Extracting prog: 6m4.96654714s
Minimizing prog: 38m49.775940431s
Simplifying prog options: 0s
Extracting C: 26.612319195s
Simplifying C: 6m57.267408948s


30 programs, 3 VMs, timeouts [15s 1m40s 6m0s]
extracting reproducer from 30 programs
single: executing 5 programs separately with timeout 15s
testing program (duration=15s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:namespace SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_open_dev$usbfs-mmap-sendmsg$nl_route_sched-socket-sendto-recvmmsg-syz_open_dev$video-syz_open_dev$vbi-ioctl$VIDIOC_S_FMT-prctl$PR_SET_IO_FLUSHER-mmap-socket-bind$inet6-getsockname$packet-syz_open_procfs-getdents64-ioctl$UFFDIO_COPY-mprotect-syz_open_dev$usbfs-mmap-sendmsg$nl_route_sched-socket-sendto-recvmmsg-syz_open_dev$video-syz_open_dev$vbi-ioctl$VIDIOC_S_FMT-prctl$PR_SET_IO_FLUSHER-mmap-socket-bind$inet6-getsockname$packet-syz_open_procfs-getdents64-ioctl$UFFDIO_COPY-mprotect
detailed listing:
executing program 0:
r0 = syz_open_dev$usbfs(&(0x7f00000000c0), 0x10, 0xa702)
mmap(&(0x7f0000527000/0x1000)=nil, 0x1000, 0x1000006, 0x11, r0, 0x0)
sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f00000007c0)={0x0, 0x0, &(0x7f0000000480)={&(0x7f0000002340)=@delchain={0x244, 0x65, 0x0, 0x0, 0x0, {}, [@TCA_CHAIN={0x8}, @filter_kind_options=@f_u32={{0x8}, {0x40, 0x2, [@TCA_U32_INDEV={0x14, 0x8, 'veth0_to_team\x00'}, @TCA_U32_CLASSID={0x8}, @TCA_U32_HASH={0x8}, @TCA_U32_MARK={0x10}, @TCA_U32_FLAGS={0x8}]}}, @TCA_CHAIN={0x8}, @TCA_RATE={0x6}, @filter_kind_options=@f_route={{0xa}, {0x1b4, 0x2, [@TCA_ROUTE4_FROM={0x8}, @TCA_ROUTE4_POLICE={0x4}, @TCA_ROUTE4_FROM={0x8}, @TCA_ROUTE4_ACT={0x19c, 0x6, [@m_ife={0x150, 0x0, 0x0, 0x0, {{0x8}, {0x34, 0x2, 0x0, 0x1, [@TCA_IFE_SMAC={0xa, 0x4, @dev}, @TCA_IFE_TYPE={0x6}, @TCA_IFE_PARMS={0x1c}]}, {0xf5, 0x6, "21b2caeba32a6f7c5900697624a17b85a9db3a31b129a4976a84cfb4f5d651fd8aa24a645c8f63c025fcca463a6b79a3d7e6c9a8b89a140805ef63939ac2e37b49004b0dc3b8446aa7038eceef52fe7bdca153fe865c65015a3b208b282c16472e451aa10a8631235c49cae271f5fc8ce5e34d9938e3d5f43ac7a0e31b0acfc73199ca90e81246819f4c740a4fa3247a2af88d6569da09be7179b89f9f024c9f465098a5a52058a431206bee68089bddc13ffe76ff0f000053fa1517700a54d423c13fb6732a5d39c87101b0882ccd8e86eb437849e249675c60d8a9cf9430b6aa206e8116810b35151fce1e1bf48c2b9c"}, {0xc}, {0xc}}}, @m_nat={0x48, 0x0, 0x0, 0x0, {{0x8}, {0x4}, {0x1d, 0x6, "ef93daeef78df7f9a037a0d7a2f92a1cc341deabba437fc636"}, {0xc}, {0xc}}}]}]}}]}, 0x244}}, 0x0)
r1 = socket(0x10, 0x803, 0x0)
sendto(r1, &(0x7f0000000740)="120000001200e7ef007b00000000000000a1", 0x12, 0x0, 0x0, 0x0)
recvmmsg(r1, &(0x7f00000037c0)=[{{&(0x7f00000004c0)=@ethernet={0x0, @random}, 0xfdf4, &(0x7f0000000380)=[{&(0x7f0000000140)=""/100, 0x365}, {&(0x7f0000000280)=""/85, 0x7c}, {&(0x7f0000000fc0)=""/4096, 0x197}, {&(0x7f0000000400)=""/106, 0x645}, {&(0x7f0000000980)=""/73, 0x1b}, {&(0x7f0000000200)=""/77, 0x334}, {&(0x7f00000007c0)=""/154, 0x8}, {&(0x7f00000001c0)=""/17, 0x1d8}], 0x21, &(0x7f0000000600)=""/191, 0x41}}], 0x4000000000003b4, 0x0, &(0x7f0000003700)={0x77359400})
syz_open_dev$video(&(0x7f0000000040), 0xa7, 0x0)
r2 = syz_open_dev$vbi(&(0x7f0000000080), 0x2, 0x2)
ioctl$VIDIOC_S_FMT(r2, 0xc0d05640, &(0x7f0000000340)={0x1, @pix={0x20000, 0x0, 0x0, 0x0, 0x0, 0x1, 0x3, 0xfeedcafe, 0x0, 0x0, 0x0, 0x7}})
prctl$PR_SET_IO_FLUSHER(0x41, 0x3)
mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f04ebbee8, 0x10, 0xffffffffffffffff, 0x0)
r3 = socket(0xa, 0x2, 0x0)
bind$inet6(r3, &(0x7f0000000040)={0xa, 0x0, 0x0, @loopback={0xff00000000000000}}, 0x59)
getsockname$packet(r3, 0x0, &(0x7f00000002c0))
r4 = syz_open_procfs(0x0, &(0x7f0000000040)='ns\x00')
getdents64(r4, 0x0, 0x500)
ioctl$UFFDIO_COPY(r4, 0xc028aa03, &(0x7f0000000000)={&(0x7f00002de000/0x1000)=nil, &(0x7f00004ed000/0x4000)=nil, 0x1000})
mprotect(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x6)
syz_open_dev$usbfs(&(0x7f00000000c0), 0x10, 0xa702) (async)
mmap(&(0x7f0000527000/0x1000)=nil, 0x1000, 0x1000006, 0x11, r0, 0x0) (async)
sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f00000007c0)={0x0, 0x0, &(0x7f0000000480)={&(0x7f0000002340)=@delchain={0x244, 0x65, 0x0, 0x0, 0x0, {}, [@TCA_CHAIN={0x8}, @filter_kind_options=@f_u32={{0x8}, {0x40, 0x2, [@TCA_U32_INDEV={0x14, 0x8, 'veth0_to_team\x00'}, @TCA_U32_CLASSID={0x8}, @TCA_U32_HASH={0x8}, @TCA_U32_MARK={0x10}, @TCA_U32_FLAGS={0x8}]}}, @TCA_CHAIN={0x8}, @TCA_RATE={0x6}, @filter_kind_options=@f_route={{0xa}, {0x1b4, 0x2, [@TCA_ROUTE4_FROM={0x8}, @TCA_ROUTE4_POLICE={0x4}, @TCA_ROUTE4_FROM={0x8}, @TCA_ROUTE4_ACT={0x19c, 0x6, [@m_ife={0x150, 0x0, 0x0, 0x0, {{0x8}, {0x34, 0x2, 0x0, 0x1, [@TCA_IFE_SMAC={0xa, 0x4, @dev}, @TCA_IFE_TYPE={0x6}, @TCA_IFE_PARMS={0x1c}]}, {0xf5, 0x6, "21b2caeba32a6f7c5900697624a17b85a9db3a31b129a4976a84cfb4f5d651fd8aa24a645c8f63c025fcca463a6b79a3d7e6c9a8b89a140805ef63939ac2e37b49004b0dc3b8446aa7038eceef52fe7bdca153fe865c65015a3b208b282c16472e451aa10a8631235c49cae271f5fc8ce5e34d9938e3d5f43ac7a0e31b0acfc73199ca90e81246819f4c740a4fa3247a2af88d6569da09be7179b89f9f024c9f465098a5a52058a431206bee68089bddc13ffe76ff0f000053fa1517700a54d423c13fb6732a5d39c87101b0882ccd8e86eb437849e249675c60d8a9cf9430b6aa206e8116810b35151fce1e1bf48c2b9c"}, {0xc}, {0xc}}}, @m_nat={0x48, 0x0, 0x0, 0x0, {{0x8}, {0x4}, {0x1d, 0x6, "ef93daeef78df7f9a037a0d7a2f92a1cc341deabba437fc636"}, {0xc}, {0xc}}}]}]}}]}, 0x244}}, 0x0) (async)
socket(0x10, 0x803, 0x0) (async)
sendto(r1, &(0x7f0000000740)="120000001200e7ef007b00000000000000a1", 0x12, 0x0, 0x0, 0x0) (async)
recvmmsg(r1, &(0x7f00000037c0)=[{{&(0x7f00000004c0)=@ethernet={0x0, @random}, 0xfdf4, &(0x7f0000000380)=[{&(0x7f0000000140)=""/100, 0x365}, {&(0x7f0000000280)=""/85, 0x7c}, {&(0x7f0000000fc0)=""/4096, 0x197}, {&(0x7f0000000400)=""/106, 0x645}, {&(0x7f0000000980)=""/73, 0x1b}, {&(0x7f0000000200)=""/77, 0x334}, {&(0x7f00000007c0)=""/154, 0x8}, {&(0x7f00000001c0)=""/17, 0x1d8}], 0x21, &(0x7f0000000600)=""/191, 0x41}}], 0x4000000000003b4, 0x0, &(0x7f0000003700)={0x77359400}) (async)
syz_open_dev$video(&(0x7f0000000040), 0xa7, 0x0) (async)
syz_open_dev$vbi(&(0x7f0000000080), 0x2, 0x2) (async)
ioctl$VIDIOC_S_FMT(r2, 0xc0d05640, &(0x7f0000000340)={0x1, @pix={0x20000, 0x0, 0x0, 0x0, 0x0, 0x1, 0x3, 0xfeedcafe, 0x0, 0x0, 0x0, 0x7}}) (async)
prctl$PR_SET_IO_FLUSHER(0x41, 0x3) (async)
mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f04ebbee8, 0x10, 0xffffffffffffffff, 0x0) (async)
socket(0xa, 0x2, 0x0) (async)
bind$inet6(r3, &(0x7f0000000040)={0xa, 0x0, 0x0, @loopback={0xff00000000000000}}, 0x59) (async)
getsockname$packet(r3, 0x0, &(0x7f00000002c0)) (async)
syz_open_procfs(0x0, &(0x7f0000000040)='ns\x00') (async)
getdents64(r4, 0x0, 0x500) (async)
ioctl$UFFDIO_COPY(r4, 0xc028aa03, &(0x7f0000000000)={&(0x7f00002de000/0x1000)=nil, &(0x7f00004ed000/0x4000)=nil, 0x1000}) (async)
mprotect(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x6) (async)

program did not crash
testing program (duration=15s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:namespace SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): madvise-mremap-mlock-prctl$PR_SCHED_CORE-sched_setaffinity-openat$hwrng-preadv-io_uring_setup-io_uring_register$IORING_REGISTER_BUFFERS-mremap-syz_open_procfs-writev-munmap-openat$kvm-ioctl$KVM_CREATE_VM-openat$cgroup_ro-write$binfmt_script-mmap-ioctl$FS_IOC_FIEMAP-preadv-ioctl$KVM_CREATE_VCPU-ioctl$KVM_GET_NESTED_STATE-migrate_pages-syz_open_procfs$pagemap-ioctl$PAGEMAP_SCAN-syz_open_dev$evdev-sendmsg$TIPC_CMD_SHOW_NAME_TABLE-ioctl$EVIOCSMASK-socket-ioctl$sock_ipv4_tunnel_SIOCGETTUNNEL
detailed listing:
executing program 0:
madvise(&(0x7f0000a93000/0x4000)=nil, 0x4000, 0x80000000e)
mremap(&(0x7f0000a96000/0x1000)=nil, 0x1000, 0x800000, 0x3, &(0x7f0000130000/0x800000)=nil)
mlock(&(0x7f0000000000/0x800000)=nil, 0x800000)
prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0)
sched_setaffinity(0x0, 0x8, &(0x7f0000000040)=0x10001)
r0 = openat$hwrng(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0)
preadv(r0, &(0x7f0000000240)=[{&(0x7f0000033a80)=""/102386, 0xfffffd6e}], 0x1, 0x0, 0x0)
r1 = io_uring_setup(0x1698, &(0x7f0000000140)={0x0, 0x3, 0x0, 0xfffffffc, 0x4})
io_uring_register$IORING_REGISTER_BUFFERS(r1, 0x0, &(0x7f00000002c0)=[{&(0x7f0000001700)=""/4095, 0x440000}], 0x100000000000011a)
mremap(&(0x7f00003c6000/0x4000)=nil, 0x4000, 0x4000, 0x7, &(0x7f00000f4000/0x4000)=nil)
r2 = syz_open_procfs(0x0, 0x0)
writev(r2, &(0x7f0000000100)=[{0x0}], 0x1)
munmap(&(0x7f00001a2000/0x1000)=nil, 0x1000)
r3 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000100), 0x0, 0x0)
r4 = ioctl$KVM_CREATE_VM(r3, 0xae01, 0x0)
r5 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000001c0)='blkio.bfq.io_wait_time_recursive\x00', 0x275a, 0x0)
write$binfmt_script(r5, &(0x7f0000000200), 0x208e24b)
mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x2, 0x28011, r5, 0x0)
ioctl$FS_IOC_FIEMAP(0xffffffffffffffff, 0xc020660b, &(0x7f0000000000)=ANY=[@ANYBLOB="0100"])
preadv(r5, &(0x7f00000015c0)=[{&(0x7f0000000080)=""/124, 0xffffff23}], 0x1, 0x0, 0x0)
r6 = ioctl$KVM_CREATE_VCPU(r4, 0xae41, 0x0)
ioctl$KVM_GET_NESTED_STATE(r6, 0xc048aeca, &(0x7f0000005580)={{0x0, 0x0, 0x80}})
migrate_pages(0x0, 0x3, &(0x7f0000000040)=0x7f, &(0x7f0000000300)=0xa)
r7 = syz_open_procfs$pagemap(0x0, &(0x7f0000000000))
ioctl$PAGEMAP_SCAN(r7, 0xc0606610, &(0x7f0000000200)={0x60, 0x0, &(0x7f0000245000/0x2000)=nil, &(0x7f0000994000/0x2000)=nil, 0x0, 0x0})
r8 = syz_open_dev$evdev(&(0x7f0000000000), 0xffffffffffffffff, 0x1)
sendmsg$TIPC_CMD_SHOW_NAME_TABLE(0xffffffffffffffff, &(0x7f0000000600)={&(0x7f0000000500)={0x10, 0x0, 0x0, 0x4000}, 0xc, &(0x7f00000005c0)={&(0x7f0000000580)={0x30, 0x0, 0x20, 0x70bd2b, 0x25dfdbff, {{}, {}, {0x14, 0x19, {0xfffffef9, 0x0, 0x2, 0xc}}}, [""]}, 0x30}, 0x1, 0x0, 0x0, 0x20000004}, 0x20000044)
ioctl$EVIOCSMASK(r8, 0x40104593, 0x0)
r9 = socket(0x11, 0x800000003, 0x0)
ioctl$sock_ipv4_tunnel_SIOCGETTUNNEL(r9, 0x89f0, &(0x7f0000000080)={'tunl0\x00', &(0x7f0000000000)={'syztnl1\x00', 0x0, 0x0, 0x0, 0x0, 0x0, {{0x5, 0x4, 0x0, 0x0, 0x14, 0x0, 0x0, 0x0, 0x0, 0x0, @local, @loopback}}}})

program did not crash
testing program (duration=15s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:namespace SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): madvise-mremap-mlock-prctl$PR_SCHED_CORE-sched_setaffinity-openat$hwrng-preadv-io_uring_setup-io_uring_register$IORING_REGISTER_BUFFERS-mremap-syz_open_procfs-writev-munmap-openat$kvm-ioctl$KVM_CREATE_VM-openat$cgroup_ro-write$binfmt_script-mmap-ioctl$FS_IOC_FIEMAP-preadv-ioctl$KVM_CREATE_VCPU-ioctl$KVM_GET_NESTED_STATE-migrate_pages-syz_open_procfs$pagemap-ioctl$PAGEMAP_SCAN-syz_open_dev$evdev-sendmsg$TIPC_CMD_SHOW_NAME_TABLE-ioctl$EVIOCSMASK-socket-ioctl$sock_ipv4_tunnel_SIOCGETTUNNEL
detailed listing:
executing program 0:
madvise(&(0x7f0000a93000/0x4000)=nil, 0x4000, 0x80000000e)
mremap(&(0x7f0000a96000/0x1000)=nil, 0x1000, 0x800000, 0x3, &(0x7f0000130000/0x800000)=nil)
mlock(&(0x7f0000000000/0x800000)=nil, 0x800000)
prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0)
sched_setaffinity(0x0, 0x8, &(0x7f0000000040)=0x10001)
r0 = openat$hwrng(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0)
preadv(r0, &(0x7f0000000240)=[{&(0x7f0000033a80)=""/102386, 0xfffffd6e}], 0x1, 0x0, 0x0)
r1 = io_uring_setup(0x1698, &(0x7f0000000140)={0x0, 0x3, 0x0, 0xfffffffc, 0x4})
io_uring_register$IORING_REGISTER_BUFFERS(r1, 0x0, &(0x7f00000002c0)=[{&(0x7f0000001700)=""/4095, 0x440000}], 0x100000000000011a)
mremap(&(0x7f00003c6000/0x4000)=nil, 0x4000, 0x4000, 0x7, &(0x7f00000f4000/0x4000)=nil)
r2 = syz_open_procfs(0x0, 0x0)
writev(r2, &(0x7f0000000100)=[{0x0}], 0x1)
munmap(&(0x7f00001a2000/0x1000)=nil, 0x1000)
r3 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000100), 0x0, 0x0)
r4 = ioctl$KVM_CREATE_VM(r3, 0xae01, 0x0)
r5 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000001c0)='blkio.bfq.io_wait_time_recursive\x00', 0x275a, 0x0)
write$binfmt_script(r5, &(0x7f0000000200), 0x208e24b)
mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x2, 0x28011, r5, 0x0)
ioctl$FS_IOC_FIEMAP(0xffffffffffffffff, 0xc020660b, &(0x7f0000000000)=ANY=[@ANYBLOB="0100"])
preadv(r5, &(0x7f00000015c0)=[{&(0x7f0000000080)=""/124, 0xffffff23}], 0x1, 0x0, 0x0)
r6 = ioctl$KVM_CREATE_VCPU(r4, 0xae41, 0x0)
ioctl$KVM_GET_NESTED_STATE(r6, 0xc048aeca, &(0x7f0000005580)={{0x0, 0x0, 0x80}})
migrate_pages(0x0, 0x3, &(0x7f0000000040)=0x7f, &(0x7f0000000300)=0xa)
r7 = syz_open_procfs$pagemap(0x0, &(0x7f0000000000))
ioctl$PAGEMAP_SCAN(r7, 0xc0606610, &(0x7f0000000200)={0x60, 0x0, &(0x7f0000245000/0x2000)=nil, &(0x7f0000994000/0x2000)=nil, 0x0, 0x0})
r8 = syz_open_dev$evdev(&(0x7f0000000000), 0xffffffffffffffff, 0x1)
sendmsg$TIPC_CMD_SHOW_NAME_TABLE(r2, 0x0, 0x20000044)
ioctl$EVIOCSMASK(r8, 0x40104593, 0x0)
r9 = socket(0x11, 0x800000003, 0x0)
ioctl$sock_ipv4_tunnel_SIOCGETTUNNEL(r9, 0x89f0, &(0x7f0000000080)={'tunl0\x00', &(0x7f0000000000)={'syztnl1\x00', 0x0, 0x0, 0x0, 0x0, 0x0, {{0x5, 0x4, 0x0, 0x0, 0x14, 0x0, 0x0, 0x0, 0x0, 0x0, @local, @loopback}}}})

program did not crash
testing program (duration=15s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:namespace SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): openat$cgroup_ro-write$binfmt_script-openat$kvm-ioctl$KVM_CREATE_VM-socket$inet_sctp-setsockopt$inet_sctp_SCTP_PEER_ADDR_THLDS-ioctl$KVM_CREATE_VCPU-socket-socket$packet-ioctl$sock_SIOCGIFINDEX-prlimit64-sched_setscheduler-sched_setscheduler-sched_setaffinity-openat$hwrng-preadv-openat$tun-fsetxattr-ioctl$TUNSETIFF-ioctl$sock_SIOCGIFINDEX_80211-ioctl$TUNSETLINK-socketpair$nbd-ioctl$SIOCSIFHWADDR-ioctl$KVM_RUN-mmap-ioctl$KVM_SET_CPUID2-openat$tun-ioctl$TUNSETIFF-ioctl$TUNSETLINK
detailed listing:
executing program 0:
r0 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000001c0)='cpuacct.usage_sys\x00', 0x275a, 0x0)
write$binfmt_script(r0, &(0x7f0000000340), 0x4)
r1 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000440), 0x0, 0x0)
r2 = ioctl$KVM_CREATE_VM(r1, 0xae01, 0x0)
r3 = socket$inet_sctp(0x2, 0x0, 0x84)
setsockopt$inet_sctp_SCTP_PEER_ADDR_THLDS(r3, 0x84, 0x1f, &(0x7f0000000b80)={0x0, @in6={{0xa, 0x4e21, 0x1, @rand_addr=' \x01\x00', 0x53}}}, 0x90)
r4 = ioctl$KVM_CREATE_VCPU(r2, 0xae41, 0x0)
socket(0x10, 0x3, 0x0)
r5 = socket$packet(0x11, 0x2, 0x300)
ioctl$sock_SIOCGIFINDEX(r5, 0x8933, 0x0)
prlimit64(0x0, 0xe, 0x0, 0x0)
sched_setscheduler(0x0, 0x0, 0x0)
sched_setscheduler(0x0, 0x0, 0x0)
sched_setaffinity(0x0, 0x8, &(0x7f0000000040)=0x10001)
r6 = openat$hwrng(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0)
preadv(r6, &(0x7f0000000240)=[{&(0x7f0000033a80)=""/102386, 0xfffffd6e}], 0x1, 0x0, 0x0)
r7 = openat$tun(0xffffffffffffff9c, &(0x7f0000000100), 0x0, 0x0)
fsetxattr(r2, &(0x7f0000000280)=ANY=[@ANYBLOB='os2.com.apurity\x00'], &(0x7f0000000500)='\'\x7f\x84r6\xbf\xdd\'\xc3\x00\x00\x00\xc9\xc8hIB\x14\x1fo\'8Ci\xceZ\xc3+Ae!\xdc\r\xa9\xc74c\xfb5\x7f\x91T\r\xcb\xb9\xb2\xb5e\x1aS\"\xb40M\xd6\xaa\xad\xa5\xf1\x9b\x1a\a\x90\'\xe5\xc0\xc9OK\x95\x15\x14\x06\x9a\xa1\xce\x8c$\xc2\xbf\xe0\xcdp', 0x53, 0x2)
ioctl$TUNSETIFF(r7, 0x400454ca, &(0x7f0000000000)={'pim6reg1\x00', 0x1})
ioctl$sock_SIOCGIFINDEX_80211(r5, 0x8933, &(0x7f00000002c0)={'wlan1\x00'})
ioctl$TUNSETLINK(r7, 0x400454cd, 0x30a)
socketpair$nbd(0x1, 0x1, 0x0, &(0x7f00000000c0)={0xffffffffffffffff, <r8=>0xffffffffffffffff})
ioctl$SIOCSIFHWADDR(r8, 0x8914, &(0x7f0000000140)={'pim6reg1\x00', @link_local})
ioctl$KVM_RUN(r4, 0xae80, 0x0)
mmap(&(0x7f0000000000/0x400000)=nil, 0x400000, 0x2000005, 0x10012, r0, 0x0)
ioctl$KVM_SET_CPUID2(r4, 0x4008ae90, &(0x7f00000004c0)=ANY=[@ANYBLOB="01ec000000010000"])
r9 = openat$tun(0xffffffffffffff9c, &(0x7f0000000140), 0x0, 0x0)
ioctl$TUNSETIFF(r9, 0x400454ca, &(0x7f0000000200)={'syzkaller1\x00', 0xc201})
ioctl$TUNSETLINK(r9, 0x400454cd, 0x324)

program did not crash
testing program (duration=15s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:namespace SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): socket$unix-socket$kcm-recvmsg$kcm-sendmsg$inet-sendmsg$kcm-socket$inet-ioctl$sock_ipv4_tunnel_SIOCCHGTUNNEL-openat$kvm-ioctl$KVM_CREATE_VM-openat$cgroup_ro-write$binfmt_script-mmap-dup-ioctl$KVM_SET_USER_MEMORY_REGION-syz_kvm_setup_cpu$x86-syz_kvm_setup_cpu$x86-ioctl$KVM_REGISTER_COALESCED_MMIO-ioctl$KVM_NMI-ioctl$KVM_RUN-setsockopt$EBT_SO_SET_ENTRIES-ioctl$sock_SIOCGIFINDEX-socket$can_raw-setsockopt$CAN_RAW_ERR_FILTER-sendmsg$can_raw
detailed listing:
executing program 0:
r0 = socket$unix(0x1, 0x1, 0x0)
r1 = socket$kcm(0x10, 0x3, 0x10)
recvmsg$kcm(0xffffffffffffffff, &(0x7f0000000c40)={0x0, 0x0, 0x0, 0x0, &(0x7f00000008c0)=""/164, 0xa4}, 0x0)
sendmsg$inet(0xffffffffffffffff, &(0x7f0000000d40)={0x0, 0x0, 0x0, 0x0, &(0x7f0000000a40)=ANY=[@ANYBLOB="7c00000000000000000000000700000044140001ac1414aa00000000ac1414000000000000441c0003e0000001000000007f000001000000000000000000000000442c000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000a400000000000000000000000700000044280000000000000000000000000000000000000000000000000000000000000000000000000000071700e0000002ac1414bb00000000e0000002ac1414bb018616000000000010c986d78e6c4b9394b247217b87cb00830b00000000007f000001861f0000000000020010421487f84baabcbcfb42a4d90bab000748c68c4c31001089ca45d9612e5b5c11f12bc78a41000000000000006c000000000000000000000007000000441c0003ffffffff000000000000000000000000e00000010000000044340001ac1414bb0000000000000000000000000000000000000000ac1414aa00000000ac14140000000000ac1e000100000000830b0000000000e000000200000000001c00000000000000000000000800"/424, @ANYRES32=0x0, @ANYBLOB="ac1414aa00000000000000001400000000000000000000000200000000000000000000001c000000000000000000000008000000", @ANYRES32=0x0, @ANYBLOB="e00000017f000001000000001c000000000000000000000008000000", @ANYRES32=0x0, @ANYBLOB="7f000001ac141400000000001c000900000000000000000007010000440c0001022101"], 0x230}, 0x0)
sendmsg$kcm(r1, &(0x7f0000000000)={0x0, 0xffffff0a, &(0x7f0000000080)=[{&(0x7f0000000040)="c01803001d000b0ad25a80648c2594f90124fc60100c0a4001000009053582c137153e370248078000f01700d1bd", 0x33fe0}], 0x1, 0x0, 0x0, 0x4000}, 0x3500000000000000)
r2 = socket$inet(0x2, 0x1, 0x0)
ioctl$sock_ipv4_tunnel_SIOCCHGTUNNEL(0xffffffffffffffff, 0x89f3, &(0x7f0000000000)={'sit0\x00', &(0x7f00000003c0)={'syztnl1\x00', 0x0, 0x0, 0x0, 0x0, 0x10000, {{0x33, 0x4, 0x0, 0x0, 0xcc, 0x0, 0x0, 0x0, 0x2f, 0x0, @empty, @remote, {[@timestamp={0x44, 0x18, 0x0, 0x0, 0x9, [0x402, 0x5, 0x0, 0x5, 0x4]}, @timestamp_prespec={0x44, 0x44, 0xc0, 0x3, 0x1, [{@private=0xa010100}, {@local, 0x5}, {@remote}, {@dev={0xac, 0x14, 0x14, 0x32}, 0x659}, {@broadcast}, {@empty, 0x4}, {@multicast1, 0xffd200}, {@private=0xa010100, 0x7}]}, @timestamp_prespec={0x44, 0x3c, 0x0, 0x3, 0x8, [{@dev}, {@remote, 0x4}, {@multicast2, 0x7}, {@private=0xa010101}, {@rand_addr=0x64010101}, {@broadcast, 0x52b1}, {@multicast2}]}, @lsrr={0x83, 0xb, 0x7, [@multicast1, @broadcast]}, @noop, @noop, @lsrr={0x83, 0xf, 0xdc, [@private=0xa010102, @rand_addr=0x64010102, @multicast1]}, @end]}}}}})
r3 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000140), 0x0, 0x0)
r4 = ioctl$KVM_CREATE_VM(r3, 0xae01, 0x0)
r5 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000040)='hugetlb.2MB.usage_in_bytes\x00', 0x275a, 0x0)
write$binfmt_script(r5, &(0x7f0000000240), 0x208e24b)
mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x1000001, 0x28011, r5, 0x0)
dup(r4)
ioctl$KVM_SET_USER_MEMORY_REGION(r4, 0x4020ae46, &(0x7f0000000080)={0x0, 0x2, 0x0, 0x2000, &(0x7f0000000000/0x2000)=nil})
syz_kvm_setup_cpu$x86(0xffffffffffffffff, 0xffffffffffffffff, &(0x7f0000000000/0x18000)=nil, &(0x7f0000000300)=[@text64={0x40, 0x0}], 0xffff, 0x0, 0x0, 0x0)
syz_kvm_setup_cpu$x86(r4, 0xffffffffffffffff, &(0x7f0000000000/0x18000)=nil, &(0x7f0000000200)=[@text64={0x40, 0x0}], 0x1, 0x0, 0x0, 0x0)
ioctl$KVM_REGISTER_COALESCED_MMIO(r4, 0x4010ae67, &(0x7f00000001c0)={0x0, 0xd000})
ioctl$KVM_NMI(0xffffffffffffffff, 0xae9a)
ioctl$KVM_RUN(0xffffffffffffffff, 0xae80, 0x0)
setsockopt$EBT_SO_SET_ENTRIES(r2, 0x0, 0x80, &(0x7f0000000080)=@broute={'broute\x00', 0x20, 0x2, 0x330, [0x0, 0x0, 0x0, 0x0, 0x0, 0x20000580], 0x0, 0x0, &(0x7f0000000580)=ANY=[@ANYBLOB="00000000000000000000000000000000000000000000000000000000000000000002000000000000feffffff0100000019000000000000000000726f7365300000000000000000000000726f736530000000cc002000000000007465616d5f736c6176655f310000000064756d6d7930000000000000000000000180c2000000000000000000ffffffffffff0000000000000000d00000000801000038010000706b74747970650000000000000000000000000000000000000000000000000008000000000000000000000000000000706b747479706500000000000000000000000000000000000000000000000000080000000000000000000000000000006d61726b0000000000000000000000000000000000000000000000000000000010000000000000000000000000000000ddffffff00000000726564697265637400000000396c27db39b2eedb0000000000000000000000000800000000000000feffffff0000000000000000000000000000000000000000000000000000000000000000000000000000000001000000ffffffff0000000000000000000000000000000000000000000000000000000000000000000000000000000001000000feffffff0000000000000000000000000000000000000000000000000000000000000000000000000000000001000000ffffffff0100000003000000000000008b357665746831000000000000000000000074756e6c30000000000000000000000074756e6c300000000005000000000000006c616e300000000000000000000000aaaaaaaaaabb000000000000aaaaaaaaaa0000000000000000000001000000010000380100006367726f75700000000000000000000000000000000000000000000000000000080000000000000000000000000000006172700000000000000000000000000000000000000000000000000000000000380000000000000000000000000000000000000000000b00007f0000010000000072ce35f34121000000000000000000000000000000000000eaffffff00000000646e6174000000000000000000000000000000000000000000000000000000001000000000000000aaaaaaaaaabb0000fdffffff000000"]}, 0x3a8)
ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000180)={'vxcan1\x00', <r6=>0x0})
r7 = socket$can_raw(0x1d, 0x3, 0x1)
setsockopt$CAN_RAW_ERR_FILTER(r7, 0x65, 0x7, &(0x7f00000001c0)=0x8, 0x4)
sendmsg$can_raw(r7, &(0x7f00000004c0)={&(0x7f00000005c0)={0x1d, r6}, 0x10, &(0x7f0000000500)={&(0x7f00000000c0)=@can={{}, 0xff, 0x0, 0x4, 0x0, '\b-\x00'}, 0x10}}, 0x0)

program did not crash
single: failed to extract reproducer
bisect: bisecting 30 programs with base timeout 15s
testing program (duration=22s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:namespace SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): [8, 7, 27, 18, 5, 24, 15, 29, 10, 3, 3, 30, 4, 30, 30, 10, 9, 29, 3, 14, 7, 30, 3, 12, 10, 30, 30, 12, 3, 36]
detailed listing:
executing program 1:
r0 = socket$inet6(0xa, 0x2, 0x0)
setsockopt$inet6_int(r0, 0x29, 0x35, &(0x7f0000000000)=0x8000, 0x4)
setsockopt$inet6_IPV6_HOPOPTS(r0, 0x29, 0x36, &(0x7f0000000140)=ANY=[], 0x8)
bind$inet6(r0, &(0x7f0000f5dfe4)={0xa, 0x4e20, 0x0, @empty}, 0x1c)
setsockopt$inet6_IPV6_DSTOPTS(r0, 0x29, 0x3b, &(0x7f0000000080)=ANY=[], 0x8)
syz_emit_ethernet(0x86, &(0x7f0000000000)=ANY=[], 0x0)
recvmmsg(r0, &(0x7f0000000040), 0x400000000000284, 0x2, 0x0)
sendto$inet6(r0, 0x0, 0x0, 0x0, &(0x7f0000000300)={0xa, 0x4e20, 0x0, @mcast1}, 0x1c)
executing program 1:
r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000100), 0x0, 0x0)
r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0)
ioctl$KVM_CREATE_IRQCHIP(r1, 0xae60)
r2 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0)
ioctl$KVM_SET_IRQCHIP(r1, 0x8208ae63, &(0x7f00000003c0)={0x1, 0x0, @pic={0x0, 0xfd, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1}})
ioctl$KVM_SET_REGS(r2, 0x4090ae82, &(0x7f0000000000)={[], 0x0, 0x2c0710})
ioctl$KVM_RUN(r2, 0xae80, 0x0) (fail_nth: 4)
executing program 1:
r0 = socket$inet6_tcp(0xa, 0x1, 0x0)
setsockopt$inet6_IPV6_FLOWLABEL_MGR(r0, 0x29, 0x1b, &(0x7f0000000000)={@remote}, 0x20)
syz_emit_ethernet(0xfc0, &(0x7f00000001c0)={@local, @dev, @void, {@ipv4={0x800, @generic={{0x5, 0x4, 0x0, 0x0, 0xfb2, 0x0, 0x0, 0x0, 0x84, 0x0, @empty, @broadcast}, "dd9dec79219eb549dbd024c796335bc5ff0e043319357749084ca9d0ae1378f4e88112a2f7c10fd1523b9007773fd2b2bd0ebabccd2e5c35fb3baff587585840f2530c6f4d025f118440ac22a8b34da7b5e1e873bd429686be3ef84439e05fc0fefedb8b897b09445a9e10cf24aec2ff3ca6a86d94df0c4a928ed904dcfb02e6c6c5918a839d33cb9b55dfb3cd89d80eb18dc06415d313b4ea240a65eff4b941ac018e8f81de044239960271333255291b5fbfdcf8db25e175640f36986b859aeb3370ca17e6a20aeeb5c5d27eb097fc1fab796a7ff8fcbe119bbe4be2c8a5c58890191c59bea20bfe4edf9c5453e59f610d3bd1d6eb49b02e464aee0480187c5717936add1347b08cdf5b056adb941708e8a0498900419e98b75658c6dd00f88eebf8c9aaee2e38c80eafcf6ca08ea305da9c7050948ef78a1457a2e933287fe8d2e100cb00078ed829985f8812d543cc5cdb71521f4113829551efe915e4d6773f2d285cc1e8813919356ca5ef202b0d2b8a3d7de51e4635e761ffd7efe5d51dd1325596f0e4e1c0b1ce73240cb931227892d66f3629c9d152372d5790c1c25e2f6f850a4eb83654f423b84adbbf4169d472b2cddaa7137ff14c2944ade3a57613806810707a2e6c078beb4b87cf8cf39c9950bcb3f9bb42308bd5e68d81f7f4d9e528541703059787f5e342be8ebb9841d587f7455b409115d511c130d9641fc74391228bda52d2fa58e2ca74b26583e73e2cfb881945d8ecbc77eb35e783057f6c35ba06b7f639ec516ee54bf3645f6ec436ba859e22ed480a862285aa21f3d5cd3734dde388a7f8920c4a6b4a952f830e0d2811f2f2714e660e961de0b3e0b8d5fd1007690a61e414e82245dbe4e47c73465ed40af1cee2eae4801ee408ad1fce81ff8db77082c5efd93fa9a1a3e3d78eff84f326df1c6fa656cc7d4dab842f47ad0a7e74dfe1a53776a346a22dc7a0e476754d385d99aa9cbd3f445ffb2ed61e01b28fc071d706ad204b1e8014481dba0cbc460b67e64d6e955184271cedef7f951021e3595ebe9c3384b53efafb67cbed2aa1ede5d7fcff3abd27d05766fb8894d7948609441759f4c4dfa33b6d486d4fb7e231f04d4f0f9e98f4b156129d9307fb9ebf3b278232062e7fe9ec2db7c4c991f83733368a107bf5798a1df45c919d71cce45ed907240c2f2fa6a4227e8e11cef2e7968c63e7a1adc3edec2170c17ed2cc54d0ea2b34e99b81015ffe51a501c2b73ddac5223e69d0dd451d358c0cd2ff7db256850ec1e9e349901f168d854284da68d80c68298a75c5d859008c82fe08b4cf2e68a2c0190760a03aff1be2c9425b6d5ef5c67bafb6d16fffeeb0211d90abbade4db9d6a9e9c981dde14c1d54e9138f9760bcdccbf17e7416042cfe7bbd8bba2f739f7f900ee45b965316b950e8474f3be92081fb63f43a4858b39e20e14d5a38c0973d680f2fda9e310d0e088523bdcbb728bcd0074447b4ace876da5642cd7d781cdb023a31446e0a0c59d5388674a5c8a97927e014a73d0330bd5c5187db79f1c546a8bcca008263509c23b246dea58fb36c44d373c1c92ffdd1600c27d4b10b3fc86b88ecefe8743bb59a6b8e443f06d2ae3a6908b6bc65b647deee13262225b8879dd79413ffa3d4aef91a0a04d4dc3030b5beb081c5fdf9152c3a17e6b24457fd580d84d3006af27ff44d6ec3664c4955a1d1dc5eb041682644ae5643901f00aa602b2a18cdd3f8a1efff7b8f3afc31c283c9b74b806a98bd9f1ad8ecce410160c0a27f7ef90a2b0c1bea64e187adc04a04bff7c435659bc4c3ce5c2730e121972541062102e93d2a136e1aaaf3e25d547cad6e2b0874500fc098469494d2654808ee88588fd167f4332061a9b4cae6b22d87624e325e89a269f61ce0d26465ddfedc1f0fa2a5cf1ee7fe3e6cb375f1ff04cf8d22667debe574b8395023bde9a8302376af2e119c4c88433d1722011ade605f3a4201860742b0392ac96cc138d9ddb952f4e4742a7fd9d625465dac35347c1662b2085c357120c6ff69dedc013c5fe46555a4448b0be41e21ad73162bf9aa1cfb70f4702c7051c0a13fae918133f123d33c5c02e66ae8fceb3109b2e13a7a3e71484d59dfcba16db2d21549be1ba6cd5ad7610eefda427982384961f18bd6857ad97e868c2914d0ba934a296eda52646031c4504864061f3cba1df65cd04ef6b1050fb30b5abbbe28f8f7adb8073e452f4c0c5492a5f8d427ddf451ae303a86639e5dbccfe2b2bedb911d534a77c012e2f8a24917d98ab14557caf3e66040f21767685644f0003459762d4ab25a0e33a92b54748cf46a977505074b79b9b0746b2b5b168876a2ca10bb903edc1d1992a4a94c0ee0dd7b37add092163b5fbaf16090f8143187d060b19e3822f3def14717e41558f9582467a5a5f89148450fde235e7a5bb900e4e9d14e2147bfd2a52f84a115eb170bf3d3b9b3de9781960be4e53025c7dce005e1458140bb9cf9da8fa1124ac558fb220d57c23a7f120f5171eb2208d9e6ab7186ae457973da564f1fd45b241c15596035f55034c3995a587b4471068076839420df947f10ab2fc211732d768c135d63cc5eeda1bdfc780e7ed90855fa5a364e63f529703cd0f691b0b6a41232bfd1c1f61ef6b16ed3b9055ca888c8ebcd16a0623ede9e4e37b7d6175e3d0ddba8e7d87639eb8b0ba246131951a581575f1adf4c598a9f2f087d5eb2a0a5834d8cb12b0ad76d9381a838ccfbfcc20bbb970474c48677f10aa57be1d607d5b049d397178035f7f3393cd9000336c83218850ecd64142a22f7ae7e6a7e62013d6d105eb7c862e13979698681d44121ee9e2e552315d4d3913ff7bcd90d6bed72d50107a971a37d5a1d75efeebf03cc91239b7e427fba8df6b79674c15acd2093289fe6155063af81d85840abf4635f66083b3707d34b2149dfdf95cb4deb71e1574118c242b160c770347e6b1f135a985e89fe8e6d7f40281cfb6dc05cd8b9d4f6680c0863acb34516092acdf2bea67f54ab4282ba2d898287f34d9384e335b2ddbb87aaea8cadb8f0b397e99a68a7a214fae5a1f56c95bcd901534c23cd5cff3c168813d7fa1191dd7437c96b07324a7b21b48e205b859dcd080bd62ab7cca4bd7a73959218d0eeb21c887483201eaf3afb19efe1741b57332c5441685a7bb8324dde85faafc785312b58aabef2eef6a8048663bf13db9ae9edd4b1dcebc99890693f11b354b1f1aad19b66251b4bcaed0daed73b87dedd140fd680e7d3355362844d1d7ba2ae6be7ffae59d7b3c679b890448b0de1acf591abfe6f3096794b7e142e0ac0862ab8cb76eb79b17d1138be3747f907c3f11c636a0f0e0d315d1ff05aab0ce62fbac03a2b4ddeac7ee192bba2da93b7a926271f6d594aa14de2c294ad0c77770a624d1ce24cc8d8f5e9b629604fa7897f0cbd641f76a85dc8df33b5715eb100e30e53b85110d2252c22575a7365eb08006b4d62d305e780101965094ce2aaad170df470870e687fb280b772d41ad5d470b71e256af3a0d2c02df95821d38f28cdff26fa7a3f6e920edbd3174d2d2bde854ef68dae8a0a4a63753c825930903a2ca75d4321bad0ad9ff6852f94dd04972a45bb9625b3726dfbcc959e85242f0d327b181aee0fdab7af064dd97151b131a5c4a51a66692cbbd9f1348a16470cedef1b255e172cd2b15184177ad43744de941869af884ff8e59ef0e63ac5e1b99c851e0f915359ce12d9c380bb6f9c2bc773267157afeda7abcc120a31a1b72af6662bff7f5f194dad00b4ebfdcbb4dfc39854412db1ae99b449d741f841239159ea467cf1e38b95bcb7603ebcb400cb31410b2a4e25126caade0019bf667cc998bc4582578da0f8a6268f6d114ccf9dd8379995e8be1b934bb5645d72f97e05628129a7d2bc548e08796341f43dc3c9fcbe89d8284dc6633bee0d17e99f600425f0172b6bc478f5117dadf15e36e850ecc0ca75664ef8e4877a44b4ffa22a6f1d6719f8d81f9937928caa0690b77406a3298aaf446e2f78343267399bb7f64c60f82bf5d07210281eaad09a3810790720c98a041332c809be7aea1480b9e5eb989085c23b4aee75143068def3e89d1c417b63321e68d340a1472d2504088c17cd75de0e700508c55a7246ca9a762cc50ca35cbcaa7dcf4ae3264c32ff2cd67566ed501fb8182b5f16c58295783f3b2b554b06aae700f198c71ad7519868c1e6fbeb0246569b04beeb8b71bcbb9af93372bee365efb1d7424689e8241b1dc346a73a84b5773487f388356b8dbec1a108846e3f8dc74865b156e8ad18b353efc4ad0b11412a381fec8f5d45678b4f8b6805913e7aff71acf9052ae3b73e41e19668f9b53bfd75b778970831b6891a78ffe0d4863e62cbbf6cf8c085032864479cd3a250842984dcc2860f057f86c8e2d4d2afefb8a45b7d5b8c94e752f369a1b434c827cd26cd0276a8b40019a95ebe7c16de4c1ce8efbd5c70e0c507631818aa4fbc937d212e428aefa895069656babdbd921af974da32c49f4ca6d1e1e28319b427c8bad4d650809c673ec6073770b4097e5700a8071110fd07acbc5a59f8d7b0735a98fd40ce03718a9a93c035948859215c59f54343b08bfd95a35d73c5f09a9ebe63c509fe8443fa74e6efd0fd87defc7cb16725ce3c3d5f7664cfe253faf2cbeb307052dd2269b6266acdb31e2006b9355f673ca5c9cb907605ce071824254b139607a069531f9598f4040ddeb9cd018e9dfa1808032dfb65a4af0820da810a7b58fbb65ac8e65b017a40ec2d445a5c7b78d1f0e717b19427ef1fe6cc08c5e9da5a7d1d508fd939854589dcba8d75ff3d8d1c1fb28af1ed6900bcd4cedbe42fd6243c81264fe81be756bfd71ebcd4d96bd7ec50a676bc57e130bd8da21bb6e888eb6c8402516f6fe6dfe25be9a3e33f2cdbed9de00efb867cbe80ec2309458f41924b967d254166e5a0a5f776395214a67900d180704b9fb09f9c4c4c62fd382fcd5efe099e22d2c82f198a39d193f65b68e09454e2ab8f2d7413c64563742f1c34ca9285e501bff5efa30a0da946f875d23162eaa53c4008bed38e9a190b08ff8bfb6bfb91553c4c329fc73b8be308b00347dee2afdc08bab311c75386f452b706d1820c9038998924665010a548c09743a16167b0b09373b5cd2fb1da4f6c9ea5b1f1dd7775f6fcb23eab4fd1990364dacb2a1656b9bcf1c4866b7222872a3a3a03d397499222a3f31a35d3aeaf6a6d39f0fbee1e0f6e1e10ba0774f15f245d955cc8132d86c2d768f8a06274caa5a12c46e9e08ee556c1da49830f1e6c0a0c53a9ef1489c3fba0251c3e6839e891ac298108f3ed05066e48b8bda2c5f6e691c7a7425b7019e0a547f6560a0af41831a4a790c3a8eac9a3a9119da3eef85cb12f3f3115f04ae95534ac847b4ee2cc2fc43cdba382ecae7c4f499ce1be1ca1907313ff665c2fd7d4c8f36716f33b6861f5cf3f1c878feadfa9a664b8d629a16c750c466326a951efaa830e4f328270041f2ca0be49f0affe5806b94b027033f008957e83d167d6fe4168ec4fb79385cc06e257bba807ecfccaba56cf751dac996b7a347d36ec52b0f5d16425402416c735530bd7c545f8c753fb3b1054b82bc368ef4ac3000000"}}}}, 0x0)
syz_emit_ethernet(0x56, &(0x7f00000001c0)=ANY=[@ANYBLOB="aaaaaaaaaaaabbbbbbbbbbbb88a800008100000086dd600000000018000000000000000000000000000000000000fc0000000000000100000000000005020000c204"], 0x0)
r1 = socket$inet_udp(0x2, 0x2, 0x0)
getsockopt$EBT_SO_GET_INIT_INFO(r1, 0x0, 0x83, &(0x7f0000000080)={'filter\x00', 0x0, 0x0, 0x90, [], 0x0, 0x0, 0x20001100}, &(0x7f0000000100)=0x108)
syz_usb_connect(0x6, 0xb9b, &(0x7f0000001180)={{0x12, 0x1, 0x0, 0x5d, 0xda, 0xf, 0xff, 0x15c2, 0x45, 0x1188, 0x1, 0x2, 0x3, 0x1, [{{0x9, 0x2, 0xb89, 0x3, 0x3, 0x3, 0x10, 0x8, [{{0x9, 0x4, 0xb4, 0x80, 0x4, 0xb7, 0x7f, 0x8e, 0x5, [@uac_as, @generic={0xff, 0x31, "53d7ad2365be49036f50f18933606fe9e1b8a563e70499462e49bf10250385a08ec36485fe29aed11599ae2c08627502baef4bc2138c112dbe21ef4323dc121b8252f330d3e4e69d828e6cfa02d46f43facd6fe7277484f741d058b208d366ec12e0f91af7a0ac3d9647c6433eb8edb64daa2223d24acd7362ceae72fa02db593d0deff251da46a71d1d113fed5402a8016a59f45b33fad6e6322dd7f7fd96a56eddb09d8d5f1e66e34fb3b140829a09064da0c0ec7632e8b14dfbc39dc9ee1f4816b6e170137236227f87f5920beda4b667aba0c4fb43a59ca0ee6a1bf92d05a5c996fe1596ddb6fe75c33eab49110238fc92e800e58b31e81ea2ffaf"}], [{{0x9, 0x5, 0x80, 0x0, 0x8, 0x8, 0x0, 0xdc}}, {{0x9, 0x5, 0x0, 0x10, 0x40, 0xba, 0x6, 0x2, [@generic={0x6f, 0x23, "c9e7056e9f622a8ace4aedf0dde290594d15d39cff119ec46638b6dc31d16c74e8b6220517e069e00f277395c6901ec15625838479e2bcf47117164f992808b8f1319c238d048cc6d8b3164f579bd9e532fd28a6574568491b47f6fe047bb7bbfbe47db03485ec5e4604ca2177"}, @generic={0xb5, 0xf, "bcd0a17b0c515e32ac3ab4b66a7d1c5d7dee289c0024cdd65536daf8f85ed6edca9696d7c2341b92b4ac2e77bf68be4ec578bae281170aa9ea3d4b33f123af957d17e0e612836451ca11cf4b32d9ebbc286780505d5f6ed45fcf262221174ca34bf121975d3b748b1c5c679e584336f9e0465cbb5692da3b8e61e3d43e19f76a6f1534269519bd9c1f5889e859e23d842172201b249267eee07b5b0e9d48d77c65bae64af8319467479e5cc5a0ed80c064cfe8"}]}}, {{0x9, 0x5, 0x4, 0x10, 0x40, 0x0, 0x6d, 0x3, [@uac_iso={0x7, 0x25, 0x1, 0x1, 0x0, 0x2}]}}, {{0x9, 0x5, 0x2, 0x2, 0x200, 0x7, 0x1, 0x5a, [@generic={0xb, 0x3, "a34459366f2d3fef5c"}]}}]}}, {{0x9, 0x4, 0x5, 0x9, 0x6, 0x63, 0xba, 0x11, 0x6, [@hid_hid={0x9, 0x21, 0x3, 0xa, 0x1, {0x22, 0xa45}}, @cdc_ecm={{0x7, 0x24, 0x6, 0x0, 0x0, "f5df"}, {0x5, 0x24, 0x0, 0x7103}, {0xd, 0x24, 0xf, 0x1, 0x78c, 0x8, 0x4}, [@obex={0x5, 0x24, 0x15, 0xa1f}, @acm={0x4, 0x24, 0x2, 0xa}, @country_functional={0x12, 0x24, 0x7, 0xb, 0x8cb, [0x7, 0x5618, 0x7, 0x7, 0x8, 0xd05]}, @mdlm={0x15, 0x24, 0x12, 0xa2c2}]}], [{{0x9, 0x5, 0x5, 0x10, 0x10, 0x0, 0x4, 0x2b, [@uac_iso={0x7, 0x25, 0x1, 0x3, 0x7f, 0x6}]}}, {{0x9, 0x5, 0x1, 0xc, 0x40, 0xc1, 0x80, 0xe1, [@generic={0xab, 0x22, "75f090879e790734657c38dc22fbc9cc013c0998c91d9bb3f341fa69dcbae910fbe4cd94f561ee40aa2a56590728a2a3ccf5a06fb14f266e19b68b0f5cdc5e933188c02434f3e4c0123c049454295e469f073f765beb2a14be0e0b6324c7c68f1ec45842972893e351460316566eddf79ad03b9a8dcf80b1684c21b6a4412598c3aa36258cd66e77164ba00874120eb44f79be0b1861a16b82a2bb7f0c299c2d0d5feb056e895ca70d"}]}}, {{0x9, 0x5, 0x8, 0x1, 0x10, 0x7, 0x5, 0x6, [@generic={0xd7, 0x6, "026db6ccfdf9d8cc839dffa549d1da7081c1e9455af81c5f3f658ae0f0f2ae98962606f775571a76effa86809965ef5411b3fc5db8660f46df6c6640da024bea65c8b105634808fcc2884897a4df53c4c5611c66aa5446b9dd8fcb29e5027af00e42346bea3844b6e2a1e505b7405f78b38abd7f6f5dfa97eceb10393cfa4541c1ba40105dc74b7ebfaab8036841d35206b5eb9aa36b97afcb044979b1082bf5ae0cbe566b3b69600f51097b8057bdf20a643ca0e82b05d231ee80c623193235c5b7aec10a87be5d43425257925e4ee076bf0a42a6"}]}}, {{0x9, 0x5, 0x2, 0x0, 0x1ff, 0xb, 0x1, 0x0, [@generic={0xfc, 0x3, "fd1eb78038c28173a9b72205b5c9cb0569326b27509706c8e7985e3b51c6de55ce92a9d31b05d8dd6600f1c27c2c15dd8df232c0528485534ef0254deb5431d6a0aeaf9a4a8bfda015c4732e86a3dee9c08fd7dbf33be9a1f1efa2a5cac96271218fa61c3a3b1f6d9353ccc0f79f0775aa078b91aea5287a4e060ed702cb516849165ef60f0ec3f74aa827e4e732b3ecb26c44fbbc620199b92f98cd85ef762f9fd2b930cd997b025fc51d8a90ce2808948adc331b853becfdc41c1fe993442b855a7743917c64beee386672e97101505dbbb725146f948363853edefa89f134f8ce4775f9d7548b79c2fd2886be0dd4deaaafbec22ff7424ee7"}]}}, {{0x9, 0x5, 0x5, 0xe6e75f5fef1fa876, 0x0, 0x6, 0x40, 0xe}}, {{0x9, 0x5, 0x1, 0x2, 0x400, 0xfa, 0x3, 0x5, [@uac_iso={0x7, 0x25, 0x1, 0x0, 0x80, 0x3}, @uac_iso={0x7, 0x25, 0x1, 0x0, 0x97, 0x3}]}}]}}, {{0x9, 0x4, 0x90, 0x80, 0x10, 0x13, 0x3e, 0x74, 0xc, [@hid_hid={0x9, 0x21, 0x80, 0x2, 0x1, {0x22, 0xa31}}, @cdc_ncm={{0x6, 0x24, 0x6, 0x0, 0x1, 'n'}, {0x5, 0x24, 0x0, 0xff}, {0xd, 0x24, 0xf, 0x1, 0x7, 0x7fff, 0x6, 0x4}, {0x6, 0x24, 0x1a, 0xf, 0x9}, [@country_functional={0xe, 0x24, 0x7, 0x4, 0x6, [0x3, 0x1, 0x9, 0x3fe3]}]}], [{{0x9, 0x5, 0x8, 0x1, 0x400, 0x1, 0x6, 0xc, [@generic={0x38, 0x2, "edaaffd26ae500fa3d240696abf7b42c5d37d8c888553568a1c9276c972a7aec1b10f6fe3782609741aee507b79666ca4956826465ae"}]}}, {{0x9, 0x5, 0x8, 0xc, 0x10, 0x6f, 0x0, 0x5, [@generic={0x2a, 0x5, "bc4c3bcda19a39350b4ca728b7fc295e95bdf7e948c185cb996e3f1e2aea80c01452097d290cb69e"}]}}, {{0x9, 0x5, 0x9, 0x3, 0x400, 0x8, 0xc8, 0x83}}, {{0x9, 0x5, 0x80, 0x1, 0x10, 0x9, 0x70, 0x80, [@generic={0x94, 0x4, "bf7057e6b4401a0d86dc2ebabe87e45f7e613ab858007374a75f354b6697fa0f2092c16a32c27f5d3dec94c576afc7c843071d43996c16e580dc71fd9a4a6d2d63155fbe9ca1dd202e723d9e31c7d69f08f570143ebd2c5fe15d13326884270513695c4799d5ae54218391faa328bd13a4f5f0fcd9b3ba58d3c2206632df7aeb5fd598c6f410543e84495d1b361b508781a4"}]}}, {{0x9, 0x5, 0xd, 0x4, 0x20, 0x2, 0xb, 0x2c, [@uac_iso={0x7, 0x25, 0x1, 0x82, 0x0, 0x6}, @generic={0xec, 0x5, "c567ec5430ba3e2ea8c669cb5db567e6ae672e9f2242e6e1617f62e68dc571586d4f59eb776e8264152215e4290e725b690a8bcb43afc96968dabb5a63e79a706e4fe7ef6cf971e82676614ca8fb09f299fcb66f2d2c08f99c955446d8bfe931b0f07f38f60ed28786919e99ce6640db912f116d31065c69ec94a723d50f47b798bf43148a4770d7a586f58d7ae9abefe08da032fd874f2a6ac070c41cfba5aa52d2890432b3a9747a87c1aa74e10c47e45c8c61ae705daad61a85a4b4b49e0f27a96a4958585b22e63378593cd7d7a7df0a05b504fe6cb98e725cb5f85b25bac8e3b0489687cd1fac53"}]}}, {{0x9, 0x5, 0x8, 0xf, 0x200, 0x8, 0x4, 0x0, [@generic={0xa, 0x21, "5da9c07b4abc5ba1"}, @uac_iso={0x7, 0x25, 0x1, 0x2, 0x69, 0x5}]}}, {{0x9, 0x5, 0x5, 0x3, 0x8, 0xe2, 0x5, 0xbc, [@generic={0x72, 0xc, "5b1e6d5a062dc634cb0979dbe54b07285dec8dd8152a543d74edfdd3112ccf5506c0aee67b5c1f973fc3ec9894815e4bfc82dbf6de7a03e73e674e7ae17a72b881a50444e1f8f2c7c1ce8afcf9dd8a0deb7a44405691be3e99e7087a1f2ffa2adca38d98fa0336883d1d371e882571cd"}]}}, {{0x9, 0x5, 0xe, 0x4, 0x20, 0xc5, 0x1, 0x9}}, {{0x9, 0x5, 0xb, 0x2, 0x40, 0x7, 0x0, 0x80, [@generic={0x29, 0x9, "795f56d9fdb34b739c617047e783e51486c42d65bf32511ac160986e85cf3cbbbca11898494470"}]}}, {{0x9, 0x5, 0x2, 0x3, 0x478, 0x15, 0xb, 0xd6, [@generic={0x88, 0x7, "e4b74f75738698a424645af745f95346b75369a9f06ef51b4eaff019a08e1ef49f435a9be0102bf467775d5c4c680103571b746b85bd8922d82f00915862ca1fb50f4f53880d297e81ae7150ebf7d480206a1e7743eae4c4296f1abe6eb390313ebbeb9ff4785b4c6550a65e9633c068854cb92ae2cdfe7cb8583a8b93940d0878bf6e0331cf"}, @uac_iso={0x7, 0x25, 0x1, 0x80, 0x2, 0x7}]}}, {{0x9, 0x5, 0x8b, 0xc, 0x20, 0x80, 0x5, 0x4, [@generic={0x7e, 0x22, "49e72bdbb20a774a430fb3812e2097dd950162d95596082334f05158d1efe42e14d407f6f4f48e8d4296f6f1eb3ac392bde60d92ea1c4ab6d1352784fb371025d27b28c8163b2035421f22d5ed4efd15c030429246ee67abd13dab004d8b3504b387ae25d995013e78685d22c4757a994cf1552b510ae6dc608b270b"}, @uac_iso={0x7, 0x25, 0x1, 0x0, 0x3, 0x2}]}}, {{0x9, 0x5, 0x4, 0xd, 0x200, 0x4, 0x1, 0x2, [@uac_iso={0x7, 0x25, 0x1, 0x81, 0x6, 0x1}, @generic={0x60, 0xc, "6a9940c3959e493e39df96513ecabb5f5aa06252e288f4bba69cb532ca621e5900be381ad646b730d16279bfc21d96794b0681f8847430d5e80df461c7f446ee4dbc9f044b4c7e4e26c1bcc3a3668d7fe26b0b7af772aac0d97c1ca9f81e"}]}}, {{0x9, 0x5, 0x0, 0x8, 0x40, 0x2a, 0x8, 0x8}}, {{0x9, 0x5, 0x5, 0x10, 0x200, 0xaf, 0x8d, 0x58}}, {{0x9, 0x5, 0x80, 0x1, 0x20, 0x76, 0xf4, 0x10, [@generic={0x62, 0x21, "02c676c77dd100042eaa784108c97fd0d37830a83e5fc19ed00eb493da45ecc811111017f1d90b425d82f51557adf66def4cd3ae96333d5708d21088d2bf6e8f35fb10f93bacb2bd47c8e6ae832588bf0d64fda79226827c86a6fe4f19bd9e47"}, @generic={0xb3, 0x22, "aed784e28c37978f9ff1bb64f686c73adc057d7cd56e9c3b07557d1f80f467a9c7e52cdac900305267d4bf06338faf5f715fd7ba7147fa082b88302a81dc830948ef36ffeb4e1d8b08eebe96004b270e66d7f52ee319ed925c537dbbf26c2cf75140562077fbc7741018940d9424cf88dddc5ab7457991d076c433a549b0f0da200e7dee5a3ce3cc4d115d46799f2db767d72ed200c23daf9c0ac230806bb7c56b156bde2d673f49853de6ab0a9cf3d6f2"}]}}, {{0x9, 0x5, 0x8, 0x0, 0x3ff, 0x5, 0x0, 0x61, [@uac_iso={0x7, 0x25, 0x1, 0x3, 0x6, 0x8}]}}]}}]}}]}}, &(0x7f00000020c0)={0xa, &(0x7f0000000040)={0xa, 0x6, 0x201, 0x4, 0xe, 0xf, 0xff, 0x58}, 0x5, &(0x7f0000000140)={0x5, 0xf, 0x5}, 0x9, [{0xc3, &(0x7f0000001d40)=@string={0xc3, 0x3, "f626fa159955511ed11219317e6d9e5e9f7a90a0b4555771596abfccff390c53d0efc4d125e55d4b3fa16248ae6e1ac294d5bbd9513755c268be87b1dd7726678d1e674561711cba6173e69ffdf625c24745c236d950d1388a5c07c04865323ceb3b914f404f4e42cea7f2254f7cdfcfa959481142a7905d4dbcf297821d5b0d11d452c99db379ef23a1fea9447e79c5c54d66488efac7104cae99cd2d1ebcf959383d98d6a07bfbca295aaba2ab951cbb12e05ade1b8556d6d4994616d9bf7ffb"}}, {0x2a, &(0x7f0000000180)=@string={0x2a, 0x3, "40509238a4534b23a5e68c5fa0867efc5fb48db69d05da6c8390d51d8906be519d362f84444bcd4c"}}, {0xb9, &(0x7f0000001e40)=@string={0xb9, 0x3, "0bba15cc50ff152bd055c954ad8fe630a5a3bb58c0f0881c06669cd1db732b220b0fd40103db19db00df0292261dacde8e48467bd9eee011bd1b18f7ab9aa88ade0df55bf89bed79e62b3ba5b25134c7773d47be1dfc45c3042eb3e6c2a29573e465e166846428581279c6f75514af19813c0ce08198fbbcdf7ab9ad2d4517c3c17ac22cd24b179728243acafc5bb14706a842f2b86cb493e8c5653649a06e27d0848f20a6e675e154cabb79403ad666fb56231f96982a"}}, {0x30, &(0x7f0000001f00)=@string={0x30, 0x3, "4dc9cffd703d20516cd6ea38d899fce879e808233da158bab20e3eacc819169bfd2e97fa5c6b29d3f816fe4e1031"}}, {0x4, &(0x7f0000001f40)=@lang_id={0x4, 0x3, 0x44b}}, {0x48, &(0x7f0000001f80)=@string={0x48, 0x3, "8b80334592dba48ea2eddf6ae239cca8f71ae1870414af5246e311765b4a6f037e06e8285fb61257cf4fe06355b1ddb20a8a785495cbba2eb682e3a199c35d88f668b23ebbf1"}}, {0x4, &(0x7f0000002000)=@lang_id={0x4, 0x3, 0x402}}, {0x22, &(0x7f0000002040)=@string={0x22, 0x3, "841982d662924ffe964cafd052b113a1762deb8de25c9d952229ec9cc0e03e68"}}, {0x4, &(0x7f0000002080)=@lang_id={0x4, 0x3, 0x414}}]})
setsockopt$inet6_IPV6_FLOWLABEL_MGR(r0, 0x29, 0x1b, &(0x7f00000000c0)={@remote={0xfe, 0x80, '\x00', 0xffffffffffffffff}}, 0x20)
close_range(0xffffffffffffffff, 0xffffffffffffffff, 0x2)
r2 = socket$packet(0x11, 0x2, 0x300)
setsockopt$packet_fanout(r2, 0x107, 0x12, &(0x7f0000000140)={0x0, 0x6}, 0x4)
setsockopt$packet_fanout_data(r2, 0x107, 0x16, &(0x7f0000000100)={0x2, &(0x7f0000000080)=[{0x30, 0x0, 0x0, 0xfffff010}, {0x6}]}, 0x10)
syz_emit_ethernet(0x36, &(0x7f0000000440)=ANY=[], 0x0)
r3 = userfaultfd(0x801)
ioctl$UFFDIO_API(r3, 0xc018aa3f, &(0x7f0000000180))
ioctl$UFFDIO_REGISTER(0xffffffffffffffff, 0xc020aa00, &(0x7f00000000c0)={{&(0x7f0000bcc000/0x4000)=nil, 0x4000}})
ioctl$UFFDIO_REGISTER(r3, 0xc020aa00, &(0x7f0000000100)={{&(0x7f00000e2000/0xc00000)=nil, 0xc00000}, 0x1})
r4 = socket$inet_tcp(0x2, 0x1, 0x0)
bind$inet(r4, &(0x7f0000000200)={0x2, 0x4e20, @empty}, 0x10)
connect$inet(r4, &(0x7f0000000000)={0x2, 0x4e20, @dev={0xac, 0x14, 0x14, 0x18}}, 0x10)
sendmsg$inet(r4, &(0x7f00000015c0)={0x0, 0x14, &(0x7f0000001600)=[{&(0x7f0000000240)=' ', 0xffffff1f}], 0x1}, 0x0)
sendto$inet(r4, &(0x7f00000000c0)="ff", 0x1, 0xc880, 0x0, 0x0)
recvmsg(0xffffffffffffffff, &(0x7f0000000580)={0x0, 0x2, &(0x7f0000000500)=[{&(0x7f0000000740)=""/4096, 0xffffff34}], 0x1}, 0x700)
ppoll(&(0x7f0000000000)=[{r3, 0x4047}], 0x1, 0x0, 0x0, 0x0)
sendmsg$key(r0, &(0x7f00000022c0)={0x0, 0x0, &(0x7f0000002280)={&(0x7f0000002180)={0x2, 0x1, 0x40, 0x9, 0x19, 0x0, 0x70bd2c, 0x25dfdbfc, [@sadb_x_filter={0x5, 0x1a, @in=@multicast1, @in6=@ipv4={'\x00', '\xff\xff', @broadcast}, 0x1a, 0x10, 0x14}, @sadb_key={0x12, 0x8, 0x440, 0x0, "5b1f3ec08c622014c810875579cc91d2301a66e432b6086f01d52fe57424add18160980fe418f79914a7928eab3f5033965b2a81f999e501244d60634fd5fec7df86b60b5d3496d252c583339a306a65263df092e1a145d8184dfe011e360d48688988cb950270ebafddc4773ab1478d5608619df878ea3f946d8caa3e82ddf9c1f9804369f306b3"}]}, 0xc8}}, 0x10)
syz_io_uring_setup(0x1f87, &(0x7f0000000080)={0x0, 0x0, 0x13580}, &(0x7f0000000100), &(0x7f0000000280))
syz_emit_ethernet(0x42, &(0x7f00000002c0)={@local, @empty, @void, {@ipv6={0x86dd, @udp={0x0, 0x6, "e90e5b", 0xc, 0x11, 0x0, @rand_addr=' \x01\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x02', @remote, {[], {0x0, 0x0, 0xc, 0x0, @gue={{0x1, 0x0, 0x0, 0x0, 0x0, @void}}}}}}}}, 0x0)
executing program 1:
r0 = socket$inet_tcp(0x2, 0x1, 0x0)
setsockopt$inet_mreqn(r0, 0x0, 0x27, &(0x7f0000000180)={@multicast2, @loopback}, 0xc)
r1 = socket$inet_tcp(0x2, 0x1, 0x0)
ioctl$sock_inet_SIOCSIFFLAGS(r1, 0x8914, &(0x7f0000000040)={'lo\x00'})
socket$nl_route(0x10, 0x3, 0x0)
socket$inet6_icmp_raw(0xa, 0x3, 0x3a)
clock_adjtime(0x0, 0x0)
bpf$BPF_PROG_QUERY(0x9, 0x0, 0x0)
capset(0x0, &(0x7f0000000080))
r2 = socket$inet(0x2, 0x2, 0x0)
setsockopt$inet_mreqn(r2, 0x0, 0x23, &(0x7f0000000740)={@multicast2, @loopback}, 0x40)
setsockopt$inet_msfilter(r2, 0x0, 0x29, &(0x7f0000000080)=ANY=[@ANYBLOB="e00000027f0007000000000002"], 0x18)
sendto$inet6(0xffffffffffffffff, &(0x7f00000001c0)="b598e0841188bcc22b5c9bd69505e6346a0b742c9dc891ca89f4cd6c4d7da44ee6ae74ae2df8125f7f87f7b0c4bd70d264b5f357e6346aaa2c1f6bb3340c6cc723f81bf231cd53eb68a16eea1b824b1251b59f8eacf1f02d5ebbe2d44cb6b22975130c0a1aa4e8d2885f0bb04169f488fc5a758c478da9572de7ec70c4b1dae0bd4689d3a08071fe647b277f9844f651cd381eb53ce387575328024dcd98ef0ddb2df55fa4374e97901beb60129f5cef0417b52e76175b64002d577272e0cededabe452844b7ad123d4b3d8f4dc4ef643eef72d07b3f94dbad75", 0xda, 0x40014, &(0x7f0000000000)={0xa, 0x4e23, 0x6, @empty, 0xfffffff7}, 0x1c)
r3 = socket(0x0, 0x4, 0x0)
r4 = socket$packet(0x11, 0x3, 0x300)
ioctl$sock_SIOCGIFINDEX(r4, 0x8933, &(0x7f0000000040)={'xfrm0\x00', <r5=>0x0})
sendto$packet(r3, &(0x7f0000000100)="4dcdc7d96a760000002c00050000000000060000", 0x34, 0x0, &(0x7f0000000000)={0x11, 0x0, r5, 0x1, 0x0, 0x6, @link_local}, 0x14)
close(r0)
executing program 1:
mkdir(&(0x7f00000001c0)='./file0\x00', 0x0)
r0 = syz_open_procfs(0x0, &(0x7f0000000000)='net/sctp\x00')
r1 = open_tree(r0, &(0x7f0000000640)='\x00', 0x89901)
move_mount(r1, &(0x7f0000000040)='.\x00', 0xffffffffffffff9c, &(0x7f0000000180)='./file0\x00', 0x0)
mount_setattr(0xffffffffffffff9c, &(0x7f00000017c0)='./file0\x00', 0x70000000, &(0x7f0000000280)={0x80}, 0x20)
executing program 1:
r0 = socket$unix(0x1, 0x1, 0x0)
r1 = socket$kcm(0x10, 0x3, 0x10)
recvmsg$kcm(0xffffffffffffffff, &(0x7f0000000c40)={0x0, 0x0, 0x0, 0x0, &(0x7f00000008c0)=""/164, 0xa4}, 0x0)
sendmsg$inet(0xffffffffffffffff, &(0x7f0000000d40)={0x0, 0x0, 0x0, 0x0, &(0x7f0000000a40)=ANY=[@ANYBLOB="7c00000000000000000000000700000044140001ac1414aa00000000ac1414000000000000441c0003e0000001000000007f000001000000000000000000000000442c000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000a400000000000000000000000700000044280000000000000000000000000000000000000000000000000000000000000000000000000000071700e0000002ac1414bb00000000e0000002ac1414bb018616000000000010c986d78e6c4b9394b247217b87cb00830b00000000007f000001861f0000000000020010421487f84baabcbcfb42a4d90bab000748c68c4c31001089ca45d9612e5b5c11f12bc78a41000000000000006c000000000000000000000007000000441c0003ffffffff000000000000000000000000e00000010000000044340001ac1414bb0000000000000000000000000000000000000000ac1414aa00000000ac14140000000000ac1e000100000000830b0000000000e000000200000000001c00000000000000000000000800"/424, @ANYRES32=0x0, @ANYBLOB="ac1414aa00000000000000001400000000000000000000000200000000000000000000001c000000000000000000000008000000", @ANYRES32=0x0, @ANYBLOB="e00000017f000001000000001c000000000000000000000008000000", @ANYRES32=0x0, @ANYBLOB="7f000001ac141400000000001c000900000000000000000007010000440c0001022101"], 0x230}, 0x0)
sendmsg$kcm(r1, &(0x7f0000000000)={0x0, 0xffffff0a, &(0x7f0000000080)=[{&(0x7f0000000040)="c01803001d000b0ad25a80648c2594f90124fc60100c0a4001000009053582c137153e370248078000f01700d1bd", 0x33fe0}], 0x1, 0x0, 0x0, 0x4000}, 0x3500000000000000)
r2 = socket$inet(0x2, 0x1, 0x0)
ioctl$sock_ipv4_tunnel_SIOCCHGTUNNEL(0xffffffffffffffff, 0x89f3, &(0x7f0000000000)={'sit0\x00', &(0x7f00000003c0)={'syztnl1\x00', 0x0, 0x0, 0x0, 0x0, 0x10000, {{0x33, 0x4, 0x0, 0x0, 0xcc, 0x0, 0x0, 0x0, 0x2f, 0x0, @empty, @remote, {[@timestamp={0x44, 0x18, 0x0, 0x0, 0x9, [0x402, 0x5, 0x0, 0x5, 0x4]}, @timestamp_prespec={0x44, 0x44, 0xc0, 0x3, 0x1, [{@private=0xa010100}, {@local, 0x5}, {@remote}, {@dev={0xac, 0x14, 0x14, 0x32}, 0x659}, {@broadcast}, {@empty, 0x4}, {@multicast1, 0xffd200}, {@private=0xa010100, 0x7}]}, @timestamp_prespec={0x44, 0x3c, 0x0, 0x3, 0x8, [{@dev}, {@remote, 0x4}, {@multicast2, 0x7}, {@private=0xa010101}, {@rand_addr=0x64010101}, {@broadcast, 0x52b1}, {@multicast2}]}, @lsrr={0x83, 0xb, 0x7, [@multicast1, @broadcast]}, @noop, @noop, @lsrr={0x83, 0xf, 0xdc, [@private=0xa010102, @rand_addr=0x64010102, @multicast1]}, @end]}}}}})
r3 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000140), 0x0, 0x0)
r4 = ioctl$KVM_CREATE_VM(r3, 0xae01, 0x0)
r5 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000040)='hugetlb.2MB.usage_in_bytes\x00', 0x275a, 0x0)
write$binfmt_script(r5, &(0x7f0000000240), 0x208e24b)
mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x1000001, 0x28011, r5, 0x0)
dup(r4)
ioctl$KVM_SET_USER_MEMORY_REGION(r4, 0x4020ae46, &(0x7f0000000080)={0x0, 0x2, 0x0, 0x2000, &(0x7f0000000000/0x2000)=nil})
syz_kvm_setup_cpu$x86(0xffffffffffffffff, 0xffffffffffffffff, &(0x7f0000000000/0x18000)=nil, &(0x7f0000000300)=[@text64={0x40, 0x0}], 0xffff, 0x0, 0x0, 0x0)
syz_kvm_setup_cpu$x86(r4, 0xffffffffffffffff, &(0x7f0000000000/0x18000)=nil, &(0x7f0000000200)=[@text64={0x40, 0x0}], 0x1, 0x0, 0x0, 0x0)
ioctl$KVM_REGISTER_COALESCED_MMIO(r4, 0x4010ae67, &(0x7f00000001c0)={0x0, 0xd000})
ioctl$KVM_NMI(0xffffffffffffffff, 0xae9a)
ioctl$KVM_RUN(0xffffffffffffffff, 0xae80, 0x0)
setsockopt$EBT_SO_SET_ENTRIES(r2, 0x0, 0x80, &(0x7f0000000080)=@broute={'broute\x00', 0x20, 0x2, 0x330, [0x0, 0x0, 0x0, 0x0, 0x0, 0x20000580], 0x0, 0x0, &(0x7f0000000580)=ANY=[@ANYBLOB="00000000000000000000000000000000000000000000000000000000000000000002000000000000feffffff0100000019000000000000000000726f7365300000000000000000000000726f736530000000cc002000000000007465616d5f736c6176655f310000000064756d6d7930000000000000000000000180c2000000000000000000ffffffffffff0000000000000000d00000000801000038010000706b74747970650000000000000000000000000000000000000000000000000008000000000000000000000000000000706b747479706500000000000000000000000000000000000000000000000000080000000000000000000000000000006d61726b0000000000000000000000000000000000000000000000000000000010000000000000000000000000000000ddffffff00000000726564697265637400000000396c27db39b2eedb0000000000000000000000000800000000000000feffffff0000000000000000000000000000000000000000000000000000000000000000000000000000000001000000ffffffff0000000000000000000000000000000000000000000000000000000000000000000000000000000001000000feffffff0000000000000000000000000000000000000000000000000000000000000000000000000000000001000000ffffffff0100000003000000000000008b357665746831000000000000000000000074756e6c30000000000000000000000074756e6c300000000005000000000000006c616e300000000000000000000000aaaaaaaaaabb000000000000aaaaaaaaaa0000000000000000000001000000010000380100006367726f75700000000000000000000000000000000000000000000000000000080000000000000000000000000000006172700000000000000000000000000000000000000000000000000000000000380000000000000000000000000000000000000000000b00007f0000010000000072ce35f34121000000000000000000000000000000000000eaffffff00000000646e6174000000000000000000000000000000000000000000000000000000001000000000000000aaaaaaaaaabb0000fdffffff000000"]}, 0x3a8)
ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000180)={'vxcan1\x00', <r6=>0x0})
r7 = socket$can_raw(0x1d, 0x3, 0x1)
setsockopt$CAN_RAW_ERR_FILTER(r7, 0x65, 0x7, &(0x7f00000001c0)=0x8, 0x4)
sendmsg$can_raw(r7, &(0x7f00000004c0)={&(0x7f00000005c0)={0x1d, r6}, 0x10, &(0x7f0000000500)={&(0x7f00000000c0)=@can={{}, 0xff, 0x0, 0x4, 0x0, '\b-\x00'}, 0x10}}, 0x0)
executing program 3:
mknodat$null(0xffffffffffffff9c, &(0x7f0000000240)='./file0\x00', 0x0, 0x103)
r0 = openat$fuse(0xffffffffffffff9c, &(0x7f0000000000), 0x2, 0x0)
mount$fuse(0x0, &(0x7f0000000100)='./file0\x00', &(0x7f0000000140), 0x0, &(0x7f0000000380)=ANY=[@ANYBLOB='fd=', @ANYRESHEX=r0, @ANYBLOB=',rootmode=00000000000000000060000,user_id=', @ANYRESDEC=0x0, @ANYBLOB, @ANYRESDEC=0x0])
r1 = openat$fuse(0xffffffffffffff9c, &(0x7f0000000140), 0x2, 0x0)
mount$fuse(0x0, &(0x7f0000002880)='.\x00', &(0x7f00000028c0), 0x0, &(0x7f0000000440)=ANY=[@ANYBLOB='fd=', @ANYRESHEX=r1, @ANYBLOB=',rootmode=00000000000000000120000,user_id=', @ANYRESDEC=0x0, @ANYBLOB=',group_id=', @ANYRESDEC=0x0])
mount$fuse(0x0, &(0x7f0000002880)='.\x00', &(0x7f00000028c0), 0x0, &(0x7f0000000080)={{'fd', 0x3d, r1}, 0x2c, {'rootmode', 0x3d, 0x1000}})
ioctl$FS_IOC_GETFSMAP(0xffffffffffffffff, 0xc0c0583b, &(0x7f0000000280)=ANY=[@ANYBLOB="75722629832bf6042ad514e956a1000000004c900200000000002300e1583afceb7a4d65f34269c5dc343054f84d3b01000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000feffffffffffffff000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000ffffffff000000000000000000000000000000000000040000000000000000000000000000000000000000000000000000000000000000000000000000000000273a07bc1ab0b40b66"])
r2 = socket$unix(0x1, 0x2, 0x0)
bind$unix(r2, &(0x7f0000000100)=@file={0x1, '\xe9\x1fq\x89Y\x1e\x923aK\x00'}, 0x6e)
r3 = socket$unix(0x1, 0x2, 0x0)
connect$unix(r3, &(0x7f0000000180)=@file={0x1, '\xe9\x1fq\x89Y\x1e\x923aK\x00'}, 0x6e)
writev(r3, &(0x7f0000000040)=[{&(0x7f0000000200)="d243a1a4ca56", 0x6}], 0x1)
setsockopt$SO_TIMESTAMP(r2, 0x1, 0x23, &(0x7f0000000080)=0x6, 0x26)
setsockopt$SO_TIMESTAMPING(r2, 0x1, 0x25, &(0x7f00000000c0)=0x41d9, 0x4)
recvmmsg(r2, &(0x7f0000005d00)=[{{&(0x7f0000000380)=@pppol2tpv3in6={0x18, 0x1, {0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, {0xa, 0x0, 0x0, @loopback}}}, 0x80, &(0x7f0000000000)=[{&(0x7f0000000400)=""/196, 0xc4}, {&(0x7f0000000500)=""/4096, 0x1000}], 0x2, &(0x7f0000000240)=""/64, 0x40}, 0x93}, {{&(0x7f0000001500)=@l2={0x1f, 0x0, @fixed}, 0x80, &(0x7f0000001640)=[{&(0x7f0000001580)=""/145, 0x91}], 0x1}, 0xffffff80}, {{&(0x7f0000001680)=@rc, 0x80, &(0x7f0000003b40)=[{&(0x7f0000001700)=""/44, 0x2c}, {&(0x7f0000001740)=""/198, 0xc6}, {&(0x7f0000001840)=""/240, 0xf0}, {0x0}, {&(0x7f0000001940)=""/162, 0xa2}, {&(0x7f0000001a00)=""/4096, 0x1000}, {&(0x7f0000002a00)=""/156, 0x9c}, {&(0x7f0000002ac0)=""/4096, 0x1000}, {&(0x7f0000003ac0)=""/92, 0x5c}], 0x9}, 0x1}, {{0x0, 0x0, &(0x7f0000005c80)=[{&(0x7f0000003c00)=""/4096, 0x1000}, {&(0x7f0000004c00)=""/24, 0x18}, {&(0x7f0000004c40)=""/4096, 0x1000}, {&(0x7f0000005c40)=""/30, 0x1e}], 0x4, &(0x7f0000005cc0)=""/16, 0x10}, 0x2}], 0x4, 0x10000000009c, 0x0)
executing program 3:
r0 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000001c0)='cpuacct.usage_sys\x00', 0x275a, 0x0)
write$binfmt_script(r0, &(0x7f0000000340), 0x4)
r1 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000440), 0x0, 0x0)
r2 = ioctl$KVM_CREATE_VM(r1, 0xae01, 0x0)
r3 = socket$inet_sctp(0x2, 0x0, 0x84)
setsockopt$inet_sctp_SCTP_PEER_ADDR_THLDS(r3, 0x84, 0x1f, &(0x7f0000000b80)={0x0, @in6={{0xa, 0x4e21, 0x1, @rand_addr=' \x01\x00', 0x53}}}, 0x90)
r4 = ioctl$KVM_CREATE_VCPU(r2, 0xae41, 0x0)
socket(0x10, 0x3, 0x0)
r5 = socket$packet(0x11, 0x2, 0x300)
ioctl$sock_SIOCGIFINDEX(r5, 0x8933, 0x0)
prlimit64(0x0, 0xe, 0x0, 0x0)
sched_setscheduler(0x0, 0x0, 0x0)
sched_setscheduler(0x0, 0x0, 0x0)
sched_setaffinity(0x0, 0x8, &(0x7f0000000040)=0x10001)
r6 = openat$hwrng(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0)
preadv(r6, &(0x7f0000000240)=[{&(0x7f0000033a80)=""/102386, 0xfffffd6e}], 0x1, 0x0, 0x0)
r7 = openat$tun(0xffffffffffffff9c, &(0x7f0000000100), 0x0, 0x0)
fsetxattr(r2, &(0x7f0000000280)=ANY=[@ANYBLOB='os2.com.apurity\x00'], &(0x7f0000000500)='\'\x7f\x84r6\xbf\xdd\'\xc3\x00\x00\x00\xc9\xc8hIB\x14\x1fo\'8Ci\xceZ\xc3+Ae!\xdc\r\xa9\xc74c\xfb5\x7f\x91T\r\xcb\xb9\xb2\xb5e\x1aS\"\xb40M\xd6\xaa\xad\xa5\xf1\x9b\x1a\a\x90\'\xe5\xc0\xc9OK\x95\x15\x14\x06\x9a\xa1\xce\x8c$\xc2\xbf\xe0\xcdp', 0x53, 0x2)
ioctl$TUNSETIFF(r7, 0x400454ca, &(0x7f0000000000)={'pim6reg1\x00', 0x1})
ioctl$sock_SIOCGIFINDEX_80211(r5, 0x8933, &(0x7f00000002c0)={'wlan1\x00'})
ioctl$TUNSETLINK(r7, 0x400454cd, 0x30a)
socketpair$nbd(0x1, 0x1, 0x0, &(0x7f00000000c0)={0xffffffffffffffff, <r8=>0xffffffffffffffff})
ioctl$SIOCSIFHWADDR(r8, 0x8914, &(0x7f0000000140)={'pim6reg1\x00', @link_local})
ioctl$KVM_RUN(r4, 0xae80, 0x0)
mmap(&(0x7f0000000000/0x400000)=nil, 0x400000, 0x2000005, 0x10012, r0, 0x0)
ioctl$KVM_SET_CPUID2(r4, 0x4008ae90, &(0x7f00000004c0)=ANY=[@ANYBLOB="01ec000000010000"])
r9 = openat$tun(0xffffffffffffff9c, &(0x7f0000000140), 0x0, 0x0)
ioctl$TUNSETIFF(r9, 0x400454ca, &(0x7f0000000200)={'syzkaller1\x00', 0xc201})
ioctl$TUNSETLINK(r9, 0x400454cd, 0x324)
executing program 2:
r0 = socket$nl_generic(0x10, 0x3, 0x10)
socket$l2tp6(0xa, 0x2, 0x73)
r1 = socket$nl_route(0x10, 0x3, 0x0)
sendmsg$nl_route(r1, &(0x7f0000000200)={0x0, 0x0, &(0x7f00000001c0)={&(0x7f0000000140)=@ipv4_newrule={0x1c, 0x20, 0x1}, 0x1c}}, 0x0)
r2 = socket$inet6(0x10, 0x3, 0x0)
sendmsg(r2, &(0x7f0000000000)={0x0, 0x0, &(0x7f00000000c0)=[{&(0x7f0000001500)="5500000020007fafb72d13b2a4a2719302000000030b43026c26236925000400fe7f0000bd2dca8a9848a3c728f1c46b7b31afdc1338d509000000000100005ae583de0dd7d8319f98af84fda542e718f94b929ade", 0x55}], 0x1}, 0x0)
socket(0x10, 0x3, 0x0)
geteuid()
r3 = socket$inet(0x2, 0xa, 0x0)
sendmsg$nl_generic(r0, &(0x7f00000029c0)={0x0, 0x0, &(0x7f0000000100)={&(0x7f00000006c0)={0x1dc, 0x10, 0x701, 0x0, 0x0, {0xb}, [@nested={0x1be, 0x4a, 0x0, 0x1, [@typed={0x8f, 0x12d, 0x0, 0x0, @binary="70c9b9fd1dda2dbf4aa73731a82b75decbf264399754fff38b1c688615d971f85999c092199d933c88960f9e5ff69fc17eefe136a23ee36a52c73d96807de3254310f04605d3308364805b3506b6f6c0371ba811de31a070c27f0393a7924da3c9b33a62abb2513d978df03e7d1e0aa26c3ec05d80ce6363fb5aade00f4a6cbbb2058c8864e31b5ca84291"}, @typed={0x4, 0xb8}, @generic="3559298e203d44ab08028f705fe8cab7459817559116bbe135c60612ecb234fb183ff8715d6feb7ec5acee4fd09e8baf2920ae62dc8ab85e79c5c49f397135a5451c8bcf16a07ab2f76f63cde1f1826a6bea3834936815f872a5d781939170011e34c65f02ef2014bbcecefe7e5a54f97fec179f56276792e2563d02f5ec07c370ad81e74acc0ffec4becba777983e7ec6587200868ea1", @typed={0x8, 0x19, 0x0, 0x0, @pid=0xffffffffffffffff}, @typed={0xd, 0x56, 0x0, 0x0, @str='subj_type'}, @generic="3f718d2fabb94504fee06032255c2465489d83254bd130692b01442231099d36d4d1b9cacf73f2cd4f880a4d5a7bb82f109b01d966cc943a9c9b86aad3d2167a3c97163bd801a892798a4d32d3888595120232b2414efca73aba04775e1d3240baf86d278190128580c708eafc8778e6f9f48b8c232e0c"]}, @typed={0x8, 0xa, 0x0, 0x0, @fd=r3}]}, 0x1dc}}, 0x0)
executing program 2:
r0 = socket(0x2, 0x80805, 0x0)
getsockopt$inet_sctp6_SCTP_SOCKOPT_CONNECTX3(r0, 0x84, 0x6f, &(0x7f0000000000)={0x0, 0x10, &(0x7f0000000380)=[@in={0x2, 0x0, @initdev={0xac, 0x1e, 0x0, 0x0}}]}, &(0x7f0000000180)=0x10)
getsockopt$bt_hci(r0, 0x84, 0x20, &(0x7f0000000000)=""/4087, &(0x7f0000001080)=0xff7)
executing program 2:
r0 = socket$inet6_tcp(0xa, 0x1, 0x0)
setsockopt$inet6_IPV6_FLOWLABEL_MGR(r0, 0x29, 0x1b, &(0x7f0000000000)={@remote}, 0x20)
syz_emit_ethernet(0x56, &(0x7f00000001c0)=ANY=[@ANYBLOB="aaaaaaaaaaaabbbbbbbbbbbb88a800008100000086dd600000000018000000000000000000000000000000000000fc0000000000000100000000000005020000c204"], 0x0)
executing program 3:
socket$nl_netfilter(0x10, 0x3, 0xc)
syz_genetlink_get_family_id$nl80211(&(0x7f0000000040), 0xffffffffffffffff)
bpf$ITER_CREATE(0xb, 0x0, 0x0)
prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0)
sched_setaffinity(0x0, 0x8, &(0x7f0000000040)=0x10001)
r0 = openat$hwrng(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0)
setsockopt$TIPC_CONN_TIMEOUT(0xffffffffffffffff, 0x10f, 0x82, &(0x7f0000000100)=0x6, 0x4)
preadv(r0, &(0x7f0000000240)=[{&(0x7f0000033a80)=""/102386, 0xfffffd6e}], 0x1, 0x0, 0x0)
mmap(&(0x7f00002a3000/0x3000)=nil, 0x3000, 0x0, 0x8031, 0xffffffffffffffff, 0x0)
syz_open_procfs$pagemap(0x0, &(0x7f0000000040))
ioctl$PAGEMAP_SCAN(r0, 0xc0606610, &(0x7f0000000080)={0x60, 0x0, &(0x7f0000001000/0x3000)=nil, &(0x7f0000ffb000/0x3000)=nil, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10})
mkdir(&(0x7f00000002c0)='./bus\x00', 0x0)
getsockopt$sock_cred(0xffffffffffffffff, 0x1, 0x11, 0x0, 0x0)
r1 = io_uring_setup(0x65b, &(0x7f0000000080)={0x0, 0xfffffffe, 0x0, 0x800, 0x80})
io_uring_register$IORING_REGISTER_BUFFERS2(r1, 0xf, &(0x7f00000019c0)={0x1, 0x0, 0x0, &(0x7f0000001940)=[{0x0}], 0x0}, 0x20)
ioctl$VIDIOC_CREATE_BUFS(0xffffffffffffffff, 0xc100565c, &(0x7f00000013c0)={0x0, 0x0, 0x0, {0x0, @win={{0xffffffff, 0x4, 0x7}, 0x1, 0x6, 0x0, 0x0, &(0x7f0000000340)="e5816da28f6783b88c4b28b90d3c4a2de8766a1d0ddc3164494e3be232b25b49de053ea0145155eb995cd8f693abaacba569166e9e045c759a4dc04669784d4ea8d2300151c18300332e"}}})
ioctl$sock_SIOCGIFINDEX_80211(0xffffffffffffffff, 0x8933, 0x0)
sched_setaffinity(0x0, 0x8, &(0x7f0000000040)=0x10001)
r2 = openat$hwrng(0xffffffffffffff9c, &(0x7f0000000300), 0x0, 0x0)
preadv(r2, &(0x7f0000000240)=[{&(0x7f0000033a80)=""/102386, 0xfffffd6e}], 0x1, 0x0, 0x0)
fsetxattr$trusted_overlay_upper(0xffffffffffffffff, &(0x7f0000000200), 0x0, 0xac, 0x1)
openat$procfs(0xffffffffffffff9c, 0x0, 0x0, 0x0)
sync()
r3 = openat$rdma_cm(0xffffffffffffff9c, &(0x7f0000000300), 0x2, 0x0)
write$RDMA_USER_CM_CMD_CREATE_ID(r3, &(0x7f00000001c0)={0x0, 0x18, 0xfa00, {0x0, &(0x7f0000000340)={<r4=>0xffffffffffffffff}, 0x13f}}, 0x20)
write$RDMA_USER_CM_CMD_SET_OPTION(r3, &(0x7f0000000180)={0xe, 0x18, 0xfa00, @id_resuseaddr={&(0x7f00000000c0)=0x1, r4, 0x0, 0x1, 0x4}}, 0x20)
write$RDMA_USER_CM_CMD_LISTEN(r3, &(0x7f0000002380)={0x7, 0x8, 0xfa00, {r4}}, 0x10)
r5 = socket$igmp6(0xa, 0x3, 0x2)
ioctl$sock_inet6_SIOCADDRT(r5, 0x4020940d, &(0x7f0000000280)={@ipv4={'\x00', '\xff\xff', @private}, @mcast1, @ipv4={'\x00', '\xff\xff', @multicast1}})
pipe2(&(0x7f0000000200), 0x0)
executing program 2:
r0 = openat$binderfs(0xffffffffffffff9c, &(0x7f00000000c0)='./binderfs/binder0\x00', 0x0, 0x0)
r1 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000100)='./binderfs/binder0\x00', 0x0, 0x0)
r2 = dup3(r1, r0, 0x0)
ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000a80)={0x4c, 0xfc, &(0x7f0000000940)=[@transaction_sg={0x40486311, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x1, 0x600, &(0x7f0000000a00)="05"})
executing program 2:
madvise(&(0x7f0000a93000/0x4000)=nil, 0x4000, 0x80000000e)
mremap(&(0x7f0000a96000/0x1000)=nil, 0x1000, 0x800000, 0x3, &(0x7f0000130000/0x800000)=nil)
mlock(&(0x7f0000000000/0x800000)=nil, 0x800000)
prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0)
sched_setaffinity(0x0, 0x8, &(0x7f0000000040)=0x10001)
r0 = openat$hwrng(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0)
preadv(r0, &(0x7f0000000240)=[{&(0x7f0000033a80)=""/102386, 0xfffffd6e}], 0x1, 0x0, 0x0)
r1 = io_uring_setup(0x1698, &(0x7f0000000140)={0x0, 0x3, 0x0, 0xfffffffc, 0x4})
io_uring_register$IORING_REGISTER_BUFFERS(r1, 0x0, &(0x7f00000002c0)=[{&(0x7f0000001700)=""/4095, 0x440000}], 0x100000000000011a)
mremap(&(0x7f00003c6000/0x4000)=nil, 0x4000, 0x4000, 0x7, &(0x7f00000f4000/0x4000)=nil)
r2 = syz_open_procfs(0x0, 0x0)
writev(r2, &(0x7f0000000100)=[{0x0}], 0x1)
munmap(&(0x7f00001a2000/0x1000)=nil, 0x1000)
r3 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000100), 0x0, 0x0)
r4 = ioctl$KVM_CREATE_VM(r3, 0xae01, 0x0)
r5 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000001c0)='blkio.bfq.io_wait_time_recursive\x00', 0x275a, 0x0)
write$binfmt_script(r5, &(0x7f0000000200), 0x208e24b)
mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x2, 0x28011, r5, 0x0)
ioctl$FS_IOC_FIEMAP(0xffffffffffffffff, 0xc020660b, &(0x7f0000000000)=ANY=[@ANYBLOB="0100"])
preadv(r5, &(0x7f00000015c0)=[{&(0x7f0000000080)=""/124, 0xffffff23}], 0x1, 0x0, 0x0)
r6 = ioctl$KVM_CREATE_VCPU(r4, 0xae41, 0x0)
ioctl$KVM_GET_NESTED_STATE(r6, 0xc048aeca, &(0x7f0000005580)={{0x0, 0x0, 0x80}})
migrate_pages(0x0, 0x3, &(0x7f0000000040)=0x7f, &(0x7f0000000300)=0xa)
r7 = syz_open_procfs$pagemap(0x0, &(0x7f0000000000))
ioctl$PAGEMAP_SCAN(r7, 0xc0606610, &(0x7f0000000200)={0x60, 0x0, &(0x7f0000245000/0x2000)=nil, &(0x7f0000994000/0x2000)=nil, 0x0, 0x0})
r8 = syz_open_dev$evdev(&(0x7f0000000000), 0xffffffffffffffff, 0x1)
sendmsg$TIPC_CMD_SHOW_NAME_TABLE(0xffffffffffffffff, &(0x7f0000000600)={&(0x7f0000000500)={0x10, 0x0, 0x0, 0x4000}, 0xc, &(0x7f00000005c0)={&(0x7f0000000580)={0x30, 0x0, 0x20, 0x70bd2b, 0x25dfdbff, {{}, {}, {0x14, 0x19, {0xfffffef9, 0x0, 0x2, 0xc}}}, [""]}, 0x30}, 0x1, 0x0, 0x0, 0x20000004}, 0x20000044)
ioctl$EVIOCSMASK(r8, 0x40104593, 0x0)
r9 = socket(0x11, 0x800000003, 0x0)
ioctl$sock_ipv4_tunnel_SIOCGETTUNNEL(r9, 0x89f0, &(0x7f0000000080)={'tunl0\x00', &(0x7f0000000000)={'syztnl1\x00', 0x0, 0x0, 0x0, 0x0, 0x0, {{0x5, 0x4, 0x0, 0x0, 0x14, 0x0, 0x0, 0x0, 0x0, 0x0, @local, @loopback}}}})
executing program 4:
r0 = openat$iommufd(0xffffffffffffff9c, &(0x7f00000000c0), 0x0, 0x0)
prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0)
r1 = openat$nullb(0xffffffffffffff9c, &(0x7f0000001000), 0x169802, 0x0)
r2 = dup(r1)
mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x1000006, 0x13, r2, 0x0)
r3 = openat$hwrng(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0)
preadv(r3, &(0x7f0000001880)=[{&(0x7f0000001a80)=""/102400, 0x19000}], 0x1, 0x0, 0x0)
r4 = openat$nullb(0xffffffffffffff9c, &(0x7f0000000140), 0xc4382, 0x0)
r5 = dup(r4)
r6 = socket$alg(0x26, 0x5, 0x0)
bind$alg(r6, &(0x7f0000000280)={0x26, 'hash\x00', 0x0, 0x0, 'sha1-avx2\x00'}, 0x58)
r7 = accept4(r6, 0x0, 0x0, 0x0)
ioctl$SNDCTL_SEQ_PANIC(r3, 0x5111)
sendfile(r7, r5, 0x0, 0x8a000)
sendmsg$BATADV_CMD_TP_METER(r2, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000380)=ANY=[@ANYBLOB="2c00a50020", @ANYRES16=0x0, @ANYBLOB="000200000000fbdbdf2502000000050037000000000008000600", @ANYRES32=0x0, @ANYBLOB="05002e000100000008002c00000000000500330000000000"], 0x3c}, 0x1, 0x0, 0x0, 0x20008050}, 0x40000040)
ioctl$IOMMU_IOAS_ALLOC(r0, 0x3b81, &(0x7f0000000200)={0xc, 0x0, <r8=>0x0})
ioctl$IOMMU_TEST_OP_ADD_RESERVED(r0, 0x3ba0, &(0x7f0000000140)={0x48, 0x1, r8, 0x0, 0x8})
ioctl$IOMMU_TEST_OP_ADD_RESERVED(r0, 0x3ba0, &(0x7f00000006c0)={0x48, 0x1, r8, 0x0, 0x155})
ioctl$IOMMU_VFIO_IOAS$SET(r0, 0x3b88, &(0x7f0000000240)={0xc, r8})
ioctl$IOMMU_VFIO_IOMMU_GET_INFO(r0, 0x3b70, &(0x7f0000000100)={0x40, 0x0, 0x0, 0x0, {}, {{}, 0x0, 0x0, [{}]}})
ioctl$IOMMU_TEST_OP_SET_TEMP_MEMORY_LIMIT(r0, 0x3ba0, &(0x7f0000000300)={0x48, 0x9, 0x0, 0x0, 0x3f})
r9 = socket(0x10, 0x80002, 0x0)
sendmsg$nl_route(0xffffffffffffffff, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000240)=ANY=[@ANYBLOB="4800000010001fff0000056800080000faff0000", @ANYRES32=0x0, @ANYRES8=r9, @ANYRES8=0x0, @ANYBLOB="fec8"], 0x48}}, 0x0)
r10 = socket$inet6_sctp(0xa, 0x1, 0x84)
bind$inet6(r10, &(0x7f00000002c0)={0xa, 0x4e24, 0x0, @private0={0xfc, 0x0, '\x00', 0x1}, 0x2000000}, 0x1c)
listen(r10, 0x4)
accept(r10, &(0x7f0000000000)=@can, 0x0)
r11 = socket$inet6_sctp(0xa, 0x5, 0x84)
sendto$inet6(r11, &(0x7f0000000080)='X', 0x1, 0x0, &(0x7f000005ffe4)={0xa, 0x4e24, 0x0, @mcast1, 0x3}, 0x1c)
sendmmsg$alg(r9, &(0x7f00000000c0), 0x492492492492627, 0x0)
executing program 3:
r0 = socket$nl_generic(0x10, 0x3, 0x10)
socket$l2tp6(0xa, 0x2, 0x73)
r1 = socket$nl_route(0x10, 0x3, 0x0)
sendmsg$nl_route(r1, &(0x7f0000000200)={0x0, 0x0, &(0x7f00000001c0)={&(0x7f0000000140)=@ipv4_newrule={0x1c, 0x20, 0x1}, 0x1c}}, 0x0)
r2 = socket$inet6(0x10, 0x3, 0x0)
sendmsg(r2, &(0x7f0000000000)={0x0, 0x0, &(0x7f00000000c0)=[{&(0x7f0000001500)="5500000020007fafb72d13b2a4a2719302000000030b43026c26236925000400fe7f0000bd2dca8a9848a3c728f1c46b7b31afdc1338d509000000000100005ae583de0dd7d8319f98af84fda542e718f94b929ade", 0x55}], 0x1}, 0x0)
socket(0x10, 0x3, 0x0)
geteuid()
r3 = socket$inet(0x2, 0xa, 0x0)
sendmsg$nl_generic(r0, &(0x7f00000029c0)={0x0, 0x0, &(0x7f0000000100)={&(0x7f00000006c0)={0x1f0, 0x10, 0x701, 0x0, 0x0, {0xb}, [@nested={0x1d2, 0x4a, 0x0, 0x1, [@typed={0x8f, 0x12d, 0x0, 0x0, @binary="70c9b9fd1dda2dbf4aa73731a82b75decbf264399754fff38b1c688615d971f85999c092199d933c88960f9e5ff69fc17eefe136a23ee36a52c73d96807de3254310f04605d3308364805b3506b6f6c0371ba811de31a070c27f0393a7924da3c9b33a62abb2513d978df03e7d1e0aa26c3ec05d80ce6363fb5aade00f4a6cbbb2058c8864e31b5ca84291"}, @typed={0x4, 0xb8}, @generic="3559298e203d44ab08028f705fe8cab7459817559116bbe135c60612ecb234fb183ff8715d6feb7ec5acee4fd09e8baf2920ae62dc8ab85e79c5c49f397135a5451c8bcf16a07ab2f76f63cde1f1826a6bea3834936815f872a5d781939170011e34c65f02ef2014bbcecefe7e5a54f97fec179f56276792e2563d02f5ec07c370ad81e74acc0ffec4becba777983e7ec6587200868ea1", @typed={0x8, 0x19, 0x0, 0x0, @pid=0xffffffffffffffff}, @typed={0xd, 0x56, 0x0, 0x0, @str='subj_type'}, @generic="3f718d2fabb94504fee06032255c2465489d83254bd130692b01442231099d36d4d1b9cacf73f2cd4f880a4d5a7bb82f109b01d966cc943a9c9b86aad3d2167a3c97163bd801a892798a4d32d3888595120232b2414efca73aba04775e1d3240baf86d278190128580c708eafc8778e6f9f48b8c232e0c8d207b40083efff5e361db247c7aaed3107adb13"]}, @typed={0x8, 0xa, 0x0, 0x0, @fd=r3}]}, 0x1f0}}, 0x0)
executing program 3:
r0 = socket$inet6_tcp(0xa, 0x1, 0x0)
bpf$PROG_LOAD(0x5, 0x0, 0x0)
r1 = socket(0x10, 0x3, 0x0)
ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000180)={'macvtap0\x00', <r2=>0x0})
sendmsg$nl_route_sched(r1, &(0x7f00000007c0)={0x0, 0x0, &(0x7f0000000240)={&(0x7f0000000280)=@newqdisc={0x34, 0x24, 0x3fe3aa0262d8c583, 0x0, 0x0, {0x0, 0x0, 0x0, r2, {}, {0xd, 0xffff}}, [@qdisc_kind_options=@q_fq_pie={{0xb}, {0x4, 0x8002}}]}, 0x34}}, 0x0)
r3 = socket$nl_route(0x10, 0x3, 0x0)
sendmsg$nl_route(r3, &(0x7f0000000000)={0x0, 0x0, &(0x7f00000002c0)={&(0x7f0000000080)=ANY=[@ANYBLOB="440000001000370400000000020000000000000074a2a2a0b8e89066fb27c701acfb5a0ecbd59bc0964a4d84df630ad2c2602080f945ef0fb6b9b86bb4b94e6261ff492d85b1de91a63dc92fc7a59da02a6b3a4f3ebe9af1bb532bf6708a022827a58798300ffb181c97f3c13b448ccda0ed3d18414825cecea01f8a9df9a0", @ANYRES32=r1, @ANYBLOB="90"], 0x44}}, 0x0)
r4 = syz_open_dev$video4linux(&(0x7f00000002c0), 0x0, 0x0)
ioctl$VIDIOC_QUERY_EXT_CTRL(r4, 0xc0445624, &(0x7f0000000140)={0x980001, 0x0, "9a555c147ce09ac66ffdb507549f0000000000000000000000000100"})
executing program 2:
r0 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000001c0)='cpuacct.usage_sys\x00', 0x275a, 0x0)
write$binfmt_script(r0, &(0x7f0000000340), 0x4)
r1 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000440), 0x0, 0x0)
r2 = ioctl$KVM_CREATE_VM(r1, 0xae01, 0x0)
r3 = socket$inet_sctp(0x2, 0x0, 0x84)
setsockopt$inet_sctp_SCTP_PEER_ADDR_THLDS(r3, 0x84, 0x1f, &(0x7f0000000b80)={0x0, @in6={{0xa, 0x4e21, 0x1, @rand_addr=' \x01\x00', 0x53}}}, 0x90)
r4 = ioctl$KVM_CREATE_VCPU(r2, 0xae41, 0x0)
socket(0x10, 0x3, 0x0)
r5 = socket$packet(0x11, 0x2, 0x300)
ioctl$sock_SIOCGIFINDEX(r5, 0x8933, 0x0)
prlimit64(0x0, 0xe, 0x0, 0x0)
sched_setscheduler(0x0, 0x0, 0x0)
sched_setscheduler(0x0, 0x0, 0x0)
sched_setaffinity(0x0, 0x8, &(0x7f0000000040)=0x10001)
r6 = openat$hwrng(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0)
preadv(r6, &(0x7f0000000240)=[{&(0x7f0000033a80)=""/102386, 0xfffffd6e}], 0x1, 0x0, 0x0)
r7 = openat$tun(0xffffffffffffff9c, &(0x7f0000000100), 0x0, 0x0)
fsetxattr(r2, &(0x7f0000000280)=ANY=[@ANYBLOB='os2.com.apurity\x00'], &(0x7f0000000500)='\'\x7f\x84r6\xbf\xdd\'\xc3\x00\x00\x00\xc9\xc8hIB\x14\x1fo\'8Ci\xceZ\xc3+Ae!\xdc\r\xa9\xc74c\xfb5\x7f\x91T\r\xcb\xb9\xb2\xb5e\x1aS\"\xb40M\xd6\xaa\xad\xa5\xf1\x9b\x1a\a\x90\'\xe5\xc0\xc9OK\x95\x15\x14\x06\x9a\xa1\xce\x8c$\xc2\xbf\xe0\xcdp', 0x53, 0x2)
ioctl$TUNSETIFF(r7, 0x400454ca, &(0x7f0000000000)={'pim6reg1\x00', 0x1})
ioctl$sock_SIOCGIFINDEX_80211(r5, 0x8933, &(0x7f00000002c0)={'wlan1\x00'})
ioctl$TUNSETLINK(r7, 0x400454cd, 0x30a)
socketpair$nbd(0x1, 0x1, 0x0, &(0x7f00000000c0)={0xffffffffffffffff, <r8=>0xffffffffffffffff})
ioctl$SIOCSIFHWADDR(r8, 0x8914, &(0x7f0000000140)={'pim6reg1\x00', @link_local})
ioctl$KVM_RUN(r4, 0xae80, 0x0)
mmap(&(0x7f0000000000/0x400000)=nil, 0x400000, 0x2000005, 0x10012, r0, 0x0)
ioctl$KVM_SET_CPUID2(r4, 0x4008ae90, &(0x7f00000004c0)=ANY=[@ANYBLOB="01ec000000010000"])
r9 = openat$tun(0xffffffffffffff9c, &(0x7f0000000140), 0x0, 0x0)
ioctl$TUNSETIFF(r9, 0x400454ca, &(0x7f0000000200)={'syzkaller1\x00', 0xc201})
ioctl$TUNSETLINK(r9, 0x400454cd, 0x324)
executing program 4:
socket$inet6_tcp(0xa, 0x1, 0x0)
syz_emit_ethernet(0xfc0, &(0x7f00000001c0)={@local, @dev, @void, {@ipv4={0x800, @generic={{0x5, 0x4, 0x0, 0x0, 0xfb2, 0x0, 0x0, 0x0, 0x84, 0x0, @empty, @broadcast}, "dd9dec79219eb549dbd024c796335bc5ff0e043319357749084ca9d0ae1378f4e88112a2f7c10fd1523b9007773fd2b2bd0ebabccd2e5c35fb3baff587585840f2530c6f4d025f118440ac22a8b34da7b5e1e873bd429686be3ef84439e05fc0fefedb8b897b09445a9e10cf24aec2ff3ca6a86d94df0c4a928ed904dcfb02e6c6c5918a839d33cb9b55dfb3cd89d80eb18dc06415d313b4ea240a65eff4b941ac018e8f81de044239960271333255291b5fbfdcf8db25e175640f36986b859aeb3370ca17e6a20aeeb5c5d27eb097fc1fab796a7ff8fcbe119bbe4be2c8a5c58890191c59bea20bfe4edf9c5453e59f610d3bd1d6eb49b02e464aee0480187c5717936add1347b08cdf5b056adb941708e8a0498900419e98b75658c6dd00f88eebf8c9aaee2e38c80eafcf6ca08ea305da9c7050948ef78a1457a2e933287fe8d2e100cb00078ed829985f8812d543cc5cdb71521f4113829551efe915e4d6773f2d285cc1e8813919356ca5ef202b0d2b8a3d7de51e4635e761ffd7efe5d51dd1325596f0e4e1c0b1ce73240cb931227892d66f3629c9d152372d5790c1c25e2f6f850a4eb83654f423b84adbbf4169d472b2cddaa7137ff14c2944ade3a57613806810707a2e6c078beb4b87cf8cf39c9950bcb3f9bb42308bd5e68d81f7f4d9e528541703059787f5e342be8ebb9841d587f7455b409115d511c130d9641fc74391228bda52d2fa58e2ca74b26583e73e2cfb881945d8ecbc77eb35e783057f6c35ba06b7f639ec516ee54bf3645f6ec436ba859e22ed480a862285aa21f3d5cd3734dde388a7f8920c4a6b4a952f830e0d2811f2f2714e660e961de0b3e0b8d5fd1007690a61e414e82245dbe4e47c73465ed40af1cee2eae4801ee408ad1fce81ff8db77082c5efd93fa9a1a3e3d78eff84f326df1c6fa656cc7d4dab842f47ad0a7e74dfe1a53776a346a22dc7a0e476754d385d99aa9cbd3f445ffb2ed61e01b28fc071d706ad204b1e8014481dba0cbc460b67e64d6e955184271cedef7f951021e3595ebe9c3384b53efafb67cbed2aa1ede5d7fcff3abd27d05766fb8894d7948609441759f4c4dfa33b6d486d4fb7e231f04d4f0f9e98f4b156129d9307fb9ebf3b278232062e7fe9ec2db7c4c991f83733368a107bf5798a1df45c919d71cce45ed907240c2f2fa6a4227e8e11cef2e7968c63e7a1adc3edec2170c17ed2cc54d0ea2b34e99b81015ffe51a501c2b73ddac5223e69d0dd451d358c0cd2ff7db256850ec1e9e349901f168d854284da68d80c68298a75c5d859008c82fe08b4cf2e68a2c0190760a03aff1be2c9425b6d5ef5c67bafb6d16fffeeb0211d90abbade4db9d6a9e9c981dde14c1d54e9138f9760bcdccbf17e7416042cfe7bbd8bba2f739f7f900ee45b965316b950e8474f3be92081fb63f43a4858b39e20e14d5a38c0973d680f2fda9e310d0e088523bdcbb728bcd0074447b4ace876da5642cd7d781cdb023a31446e0a0c59d5388674a5c8a97927e014a73d0330bd5c5187db79f1c546a8bcca008263509c23b246dea58fb36c44d373c1c92ffdd1600c27d4b10b3fc86b88ecefe8743bb59a6b8e443f06d2ae3a6908b6bc65b647deee13262225b8879dd79413ffa3d4aef91a0a04d4dc3030b5beb081c5fdf9152c3a17e6b24457fd580d84d3006af27ff44d6ec3664c4955a1d1dc5eb041682644ae5643901f00aa602b2a18cdd3f8a1efff7b8f3afc31c283c9b74b806a98bd9f1ad8ecce410160c0a27f7ef90a2b0c1bea64e187adc04a04bff7c435659bc4c3ce5c2730e121972541062102e93d2a136e1aaaf3e25d547cad6e2b0874500fc098469494d2654808ee88588fd167f4332061a9b4cae6b22d87624e325e89a269f61ce0d26465ddfedc1f0fa2a5cf1ee7fe3e6cb375f1ff04cf8d22667debe574b8395023bde9a8302376af2e119c4c88433d1722011ade605f3a4201860742b0392ac96cc138d9ddb952f4e4742a7fd9d625465dac35347c1662b2085c357120c6ff69dedc013c5fe46555a4448b0be41e21ad73162bf9aa1cfb70f4702c7051c0a13fae918133f123d33c5c02e66ae8fceb3109b2e13a7a3e71484d59dfcba16db2d21549be1ba6cd5ad7610eefda427982384961f18bd6857ad97e868c2914d0ba934a296eda52646031c4504864061f3cba1df65cd04ef6b1050fb30b5abbbe28f8f7adb8073e452f4c0c5492a5f8d427ddf451ae303a86639e5dbccfe2b2bedb911d534a77c012e2f8a24917d98ab14557caf3e66040f21767685644f0003459762d4ab25a0e33a92b54748cf46a977505074b79b9b0746b2b5b168876a2ca10bb903edc1d1992a4a94c0ee0dd7b37add092163b5fbaf16090f8143187d060b19e3822f3def14717e41558f9582467a5a5f89148450fde235e7a5bb900e4e9d14e2147bfd2a52f84a115eb170bf3d3b9b3de9781960be4e53025c7dce005e1458140bb9cf9da8fa1124ac558fb220d57c23a7f120f5171eb2208d9e6ab7186ae457973da564f1fd45b241c15596035f55034c3995a587b4471068076839420df947f10ab2fc211732d768c135d63cc5eeda1bdfc780e7ed90855fa5a364e63f529703cd0f691b0b6a41232bfd1c1f61ef6b16ed3b9055ca888c8ebcd16a0623ede9e4e37b7d6175e3d0ddba8e7d87639eb8b0ba246131951a581575f1adf4c598a9f2f087d5eb2a0a5834d8cb12b0ad76d9381a838ccfbfcc20bbb970474c48677f10aa57be1d607d5b049d397178035f7f3393cd9000336c83218850ecd64142a22f7ae7e6a7e62013d6d105eb7c862e13979698681d44121ee9e2e552315d4d3913ff7bcd90d6bed72d50107a971a37d5a1d75efeebf03cc91239b7e427fba8df6b79674c15acd2093289fe6155063af81d85840abf4635f66083b3707d34b2149dfdf95cb4deb71e1574118c242b160c770347e6b1f135a985e89fe8e6d7f40281cfb6dc05cd8b9d4f6680c0863acb34516092acdf2bea67f54ab4282ba2d898287f34d9384e335b2ddbb87aaea8cadb8f0b397e99a68a7a214fae5a1f56c95bcd901534c23cd5cff3c168813d7fa1191dd7437c96b07324a7b21b48e205b859dcd080bd62ab7cca4bd7a73959218d0eeb21c887483201eaf3afb19efe1741b57332c5441685a7bb8324dde85faafc785312b58aabef2eef6a8048663bf13db9ae9edd4b1dcebc99890693f11b354b1f1aad19b66251b4bcaed0daed73b87dedd140fd680e7d3355362844d1d7ba2ae6be7ffae59d7b3c679b890448b0de1acf591abfe6f3096794b7e142e0ac0862ab8cb76eb79b17d1138be3747f907c3f11c636a0f0e0d315d1ff05aab0ce62fbac03a2b4ddeac7ee192bba2da93b7a926271f6d594aa14de2c294ad0c77770a624d1ce24cc8d8f5e9b629604fa7897f0cbd641f76a85dc8df33b5715eb100e30e53b85110d2252c22575a7365eb08006b4d62d305e780101965094ce2aaad170df470870e687fb280b772d41ad5d470b71e256af3a0d2c02df95821d38f28cdff26fa7a3f6e920edbd3174d2d2bde854ef68dae8a0a4a63753c825930903a2ca75d4321bad0ad9ff6852f94dd04972a45bb9625b3726dfbcc959e85242f0d327b181aee0fdab7af064dd97151b131a5c4a51a66692cbbd9f1348a16470cedef1b255e172cd2b15184177ad43744de941869af884ff8e59ef0e63ac5e1b99c851e0f915359ce12d9c380bb6f9c2bc773267157afeda7abcc120a31a1b72af6662bff7f5f194dad00b4ebfdcbb4dfc39854412db1ae99b449d741f841239159ea467cf1e38b95bcb7603ebcb400cb31410b2a4e25126caade0019bf667cc998bc4582578da0f8a6268f6d114ccf9dd8379995e8be1b934bb5645d72f97e05628129a7d2bc548e08796341f43dc3c9fcbe89d8284dc6633bee0d17e99f600425f0172b6bc478f5117dadf15e36e850ecc0ca75664ef8e4877a44b4ffa22a6f1d6719f8d81f9937928caa0690b77406a3298aaf446e2f78343267399bb7f64c60f82bf5d07210281eaad09a3810790720c98a041332c809be7aea1480b9e5eb989085c23b4aee75143068def3e89d1c417b63321e68d340a1472d2504088c17cd75de0e700508c55a7246ca9a762cc50ca35cbcaa7dcf4ae3264c32ff2cd67566ed501fb8182b5f16c58295783f3b2b554b06aae700f198c71ad7519868c1e6fbeb0246569b04beeb8b71bcbb9af93372bee365efb1d7424689e8241b1dc346a73a84b5773487f388356b8dbec1a108846e3f8dc74865b156e8ad18b353efc4ad0b11412a381fec8f5d45678b4f8b6805913e7aff71acf9052ae3b73e41e19668f9b53bfd75b778970831b6891a78ffe0d4863e62cbbf6cf8c085032864479cd3a250842984dcc2860f057f86c8e2d4d2afefb8a45b7d5b8c94e752f369a1b434c827cd26cd0276a8b40019a95ebe7c16de4c1ce8efbd5c70e0c507631818aa4fbc937d212e428aefa895069656babdbd921af974da32c49f4ca6d1e1e28319b427c8bad4d650809c673ec6073770b4097e5700a8071110fd07acbc5a59f8d7b0735a98fd40ce03718a9a93c035948859215c59f54343b08bfd95a35d73c5f09a9ebe63c509fe8443fa74e6efd0fd87defc7cb16725ce3c3d5f7664cfe253faf2cbeb307052dd2269b6266acdb31e2006b9355f673ca5c9cb907605ce071824254b139607a069531f9598f4040ddeb9cd018e9dfa1808032dfb65a4af0820da810a7b58fbb65ac8e65b017a40ec2d445a5c7b78d1f0e717b19427ef1fe6cc08c5e9da5a7d1d508fd939854589dcba8d75ff3d8d1c1fb28af1ed6900bcd4cedbe42fd6243c81264fe81be756bfd71ebcd4d96bd7ec50a676bc57e130bd8da21bb6e888eb6c8402516f6fe6dfe25be9a3e33f2cdbed9de00efb867cbe80ec2309458f41924b967d254166e5a0a5f776395214a67900d180704b9fb09f9c4c4c62fd382fcd5efe099e22d2c82f198a39d193f65b68e09454e2ab8f2d7413c64563742f1c34ca9285e501bff5efa30a0da946f875d23162eaa53c4008bed38e9a190b08ff8bfb6bfb91553c4c329fc73b8be308b00347dee2afdc08bab311c75386f452b706d1820c9038998924665010a548c09743a16167b0b09373b5cd2fb1da4f6c9ea5b1f1dd7775f6fcb23eab4fd1990364dacb2a1656b9bcf1c4866b7222872a3a3a03d397499222a3f31a35d3aeaf6a6d39f0fbee1e0f6e1e10ba0774f15f245d955cc8132d86c2d768f8a06274caa5a12c46e9e08ee556c1da49830f1e6c0a0c53a9ef1489c3fba0251c3e6839e891ac298108f3ed05066e48b8bda2c5f6e691c7a7425b7019e0a547f6560a0af41831a4a790c3a8eac9a3a9119da3eef85cb12f3f3115f04ae95534ac847b4ee2cc2fc43cdba382ecae7c4f499ce1be1ca1907313ff665c2fd7d4c8f36716f33b6861f5cf3f1c878feadfa9a664b8d629a16c750c466326a951efaa830e4f328270041f2ca0be49f0affe5806b94b027033f008957e83d167d6fe4168ec4fb79385cc06e257bba807ecfccaba56cf751dac996b7a347d36ec52b0f5d16425402416c735530bd7c545f8c753fb3b1054b82bc368ef4ac3000000"}}}}, 0x0)
syz_emit_ethernet(0x56, &(0x7f00000001c0)=ANY=[@ANYBLOB="aaaaaaaaaaaabbbbbbbbbbbb88a800008100000086dd600000000018000000000000000000000000000000000000fc0000000000000100000000000005020000c204"], 0x0)
executing program 4:
r0 = memfd_create(&(0x7f00000000c0)='-B\xd5N4\xa6Ey\xdb\xd1\xa7\xb1S\xf1:)\x00\x8a\xd7Uw\x00\xbc\xa92\xb3\xbb\x8d\xac\xacva}knh#\xcf)\x0f\xc8\xc0:\x9cc\x10d\xee\xa9\x8b\x066\xb8G\xd1c\xe1$\xff\x97\x8f~\xb90a\xa9\xb2\x04K\x98\x93=\xabQ\xf7\x19\xea\xef\xe3\xe1@\x84\x13\xefZb:\x8f\t\x01B\xec\xde\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00@Ip]D\xd6\r\xac\v#co\xd5\xb9\xc806\xa8\x99\xffs7\xa1b1\xb1;i)j\x0e\x1e\xedI\xa2\x80\x89\x1d\xd9p!\xc86s\xe07(\xee\xf9<\"\xf0\xc8\xae\x96J\xe2]\x01\x86\xb7.<\xf5N\xd3\x94W1\xff\x18z>\xa7q,\xf7\x96\xb8{\x8e\xbf4\xe0\x95\x1ce\xe4\x85\xcdi\xed\xd3>\xeb\xa5\xaf\x87\x90@\xd1\xbd`^\xfa\xb6\x9cj\x13/\xc5\\W\x04\br\x17X\xe3\xfb\xc8\xd4\xaeX\xc9s\xd18\xd9L\xbf\xa0\xa6\xdf2\a\x99i\xb1/\x19@\x1cq\xeb?\xc1z:\x913\xfa8\xac\xd3q\xe4vPGU', 0x0)
r1 = dup(r0)
write$binfmt_misc(r0, &(0x7f0000000200)=ANY=[@ANYBLOB='sy'], 0x4)
execveat(r1, &(0x7f0000000000)='\x00', 0x0, 0x0, 0x1000)
r2 = syz_clone(0x0, 0x0, 0x0, 0x0, 0x0, 0x0)
ptrace(0x10, r2)
ptrace$setregs(0xd, r2, 0x0, &(0x7f00000000c0)="18607651149d7b10b4024fbbdc08899b8f589df2dbb5d7a8d1b36cfab675cb3976ee8100e2878c9cfa178cac130eb046eda93df39ed4b41924dc225ad4028dd63defb87d698be5c749450b350a789dcfc6b2d6a696b5026d1e52f19274566d1da0f353dd65e330ebf71c5e823f2753c5fd76724828ef31b353e71805205c3dceb44cc4c7b3664e29fb")
read$FUSE(0xffffffffffffffff, &(0x7f0000000500)={0x2020, 0x0, 0x0, 0x0, 0x0, <r3=>0x0}, 0x2020)
ioctl$SNDRV_CTL_IOCTL_ELEM_REPLACE(0xffffffffffffffff, 0xc1105518, &(0x7f0000000280)={{0x5, 0x4, 0x1, 0x8001, '\x00', 0x1}, 0x5, 0x131, 0xba, r3, 0x1, 0xc, 'syz1\x00', &(0x7f0000000040)=['&](\x00'], 0x4})
sendmsg$IPSET_CMD_CREATE(0xffffffffffffffff, &(0x7f0000000000)={0x0, 0x0, &(0x7f00000004c0)={&(0x7f0000000200)={0x54, 0x2, 0x6, 0x0, 0x0, 0x0, {}, [@IPSET_ATTR_TYPENAME={0x12, 0x3, 'bitmap:ip,mac\x00'}, @IPSET_ATTR_SETNAME={0x9, 0x2, 'syz1\x00'}, @IPSET_ATTR_DATA={0x10, 0x7, 0x0, 0x1, [@IPSET_ATTR_IP={0xc, 0x1, 0x0, 0x1, @IPSET_ATTR_IPADDR_IPV4={0x8, 0x1, 0x1, 0x0, @private}}]}, @IPSET_ATTR_FAMILY={0x5}, @IPSET_ATTR_PROTOCOL={0x5, 0x1, 0x6}]}, 0x54}}, 0x0)
r4 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000080)='cpu.stat\x00', 0x275a, 0x0)
write$UHID_CREATE2(r4, &(0x7f00000001c0)=ANY=[], 0x118)
mmap(&(0x7f0000000000/0x3000)=nil, 0x3000, 0x5, 0x12, r4, 0x0)
ptrace$getregset(0x4205, r2, 0x200, &(0x7f0000000080)={0x0})
executing program 4:
r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000100), 0x0, 0x0)
r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0)
ioctl$KVM_CREATE_IRQCHIP(r1, 0xae60)
r2 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0)
ioctl$KVM_SET_IRQCHIP(r1, 0x8208ae63, &(0x7f00000003c0)={0x1, 0x0, @pic={0x0, 0xfd, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1}})
ioctl$KVM_SET_REGS(r2, 0x4090ae82, &(0x7f0000000000)={[], 0x0, 0x2c0710})
ioctl$KVM_RUN(r2, 0x5421, 0x0)
executing program 4:
listen(0xffffffffffffffff, 0x0)
prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0)
sched_setaffinity(0x0, 0x8, &(0x7f0000000040)=0x10001)
r0 = openat$hwrng(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0)
preadv(r0, &(0x7f0000000240)=[{&(0x7f0000033a80)=""/102386, 0xfffffd6e}], 0x1, 0x0, 0x0)
fcntl$getown(0xffffffffffffffff, 0x9)
sendto$packet(0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0)
r1 = socket$inet_smc(0x2b, 0x1, 0x0)
syz_genetlink_get_family_id$ethtool(0x0, 0xffffffffffffffff)
r2 = socket$nl_xfrm(0x10, 0x3, 0x6)
sendmsg$nl_xfrm(r2, &(0x7f00000003c0)={0x0, 0x0, &(0x7f0000000380)={&(0x7f00000009c0)=ANY=[@ANYBLOB="28010000170001003a7dc09c007aab5097000000000000000000000000000000000000ffffac1414000000000000000000ac141400000000000000000000000000ffffffff0000000000000000000000007f000001000000000000f20000d76f61f6381d2fb0cf0f94b300"/116, @ANYRES32=0x0, @ANYRES32=0xee01, @ANYBLOB="e0000002000000000000000000000000ff01000000000000000000000000000100"/48, @ANYRES32=0x0, @ANYRES32=0x0, @ANYBLOB], 0x128}}, 0x0)
seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0x0, &(0x7f0000000000)={0x0, 0x0})
r3 = socket(0x10, 0x80803, 0x0)
sendmsg$nl_route(r3, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000100)=ANY=[@ANYBLOB="1c0000005e00010200"/20, @ANYRES32=0x0, @ANYBLOB="bf"], 0x1c}}, 0x0)
recvmmsg(0xffffffffffffffff, &(0x7f0000001bc0), 0x0, 0x0, 0x0)
futex_waitv(&(0x7f0000000180)=[{0x0, &(0x7f0000000040), 0x2}], 0x1, 0x0, 0x0, 0x0)
futex(&(0x7f0000000040), 0x1, 0x0, 0x0, 0x0, 0x0)
r4 = bpf$MAP_CREATE(0x0, &(0x7f0000000180)=@base={0x3, 0x4, 0x4, 0x6}, 0x48)
bpf$MAP_CREATE(0x0, &(0x7f0000000440)=@base={0xc, 0x4, 0x4, 0x10000, 0x0, r4}, 0x48)
bind$inet(r1, &(0x7f0000000140)={0x2, 0x4e22, @multicast2}, 0x10)
bpf$PROG_LOAD_XDP(0x5, &(0x7f0000000380)={0x17, 0x0, 0x0, 0x0}, 0x90)
set_mempolicy(0x3, &(0x7f0000000140)=0x3, 0x8)
ppoll(&(0x7f0000000300)=[{}], 0x20000000000000d0, 0x0, 0x0, 0x0)
connect$inet(r1, &(0x7f0000000000)={0x2, 0x4e22, @local}, 0x10)
r5 = syz_open_procfs(0x0, &(0x7f0000000140)='net/stat\x00')
fchdir(r5)
r6 = inotify_init()
inotify_add_watch(r6, &(0x7f0000000000)='.\x00', 0x400017e)
r7 = open(&(0x7f00000000c0)='.\x00', 0x0, 0x0)
getdents(r7, 0x0, 0x0)
executing program 0:
r0 = socket$nl_netfilter(0x10, 0x3, 0xc)
sendmsg$NFT_BATCH(r0, &(0x7f000000c2c0)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000440)=ANY=[@ANYBLOB="140000001000010000000000000000000000000a28000000000a0101000000005e1affd5020000000900010073797a300000000008000240000000032c000000030a01030000e6ff00000000020000000900010073797a30000000000900030073797a320000000014000000110001"], 0x7c}}, 0x0)
sendmsg$NFT_BATCH(r0, &(0x7f00000000c0)={0x0, 0x1400, &(0x7f0000000b00)={&(0x7f0000000100)={{0x14}, [@NFT_MSG_NEWRULE={0x6c, 0x6, 0xa, 0x401, 0x0, 0x0, {0x2}, [@NFTA_RULE_EXPRESSIONS={0x40, 0x4, 0x0, 0x1, [{0x3c, 0x1, 0x0, 0x1, @payload={{0xc}, @val={0x2c, 0x2, 0x0, 0x1, [@NFTA_PAYLOAD_LEN={0x8}, @NFTA_PAYLOAD_SREG={0x8}, @NFTA_PAYLOAD_OFFSET={0x8}, @NFTA_PAYLOAD_BASE={0x8}, @NFTA_PAYLOAD_DREG={0x8}]}}}]}, @NFTA_RULE_TABLE={0x9, 0x1, 'syz0\x00'}, @NFTA_RULE_CHAIN={0x9, 0x2, 'syz2\x00'}]}], {0x14}}, 0x94}}, 0x0)
executing program 0:
bpf$PROG_LOAD(0x5, 0x0, 0x0)
r0 = socket$nl_netfilter(0x10, 0x3, 0xc)
socket$nl_netfilter(0x10, 0x3, 0xc)
socket(0x0, 0x3, 0x0)
bind$inet6(0xffffffffffffffff, &(0x7f0000000100)={0xa, 0x0, 0x0, @loopback}, 0x1c)
ioctl$sock_SIOCGIFINDEX(0xffffffffffffffff, 0x8933, &(0x7f0000001400)={'team_slave_0\x00'})
bpf$ENABLE_STATS(0x20, 0x0, 0x0)
setsockopt$inet6_IPV6_FLOWLABEL_MGR(0xffffffffffffffff, 0x29, 0x20, &(0x7f0000000200)={@loopback={0xff00000000000000}}, 0x20)
sendmsg$MPTCP_PM_CMD_ADD_ADDR(0xffffffffffffffff, 0x0, 0x0)
unshare(0x0)
sendmsg$IPSET_CMD_TEST(r0, &(0x7f0000000200)={0x0, 0x4000, &(0x7f00000001c0)={&(0x7f0000000100)={0x2c, 0xb, 0x6, 0x201, 0x0, 0x0, {}, [@IPSET_ATTR_DATA={0x4}, @IPSET_ATTR_SETNAME={0x9, 0x2, 'syz2\x00'}, @IPSET_ATTR_PROTOCOL={0x5}]}, 0x2c}}, 0x0)
syz_emit_ethernet(0x3b6, 0x0, 0x0)
executing program 0:
r0 = socket$nl_generic(0x10, 0x3, 0x10)
socket$l2tp6(0xa, 0x2, 0x73)
r1 = socket$nl_route(0x10, 0x3, 0x0)
sendmsg$nl_route(r1, &(0x7f0000000200)={0x0, 0x0, &(0x7f00000001c0)={&(0x7f0000000140)=@ipv4_newrule={0x1c, 0x20, 0x1}, 0x1c}}, 0x0)
r2 = socket$inet6(0x10, 0x3, 0x0)
sendmsg(r2, &(0x7f0000000000)={0x0, 0x0, &(0x7f00000000c0)=[{&(0x7f0000001500)="5500000020007fafb72d13b2a4a2719302000000030b43026c26236925000400fe7f0000bd2dca8a9848a3c728f1c46b7b31afdc1338d509000000000100005ae583de0dd7d8319f98af84fda542e718f94b929ade", 0x55}], 0x1}, 0x0)
socket(0x10, 0x3, 0x0)
geteuid()
r3 = socket$inet(0x2, 0xa, 0x0)
sendmsg$nl_generic(r0, &(0x7f00000029c0)={0x0, 0x0, &(0x7f0000000100)={&(0x7f00000006c0)={0x1f0, 0x10, 0x701, 0x0, 0x0, {0xb}, [@nested={0x1d2, 0x4a, 0x0, 0x1, [@typed={0x8f, 0x12d, 0x0, 0x0, @binary="70c9b9fd1dda2dbf4aa73731a82b75decbf264399754fff38b1c688615d971f85999c092199d933c88960f9e5ff69fc17eefe136a23ee36a52c73d96807de3254310f04605d3308364805b3506b6f6c0371ba811de31a070c27f0393a7924da3c9b33a62abb2513d978df03e7d1e0aa26c3ec05d80ce6363fb5aade00f4a6cbbb2058c8864e31b5ca84291"}, @typed={0x4, 0xb8}, @generic="3559298e203d44ab08028f705fe8cab7459817559116bbe135c60612ecb234fb183ff8715d6feb7ec5acee4fd09e8baf2920ae62dc8ab85e79c5c49f397135a5451c8bcf16a07ab2f76f63cde1f1826a6bea3834936815f872a5d781939170011e34c65f02ef2014bbcecefe7e5a54f97fec179f56276792e2563d02f5ec07c370ad81e74acc0ffec4becba777983e7ec6587200868ea1", @typed={0x8, 0x19, 0x0, 0x0, @pid=0xffffffffffffffff}, @typed={0xd, 0x56, 0x0, 0x0, @str='subj_type'}, @generic="3f718d2fabb94504fee06032255c2465489d83254bd130692b01442231099d36d4d1b9cacf73f2cd4f880a4d5a7bb82f109b01d966cc943a9c9b86aad3d2167a3c97163bd801a892798a4d32d3888595120232b2414efca73aba04775e1d3240baf86d278190128580c708eafc8778e6f9f48b8c232e0c8d207b40083efff5e361db247c7aaed3107adb13"]}, @typed={0x8, 0xa, 0x0, 0x0, @fd=r3}]}, 0x1f0}}, 0x0)
executing program 3:
madvise(&(0x7f0000a93000/0x4000)=nil, 0x4000, 0x80000000e)
mremap(&(0x7f0000a96000/0x1000)=nil, 0x1000, 0x800000, 0x3, &(0x7f0000130000/0x800000)=nil)
mlock(&(0x7f0000000000/0x800000)=nil, 0x800000)
prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0)
sched_setaffinity(0x0, 0x8, &(0x7f0000000040)=0x10001)
r0 = openat$hwrng(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0)
preadv(r0, &(0x7f0000000240)=[{&(0x7f0000033a80)=""/102386, 0xfffffd6e}], 0x1, 0x0, 0x0)
r1 = io_uring_setup(0x1698, &(0x7f0000000140)={0x0, 0x3, 0x0, 0xfffffffc, 0x4})
io_uring_register$IORING_REGISTER_BUFFERS(r1, 0x0, &(0x7f00000002c0)=[{&(0x7f0000001700)=""/4095, 0x440000}], 0x100000000000011a)
mremap(&(0x7f00003c6000/0x4000)=nil, 0x4000, 0x4000, 0x7, &(0x7f00000f4000/0x4000)=nil)
r2 = syz_open_procfs(0x0, 0x0)
writev(r2, &(0x7f0000000100)=[{0x0}], 0x1)
munmap(&(0x7f00001a2000/0x1000)=nil, 0x1000)
r3 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000100), 0x0, 0x0)
r4 = ioctl$KVM_CREATE_VM(r3, 0xae01, 0x0)
r5 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000001c0)='blkio.bfq.io_wait_time_recursive\x00', 0x275a, 0x0)
write$binfmt_script(r5, &(0x7f0000000200), 0x208e24b)
mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x2, 0x28011, r5, 0x0)
ioctl$FS_IOC_FIEMAP(0xffffffffffffffff, 0xc020660b, &(0x7f0000000000)=ANY=[@ANYBLOB="0100"])
preadv(r5, &(0x7f00000015c0)=[{&(0x7f0000000080)=""/124, 0xffffff23}], 0x1, 0x0, 0x0)
r6 = ioctl$KVM_CREATE_VCPU(r4, 0xae41, 0x0)
ioctl$KVM_GET_NESTED_STATE(r6, 0xc048aeca, &(0x7f0000005580)={{0x0, 0x0, 0x80}})
migrate_pages(0x0, 0x3, &(0x7f0000000040)=0x7f, &(0x7f0000000300)=0xa)
r7 = syz_open_procfs$pagemap(0x0, &(0x7f0000000000))
ioctl$PAGEMAP_SCAN(r7, 0xc0606610, &(0x7f0000000200)={0x60, 0x0, &(0x7f0000245000/0x2000)=nil, &(0x7f0000994000/0x2000)=nil, 0x0, 0x0})
r8 = syz_open_dev$evdev(&(0x7f0000000000), 0xffffffffffffffff, 0x1)
sendmsg$TIPC_CMD_SHOW_NAME_TABLE(r2, 0x0, 0x20000044)
ioctl$EVIOCSMASK(r8, 0x40104593, 0x0)
r9 = socket(0x11, 0x800000003, 0x0)
ioctl$sock_ipv4_tunnel_SIOCGETTUNNEL(r9, 0x89f0, &(0x7f0000000080)={'tunl0\x00', &(0x7f0000000000)={'syztnl1\x00', 0x0, 0x0, 0x0, 0x0, 0x0, {{0x5, 0x4, 0x0, 0x0, 0x14, 0x0, 0x0, 0x0, 0x0, 0x0, @local, @loopback}}}})
executing program 4:
madvise(&(0x7f0000a93000/0x4000)=nil, 0x4000, 0x80000000e)
mremap(&(0x7f0000a96000/0x1000)=nil, 0x1000, 0x800000, 0x3, &(0x7f0000130000/0x800000)=nil)
mlock(&(0x7f0000000000/0x800000)=nil, 0x800000)
prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0)
sched_setaffinity(0x0, 0x8, &(0x7f0000000040)=0x10001)
r0 = openat$hwrng(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0)
preadv(r0, &(0x7f0000000240)=[{&(0x7f0000033a80)=""/102386, 0xfffffd6e}], 0x1, 0x0, 0x0)
r1 = io_uring_setup(0x1698, &(0x7f0000000140)={0x0, 0x3, 0x0, 0xfffffffc, 0x4})
io_uring_register$IORING_REGISTER_BUFFERS(r1, 0x0, &(0x7f00000002c0)=[{&(0x7f0000001700)=""/4095, 0x440000}], 0x100000000000011a)
mremap(&(0x7f00003c6000/0x4000)=nil, 0x4000, 0x4000, 0x7, &(0x7f00000f4000/0x4000)=nil)
r2 = syz_open_procfs(0x0, 0x0)
writev(r2, &(0x7f0000000100)=[{0x0}], 0x1)
munmap(&(0x7f00001a2000/0x1000)=nil, 0x1000)
r3 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000100), 0x0, 0x0)
r4 = ioctl$KVM_CREATE_VM(r3, 0xae01, 0x0)
r5 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000001c0)='blkio.bfq.io_wait_time_recursive\x00', 0x275a, 0x0)
write$binfmt_script(r5, &(0x7f0000000200), 0x208e24b)
mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x2, 0x28011, r5, 0x0)
ioctl$FS_IOC_FIEMAP(0xffffffffffffffff, 0xc020660b, &(0x7f0000000000)=ANY=[@ANYBLOB="0100"])
preadv(r5, &(0x7f00000015c0)=[{&(0x7f0000000080)=""/124, 0xffffff23}], 0x1, 0x0, 0x0)
r6 = ioctl$KVM_CREATE_VCPU(r4, 0xae41, 0x0)
ioctl$KVM_GET_NESTED_STATE(r6, 0xc048aeca, &(0x7f0000005580)={{0x0, 0x0, 0x80}})
migrate_pages(0x0, 0x3, &(0x7f0000000040)=0x7f, &(0x7f0000000300)=0xa)
r7 = syz_open_procfs$pagemap(0x0, &(0x7f0000000000))
ioctl$PAGEMAP_SCAN(r7, 0xc0606610, &(0x7f0000000200)={0x60, 0x0, &(0x7f0000245000/0x2000)=nil, &(0x7f0000994000/0x2000)=nil, 0x0, 0x0})
r8 = syz_open_dev$evdev(&(0x7f0000000000), 0xffffffffffffffff, 0x1)
sendmsg$TIPC_CMD_SHOW_NAME_TABLE(0xffffffffffffffff, &(0x7f0000000600)={&(0x7f0000000500)={0x10, 0x0, 0x0, 0x4000}, 0xc, &(0x7f00000005c0)={&(0x7f0000000580)={0x30, 0x0, 0x20, 0x70bd2b, 0x25dfdbff, {{}, {}, {0x14, 0x19, {0xfffffef9, 0x0, 0x2, 0xc}}}, [""]}, 0x30}, 0x1, 0x0, 0x0, 0x20000004}, 0x20000044)
ioctl$EVIOCSMASK(r8, 0x40104593, 0x0)
r9 = socket(0x11, 0x800000003, 0x0)
ioctl$sock_ipv4_tunnel_SIOCGETTUNNEL(r9, 0x89f0, &(0x7f0000000080)={'tunl0\x00', &(0x7f0000000000)={'syztnl1\x00', 0x0, 0x0, 0x0, 0x0, 0x0, {{0x5, 0x4, 0x0, 0x0, 0x14, 0x0, 0x0, 0x0, 0x0, 0x0, @local, @loopback}}}})
executing program 0:
r0 = socket$nl_xfrm(0x10, 0x3, 0x6)
setsockopt$netlink_NETLINK_ADD_MEMBERSHIP(r0, 0x10e, 0x1, &(0x7f0000000400)=0x1, 0x2c)
r1 = syz_io_uring_setup(0x24fb, &(0x7f0000000300)={0x0, 0x0, 0x10100}, &(0x7f0000000100)=<r2=>0x0, &(0x7f0000000080)=<r3=>0x0)
r4 = socket$inet6_dccp(0xa, 0x6, 0x0)
bind$inet6(r4, &(0x7f0000000000)={0xa, 0x0, 0x0, @mcast1, 0x1}, 0x1c)
syz_io_uring_submit(r2, r3, &(0x7f00000001c0)=@IORING_OP_CONNECT={0x10, 0x0, 0x0, r4, 0x80, &(0x7f0000000200)=@in6={0xa, 0x0, 0x0, @ipv4={'\x00', '\xff\xff', @loopback}}})
io_uring_enter(r1, 0x5b43, 0x0, 0x0, 0x0, 0x0)
r5 = socket$inet6(0xa, 0x3, 0x6)
r6 = openat(0xffffffffffffffff, &(0x7f0000000040)='./file0\x00', 0x175400, 0xa4)
ioctl$PTP_PEROUT_REQUEST2(r6, 0x40383d0c, &(0x7f0000000080)={{0x7, 0x400}, {0x4, 0x4}, 0x6, 0x1})
setsockopt$inet6_IPV6_XFRM_POLICY(r5, 0x29, 0x23, &(0x7f0000000180)={{{@in=@local, @in6=@dev, 0x0, 0x0, 0x0, 0x0, 0x2}, {}, {}, 0x0, 0x0, 0x1}, {{@in=@empty, 0x0, 0x6c}, 0x0, @in6=@loopback}}, 0xe8)
connect$inet6(r5, &(0x7f0000000000)={0xa, 0x0, 0x0, @ipv4={'\x00', '\xff\xff', @dev}}, 0x1c)
executing program 0:
socket$inet6_tcp(0xa, 0x1, 0x0)
syz_emit_ethernet(0xfc0, &(0x7f00000001c0)={@local, @dev, @void, {@ipv4={0x800, @generic={{0x5, 0x4, 0x0, 0x0, 0xfb2, 0x0, 0x0, 0x0, 0x84, 0x0, @empty, @broadcast}, "dd9dec79219eb549dbd024c796335bc5ff0e043319357749084ca9d0ae1378f4e88112a2f7c10fd1523b9007773fd2b2bd0ebabccd2e5c35fb3baff587585840f2530c6f4d025f118440ac22a8b34da7b5e1e873bd429686be3ef84439e05fc0fefedb8b897b09445a9e10cf24aec2ff3ca6a86d94df0c4a928ed904dcfb02e6c6c5918a839d33cb9b55dfb3cd89d80eb18dc06415d313b4ea240a65eff4b941ac018e8f81de044239960271333255291b5fbfdcf8db25e175640f36986b859aeb3370ca17e6a20aeeb5c5d27eb097fc1fab796a7ff8fcbe119bbe4be2c8a5c58890191c59bea20bfe4edf9c5453e59f610d3bd1d6eb49b02e464aee0480187c5717936add1347b08cdf5b056adb941708e8a0498900419e98b75658c6dd00f88eebf8c9aaee2e38c80eafcf6ca08ea305da9c7050948ef78a1457a2e933287fe8d2e100cb00078ed829985f8812d543cc5cdb71521f4113829551efe915e4d6773f2d285cc1e8813919356ca5ef202b0d2b8a3d7de51e4635e761ffd7efe5d51dd1325596f0e4e1c0b1ce73240cb931227892d66f3629c9d152372d5790c1c25e2f6f850a4eb83654f423b84adbbf4169d472b2cddaa7137ff14c2944ade3a57613806810707a2e6c078beb4b87cf8cf39c9950bcb3f9bb42308bd5e68d81f7f4d9e528541703059787f5e342be8ebb9841d587f7455b409115d511c130d9641fc74391228bda52d2fa58e2ca74b26583e73e2cfb881945d8ecbc77eb35e783057f6c35ba06b7f639ec516ee54bf3645f6ec436ba859e22ed480a862285aa21f3d5cd3734dde388a7f8920c4a6b4a952f830e0d2811f2f2714e660e961de0b3e0b8d5fd1007690a61e414e82245dbe4e47c73465ed40af1cee2eae4801ee408ad1fce81ff8db77082c5efd93fa9a1a3e3d78eff84f326df1c6fa656cc7d4dab842f47ad0a7e74dfe1a53776a346a22dc7a0e476754d385d99aa9cbd3f445ffb2ed61e01b28fc071d706ad204b1e8014481dba0cbc460b67e64d6e955184271cedef7f951021e3595ebe9c3384b53efafb67cbed2aa1ede5d7fcff3abd27d05766fb8894d7948609441759f4c4dfa33b6d486d4fb7e231f04d4f0f9e98f4b156129d9307fb9ebf3b278232062e7fe9ec2db7c4c991f83733368a107bf5798a1df45c919d71cce45ed907240c2f2fa6a4227e8e11cef2e7968c63e7a1adc3edec2170c17ed2cc54d0ea2b34e99b81015ffe51a501c2b73ddac5223e69d0dd451d358c0cd2ff7db256850ec1e9e349901f168d854284da68d80c68298a75c5d859008c82fe08b4cf2e68a2c0190760a03aff1be2c9425b6d5ef5c67bafb6d16fffeeb0211d90abbade4db9d6a9e9c981dde14c1d54e9138f9760bcdccbf17e7416042cfe7bbd8bba2f739f7f900ee45b965316b950e8474f3be92081fb63f43a4858b39e20e14d5a38c0973d680f2fda9e310d0e088523bdcbb728bcd0074447b4ace876da5642cd7d781cdb023a31446e0a0c59d5388674a5c8a97927e014a73d0330bd5c5187db79f1c546a8bcca008263509c23b246dea58fb36c44d373c1c92ffdd1600c27d4b10b3fc86b88ecefe8743bb59a6b8e443f06d2ae3a6908b6bc65b647deee13262225b8879dd79413ffa3d4aef91a0a04d4dc3030b5beb081c5fdf9152c3a17e6b24457fd580d84d3006af27ff44d6ec3664c4955a1d1dc5eb041682644ae5643901f00aa602b2a18cdd3f8a1efff7b8f3afc31c283c9b74b806a98bd9f1ad8ecce410160c0a27f7ef90a2b0c1bea64e187adc04a04bff7c435659bc4c3ce5c2730e121972541062102e93d2a136e1aaaf3e25d547cad6e2b0874500fc098469494d2654808ee88588fd167f4332061a9b4cae6b22d87624e325e89a269f61ce0d26465ddfedc1f0fa2a5cf1ee7fe3e6cb375f1ff04cf8d22667debe574b8395023bde9a8302376af2e119c4c88433d1722011ade605f3a4201860742b0392ac96cc138d9ddb952f4e4742a7fd9d625465dac35347c1662b2085c357120c6ff69dedc013c5fe46555a4448b0be41e21ad73162bf9aa1cfb70f4702c7051c0a13fae918133f123d33c5c02e66ae8fceb3109b2e13a7a3e71484d59dfcba16db2d21549be1ba6cd5ad7610eefda427982384961f18bd6857ad97e868c2914d0ba934a296eda52646031c4504864061f3cba1df65cd04ef6b1050fb30b5abbbe28f8f7adb8073e452f4c0c5492a5f8d427ddf451ae303a86639e5dbccfe2b2bedb911d534a77c012e2f8a24917d98ab14557caf3e66040f21767685644f0003459762d4ab25a0e33a92b54748cf46a977505074b79b9b0746b2b5b168876a2ca10bb903edc1d1992a4a94c0ee0dd7b37add092163b5fbaf16090f8143187d060b19e3822f3def14717e41558f9582467a5a5f89148450fde235e7a5bb900e4e9d14e2147bfd2a52f84a115eb170bf3d3b9b3de9781960be4e53025c7dce005e1458140bb9cf9da8fa1124ac558fb220d57c23a7f120f5171eb2208d9e6ab7186ae457973da564f1fd45b241c15596035f55034c3995a587b4471068076839420df947f10ab2fc211732d768c135d63cc5eeda1bdfc780e7ed90855fa5a364e63f529703cd0f691b0b6a41232bfd1c1f61ef6b16ed3b9055ca888c8ebcd16a0623ede9e4e37b7d6175e3d0ddba8e7d87639eb8b0ba246131951a581575f1adf4c598a9f2f087d5eb2a0a5834d8cb12b0ad76d9381a838ccfbfcc20bbb970474c48677f10aa57be1d607d5b049d397178035f7f3393cd9000336c83218850ecd64142a22f7ae7e6a7e62013d6d105eb7c862e13979698681d44121ee9e2e552315d4d3913ff7bcd90d6bed72d50107a971a37d5a1d75efeebf03cc91239b7e427fba8df6b79674c15acd2093289fe6155063af81d85840abf4635f66083b3707d34b2149dfdf95cb4deb71e1574118c242b160c770347e6b1f135a985e89fe8e6d7f40281cfb6dc05cd8b9d4f6680c0863acb34516092acdf2bea67f54ab4282ba2d898287f34d9384e335b2ddbb87aaea8cadb8f0b397e99a68a7a214fae5a1f56c95bcd901534c23cd5cff3c168813d7fa1191dd7437c96b07324a7b21b48e205b859dcd080bd62ab7cca4bd7a73959218d0eeb21c887483201eaf3afb19efe1741b57332c5441685a7bb8324dde85faafc785312b58aabef2eef6a8048663bf13db9ae9edd4b1dcebc99890693f11b354b1f1aad19b66251b4bcaed0daed73b87dedd140fd680e7d3355362844d1d7ba2ae6be7ffae59d7b3c679b890448b0de1acf591abfe6f3096794b7e142e0ac0862ab8cb76eb79b17d1138be3747f907c3f11c636a0f0e0d315d1ff05aab0ce62fbac03a2b4ddeac7ee192bba2da93b7a926271f6d594aa14de2c294ad0c77770a624d1ce24cc8d8f5e9b629604fa7897f0cbd641f76a85dc8df33b5715eb100e30e53b85110d2252c22575a7365eb08006b4d62d305e780101965094ce2aaad170df470870e687fb280b772d41ad5d470b71e256af3a0d2c02df95821d38f28cdff26fa7a3f6e920edbd3174d2d2bde854ef68dae8a0a4a63753c825930903a2ca75d4321bad0ad9ff6852f94dd04972a45bb9625b3726dfbcc959e85242f0d327b181aee0fdab7af064dd97151b131a5c4a51a66692cbbd9f1348a16470cedef1b255e172cd2b15184177ad43744de941869af884ff8e59ef0e63ac5e1b99c851e0f915359ce12d9c380bb6f9c2bc773267157afeda7abcc120a31a1b72af6662bff7f5f194dad00b4ebfdcbb4dfc39854412db1ae99b449d741f841239159ea467cf1e38b95bcb7603ebcb400cb31410b2a4e25126caade0019bf667cc998bc4582578da0f8a6268f6d114ccf9dd8379995e8be1b934bb5645d72f97e05628129a7d2bc548e08796341f43dc3c9fcbe89d8284dc6633bee0d17e99f600425f0172b6bc478f5117dadf15e36e850ecc0ca75664ef8e4877a44b4ffa22a6f1d6719f8d81f9937928caa0690b77406a3298aaf446e2f78343267399bb7f64c60f82bf5d07210281eaad09a3810790720c98a041332c809be7aea1480b9e5eb989085c23b4aee75143068def3e89d1c417b63321e68d340a1472d2504088c17cd75de0e700508c55a7246ca9a762cc50ca35cbcaa7dcf4ae3264c32ff2cd67566ed501fb8182b5f16c58295783f3b2b554b06aae700f198c71ad7519868c1e6fbeb0246569b04beeb8b71bcbb9af93372bee365efb1d7424689e8241b1dc346a73a84b5773487f388356b8dbec1a108846e3f8dc74865b156e8ad18b353efc4ad0b11412a381fec8f5d45678b4f8b6805913e7aff71acf9052ae3b73e41e19668f9b53bfd75b778970831b6891a78ffe0d4863e62cbbf6cf8c085032864479cd3a250842984dcc2860f057f86c8e2d4d2afefb8a45b7d5b8c94e752f369a1b434c827cd26cd0276a8b40019a95ebe7c16de4c1ce8efbd5c70e0c507631818aa4fbc937d212e428aefa895069656babdbd921af974da32c49f4ca6d1e1e28319b427c8bad4d650809c673ec6073770b4097e5700a8071110fd07acbc5a59f8d7b0735a98fd40ce03718a9a93c035948859215c59f54343b08bfd95a35d73c5f09a9ebe63c509fe8443fa74e6efd0fd87defc7cb16725ce3c3d5f7664cfe253faf2cbeb307052dd2269b6266acdb31e2006b9355f673ca5c9cb907605ce071824254b139607a069531f9598f4040ddeb9cd018e9dfa1808032dfb65a4af0820da810a7b58fbb65ac8e65b017a40ec2d445a5c7b78d1f0e717b19427ef1fe6cc08c5e9da5a7d1d508fd939854589dcba8d75ff3d8d1c1fb28af1ed6900bcd4cedbe42fd6243c81264fe81be756bfd71ebcd4d96bd7ec50a676bc57e130bd8da21bb6e888eb6c8402516f6fe6dfe25be9a3e33f2cdbed9de00efb867cbe80ec2309458f41924b967d254166e5a0a5f776395214a67900d180704b9fb09f9c4c4c62fd382fcd5efe099e22d2c82f198a39d193f65b68e09454e2ab8f2d7413c64563742f1c34ca9285e501bff5efa30a0da946f875d23162eaa53c4008bed38e9a190b08ff8bfb6bfb91553c4c329fc73b8be308b00347dee2afdc08bab311c75386f452b706d1820c9038998924665010a548c09743a16167b0b09373b5cd2fb1da4f6c9ea5b1f1dd7775f6fcb23eab4fd1990364dacb2a1656b9bcf1c4866b7222872a3a3a03d397499222a3f31a35d3aeaf6a6d39f0fbee1e0f6e1e10ba0774f15f245d955cc8132d86c2d768f8a06274caa5a12c46e9e08ee556c1da49830f1e6c0a0c53a9ef1489c3fba0251c3e6839e891ac298108f3ed05066e48b8bda2c5f6e691c7a7425b7019e0a547f6560a0af41831a4a790c3a8eac9a3a9119da3eef85cb12f3f3115f04ae95534ac847b4ee2cc2fc43cdba382ecae7c4f499ce1be1ca1907313ff665c2fd7d4c8f36716f33b6861f5cf3f1c878feadfa9a664b8d629a16c750c466326a951efaa830e4f328270041f2ca0be49f0affe5806b94b027033f008957e83d167d6fe4168ec4fb79385cc06e257bba807ecfccaba56cf751dac996b7a347d36ec52b0f5d16425402416c735530bd7c545f8c753fb3b1054b82bc368ef4ac3000000"}}}}, 0x0)
syz_emit_ethernet(0x56, &(0x7f00000001c0)=ANY=[@ANYBLOB="aaaaaaaaaaaabbbbbbbbbbbb88a800008100000086dd600000000018000000000000000000000000000000000000fc0000000000000100000000000005020000c204"], 0x0)
executing program 0:
r0 = syz_open_dev$usbfs(&(0x7f00000000c0), 0x10, 0xa702)
mmap(&(0x7f0000527000/0x1000)=nil, 0x1000, 0x1000006, 0x11, r0, 0x0)
sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f00000007c0)={0x0, 0x0, &(0x7f0000000480)={&(0x7f0000002340)=@delchain={0x244, 0x65, 0x0, 0x0, 0x0, {}, [@TCA_CHAIN={0x8}, @filter_kind_options=@f_u32={{0x8}, {0x40, 0x2, [@TCA_U32_INDEV={0x14, 0x8, 'veth0_to_team\x00'}, @TCA_U32_CLASSID={0x8}, @TCA_U32_HASH={0x8}, @TCA_U32_MARK={0x10}, @TCA_U32_FLAGS={0x8}]}}, @TCA_CHAIN={0x8}, @TCA_RATE={0x6}, @filter_kind_options=@f_route={{0xa}, {0x1b4, 0x2, [@TCA_ROUTE4_FROM={0x8}, @TCA_ROUTE4_POLICE={0x4}, @TCA_ROUTE4_FROM={0x8}, @TCA_ROUTE4_ACT={0x19c, 0x6, [@m_ife={0x150, 0x0, 0x0, 0x0, {{0x8}, {0x34, 0x2, 0x0, 0x1, [@TCA_IFE_SMAC={0xa, 0x4, @dev}, @TCA_IFE_TYPE={0x6}, @TCA_IFE_PARMS={0x1c}]}, {0xf5, 0x6, "21b2caeba32a6f7c5900697624a17b85a9db3a31b129a4976a84cfb4f5d651fd8aa24a645c8f63c025fcca463a6b79a3d7e6c9a8b89a140805ef63939ac2e37b49004b0dc3b8446aa7038eceef52fe7bdca153fe865c65015a3b208b282c16472e451aa10a8631235c49cae271f5fc8ce5e34d9938e3d5f43ac7a0e31b0acfc73199ca90e81246819f4c740a4fa3247a2af88d6569da09be7179b89f9f024c9f465098a5a52058a431206bee68089bddc13ffe76ff0f000053fa1517700a54d423c13fb6732a5d39c87101b0882ccd8e86eb437849e249675c60d8a9cf9430b6aa206e8116810b35151fce1e1bf48c2b9c"}, {0xc}, {0xc}}}, @m_nat={0x48, 0x0, 0x0, 0x0, {{0x8}, {0x4}, {0x1d, 0x6, "ef93daeef78df7f9a037a0d7a2f92a1cc341deabba437fc636"}, {0xc}, {0xc}}}]}]}}]}, 0x244}}, 0x0)
r1 = socket(0x10, 0x803, 0x0)
sendto(r1, &(0x7f0000000740)="120000001200e7ef007b00000000000000a1", 0x12, 0x0, 0x0, 0x0)
recvmmsg(r1, &(0x7f00000037c0)=[{{&(0x7f00000004c0)=@ethernet={0x0, @random}, 0xfdf4, &(0x7f0000000380)=[{&(0x7f0000000140)=""/100, 0x365}, {&(0x7f0000000280)=""/85, 0x7c}, {&(0x7f0000000fc0)=""/4096, 0x197}, {&(0x7f0000000400)=""/106, 0x645}, {&(0x7f0000000980)=""/73, 0x1b}, {&(0x7f0000000200)=""/77, 0x334}, {&(0x7f00000007c0)=""/154, 0x8}, {&(0x7f00000001c0)=""/17, 0x1d8}], 0x21, &(0x7f0000000600)=""/191, 0x41}}], 0x4000000000003b4, 0x0, &(0x7f0000003700)={0x77359400})
syz_open_dev$video(&(0x7f0000000040), 0xa7, 0x0)
r2 = syz_open_dev$vbi(&(0x7f0000000080), 0x2, 0x2)
ioctl$VIDIOC_S_FMT(r2, 0xc0d05640, &(0x7f0000000340)={0x1, @pix={0x20000, 0x0, 0x0, 0x0, 0x0, 0x1, 0x3, 0xfeedcafe, 0x0, 0x0, 0x0, 0x7}})
prctl$PR_SET_IO_FLUSHER(0x41, 0x3)
mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f04ebbee8, 0x10, 0xffffffffffffffff, 0x0)
r3 = socket(0xa, 0x2, 0x0)
bind$inet6(r3, &(0x7f0000000040)={0xa, 0x0, 0x0, @loopback={0xff00000000000000}}, 0x59)
getsockname$packet(r3, 0x0, &(0x7f00000002c0))
r4 = syz_open_procfs(0x0, &(0x7f0000000040)='ns\x00')
getdents64(r4, 0x0, 0x500)
ioctl$UFFDIO_COPY(r4, 0xc028aa03, &(0x7f0000000000)={&(0x7f00002de000/0x1000)=nil, &(0x7f00004ed000/0x4000)=nil, 0x1000})
mprotect(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x6)
syz_open_dev$usbfs(&(0x7f00000000c0), 0x10, 0xa702) (async)
mmap(&(0x7f0000527000/0x1000)=nil, 0x1000, 0x1000006, 0x11, r0, 0x0) (async)
sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f00000007c0)={0x0, 0x0, &(0x7f0000000480)={&(0x7f0000002340)=@delchain={0x244, 0x65, 0x0, 0x0, 0x0, {}, [@TCA_CHAIN={0x8}, @filter_kind_options=@f_u32={{0x8}, {0x40, 0x2, [@TCA_U32_INDEV={0x14, 0x8, 'veth0_to_team\x00'}, @TCA_U32_CLASSID={0x8}, @TCA_U32_HASH={0x8}, @TCA_U32_MARK={0x10}, @TCA_U32_FLAGS={0x8}]}}, @TCA_CHAIN={0x8}, @TCA_RATE={0x6}, @filter_kind_options=@f_route={{0xa}, {0x1b4, 0x2, [@TCA_ROUTE4_FROM={0x8}, @TCA_ROUTE4_POLICE={0x4}, @TCA_ROUTE4_FROM={0x8}, @TCA_ROUTE4_ACT={0x19c, 0x6, [@m_ife={0x150, 0x0, 0x0, 0x0, {{0x8}, {0x34, 0x2, 0x0, 0x1, [@TCA_IFE_SMAC={0xa, 0x4, @dev}, @TCA_IFE_TYPE={0x6}, @TCA_IFE_PARMS={0x1c}]}, {0xf5, 0x6, "21b2caeba32a6f7c5900697624a17b85a9db3a31b129a4976a84cfb4f5d651fd8aa24a645c8f63c025fcca463a6b79a3d7e6c9a8b89a140805ef63939ac2e37b49004b0dc3b8446aa7038eceef52fe7bdca153fe865c65015a3b208b282c16472e451aa10a8631235c49cae271f5fc8ce5e34d9938e3d5f43ac7a0e31b0acfc73199ca90e81246819f4c740a4fa3247a2af88d6569da09be7179b89f9f024c9f465098a5a52058a431206bee68089bddc13ffe76ff0f000053fa1517700a54d423c13fb6732a5d39c87101b0882ccd8e86eb437849e249675c60d8a9cf9430b6aa206e8116810b35151fce1e1bf48c2b9c"}, {0xc}, {0xc}}}, @m_nat={0x48, 0x0, 0x0, 0x0, {{0x8}, {0x4}, {0x1d, 0x6, "ef93daeef78df7f9a037a0d7a2f92a1cc341deabba437fc636"}, {0xc}, {0xc}}}]}]}}]}, 0x244}}, 0x0) (async)
socket(0x10, 0x803, 0x0) (async)
sendto(r1, &(0x7f0000000740)="120000001200e7ef007b00000000000000a1", 0x12, 0x0, 0x0, 0x0) (async)
recvmmsg(r1, &(0x7f00000037c0)=[{{&(0x7f00000004c0)=@ethernet={0x0, @random}, 0xfdf4, &(0x7f0000000380)=[{&(0x7f0000000140)=""/100, 0x365}, {&(0x7f0000000280)=""/85, 0x7c}, {&(0x7f0000000fc0)=""/4096, 0x197}, {&(0x7f0000000400)=""/106, 0x645}, {&(0x7f0000000980)=""/73, 0x1b}, {&(0x7f0000000200)=""/77, 0x334}, {&(0x7f00000007c0)=""/154, 0x8}, {&(0x7f00000001c0)=""/17, 0x1d8}], 0x21, &(0x7f0000000600)=""/191, 0x41}}], 0x4000000000003b4, 0x0, &(0x7f0000003700)={0x77359400}) (async)
syz_open_dev$video(&(0x7f0000000040), 0xa7, 0x0) (async)
syz_open_dev$vbi(&(0x7f0000000080), 0x2, 0x2) (async)
ioctl$VIDIOC_S_FMT(r2, 0xc0d05640, &(0x7f0000000340)={0x1, @pix={0x20000, 0x0, 0x0, 0x0, 0x0, 0x1, 0x3, 0xfeedcafe, 0x0, 0x0, 0x0, 0x7}}) (async)
prctl$PR_SET_IO_FLUSHER(0x41, 0x3) (async)
mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f04ebbee8, 0x10, 0xffffffffffffffff, 0x0) (async)
socket(0xa, 0x2, 0x0) (async)
bind$inet6(r3, &(0x7f0000000040)={0xa, 0x0, 0x0, @loopback={0xff00000000000000}}, 0x59) (async)
getsockname$packet(r3, 0x0, &(0x7f00000002c0)) (async)
syz_open_procfs(0x0, &(0x7f0000000040)='ns\x00') (async)
getdents64(r4, 0x0, 0x500) (async)
ioctl$UFFDIO_COPY(r4, 0xc028aa03, &(0x7f0000000000)={&(0x7f00002de000/0x1000)=nil, &(0x7f00004ed000/0x4000)=nil, 0x1000}) (async)
mprotect(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x6) (async)

program did not crash
replaying the whole log did not cause a kernel crash
single: executing 5 programs separately with timeout 1m40s
testing program (duration=1m40s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:namespace SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_open_dev$usbfs-mmap-sendmsg$nl_route_sched-socket-sendto-recvmmsg-syz_open_dev$video-syz_open_dev$vbi-ioctl$VIDIOC_S_FMT-prctl$PR_SET_IO_FLUSHER-mmap-socket-bind$inet6-getsockname$packet-syz_open_procfs-getdents64-ioctl$UFFDIO_COPY-mprotect-syz_open_dev$usbfs-mmap-sendmsg$nl_route_sched-socket-sendto-recvmmsg-syz_open_dev$video-syz_open_dev$vbi-ioctl$VIDIOC_S_FMT-prctl$PR_SET_IO_FLUSHER-mmap-socket-bind$inet6-getsockname$packet-syz_open_procfs-getdents64-ioctl$UFFDIO_COPY-mprotect
detailed listing:
executing program 0:
r0 = syz_open_dev$usbfs(&(0x7f00000000c0), 0x10, 0xa702)
mmap(&(0x7f0000527000/0x1000)=nil, 0x1000, 0x1000006, 0x11, r0, 0x0)
sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f00000007c0)={0x0, 0x0, &(0x7f0000000480)={&(0x7f0000002340)=@delchain={0x244, 0x65, 0x0, 0x0, 0x0, {}, [@TCA_CHAIN={0x8}, @filter_kind_options=@f_u32={{0x8}, {0x40, 0x2, [@TCA_U32_INDEV={0x14, 0x8, 'veth0_to_team\x00'}, @TCA_U32_CLASSID={0x8}, @TCA_U32_HASH={0x8}, @TCA_U32_MARK={0x10}, @TCA_U32_FLAGS={0x8}]}}, @TCA_CHAIN={0x8}, @TCA_RATE={0x6}, @filter_kind_options=@f_route={{0xa}, {0x1b4, 0x2, [@TCA_ROUTE4_FROM={0x8}, @TCA_ROUTE4_POLICE={0x4}, @TCA_ROUTE4_FROM={0x8}, @TCA_ROUTE4_ACT={0x19c, 0x6, [@m_ife={0x150, 0x0, 0x0, 0x0, {{0x8}, {0x34, 0x2, 0x0, 0x1, [@TCA_IFE_SMAC={0xa, 0x4, @dev}, @TCA_IFE_TYPE={0x6}, @TCA_IFE_PARMS={0x1c}]}, {0xf5, 0x6, "21b2caeba32a6f7c5900697624a17b85a9db3a31b129a4976a84cfb4f5d651fd8aa24a645c8f63c025fcca463a6b79a3d7e6c9a8b89a140805ef63939ac2e37b49004b0dc3b8446aa7038eceef52fe7bdca153fe865c65015a3b208b282c16472e451aa10a8631235c49cae271f5fc8ce5e34d9938e3d5f43ac7a0e31b0acfc73199ca90e81246819f4c740a4fa3247a2af88d6569da09be7179b89f9f024c9f465098a5a52058a431206bee68089bddc13ffe76ff0f000053fa1517700a54d423c13fb6732a5d39c87101b0882ccd8e86eb437849e249675c60d8a9cf9430b6aa206e8116810b35151fce1e1bf48c2b9c"}, {0xc}, {0xc}}}, @m_nat={0x48, 0x0, 0x0, 0x0, {{0x8}, {0x4}, {0x1d, 0x6, "ef93daeef78df7f9a037a0d7a2f92a1cc341deabba437fc636"}, {0xc}, {0xc}}}]}]}}]}, 0x244}}, 0x0)
r1 = socket(0x10, 0x803, 0x0)
sendto(r1, &(0x7f0000000740)="120000001200e7ef007b00000000000000a1", 0x12, 0x0, 0x0, 0x0)
recvmmsg(r1, &(0x7f00000037c0)=[{{&(0x7f00000004c0)=@ethernet={0x0, @random}, 0xfdf4, &(0x7f0000000380)=[{&(0x7f0000000140)=""/100, 0x365}, {&(0x7f0000000280)=""/85, 0x7c}, {&(0x7f0000000fc0)=""/4096, 0x197}, {&(0x7f0000000400)=""/106, 0x645}, {&(0x7f0000000980)=""/73, 0x1b}, {&(0x7f0000000200)=""/77, 0x334}, {&(0x7f00000007c0)=""/154, 0x8}, {&(0x7f00000001c0)=""/17, 0x1d8}], 0x21, &(0x7f0000000600)=""/191, 0x41}}], 0x4000000000003b4, 0x0, &(0x7f0000003700)={0x77359400})
syz_open_dev$video(&(0x7f0000000040), 0xa7, 0x0)
r2 = syz_open_dev$vbi(&(0x7f0000000080), 0x2, 0x2)
ioctl$VIDIOC_S_FMT(r2, 0xc0d05640, &(0x7f0000000340)={0x1, @pix={0x20000, 0x0, 0x0, 0x0, 0x0, 0x1, 0x3, 0xfeedcafe, 0x0, 0x0, 0x0, 0x7}})
prctl$PR_SET_IO_FLUSHER(0x41, 0x3)
mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f04ebbee8, 0x10, 0xffffffffffffffff, 0x0)
r3 = socket(0xa, 0x2, 0x0)
bind$inet6(r3, &(0x7f0000000040)={0xa, 0x0, 0x0, @loopback={0xff00000000000000}}, 0x59)
getsockname$packet(r3, 0x0, &(0x7f00000002c0))
r4 = syz_open_procfs(0x0, &(0x7f0000000040)='ns\x00')
getdents64(r4, 0x0, 0x500)
ioctl$UFFDIO_COPY(r4, 0xc028aa03, &(0x7f0000000000)={&(0x7f00002de000/0x1000)=nil, &(0x7f00004ed000/0x4000)=nil, 0x1000})
mprotect(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x6)
syz_open_dev$usbfs(&(0x7f00000000c0), 0x10, 0xa702) (async)
mmap(&(0x7f0000527000/0x1000)=nil, 0x1000, 0x1000006, 0x11, r0, 0x0) (async)
sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f00000007c0)={0x0, 0x0, &(0x7f0000000480)={&(0x7f0000002340)=@delchain={0x244, 0x65, 0x0, 0x0, 0x0, {}, [@TCA_CHAIN={0x8}, @filter_kind_options=@f_u32={{0x8}, {0x40, 0x2, [@TCA_U32_INDEV={0x14, 0x8, 'veth0_to_team\x00'}, @TCA_U32_CLASSID={0x8}, @TCA_U32_HASH={0x8}, @TCA_U32_MARK={0x10}, @TCA_U32_FLAGS={0x8}]}}, @TCA_CHAIN={0x8}, @TCA_RATE={0x6}, @filter_kind_options=@f_route={{0xa}, {0x1b4, 0x2, [@TCA_ROUTE4_FROM={0x8}, @TCA_ROUTE4_POLICE={0x4}, @TCA_ROUTE4_FROM={0x8}, @TCA_ROUTE4_ACT={0x19c, 0x6, [@m_ife={0x150, 0x0, 0x0, 0x0, {{0x8}, {0x34, 0x2, 0x0, 0x1, [@TCA_IFE_SMAC={0xa, 0x4, @dev}, @TCA_IFE_TYPE={0x6}, @TCA_IFE_PARMS={0x1c}]}, {0xf5, 0x6, "21b2caeba32a6f7c5900697624a17b85a9db3a31b129a4976a84cfb4f5d651fd8aa24a645c8f63c025fcca463a6b79a3d7e6c9a8b89a140805ef63939ac2e37b49004b0dc3b8446aa7038eceef52fe7bdca153fe865c65015a3b208b282c16472e451aa10a8631235c49cae271f5fc8ce5e34d9938e3d5f43ac7a0e31b0acfc73199ca90e81246819f4c740a4fa3247a2af88d6569da09be7179b89f9f024c9f465098a5a52058a431206bee68089bddc13ffe76ff0f000053fa1517700a54d423c13fb6732a5d39c87101b0882ccd8e86eb437849e249675c60d8a9cf9430b6aa206e8116810b35151fce1e1bf48c2b9c"}, {0xc}, {0xc}}}, @m_nat={0x48, 0x0, 0x0, 0x0, {{0x8}, {0x4}, {0x1d, 0x6, "ef93daeef78df7f9a037a0d7a2f92a1cc341deabba437fc636"}, {0xc}, {0xc}}}]}]}}]}, 0x244}}, 0x0) (async)
socket(0x10, 0x803, 0x0) (async)
sendto(r1, &(0x7f0000000740)="120000001200e7ef007b00000000000000a1", 0x12, 0x0, 0x0, 0x0) (async)
recvmmsg(r1, &(0x7f00000037c0)=[{{&(0x7f00000004c0)=@ethernet={0x0, @random}, 0xfdf4, &(0x7f0000000380)=[{&(0x7f0000000140)=""/100, 0x365}, {&(0x7f0000000280)=""/85, 0x7c}, {&(0x7f0000000fc0)=""/4096, 0x197}, {&(0x7f0000000400)=""/106, 0x645}, {&(0x7f0000000980)=""/73, 0x1b}, {&(0x7f0000000200)=""/77, 0x334}, {&(0x7f00000007c0)=""/154, 0x8}, {&(0x7f00000001c0)=""/17, 0x1d8}], 0x21, &(0x7f0000000600)=""/191, 0x41}}], 0x4000000000003b4, 0x0, &(0x7f0000003700)={0x77359400}) (async)
syz_open_dev$video(&(0x7f0000000040), 0xa7, 0x0) (async)
syz_open_dev$vbi(&(0x7f0000000080), 0x2, 0x2) (async)
ioctl$VIDIOC_S_FMT(r2, 0xc0d05640, &(0x7f0000000340)={0x1, @pix={0x20000, 0x0, 0x0, 0x0, 0x0, 0x1, 0x3, 0xfeedcafe, 0x0, 0x0, 0x0, 0x7}}) (async)
prctl$PR_SET_IO_FLUSHER(0x41, 0x3) (async)
mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f04ebbee8, 0x10, 0xffffffffffffffff, 0x0) (async)
socket(0xa, 0x2, 0x0) (async)
bind$inet6(r3, &(0x7f0000000040)={0xa, 0x0, 0x0, @loopback={0xff00000000000000}}, 0x59) (async)
getsockname$packet(r3, 0x0, &(0x7f00000002c0)) (async)
syz_open_procfs(0x0, &(0x7f0000000040)='ns\x00') (async)
getdents64(r4, 0x0, 0x500) (async)
ioctl$UFFDIO_COPY(r4, 0xc028aa03, &(0x7f0000000000)={&(0x7f00002de000/0x1000)=nil, &(0x7f00004ed000/0x4000)=nil, 0x1000}) (async)
mprotect(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x6) (async)

program crashed: kernel BUG in __page_table_check_zero
single: successfully extracted reproducer
found reproducer with 36 syscalls
minimizing guilty program
testing program (duration=2m30s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:namespace SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_open_dev$usbfs-mmap-sendmsg$nl_route_sched-socket-sendto-recvmmsg-syz_open_dev$video-syz_open_dev$vbi-ioctl$VIDIOC_S_FMT-prctl$PR_SET_IO_FLUSHER-mmap-socket-bind$inet6-getsockname$packet-syz_open_procfs-getdents64-ioctl$UFFDIO_COPY-mprotect-syz_open_dev$usbfs-mmap-sendmsg$nl_route_sched-socket-sendto-recvmmsg-syz_open_dev$video-syz_open_dev$vbi-ioctl$VIDIOC_S_FMT-prctl$PR_SET_IO_FLUSHER-mmap-socket-bind$inet6-getsockname$packet-syz_open_procfs-getdents64-ioctl$UFFDIO_COPY
detailed listing:
executing program 0:
r0 = syz_open_dev$usbfs(&(0x7f00000000c0), 0x10, 0xa702)
mmap(&(0x7f0000527000/0x1000)=nil, 0x1000, 0x1000006, 0x11, r0, 0x0)
sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f00000007c0)={0x0, 0x0, &(0x7f0000000480)={&(0x7f0000002340)=@delchain={0x244, 0x65, 0x0, 0x0, 0x0, {}, [@TCA_CHAIN={0x8}, @filter_kind_options=@f_u32={{0x8}, {0x40, 0x2, [@TCA_U32_INDEV={0x14, 0x8, 'veth0_to_team\x00'}, @TCA_U32_CLASSID={0x8}, @TCA_U32_HASH={0x8}, @TCA_U32_MARK={0x10}, @TCA_U32_FLAGS={0x8}]}}, @TCA_CHAIN={0x8}, @TCA_RATE={0x6}, @filter_kind_options=@f_route={{0xa}, {0x1b4, 0x2, [@TCA_ROUTE4_FROM={0x8}, @TCA_ROUTE4_POLICE={0x4}, @TCA_ROUTE4_FROM={0x8}, @TCA_ROUTE4_ACT={0x19c, 0x6, [@m_ife={0x150, 0x0, 0x0, 0x0, {{0x8}, {0x34, 0x2, 0x0, 0x1, [@TCA_IFE_SMAC={0xa, 0x4, @dev}, @TCA_IFE_TYPE={0x6}, @TCA_IFE_PARMS={0x1c}]}, {0xf5, 0x6, "21b2caeba32a6f7c5900697624a17b85a9db3a31b129a4976a84cfb4f5d651fd8aa24a645c8f63c025fcca463a6b79a3d7e6c9a8b89a140805ef63939ac2e37b49004b0dc3b8446aa7038eceef52fe7bdca153fe865c65015a3b208b282c16472e451aa10a8631235c49cae271f5fc8ce5e34d9938e3d5f43ac7a0e31b0acfc73199ca90e81246819f4c740a4fa3247a2af88d6569da09be7179b89f9f024c9f465098a5a52058a431206bee68089bddc13ffe76ff0f000053fa1517700a54d423c13fb6732a5d39c87101b0882ccd8e86eb437849e249675c60d8a9cf9430b6aa206e8116810b35151fce1e1bf48c2b9c"}, {0xc}, {0xc}}}, @m_nat={0x48, 0x0, 0x0, 0x0, {{0x8}, {0x4}, {0x1d, 0x6, "ef93daeef78df7f9a037a0d7a2f92a1cc341deabba437fc636"}, {0xc}, {0xc}}}]}]}}]}, 0x244}}, 0x0)
r1 = socket(0x10, 0x803, 0x0)
sendto(r1, &(0x7f0000000740)="120000001200e7ef007b00000000000000a1", 0x12, 0x0, 0x0, 0x0)
recvmmsg(r1, &(0x7f00000037c0)=[{{&(0x7f00000004c0)=@ethernet={0x0, @random}, 0xfdf4, &(0x7f0000000380)=[{&(0x7f0000000140)=""/100, 0x365}, {&(0x7f0000000280)=""/85, 0x7c}, {&(0x7f0000000fc0)=""/4096, 0x197}, {&(0x7f0000000400)=""/106, 0x645}, {&(0x7f0000000980)=""/73, 0x1b}, {&(0x7f0000000200)=""/77, 0x334}, {&(0x7f00000007c0)=""/154, 0x8}, {&(0x7f00000001c0)=""/17, 0x1d8}], 0x21, &(0x7f0000000600)=""/191, 0x41}}], 0x4000000000003b4, 0x0, &(0x7f0000003700)={0x77359400})
syz_open_dev$video(&(0x7f0000000040), 0xa7, 0x0)
r2 = syz_open_dev$vbi(&(0x7f0000000080), 0x2, 0x2)
ioctl$VIDIOC_S_FMT(r2, 0xc0d05640, &(0x7f0000000340)={0x1, @pix={0x20000, 0x0, 0x0, 0x0, 0x0, 0x1, 0x3, 0xfeedcafe, 0x0, 0x0, 0x0, 0x7}})
prctl$PR_SET_IO_FLUSHER(0x41, 0x3)
mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f04ebbee8, 0x10, 0xffffffffffffffff, 0x0)
r3 = socket(0xa, 0x2, 0x0)
bind$inet6(r3, &(0x7f0000000040)={0xa, 0x0, 0x0, @loopback={0xff00000000000000}}, 0x59)
getsockname$packet(r3, 0x0, &(0x7f00000002c0))
r4 = syz_open_procfs(0x0, &(0x7f0000000040)='ns\x00')
getdents64(r4, 0x0, 0x500)
ioctl$UFFDIO_COPY(r4, 0xc028aa03, &(0x7f0000000000)={&(0x7f00002de000/0x1000)=nil, &(0x7f00004ed000/0x4000)=nil, 0x1000})
mprotect(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x6)
syz_open_dev$usbfs(&(0x7f00000000c0), 0x10, 0xa702) (async)
mmap(&(0x7f0000527000/0x1000)=nil, 0x1000, 0x1000006, 0x11, r0, 0x0) (async)
sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f00000007c0)={0x0, 0x0, &(0x7f0000000480)={&(0x7f0000002340)=@delchain={0x244, 0x65, 0x0, 0x0, 0x0, {}, [@TCA_CHAIN={0x8}, @filter_kind_options=@f_u32={{0x8}, {0x40, 0x2, [@TCA_U32_INDEV={0x14, 0x8, 'veth0_to_team\x00'}, @TCA_U32_CLASSID={0x8}, @TCA_U32_HASH={0x8}, @TCA_U32_MARK={0x10}, @TCA_U32_FLAGS={0x8}]}}, @TCA_CHAIN={0x8}, @TCA_RATE={0x6}, @filter_kind_options=@f_route={{0xa}, {0x1b4, 0x2, [@TCA_ROUTE4_FROM={0x8}, @TCA_ROUTE4_POLICE={0x4}, @TCA_ROUTE4_FROM={0x8}, @TCA_ROUTE4_ACT={0x19c, 0x6, [@m_ife={0x150, 0x0, 0x0, 0x0, {{0x8}, {0x34, 0x2, 0x0, 0x1, [@TCA_IFE_SMAC={0xa, 0x4, @dev}, @TCA_IFE_TYPE={0x6}, @TCA_IFE_PARMS={0x1c}]}, {0xf5, 0x6, "21b2caeba32a6f7c5900697624a17b85a9db3a31b129a4976a84cfb4f5d651fd8aa24a645c8f63c025fcca463a6b79a3d7e6c9a8b89a140805ef63939ac2e37b49004b0dc3b8446aa7038eceef52fe7bdca153fe865c65015a3b208b282c16472e451aa10a8631235c49cae271f5fc8ce5e34d9938e3d5f43ac7a0e31b0acfc73199ca90e81246819f4c740a4fa3247a2af88d6569da09be7179b89f9f024c9f465098a5a52058a431206bee68089bddc13ffe76ff0f000053fa1517700a54d423c13fb6732a5d39c87101b0882ccd8e86eb437849e249675c60d8a9cf9430b6aa206e8116810b35151fce1e1bf48c2b9c"}, {0xc}, {0xc}}}, @m_nat={0x48, 0x0, 0x0, 0x0, {{0x8}, {0x4}, {0x1d, 0x6, "ef93daeef78df7f9a037a0d7a2f92a1cc341deabba437fc636"}, {0xc}, {0xc}}}]}]}}]}, 0x244}}, 0x0) (async)
socket(0x10, 0x803, 0x0) (async)
sendto(r1, &(0x7f0000000740)="120000001200e7ef007b00000000000000a1", 0x12, 0x0, 0x0, 0x0) (async)
recvmmsg(r1, &(0x7f00000037c0)=[{{&(0x7f00000004c0)=@ethernet={0x0, @random}, 0xfdf4, &(0x7f0000000380)=[{&(0x7f0000000140)=""/100, 0x365}, {&(0x7f0000000280)=""/85, 0x7c}, {&(0x7f0000000fc0)=""/4096, 0x197}, {&(0x7f0000000400)=""/106, 0x645}, {&(0x7f0000000980)=""/73, 0x1b}, {&(0x7f0000000200)=""/77, 0x334}, {&(0x7f00000007c0)=""/154, 0x8}, {&(0x7f00000001c0)=""/17, 0x1d8}], 0x21, &(0x7f0000000600)=""/191, 0x41}}], 0x4000000000003b4, 0x0, &(0x7f0000003700)={0x77359400}) (async)
syz_open_dev$video(&(0x7f0000000040), 0xa7, 0x0) (async)
syz_open_dev$vbi(&(0x7f0000000080), 0x2, 0x2) (async)
ioctl$VIDIOC_S_FMT(r2, 0xc0d05640, &(0x7f0000000340)={0x1, @pix={0x20000, 0x0, 0x0, 0x0, 0x0, 0x1, 0x3, 0xfeedcafe, 0x0, 0x0, 0x0, 0x7}}) (async)
prctl$PR_SET_IO_FLUSHER(0x41, 0x3) (async)
mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f04ebbee8, 0x10, 0xffffffffffffffff, 0x0) (async)
socket(0xa, 0x2, 0x0) (async)
bind$inet6(r3, &(0x7f0000000040)={0xa, 0x0, 0x0, @loopback={0xff00000000000000}}, 0x59) (async)
getsockname$packet(r3, 0x0, &(0x7f00000002c0)) (async)
syz_open_procfs(0x0, &(0x7f0000000040)='ns\x00') (async)
getdents64(r4, 0x0, 0x500) (async)
ioctl$UFFDIO_COPY(r4, 0xc028aa03, &(0x7f0000000000)={&(0x7f00002de000/0x1000)=nil, &(0x7f00004ed000/0x4000)=nil, 0x1000}) (async)

program crashed: kernel BUG in __page_table_check_zero
testing program (duration=2m30s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:namespace SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_open_dev$usbfs-mmap-sendmsg$nl_route_sched-socket-sendto-recvmmsg-syz_open_dev$video-syz_open_dev$vbi-ioctl$VIDIOC_S_FMT-prctl$PR_SET_IO_FLUSHER-mmap-socket-bind$inet6-getsockname$packet-syz_open_procfs-getdents64-ioctl$UFFDIO_COPY-mprotect-syz_open_dev$usbfs-mmap-sendmsg$nl_route_sched-socket-sendto-recvmmsg-syz_open_dev$video-syz_open_dev$vbi-ioctl$VIDIOC_S_FMT-prctl$PR_SET_IO_FLUSHER-mmap-socket-bind$inet6-getsockname$packet-syz_open_procfs-getdents64
detailed listing:
executing program 0:
r0 = syz_open_dev$usbfs(&(0x7f00000000c0), 0x10, 0xa702)
mmap(&(0x7f0000527000/0x1000)=nil, 0x1000, 0x1000006, 0x11, r0, 0x0)
sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f00000007c0)={0x0, 0x0, &(0x7f0000000480)={&(0x7f0000002340)=@delchain={0x244, 0x65, 0x0, 0x0, 0x0, {}, [@TCA_CHAIN={0x8}, @filter_kind_options=@f_u32={{0x8}, {0x40, 0x2, [@TCA_U32_INDEV={0x14, 0x8, 'veth0_to_team\x00'}, @TCA_U32_CLASSID={0x8}, @TCA_U32_HASH={0x8}, @TCA_U32_MARK={0x10}, @TCA_U32_FLAGS={0x8}]}}, @TCA_CHAIN={0x8}, @TCA_RATE={0x6}, @filter_kind_options=@f_route={{0xa}, {0x1b4, 0x2, [@TCA_ROUTE4_FROM={0x8}, @TCA_ROUTE4_POLICE={0x4}, @TCA_ROUTE4_FROM={0x8}, @TCA_ROUTE4_ACT={0x19c, 0x6, [@m_ife={0x150, 0x0, 0x0, 0x0, {{0x8}, {0x34, 0x2, 0x0, 0x1, [@TCA_IFE_SMAC={0xa, 0x4, @dev}, @TCA_IFE_TYPE={0x6}, @TCA_IFE_PARMS={0x1c}]}, {0xf5, 0x6, "21b2caeba32a6f7c5900697624a17b85a9db3a31b129a4976a84cfb4f5d651fd8aa24a645c8f63c025fcca463a6b79a3d7e6c9a8b89a140805ef63939ac2e37b49004b0dc3b8446aa7038eceef52fe7bdca153fe865c65015a3b208b282c16472e451aa10a8631235c49cae271f5fc8ce5e34d9938e3d5f43ac7a0e31b0acfc73199ca90e81246819f4c740a4fa3247a2af88d6569da09be7179b89f9f024c9f465098a5a52058a431206bee68089bddc13ffe76ff0f000053fa1517700a54d423c13fb6732a5d39c87101b0882ccd8e86eb437849e249675c60d8a9cf9430b6aa206e8116810b35151fce1e1bf48c2b9c"}, {0xc}, {0xc}}}, @m_nat={0x48, 0x0, 0x0, 0x0, {{0x8}, {0x4}, {0x1d, 0x6, "ef93daeef78df7f9a037a0d7a2f92a1cc341deabba437fc636"}, {0xc}, {0xc}}}]}]}}]}, 0x244}}, 0x0)
r1 = socket(0x10, 0x803, 0x0)
sendto(r1, &(0x7f0000000740)="120000001200e7ef007b00000000000000a1", 0x12, 0x0, 0x0, 0x0)
recvmmsg(r1, &(0x7f00000037c0)=[{{&(0x7f00000004c0)=@ethernet={0x0, @random}, 0xfdf4, &(0x7f0000000380)=[{&(0x7f0000000140)=""/100, 0x365}, {&(0x7f0000000280)=""/85, 0x7c}, {&(0x7f0000000fc0)=""/4096, 0x197}, {&(0x7f0000000400)=""/106, 0x645}, {&(0x7f0000000980)=""/73, 0x1b}, {&(0x7f0000000200)=""/77, 0x334}, {&(0x7f00000007c0)=""/154, 0x8}, {&(0x7f00000001c0)=""/17, 0x1d8}], 0x21, &(0x7f0000000600)=""/191, 0x41}}], 0x4000000000003b4, 0x0, &(0x7f0000003700)={0x77359400})
syz_open_dev$video(&(0x7f0000000040), 0xa7, 0x0)
r2 = syz_open_dev$vbi(&(0x7f0000000080), 0x2, 0x2)
ioctl$VIDIOC_S_FMT(r2, 0xc0d05640, &(0x7f0000000340)={0x1, @pix={0x20000, 0x0, 0x0, 0x0, 0x0, 0x1, 0x3, 0xfeedcafe, 0x0, 0x0, 0x0, 0x7}})
prctl$PR_SET_IO_FLUSHER(0x41, 0x3)
mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f04ebbee8, 0x10, 0xffffffffffffffff, 0x0)
r3 = socket(0xa, 0x2, 0x0)
bind$inet6(r3, &(0x7f0000000040)={0xa, 0x0, 0x0, @loopback={0xff00000000000000}}, 0x59)
getsockname$packet(r3, 0x0, &(0x7f00000002c0))
r4 = syz_open_procfs(0x0, &(0x7f0000000040)='ns\x00')
getdents64(r4, 0x0, 0x500)
ioctl$UFFDIO_COPY(r4, 0xc028aa03, &(0x7f0000000000)={&(0x7f00002de000/0x1000)=nil, &(0x7f00004ed000/0x4000)=nil, 0x1000})
mprotect(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x6)
syz_open_dev$usbfs(&(0x7f00000000c0), 0x10, 0xa702) (async)
mmap(&(0x7f0000527000/0x1000)=nil, 0x1000, 0x1000006, 0x11, r0, 0x0) (async)
sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f00000007c0)={0x0, 0x0, &(0x7f0000000480)={&(0x7f0000002340)=@delchain={0x244, 0x65, 0x0, 0x0, 0x0, {}, [@TCA_CHAIN={0x8}, @filter_kind_options=@f_u32={{0x8}, {0x40, 0x2, [@TCA_U32_INDEV={0x14, 0x8, 'veth0_to_team\x00'}, @TCA_U32_CLASSID={0x8}, @TCA_U32_HASH={0x8}, @TCA_U32_MARK={0x10}, @TCA_U32_FLAGS={0x8}]}}, @TCA_CHAIN={0x8}, @TCA_RATE={0x6}, @filter_kind_options=@f_route={{0xa}, {0x1b4, 0x2, [@TCA_ROUTE4_FROM={0x8}, @TCA_ROUTE4_POLICE={0x4}, @TCA_ROUTE4_FROM={0x8}, @TCA_ROUTE4_ACT={0x19c, 0x6, [@m_ife={0x150, 0x0, 0x0, 0x0, {{0x8}, {0x34, 0x2, 0x0, 0x1, [@TCA_IFE_SMAC={0xa, 0x4, @dev}, @TCA_IFE_TYPE={0x6}, @TCA_IFE_PARMS={0x1c}]}, {0xf5, 0x6, "21b2caeba32a6f7c5900697624a17b85a9db3a31b129a4976a84cfb4f5d651fd8aa24a645c8f63c025fcca463a6b79a3d7e6c9a8b89a140805ef63939ac2e37b49004b0dc3b8446aa7038eceef52fe7bdca153fe865c65015a3b208b282c16472e451aa10a8631235c49cae271f5fc8ce5e34d9938e3d5f43ac7a0e31b0acfc73199ca90e81246819f4c740a4fa3247a2af88d6569da09be7179b89f9f024c9f465098a5a52058a431206bee68089bddc13ffe76ff0f000053fa1517700a54d423c13fb6732a5d39c87101b0882ccd8e86eb437849e249675c60d8a9cf9430b6aa206e8116810b35151fce1e1bf48c2b9c"}, {0xc}, {0xc}}}, @m_nat={0x48, 0x0, 0x0, 0x0, {{0x8}, {0x4}, {0x1d, 0x6, "ef93daeef78df7f9a037a0d7a2f92a1cc341deabba437fc636"}, {0xc}, {0xc}}}]}]}}]}, 0x244}}, 0x0) (async)
socket(0x10, 0x803, 0x0) (async)
sendto(r1, &(0x7f0000000740)="120000001200e7ef007b00000000000000a1", 0x12, 0x0, 0x0, 0x0) (async)
recvmmsg(r1, &(0x7f00000037c0)=[{{&(0x7f00000004c0)=@ethernet={0x0, @random}, 0xfdf4, &(0x7f0000000380)=[{&(0x7f0000000140)=""/100, 0x365}, {&(0x7f0000000280)=""/85, 0x7c}, {&(0x7f0000000fc0)=""/4096, 0x197}, {&(0x7f0000000400)=""/106, 0x645}, {&(0x7f0000000980)=""/73, 0x1b}, {&(0x7f0000000200)=""/77, 0x334}, {&(0x7f00000007c0)=""/154, 0x8}, {&(0x7f00000001c0)=""/17, 0x1d8}], 0x21, &(0x7f0000000600)=""/191, 0x41}}], 0x4000000000003b4, 0x0, &(0x7f0000003700)={0x77359400}) (async)
syz_open_dev$video(&(0x7f0000000040), 0xa7, 0x0) (async)
syz_open_dev$vbi(&(0x7f0000000080), 0x2, 0x2) (async)
ioctl$VIDIOC_S_FMT(r2, 0xc0d05640, &(0x7f0000000340)={0x1, @pix={0x20000, 0x0, 0x0, 0x0, 0x0, 0x1, 0x3, 0xfeedcafe, 0x0, 0x0, 0x0, 0x7}}) (async)
prctl$PR_SET_IO_FLUSHER(0x41, 0x3) (async)
mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f04ebbee8, 0x10, 0xffffffffffffffff, 0x0) (async)
socket(0xa, 0x2, 0x0) (async)
bind$inet6(r3, &(0x7f0000000040)={0xa, 0x0, 0x0, @loopback={0xff00000000000000}}, 0x59) (async)
getsockname$packet(r3, 0x0, &(0x7f00000002c0)) (async)
syz_open_procfs(0x0, &(0x7f0000000040)='ns\x00') (async)
getdents64(r4, 0x0, 0x500) (async)

program crashed: kernel BUG in __page_table_check_zero
testing program (duration=2m30s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:namespace SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_open_dev$usbfs-mmap-sendmsg$nl_route_sched-socket-sendto-recvmmsg-syz_open_dev$video-syz_open_dev$vbi-ioctl$VIDIOC_S_FMT-prctl$PR_SET_IO_FLUSHER-mmap-socket-bind$inet6-getsockname$packet-syz_open_procfs-getdents64-ioctl$UFFDIO_COPY-mprotect-syz_open_dev$usbfs-mmap-sendmsg$nl_route_sched-socket-sendto-recvmmsg-syz_open_dev$video-syz_open_dev$vbi-ioctl$VIDIOC_S_FMT-prctl$PR_SET_IO_FLUSHER-mmap-socket-bind$inet6-getsockname$packet-syz_open_procfs
detailed listing:
executing program 0:
r0 = syz_open_dev$usbfs(&(0x7f00000000c0), 0x10, 0xa702)
mmap(&(0x7f0000527000/0x1000)=nil, 0x1000, 0x1000006, 0x11, r0, 0x0)
sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f00000007c0)={0x0, 0x0, &(0x7f0000000480)={&(0x7f0000002340)=@delchain={0x244, 0x65, 0x0, 0x0, 0x0, {}, [@TCA_CHAIN={0x8}, @filter_kind_options=@f_u32={{0x8}, {0x40, 0x2, [@TCA_U32_INDEV={0x14, 0x8, 'veth0_to_team\x00'}, @TCA_U32_CLASSID={0x8}, @TCA_U32_HASH={0x8}, @TCA_U32_MARK={0x10}, @TCA_U32_FLAGS={0x8}]}}, @TCA_CHAIN={0x8}, @TCA_RATE={0x6}, @filter_kind_options=@f_route={{0xa}, {0x1b4, 0x2, [@TCA_ROUTE4_FROM={0x8}, @TCA_ROUTE4_POLICE={0x4}, @TCA_ROUTE4_FROM={0x8}, @TCA_ROUTE4_ACT={0x19c, 0x6, [@m_ife={0x150, 0x0, 0x0, 0x0, {{0x8}, {0x34, 0x2, 0x0, 0x1, [@TCA_IFE_SMAC={0xa, 0x4, @dev}, @TCA_IFE_TYPE={0x6}, @TCA_IFE_PARMS={0x1c}]}, {0xf5, 0x6, "21b2caeba32a6f7c5900697624a17b85a9db3a31b129a4976a84cfb4f5d651fd8aa24a645c8f63c025fcca463a6b79a3d7e6c9a8b89a140805ef63939ac2e37b49004b0dc3b8446aa7038eceef52fe7bdca153fe865c65015a3b208b282c16472e451aa10a8631235c49cae271f5fc8ce5e34d9938e3d5f43ac7a0e31b0acfc73199ca90e81246819f4c740a4fa3247a2af88d6569da09be7179b89f9f024c9f465098a5a52058a431206bee68089bddc13ffe76ff0f000053fa1517700a54d423c13fb6732a5d39c87101b0882ccd8e86eb437849e249675c60d8a9cf9430b6aa206e8116810b35151fce1e1bf48c2b9c"}, {0xc}, {0xc}}}, @m_nat={0x48, 0x0, 0x0, 0x0, {{0x8}, {0x4}, {0x1d, 0x6, "ef93daeef78df7f9a037a0d7a2f92a1cc341deabba437fc636"}, {0xc}, {0xc}}}]}]}}]}, 0x244}}, 0x0)
r1 = socket(0x10, 0x803, 0x0)
sendto(r1, &(0x7f0000000740)="120000001200e7ef007b00000000000000a1", 0x12, 0x0, 0x0, 0x0)
recvmmsg(r1, &(0x7f00000037c0)=[{{&(0x7f00000004c0)=@ethernet={0x0, @random}, 0xfdf4, &(0x7f0000000380)=[{&(0x7f0000000140)=""/100, 0x365}, {&(0x7f0000000280)=""/85, 0x7c}, {&(0x7f0000000fc0)=""/4096, 0x197}, {&(0x7f0000000400)=""/106, 0x645}, {&(0x7f0000000980)=""/73, 0x1b}, {&(0x7f0000000200)=""/77, 0x334}, {&(0x7f00000007c0)=""/154, 0x8}, {&(0x7f00000001c0)=""/17, 0x1d8}], 0x21, &(0x7f0000000600)=""/191, 0x41}}], 0x4000000000003b4, 0x0, &(0x7f0000003700)={0x77359400})
syz_open_dev$video(&(0x7f0000000040), 0xa7, 0x0)
r2 = syz_open_dev$vbi(&(0x7f0000000080), 0x2, 0x2)
ioctl$VIDIOC_S_FMT(r2, 0xc0d05640, &(0x7f0000000340)={0x1, @pix={0x20000, 0x0, 0x0, 0x0, 0x0, 0x1, 0x3, 0xfeedcafe, 0x0, 0x0, 0x0, 0x7}})
prctl$PR_SET_IO_FLUSHER(0x41, 0x3)
mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f04ebbee8, 0x10, 0xffffffffffffffff, 0x0)
r3 = socket(0xa, 0x2, 0x0)
bind$inet6(r3, &(0x7f0000000040)={0xa, 0x0, 0x0, @loopback={0xff00000000000000}}, 0x59)
getsockname$packet(r3, 0x0, &(0x7f00000002c0))
r4 = syz_open_procfs(0x0, &(0x7f0000000040)='ns\x00')
getdents64(r4, 0x0, 0x500)
ioctl$UFFDIO_COPY(r4, 0xc028aa03, &(0x7f0000000000)={&(0x7f00002de000/0x1000)=nil, &(0x7f00004ed000/0x4000)=nil, 0x1000})
mprotect(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x6)
syz_open_dev$usbfs(&(0x7f00000000c0), 0x10, 0xa702) (async)
mmap(&(0x7f0000527000/0x1000)=nil, 0x1000, 0x1000006, 0x11, r0, 0x0) (async)
sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f00000007c0)={0x0, 0x0, &(0x7f0000000480)={&(0x7f0000002340)=@delchain={0x244, 0x65, 0x0, 0x0, 0x0, {}, [@TCA_CHAIN={0x8}, @filter_kind_options=@f_u32={{0x8}, {0x40, 0x2, [@TCA_U32_INDEV={0x14, 0x8, 'veth0_to_team\x00'}, @TCA_U32_CLASSID={0x8}, @TCA_U32_HASH={0x8}, @TCA_U32_MARK={0x10}, @TCA_U32_FLAGS={0x8}]}}, @TCA_CHAIN={0x8}, @TCA_RATE={0x6}, @filter_kind_options=@f_route={{0xa}, {0x1b4, 0x2, [@TCA_ROUTE4_FROM={0x8}, @TCA_ROUTE4_POLICE={0x4}, @TCA_ROUTE4_FROM={0x8}, @TCA_ROUTE4_ACT={0x19c, 0x6, [@m_ife={0x150, 0x0, 0x0, 0x0, {{0x8}, {0x34, 0x2, 0x0, 0x1, [@TCA_IFE_SMAC={0xa, 0x4, @dev}, @TCA_IFE_TYPE={0x6}, @TCA_IFE_PARMS={0x1c}]}, {0xf5, 0x6, "21b2caeba32a6f7c5900697624a17b85a9db3a31b129a4976a84cfb4f5d651fd8aa24a645c8f63c025fcca463a6b79a3d7e6c9a8b89a140805ef63939ac2e37b49004b0dc3b8446aa7038eceef52fe7bdca153fe865c65015a3b208b282c16472e451aa10a8631235c49cae271f5fc8ce5e34d9938e3d5f43ac7a0e31b0acfc73199ca90e81246819f4c740a4fa3247a2af88d6569da09be7179b89f9f024c9f465098a5a52058a431206bee68089bddc13ffe76ff0f000053fa1517700a54d423c13fb6732a5d39c87101b0882ccd8e86eb437849e249675c60d8a9cf9430b6aa206e8116810b35151fce1e1bf48c2b9c"}, {0xc}, {0xc}}}, @m_nat={0x48, 0x0, 0x0, 0x0, {{0x8}, {0x4}, {0x1d, 0x6, "ef93daeef78df7f9a037a0d7a2f92a1cc341deabba437fc636"}, {0xc}, {0xc}}}]}]}}]}, 0x244}}, 0x0) (async)
socket(0x10, 0x803, 0x0) (async)
sendto(r1, &(0x7f0000000740)="120000001200e7ef007b00000000000000a1", 0x12, 0x0, 0x0, 0x0) (async)
recvmmsg(r1, &(0x7f00000037c0)=[{{&(0x7f00000004c0)=@ethernet={0x0, @random}, 0xfdf4, &(0x7f0000000380)=[{&(0x7f0000000140)=""/100, 0x365}, {&(0x7f0000000280)=""/85, 0x7c}, {&(0x7f0000000fc0)=""/4096, 0x197}, {&(0x7f0000000400)=""/106, 0x645}, {&(0x7f0000000980)=""/73, 0x1b}, {&(0x7f0000000200)=""/77, 0x334}, {&(0x7f00000007c0)=""/154, 0x8}, {&(0x7f00000001c0)=""/17, 0x1d8}], 0x21, &(0x7f0000000600)=""/191, 0x41}}], 0x4000000000003b4, 0x0, &(0x7f0000003700)={0x77359400}) (async)
syz_open_dev$video(&(0x7f0000000040), 0xa7, 0x0) (async)
syz_open_dev$vbi(&(0x7f0000000080), 0x2, 0x2) (async)
ioctl$VIDIOC_S_FMT(r2, 0xc0d05640, &(0x7f0000000340)={0x1, @pix={0x20000, 0x0, 0x0, 0x0, 0x0, 0x1, 0x3, 0xfeedcafe, 0x0, 0x0, 0x0, 0x7}}) (async)
prctl$PR_SET_IO_FLUSHER(0x41, 0x3) (async)
mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f04ebbee8, 0x10, 0xffffffffffffffff, 0x0) (async)
socket(0xa, 0x2, 0x0) (async)
bind$inet6(r3, &(0x7f0000000040)={0xa, 0x0, 0x0, @loopback={0xff00000000000000}}, 0x59) (async)
getsockname$packet(r3, 0x0, &(0x7f00000002c0)) (async)
syz_open_procfs(0x0, &(0x7f0000000040)='ns\x00') (async)

program crashed: kernel BUG in __page_table_check_zero
testing program (duration=2m30s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:namespace SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_open_dev$usbfs-mmap-sendmsg$nl_route_sched-socket-sendto-recvmmsg-syz_open_dev$video-syz_open_dev$vbi-ioctl$VIDIOC_S_FMT-prctl$PR_SET_IO_FLUSHER-mmap-socket-bind$inet6-getsockname$packet-syz_open_procfs-getdents64-ioctl$UFFDIO_COPY-mprotect-syz_open_dev$usbfs-mmap-sendmsg$nl_route_sched-socket-sendto-recvmmsg-syz_open_dev$video-syz_open_dev$vbi-ioctl$VIDIOC_S_FMT-prctl$PR_SET_IO_FLUSHER-mmap-socket-bind$inet6-getsockname$packet
detailed listing:
executing program 0:
r0 = syz_open_dev$usbfs(&(0x7f00000000c0), 0x10, 0xa702)
mmap(&(0x7f0000527000/0x1000)=nil, 0x1000, 0x1000006, 0x11, r0, 0x0)
sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f00000007c0)={0x0, 0x0, &(0x7f0000000480)={&(0x7f0000002340)=@delchain={0x244, 0x65, 0x0, 0x0, 0x0, {}, [@TCA_CHAIN={0x8}, @filter_kind_options=@f_u32={{0x8}, {0x40, 0x2, [@TCA_U32_INDEV={0x14, 0x8, 'veth0_to_team\x00'}, @TCA_U32_CLASSID={0x8}, @TCA_U32_HASH={0x8}, @TCA_U32_MARK={0x10}, @TCA_U32_FLAGS={0x8}]}}, @TCA_CHAIN={0x8}, @TCA_RATE={0x6}, @filter_kind_options=@f_route={{0xa}, {0x1b4, 0x2, [@TCA_ROUTE4_FROM={0x8}, @TCA_ROUTE4_POLICE={0x4}, @TCA_ROUTE4_FROM={0x8}, @TCA_ROUTE4_ACT={0x19c, 0x6, [@m_ife={0x150, 0x0, 0x0, 0x0, {{0x8}, {0x34, 0x2, 0x0, 0x1, [@TCA_IFE_SMAC={0xa, 0x4, @dev}, @TCA_IFE_TYPE={0x6}, @TCA_IFE_PARMS={0x1c}]}, {0xf5, 0x6, "21b2caeba32a6f7c5900697624a17b85a9db3a31b129a4976a84cfb4f5d651fd8aa24a645c8f63c025fcca463a6b79a3d7e6c9a8b89a140805ef63939ac2e37b49004b0dc3b8446aa7038eceef52fe7bdca153fe865c65015a3b208b282c16472e451aa10a8631235c49cae271f5fc8ce5e34d9938e3d5f43ac7a0e31b0acfc73199ca90e81246819f4c740a4fa3247a2af88d6569da09be7179b89f9f024c9f465098a5a52058a431206bee68089bddc13ffe76ff0f000053fa1517700a54d423c13fb6732a5d39c87101b0882ccd8e86eb437849e249675c60d8a9cf9430b6aa206e8116810b35151fce1e1bf48c2b9c"}, {0xc}, {0xc}}}, @m_nat={0x48, 0x0, 0x0, 0x0, {{0x8}, {0x4}, {0x1d, 0x6, "ef93daeef78df7f9a037a0d7a2f92a1cc341deabba437fc636"}, {0xc}, {0xc}}}]}]}}]}, 0x244}}, 0x0)
r1 = socket(0x10, 0x803, 0x0)
sendto(r1, &(0x7f0000000740)="120000001200e7ef007b00000000000000a1", 0x12, 0x0, 0x0, 0x0)
recvmmsg(r1, &(0x7f00000037c0)=[{{&(0x7f00000004c0)=@ethernet={0x0, @random}, 0xfdf4, &(0x7f0000000380)=[{&(0x7f0000000140)=""/100, 0x365}, {&(0x7f0000000280)=""/85, 0x7c}, {&(0x7f0000000fc0)=""/4096, 0x197}, {&(0x7f0000000400)=""/106, 0x645}, {&(0x7f0000000980)=""/73, 0x1b}, {&(0x7f0000000200)=""/77, 0x334}, {&(0x7f00000007c0)=""/154, 0x8}, {&(0x7f00000001c0)=""/17, 0x1d8}], 0x21, &(0x7f0000000600)=""/191, 0x41}}], 0x4000000000003b4, 0x0, &(0x7f0000003700)={0x77359400})
syz_open_dev$video(&(0x7f0000000040), 0xa7, 0x0)
r2 = syz_open_dev$vbi(&(0x7f0000000080), 0x2, 0x2)
ioctl$VIDIOC_S_FMT(r2, 0xc0d05640, &(0x7f0000000340)={0x1, @pix={0x20000, 0x0, 0x0, 0x0, 0x0, 0x1, 0x3, 0xfeedcafe, 0x0, 0x0, 0x0, 0x7}})
prctl$PR_SET_IO_FLUSHER(0x41, 0x3)
mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f04ebbee8, 0x10, 0xffffffffffffffff, 0x0)
r3 = socket(0xa, 0x2, 0x0)
bind$inet6(r3, &(0x7f0000000040)={0xa, 0x0, 0x0, @loopback={0xff00000000000000}}, 0x59)
getsockname$packet(r3, 0x0, &(0x7f00000002c0))
r4 = syz_open_procfs(0x0, &(0x7f0000000040)='ns\x00')
getdents64(r4, 0x0, 0x500)
ioctl$UFFDIO_COPY(r4, 0xc028aa03, &(0x7f0000000000)={&(0x7f00002de000/0x1000)=nil, &(0x7f00004ed000/0x4000)=nil, 0x1000})
mprotect(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x6)
syz_open_dev$usbfs(&(0x7f00000000c0), 0x10, 0xa702) (async)
mmap(&(0x7f0000527000/0x1000)=nil, 0x1000, 0x1000006, 0x11, r0, 0x0) (async)
sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f00000007c0)={0x0, 0x0, &(0x7f0000000480)={&(0x7f0000002340)=@delchain={0x244, 0x65, 0x0, 0x0, 0x0, {}, [@TCA_CHAIN={0x8}, @filter_kind_options=@f_u32={{0x8}, {0x40, 0x2, [@TCA_U32_INDEV={0x14, 0x8, 'veth0_to_team\x00'}, @TCA_U32_CLASSID={0x8}, @TCA_U32_HASH={0x8}, @TCA_U32_MARK={0x10}, @TCA_U32_FLAGS={0x8}]}}, @TCA_CHAIN={0x8}, @TCA_RATE={0x6}, @filter_kind_options=@f_route={{0xa}, {0x1b4, 0x2, [@TCA_ROUTE4_FROM={0x8}, @TCA_ROUTE4_POLICE={0x4}, @TCA_ROUTE4_FROM={0x8}, @TCA_ROUTE4_ACT={0x19c, 0x6, [@m_ife={0x150, 0x0, 0x0, 0x0, {{0x8}, {0x34, 0x2, 0x0, 0x1, [@TCA_IFE_SMAC={0xa, 0x4, @dev}, @TCA_IFE_TYPE={0x6}, @TCA_IFE_PARMS={0x1c}]}, {0xf5, 0x6, "21b2caeba32a6f7c5900697624a17b85a9db3a31b129a4976a84cfb4f5d651fd8aa24a645c8f63c025fcca463a6b79a3d7e6c9a8b89a140805ef63939ac2e37b49004b0dc3b8446aa7038eceef52fe7bdca153fe865c65015a3b208b282c16472e451aa10a8631235c49cae271f5fc8ce5e34d9938e3d5f43ac7a0e31b0acfc73199ca90e81246819f4c740a4fa3247a2af88d6569da09be7179b89f9f024c9f465098a5a52058a431206bee68089bddc13ffe76ff0f000053fa1517700a54d423c13fb6732a5d39c87101b0882ccd8e86eb437849e249675c60d8a9cf9430b6aa206e8116810b35151fce1e1bf48c2b9c"}, {0xc}, {0xc}}}, @m_nat={0x48, 0x0, 0x0, 0x0, {{0x8}, {0x4}, {0x1d, 0x6, "ef93daeef78df7f9a037a0d7a2f92a1cc341deabba437fc636"}, {0xc}, {0xc}}}]}]}}]}, 0x244}}, 0x0) (async)
socket(0x10, 0x803, 0x0) (async)
sendto(r1, &(0x7f0000000740)="120000001200e7ef007b00000000000000a1", 0x12, 0x0, 0x0, 0x0) (async)
recvmmsg(r1, &(0x7f00000037c0)=[{{&(0x7f00000004c0)=@ethernet={0x0, @random}, 0xfdf4, &(0x7f0000000380)=[{&(0x7f0000000140)=""/100, 0x365}, {&(0x7f0000000280)=""/85, 0x7c}, {&(0x7f0000000fc0)=""/4096, 0x197}, {&(0x7f0000000400)=""/106, 0x645}, {&(0x7f0000000980)=""/73, 0x1b}, {&(0x7f0000000200)=""/77, 0x334}, {&(0x7f00000007c0)=""/154, 0x8}, {&(0x7f00000001c0)=""/17, 0x1d8}], 0x21, &(0x7f0000000600)=""/191, 0x41}}], 0x4000000000003b4, 0x0, &(0x7f0000003700)={0x77359400}) (async)
syz_open_dev$video(&(0x7f0000000040), 0xa7, 0x0) (async)
syz_open_dev$vbi(&(0x7f0000000080), 0x2, 0x2) (async)
ioctl$VIDIOC_S_FMT(r2, 0xc0d05640, &(0x7f0000000340)={0x1, @pix={0x20000, 0x0, 0x0, 0x0, 0x0, 0x1, 0x3, 0xfeedcafe, 0x0, 0x0, 0x0, 0x7}}) (async)
prctl$PR_SET_IO_FLUSHER(0x41, 0x3) (async)
mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f04ebbee8, 0x10, 0xffffffffffffffff, 0x0) (async)
socket(0xa, 0x2, 0x0) (async)
bind$inet6(r3, &(0x7f0000000040)={0xa, 0x0, 0x0, @loopback={0xff00000000000000}}, 0x59) (async)
getsockname$packet(r3, 0x0, &(0x7f00000002c0)) (async)

program crashed: kernel BUG in __page_table_check_zero
testing program (duration=2m30s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:namespace SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_open_dev$usbfs-mmap-sendmsg$nl_route_sched-socket-sendto-recvmmsg-syz_open_dev$video-syz_open_dev$vbi-ioctl$VIDIOC_S_FMT-prctl$PR_SET_IO_FLUSHER-mmap-socket-bind$inet6-getsockname$packet-syz_open_procfs-getdents64-ioctl$UFFDIO_COPY-mprotect-syz_open_dev$usbfs-mmap-sendmsg$nl_route_sched-socket-sendto-recvmmsg-syz_open_dev$video-syz_open_dev$vbi-ioctl$VIDIOC_S_FMT-prctl$PR_SET_IO_FLUSHER-mmap-socket-bind$inet6
detailed listing:
executing program 0:
r0 = syz_open_dev$usbfs(&(0x7f00000000c0), 0x10, 0xa702)
mmap(&(0x7f0000527000/0x1000)=nil, 0x1000, 0x1000006, 0x11, r0, 0x0)
sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f00000007c0)={0x0, 0x0, &(0x7f0000000480)={&(0x7f0000002340)=@delchain={0x244, 0x65, 0x0, 0x0, 0x0, {}, [@TCA_CHAIN={0x8}, @filter_kind_options=@f_u32={{0x8}, {0x40, 0x2, [@TCA_U32_INDEV={0x14, 0x8, 'veth0_to_team\x00'}, @TCA_U32_CLASSID={0x8}, @TCA_U32_HASH={0x8}, @TCA_U32_MARK={0x10}, @TCA_U32_FLAGS={0x8}]}}, @TCA_CHAIN={0x8}, @TCA_RATE={0x6}, @filter_kind_options=@f_route={{0xa}, {0x1b4, 0x2, [@TCA_ROUTE4_FROM={0x8}, @TCA_ROUTE4_POLICE={0x4}, @TCA_ROUTE4_FROM={0x8}, @TCA_ROUTE4_ACT={0x19c, 0x6, [@m_ife={0x150, 0x0, 0x0, 0x0, {{0x8}, {0x34, 0x2, 0x0, 0x1, [@TCA_IFE_SMAC={0xa, 0x4, @dev}, @TCA_IFE_TYPE={0x6}, @TCA_IFE_PARMS={0x1c}]}, {0xf5, 0x6, "21b2caeba32a6f7c5900697624a17b85a9db3a31b129a4976a84cfb4f5d651fd8aa24a645c8f63c025fcca463a6b79a3d7e6c9a8b89a140805ef63939ac2e37b49004b0dc3b8446aa7038eceef52fe7bdca153fe865c65015a3b208b282c16472e451aa10a8631235c49cae271f5fc8ce5e34d9938e3d5f43ac7a0e31b0acfc73199ca90e81246819f4c740a4fa3247a2af88d6569da09be7179b89f9f024c9f465098a5a52058a431206bee68089bddc13ffe76ff0f000053fa1517700a54d423c13fb6732a5d39c87101b0882ccd8e86eb437849e249675c60d8a9cf9430b6aa206e8116810b35151fce1e1bf48c2b9c"}, {0xc}, {0xc}}}, @m_nat={0x48, 0x0, 0x0, 0x0, {{0x8}, {0x4}, {0x1d, 0x6, "ef93daeef78df7f9a037a0d7a2f92a1cc341deabba437fc636"}, {0xc}, {0xc}}}]}]}}]}, 0x244}}, 0x0)
r1 = socket(0x10, 0x803, 0x0)
sendto(r1, &(0x7f0000000740)="120000001200e7ef007b00000000000000a1", 0x12, 0x0, 0x0, 0x0)
recvmmsg(r1, &(0x7f00000037c0)=[{{&(0x7f00000004c0)=@ethernet={0x0, @random}, 0xfdf4, &(0x7f0000000380)=[{&(0x7f0000000140)=""/100, 0x365}, {&(0x7f0000000280)=""/85, 0x7c}, {&(0x7f0000000fc0)=""/4096, 0x197}, {&(0x7f0000000400)=""/106, 0x645}, {&(0x7f0000000980)=""/73, 0x1b}, {&(0x7f0000000200)=""/77, 0x334}, {&(0x7f00000007c0)=""/154, 0x8}, {&(0x7f00000001c0)=""/17, 0x1d8}], 0x21, &(0x7f0000000600)=""/191, 0x41}}], 0x4000000000003b4, 0x0, &(0x7f0000003700)={0x77359400})
syz_open_dev$video(&(0x7f0000000040), 0xa7, 0x0)
r2 = syz_open_dev$vbi(&(0x7f0000000080), 0x2, 0x2)
ioctl$VIDIOC_S_FMT(r2, 0xc0d05640, &(0x7f0000000340)={0x1, @pix={0x20000, 0x0, 0x0, 0x0, 0x0, 0x1, 0x3, 0xfeedcafe, 0x0, 0x0, 0x0, 0x7}})
prctl$PR_SET_IO_FLUSHER(0x41, 0x3)
mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f04ebbee8, 0x10, 0xffffffffffffffff, 0x0)
r3 = socket(0xa, 0x2, 0x0)
bind$inet6(r3, &(0x7f0000000040)={0xa, 0x0, 0x0, @loopback={0xff00000000000000}}, 0x59)
getsockname$packet(r3, 0x0, &(0x7f00000002c0))
r4 = syz_open_procfs(0x0, &(0x7f0000000040)='ns\x00')
getdents64(r4, 0x0, 0x500)
ioctl$UFFDIO_COPY(r4, 0xc028aa03, &(0x7f0000000000)={&(0x7f00002de000/0x1000)=nil, &(0x7f00004ed000/0x4000)=nil, 0x1000})
mprotect(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x6)
syz_open_dev$usbfs(&(0x7f00000000c0), 0x10, 0xa702) (async)
mmap(&(0x7f0000527000/0x1000)=nil, 0x1000, 0x1000006, 0x11, r0, 0x0) (async)
sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f00000007c0)={0x0, 0x0, &(0x7f0000000480)={&(0x7f0000002340)=@delchain={0x244, 0x65, 0x0, 0x0, 0x0, {}, [@TCA_CHAIN={0x8}, @filter_kind_options=@f_u32={{0x8}, {0x40, 0x2, [@TCA_U32_INDEV={0x14, 0x8, 'veth0_to_team\x00'}, @TCA_U32_CLASSID={0x8}, @TCA_U32_HASH={0x8}, @TCA_U32_MARK={0x10}, @TCA_U32_FLAGS={0x8}]}}, @TCA_CHAIN={0x8}, @TCA_RATE={0x6}, @filter_kind_options=@f_route={{0xa}, {0x1b4, 0x2, [@TCA_ROUTE4_FROM={0x8}, @TCA_ROUTE4_POLICE={0x4}, @TCA_ROUTE4_FROM={0x8}, @TCA_ROUTE4_ACT={0x19c, 0x6, [@m_ife={0x150, 0x0, 0x0, 0x0, {{0x8}, {0x34, 0x2, 0x0, 0x1, [@TCA_IFE_SMAC={0xa, 0x4, @dev}, @TCA_IFE_TYPE={0x6}, @TCA_IFE_PARMS={0x1c}]}, {0xf5, 0x6, "21b2caeba32a6f7c5900697624a17b85a9db3a31b129a4976a84cfb4f5d651fd8aa24a645c8f63c025fcca463a6b79a3d7e6c9a8b89a140805ef63939ac2e37b49004b0dc3b8446aa7038eceef52fe7bdca153fe865c65015a3b208b282c16472e451aa10a8631235c49cae271f5fc8ce5e34d9938e3d5f43ac7a0e31b0acfc73199ca90e81246819f4c740a4fa3247a2af88d6569da09be7179b89f9f024c9f465098a5a52058a431206bee68089bddc13ffe76ff0f000053fa1517700a54d423c13fb6732a5d39c87101b0882ccd8e86eb437849e249675c60d8a9cf9430b6aa206e8116810b35151fce1e1bf48c2b9c"}, {0xc}, {0xc}}}, @m_nat={0x48, 0x0, 0x0, 0x0, {{0x8}, {0x4}, {0x1d, 0x6, "ef93daeef78df7f9a037a0d7a2f92a1cc341deabba437fc636"}, {0xc}, {0xc}}}]}]}}]}, 0x244}}, 0x0) (async)
socket(0x10, 0x803, 0x0) (async)
sendto(r1, &(0x7f0000000740)="120000001200e7ef007b00000000000000a1", 0x12, 0x0, 0x0, 0x0) (async)
recvmmsg(r1, &(0x7f00000037c0)=[{{&(0x7f00000004c0)=@ethernet={0x0, @random}, 0xfdf4, &(0x7f0000000380)=[{&(0x7f0000000140)=""/100, 0x365}, {&(0x7f0000000280)=""/85, 0x7c}, {&(0x7f0000000fc0)=""/4096, 0x197}, {&(0x7f0000000400)=""/106, 0x645}, {&(0x7f0000000980)=""/73, 0x1b}, {&(0x7f0000000200)=""/77, 0x334}, {&(0x7f00000007c0)=""/154, 0x8}, {&(0x7f00000001c0)=""/17, 0x1d8}], 0x21, &(0x7f0000000600)=""/191, 0x41}}], 0x4000000000003b4, 0x0, &(0x7f0000003700)={0x77359400}) (async)
syz_open_dev$video(&(0x7f0000000040), 0xa7, 0x0) (async)
syz_open_dev$vbi(&(0x7f0000000080), 0x2, 0x2) (async)
ioctl$VIDIOC_S_FMT(r2, 0xc0d05640, &(0x7f0000000340)={0x1, @pix={0x20000, 0x0, 0x0, 0x0, 0x0, 0x1, 0x3, 0xfeedcafe, 0x0, 0x0, 0x0, 0x7}}) (async)
prctl$PR_SET_IO_FLUSHER(0x41, 0x3) (async)
mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f04ebbee8, 0x10, 0xffffffffffffffff, 0x0) (async)
socket(0xa, 0x2, 0x0) (async)
bind$inet6(r3, &(0x7f0000000040)={0xa, 0x0, 0x0, @loopback={0xff00000000000000}}, 0x59) (async)

program crashed: kernel BUG in __page_table_check_zero
testing program (duration=2m30s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:namespace SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_open_dev$usbfs-mmap-sendmsg$nl_route_sched-socket-sendto-recvmmsg-syz_open_dev$video-syz_open_dev$vbi-ioctl$VIDIOC_S_FMT-prctl$PR_SET_IO_FLUSHER-mmap-socket-bind$inet6-getsockname$packet-syz_open_procfs-getdents64-ioctl$UFFDIO_COPY-mprotect-syz_open_dev$usbfs-mmap-sendmsg$nl_route_sched-socket-sendto-recvmmsg-syz_open_dev$video-syz_open_dev$vbi-ioctl$VIDIOC_S_FMT-prctl$PR_SET_IO_FLUSHER-mmap-socket
detailed listing:
executing program 0:
r0 = syz_open_dev$usbfs(&(0x7f00000000c0), 0x10, 0xa702)
mmap(&(0x7f0000527000/0x1000)=nil, 0x1000, 0x1000006, 0x11, r0, 0x0)
sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f00000007c0)={0x0, 0x0, &(0x7f0000000480)={&(0x7f0000002340)=@delchain={0x244, 0x65, 0x0, 0x0, 0x0, {}, [@TCA_CHAIN={0x8}, @filter_kind_options=@f_u32={{0x8}, {0x40, 0x2, [@TCA_U32_INDEV={0x14, 0x8, 'veth0_to_team\x00'}, @TCA_U32_CLASSID={0x8}, @TCA_U32_HASH={0x8}, @TCA_U32_MARK={0x10}, @TCA_U32_FLAGS={0x8}]}}, @TCA_CHAIN={0x8}, @TCA_RATE={0x6}, @filter_kind_options=@f_route={{0xa}, {0x1b4, 0x2, [@TCA_ROUTE4_FROM={0x8}, @TCA_ROUTE4_POLICE={0x4}, @TCA_ROUTE4_FROM={0x8}, @TCA_ROUTE4_ACT={0x19c, 0x6, [@m_ife={0x150, 0x0, 0x0, 0x0, {{0x8}, {0x34, 0x2, 0x0, 0x1, [@TCA_IFE_SMAC={0xa, 0x4, @dev}, @TCA_IFE_TYPE={0x6}, @TCA_IFE_PARMS={0x1c}]}, {0xf5, 0x6, "21b2caeba32a6f7c5900697624a17b85a9db3a31b129a4976a84cfb4f5d651fd8aa24a645c8f63c025fcca463a6b79a3d7e6c9a8b89a140805ef63939ac2e37b49004b0dc3b8446aa7038eceef52fe7bdca153fe865c65015a3b208b282c16472e451aa10a8631235c49cae271f5fc8ce5e34d9938e3d5f43ac7a0e31b0acfc73199ca90e81246819f4c740a4fa3247a2af88d6569da09be7179b89f9f024c9f465098a5a52058a431206bee68089bddc13ffe76ff0f000053fa1517700a54d423c13fb6732a5d39c87101b0882ccd8e86eb437849e249675c60d8a9cf9430b6aa206e8116810b35151fce1e1bf48c2b9c"}, {0xc}, {0xc}}}, @m_nat={0x48, 0x0, 0x0, 0x0, {{0x8}, {0x4}, {0x1d, 0x6, "ef93daeef78df7f9a037a0d7a2f92a1cc341deabba437fc636"}, {0xc}, {0xc}}}]}]}}]}, 0x244}}, 0x0)
r1 = socket(0x10, 0x803, 0x0)
sendto(r1, &(0x7f0000000740)="120000001200e7ef007b00000000000000a1", 0x12, 0x0, 0x0, 0x0)
recvmmsg(r1, &(0x7f00000037c0)=[{{&(0x7f00000004c0)=@ethernet={0x0, @random}, 0xfdf4, &(0x7f0000000380)=[{&(0x7f0000000140)=""/100, 0x365}, {&(0x7f0000000280)=""/85, 0x7c}, {&(0x7f0000000fc0)=""/4096, 0x197}, {&(0x7f0000000400)=""/106, 0x645}, {&(0x7f0000000980)=""/73, 0x1b}, {&(0x7f0000000200)=""/77, 0x334}, {&(0x7f00000007c0)=""/154, 0x8}, {&(0x7f00000001c0)=""/17, 0x1d8}], 0x21, &(0x7f0000000600)=""/191, 0x41}}], 0x4000000000003b4, 0x0, &(0x7f0000003700)={0x77359400})
syz_open_dev$video(&(0x7f0000000040), 0xa7, 0x0)
r2 = syz_open_dev$vbi(&(0x7f0000000080), 0x2, 0x2)
ioctl$VIDIOC_S_FMT(r2, 0xc0d05640, &(0x7f0000000340)={0x1, @pix={0x20000, 0x0, 0x0, 0x0, 0x0, 0x1, 0x3, 0xfeedcafe, 0x0, 0x0, 0x0, 0x7}})
prctl$PR_SET_IO_FLUSHER(0x41, 0x3)
mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f04ebbee8, 0x10, 0xffffffffffffffff, 0x0)
r3 = socket(0xa, 0x2, 0x0)
bind$inet6(r3, &(0x7f0000000040)={0xa, 0x0, 0x0, @loopback={0xff00000000000000}}, 0x59)
getsockname$packet(r3, 0x0, &(0x7f00000002c0))
r4 = syz_open_procfs(0x0, &(0x7f0000000040)='ns\x00')
getdents64(r4, 0x0, 0x500)
ioctl$UFFDIO_COPY(r4, 0xc028aa03, &(0x7f0000000000)={&(0x7f00002de000/0x1000)=nil, &(0x7f00004ed000/0x4000)=nil, 0x1000})
mprotect(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x6)
syz_open_dev$usbfs(&(0x7f00000000c0), 0x10, 0xa702) (async)
mmap(&(0x7f0000527000/0x1000)=nil, 0x1000, 0x1000006, 0x11, r0, 0x0) (async)
sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f00000007c0)={0x0, 0x0, &(0x7f0000000480)={&(0x7f0000002340)=@delchain={0x244, 0x65, 0x0, 0x0, 0x0, {}, [@TCA_CHAIN={0x8}, @filter_kind_options=@f_u32={{0x8}, {0x40, 0x2, [@TCA_U32_INDEV={0x14, 0x8, 'veth0_to_team\x00'}, @TCA_U32_CLASSID={0x8}, @TCA_U32_HASH={0x8}, @TCA_U32_MARK={0x10}, @TCA_U32_FLAGS={0x8}]}}, @TCA_CHAIN={0x8}, @TCA_RATE={0x6}, @filter_kind_options=@f_route={{0xa}, {0x1b4, 0x2, [@TCA_ROUTE4_FROM={0x8}, @TCA_ROUTE4_POLICE={0x4}, @TCA_ROUTE4_FROM={0x8}, @TCA_ROUTE4_ACT={0x19c, 0x6, [@m_ife={0x150, 0x0, 0x0, 0x0, {{0x8}, {0x34, 0x2, 0x0, 0x1, [@TCA_IFE_SMAC={0xa, 0x4, @dev}, @TCA_IFE_TYPE={0x6}, @TCA_IFE_PARMS={0x1c}]}, {0xf5, 0x6, "21b2caeba32a6f7c5900697624a17b85a9db3a31b129a4976a84cfb4f5d651fd8aa24a645c8f63c025fcca463a6b79a3d7e6c9a8b89a140805ef63939ac2e37b49004b0dc3b8446aa7038eceef52fe7bdca153fe865c65015a3b208b282c16472e451aa10a8631235c49cae271f5fc8ce5e34d9938e3d5f43ac7a0e31b0acfc73199ca90e81246819f4c740a4fa3247a2af88d6569da09be7179b89f9f024c9f465098a5a52058a431206bee68089bddc13ffe76ff0f000053fa1517700a54d423c13fb6732a5d39c87101b0882ccd8e86eb437849e249675c60d8a9cf9430b6aa206e8116810b35151fce1e1bf48c2b9c"}, {0xc}, {0xc}}}, @m_nat={0x48, 0x0, 0x0, 0x0, {{0x8}, {0x4}, {0x1d, 0x6, "ef93daeef78df7f9a037a0d7a2f92a1cc341deabba437fc636"}, {0xc}, {0xc}}}]}]}}]}, 0x244}}, 0x0) (async)
socket(0x10, 0x803, 0x0) (async)
sendto(r1, &(0x7f0000000740)="120000001200e7ef007b00000000000000a1", 0x12, 0x0, 0x0, 0x0) (async)
recvmmsg(r1, &(0x7f00000037c0)=[{{&(0x7f00000004c0)=@ethernet={0x0, @random}, 0xfdf4, &(0x7f0000000380)=[{&(0x7f0000000140)=""/100, 0x365}, {&(0x7f0000000280)=""/85, 0x7c}, {&(0x7f0000000fc0)=""/4096, 0x197}, {&(0x7f0000000400)=""/106, 0x645}, {&(0x7f0000000980)=""/73, 0x1b}, {&(0x7f0000000200)=""/77, 0x334}, {&(0x7f00000007c0)=""/154, 0x8}, {&(0x7f00000001c0)=""/17, 0x1d8}], 0x21, &(0x7f0000000600)=""/191, 0x41}}], 0x4000000000003b4, 0x0, &(0x7f0000003700)={0x77359400}) (async)
syz_open_dev$video(&(0x7f0000000040), 0xa7, 0x0) (async)
syz_open_dev$vbi(&(0x7f0000000080), 0x2, 0x2) (async)
ioctl$VIDIOC_S_FMT(r2, 0xc0d05640, &(0x7f0000000340)={0x1, @pix={0x20000, 0x0, 0x0, 0x0, 0x0, 0x1, 0x3, 0xfeedcafe, 0x0, 0x0, 0x0, 0x7}}) (async)
prctl$PR_SET_IO_FLUSHER(0x41, 0x3) (async)
mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f04ebbee8, 0x10, 0xffffffffffffffff, 0x0) (async)
socket(0xa, 0x2, 0x0) (async)

program crashed: kernel BUG in __page_table_check_zero
testing program (duration=2m30s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:namespace SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_open_dev$usbfs-mmap-sendmsg$nl_route_sched-socket-sendto-recvmmsg-syz_open_dev$video-syz_open_dev$vbi-ioctl$VIDIOC_S_FMT-prctl$PR_SET_IO_FLUSHER-mmap-socket-bind$inet6-getsockname$packet-syz_open_procfs-getdents64-ioctl$UFFDIO_COPY-mprotect-syz_open_dev$usbfs-mmap-sendmsg$nl_route_sched-socket-sendto-recvmmsg-syz_open_dev$video-syz_open_dev$vbi-ioctl$VIDIOC_S_FMT-prctl$PR_SET_IO_FLUSHER-mmap
detailed listing:
executing program 0:
r0 = syz_open_dev$usbfs(&(0x7f00000000c0), 0x10, 0xa702)
mmap(&(0x7f0000527000/0x1000)=nil, 0x1000, 0x1000006, 0x11, r0, 0x0)
sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f00000007c0)={0x0, 0x0, &(0x7f0000000480)={&(0x7f0000002340)=@delchain={0x244, 0x65, 0x0, 0x0, 0x0, {}, [@TCA_CHAIN={0x8}, @filter_kind_options=@f_u32={{0x8}, {0x40, 0x2, [@TCA_U32_INDEV={0x14, 0x8, 'veth0_to_team\x00'}, @TCA_U32_CLASSID={0x8}, @TCA_U32_HASH={0x8}, @TCA_U32_MARK={0x10}, @TCA_U32_FLAGS={0x8}]}}, @TCA_CHAIN={0x8}, @TCA_RATE={0x6}, @filter_kind_options=@f_route={{0xa}, {0x1b4, 0x2, [@TCA_ROUTE4_FROM={0x8}, @TCA_ROUTE4_POLICE={0x4}, @TCA_ROUTE4_FROM={0x8}, @TCA_ROUTE4_ACT={0x19c, 0x6, [@m_ife={0x150, 0x0, 0x0, 0x0, {{0x8}, {0x34, 0x2, 0x0, 0x1, [@TCA_IFE_SMAC={0xa, 0x4, @dev}, @TCA_IFE_TYPE={0x6}, @TCA_IFE_PARMS={0x1c}]}, {0xf5, 0x6, "21b2caeba32a6f7c5900697624a17b85a9db3a31b129a4976a84cfb4f5d651fd8aa24a645c8f63c025fcca463a6b79a3d7e6c9a8b89a140805ef63939ac2e37b49004b0dc3b8446aa7038eceef52fe7bdca153fe865c65015a3b208b282c16472e451aa10a8631235c49cae271f5fc8ce5e34d9938e3d5f43ac7a0e31b0acfc73199ca90e81246819f4c740a4fa3247a2af88d6569da09be7179b89f9f024c9f465098a5a52058a431206bee68089bddc13ffe76ff0f000053fa1517700a54d423c13fb6732a5d39c87101b0882ccd8e86eb437849e249675c60d8a9cf9430b6aa206e8116810b35151fce1e1bf48c2b9c"}, {0xc}, {0xc}}}, @m_nat={0x48, 0x0, 0x0, 0x0, {{0x8}, {0x4}, {0x1d, 0x6, "ef93daeef78df7f9a037a0d7a2f92a1cc341deabba437fc636"}, {0xc}, {0xc}}}]}]}}]}, 0x244}}, 0x0)
r1 = socket(0x10, 0x803, 0x0)
sendto(r1, &(0x7f0000000740)="120000001200e7ef007b00000000000000a1", 0x12, 0x0, 0x0, 0x0)
recvmmsg(r1, &(0x7f00000037c0)=[{{&(0x7f00000004c0)=@ethernet={0x0, @random}, 0xfdf4, &(0x7f0000000380)=[{&(0x7f0000000140)=""/100, 0x365}, {&(0x7f0000000280)=""/85, 0x7c}, {&(0x7f0000000fc0)=""/4096, 0x197}, {&(0x7f0000000400)=""/106, 0x645}, {&(0x7f0000000980)=""/73, 0x1b}, {&(0x7f0000000200)=""/77, 0x334}, {&(0x7f00000007c0)=""/154, 0x8}, {&(0x7f00000001c0)=""/17, 0x1d8}], 0x21, &(0x7f0000000600)=""/191, 0x41}}], 0x4000000000003b4, 0x0, &(0x7f0000003700)={0x77359400})
syz_open_dev$video(&(0x7f0000000040), 0xa7, 0x0)
r2 = syz_open_dev$vbi(&(0x7f0000000080), 0x2, 0x2)
ioctl$VIDIOC_S_FMT(r2, 0xc0d05640, &(0x7f0000000340)={0x1, @pix={0x20000, 0x0, 0x0, 0x0, 0x0, 0x1, 0x3, 0xfeedcafe, 0x0, 0x0, 0x0, 0x7}})
prctl$PR_SET_IO_FLUSHER(0x41, 0x3)
mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f04ebbee8, 0x10, 0xffffffffffffffff, 0x0)
r3 = socket(0xa, 0x2, 0x0)
bind$inet6(r3, &(0x7f0000000040)={0xa, 0x0, 0x0, @loopback={0xff00000000000000}}, 0x59)
getsockname$packet(r3, 0x0, &(0x7f00000002c0))
r4 = syz_open_procfs(0x0, &(0x7f0000000040)='ns\x00')
getdents64(r4, 0x0, 0x500)
ioctl$UFFDIO_COPY(r4, 0xc028aa03, &(0x7f0000000000)={&(0x7f00002de000/0x1000)=nil, &(0x7f00004ed000/0x4000)=nil, 0x1000})
mprotect(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x6)
syz_open_dev$usbfs(&(0x7f00000000c0), 0x10, 0xa702) (async)
mmap(&(0x7f0000527000/0x1000)=nil, 0x1000, 0x1000006, 0x11, r0, 0x0) (async)
sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f00000007c0)={0x0, 0x0, &(0x7f0000000480)={&(0x7f0000002340)=@delchain={0x244, 0x65, 0x0, 0x0, 0x0, {}, [@TCA_CHAIN={0x8}, @filter_kind_options=@f_u32={{0x8}, {0x40, 0x2, [@TCA_U32_INDEV={0x14, 0x8, 'veth0_to_team\x00'}, @TCA_U32_CLASSID={0x8}, @TCA_U32_HASH={0x8}, @TCA_U32_MARK={0x10}, @TCA_U32_FLAGS={0x8}]}}, @TCA_CHAIN={0x8}, @TCA_RATE={0x6}, @filter_kind_options=@f_route={{0xa}, {0x1b4, 0x2, [@TCA_ROUTE4_FROM={0x8}, @TCA_ROUTE4_POLICE={0x4}, @TCA_ROUTE4_FROM={0x8}, @TCA_ROUTE4_ACT={0x19c, 0x6, [@m_ife={0x150, 0x0, 0x0, 0x0, {{0x8}, {0x34, 0x2, 0x0, 0x1, [@TCA_IFE_SMAC={0xa, 0x4, @dev}, @TCA_IFE_TYPE={0x6}, @TCA_IFE_PARMS={0x1c}]}, {0xf5, 0x6, "21b2caeba32a6f7c5900697624a17b85a9db3a31b129a4976a84cfb4f5d651fd8aa24a645c8f63c025fcca463a6b79a3d7e6c9a8b89a140805ef63939ac2e37b49004b0dc3b8446aa7038eceef52fe7bdca153fe865c65015a3b208b282c16472e451aa10a8631235c49cae271f5fc8ce5e34d9938e3d5f43ac7a0e31b0acfc73199ca90e81246819f4c740a4fa3247a2af88d6569da09be7179b89f9f024c9f465098a5a52058a431206bee68089bddc13ffe76ff0f000053fa1517700a54d423c13fb6732a5d39c87101b0882ccd8e86eb437849e249675c60d8a9cf9430b6aa206e8116810b35151fce1e1bf48c2b9c"}, {0xc}, {0xc}}}, @m_nat={0x48, 0x0, 0x0, 0x0, {{0x8}, {0x4}, {0x1d, 0x6, "ef93daeef78df7f9a037a0d7a2f92a1cc341deabba437fc636"}, {0xc}, {0xc}}}]}]}}]}, 0x244}}, 0x0) (async)
socket(0x10, 0x803, 0x0) (async)
sendto(r1, &(0x7f0000000740)="120000001200e7ef007b00000000000000a1", 0x12, 0x0, 0x0, 0x0) (async)
recvmmsg(r1, &(0x7f00000037c0)=[{{&(0x7f00000004c0)=@ethernet={0x0, @random}, 0xfdf4, &(0x7f0000000380)=[{&(0x7f0000000140)=""/100, 0x365}, {&(0x7f0000000280)=""/85, 0x7c}, {&(0x7f0000000fc0)=""/4096, 0x197}, {&(0x7f0000000400)=""/106, 0x645}, {&(0x7f0000000980)=""/73, 0x1b}, {&(0x7f0000000200)=""/77, 0x334}, {&(0x7f00000007c0)=""/154, 0x8}, {&(0x7f00000001c0)=""/17, 0x1d8}], 0x21, &(0x7f0000000600)=""/191, 0x41}}], 0x4000000000003b4, 0x0, &(0x7f0000003700)={0x77359400}) (async)
syz_open_dev$video(&(0x7f0000000040), 0xa7, 0x0) (async)
syz_open_dev$vbi(&(0x7f0000000080), 0x2, 0x2) (async)
ioctl$VIDIOC_S_FMT(r2, 0xc0d05640, &(0x7f0000000340)={0x1, @pix={0x20000, 0x0, 0x0, 0x0, 0x0, 0x1, 0x3, 0xfeedcafe, 0x0, 0x0, 0x0, 0x7}}) (async)
prctl$PR_SET_IO_FLUSHER(0x41, 0x3) (async)
mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f04ebbee8, 0x10, 0xffffffffffffffff, 0x0) (async)

program crashed: kernel BUG in __page_table_check_zero
testing program (duration=2m30s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:namespace SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_open_dev$usbfs-mmap-sendmsg$nl_route_sched-socket-sendto-recvmmsg-syz_open_dev$video-syz_open_dev$vbi-ioctl$VIDIOC_S_FMT-prctl$PR_SET_IO_FLUSHER-mmap-socket-bind$inet6-getsockname$packet-syz_open_procfs-getdents64-ioctl$UFFDIO_COPY-mprotect-syz_open_dev$usbfs-mmap-sendmsg$nl_route_sched-socket-sendto-recvmmsg-syz_open_dev$video-syz_open_dev$vbi-ioctl$VIDIOC_S_FMT-prctl$PR_SET_IO_FLUSHER
detailed listing:
executing program 0:
r0 = syz_open_dev$usbfs(&(0x7f00000000c0), 0x10, 0xa702)
mmap(&(0x7f0000527000/0x1000)=nil, 0x1000, 0x1000006, 0x11, r0, 0x0)
sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f00000007c0)={0x0, 0x0, &(0x7f0000000480)={&(0x7f0000002340)=@delchain={0x244, 0x65, 0x0, 0x0, 0x0, {}, [@TCA_CHAIN={0x8}, @filter_kind_options=@f_u32={{0x8}, {0x40, 0x2, [@TCA_U32_INDEV={0x14, 0x8, 'veth0_to_team\x00'}, @TCA_U32_CLASSID={0x8}, @TCA_U32_HASH={0x8}, @TCA_U32_MARK={0x10}, @TCA_U32_FLAGS={0x8}]}}, @TCA_CHAIN={0x8}, @TCA_RATE={0x6}, @filter_kind_options=@f_route={{0xa}, {0x1b4, 0x2, [@TCA_ROUTE4_FROM={0x8}, @TCA_ROUTE4_POLICE={0x4}, @TCA_ROUTE4_FROM={0x8}, @TCA_ROUTE4_ACT={0x19c, 0x6, [@m_ife={0x150, 0x0, 0x0, 0x0, {{0x8}, {0x34, 0x2, 0x0, 0x1, [@TCA_IFE_SMAC={0xa, 0x4, @dev}, @TCA_IFE_TYPE={0x6}, @TCA_IFE_PARMS={0x1c}]}, {0xf5, 0x6, "21b2caeba32a6f7c5900697624a17b85a9db3a31b129a4976a84cfb4f5d651fd8aa24a645c8f63c025fcca463a6b79a3d7e6c9a8b89a140805ef63939ac2e37b49004b0dc3b8446aa7038eceef52fe7bdca153fe865c65015a3b208b282c16472e451aa10a8631235c49cae271f5fc8ce5e34d9938e3d5f43ac7a0e31b0acfc73199ca90e81246819f4c740a4fa3247a2af88d6569da09be7179b89f9f024c9f465098a5a52058a431206bee68089bddc13ffe76ff0f000053fa1517700a54d423c13fb6732a5d39c87101b0882ccd8e86eb437849e249675c60d8a9cf9430b6aa206e8116810b35151fce1e1bf48c2b9c"}, {0xc}, {0xc}}}, @m_nat={0x48, 0x0, 0x0, 0x0, {{0x8}, {0x4}, {0x1d, 0x6, "ef93daeef78df7f9a037a0d7a2f92a1cc341deabba437fc636"}, {0xc}, {0xc}}}]}]}}]}, 0x244}}, 0x0)
r1 = socket(0x10, 0x803, 0x0)
sendto(r1, &(0x7f0000000740)="120000001200e7ef007b00000000000000a1", 0x12, 0x0, 0x0, 0x0)
recvmmsg(r1, &(0x7f00000037c0)=[{{&(0x7f00000004c0)=@ethernet={0x0, @random}, 0xfdf4, &(0x7f0000000380)=[{&(0x7f0000000140)=""/100, 0x365}, {&(0x7f0000000280)=""/85, 0x7c}, {&(0x7f0000000fc0)=""/4096, 0x197}, {&(0x7f0000000400)=""/106, 0x645}, {&(0x7f0000000980)=""/73, 0x1b}, {&(0x7f0000000200)=""/77, 0x334}, {&(0x7f00000007c0)=""/154, 0x8}, {&(0x7f00000001c0)=""/17, 0x1d8}], 0x21, &(0x7f0000000600)=""/191, 0x41}}], 0x4000000000003b4, 0x0, &(0x7f0000003700)={0x77359400})
syz_open_dev$video(&(0x7f0000000040), 0xa7, 0x0)
r2 = syz_open_dev$vbi(&(0x7f0000000080), 0x2, 0x2)
ioctl$VIDIOC_S_FMT(r2, 0xc0d05640, &(0x7f0000000340)={0x1, @pix={0x20000, 0x0, 0x0, 0x0, 0x0, 0x1, 0x3, 0xfeedcafe, 0x0, 0x0, 0x0, 0x7}})
prctl$PR_SET_IO_FLUSHER(0x41, 0x3)
mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f04ebbee8, 0x10, 0xffffffffffffffff, 0x0)
r3 = socket(0xa, 0x2, 0x0)
bind$inet6(r3, &(0x7f0000000040)={0xa, 0x0, 0x0, @loopback={0xff00000000000000}}, 0x59)
getsockname$packet(r3, 0x0, &(0x7f00000002c0))
r4 = syz_open_procfs(0x0, &(0x7f0000000040)='ns\x00')
getdents64(r4, 0x0, 0x500)
ioctl$UFFDIO_COPY(r4, 0xc028aa03, &(0x7f0000000000)={&(0x7f00002de000/0x1000)=nil, &(0x7f00004ed000/0x4000)=nil, 0x1000})
mprotect(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x6)
syz_open_dev$usbfs(&(0x7f00000000c0), 0x10, 0xa702) (async)
mmap(&(0x7f0000527000/0x1000)=nil, 0x1000, 0x1000006, 0x11, r0, 0x0) (async)
sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f00000007c0)={0x0, 0x0, &(0x7f0000000480)={&(0x7f0000002340)=@delchain={0x244, 0x65, 0x0, 0x0, 0x0, {}, [@TCA_CHAIN={0x8}, @filter_kind_options=@f_u32={{0x8}, {0x40, 0x2, [@TCA_U32_INDEV={0x14, 0x8, 'veth0_to_team\x00'}, @TCA_U32_CLASSID={0x8}, @TCA_U32_HASH={0x8}, @TCA_U32_MARK={0x10}, @TCA_U32_FLAGS={0x8}]}}, @TCA_CHAIN={0x8}, @TCA_RATE={0x6}, @filter_kind_options=@f_route={{0xa}, {0x1b4, 0x2, [@TCA_ROUTE4_FROM={0x8}, @TCA_ROUTE4_POLICE={0x4}, @TCA_ROUTE4_FROM={0x8}, @TCA_ROUTE4_ACT={0x19c, 0x6, [@m_ife={0x150, 0x0, 0x0, 0x0, {{0x8}, {0x34, 0x2, 0x0, 0x1, [@TCA_IFE_SMAC={0xa, 0x4, @dev}, @TCA_IFE_TYPE={0x6}, @TCA_IFE_PARMS={0x1c}]}, {0xf5, 0x6, "21b2caeba32a6f7c5900697624a17b85a9db3a31b129a4976a84cfb4f5d651fd8aa24a645c8f63c025fcca463a6b79a3d7e6c9a8b89a140805ef63939ac2e37b49004b0dc3b8446aa7038eceef52fe7bdca153fe865c65015a3b208b282c16472e451aa10a8631235c49cae271f5fc8ce5e34d9938e3d5f43ac7a0e31b0acfc73199ca90e81246819f4c740a4fa3247a2af88d6569da09be7179b89f9f024c9f465098a5a52058a431206bee68089bddc13ffe76ff0f000053fa1517700a54d423c13fb6732a5d39c87101b0882ccd8e86eb437849e249675c60d8a9cf9430b6aa206e8116810b35151fce1e1bf48c2b9c"}, {0xc}, {0xc}}}, @m_nat={0x48, 0x0, 0x0, 0x0, {{0x8}, {0x4}, {0x1d, 0x6, "ef93daeef78df7f9a037a0d7a2f92a1cc341deabba437fc636"}, {0xc}, {0xc}}}]}]}}]}, 0x244}}, 0x0) (async)
socket(0x10, 0x803, 0x0) (async)
sendto(r1, &(0x7f0000000740)="120000001200e7ef007b00000000000000a1", 0x12, 0x0, 0x0, 0x0) (async)
recvmmsg(r1, &(0x7f00000037c0)=[{{&(0x7f00000004c0)=@ethernet={0x0, @random}, 0xfdf4, &(0x7f0000000380)=[{&(0x7f0000000140)=""/100, 0x365}, {&(0x7f0000000280)=""/85, 0x7c}, {&(0x7f0000000fc0)=""/4096, 0x197}, {&(0x7f0000000400)=""/106, 0x645}, {&(0x7f0000000980)=""/73, 0x1b}, {&(0x7f0000000200)=""/77, 0x334}, {&(0x7f00000007c0)=""/154, 0x8}, {&(0x7f00000001c0)=""/17, 0x1d8}], 0x21, &(0x7f0000000600)=""/191, 0x41}}], 0x4000000000003b4, 0x0, &(0x7f0000003700)={0x77359400}) (async)
syz_open_dev$video(&(0x7f0000000040), 0xa7, 0x0) (async)
syz_open_dev$vbi(&(0x7f0000000080), 0x2, 0x2) (async)
ioctl$VIDIOC_S_FMT(r2, 0xc0d05640, &(0x7f0000000340)={0x1, @pix={0x20000, 0x0, 0x0, 0x0, 0x0, 0x1, 0x3, 0xfeedcafe, 0x0, 0x0, 0x0, 0x7}}) (async)
prctl$PR_SET_IO_FLUSHER(0x41, 0x3) (async)

program crashed: kernel BUG in __page_table_check_zero
testing program (duration=2m30s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:namespace SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_open_dev$usbfs-mmap-sendmsg$nl_route_sched-socket-sendto-recvmmsg-syz_open_dev$video-syz_open_dev$vbi-ioctl$VIDIOC_S_FMT-prctl$PR_SET_IO_FLUSHER-mmap-socket-bind$inet6-getsockname$packet-syz_open_procfs-getdents64-ioctl$UFFDIO_COPY-mprotect-syz_open_dev$usbfs-mmap-sendmsg$nl_route_sched-socket-sendto-recvmmsg-syz_open_dev$video-syz_open_dev$vbi-ioctl$VIDIOC_S_FMT
detailed listing:
executing program 0:
r0 = syz_open_dev$usbfs(&(0x7f00000000c0), 0x10, 0xa702)
mmap(&(0x7f0000527000/0x1000)=nil, 0x1000, 0x1000006, 0x11, r0, 0x0)
sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f00000007c0)={0x0, 0x0, &(0x7f0000000480)={&(0x7f0000002340)=@delchain={0x244, 0x65, 0x0, 0x0, 0x0, {}, [@TCA_CHAIN={0x8}, @filter_kind_options=@f_u32={{0x8}, {0x40, 0x2, [@TCA_U32_INDEV={0x14, 0x8, 'veth0_to_team\x00'}, @TCA_U32_CLASSID={0x8}, @TCA_U32_HASH={0x8}, @TCA_U32_MARK={0x10}, @TCA_U32_FLAGS={0x8}]}}, @TCA_CHAIN={0x8}, @TCA_RATE={0x6}, @filter_kind_options=@f_route={{0xa}, {0x1b4, 0x2, [@TCA_ROUTE4_FROM={0x8}, @TCA_ROUTE4_POLICE={0x4}, @TCA_ROUTE4_FROM={0x8}, @TCA_ROUTE4_ACT={0x19c, 0x6, [@m_ife={0x150, 0x0, 0x0, 0x0, {{0x8}, {0x34, 0x2, 0x0, 0x1, [@TCA_IFE_SMAC={0xa, 0x4, @dev}, @TCA_IFE_TYPE={0x6}, @TCA_IFE_PARMS={0x1c}]}, {0xf5, 0x6, "21b2caeba32a6f7c5900697624a17b85a9db3a31b129a4976a84cfb4f5d651fd8aa24a645c8f63c025fcca463a6b79a3d7e6c9a8b89a140805ef63939ac2e37b49004b0dc3b8446aa7038eceef52fe7bdca153fe865c65015a3b208b282c16472e451aa10a8631235c49cae271f5fc8ce5e34d9938e3d5f43ac7a0e31b0acfc73199ca90e81246819f4c740a4fa3247a2af88d6569da09be7179b89f9f024c9f465098a5a52058a431206bee68089bddc13ffe76ff0f000053fa1517700a54d423c13fb6732a5d39c87101b0882ccd8e86eb437849e249675c60d8a9cf9430b6aa206e8116810b35151fce1e1bf48c2b9c"}, {0xc}, {0xc}}}, @m_nat={0x48, 0x0, 0x0, 0x0, {{0x8}, {0x4}, {0x1d, 0x6, "ef93daeef78df7f9a037a0d7a2f92a1cc341deabba437fc636"}, {0xc}, {0xc}}}]}]}}]}, 0x244}}, 0x0)
r1 = socket(0x10, 0x803, 0x0)
sendto(r1, &(0x7f0000000740)="120000001200e7ef007b00000000000000a1", 0x12, 0x0, 0x0, 0x0)
recvmmsg(r1, &(0x7f00000037c0)=[{{&(0x7f00000004c0)=@ethernet={0x0, @random}, 0xfdf4, &(0x7f0000000380)=[{&(0x7f0000000140)=""/100, 0x365}, {&(0x7f0000000280)=""/85, 0x7c}, {&(0x7f0000000fc0)=""/4096, 0x197}, {&(0x7f0000000400)=""/106, 0x645}, {&(0x7f0000000980)=""/73, 0x1b}, {&(0x7f0000000200)=""/77, 0x334}, {&(0x7f00000007c0)=""/154, 0x8}, {&(0x7f00000001c0)=""/17, 0x1d8}], 0x21, &(0x7f0000000600)=""/191, 0x41}}], 0x4000000000003b4, 0x0, &(0x7f0000003700)={0x77359400})
syz_open_dev$video(&(0x7f0000000040), 0xa7, 0x0)
r2 = syz_open_dev$vbi(&(0x7f0000000080), 0x2, 0x2)
ioctl$VIDIOC_S_FMT(r2, 0xc0d05640, &(0x7f0000000340)={0x1, @pix={0x20000, 0x0, 0x0, 0x0, 0x0, 0x1, 0x3, 0xfeedcafe, 0x0, 0x0, 0x0, 0x7}})
prctl$PR_SET_IO_FLUSHER(0x41, 0x3)
mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f04ebbee8, 0x10, 0xffffffffffffffff, 0x0)
r3 = socket(0xa, 0x2, 0x0)
bind$inet6(r3, &(0x7f0000000040)={0xa, 0x0, 0x0, @loopback={0xff00000000000000}}, 0x59)
getsockname$packet(r3, 0x0, &(0x7f00000002c0))
r4 = syz_open_procfs(0x0, &(0x7f0000000040)='ns\x00')
getdents64(r4, 0x0, 0x500)
ioctl$UFFDIO_COPY(r4, 0xc028aa03, &(0x7f0000000000)={&(0x7f00002de000/0x1000)=nil, &(0x7f00004ed000/0x4000)=nil, 0x1000})
mprotect(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x6)
syz_open_dev$usbfs(&(0x7f00000000c0), 0x10, 0xa702) (async)
mmap(&(0x7f0000527000/0x1000)=nil, 0x1000, 0x1000006, 0x11, r0, 0x0) (async)
sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f00000007c0)={0x0, 0x0, &(0x7f0000000480)={&(0x7f0000002340)=@delchain={0x244, 0x65, 0x0, 0x0, 0x0, {}, [@TCA_CHAIN={0x8}, @filter_kind_options=@f_u32={{0x8}, {0x40, 0x2, [@TCA_U32_INDEV={0x14, 0x8, 'veth0_to_team\x00'}, @TCA_U32_CLASSID={0x8}, @TCA_U32_HASH={0x8}, @TCA_U32_MARK={0x10}, @TCA_U32_FLAGS={0x8}]}}, @TCA_CHAIN={0x8}, @TCA_RATE={0x6}, @filter_kind_options=@f_route={{0xa}, {0x1b4, 0x2, [@TCA_ROUTE4_FROM={0x8}, @TCA_ROUTE4_POLICE={0x4}, @TCA_ROUTE4_FROM={0x8}, @TCA_ROUTE4_ACT={0x19c, 0x6, [@m_ife={0x150, 0x0, 0x0, 0x0, {{0x8}, {0x34, 0x2, 0x0, 0x1, [@TCA_IFE_SMAC={0xa, 0x4, @dev}, @TCA_IFE_TYPE={0x6}, @TCA_IFE_PARMS={0x1c}]}, {0xf5, 0x6, "21b2caeba32a6f7c5900697624a17b85a9db3a31b129a4976a84cfb4f5d651fd8aa24a645c8f63c025fcca463a6b79a3d7e6c9a8b89a140805ef63939ac2e37b49004b0dc3b8446aa7038eceef52fe7bdca153fe865c65015a3b208b282c16472e451aa10a8631235c49cae271f5fc8ce5e34d9938e3d5f43ac7a0e31b0acfc73199ca90e81246819f4c740a4fa3247a2af88d6569da09be7179b89f9f024c9f465098a5a52058a431206bee68089bddc13ffe76ff0f000053fa1517700a54d423c13fb6732a5d39c87101b0882ccd8e86eb437849e249675c60d8a9cf9430b6aa206e8116810b35151fce1e1bf48c2b9c"}, {0xc}, {0xc}}}, @m_nat={0x48, 0x0, 0x0, 0x0, {{0x8}, {0x4}, {0x1d, 0x6, "ef93daeef78df7f9a037a0d7a2f92a1cc341deabba437fc636"}, {0xc}, {0xc}}}]}]}}]}, 0x244}}, 0x0) (async)
socket(0x10, 0x803, 0x0) (async)
sendto(r1, &(0x7f0000000740)="120000001200e7ef007b00000000000000a1", 0x12, 0x0, 0x0, 0x0) (async)
recvmmsg(r1, &(0x7f00000037c0)=[{{&(0x7f00000004c0)=@ethernet={0x0, @random}, 0xfdf4, &(0x7f0000000380)=[{&(0x7f0000000140)=""/100, 0x365}, {&(0x7f0000000280)=""/85, 0x7c}, {&(0x7f0000000fc0)=""/4096, 0x197}, {&(0x7f0000000400)=""/106, 0x645}, {&(0x7f0000000980)=""/73, 0x1b}, {&(0x7f0000000200)=""/77, 0x334}, {&(0x7f00000007c0)=""/154, 0x8}, {&(0x7f00000001c0)=""/17, 0x1d8}], 0x21, &(0x7f0000000600)=""/191, 0x41}}], 0x4000000000003b4, 0x0, &(0x7f0000003700)={0x77359400}) (async)
syz_open_dev$video(&(0x7f0000000040), 0xa7, 0x0) (async)
syz_open_dev$vbi(&(0x7f0000000080), 0x2, 0x2) (async)
ioctl$VIDIOC_S_FMT(r2, 0xc0d05640, &(0x7f0000000340)={0x1, @pix={0x20000, 0x0, 0x0, 0x0, 0x0, 0x1, 0x3, 0xfeedcafe, 0x0, 0x0, 0x0, 0x7}}) (async)

program crashed: kernel BUG in __page_table_check_zero
testing program (duration=2m30s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:namespace SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_open_dev$usbfs-mmap-sendmsg$nl_route_sched-socket-sendto-recvmmsg-syz_open_dev$video-syz_open_dev$vbi-ioctl$VIDIOC_S_FMT-prctl$PR_SET_IO_FLUSHER-mmap-socket-bind$inet6-getsockname$packet-syz_open_procfs-getdents64-ioctl$UFFDIO_COPY-mprotect-syz_open_dev$usbfs-mmap-sendmsg$nl_route_sched-socket-sendto-recvmmsg-syz_open_dev$video-syz_open_dev$vbi
detailed listing:
executing program 0:
r0 = syz_open_dev$usbfs(&(0x7f00000000c0), 0x10, 0xa702)
mmap(&(0x7f0000527000/0x1000)=nil, 0x1000, 0x1000006, 0x11, r0, 0x0)
sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f00000007c0)={0x0, 0x0, &(0x7f0000000480)={&(0x7f0000002340)=@delchain={0x244, 0x65, 0x0, 0x0, 0x0, {}, [@TCA_CHAIN={0x8}, @filter_kind_options=@f_u32={{0x8}, {0x40, 0x2, [@TCA_U32_INDEV={0x14, 0x8, 'veth0_to_team\x00'}, @TCA_U32_CLASSID={0x8}, @TCA_U32_HASH={0x8}, @TCA_U32_MARK={0x10}, @TCA_U32_FLAGS={0x8}]}}, @TCA_CHAIN={0x8}, @TCA_RATE={0x6}, @filter_kind_options=@f_route={{0xa}, {0x1b4, 0x2, [@TCA_ROUTE4_FROM={0x8}, @TCA_ROUTE4_POLICE={0x4}, @TCA_ROUTE4_FROM={0x8}, @TCA_ROUTE4_ACT={0x19c, 0x6, [@m_ife={0x150, 0x0, 0x0, 0x0, {{0x8}, {0x34, 0x2, 0x0, 0x1, [@TCA_IFE_SMAC={0xa, 0x4, @dev}, @TCA_IFE_TYPE={0x6}, @TCA_IFE_PARMS={0x1c}]}, {0xf5, 0x6, "21b2caeba32a6f7c5900697624a17b85a9db3a31b129a4976a84cfb4f5d651fd8aa24a645c8f63c025fcca463a6b79a3d7e6c9a8b89a140805ef63939ac2e37b49004b0dc3b8446aa7038eceef52fe7bdca153fe865c65015a3b208b282c16472e451aa10a8631235c49cae271f5fc8ce5e34d9938e3d5f43ac7a0e31b0acfc73199ca90e81246819f4c740a4fa3247a2af88d6569da09be7179b89f9f024c9f465098a5a52058a431206bee68089bddc13ffe76ff0f000053fa1517700a54d423c13fb6732a5d39c87101b0882ccd8e86eb437849e249675c60d8a9cf9430b6aa206e8116810b35151fce1e1bf48c2b9c"}, {0xc}, {0xc}}}, @m_nat={0x48, 0x0, 0x0, 0x0, {{0x8}, {0x4}, {0x1d, 0x6, "ef93daeef78df7f9a037a0d7a2f92a1cc341deabba437fc636"}, {0xc}, {0xc}}}]}]}}]}, 0x244}}, 0x0)
r1 = socket(0x10, 0x803, 0x0)
sendto(r1, &(0x7f0000000740)="120000001200e7ef007b00000000000000a1", 0x12, 0x0, 0x0, 0x0)
recvmmsg(r1, &(0x7f00000037c0)=[{{&(0x7f00000004c0)=@ethernet={0x0, @random}, 0xfdf4, &(0x7f0000000380)=[{&(0x7f0000000140)=""/100, 0x365}, {&(0x7f0000000280)=""/85, 0x7c}, {&(0x7f0000000fc0)=""/4096, 0x197}, {&(0x7f0000000400)=""/106, 0x645}, {&(0x7f0000000980)=""/73, 0x1b}, {&(0x7f0000000200)=""/77, 0x334}, {&(0x7f00000007c0)=""/154, 0x8}, {&(0x7f00000001c0)=""/17, 0x1d8}], 0x21, &(0x7f0000000600)=""/191, 0x41}}], 0x4000000000003b4, 0x0, &(0x7f0000003700)={0x77359400})
syz_open_dev$video(&(0x7f0000000040), 0xa7, 0x0)
r2 = syz_open_dev$vbi(&(0x7f0000000080), 0x2, 0x2)
ioctl$VIDIOC_S_FMT(r2, 0xc0d05640, &(0x7f0000000340)={0x1, @pix={0x20000, 0x0, 0x0, 0x0, 0x0, 0x1, 0x3, 0xfeedcafe, 0x0, 0x0, 0x0, 0x7}})
prctl$PR_SET_IO_FLUSHER(0x41, 0x3)
mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f04ebbee8, 0x10, 0xffffffffffffffff, 0x0)
r3 = socket(0xa, 0x2, 0x0)
bind$inet6(r3, &(0x7f0000000040)={0xa, 0x0, 0x0, @loopback={0xff00000000000000}}, 0x59)
getsockname$packet(r3, 0x0, &(0x7f00000002c0))
r4 = syz_open_procfs(0x0, &(0x7f0000000040)='ns\x00')
getdents64(r4, 0x0, 0x500)
ioctl$UFFDIO_COPY(r4, 0xc028aa03, &(0x7f0000000000)={&(0x7f00002de000/0x1000)=nil, &(0x7f00004ed000/0x4000)=nil, 0x1000})
mprotect(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x6)
syz_open_dev$usbfs(&(0x7f00000000c0), 0x10, 0xa702) (async)
mmap(&(0x7f0000527000/0x1000)=nil, 0x1000, 0x1000006, 0x11, r0, 0x0) (async)
sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f00000007c0)={0x0, 0x0, &(0x7f0000000480)={&(0x7f0000002340)=@delchain={0x244, 0x65, 0x0, 0x0, 0x0, {}, [@TCA_CHAIN={0x8}, @filter_kind_options=@f_u32={{0x8}, {0x40, 0x2, [@TCA_U32_INDEV={0x14, 0x8, 'veth0_to_team\x00'}, @TCA_U32_CLASSID={0x8}, @TCA_U32_HASH={0x8}, @TCA_U32_MARK={0x10}, @TCA_U32_FLAGS={0x8}]}}, @TCA_CHAIN={0x8}, @TCA_RATE={0x6}, @filter_kind_options=@f_route={{0xa}, {0x1b4, 0x2, [@TCA_ROUTE4_FROM={0x8}, @TCA_ROUTE4_POLICE={0x4}, @TCA_ROUTE4_FROM={0x8}, @TCA_ROUTE4_ACT={0x19c, 0x6, [@m_ife={0x150, 0x0, 0x0, 0x0, {{0x8}, {0x34, 0x2, 0x0, 0x1, [@TCA_IFE_SMAC={0xa, 0x4, @dev}, @TCA_IFE_TYPE={0x6}, @TCA_IFE_PARMS={0x1c}]}, {0xf5, 0x6, "21b2caeba32a6f7c5900697624a17b85a9db3a31b129a4976a84cfb4f5d651fd8aa24a645c8f63c025fcca463a6b79a3d7e6c9a8b89a140805ef63939ac2e37b49004b0dc3b8446aa7038eceef52fe7bdca153fe865c65015a3b208b282c16472e451aa10a8631235c49cae271f5fc8ce5e34d9938e3d5f43ac7a0e31b0acfc73199ca90e81246819f4c740a4fa3247a2af88d6569da09be7179b89f9f024c9f465098a5a52058a431206bee68089bddc13ffe76ff0f000053fa1517700a54d423c13fb6732a5d39c87101b0882ccd8e86eb437849e249675c60d8a9cf9430b6aa206e8116810b35151fce1e1bf48c2b9c"}, {0xc}, {0xc}}}, @m_nat={0x48, 0x0, 0x0, 0x0, {{0x8}, {0x4}, {0x1d, 0x6, "ef93daeef78df7f9a037a0d7a2f92a1cc341deabba437fc636"}, {0xc}, {0xc}}}]}]}}]}, 0x244}}, 0x0) (async)
socket(0x10, 0x803, 0x0) (async)
sendto(r1, &(0x7f0000000740)="120000001200e7ef007b00000000000000a1", 0x12, 0x0, 0x0, 0x0) (async)
recvmmsg(r1, &(0x7f00000037c0)=[{{&(0x7f00000004c0)=@ethernet={0x0, @random}, 0xfdf4, &(0x7f0000000380)=[{&(0x7f0000000140)=""/100, 0x365}, {&(0x7f0000000280)=""/85, 0x7c}, {&(0x7f0000000fc0)=""/4096, 0x197}, {&(0x7f0000000400)=""/106, 0x645}, {&(0x7f0000000980)=""/73, 0x1b}, {&(0x7f0000000200)=""/77, 0x334}, {&(0x7f00000007c0)=""/154, 0x8}, {&(0x7f00000001c0)=""/17, 0x1d8}], 0x21, &(0x7f0000000600)=""/191, 0x41}}], 0x4000000000003b4, 0x0, &(0x7f0000003700)={0x77359400}) (async)
syz_open_dev$video(&(0x7f0000000040), 0xa7, 0x0) (async)
syz_open_dev$vbi(&(0x7f0000000080), 0x2, 0x2) (async)

program crashed: kernel BUG in __page_table_check_zero
testing program (duration=2m30s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:namespace SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_open_dev$usbfs-mmap-sendmsg$nl_route_sched-socket-sendto-recvmmsg-syz_open_dev$video-syz_open_dev$vbi-ioctl$VIDIOC_S_FMT-prctl$PR_SET_IO_FLUSHER-mmap-socket-bind$inet6-getsockname$packet-syz_open_procfs-getdents64-ioctl$UFFDIO_COPY-mprotect-syz_open_dev$usbfs-mmap-sendmsg$nl_route_sched-socket-sendto-recvmmsg-syz_open_dev$video
detailed listing:
executing program 0:
r0 = syz_open_dev$usbfs(&(0x7f00000000c0), 0x10, 0xa702)
mmap(&(0x7f0000527000/0x1000)=nil, 0x1000, 0x1000006, 0x11, r0, 0x0)
sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f00000007c0)={0x0, 0x0, &(0x7f0000000480)={&(0x7f0000002340)=@delchain={0x244, 0x65, 0x0, 0x0, 0x0, {}, [@TCA_CHAIN={0x8}, @filter_kind_options=@f_u32={{0x8}, {0x40, 0x2, [@TCA_U32_INDEV={0x14, 0x8, 'veth0_to_team\x00'}, @TCA_U32_CLASSID={0x8}, @TCA_U32_HASH={0x8}, @TCA_U32_MARK={0x10}, @TCA_U32_FLAGS={0x8}]}}, @TCA_CHAIN={0x8}, @TCA_RATE={0x6}, @filter_kind_options=@f_route={{0xa}, {0x1b4, 0x2, [@TCA_ROUTE4_FROM={0x8}, @TCA_ROUTE4_POLICE={0x4}, @TCA_ROUTE4_FROM={0x8}, @TCA_ROUTE4_ACT={0x19c, 0x6, [@m_ife={0x150, 0x0, 0x0, 0x0, {{0x8}, {0x34, 0x2, 0x0, 0x1, [@TCA_IFE_SMAC={0xa, 0x4, @dev}, @TCA_IFE_TYPE={0x6}, @TCA_IFE_PARMS={0x1c}]}, {0xf5, 0x6, "21b2caeba32a6f7c5900697624a17b85a9db3a31b129a4976a84cfb4f5d651fd8aa24a645c8f63c025fcca463a6b79a3d7e6c9a8b89a140805ef63939ac2e37b49004b0dc3b8446aa7038eceef52fe7bdca153fe865c65015a3b208b282c16472e451aa10a8631235c49cae271f5fc8ce5e34d9938e3d5f43ac7a0e31b0acfc73199ca90e81246819f4c740a4fa3247a2af88d6569da09be7179b89f9f024c9f465098a5a52058a431206bee68089bddc13ffe76ff0f000053fa1517700a54d423c13fb6732a5d39c87101b0882ccd8e86eb437849e249675c60d8a9cf9430b6aa206e8116810b35151fce1e1bf48c2b9c"}, {0xc}, {0xc}}}, @m_nat={0x48, 0x0, 0x0, 0x0, {{0x8}, {0x4}, {0x1d, 0x6, "ef93daeef78df7f9a037a0d7a2f92a1cc341deabba437fc636"}, {0xc}, {0xc}}}]}]}}]}, 0x244}}, 0x0)
r1 = socket(0x10, 0x803, 0x0)
sendto(r1, &(0x7f0000000740)="120000001200e7ef007b00000000000000a1", 0x12, 0x0, 0x0, 0x0)
recvmmsg(r1, &(0x7f00000037c0)=[{{&(0x7f00000004c0)=@ethernet={0x0, @random}, 0xfdf4, &(0x7f0000000380)=[{&(0x7f0000000140)=""/100, 0x365}, {&(0x7f0000000280)=""/85, 0x7c}, {&(0x7f0000000fc0)=""/4096, 0x197}, {&(0x7f0000000400)=""/106, 0x645}, {&(0x7f0000000980)=""/73, 0x1b}, {&(0x7f0000000200)=""/77, 0x334}, {&(0x7f00000007c0)=""/154, 0x8}, {&(0x7f00000001c0)=""/17, 0x1d8}], 0x21, &(0x7f0000000600)=""/191, 0x41}}], 0x4000000000003b4, 0x0, &(0x7f0000003700)={0x77359400})
syz_open_dev$video(&(0x7f0000000040), 0xa7, 0x0)
r2 = syz_open_dev$vbi(&(0x7f0000000080), 0x2, 0x2)
ioctl$VIDIOC_S_FMT(r2, 0xc0d05640, &(0x7f0000000340)={0x1, @pix={0x20000, 0x0, 0x0, 0x0, 0x0, 0x1, 0x3, 0xfeedcafe, 0x0, 0x0, 0x0, 0x7}})
prctl$PR_SET_IO_FLUSHER(0x41, 0x3)
mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f04ebbee8, 0x10, 0xffffffffffffffff, 0x0)
r3 = socket(0xa, 0x2, 0x0)
bind$inet6(r3, &(0x7f0000000040)={0xa, 0x0, 0x0, @loopback={0xff00000000000000}}, 0x59)
getsockname$packet(r3, 0x0, &(0x7f00000002c0))
r4 = syz_open_procfs(0x0, &(0x7f0000000040)='ns\x00')
getdents64(r4, 0x0, 0x500)
ioctl$UFFDIO_COPY(r4, 0xc028aa03, &(0x7f0000000000)={&(0x7f00002de000/0x1000)=nil, &(0x7f00004ed000/0x4000)=nil, 0x1000})
mprotect(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x6)
syz_open_dev$usbfs(&(0x7f00000000c0), 0x10, 0xa702) (async)
mmap(&(0x7f0000527000/0x1000)=nil, 0x1000, 0x1000006, 0x11, r0, 0x0) (async)
sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f00000007c0)={0x0, 0x0, &(0x7f0000000480)={&(0x7f0000002340)=@delchain={0x244, 0x65, 0x0, 0x0, 0x0, {}, [@TCA_CHAIN={0x8}, @filter_kind_options=@f_u32={{0x8}, {0x40, 0x2, [@TCA_U32_INDEV={0x14, 0x8, 'veth0_to_team\x00'}, @TCA_U32_CLASSID={0x8}, @TCA_U32_HASH={0x8}, @TCA_U32_MARK={0x10}, @TCA_U32_FLAGS={0x8}]}}, @TCA_CHAIN={0x8}, @TCA_RATE={0x6}, @filter_kind_options=@f_route={{0xa}, {0x1b4, 0x2, [@TCA_ROUTE4_FROM={0x8}, @TCA_ROUTE4_POLICE={0x4}, @TCA_ROUTE4_FROM={0x8}, @TCA_ROUTE4_ACT={0x19c, 0x6, [@m_ife={0x150, 0x0, 0x0, 0x0, {{0x8}, {0x34, 0x2, 0x0, 0x1, [@TCA_IFE_SMAC={0xa, 0x4, @dev}, @TCA_IFE_TYPE={0x6}, @TCA_IFE_PARMS={0x1c}]}, {0xf5, 0x6, "21b2caeba32a6f7c5900697624a17b85a9db3a31b129a4976a84cfb4f5d651fd8aa24a645c8f63c025fcca463a6b79a3d7e6c9a8b89a140805ef63939ac2e37b49004b0dc3b8446aa7038eceef52fe7bdca153fe865c65015a3b208b282c16472e451aa10a8631235c49cae271f5fc8ce5e34d9938e3d5f43ac7a0e31b0acfc73199ca90e81246819f4c740a4fa3247a2af88d6569da09be7179b89f9f024c9f465098a5a52058a431206bee68089bddc13ffe76ff0f000053fa1517700a54d423c13fb6732a5d39c87101b0882ccd8e86eb437849e249675c60d8a9cf9430b6aa206e8116810b35151fce1e1bf48c2b9c"}, {0xc}, {0xc}}}, @m_nat={0x48, 0x0, 0x0, 0x0, {{0x8}, {0x4}, {0x1d, 0x6, "ef93daeef78df7f9a037a0d7a2f92a1cc341deabba437fc636"}, {0xc}, {0xc}}}]}]}}]}, 0x244}}, 0x0) (async)
socket(0x10, 0x803, 0x0) (async)
sendto(r1, &(0x7f0000000740)="120000001200e7ef007b00000000000000a1", 0x12, 0x0, 0x0, 0x0) (async)
recvmmsg(r1, &(0x7f00000037c0)=[{{&(0x7f00000004c0)=@ethernet={0x0, @random}, 0xfdf4, &(0x7f0000000380)=[{&(0x7f0000000140)=""/100, 0x365}, {&(0x7f0000000280)=""/85, 0x7c}, {&(0x7f0000000fc0)=""/4096, 0x197}, {&(0x7f0000000400)=""/106, 0x645}, {&(0x7f0000000980)=""/73, 0x1b}, {&(0x7f0000000200)=""/77, 0x334}, {&(0x7f00000007c0)=""/154, 0x8}, {&(0x7f00000001c0)=""/17, 0x1d8}], 0x21, &(0x7f0000000600)=""/191, 0x41}}], 0x4000000000003b4, 0x0, &(0x7f0000003700)={0x77359400}) (async)
syz_open_dev$video(&(0x7f0000000040), 0xa7, 0x0) (async)

program crashed: kernel BUG in __page_table_check_zero
testing program (duration=2m30s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:namespace SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_open_dev$usbfs-mmap-sendmsg$nl_route_sched-socket-sendto-recvmmsg-syz_open_dev$video-syz_open_dev$vbi-ioctl$VIDIOC_S_FMT-prctl$PR_SET_IO_FLUSHER-mmap-socket-bind$inet6-getsockname$packet-syz_open_procfs-getdents64-ioctl$UFFDIO_COPY-mprotect-syz_open_dev$usbfs-mmap-sendmsg$nl_route_sched-socket-sendto-recvmmsg
detailed listing:
executing program 0:
r0 = syz_open_dev$usbfs(&(0x7f00000000c0), 0x10, 0xa702)
mmap(&(0x7f0000527000/0x1000)=nil, 0x1000, 0x1000006, 0x11, r0, 0x0)
sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f00000007c0)={0x0, 0x0, &(0x7f0000000480)={&(0x7f0000002340)=@delchain={0x244, 0x65, 0x0, 0x0, 0x0, {}, [@TCA_CHAIN={0x8}, @filter_kind_options=@f_u32={{0x8}, {0x40, 0x2, [@TCA_U32_INDEV={0x14, 0x8, 'veth0_to_team\x00'}, @TCA_U32_CLASSID={0x8}, @TCA_U32_HASH={0x8}, @TCA_U32_MARK={0x10}, @TCA_U32_FLAGS={0x8}]}}, @TCA_CHAIN={0x8}, @TCA_RATE={0x6}, @filter_kind_options=@f_route={{0xa}, {0x1b4, 0x2, [@TCA_ROUTE4_FROM={0x8}, @TCA_ROUTE4_POLICE={0x4}, @TCA_ROUTE4_FROM={0x8}, @TCA_ROUTE4_ACT={0x19c, 0x6, [@m_ife={0x150, 0x0, 0x0, 0x0, {{0x8}, {0x34, 0x2, 0x0, 0x1, [@TCA_IFE_SMAC={0xa, 0x4, @dev}, @TCA_IFE_TYPE={0x6}, @TCA_IFE_PARMS={0x1c}]}, {0xf5, 0x6, "21b2caeba32a6f7c5900697624a17b85a9db3a31b129a4976a84cfb4f5d651fd8aa24a645c8f63c025fcca463a6b79a3d7e6c9a8b89a140805ef63939ac2e37b49004b0dc3b8446aa7038eceef52fe7bdca153fe865c65015a3b208b282c16472e451aa10a8631235c49cae271f5fc8ce5e34d9938e3d5f43ac7a0e31b0acfc73199ca90e81246819f4c740a4fa3247a2af88d6569da09be7179b89f9f024c9f465098a5a52058a431206bee68089bddc13ffe76ff0f000053fa1517700a54d423c13fb6732a5d39c87101b0882ccd8e86eb437849e249675c60d8a9cf9430b6aa206e8116810b35151fce1e1bf48c2b9c"}, {0xc}, {0xc}}}, @m_nat={0x48, 0x0, 0x0, 0x0, {{0x8}, {0x4}, {0x1d, 0x6, "ef93daeef78df7f9a037a0d7a2f92a1cc341deabba437fc636"}, {0xc}, {0xc}}}]}]}}]}, 0x244}}, 0x0)
r1 = socket(0x10, 0x803, 0x0)
sendto(r1, &(0x7f0000000740)="120000001200e7ef007b00000000000000a1", 0x12, 0x0, 0x0, 0x0)
recvmmsg(r1, &(0x7f00000037c0)=[{{&(0x7f00000004c0)=@ethernet={0x0, @random}, 0xfdf4, &(0x7f0000000380)=[{&(0x7f0000000140)=""/100, 0x365}, {&(0x7f0000000280)=""/85, 0x7c}, {&(0x7f0000000fc0)=""/4096, 0x197}, {&(0x7f0000000400)=""/106, 0x645}, {&(0x7f0000000980)=""/73, 0x1b}, {&(0x7f0000000200)=""/77, 0x334}, {&(0x7f00000007c0)=""/154, 0x8}, {&(0x7f00000001c0)=""/17, 0x1d8}], 0x21, &(0x7f0000000600)=""/191, 0x41}}], 0x4000000000003b4, 0x0, &(0x7f0000003700)={0x77359400})
syz_open_dev$video(&(0x7f0000000040), 0xa7, 0x0)
r2 = syz_open_dev$vbi(&(0x7f0000000080), 0x2, 0x2)
ioctl$VIDIOC_S_FMT(r2, 0xc0d05640, &(0x7f0000000340)={0x1, @pix={0x20000, 0x0, 0x0, 0x0, 0x0, 0x1, 0x3, 0xfeedcafe, 0x0, 0x0, 0x0, 0x7}})
prctl$PR_SET_IO_FLUSHER(0x41, 0x3)
mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f04ebbee8, 0x10, 0xffffffffffffffff, 0x0)
r3 = socket(0xa, 0x2, 0x0)
bind$inet6(r3, &(0x7f0000000040)={0xa, 0x0, 0x0, @loopback={0xff00000000000000}}, 0x59)
getsockname$packet(r3, 0x0, &(0x7f00000002c0))
r4 = syz_open_procfs(0x0, &(0x7f0000000040)='ns\x00')
getdents64(r4, 0x0, 0x500)
ioctl$UFFDIO_COPY(r4, 0xc028aa03, &(0x7f0000000000)={&(0x7f00002de000/0x1000)=nil, &(0x7f00004ed000/0x4000)=nil, 0x1000})
mprotect(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x6)
syz_open_dev$usbfs(&(0x7f00000000c0), 0x10, 0xa702) (async)
mmap(&(0x7f0000527000/0x1000)=nil, 0x1000, 0x1000006, 0x11, r0, 0x0) (async)
sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f00000007c0)={0x0, 0x0, &(0x7f0000000480)={&(0x7f0000002340)=@delchain={0x244, 0x65, 0x0, 0x0, 0x0, {}, [@TCA_CHAIN={0x8}, @filter_kind_options=@f_u32={{0x8}, {0x40, 0x2, [@TCA_U32_INDEV={0x14, 0x8, 'veth0_to_team\x00'}, @TCA_U32_CLASSID={0x8}, @TCA_U32_HASH={0x8}, @TCA_U32_MARK={0x10}, @TCA_U32_FLAGS={0x8}]}}, @TCA_CHAIN={0x8}, @TCA_RATE={0x6}, @filter_kind_options=@f_route={{0xa}, {0x1b4, 0x2, [@TCA_ROUTE4_FROM={0x8}, @TCA_ROUTE4_POLICE={0x4}, @TCA_ROUTE4_FROM={0x8}, @TCA_ROUTE4_ACT={0x19c, 0x6, [@m_ife={0x150, 0x0, 0x0, 0x0, {{0x8}, {0x34, 0x2, 0x0, 0x1, [@TCA_IFE_SMAC={0xa, 0x4, @dev}, @TCA_IFE_TYPE={0x6}, @TCA_IFE_PARMS={0x1c}]}, {0xf5, 0x6, "21b2caeba32a6f7c5900697624a17b85a9db3a31b129a4976a84cfb4f5d651fd8aa24a645c8f63c025fcca463a6b79a3d7e6c9a8b89a140805ef63939ac2e37b49004b0dc3b8446aa7038eceef52fe7bdca153fe865c65015a3b208b282c16472e451aa10a8631235c49cae271f5fc8ce5e34d9938e3d5f43ac7a0e31b0acfc73199ca90e81246819f4c740a4fa3247a2af88d6569da09be7179b89f9f024c9f465098a5a52058a431206bee68089bddc13ffe76ff0f000053fa1517700a54d423c13fb6732a5d39c87101b0882ccd8e86eb437849e249675c60d8a9cf9430b6aa206e8116810b35151fce1e1bf48c2b9c"}, {0xc}, {0xc}}}, @m_nat={0x48, 0x0, 0x0, 0x0, {{0x8}, {0x4}, {0x1d, 0x6, "ef93daeef78df7f9a037a0d7a2f92a1cc341deabba437fc636"}, {0xc}, {0xc}}}]}]}}]}, 0x244}}, 0x0) (async)
socket(0x10, 0x803, 0x0) (async)
sendto(r1, &(0x7f0000000740)="120000001200e7ef007b00000000000000a1", 0x12, 0x0, 0x0, 0x0) (async)
recvmmsg(r1, &(0x7f00000037c0)=[{{&(0x7f00000004c0)=@ethernet={0x0, @random}, 0xfdf4, &(0x7f0000000380)=[{&(0x7f0000000140)=""/100, 0x365}, {&(0x7f0000000280)=""/85, 0x7c}, {&(0x7f0000000fc0)=""/4096, 0x197}, {&(0x7f0000000400)=""/106, 0x645}, {&(0x7f0000000980)=""/73, 0x1b}, {&(0x7f0000000200)=""/77, 0x334}, {&(0x7f00000007c0)=""/154, 0x8}, {&(0x7f00000001c0)=""/17, 0x1d8}], 0x21, &(0x7f0000000600)=""/191, 0x41}}], 0x4000000000003b4, 0x0, &(0x7f0000003700)={0x77359400}) (async)

program crashed: kernel BUG in __page_table_check_zero
testing program (duration=2m30s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:namespace SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_open_dev$usbfs-mmap-sendmsg$nl_route_sched-socket-sendto-recvmmsg-syz_open_dev$video-syz_open_dev$vbi-ioctl$VIDIOC_S_FMT-prctl$PR_SET_IO_FLUSHER-mmap-socket-bind$inet6-getsockname$packet-syz_open_procfs-getdents64-ioctl$UFFDIO_COPY-mprotect-syz_open_dev$usbfs-mmap-sendmsg$nl_route_sched-socket-sendto
detailed listing:
executing program 0:
r0 = syz_open_dev$usbfs(&(0x7f00000000c0), 0x10, 0xa702)
mmap(&(0x7f0000527000/0x1000)=nil, 0x1000, 0x1000006, 0x11, r0, 0x0)
sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f00000007c0)={0x0, 0x0, &(0x7f0000000480)={&(0x7f0000002340)=@delchain={0x244, 0x65, 0x0, 0x0, 0x0, {}, [@TCA_CHAIN={0x8}, @filter_kind_options=@f_u32={{0x8}, {0x40, 0x2, [@TCA_U32_INDEV={0x14, 0x8, 'veth0_to_team\x00'}, @TCA_U32_CLASSID={0x8}, @TCA_U32_HASH={0x8}, @TCA_U32_MARK={0x10}, @TCA_U32_FLAGS={0x8}]}}, @TCA_CHAIN={0x8}, @TCA_RATE={0x6}, @filter_kind_options=@f_route={{0xa}, {0x1b4, 0x2, [@TCA_ROUTE4_FROM={0x8}, @TCA_ROUTE4_POLICE={0x4}, @TCA_ROUTE4_FROM={0x8}, @TCA_ROUTE4_ACT={0x19c, 0x6, [@m_ife={0x150, 0x0, 0x0, 0x0, {{0x8}, {0x34, 0x2, 0x0, 0x1, [@TCA_IFE_SMAC={0xa, 0x4, @dev}, @TCA_IFE_TYPE={0x6}, @TCA_IFE_PARMS={0x1c}]}, {0xf5, 0x6, "21b2caeba32a6f7c5900697624a17b85a9db3a31b129a4976a84cfb4f5d651fd8aa24a645c8f63c025fcca463a6b79a3d7e6c9a8b89a140805ef63939ac2e37b49004b0dc3b8446aa7038eceef52fe7bdca153fe865c65015a3b208b282c16472e451aa10a8631235c49cae271f5fc8ce5e34d9938e3d5f43ac7a0e31b0acfc73199ca90e81246819f4c740a4fa3247a2af88d6569da09be7179b89f9f024c9f465098a5a52058a431206bee68089bddc13ffe76ff0f000053fa1517700a54d423c13fb6732a5d39c87101b0882ccd8e86eb437849e249675c60d8a9cf9430b6aa206e8116810b35151fce1e1bf48c2b9c"}, {0xc}, {0xc}}}, @m_nat={0x48, 0x0, 0x0, 0x0, {{0x8}, {0x4}, {0x1d, 0x6, "ef93daeef78df7f9a037a0d7a2f92a1cc341deabba437fc636"}, {0xc}, {0xc}}}]}]}}]}, 0x244}}, 0x0)
r1 = socket(0x10, 0x803, 0x0)
sendto(r1, &(0x7f0000000740)="120000001200e7ef007b00000000000000a1", 0x12, 0x0, 0x0, 0x0)
recvmmsg(r1, &(0x7f00000037c0)=[{{&(0x7f00000004c0)=@ethernet={0x0, @random}, 0xfdf4, &(0x7f0000000380)=[{&(0x7f0000000140)=""/100, 0x365}, {&(0x7f0000000280)=""/85, 0x7c}, {&(0x7f0000000fc0)=""/4096, 0x197}, {&(0x7f0000000400)=""/106, 0x645}, {&(0x7f0000000980)=""/73, 0x1b}, {&(0x7f0000000200)=""/77, 0x334}, {&(0x7f00000007c0)=""/154, 0x8}, {&(0x7f00000001c0)=""/17, 0x1d8}], 0x21, &(0x7f0000000600)=""/191, 0x41}}], 0x4000000000003b4, 0x0, &(0x7f0000003700)={0x77359400})
syz_open_dev$video(&(0x7f0000000040), 0xa7, 0x0)
r2 = syz_open_dev$vbi(&(0x7f0000000080), 0x2, 0x2)
ioctl$VIDIOC_S_FMT(r2, 0xc0d05640, &(0x7f0000000340)={0x1, @pix={0x20000, 0x0, 0x0, 0x0, 0x0, 0x1, 0x3, 0xfeedcafe, 0x0, 0x0, 0x0, 0x7}})
prctl$PR_SET_IO_FLUSHER(0x41, 0x3)
mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f04ebbee8, 0x10, 0xffffffffffffffff, 0x0)
r3 = socket(0xa, 0x2, 0x0)
bind$inet6(r3, &(0x7f0000000040)={0xa, 0x0, 0x0, @loopback={0xff00000000000000}}, 0x59)
getsockname$packet(r3, 0x0, &(0x7f00000002c0))
r4 = syz_open_procfs(0x0, &(0x7f0000000040)='ns\x00')
getdents64(r4, 0x0, 0x500)
ioctl$UFFDIO_COPY(r4, 0xc028aa03, &(0x7f0000000000)={&(0x7f00002de000/0x1000)=nil, &(0x7f00004ed000/0x4000)=nil, 0x1000})
mprotect(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x6)
syz_open_dev$usbfs(&(0x7f00000000c0), 0x10, 0xa702) (async)
mmap(&(0x7f0000527000/0x1000)=nil, 0x1000, 0x1000006, 0x11, r0, 0x0) (async)
sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f00000007c0)={0x0, 0x0, &(0x7f0000000480)={&(0x7f0000002340)=@delchain={0x244, 0x65, 0x0, 0x0, 0x0, {}, [@TCA_CHAIN={0x8}, @filter_kind_options=@f_u32={{0x8}, {0x40, 0x2, [@TCA_U32_INDEV={0x14, 0x8, 'veth0_to_team\x00'}, @TCA_U32_CLASSID={0x8}, @TCA_U32_HASH={0x8}, @TCA_U32_MARK={0x10}, @TCA_U32_FLAGS={0x8}]}}, @TCA_CHAIN={0x8}, @TCA_RATE={0x6}, @filter_kind_options=@f_route={{0xa}, {0x1b4, 0x2, [@TCA_ROUTE4_FROM={0x8}, @TCA_ROUTE4_POLICE={0x4}, @TCA_ROUTE4_FROM={0x8}, @TCA_ROUTE4_ACT={0x19c, 0x6, [@m_ife={0x150, 0x0, 0x0, 0x0, {{0x8}, {0x34, 0x2, 0x0, 0x1, [@TCA_IFE_SMAC={0xa, 0x4, @dev}, @TCA_IFE_TYPE={0x6}, @TCA_IFE_PARMS={0x1c}]}, {0xf5, 0x6, "21b2caeba32a6f7c5900697624a17b85a9db3a31b129a4976a84cfb4f5d651fd8aa24a645c8f63c025fcca463a6b79a3d7e6c9a8b89a140805ef63939ac2e37b49004b0dc3b8446aa7038eceef52fe7bdca153fe865c65015a3b208b282c16472e451aa10a8631235c49cae271f5fc8ce5e34d9938e3d5f43ac7a0e31b0acfc73199ca90e81246819f4c740a4fa3247a2af88d6569da09be7179b89f9f024c9f465098a5a52058a431206bee68089bddc13ffe76ff0f000053fa1517700a54d423c13fb6732a5d39c87101b0882ccd8e86eb437849e249675c60d8a9cf9430b6aa206e8116810b35151fce1e1bf48c2b9c"}, {0xc}, {0xc}}}, @m_nat={0x48, 0x0, 0x0, 0x0, {{0x8}, {0x4}, {0x1d, 0x6, "ef93daeef78df7f9a037a0d7a2f92a1cc341deabba437fc636"}, {0xc}, {0xc}}}]}]}}]}, 0x244}}, 0x0) (async)
socket(0x10, 0x803, 0x0) (async)
sendto(r1, &(0x7f0000000740)="120000001200e7ef007b00000000000000a1", 0x12, 0x0, 0x0, 0x0) (async)

program crashed: kernel BUG in __page_table_check_zero
testing program (duration=2m30s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:namespace SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_open_dev$usbfs-mmap-sendmsg$nl_route_sched-socket-sendto-recvmmsg-syz_open_dev$video-syz_open_dev$vbi-ioctl$VIDIOC_S_FMT-prctl$PR_SET_IO_FLUSHER-mmap-socket-bind$inet6-getsockname$packet-syz_open_procfs-getdents64-ioctl$UFFDIO_COPY-mprotect-syz_open_dev$usbfs-mmap-sendmsg$nl_route_sched-socket
detailed listing:
executing program 0:
r0 = syz_open_dev$usbfs(&(0x7f00000000c0), 0x10, 0xa702)
mmap(&(0x7f0000527000/0x1000)=nil, 0x1000, 0x1000006, 0x11, r0, 0x0)
sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f00000007c0)={0x0, 0x0, &(0x7f0000000480)={&(0x7f0000002340)=@delchain={0x244, 0x65, 0x0, 0x0, 0x0, {}, [@TCA_CHAIN={0x8}, @filter_kind_options=@f_u32={{0x8}, {0x40, 0x2, [@TCA_U32_INDEV={0x14, 0x8, 'veth0_to_team\x00'}, @TCA_U32_CLASSID={0x8}, @TCA_U32_HASH={0x8}, @TCA_U32_MARK={0x10}, @TCA_U32_FLAGS={0x8}]}}, @TCA_CHAIN={0x8}, @TCA_RATE={0x6}, @filter_kind_options=@f_route={{0xa}, {0x1b4, 0x2, [@TCA_ROUTE4_FROM={0x8}, @TCA_ROUTE4_POLICE={0x4}, @TCA_ROUTE4_FROM={0x8}, @TCA_ROUTE4_ACT={0x19c, 0x6, [@m_ife={0x150, 0x0, 0x0, 0x0, {{0x8}, {0x34, 0x2, 0x0, 0x1, [@TCA_IFE_SMAC={0xa, 0x4, @dev}, @TCA_IFE_TYPE={0x6}, @TCA_IFE_PARMS={0x1c}]}, {0xf5, 0x6, "21b2caeba32a6f7c5900697624a17b85a9db3a31b129a4976a84cfb4f5d651fd8aa24a645c8f63c025fcca463a6b79a3d7e6c9a8b89a140805ef63939ac2e37b49004b0dc3b8446aa7038eceef52fe7bdca153fe865c65015a3b208b282c16472e451aa10a8631235c49cae271f5fc8ce5e34d9938e3d5f43ac7a0e31b0acfc73199ca90e81246819f4c740a4fa3247a2af88d6569da09be7179b89f9f024c9f465098a5a52058a431206bee68089bddc13ffe76ff0f000053fa1517700a54d423c13fb6732a5d39c87101b0882ccd8e86eb437849e249675c60d8a9cf9430b6aa206e8116810b35151fce1e1bf48c2b9c"}, {0xc}, {0xc}}}, @m_nat={0x48, 0x0, 0x0, 0x0, {{0x8}, {0x4}, {0x1d, 0x6, "ef93daeef78df7f9a037a0d7a2f92a1cc341deabba437fc636"}, {0xc}, {0xc}}}]}]}}]}, 0x244}}, 0x0)
r1 = socket(0x10, 0x803, 0x0)
sendto(r1, &(0x7f0000000740)="120000001200e7ef007b00000000000000a1", 0x12, 0x0, 0x0, 0x0)
recvmmsg(r1, &(0x7f00000037c0)=[{{&(0x7f00000004c0)=@ethernet={0x0, @random}, 0xfdf4, &(0x7f0000000380)=[{&(0x7f0000000140)=""/100, 0x365}, {&(0x7f0000000280)=""/85, 0x7c}, {&(0x7f0000000fc0)=""/4096, 0x197}, {&(0x7f0000000400)=""/106, 0x645}, {&(0x7f0000000980)=""/73, 0x1b}, {&(0x7f0000000200)=""/77, 0x334}, {&(0x7f00000007c0)=""/154, 0x8}, {&(0x7f00000001c0)=""/17, 0x1d8}], 0x21, &(0x7f0000000600)=""/191, 0x41}}], 0x4000000000003b4, 0x0, &(0x7f0000003700)={0x77359400})
syz_open_dev$video(&(0x7f0000000040), 0xa7, 0x0)
r2 = syz_open_dev$vbi(&(0x7f0000000080), 0x2, 0x2)
ioctl$VIDIOC_S_FMT(r2, 0xc0d05640, &(0x7f0000000340)={0x1, @pix={0x20000, 0x0, 0x0, 0x0, 0x0, 0x1, 0x3, 0xfeedcafe, 0x0, 0x0, 0x0, 0x7}})
prctl$PR_SET_IO_FLUSHER(0x41, 0x3)
mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f04ebbee8, 0x10, 0xffffffffffffffff, 0x0)
r3 = socket(0xa, 0x2, 0x0)
bind$inet6(r3, &(0x7f0000000040)={0xa, 0x0, 0x0, @loopback={0xff00000000000000}}, 0x59)
getsockname$packet(r3, 0x0, &(0x7f00000002c0))
r4 = syz_open_procfs(0x0, &(0x7f0000000040)='ns\x00')
getdents64(r4, 0x0, 0x500)
ioctl$UFFDIO_COPY(r4, 0xc028aa03, &(0x7f0000000000)={&(0x7f00002de000/0x1000)=nil, &(0x7f00004ed000/0x4000)=nil, 0x1000})
mprotect(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x6)
syz_open_dev$usbfs(&(0x7f00000000c0), 0x10, 0xa702) (async)
mmap(&(0x7f0000527000/0x1000)=nil, 0x1000, 0x1000006, 0x11, r0, 0x0) (async)
sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f00000007c0)={0x0, 0x0, &(0x7f0000000480)={&(0x7f0000002340)=@delchain={0x244, 0x65, 0x0, 0x0, 0x0, {}, [@TCA_CHAIN={0x8}, @filter_kind_options=@f_u32={{0x8}, {0x40, 0x2, [@TCA_U32_INDEV={0x14, 0x8, 'veth0_to_team\x00'}, @TCA_U32_CLASSID={0x8}, @TCA_U32_HASH={0x8}, @TCA_U32_MARK={0x10}, @TCA_U32_FLAGS={0x8}]}}, @TCA_CHAIN={0x8}, @TCA_RATE={0x6}, @filter_kind_options=@f_route={{0xa}, {0x1b4, 0x2, [@TCA_ROUTE4_FROM={0x8}, @TCA_ROUTE4_POLICE={0x4}, @TCA_ROUTE4_FROM={0x8}, @TCA_ROUTE4_ACT={0x19c, 0x6, [@m_ife={0x150, 0x0, 0x0, 0x0, {{0x8}, {0x34, 0x2, 0x0, 0x1, [@TCA_IFE_SMAC={0xa, 0x4, @dev}, @TCA_IFE_TYPE={0x6}, @TCA_IFE_PARMS={0x1c}]}, {0xf5, 0x6, "21b2caeba32a6f7c5900697624a17b85a9db3a31b129a4976a84cfb4f5d651fd8aa24a645c8f63c025fcca463a6b79a3d7e6c9a8b89a140805ef63939ac2e37b49004b0dc3b8446aa7038eceef52fe7bdca153fe865c65015a3b208b282c16472e451aa10a8631235c49cae271f5fc8ce5e34d9938e3d5f43ac7a0e31b0acfc73199ca90e81246819f4c740a4fa3247a2af88d6569da09be7179b89f9f024c9f465098a5a52058a431206bee68089bddc13ffe76ff0f000053fa1517700a54d423c13fb6732a5d39c87101b0882ccd8e86eb437849e249675c60d8a9cf9430b6aa206e8116810b35151fce1e1bf48c2b9c"}, {0xc}, {0xc}}}, @m_nat={0x48, 0x0, 0x0, 0x0, {{0x8}, {0x4}, {0x1d, 0x6, "ef93daeef78df7f9a037a0d7a2f92a1cc341deabba437fc636"}, {0xc}, {0xc}}}]}]}}]}, 0x244}}, 0x0) (async)
socket(0x10, 0x803, 0x0) (async)

program crashed: kernel BUG in __page_table_check_zero
testing program (duration=2m30s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:namespace SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_open_dev$usbfs-mmap-sendmsg$nl_route_sched-socket-sendto-recvmmsg-syz_open_dev$video-syz_open_dev$vbi-ioctl$VIDIOC_S_FMT-prctl$PR_SET_IO_FLUSHER-mmap-socket-bind$inet6-getsockname$packet-syz_open_procfs-getdents64-ioctl$UFFDIO_COPY-mprotect-syz_open_dev$usbfs-mmap-sendmsg$nl_route_sched
detailed listing:
executing program 0:
r0 = syz_open_dev$usbfs(&(0x7f00000000c0), 0x10, 0xa702)
mmap(&(0x7f0000527000/0x1000)=nil, 0x1000, 0x1000006, 0x11, r0, 0x0)
sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f00000007c0)={0x0, 0x0, &(0x7f0000000480)={&(0x7f0000002340)=@delchain={0x244, 0x65, 0x0, 0x0, 0x0, {}, [@TCA_CHAIN={0x8}, @filter_kind_options=@f_u32={{0x8}, {0x40, 0x2, [@TCA_U32_INDEV={0x14, 0x8, 'veth0_to_team\x00'}, @TCA_U32_CLASSID={0x8}, @TCA_U32_HASH={0x8}, @TCA_U32_MARK={0x10}, @TCA_U32_FLAGS={0x8}]}}, @TCA_CHAIN={0x8}, @TCA_RATE={0x6}, @filter_kind_options=@f_route={{0xa}, {0x1b4, 0x2, [@TCA_ROUTE4_FROM={0x8}, @TCA_ROUTE4_POLICE={0x4}, @TCA_ROUTE4_FROM={0x8}, @TCA_ROUTE4_ACT={0x19c, 0x6, [@m_ife={0x150, 0x0, 0x0, 0x0, {{0x8}, {0x34, 0x2, 0x0, 0x1, [@TCA_IFE_SMAC={0xa, 0x4, @dev}, @TCA_IFE_TYPE={0x6}, @TCA_IFE_PARMS={0x1c}]}, {0xf5, 0x6, "21b2caeba32a6f7c5900697624a17b85a9db3a31b129a4976a84cfb4f5d651fd8aa24a645c8f63c025fcca463a6b79a3d7e6c9a8b89a140805ef63939ac2e37b49004b0dc3b8446aa7038eceef52fe7bdca153fe865c65015a3b208b282c16472e451aa10a8631235c49cae271f5fc8ce5e34d9938e3d5f43ac7a0e31b0acfc73199ca90e81246819f4c740a4fa3247a2af88d6569da09be7179b89f9f024c9f465098a5a52058a431206bee68089bddc13ffe76ff0f000053fa1517700a54d423c13fb6732a5d39c87101b0882ccd8e86eb437849e249675c60d8a9cf9430b6aa206e8116810b35151fce1e1bf48c2b9c"}, {0xc}, {0xc}}}, @m_nat={0x48, 0x0, 0x0, 0x0, {{0x8}, {0x4}, {0x1d, 0x6, "ef93daeef78df7f9a037a0d7a2f92a1cc341deabba437fc636"}, {0xc}, {0xc}}}]}]}}]}, 0x244}}, 0x0)
r1 = socket(0x10, 0x803, 0x0)
sendto(r1, &(0x7f0000000740)="120000001200e7ef007b00000000000000a1", 0x12, 0x0, 0x0, 0x0)
recvmmsg(r1, &(0x7f00000037c0)=[{{&(0x7f00000004c0)=@ethernet={0x0, @random}, 0xfdf4, &(0x7f0000000380)=[{&(0x7f0000000140)=""/100, 0x365}, {&(0x7f0000000280)=""/85, 0x7c}, {&(0x7f0000000fc0)=""/4096, 0x197}, {&(0x7f0000000400)=""/106, 0x645}, {&(0x7f0000000980)=""/73, 0x1b}, {&(0x7f0000000200)=""/77, 0x334}, {&(0x7f00000007c0)=""/154, 0x8}, {&(0x7f00000001c0)=""/17, 0x1d8}], 0x21, &(0x7f0000000600)=""/191, 0x41}}], 0x4000000000003b4, 0x0, &(0x7f0000003700)={0x77359400})
syz_open_dev$video(&(0x7f0000000040), 0xa7, 0x0)
r2 = syz_open_dev$vbi(&(0x7f0000000080), 0x2, 0x2)
ioctl$VIDIOC_S_FMT(r2, 0xc0d05640, &(0x7f0000000340)={0x1, @pix={0x20000, 0x0, 0x0, 0x0, 0x0, 0x1, 0x3, 0xfeedcafe, 0x0, 0x0, 0x0, 0x7}})
prctl$PR_SET_IO_FLUSHER(0x41, 0x3)
mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f04ebbee8, 0x10, 0xffffffffffffffff, 0x0)
r3 = socket(0xa, 0x2, 0x0)
bind$inet6(r3, &(0x7f0000000040)={0xa, 0x0, 0x0, @loopback={0xff00000000000000}}, 0x59)
getsockname$packet(r3, 0x0, &(0x7f00000002c0))
r4 = syz_open_procfs(0x0, &(0x7f0000000040)='ns\x00')
getdents64(r4, 0x0, 0x500)
ioctl$UFFDIO_COPY(r4, 0xc028aa03, &(0x7f0000000000)={&(0x7f00002de000/0x1000)=nil, &(0x7f00004ed000/0x4000)=nil, 0x1000})
mprotect(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x6)
syz_open_dev$usbfs(&(0x7f00000000c0), 0x10, 0xa702) (async)
mmap(&(0x7f0000527000/0x1000)=nil, 0x1000, 0x1000006, 0x11, r0, 0x0) (async)
sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f00000007c0)={0x0, 0x0, &(0x7f0000000480)={&(0x7f0000002340)=@delchain={0x244, 0x65, 0x0, 0x0, 0x0, {}, [@TCA_CHAIN={0x8}, @filter_kind_options=@f_u32={{0x8}, {0x40, 0x2, [@TCA_U32_INDEV={0x14, 0x8, 'veth0_to_team\x00'}, @TCA_U32_CLASSID={0x8}, @TCA_U32_HASH={0x8}, @TCA_U32_MARK={0x10}, @TCA_U32_FLAGS={0x8}]}}, @TCA_CHAIN={0x8}, @TCA_RATE={0x6}, @filter_kind_options=@f_route={{0xa}, {0x1b4, 0x2, [@TCA_ROUTE4_FROM={0x8}, @TCA_ROUTE4_POLICE={0x4}, @TCA_ROUTE4_FROM={0x8}, @TCA_ROUTE4_ACT={0x19c, 0x6, [@m_ife={0x150, 0x0, 0x0, 0x0, {{0x8}, {0x34, 0x2, 0x0, 0x1, [@TCA_IFE_SMAC={0xa, 0x4, @dev}, @TCA_IFE_TYPE={0x6}, @TCA_IFE_PARMS={0x1c}]}, {0xf5, 0x6, "21b2caeba32a6f7c5900697624a17b85a9db3a31b129a4976a84cfb4f5d651fd8aa24a645c8f63c025fcca463a6b79a3d7e6c9a8b89a140805ef63939ac2e37b49004b0dc3b8446aa7038eceef52fe7bdca153fe865c65015a3b208b282c16472e451aa10a8631235c49cae271f5fc8ce5e34d9938e3d5f43ac7a0e31b0acfc73199ca90e81246819f4c740a4fa3247a2af88d6569da09be7179b89f9f024c9f465098a5a52058a431206bee68089bddc13ffe76ff0f000053fa1517700a54d423c13fb6732a5d39c87101b0882ccd8e86eb437849e249675c60d8a9cf9430b6aa206e8116810b35151fce1e1bf48c2b9c"}, {0xc}, {0xc}}}, @m_nat={0x48, 0x0, 0x0, 0x0, {{0x8}, {0x4}, {0x1d, 0x6, "ef93daeef78df7f9a037a0d7a2f92a1cc341deabba437fc636"}, {0xc}, {0xc}}}]}]}}]}, 0x244}}, 0x0) (async)

program crashed: kernel BUG in __page_table_check_zero
testing program (duration=2m30s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:namespace SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_open_dev$usbfs-mmap-sendmsg$nl_route_sched-socket-sendto-recvmmsg-syz_open_dev$video-syz_open_dev$vbi-ioctl$VIDIOC_S_FMT-prctl$PR_SET_IO_FLUSHER-mmap-socket-bind$inet6-getsockname$packet-syz_open_procfs-getdents64-ioctl$UFFDIO_COPY-mprotect-syz_open_dev$usbfs-mmap
detailed listing:
executing program 0:
r0 = syz_open_dev$usbfs(&(0x7f00000000c0), 0x10, 0xa702)
mmap(&(0x7f0000527000/0x1000)=nil, 0x1000, 0x1000006, 0x11, r0, 0x0)
sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f00000007c0)={0x0, 0x0, &(0x7f0000000480)={&(0x7f0000002340)=@delchain={0x244, 0x65, 0x0, 0x0, 0x0, {}, [@TCA_CHAIN={0x8}, @filter_kind_options=@f_u32={{0x8}, {0x40, 0x2, [@TCA_U32_INDEV={0x14, 0x8, 'veth0_to_team\x00'}, @TCA_U32_CLASSID={0x8}, @TCA_U32_HASH={0x8}, @TCA_U32_MARK={0x10}, @TCA_U32_FLAGS={0x8}]}}, @TCA_CHAIN={0x8}, @TCA_RATE={0x6}, @filter_kind_options=@f_route={{0xa}, {0x1b4, 0x2, [@TCA_ROUTE4_FROM={0x8}, @TCA_ROUTE4_POLICE={0x4}, @TCA_ROUTE4_FROM={0x8}, @TCA_ROUTE4_ACT={0x19c, 0x6, [@m_ife={0x150, 0x0, 0x0, 0x0, {{0x8}, {0x34, 0x2, 0x0, 0x1, [@TCA_IFE_SMAC={0xa, 0x4, @dev}, @TCA_IFE_TYPE={0x6}, @TCA_IFE_PARMS={0x1c}]}, {0xf5, 0x6, "21b2caeba32a6f7c5900697624a17b85a9db3a31b129a4976a84cfb4f5d651fd8aa24a645c8f63c025fcca463a6b79a3d7e6c9a8b89a140805ef63939ac2e37b49004b0dc3b8446aa7038eceef52fe7bdca153fe865c65015a3b208b282c16472e451aa10a8631235c49cae271f5fc8ce5e34d9938e3d5f43ac7a0e31b0acfc73199ca90e81246819f4c740a4fa3247a2af88d6569da09be7179b89f9f024c9f465098a5a52058a431206bee68089bddc13ffe76ff0f000053fa1517700a54d423c13fb6732a5d39c87101b0882ccd8e86eb437849e249675c60d8a9cf9430b6aa206e8116810b35151fce1e1bf48c2b9c"}, {0xc}, {0xc}}}, @m_nat={0x48, 0x0, 0x0, 0x0, {{0x8}, {0x4}, {0x1d, 0x6, "ef93daeef78df7f9a037a0d7a2f92a1cc341deabba437fc636"}, {0xc}, {0xc}}}]}]}}]}, 0x244}}, 0x0)
r1 = socket(0x10, 0x803, 0x0)
sendto(r1, &(0x7f0000000740)="120000001200e7ef007b00000000000000a1", 0x12, 0x0, 0x0, 0x0)
recvmmsg(r1, &(0x7f00000037c0)=[{{&(0x7f00000004c0)=@ethernet={0x0, @random}, 0xfdf4, &(0x7f0000000380)=[{&(0x7f0000000140)=""/100, 0x365}, {&(0x7f0000000280)=""/85, 0x7c}, {&(0x7f0000000fc0)=""/4096, 0x197}, {&(0x7f0000000400)=""/106, 0x645}, {&(0x7f0000000980)=""/73, 0x1b}, {&(0x7f0000000200)=""/77, 0x334}, {&(0x7f00000007c0)=""/154, 0x8}, {&(0x7f00000001c0)=""/17, 0x1d8}], 0x21, &(0x7f0000000600)=""/191, 0x41}}], 0x4000000000003b4, 0x0, &(0x7f0000003700)={0x77359400})
syz_open_dev$video(&(0x7f0000000040), 0xa7, 0x0)
r2 = syz_open_dev$vbi(&(0x7f0000000080), 0x2, 0x2)
ioctl$VIDIOC_S_FMT(r2, 0xc0d05640, &(0x7f0000000340)={0x1, @pix={0x20000, 0x0, 0x0, 0x0, 0x0, 0x1, 0x3, 0xfeedcafe, 0x0, 0x0, 0x0, 0x7}})
prctl$PR_SET_IO_FLUSHER(0x41, 0x3)
mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f04ebbee8, 0x10, 0xffffffffffffffff, 0x0)
r3 = socket(0xa, 0x2, 0x0)
bind$inet6(r3, &(0x7f0000000040)={0xa, 0x0, 0x0, @loopback={0xff00000000000000}}, 0x59)
getsockname$packet(r3, 0x0, &(0x7f00000002c0))
r4 = syz_open_procfs(0x0, &(0x7f0000000040)='ns\x00')
getdents64(r4, 0x0, 0x500)
ioctl$UFFDIO_COPY(r4, 0xc028aa03, &(0x7f0000000000)={&(0x7f00002de000/0x1000)=nil, &(0x7f00004ed000/0x4000)=nil, 0x1000})
mprotect(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x6)
syz_open_dev$usbfs(&(0x7f00000000c0), 0x10, 0xa702) (async)
mmap(&(0x7f0000527000/0x1000)=nil, 0x1000, 0x1000006, 0x11, r0, 0x0) (async)

program crashed: kernel BUG in __page_table_check_zero
testing program (duration=2m30s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:namespace SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_open_dev$usbfs-mmap-sendmsg$nl_route_sched-socket-sendto-recvmmsg-syz_open_dev$video-syz_open_dev$vbi-ioctl$VIDIOC_S_FMT-prctl$PR_SET_IO_FLUSHER-mmap-socket-bind$inet6-getsockname$packet-syz_open_procfs-getdents64-ioctl$UFFDIO_COPY-mprotect-syz_open_dev$usbfs
detailed listing:
executing program 0:
r0 = syz_open_dev$usbfs(&(0x7f00000000c0), 0x10, 0xa702)
mmap(&(0x7f0000527000/0x1000)=nil, 0x1000, 0x1000006, 0x11, r0, 0x0)
sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f00000007c0)={0x0, 0x0, &(0x7f0000000480)={&(0x7f0000002340)=@delchain={0x244, 0x65, 0x0, 0x0, 0x0, {}, [@TCA_CHAIN={0x8}, @filter_kind_options=@f_u32={{0x8}, {0x40, 0x2, [@TCA_U32_INDEV={0x14, 0x8, 'veth0_to_team\x00'}, @TCA_U32_CLASSID={0x8}, @TCA_U32_HASH={0x8}, @TCA_U32_MARK={0x10}, @TCA_U32_FLAGS={0x8}]}}, @TCA_CHAIN={0x8}, @TCA_RATE={0x6}, @filter_kind_options=@f_route={{0xa}, {0x1b4, 0x2, [@TCA_ROUTE4_FROM={0x8}, @TCA_ROUTE4_POLICE={0x4}, @TCA_ROUTE4_FROM={0x8}, @TCA_ROUTE4_ACT={0x19c, 0x6, [@m_ife={0x150, 0x0, 0x0, 0x0, {{0x8}, {0x34, 0x2, 0x0, 0x1, [@TCA_IFE_SMAC={0xa, 0x4, @dev}, @TCA_IFE_TYPE={0x6}, @TCA_IFE_PARMS={0x1c}]}, {0xf5, 0x6, "21b2caeba32a6f7c5900697624a17b85a9db3a31b129a4976a84cfb4f5d651fd8aa24a645c8f63c025fcca463a6b79a3d7e6c9a8b89a140805ef63939ac2e37b49004b0dc3b8446aa7038eceef52fe7bdca153fe865c65015a3b208b282c16472e451aa10a8631235c49cae271f5fc8ce5e34d9938e3d5f43ac7a0e31b0acfc73199ca90e81246819f4c740a4fa3247a2af88d6569da09be7179b89f9f024c9f465098a5a52058a431206bee68089bddc13ffe76ff0f000053fa1517700a54d423c13fb6732a5d39c87101b0882ccd8e86eb437849e249675c60d8a9cf9430b6aa206e8116810b35151fce1e1bf48c2b9c"}, {0xc}, {0xc}}}, @m_nat={0x48, 0x0, 0x0, 0x0, {{0x8}, {0x4}, {0x1d, 0x6, "ef93daeef78df7f9a037a0d7a2f92a1cc341deabba437fc636"}, {0xc}, {0xc}}}]}]}}]}, 0x244}}, 0x0)
r1 = socket(0x10, 0x803, 0x0)
sendto(r1, &(0x7f0000000740)="120000001200e7ef007b00000000000000a1", 0x12, 0x0, 0x0, 0x0)
recvmmsg(r1, &(0x7f00000037c0)=[{{&(0x7f00000004c0)=@ethernet={0x0, @random}, 0xfdf4, &(0x7f0000000380)=[{&(0x7f0000000140)=""/100, 0x365}, {&(0x7f0000000280)=""/85, 0x7c}, {&(0x7f0000000fc0)=""/4096, 0x197}, {&(0x7f0000000400)=""/106, 0x645}, {&(0x7f0000000980)=""/73, 0x1b}, {&(0x7f0000000200)=""/77, 0x334}, {&(0x7f00000007c0)=""/154, 0x8}, {&(0x7f00000001c0)=""/17, 0x1d8}], 0x21, &(0x7f0000000600)=""/191, 0x41}}], 0x4000000000003b4, 0x0, &(0x7f0000003700)={0x77359400})
syz_open_dev$video(&(0x7f0000000040), 0xa7, 0x0)
r2 = syz_open_dev$vbi(&(0x7f0000000080), 0x2, 0x2)
ioctl$VIDIOC_S_FMT(r2, 0xc0d05640, &(0x7f0000000340)={0x1, @pix={0x20000, 0x0, 0x0, 0x0, 0x0, 0x1, 0x3, 0xfeedcafe, 0x0, 0x0, 0x0, 0x7}})
prctl$PR_SET_IO_FLUSHER(0x41, 0x3)
mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f04ebbee8, 0x10, 0xffffffffffffffff, 0x0)
r3 = socket(0xa, 0x2, 0x0)
bind$inet6(r3, &(0x7f0000000040)={0xa, 0x0, 0x0, @loopback={0xff00000000000000}}, 0x59)
getsockname$packet(r3, 0x0, &(0x7f00000002c0))
r4 = syz_open_procfs(0x0, &(0x7f0000000040)='ns\x00')
getdents64(r4, 0x0, 0x500)
ioctl$UFFDIO_COPY(r4, 0xc028aa03, &(0x7f0000000000)={&(0x7f00002de000/0x1000)=nil, &(0x7f00004ed000/0x4000)=nil, 0x1000})
mprotect(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x6)
syz_open_dev$usbfs(&(0x7f00000000c0), 0x10, 0xa702) (async)

program did not crash
testing program (duration=2m30s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:namespace SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_open_dev$usbfs-mmap-sendmsg$nl_route_sched-socket-sendto-recvmmsg-syz_open_dev$video-syz_open_dev$vbi-ioctl$VIDIOC_S_FMT-prctl$PR_SET_IO_FLUSHER-mmap-socket-bind$inet6-getsockname$packet-syz_open_procfs-getdents64-ioctl$UFFDIO_COPY-mprotect-mmap
detailed listing:
executing program 0:
r0 = syz_open_dev$usbfs(&(0x7f00000000c0), 0x10, 0xa702)
mmap(&(0x7f0000527000/0x1000)=nil, 0x1000, 0x1000006, 0x11, r0, 0x0)
sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f00000007c0)={0x0, 0x0, &(0x7f0000000480)={&(0x7f0000002340)=@delchain={0x244, 0x65, 0x0, 0x0, 0x0, {}, [@TCA_CHAIN={0x8}, @filter_kind_options=@f_u32={{0x8}, {0x40, 0x2, [@TCA_U32_INDEV={0x14, 0x8, 'veth0_to_team\x00'}, @TCA_U32_CLASSID={0x8}, @TCA_U32_HASH={0x8}, @TCA_U32_MARK={0x10}, @TCA_U32_FLAGS={0x8}]}}, @TCA_CHAIN={0x8}, @TCA_RATE={0x6}, @filter_kind_options=@f_route={{0xa}, {0x1b4, 0x2, [@TCA_ROUTE4_FROM={0x8}, @TCA_ROUTE4_POLICE={0x4}, @TCA_ROUTE4_FROM={0x8}, @TCA_ROUTE4_ACT={0x19c, 0x6, [@m_ife={0x150, 0x0, 0x0, 0x0, {{0x8}, {0x34, 0x2, 0x0, 0x1, [@TCA_IFE_SMAC={0xa, 0x4, @dev}, @TCA_IFE_TYPE={0x6}, @TCA_IFE_PARMS={0x1c}]}, {0xf5, 0x6, "21b2caeba32a6f7c5900697624a17b85a9db3a31b129a4976a84cfb4f5d651fd8aa24a645c8f63c025fcca463a6b79a3d7e6c9a8b89a140805ef63939ac2e37b49004b0dc3b8446aa7038eceef52fe7bdca153fe865c65015a3b208b282c16472e451aa10a8631235c49cae271f5fc8ce5e34d9938e3d5f43ac7a0e31b0acfc73199ca90e81246819f4c740a4fa3247a2af88d6569da09be7179b89f9f024c9f465098a5a52058a431206bee68089bddc13ffe76ff0f000053fa1517700a54d423c13fb6732a5d39c87101b0882ccd8e86eb437849e249675c60d8a9cf9430b6aa206e8116810b35151fce1e1bf48c2b9c"}, {0xc}, {0xc}}}, @m_nat={0x48, 0x0, 0x0, 0x0, {{0x8}, {0x4}, {0x1d, 0x6, "ef93daeef78df7f9a037a0d7a2f92a1cc341deabba437fc636"}, {0xc}, {0xc}}}]}]}}]}, 0x244}}, 0x0)
r1 = socket(0x10, 0x803, 0x0)
sendto(r1, &(0x7f0000000740)="120000001200e7ef007b00000000000000a1", 0x12, 0x0, 0x0, 0x0)
recvmmsg(r1, &(0x7f00000037c0)=[{{&(0x7f00000004c0)=@ethernet={0x0, @random}, 0xfdf4, &(0x7f0000000380)=[{&(0x7f0000000140)=""/100, 0x365}, {&(0x7f0000000280)=""/85, 0x7c}, {&(0x7f0000000fc0)=""/4096, 0x197}, {&(0x7f0000000400)=""/106, 0x645}, {&(0x7f0000000980)=""/73, 0x1b}, {&(0x7f0000000200)=""/77, 0x334}, {&(0x7f00000007c0)=""/154, 0x8}, {&(0x7f00000001c0)=""/17, 0x1d8}], 0x21, &(0x7f0000000600)=""/191, 0x41}}], 0x4000000000003b4, 0x0, &(0x7f0000003700)={0x77359400})
syz_open_dev$video(&(0x7f0000000040), 0xa7, 0x0)
r2 = syz_open_dev$vbi(&(0x7f0000000080), 0x2, 0x2)
ioctl$VIDIOC_S_FMT(r2, 0xc0d05640, &(0x7f0000000340)={0x1, @pix={0x20000, 0x0, 0x0, 0x0, 0x0, 0x1, 0x3, 0xfeedcafe, 0x0, 0x0, 0x0, 0x7}})
prctl$PR_SET_IO_FLUSHER(0x41, 0x3)
mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f04ebbee8, 0x10, 0xffffffffffffffff, 0x0)
r3 = socket(0xa, 0x2, 0x0)
bind$inet6(r3, &(0x7f0000000040)={0xa, 0x0, 0x0, @loopback={0xff00000000000000}}, 0x59)
getsockname$packet(r3, 0x0, &(0x7f00000002c0))
r4 = syz_open_procfs(0x0, &(0x7f0000000040)='ns\x00')
getdents64(r4, 0x0, 0x500)
ioctl$UFFDIO_COPY(r4, 0xc028aa03, &(0x7f0000000000)={&(0x7f00002de000/0x1000)=nil, &(0x7f00004ed000/0x4000)=nil, 0x1000})
mprotect(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x6)
mmap(&(0x7f0000527000/0x1000)=nil, 0x1000, 0x1000006, 0x11, r0, 0x0) (async)

program crashed: kernel BUG in __page_table_check_zero
testing program (duration=2m30s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:namespace SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_open_dev$usbfs-mmap-sendmsg$nl_route_sched-socket-sendto-recvmmsg-syz_open_dev$video-syz_open_dev$vbi-ioctl$VIDIOC_S_FMT-prctl$PR_SET_IO_FLUSHER-mmap-socket-bind$inet6-getsockname$packet-syz_open_procfs-getdents64-ioctl$UFFDIO_COPY-mmap
detailed listing:
executing program 0:
r0 = syz_open_dev$usbfs(&(0x7f00000000c0), 0x10, 0xa702)
mmap(&(0x7f0000527000/0x1000)=nil, 0x1000, 0x1000006, 0x11, r0, 0x0)
sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f00000007c0)={0x0, 0x0, &(0x7f0000000480)={&(0x7f0000002340)=@delchain={0x244, 0x65, 0x0, 0x0, 0x0, {}, [@TCA_CHAIN={0x8}, @filter_kind_options=@f_u32={{0x8}, {0x40, 0x2, [@TCA_U32_INDEV={0x14, 0x8, 'veth0_to_team\x00'}, @TCA_U32_CLASSID={0x8}, @TCA_U32_HASH={0x8}, @TCA_U32_MARK={0x10}, @TCA_U32_FLAGS={0x8}]}}, @TCA_CHAIN={0x8}, @TCA_RATE={0x6}, @filter_kind_options=@f_route={{0xa}, {0x1b4, 0x2, [@TCA_ROUTE4_FROM={0x8}, @TCA_ROUTE4_POLICE={0x4}, @TCA_ROUTE4_FROM={0x8}, @TCA_ROUTE4_ACT={0x19c, 0x6, [@m_ife={0x150, 0x0, 0x0, 0x0, {{0x8}, {0x34, 0x2, 0x0, 0x1, [@TCA_IFE_SMAC={0xa, 0x4, @dev}, @TCA_IFE_TYPE={0x6}, @TCA_IFE_PARMS={0x1c}]}, {0xf5, 0x6, "21b2caeba32a6f7c5900697624a17b85a9db3a31b129a4976a84cfb4f5d651fd8aa24a645c8f63c025fcca463a6b79a3d7e6c9a8b89a140805ef63939ac2e37b49004b0dc3b8446aa7038eceef52fe7bdca153fe865c65015a3b208b282c16472e451aa10a8631235c49cae271f5fc8ce5e34d9938e3d5f43ac7a0e31b0acfc73199ca90e81246819f4c740a4fa3247a2af88d6569da09be7179b89f9f024c9f465098a5a52058a431206bee68089bddc13ffe76ff0f000053fa1517700a54d423c13fb6732a5d39c87101b0882ccd8e86eb437849e249675c60d8a9cf9430b6aa206e8116810b35151fce1e1bf48c2b9c"}, {0xc}, {0xc}}}, @m_nat={0x48, 0x0, 0x0, 0x0, {{0x8}, {0x4}, {0x1d, 0x6, "ef93daeef78df7f9a037a0d7a2f92a1cc341deabba437fc636"}, {0xc}, {0xc}}}]}]}}]}, 0x244}}, 0x0)
r1 = socket(0x10, 0x803, 0x0)
sendto(r1, &(0x7f0000000740)="120000001200e7ef007b00000000000000a1", 0x12, 0x0, 0x0, 0x0)
recvmmsg(r1, &(0x7f00000037c0)=[{{&(0x7f00000004c0)=@ethernet={0x0, @random}, 0xfdf4, &(0x7f0000000380)=[{&(0x7f0000000140)=""/100, 0x365}, {&(0x7f0000000280)=""/85, 0x7c}, {&(0x7f0000000fc0)=""/4096, 0x197}, {&(0x7f0000000400)=""/106, 0x645}, {&(0x7f0000000980)=""/73, 0x1b}, {&(0x7f0000000200)=""/77, 0x334}, {&(0x7f00000007c0)=""/154, 0x8}, {&(0x7f00000001c0)=""/17, 0x1d8}], 0x21, &(0x7f0000000600)=""/191, 0x41}}], 0x4000000000003b4, 0x0, &(0x7f0000003700)={0x77359400})
syz_open_dev$video(&(0x7f0000000040), 0xa7, 0x0)
r2 = syz_open_dev$vbi(&(0x7f0000000080), 0x2, 0x2)
ioctl$VIDIOC_S_FMT(r2, 0xc0d05640, &(0x7f0000000340)={0x1, @pix={0x20000, 0x0, 0x0, 0x0, 0x0, 0x1, 0x3, 0xfeedcafe, 0x0, 0x0, 0x0, 0x7}})
prctl$PR_SET_IO_FLUSHER(0x41, 0x3)
mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f04ebbee8, 0x10, 0xffffffffffffffff, 0x0)
r3 = socket(0xa, 0x2, 0x0)
bind$inet6(r3, &(0x7f0000000040)={0xa, 0x0, 0x0, @loopback={0xff00000000000000}}, 0x59)
getsockname$packet(r3, 0x0, &(0x7f00000002c0))
r4 = syz_open_procfs(0x0, &(0x7f0000000040)='ns\x00')
getdents64(r4, 0x0, 0x500)
ioctl$UFFDIO_COPY(r4, 0xc028aa03, &(0x7f0000000000)={&(0x7f00002de000/0x1000)=nil, &(0x7f00004ed000/0x4000)=nil, 0x1000})
mmap(&(0x7f0000527000/0x1000)=nil, 0x1000, 0x1000006, 0x11, r0, 0x0) (async)

program crashed: kernel BUG in __page_table_check_zero
testing program (duration=2m30s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:namespace SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_open_dev$usbfs-mmap-sendmsg$nl_route_sched-socket-sendto-recvmmsg-syz_open_dev$video-syz_open_dev$vbi-ioctl$VIDIOC_S_FMT-prctl$PR_SET_IO_FLUSHER-mmap-socket-bind$inet6-getsockname$packet-syz_open_procfs-getdents64-mmap
detailed listing:
executing program 0:
r0 = syz_open_dev$usbfs(&(0x7f00000000c0), 0x10, 0xa702)
mmap(&(0x7f0000527000/0x1000)=nil, 0x1000, 0x1000006, 0x11, r0, 0x0)
sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f00000007c0)={0x0, 0x0, &(0x7f0000000480)={&(0x7f0000002340)=@delchain={0x244, 0x65, 0x0, 0x0, 0x0, {}, [@TCA_CHAIN={0x8}, @filter_kind_options=@f_u32={{0x8}, {0x40, 0x2, [@TCA_U32_INDEV={0x14, 0x8, 'veth0_to_team\x00'}, @TCA_U32_CLASSID={0x8}, @TCA_U32_HASH={0x8}, @TCA_U32_MARK={0x10}, @TCA_U32_FLAGS={0x8}]}}, @TCA_CHAIN={0x8}, @TCA_RATE={0x6}, @filter_kind_options=@f_route={{0xa}, {0x1b4, 0x2, [@TCA_ROUTE4_FROM={0x8}, @TCA_ROUTE4_POLICE={0x4}, @TCA_ROUTE4_FROM={0x8}, @TCA_ROUTE4_ACT={0x19c, 0x6, [@m_ife={0x150, 0x0, 0x0, 0x0, {{0x8}, {0x34, 0x2, 0x0, 0x1, [@TCA_IFE_SMAC={0xa, 0x4, @dev}, @TCA_IFE_TYPE={0x6}, @TCA_IFE_PARMS={0x1c}]}, {0xf5, 0x6, "21b2caeba32a6f7c5900697624a17b85a9db3a31b129a4976a84cfb4f5d651fd8aa24a645c8f63c025fcca463a6b79a3d7e6c9a8b89a140805ef63939ac2e37b49004b0dc3b8446aa7038eceef52fe7bdca153fe865c65015a3b208b282c16472e451aa10a8631235c49cae271f5fc8ce5e34d9938e3d5f43ac7a0e31b0acfc73199ca90e81246819f4c740a4fa3247a2af88d6569da09be7179b89f9f024c9f465098a5a52058a431206bee68089bddc13ffe76ff0f000053fa1517700a54d423c13fb6732a5d39c87101b0882ccd8e86eb437849e249675c60d8a9cf9430b6aa206e8116810b35151fce1e1bf48c2b9c"}, {0xc}, {0xc}}}, @m_nat={0x48, 0x0, 0x0, 0x0, {{0x8}, {0x4}, {0x1d, 0x6, "ef93daeef78df7f9a037a0d7a2f92a1cc341deabba437fc636"}, {0xc}, {0xc}}}]}]}}]}, 0x244}}, 0x0)
r1 = socket(0x10, 0x803, 0x0)
sendto(r1, &(0x7f0000000740)="120000001200e7ef007b00000000000000a1", 0x12, 0x0, 0x0, 0x0)
recvmmsg(r1, &(0x7f00000037c0)=[{{&(0x7f00000004c0)=@ethernet={0x0, @random}, 0xfdf4, &(0x7f0000000380)=[{&(0x7f0000000140)=""/100, 0x365}, {&(0x7f0000000280)=""/85, 0x7c}, {&(0x7f0000000fc0)=""/4096, 0x197}, {&(0x7f0000000400)=""/106, 0x645}, {&(0x7f0000000980)=""/73, 0x1b}, {&(0x7f0000000200)=""/77, 0x334}, {&(0x7f00000007c0)=""/154, 0x8}, {&(0x7f00000001c0)=""/17, 0x1d8}], 0x21, &(0x7f0000000600)=""/191, 0x41}}], 0x4000000000003b4, 0x0, &(0x7f0000003700)={0x77359400})
syz_open_dev$video(&(0x7f0000000040), 0xa7, 0x0)
r2 = syz_open_dev$vbi(&(0x7f0000000080), 0x2, 0x2)
ioctl$VIDIOC_S_FMT(r2, 0xc0d05640, &(0x7f0000000340)={0x1, @pix={0x20000, 0x0, 0x0, 0x0, 0x0, 0x1, 0x3, 0xfeedcafe, 0x0, 0x0, 0x0, 0x7}})
prctl$PR_SET_IO_FLUSHER(0x41, 0x3)
mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f04ebbee8, 0x10, 0xffffffffffffffff, 0x0)
r3 = socket(0xa, 0x2, 0x0)
bind$inet6(r3, &(0x7f0000000040)={0xa, 0x0, 0x0, @loopback={0xff00000000000000}}, 0x59)
getsockname$packet(r3, 0x0, &(0x7f00000002c0))
r4 = syz_open_procfs(0x0, &(0x7f0000000040)='ns\x00')
getdents64(r4, 0x0, 0x500)
mmap(&(0x7f0000527000/0x1000)=nil, 0x1000, 0x1000006, 0x11, r0, 0x0) (async)

program crashed: kernel BUG in __page_table_check_zero
testing program (duration=2m30s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:namespace SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_open_dev$usbfs-mmap-sendmsg$nl_route_sched-socket-sendto-recvmmsg-syz_open_dev$video-syz_open_dev$vbi-ioctl$VIDIOC_S_FMT-prctl$PR_SET_IO_FLUSHER-mmap-socket-bind$inet6-getsockname$packet-syz_open_procfs-mmap
detailed listing:
executing program 0:
r0 = syz_open_dev$usbfs(&(0x7f00000000c0), 0x10, 0xa702)
mmap(&(0x7f0000527000/0x1000)=nil, 0x1000, 0x1000006, 0x11, r0, 0x0)
sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f00000007c0)={0x0, 0x0, &(0x7f0000000480)={&(0x7f0000002340)=@delchain={0x244, 0x65, 0x0, 0x0, 0x0, {}, [@TCA_CHAIN={0x8}, @filter_kind_options=@f_u32={{0x8}, {0x40, 0x2, [@TCA_U32_INDEV={0x14, 0x8, 'veth0_to_team\x00'}, @TCA_U32_CLASSID={0x8}, @TCA_U32_HASH={0x8}, @TCA_U32_MARK={0x10}, @TCA_U32_FLAGS={0x8}]}}, @TCA_CHAIN={0x8}, @TCA_RATE={0x6}, @filter_kind_options=@f_route={{0xa}, {0x1b4, 0x2, [@TCA_ROUTE4_FROM={0x8}, @TCA_ROUTE4_POLICE={0x4}, @TCA_ROUTE4_FROM={0x8}, @TCA_ROUTE4_ACT={0x19c, 0x6, [@m_ife={0x150, 0x0, 0x0, 0x0, {{0x8}, {0x34, 0x2, 0x0, 0x1, [@TCA_IFE_SMAC={0xa, 0x4, @dev}, @TCA_IFE_TYPE={0x6}, @TCA_IFE_PARMS={0x1c}]}, {0xf5, 0x6, "21b2caeba32a6f7c5900697624a17b85a9db3a31b129a4976a84cfb4f5d651fd8aa24a645c8f63c025fcca463a6b79a3d7e6c9a8b89a140805ef63939ac2e37b49004b0dc3b8446aa7038eceef52fe7bdca153fe865c65015a3b208b282c16472e451aa10a8631235c49cae271f5fc8ce5e34d9938e3d5f43ac7a0e31b0acfc73199ca90e81246819f4c740a4fa3247a2af88d6569da09be7179b89f9f024c9f465098a5a52058a431206bee68089bddc13ffe76ff0f000053fa1517700a54d423c13fb6732a5d39c87101b0882ccd8e86eb437849e249675c60d8a9cf9430b6aa206e8116810b35151fce1e1bf48c2b9c"}, {0xc}, {0xc}}}, @m_nat={0x48, 0x0, 0x0, 0x0, {{0x8}, {0x4}, {0x1d, 0x6, "ef93daeef78df7f9a037a0d7a2f92a1cc341deabba437fc636"}, {0xc}, {0xc}}}]}]}}]}, 0x244}}, 0x0)
r1 = socket(0x10, 0x803, 0x0)
sendto(r1, &(0x7f0000000740)="120000001200e7ef007b00000000000000a1", 0x12, 0x0, 0x0, 0x0)
recvmmsg(r1, &(0x7f00000037c0)=[{{&(0x7f00000004c0)=@ethernet={0x0, @random}, 0xfdf4, &(0x7f0000000380)=[{&(0x7f0000000140)=""/100, 0x365}, {&(0x7f0000000280)=""/85, 0x7c}, {&(0x7f0000000fc0)=""/4096, 0x197}, {&(0x7f0000000400)=""/106, 0x645}, {&(0x7f0000000980)=""/73, 0x1b}, {&(0x7f0000000200)=""/77, 0x334}, {&(0x7f00000007c0)=""/154, 0x8}, {&(0x7f00000001c0)=""/17, 0x1d8}], 0x21, &(0x7f0000000600)=""/191, 0x41}}], 0x4000000000003b4, 0x0, &(0x7f0000003700)={0x77359400})
syz_open_dev$video(&(0x7f0000000040), 0xa7, 0x0)
r2 = syz_open_dev$vbi(&(0x7f0000000080), 0x2, 0x2)
ioctl$VIDIOC_S_FMT(r2, 0xc0d05640, &(0x7f0000000340)={0x1, @pix={0x20000, 0x0, 0x0, 0x0, 0x0, 0x1, 0x3, 0xfeedcafe, 0x0, 0x0, 0x0, 0x7}})
prctl$PR_SET_IO_FLUSHER(0x41, 0x3)
mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f04ebbee8, 0x10, 0xffffffffffffffff, 0x0)
r3 = socket(0xa, 0x2, 0x0)
bind$inet6(r3, &(0x7f0000000040)={0xa, 0x0, 0x0, @loopback={0xff00000000000000}}, 0x59)
getsockname$packet(r3, 0x0, &(0x7f00000002c0))
syz_open_procfs(0x0, &(0x7f0000000040)='ns\x00')
mmap(&(0x7f0000527000/0x1000)=nil, 0x1000, 0x1000006, 0x11, r0, 0x0) (async)

program crashed: kernel BUG in __page_table_check_zero
testing program (duration=2m30s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:namespace SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_open_dev$usbfs-mmap-sendmsg$nl_route_sched-socket-sendto-recvmmsg-syz_open_dev$video-syz_open_dev$vbi-ioctl$VIDIOC_S_FMT-prctl$PR_SET_IO_FLUSHER-mmap-socket-bind$inet6-getsockname$packet-mmap
detailed listing:
executing program 0:
r0 = syz_open_dev$usbfs(&(0x7f00000000c0), 0x10, 0xa702)
mmap(&(0x7f0000527000/0x1000)=nil, 0x1000, 0x1000006, 0x11, r0, 0x0)
sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f00000007c0)={0x0, 0x0, &(0x7f0000000480)={&(0x7f0000002340)=@delchain={0x244, 0x65, 0x0, 0x0, 0x0, {}, [@TCA_CHAIN={0x8}, @filter_kind_options=@f_u32={{0x8}, {0x40, 0x2, [@TCA_U32_INDEV={0x14, 0x8, 'veth0_to_team\x00'}, @TCA_U32_CLASSID={0x8}, @TCA_U32_HASH={0x8}, @TCA_U32_MARK={0x10}, @TCA_U32_FLAGS={0x8}]}}, @TCA_CHAIN={0x8}, @TCA_RATE={0x6}, @filter_kind_options=@f_route={{0xa}, {0x1b4, 0x2, [@TCA_ROUTE4_FROM={0x8}, @TCA_ROUTE4_POLICE={0x4}, @TCA_ROUTE4_FROM={0x8}, @TCA_ROUTE4_ACT={0x19c, 0x6, [@m_ife={0x150, 0x0, 0x0, 0x0, {{0x8}, {0x34, 0x2, 0x0, 0x1, [@TCA_IFE_SMAC={0xa, 0x4, @dev}, @TCA_IFE_TYPE={0x6}, @TCA_IFE_PARMS={0x1c}]}, {0xf5, 0x6, "21b2caeba32a6f7c5900697624a17b85a9db3a31b129a4976a84cfb4f5d651fd8aa24a645c8f63c025fcca463a6b79a3d7e6c9a8b89a140805ef63939ac2e37b49004b0dc3b8446aa7038eceef52fe7bdca153fe865c65015a3b208b282c16472e451aa10a8631235c49cae271f5fc8ce5e34d9938e3d5f43ac7a0e31b0acfc73199ca90e81246819f4c740a4fa3247a2af88d6569da09be7179b89f9f024c9f465098a5a52058a431206bee68089bddc13ffe76ff0f000053fa1517700a54d423c13fb6732a5d39c87101b0882ccd8e86eb437849e249675c60d8a9cf9430b6aa206e8116810b35151fce1e1bf48c2b9c"}, {0xc}, {0xc}}}, @m_nat={0x48, 0x0, 0x0, 0x0, {{0x8}, {0x4}, {0x1d, 0x6, "ef93daeef78df7f9a037a0d7a2f92a1cc341deabba437fc636"}, {0xc}, {0xc}}}]}]}}]}, 0x244}}, 0x0)
r1 = socket(0x10, 0x803, 0x0)
sendto(r1, &(0x7f0000000740)="120000001200e7ef007b00000000000000a1", 0x12, 0x0, 0x0, 0x0)
recvmmsg(r1, &(0x7f00000037c0)=[{{&(0x7f00000004c0)=@ethernet={0x0, @random}, 0xfdf4, &(0x7f0000000380)=[{&(0x7f0000000140)=""/100, 0x365}, {&(0x7f0000000280)=""/85, 0x7c}, {&(0x7f0000000fc0)=""/4096, 0x197}, {&(0x7f0000000400)=""/106, 0x645}, {&(0x7f0000000980)=""/73, 0x1b}, {&(0x7f0000000200)=""/77, 0x334}, {&(0x7f00000007c0)=""/154, 0x8}, {&(0x7f00000001c0)=""/17, 0x1d8}], 0x21, &(0x7f0000000600)=""/191, 0x41}}], 0x4000000000003b4, 0x0, &(0x7f0000003700)={0x77359400})
syz_open_dev$video(&(0x7f0000000040), 0xa7, 0x0)
r2 = syz_open_dev$vbi(&(0x7f0000000080), 0x2, 0x2)
ioctl$VIDIOC_S_FMT(r2, 0xc0d05640, &(0x7f0000000340)={0x1, @pix={0x20000, 0x0, 0x0, 0x0, 0x0, 0x1, 0x3, 0xfeedcafe, 0x0, 0x0, 0x0, 0x7}})
prctl$PR_SET_IO_FLUSHER(0x41, 0x3)
mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f04ebbee8, 0x10, 0xffffffffffffffff, 0x0)
r3 = socket(0xa, 0x2, 0x0)
bind$inet6(r3, &(0x7f0000000040)={0xa, 0x0, 0x0, @loopback={0xff00000000000000}}, 0x59)
getsockname$packet(r3, 0x0, &(0x7f00000002c0))
mmap(&(0x7f0000527000/0x1000)=nil, 0x1000, 0x1000006, 0x11, r0, 0x0) (async)

program crashed: kernel BUG in __page_table_check_zero
testing program (duration=2m30s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:namespace SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_open_dev$usbfs-mmap-sendmsg$nl_route_sched-socket-sendto-recvmmsg-syz_open_dev$video-syz_open_dev$vbi-ioctl$VIDIOC_S_FMT-prctl$PR_SET_IO_FLUSHER-mmap-socket-bind$inet6-mmap
detailed listing:
executing program 0:
r0 = syz_open_dev$usbfs(&(0x7f00000000c0), 0x10, 0xa702)
mmap(&(0x7f0000527000/0x1000)=nil, 0x1000, 0x1000006, 0x11, r0, 0x0)
sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f00000007c0)={0x0, 0x0, &(0x7f0000000480)={&(0x7f0000002340)=@delchain={0x244, 0x65, 0x0, 0x0, 0x0, {}, [@TCA_CHAIN={0x8}, @filter_kind_options=@f_u32={{0x8}, {0x40, 0x2, [@TCA_U32_INDEV={0x14, 0x8, 'veth0_to_team\x00'}, @TCA_U32_CLASSID={0x8}, @TCA_U32_HASH={0x8}, @TCA_U32_MARK={0x10}, @TCA_U32_FLAGS={0x8}]}}, @TCA_CHAIN={0x8}, @TCA_RATE={0x6}, @filter_kind_options=@f_route={{0xa}, {0x1b4, 0x2, [@TCA_ROUTE4_FROM={0x8}, @TCA_ROUTE4_POLICE={0x4}, @TCA_ROUTE4_FROM={0x8}, @TCA_ROUTE4_ACT={0x19c, 0x6, [@m_ife={0x150, 0x0, 0x0, 0x0, {{0x8}, {0x34, 0x2, 0x0, 0x1, [@TCA_IFE_SMAC={0xa, 0x4, @dev}, @TCA_IFE_TYPE={0x6}, @TCA_IFE_PARMS={0x1c}]}, {0xf5, 0x6, "21b2caeba32a6f7c5900697624a17b85a9db3a31b129a4976a84cfb4f5d651fd8aa24a645c8f63c025fcca463a6b79a3d7e6c9a8b89a140805ef63939ac2e37b49004b0dc3b8446aa7038eceef52fe7bdca153fe865c65015a3b208b282c16472e451aa10a8631235c49cae271f5fc8ce5e34d9938e3d5f43ac7a0e31b0acfc73199ca90e81246819f4c740a4fa3247a2af88d6569da09be7179b89f9f024c9f465098a5a52058a431206bee68089bddc13ffe76ff0f000053fa1517700a54d423c13fb6732a5d39c87101b0882ccd8e86eb437849e249675c60d8a9cf9430b6aa206e8116810b35151fce1e1bf48c2b9c"}, {0xc}, {0xc}}}, @m_nat={0x48, 0x0, 0x0, 0x0, {{0x8}, {0x4}, {0x1d, 0x6, "ef93daeef78df7f9a037a0d7a2f92a1cc341deabba437fc636"}, {0xc}, {0xc}}}]}]}}]}, 0x244}}, 0x0)
r1 = socket(0x10, 0x803, 0x0)
sendto(r1, &(0x7f0000000740)="120000001200e7ef007b00000000000000a1", 0x12, 0x0, 0x0, 0x0)
recvmmsg(r1, &(0x7f00000037c0)=[{{&(0x7f00000004c0)=@ethernet={0x0, @random}, 0xfdf4, &(0x7f0000000380)=[{&(0x7f0000000140)=""/100, 0x365}, {&(0x7f0000000280)=""/85, 0x7c}, {&(0x7f0000000fc0)=""/4096, 0x197}, {&(0x7f0000000400)=""/106, 0x645}, {&(0x7f0000000980)=""/73, 0x1b}, {&(0x7f0000000200)=""/77, 0x334}, {&(0x7f00000007c0)=""/154, 0x8}, {&(0x7f00000001c0)=""/17, 0x1d8}], 0x21, &(0x7f0000000600)=""/191, 0x41}}], 0x4000000000003b4, 0x0, &(0x7f0000003700)={0x77359400})
syz_open_dev$video(&(0x7f0000000040), 0xa7, 0x0)
r2 = syz_open_dev$vbi(&(0x7f0000000080), 0x2, 0x2)
ioctl$VIDIOC_S_FMT(r2, 0xc0d05640, &(0x7f0000000340)={0x1, @pix={0x20000, 0x0, 0x0, 0x0, 0x0, 0x1, 0x3, 0xfeedcafe, 0x0, 0x0, 0x0, 0x7}})
prctl$PR_SET_IO_FLUSHER(0x41, 0x3)
mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f04ebbee8, 0x10, 0xffffffffffffffff, 0x0)
r3 = socket(0xa, 0x2, 0x0)
bind$inet6(r3, &(0x7f0000000040)={0xa, 0x0, 0x0, @loopback={0xff00000000000000}}, 0x59)
mmap(&(0x7f0000527000/0x1000)=nil, 0x1000, 0x1000006, 0x11, r0, 0x0) (async)

program crashed: kernel BUG in __page_table_check_zero
testing program (duration=2m30s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:namespace SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_open_dev$usbfs-mmap-sendmsg$nl_route_sched-socket-sendto-recvmmsg-syz_open_dev$video-syz_open_dev$vbi-ioctl$VIDIOC_S_FMT-prctl$PR_SET_IO_FLUSHER-mmap-socket-mmap
detailed listing:
executing program 0:
r0 = syz_open_dev$usbfs(&(0x7f00000000c0), 0x10, 0xa702)
mmap(&(0x7f0000527000/0x1000)=nil, 0x1000, 0x1000006, 0x11, r0, 0x0)
sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f00000007c0)={0x0, 0x0, &(0x7f0000000480)={&(0x7f0000002340)=@delchain={0x244, 0x65, 0x0, 0x0, 0x0, {}, [@TCA_CHAIN={0x8}, @filter_kind_options=@f_u32={{0x8}, {0x40, 0x2, [@TCA_U32_INDEV={0x14, 0x8, 'veth0_to_team\x00'}, @TCA_U32_CLASSID={0x8}, @TCA_U32_HASH={0x8}, @TCA_U32_MARK={0x10}, @TCA_U32_FLAGS={0x8}]}}, @TCA_CHAIN={0x8}, @TCA_RATE={0x6}, @filter_kind_options=@f_route={{0xa}, {0x1b4, 0x2, [@TCA_ROUTE4_FROM={0x8}, @TCA_ROUTE4_POLICE={0x4}, @TCA_ROUTE4_FROM={0x8}, @TCA_ROUTE4_ACT={0x19c, 0x6, [@m_ife={0x150, 0x0, 0x0, 0x0, {{0x8}, {0x34, 0x2, 0x0, 0x1, [@TCA_IFE_SMAC={0xa, 0x4, @dev}, @TCA_IFE_TYPE={0x6}, @TCA_IFE_PARMS={0x1c}]}, {0xf5, 0x6, "21b2caeba32a6f7c5900697624a17b85a9db3a31b129a4976a84cfb4f5d651fd8aa24a645c8f63c025fcca463a6b79a3d7e6c9a8b89a140805ef63939ac2e37b49004b0dc3b8446aa7038eceef52fe7bdca153fe865c65015a3b208b282c16472e451aa10a8631235c49cae271f5fc8ce5e34d9938e3d5f43ac7a0e31b0acfc73199ca90e81246819f4c740a4fa3247a2af88d6569da09be7179b89f9f024c9f465098a5a52058a431206bee68089bddc13ffe76ff0f000053fa1517700a54d423c13fb6732a5d39c87101b0882ccd8e86eb437849e249675c60d8a9cf9430b6aa206e8116810b35151fce1e1bf48c2b9c"}, {0xc}, {0xc}}}, @m_nat={0x48, 0x0, 0x0, 0x0, {{0x8}, {0x4}, {0x1d, 0x6, "ef93daeef78df7f9a037a0d7a2f92a1cc341deabba437fc636"}, {0xc}, {0xc}}}]}]}}]}, 0x244}}, 0x0)
r1 = socket(0x10, 0x803, 0x0)
sendto(r1, &(0x7f0000000740)="120000001200e7ef007b00000000000000a1", 0x12, 0x0, 0x0, 0x0)
recvmmsg(r1, &(0x7f00000037c0)=[{{&(0x7f00000004c0)=@ethernet={0x0, @random}, 0xfdf4, &(0x7f0000000380)=[{&(0x7f0000000140)=""/100, 0x365}, {&(0x7f0000000280)=""/85, 0x7c}, {&(0x7f0000000fc0)=""/4096, 0x197}, {&(0x7f0000000400)=""/106, 0x645}, {&(0x7f0000000980)=""/73, 0x1b}, {&(0x7f0000000200)=""/77, 0x334}, {&(0x7f00000007c0)=""/154, 0x8}, {&(0x7f00000001c0)=""/17, 0x1d8}], 0x21, &(0x7f0000000600)=""/191, 0x41}}], 0x4000000000003b4, 0x0, &(0x7f0000003700)={0x77359400})
syz_open_dev$video(&(0x7f0000000040), 0xa7, 0x0)
r2 = syz_open_dev$vbi(&(0x7f0000000080), 0x2, 0x2)
ioctl$VIDIOC_S_FMT(r2, 0xc0d05640, &(0x7f0000000340)={0x1, @pix={0x20000, 0x0, 0x0, 0x0, 0x0, 0x1, 0x3, 0xfeedcafe, 0x0, 0x0, 0x0, 0x7}})
prctl$PR_SET_IO_FLUSHER(0x41, 0x3)
mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f04ebbee8, 0x10, 0xffffffffffffffff, 0x0)
socket(0xa, 0x2, 0x0)
mmap(&(0x7f0000527000/0x1000)=nil, 0x1000, 0x1000006, 0x11, r0, 0x0) (async)

program crashed: kernel BUG in __page_table_check_zero
testing program (duration=2m30s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:namespace SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_open_dev$usbfs-mmap-sendmsg$nl_route_sched-socket-sendto-recvmmsg-syz_open_dev$video-syz_open_dev$vbi-ioctl$VIDIOC_S_FMT-prctl$PR_SET_IO_FLUSHER-mmap-mmap
detailed listing:
executing program 0:
r0 = syz_open_dev$usbfs(&(0x7f00000000c0), 0x10, 0xa702)
mmap(&(0x7f0000527000/0x1000)=nil, 0x1000, 0x1000006, 0x11, r0, 0x0)
sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f00000007c0)={0x0, 0x0, &(0x7f0000000480)={&(0x7f0000002340)=@delchain={0x244, 0x65, 0x0, 0x0, 0x0, {}, [@TCA_CHAIN={0x8}, @filter_kind_options=@f_u32={{0x8}, {0x40, 0x2, [@TCA_U32_INDEV={0x14, 0x8, 'veth0_to_team\x00'}, @TCA_U32_CLASSID={0x8}, @TCA_U32_HASH={0x8}, @TCA_U32_MARK={0x10}, @TCA_U32_FLAGS={0x8}]}}, @TCA_CHAIN={0x8}, @TCA_RATE={0x6}, @filter_kind_options=@f_route={{0xa}, {0x1b4, 0x2, [@TCA_ROUTE4_FROM={0x8}, @TCA_ROUTE4_POLICE={0x4}, @TCA_ROUTE4_FROM={0x8}, @TCA_ROUTE4_ACT={0x19c, 0x6, [@m_ife={0x150, 0x0, 0x0, 0x0, {{0x8}, {0x34, 0x2, 0x0, 0x1, [@TCA_IFE_SMAC={0xa, 0x4, @dev}, @TCA_IFE_TYPE={0x6}, @TCA_IFE_PARMS={0x1c}]}, {0xf5, 0x6, "21b2caeba32a6f7c5900697624a17b85a9db3a31b129a4976a84cfb4f5d651fd8aa24a645c8f63c025fcca463a6b79a3d7e6c9a8b89a140805ef63939ac2e37b49004b0dc3b8446aa7038eceef52fe7bdca153fe865c65015a3b208b282c16472e451aa10a8631235c49cae271f5fc8ce5e34d9938e3d5f43ac7a0e31b0acfc73199ca90e81246819f4c740a4fa3247a2af88d6569da09be7179b89f9f024c9f465098a5a52058a431206bee68089bddc13ffe76ff0f000053fa1517700a54d423c13fb6732a5d39c87101b0882ccd8e86eb437849e249675c60d8a9cf9430b6aa206e8116810b35151fce1e1bf48c2b9c"}, {0xc}, {0xc}}}, @m_nat={0x48, 0x0, 0x0, 0x0, {{0x8}, {0x4}, {0x1d, 0x6, "ef93daeef78df7f9a037a0d7a2f92a1cc341deabba437fc636"}, {0xc}, {0xc}}}]}]}}]}, 0x244}}, 0x0)
r1 = socket(0x10, 0x803, 0x0)
sendto(r1, &(0x7f0000000740)="120000001200e7ef007b00000000000000a1", 0x12, 0x0, 0x0, 0x0)
recvmmsg(r1, &(0x7f00000037c0)=[{{&(0x7f00000004c0)=@ethernet={0x0, @random}, 0xfdf4, &(0x7f0000000380)=[{&(0x7f0000000140)=""/100, 0x365}, {&(0x7f0000000280)=""/85, 0x7c}, {&(0x7f0000000fc0)=""/4096, 0x197}, {&(0x7f0000000400)=""/106, 0x645}, {&(0x7f0000000980)=""/73, 0x1b}, {&(0x7f0000000200)=""/77, 0x334}, {&(0x7f00000007c0)=""/154, 0x8}, {&(0x7f00000001c0)=""/17, 0x1d8}], 0x21, &(0x7f0000000600)=""/191, 0x41}}], 0x4000000000003b4, 0x0, &(0x7f0000003700)={0x77359400})
syz_open_dev$video(&(0x7f0000000040), 0xa7, 0x0)
r2 = syz_open_dev$vbi(&(0x7f0000000080), 0x2, 0x2)
ioctl$VIDIOC_S_FMT(r2, 0xc0d05640, &(0x7f0000000340)={0x1, @pix={0x20000, 0x0, 0x0, 0x0, 0x0, 0x1, 0x3, 0xfeedcafe, 0x0, 0x0, 0x0, 0x7}})
prctl$PR_SET_IO_FLUSHER(0x41, 0x3)
mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f04ebbee8, 0x10, 0xffffffffffffffff, 0x0)
mmap(&(0x7f0000527000/0x1000)=nil, 0x1000, 0x1000006, 0x11, r0, 0x0) (async)

program crashed: kernel BUG in __page_table_check_zero
testing program (duration=2m30s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:namespace SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_open_dev$usbfs-mmap-sendmsg$nl_route_sched-socket-sendto-recvmmsg-syz_open_dev$video-syz_open_dev$vbi-ioctl$VIDIOC_S_FMT-prctl$PR_SET_IO_FLUSHER-mmap
detailed listing:
executing program 0:
r0 = syz_open_dev$usbfs(&(0x7f00000000c0), 0x10, 0xa702)
mmap(&(0x7f0000527000/0x1000)=nil, 0x1000, 0x1000006, 0x11, r0, 0x0)
sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f00000007c0)={0x0, 0x0, &(0x7f0000000480)={&(0x7f0000002340)=@delchain={0x244, 0x65, 0x0, 0x0, 0x0, {}, [@TCA_CHAIN={0x8}, @filter_kind_options=@f_u32={{0x8}, {0x40, 0x2, [@TCA_U32_INDEV={0x14, 0x8, 'veth0_to_team\x00'}, @TCA_U32_CLASSID={0x8}, @TCA_U32_HASH={0x8}, @TCA_U32_MARK={0x10}, @TCA_U32_FLAGS={0x8}]}}, @TCA_CHAIN={0x8}, @TCA_RATE={0x6}, @filter_kind_options=@f_route={{0xa}, {0x1b4, 0x2, [@TCA_ROUTE4_FROM={0x8}, @TCA_ROUTE4_POLICE={0x4}, @TCA_ROUTE4_FROM={0x8}, @TCA_ROUTE4_ACT={0x19c, 0x6, [@m_ife={0x150, 0x0, 0x0, 0x0, {{0x8}, {0x34, 0x2, 0x0, 0x1, [@TCA_IFE_SMAC={0xa, 0x4, @dev}, @TCA_IFE_TYPE={0x6}, @TCA_IFE_PARMS={0x1c}]}, {0xf5, 0x6, "21b2caeba32a6f7c5900697624a17b85a9db3a31b129a4976a84cfb4f5d651fd8aa24a645c8f63c025fcca463a6b79a3d7e6c9a8b89a140805ef63939ac2e37b49004b0dc3b8446aa7038eceef52fe7bdca153fe865c65015a3b208b282c16472e451aa10a8631235c49cae271f5fc8ce5e34d9938e3d5f43ac7a0e31b0acfc73199ca90e81246819f4c740a4fa3247a2af88d6569da09be7179b89f9f024c9f465098a5a52058a431206bee68089bddc13ffe76ff0f000053fa1517700a54d423c13fb6732a5d39c87101b0882ccd8e86eb437849e249675c60d8a9cf9430b6aa206e8116810b35151fce1e1bf48c2b9c"}, {0xc}, {0xc}}}, @m_nat={0x48, 0x0, 0x0, 0x0, {{0x8}, {0x4}, {0x1d, 0x6, "ef93daeef78df7f9a037a0d7a2f92a1cc341deabba437fc636"}, {0xc}, {0xc}}}]}]}}]}, 0x244}}, 0x0)
r1 = socket(0x10, 0x803, 0x0)
sendto(r1, &(0x7f0000000740)="120000001200e7ef007b00000000000000a1", 0x12, 0x0, 0x0, 0x0)
recvmmsg(r1, &(0x7f00000037c0)=[{{&(0x7f00000004c0)=@ethernet={0x0, @random}, 0xfdf4, &(0x7f0000000380)=[{&(0x7f0000000140)=""/100, 0x365}, {&(0x7f0000000280)=""/85, 0x7c}, {&(0x7f0000000fc0)=""/4096, 0x197}, {&(0x7f0000000400)=""/106, 0x645}, {&(0x7f0000000980)=""/73, 0x1b}, {&(0x7f0000000200)=""/77, 0x334}, {&(0x7f00000007c0)=""/154, 0x8}, {&(0x7f00000001c0)=""/17, 0x1d8}], 0x21, &(0x7f0000000600)=""/191, 0x41}}], 0x4000000000003b4, 0x0, &(0x7f0000003700)={0x77359400})
syz_open_dev$video(&(0x7f0000000040), 0xa7, 0x0)
r2 = syz_open_dev$vbi(&(0x7f0000000080), 0x2, 0x2)
ioctl$VIDIOC_S_FMT(r2, 0xc0d05640, &(0x7f0000000340)={0x1, @pix={0x20000, 0x0, 0x0, 0x0, 0x0, 0x1, 0x3, 0xfeedcafe, 0x0, 0x0, 0x0, 0x7}})
prctl$PR_SET_IO_FLUSHER(0x41, 0x3)
mmap(&(0x7f0000527000/0x1000)=nil, 0x1000, 0x1000006, 0x11, r0, 0x0) (async)

program crashed: kernel BUG in __page_table_check_zero
testing program (duration=2m30s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:namespace SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_open_dev$usbfs-mmap-sendmsg$nl_route_sched-socket-sendto-recvmmsg-syz_open_dev$video-syz_open_dev$vbi-ioctl$VIDIOC_S_FMT-mmap
detailed listing:
executing program 0:
r0 = syz_open_dev$usbfs(&(0x7f00000000c0), 0x10, 0xa702)
mmap(&(0x7f0000527000/0x1000)=nil, 0x1000, 0x1000006, 0x11, r0, 0x0)
sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f00000007c0)={0x0, 0x0, &(0x7f0000000480)={&(0x7f0000002340)=@delchain={0x244, 0x65, 0x0, 0x0, 0x0, {}, [@TCA_CHAIN={0x8}, @filter_kind_options=@f_u32={{0x8}, {0x40, 0x2, [@TCA_U32_INDEV={0x14, 0x8, 'veth0_to_team\x00'}, @TCA_U32_CLASSID={0x8}, @TCA_U32_HASH={0x8}, @TCA_U32_MARK={0x10}, @TCA_U32_FLAGS={0x8}]}}, @TCA_CHAIN={0x8}, @TCA_RATE={0x6}, @filter_kind_options=@f_route={{0xa}, {0x1b4, 0x2, [@TCA_ROUTE4_FROM={0x8}, @TCA_ROUTE4_POLICE={0x4}, @TCA_ROUTE4_FROM={0x8}, @TCA_ROUTE4_ACT={0x19c, 0x6, [@m_ife={0x150, 0x0, 0x0, 0x0, {{0x8}, {0x34, 0x2, 0x0, 0x1, [@TCA_IFE_SMAC={0xa, 0x4, @dev}, @TCA_IFE_TYPE={0x6}, @TCA_IFE_PARMS={0x1c}]}, {0xf5, 0x6, "21b2caeba32a6f7c5900697624a17b85a9db3a31b129a4976a84cfb4f5d651fd8aa24a645c8f63c025fcca463a6b79a3d7e6c9a8b89a140805ef63939ac2e37b49004b0dc3b8446aa7038eceef52fe7bdca153fe865c65015a3b208b282c16472e451aa10a8631235c49cae271f5fc8ce5e34d9938e3d5f43ac7a0e31b0acfc73199ca90e81246819f4c740a4fa3247a2af88d6569da09be7179b89f9f024c9f465098a5a52058a431206bee68089bddc13ffe76ff0f000053fa1517700a54d423c13fb6732a5d39c87101b0882ccd8e86eb437849e249675c60d8a9cf9430b6aa206e8116810b35151fce1e1bf48c2b9c"}, {0xc}, {0xc}}}, @m_nat={0x48, 0x0, 0x0, 0x0, {{0x8}, {0x4}, {0x1d, 0x6, "ef93daeef78df7f9a037a0d7a2f92a1cc341deabba437fc636"}, {0xc}, {0xc}}}]}]}}]}, 0x244}}, 0x0)
r1 = socket(0x10, 0x803, 0x0)
sendto(r1, &(0x7f0000000740)="120000001200e7ef007b00000000000000a1", 0x12, 0x0, 0x0, 0x0)
recvmmsg(r1, &(0x7f00000037c0)=[{{&(0x7f00000004c0)=@ethernet={0x0, @random}, 0xfdf4, &(0x7f0000000380)=[{&(0x7f0000000140)=""/100, 0x365}, {&(0x7f0000000280)=""/85, 0x7c}, {&(0x7f0000000fc0)=""/4096, 0x197}, {&(0x7f0000000400)=""/106, 0x645}, {&(0x7f0000000980)=""/73, 0x1b}, {&(0x7f0000000200)=""/77, 0x334}, {&(0x7f00000007c0)=""/154, 0x8}, {&(0x7f00000001c0)=""/17, 0x1d8}], 0x21, &(0x7f0000000600)=""/191, 0x41}}], 0x4000000000003b4, 0x0, &(0x7f0000003700)={0x77359400})
syz_open_dev$video(&(0x7f0000000040), 0xa7, 0x0)
r2 = syz_open_dev$vbi(&(0x7f0000000080), 0x2, 0x2)
ioctl$VIDIOC_S_FMT(r2, 0xc0d05640, &(0x7f0000000340)={0x1, @pix={0x20000, 0x0, 0x0, 0x0, 0x0, 0x1, 0x3, 0xfeedcafe, 0x0, 0x0, 0x0, 0x7}})
mmap(&(0x7f0000527000/0x1000)=nil, 0x1000, 0x1000006, 0x11, r0, 0x0) (async)

program did not crash
testing program (duration=2m30s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:namespace SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_open_dev$usbfs-mmap-sendmsg$nl_route_sched-socket-sendto-recvmmsg-syz_open_dev$video-syz_open_dev$vbi-prctl$PR_SET_IO_FLUSHER-mmap
detailed listing:
executing program 0:
r0 = syz_open_dev$usbfs(&(0x7f00000000c0), 0x10, 0xa702)
mmap(&(0x7f0000527000/0x1000)=nil, 0x1000, 0x1000006, 0x11, r0, 0x0)
sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f00000007c0)={0x0, 0x0, &(0x7f0000000480)={&(0x7f0000002340)=@delchain={0x244, 0x65, 0x0, 0x0, 0x0, {}, [@TCA_CHAIN={0x8}, @filter_kind_options=@f_u32={{0x8}, {0x40, 0x2, [@TCA_U32_INDEV={0x14, 0x8, 'veth0_to_team\x00'}, @TCA_U32_CLASSID={0x8}, @TCA_U32_HASH={0x8}, @TCA_U32_MARK={0x10}, @TCA_U32_FLAGS={0x8}]}}, @TCA_CHAIN={0x8}, @TCA_RATE={0x6}, @filter_kind_options=@f_route={{0xa}, {0x1b4, 0x2, [@TCA_ROUTE4_FROM={0x8}, @TCA_ROUTE4_POLICE={0x4}, @TCA_ROUTE4_FROM={0x8}, @TCA_ROUTE4_ACT={0x19c, 0x6, [@m_ife={0x150, 0x0, 0x0, 0x0, {{0x8}, {0x34, 0x2, 0x0, 0x1, [@TCA_IFE_SMAC={0xa, 0x4, @dev}, @TCA_IFE_TYPE={0x6}, @TCA_IFE_PARMS={0x1c}]}, {0xf5, 0x6, "21b2caeba32a6f7c5900697624a17b85a9db3a31b129a4976a84cfb4f5d651fd8aa24a645c8f63c025fcca463a6b79a3d7e6c9a8b89a140805ef63939ac2e37b49004b0dc3b8446aa7038eceef52fe7bdca153fe865c65015a3b208b282c16472e451aa10a8631235c49cae271f5fc8ce5e34d9938e3d5f43ac7a0e31b0acfc73199ca90e81246819f4c740a4fa3247a2af88d6569da09be7179b89f9f024c9f465098a5a52058a431206bee68089bddc13ffe76ff0f000053fa1517700a54d423c13fb6732a5d39c87101b0882ccd8e86eb437849e249675c60d8a9cf9430b6aa206e8116810b35151fce1e1bf48c2b9c"}, {0xc}, {0xc}}}, @m_nat={0x48, 0x0, 0x0, 0x0, {{0x8}, {0x4}, {0x1d, 0x6, "ef93daeef78df7f9a037a0d7a2f92a1cc341deabba437fc636"}, {0xc}, {0xc}}}]}]}}]}, 0x244}}, 0x0)
r1 = socket(0x10, 0x803, 0x0)
sendto(r1, &(0x7f0000000740)="120000001200e7ef007b00000000000000a1", 0x12, 0x0, 0x0, 0x0)
recvmmsg(r1, &(0x7f00000037c0)=[{{&(0x7f00000004c0)=@ethernet={0x0, @random}, 0xfdf4, &(0x7f0000000380)=[{&(0x7f0000000140)=""/100, 0x365}, {&(0x7f0000000280)=""/85, 0x7c}, {&(0x7f0000000fc0)=""/4096, 0x197}, {&(0x7f0000000400)=""/106, 0x645}, {&(0x7f0000000980)=""/73, 0x1b}, {&(0x7f0000000200)=""/77, 0x334}, {&(0x7f00000007c0)=""/154, 0x8}, {&(0x7f00000001c0)=""/17, 0x1d8}], 0x21, &(0x7f0000000600)=""/191, 0x41}}], 0x4000000000003b4, 0x0, &(0x7f0000003700)={0x77359400})
syz_open_dev$video(&(0x7f0000000040), 0xa7, 0x0)
syz_open_dev$vbi(&(0x7f0000000080), 0x2, 0x2)
prctl$PR_SET_IO_FLUSHER(0x41, 0x3)
mmap(&(0x7f0000527000/0x1000)=nil, 0x1000, 0x1000006, 0x11, r0, 0x0) (async)

program crashed: kernel BUG in __page_table_check_zero
testing program (duration=2m30s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:namespace SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_open_dev$usbfs-mmap-sendmsg$nl_route_sched-socket-sendto-recvmmsg-syz_open_dev$video-prctl$PR_SET_IO_FLUSHER-mmap
detailed listing:
executing program 0:
r0 = syz_open_dev$usbfs(&(0x7f00000000c0), 0x10, 0xa702)
mmap(&(0x7f0000527000/0x1000)=nil, 0x1000, 0x1000006, 0x11, r0, 0x0)
sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f00000007c0)={0x0, 0x0, &(0x7f0000000480)={&(0x7f0000002340)=@delchain={0x244, 0x65, 0x0, 0x0, 0x0, {}, [@TCA_CHAIN={0x8}, @filter_kind_options=@f_u32={{0x8}, {0x40, 0x2, [@TCA_U32_INDEV={0x14, 0x8, 'veth0_to_team\x00'}, @TCA_U32_CLASSID={0x8}, @TCA_U32_HASH={0x8}, @TCA_U32_MARK={0x10}, @TCA_U32_FLAGS={0x8}]}}, @TCA_CHAIN={0x8}, @TCA_RATE={0x6}, @filter_kind_options=@f_route={{0xa}, {0x1b4, 0x2, [@TCA_ROUTE4_FROM={0x8}, @TCA_ROUTE4_POLICE={0x4}, @TCA_ROUTE4_FROM={0x8}, @TCA_ROUTE4_ACT={0x19c, 0x6, [@m_ife={0x150, 0x0, 0x0, 0x0, {{0x8}, {0x34, 0x2, 0x0, 0x1, [@TCA_IFE_SMAC={0xa, 0x4, @dev}, @TCA_IFE_TYPE={0x6}, @TCA_IFE_PARMS={0x1c}]}, {0xf5, 0x6, "21b2caeba32a6f7c5900697624a17b85a9db3a31b129a4976a84cfb4f5d651fd8aa24a645c8f63c025fcca463a6b79a3d7e6c9a8b89a140805ef63939ac2e37b49004b0dc3b8446aa7038eceef52fe7bdca153fe865c65015a3b208b282c16472e451aa10a8631235c49cae271f5fc8ce5e34d9938e3d5f43ac7a0e31b0acfc73199ca90e81246819f4c740a4fa3247a2af88d6569da09be7179b89f9f024c9f465098a5a52058a431206bee68089bddc13ffe76ff0f000053fa1517700a54d423c13fb6732a5d39c87101b0882ccd8e86eb437849e249675c60d8a9cf9430b6aa206e8116810b35151fce1e1bf48c2b9c"}, {0xc}, {0xc}}}, @m_nat={0x48, 0x0, 0x0, 0x0, {{0x8}, {0x4}, {0x1d, 0x6, "ef93daeef78df7f9a037a0d7a2f92a1cc341deabba437fc636"}, {0xc}, {0xc}}}]}]}}]}, 0x244}}, 0x0)
r1 = socket(0x10, 0x803, 0x0)
sendto(r1, &(0x7f0000000740)="120000001200e7ef007b00000000000000a1", 0x12, 0x0, 0x0, 0x0)
recvmmsg(r1, &(0x7f00000037c0)=[{{&(0x7f00000004c0)=@ethernet={0x0, @random}, 0xfdf4, &(0x7f0000000380)=[{&(0x7f0000000140)=""/100, 0x365}, {&(0x7f0000000280)=""/85, 0x7c}, {&(0x7f0000000fc0)=""/4096, 0x197}, {&(0x7f0000000400)=""/106, 0x645}, {&(0x7f0000000980)=""/73, 0x1b}, {&(0x7f0000000200)=""/77, 0x334}, {&(0x7f00000007c0)=""/154, 0x8}, {&(0x7f00000001c0)=""/17, 0x1d8}], 0x21, &(0x7f0000000600)=""/191, 0x41}}], 0x4000000000003b4, 0x0, &(0x7f0000003700)={0x77359400})
syz_open_dev$video(&(0x7f0000000040), 0xa7, 0x0)
prctl$PR_SET_IO_FLUSHER(0x41, 0x3)
mmap(&(0x7f0000527000/0x1000)=nil, 0x1000, 0x1000006, 0x11, r0, 0x0) (async)

program crashed: kernel BUG in __page_table_check_zero
testing program (duration=2m30s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:namespace SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_open_dev$usbfs-mmap-sendmsg$nl_route_sched-socket-sendto-recvmmsg-prctl$PR_SET_IO_FLUSHER-mmap
detailed listing:
executing program 0:
r0 = syz_open_dev$usbfs(&(0x7f00000000c0), 0x10, 0xa702)
mmap(&(0x7f0000527000/0x1000)=nil, 0x1000, 0x1000006, 0x11, r0, 0x0)
sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f00000007c0)={0x0, 0x0, &(0x7f0000000480)={&(0x7f0000002340)=@delchain={0x244, 0x65, 0x0, 0x0, 0x0, {}, [@TCA_CHAIN={0x8}, @filter_kind_options=@f_u32={{0x8}, {0x40, 0x2, [@TCA_U32_INDEV={0x14, 0x8, 'veth0_to_team\x00'}, @TCA_U32_CLASSID={0x8}, @TCA_U32_HASH={0x8}, @TCA_U32_MARK={0x10}, @TCA_U32_FLAGS={0x8}]}}, @TCA_CHAIN={0x8}, @TCA_RATE={0x6}, @filter_kind_options=@f_route={{0xa}, {0x1b4, 0x2, [@TCA_ROUTE4_FROM={0x8}, @TCA_ROUTE4_POLICE={0x4}, @TCA_ROUTE4_FROM={0x8}, @TCA_ROUTE4_ACT={0x19c, 0x6, [@m_ife={0x150, 0x0, 0x0, 0x0, {{0x8}, {0x34, 0x2, 0x0, 0x1, [@TCA_IFE_SMAC={0xa, 0x4, @dev}, @TCA_IFE_TYPE={0x6}, @TCA_IFE_PARMS={0x1c}]}, {0xf5, 0x6, "21b2caeba32a6f7c5900697624a17b85a9db3a31b129a4976a84cfb4f5d651fd8aa24a645c8f63c025fcca463a6b79a3d7e6c9a8b89a140805ef63939ac2e37b49004b0dc3b8446aa7038eceef52fe7bdca153fe865c65015a3b208b282c16472e451aa10a8631235c49cae271f5fc8ce5e34d9938e3d5f43ac7a0e31b0acfc73199ca90e81246819f4c740a4fa3247a2af88d6569da09be7179b89f9f024c9f465098a5a52058a431206bee68089bddc13ffe76ff0f000053fa1517700a54d423c13fb6732a5d39c87101b0882ccd8e86eb437849e249675c60d8a9cf9430b6aa206e8116810b35151fce1e1bf48c2b9c"}, {0xc}, {0xc}}}, @m_nat={0x48, 0x0, 0x0, 0x0, {{0x8}, {0x4}, {0x1d, 0x6, "ef93daeef78df7f9a037a0d7a2f92a1cc341deabba437fc636"}, {0xc}, {0xc}}}]}]}}]}, 0x244}}, 0x0)
r1 = socket(0x10, 0x803, 0x0)
sendto(r1, &(0x7f0000000740)="120000001200e7ef007b00000000000000a1", 0x12, 0x0, 0x0, 0x0)
recvmmsg(r1, &(0x7f00000037c0)=[{{&(0x7f00000004c0)=@ethernet={0x0, @random}, 0xfdf4, &(0x7f0000000380)=[{&(0x7f0000000140)=""/100, 0x365}, {&(0x7f0000000280)=""/85, 0x7c}, {&(0x7f0000000fc0)=""/4096, 0x197}, {&(0x7f0000000400)=""/106, 0x645}, {&(0x7f0000000980)=""/73, 0x1b}, {&(0x7f0000000200)=""/77, 0x334}, {&(0x7f00000007c0)=""/154, 0x8}, {&(0x7f00000001c0)=""/17, 0x1d8}], 0x21, &(0x7f0000000600)=""/191, 0x41}}], 0x4000000000003b4, 0x0, &(0x7f0000003700)={0x77359400})
prctl$PR_SET_IO_FLUSHER(0x41, 0x3)
mmap(&(0x7f0000527000/0x1000)=nil, 0x1000, 0x1000006, 0x11, r0, 0x0) (async)

program crashed: kernel BUG in __page_table_check_zero
testing program (duration=2m30s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:namespace SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_open_dev$usbfs-mmap-sendmsg$nl_route_sched-socket-sendto-prctl$PR_SET_IO_FLUSHER-mmap
detailed listing:
executing program 0:
r0 = syz_open_dev$usbfs(&(0x7f00000000c0), 0x10, 0xa702)
mmap(&(0x7f0000527000/0x1000)=nil, 0x1000, 0x1000006, 0x11, r0, 0x0)
sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f00000007c0)={0x0, 0x0, &(0x7f0000000480)={&(0x7f0000002340)=@delchain={0x244, 0x65, 0x0, 0x0, 0x0, {}, [@TCA_CHAIN={0x8}, @filter_kind_options=@f_u32={{0x8}, {0x40, 0x2, [@TCA_U32_INDEV={0x14, 0x8, 'veth0_to_team\x00'}, @TCA_U32_CLASSID={0x8}, @TCA_U32_HASH={0x8}, @TCA_U32_MARK={0x10}, @TCA_U32_FLAGS={0x8}]}}, @TCA_CHAIN={0x8}, @TCA_RATE={0x6}, @filter_kind_options=@f_route={{0xa}, {0x1b4, 0x2, [@TCA_ROUTE4_FROM={0x8}, @TCA_ROUTE4_POLICE={0x4}, @TCA_ROUTE4_FROM={0x8}, @TCA_ROUTE4_ACT={0x19c, 0x6, [@m_ife={0x150, 0x0, 0x0, 0x0, {{0x8}, {0x34, 0x2, 0x0, 0x1, [@TCA_IFE_SMAC={0xa, 0x4, @dev}, @TCA_IFE_TYPE={0x6}, @TCA_IFE_PARMS={0x1c}]}, {0xf5, 0x6, "21b2caeba32a6f7c5900697624a17b85a9db3a31b129a4976a84cfb4f5d651fd8aa24a645c8f63c025fcca463a6b79a3d7e6c9a8b89a140805ef63939ac2e37b49004b0dc3b8446aa7038eceef52fe7bdca153fe865c65015a3b208b282c16472e451aa10a8631235c49cae271f5fc8ce5e34d9938e3d5f43ac7a0e31b0acfc73199ca90e81246819f4c740a4fa3247a2af88d6569da09be7179b89f9f024c9f465098a5a52058a431206bee68089bddc13ffe76ff0f000053fa1517700a54d423c13fb6732a5d39c87101b0882ccd8e86eb437849e249675c60d8a9cf9430b6aa206e8116810b35151fce1e1bf48c2b9c"}, {0xc}, {0xc}}}, @m_nat={0x48, 0x0, 0x0, 0x0, {{0x8}, {0x4}, {0x1d, 0x6, "ef93daeef78df7f9a037a0d7a2f92a1cc341deabba437fc636"}, {0xc}, {0xc}}}]}]}}]}, 0x244}}, 0x0)
r1 = socket(0x10, 0x803, 0x0)
sendto(r1, &(0x7f0000000740)="120000001200e7ef007b00000000000000a1", 0x12, 0x0, 0x0, 0x0)
prctl$PR_SET_IO_FLUSHER(0x41, 0x3)
mmap(&(0x7f0000527000/0x1000)=nil, 0x1000, 0x1000006, 0x11, r0, 0x0) (async)

program crashed: kernel BUG in __page_table_check_zero
testing program (duration=2m30s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:namespace SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_open_dev$usbfs-mmap-sendmsg$nl_route_sched-socket-prctl$PR_SET_IO_FLUSHER-mmap
detailed listing:
executing program 0:
r0 = syz_open_dev$usbfs(&(0x7f00000000c0), 0x10, 0xa702)
mmap(&(0x7f0000527000/0x1000)=nil, 0x1000, 0x1000006, 0x11, r0, 0x0)
sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f00000007c0)={0x0, 0x0, &(0x7f0000000480)={&(0x7f0000002340)=@delchain={0x244, 0x65, 0x0, 0x0, 0x0, {}, [@TCA_CHAIN={0x8}, @filter_kind_options=@f_u32={{0x8}, {0x40, 0x2, [@TCA_U32_INDEV={0x14, 0x8, 'veth0_to_team\x00'}, @TCA_U32_CLASSID={0x8}, @TCA_U32_HASH={0x8}, @TCA_U32_MARK={0x10}, @TCA_U32_FLAGS={0x8}]}}, @TCA_CHAIN={0x8}, @TCA_RATE={0x6}, @filter_kind_options=@f_route={{0xa}, {0x1b4, 0x2, [@TCA_ROUTE4_FROM={0x8}, @TCA_ROUTE4_POLICE={0x4}, @TCA_ROUTE4_FROM={0x8}, @TCA_ROUTE4_ACT={0x19c, 0x6, [@m_ife={0x150, 0x0, 0x0, 0x0, {{0x8}, {0x34, 0x2, 0x0, 0x1, [@TCA_IFE_SMAC={0xa, 0x4, @dev}, @TCA_IFE_TYPE={0x6}, @TCA_IFE_PARMS={0x1c}]}, {0xf5, 0x6, "21b2caeba32a6f7c5900697624a17b85a9db3a31b129a4976a84cfb4f5d651fd8aa24a645c8f63c025fcca463a6b79a3d7e6c9a8b89a140805ef63939ac2e37b49004b0dc3b8446aa7038eceef52fe7bdca153fe865c65015a3b208b282c16472e451aa10a8631235c49cae271f5fc8ce5e34d9938e3d5f43ac7a0e31b0acfc73199ca90e81246819f4c740a4fa3247a2af88d6569da09be7179b89f9f024c9f465098a5a52058a431206bee68089bddc13ffe76ff0f000053fa1517700a54d423c13fb6732a5d39c87101b0882ccd8e86eb437849e249675c60d8a9cf9430b6aa206e8116810b35151fce1e1bf48c2b9c"}, {0xc}, {0xc}}}, @m_nat={0x48, 0x0, 0x0, 0x0, {{0x8}, {0x4}, {0x1d, 0x6, "ef93daeef78df7f9a037a0d7a2f92a1cc341deabba437fc636"}, {0xc}, {0xc}}}]}]}}]}, 0x244}}, 0x0)
socket(0x10, 0x803, 0x0)
prctl$PR_SET_IO_FLUSHER(0x41, 0x3)
mmap(&(0x7f0000527000/0x1000)=nil, 0x1000, 0x1000006, 0x11, r0, 0x0) (async)

program crashed: kernel BUG in __page_table_check_zero
testing program (duration=2m30s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:namespace SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_open_dev$usbfs-mmap-sendmsg$nl_route_sched-prctl$PR_SET_IO_FLUSHER-mmap
detailed listing:
executing program 0:
r0 = syz_open_dev$usbfs(&(0x7f00000000c0), 0x10, 0xa702)
mmap(&(0x7f0000527000/0x1000)=nil, 0x1000, 0x1000006, 0x11, r0, 0x0)
sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f00000007c0)={0x0, 0x0, &(0x7f0000000480)={&(0x7f0000002340)=@delchain={0x244, 0x65, 0x0, 0x0, 0x0, {}, [@TCA_CHAIN={0x8}, @filter_kind_options=@f_u32={{0x8}, {0x40, 0x2, [@TCA_U32_INDEV={0x14, 0x8, 'veth0_to_team\x00'}, @TCA_U32_CLASSID={0x8}, @TCA_U32_HASH={0x8}, @TCA_U32_MARK={0x10}, @TCA_U32_FLAGS={0x8}]}}, @TCA_CHAIN={0x8}, @TCA_RATE={0x6}, @filter_kind_options=@f_route={{0xa}, {0x1b4, 0x2, [@TCA_ROUTE4_FROM={0x8}, @TCA_ROUTE4_POLICE={0x4}, @TCA_ROUTE4_FROM={0x8}, @TCA_ROUTE4_ACT={0x19c, 0x6, [@m_ife={0x150, 0x0, 0x0, 0x0, {{0x8}, {0x34, 0x2, 0x0, 0x1, [@TCA_IFE_SMAC={0xa, 0x4, @dev}, @TCA_IFE_TYPE={0x6}, @TCA_IFE_PARMS={0x1c}]}, {0xf5, 0x6, "21b2caeba32a6f7c5900697624a17b85a9db3a31b129a4976a84cfb4f5d651fd8aa24a645c8f63c025fcca463a6b79a3d7e6c9a8b89a140805ef63939ac2e37b49004b0dc3b8446aa7038eceef52fe7bdca153fe865c65015a3b208b282c16472e451aa10a8631235c49cae271f5fc8ce5e34d9938e3d5f43ac7a0e31b0acfc73199ca90e81246819f4c740a4fa3247a2af88d6569da09be7179b89f9f024c9f465098a5a52058a431206bee68089bddc13ffe76ff0f000053fa1517700a54d423c13fb6732a5d39c87101b0882ccd8e86eb437849e249675c60d8a9cf9430b6aa206e8116810b35151fce1e1bf48c2b9c"}, {0xc}, {0xc}}}, @m_nat={0x48, 0x0, 0x0, 0x0, {{0x8}, {0x4}, {0x1d, 0x6, "ef93daeef78df7f9a037a0d7a2f92a1cc341deabba437fc636"}, {0xc}, {0xc}}}]}]}}]}, 0x244}}, 0x0)
prctl$PR_SET_IO_FLUSHER(0x41, 0x3)
mmap(&(0x7f0000527000/0x1000)=nil, 0x1000, 0x1000006, 0x11, r0, 0x0) (async)

program crashed: kernel BUG in __page_table_check_zero
testing program (duration=2m30s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:namespace SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_open_dev$usbfs-mmap-prctl$PR_SET_IO_FLUSHER-mmap
detailed listing:
executing program 0:
r0 = syz_open_dev$usbfs(&(0x7f00000000c0), 0x10, 0xa702)
mmap(&(0x7f0000527000/0x1000)=nil, 0x1000, 0x1000006, 0x11, r0, 0x0)
prctl$PR_SET_IO_FLUSHER(0x41, 0x3)
mmap(&(0x7f0000527000/0x1000)=nil, 0x1000, 0x1000006, 0x11, r0, 0x0) (async)

program crashed: kernel BUG in __page_table_check_zero
testing program (duration=2m30s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:namespace SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_open_dev$usbfs-prctl$PR_SET_IO_FLUSHER-mmap
detailed listing:
executing program 0:
r0 = syz_open_dev$usbfs(&(0x7f00000000c0), 0x10, 0xa702)
prctl$PR_SET_IO_FLUSHER(0x41, 0x3)
mmap(&(0x7f0000527000/0x1000)=nil, 0x1000, 0x1000006, 0x11, r0, 0x0) (async)

program crashed: kernel BUG in __page_table_check_zero
testing program (duration=2m30s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:namespace SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): prctl$PR_SET_IO_FLUSHER-mmap
detailed listing:
executing program 0:
prctl$PR_SET_IO_FLUSHER(0x41, 0x3)
mmap(&(0x7f0000527000/0x1000)=nil, 0x1000, 0x1000006, 0x11, 0xffffffffffffffff, 0x0) (async)

program did not crash
testing program (duration=2m30s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:namespace SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_open_dev$usbfs-prctl$PR_SET_IO_FLUSHER-mmap
detailed listing:
executing program 0:
r0 = syz_open_dev$usbfs(&(0x7f00000000c0), 0x10, 0xa702)
prctl$PR_SET_IO_FLUSHER(0x41, 0x3)
mmap(&(0x7f0000527000/0x1000)=nil, 0x1000, 0x1000006, 0x11, r0, 0x0)

program crashed: kernel BUG in __page_table_check_zero
testing program (duration=2m30s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:namespace SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_open_dev$usbfs-prctl$PR_SET_IO_FLUSHER-mmap
detailed listing:
executing program 0:
r0 = syz_open_dev$usbfs(0x0, 0x10, 0xa702)
prctl$PR_SET_IO_FLUSHER(0x41, 0x3)
mmap(&(0x7f0000527000/0x1000)=nil, 0x1000, 0x1000006, 0x11, r0, 0x0)

program did not crash
extracting C reproducer
testing compiled C program (duration=2m30s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:namespace SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_open_dev$usbfs-prctl$PR_SET_IO_FLUSHER-mmap
program crashed: kernel BUG in __page_table_check_zero
simplifying C reproducer
testing compiled C program (duration=2m30s, {Threaded:false Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:namespace SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_open_dev$usbfs-prctl$PR_SET_IO_FLUSHER-mmap
program crashed: kernel BUG in __page_table_check_zero
testing compiled C program (duration=2m30s, {Threaded:false Repeat:true RepeatTimes:0 Procs:1 Slowdown:1 Sandbox:namespace SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_open_dev$usbfs-prctl$PR_SET_IO_FLUSHER-mmap
program crashed: kernel BUG in __page_table_check_zero
testing compiled C program (duration=2m30s, {Threaded:false Repeat:true RepeatTimes:0 Procs:1 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_open_dev$usbfs-prctl$PR_SET_IO_FLUSHER-mmap
program crashed: kernel BUG in __page_table_check_zero
testing compiled C program (duration=2m30s, {Threaded:false Repeat:true RepeatTimes:0 Procs:1 Slowdown:1 Sandbox: SandboxArg:0 Leak:false NetInjection:false NetDevices:false NetReset:false Cgroups:false BinfmtMisc:false CloseFDs:false KCSAN:false DevlinkPCI:false NicVF:false USB:false VhciInjection:false Wifi:false IEEE802154:true Sysctl:true Swap:false UseTmpDir:true HandleSegv:true Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_open_dev$usbfs-prctl$PR_SET_IO_FLUSHER-mmap
program crashed: kernel BUG in __page_table_check_zero
testing compiled C program (duration=2m30s, {Threaded:false Repeat:true RepeatTimes:0 Procs:1 Slowdown:1 Sandbox: SandboxArg:0 Leak:false NetInjection:false NetDevices:false NetReset:false Cgroups:false BinfmtMisc:false CloseFDs:false KCSAN:false DevlinkPCI:false NicVF:false USB:false VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:false UseTmpDir:true HandleSegv:true Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_open_dev$usbfs-prctl$PR_SET_IO_FLUSHER-mmap
program crashed: kernel BUG in __page_table_check_zero
testing compiled C program (duration=2m30s, {Threaded:false Repeat:true RepeatTimes:0 Procs:1 Slowdown:1 Sandbox: SandboxArg:0 Leak:false NetInjection:false NetDevices:false NetReset:false Cgroups:false BinfmtMisc:false CloseFDs:false KCSAN:false DevlinkPCI:false NicVF:false USB:false VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:false UseTmpDir:false HandleSegv:true Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_open_dev$usbfs-prctl$PR_SET_IO_FLUSHER-mmap
program crashed: kernel BUG in __page_table_check_zero
testing compiled C program (duration=2m30s, {Threaded:false Repeat:true RepeatTimes:0 Procs:1 Slowdown:1 Sandbox: SandboxArg:0 Leak:false NetInjection:false NetDevices:false NetReset:false Cgroups:false BinfmtMisc:false CloseFDs:false KCSAN:false DevlinkPCI:false NicVF:false USB:false VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:false UseTmpDir:false HandleSegv:false Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_open_dev$usbfs-prctl$PR_SET_IO_FLUSHER-mmap
program crashed: kernel BUG in __page_table_check_zero
testing compiled C program (duration=2m30s, {Threaded:false Repeat:true RepeatTimes:0 Procs:1 Slowdown:1 Sandbox: SandboxArg:0 Leak:false NetInjection:false NetDevices:false NetReset:false Cgroups:false BinfmtMisc:false CloseFDs:false KCSAN:false DevlinkPCI:false NicVF:false USB:false VhciInjection:false Wifi:false IEEE802154:false Sysctl:false Swap:false UseTmpDir:false HandleSegv:false Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_open_dev$usbfs-prctl$PR_SET_IO_FLUSHER-mmap
program crashed: kernel BUG in __page_table_check_zero
reproducing took 52m18.622232904s
repro crashed as (corrupted=false):
------------[ cut here ]------------
kernel BUG at mm/page_table_check.c:157!
Oops: invalid opcode: 0000 [#1] PREEMPT SMP KASAN PTI
CPU: 1 PID: 5098 Comm: syz-executor123 Not tainted 6.10.0-rc6-syzkaller-00069-g795c58e4c7fc #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 06/07/2024
RIP: 0010:__page_table_check_zero+0x274/0x350 mm/page_table_check.c:157
Code: c1 0f 8c 39 fe ff ff 48 89 df e8 97 41 f4 ff e9 2c fe ff ff e8 5d 8c 8e ff 90 0f 0b e8 55 8c 8e ff 90 0f 0b e8 4d 8c 8e ff 90 <0f> 0b f3 0f 1e fa 4c 89 f6 48 81 e6 ff 0f 00 00 31 ff e8 15 91 8e
RSP: 0018:ffffc900035bf938 EFLAGS: 00010293
RAX: ffffffff82079b03 RBX: dffffc0000000000 RCX: ffff88802ed5bc00
RDX: 0000000000000000 RSI: 0000000000000004 RDI: ffff888019096aec
RBP: ffff888019096aec R08: ffff888019096aef R09: 1ffff11003212d5d
R10: dffffc0000000000 R11: ffffed1003212d5e R12: ffff888019096aa0
R13: 1ffffffff2901988 R14: 0000000000000000 R15: 0000000000000000
FS:  0000555570292380(0000) GS:ffff8880b9500000(0000) knlGS:0000000000000000
CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 00007ff7eb3350f0 CR3: 000000007a252000 CR4: 00000000003506f0
DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400
Call Trace:
 <TASK>
 page_table_check_free include/linux/page_table_check.h:41 [inline]
 free_pages_prepare mm/page_alloc.c:1094 [inline]
 free_unref_page+0xd36/0xea0 mm/page_alloc.c:2588
 dec_usb_memory_use_count+0x259/0x350 drivers/usb/core/devio.c:198
 mmap_region+0x13b4/0x2090 mm/mmap.c:3005
 do_mmap+0x8ad/0xfa0 mm/mmap.c:1397
 vm_mmap_pgoff+0x1dd/0x3d0 mm/util.c:573
 ksys_mmap_pgoff+0x4f1/0x720 mm/mmap.c:1443
 do_syscall_x64 arch/x86/entry/common.c:52 [inline]
 do_syscall_64+0xf3/0x230 arch/x86/entry/common.c:83
 entry_SYSCALL_64_after_hwframe+0x77/0x7f
RIP: 0033:0x7ff7eb2be879
Code: 28 00 00 00 75 05 48 83 c4 28 c3 e8 c1 17 00 00 90 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 b8 ff ff ff f7 d8 64 89 01 48
RSP: 002b:00007fff50c085b8 EFLAGS: 00000246 ORIG_RAX: 0000000000000009
RAX: ffffffffffffffda RBX: 0000000000000000 RCX: 00007ff7eb2be879
RDX: 0000000001000006 RSI: 0000000000001000 RDI: 0000000020527000
RBP: 00007ff7eb3315f0 R08: 0000000000000003 R09: 0000000000000000
R10: 0000000000000011 R11: 0000000000000246 R12: 0000000000000001
R13: 431bde82d7b634db R14: 0000000000000001 R15: 0000000000000001
 </TASK>
Modules linked in:
---[ end trace 0000000000000000 ]---
RIP: 0010:__page_table_check_zero+0x274/0x350 mm/page_table_check.c:157
Code: c1 0f 8c 39 fe ff ff 48 89 df e8 97 41 f4 ff e9 2c fe ff ff e8 5d 8c 8e ff 90 0f 0b e8 55 8c 8e ff 90 0f 0b e8 4d 8c 8e ff 90 <0f> 0b f3 0f 1e fa 4c 89 f6 48 81 e6 ff 0f 00 00 31 ff e8 15 91 8e
RSP: 0018:ffffc900035bf938 EFLAGS: 00010293
RAX: ffffffff82079b03 RBX: dffffc0000000000 RCX: ffff88802ed5bc00
RDX: 0000000000000000 RSI: 0000000000000004 RDI: ffff888019096aec
RBP: ffff888019096aec R08: ffff888019096aef R09: 1ffff11003212d5d
R10: dffffc0000000000 R11: ffffed1003212d5e R12: ffff888019096aa0
R13: 1ffffffff2901988 R14: 0000000000000000 R15: 0000000000000000
FS:  0000555570292380(0000) GS:ffff8880b9500000(0000) knlGS:0000000000000000
CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 00007ff7eb3350f0 CR3: 000000007a252000 CR4: 00000000003506f0
DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400

final repro crashed as (corrupted=false):
------------[ cut here ]------------
kernel BUG at mm/page_table_check.c:157!
Oops: invalid opcode: 0000 [#1] PREEMPT SMP KASAN PTI
CPU: 1 PID: 5098 Comm: syz-executor123 Not tainted 6.10.0-rc6-syzkaller-00069-g795c58e4c7fc #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 06/07/2024
RIP: 0010:__page_table_check_zero+0x274/0x350 mm/page_table_check.c:157
Code: c1 0f 8c 39 fe ff ff 48 89 df e8 97 41 f4 ff e9 2c fe ff ff e8 5d 8c 8e ff 90 0f 0b e8 55 8c 8e ff 90 0f 0b e8 4d 8c 8e ff 90 <0f> 0b f3 0f 1e fa 4c 89 f6 48 81 e6 ff 0f 00 00 31 ff e8 15 91 8e
RSP: 0018:ffffc900035bf938 EFLAGS: 00010293
RAX: ffffffff82079b03 RBX: dffffc0000000000 RCX: ffff88802ed5bc00
RDX: 0000000000000000 RSI: 0000000000000004 RDI: ffff888019096aec
RBP: ffff888019096aec R08: ffff888019096aef R09: 1ffff11003212d5d
R10: dffffc0000000000 R11: ffffed1003212d5e R12: ffff888019096aa0
R13: 1ffffffff2901988 R14: 0000000000000000 R15: 0000000000000000
FS:  0000555570292380(0000) GS:ffff8880b9500000(0000) knlGS:0000000000000000
CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 00007ff7eb3350f0 CR3: 000000007a252000 CR4: 00000000003506f0
DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400
Call Trace:
 <TASK>
 page_table_check_free include/linux/page_table_check.h:41 [inline]
 free_pages_prepare mm/page_alloc.c:1094 [inline]
 free_unref_page+0xd36/0xea0 mm/page_alloc.c:2588
 dec_usb_memory_use_count+0x259/0x350 drivers/usb/core/devio.c:198
 mmap_region+0x13b4/0x2090 mm/mmap.c:3005
 do_mmap+0x8ad/0xfa0 mm/mmap.c:1397
 vm_mmap_pgoff+0x1dd/0x3d0 mm/util.c:573
 ksys_mmap_pgoff+0x4f1/0x720 mm/mmap.c:1443
 do_syscall_x64 arch/x86/entry/common.c:52 [inline]
 do_syscall_64+0xf3/0x230 arch/x86/entry/common.c:83
 entry_SYSCALL_64_after_hwframe+0x77/0x7f
RIP: 0033:0x7ff7eb2be879
Code: 28 00 00 00 75 05 48 83 c4 28 c3 e8 c1 17 00 00 90 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 b8 ff ff ff f7 d8 64 89 01 48
RSP: 002b:00007fff50c085b8 EFLAGS: 00000246 ORIG_RAX: 0000000000000009
RAX: ffffffffffffffda RBX: 0000000000000000 RCX: 00007ff7eb2be879
RDX: 0000000001000006 RSI: 0000000000001000 RDI: 0000000020527000
RBP: 00007ff7eb3315f0 R08: 0000000000000003 R09: 0000000000000000
R10: 0000000000000011 R11: 0000000000000246 R12: 0000000000000001
R13: 431bde82d7b634db R14: 0000000000000001 R15: 0000000000000001
 </TASK>
Modules linked in:
---[ end trace 0000000000000000 ]---
RIP: 0010:__page_table_check_zero+0x274/0x350 mm/page_table_check.c:157
Code: c1 0f 8c 39 fe ff ff 48 89 df e8 97 41 f4 ff e9 2c fe ff ff e8 5d 8c 8e ff 90 0f 0b e8 55 8c 8e ff 90 0f 0b e8 4d 8c 8e ff 90 <0f> 0b f3 0f 1e fa 4c 89 f6 48 81 e6 ff 0f 00 00 31 ff e8 15 91 8e
RSP: 0018:ffffc900035bf938 EFLAGS: 00010293
RAX: ffffffff82079b03 RBX: dffffc0000000000 RCX: ffff88802ed5bc00
RDX: 0000000000000000 RSI: 0000000000000004 RDI: ffff888019096aec
RBP: ffff888019096aec R08: ffff888019096aef R09: 1ffff11003212d5d
R10: dffffc0000000000 R11: ffffed1003212d5e R12: ffff888019096aa0
R13: 1ffffffff2901988 R14: 0000000000000000 R15: 0000000000000000
FS:  0000555570292380(0000) GS:ffff8880b9500000(0000) knlGS:0000000000000000
CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 00007ff7eb3350f0 CR3: 000000007a252000 CR4: 00000000003506f0
DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400