Extracting prog: 1h58m17.876369061s Minimizing prog: 5h35m41.02515164s Simplifying prog options: 23m53.846128759s Extracting C: 6m43.485109482s Simplifying C: 0s extracting reproducer from 24 programs testing a last program of every proc single: executing 4 programs separately with timeout 30s testing program (duration=30s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): socket$nl_generic-sendmsg$nl_generic-ioctl$BTRFS_IOC_START_SYNC-prctl$PR_SCHED_CORE-prlimit64-sched_setscheduler-openat$sequencer-syz_open_dev$sndmidi-writev-socket$inet6_sctp-ioctl$IOCTL_VMCI_VERSION2-bind$alg-mkdirat$cgroup_root-openat$cgroup_root-openat$cgroup_type-write$cgroup_type-openat$cgroup_procs-write$cgroup_pid-openat$cgroup_root-openat$cgroup_ro-syz_io_uring_setup-syz_io_uring_submit-write$cgroup_int-seccomp$SECCOMP_SET_MODE_FILTER_LISTENER-syz_ublk_setup_io_uring-socket$inet6_tcp detailed listing: executing program 0: r0 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$nl_generic(r0, &(0x7f00000000c0)={0x0, 0x0, &(0x7f00000003c0)={&(0x7f0000000b40)=ANY=[], 0x34}}, 0x4000) ioctl$BTRFS_IOC_START_SYNC(r0, 0x80089418, &(0x7f0000000000)) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000380)={0x8, 0x100008b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000200)=0x5) openat$sequencer(0xffffffffffffff9c, &(0x7f0000000300), 0x80200, 0x0) r1 = syz_open_dev$sndmidi(&(0x7f00000004c0), 0x2, 0x141102) writev(r1, &(0x7f0000000840)=[{&(0x7f00000002c0)="94", 0xf000}, {0x0}], 0x2) socket$inet6_sctp(0xa, 0x1, 0x84) ioctl$IOCTL_VMCI_VERSION2(0xffffffffffffffff, 0x7a7, 0x0) bind$alg(0xffffffffffffffff, &(0x7f0000000040)={0x26, 'skcipher\x00', 0x0, 0x0, 'xts(aes)\x00'}, 0x58) mkdirat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000)='./cgroup/syz0\x00', 0x1ff) r2 = openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000), 0x200002, 0x0) r3 = openat$cgroup_type(r2, &(0x7f0000000100), 0x2, 0x0) write$cgroup_type(r3, &(0x7f0000000280), 0x9) r4 = openat$cgroup_procs(r2, &(0x7f00000002c0)='cgroup.threads\x00', 0x2, 0x0) write$cgroup_pid(r4, &(0x7f0000000c40), 0x12) r5 = openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000), 0x200002, 0x0) r6 = openat$cgroup_ro(r5, &(0x7f0000000040)='cgroup.freeze\x00', 0x275a, 0x0) syz_io_uring_setup(0xefd, &(0x7f0000000300)={0x0, 0x0, 0x10000, 0x3, 0x55}, &(0x7f0000000100)=0x0, &(0x7f0000000140)=0x0, &(0x7f0000000080)=0x0) syz_io_uring_submit(r7, r8, r9, &(0x7f00000001c0)=@IORING_OP_FIXED_FD_INSTALL={0x36, 0x6, 0x0, r5, 0x0, 0x0, 0x0, 0x1, 0x1}) write$cgroup_int(r6, &(0x7f0000000200)=0x1, 0x12) seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0x0, &(0x7f0000000040)={0x1, &(0x7f0000000000)=[{0x6, 0x0, 0x0, 0x7fff7ffc}]}) syz_ublk_setup_io_uring(0x1d, &(0x7f0000000040)={0x0, 0x30b5, 0x1, 0x2, 0x158}, &(0x7f0000000100), &(0x7f0000000280), &(0x7f0000000140)) socket$inet6_tcp(0xa, 0x1, 0x0) program did not crash testing program (duration=30s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): write-socket$netlink-bind$inet6-prlimit64-sched_setaffinity-sched_setscheduler-syz_open_dev$MSR-read$msr-bind$netlink-sched_setaffinity-syz_ublk_setup_io_uring-syz_ublk_add_dev-sendmsg$NFT_BATCH-socket$nl_netfilter-sendmsg$NFT_MSG_GETFLOWTABLE-syz_open_dev$ublk_chdev-syz_ublk_setup_queues-syz_ublk_setup_queues-openat$ptmx detailed listing: executing program 0: write(0xffffffffffffffff, &(0x7f0000000340)='0fc5:1227:', 0xa) r0 = socket$netlink(0x10, 0x3, 0x4) bind$inet6(0xffffffffffffffff, 0x0, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) sched_setaffinity(0x0, 0x8, &(0x7f0000000100)=0x2) sched_setscheduler(0x0, 0x2, &(0x7f0000000200)=0x4) r1 = syz_open_dev$MSR(&(0x7f00000001c0), 0x0, 0x0) read$msr(r1, &(0x7f0000032680)=""/102392, 0x18ff8) bind$netlink(r0, &(0x7f0000000180)={0x10, 0x0, 0x25dfdbfd, 0x1000000}, 0xc) sched_setaffinity(0x0, 0xfffffef7, &(0x7f0000000740)=0x410000002) r2 = syz_ublk_setup_io_uring(0x20, &(0x7f0000000080)={0x0, 0x0, 0x0, 0x1, 0x2}, &(0x7f0000000040)=0x0, &(0x7f0000000100)=0x0, &(0x7f00000002c0)=0x0) r6 = syz_ublk_add_dev(r2, r3, r4, r5, &(0x7f0000000200)={0x2e, 0xc, 0x0, 0xffffffffffffffff, 0xc0207504, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', {0xffffffff, 0xffff, 0x40, &(0x7f0000000500)=@new_dev={0x3, 0x104}}}, &(0x7f0000000300)=0x0) sendmsg$NFT_BATCH(0xffffffffffffffff, 0x0, 0x80) r8 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_MSG_GETFLOWTABLE(r8, &(0x7f00000010c0)={0x0, 0x0, &(0x7f0000001080)={&(0x7f00000015c0)={0x20, 0x17, 0xa, 0x301, 0x0, 0x0, {0x2, 0x0, 0x4}, [@NFTA_FLOWTABLE_TABLE={0x9, 0x1, 'syz1\x00'}]}, 0x20}}, 0x4) r9 = syz_open_dev$ublk_chdev(&(0x7f0000002000), r6, 0x2) syz_ublk_setup_queues(r9, r7, &(0x7f0000000340)={0x0, 0x92d1, 0x400, 0x80000002, 0x165}, &(0x7f00000007c0)=[{0x0, 0x0, 0xffffffffffffffff, {0x0, 0x7ec5, 0x8, 0x2, 0x2f8, 0x0, r2}}, {0x0, 0x0, 0xffffffffffffffff, {0x0, 0x7dd8, 0x80, 0x1, 0x80000264, 0x0, r2}}, {0x0, 0x0, 0xffffffffffffffff, {0x0, 0xaa92, 0x8, 0x0, 0x67}}, {0x0, 0x0, 0xffffffffffffffff, {0x0, 0x97fb, 0x400, 0x1, 0x38b}}], 0x4, &(0x7f0000001a40)={0x2e, 0x10, 0x0, r9, 0xc0107520, 0x0, 0x0, 0x0, 0x0, {0x9}, 0x0, 0x0, '\x00', {0x0, 0x81c, 0x0, 0x0}}, &(0x7f0000001ac0)) syz_ublk_setup_queues(r10, 0x0, &(0x7f0000000180)={0x0, 0xfffffffe, 0x0, 0xfffffffe, 0x1002f6}, &(0x7f0000000800)=[{0x0, 0x0, 0xffffffffffffffff, {0x0, 0xe704, 0x40040, 0x1000002, 0x91}}, {0x0, 0x0, 0xffffffffffffffff, {0x0, 0x5c87, 0x20, 0x3, 0x3aa}}, {0x0, 0x0, 0xffffffffffffffff, {0x0, 0x1f70, 0x2, 0x3ffffffe, 0x337}}, {0x0, 0x0, 0xffffffffffffffff, {0x0, 0x4, 0x200, 0x1, 0xffffffff}}], 0x1, 0x0, 0x0) openat$ptmx(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) program did not crash testing program (duration=30s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): prlimit64-sched_setscheduler-sched_setaffinity-getpid-bpf$MAP_GET_NEXT_KEY-rseq-sched_setscheduler-socketpair$unix-connect$unix-sendmmsg$unix-sched_setaffinity-socket$inet_tcp-mremap-socket$inet_udp-io_uring_setup-io_uring_register$IORING_REGISTER_BUFFERS_UPDATE detailed listing: executing program 0: prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000080)=0x8) sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x2) r0 = getpid() bpf$MAP_GET_NEXT_KEY(0x4, 0x0, 0x0) rseq(0x0, 0xfde1, 0x0, 0x0) sched_setscheduler(r0, 0x1, &(0x7f0000000100)=0x5) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000001480)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r1, &(0x7f00000004c0)=@file={0x0, './file0\x00'}, 0x6e) sendmmsg$unix(r2, &(0x7f00000bd000), 0x318, 0x0) sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x2) socket$inet_tcp(0x2, 0x1, 0x0) mremap(&(0x7f0000a96000/0x1000)=nil, 0x1000, 0x400000, 0x3, &(0x7f0000000000/0x400000)=nil) socket$inet_udp(0x2, 0x2, 0x0) r3 = io_uring_setup(0xa2, &(0x7f0000000080)={0x0, 0x592c, 0x2, 0xfffffffc, 0x2}) io_uring_register$IORING_REGISTER_BUFFERS_UPDATE(r3, 0x10, &(0x7f00000003c0)={0x0, 0x0, &(0x7f0000000240)=[{0x0}], 0x0, 0x1}, 0x20) program did not crash testing program (duration=30s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): socketpair$unix-ioctl$KVM_SET_REGS-pipe-splice-splice-write-mmap-syz_open_procfs-mprotect-lseek-mmap detailed listing: executing program 0: socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000180)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$KVM_SET_REGS(0xffffffffffffffff, 0x4090ae82, &(0x7f0000000380)={[0xb, 0x6, 0x6, 0x4004, 0x2, 0x4, 0xefffffffffffffff, 0x0, 0x0, 0x2000000, 0x20000, 0x1c, 0x0, 0x5], 0x0, 0x41981}) pipe(&(0x7f0000000040)={0xffffffffffffffff, 0xffffffffffffffff}) splice(r1, 0x0, r3, 0x0, 0x8000f28, 0x0) splice(r2, 0x0, r1, 0x0, 0x8, 0xe) write(r0, 0x0, 0x0) mmap(&(0x7f0000000000/0xfbe000)=nil, 0xfbe000, 0x1000002, 0x4012831, 0xffffffffffffffff, 0x0) r4 = syz_open_procfs(0x0, 0x0) mprotect(&(0x7f0000000000/0x3000)=nil, 0x3000, 0x1) lseek(r4, 0x2004, 0x0) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbee2, 0x8031, 0xffffffffffffffff, 0x0) program did not crash single: failed to extract reproducer bisect: bisecting 24 programs with base timeout 30s testing program (duration=36s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): [23, 11, 4, 23, 20, 26, 26, 19, 19, 11, 18, 27, 29, 4, 11, 21, 27, 26, 23, 20, 19, 16, 19, 26] detailed listing: executing program 1: write(0xffffffffffffffff, &(0x7f0000000340)='0fc5:1227:', 0xa) mmap$IORING_OFF_SQ_RING(0x110c230000, 0x8000002, 0x4, 0x401d031, 0xffffffffffffffff, 0x0) r0 = socket$netlink(0x10, 0x3, 0x4) socket$inet6_tcp(0xa, 0x1, 0x0) fcntl$setstatus(0xffffffffffffffff, 0x4, 0x40800) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000080)=0x7) sched_setaffinity(0x0, 0x8, &(0x7f0000000100)=0x2) sched_setscheduler(0x0, 0x2, &(0x7f0000000200)=0x4) r1 = syz_open_dev$MSR(&(0x7f00000001c0), 0x0, 0x0) read$msr(r1, &(0x7f0000032680)=""/102392, 0x18ff8) bind$netlink(r0, &(0x7f0000000180)={0x10, 0x0, 0x25dfdbfd, 0x1000000}, 0xc) sched_setaffinity(0x0, 0xfffffef7, &(0x7f0000000740)=0x410000002) r2 = openat$ublk_ctrl(0xffffffffffffff9c, &(0x7f0000000000), 0x2, 0x0) r3 = syz_ublk_setup_io_uring(0x20, &(0x7f0000000080)={0x0, 0x0, 0x0, 0x1, 0x2}, &(0x7f0000000040)=0x0, &(0x7f0000000100)=0x0, &(0x7f00000002c0)=0x0) r7 = syz_ublk_add_dev(r3, r4, r5, r6, &(0x7f0000000200)={0x2e, 0xc, 0x0, r2, 0xc0207504, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', {0xffffffff, 0xffff, 0x40, &(0x7f0000000500)=@new_dev={0x3, 0x104}}}, &(0x7f0000000300)) r8 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r8, 0x0, 0x80) r9 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_MSG_GETFLOWTABLE(r9, &(0x7f00000010c0)={0x0, 0x0, &(0x7f0000001080)={&(0x7f00000015c0)={0x20, 0x17, 0xa, 0x301, 0x0, 0x0, {0x2, 0x0, 0x4}, [@NFTA_FLOWTABLE_TABLE={0x9, 0x1, 'syz1\x00'}]}, 0x20}}, 0x4) syz_open_dev$ublk_chdev(&(0x7f0000002000), r7, 0x2) syz_ublk_setup_queues(0xffffffffffffffff, 0x0, &(0x7f0000000180)={0x0, 0xfffffffe, 0x0, 0xfffffffe, 0x1002f6}, &(0x7f0000000800)=[{0x0, 0x0, 0xffffffffffffffff, {0x0, 0xe704, 0x40040, 0x1000002, 0x91}}, {0x0, 0x0, 0xffffffffffffffff, {0x0, 0x5c87, 0x20, 0x3, 0x3aa}}, {0x0, 0x0, 0xffffffffffffffff, {0x0, 0x1f70, 0x2, 0x3ffffffe, 0x337}}, {0x0, 0x0, 0xffffffffffffffff, {0x0, 0x4, 0x200, 0x1, 0xffffffff}}], 0x1, 0x0, 0x0) openat$ptmx(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) executing program 1: socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000180)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$KVM_SET_REGS(0xffffffffffffffff, 0x4090ae82, &(0x7f0000000380)={[0xb, 0x6, 0x6, 0x4004, 0x2, 0x4, 0xefffffffffffffff, 0x0, 0x0, 0x2000000, 0x20000, 0x1c, 0x0, 0x5], 0x0, 0x41981}) pipe(&(0x7f0000000040)={0xffffffffffffffff, 0xffffffffffffffff}) splice(r1, 0x0, r3, 0x0, 0x8000f28, 0x0) splice(r2, 0x0, r1, 0x0, 0x8, 0xe) write(r0, 0x0, 0x0) mmap(&(0x7f0000000000/0xfbe000)=nil, 0xfbe000, 0x1000002, 0x4012831, 0xffffffffffffffff, 0x0) r4 = syz_open_procfs(0x0, 0x0) mprotect(&(0x7f0000000000/0x3000)=nil, 0x3000, 0x1) lseek(r4, 0x2004, 0x0) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbee2, 0x8031, 0xffffffffffffffff, 0x0) executing program 1: r0 = openat$uinput(0xffffffffffffff9c, &(0x7f0000000040), 0x802, 0x0) write$uinput_user_dev(r0, &(0x7f0000000800)={'syz0\x00', {0x2, 0x10, 0x2, 0x4}, 0xf, [0x1, 0x0, 0x0, 0x40000, 0x1, 0x2, 0x4, 0x0, 0x4, 0x0, 0x0, 0x0, 0xfffffffd, 0x0, 0x0, 0x0, 0x4000, 0x20, 0x400, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffd, 0x0, 0x0, 0x2, 0x0, 0x1, 0x2, 0x0, 0x0, 0x7, 0x1, 0x0, 0x0, 0xfffffffe, 0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x29a, 0x1, 0x0, 0x0, 0x0, 0x2000, 0x0, 0xfffffffc, 0x0, 0x0, 0x0, 0x6, 0x0, 0x0, 0x6, 0x5f1, 0x6], [0x0, 0x0, 0x8, 0x0, 0x0, 0x5, 0x0, 0x80, 0x8000, 0x2, 0x9, 0x0, 0x2, 0x0, 0x0, 0x0, 0xfffffffc, 0x0, 0x200, 0x7, 0xfffffffc, 0x0, 0x0, 0x7, 0x0, 0xfffffffc, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffe, 0x3, 0x0, 0xd, 0x0, 0x2, 0x0, 0x3, 0x5, 0xfffffffd, 0x4000000, 0xfffffffd, 0x0, 0x0, 0x0, 0x0, 0x80000, 0x0, 0xfffffffd, 0x0, 0x8, 0x0, 0x0, 0x8, 0x0, 0x0, 0x4, 0xffff], [0x4, 0xfc, 0x0, 0x4, 0x0, 0x0, 0x0, 0x0, 0xb, 0x1, 0x4000000, 0x0, 0x1, 0x4, 0x1000, 0x80, 0x0, 0x200, 0x0, 0xffffffff, 0x400000, 0xfffffffc, 0x0, 0xfffffffd, 0xffffffff, 0x0, 0x0, 0xfffffffd, 0x0, 0x0, 0x20, 0x4, 0x0, 0x0, 0xfffffffe, 0x1, 0x0, 0x18c, 0x0, 0x6, 0x1, 0x0, 0xbda6, 0xe, 0x0, 0x0, 0xfffffffd, 0xffffffff, 0x0, 0x20, 0x100, 0x0, 0x0, 0x204, 0x0, 0x0, 0x4000, 0xfff, 0x6, 0x0, 0x0, 0x0, 0x0, 0x8], [0x40000000, 0x0, 0x74e2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7, 0x40, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffe, 0x0, 0x0, 0x402, 0x40, 0x0, 0x0, 0xbd, 0x0, 0xff, 0x0, 0x0, 0x0, 0x2, 0xc9, 0x0, 0x8, 0x9, 0x0, 0x0, 0xffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x101, 0x80000020, 0x0, 0x0, 0x0, 0x0, 0x40000000, 0x5cb9, 0xcaa, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x4]}, 0x45c) ioctl$UI_DEV_CREATE(r0, 0x5501) ioctl$UI_GET_SYSNAME(r0, 0x8040552c, 0x0) executing program 3: write(0xffffffffffffffff, &(0x7f0000000340)='0fc5:1227:', 0xa) mmap$IORING_OFF_SQ_RING(0x110c230000, 0x8000002, 0x4, 0x401d031, 0xffffffffffffffff, 0x0) r0 = socket$netlink(0x10, 0x3, 0x4) socket$inet6_tcp(0xa, 0x1, 0x0) fcntl$setstatus(0xffffffffffffffff, 0x4, 0x40800) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000080)=0x7) sched_setaffinity(0x0, 0x8, &(0x7f0000000100)=0x2) sched_setscheduler(0x0, 0x2, &(0x7f0000000200)=0x4) r1 = syz_open_dev$MSR(&(0x7f00000001c0), 0x0, 0x0) read$msr(r1, &(0x7f0000032680)=""/102392, 0x18ff8) bind$netlink(r0, &(0x7f0000000180)={0x10, 0x0, 0x25dfdbfd, 0x1000000}, 0xc) sched_setaffinity(0x0, 0xfffffef7, &(0x7f0000000740)=0x410000002) r2 = openat$ublk_ctrl(0xffffffffffffff9c, &(0x7f0000000000), 0x2, 0x0) r3 = syz_ublk_setup_io_uring(0x20, &(0x7f0000000080)={0x0, 0x0, 0x0, 0x1, 0x2}, &(0x7f0000000040)=0x0, &(0x7f0000000100)=0x0, &(0x7f00000002c0)=0x0) r7 = syz_ublk_add_dev(r3, r4, r5, r6, &(0x7f0000000200)={0x2e, 0xc, 0x0, r2, 0xc0207504, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', {0xffffffff, 0xffff, 0x40, &(0x7f0000000500)=@new_dev={0x3, 0x104}}}, &(0x7f0000000300)) r8 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r8, 0x0, 0x80) r9 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_MSG_GETFLOWTABLE(r9, &(0x7f00000010c0)={0x0, 0x0, &(0x7f0000001080)={&(0x7f00000015c0)={0x20, 0x17, 0xa, 0x301, 0x0, 0x0, {0x2, 0x0, 0x4}, [@NFTA_FLOWTABLE_TABLE={0x9, 0x1, 'syz1\x00'}]}, 0x20}}, 0x4) syz_open_dev$ublk_chdev(&(0x7f0000002000), r7, 0x2) syz_ublk_setup_queues(0xffffffffffffffff, 0x0, &(0x7f0000000180)={0x0, 0xfffffffe, 0x0, 0xfffffffe, 0x1002f6}, &(0x7f0000000800)=[{0x0, 0x0, 0xffffffffffffffff, {0x0, 0xe704, 0x40040, 0x1000002, 0x91}}, {0x0, 0x0, 0xffffffffffffffff, {0x0, 0x5c87, 0x20, 0x3, 0x3aa}}, {0x0, 0x0, 0xffffffffffffffff, {0x0, 0x1f70, 0x2, 0x3ffffffe, 0x337}}, {0x0, 0x0, 0xffffffffffffffff, {0x0, 0x4, 0x200, 0x1, 0xffffffff}}], 0x1, 0x0, 0x0) openat$ptmx(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) executing program 1: prlimit64(0x0, 0xe, &(0x7f0000000140)={0xa, 0x8b}, 0x0) ptrace(0x4207, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000280)=0x8) r0 = getpid() sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x2) sched_setscheduler(r0, 0x2, &(0x7f0000000200)=0x7) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeea, 0x8031, 0xffffffffffffffff, 0x28f43000) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r1, &(0x7f0000000180)=@abs, 0x6e) sendmmsg$unix(r2, 0x0, 0x0, 0x0) recvmmsg(r1, &(0x7f00000000c0), 0x10106, 0x2, 0x0) unshare(0x28000600) r3 = fsopen(&(0x7f00000001c0)='mqueue\x00', 0x0) fsconfig$FSCONFIG_CMD_CREATE(r3, 0x6, 0x0, 0x0, 0x0) fsmount(r3, 0x0, 0x8e) unshare(0x8000280) prlimit64(r0, 0x0, &(0x7f0000000240)={0x0, 0x80}, &(0x7f0000000300)) mprotect(&(0x7f00001a4000/0x1000)=nil, 0x1000, 0x1) munmap(&(0x7f0000002000/0x1000)=nil, 0x1000) close(0xffffffffffffffff) executing program 0: write(0xffffffffffffffff, &(0x7f0000000340)='0fc5:1227:', 0xa) mmap$IORING_OFF_SQ_RING(0x110c230000, 0x8000002, 0x4, 0x401d031, 0xffffffffffffffff, 0x0) r0 = socket$netlink(0x10, 0x3, 0x4) r1 = socket$inet6_tcp(0xa, 0x1, 0x0) bind$inet6(r1, 0x0, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000080)=0x7) r2 = getpid() sched_setaffinity(0x0, 0x8, &(0x7f0000000100)=0x2) sched_setscheduler(r2, 0x2, &(0x7f0000000200)=0x4) r3 = syz_open_dev$MSR(&(0x7f00000001c0), 0x0, 0x0) read$msr(r3, &(0x7f0000032680)=""/102392, 0x18ff8) bind$netlink(r0, &(0x7f0000000180)={0x10, 0x0, 0x25dfdbfd, 0x1000000}, 0xc) sched_setaffinity(0x0, 0xfffffef7, &(0x7f0000000740)=0x410000002) r4 = openat$ublk_ctrl(0xffffffffffffff9c, &(0x7f0000000000), 0x2, 0x0) r5 = syz_ublk_setup_io_uring(0x20, &(0x7f0000000080)={0x0, 0x0, 0x0, 0x1, 0x2}, &(0x7f0000000040)=0x0, &(0x7f0000000100)=0x0, &(0x7f00000002c0)=0x0) r9 = syz_ublk_add_dev(r5, r6, r7, r8, &(0x7f0000000200)={0x2e, 0xc, 0x0, r4, 0xc0207504, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', {0xffffffff, 0xffff, 0x40, &(0x7f0000000500)=@new_dev={0x3, 0x104}}}, &(0x7f0000000300)=0x0) r11 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r11, 0x0, 0x80) r12 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_MSG_GETFLOWTABLE(r12, &(0x7f00000010c0)={0x0, 0x0, &(0x7f0000001080)={&(0x7f00000015c0)={0x20, 0x17, 0xa, 0x301, 0x0, 0x0, {0x2, 0x0, 0x4}, [@NFTA_FLOWTABLE_TABLE={0x9, 0x1, 'syz1\x00'}]}, 0x20}}, 0x4) r13 = syz_open_dev$ublk_chdev(&(0x7f0000002000), r9, 0x2) syz_ublk_setup_queues(r13, r10, &(0x7f0000000340)={0x0, 0x92d1, 0x400, 0x80000002, 0x165}, &(0x7f00000007c0)=[{0x0, 0x0, 0xffffffffffffffff, {0x0, 0x7ec5, 0x8, 0x2, 0x2f8, 0x0, r5}}, {0x0, 0x0, 0xffffffffffffffff, {0x0, 0x7dd8, 0x80, 0x1, 0x80000264, 0x0, r5}}, {0x0, 0x0, 0xffffffffffffffff, {0x0, 0xaa92, 0x8, 0x0, 0x67}}, {0x0, 0x0, 0xffffffffffffffff, {0x0, 0x97fb, 0x400, 0x1, 0x38b}}], 0x4, &(0x7f0000001a40)={0x2e, 0x10, 0x0, r13, 0xc0107520, 0x0, 0x0, 0x0, 0x0, {0x9}, 0x0, 0x0, '\x00', {0x0, 0x81c, 0x0, 0x0}}, &(0x7f0000001ac0)) mmap$IORING_OFF_SQ_RING(0x0, 0xc00000, 0x2000007, 0x401d031, 0xffffffffffffffff, 0x0) syz_ublk_setup_queues(r14, 0x0, &(0x7f0000000180)={0x0, 0xfffffffe, 0x0, 0xfffffffe, 0x1002f6}, &(0x7f0000000800)=[{0x0, 0x0, 0xffffffffffffffff, {0x0, 0xe704, 0x40040, 0x1000002, 0x91}}, {0x0, 0x0, 0xffffffffffffffff, {0x0, 0x5c87, 0x20, 0x3, 0x3aa}}, {0x0, 0x0, 0xffffffffffffffff, {0x0, 0x1f70, 0x2, 0x3ffffffe, 0x337}}, {0x0, 0x0, 0xffffffffffffffff, {0x0, 0x4, 0x200, 0x1, 0xffffffff}}], 0x1, 0x0, 0x0) openat$ptmx(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) executing program 0: r0 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$nl_generic(r0, &(0x7f00000000c0)={0x0, 0x0, &(0x7f00000003c0)={&(0x7f0000000b40)=ANY=[], 0x34}}, 0x4000) ioctl$BTRFS_IOC_START_SYNC(r0, 0x80089418, &(0x7f0000000000)) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000380)={0x8, 0x100008b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000200)=0x5) openat$sequencer(0xffffffffffffff9c, &(0x7f0000000300), 0x80200, 0x0) r1 = syz_open_dev$sndmidi(&(0x7f00000004c0), 0x2, 0x141102) writev(r1, &(0x7f0000000840)=[{&(0x7f00000002c0)="94", 0xf000}, {0x0}], 0x2) socket$inet6_sctp(0xa, 0x1, 0x84) ioctl$IOCTL_VMCI_VERSION2(0xffffffffffffffff, 0x7a7, 0x0) bind$alg(0xffffffffffffffff, &(0x7f0000000040)={0x26, 'skcipher\x00', 0x0, 0x0, 'xts(aes)\x00'}, 0x58) mkdirat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000)='./cgroup/syz0\x00', 0x1ff) r2 = openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000), 0x200002, 0x0) r3 = openat$cgroup_type(r2, &(0x7f0000000100), 0x2, 0x0) write$cgroup_type(r3, &(0x7f0000000280), 0x9) r4 = openat$cgroup_procs(r2, &(0x7f00000002c0)='cgroup.threads\x00', 0x2, 0x0) write$cgroup_pid(r4, &(0x7f0000000c40), 0x12) r5 = openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000), 0x200002, 0x0) r6 = openat$cgroup_ro(r5, &(0x7f0000000040)='cgroup.freeze\x00', 0x275a, 0x0) syz_io_uring_setup(0xefd, &(0x7f0000000300)={0x0, 0x0, 0x10000, 0x3, 0x55}, &(0x7f0000000100)=0x0, &(0x7f0000000140)=0x0, &(0x7f0000000080)=0x0) syz_io_uring_submit(r7, r8, r9, &(0x7f00000001c0)=@IORING_OP_FIXED_FD_INSTALL={0x36, 0x6, 0x0, r5, 0x0, 0x0, 0x0, 0x1, 0x1}) write$cgroup_int(r6, &(0x7f0000000200)=0x1, 0x12) seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0x0, &(0x7f0000000040)={0x1, &(0x7f0000000000)=[{0x6, 0x0, 0x0, 0x7fff7ffc}]}) syz_ublk_setup_io_uring(0x1d, &(0x7f0000000040)={0x0, 0x30b5, 0x1, 0x2, 0x158}, &(0x7f0000000100), &(0x7f0000000280), &(0x7f0000000140)) socket$inet6_tcp(0xa, 0x1, 0x0) executing program 3: write(0xffffffffffffffff, 0x0, 0x0) r0 = socket$netlink(0x10, 0x3, 0x4) r1 = socket$inet6_tcp(0xa, 0x1, 0x0) bind$inet6(r1, 0x0, 0x0) fcntl$setstatus(0xffffffffffffffff, 0x4, 0x40800) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000080)=0x7) sched_setaffinity(0x0, 0x8, &(0x7f0000000100)=0x2) sched_setscheduler(0x0, 0x2, &(0x7f0000000200)=0x4) r2 = syz_open_dev$MSR(&(0x7f00000001c0), 0x0, 0x0) read$msr(r2, &(0x7f0000032680)=""/102392, 0x18ff8) bind$netlink(r0, &(0x7f0000000180)={0x10, 0x0, 0x25dfdbfd, 0x1000000}, 0xc) sched_setaffinity(0x0, 0xfffffef7, &(0x7f0000000740)=0x410000002) r3 = openat$ublk_ctrl(0xffffffffffffff9c, &(0x7f0000000000), 0x2, 0x0) syz_ublk_add_dev(0xffffffffffffffff, 0x0, 0x0, 0x0, &(0x7f0000000200)={0x2e, 0xc, 0x0, r3, 0xc0207504, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', {0xffffffff, 0xffff, 0x40, &(0x7f0000000500)=@new_dev={0x3, 0x104}}}, &(0x7f0000000300)) r4 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r4, 0x0, 0x80) r5 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_MSG_GETFLOWTABLE(r5, &(0x7f00000010c0)={0x0, 0x0, &(0x7f0000001080)={&(0x7f00000015c0)={0x20, 0x17, 0xa, 0x301, 0x0, 0x0, {0x2, 0x0, 0x4}, [@NFTA_FLOWTABLE_TABLE={0x9, 0x1, 'syz1\x00'}]}, 0x20}}, 0x4) executing program 2: write(0xffffffffffffffff, &(0x7f0000000340)='0fc5:1227:', 0xa) mmap$IORING_OFF_SQ_RING(0x110c230000, 0x8000002, 0x4, 0x401d031, 0xffffffffffffffff, 0x0) bind$inet6(0xffffffffffffffff, 0x0, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) sched_setaffinity(0x0, 0x8, &(0x7f0000000100)=0x2) sched_setscheduler(0x0, 0x2, &(0x7f0000000200)=0x4) r0 = syz_open_dev$MSR(&(0x7f00000001c0), 0x0, 0x0) read$msr(r0, &(0x7f0000032680)=""/102392, 0x18ff8) bind$netlink(0xffffffffffffffff, &(0x7f0000000180)={0x10, 0x0, 0x25dfdbfd, 0x1000000}, 0xc) sched_setaffinity(0x0, 0xfffffef7, &(0x7f0000000740)=0x410000002) r1 = syz_ublk_setup_io_uring(0x20, &(0x7f0000000080)={0x0, 0x0, 0x0, 0x1, 0x2}, &(0x7f0000000040)=0x0, &(0x7f0000000100)=0x0, &(0x7f00000002c0)=0x0) r5 = syz_ublk_add_dev(r1, r2, r3, r4, &(0x7f0000000200)={0x2e, 0xc, 0x0, 0xffffffffffffffff, 0xc0207504, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', {0xffffffff, 0xffff, 0x40, &(0x7f0000000500)=@new_dev={0x3, 0x104}}}, &(0x7f0000000300)=0x0) sendmsg$NFT_BATCH(0xffffffffffffffff, 0x0, 0x80) r7 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_MSG_GETFLOWTABLE(r7, &(0x7f00000010c0)={0x0, 0x0, &(0x7f0000001080)={&(0x7f00000015c0)={0x20, 0x17, 0xa, 0x301, 0x0, 0x0, {0x2, 0x0, 0x4}, [@NFTA_FLOWTABLE_TABLE={0x9, 0x1, 'syz1\x00'}]}, 0x20}}, 0x4) r8 = syz_open_dev$ublk_chdev(&(0x7f0000002000), r5, 0x2) syz_ublk_setup_queues(r8, r6, &(0x7f0000000340)={0x0, 0x92d1, 0x400, 0x80000002, 0x165}, &(0x7f00000007c0)=[{0x0, 0x0, 0xffffffffffffffff, {0x0, 0x7ec5, 0x8, 0x2, 0x2f8, 0x0, r1}}, {0x0, 0x0, 0xffffffffffffffff, {0x0, 0x7dd8, 0x80, 0x1, 0x80000264, 0x0, r1}}, {0x0, 0x0, 0xffffffffffffffff, {0x0, 0xaa92, 0x8, 0x0, 0x67}}, {0x0, 0x0, 0xffffffffffffffff, {0x0, 0x97fb, 0x400, 0x1, 0x38b}}], 0x4, &(0x7f0000001a40)={0x2e, 0x10, 0x0, r8, 0xc0107520, 0x0, 0x0, 0x0, 0x0, {0x9}, 0x0, 0x0, '\x00', {0x0, 0x81c, 0x0, 0x0}}, &(0x7f0000001ac0)) syz_ublk_setup_queues(r9, 0x0, &(0x7f0000000180)={0x0, 0xfffffffe, 0x0, 0xfffffffe, 0x1002f6}, &(0x7f0000000800)=[{0x0, 0x0, 0xffffffffffffffff, {0x0, 0xe704, 0x40040, 0x1000002, 0x91}}, {0x0, 0x0, 0xffffffffffffffff, {0x0, 0x5c87, 0x20, 0x3, 0x3aa}}, {0x0, 0x0, 0xffffffffffffffff, {0x0, 0x1f70, 0x2, 0x3ffffffe, 0x337}}, {0x0, 0x0, 0xffffffffffffffff, {0x0, 0x4, 0x200, 0x1, 0xffffffff}}], 0x1, 0x0, 0x0) openat$ptmx(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) executing program 1: socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000180)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$KVM_SET_REGS(0xffffffffffffffff, 0x4090ae82, &(0x7f0000000380)={[0xb, 0x6, 0x6, 0x4004, 0x2, 0x4, 0xefffffffffffffff, 0x0, 0x0, 0x2000000, 0x20000, 0x1c, 0x0, 0x5], 0x0, 0x41981}) pipe(&(0x7f0000000040)={0xffffffffffffffff, 0xffffffffffffffff}) splice(r1, 0x0, r3, 0x0, 0x8000f28, 0x0) splice(r2, 0x0, r1, 0x0, 0x8, 0xe) write(r0, 0x0, 0x0) mmap(&(0x7f0000000000/0xfbe000)=nil, 0xfbe000, 0x1000002, 0x4012831, 0xffffffffffffffff, 0x0) r4 = syz_open_procfs(0x0, 0x0) mprotect(&(0x7f0000000000/0x3000)=nil, 0x3000, 0x1) lseek(r4, 0x2004, 0x0) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbee2, 0x8031, 0xffffffffffffffff, 0x0) executing program 3: prlimit64(0x0, 0xe, &(0x7f0000000140)={0x9, 0xff}, 0x0) setrlimit(0xd, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000380)=0x7) r0 = getpid() sched_setscheduler(r0, 0x1, &(0x7f00000000c0)=0x7) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000240)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r1, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r2, &(0x7f0000000000), 0x651, 0x0) recvmmsg(r1, &(0x7f00000000c0), 0x10106, 0x2, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000000)=0x6) sendmsg$nl_generic(0xffffffffffffffff, &(0x7f0000000100)={0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x4000002}, 0x4000080) r3 = socket$inet_smc(0x2b, 0x1, 0x0) ioctl$int_in(r3, 0x5421, &(0x7f0000000100)=0x100000001) setsockopt$inet_tcp_int(r3, 0x6, 0x1e, &(0x7f0000000180)=0x1, 0x4) connect$inet(r3, &(0x7f0000000480)={0x2, 0x4e20, @dev={0xac, 0x14, 0x14, 0xbc}}, 0x10) socketpair$unix(0x1, 0x5, 0x0, 0x0) close(r3) executing program 2: r0 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000040)='cgroup.kill\x00', 0x275a, 0x0) inotify_init1(0x800) pipe(&(0x7f00000001c0)) mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./sys\x00', 0x1ff) mount(0x0, &(0x7f0000000000)='./sys\x00', &(0x7f0000000100)='sysfs\x00', 0x0, 0x0) r1 = openat(0xffffffffffffff9c, &(0x7f0000000200)='./sys/bus/pci/devices/0000:00:00.0/remove\x00', 0x1, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000140)={0xa, 0x8b}, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000280)=0x8) r2 = getpid() sched_setaffinity(0x0, 0x0, 0x0) sched_setscheduler(r2, 0x2, &(0x7f0000000200)=0x7) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeea, 0x8031, 0xffffffffffffffff, 0x28f43000) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$TIOCSPGRP(r1, 0x5410, &(0x7f0000000240)=r2) connect$unix(r3, &(0x7f0000000180)=@abs, 0x6e) sendmmsg$unix(r4, &(0x7f0000000000), 0x651, 0x0) recvmmsg(r3, &(0x7f00000000c0), 0x10106, 0x2, 0x0) mmap$IORING_OFF_SQ_RING(0x110c230000, 0x8000002, 0x2000007, 0x401d031, 0xffffffffffffffff, 0x0) write(r1, &(0x7f0000000300)='1', 0x1) r5 = openat(0xffffffffffffff9c, &(0x7f0000000080)='./sys/bus/pci/rescan\x00', 0x1, 0x0) write(r5, &(0x7f0000000300)='1', 0x1) mkdirat(0xffffffffffffff9c, 0x0, 0x1ff) timer_create(0x0, 0x0, &(0x7f0000000300)) mprotect(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x5) fcntl$lock(r0, 0x6, &(0x7f0000000080)={0x1, 0x1}) fcntl$lock(r0, 0x7, &(0x7f0000000000)={0x0, 0x2, 0x600000000000000, 0x1d}) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000000)) executing program 0: r0 = socket$netlink(0x10, 0x3, 0x6) bind$netlink(r0, &(0x7f0000514ff4)={0x10, 0x0, 0x0, 0x2ffffffff}, 0xc) r1 = socket$inet_sctp(0x2, 0x1, 0x84) setsockopt$IP_VS_SO_SET_ADD(r1, 0x0, 0x482, &(0x7f0000000080)={0x84, @broadcast, 0x15, 0x3, 'lblcr\x00', 0xa, 0x4, 0x72}, 0x2c) r2 = socket$kcm(0xa, 0x2, 0x0) sendmsg$sock(r2, &(0x7f0000000400)={&(0x7f0000000580)=@in6={0x2, 0x4e22, 0x0, @dev}, 0x80, 0x0, 0x0, &(0x7f0000000000)=[@mark={{0x14, 0x1, 0x24, 0x3}}], 0x18}, 0x0) r3 = socket$inet6_tcp(0xa, 0x1, 0x0) bind$inet6(r3, &(0x7f0000000280)={0xa, 0x4e22, 0x9, @loopback, 0x3e}, 0x1c) connect$inet6(r3, &(0x7f0000000140)={0xa, 0x4e22, 0x56202329, @empty, 0x4000005}, 0x1c) r4 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r4, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000000200)=@newsa={0x158, 0x10, 0x5, 0x1, 0x0, {{@in6=@loopback, @in6=@loopback, 0x0, 0x0, 0x0, 0x0, 0xa, 0x80, 0x80, 0x0, 0x0, 0x80}, {@in6=@loopback, 0x1234, 0x33}, @in6=@loopback, {0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff}, {0x0, 0x0, 0x0, 0x1}, {}, 0x0, 0x0, 0xa, 0x0, 0x0, 0x80}, [@algo_auth={0x48, 0x1, {{'hmac(sha1)\x00'}}}, @replay_esn_val={0x20, 0x17, {0x1, 0x0, 0x0, 0x2, 0x4000, 0x20, [0x0]}}]}, 0x158}}, 0x0) sendmsg$nl_xfrm(r4, &(0x7f0000000300)={0x0, 0x0, &(0x7f0000000400)={&(0x7f0000000500)=@newpolicy={0xfc, 0x13, 0x5, 0x1, 0x0, {{@in6=@loopback, @in6=@loopback, 0x0, 0x0, 0x0, 0x0, 0xa, 0x80, 0x80}, {0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff}, {}, 0x0, 0x0, 0x1}, [@tmpl={0x44, 0x5, [{{@in6=@loopback, 0x1234, 0x33}, 0xa, @in6=@loopback}]}]}, 0xfc}}, 0x0) syz_open_procfs(0xffffffffffffffff, 0x0) bpf$MAP_CREATE(0x0, &(0x7f0000000640)=ANY=[@ANYBLOB="160000000000000004000000"], 0x48) mmap(&(0x7f0000000000/0xff5000)=nil, 0xff5000, 0x1000002, 0x200000005c831, 0xffffffffffffffff, 0x0) openat$sequencer2(0xffffffffffffff9c, &(0x7f0000000080), 0x0, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000380)={0x8, 0x100008b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000000)=0x7) r5 = syz_open_dev$sndmidi(&(0x7f00000004c0), 0x2, 0x143102) writev(r5, &(0x7f0000000840)=[{&(0x7f00000002c0)="94", 0xf000}, {0x0}], 0x2) remap_file_pages(&(0x7f0000800000/0x800000)=nil, 0x800000, 0x0, 0x0, 0x0) madvise(&(0x7f0000400000/0xc00000)=nil, 0xc00000, 0x9) bpf$PROG_LOAD(0x5, 0x0, 0x0) syz_open_procfs(0x0, &(0x7f0000000000)='fd/3\x00') ioctl$PPPIOCNEWUNIT(0xffffffffffffffff, 0xc004743e, &(0x7f0000000140)) splice(0xffffffffffffffff, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x2) openat$vhost_vsock(0xffffffffffffff9c, &(0x7f0000000040), 0x2, 0x0) sendmmsg$inet6(r3, &(0x7f00000000c0)=[{{0x0, 0x0, &(0x7f0000000180)=[{&(0x7f0000000680)='A', 0x1}], 0x1}}], 0x1, 0x4000801) executing program 3: r0 = openat$uinput(0xffffffffffffff9c, &(0x7f0000000040), 0x802, 0x0) write$uinput_user_dev(r0, &(0x7f0000000800)={'syz0\x00', {0x2, 0x10, 0x2, 0x4}, 0xf, [0x1, 0x0, 0x0, 0x40000, 0x1, 0x2, 0x4, 0x0, 0x4, 0x0, 0x0, 0x0, 0xfffffffd, 0x0, 0x0, 0x0, 0x4000, 0x20, 0x400, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffd, 0x0, 0x0, 0x2, 0x0, 0x1, 0x2, 0x0, 0x0, 0x7, 0x1, 0x0, 0x0, 0xfffffffe, 0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x29a, 0x1, 0x0, 0x0, 0x0, 0x2000, 0x0, 0xfffffffc, 0x0, 0x0, 0x0, 0x6, 0x0, 0x0, 0x6, 0x5f1, 0x6], [0x0, 0x0, 0x8, 0x0, 0x0, 0x5, 0x0, 0x80, 0x8000, 0x2, 0x9, 0x0, 0x2, 0x0, 0x0, 0x0, 0xfffffffc, 0x0, 0x200, 0x7, 0xfffffffc, 0x0, 0x0, 0x7, 0x0, 0xfffffffc, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffe, 0x3, 0x0, 0xd, 0x0, 0x2, 0x0, 0x3, 0x5, 0xfffffffd, 0x4000000, 0xfffffffd, 0x0, 0x0, 0x0, 0x0, 0x80000, 0x0, 0xfffffffd, 0x0, 0x8, 0x0, 0x0, 0x8, 0x0, 0x0, 0x4, 0xffff], [0x4, 0xfc, 0x0, 0x4, 0x0, 0x0, 0x0, 0x0, 0xb, 0x1, 0x4000000, 0x0, 0x1, 0x4, 0x1000, 0x80, 0x0, 0x200, 0x0, 0xffffffff, 0x400000, 0xfffffffc, 0x0, 0xfffffffd, 0xffffffff, 0x0, 0x0, 0xfffffffd, 0x0, 0x0, 0x20, 0x4, 0x0, 0x0, 0xfffffffe, 0x1, 0x0, 0x18c, 0x0, 0x6, 0x1, 0x0, 0xbda6, 0xe, 0x0, 0x0, 0xfffffffd, 0xffffffff, 0x0, 0x20, 0x100, 0x0, 0x0, 0x204, 0x0, 0x0, 0x4000, 0xfff, 0x6, 0x0, 0x0, 0x0, 0x0, 0x8], [0x40000000, 0x0, 0x74e2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7, 0x40, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffe, 0x0, 0x0, 0x402, 0x40, 0x0, 0x0, 0xbd, 0x0, 0xff, 0x0, 0x0, 0x0, 0x2, 0xc9, 0x0, 0x8, 0x9, 0x0, 0x0, 0xffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x101, 0x80000020, 0x0, 0x0, 0x0, 0x0, 0x40000000, 0x5cb9, 0xcaa, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x4]}, 0x45c) ioctl$UI_DEV_CREATE(r0, 0x5501) ioctl$UI_GET_SYSNAME(r0, 0x8040552c, 0x0) executing program 1: socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000180)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$KVM_SET_REGS(0xffffffffffffffff, 0x4090ae82, &(0x7f0000000380)={[0xb, 0x6, 0x6, 0x4004, 0x2, 0x4, 0xefffffffffffffff, 0x0, 0x0, 0x2000000, 0x20000, 0x1c, 0x0, 0x5], 0x0, 0x41981}) pipe(&(0x7f0000000040)={0xffffffffffffffff, 0xffffffffffffffff}) splice(r1, 0x0, r3, 0x0, 0x8000f28, 0x0) splice(r2, 0x0, r1, 0x0, 0x8, 0xe) write(r0, 0x0, 0x0) mmap(&(0x7f0000000000/0xfbe000)=nil, 0xfbe000, 0x1000002, 0x4012831, 0xffffffffffffffff, 0x0) r4 = syz_open_procfs(0x0, 0x0) mprotect(&(0x7f0000000000/0x3000)=nil, 0x3000, 0x1) lseek(r4, 0x2004, 0x0) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbee2, 0x8031, 0xffffffffffffffff, 0x0) executing program 3: openat$hwrng(0xffffffffffffff9c, &(0x7f0000000300), 0x0, 0x0) bpf$BPF_BTF_GET_NEXT_ID(0x17, 0x0, 0x0) bpf$BPF_GET_BTF_INFO(0xf, &(0x7f0000000000)={0xffffffffffffffff, 0x0, 0x0}, 0x10) socketpair$nbd(0x1, 0x1, 0x0, 0x0) r0 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000040)='memory.current\x00', 0x275a, 0x0) ioctl$sock_inet_SIOCADDRT(0xffffffffffffffff, 0x890b, &(0x7f0000000040)={0x0, {0x2, 0x4e24, @dev={0xac, 0x14, 0x14, 0x2b}}, {0x2, 0x4e23, @multicast2}, {0x2, 0x4e21, @initdev={0xac, 0x1e, 0x0, 0x0}}, 0xfd, 0x0, 0x0, 0x0, 0x7, &(0x7f0000000000)='veth0_virt_wifi\x00', 0x80000001, 0x1, 0x9}) write$binfmt_script(r0, &(0x7f00000004c0), 0x208e24b) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x2, 0x28012, r0, 0x0) bpf$PROG_LOAD(0x5, &(0x7f000000e000)={0xe, 0x4, 0x0, &(0x7f0000000100)='GPL\x00', 0x5, 0xc3, &(0x7f000000cf3d)=""/195, 0x0, 0x0, '\x00', 0x0, @sk_skb, 0xffffffffffffffff, 0x8, &(0x7f00000000c0), 0x8, 0x10, &(0x7f0000000000), 0x10}, 0x94) r1 = openat$ppp(0xffffffffffffff9c, 0x0, 0xc0802, 0x0) ioctl$PPPIOCNEWUNIT(r1, 0xc004743e, &(0x7f00000000c0)) r2 = socket$key(0xf, 0x3, 0x2) r3 = syz_open_procfs(0xffffffffffffffff, &(0x7f00000004c0)='setgroups\x00') writev(r3, 0x0, 0x0) sendmsg$key(r2, &(0x7f00000014c0)={0x0, 0x0, &(0x7f0000000140)={0x0}}, 0x0) madvise(&(0x7f0000000000/0x600000)=nil, 0x600003, 0x15) r4 = openat$procfs(0xffffffffffffff9c, &(0x7f0000000040)='/proc/diskstats\x00', 0x0, 0x0) sendfile(0xffffffffffffffff, r4, 0x0, 0x20c3) pipe2(&(0x7f0000000340)={0xffffffffffffffff, 0xffffffffffffffff}, 0x80000) write$tun(r6, &(0x7f0000000100)={@void, @void, @eth={@remote, @empty, @void, {@mpls_uc={0x8847, {[{0xffffb, 0x0, 0x1}], @ipv6=@gre_packet={0x6, 0x6, 'K\x00', 0x44, 0x2f, 0x1, @mcast1, @dev={0xfe, 0x80, '\x00', 0x36}, {[], {{}, {0x1, 0x0, 0x1, 0x1}, {0x1}, {0x8, 0x88be, 0x4, {{0x1, 0x1, 0xe, 0x1, 0x0, 0x1, 0x1, 0x4}, 0x1, {0xffffffff}}}, {0x8, 0x22eb, 0x0, {{0x3, 0x2, 0x2, 0x2, 0x0, 0x2, 0x3, 0x63}, 0x2, {0x715, 0x1, 0x2, 0x13, 0x0, 0x0, 0x2, 0x0, 0x1}}}}}}}}}}}, 0x7e) read$FUSE(r5, &(0x7f0000002180)={0x2020}, 0x2020) executing program 0: r0 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000040)='cgroup.kill\x00', 0x275a, 0x0) inotify_init1(0x800) pipe(&(0x7f00000001c0)) mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./sys\x00', 0x1ff) mount(0x0, &(0x7f0000000000)='./sys\x00', &(0x7f0000000100)='sysfs\x00', 0x0, 0x0) r1 = openat(0xffffffffffffff9c, &(0x7f0000000200)='./sys/bus/pci/devices/0000:00:00.0/remove\x00', 0x1, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000140)={0xa, 0x8b}, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000280)=0x8) r2 = getpid() sched_setaffinity(0x0, 0x0, 0x0) sched_setscheduler(r2, 0x2, &(0x7f0000000200)=0x7) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeea, 0x8031, 0xffffffffffffffff, 0x28f43000) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$TIOCSPGRP(r1, 0x5410, &(0x7f0000000240)=r2) connect$unix(r3, &(0x7f0000000180)=@abs, 0x6e) sendmmsg$unix(r4, &(0x7f0000000000), 0x651, 0x0) recvmmsg(r3, &(0x7f00000000c0), 0x10106, 0x2, 0x0) mmap$IORING_OFF_SQ_RING(0x110c230000, 0x8000002, 0x2000007, 0x401d031, 0xffffffffffffffff, 0x0) write(r1, &(0x7f0000000300)='1', 0x1) r5 = openat(0xffffffffffffff9c, &(0x7f0000000080)='./sys/bus/pci/rescan\x00', 0x1, 0x0) write(r5, &(0x7f0000000300)='1', 0x1) mkdirat(0xffffffffffffff9c, 0x0, 0x1ff) timer_create(0x0, &(0x7f00000000c0)={0x0, 0x21, 0x2}, 0x0) mprotect(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x5) fcntl$lock(r0, 0x6, &(0x7f0000000080)={0x1, 0x1}) fcntl$lock(r0, 0x7, &(0x7f0000000000)={0x0, 0x2, 0x600000000000000, 0x1d}) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000000)) executing program 2: write(0xffffffffffffffff, &(0x7f0000000340)='0fc5:1227:', 0xa) mmap$IORING_OFF_SQ_RING(0x110c230000, 0x8000002, 0x4, 0x401d031, 0xffffffffffffffff, 0x0) r0 = socket$netlink(0x10, 0x3, 0x4) socket$inet6_tcp(0xa, 0x1, 0x0) fcntl$setstatus(0xffffffffffffffff, 0x4, 0x40800) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000080)=0x7) r1 = getpid() sched_setaffinity(0x0, 0x8, &(0x7f0000000100)=0x2) sched_setscheduler(r1, 0x2, &(0x7f0000000200)=0x4) r2 = syz_open_dev$MSR(&(0x7f00000001c0), 0x0, 0x0) read$msr(r2, &(0x7f0000032680)=""/102392, 0x18ff8) bind$netlink(r0, &(0x7f0000000180)={0x10, 0x0, 0x25dfdbfd, 0x1000000}, 0xc) sched_setaffinity(0x0, 0xfffffef7, &(0x7f0000000740)=0x410000002) r3 = openat$ublk_ctrl(0xffffffffffffff9c, &(0x7f0000000000), 0x2, 0x0) r4 = syz_ublk_setup_io_uring(0x20, &(0x7f0000000080)={0x0, 0x0, 0x0, 0x1, 0x2}, &(0x7f0000000040)=0x0, &(0x7f0000000100)=0x0, &(0x7f00000002c0)=0x0) r8 = syz_ublk_add_dev(r4, r5, r6, r7, &(0x7f0000000200)={0x2e, 0xc, 0x0, r3, 0xc0207504, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', {0xffffffff, 0xffff, 0x40, &(0x7f0000000500)=@new_dev={0x3, 0x104}}}, &(0x7f0000000300)=0x0) r10 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r10, 0x0, 0x80) r11 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_MSG_GETFLOWTABLE(r11, &(0x7f00000010c0)={0x0, 0x0, &(0x7f0000001080)={&(0x7f00000015c0)={0x20, 0x17, 0xa, 0x301, 0x0, 0x0, {0x2, 0x0, 0x4}, [@NFTA_FLOWTABLE_TABLE={0x9, 0x1, 'syz1\x00'}]}, 0x20}}, 0x4) r12 = syz_open_dev$ublk_chdev(&(0x7f0000002000), r8, 0x2) syz_ublk_setup_queues(r12, r9, &(0x7f0000000340)={0x0, 0x92d1, 0x400, 0x80000002, 0x165}, &(0x7f00000007c0)=[{0x0, 0x0, 0xffffffffffffffff, {0x0, 0x7ec5, 0x8, 0x2, 0x2f8, 0x0, r4}}, {0x0, 0x0, 0xffffffffffffffff, {0x0, 0x7dd8, 0x80, 0x1, 0x80000264, 0x0, r4}}, {0x0, 0x0, 0xffffffffffffffff, {0x0, 0xaa92, 0x8, 0x0, 0x67}}, {0x0, 0x0, 0xffffffffffffffff, {0x0, 0x97fb, 0x400, 0x1, 0x38b}}], 0x4, &(0x7f0000001a40)={0x2e, 0x10, 0x0, r12, 0xc0107520, 0x0, 0x0, 0x0, 0x0, {0x9}, 0x0, 0x0, '\x00', {0x0, 0x81c, 0x0, 0x0}}, &(0x7f0000001ac0)) mmap$IORING_OFF_SQ_RING(0x0, 0xc00000, 0x2000007, 0x401d031, 0xffffffffffffffff, 0x0) syz_ublk_setup_queues(r13, 0x0, &(0x7f0000000180)={0x0, 0xfffffffe, 0x0, 0xfffffffe, 0x1002f6}, &(0x7f0000000800)=[{0x0, 0x0, 0xffffffffffffffff, {0x0, 0xe704, 0x40040, 0x1000002, 0x91}}, {0x0, 0x0, 0xffffffffffffffff, {0x0, 0x5c87, 0x20, 0x3, 0x3aa}}, {0x0, 0x0, 0xffffffffffffffff, {0x0, 0x1f70, 0x2, 0x3ffffffe, 0x337}}, {0x0, 0x0, 0xffffffffffffffff, {0x0, 0x4, 0x200, 0x1, 0xffffffff}}], 0x1, 0x0, 0x0) openat$ptmx(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) executing program 2: write(0xffffffffffffffff, &(0x7f0000000340)='0fc5:1227:', 0xa) mmap$IORING_OFF_SQ_RING(0x110c230000, 0x8000002, 0x4, 0x401d031, 0xffffffffffffffff, 0x0) r0 = socket$netlink(0x10, 0x3, 0x4) socket$inet6_tcp(0xa, 0x1, 0x0) fcntl$setstatus(0xffffffffffffffff, 0x4, 0x40800) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000080)=0x7) sched_setaffinity(0x0, 0x8, &(0x7f0000000100)=0x2) sched_setscheduler(0x0, 0x2, &(0x7f0000000200)=0x4) r1 = syz_open_dev$MSR(&(0x7f00000001c0), 0x0, 0x0) read$msr(r1, &(0x7f0000032680)=""/102392, 0x18ff8) bind$netlink(r0, &(0x7f0000000180)={0x10, 0x0, 0x25dfdbfd, 0x1000000}, 0xc) sched_setaffinity(0x0, 0xfffffef7, &(0x7f0000000740)=0x410000002) r2 = openat$ublk_ctrl(0xffffffffffffff9c, &(0x7f0000000000), 0x2, 0x0) r3 = syz_ublk_setup_io_uring(0x20, &(0x7f0000000080)={0x0, 0x0, 0x0, 0x1, 0x2}, &(0x7f0000000040)=0x0, &(0x7f0000000100)=0x0, &(0x7f00000002c0)=0x0) r7 = syz_ublk_add_dev(r3, r4, r5, r6, &(0x7f0000000200)={0x2e, 0xc, 0x0, r2, 0xc0207504, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', {0xffffffff, 0xffff, 0x40, &(0x7f0000000500)=@new_dev={0x3, 0x104}}}, &(0x7f0000000300)) r8 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r8, 0x0, 0x80) r9 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_MSG_GETFLOWTABLE(r9, &(0x7f00000010c0)={0x0, 0x0, &(0x7f0000001080)={&(0x7f00000015c0)={0x20, 0x17, 0xa, 0x301, 0x0, 0x0, {0x2, 0x0, 0x4}, [@NFTA_FLOWTABLE_TABLE={0x9, 0x1, 'syz1\x00'}]}, 0x20}}, 0x4) syz_open_dev$ublk_chdev(&(0x7f0000002000), r7, 0x2) syz_ublk_setup_queues(0xffffffffffffffff, 0x0, &(0x7f0000000180)={0x0, 0xfffffffe, 0x0, 0xfffffffe, 0x1002f6}, &(0x7f0000000800)=[{0x0, 0x0, 0xffffffffffffffff, {0x0, 0xe704, 0x40040, 0x1000002, 0x91}}, {0x0, 0x0, 0xffffffffffffffff, {0x0, 0x5c87, 0x20, 0x3, 0x3aa}}, {0x0, 0x0, 0xffffffffffffffff, {0x0, 0x1f70, 0x2, 0x3ffffffe, 0x337}}, {0x0, 0x0, 0xffffffffffffffff, {0x0, 0x4, 0x200, 0x1, 0xffffffff}}], 0x1, 0x0, 0x0) openat$ptmx(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) executing program 0: prlimit64(0x0, 0xe, &(0x7f0000000140)={0xa, 0x8b}, 0x0) ptrace(0x4207, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000280)=0x8) r0 = getpid() sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x2) sched_setscheduler(r0, 0x2, &(0x7f0000000200)=0x7) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeea, 0x8031, 0xffffffffffffffff, 0x28f43000) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r1, &(0x7f0000000180)=@abs, 0x6e) sendmmsg$unix(r2, 0x0, 0x0, 0x0) recvmmsg(r1, &(0x7f00000000c0), 0x10106, 0x2, 0x0) unshare(0x28000600) r3 = fsopen(&(0x7f00000001c0)='mqueue\x00', 0x0) fsconfig$FSCONFIG_CMD_CREATE(r3, 0x6, 0x0, 0x0, 0x0) fsmount(r3, 0x0, 0x8e) unshare(0x8000280) prlimit64(r0, 0x0, &(0x7f0000000240)={0x0, 0x80}, &(0x7f0000000300)) mprotect(&(0x7f00001a4000/0x1000)=nil, 0x1000, 0x1) munmap(&(0x7f0000002000/0x1000)=nil, 0x1000) close(0xffffffffffffffff) executing program 2: write(0xffffffffffffffff, 0x0, 0x0) r0 = socket$netlink(0x10, 0x3, 0x4) r1 = socket$inet6_tcp(0xa, 0x1, 0x0) bind$inet6(r1, 0x0, 0x0) fcntl$setstatus(0xffffffffffffffff, 0x4, 0x40800) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000080)=0x7) sched_setaffinity(0x0, 0x8, &(0x7f0000000100)=0x2) sched_setscheduler(0x0, 0x2, &(0x7f0000000200)=0x4) r2 = syz_open_dev$MSR(&(0x7f00000001c0), 0x0, 0x0) read$msr(r2, &(0x7f0000032680)=""/102392, 0x18ff8) bind$netlink(r0, &(0x7f0000000180)={0x10, 0x0, 0x25dfdbfd, 0x1000000}, 0xc) sched_setaffinity(0x0, 0xfffffef7, &(0x7f0000000740)=0x410000002) r3 = openat$ublk_ctrl(0xffffffffffffff9c, &(0x7f0000000000), 0x2, 0x0) syz_ublk_add_dev(0xffffffffffffffff, 0x0, 0x0, 0x0, &(0x7f0000000200)={0x2e, 0xc, 0x0, r3, 0xc0207504, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', {0xffffffff, 0xffff, 0x40, &(0x7f0000000500)=@new_dev={0x3, 0x104}}}, &(0x7f0000000300)) r4 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r4, 0x0, 0x80) r5 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_MSG_GETFLOWTABLE(r5, &(0x7f00000010c0)={0x0, 0x0, &(0x7f0000001080)={&(0x7f00000015c0)={0x20, 0x17, 0xa, 0x301, 0x0, 0x0, {0x2, 0x0, 0x4}, [@NFTA_FLOWTABLE_TABLE={0x9, 0x1, 'syz1\x00'}]}, 0x20}}, 0x4) executing program 3: prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000080)=0x8) sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x2) r0 = getpid() bpf$MAP_GET_NEXT_KEY(0x4, 0x0, 0x0) rseq(0x0, 0xfde1, 0x0, 0x0) sched_setscheduler(r0, 0x1, &(0x7f0000000100)=0x5) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000001480)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r1, &(0x7f00000004c0)=@file={0x0, './file0\x00'}, 0x6e) sendmmsg$unix(r2, &(0x7f00000bd000), 0x318, 0x0) sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x2) socket$inet_tcp(0x2, 0x1, 0x0) mremap(&(0x7f0000a96000/0x1000)=nil, 0x1000, 0x400000, 0x3, &(0x7f0000000000/0x400000)=nil) socket$inet_udp(0x2, 0x2, 0x0) r3 = io_uring_setup(0xa2, &(0x7f0000000080)={0x0, 0x592c, 0x2, 0xfffffffc, 0x2}) io_uring_register$IORING_REGISTER_BUFFERS_UPDATE(r3, 0x10, &(0x7f00000003c0)={0x0, 0x0, &(0x7f0000000240)=[{0x0}], 0x0, 0x1}, 0x20) executing program 2: write(0xffffffffffffffff, &(0x7f0000000340)='0fc5:1227:', 0xa) r0 = socket$netlink(0x10, 0x3, 0x4) bind$inet6(0xffffffffffffffff, 0x0, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) sched_setaffinity(0x0, 0x8, &(0x7f0000000100)=0x2) sched_setscheduler(0x0, 0x2, &(0x7f0000000200)=0x4) r1 = syz_open_dev$MSR(&(0x7f00000001c0), 0x0, 0x0) read$msr(r1, &(0x7f0000032680)=""/102392, 0x18ff8) bind$netlink(r0, &(0x7f0000000180)={0x10, 0x0, 0x25dfdbfd, 0x1000000}, 0xc) sched_setaffinity(0x0, 0xfffffef7, &(0x7f0000000740)=0x410000002) r2 = syz_ublk_setup_io_uring(0x20, &(0x7f0000000080)={0x0, 0x0, 0x0, 0x1, 0x2}, &(0x7f0000000040)=0x0, &(0x7f0000000100)=0x0, &(0x7f00000002c0)=0x0) r6 = syz_ublk_add_dev(r2, r3, r4, r5, &(0x7f0000000200)={0x2e, 0xc, 0x0, 0xffffffffffffffff, 0xc0207504, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', {0xffffffff, 0xffff, 0x40, &(0x7f0000000500)=@new_dev={0x3, 0x104}}}, &(0x7f0000000300)=0x0) sendmsg$NFT_BATCH(0xffffffffffffffff, 0x0, 0x80) r8 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_MSG_GETFLOWTABLE(r8, &(0x7f00000010c0)={0x0, 0x0, &(0x7f0000001080)={&(0x7f00000015c0)={0x20, 0x17, 0xa, 0x301, 0x0, 0x0, {0x2, 0x0, 0x4}, [@NFTA_FLOWTABLE_TABLE={0x9, 0x1, 'syz1\x00'}]}, 0x20}}, 0x4) r9 = syz_open_dev$ublk_chdev(&(0x7f0000002000), r6, 0x2) syz_ublk_setup_queues(r9, r7, &(0x7f0000000340)={0x0, 0x92d1, 0x400, 0x80000002, 0x165}, &(0x7f00000007c0)=[{0x0, 0x0, 0xffffffffffffffff, {0x0, 0x7ec5, 0x8, 0x2, 0x2f8, 0x0, r2}}, {0x0, 0x0, 0xffffffffffffffff, {0x0, 0x7dd8, 0x80, 0x1, 0x80000264, 0x0, r2}}, {0x0, 0x0, 0xffffffffffffffff, {0x0, 0xaa92, 0x8, 0x0, 0x67}}, {0x0, 0x0, 0xffffffffffffffff, {0x0, 0x97fb, 0x400, 0x1, 0x38b}}], 0x4, &(0x7f0000001a40)={0x2e, 0x10, 0x0, r9, 0xc0107520, 0x0, 0x0, 0x0, 0x0, {0x9}, 0x0, 0x0, '\x00', {0x0, 0x81c, 0x0, 0x0}}, &(0x7f0000001ac0)) syz_ublk_setup_queues(r10, 0x0, &(0x7f0000000180)={0x0, 0xfffffffe, 0x0, 0xfffffffe, 0x1002f6}, &(0x7f0000000800)=[{0x0, 0x0, 0xffffffffffffffff, {0x0, 0xe704, 0x40040, 0x1000002, 0x91}}, {0x0, 0x0, 0xffffffffffffffff, {0x0, 0x5c87, 0x20, 0x3, 0x3aa}}, {0x0, 0x0, 0xffffffffffffffff, {0x0, 0x1f70, 0x2, 0x3ffffffe, 0x337}}, {0x0, 0x0, 0xffffffffffffffff, {0x0, 0x4, 0x200, 0x1, 0xffffffff}}], 0x1, 0x0, 0x0) openat$ptmx(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) executing program 0: r0 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$nl_generic(r0, &(0x7f00000000c0)={0x0, 0x0, &(0x7f00000003c0)={&(0x7f0000000b40)=ANY=[], 0x34}}, 0x4000) ioctl$BTRFS_IOC_START_SYNC(r0, 0x80089418, &(0x7f0000000000)) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000380)={0x8, 0x100008b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000200)=0x5) openat$sequencer(0xffffffffffffff9c, &(0x7f0000000300), 0x80200, 0x0) r1 = syz_open_dev$sndmidi(&(0x7f00000004c0), 0x2, 0x141102) writev(r1, &(0x7f0000000840)=[{&(0x7f00000002c0)="94", 0xf000}, {0x0}], 0x2) socket$inet6_sctp(0xa, 0x1, 0x84) ioctl$IOCTL_VMCI_VERSION2(0xffffffffffffffff, 0x7a7, 0x0) bind$alg(0xffffffffffffffff, &(0x7f0000000040)={0x26, 'skcipher\x00', 0x0, 0x0, 'xts(aes)\x00'}, 0x58) mkdirat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000)='./cgroup/syz0\x00', 0x1ff) r2 = openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000), 0x200002, 0x0) r3 = openat$cgroup_type(r2, &(0x7f0000000100), 0x2, 0x0) write$cgroup_type(r3, &(0x7f0000000280), 0x9) r4 = openat$cgroup_procs(r2, &(0x7f00000002c0)='cgroup.threads\x00', 0x2, 0x0) write$cgroup_pid(r4, &(0x7f0000000c40), 0x12) r5 = openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000), 0x200002, 0x0) r6 = openat$cgroup_ro(r5, &(0x7f0000000040)='cgroup.freeze\x00', 0x275a, 0x0) syz_io_uring_setup(0xefd, &(0x7f0000000300)={0x0, 0x0, 0x10000, 0x3, 0x55}, &(0x7f0000000100)=0x0, &(0x7f0000000140)=0x0, &(0x7f0000000080)=0x0) syz_io_uring_submit(r7, r8, r9, &(0x7f00000001c0)=@IORING_OP_FIXED_FD_INSTALL={0x36, 0x6, 0x0, r5, 0x0, 0x0, 0x0, 0x1, 0x1}) write$cgroup_int(r6, &(0x7f0000000200)=0x1, 0x12) seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0x0, &(0x7f0000000040)={0x1, &(0x7f0000000000)=[{0x6, 0x0, 0x0, 0x7fff7ffc}]}) syz_ublk_setup_io_uring(0x1d, &(0x7f0000000040)={0x0, 0x30b5, 0x1, 0x2, 0x158}, &(0x7f0000000100), &(0x7f0000000280), &(0x7f0000000140)) socket$inet6_tcp(0xa, 0x1, 0x0) program did not crash replaying the whole log did not cause a kernel crash single: executing 4 programs separately with timeout 1m40s testing program (duration=1m40s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): socket$nl_generic-sendmsg$nl_generic-ioctl$BTRFS_IOC_START_SYNC-prctl$PR_SCHED_CORE-prlimit64-sched_setscheduler-openat$sequencer-syz_open_dev$sndmidi-writev-socket$inet6_sctp-ioctl$IOCTL_VMCI_VERSION2-bind$alg-mkdirat$cgroup_root-openat$cgroup_root-openat$cgroup_type-write$cgroup_type-openat$cgroup_procs-write$cgroup_pid-openat$cgroup_root-openat$cgroup_ro-syz_io_uring_setup-syz_io_uring_submit-write$cgroup_int-seccomp$SECCOMP_SET_MODE_FILTER_LISTENER-syz_ublk_setup_io_uring-socket$inet6_tcp detailed listing: executing program 0: r0 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$nl_generic(r0, &(0x7f00000000c0)={0x0, 0x0, &(0x7f00000003c0)={&(0x7f0000000b40)=ANY=[], 0x34}}, 0x4000) ioctl$BTRFS_IOC_START_SYNC(r0, 0x80089418, &(0x7f0000000000)) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000380)={0x8, 0x100008b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000200)=0x5) openat$sequencer(0xffffffffffffff9c, &(0x7f0000000300), 0x80200, 0x0) r1 = syz_open_dev$sndmidi(&(0x7f00000004c0), 0x2, 0x141102) writev(r1, &(0x7f0000000840)=[{&(0x7f00000002c0)="94", 0xf000}, {0x0}], 0x2) socket$inet6_sctp(0xa, 0x1, 0x84) ioctl$IOCTL_VMCI_VERSION2(0xffffffffffffffff, 0x7a7, 0x0) bind$alg(0xffffffffffffffff, &(0x7f0000000040)={0x26, 'skcipher\x00', 0x0, 0x0, 'xts(aes)\x00'}, 0x58) mkdirat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000)='./cgroup/syz0\x00', 0x1ff) r2 = openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000), 0x200002, 0x0) r3 = openat$cgroup_type(r2, &(0x7f0000000100), 0x2, 0x0) write$cgroup_type(r3, &(0x7f0000000280), 0x9) r4 = openat$cgroup_procs(r2, &(0x7f00000002c0)='cgroup.threads\x00', 0x2, 0x0) write$cgroup_pid(r4, &(0x7f0000000c40), 0x12) r5 = openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000), 0x200002, 0x0) r6 = openat$cgroup_ro(r5, &(0x7f0000000040)='cgroup.freeze\x00', 0x275a, 0x0) syz_io_uring_setup(0xefd, &(0x7f0000000300)={0x0, 0x0, 0x10000, 0x3, 0x55}, &(0x7f0000000100)=0x0, &(0x7f0000000140)=0x0, &(0x7f0000000080)=0x0) syz_io_uring_submit(r7, r8, r9, &(0x7f00000001c0)=@IORING_OP_FIXED_FD_INSTALL={0x36, 0x6, 0x0, r5, 0x0, 0x0, 0x0, 0x1, 0x1}) write$cgroup_int(r6, &(0x7f0000000200)=0x1, 0x12) seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0x0, &(0x7f0000000040)={0x1, &(0x7f0000000000)=[{0x6, 0x0, 0x0, 0x7fff7ffc}]}) syz_ublk_setup_io_uring(0x1d, &(0x7f0000000040)={0x0, 0x30b5, 0x1, 0x2, 0x158}, &(0x7f0000000100), &(0x7f0000000280), &(0x7f0000000140)) socket$inet6_tcp(0xa, 0x1, 0x0) program did not crash testing program (duration=1m40s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): write-socket$netlink-bind$inet6-prlimit64-sched_setaffinity-sched_setscheduler-syz_open_dev$MSR-read$msr-bind$netlink-sched_setaffinity-syz_ublk_setup_io_uring-syz_ublk_add_dev-sendmsg$NFT_BATCH-socket$nl_netfilter-sendmsg$NFT_MSG_GETFLOWTABLE-syz_open_dev$ublk_chdev-syz_ublk_setup_queues-syz_ublk_setup_queues-openat$ptmx detailed listing: executing program 0: write(0xffffffffffffffff, &(0x7f0000000340)='0fc5:1227:', 0xa) r0 = socket$netlink(0x10, 0x3, 0x4) bind$inet6(0xffffffffffffffff, 0x0, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) sched_setaffinity(0x0, 0x8, &(0x7f0000000100)=0x2) sched_setscheduler(0x0, 0x2, &(0x7f0000000200)=0x4) r1 = syz_open_dev$MSR(&(0x7f00000001c0), 0x0, 0x0) read$msr(r1, &(0x7f0000032680)=""/102392, 0x18ff8) bind$netlink(r0, &(0x7f0000000180)={0x10, 0x0, 0x25dfdbfd, 0x1000000}, 0xc) sched_setaffinity(0x0, 0xfffffef7, &(0x7f0000000740)=0x410000002) r2 = syz_ublk_setup_io_uring(0x20, &(0x7f0000000080)={0x0, 0x0, 0x0, 0x1, 0x2}, &(0x7f0000000040)=0x0, &(0x7f0000000100)=0x0, &(0x7f00000002c0)=0x0) r6 = syz_ublk_add_dev(r2, r3, r4, r5, &(0x7f0000000200)={0x2e, 0xc, 0x0, 0xffffffffffffffff, 0xc0207504, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', {0xffffffff, 0xffff, 0x40, &(0x7f0000000500)=@new_dev={0x3, 0x104}}}, &(0x7f0000000300)=0x0) sendmsg$NFT_BATCH(0xffffffffffffffff, 0x0, 0x80) r8 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_MSG_GETFLOWTABLE(r8, &(0x7f00000010c0)={0x0, 0x0, &(0x7f0000001080)={&(0x7f00000015c0)={0x20, 0x17, 0xa, 0x301, 0x0, 0x0, {0x2, 0x0, 0x4}, [@NFTA_FLOWTABLE_TABLE={0x9, 0x1, 'syz1\x00'}]}, 0x20}}, 0x4) r9 = syz_open_dev$ublk_chdev(&(0x7f0000002000), r6, 0x2) syz_ublk_setup_queues(r9, r7, &(0x7f0000000340)={0x0, 0x92d1, 0x400, 0x80000002, 0x165}, &(0x7f00000007c0)=[{0x0, 0x0, 0xffffffffffffffff, {0x0, 0x7ec5, 0x8, 0x2, 0x2f8, 0x0, r2}}, {0x0, 0x0, 0xffffffffffffffff, {0x0, 0x7dd8, 0x80, 0x1, 0x80000264, 0x0, r2}}, {0x0, 0x0, 0xffffffffffffffff, {0x0, 0xaa92, 0x8, 0x0, 0x67}}, {0x0, 0x0, 0xffffffffffffffff, {0x0, 0x97fb, 0x400, 0x1, 0x38b}}], 0x4, &(0x7f0000001a40)={0x2e, 0x10, 0x0, r9, 0xc0107520, 0x0, 0x0, 0x0, 0x0, {0x9}, 0x0, 0x0, '\x00', {0x0, 0x81c, 0x0, 0x0}}, &(0x7f0000001ac0)) syz_ublk_setup_queues(r10, 0x0, &(0x7f0000000180)={0x0, 0xfffffffe, 0x0, 0xfffffffe, 0x1002f6}, &(0x7f0000000800)=[{0x0, 0x0, 0xffffffffffffffff, {0x0, 0xe704, 0x40040, 0x1000002, 0x91}}, {0x0, 0x0, 0xffffffffffffffff, {0x0, 0x5c87, 0x20, 0x3, 0x3aa}}, {0x0, 0x0, 0xffffffffffffffff, {0x0, 0x1f70, 0x2, 0x3ffffffe, 0x337}}, {0x0, 0x0, 0xffffffffffffffff, {0x0, 0x4, 0x200, 0x1, 0xffffffff}}], 0x1, 0x0, 0x0) openat$ptmx(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) program did not crash testing program (duration=1m40s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): prlimit64-sched_setscheduler-sched_setaffinity-getpid-bpf$MAP_GET_NEXT_KEY-rseq-sched_setscheduler-socketpair$unix-connect$unix-sendmmsg$unix-sched_setaffinity-socket$inet_tcp-mremap-socket$inet_udp-io_uring_setup-io_uring_register$IORING_REGISTER_BUFFERS_UPDATE detailed listing: executing program 0: prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000080)=0x8) sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x2) r0 = getpid() bpf$MAP_GET_NEXT_KEY(0x4, 0x0, 0x0) rseq(0x0, 0xfde1, 0x0, 0x0) sched_setscheduler(r0, 0x1, &(0x7f0000000100)=0x5) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000001480)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r1, &(0x7f00000004c0)=@file={0x0, './file0\x00'}, 0x6e) sendmmsg$unix(r2, &(0x7f00000bd000), 0x318, 0x0) sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x2) socket$inet_tcp(0x2, 0x1, 0x0) mremap(&(0x7f0000a96000/0x1000)=nil, 0x1000, 0x400000, 0x3, &(0x7f0000000000/0x400000)=nil) socket$inet_udp(0x2, 0x2, 0x0) r3 = io_uring_setup(0xa2, &(0x7f0000000080)={0x0, 0x592c, 0x2, 0xfffffffc, 0x2}) io_uring_register$IORING_REGISTER_BUFFERS_UPDATE(r3, 0x10, &(0x7f00000003c0)={0x0, 0x0, &(0x7f0000000240)=[{0x0}], 0x0, 0x1}, 0x20) program did not crash testing program (duration=1m40s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): socketpair$unix-ioctl$KVM_SET_REGS-pipe-splice-splice-write-mmap-syz_open_procfs-mprotect-lseek-mmap detailed listing: executing program 0: socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000180)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$KVM_SET_REGS(0xffffffffffffffff, 0x4090ae82, &(0x7f0000000380)={[0xb, 0x6, 0x6, 0x4004, 0x2, 0x4, 0xefffffffffffffff, 0x0, 0x0, 0x2000000, 0x20000, 0x1c, 0x0, 0x5], 0x0, 0x41981}) pipe(&(0x7f0000000040)={0xffffffffffffffff, 0xffffffffffffffff}) splice(r1, 0x0, r3, 0x0, 0x8000f28, 0x0) splice(r2, 0x0, r1, 0x0, 0x8, 0xe) write(r0, 0x0, 0x0) mmap(&(0x7f0000000000/0xfbe000)=nil, 0xfbe000, 0x1000002, 0x4012831, 0xffffffffffffffff, 0x0) r4 = syz_open_procfs(0x0, 0x0) mprotect(&(0x7f0000000000/0x3000)=nil, 0x3000, 0x1) lseek(r4, 0x2004, 0x0) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbee2, 0x8031, 0xffffffffffffffff, 0x0) program did not crash single: failed to extract reproducer bisect: bisecting 24 programs with base timeout 1m40s testing program (duration=1m46s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): [23, 11, 4, 23, 20, 26, 26, 19, 19, 11, 18, 27, 29, 4, 11, 21, 27, 26, 23, 20, 19, 16, 19, 26] detailed listing: executing program 1: write(0xffffffffffffffff, &(0x7f0000000340)='0fc5:1227:', 0xa) mmap$IORING_OFF_SQ_RING(0x110c230000, 0x8000002, 0x4, 0x401d031, 0xffffffffffffffff, 0x0) r0 = socket$netlink(0x10, 0x3, 0x4) socket$inet6_tcp(0xa, 0x1, 0x0) fcntl$setstatus(0xffffffffffffffff, 0x4, 0x40800) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000080)=0x7) sched_setaffinity(0x0, 0x8, &(0x7f0000000100)=0x2) sched_setscheduler(0x0, 0x2, &(0x7f0000000200)=0x4) r1 = syz_open_dev$MSR(&(0x7f00000001c0), 0x0, 0x0) read$msr(r1, &(0x7f0000032680)=""/102392, 0x18ff8) bind$netlink(r0, &(0x7f0000000180)={0x10, 0x0, 0x25dfdbfd, 0x1000000}, 0xc) sched_setaffinity(0x0, 0xfffffef7, &(0x7f0000000740)=0x410000002) r2 = openat$ublk_ctrl(0xffffffffffffff9c, &(0x7f0000000000), 0x2, 0x0) r3 = syz_ublk_setup_io_uring(0x20, &(0x7f0000000080)={0x0, 0x0, 0x0, 0x1, 0x2}, &(0x7f0000000040)=0x0, &(0x7f0000000100)=0x0, &(0x7f00000002c0)=0x0) r7 = syz_ublk_add_dev(r3, r4, r5, r6, &(0x7f0000000200)={0x2e, 0xc, 0x0, r2, 0xc0207504, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', {0xffffffff, 0xffff, 0x40, &(0x7f0000000500)=@new_dev={0x3, 0x104}}}, &(0x7f0000000300)) r8 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r8, 0x0, 0x80) r9 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_MSG_GETFLOWTABLE(r9, &(0x7f00000010c0)={0x0, 0x0, &(0x7f0000001080)={&(0x7f00000015c0)={0x20, 0x17, 0xa, 0x301, 0x0, 0x0, {0x2, 0x0, 0x4}, [@NFTA_FLOWTABLE_TABLE={0x9, 0x1, 'syz1\x00'}]}, 0x20}}, 0x4) syz_open_dev$ublk_chdev(&(0x7f0000002000), r7, 0x2) syz_ublk_setup_queues(0xffffffffffffffff, 0x0, &(0x7f0000000180)={0x0, 0xfffffffe, 0x0, 0xfffffffe, 0x1002f6}, &(0x7f0000000800)=[{0x0, 0x0, 0xffffffffffffffff, {0x0, 0xe704, 0x40040, 0x1000002, 0x91}}, {0x0, 0x0, 0xffffffffffffffff, {0x0, 0x5c87, 0x20, 0x3, 0x3aa}}, {0x0, 0x0, 0xffffffffffffffff, {0x0, 0x1f70, 0x2, 0x3ffffffe, 0x337}}, {0x0, 0x0, 0xffffffffffffffff, {0x0, 0x4, 0x200, 0x1, 0xffffffff}}], 0x1, 0x0, 0x0) openat$ptmx(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) executing program 1: socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000180)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$KVM_SET_REGS(0xffffffffffffffff, 0x4090ae82, &(0x7f0000000380)={[0xb, 0x6, 0x6, 0x4004, 0x2, 0x4, 0xefffffffffffffff, 0x0, 0x0, 0x2000000, 0x20000, 0x1c, 0x0, 0x5], 0x0, 0x41981}) pipe(&(0x7f0000000040)={0xffffffffffffffff, 0xffffffffffffffff}) splice(r1, 0x0, r3, 0x0, 0x8000f28, 0x0) splice(r2, 0x0, r1, 0x0, 0x8, 0xe) write(r0, 0x0, 0x0) mmap(&(0x7f0000000000/0xfbe000)=nil, 0xfbe000, 0x1000002, 0x4012831, 0xffffffffffffffff, 0x0) r4 = syz_open_procfs(0x0, 0x0) mprotect(&(0x7f0000000000/0x3000)=nil, 0x3000, 0x1) lseek(r4, 0x2004, 0x0) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbee2, 0x8031, 0xffffffffffffffff, 0x0) executing program 1: r0 = openat$uinput(0xffffffffffffff9c, &(0x7f0000000040), 0x802, 0x0) write$uinput_user_dev(r0, &(0x7f0000000800)={'syz0\x00', {0x2, 0x10, 0x2, 0x4}, 0xf, [0x1, 0x0, 0x0, 0x40000, 0x1, 0x2, 0x4, 0x0, 0x4, 0x0, 0x0, 0x0, 0xfffffffd, 0x0, 0x0, 0x0, 0x4000, 0x20, 0x400, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffd, 0x0, 0x0, 0x2, 0x0, 0x1, 0x2, 0x0, 0x0, 0x7, 0x1, 0x0, 0x0, 0xfffffffe, 0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x29a, 0x1, 0x0, 0x0, 0x0, 0x2000, 0x0, 0xfffffffc, 0x0, 0x0, 0x0, 0x6, 0x0, 0x0, 0x6, 0x5f1, 0x6], [0x0, 0x0, 0x8, 0x0, 0x0, 0x5, 0x0, 0x80, 0x8000, 0x2, 0x9, 0x0, 0x2, 0x0, 0x0, 0x0, 0xfffffffc, 0x0, 0x200, 0x7, 0xfffffffc, 0x0, 0x0, 0x7, 0x0, 0xfffffffc, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffe, 0x3, 0x0, 0xd, 0x0, 0x2, 0x0, 0x3, 0x5, 0xfffffffd, 0x4000000, 0xfffffffd, 0x0, 0x0, 0x0, 0x0, 0x80000, 0x0, 0xfffffffd, 0x0, 0x8, 0x0, 0x0, 0x8, 0x0, 0x0, 0x4, 0xffff], [0x4, 0xfc, 0x0, 0x4, 0x0, 0x0, 0x0, 0x0, 0xb, 0x1, 0x4000000, 0x0, 0x1, 0x4, 0x1000, 0x80, 0x0, 0x200, 0x0, 0xffffffff, 0x400000, 0xfffffffc, 0x0, 0xfffffffd, 0xffffffff, 0x0, 0x0, 0xfffffffd, 0x0, 0x0, 0x20, 0x4, 0x0, 0x0, 0xfffffffe, 0x1, 0x0, 0x18c, 0x0, 0x6, 0x1, 0x0, 0xbda6, 0xe, 0x0, 0x0, 0xfffffffd, 0xffffffff, 0x0, 0x20, 0x100, 0x0, 0x0, 0x204, 0x0, 0x0, 0x4000, 0xfff, 0x6, 0x0, 0x0, 0x0, 0x0, 0x8], [0x40000000, 0x0, 0x74e2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7, 0x40, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffe, 0x0, 0x0, 0x402, 0x40, 0x0, 0x0, 0xbd, 0x0, 0xff, 0x0, 0x0, 0x0, 0x2, 0xc9, 0x0, 0x8, 0x9, 0x0, 0x0, 0xffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x101, 0x80000020, 0x0, 0x0, 0x0, 0x0, 0x40000000, 0x5cb9, 0xcaa, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x4]}, 0x45c) ioctl$UI_DEV_CREATE(r0, 0x5501) ioctl$UI_GET_SYSNAME(r0, 0x8040552c, 0x0) executing program 3: write(0xffffffffffffffff, &(0x7f0000000340)='0fc5:1227:', 0xa) mmap$IORING_OFF_SQ_RING(0x110c230000, 0x8000002, 0x4, 0x401d031, 0xffffffffffffffff, 0x0) r0 = socket$netlink(0x10, 0x3, 0x4) socket$inet6_tcp(0xa, 0x1, 0x0) fcntl$setstatus(0xffffffffffffffff, 0x4, 0x40800) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000080)=0x7) sched_setaffinity(0x0, 0x8, &(0x7f0000000100)=0x2) sched_setscheduler(0x0, 0x2, &(0x7f0000000200)=0x4) r1 = syz_open_dev$MSR(&(0x7f00000001c0), 0x0, 0x0) read$msr(r1, &(0x7f0000032680)=""/102392, 0x18ff8) bind$netlink(r0, &(0x7f0000000180)={0x10, 0x0, 0x25dfdbfd, 0x1000000}, 0xc) sched_setaffinity(0x0, 0xfffffef7, &(0x7f0000000740)=0x410000002) r2 = openat$ublk_ctrl(0xffffffffffffff9c, &(0x7f0000000000), 0x2, 0x0) r3 = syz_ublk_setup_io_uring(0x20, &(0x7f0000000080)={0x0, 0x0, 0x0, 0x1, 0x2}, &(0x7f0000000040)=0x0, &(0x7f0000000100)=0x0, &(0x7f00000002c0)=0x0) r7 = syz_ublk_add_dev(r3, r4, r5, r6, &(0x7f0000000200)={0x2e, 0xc, 0x0, r2, 0xc0207504, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', {0xffffffff, 0xffff, 0x40, &(0x7f0000000500)=@new_dev={0x3, 0x104}}}, &(0x7f0000000300)) r8 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r8, 0x0, 0x80) r9 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_MSG_GETFLOWTABLE(r9, &(0x7f00000010c0)={0x0, 0x0, &(0x7f0000001080)={&(0x7f00000015c0)={0x20, 0x17, 0xa, 0x301, 0x0, 0x0, {0x2, 0x0, 0x4}, [@NFTA_FLOWTABLE_TABLE={0x9, 0x1, 'syz1\x00'}]}, 0x20}}, 0x4) syz_open_dev$ublk_chdev(&(0x7f0000002000), r7, 0x2) syz_ublk_setup_queues(0xffffffffffffffff, 0x0, &(0x7f0000000180)={0x0, 0xfffffffe, 0x0, 0xfffffffe, 0x1002f6}, &(0x7f0000000800)=[{0x0, 0x0, 0xffffffffffffffff, {0x0, 0xe704, 0x40040, 0x1000002, 0x91}}, {0x0, 0x0, 0xffffffffffffffff, {0x0, 0x5c87, 0x20, 0x3, 0x3aa}}, {0x0, 0x0, 0xffffffffffffffff, {0x0, 0x1f70, 0x2, 0x3ffffffe, 0x337}}, {0x0, 0x0, 0xffffffffffffffff, {0x0, 0x4, 0x200, 0x1, 0xffffffff}}], 0x1, 0x0, 0x0) openat$ptmx(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) executing program 1: prlimit64(0x0, 0xe, &(0x7f0000000140)={0xa, 0x8b}, 0x0) ptrace(0x4207, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000280)=0x8) r0 = getpid() sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x2) sched_setscheduler(r0, 0x2, &(0x7f0000000200)=0x7) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeea, 0x8031, 0xffffffffffffffff, 0x28f43000) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r1, &(0x7f0000000180)=@abs, 0x6e) sendmmsg$unix(r2, 0x0, 0x0, 0x0) recvmmsg(r1, &(0x7f00000000c0), 0x10106, 0x2, 0x0) unshare(0x28000600) r3 = fsopen(&(0x7f00000001c0)='mqueue\x00', 0x0) fsconfig$FSCONFIG_CMD_CREATE(r3, 0x6, 0x0, 0x0, 0x0) fsmount(r3, 0x0, 0x8e) unshare(0x8000280) prlimit64(r0, 0x0, &(0x7f0000000240)={0x0, 0x80}, &(0x7f0000000300)) mprotect(&(0x7f00001a4000/0x1000)=nil, 0x1000, 0x1) munmap(&(0x7f0000002000/0x1000)=nil, 0x1000) close(0xffffffffffffffff) executing program 0: write(0xffffffffffffffff, &(0x7f0000000340)='0fc5:1227:', 0xa) mmap$IORING_OFF_SQ_RING(0x110c230000, 0x8000002, 0x4, 0x401d031, 0xffffffffffffffff, 0x0) r0 = socket$netlink(0x10, 0x3, 0x4) r1 = socket$inet6_tcp(0xa, 0x1, 0x0) bind$inet6(r1, 0x0, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000080)=0x7) r2 = getpid() sched_setaffinity(0x0, 0x8, &(0x7f0000000100)=0x2) sched_setscheduler(r2, 0x2, &(0x7f0000000200)=0x4) r3 = syz_open_dev$MSR(&(0x7f00000001c0), 0x0, 0x0) read$msr(r3, &(0x7f0000032680)=""/102392, 0x18ff8) bind$netlink(r0, &(0x7f0000000180)={0x10, 0x0, 0x25dfdbfd, 0x1000000}, 0xc) sched_setaffinity(0x0, 0xfffffef7, &(0x7f0000000740)=0x410000002) r4 = openat$ublk_ctrl(0xffffffffffffff9c, &(0x7f0000000000), 0x2, 0x0) r5 = syz_ublk_setup_io_uring(0x20, &(0x7f0000000080)={0x0, 0x0, 0x0, 0x1, 0x2}, &(0x7f0000000040)=0x0, &(0x7f0000000100)=0x0, &(0x7f00000002c0)=0x0) r9 = syz_ublk_add_dev(r5, r6, r7, r8, &(0x7f0000000200)={0x2e, 0xc, 0x0, r4, 0xc0207504, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', {0xffffffff, 0xffff, 0x40, &(0x7f0000000500)=@new_dev={0x3, 0x104}}}, &(0x7f0000000300)=0x0) r11 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r11, 0x0, 0x80) r12 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_MSG_GETFLOWTABLE(r12, &(0x7f00000010c0)={0x0, 0x0, &(0x7f0000001080)={&(0x7f00000015c0)={0x20, 0x17, 0xa, 0x301, 0x0, 0x0, {0x2, 0x0, 0x4}, [@NFTA_FLOWTABLE_TABLE={0x9, 0x1, 'syz1\x00'}]}, 0x20}}, 0x4) r13 = syz_open_dev$ublk_chdev(&(0x7f0000002000), r9, 0x2) syz_ublk_setup_queues(r13, r10, &(0x7f0000000340)={0x0, 0x92d1, 0x400, 0x80000002, 0x165}, &(0x7f00000007c0)=[{0x0, 0x0, 0xffffffffffffffff, {0x0, 0x7ec5, 0x8, 0x2, 0x2f8, 0x0, r5}}, {0x0, 0x0, 0xffffffffffffffff, {0x0, 0x7dd8, 0x80, 0x1, 0x80000264, 0x0, r5}}, {0x0, 0x0, 0xffffffffffffffff, {0x0, 0xaa92, 0x8, 0x0, 0x67}}, {0x0, 0x0, 0xffffffffffffffff, {0x0, 0x97fb, 0x400, 0x1, 0x38b}}], 0x4, &(0x7f0000001a40)={0x2e, 0x10, 0x0, r13, 0xc0107520, 0x0, 0x0, 0x0, 0x0, {0x9}, 0x0, 0x0, '\x00', {0x0, 0x81c, 0x0, 0x0}}, &(0x7f0000001ac0)) mmap$IORING_OFF_SQ_RING(0x0, 0xc00000, 0x2000007, 0x401d031, 0xffffffffffffffff, 0x0) syz_ublk_setup_queues(r14, 0x0, &(0x7f0000000180)={0x0, 0xfffffffe, 0x0, 0xfffffffe, 0x1002f6}, &(0x7f0000000800)=[{0x0, 0x0, 0xffffffffffffffff, {0x0, 0xe704, 0x40040, 0x1000002, 0x91}}, {0x0, 0x0, 0xffffffffffffffff, {0x0, 0x5c87, 0x20, 0x3, 0x3aa}}, {0x0, 0x0, 0xffffffffffffffff, {0x0, 0x1f70, 0x2, 0x3ffffffe, 0x337}}, {0x0, 0x0, 0xffffffffffffffff, {0x0, 0x4, 0x200, 0x1, 0xffffffff}}], 0x1, 0x0, 0x0) openat$ptmx(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) executing program 0: r0 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$nl_generic(r0, &(0x7f00000000c0)={0x0, 0x0, &(0x7f00000003c0)={&(0x7f0000000b40)=ANY=[], 0x34}}, 0x4000) ioctl$BTRFS_IOC_START_SYNC(r0, 0x80089418, &(0x7f0000000000)) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000380)={0x8, 0x100008b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000200)=0x5) openat$sequencer(0xffffffffffffff9c, &(0x7f0000000300), 0x80200, 0x0) r1 = syz_open_dev$sndmidi(&(0x7f00000004c0), 0x2, 0x141102) writev(r1, &(0x7f0000000840)=[{&(0x7f00000002c0)="94", 0xf000}, {0x0}], 0x2) socket$inet6_sctp(0xa, 0x1, 0x84) ioctl$IOCTL_VMCI_VERSION2(0xffffffffffffffff, 0x7a7, 0x0) bind$alg(0xffffffffffffffff, &(0x7f0000000040)={0x26, 'skcipher\x00', 0x0, 0x0, 'xts(aes)\x00'}, 0x58) mkdirat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000)='./cgroup/syz0\x00', 0x1ff) r2 = openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000), 0x200002, 0x0) r3 = openat$cgroup_type(r2, &(0x7f0000000100), 0x2, 0x0) write$cgroup_type(r3, &(0x7f0000000280), 0x9) r4 = openat$cgroup_procs(r2, &(0x7f00000002c0)='cgroup.threads\x00', 0x2, 0x0) write$cgroup_pid(r4, &(0x7f0000000c40), 0x12) r5 = openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000), 0x200002, 0x0) r6 = openat$cgroup_ro(r5, &(0x7f0000000040)='cgroup.freeze\x00', 0x275a, 0x0) syz_io_uring_setup(0xefd, &(0x7f0000000300)={0x0, 0x0, 0x10000, 0x3, 0x55}, &(0x7f0000000100)=0x0, &(0x7f0000000140)=0x0, &(0x7f0000000080)=0x0) syz_io_uring_submit(r7, r8, r9, &(0x7f00000001c0)=@IORING_OP_FIXED_FD_INSTALL={0x36, 0x6, 0x0, r5, 0x0, 0x0, 0x0, 0x1, 0x1}) write$cgroup_int(r6, &(0x7f0000000200)=0x1, 0x12) seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0x0, &(0x7f0000000040)={0x1, &(0x7f0000000000)=[{0x6, 0x0, 0x0, 0x7fff7ffc}]}) syz_ublk_setup_io_uring(0x1d, &(0x7f0000000040)={0x0, 0x30b5, 0x1, 0x2, 0x158}, &(0x7f0000000100), &(0x7f0000000280), &(0x7f0000000140)) socket$inet6_tcp(0xa, 0x1, 0x0) executing program 3: write(0xffffffffffffffff, 0x0, 0x0) r0 = socket$netlink(0x10, 0x3, 0x4) r1 = socket$inet6_tcp(0xa, 0x1, 0x0) bind$inet6(r1, 0x0, 0x0) fcntl$setstatus(0xffffffffffffffff, 0x4, 0x40800) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000080)=0x7) sched_setaffinity(0x0, 0x8, &(0x7f0000000100)=0x2) sched_setscheduler(0x0, 0x2, &(0x7f0000000200)=0x4) r2 = syz_open_dev$MSR(&(0x7f00000001c0), 0x0, 0x0) read$msr(r2, &(0x7f0000032680)=""/102392, 0x18ff8) bind$netlink(r0, &(0x7f0000000180)={0x10, 0x0, 0x25dfdbfd, 0x1000000}, 0xc) sched_setaffinity(0x0, 0xfffffef7, &(0x7f0000000740)=0x410000002) r3 = openat$ublk_ctrl(0xffffffffffffff9c, &(0x7f0000000000), 0x2, 0x0) syz_ublk_add_dev(0xffffffffffffffff, 0x0, 0x0, 0x0, &(0x7f0000000200)={0x2e, 0xc, 0x0, r3, 0xc0207504, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', {0xffffffff, 0xffff, 0x40, &(0x7f0000000500)=@new_dev={0x3, 0x104}}}, &(0x7f0000000300)) r4 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r4, 0x0, 0x80) r5 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_MSG_GETFLOWTABLE(r5, &(0x7f00000010c0)={0x0, 0x0, &(0x7f0000001080)={&(0x7f00000015c0)={0x20, 0x17, 0xa, 0x301, 0x0, 0x0, {0x2, 0x0, 0x4}, [@NFTA_FLOWTABLE_TABLE={0x9, 0x1, 'syz1\x00'}]}, 0x20}}, 0x4) executing program 2: write(0xffffffffffffffff, &(0x7f0000000340)='0fc5:1227:', 0xa) mmap$IORING_OFF_SQ_RING(0x110c230000, 0x8000002, 0x4, 0x401d031, 0xffffffffffffffff, 0x0) bind$inet6(0xffffffffffffffff, 0x0, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) sched_setaffinity(0x0, 0x8, &(0x7f0000000100)=0x2) sched_setscheduler(0x0, 0x2, &(0x7f0000000200)=0x4) r0 = syz_open_dev$MSR(&(0x7f00000001c0), 0x0, 0x0) read$msr(r0, &(0x7f0000032680)=""/102392, 0x18ff8) bind$netlink(0xffffffffffffffff, &(0x7f0000000180)={0x10, 0x0, 0x25dfdbfd, 0x1000000}, 0xc) sched_setaffinity(0x0, 0xfffffef7, &(0x7f0000000740)=0x410000002) r1 = syz_ublk_setup_io_uring(0x20, &(0x7f0000000080)={0x0, 0x0, 0x0, 0x1, 0x2}, &(0x7f0000000040)=0x0, &(0x7f0000000100)=0x0, &(0x7f00000002c0)=0x0) r5 = syz_ublk_add_dev(r1, r2, r3, r4, &(0x7f0000000200)={0x2e, 0xc, 0x0, 0xffffffffffffffff, 0xc0207504, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', {0xffffffff, 0xffff, 0x40, &(0x7f0000000500)=@new_dev={0x3, 0x104}}}, &(0x7f0000000300)=0x0) sendmsg$NFT_BATCH(0xffffffffffffffff, 0x0, 0x80) r7 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_MSG_GETFLOWTABLE(r7, &(0x7f00000010c0)={0x0, 0x0, &(0x7f0000001080)={&(0x7f00000015c0)={0x20, 0x17, 0xa, 0x301, 0x0, 0x0, {0x2, 0x0, 0x4}, [@NFTA_FLOWTABLE_TABLE={0x9, 0x1, 'syz1\x00'}]}, 0x20}}, 0x4) r8 = syz_open_dev$ublk_chdev(&(0x7f0000002000), r5, 0x2) syz_ublk_setup_queues(r8, r6, &(0x7f0000000340)={0x0, 0x92d1, 0x400, 0x80000002, 0x165}, &(0x7f00000007c0)=[{0x0, 0x0, 0xffffffffffffffff, {0x0, 0x7ec5, 0x8, 0x2, 0x2f8, 0x0, r1}}, {0x0, 0x0, 0xffffffffffffffff, {0x0, 0x7dd8, 0x80, 0x1, 0x80000264, 0x0, r1}}, {0x0, 0x0, 0xffffffffffffffff, {0x0, 0xaa92, 0x8, 0x0, 0x67}}, {0x0, 0x0, 0xffffffffffffffff, {0x0, 0x97fb, 0x400, 0x1, 0x38b}}], 0x4, &(0x7f0000001a40)={0x2e, 0x10, 0x0, r8, 0xc0107520, 0x0, 0x0, 0x0, 0x0, {0x9}, 0x0, 0x0, '\x00', {0x0, 0x81c, 0x0, 0x0}}, &(0x7f0000001ac0)) syz_ublk_setup_queues(r9, 0x0, &(0x7f0000000180)={0x0, 0xfffffffe, 0x0, 0xfffffffe, 0x1002f6}, &(0x7f0000000800)=[{0x0, 0x0, 0xffffffffffffffff, {0x0, 0xe704, 0x40040, 0x1000002, 0x91}}, {0x0, 0x0, 0xffffffffffffffff, {0x0, 0x5c87, 0x20, 0x3, 0x3aa}}, {0x0, 0x0, 0xffffffffffffffff, {0x0, 0x1f70, 0x2, 0x3ffffffe, 0x337}}, {0x0, 0x0, 0xffffffffffffffff, {0x0, 0x4, 0x200, 0x1, 0xffffffff}}], 0x1, 0x0, 0x0) openat$ptmx(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) executing program 1: socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000180)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$KVM_SET_REGS(0xffffffffffffffff, 0x4090ae82, &(0x7f0000000380)={[0xb, 0x6, 0x6, 0x4004, 0x2, 0x4, 0xefffffffffffffff, 0x0, 0x0, 0x2000000, 0x20000, 0x1c, 0x0, 0x5], 0x0, 0x41981}) pipe(&(0x7f0000000040)={0xffffffffffffffff, 0xffffffffffffffff}) splice(r1, 0x0, r3, 0x0, 0x8000f28, 0x0) splice(r2, 0x0, r1, 0x0, 0x8, 0xe) write(r0, 0x0, 0x0) mmap(&(0x7f0000000000/0xfbe000)=nil, 0xfbe000, 0x1000002, 0x4012831, 0xffffffffffffffff, 0x0) r4 = syz_open_procfs(0x0, 0x0) mprotect(&(0x7f0000000000/0x3000)=nil, 0x3000, 0x1) lseek(r4, 0x2004, 0x0) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbee2, 0x8031, 0xffffffffffffffff, 0x0) executing program 3: prlimit64(0x0, 0xe, &(0x7f0000000140)={0x9, 0xff}, 0x0) setrlimit(0xd, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000380)=0x7) r0 = getpid() sched_setscheduler(r0, 0x1, &(0x7f00000000c0)=0x7) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000240)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r1, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r2, &(0x7f0000000000), 0x651, 0x0) recvmmsg(r1, &(0x7f00000000c0), 0x10106, 0x2, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000000)=0x6) sendmsg$nl_generic(0xffffffffffffffff, &(0x7f0000000100)={0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x4000002}, 0x4000080) r3 = socket$inet_smc(0x2b, 0x1, 0x0) ioctl$int_in(r3, 0x5421, &(0x7f0000000100)=0x100000001) setsockopt$inet_tcp_int(r3, 0x6, 0x1e, &(0x7f0000000180)=0x1, 0x4) connect$inet(r3, &(0x7f0000000480)={0x2, 0x4e20, @dev={0xac, 0x14, 0x14, 0xbc}}, 0x10) socketpair$unix(0x1, 0x5, 0x0, 0x0) close(r3) executing program 2: r0 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000040)='cgroup.kill\x00', 0x275a, 0x0) inotify_init1(0x800) pipe(&(0x7f00000001c0)) mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./sys\x00', 0x1ff) mount(0x0, &(0x7f0000000000)='./sys\x00', &(0x7f0000000100)='sysfs\x00', 0x0, 0x0) r1 = openat(0xffffffffffffff9c, &(0x7f0000000200)='./sys/bus/pci/devices/0000:00:00.0/remove\x00', 0x1, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000140)={0xa, 0x8b}, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000280)=0x8) r2 = getpid() sched_setaffinity(0x0, 0x0, 0x0) sched_setscheduler(r2, 0x2, &(0x7f0000000200)=0x7) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeea, 0x8031, 0xffffffffffffffff, 0x28f43000) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$TIOCSPGRP(r1, 0x5410, &(0x7f0000000240)=r2) connect$unix(r3, &(0x7f0000000180)=@abs, 0x6e) sendmmsg$unix(r4, &(0x7f0000000000), 0x651, 0x0) recvmmsg(r3, &(0x7f00000000c0), 0x10106, 0x2, 0x0) mmap$IORING_OFF_SQ_RING(0x110c230000, 0x8000002, 0x2000007, 0x401d031, 0xffffffffffffffff, 0x0) write(r1, &(0x7f0000000300)='1', 0x1) r5 = openat(0xffffffffffffff9c, &(0x7f0000000080)='./sys/bus/pci/rescan\x00', 0x1, 0x0) write(r5, &(0x7f0000000300)='1', 0x1) mkdirat(0xffffffffffffff9c, 0x0, 0x1ff) timer_create(0x0, 0x0, &(0x7f0000000300)) mprotect(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x5) fcntl$lock(r0, 0x6, &(0x7f0000000080)={0x1, 0x1}) fcntl$lock(r0, 0x7, &(0x7f0000000000)={0x0, 0x2, 0x600000000000000, 0x1d}) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000000)) executing program 0: r0 = socket$netlink(0x10, 0x3, 0x6) bind$netlink(r0, &(0x7f0000514ff4)={0x10, 0x0, 0x0, 0x2ffffffff}, 0xc) r1 = socket$inet_sctp(0x2, 0x1, 0x84) setsockopt$IP_VS_SO_SET_ADD(r1, 0x0, 0x482, &(0x7f0000000080)={0x84, @broadcast, 0x15, 0x3, 'lblcr\x00', 0xa, 0x4, 0x72}, 0x2c) r2 = socket$kcm(0xa, 0x2, 0x0) sendmsg$sock(r2, &(0x7f0000000400)={&(0x7f0000000580)=@in6={0x2, 0x4e22, 0x0, @dev}, 0x80, 0x0, 0x0, &(0x7f0000000000)=[@mark={{0x14, 0x1, 0x24, 0x3}}], 0x18}, 0x0) r3 = socket$inet6_tcp(0xa, 0x1, 0x0) bind$inet6(r3, &(0x7f0000000280)={0xa, 0x4e22, 0x9, @loopback, 0x3e}, 0x1c) connect$inet6(r3, &(0x7f0000000140)={0xa, 0x4e22, 0x56202329, @empty, 0x4000005}, 0x1c) r4 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r4, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000000200)=@newsa={0x158, 0x10, 0x5, 0x1, 0x0, {{@in6=@loopback, @in6=@loopback, 0x0, 0x0, 0x0, 0x0, 0xa, 0x80, 0x80, 0x0, 0x0, 0x80}, {@in6=@loopback, 0x1234, 0x33}, @in6=@loopback, {0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff}, {0x0, 0x0, 0x0, 0x1}, {}, 0x0, 0x0, 0xa, 0x0, 0x0, 0x80}, [@algo_auth={0x48, 0x1, {{'hmac(sha1)\x00'}}}, @replay_esn_val={0x20, 0x17, {0x1, 0x0, 0x0, 0x2, 0x4000, 0x20, [0x0]}}]}, 0x158}}, 0x0) sendmsg$nl_xfrm(r4, &(0x7f0000000300)={0x0, 0x0, &(0x7f0000000400)={&(0x7f0000000500)=@newpolicy={0xfc, 0x13, 0x5, 0x1, 0x0, {{@in6=@loopback, @in6=@loopback, 0x0, 0x0, 0x0, 0x0, 0xa, 0x80, 0x80}, {0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff}, {}, 0x0, 0x0, 0x1}, [@tmpl={0x44, 0x5, [{{@in6=@loopback, 0x1234, 0x33}, 0xa, @in6=@loopback}]}]}, 0xfc}}, 0x0) syz_open_procfs(0xffffffffffffffff, 0x0) bpf$MAP_CREATE(0x0, &(0x7f0000000640)=ANY=[@ANYBLOB="160000000000000004000000"], 0x48) mmap(&(0x7f0000000000/0xff5000)=nil, 0xff5000, 0x1000002, 0x200000005c831, 0xffffffffffffffff, 0x0) openat$sequencer2(0xffffffffffffff9c, &(0x7f0000000080), 0x0, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000380)={0x8, 0x100008b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000000)=0x7) r5 = syz_open_dev$sndmidi(&(0x7f00000004c0), 0x2, 0x143102) writev(r5, &(0x7f0000000840)=[{&(0x7f00000002c0)="94", 0xf000}, {0x0}], 0x2) remap_file_pages(&(0x7f0000800000/0x800000)=nil, 0x800000, 0x0, 0x0, 0x0) madvise(&(0x7f0000400000/0xc00000)=nil, 0xc00000, 0x9) bpf$PROG_LOAD(0x5, 0x0, 0x0) syz_open_procfs(0x0, &(0x7f0000000000)='fd/3\x00') ioctl$PPPIOCNEWUNIT(0xffffffffffffffff, 0xc004743e, &(0x7f0000000140)) splice(0xffffffffffffffff, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x2) openat$vhost_vsock(0xffffffffffffff9c, &(0x7f0000000040), 0x2, 0x0) sendmmsg$inet6(r3, &(0x7f00000000c0)=[{{0x0, 0x0, &(0x7f0000000180)=[{&(0x7f0000000680)='A', 0x1}], 0x1}}], 0x1, 0x4000801) executing program 3: r0 = openat$uinput(0xffffffffffffff9c, &(0x7f0000000040), 0x802, 0x0) write$uinput_user_dev(r0, &(0x7f0000000800)={'syz0\x00', {0x2, 0x10, 0x2, 0x4}, 0xf, [0x1, 0x0, 0x0, 0x40000, 0x1, 0x2, 0x4, 0x0, 0x4, 0x0, 0x0, 0x0, 0xfffffffd, 0x0, 0x0, 0x0, 0x4000, 0x20, 0x400, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffd, 0x0, 0x0, 0x2, 0x0, 0x1, 0x2, 0x0, 0x0, 0x7, 0x1, 0x0, 0x0, 0xfffffffe, 0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x29a, 0x1, 0x0, 0x0, 0x0, 0x2000, 0x0, 0xfffffffc, 0x0, 0x0, 0x0, 0x6, 0x0, 0x0, 0x6, 0x5f1, 0x6], [0x0, 0x0, 0x8, 0x0, 0x0, 0x5, 0x0, 0x80, 0x8000, 0x2, 0x9, 0x0, 0x2, 0x0, 0x0, 0x0, 0xfffffffc, 0x0, 0x200, 0x7, 0xfffffffc, 0x0, 0x0, 0x7, 0x0, 0xfffffffc, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffe, 0x3, 0x0, 0xd, 0x0, 0x2, 0x0, 0x3, 0x5, 0xfffffffd, 0x4000000, 0xfffffffd, 0x0, 0x0, 0x0, 0x0, 0x80000, 0x0, 0xfffffffd, 0x0, 0x8, 0x0, 0x0, 0x8, 0x0, 0x0, 0x4, 0xffff], [0x4, 0xfc, 0x0, 0x4, 0x0, 0x0, 0x0, 0x0, 0xb, 0x1, 0x4000000, 0x0, 0x1, 0x4, 0x1000, 0x80, 0x0, 0x200, 0x0, 0xffffffff, 0x400000, 0xfffffffc, 0x0, 0xfffffffd, 0xffffffff, 0x0, 0x0, 0xfffffffd, 0x0, 0x0, 0x20, 0x4, 0x0, 0x0, 0xfffffffe, 0x1, 0x0, 0x18c, 0x0, 0x6, 0x1, 0x0, 0xbda6, 0xe, 0x0, 0x0, 0xfffffffd, 0xffffffff, 0x0, 0x20, 0x100, 0x0, 0x0, 0x204, 0x0, 0x0, 0x4000, 0xfff, 0x6, 0x0, 0x0, 0x0, 0x0, 0x8], [0x40000000, 0x0, 0x74e2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7, 0x40, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffe, 0x0, 0x0, 0x402, 0x40, 0x0, 0x0, 0xbd, 0x0, 0xff, 0x0, 0x0, 0x0, 0x2, 0xc9, 0x0, 0x8, 0x9, 0x0, 0x0, 0xffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x101, 0x80000020, 0x0, 0x0, 0x0, 0x0, 0x40000000, 0x5cb9, 0xcaa, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x4]}, 0x45c) ioctl$UI_DEV_CREATE(r0, 0x5501) ioctl$UI_GET_SYSNAME(r0, 0x8040552c, 0x0) executing program 1: socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000180)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$KVM_SET_REGS(0xffffffffffffffff, 0x4090ae82, &(0x7f0000000380)={[0xb, 0x6, 0x6, 0x4004, 0x2, 0x4, 0xefffffffffffffff, 0x0, 0x0, 0x2000000, 0x20000, 0x1c, 0x0, 0x5], 0x0, 0x41981}) pipe(&(0x7f0000000040)={0xffffffffffffffff, 0xffffffffffffffff}) splice(r1, 0x0, r3, 0x0, 0x8000f28, 0x0) splice(r2, 0x0, r1, 0x0, 0x8, 0xe) write(r0, 0x0, 0x0) mmap(&(0x7f0000000000/0xfbe000)=nil, 0xfbe000, 0x1000002, 0x4012831, 0xffffffffffffffff, 0x0) r4 = syz_open_procfs(0x0, 0x0) mprotect(&(0x7f0000000000/0x3000)=nil, 0x3000, 0x1) lseek(r4, 0x2004, 0x0) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbee2, 0x8031, 0xffffffffffffffff, 0x0) executing program 3: openat$hwrng(0xffffffffffffff9c, &(0x7f0000000300), 0x0, 0x0) bpf$BPF_BTF_GET_NEXT_ID(0x17, 0x0, 0x0) bpf$BPF_GET_BTF_INFO(0xf, &(0x7f0000000000)={0xffffffffffffffff, 0x0, 0x0}, 0x10) socketpair$nbd(0x1, 0x1, 0x0, 0x0) r0 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000040)='memory.current\x00', 0x275a, 0x0) ioctl$sock_inet_SIOCADDRT(0xffffffffffffffff, 0x890b, &(0x7f0000000040)={0x0, {0x2, 0x4e24, @dev={0xac, 0x14, 0x14, 0x2b}}, {0x2, 0x4e23, @multicast2}, {0x2, 0x4e21, @initdev={0xac, 0x1e, 0x0, 0x0}}, 0xfd, 0x0, 0x0, 0x0, 0x7, &(0x7f0000000000)='veth0_virt_wifi\x00', 0x80000001, 0x1, 0x9}) write$binfmt_script(r0, &(0x7f00000004c0), 0x208e24b) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x2, 0x28012, r0, 0x0) bpf$PROG_LOAD(0x5, &(0x7f000000e000)={0xe, 0x4, 0x0, &(0x7f0000000100)='GPL\x00', 0x5, 0xc3, &(0x7f000000cf3d)=""/195, 0x0, 0x0, '\x00', 0x0, @sk_skb, 0xffffffffffffffff, 0x8, &(0x7f00000000c0), 0x8, 0x10, &(0x7f0000000000), 0x10}, 0x94) r1 = openat$ppp(0xffffffffffffff9c, 0x0, 0xc0802, 0x0) ioctl$PPPIOCNEWUNIT(r1, 0xc004743e, &(0x7f00000000c0)) r2 = socket$key(0xf, 0x3, 0x2) r3 = syz_open_procfs(0xffffffffffffffff, &(0x7f00000004c0)='setgroups\x00') writev(r3, 0x0, 0x0) sendmsg$key(r2, &(0x7f00000014c0)={0x0, 0x0, &(0x7f0000000140)={0x0}}, 0x0) madvise(&(0x7f0000000000/0x600000)=nil, 0x600003, 0x15) r4 = openat$procfs(0xffffffffffffff9c, &(0x7f0000000040)='/proc/diskstats\x00', 0x0, 0x0) sendfile(0xffffffffffffffff, r4, 0x0, 0x20c3) pipe2(&(0x7f0000000340)={0xffffffffffffffff, 0xffffffffffffffff}, 0x80000) write$tun(r6, &(0x7f0000000100)={@void, @void, @eth={@remote, @empty, @void, {@mpls_uc={0x8847, {[{0xffffb, 0x0, 0x1}], @ipv6=@gre_packet={0x6, 0x6, 'K\x00', 0x44, 0x2f, 0x1, @mcast1, @dev={0xfe, 0x80, '\x00', 0x36}, {[], {{}, {0x1, 0x0, 0x1, 0x1}, {0x1}, {0x8, 0x88be, 0x4, {{0x1, 0x1, 0xe, 0x1, 0x0, 0x1, 0x1, 0x4}, 0x1, {0xffffffff}}}, {0x8, 0x22eb, 0x0, {{0x3, 0x2, 0x2, 0x2, 0x0, 0x2, 0x3, 0x63}, 0x2, {0x715, 0x1, 0x2, 0x13, 0x0, 0x0, 0x2, 0x0, 0x1}}}}}}}}}}}, 0x7e) read$FUSE(r5, &(0x7f0000002180)={0x2020}, 0x2020) executing program 0: r0 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000040)='cgroup.kill\x00', 0x275a, 0x0) inotify_init1(0x800) pipe(&(0x7f00000001c0)) mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./sys\x00', 0x1ff) mount(0x0, &(0x7f0000000000)='./sys\x00', &(0x7f0000000100)='sysfs\x00', 0x0, 0x0) r1 = openat(0xffffffffffffff9c, &(0x7f0000000200)='./sys/bus/pci/devices/0000:00:00.0/remove\x00', 0x1, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000140)={0xa, 0x8b}, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000280)=0x8) r2 = getpid() sched_setaffinity(0x0, 0x0, 0x0) sched_setscheduler(r2, 0x2, &(0x7f0000000200)=0x7) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeea, 0x8031, 0xffffffffffffffff, 0x28f43000) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$TIOCSPGRP(r1, 0x5410, &(0x7f0000000240)=r2) connect$unix(r3, &(0x7f0000000180)=@abs, 0x6e) sendmmsg$unix(r4, &(0x7f0000000000), 0x651, 0x0) recvmmsg(r3, &(0x7f00000000c0), 0x10106, 0x2, 0x0) mmap$IORING_OFF_SQ_RING(0x110c230000, 0x8000002, 0x2000007, 0x401d031, 0xffffffffffffffff, 0x0) write(r1, &(0x7f0000000300)='1', 0x1) r5 = openat(0xffffffffffffff9c, &(0x7f0000000080)='./sys/bus/pci/rescan\x00', 0x1, 0x0) write(r5, &(0x7f0000000300)='1', 0x1) mkdirat(0xffffffffffffff9c, 0x0, 0x1ff) timer_create(0x0, &(0x7f00000000c0)={0x0, 0x21, 0x2}, 0x0) mprotect(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x5) fcntl$lock(r0, 0x6, &(0x7f0000000080)={0x1, 0x1}) fcntl$lock(r0, 0x7, &(0x7f0000000000)={0x0, 0x2, 0x600000000000000, 0x1d}) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000000)) executing program 2: write(0xffffffffffffffff, &(0x7f0000000340)='0fc5:1227:', 0xa) mmap$IORING_OFF_SQ_RING(0x110c230000, 0x8000002, 0x4, 0x401d031, 0xffffffffffffffff, 0x0) r0 = socket$netlink(0x10, 0x3, 0x4) socket$inet6_tcp(0xa, 0x1, 0x0) fcntl$setstatus(0xffffffffffffffff, 0x4, 0x40800) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000080)=0x7) r1 = getpid() sched_setaffinity(0x0, 0x8, &(0x7f0000000100)=0x2) sched_setscheduler(r1, 0x2, &(0x7f0000000200)=0x4) r2 = syz_open_dev$MSR(&(0x7f00000001c0), 0x0, 0x0) read$msr(r2, &(0x7f0000032680)=""/102392, 0x18ff8) bind$netlink(r0, &(0x7f0000000180)={0x10, 0x0, 0x25dfdbfd, 0x1000000}, 0xc) sched_setaffinity(0x0, 0xfffffef7, &(0x7f0000000740)=0x410000002) r3 = openat$ublk_ctrl(0xffffffffffffff9c, &(0x7f0000000000), 0x2, 0x0) r4 = syz_ublk_setup_io_uring(0x20, &(0x7f0000000080)={0x0, 0x0, 0x0, 0x1, 0x2}, &(0x7f0000000040)=0x0, &(0x7f0000000100)=0x0, &(0x7f00000002c0)=0x0) r8 = syz_ublk_add_dev(r4, r5, r6, r7, &(0x7f0000000200)={0x2e, 0xc, 0x0, r3, 0xc0207504, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', {0xffffffff, 0xffff, 0x40, &(0x7f0000000500)=@new_dev={0x3, 0x104}}}, &(0x7f0000000300)=0x0) r10 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r10, 0x0, 0x80) r11 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_MSG_GETFLOWTABLE(r11, &(0x7f00000010c0)={0x0, 0x0, &(0x7f0000001080)={&(0x7f00000015c0)={0x20, 0x17, 0xa, 0x301, 0x0, 0x0, {0x2, 0x0, 0x4}, [@NFTA_FLOWTABLE_TABLE={0x9, 0x1, 'syz1\x00'}]}, 0x20}}, 0x4) r12 = syz_open_dev$ublk_chdev(&(0x7f0000002000), r8, 0x2) syz_ublk_setup_queues(r12, r9, &(0x7f0000000340)={0x0, 0x92d1, 0x400, 0x80000002, 0x165}, &(0x7f00000007c0)=[{0x0, 0x0, 0xffffffffffffffff, {0x0, 0x7ec5, 0x8, 0x2, 0x2f8, 0x0, r4}}, {0x0, 0x0, 0xffffffffffffffff, {0x0, 0x7dd8, 0x80, 0x1, 0x80000264, 0x0, r4}}, {0x0, 0x0, 0xffffffffffffffff, {0x0, 0xaa92, 0x8, 0x0, 0x67}}, {0x0, 0x0, 0xffffffffffffffff, {0x0, 0x97fb, 0x400, 0x1, 0x38b}}], 0x4, &(0x7f0000001a40)={0x2e, 0x10, 0x0, r12, 0xc0107520, 0x0, 0x0, 0x0, 0x0, {0x9}, 0x0, 0x0, '\x00', {0x0, 0x81c, 0x0, 0x0}}, &(0x7f0000001ac0)) mmap$IORING_OFF_SQ_RING(0x0, 0xc00000, 0x2000007, 0x401d031, 0xffffffffffffffff, 0x0) syz_ublk_setup_queues(r13, 0x0, &(0x7f0000000180)={0x0, 0xfffffffe, 0x0, 0xfffffffe, 0x1002f6}, &(0x7f0000000800)=[{0x0, 0x0, 0xffffffffffffffff, {0x0, 0xe704, 0x40040, 0x1000002, 0x91}}, {0x0, 0x0, 0xffffffffffffffff, {0x0, 0x5c87, 0x20, 0x3, 0x3aa}}, {0x0, 0x0, 0xffffffffffffffff, {0x0, 0x1f70, 0x2, 0x3ffffffe, 0x337}}, {0x0, 0x0, 0xffffffffffffffff, {0x0, 0x4, 0x200, 0x1, 0xffffffff}}], 0x1, 0x0, 0x0) openat$ptmx(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) executing program 2: write(0xffffffffffffffff, &(0x7f0000000340)='0fc5:1227:', 0xa) mmap$IORING_OFF_SQ_RING(0x110c230000, 0x8000002, 0x4, 0x401d031, 0xffffffffffffffff, 0x0) r0 = socket$netlink(0x10, 0x3, 0x4) socket$inet6_tcp(0xa, 0x1, 0x0) fcntl$setstatus(0xffffffffffffffff, 0x4, 0x40800) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000080)=0x7) sched_setaffinity(0x0, 0x8, &(0x7f0000000100)=0x2) sched_setscheduler(0x0, 0x2, &(0x7f0000000200)=0x4) r1 = syz_open_dev$MSR(&(0x7f00000001c0), 0x0, 0x0) read$msr(r1, &(0x7f0000032680)=""/102392, 0x18ff8) bind$netlink(r0, &(0x7f0000000180)={0x10, 0x0, 0x25dfdbfd, 0x1000000}, 0xc) sched_setaffinity(0x0, 0xfffffef7, &(0x7f0000000740)=0x410000002) r2 = openat$ublk_ctrl(0xffffffffffffff9c, &(0x7f0000000000), 0x2, 0x0) r3 = syz_ublk_setup_io_uring(0x20, &(0x7f0000000080)={0x0, 0x0, 0x0, 0x1, 0x2}, &(0x7f0000000040)=0x0, &(0x7f0000000100)=0x0, &(0x7f00000002c0)=0x0) r7 = syz_ublk_add_dev(r3, r4, r5, r6, &(0x7f0000000200)={0x2e, 0xc, 0x0, r2, 0xc0207504, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', {0xffffffff, 0xffff, 0x40, &(0x7f0000000500)=@new_dev={0x3, 0x104}}}, &(0x7f0000000300)) r8 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r8, 0x0, 0x80) r9 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_MSG_GETFLOWTABLE(r9, &(0x7f00000010c0)={0x0, 0x0, &(0x7f0000001080)={&(0x7f00000015c0)={0x20, 0x17, 0xa, 0x301, 0x0, 0x0, {0x2, 0x0, 0x4}, [@NFTA_FLOWTABLE_TABLE={0x9, 0x1, 'syz1\x00'}]}, 0x20}}, 0x4) syz_open_dev$ublk_chdev(&(0x7f0000002000), r7, 0x2) syz_ublk_setup_queues(0xffffffffffffffff, 0x0, &(0x7f0000000180)={0x0, 0xfffffffe, 0x0, 0xfffffffe, 0x1002f6}, &(0x7f0000000800)=[{0x0, 0x0, 0xffffffffffffffff, {0x0, 0xe704, 0x40040, 0x1000002, 0x91}}, {0x0, 0x0, 0xffffffffffffffff, {0x0, 0x5c87, 0x20, 0x3, 0x3aa}}, {0x0, 0x0, 0xffffffffffffffff, {0x0, 0x1f70, 0x2, 0x3ffffffe, 0x337}}, {0x0, 0x0, 0xffffffffffffffff, {0x0, 0x4, 0x200, 0x1, 0xffffffff}}], 0x1, 0x0, 0x0) openat$ptmx(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) executing program 0: prlimit64(0x0, 0xe, &(0x7f0000000140)={0xa, 0x8b}, 0x0) ptrace(0x4207, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000280)=0x8) r0 = getpid() sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x2) sched_setscheduler(r0, 0x2, &(0x7f0000000200)=0x7) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeea, 0x8031, 0xffffffffffffffff, 0x28f43000) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r1, &(0x7f0000000180)=@abs, 0x6e) sendmmsg$unix(r2, 0x0, 0x0, 0x0) recvmmsg(r1, &(0x7f00000000c0), 0x10106, 0x2, 0x0) unshare(0x28000600) r3 = fsopen(&(0x7f00000001c0)='mqueue\x00', 0x0) fsconfig$FSCONFIG_CMD_CREATE(r3, 0x6, 0x0, 0x0, 0x0) fsmount(r3, 0x0, 0x8e) unshare(0x8000280) prlimit64(r0, 0x0, &(0x7f0000000240)={0x0, 0x80}, &(0x7f0000000300)) mprotect(&(0x7f00001a4000/0x1000)=nil, 0x1000, 0x1) munmap(&(0x7f0000002000/0x1000)=nil, 0x1000) close(0xffffffffffffffff) executing program 2: write(0xffffffffffffffff, 0x0, 0x0) r0 = socket$netlink(0x10, 0x3, 0x4) r1 = socket$inet6_tcp(0xa, 0x1, 0x0) bind$inet6(r1, 0x0, 0x0) fcntl$setstatus(0xffffffffffffffff, 0x4, 0x40800) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000080)=0x7) sched_setaffinity(0x0, 0x8, &(0x7f0000000100)=0x2) sched_setscheduler(0x0, 0x2, &(0x7f0000000200)=0x4) r2 = syz_open_dev$MSR(&(0x7f00000001c0), 0x0, 0x0) read$msr(r2, &(0x7f0000032680)=""/102392, 0x18ff8) bind$netlink(r0, &(0x7f0000000180)={0x10, 0x0, 0x25dfdbfd, 0x1000000}, 0xc) sched_setaffinity(0x0, 0xfffffef7, &(0x7f0000000740)=0x410000002) r3 = openat$ublk_ctrl(0xffffffffffffff9c, &(0x7f0000000000), 0x2, 0x0) syz_ublk_add_dev(0xffffffffffffffff, 0x0, 0x0, 0x0, &(0x7f0000000200)={0x2e, 0xc, 0x0, r3, 0xc0207504, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', {0xffffffff, 0xffff, 0x40, &(0x7f0000000500)=@new_dev={0x3, 0x104}}}, &(0x7f0000000300)) r4 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r4, 0x0, 0x80) r5 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_MSG_GETFLOWTABLE(r5, &(0x7f00000010c0)={0x0, 0x0, &(0x7f0000001080)={&(0x7f00000015c0)={0x20, 0x17, 0xa, 0x301, 0x0, 0x0, {0x2, 0x0, 0x4}, [@NFTA_FLOWTABLE_TABLE={0x9, 0x1, 'syz1\x00'}]}, 0x20}}, 0x4) executing program 3: prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000080)=0x8) sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x2) r0 = getpid() bpf$MAP_GET_NEXT_KEY(0x4, 0x0, 0x0) rseq(0x0, 0xfde1, 0x0, 0x0) sched_setscheduler(r0, 0x1, &(0x7f0000000100)=0x5) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000001480)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r1, &(0x7f00000004c0)=@file={0x0, './file0\x00'}, 0x6e) sendmmsg$unix(r2, &(0x7f00000bd000), 0x318, 0x0) sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x2) socket$inet_tcp(0x2, 0x1, 0x0) mremap(&(0x7f0000a96000/0x1000)=nil, 0x1000, 0x400000, 0x3, &(0x7f0000000000/0x400000)=nil) socket$inet_udp(0x2, 0x2, 0x0) r3 = io_uring_setup(0xa2, &(0x7f0000000080)={0x0, 0x592c, 0x2, 0xfffffffc, 0x2}) io_uring_register$IORING_REGISTER_BUFFERS_UPDATE(r3, 0x10, &(0x7f00000003c0)={0x0, 0x0, &(0x7f0000000240)=[{0x0}], 0x0, 0x1}, 0x20) executing program 2: write(0xffffffffffffffff, &(0x7f0000000340)='0fc5:1227:', 0xa) r0 = socket$netlink(0x10, 0x3, 0x4) bind$inet6(0xffffffffffffffff, 0x0, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) sched_setaffinity(0x0, 0x8, &(0x7f0000000100)=0x2) sched_setscheduler(0x0, 0x2, &(0x7f0000000200)=0x4) r1 = syz_open_dev$MSR(&(0x7f00000001c0), 0x0, 0x0) read$msr(r1, &(0x7f0000032680)=""/102392, 0x18ff8) bind$netlink(r0, &(0x7f0000000180)={0x10, 0x0, 0x25dfdbfd, 0x1000000}, 0xc) sched_setaffinity(0x0, 0xfffffef7, &(0x7f0000000740)=0x410000002) r2 = syz_ublk_setup_io_uring(0x20, &(0x7f0000000080)={0x0, 0x0, 0x0, 0x1, 0x2}, &(0x7f0000000040)=0x0, &(0x7f0000000100)=0x0, &(0x7f00000002c0)=0x0) r6 = syz_ublk_add_dev(r2, r3, r4, r5, &(0x7f0000000200)={0x2e, 0xc, 0x0, 0xffffffffffffffff, 0xc0207504, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', {0xffffffff, 0xffff, 0x40, &(0x7f0000000500)=@new_dev={0x3, 0x104}}}, &(0x7f0000000300)=0x0) sendmsg$NFT_BATCH(0xffffffffffffffff, 0x0, 0x80) r8 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_MSG_GETFLOWTABLE(r8, &(0x7f00000010c0)={0x0, 0x0, &(0x7f0000001080)={&(0x7f00000015c0)={0x20, 0x17, 0xa, 0x301, 0x0, 0x0, {0x2, 0x0, 0x4}, [@NFTA_FLOWTABLE_TABLE={0x9, 0x1, 'syz1\x00'}]}, 0x20}}, 0x4) r9 = syz_open_dev$ublk_chdev(&(0x7f0000002000), r6, 0x2) syz_ublk_setup_queues(r9, r7, &(0x7f0000000340)={0x0, 0x92d1, 0x400, 0x80000002, 0x165}, &(0x7f00000007c0)=[{0x0, 0x0, 0xffffffffffffffff, {0x0, 0x7ec5, 0x8, 0x2, 0x2f8, 0x0, r2}}, {0x0, 0x0, 0xffffffffffffffff, {0x0, 0x7dd8, 0x80, 0x1, 0x80000264, 0x0, r2}}, {0x0, 0x0, 0xffffffffffffffff, {0x0, 0xaa92, 0x8, 0x0, 0x67}}, {0x0, 0x0, 0xffffffffffffffff, {0x0, 0x97fb, 0x400, 0x1, 0x38b}}], 0x4, &(0x7f0000001a40)={0x2e, 0x10, 0x0, r9, 0xc0107520, 0x0, 0x0, 0x0, 0x0, {0x9}, 0x0, 0x0, '\x00', {0x0, 0x81c, 0x0, 0x0}}, &(0x7f0000001ac0)) syz_ublk_setup_queues(r10, 0x0, &(0x7f0000000180)={0x0, 0xfffffffe, 0x0, 0xfffffffe, 0x1002f6}, &(0x7f0000000800)=[{0x0, 0x0, 0xffffffffffffffff, {0x0, 0xe704, 0x40040, 0x1000002, 0x91}}, {0x0, 0x0, 0xffffffffffffffff, {0x0, 0x5c87, 0x20, 0x3, 0x3aa}}, {0x0, 0x0, 0xffffffffffffffff, {0x0, 0x1f70, 0x2, 0x3ffffffe, 0x337}}, {0x0, 0x0, 0xffffffffffffffff, {0x0, 0x4, 0x200, 0x1, 0xffffffff}}], 0x1, 0x0, 0x0) openat$ptmx(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) executing program 0: r0 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$nl_generic(r0, &(0x7f00000000c0)={0x0, 0x0, &(0x7f00000003c0)={&(0x7f0000000b40)=ANY=[], 0x34}}, 0x4000) ioctl$BTRFS_IOC_START_SYNC(r0, 0x80089418, &(0x7f0000000000)) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000380)={0x8, 0x100008b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000200)=0x5) openat$sequencer(0xffffffffffffff9c, &(0x7f0000000300), 0x80200, 0x0) r1 = syz_open_dev$sndmidi(&(0x7f00000004c0), 0x2, 0x141102) writev(r1, &(0x7f0000000840)=[{&(0x7f00000002c0)="94", 0xf000}, {0x0}], 0x2) socket$inet6_sctp(0xa, 0x1, 0x84) ioctl$IOCTL_VMCI_VERSION2(0xffffffffffffffff, 0x7a7, 0x0) bind$alg(0xffffffffffffffff, &(0x7f0000000040)={0x26, 'skcipher\x00', 0x0, 0x0, 'xts(aes)\x00'}, 0x58) mkdirat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000)='./cgroup/syz0\x00', 0x1ff) r2 = openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000), 0x200002, 0x0) r3 = openat$cgroup_type(r2, &(0x7f0000000100), 0x2, 0x0) write$cgroup_type(r3, &(0x7f0000000280), 0x9) r4 = openat$cgroup_procs(r2, &(0x7f00000002c0)='cgroup.threads\x00', 0x2, 0x0) write$cgroup_pid(r4, &(0x7f0000000c40), 0x12) r5 = openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000), 0x200002, 0x0) r6 = openat$cgroup_ro(r5, &(0x7f0000000040)='cgroup.freeze\x00', 0x275a, 0x0) syz_io_uring_setup(0xefd, &(0x7f0000000300)={0x0, 0x0, 0x10000, 0x3, 0x55}, &(0x7f0000000100)=0x0, &(0x7f0000000140)=0x0, &(0x7f0000000080)=0x0) syz_io_uring_submit(r7, r8, r9, &(0x7f00000001c0)=@IORING_OP_FIXED_FD_INSTALL={0x36, 0x6, 0x0, r5, 0x0, 0x0, 0x0, 0x1, 0x1}) write$cgroup_int(r6, &(0x7f0000000200)=0x1, 0x12) seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0x0, &(0x7f0000000040)={0x1, &(0x7f0000000000)=[{0x6, 0x0, 0x0, 0x7fff7ffc}]}) syz_ublk_setup_io_uring(0x1d, &(0x7f0000000040)={0x0, 0x30b5, 0x1, 0x2, 0x158}, &(0x7f0000000100), &(0x7f0000000280), &(0x7f0000000140)) socket$inet6_tcp(0xa, 0x1, 0x0) program did not crash replaying the whole log did not cause a kernel crash single: executing 4 programs separately with timeout 6m0s testing program (duration=6m0s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): socket$nl_generic-sendmsg$nl_generic-ioctl$BTRFS_IOC_START_SYNC-prctl$PR_SCHED_CORE-prlimit64-sched_setscheduler-openat$sequencer-syz_open_dev$sndmidi-writev-socket$inet6_sctp-ioctl$IOCTL_VMCI_VERSION2-bind$alg-mkdirat$cgroup_root-openat$cgroup_root-openat$cgroup_type-write$cgroup_type-openat$cgroup_procs-write$cgroup_pid-openat$cgroup_root-openat$cgroup_ro-syz_io_uring_setup-syz_io_uring_submit-write$cgroup_int-seccomp$SECCOMP_SET_MODE_FILTER_LISTENER-syz_ublk_setup_io_uring-socket$inet6_tcp detailed listing: executing program 0: r0 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$nl_generic(r0, &(0x7f00000000c0)={0x0, 0x0, &(0x7f00000003c0)={&(0x7f0000000b40)=ANY=[], 0x34}}, 0x4000) ioctl$BTRFS_IOC_START_SYNC(r0, 0x80089418, &(0x7f0000000000)) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000380)={0x8, 0x100008b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000200)=0x5) openat$sequencer(0xffffffffffffff9c, &(0x7f0000000300), 0x80200, 0x0) r1 = syz_open_dev$sndmidi(&(0x7f00000004c0), 0x2, 0x141102) writev(r1, &(0x7f0000000840)=[{&(0x7f00000002c0)="94", 0xf000}, {0x0}], 0x2) socket$inet6_sctp(0xa, 0x1, 0x84) ioctl$IOCTL_VMCI_VERSION2(0xffffffffffffffff, 0x7a7, 0x0) bind$alg(0xffffffffffffffff, &(0x7f0000000040)={0x26, 'skcipher\x00', 0x0, 0x0, 'xts(aes)\x00'}, 0x58) mkdirat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000)='./cgroup/syz0\x00', 0x1ff) r2 = openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000), 0x200002, 0x0) r3 = openat$cgroup_type(r2, &(0x7f0000000100), 0x2, 0x0) write$cgroup_type(r3, &(0x7f0000000280), 0x9) r4 = openat$cgroup_procs(r2, &(0x7f00000002c0)='cgroup.threads\x00', 0x2, 0x0) write$cgroup_pid(r4, &(0x7f0000000c40), 0x12) r5 = openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000), 0x200002, 0x0) r6 = openat$cgroup_ro(r5, &(0x7f0000000040)='cgroup.freeze\x00', 0x275a, 0x0) syz_io_uring_setup(0xefd, &(0x7f0000000300)={0x0, 0x0, 0x10000, 0x3, 0x55}, &(0x7f0000000100)=0x0, &(0x7f0000000140)=0x0, &(0x7f0000000080)=0x0) syz_io_uring_submit(r7, r8, r9, &(0x7f00000001c0)=@IORING_OP_FIXED_FD_INSTALL={0x36, 0x6, 0x0, r5, 0x0, 0x0, 0x0, 0x1, 0x1}) write$cgroup_int(r6, &(0x7f0000000200)=0x1, 0x12) seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0x0, &(0x7f0000000040)={0x1, &(0x7f0000000000)=[{0x6, 0x0, 0x0, 0x7fff7ffc}]}) syz_ublk_setup_io_uring(0x1d, &(0x7f0000000040)={0x0, 0x30b5, 0x1, 0x2, 0x158}, &(0x7f0000000100), &(0x7f0000000280), &(0x7f0000000140)) socket$inet6_tcp(0xa, 0x1, 0x0) program did not crash testing program (duration=6m0s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): write-socket$netlink-bind$inet6-prlimit64-sched_setaffinity-sched_setscheduler-syz_open_dev$MSR-read$msr-bind$netlink-sched_setaffinity-syz_ublk_setup_io_uring-syz_ublk_add_dev-sendmsg$NFT_BATCH-socket$nl_netfilter-sendmsg$NFT_MSG_GETFLOWTABLE-syz_open_dev$ublk_chdev-syz_ublk_setup_queues-syz_ublk_setup_queues-openat$ptmx detailed listing: executing program 0: write(0xffffffffffffffff, &(0x7f0000000340)='0fc5:1227:', 0xa) r0 = socket$netlink(0x10, 0x3, 0x4) bind$inet6(0xffffffffffffffff, 0x0, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) sched_setaffinity(0x0, 0x8, &(0x7f0000000100)=0x2) sched_setscheduler(0x0, 0x2, &(0x7f0000000200)=0x4) r1 = syz_open_dev$MSR(&(0x7f00000001c0), 0x0, 0x0) read$msr(r1, &(0x7f0000032680)=""/102392, 0x18ff8) bind$netlink(r0, &(0x7f0000000180)={0x10, 0x0, 0x25dfdbfd, 0x1000000}, 0xc) sched_setaffinity(0x0, 0xfffffef7, &(0x7f0000000740)=0x410000002) r2 = syz_ublk_setup_io_uring(0x20, &(0x7f0000000080)={0x0, 0x0, 0x0, 0x1, 0x2}, &(0x7f0000000040)=0x0, &(0x7f0000000100)=0x0, &(0x7f00000002c0)=0x0) r6 = syz_ublk_add_dev(r2, r3, r4, r5, &(0x7f0000000200)={0x2e, 0xc, 0x0, 0xffffffffffffffff, 0xc0207504, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', {0xffffffff, 0xffff, 0x40, &(0x7f0000000500)=@new_dev={0x3, 0x104}}}, &(0x7f0000000300)=0x0) sendmsg$NFT_BATCH(0xffffffffffffffff, 0x0, 0x80) r8 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_MSG_GETFLOWTABLE(r8, &(0x7f00000010c0)={0x0, 0x0, &(0x7f0000001080)={&(0x7f00000015c0)={0x20, 0x17, 0xa, 0x301, 0x0, 0x0, {0x2, 0x0, 0x4}, [@NFTA_FLOWTABLE_TABLE={0x9, 0x1, 'syz1\x00'}]}, 0x20}}, 0x4) r9 = syz_open_dev$ublk_chdev(&(0x7f0000002000), r6, 0x2) syz_ublk_setup_queues(r9, r7, &(0x7f0000000340)={0x0, 0x92d1, 0x400, 0x80000002, 0x165}, &(0x7f00000007c0)=[{0x0, 0x0, 0xffffffffffffffff, {0x0, 0x7ec5, 0x8, 0x2, 0x2f8, 0x0, r2}}, {0x0, 0x0, 0xffffffffffffffff, {0x0, 0x7dd8, 0x80, 0x1, 0x80000264, 0x0, r2}}, {0x0, 0x0, 0xffffffffffffffff, {0x0, 0xaa92, 0x8, 0x0, 0x67}}, {0x0, 0x0, 0xffffffffffffffff, {0x0, 0x97fb, 0x400, 0x1, 0x38b}}], 0x4, &(0x7f0000001a40)={0x2e, 0x10, 0x0, r9, 0xc0107520, 0x0, 0x0, 0x0, 0x0, {0x9}, 0x0, 0x0, '\x00', {0x0, 0x81c, 0x0, 0x0}}, &(0x7f0000001ac0)) syz_ublk_setup_queues(r10, 0x0, &(0x7f0000000180)={0x0, 0xfffffffe, 0x0, 0xfffffffe, 0x1002f6}, &(0x7f0000000800)=[{0x0, 0x0, 0xffffffffffffffff, {0x0, 0xe704, 0x40040, 0x1000002, 0x91}}, {0x0, 0x0, 0xffffffffffffffff, {0x0, 0x5c87, 0x20, 0x3, 0x3aa}}, {0x0, 0x0, 0xffffffffffffffff, {0x0, 0x1f70, 0x2, 0x3ffffffe, 0x337}}, {0x0, 0x0, 0xffffffffffffffff, {0x0, 0x4, 0x200, 0x1, 0xffffffff}}], 0x1, 0x0, 0x0) openat$ptmx(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) VM was preempted during syz execution: failed to run command in VM: instance is preempted, retrying program did not crash testing program (duration=6m0s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): prlimit64-sched_setscheduler-sched_setaffinity-getpid-bpf$MAP_GET_NEXT_KEY-rseq-sched_setscheduler-socketpair$unix-connect$unix-sendmmsg$unix-sched_setaffinity-socket$inet_tcp-mremap-socket$inet_udp-io_uring_setup-io_uring_register$IORING_REGISTER_BUFFERS_UPDATE detailed listing: executing program 0: prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000080)=0x8) sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x2) r0 = getpid() bpf$MAP_GET_NEXT_KEY(0x4, 0x0, 0x0) rseq(0x0, 0xfde1, 0x0, 0x0) sched_setscheduler(r0, 0x1, &(0x7f0000000100)=0x5) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000001480)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r1, &(0x7f00000004c0)=@file={0x0, './file0\x00'}, 0x6e) sendmmsg$unix(r2, &(0x7f00000bd000), 0x318, 0x0) sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x2) socket$inet_tcp(0x2, 0x1, 0x0) mremap(&(0x7f0000a96000/0x1000)=nil, 0x1000, 0x400000, 0x3, &(0x7f0000000000/0x400000)=nil) socket$inet_udp(0x2, 0x2, 0x0) r3 = io_uring_setup(0xa2, &(0x7f0000000080)={0x0, 0x592c, 0x2, 0xfffffffc, 0x2}) io_uring_register$IORING_REGISTER_BUFFERS_UPDATE(r3, 0x10, &(0x7f00000003c0)={0x0, 0x0, &(0x7f0000000240)=[{0x0}], 0x0, 0x1}, 0x20) program did not crash testing program (duration=6m0s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): socketpair$unix-ioctl$KVM_SET_REGS-pipe-splice-splice-write-mmap-syz_open_procfs-mprotect-lseek-mmap detailed listing: executing program 0: socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000180)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$KVM_SET_REGS(0xffffffffffffffff, 0x4090ae82, &(0x7f0000000380)={[0xb, 0x6, 0x6, 0x4004, 0x2, 0x4, 0xefffffffffffffff, 0x0, 0x0, 0x2000000, 0x20000, 0x1c, 0x0, 0x5], 0x0, 0x41981}) pipe(&(0x7f0000000040)={0xffffffffffffffff, 0xffffffffffffffff}) splice(r1, 0x0, r3, 0x0, 0x8000f28, 0x0) splice(r2, 0x0, r1, 0x0, 0x8, 0xe) write(r0, 0x0, 0x0) mmap(&(0x7f0000000000/0xfbe000)=nil, 0xfbe000, 0x1000002, 0x4012831, 0xffffffffffffffff, 0x0) r4 = syz_open_procfs(0x0, 0x0) mprotect(&(0x7f0000000000/0x3000)=nil, 0x3000, 0x1) lseek(r4, 0x2004, 0x0) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbee2, 0x8031, 0xffffffffffffffff, 0x0) program did not crash single: failed to extract reproducer bisect: bisecting 24 programs with base timeout 6m0s testing program (duration=6m6s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): [23, 11, 4, 23, 20, 26, 26, 19, 19, 11, 18, 27, 29, 4, 11, 21, 27, 26, 23, 20, 19, 16, 19, 26] detailed listing: executing program 1: write(0xffffffffffffffff, &(0x7f0000000340)='0fc5:1227:', 0xa) mmap$IORING_OFF_SQ_RING(0x110c230000, 0x8000002, 0x4, 0x401d031, 0xffffffffffffffff, 0x0) r0 = socket$netlink(0x10, 0x3, 0x4) socket$inet6_tcp(0xa, 0x1, 0x0) fcntl$setstatus(0xffffffffffffffff, 0x4, 0x40800) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000080)=0x7) sched_setaffinity(0x0, 0x8, &(0x7f0000000100)=0x2) sched_setscheduler(0x0, 0x2, &(0x7f0000000200)=0x4) r1 = syz_open_dev$MSR(&(0x7f00000001c0), 0x0, 0x0) read$msr(r1, &(0x7f0000032680)=""/102392, 0x18ff8) bind$netlink(r0, &(0x7f0000000180)={0x10, 0x0, 0x25dfdbfd, 0x1000000}, 0xc) sched_setaffinity(0x0, 0xfffffef7, &(0x7f0000000740)=0x410000002) r2 = openat$ublk_ctrl(0xffffffffffffff9c, &(0x7f0000000000), 0x2, 0x0) r3 = syz_ublk_setup_io_uring(0x20, &(0x7f0000000080)={0x0, 0x0, 0x0, 0x1, 0x2}, &(0x7f0000000040)=0x0, &(0x7f0000000100)=0x0, &(0x7f00000002c0)=0x0) r7 = syz_ublk_add_dev(r3, r4, r5, r6, &(0x7f0000000200)={0x2e, 0xc, 0x0, r2, 0xc0207504, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', {0xffffffff, 0xffff, 0x40, &(0x7f0000000500)=@new_dev={0x3, 0x104}}}, &(0x7f0000000300)) r8 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r8, 0x0, 0x80) r9 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_MSG_GETFLOWTABLE(r9, &(0x7f00000010c0)={0x0, 0x0, &(0x7f0000001080)={&(0x7f00000015c0)={0x20, 0x17, 0xa, 0x301, 0x0, 0x0, {0x2, 0x0, 0x4}, [@NFTA_FLOWTABLE_TABLE={0x9, 0x1, 'syz1\x00'}]}, 0x20}}, 0x4) syz_open_dev$ublk_chdev(&(0x7f0000002000), r7, 0x2) syz_ublk_setup_queues(0xffffffffffffffff, 0x0, &(0x7f0000000180)={0x0, 0xfffffffe, 0x0, 0xfffffffe, 0x1002f6}, &(0x7f0000000800)=[{0x0, 0x0, 0xffffffffffffffff, {0x0, 0xe704, 0x40040, 0x1000002, 0x91}}, {0x0, 0x0, 0xffffffffffffffff, {0x0, 0x5c87, 0x20, 0x3, 0x3aa}}, {0x0, 0x0, 0xffffffffffffffff, {0x0, 0x1f70, 0x2, 0x3ffffffe, 0x337}}, {0x0, 0x0, 0xffffffffffffffff, {0x0, 0x4, 0x200, 0x1, 0xffffffff}}], 0x1, 0x0, 0x0) openat$ptmx(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) executing program 1: socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000180)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$KVM_SET_REGS(0xffffffffffffffff, 0x4090ae82, &(0x7f0000000380)={[0xb, 0x6, 0x6, 0x4004, 0x2, 0x4, 0xefffffffffffffff, 0x0, 0x0, 0x2000000, 0x20000, 0x1c, 0x0, 0x5], 0x0, 0x41981}) pipe(&(0x7f0000000040)={0xffffffffffffffff, 0xffffffffffffffff}) splice(r1, 0x0, r3, 0x0, 0x8000f28, 0x0) splice(r2, 0x0, r1, 0x0, 0x8, 0xe) write(r0, 0x0, 0x0) mmap(&(0x7f0000000000/0xfbe000)=nil, 0xfbe000, 0x1000002, 0x4012831, 0xffffffffffffffff, 0x0) r4 = syz_open_procfs(0x0, 0x0) mprotect(&(0x7f0000000000/0x3000)=nil, 0x3000, 0x1) lseek(r4, 0x2004, 0x0) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbee2, 0x8031, 0xffffffffffffffff, 0x0) executing program 1: r0 = openat$uinput(0xffffffffffffff9c, &(0x7f0000000040), 0x802, 0x0) write$uinput_user_dev(r0, &(0x7f0000000800)={'syz0\x00', {0x2, 0x10, 0x2, 0x4}, 0xf, [0x1, 0x0, 0x0, 0x40000, 0x1, 0x2, 0x4, 0x0, 0x4, 0x0, 0x0, 0x0, 0xfffffffd, 0x0, 0x0, 0x0, 0x4000, 0x20, 0x400, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffd, 0x0, 0x0, 0x2, 0x0, 0x1, 0x2, 0x0, 0x0, 0x7, 0x1, 0x0, 0x0, 0xfffffffe, 0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x29a, 0x1, 0x0, 0x0, 0x0, 0x2000, 0x0, 0xfffffffc, 0x0, 0x0, 0x0, 0x6, 0x0, 0x0, 0x6, 0x5f1, 0x6], [0x0, 0x0, 0x8, 0x0, 0x0, 0x5, 0x0, 0x80, 0x8000, 0x2, 0x9, 0x0, 0x2, 0x0, 0x0, 0x0, 0xfffffffc, 0x0, 0x200, 0x7, 0xfffffffc, 0x0, 0x0, 0x7, 0x0, 0xfffffffc, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffe, 0x3, 0x0, 0xd, 0x0, 0x2, 0x0, 0x3, 0x5, 0xfffffffd, 0x4000000, 0xfffffffd, 0x0, 0x0, 0x0, 0x0, 0x80000, 0x0, 0xfffffffd, 0x0, 0x8, 0x0, 0x0, 0x8, 0x0, 0x0, 0x4, 0xffff], [0x4, 0xfc, 0x0, 0x4, 0x0, 0x0, 0x0, 0x0, 0xb, 0x1, 0x4000000, 0x0, 0x1, 0x4, 0x1000, 0x80, 0x0, 0x200, 0x0, 0xffffffff, 0x400000, 0xfffffffc, 0x0, 0xfffffffd, 0xffffffff, 0x0, 0x0, 0xfffffffd, 0x0, 0x0, 0x20, 0x4, 0x0, 0x0, 0xfffffffe, 0x1, 0x0, 0x18c, 0x0, 0x6, 0x1, 0x0, 0xbda6, 0xe, 0x0, 0x0, 0xfffffffd, 0xffffffff, 0x0, 0x20, 0x100, 0x0, 0x0, 0x204, 0x0, 0x0, 0x4000, 0xfff, 0x6, 0x0, 0x0, 0x0, 0x0, 0x8], [0x40000000, 0x0, 0x74e2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7, 0x40, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffe, 0x0, 0x0, 0x402, 0x40, 0x0, 0x0, 0xbd, 0x0, 0xff, 0x0, 0x0, 0x0, 0x2, 0xc9, 0x0, 0x8, 0x9, 0x0, 0x0, 0xffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x101, 0x80000020, 0x0, 0x0, 0x0, 0x0, 0x40000000, 0x5cb9, 0xcaa, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x4]}, 0x45c) ioctl$UI_DEV_CREATE(r0, 0x5501) ioctl$UI_GET_SYSNAME(r0, 0x8040552c, 0x0) executing program 3: write(0xffffffffffffffff, &(0x7f0000000340)='0fc5:1227:', 0xa) mmap$IORING_OFF_SQ_RING(0x110c230000, 0x8000002, 0x4, 0x401d031, 0xffffffffffffffff, 0x0) r0 = socket$netlink(0x10, 0x3, 0x4) socket$inet6_tcp(0xa, 0x1, 0x0) fcntl$setstatus(0xffffffffffffffff, 0x4, 0x40800) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000080)=0x7) sched_setaffinity(0x0, 0x8, &(0x7f0000000100)=0x2) sched_setscheduler(0x0, 0x2, &(0x7f0000000200)=0x4) r1 = syz_open_dev$MSR(&(0x7f00000001c0), 0x0, 0x0) read$msr(r1, &(0x7f0000032680)=""/102392, 0x18ff8) bind$netlink(r0, &(0x7f0000000180)={0x10, 0x0, 0x25dfdbfd, 0x1000000}, 0xc) sched_setaffinity(0x0, 0xfffffef7, &(0x7f0000000740)=0x410000002) r2 = openat$ublk_ctrl(0xffffffffffffff9c, &(0x7f0000000000), 0x2, 0x0) r3 = syz_ublk_setup_io_uring(0x20, &(0x7f0000000080)={0x0, 0x0, 0x0, 0x1, 0x2}, &(0x7f0000000040)=0x0, &(0x7f0000000100)=0x0, &(0x7f00000002c0)=0x0) r7 = syz_ublk_add_dev(r3, r4, r5, r6, &(0x7f0000000200)={0x2e, 0xc, 0x0, r2, 0xc0207504, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', {0xffffffff, 0xffff, 0x40, &(0x7f0000000500)=@new_dev={0x3, 0x104}}}, &(0x7f0000000300)) r8 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r8, 0x0, 0x80) r9 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_MSG_GETFLOWTABLE(r9, &(0x7f00000010c0)={0x0, 0x0, &(0x7f0000001080)={&(0x7f00000015c0)={0x20, 0x17, 0xa, 0x301, 0x0, 0x0, {0x2, 0x0, 0x4}, [@NFTA_FLOWTABLE_TABLE={0x9, 0x1, 'syz1\x00'}]}, 0x20}}, 0x4) syz_open_dev$ublk_chdev(&(0x7f0000002000), r7, 0x2) syz_ublk_setup_queues(0xffffffffffffffff, 0x0, &(0x7f0000000180)={0x0, 0xfffffffe, 0x0, 0xfffffffe, 0x1002f6}, &(0x7f0000000800)=[{0x0, 0x0, 0xffffffffffffffff, {0x0, 0xe704, 0x40040, 0x1000002, 0x91}}, {0x0, 0x0, 0xffffffffffffffff, {0x0, 0x5c87, 0x20, 0x3, 0x3aa}}, {0x0, 0x0, 0xffffffffffffffff, {0x0, 0x1f70, 0x2, 0x3ffffffe, 0x337}}, {0x0, 0x0, 0xffffffffffffffff, {0x0, 0x4, 0x200, 0x1, 0xffffffff}}], 0x1, 0x0, 0x0) openat$ptmx(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) executing program 1: prlimit64(0x0, 0xe, &(0x7f0000000140)={0xa, 0x8b}, 0x0) ptrace(0x4207, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000280)=0x8) r0 = getpid() sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x2) sched_setscheduler(r0, 0x2, &(0x7f0000000200)=0x7) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeea, 0x8031, 0xffffffffffffffff, 0x28f43000) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r1, &(0x7f0000000180)=@abs, 0x6e) sendmmsg$unix(r2, 0x0, 0x0, 0x0) recvmmsg(r1, &(0x7f00000000c0), 0x10106, 0x2, 0x0) unshare(0x28000600) r3 = fsopen(&(0x7f00000001c0)='mqueue\x00', 0x0) fsconfig$FSCONFIG_CMD_CREATE(r3, 0x6, 0x0, 0x0, 0x0) fsmount(r3, 0x0, 0x8e) unshare(0x8000280) prlimit64(r0, 0x0, &(0x7f0000000240)={0x0, 0x80}, &(0x7f0000000300)) mprotect(&(0x7f00001a4000/0x1000)=nil, 0x1000, 0x1) munmap(&(0x7f0000002000/0x1000)=nil, 0x1000) close(0xffffffffffffffff) executing program 0: write(0xffffffffffffffff, &(0x7f0000000340)='0fc5:1227:', 0xa) mmap$IORING_OFF_SQ_RING(0x110c230000, 0x8000002, 0x4, 0x401d031, 0xffffffffffffffff, 0x0) r0 = socket$netlink(0x10, 0x3, 0x4) r1 = socket$inet6_tcp(0xa, 0x1, 0x0) bind$inet6(r1, 0x0, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000080)=0x7) r2 = getpid() sched_setaffinity(0x0, 0x8, &(0x7f0000000100)=0x2) sched_setscheduler(r2, 0x2, &(0x7f0000000200)=0x4) r3 = syz_open_dev$MSR(&(0x7f00000001c0), 0x0, 0x0) read$msr(r3, &(0x7f0000032680)=""/102392, 0x18ff8) bind$netlink(r0, &(0x7f0000000180)={0x10, 0x0, 0x25dfdbfd, 0x1000000}, 0xc) sched_setaffinity(0x0, 0xfffffef7, &(0x7f0000000740)=0x410000002) r4 = openat$ublk_ctrl(0xffffffffffffff9c, &(0x7f0000000000), 0x2, 0x0) r5 = syz_ublk_setup_io_uring(0x20, &(0x7f0000000080)={0x0, 0x0, 0x0, 0x1, 0x2}, &(0x7f0000000040)=0x0, &(0x7f0000000100)=0x0, &(0x7f00000002c0)=0x0) r9 = syz_ublk_add_dev(r5, r6, r7, r8, &(0x7f0000000200)={0x2e, 0xc, 0x0, r4, 0xc0207504, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', {0xffffffff, 0xffff, 0x40, &(0x7f0000000500)=@new_dev={0x3, 0x104}}}, &(0x7f0000000300)=0x0) r11 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r11, 0x0, 0x80) r12 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_MSG_GETFLOWTABLE(r12, &(0x7f00000010c0)={0x0, 0x0, &(0x7f0000001080)={&(0x7f00000015c0)={0x20, 0x17, 0xa, 0x301, 0x0, 0x0, {0x2, 0x0, 0x4}, [@NFTA_FLOWTABLE_TABLE={0x9, 0x1, 'syz1\x00'}]}, 0x20}}, 0x4) r13 = syz_open_dev$ublk_chdev(&(0x7f0000002000), r9, 0x2) syz_ublk_setup_queues(r13, r10, &(0x7f0000000340)={0x0, 0x92d1, 0x400, 0x80000002, 0x165}, &(0x7f00000007c0)=[{0x0, 0x0, 0xffffffffffffffff, {0x0, 0x7ec5, 0x8, 0x2, 0x2f8, 0x0, r5}}, {0x0, 0x0, 0xffffffffffffffff, {0x0, 0x7dd8, 0x80, 0x1, 0x80000264, 0x0, r5}}, {0x0, 0x0, 0xffffffffffffffff, {0x0, 0xaa92, 0x8, 0x0, 0x67}}, {0x0, 0x0, 0xffffffffffffffff, {0x0, 0x97fb, 0x400, 0x1, 0x38b}}], 0x4, &(0x7f0000001a40)={0x2e, 0x10, 0x0, r13, 0xc0107520, 0x0, 0x0, 0x0, 0x0, {0x9}, 0x0, 0x0, '\x00', {0x0, 0x81c, 0x0, 0x0}}, &(0x7f0000001ac0)) mmap$IORING_OFF_SQ_RING(0x0, 0xc00000, 0x2000007, 0x401d031, 0xffffffffffffffff, 0x0) syz_ublk_setup_queues(r14, 0x0, &(0x7f0000000180)={0x0, 0xfffffffe, 0x0, 0xfffffffe, 0x1002f6}, &(0x7f0000000800)=[{0x0, 0x0, 0xffffffffffffffff, {0x0, 0xe704, 0x40040, 0x1000002, 0x91}}, {0x0, 0x0, 0xffffffffffffffff, {0x0, 0x5c87, 0x20, 0x3, 0x3aa}}, {0x0, 0x0, 0xffffffffffffffff, {0x0, 0x1f70, 0x2, 0x3ffffffe, 0x337}}, {0x0, 0x0, 0xffffffffffffffff, {0x0, 0x4, 0x200, 0x1, 0xffffffff}}], 0x1, 0x0, 0x0) openat$ptmx(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) executing program 0: r0 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$nl_generic(r0, &(0x7f00000000c0)={0x0, 0x0, &(0x7f00000003c0)={&(0x7f0000000b40)=ANY=[], 0x34}}, 0x4000) ioctl$BTRFS_IOC_START_SYNC(r0, 0x80089418, &(0x7f0000000000)) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000380)={0x8, 0x100008b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000200)=0x5) openat$sequencer(0xffffffffffffff9c, &(0x7f0000000300), 0x80200, 0x0) r1 = syz_open_dev$sndmidi(&(0x7f00000004c0), 0x2, 0x141102) writev(r1, &(0x7f0000000840)=[{&(0x7f00000002c0)="94", 0xf000}, {0x0}], 0x2) socket$inet6_sctp(0xa, 0x1, 0x84) ioctl$IOCTL_VMCI_VERSION2(0xffffffffffffffff, 0x7a7, 0x0) bind$alg(0xffffffffffffffff, &(0x7f0000000040)={0x26, 'skcipher\x00', 0x0, 0x0, 'xts(aes)\x00'}, 0x58) mkdirat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000)='./cgroup/syz0\x00', 0x1ff) r2 = openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000), 0x200002, 0x0) r3 = openat$cgroup_type(r2, &(0x7f0000000100), 0x2, 0x0) write$cgroup_type(r3, &(0x7f0000000280), 0x9) r4 = openat$cgroup_procs(r2, &(0x7f00000002c0)='cgroup.threads\x00', 0x2, 0x0) write$cgroup_pid(r4, &(0x7f0000000c40), 0x12) r5 = openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000), 0x200002, 0x0) r6 = openat$cgroup_ro(r5, &(0x7f0000000040)='cgroup.freeze\x00', 0x275a, 0x0) syz_io_uring_setup(0xefd, &(0x7f0000000300)={0x0, 0x0, 0x10000, 0x3, 0x55}, &(0x7f0000000100)=0x0, &(0x7f0000000140)=0x0, &(0x7f0000000080)=0x0) syz_io_uring_submit(r7, r8, r9, &(0x7f00000001c0)=@IORING_OP_FIXED_FD_INSTALL={0x36, 0x6, 0x0, r5, 0x0, 0x0, 0x0, 0x1, 0x1}) write$cgroup_int(r6, &(0x7f0000000200)=0x1, 0x12) seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0x0, &(0x7f0000000040)={0x1, &(0x7f0000000000)=[{0x6, 0x0, 0x0, 0x7fff7ffc}]}) syz_ublk_setup_io_uring(0x1d, &(0x7f0000000040)={0x0, 0x30b5, 0x1, 0x2, 0x158}, &(0x7f0000000100), &(0x7f0000000280), &(0x7f0000000140)) socket$inet6_tcp(0xa, 0x1, 0x0) executing program 3: write(0xffffffffffffffff, 0x0, 0x0) r0 = socket$netlink(0x10, 0x3, 0x4) r1 = socket$inet6_tcp(0xa, 0x1, 0x0) bind$inet6(r1, 0x0, 0x0) fcntl$setstatus(0xffffffffffffffff, 0x4, 0x40800) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000080)=0x7) sched_setaffinity(0x0, 0x8, &(0x7f0000000100)=0x2) sched_setscheduler(0x0, 0x2, &(0x7f0000000200)=0x4) r2 = syz_open_dev$MSR(&(0x7f00000001c0), 0x0, 0x0) read$msr(r2, &(0x7f0000032680)=""/102392, 0x18ff8) bind$netlink(r0, &(0x7f0000000180)={0x10, 0x0, 0x25dfdbfd, 0x1000000}, 0xc) sched_setaffinity(0x0, 0xfffffef7, &(0x7f0000000740)=0x410000002) r3 = openat$ublk_ctrl(0xffffffffffffff9c, &(0x7f0000000000), 0x2, 0x0) syz_ublk_add_dev(0xffffffffffffffff, 0x0, 0x0, 0x0, &(0x7f0000000200)={0x2e, 0xc, 0x0, r3, 0xc0207504, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', {0xffffffff, 0xffff, 0x40, &(0x7f0000000500)=@new_dev={0x3, 0x104}}}, &(0x7f0000000300)) r4 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r4, 0x0, 0x80) r5 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_MSG_GETFLOWTABLE(r5, &(0x7f00000010c0)={0x0, 0x0, &(0x7f0000001080)={&(0x7f00000015c0)={0x20, 0x17, 0xa, 0x301, 0x0, 0x0, {0x2, 0x0, 0x4}, [@NFTA_FLOWTABLE_TABLE={0x9, 0x1, 'syz1\x00'}]}, 0x20}}, 0x4) executing program 2: write(0xffffffffffffffff, &(0x7f0000000340)='0fc5:1227:', 0xa) mmap$IORING_OFF_SQ_RING(0x110c230000, 0x8000002, 0x4, 0x401d031, 0xffffffffffffffff, 0x0) bind$inet6(0xffffffffffffffff, 0x0, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) sched_setaffinity(0x0, 0x8, &(0x7f0000000100)=0x2) sched_setscheduler(0x0, 0x2, &(0x7f0000000200)=0x4) r0 = syz_open_dev$MSR(&(0x7f00000001c0), 0x0, 0x0) read$msr(r0, &(0x7f0000032680)=""/102392, 0x18ff8) bind$netlink(0xffffffffffffffff, &(0x7f0000000180)={0x10, 0x0, 0x25dfdbfd, 0x1000000}, 0xc) sched_setaffinity(0x0, 0xfffffef7, &(0x7f0000000740)=0x410000002) r1 = syz_ublk_setup_io_uring(0x20, &(0x7f0000000080)={0x0, 0x0, 0x0, 0x1, 0x2}, &(0x7f0000000040)=0x0, &(0x7f0000000100)=0x0, &(0x7f00000002c0)=0x0) r5 = syz_ublk_add_dev(r1, r2, r3, r4, &(0x7f0000000200)={0x2e, 0xc, 0x0, 0xffffffffffffffff, 0xc0207504, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', {0xffffffff, 0xffff, 0x40, &(0x7f0000000500)=@new_dev={0x3, 0x104}}}, &(0x7f0000000300)=0x0) sendmsg$NFT_BATCH(0xffffffffffffffff, 0x0, 0x80) r7 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_MSG_GETFLOWTABLE(r7, &(0x7f00000010c0)={0x0, 0x0, &(0x7f0000001080)={&(0x7f00000015c0)={0x20, 0x17, 0xa, 0x301, 0x0, 0x0, {0x2, 0x0, 0x4}, [@NFTA_FLOWTABLE_TABLE={0x9, 0x1, 'syz1\x00'}]}, 0x20}}, 0x4) r8 = syz_open_dev$ublk_chdev(&(0x7f0000002000), r5, 0x2) syz_ublk_setup_queues(r8, r6, &(0x7f0000000340)={0x0, 0x92d1, 0x400, 0x80000002, 0x165}, &(0x7f00000007c0)=[{0x0, 0x0, 0xffffffffffffffff, {0x0, 0x7ec5, 0x8, 0x2, 0x2f8, 0x0, r1}}, {0x0, 0x0, 0xffffffffffffffff, {0x0, 0x7dd8, 0x80, 0x1, 0x80000264, 0x0, r1}}, {0x0, 0x0, 0xffffffffffffffff, {0x0, 0xaa92, 0x8, 0x0, 0x67}}, {0x0, 0x0, 0xffffffffffffffff, {0x0, 0x97fb, 0x400, 0x1, 0x38b}}], 0x4, &(0x7f0000001a40)={0x2e, 0x10, 0x0, r8, 0xc0107520, 0x0, 0x0, 0x0, 0x0, {0x9}, 0x0, 0x0, '\x00', {0x0, 0x81c, 0x0, 0x0}}, &(0x7f0000001ac0)) syz_ublk_setup_queues(r9, 0x0, &(0x7f0000000180)={0x0, 0xfffffffe, 0x0, 0xfffffffe, 0x1002f6}, &(0x7f0000000800)=[{0x0, 0x0, 0xffffffffffffffff, {0x0, 0xe704, 0x40040, 0x1000002, 0x91}}, {0x0, 0x0, 0xffffffffffffffff, {0x0, 0x5c87, 0x20, 0x3, 0x3aa}}, {0x0, 0x0, 0xffffffffffffffff, {0x0, 0x1f70, 0x2, 0x3ffffffe, 0x337}}, {0x0, 0x0, 0xffffffffffffffff, {0x0, 0x4, 0x200, 0x1, 0xffffffff}}], 0x1, 0x0, 0x0) openat$ptmx(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) executing program 1: socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000180)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$KVM_SET_REGS(0xffffffffffffffff, 0x4090ae82, &(0x7f0000000380)={[0xb, 0x6, 0x6, 0x4004, 0x2, 0x4, 0xefffffffffffffff, 0x0, 0x0, 0x2000000, 0x20000, 0x1c, 0x0, 0x5], 0x0, 0x41981}) pipe(&(0x7f0000000040)={0xffffffffffffffff, 0xffffffffffffffff}) splice(r1, 0x0, r3, 0x0, 0x8000f28, 0x0) splice(r2, 0x0, r1, 0x0, 0x8, 0xe) write(r0, 0x0, 0x0) mmap(&(0x7f0000000000/0xfbe000)=nil, 0xfbe000, 0x1000002, 0x4012831, 0xffffffffffffffff, 0x0) r4 = syz_open_procfs(0x0, 0x0) mprotect(&(0x7f0000000000/0x3000)=nil, 0x3000, 0x1) lseek(r4, 0x2004, 0x0) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbee2, 0x8031, 0xffffffffffffffff, 0x0) executing program 3: prlimit64(0x0, 0xe, &(0x7f0000000140)={0x9, 0xff}, 0x0) setrlimit(0xd, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000380)=0x7) r0 = getpid() sched_setscheduler(r0, 0x1, &(0x7f00000000c0)=0x7) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000240)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r1, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r2, &(0x7f0000000000), 0x651, 0x0) recvmmsg(r1, &(0x7f00000000c0), 0x10106, 0x2, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000000)=0x6) sendmsg$nl_generic(0xffffffffffffffff, &(0x7f0000000100)={0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x4000002}, 0x4000080) r3 = socket$inet_smc(0x2b, 0x1, 0x0) ioctl$int_in(r3, 0x5421, &(0x7f0000000100)=0x100000001) setsockopt$inet_tcp_int(r3, 0x6, 0x1e, &(0x7f0000000180)=0x1, 0x4) connect$inet(r3, &(0x7f0000000480)={0x2, 0x4e20, @dev={0xac, 0x14, 0x14, 0xbc}}, 0x10) socketpair$unix(0x1, 0x5, 0x0, 0x0) close(r3) executing program 2: r0 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000040)='cgroup.kill\x00', 0x275a, 0x0) inotify_init1(0x800) pipe(&(0x7f00000001c0)) mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./sys\x00', 0x1ff) mount(0x0, &(0x7f0000000000)='./sys\x00', &(0x7f0000000100)='sysfs\x00', 0x0, 0x0) r1 = openat(0xffffffffffffff9c, &(0x7f0000000200)='./sys/bus/pci/devices/0000:00:00.0/remove\x00', 0x1, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000140)={0xa, 0x8b}, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000280)=0x8) r2 = getpid() sched_setaffinity(0x0, 0x0, 0x0) sched_setscheduler(r2, 0x2, &(0x7f0000000200)=0x7) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeea, 0x8031, 0xffffffffffffffff, 0x28f43000) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$TIOCSPGRP(r1, 0x5410, &(0x7f0000000240)=r2) connect$unix(r3, &(0x7f0000000180)=@abs, 0x6e) sendmmsg$unix(r4, &(0x7f0000000000), 0x651, 0x0) recvmmsg(r3, &(0x7f00000000c0), 0x10106, 0x2, 0x0) mmap$IORING_OFF_SQ_RING(0x110c230000, 0x8000002, 0x2000007, 0x401d031, 0xffffffffffffffff, 0x0) write(r1, &(0x7f0000000300)='1', 0x1) r5 = openat(0xffffffffffffff9c, &(0x7f0000000080)='./sys/bus/pci/rescan\x00', 0x1, 0x0) write(r5, &(0x7f0000000300)='1', 0x1) mkdirat(0xffffffffffffff9c, 0x0, 0x1ff) timer_create(0x0, 0x0, &(0x7f0000000300)) mprotect(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x5) fcntl$lock(r0, 0x6, &(0x7f0000000080)={0x1, 0x1}) fcntl$lock(r0, 0x7, &(0x7f0000000000)={0x0, 0x2, 0x600000000000000, 0x1d}) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000000)) executing program 0: r0 = socket$netlink(0x10, 0x3, 0x6) bind$netlink(r0, &(0x7f0000514ff4)={0x10, 0x0, 0x0, 0x2ffffffff}, 0xc) r1 = socket$inet_sctp(0x2, 0x1, 0x84) setsockopt$IP_VS_SO_SET_ADD(r1, 0x0, 0x482, &(0x7f0000000080)={0x84, @broadcast, 0x15, 0x3, 'lblcr\x00', 0xa, 0x4, 0x72}, 0x2c) r2 = socket$kcm(0xa, 0x2, 0x0) sendmsg$sock(r2, &(0x7f0000000400)={&(0x7f0000000580)=@in6={0x2, 0x4e22, 0x0, @dev}, 0x80, 0x0, 0x0, &(0x7f0000000000)=[@mark={{0x14, 0x1, 0x24, 0x3}}], 0x18}, 0x0) r3 = socket$inet6_tcp(0xa, 0x1, 0x0) bind$inet6(r3, &(0x7f0000000280)={0xa, 0x4e22, 0x9, @loopback, 0x3e}, 0x1c) connect$inet6(r3, &(0x7f0000000140)={0xa, 0x4e22, 0x56202329, @empty, 0x4000005}, 0x1c) r4 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r4, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000000200)=@newsa={0x158, 0x10, 0x5, 0x1, 0x0, {{@in6=@loopback, @in6=@loopback, 0x0, 0x0, 0x0, 0x0, 0xa, 0x80, 0x80, 0x0, 0x0, 0x80}, {@in6=@loopback, 0x1234, 0x33}, @in6=@loopback, {0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff}, {0x0, 0x0, 0x0, 0x1}, {}, 0x0, 0x0, 0xa, 0x0, 0x0, 0x80}, [@algo_auth={0x48, 0x1, {{'hmac(sha1)\x00'}}}, @replay_esn_val={0x20, 0x17, {0x1, 0x0, 0x0, 0x2, 0x4000, 0x20, [0x0]}}]}, 0x158}}, 0x0) sendmsg$nl_xfrm(r4, &(0x7f0000000300)={0x0, 0x0, &(0x7f0000000400)={&(0x7f0000000500)=@newpolicy={0xfc, 0x13, 0x5, 0x1, 0x0, {{@in6=@loopback, @in6=@loopback, 0x0, 0x0, 0x0, 0x0, 0xa, 0x80, 0x80}, {0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff}, {}, 0x0, 0x0, 0x1}, [@tmpl={0x44, 0x5, [{{@in6=@loopback, 0x1234, 0x33}, 0xa, @in6=@loopback}]}]}, 0xfc}}, 0x0) syz_open_procfs(0xffffffffffffffff, 0x0) bpf$MAP_CREATE(0x0, &(0x7f0000000640)=ANY=[@ANYBLOB="160000000000000004000000"], 0x48) mmap(&(0x7f0000000000/0xff5000)=nil, 0xff5000, 0x1000002, 0x200000005c831, 0xffffffffffffffff, 0x0) openat$sequencer2(0xffffffffffffff9c, &(0x7f0000000080), 0x0, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000380)={0x8, 0x100008b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000000)=0x7) r5 = syz_open_dev$sndmidi(&(0x7f00000004c0), 0x2, 0x143102) writev(r5, &(0x7f0000000840)=[{&(0x7f00000002c0)="94", 0xf000}, {0x0}], 0x2) remap_file_pages(&(0x7f0000800000/0x800000)=nil, 0x800000, 0x0, 0x0, 0x0) madvise(&(0x7f0000400000/0xc00000)=nil, 0xc00000, 0x9) bpf$PROG_LOAD(0x5, 0x0, 0x0) syz_open_procfs(0x0, &(0x7f0000000000)='fd/3\x00') ioctl$PPPIOCNEWUNIT(0xffffffffffffffff, 0xc004743e, &(0x7f0000000140)) splice(0xffffffffffffffff, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x2) openat$vhost_vsock(0xffffffffffffff9c, &(0x7f0000000040), 0x2, 0x0) sendmmsg$inet6(r3, &(0x7f00000000c0)=[{{0x0, 0x0, &(0x7f0000000180)=[{&(0x7f0000000680)='A', 0x1}], 0x1}}], 0x1, 0x4000801) executing program 3: r0 = openat$uinput(0xffffffffffffff9c, &(0x7f0000000040), 0x802, 0x0) write$uinput_user_dev(r0, &(0x7f0000000800)={'syz0\x00', {0x2, 0x10, 0x2, 0x4}, 0xf, [0x1, 0x0, 0x0, 0x40000, 0x1, 0x2, 0x4, 0x0, 0x4, 0x0, 0x0, 0x0, 0xfffffffd, 0x0, 0x0, 0x0, 0x4000, 0x20, 0x400, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffd, 0x0, 0x0, 0x2, 0x0, 0x1, 0x2, 0x0, 0x0, 0x7, 0x1, 0x0, 0x0, 0xfffffffe, 0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x29a, 0x1, 0x0, 0x0, 0x0, 0x2000, 0x0, 0xfffffffc, 0x0, 0x0, 0x0, 0x6, 0x0, 0x0, 0x6, 0x5f1, 0x6], [0x0, 0x0, 0x8, 0x0, 0x0, 0x5, 0x0, 0x80, 0x8000, 0x2, 0x9, 0x0, 0x2, 0x0, 0x0, 0x0, 0xfffffffc, 0x0, 0x200, 0x7, 0xfffffffc, 0x0, 0x0, 0x7, 0x0, 0xfffffffc, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffe, 0x3, 0x0, 0xd, 0x0, 0x2, 0x0, 0x3, 0x5, 0xfffffffd, 0x4000000, 0xfffffffd, 0x0, 0x0, 0x0, 0x0, 0x80000, 0x0, 0xfffffffd, 0x0, 0x8, 0x0, 0x0, 0x8, 0x0, 0x0, 0x4, 0xffff], [0x4, 0xfc, 0x0, 0x4, 0x0, 0x0, 0x0, 0x0, 0xb, 0x1, 0x4000000, 0x0, 0x1, 0x4, 0x1000, 0x80, 0x0, 0x200, 0x0, 0xffffffff, 0x400000, 0xfffffffc, 0x0, 0xfffffffd, 0xffffffff, 0x0, 0x0, 0xfffffffd, 0x0, 0x0, 0x20, 0x4, 0x0, 0x0, 0xfffffffe, 0x1, 0x0, 0x18c, 0x0, 0x6, 0x1, 0x0, 0xbda6, 0xe, 0x0, 0x0, 0xfffffffd, 0xffffffff, 0x0, 0x20, 0x100, 0x0, 0x0, 0x204, 0x0, 0x0, 0x4000, 0xfff, 0x6, 0x0, 0x0, 0x0, 0x0, 0x8], [0x40000000, 0x0, 0x74e2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7, 0x40, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffe, 0x0, 0x0, 0x402, 0x40, 0x0, 0x0, 0xbd, 0x0, 0xff, 0x0, 0x0, 0x0, 0x2, 0xc9, 0x0, 0x8, 0x9, 0x0, 0x0, 0xffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x101, 0x80000020, 0x0, 0x0, 0x0, 0x0, 0x40000000, 0x5cb9, 0xcaa, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x4]}, 0x45c) ioctl$UI_DEV_CREATE(r0, 0x5501) ioctl$UI_GET_SYSNAME(r0, 0x8040552c, 0x0) executing program 1: socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000180)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$KVM_SET_REGS(0xffffffffffffffff, 0x4090ae82, &(0x7f0000000380)={[0xb, 0x6, 0x6, 0x4004, 0x2, 0x4, 0xefffffffffffffff, 0x0, 0x0, 0x2000000, 0x20000, 0x1c, 0x0, 0x5], 0x0, 0x41981}) pipe(&(0x7f0000000040)={0xffffffffffffffff, 0xffffffffffffffff}) splice(r1, 0x0, r3, 0x0, 0x8000f28, 0x0) splice(r2, 0x0, r1, 0x0, 0x8, 0xe) write(r0, 0x0, 0x0) mmap(&(0x7f0000000000/0xfbe000)=nil, 0xfbe000, 0x1000002, 0x4012831, 0xffffffffffffffff, 0x0) r4 = syz_open_procfs(0x0, 0x0) mprotect(&(0x7f0000000000/0x3000)=nil, 0x3000, 0x1) lseek(r4, 0x2004, 0x0) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbee2, 0x8031, 0xffffffffffffffff, 0x0) executing program 3: openat$hwrng(0xffffffffffffff9c, &(0x7f0000000300), 0x0, 0x0) bpf$BPF_BTF_GET_NEXT_ID(0x17, 0x0, 0x0) bpf$BPF_GET_BTF_INFO(0xf, &(0x7f0000000000)={0xffffffffffffffff, 0x0, 0x0}, 0x10) socketpair$nbd(0x1, 0x1, 0x0, 0x0) r0 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000040)='memory.current\x00', 0x275a, 0x0) ioctl$sock_inet_SIOCADDRT(0xffffffffffffffff, 0x890b, &(0x7f0000000040)={0x0, {0x2, 0x4e24, @dev={0xac, 0x14, 0x14, 0x2b}}, {0x2, 0x4e23, @multicast2}, {0x2, 0x4e21, @initdev={0xac, 0x1e, 0x0, 0x0}}, 0xfd, 0x0, 0x0, 0x0, 0x7, &(0x7f0000000000)='veth0_virt_wifi\x00', 0x80000001, 0x1, 0x9}) write$binfmt_script(r0, &(0x7f00000004c0), 0x208e24b) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x2, 0x28012, r0, 0x0) bpf$PROG_LOAD(0x5, &(0x7f000000e000)={0xe, 0x4, 0x0, &(0x7f0000000100)='GPL\x00', 0x5, 0xc3, &(0x7f000000cf3d)=""/195, 0x0, 0x0, '\x00', 0x0, @sk_skb, 0xffffffffffffffff, 0x8, &(0x7f00000000c0), 0x8, 0x10, &(0x7f0000000000), 0x10}, 0x94) r1 = openat$ppp(0xffffffffffffff9c, 0x0, 0xc0802, 0x0) ioctl$PPPIOCNEWUNIT(r1, 0xc004743e, &(0x7f00000000c0)) r2 = socket$key(0xf, 0x3, 0x2) r3 = syz_open_procfs(0xffffffffffffffff, &(0x7f00000004c0)='setgroups\x00') writev(r3, 0x0, 0x0) sendmsg$key(r2, &(0x7f00000014c0)={0x0, 0x0, &(0x7f0000000140)={0x0}}, 0x0) madvise(&(0x7f0000000000/0x600000)=nil, 0x600003, 0x15) r4 = openat$procfs(0xffffffffffffff9c, &(0x7f0000000040)='/proc/diskstats\x00', 0x0, 0x0) sendfile(0xffffffffffffffff, r4, 0x0, 0x20c3) pipe2(&(0x7f0000000340)={0xffffffffffffffff, 0xffffffffffffffff}, 0x80000) write$tun(r6, &(0x7f0000000100)={@void, @void, @eth={@remote, @empty, @void, {@mpls_uc={0x8847, {[{0xffffb, 0x0, 0x1}], @ipv6=@gre_packet={0x6, 0x6, 'K\x00', 0x44, 0x2f, 0x1, @mcast1, @dev={0xfe, 0x80, '\x00', 0x36}, {[], {{}, {0x1, 0x0, 0x1, 0x1}, {0x1}, {0x8, 0x88be, 0x4, {{0x1, 0x1, 0xe, 0x1, 0x0, 0x1, 0x1, 0x4}, 0x1, {0xffffffff}}}, {0x8, 0x22eb, 0x0, {{0x3, 0x2, 0x2, 0x2, 0x0, 0x2, 0x3, 0x63}, 0x2, {0x715, 0x1, 0x2, 0x13, 0x0, 0x0, 0x2, 0x0, 0x1}}}}}}}}}}}, 0x7e) read$FUSE(r5, &(0x7f0000002180)={0x2020}, 0x2020) executing program 0: r0 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000040)='cgroup.kill\x00', 0x275a, 0x0) inotify_init1(0x800) pipe(&(0x7f00000001c0)) mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./sys\x00', 0x1ff) mount(0x0, &(0x7f0000000000)='./sys\x00', &(0x7f0000000100)='sysfs\x00', 0x0, 0x0) r1 = openat(0xffffffffffffff9c, &(0x7f0000000200)='./sys/bus/pci/devices/0000:00:00.0/remove\x00', 0x1, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000140)={0xa, 0x8b}, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000280)=0x8) r2 = getpid() sched_setaffinity(0x0, 0x0, 0x0) sched_setscheduler(r2, 0x2, &(0x7f0000000200)=0x7) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeea, 0x8031, 0xffffffffffffffff, 0x28f43000) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$TIOCSPGRP(r1, 0x5410, &(0x7f0000000240)=r2) connect$unix(r3, &(0x7f0000000180)=@abs, 0x6e) sendmmsg$unix(r4, &(0x7f0000000000), 0x651, 0x0) recvmmsg(r3, &(0x7f00000000c0), 0x10106, 0x2, 0x0) mmap$IORING_OFF_SQ_RING(0x110c230000, 0x8000002, 0x2000007, 0x401d031, 0xffffffffffffffff, 0x0) write(r1, &(0x7f0000000300)='1', 0x1) r5 = openat(0xffffffffffffff9c, &(0x7f0000000080)='./sys/bus/pci/rescan\x00', 0x1, 0x0) write(r5, &(0x7f0000000300)='1', 0x1) mkdirat(0xffffffffffffff9c, 0x0, 0x1ff) timer_create(0x0, &(0x7f00000000c0)={0x0, 0x21, 0x2}, 0x0) mprotect(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x5) fcntl$lock(r0, 0x6, &(0x7f0000000080)={0x1, 0x1}) fcntl$lock(r0, 0x7, &(0x7f0000000000)={0x0, 0x2, 0x600000000000000, 0x1d}) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000000)) executing program 2: write(0xffffffffffffffff, &(0x7f0000000340)='0fc5:1227:', 0xa) mmap$IORING_OFF_SQ_RING(0x110c230000, 0x8000002, 0x4, 0x401d031, 0xffffffffffffffff, 0x0) r0 = socket$netlink(0x10, 0x3, 0x4) socket$inet6_tcp(0xa, 0x1, 0x0) fcntl$setstatus(0xffffffffffffffff, 0x4, 0x40800) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000080)=0x7) r1 = getpid() sched_setaffinity(0x0, 0x8, &(0x7f0000000100)=0x2) sched_setscheduler(r1, 0x2, &(0x7f0000000200)=0x4) r2 = syz_open_dev$MSR(&(0x7f00000001c0), 0x0, 0x0) read$msr(r2, &(0x7f0000032680)=""/102392, 0x18ff8) bind$netlink(r0, &(0x7f0000000180)={0x10, 0x0, 0x25dfdbfd, 0x1000000}, 0xc) sched_setaffinity(0x0, 0xfffffef7, &(0x7f0000000740)=0x410000002) r3 = openat$ublk_ctrl(0xffffffffffffff9c, &(0x7f0000000000), 0x2, 0x0) r4 = syz_ublk_setup_io_uring(0x20, &(0x7f0000000080)={0x0, 0x0, 0x0, 0x1, 0x2}, &(0x7f0000000040)=0x0, &(0x7f0000000100)=0x0, &(0x7f00000002c0)=0x0) r8 = syz_ublk_add_dev(r4, r5, r6, r7, &(0x7f0000000200)={0x2e, 0xc, 0x0, r3, 0xc0207504, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', {0xffffffff, 0xffff, 0x40, &(0x7f0000000500)=@new_dev={0x3, 0x104}}}, &(0x7f0000000300)=0x0) r10 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r10, 0x0, 0x80) r11 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_MSG_GETFLOWTABLE(r11, &(0x7f00000010c0)={0x0, 0x0, &(0x7f0000001080)={&(0x7f00000015c0)={0x20, 0x17, 0xa, 0x301, 0x0, 0x0, {0x2, 0x0, 0x4}, [@NFTA_FLOWTABLE_TABLE={0x9, 0x1, 'syz1\x00'}]}, 0x20}}, 0x4) r12 = syz_open_dev$ublk_chdev(&(0x7f0000002000), r8, 0x2) syz_ublk_setup_queues(r12, r9, &(0x7f0000000340)={0x0, 0x92d1, 0x400, 0x80000002, 0x165}, &(0x7f00000007c0)=[{0x0, 0x0, 0xffffffffffffffff, {0x0, 0x7ec5, 0x8, 0x2, 0x2f8, 0x0, r4}}, {0x0, 0x0, 0xffffffffffffffff, {0x0, 0x7dd8, 0x80, 0x1, 0x80000264, 0x0, r4}}, {0x0, 0x0, 0xffffffffffffffff, {0x0, 0xaa92, 0x8, 0x0, 0x67}}, {0x0, 0x0, 0xffffffffffffffff, {0x0, 0x97fb, 0x400, 0x1, 0x38b}}], 0x4, &(0x7f0000001a40)={0x2e, 0x10, 0x0, r12, 0xc0107520, 0x0, 0x0, 0x0, 0x0, {0x9}, 0x0, 0x0, '\x00', {0x0, 0x81c, 0x0, 0x0}}, &(0x7f0000001ac0)) mmap$IORING_OFF_SQ_RING(0x0, 0xc00000, 0x2000007, 0x401d031, 0xffffffffffffffff, 0x0) syz_ublk_setup_queues(r13, 0x0, &(0x7f0000000180)={0x0, 0xfffffffe, 0x0, 0xfffffffe, 0x1002f6}, &(0x7f0000000800)=[{0x0, 0x0, 0xffffffffffffffff, {0x0, 0xe704, 0x40040, 0x1000002, 0x91}}, {0x0, 0x0, 0xffffffffffffffff, {0x0, 0x5c87, 0x20, 0x3, 0x3aa}}, {0x0, 0x0, 0xffffffffffffffff, {0x0, 0x1f70, 0x2, 0x3ffffffe, 0x337}}, {0x0, 0x0, 0xffffffffffffffff, {0x0, 0x4, 0x200, 0x1, 0xffffffff}}], 0x1, 0x0, 0x0) openat$ptmx(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) executing program 2: write(0xffffffffffffffff, &(0x7f0000000340)='0fc5:1227:', 0xa) mmap$IORING_OFF_SQ_RING(0x110c230000, 0x8000002, 0x4, 0x401d031, 0xffffffffffffffff, 0x0) r0 = socket$netlink(0x10, 0x3, 0x4) socket$inet6_tcp(0xa, 0x1, 0x0) fcntl$setstatus(0xffffffffffffffff, 0x4, 0x40800) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000080)=0x7) sched_setaffinity(0x0, 0x8, &(0x7f0000000100)=0x2) sched_setscheduler(0x0, 0x2, &(0x7f0000000200)=0x4) r1 = syz_open_dev$MSR(&(0x7f00000001c0), 0x0, 0x0) read$msr(r1, &(0x7f0000032680)=""/102392, 0x18ff8) bind$netlink(r0, &(0x7f0000000180)={0x10, 0x0, 0x25dfdbfd, 0x1000000}, 0xc) sched_setaffinity(0x0, 0xfffffef7, &(0x7f0000000740)=0x410000002) r2 = openat$ublk_ctrl(0xffffffffffffff9c, &(0x7f0000000000), 0x2, 0x0) r3 = syz_ublk_setup_io_uring(0x20, &(0x7f0000000080)={0x0, 0x0, 0x0, 0x1, 0x2}, &(0x7f0000000040)=0x0, &(0x7f0000000100)=0x0, &(0x7f00000002c0)=0x0) r7 = syz_ublk_add_dev(r3, r4, r5, r6, &(0x7f0000000200)={0x2e, 0xc, 0x0, r2, 0xc0207504, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', {0xffffffff, 0xffff, 0x40, &(0x7f0000000500)=@new_dev={0x3, 0x104}}}, &(0x7f0000000300)) r8 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r8, 0x0, 0x80) r9 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_MSG_GETFLOWTABLE(r9, &(0x7f00000010c0)={0x0, 0x0, &(0x7f0000001080)={&(0x7f00000015c0)={0x20, 0x17, 0xa, 0x301, 0x0, 0x0, {0x2, 0x0, 0x4}, [@NFTA_FLOWTABLE_TABLE={0x9, 0x1, 'syz1\x00'}]}, 0x20}}, 0x4) syz_open_dev$ublk_chdev(&(0x7f0000002000), r7, 0x2) syz_ublk_setup_queues(0xffffffffffffffff, 0x0, &(0x7f0000000180)={0x0, 0xfffffffe, 0x0, 0xfffffffe, 0x1002f6}, &(0x7f0000000800)=[{0x0, 0x0, 0xffffffffffffffff, {0x0, 0xe704, 0x40040, 0x1000002, 0x91}}, {0x0, 0x0, 0xffffffffffffffff, {0x0, 0x5c87, 0x20, 0x3, 0x3aa}}, {0x0, 0x0, 0xffffffffffffffff, {0x0, 0x1f70, 0x2, 0x3ffffffe, 0x337}}, {0x0, 0x0, 0xffffffffffffffff, {0x0, 0x4, 0x200, 0x1, 0xffffffff}}], 0x1, 0x0, 0x0) openat$ptmx(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) executing program 0: prlimit64(0x0, 0xe, &(0x7f0000000140)={0xa, 0x8b}, 0x0) ptrace(0x4207, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000280)=0x8) r0 = getpid() sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x2) sched_setscheduler(r0, 0x2, &(0x7f0000000200)=0x7) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeea, 0x8031, 0xffffffffffffffff, 0x28f43000) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r1, &(0x7f0000000180)=@abs, 0x6e) sendmmsg$unix(r2, 0x0, 0x0, 0x0) recvmmsg(r1, &(0x7f00000000c0), 0x10106, 0x2, 0x0) unshare(0x28000600) r3 = fsopen(&(0x7f00000001c0)='mqueue\x00', 0x0) fsconfig$FSCONFIG_CMD_CREATE(r3, 0x6, 0x0, 0x0, 0x0) fsmount(r3, 0x0, 0x8e) unshare(0x8000280) prlimit64(r0, 0x0, &(0x7f0000000240)={0x0, 0x80}, &(0x7f0000000300)) mprotect(&(0x7f00001a4000/0x1000)=nil, 0x1000, 0x1) munmap(&(0x7f0000002000/0x1000)=nil, 0x1000) close(0xffffffffffffffff) executing program 2: write(0xffffffffffffffff, 0x0, 0x0) r0 = socket$netlink(0x10, 0x3, 0x4) r1 = socket$inet6_tcp(0xa, 0x1, 0x0) bind$inet6(r1, 0x0, 0x0) fcntl$setstatus(0xffffffffffffffff, 0x4, 0x40800) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000080)=0x7) sched_setaffinity(0x0, 0x8, &(0x7f0000000100)=0x2) sched_setscheduler(0x0, 0x2, &(0x7f0000000200)=0x4) r2 = syz_open_dev$MSR(&(0x7f00000001c0), 0x0, 0x0) read$msr(r2, &(0x7f0000032680)=""/102392, 0x18ff8) bind$netlink(r0, &(0x7f0000000180)={0x10, 0x0, 0x25dfdbfd, 0x1000000}, 0xc) sched_setaffinity(0x0, 0xfffffef7, &(0x7f0000000740)=0x410000002) r3 = openat$ublk_ctrl(0xffffffffffffff9c, &(0x7f0000000000), 0x2, 0x0) syz_ublk_add_dev(0xffffffffffffffff, 0x0, 0x0, 0x0, &(0x7f0000000200)={0x2e, 0xc, 0x0, r3, 0xc0207504, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', {0xffffffff, 0xffff, 0x40, &(0x7f0000000500)=@new_dev={0x3, 0x104}}}, &(0x7f0000000300)) r4 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r4, 0x0, 0x80) r5 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_MSG_GETFLOWTABLE(r5, &(0x7f00000010c0)={0x0, 0x0, &(0x7f0000001080)={&(0x7f00000015c0)={0x20, 0x17, 0xa, 0x301, 0x0, 0x0, {0x2, 0x0, 0x4}, [@NFTA_FLOWTABLE_TABLE={0x9, 0x1, 'syz1\x00'}]}, 0x20}}, 0x4) executing program 3: prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000080)=0x8) sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x2) r0 = getpid() bpf$MAP_GET_NEXT_KEY(0x4, 0x0, 0x0) rseq(0x0, 0xfde1, 0x0, 0x0) sched_setscheduler(r0, 0x1, &(0x7f0000000100)=0x5) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000001480)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r1, &(0x7f00000004c0)=@file={0x0, './file0\x00'}, 0x6e) sendmmsg$unix(r2, &(0x7f00000bd000), 0x318, 0x0) sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x2) socket$inet_tcp(0x2, 0x1, 0x0) mremap(&(0x7f0000a96000/0x1000)=nil, 0x1000, 0x400000, 0x3, &(0x7f0000000000/0x400000)=nil) socket$inet_udp(0x2, 0x2, 0x0) r3 = io_uring_setup(0xa2, &(0x7f0000000080)={0x0, 0x592c, 0x2, 0xfffffffc, 0x2}) io_uring_register$IORING_REGISTER_BUFFERS_UPDATE(r3, 0x10, &(0x7f00000003c0)={0x0, 0x0, &(0x7f0000000240)=[{0x0}], 0x0, 0x1}, 0x20) executing program 2: write(0xffffffffffffffff, &(0x7f0000000340)='0fc5:1227:', 0xa) r0 = socket$netlink(0x10, 0x3, 0x4) bind$inet6(0xffffffffffffffff, 0x0, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) sched_setaffinity(0x0, 0x8, &(0x7f0000000100)=0x2) sched_setscheduler(0x0, 0x2, &(0x7f0000000200)=0x4) r1 = syz_open_dev$MSR(&(0x7f00000001c0), 0x0, 0x0) read$msr(r1, &(0x7f0000032680)=""/102392, 0x18ff8) bind$netlink(r0, &(0x7f0000000180)={0x10, 0x0, 0x25dfdbfd, 0x1000000}, 0xc) sched_setaffinity(0x0, 0xfffffef7, &(0x7f0000000740)=0x410000002) r2 = syz_ublk_setup_io_uring(0x20, &(0x7f0000000080)={0x0, 0x0, 0x0, 0x1, 0x2}, &(0x7f0000000040)=0x0, &(0x7f0000000100)=0x0, &(0x7f00000002c0)=0x0) r6 = syz_ublk_add_dev(r2, r3, r4, r5, &(0x7f0000000200)={0x2e, 0xc, 0x0, 0xffffffffffffffff, 0xc0207504, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', {0xffffffff, 0xffff, 0x40, &(0x7f0000000500)=@new_dev={0x3, 0x104}}}, &(0x7f0000000300)=0x0) sendmsg$NFT_BATCH(0xffffffffffffffff, 0x0, 0x80) r8 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_MSG_GETFLOWTABLE(r8, &(0x7f00000010c0)={0x0, 0x0, &(0x7f0000001080)={&(0x7f00000015c0)={0x20, 0x17, 0xa, 0x301, 0x0, 0x0, {0x2, 0x0, 0x4}, [@NFTA_FLOWTABLE_TABLE={0x9, 0x1, 'syz1\x00'}]}, 0x20}}, 0x4) r9 = syz_open_dev$ublk_chdev(&(0x7f0000002000), r6, 0x2) syz_ublk_setup_queues(r9, r7, &(0x7f0000000340)={0x0, 0x92d1, 0x400, 0x80000002, 0x165}, &(0x7f00000007c0)=[{0x0, 0x0, 0xffffffffffffffff, {0x0, 0x7ec5, 0x8, 0x2, 0x2f8, 0x0, r2}}, {0x0, 0x0, 0xffffffffffffffff, {0x0, 0x7dd8, 0x80, 0x1, 0x80000264, 0x0, r2}}, {0x0, 0x0, 0xffffffffffffffff, {0x0, 0xaa92, 0x8, 0x0, 0x67}}, {0x0, 0x0, 0xffffffffffffffff, {0x0, 0x97fb, 0x400, 0x1, 0x38b}}], 0x4, &(0x7f0000001a40)={0x2e, 0x10, 0x0, r9, 0xc0107520, 0x0, 0x0, 0x0, 0x0, {0x9}, 0x0, 0x0, '\x00', {0x0, 0x81c, 0x0, 0x0}}, &(0x7f0000001ac0)) syz_ublk_setup_queues(r10, 0x0, &(0x7f0000000180)={0x0, 0xfffffffe, 0x0, 0xfffffffe, 0x1002f6}, &(0x7f0000000800)=[{0x0, 0x0, 0xffffffffffffffff, {0x0, 0xe704, 0x40040, 0x1000002, 0x91}}, {0x0, 0x0, 0xffffffffffffffff, {0x0, 0x5c87, 0x20, 0x3, 0x3aa}}, {0x0, 0x0, 0xffffffffffffffff, {0x0, 0x1f70, 0x2, 0x3ffffffe, 0x337}}, {0x0, 0x0, 0xffffffffffffffff, {0x0, 0x4, 0x200, 0x1, 0xffffffff}}], 0x1, 0x0, 0x0) openat$ptmx(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) executing program 0: r0 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$nl_generic(r0, &(0x7f00000000c0)={0x0, 0x0, &(0x7f00000003c0)={&(0x7f0000000b40)=ANY=[], 0x34}}, 0x4000) ioctl$BTRFS_IOC_START_SYNC(r0, 0x80089418, &(0x7f0000000000)) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000380)={0x8, 0x100008b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000200)=0x5) openat$sequencer(0xffffffffffffff9c, &(0x7f0000000300), 0x80200, 0x0) r1 = syz_open_dev$sndmidi(&(0x7f00000004c0), 0x2, 0x141102) writev(r1, &(0x7f0000000840)=[{&(0x7f00000002c0)="94", 0xf000}, {0x0}], 0x2) socket$inet6_sctp(0xa, 0x1, 0x84) ioctl$IOCTL_VMCI_VERSION2(0xffffffffffffffff, 0x7a7, 0x0) bind$alg(0xffffffffffffffff, &(0x7f0000000040)={0x26, 'skcipher\x00', 0x0, 0x0, 'xts(aes)\x00'}, 0x58) mkdirat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000)='./cgroup/syz0\x00', 0x1ff) r2 = openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000), 0x200002, 0x0) r3 = openat$cgroup_type(r2, &(0x7f0000000100), 0x2, 0x0) write$cgroup_type(r3, &(0x7f0000000280), 0x9) r4 = openat$cgroup_procs(r2, &(0x7f00000002c0)='cgroup.threads\x00', 0x2, 0x0) write$cgroup_pid(r4, &(0x7f0000000c40), 0x12) r5 = openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000), 0x200002, 0x0) r6 = openat$cgroup_ro(r5, &(0x7f0000000040)='cgroup.freeze\x00', 0x275a, 0x0) syz_io_uring_setup(0xefd, &(0x7f0000000300)={0x0, 0x0, 0x10000, 0x3, 0x55}, &(0x7f0000000100)=0x0, &(0x7f0000000140)=0x0, &(0x7f0000000080)=0x0) syz_io_uring_submit(r7, r8, r9, &(0x7f00000001c0)=@IORING_OP_FIXED_FD_INSTALL={0x36, 0x6, 0x0, r5, 0x0, 0x0, 0x0, 0x1, 0x1}) write$cgroup_int(r6, &(0x7f0000000200)=0x1, 0x12) seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0x0, &(0x7f0000000040)={0x1, &(0x7f0000000000)=[{0x6, 0x0, 0x0, 0x7fff7ffc}]}) syz_ublk_setup_io_uring(0x1d, &(0x7f0000000040)={0x0, 0x30b5, 0x1, 0x2, 0x158}, &(0x7f0000000100), &(0x7f0000000280), &(0x7f0000000140)) socket$inet6_tcp(0xa, 0x1, 0x0) program crashed: WARNING in io_ring_exit_work bisect: bisecting 24 programs bisect: split chunks (needed=false): <24> bisect: split chunk #0 of len 24 into 3 parts bisect: testing without sub-chunk 1/3 testing program (duration=6m4s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): [19, 11, 18, 27, 29, 4, 11, 21, 27, 26, 23, 20, 19, 16, 19, 26] detailed listing: executing program 2: write(0xffffffffffffffff, &(0x7f0000000340)='0fc5:1227:', 0xa) mmap$IORING_OFF_SQ_RING(0x110c230000, 0x8000002, 0x4, 0x401d031, 0xffffffffffffffff, 0x0) bind$inet6(0xffffffffffffffff, 0x0, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) sched_setaffinity(0x0, 0x8, &(0x7f0000000100)=0x2) sched_setscheduler(0x0, 0x2, &(0x7f0000000200)=0x4) r0 = syz_open_dev$MSR(&(0x7f00000001c0), 0x0, 0x0) read$msr(r0, &(0x7f0000032680)=""/102392, 0x18ff8) bind$netlink(0xffffffffffffffff, &(0x7f0000000180)={0x10, 0x0, 0x25dfdbfd, 0x1000000}, 0xc) sched_setaffinity(0x0, 0xfffffef7, &(0x7f0000000740)=0x410000002) r1 = syz_ublk_setup_io_uring(0x20, &(0x7f0000000080)={0x0, 0x0, 0x0, 0x1, 0x2}, &(0x7f0000000040)=0x0, &(0x7f0000000100)=0x0, &(0x7f00000002c0)=0x0) r5 = syz_ublk_add_dev(r1, r2, r3, r4, &(0x7f0000000200)={0x2e, 0xc, 0x0, 0xffffffffffffffff, 0xc0207504, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', {0xffffffff, 0xffff, 0x40, &(0x7f0000000500)=@new_dev={0x3, 0x104}}}, &(0x7f0000000300)=0x0) sendmsg$NFT_BATCH(0xffffffffffffffff, 0x0, 0x80) r7 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_MSG_GETFLOWTABLE(r7, &(0x7f00000010c0)={0x0, 0x0, &(0x7f0000001080)={&(0x7f00000015c0)={0x20, 0x17, 0xa, 0x301, 0x0, 0x0, {0x2, 0x0, 0x4}, [@NFTA_FLOWTABLE_TABLE={0x9, 0x1, 'syz1\x00'}]}, 0x20}}, 0x4) r8 = syz_open_dev$ublk_chdev(&(0x7f0000002000), r5, 0x2) syz_ublk_setup_queues(r8, r6, &(0x7f0000000340)={0x0, 0x92d1, 0x400, 0x80000002, 0x165}, &(0x7f00000007c0)=[{0x0, 0x0, 0xffffffffffffffff, {0x0, 0x7ec5, 0x8, 0x2, 0x2f8, 0x0, r1}}, {0x0, 0x0, 0xffffffffffffffff, {0x0, 0x7dd8, 0x80, 0x1, 0x80000264, 0x0, r1}}, {0x0, 0x0, 0xffffffffffffffff, {0x0, 0xaa92, 0x8, 0x0, 0x67}}, {0x0, 0x0, 0xffffffffffffffff, {0x0, 0x97fb, 0x400, 0x1, 0x38b}}], 0x4, &(0x7f0000001a40)={0x2e, 0x10, 0x0, r8, 0xc0107520, 0x0, 0x0, 0x0, 0x0, {0x9}, 0x0, 0x0, '\x00', {0x0, 0x81c, 0x0, 0x0}}, &(0x7f0000001ac0)) syz_ublk_setup_queues(r9, 0x0, &(0x7f0000000180)={0x0, 0xfffffffe, 0x0, 0xfffffffe, 0x1002f6}, &(0x7f0000000800)=[{0x0, 0x0, 0xffffffffffffffff, {0x0, 0xe704, 0x40040, 0x1000002, 0x91}}, {0x0, 0x0, 0xffffffffffffffff, {0x0, 0x5c87, 0x20, 0x3, 0x3aa}}, {0x0, 0x0, 0xffffffffffffffff, {0x0, 0x1f70, 0x2, 0x3ffffffe, 0x337}}, {0x0, 0x0, 0xffffffffffffffff, {0x0, 0x4, 0x200, 0x1, 0xffffffff}}], 0x1, 0x0, 0x0) openat$ptmx(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) executing program 1: socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000180)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$KVM_SET_REGS(0xffffffffffffffff, 0x4090ae82, &(0x7f0000000380)={[0xb, 0x6, 0x6, 0x4004, 0x2, 0x4, 0xefffffffffffffff, 0x0, 0x0, 0x2000000, 0x20000, 0x1c, 0x0, 0x5], 0x0, 0x41981}) pipe(&(0x7f0000000040)={0xffffffffffffffff, 0xffffffffffffffff}) splice(r1, 0x0, r3, 0x0, 0x8000f28, 0x0) splice(r2, 0x0, r1, 0x0, 0x8, 0xe) write(r0, 0x0, 0x0) mmap(&(0x7f0000000000/0xfbe000)=nil, 0xfbe000, 0x1000002, 0x4012831, 0xffffffffffffffff, 0x0) r4 = syz_open_procfs(0x0, 0x0) mprotect(&(0x7f0000000000/0x3000)=nil, 0x3000, 0x1) lseek(r4, 0x2004, 0x0) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbee2, 0x8031, 0xffffffffffffffff, 0x0) executing program 3: prlimit64(0x0, 0xe, &(0x7f0000000140)={0x9, 0xff}, 0x0) setrlimit(0xd, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000380)=0x7) r0 = getpid() sched_setscheduler(r0, 0x1, &(0x7f00000000c0)=0x7) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000240)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r1, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r2, &(0x7f0000000000), 0x651, 0x0) recvmmsg(r1, &(0x7f00000000c0), 0x10106, 0x2, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000000)=0x6) sendmsg$nl_generic(0xffffffffffffffff, &(0x7f0000000100)={0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x4000002}, 0x4000080) r3 = socket$inet_smc(0x2b, 0x1, 0x0) ioctl$int_in(r3, 0x5421, &(0x7f0000000100)=0x100000001) setsockopt$inet_tcp_int(r3, 0x6, 0x1e, &(0x7f0000000180)=0x1, 0x4) connect$inet(r3, &(0x7f0000000480)={0x2, 0x4e20, @dev={0xac, 0x14, 0x14, 0xbc}}, 0x10) socketpair$unix(0x1, 0x5, 0x0, 0x0) close(r3) executing program 2: r0 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000040)='cgroup.kill\x00', 0x275a, 0x0) inotify_init1(0x800) pipe(&(0x7f00000001c0)) mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./sys\x00', 0x1ff) mount(0x0, &(0x7f0000000000)='./sys\x00', &(0x7f0000000100)='sysfs\x00', 0x0, 0x0) r1 = openat(0xffffffffffffff9c, &(0x7f0000000200)='./sys/bus/pci/devices/0000:00:00.0/remove\x00', 0x1, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000140)={0xa, 0x8b}, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000280)=0x8) r2 = getpid() sched_setaffinity(0x0, 0x0, 0x0) sched_setscheduler(r2, 0x2, &(0x7f0000000200)=0x7) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeea, 0x8031, 0xffffffffffffffff, 0x28f43000) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$TIOCSPGRP(r1, 0x5410, &(0x7f0000000240)=r2) connect$unix(r3, &(0x7f0000000180)=@abs, 0x6e) sendmmsg$unix(r4, &(0x7f0000000000), 0x651, 0x0) recvmmsg(r3, &(0x7f00000000c0), 0x10106, 0x2, 0x0) mmap$IORING_OFF_SQ_RING(0x110c230000, 0x8000002, 0x2000007, 0x401d031, 0xffffffffffffffff, 0x0) write(r1, &(0x7f0000000300)='1', 0x1) r5 = openat(0xffffffffffffff9c, &(0x7f0000000080)='./sys/bus/pci/rescan\x00', 0x1, 0x0) write(r5, &(0x7f0000000300)='1', 0x1) mkdirat(0xffffffffffffff9c, 0x0, 0x1ff) timer_create(0x0, 0x0, &(0x7f0000000300)) mprotect(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x5) fcntl$lock(r0, 0x6, &(0x7f0000000080)={0x1, 0x1}) fcntl$lock(r0, 0x7, &(0x7f0000000000)={0x0, 0x2, 0x600000000000000, 0x1d}) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000000)) executing program 0: r0 = socket$netlink(0x10, 0x3, 0x6) bind$netlink(r0, &(0x7f0000514ff4)={0x10, 0x0, 0x0, 0x2ffffffff}, 0xc) r1 = socket$inet_sctp(0x2, 0x1, 0x84) setsockopt$IP_VS_SO_SET_ADD(r1, 0x0, 0x482, &(0x7f0000000080)={0x84, @broadcast, 0x15, 0x3, 'lblcr\x00', 0xa, 0x4, 0x72}, 0x2c) r2 = socket$kcm(0xa, 0x2, 0x0) sendmsg$sock(r2, &(0x7f0000000400)={&(0x7f0000000580)=@in6={0x2, 0x4e22, 0x0, @dev}, 0x80, 0x0, 0x0, &(0x7f0000000000)=[@mark={{0x14, 0x1, 0x24, 0x3}}], 0x18}, 0x0) r3 = socket$inet6_tcp(0xa, 0x1, 0x0) bind$inet6(r3, &(0x7f0000000280)={0xa, 0x4e22, 0x9, @loopback, 0x3e}, 0x1c) connect$inet6(r3, &(0x7f0000000140)={0xa, 0x4e22, 0x56202329, @empty, 0x4000005}, 0x1c) r4 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r4, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000000200)=@newsa={0x158, 0x10, 0x5, 0x1, 0x0, {{@in6=@loopback, @in6=@loopback, 0x0, 0x0, 0x0, 0x0, 0xa, 0x80, 0x80, 0x0, 0x0, 0x80}, {@in6=@loopback, 0x1234, 0x33}, @in6=@loopback, {0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff}, {0x0, 0x0, 0x0, 0x1}, {}, 0x0, 0x0, 0xa, 0x0, 0x0, 0x80}, [@algo_auth={0x48, 0x1, {{'hmac(sha1)\x00'}}}, @replay_esn_val={0x20, 0x17, {0x1, 0x0, 0x0, 0x2, 0x4000, 0x20, [0x0]}}]}, 0x158}}, 0x0) sendmsg$nl_xfrm(r4, &(0x7f0000000300)={0x0, 0x0, &(0x7f0000000400)={&(0x7f0000000500)=@newpolicy={0xfc, 0x13, 0x5, 0x1, 0x0, {{@in6=@loopback, @in6=@loopback, 0x0, 0x0, 0x0, 0x0, 0xa, 0x80, 0x80}, {0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff}, {}, 0x0, 0x0, 0x1}, [@tmpl={0x44, 0x5, [{{@in6=@loopback, 0x1234, 0x33}, 0xa, @in6=@loopback}]}]}, 0xfc}}, 0x0) syz_open_procfs(0xffffffffffffffff, 0x0) bpf$MAP_CREATE(0x0, &(0x7f0000000640)=ANY=[@ANYBLOB="160000000000000004000000"], 0x48) mmap(&(0x7f0000000000/0xff5000)=nil, 0xff5000, 0x1000002, 0x200000005c831, 0xffffffffffffffff, 0x0) openat$sequencer2(0xffffffffffffff9c, &(0x7f0000000080), 0x0, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000380)={0x8, 0x100008b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000000)=0x7) r5 = syz_open_dev$sndmidi(&(0x7f00000004c0), 0x2, 0x143102) writev(r5, &(0x7f0000000840)=[{&(0x7f00000002c0)="94", 0xf000}, {0x0}], 0x2) remap_file_pages(&(0x7f0000800000/0x800000)=nil, 0x800000, 0x0, 0x0, 0x0) madvise(&(0x7f0000400000/0xc00000)=nil, 0xc00000, 0x9) bpf$PROG_LOAD(0x5, 0x0, 0x0) syz_open_procfs(0x0, &(0x7f0000000000)='fd/3\x00') ioctl$PPPIOCNEWUNIT(0xffffffffffffffff, 0xc004743e, &(0x7f0000000140)) splice(0xffffffffffffffff, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x2) openat$vhost_vsock(0xffffffffffffff9c, &(0x7f0000000040), 0x2, 0x0) sendmmsg$inet6(r3, &(0x7f00000000c0)=[{{0x0, 0x0, &(0x7f0000000180)=[{&(0x7f0000000680)='A', 0x1}], 0x1}}], 0x1, 0x4000801) executing program 3: r0 = openat$uinput(0xffffffffffffff9c, &(0x7f0000000040), 0x802, 0x0) write$uinput_user_dev(r0, &(0x7f0000000800)={'syz0\x00', {0x2, 0x10, 0x2, 0x4}, 0xf, [0x1, 0x0, 0x0, 0x40000, 0x1, 0x2, 0x4, 0x0, 0x4, 0x0, 0x0, 0x0, 0xfffffffd, 0x0, 0x0, 0x0, 0x4000, 0x20, 0x400, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffd, 0x0, 0x0, 0x2, 0x0, 0x1, 0x2, 0x0, 0x0, 0x7, 0x1, 0x0, 0x0, 0xfffffffe, 0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x29a, 0x1, 0x0, 0x0, 0x0, 0x2000, 0x0, 0xfffffffc, 0x0, 0x0, 0x0, 0x6, 0x0, 0x0, 0x6, 0x5f1, 0x6], [0x0, 0x0, 0x8, 0x0, 0x0, 0x5, 0x0, 0x80, 0x8000, 0x2, 0x9, 0x0, 0x2, 0x0, 0x0, 0x0, 0xfffffffc, 0x0, 0x200, 0x7, 0xfffffffc, 0x0, 0x0, 0x7, 0x0, 0xfffffffc, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffe, 0x3, 0x0, 0xd, 0x0, 0x2, 0x0, 0x3, 0x5, 0xfffffffd, 0x4000000, 0xfffffffd, 0x0, 0x0, 0x0, 0x0, 0x80000, 0x0, 0xfffffffd, 0x0, 0x8, 0x0, 0x0, 0x8, 0x0, 0x0, 0x4, 0xffff], [0x4, 0xfc, 0x0, 0x4, 0x0, 0x0, 0x0, 0x0, 0xb, 0x1, 0x4000000, 0x0, 0x1, 0x4, 0x1000, 0x80, 0x0, 0x200, 0x0, 0xffffffff, 0x400000, 0xfffffffc, 0x0, 0xfffffffd, 0xffffffff, 0x0, 0x0, 0xfffffffd, 0x0, 0x0, 0x20, 0x4, 0x0, 0x0, 0xfffffffe, 0x1, 0x0, 0x18c, 0x0, 0x6, 0x1, 0x0, 0xbda6, 0xe, 0x0, 0x0, 0xfffffffd, 0xffffffff, 0x0, 0x20, 0x100, 0x0, 0x0, 0x204, 0x0, 0x0, 0x4000, 0xfff, 0x6, 0x0, 0x0, 0x0, 0x0, 0x8], [0x40000000, 0x0, 0x74e2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7, 0x40, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffe, 0x0, 0x0, 0x402, 0x40, 0x0, 0x0, 0xbd, 0x0, 0xff, 0x0, 0x0, 0x0, 0x2, 0xc9, 0x0, 0x8, 0x9, 0x0, 0x0, 0xffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x101, 0x80000020, 0x0, 0x0, 0x0, 0x0, 0x40000000, 0x5cb9, 0xcaa, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x4]}, 0x45c) ioctl$UI_DEV_CREATE(r0, 0x5501) ioctl$UI_GET_SYSNAME(r0, 0x8040552c, 0x0) executing program 1: socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000180)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$KVM_SET_REGS(0xffffffffffffffff, 0x4090ae82, &(0x7f0000000380)={[0xb, 0x6, 0x6, 0x4004, 0x2, 0x4, 0xefffffffffffffff, 0x0, 0x0, 0x2000000, 0x20000, 0x1c, 0x0, 0x5], 0x0, 0x41981}) pipe(&(0x7f0000000040)={0xffffffffffffffff, 0xffffffffffffffff}) splice(r1, 0x0, r3, 0x0, 0x8000f28, 0x0) splice(r2, 0x0, r1, 0x0, 0x8, 0xe) write(r0, 0x0, 0x0) mmap(&(0x7f0000000000/0xfbe000)=nil, 0xfbe000, 0x1000002, 0x4012831, 0xffffffffffffffff, 0x0) r4 = syz_open_procfs(0x0, 0x0) mprotect(&(0x7f0000000000/0x3000)=nil, 0x3000, 0x1) lseek(r4, 0x2004, 0x0) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbee2, 0x8031, 0xffffffffffffffff, 0x0) executing program 3: openat$hwrng(0xffffffffffffff9c, &(0x7f0000000300), 0x0, 0x0) bpf$BPF_BTF_GET_NEXT_ID(0x17, 0x0, 0x0) bpf$BPF_GET_BTF_INFO(0xf, &(0x7f0000000000)={0xffffffffffffffff, 0x0, 0x0}, 0x10) socketpair$nbd(0x1, 0x1, 0x0, 0x0) r0 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000040)='memory.current\x00', 0x275a, 0x0) ioctl$sock_inet_SIOCADDRT(0xffffffffffffffff, 0x890b, &(0x7f0000000040)={0x0, {0x2, 0x4e24, @dev={0xac, 0x14, 0x14, 0x2b}}, {0x2, 0x4e23, @multicast2}, {0x2, 0x4e21, @initdev={0xac, 0x1e, 0x0, 0x0}}, 0xfd, 0x0, 0x0, 0x0, 0x7, &(0x7f0000000000)='veth0_virt_wifi\x00', 0x80000001, 0x1, 0x9}) write$binfmt_script(r0, &(0x7f00000004c0), 0x208e24b) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x2, 0x28012, r0, 0x0) bpf$PROG_LOAD(0x5, &(0x7f000000e000)={0xe, 0x4, 0x0, &(0x7f0000000100)='GPL\x00', 0x5, 0xc3, &(0x7f000000cf3d)=""/195, 0x0, 0x0, '\x00', 0x0, @sk_skb, 0xffffffffffffffff, 0x8, &(0x7f00000000c0), 0x8, 0x10, &(0x7f0000000000), 0x10}, 0x94) r1 = openat$ppp(0xffffffffffffff9c, 0x0, 0xc0802, 0x0) ioctl$PPPIOCNEWUNIT(r1, 0xc004743e, &(0x7f00000000c0)) r2 = socket$key(0xf, 0x3, 0x2) r3 = syz_open_procfs(0xffffffffffffffff, &(0x7f00000004c0)='setgroups\x00') writev(r3, 0x0, 0x0) sendmsg$key(r2, &(0x7f00000014c0)={0x0, 0x0, &(0x7f0000000140)={0x0}}, 0x0) madvise(&(0x7f0000000000/0x600000)=nil, 0x600003, 0x15) r4 = openat$procfs(0xffffffffffffff9c, &(0x7f0000000040)='/proc/diskstats\x00', 0x0, 0x0) sendfile(0xffffffffffffffff, r4, 0x0, 0x20c3) pipe2(&(0x7f0000000340)={0xffffffffffffffff, 0xffffffffffffffff}, 0x80000) write$tun(r6, &(0x7f0000000100)={@void, @void, @eth={@remote, @empty, @void, {@mpls_uc={0x8847, {[{0xffffb, 0x0, 0x1}], @ipv6=@gre_packet={0x6, 0x6, 'K\x00', 0x44, 0x2f, 0x1, @mcast1, @dev={0xfe, 0x80, '\x00', 0x36}, {[], {{}, {0x1, 0x0, 0x1, 0x1}, {0x1}, {0x8, 0x88be, 0x4, {{0x1, 0x1, 0xe, 0x1, 0x0, 0x1, 0x1, 0x4}, 0x1, {0xffffffff}}}, {0x8, 0x22eb, 0x0, {{0x3, 0x2, 0x2, 0x2, 0x0, 0x2, 0x3, 0x63}, 0x2, {0x715, 0x1, 0x2, 0x13, 0x0, 0x0, 0x2, 0x0, 0x1}}}}}}}}}}}, 0x7e) read$FUSE(r5, &(0x7f0000002180)={0x2020}, 0x2020) executing program 0: r0 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000040)='cgroup.kill\x00', 0x275a, 0x0) inotify_init1(0x800) pipe(&(0x7f00000001c0)) mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./sys\x00', 0x1ff) mount(0x0, &(0x7f0000000000)='./sys\x00', &(0x7f0000000100)='sysfs\x00', 0x0, 0x0) r1 = openat(0xffffffffffffff9c, &(0x7f0000000200)='./sys/bus/pci/devices/0000:00:00.0/remove\x00', 0x1, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000140)={0xa, 0x8b}, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000280)=0x8) r2 = getpid() sched_setaffinity(0x0, 0x0, 0x0) sched_setscheduler(r2, 0x2, &(0x7f0000000200)=0x7) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeea, 0x8031, 0xffffffffffffffff, 0x28f43000) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$TIOCSPGRP(r1, 0x5410, &(0x7f0000000240)=r2) connect$unix(r3, &(0x7f0000000180)=@abs, 0x6e) sendmmsg$unix(r4, &(0x7f0000000000), 0x651, 0x0) recvmmsg(r3, &(0x7f00000000c0), 0x10106, 0x2, 0x0) mmap$IORING_OFF_SQ_RING(0x110c230000, 0x8000002, 0x2000007, 0x401d031, 0xffffffffffffffff, 0x0) write(r1, &(0x7f0000000300)='1', 0x1) r5 = openat(0xffffffffffffff9c, &(0x7f0000000080)='./sys/bus/pci/rescan\x00', 0x1, 0x0) write(r5, &(0x7f0000000300)='1', 0x1) mkdirat(0xffffffffffffff9c, 0x0, 0x1ff) timer_create(0x0, &(0x7f00000000c0)={0x0, 0x21, 0x2}, 0x0) mprotect(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x5) fcntl$lock(r0, 0x6, &(0x7f0000000080)={0x1, 0x1}) fcntl$lock(r0, 0x7, &(0x7f0000000000)={0x0, 0x2, 0x600000000000000, 0x1d}) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000000)) executing program 2: write(0xffffffffffffffff, &(0x7f0000000340)='0fc5:1227:', 0xa) mmap$IORING_OFF_SQ_RING(0x110c230000, 0x8000002, 0x4, 0x401d031, 0xffffffffffffffff, 0x0) r0 = socket$netlink(0x10, 0x3, 0x4) socket$inet6_tcp(0xa, 0x1, 0x0) fcntl$setstatus(0xffffffffffffffff, 0x4, 0x40800) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000080)=0x7) r1 = getpid() sched_setaffinity(0x0, 0x8, &(0x7f0000000100)=0x2) sched_setscheduler(r1, 0x2, &(0x7f0000000200)=0x4) r2 = syz_open_dev$MSR(&(0x7f00000001c0), 0x0, 0x0) read$msr(r2, &(0x7f0000032680)=""/102392, 0x18ff8) bind$netlink(r0, &(0x7f0000000180)={0x10, 0x0, 0x25dfdbfd, 0x1000000}, 0xc) sched_setaffinity(0x0, 0xfffffef7, &(0x7f0000000740)=0x410000002) r3 = openat$ublk_ctrl(0xffffffffffffff9c, &(0x7f0000000000), 0x2, 0x0) r4 = syz_ublk_setup_io_uring(0x20, &(0x7f0000000080)={0x0, 0x0, 0x0, 0x1, 0x2}, &(0x7f0000000040)=0x0, &(0x7f0000000100)=0x0, &(0x7f00000002c0)=0x0) r8 = syz_ublk_add_dev(r4, r5, r6, r7, &(0x7f0000000200)={0x2e, 0xc, 0x0, r3, 0xc0207504, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', {0xffffffff, 0xffff, 0x40, &(0x7f0000000500)=@new_dev={0x3, 0x104}}}, &(0x7f0000000300)=0x0) r10 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r10, 0x0, 0x80) r11 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_MSG_GETFLOWTABLE(r11, &(0x7f00000010c0)={0x0, 0x0, &(0x7f0000001080)={&(0x7f00000015c0)={0x20, 0x17, 0xa, 0x301, 0x0, 0x0, {0x2, 0x0, 0x4}, [@NFTA_FLOWTABLE_TABLE={0x9, 0x1, 'syz1\x00'}]}, 0x20}}, 0x4) r12 = syz_open_dev$ublk_chdev(&(0x7f0000002000), r8, 0x2) syz_ublk_setup_queues(r12, r9, &(0x7f0000000340)={0x0, 0x92d1, 0x400, 0x80000002, 0x165}, &(0x7f00000007c0)=[{0x0, 0x0, 0xffffffffffffffff, {0x0, 0x7ec5, 0x8, 0x2, 0x2f8, 0x0, r4}}, {0x0, 0x0, 0xffffffffffffffff, {0x0, 0x7dd8, 0x80, 0x1, 0x80000264, 0x0, r4}}, {0x0, 0x0, 0xffffffffffffffff, {0x0, 0xaa92, 0x8, 0x0, 0x67}}, {0x0, 0x0, 0xffffffffffffffff, {0x0, 0x97fb, 0x400, 0x1, 0x38b}}], 0x4, &(0x7f0000001a40)={0x2e, 0x10, 0x0, r12, 0xc0107520, 0x0, 0x0, 0x0, 0x0, {0x9}, 0x0, 0x0, '\x00', {0x0, 0x81c, 0x0, 0x0}}, &(0x7f0000001ac0)) mmap$IORING_OFF_SQ_RING(0x0, 0xc00000, 0x2000007, 0x401d031, 0xffffffffffffffff, 0x0) syz_ublk_setup_queues(r13, 0x0, &(0x7f0000000180)={0x0, 0xfffffffe, 0x0, 0xfffffffe, 0x1002f6}, &(0x7f0000000800)=[{0x0, 0x0, 0xffffffffffffffff, {0x0, 0xe704, 0x40040, 0x1000002, 0x91}}, {0x0, 0x0, 0xffffffffffffffff, {0x0, 0x5c87, 0x20, 0x3, 0x3aa}}, {0x0, 0x0, 0xffffffffffffffff, {0x0, 0x1f70, 0x2, 0x3ffffffe, 0x337}}, {0x0, 0x0, 0xffffffffffffffff, {0x0, 0x4, 0x200, 0x1, 0xffffffff}}], 0x1, 0x0, 0x0) openat$ptmx(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) executing program 2: write(0xffffffffffffffff, &(0x7f0000000340)='0fc5:1227:', 0xa) mmap$IORING_OFF_SQ_RING(0x110c230000, 0x8000002, 0x4, 0x401d031, 0xffffffffffffffff, 0x0) r0 = socket$netlink(0x10, 0x3, 0x4) socket$inet6_tcp(0xa, 0x1, 0x0) fcntl$setstatus(0xffffffffffffffff, 0x4, 0x40800) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000080)=0x7) sched_setaffinity(0x0, 0x8, &(0x7f0000000100)=0x2) sched_setscheduler(0x0, 0x2, &(0x7f0000000200)=0x4) r1 = syz_open_dev$MSR(&(0x7f00000001c0), 0x0, 0x0) read$msr(r1, &(0x7f0000032680)=""/102392, 0x18ff8) bind$netlink(r0, &(0x7f0000000180)={0x10, 0x0, 0x25dfdbfd, 0x1000000}, 0xc) sched_setaffinity(0x0, 0xfffffef7, &(0x7f0000000740)=0x410000002) r2 = openat$ublk_ctrl(0xffffffffffffff9c, &(0x7f0000000000), 0x2, 0x0) r3 = syz_ublk_setup_io_uring(0x20, &(0x7f0000000080)={0x0, 0x0, 0x0, 0x1, 0x2}, &(0x7f0000000040)=0x0, &(0x7f0000000100)=0x0, &(0x7f00000002c0)=0x0) r7 = syz_ublk_add_dev(r3, r4, r5, r6, &(0x7f0000000200)={0x2e, 0xc, 0x0, r2, 0xc0207504, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', {0xffffffff, 0xffff, 0x40, &(0x7f0000000500)=@new_dev={0x3, 0x104}}}, &(0x7f0000000300)) r8 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r8, 0x0, 0x80) r9 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_MSG_GETFLOWTABLE(r9, &(0x7f00000010c0)={0x0, 0x0, &(0x7f0000001080)={&(0x7f00000015c0)={0x20, 0x17, 0xa, 0x301, 0x0, 0x0, {0x2, 0x0, 0x4}, [@NFTA_FLOWTABLE_TABLE={0x9, 0x1, 'syz1\x00'}]}, 0x20}}, 0x4) syz_open_dev$ublk_chdev(&(0x7f0000002000), r7, 0x2) syz_ublk_setup_queues(0xffffffffffffffff, 0x0, &(0x7f0000000180)={0x0, 0xfffffffe, 0x0, 0xfffffffe, 0x1002f6}, &(0x7f0000000800)=[{0x0, 0x0, 0xffffffffffffffff, {0x0, 0xe704, 0x40040, 0x1000002, 0x91}}, {0x0, 0x0, 0xffffffffffffffff, {0x0, 0x5c87, 0x20, 0x3, 0x3aa}}, {0x0, 0x0, 0xffffffffffffffff, {0x0, 0x1f70, 0x2, 0x3ffffffe, 0x337}}, {0x0, 0x0, 0xffffffffffffffff, {0x0, 0x4, 0x200, 0x1, 0xffffffff}}], 0x1, 0x0, 0x0) openat$ptmx(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) executing program 0: prlimit64(0x0, 0xe, &(0x7f0000000140)={0xa, 0x8b}, 0x0) ptrace(0x4207, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000280)=0x8) r0 = getpid() sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x2) sched_setscheduler(r0, 0x2, &(0x7f0000000200)=0x7) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeea, 0x8031, 0xffffffffffffffff, 0x28f43000) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r1, &(0x7f0000000180)=@abs, 0x6e) sendmmsg$unix(r2, 0x0, 0x0, 0x0) recvmmsg(r1, &(0x7f00000000c0), 0x10106, 0x2, 0x0) unshare(0x28000600) r3 = fsopen(&(0x7f00000001c0)='mqueue\x00', 0x0) fsconfig$FSCONFIG_CMD_CREATE(r3, 0x6, 0x0, 0x0, 0x0) fsmount(r3, 0x0, 0x8e) unshare(0x8000280) prlimit64(r0, 0x0, &(0x7f0000000240)={0x0, 0x80}, &(0x7f0000000300)) mprotect(&(0x7f00001a4000/0x1000)=nil, 0x1000, 0x1) munmap(&(0x7f0000002000/0x1000)=nil, 0x1000) close(0xffffffffffffffff) executing program 2: write(0xffffffffffffffff, 0x0, 0x0) r0 = socket$netlink(0x10, 0x3, 0x4) r1 = socket$inet6_tcp(0xa, 0x1, 0x0) bind$inet6(r1, 0x0, 0x0) fcntl$setstatus(0xffffffffffffffff, 0x4, 0x40800) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000080)=0x7) sched_setaffinity(0x0, 0x8, &(0x7f0000000100)=0x2) sched_setscheduler(0x0, 0x2, &(0x7f0000000200)=0x4) r2 = syz_open_dev$MSR(&(0x7f00000001c0), 0x0, 0x0) read$msr(r2, &(0x7f0000032680)=""/102392, 0x18ff8) bind$netlink(r0, &(0x7f0000000180)={0x10, 0x0, 0x25dfdbfd, 0x1000000}, 0xc) sched_setaffinity(0x0, 0xfffffef7, &(0x7f0000000740)=0x410000002) r3 = openat$ublk_ctrl(0xffffffffffffff9c, &(0x7f0000000000), 0x2, 0x0) syz_ublk_add_dev(0xffffffffffffffff, 0x0, 0x0, 0x0, &(0x7f0000000200)={0x2e, 0xc, 0x0, r3, 0xc0207504, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', {0xffffffff, 0xffff, 0x40, &(0x7f0000000500)=@new_dev={0x3, 0x104}}}, &(0x7f0000000300)) r4 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r4, 0x0, 0x80) r5 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_MSG_GETFLOWTABLE(r5, &(0x7f00000010c0)={0x0, 0x0, &(0x7f0000001080)={&(0x7f00000015c0)={0x20, 0x17, 0xa, 0x301, 0x0, 0x0, {0x2, 0x0, 0x4}, [@NFTA_FLOWTABLE_TABLE={0x9, 0x1, 'syz1\x00'}]}, 0x20}}, 0x4) executing program 3: prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000080)=0x8) sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x2) r0 = getpid() bpf$MAP_GET_NEXT_KEY(0x4, 0x0, 0x0) rseq(0x0, 0xfde1, 0x0, 0x0) sched_setscheduler(r0, 0x1, &(0x7f0000000100)=0x5) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000001480)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r1, &(0x7f00000004c0)=@file={0x0, './file0\x00'}, 0x6e) sendmmsg$unix(r2, &(0x7f00000bd000), 0x318, 0x0) sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x2) socket$inet_tcp(0x2, 0x1, 0x0) mremap(&(0x7f0000a96000/0x1000)=nil, 0x1000, 0x400000, 0x3, &(0x7f0000000000/0x400000)=nil) socket$inet_udp(0x2, 0x2, 0x0) r3 = io_uring_setup(0xa2, &(0x7f0000000080)={0x0, 0x592c, 0x2, 0xfffffffc, 0x2}) io_uring_register$IORING_REGISTER_BUFFERS_UPDATE(r3, 0x10, &(0x7f00000003c0)={0x0, 0x0, &(0x7f0000000240)=[{0x0}], 0x0, 0x1}, 0x20) executing program 2: write(0xffffffffffffffff, &(0x7f0000000340)='0fc5:1227:', 0xa) r0 = socket$netlink(0x10, 0x3, 0x4) bind$inet6(0xffffffffffffffff, 0x0, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) sched_setaffinity(0x0, 0x8, &(0x7f0000000100)=0x2) sched_setscheduler(0x0, 0x2, &(0x7f0000000200)=0x4) r1 = syz_open_dev$MSR(&(0x7f00000001c0), 0x0, 0x0) read$msr(r1, &(0x7f0000032680)=""/102392, 0x18ff8) bind$netlink(r0, &(0x7f0000000180)={0x10, 0x0, 0x25dfdbfd, 0x1000000}, 0xc) sched_setaffinity(0x0, 0xfffffef7, &(0x7f0000000740)=0x410000002) r2 = syz_ublk_setup_io_uring(0x20, &(0x7f0000000080)={0x0, 0x0, 0x0, 0x1, 0x2}, &(0x7f0000000040)=0x0, &(0x7f0000000100)=0x0, &(0x7f00000002c0)=0x0) r6 = syz_ublk_add_dev(r2, r3, r4, r5, &(0x7f0000000200)={0x2e, 0xc, 0x0, 0xffffffffffffffff, 0xc0207504, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', {0xffffffff, 0xffff, 0x40, &(0x7f0000000500)=@new_dev={0x3, 0x104}}}, &(0x7f0000000300)=0x0) sendmsg$NFT_BATCH(0xffffffffffffffff, 0x0, 0x80) r8 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_MSG_GETFLOWTABLE(r8, &(0x7f00000010c0)={0x0, 0x0, &(0x7f0000001080)={&(0x7f00000015c0)={0x20, 0x17, 0xa, 0x301, 0x0, 0x0, {0x2, 0x0, 0x4}, [@NFTA_FLOWTABLE_TABLE={0x9, 0x1, 'syz1\x00'}]}, 0x20}}, 0x4) r9 = syz_open_dev$ublk_chdev(&(0x7f0000002000), r6, 0x2) syz_ublk_setup_queues(r9, r7, &(0x7f0000000340)={0x0, 0x92d1, 0x400, 0x80000002, 0x165}, &(0x7f00000007c0)=[{0x0, 0x0, 0xffffffffffffffff, {0x0, 0x7ec5, 0x8, 0x2, 0x2f8, 0x0, r2}}, {0x0, 0x0, 0xffffffffffffffff, {0x0, 0x7dd8, 0x80, 0x1, 0x80000264, 0x0, r2}}, {0x0, 0x0, 0xffffffffffffffff, {0x0, 0xaa92, 0x8, 0x0, 0x67}}, {0x0, 0x0, 0xffffffffffffffff, {0x0, 0x97fb, 0x400, 0x1, 0x38b}}], 0x4, &(0x7f0000001a40)={0x2e, 0x10, 0x0, r9, 0xc0107520, 0x0, 0x0, 0x0, 0x0, {0x9}, 0x0, 0x0, '\x00', {0x0, 0x81c, 0x0, 0x0}}, &(0x7f0000001ac0)) syz_ublk_setup_queues(r10, 0x0, &(0x7f0000000180)={0x0, 0xfffffffe, 0x0, 0xfffffffe, 0x1002f6}, &(0x7f0000000800)=[{0x0, 0x0, 0xffffffffffffffff, {0x0, 0xe704, 0x40040, 0x1000002, 0x91}}, {0x0, 0x0, 0xffffffffffffffff, {0x0, 0x5c87, 0x20, 0x3, 0x3aa}}, {0x0, 0x0, 0xffffffffffffffff, {0x0, 0x1f70, 0x2, 0x3ffffffe, 0x337}}, {0x0, 0x0, 0xffffffffffffffff, {0x0, 0x4, 0x200, 0x1, 0xffffffff}}], 0x1, 0x0, 0x0) openat$ptmx(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) executing program 0: r0 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$nl_generic(r0, &(0x7f00000000c0)={0x0, 0x0, &(0x7f00000003c0)={&(0x7f0000000b40)=ANY=[], 0x34}}, 0x4000) ioctl$BTRFS_IOC_START_SYNC(r0, 0x80089418, &(0x7f0000000000)) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000380)={0x8, 0x100008b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000200)=0x5) openat$sequencer(0xffffffffffffff9c, &(0x7f0000000300), 0x80200, 0x0) r1 = syz_open_dev$sndmidi(&(0x7f00000004c0), 0x2, 0x141102) writev(r1, &(0x7f0000000840)=[{&(0x7f00000002c0)="94", 0xf000}, {0x0}], 0x2) socket$inet6_sctp(0xa, 0x1, 0x84) ioctl$IOCTL_VMCI_VERSION2(0xffffffffffffffff, 0x7a7, 0x0) bind$alg(0xffffffffffffffff, &(0x7f0000000040)={0x26, 'skcipher\x00', 0x0, 0x0, 'xts(aes)\x00'}, 0x58) mkdirat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000)='./cgroup/syz0\x00', 0x1ff) r2 = openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000), 0x200002, 0x0) r3 = openat$cgroup_type(r2, &(0x7f0000000100), 0x2, 0x0) write$cgroup_type(r3, &(0x7f0000000280), 0x9) r4 = openat$cgroup_procs(r2, &(0x7f00000002c0)='cgroup.threads\x00', 0x2, 0x0) write$cgroup_pid(r4, &(0x7f0000000c40), 0x12) r5 = openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000), 0x200002, 0x0) r6 = openat$cgroup_ro(r5, &(0x7f0000000040)='cgroup.freeze\x00', 0x275a, 0x0) syz_io_uring_setup(0xefd, &(0x7f0000000300)={0x0, 0x0, 0x10000, 0x3, 0x55}, &(0x7f0000000100)=0x0, &(0x7f0000000140)=0x0, &(0x7f0000000080)=0x0) syz_io_uring_submit(r7, r8, r9, &(0x7f00000001c0)=@IORING_OP_FIXED_FD_INSTALL={0x36, 0x6, 0x0, r5, 0x0, 0x0, 0x0, 0x1, 0x1}) write$cgroup_int(r6, &(0x7f0000000200)=0x1, 0x12) seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0x0, &(0x7f0000000040)={0x1, &(0x7f0000000000)=[{0x6, 0x0, 0x0, 0x7fff7ffc}]}) syz_ublk_setup_io_uring(0x1d, &(0x7f0000000040)={0x0, 0x30b5, 0x1, 0x2, 0x158}, &(0x7f0000000100), &(0x7f0000000280), &(0x7f0000000140)) socket$inet6_tcp(0xa, 0x1, 0x0) program crashed: WARNING in io_ring_exit_work bisect: the chunk can be dropped bisect: testing without sub-chunk 2/3 testing program (duration=6m2s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): [27, 26, 23, 20, 19, 16, 19, 26] detailed listing: executing program 0: r0 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000040)='cgroup.kill\x00', 0x275a, 0x0) inotify_init1(0x800) pipe(&(0x7f00000001c0)) mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./sys\x00', 0x1ff) mount(0x0, &(0x7f0000000000)='./sys\x00', &(0x7f0000000100)='sysfs\x00', 0x0, 0x0) r1 = openat(0xffffffffffffff9c, &(0x7f0000000200)='./sys/bus/pci/devices/0000:00:00.0/remove\x00', 0x1, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000140)={0xa, 0x8b}, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000280)=0x8) r2 = getpid() sched_setaffinity(0x0, 0x0, 0x0) sched_setscheduler(r2, 0x2, &(0x7f0000000200)=0x7) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeea, 0x8031, 0xffffffffffffffff, 0x28f43000) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$TIOCSPGRP(r1, 0x5410, &(0x7f0000000240)=r2) connect$unix(r3, &(0x7f0000000180)=@abs, 0x6e) sendmmsg$unix(r4, &(0x7f0000000000), 0x651, 0x0) recvmmsg(r3, &(0x7f00000000c0), 0x10106, 0x2, 0x0) mmap$IORING_OFF_SQ_RING(0x110c230000, 0x8000002, 0x2000007, 0x401d031, 0xffffffffffffffff, 0x0) write(r1, &(0x7f0000000300)='1', 0x1) r5 = openat(0xffffffffffffff9c, &(0x7f0000000080)='./sys/bus/pci/rescan\x00', 0x1, 0x0) write(r5, &(0x7f0000000300)='1', 0x1) mkdirat(0xffffffffffffff9c, 0x0, 0x1ff) timer_create(0x0, &(0x7f00000000c0)={0x0, 0x21, 0x2}, 0x0) mprotect(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x5) fcntl$lock(r0, 0x6, &(0x7f0000000080)={0x1, 0x1}) fcntl$lock(r0, 0x7, &(0x7f0000000000)={0x0, 0x2, 0x600000000000000, 0x1d}) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000000)) executing program 2: write(0xffffffffffffffff, &(0x7f0000000340)='0fc5:1227:', 0xa) mmap$IORING_OFF_SQ_RING(0x110c230000, 0x8000002, 0x4, 0x401d031, 0xffffffffffffffff, 0x0) r0 = socket$netlink(0x10, 0x3, 0x4) socket$inet6_tcp(0xa, 0x1, 0x0) fcntl$setstatus(0xffffffffffffffff, 0x4, 0x40800) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000080)=0x7) r1 = getpid() sched_setaffinity(0x0, 0x8, &(0x7f0000000100)=0x2) sched_setscheduler(r1, 0x2, &(0x7f0000000200)=0x4) r2 = syz_open_dev$MSR(&(0x7f00000001c0), 0x0, 0x0) read$msr(r2, &(0x7f0000032680)=""/102392, 0x18ff8) bind$netlink(r0, &(0x7f0000000180)={0x10, 0x0, 0x25dfdbfd, 0x1000000}, 0xc) sched_setaffinity(0x0, 0xfffffef7, &(0x7f0000000740)=0x410000002) r3 = openat$ublk_ctrl(0xffffffffffffff9c, &(0x7f0000000000), 0x2, 0x0) r4 = syz_ublk_setup_io_uring(0x20, &(0x7f0000000080)={0x0, 0x0, 0x0, 0x1, 0x2}, &(0x7f0000000040)=0x0, &(0x7f0000000100)=0x0, &(0x7f00000002c0)=0x0) r8 = syz_ublk_add_dev(r4, r5, r6, r7, &(0x7f0000000200)={0x2e, 0xc, 0x0, r3, 0xc0207504, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', {0xffffffff, 0xffff, 0x40, &(0x7f0000000500)=@new_dev={0x3, 0x104}}}, &(0x7f0000000300)=0x0) r10 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r10, 0x0, 0x80) r11 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_MSG_GETFLOWTABLE(r11, &(0x7f00000010c0)={0x0, 0x0, &(0x7f0000001080)={&(0x7f00000015c0)={0x20, 0x17, 0xa, 0x301, 0x0, 0x0, {0x2, 0x0, 0x4}, [@NFTA_FLOWTABLE_TABLE={0x9, 0x1, 'syz1\x00'}]}, 0x20}}, 0x4) r12 = syz_open_dev$ublk_chdev(&(0x7f0000002000), r8, 0x2) syz_ublk_setup_queues(r12, r9, &(0x7f0000000340)={0x0, 0x92d1, 0x400, 0x80000002, 0x165}, &(0x7f00000007c0)=[{0x0, 0x0, 0xffffffffffffffff, {0x0, 0x7ec5, 0x8, 0x2, 0x2f8, 0x0, r4}}, {0x0, 0x0, 0xffffffffffffffff, {0x0, 0x7dd8, 0x80, 0x1, 0x80000264, 0x0, r4}}, {0x0, 0x0, 0xffffffffffffffff, {0x0, 0xaa92, 0x8, 0x0, 0x67}}, {0x0, 0x0, 0xffffffffffffffff, {0x0, 0x97fb, 0x400, 0x1, 0x38b}}], 0x4, &(0x7f0000001a40)={0x2e, 0x10, 0x0, r12, 0xc0107520, 0x0, 0x0, 0x0, 0x0, {0x9}, 0x0, 0x0, '\x00', {0x0, 0x81c, 0x0, 0x0}}, &(0x7f0000001ac0)) mmap$IORING_OFF_SQ_RING(0x0, 0xc00000, 0x2000007, 0x401d031, 0xffffffffffffffff, 0x0) syz_ublk_setup_queues(r13, 0x0, &(0x7f0000000180)={0x0, 0xfffffffe, 0x0, 0xfffffffe, 0x1002f6}, &(0x7f0000000800)=[{0x0, 0x0, 0xffffffffffffffff, {0x0, 0xe704, 0x40040, 0x1000002, 0x91}}, {0x0, 0x0, 0xffffffffffffffff, {0x0, 0x5c87, 0x20, 0x3, 0x3aa}}, {0x0, 0x0, 0xffffffffffffffff, {0x0, 0x1f70, 0x2, 0x3ffffffe, 0x337}}, {0x0, 0x0, 0xffffffffffffffff, {0x0, 0x4, 0x200, 0x1, 0xffffffff}}], 0x1, 0x0, 0x0) openat$ptmx(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) executing program 2: write(0xffffffffffffffff, &(0x7f0000000340)='0fc5:1227:', 0xa) mmap$IORING_OFF_SQ_RING(0x110c230000, 0x8000002, 0x4, 0x401d031, 0xffffffffffffffff, 0x0) r0 = socket$netlink(0x10, 0x3, 0x4) socket$inet6_tcp(0xa, 0x1, 0x0) fcntl$setstatus(0xffffffffffffffff, 0x4, 0x40800) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000080)=0x7) sched_setaffinity(0x0, 0x8, &(0x7f0000000100)=0x2) sched_setscheduler(0x0, 0x2, &(0x7f0000000200)=0x4) r1 = syz_open_dev$MSR(&(0x7f00000001c0), 0x0, 0x0) read$msr(r1, &(0x7f0000032680)=""/102392, 0x18ff8) bind$netlink(r0, &(0x7f0000000180)={0x10, 0x0, 0x25dfdbfd, 0x1000000}, 0xc) sched_setaffinity(0x0, 0xfffffef7, &(0x7f0000000740)=0x410000002) r2 = openat$ublk_ctrl(0xffffffffffffff9c, &(0x7f0000000000), 0x2, 0x0) r3 = syz_ublk_setup_io_uring(0x20, &(0x7f0000000080)={0x0, 0x0, 0x0, 0x1, 0x2}, &(0x7f0000000040)=0x0, &(0x7f0000000100)=0x0, &(0x7f00000002c0)=0x0) r7 = syz_ublk_add_dev(r3, r4, r5, r6, &(0x7f0000000200)={0x2e, 0xc, 0x0, r2, 0xc0207504, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', {0xffffffff, 0xffff, 0x40, &(0x7f0000000500)=@new_dev={0x3, 0x104}}}, &(0x7f0000000300)) r8 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r8, 0x0, 0x80) r9 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_MSG_GETFLOWTABLE(r9, &(0x7f00000010c0)={0x0, 0x0, &(0x7f0000001080)={&(0x7f00000015c0)={0x20, 0x17, 0xa, 0x301, 0x0, 0x0, {0x2, 0x0, 0x4}, [@NFTA_FLOWTABLE_TABLE={0x9, 0x1, 'syz1\x00'}]}, 0x20}}, 0x4) syz_open_dev$ublk_chdev(&(0x7f0000002000), r7, 0x2) syz_ublk_setup_queues(0xffffffffffffffff, 0x0, &(0x7f0000000180)={0x0, 0xfffffffe, 0x0, 0xfffffffe, 0x1002f6}, &(0x7f0000000800)=[{0x0, 0x0, 0xffffffffffffffff, {0x0, 0xe704, 0x40040, 0x1000002, 0x91}}, {0x0, 0x0, 0xffffffffffffffff, {0x0, 0x5c87, 0x20, 0x3, 0x3aa}}, {0x0, 0x0, 0xffffffffffffffff, {0x0, 0x1f70, 0x2, 0x3ffffffe, 0x337}}, {0x0, 0x0, 0xffffffffffffffff, {0x0, 0x4, 0x200, 0x1, 0xffffffff}}], 0x1, 0x0, 0x0) openat$ptmx(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) executing program 0: prlimit64(0x0, 0xe, &(0x7f0000000140)={0xa, 0x8b}, 0x0) ptrace(0x4207, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000280)=0x8) r0 = getpid() sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x2) sched_setscheduler(r0, 0x2, &(0x7f0000000200)=0x7) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeea, 0x8031, 0xffffffffffffffff, 0x28f43000) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r1, &(0x7f0000000180)=@abs, 0x6e) sendmmsg$unix(r2, 0x0, 0x0, 0x0) recvmmsg(r1, &(0x7f00000000c0), 0x10106, 0x2, 0x0) unshare(0x28000600) r3 = fsopen(&(0x7f00000001c0)='mqueue\x00', 0x0) fsconfig$FSCONFIG_CMD_CREATE(r3, 0x6, 0x0, 0x0, 0x0) fsmount(r3, 0x0, 0x8e) unshare(0x8000280) prlimit64(r0, 0x0, &(0x7f0000000240)={0x0, 0x80}, &(0x7f0000000300)) mprotect(&(0x7f00001a4000/0x1000)=nil, 0x1000, 0x1) munmap(&(0x7f0000002000/0x1000)=nil, 0x1000) close(0xffffffffffffffff) executing program 2: write(0xffffffffffffffff, 0x0, 0x0) r0 = socket$netlink(0x10, 0x3, 0x4) r1 = socket$inet6_tcp(0xa, 0x1, 0x0) bind$inet6(r1, 0x0, 0x0) fcntl$setstatus(0xffffffffffffffff, 0x4, 0x40800) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000080)=0x7) sched_setaffinity(0x0, 0x8, &(0x7f0000000100)=0x2) sched_setscheduler(0x0, 0x2, &(0x7f0000000200)=0x4) r2 = syz_open_dev$MSR(&(0x7f00000001c0), 0x0, 0x0) read$msr(r2, &(0x7f0000032680)=""/102392, 0x18ff8) bind$netlink(r0, &(0x7f0000000180)={0x10, 0x0, 0x25dfdbfd, 0x1000000}, 0xc) sched_setaffinity(0x0, 0xfffffef7, &(0x7f0000000740)=0x410000002) r3 = openat$ublk_ctrl(0xffffffffffffff9c, &(0x7f0000000000), 0x2, 0x0) syz_ublk_add_dev(0xffffffffffffffff, 0x0, 0x0, 0x0, &(0x7f0000000200)={0x2e, 0xc, 0x0, r3, 0xc0207504, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', {0xffffffff, 0xffff, 0x40, &(0x7f0000000500)=@new_dev={0x3, 0x104}}}, &(0x7f0000000300)) r4 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r4, 0x0, 0x80) r5 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_MSG_GETFLOWTABLE(r5, &(0x7f00000010c0)={0x0, 0x0, &(0x7f0000001080)={&(0x7f00000015c0)={0x20, 0x17, 0xa, 0x301, 0x0, 0x0, {0x2, 0x0, 0x4}, [@NFTA_FLOWTABLE_TABLE={0x9, 0x1, 'syz1\x00'}]}, 0x20}}, 0x4) executing program 3: prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000080)=0x8) sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x2) r0 = getpid() bpf$MAP_GET_NEXT_KEY(0x4, 0x0, 0x0) rseq(0x0, 0xfde1, 0x0, 0x0) sched_setscheduler(r0, 0x1, &(0x7f0000000100)=0x5) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000001480)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r1, &(0x7f00000004c0)=@file={0x0, './file0\x00'}, 0x6e) sendmmsg$unix(r2, &(0x7f00000bd000), 0x318, 0x0) sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x2) socket$inet_tcp(0x2, 0x1, 0x0) mremap(&(0x7f0000a96000/0x1000)=nil, 0x1000, 0x400000, 0x3, &(0x7f0000000000/0x400000)=nil) socket$inet_udp(0x2, 0x2, 0x0) r3 = io_uring_setup(0xa2, &(0x7f0000000080)={0x0, 0x592c, 0x2, 0xfffffffc, 0x2}) io_uring_register$IORING_REGISTER_BUFFERS_UPDATE(r3, 0x10, &(0x7f00000003c0)={0x0, 0x0, &(0x7f0000000240)=[{0x0}], 0x0, 0x1}, 0x20) executing program 2: write(0xffffffffffffffff, &(0x7f0000000340)='0fc5:1227:', 0xa) r0 = socket$netlink(0x10, 0x3, 0x4) bind$inet6(0xffffffffffffffff, 0x0, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) sched_setaffinity(0x0, 0x8, &(0x7f0000000100)=0x2) sched_setscheduler(0x0, 0x2, &(0x7f0000000200)=0x4) r1 = syz_open_dev$MSR(&(0x7f00000001c0), 0x0, 0x0) read$msr(r1, &(0x7f0000032680)=""/102392, 0x18ff8) bind$netlink(r0, &(0x7f0000000180)={0x10, 0x0, 0x25dfdbfd, 0x1000000}, 0xc) sched_setaffinity(0x0, 0xfffffef7, &(0x7f0000000740)=0x410000002) r2 = syz_ublk_setup_io_uring(0x20, &(0x7f0000000080)={0x0, 0x0, 0x0, 0x1, 0x2}, &(0x7f0000000040)=0x0, &(0x7f0000000100)=0x0, &(0x7f00000002c0)=0x0) r6 = syz_ublk_add_dev(r2, r3, r4, r5, &(0x7f0000000200)={0x2e, 0xc, 0x0, 0xffffffffffffffff, 0xc0207504, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', {0xffffffff, 0xffff, 0x40, &(0x7f0000000500)=@new_dev={0x3, 0x104}}}, &(0x7f0000000300)=0x0) sendmsg$NFT_BATCH(0xffffffffffffffff, 0x0, 0x80) r8 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_MSG_GETFLOWTABLE(r8, &(0x7f00000010c0)={0x0, 0x0, &(0x7f0000001080)={&(0x7f00000015c0)={0x20, 0x17, 0xa, 0x301, 0x0, 0x0, {0x2, 0x0, 0x4}, [@NFTA_FLOWTABLE_TABLE={0x9, 0x1, 'syz1\x00'}]}, 0x20}}, 0x4) r9 = syz_open_dev$ublk_chdev(&(0x7f0000002000), r6, 0x2) syz_ublk_setup_queues(r9, r7, &(0x7f0000000340)={0x0, 0x92d1, 0x400, 0x80000002, 0x165}, &(0x7f00000007c0)=[{0x0, 0x0, 0xffffffffffffffff, {0x0, 0x7ec5, 0x8, 0x2, 0x2f8, 0x0, r2}}, {0x0, 0x0, 0xffffffffffffffff, {0x0, 0x7dd8, 0x80, 0x1, 0x80000264, 0x0, r2}}, {0x0, 0x0, 0xffffffffffffffff, {0x0, 0xaa92, 0x8, 0x0, 0x67}}, {0x0, 0x0, 0xffffffffffffffff, {0x0, 0x97fb, 0x400, 0x1, 0x38b}}], 0x4, &(0x7f0000001a40)={0x2e, 0x10, 0x0, r9, 0xc0107520, 0x0, 0x0, 0x0, 0x0, {0x9}, 0x0, 0x0, '\x00', {0x0, 0x81c, 0x0, 0x0}}, &(0x7f0000001ac0)) syz_ublk_setup_queues(r10, 0x0, &(0x7f0000000180)={0x0, 0xfffffffe, 0x0, 0xfffffffe, 0x1002f6}, &(0x7f0000000800)=[{0x0, 0x0, 0xffffffffffffffff, {0x0, 0xe704, 0x40040, 0x1000002, 0x91}}, {0x0, 0x0, 0xffffffffffffffff, {0x0, 0x5c87, 0x20, 0x3, 0x3aa}}, {0x0, 0x0, 0xffffffffffffffff, {0x0, 0x1f70, 0x2, 0x3ffffffe, 0x337}}, {0x0, 0x0, 0xffffffffffffffff, {0x0, 0x4, 0x200, 0x1, 0xffffffff}}], 0x1, 0x0, 0x0) openat$ptmx(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) executing program 0: r0 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$nl_generic(r0, &(0x7f00000000c0)={0x0, 0x0, &(0x7f00000003c0)={&(0x7f0000000b40)=ANY=[], 0x34}}, 0x4000) ioctl$BTRFS_IOC_START_SYNC(r0, 0x80089418, &(0x7f0000000000)) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000380)={0x8, 0x100008b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000200)=0x5) openat$sequencer(0xffffffffffffff9c, &(0x7f0000000300), 0x80200, 0x0) r1 = syz_open_dev$sndmidi(&(0x7f00000004c0), 0x2, 0x141102) writev(r1, &(0x7f0000000840)=[{&(0x7f00000002c0)="94", 0xf000}, {0x0}], 0x2) socket$inet6_sctp(0xa, 0x1, 0x84) ioctl$IOCTL_VMCI_VERSION2(0xffffffffffffffff, 0x7a7, 0x0) bind$alg(0xffffffffffffffff, &(0x7f0000000040)={0x26, 'skcipher\x00', 0x0, 0x0, 'xts(aes)\x00'}, 0x58) mkdirat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000)='./cgroup/syz0\x00', 0x1ff) r2 = openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000), 0x200002, 0x0) r3 = openat$cgroup_type(r2, &(0x7f0000000100), 0x2, 0x0) write$cgroup_type(r3, &(0x7f0000000280), 0x9) r4 = openat$cgroup_procs(r2, &(0x7f00000002c0)='cgroup.threads\x00', 0x2, 0x0) write$cgroup_pid(r4, &(0x7f0000000c40), 0x12) r5 = openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000), 0x200002, 0x0) r6 = openat$cgroup_ro(r5, &(0x7f0000000040)='cgroup.freeze\x00', 0x275a, 0x0) syz_io_uring_setup(0xefd, &(0x7f0000000300)={0x0, 0x0, 0x10000, 0x3, 0x55}, &(0x7f0000000100)=0x0, &(0x7f0000000140)=0x0, &(0x7f0000000080)=0x0) syz_io_uring_submit(r7, r8, r9, &(0x7f00000001c0)=@IORING_OP_FIXED_FD_INSTALL={0x36, 0x6, 0x0, r5, 0x0, 0x0, 0x0, 0x1, 0x1}) write$cgroup_int(r6, &(0x7f0000000200)=0x1, 0x12) seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0x0, &(0x7f0000000040)={0x1, &(0x7f0000000000)=[{0x6, 0x0, 0x0, 0x7fff7ffc}]}) syz_ublk_setup_io_uring(0x1d, &(0x7f0000000040)={0x0, 0x30b5, 0x1, 0x2, 0x158}, &(0x7f0000000100), &(0x7f0000000280), &(0x7f0000000140)) socket$inet6_tcp(0xa, 0x1, 0x0) program crashed: WARNING in io_ring_exit_work bisect: the chunk can be dropped bisect: testing without sub-chunk 3/3 bisect: split chunks (needed=true): <8> bisect: split chunk #0 of len 8 into 2 parts bisect: testing without sub-chunk 1/2 testing program (duration=6m1s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): [19, 16, 19, 26] detailed listing: executing program 2: write(0xffffffffffffffff, 0x0, 0x0) r0 = socket$netlink(0x10, 0x3, 0x4) r1 = socket$inet6_tcp(0xa, 0x1, 0x0) bind$inet6(r1, 0x0, 0x0) fcntl$setstatus(0xffffffffffffffff, 0x4, 0x40800) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000080)=0x7) sched_setaffinity(0x0, 0x8, &(0x7f0000000100)=0x2) sched_setscheduler(0x0, 0x2, &(0x7f0000000200)=0x4) r2 = syz_open_dev$MSR(&(0x7f00000001c0), 0x0, 0x0) read$msr(r2, &(0x7f0000032680)=""/102392, 0x18ff8) bind$netlink(r0, &(0x7f0000000180)={0x10, 0x0, 0x25dfdbfd, 0x1000000}, 0xc) sched_setaffinity(0x0, 0xfffffef7, &(0x7f0000000740)=0x410000002) r3 = openat$ublk_ctrl(0xffffffffffffff9c, &(0x7f0000000000), 0x2, 0x0) syz_ublk_add_dev(0xffffffffffffffff, 0x0, 0x0, 0x0, &(0x7f0000000200)={0x2e, 0xc, 0x0, r3, 0xc0207504, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', {0xffffffff, 0xffff, 0x40, &(0x7f0000000500)=@new_dev={0x3, 0x104}}}, &(0x7f0000000300)) r4 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r4, 0x0, 0x80) r5 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_MSG_GETFLOWTABLE(r5, &(0x7f00000010c0)={0x0, 0x0, &(0x7f0000001080)={&(0x7f00000015c0)={0x20, 0x17, 0xa, 0x301, 0x0, 0x0, {0x2, 0x0, 0x4}, [@NFTA_FLOWTABLE_TABLE={0x9, 0x1, 'syz1\x00'}]}, 0x20}}, 0x4) executing program 3: prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000080)=0x8) sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x2) r0 = getpid() bpf$MAP_GET_NEXT_KEY(0x4, 0x0, 0x0) rseq(0x0, 0xfde1, 0x0, 0x0) sched_setscheduler(r0, 0x1, &(0x7f0000000100)=0x5) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000001480)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r1, &(0x7f00000004c0)=@file={0x0, './file0\x00'}, 0x6e) sendmmsg$unix(r2, &(0x7f00000bd000), 0x318, 0x0) sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x2) socket$inet_tcp(0x2, 0x1, 0x0) mremap(&(0x7f0000a96000/0x1000)=nil, 0x1000, 0x400000, 0x3, &(0x7f0000000000/0x400000)=nil) socket$inet_udp(0x2, 0x2, 0x0) r3 = io_uring_setup(0xa2, &(0x7f0000000080)={0x0, 0x592c, 0x2, 0xfffffffc, 0x2}) io_uring_register$IORING_REGISTER_BUFFERS_UPDATE(r3, 0x10, &(0x7f00000003c0)={0x0, 0x0, &(0x7f0000000240)=[{0x0}], 0x0, 0x1}, 0x20) executing program 2: write(0xffffffffffffffff, &(0x7f0000000340)='0fc5:1227:', 0xa) r0 = socket$netlink(0x10, 0x3, 0x4) bind$inet6(0xffffffffffffffff, 0x0, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) sched_setaffinity(0x0, 0x8, &(0x7f0000000100)=0x2) sched_setscheduler(0x0, 0x2, &(0x7f0000000200)=0x4) r1 = syz_open_dev$MSR(&(0x7f00000001c0), 0x0, 0x0) read$msr(r1, &(0x7f0000032680)=""/102392, 0x18ff8) bind$netlink(r0, &(0x7f0000000180)={0x10, 0x0, 0x25dfdbfd, 0x1000000}, 0xc) sched_setaffinity(0x0, 0xfffffef7, &(0x7f0000000740)=0x410000002) r2 = syz_ublk_setup_io_uring(0x20, &(0x7f0000000080)={0x0, 0x0, 0x0, 0x1, 0x2}, &(0x7f0000000040)=0x0, &(0x7f0000000100)=0x0, &(0x7f00000002c0)=0x0) r6 = syz_ublk_add_dev(r2, r3, r4, r5, &(0x7f0000000200)={0x2e, 0xc, 0x0, 0xffffffffffffffff, 0xc0207504, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', {0xffffffff, 0xffff, 0x40, &(0x7f0000000500)=@new_dev={0x3, 0x104}}}, &(0x7f0000000300)=0x0) sendmsg$NFT_BATCH(0xffffffffffffffff, 0x0, 0x80) r8 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_MSG_GETFLOWTABLE(r8, &(0x7f00000010c0)={0x0, 0x0, &(0x7f0000001080)={&(0x7f00000015c0)={0x20, 0x17, 0xa, 0x301, 0x0, 0x0, {0x2, 0x0, 0x4}, [@NFTA_FLOWTABLE_TABLE={0x9, 0x1, 'syz1\x00'}]}, 0x20}}, 0x4) r9 = syz_open_dev$ublk_chdev(&(0x7f0000002000), r6, 0x2) syz_ublk_setup_queues(r9, r7, &(0x7f0000000340)={0x0, 0x92d1, 0x400, 0x80000002, 0x165}, &(0x7f00000007c0)=[{0x0, 0x0, 0xffffffffffffffff, {0x0, 0x7ec5, 0x8, 0x2, 0x2f8, 0x0, r2}}, {0x0, 0x0, 0xffffffffffffffff, {0x0, 0x7dd8, 0x80, 0x1, 0x80000264, 0x0, r2}}, {0x0, 0x0, 0xffffffffffffffff, {0x0, 0xaa92, 0x8, 0x0, 0x67}}, {0x0, 0x0, 0xffffffffffffffff, {0x0, 0x97fb, 0x400, 0x1, 0x38b}}], 0x4, &(0x7f0000001a40)={0x2e, 0x10, 0x0, r9, 0xc0107520, 0x0, 0x0, 0x0, 0x0, {0x9}, 0x0, 0x0, '\x00', {0x0, 0x81c, 0x0, 0x0}}, &(0x7f0000001ac0)) syz_ublk_setup_queues(r10, 0x0, &(0x7f0000000180)={0x0, 0xfffffffe, 0x0, 0xfffffffe, 0x1002f6}, &(0x7f0000000800)=[{0x0, 0x0, 0xffffffffffffffff, {0x0, 0xe704, 0x40040, 0x1000002, 0x91}}, {0x0, 0x0, 0xffffffffffffffff, {0x0, 0x5c87, 0x20, 0x3, 0x3aa}}, {0x0, 0x0, 0xffffffffffffffff, {0x0, 0x1f70, 0x2, 0x3ffffffe, 0x337}}, {0x0, 0x0, 0xffffffffffffffff, {0x0, 0x4, 0x200, 0x1, 0xffffffff}}], 0x1, 0x0, 0x0) openat$ptmx(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) executing program 0: r0 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$nl_generic(r0, &(0x7f00000000c0)={0x0, 0x0, &(0x7f00000003c0)={&(0x7f0000000b40)=ANY=[], 0x34}}, 0x4000) ioctl$BTRFS_IOC_START_SYNC(r0, 0x80089418, &(0x7f0000000000)) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000380)={0x8, 0x100008b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000200)=0x5) openat$sequencer(0xffffffffffffff9c, &(0x7f0000000300), 0x80200, 0x0) r1 = syz_open_dev$sndmidi(&(0x7f00000004c0), 0x2, 0x141102) writev(r1, &(0x7f0000000840)=[{&(0x7f00000002c0)="94", 0xf000}, {0x0}], 0x2) socket$inet6_sctp(0xa, 0x1, 0x84) ioctl$IOCTL_VMCI_VERSION2(0xffffffffffffffff, 0x7a7, 0x0) bind$alg(0xffffffffffffffff, &(0x7f0000000040)={0x26, 'skcipher\x00', 0x0, 0x0, 'xts(aes)\x00'}, 0x58) mkdirat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000)='./cgroup/syz0\x00', 0x1ff) r2 = openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000), 0x200002, 0x0) r3 = openat$cgroup_type(r2, &(0x7f0000000100), 0x2, 0x0) write$cgroup_type(r3, &(0x7f0000000280), 0x9) r4 = openat$cgroup_procs(r2, &(0x7f00000002c0)='cgroup.threads\x00', 0x2, 0x0) write$cgroup_pid(r4, &(0x7f0000000c40), 0x12) r5 = openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000), 0x200002, 0x0) r6 = openat$cgroup_ro(r5, &(0x7f0000000040)='cgroup.freeze\x00', 0x275a, 0x0) syz_io_uring_setup(0xefd, &(0x7f0000000300)={0x0, 0x0, 0x10000, 0x3, 0x55}, &(0x7f0000000100)=0x0, &(0x7f0000000140)=0x0, &(0x7f0000000080)=0x0) syz_io_uring_submit(r7, r8, r9, &(0x7f00000001c0)=@IORING_OP_FIXED_FD_INSTALL={0x36, 0x6, 0x0, r5, 0x0, 0x0, 0x0, 0x1, 0x1}) write$cgroup_int(r6, &(0x7f0000000200)=0x1, 0x12) seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0x0, &(0x7f0000000040)={0x1, &(0x7f0000000000)=[{0x6, 0x0, 0x0, 0x7fff7ffc}]}) syz_ublk_setup_io_uring(0x1d, &(0x7f0000000040)={0x0, 0x30b5, 0x1, 0x2, 0x158}, &(0x7f0000000100), &(0x7f0000000280), &(0x7f0000000140)) socket$inet6_tcp(0xa, 0x1, 0x0) program did not crash bisect: testing without sub-chunk 2/2 testing program (duration=6m1s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): [27, 26, 23, 20] detailed listing: executing program 0: r0 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000040)='cgroup.kill\x00', 0x275a, 0x0) inotify_init1(0x800) pipe(&(0x7f00000001c0)) mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./sys\x00', 0x1ff) mount(0x0, &(0x7f0000000000)='./sys\x00', &(0x7f0000000100)='sysfs\x00', 0x0, 0x0) r1 = openat(0xffffffffffffff9c, &(0x7f0000000200)='./sys/bus/pci/devices/0000:00:00.0/remove\x00', 0x1, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000140)={0xa, 0x8b}, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000280)=0x8) r2 = getpid() sched_setaffinity(0x0, 0x0, 0x0) sched_setscheduler(r2, 0x2, &(0x7f0000000200)=0x7) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeea, 0x8031, 0xffffffffffffffff, 0x28f43000) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$TIOCSPGRP(r1, 0x5410, &(0x7f0000000240)=r2) connect$unix(r3, &(0x7f0000000180)=@abs, 0x6e) sendmmsg$unix(r4, &(0x7f0000000000), 0x651, 0x0) recvmmsg(r3, &(0x7f00000000c0), 0x10106, 0x2, 0x0) mmap$IORING_OFF_SQ_RING(0x110c230000, 0x8000002, 0x2000007, 0x401d031, 0xffffffffffffffff, 0x0) write(r1, &(0x7f0000000300)='1', 0x1) r5 = openat(0xffffffffffffff9c, &(0x7f0000000080)='./sys/bus/pci/rescan\x00', 0x1, 0x0) write(r5, &(0x7f0000000300)='1', 0x1) mkdirat(0xffffffffffffff9c, 0x0, 0x1ff) timer_create(0x0, &(0x7f00000000c0)={0x0, 0x21, 0x2}, 0x0) mprotect(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x5) fcntl$lock(r0, 0x6, &(0x7f0000000080)={0x1, 0x1}) fcntl$lock(r0, 0x7, &(0x7f0000000000)={0x0, 0x2, 0x600000000000000, 0x1d}) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000000)) executing program 2: write(0xffffffffffffffff, &(0x7f0000000340)='0fc5:1227:', 0xa) mmap$IORING_OFF_SQ_RING(0x110c230000, 0x8000002, 0x4, 0x401d031, 0xffffffffffffffff, 0x0) r0 = socket$netlink(0x10, 0x3, 0x4) socket$inet6_tcp(0xa, 0x1, 0x0) fcntl$setstatus(0xffffffffffffffff, 0x4, 0x40800) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000080)=0x7) r1 = getpid() sched_setaffinity(0x0, 0x8, &(0x7f0000000100)=0x2) sched_setscheduler(r1, 0x2, &(0x7f0000000200)=0x4) r2 = syz_open_dev$MSR(&(0x7f00000001c0), 0x0, 0x0) read$msr(r2, &(0x7f0000032680)=""/102392, 0x18ff8) bind$netlink(r0, &(0x7f0000000180)={0x10, 0x0, 0x25dfdbfd, 0x1000000}, 0xc) sched_setaffinity(0x0, 0xfffffef7, &(0x7f0000000740)=0x410000002) r3 = openat$ublk_ctrl(0xffffffffffffff9c, &(0x7f0000000000), 0x2, 0x0) r4 = syz_ublk_setup_io_uring(0x20, &(0x7f0000000080)={0x0, 0x0, 0x0, 0x1, 0x2}, &(0x7f0000000040)=0x0, &(0x7f0000000100)=0x0, &(0x7f00000002c0)=0x0) r8 = syz_ublk_add_dev(r4, r5, r6, r7, &(0x7f0000000200)={0x2e, 0xc, 0x0, r3, 0xc0207504, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', {0xffffffff, 0xffff, 0x40, &(0x7f0000000500)=@new_dev={0x3, 0x104}}}, &(0x7f0000000300)=0x0) r10 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r10, 0x0, 0x80) r11 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_MSG_GETFLOWTABLE(r11, &(0x7f00000010c0)={0x0, 0x0, &(0x7f0000001080)={&(0x7f00000015c0)={0x20, 0x17, 0xa, 0x301, 0x0, 0x0, {0x2, 0x0, 0x4}, [@NFTA_FLOWTABLE_TABLE={0x9, 0x1, 'syz1\x00'}]}, 0x20}}, 0x4) r12 = syz_open_dev$ublk_chdev(&(0x7f0000002000), r8, 0x2) syz_ublk_setup_queues(r12, r9, &(0x7f0000000340)={0x0, 0x92d1, 0x400, 0x80000002, 0x165}, &(0x7f00000007c0)=[{0x0, 0x0, 0xffffffffffffffff, {0x0, 0x7ec5, 0x8, 0x2, 0x2f8, 0x0, r4}}, {0x0, 0x0, 0xffffffffffffffff, {0x0, 0x7dd8, 0x80, 0x1, 0x80000264, 0x0, r4}}, {0x0, 0x0, 0xffffffffffffffff, {0x0, 0xaa92, 0x8, 0x0, 0x67}}, {0x0, 0x0, 0xffffffffffffffff, {0x0, 0x97fb, 0x400, 0x1, 0x38b}}], 0x4, &(0x7f0000001a40)={0x2e, 0x10, 0x0, r12, 0xc0107520, 0x0, 0x0, 0x0, 0x0, {0x9}, 0x0, 0x0, '\x00', {0x0, 0x81c, 0x0, 0x0}}, &(0x7f0000001ac0)) mmap$IORING_OFF_SQ_RING(0x0, 0xc00000, 0x2000007, 0x401d031, 0xffffffffffffffff, 0x0) syz_ublk_setup_queues(r13, 0x0, &(0x7f0000000180)={0x0, 0xfffffffe, 0x0, 0xfffffffe, 0x1002f6}, &(0x7f0000000800)=[{0x0, 0x0, 0xffffffffffffffff, {0x0, 0xe704, 0x40040, 0x1000002, 0x91}}, {0x0, 0x0, 0xffffffffffffffff, {0x0, 0x5c87, 0x20, 0x3, 0x3aa}}, {0x0, 0x0, 0xffffffffffffffff, {0x0, 0x1f70, 0x2, 0x3ffffffe, 0x337}}, {0x0, 0x0, 0xffffffffffffffff, {0x0, 0x4, 0x200, 0x1, 0xffffffff}}], 0x1, 0x0, 0x0) openat$ptmx(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) executing program 2: write(0xffffffffffffffff, &(0x7f0000000340)='0fc5:1227:', 0xa) mmap$IORING_OFF_SQ_RING(0x110c230000, 0x8000002, 0x4, 0x401d031, 0xffffffffffffffff, 0x0) r0 = socket$netlink(0x10, 0x3, 0x4) socket$inet6_tcp(0xa, 0x1, 0x0) fcntl$setstatus(0xffffffffffffffff, 0x4, 0x40800) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000080)=0x7) sched_setaffinity(0x0, 0x8, &(0x7f0000000100)=0x2) sched_setscheduler(0x0, 0x2, &(0x7f0000000200)=0x4) r1 = syz_open_dev$MSR(&(0x7f00000001c0), 0x0, 0x0) read$msr(r1, &(0x7f0000032680)=""/102392, 0x18ff8) bind$netlink(r0, &(0x7f0000000180)={0x10, 0x0, 0x25dfdbfd, 0x1000000}, 0xc) sched_setaffinity(0x0, 0xfffffef7, &(0x7f0000000740)=0x410000002) r2 = openat$ublk_ctrl(0xffffffffffffff9c, &(0x7f0000000000), 0x2, 0x0) r3 = syz_ublk_setup_io_uring(0x20, &(0x7f0000000080)={0x0, 0x0, 0x0, 0x1, 0x2}, &(0x7f0000000040)=0x0, &(0x7f0000000100)=0x0, &(0x7f00000002c0)=0x0) r7 = syz_ublk_add_dev(r3, r4, r5, r6, &(0x7f0000000200)={0x2e, 0xc, 0x0, r2, 0xc0207504, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', {0xffffffff, 0xffff, 0x40, &(0x7f0000000500)=@new_dev={0x3, 0x104}}}, &(0x7f0000000300)) r8 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r8, 0x0, 0x80) r9 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_MSG_GETFLOWTABLE(r9, &(0x7f00000010c0)={0x0, 0x0, &(0x7f0000001080)={&(0x7f00000015c0)={0x20, 0x17, 0xa, 0x301, 0x0, 0x0, {0x2, 0x0, 0x4}, [@NFTA_FLOWTABLE_TABLE={0x9, 0x1, 'syz1\x00'}]}, 0x20}}, 0x4) syz_open_dev$ublk_chdev(&(0x7f0000002000), r7, 0x2) syz_ublk_setup_queues(0xffffffffffffffff, 0x0, &(0x7f0000000180)={0x0, 0xfffffffe, 0x0, 0xfffffffe, 0x1002f6}, &(0x7f0000000800)=[{0x0, 0x0, 0xffffffffffffffff, {0x0, 0xe704, 0x40040, 0x1000002, 0x91}}, {0x0, 0x0, 0xffffffffffffffff, {0x0, 0x5c87, 0x20, 0x3, 0x3aa}}, {0x0, 0x0, 0xffffffffffffffff, {0x0, 0x1f70, 0x2, 0x3ffffffe, 0x337}}, {0x0, 0x0, 0xffffffffffffffff, {0x0, 0x4, 0x200, 0x1, 0xffffffff}}], 0x1, 0x0, 0x0) openat$ptmx(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) executing program 0: prlimit64(0x0, 0xe, &(0x7f0000000140)={0xa, 0x8b}, 0x0) ptrace(0x4207, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000280)=0x8) r0 = getpid() sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x2) sched_setscheduler(r0, 0x2, &(0x7f0000000200)=0x7) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeea, 0x8031, 0xffffffffffffffff, 0x28f43000) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r1, &(0x7f0000000180)=@abs, 0x6e) sendmmsg$unix(r2, 0x0, 0x0, 0x0) recvmmsg(r1, &(0x7f00000000c0), 0x10106, 0x2, 0x0) unshare(0x28000600) r3 = fsopen(&(0x7f00000001c0)='mqueue\x00', 0x0) fsconfig$FSCONFIG_CMD_CREATE(r3, 0x6, 0x0, 0x0, 0x0) fsmount(r3, 0x0, 0x8e) unshare(0x8000280) prlimit64(r0, 0x0, &(0x7f0000000240)={0x0, 0x80}, &(0x7f0000000300)) mprotect(&(0x7f00001a4000/0x1000)=nil, 0x1000, 0x1) munmap(&(0x7f0000002000/0x1000)=nil, 0x1000) close(0xffffffffffffffff) program crashed: WARNING in io_ring_exit_work bisect: the chunk can be dropped bisect: split chunks (needed=true): <4> bisect: split chunk #0 of len 4 into 2 parts bisect: testing without sub-chunk 1/2 testing program (duration=6m0s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): [23, 20] detailed listing: executing program 2: write(0xffffffffffffffff, &(0x7f0000000340)='0fc5:1227:', 0xa) mmap$IORING_OFF_SQ_RING(0x110c230000, 0x8000002, 0x4, 0x401d031, 0xffffffffffffffff, 0x0) r0 = socket$netlink(0x10, 0x3, 0x4) socket$inet6_tcp(0xa, 0x1, 0x0) fcntl$setstatus(0xffffffffffffffff, 0x4, 0x40800) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000080)=0x7) sched_setaffinity(0x0, 0x8, &(0x7f0000000100)=0x2) sched_setscheduler(0x0, 0x2, &(0x7f0000000200)=0x4) r1 = syz_open_dev$MSR(&(0x7f00000001c0), 0x0, 0x0) read$msr(r1, &(0x7f0000032680)=""/102392, 0x18ff8) bind$netlink(r0, &(0x7f0000000180)={0x10, 0x0, 0x25dfdbfd, 0x1000000}, 0xc) sched_setaffinity(0x0, 0xfffffef7, &(0x7f0000000740)=0x410000002) r2 = openat$ublk_ctrl(0xffffffffffffff9c, &(0x7f0000000000), 0x2, 0x0) r3 = syz_ublk_setup_io_uring(0x20, &(0x7f0000000080)={0x0, 0x0, 0x0, 0x1, 0x2}, &(0x7f0000000040)=0x0, &(0x7f0000000100)=0x0, &(0x7f00000002c0)=0x0) r7 = syz_ublk_add_dev(r3, r4, r5, r6, &(0x7f0000000200)={0x2e, 0xc, 0x0, r2, 0xc0207504, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', {0xffffffff, 0xffff, 0x40, &(0x7f0000000500)=@new_dev={0x3, 0x104}}}, &(0x7f0000000300)) r8 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r8, 0x0, 0x80) r9 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_MSG_GETFLOWTABLE(r9, &(0x7f00000010c0)={0x0, 0x0, &(0x7f0000001080)={&(0x7f00000015c0)={0x20, 0x17, 0xa, 0x301, 0x0, 0x0, {0x2, 0x0, 0x4}, [@NFTA_FLOWTABLE_TABLE={0x9, 0x1, 'syz1\x00'}]}, 0x20}}, 0x4) syz_open_dev$ublk_chdev(&(0x7f0000002000), r7, 0x2) syz_ublk_setup_queues(0xffffffffffffffff, 0x0, &(0x7f0000000180)={0x0, 0xfffffffe, 0x0, 0xfffffffe, 0x1002f6}, &(0x7f0000000800)=[{0x0, 0x0, 0xffffffffffffffff, {0x0, 0xe704, 0x40040, 0x1000002, 0x91}}, {0x0, 0x0, 0xffffffffffffffff, {0x0, 0x5c87, 0x20, 0x3, 0x3aa}}, {0x0, 0x0, 0xffffffffffffffff, {0x0, 0x1f70, 0x2, 0x3ffffffe, 0x337}}, {0x0, 0x0, 0xffffffffffffffff, {0x0, 0x4, 0x200, 0x1, 0xffffffff}}], 0x1, 0x0, 0x0) openat$ptmx(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) executing program 0: prlimit64(0x0, 0xe, &(0x7f0000000140)={0xa, 0x8b}, 0x0) ptrace(0x4207, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000280)=0x8) r0 = getpid() sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x2) sched_setscheduler(r0, 0x2, &(0x7f0000000200)=0x7) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeea, 0x8031, 0xffffffffffffffff, 0x28f43000) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r1, &(0x7f0000000180)=@abs, 0x6e) sendmmsg$unix(r2, 0x0, 0x0, 0x0) recvmmsg(r1, &(0x7f00000000c0), 0x10106, 0x2, 0x0) unshare(0x28000600) r3 = fsopen(&(0x7f00000001c0)='mqueue\x00', 0x0) fsconfig$FSCONFIG_CMD_CREATE(r3, 0x6, 0x0, 0x0, 0x0) fsmount(r3, 0x0, 0x8e) unshare(0x8000280) prlimit64(r0, 0x0, &(0x7f0000000240)={0x0, 0x80}, &(0x7f0000000300)) mprotect(&(0x7f00001a4000/0x1000)=nil, 0x1000, 0x1) munmap(&(0x7f0000002000/0x1000)=nil, 0x1000) close(0xffffffffffffffff) program did not crash bisect: testing without sub-chunk 2/2 testing program (duration=6m0s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): [27, 26] detailed listing: executing program 0: r0 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000040)='cgroup.kill\x00', 0x275a, 0x0) inotify_init1(0x800) pipe(&(0x7f00000001c0)) mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./sys\x00', 0x1ff) mount(0x0, &(0x7f0000000000)='./sys\x00', &(0x7f0000000100)='sysfs\x00', 0x0, 0x0) r1 = openat(0xffffffffffffff9c, &(0x7f0000000200)='./sys/bus/pci/devices/0000:00:00.0/remove\x00', 0x1, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000140)={0xa, 0x8b}, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000280)=0x8) r2 = getpid() sched_setaffinity(0x0, 0x0, 0x0) sched_setscheduler(r2, 0x2, &(0x7f0000000200)=0x7) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeea, 0x8031, 0xffffffffffffffff, 0x28f43000) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$TIOCSPGRP(r1, 0x5410, &(0x7f0000000240)=r2) connect$unix(r3, &(0x7f0000000180)=@abs, 0x6e) sendmmsg$unix(r4, &(0x7f0000000000), 0x651, 0x0) recvmmsg(r3, &(0x7f00000000c0), 0x10106, 0x2, 0x0) mmap$IORING_OFF_SQ_RING(0x110c230000, 0x8000002, 0x2000007, 0x401d031, 0xffffffffffffffff, 0x0) write(r1, &(0x7f0000000300)='1', 0x1) r5 = openat(0xffffffffffffff9c, &(0x7f0000000080)='./sys/bus/pci/rescan\x00', 0x1, 0x0) write(r5, &(0x7f0000000300)='1', 0x1) mkdirat(0xffffffffffffff9c, 0x0, 0x1ff) timer_create(0x0, &(0x7f00000000c0)={0x0, 0x21, 0x2}, 0x0) mprotect(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x5) fcntl$lock(r0, 0x6, &(0x7f0000000080)={0x1, 0x1}) fcntl$lock(r0, 0x7, &(0x7f0000000000)={0x0, 0x2, 0x600000000000000, 0x1d}) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000000)) executing program 2: write(0xffffffffffffffff, &(0x7f0000000340)='0fc5:1227:', 0xa) mmap$IORING_OFF_SQ_RING(0x110c230000, 0x8000002, 0x4, 0x401d031, 0xffffffffffffffff, 0x0) r0 = socket$netlink(0x10, 0x3, 0x4) socket$inet6_tcp(0xa, 0x1, 0x0) fcntl$setstatus(0xffffffffffffffff, 0x4, 0x40800) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000080)=0x7) r1 = getpid() sched_setaffinity(0x0, 0x8, &(0x7f0000000100)=0x2) sched_setscheduler(r1, 0x2, &(0x7f0000000200)=0x4) r2 = syz_open_dev$MSR(&(0x7f00000001c0), 0x0, 0x0) read$msr(r2, &(0x7f0000032680)=""/102392, 0x18ff8) bind$netlink(r0, &(0x7f0000000180)={0x10, 0x0, 0x25dfdbfd, 0x1000000}, 0xc) sched_setaffinity(0x0, 0xfffffef7, &(0x7f0000000740)=0x410000002) r3 = openat$ublk_ctrl(0xffffffffffffff9c, &(0x7f0000000000), 0x2, 0x0) r4 = syz_ublk_setup_io_uring(0x20, &(0x7f0000000080)={0x0, 0x0, 0x0, 0x1, 0x2}, &(0x7f0000000040)=0x0, &(0x7f0000000100)=0x0, &(0x7f00000002c0)=0x0) r8 = syz_ublk_add_dev(r4, r5, r6, r7, &(0x7f0000000200)={0x2e, 0xc, 0x0, r3, 0xc0207504, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', {0xffffffff, 0xffff, 0x40, &(0x7f0000000500)=@new_dev={0x3, 0x104}}}, &(0x7f0000000300)=0x0) r10 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r10, 0x0, 0x80) r11 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_MSG_GETFLOWTABLE(r11, &(0x7f00000010c0)={0x0, 0x0, &(0x7f0000001080)={&(0x7f00000015c0)={0x20, 0x17, 0xa, 0x301, 0x0, 0x0, {0x2, 0x0, 0x4}, [@NFTA_FLOWTABLE_TABLE={0x9, 0x1, 'syz1\x00'}]}, 0x20}}, 0x4) r12 = syz_open_dev$ublk_chdev(&(0x7f0000002000), r8, 0x2) syz_ublk_setup_queues(r12, r9, &(0x7f0000000340)={0x0, 0x92d1, 0x400, 0x80000002, 0x165}, &(0x7f00000007c0)=[{0x0, 0x0, 0xffffffffffffffff, {0x0, 0x7ec5, 0x8, 0x2, 0x2f8, 0x0, r4}}, {0x0, 0x0, 0xffffffffffffffff, {0x0, 0x7dd8, 0x80, 0x1, 0x80000264, 0x0, r4}}, {0x0, 0x0, 0xffffffffffffffff, {0x0, 0xaa92, 0x8, 0x0, 0x67}}, {0x0, 0x0, 0xffffffffffffffff, {0x0, 0x97fb, 0x400, 0x1, 0x38b}}], 0x4, &(0x7f0000001a40)={0x2e, 0x10, 0x0, r12, 0xc0107520, 0x0, 0x0, 0x0, 0x0, {0x9}, 0x0, 0x0, '\x00', {0x0, 0x81c, 0x0, 0x0}}, &(0x7f0000001ac0)) mmap$IORING_OFF_SQ_RING(0x0, 0xc00000, 0x2000007, 0x401d031, 0xffffffffffffffff, 0x0) syz_ublk_setup_queues(r13, 0x0, &(0x7f0000000180)={0x0, 0xfffffffe, 0x0, 0xfffffffe, 0x1002f6}, &(0x7f0000000800)=[{0x0, 0x0, 0xffffffffffffffff, {0x0, 0xe704, 0x40040, 0x1000002, 0x91}}, {0x0, 0x0, 0xffffffffffffffff, {0x0, 0x5c87, 0x20, 0x3, 0x3aa}}, {0x0, 0x0, 0xffffffffffffffff, {0x0, 0x1f70, 0x2, 0x3ffffffe, 0x337}}, {0x0, 0x0, 0xffffffffffffffff, {0x0, 0x4, 0x200, 0x1, 0xffffffff}}], 0x1, 0x0, 0x0) openat$ptmx(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) program crashed: WARNING in io_ring_exit_work bisect: the chunk can be dropped bisect: split chunks (needed=true): <2> bisect: split chunk #0 of len 2 into 2 parts bisect: testing without sub-chunk 1/2 testing program (duration=6m0s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): write-mmap$IORING_OFF_SQ_RING-socket$netlink-socket$inet6_tcp-fcntl$setstatus-prlimit64-sched_setscheduler-getpid-sched_setaffinity-sched_setscheduler-syz_open_dev$MSR-read$msr-bind$netlink-sched_setaffinity-openat$ublk_ctrl-syz_ublk_setup_io_uring-syz_ublk_add_dev-socket$nl_netfilter-sendmsg$NFT_BATCH-socket$nl_netfilter-sendmsg$NFT_MSG_GETFLOWTABLE-syz_open_dev$ublk_chdev-syz_ublk_setup_queues-mmap$IORING_OFF_SQ_RING-syz_ublk_setup_queues-openat$ptmx detailed listing: executing program 2: write(0xffffffffffffffff, &(0x7f0000000340)='0fc5:1227:', 0xa) mmap$IORING_OFF_SQ_RING(0x110c230000, 0x8000002, 0x4, 0x401d031, 0xffffffffffffffff, 0x0) r0 = socket$netlink(0x10, 0x3, 0x4) socket$inet6_tcp(0xa, 0x1, 0x0) fcntl$setstatus(0xffffffffffffffff, 0x4, 0x40800) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000080)=0x7) r1 = getpid() sched_setaffinity(0x0, 0x8, &(0x7f0000000100)=0x2) sched_setscheduler(r1, 0x2, &(0x7f0000000200)=0x4) r2 = syz_open_dev$MSR(&(0x7f00000001c0), 0x0, 0x0) read$msr(r2, &(0x7f0000032680)=""/102392, 0x18ff8) bind$netlink(r0, &(0x7f0000000180)={0x10, 0x0, 0x25dfdbfd, 0x1000000}, 0xc) sched_setaffinity(0x0, 0xfffffef7, &(0x7f0000000740)=0x410000002) r3 = openat$ublk_ctrl(0xffffffffffffff9c, &(0x7f0000000000), 0x2, 0x0) r4 = syz_ublk_setup_io_uring(0x20, &(0x7f0000000080)={0x0, 0x0, 0x0, 0x1, 0x2}, &(0x7f0000000040)=0x0, &(0x7f0000000100)=0x0, &(0x7f00000002c0)=0x0) r8 = syz_ublk_add_dev(r4, r5, r6, r7, &(0x7f0000000200)={0x2e, 0xc, 0x0, r3, 0xc0207504, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', {0xffffffff, 0xffff, 0x40, &(0x7f0000000500)=@new_dev={0x3, 0x104}}}, &(0x7f0000000300)=0x0) r10 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r10, 0x0, 0x80) r11 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_MSG_GETFLOWTABLE(r11, &(0x7f00000010c0)={0x0, 0x0, &(0x7f0000001080)={&(0x7f00000015c0)={0x20, 0x17, 0xa, 0x301, 0x0, 0x0, {0x2, 0x0, 0x4}, [@NFTA_FLOWTABLE_TABLE={0x9, 0x1, 'syz1\x00'}]}, 0x20}}, 0x4) r12 = syz_open_dev$ublk_chdev(&(0x7f0000002000), r8, 0x2) syz_ublk_setup_queues(r12, r9, &(0x7f0000000340)={0x0, 0x92d1, 0x400, 0x80000002, 0x165}, &(0x7f00000007c0)=[{0x0, 0x0, 0xffffffffffffffff, {0x0, 0x7ec5, 0x8, 0x2, 0x2f8, 0x0, r4}}, {0x0, 0x0, 0xffffffffffffffff, {0x0, 0x7dd8, 0x80, 0x1, 0x80000264, 0x0, r4}}, {0x0, 0x0, 0xffffffffffffffff, {0x0, 0xaa92, 0x8, 0x0, 0x67}}, {0x0, 0x0, 0xffffffffffffffff, {0x0, 0x97fb, 0x400, 0x1, 0x38b}}], 0x4, &(0x7f0000001a40)={0x2e, 0x10, 0x0, r12, 0xc0107520, 0x0, 0x0, 0x0, 0x0, {0x9}, 0x0, 0x0, '\x00', {0x0, 0x81c, 0x0, 0x0}}, &(0x7f0000001ac0)) mmap$IORING_OFF_SQ_RING(0x0, 0xc00000, 0x2000007, 0x401d031, 0xffffffffffffffff, 0x0) syz_ublk_setup_queues(r13, 0x0, &(0x7f0000000180)={0x0, 0xfffffffe, 0x0, 0xfffffffe, 0x1002f6}, &(0x7f0000000800)=[{0x0, 0x0, 0xffffffffffffffff, {0x0, 0xe704, 0x40040, 0x1000002, 0x91}}, {0x0, 0x0, 0xffffffffffffffff, {0x0, 0x5c87, 0x20, 0x3, 0x3aa}}, {0x0, 0x0, 0xffffffffffffffff, {0x0, 0x1f70, 0x2, 0x3ffffffe, 0x337}}, {0x0, 0x0, 0xffffffffffffffff, {0x0, 0x4, 0x200, 0x1, 0xffffffff}}], 0x1, 0x0, 0x0) openat$ptmx(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) program crashed: WARNING in io_ring_exit_work bisect: the chunk can be dropped bisect: testing without sub-chunk 2/2 bisect: no need to test this chunk, it's definitely needed bisect: split chunks (needed=true): <1> bisect: split chunk #0 of len 1 into 2 parts bisect: no way to further split the chunk bisect: 1 programs left: executing program 2: write(0xffffffffffffffff, &(0x7f0000000340)='0fc5:1227:', 0xa) mmap$IORING_OFF_SQ_RING(0x110c230000, 0x8000002, 0x4, 0x401d031, 0xffffffffffffffff, 0x0) r0 = socket$netlink(0x10, 0x3, 0x4) socket$inet6_tcp(0xa, 0x1, 0x0) fcntl$setstatus(0xffffffffffffffff, 0x4, 0x40800) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000080)=0x7) r1 = getpid() sched_setaffinity(0x0, 0x8, &(0x7f0000000100)=0x2) sched_setscheduler(r1, 0x2, &(0x7f0000000200)=0x4) r2 = syz_open_dev$MSR(&(0x7f00000001c0), 0x0, 0x0) read$msr(r2, &(0x7f0000032680)=""/102392, 0x18ff8) bind$netlink(r0, &(0x7f0000000180)={0x10, 0x0, 0x25dfdbfd, 0x1000000}, 0xc) sched_setaffinity(0x0, 0xfffffef7, &(0x7f0000000740)=0x410000002) r3 = openat$ublk_ctrl(0xffffffffffffff9c, &(0x7f0000000000), 0x2, 0x0) r4 = syz_ublk_setup_io_uring(0x20, &(0x7f0000000080)={0x0, 0x0, 0x0, 0x1, 0x2}, &(0x7f0000000040)=0x0, &(0x7f0000000100)=0x0, &(0x7f00000002c0)=0x0) r8 = syz_ublk_add_dev(r4, r5, r6, r7, &(0x7f0000000200)={0x2e, 0xc, 0x0, r3, 0xc0207504, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', {0xffffffff, 0xffff, 0x40, &(0x7f0000000500)=@new_dev={0x3, 0x104}}}, &(0x7f0000000300)=0x0) r10 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r10, 0x0, 0x80) r11 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_MSG_GETFLOWTABLE(r11, &(0x7f00000010c0)={0x0, 0x0, &(0x7f0000001080)={&(0x7f00000015c0)={0x20, 0x17, 0xa, 0x301, 0x0, 0x0, {0x2, 0x0, 0x4}, [@NFTA_FLOWTABLE_TABLE={0x9, 0x1, 'syz1\x00'}]}, 0x20}}, 0x4) r12 = syz_open_dev$ublk_chdev(&(0x7f0000002000), r8, 0x2) syz_ublk_setup_queues(r12, r9, &(0x7f0000000340)={0x0, 0x92d1, 0x400, 0x80000002, 0x165}, &(0x7f00000007c0)=[{0x0, 0x0, 0xffffffffffffffff, {0x0, 0x7ec5, 0x8, 0x2, 0x2f8, 0x0, r4}}, {0x0, 0x0, 0xffffffffffffffff, {0x0, 0x7dd8, 0x80, 0x1, 0x80000264, 0x0, r4}}, {0x0, 0x0, 0xffffffffffffffff, {0x0, 0xaa92, 0x8, 0x0, 0x67}}, {0x0, 0x0, 0xffffffffffffffff, {0x0, 0x97fb, 0x400, 0x1, 0x38b}}], 0x4, &(0x7f0000001a40)={0x2e, 0x10, 0x0, r12, 0xc0107520, 0x0, 0x0, 0x0, 0x0, {0x9}, 0x0, 0x0, '\x00', {0x0, 0x81c, 0x0, 0x0}}, &(0x7f0000001ac0)) mmap$IORING_OFF_SQ_RING(0x0, 0xc00000, 0x2000007, 0x401d031, 0xffffffffffffffff, 0x0) syz_ublk_setup_queues(r13, 0x0, &(0x7f0000000180)={0x0, 0xfffffffe, 0x0, 0xfffffffe, 0x1002f6}, &(0x7f0000000800)=[{0x0, 0x0, 0xffffffffffffffff, {0x0, 0xe704, 0x40040, 0x1000002, 0x91}}, {0x0, 0x0, 0xffffffffffffffff, {0x0, 0x5c87, 0x20, 0x3, 0x3aa}}, {0x0, 0x0, 0xffffffffffffffff, {0x0, 0x1f70, 0x2, 0x3ffffffe, 0x337}}, {0x0, 0x0, 0xffffffffffffffff, {0x0, 0x4, 0x200, 0x1, 0xffffffff}}], 0x1, 0x0, 0x0) openat$ptmx(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) bisect: trying to concatenate bisect: concatenate 1 entries testing program (duration=9m0s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): write-mmap$IORING_OFF_SQ_RING-socket$netlink-socket$inet6_tcp-fcntl$setstatus-prlimit64-sched_setscheduler-getpid-sched_setaffinity-sched_setscheduler-syz_open_dev$MSR-read$msr-bind$netlink-sched_setaffinity-openat$ublk_ctrl-syz_ublk_setup_io_uring-syz_ublk_add_dev-socket$nl_netfilter-sendmsg$NFT_BATCH-socket$nl_netfilter-sendmsg$NFT_MSG_GETFLOWTABLE-syz_open_dev$ublk_chdev-syz_ublk_setup_queues-mmap$IORING_OFF_SQ_RING-syz_ublk_setup_queues-openat$ptmx detailed listing: executing program 0: write(0xffffffffffffffff, &(0x7f0000000340)='0fc5:1227:', 0xa) mmap$IORING_OFF_SQ_RING(0x110c230000, 0x8000002, 0x4, 0x401d031, 0xffffffffffffffff, 0x0) r0 = socket$netlink(0x10, 0x3, 0x4) socket$inet6_tcp(0xa, 0x1, 0x0) fcntl$setstatus(0xffffffffffffffff, 0x4, 0x40800) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000080)=0x7) r1 = getpid() sched_setaffinity(0x0, 0x8, &(0x7f0000000100)=0x2) sched_setscheduler(r1, 0x2, &(0x7f0000000200)=0x4) r2 = syz_open_dev$MSR(&(0x7f00000001c0), 0x0, 0x0) read$msr(r2, &(0x7f0000032680)=""/102392, 0x18ff8) bind$netlink(r0, &(0x7f0000000180)={0x10, 0x0, 0x25dfdbfd, 0x1000000}, 0xc) sched_setaffinity(0x0, 0xfffffef7, &(0x7f0000000740)=0x410000002) r3 = openat$ublk_ctrl(0xffffffffffffff9c, &(0x7f0000000000), 0x2, 0x0) r4 = syz_ublk_setup_io_uring(0x20, &(0x7f0000000080)={0x0, 0x0, 0x0, 0x1, 0x2}, &(0x7f0000000040)=0x0, &(0x7f0000000100)=0x0, &(0x7f00000002c0)=0x0) r8 = syz_ublk_add_dev(r4, r5, r6, r7, &(0x7f0000000200)={0x2e, 0xc, 0x0, r3, 0xc0207504, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', {0xffffffff, 0xffff, 0x40, &(0x7f0000000500)=@new_dev={0x3, 0x104}}}, &(0x7f0000000300)=0x0) r10 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r10, 0x0, 0x80) r11 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_MSG_GETFLOWTABLE(r11, &(0x7f00000010c0)={0x0, 0x0, &(0x7f0000001080)={&(0x7f00000015c0)={0x20, 0x17, 0xa, 0x301, 0x0, 0x0, {0x2, 0x0, 0x4}, [@NFTA_FLOWTABLE_TABLE={0x9, 0x1, 'syz1\x00'}]}, 0x20}}, 0x4) r12 = syz_open_dev$ublk_chdev(&(0x7f0000002000), r8, 0x2) syz_ublk_setup_queues(r12, r9, &(0x7f0000000340)={0x0, 0x92d1, 0x400, 0x80000002, 0x165}, &(0x7f00000007c0)=[{0x0, 0x0, 0xffffffffffffffff, {0x0, 0x7ec5, 0x8, 0x2, 0x2f8, 0x0, r4}}, {0x0, 0x0, 0xffffffffffffffff, {0x0, 0x7dd8, 0x80, 0x1, 0x80000264, 0x0, r4}}, {0x0, 0x0, 0xffffffffffffffff, {0x0, 0xaa92, 0x8, 0x0, 0x67}}, {0x0, 0x0, 0xffffffffffffffff, {0x0, 0x97fb, 0x400, 0x1, 0x38b}}], 0x4, &(0x7f0000001a40)={0x2e, 0x10, 0x0, r12, 0xc0107520, 0x0, 0x0, 0x0, 0x0, {0x9}, 0x0, 0x0, '\x00', {0x0, 0x81c, 0x0, 0x0}}, &(0x7f0000001ac0)) mmap$IORING_OFF_SQ_RING(0x0, 0xc00000, 0x2000007, 0x401d031, 0xffffffffffffffff, 0x0) syz_ublk_setup_queues(r13, 0x0, &(0x7f0000000180)={0x0, 0xfffffffe, 0x0, 0xfffffffe, 0x1002f6}, &(0x7f0000000800)=[{0x0, 0x0, 0xffffffffffffffff, {0x0, 0xe704, 0x40040, 0x1000002, 0x91}}, {0x0, 0x0, 0xffffffffffffffff, {0x0, 0x5c87, 0x20, 0x3, 0x3aa}}, {0x0, 0x0, 0xffffffffffffffff, {0x0, 0x1f70, 0x2, 0x3ffffffe, 0x337}}, {0x0, 0x0, 0xffffffffffffffff, {0x0, 0x4, 0x200, 0x1, 0xffffffff}}], 0x1, 0x0, 0x0) openat$ptmx(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) program crashed: WARNING in io_ring_exit_work bisect: concatenation succeeded found reproducer with 26 syscalls minimizing guilty program testing program (duration=9m0s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): write-mmap$IORING_OFF_SQ_RING-socket$netlink-socket$inet6_tcp-fcntl$setstatus-prlimit64-sched_setscheduler-getpid-sched_setaffinity-sched_setscheduler-syz_open_dev$MSR-read$msr-bind$netlink-sched_setaffinity-openat$ublk_ctrl-syz_ublk_setup_io_uring-syz_ublk_add_dev-socket$nl_netfilter-sendmsg$NFT_BATCH-socket$nl_netfilter-sendmsg$NFT_MSG_GETFLOWTABLE-syz_open_dev$ublk_chdev-syz_ublk_setup_queues-mmap$IORING_OFF_SQ_RING-syz_ublk_setup_queues detailed listing: executing program 0: write(0xffffffffffffffff, &(0x7f0000000340)='0fc5:1227:', 0xa) mmap$IORING_OFF_SQ_RING(0x110c230000, 0x8000002, 0x4, 0x401d031, 0xffffffffffffffff, 0x0) r0 = socket$netlink(0x10, 0x3, 0x4) socket$inet6_tcp(0xa, 0x1, 0x0) fcntl$setstatus(0xffffffffffffffff, 0x4, 0x40800) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000080)=0x7) r1 = getpid() sched_setaffinity(0x0, 0x8, &(0x7f0000000100)=0x2) sched_setscheduler(r1, 0x2, &(0x7f0000000200)=0x4) r2 = syz_open_dev$MSR(&(0x7f00000001c0), 0x0, 0x0) read$msr(r2, &(0x7f0000032680)=""/102392, 0x18ff8) bind$netlink(r0, &(0x7f0000000180)={0x10, 0x0, 0x25dfdbfd, 0x1000000}, 0xc) sched_setaffinity(0x0, 0xfffffef7, &(0x7f0000000740)=0x410000002) r3 = openat$ublk_ctrl(0xffffffffffffff9c, &(0x7f0000000000), 0x2, 0x0) r4 = syz_ublk_setup_io_uring(0x20, &(0x7f0000000080)={0x0, 0x0, 0x0, 0x1, 0x2}, &(0x7f0000000040)=0x0, &(0x7f0000000100)=0x0, &(0x7f00000002c0)=0x0) r8 = syz_ublk_add_dev(r4, r5, r6, r7, &(0x7f0000000200)={0x2e, 0xc, 0x0, r3, 0xc0207504, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', {0xffffffff, 0xffff, 0x40, &(0x7f0000000500)=@new_dev={0x3, 0x104}}}, &(0x7f0000000300)=0x0) r10 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r10, 0x0, 0x80) r11 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_MSG_GETFLOWTABLE(r11, &(0x7f00000010c0)={0x0, 0x0, &(0x7f0000001080)={&(0x7f00000015c0)={0x20, 0x17, 0xa, 0x301, 0x0, 0x0, {0x2, 0x0, 0x4}, [@NFTA_FLOWTABLE_TABLE={0x9, 0x1, 'syz1\x00'}]}, 0x20}}, 0x4) r12 = syz_open_dev$ublk_chdev(&(0x7f0000002000), r8, 0x2) syz_ublk_setup_queues(r12, r9, &(0x7f0000000340)={0x0, 0x92d1, 0x400, 0x80000002, 0x165}, &(0x7f00000007c0)=[{0x0, 0x0, 0xffffffffffffffff, {0x0, 0x7ec5, 0x8, 0x2, 0x2f8, 0x0, r4}}, {0x0, 0x0, 0xffffffffffffffff, {0x0, 0x7dd8, 0x80, 0x1, 0x80000264, 0x0, r4}}, {0x0, 0x0, 0xffffffffffffffff, {0x0, 0xaa92, 0x8, 0x0, 0x67}}, {0x0, 0x0, 0xffffffffffffffff, {0x0, 0x97fb, 0x400, 0x1, 0x38b}}], 0x4, &(0x7f0000001a40)={0x2e, 0x10, 0x0, r12, 0xc0107520, 0x0, 0x0, 0x0, 0x0, {0x9}, 0x0, 0x0, '\x00', {0x0, 0x81c, 0x0, 0x0}}, &(0x7f0000001ac0)) mmap$IORING_OFF_SQ_RING(0x0, 0xc00000, 0x2000007, 0x401d031, 0xffffffffffffffff, 0x0) syz_ublk_setup_queues(r13, 0x0, &(0x7f0000000180)={0x0, 0xfffffffe, 0x0, 0xfffffffe, 0x1002f6}, &(0x7f0000000800)=[{0x0, 0x0, 0xffffffffffffffff, {0x0, 0xe704, 0x40040, 0x1000002, 0x91}}, {0x0, 0x0, 0xffffffffffffffff, {0x0, 0x5c87, 0x20, 0x3, 0x3aa}}, {0x0, 0x0, 0xffffffffffffffff, {0x0, 0x1f70, 0x2, 0x3ffffffe, 0x337}}, {0x0, 0x0, 0xffffffffffffffff, {0x0, 0x4, 0x200, 0x1, 0xffffffff}}], 0x1, 0x0, 0x0) program crashed: WARNING in io_ring_exit_work testing program (duration=9m0s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): write-mmap$IORING_OFF_SQ_RING-socket$netlink-socket$inet6_tcp-fcntl$setstatus-prlimit64-sched_setscheduler-getpid-sched_setaffinity-sched_setscheduler-syz_open_dev$MSR-read$msr-bind$netlink-sched_setaffinity-openat$ublk_ctrl-syz_ublk_setup_io_uring-syz_ublk_add_dev-socket$nl_netfilter-sendmsg$NFT_BATCH-socket$nl_netfilter-sendmsg$NFT_MSG_GETFLOWTABLE-syz_open_dev$ublk_chdev-syz_ublk_setup_queues-mmap$IORING_OFF_SQ_RING detailed listing: executing program 0: write(0xffffffffffffffff, &(0x7f0000000340)='0fc5:1227:', 0xa) mmap$IORING_OFF_SQ_RING(0x110c230000, 0x8000002, 0x4, 0x401d031, 0xffffffffffffffff, 0x0) r0 = socket$netlink(0x10, 0x3, 0x4) socket$inet6_tcp(0xa, 0x1, 0x0) fcntl$setstatus(0xffffffffffffffff, 0x4, 0x40800) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000080)=0x7) r1 = getpid() sched_setaffinity(0x0, 0x8, &(0x7f0000000100)=0x2) sched_setscheduler(r1, 0x2, &(0x7f0000000200)=0x4) r2 = syz_open_dev$MSR(&(0x7f00000001c0), 0x0, 0x0) read$msr(r2, &(0x7f0000032680)=""/102392, 0x18ff8) bind$netlink(r0, &(0x7f0000000180)={0x10, 0x0, 0x25dfdbfd, 0x1000000}, 0xc) sched_setaffinity(0x0, 0xfffffef7, &(0x7f0000000740)=0x410000002) r3 = openat$ublk_ctrl(0xffffffffffffff9c, &(0x7f0000000000), 0x2, 0x0) r4 = syz_ublk_setup_io_uring(0x20, &(0x7f0000000080)={0x0, 0x0, 0x0, 0x1, 0x2}, &(0x7f0000000040)=0x0, &(0x7f0000000100)=0x0, &(0x7f00000002c0)=0x0) r8 = syz_ublk_add_dev(r4, r5, r6, r7, &(0x7f0000000200)={0x2e, 0xc, 0x0, r3, 0xc0207504, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', {0xffffffff, 0xffff, 0x40, &(0x7f0000000500)=@new_dev={0x3, 0x104}}}, &(0x7f0000000300)=0x0) r10 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r10, 0x0, 0x80) r11 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_MSG_GETFLOWTABLE(r11, &(0x7f00000010c0)={0x0, 0x0, &(0x7f0000001080)={&(0x7f00000015c0)={0x20, 0x17, 0xa, 0x301, 0x0, 0x0, {0x2, 0x0, 0x4}, [@NFTA_FLOWTABLE_TABLE={0x9, 0x1, 'syz1\x00'}]}, 0x20}}, 0x4) r12 = syz_open_dev$ublk_chdev(&(0x7f0000002000), r8, 0x2) syz_ublk_setup_queues(r12, r9, &(0x7f0000000340)={0x0, 0x92d1, 0x400, 0x80000002, 0x165}, &(0x7f00000007c0)=[{0x0, 0x0, 0xffffffffffffffff, {0x0, 0x7ec5, 0x8, 0x2, 0x2f8, 0x0, r4}}, {0x0, 0x0, 0xffffffffffffffff, {0x0, 0x7dd8, 0x80, 0x1, 0x80000264, 0x0, r4}}, {0x0, 0x0, 0xffffffffffffffff, {0x0, 0xaa92, 0x8, 0x0, 0x67}}, {0x0, 0x0, 0xffffffffffffffff, {0x0, 0x97fb, 0x400, 0x1, 0x38b}}], 0x4, &(0x7f0000001a40)={0x2e, 0x10, 0x0, r12, 0xc0107520, 0x0, 0x0, 0x0, 0x0, {0x9}, 0x0, 0x0, '\x00', {0x0, 0x81c, 0x0, 0x0}}, &(0x7f0000001ac0)) mmap$IORING_OFF_SQ_RING(0x0, 0xc00000, 0x2000007, 0x401d031, 0xffffffffffffffff, 0x0) program crashed: WARNING in io_ring_exit_work testing program (duration=9m0s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): write-mmap$IORING_OFF_SQ_RING-socket$netlink-socket$inet6_tcp-fcntl$setstatus-prlimit64-sched_setscheduler-getpid-sched_setaffinity-sched_setscheduler-syz_open_dev$MSR-read$msr-bind$netlink-sched_setaffinity-openat$ublk_ctrl-syz_ublk_setup_io_uring-syz_ublk_add_dev-socket$nl_netfilter-sendmsg$NFT_BATCH-socket$nl_netfilter-sendmsg$NFT_MSG_GETFLOWTABLE-syz_open_dev$ublk_chdev-syz_ublk_setup_queues detailed listing: executing program 0: write(0xffffffffffffffff, &(0x7f0000000340)='0fc5:1227:', 0xa) mmap$IORING_OFF_SQ_RING(0x110c230000, 0x8000002, 0x4, 0x401d031, 0xffffffffffffffff, 0x0) r0 = socket$netlink(0x10, 0x3, 0x4) socket$inet6_tcp(0xa, 0x1, 0x0) fcntl$setstatus(0xffffffffffffffff, 0x4, 0x40800) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000080)=0x7) r1 = getpid() sched_setaffinity(0x0, 0x8, &(0x7f0000000100)=0x2) sched_setscheduler(r1, 0x2, &(0x7f0000000200)=0x4) r2 = syz_open_dev$MSR(&(0x7f00000001c0), 0x0, 0x0) read$msr(r2, &(0x7f0000032680)=""/102392, 0x18ff8) bind$netlink(r0, &(0x7f0000000180)={0x10, 0x0, 0x25dfdbfd, 0x1000000}, 0xc) sched_setaffinity(0x0, 0xfffffef7, &(0x7f0000000740)=0x410000002) r3 = openat$ublk_ctrl(0xffffffffffffff9c, &(0x7f0000000000), 0x2, 0x0) r4 = syz_ublk_setup_io_uring(0x20, &(0x7f0000000080)={0x0, 0x0, 0x0, 0x1, 0x2}, &(0x7f0000000040)=0x0, &(0x7f0000000100)=0x0, &(0x7f00000002c0)=0x0) r8 = syz_ublk_add_dev(r4, r5, r6, r7, &(0x7f0000000200)={0x2e, 0xc, 0x0, r3, 0xc0207504, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', {0xffffffff, 0xffff, 0x40, &(0x7f0000000500)=@new_dev={0x3, 0x104}}}, &(0x7f0000000300)=0x0) r10 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r10, 0x0, 0x80) r11 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_MSG_GETFLOWTABLE(r11, &(0x7f00000010c0)={0x0, 0x0, &(0x7f0000001080)={&(0x7f00000015c0)={0x20, 0x17, 0xa, 0x301, 0x0, 0x0, {0x2, 0x0, 0x4}, [@NFTA_FLOWTABLE_TABLE={0x9, 0x1, 'syz1\x00'}]}, 0x20}}, 0x4) r12 = syz_open_dev$ublk_chdev(&(0x7f0000002000), r8, 0x2) syz_ublk_setup_queues(r12, r9, &(0x7f0000000340)={0x0, 0x92d1, 0x400, 0x80000002, 0x165}, &(0x7f00000007c0)=[{0x0, 0x0, 0xffffffffffffffff, {0x0, 0x7ec5, 0x8, 0x2, 0x2f8, 0x0, r4}}, {0x0, 0x0, 0xffffffffffffffff, {0x0, 0x7dd8, 0x80, 0x1, 0x80000264, 0x0, r4}}, {0x0, 0x0, 0xffffffffffffffff, {0x0, 0xaa92, 0x8, 0x0, 0x67}}, {0x0, 0x0, 0xffffffffffffffff, {0x0, 0x97fb, 0x400, 0x1, 0x38b}}], 0x4, &(0x7f0000001a40)={0x2e, 0x10, 0x0, r12, 0xc0107520, 0x0, 0x0, 0x0, 0x0, {0x9}, 0x0, 0x0, '\x00', {0x0, 0x81c, 0x0, 0x0}}, &(0x7f0000001ac0)) program crashed: WARNING in io_ring_exit_work testing program (duration=9m0s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): write-mmap$IORING_OFF_SQ_RING-socket$netlink-socket$inet6_tcp-fcntl$setstatus-prlimit64-sched_setscheduler-getpid-sched_setaffinity-sched_setscheduler-syz_open_dev$MSR-read$msr-bind$netlink-sched_setaffinity-openat$ublk_ctrl-syz_ublk_setup_io_uring-syz_ublk_add_dev-socket$nl_netfilter-sendmsg$NFT_BATCH-socket$nl_netfilter-sendmsg$NFT_MSG_GETFLOWTABLE-syz_open_dev$ublk_chdev detailed listing: executing program 0: write(0xffffffffffffffff, &(0x7f0000000340)='0fc5:1227:', 0xa) mmap$IORING_OFF_SQ_RING(0x110c230000, 0x8000002, 0x4, 0x401d031, 0xffffffffffffffff, 0x0) r0 = socket$netlink(0x10, 0x3, 0x4) socket$inet6_tcp(0xa, 0x1, 0x0) fcntl$setstatus(0xffffffffffffffff, 0x4, 0x40800) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000080)=0x7) r1 = getpid() sched_setaffinity(0x0, 0x8, &(0x7f0000000100)=0x2) sched_setscheduler(r1, 0x2, &(0x7f0000000200)=0x4) r2 = syz_open_dev$MSR(&(0x7f00000001c0), 0x0, 0x0) read$msr(r2, &(0x7f0000032680)=""/102392, 0x18ff8) bind$netlink(r0, &(0x7f0000000180)={0x10, 0x0, 0x25dfdbfd, 0x1000000}, 0xc) sched_setaffinity(0x0, 0xfffffef7, &(0x7f0000000740)=0x410000002) r3 = openat$ublk_ctrl(0xffffffffffffff9c, &(0x7f0000000000), 0x2, 0x0) r4 = syz_ublk_setup_io_uring(0x20, &(0x7f0000000080)={0x0, 0x0, 0x0, 0x1, 0x2}, &(0x7f0000000040)=0x0, &(0x7f0000000100)=0x0, &(0x7f00000002c0)=0x0) r8 = syz_ublk_add_dev(r4, r5, r6, r7, &(0x7f0000000200)={0x2e, 0xc, 0x0, r3, 0xc0207504, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', {0xffffffff, 0xffff, 0x40, &(0x7f0000000500)=@new_dev={0x3, 0x104}}}, &(0x7f0000000300)) r9 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r9, 0x0, 0x80) r10 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_MSG_GETFLOWTABLE(r10, &(0x7f00000010c0)={0x0, 0x0, &(0x7f0000001080)={&(0x7f00000015c0)={0x20, 0x17, 0xa, 0x301, 0x0, 0x0, {0x2, 0x0, 0x4}, [@NFTA_FLOWTABLE_TABLE={0x9, 0x1, 'syz1\x00'}]}, 0x20}}, 0x4) syz_open_dev$ublk_chdev(&(0x7f0000002000), r8, 0x2) VM was preempted during syz execution: failed to run command in VM: instance is preempted, retrying program did not crash testing program (duration=9m0s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): write-mmap$IORING_OFF_SQ_RING-socket$netlink-socket$inet6_tcp-fcntl$setstatus-prlimit64-sched_setscheduler-getpid-sched_setaffinity-sched_setscheduler-syz_open_dev$MSR-read$msr-bind$netlink-sched_setaffinity-openat$ublk_ctrl-syz_ublk_setup_io_uring-syz_ublk_add_dev-socket$nl_netfilter-sendmsg$NFT_BATCH-socket$nl_netfilter-sendmsg$NFT_MSG_GETFLOWTABLE-syz_ublk_setup_queues detailed listing: executing program 0: write(0xffffffffffffffff, &(0x7f0000000340)='0fc5:1227:', 0xa) mmap$IORING_OFF_SQ_RING(0x110c230000, 0x8000002, 0x4, 0x401d031, 0xffffffffffffffff, 0x0) r0 = socket$netlink(0x10, 0x3, 0x4) socket$inet6_tcp(0xa, 0x1, 0x0) fcntl$setstatus(0xffffffffffffffff, 0x4, 0x40800) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000080)=0x7) r1 = getpid() sched_setaffinity(0x0, 0x8, &(0x7f0000000100)=0x2) sched_setscheduler(r1, 0x2, &(0x7f0000000200)=0x4) r2 = syz_open_dev$MSR(&(0x7f00000001c0), 0x0, 0x0) read$msr(r2, &(0x7f0000032680)=""/102392, 0x18ff8) bind$netlink(r0, &(0x7f0000000180)={0x10, 0x0, 0x25dfdbfd, 0x1000000}, 0xc) sched_setaffinity(0x0, 0xfffffef7, &(0x7f0000000740)=0x410000002) r3 = openat$ublk_ctrl(0xffffffffffffff9c, &(0x7f0000000000), 0x2, 0x0) r4 = syz_ublk_setup_io_uring(0x20, &(0x7f0000000080)={0x0, 0x0, 0x0, 0x1, 0x2}, &(0x7f0000000040)=0x0, &(0x7f0000000100)=0x0, &(0x7f00000002c0)=0x0) syz_ublk_add_dev(r4, r5, r6, r7, &(0x7f0000000200)={0x2e, 0xc, 0x0, r3, 0xc0207504, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', {0xffffffff, 0xffff, 0x40, &(0x7f0000000500)=@new_dev={0x3, 0x104}}}, &(0x7f0000000300)=0x0) r9 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r9, 0x0, 0x80) r10 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_MSG_GETFLOWTABLE(r10, &(0x7f00000010c0)={0x0, 0x0, &(0x7f0000001080)={&(0x7f00000015c0)={0x20, 0x17, 0xa, 0x301, 0x0, 0x0, {0x2, 0x0, 0x4}, [@NFTA_FLOWTABLE_TABLE={0x9, 0x1, 'syz1\x00'}]}, 0x20}}, 0x4) syz_ublk_setup_queues(0xffffffffffffffff, r8, &(0x7f0000000340)={0x0, 0x92d1, 0x400, 0x80000002, 0x165}, &(0x7f00000007c0)=[{0x0, 0x0, 0xffffffffffffffff, {0x0, 0x7ec5, 0x8, 0x2, 0x2f8, 0x0, r4}}, {0x0, 0x0, 0xffffffffffffffff, {0x0, 0x7dd8, 0x80, 0x1, 0x80000264, 0x0, r4}}, {0x0, 0x0, 0xffffffffffffffff, {0x0, 0xaa92, 0x8, 0x0, 0x67}}, {0x0, 0x0, 0xffffffffffffffff, {0x0, 0x97fb, 0x400, 0x1, 0x38b}}], 0x4, &(0x7f0000001a40)={0x2e, 0x10, 0x0, 0xffffffffffffffff, 0xc0107520, 0x0, 0x0, 0x0, 0x0, {0x9}, 0x0, 0x0, '\x00', {0x0, 0x81c, 0x0, 0x0}}, &(0x7f0000001ac0)) program did not crash testing program (duration=9m0s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): write-mmap$IORING_OFF_SQ_RING-socket$netlink-socket$inet6_tcp-fcntl$setstatus-prlimit64-sched_setscheduler-getpid-sched_setaffinity-sched_setscheduler-syz_open_dev$MSR-read$msr-bind$netlink-sched_setaffinity-openat$ublk_ctrl-syz_ublk_setup_io_uring-syz_ublk_add_dev-socket$nl_netfilter-sendmsg$NFT_BATCH-socket$nl_netfilter-syz_open_dev$ublk_chdev-syz_ublk_setup_queues detailed listing: executing program 0: write(0xffffffffffffffff, &(0x7f0000000340)='0fc5:1227:', 0xa) mmap$IORING_OFF_SQ_RING(0x110c230000, 0x8000002, 0x4, 0x401d031, 0xffffffffffffffff, 0x0) r0 = socket$netlink(0x10, 0x3, 0x4) socket$inet6_tcp(0xa, 0x1, 0x0) fcntl$setstatus(0xffffffffffffffff, 0x4, 0x40800) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000080)=0x7) r1 = getpid() sched_setaffinity(0x0, 0x8, &(0x7f0000000100)=0x2) sched_setscheduler(r1, 0x2, &(0x7f0000000200)=0x4) r2 = syz_open_dev$MSR(&(0x7f00000001c0), 0x0, 0x0) read$msr(r2, &(0x7f0000032680)=""/102392, 0x18ff8) bind$netlink(r0, &(0x7f0000000180)={0x10, 0x0, 0x25dfdbfd, 0x1000000}, 0xc) sched_setaffinity(0x0, 0xfffffef7, &(0x7f0000000740)=0x410000002) r3 = openat$ublk_ctrl(0xffffffffffffff9c, &(0x7f0000000000), 0x2, 0x0) r4 = syz_ublk_setup_io_uring(0x20, &(0x7f0000000080)={0x0, 0x0, 0x0, 0x1, 0x2}, &(0x7f0000000040)=0x0, &(0x7f0000000100)=0x0, &(0x7f00000002c0)=0x0) r8 = syz_ublk_add_dev(r4, r5, r6, r7, &(0x7f0000000200)={0x2e, 0xc, 0x0, r3, 0xc0207504, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', {0xffffffff, 0xffff, 0x40, &(0x7f0000000500)=@new_dev={0x3, 0x104}}}, &(0x7f0000000300)=0x0) r10 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r10, 0x0, 0x80) socket$nl_netfilter(0x10, 0x3, 0xc) r11 = syz_open_dev$ublk_chdev(&(0x7f0000002000), r8, 0x2) syz_ublk_setup_queues(r11, r9, &(0x7f0000000340)={0x0, 0x92d1, 0x400, 0x80000002, 0x165}, &(0x7f00000007c0)=[{0x0, 0x0, 0xffffffffffffffff, {0x0, 0x7ec5, 0x8, 0x2, 0x2f8, 0x0, r4}}, {0x0, 0x0, 0xffffffffffffffff, {0x0, 0x7dd8, 0x80, 0x1, 0x80000264, 0x0, r4}}, {0x0, 0x0, 0xffffffffffffffff, {0x0, 0xaa92, 0x8, 0x0, 0x67}}, {0x0, 0x0, 0xffffffffffffffff, {0x0, 0x97fb, 0x400, 0x1, 0x38b}}], 0x4, &(0x7f0000001a40)={0x2e, 0x10, 0x0, r11, 0xc0107520, 0x0, 0x0, 0x0, 0x0, {0x9}, 0x0, 0x0, '\x00', {0x0, 0x81c, 0x0, 0x0}}, &(0x7f0000001ac0)) program crashed: WARNING in io_ring_exit_work testing program (duration=9m0s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): write-mmap$IORING_OFF_SQ_RING-socket$netlink-socket$inet6_tcp-fcntl$setstatus-prlimit64-sched_setscheduler-getpid-sched_setaffinity-sched_setscheduler-syz_open_dev$MSR-read$msr-bind$netlink-sched_setaffinity-openat$ublk_ctrl-syz_ublk_setup_io_uring-syz_ublk_add_dev-socket$nl_netfilter-sendmsg$NFT_BATCH-syz_open_dev$ublk_chdev-syz_ublk_setup_queues detailed listing: executing program 0: write(0xffffffffffffffff, &(0x7f0000000340)='0fc5:1227:', 0xa) mmap$IORING_OFF_SQ_RING(0x110c230000, 0x8000002, 0x4, 0x401d031, 0xffffffffffffffff, 0x0) r0 = socket$netlink(0x10, 0x3, 0x4) socket$inet6_tcp(0xa, 0x1, 0x0) fcntl$setstatus(0xffffffffffffffff, 0x4, 0x40800) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000080)=0x7) r1 = getpid() sched_setaffinity(0x0, 0x8, &(0x7f0000000100)=0x2) sched_setscheduler(r1, 0x2, &(0x7f0000000200)=0x4) r2 = syz_open_dev$MSR(&(0x7f00000001c0), 0x0, 0x0) read$msr(r2, &(0x7f0000032680)=""/102392, 0x18ff8) bind$netlink(r0, &(0x7f0000000180)={0x10, 0x0, 0x25dfdbfd, 0x1000000}, 0xc) sched_setaffinity(0x0, 0xfffffef7, &(0x7f0000000740)=0x410000002) r3 = openat$ublk_ctrl(0xffffffffffffff9c, &(0x7f0000000000), 0x2, 0x0) r4 = syz_ublk_setup_io_uring(0x20, &(0x7f0000000080)={0x0, 0x0, 0x0, 0x1, 0x2}, &(0x7f0000000040)=0x0, &(0x7f0000000100)=0x0, &(0x7f00000002c0)=0x0) r8 = syz_ublk_add_dev(r4, r5, r6, r7, &(0x7f0000000200)={0x2e, 0xc, 0x0, r3, 0xc0207504, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', {0xffffffff, 0xffff, 0x40, &(0x7f0000000500)=@new_dev={0x3, 0x104}}}, &(0x7f0000000300)=0x0) r10 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r10, 0x0, 0x80) r11 = syz_open_dev$ublk_chdev(&(0x7f0000002000), r8, 0x2) syz_ublk_setup_queues(r11, r9, &(0x7f0000000340)={0x0, 0x92d1, 0x400, 0x80000002, 0x165}, &(0x7f00000007c0)=[{0x0, 0x0, 0xffffffffffffffff, {0x0, 0x7ec5, 0x8, 0x2, 0x2f8, 0x0, r4}}, {0x0, 0x0, 0xffffffffffffffff, {0x0, 0x7dd8, 0x80, 0x1, 0x80000264, 0x0, r4}}, {0x0, 0x0, 0xffffffffffffffff, {0x0, 0xaa92, 0x8, 0x0, 0x67}}, {0x0, 0x0, 0xffffffffffffffff, {0x0, 0x97fb, 0x400, 0x1, 0x38b}}], 0x4, &(0x7f0000001a40)={0x2e, 0x10, 0x0, r11, 0xc0107520, 0x0, 0x0, 0x0, 0x0, {0x9}, 0x0, 0x0, '\x00', {0x0, 0x81c, 0x0, 0x0}}, &(0x7f0000001ac0)) program crashed: WARNING in io_ring_exit_work testing program (duration=9m0s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): write-mmap$IORING_OFF_SQ_RING-socket$netlink-socket$inet6_tcp-fcntl$setstatus-prlimit64-sched_setscheduler-getpid-sched_setaffinity-sched_setscheduler-syz_open_dev$MSR-read$msr-bind$netlink-sched_setaffinity-openat$ublk_ctrl-syz_ublk_setup_io_uring-syz_ublk_add_dev-socket$nl_netfilter-syz_open_dev$ublk_chdev-syz_ublk_setup_queues detailed listing: executing program 0: write(0xffffffffffffffff, &(0x7f0000000340)='0fc5:1227:', 0xa) mmap$IORING_OFF_SQ_RING(0x110c230000, 0x8000002, 0x4, 0x401d031, 0xffffffffffffffff, 0x0) r0 = socket$netlink(0x10, 0x3, 0x4) socket$inet6_tcp(0xa, 0x1, 0x0) fcntl$setstatus(0xffffffffffffffff, 0x4, 0x40800) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000080)=0x7) r1 = getpid() sched_setaffinity(0x0, 0x8, &(0x7f0000000100)=0x2) sched_setscheduler(r1, 0x2, &(0x7f0000000200)=0x4) r2 = syz_open_dev$MSR(&(0x7f00000001c0), 0x0, 0x0) read$msr(r2, &(0x7f0000032680)=""/102392, 0x18ff8) bind$netlink(r0, &(0x7f0000000180)={0x10, 0x0, 0x25dfdbfd, 0x1000000}, 0xc) sched_setaffinity(0x0, 0xfffffef7, &(0x7f0000000740)=0x410000002) r3 = openat$ublk_ctrl(0xffffffffffffff9c, &(0x7f0000000000), 0x2, 0x0) r4 = syz_ublk_setup_io_uring(0x20, &(0x7f0000000080)={0x0, 0x0, 0x0, 0x1, 0x2}, &(0x7f0000000040)=0x0, &(0x7f0000000100)=0x0, &(0x7f00000002c0)=0x0) r8 = syz_ublk_add_dev(r4, r5, r6, r7, &(0x7f0000000200)={0x2e, 0xc, 0x0, r3, 0xc0207504, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', {0xffffffff, 0xffff, 0x40, &(0x7f0000000500)=@new_dev={0x3, 0x104}}}, &(0x7f0000000300)=0x0) socket$nl_netfilter(0x10, 0x3, 0xc) r10 = syz_open_dev$ublk_chdev(&(0x7f0000002000), r8, 0x2) syz_ublk_setup_queues(r10, r9, &(0x7f0000000340)={0x0, 0x92d1, 0x400, 0x80000002, 0x165}, &(0x7f00000007c0)=[{0x0, 0x0, 0xffffffffffffffff, {0x0, 0x7ec5, 0x8, 0x2, 0x2f8, 0x0, r4}}, {0x0, 0x0, 0xffffffffffffffff, {0x0, 0x7dd8, 0x80, 0x1, 0x80000264, 0x0, r4}}, {0x0, 0x0, 0xffffffffffffffff, {0x0, 0xaa92, 0x8, 0x0, 0x67}}, {0x0, 0x0, 0xffffffffffffffff, {0x0, 0x97fb, 0x400, 0x1, 0x38b}}], 0x4, &(0x7f0000001a40)={0x2e, 0x10, 0x0, r10, 0xc0107520, 0x0, 0x0, 0x0, 0x0, {0x9}, 0x0, 0x0, '\x00', {0x0, 0x81c, 0x0, 0x0}}, &(0x7f0000001ac0)) program crashed: WARNING in io_ring_exit_work testing program (duration=9m0s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): write-mmap$IORING_OFF_SQ_RING-socket$netlink-socket$inet6_tcp-fcntl$setstatus-prlimit64-sched_setscheduler-getpid-sched_setaffinity-sched_setscheduler-syz_open_dev$MSR-read$msr-bind$netlink-sched_setaffinity-openat$ublk_ctrl-syz_ublk_setup_io_uring-syz_ublk_add_dev-syz_open_dev$ublk_chdev-syz_ublk_setup_queues detailed listing: executing program 0: write(0xffffffffffffffff, &(0x7f0000000340)='0fc5:1227:', 0xa) mmap$IORING_OFF_SQ_RING(0x110c230000, 0x8000002, 0x4, 0x401d031, 0xffffffffffffffff, 0x0) r0 = socket$netlink(0x10, 0x3, 0x4) socket$inet6_tcp(0xa, 0x1, 0x0) fcntl$setstatus(0xffffffffffffffff, 0x4, 0x40800) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000080)=0x7) r1 = getpid() sched_setaffinity(0x0, 0x8, &(0x7f0000000100)=0x2) sched_setscheduler(r1, 0x2, &(0x7f0000000200)=0x4) r2 = syz_open_dev$MSR(&(0x7f00000001c0), 0x0, 0x0) read$msr(r2, &(0x7f0000032680)=""/102392, 0x18ff8) bind$netlink(r0, &(0x7f0000000180)={0x10, 0x0, 0x25dfdbfd, 0x1000000}, 0xc) sched_setaffinity(0x0, 0xfffffef7, &(0x7f0000000740)=0x410000002) r3 = openat$ublk_ctrl(0xffffffffffffff9c, &(0x7f0000000000), 0x2, 0x0) r4 = syz_ublk_setup_io_uring(0x20, &(0x7f0000000080)={0x0, 0x0, 0x0, 0x1, 0x2}, &(0x7f0000000040)=0x0, &(0x7f0000000100)=0x0, &(0x7f00000002c0)=0x0) r8 = syz_ublk_add_dev(r4, r5, r6, r7, &(0x7f0000000200)={0x2e, 0xc, 0x0, r3, 0xc0207504, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', {0xffffffff, 0xffff, 0x40, &(0x7f0000000500)=@new_dev={0x3, 0x104}}}, &(0x7f0000000300)=0x0) r10 = syz_open_dev$ublk_chdev(&(0x7f0000002000), r8, 0x2) syz_ublk_setup_queues(r10, r9, &(0x7f0000000340)={0x0, 0x92d1, 0x400, 0x80000002, 0x165}, &(0x7f00000007c0)=[{0x0, 0x0, 0xffffffffffffffff, {0x0, 0x7ec5, 0x8, 0x2, 0x2f8, 0x0, r4}}, {0x0, 0x0, 0xffffffffffffffff, {0x0, 0x7dd8, 0x80, 0x1, 0x80000264, 0x0, r4}}, {0x0, 0x0, 0xffffffffffffffff, {0x0, 0xaa92, 0x8, 0x0, 0x67}}, {0x0, 0x0, 0xffffffffffffffff, {0x0, 0x97fb, 0x400, 0x1, 0x38b}}], 0x4, &(0x7f0000001a40)={0x2e, 0x10, 0x0, r10, 0xc0107520, 0x0, 0x0, 0x0, 0x0, {0x9}, 0x0, 0x0, '\x00', {0x0, 0x81c, 0x0, 0x0}}, &(0x7f0000001ac0)) program crashed: WARNING in io_ring_exit_work testing program (duration=9m0s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): write-mmap$IORING_OFF_SQ_RING-socket$netlink-socket$inet6_tcp-fcntl$setstatus-prlimit64-sched_setscheduler-getpid-sched_setaffinity-sched_setscheduler-syz_open_dev$MSR-read$msr-bind$netlink-sched_setaffinity-openat$ublk_ctrl-syz_ublk_setup_io_uring-syz_open_dev$ublk_chdev-syz_ublk_setup_queues detailed listing: executing program 0: write(0xffffffffffffffff, &(0x7f0000000340)='0fc5:1227:', 0xa) mmap$IORING_OFF_SQ_RING(0x110c230000, 0x8000002, 0x4, 0x401d031, 0xffffffffffffffff, 0x0) r0 = socket$netlink(0x10, 0x3, 0x4) socket$inet6_tcp(0xa, 0x1, 0x0) fcntl$setstatus(0xffffffffffffffff, 0x4, 0x40800) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000080)=0x7) r1 = getpid() sched_setaffinity(0x0, 0x8, &(0x7f0000000100)=0x2) sched_setscheduler(r1, 0x2, &(0x7f0000000200)=0x4) r2 = syz_open_dev$MSR(&(0x7f00000001c0), 0x0, 0x0) read$msr(r2, &(0x7f0000032680)=""/102392, 0x18ff8) bind$netlink(r0, &(0x7f0000000180)={0x10, 0x0, 0x25dfdbfd, 0x1000000}, 0xc) sched_setaffinity(0x0, 0xfffffef7, &(0x7f0000000740)=0x410000002) openat$ublk_ctrl(0xffffffffffffff9c, &(0x7f0000000000), 0x2, 0x0) r3 = syz_ublk_setup_io_uring(0x20, &(0x7f0000000080)={0x0, 0x0, 0x0, 0x1, 0x2}, &(0x7f0000000040), &(0x7f0000000100), &(0x7f00000002c0)) r4 = syz_open_dev$ublk_chdev(&(0x7f0000002000), 0x0, 0x2) syz_ublk_setup_queues(r4, 0x0, &(0x7f0000000340)={0x0, 0x92d1, 0x400, 0x80000002, 0x165}, &(0x7f00000007c0)=[{0x0, 0x0, 0xffffffffffffffff, {0x0, 0x7ec5, 0x8, 0x2, 0x2f8, 0x0, r3}}, {0x0, 0x0, 0xffffffffffffffff, {0x0, 0x7dd8, 0x80, 0x1, 0x80000264, 0x0, r3}}, {0x0, 0x0, 0xffffffffffffffff, {0x0, 0xaa92, 0x8, 0x0, 0x67}}, {0x0, 0x0, 0xffffffffffffffff, {0x0, 0x97fb, 0x400, 0x1, 0x38b}}], 0x4, &(0x7f0000001a40)={0x2e, 0x10, 0x0, r4, 0xc0107520, 0x0, 0x0, 0x0, 0x0, {0x9}, 0x0, 0x0, '\x00', {0x0, 0x81c, 0x0, 0x0}}, &(0x7f0000001ac0)) program did not crash testing program (duration=9m0s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): write-mmap$IORING_OFF_SQ_RING-socket$netlink-socket$inet6_tcp-fcntl$setstatus-prlimit64-sched_setscheduler-getpid-sched_setaffinity-sched_setscheduler-syz_open_dev$MSR-read$msr-bind$netlink-sched_setaffinity-openat$ublk_ctrl-syz_ublk_add_dev-syz_open_dev$ublk_chdev-syz_ublk_setup_queues detailed listing: executing program 0: write(0xffffffffffffffff, &(0x7f0000000340)='0fc5:1227:', 0xa) mmap$IORING_OFF_SQ_RING(0x110c230000, 0x8000002, 0x4, 0x401d031, 0xffffffffffffffff, 0x0) r0 = socket$netlink(0x10, 0x3, 0x4) socket$inet6_tcp(0xa, 0x1, 0x0) fcntl$setstatus(0xffffffffffffffff, 0x4, 0x40800) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000080)=0x7) r1 = getpid() sched_setaffinity(0x0, 0x8, &(0x7f0000000100)=0x2) sched_setscheduler(r1, 0x2, &(0x7f0000000200)=0x4) r2 = syz_open_dev$MSR(&(0x7f00000001c0), 0x0, 0x0) read$msr(r2, &(0x7f0000032680)=""/102392, 0x18ff8) bind$netlink(r0, &(0x7f0000000180)={0x10, 0x0, 0x25dfdbfd, 0x1000000}, 0xc) sched_setaffinity(0x0, 0xfffffef7, &(0x7f0000000740)=0x410000002) r3 = openat$ublk_ctrl(0xffffffffffffff9c, &(0x7f0000000000), 0x2, 0x0) r4 = syz_ublk_add_dev(0xffffffffffffffff, 0x0, 0x0, 0x0, &(0x7f0000000200)={0x2e, 0xc, 0x0, r3, 0xc0207504, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', {0xffffffff, 0xffff, 0x40, &(0x7f0000000500)=@new_dev={0x3, 0x104}}}, &(0x7f0000000300)=0x0) r6 = syz_open_dev$ublk_chdev(&(0x7f0000002000), r4, 0x2) syz_ublk_setup_queues(r6, r5, &(0x7f0000000340)={0x0, 0x92d1, 0x400, 0x80000002, 0x165}, &(0x7f00000007c0)=[{0x0, 0x0, 0xffffffffffffffff, {0x0, 0x7ec5, 0x8, 0x2, 0x2f8}}, {0x0, 0x0, 0xffffffffffffffff, {0x0, 0x7dd8, 0x80, 0x1, 0x80000264}}, {0x0, 0x0, 0xffffffffffffffff, {0x0, 0xaa92, 0x8, 0x0, 0x67}}, {0x0, 0x0, 0xffffffffffffffff, {0x0, 0x97fb, 0x400, 0x1, 0x38b}}], 0x4, &(0x7f0000001a40)={0x2e, 0x10, 0x0, r6, 0xc0107520, 0x0, 0x0, 0x0, 0x0, {0x9}, 0x0, 0x0, '\x00', {0x0, 0x81c, 0x0, 0x0}}, &(0x7f0000001ac0)) program did not crash testing program (duration=9m0s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): write-mmap$IORING_OFF_SQ_RING-socket$netlink-socket$inet6_tcp-fcntl$setstatus-prlimit64-sched_setscheduler-getpid-sched_setaffinity-sched_setscheduler-syz_open_dev$MSR-read$msr-bind$netlink-sched_setaffinity-syz_ublk_setup_io_uring-syz_ublk_add_dev-syz_open_dev$ublk_chdev-syz_ublk_setup_queues detailed listing: executing program 0: write(0xffffffffffffffff, &(0x7f0000000340)='0fc5:1227:', 0xa) mmap$IORING_OFF_SQ_RING(0x110c230000, 0x8000002, 0x4, 0x401d031, 0xffffffffffffffff, 0x0) r0 = socket$netlink(0x10, 0x3, 0x4) socket$inet6_tcp(0xa, 0x1, 0x0) fcntl$setstatus(0xffffffffffffffff, 0x4, 0x40800) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000080)=0x7) r1 = getpid() sched_setaffinity(0x0, 0x8, &(0x7f0000000100)=0x2) sched_setscheduler(r1, 0x2, &(0x7f0000000200)=0x4) r2 = syz_open_dev$MSR(&(0x7f00000001c0), 0x0, 0x0) read$msr(r2, &(0x7f0000032680)=""/102392, 0x18ff8) bind$netlink(r0, &(0x7f0000000180)={0x10, 0x0, 0x25dfdbfd, 0x1000000}, 0xc) sched_setaffinity(0x0, 0xfffffef7, &(0x7f0000000740)=0x410000002) r3 = syz_ublk_setup_io_uring(0x20, &(0x7f0000000080)={0x0, 0x0, 0x0, 0x1, 0x2}, &(0x7f0000000040)=0x0, &(0x7f0000000100)=0x0, &(0x7f00000002c0)=0x0) r7 = syz_ublk_add_dev(r3, r4, r5, r6, &(0x7f0000000200)={0x2e, 0xc, 0x0, 0xffffffffffffffff, 0xc0207504, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', {0xffffffff, 0xffff, 0x40, &(0x7f0000000500)=@new_dev={0x3, 0x104}}}, &(0x7f0000000300)=0x0) r9 = syz_open_dev$ublk_chdev(&(0x7f0000002000), r7, 0x2) syz_ublk_setup_queues(r9, r8, &(0x7f0000000340)={0x0, 0x92d1, 0x400, 0x80000002, 0x165}, &(0x7f00000007c0)=[{0x0, 0x0, 0xffffffffffffffff, {0x0, 0x7ec5, 0x8, 0x2, 0x2f8, 0x0, r3}}, {0x0, 0x0, 0xffffffffffffffff, {0x0, 0x7dd8, 0x80, 0x1, 0x80000264, 0x0, r3}}, {0x0, 0x0, 0xffffffffffffffff, {0x0, 0xaa92, 0x8, 0x0, 0x67}}, {0x0, 0x0, 0xffffffffffffffff, {0x0, 0x97fb, 0x400, 0x1, 0x38b}}], 0x4, &(0x7f0000001a40)={0x2e, 0x10, 0x0, r9, 0xc0107520, 0x0, 0x0, 0x0, 0x0, {0x9}, 0x0, 0x0, '\x00', {0x0, 0x81c, 0x0, 0x0}}, &(0x7f0000001ac0)) VM was preempted during syz execution: failed to run command in VM: instance is preempted, retrying program did not crash testing program (duration=9m0s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): write-mmap$IORING_OFF_SQ_RING-socket$netlink-socket$inet6_tcp-fcntl$setstatus-prlimit64-sched_setscheduler-getpid-sched_setaffinity-sched_setscheduler-syz_open_dev$MSR-read$msr-bind$netlink-openat$ublk_ctrl-syz_ublk_setup_io_uring-syz_ublk_add_dev-syz_open_dev$ublk_chdev-syz_ublk_setup_queues detailed listing: executing program 0: write(0xffffffffffffffff, &(0x7f0000000340)='0fc5:1227:', 0xa) mmap$IORING_OFF_SQ_RING(0x110c230000, 0x8000002, 0x4, 0x401d031, 0xffffffffffffffff, 0x0) r0 = socket$netlink(0x10, 0x3, 0x4) socket$inet6_tcp(0xa, 0x1, 0x0) fcntl$setstatus(0xffffffffffffffff, 0x4, 0x40800) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000080)=0x7) r1 = getpid() sched_setaffinity(0x0, 0x8, &(0x7f0000000100)=0x2) sched_setscheduler(r1, 0x2, &(0x7f0000000200)=0x4) r2 = syz_open_dev$MSR(&(0x7f00000001c0), 0x0, 0x0) read$msr(r2, &(0x7f0000032680)=""/102392, 0x18ff8) bind$netlink(r0, &(0x7f0000000180)={0x10, 0x0, 0x25dfdbfd, 0x1000000}, 0xc) r3 = openat$ublk_ctrl(0xffffffffffffff9c, &(0x7f0000000000), 0x2, 0x0) r4 = syz_ublk_setup_io_uring(0x20, &(0x7f0000000080)={0x0, 0x0, 0x0, 0x1, 0x2}, &(0x7f0000000040)=0x0, &(0x7f0000000100)=0x0, &(0x7f00000002c0)=0x0) r8 = syz_ublk_add_dev(r4, r5, r6, r7, &(0x7f0000000200)={0x2e, 0xc, 0x0, r3, 0xc0207504, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', {0xffffffff, 0xffff, 0x40, &(0x7f0000000500)=@new_dev={0x3, 0x104}}}, &(0x7f0000000300)=0x0) r10 = syz_open_dev$ublk_chdev(&(0x7f0000002000), r8, 0x2) syz_ublk_setup_queues(r10, r9, &(0x7f0000000340)={0x0, 0x92d1, 0x400, 0x80000002, 0x165}, &(0x7f00000007c0)=[{0x0, 0x0, 0xffffffffffffffff, {0x0, 0x7ec5, 0x8, 0x2, 0x2f8, 0x0, r4}}, {0x0, 0x0, 0xffffffffffffffff, {0x0, 0x7dd8, 0x80, 0x1, 0x80000264, 0x0, r4}}, {0x0, 0x0, 0xffffffffffffffff, {0x0, 0xaa92, 0x8, 0x0, 0x67}}, {0x0, 0x0, 0xffffffffffffffff, {0x0, 0x97fb, 0x400, 0x1, 0x38b}}], 0x4, &(0x7f0000001a40)={0x2e, 0x10, 0x0, r10, 0xc0107520, 0x0, 0x0, 0x0, 0x0, {0x9}, 0x0, 0x0, '\x00', {0x0, 0x81c, 0x0, 0x0}}, &(0x7f0000001ac0)) program crashed: WARNING in io_ring_exit_work testing program (duration=9m0s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): write-mmap$IORING_OFF_SQ_RING-socket$netlink-socket$inet6_tcp-fcntl$setstatus-prlimit64-sched_setscheduler-getpid-sched_setaffinity-sched_setscheduler-syz_open_dev$MSR-read$msr-openat$ublk_ctrl-syz_ublk_setup_io_uring-syz_ublk_add_dev-syz_open_dev$ublk_chdev-syz_ublk_setup_queues detailed listing: executing program 0: write(0xffffffffffffffff, &(0x7f0000000340)='0fc5:1227:', 0xa) mmap$IORING_OFF_SQ_RING(0x110c230000, 0x8000002, 0x4, 0x401d031, 0xffffffffffffffff, 0x0) socket$netlink(0x10, 0x3, 0x4) socket$inet6_tcp(0xa, 0x1, 0x0) fcntl$setstatus(0xffffffffffffffff, 0x4, 0x40800) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000080)=0x7) r0 = getpid() sched_setaffinity(0x0, 0x8, &(0x7f0000000100)=0x2) sched_setscheduler(r0, 0x2, &(0x7f0000000200)=0x4) r1 = syz_open_dev$MSR(&(0x7f00000001c0), 0x0, 0x0) read$msr(r1, &(0x7f0000032680)=""/102392, 0x18ff8) r2 = openat$ublk_ctrl(0xffffffffffffff9c, &(0x7f0000000000), 0x2, 0x0) r3 = syz_ublk_setup_io_uring(0x20, &(0x7f0000000080)={0x0, 0x0, 0x0, 0x1, 0x2}, &(0x7f0000000040)=0x0, &(0x7f0000000100)=0x0, &(0x7f00000002c0)=0x0) r7 = syz_ublk_add_dev(r3, r4, r5, r6, &(0x7f0000000200)={0x2e, 0xc, 0x0, r2, 0xc0207504, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', {0xffffffff, 0xffff, 0x40, &(0x7f0000000500)=@new_dev={0x3, 0x104}}}, &(0x7f0000000300)=0x0) r9 = syz_open_dev$ublk_chdev(&(0x7f0000002000), r7, 0x2) syz_ublk_setup_queues(r9, r8, &(0x7f0000000340)={0x0, 0x92d1, 0x400, 0x80000002, 0x165}, &(0x7f00000007c0)=[{0x0, 0x0, 0xffffffffffffffff, {0x0, 0x7ec5, 0x8, 0x2, 0x2f8, 0x0, r3}}, {0x0, 0x0, 0xffffffffffffffff, {0x0, 0x7dd8, 0x80, 0x1, 0x80000264, 0x0, r3}}, {0x0, 0x0, 0xffffffffffffffff, {0x0, 0xaa92, 0x8, 0x0, 0x67}}, {0x0, 0x0, 0xffffffffffffffff, {0x0, 0x97fb, 0x400, 0x1, 0x38b}}], 0x4, &(0x7f0000001a40)={0x2e, 0x10, 0x0, r9, 0xc0107520, 0x0, 0x0, 0x0, 0x0, {0x9}, 0x0, 0x0, '\x00', {0x0, 0x81c, 0x0, 0x0}}, &(0x7f0000001ac0)) program crashed: WARNING in io_ring_exit_work testing program (duration=9m0s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): write-mmap$IORING_OFF_SQ_RING-socket$netlink-socket$inet6_tcp-fcntl$setstatus-prlimit64-sched_setscheduler-getpid-sched_setaffinity-sched_setscheduler-syz_open_dev$MSR-openat$ublk_ctrl-syz_ublk_setup_io_uring-syz_ublk_add_dev-syz_open_dev$ublk_chdev-syz_ublk_setup_queues detailed listing: executing program 0: write(0xffffffffffffffff, &(0x7f0000000340)='0fc5:1227:', 0xa) mmap$IORING_OFF_SQ_RING(0x110c230000, 0x8000002, 0x4, 0x401d031, 0xffffffffffffffff, 0x0) socket$netlink(0x10, 0x3, 0x4) socket$inet6_tcp(0xa, 0x1, 0x0) fcntl$setstatus(0xffffffffffffffff, 0x4, 0x40800) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000080)=0x7) r0 = getpid() sched_setaffinity(0x0, 0x8, &(0x7f0000000100)=0x2) sched_setscheduler(r0, 0x2, &(0x7f0000000200)=0x4) syz_open_dev$MSR(&(0x7f00000001c0), 0x0, 0x0) r1 = openat$ublk_ctrl(0xffffffffffffff9c, &(0x7f0000000000), 0x2, 0x0) r2 = syz_ublk_setup_io_uring(0x20, &(0x7f0000000080)={0x0, 0x0, 0x0, 0x1, 0x2}, &(0x7f0000000040)=0x0, &(0x7f0000000100)=0x0, &(0x7f00000002c0)=0x0) r6 = syz_ublk_add_dev(r2, r3, r4, r5, &(0x7f0000000200)={0x2e, 0xc, 0x0, r1, 0xc0207504, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', {0xffffffff, 0xffff, 0x40, &(0x7f0000000500)=@new_dev={0x3, 0x104}}}, &(0x7f0000000300)=0x0) r8 = syz_open_dev$ublk_chdev(&(0x7f0000002000), r6, 0x2) syz_ublk_setup_queues(r8, r7, &(0x7f0000000340)={0x0, 0x92d1, 0x400, 0x80000002, 0x165}, &(0x7f00000007c0)=[{0x0, 0x0, 0xffffffffffffffff, {0x0, 0x7ec5, 0x8, 0x2, 0x2f8, 0x0, r2}}, {0x0, 0x0, 0xffffffffffffffff, {0x0, 0x7dd8, 0x80, 0x1, 0x80000264, 0x0, r2}}, {0x0, 0x0, 0xffffffffffffffff, {0x0, 0xaa92, 0x8, 0x0, 0x67}}, {0x0, 0x0, 0xffffffffffffffff, {0x0, 0x97fb, 0x400, 0x1, 0x38b}}], 0x4, &(0x7f0000001a40)={0x2e, 0x10, 0x0, r8, 0xc0107520, 0x0, 0x0, 0x0, 0x0, {0x9}, 0x0, 0x0, '\x00', {0x0, 0x81c, 0x0, 0x0}}, &(0x7f0000001ac0)) program crashed: WARNING in io_ring_exit_work testing program (duration=9m0s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): write-mmap$IORING_OFF_SQ_RING-socket$netlink-socket$inet6_tcp-fcntl$setstatus-prlimit64-sched_setscheduler-getpid-sched_setaffinity-sched_setscheduler-openat$ublk_ctrl-syz_ublk_setup_io_uring-syz_ublk_add_dev-syz_open_dev$ublk_chdev-syz_ublk_setup_queues detailed listing: executing program 0: write(0xffffffffffffffff, &(0x7f0000000340)='0fc5:1227:', 0xa) mmap$IORING_OFF_SQ_RING(0x110c230000, 0x8000002, 0x4, 0x401d031, 0xffffffffffffffff, 0x0) socket$netlink(0x10, 0x3, 0x4) socket$inet6_tcp(0xa, 0x1, 0x0) fcntl$setstatus(0xffffffffffffffff, 0x4, 0x40800) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000080)=0x7) r0 = getpid() sched_setaffinity(0x0, 0x8, &(0x7f0000000100)=0x2) sched_setscheduler(r0, 0x2, &(0x7f0000000200)=0x4) r1 = openat$ublk_ctrl(0xffffffffffffff9c, &(0x7f0000000000), 0x2, 0x0) r2 = syz_ublk_setup_io_uring(0x20, &(0x7f0000000080)={0x0, 0x0, 0x0, 0x1, 0x2}, &(0x7f0000000040)=0x0, &(0x7f0000000100)=0x0, &(0x7f00000002c0)=0x0) r6 = syz_ublk_add_dev(r2, r3, r4, r5, &(0x7f0000000200)={0x2e, 0xc, 0x0, r1, 0xc0207504, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', {0xffffffff, 0xffff, 0x40, &(0x7f0000000500)=@new_dev={0x3, 0x104}}}, &(0x7f0000000300)=0x0) r8 = syz_open_dev$ublk_chdev(&(0x7f0000002000), r6, 0x2) syz_ublk_setup_queues(r8, r7, &(0x7f0000000340)={0x0, 0x92d1, 0x400, 0x80000002, 0x165}, &(0x7f00000007c0)=[{0x0, 0x0, 0xffffffffffffffff, {0x0, 0x7ec5, 0x8, 0x2, 0x2f8, 0x0, r2}}, {0x0, 0x0, 0xffffffffffffffff, {0x0, 0x7dd8, 0x80, 0x1, 0x80000264, 0x0, r2}}, {0x0, 0x0, 0xffffffffffffffff, {0x0, 0xaa92, 0x8, 0x0, 0x67}}, {0x0, 0x0, 0xffffffffffffffff, {0x0, 0x97fb, 0x400, 0x1, 0x38b}}], 0x4, &(0x7f0000001a40)={0x2e, 0x10, 0x0, r8, 0xc0107520, 0x0, 0x0, 0x0, 0x0, {0x9}, 0x0, 0x0, '\x00', {0x0, 0x81c, 0x0, 0x0}}, &(0x7f0000001ac0)) program crashed: WARNING in io_ring_exit_work testing program (duration=9m0s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): write-mmap$IORING_OFF_SQ_RING-socket$netlink-socket$inet6_tcp-fcntl$setstatus-prlimit64-sched_setscheduler-getpid-sched_setaffinity-openat$ublk_ctrl-syz_ublk_setup_io_uring-syz_ublk_add_dev-syz_open_dev$ublk_chdev-syz_ublk_setup_queues detailed listing: executing program 0: write(0xffffffffffffffff, &(0x7f0000000340)='0fc5:1227:', 0xa) mmap$IORING_OFF_SQ_RING(0x110c230000, 0x8000002, 0x4, 0x401d031, 0xffffffffffffffff, 0x0) socket$netlink(0x10, 0x3, 0x4) socket$inet6_tcp(0xa, 0x1, 0x0) fcntl$setstatus(0xffffffffffffffff, 0x4, 0x40800) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000080)=0x7) getpid() sched_setaffinity(0x0, 0x8, &(0x7f0000000100)=0x2) r0 = openat$ublk_ctrl(0xffffffffffffff9c, &(0x7f0000000000), 0x2, 0x0) r1 = syz_ublk_setup_io_uring(0x20, &(0x7f0000000080)={0x0, 0x0, 0x0, 0x1, 0x2}, &(0x7f0000000040)=0x0, &(0x7f0000000100)=0x0, &(0x7f00000002c0)=0x0) r5 = syz_ublk_add_dev(r1, r2, r3, r4, &(0x7f0000000200)={0x2e, 0xc, 0x0, r0, 0xc0207504, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', {0xffffffff, 0xffff, 0x40, &(0x7f0000000500)=@new_dev={0x3, 0x104}}}, &(0x7f0000000300)=0x0) r7 = syz_open_dev$ublk_chdev(&(0x7f0000002000), r5, 0x2) syz_ublk_setup_queues(r7, r6, &(0x7f0000000340)={0x0, 0x92d1, 0x400, 0x80000002, 0x165}, &(0x7f00000007c0)=[{0x0, 0x0, 0xffffffffffffffff, {0x0, 0x7ec5, 0x8, 0x2, 0x2f8, 0x0, r1}}, {0x0, 0x0, 0xffffffffffffffff, {0x0, 0x7dd8, 0x80, 0x1, 0x80000264, 0x0, r1}}, {0x0, 0x0, 0xffffffffffffffff, {0x0, 0xaa92, 0x8, 0x0, 0x67}}, {0x0, 0x0, 0xffffffffffffffff, {0x0, 0x97fb, 0x400, 0x1, 0x38b}}], 0x4, &(0x7f0000001a40)={0x2e, 0x10, 0x0, r7, 0xc0107520, 0x0, 0x0, 0x0, 0x0, {0x9}, 0x0, 0x0, '\x00', {0x0, 0x81c, 0x0, 0x0}}, &(0x7f0000001ac0)) program crashed: WARNING in io_ring_exit_work testing program (duration=9m0s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): write-mmap$IORING_OFF_SQ_RING-socket$netlink-socket$inet6_tcp-fcntl$setstatus-prlimit64-sched_setscheduler-getpid-openat$ublk_ctrl-syz_ublk_setup_io_uring-syz_ublk_add_dev-syz_open_dev$ublk_chdev-syz_ublk_setup_queues detailed listing: executing program 0: write(0xffffffffffffffff, &(0x7f0000000340)='0fc5:1227:', 0xa) mmap$IORING_OFF_SQ_RING(0x110c230000, 0x8000002, 0x4, 0x401d031, 0xffffffffffffffff, 0x0) socket$netlink(0x10, 0x3, 0x4) socket$inet6_tcp(0xa, 0x1, 0x0) fcntl$setstatus(0xffffffffffffffff, 0x4, 0x40800) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000080)=0x7) getpid() r0 = openat$ublk_ctrl(0xffffffffffffff9c, &(0x7f0000000000), 0x2, 0x0) r1 = syz_ublk_setup_io_uring(0x20, &(0x7f0000000080)={0x0, 0x0, 0x0, 0x1, 0x2}, &(0x7f0000000040)=0x0, &(0x7f0000000100)=0x0, &(0x7f00000002c0)=0x0) r5 = syz_ublk_add_dev(r1, r2, r3, r4, &(0x7f0000000200)={0x2e, 0xc, 0x0, r0, 0xc0207504, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', {0xffffffff, 0xffff, 0x40, &(0x7f0000000500)=@new_dev={0x3, 0x104}}}, &(0x7f0000000300)=0x0) r7 = syz_open_dev$ublk_chdev(&(0x7f0000002000), r5, 0x2) syz_ublk_setup_queues(r7, r6, &(0x7f0000000340)={0x0, 0x92d1, 0x400, 0x80000002, 0x165}, &(0x7f00000007c0)=[{0x0, 0x0, 0xffffffffffffffff, {0x0, 0x7ec5, 0x8, 0x2, 0x2f8, 0x0, r1}}, {0x0, 0x0, 0xffffffffffffffff, {0x0, 0x7dd8, 0x80, 0x1, 0x80000264, 0x0, r1}}, {0x0, 0x0, 0xffffffffffffffff, {0x0, 0xaa92, 0x8, 0x0, 0x67}}, {0x0, 0x0, 0xffffffffffffffff, {0x0, 0x97fb, 0x400, 0x1, 0x38b}}], 0x4, &(0x7f0000001a40)={0x2e, 0x10, 0x0, r7, 0xc0107520, 0x0, 0x0, 0x0, 0x0, {0x9}, 0x0, 0x0, '\x00', {0x0, 0x81c, 0x0, 0x0}}, &(0x7f0000001ac0)) program crashed: WARNING in io_ring_exit_work testing program (duration=9m0s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): write-mmap$IORING_OFF_SQ_RING-socket$netlink-socket$inet6_tcp-fcntl$setstatus-prlimit64-sched_setscheduler-openat$ublk_ctrl-syz_ublk_setup_io_uring-syz_ublk_add_dev-syz_open_dev$ublk_chdev-syz_ublk_setup_queues detailed listing: executing program 0: write(0xffffffffffffffff, &(0x7f0000000340)='0fc5:1227:', 0xa) mmap$IORING_OFF_SQ_RING(0x110c230000, 0x8000002, 0x4, 0x401d031, 0xffffffffffffffff, 0x0) socket$netlink(0x10, 0x3, 0x4) socket$inet6_tcp(0xa, 0x1, 0x0) fcntl$setstatus(0xffffffffffffffff, 0x4, 0x40800) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000080)=0x7) r0 = openat$ublk_ctrl(0xffffffffffffff9c, &(0x7f0000000000), 0x2, 0x0) r1 = syz_ublk_setup_io_uring(0x20, &(0x7f0000000080)={0x0, 0x0, 0x0, 0x1, 0x2}, &(0x7f0000000040)=0x0, &(0x7f0000000100)=0x0, &(0x7f00000002c0)=0x0) r5 = syz_ublk_add_dev(r1, r2, r3, r4, &(0x7f0000000200)={0x2e, 0xc, 0x0, r0, 0xc0207504, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', {0xffffffff, 0xffff, 0x40, &(0x7f0000000500)=@new_dev={0x3, 0x104}}}, &(0x7f0000000300)=0x0) r7 = syz_open_dev$ublk_chdev(&(0x7f0000002000), r5, 0x2) syz_ublk_setup_queues(r7, r6, &(0x7f0000000340)={0x0, 0x92d1, 0x400, 0x80000002, 0x165}, &(0x7f00000007c0)=[{0x0, 0x0, 0xffffffffffffffff, {0x0, 0x7ec5, 0x8, 0x2, 0x2f8, 0x0, r1}}, {0x0, 0x0, 0xffffffffffffffff, {0x0, 0x7dd8, 0x80, 0x1, 0x80000264, 0x0, r1}}, {0x0, 0x0, 0xffffffffffffffff, {0x0, 0xaa92, 0x8, 0x0, 0x67}}, {0x0, 0x0, 0xffffffffffffffff, {0x0, 0x97fb, 0x400, 0x1, 0x38b}}], 0x4, &(0x7f0000001a40)={0x2e, 0x10, 0x0, r7, 0xc0107520, 0x0, 0x0, 0x0, 0x0, {0x9}, 0x0, 0x0, '\x00', {0x0, 0x81c, 0x0, 0x0}}, &(0x7f0000001ac0)) program crashed: WARNING in io_ring_exit_work testing program (duration=9m0s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): write-mmap$IORING_OFF_SQ_RING-socket$netlink-socket$inet6_tcp-fcntl$setstatus-prlimit64-openat$ublk_ctrl-syz_ublk_setup_io_uring-syz_ublk_add_dev-syz_open_dev$ublk_chdev-syz_ublk_setup_queues detailed listing: executing program 0: write(0xffffffffffffffff, &(0x7f0000000340)='0fc5:1227:', 0xa) mmap$IORING_OFF_SQ_RING(0x110c230000, 0x8000002, 0x4, 0x401d031, 0xffffffffffffffff, 0x0) socket$netlink(0x10, 0x3, 0x4) socket$inet6_tcp(0xa, 0x1, 0x0) fcntl$setstatus(0xffffffffffffffff, 0x4, 0x40800) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) r0 = openat$ublk_ctrl(0xffffffffffffff9c, &(0x7f0000000000), 0x2, 0x0) r1 = syz_ublk_setup_io_uring(0x20, &(0x7f0000000080)={0x0, 0x0, 0x0, 0x1, 0x2}, &(0x7f0000000040)=0x0, &(0x7f0000000100)=0x0, &(0x7f00000002c0)=0x0) r5 = syz_ublk_add_dev(r1, r2, r3, r4, &(0x7f0000000200)={0x2e, 0xc, 0x0, r0, 0xc0207504, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', {0xffffffff, 0xffff, 0x40, &(0x7f0000000500)=@new_dev={0x3, 0x104}}}, &(0x7f0000000300)=0x0) r7 = syz_open_dev$ublk_chdev(&(0x7f0000002000), r5, 0x2) syz_ublk_setup_queues(r7, r6, &(0x7f0000000340)={0x0, 0x92d1, 0x400, 0x80000002, 0x165}, &(0x7f00000007c0)=[{0x0, 0x0, 0xffffffffffffffff, {0x0, 0x7ec5, 0x8, 0x2, 0x2f8, 0x0, r1}}, {0x0, 0x0, 0xffffffffffffffff, {0x0, 0x7dd8, 0x80, 0x1, 0x80000264, 0x0, r1}}, {0x0, 0x0, 0xffffffffffffffff, {0x0, 0xaa92, 0x8, 0x0, 0x67}}, {0x0, 0x0, 0xffffffffffffffff, {0x0, 0x97fb, 0x400, 0x1, 0x38b}}], 0x4, &(0x7f0000001a40)={0x2e, 0x10, 0x0, r7, 0xc0107520, 0x0, 0x0, 0x0, 0x0, {0x9}, 0x0, 0x0, '\x00', {0x0, 0x81c, 0x0, 0x0}}, &(0x7f0000001ac0)) program crashed: WARNING in io_ring_exit_work testing program (duration=9m0s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): write-mmap$IORING_OFF_SQ_RING-socket$netlink-socket$inet6_tcp-fcntl$setstatus-openat$ublk_ctrl-syz_ublk_setup_io_uring-syz_ublk_add_dev-syz_open_dev$ublk_chdev-syz_ublk_setup_queues detailed listing: executing program 0: write(0xffffffffffffffff, &(0x7f0000000340)='0fc5:1227:', 0xa) mmap$IORING_OFF_SQ_RING(0x110c230000, 0x8000002, 0x4, 0x401d031, 0xffffffffffffffff, 0x0) socket$netlink(0x10, 0x3, 0x4) socket$inet6_tcp(0xa, 0x1, 0x0) fcntl$setstatus(0xffffffffffffffff, 0x4, 0x40800) r0 = openat$ublk_ctrl(0xffffffffffffff9c, &(0x7f0000000000), 0x2, 0x0) r1 = syz_ublk_setup_io_uring(0x20, &(0x7f0000000080)={0x0, 0x0, 0x0, 0x1, 0x2}, &(0x7f0000000040)=0x0, &(0x7f0000000100)=0x0, &(0x7f00000002c0)=0x0) r5 = syz_ublk_add_dev(r1, r2, r3, r4, &(0x7f0000000200)={0x2e, 0xc, 0x0, r0, 0xc0207504, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', {0xffffffff, 0xffff, 0x40, &(0x7f0000000500)=@new_dev={0x3, 0x104}}}, &(0x7f0000000300)=0x0) r7 = syz_open_dev$ublk_chdev(&(0x7f0000002000), r5, 0x2) syz_ublk_setup_queues(r7, r6, &(0x7f0000000340)={0x0, 0x92d1, 0x400, 0x80000002, 0x165}, &(0x7f00000007c0)=[{0x0, 0x0, 0xffffffffffffffff, {0x0, 0x7ec5, 0x8, 0x2, 0x2f8, 0x0, r1}}, {0x0, 0x0, 0xffffffffffffffff, {0x0, 0x7dd8, 0x80, 0x1, 0x80000264, 0x0, r1}}, {0x0, 0x0, 0xffffffffffffffff, {0x0, 0xaa92, 0x8, 0x0, 0x67}}, {0x0, 0x0, 0xffffffffffffffff, {0x0, 0x97fb, 0x400, 0x1, 0x38b}}], 0x4, &(0x7f0000001a40)={0x2e, 0x10, 0x0, r7, 0xc0107520, 0x0, 0x0, 0x0, 0x0, {0x9}, 0x0, 0x0, '\x00', {0x0, 0x81c, 0x0, 0x0}}, &(0x7f0000001ac0)) program crashed: lost connection to test machine suppressed program crash: lost connection to test machine testing program (duration=9m0s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): write-mmap$IORING_OFF_SQ_RING-socket$netlink-socket$inet6_tcp-prlimit64-openat$ublk_ctrl-syz_ublk_setup_io_uring-syz_ublk_add_dev-syz_open_dev$ublk_chdev-syz_ublk_setup_queues detailed listing: executing program 0: write(0xffffffffffffffff, &(0x7f0000000340)='0fc5:1227:', 0xa) mmap$IORING_OFF_SQ_RING(0x110c230000, 0x8000002, 0x4, 0x401d031, 0xffffffffffffffff, 0x0) socket$netlink(0x10, 0x3, 0x4) socket$inet6_tcp(0xa, 0x1, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) r0 = openat$ublk_ctrl(0xffffffffffffff9c, &(0x7f0000000000), 0x2, 0x0) r1 = syz_ublk_setup_io_uring(0x20, &(0x7f0000000080)={0x0, 0x0, 0x0, 0x1, 0x2}, &(0x7f0000000040)=0x0, &(0x7f0000000100)=0x0, &(0x7f00000002c0)=0x0) r5 = syz_ublk_add_dev(r1, r2, r3, r4, &(0x7f0000000200)={0x2e, 0xc, 0x0, r0, 0xc0207504, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', {0xffffffff, 0xffff, 0x40, &(0x7f0000000500)=@new_dev={0x3, 0x104}}}, &(0x7f0000000300)=0x0) r7 = syz_open_dev$ublk_chdev(&(0x7f0000002000), r5, 0x2) syz_ublk_setup_queues(r7, r6, &(0x7f0000000340)={0x0, 0x92d1, 0x400, 0x80000002, 0x165}, &(0x7f00000007c0)=[{0x0, 0x0, 0xffffffffffffffff, {0x0, 0x7ec5, 0x8, 0x2, 0x2f8, 0x0, r1}}, {0x0, 0x0, 0xffffffffffffffff, {0x0, 0x7dd8, 0x80, 0x1, 0x80000264, 0x0, r1}}, {0x0, 0x0, 0xffffffffffffffff, {0x0, 0xaa92, 0x8, 0x0, 0x67}}, {0x0, 0x0, 0xffffffffffffffff, {0x0, 0x97fb, 0x400, 0x1, 0x38b}}], 0x4, &(0x7f0000001a40)={0x2e, 0x10, 0x0, r7, 0xc0107520, 0x0, 0x0, 0x0, 0x0, {0x9}, 0x0, 0x0, '\x00', {0x0, 0x81c, 0x0, 0x0}}, &(0x7f0000001ac0)) program crashed: WARNING in io_ring_exit_work testing program (duration=9m0s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): write-mmap$IORING_OFF_SQ_RING-socket$netlink-prlimit64-openat$ublk_ctrl-syz_ublk_setup_io_uring-syz_ublk_add_dev-syz_open_dev$ublk_chdev-syz_ublk_setup_queues detailed listing: executing program 0: write(0xffffffffffffffff, &(0x7f0000000340)='0fc5:1227:', 0xa) mmap$IORING_OFF_SQ_RING(0x110c230000, 0x8000002, 0x4, 0x401d031, 0xffffffffffffffff, 0x0) socket$netlink(0x10, 0x3, 0x4) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) r0 = openat$ublk_ctrl(0xffffffffffffff9c, &(0x7f0000000000), 0x2, 0x0) r1 = syz_ublk_setup_io_uring(0x20, &(0x7f0000000080)={0x0, 0x0, 0x0, 0x1, 0x2}, &(0x7f0000000040)=0x0, &(0x7f0000000100)=0x0, &(0x7f00000002c0)=0x0) r5 = syz_ublk_add_dev(r1, r2, r3, r4, &(0x7f0000000200)={0x2e, 0xc, 0x0, r0, 0xc0207504, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', {0xffffffff, 0xffff, 0x40, &(0x7f0000000500)=@new_dev={0x3, 0x104}}}, &(0x7f0000000300)=0x0) r7 = syz_open_dev$ublk_chdev(&(0x7f0000002000), r5, 0x2) syz_ublk_setup_queues(r7, r6, &(0x7f0000000340)={0x0, 0x92d1, 0x400, 0x80000002, 0x165}, &(0x7f00000007c0)=[{0x0, 0x0, 0xffffffffffffffff, {0x0, 0x7ec5, 0x8, 0x2, 0x2f8, 0x0, r1}}, {0x0, 0x0, 0xffffffffffffffff, {0x0, 0x7dd8, 0x80, 0x1, 0x80000264, 0x0, r1}}, {0x0, 0x0, 0xffffffffffffffff, {0x0, 0xaa92, 0x8, 0x0, 0x67}}, {0x0, 0x0, 0xffffffffffffffff, {0x0, 0x97fb, 0x400, 0x1, 0x38b}}], 0x4, &(0x7f0000001a40)={0x2e, 0x10, 0x0, r7, 0xc0107520, 0x0, 0x0, 0x0, 0x0, {0x9}, 0x0, 0x0, '\x00', {0x0, 0x81c, 0x0, 0x0}}, &(0x7f0000001ac0)) program crashed: WARNING in io_ring_exit_work testing program (duration=9m0s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): write-mmap$IORING_OFF_SQ_RING-prlimit64-openat$ublk_ctrl-syz_ublk_setup_io_uring-syz_ublk_add_dev-syz_open_dev$ublk_chdev-syz_ublk_setup_queues detailed listing: executing program 0: write(0xffffffffffffffff, &(0x7f0000000340)='0fc5:1227:', 0xa) mmap$IORING_OFF_SQ_RING(0x110c230000, 0x8000002, 0x4, 0x401d031, 0xffffffffffffffff, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) r0 = openat$ublk_ctrl(0xffffffffffffff9c, &(0x7f0000000000), 0x2, 0x0) r1 = syz_ublk_setup_io_uring(0x20, &(0x7f0000000080)={0x0, 0x0, 0x0, 0x1, 0x2}, &(0x7f0000000040)=0x0, &(0x7f0000000100)=0x0, &(0x7f00000002c0)=0x0) r5 = syz_ublk_add_dev(r1, r2, r3, r4, &(0x7f0000000200)={0x2e, 0xc, 0x0, r0, 0xc0207504, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', {0xffffffff, 0xffff, 0x40, &(0x7f0000000500)=@new_dev={0x3, 0x104}}}, &(0x7f0000000300)=0x0) r7 = syz_open_dev$ublk_chdev(&(0x7f0000002000), r5, 0x2) syz_ublk_setup_queues(r7, r6, &(0x7f0000000340)={0x0, 0x92d1, 0x400, 0x80000002, 0x165}, &(0x7f00000007c0)=[{0x0, 0x0, 0xffffffffffffffff, {0x0, 0x7ec5, 0x8, 0x2, 0x2f8, 0x0, r1}}, {0x0, 0x0, 0xffffffffffffffff, {0x0, 0x7dd8, 0x80, 0x1, 0x80000264, 0x0, r1}}, {0x0, 0x0, 0xffffffffffffffff, {0x0, 0xaa92, 0x8, 0x0, 0x67}}, {0x0, 0x0, 0xffffffffffffffff, {0x0, 0x97fb, 0x400, 0x1, 0x38b}}], 0x4, &(0x7f0000001a40)={0x2e, 0x10, 0x0, r7, 0xc0107520, 0x0, 0x0, 0x0, 0x0, {0x9}, 0x0, 0x0, '\x00', {0x0, 0x81c, 0x0, 0x0}}, &(0x7f0000001ac0)) VM was preempted during syz execution: failed to run command in VM: instance is preempted, retrying program crashed: WARNING in io_ring_exit_work testing program (duration=9m0s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): write-prlimit64-openat$ublk_ctrl-syz_ublk_setup_io_uring-syz_ublk_add_dev-syz_open_dev$ublk_chdev-syz_ublk_setup_queues detailed listing: executing program 0: write(0xffffffffffffffff, &(0x7f0000000340)='0fc5:1227:', 0xa) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) r0 = openat$ublk_ctrl(0xffffffffffffff9c, &(0x7f0000000000), 0x2, 0x0) r1 = syz_ublk_setup_io_uring(0x20, &(0x7f0000000080)={0x0, 0x0, 0x0, 0x1, 0x2}, &(0x7f0000000040)=0x0, &(0x7f0000000100)=0x0, &(0x7f00000002c0)=0x0) r5 = syz_ublk_add_dev(r1, r2, r3, r4, &(0x7f0000000200)={0x2e, 0xc, 0x0, r0, 0xc0207504, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', {0xffffffff, 0xffff, 0x40, &(0x7f0000000500)=@new_dev={0x3, 0x104}}}, &(0x7f0000000300)=0x0) r7 = syz_open_dev$ublk_chdev(&(0x7f0000002000), r5, 0x2) syz_ublk_setup_queues(r7, r6, &(0x7f0000000340)={0x0, 0x92d1, 0x400, 0x80000002, 0x165}, &(0x7f00000007c0)=[{0x0, 0x0, 0xffffffffffffffff, {0x0, 0x7ec5, 0x8, 0x2, 0x2f8, 0x0, r1}}, {0x0, 0x0, 0xffffffffffffffff, {0x0, 0x7dd8, 0x80, 0x1, 0x80000264, 0x0, r1}}, {0x0, 0x0, 0xffffffffffffffff, {0x0, 0xaa92, 0x8, 0x0, 0x67}}, {0x0, 0x0, 0xffffffffffffffff, {0x0, 0x97fb, 0x400, 0x1, 0x38b}}], 0x4, &(0x7f0000001a40)={0x2e, 0x10, 0x0, r7, 0xc0107520, 0x0, 0x0, 0x0, 0x0, {0x9}, 0x0, 0x0, '\x00', {0x0, 0x81c, 0x0, 0x0}}, &(0x7f0000001ac0)) program crashed: WARNING in io_ring_exit_work testing program (duration=9m0s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): prlimit64-openat$ublk_ctrl-syz_ublk_setup_io_uring-syz_ublk_add_dev-syz_open_dev$ublk_chdev-syz_ublk_setup_queues detailed listing: executing program 0: prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) r0 = openat$ublk_ctrl(0xffffffffffffff9c, &(0x7f0000000000), 0x2, 0x0) r1 = syz_ublk_setup_io_uring(0x20, &(0x7f0000000080)={0x0, 0x0, 0x0, 0x1, 0x2}, &(0x7f0000000040)=0x0, &(0x7f0000000100)=0x0, &(0x7f00000002c0)=0x0) r5 = syz_ublk_add_dev(r1, r2, r3, r4, &(0x7f0000000200)={0x2e, 0xc, 0x0, r0, 0xc0207504, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', {0xffffffff, 0xffff, 0x40, &(0x7f0000000500)=@new_dev={0x3, 0x104}}}, &(0x7f0000000300)=0x0) r7 = syz_open_dev$ublk_chdev(&(0x7f0000002000), r5, 0x2) syz_ublk_setup_queues(r7, r6, &(0x7f0000000340)={0x0, 0x92d1, 0x400, 0x80000002, 0x165}, &(0x7f00000007c0)=[{0x0, 0x0, 0xffffffffffffffff, {0x0, 0x7ec5, 0x8, 0x2, 0x2f8, 0x0, r1}}, {0x0, 0x0, 0xffffffffffffffff, {0x0, 0x7dd8, 0x80, 0x1, 0x80000264, 0x0, r1}}, {0x0, 0x0, 0xffffffffffffffff, {0x0, 0xaa92, 0x8, 0x0, 0x67}}, {0x0, 0x0, 0xffffffffffffffff, {0x0, 0x97fb, 0x400, 0x1, 0x38b}}], 0x4, &(0x7f0000001a40)={0x2e, 0x10, 0x0, r7, 0xc0107520, 0x0, 0x0, 0x0, 0x0, {0x9}, 0x0, 0x0, '\x00', {0x0, 0x81c, 0x0, 0x0}}, &(0x7f0000001ac0)) program crashed: WARNING in io_ring_exit_work testing program (duration=9m0s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): prlimit64-openat$ublk_ctrl-syz_ublk_setup_io_uring-syz_ublk_add_dev-syz_open_dev$ublk_chdev-syz_ublk_setup_queues detailed listing: executing program 0: prlimit64(0x0, 0xe, 0x0, 0x0) r0 = openat$ublk_ctrl(0xffffffffffffff9c, &(0x7f0000000000), 0x2, 0x0) r1 = syz_ublk_setup_io_uring(0x20, &(0x7f0000000080)={0x0, 0x0, 0x0, 0x1, 0x2}, &(0x7f0000000040)=0x0, &(0x7f0000000100)=0x0, &(0x7f00000002c0)=0x0) r5 = syz_ublk_add_dev(r1, r2, r3, r4, &(0x7f0000000200)={0x2e, 0xc, 0x0, r0, 0xc0207504, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', {0xffffffff, 0xffff, 0x40, &(0x7f0000000500)=@new_dev={0x3, 0x104}}}, &(0x7f0000000300)=0x0) r7 = syz_open_dev$ublk_chdev(&(0x7f0000002000), r5, 0x2) syz_ublk_setup_queues(r7, r6, &(0x7f0000000340)={0x0, 0x92d1, 0x400, 0x80000002, 0x165}, &(0x7f00000007c0)=[{0x0, 0x0, 0xffffffffffffffff, {0x0, 0x7ec5, 0x8, 0x2, 0x2f8, 0x0, r1}}, {0x0, 0x0, 0xffffffffffffffff, {0x0, 0x7dd8, 0x80, 0x1, 0x80000264, 0x0, r1}}, {0x0, 0x0, 0xffffffffffffffff, {0x0, 0xaa92, 0x8, 0x0, 0x67}}, {0x0, 0x0, 0xffffffffffffffff, {0x0, 0x97fb, 0x400, 0x1, 0x38b}}], 0x4, &(0x7f0000001a40)={0x2e, 0x10, 0x0, r7, 0xc0107520, 0x0, 0x0, 0x0, 0x0, {0x9}, 0x0, 0x0, '\x00', {0x0, 0x81c, 0x0, 0x0}}, &(0x7f0000001ac0)) program crashed: WARNING in io_ring_exit_work testing program (duration=9m0s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): prlimit64-openat$ublk_ctrl-syz_ublk_setup_io_uring-syz_ublk_add_dev-syz_open_dev$ublk_chdev-syz_ublk_setup_queues detailed listing: executing program 0: prlimit64(0x0, 0xe, 0x0, 0x0) r0 = openat$ublk_ctrl(0xffffffffffffff9c, 0x0, 0x2, 0x0) r1 = syz_ublk_setup_io_uring(0x20, &(0x7f0000000080)={0x0, 0x0, 0x0, 0x1, 0x2}, &(0x7f0000000040)=0x0, &(0x7f0000000100)=0x0, &(0x7f00000002c0)=0x0) r5 = syz_ublk_add_dev(r1, r2, r3, r4, &(0x7f0000000200)={0x2e, 0xc, 0x0, r0, 0xc0207504, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', {0xffffffff, 0xffff, 0x40, &(0x7f0000000500)=@new_dev={0x3, 0x104}}}, &(0x7f0000000300)=0x0) r7 = syz_open_dev$ublk_chdev(&(0x7f0000002000), r5, 0x2) syz_ublk_setup_queues(r7, r6, &(0x7f0000000340)={0x0, 0x92d1, 0x400, 0x80000002, 0x165}, &(0x7f00000007c0)=[{0x0, 0x0, 0xffffffffffffffff, {0x0, 0x7ec5, 0x8, 0x2, 0x2f8, 0x0, r1}}, {0x0, 0x0, 0xffffffffffffffff, {0x0, 0x7dd8, 0x80, 0x1, 0x80000264, 0x0, r1}}, {0x0, 0x0, 0xffffffffffffffff, {0x0, 0xaa92, 0x8, 0x0, 0x67}}, {0x0, 0x0, 0xffffffffffffffff, {0x0, 0x97fb, 0x400, 0x1, 0x38b}}], 0x4, &(0x7f0000001a40)={0x2e, 0x10, 0x0, r7, 0xc0107520, 0x0, 0x0, 0x0, 0x0, {0x9}, 0x0, 0x0, '\x00', {0x0, 0x81c, 0x0, 0x0}}, &(0x7f0000001ac0)) program crashed: lost connection to test machine suppressed program crash: lost connection to test machine testing program (duration=9m0s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): prlimit64-openat$ublk_ctrl-syz_ublk_setup_io_uring-syz_ublk_add_dev-syz_open_dev$ublk_chdev-syz_ublk_setup_queues detailed listing: executing program 0: prlimit64(0x0, 0xe, 0x0, 0x0) r0 = openat$ublk_ctrl(0xffffffffffffff9c, &(0x7f0000000000), 0x2, 0x0) r1 = syz_ublk_setup_io_uring(0x20, 0x0, &(0x7f0000000040)=0x0, &(0x7f0000000100)=0x0, &(0x7f00000002c0)=0x0) r5 = syz_ublk_add_dev(r1, r2, r3, r4, &(0x7f0000000200)={0x2e, 0xc, 0x0, r0, 0xc0207504, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', {0xffffffff, 0xffff, 0x40, &(0x7f0000000500)=@new_dev={0x3, 0x104}}}, &(0x7f0000000300)=0x0) r7 = syz_open_dev$ublk_chdev(&(0x7f0000002000), r5, 0x2) syz_ublk_setup_queues(r7, r6, &(0x7f0000000340)={0x0, 0x92d1, 0x400, 0x80000002, 0x165}, &(0x7f00000007c0)=[{0x0, 0x0, 0xffffffffffffffff, {0x0, 0x7ec5, 0x8, 0x2, 0x2f8, 0x0, r1}}, {0x0, 0x0, 0xffffffffffffffff, {0x0, 0x7dd8, 0x80, 0x1, 0x80000264, 0x0, r1}}, {0x0, 0x0, 0xffffffffffffffff, {0x0, 0xaa92, 0x8, 0x0, 0x67}}, {0x0, 0x0, 0xffffffffffffffff, {0x0, 0x97fb, 0x400, 0x1, 0x38b}}], 0x4, &(0x7f0000001a40)={0x2e, 0x10, 0x0, r7, 0xc0107520, 0x0, 0x0, 0x0, 0x0, {0x9}, 0x0, 0x0, '\x00', {0x0, 0x81c, 0x0, 0x0}}, &(0x7f0000001ac0)) program did not crash testing program (duration=9m0s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): prlimit64-openat$ublk_ctrl-syz_ublk_setup_io_uring-syz_ublk_add_dev-syz_open_dev$ublk_chdev-syz_ublk_setup_queues detailed listing: executing program 0: prlimit64(0x0, 0xe, 0x0, 0x0) r0 = openat$ublk_ctrl(0xffffffffffffff9c, &(0x7f0000000000), 0x2, 0x0) r1 = syz_ublk_setup_io_uring(0x20, &(0x7f0000000080)={0x0, 0x0, 0x0, 0x1, 0x2}, 0x0, &(0x7f0000000100)=0x0, &(0x7f00000002c0)=0x0) r4 = syz_ublk_add_dev(r1, 0x0, r2, r3, &(0x7f0000000200)={0x2e, 0xc, 0x0, r0, 0xc0207504, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', {0xffffffff, 0xffff, 0x40, &(0x7f0000000500)=@new_dev={0x3, 0x104}}}, &(0x7f0000000300)=0x0) r6 = syz_open_dev$ublk_chdev(&(0x7f0000002000), r4, 0x2) syz_ublk_setup_queues(r6, r5, &(0x7f0000000340)={0x0, 0x92d1, 0x400, 0x80000002, 0x165}, &(0x7f00000007c0)=[{0x0, 0x0, 0xffffffffffffffff, {0x0, 0x7ec5, 0x8, 0x2, 0x2f8, 0x0, r1}}, {0x0, 0x0, 0xffffffffffffffff, {0x0, 0x7dd8, 0x80, 0x1, 0x80000264, 0x0, r1}}, {0x0, 0x0, 0xffffffffffffffff, {0x0, 0xaa92, 0x8, 0x0, 0x67}}, {0x0, 0x0, 0xffffffffffffffff, {0x0, 0x97fb, 0x400, 0x1, 0x38b}}], 0x4, &(0x7f0000001a40)={0x2e, 0x10, 0x0, r6, 0xc0107520, 0x0, 0x0, 0x0, 0x0, {0x9}, 0x0, 0x0, '\x00', {0x0, 0x81c, 0x0, 0x0}}, &(0x7f0000001ac0)) program did not crash testing program (duration=9m0s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): prlimit64-openat$ublk_ctrl-syz_ublk_setup_io_uring-syz_ublk_add_dev-syz_open_dev$ublk_chdev-syz_ublk_setup_queues detailed listing: executing program 0: prlimit64(0x0, 0xe, 0x0, 0x0) r0 = openat$ublk_ctrl(0xffffffffffffff9c, &(0x7f0000000000), 0x2, 0x0) r1 = syz_ublk_setup_io_uring(0x20, &(0x7f0000000080)={0x0, 0x0, 0x0, 0x1, 0x2}, &(0x7f0000000040)=0x0, 0x0, &(0x7f00000002c0)=0x0) r4 = syz_ublk_add_dev(r1, r2, 0x0, r3, &(0x7f0000000200)={0x2e, 0xc, 0x0, r0, 0xc0207504, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', {0xffffffff, 0xffff, 0x40, &(0x7f0000000500)=@new_dev={0x3, 0x104}}}, &(0x7f0000000300)=0x0) r6 = syz_open_dev$ublk_chdev(&(0x7f0000002000), r4, 0x2) syz_ublk_setup_queues(r6, r5, &(0x7f0000000340)={0x0, 0x92d1, 0x400, 0x80000002, 0x165}, &(0x7f00000007c0)=[{0x0, 0x0, 0xffffffffffffffff, {0x0, 0x7ec5, 0x8, 0x2, 0x2f8, 0x0, r1}}, {0x0, 0x0, 0xffffffffffffffff, {0x0, 0x7dd8, 0x80, 0x1, 0x80000264, 0x0, r1}}, {0x0, 0x0, 0xffffffffffffffff, {0x0, 0xaa92, 0x8, 0x0, 0x67}}, {0x0, 0x0, 0xffffffffffffffff, {0x0, 0x97fb, 0x400, 0x1, 0x38b}}], 0x4, &(0x7f0000001a40)={0x2e, 0x10, 0x0, r6, 0xc0107520, 0x0, 0x0, 0x0, 0x0, {0x9}, 0x0, 0x0, '\x00', {0x0, 0x81c, 0x0, 0x0}}, &(0x7f0000001ac0)) program did not crash testing program (duration=9m0s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): prlimit64-openat$ublk_ctrl-syz_ublk_setup_io_uring-syz_ublk_add_dev-syz_open_dev$ublk_chdev-syz_ublk_setup_queues detailed listing: executing program 0: prlimit64(0x0, 0xe, 0x0, 0x0) r0 = openat$ublk_ctrl(0xffffffffffffff9c, &(0x7f0000000000), 0x2, 0x0) r1 = syz_ublk_setup_io_uring(0x20, &(0x7f0000000080)={0x0, 0x0, 0x0, 0x1, 0x2}, &(0x7f0000000040)=0x0, &(0x7f0000000100)=0x0, 0x0) r4 = syz_ublk_add_dev(r1, r2, r3, 0x0, &(0x7f0000000200)={0x2e, 0xc, 0x0, r0, 0xc0207504, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', {0xffffffff, 0xffff, 0x40, &(0x7f0000000500)=@new_dev={0x3, 0x104}}}, &(0x7f0000000300)=0x0) r6 = syz_open_dev$ublk_chdev(&(0x7f0000002000), r4, 0x2) syz_ublk_setup_queues(r6, r5, &(0x7f0000000340)={0x0, 0x92d1, 0x400, 0x80000002, 0x165}, &(0x7f00000007c0)=[{0x0, 0x0, 0xffffffffffffffff, {0x0, 0x7ec5, 0x8, 0x2, 0x2f8, 0x0, r1}}, {0x0, 0x0, 0xffffffffffffffff, {0x0, 0x7dd8, 0x80, 0x1, 0x80000264, 0x0, r1}}, {0x0, 0x0, 0xffffffffffffffff, {0x0, 0xaa92, 0x8, 0x0, 0x67}}, {0x0, 0x0, 0xffffffffffffffff, {0x0, 0x97fb, 0x400, 0x1, 0x38b}}], 0x4, &(0x7f0000001a40)={0x2e, 0x10, 0x0, r6, 0xc0107520, 0x0, 0x0, 0x0, 0x0, {0x9}, 0x0, 0x0, '\x00', {0x0, 0x81c, 0x0, 0x0}}, &(0x7f0000001ac0)) program did not crash testing program (duration=9m0s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): prlimit64-openat$ublk_ctrl-syz_ublk_setup_io_uring-syz_ublk_add_dev-syz_open_dev$ublk_chdev-syz_ublk_setup_queues detailed listing: executing program 0: prlimit64(0x0, 0xe, 0x0, 0x0) openat$ublk_ctrl(0xffffffffffffff9c, &(0x7f0000000000), 0x2, 0x0) r0 = syz_ublk_setup_io_uring(0x20, &(0x7f0000000080)={0x0, 0x0, 0x0, 0x1, 0x2}, &(0x7f0000000040)=0x0, &(0x7f0000000100)=0x0, &(0x7f00000002c0)=0x0) r4 = syz_ublk_add_dev(r0, r1, r2, r3, 0x0, &(0x7f0000000300)=0x0) r6 = syz_open_dev$ublk_chdev(&(0x7f0000002000), r4, 0x2) syz_ublk_setup_queues(r6, r5, &(0x7f0000000340)={0x0, 0x92d1, 0x400, 0x80000002, 0x165}, &(0x7f00000007c0)=[{0x0, 0x0, 0xffffffffffffffff, {0x0, 0x7ec5, 0x8, 0x2, 0x2f8, 0x0, r0}}, {0x0, 0x0, 0xffffffffffffffff, {0x0, 0x7dd8, 0x80, 0x1, 0x80000264, 0x0, r0}}, {0x0, 0x0, 0xffffffffffffffff, {0x0, 0xaa92, 0x8, 0x0, 0x67}}, {0x0, 0x0, 0xffffffffffffffff, {0x0, 0x97fb, 0x400, 0x1, 0x38b}}], 0x4, &(0x7f0000001a40)={0x2e, 0x10, 0x0, r6, 0xc0107520, 0x0, 0x0, 0x0, 0x0, {0x9}, 0x0, 0x0, '\x00', {0x0, 0x81c, 0x0, 0x0}}, &(0x7f0000001ac0)) program did not crash testing program (duration=9m0s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): prlimit64-openat$ublk_ctrl-syz_ublk_setup_io_uring-syz_ublk_add_dev-syz_open_dev$ublk_chdev-syz_ublk_setup_queues detailed listing: executing program 0: prlimit64(0x0, 0xe, 0x0, 0x0) r0 = openat$ublk_ctrl(0xffffffffffffff9c, &(0x7f0000000000), 0x2, 0x0) r1 = syz_ublk_setup_io_uring(0x20, &(0x7f0000000080)={0x0, 0x0, 0x0, 0x1, 0x2}, &(0x7f0000000040)=0x0, &(0x7f0000000100)=0x0, &(0x7f00000002c0)=0x0) r5 = syz_ublk_add_dev(r1, r2, r3, r4, &(0x7f0000000200)={0x2e, 0xc, 0x0, r0, 0xc0207504, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', {0xffffffff, 0xffff, 0x0, 0x0}}, &(0x7f0000000300)=0x0) r7 = syz_open_dev$ublk_chdev(&(0x7f0000002000), r5, 0x2) syz_ublk_setup_queues(r7, r6, &(0x7f0000000340)={0x0, 0x92d1, 0x400, 0x80000002, 0x165}, &(0x7f00000007c0)=[{0x0, 0x0, 0xffffffffffffffff, {0x0, 0x7ec5, 0x8, 0x2, 0x2f8, 0x0, r1}}, {0x0, 0x0, 0xffffffffffffffff, {0x0, 0x7dd8, 0x80, 0x1, 0x80000264, 0x0, r1}}, {0x0, 0x0, 0xffffffffffffffff, {0x0, 0xaa92, 0x8, 0x0, 0x67}}, {0x0, 0x0, 0xffffffffffffffff, {0x0, 0x97fb, 0x400, 0x1, 0x38b}}], 0x4, &(0x7f0000001a40)={0x2e, 0x10, 0x0, r7, 0xc0107520, 0x0, 0x0, 0x0, 0x0, {0x9}, 0x0, 0x0, '\x00', {0x0, 0x81c, 0x0, 0x0}}, &(0x7f0000001ac0)) program did not crash testing program (duration=9m0s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): prlimit64-openat$ublk_ctrl-syz_ublk_setup_io_uring-syz_ublk_add_dev-syz_open_dev$ublk_chdev-syz_ublk_setup_queues detailed listing: executing program 0: prlimit64(0x0, 0xe, 0x0, 0x0) r0 = openat$ublk_ctrl(0xffffffffffffff9c, &(0x7f0000000000), 0x2, 0x0) r1 = syz_ublk_setup_io_uring(0x20, &(0x7f0000000080)={0x0, 0x0, 0x0, 0x1, 0x2}, &(0x7f0000000040)=0x0, &(0x7f0000000100)=0x0, &(0x7f00000002c0)=0x0) r5 = syz_ublk_add_dev(r1, r2, r3, r4, &(0x7f0000000200)={0x2e, 0xc, 0x0, r0, 0xc0207504, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', {0xffffffff, 0xffff, 0x40, &(0x7f0000000500)=@new_dev={0x3, 0x104}}}, 0x0) r6 = syz_open_dev$ublk_chdev(&(0x7f0000002000), r5, 0x2) syz_ublk_setup_queues(r6, 0x0, &(0x7f0000000340)={0x0, 0x92d1, 0x400, 0x80000002, 0x165}, &(0x7f00000007c0)=[{0x0, 0x0, 0xffffffffffffffff, {0x0, 0x7ec5, 0x8, 0x2, 0x2f8, 0x0, r1}}, {0x0, 0x0, 0xffffffffffffffff, {0x0, 0x7dd8, 0x80, 0x1, 0x80000264, 0x0, r1}}, {0x0, 0x0, 0xffffffffffffffff, {0x0, 0xaa92, 0x8, 0x0, 0x67}}, {0x0, 0x0, 0xffffffffffffffff, {0x0, 0x97fb, 0x400, 0x1, 0x38b}}], 0x4, &(0x7f0000001a40)={0x2e, 0x10, 0x0, r6, 0xc0107520, 0x0, 0x0, 0x0, 0x0, {0x9}, 0x0, 0x0, '\x00', {0x0, 0x81c, 0x0, 0x0}}, &(0x7f0000001ac0)) program crashed: lost connection to test machine suppressed program crash: lost connection to test machine testing program (duration=9m0s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): prlimit64-openat$ublk_ctrl-syz_ublk_setup_io_uring-syz_ublk_add_dev-syz_open_dev$ublk_chdev-syz_ublk_setup_queues detailed listing: executing program 0: prlimit64(0x0, 0xe, 0x0, 0x0) r0 = openat$ublk_ctrl(0xffffffffffffff9c, &(0x7f0000000000), 0x2, 0x0) r1 = syz_ublk_setup_io_uring(0x20, &(0x7f0000000080)={0x0, 0x0, 0x0, 0x1, 0x2}, &(0x7f0000000040)=0x0, &(0x7f0000000100)=0x0, &(0x7f00000002c0)=0x0) r5 = syz_ublk_add_dev(r1, r2, r3, r4, &(0x7f0000000200)={0x2e, 0xc, 0x0, r0, 0xc0207504, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', {0xffffffff, 0xffff, 0x40, &(0x7f0000000500)=@new_dev={0x3, 0x104}}}, &(0x7f0000000300)=0x0) r7 = syz_open_dev$ublk_chdev(0x0, r5, 0x2) syz_ublk_setup_queues(r7, r6, &(0x7f0000000340)={0x0, 0x92d1, 0x400, 0x80000002, 0x165}, &(0x7f00000007c0)=[{0x0, 0x0, 0xffffffffffffffff, {0x0, 0x7ec5, 0x8, 0x2, 0x2f8, 0x0, r1}}, {0x0, 0x0, 0xffffffffffffffff, {0x0, 0x7dd8, 0x80, 0x1, 0x80000264, 0x0, r1}}, {0x0, 0x0, 0xffffffffffffffff, {0x0, 0xaa92, 0x8, 0x0, 0x67}}, {0x0, 0x0, 0xffffffffffffffff, {0x0, 0x97fb, 0x400, 0x1, 0x38b}}], 0x4, &(0x7f0000001a40)={0x2e, 0x10, 0x0, r7, 0xc0107520, 0x0, 0x0, 0x0, 0x0, {0x9}, 0x0, 0x0, '\x00', {0x0, 0x81c, 0x0, 0x0}}, &(0x7f0000001ac0)) VM was preempted during syz execution: failed to run command in VM: instance is preempted, retrying program did not crash testing program (duration=9m0s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): prlimit64-openat$ublk_ctrl-syz_ublk_setup_io_uring-syz_ublk_add_dev-syz_open_dev$ublk_chdev-syz_ublk_setup_queues detailed listing: executing program 0: prlimit64(0x0, 0xe, 0x0, 0x0) r0 = openat$ublk_ctrl(0xffffffffffffff9c, &(0x7f0000000000), 0x2, 0x0) r1 = syz_ublk_setup_io_uring(0x20, &(0x7f0000000080)={0x0, 0x0, 0x0, 0x1, 0x2}, &(0x7f0000000040)=0x0, &(0x7f0000000100)=0x0, &(0x7f00000002c0)=0x0) r5 = syz_ublk_add_dev(r1, r2, r3, r4, &(0x7f0000000200)={0x2e, 0xc, 0x0, r0, 0xc0207504, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', {0xffffffff, 0xffff, 0x40, &(0x7f0000000500)=@new_dev={0x3, 0x104}}}, &(0x7f0000000300)=0x0) r7 = syz_open_dev$ublk_chdev(&(0x7f0000002000), r5, 0x2) syz_ublk_setup_queues(r7, r6, 0x0, &(0x7f00000007c0)=[{0x0, 0x0, 0xffffffffffffffff, {0x0, 0x7ec5, 0x8, 0x2, 0x2f8, 0x0, r1}}, {0x0, 0x0, 0xffffffffffffffff, {0x0, 0x7dd8, 0x80, 0x1, 0x80000264, 0x0, r1}}, {0x0, 0x0, 0xffffffffffffffff, {0x0, 0xaa92, 0x8, 0x0, 0x67}}, {0x0, 0x0, 0xffffffffffffffff, {0x0, 0x97fb, 0x400, 0x1, 0x38b}}], 0x4, &(0x7f0000001a40)={0x2e, 0x10, 0x0, r7, 0xc0107520, 0x0, 0x0, 0x0, 0x0, {0x9}, 0x0, 0x0, '\x00', {0x0, 0x81c, 0x0, 0x0}}, &(0x7f0000001ac0)) program did not crash testing program (duration=9m0s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): prlimit64-openat$ublk_ctrl-syz_ublk_setup_io_uring-syz_ublk_add_dev-syz_open_dev$ublk_chdev-syz_ublk_setup_queues detailed listing: executing program 0: prlimit64(0x0, 0xe, 0x0, 0x0) r0 = openat$ublk_ctrl(0xffffffffffffff9c, &(0x7f0000000000), 0x2, 0x0) r1 = syz_ublk_setup_io_uring(0x20, &(0x7f0000000080)={0x0, 0x0, 0x0, 0x1, 0x2}, &(0x7f0000000040)=0x0, &(0x7f0000000100)=0x0, &(0x7f00000002c0)=0x0) r5 = syz_ublk_add_dev(r1, r2, r3, r4, &(0x7f0000000200)={0x2e, 0xc, 0x0, r0, 0xc0207504, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', {0xffffffff, 0xffff, 0x40, &(0x7f0000000500)=@new_dev={0x3, 0x104}}}, &(0x7f0000000300)=0x0) r7 = syz_open_dev$ublk_chdev(&(0x7f0000002000), r5, 0x2) syz_ublk_setup_queues(r7, r6, &(0x7f0000000340)={0x0, 0x92d1, 0x400, 0x80000002, 0x165}, 0x0, 0x4, &(0x7f0000001a40)={0x2e, 0x10, 0x0, r7, 0xc0107520, 0x0, 0x0, 0x0, 0x0, {0x9}, 0x0, 0x0, '\x00', {0x0, 0x81c, 0x0, 0x0}}, &(0x7f0000001ac0)) program crashed: lost connection to test machine suppressed program crash: lost connection to test machine testing program (duration=9m0s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): prlimit64-openat$ublk_ctrl-syz_ublk_setup_io_uring-syz_ublk_add_dev-syz_open_dev$ublk_chdev-syz_ublk_setup_queues detailed listing: executing program 0: prlimit64(0x0, 0xe, 0x0, 0x0) r0 = openat$ublk_ctrl(0xffffffffffffff9c, &(0x7f0000000000), 0x2, 0x0) r1 = syz_ublk_setup_io_uring(0x20, &(0x7f0000000080)={0x0, 0x0, 0x0, 0x1, 0x2}, &(0x7f0000000040)=0x0, &(0x7f0000000100)=0x0, &(0x7f00000002c0)=0x0) r5 = syz_ublk_add_dev(r1, r2, r3, r4, &(0x7f0000000200)={0x2e, 0xc, 0x0, r0, 0xc0207504, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', {0xffffffff, 0xffff, 0x40, &(0x7f0000000500)=@new_dev={0x3, 0x104}}}, &(0x7f0000000300)=0x0) r7 = syz_open_dev$ublk_chdev(&(0x7f0000002000), r5, 0x2) syz_ublk_setup_queues(r7, r6, &(0x7f0000000340)={0x0, 0x92d1, 0x400, 0x80000002, 0x165}, &(0x7f00000007c0)=[{0x0, 0x0, 0xffffffffffffffff, {0x0, 0x7ec5, 0x8, 0x2, 0x2f8, 0x0, r1}}, {0x0, 0x0, 0xffffffffffffffff, {0x0, 0x7dd8, 0x80, 0x1, 0x80000264, 0x0, r1}}, {0x0, 0x0, 0xffffffffffffffff, {0x0, 0xaa92, 0x8, 0x0, 0x67}}, {0x0, 0x0, 0xffffffffffffffff, {0x0, 0x97fb, 0x400, 0x1, 0x38b}}], 0x4, 0x0, &(0x7f0000001ac0)) program did not crash testing program (duration=9m0s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): prlimit64-openat$ublk_ctrl-syz_ublk_setup_io_uring-syz_ublk_add_dev-syz_open_dev$ublk_chdev-syz_ublk_setup_queues detailed listing: executing program 0: prlimit64(0x0, 0xe, 0x0, 0x0) r0 = openat$ublk_ctrl(0xffffffffffffff9c, &(0x7f0000000000), 0x2, 0x0) r1 = syz_ublk_setup_io_uring(0x20, &(0x7f0000000080)={0x0, 0x0, 0x0, 0x1, 0x2}, &(0x7f0000000040)=0x0, &(0x7f0000000100)=0x0, &(0x7f00000002c0)=0x0) r5 = syz_ublk_add_dev(r1, r2, r3, r4, &(0x7f0000000200)={0x2e, 0xc, 0x0, r0, 0xc0207504, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', {0xffffffff, 0xffff, 0x40, &(0x7f0000000500)=@new_dev={0x3, 0x104}}}, &(0x7f0000000300)=0x0) r7 = syz_open_dev$ublk_chdev(&(0x7f0000002000), r5, 0x2) syz_ublk_setup_queues(r7, r6, &(0x7f0000000340)={0x0, 0x92d1, 0x400, 0x80000002, 0x165}, &(0x7f00000007c0)=[{0x0, 0x0, 0xffffffffffffffff, {0x0, 0x7ec5, 0x8, 0x2, 0x2f8, 0x0, r1}}, {0x0, 0x0, 0xffffffffffffffff, {0x0, 0x7dd8, 0x80, 0x1, 0x80000264, 0x0, r1}}, {0x0, 0x0, 0xffffffffffffffff, {0x0, 0xaa92, 0x8, 0x0, 0x67}}, {0x0, 0x0, 0xffffffffffffffff, {0x0, 0x97fb, 0x400, 0x1, 0x38b}}], 0x4, &(0x7f0000001a40)={0x2e, 0x10, 0x0, r7, 0xc0107520, 0x0, 0x0, 0x0, 0x0, {0x9}, 0x0, 0x0, '\x00', {0x0, 0x81c, 0x0, 0x0}}, 0x0) program crashed: WARNING in io_ring_exit_work extracting C reproducer testing compiled C program (duration=9m0s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): prlimit64-openat$ublk_ctrl-syz_ublk_setup_io_uring-syz_ublk_add_dev-syz_open_dev$ublk_chdev-syz_ublk_setup_queues program crashed: no output from test machine a never seen crash title: no output from test machine, ignore simplifying guilty program options testing program (duration=9m0s, {Threaded:false Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): prlimit64-openat$ublk_ctrl-syz_ublk_setup_io_uring-syz_ublk_add_dev-syz_open_dev$ublk_chdev-syz_ublk_setup_queues detailed listing: executing program 0: prlimit64(0x0, 0xe, 0x0, 0x0) r0 = openat$ublk_ctrl(0xffffffffffffff9c, &(0x7f0000000000), 0x2, 0x0) r1 = syz_ublk_setup_io_uring(0x20, &(0x7f0000000080)={0x0, 0x0, 0x0, 0x1, 0x2}, &(0x7f0000000040)=0x0, &(0x7f0000000100)=0x0, &(0x7f00000002c0)=0x0) r5 = syz_ublk_add_dev(r1, r2, r3, r4, &(0x7f0000000200)={0x2e, 0xc, 0x0, r0, 0xc0207504, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', {0xffffffff, 0xffff, 0x40, &(0x7f0000000500)=@new_dev={0x3, 0x104}}}, &(0x7f0000000300)=0x0) r7 = syz_open_dev$ublk_chdev(&(0x7f0000002000), r5, 0x2) syz_ublk_setup_queues(r7, r6, &(0x7f0000000340)={0x0, 0x92d1, 0x400, 0x80000002, 0x165}, &(0x7f00000007c0)=[{0x0, 0x0, 0xffffffffffffffff, {0x0, 0x7ec5, 0x8, 0x2, 0x2f8, 0x0, r1}}, {0x0, 0x0, 0xffffffffffffffff, {0x0, 0x7dd8, 0x80, 0x1, 0x80000264, 0x0, r1}}, {0x0, 0x0, 0xffffffffffffffff, {0x0, 0xaa92, 0x8, 0x0, 0x67}}, {0x0, 0x0, 0xffffffffffffffff, {0x0, 0x97fb, 0x400, 0x1, 0x38b}}], 0x4, &(0x7f0000001a40)={0x2e, 0x10, 0x0, r7, 0xc0107520, 0x0, 0x0, 0x0, 0x0, {0x9}, 0x0, 0x0, '\x00', {0x0, 0x81c, 0x0, 0x0}}, 0x0) program crashed: WARNING in io_ring_exit_work extracting C reproducer testing compiled C program (duration=9m0s, {Threaded:false Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): prlimit64-openat$ublk_ctrl-syz_ublk_setup_io_uring-syz_ublk_add_dev-syz_open_dev$ublk_chdev-syz_ublk_setup_queues program crashed: no output from test machine a never seen crash title: no output from test machine, ignore testing program (duration=9m0s, {Threaded:false Repeat:true RepeatTimes:0 Procs:1 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): prlimit64-openat$ublk_ctrl-syz_ublk_setup_io_uring-syz_ublk_add_dev-syz_open_dev$ublk_chdev-syz_ublk_setup_queues detailed listing: executing program 0: prlimit64(0x0, 0xe, 0x0, 0x0) r0 = openat$ublk_ctrl(0xffffffffffffff9c, &(0x7f0000000000), 0x2, 0x0) r1 = syz_ublk_setup_io_uring(0x20, &(0x7f0000000080)={0x0, 0x0, 0x0, 0x1, 0x2}, &(0x7f0000000040)=0x0, &(0x7f0000000100)=0x0, &(0x7f00000002c0)=0x0) r5 = syz_ublk_add_dev(r1, r2, r3, r4, &(0x7f0000000200)={0x2e, 0xc, 0x0, r0, 0xc0207504, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', {0xffffffff, 0xffff, 0x40, &(0x7f0000000500)=@new_dev={0x3, 0x104}}}, &(0x7f0000000300)=0x0) r7 = syz_open_dev$ublk_chdev(&(0x7f0000002000), r5, 0x2) syz_ublk_setup_queues(r7, r6, &(0x7f0000000340)={0x0, 0x92d1, 0x400, 0x80000002, 0x165}, &(0x7f00000007c0)=[{0x0, 0x0, 0xffffffffffffffff, {0x0, 0x7ec5, 0x8, 0x2, 0x2f8, 0x0, r1}}, {0x0, 0x0, 0xffffffffffffffff, {0x0, 0x7dd8, 0x80, 0x1, 0x80000264, 0x0, r1}}, {0x0, 0x0, 0xffffffffffffffff, {0x0, 0xaa92, 0x8, 0x0, 0x67}}, {0x0, 0x0, 0xffffffffffffffff, {0x0, 0x97fb, 0x400, 0x1, 0x38b}}], 0x4, &(0x7f0000001a40)={0x2e, 0x10, 0x0, r7, 0xc0107520, 0x0, 0x0, 0x0, 0x0, {0x9}, 0x0, 0x0, '\x00', {0x0, 0x81c, 0x0, 0x0}}, 0x0) program crashed: WARNING in io_ring_exit_work extracting C reproducer testing compiled C program (duration=9m0s, {Threaded:false Repeat:true RepeatTimes:0 Procs:1 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): prlimit64-openat$ublk_ctrl-syz_ublk_setup_io_uring-syz_ublk_add_dev-syz_open_dev$ublk_chdev-syz_ublk_setup_queues program crashed: no output from test machine a never seen crash title: no output from test machine, ignore testing program (duration=9m0s, {Threaded:false Repeat:true RepeatTimes:0 Procs:1 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): prlimit64-openat$ublk_ctrl-syz_ublk_setup_io_uring-syz_ublk_add_dev-syz_open_dev$ublk_chdev-syz_ublk_setup_queues detailed listing: executing program 0: prlimit64(0x0, 0xe, 0x0, 0x0) r0 = openat$ublk_ctrl(0xffffffffffffff9c, &(0x7f0000000000), 0x2, 0x0) r1 = syz_ublk_setup_io_uring(0x20, &(0x7f0000000080)={0x0, 0x0, 0x0, 0x1, 0x2}, &(0x7f0000000040)=0x0, &(0x7f0000000100)=0x0, &(0x7f00000002c0)=0x0) r5 = syz_ublk_add_dev(r1, r2, r3, r4, &(0x7f0000000200)={0x2e, 0xc, 0x0, r0, 0xc0207504, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', {0xffffffff, 0xffff, 0x40, &(0x7f0000000500)=@new_dev={0x3, 0x104}}}, &(0x7f0000000300)=0x0) r7 = syz_open_dev$ublk_chdev(&(0x7f0000002000), r5, 0x2) syz_ublk_setup_queues(r7, r6, &(0x7f0000000340)={0x0, 0x92d1, 0x400, 0x80000002, 0x165}, &(0x7f00000007c0)=[{0x0, 0x0, 0xffffffffffffffff, {0x0, 0x7ec5, 0x8, 0x2, 0x2f8, 0x0, r1}}, {0x0, 0x0, 0xffffffffffffffff, {0x0, 0x7dd8, 0x80, 0x1, 0x80000264, 0x0, r1}}, {0x0, 0x0, 0xffffffffffffffff, {0x0, 0xaa92, 0x8, 0x0, 0x67}}, {0x0, 0x0, 0xffffffffffffffff, {0x0, 0x97fb, 0x400, 0x1, 0x38b}}], 0x4, &(0x7f0000001a40)={0x2e, 0x10, 0x0, r7, 0xc0107520, 0x0, 0x0, 0x0, 0x0, {0x9}, 0x0, 0x0, '\x00', {0x0, 0x81c, 0x0, 0x0}}, 0x0) program crashed: WARNING in io_ring_exit_work validation run: crashed=true testing program (duration=9m0s, {Threaded:false Repeat:true RepeatTimes:0 Procs:1 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): prlimit64-openat$ublk_ctrl-syz_ublk_setup_io_uring-syz_ublk_add_dev-syz_open_dev$ublk_chdev-syz_ublk_setup_queues detailed listing: executing program 0: prlimit64(0x0, 0xe, 0x0, 0x0) r0 = openat$ublk_ctrl(0xffffffffffffff9c, &(0x7f0000000000), 0x2, 0x0) r1 = syz_ublk_setup_io_uring(0x20, &(0x7f0000000080)={0x0, 0x0, 0x0, 0x1, 0x2}, &(0x7f0000000040)=0x0, &(0x7f0000000100)=0x0, &(0x7f00000002c0)=0x0) r5 = syz_ublk_add_dev(r1, r2, r3, r4, &(0x7f0000000200)={0x2e, 0xc, 0x0, r0, 0xc0207504, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', {0xffffffff, 0xffff, 0x40, &(0x7f0000000500)=@new_dev={0x3, 0x104}}}, &(0x7f0000000300)=0x0) r7 = syz_open_dev$ublk_chdev(&(0x7f0000002000), r5, 0x2) syz_ublk_setup_queues(r7, r6, &(0x7f0000000340)={0x0, 0x92d1, 0x400, 0x80000002, 0x165}, &(0x7f00000007c0)=[{0x0, 0x0, 0xffffffffffffffff, {0x0, 0x7ec5, 0x8, 0x2, 0x2f8, 0x0, r1}}, {0x0, 0x0, 0xffffffffffffffff, {0x0, 0x7dd8, 0x80, 0x1, 0x80000264, 0x0, r1}}, {0x0, 0x0, 0xffffffffffffffff, {0x0, 0xaa92, 0x8, 0x0, 0x67}}, {0x0, 0x0, 0xffffffffffffffff, {0x0, 0x97fb, 0x400, 0x1, 0x38b}}], 0x4, &(0x7f0000001a40)={0x2e, 0x10, 0x0, r7, 0xc0107520, 0x0, 0x0, 0x0, 0x0, {0x9}, 0x0, 0x0, '\x00', {0x0, 0x81c, 0x0, 0x0}}, 0x0) program crashed: WARNING in io_ring_exit_work validation run: crashed=true testing program (duration=9m0s, {Threaded:false Repeat:true RepeatTimes:0 Procs:1 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): prlimit64-openat$ublk_ctrl-syz_ublk_setup_io_uring-syz_ublk_add_dev-syz_open_dev$ublk_chdev-syz_ublk_setup_queues detailed listing: executing program 0: prlimit64(0x0, 0xe, 0x0, 0x0) r0 = openat$ublk_ctrl(0xffffffffffffff9c, &(0x7f0000000000), 0x2, 0x0) r1 = syz_ublk_setup_io_uring(0x20, &(0x7f0000000080)={0x0, 0x0, 0x0, 0x1, 0x2}, &(0x7f0000000040)=0x0, &(0x7f0000000100)=0x0, &(0x7f00000002c0)=0x0) r5 = syz_ublk_add_dev(r1, r2, r3, r4, &(0x7f0000000200)={0x2e, 0xc, 0x0, r0, 0xc0207504, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', {0xffffffff, 0xffff, 0x40, &(0x7f0000000500)=@new_dev={0x3, 0x104}}}, &(0x7f0000000300)=0x0) r7 = syz_open_dev$ublk_chdev(&(0x7f0000002000), r5, 0x2) syz_ublk_setup_queues(r7, r6, &(0x7f0000000340)={0x0, 0x92d1, 0x400, 0x80000002, 0x165}, &(0x7f00000007c0)=[{0x0, 0x0, 0xffffffffffffffff, {0x0, 0x7ec5, 0x8, 0x2, 0x2f8, 0x0, r1}}, {0x0, 0x0, 0xffffffffffffffff, {0x0, 0x7dd8, 0x80, 0x1, 0x80000264, 0x0, r1}}, {0x0, 0x0, 0xffffffffffffffff, {0x0, 0xaa92, 0x8, 0x0, 0x67}}, {0x0, 0x0, 0xffffffffffffffff, {0x0, 0x97fb, 0x400, 0x1, 0x38b}}], 0x4, &(0x7f0000001a40)={0x2e, 0x10, 0x0, r7, 0xc0107520, 0x0, 0x0, 0x0, 0x0, {0x9}, 0x0, 0x0, '\x00', {0x0, 0x81c, 0x0, 0x0}}, 0x0) program crashed: WARNING in io_ring_exit_work validation run: crashed=true reproducing took 8h21m55.937994755s repro crashed as (corrupted=false): ------------[ cut here ]------------ WARNING: CPU: 0 PID: 1138 at io_uring/io_uring.c:3214 io_ring_exit_work+0x3b9/0x830 io_uring/io_uring.c:3214 Modules linked in: CPU: 0 PID: 1138 Comm: kworker/u4:7 Not tainted syzkaller #0 Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 Workqueue: iou_exit io_ring_exit_work RIP: 0010:io_ring_exit_work+0x3b9/0x830 io_uring/io_uring.c:3214 Code: fd 48 8b 7c 24 40 48 8b 74 24 10 e8 31 02 11 00 48 85 c0 41 bf 00 20 00 00 75 1d e8 e1 c9 fe f6 e9 b1 fd ff ff e8 d7 c9 fe f6 <0f> 0b b8 70 17 00 00 48 89 44 24 10 eb c1 c7 84 24 90 00 00 00 00 RSP: 0000:ffffc900046c7a40 EFLAGS: 00010293 RAX: ffffffff8a88c179 RBX: ffff88807af2e000 RCX: ffff888023d4bc00 RDX: 0000000000000000 RSI: fffffffffffffffc RDI: 0000000000000000 RBP: ffffc900046c7bb0 R08: ffffc900046c79c7 R09: 1ffff920008d8f38 R10: dffffc0000000000 R11: fffff520008d8f39 R12: dffffc0000000000 R13: 0000000100002382 R14: 0000000100002386 R15: ffff88807af2e510 FS: 0000000000000000(0000) GS:ffff8880b8e00000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: 00007f11ad9d5300 CR3: 000000000cf32000 CR4: 00000000003506f0 Call Trace: process_one_work kernel/workqueue.c:2657 [inline] process_scheduled_works+0xa60/0x1600 kernel/workqueue.c:2734 worker_thread+0xa5e/0xfe0 kernel/workqueue.c:2815 kthread+0x2fa/0x390 kernel/kthread.c:388 ret_from_fork+0x48/0x80 arch/x86/kernel/process.c:152 ret_from_fork_asm+0x11/0x20 arch/x86/entry/entry_64.S:293 final repro crashed as (corrupted=false): ------------[ cut here ]------------ WARNING: CPU: 0 PID: 1138 at io_uring/io_uring.c:3214 io_ring_exit_work+0x3b9/0x830 io_uring/io_uring.c:3214 Modules linked in: CPU: 0 PID: 1138 Comm: kworker/u4:7 Not tainted syzkaller #0 Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 Workqueue: iou_exit io_ring_exit_work RIP: 0010:io_ring_exit_work+0x3b9/0x830 io_uring/io_uring.c:3214 Code: fd 48 8b 7c 24 40 48 8b 74 24 10 e8 31 02 11 00 48 85 c0 41 bf 00 20 00 00 75 1d e8 e1 c9 fe f6 e9 b1 fd ff ff e8 d7 c9 fe f6 <0f> 0b b8 70 17 00 00 48 89 44 24 10 eb c1 c7 84 24 90 00 00 00 00 RSP: 0000:ffffc900046c7a40 EFLAGS: 00010293 RAX: ffffffff8a88c179 RBX: ffff88807af2e000 RCX: ffff888023d4bc00 RDX: 0000000000000000 RSI: fffffffffffffffc RDI: 0000000000000000 RBP: ffffc900046c7bb0 R08: ffffc900046c79c7 R09: 1ffff920008d8f38 R10: dffffc0000000000 R11: fffff520008d8f39 R12: dffffc0000000000 R13: 0000000100002382 R14: 0000000100002386 R15: ffff88807af2e510 FS: 0000000000000000(0000) GS:ffff8880b8e00000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: 00007f11ad9d5300 CR3: 000000000cf32000 CR4: 00000000003506f0 Call Trace: process_one_work kernel/workqueue.c:2657 [inline] process_scheduled_works+0xa60/0x1600 kernel/workqueue.c:2734 worker_thread+0xa5e/0xfe0 kernel/workqueue.c:2815 kthread+0x2fa/0x390 kernel/kthread.c:388 ret_from_fork+0x48/0x80 arch/x86/kernel/process.c:152 ret_from_fork_asm+0x11/0x20 arch/x86/entry/entry_64.S:293