724699d82bb12eb58b414417110cb37c234c48f855f285b6aa13579d71158262571b1f9b5aa20963f5346fc0de90ee9d6092e3cbc1ef00ac04895051785263ca93f2ceeb02b01f4ff744701db215db5cd31d0d5964c8a9da15021cfcee3d804711f306dc6f7ace3232c9bffa409746f4060fd7d3911b43b5b9cdbbec8cd0ed12b5e76996893eeabdd4f15a67a6bfcd6fee80ea592bec65541e33eb1e3cdef38c4d192d936d8f964e5e914b187bff52ea8538e7c2077ddd7eb72a02402283db9498b84a9f12b6d6fbdf2b23abd897a0b91b2d5528aa310a3bb9a1617d68b2f27371ff1868bf29237e894a828508d111895b21b8823ef680a84dd8cbaf0db81f4fd45ab89e51b0d7005097bb6d774dd281f13632c10edb5365837cfd2d69e843ec73fb5da0fd5ce08ec1c6d3f8dc1acf976c13d4e5d2844aec49213692b18a1cf0f8d4f3404a0860657f36dc7cfc461c653270b78f80e09c8be5b6e9e83596882d59f7ad7148da88fc125777f3a40244d083ab401072e2837ee773c26fa20197220d4f53902cf58b13baa21645791c4ea3d19f8ae897fcf9d5344364c3267414d7854153672a5dea2143515d821a775a3cbba2fb22b9d09ad8bbb9117d19a74e09b777cbd3a8352f05b06c386570860fbf65a5b5fb23c7d0299f0a7540e34246861414027586006d7df7974be30e062c9cdadb340c9921e8ecb8650c444265bfde678d5786c6dbec322976a7d17b268ca1ff5ddbd0296a59dc7c499a09ceac0bf62129fcaa2340c7ee1432e255e7cda55df0a75f08e1159bb0206f4a1e20402f5c0e71774f486ec50a8ac6a1db2538891119bd7e0117bde783cb032edba454cd8eaccb49e341ae9528cc29cefbf4e912ab79a1ef0363cd91330f69f4e90826659beca3479bb37b4679b35734a100909ef8b5f11b147f2da28f9d0bf48e98dde6e1969f8b8d99b64cf019a46116d902d0e8f5929ab82fd338ff23604e4bbf9bbe6c30c17e6a9c8803cda27ab35115609c54198e4a5defebebe8d26c58c5355d98c5a6cf3c3e3a0e85a51af9711b00b0b13406ff6d2d62ec558bb0e3b687c1029379b6076fa19c3070477d047d8744954f44164f4f5e04a459a45c2cb7c95457bb245949fdee86ff6538079ff573a16f6627237652a7db2d7b809076af4a07d940165c080f1f32049325fba2f552f032c98a7ec7f3b545c81612e25576ae9445885d6cd25ccfb1efbd371a8670a62976d5bec5de8c58be941319a4ca5738e337d686a6d641ed5f445c53f9e362d003d8bed2afc088191ffd688f9beae9e52b1d8197cca832651de09222c67987f0d5b44218524d2f0b6e364231a7038c97ac622f2adfa303e393b7d04a569a53f34e036c421870d2f14d2007eb4065ea5553ad83aaa36c1f77537affa68be9b2d1e18300696531b7d33b33e3b9e87fbc988f158836765a66988b4c0d98dd0d65d1ff1b3e4e1bb129287237092b008e81972f929e06bce222f89433a90a109491274f641720ca0f4521b6572804437cdfd8b6e7f67b3b25ebd9a749aa7318dc59bd5133751bf19015a9411af04c8a07e738b7b0103117d54dba9032fa40898927f1d520e787bb47a3853a0bcb3a80b4903f53356df6e8c188af988683284b871f3e058895c62d06df2302fbf57dc2430283113234cd432610d088e408f2563dc60f1eb42e9b554aaa492204635e25f4552c44a343eee39c3071b9045e0f5b75fe8080be0da8cccfa667b124eae0b44a845c1ab39f58e55f0b856d939abb427506ebe6f1a5389bbe819ea4f50a9db17f774aaec7659609f0bf508a8723fd5e4a95969a60fd7dc91113966bc34c30f92c59256cbe886f109a1cc6b07504aba6b3e096f8cbe6b795063f11e47f1c7c766959c684e729bdef064e7f2f3cfc43feb598e088671bfc7ba9534ec5fdd55b56cf641bbfe5ad2b226032b1"})
mmap$auto(0x8000000000000001, 0x7ff, 0x0, 0xfffffffffffffffb, r6, 0x7)
ioctl$IOCTL_GET_NCIDEV_IDX(r3, 0x0, &(0x7f0000001480)=<r7=>0x0)
connect$auto(r2, &(0x7f00000014c0)=@nfc={0x27, r7, 0xffffffffffffffff, 0x1}, 0x2)
r8 = semctl$auto_SETVAL(0xba, 0x2, 0x10, 0x8)
ptrace$auto(0x4, r8, 0x8, 0x5)
waitid$auto_P_PGID(0x2, r1, &(0x7f0000001500)={@siginfo_0_0={0x0, 0x3, 0x5, @_rt={0x0, 0x0, @sival_int=0xe}}}, 0x0, &(0x7f0000001580)={{0x253, 0x9}, {0x200, 0x4}, 0x8, 0x7f, 0x2, 0x0, 0x2, 0x1000, 0x8, 0x2, 0x3, 0x2, 0x9, 0x8, 0x1, 0x1})
mmap$auto(0x6, 0x3, 0x4, 0x3f, r6, 0x6dabfa32)
r9 = syz_genetlink_get_family_id$auto_nl80211(&(0x7f0000001680), 0xffffffffffffffff)
sendmsg$auto_NL80211_CMD_GET_REG(r1, &(0x7f0000001740)={&(0x7f0000001640)={0x10, 0x0, 0x0, 0x100000}, 0xc, &(0x7f0000001700)={&(0x7f00000016c0)={0x28, r9, 0x8, 0x70bd28, 0x25dfdbff, {}, [@NL80211_ATTR_STA_LISTEN_INTERVAL={0x6, 0x12, 0x6}, @NL80211_ATTR_WPA_VERSIONS={0x8, 0x4b, 0x8001}, @NL80211_ATTR_TX_NO_CCK_RATE={0x4}]}, 0x28}, 0x1, 0x0, 0x0, 0x80}, 0x0)
ioctl$auto_SG_GET_RESERVED_SIZE(r1, 0x2272, &(0x7f0000001780)="4d1d72bb5f31bf01a18b3b27c79a2cba6aa6c975293d02108bc87a736c3c79e63702debd8b1747a2e2953dc56c66b4f041e0c45415aab531e5dc1441ff6a6200067257abc735a5cb381dc2ed4faa395bc931e6ffeb68f9fd8273a3ba177cf025e9b31149a55323889681d7")
r10 = syz_genetlink_get_family_id$auto_netdev(&(0x7f0000001840), r1)
ioctl$sock_SIOCGIFINDEX(r3, 0x8933, &(0x7f0000001880)={'caif0\x00', <r11=>0x0})
ioctl$sock_SIOCGIFINDEX(r6, 0x8933, &(0x7f00000018c0)={'\x00', <r12=>0x0})
sendmsg$auto_NETDEV_CMD_DEV_GET(r3, &(0x7f0000001bc0)={&(0x7f0000001800)={0x10, 0x0, 0x0, 0x10000}, 0xc, &(0x7f0000001b80)={&(0x7f0000001b00)={0x64, r10, 0x4, 0x70bd2a, 0x25dfdbfc, {}, [@NETDEV_A_DEV_IFINDEX={0x8, 0x1, r11}, @NETDEV_A_DEV_IFINDEX={0x8, 0x1, r12}, @NETDEV_A_DEV_IFINDEX={0x8}, @NETDEV_A_DEV_IFINDEX={0x8}, @NETDEV_A_DEV_IFINDEX={0x8}, @NETDEV_A_DEV_IFINDEX={0x8}, @NETDEV_A_DEV_IFINDEX={0x8}, @NETDEV_A_DEV_IFINDEX={0x8}, @NETDEV_A_DEV_IFINDEX={0x8}, @NETDEV_A_DEV_IFINDEX={0x8}]}, 0x64}, 0x1, 0x0, 0x0, 0x40800}, 0x20000880)
executing program 6:
bpf$auto(0x5, &(0x7f0000000000)=@test={0x12, 0x1, 0x0, 0x9, 0x1, 0x3, 0x3da1, 0x0, 0xb4, 0x7, 0x140000000000, 0xdb, 0x7fffffff, 0x10, 0x1}, 0x171)
r0 = socket$nl_generic(0x10, 0x3, 0x10)
r1 = syz_genetlink_get_family_id$auto_batadv(&(0x7f0000000080), r0)
ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000240)={'batadv0\x00', <r2=>0x0})
sendmsg$auto_BATADV_CMD_GET_MCAST_FLAGS(r0, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000280)={&(0x7f0000000200)=ANY=[@ANYBLOB="1c000000", @ANYRES16=r1, @ANYBLOB="afa72db57000ffdbdf250e00000008000300", @ANYRES32=r2], 0x1c}, 0x1, 0x0, 0x0, 0x300}, 0x20000000)
executing program 4:
openat$auto_seq_oss_f_ops_seq_oss(0xffffffffffffff9c, &(0x7f0000000080)='/dev/sequencer2\x00', 0x2, 0x0)
r0 = socket(0x11, 0x3, 0x9)
capset$auto(0x0, &(0x7f0000000000)={0xb213, 0x2c, 0x800})
openat$auto_fb_fops_fb_chrdev(0xffffffffffffff9c, &(0x7f0000000100)='/dev/fb0\x00', 0x2, 0x0)
openat$auto_tty_fops_tty_io(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ttynull\x00', 0x201, 0x0)
r1 = openat$auto_loop_ctl_fops_loop(0xffffffffffffff9c, &(0x7f0000000440), 0x20100, 0x0)
ioctl$auto_LOOP_CTL_REMOVE(r1, 0x4c81, 0x0)
mmap$auto(0x0, 0x400008, 0xdf, 0x9b72, 0xffffffffffffffff, 0x0)
write$auto(0x3, 0x0, 0x7fffffff)
openat$auto_stat_fops_(0xffffffffffffff9c, &(0x7f0000000140)='/proc/stat\x00', 0x2, 0x0)
read$auto(0x3, 0x0, 0x80)
mmap$auto(0x0, 0x4020009, 0x6, 0xeb1, 0x401, 0x8000)
mmap$auto(0x0, 0x7, 0x1000000004, 0x9b72, 0x2, 0x100)
openat$auto_proc_iter_file_ops_compat_inode(0xffffffffffffff9c, 0x0, 0xc0000, 0x0)
listxattrat$auto(0xffffffffffffffff, 0x0, 0x7ffffffe, &(0x7f0000000380)='\xdf^\xe2o\x87D\x10\xa0\x0e1\xb5B\xd6k]Yh\x99\xf4\xbcy.8\xcd\xf2I\xcc\xf5\xc7\xee\xb8\xea\xb7+\xd8K\xf1\x1aI\xe6(\x9f\xaeS\xf1\x199\x1fk\x01\xf36\xe1 \x1a+\xcd\xfc6\xc7W\xeaw7\x1b\xf4\x01\xebQ\n\x94{\xb5\xa7/\xa3\xa7\x16\x82\x1c\rEqd\xf7~\xba{\x8f7S\x82\xed\x8es\x02W\xdc\x16l\xee\xf1\xd9\x83\xc8', 0xe9)
statmount$auto(0x0, &(0x7f0000000180)={0x8, 0x1, 0x1, 0x3, 0xf, 0x940, 0x1ffde, 0x3, 0x6, 0x8000002, 0xff, 0x5, 0x5, 0x4, 0xb0, 0x7, 0x2, 0x3, 0x5, 0x7, 0x0, 0x0, 0x0, 0x0, 0x0, 0x80000009, [0x0, 0x4000000000000000, 0x10000, 0x243efbdf, 0x0, 0x0, 0x4000000000000, 0x0, 0x0, 0xffffffffffffffff, 0x9, 0x0, 0x0, 0x0, 0x0, 0xfffffffffffffffd, 0x0, 0x9, 0x0, 0x0, 0x0, 0x0, 0x800, 0x0, 0x0, 0x9, 0x0, 0xfffffffffffffffc, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff, 0xfffffffffffffffc, 0x0, 0x0, 0x0, 0x0, 0x0, 0xe6e, 0x0, 0x0, 0xfffffffffffffffe]}, 0x1fe, 0x81)
close_range$auto(0x0, 0xffffffffffffffff, 0x2)
sendmsg$auto_OVS_VPORT_CMD_DEL(0xffffffffffffffff, &(0x7f0000000200)={0x0, 0x0, &(0x7f00000001c0)={&(0x7f0000000180)=ANY=[@ANYBLOB='<\x00\x00\x00', @ANYBLOB="11002d"], 0x3c}, 0x1, 0x0, 0x0, 0x8000}, 0x8000)
r2 = socket(0x10, 0x2, 0x0)
sendmsg$auto_NL80211_CMD_GET_REG(r2, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000280)={&(0x7f0000000180)=ANY=[], 0x1ac}, 0x1, 0x700}, 0x40000)
sendmsg$auto_NL80211_CMD_GET_REG(0xffffffffffffffff, 0x0, 0x40000)
sendmsg$auto_NETDEV_CMD_DEV_GET(0xffffffffffffffff, &(0x7f0000000080)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x400000}, 0xc, 0x0, 0x1, 0x0, 0x0, 0x24048000}, 0xc0)
ioctl$auto(0xffffffffffffffff, 0x13, 0xffffffffffffffff)
io_uring_register$auto(0x2, 0x0, &(0x7f0000000000), 0x3)
mmap$auto(0x0, 0x400008, 0xdf, 0x9b72, 0x2, 0x8000)
mbind$auto(0x2000, 0x100000004, 0x100000000, 0x0, 0x6, 0x2)
syz_clone3(&(0x7f0000000400)={0x9840100, 0x0, 0x0, 0x0, {0x31}, 0x0, 0x0, 0x0, 0x0}, 0x58)
mmap$auto(0x0, 0x40009, 0xe2, 0x9b72, 0x7, 0x28000)
openat$auto_kernfs_file_fops_kernfs_internal(0xffffffffffffff9c, &(0x7f0000000080)='/sys/devices/LNXSYSTM:00/LNXSYBUS:00/PNP0A03:00/device:08/adr\x00', 0x0, 0x0)
sendmmsg$auto(r0, &(0x7f0000000400)={{&(0x7f0000000000), 0x5aa, &(0x7f00000000c0)={&(0x7f0000000040)="661b", 0x49}, 0x1, &(0x7f0000000200), 0x5, 0x3}, 0x4}, 0x2, 0x100)
executing program 6:
sendmsg$auto_NL80211_CMD_GET_REG(0xffffffffffffffff, 0x0, 0x0)
socket(0x2, 0x80002, 0x73)
socket(0xa, 0x1, 0x84)
ioctl$auto(0x3, 0x8905, 0x38)
ioctl$auto_TIOCMSET2(0xffffffffffffffff, 0x5418, 0x0)
setsockopt$auto_SO_DETACH_FILTER(0xffffffffffffffff, 0x6, 0x1b, &(0x7f0000000140)='/dev/audio1\x00', 0xf)
r0 = openat$auto_tracing_pipe_fops_trace(0xffffffffffffff9c, &(0x7f0000000100)='/sys/kernel/debug/tracing/per_cpu/cpu0/trace_pipe\x00', 0x101801, 0x0)
setsockopt$auto_SO_DETACH_FILTER(r0, 0x6, 0x1b, &(0x7f0000000140)='/dev/audio1\x00', 0xf)
openat$auto_binder_fops_binder_internal(0xffffffffffffff9c, 0x0, 0x1, 0x0)
socket(0x28, 0x1, 0x0)
r1 = openat$auto_posix_clock_file_operations_posix_clock(0xffffffffffffff9c, &(0x7f0000000080), 0x40400, 0x0)
ioctl$auto_posix_clock_file_operations_posix_clock(r1, 0x40103d02, 0x0)
sendmsg$auto_NL80211_CMD_TRIGGER_SCAN(0xffffffffffffffff, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000240)={&(0x7f0000000180)=ANY=[], 0x14}}, 0x4000000)
openat$auto_seq_oss_f_ops_seq_oss(0xffffffffffffff9c, &(0x7f0000000080)='/dev/sequencer2\x00', 0x2, 0x0)
r2 = openat$auto_snd_rawmidi_f_ops_rawmidi(0xffffffffffffff9c, &(0x7f0000000000)='/dev/snd/midiC2D0\x00', 0x1, 0x0)
openat$auto_proc_sys_file_operations_proc_sysctl(0xffffffffffffff9c, &(0x7f0000000000)='/proc/sys/fs/pipe-max-size\x00', 0x382, 0x0)
sendmsg$auto_NFSD_CMD_THREADS_SET(0xffffffffffffffff, &(0x7f0000000100)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000040)=ANY=[@ANYBLOB='$\x00\x00\x00', @ANYRES16=0x0, @ANYBLOB="00042cbd7000fb3d89cb809172a33200030080004000880001"], 0x24}, 0x1, 0x0, 0x0, 0x20008010}, 0x400d0)
sendmsg$auto_NL80211_CMD_GET_REG(0xffffffffffffffff, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000040)=ANY=[@ANYBLOB="72010000", @ANYBLOB="1a0027"], 0x1ac}, 0x1, 0x0, 0x0, 0x4000804}, 0x40000)
r3 = socket(0x10, 0x2, 0x0)
sendmsg$auto_NL80211_CMD_GET_REG(0xffffffffffffffff, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000300)={&(0x7f0000000040)=ANY=[], 0x1ac}, 0x1, 0x0, 0x0, 0x44814}, 0x2004c0c4)
sendmmsg$auto(r3, &(0x7f0000000200)={{0x0, 0x0, &(0x7f0000000100)={&(0x7f0000000080), 0xfc2}, 0x2, &(0x7f00000001c0), 0x7, 0xa505}, 0x800}, 0x7, 0x8)
write$auto(r2, &(0x7f0000000400)='/dev/audio1\x00', 0xa3d9)
select$auto(0xe, 0x0, 0x0, &(0x7f00000002c0)={[0x1ff, 0x7, 0xd, 0xa00, 0x948b, 0x2, 0xfffffffffffffffc, 0x6, 0x3, 0x300000000000000, 0x80000001, 0x5, 0x6d3c, 0x5, 0x2]}, 0x0)
madvise$auto(0x108000, 0x800034, 0xa)
unshare$auto(0x40000080)
msgrcv$auto(0x0, 0x0, 0x2, 0x1, 0xb2)
msgsnd$auto(0x0, &(0x7f0000000000)={0x3, 0x45}, 0x8, 0x9)
executing program 5:
openat$auto_snd_pcm_oss_f_reg_pcm_oss(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/dsp1\x00', 0x20b42, 0x0)
read$auto_proc_reg_file_ops_compat_inode(0xffffffffffffffff, &(0x7f0000000280)=""/65, 0x41)
mmap$auto(0x0, 0x4020009, 0x6, 0xeb1, 0x401, 0x8000)
prctl$auto(0x1000000003b, 0x1, 0x4, 0x5, 0x7)
socket$nl_generic(0x10, 0x3, 0x10)
close_range$auto(0x2, 0x8, 0x0)
sendmsg$auto_NETDEV_CMD_DEV_GET(0xffffffffffffffff, &(0x7f0000000080)={&(0x7f0000000140)={0x10, 0x0, 0x0, 0x400000}, 0xc, 0x0, 0x1, 0x0, 0x0, 0x48000}, 0x0)
mmap$auto(0x0, 0x400008, 0xdf, 0x9b72, 0x2, 0x8000)
close_range$auto(0x2, 0x8000, 0x0)
sendmsg$auto_HSR_C_GET_NODE_STATUS(0xffffffffffffffff, &(0x7f0000000200)={0x0, 0x0, &(0x7f00000001c0)={&(0x7f0000000140)={0x68, 0x0, 0x200, 0x70bd26, 0x25dfdbfe, {}, [@HSR_A_IF1_AGE={0x8, 0x3, 0x200}, @HSR_A_IF2_SEQ={0x6, 0x7, 0x4}, @HSR_A_IFINDEX={0x8}, @HSR_A_NODE_ADDR_B={0xa}, @HSR_A_NODE_ADDR={0xa, 0x1, @broadcast}, @HSR_A_NODE_ADDR={0xa}, @HSR_A_IF1_AGE={0x8, 0x3, 0x38}, @HSR_A_IFINDEX={0x8}, @HSR_A_IF2_AGE={0x8, 0x4, 0x4}]}, 0x68}, 0x1, 0x0, 0x0, 0x40080}, 0x40090)
socket(0x2, 0x3, 0x100)
socket(0x10, 0x2, 0x0)
sendmsg$auto_NL80211_CMD_GET_REG(0xffffffffffffffff, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000200)={0x0, 0x1ac}, 0x1, 0x0, 0x0, 0x4004810}, 0x800)
sendmsg$auto_NL80211_CMD_GET_REG(0xffffffffffffffff, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000180)=ANY=[@ANYBLOB="720100", @ANYBLOB="13"], 0x1ac}}, 0x4004)
sendmmsg$auto(0x3, &(0x7f0000000080)={{0x0, 0x2, &(0x7f00000002c0)={0x0, 0xc4}, 0x1, 0x0, 0x0, 0x9}, 0x7}, 0x3, 0x0)
executing program 0:
mmap$auto(0x0, 0x20009, 0x4000000000df, 0xeb1, 0x401, 0x8000)
prctl$auto(0x22, 0x40, 0x0, 0x7, 0x7fffd)
clone$auto(0x20003b46, 0x2, 0x0, 0x0, 0x2)
prctl$auto(0x10000000024, 0x2, 0x2008, 0x4000000c, 0x80001)
openat$auto_vmwgfx_driver_fops_vmwgfx_drv(0xffffffffffffff9c, &(0x7f0000026d00)='/dev/dri/card1\x00', 0x2000, 0x0)
mmap$auto(0x0, 0x202000b, 0x3, 0xeb1, 0xfffffffffffffffa, 0x8000)
r0 = io_uring_setup$auto(0x401, 0x0)
socket(0x26, 0x80004, 0x73)
socket$nl_generic(0x10, 0x3, 0x10)
socket$nl_generic(0x10, 0x3, 0x10)
socket$nl_generic(0x10, 0x3, 0x10)
socket$nl_generic(0x10, 0x3, 0x10)
ioctl$auto_SNDCTL_DSP_SETTRIGGER(r0, 0x40045010, &(0x7f00000000c0))
clone$auto(0x4, 0x7, &(0x7f00000000c0)=0x1, &(0x7f0000000100)=0xff, 0x7ff)
mmap$auto(0x0, 0x2000b, 0xe2, 0xeb1, 0x405, 0xfffffffffffffff9)
clone$auto(0x3fff, 0xad3, 0x0, 0x0, 0x7fffffff)
wait4$auto(0xffffffffffffffff, 0x0, 0x80000001, 0x0)
sendmsg$auto_GTP_CMD_NEWPDP(0xffffffffffffffff, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000180)={0x0}, 0x1, 0x0, 0x0, 0x8000}, 0x4040804)
lstat$auto(0x0, &(0x7f0000000180)={0x4, 0xb, 0x6, 0x76402f57, 0x0, 0x0, 0x0, 0x4, 0x40000000000f, 0x400, 0x40000402, 0x4, 0x9, 0x4, 0x9, 0x7, 0x20000010010b})
r1 = socket$nl_generic(0x10, 0x3, 0x10)
dup3$auto(0x8000000000000001, 0x5, 0x800080000)
ioctl$sock_SIOCGIFINDEX(r1, 0x89fc, &(0x7f0000000040)={'bridge0\x00'})
socket$nl_generic(0x10, 0x3, 0x10)
socket$nl_generic(0x10, 0x3, 0x10)
eventfd$auto(0x3)
eventfd$auto(0x0)
r2 = socket(0xa, 0x2, 0x0)
bpf$auto(0x0, &(0x7f0000000000)=@link_update={r2, @new_prog_fd=0x4, 0x4}, 0xa3)
setsockopt$auto_SO_WIFI_STATUS(0xffffffffffffffff, 0x0, 0x29, 0x0, 0x9)
getsockopt$auto(0xffffffffffffffff, 0x6, 0x3, &(0x7f0000000140)='bridge0\x00', &(0x7f0000000240)=0x6b96)
executing program 5:
mmap$auto(0x0, 0x20009, 0xe2, 0xeb1, 0xffffffffffffffff, 0x8000)
close_range$auto(0x2, 0x8, 0x0)
socket(0x8, 0x2, 0x9)
r0 = socket(0x2, 0x1, 0x0)
r1 = socket(0x2, 0x1, 0x0)
bind$auto(0x3, &(0x7f0000000040)=@in={0x2, 0xffff, @remote}, 0x6a)
listen$auto(r0, 0x7)
sendmmsg$auto(r1, &(0x7f0000000140)={{&(0x7f0000000040), 0x12, 0x0, 0x9, 0x0, 0x1, 0xb}, 0x800009}, 0x5, 0x20000000)
r2 = openat$auto_proc_reg_file_ops_compat_inode(0xffffffffffffff9c, &(0x7f0000000000)='/proc/asound/card1/pcm0c/sub7/sw_params\x00', 0x0, 0x0)
pread64$auto(r2, 0x0, 0xffe, 0x0)
executing program 5:
r0 = socket(0x10, 0x2, 0x0)
close_range$auto(0x2, 0x8, 0x0)
socket(0x10, 0x2, 0x4)
socket(0x10, 0x3, 0x6)
sendmsg$auto_NL80211_CMD_GET_REG(r0, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000300)=ANY=[@ANYBLOB="72010000", @ANYBLOB="120027", @ANYBLOB="5de1"], 0x1ac}}, 0x40000)
read$auto(r0, &(0x7f0000000000)='$-]&@\x00', 0x5)
executing program 5:
mmap$auto(0x0, 0x400008, 0xdf, 0x9b72, 0x2, 0x8000)
socketpair$auto(0x1e, 0x5, 0x8000000000000000, 0x0)
r0 = openat$auto_vmuser_fops_vmci_host(0xffffffffffffff9c, &(0x7f0000000180), 0x6b2c03, 0x0)
ioctl$auto_IOCTL_VMCI_VERSION2(r0, 0x7a7, 0x0)
ioctl$auto_IOCTL_VMCI_INIT_CONTEXT(r0, 0x7a0, 0x6)
ioctl$auto_IOCTL_VMCI_CTX_ADD_NOTIFICATION(r0, 0x7af, 0x0)
ioctl$auto_IOCTL_VMCI_CTX_ADD_NOTIFICATION(r0, 0x7af, 0x0)
futex$auto(0x0, 0x6, 0x8, 0x0, 0x0, 0x80000001)
openat$auto_binder_fops_binder_internal(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/binderfs/binder0\x00', 0x80, 0x0)
mmap$auto(0x0, 0x2020009, 0x3, 0xeb1, 0xffffffffffffffff, 0x8000)
select$auto(0xfffffff3, &(0x7f0000000100)={[0x5, 0x400, 0x4, 0x3, 0xea47, 0x101, 0xa, 0x3ff, 0x4, 0xb4be, 0xfffffffffffffeff, 0x5, 0x3, 0xfffffffffffffffd, 0x40, 0x80]}, 0x0, 0x0, 0x0)
r1 = openat$auto_kernfs_file_fops_kernfs_internal(0xffffffffffffff9c, &(0x7f0000000080)='/sys/devices/LNXSYSTM:00/LNXSYBUS:00/PNP0A03:00/device:08/adr\x00', 0x0, 0x0)
read$auto(r1, 0x0, 0x20)
r2 = openat$auto_proc_fail_nth_operations_base(0xffffffffffffff9c, &(0x7f0000000000)='/proc/thread-self/fail-nth\x00', 0x802, 0x0)
writev$auto(r2, &(0x7f0000000200)={0x0, 0x7}, 0x3)
syz_genetlink_get_family_id$auto_tipcv2(&(0x7f0000000300), 0xffffffffffffffff)
mmap$auto(0x0, 0x4020009, 0x6, 0xeb1, 0x401, 0x8000)
r3 = openat$auto_proc_reg_file_ops_compat_inode(0xffffffffffffff9c, &(0x7f00000000c0)='/proc/self/net/fib_triestat\x00', 0x0, 0x0)
pread64$auto(r3, 0x0, 0x200000000006, 0x5)
r4 = openat$auto_kernfs_file_fops_kernfs_internal(0xffffffffffffff9c, &(0x7f0000000080)='/sys/devices/LNXSYSTM:00/LNXSYBUS:00/PNP0C0F:00/status\x00', 0xa140, 0x0)
read$auto_kernfs_file_fops_kernfs_internal(r4, &(0x7f0000000000)=""/112, 0x70)
sendmsg$auto_NL80211_CMD_GET_REG(0xffffffffffffffff, &(0x7f0000000240)={0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x40814}, 0x2004c0c4)
executing program 6:
mmap$auto(0x0, 0x4020009, 0x8000000080000000, 0x17, 0x401, 0x8000)
madvise$auto(0x0, 0xffffffffffff0005, 0x17)
openat$auto_clear_warn_once_fops_(0xffffffffffffff9c, &(0x7f0000000100), 0x210800, 0x0)
r0 = openat$auto_tty_fops_tty_io(0xffffffffffffff9c, &(0x7f0000000000)='/dev/tty46\x00', 0x0, 0x0)
close_range$auto(0x2, 0x8, 0x0)
socket(0x10, 0x2, 0x0)
socket(0x2, 0x6, 0x0)
mmap$auto(0x0, 0x400005, 0xdf, 0x9b72, 0x2, 0x8000)
socket(0xa, 0x5, 0x84)
bind$auto(0x3, 0x0, 0x6a)
ioctl$auto(0x3, 0x800005411, 0x38)
ioctl$auto(r0, 0x5600, 0x0)
mmap$auto(0x6, 0x400005, 0xffffffffffffff00, 0x9b72, r0, 0x8000)
close_range$auto(0x2, 0x8, 0x0)
socketpair$auto(0x1, 0x2, 0x8000000000000000, 0x0)
r1 = openat$auto_force_devcoredump_fops_hci_vhci(0xffffffffffffff9c, &(0x7f0000000c40)='/sys/kernel/debug/bluetooth/hci0/force_devcoredump\x00', 0x2, 0x0)
write$auto(r1, 0x0, 0xe)
mremap$auto(0x0, 0xffffffffffffffff, 0x3fd6, 0x3, 0x7fffffffb000)
mmap$auto(0x0, 0x400005, 0x800000000000df, 0x9b72, 0x2, 0x8000)
madvise$auto(0x0, 0xffffffffffff0001, 0x15)
r2 = openat$auto_proc_clear_refs_operations_internal(0xffffffffffffff9c, &(0x7f0000000600)='/proc/thread-self/clear_refs\x00', 0x2, 0x0)
mmap$auto(0x0, 0x8, 0xdf, 0x9b72, 0x2, 0x8000)
setitimer$auto(0x4, &(0x7f0000000000)={{0x1ff, 0x10001}, {0x200000000004, 0x6}}, 0x0)
openat$nci(0xffffffffffffff9c, &(0x7f0000000000), 0x2, 0x0)
bpf$auto(0x12, &(0x7f0000000000)=@info={0x2800, 0x1ff, 0x2}, 0xcf)
r3 = socket(0x10, 0x2, 0x0)
sendmsg$auto_NL80211_CMD_GET_REG(r3, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000300)=ANY=[@ANYBLOB=' \x00\x00\x00', @ANYBLOB="1200", @ANYBLOB=']'], 0x1ac}}, 0x40000)
recvmmsg$auto(r3, &(0x7f0000000380)={{0x0, 0x1, &(0x7f0000000000)={0x0, 0x400}, 0x4, 0x0, 0x200002, 0x8}, 0x803}, 0xfffffff9, 0x10010, 0x0)
write$auto_proc_clear_refs_operations_internal(r2, 0x0, 0xffffff4b)
socket(0xa, 0x3, 0x3a)

program did not crash
bisect: testing without sub-chunk 3/3
testing program (duration=6m4s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): [16, 30, 26, 15, 24, 24, 30, 5, 6, 30, 2, 30, 15, 30, 26, 30]
detailed listing:
executing program 2:
r0 = openat$auto_kernfs_file_fops_kernfs_internal(0xffffffffffffff9c, &(0x7f00000002c0)='/sys/devices/virtual/block/ram3/queue/iostats_passthrough\x00', 0x80302, 0x0)
r1 = socket$nl_generic(0x10, 0x3, 0x10)
r2 = socket$nl_generic(0x10, 0x3, 0x10)
r3 = syz_genetlink_get_family_id$auto_l2tp(&(0x7f0000000640), 0xffffffffffffffff)
sendmsg$auto_L2TP_CMD_TUNNEL_CREATE(r2, &(0x7f0000001040)={0x0, 0x0, &(0x7f0000000280)={&(0x7f0000000000)={0x5c, r3, 0x1, 0x70bd2d, 0x25dfdbfd, {0x1, 0x0, 0x3f00}, [@L2TP_ATTR_OFFSET={0x6, 0x3, 0x7}, @L2TP_ATTR_PROTO_VERSION={0x5, 0x7, 0x58}, @L2TP_ATTR_CONN_ID={0x8, 0x9, 0x8}, @L2TP_ATTR_PEER_CONN_ID={0x8, 0xa, 0x8}, @L2TP_ATTR_IP6_SADDR={0x14}, @L2TP_ATTR_IP6_DADDR={0x14, 0x20, @ipv4={'\x00', '\xff\xff', @local}}]}, 0x5c}, 0x1, 0x0, 0x0, 0x4c019}, 0x0)
r4 = getpid()
process_vm_readv$auto(r4, &(0x7f0000000080)={0x0, 0xfff}, 0x1, &(0x7f0000000280)={0x0, 0xffffffff}, 0x6, 0x0)
r5 = openat$auto_nvmf_dev_fops_fabrics(0xffffffffffffff9c, &(0x7f00000004c0), 0x101202, 0x0)
write$auto_nvmf_dev_fops_fabrics(r5, 0x0, 0x0)
write$auto_nvmf_dev_fops_fabrics(r5, 0x0, 0x0)
prctl$auto_PR_SET_MM_START_STACK(0x95, 0x5, 0x0, 0x0, 0x6)
stat$auto(&(0x7f00000000c0)='./file0\x00', &(0x7f0000000100)={0x9a, 0x100, 0x8, 0xb, <r6=>0xee00, 0x0, 0x0, 0x2, 0x3, 0x5, 0x3, 0x7, 0x5, 0x3, 0x0, 0x4, 0x6})
sendmsg$auto_TIPC_NL_KEY_SET(r1, &(0x7f0000000380)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x2000000}, 0xc, &(0x7f0000000340)={&(0x7f0000001080)={0x1810, 0x0, 0x800, 0x70bd28, 0x25dfdbfc, {}, [@TIPC_NLA_PUBL={0x1780, 0x3, 0x0, 0x1, [@typed={0x4, 0xa0}, @typed={0x8, 0x13e, 0x0, 0x0, @fd=r2}, @typed={0x8, 0x51, 0x0, 0x0, @pid=r4}, @nested={0x1ae, 0x134, 0x0, 0x1, [@generic="3f74007cf8216c93f7f106e28c20943f34e65ec832411016497e483652e7550fe0101174f511f2ed4c9f171e443ecf965a3393ce09132ebbe53e6507a8b14ec350bff171c838d43899f7d5d8fef51c2ab2d10a1b3845d9fa42a03ce6c6fefa2022d1879ab3a78248fed9e8dea2691a521a57e1e2aa1812c7b13b56b781ed7dadf92ed58728dfc3d9a8f70d2a65117d1d9b0346dfb5680f89128236a8f783953c6e64dbc879b166554bbec4343328e89bf966", @nested={0x4, 0xb2}, @nested={0x4, 0xe3}, @nested={0x4, 0x6f}, @nested={0xe4, 0x72, 0x0, 0x1, [@typed={0xdf, 0x5c, 0x0, 0x0, @binary="8639085f4dab6f652f0c8731f21b5f4ff470001bc7872f6a894ffd577d0c5128b65d6fb4b18be68f28113a0d9d7ef8781a8a996ad4d0f5bd89e31fe08798fc115855735af81c8790d23457d0d28915f4f13dba152d344d0ad27f602309a122a3ac1328226702917fee850b82a3a77b6c40f16c0c60b06f9b1da972938e3c909972fbba8a4db784634003a79b6b71cf0221443639ddf3b695c2d8d60693564eeab5454db2920546961073d1c329ccad9b99e19a6fdd105eb5d1b953b0924441d890ce9fcb2aa90211cf34e16864c975e821c44743d6c340aa392443"}]}, @typed={0x8, 0x68, 0x0, 0x0, @ipv4=@dev={0xac, 0x14, 0x14, 0x1d}}]}, @nested={0x15b7, 0x1, 0x0, 0x1, [@nested={0xea, 0x7f, 0x0, 0x1, [@generic="30f498d8ba7ccbb263ea2b1c70913a51bd4f945e562bbb203751f199f9311aa60fb5a2dab43c8f8b86483a132046a0da12eea866c552a027f855466c8f444b60d2d9d6665f6c2e6be94c87d88c31960151cb3b90e53b69ba5de75df1617bafeba6e850f7e2ede1fcc7c8dec6490f2e04ad7dadcd89ce6c67bd48a8e8242f7a9977878fa7444f9fe6555117a073c921160e4b3292d44e921bf94eb5cc7d0f51b8930bc53f2d3e6ac53aa3be3297f45e62f9f189b8c2b7dfd57005fb0c27576074c77fdd149ead1bfdfb4329b040cf16e285104a0c22e41008f7c224d3e12b", @typed={0x8, 0x62, 0x0, 0x0, @pid=r4}]}, @typed={0x9, 0x83, 0x0, 0x0, @str='\xf9})\xb5\x00'}, @typed={0x8, 0x136, 0x0, 0x0, @uid=r6}, @typed={0x8, 0x23, 0x0, 0x0, @fd=r2}, @nested={0xe2, 0xd, 0x0, 0x1, [@generic="45b415df6e1efa332ab11a6e453257f273132fa34bc8b77a0d6b0c7ace8513803f5a1cb1156876b226d39869c85fe3b170e9ad58466bde972b84191d99a5ab41cb05f0b588fc5619873d504c0835c7c9c23374340000030ad94793888c151a6b8cfe4dbeb7544d8d4ddc", @generic="5b1f3f84a94bbf3a01986e1334d365b98ddd4f9a80da80394ef62301da97aa0a0baed54b5dd24d9909ad25f3946e3012f8f6dde3c65f28d9c7955654a055980d47ef68a9c5755f56266527580e9500eae0f1c663f765769e83b92b32801eadfa2fc352f435f07e28874d9ca11884149f79583385"]}, @nested={0x1d4, 0x4b, 0x0, 0x1, [@generic="37e71a544d1fd1f6d3863c9044a067eedad18784b7347ca7d4a3ac6757b28a6ff331c3acf8ec679be8f9c2566a61d28bea9bbf4b9018566163bd231a424e35964da54e43e9b608ce1f224e35466f356904f4729773aa495d6628d74f309a09a4c4f7796e4ab435eef7424b582f8c273d8ab251499ead1f07d58abd38cce5314d120f98cbd9395e95449eecea5687e9a6197490813990534a179967bc6b689ef46551290c6efe80b25b3d44c7bb45a46276ec1edc9303f64c04935674aeff1f28b2eec759db3104917c24f49bff6678aeca5e0319332a01385a", @generic="8375f0b5247ed3d6921813a6a10f081d686680d361d51386e07c5f5a09d25806f67eee9e15ddb3ea11cb16a2df220bb34d166d70a42fb754c086f71405246cfb3d008917c29ea104205e2e521bbab2291970d68c45b5f3bea7720c966a1ce4d63f8f6ca0860b652b5497613e2eabee57cf1b335176110e32ab252ca7adbe0573ed48a31ea091cab9321eb6242a07357aaa9adfbeb9a36598697edfe70966877db021003a6d2efe1a0019bb8b144f59424c4d248b69c32400418c5f312dad674ccd07f7d35371bafc60d1bbd86334320c67ad33a4e51bd925628786", @nested={0x4, 0x1d}, @nested={0x4, 0x105}, @nested={0x4, 0x20}, @typed={0xc, 0xde, 0x0, 0x0, @u64=0xf202}, @nested={0x4, 0x1d}]}, @generic="3db2dea5ae6f1c330670f4c839e550fdd362b4fd3eb77a7f6720b6f8773053a3b5bf33e60485ddb9e8de06a9050e4dec0463807c383d24be4c90ae70c9b5e2ec6b640b7cc3de7b0b4313241a7ebc5e2f7314494657918f058c09927283cbacbb19f46b3890665b527c1c002ee94f491454377ef0281582edafc68ac8d76f8c2d340ad2f07d505d84d019c7e0cbbdf1df82adead52c7a8e33567a1e48376a9c9081e37131b8070db74a5a7f547be2adbc0271fcc7c6082ea6a92e22003b8362a77151f89b5f8924da98767d004dff7507b6c2928b28f48acc00a5b2c89dc4ec51c0679d2d0f3c7f5405fdc37f467df0d7a4e503958a0bd29405ec55cf737c94a258c775c3b8b126204d68752c8214d55970a029cac48b021f2a5374871fae934f1cfc15a3c49792ac84f89cdbed122fb91b648a91ea1eb807ba20397556e191c2ddb987ff500fcf3dd2f232bd79e61d486d3fc5e19049bff76a9e1df67285b2dc1e112a27fa42a35a1b2ee8b57d3618c3298a999aefe527e24a9122249be58c499e6cfa1d912c36e01c02e1457b0088fd03c04f87e33bf7cf906683e4c4a2fc804b2233f63b58ce259494a9ca378f39b7c4d25a8340ebb233e4f2083e59efd0f65f21128d917f3b4d5cce592a35b52dfd86300b9c01f7f2a2b97f7fe487cbb09707f130c08942f4a4878bb90122df1139754bd161510f7d0cb4372b70e6934bf8cf77397450866ba350dd50890280e442d5fcad909dde13aea60b6a1d72fca35a624977d5b6e36ba0fc683301a78b3caedb3a728649e03efa2b64522f753dcd6fa43d5e142aeed05a45f02cf89e909b65d24f492cb872db8457c0307fd78db25afb4be57450ac7dc5675e6657dbc382853fd20f68de75c20a7bd22760e5d1dace835c719d1fcc9e0fc1503b2832e8d291ad1fe8325ab6eb8271ca73aafa5decf4620f3d13655e463be3b58102a023d26f9595698b88ca5d5a2e27072c95e44a52ac2f0aeaea9c3e2f50e420f28da204242ede123aa3136ceb13e7963099c2e36208592088ec5f7bc3bc81604ba179ab3244f2c75c3a17764b1ea6d4f16cbf6f921de77d89685fc7c767348ba753944f4e6acb3fff7d7e2c14d272dd8b0d65275693ce970c19c1b9ab25240bb81de7035a1cf5d49fc941af6c46ae31d0c693ddfc15796781c2c93544f8eee398ac65157155a8d3e820fc83d5469ac0a0753332f32d471202dedf9329ecccecb293ace723fb2516a90053cca718dce686056f139e825476d4007021460217ad1472158bf6320eee5bbcd8d45930fac59209c4abb04a341e394129f3bd75a488ed9118a65a3328f1cd5c2556b1da01abf48752fff081bfbc63cd2b25788917dc8563aea774dd46c9facf127e88c07209bbd71aeba29028fba467daf489eef52c123021c0e62357e103c4e42e0c29406525ed9efaf75478e802b4093d0ae0c7700b81a5773365776bbd751a93abb97072e497238aaf6f7c59d17fb9cb89e32b9d13413b62ae869f6a98030c63722ba4089384cd7f0b4b4cb65de2bee537f700b053afd7cd5248e6dab99140d6ea7b235fca2cf75ee4e98e1d236f8ca0d4b29624c220597508efdad7afe0f18d3a3457ea5eaf36064a6d72facd8c6bf4c8104bdd8d11421defd8f5dbbfb43f6b4dab5546225240852f339122184a8c331a495cf36423a52a7dff9461d7ac1dae4a7da523607b4473a2a5189c4179daeabe10405887b70ad83fc390289ad89035a04ab077c2563d7d2bd14ee4e9c76e213fd8fc9a3ca4aaab98c2795b565a525c665361a0276f1d1622f6606b46620b1f12c1ab420548c00d8f8cbe0370cd11646b31e7f406efcbf823636f625659b44ae390da6200869c48b88d82b7fce5eca4df70795c36d6249d6a07a62757f77fcf20f48bf0aa0d2fffc3fd12a9f175580a04ddccf21c131f6aeb3ac670431859073d1e06cbb25e7b45c8b0288e9aa29ba172469022322748af09d787e7f1709a9db35e40100746b390233f4112c40e3cd83a77411ca321ef3e336840779e89ea83633b8feef38867b1dad8077a4315cd617ab409fd6898569857c512963fb63f469b176a57b70c62686ec7bbc29c954682029bf6c75df7caa85a943965290bfad738b7f8c5ead8e133af39bfa9a0c29bc751399e8ea401505af6cde1b39c7f4e0fd10adc4f31401578494ae72dc86bb9bcf9136d9fca5847b08f4f4821d19bf28aed830e6c57b59740d6692d693268d83c0b559a963a1a723ed9e189261fd6d97592d49d8b8d58960bc0c2e8aaeb3b268cf96059b0dd480726543be6155dfab263eacc4ed773c28a53cf62a584e55eac04c1ad91ea62d6e92ab5450af90d546d25849ee4a4636d89f735a8411febfdd40cc85767d494d4c5bedc70f59ff482f473cf3b2795cc7bee41871943f908de5fd4fe879a5a1aeae64c9b69f52be9cfb5a11411d9cc1dc20e5e88329cc17731447a7bf201c807ee13acd5e1c1884f08890e924e7883d89f15b9814f6ff919697647828dfe1a172b5d1167415cd8f32cf6b511ae2c03b1492bcd5a8a2fb85fba2e998d772e3cca76b4b81d62e628a7a25678cc3a6cf556d43087732077e3fa61d193d49efbd1c29432c211244e1731a08a171507f0d63ae4c60b01533cdf81713340c9f474c4fbaa6eb801212d2f0cf65b394da4a25ff89d5696b3123f56e26f5f1e95d2c055c73fbbaeb63fc5fcde99a88f959b109170fe1fa2b837fc07dff9f94c95fefa1a7a870bf4fedbd099176accf500534711e1c4d389bcef19e7144d8cf9519b2d44a8ebe5da7c4e89861261e69df204524db99530affcc3f890cd857028e8a5330cf3667118360f198d3211cef7d9bb02090eba7f36ec16f385978be0c486d46a1ca5c8de4822c2c70d8203edd983127bf1a37edc38e96ebb9fedc18e706a1bab959c07e282926c206f6e9f00c9b1f7cee5492cde227fd92483beed255913c301c9ed217c8b1bac85a1eef438094bcc64e6a9a4c7e2fbd0cdeed9cc68dc50b49694d78a3fbcd9e206d95fd081054ba543a6041122b702e84ef59bc6b3554dbb436cb7404ee5e6fb3410f2d5f94da1a43e170a5e7f9118e3a9f764b6d6b3e52f314aace23df883415e1bdeb96e8b21328987731192ccb7e785bcd43df7c6555a03255ae8eb28c5a20477e2c6b077c5a073a107333fb43c22d36fe4bf66a84b83efb424a2bfe5f406bd05e43baaf4c6cc4a96797d5da7c0782f048b071e974f419097ddd4785ba6e2b5e7088cfeb0ffad6a36989409666265bbcfece2d8eb601e6c95dc8aca77a2df99a46ea363a38144e7c957aa666bb42f2e97a0b3197cbbb3c0d5d35cd9b4044162738c47fcb8a78c46da6802dafedb8ba69f0a653bbb9649e77b1107b62e2357a8c11bcf82798b7db847de03589946089a66938d690f7c7ae20d1cb9c9401ae911f698f13e8090b9b09a40e7c7c1065ede2e72c369cdeb9d7501ab3d2190b566fada98efcdebbad6066c2f72ee3e4cc021e08d11f9378095f78532e1c994ede51792b32f76456af8b9fcc3b07f9e3a04f9e7e641e5454985f53ae0c2e1f5f3021eb1098c4ffb435c155fb34345771df10d9cffdd8840f2c1e7c41e85725c839111466f57fc1fea9753715cb05d354ac0c9ca3595854f4c2df213227d6e86b4ececce31d380caf0b36b252a0c39c73b9a6f6729dfcc4b49b450da30c9c29d7bcebc60a86faaf337bebccf8f5392c6cbf7c7fafe6c0b828c12a9eca2474bfdc0a29829a3f73fbfcd123a8afaee3f9f9ddff79683aa40ed943712544fc186eb066778090594571b074b5f2b3afbdb491a3f6dcfe4bd4b524391829dbbbd73e36e8bffcd22aaccb49a4f831fa6731f1d618354d4a700cc1ea0506bddf76f2fc720539981b00f1744ddc33bfc965599cc7c3cdbb2596684c300ae65703c1196659a6e15ebbde08e87ea889c00996054f9d99df98367df40342b75a7c142f13cc9b97c0dec556e69a9737c485ad6b0522944094de584661e5279eebdad5a48d822d74f37ab91e50d4aefbfcef9466132aba8875bd18d987bcc4edf6790c8eaf22dcef8a053a3d4d39218934bca578d708315aad24868c706fa34c85699a308ae39a881dfcf86fd1d0b30f6494180acadad637c72850c7be3a0dd3aa71614c566e17f3783653ae64dc1317b0069feb62c3b1a34ff18bc1f1013cec721338714afdf8a7db2f917e075f2de8a6ceba096bc4e6e142b0a335e6663fd82cb95265ca24375094570a4297a579b589849e14f0875cfbbb92c0f191e93bebfd158b56096b3b68e3273a497e7147cb148a65804d39cc3799d87ae26ad7a245f8a483dbaf10a5fd477927235cbfa0b31e1d633302f8989da5c9afd4ea6e93f6a017b3b9f45400f5b9c0115fbac884a33ea815ddae71327d0371eed762b56d0e5faafbc275726adc639645edc94bf28633f1bd30d62101edc959f312c14c65300586950c9eaf31426f1419f64e6f1918739b34a013df9fa724b14650c4c693823096bbfef32619a4f4aa4588c45d453485fd2234e8ca17bee9fad440631977682563033c153a709d794a788661348d28b97b1861adb7ad75177b1662363020587760f32ec937cf1073dce02721d3375370cc68366fc40226ca0c81ae4160e8eaeade80b673b0edd48c4bfc0663526df1eeb0c5391a9b1f2235e1731efe92aa6ff4f0363cce74128c347c0327bda48caa87f31bc5dd7528db4a81e923f546b4b760fd94562f750dc225b0caa149383ad7b6798d1d56cc17cea0ef5689abead36afa42792f44081823cbcf4fe7bfd15df6de5930f102130c3a749a1439e11bf34d024820c10d71b8c2cc8eb0e9ad587439c5a2e1aa2f32efd620c75a8bdb65fdf4f3494fb23241548321edcfa72573c29071d50cdf19adbe9f520d83dd45994b4bbd828bd157b5b9a1b42428118994a2ac14cadbea3446852db1ffd6f8e61471028243bb9355483fcb621feae842e94f94ec9f7bcdf9af6f8638c4949e612fb6d1d4e218be9487b77a5d2daaf68a6488a8f18ac9f37a25543dc6080dfd17903ed005273200371332ea51d75f7a7e2c8b413eaf099201b565653ce7a1e98dfd8ca953da58d5fa04c5cd3244c480c96f0c4e4c0f0284ed8c70b954e6a26c9a852437fd31df867892250af5db38d4fae3b5e7f55fc2b669004fb1fc46b1bacf522756ab6234e011a80043b39bcd60f991cf116a658b33c9960f6e8c6c63ab48415f2441896ce5fe302899964217054460192cad0926ee2374be57f500b5326c9272123b7d977251748a122597eb5d19382f7f4d6ac361f259a372fbb736e95dfed4a832b9d77a997598f431dbf615580f2ce4adc6f3cf72e4ef647cb870afbed67b803ba88e6ef4134454308e5d68fba6643cdf07170188ac36a165317e1e1ff1ccae0c04b6df2dfab2dd784e9e7f2194b8e85b1d98efb7e4885a55783995ba9e74f2b231ddc2d9c0c5d9322d0ec3ccb5510d75bc00c8a9fc2b9fd9c3f315e1b259e71cccb58645db60fcf550fd15bef87712f8b27aea1197b45afc78fa37679553bae82b9c913a8b9c742dff6e6f5f5bfcaf49b72812653a835ad59ccfb2b7be59301efecbbab8c758252f471dbcd38329059dde96b3a2160ec978eccbb2f017db037f26286ae64b988a1734f87503ca89407b7c7ea9855dbefebc49d1dc691c8521c76e3bc0d3bb2c6ff1ac90e441c228aa5b2453f6ad794bc9bb9c57d18b55f4203ded793600c76801524c5f96238176ed553887981ca2b29661c45b92f236f211cf5ad87eb7325df", @typed={0x8, 0x117, 0x0, 0x0, @pid=r4}, @generic="7848392974b3c06a0ee27f7affa7a40607c7f0a2361822dffd7623956feadd6cb6ff3739725ef9e7aa540617688bd74ba7d7a7a6b4b71e6c03fab9a092704f34e04a5fdd87c4a2ac2a20d547216225be36853e2e69269e1cd9e469fe0d95bcfe8ec6cebf55079a29d22173b07c5afaa1d9921b3fc953f1183b9473970bd1bd1b3a83207cb26476d651f45c72104a4a1b1b6a6b60fc06331dc917b25fd84c0c8ffb7d72b2134b2b05c805195a1629a79badb6e383dff974291f566e319a8dc5547e93590f67a23b80a5236d612e20bd291ac31a482a12964cbacaacf2f6d12077ebc28a593b25afcaad91c96b4e83e5d1164db2", @generic="c92ccdad86ab559b20c76a0e6876ad09b40528860beb76a40c3748f83b08735023fc623d3176c1ca2eaf02f52ea8a5f0a009cf3eaa69d978cfb3fb71657b0663d069ff3418702ebca2b92ca6f4718674028b5ee3a5e778175a3626fa95ee62389d30a8a8685bed79e6be1adf6d8e598c437b4976f0c6912f66a93b5a1bde97b1c8a7b472e42cad18992b00f5b7b9b1961e497d994a826760e18e76290b92ab3e8b25776a70a221d7d9ee9295c0a60e7ec0fc3171d07aa1b743f385f03d3ca6aebeac2b1bae4f0870f5a2c6289b7684cfe530d4abcbf1838ffea022b7c6ea68448ca7bac68359f9bdec78581c41cb7f1c751cfb1e8335946a"]}]}, @TIPC_NLA_NET={0x7a, 0x7, 0x0, 0x1, [@typed={0xc, 0x4b, 0x0, 0x0, @u64=0x2}, @generic="bb645bc1680e23ef9375f4ba97b28d2fa6883639aa178ff52e3f5816b4e289841d2f18d11780f0b2993944eeac4a6e1e0e24e1e7617241de0e34dfb219e277911f360a2049ad745e9562a0d645266e63fbca0d5e42d9fda7031dfb38300ff582707b8361c1560cbd8f62"]}]}, 0x1810}, 0x1, 0x0, 0x0, 0x4}, 0x4004810)
mmap$auto(0x0, 0x2020009, 0x3, 0xeb1, 0xfffffffffffffffa, 0x8000)
madvise$auto(0x108000, 0x800034, 0xa)
sendfile$auto(r0, r0, 0x0, 0x3)
executing program 2:
mmap$auto(0x0, 0xe983, 0xdf, 0xeb1, 0x401, 0x8000)
sendmsg$auto_NL80211_CMD_GET_REG(0xffffffffffffffff, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000200)={0x0, 0x1ac}, 0x1, 0x0, 0x0, 0x4004810}, 0x800)
bpf$auto(0x0, &(0x7f00000001c0)=@test={0xffffffffffffffff, 0xffff, 0xfffff0b6, 0x5, 0xff, 0xac1, 0x2, 0x36242398, 0xfffff5b2, 0x3bb, 0x7, 0xffff, 0x800, 0x81, 0x68198}, 0x6f3)
r0 = socket(0x2, 0x1, 0x0)
close_range$auto(0x2, 0xa, 0x0)
r1 = socket$nl_generic(0x10, 0x3, 0x10)
socket(0x2, 0x3, 0x2)
getsockopt$auto(r0, 0x0, 0xcf, 0x0, 0x0)
r2 = socket(0x2c, 0x8180b, 0x67)
sendmsg$auto_NL80211_CMD_START_AP(r1, &(0x7f0000000740)={&(0x7f0000000480)={0x10, 0x0, 0x0, 0x4}, 0xc, &(0x7f0000000700)={&(0x7f00000004c0)={0x228, 0x0, 0x200, 0x70bd29, 0x25dfdbfb, {}, [@NL80211_ATTR_TDLS_OPERATION={0x5}, @NL80211_ATTR_PROBE_RESP={0xc6, 0x91, "b115c623f370c56f66e456048653950cf0eeda7ef15a981dcf6426abe06771909f0c689d6916de5759cd95f560b5c3e6e15bff365d33dab578ca3c52377279aa39baa39fa37d74c2ca190fd0e761869db0b8a6d12c1d6fa32744fceae6bbcbf12289ec19320c66a94bf68f03959a45dbb0eb013b32aaea2d15c03b2528245c77ad243fae4279281e7efe2137d9a895c480d01daceeb32eb1544dbba3381907ebef1d013ebb918b442034d27b9086282d5b6e527edb6410e9c9a2a3e2eb7a154c979b"}, @NL80211_ATTR_SCHED_SCAN_RELATIVE_RSSI={0x5, 0xf6, 0x10}, @NL80211_ATTR_MU_MIMO_FOLLOW_MAC_ADDR={0xdd, 0xe8, "f7523d62b236edacfea193cc0643de264f4a95bc101466455723af7209299a6e8d10a673e95297c7bbdb2f0d795f264cc30ace286c314b2d2243ba81e6c6324471d7d3ef2ac8e5e911f3921e3d36b349665f09672808971993adacd8ceb6d503b959383e804ca42b50497c33bcf21a8d1e70a3ca3804800e4f8fd6267e07f191ee0851d48b8d379b7a6120fd13de484ac83b774ba13ebae2ac030db2d87697191f6ab3c4c76e5bf59711bda8fdf7804205254490d595036f47d602e4c3bac1ce35f7d2158e3edfd56e98fccdb024731d0409e9249d0da042ae"}, @NL80211_ATTR_LOCAL_STATE_CHANGE={0x4}, @NL80211_ATTR_CENTER_FREQ1={0x8}, @NL80211_ATTR_MESH_CONFIG={0x50, 0x23, 0x0, 0x1, [@typed={0x4a, 0x13f, 0x0, 0x0, @binary="24bf0b1e106524fe2723887c2b056908df8d79f4fc1dcbf7886d5fd573fbd665d81e86799e2a7e728ef1bf4c1c79c5bf5a3f378727468f4c213251f73759df25d357d3b6821d"}]}]}, 0x228}, 0x1, 0x0, 0x0, 0x4}, 0x20000040)
sendmsg$auto_ETHTOOL_MSG_EEE_SET(0xffffffffffffffff, &(0x7f0000001700)={0x0, 0x0, &(0x7f00000016c0)={&(0x7f0000000100)=ANY=[@ANYBLOB="d4000000", @ANYRES16=0x0, @ANYBLOB="100027bd7000fbdbdf2518000000200001800247eea41fac000014000200766574683100000000000000000000000800070063fbffff0500060001000000840002803d00488013b37090badc49d6dc93876646d25a4d297d01cd3b7da38d12889cc50d505f353dc42d0a3c0a14c7b46428910708003600", @ANYRES32=0x0, @ANYBLOB="0400b3800000003d003b800400a4800c009a00008000000000000004008680c16ab1b1b39dcaa14b6af7dcc011b43cf706e562811c62b28a702b72e0a87126700294f2350000000c000180080003"], 0xd4}, 0x1, 0x0, 0x0, 0x20000010}, 0x20008000)
r3 = clone$auto(0x20003b46, 0x2, 0x0, 0x0, 0x2)
socket(0x10, 0x3, 0x0)
openat$auto_adf_hb_cfg_fops_adf_heartbeat_dbgfs(0xffffffffffffff9c, &(0x7f0000000040)='/sys/kernel/debug/ieee80211/phy1/netdev:wlan1/smps\x00', 0x20a00, 0x0)
mmap$auto(0x0, 0x2020009, 0x3, 0xeb1, 0xfffffffffffffffa, 0x8000)
sendmsg$auto_NL80211_CMD_GET_REG(0xffffffffffffffff, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000200)={0x0, 0x1ac}, 0x1, 0x0, 0x0, 0x4004810}, 0x800)
sendmsg$auto_OVS_PACKET_CMD_EXECUTE(0xffffffffffffffff, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000240)={&(0x7f0000000040)=ANY=[@ANYBLOB='@\x00\x00\x00', @ANYRES16, @ANYBLOB="1b0026bd7400fddbdf250300000004000800100003800c000980"], 0x40}, 0x1, 0x0, 0x0, 0x4004040}, 0xc800)
sendmsg$auto_NETDEV_CMD_QUEUE_GET(0xffffffffffffffff, &(0x7f0000003040)={0x0, 0x0, &(0x7f0000003000)={&(0x7f0000000040)=ANY=[@ANYBLOB="1c000000", @ANYRES16=0x0, @ANYBLOB="010600bd7000fbdbdf250a"], 0x1c}, 0x1, 0x0, 0x0, 0x20040004}, 0x20008810)
syz_genetlink_get_family_id$auto_mac80211_hwsim(&(0x7f0000000040), 0xffffffffffffffff)
sendmsg$auto_NL80211_CMD_GET_REG(0xffffffffffffffff, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000280)={&(0x7f0000000340)=ANY=[@ANYRES16=r3, @ANYBLOB="1a00"], 0x1ac}, 0x1, 0x0, 0x0, 0x81c0}, 0x1)
sendmsg$auto_NL80211_CMD_GET_REG(0xffffffffffffffff, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000040)=ANY=[@ANYBLOB="72010000", @ANYBLOB="19"], 0x1ac}}, 0x40000)
r4 = syz_genetlink_get_family_id$auto_nl802154(&(0x7f0000000380), r2)
sendmsg$auto_NL802154_CMD_SET_CCA_ED_LEVEL(r2, &(0x7f0000000440)={&(0x7f0000000300)={0x10, 0x0, 0x0, 0x2}, 0xc, &(0x7f0000000400)={&(0x7f00000003c0)={0x14, r4, 0xf08, 0x70bd2a, 0x25dfdbfc}, 0x14}, 0x1, 0x0, 0x0, 0x894}, 0x40000)
sendmmsg$auto(0x3, &(0x7f0000000080)={{0x0, 0x1c03, &(0x7f0000000000)={0x0, 0xc4}, 0x1, 0x0, 0x0, 0x9}, 0x1}, 0x2, 0x0)
close_range$auto(0x2, 0x8, 0x0)
open(0x0, 0x22040, 0x75)
r5 = socket(0x10, 0x2, 0x4)
sendmsg$auto_ETHTOOL_MSG_WOL_SET(0xffffffffffffffff, &(0x7f0000002cc0)={0x0, 0x0, &(0x7f0000002c80)={&(0x7f0000000180)=ANY=[@ANYBLOB=',\x00\x00\x00', @ANYBLOB="010027"], 0x2c}, 0x1, 0x0, 0x0, 0x4801}, 0x0)
sendmsg$auto_NL80211_CMD_GET_REG(r5, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000180)=ANY=[@ANYBLOB="72010000", @ANYBLOB="12"], 0x1ac}}, 0x40000)
sendmmsg$auto(0x3, &(0x7f0000000080)={{0x0, 0x2, &(0x7f00000002c0)={0x0, 0xc4}, 0x1, 0x0, 0x0, 0x9}, 0x7}, 0x3, 0x0)
executing program 2:
r0 = openat$auto_bsg_fops_bsg(0xffffffffffffff9c, &(0x7f0000000100)='/dev/bsg/1:0:0:0\x00', 0x0, 0x0)
r1 = openat$auto_tracing_mark_fops_trace(0xffffffffffffff9c, &(0x7f0000000000)='/sys/kernel/debug/tracing/trace_marker\x00', 0x201, 0x0) (async)
mmap$auto(0x0, 0x400008, 0xdf, 0x9b72, 0x2, 0x8000)
r2 = open(&(0x7f00000020c0)='./cgroup\x00', 0x0, 0x408)
getdents$auto(r2, 0x0, 0x400018) (async)
write$auto_tracing_mark_fops_trace(r1, 0x0, 0x1f00)
close_range$auto(0xffffffffffffffff, 0x8000, 0x8000000) (async)
openat$auto_tracing_pipe_fops_trace(0xffffffffffffff9c, &(0x7f0000003fc0)='/sys/kernel/debug/tracing/trace_pipe\x00', 0x20a02, 0x0) (async)
sendfile$auto(0x1, 0x3, 0x0, 0xc01) (async)
write$auto(r0, 0x0, 0x100082) (async)
r3 = socket(0x22, 0x1, 0x1)
getsockopt$auto(r3, 0x84, 0x75, 0x0, &(0x7f0000000000)=0x9b) (async)
r4 = openat$auto_tty_fops_tty_io(0xffffffffffffff9c, &(0x7f0000000000)='/dev/ttyS0\x00', 0x801, 0x0)
ioctl$auto_TIOCVHANGUP2(r4, 0x5437, 0x0) (async)
mmap$auto(0x0, 0x400008, 0xa, 0x10, r0, 0x0)
unshare$auto(0x40000080) (async)
socket(0x18, 0x5, 0x2)
mmap$auto(0x0, 0x8, 0xdf, 0x9b72, 0x2, 0x8000)
openat$nci(0xffffffffffffff9c, &(0x7f0000000080), 0x2, 0x0)
sendmsg$auto_NETDEV_CMD_QUEUE_GET(0xffffffffffffffff, &(0x7f0000003040)={0x0, 0x0, &(0x7f0000003000)={&(0x7f0000000040)=ANY=[@ANYBLOB='$\x00', @ANYRES16=0x0, @ANYBLOB="41004bbd7000fbdbdf250a00"], 0x24}, 0x1, 0x0, 0x0, 0x44884}, 0x20008810) (async)
capset$auto(0x0, 0x0) (async)
semctl$auto_SEM_STAT(0x7ff, 0x0, 0x12, 0x7fff) (async)
close_range$auto(0x2, 0x8, 0x0) (async)
r5 = prctl$auto_PR_RISCV_V_GET_CONTROL(0x46, 0x7fffffffffffffff, 0xffffffffffffffff, 0x8, 0x919c)
syz_genetlink_get_family_id$auto_nl80211(&(0x7f00000011c0), r5)
openat$auto_tracing_saved_cmdlines_fops_trace(0xffffffffffffff9c, &(0x7f0000001200)='/sys/kernel/debug/tracing/saved_cmdlines\x00', 0x72d102, 0x0)
executing program 2:
close_range$auto(0x2, 0x8, 0x0)
mmap$auto(0x0, 0x8c7, 0xdf, 0x9b72, 0x2, 0x8000)
socketpair$auto(0x1, 0x2, 0x8000000000000000, 0x0)
close_range$auto(0x2, 0x8, 0x0)
open(0x0, 0x163340, 0x2a)
socket(0x2, 0x80802, 0x0)
setsockopt$auto(0x3, 0x1, 0x3e, 0x0, 0x9)
mmap$auto(0x0, 0x20009, 0xe2, 0xeb1, 0x405, 0x8000)
r0 = openat$auto_fb_fops_fb_chrdev(0xffffffffffffff9c, &(0x7f0000001c80)='/dev/fb0\x00', 0x20401, 0x0)
ioctl$sock_SIOCGIFINDEX(r0, 0x4600, 0x0)
r1 = openat$auto_fb_fops_fb_chrdev(0xffffffffffffff9c, &(0x7f0000001c80)='/dev/fb0\x00', 0x20401, 0x0)
ioctl$sock_SIOCGIFINDEX(r1, 0x4601, 0x0)
connect$auto(0x3, 0x0, 0x55)
setsockopt$auto(0x3, 0x0, 0x1, 0x0, 0x9)
sendmmsg$auto(0x3, 0x0, 0x3, 0x0)
executing program 2:
r0 = openat$auto_uinput_fops_uinput(0xffffffffffffff9c, &(0x7f0000000000), 0x101001, 0x0)
mmap$auto(0x0, 0x4020009, 0xdf, 0xeb1, 0x401, 0x8000)
r1 = clone$auto(0x4, 0x80000001, 0x0, 0x0, 0xfff)
move_pages$auto(r1, 0xd0, 0x0, 0x0, 0x0, 0x2)
mmap$auto(0x0, 0x4020009, 0xdf, 0xeb1, 0x401, 0x8000)
close_range$auto(r0, 0xffffffffffffffff, 0x2)
socket(0x10, 0x2, 0x0)
socketpair$auto(0x1, 0x1, 0x8000000000000000, 0x0)
socket(0x2, 0x1, 0x0)
r2 = openat$auto_kvm_chardev_ops_kvm_main(0xffffffffffffff9c, &(0x7f0000000000), 0x212480, 0x0)
ustat$auto(0x801, 0x0)
close_range$auto(0x2, 0x8000, 0x0)
r3 = openat$auto_kvm_chardev_ops_kvm_main(0xffffffffffffff9c, &(0x7f00000011c0), 0xe0180, 0x0)
ioctl$auto_KVM_CREATE_VM(r3, 0xae01, 0x0)
ioctl$auto(0x3, 0xae41, r3)
ioctl$auto_KVM_CREATE_VM(r2, 0x4008ae8a, 0x0)
r4 = openat$auto_rtc_dev_fops_dev(0xffffffffffffff9c, &(0x7f0000000100), 0x240, 0x0)
ioctl$auto_RTC_PIE_ON(r4, 0x7005, 0x0)
ioctl$auto_UI_DEV_SETUP(r0, 0x405c5503, &(0x7f00000000c0)={{0x9, 0xf2cf, 0x8, 0x80}, "6a034a07c7b82d90b69a39e32576f893fba86c9dd051a0094a3836d61c9100fefbbabea6ef9368c7996e841f3f1561d4992f726b0a6c36b0b2fd1678e816201cf562367fe6596824588a2e3d84ba165f", 0xa})
ioctl$auto_UI_DEV_CREATE(r0, 0x5501, 0x0)
mmap$auto(0x0, 0x400008, 0xdf, 0x9b72, 0x0, 0x100000000008000)
write$auto(0x3, 0x0, 0x7fffffff)
fsopen$auto(0x0, 0x2)
mmap$auto(0x0, 0x400008, 0xdf, 0x9b72, 0x2, 0x8000)
executing program 34:
r0 = openat$auto_uinput_fops_uinput(0xffffffffffffff9c, &(0x7f0000000000), 0x101001, 0x0)
mmap$auto(0x0, 0x4020009, 0xdf, 0xeb1, 0x401, 0x8000)
r1 = clone$auto(0x4, 0x80000001, 0x0, 0x0, 0xfff)
move_pages$auto(r1, 0xd0, 0x0, 0x0, 0x0, 0x2)
mmap$auto(0x0, 0x4020009, 0xdf, 0xeb1, 0x401, 0x8000)
close_range$auto(r0, 0xffffffffffffffff, 0x2)
socket(0x10, 0x2, 0x0)
socketpair$auto(0x1, 0x1, 0x8000000000000000, 0x0)
socket(0x2, 0x1, 0x0)
r2 = openat$auto_kvm_chardev_ops_kvm_main(0xffffffffffffff9c, &(0x7f0000000000), 0x212480, 0x0)
ustat$auto(0x801, 0x0)
close_range$auto(0x2, 0x8000, 0x0)
r3 = openat$auto_kvm_chardev_ops_kvm_main(0xffffffffffffff9c, &(0x7f00000011c0), 0xe0180, 0x0)
ioctl$auto_KVM_CREATE_VM(r3, 0xae01, 0x0)
ioctl$auto(0x3, 0xae41, r3)
ioctl$auto_KVM_CREATE_VM(r2, 0x4008ae8a, 0x0)
r4 = openat$auto_rtc_dev_fops_dev(0xffffffffffffff9c, &(0x7f0000000100), 0x240, 0x0)
ioctl$auto_RTC_PIE_ON(r4, 0x7005, 0x0)
ioctl$auto_UI_DEV_SETUP(r0, 0x405c5503, &(0x7f00000000c0)={{0x9, 0xf2cf, 0x8, 0x80}, "6a034a07c7b82d90b69a39e32576f893fba86c9dd051a0094a3836d61c9100fefbbabea6ef9368c7996e841f3f1561d4992f726b0a6c36b0b2fd1678e816201cf562367fe6596824588a2e3d84ba165f", 0xa})
ioctl$auto_UI_DEV_CREATE(r0, 0x5501, 0x0)
mmap$auto(0x0, 0x400008, 0xdf, 0x9b72, 0x0, 0x100000000008000)
write$auto(0x3, 0x0, 0x7fffffff)
fsopen$auto(0x0, 0x2)
mmap$auto(0x0, 0x400008, 0xdf, 0x9b72, 0x2, 0x8000)
executing program 6:
mmap$auto(0x0, 0x2020009, 0x3, 0xeb1, 0xfffffffffffffffa, 0x8000)
close_range$auto(0x0, 0xfffffffffffff000, 0x2)
mmap$auto(0x0, 0x20009, 0x4000000000df, 0xeb1, 0x401, 0x8000)
close_range$auto(0x2, 0x8, 0x0)
socket$nl_generic(0x10, 0x3, 0x10)
socket(0x11, 0x80003, 0x300)
sendto$auto(0x3, 0x0, 0x800013, 0xffffffbc, &(0x7f0000000440)=@tipc=@name={0x1e, 0x2, 0x0, {{0x41, 0x4}, 0x4}}, 0x22)
socket(0xa, 0x2, 0x73)
socketpair$auto(0x1, 0x5, 0x8000000000000000, 0x0)
socket(0x1, 0x3, 0x0)
bind$auto(0x3, 0x0, 0x6b)
connect$auto(0x3, 0x0, 0x6b)
readv$auto(0xffffffffffffffff, 0x0, 0x410)
sendmsg$auto_NL80211_CMD_SET_WIPHY(0xffffffffffffffff, 0x0, 0x4000000)
close_range$auto(0x0, 0xfffffffffffff001, 0x2)
openat$auto_adf_hb_cfg_fops_adf_heartbeat_dbgfs(0xffffffffffffff9c, &(0x7f0000000000)='/sys/kernel/debug/ieee80211/phy0/hw_conf\x00', 0x20486, 0x0)
openat$auto_def_blk_fops_fs(0xffffffffffffff9c, &(0x7f0000000040)='/dev/loop6\x00', 0x169780, 0x0)
socket(0x11, 0x80003, 0x0)
openat$auto_raw_fops_raw_gadget(0xffffffffffffff9c, &(0x7f00000000c0), 0x0, 0x0)
r0 = socket(0x29, 0x2, 0x0)
mmap$auto(0x0, 0x202000c, 0x3, 0xab1, 0xfffffffffffffffa, 0x8000)
mmap$auto(0x0, 0x400008, 0xdf, 0x9b72, 0x2, 0x8000)
prctl$auto(0x1000000003b, 0x1, 0x4, 0x5, 0x10004)
madvise$auto(0x0, 0xffffffffffff0001, 0x15)
madvise$auto(0x0, 0xffffffffffff0008, 0x19)
setsockopt$auto(r0, 0x119, 0x400000, 0x0, 0x802)
socket(0x10, 0x2, 0x6)
mmap$auto(0x0, 0x400008, 0xdf, 0x9b72, 0x1fe, 0x8000)
sendmsg$auto_NL80211_CMD_GET_REG(0xffffffffffffffff, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000200)={0x0}, 0x1, 0x0, 0x0, 0x40000}, 0x40805)
sendmsg$auto_L2TP_CMD_NOOP(0xffffffffffffffff, &(0x7f0000000280)={0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x40080}, 0x8c1)
executing program 4:
read$auto(0xffffffffffffffff, &(0x7f0000000000)='%:\x00', 0x7)
mmap$auto(0x0, 0x7, 0x8, 0xeb1, 0xfffffffffffffffa, 0x40000000008000)
r0 = openat$auto_proc_mem_operations_base(0xffffffffffffff9c, &(0x7f0000000300)='/proc/self/mem\x00', 0x100, 0x0)
read$auto_proc_mem_operations_base(r0, &(0x7f0000000340)=""/230, 0xe6)
bpf$auto(0x14, &(0x7f00000000c0)=@iter_create={0xffffffffffffffff, 0x4}, 0x7)
executing program 4:
r0 = socket(0x10, 0x2, 0x0)
close_range$auto(0x2, 0x8, 0x0)
socket(0x10, 0x2, 0x4)
socket(0x10, 0x3, 0x6)
sendmsg$auto_NL80211_CMD_GET_REG(r0, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000300)=ANY=[@ANYBLOB="72010000", @ANYBLOB="120027", @ANYBLOB="5de1"], 0x1ac}}, 0x40000)
read$auto(r0, &(0x7f0000000000)='$-]&@\x00', 0x5)
executing program 4:
mmap$auto(0x0, 0x2020009, 0x3, 0xeb2, 0xfffffffffffffffb, 0x8000)
close_range$auto(0x2, 0x8, 0x0)
r0 = openat$auto_tracing_err_log_fops_trace(0xffffffffffffff9c, &(0x7f0000000000)='/sys/kernel/debug/tracing/error_log\x00', 0xb01, 0x0)
socket(0x15, 0x5, 0x0)
connect$auto(0x3, &(0x7f0000000080)=@in={0x2, 0x3, @dev={0xac, 0x14, 0x14, 0x10}}, 0x54)
getsockopt$auto(0x3, 0x200000000001, 0x1c, 0x0, 0x0)
mmap$auto(0x0, 0x2020009, 0x9, 0xeb1, 0xfffefffffffffffa, 0x8000)
r1 = epoll_create$auto(0x4)
r2 = openat$auto_v4l2_fops_v4l2_dev(0xffffffffffffff9c, &(0x7f0000000000)='/dev/video2\x00', 0x101081, 0x0)
epoll_ctl$auto(r1, 0x1, r2, 0x0)
mmap$auto(0x0, 0x4020009, 0xdf, 0xeb1, 0x401, 0x8000)
r3 = socket(0x1, 0x3, 0x80000000)
r4 = getsockopt$auto(r3, 0x6, 0x25, 0x0, 0x0)
mmap$auto(0x40000000010000, 0x400008, 0xdf, 0x9b72, r0, 0x8000)
socketpair$auto(0x1, 0x1, 0x8000000000000000, 0x0)
socket(0x11, 0x80003, 0x300)
setsockopt$auto(r4, 0xffff6871, 0x8, 0x0, 0x3)
r5 = socket(0x10, 0x2, 0x4)
io_uring_setup$auto(0x4bf15e08, &(0x7f0000000000)={0x401, 0x8, 0xfe, 0x6fb3, 0x8a, 0x40000009, 0xffffffffffffffff, [0x100, 0x9, 0x7f], {0x6, 0x7, 0x3032, 0xe, 0xf, 0x5, 0x5, 0xfffffff9, 0xf08a2b3}, {0x0, 0xfc, 0x6, 0x1, 0x0, 0xf89, 0x9, 0x7fffffff, 0x8}})
r6 = socket$nl_generic(0x10, 0x3, 0x10)
ioctl$sock_SIOCGIFINDEX(r6, 0x8933, &(0x7f0000000000)={'dummy0\x00'})
syz_open_procfs$namespace(0x0, 0x0)
sendmsg$auto_NFSD_CMD_THREADS_SET(0xffffffffffffffff, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000000140)=ANY=[@ANYBLOB="1f9a81052a570148ea3acf23453bf490b45c8a1e9c681d666620c84499a29282c991", @ANYRESOCT=r4], 0x2c}, 0x1, 0x0, 0x0, 0x4000044}, 0x2404c000)
write$auto(r5, &(0x7f0000000000)='-\x00', 0x2fb)
r7 = openat$auto_kernfs_file_fops_kernfs_internal(0xffffffffffffff9c, 0x0, 0x500, 0x0)
read$auto_kernfs_file_fops_kernfs_internal(r7, &(0x7f0000000080)=""/23, 0x17)
openat$auto_proc_sys_file_operations_proc_sysctl(0xffffffffffffff9c, 0x0, 0x101202, 0x0)
close_range$auto(0x2, 0x8, 0x0)
openat$auto_proc_iter_file_ops_compat_inode(0xffffffffffffff9c, &(0x7f0000000040)='/proc/fs/netfs/cookies\x00', 0x40080, 0x0)
openat$auto_proc_sys_file_operations_proc_sysctl(0xffffffffffffff9c, &(0x7f0000000080)='/proc/sys/kernel/seccomp/actions_logged\x00', 0x8202, 0x0)
executing program 0:
r0 = socket(0xa, 0x2, 0x3a)
setsockopt$auto(r0, 0x29, 0x11, &(0x7f0000000240)='!\x00\xba\xe4\x8a\xf0t\xaf\x82\xd7{\x98\xdd\xee\xc2f\xcaH\x90\xc57M\x87<<\n\xf2L\"Y\xa9\f\n\xbd?\xdd\b\xf7vu:\x00\xeaP\xa7=\xef\xc3\xdc\xf3=J\xf9\x9e\xd9\x02\xbb\xd3\xf8\xff*\xc2\xd8w\xe9\x00\x00\x01\x00h\xe2\x0f\x1b\x95L\xbf\xa5\xacH\"xV#\xc7e\x12\x83\xed\xc7\xc5\x9e\x84?\xfa=\f\xd8\x14\x00\x9fJl\xdd)i\x9f(#\xb7\xff:\x94\x8bd,\xb2\xfc\xde32\x87;\tx\xffM\x1f\x1d\xd8b\xa5\r\xb7v;\xfd\xa14M\xd3\x95\x86\x04\xd4\xda}\xcat}\x18K\x85\x9bBj\x8e\x95\xca\x87\xfe\x125\x154\x83\x94X,\xa4\xf3\xf6\xef\x1a\xb5iX\x99\xa1NO\xc5R\xc9\xc7\xd6\x8d?\x13\x9f\xaf\xf4\xbc\xa3j\xefQ\x7f\xc4\x86\xe8\xc6\xf8\xfe\x115\xd7\x89\x86\xc6T\x14\x00\x13\xb9mf\xc0\xc2%_N\xed\xa9\x02\xe5\x83\xa0\x01O%NHKp\xe0\xb3u\xdc\x8bb\xfa\xabD\x1d\x8a\x1e\xb4C\x05R\xdco\xa5\xce\xc9+\xf8\xf2X#', 0x1fe)
executing program 0:
stat$auto(&(0x7f0000000300)='./cgroup\x00', &(0x7f0000000340)={0x7, 0x8000, 0x6, 0x8001, 0xee00, <r0=>0xee01, 0x0, 0x187, 0x2, 0x8, 0x3, 0x5fd0, 0x7f, 0x6, 0xfff, 0x3, 0x1})
mmap$auto(0x0, 0x20009, 0xdf, 0xeb1, 0x401, 0x8000)
close_range$auto(0x2, 0x8, 0x0)
sendmsg$auto_NL80211_CMD_GET_REG(0xffffffffffffffff, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000200)={0x0, 0x1ac}, 0x1, 0x0, 0x0, 0x4004810}, 0x800)
sendmsg$auto_HSR_C_GET_NODE_STATUS(0xffffffffffffffff, &(0x7f0000000200)={0x0, 0x0, &(0x7f00000001c0)={&(0x7f0000000140)=ANY=[@ANYBLOB='h\x00\x00\x00', @ANYRES16=<r1=>0x0, @ANYBLOB="000226bd7000fedbdf25030000000800030004020000060007000080000008000200", @ANYRES32=0x0, @ANYBLOB="0a00050000000000000000000a00010000000000000000000a0001000000000000000000060007000a00000008000200", @ANYRES32=0x0, @ANYBLOB="080140"], 0x68}}, 0x40090)
sendmsg$auto_NL80211_CMD_STOP_AP(0xffffffffffffffff, &(0x7f0000000d80)={0x0, 0x0, &(0x7f0000000d40)={&(0x7f0000000480)=ANY=[@ANYBLOB="140000008f68084197cad0a602aceff6e434f2a84c1f9a2b686c17575cce6e2cd51220266f0b04fe6d0d6755e40794c7abe48678c462385fa5f6513224e850eeda5ea0674056022442388de7dccbfa2d751c143291176413f704a2f4a993ee64456952edd4e6754a5a15e01f0af0c21460ba", @ANYRES16=0x0, @ANYBLOB="040029bd7000fedbdf2510000000"], 0x14}, 0x1, 0x0, 0x0, 0x4000001}, 0x40)
r2 = syz_genetlink_get_family_id$auto_nfsd(&(0x7f0000001440), 0xffffffffffffffff)
r3 = syz_genetlink_get_family_id$auto_nfc(&(0x7f00000015c0), 0xffffffffffffffff)
sendmsg$auto_NFC_CMD_STOP_POLL(0xffffffffffffffff, &(0x7f0000002680)={0x0, 0x0, &(0x7f0000002640)={&(0x7f0000000580)=ANY=[@ANYBLOB="a65115c4", @ANYRESHEX=r2, @ANYBLOB="20fa28bd7000ff08000000000000", @ANYRESHEX=r0, @ANYRES32=r1, @ANYBLOB="0e8ccd1998719890eacd4d3402f180541c0d46edfd51d271fc33418c4c593e56ad425d740f39db93ceccd1d5080384ccbae93ed6023dbe608b336fb2ab07c317034bb6502024c8ed3c37f4faa9f60e127fdd7dee19f9b9629e0e7e1557ede9db5ae05b584563f1a93b6a219e6180b2169ed686dedb69b3938d03d1811ad83d761ddf44eeb82bec8cf9393ae21418e7db49746d2169a15334ea7eba5e60fe201d46cd32d3ca0a8f7c5c34cef4371cc0e9", @ANYRES8=r1, @ANYRES8=r0, @ANYRES8=0x0], 0x14}, 0x1, 0x0, 0x0, 0x40008d5}, 0x4010)
sendmsg$auto_NFC_CMD_START_POLL(0xffffffffffffffff, &(0x7f0000000400)={&(0x7f0000000440)={0x10, 0x0, 0x0, 0x402}, 0xc, &(0x7f0000000280)={&(0x7f0000000240)=ANY=[@ANYBLOB='<\x00\x00\x00', @ANYRES16=r3, @ANYBLOB="08002bfd7000ffdbdf450600000020000200d65bced5efd32a94b7f5980a2f0965559f617873703100f47c78308008001e0080000000"], 0x3c}, 0x1, 0x0, 0x0, 0x20048895}, 0x40000)
r4 = socket(0x2, 0x3, 0x100)
socket(0x10, 0x2, 0x0)
sendmsg$auto_NL80211_CMD_GET_REG(0xffffffffffffffff, &(0x7f0000000100)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000180)=ANY=[@ANYBLOB="72010000", @ANYBLOB="13"], 0x1ac}, 0x1, 0x0, 0x0, 0x10008001}, 0x4004)
sendmmsg$auto(0x3, &(0x7f0000000080)={{0x0, 0x2, &(0x7f00000002c0)={0x0, 0xc4}, 0x1, 0x0, 0x0, 0x9}, 0x7}, 0x3, 0x0)
r5 = socket$nl_generic(0x10, 0x3, 0x10)
mmap$auto(0x0, 0xe983, 0xdf, 0xeb1, 0x401, 0x8000)
mmap$auto(0x0, 0x9, 0xdf, 0x9b72, 0x2, 0x8000)
io_uring_setup$auto(0x406, 0x0)
mmap$auto(0x0, 0x9, 0xffb, 0x8000000008011, 0x3, 0x0)
getrandom$auto(0x0, 0x6000000, 0x3)
io_uring_enter$auto(r4, 0xa84, 0x80000001, 0xe, 0x0, 0x46)
migrate_pages$auto(0x0, 0x99, 0x0, &(0x7f00000001c0)=0x3fe)
r6 = openat$auto_snd_pcm_oss_f_reg_pcm_oss(0xffffffffffffff9c, &(0x7f0000000100)='/dev/adsp1\x00', 0x40a140, 0x0)
ioctl$auto_SNDCTL_DSP_CHANNELS(r6, 0xc0045006, &(0x7f00000001c0))
getrandom$auto(&(0x7f0000000100)='..\x00k\xac\x8c\x1d\x0e\x98\x80\xd2\xaf\xa1\xf2\x1e\xe1R1\xa2\x8e\xce\xa0\x17\bI3\'\xc5tw\xd7\x1d\xa6\xf4#+\xfa\xd7\x01\xb9j<\v\xf47\n\xa7\xd2\x8b\x11e</\xfd\x9b\xe4\x99G\xeaS\x9a\xadu(:\x94:\xaf\x06c=3>1\xb3\xfdd\x04\xa9 1q\x97\xc4,\xa9^\xc1\xb6\xa1q\x0f\xd1\x013\x87l\xb9\x1e\x05\x90\xa2', 0xd5, 0x1)
move_pages$auto(0x0, 0x1002, 0x0, 0x0, 0x0, 0x2)
openat$auto_seq_oss_f_ops_seq_oss(0xffffffffffffff9c, &(0x7f0000000540)='/dev/sequencer2\x00', 0x0, 0x0)
io_uring_enter$auto(0x3, 0x5, 0xffffffff, 0x3, 0x0, 0x2)
getdents$auto(0xffffffffffffffff, 0x0, 0x100019)
syz_genetlink_get_family_id$auto_nl80211(&(0x7f0000000000), r5)
executing program 4:
openat$auto_snd_pcm_oss_f_reg_pcm_oss(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/dsp1\x00', 0x20b42, 0x0)
read$auto_proc_reg_file_ops_compat_inode(0xffffffffffffffff, &(0x7f0000000280)=""/65, 0x41)
mmap$auto(0x0, 0x4020009, 0x6, 0xeb1, 0x401, 0x8000)
prctl$auto(0x1000000003b, 0x1, 0x4, 0x5, 0x7)
socket$nl_generic(0x10, 0x3, 0x10)
close_range$auto(0x2, 0x8, 0x0)
sendmsg$auto_NETDEV_CMD_DEV_GET(0xffffffffffffffff, &(0x7f0000000080)={&(0x7f0000000140)={0x10, 0x0, 0x0, 0x400000}, 0xc, 0x0, 0x1, 0x0, 0x0, 0x48000}, 0x0)
mmap$auto(0x0, 0x400008, 0xdf, 0x9b72, 0x2, 0x8000)
close_range$auto(0x2, 0x8000, 0x0)
sendmsg$auto_HSR_C_GET_NODE_STATUS(0xffffffffffffffff, &(0x7f0000000200)={0x0, 0x0, &(0x7f00000001c0)={&(0x7f0000000140)={0x68, 0x0, 0x200, 0x70bd26, 0x25dfdbfe, {}, [@HSR_A_IF1_AGE={0x8, 0x3, 0x200}, @HSR_A_IF2_SEQ={0x6, 0x7, 0x4}, @HSR_A_IFINDEX={0x8}, @HSR_A_NODE_ADDR_B={0xa}, @HSR_A_NODE_ADDR={0xa, 0x1, @broadcast}, @HSR_A_NODE_ADDR={0xa}, @HSR_A_IF1_AGE={0x8, 0x3, 0x38}, @HSR_A_IFINDEX={0x8}, @HSR_A_IF2_AGE={0x8, 0x4, 0x4}]}, 0x68}, 0x1, 0x0, 0x0, 0x40080}, 0x40090)
socket(0x2, 0x3, 0x100)
socket(0x10, 0x2, 0x0)
sendmsg$auto_NL80211_CMD_GET_REG(0xffffffffffffffff, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000200)={0x0, 0x1ac}, 0x1, 0x0, 0x0, 0x4004810}, 0x800)
sendmsg$auto_NL80211_CMD_GET_REG(0xffffffffffffffff, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000180)=ANY=[@ANYBLOB="720100", @ANYBLOB="13"], 0x1ac}}, 0x4004)
sendmmsg$auto(0x3, &(0x7f0000000080)={{0x0, 0x2, &(0x7f00000002c0)={0x0, 0xc4}, 0x1, 0x0, 0x0, 0x9}, 0x7}, 0x3, 0x0)
executing program 0:
futex_waitv$auto(&(0x7f0000000180)={0x3fb, 0x6, 0x2, 0xfff}, 0x3, 0xbffffffc, 0x0, 0x81)
r0 = bpf$auto(0x5, &(0x7f00000001c0)=@task_fd_query={0x2, 0x2, 0x4, 0x0, 0x85, 0x4, 0x9, 0x6, 0x8001}, 0x101)
close_range$auto(0x2, 0xa, 0x0)
socket$nl_generic(0x10, 0x3, 0x10)
syz_clone(0x11, 0x0, 0x0, 0x0, 0x0, 0x0)
r1 = openat$auto_blk_mq_debugfs_fops_blk_mq_debugfs(0xffffffffffffff9c, &(0x7f00000000c0)='/sys/kernel/debug/block/mtdblock0/sched/read0_fifo_list\x00', 0x0, 0x0)
read$auto_blk_mq_debugfs_fops_blk_mq_debugfs(r1, &(0x7f0000000040)=""/124, 0x7c)
pipe$auto(&(0x7f0000000000)=<r2=>0xffffffffffffffff)
splice$auto(r2, 0x0, 0x2, 0x0, 0x9, 0x8)
mmap$auto(0x0, 0x7, 0xdf, 0x9b72, 0x2, 0x7ffc)
mmap$auto(0x0, 0x20009, 0x4000000000df, 0xeb1, 0x401, 0x8000)
mremap$auto(0x0, 0x4, 0x4, 0x7, 0x1000)
mmap$auto(0x0, 0x400008, 0xdf, 0x9b72, 0x2, 0x8000)
close_range$auto(0x2, r0, 0x0)
socketpair$auto(0x1e, 0x1, 0x8000000000000000, 0x0)
openat$auto_vhost_vsock_fops_vsock(0xffffffffffffff9c, &(0x7f0000000000), 0x121900, 0x0)
mmap$auto(0x0, 0x20009, 0xdf, 0xeb1, 0x401, 0x8000)
r3 = socket(0x2, 0x1, 0x0)
fcntl$auto(0x3, 0x4, 0xa553)
bind$auto(r2, &(0x7f0000000040)=@llc={0x1a, 0x301, 0x81, 0xe, 0x4, 0x2, @local}, 0x1)
sendmmsg$auto(r3, &(0x7f0000000140)={{&(0x7f0000000040), 0x12, 0x0, 0x101, 0x0, 0x5, 0x9ad}, 0x5}, 0x5, 0x20000000)
r4 = socketpair$auto(0x1, 0x5, 0x8000000000000000, 0x0)
syz_genetlink_get_family_id$auto_batadv(0x0, 0xffffffffffffffff)
mmap$auto(0x7, 0x202000c, 0x5, 0xfb1, r4, 0xa)
semctl$auto(0x9, 0xc1b8, 0x4, 0x1)
mmap$auto(0x7ffffffd, 0x400004, 0x7, 0x9b72, r3, 0x5)
dup2$auto(0xffffffffffffffff, 0xffffffffffffffff)
syz_genetlink_get_family_id$auto_nl80211(0x0, 0xffffffffffffffff)
sendmsg$auto_NL80211_CMD_SET_MULTICAST_TO_UNICAST(0xffffffffffffffff, 0x0, 0x0)
sendmsg$auto_NL80211_CMD_GET_STATION(0xffffffffffffffff, 0x0, 0x40)
executing program 6:
close_range$auto(0x2, 0x1d, 0x0)
r0 = syz_genetlink_get_family_id$auto_nl80211(&(0x7f0000000180), 0xffffffffffffffff)
sendmsg$auto_NL80211_CMD_SET_WIPHY(0xffffffffffffffff, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000080)=ANY=[@ANYBLOB='$\x00\x00\x00', @ANYRES16=r0, @ANYBLOB="011d3da4420008bd7100f9db5f250200000000000010", @ANYRES32], 0x24}, 0x1, 0x0, 0x0, 0x404c0c0}, 0x80)
mmap$auto(0x0, 0x3, 0x4000000200df, 0x40eb2, 0x402, 0x300000000000)
capget$auto(&(0x7f0000000100)={0x5}, &(0x7f0000000140)={0x7ff, 0xc, 0x800})
close_range$auto(0x2, 0xa, 0x0)
socket(0x10, 0x2, 0x4)
openat$auto_safesetid_uid_file_fops_securityfs(0xffffffffffffff9c, &(0x7f0000000080), 0x1, 0x0)
writev$auto(0x3, &(0x7f0000000100)={0x0, 0x7111}, 0x8)
r1 = socket(0x10, 0x2, 0x0)
sendmmsg$auto(r1, &(0x7f0000000200)={{0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000080), 0xfc2}, 0x2, &(0x7f00000001c0), 0x7, 0xa505}, 0x800}, 0x7, 0x4008)
socket(0x3, 0x800, 0x9)
r2 = openat$auto_kernfs_file_fops_kernfs_internal(0xffffffffffffff9c, &(0x7f0000000080)='/sys/module/apparmor/parameters/path_max\x00', 0x80, 0x0)
r3 = socket(0x1e, 0x4, 0x0)
setsockopt$auto(r3, 0x10f, 0x86, 0x0, 0x0)
read$auto_kernfs_file_fops_kernfs_internal(r2, &(0x7f00000000c0)=""/17, 0x11)
open(&(0x7f0000000000)='./file0\x00', 0x261c2, 0x84)
r4 = open(&(0x7f0000000080)='./file0\x00', 0xeee00, 0x31)
mmap$auto(0x3, 0x2020009, 0x7fffffff, 0xeb1, 0xfffffffffffffffa, 0x8000)
r5 = openat$auto_kernfs_file_fops_kernfs_internal(0xffffffffffffff9c, &(0x7f0000000040)='/sys/devices/virtual/block/ram6/queue/minimum_io_size\x00', 0x0, 0x0)
read$auto_kernfs_file_fops_kernfs_internal(r5, &(0x7f0000001540)=""/104, 0x68)
mmap$auto(0x0, 0x400008, 0xdf, 0x9b72, 0x2, 0x8000)
getcwd$auto(0x0, 0xffffffffffffffff)
rename$auto(0x0, &(0x7f0000000300)='v#\xd5\xaf>=\x14\xe6%\xf7\x8a\x8d\x9a\xae\x1a\xd6\xa8\xb8\x1d\xf5(\xb0\x1f\xbd\xcbV\n\"\xe3V\xfeP\xceN\xb2\xc32\xaf\xcc\x80\xfa\xf0\xd4\xd9|\xfe\x03y\xd16\x17\x99R\xca\xe5\xf4\xb4T\xfcv\xfc\xe6\x9cv\a\x00\xc2a\x16\xd1\x8a\x80\x90\x87\xa5s\x10\xed\x93\xd4\x15=\xc0\x1f\x0e\xb0\x18v}\x03!\xf0I\xe3}\x90\x9b\x92[\xfe2<7\xd3\x81\x9a~\xcd\r\x19\x9e\x10(5\xfd\x8b\x82\xd4\xc85\xc3\x93t\t\xd0\x9d\xca^n\xf3\xcb>\x1bO\xcej\xe0\xef\xf2\xd7\xc2}\x18\xd9`AO\x95<\x9aH\vu\xae\xd4\xea\x12\xb8\xd1\n\x01\x83r\x85\xbf*\x18\xa7 S:R\x14\x89Z3\x94\x8bP)')
write$auto(0x3, 0x0, 0x100082)
lseek$auto(r4, 0xc, 0x4)
executing program 6:
mmap$auto(0x0, 0x4020009, 0x8000000080000000, 0x17, 0x401, 0x8000)
madvise$auto(0x0, 0xffffffffffff0005, 0x17)
openat$auto_clear_warn_once_fops_(0xffffffffffffff9c, &(0x7f0000000100), 0x210800, 0x0)
r0 = openat$auto_tty_fops_tty_io(0xffffffffffffff9c, &(0x7f0000000000)='/dev/tty46\x00', 0x0, 0x0)
close_range$auto(0x2, 0x8, 0x0)
socket(0x10, 0x2, 0x0)
socket(0x2, 0x6, 0x0)
mmap$auto(0x0, 0x400005, 0xdf, 0x9b72, 0x2, 0x8000)
socket(0xa, 0x5, 0x84)
bind$auto(0x3, 0x0, 0x6a)
ioctl$auto(0x3, 0x800005411, 0x38)
ioctl$auto(r0, 0x5600, 0x0)
mmap$auto(0x6, 0x400005, 0xffffffffffffff00, 0x9b72, r0, 0x8000)
close_range$auto(0x2, 0x8, 0x0)
socketpair$auto(0x1, 0x2, 0x8000000000000000, 0x0)
r1 = openat$auto_force_devcoredump_fops_hci_vhci(0xffffffffffffff9c, &(0x7f0000000c40)='/sys/kernel/debug/bluetooth/hci0/force_devcoredump\x00', 0x2, 0x0)
write$auto(r1, 0x0, 0xe)
mremap$auto(0x0, 0xffffffffffffffff, 0x3fd6, 0x3, 0x7fffffffb000)
mmap$auto(0x0, 0x400005, 0x800000000000df, 0x9b72, 0x2, 0x8000)
madvise$auto(0x0, 0xffffffffffff0001, 0x15)
r2 = openat$auto_proc_clear_refs_operations_internal(0xffffffffffffff9c, &(0x7f0000000600)='/proc/thread-self/clear_refs\x00', 0x2, 0x0)
mmap$auto(0x0, 0x8, 0xdf, 0x9b72, 0x2, 0x8000)
setitimer$auto(0x4, &(0x7f0000000000)={{0x1ff, 0x10001}, {0x200000000004, 0x6}}, 0x0)
openat$nci(0xffffffffffffff9c, &(0x7f0000000000), 0x2, 0x0)
bpf$auto(0x12, &(0x7f0000000000)=@info={0x2800, 0x1ff, 0x2}, 0xcf)
r3 = socket(0x10, 0x2, 0x0)
sendmsg$auto_NL80211_CMD_GET_REG(r3, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000300)=ANY=[@ANYBLOB=' \x00\x00\x00', @ANYBLOB="1200", @ANYBLOB=']'], 0x1ac}}, 0x40000)
recvmmsg$auto(r3, &(0x7f0000000380)={{0x0, 0x1, &(0x7f0000000000)={0x0, 0x400}, 0x4, 0x0, 0x200002, 0x8}, 0x803}, 0xfffffff9, 0x10010, 0x0)
write$auto_proc_clear_refs_operations_internal(r2, 0x0, 0xffffff4b)
socket(0xa, 0x3, 0x3a)

program crashed: KASAN: slab-use-after-free Read in force_devcd_write
bisect: the chunk can be dropped
bisect: split chunks (needed=true): <15>
bisect: split chunk #0 of len 15 into 2 parts
bisect: testing without sub-chunk 1/2
testing program (duration=6m2s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): [6, 30, 2, 30, 15, 30, 26, 30]
detailed listing:
executing program 4:
r0 = socket(0x10, 0x2, 0x0)
close_range$auto(0x2, 0x8, 0x0)
socket(0x10, 0x2, 0x4)
socket(0x10, 0x3, 0x6)
sendmsg$auto_NL80211_CMD_GET_REG(r0, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000300)=ANY=[@ANYBLOB="72010000", @ANYBLOB="120027", @ANYBLOB="5de1"], 0x1ac}}, 0x40000)
read$auto(r0, &(0x7f0000000000)='$-]&@\x00', 0x5)
executing program 4:
mmap$auto(0x0, 0x2020009, 0x3, 0xeb2, 0xfffffffffffffffb, 0x8000)
close_range$auto(0x2, 0x8, 0x0)
r0 = openat$auto_tracing_err_log_fops_trace(0xffffffffffffff9c, &(0x7f0000000000)='/sys/kernel/debug/tracing/error_log\x00', 0xb01, 0x0)
socket(0x15, 0x5, 0x0)
connect$auto(0x3, &(0x7f0000000080)=@in={0x2, 0x3, @dev={0xac, 0x14, 0x14, 0x10}}, 0x54)
getsockopt$auto(0x3, 0x200000000001, 0x1c, 0x0, 0x0)
mmap$auto(0x0, 0x2020009, 0x9, 0xeb1, 0xfffefffffffffffa, 0x8000)
r1 = epoll_create$auto(0x4)
r2 = openat$auto_v4l2_fops_v4l2_dev(0xffffffffffffff9c, &(0x7f0000000000)='/dev/video2\x00', 0x101081, 0x0)
epoll_ctl$auto(r1, 0x1, r2, 0x0)
mmap$auto(0x0, 0x4020009, 0xdf, 0xeb1, 0x401, 0x8000)
r3 = socket(0x1, 0x3, 0x80000000)
r4 = getsockopt$auto(r3, 0x6, 0x25, 0x0, 0x0)
mmap$auto(0x40000000010000, 0x400008, 0xdf, 0x9b72, r0, 0x8000)
socketpair$auto(0x1, 0x1, 0x8000000000000000, 0x0)
socket(0x11, 0x80003, 0x300)
setsockopt$auto(r4, 0xffff6871, 0x8, 0x0, 0x3)
r5 = socket(0x10, 0x2, 0x4)
io_uring_setup$auto(0x4bf15e08, &(0x7f0000000000)={0x401, 0x8, 0xfe, 0x6fb3, 0x8a, 0x40000009, 0xffffffffffffffff, [0x100, 0x9, 0x7f], {0x6, 0x7, 0x3032, 0xe, 0xf, 0x5, 0x5, 0xfffffff9, 0xf08a2b3}, {0x0, 0xfc, 0x6, 0x1, 0x0, 0xf89, 0x9, 0x7fffffff, 0x8}})
r6 = socket$nl_generic(0x10, 0x3, 0x10)
ioctl$sock_SIOCGIFINDEX(r6, 0x8933, &(0x7f0000000000)={'dummy0\x00'})
syz_open_procfs$namespace(0x0, 0x0)
sendmsg$auto_NFSD_CMD_THREADS_SET(0xffffffffffffffff, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000000140)=ANY=[@ANYBLOB="1f9a81052a570148ea3acf23453bf490b45c8a1e9c681d666620c84499a29282c991", @ANYRESOCT=r4], 0x2c}, 0x1, 0x0, 0x0, 0x4000044}, 0x2404c000)
write$auto(r5, &(0x7f0000000000)='-\x00', 0x2fb)
r7 = openat$auto_kernfs_file_fops_kernfs_internal(0xffffffffffffff9c, 0x0, 0x500, 0x0)
read$auto_kernfs_file_fops_kernfs_internal(r7, &(0x7f0000000080)=""/23, 0x17)
openat$auto_proc_sys_file_operations_proc_sysctl(0xffffffffffffff9c, 0x0, 0x101202, 0x0)
close_range$auto(0x2, 0x8, 0x0)
openat$auto_proc_iter_file_ops_compat_inode(0xffffffffffffff9c, &(0x7f0000000040)='/proc/fs/netfs/cookies\x00', 0x40080, 0x0)
openat$auto_proc_sys_file_operations_proc_sysctl(0xffffffffffffff9c, &(0x7f0000000080)='/proc/sys/kernel/seccomp/actions_logged\x00', 0x8202, 0x0)
executing program 0:
r0 = socket(0xa, 0x2, 0x3a)
setsockopt$auto(r0, 0x29, 0x11, &(0x7f0000000240)='!\x00\xba\xe4\x8a\xf0t\xaf\x82\xd7{\x98\xdd\xee\xc2f\xcaH\x90\xc57M\x87<<\n\xf2L\"Y\xa9\f\n\xbd?\xdd\b\xf7vu:\x00\xeaP\xa7=\xef\xc3\xdc\xf3=J\xf9\x9e\xd9\x02\xbb\xd3\xf8\xff*\xc2\xd8w\xe9\x00\x00\x01\x00h\xe2\x0f\x1b\x95L\xbf\xa5\xacH\"xV#\xc7e\x12\x83\xed\xc7\xc5\x9e\x84?\xfa=\f\xd8\x14\x00\x9fJl\xdd)i\x9f(#\xb7\xff:\x94\x8bd,\xb2\xfc\xde32\x87;\tx\xffM\x1f\x1d\xd8b\xa5\r\xb7v;\xfd\xa14M\xd3\x95\x86\x04\xd4\xda}\xcat}\x18K\x85\x9bBj\x8e\x95\xca\x87\xfe\x125\x154\x83\x94X,\xa4\xf3\xf6\xef\x1a\xb5iX\x99\xa1NO\xc5R\xc9\xc7\xd6\x8d?\x13\x9f\xaf\xf4\xbc\xa3j\xefQ\x7f\xc4\x86\xe8\xc6\xf8\xfe\x115\xd7\x89\x86\xc6T\x14\x00\x13\xb9mf\xc0\xc2%_N\xed\xa9\x02\xe5\x83\xa0\x01O%NHKp\xe0\xb3u\xdc\x8bb\xfa\xabD\x1d\x8a\x1e\xb4C\x05R\xdco\xa5\xce\xc9+\xf8\xf2X#', 0x1fe)
executing program 0:
stat$auto(&(0x7f0000000300)='./cgroup\x00', &(0x7f0000000340)={0x7, 0x8000, 0x6, 0x8001, 0xee00, <r0=>0xee01, 0x0, 0x187, 0x2, 0x8, 0x3, 0x5fd0, 0x7f, 0x6, 0xfff, 0x3, 0x1})
mmap$auto(0x0, 0x20009, 0xdf, 0xeb1, 0x401, 0x8000)
close_range$auto(0x2, 0x8, 0x0)
sendmsg$auto_NL80211_CMD_GET_REG(0xffffffffffffffff, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000200)={0x0, 0x1ac}, 0x1, 0x0, 0x0, 0x4004810}, 0x800)
sendmsg$auto_HSR_C_GET_NODE_STATUS(0xffffffffffffffff, &(0x7f0000000200)={0x0, 0x0, &(0x7f00000001c0)={&(0x7f0000000140)=ANY=[@ANYBLOB='h\x00\x00\x00', @ANYRES16=<r1=>0x0, @ANYBLOB="000226bd7000fedbdf25030000000800030004020000060007000080000008000200", @ANYRES32=0x0, @ANYBLOB="0a00050000000000000000000a00010000000000000000000a0001000000000000000000060007000a00000008000200", @ANYRES32=0x0, @ANYBLOB="080140"], 0x68}}, 0x40090)
sendmsg$auto_NL80211_CMD_STOP_AP(0xffffffffffffffff, &(0x7f0000000d80)={0x0, 0x0, &(0x7f0000000d40)={&(0x7f0000000480)=ANY=[@ANYBLOB="140000008f68084197cad0a602aceff6e434f2a84c1f9a2b686c17575cce6e2cd51220266f0b04fe6d0d6755e40794c7abe48678c462385fa5f6513224e850eeda5ea0674056022442388de7dccbfa2d751c143291176413f704a2f4a993ee64456952edd4e6754a5a15e01f0af0c21460ba", @ANYRES16=0x0, @ANYBLOB="040029bd7000fedbdf2510000000"], 0x14}, 0x1, 0x0, 0x0, 0x4000001}, 0x40)
r2 = syz_genetlink_get_family_id$auto_nfsd(&(0x7f0000001440), 0xffffffffffffffff)
r3 = syz_genetlink_get_family_id$auto_nfc(&(0x7f00000015c0), 0xffffffffffffffff)
sendmsg$auto_NFC_CMD_STOP_POLL(0xffffffffffffffff, &(0x7f0000002680)={0x0, 0x0, &(0x7f0000002640)={&(0x7f0000000580)=ANY=[@ANYBLOB="a65115c4", @ANYRESHEX=r2, @ANYBLOB="20fa28bd7000ff08000000000000", @ANYRESHEX=r0, @ANYRES32=r1, @ANYBLOB="0e8ccd1998719890eacd4d3402f180541c0d46edfd51d271fc33418c4c593e56ad425d740f39db93ceccd1d5080384ccbae93ed6023dbe608b336fb2ab07c317034bb6502024c8ed3c37f4faa9f60e127fdd7dee19f9b9629e0e7e1557ede9db5ae05b584563f1a93b6a219e6180b2169ed686dedb69b3938d03d1811ad83d761ddf44eeb82bec8cf9393ae21418e7db49746d2169a15334ea7eba5e60fe201d46cd32d3ca0a8f7c5c34cef4371cc0e9", @ANYRES8=r1, @ANYRES8=r0, @ANYRES8=0x0], 0x14}, 0x1, 0x0, 0x0, 0x40008d5}, 0x4010)
sendmsg$auto_NFC_CMD_START_POLL(0xffffffffffffffff, &(0x7f0000000400)={&(0x7f0000000440)={0x10, 0x0, 0x0, 0x402}, 0xc, &(0x7f0000000280)={&(0x7f0000000240)=ANY=[@ANYBLOB='<\x00\x00\x00', @ANYRES16=r3, @ANYBLOB="08002bfd7000ffdbdf450600000020000200d65bced5efd32a94b7f5980a2f0965559f617873703100f47c78308008001e0080000000"], 0x3c}, 0x1, 0x0, 0x0, 0x20048895}, 0x40000)
r4 = socket(0x2, 0x3, 0x100)
socket(0x10, 0x2, 0x0)
sendmsg$auto_NL80211_CMD_GET_REG(0xffffffffffffffff, &(0x7f0000000100)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000180)=ANY=[@ANYBLOB="72010000", @ANYBLOB="13"], 0x1ac}, 0x1, 0x0, 0x0, 0x10008001}, 0x4004)
sendmmsg$auto(0x3, &(0x7f0000000080)={{0x0, 0x2, &(0x7f00000002c0)={0x0, 0xc4}, 0x1, 0x0, 0x0, 0x9}, 0x7}, 0x3, 0x0)
r5 = socket$nl_generic(0x10, 0x3, 0x10)
mmap$auto(0x0, 0xe983, 0xdf, 0xeb1, 0x401, 0x8000)
mmap$auto(0x0, 0x9, 0xdf, 0x9b72, 0x2, 0x8000)
io_uring_setup$auto(0x406, 0x0)
mmap$auto(0x0, 0x9, 0xffb, 0x8000000008011, 0x3, 0x0)
getrandom$auto(0x0, 0x6000000, 0x3)
io_uring_enter$auto(r4, 0xa84, 0x80000001, 0xe, 0x0, 0x46)
migrate_pages$auto(0x0, 0x99, 0x0, &(0x7f00000001c0)=0x3fe)
r6 = openat$auto_snd_pcm_oss_f_reg_pcm_oss(0xffffffffffffff9c, &(0x7f0000000100)='/dev/adsp1\x00', 0x40a140, 0x0)
ioctl$auto_SNDCTL_DSP_CHANNELS(r6, 0xc0045006, &(0x7f00000001c0))
getrandom$auto(&(0x7f0000000100)='..\x00k\xac\x8c\x1d\x0e\x98\x80\xd2\xaf\xa1\xf2\x1e\xe1R1\xa2\x8e\xce\xa0\x17\bI3\'\xc5tw\xd7\x1d\xa6\xf4#+\xfa\xd7\x01\xb9j<\v\xf47\n\xa7\xd2\x8b\x11e</\xfd\x9b\xe4\x99G\xeaS\x9a\xadu(:\x94:\xaf\x06c=3>1\xb3\xfdd\x04\xa9 1q\x97\xc4,\xa9^\xc1\xb6\xa1q\x0f\xd1\x013\x87l\xb9\x1e\x05\x90\xa2', 0xd5, 0x1)
move_pages$auto(0x0, 0x1002, 0x0, 0x0, 0x0, 0x2)
openat$auto_seq_oss_f_ops_seq_oss(0xffffffffffffff9c, &(0x7f0000000540)='/dev/sequencer2\x00', 0x0, 0x0)
io_uring_enter$auto(0x3, 0x5, 0xffffffff, 0x3, 0x0, 0x2)
getdents$auto(0xffffffffffffffff, 0x0, 0x100019)
syz_genetlink_get_family_id$auto_nl80211(&(0x7f0000000000), r5)
executing program 4:
openat$auto_snd_pcm_oss_f_reg_pcm_oss(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/dsp1\x00', 0x20b42, 0x0)
read$auto_proc_reg_file_ops_compat_inode(0xffffffffffffffff, &(0x7f0000000280)=""/65, 0x41)
mmap$auto(0x0, 0x4020009, 0x6, 0xeb1, 0x401, 0x8000)
prctl$auto(0x1000000003b, 0x1, 0x4, 0x5, 0x7)
socket$nl_generic(0x10, 0x3, 0x10)
close_range$auto(0x2, 0x8, 0x0)
sendmsg$auto_NETDEV_CMD_DEV_GET(0xffffffffffffffff, &(0x7f0000000080)={&(0x7f0000000140)={0x10, 0x0, 0x0, 0x400000}, 0xc, 0x0, 0x1, 0x0, 0x0, 0x48000}, 0x0)
mmap$auto(0x0, 0x400008, 0xdf, 0x9b72, 0x2, 0x8000)
close_range$auto(0x2, 0x8000, 0x0)
sendmsg$auto_HSR_C_GET_NODE_STATUS(0xffffffffffffffff, &(0x7f0000000200)={0x0, 0x0, &(0x7f00000001c0)={&(0x7f0000000140)={0x68, 0x0, 0x200, 0x70bd26, 0x25dfdbfe, {}, [@HSR_A_IF1_AGE={0x8, 0x3, 0x200}, @HSR_A_IF2_SEQ={0x6, 0x7, 0x4}, @HSR_A_IFINDEX={0x8}, @HSR_A_NODE_ADDR_B={0xa}, @HSR_A_NODE_ADDR={0xa, 0x1, @broadcast}, @HSR_A_NODE_ADDR={0xa}, @HSR_A_IF1_AGE={0x8, 0x3, 0x38}, @HSR_A_IFINDEX={0x8}, @HSR_A_IF2_AGE={0x8, 0x4, 0x4}]}, 0x68}, 0x1, 0x0, 0x0, 0x40080}, 0x40090)
socket(0x2, 0x3, 0x100)
socket(0x10, 0x2, 0x0)
sendmsg$auto_NL80211_CMD_GET_REG(0xffffffffffffffff, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000200)={0x0, 0x1ac}, 0x1, 0x0, 0x0, 0x4004810}, 0x800)
sendmsg$auto_NL80211_CMD_GET_REG(0xffffffffffffffff, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000180)=ANY=[@ANYBLOB="720100", @ANYBLOB="13"], 0x1ac}}, 0x4004)
sendmmsg$auto(0x3, &(0x7f0000000080)={{0x0, 0x2, &(0x7f00000002c0)={0x0, 0xc4}, 0x1, 0x0, 0x0, 0x9}, 0x7}, 0x3, 0x0)
executing program 0:
futex_waitv$auto(&(0x7f0000000180)={0x3fb, 0x6, 0x2, 0xfff}, 0x3, 0xbffffffc, 0x0, 0x81)
r0 = bpf$auto(0x5, &(0x7f00000001c0)=@task_fd_query={0x2, 0x2, 0x4, 0x0, 0x85, 0x4, 0x9, 0x6, 0x8001}, 0x101)
close_range$auto(0x2, 0xa, 0x0)
socket$nl_generic(0x10, 0x3, 0x10)
syz_clone(0x11, 0x0, 0x0, 0x0, 0x0, 0x0)
r1 = openat$auto_blk_mq_debugfs_fops_blk_mq_debugfs(0xffffffffffffff9c, &(0x7f00000000c0)='/sys/kernel/debug/block/mtdblock0/sched/read0_fifo_list\x00', 0x0, 0x0)
read$auto_blk_mq_debugfs_fops_blk_mq_debugfs(r1, &(0x7f0000000040)=""/124, 0x7c)
pipe$auto(&(0x7f0000000000)=<r2=>0xffffffffffffffff)
splice$auto(r2, 0x0, 0x2, 0x0, 0x9, 0x8)
mmap$auto(0x0, 0x7, 0xdf, 0x9b72, 0x2, 0x7ffc)
mmap$auto(0x0, 0x20009, 0x4000000000df, 0xeb1, 0x401, 0x8000)
mremap$auto(0x0, 0x4, 0x4, 0x7, 0x1000)
mmap$auto(0x0, 0x400008, 0xdf, 0x9b72, 0x2, 0x8000)
close_range$auto(0x2, r0, 0x0)
socketpair$auto(0x1e, 0x1, 0x8000000000000000, 0x0)
openat$auto_vhost_vsock_fops_vsock(0xffffffffffffff9c, &(0x7f0000000000), 0x121900, 0x0)
mmap$auto(0x0, 0x20009, 0xdf, 0xeb1, 0x401, 0x8000)
r3 = socket(0x2, 0x1, 0x0)
fcntl$auto(0x3, 0x4, 0xa553)
bind$auto(r2, &(0x7f0000000040)=@llc={0x1a, 0x301, 0x81, 0xe, 0x4, 0x2, @local}, 0x1)
sendmmsg$auto(r3, &(0x7f0000000140)={{&(0x7f0000000040), 0x12, 0x0, 0x101, 0x0, 0x5, 0x9ad}, 0x5}, 0x5, 0x20000000)
r4 = socketpair$auto(0x1, 0x5, 0x8000000000000000, 0x0)
syz_genetlink_get_family_id$auto_batadv(0x0, 0xffffffffffffffff)
mmap$auto(0x7, 0x202000c, 0x5, 0xfb1, r4, 0xa)
semctl$auto(0x9, 0xc1b8, 0x4, 0x1)
mmap$auto(0x7ffffffd, 0x400004, 0x7, 0x9b72, r3, 0x5)
dup2$auto(0xffffffffffffffff, 0xffffffffffffffff)
syz_genetlink_get_family_id$auto_nl80211(0x0, 0xffffffffffffffff)
sendmsg$auto_NL80211_CMD_SET_MULTICAST_TO_UNICAST(0xffffffffffffffff, 0x0, 0x0)
sendmsg$auto_NL80211_CMD_GET_STATION(0xffffffffffffffff, 0x0, 0x40)
executing program 6:
close_range$auto(0x2, 0x1d, 0x0)
r0 = syz_genetlink_get_family_id$auto_nl80211(&(0x7f0000000180), 0xffffffffffffffff)
sendmsg$auto_NL80211_CMD_SET_WIPHY(0xffffffffffffffff, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000080)=ANY=[@ANYBLOB='$\x00\x00\x00', @ANYRES16=r0, @ANYBLOB="011d3da4420008bd7100f9db5f250200000000000010", @ANYRES32], 0x24}, 0x1, 0x0, 0x0, 0x404c0c0}, 0x80)
mmap$auto(0x0, 0x3, 0x4000000200df, 0x40eb2, 0x402, 0x300000000000)
capget$auto(&(0x7f0000000100)={0x5}, &(0x7f0000000140)={0x7ff, 0xc, 0x800})
close_range$auto(0x2, 0xa, 0x0)
socket(0x10, 0x2, 0x4)
openat$auto_safesetid_uid_file_fops_securityfs(0xffffffffffffff9c, &(0x7f0000000080), 0x1, 0x0)
writev$auto(0x3, &(0x7f0000000100)={0x0, 0x7111}, 0x8)
r1 = socket(0x10, 0x2, 0x0)
sendmmsg$auto(r1, &(0x7f0000000200)={{0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000080), 0xfc2}, 0x2, &(0x7f00000001c0), 0x7, 0xa505}, 0x800}, 0x7, 0x4008)
socket(0x3, 0x800, 0x9)
r2 = openat$auto_kernfs_file_fops_kernfs_internal(0xffffffffffffff9c, &(0x7f0000000080)='/sys/module/apparmor/parameters/path_max\x00', 0x80, 0x0)
r3 = socket(0x1e, 0x4, 0x0)
setsockopt$auto(r3, 0x10f, 0x86, 0x0, 0x0)
read$auto_kernfs_file_fops_kernfs_internal(r2, &(0x7f00000000c0)=""/17, 0x11)
open(&(0x7f0000000000)='./file0\x00', 0x261c2, 0x84)
r4 = open(&(0x7f0000000080)='./file0\x00', 0xeee00, 0x31)
mmap$auto(0x3, 0x2020009, 0x7fffffff, 0xeb1, 0xfffffffffffffffa, 0x8000)
r5 = openat$auto_kernfs_file_fops_kernfs_internal(0xffffffffffffff9c, &(0x7f0000000040)='/sys/devices/virtual/block/ram6/queue/minimum_io_size\x00', 0x0, 0x0)
read$auto_kernfs_file_fops_kernfs_internal(r5, &(0x7f0000001540)=""/104, 0x68)
mmap$auto(0x0, 0x400008, 0xdf, 0x9b72, 0x2, 0x8000)
getcwd$auto(0x0, 0xffffffffffffffff)
rename$auto(0x0, &(0x7f0000000300)='v#\xd5\xaf>=\x14\xe6%\xf7\x8a\x8d\x9a\xae\x1a\xd6\xa8\xb8\x1d\xf5(\xb0\x1f\xbd\xcbV\n\"\xe3V\xfeP\xceN\xb2\xc32\xaf\xcc\x80\xfa\xf0\xd4\xd9|\xfe\x03y\xd16\x17\x99R\xca\xe5\xf4\xb4T\xfcv\xfc\xe6\x9cv\a\x00\xc2a\x16\xd1\x8a\x80\x90\x87\xa5s\x10\xed\x93\xd4\x15=\xc0\x1f\x0e\xb0\x18v}\x03!\xf0I\xe3}\x90\x9b\x92[\xfe2<7\xd3\x81\x9a~\xcd\r\x19\x9e\x10(5\xfd\x8b\x82\xd4\xc85\xc3\x93t\t\xd0\x9d\xca^n\xf3\xcb>\x1bO\xcej\xe0\xef\xf2\xd7\xc2}\x18\xd9`AO\x95<\x9aH\vu\xae\xd4\xea\x12\xb8\xd1\n\x01\x83r\x85\xbf*\x18\xa7 S:R\x14\x89Z3\x94\x8bP)')
write$auto(0x3, 0x0, 0x100082)
lseek$auto(r4, 0xc, 0x4)
executing program 6:
mmap$auto(0x0, 0x4020009, 0x8000000080000000, 0x17, 0x401, 0x8000)
madvise$auto(0x0, 0xffffffffffff0005, 0x17)
openat$auto_clear_warn_once_fops_(0xffffffffffffff9c, &(0x7f0000000100), 0x210800, 0x0)
r0 = openat$auto_tty_fops_tty_io(0xffffffffffffff9c, &(0x7f0000000000)='/dev/tty46\x00', 0x0, 0x0)
close_range$auto(0x2, 0x8, 0x0)
socket(0x10, 0x2, 0x0)
socket(0x2, 0x6, 0x0)
mmap$auto(0x0, 0x400005, 0xdf, 0x9b72, 0x2, 0x8000)
socket(0xa, 0x5, 0x84)
bind$auto(0x3, 0x0, 0x6a)
ioctl$auto(0x3, 0x800005411, 0x38)
ioctl$auto(r0, 0x5600, 0x0)
mmap$auto(0x6, 0x400005, 0xffffffffffffff00, 0x9b72, r0, 0x8000)
close_range$auto(0x2, 0x8, 0x0)
socketpair$auto(0x1, 0x2, 0x8000000000000000, 0x0)
r1 = openat$auto_force_devcoredump_fops_hci_vhci(0xffffffffffffff9c, &(0x7f0000000c40)='/sys/kernel/debug/bluetooth/hci0/force_devcoredump\x00', 0x2, 0x0)
write$auto(r1, 0x0, 0xe)
mremap$auto(0x0, 0xffffffffffffffff, 0x3fd6, 0x3, 0x7fffffffb000)
mmap$auto(0x0, 0x400005, 0x800000000000df, 0x9b72, 0x2, 0x8000)
madvise$auto(0x0, 0xffffffffffff0001, 0x15)
r2 = openat$auto_proc_clear_refs_operations_internal(0xffffffffffffff9c, &(0x7f0000000600)='/proc/thread-self/clear_refs\x00', 0x2, 0x0)
mmap$auto(0x0, 0x8, 0xdf, 0x9b72, 0x2, 0x8000)
setitimer$auto(0x4, &(0x7f0000000000)={{0x1ff, 0x10001}, {0x200000000004, 0x6}}, 0x0)
openat$nci(0xffffffffffffff9c, &(0x7f0000000000), 0x2, 0x0)
bpf$auto(0x12, &(0x7f0000000000)=@info={0x2800, 0x1ff, 0x2}, 0xcf)
r3 = socket(0x10, 0x2, 0x0)
sendmsg$auto_NL80211_CMD_GET_REG(r3, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000300)=ANY=[@ANYBLOB=' \x00\x00\x00', @ANYBLOB="1200", @ANYBLOB=']'], 0x1ac}}, 0x40000)
recvmmsg$auto(r3, &(0x7f0000000380)={{0x0, 0x1, &(0x7f0000000000)={0x0, 0x400}, 0x4, 0x0, 0x200002, 0x8}, 0x803}, 0xfffffff9, 0x10010, 0x0)
write$auto_proc_clear_refs_operations_internal(r2, 0x0, 0xffffff4b)
socket(0xa, 0x3, 0x3a)

program crashed: KASAN: slab-use-after-free Read in force_devcd_write
bisect: the chunk can be dropped
bisect: testing without sub-chunk 2/2
bisect: no need to test this chunk, it's definitely needed
bisect: split chunks (needed=true): <7>
bisect: split chunk #0 of len 7 into 2 parts
bisect: testing without sub-chunk 1/2
testing program (duration=6m1s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): [15, 30, 26, 30]
detailed listing:
executing program 4:
openat$auto_snd_pcm_oss_f_reg_pcm_oss(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/dsp1\x00', 0x20b42, 0x0)
read$auto_proc_reg_file_ops_compat_inode(0xffffffffffffffff, &(0x7f0000000280)=""/65, 0x41)
mmap$auto(0x0, 0x4020009, 0x6, 0xeb1, 0x401, 0x8000)
prctl$auto(0x1000000003b, 0x1, 0x4, 0x5, 0x7)
socket$nl_generic(0x10, 0x3, 0x10)
close_range$auto(0x2, 0x8, 0x0)
sendmsg$auto_NETDEV_CMD_DEV_GET(0xffffffffffffffff, &(0x7f0000000080)={&(0x7f0000000140)={0x10, 0x0, 0x0, 0x400000}, 0xc, 0x0, 0x1, 0x0, 0x0, 0x48000}, 0x0)
mmap$auto(0x0, 0x400008, 0xdf, 0x9b72, 0x2, 0x8000)
close_range$auto(0x2, 0x8000, 0x0)
sendmsg$auto_HSR_C_GET_NODE_STATUS(0xffffffffffffffff, &(0x7f0000000200)={0x0, 0x0, &(0x7f00000001c0)={&(0x7f0000000140)={0x68, 0x0, 0x200, 0x70bd26, 0x25dfdbfe, {}, [@HSR_A_IF1_AGE={0x8, 0x3, 0x200}, @HSR_A_IF2_SEQ={0x6, 0x7, 0x4}, @HSR_A_IFINDEX={0x8}, @HSR_A_NODE_ADDR_B={0xa}, @HSR_A_NODE_ADDR={0xa, 0x1, @broadcast}, @HSR_A_NODE_ADDR={0xa}, @HSR_A_IF1_AGE={0x8, 0x3, 0x38}, @HSR_A_IFINDEX={0x8}, @HSR_A_IF2_AGE={0x8, 0x4, 0x4}]}, 0x68}, 0x1, 0x0, 0x0, 0x40080}, 0x40090)
socket(0x2, 0x3, 0x100)
socket(0x10, 0x2, 0x0)
sendmsg$auto_NL80211_CMD_GET_REG(0xffffffffffffffff, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000200)={0x0, 0x1ac}, 0x1, 0x0, 0x0, 0x4004810}, 0x800)
sendmsg$auto_NL80211_CMD_GET_REG(0xffffffffffffffff, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000180)=ANY=[@ANYBLOB="720100", @ANYBLOB="13"], 0x1ac}}, 0x4004)
sendmmsg$auto(0x3, &(0x7f0000000080)={{0x0, 0x2, &(0x7f00000002c0)={0x0, 0xc4}, 0x1, 0x0, 0x0, 0x9}, 0x7}, 0x3, 0x0)
executing program 0:
futex_waitv$auto(&(0x7f0000000180)={0x3fb, 0x6, 0x2, 0xfff}, 0x3, 0xbffffffc, 0x0, 0x81)
r0 = bpf$auto(0x5, &(0x7f00000001c0)=@task_fd_query={0x2, 0x2, 0x4, 0x0, 0x85, 0x4, 0x9, 0x6, 0x8001}, 0x101)
close_range$auto(0x2, 0xa, 0x0)
socket$nl_generic(0x10, 0x3, 0x10)
syz_clone(0x11, 0x0, 0x0, 0x0, 0x0, 0x0)
r1 = openat$auto_blk_mq_debugfs_fops_blk_mq_debugfs(0xffffffffffffff9c, &(0x7f00000000c0)='/sys/kernel/debug/block/mtdblock0/sched/read0_fifo_list\x00', 0x0, 0x0)
read$auto_blk_mq_debugfs_fops_blk_mq_debugfs(r1, &(0x7f0000000040)=""/124, 0x7c)
pipe$auto(&(0x7f0000000000)=<r2=>0xffffffffffffffff)
splice$auto(r2, 0x0, 0x2, 0x0, 0x9, 0x8)
mmap$auto(0x0, 0x7, 0xdf, 0x9b72, 0x2, 0x7ffc)
mmap$auto(0x0, 0x20009, 0x4000000000df, 0xeb1, 0x401, 0x8000)
mremap$auto(0x0, 0x4, 0x4, 0x7, 0x1000)
mmap$auto(0x0, 0x400008, 0xdf, 0x9b72, 0x2, 0x8000)
close_range$auto(0x2, r0, 0x0)
socketpair$auto(0x1e, 0x1, 0x8000000000000000, 0x0)
openat$auto_vhost_vsock_fops_vsock(0xffffffffffffff9c, &(0x7f0000000000), 0x121900, 0x0)
mmap$auto(0x0, 0x20009, 0xdf, 0xeb1, 0x401, 0x8000)
r3 = socket(0x2, 0x1, 0x0)
fcntl$auto(0x3, 0x4, 0xa553)
bind$auto(r2, &(0x7f0000000040)=@llc={0x1a, 0x301, 0x81, 0xe, 0x4, 0x2, @local}, 0x1)
sendmmsg$auto(r3, &(0x7f0000000140)={{&(0x7f0000000040), 0x12, 0x0, 0x101, 0x0, 0x5, 0x9ad}, 0x5}, 0x5, 0x20000000)
r4 = socketpair$auto(0x1, 0x5, 0x8000000000000000, 0x0)
syz_genetlink_get_family_id$auto_batadv(0x0, 0xffffffffffffffff)
mmap$auto(0x7, 0x202000c, 0x5, 0xfb1, r4, 0xa)
semctl$auto(0x9, 0xc1b8, 0x4, 0x1)
mmap$auto(0x7ffffffd, 0x400004, 0x7, 0x9b72, r3, 0x5)
dup2$auto(0xffffffffffffffff, 0xffffffffffffffff)
syz_genetlink_get_family_id$auto_nl80211(0x0, 0xffffffffffffffff)
sendmsg$auto_NL80211_CMD_SET_MULTICAST_TO_UNICAST(0xffffffffffffffff, 0x0, 0x0)
sendmsg$auto_NL80211_CMD_GET_STATION(0xffffffffffffffff, 0x0, 0x40)
executing program 6:
close_range$auto(0x2, 0x1d, 0x0)
r0 = syz_genetlink_get_family_id$auto_nl80211(&(0x7f0000000180), 0xffffffffffffffff)
sendmsg$auto_NL80211_CMD_SET_WIPHY(0xffffffffffffffff, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000080)=ANY=[@ANYBLOB='$\x00\x00\x00', @ANYRES16=r0, @ANYBLOB="011d3da4420008bd7100f9db5f250200000000000010", @ANYRES32], 0x24}, 0x1, 0x0, 0x0, 0x404c0c0}, 0x80)
mmap$auto(0x0, 0x3, 0x4000000200df, 0x40eb2, 0x402, 0x300000000000)
capget$auto(&(0x7f0000000100)={0x5}, &(0x7f0000000140)={0x7ff, 0xc, 0x800})
close_range$auto(0x2, 0xa, 0x0)
socket(0x10, 0x2, 0x4)
openat$auto_safesetid_uid_file_fops_securityfs(0xffffffffffffff9c, &(0x7f0000000080), 0x1, 0x0)
writev$auto(0x3, &(0x7f0000000100)={0x0, 0x7111}, 0x8)
r1 = socket(0x10, 0x2, 0x0)
sendmmsg$auto(r1, &(0x7f0000000200)={{0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000080), 0xfc2}, 0x2, &(0x7f00000001c0), 0x7, 0xa505}, 0x800}, 0x7, 0x4008)
socket(0x3, 0x800, 0x9)
r2 = openat$auto_kernfs_file_fops_kernfs_internal(0xffffffffffffff9c, &(0x7f0000000080)='/sys/module/apparmor/parameters/path_max\x00', 0x80, 0x0)
r3 = socket(0x1e, 0x4, 0x0)
setsockopt$auto(r3, 0x10f, 0x86, 0x0, 0x0)
read$auto_kernfs_file_fops_kernfs_internal(r2, &(0x7f00000000c0)=""/17, 0x11)
open(&(0x7f0000000000)='./file0\x00', 0x261c2, 0x84)
r4 = open(&(0x7f0000000080)='./file0\x00', 0xeee00, 0x31)
mmap$auto(0x3, 0x2020009, 0x7fffffff, 0xeb1, 0xfffffffffffffffa, 0x8000)
r5 = openat$auto_kernfs_file_fops_kernfs_internal(0xffffffffffffff9c, &(0x7f0000000040)='/sys/devices/virtual/block/ram6/queue/minimum_io_size\x00', 0x0, 0x0)
read$auto_kernfs_file_fops_kernfs_internal(r5, &(0x7f0000001540)=""/104, 0x68)
mmap$auto(0x0, 0x400008, 0xdf, 0x9b72, 0x2, 0x8000)
getcwd$auto(0x0, 0xffffffffffffffff)
rename$auto(0x0, &(0x7f0000000300)='v#\xd5\xaf>=\x14\xe6%\xf7\x8a\x8d\x9a\xae\x1a\xd6\xa8\xb8\x1d\xf5(\xb0\x1f\xbd\xcbV\n\"\xe3V\xfeP\xceN\xb2\xc32\xaf\xcc\x80\xfa\xf0\xd4\xd9|\xfe\x03y\xd16\x17\x99R\xca\xe5\xf4\xb4T\xfcv\xfc\xe6\x9cv\a\x00\xc2a\x16\xd1\x8a\x80\x90\x87\xa5s\x10\xed\x93\xd4\x15=\xc0\x1f\x0e\xb0\x18v}\x03!\xf0I\xe3}\x90\x9b\x92[\xfe2<7\xd3\x81\x9a~\xcd\r\x19\x9e\x10(5\xfd\x8b\x82\xd4\xc85\xc3\x93t\t\xd0\x9d\xca^n\xf3\xcb>\x1bO\xcej\xe0\xef\xf2\xd7\xc2}\x18\xd9`AO\x95<\x9aH\vu\xae\xd4\xea\x12\xb8\xd1\n\x01\x83r\x85\xbf*\x18\xa7 S:R\x14\x89Z3\x94\x8bP)')
write$auto(0x3, 0x0, 0x100082)
lseek$auto(r4, 0xc, 0x4)
executing program 6:
mmap$auto(0x0, 0x4020009, 0x8000000080000000, 0x17, 0x401, 0x8000)
madvise$auto(0x0, 0xffffffffffff0005, 0x17)
openat$auto_clear_warn_once_fops_(0xffffffffffffff9c, &(0x7f0000000100), 0x210800, 0x0)
r0 = openat$auto_tty_fops_tty_io(0xffffffffffffff9c, &(0x7f0000000000)='/dev/tty46\x00', 0x0, 0x0)
close_range$auto(0x2, 0x8, 0x0)
socket(0x10, 0x2, 0x0)
socket(0x2, 0x6, 0x0)
mmap$auto(0x0, 0x400005, 0xdf, 0x9b72, 0x2, 0x8000)
socket(0xa, 0x5, 0x84)
bind$auto(0x3, 0x0, 0x6a)
ioctl$auto(0x3, 0x800005411, 0x38)
ioctl$auto(r0, 0x5600, 0x0)
mmap$auto(0x6, 0x400005, 0xffffffffffffff00, 0x9b72, r0, 0x8000)
close_range$auto(0x2, 0x8, 0x0)
socketpair$auto(0x1, 0x2, 0x8000000000000000, 0x0)
r1 = openat$auto_force_devcoredump_fops_hci_vhci(0xffffffffffffff9c, &(0x7f0000000c40)='/sys/kernel/debug/bluetooth/hci0/force_devcoredump\x00', 0x2, 0x0)
write$auto(r1, 0x0, 0xe)
mremap$auto(0x0, 0xffffffffffffffff, 0x3fd6, 0x3, 0x7fffffffb000)
mmap$auto(0x0, 0x400005, 0x800000000000df, 0x9b72, 0x2, 0x8000)
madvise$auto(0x0, 0xffffffffffff0001, 0x15)
r2 = openat$auto_proc_clear_refs_operations_internal(0xffffffffffffff9c, &(0x7f0000000600)='/proc/thread-self/clear_refs\x00', 0x2, 0x0)
mmap$auto(0x0, 0x8, 0xdf, 0x9b72, 0x2, 0x8000)
setitimer$auto(0x4, &(0x7f0000000000)={{0x1ff, 0x10001}, {0x200000000004, 0x6}}, 0x0)
openat$nci(0xffffffffffffff9c, &(0x7f0000000000), 0x2, 0x0)
bpf$auto(0x12, &(0x7f0000000000)=@info={0x2800, 0x1ff, 0x2}, 0xcf)
r3 = socket(0x10, 0x2, 0x0)
sendmsg$auto_NL80211_CMD_GET_REG(r3, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000300)=ANY=[@ANYBLOB=' \x00\x00\x00', @ANYBLOB="1200", @ANYBLOB=']'], 0x1ac}}, 0x40000)
recvmmsg$auto(r3, &(0x7f0000000380)={{0x0, 0x1, &(0x7f0000000000)={0x0, 0x400}, 0x4, 0x0, 0x200002, 0x8}, 0x803}, 0xfffffff9, 0x10010, 0x0)
write$auto_proc_clear_refs_operations_internal(r2, 0x0, 0xffffff4b)
socket(0xa, 0x3, 0x3a)

program crashed: KASAN: slab-use-after-free Read in force_devcd_write
bisect: the chunk can be dropped
bisect: testing without sub-chunk 2/2
bisect: no need to test this chunk, it's definitely needed
bisect: split chunks (needed=true): <3>
bisect: split chunk #0 of len 3 into 2 parts
bisect: testing without sub-chunk 1/2
testing program (duration=6m0s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): [26, 30]
detailed listing:
executing program 6:
close_range$auto(0x2, 0x1d, 0x0)
r0 = syz_genetlink_get_family_id$auto_nl80211(&(0x7f0000000180), 0xffffffffffffffff)
sendmsg$auto_NL80211_CMD_SET_WIPHY(0xffffffffffffffff, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000080)=ANY=[@ANYBLOB='$\x00\x00\x00', @ANYRES16=r0, @ANYBLOB="011d3da4420008bd7100f9db5f250200000000000010", @ANYRES32], 0x24}, 0x1, 0x0, 0x0, 0x404c0c0}, 0x80)
mmap$auto(0x0, 0x3, 0x4000000200df, 0x40eb2, 0x402, 0x300000000000)
capget$auto(&(0x7f0000000100)={0x5}, &(0x7f0000000140)={0x7ff, 0xc, 0x800})
close_range$auto(0x2, 0xa, 0x0)
socket(0x10, 0x2, 0x4)
openat$auto_safesetid_uid_file_fops_securityfs(0xffffffffffffff9c, &(0x7f0000000080), 0x1, 0x0)
writev$auto(0x3, &(0x7f0000000100)={0x0, 0x7111}, 0x8)
r1 = socket(0x10, 0x2, 0x0)
sendmmsg$auto(r1, &(0x7f0000000200)={{0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000080), 0xfc2}, 0x2, &(0x7f00000001c0), 0x7, 0xa505}, 0x800}, 0x7, 0x4008)
socket(0x3, 0x800, 0x9)
r2 = openat$auto_kernfs_file_fops_kernfs_internal(0xffffffffffffff9c, &(0x7f0000000080)='/sys/module/apparmor/parameters/path_max\x00', 0x80, 0x0)
r3 = socket(0x1e, 0x4, 0x0)
setsockopt$auto(r3, 0x10f, 0x86, 0x0, 0x0)
read$auto_kernfs_file_fops_kernfs_internal(r2, &(0x7f00000000c0)=""/17, 0x11)
open(&(0x7f0000000000)='./file0\x00', 0x261c2, 0x84)
r4 = open(&(0x7f0000000080)='./file0\x00', 0xeee00, 0x31)
mmap$auto(0x3, 0x2020009, 0x7fffffff, 0xeb1, 0xfffffffffffffffa, 0x8000)
r5 = openat$auto_kernfs_file_fops_kernfs_internal(0xffffffffffffff9c, &(0x7f0000000040)='/sys/devices/virtual/block/ram6/queue/minimum_io_size\x00', 0x0, 0x0)
read$auto_kernfs_file_fops_kernfs_internal(r5, &(0x7f0000001540)=""/104, 0x68)
mmap$auto(0x0, 0x400008, 0xdf, 0x9b72, 0x2, 0x8000)
getcwd$auto(0x0, 0xffffffffffffffff)
rename$auto(0x0, &(0x7f0000000300)='v#\xd5\xaf>=\x14\xe6%\xf7\x8a\x8d\x9a\xae\x1a\xd6\xa8\xb8\x1d\xf5(\xb0\x1f\xbd\xcbV\n\"\xe3V\xfeP\xceN\xb2\xc32\xaf\xcc\x80\xfa\xf0\xd4\xd9|\xfe\x03y\xd16\x17\x99R\xca\xe5\xf4\xb4T\xfcv\xfc\xe6\x9cv\a\x00\xc2a\x16\xd1\x8a\x80\x90\x87\xa5s\x10\xed\x93\xd4\x15=\xc0\x1f\x0e\xb0\x18v}\x03!\xf0I\xe3}\x90\x9b\x92[\xfe2<7\xd3\x81\x9a~\xcd\r\x19\x9e\x10(5\xfd\x8b\x82\xd4\xc85\xc3\x93t\t\xd0\x9d\xca^n\xf3\xcb>\x1bO\xcej\xe0\xef\xf2\xd7\xc2}\x18\xd9`AO\x95<\x9aH\vu\xae\xd4\xea\x12\xb8\xd1\n\x01\x83r\x85\xbf*\x18\xa7 S:R\x14\x89Z3\x94\x8bP)')
write$auto(0x3, 0x0, 0x100082)
lseek$auto(r4, 0xc, 0x4)
executing program 6:
mmap$auto(0x0, 0x4020009, 0x8000000080000000, 0x17, 0x401, 0x8000)
madvise$auto(0x0, 0xffffffffffff0005, 0x17)
openat$auto_clear_warn_once_fops_(0xffffffffffffff9c, &(0x7f0000000100), 0x210800, 0x0)
r0 = openat$auto_tty_fops_tty_io(0xffffffffffffff9c, &(0x7f0000000000)='/dev/tty46\x00', 0x0, 0x0)
close_range$auto(0x2, 0x8, 0x0)
socket(0x10, 0x2, 0x0)
socket(0x2, 0x6, 0x0)
mmap$auto(0x0, 0x400005, 0xdf, 0x9b72, 0x2, 0x8000)
socket(0xa, 0x5, 0x84)
bind$auto(0x3, 0x0, 0x6a)
ioctl$auto(0x3, 0x800005411, 0x38)
ioctl$auto(r0, 0x5600, 0x0)
mmap$auto(0x6, 0x400005, 0xffffffffffffff00, 0x9b72, r0, 0x8000)
close_range$auto(0x2, 0x8, 0x0)
socketpair$auto(0x1, 0x2, 0x8000000000000000, 0x0)
r1 = openat$auto_force_devcoredump_fops_hci_vhci(0xffffffffffffff9c, &(0x7f0000000c40)='/sys/kernel/debug/bluetooth/hci0/force_devcoredump\x00', 0x2, 0x0)
write$auto(r1, 0x0, 0xe)
mremap$auto(0x0, 0xffffffffffffffff, 0x3fd6, 0x3, 0x7fffffffb000)
mmap$auto(0x0, 0x400005, 0x800000000000df, 0x9b72, 0x2, 0x8000)
madvise$auto(0x0, 0xffffffffffff0001, 0x15)
r2 = openat$auto_proc_clear_refs_operations_internal(0xffffffffffffff9c, &(0x7f0000000600)='/proc/thread-self/clear_refs\x00', 0x2, 0x0)
mmap$auto(0x0, 0x8, 0xdf, 0x9b72, 0x2, 0x8000)
setitimer$auto(0x4, &(0x7f0000000000)={{0x1ff, 0x10001}, {0x200000000004, 0x6}}, 0x0)
openat$nci(0xffffffffffffff9c, &(0x7f0000000000), 0x2, 0x0)
bpf$auto(0x12, &(0x7f0000000000)=@info={0x2800, 0x1ff, 0x2}, 0xcf)
r3 = socket(0x10, 0x2, 0x0)
sendmsg$auto_NL80211_CMD_GET_REG(r3, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000300)=ANY=[@ANYBLOB=' \x00\x00\x00', @ANYBLOB="1200", @ANYBLOB=']'], 0x1ac}}, 0x40000)
recvmmsg$auto(r3, &(0x7f0000000380)={{0x0, 0x1, &(0x7f0000000000)={0x0, 0x400}, 0x4, 0x0, 0x200002, 0x8}, 0x803}, 0xfffffff9, 0x10010, 0x0)
write$auto_proc_clear_refs_operations_internal(r2, 0x0, 0xffffff4b)
socket(0xa, 0x3, 0x3a)

program crashed: KASAN: slab-use-after-free Read in force_devcd_write
bisect: the chunk can be dropped
bisect: testing without sub-chunk 2/2
bisect: no need to test this chunk, it's definitely needed
bisect: split chunks (needed=true): <1>
bisect: split chunk #0 of len 1 into 2 parts
bisect: no way to further split the chunk
bisect: 2 programs left: 

executing program 6:
close_range$auto(0x2, 0x1d, 0x0)
r0 = syz_genetlink_get_family_id$auto_nl80211(&(0x7f0000000180), 0xffffffffffffffff)
sendmsg$auto_NL80211_CMD_SET_WIPHY(0xffffffffffffffff, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000080)=ANY=[@ANYBLOB='$\x00\x00\x00', @ANYRES16=r0, @ANYBLOB="011d3da4420008bd7100f9db5f250200000000000010", @ANYRES32], 0x24}, 0x1, 0x0, 0x0, 0x404c0c0}, 0x80)
mmap$auto(0x0, 0x3, 0x4000000200df, 0x40eb2, 0x402, 0x300000000000)
capget$auto(&(0x7f0000000100)={0x5}, &(0x7f0000000140)={0x7ff, 0xc, 0x800})
close_range$auto(0x2, 0xa, 0x0)
socket(0x10, 0x2, 0x4)
openat$auto_safesetid_uid_file_fops_securityfs(0xffffffffffffff9c, &(0x7f0000000080), 0x1, 0x0)
writev$auto(0x3, &(0x7f0000000100)={0x0, 0x7111}, 0x8)
r1 = socket(0x10, 0x2, 0x0)
sendmmsg$auto(r1, &(0x7f0000000200)={{0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000080), 0xfc2}, 0x2, &(0x7f00000001c0), 0x7, 0xa505}, 0x800}, 0x7, 0x4008)
socket(0x3, 0x800, 0x9)
r2 = openat$auto_kernfs_file_fops_kernfs_internal(0xffffffffffffff9c, &(0x7f0000000080)='/sys/module/apparmor/parameters/path_max\x00', 0x80, 0x0)
r3 = socket(0x1e, 0x4, 0x0)
setsockopt$auto(r3, 0x10f, 0x86, 0x0, 0x0)
read$auto_kernfs_file_fops_kernfs_internal(r2, &(0x7f00000000c0)=""/17, 0x11)
open(&(0x7f0000000000)='./file0\x00', 0x261c2, 0x84)
r4 = open(&(0x7f0000000080)='./file0\x00', 0xeee00, 0x31)
mmap$auto(0x3, 0x2020009, 0x7fffffff, 0xeb1, 0xfffffffffffffffa, 0x8000)
r5 = openat$auto_kernfs_file_fops_kernfs_internal(0xffffffffffffff9c, &(0x7f0000000040)='/sys/devices/virtual/block/ram6/queue/minimum_io_size\x00', 0x0, 0x0)
read$auto_kernfs_file_fops_kernfs_internal(r5, &(0x7f0000001540)=""/104, 0x68)
mmap$auto(0x0, 0x400008, 0xdf, 0x9b72, 0x2, 0x8000)
getcwd$auto(0x0, 0xffffffffffffffff)
rename$auto(0x0, &(0x7f0000000300)='v#\xd5\xaf>=\x14\xe6%\xf7\x8a\x8d\x9a\xae\x1a\xd6\xa8\xb8\x1d\xf5(\xb0\x1f\xbd\xcbV\n\"\xe3V\xfeP\xceN\xb2\xc32\xaf\xcc\x80\xfa\xf0\xd4\xd9|\xfe\x03y\xd16\x17\x99R\xca\xe5\xf4\xb4T\xfcv\xfc\xe6\x9cv\a\x00\xc2a\x16\xd1\x8a\x80\x90\x87\xa5s\x10\xed\x93\xd4\x15=\xc0\x1f\x0e\xb0\x18v}\x03!\xf0I\xe3}\x90\x9b\x92[\xfe2<7\xd3\x81\x9a~\xcd\r\x19\x9e\x10(5\xfd\x8b\x82\xd4\xc85\xc3\x93t\t\xd0\x9d\xca^n\xf3\xcb>\x1bO\xcej\xe0\xef\xf2\xd7\xc2}\x18\xd9`AO\x95<\x9aH\vu\xae\xd4\xea\x12\xb8\xd1\n\x01\x83r\x85\xbf*\x18\xa7 S:R\x14\x89Z3\x94\x8bP)')
write$auto(0x3, 0x0, 0x100082)
lseek$auto(r4, 0xc, 0x4)
executing program 6:
mmap$auto(0x0, 0x4020009, 0x8000000080000000, 0x17, 0x401, 0x8000)
madvise$auto(0x0, 0xffffffffffff0005, 0x17)
openat$auto_clear_warn_once_fops_(0xffffffffffffff9c, &(0x7f0000000100), 0x210800, 0x0)
r0 = openat$auto_tty_fops_tty_io(0xffffffffffffff9c, &(0x7f0000000000)='/dev/tty46\x00', 0x0, 0x0)
close_range$auto(0x2, 0x8, 0x0)
socket(0x10, 0x2, 0x0)
socket(0x2, 0x6, 0x0)
mmap$auto(0x0, 0x400005, 0xdf, 0x9b72, 0x2, 0x8000)
socket(0xa, 0x5, 0x84)
bind$auto(0x3, 0x0, 0x6a)
ioctl$auto(0x3, 0x800005411, 0x38)
ioctl$auto(r0, 0x5600, 0x0)
mmap$auto(0x6, 0x400005, 0xffffffffffffff00, 0x9b72, r0, 0x8000)
close_range$auto(0x2, 0x8, 0x0)
socketpair$auto(0x1, 0x2, 0x8000000000000000, 0x0)
r1 = openat$auto_force_devcoredump_fops_hci_vhci(0xffffffffffffff9c, &(0x7f0000000c40)='/sys/kernel/debug/bluetooth/hci0/force_devcoredump\x00', 0x2, 0x0)
write$auto(r1, 0x0, 0xe)
mremap$auto(0x0, 0xffffffffffffffff, 0x3fd6, 0x3, 0x7fffffffb000)
mmap$auto(0x0, 0x400005, 0x800000000000df, 0x9b72, 0x2, 0x8000)
madvise$auto(0x0, 0xffffffffffff0001, 0x15)
r2 = openat$auto_proc_clear_refs_operations_internal(0xffffffffffffff9c, &(0x7f0000000600)='/proc/thread-self/clear_refs\x00', 0x2, 0x0)
mmap$auto(0x0, 0x8, 0xdf, 0x9b72, 0x2, 0x8000)
setitimer$auto(0x4, &(0x7f0000000000)={{0x1ff, 0x10001}, {0x200000000004, 0x6}}, 0x0)
openat$nci(0xffffffffffffff9c, &(0x7f0000000000), 0x2, 0x0)
bpf$auto(0x12, &(0x7f0000000000)=@info={0x2800, 0x1ff, 0x2}, 0xcf)
r3 = socket(0x10, 0x2, 0x0)
sendmsg$auto_NL80211_CMD_GET_REG(r3, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000300)=ANY=[@ANYBLOB=' \x00\x00\x00', @ANYBLOB="1200", @ANYBLOB=']'], 0x1ac}}, 0x40000)
recvmmsg$auto(r3, &(0x7f0000000380)={{0x0, 0x1, &(0x7f0000000000)={0x0, 0x400}, 0x4, 0x0, 0x200002, 0x8}, 0x803}, 0xfffffff9, 0x10010, 0x0)
write$auto_proc_clear_refs_operations_internal(r2, 0x0, 0xffffff4b)
socket(0xa, 0x3, 0x3a)


bisect: trying to concatenate
bisect: concatenate 2 entries
minimizing program #0 before concatenation
testing program (duration=9m0s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): [25, 30]
detailed listing:
executing program 0:
close_range$auto(0x2, 0x1d, 0x0)
r0 = syz_genetlink_get_family_id$auto_nl80211(&(0x7f0000000180), 0xffffffffffffffff)
sendmsg$auto_NL80211_CMD_SET_WIPHY(0xffffffffffffffff, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000080)=ANY=[@ANYBLOB='$\x00\x00\x00', @ANYRES16=r0, @ANYBLOB="011d3da4420008bd7100f9db5f250200000000000010", @ANYRES32], 0x24}, 0x1, 0x0, 0x0, 0x404c0c0}, 0x80)
mmap$auto(0x0, 0x3, 0x4000000200df, 0x40eb2, 0x402, 0x300000000000)
capget$auto(&(0x7f0000000100)={0x5}, &(0x7f0000000140)={0x7ff, 0xc, 0x800})
close_range$auto(0x2, 0xa, 0x0)
socket(0x10, 0x2, 0x4)
openat$auto_safesetid_uid_file_fops_securityfs(0xffffffffffffff9c, &(0x7f0000000080), 0x1, 0x0)
writev$auto(0x3, &(0x7f0000000100)={0x0, 0x7111}, 0x8)
r1 = socket(0x10, 0x2, 0x0)
sendmmsg$auto(r1, &(0x7f0000000200)={{0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000080), 0xfc2}, 0x2, &(0x7f00000001c0), 0x7, 0xa505}, 0x800}, 0x7, 0x4008)
socket(0x3, 0x800, 0x9)
r2 = openat$auto_kernfs_file_fops_kernfs_internal(0xffffffffffffff9c, &(0x7f0000000080)='/sys/module/apparmor/parameters/path_max\x00', 0x80, 0x0)
r3 = socket(0x1e, 0x4, 0x0)
setsockopt$auto(r3, 0x10f, 0x86, 0x0, 0x0)
read$auto_kernfs_file_fops_kernfs_internal(r2, &(0x7f00000000c0)=""/17, 0x11)
open(&(0x7f0000000000)='./file0\x00', 0x261c2, 0x84)
open(&(0x7f0000000080)='./file0\x00', 0xeee00, 0x31)
mmap$auto(0x3, 0x2020009, 0x7fffffff, 0xeb1, 0xfffffffffffffffa, 0x8000)
r4 = openat$auto_kernfs_file_fops_kernfs_internal(0xffffffffffffff9c, &(0x7f0000000040)='/sys/devices/virtual/block/ram6/queue/minimum_io_size\x00', 0x0, 0x0)
read$auto_kernfs_file_fops_kernfs_internal(r4, &(0x7f0000001540)=""/104, 0x68)
mmap$auto(0x0, 0x400008, 0xdf, 0x9b72, 0x2, 0x8000)
getcwd$auto(0x0, 0xffffffffffffffff)
rename$auto(0x0, &(0x7f0000000300)='v#\xd5\xaf>=\x14\xe6%\xf7\x8a\x8d\x9a\xae\x1a\xd6\xa8\xb8\x1d\xf5(\xb0\x1f\xbd\xcbV\n\"\xe3V\xfeP\xceN\xb2\xc32\xaf\xcc\x80\xfa\xf0\xd4\xd9|\xfe\x03y\xd16\x17\x99R\xca\xe5\xf4\xb4T\xfcv\xfc\xe6\x9cv\a\x00\xc2a\x16\xd1\x8a\x80\x90\x87\xa5s\x10\xed\x93\xd4\x15=\xc0\x1f\x0e\xb0\x18v}\x03!\xf0I\xe3}\x90\x9b\x92[\xfe2<7\xd3\x81\x9a~\xcd\r\x19\x9e\x10(5\xfd\x8b\x82\xd4\xc85\xc3\x93t\t\xd0\x9d\xca^n\xf3\xcb>\x1bO\xcej\xe0\xef\xf2\xd7\xc2}\x18\xd9`AO\x95<\x9aH\vu\xae\xd4\xea\x12\xb8\xd1\n\x01\x83r\x85\xbf*\x18\xa7 S:R\x14\x89Z3\x94\x8bP)')
write$auto(0x3, 0x0, 0x100082)
executing program 6:
mmap$auto(0x0, 0x4020009, 0x8000000080000000, 0x17, 0x401, 0x8000)
madvise$auto(0x0, 0xffffffffffff0005, 0x17)
openat$auto_clear_warn_once_fops_(0xffffffffffffff9c, &(0x7f0000000100), 0x210800, 0x0)
r0 = openat$auto_tty_fops_tty_io(0xffffffffffffff9c, &(0x7f0000000000)='/dev/tty46\x00', 0x0, 0x0)
close_range$auto(0x2, 0x8, 0x0)
socket(0x10, 0x2, 0x0)
socket(0x2, 0x6, 0x0)
mmap$auto(0x0, 0x400005, 0xdf, 0x9b72, 0x2, 0x8000)
socket(0xa, 0x5, 0x84)
bind$auto(0x3, 0x0, 0x6a)
ioctl$auto(0x3, 0x800005411, 0x38)
ioctl$auto(r0, 0x5600, 0x0)
mmap$auto(0x6, 0x400005, 0xffffffffffffff00, 0x9b72, r0, 0x8000)
close_range$auto(0x2, 0x8, 0x0)
socketpair$auto(0x1, 0x2, 0x8000000000000000, 0x0)
r1 = openat$auto_force_devcoredump_fops_hci_vhci(0xffffffffffffff9c, &(0x7f0000000c40)='/sys/kernel/debug/bluetooth/hci0/force_devcoredump\x00', 0x2, 0x0)
write$auto(r1, 0x0, 0xe)
mremap$auto(0x0, 0xffffffffffffffff, 0x3fd6, 0x3, 0x7fffffffb000)
mmap$auto(0x0, 0x400005, 0x800000000000df, 0x9b72, 0x2, 0x8000)
madvise$auto(0x0, 0xffffffffffff0001, 0x15)
r2 = openat$auto_proc_clear_refs_operations_internal(0xffffffffffffff9c, &(0x7f0000000600)='/proc/thread-self/clear_refs\x00', 0x2, 0x0)
mmap$auto(0x0, 0x8, 0xdf, 0x9b72, 0x2, 0x8000)
setitimer$auto(0x4, &(0x7f0000000000)={{0x1ff, 0x10001}, {0x200000000004, 0x6}}, 0x0)
openat$nci(0xffffffffffffff9c, &(0x7f0000000000), 0x2, 0x0)
bpf$auto(0x12, &(0x7f0000000000)=@info={0x2800, 0x1ff, 0x2}, 0xcf)
r3 = socket(0x10, 0x2, 0x0)
sendmsg$auto_NL80211_CMD_GET_REG(r3, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000300)=ANY=[@ANYBLOB=' \x00\x00\x00', @ANYBLOB="1200", @ANYBLOB=']'], 0x1ac}}, 0x40000)
recvmmsg$auto(r3, &(0x7f0000000380)={{0x0, 0x1, &(0x7f0000000000)={0x0, 0x400}, 0x4, 0x0, 0x200002, 0x8}, 0x803}, 0xfffffff9, 0x10010, 0x0)
write$auto_proc_clear_refs_operations_internal(r2, 0x0, 0xffffff4b)
socket(0xa, 0x3, 0x3a)

program crashed: KASAN: slab-use-after-free Read in force_devcd_write
testing program (duration=9m0s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): [24, 30]
detailed listing:
executing program 0:
close_range$auto(0x2, 0x1d, 0x0)
r0 = syz_genetlink_get_family_id$auto_nl80211(&(0x7f0000000180), 0xffffffffffffffff)
sendmsg$auto_NL80211_CMD_SET_WIPHY(0xffffffffffffffff, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000080)=ANY=[@ANYBLOB='$\x00\x00\x00', @ANYRES16=r0, @ANYBLOB="011d3da4420008bd7100f9db5f250200000000000010", @ANYRES32], 0x24}, 0x1, 0x0, 0x0, 0x404c0c0}, 0x80)
mmap$auto(0x0, 0x3, 0x4000000200df, 0x40eb2, 0x402, 0x300000000000)
capget$auto(&(0x7f0000000100)={0x5}, &(0x7f0000000140)={0x7ff, 0xc, 0x800})
close_range$auto(0x2, 0xa, 0x0)
socket(0x10, 0x2, 0x4)
openat$auto_safesetid_uid_file_fops_securityfs(0xffffffffffffff9c, &(0x7f0000000080), 0x1, 0x0)
writev$auto(0x3, &(0x7f0000000100)={0x0, 0x7111}, 0x8)
r1 = socket(0x10, 0x2, 0x0)
sendmmsg$auto(r1, &(0x7f0000000200)={{0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000080), 0xfc2}, 0x2, &(0x7f00000001c0), 0x7, 0xa505}, 0x800}, 0x7, 0x4008)
socket(0x3, 0x800, 0x9)
r2 = openat$auto_kernfs_file_fops_kernfs_internal(0xffffffffffffff9c, &(0x7f0000000080)='/sys/module/apparmor/parameters/path_max\x00', 0x80, 0x0)
r3 = socket(0x1e, 0x4, 0x0)
setsockopt$auto(r3, 0x10f, 0x86, 0x0, 0x0)
read$auto_kernfs_file_fops_kernfs_internal(r2, &(0x7f00000000c0)=""/17, 0x11)
open(&(0x7f0000000000)='./file0\x00', 0x261c2, 0x84)
open(&(0x7f0000000080)='./file0\x00', 0xeee00, 0x31)
mmap$auto(0x3, 0x2020009, 0x7fffffff, 0xeb1, 0xfffffffffffffffa, 0x8000)
r4 = openat$auto_kernfs_file_fops_kernfs_internal(0xffffffffffffff9c, &(0x7f0000000040)='/sys/devices/virtual/block/ram6/queue/minimum_io_size\x00', 0x0, 0x0)
read$auto_kernfs_file_fops_kernfs_internal(r4, &(0x7f0000001540)=""/104, 0x68)
mmap$auto(0x0, 0x400008, 0xdf, 0x9b72, 0x2, 0x8000)
getcwd$auto(0x0, 0xffffffffffffffff)
rename$auto(0x0, &(0x7f0000000300)='v#\xd5\xaf>=\x14\xe6%\xf7\x8a\x8d\x9a\xae\x1a\xd6\xa8\xb8\x1d\xf5(\xb0\x1f\xbd\xcbV\n\"\xe3V\xfeP\xceN\xb2\xc32\xaf\xcc\x80\xfa\xf0\xd4\xd9|\xfe\x03y\xd16\x17\x99R\xca\xe5\xf4\xb4T\xfcv\xfc\xe6\x9cv\a\x00\xc2a\x16\xd1\x8a\x80\x90\x87\xa5s\x10\xed\x93\xd4\x15=\xc0\x1f\x0e\xb0\x18v}\x03!\xf0I\xe3}\x90\x9b\x92[\xfe2<7\xd3\x81\x9a~\xcd\r\x19\x9e\x10(5\xfd\x8b\x82\xd4\xc85\xc3\x93t\t\xd0\x9d\xca^n\xf3\xcb>\x1bO\xcej\xe0\xef\xf2\xd7\xc2}\x18\xd9`AO\x95<\x9aH\vu\xae\xd4\xea\x12\xb8\xd1\n\x01\x83r\x85\xbf*\x18\xa7 S:R\x14\x89Z3\x94\x8bP)')
executing program 6:
mmap$auto(0x0, 0x4020009, 0x8000000080000000, 0x17, 0x401, 0x8000)
madvise$auto(0x0, 0xffffffffffff0005, 0x17)
openat$auto_clear_warn_once_fops_(0xffffffffffffff9c, &(0x7f0000000100), 0x210800, 0x0)
r0 = openat$auto_tty_fops_tty_io(0xffffffffffffff9c, &(0x7f0000000000)='/dev/tty46\x00', 0x0, 0x0)
close_range$auto(0x2, 0x8, 0x0)
socket(0x10, 0x2, 0x0)
socket(0x2, 0x6, 0x0)
mmap$auto(0x0, 0x400005, 0xdf, 0x9b72, 0x2, 0x8000)
socket(0xa, 0x5, 0x84)
bind$auto(0x3, 0x0, 0x6a)
ioctl$auto(0x3, 0x800005411, 0x38)
ioctl$auto(r0, 0x5600, 0x0)
mmap$auto(0x6, 0x400005, 0xffffffffffffff00, 0x9b72, r0, 0x8000)
close_range$auto(0x2, 0x8, 0x0)
socketpair$auto(0x1, 0x2, 0x8000000000000000, 0x0)
r1 = openat$auto_force_devcoredump_fops_hci_vhci(0xffffffffffffff9c, &(0x7f0000000c40)='/sys/kernel/debug/bluetooth/hci0/force_devcoredump\x00', 0x2, 0x0)
write$auto(r1, 0x0, 0xe)
mremap$auto(0x0, 0xffffffffffffffff, 0x3fd6, 0x3, 0x7fffffffb000)
mmap$auto(0x0, 0x400005, 0x800000000000df, 0x9b72, 0x2, 0x8000)
madvise$auto(0x0, 0xffffffffffff0001, 0x15)
r2 = openat$auto_proc_clear_refs_operations_internal(0xffffffffffffff9c, &(0x7f0000000600)='/proc/thread-self/clear_refs\x00', 0x2, 0x0)
mmap$auto(0x0, 0x8, 0xdf, 0x9b72, 0x2, 0x8000)
setitimer$auto(0x4, &(0x7f0000000000)={{0x1ff, 0x10001}, {0x200000000004, 0x6}}, 0x0)
openat$nci(0xffffffffffffff9c, &(0x7f0000000000), 0x2, 0x0)
bpf$auto(0x12, &(0x7f0000000000)=@info={0x2800, 0x1ff, 0x2}, 0xcf)
r3 = socket(0x10, 0x2, 0x0)
sendmsg$auto_NL80211_CMD_GET_REG(r3, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000300)=ANY=[@ANYBLOB=' \x00\x00\x00', @ANYBLOB="1200", @ANYBLOB=']'], 0x1ac}}, 0x40000)
recvmmsg$auto(r3, &(0x7f0000000380)={{0x0, 0x1, &(0x7f0000000000)={0x0, 0x400}, 0x4, 0x0, 0x200002, 0x8}, 0x803}, 0xfffffff9, 0x10010, 0x0)
write$auto_proc_clear_refs_operations_internal(r2, 0x0, 0xffffff4b)
socket(0xa, 0x3, 0x3a)

program crashed: KASAN: slab-use-after-free Read in force_devcd_write
testing program (duration=9m0s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): [23, 30]
detailed listing:
executing program 0:
close_range$auto(0x2, 0x1d, 0x0)
r0 = syz_genetlink_get_family_id$auto_nl80211(&(0x7f0000000180), 0xffffffffffffffff)
sendmsg$auto_NL80211_CMD_SET_WIPHY(0xffffffffffffffff, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000080)=ANY=[@ANYBLOB='$\x00\x00\x00', @ANYRES16=r0, @ANYBLOB="011d3da4420008bd7100f9db5f250200000000000010", @ANYRES32], 0x24}, 0x1, 0x0, 0x0, 0x404c0c0}, 0x80)
mmap$auto(0x0, 0x3, 0x4000000200df, 0x40eb2, 0x402, 0x300000000000)
capget$auto(&(0x7f0000000100)={0x5}, &(0x7f0000000140)={0x7ff, 0xc, 0x800})
close_range$auto(0x2, 0xa, 0x0)
socket(0x10, 0x2, 0x4)
openat$auto_safesetid_uid_file_fops_securityfs(0xffffffffffffff9c, &(0x7f0000000080), 0x1, 0x0)
writev$auto(0x3, &(0x7f0000000100)={0x0, 0x7111}, 0x8)
r1 = socket(0x10, 0x2, 0x0)
sendmmsg$auto(r1, &(0x7f0000000200)={{0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000080), 0xfc2}, 0x2, &(0x7f00000001c0), 0x7, 0xa505}, 0x800}, 0x7, 0x4008)
socket(0x3, 0x800, 0x9)
r2 = openat$auto_kernfs_file_fops_kernfs_internal(0xffffffffffffff9c, &(0x7f0000000080)='/sys/module/apparmor/parameters/path_max\x00', 0x80, 0x0)
r3 = socket(0x1e, 0x4, 0x0)
setsockopt$auto(r3, 0x10f, 0x86, 0x0, 0x0)
read$auto_kernfs_file_fops_kernfs_internal(r2, &(0x7f00000000c0)=""/17, 0x11)
open(&(0x7f0000000000)='./file0\x00', 0x261c2, 0x84)
open(&(0x7f0000000080)='./file0\x00', 0xeee00, 0x31)
mmap$auto(0x3, 0x2020009, 0x7fffffff, 0xeb1, 0xfffffffffffffffa, 0x8000)
r4 = openat$auto_kernfs_file_fops_kernfs_internal(0xffffffffffffff9c, &(0x7f0000000040)='/sys/devices/virtual/block/ram6/queue/minimum_io_size\x00', 0x0, 0x0)
read$auto_kernfs_file_fops_kernfs_internal(r4, &(0x7f0000001540)=""/104, 0x68)
mmap$auto(0x0, 0x400008, 0xdf, 0x9b72, 0x2, 0x8000)
getcwd$auto(0x0, 0xffffffffffffffff)
executing program 6:
mmap$auto(0x0, 0x4020009, 0x8000000080000000, 0x17, 0x401, 0x8000)
madvise$auto(0x0, 0xffffffffffff0005, 0x17)
openat$auto_clear_warn_once_fops_(0xffffffffffffff9c, &(0x7f0000000100), 0x210800, 0x0)
r0 = openat$auto_tty_fops_tty_io(0xffffffffffffff9c, &(0x7f0000000000)='/dev/tty46\x00', 0x0, 0x0)
close_range$auto(0x2, 0x8, 0x0)
socket(0x10, 0x2, 0x0)
socket(0x2, 0x6, 0x0)
mmap$auto(0x0, 0x400005, 0xdf, 0x9b72, 0x2, 0x8000)
socket(0xa, 0x5, 0x84)
bind$auto(0x3, 0x0, 0x6a)
ioctl$auto(0x3, 0x800005411, 0x38)
ioctl$auto(r0, 0x5600, 0x0)
mmap$auto(0x6, 0x400005, 0xffffffffffffff00, 0x9b72, r0, 0x8000)
close_range$auto(0x2, 0x8, 0x0)
socketpair$auto(0x1, 0x2, 0x8000000000000000, 0x0)
r1 = openat$auto_force_devcoredump_fops_hci_vhci(0xffffffffffffff9c, &(0x7f0000000c40)='/sys/kernel/debug/bluetooth/hci0/force_devcoredump\x00', 0x2, 0x0)
write$auto(r1, 0x0, 0xe)
mremap$auto(0x0, 0xffffffffffffffff, 0x3fd6, 0x3, 0x7fffffffb000)
mmap$auto(0x0, 0x400005, 0x800000000000df, 0x9b72, 0x2, 0x8000)
madvise$auto(0x0, 0xffffffffffff0001, 0x15)
r2 = openat$auto_proc_clear_refs_operations_internal(0xffffffffffffff9c, &(0x7f0000000600)='/proc/thread-self/clear_refs\x00', 0x2, 0x0)
mmap$auto(0x0, 0x8, 0xdf, 0x9b72, 0x2, 0x8000)
setitimer$auto(0x4, &(0x7f0000000000)={{0x1ff, 0x10001}, {0x200000000004, 0x6}}, 0x0)
openat$nci(0xffffffffffffff9c, &(0x7f0000000000), 0x2, 0x0)
bpf$auto(0x12, &(0x7f0000000000)=@info={0x2800, 0x1ff, 0x2}, 0xcf)
r3 = socket(0x10, 0x2, 0x0)
sendmsg$auto_NL80211_CMD_GET_REG(r3, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000300)=ANY=[@ANYBLOB=' \x00\x00\x00', @ANYBLOB="1200", @ANYBLOB=']'], 0x1ac}}, 0x40000)
recvmmsg$auto(r3, &(0x7f0000000380)={{0x0, 0x1, &(0x7f0000000000)={0x0, 0x400}, 0x4, 0x0, 0x200002, 0x8}, 0x803}, 0xfffffff9, 0x10010, 0x0)
write$auto_proc_clear_refs_operations_internal(r2, 0x0, 0xffffff4b)
socket(0xa, 0x3, 0x3a)

program crashed: KASAN: slab-use-after-free Read in force_devcd_write
testing program (duration=9m0s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): [22, 30]
detailed listing:
executing program 0:
close_range$auto(0x2, 0x1d, 0x0)
r0 = syz_genetlink_get_family_id$auto_nl80211(&(0x7f0000000180), 0xffffffffffffffff)
sendmsg$auto_NL80211_CMD_SET_WIPHY(0xffffffffffffffff, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000080)=ANY=[@ANYBLOB='$\x00\x00\x00', @ANYRES16=r0, @ANYBLOB="011d3da4420008bd7100f9db5f250200000000000010", @ANYRES32], 0x24}, 0x1, 0x0, 0x0, 0x404c0c0}, 0x80)
mmap$auto(0x0, 0x3, 0x4000000200df, 0x40eb2, 0x402, 0x300000000000)
capget$auto(&(0x7f0000000100)={0x5}, &(0x7f0000000140)={0x7ff, 0xc, 0x800})
close_range$auto(0x2, 0xa, 0x0)
socket(0x10, 0x2, 0x4)
openat$auto_safesetid_uid_file_fops_securityfs(0xffffffffffffff9c, &(0x7f0000000080), 0x1, 0x0)
writev$auto(0x3, &(0x7f0000000100)={0x0, 0x7111}, 0x8)
r1 = socket(0x10, 0x2, 0x0)
sendmmsg$auto(r1, &(0x7f0000000200)={{0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000080), 0xfc2}, 0x2, &(0x7f00000001c0), 0x7, 0xa505}, 0x800}, 0x7, 0x4008)
socket(0x3, 0x800, 0x9)
r2 = openat$auto_kernfs_file_fops_kernfs_internal(0xffffffffffffff9c, &(0x7f0000000080)='/sys/module/apparmor/parameters/path_max\x00', 0x80, 0x0)
r3 = socket(0x1e, 0x4, 0x0)
setsockopt$auto(r3, 0x10f, 0x86, 0x0, 0x0)
read$auto_kernfs_file_fops_kernfs_internal(r2, &(0x7f00000000c0)=""/17, 0x11)
open(&(0x7f0000000000)='./file0\x00', 0x261c2, 0x84)
open(&(0x7f0000000080)='./file0\x00', 0xeee00, 0x31)
mmap$auto(0x3, 0x2020009, 0x7fffffff, 0xeb1, 0xfffffffffffffffa, 0x8000)
r4 = openat$auto_kernfs_file_fops_kernfs_internal(0xffffffffffffff9c, &(0x7f0000000040)='/sys/devices/virtual/block/ram6/queue/minimum_io_size\x00', 0x0, 0x0)
read$auto_kernfs_file_fops_kernfs_internal(r4, &(0x7f0000001540)=""/104, 0x68)
mmap$auto(0x0, 0x400008, 0xdf, 0x9b72, 0x2, 0x8000)
executing program 6:
mmap$auto(0x0, 0x4020009, 0x8000000080000000, 0x17, 0x401, 0x8000)
madvise$auto(0x0, 0xffffffffffff0005, 0x17)
openat$auto_clear_warn_once_fops_(0xffffffffffffff9c, &(0x7f0000000100), 0x210800, 0x0)
r0 = openat$auto_tty_fops_tty_io(0xffffffffffffff9c, &(0x7f0000000000)='/dev/tty46\x00', 0x0, 0x0)
close_range$auto(0x2, 0x8, 0x0)
socket(0x10, 0x2, 0x0)
socket(0x2, 0x6, 0x0)
mmap$auto(0x0, 0x400005, 0xdf, 0x9b72, 0x2, 0x8000)
socket(0xa, 0x5, 0x84)
bind$auto(0x3, 0x0, 0x6a)
ioctl$auto(0x3, 0x800005411, 0x38)
ioctl$auto(r0, 0x5600, 0x0)
mmap$auto(0x6, 0x400005, 0xffffffffffffff00, 0x9b72, r0, 0x8000)
close_range$auto(0x2, 0x8, 0x0)
socketpair$auto(0x1, 0x2, 0x8000000000000000, 0x0)
r1 = openat$auto_force_devcoredump_fops_hci_vhci(0xffffffffffffff9c, &(0x7f0000000c40)='/sys/kernel/debug/bluetooth/hci0/force_devcoredump\x00', 0x2, 0x0)
write$auto(r1, 0x0, 0xe)
mremap$auto(0x0, 0xffffffffffffffff, 0x3fd6, 0x3, 0x7fffffffb000)
mmap$auto(0x0, 0x400005, 0x800000000000df, 0x9b72, 0x2, 0x8000)
madvise$auto(0x0, 0xffffffffffff0001, 0x15)
r2 = openat$auto_proc_clear_refs_operations_internal(0xffffffffffffff9c, &(0x7f0000000600)='/proc/thread-self/clear_refs\x00', 0x2, 0x0)
mmap$auto(0x0, 0x8, 0xdf, 0x9b72, 0x2, 0x8000)
setitimer$auto(0x4, &(0x7f0000000000)={{0x1ff, 0x10001}, {0x200000000004, 0x6}}, 0x0)
openat$nci(0xffffffffffffff9c, &(0x7f0000000000), 0x2, 0x0)
bpf$auto(0x12, &(0x7f0000000000)=@info={0x2800, 0x1ff, 0x2}, 0xcf)
r3 = socket(0x10, 0x2, 0x0)
sendmsg$auto_NL80211_CMD_GET_REG(r3, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000300)=ANY=[@ANYBLOB=' \x00\x00\x00', @ANYBLOB="1200", @ANYBLOB=']'], 0x1ac}}, 0x40000)
recvmmsg$auto(r3, &(0x7f0000000380)={{0x0, 0x1, &(0x7f0000000000)={0x0, 0x400}, 0x4, 0x0, 0x200002, 0x8}, 0x803}, 0xfffffff9, 0x10010, 0x0)
write$auto_proc_clear_refs_operations_internal(r2, 0x0, 0xffffff4b)
socket(0xa, 0x3, 0x3a)

program crashed: KASAN: slab-use-after-free Read in force_devcd_write
testing program (duration=9m0s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): [21, 30]
detailed listing:
executing program 0:
close_range$auto(0x2, 0x1d, 0x0)
r0 = syz_genetlink_get_family_id$auto_nl80211(&(0x7f0000000180), 0xffffffffffffffff)
sendmsg$auto_NL80211_CMD_SET_WIPHY(0xffffffffffffffff, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000080)=ANY=[@ANYBLOB='$\x00\x00\x00', @ANYRES16=r0, @ANYBLOB="011d3da4420008bd7100f9db5f250200000000000010", @ANYRES32], 0x24}, 0x1, 0x0, 0x0, 0x404c0c0}, 0x80)
mmap$auto(0x0, 0x3, 0x4000000200df, 0x40eb2, 0x402, 0x300000000000)
capget$auto(&(0x7f0000000100)={0x5}, &(0x7f0000000140)={0x7ff, 0xc, 0x800})
close_range$auto(0x2, 0xa, 0x0)
socket(0x10, 0x2, 0x4)
openat$auto_safesetid_uid_file_fops_securityfs(0xffffffffffffff9c, &(0x7f0000000080), 0x1, 0x0)
writev$auto(0x3, &(0x7f0000000100)={0x0, 0x7111}, 0x8)
r1 = socket(0x10, 0x2, 0x0)
sendmmsg$auto(r1, &(0x7f0000000200)={{0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000080), 0xfc2}, 0x2, &(0x7f00000001c0), 0x7, 0xa505}, 0x800}, 0x7, 0x4008)
socket(0x3, 0x800, 0x9)
r2 = openat$auto_kernfs_file_fops_kernfs_internal(0xffffffffffffff9c, &(0x7f0000000080)='/sys/module/apparmor/parameters/path_max\x00', 0x80, 0x0)
r3 = socket(0x1e, 0x4, 0x0)
setsockopt$auto(r3, 0x10f, 0x86, 0x0, 0x0)
read$auto_kernfs_file_fops_kernfs_internal(r2, &(0x7f00000000c0)=""/17, 0x11)
open(&(0x7f0000000000)='./file0\x00', 0x261c2, 0x84)
open(&(0x7f0000000080)='./file0\x00', 0xeee00, 0x31)
mmap$auto(0x3, 0x2020009, 0x7fffffff, 0xeb1, 0xfffffffffffffffa, 0x8000)
r4 = openat$auto_kernfs_file_fops_kernfs_internal(0xffffffffffffff9c, &(0x7f0000000040)='/sys/devices/virtual/block/ram6/queue/minimum_io_size\x00', 0x0, 0x0)
read$auto_kernfs_file_fops_kernfs_internal(r4, &(0x7f0000001540)=""/104, 0x68)
executing program 6:
mmap$auto(0x0, 0x4020009, 0x8000000080000000, 0x17, 0x401, 0x8000)
madvise$auto(0x0, 0xffffffffffff0005, 0x17)
openat$auto_clear_warn_once_fops_(0xffffffffffffff9c, &(0x7f0000000100), 0x210800, 0x0)
r0 = openat$auto_tty_fops_tty_io(0xffffffffffffff9c, &(0x7f0000000000)='/dev/tty46\x00', 0x0, 0x0)
close_range$auto(0x2, 0x8, 0x0)
socket(0x10, 0x2, 0x0)
socket(0x2, 0x6, 0x0)
mmap$auto(0x0, 0x400005, 0xdf, 0x9b72, 0x2, 0x8000)
socket(0xa, 0x5, 0x84)
bind$auto(0x3, 0x0, 0x6a)
ioctl$auto(0x3, 0x800005411, 0x38)
ioctl$auto(r0, 0x5600, 0x0)
mmap$auto(0x6, 0x400005, 0xffffffffffffff00, 0x9b72, r0, 0x8000)
close_range$auto(0x2, 0x8, 0x0)
socketpair$auto(0x1, 0x2, 0x8000000000000000, 0x0)
r1 = openat$auto_force_devcoredump_fops_hci_vhci(0xffffffffffffff9c, &(0x7f0000000c40)='/sys/kernel/debug/bluetooth/hci0/force_devcoredump\x00', 0x2, 0x0)
write$auto(r1, 0x0, 0xe)
mremap$auto(0x0, 0xffffffffffffffff, 0x3fd6, 0x3, 0x7fffffffb000)
mmap$auto(0x0, 0x400005, 0x800000000000df, 0x9b72, 0x2, 0x8000)
madvise$auto(0x0, 0xffffffffffff0001, 0x15)
r2 = openat$auto_proc_clear_refs_operations_internal(0xffffffffffffff9c, &(0x7f0000000600)='/proc/thread-self/clear_refs\x00', 0x2, 0x0)
mmap$auto(0x0, 0x8, 0xdf, 0x9b72, 0x2, 0x8000)
setitimer$auto(0x4, &(0x7f0000000000)={{0x1ff, 0x10001}, {0x200000000004, 0x6}}, 0x0)
openat$nci(0xffffffffffffff9c, &(0x7f0000000000), 0x2, 0x0)
bpf$auto(0x12, &(0x7f0000000000)=@info={0x2800, 0x1ff, 0x2}, 0xcf)
r3 = socket(0x10, 0x2, 0x0)
sendmsg$auto_NL80211_CMD_GET_REG(r3, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000300)=ANY=[@ANYBLOB=' \x00\x00\x00', @ANYBLOB="1200", @ANYBLOB=']'], 0x1ac}}, 0x40000)
recvmmsg$auto(r3, &(0x7f0000000380)={{0x0, 0x1, &(0x7f0000000000)={0x0, 0x400}, 0x4, 0x0, 0x200002, 0x8}, 0x803}, 0xfffffff9, 0x10010, 0x0)
write$auto_proc_clear_refs_operations_internal(r2, 0x0, 0xffffff4b)
socket(0xa, 0x3, 0x3a)

program crashed: KASAN: slab-use-after-free Read in force_devcd_write
testing program (duration=9m0s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): [20, 30]
detailed listing:
executing program 0:
close_range$auto(0x2, 0x1d, 0x0)
r0 = syz_genetlink_get_family_id$auto_nl80211(&(0x7f0000000180), 0xffffffffffffffff)
sendmsg$auto_NL80211_CMD_SET_WIPHY(0xffffffffffffffff, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000080)=ANY=[@ANYBLOB='$\x00\x00\x00', @ANYRES16=r0, @ANYBLOB="011d3da4420008bd7100f9db5f250200000000000010", @ANYRES32], 0x24}, 0x1, 0x0, 0x0, 0x404c0c0}, 0x80)
mmap$auto(0x0, 0x3, 0x4000000200df, 0x40eb2, 0x402, 0x300000000000)
capget$auto(&(0x7f0000000100)={0x5}, &(0x7f0000000140)={0x7ff, 0xc, 0x800})
close_range$auto(0x2, 0xa, 0x0)
socket(0x10, 0x2, 0x4)
openat$auto_safesetid_uid_file_fops_securityfs(0xffffffffffffff9c, &(0x7f0000000080), 0x1, 0x0)
writev$auto(0x3, &(0x7f0000000100)={0x0, 0x7111}, 0x8)
r1 = socket(0x10, 0x2, 0x0)
sendmmsg$auto(r1, &(0x7f0000000200)={{0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000080), 0xfc2}, 0x2, &(0x7f00000001c0), 0x7, 0xa505}, 0x800}, 0x7, 0x4008)
socket(0x3, 0x800, 0x9)
r2 = openat$auto_kernfs_file_fops_kernfs_internal(0xffffffffffffff9c, &(0x7f0000000080)='/sys/module/apparmor/parameters/path_max\x00', 0x80, 0x0)
r3 = socket(0x1e, 0x4, 0x0)
setsockopt$auto(r3, 0x10f, 0x86, 0x0, 0x0)
read$auto_kernfs_file_fops_kernfs_internal(r2, &(0x7f00000000c0)=""/17, 0x11)
open(&(0x7f0000000000)='./file0\x00', 0x261c2, 0x84)
open(&(0x7f0000000080)='./file0\x00', 0xeee00, 0x31)
mmap$auto(0x3, 0x2020009, 0x7fffffff, 0xeb1, 0xfffffffffffffffa, 0x8000)
openat$auto_kernfs_file_fops_kernfs_internal(0xffffffffffffff9c, &(0x7f0000000040)='/sys/devices/virtual/block/ram6/queue/minimum_io_size\x00', 0x0, 0x0)
executing program 6:
mmap$auto(0x0, 0x4020009, 0x8000000080000000, 0x17, 0x401, 0x8000)
madvise$auto(0x0, 0xffffffffffff0005, 0x17)
openat$auto_clear_warn_once_fops_(0xffffffffffffff9c, &(0x7f0000000100), 0x210800, 0x0)
r0 = openat$auto_tty_fops_tty_io(0xffffffffffffff9c, &(0x7f0000000000)='/dev/tty46\x00', 0x0, 0x0)
close_range$auto(0x2, 0x8, 0x0)
socket(0x10, 0x2, 0x0)
socket(0x2, 0x6, 0x0)
mmap$auto(0x0, 0x400005, 0xdf, 0x9b72, 0x2, 0x8000)
socket(0xa, 0x5, 0x84)
bind$auto(0x3, 0x0, 0x6a)
ioctl$auto(0x3, 0x800005411, 0x38)
ioctl$auto(r0, 0x5600, 0x0)
mmap$auto(0x6, 0x400005, 0xffffffffffffff00, 0x9b72, r0, 0x8000)
close_range$auto(0x2, 0x8, 0x0)
socketpair$auto(0x1, 0x2, 0x8000000000000000, 0x0)
r1 = openat$auto_force_devcoredump_fops_hci_vhci(0xffffffffffffff9c, &(0x7f0000000c40)='/sys/kernel/debug/bluetooth/hci0/force_devcoredump\x00', 0x2, 0x0)
write$auto(r1, 0x0, 0xe)
mremap$auto(0x0, 0xffffffffffffffff, 0x3fd6, 0x3, 0x7fffffffb000)
mmap$auto(0x0, 0x400005, 0x800000000000df, 0x9b72, 0x2, 0x8000)
madvise$auto(0x0, 0xffffffffffff0001, 0x15)
r2 = openat$auto_proc_clear_refs_operations_internal(0xffffffffffffff9c, &(0x7f0000000600)='/proc/thread-self/clear_refs\x00', 0x2, 0x0)
mmap$auto(0x0, 0x8, 0xdf, 0x9b72, 0x2, 0x8000)
setitimer$auto(0x4, &(0x7f0000000000)={{0x1ff, 0x10001}, {0x200000000004, 0x6}}, 0x0)
openat$nci(0xffffffffffffff9c, &(0x7f0000000000), 0x2, 0x0)
bpf$auto(0x12, &(0x7f0000000000)=@info={0x2800, 0x1ff, 0x2}, 0xcf)
r3 = socket(0x10, 0x2, 0x0)
sendmsg$auto_NL80211_CMD_GET_REG(r3, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000300)=ANY=[@ANYBLOB=' \x00\x00\x00', @ANYBLOB="1200", @ANYBLOB=']'], 0x1ac}}, 0x40000)
recvmmsg$auto(r3, &(0x7f0000000380)={{0x0, 0x1, &(0x7f0000000000)={0x0, 0x400}, 0x4, 0x0, 0x200002, 0x8}, 0x803}, 0xfffffff9, 0x10010, 0x0)
write$auto_proc_clear_refs_operations_internal(r2, 0x0, 0xffffff4b)
socket(0xa, 0x3, 0x3a)

program crashed: KASAN: slab-use-after-free Read in force_devcd_write
testing program (duration=9m0s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): [19, 30]
detailed listing:
executing program 0:
close_range$auto(0x2, 0x1d, 0x0)
r0 = syz_genetlink_get_family_id$auto_nl80211(&(0x7f0000000180), 0xffffffffffffffff)
sendmsg$auto_NL80211_CMD_SET_WIPHY(0xffffffffffffffff, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000080)=ANY=[@ANYBLOB='$\x00\x00\x00', @ANYRES16=r0, @ANYBLOB="011d3da4420008bd7100f9db5f250200000000000010", @ANYRES32], 0x24}, 0x1, 0x0, 0x0, 0x404c0c0}, 0x80)
mmap$auto(0x0, 0x3, 0x4000000200df, 0x40eb2, 0x402, 0x300000000000)
capget$auto(&(0x7f0000000100)={0x5}, &(0x7f0000000140)={0x7ff, 0xc, 0x800})
close_range$auto(0x2, 0xa, 0x0)
socket(0x10, 0x2, 0x4)
openat$auto_safesetid_uid_file_fops_securityfs(0xffffffffffffff9c, &(0x7f0000000080), 0x1, 0x0)
writev$auto(0x3, &(0x7f0000000100)={0x0, 0x7111}, 0x8)
r1 = socket(0x10, 0x2, 0x0)
sendmmsg$auto(r1, &(0x7f0000000200)={{0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000080), 0xfc2}, 0x2, &(0x7f00000001c0), 0x7, 0xa505}, 0x800}, 0x7, 0x4008)
socket(0x3, 0x800, 0x9)
r2 = openat$auto_kernfs_file_fops_kernfs_internal(0xffffffffffffff9c, &(0x7f0000000080)='/sys/module/apparmor/parameters/path_max\x00', 0x80, 0x0)
r3 = socket(0x1e, 0x4, 0x0)
setsockopt$auto(r3, 0x10f, 0x86, 0x0, 0x0)
read$auto_kernfs_file_fops_kernfs_internal(r2, &(0x7f00000000c0)=""/17, 0x11)
open(&(0x7f0000000000)='./file0\x00', 0x261c2, 0x84)
open(&(0x7f0000000080)='./file0\x00', 0xeee00, 0x31)
mmap$auto(0x3, 0x2020009, 0x7fffffff, 0xeb1, 0xfffffffffffffffa, 0x8000)
executing program 6:
mmap$auto(0x0, 0x4020009, 0x8000000080000000, 0x17, 0x401, 0x8000)
madvise$auto(0x0, 0xffffffffffff0005, 0x17)
openat$auto_clear_warn_once_fops_(0xffffffffffffff9c, &(0x7f0000000100), 0x210800, 0x0)
r0 = openat$auto_tty_fops_tty_io(0xffffffffffffff9c, &(0x7f0000000000)='/dev/tty46\x00', 0x0, 0x0)
close_range$auto(0x2, 0x8, 0x0)
socket(0x10, 0x2, 0x0)
socket(0x2, 0x6, 0x0)
mmap$auto(0x0, 0x400005, 0xdf, 0x9b72, 0x2, 0x8000)
socket(0xa, 0x5, 0x84)
bind$auto(0x3, 0x0, 0x6a)
ioctl$auto(0x3, 0x800005411, 0x38)
ioctl$auto(r0, 0x5600, 0x0)
mmap$auto(0x6, 0x400005, 0xffffffffffffff00, 0x9b72, r0, 0x8000)
close_range$auto(0x2, 0x8, 0x0)
socketpair$auto(0x1, 0x2, 0x8000000000000000, 0x0)
r1 = openat$auto_force_devcoredump_fops_hci_vhci(0xffffffffffffff9c, &(0x7f0000000c40)='/sys/kernel/debug/bluetooth/hci0/force_devcoredump\x00', 0x2, 0x0)
write$auto(r1, 0x0, 0xe)
mremap$auto(0x0, 0xffffffffffffffff, 0x3fd6, 0x3, 0x7fffffffb000)
mmap$auto(0x0, 0x400005, 0x800000000000df, 0x9b72, 0x2, 0x8000)
madvise$auto(0x0, 0xffffffffffff0001, 0x15)
r2 = openat$auto_proc_clear_refs_operations_internal(0xffffffffffffff9c, &(0x7f0000000600)='/proc/thread-self/clear_refs\x00', 0x2, 0x0)
mmap$auto(0x0, 0x8, 0xdf, 0x9b72, 0x2, 0x8000)
setitimer$auto(0x4, &(0x7f0000000000)={{0x1ff, 0x10001}, {0x200000000004, 0x6}}, 0x0)
openat$nci(0xffffffffffffff9c, &(0x7f0000000000), 0x2, 0x0)
bpf$auto(0x12, &(0x7f0000000000)=@info={0x2800, 0x1ff, 0x2}, 0xcf)
r3 = socket(0x10, 0x2, 0x0)
sendmsg$auto_NL80211_CMD_GET_REG(r3, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000300)=ANY=[@ANYBLOB=' \x00\x00\x00', @ANYBLOB="1200", @ANYBLOB=']'], 0x1ac}}, 0x40000)
recvmmsg$auto(r3, &(0x7f0000000380)={{0x0, 0x1, &(0x7f0000000000)={0x0, 0x400}, 0x4, 0x0, 0x200002, 0x8}, 0x803}, 0xfffffff9, 0x10010, 0x0)
write$auto_proc_clear_refs_operations_internal(r2, 0x0, 0xffffff4b)
socket(0xa, 0x3, 0x3a)

program crashed: KASAN: slab-use-after-free Read in force_devcd_write
testing program (duration=9m0s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): [18, 30]
detailed listing:
executing program 0:
close_range$auto(0x2, 0x1d, 0x0)
r0 = syz_genetlink_get_family_id$auto_nl80211(&(0x7f0000000180), 0xffffffffffffffff)
sendmsg$auto_NL80211_CMD_SET_WIPHY(0xffffffffffffffff, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000080)=ANY=[@ANYBLOB='$\x00\x00\x00', @ANYRES16=r0, @ANYBLOB="011d3da4420008bd7100f9db5f250200000000000010", @ANYRES32], 0x24}, 0x1, 0x0, 0x0, 0x404c0c0}, 0x80)
mmap$auto(0x0, 0x3, 0x4000000200df, 0x40eb2, 0x402, 0x300000000000)
capget$auto(&(0x7f0000000100)={0x5}, &(0x7f0000000140)={0x7ff, 0xc, 0x800})
close_range$auto(0x2, 0xa, 0x0)
socket(0x10, 0x2, 0x4)
openat$auto_safesetid_uid_file_fops_securityfs(0xffffffffffffff9c, &(0x7f0000000080), 0x1, 0x0)
writev$auto(0x3, &(0x7f0000000100)={0x0, 0x7111}, 0x8)
r1 = socket(0x10, 0x2, 0x0)
sendmmsg$auto(r1, &(0x7f0000000200)={{0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000080), 0xfc2}, 0x2, &(0x7f00000001c0), 0x7, 0xa505}, 0x800}, 0x7, 0x4008)
socket(0x3, 0x800, 0x9)
r2 = openat$auto_kernfs_file_fops_kernfs_internal(0xffffffffffffff9c, &(0x7f0000000080)='/sys/module/apparmor/parameters/path_max\x00', 0x80, 0x0)
r3 = socket(0x1e, 0x4, 0x0)
setsockopt$auto(r3, 0x10f, 0x86, 0x0, 0x0)
read$auto_kernfs_file_fops_kernfs_internal(r2, &(0x7f00000000c0)=""/17, 0x11)
open(&(0x7f0000000000)='./file0\x00', 0x261c2, 0x84)
open(&(0x7f0000000080)='./file0\x00', 0xeee00, 0x31)
executing program 6:
mmap$auto(0x0, 0x4020009, 0x8000000080000000, 0x17, 0x401, 0x8000)
madvise$auto(0x0, 0xffffffffffff0005, 0x17)
openat$auto_clear_warn_once_fops_(0xffffffffffffff9c, &(0x7f0000000100), 0x210800, 0x0)
r0 = openat$auto_tty_fops_tty_io(0xffffffffffffff9c, &(0x7f0000000000)='/dev/tty46\x00', 0x0, 0x0)
close_range$auto(0x2, 0x8, 0x0)
socket(0x10, 0x2, 0x0)
socket(0x2, 0x6, 0x0)
mmap$auto(0x0, 0x400005, 0xdf, 0x9b72, 0x2, 0x8000)
socket(0xa, 0x5, 0x84)
bind$auto(0x3, 0x0, 0x6a)
ioctl$auto(0x3, 0x800005411, 0x38)
ioctl$auto(r0, 0x5600, 0x0)
mmap$auto(0x6, 0x400005, 0xffffffffffffff00, 0x9b72, r0, 0x8000)
close_range$auto(0x2, 0x8, 0x0)
socketpair$auto(0x1, 0x2, 0x8000000000000000, 0x0)
r1 = openat$auto_force_devcoredump_fops_hci_vhci(0xffffffffffffff9c, &(0x7f0000000c40)='/sys/kernel/debug/bluetooth/hci0/force_devcoredump\x00', 0x2, 0x0)
write$auto(r1, 0x0, 0xe)
mremap$auto(0x0, 0xffffffffffffffff, 0x3fd6, 0x3, 0x7fffffffb000)
mmap$auto(0x0, 0x400005, 0x800000000000df, 0x9b72, 0x2, 0x8000)
madvise$auto(0x0, 0xffffffffffff0001, 0x15)
r2 = openat$auto_proc_clear_refs_operations_internal(0xffffffffffffff9c, &(0x7f0000000600)='/proc/thread-self/clear_refs\x00', 0x2, 0x0)
mmap$auto(0x0, 0x8, 0xdf, 0x9b72, 0x2, 0x8000)
setitimer$auto(0x4, &(0x7f0000000000)={{0x1ff, 0x10001}, {0x200000000004, 0x6}}, 0x0)
openat$nci(0xffffffffffffff9c, &(0x7f0000000000), 0x2, 0x0)
bpf$auto(0x12, &(0x7f0000000000)=@info={0x2800, 0x1ff, 0x2}, 0xcf)
r3 = socket(0x10, 0x2, 0x0)
sendmsg$auto_NL80211_CMD_GET_REG(r3, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000300)=ANY=[@ANYBLOB=' \x00\x00\x00', @ANYBLOB="1200", @ANYBLOB=']'], 0x1ac}}, 0x40000)
recvmmsg$auto(r3, &(0x7f0000000380)={{0x0, 0x1, &(0x7f0000000000)={0x0, 0x400}, 0x4, 0x0, 0x200002, 0x8}, 0x803}, 0xfffffff9, 0x10010, 0x0)
write$auto_proc_clear_refs_operations_internal(r2, 0x0, 0xffffff4b)
socket(0xa, 0x3, 0x3a)

program crashed: KASAN: slab-use-after-free Read in force_devcd_write
testing program (duration=9m0s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): [17, 30]
detailed listing:
executing program 0:
close_range$auto(0x2, 0x1d, 0x0)
r0 = syz_genetlink_get_family_id$auto_nl80211(&(0x7f0000000180), 0xffffffffffffffff)
sendmsg$auto_NL80211_CMD_SET_WIPHY(0xffffffffffffffff, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000080)=ANY=[@ANYBLOB='$\x00\x00\x00', @ANYRES16=r0, @ANYBLOB="011d3da4420008bd7100f9db5f250200000000000010", @ANYRES32], 0x24}, 0x1, 0x0, 0x0, 0x404c0c0}, 0x80)
mmap$auto(0x0, 0x3, 0x4000000200df, 0x40eb2, 0x402, 0x300000000000)
capget$auto(&(0x7f0000000100)={0x5}, &(0x7f0000000140)={0x7ff, 0xc, 0x800})
close_range$auto(0x2, 0xa, 0x0)
socket(0x10, 0x2, 0x4)
openat$auto_safesetid_uid_file_fops_securityfs(0xffffffffffffff9c, &(0x7f0000000080), 0x1, 0x0)
writev$auto(0x3, &(0x7f0000000100)={0x0, 0x7111}, 0x8)
r1 = socket(0x10, 0x2, 0x0)
sendmmsg$auto(r1, &(0x7f0000000200)={{0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000080), 0xfc2}, 0x2, &(0x7f00000001c0), 0x7, 0xa505}, 0x800}, 0x7, 0x4008)
socket(0x3, 0x800, 0x9)
r2 = openat$auto_kernfs_file_fops_kernfs_internal(0xffffffffffffff9c, &(0x7f0000000080)='/sys/module/apparmor/parameters/path_max\x00', 0x80, 0x0)
r3 = socket(0x1e, 0x4, 0x0)
setsockopt$auto(r3, 0x10f, 0x86, 0x0, 0x0)
read$auto_kernfs_file_fops_kernfs_internal(r2, &(0x7f00000000c0)=""/17, 0x11)
open(&(0x7f0000000000)='./file0\x00', 0x261c2, 0x84)
executing program 6:
mmap$auto(0x0, 0x4020009, 0x8000000080000000, 0x17, 0x401, 0x8000)
madvise$auto(0x0, 0xffffffffffff0005, 0x17)
openat$auto_clear_warn_once_fops_(0xffffffffffffff9c, &(0x7f0000000100), 0x210800, 0x0)
r0 = openat$auto_tty_fops_tty_io(0xffffffffffffff9c, &(0x7f0000000000)='/dev/tty46\x00', 0x0, 0x0)
close_range$auto(0x2, 0x8, 0x0)
socket(0x10, 0x2, 0x0)
socket(0x2, 0x6, 0x0)
mmap$auto(0x0, 0x400005, 0xdf, 0x9b72, 0x2, 0x8000)
socket(0xa, 0x5, 0x84)
bind$auto(0x3, 0x0, 0x6a)
ioctl$auto(0x3, 0x800005411, 0x38)
ioctl$auto(r0, 0x5600, 0x0)
mmap$auto(0x6, 0x400005, 0xffffffffffffff00, 0x9b72, r0, 0x8000)
close_range$auto(0x2, 0x8, 0x0)
socketpair$auto(0x1, 0x2, 0x8000000000000000, 0x0)
r1 = openat$auto_force_devcoredump_fops_hci_vhci(0xffffffffffffff9c, &(0x7f0000000c40)='/sys/kernel/debug/bluetooth/hci0/force_devcoredump\x00', 0x2, 0x0)
write$auto(r1, 0x0, 0xe)
mremap$auto(0x0, 0xffffffffffffffff, 0x3fd6, 0x3, 0x7fffffffb000)
mmap$auto(0x0, 0x400005, 0x800000000000df, 0x9b72, 0x2, 0x8000)
madvise$auto(0x0, 0xffffffffffff0001, 0x15)
r2 = openat$auto_proc_clear_refs_operations_internal(0xffffffffffffff9c, &(0x7f0000000600)='/proc/thread-self/clear_refs\x00', 0x2, 0x0)
mmap$auto(0x0, 0x8, 0xdf, 0x9b72, 0x2, 0x8000)
setitimer$auto(0x4, &(0x7f0000000000)={{0x1ff, 0x10001}, {0x200000000004, 0x6}}, 0x0)
openat$nci(0xffffffffffffff9c, &(0x7f0000000000), 0x2, 0x0)
bpf$auto(0x12, &(0x7f0000000000)=@info={0x2800, 0x1ff, 0x2}, 0xcf)
r3 = socket(0x10, 0x2, 0x0)
sendmsg$auto_NL80211_CMD_GET_REG(r3, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000300)=ANY=[@ANYBLOB=' \x00\x00\x00', @ANYBLOB="1200", @ANYBLOB=']'], 0x1ac}}, 0x40000)
recvmmsg$auto(r3, &(0x7f0000000380)={{0x0, 0x1, &(0x7f0000000000)={0x0, 0x400}, 0x4, 0x0, 0x200002, 0x8}, 0x803}, 0xfffffff9, 0x10010, 0x0)
write$auto_proc_clear_refs_operations_internal(r2, 0x0, 0xffffff4b)
socket(0xa, 0x3, 0x3a)

program crashed: KASAN: slab-use-after-free Read in force_devcd_write
testing program (duration=9m0s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): [16, 30]
detailed listing:
executing program 0:
close_range$auto(0x2, 0x1d, 0x0)
r0 = syz_genetlink_get_family_id$auto_nl80211(&(0x7f0000000180), 0xffffffffffffffff)
sendmsg$auto_NL80211_CMD_SET_WIPHY(0xffffffffffffffff, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000080)=ANY=[@ANYBLOB='$\x00\x00\x00', @ANYRES16=r0, @ANYBLOB="011d3da4420008bd7100f9db5f250200000000000010", @ANYRES32], 0x24}, 0x1, 0x0, 0x0, 0x404c0c0}, 0x80)
mmap$auto(0x0, 0x3, 0x4000000200df, 0x40eb2, 0x402, 0x300000000000)
capget$auto(&(0x7f0000000100)={0x5}, &(0x7f0000000140)={0x7ff, 0xc, 0x800})
close_range$auto(0x2, 0xa, 0x0)
socket(0x10, 0x2, 0x4)
openat$auto_safesetid_uid_file_fops_securityfs(0xffffffffffffff9c, &(0x7f0000000080), 0x1, 0x0)
writev$auto(0x3, &(0x7f0000000100)={0x0, 0x7111}, 0x8)
r1 = socket(0x10, 0x2, 0x0)
sendmmsg$auto(r1, &(0x7f0000000200)={{0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000080), 0xfc2}, 0x2, &(0x7f00000001c0), 0x7, 0xa505}, 0x800}, 0x7, 0x4008)
socket(0x3, 0x800, 0x9)
r2 = openat$auto_kernfs_file_fops_kernfs_internal(0xffffffffffffff9c, &(0x7f0000000080)='/sys/module/apparmor/parameters/path_max\x00', 0x80, 0x0)
r3 = socket(0x1e, 0x4, 0x0)
setsockopt$auto(r3, 0x10f, 0x86, 0x0, 0x0)
read$auto_kernfs_file_fops_kernfs_internal(r2, &(0x7f00000000c0)=""/17, 0x11)
executing program 6:
mmap$auto(0x0, 0x4020009, 0x8000000080000000, 0x17, 0x401, 0x8000)
madvise$auto(0x0, 0xffffffffffff0005, 0x17)
openat$auto_clear_warn_once_fops_(0xffffffffffffff9c, &(0x7f0000000100), 0x210800, 0x0)
r0 = openat$auto_tty_fops_tty_io(0xffffffffffffff9c, &(0x7f0000000000)='/dev/tty46\x00', 0x0, 0x0)
close_range$auto(0x2, 0x8, 0x0)
socket(0x10, 0x2, 0x0)
socket(0x2, 0x6, 0x0)
mmap$auto(0x0, 0x400005, 0xdf, 0x9b72, 0x2, 0x8000)
socket(0xa, 0x5, 0x84)
bind$auto(0x3, 0x0, 0x6a)
ioctl$auto(0x3, 0x800005411, 0x38)
ioctl$auto(r0, 0x5600, 0x0)
mmap$auto(0x6, 0x400005, 0xffffffffffffff00, 0x9b72, r0, 0x8000)
close_range$auto(0x2, 0x8, 0x0)
socketpair$auto(0x1, 0x2, 0x8000000000000000, 0x0)
r1 = openat$auto_force_devcoredump_fops_hci_vhci(0xffffffffffffff9c, &(0x7f0000000c40)='/sys/kernel/debug/bluetooth/hci0/force_devcoredump\x00', 0x2, 0x0)
write$auto(r1, 0x0, 0xe)
mremap$auto(0x0, 0xffffffffffffffff, 0x3fd6, 0x3, 0x7fffffffb000)
mmap$auto(0x0, 0x400005, 0x800000000000df, 0x9b72, 0x2, 0x8000)
madvise$auto(0x0, 0xffffffffffff0001, 0x15)
r2 = openat$auto_proc_clear_refs_operations_internal(0xffffffffffffff9c, &(0x7f0000000600)='/proc/thread-self/clear_refs\x00', 0x2, 0x0)
mmap$auto(0x0, 0x8, 0xdf, 0x9b72, 0x2, 0x8000)
setitimer$auto(0x4, &(0x7f0000000000)={{0x1ff, 0x10001}, {0x200000000004, 0x6}}, 0x0)
openat$nci(0xffffffffffffff9c, &(0x7f0000000000), 0x2, 0x0)
bpf$auto(0x12, &(0x7f0000000000)=@info={0x2800, 0x1ff, 0x2}, 0xcf)
r3 = socket(0x10, 0x2, 0x0)
sendmsg$auto_NL80211_CMD_GET_REG(r3, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000300)=ANY=[@ANYBLOB=' \x00\x00\x00', @ANYBLOB="1200", @ANYBLOB=']'], 0x1ac}}, 0x40000)
recvmmsg$auto(r3, &(0x7f0000000380)={{0x0, 0x1, &(0x7f0000000000)={0x0, 0x400}, 0x4, 0x0, 0x200002, 0x8}, 0x803}, 0xfffffff9, 0x10010, 0x0)
write$auto_proc_clear_refs_operations_internal(r2, 0x0, 0xffffff4b)
socket(0xa, 0x3, 0x3a)

program crashed: KASAN: slab-use-after-free Read in force_devcd_write
testing program (duration=9m0s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): [15, 30]
detailed listing:
executing program 0:
close_range$auto(0x2, 0x1d, 0x0)
r0 = syz_genetlink_get_family_id$auto_nl80211(&(0x7f0000000180), 0xffffffffffffffff)
sendmsg$auto_NL80211_CMD_SET_WIPHY(0xffffffffffffffff, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000080)=ANY=[@ANYBLOB='$\x00\x00\x00', @ANYRES16=r0, @ANYBLOB="011d3da4420008bd7100f9db5f250200000000000010", @ANYRES32], 0x24}, 0x1, 0x0, 0x0, 0x404c0c0}, 0x80)
mmap$auto(0x0, 0x3, 0x4000000200df, 0x40eb2, 0x402, 0x300000000000)
capget$auto(&(0x7f0000000100)={0x5}, &(0x7f0000000140)={0x7ff, 0xc, 0x800})
close_range$auto(0x2, 0xa, 0x0)
socket(0x10, 0x2, 0x4)
openat$auto_safesetid_uid_file_fops_securityfs(0xffffffffffffff9c, &(0x7f0000000080), 0x1, 0x0)
writev$auto(0x3, &(0x7f0000000100)={0x0, 0x7111}, 0x8)
r1 = socket(0x10, 0x2, 0x0)
sendmmsg$auto(r1, &(0x7f0000000200)={{0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000080), 0xfc2}, 0x2, &(0x7f00000001c0), 0x7, 0xa505}, 0x800}, 0x7, 0x4008)
socket(0x3, 0x800, 0x9)
openat$auto_kernfs_file_fops_kernfs_internal(0xffffffffffffff9c, &(0x7f0000000080)='/sys/module/apparmor/parameters/path_max\x00', 0x80, 0x0)
r2 = socket(0x1e, 0x4, 0x0)
setsockopt$auto(r2, 0x10f, 0x86, 0x0, 0x0)
executing program 6:
mmap$auto(0x0, 0x4020009, 0x8000000080000000, 0x17, 0x401, 0x8000)
madvise$auto(0x0, 0xffffffffffff0005, 0x17)
openat$auto_clear_warn_once_fops_(0xffffffffffffff9c, &(0x7f0000000100), 0x210800, 0x0)
r0 = openat$auto_tty_fops_tty_io(0xffffffffffffff9c, &(0x7f0000000000)='/dev/tty46\x00', 0x0, 0x0)
close_range$auto(0x2, 0x8, 0x0)
socket(0x10, 0x2, 0x0)
socket(0x2, 0x6, 0x0)
mmap$auto(0x0, 0x400005, 0xdf, 0x9b72, 0x2, 0x8000)
socket(0xa, 0x5, 0x84)
bind$auto(0x3, 0x0, 0x6a)
ioctl$auto(0x3, 0x800005411, 0x38)
ioctl$auto(r0, 0x5600, 0x0)
mmap$auto(0x6, 0x400005, 0xffffffffffffff00, 0x9b72, r0, 0x8000)
close_range$auto(0x2, 0x8, 0x0)
socketpair$auto(0x1, 0x2, 0x8000000000000000, 0x0)
r1 = openat$auto_force_devcoredump_fops_hci_vhci(0xffffffffffffff9c, &(0x7f0000000c40)='/sys/kernel/debug/bluetooth/hci0/force_devcoredump\x00', 0x2, 0x0)
write$auto(r1, 0x0, 0xe)
mremap$auto(0x0, 0xffffffffffffffff, 0x3fd6, 0x3, 0x7fffffffb000)
mmap$auto(0x0, 0x400005, 0x800000000000df, 0x9b72, 0x2, 0x8000)
madvise$auto(0x0, 0xffffffffffff0001, 0x15)
r2 = openat$auto_proc_clear_refs_operations_internal(0xffffffffffffff9c, &(0x7f0000000600)='/proc/thread-self/clear_refs\x00', 0x2, 0x0)
mmap$auto(0x0, 0x8, 0xdf, 0x9b72, 0x2, 0x8000)
setitimer$auto(0x4, &(0x7f0000000000)={{0x1ff, 0x10001}, {0x200000000004, 0x6}}, 0x0)
openat$nci(0xffffffffffffff9c, &(0x7f0000000000), 0x2, 0x0)
bpf$auto(0x12, &(0x7f0000000000)=@info={0x2800, 0x1ff, 0x2}, 0xcf)
r3 = socket(0x10, 0x2, 0x0)
sendmsg$auto_NL80211_CMD_GET_REG(r3, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000300)=ANY=[@ANYBLOB=' \x00\x00\x00', @ANYBLOB="1200", @ANYBLOB=']'], 0x1ac}}, 0x40000)
recvmmsg$auto(r3, &(0x7f0000000380)={{0x0, 0x1, &(0x7f0000000000)={0x0, 0x400}, 0x4, 0x0, 0x200002, 0x8}, 0x803}, 0xfffffff9, 0x10010, 0x0)
write$auto_proc_clear_refs_operations_internal(r2, 0x0, 0xffffff4b)
socket(0xa, 0x3, 0x3a)

program crashed: KASAN: slab-use-after-free Read in force_devcd_write
testing program (duration=9m0s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): [14, 30]
detailed listing:
executing program 0:
close_range$auto(0x2, 0x1d, 0x0)
r0 = syz_genetlink_get_family_id$auto_nl80211(&(0x7f0000000180), 0xffffffffffffffff)
sendmsg$auto_NL80211_CMD_SET_WIPHY(0xffffffffffffffff, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000080)=ANY=[@ANYBLOB='$\x00\x00\x00', @ANYRES16=r0, @ANYBLOB="011d3da4420008bd7100f9db5f250200000000000010", @ANYRES32], 0x24}, 0x1, 0x0, 0x0, 0x404c0c0}, 0x80)
mmap$auto(0x0, 0x3, 0x4000000200df, 0x40eb2, 0x402, 0x300000000000)
capget$auto(&(0x7f0000000100)={0x5}, &(0x7f0000000140)={0x7ff, 0xc, 0x800})
close_range$auto(0x2, 0xa, 0x0)
socket(0x10, 0x2, 0x4)
openat$auto_safesetid_uid_file_fops_securityfs(0xffffffffffffff9c, &(0x7f0000000080), 0x1, 0x0)
writev$auto(0x3, &(0x7f0000000100)={0x0, 0x7111}, 0x8)
r1 = socket(0x10, 0x2, 0x0)
sendmmsg$auto(r1, &(0x7f0000000200)={{0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000080), 0xfc2}, 0x2, &(0x7f00000001c0), 0x7, 0xa505}, 0x800}, 0x7, 0x4008)
socket(0x3, 0x800, 0x9)
openat$auto_kernfs_file_fops_kernfs_internal(0xffffffffffffff9c, &(0x7f0000000080)='/sys/module/apparmor/parameters/path_max\x00', 0x80, 0x0)
socket(0x1e, 0x4, 0x0)
executing program 6:
mmap$auto(0x0, 0x4020009, 0x8000000080000000, 0x17, 0x401, 0x8000)
madvise$auto(0x0, 0xffffffffffff0005, 0x17)
openat$auto_clear_warn_once_fops_(0xffffffffffffff9c, &(0x7f0000000100), 0x210800, 0x0)
r0 = openat$auto_tty_fops_tty_io(0xffffffffffffff9c, &(0x7f0000000000)='/dev/tty46\x00', 0x0, 0x0)
close_range$auto(0x2, 0x8, 0x0)
socket(0x10, 0x2, 0x0)
socket(0x2, 0x6, 0x0)
mmap$auto(0x0, 0x400005, 0xdf, 0x9b72, 0x2, 0x8000)
socket(0xa, 0x5, 0x84)
bind$auto(0x3, 0x0, 0x6a)
ioctl$auto(0x3, 0x800005411, 0x38)
ioctl$auto(r0, 0x5600, 0x0)
mmap$auto(0x6, 0x400005, 0xffffffffffffff00, 0x9b72, r0, 0x8000)
close_range$auto(0x2, 0x8, 0x0)
socketpair$auto(0x1, 0x2, 0x8000000000000000, 0x0)
r1 = openat$auto_force_devcoredump_fops_hci_vhci(0xffffffffffffff9c, &(0x7f0000000c40)='/sys/kernel/debug/bluetooth/hci0/force_devcoredump\x00', 0x2, 0x0)
write$auto(r1, 0x0, 0xe)
mremap$auto(0x0, 0xffffffffffffffff, 0x3fd6, 0x3, 0x7fffffffb000)
mmap$auto(0x0, 0x400005, 0x800000000000df, 0x9b72, 0x2, 0x8000)
madvise$auto(0x0, 0xffffffffffff0001, 0x15)
r2 = openat$auto_proc_clear_refs_operations_internal(0xffffffffffffff9c, &(0x7f0000000600)='/proc/thread-self/clear_refs\x00', 0x2, 0x0)
mmap$auto(0x0, 0x8, 0xdf, 0x9b72, 0x2, 0x8000)
setitimer$auto(0x4, &(0x7f0000000000)={{0x1ff, 0x10001}, {0x200000000004, 0x6}}, 0x0)
openat$nci(0xffffffffffffff9c, &(0x7f0000000000), 0x2, 0x0)
bpf$auto(0x12, &(0x7f0000000000)=@info={0x2800, 0x1ff, 0x2}, 0xcf)
r3 = socket(0x10, 0x2, 0x0)
sendmsg$auto_NL80211_CMD_GET_REG(r3, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000300)=ANY=[@ANYBLOB=' \x00\x00\x00', @ANYBLOB="1200", @ANYBLOB=']'], 0x1ac}}, 0x40000)
recvmmsg$auto(r3, &(0x7f0000000380)={{0x0, 0x1, &(0x7f0000000000)={0x0, 0x400}, 0x4, 0x0, 0x200002, 0x8}, 0x803}, 0xfffffff9, 0x10010, 0x0)
write$auto_proc_clear_refs_operations_internal(r2, 0x0, 0xffffff4b)
socket(0xa, 0x3, 0x3a)

program crashed: KASAN: slab-use-after-free Read in force_devcd_write
testing program (duration=9m0s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): [13, 30]
detailed listing:
executing program 0:
close_range$auto(0x2, 0x1d, 0x0)
r0 = syz_genetlink_get_family_id$auto_nl80211(&(0x7f0000000180), 0xffffffffffffffff)
sendmsg$auto_NL80211_CMD_SET_WIPHY(0xffffffffffffffff, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000080)=ANY=[@ANYBLOB='$\x00\x00\x00', @ANYRES16=r0, @ANYBLOB="011d3da4420008bd7100f9db5f250200000000000010", @ANYRES32], 0x24}, 0x1, 0x0, 0x0, 0x404c0c0}, 0x80)
mmap$auto(0x0, 0x3, 0x4000000200df, 0x40eb2, 0x402, 0x300000000000)
capget$auto(&(0x7f0000000100)={0x5}, &(0x7f0000000140)={0x7ff, 0xc, 0x800})
close_range$auto(0x2, 0xa, 0x0)
socket(0x10, 0x2, 0x4)
openat$auto_safesetid_uid_file_fops_securityfs(0xffffffffffffff9c, &(0x7f0000000080), 0x1, 0x0)
writev$auto(0x3, &(0x7f0000000100)={0x0, 0x7111}, 0x8)
r1 = socket(0x10, 0x2, 0x0)
sendmmsg$auto(r1, &(0x7f0000000200)={{0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000080), 0xfc2}, 0x2, &(0x7f00000001c0), 0x7, 0xa505}, 0x800}, 0x7, 0x4008)
socket(0x3, 0x800, 0x9)
openat$auto_kernfs_file_fops_kernfs_internal(0xffffffffffffff9c, &(0x7f0000000080)='/sys/module/apparmor/parameters/path_max\x00', 0x80, 0x0)
executing program 6:
mmap$auto(0x0, 0x4020009, 0x8000000080000000, 0x17, 0x401, 0x8000)
madvise$auto(0x0, 0xffffffffffff0005, 0x17)
openat$auto_clear_warn_once_fops_(0xffffffffffffff9c, &(0x7f0000000100), 0x210800, 0x0)
r0 = openat$auto_tty_fops_tty_io(0xffffffffffffff9c, &(0x7f0000000000)='/dev/tty46\x00', 0x0, 0x0)
close_range$auto(0x2, 0x8, 0x0)
socket(0x10, 0x2, 0x0)
socket(0x2, 0x6, 0x0)
mmap$auto(0x0, 0x400005, 0xdf, 0x9b72, 0x2, 0x8000)
socket(0xa, 0x5, 0x84)
bind$auto(0x3, 0x0, 0x6a)
ioctl$auto(0x3, 0x800005411, 0x38)
ioctl$auto(r0, 0x5600, 0x0)
mmap$auto(0x6, 0x400005, 0xffffffffffffff00, 0x9b72, r0, 0x8000)
close_range$auto(0x2, 0x8, 0x0)
socketpair$auto(0x1, 0x2, 0x8000000000000000, 0x0)
r1 = openat$auto_force_devcoredump_fops_hci_vhci(0xffffffffffffff9c, &(0x7f0000000c40)='/sys/kernel/debug/bluetooth/hci0/force_devcoredump\x00', 0x2, 0x0)
write$auto(r1, 0x0, 0xe)
mremap$auto(0x0, 0xffffffffffffffff, 0x3fd6, 0x3, 0x7fffffffb000)
mmap$auto(0x0, 0x400005, 0x800000000000df, 0x9b72, 0x2, 0x8000)
madvise$auto(0x0, 0xffffffffffff0001, 0x15)
r2 = openat$auto_proc_clear_refs_operations_internal(0xffffffffffffff9c, &(0x7f0000000600)='/proc/thread-self/clear_refs\x00', 0x2, 0x0)
mmap$auto(0x0, 0x8, 0xdf, 0x9b72, 0x2, 0x8000)
setitimer$auto(0x4, &(0x7f0000000000)={{0x1ff, 0x10001}, {0x200000000004, 0x6}}, 0x0)
openat$nci(0xffffffffffffff9c, &(0x7f0000000000), 0x2, 0x0)
bpf$auto(0x12, &(0x7f0000000000)=@info={0x2800, 0x1ff, 0x2}, 0xcf)
r3 = socket(0x10, 0x2, 0x0)
sendmsg$auto_NL80211_CMD_GET_REG(r3, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000300)=ANY=[@ANYBLOB=' \x00\x00\x00', @ANYBLOB="1200", @ANYBLOB=']'], 0x1ac}}, 0x40000)
recvmmsg$auto(r3, &(0x7f0000000380)={{0x0, 0x1, &(0x7f0000000000)={0x0, 0x400}, 0x4, 0x0, 0x200002, 0x8}, 0x803}, 0xfffffff9, 0x10010, 0x0)
write$auto_proc_clear_refs_operations_internal(r2, 0x0, 0xffffff4b)
socket(0xa, 0x3, 0x3a)

program crashed: KASAN: slab-use-after-free Read in force_devcd_write
testing program (duration=9m0s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): [12, 30]
detailed listing:
executing program 0:
close_range$auto(0x2, 0x1d, 0x0)
r0 = syz_genetlink_get_family_id$auto_nl80211(&(0x7f0000000180), 0xffffffffffffffff)
sendmsg$auto_NL80211_CMD_SET_WIPHY(0xffffffffffffffff, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000080)=ANY=[@ANYBLOB='$\x00\x00\x00', @ANYRES16=r0, @ANYBLOB="011d3da4420008bd7100f9db5f250200000000000010", @ANYRES32], 0x24}, 0x1, 0x0, 0x0, 0x404c0c0}, 0x80)
mmap$auto(0x0, 0x3, 0x4000000200df, 0x40eb2, 0x402, 0x300000000000)
capget$auto(&(0x7f0000000100)={0x5}, &(0x7f0000000140)={0x7ff, 0xc, 0x800})
close_range$auto(0x2, 0xa, 0x0)
socket(0x10, 0x2, 0x4)
openat$auto_safesetid_uid_file_fops_securityfs(0xffffffffffffff9c, &(0x7f0000000080), 0x1, 0x0)
writev$auto(0x3, &(0x7f0000000100)={0x0, 0x7111}, 0x8)
r1 = socket(0x10, 0x2, 0x0)
sendmmsg$auto(r1, &(0x7f0000000200)={{0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000080), 0xfc2}, 0x2, &(0x7f00000001c0), 0x7, 0xa505}, 0x800}, 0x7, 0x4008)
socket(0x3, 0x800, 0x9)
executing program 6:
mmap$auto(0x0, 0x4020009, 0x8000000080000000, 0x17, 0x401, 0x8000)
madvise$auto(0x0, 0xffffffffffff0005, 0x17)
openat$auto_clear_warn_once_fops_(0xffffffffffffff9c, &(0x7f0000000100), 0x210800, 0x0)
r0 = openat$auto_tty_fops_tty_io(0xffffffffffffff9c, &(0x7f0000000000)='/dev/tty46\x00', 0x0, 0x0)
close_range$auto(0x2, 0x8, 0x0)
socket(0x10, 0x2, 0x0)
socket(0x2, 0x6, 0x0)
mmap$auto(0x0, 0x400005, 0xdf, 0x9b72, 0x2, 0x8000)
socket(0xa, 0x5, 0x84)
bind$auto(0x3, 0x0, 0x6a)
ioctl$auto(0x3, 0x800005411, 0x38)
ioctl$auto(r0, 0x5600, 0x0)
mmap$auto(0x6, 0x400005, 0xffffffffffffff00, 0x9b72, r0, 0x8000)
close_range$auto(0x2, 0x8, 0x0)
socketpair$auto(0x1, 0x2, 0x8000000000000000, 0x0)
r1 = openat$auto_force_devcoredump_fops_hci_vhci(0xffffffffffffff9c, &(0x7f0000000c40)='/sys/kernel/debug/bluetooth/hci0/force_devcoredump\x00', 0x2, 0x0)
write$auto(r1, 0x0, 0xe)
mremap$auto(0x0, 0xffffffffffffffff, 0x3fd6, 0x3, 0x7fffffffb000)
mmap$auto(0x0, 0x400005, 0x800000000000df, 0x9b72, 0x2, 0x8000)
madvise$auto(0x0, 0xffffffffffff0001, 0x15)
r2 = openat$auto_proc_clear_refs_operations_internal(0xffffffffffffff9c, &(0x7f0000000600)='/proc/thread-self/clear_refs\x00', 0x2, 0x0)
mmap$auto(0x0, 0x8, 0xdf, 0x9b72, 0x2, 0x8000)
setitimer$auto(0x4, &(0x7f0000000000)={{0x1ff, 0x10001}, {0x200000000004, 0x6}}, 0x0)
openat$nci(0xffffffffffffff9c, &(0x7f0000000000), 0x2, 0x0)
bpf$auto(0x12, &(0x7f0000000000)=@info={0x2800, 0x1ff, 0x2}, 0xcf)
r3 = socket(0x10, 0x2, 0x0)
sendmsg$auto_NL80211_CMD_GET_REG(r3, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000300)=ANY=[@ANYBLOB=' \x00\x00\x00', @ANYBLOB="1200", @ANYBLOB=']'], 0x1ac}}, 0x40000)
recvmmsg$auto(r3, &(0x7f0000000380)={{0x0, 0x1, &(0x7f0000000000)={0x0, 0x400}, 0x4, 0x0, 0x200002, 0x8}, 0x803}, 0xfffffff9, 0x10010, 0x0)
write$auto_proc_clear_refs_operations_internal(r2, 0x0, 0xffffff4b)
socket(0xa, 0x3, 0x3a)

program crashed: KASAN: slab-use-after-free Read in force_devcd_write
testing program (duration=9m0s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): [11, 30]
detailed listing:
executing program 0:
close_range$auto(0x2, 0x1d, 0x0)
r0 = syz_genetlink_get_family_id$auto_nl80211(&(0x7f0000000180), 0xffffffffffffffff)
sendmsg$auto_NL80211_CMD_SET_WIPHY(0xffffffffffffffff, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000080)=ANY=[@ANYBLOB='$\x00\x00\x00', @ANYRES16=r0, @ANYBLOB="011d3da4420008bd7100f9db5f250200000000000010", @ANYRES32], 0x24}, 0x1, 0x0, 0x0, 0x404c0c0}, 0x80)
mmap$auto(0x0, 0x3, 0x4000000200df, 0x40eb2, 0x402, 0x300000000000)
capget$auto(&(0x7f0000000100)={0x5}, &(0x7f0000000140)={0x7ff, 0xc, 0x800})
close_range$auto(0x2, 0xa, 0x0)
socket(0x10, 0x2, 0x4)
openat$auto_safesetid_uid_file_fops_securityfs(0xffffffffffffff9c, &(0x7f0000000080), 0x1, 0x0)
writev$auto(0x3, &(0x7f0000000100)={0x0, 0x7111}, 0x8)
r1 = socket(0x10, 0x2, 0x0)
sendmmsg$auto(r1, &(0x7f0000000200)={{0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000080), 0xfc2}, 0x2, &(0x7f00000001c0), 0x7, 0xa505}, 0x800}, 0x7, 0x4008)
executing program 6:
mmap$auto(0x0, 0x4020009, 0x8000000080000000, 0x17, 0x401, 0x8000)
madvise$auto(0x0, 0xffffffffffff0005, 0x17)
openat$auto_clear_warn_once_fops_(0xffffffffffffff9c, &(0x7f0000000100), 0x210800, 0x0)
r0 = openat$auto_tty_fops_tty_io(0xffffffffffffff9c, &(0x7f0000000000)='/dev/tty46\x00', 0x0, 0x0)
close_range$auto(0x2, 0x8, 0x0)
socket(0x10, 0x2, 0x0)
socket(0x2, 0x6, 0x0)
mmap$auto(0x0, 0x400005, 0xdf, 0x9b72, 0x2, 0x8000)
socket(0xa, 0x5, 0x84)
bind$auto(0x3, 0x0, 0x6a)
ioctl$auto(0x3, 0x800005411, 0x38)
ioctl$auto(r0, 0x5600, 0x0)
mmap$auto(0x6, 0x400005, 0xffffffffffffff00, 0x9b72, r0, 0x8000)
close_range$auto(0x2, 0x8, 0x0)
socketpair$auto(0x1, 0x2, 0x8000000000000000, 0x0)
r1 = openat$auto_force_devcoredump_fops_hci_vhci(0xffffffffffffff9c, &(0x7f0000000c40)='/sys/kernel/debug/bluetooth/hci0/force_devcoredump\x00', 0x2, 0x0)
write$auto(r1, 0x0, 0xe)
mremap$auto(0x0, 0xffffffffffffffff, 0x3fd6, 0x3, 0x7fffffffb000)
mmap$auto(0x0, 0x400005, 0x800000000000df, 0x9b72, 0x2, 0x8000)
madvise$auto(0x0, 0xffffffffffff0001, 0x15)
r2 = openat$auto_proc_clear_refs_operations_internal(0xffffffffffffff9c, &(0x7f0000000600)='/proc/thread-self/clear_refs\x00', 0x2, 0x0)
mmap$auto(0x0, 0x8, 0xdf, 0x9b72, 0x2, 0x8000)
setitimer$auto(0x4, &(0x7f0000000000)={{0x1ff, 0x10001}, {0x200000000004, 0x6}}, 0x0)
openat$nci(0xffffffffffffff9c, &(0x7f0000000000), 0x2, 0x0)
bpf$auto(0x12, &(0x7f0000000000)=@info={0x2800, 0x1ff, 0x2}, 0xcf)
r3 = socket(0x10, 0x2, 0x0)
sendmsg$auto_NL80211_CMD_GET_REG(r3, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000300)=ANY=[@ANYBLOB=' \x00\x00\x00', @ANYBLOB="1200", @ANYBLOB=']'], 0x1ac}}, 0x40000)
recvmmsg$auto(r3, &(0x7f0000000380)={{0x0, 0x1, &(0x7f0000000000)={0x0, 0x400}, 0x4, 0x0, 0x200002, 0x8}, 0x803}, 0xfffffff9, 0x10010, 0x0)
write$auto_proc_clear_refs_operations_internal(r2, 0x0, 0xffffff4b)
socket(0xa, 0x3, 0x3a)

program crashed: KASAN: slab-use-after-free Read in force_devcd_write
testing program (duration=9m0s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): [10, 30]
detailed listing:
executing program 0:
close_range$auto(0x2, 0x1d, 0x0)
r0 = syz_genetlink_get_family_id$auto_nl80211(&(0x7f0000000180), 0xffffffffffffffff)
sendmsg$auto_NL80211_CMD_SET_WIPHY(0xffffffffffffffff, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000080)=ANY=[@ANYBLOB='$\x00\x00\x00', @ANYRES16=r0, @ANYBLOB="011d3da4420008bd7100f9db5f250200000000000010", @ANYRES32], 0x24}, 0x1, 0x0, 0x0, 0x404c0c0}, 0x80)
mmap$auto(0x0, 0x3, 0x4000000200df, 0x40eb2, 0x402, 0x300000000000)
capget$auto(&(0x7f0000000100)={0x5}, &(0x7f0000000140)={0x7ff, 0xc, 0x800})
close_range$auto(0x2, 0xa, 0x0)
socket(0x10, 0x2, 0x4)
openat$auto_safesetid_uid_file_fops_securityfs(0xffffffffffffff9c, &(0x7f0000000080), 0x1, 0x0)
writev$auto(0x3, &(0x7f0000000100)={0x0, 0x7111}, 0x8)
socket(0x10, 0x2, 0x0)
executing program 6:
mmap$auto(0x0, 0x4020009, 0x8000000080000000, 0x17, 0x401, 0x8000)
madvise$auto(0x0, 0xffffffffffff0005, 0x17)
openat$auto_clear_warn_once_fops_(0xffffffffffffff9c, &(0x7f0000000100), 0x210800, 0x0)
r0 = openat$auto_tty_fops_tty_io(0xffffffffffffff9c, &(0x7f0000000000)='/dev/tty46\x00', 0x0, 0x0)
close_range$auto(0x2, 0x8, 0x0)
socket(0x10, 0x2, 0x0)
socket(0x2, 0x6, 0x0)
mmap$auto(0x0, 0x400005, 0xdf, 0x9b72, 0x2, 0x8000)
socket(0xa, 0x5, 0x84)
bind$auto(0x3, 0x0, 0x6a)
ioctl$auto(0x3, 0x800005411, 0x38)
ioctl$auto(r0, 0x5600, 0x0)
mmap$auto(0x6, 0x400005, 0xffffffffffffff00, 0x9b72, r0, 0x8000)
close_range$auto(0x2, 0x8, 0x0)
socketpair$auto(0x1, 0x2, 0x8000000000000000, 0x0)
r1 = openat$auto_force_devcoredump_fops_hci_vhci(0xffffffffffffff9c, &(0x7f0000000c40)='/sys/kernel/debug/bluetooth/hci0/force_devcoredump\x00', 0x2, 0x0)
write$auto(r1, 0x0, 0xe)
mremap$auto(0x0, 0xffffffffffffffff, 0x3fd6, 0x3, 0x7fffffffb000)
mmap$auto(0x0, 0x400005, 0x800000000000df, 0x9b72, 0x2, 0x8000)
madvise$auto(0x0, 0xffffffffffff0001, 0x15)
r2 = openat$auto_proc_clear_refs_operations_internal(0xffffffffffffff9c, &(0x7f0000000600)='/proc/thread-self/clear_refs\x00', 0x2, 0x0)
mmap$auto(0x0, 0x8, 0xdf, 0x9b72, 0x2, 0x8000)
setitimer$auto(0x4, &(0x7f0000000000)={{0x1ff, 0x10001}, {0x200000000004, 0x6}}, 0x0)
openat$nci(0xffffffffffffff9c, &(0x7f0000000000), 0x2, 0x0)
bpf$auto(0x12, &(0x7f0000000000)=@info={0x2800, 0x1ff, 0x2}, 0xcf)
r3 = socket(0x10, 0x2, 0x0)
sendmsg$auto_NL80211_CMD_GET_REG(r3, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000300)=ANY=[@ANYBLOB=' \x00\x00\x00', @ANYBLOB="1200", @ANYBLOB=']'], 0x1ac}}, 0x40000)
recvmmsg$auto(r3, &(0x7f0000000380)={{0x0, 0x1, &(0x7f0000000000)={0x0, 0x400}, 0x4, 0x0, 0x200002, 0x8}, 0x803}, 0xfffffff9, 0x10010, 0x0)
write$auto_proc_clear_refs_operations_internal(r2, 0x0, 0xffffff4b)
socket(0xa, 0x3, 0x3a)

program crashed: KASAN: slab-use-after-free Read in force_devcd_write
testing program (duration=9m0s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): [9, 30]
detailed listing:
executing program 0:
close_range$auto(0x2, 0x1d, 0x0)
r0 = syz_genetlink_get_family_id$auto_nl80211(&(0x7f0000000180), 0xffffffffffffffff)
sendmsg$auto_NL80211_CMD_SET_WIPHY(0xffffffffffffffff, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000080)=ANY=[@ANYBLOB='$\x00\x00\x00', @ANYRES16=r0, @ANYBLOB="011d3da4420008bd7100f9db5f250200000000000010", @ANYRES32], 0x24}, 0x1, 0x0, 0x0, 0x404c0c0}, 0x80)
mmap$auto(0x0, 0x3, 0x4000000200df, 0x40eb2, 0x402, 0x300000000000)
capget$auto(&(0x7f0000000100)={0x5}, &(0x7f0000000140)={0x7ff, 0xc, 0x800})
close_range$auto(0x2, 0xa, 0x0)
socket(0x10, 0x2, 0x4)
openat$auto_safesetid_uid_file_fops_securityfs(0xffffffffffffff9c, &(0x7f0000000080), 0x1, 0x0)
writev$auto(0x3, &(0x7f0000000100)={0x0, 0x7111}, 0x8)
executing program 6:
mmap$auto(0x0, 0x4020009, 0x8000000080000000, 0x17, 0x401, 0x8000)
madvise$auto(0x0, 0xffffffffffff0005, 0x17)
openat$auto_clear_warn_once_fops_(0xffffffffffffff9c, &(0x7f0000000100), 0x210800, 0x0)
r0 = openat$auto_tty_fops_tty_io(0xffffffffffffff9c, &(0x7f0000000000)='/dev/tty46\x00', 0x0, 0x0)
close_range$auto(0x2, 0x8, 0x0)
socket(0x10, 0x2, 0x0)
socket(0x2, 0x6, 0x0)
mmap$auto(0x0, 0x400005, 0xdf, 0x9b72, 0x2, 0x8000)
socket(0xa, 0x5, 0x84)
bind$auto(0x3, 0x0, 0x6a)
ioctl$auto(0x3, 0x800005411, 0x38)
ioctl$auto(r0, 0x5600, 0x0)
mmap$auto(0x6, 0x400005, 0xffffffffffffff00, 0x9b72, r0, 0x8000)
close_range$auto(0x2, 0x8, 0x0)
socketpair$auto(0x1, 0x2, 0x8000000000000000, 0x0)
r1 = openat$auto_force_devcoredump_fops_hci_vhci(0xffffffffffffff9c, &(0x7f0000000c40)='/sys/kernel/debug/bluetooth/hci0/force_devcoredump\x00', 0x2, 0x0)
write$auto(r1, 0x0, 0xe)
mremap$auto(0x0, 0xffffffffffffffff, 0x3fd6, 0x3, 0x7fffffffb000)
mmap$auto(0x0, 0x400005, 0x800000000000df, 0x9b72, 0x2, 0x8000)
madvise$auto(0x0, 0xffffffffffff0001, 0x15)
r2 = openat$auto_proc_clear_refs_operations_internal(0xffffffffffffff9c, &(0x7f0000000600)='/proc/thread-self/clear_refs\x00', 0x2, 0x0)
mmap$auto(0x0, 0x8, 0xdf, 0x9b72, 0x2, 0x8000)
setitimer$auto(0x4, &(0x7f0000000000)={{0x1ff, 0x10001}, {0x200000000004, 0x6}}, 0x0)
openat$nci(0xffffffffffffff9c, &(0x7f0000000000), 0x2, 0x0)
bpf$auto(0x12, &(0x7f0000000000)=@info={0x2800, 0x1ff, 0x2}, 0xcf)
r3 = socket(0x10, 0x2, 0x0)
sendmsg$auto_NL80211_CMD_GET_REG(r3, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000300)=ANY=[@ANYBLOB=' \x00\x00\x00', @ANYBLOB="1200", @ANYBLOB=']'], 0x1ac}}, 0x40000)
recvmmsg$auto(r3, &(0x7f0000000380)={{0x0, 0x1, &(0x7f0000000000)={0x0, 0x400}, 0x4, 0x0, 0x200002, 0x8}, 0x803}, 0xfffffff9, 0x10010, 0x0)
write$auto_proc_clear_refs_operations_internal(r2, 0x0, 0xffffff4b)
socket(0xa, 0x3, 0x3a)

program crashed: KASAN: slab-use-after-free Read in force_devcd_write
testing program (duration=9m0s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): [8, 30]
detailed listing:
executing program 0:
close_range$auto(0x2, 0x1d, 0x0)
r0 = syz_genetlink_get_family_id$auto_nl80211(&(0x7f0000000180), 0xffffffffffffffff)
sendmsg$auto_NL80211_CMD_SET_WIPHY(0xffffffffffffffff, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000080)=ANY=[@ANYBLOB='$\x00\x00\x00', @ANYRES16=r0, @ANYBLOB="011d3da4420008bd7100f9db5f250200000000000010", @ANYRES32], 0x24}, 0x1, 0x0, 0x0, 0x404c0c0}, 0x80)
mmap$auto(0x0, 0x3, 0x4000000200df, 0x40eb2, 0x402, 0x300000000000)
capget$auto(&(0x7f0000000100)={0x5}, &(0x7f0000000140)={0x7ff, 0xc, 0x800})
close_range$auto(0x2, 0xa, 0x0)
socket(0x10, 0x2, 0x4)
openat$auto_safesetid_uid_file_fops_securityfs(0xffffffffffffff9c, &(0x7f0000000080), 0x1, 0x0)
executing program 6:
mmap$auto(0x0, 0x4020009, 0x8000000080000000, 0x17, 0x401, 0x8000)
madvise$auto(0x0, 0xffffffffffff0005, 0x17)
openat$auto_clear_warn_once_fops_(0xffffffffffffff9c, &(0x7f0000000100), 0x210800, 0x0)
r0 = openat$auto_tty_fops_tty_io(0xffffffffffffff9c, &(0x7f0000000000)='/dev/tty46\x00', 0x0, 0x0)
close_range$auto(0x2, 0x8, 0x0)
socket(0x10, 0x2, 0x0)
socket(0x2, 0x6, 0x0)
mmap$auto(0x0, 0x400005, 0xdf, 0x9b72, 0x2, 0x8000)
socket(0xa, 0x5, 0x84)
bind$auto(0x3, 0x0, 0x6a)
ioctl$auto(0x3, 0x800005411, 0x38)
ioctl$auto(r0, 0x5600, 0x0)
mmap$auto(0x6, 0x400005, 0xffffffffffffff00, 0x9b72, r0, 0x8000)
close_range$auto(0x2, 0x8, 0x0)
socketpair$auto(0x1, 0x2, 0x8000000000000000, 0x0)
r1 = openat$auto_force_devcoredump_fops_hci_vhci(0xffffffffffffff9c, &(0x7f0000000c40)='/sys/kernel/debug/bluetooth/hci0/force_devcoredump\x00', 0x2, 0x0)
write$auto(r1, 0x0, 0xe)
mremap$auto(0x0, 0xffffffffffffffff, 0x3fd6, 0x3, 0x7fffffffb000)
mmap$auto(0x0, 0x400005, 0x800000000000df, 0x9b72, 0x2, 0x8000)
madvise$auto(0x0, 0xffffffffffff0001, 0x15)
r2 = openat$auto_proc_clear_refs_operations_internal(0xffffffffffffff9c, &(0x7f0000000600)='/proc/thread-self/clear_refs\x00', 0x2, 0x0)
mmap$auto(0x0, 0x8, 0xdf, 0x9b72, 0x2, 0x8000)
setitimer$auto(0x4, &(0x7f0000000000)={{0x1ff, 0x10001}, {0x200000000004, 0x6}}, 0x0)
openat$nci(0xffffffffffffff9c, &(0x7f0000000000), 0x2, 0x0)
bpf$auto(0x12, &(0x7f0000000000)=@info={0x2800, 0x1ff, 0x2}, 0xcf)
r3 = socket(0x10, 0x2, 0x0)
sendmsg$auto_NL80211_CMD_GET_REG(r3, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000300)=ANY=[@ANYBLOB=' \x00\x00\x00', @ANYBLOB="1200", @ANYBLOB=']'], 0x1ac}}, 0x40000)
recvmmsg$auto(r3, &(0x7f0000000380)={{0x0, 0x1, &(0x7f0000000000)={0x0, 0x400}, 0x4, 0x0, 0x200002, 0x8}, 0x803}, 0xfffffff9, 0x10010, 0x0)
write$auto_proc_clear_refs_operations_internal(r2, 0x0, 0xffffff4b)
socket(0xa, 0x3, 0x3a)

program crashed: KASAN: slab-use-after-free Read in force_devcd_write
testing program (duration=9m0s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): [7, 30]
detailed listing:
executing program 0:
close_range$auto(0x2, 0x1d, 0x0)
r0 = syz_genetlink_get_family_id$auto_nl80211(&(0x7f0000000180), 0xffffffffffffffff)
sendmsg$auto_NL80211_CMD_SET_WIPHY(0xffffffffffffffff, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000080)=ANY=[@ANYBLOB='$\x00\x00\x00', @ANYRES16=r0, @ANYBLOB="011d3da4420008bd7100f9db5f250200000000000010", @ANYRES32], 0x24}, 0x1, 0x0, 0x0, 0x404c0c0}, 0x80)
mmap$auto(0x0, 0x3, 0x4000000200df, 0x40eb2, 0x402, 0x300000000000)
capget$auto(&(0x7f0000000100)={0x5}, &(0x7f0000000140)={0x7ff, 0xc, 0x800})
close_range$auto(0x2, 0xa, 0x0)
socket(0x10, 0x2, 0x4)
executing program 6:
mmap$auto(0x0, 0x4020009, 0x8000000080000000, 0x17, 0x401, 0x8000)
madvise$auto(0x0, 0xffffffffffff0005, 0x17)
openat$auto_clear_warn_once_fops_(0xffffffffffffff9c, &(0x7f0000000100), 0x210800, 0x0)
r0 = openat$auto_tty_fops_tty_io(0xffffffffffffff9c, &(0x7f0000000000)='/dev/tty46\x00', 0x0, 0x0)
close_range$auto(0x2, 0x8, 0x0)
socket(0x10, 0x2, 0x0)
socket(0x2, 0x6, 0x0)
mmap$auto(0x0, 0x400005, 0xdf, 0x9b72, 0x2, 0x8000)
socket(0xa, 0x5, 0x84)
bind$auto(0x3, 0x0, 0x6a)
ioctl$auto(0x3, 0x800005411, 0x38)
ioctl$auto(r0, 0x5600, 0x0)
mmap$auto(0x6, 0x400005, 0xffffffffffffff00, 0x9b72, r0, 0x8000)
close_range$auto(0x2, 0x8, 0x0)
socketpair$auto(0x1, 0x2, 0x8000000000000000, 0x0)
r1 = openat$auto_force_devcoredump_fops_hci_vhci(0xffffffffffffff9c, &(0x7f0000000c40)='/sys/kernel/debug/bluetooth/hci0/force_devcoredump\x00', 0x2, 0x0)
write$auto(r1, 0x0, 0xe)
mremap$auto(0x0, 0xffffffffffffffff, 0x3fd6, 0x3, 0x7fffffffb000)
mmap$auto(0x0, 0x400005, 0x800000000000df, 0x9b72, 0x2, 0x8000)
madvise$auto(0x0, 0xffffffffffff0001, 0x15)
r2 = openat$auto_proc_clear_refs_operations_internal(0xffffffffffffff9c, &(0x7f0000000600)='/proc/thread-self/clear_refs\x00', 0x2, 0x0)
mmap$auto(0x0, 0x8, 0xdf, 0x9b72, 0x2, 0x8000)
setitimer$auto(0x4, &(0x7f0000000000)={{0x1ff, 0x10001}, {0x200000000004, 0x6}}, 0x0)
openat$nci(0xffffffffffffff9c, &(0x7f0000000000), 0x2, 0x0)
bpf$auto(0x12, &(0x7f0000000000)=@info={0x2800, 0x1ff, 0x2}, 0xcf)
r3 = socket(0x10, 0x2, 0x0)
sendmsg$auto_NL80211_CMD_GET_REG(r3, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000300)=ANY=[@ANYBLOB=' \x00\x00\x00', @ANYBLOB="1200", @ANYBLOB=']'], 0x1ac}}, 0x40000)
recvmmsg$auto(r3, &(0x7f0000000380)={{0x0, 0x1, &(0x7f0000000000)={0x0, 0x400}, 0x4, 0x0, 0x200002, 0x8}, 0x803}, 0xfffffff9, 0x10010, 0x0)
write$auto_proc_clear_refs_operations_internal(r2, 0x0, 0xffffff4b)
socket(0xa, 0x3, 0x3a)

program crashed: KASAN: slab-use-after-free Read in force_devcd_write
testing program (duration=9m0s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): [6, 30]
detailed listing:
executing program 0:
close_range$auto(0x2, 0x1d, 0x0)
r0 = syz_genetlink_get_family_id$auto_nl80211(&(0x7f0000000180), 0xffffffffffffffff)
sendmsg$auto_NL80211_CMD_SET_WIPHY(0xffffffffffffffff, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000080)=ANY=[@ANYBLOB='$\x00\x00\x00', @ANYRES16=r0, @ANYBLOB="011d3da4420008bd7100f9db5f250200000000000010", @ANYRES32], 0x24}, 0x1, 0x0, 0x0, 0x404c0c0}, 0x80)
mmap$auto(0x0, 0x3, 0x4000000200df, 0x40eb2, 0x402, 0x300000000000)
capget$auto(&(0x7f0000000100)={0x5}, &(0x7f0000000140)={0x7ff, 0xc, 0x800})
close_range$auto(0x2, 0xa, 0x0)
executing program 6:
mmap$auto(0x0, 0x4020009, 0x8000000080000000, 0x17, 0x401, 0x8000)
madvise$auto(0x0, 0xffffffffffff0005, 0x17)
openat$auto_clear_warn_once_fops_(0xffffffffffffff9c, &(0x7f0000000100), 0x210800, 0x0)
r0 = openat$auto_tty_fops_tty_io(0xffffffffffffff9c, &(0x7f0000000000)='/dev/tty46\x00', 0x0, 0x0)
close_range$auto(0x2, 0x8, 0x0)
socket(0x10, 0x2, 0x0)
socket(0x2, 0x6, 0x0)
mmap$auto(0x0, 0x400005, 0xdf, 0x9b72, 0x2, 0x8000)
socket(0xa, 0x5, 0x84)
bind$auto(0x3, 0x0, 0x6a)
ioctl$auto(0x3, 0x800005411, 0x38)
ioctl$auto(r0, 0x5600, 0x0)
mmap$auto(0x6, 0x400005, 0xffffffffffffff00, 0x9b72, r0, 0x8000)
close_range$auto(0x2, 0x8, 0x0)
socketpair$auto(0x1, 0x2, 0x8000000000000000, 0x0)
r1 = openat$auto_force_devcoredump_fops_hci_vhci(0xffffffffffffff9c, &(0x7f0000000c40)='/sys/kernel/debug/bluetooth/hci0/force_devcoredump\x00', 0x2, 0x0)
write$auto(r1, 0x0, 0xe)
mremap$auto(0x0, 0xffffffffffffffff, 0x3fd6, 0x3, 0x7fffffffb000)
mmap$auto(0x0, 0x400005, 0x800000000000df, 0x9b72, 0x2, 0x8000)
madvise$auto(0x0, 0xffffffffffff0001, 0x15)
r2 = openat$auto_proc_clear_refs_operations_internal(0xffffffffffffff9c, &(0x7f0000000600)='/proc/thread-self/clear_refs\x00', 0x2, 0x0)
mmap$auto(0x0, 0x8, 0xdf, 0x9b72, 0x2, 0x8000)
setitimer$auto(0x4, &(0x7f0000000000)={{0x1ff, 0x10001}, {0x200000000004, 0x6}}, 0x0)
openat$nci(0xffffffffffffff9c, &(0x7f0000000000), 0x2, 0x0)
bpf$auto(0x12, &(0x7f0000000000)=@info={0x2800, 0x1ff, 0x2}, 0xcf)
r3 = socket(0x10, 0x2, 0x0)
sendmsg$auto_NL80211_CMD_GET_REG(r3, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000300)=ANY=[@ANYBLOB=' \x00\x00\x00', @ANYBLOB="1200", @ANYBLOB=']'], 0x1ac}}, 0x40000)
recvmmsg$auto(r3, &(0x7f0000000380)={{0x0, 0x1, &(0x7f0000000000)={0x0, 0x400}, 0x4, 0x0, 0x200002, 0x8}, 0x803}, 0xfffffff9, 0x10010, 0x0)
write$auto_proc_clear_refs_operations_internal(r2, 0x0, 0xffffff4b)
socket(0xa, 0x3, 0x3a)

program crashed: KASAN: slab-use-after-free Read in force_devcd_write
testing program (duration=9m0s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): [5, 30]
detailed listing:
executing program 0:
close_range$auto(0x2, 0x1d, 0x0)
r0 = syz_genetlink_get_family_id$auto_nl80211(&(0x7f0000000180), 0xffffffffffffffff)
sendmsg$auto_NL80211_CMD_SET_WIPHY(0xffffffffffffffff, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000080)=ANY=[@ANYBLOB='$\x00\x00\x00', @ANYRES16=r0, @ANYBLOB="011d3da4420008bd7100f9db5f250200000000000010", @ANYRES32], 0x24}, 0x1, 0x0, 0x0, 0x404c0c0}, 0x80)
mmap$auto(0x0, 0x3, 0x4000000200df, 0x40eb2, 0x402, 0x300000000000)
capget$auto(&(0x7f0000000100)={0x5}, &(0x7f0000000140)={0x7ff, 0xc, 0x800})
executing program 6:
mmap$auto(0x0, 0x4020009, 0x8000000080000000, 0x17, 0x401, 0x8000)
madvise$auto(0x0, 0xffffffffffff0005, 0x17)
openat$auto_clear_warn_once_fops_(0xffffffffffffff9c, &(0x7f0000000100), 0x210800, 0x0)
r0 = openat$auto_tty_fops_tty_io(0xffffffffffffff9c, &(0x7f0000000000)='/dev/tty46\x00', 0x0, 0x0)
close_range$auto(0x2, 0x8, 0x0)
socket(0x10, 0x2, 0x0)
socket(0x2, 0x6, 0x0)
mmap$auto(0x0, 0x400005, 0xdf, 0x9b72, 0x2, 0x8000)
socket(0xa, 0x5, 0x84)
bind$auto(0x3, 0x0, 0x6a)
ioctl$auto(0x3, 0x800005411, 0x38)
ioctl$auto(r0, 0x5600, 0x0)
mmap$auto(0x6, 0x400005, 0xffffffffffffff00, 0x9b72, r0, 0x8000)
close_range$auto(0x2, 0x8, 0x0)
socketpair$auto(0x1, 0x2, 0x8000000000000000, 0x0)
r1 = openat$auto_force_devcoredump_fops_hci_vhci(0xffffffffffffff9c, &(0x7f0000000c40)='/sys/kernel/debug/bluetooth/hci0/force_devcoredump\x00', 0x2, 0x0)
write$auto(r1, 0x0, 0xe)
mremap$auto(0x0, 0xffffffffffffffff, 0x3fd6, 0x3, 0x7fffffffb000)
mmap$auto(0x0, 0x400005, 0x800000000000df, 0x9b72, 0x2, 0x8000)
madvise$auto(0x0, 0xffffffffffff0001, 0x15)
r2 = openat$auto_proc_clear_refs_operations_internal(0xffffffffffffff9c, &(0x7f0000000600)='/proc/thread-self/clear_refs\x00', 0x2, 0x0)
mmap$auto(0x0, 0x8, 0xdf, 0x9b72, 0x2, 0x8000)
setitimer$auto(0x4, &(0x7f0000000000)={{0x1ff, 0x10001}, {0x200000000004, 0x6}}, 0x0)
openat$nci(0xffffffffffffff9c, &(0x7f0000000000), 0x2, 0x0)
bpf$auto(0x12, &(0x7f0000000000)=@info={0x2800, 0x1ff, 0x2}, 0xcf)
r3 = socket(0x10, 0x2, 0x0)
sendmsg$auto_NL80211_CMD_GET_REG(r3, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000300)=ANY=[@ANYBLOB=' \x00\x00\x00', @ANYBLOB="1200", @ANYBLOB=']'], 0x1ac}}, 0x40000)
recvmmsg$auto(r3, &(0x7f0000000380)={{0x0, 0x1, &(0x7f0000000000)={0x0, 0x400}, 0x4, 0x0, 0x200002, 0x8}, 0x803}, 0xfffffff9, 0x10010, 0x0)
write$auto_proc_clear_refs_operations_internal(r2, 0x0, 0xffffff4b)
socket(0xa, 0x3, 0x3a)

program crashed: KASAN: slab-use-after-free Read in force_devcd_write
testing program (duration=9m0s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): [4, 30]
detailed listing:
executing program 0:
close_range$auto(0x2, 0x1d, 0x0)
r0 = syz_genetlink_get_family_id$auto_nl80211(&(0x7f0000000180), 0xffffffffffffffff)
sendmsg$auto_NL80211_CMD_SET_WIPHY(0xffffffffffffffff, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000080)=ANY=[@ANYBLOB='$\x00\x00\x00', @ANYRES16=r0, @ANYBLOB="011d3da4420008bd7100f9db5f250200000000000010", @ANYRES32], 0x24}, 0x1, 0x0, 0x0, 0x404c0c0}, 0x80)
mmap$auto(0x0, 0x3, 0x4000000200df, 0x40eb2, 0x402, 0x300000000000)
executing program 6:
mmap$auto(0x0, 0x4020009, 0x8000000080000000, 0x17, 0x401, 0x8000)
madvise$auto(0x0, 0xffffffffffff0005, 0x17)
openat$auto_clear_warn_once_fops_(0xffffffffffffff9c, &(0x7f0000000100), 0x210800, 0x0)
r0 = openat$auto_tty_fops_tty_io(0xffffffffffffff9c, &(0x7f0000000000)='/dev/tty46\x00', 0x0, 0x0)
close_range$auto(0x2, 0x8, 0x0)
socket(0x10, 0x2, 0x0)
socket(0x2, 0x6, 0x0)
mmap$auto(0x0, 0x400005, 0xdf, 0x9b72, 0x2, 0x8000)
socket(0xa, 0x5, 0x84)
bind$auto(0x3, 0x0, 0x6a)
ioctl$auto(0x3, 0x800005411, 0x38)
ioctl$auto(r0, 0x5600, 0x0)
mmap$auto(0x6, 0x400005, 0xffffffffffffff00, 0x9b72, r0, 0x8000)
close_range$auto(0x2, 0x8, 0x0)
socketpair$auto(0x1, 0x2, 0x8000000000000000, 0x0)
r1 = openat$auto_force_devcoredump_fops_hci_vhci(0xffffffffffffff9c, &(0x7f0000000c40)='/sys/kernel/debug/bluetooth/hci0/force_devcoredump\x00', 0x2, 0x0)
write$auto(r1, 0x0, 0xe)
mremap$auto(0x0, 0xffffffffffffffff, 0x3fd6, 0x3, 0x7fffffffb000)
mmap$auto(0x0, 0x400005, 0x800000000000df, 0x9b72, 0x2, 0x8000)
madvise$auto(0x0, 0xffffffffffff0001, 0x15)
r2 = openat$auto_proc_clear_refs_operations_internal(0xffffffffffffff9c, &(0x7f0000000600)='/proc/thread-self/clear_refs\x00', 0x2, 0x0)
mmap$auto(0x0, 0x8, 0xdf, 0x9b72, 0x2, 0x8000)
setitimer$auto(0x4, &(0x7f0000000000)={{0x1ff, 0x10001}, {0x200000000004, 0x6}}, 0x0)
openat$nci(0xffffffffffffff9c, &(0x7f0000000000), 0x2, 0x0)
bpf$auto(0x12, &(0x7f0000000000)=@info={0x2800, 0x1ff, 0x2}, 0xcf)
r3 = socket(0x10, 0x2, 0x0)
sendmsg$auto_NL80211_CMD_GET_REG(r3, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000300)=ANY=[@ANYBLOB=' \x00\x00\x00', @ANYBLOB="1200", @ANYBLOB=']'], 0x1ac}}, 0x40000)
recvmmsg$auto(r3, &(0x7f0000000380)={{0x0, 0x1, &(0x7f0000000000)={0x0, 0x400}, 0x4, 0x0, 0x200002, 0x8}, 0x803}, 0xfffffff9, 0x10010, 0x0)
write$auto_proc_clear_refs_operations_internal(r2, 0x0, 0xffffff4b)
socket(0xa, 0x3, 0x3a)

program crashed: KASAN: slab-use-after-free Read in force_devcd_write
testing program (duration=9m0s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): [3, 30]
detailed listing:
executing program 0:
close_range$auto(0x2, 0x1d, 0x0)
r0 = syz_genetlink_get_family_id$auto_nl80211(&(0x7f0000000180), 0xffffffffffffffff)
sendmsg$auto_NL80211_CMD_SET_WIPHY(0xffffffffffffffff, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000080)=ANY=[@ANYBLOB='$\x00\x00\x00', @ANYRES16=r0, @ANYBLOB="011d3da4420008bd7100f9db5f250200000000000010", @ANYRES32], 0x24}, 0x1, 0x0, 0x0, 0x404c0c0}, 0x80)
executing program 6:
mmap$auto(0x0, 0x4020009, 0x8000000080000000, 0x17, 0x401, 0x8000)
madvise$auto(0x0, 0xffffffffffff0005, 0x17)
openat$auto_clear_warn_once_fops_(0xffffffffffffff9c, &(0x7f0000000100), 0x210800, 0x0)
r0 = openat$auto_tty_fops_tty_io(0xffffffffffffff9c, &(0x7f0000000000)='/dev/tty46\x00', 0x0, 0x0)
close_range$auto(0x2, 0x8, 0x0)
socket(0x10, 0x2, 0x0)
socket(0x2, 0x6, 0x0)
mmap$auto(0x0, 0x400005, 0xdf, 0x9b72, 0x2, 0x8000)
socket(0xa, 0x5, 0x84)
bind$auto(0x3, 0x0, 0x6a)
ioctl$auto(0x3, 0x800005411, 0x38)
ioctl$auto(r0, 0x5600, 0x0)
mmap$auto(0x6, 0x400005, 0xffffffffffffff00, 0x9b72, r0, 0x8000)
close_range$auto(0x2, 0x8, 0x0)
socketpair$auto(0x1, 0x2, 0x8000000000000000, 0x0)
r1 = openat$auto_force_devcoredump_fops_hci_vhci(0xffffffffffffff9c, &(0x7f0000000c40)='/sys/kernel/debug/bluetooth/hci0/force_devcoredump\x00', 0x2, 0x0)
write$auto(r1, 0x0, 0xe)
mremap$auto(0x0, 0xffffffffffffffff, 0x3fd6, 0x3, 0x7fffffffb000)
mmap$auto(0x0, 0x400005, 0x800000000000df, 0x9b72, 0x2, 0x8000)
madvise$auto(0x0, 0xffffffffffff0001, 0x15)
r2 = openat$auto_proc_clear_refs_operations_internal(0xffffffffffffff9c, &(0x7f0000000600)='/proc/thread-self/clear_refs\x00', 0x2, 0x0)
mmap$auto(0x0, 0x8, 0xdf, 0x9b72, 0x2, 0x8000)
setitimer$auto(0x4, &(0x7f0000000000)={{0x1ff, 0x10001}, {0x200000000004, 0x6}}, 0x0)
openat$nci(0xffffffffffffff9c, &(0x7f0000000000), 0x2, 0x0)
bpf$auto(0x12, &(0x7f0000000000)=@info={0x2800, 0x1ff, 0x2}, 0xcf)
r3 = socket(0x10, 0x2, 0x0)
sendmsg$auto_NL80211_CMD_GET_REG(r3, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000300)=ANY=[@ANYBLOB=' \x00\x00\x00', @ANYBLOB="1200", @ANYBLOB=']'], 0x1ac}}, 0x40000)
recvmmsg$auto(r3, &(0x7f0000000380)={{0x0, 0x1, &(0x7f0000000000)={0x0, 0x400}, 0x4, 0x0, 0x200002, 0x8}, 0x803}, 0xfffffff9, 0x10010, 0x0)
write$auto_proc_clear_refs_operations_internal(r2, 0x0, 0xffffff4b)
socket(0xa, 0x3, 0x3a)

program crashed: KASAN: slab-use-after-free Read in force_devcd_write
testing program (duration=9m0s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): [2, 30]
detailed listing:
executing program 0:
close_range$auto(0x2, 0x1d, 0x0)
syz_genetlink_get_family_id$auto_nl80211(&(0x7f0000000180), 0xffffffffffffffff)
executing program 6:
mmap$auto(0x0, 0x4020009, 0x8000000080000000, 0x17, 0x401, 0x8000)
madvise$auto(0x0, 0xffffffffffff0005, 0x17)
openat$auto_clear_warn_once_fops_(0xffffffffffffff9c, &(0x7f0000000100), 0x210800, 0x0)
r0 = openat$auto_tty_fops_tty_io(0xffffffffffffff9c, &(0x7f0000000000)='/dev/tty46\x00', 0x0, 0x0)
close_range$auto(0x2, 0x8, 0x0)
socket(0x10, 0x2, 0x0)
socket(0x2, 0x6, 0x0)
mmap$auto(0x0, 0x400005, 0xdf, 0x9b72, 0x2, 0x8000)
socket(0xa, 0x5, 0x84)
bind$auto(0x3, 0x0, 0x6a)
ioctl$auto(0x3, 0x800005411, 0x38)
ioctl$auto(r0, 0x5600, 0x0)
mmap$auto(0x6, 0x400005, 0xffffffffffffff00, 0x9b72, r0, 0x8000)
close_range$auto(0x2, 0x8, 0x0)
socketpair$auto(0x1, 0x2, 0x8000000000000000, 0x0)
r1 = openat$auto_force_devcoredump_fops_hci_vhci(0xffffffffffffff9c, &(0x7f0000000c40)='/sys/kernel/debug/bluetooth/hci0/force_devcoredump\x00', 0x2, 0x0)
write$auto(r1, 0x0, 0xe)
mremap$auto(0x0, 0xffffffffffffffff, 0x3fd6, 0x3, 0x7fffffffb000)
mmap$auto(0x0, 0x400005, 0x800000000000df, 0x9b72, 0x2, 0x8000)
madvise$auto(0x0, 0xffffffffffff0001, 0x15)
r2 = openat$auto_proc_clear_refs_operations_internal(0xffffffffffffff9c, &(0x7f0000000600)='/proc/thread-self/clear_refs\x00', 0x2, 0x0)
mmap$auto(0x0, 0x8, 0xdf, 0x9b72, 0x2, 0x8000)
setitimer$auto(0x4, &(0x7f0000000000)={{0x1ff, 0x10001}, {0x200000000004, 0x6}}, 0x0)
openat$nci(0xffffffffffffff9c, &(0x7f0000000000), 0x2, 0x0)
bpf$auto(0x12, &(0x7f0000000000)=@info={0x2800, 0x1ff, 0x2}, 0xcf)
r3 = socket(0x10, 0x2, 0x0)
sendmsg$auto_NL80211_CMD_GET_REG(r3, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000300)=ANY=[@ANYBLOB=' \x00\x00\x00', @ANYBLOB="1200", @ANYBLOB=']'], 0x1ac}}, 0x40000)
recvmmsg$auto(r3, &(0x7f0000000380)={{0x0, 0x1, &(0x7f0000000000)={0x0, 0x400}, 0x4, 0x0, 0x200002, 0x8}, 0x803}, 0xfffffff9, 0x10010, 0x0)
write$auto_proc_clear_refs_operations_internal(r2, 0x0, 0xffffff4b)
socket(0xa, 0x3, 0x3a)

program crashed: KASAN: slab-use-after-free Read in force_devcd_write
testing program (duration=9m0s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): [1, 30]
detailed listing:
executing program 0:
close_range$auto(0x2, 0x1d, 0x0)
executing program 6:
mmap$auto(0x0, 0x4020009, 0x8000000080000000, 0x17, 0x401, 0x8000)
madvise$auto(0x0, 0xffffffffffff0005, 0x17)
openat$auto_clear_warn_once_fops_(0xffffffffffffff9c, &(0x7f0000000100), 0x210800, 0x0)
r0 = openat$auto_tty_fops_tty_io(0xffffffffffffff9c, &(0x7f0000000000)='/dev/tty46\x00', 0x0, 0x0)
close_range$auto(0x2, 0x8, 0x0)
socket(0x10, 0x2, 0x0)
socket(0x2, 0x6, 0x0)
mmap$auto(0x0, 0x400005, 0xdf, 0x9b72, 0x2, 0x8000)
socket(0xa, 0x5, 0x84)
bind$auto(0x3, 0x0, 0x6a)
ioctl$auto(0x3, 0x800005411, 0x38)
ioctl$auto(r0, 0x5600, 0x0)
mmap$auto(0x6, 0x400005, 0xffffffffffffff00, 0x9b72, r0, 0x8000)
close_range$auto(0x2, 0x8, 0x0)
socketpair$auto(0x1, 0x2, 0x8000000000000000, 0x0)
r1 = openat$auto_force_devcoredump_fops_hci_vhci(0xffffffffffffff9c, &(0x7f0000000c40)='/sys/kernel/debug/bluetooth/hci0/force_devcoredump\x00', 0x2, 0x0)
write$auto(r1, 0x0, 0xe)
mremap$auto(0x0, 0xffffffffffffffff, 0x3fd6, 0x3, 0x7fffffffb000)
mmap$auto(0x0, 0x400005, 0x800000000000df, 0x9b72, 0x2, 0x8000)
madvise$auto(0x0, 0xffffffffffff0001, 0x15)
r2 = openat$auto_proc_clear_refs_operations_internal(0xffffffffffffff9c, &(0x7f0000000600)='/proc/thread-self/clear_refs\x00', 0x2, 0x0)
mmap$auto(0x0, 0x8, 0xdf, 0x9b72, 0x2, 0x8000)
setitimer$auto(0x4, &(0x7f0000000000)={{0x1ff, 0x10001}, {0x200000000004, 0x6}}, 0x0)
openat$nci(0xffffffffffffff9c, &(0x7f0000000000), 0x2, 0x0)
bpf$auto(0x12, &(0x7f0000000000)=@info={0x2800, 0x1ff, 0x2}, 0xcf)
r3 = socket(0x10, 0x2, 0x0)
sendmsg$auto_NL80211_CMD_GET_REG(r3, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000300)=ANY=[@ANYBLOB=' \x00\x00\x00', @ANYBLOB="1200", @ANYBLOB=']'], 0x1ac}}, 0x40000)
recvmmsg$auto(r3, &(0x7f0000000380)={{0x0, 0x1, &(0x7f0000000000)={0x0, 0x400}, 0x4, 0x0, 0x200002, 0x8}, 0x803}, 0xfffffff9, 0x10010, 0x0)
write$auto_proc_clear_refs_operations_internal(r2, 0x0, 0xffffff4b)
socket(0xa, 0x3, 0x3a)

program crashed: KASAN: slab-use-after-free Read in force_devcd_write
testing program (duration=9m0s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): [0, 30]
detailed listing:
executing program 0:
executing program 6:
mmap$auto(0x0, 0x4020009, 0x8000000080000000, 0x17, 0x401, 0x8000)
madvise$auto(0x0, 0xffffffffffff0005, 0x17)
openat$auto_clear_warn_once_fops_(0xffffffffffffff9c, &(0x7f0000000100), 0x210800, 0x0)
r0 = openat$auto_tty_fops_tty_io(0xffffffffffffff9c, &(0x7f0000000000)='/dev/tty46\x00', 0x0, 0x0)
close_range$auto(0x2, 0x8, 0x0)
socket(0x10, 0x2, 0x0)
socket(0x2, 0x6, 0x0)
mmap$auto(0x0, 0x400005, 0xdf, 0x9b72, 0x2, 0x8000)
socket(0xa, 0x5, 0x84)
bind$auto(0x3, 0x0, 0x6a)
ioctl$auto(0x3, 0x800005411, 0x38)
ioctl$auto(r0, 0x5600, 0x0)
mmap$auto(0x6, 0x400005, 0xffffffffffffff00, 0x9b72, r0, 0x8000)
close_range$auto(0x2, 0x8, 0x0)
socketpair$auto(0x1, 0x2, 0x8000000000000000, 0x0)
r1 = openat$auto_force_devcoredump_fops_hci_vhci(0xffffffffffffff9c, &(0x7f0000000c40)='/sys/kernel/debug/bluetooth/hci0/force_devcoredump\x00', 0x2, 0x0)
write$auto(r1, 0x0, 0xe)
mremap$auto(0x0, 0xffffffffffffffff, 0x3fd6, 0x3, 0x7fffffffb000)
mmap$auto(0x0, 0x400005, 0x800000000000df, 0x9b72, 0x2, 0x8000)
madvise$auto(0x0, 0xffffffffffff0001, 0x15)
r2 = openat$auto_proc_clear_refs_operations_internal(0xffffffffffffff9c, &(0x7f0000000600)='/proc/thread-self/clear_refs\x00', 0x2, 0x0)
mmap$auto(0x0, 0x8, 0xdf, 0x9b72, 0x2, 0x8000)
setitimer$auto(0x4, &(0x7f0000000000)={{0x1ff, 0x10001}, {0x200000000004, 0x6}}, 0x0)
openat$nci(0xffffffffffffff9c, &(0x7f0000000000), 0x2, 0x0)
bpf$auto(0x12, &(0x7f0000000000)=@info={0x2800, 0x1ff, 0x2}, 0xcf)
r3 = socket(0x10, 0x2, 0x0)
sendmsg$auto_NL80211_CMD_GET_REG(r3, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000300)=ANY=[@ANYBLOB=' \x00\x00\x00', @ANYBLOB="1200", @ANYBLOB=']'], 0x1ac}}, 0x40000)
recvmmsg$auto(r3, &(0x7f0000000380)={{0x0, 0x1, &(0x7f0000000000)={0x0, 0x400}, 0x4, 0x0, 0x200002, 0x8}, 0x803}, 0xfffffff9, 0x10010, 0x0)
write$auto_proc_clear_refs_operations_internal(r2, 0x0, 0xffffff4b)
socket(0xa, 0x3, 0x3a)

program crashed: KASAN: slab-use-after-free Read in force_devcd_write
minimized 26 calls -> 0 calls
minimizing program #1 before concatenation
testing program (duration=9m0s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): [0, 29]
detailed listing:
executing program 6:
executing program 0:
mmap$auto(0x0, 0x4020009, 0x8000000080000000, 0x17, 0x401, 0x8000)
madvise$auto(0x0, 0xffffffffffff0005, 0x17)
openat$auto_clear_warn_once_fops_(0xffffffffffffff9c, &(0x7f0000000100), 0x210800, 0x0)
r0 = openat$auto_tty_fops_tty_io(0xffffffffffffff9c, &(0x7f0000000000)='/dev/tty46\x00', 0x0, 0x0)
close_range$auto(0x2, 0x8, 0x0)
socket(0x10, 0x2, 0x0)
socket(0x2, 0x6, 0x0)
mmap$auto(0x0, 0x400005, 0xdf, 0x9b72, 0x2, 0x8000)
socket(0xa, 0x5, 0x84)
bind$auto(0x3, 0x0, 0x6a)
ioctl$auto(0x3, 0x800005411, 0x38)
ioctl$auto(r0, 0x5600, 0x0)
mmap$auto(0x6, 0x400005, 0xffffffffffffff00, 0x9b72, r0, 0x8000)
close_range$auto(0x2, 0x8, 0x0)
socketpair$auto(0x1, 0x2, 0x8000000000000000, 0x0)
r1 = openat$auto_force_devcoredump_fops_hci_vhci(0xffffffffffffff9c, &(0x7f0000000c40)='/sys/kernel/debug/bluetooth/hci0/force_devcoredump\x00', 0x2, 0x0)
write$auto(r1, 0x0, 0xe)
mremap$auto(0x0, 0xffffffffffffffff, 0x3fd6, 0x3, 0x7fffffffb000)
mmap$auto(0x0, 0x400005, 0x800000000000df, 0x9b72, 0x2, 0x8000)
madvise$auto(0x0, 0xffffffffffff0001, 0x15)
r2 = openat$auto_proc_clear_refs_operations_internal(0xffffffffffffff9c, &(0x7f0000000600)='/proc/thread-self/clear_refs\x00', 0x2, 0x0)
mmap$auto(0x0, 0x8, 0xdf, 0x9b72, 0x2, 0x8000)
setitimer$auto(0x4, &(0x7f0000000000)={{0x1ff, 0x10001}, {0x200000000004, 0x6}}, 0x0)
openat$nci(0xffffffffffffff9c, &(0x7f0000000000), 0x2, 0x0)
bpf$auto(0x12, &(0x7f0000000000)=@info={0x2800, 0x1ff, 0x2}, 0xcf)
r3 = socket(0x10, 0x2, 0x0)
sendmsg$auto_NL80211_CMD_GET_REG(r3, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000300)=ANY=[@ANYBLOB=' \x00\x00\x00', @ANYBLOB="1200", @ANYBLOB=']'], 0x1ac}}, 0x40000)
recvmmsg$auto(r3, &(0x7f0000000380)={{0x0, 0x1, &(0x7f0000000000)={0x0, 0x400}, 0x4, 0x0, 0x200002, 0x8}, 0x803}, 0xfffffff9, 0x10010, 0x0)
write$auto_proc_clear_refs_operations_internal(r2, 0x0, 0xffffff4b)

program crashed: KASAN: slab-use-after-free Read in force_devcd_write
testing program (duration=9m0s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): [0, 28]
detailed listing:
executing program 6:
executing program 0:
mmap$auto(0x0, 0x4020009, 0x8000000080000000, 0x17, 0x401, 0x8000)
madvise$auto(0x0, 0xffffffffffff0005, 0x17)
openat$auto_clear_warn_once_fops_(0xffffffffffffff9c, &(0x7f0000000100), 0x210800, 0x0)
r0 = openat$auto_tty_fops_tty_io(0xffffffffffffff9c, &(0x7f0000000000)='/dev/tty46\x00', 0x0, 0x0)
close_range$auto(0x2, 0x8, 0x0)
socket(0x10, 0x2, 0x0)
socket(0x2, 0x6, 0x0)
mmap$auto(0x0, 0x400005, 0xdf, 0x9b72, 0x2, 0x8000)
socket(0xa, 0x5, 0x84)
bind$auto(0x3, 0x0, 0x6a)
ioctl$auto(0x3, 0x800005411, 0x38)
ioctl$auto(r0, 0x5600, 0x0)
mmap$auto(0x6, 0x400005, 0xffffffffffffff00, 0x9b72, r0, 0x8000)
close_range$auto(0x2, 0x8, 0x0)
socketpair$auto(0x1, 0x2, 0x8000000000000000, 0x0)
r1 = openat$auto_force_devcoredump_fops_hci_vhci(0xffffffffffffff9c, &(0x7f0000000c40)='/sys/kernel/debug/bluetooth/hci0/force_devcoredump\x00', 0x2, 0x0)
write$auto(r1, 0x0, 0xe)
mremap$auto(0x0, 0xffffffffffffffff, 0x3fd6, 0x3, 0x7fffffffb000)
mmap$auto(0x0, 0x400005, 0x800000000000df, 0x9b72, 0x2, 0x8000)
madvise$auto(0x0, 0xffffffffffff0001, 0x15)
openat$auto_proc_clear_refs_operations_internal(0xffffffffffffff9c, &(0x7f0000000600)='/proc/thread-self/clear_refs\x00', 0x2, 0x0)
mmap$auto(0x0, 0x8, 0xdf, 0x9b72, 0x2, 0x8000)
setitimer$auto(0x4, &(0x7f0000000000)={{0x1ff, 0x10001}, {0x200000000004, 0x6}}, 0x0)
openat$nci(0xffffffffffffff9c, &(0x7f0000000000), 0x2, 0x0)
bpf$auto(0x12, &(0x7f0000000000)=@info={0x2800, 0x1ff, 0x2}, 0xcf)
r2 = socket(0x10, 0x2, 0x0)
sendmsg$auto_NL80211_CMD_GET_REG(r2, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000300)=ANY=[@ANYBLOB=' \x00\x00\x00', @ANYBLOB="1200", @ANYBLOB=']'], 0x1ac}}, 0x40000)
recvmmsg$auto(r2, &(0x7f0000000380)={{0x0, 0x1, &(0x7f0000000000)={0x0, 0x400}, 0x4, 0x0, 0x200002, 0x8}, 0x803}, 0xfffffff9, 0x10010, 0x0)

program crashed: KASAN: slab-use-after-free Read in force_devcd_write
testing program (duration=9m0s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): [0, 27]
detailed listing:
executing program 6:
executing program 0:
mmap$auto(0x0, 0x4020009, 0x8000000080000000, 0x17, 0x401, 0x8000)
madvise$auto(0x0, 0xffffffffffff0005, 0x17)
openat$auto_clear_warn_once_fops_(0xffffffffffffff9c, &(0x7f0000000100), 0x210800, 0x0)
r0 = openat$auto_tty_fops_tty_io(0xffffffffffffff9c, &(0x7f0000000000)='/dev/tty46\x00', 0x0, 0x0)
close_range$auto(0x2, 0x8, 0x0)
socket(0x10, 0x2, 0x0)
socket(0x2, 0x6, 0x0)
mmap$auto(0x0, 0x400005, 0xdf, 0x9b72, 0x2, 0x8000)
socket(0xa, 0x5, 0x84)
bind$auto(0x3, 0x0, 0x6a)
ioctl$auto(0x3, 0x800005411, 0x38)
ioctl$auto(r0, 0x5600, 0x0)
mmap$auto(0x6, 0x400005, 0xffffffffffffff00, 0x9b72, r0, 0x8000)
close_range$auto(0x2, 0x8, 0x0)
socketpair$auto(0x1, 0x2, 0x8000000000000000, 0x0)
r1 = openat$auto_force_devcoredump_fops_hci_vhci(0xffffffffffffff9c, &(0x7f0000000c40)='/sys/kernel/debug/bluetooth/hci0/force_devcoredump\x00', 0x2, 0x0)
write$auto(r1, 0x0, 0xe)
mremap$auto(0x0, 0xffffffffffffffff, 0x3fd6, 0x3, 0x7fffffffb000)
mmap$auto(0x0, 0x400005, 0x800000000000df, 0x9b72, 0x2, 0x8000)
madvise$auto(0x0, 0xffffffffffff0001, 0x15)
openat$auto_proc_clear_refs_operations_internal(0xffffffffffffff9c, &(0x7f0000000600)='/proc/thread-self/clear_refs\x00', 0x2, 0x0)
mmap$auto(0x0, 0x8, 0xdf, 0x9b72, 0x2, 0x8000)
setitimer$auto(0x4, &(0x7f0000000000)={{0x1ff, 0x10001}, {0x200000000004, 0x6}}, 0x0)
openat$nci(0xffffffffffffff9c, &(0x7f0000000000), 0x2, 0x0)
bpf$auto(0x12, &(0x7f0000000000)=@info={0x2800, 0x1ff, 0x2}, 0xcf)
r2 = socket(0x10, 0x2, 0x0)
sendmsg$auto_NL80211_CMD_GET_REG(r2, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000300)=ANY=[@ANYBLOB=' \x00\x00\x00', @ANYBLOB="1200", @ANYBLOB=']'], 0x1ac}}, 0x40000)

program did not crash
testing program (duration=9m0s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): [0, 27]
detailed listing:
executing program 6:
executing program 0:
mmap$auto(0x0, 0x4020009, 0x8000000080000000, 0x17, 0x401, 0x8000)
madvise$auto(0x0, 0xffffffffffff0005, 0x17)
openat$auto_clear_warn_once_fops_(0xffffffffffffff9c, &(0x7f0000000100), 0x210800, 0x0)
r0 = openat$auto_tty_fops_tty_io(0xffffffffffffff9c, &(0x7f0000000000)='/dev/tty46\x00', 0x0, 0x0)
close_range$auto(0x2, 0x8, 0x0)
socket(0x10, 0x2, 0x0)
socket(0x2, 0x6, 0x0)
mmap$auto(0x0, 0x400005, 0xdf, 0x9b72, 0x2, 0x8000)
socket(0xa, 0x5, 0x84)
bind$auto(0x3, 0x0, 0x6a)
ioctl$auto(0x3, 0x800005411, 0x38)
ioctl$auto(r0, 0x5600, 0x0)
mmap$auto(0x6, 0x400005, 0xffffffffffffff00, 0x9b72, r0, 0x8000)
close_range$auto(0x2, 0x8, 0x0)
socketpair$auto(0x1, 0x2, 0x8000000000000000, 0x0)
r1 = openat$auto_force_devcoredump_fops_hci_vhci(0xffffffffffffff9c, &(0x7f0000000c40)='/sys/kernel/debug/bluetooth/hci0/force_devcoredump\x00', 0x2, 0x0)
write$auto(r1, 0x0, 0xe)
mremap$auto(0x0, 0xffffffffffffffff, 0x3fd6, 0x3, 0x7fffffffb000)
mmap$auto(0x0, 0x400005, 0x800000000000df, 0x9b72, 0x2, 0x8000)
madvise$auto(0x0, 0xffffffffffff0001, 0x15)
openat$auto_proc_clear_refs_operations_internal(0xffffffffffffff9c, &(0x7f0000000600)='/proc/thread-self/clear_refs\x00', 0x2, 0x0)
mmap$auto(0x0, 0x8, 0xdf, 0x9b72, 0x2, 0x8000)
setitimer$auto(0x4, &(0x7f0000000000)={{0x1ff, 0x10001}, {0x200000000004, 0x6}}, 0x0)
openat$nci(0xffffffffffffff9c, &(0x7f0000000000), 0x2, 0x0)
bpf$auto(0x12, &(0x7f0000000000)=@info={0x2800, 0x1ff, 0x2}, 0xcf)
r2 = socket(0x10, 0x2, 0x0)
recvmmsg$auto(r2, &(0x7f0000000380)={{0x0, 0x1, &(0x7f0000000000)={0x0, 0x400}, 0x4, 0x0, 0x200002, 0x8}, 0x803}, 0xfffffff9, 0x10010, 0x0)

program did not crash
testing program (duration=9m0s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): [0, 27]
detailed listing:
executing program 6:
executing program 0:
mmap$auto(0x0, 0x4020009, 0x8000000080000000, 0x17, 0x401, 0x8000)
madvise$auto(0x0, 0xffffffffffff0005, 0x17)
openat$auto_clear_warn_once_fops_(0xffffffffffffff9c, &(0x7f0000000100), 0x210800, 0x0)
r0 = openat$auto_tty_fops_tty_io(0xffffffffffffff9c, &(0x7f0000000000)='/dev/tty46\x00', 0x0, 0x0)
close_range$auto(0x2, 0x8, 0x0)
socket(0x10, 0x2, 0x0)
socket(0x2, 0x6, 0x0)
mmap$auto(0x0, 0x400005, 0xdf, 0x9b72, 0x2, 0x8000)
socket(0xa, 0x5, 0x84)
bind$auto(0x3, 0x0, 0x6a)
ioctl$auto(0x3, 0x800005411, 0x38)
ioctl$auto(r0, 0x5600, 0x0)
mmap$auto(0x6, 0x400005, 0xffffffffffffff00, 0x9b72, r0, 0x8000)
close_range$auto(0x2, 0x8, 0x0)
socketpair$auto(0x1, 0x2, 0x8000000000000000, 0x0)
r1 = openat$auto_force_devcoredump_fops_hci_vhci(0xffffffffffffff9c, &(0x7f0000000c40)='/sys/kernel/debug/bluetooth/hci0/force_devcoredump\x00', 0x2, 0x0)
write$auto(r1, 0x0, 0xe)
mremap$auto(0x0, 0xffffffffffffffff, 0x3fd6, 0x3, 0x7fffffffb000)
mmap$auto(0x0, 0x400005, 0x800000000000df, 0x9b72, 0x2, 0x8000)
madvise$auto(0x0, 0xffffffffffff0001, 0x15)
openat$auto_proc_clear_refs_operations_internal(0xffffffffffffff9c, &(0x7f0000000600)='/proc/thread-self/clear_refs\x00', 0x2, 0x0)
mmap$auto(0x0, 0x8, 0xdf, 0x9b72, 0x2, 0x8000)
setitimer$auto(0x4, &(0x7f0000000000)={{0x1ff, 0x10001}, {0x200000000004, 0x6}}, 0x0)
openat$nci(0xffffffffffffff9c, &(0x7f0000000000), 0x2, 0x0)
bpf$auto(0x12, &(0x7f0000000000)=@info={0x2800, 0x1ff, 0x2}, 0xcf)
sendmsg$auto_NL80211_CMD_GET_REG(0xffffffffffffffff, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000300)=ANY=[@ANYBLOB=' \x00\x00\x00', @ANYBLOB="1200", @ANYBLOB=']'], 0x1ac}}, 0x40000)
recvmmsg$auto(0xffffffffffffffff, &(0x7f0000000380)={{0x0, 0x1, &(0x7f0000000000)={0x0, 0x400}, 0x4, 0x0, 0x200002, 0x8}, 0x803}, 0xfffffff9, 0x10010, 0x0)

program crashed: KASAN: slab-use-after-free Read in force_devcd_write
testing program (duration=9m0s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): [0, 26]
detailed listing:
executing program 6:
executing program 0:
mmap$auto(0x0, 0x4020009, 0x8000000080000000, 0x17, 0x401, 0x8000)
madvise$auto(0x0, 0xffffffffffff0005, 0x17)
openat$auto_clear_warn_once_fops_(0xffffffffffffff9c, &(0x7f0000000100), 0x210800, 0x0)
r0 = openat$auto_tty_fops_tty_io(0xffffffffffffff9c, &(0x7f0000000000)='/dev/tty46\x00', 0x0, 0x0)
close_range$auto(0x2, 0x8, 0x0)
socket(0x10, 0x2, 0x0)
socket(0x2, 0x6, 0x0)
mmap$auto(0x0, 0x400005, 0xdf, 0x9b72, 0x2, 0x8000)
socket(0xa, 0x5, 0x84)
bind$auto(0x3, 0x0, 0x6a)
ioctl$auto(0x3, 0x800005411, 0x38)
ioctl$auto(r0, 0x5600, 0x0)
mmap$auto(0x6, 0x400005, 0xffffffffffffff00, 0x9b72, r0, 0x8000)
close_range$auto(0x2, 0x8, 0x0)
socketpair$auto(0x1, 0x2, 0x8000000000000000, 0x0)
r1 = openat$auto_force_devcoredump_fops_hci_vhci(0xffffffffffffff9c, &(0x7f0000000c40)='/sys/kernel/debug/bluetooth/hci0/force_devcoredump\x00', 0x2, 0x0)
write$auto(r1, 0x0, 0xe)
mremap$auto(0x0, 0xffffffffffffffff, 0x3fd6, 0x3, 0x7fffffffb000)
mmap$auto(0x0, 0x400005, 0x800000000000df, 0x9b72, 0x2, 0x8000)
madvise$auto(0x0, 0xffffffffffff0001, 0x15)
openat$auto_proc_clear_refs_operations_internal(0xffffffffffffff9c, &(0x7f0000000600)='/proc/thread-self/clear_refs\x00', 0x2, 0x0)
mmap$auto(0x0, 0x8, 0xdf, 0x9b72, 0x2, 0x8000)
setitimer$auto(0x4, &(0x7f0000000000)={{0x1ff, 0x10001}, {0x200000000004, 0x6}}, 0x0)
openat$nci(0xffffffffffffff9c, &(0x7f0000000000), 0x2, 0x0)
sendmsg$auto_NL80211_CMD_GET_REG(0xffffffffffffffff, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000300)=ANY=[@ANYBLOB=' \x00\x00\x00', @ANYBLOB="1200", @ANYBLOB=']'], 0x1ac}}, 0x40000)
recvmmsg$auto(0xffffffffffffffff, &(0x7f0000000380)={{0x0, 0x1, &(0x7f0000000000)={0x0, 0x400}, 0x4, 0x0, 0x200002, 0x8}, 0x803}, 0xfffffff9, 0x10010, 0x0)

program did not crash
testing program (duration=9m0s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): [0, 26]
detailed listing:
executing program 6:
executing program 0:
mmap$auto(0x0, 0x4020009, 0x8000000080000000, 0x17, 0x401, 0x8000)
madvise$auto(0x0, 0xffffffffffff0005, 0x17)
openat$auto_clear_warn_once_fops_(0xffffffffffffff9c, &(0x7f0000000100), 0x210800, 0x0)
r0 = openat$auto_tty_fops_tty_io(0xffffffffffffff9c, &(0x7f0000000000)='/dev/tty46\x00', 0x0, 0x0)
close_range$auto(0x2, 0x8, 0x0)
socket(0x10, 0x2, 0x0)
socket(0x2, 0x6, 0x0)
mmap$auto(0x0, 0x400005, 0xdf, 0x9b72, 0x2, 0x8000)
socket(0xa, 0x5, 0x84)
bind$auto(0x3, 0x0, 0x6a)
ioctl$auto(0x3, 0x800005411, 0x38)
ioctl$auto(r0, 0x5600, 0x0)
mmap$auto(0x6, 0x400005, 0xffffffffffffff00, 0x9b72, r0, 0x8000)
close_range$auto(0x2, 0x8, 0x0)
socketpair$auto(0x1, 0x2, 0x8000000000000000, 0x0)
r1 = openat$auto_force_devcoredump_fops_hci_vhci(0xffffffffffffff9c, &(0x7f0000000c40)='/sys/kernel/debug/bluetooth/hci0/force_devcoredump\x00', 0x2, 0x0)
write$auto(r1, 0x0, 0xe)
mremap$auto(0x0, 0xffffffffffffffff, 0x3fd6, 0x3, 0x7fffffffb000)
mmap$auto(0x0, 0x400005, 0x800000000000df, 0x9b72, 0x2, 0x8000)
madvise$auto(0x0, 0xffffffffffff0001, 0x15)
openat$auto_proc_clear_refs_operations_internal(0xffffffffffffff9c, &(0x7f0000000600)='/proc/thread-self/clear_refs\x00', 0x2, 0x0)
mmap$auto(0x0, 0x8, 0xdf, 0x9b72, 0x2, 0x8000)
setitimer$auto(0x4, &(0x7f0000000000)={{0x1ff, 0x10001}, {0x200000000004, 0x6}}, 0x0)
bpf$auto(0x12, &(0x7f0000000000)=@info={0x2800, 0x1ff, 0x2}, 0xcf)
sendmsg$auto_NL80211_CMD_GET_REG(0xffffffffffffffff, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000300)=ANY=[@ANYBLOB=' \x00\x00\x00', @ANYBLOB="1200", @ANYBLOB=']'], 0x1ac}}, 0x40000)
recvmmsg$auto(0xffffffffffffffff, &(0x7f0000000380)={{0x0, 0x1, &(0x7f0000000000)={0x0, 0x400}, 0x4, 0x0, 0x200002, 0x8}, 0x803}, 0xfffffff9, 0x10010, 0x0)

program crashed: KASAN: slab-use-after-free Read in force_devcd_write
testing program (duration=9m0s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): [0, 25]
detailed listing:
executing program 6:
executing program 0:
mmap$auto(0x0, 0x4020009, 0x8000000080000000, 0x17, 0x401, 0x8000)
madvise$auto(0x0, 0xffffffffffff0005, 0x17)
openat$auto_clear_warn_once_fops_(0xffffffffffffff9c, &(0x7f0000000100), 0x210800, 0x0)
r0 = openat$auto_tty_fops_tty_io(0xffffffffffffff9c, &(0x7f0000000000)='/dev/tty46\x00', 0x0, 0x0)
close_range$auto(0x2, 0x8, 0x0)
socket(0x10, 0x2, 0x0)
socket(0x2, 0x6, 0x0)
mmap$auto(0x0, 0x400005, 0xdf, 0x9b72, 0x2, 0x8000)
socket(0xa, 0x5, 0x84)
bind$auto(0x3, 0x0, 0x6a)
ioctl$auto(0x3, 0x800005411, 0x38)
ioctl$auto(r0, 0x5600, 0x0)
mmap$auto(0x6, 0x400005, 0xffffffffffffff00, 0x9b72, r0, 0x8000)
close_range$auto(0x2, 0x8, 0x0)
socketpair$auto(0x1, 0x2, 0x8000000000000000, 0x0)
r1 = openat$auto_force_devcoredump_fops_hci_vhci(0xffffffffffffff9c, &(0x7f0000000c40)='/sys/kernel/debug/bluetooth/hci0/force_devcoredump\x00', 0x2, 0x0)
write$auto(r1, 0x0, 0xe)
mremap$auto(0x0, 0xffffffffffffffff, 0x3fd6, 0x3, 0x7fffffffb000)
mmap$auto(0x0, 0x400005, 0x800000000000df, 0x9b72, 0x2, 0x8000)
madvise$auto(0x0, 0xffffffffffff0001, 0x15)
openat$auto_proc_clear_refs_operations_internal(0xffffffffffffff9c, &(0x7f0000000600)='/proc/thread-self/clear_refs\x00', 0x2, 0x0)
mmap$auto(0x0, 0x8, 0xdf, 0x9b72, 0x2, 0x8000)
bpf$auto(0x12, &(0x7f0000000000)=@info={0x2800, 0x1ff, 0x2}, 0xcf)
sendmsg$auto_NL80211_CMD_GET_REG(0xffffffffffffffff, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000300)=ANY=[@ANYBLOB=' \x00\x00\x00', @ANYBLOB="1200", @ANYBLOB=']'], 0x1ac}}, 0x40000)
recvmmsg$auto(0xffffffffffffffff, &(0x7f0000000380)={{0x0, 0x1, &(0x7f0000000000)={0x0, 0x400}, 0x4, 0x0, 0x200002, 0x8}, 0x803}, 0xfffffff9, 0x10010, 0x0)

program crashed: KASAN: slab-use-after-free Read in force_devcd_write
testing program (duration=9m0s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): [0, 24]
detailed listing:
executing program 6:
executing program 0:
mmap$auto(0x0, 0x4020009, 0x8000000080000000, 0x17, 0x401, 0x8000)
madvise$auto(0x0, 0xffffffffffff0005, 0x17)
openat$auto_clear_warn_once_fops_(0xffffffffffffff9c, &(0x7f0000000100), 0x210800, 0x0)
r0 = openat$auto_tty_fops_tty_io(0xffffffffffffff9c, &(0x7f0000000000)='/dev/tty46\x00', 0x0, 0x0)
close_range$auto(0x2, 0x8, 0x0)
socket(0x10, 0x2, 0x0)
socket(0x2, 0x6, 0x0)
mmap$auto(0x0, 0x400005, 0xdf, 0x9b72, 0x2, 0x8000)
socket(0xa, 0x5, 0x84)
bind$auto(0x3, 0x0, 0x6a)
ioctl$auto(0x3, 0x800005411, 0x38)
ioctl$auto(r0, 0x5600, 0x0)
mmap$auto(0x6, 0x400005, 0xffffffffffffff00, 0x9b72, r0, 0x8000)
close_range$auto(0x2, 0x8, 0x0)
socketpair$auto(0x1, 0x2, 0x8000000000000000, 0x0)
r1 = openat$auto_force_devcoredump_fops_hci_vhci(0xffffffffffffff9c, &(0x7f0000000c40)='/sys/kernel/debug/bluetooth/hci0/force_devcoredump\x00', 0x2, 0x0)
write$auto(r1, 0x0, 0xe)
mremap$auto(0x0, 0xffffffffffffffff, 0x3fd6, 0x3, 0x7fffffffb000)
mmap$auto(0x0, 0x400005, 0x800000000000df, 0x9b72, 0x2, 0x8000)
madvise$auto(0x0, 0xffffffffffff0001, 0x15)
openat$auto_proc_clear_refs_operations_internal(0xffffffffffffff9c, &(0x7f0000000600)='/proc/thread-self/clear_refs\x00', 0x2, 0x0)
bpf$auto(0x12, &(0x7f0000000000)=@info={0x2800, 0x1ff, 0x2}, 0xcf)
sendmsg$auto_NL80211_CMD_GET_REG(0xffffffffffffffff, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000300)=ANY=[@ANYBLOB=' \x00\x00\x00', @ANYBLOB="1200", @ANYBLOB=']'], 0x1ac}}, 0x40000)
recvmmsg$auto(0xffffffffffffffff, &(0x7f0000000380)={{0x0, 0x1, &(0x7f0000000000)={0x0, 0x400}, 0x4, 0x0, 0x200002, 0x8}, 0x803}, 0xfffffff9, 0x10010, 0x0)

program crashed: KASAN: slab-use-after-free Read in force_devcd_write
testing program (duration=9m0s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): [0, 23]
detailed listing:
executing program 6:
executing program 0:
mmap$auto(0x0, 0x4020009, 0x8000000080000000, 0x17, 0x401, 0x8000)
madvise$auto(0x0, 0xffffffffffff0005, 0x17)
openat$auto_clear_warn_once_fops_(0xffffffffffffff9c, &(0x7f0000000100), 0x210800, 0x0)
r0 = openat$auto_tty_fops_tty_io(0xffffffffffffff9c, &(0x7f0000000000)='/dev/tty46\x00', 0x0, 0x0)
close_range$auto(0x2, 0x8, 0x0)
socket(0x10, 0x2, 0x0)
socket(0x2, 0x6, 0x0)
mmap$auto(0x0, 0x400005, 0xdf, 0x9b72, 0x2, 0x8000)
socket(0xa, 0x5, 0x84)
bind$auto(0x3, 0x0, 0x6a)
ioctl$auto(0x3, 0x800005411, 0x38)
ioctl$auto(r0, 0x5600, 0x0)
mmap$auto(0x6, 0x400005, 0xffffffffffffff00, 0x9b72, r0, 0x8000)
close_range$auto(0x2, 0x8, 0x0)
socketpair$auto(0x1, 0x2, 0x8000000000000000, 0x0)
r1 = openat$auto_force_devcoredump_fops_hci_vhci(0xffffffffffffff9c, &(0x7f0000000c40)='/sys/kernel/debug/bluetooth/hci0/force_devcoredump\x00', 0x2, 0x0)
write$auto(r1, 0x0, 0xe)
mremap$auto(0x0, 0xffffffffffffffff, 0x3fd6, 0x3, 0x7fffffffb000)
mmap$auto(0x0, 0x400005, 0x800000000000df, 0x9b72, 0x2, 0x8000)
madvise$auto(0x0, 0xffffffffffff0001, 0x15)
bpf$auto(0x12, &(0x7f0000000000)=@info={0x2800, 0x1ff, 0x2}, 0xcf)
sendmsg$auto_NL80211_CMD_GET_REG(0xffffffffffffffff, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000300)=ANY=[@ANYBLOB=' \x00\x00\x00', @ANYBLOB="1200", @ANYBLOB=']'], 0x1ac}}, 0x40000)
recvmmsg$auto(0xffffffffffffffff, &(0x7f0000000380)={{0x0, 0x1, &(0x7f0000000000)={0x0, 0x400}, 0x4, 0x0, 0x200002, 0x8}, 0x803}, 0xfffffff9, 0x10010, 0x0)

program crashed: KASAN: slab-use-after-free Read in force_devcd_write
testing program (duration=9m0s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): [0, 22]
detailed listing:
executing program 6:
executing program 0:
mmap$auto(0x0, 0x4020009, 0x8000000080000000, 0x17, 0x401, 0x8000)
madvise$auto(0x0, 0xffffffffffff0005, 0x17)
openat$auto_clear_warn_once_fops_(0xffffffffffffff9c, &(0x7f0000000100), 0x210800, 0x0)
r0 = openat$auto_tty_fops_tty_io(0xffffffffffffff9c, &(0x7f0000000000)='/dev/tty46\x00', 0x0, 0x0)
close_range$auto(0x2, 0x8, 0x0)
socket(0x10, 0x2, 0x0)
socket(0x2, 0x6, 0x0)
mmap$auto(0x0, 0x400005, 0xdf, 0x9b72, 0x2, 0x8000)
socket(0xa, 0x5, 0x84)
bind$auto(0x3, 0x0, 0x6a)
ioctl$auto(0x3, 0x800005411, 0x38)
ioctl$auto(r0, 0x5600, 0x0)
mmap$auto(0x6, 0x400005, 0xffffffffffffff00, 0x9b72, r0, 0x8000)
close_range$auto(0x2, 0x8, 0x0)
socketpair$auto(0x1, 0x2, 0x8000000000000000, 0x0)
r1 = openat$auto_force_devcoredump_fops_hci_vhci(0xffffffffffffff9c, &(0x7f0000000c40)='/sys/kernel/debug/bluetooth/hci0/force_devcoredump\x00', 0x2, 0x0)
write$auto(r1, 0x0, 0xe)
mremap$auto(0x0, 0xffffffffffffffff, 0x3fd6, 0x3, 0x7fffffffb000)
mmap$auto(0x0, 0x400005, 0x800000000000df, 0x9b72, 0x2, 0x8000)
bpf$auto(0x12, &(0x7f0000000000)=@info={0x2800, 0x1ff, 0x2}, 0xcf)
sendmsg$auto_NL80211_CMD_GET_REG(0xffffffffffffffff, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000300)=ANY=[@ANYBLOB=' \x00\x00\x00', @ANYBLOB="1200", @ANYBLOB=']'], 0x1ac}}, 0x40000)
recvmmsg$auto(0xffffffffffffffff, &(0x7f0000000380)={{0x0, 0x1, &(0x7f0000000000)={0x0, 0x400}, 0x4, 0x0, 0x200002, 0x8}, 0x803}, 0xfffffff9, 0x10010, 0x0)

program did not crash
testing program (duration=9m0s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): [0, 22]
detailed listing:
executing program 6:
executing program 0:
mmap$auto(0x0, 0x4020009, 0x8000000080000000, 0x17, 0x401, 0x8000)
madvise$auto(0x0, 0xffffffffffff0005, 0x17)
openat$auto_clear_warn_once_fops_(0xffffffffffffff9c, &(0x7f0000000100), 0x210800, 0x0)
r0 = openat$auto_tty_fops_tty_io(0xffffffffffffff9c, &(0x7f0000000000)='/dev/tty46\x00', 0x0, 0x0)
close_range$auto(0x2, 0x8, 0x0)
socket(0x10, 0x2, 0x0)
socket(0x2, 0x6, 0x0)
mmap$auto(0x0, 0x400005, 0xdf, 0x9b72, 0x2, 0x8000)
socket(0xa, 0x5, 0x84)
bind$auto(0x3, 0x0, 0x6a)
ioctl$auto(0x3, 0x800005411, 0x38)
ioctl$auto(r0, 0x5600, 0x0)
mmap$auto(0x6, 0x400005, 0xffffffffffffff00, 0x9b72, r0, 0x8000)
close_range$auto(0x2, 0x8, 0x0)
socketpair$auto(0x1, 0x2, 0x8000000000000000, 0x0)
r1 = openat$auto_force_devcoredump_fops_hci_vhci(0xffffffffffffff9c, &(0x7f0000000c40)='/sys/kernel/debug/bluetooth/hci0/force_devcoredump\x00', 0x2, 0x0)
write$auto(r1, 0x0, 0xe)
mremap$auto(0x0, 0xffffffffffffffff, 0x3fd6, 0x3, 0x7fffffffb000)
madvise$auto(0x0, 0xffffffffffff0001, 0x15)
bpf$auto(0x12, &(0x7f0000000000)=@info={0x2800, 0x1ff, 0x2}, 0xcf)
sendmsg$auto_NL80211_CMD_GET_REG(0xffffffffffffffff, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000300)=ANY=[@ANYBLOB=' \x00\x00\x00', @ANYBLOB="1200", @ANYBLOB=']'], 0x1ac}}, 0x40000)
recvmmsg$auto(0xffffffffffffffff, &(0x7f0000000380)={{0x0, 0x1, &(0x7f0000000000)={0x0, 0x400}, 0x4, 0x0, 0x200002, 0x8}, 0x803}, 0xfffffff9, 0x10010, 0x0)

program crashed: KASAN: slab-use-after-free Read in force_devcd_write
testing program (duration=9m0s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): [0, 21]
detailed listing:
executing program 6:
executing program 0:
mmap$auto(0x0, 0x4020009, 0x8000000080000000, 0x17, 0x401, 0x8000)
madvise$auto(0x0, 0xffffffffffff0005, 0x17)
openat$auto_clear_warn_once_fops_(0xffffffffffffff9c, &(0x7f0000000100), 0x210800, 0x0)
r0 = openat$auto_tty_fops_tty_io(0xffffffffffffff9c, &(0x7f0000000000)='/dev/tty46\x00', 0x0, 0x0)
close_range$auto(0x2, 0x8, 0x0)
socket(0x10, 0x2, 0x0)
socket(0x2, 0x6, 0x0)
mmap$auto(0x0, 0x400005, 0xdf, 0x9b72, 0x2, 0x8000)
socket(0xa, 0x5, 0x84)
bind$auto(0x3, 0x0, 0x6a)
ioctl$auto(0x3, 0x800005411, 0x38)
ioctl$auto(r0, 0x5600, 0x0)
mmap$auto(0x6, 0x400005, 0xffffffffffffff00, 0x9b72, r0, 0x8000)
close_range$auto(0x2, 0x8, 0x0)
socketpair$auto(0x1, 0x2, 0x8000000000000000, 0x0)
r1 = openat$auto_force_devcoredump_fops_hci_vhci(0xffffffffffffff9c, &(0x7f0000000c40)='/sys/kernel/debug/bluetooth/hci0/force_devcoredump\x00', 0x2, 0x0)
write$auto(r1, 0x0, 0xe)
madvise$auto(0x0, 0xffffffffffff0001, 0x15)
bpf$auto(0x12, &(0x7f0000000000)=@info={0x2800, 0x1ff, 0x2}, 0xcf)
sendmsg$auto_NL80211_CMD_GET_REG(0xffffffffffffffff, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000300)=ANY=[@ANYBLOB=' \x00\x00\x00', @ANYBLOB="1200", @ANYBLOB=']'], 0x1ac}}, 0x40000)
recvmmsg$auto(0xffffffffffffffff, &(0x7f0000000380)={{0x0, 0x1, &(0x7f0000000000)={0x0, 0x400}, 0x4, 0x0, 0x200002, 0x8}, 0x803}, 0xfffffff9, 0x10010, 0x0)

program crashed: KASAN: slab-use-after-free Read in force_devcd_write
testing program (duration=9m0s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): [0, 20]
detailed listing:
executing program 6:
executing program 0:
mmap$auto(0x0, 0x4020009, 0x8000000080000000, 0x17, 0x401, 0x8000)
madvise$auto(0x0, 0xffffffffffff0005, 0x17)
openat$auto_clear_warn_once_fops_(0xffffffffffffff9c, &(0x7f0000000100), 0x210800, 0x0)
r0 = openat$auto_tty_fops_tty_io(0xffffffffffffff9c, &(0x7f0000000000)='/dev/tty46\x00', 0x0, 0x0)
close_range$auto(0x2, 0x8, 0x0)
socket(0x10, 0x2, 0x0)
socket(0x2, 0x6, 0x0)
mmap$auto(0x0, 0x400005, 0xdf, 0x9b72, 0x2, 0x8000)
socket(0xa, 0x5, 0x84)
bind$auto(0x3, 0x0, 0x6a)
ioctl$auto(0x3, 0x800005411, 0x38)
ioctl$auto(r0, 0x5600, 0x0)
mmap$auto(0x6, 0x400005, 0xffffffffffffff00, 0x9b72, r0, 0x8000)
close_range$auto(0x2, 0x8, 0x0)
socketpair$auto(0x1, 0x2, 0x8000000000000000, 0x0)
openat$auto_force_devcoredump_fops_hci_vhci(0xffffffffffffff9c, &(0x7f0000000c40)='/sys/kernel/debug/bluetooth/hci0/force_devcoredump\x00', 0x2, 0x0)
madvise$auto(0x0, 0xffffffffffff0001, 0x15)
bpf$auto(0x12, &(0x7f0000000000)=@info={0x2800, 0x1ff, 0x2}, 0xcf)
sendmsg$auto_NL80211_CMD_GET_REG(0xffffffffffffffff, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000300)=ANY=[@ANYBLOB=' \x00\x00\x00', @ANYBLOB="1200", @ANYBLOB=']'], 0x1ac}}, 0x40000)
recvmmsg$auto(0xffffffffffffffff, &(0x7f0000000380)={{0x0, 0x1, &(0x7f0000000000)={0x0, 0x400}, 0x4, 0x0, 0x200002, 0x8}, 0x803}, 0xfffffff9, 0x10010, 0x0)

program did not crash
testing program (duration=9m0s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): [0, 20]
detailed listing:
executing program 6:
executing program 0:
mmap$auto(0x0, 0x4020009, 0x8000000080000000, 0x17, 0x401, 0x8000)
madvise$auto(0x0, 0xffffffffffff0005, 0x17)
openat$auto_clear_warn_once_fops_(0xffffffffffffff9c, &(0x7f0000000100), 0x210800, 0x0)
r0 = openat$auto_tty_fops_tty_io(0xffffffffffffff9c, &(0x7f0000000000)='/dev/tty46\x00', 0x0, 0x0)
close_range$auto(0x2, 0x8, 0x0)
socket(0x10, 0x2, 0x0)
socket(0x2, 0x6, 0x0)
mmap$auto(0x0, 0x400005, 0xdf, 0x9b72, 0x2, 0x8000)
socket(0xa, 0x5, 0x84)
bind$auto(0x3, 0x0, 0x6a)
ioctl$auto(0x3, 0x800005411, 0x38)
ioctl$auto(r0, 0x5600, 0x0)
mmap$auto(0x6, 0x400005, 0xffffffffffffff00, 0x9b72, r0, 0x8000)
close_range$auto(0x2, 0x8, 0x0)
socketpair$auto(0x1, 0x2, 0x8000000000000000, 0x0)
write$auto(0xffffffffffffffff, 0x0, 0xe)
madvise$auto(0x0, 0xffffffffffff0001, 0x15)
bpf$auto(0x12, &(0x7f0000000000)=@info={0x2800, 0x1ff, 0x2}, 0xcf)
sendmsg$auto_NL80211_CMD_GET_REG(0xffffffffffffffff, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000300)=ANY=[@ANYBLOB=' \x00\x00\x00', @ANYBLOB="1200", @ANYBLOB=']'], 0x1ac}}, 0x40000)
recvmmsg$auto(0xffffffffffffffff, &(0x7f0000000380)={{0x0, 0x1, &(0x7f0000000000)={0x0, 0x400}, 0x4, 0x0, 0x200002, 0x8}, 0x803}, 0xfffffff9, 0x10010, 0x0)

program did not crash
testing program (duration=9m0s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): [0, 20]
detailed listing:
executing program 6:
executing program 0:
mmap$auto(0x0, 0x4020009, 0x8000000080000000, 0x17, 0x401, 0x8000)
madvise$auto(0x0, 0xffffffffffff0005, 0x17)
openat$auto_clear_warn_once_fops_(0xffffffffffffff9c, &(0x7f0000000100), 0x210800, 0x0)
r0 = openat$auto_tty_fops_tty_io(0xffffffffffffff9c, &(0x7f0000000000)='/dev/tty46\x00', 0x0, 0x0)
close_range$auto(0x2, 0x8, 0x0)
socket(0x10, 0x2, 0x0)
socket(0x2, 0x6, 0x0)
mmap$auto(0x0, 0x400005, 0xdf, 0x9b72, 0x2, 0x8000)
socket(0xa, 0x5, 0x84)
bind$auto(0x3, 0x0, 0x6a)
ioctl$auto(0x3, 0x800005411, 0x38)
ioctl$auto(r0, 0x5600, 0x0)
mmap$auto(0x6, 0x400005, 0xffffffffffffff00, 0x9b72, r0, 0x8000)
close_range$auto(0x2, 0x8, 0x0)
r1 = openat$auto_force_devcoredump_fops_hci_vhci(0xffffffffffffff9c, &(0x7f0000000c40)='/sys/kernel/debug/bluetooth/hci0/force_devcoredump\x00', 0x2, 0x0)
write$auto(r1, 0x0, 0xe)
madvise$auto(0x0, 0xffffffffffff0001, 0x15)
bpf$auto(0x12, &(0x7f0000000000)=@info={0x2800, 0x1ff, 0x2}, 0xcf)
sendmsg$auto_NL80211_CMD_GET_REG(0xffffffffffffffff, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000300)=ANY=[@ANYBLOB=' \x00\x00\x00', @ANYBLOB="1200", @ANYBLOB=']'], 0x1ac}}, 0x40000)
recvmmsg$auto(0xffffffffffffffff, &(0x7f0000000380)={{0x0, 0x1, &(0x7f0000000000)={0x0, 0x400}, 0x4, 0x0, 0x200002, 0x8}, 0x803}, 0xfffffff9, 0x10010, 0x0)

program crashed: KASAN: slab-use-after-free Read in force_devcd_write
testing program (duration=9m0s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): [0, 19]
detailed listing:
executing program 6:
executing program 0:
mmap$auto(0x0, 0x4020009, 0x8000000080000000, 0x17, 0x401, 0x8000)
madvise$auto(0x0, 0xffffffffffff0005, 0x17)
openat$auto_clear_warn_once_fops_(0xffffffffffffff9c, &(0x7f0000000100), 0x210800, 0x0)
r0 = openat$auto_tty_fops_tty_io(0xffffffffffffff9c, &(0x7f0000000000)='/dev/tty46\x00', 0x0, 0x0)
close_range$auto(0x2, 0x8, 0x0)
socket(0x10, 0x2, 0x0)
socket(0x2, 0x6, 0x0)
mmap$auto(0x0, 0x400005, 0xdf, 0x9b72, 0x2, 0x8000)
socket(0xa, 0x5, 0x84)
bind$auto(0x3, 0x0, 0x6a)
ioctl$auto(0x3, 0x800005411, 0x38)
ioctl$auto(r0, 0x5600, 0x0)
mmap$auto(0x6, 0x400005, 0xffffffffffffff00, 0x9b72, r0, 0x8000)
r1 = openat$auto_force_devcoredump_fops_hci_vhci(0xffffffffffffff9c, &(0x7f0000000c40)='/sys/kernel/debug/bluetooth/hci0/force_devcoredump\x00', 0x2, 0x0)
write$auto(r1, 0x0, 0xe)
madvise$auto(0x0, 0xffffffffffff0001, 0x15)
bpf$auto(0x12, &(0x7f0000000000)=@info={0x2800, 0x1ff, 0x2}, 0xcf)
sendmsg$auto_NL80211_CMD_GET_REG(0xffffffffffffffff, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000300)=ANY=[@ANYBLOB=' \x00\x00\x00', @ANYBLOB="1200", @ANYBLOB=']'], 0x1ac}}, 0x40000)
recvmmsg$auto(0xffffffffffffffff, &(0x7f0000000380)={{0x0, 0x1, &(0x7f0000000000)={0x0, 0x400}, 0x4, 0x0, 0x200002, 0x8}, 0x803}, 0xfffffff9, 0x10010, 0x0)

program crashed: KASAN: slab-use-after-free Read in force_devcd_write
testing program (duration=9m0s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): [0, 18]
detailed listing:
executing program 6:
executing program 0:
mmap$auto(0x0, 0x4020009, 0x8000000080000000, 0x17, 0x401, 0x8000)
madvise$auto(0x0, 0xffffffffffff0005, 0x17)
openat$auto_clear_warn_once_fops_(0xffffffffffffff9c, &(0x7f0000000100), 0x210800, 0x0)
r0 = openat$auto_tty_fops_tty_io(0xffffffffffffff9c, &(0x7f0000000000)='/dev/tty46\x00', 0x0, 0x0)
close_range$auto(0x2, 0x8, 0x0)
socket(0x10, 0x2, 0x0)
socket(0x2, 0x6, 0x0)
mmap$auto(0x0, 0x400005, 0xdf, 0x9b72, 0x2, 0x8000)
socket(0xa, 0x5, 0x84)
bind$auto(0x3, 0x0, 0x6a)
ioctl$auto(0x3, 0x800005411, 0x38)
ioctl$auto(r0, 0x5600, 0x0)
r1 = openat$auto_force_devcoredump_fops_hci_vhci(0xffffffffffffff9c, &(0x7f0000000c40)='/sys/kernel/debug/bluetooth/hci0/force_devcoredump\x00', 0x2, 0x0)
write$auto(r1, 0x0, 0xe)
madvise$auto(0x0, 0xffffffffffff0001, 0x15)
bpf$auto(0x12, &(0x7f0000000000)=@info={0x2800, 0x1ff, 0x2}, 0xcf)
sendmsg$auto_NL80211_CMD_GET_REG(0xffffffffffffffff, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000300)=ANY=[@ANYBLOB=' \x00\x00\x00', @ANYBLOB="1200", @ANYBLOB=']'], 0x1ac}}, 0x40000)
recvmmsg$auto(0xffffffffffffffff, &(0x7f0000000380)={{0x0, 0x1, &(0x7f0000000000)={0x0, 0x400}, 0x4, 0x0, 0x200002, 0x8}, 0x803}, 0xfffffff9, 0x10010, 0x0)

program crashed: KASAN: slab-use-after-free Read in force_devcd_write
testing program (duration=9m0s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): [0, 17]
detailed listing:
executing program 6:
executing program 0:
mmap$auto(0x0, 0x4020009, 0x8000000080000000, 0x17, 0x401, 0x8000)
madvise$auto(0x0, 0xffffffffffff0005, 0x17)
openat$auto_clear_warn_once_fops_(0xffffffffffffff9c, &(0x7f0000000100), 0x210800, 0x0)
openat$auto_tty_fops_tty_io(0xffffffffffffff9c, &(0x7f0000000000)='/dev/tty46\x00', 0x0, 0x0)
close_range$auto(0x2, 0x8, 0x0)
socket(0x10, 0x2, 0x0)
socket(0x2, 0x6, 0x0)
mmap$auto(0x0, 0x400005, 0xdf, 0x9b72, 0x2, 0x8000)
socket(0xa, 0x5, 0x84)
bind$auto(0x3, 0x0, 0x6a)
ioctl$auto(0x3, 0x800005411, 0x38)
r0 = openat$auto_force_devcoredump_fops_hci_vhci(0xffffffffffffff9c, &(0x7f0000000c40)='/sys/kernel/debug/bluetooth/hci0/force_devcoredump\x00', 0x2, 0x0)
write$auto(r0, 0x0, 0xe)
madvise$auto(0x0, 0xffffffffffff0001, 0x15)
bpf$auto(0x12, &(0x7f0000000000)=@info={0x2800, 0x1ff, 0x2}, 0xcf)
sendmsg$auto_NL80211_CMD_GET_REG(0xffffffffffffffff, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000300)=ANY=[@ANYBLOB=' \x00\x00\x00', @ANYBLOB="1200", @ANYBLOB=']'], 0x1ac}}, 0x40000)
recvmmsg$auto(0xffffffffffffffff, &(0x7f0000000380)={{0x0, 0x1, &(0x7f0000000000)={0x0, 0x400}, 0x4, 0x0, 0x200002, 0x8}, 0x803}, 0xfffffff9, 0x10010, 0x0)

program crashed: KASAN: slab-use-after-free Read in force_devcd_write
testing program (duration=9m0s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): [0, 16]
detailed listing:
executing program 6:
executing program 0:
mmap$auto(0x0, 0x4020009, 0x8000000080000000, 0x17, 0x401, 0x8000)
madvise$auto(0x0, 0xffffffffffff0005, 0x17)
openat$auto_clear_warn_once_fops_(0xffffffffffffff9c, &(0x7f0000000100), 0x210800, 0x0)
openat$auto_tty_fops_tty_io(0xffffffffffffff9c, &(0x7f0000000000)='/dev/tty46\x00', 0x0, 0x0)
close_range$auto(0x2, 0x8, 0x0)
socket(0x10, 0x2, 0x0)
socket(0x2, 0x6, 0x0)
mmap$auto(0x0, 0x400005, 0xdf, 0x9b72, 0x2, 0x8000)
socket(0xa, 0x5, 0x84)
bind$auto(0x3, 0x0, 0x6a)
r0 = openat$auto_force_devcoredump_fops_hci_vhci(0xffffffffffffff9c, &(0x7f0000000c40)='/sys/kernel/debug/bluetooth/hci0/force_devcoredump\x00', 0x2, 0x0)
write$auto(r0, 0x0, 0xe)
madvise$auto(0x0, 0xffffffffffff0001, 0x15)
bpf$auto(0x12, &(0x7f0000000000)=@info={0x2800, 0x1ff, 0x2}, 0xcf)
sendmsg$auto_NL80211_CMD_GET_REG(0xffffffffffffffff, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000300)=ANY=[@ANYBLOB=' \x00\x00\x00', @ANYBLOB="1200", @ANYBLOB=']'], 0x1ac}}, 0x40000)
recvmmsg$auto(0xffffffffffffffff, &(0x7f0000000380)={{0x0, 0x1, &(0x7f0000000000)={0x0, 0x400}, 0x4, 0x0, 0x200002, 0x8}, 0x803}, 0xfffffff9, 0x10010, 0x0)

program crashed: KASAN: slab-use-after-free Read in force_devcd_write
testing program (duration=9m0s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): [0, 15]
detailed listing:
executing program 6:
executing program 0:
mmap$auto(0x0, 0x4020009, 0x8000000080000000, 0x17, 0x401, 0x8000)
madvise$auto(0x0, 0xffffffffffff0005, 0x17)
openat$auto_clear_warn_once_fops_(0xffffffffffffff9c, &(0x7f0000000100), 0x210800, 0x0)
openat$auto_tty_fops_tty_io(0xffffffffffffff9c, &(0x7f0000000000)='/dev/tty46\x00', 0x0, 0x0)
close_range$auto(0x2, 0x8, 0x0)
socket(0x10, 0x2, 0x0)
socket(0x2, 0x6, 0x0)
mmap$auto(0x0, 0x400005, 0xdf, 0x9b72, 0x2, 0x8000)
socket(0xa, 0x5, 0x84)
r0 = openat$auto_force_devcoredump_fops_hci_vhci(0xffffffffffffff9c, &(0x7f0000000c40)='/sys/kernel/debug/bluetooth/hci0/force_devcoredump\x00', 0x2, 0x0)
write$auto(r0, 0x0, 0xe)
madvise$auto(0x0, 0xffffffffffff0001, 0x15)
bpf$auto(0x12, &(0x7f0000000000)=@info={0x2800, 0x1ff, 0x2}, 0xcf)
sendmsg$auto_NL80211_CMD_GET_REG(0xffffffffffffffff, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000300)=ANY=[@ANYBLOB=' \x00\x00\x00', @ANYBLOB="1200", @ANYBLOB=']'], 0x1ac}}, 0x40000)
recvmmsg$auto(0xffffffffffffffff, &(0x7f0000000380)={{0x0, 0x1, &(0x7f0000000000)={0x0, 0x400}, 0x4, 0x0, 0x200002, 0x8}, 0x803}, 0xfffffff9, 0x10010, 0x0)

program crashed: KASAN: slab-use-after-free Read in force_devcd_write
testing program (duration=9m0s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): [0, 14]
detailed listing:
executing program 6:
executing program 0:
mmap$auto(0x0, 0x4020009, 0x8000000080000000, 0x17, 0x401, 0x8000)
madvise$auto(0x0, 0xffffffffffff0005, 0x17)
openat$auto_clear_warn_once_fops_(0xffffffffffffff9c, &(0x7f0000000100), 0x210800, 0x0)
openat$auto_tty_fops_tty_io(0xffffffffffffff9c, &(0x7f0000000000)='/dev/tty46\x00', 0x0, 0x0)
close_range$auto(0x2, 0x8, 0x0)
socket(0x10, 0x2, 0x0)
socket(0x2, 0x6, 0x0)
mmap$auto(0x0, 0x400005, 0xdf, 0x9b72, 0x2, 0x8000)
r0 = openat$auto_force_devcoredump_fops_hci_vhci(0xffffffffffffff9c, &(0x7f0000000c40)='/sys/kernel/debug/bluetooth/hci0/force_devcoredump\x00', 0x2, 0x0)
write$auto(r0, 0x0, 0xe)
madvise$auto(0x0, 0xffffffffffff0001, 0x15)
bpf$auto(0x12, &(0x7f0000000000)=@info={0x2800, 0x1ff, 0x2}, 0xcf)
sendmsg$auto_NL80211_CMD_GET_REG(0xffffffffffffffff, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000300)=ANY=[@ANYBLOB=' \x00\x00\x00', @ANYBLOB="1200", @ANYBLOB=']'], 0x1ac}}, 0x40000)
recvmmsg$auto(0xffffffffffffffff, &(0x7f0000000380)={{0x0, 0x1, &(0x7f0000000000)={0x0, 0x400}, 0x4, 0x0, 0x200002, 0x8}, 0x803}, 0xfffffff9, 0x10010, 0x0)

program crashed: KASAN: slab-use-after-free Read in force_devcd_write
testing program (duration=9m0s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): [0, 13]
detailed listing:
executing program 6:
executing program 0:
mmap$auto(0x0, 0x4020009, 0x8000000080000000, 0x17, 0x401, 0x8000)
madvise$auto(0x0, 0xffffffffffff0005, 0x17)
openat$auto_clear_warn_once_fops_(0xffffffffffffff9c, &(0x7f0000000100), 0x210800, 0x0)
openat$auto_tty_fops_tty_io(0xffffffffffffff9c, &(0x7f0000000000)='/dev/tty46\x00', 0x0, 0x0)
close_range$auto(0x2, 0x8, 0x0)
socket(0x10, 0x2, 0x0)
socket(0x2, 0x6, 0x0)
r0 = openat$auto_force_devcoredump_fops_hci_vhci(0xffffffffffffff9c, &(0x7f0000000c40)='/sys/kernel/debug/bluetooth/hci0/force_devcoredump\x00', 0x2, 0x0)
write$auto(r0, 0x0, 0xe)
madvise$auto(0x0, 0xffffffffffff0001, 0x15)
bpf$auto(0x12, &(0x7f0000000000)=@info={0x2800, 0x1ff, 0x2}, 0xcf)
sendmsg$auto_NL80211_CMD_GET_REG(0xffffffffffffffff, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000300)=ANY=[@ANYBLOB=' \x00\x00\x00', @ANYBLOB="1200", @ANYBLOB=']'], 0x1ac}}, 0x40000)
recvmmsg$auto(0xffffffffffffffff, &(0x7f0000000380)={{0x0, 0x1, &(0x7f0000000000)={0x0, 0x400}, 0x4, 0x0, 0x200002, 0x8}, 0x803}, 0xfffffff9, 0x10010, 0x0)

program did not crash
testing program (duration=9m0s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): [0, 13]
detailed listing:
executing program 6:
executing program 0:
mmap$auto(0x0, 0x4020009, 0x8000000080000000, 0x17, 0x401, 0x8000)
madvise$auto(0x0, 0xffffffffffff0005, 0x17)
openat$auto_clear_warn_once_fops_(0xffffffffffffff9c, &(0x7f0000000100), 0x210800, 0x0)
openat$auto_tty_fops_tty_io(0xffffffffffffff9c, &(0x7f0000000000)='/dev/tty46\x00', 0x0, 0x0)
close_range$auto(0x2, 0x8, 0x0)
socket(0x10, 0x2, 0x0)
mmap$auto(0x0, 0x400005, 0xdf, 0x9b72, 0x2, 0x8000)
r0 = openat$auto_force_devcoredump_fops_hci_vhci(0xffffffffffffff9c, &(0x7f0000000c40)='/sys/kernel/debug/bluetooth/hci0/force_devcoredump\x00', 0x2, 0x0)
write$auto(r0, 0x0, 0xe)
madvise$auto(0x0, 0xffffffffffff0001, 0x15)
bpf$auto(0x12, &(0x7f0000000000)=@info={0x2800, 0x1ff, 0x2}, 0xcf)
sendmsg$auto_NL80211_CMD_GET_REG(0xffffffffffffffff, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000300)=ANY=[@ANYBLOB=' \x00\x00\x00', @ANYBLOB="1200", @ANYBLOB=']'], 0x1ac}}, 0x40000)
recvmmsg$auto(0xffffffffffffffff, &(0x7f0000000380)={{0x0, 0x1, &(0x7f0000000000)={0x0, 0x400}, 0x4, 0x0, 0x200002, 0x8}, 0x803}, 0xfffffff9, 0x10010, 0x0)

program crashed: KASAN: slab-use-after-free Read in force_devcd_write
testing program (duration=9m0s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): [0, 12]
detailed listing:
executing program 6:
executing program 0:
mmap$auto(0x0, 0x4020009, 0x8000000080000000, 0x17, 0x401, 0x8000)
madvise$auto(0x0, 0xffffffffffff0005, 0x17)
openat$auto_clear_warn_once_fops_(0xffffffffffffff9c, &(0x7f0000000100), 0x210800, 0x0)
openat$auto_tty_fops_tty_io(0xffffffffffffff9c, &(0x7f0000000000)='/dev/tty46\x00', 0x0, 0x0)
close_range$auto(0x2, 0x8, 0x0)
mmap$auto(0x0, 0x400005, 0xdf, 0x9b72, 0x2, 0x8000)
r0 = openat$auto_force_devcoredump_fops_hci_vhci(0xffffffffffffff9c, &(0x7f0000000c40)='/sys/kernel/debug/bluetooth/hci0/force_devcoredump\x00', 0x2, 0x0)
write$auto(r0, 0x0, 0xe)
madvise$auto(0x0, 0xffffffffffff0001, 0x15)
bpf$auto(0x12, &(0x7f0000000000)=@info={0x2800, 0x1ff, 0x2}, 0xcf)
sendmsg$auto_NL80211_CMD_GET_REG(0xffffffffffffffff, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000300)=ANY=[@ANYBLOB=' \x00\x00\x00', @ANYBLOB="1200", @ANYBLOB=']'], 0x1ac}}, 0x40000)
recvmmsg$auto(0xffffffffffffffff, &(0x7f0000000380)={{0x0, 0x1, &(0x7f0000000000)={0x0, 0x400}, 0x4, 0x0, 0x200002, 0x8}, 0x803}, 0xfffffff9, 0x10010, 0x0)

program crashed: WARNING: ODEBUG bug in hci_release_dev
testing program (duration=9m0s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): [0, 11]
detailed listing:
executing program 6:
executing program 0:
mmap$auto(0x0, 0x4020009, 0x8000000080000000, 0x17, 0x401, 0x8000)
madvise$auto(0x0, 0xffffffffffff0005, 0x17)
openat$auto_clear_warn_once_fops_(0xffffffffffffff9c, &(0x7f0000000100), 0x210800, 0x0)
openat$auto_tty_fops_tty_io(0xffffffffffffff9c, &(0x7f0000000000)='/dev/tty46\x00', 0x0, 0x0)
mmap$auto(0x0, 0x400005, 0xdf, 0x9b72, 0x2, 0x8000)
r0 = openat$auto_force_devcoredump_fops_hci_vhci(0xffffffffffffff9c, &(0x7f0000000c40)='/sys/kernel/debug/bluetooth/hci0/force_devcoredump\x00', 0x2, 0x0)
write$auto(r0, 0x0, 0xe)
madvise$auto(0x0, 0xffffffffffff0001, 0x15)
bpf$auto(0x12, &(0x7f0000000000)=@info={0x2800, 0x1ff, 0x2}, 0xcf)
sendmsg$auto_NL80211_CMD_GET_REG(0xffffffffffffffff, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000300)=ANY=[@ANYBLOB=' \x00\x00\x00', @ANYBLOB="1200", @ANYBLOB=']'], 0x1ac}}, 0x40000)
recvmmsg$auto(0xffffffffffffffff, &(0x7f0000000380)={{0x0, 0x1, &(0x7f0000000000)={0x0, 0x400}, 0x4, 0x0, 0x200002, 0x8}, 0x803}, 0xfffffff9, 0x10010, 0x0)

program crashed: KASAN: slab-use-after-free Read in force_devcd_write
testing program (duration=9m0s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): [0, 10]
detailed listing:
executing program 6:
executing program 0:
mmap$auto(0x0, 0x4020009, 0x8000000080000000, 0x17, 0x401, 0x8000)
madvise$auto(0x0, 0xffffffffffff0005, 0x17)
openat$auto_clear_warn_once_fops_(0xffffffffffffff9c, &(0x7f0000000100), 0x210800, 0x0)
mmap$auto(0x0, 0x400005, 0xdf, 0x9b72, 0x2, 0x8000)
r0 = openat$auto_force_devcoredump_fops_hci_vhci(0xffffffffffffff9c, &(0x7f0000000c40)='/sys/kernel/debug/bluetooth/hci0/force_devcoredump\x00', 0x2, 0x0)
write$auto(r0, 0x0, 0xe)
madvise$auto(0x0, 0xffffffffffff0001, 0x15)
bpf$auto(0x12, &(0x7f0000000000)=@info={0x2800, 0x1ff, 0x2}, 0xcf)
sendmsg$auto_NL80211_CMD_GET_REG(0xffffffffffffffff, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000300)=ANY=[@ANYBLOB=' \x00\x00\x00', @ANYBLOB="1200", @ANYBLOB=']'], 0x1ac}}, 0x40000)
recvmmsg$auto(0xffffffffffffffff, &(0x7f0000000380)={{0x0, 0x1, &(0x7f0000000000)={0x0, 0x400}, 0x4, 0x0, 0x200002, 0x8}, 0x803}, 0xfffffff9, 0x10010, 0x0)

program crashed: KASAN: slab-use-after-free Read in force_devcd_write
testing program (duration=9m0s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): [0, 9]
detailed listing:
executing program 6:
executing program 0:
mmap$auto(0x0, 0x4020009, 0x8000000080000000, 0x17, 0x401, 0x8000)
madvise$auto(0x0, 0xffffffffffff0005, 0x17)
mmap$auto(0x0, 0x400005, 0xdf, 0x9b72, 0x2, 0x8000)
r0 = openat$auto_force_devcoredump_fops_hci_vhci(0xffffffffffffff9c, &(0x7f0000000c40)='/sys/kernel/debug/bluetooth/hci0/force_devcoredump\x00', 0x2, 0x0)
write$auto(r0, 0x0, 0xe)
madvise$auto(0x0, 0xffffffffffff0001, 0x15)
bpf$auto(0x12, &(0x7f0000000000)=@info={0x2800, 0x1ff, 0x2}, 0xcf)
sendmsg$auto_NL80211_CMD_GET_REG(0xffffffffffffffff, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000300)=ANY=[@ANYBLOB=' \x00\x00\x00', @ANYBLOB="1200", @ANYBLOB=']'], 0x1ac}}, 0x40000)
recvmmsg$auto(0xffffffffffffffff, &(0x7f0000000380)={{0x0, 0x1, &(0x7f0000000000)={0x0, 0x400}, 0x4, 0x0, 0x200002, 0x8}, 0x803}, 0xfffffff9, 0x10010, 0x0)

program did not crash
testing program (duration=9m0s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): [0, 9]
detailed listing:
executing program 6:
executing program 0:
mmap$auto(0x0, 0x4020009, 0x8000000080000000, 0x17, 0x401, 0x8000)
openat$auto_clear_warn_once_fops_(0xffffffffffffff9c, &(0x7f0000000100), 0x210800, 0x0)
mmap$auto(0x0, 0x400005, 0xdf, 0x9b72, 0x2, 0x8000)
r0 = openat$auto_force_devcoredump_fops_hci_vhci(0xffffffffffffff9c, &(0x7f0000000c40)='/sys/kernel/debug/bluetooth/hci0/force_devcoredump\x00', 0x2, 0x0)
write$auto(r0, 0x0, 0xe)
madvise$auto(0x0, 0xffffffffffff0001, 0x15)
bpf$auto(0x12, &(0x7f0000000000)=@info={0x2800, 0x1ff, 0x2}, 0xcf)
sendmsg$auto_NL80211_CMD_GET_REG(0xffffffffffffffff, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000300)=ANY=[@ANYBLOB=' \x00\x00\x00', @ANYBLOB="1200", @ANYBLOB=']'], 0x1ac}}, 0x40000)
recvmmsg$auto(0xffffffffffffffff, &(0x7f0000000380)={{0x0, 0x1, &(0x7f0000000000)={0x0, 0x400}, 0x4, 0x0, 0x200002, 0x8}, 0x803}, 0xfffffff9, 0x10010, 0x0)

program crashed: KASAN: slab-use-after-free Read in force_devcd_write
testing program (duration=9m0s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): [0, 8]
detailed listing:
executing program 6:
executing program 0:
openat$auto_clear_warn_once_fops_(0xffffffffffffff9c, &(0x7f0000000100), 0x210800, 0x0)
mmap$auto(0x0, 0x400005, 0xdf, 0x9b72, 0x2, 0x8000)
r0 = openat$auto_force_devcoredump_fops_hci_vhci(0xffffffffffffff9c, &(0x7f0000000c40)='/sys/kernel/debug/bluetooth/hci0/force_devcoredump\x00', 0x2, 0x0)
write$auto(r0, 0x0, 0xe)
madvise$auto(0x0, 0xffffffffffff0001, 0x15)
bpf$auto(0x12, &(0x7f0000000000)=@info={0x2800, 0x1ff, 0x2}, 0xcf)
sendmsg$auto_NL80211_CMD_GET_REG(0xffffffffffffffff, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000300)=ANY=[@ANYBLOB=' \x00\x00\x00', @ANYBLOB="1200", @ANYBLOB=']'], 0x1ac}}, 0x40000)
recvmmsg$auto(0xffffffffffffffff, &(0x7f0000000380)={{0x0, 0x1, &(0x7f0000000000)={0x0, 0x400}, 0x4, 0x0, 0x200002, 0x8}, 0x803}, 0xfffffff9, 0x10010, 0x0)

program crashed: KASAN: slab-use-after-free Read in force_devcd_write
minimized 30 calls -> 8 calls
testing program (duration=9m0s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): openat$auto_clear_warn_once_fops_-mmap$auto-openat$auto_force_devcoredump_fops_hci_vhci-write$auto-madvise$auto-bpf$auto-sendmsg$auto_NL80211_CMD_GET_REG-recvmmsg$auto
detailed listing:
executing program 0:
openat$auto_clear_warn_once_fops_(0xffffffffffffff9c, &(0x7f0000000100), 0x210800, 0x0)
mmap$auto(0x0, 0x400005, 0xdf, 0x9b72, 0x2, 0x8000)
r0 = openat$auto_force_devcoredump_fops_hci_vhci(0xffffffffffffff9c, &(0x7f0000000c40)='/sys/kernel/debug/bluetooth/hci0/force_devcoredump\x00', 0x2, 0x0)
write$auto(r0, 0x0, 0xe)
madvise$auto(0x0, 0xffffffffffff0001, 0x15)
bpf$auto(0x12, &(0x7f0000000000)=@info={0x2800, 0x1ff, 0x2}, 0xcf)
sendmsg$auto_NL80211_CMD_GET_REG(0xffffffffffffffff, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000300)=ANY=[@ANYBLOB=' \x00\x00\x00', @ANYBLOB="1200", @ANYBLOB=']'], 0x1ac}}, 0x40000)
recvmmsg$auto(0xffffffffffffffff, &(0x7f0000000380)={{0x0, 0x1, &(0x7f0000000000)={0x0, 0x400}, 0x4, 0x0, 0x200002, 0x8}, 0x803}, 0xfffffff9, 0x10010, 0x0)

program crashed: KASAN: slab-use-after-free Read in force_devcd_write
bisect: concatenation succeeded
found reproducer with 8 syscalls
minimizing guilty program
testing program (duration=9m0s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): openat$auto_clear_warn_once_fops_-mmap$auto-openat$auto_force_devcoredump_fops_hci_vhci-write$auto-madvise$auto-bpf$auto-sendmsg$auto_NL80211_CMD_GET_REG
detailed listing:
executing program 0:
openat$auto_clear_warn_once_fops_(0xffffffffffffff9c, &(0x7f0000000100), 0x210800, 0x0)
mmap$auto(0x0, 0x400005, 0xdf, 0x9b72, 0x2, 0x8000)
r0 = openat$auto_force_devcoredump_fops_hci_vhci(0xffffffffffffff9c, &(0x7f0000000c40)='/sys/kernel/debug/bluetooth/hci0/force_devcoredump\x00', 0x2, 0x0)
write$auto(r0, 0x0, 0xe)
madvise$auto(0x0, 0xffffffffffff0001, 0x15)
bpf$auto(0x12, &(0x7f0000000000)=@info={0x2800, 0x1ff, 0x2}, 0xcf)
sendmsg$auto_NL80211_CMD_GET_REG(0xffffffffffffffff, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000300)=ANY=[@ANYBLOB=' \x00\x00\x00', @ANYBLOB="1200", @ANYBLOB=']'], 0x1ac}}, 0x40000)

program crashed: lost connection to test machine
suppressed program crash: lost connection to test machine
testing program (duration=9m0s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): openat$auto_clear_warn_once_fops_-mmap$auto-openat$auto_force_devcoredump_fops_hci_vhci-write$auto-madvise$auto-bpf$auto-recvmmsg$auto
detailed listing:
executing program 0:
openat$auto_clear_warn_once_fops_(0xffffffffffffff9c, &(0x7f0000000100), 0x210800, 0x0)
mmap$auto(0x0, 0x400005, 0xdf, 0x9b72, 0x2, 0x8000)
r0 = openat$auto_force_devcoredump_fops_hci_vhci(0xffffffffffffff9c, &(0x7f0000000c40)='/sys/kernel/debug/bluetooth/hci0/force_devcoredump\x00', 0x2, 0x0)
write$auto(r0, 0x0, 0xe)
madvise$auto(0x0, 0xffffffffffff0001, 0x15)
bpf$auto(0x12, &(0x7f0000000000)=@info={0x2800, 0x1ff, 0x2}, 0xcf)
recvmmsg$auto(0xffffffffffffffff, &(0x7f0000000380)={{0x0, 0x1, &(0x7f0000000000)={0x0, 0x400}, 0x4, 0x0, 0x200002, 0x8}, 0x803}, 0xfffffff9, 0x10010, 0x0)

program crashed: KASAN: slab-use-after-free Read in force_devcd_write
testing program (duration=9m0s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): openat$auto_clear_warn_once_fops_-mmap$auto-openat$auto_force_devcoredump_fops_hci_vhci-write$auto-madvise$auto-recvmmsg$auto
detailed listing:
executing program 0:
openat$auto_clear_warn_once_fops_(0xffffffffffffff9c, &(0x7f0000000100), 0x210800, 0x0)
mmap$auto(0x0, 0x400005, 0xdf, 0x9b72, 0x2, 0x8000)
r0 = openat$auto_force_devcoredump_fops_hci_vhci(0xffffffffffffff9c, &(0x7f0000000c40)='/sys/kernel/debug/bluetooth/hci0/force_devcoredump\x00', 0x2, 0x0)
write$auto(r0, 0x0, 0xe)
madvise$auto(0x0, 0xffffffffffff0001, 0x15)
recvmmsg$auto(0xffffffffffffffff, &(0x7f0000000380)={{0x0, 0x1, &(0x7f0000000000)={0x0, 0x400}, 0x4, 0x0, 0x200002, 0x8}, 0x803}, 0xfffffff9, 0x10010, 0x0)

program crashed: KASAN: slab-use-after-free Read in force_devcd_write
testing program (duration=9m0s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): openat$auto_clear_warn_once_fops_-mmap$auto-openat$auto_force_devcoredump_fops_hci_vhci-write$auto-recvmmsg$auto
detailed listing:
executing program 0:
openat$auto_clear_warn_once_fops_(0xffffffffffffff9c, &(0x7f0000000100), 0x210800, 0x0)
mmap$auto(0x0, 0x400005, 0xdf, 0x9b72, 0x2, 0x8000)
r0 = openat$auto_force_devcoredump_fops_hci_vhci(0xffffffffffffff9c, &(0x7f0000000c40)='/sys/kernel/debug/bluetooth/hci0/force_devcoredump\x00', 0x2, 0x0)
write$auto(r0, 0x0, 0xe)
recvmmsg$auto(0xffffffffffffffff, &(0x7f0000000380)={{0x0, 0x1, &(0x7f0000000000)={0x0, 0x400}, 0x4, 0x0, 0x200002, 0x8}, 0x803}, 0xfffffff9, 0x10010, 0x0)

program crashed: KASAN: slab-use-after-free Read in force_devcd_write
testing program (duration=9m0s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): openat$auto_clear_warn_once_fops_-mmap$auto-openat$auto_force_devcoredump_fops_hci_vhci-recvmmsg$auto
detailed listing:
executing program 0:
openat$auto_clear_warn_once_fops_(0xffffffffffffff9c, &(0x7f0000000100), 0x210800, 0x0)
mmap$auto(0x0, 0x400005, 0xdf, 0x9b72, 0x2, 0x8000)
openat$auto_force_devcoredump_fops_hci_vhci(0xffffffffffffff9c, &(0x7f0000000c40)='/sys/kernel/debug/bluetooth/hci0/force_devcoredump\x00', 0x2, 0x0)
recvmmsg$auto(0xffffffffffffffff, &(0x7f0000000380)={{0x0, 0x1, &(0x7f0000000000)={0x0, 0x400}, 0x4, 0x0, 0x200002, 0x8}, 0x803}, 0xfffffff9, 0x10010, 0x0)

program did not crash
testing program (duration=9m0s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): openat$auto_clear_warn_once_fops_-mmap$auto-write$auto-recvmmsg$auto
detailed listing:
executing program 0:
openat$auto_clear_warn_once_fops_(0xffffffffffffff9c, &(0x7f0000000100), 0x210800, 0x0)
mmap$auto(0x0, 0x400005, 0xdf, 0x9b72, 0x2, 0x8000)
write$auto(0xffffffffffffffff, 0x0, 0xe)
recvmmsg$auto(0xffffffffffffffff, &(0x7f0000000380)={{0x0, 0x1, &(0x7f0000000000)={0x0, 0x400}, 0x4, 0x0, 0x200002, 0x8}, 0x803}, 0xfffffff9, 0x10010, 0x0)

program did not crash
testing program (duration=9m0s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): openat$auto_clear_warn_once_fops_-openat$auto_force_devcoredump_fops_hci_vhci-write$auto-recvmmsg$auto
detailed listing:
executing program 0:
openat$auto_clear_warn_once_fops_(0xffffffffffffff9c, &(0x7f0000000100), 0x210800, 0x0)
r0 = openat$auto_force_devcoredump_fops_hci_vhci(0xffffffffffffff9c, &(0x7f0000000c40)='/sys/kernel/debug/bluetooth/hci0/force_devcoredump\x00', 0x2, 0x0)
write$auto(r0, 0x0, 0xe)
recvmmsg$auto(0xffffffffffffffff, &(0x7f0000000380)={{0x0, 0x1, &(0x7f0000000000)={0x0, 0x400}, 0x4, 0x0, 0x200002, 0x8}, 0x803}, 0xfffffff9, 0x10010, 0x0)

program crashed: lost connection to test machine
suppressed program crash: lost connection to test machine
testing program (duration=9m0s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): mmap$auto-openat$auto_force_devcoredump_fops_hci_vhci-write$auto-recvmmsg$auto
detailed listing:
executing program 0:
mmap$auto(0x0, 0x400005, 0xdf, 0x9b72, 0x2, 0x8000)
r0 = openat$auto_force_devcoredump_fops_hci_vhci(0xffffffffffffff9c, &(0x7f0000000c40)='/sys/kernel/debug/bluetooth/hci0/force_devcoredump\x00', 0x2, 0x0)
write$auto(r0, 0x0, 0xe)
recvmmsg$auto(0xffffffffffffffff, &(0x7f0000000380)={{0x0, 0x1, &(0x7f0000000000)={0x0, 0x400}, 0x4, 0x0, 0x200002, 0x8}, 0x803}, 0xfffffff9, 0x10010, 0x0)

program crashed: WARNING: ODEBUG bug in hci_release_dev
testing program (duration=9m0s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): mmap$auto-openat$auto_force_devcoredump_fops_hci_vhci-write$auto-recvmmsg$auto
detailed listing:
executing program 0:
mmap$auto(0x0, 0x400005, 0xdf, 0x9b72, 0x2, 0x8000)
r0 = openat$auto_force_devcoredump_fops_hci_vhci(0xffffffffffffff9c, 0x0, 0x2, 0x0)
write$auto(r0, 0x0, 0xe)
recvmmsg$auto(0xffffffffffffffff, &(0x7f0000000380)={{0x0, 0x1, &(0x7f0000000000)={0x0, 0x400}, 0x4, 0x0, 0x200002, 0x8}, 0x803}, 0xfffffff9, 0x10010, 0x0)

program did not crash
testing program (duration=9m0s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): mmap$auto-openat$auto_force_devcoredump_fops_hci_vhci-write$auto-recvmmsg$auto
detailed listing:
executing program 0:
mmap$auto(0x0, 0x400005, 0xdf, 0x9b72, 0x2, 0x8000)
r0 = openat$auto_force_devcoredump_fops_hci_vhci(0xffffffffffffff9c, &(0x7f0000000c40)='/sys/kernel/debug/bluetooth/hci0/force_devcoredump\x00', 0x2, 0x0)
write$auto(r0, 0x0, 0xe)
recvmmsg$auto(0xffffffffffffffff, 0x0, 0xfffffff9, 0x10010, 0x0)

program crashed: KASAN: slab-use-after-free Read in force_devcd_write
extracting C reproducer
testing compiled C program (duration=9m0s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): mmap$auto-openat$auto_force_devcoredump_fops_hci_vhci-write$auto-recvmmsg$auto
program crashed: no output from test machine
a never seen crash title: no output from test machine, ignore
simplifying guilty program options
testing program (duration=9m0s, {Threaded:false Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): mmap$auto-openat$auto_force_devcoredump_fops_hci_vhci-write$auto-recvmmsg$auto
detailed listing:
executing program 0:
mmap$auto(0x0, 0x400005, 0xdf, 0x9b72, 0x2, 0x8000)
r0 = openat$auto_force_devcoredump_fops_hci_vhci(0xffffffffffffff9c, &(0x7f0000000c40)='/sys/kernel/debug/bluetooth/hci0/force_devcoredump\x00', 0x2, 0x0)
write$auto(r0, 0x0, 0xe)
recvmmsg$auto(0xffffffffffffffff, 0x0, 0xfffffff9, 0x10010, 0x0)

program crashed: KASAN: slab-use-after-free Read in force_devcd_write
extracting C reproducer
testing compiled C program (duration=9m0s, {Threaded:false Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): mmap$auto-openat$auto_force_devcoredump_fops_hci_vhci-write$auto-recvmmsg$auto
program crashed: no output from test machine
a never seen crash title: no output from test machine, ignore
testing program (duration=9m0s, {Threaded:false Repeat:true RepeatTimes:0 Procs:1 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): mmap$auto-openat$auto_force_devcoredump_fops_hci_vhci-write$auto-recvmmsg$auto
detailed listing:
executing program 0:
mmap$auto(0x0, 0x400005, 0xdf, 0x9b72, 0x2, 0x8000)
r0 = openat$auto_force_devcoredump_fops_hci_vhci(0xffffffffffffff9c, &(0x7f0000000c40)='/sys/kernel/debug/bluetooth/hci0/force_devcoredump\x00', 0x2, 0x0)
write$auto(r0, 0x0, 0xe)
recvmmsg$auto(0xffffffffffffffff, 0x0, 0xfffffff9, 0x10010, 0x0)

program crashed: KASAN: slab-use-after-free Read in force_devcd_write
extracting C reproducer
testing compiled C program (duration=9m0s, {Threaded:false Repeat:true RepeatTimes:0 Procs:1 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): mmap$auto-openat$auto_force_devcoredump_fops_hci_vhci-write$auto-recvmmsg$auto
program crashed: no output from test machine
a never seen crash title: no output from test machine, ignore
reproducing took 7h50m49.403324488s
repro crashed as (corrupted=false):
==================================================================
BUG: KASAN: slab-use-after-free in force_devcd_write+0x317/0x330 drivers/bluetooth/hci_vhci.c:327
Read of size 8 at addr ffff88802a73a000 by task syz.0.616/6675

CPU: 0 UID: 0 PID: 6675 Comm: syz.0.616 Not tainted 6.14.0-rc4-syzkaller #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 02/12/2025
Call Trace:
 <TASK>
 __dump_stack lib/dump_stack.c:94 [inline]
 dump_stack_lvl+0x116/0x1f0 lib/dump_stack.c:120
 print_address_description mm/kasan/report.c:408 [inline]
 print_report+0xc3/0x670 mm/kasan/report.c:521
 kasan_report+0xd9/0x110 mm/kasan/report.c:634
 force_devcd_write+0x317/0x330 drivers/bluetooth/hci_vhci.c:327
 full_proxy_write+0x13c/0x200 fs/debugfs/file.c:398
 vfs_write+0x24c/0x1150 fs/read_write.c:677
 ksys_write+0x12b/0x250 fs/read_write.c:731
 do_syscall_x64 arch/x86/entry/common.c:52 [inline]
 do_syscall_64+0xcd/0x250 arch/x86/entry/common.c:83
 entry_SYSCALL_64_after_hwframe+0x77/0x7f
RIP: 0033:0x7fa617f8d169
Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48
RSP: 002b:00007fffccd3de98 EFLAGS: 00000246 ORIG_RAX: 0000000000000001
RAX: ffffffffffffffda RBX: 00007fa6181a5fa0 RCX: 00007fa617f8d169
RDX: 000000000000000e RSI: 0000000000000000 RDI: 0000000000000003
RBP: 00007fa61800e2a0 R08: 0000000000000000 R09: 0000000000000000
R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000
R13: 00007fa6181a5fa0 R14: 00007fa6181a5fa0 R15: 0000000000000003
 </TASK>

Allocated by task 5980:
 kasan_save_stack+0x33/0x60 mm/kasan/common.c:47
 kasan_save_track+0x14/0x30 mm/kasan/common.c:68
 poison_kmalloc_redzone mm/kasan/common.c:377 [inline]
 __kasan_kmalloc+0xaa/0xb0 mm/kasan/common.c:394
 kmalloc_noprof include/linux/slab.h:901 [inline]
 kzalloc_noprof include/linux/slab.h:1037 [inline]
 vhci_open+0x4c/0x430 drivers/bluetooth/hci_vhci.c:634
 misc_open+0x35a/0x420 drivers/char/misc.c:179
 chrdev_open+0x237/0x6a0 fs/char_dev.c:414
 do_dentry_open+0x735/0x1c40 fs/open.c:956
 vfs_open+0x82/0x3f0 fs/open.c:1086
 do_open fs/namei.c:3830 [inline]
 path_openat+0x1e88/0x2d80 fs/namei.c:3989
 do_filp_open+0x20c/0x470 fs/namei.c:4016
 do_sys_openat2+0x17a/0x1e0 fs/open.c:1428
 do_sys_open fs/open.c:1443 [inline]
 __do_sys_openat fs/open.c:1459 [inline]
 __se_sys_openat fs/open.c:1454 [inline]
 __x64_sys_openat+0x175/0x210 fs/open.c:1454
 do_syscall_x64 arch/x86/entry/common.c:52 [inline]
 do_syscall_64+0xcd/0x250 arch/x86/entry/common.c:83
 entry_SYSCALL_64_after_hwframe+0x77/0x7f

Freed by task 5980:
 kasan_save_stack+0x33/0x60 mm/kasan/common.c:47
 kasan_save_track+0x14/0x30 mm/kasan/common.c:68
 kasan_save_free_info+0x3b/0x60 mm/kasan/generic.c:576
 poison_slab_object mm/kasan/common.c:247 [inline]
 __kasan_slab_free+0x51/0x70 mm/kasan/common.c:264
 kasan_slab_free include/linux/kasan.h:233 [inline]
 slab_free_hook mm/slub.c:2353 [inline]
 slab_free mm/slub.c:4609 [inline]
 kfree+0x2c4/0x4d0 mm/slub.c:4757
 vhci_release+0xbb/0xf0 drivers/bluetooth/hci_vhci.c:670
 __fput+0x3ff/0xb70 fs/file_table.c:464
 task_work_run+0x14e/0x250 kernel/task_work.c:227
 exit_task_work include/linux/task_work.h:40 [inline]
 do_exit+0xad8/0x2d70 kernel/exit.c:938
 do_group_exit+0xd3/0x2a0 kernel/exit.c:1087
 get_signal+0x24ed/0x26c0 kernel/signal.c:3036
 arch_do_signal_or_restart+0x90/0x7e0 arch/x86/kernel/signal.c:337
 exit_to_user_mode_loop kernel/entry/common.c:111 [inline]
 exit_to_user_mode_prepare include/linux/entry-common.h:329 [inline]
 __syscall_exit_to_user_mode_work kernel/entry/common.c:207 [inline]
 syscall_exit_to_user_mode+0x150/0x2a0 kernel/entry/common.c:218
 do_syscall_64+0xda/0x250 arch/x86/entry/common.c:89
 entry_SYSCALL_64_after_hwframe+0x77/0x7f

The buggy address belongs to the object at ffff88802a73a000
 which belongs to the cache kmalloc-1k of size 1024
The buggy address is located 0 bytes inside of
 freed 1024-byte region [ffff88802a73a000, ffff88802a73a400)

The buggy address belongs to the physical page:
page: refcount:0 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x2a738
head: order:3 mapcount:0 entire_mapcount:0 nr_pages_mapped:0 pincount:0
flags: 0xfff00000000040(head|node=0|zone=1|lastcpupid=0x7ff)
page_type: f5(slab)
raw: 00fff00000000040 ffff88801b041dc0 dead000000000100 dead000000000122
raw: 0000000000000000 0000000000100010 00000000f5000000 0000000000000000
head: 00fff00000000040 ffff88801b041dc0 dead000000000100 dead000000000122
head: 0000000000000000 0000000000100010 00000000f5000000 0000000000000000
head: 00fff00000000003 ffffea0000a9ce01 ffffffffffffffff 0000000000000000
head: 0000000000000008 0000000000000000 00000000ffffffff 0000000000000000
page dumped because: kasan: bad access detected
page_owner tracks the page as allocated
page last allocated via order 3, migratetype Unmovable, gfp_mask 0xd20c0(__GFP_IO|__GFP_FS|__GFP_NOWARN|__GFP_NORETRY|__GFP_COMP|__GFP_NOMEMALLOC), pid 5679, tgid 5679 (dhcpcd), ts 66081165048, free_ts 65707782857
 set_page_owner include/linux/page_owner.h:32 [inline]
 post_alloc_hook+0x181/0x1b0 mm/page_alloc.c:1551
 prep_new_page mm/page_alloc.c:1559 [inline]
 get_page_from_freelist+0xfce/0x2f80 mm/page_alloc.c:3477
 __alloc_frozen_pages_noprof+0x221/0x2470 mm/page_alloc.c:4739
 alloc_pages_mpol+0x1fc/0x540 mm/mempolicy.c:2270
 alloc_slab_page mm/slub.c:2423 [inline]
 allocate_slab mm/slub.c:2587 [inline]
 new_slab+0x23d/0x330 mm/slub.c:2640
 ___slab_alloc+0xc5d/0x1720 mm/slub.c:3826
 __slab_alloc.constprop.0+0x56/0xb0 mm/slub.c:3916
 __slab_alloc_node mm/slub.c:3991 [inline]
 slab_alloc_node mm/slub.c:4152 [inline]
 __do_kmalloc_node mm/slub.c:4293 [inline]
 __kmalloc_node_noprof+0x2f0/0x510 mm/slub.c:4300
 __kvmalloc_node_noprof+0xad/0x1a0 mm/util.c:662
 bpf_jit_binary_pack_alloc+0xc1/0x290 kernel/bpf/core.c:1159
 bpf_int_jit_compile+0x575/0x1830 arch/x86/net/bpf_jit_comp.c:3555
 bpf_prog_select_runtime+0x32a/0x4c0 kernel/bpf/core.c:2428
 bpf_migrate_filter net/core/filter.c:1307 [inline]
 bpf_prepare_filter+0xd3d/0x1100 net/core/filter.c:1355
 __get_filter+0x20b/0x2b0 net/core/filter.c:1524
 sk_attach_filter+0x1e/0x180 net/core/filter.c:1539
 sk_setsockopt+0x2f03/0x3c00 net/core/sock.c:1460
page last free pid 5503 tgid 5503 stack trace:
 reset_page_owner include/linux/page_owner.h:25 [inline]
 free_pages_prepare mm/page_alloc.c:1127 [inline]
 free_frozen_pages+0x6db/0xfb0 mm/page_alloc.c:2660
 __put_partials+0x14c/0x170 mm/slub.c:3153
 qlink_free mm/kasan/quarantine.c:163 [inline]
 qlist_free_all+0x4e/0x120 mm/kasan/quarantine.c:179
 kasan_quarantine_reduce+0x195/0x1e0 mm/kasan/quarantine.c:286
 __kasan_slab_alloc+0x69/0x90 mm/kasan/common.c:329
 kasan_slab_alloc include/linux/kasan.h:250 [inline]
 slab_post_alloc_hook mm/slub.c:4115 [inline]
 slab_alloc_node mm/slub.c:4164 [inline]
 kmem_cache_alloc_node_noprof+0x223/0x3c0 mm/slub.c:4216
 __alloc_skb+0x2b1/0x380 net/core/skbuff.c:596
 alloc_skb include/linux/skbuff.h:1331 [inline]
 alloc_skb_with_frags+0xe4/0x850 net/core/skbuff.c:6522
 sock_alloc_send_pskb+0x7f1/0x980 net/core/sock.c:2897
 unix_dgram_sendmsg+0x45e/0x18c0 net/unix/af_unix.c:2017
 sock_sendmsg_nosec net/socket.c:718 [inline]
 __sock_sendmsg net/socket.c:733 [inline]
 sock_write_iter+0x4fe/0x5b0 net/socket.c:1137
 do_iter_readv_writev+0x655/0x950 fs/read_write.c:820
 vfs_writev+0x363/0xdd0 fs/read_write.c:1050
 do_writev+0x297/0x340 fs/read_write.c:1096
 do_syscall_x64 arch/x86/entry/common.c:52 [inline]
 do_syscall_64+0xcd/0x250 arch/x86/entry/common.c:83
 entry_SYSCALL_64_after_hwframe+0x77/0x7f

Memory state around the buggy address:
 ffff88802a739f00: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc
 ffff88802a739f80: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc
>ffff88802a73a000: fa fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
                   ^
 ffff88802a73a080: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
 ffff88802a73a100: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
==================================================================

final repro crashed as (corrupted=false):
==================================================================
BUG: KASAN: slab-use-after-free in force_devcd_write+0x317/0x330 drivers/bluetooth/hci_vhci.c:327
Read of size 8 at addr ffff88802a73a000 by task syz.0.616/6675

CPU: 0 UID: 0 PID: 6675 Comm: syz.0.616 Not tainted 6.14.0-rc4-syzkaller #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 02/12/2025
Call Trace:
 <TASK>
 __dump_stack lib/dump_stack.c:94 [inline]
 dump_stack_lvl+0x116/0x1f0 lib/dump_stack.c:120
 print_address_description mm/kasan/report.c:408 [inline]
 print_report+0xc3/0x670 mm/kasan/report.c:521
 kasan_report+0xd9/0x110 mm/kasan/report.c:634
 force_devcd_write+0x317/0x330 drivers/bluetooth/hci_vhci.c:327
 full_proxy_write+0x13c/0x200 fs/debugfs/file.c:398
 vfs_write+0x24c/0x1150 fs/read_write.c:677
 ksys_write+0x12b/0x250 fs/read_write.c:731
 do_syscall_x64 arch/x86/entry/common.c:52 [inline]
 do_syscall_64+0xcd/0x250 arch/x86/entry/common.c:83
 entry_SYSCALL_64_after_hwframe+0x77/0x7f
RIP: 0033:0x7fa617f8d169
Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48
RSP: 002b:00007fffccd3de98 EFLAGS: 00000246 ORIG_RAX: 0000000000000001
RAX: ffffffffffffffda RBX: 00007fa6181a5fa0 RCX: 00007fa617f8d169
RDX: 000000000000000e RSI: 0000000000000000 RDI: 0000000000000003
RBP: 00007fa61800e2a0 R08: 0000000000000000 R09: 0000000000000000
R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000
R13: 00007fa6181a5fa0 R14: 00007fa6181a5fa0 R15: 0000000000000003
 </TASK>

Allocated by task 5980:
 kasan_save_stack+0x33/0x60 mm/kasan/common.c:47
 kasan_save_track+0x14/0x30 mm/kasan/common.c:68
 poison_kmalloc_redzone mm/kasan/common.c:377 [inline]
 __kasan_kmalloc+0xaa/0xb0 mm/kasan/common.c:394
 kmalloc_noprof include/linux/slab.h:901 [inline]
 kzalloc_noprof include/linux/slab.h:1037 [inline]
 vhci_open+0x4c/0x430 drivers/bluetooth/hci_vhci.c:634
 misc_open+0x35a/0x420 drivers/char/misc.c:179
 chrdev_open+0x237/0x6a0 fs/char_dev.c:414
 do_dentry_open+0x735/0x1c40 fs/open.c:956
 vfs_open+0x82/0x3f0 fs/open.c:1086
 do_open fs/namei.c:3830 [inline]
 path_openat+0x1e88/0x2d80 fs/namei.c:3989
 do_filp_open+0x20c/0x470 fs/namei.c:4016
 do_sys_openat2+0x17a/0x1e0 fs/open.c:1428
 do_sys_open fs/open.c:1443 [inline]
 __do_sys_openat fs/open.c:1459 [inline]
 __se_sys_openat fs/open.c:1454 [inline]
 __x64_sys_openat+0x175/0x210 fs/open.c:1454
 do_syscall_x64 arch/x86/entry/common.c:52 [inline]
 do_syscall_64+0xcd/0x250 arch/x86/entry/common.c:83
 entry_SYSCALL_64_after_hwframe+0x77/0x7f

Freed by task 5980:
 kasan_save_stack+0x33/0x60 mm/kasan/common.c:47
 kasan_save_track+0x14/0x30 mm/kasan/common.c:68
 kasan_save_free_info+0x3b/0x60 mm/kasan/generic.c:576
 poison_slab_object mm/kasan/common.c:247 [inline]
 __kasan_slab_free+0x51/0x70 mm/kasan/common.c:264
 kasan_slab_free include/linux/kasan.h:233 [inline]
 slab_free_hook mm/slub.c:2353 [inline]
 slab_free mm/slub.c:4609 [inline]
 kfree+0x2c4/0x4d0 mm/slub.c:4757
 vhci_release+0xbb/0xf0 drivers/bluetooth/hci_vhci.c:670
 __fput+0x3ff/0xb70 fs/file_table.c:464
 task_work_run+0x14e/0x250 kernel/task_work.c:227
 exit_task_work include/linux/task_work.h:40 [inline]
 do_exit+0xad8/0x2d70 kernel/exit.c:938
 do_group_exit+0xd3/0x2a0 kernel/exit.c:1087
 get_signal+0x24ed/0x26c0 kernel/signal.c:3036
 arch_do_signal_or_restart+0x90/0x7e0 arch/x86/kernel/signal.c:337
 exit_to_user_mode_loop kernel/entry/common.c:111 [inline]
 exit_to_user_mode_prepare include/linux/entry-common.h:329 [inline]
 __syscall_exit_to_user_mode_work kernel/entry/common.c:207 [inline]
 syscall_exit_to_user_mode+0x150/0x2a0 kernel/entry/common.c:218
 do_syscall_64+0xda/0x250 arch/x86/entry/common.c:89
 entry_SYSCALL_64_after_hwframe+0x77/0x7f

The buggy address belongs to the object at ffff88802a73a000
 which belongs to the cache kmalloc-1k of size 1024
The buggy address is located 0 bytes inside of
 freed 1024-byte region [ffff88802a73a000, ffff88802a73a400)

The buggy address belongs to the physical page:
page: refcount:0 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x2a738
head: order:3 mapcount:0 entire_mapcount:0 nr_pages_mapped:0 pincount:0
flags: 0xfff00000000040(head|node=0|zone=1|lastcpupid=0x7ff)
page_type: f5(slab)
raw: 00fff00000000040 ffff88801b041dc0 dead000000000100 dead000000000122
raw: 0000000000000000 0000000000100010 00000000f5000000 0000000000000000
head: 00fff00000000040 ffff88801b041dc0 dead000000000100 dead000000000122
head: 0000000000000000 0000000000100010 00000000f5000000 0000000000000000
head: 00fff00000000003 ffffea0000a9ce01 ffffffffffffffff 0000000000000000
head: 0000000000000008 0000000000000000 00000000ffffffff 0000000000000000
page dumped because: kasan: bad access detected
page_owner tracks the page as allocated
page last allocated via order 3, migratetype Unmovable, gfp_mask 0xd20c0(__GFP_IO|__GFP_FS|__GFP_NOWARN|__GFP_NORETRY|__GFP_COMP|__GFP_NOMEMALLOC), pid 5679, tgid 5679 (dhcpcd), ts 66081165048, free_ts 65707782857
 set_page_owner include/linux/page_owner.h:32 [inline]
 post_alloc_hook+0x181/0x1b0 mm/page_alloc.c:1551
 prep_new_page mm/page_alloc.c:1559 [inline]
 get_page_from_freelist+0xfce/0x2f80 mm/page_alloc.c:3477
 __alloc_frozen_pages_noprof+0x221/0x2470 mm/page_alloc.c:4739
 alloc_pages_mpol+0x1fc/0x540 mm/mempolicy.c:2270
 alloc_slab_page mm/slub.c:2423 [inline]
 allocate_slab mm/slub.c:2587 [inline]
 new_slab+0x23d/0x330 mm/slub.c:2640
 ___slab_alloc+0xc5d/0x1720 mm/slub.c:3826
 __slab_alloc.constprop.0+0x56/0xb0 mm/slub.c:3916
 __slab_alloc_node mm/slub.c:3991 [inline]
 slab_alloc_node mm/slub.c:4152 [inline]
 __do_kmalloc_node mm/slub.c:4293 [inline]
 __kmalloc_node_noprof+0x2f0/0x510 mm/slub.c:4300
 __kvmalloc_node_noprof+0xad/0x1a0 mm/util.c:662
 bpf_jit_binary_pack_alloc+0xc1/0x290 kernel/bpf/core.c:1159
 bpf_int_jit_compile+0x575/0x1830 arch/x86/net/bpf_jit_comp.c:3555
 bpf_prog_select_runtime+0x32a/0x4c0 kernel/bpf/core.c:2428
 bpf_migrate_filter net/core/filter.c:1307 [inline]
 bpf_prepare_filter+0xd3d/0x1100 net/core/filter.c:1355
 __get_filter+0x20b/0x2b0 net/core/filter.c:1524
 sk_attach_filter+0x1e/0x180 net/core/filter.c:1539
 sk_setsockopt+0x2f03/0x3c00 net/core/sock.c:1460
page last free pid 5503 tgid 5503 stack trace:
 reset_page_owner include/linux/page_owner.h:25 [inline]
 free_pages_prepare mm/page_alloc.c:1127 [inline]
 free_frozen_pages+0x6db/0xfb0 mm/page_alloc.c:2660
 __put_partials+0x14c/0x170 mm/slub.c:3153
 qlink_free mm/kasan/quarantine.c:163 [inline]
 qlist_free_all+0x4e/0x120 mm/kasan/quarantine.c:179
 kasan_quarantine_reduce+0x195/0x1e0 mm/kasan/quarantine.c:286
 __kasan_slab_alloc+0x69/0x90 mm/kasan/common.c:329
 kasan_slab_alloc include/linux/kasan.h:250 [inline]
 slab_post_alloc_hook mm/slub.c:4115 [inline]
 slab_alloc_node mm/slub.c:4164 [inline]
 kmem_cache_alloc_node_noprof+0x223/0x3c0 mm/slub.c:4216
 __alloc_skb+0x2b1/0x380 net/core/skbuff.c:596
 alloc_skb include/linux/skbuff.h:1331 [inline]
 alloc_skb_with_frags+0xe4/0x850 net/core/skbuff.c:6522
 sock_alloc_send_pskb+0x7f1/0x980 net/core/sock.c:2897
 unix_dgram_sendmsg+0x45e/0x18c0 net/unix/af_unix.c:2017
 sock_sendmsg_nosec net/socket.c:718 [inline]
 __sock_sendmsg net/socket.c:733 [inline]
 sock_write_iter+0x4fe/0x5b0 net/socket.c:1137
 do_iter_readv_writev+0x655/0x950 fs/read_write.c:820
 vfs_writev+0x363/0xdd0 fs/read_write.c:1050
 do_writev+0x297/0x340 fs/read_write.c:1096
 do_syscall_x64 arch/x86/entry/common.c:52 [inline]
 do_syscall_64+0xcd/0x250 arch/x86/entry/common.c:83
 entry_SYSCALL_64_after_hwframe+0x77/0x7f

Memory state around the buggy address:
 ffff88802a739f00: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc
 ffff88802a739f80: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc
>ffff88802a73a000: fa fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
                   ^
 ffff88802a73a080: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
 ffff88802a73a100: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
==================================================================