Extracting prog: 1h8m2.087950232s Minimizing prog: 2m54.307692652s Simplifying prog options: 0s Extracting C: 32.500176546s Simplifying C: 6m59.460451474s extracting reproducer from 58 programs first checking the prog from the crash report single: executing 1 programs separately with timeout 6m0s testing program (duration=6m0s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): sendmsg$nl_route_sched-openat$tun-ioctl$TUNSETIFF-openat$tun-close-socket$nl_generic-ioctl$SIOCSIFHWADDR-socket$nl_route-ioctl$sock_SIOCGIFINDEX-sendmsg$nl_route_sched-sendmsg$nl_route_sched-socket$packet-sendto$packet detailed listing: executing program 0: sendmsg$nl_route_sched(0xffffffffffffffff, 0x0, 0x10) r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000200), 0x0, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000040)={'syzkaller0\x00', 0x2}) r1 = openat$tun(0xffffffffffffff9c, &(0x7f0000000400), 0x0, 0x0) close(r1) socket$nl_generic(0x10, 0x3, 0x10) ioctl$SIOCSIFHWADDR(r1, 0x8914, &(0x7f0000002280)={'syzkaller0\x00', @multicast}) r2 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r2, 0x8933, &(0x7f0000000100)={'syzkaller0\x00', 0x0}) sendmsg$nl_route_sched(r2, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000580)={&(0x7f0000000340)=@newqdisc={0x4c, 0x24, 0x4ee4e6a52ff56541, 0x70bd25, 0x25dfdbfd, {0x0, 0x0, 0x0, r3, {0x0, 0xb}, {0xffff, 0xffff}, {0xfff2}}, [@qdisc_kind_options=@q_netem={{0xa}, {0x1c, 0x2, {{0x3, 0x3, 0x4361, 0x7, 0xffffffff, 0x3}}}}]}, 0x4c}, 0x1, 0x0, 0x0, 0x8000}, 0x0) sendmsg$nl_route_sched(r2, &(0x7f00000003c0)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000440)=@newqdisc={0x44, 0x24, 0x4ee4e6a52ff56541, 0x70b927, 0x25dfdbfc, {0x0, 0x0, 0x0, r3, {0x0, 0xd}, {0x6, 0xb}, {0xb, 0x2}}, [@qdisc_kind_options=@q_cake={{0x9}, {0x14, 0x2, [@TCA_CAKE_AUTORATE={0x8, 0x9, 0x6}, @TCA_CAKE_MEMORY={0x8, 0xa, 0x5}]}}]}, 0x44}, 0x1, 0x0, 0x0, 0x240040e0}, 0x4890) r4 = socket$packet(0x11, 0x3, 0x300) sendto$packet(r4, &(0x7f0000000240)="800000800000210ee7decd7a000340", 0xf, 0x40, &(0x7f00000001c0)={0x11, 0x8100, r3, 0x1, 0xd8, 0x6, @broadcast}, 0x14) program did not crash single: failed to extract reproducer bisect: bisecting 58 programs with base timeout 6m0s testing program (duration=6m14s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): [4, 7, 4, 13, 4, 17, 16, 16, 14, 13, 13, 13, 24, 23, 23, 9, 14, 13, 24, 2, 2, 5, 9, 14, 13, 16, 4, 4, 2, 4, 6, 16, 1, 2, 4, 12, 9, 22, 16, 10, 8, 4, 5, 8, 3, 18, 6, 9, 13, 4, 8, 5, 8, 16, 2, 14, 1, 5] detailed listing: executing program 4: r0 = syz_open_dev$sndctrl(&(0x7f0000000040), 0x0, 0x0) madvise(&(0x7f0000000000/0x600000)=nil, 0x600000, 0x15) mprotect(&(0x7f0000000000/0x4000)=nil, 0x4000, 0x1) ioctl$SNDRV_CTL_IOCTL_SUBSCRIBE_EVENTS(r0, 0xc0045516, &(0x7f0000000000)=0xffb) executing program 4: r0 = socket$l2tp(0x2, 0x2, 0x73) bind$inet(r0, &(0x7f00000002c0)={0x2, 0x4e1c, @multicast1}, 0x10) connect$inet(r0, &(0x7f0000000200)={0x2, 0x4e22, @local}, 0x10) r1 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000001c0)='memory.events\x00', 0x275a, 0x0) write$cgroup_subtree(r1, &(0x7f0000000100)=ANY=[], 0x32600) mmap(&(0x7f0000000000/0x3000)=nil, 0x3000, 0x2000001, 0x12, r1, 0x0) getsockopt$sock_buf(r0, 0x1, 0x1c, 0x0, &(0x7f00000000c0)) executing program 4: writev(0xffffffffffffffff, &(0x7f0000000180)=[{&(0x7f0000000240)}], 0x1) mprotect(&(0x7f0000000000/0xf000)=nil, 0xf000, 0x1) r0 = socket$inet6_sctp(0xa, 0x1, 0x84) getsockopt$inet_sctp6_SCTP_STREAM_SCHEDULER(r0, 0x84, 0x7b, &(0x7f0000000140)={0x0, 0x9}, &(0x7f0000000180)=0x8) executing program 4: syz_mount_image$fuse(0x0, &(0x7f0000002080)='./file0\x00', 0x208000, 0x0, 0x3d, 0x0, 0x0) r0 = open_tree(0xffffffffffffff9c, &(0x7f0000000640)='\x00', 0x89901) move_mount(r0, &(0x7f0000000140)='.\x00', 0xffffffffffffff9c, &(0x7f0000000180)='./file0\x00', 0x0) r1 = open_tree(0xffffffffffffff9c, &(0x7f0000000640)='\x00', 0x9801) move_mount(r1, &(0x7f0000000140)='.\x00', 0xffffffffffffff9c, &(0x7f0000000180)='./file0\x00', 0x0) chroot(&(0x7f0000001740)='./file0\x00') syz_open_procfs(0x0, &(0x7f0000000040)='mounts\x00') r2 = fsopen(&(0x7f0000000180)='proc\x00', 0x1) fsconfig$FSCONFIG_CMD_CREATE(r2, 0x6, 0x0, 0x0, 0x0) mprotect(&(0x7f0000000000/0x4000)=nil, 0x4000, 0x1) fchdir(0xffffffffffffffff) r3 = openat$fuse(0xffffffffffffff9c, &(0x7f0000000040), 0x42, 0x0) read$FUSE(r3, &(0x7f00000102c0)={0x2020}, 0x7) executing program 4: mmap(&(0x7f0000000000/0xff5000)=nil, 0xff5000, 0x1000002, 0x200000005c831, 0xffffffffffffffff, 0x0) timer_create(0x2, 0x0, &(0x7f0000bbdffc)) seccomp$SECCOMP_SET_MODE_FILTER(0x1, 0x4, &(0x7f0000000140)={0x0, 0x0}) remap_file_pages(&(0x7f0000800000/0x800000)=nil, 0x800000, 0x0, 0x600, 0x102020) executing program 3: r0 = socket$unix(0x1, 0x5, 0x0) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000100)={'veth0_macvtap\x00', 0x0}) ioctl$FS_IOC_RESVSP(0xffffffffffffffff, 0xc0189436, 0x0) r2 = socket$inet6_mptcp(0xa, 0x1, 0x106) bind$inet6(r2, &(0x7f0000000040)={0xa, 0x4e22, 0x0, @empty, 0x7}, 0x1c) listen(r2, 0xfffffffc) r3 = socket$nl_generic(0x10, 0x3, 0x10) r4 = syz_genetlink_get_family_id$mptcp(&(0x7f0000000000), 0xffffffffffffffff) bpf$MAP_CREATE_CONST_STR(0x0, 0x0, 0x0) bpf$MAP_CREATE_RINGBUF(0x0, &(0x7f0000000780)={0x1b, 0x0, 0x0, 0x40000, 0x0, 0x0, 0x1, '\x00', r1, 0x0}, 0x50) bpf$PROG_LOAD(0x5, 0x0, 0x0) r5 = syz_genetlink_get_family_id$mptcp(&(0x7f0000000040), 0xffffffffffffffff) r6 = socket$inet_mptcp(0x2, 0x1, 0x106) connect$inet(r6, &(0x7f0000000000)={0x2, 0x4e22, @local}, 0x10) sendmsg$MPTCP_PM_CMD_DEL_ADDR(0xffffffffffffffff, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000000240)={0x28, r5, 0x7, 0x0, 0x0, {}, [@MPTCP_PM_ATTR_ADDR={0x14, 0x1, 0x0, 0x1, [@MPTCP_PM_ADDR_ATTR_FAMILY={0x6, 0x1, 0x2}, @MPTCP_PM_ADDR_ATTR_ADDR4={0x8, 0x3, @local}]}]}, 0x28}}, 0x0) syz_genetlink_get_family_id$mptcp(&(0x7f00000000c0), 0xffffffffffffffff) sendmsg$MPTCP_PM_CMD_ADD_ADDR(r3, &(0x7f0000000400)={0x0, 0x0, &(0x7f00000003c0)={&(0x7f00000004c0)={0x30, r4, 0x1, 0x70bd2c, 0x1000000, {}, [@MPTCP_PM_ATTR_ADDR={0x1c, 0x1, 0x0, 0x1, [@MPTCP_PM_ADDR_ATTR_FAMILY={0x6, 0x1, 0x2}, @MPTCP_PM_ADDR_ATTR_ADDR4={0x8, 0x3, @dev={0xac, 0x14, 0x14, 0x37}}, @MPTCP_PM_ADDR_ATTR_FLAGS={0x8, 0x6, 0x3}]}]}, 0x30}, 0x1, 0xff07}, 0x2000000) executing program 3: r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000100), 0x0, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000040)={'syzkaller0\x00', 0x2}) r1 = openat$tun(0xffffffffffffff9c, &(0x7f0000000400), 0x0, 0x0) close(r1) socket$inet_udp(0x2, 0x2, 0x0) ioctl$SIOCSIFHWADDR(r1, 0x8914, &(0x7f0000002280)={'syzkaller0\x00', @multicast}) r2 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r2, 0x8933, &(0x7f0000000100)={'syzkaller0\x00', 0x0}) sendmsg$nl_route_sched(r2, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000580)={&(0x7f0000000600)=@newqdisc={0x4c, 0x24, 0x4ee4e6a52ff56541, 0x1, 0x25dfdbfd, {0x0, 0x0, 0x0, r3, {0x0, 0xb}, {0xffff, 0xffff}, {0xfff2}}, [@qdisc_kind_options=@q_netem={{0xa}, {0x1c, 0x2, {{0x3, 0x3, 0x6361, 0x5, 0xffffffff, 0x3}}}}]}, 0x4c}, 0x1, 0x0, 0x0, 0x40088c1}, 0x0) r4 = socket$unix(0x1, 0x1, 0x0) r5 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r4, 0x8933, &(0x7f0000000100)={'syzkaller0\x00', 0x0}) sendmsg$nl_route_sched(r5, &(0x7f0000000200)={0x0, 0x0, &(0x7f0000000140)={&(0x7f00000004c0)=@newqdisc={0x24, 0x24, 0x4ee4e6a52ff56541, 0x70b923, 0x80000, {0x0, 0x0, 0x0, r6, {0x0, 0x9}, {0x0, 0xb}, {0x9, 0xb}}}, 0x24}, 0x1, 0x0, 0x0, 0x2000c061}, 0x0) r7 = socket$nl_generic(0x10, 0x3, 0x10) r8 = syz_genetlink_get_family_id$tipc(&(0x7f0000000080), r7) sendmsg$TIPC_CMD_ENABLE_BEARER(r7, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000280)={&(0x7f0000000680)=ANY=[@ANYBLOB='8\x00\x00\x00', @ANYRES16=r8, @ANYBLOB="010000000d0000000000010000000000000001410000001c001700000000000000006574683a73797a6b616c6c657230"], 0x38}}, 0x0) executing program 1: r0 = openat$binder_debug(0xffffffffffffff9c, &(0x7f0000000040)='/sys/kernel/debug/binder/transactions\x00', 0x0, 0x0) r1 = openat$binderfs(0xffffffffffffff9c, &(0x7f00000000c0)='./binderfs/binder0\x00', 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR_EXT(r1, 0x4018620d, &(0x7f0000000100)) r2 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000140)='./binderfs/binder0\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000080)={0x8, 0x0, &(0x7f0000000400)=[@increfs], 0x0, 0x0, 0x0}) r3 = dup3(r2, r1, 0x0) r4 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000040)='./binderfs/binder0\x00', 0x0, 0x0) mmap$binder(&(0x7f0000ffd000/0x3000)=nil, 0x3000, 0x1, 0x11, r4, 0x0) ioctl$BINDER_SET_CONTEXT_MGR_EXT(r4, 0x4018620d, 0x0) ioctl$BINDER_WRITE_READ(r3, 0xc0306201, &(0x7f00000004c0)={0x8, 0x0, &(0x7f0000000000)=[@acquire], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r3, 0xc0306201, &(0x7f00000001c0)={0x4c, 0x0, &(0x7f0000000fc0)=[@transaction_sg={0x40486311, {0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x48, 0x18, &(0x7f0000000300)={@flat=@weak_binder={0x77622a85, 0x100a, 0x8000000000}, @flat=@weak_binder={0x77622a85, 0x1100, 0x3}}, &(0x7f0000000200)={0x0, 0x18, 0x30}}}], 0x0, 0x0, 0x0}) mmap$binder(&(0x7f0000ffe000/0x2000)=nil, 0x2000, 0x1, 0x11, r1, 0x10000000000) ioctl$BINDER_WRITE_READ(r4, 0xc0306201, &(0x7f0000000180)={0x0, 0x0, 0x0, 0x50, 0x0, &(0x7f0000000580)="b3185d7bb56f70f003360fa8bf71ac3086aedebf6fff904f92849a7a07395ee7f0e4cb1d78001c08a0ab73ffcf5ad07693727980eea946e6cba1723e81bfa5c3688803c8a124dcb27df7938e7ddfdd52"}) ioctl$BINDER_WRITE_READ(r4, 0xc0306201, &(0x7f0000004a40)={0x44, 0x0, &(0x7f00000049c0)=[@transaction={0x40406300, {0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) ioctl$BINDER_THREAD_EXIT(r4, 0x40046208, 0x0) read$FUSE(r0, &(0x7f0000004800)={0x2020}, 0x2020) executing program 3: r0 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000380)='./binderfs/binder0\x00', 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR_EXT(r0, 0x4018620d, &(0x7f00000000c0)={0x73622a85, 0xa, 0x8000000000002}) r1 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000200)='./binderfs/binder0\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000080)={0x8, 0x0, &(0x7f0000000400)=[@increfs], 0x0, 0x0, 0x0}) r2 = dup3(r1, r0, 0x0) r3 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000000)='./binderfs/binder0\x00', 0x0, 0x0) mmap$binder(&(0x7f0000ffd000/0x3000)=nil, 0x3000, 0x1, 0x11, r3, 0x0) ioctl$BINDER_SET_CONTEXT_MGR_EXT(r3, 0x4018620d, &(0x7f0000000040)={0x73622a85, 0x10a}) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f00000003c0)={0x8, 0x0, &(0x7f0000000340)=[@acquire], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000001040)={0x4c, 0x0, &(0x7f0000000ec0)=[@transaction_sg={0x40486311, {0x1, 0x0, 0x0, 0x0, 0x41, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x1000}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000001c0)={0x4c, 0x0, &(0x7f0000000740)=[@transaction_sg={0x40486311, {0x1, 0x0, 0x0, 0x0, 0x11, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x400}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000c00)={0x44, 0x0, &(0x7f0000000a80)=[@transaction={0x40406300, {0x1, 0x0, 0x0, 0x0, 0x21, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) r4 = openat$binder_debug(0xffffffffffffff9c, 0x0, 0x0, 0x0) read$FUSE(r4, &(0x7f0000007fc0)={0x2020}, 0x2020) executing program 4: r0 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000380)='./binderfs/binder0\x00', 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR_EXT(r0, 0x4018620d, &(0x7f00000000c0)={0x73622a85, 0xa, 0x8000000000002}) r1 = openat$binderfs(0xffffffffffffff9c, 0x0, 0x0, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000080)={0x8, 0x0, &(0x7f0000000400)=[@increfs], 0x0, 0x0, 0x0}) r2 = dup3(r1, r0, 0x0) r3 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000000)='./binderfs/binder0\x00', 0x0, 0x0) r4 = mmap$binder(&(0x7f0000ffd000/0x3000)=nil, 0x3000, 0x1, 0x11, r3, 0x0) ioctl$BINDER_SET_CONTEXT_MGR_EXT(r3, 0x4018620d, &(0x7f0000000040)={0x73622a85, 0x10a}) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f00000003c0)={0x8, 0x0, &(0x7f0000000340)=[@acquire], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000001040)={0x4c, 0x0, &(0x7f0000000ec0)=[@transaction_sg={0x40486311, {0x1, 0x0, 0x0, 0x0, 0x41, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x1000}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000001c0)={0x4c, 0x0, &(0x7f0000000740)=[@transaction_sg={0x40486311, {0x1, 0x0, 0x0, 0x0, 0x11, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x400}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000c00)={0x44, 0x0, &(0x7f0000000a80)=[@transaction={0x40406300, {0x1, 0x0, 0x0, 0x0, 0x21, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r3, 0xc0306201, &(0x7f0000000300)={0xc, 0x0, &(0x7f0000000240)=[@free_buffer={0x40086303, r4}], 0x54, 0x0, &(0x7f0000000280)="37b82b8f41afa37c5297fe5b692d3cedbd057d6f37743560799bbf4ddd06bc810453adcec0c458de737aeadf5afcd6641ea3434a1a0bfd0debe7506939a82090490c46a6010019e855badfb0bee8561d5ee15bac"}) executing program 32: r0 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000380)='./binderfs/binder0\x00', 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR_EXT(r0, 0x4018620d, &(0x7f00000000c0)={0x73622a85, 0xa, 0x8000000000002}) r1 = openat$binderfs(0xffffffffffffff9c, 0x0, 0x0, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000080)={0x8, 0x0, &(0x7f0000000400)=[@increfs], 0x0, 0x0, 0x0}) r2 = dup3(r1, r0, 0x0) r3 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000000)='./binderfs/binder0\x00', 0x0, 0x0) r4 = mmap$binder(&(0x7f0000ffd000/0x3000)=nil, 0x3000, 0x1, 0x11, r3, 0x0) ioctl$BINDER_SET_CONTEXT_MGR_EXT(r3, 0x4018620d, &(0x7f0000000040)={0x73622a85, 0x10a}) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f00000003c0)={0x8, 0x0, &(0x7f0000000340)=[@acquire], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000001040)={0x4c, 0x0, &(0x7f0000000ec0)=[@transaction_sg={0x40486311, {0x1, 0x0, 0x0, 0x0, 0x41, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x1000}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000001c0)={0x4c, 0x0, &(0x7f0000000740)=[@transaction_sg={0x40486311, {0x1, 0x0, 0x0, 0x0, 0x11, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x400}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000c00)={0x44, 0x0, &(0x7f0000000a80)=[@transaction={0x40406300, {0x1, 0x0, 0x0, 0x0, 0x21, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r3, 0xc0306201, &(0x7f0000000300)={0xc, 0x0, &(0x7f0000000240)=[@free_buffer={0x40086303, r4}], 0x54, 0x0, &(0x7f0000000280)="37b82b8f41afa37c5297fe5b692d3cedbd057d6f37743560799bbf4ddd06bc810453adcec0c458de737aeadf5afcd6641ea3434a1a0bfd0debe7506939a82090490c46a6010019e855badfb0bee8561d5ee15bac"}) executing program 3: syz_mount_image$fuse(0x0, &(0x7f0000002080)='./file0\x00', 0x208000, 0x0, 0x3d, 0x0, 0x0) r0 = open_tree(0xffffffffffffff9c, &(0x7f0000000640)='\x00', 0x89901) move_mount(r0, &(0x7f0000000140)='.\x00', 0xffffffffffffff9c, &(0x7f0000000180)='./file0\x00', 0x0) r1 = open_tree(0xffffffffffffff9c, &(0x7f0000000640)='\x00', 0x9801) move_mount(r1, &(0x7f0000000140)='.\x00', 0xffffffffffffff9c, &(0x7f0000000180)='./file0\x00', 0x0) chroot(&(0x7f0000001740)='./file0\x00') syz_open_procfs(0x0, &(0x7f0000000040)='mounts\x00') r2 = fsopen(&(0x7f0000000180)='proc\x00', 0x1) fsconfig$FSCONFIG_CMD_CREATE(r2, 0x6, 0x0, 0x0, 0x0) mprotect(&(0x7f0000000000/0x4000)=nil, 0x4000, 0x1) fchdir(0xffffffffffffffff) r3 = openat$fuse(0xffffffffffffff9c, &(0x7f0000000040), 0x42, 0x0) read$FUSE(r3, &(0x7f00000102c0)={0x2020}, 0x7) executing program 3: r0 = socket$inet6_sctp(0xa, 0x1, 0x84) r1 = dup(r0) setsockopt$inet_sctp6_SCTP_SOCKOPT_BINDX_ADD(r1, 0x84, 0x64, 0x0, 0x0) sendmsg$inet6(r0, 0x0, 0x20000896) dup(r0) write$UHID_INPUT(r1, 0x0, 0x0) openat$ppp(0xffffffffffffff9c, &(0x7f0000000140), 0x42000, 0x0) syz_open_dev$vim2m(&(0x7f0000000000), 0x800, 0x2) socket$netlink(0x10, 0x3, 0x0) syz_open_procfs(0xffffffffffffffff, &(0x7f0000000500)='status\x00') socketpair$unix(0x1, 0x1, 0x0, &(0x7f00000001c0)) openat$fuse(0xffffffffffffff9c, &(0x7f00000000c0), 0x2, 0x0) r2 = open_tree(0xffffffffffffff9c, &(0x7f0000000640)='\x00', 0x89901) mount_setattr(r2, 0x0, 0x8000, 0x0, 0x0) socket(0x10, 0x3, 0x0) socket$nl_generic(0x10, 0x3, 0x10) socket$nl_netfilter(0x10, 0x3, 0xc) socket$kcm(0x2, 0xa, 0x2) r3 = socket$unix(0x1, 0x1, 0x0) bind$unix(r3, &(0x7f00000000c0)=@file={0x1, '\xe9\x1fq\x89Y\x1e\x923aK\x00'}, 0x6e) listen(r3, 0x0) accept(r3, 0x0, 0x0) r4 = socket$nl_netfilter(0x10, 0x3, 0xc) syz_emit_vhci(&(0x7f0000000840)=ANY=[@ANYBLOB="04050400c900", @ANYRES16=r4], 0x7) executing program 3: r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000100), 0x0, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000040)={'syzkaller0\x00', 0x2}) r1 = open_tree(0xffffffffffffff9c, &(0x7f0000000100)='\x00', 0x89901) r2 = fspick(r1, &(0x7f00000000c0)='.\x00', 0x0) fsconfig$FSCONFIG_SET_FLAG(r2, 0x0, &(0x7f0000000000)='dirsync\x00', 0x0, 0x0) fsconfig$FSCONFIG_CMD_RECONFIGURE(r2, 0x7, 0x0, 0x0, 0x0) setxattr$security_ima(&(0x7f0000000080)='./file0\x00', &(0x7f00000002c0), &(0x7f0000000380)=@ng={0x4, 0x2, "1263cdb7"}, 0x6, 0x0) r3 = openat$tun(0xffffffffffffff9c, &(0x7f0000000500), 0x40, 0x0) close(r3) r4 = socket$kcm(0x29, 0x2, 0x0) ioctl$sock_proto_private(r4, 0x89e2, &(0x7f0000000040)) socket$nl_generic(0x10, 0x3, 0x10) ioctl$SIOCSIFHWADDR(r3, 0x8914, &(0x7f0000002280)={'syzkaller0\x00', @multicast}) socket$nl_route(0x10, 0x3, 0x0) r5 = socket$nl_route(0x10, 0x3, 0x0) r6 = socket$unix(0x1, 0x1, 0x0) ioctl$sock_SIOCGIFINDEX(r6, 0x8933, &(0x7f0000000100)={'syzkaller0\x00', 0x0}) ioctl$VIDIOC_ENUMAUDOUT(r1, 0xc0345642, &(0x7f00000003c0)={0x2, "873e45dacd5291f166c9aac0b6f8ce6da80afca0fe66169480a5a6b43da5bc0e", 0x1}) sendmsg$nl_route_sched(r5, &(0x7f00000008c0)={0x0, 0x0, &(0x7f0000000900)={&(0x7f0000000140)=@newqdisc={0x44, 0x24, 0x4ee4e6a52ff56541, 0x70bd26, 0xffffffff, {0x0, 0x0, 0x0, r7, {0x0, 0xfff1}, {0xffff, 0xffff}, {0xe}}, [@qdisc_kind_options=@q_hfsc={{0x9}, {0x14, 0x2, @TCA_HFSC_FSC={0x10, 0x2, {0x5, 0x7, 0xb3}}}}]}, 0x44}, 0x1, 0x0, 0x0, 0x4000000}, 0x0) r8 = socket$nl_route(0x10, 0x3, 0x0) r9 = socket$unix(0x1, 0x1, 0x0) ioctl$sock_SIOCGIFINDEX(r9, 0x8933, &(0x7f0000000100)={'syzkaller0\x00', 0x0}) sendmsg$nl_route_sched(r8, &(0x7f0000001200)={0x0, 0x0, &(0x7f0000000280)={&(0x7f0000001240)=@newqdisc={0xc48, 0x28, 0x4ee4e6a52ff56541, 0x4001, 0xfffffdfc, {0x0, 0x0, 0x0, r10, {0x10}, {}, {0x2, 0x3}}, [@qdisc_kind_options=@q_tbf={{0x8}, {0xc1c, 0x2, [@TCA_TBF_PTAB={0x404, 0x3, [0x0, 0x4f0d, 0x5, 0x10001, 0x8, 0x10000, 0x80, 0x288, 0x9, 0x9, 0x2, 0xfff, 0xdfd, 0x1, 0x7887, 0x5, 0xdd16, 0x392, 0x31aa, 0x7fff, 0x2, 0xfffff98c, 0x4, 0x4e, 0x100, 0xa, 0x9, 0x2, 0x11, 0xffffffff, 0x3, 0x4, 0x1000, 0x800, 0x7, 0x1, 0x9, 0xd, 0x7, 0xa4f, 0x2, 0xc, 0x3, 0x0, 0xffffffef, 0x74, 0x4, 0x4, 0xffffffff, 0x6, 0x3, 0x1000, 0x6, 0x5, 0x71d, 0x2, 0xffff, 0x6, 0x6, 0x80000000, 0xce0, 0x9, 0xea5, 0x8, 0x200, 0x4, 0x8001, 0xa8, 0x9, 0x10, 0x9, 0x10000, 0x2, 0x7fff, 0xc, 0x7, 0x4800, 0x8, 0x6, 0xe87, 0x7f, 0x6, 0x0, 0x4800, 0x1, 0x12, 0x18b, 0x6, 0x2, 0x5, 0x1, 0x40, 0x5, 0x1, 0x0, 0x1da35084, 0x4, 0x1, 0x9, 0x7, 0x0, 0x4, 0x8, 0x4, 0x2, 0x0, 0x7, 0x200, 0x3, 0x8001, 0xa000, 0x0, 0x7a69, 0x764064d2, 0x92, 0x2, 0xbdc9, 0x3, 0xff, 0x2, 0x10, 0x5, 0x10000, 0x100, 0x5, 0x1022075d, 0x8, 0x5, 0x5, 0xfffffffe, 0x7f, 0x101, 0x4, 0xb, 0x9, 0x27, 0xff, 0x1, 0xf64a, 0xa78c, 0x5, 0x6, 0x7, 0xffff4fc5, 0x8, 0x7f, 0x385, 0x400, 0x100, 0x2, 0x5, 0x4, 0x7, 0x2, 0x7, 0x1, 0xb8, 0xffffff2a, 0x6, 0x8001, 0x6, 0x8, 0x3ff, 0x2, 0x6, 0x0, 0x6, 0x7fff, 0x80, 0x2, 0x5aeb, 0xe, 0x80000001, 0x39, 0x5, 0xa05, 0x3, 0x9, 0x72, 0x5, 0x4, 0x9, 0xba, 0x3, 0xc3, 0x8, 0x6, 0x7f, 0x5, 0xe8f0, 0x55, 0x8, 0x0, 0x7, 0x2, 0x8, 0x410, 0xffff03a4, 0xa8, 0x39b5, 0x8, 0xf3, 0x4, 0x10001, 0x0, 0x7f, 0x2, 0x7fff, 0x7, 0x401, 0x4, 0x0, 0x8, 0x2, 0x7, 0x2, 0x1, 0x2, 0x8, 0xffff, 0x0, 0x9, 0xc0e, 0x41, 0xf, 0xffff, 0xfffffff7, 0xffffff26, 0x7, 0x32a, 0xad95, 0x776, 0x9, 0xfffffffd, 0xfbc0, 0x3, 0xa4c9, 0x1, 0x6, 0xb, 0x3, 0x101, 0x1, 0x0, 0x2, 0x3, 0x4, 0x0, 0x80000000, 0xfffffff8, 0x400, 0x5, 0x2, 0x40, 0xfffeffff, 0x541b]}, @TCA_TBF_RTAB={0x404, 0x2, [0x9, 0x100, 0x2, 0xc91, 0x5, 0x400, 0x1000, 0x2, 0x5, 0x3ff, 0x2, 0x200, 0x7, 0x2, 0x6, 0xdb6, 0x401, 0x6, 0xf, 0x100, 0x3, 0xb, 0x5, 0x77dedf80, 0x100, 0x7, 0x2, 0x4, 0x1, 0x5, 0x5, 0x5, 0x4, 0x7, 0x6, 0x6, 0x4, 0x0, 0x0, 0x3, 0x5, 0x2, 0x10, 0x101, 0x8, 0xd6, 0x8, 0x800, 0x3, 0x4, 0x10001, 0x66a, 0x7, 0x7, 0x6c, 0xa6d, 0x4, 0x6, 0x3, 0x8, 0x2, 0x3d, 0x4, 0x80000000, 0xc, 0x2, 0x40, 0x7, 0x2, 0x4, 0xffffffff, 0x2, 0x4, 0xb0, 0xe7, 0x8, 0x8001, 0x7, 0xb, 0x4, 0x3, 0x2, 0x6, 0x1, 0x5, 0x10001, 0x3, 0x4, 0xffffffff, 0x5, 0x4, 0x7, 0x5, 0x3, 0x8, 0x8, 0x0, 0x374, 0x2, 0x4, 0x7, 0x81, 0x8, 0x7f, 0x9, 0x0, 0x4, 0x6, 0x2, 0xa08d, 0x100, 0x5, 0xffff248d, 0x5, 0x7, 0xa, 0x0, 0x671, 0x3, 0x10000, 0x8c, 0x2ea, 0xd6, 0x79, 0x9, 0x9, 0xc, 0xccf, 0x2, 0xb, 0x5, 0x100, 0x158, 0x4, 0x2, 0x7, 0x1, 0x401, 0x6, 0x5, 0xfffffffb, 0xffffffff, 0x6, 0x80000001, 0x2, 0x7, 0x5, 0xab7, 0x6f18f07b, 0x80000001, 0x0, 0x9, 0xc1, 0x5, 0x4, 0x8, 0x7, 0x3, 0x8, 0x3ff, 0x0, 0x9, 0x203a, 0x3, 0x0, 0x8, 0x2, 0x7, 0x7, 0x8, 0x0, 0x4, 0x4007ff, 0x4, 0x9, 0x2, 0x5, 0x8000, 0x200, 0x0, 0x1, 0xfffffff6, 0x0, 0x7b, 0xfd, 0x5b653309, 0xe5, 0x14f, 0x6, 0x10001, 0x1, 0x7, 0x2, 0xffffffff, 0x0, 0x40100, 0x197, 0x3ff, 0x9, 0x4, 0x200, 0xcbf, 0x1ff, 0x80, 0x9, 0x2f74, 0x4, 0x1, 0x9, 0x0, 0x4, 0x8, 0x8000, 0x5, 0x8, 0xf, 0x9, 0x6057, 0x101, 0x8001, 0xad, 0x4, 0x7, 0x7, 0x2, 0x80000001, 0x8c6b, 0xd87, 0x82, 0x100, 0x0, 0x80000000, 0x0, 0x9a, 0x9, 0xfc3, 0x89, 0xa, 0x80000001, 0x2, 0x1, 0xffffffff, 0x4, 0x8000, 0x2, 0x3, 0x10000, 0x8486, 0x3, 0x8, 0x6, 0x0, 0x1, 0x3, 0x2, 0x9]}, @TCA_TBF_PTAB={0x404, 0x3, [0x5, 0x5, 0x4, 0x5, 0x8001, 0x8, 0x5, 0x2, 0x8, 0x5, 0x4c5, 0x1, 0x6, 0x8, 0x5, 0x5, 0x1, 0x6, 0x0, 0x0, 0x0, 0x0, 0x81, 0xfff, 0x10, 0x3, 0xe55, 0xd, 0x3, 0x6, 0x2, 0x5, 0xef, 0x7, 0x1, 0x8, 0x96b, 0x8, 0x80000001, 0x3, 0x6, 0x5, 0xa4f, 0x8, 0x3, 0x7ff, 0xc68, 0x80000001, 0x10200, 0x101, 0x10100, 0x166, 0x1, 0x7, 0x7a8, 0x2d, 0x7, 0x80, 0x8, 0x9, 0x0, 0x3ff, 0x8001, 0x5, 0x0, 0x635, 0x656, 0x2, 0x6, 0x5, 0x8, 0x1, 0x6, 0xeb, 0xfffffff9, 0x8, 0x3, 0x1, 0x0, 0x0, 0x3, 0x8ca, 0xffff, 0x9, 0x8, 0x800, 0xc198, 0x8, 0x7db903f4, 0x4, 0x6, 0x2, 0xfffffffc, 0x4, 0x7, 0xa2d, 0x0, 0x0, 0x8, 0x5, 0x8, 0x1000, 0x44da11fe, 0x5, 0xfffffbff, 0xfffff2fc, 0x4, 0x7d2, 0x4, 0x7, 0xffffffff, 0x2, 0xe, 0xe, 0x7, 0x101, 0x5, 0x1, 0x98, 0xc, 0x4, 0x98, 0x7, 0xffff, 0x8e58, 0x6, 0x9, 0x77a, 0x1, 0xfffff001, 0x1, 0x0, 0x7, 0x5, 0x9, 0x0, 0x2, 0xe5, 0x51, 0x2, 0xd50, 0x80000000, 0x1ff, 0x7, 0x3, 0xfffffff2, 0x7ff, 0x1ff, 0xee, 0x0, 0xfffff8aa, 0x0, 0x0, 0x80, 0x6df0, 0x2, 0x4, 0x10001, 0x7ff, 0x1, 0xfffffe01, 0x4, 0x5, 0x81, 0x5, 0x2e7, 0xf3, 0x9, 0x6, 0x5, 0x8000, 0x8, 0xe, 0xce2a, 0x1, 0xcb, 0x5, 0x0, 0x9, 0x94, 0x9f, 0x3, 0x8, 0x401, 0x5, 0x3ff, 0x5, 0x1b, 0x2, 0x4, 0x862d, 0x0, 0xff, 0x5, 0x1, 0x1, 0x0, 0xd, 0x5, 0x4, 0xffffff5c, 0x6, 0xff, 0x3, 0x728, 0x2be55882, 0x8, 0x7, 0x7, 0x0, 0x10, 0x7, 0xff, 0x101, 0xfffff801, 0xc86, 0x3, 0x10000, 0x2, 0x2, 0x2, 0x2, 0x2400, 0x81, 0x5, 0x5, 0x3, 0xc9, 0x1, 0x13, 0x5, 0x9, 0xffffffa2, 0xf5b, 0xe, 0xe, 0xb, 0x8, 0xff, 0x2, 0x3, 0x9, 0x10, 0x67d8fb7a, 0x3, 0x8, 0x10001, 0xfffffffa, 0x8001, 0x4, 0x9, 0x0, 0x1, 0x3, 0xfffffffe, 0x100]}, @TCA_TBF_PRATE64={0xc, 0x5, 0x467944efcdcbb7e7}]}}]}, 0xc48}, 0x1, 0x0, 0x0, 0xb3538085985bb3d6}, 0x0) executing program 33: r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000100), 0x0, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000040)={'syzkaller0\x00', 0x2}) r1 = open_tree(0xffffffffffffff9c, &(0x7f0000000100)='\x00', 0x89901) r2 = fspick(r1, &(0x7f00000000c0)='.\x00', 0x0) fsconfig$FSCONFIG_SET_FLAG(r2, 0x0, &(0x7f0000000000)='dirsync\x00', 0x0, 0x0) fsconfig$FSCONFIG_CMD_RECONFIGURE(r2, 0x7, 0x0, 0x0, 0x0) setxattr$security_ima(&(0x7f0000000080)='./file0\x00', &(0x7f00000002c0), &(0x7f0000000380)=@ng={0x4, 0x2, "1263cdb7"}, 0x6, 0x0) r3 = openat$tun(0xffffffffffffff9c, &(0x7f0000000500), 0x40, 0x0) close(r3) r4 = socket$kcm(0x29, 0x2, 0x0) ioctl$sock_proto_private(r4, 0x89e2, &(0x7f0000000040)) socket$nl_generic(0x10, 0x3, 0x10) ioctl$SIOCSIFHWADDR(r3, 0x8914, &(0x7f0000002280)={'syzkaller0\x00', @multicast}) socket$nl_route(0x10, 0x3, 0x0) r5 = socket$nl_route(0x10, 0x3, 0x0) r6 = socket$unix(0x1, 0x1, 0x0) ioctl$sock_SIOCGIFINDEX(r6, 0x8933, &(0x7f0000000100)={'syzkaller0\x00', 0x0}) ioctl$VIDIOC_ENUMAUDOUT(r1, 0xc0345642, &(0x7f00000003c0)={0x2, "873e45dacd5291f166c9aac0b6f8ce6da80afca0fe66169480a5a6b43da5bc0e", 0x1}) sendmsg$nl_route_sched(r5, &(0x7f00000008c0)={0x0, 0x0, &(0x7f0000000900)={&(0x7f0000000140)=@newqdisc={0x44, 0x24, 0x4ee4e6a52ff56541, 0x70bd26, 0xffffffff, {0x0, 0x0, 0x0, r7, {0x0, 0xfff1}, {0xffff, 0xffff}, {0xe}}, [@qdisc_kind_options=@q_hfsc={{0x9}, {0x14, 0x2, @TCA_HFSC_FSC={0x10, 0x2, {0x5, 0x7, 0xb3}}}}]}, 0x44}, 0x1, 0x0, 0x0, 0x4000000}, 0x0) r8 = socket$nl_route(0x10, 0x3, 0x0) r9 = socket$unix(0x1, 0x1, 0x0) ioctl$sock_SIOCGIFINDEX(r9, 0x8933, &(0x7f0000000100)={'syzkaller0\x00', 0x0}) sendmsg$nl_route_sched(r8, &(0x7f0000001200)={0x0, 0x0, &(0x7f0000000280)={&(0x7f0000001240)=@newqdisc={0xc48, 0x28, 0x4ee4e6a52ff56541, 0x4001, 0xfffffdfc, {0x0, 0x0, 0x0, r10, {0x10}, {}, {0x2, 0x3}}, [@qdisc_kind_options=@q_tbf={{0x8}, {0xc1c, 0x2, [@TCA_TBF_PTAB={0x404, 0x3, [0x0, 0x4f0d, 0x5, 0x10001, 0x8, 0x10000, 0x80, 0x288, 0x9, 0x9, 0x2, 0xfff, 0xdfd, 0x1, 0x7887, 0x5, 0xdd16, 0x392, 0x31aa, 0x7fff, 0x2, 0xfffff98c, 0x4, 0x4e, 0x100, 0xa, 0x9, 0x2, 0x11, 0xffffffff, 0x3, 0x4, 0x1000, 0x800, 0x7, 0x1, 0x9, 0xd, 0x7, 0xa4f, 0x2, 0xc, 0x3, 0x0, 0xffffffef, 0x74, 0x4, 0x4, 0xffffffff, 0x6, 0x3, 0x1000, 0x6, 0x5, 0x71d, 0x2, 0xffff, 0x6, 0x6, 0x80000000, 0xce0, 0x9, 0xea5, 0x8, 0x200, 0x4, 0x8001, 0xa8, 0x9, 0x10, 0x9, 0x10000, 0x2, 0x7fff, 0xc, 0x7, 0x4800, 0x8, 0x6, 0xe87, 0x7f, 0x6, 0x0, 0x4800, 0x1, 0x12, 0x18b, 0x6, 0x2, 0x5, 0x1, 0x40, 0x5, 0x1, 0x0, 0x1da35084, 0x4, 0x1, 0x9, 0x7, 0x0, 0x4, 0x8, 0x4, 0x2, 0x0, 0x7, 0x200, 0x3, 0x8001, 0xa000, 0x0, 0x7a69, 0x764064d2, 0x92, 0x2, 0xbdc9, 0x3, 0xff, 0x2, 0x10, 0x5, 0x10000, 0x100, 0x5, 0x1022075d, 0x8, 0x5, 0x5, 0xfffffffe, 0x7f, 0x101, 0x4, 0xb, 0x9, 0x27, 0xff, 0x1, 0xf64a, 0xa78c, 0x5, 0x6, 0x7, 0xffff4fc5, 0x8, 0x7f, 0x385, 0x400, 0x100, 0x2, 0x5, 0x4, 0x7, 0x2, 0x7, 0x1, 0xb8, 0xffffff2a, 0x6, 0x8001, 0x6, 0x8, 0x3ff, 0x2, 0x6, 0x0, 0x6, 0x7fff, 0x80, 0x2, 0x5aeb, 0xe, 0x80000001, 0x39, 0x5, 0xa05, 0x3, 0x9, 0x72, 0x5, 0x4, 0x9, 0xba, 0x3, 0xc3, 0x8, 0x6, 0x7f, 0x5, 0xe8f0, 0x55, 0x8, 0x0, 0x7, 0x2, 0x8, 0x410, 0xffff03a4, 0xa8, 0x39b5, 0x8, 0xf3, 0x4, 0x10001, 0x0, 0x7f, 0x2, 0x7fff, 0x7, 0x401, 0x4, 0x0, 0x8, 0x2, 0x7, 0x2, 0x1, 0x2, 0x8, 0xffff, 0x0, 0x9, 0xc0e, 0x41, 0xf, 0xffff, 0xfffffff7, 0xffffff26, 0x7, 0x32a, 0xad95, 0x776, 0x9, 0xfffffffd, 0xfbc0, 0x3, 0xa4c9, 0x1, 0x6, 0xb, 0x3, 0x101, 0x1, 0x0, 0x2, 0x3, 0x4, 0x0, 0x80000000, 0xfffffff8, 0x400, 0x5, 0x2, 0x40, 0xfffeffff, 0x541b]}, @TCA_TBF_RTAB={0x404, 0x2, [0x9, 0x100, 0x2, 0xc91, 0x5, 0x400, 0x1000, 0x2, 0x5, 0x3ff, 0x2, 0x200, 0x7, 0x2, 0x6, 0xdb6, 0x401, 0x6, 0xf, 0x100, 0x3, 0xb, 0x5, 0x77dedf80, 0x100, 0x7, 0x2, 0x4, 0x1, 0x5, 0x5, 0x5, 0x4, 0x7, 0x6, 0x6, 0x4, 0x0, 0x0, 0x3, 0x5, 0x2, 0x10, 0x101, 0x8, 0xd6, 0x8, 0x800, 0x3, 0x4, 0x10001, 0x66a, 0x7, 0x7, 0x6c, 0xa6d, 0x4, 0x6, 0x3, 0x8, 0x2, 0x3d, 0x4, 0x80000000, 0xc, 0x2, 0x40, 0x7, 0x2, 0x4, 0xffffffff, 0x2, 0x4, 0xb0, 0xe7, 0x8, 0x8001, 0x7, 0xb, 0x4, 0x3, 0x2, 0x6, 0x1, 0x5, 0x10001, 0x3, 0x4, 0xffffffff, 0x5, 0x4, 0x7, 0x5, 0x3, 0x8, 0x8, 0x0, 0x374, 0x2, 0x4, 0x7, 0x81, 0x8, 0x7f, 0x9, 0x0, 0x4, 0x6, 0x2, 0xa08d, 0x100, 0x5, 0xffff248d, 0x5, 0x7, 0xa, 0x0, 0x671, 0x3, 0x10000, 0x8c, 0x2ea, 0xd6, 0x79, 0x9, 0x9, 0xc, 0xccf, 0x2, 0xb, 0x5, 0x100, 0x158, 0x4, 0x2, 0x7, 0x1, 0x401, 0x6, 0x5, 0xfffffffb, 0xffffffff, 0x6, 0x80000001, 0x2, 0x7, 0x5, 0xab7, 0x6f18f07b, 0x80000001, 0x0, 0x9, 0xc1, 0x5, 0x4, 0x8, 0x7, 0x3, 0x8, 0x3ff, 0x0, 0x9, 0x203a, 0x3, 0x0, 0x8, 0x2, 0x7, 0x7, 0x8, 0x0, 0x4, 0x4007ff, 0x4, 0x9, 0x2, 0x5, 0x8000, 0x200, 0x0, 0x1, 0xfffffff6, 0x0, 0x7b, 0xfd, 0x5b653309, 0xe5, 0x14f, 0x6, 0x10001, 0x1, 0x7, 0x2, 0xffffffff, 0x0, 0x40100, 0x197, 0x3ff, 0x9, 0x4, 0x200, 0xcbf, 0x1ff, 0x80, 0x9, 0x2f74, 0x4, 0x1, 0x9, 0x0, 0x4, 0x8, 0x8000, 0x5, 0x8, 0xf, 0x9, 0x6057, 0x101, 0x8001, 0xad, 0x4, 0x7, 0x7, 0x2, 0x80000001, 0x8c6b, 0xd87, 0x82, 0x100, 0x0, 0x80000000, 0x0, 0x9a, 0x9, 0xfc3, 0x89, 0xa, 0x80000001, 0x2, 0x1, 0xffffffff, 0x4, 0x8000, 0x2, 0x3, 0x10000, 0x8486, 0x3, 0x8, 0x6, 0x0, 0x1, 0x3, 0x2, 0x9]}, @TCA_TBF_PTAB={0x404, 0x3, [0x5, 0x5, 0x4, 0x5, 0x8001, 0x8, 0x5, 0x2, 0x8, 0x5, 0x4c5, 0x1, 0x6, 0x8, 0x5, 0x5, 0x1, 0x6, 0x0, 0x0, 0x0, 0x0, 0x81, 0xfff, 0x10, 0x3, 0xe55, 0xd, 0x3, 0x6, 0x2, 0x5, 0xef, 0x7, 0x1, 0x8, 0x96b, 0x8, 0x80000001, 0x3, 0x6, 0x5, 0xa4f, 0x8, 0x3, 0x7ff, 0xc68, 0x80000001, 0x10200, 0x101, 0x10100, 0x166, 0x1, 0x7, 0x7a8, 0x2d, 0x7, 0x80, 0x8, 0x9, 0x0, 0x3ff, 0x8001, 0x5, 0x0, 0x635, 0x656, 0x2, 0x6, 0x5, 0x8, 0x1, 0x6, 0xeb, 0xfffffff9, 0x8, 0x3, 0x1, 0x0, 0x0, 0x3, 0x8ca, 0xffff, 0x9, 0x8, 0x800, 0xc198, 0x8, 0x7db903f4, 0x4, 0x6, 0x2, 0xfffffffc, 0x4, 0x7, 0xa2d, 0x0, 0x0, 0x8, 0x5, 0x8, 0x1000, 0x44da11fe, 0x5, 0xfffffbff, 0xfffff2fc, 0x4, 0x7d2, 0x4, 0x7, 0xffffffff, 0x2, 0xe, 0xe, 0x7, 0x101, 0x5, 0x1, 0x98, 0xc, 0x4, 0x98, 0x7, 0xffff, 0x8e58, 0x6, 0x9, 0x77a, 0x1, 0xfffff001, 0x1, 0x0, 0x7, 0x5, 0x9, 0x0, 0x2, 0xe5, 0x51, 0x2, 0xd50, 0x80000000, 0x1ff, 0x7, 0x3, 0xfffffff2, 0x7ff, 0x1ff, 0xee, 0x0, 0xfffff8aa, 0x0, 0x0, 0x80, 0x6df0, 0x2, 0x4, 0x10001, 0x7ff, 0x1, 0xfffffe01, 0x4, 0x5, 0x81, 0x5, 0x2e7, 0xf3, 0x9, 0x6, 0x5, 0x8000, 0x8, 0xe, 0xce2a, 0x1, 0xcb, 0x5, 0x0, 0x9, 0x94, 0x9f, 0x3, 0x8, 0x401, 0x5, 0x3ff, 0x5, 0x1b, 0x2, 0x4, 0x862d, 0x0, 0xff, 0x5, 0x1, 0x1, 0x0, 0xd, 0x5, 0x4, 0xffffff5c, 0x6, 0xff, 0x3, 0x728, 0x2be55882, 0x8, 0x7, 0x7, 0x0, 0x10, 0x7, 0xff, 0x101, 0xfffff801, 0xc86, 0x3, 0x10000, 0x2, 0x2, 0x2, 0x2, 0x2400, 0x81, 0x5, 0x5, 0x3, 0xc9, 0x1, 0x13, 0x5, 0x9, 0xffffffa2, 0xf5b, 0xe, 0xe, 0xb, 0x8, 0xff, 0x2, 0x3, 0x9, 0x10, 0x67d8fb7a, 0x3, 0x8, 0x10001, 0xfffffffa, 0x8001, 0x4, 0x9, 0x0, 0x1, 0x3, 0xfffffffe, 0x100]}, @TCA_TBF_PRATE64={0xc, 0x5, 0x467944efcdcbb7e7}]}}]}, 0xc48}, 0x1, 0x0, 0x0, 0xb3538085985bb3d6}, 0x0) executing program 1: bpf$MAP_CREATE(0x0, &(0x7f00000000c0)=@base={0x1b, 0x0, 0x0, 0x8000, 0x80000}, 0x50) mount$fuse(0x0, &(0x7f00000020c0)='./file0\x00', 0x0, 0x80, &(0x7f00000002c0)={{}, 0x2c, {'rootmode', 0x3d, 0x4000}}) syz_fuse_handle_req(0xffffffffffffffff, 0x0, 0x0, 0x0) syz_fuse_handle_req(0xffffffffffffffff, 0x0, 0x0, 0x0) getdents64(0xffffffffffffffff, 0x0, 0x0) r0 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPSET_CMD_CREATE(r0, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)={&(0x7f00000000c0)=ANY=[@ANYBLOB="4c0000000206010800000000000000000000003f0500010006000000050005000200000005000400000000000900020073797a310020000013000300686173683a"], 0x4c}}, 0x0) r1 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPSET_CMD_ADD(r1, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000300)={0x54, 0x9, 0x6, 0x201, 0x0, 0x0, {0x2, 0x0, 0xfdff}, [@IPSET_ATTR_DATA={0x2c, 0x7, 0x0, 0x1, [@IPSET_ATTR_IP={0xc, 0x1, 0x0, 0x1, @IPSET_ATTR_IPADDR_IPV4={0x8, 0x1, 0x1, 0x0, @multicast1}}, @IPSET_ATTR_IFACE={0x14, 0x17, 'batadv_slave_0\x00'}, @IPSET_ATTR_CADT_FLAGS={0x8, 0x8, 0x1, 0x0, 0x94}]}, @IPSET_ATTR_SETNAME={0x9, 0x2, 'syz1\x00'}, @IPSET_ATTR_PROTOCOL={0x5}]}, 0x54}}, 0x40c0080) executing program 1: r0 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000380)='./binderfs/binder0\x00', 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR_EXT(r0, 0x4018620d, &(0x7f00000000c0)={0x73622a85, 0xa, 0x8000000000002}) r1 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000200)='./binderfs/binder0\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000080)={0x8, 0x0, &(0x7f0000000400)=[@increfs], 0x0, 0x0, 0x0}) r2 = dup3(r1, r0, 0x0) r3 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000000)='./binderfs/binder0\x00', 0x0, 0x0) mmap$binder(&(0x7f0000ffd000/0x3000)=nil, 0x3000, 0x1, 0x11, r3, 0x0) ioctl$BINDER_SET_CONTEXT_MGR_EXT(r3, 0x4018620d, &(0x7f0000000040)={0x73622a85, 0x10a}) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f00000003c0)={0x8, 0x0, &(0x7f0000000340)=[@acquire], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000001040)={0x4c, 0x0, &(0x7f0000000ec0)=[@transaction_sg={0x40486311, {0x1, 0x0, 0x0, 0x0, 0x41, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x1000}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000001c0)={0x4c, 0x0, &(0x7f0000000740)=[@transaction_sg={0x40486311, {0x1, 0x0, 0x0, 0x0, 0x11, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x400}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000c00)={0x44, 0x0, &(0x7f0000000a80)=[@transaction={0x40406300, {0x1, 0x0, 0x0, 0x0, 0x21, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) r4 = openat$binder_debug(0xffffffffffffff9c, 0x0, 0x0, 0x0) read$FUSE(r4, &(0x7f0000007fc0)={0x2020}, 0x2020) executing program 1: syz_mount_image$fuse(0x0, &(0x7f0000002080)='./file0\x00', 0x208000, 0x0, 0x3d, 0x0, 0x0) r0 = open_tree(0xffffffffffffff9c, &(0x7f0000000640)='\x00', 0x89901) move_mount(r0, &(0x7f0000000140)='.\x00', 0xffffffffffffff9c, &(0x7f0000000180)='./file0\x00', 0x0) r1 = open_tree(0xffffffffffffff9c, &(0x7f0000000640)='\x00', 0x9801) move_mount(r1, &(0x7f0000000140)='.\x00', 0xffffffffffffff9c, &(0x7f0000000180)='./file0\x00', 0x0) chroot(&(0x7f0000001740)='./file0\x00') syz_open_procfs(0x0, &(0x7f0000000040)='mounts\x00') r2 = fsopen(&(0x7f0000000180)='proc\x00', 0x1) r3 = fsmount(r2, 0x1, 0x0) mprotect(&(0x7f0000000000/0x4000)=nil, 0x4000, 0x1) fchdir(r3) r4 = openat$fuse(0xffffffffffffff9c, &(0x7f0000000040), 0x42, 0x0) read$FUSE(r4, &(0x7f00000102c0)={0x2020}, 0x7) executing program 1: r0 = socket$inet6_sctp(0xa, 0x1, 0x84) r1 = dup(r0) setsockopt$inet_sctp6_SCTP_SOCKOPT_BINDX_ADD(r1, 0x84, 0x64, 0x0, 0x0) sendmsg$inet6(r0, 0x0, 0x20000896) dup(r0) write$UHID_INPUT(r1, 0x0, 0x0) openat$ppp(0xffffffffffffff9c, &(0x7f0000000140), 0x42000, 0x0) syz_open_dev$vim2m(&(0x7f0000000000), 0x800, 0x2) socket$netlink(0x10, 0x3, 0x0) syz_open_procfs(0xffffffffffffffff, &(0x7f0000000500)='status\x00') socketpair$unix(0x1, 0x1, 0x0, &(0x7f00000001c0)) openat$fuse(0xffffffffffffff9c, &(0x7f00000000c0), 0x2, 0x0) r2 = open_tree(0xffffffffffffff9c, &(0x7f0000000640)='\x00', 0x89901) mount_setattr(r2, 0x0, 0x8000, 0x0, 0x0) socket(0x10, 0x3, 0x0) socket$nl_generic(0x10, 0x3, 0x10) socket$nl_netfilter(0x10, 0x3, 0xc) socket$kcm(0x2, 0xa, 0x2) r3 = socket$unix(0x1, 0x1, 0x0) bind$unix(r3, &(0x7f00000000c0)=@file={0x1, '\xe9\x1fq\x89Y\x1e\x923aK\x00'}, 0x6e) listen(r3, 0x0) accept(r3, 0x0, 0x0) r4 = socket$nl_netfilter(0x10, 0x3, 0xc) syz_emit_vhci(&(0x7f0000000840)=ANY=[@ANYBLOB="04050400c900", @ANYRES16=r4], 0x7) executing program 1: r0 = syz_io_uring_setup(0xbdc, &(0x7f0000000640)={0x0, 0xecc0, 0x400, 0x1, 0x40000333}, 0x0, &(0x7f00000001c0), &(0x7f0000000000)) syz_io_uring_setup(0x4acf, &(0x7f0000000000)={0x0, 0x9e4e, 0x125, 0x3, 0x28d, 0x0, r0}, 0x0, 0x0, 0x0) executing program 34: r0 = syz_io_uring_setup(0xbdc, &(0x7f0000000640)={0x0, 0xecc0, 0x400, 0x1, 0x40000333}, 0x0, &(0x7f00000001c0), &(0x7f0000000000)) syz_io_uring_setup(0x4acf, &(0x7f0000000000)={0x0, 0x9e4e, 0x125, 0x3, 0x28d, 0x0, r0}, 0x0, 0x0, 0x0) executing program 2: mount_setattr(0xffffffffffffffff, 0x0, 0x0, &(0x7f0000000080)={0xb, 0x0, 0x40000}, 0x20) r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000480), 0x101301, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000040)={'syzkaller0\x00', 0x4e02}) io_setup(0xbf, &(0x7f0000000100)=0x0) io_submit(r1, 0x0, &(0x7f00000001c0)) executing program 2: bpf$MAP_CREATE(0x0, &(0x7f00000000c0)=@base={0x1b, 0x0, 0x0, 0x8000, 0x80000}, 0x50) mount$fuse(0x0, &(0x7f00000020c0)='./file0\x00', 0x0, 0x80, &(0x7f00000002c0)={{}, 0x2c, {'rootmode', 0x3d, 0x4000}}) syz_fuse_handle_req(0xffffffffffffffff, 0x0, 0x0, 0x0) syz_fuse_handle_req(0xffffffffffffffff, 0x0, 0x0, 0x0) getdents64(0xffffffffffffffff, 0x0, 0x0) r0 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPSET_CMD_CREATE(r0, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)={&(0x7f00000000c0)=ANY=[@ANYBLOB="4c0000000206010800000000000000000000003f0500010006000000050005000200000005000400000000000900020073797a310020000013000300686173683a"], 0x4c}}, 0x0) r1 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPSET_CMD_ADD(r1, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000300)={0x54, 0x9, 0x6, 0x201, 0x0, 0x0, {0x2, 0x0, 0xfdff}, [@IPSET_ATTR_DATA={0x2c, 0x7, 0x0, 0x1, [@IPSET_ATTR_IP={0xc, 0x1, 0x0, 0x1, @IPSET_ATTR_IPADDR_IPV4={0x8, 0x1, 0x1, 0x0, @multicast1}}, @IPSET_ATTR_IFACE={0x14, 0x17, 'batadv_slave_0\x00'}, @IPSET_ATTR_CADT_FLAGS={0x8, 0x8, 0x1, 0x0, 0x94}]}, @IPSET_ATTR_SETNAME={0x9, 0x2, 'syz1\x00'}, @IPSET_ATTR_PROTOCOL={0x5}]}, 0x54}}, 0x40c0080) executing program 2: r0 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000380)='./binderfs/binder0\x00', 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR_EXT(r0, 0x4018620d, &(0x7f00000000c0)={0x73622a85, 0xa, 0x8000000000002}) r1 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000200)='./binderfs/binder0\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000080)={0x8, 0x0, &(0x7f0000000400)=[@increfs], 0x0, 0x0, 0x0}) r2 = dup3(r1, r0, 0x0) r3 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000000)='./binderfs/binder0\x00', 0x0, 0x0) mmap$binder(&(0x7f0000ffd000/0x3000)=nil, 0x3000, 0x1, 0x11, r3, 0x0) ioctl$BINDER_SET_CONTEXT_MGR_EXT(r3, 0x4018620d, &(0x7f0000000040)={0x73622a85, 0x10a}) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f00000003c0)={0x8, 0x0, &(0x7f0000000340)=[@acquire], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000001040)={0x4c, 0x0, &(0x7f0000000ec0)=[@transaction_sg={0x40486311, {0x1, 0x0, 0x0, 0x0, 0x41, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x1000}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000001c0)={0x4c, 0x0, &(0x7f0000000740)=[@transaction_sg={0x40486311, {0x1, 0x0, 0x0, 0x0, 0x11, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x400}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000c00)={0x44, 0x0, &(0x7f0000000a80)=[@transaction={0x40406300, {0x1, 0x0, 0x0, 0x0, 0x21, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) r4 = openat$binder_debug(0xffffffffffffff9c, 0x0, 0x0, 0x0) read$FUSE(r4, &(0x7f0000007fc0)={0x2020}, 0x2020) executing program 2: syz_mount_image$fuse(0x0, &(0x7f0000002080)='./file0\x00', 0x208000, 0x0, 0x3d, 0x0, 0x0) r0 = open_tree(0xffffffffffffff9c, &(0x7f0000000640)='\x00', 0x89901) move_mount(r0, &(0x7f0000000140)='.\x00', 0xffffffffffffff9c, &(0x7f0000000180)='./file0\x00', 0x0) r1 = open_tree(0xffffffffffffff9c, &(0x7f0000000640)='\x00', 0x9801) move_mount(r1, &(0x7f0000000140)='.\x00', 0xffffffffffffff9c, &(0x7f0000000180)='./file0\x00', 0x0) chroot(&(0x7f0000001740)='./file0\x00') syz_open_procfs(0x0, &(0x7f0000000040)='mounts\x00') r2 = fsopen(&(0x7f0000000180)='proc\x00', 0x1) r3 = fsmount(r2, 0x1, 0x0) mprotect(&(0x7f0000000000/0x4000)=nil, 0x4000, 0x1) fchdir(r3) r4 = openat$fuse(0xffffffffffffff9c, &(0x7f0000000040), 0x42, 0x0) read$FUSE(r4, &(0x7f00000102c0)={0x2020}, 0x7) executing program 2: r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000100), 0x0, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000040)={'syzkaller0\x00', 0x2}) r1 = openat$tun(0xffffffffffffff9c, &(0x7f0000000400), 0x0, 0x0) close(r1) socket$inet_udp(0x2, 0x2, 0x0) ioctl$SIOCSIFHWADDR(r1, 0x8914, &(0x7f0000002280)={'syzkaller0\x00', @multicast}) r2 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r2, 0x8933, &(0x7f0000000100)={'syzkaller0\x00', 0x0}) sendmsg$nl_route_sched(r2, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000580)={&(0x7f0000000600)=@newqdisc={0x4c, 0x24, 0x4ee4e6a52ff56541, 0x1, 0x25dfdbfd, {0x0, 0x0, 0x0, r3, {0x0, 0xb}, {0xffff, 0xffff}, {0xfff2}}, [@qdisc_kind_options=@q_netem={{0xa}, {0x1c, 0x2, {{0x3, 0x3, 0x6361, 0x5, 0xffffffff, 0x3}}}}]}, 0x4c}, 0x1, 0x0, 0x0, 0x40088c1}, 0x0) r4 = socket$unix(0x1, 0x1, 0x0) r5 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r4, 0x8933, &(0x7f0000000100)={'syzkaller0\x00', 0x0}) sendmsg$nl_route_sched(r5, &(0x7f0000000200)={0x0, 0x0, &(0x7f0000000140)={&(0x7f00000004c0)=@newqdisc={0x58, 0x24, 0x4ee4e6a52ff56541, 0x70b923, 0x80000, {0x0, 0x0, 0x0, r6, {0x0, 0x9}, {0x0, 0xb}, {0x9, 0xb}}, [@qdisc_kind_options=@q_sfb={{0x8}, {0x2c, 0x2, @TCA_SFB_PARMS={0x28, 0x1, {0xd2b1, 0x84000002, 0x10001, 0x1, 0x80000000, 0x1ff, 0x8, 0x0, 0x2}}}}]}, 0x58}, 0x1, 0x0, 0x0, 0x2000c061}, 0x0) r7 = socket$nl_generic(0x10, 0x3, 0x10) r8 = syz_genetlink_get_family_id$tipc(0x0, r7) sendmsg$TIPC_CMD_ENABLE_BEARER(r7, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000280)={&(0x7f0000000680)=ANY=[@ANYBLOB='8\x00\x00\x00', @ANYRES16=r8, @ANYBLOB="010000000d0000000000010000000000000001410000001c001700000000000000006574683a73797a6b616c6c657230"], 0x38}}, 0x0) executing program 2: socket$nl_route(0x10, 0x3, 0x0) bpf$PROG_LOAD(0x5, &(0x7f0000000340)={0xd, 0x4, &(0x7f0000000180)=ANY=[], 0x0, 0x0, 0x0, 0x0, 0x41000, 0x2a, '\x00', 0x0, @fallback=0x3c, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0x7}, 0x94) r0 = socket$inet6(0xa, 0x2, 0x0) ioctl$sock_SIOCETHTOOL(r0, 0x89f0, &(0x7f0000000000)={'bridge0\x00', &(0x7f0000000340)=@ethtool_regs={0x7}}) executing program 35: socket$nl_route(0x10, 0x3, 0x0) bpf$PROG_LOAD(0x5, &(0x7f0000000340)={0xd, 0x4, &(0x7f0000000180)=ANY=[], 0x0, 0x0, 0x0, 0x0, 0x41000, 0x2a, '\x00', 0x0, @fallback=0x3c, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0x7}, 0x94) r0 = socket$inet6(0xa, 0x2, 0x0) ioctl$sock_SIOCETHTOOL(r0, 0x89f0, &(0x7f0000000000)={'bridge0\x00', &(0x7f0000000340)=@ethtool_regs={0x7}}) executing program 0: r0 = socket$inet(0x2, 0x3, 0xa) sendmmsg$inet(r0, &(0x7f0000000900)=[{{&(0x7f00000000c0)={0x2, 0x4e20, @empty}, 0x10, 0x0, 0x0, &(0x7f0000000ac0)=ANY=[@ANYBLOB="1c000000000000000000000007000000860a00000003"], 0x20}}], 0x1, 0x24000004) executing program 0: socket$nl_netfilter(0x10, 0x3, 0xc) socket$netlink(0x10, 0x3, 0x4) r0 = socket$inet6(0xa, 0x3, 0x5) sendmmsg(r0, &(0x7f0000001500)=[{{&(0x7f0000000040)=@l2tp6={0xa, 0x0, 0x7080000, @ipv4={'\x00', '\xff\xff', @loopback}, 0x7, 0x1}, 0x80, 0x0, 0x0, &(0x7f0000001580)=ANY=[@ANYBLOB="120000000000000029000000", @ANYRES64=r0], 0x108}}], 0x1, 0xc040) executing program 0: r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$nl80211(&(0x7f00000003c0), 0xffffffffffffffff) sendmsg$NL80211_CMD_START_P2P_DEVICE(0xffffffffffffffff, 0x0, 0x0) r2 = socket$nl_netfilter(0x10, 0x3, 0xc) ioctl$sock_SIOCGIFINDEX_80211(r2, 0x8933, &(0x7f0000000200)={'wlan0\x00', 0x0}) sendmsg$NL80211_CMD_SET_PMKSA(r0, &(0x7f0000000100)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000040)={0x60, r1, 0x63d, 0x70bd2a, 0x25dfdbff, {{}, {@val={0x8, 0x3, r3}, @void}}, [@NL80211_ATTR_PMKID={0x14, 0x55, "c8cf7f4639f3a71d5048b1b814d79e0b"}, @NL80211_ATTR_SSID={0xa, 0x34, @default_ibss_ssid}, @NL80211_ATTR_PMK={0x14, 0xfe, "81954acaf42aa86b0bf1a9be0bdc6fac"}, @NL80211_ATTR_FILS_CACHE_ID={0x6, 0xfd, 0x1}, @NL80211_ATTR_PMK_LIFETIME={0x8, 0x11f, 0x7}]}, 0x60}, 0x1, 0x0, 0x0, 0x801}, 0x20002884) executing program 0: r0 = socket$inet6(0xa, 0x5, 0x0) setsockopt$inet_int(r0, 0x0, 0xf, &(0x7f0000000340)=0xfffffffffffffff9, 0x4) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000200)=@newchain={0x24, 0x1e, 0x1, 0x0, 0x8000, {0x0, 0x0, 0x0, 0x0, {0x0, 0x8}, {0x4, 0xe}, {0x10, 0xb}}}, 0x24}, 0x1, 0x0, 0x0, 0x24001090}, 0x44004) socket$inet_icmp_raw(0x2, 0x3, 0x1) syz_genetlink_get_family_id$devlink(0x0, 0xffffffffffffffff) socket$nl_route(0x10, 0x3, 0x0) ioctl$BTRFS_IOC_QGROUP_LIMIT(0xffffffffffffffff, 0x8030942b, &(0x7f0000000300)={0x6, {0x2, 0x100, 0x8, 0x1, 0x576}}) syz_emit_ethernet(0xbe, 0x0, 0x0) r1 = socket$inet6_udp(0xa, 0x2, 0x0) setsockopt$inet6_IPV6_HOPOPTS(r1, 0x29, 0x36, 0x0, 0x0) r2 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r2, 0x0, 0x0) openat$ppp(0xffffffffffffff9c, 0x0, 0x101000, 0x0) socket$nl_xfrm(0x10, 0x3, 0x6) r3 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r3, &(0x7f0000000580)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000000)=@updpolicy={0xb8, 0x13, 0xcb23c9c9931e99e9, 0x0, 0x0, {{@in6=@private0, @in=@initdev={0xac, 0x1e, 0x0, 0x0}, 0x0, 0x0, 0x0, 0x0, 0xa, 0x60, 0x30, 0x0, 0x0, 0xee01}, {0x0, 0x0, 0x0, 0x0, 0x4}}}, 0xb8}}, 0x0) executing program 0: syz_usb_connect(0x2, 0x4e, &(0x7f0000000080)={{0x12, 0x1, 0x110, 0x47, 0xfe, 0x93, 0x40, 0x2caf, 0x13a3, 0xbddc, 0x1, 0x2, 0x3, 0x1, [{{0x9, 0x2, 0x3c, 0x2, 0x1, 0x2, 0x0, 0xd, "", [{{0x9, 0x4, 0x3e, 0xe3, 0x1, 0x60, 0x6a, 0xbc, 0x8, [], [{{0x9, 0x5, 0x0, 0x1, 0x10, 0xf4, 0x29, 0x81, [@generic={0x8, 0xb, "af33248a602c"}]}}]}}, {{0x9, 0x4, 0x8b, 0x86, 0x1, 0x2, 0x2, 0xff, 0x97, [], [{{0x9, 0x5, 0x0, 0x3, 0x20, 0x5, 0x81, 0xb0, [@generic={0x7, 0xb, "001521caf6"}]}}]}}]}}]}}, 0x0) executing program 8: r0 = bpf$PROG_LOAD(0x5, &(0x7f0000000180)={0xa, 0x5, &(0x7f0000000000)=ANY=[@ANYBLOB="18020000ff0300000000000000000000850000001100000085000000a000000095"], &(0x7f00000000c0)='syzkaller\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f0000000600)={r0, 0x0, 0xe, 0x0, &(0x7f0000000300)="e02742e8680d85ff978276fcf294", 0x0, 0x4002, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x50) executing program 8: r0 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) bind$bt_hci(r0, &(0x7f0000000000)={0x1f, 0xffff, 0x2}, 0x6) recvmmsg(r0, &(0x7f0000000580)=[{{&(0x7f0000000080)=@nl=@unspec, 0x80, &(0x7f00000005c0)=[{&(0x7f0000000100)=""/230, 0xe6}, {&(0x7f0000000240)=""/200, 0xc8}, {&(0x7f0000000340)=""/175, 0xaf}, {&(0x7f0000000400)=""/53, 0x35}, {&(0x7f0000000440)=""/119, 0x77}], 0x5, &(0x7f0000000540)=""/55, 0x37}}], 0x400000000000222, 0x0, 0x0) sendmsg$inet(r0, &(0x7f00000008c0)={0x0, 0x0, &(0x7f0000000780)=[{&(0x7f0000000740)='T*/\n', 0x4}], 0x1}, 0x4000) executing program 7: r0 = socket$nl_generic(0x10, 0x3, 0x10) ioctl$sock_SIOCGIFINDEX_80211(r0, 0x8933, &(0x7f00000003c0)={'wlan0\x00'}) syz_genetlink_get_family_id$nl80211(0x0, 0xffffffffffffffff) sendmsg$NL80211_CMD_FRAME(r0, 0x0, 0x0) connect$can_bcm(0xffffffffffffffff, 0x0, 0x0) r1 = socket$netlink(0x10, 0x3, 0x0) sendmsg$nl_route(r1, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000080)=ANY=[], 0x4c}}, 0x0) r2 = socket(0x2, 0x80805, 0x0) sendmmsg$inet(r2, &(0x7f0000001d80)=[{{&(0x7f0000000280)={0x2, 0x4e22, @private=0xa010101}, 0x10, &(0x7f0000000980)=[{&(0x7f0000000200)="9c", 0x1}], 0x1}}, {{&(0x7f0000000080)={0x2, 0x4e22, @rand_addr=0x64010104}, 0x10, &(0x7f0000000180)=[{&(0x7f00000000c0)="99", 0x1}], 0x1}}, {{&(0x7f0000000380)={0x2, 0x4e21, @initdev={0xac, 0x1e, 0x1, 0x0}}, 0x10, &(0x7f0000001c80)=[{&(0x7f0000000b00)='>', 0x1}], 0x1, &(0x7f0000001f40)=ANY=[@ANYBLOB="110000000000000000000000010000000b000000000000001400000000000000000000000200000001000080000000004c"], 0x80}}], 0x3, 0x48000) getsockopt$inet_sctp_SCTP_MAX_BURST(r2, 0x84, 0xc, &(0x7f0000000040)=@assoc_value, &(0x7f0000000000)=0x8) sendmsg$can_bcm(0xffffffffffffffff, &(0x7f0000000000)={0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x15}, 0x60040090) recvmmsg(0xffffffffffffffff, &(0x7f0000000280)=[{{0x0, 0x0, 0x0}, 0x40}], 0x15, 0x10040, 0x0) executing program 8: r0 = openat$dsp(0xffffffffffffff9c, &(0x7f0000000000), 0x42, 0x0) write$dsp(r0, &(0x7f0000000200), 0x0) r1 = syz_open_dev$sndctrl(&(0x7f0000001440), 0x0, 0x801) ioctl$SNDRV_CTL_IOCTL_PCM_PREFER_SUBDEVICE(r1, 0x40045532, &(0x7f0000000100)) r2 = syz_open_dev$sndpcmp(&(0x7f0000001200), 0x0, 0xa2c65) write$snddsp(r2, &(0x7f0000000200)="a3", 0x1) ioctl$SNDRV_PCM_IOCTL_DRAIN(r2, 0x4144, 0x0) ioctl$SNDRV_PCM_IOCTL_FORWARD(r2, 0x40084149, &(0x7f0000000040)=0x80000000) ioctl$SNDRV_PCM_IOCTL_HW_FREE(r2, 0x4112, 0x0) executing program 7: socket$kcm(0x10, 0x2, 0x0) socket$igmp(0x2, 0x3, 0x2) r0 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000580), 0xffffffffffffffff) r1 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$NL80211_CMD_SET_TID_CONFIG(r1, &(0x7f0000000680)={0x0, 0x0, &(0x7f0000000340)={&(0x7f0000000140)={0x38, r0, 0x10ada85e65c25359, 0xfffffffc, 0x25dfdbfd, {{0x6b}, {@val={0x8}, @val={0xc, 0x99, {0x7431, 0x2e}}}}, [@NL80211_ATTR_TID_CONFIG={0x10, 0x11d, 0x0, 0x1, [{0xc, 0x0, 0x0, 0x1, [@NL80211_TID_CONFIG_ATTR_TX_RATE={0x8, 0xd, 0x0, 0x1, [@NL80211_BAND_5GHZ={0x4}]}]}]}]}, 0x38}, 0x1, 0x0, 0x0, 0x8441}, 0x4000000) r2 = socket$nl_generic(0x10, 0x3, 0x10) socket$kcm(0x10, 0x2, 0x0) bpf$MAP_CREATE(0x0, &(0x7f00000009c0)=ANY=[], 0x48) socket$inet6_udp(0xa, 0x2, 0x0) socket(0x10, 0x3, 0x0) r3 = socket$nl_generic(0x11, 0x3, 0x10) syz_emit_ethernet(0x2a, &(0x7f0000000000)={@local, @broadcast, @void, {@ipv4={0x800, @igmp={{0x5, 0x4, 0x0, 0x3a, 0x1c, 0x7ffd, 0x0, 0x0, 0x2, 0x0, @broadcast, @loopback}, {0x17, 0x74, 0x0, @rand_addr=0x64010100}}}}}, 0x0) sendmsg(r3, &(0x7f0000000640)={&(0x7f00000000c0)=@caif=@dgm={0x25, 0xd}, 0x80, &(0x7f00000005c0)=[{&(0x7f0000000000)="4ba72c4cfd81685544f46c3f0800", 0x36}], 0x2, 0x0, 0x0, 0x11000000}, 0x0) bpf$PROG_LOAD(0x5, 0x0, 0x0) r4 = bpf$MAP_CREATE(0x0, &(0x7f0000000780)=ANY=[@ANYBLOB="19000000040000000800000008"], 0x50) r5 = bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x6, 0xd, &(0x7f0000000200)=ANY=[@ANYBLOB="1800000000000000000000000000000085000000bc00000018110000", @ANYRES32=r4, @ANYBLOB="0000000000000000b7080000000000007b8af8ff00000000bca2000000000000a6020000f8ffffffb703000008000000b704000000000400850000003300000095"], &(0x7f0000000180)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @xdp, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$MAP_UPDATE_ELEM_TAIL_CALL(0x2, &(0x7f0000000340)={{r4, 0xffffffffffffffff}, &(0x7f00000001c0), &(0x7f0000000300)=r5}, 0x20) r7 = socket$nl_generic(0x10, 0x3, 0x10) r8 = syz_genetlink_get_family_id$tipc2(&(0x7f0000000080), r2) sendmsg$TIPC_NL_MON_GET(r7, &(0x7f00000004c0)={&(0x7f0000000040)={0x10, 0x0, 0x0, 0x1000000}, 0xc, &(0x7f0000000440)={&(0x7f0000000400)={0x3c, r8, 0x311, 0x70bd29, 0x25dfdbfd, {}, [@TIPC_NLA_PUBL={0x24, 0x3, 0x0, 0x1, [@TIPC_NLA_PUBL_UPPER={0x8, 0x3, 0x1}, @TIPC_NLA_PUBL_TYPE={0x8, 0x1, 0x80000001}, @TIPC_NLA_PUBL_TYPE={0x8, 0x1, 0x7}, @TIPC_NLA_PUBL_LOWER={0x8, 0x2, 0x810e}]}, @TIPC_NLA_SOCK={0x4}]}, 0x3c}, 0x1, 0x0, 0x0, 0xdc63f6baf90ddeb5}, 0x20044880) bpf$MAP_UPDATE_ELEM(0x2, &(0x7f0000000000)={r6, &(0x7f0000000380)="0099", &(0x7f0000000480)=@udp6=r5, 0x2}, 0x20) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f0000000280)={r5, 0x5, 0xe, 0x0, &(0x7f00000003c0)="000000000000000000000001e370", 0x0, 0xff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x20}, 0x50) executing program 8: socket$key(0xf, 0x3, 0x2) syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) sendmsg$nl_route(0xffffffffffffffff, 0x0, 0x840) r0 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$nl_generic(r0, 0x0, 0xc000) r1 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) sendmsg$NLBL_MGMT_C_REMOVE(r1, &(0x7f0000000480)={&(0x7f0000000280)={0x10, 0x0, 0x0, 0x800000}, 0xc, &(0x7f0000000440)={&(0x7f00000002c0)={0x14, 0x0, 0x8, 0x70bd28, 0x25dfdbff}, 0x14}, 0x1, 0x0, 0x0, 0x4010}, 0x0) bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x11, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x40f00, 0x0, '\x00', 0x0, @fallback=0x2b, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) r2 = socket(0x1, 0x803, 0x0) getsockname$packet(r2, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) r4 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r4, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000300)={&(0x7f0000000340)=@ipv6_newaddr={0x34, 0x14, 0x9535393fea6295b5, 0x0, 0x0, {0xa, 0x40, 0x0, 0x0, r3}, [@IFA_LOCAL={0x14, 0x2, @ipv4}, @IFA_FLAGS={0x8, 0x8, 0x100}]}, 0x34}}, 0x0) r5 = socket(0x10, 0x803, 0x0) ioctl$SIOCX25SCALLUSERDATA(r2, 0x89e5, 0x0) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f07ebbeef, 0x8031, 0xffffffffffffffff, 0x215eb000) sendmsg$nl_route(r5, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000300)={&(0x7f0000000000)=@ipv6_newaddr={0x34, 0x14, 0x9535393fea6295b5, 0x0, 0x0, {0xa, 0x0, 0x0, 0x0, r3}, [@IFA_LOCAL={0x14, 0x2, @ipv4}, @IFA_FLAGS={0x8, 0x8, 0x210}]}, 0x34}}, 0x8000) executing program 5: r0 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$nl_generic(r0, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000440)={&(0x7f0000000240)=ANY=[@ANYBLOB="140000001e00010330bd7000f8dbdf2505"], 0x14}}, 0x0) mmap(&(0x7f0000001000/0xc00000)=nil, 0xc00000, 0x0, 0x1010, 0xffffffffffffffff, 0x4000) socket(0x11, 0x2, 0x10001) bpf$PROG_LOAD(0x5, 0x0, 0x0) setsockopt$SO_TIMESTAMPING(0xffffffffffffffff, 0x1, 0x41, 0x0, 0x0) bind$inet(0xffffffffffffffff, &(0x7f00000001c0)={0x2, 0x0, @local}, 0x10) syz_open_procfs$namespace(0x0, 0x0) getpeername(0xffffffffffffffff, 0x0, &(0x7f0000000700)) mmap(&(0x7f0000000000/0x3000)=nil, 0x3000, 0x2000001, 0x12, 0xffffffffffffffff, 0x0) executing program 5: r0 = openat$dsp(0xffffffffffffff9c, &(0x7f0000000000), 0x42, 0x0) write$dsp(r0, 0x0, 0x0) r1 = syz_open_dev$sndctrl(&(0x7f0000001440), 0x0, 0x801) ioctl$SNDRV_CTL_IOCTL_PCM_PREFER_SUBDEVICE(r1, 0x40045532, &(0x7f0000000100)) r2 = syz_open_dev$sndpcmp(&(0x7f0000001200), 0x0, 0xa2c65) write$snddsp(r2, &(0x7f0000000200)="a3", 0x1) ioctl$SNDRV_PCM_IOCTL_DRAIN(r2, 0x4144, 0x0) ioctl$SNDRV_PCM_IOCTL_FORWARD(r2, 0x40084149, &(0x7f0000000040)=0x80000000) executing program 7: bpf$PROG_LOAD_XDP(0x5, &(0x7f0000000040)={0x5, 0x0, 0x0, 0x0, 0x1000d, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x25, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0x3c}, 0x94) r0 = syz_genetlink_get_family_id$ethtool(&(0x7f0000000040), 0xffffffffffffffff) r1 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$ETHTOOL_MSG_PAUSE_SET(r1, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000cc0)={&(0x7f0000000080)=ANY=[@ANYBLOB=' \x00\x00\x00', @ANYRES16=r0, @ANYBLOB="0100000010651fbe347b2c2b00000c000180080001"], 0x20}}, 0x0) executing program 5: openat$ppp(0xffffffffffffff9c, &(0x7f0000000080), 0x100, 0x0) mprotect(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x5) r0 = socket(0xa, 0x3, 0xff) setsockopt$inet6_int(r0, 0x29, 0x21, 0x0, 0x0) sendto$inet6(r0, 0x0, 0x0, 0x24000844, &(0x7f00000005c0)={0xa, 0x2, 0x6, @private0, 0xdb}, 0x1c) executing program 5: r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = openat$tun(0xffffffffffffff9c, &(0x7f0000000140), 0x0, 0x0) ioctl$TUNSETIFF(r1, 0x400454ca, &(0x7f00000000c0)={'syzkaller1\x00', 0x2}) bpf$PROG_LOAD(0x5, &(0x7f0000000080)={0x6, 0x6, &(0x7f00000001c0)=ANY=[@ANYBLOB="18020000013f00000000000003000000850000002c00000018"], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @xdp=0x25, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0x4}, 0x94) readv(r1, &(0x7f00000001c0)=[{&(0x7f0000001400)=""/227, 0x10}], 0x4) r2 = socket$kcm(0x2, 0xa, 0x2) ioctl$sock_SIOCSIFVLAN_ADD_VLAN_CMD(r0, 0x8983, &(0x7f0000000080)={0x0, 'syzkaller1\x00', {0x4}, 0x1}) ioctl$SIOCSIFHWADDR(r2, 0x8914, &(0x7f0000000000)={'syzkaller1\x00', @link_local}) executing program 7: bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f0000000000)={0xffffffffffffffff, 0x27, 0x0, 0x0, 0x0, 0x0, 0x4000, 0xf2ffffff, 0x0, 0x0, 0x0, 0x0}, 0x50) r0 = socket(0x10, 0x803, 0x0) sendmsg$nl_route(r0, &(0x7f0000000600)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000000)=ANY=[@ANYBLOB="3800000056000100000000f70000000007020000", @ANYRES32, @ANYBLOB="200001"], 0x38}}, 0x0) executing program 7: r0 = socket$alg(0x26, 0x5, 0x0) bpf$MAP_CREATE(0x0, &(0x7f00000007c0)=ANY=[@ANYBLOB='\n\x00\x00\x00\v', @ANYRES32, @ANYBLOB='\x00'/20, @ANYRES32, @ANYBLOB="0000000000000000000000000000000000a7"], 0x50) bpf$MAP_UPDATE_ELEM_TAIL_CALL(0x2, &(0x7f00000002c0)={{}, &(0x7f0000000140), &(0x7f0000000280)}, 0x20) close(0x3) socket$inet6_sctp(0xa, 0x1, 0x84) socket$nl_netfilter(0x10, 0x3, 0xc) socket$nl_netfilter(0x10, 0x3, 0xc) syz_init_net_socket$x25(0x9, 0x5, 0x0) mmap(&(0x7f0000000000/0x800000)=nil, 0x800000, 0xb, 0xc3072, 0xffffffffffffffff, 0x0) socket$unix(0x1, 0x5, 0x0) r1 = socket$nl_generic(0x10, 0x3, 0x10) r2 = syz_genetlink_get_family_id$ethtool(&(0x7f0000000180), r1) sendmsg$ETHTOOL_MSG_COALESCE_SET(r1, &(0x7f0000000540)={0x0, 0x1f, &(0x7f0000000500)={&(0x7f00000001c0)=ANY=[@ANYBLOB='\\\x00\x00\x00', @ANYRES16=r2, @ANYBLOB="010000000000000000001400000008000200fc00000018000180140002006e657464657673696d300000000000000800050000fcffff08000900fc000000080011000700000008000e00800000000800", @ANYRES32=r1], 0x5c}, 0x1, 0x0, 0x0, 0x800}, 0x0) r3 = accept(r0, 0x0, 0x0) bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x1, 0xd, &(0x7f0000000300)=ANY=[@ANYBLOB="18000000000000000000000000000000850000002f00000018110000"], &(0x7f0000000240)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x40, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$PROG_LOAD_XDP(0x5, 0x0, 0x0) socket$packet(0x11, 0x3, 0x300) sendmsg$nl_route(r3, 0x0, 0x4091) executing program 0: r0 = socket$inet6_udp(0xa, 0x2, 0x0) bind$inet6(r0, &(0x7f0000000000)={0xa, 0xe22, 0x0, @empty}, 0x1c) r1 = socket$igmp6(0xa, 0x3, 0x2) setsockopt$IP6T_SO_SET_REPLACE(r1, 0x29, 0x40, &(0x7f0000000440)=@raw={'raw\x00', 0x8, 0x3, 0x4c8, 0x0, 0xffffffff, 0xffffffff, 0x0, 0xffffffff, 0x3f8, 0xffffffff, 0xffffffff, 0x3f8, 0xffffffff, 0x3, 0x0, {[{{@ipv6={@private0, @mcast2, [], [], 'veth0_macvtap\x00', 'bridge0\x00'}, 0x0, 0x148, 0x170, 0x0, {}, [@common=@unspec=@helper={{0x48}}, @common=@inet=@hashlimit1={{0x58}, {'bond_slave_1\x00', {0x41, 0x1ff, 0x6, 0xb0e2, 0x10001, 0x84e, 0xfffffffb, 0x18, 0x8}, {0x1}}}]}, @common=@unspec=@NFQUEUE0={0x28}}, {{@ipv6={@remote, @ipv4={'\x00', '\xff\xff', @dev}, [], [], 'erspan0\x00', 'gre0\x00', {0xff}, {}, 0x0, 0x0, 0x0, 0x4b}, 0x0, 0x258, 0x288, 0x0, {}, [@common=@inet=@hashlimit1={{0x58}, {'pim6reg\x00', {0x0, 0x0, 0x5, 0x0, 0x0, 0x7, 0x3ff}}}, @common=@inet=@hashlimit3={{0x158}, {'vcan0\x00', {0x3, 0x0, 0x41, 0xfffffffe, 0x2, 0x1000, 0x6, 0x3}}}]}, @common=@unspec=@CONNMARK={0x30}}], {{'\x00', 0x0, 0xa8, 0xd0}, {0x28, '\x00', 0x7}}}}, 0x528) connect$inet6(r0, &(0x7f0000000140)={0xa, 0x4e20, 0x6, @local, 0xb}, 0x1c) syz_emit_ethernet(0x7e, &(0x7f0000000300)={@local, @local, @void, {@ipv6={0x86dd, @udp={0x0, 0x6, "fa0500", 0x48, 0x11, 0x0, @local, @local, {[], {0x4e20, 0xe22, 0x48, 0x0, @wg=@cookie={0x3, 0x2, "88c73b21f267636d01dbe5712c1c941e1cdafbbb43f09c28", "e102060872381f41e5fff9620915b6f78670dfaf9a195fcb2a79cf6b7931c9b4"}}}}}}}, 0x0) executing program 6: r0 = openat$dsp(0xffffffffffffff9c, &(0x7f0000000000), 0x42, 0x0) write$dsp(r0, &(0x7f0000000200), 0x0) r1 = syz_open_dev$sndctrl(&(0x7f0000001440), 0x0, 0x801) ioctl$SNDRV_CTL_IOCTL_PCM_PREFER_SUBDEVICE(r1, 0x40045532, &(0x7f0000000100)) r2 = syz_open_dev$sndpcmp(&(0x7f0000001200), 0x0, 0xa2c65) write$snddsp(r2, &(0x7f0000000200)="a3", 0x1) ioctl$SNDRV_PCM_IOCTL_DRAIN(r2, 0x4144, 0x0) ioctl$SNDRV_PCM_IOCTL_FORWARD(r2, 0x40084149, &(0x7f0000000040)=0x80000000) ioctl$SNDRV_PCM_IOCTL_HW_FREE(r2, 0x4112, 0x0) executing program 7: sendmsg$nl_route_sched(0xffffffffffffffff, 0x0, 0x10) r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000200), 0x0, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000040)={'syzkaller0\x00', 0x2}) r1 = openat$tun(0xffffffffffffff9c, &(0x7f0000000400), 0x0, 0x0) close(r1) socket$nl_generic(0x10, 0x3, 0x10) ioctl$SIOCSIFHWADDR(r1, 0x8914, &(0x7f0000002280)={'syzkaller0\x00', @multicast}) r2 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r2, 0x8933, &(0x7f0000000100)={'syzkaller0\x00', 0x0}) sendmsg$nl_route_sched(r2, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000580)={&(0x7f0000000340)=@newqdisc={0x4c, 0x24, 0x4ee4e6a52ff56541, 0x70bd25, 0x25dfdbfd, {0x0, 0x0, 0x0, r3, {0x0, 0xb}, {0xffff, 0xffff}, {0xfff2}}, [@qdisc_kind_options=@q_netem={{0xa}, {0x1c, 0x2, {{0x3, 0x3, 0x4361, 0x7, 0xffffffff, 0x3}}}}]}, 0x4c}, 0x1, 0x0, 0x0, 0x8000}, 0x0) sendmsg$nl_route_sched(r2, &(0x7f00000003c0)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000440)=@newqdisc={0x44, 0x24, 0x4ee4e6a52ff56541, 0x70b927, 0x25dfdbfc, {0x0, 0x0, 0x0, r3, {0x0, 0xd}, {0x6, 0xb}, {0xb, 0x2}}, [@qdisc_kind_options=@q_cake={{0x9}, {0x14, 0x2, [@TCA_CAKE_AUTORATE={0x8, 0x9, 0x6}, @TCA_CAKE_MEMORY={0x8, 0xa, 0x5}]}}]}, 0x44}, 0x1, 0x0, 0x0, 0x240040e0}, 0x4890) r4 = socket$packet(0x11, 0x3, 0x300) sendto$packet(r4, &(0x7f0000000240)="800000800000210ee7decd7a000340", 0xf, 0x40, &(0x7f00000001c0)={0x11, 0x8100, r3, 0x1, 0xd8, 0x6, @broadcast}, 0x14) executing program 8: r0 = socket$inet(0x2, 0x1, 0x100) setsockopt$sock_int(r0, 0x1, 0x48, &(0x7f0000000040)=0x3, 0x4) connect$inet(r0, &(0x7f0000002040)={0x2, 0x4e24, @loopback}, 0x10) connect(r0, &(0x7f0000000380)=@in={0x2, 0x4e22, @empty}, 0x80) executing program 6: r0 = openat$dsp(0xffffffffffffff9c, &(0x7f0000000000), 0x42, 0x0) write$dsp(r0, &(0x7f0000000200), 0x0) r1 = syz_open_dev$sndctrl(&(0x7f0000001440), 0x0, 0x801) ioctl$SNDRV_CTL_IOCTL_PCM_PREFER_SUBDEVICE(r1, 0x40045532, &(0x7f0000000100)) r2 = syz_open_dev$sndpcmp(&(0x7f0000001200), 0x0, 0xa2c65) write$snddsp(r2, &(0x7f0000000200)="a3", 0x1) ioctl$SNDRV_PCM_IOCTL_DRAIN(r2, 0x4144, 0x0) ioctl$SNDRV_PCM_IOCTL_FORWARD(r2, 0x40084149, &(0x7f0000000040)=0x80000000) executing program 6: openat$ppp(0xffffffffffffff9c, &(0x7f0000000080), 0x100, 0x0) mprotect(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x5) r0 = socket(0xa, 0x3, 0xff) setsockopt$inet6_int(r0, 0x29, 0x21, 0x0, 0x0) sendto$inet6(r0, 0x0, 0x0, 0x24000844, &(0x7f00000005c0)={0xa, 0x2, 0x6, @private0, 0xdb}, 0x1c) executing program 5: r0 = socket$inet_udp(0x2, 0x2, 0x0) setsockopt$SO_TIMESTAMPING(r0, 0x1, 0x25, &(0x7f0000000200)=0x474c, 0x4) bind$inet(r0, &(0x7f0000000240)={0x2, 0x0, @local}, 0x6f) connect$inet(r0, &(0x7f0000000480)={0x2, 0x0, @multicast1}, 0x10) sendmmsg(r0, &(0x7f0000007fc0), 0x800001d, 0x300) setsockopt$inet_int(r0, 0x0, 0x19, &(0x7f0000000180)=0x1f5, 0x4) setsockopt$inet_int(r0, 0x0, 0x17, &(0x7f0000000880)=0x8, 0x4) recvmmsg(r0, &(0x7f0000008c00)=[{{0x0, 0x0, 0x0}}], 0x1, 0x45833af96e4b39fe, 0x0) executing program 8: r0 = openat$binder_debug(0xffffffffffffff9c, &(0x7f0000000040)='/sys/kernel/debug/binder/transactions\x00', 0x0, 0x0) r1 = openat$binderfs(0xffffffffffffff9c, &(0x7f00000000c0)='./binderfs/binder0\x00', 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR_EXT(r1, 0x4018620d, &(0x7f0000000100)) r2 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000140)='./binderfs/binder0\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000080)={0x8, 0x0, &(0x7f0000000400)=[@increfs], 0x0, 0x0, 0x0}) r3 = dup3(r2, r1, 0x0) r4 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000040)='./binderfs/binder0\x00', 0x0, 0x0) mmap$binder(&(0x7f0000ffd000/0x3000)=nil, 0x3000, 0x1, 0x11, r4, 0x0) ioctl$BINDER_SET_CONTEXT_MGR_EXT(r4, 0x4018620d, &(0x7f0000004a80)={0x73622a85, 0x100, 0x1}) ioctl$BINDER_WRITE_READ(r3, 0xc0306201, &(0x7f00000004c0)={0x8, 0x0, &(0x7f0000000000)=[@acquire], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r3, 0xc0306201, &(0x7f00000001c0)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) mmap$binder(&(0x7f0000ffe000/0x2000)=nil, 0x2000, 0x1, 0x11, r1, 0x10000000000) ioctl$BINDER_WRITE_READ(r4, 0xc0306201, &(0x7f0000000180)={0x0, 0x0, 0x0, 0x50, 0x0, &(0x7f0000000580)="b3185d7bb56f70f003360fa8bf71ac3086aedebf6fff904f92849a7a07395ee7f0e4cb1d78001c08a0ab73ffcf5ad07693727980eea946e6cba1723e81bfa5c3688803c8a124dcb27df7938e7ddfdd52"}) ioctl$BINDER_WRITE_READ(r4, 0xc0306201, &(0x7f0000004a40)={0x44, 0x0, &(0x7f00000049c0)=[@transaction={0x40406300, {0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) ioctl$BINDER_THREAD_EXIT(r4, 0x40046208, 0x0) read$FUSE(r0, &(0x7f0000004800)={0x2020}, 0x2020) executing program 6: r0 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$nl_generic(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000680)={0x18, 0x40, 0x1, 0xfffffffe, 0x25dfdbff, {0x1, 0x7c}, [@nested={0x4, 0x142}]}, 0x18}, 0x1, 0x0, 0x0, 0xc081}, 0x800c000) executing program 6: socket$rds(0x15, 0x5, 0x0) r0 = socket$alg(0x26, 0x5, 0x0) bind$alg(r0, 0x0, 0x0) bpf$MAP_CREATE(0x0, &(0x7f00000009c0)=@base={0xf, 0x4, 0x8, 0x8, 0x0, 0xffffffffffffffff, 0x2}, 0x50) bpf$PROG_LOAD(0x5, &(0x7f0000000600)={0x15, 0x3, &(0x7f0000000440)=@framed={{0x18, 0x0, 0x0, 0x0, 0xfffffffd, 0x0, 0x0, 0x0, 0x800}}, 0x0, 0x0, 0x0, 0x0, 0x1e00, 0x48, '\x00', 0x0, @sk_reuseport=0x28, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0xffffffff}, 0x94) bpf$BPF_PROG_TEST_RUN(0xa, 0x0, 0x0) setsockopt$ALG_SET_KEY(r0, 0x117, 0x1, 0x0, 0x0) syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r2 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) accept4$alg(r0, 0x0, 0x0, 0x800) r3 = syz_genetlink_get_family_id$netlbl_mgmt(&(0x7f0000000040), r2) sendmsg$NLBL_MGMT_C_ADDDEF(r1, &(0x7f0000000300)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000280)={0x34, r3, 0x1, 0x70bd2c, 0x25dfdbfe, {}, [@NLBL_MGMT_A_IPV4MASK={0x8, 0x8, @local}, @NLBL_MGMT_A_PROTOCOL={0x8, 0x2, 0x3}, @NLBL_MGMT_A_IPV4ADDR={0x8, 0x7, @remote}, @NLBL_MGMT_A_CV4DOI={0x8, 0x4, 0x3}]}, 0x34}, 0x1, 0x0, 0x0, 0x2400cc04}, 0x0) executing program 5: syz_usb_connect(0x2, 0x4e, &(0x7f0000000080)={{0x12, 0x1, 0x110, 0x47, 0xfe, 0x93, 0x40, 0x2caf, 0x13a3, 0xbddc, 0x1, 0x2, 0x3, 0x1, [{{0x9, 0x2, 0x3c, 0x2, 0x1, 0x2, 0x0, 0xd, "", [{{0x9, 0x4, 0x3e, 0xe3, 0x1, 0x60, 0x6a, 0xbc, 0x8, [], [{{0x9, 0x5, 0x0, 0x1, 0x10, 0xf4, 0x29, 0x81, [@generic={0x8, 0xb, "af33248a602c"}]}}]}}, {{0x9, 0x4, 0x8b, 0x86, 0x1, 0x2, 0x2, 0xff, 0x97, [], [{{0x9, 0x5, 0x0, 0x3, 0x20, 0x5, 0x81, 0xb0, [@generic={0x7, 0xb, "001521caf6"}]}}]}}]}}]}}, 0x0) executing program 6: r0 = bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x6, 0x4, &(0x7f0000000080)=ANY=[@ANYBLOB="1800000002000000000000000000000085000000bc00000095"], &(0x7f0000000200)='GPL\x00', 0x4, 0x0, 0x0, 0x0, 0x29, '\x00', 0x0, @fallback=0x2a, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) r1 = socket$inet_tcp(0x2, 0x1, 0x0) ioctl$sock_SIOCGIFINDEX(r1, 0x8933, &(0x7f0000000180)={'syz_tun\x00', 0x0}) bpf$BPF_LINK_CREATE_XDP(0x1c, &(0x7f00000005c0)={r0, r2, 0x25, 0x0, @val=@iter={0x0}}, 0x20) syz_emit_ethernet(0xd81, &(0x7f0000000600)={@local, @link_local={0x1, 0x80, 0xc2, 0x0, 0x0, 0x1}, @val={@void, {0x8100, 0x4, 0x1}}, {@mpls_uc={0x8847, {[], @ipv6=@generic={0x9, 0x6, "42e05d", 0xd47, 0x5c, 0x1, @loopback, @private1, {[@hopopts={0x3b, 0x18b, '\x00', [@hao={0xc9, 0x10, @private1}, @calipso={0x7, 0x48, {0x3, 0x10, 0x0, 0x2, [0x7dc, 0x9, 0x7, 0x7ff, 0xfffffffffffff44f, 0xfff, 0x9, 0x8]}}, @generic={0x7, 0x7b, "15150516342241d33f2f84419cd0ade5ead47f040f3610e0e64553bf3410243438486330d290af3e2a7347207e3096c9f52ae8fa46bb92954b5c4c8ddd25c8222c8e89291bbf3708eaf1cff9de108813e7d75f55f342443d057d1370fddf3a0525054239a4a929e53efdceba1f264486dd705079a5159b644cab60"}, @generic={0xb6, 0xb7e, "dcc90b7af212186183e96f505753a6bac53a363b8fea5b6f8ae2ffa5e616fb00ce4a776634ec4850a4336077d815b910c33440425503122672698c7f18eae511fabe74fff308983388351bedd123432d693ece874bc53b7cd6236bbf793f36fe58d256038f7bc58958b28b42e670a1e6c34be414b6ae7d19038ec6c9a1c5f5e726764e536e0c9947b044d126c68feaa30e71f6e99b15d78a283fc5948a0963f563ac50bedc5d4e4cccd75473a1f7048b5ec17441be54e319a19be0a405054fe58e8a082f53b4a4cbd649e76fde6fae7a1e2e1b07e29e94bbb1096d12a4b4ffa9eead4d2945653a0f1860cbd57c218fc8bd08943eca3246fd11a13d6551798f766702da5ce0f56b7a7db290e7f01bb26be889e8abc62c18ac4d9437b2d2133bae88ba5b2847c1916ac4a926cc51bbd5a723af30fd732e0118b78accd99bcd2d5406948f5f7b5fe2f3f12bb6dd940fc079dfceada5e2be2c011a836ce08a9966986c372a872cc3d17d5d34be3dd9f3751ab3821efb99006244fd3572fa6ee4e64558bdc9e704caa56175247ba767525d36f27d0664ecf57a18b28e8fea0baae0d944bb61c81ada0bf3a82cf3022c3d38cb857710212f46327c0899a8e998065a1700a4afb0023703607b8ec5a32826fea96f7c3b6d59e5541548eb5fed861392f04d5e5d9f487e6f41a09bddec16b3eb1089d5f3a1e97a755f4350a82f054eb13e06e77cdc5e4862dcc606cc26609734220cb35e27eabe1a339da9411a100bdbe973d27ab8a5a53ca1c0356c9608c5557feb8e376f9844a0cb6fe9ae6905f565fe8d62acffb89255459e95fb1d5340e3c9b95240eff2041d580a7469d4fa0b409d43ea489fb7fb20b0ea89d4c43430532cd2a273b97187335b605dd9a453d5f343642ae852e7e25006785eac4b1027f5aa7999ff1eeb16f118ca01a394914c6358f5667df96d8428034ecd7b600e4fd749171343ac8e5557e21614eb6c42633c919ddc7a9f9cf4d08b2e94db8f5a3aec1d63e5b8665e7f5007ef415866681d0e2520bed0a97af32c04591911257c71b7a1614447f8b520099781662f68f579a84ebcda93d0fe37c6423697c3492709da0f007a293a3142620478a7aad12baf7dc3ad15e2b1db8f8af17c8419208abf86fa188eda5c563961edaa2d47104b076f442d39b87dd4d254b92b3bbe2b8a95be230721a07631fe9066e6dcfb4c96e3b74acb93ae21e55d7e9b0a9b5b59f0ac7628262b960fcbd0a86e44223ca6d76fdedce62ecabb7b02f1f705862a2b60297d17f295275c80e8fb0791453847183d7cfb3e08f87b7ecd0ae24481df38a352c54227a20c60b899854287bbae06f974e74481419a6f705fd2b516d452c55fb87df013bbd714a0fe39cec0a18e4973407f45da2cccbc3004e0c62b6ae8bfb9c65400a22622bd9ff50cdf93e9031dd05c4afc5cc30d61d3c013b1c474695ca62d452ec6cdfbc21730b3cfdbdf815b508121dbb3af2b2b7235a2dd933d4ad2f82a59ec3fe8823b9730a4d2dcdb719f341cafd458752e23dac67b028988195ec33617f91921daa1f74a32970ad36bc4793bd4c40a83fefebf94db566cb2025be3cb05c3fd2abb99df00901c444cb56c64cb96eafba1e33bb5077168a4b0b8446b2cefca6b1d9d63ff1cce61e0b3ef3021c6270a799f94e0efd62e9a9d8c628b88fc07354d7ef8ea7f9b251456ad56d943e3f0092d7042c35bd94970cc5b7fe2364da0bae7f4fb0bf7a3bb3212f079a69b53fbe11afc0dbff7f005b12d6cec9e7169ebf8dfda4bb7d3211cabc7cffe7a0c1c1e496720209041c7f95aac0f49126ca7a5620f9f709bb72ba32ac6afe0acbfe3bee20b406d98b7e7bbe263b76fdb963c9e84c06c168aaac23c921feba4b2ef064f79aa1092fd2fc435feecee01ee10ebbd11199f6ee343e45dfc69b9f10fd86c85d4d3adf2d8d9be8c692fce1d92ce544bd53f33be2f40219953fd17842e0b608eb2d9e0db97286af10da05d6d3f2cebc5ae79d5fd3a7517f51c95ebc1044cdb711d03239b713553d5f99d9fdf7ac5dfe92e2c1a16c6de7f3c157698d8f96e3f46d2c9fca0de48fe3630afb2064686ba0c1734c37f0e9303488e9209025651142a87e8b1af770de99bc0b93c1cd9cf186bee7642588ea7f2f897f765b405dced642901d755c984de04602ca607a2cdd25f45eb7380d92ac70a80155a15438654ec26a3a90fe0fb8ae0bafe187440643dd3d29de3550d97f0b67c84f101e21c158279b18c29468e8b8968fc08ab5d794407f2a0cdcd31f23ba3c8e8ef0cd14a5be81ad4260142a457962171d216983c1d9a4ba1cf7009098d8d6848b12a6d14ef2fff856a5e3064e3ff2d9047e97c58644dce9a5c1c73c7cd3dcee911fda15cdbbf1e24a7f9d800f0197fa5af4a853a63d48a3fddc593bb68ebe0cd086359b69aa3f3b22b18d55bbad6a8c878f3bbc4730344fc84967fded81a7b7c651f6b121da407b818ff3516056bec3f4b4e6e8341de95a48614af93db4a7c74a96c3da0f623e58d0b224864d58d952359f13c01e322b2a8f9c2d564aaf25b0d83804b86bedb8db62d36dbb27437d7dc953d4b91270fd31b9fb50684b7bdf3ab78be0f94601feeceaba24cfd9ca2e3e9708f724b070d6153fc44fd68aa375037fb83b77a988d6e12c05e0ff9eb954fd732017979f0bdf7ba44c2b96d47815cd1527fd57cfbffa58c0e6727f1c56ff01fb78dc0aab374ef6b9bf409f3a1751f1935fad983a8def7de2c594b37fdcc29bceaff0e8d1aecd8bd938b3cbc5eed823897be22f1c037a73831b69e5148d11baeeb9b32ad016fe327705a59f7f40dd4bf4ca7ff1c5326dc24d81cbeeacfe6bbd9e9a44b56d8cc1eddb652744c0b2201d7014f9a49f55ee2b940f84a0369d5e81b5323321c89254fffa4d201c7a1eb032efc53607c48b5ebae48d80ad49bdaa20e13c9060692d50f50353ccadffa02cae0dfec8f60bbaef885cb16c2f02077762fc7518d28004e9630273a493ff53499499d766c60b0310e39a9c6c9db6c0a63f73f9e5089dade79e1939a88d6046cabaaed7588cd651761a1ca25be434e0280744693e3134fcd9d89e11cff18a841f4e2209aa9d52c2c257c95e283957c097227c493741d8a9a7fc5ac5e4c86dac5b419c8bc4a697534c1febfd52f9353805f554e30fb3f8c0bd977a83bbf2bdfb019cdd958af21dc00f54e86a0bf3df7219e1ca9c900646921c138404be38c279dcfcdd68a012715f6f0c5d68e5365658ac8b121868afe1d7f9ec07ed3b4b2ef49a3f07facdaccc07dd87b187a2dbb9e49b37c22b818d47f8cb27045c8b6e3ef1656072d7fdc23ab9a8e28506b52d04ae642152f4d6fd03f50537e9a7baa9e3a9ceb209b04f2844be5dca1526f9f1fcc8b57f33ada774f8262da08fb7f2b73cdc818e7788a240e656794a7186f4cfc0edb4940e73807b0dd39320056d1a9750041adf833562744323e9c492b2e199bbb8b2a647293e6b1e38e8022c0924a2dcccd406eab7c0d0caaf9ad4023bb57371c2a9de61b42363a266def05c178437715af52b1d424acf73f3298e8dfd02d849bd0d0d15a99026296cb6c9043909360b3173bd317834ca84261ffed928c83e058505abacde4171b14edb48450124bb253e8c35f6f44784b35c5b7cf761d25fc840bf88e8bb15adb3ca3a548d5727122c97209ff2321d46bfa5cb18a8c03b386c9aaef40ac79d5b5efc977447ac5b85df24cbe4365c996652f210a9477e57e137423b83f43cd217caa9be580735336400ad0b954469a56c0046e1123e00654c64d70d62cb07e90b7e475b8cae3e34e47ffd8bc282c7698c25fd5befe1719c1caec7771744ac07e2892c86ec383756d0fd055d4c8dbdef397e2f2c72ae9896db73830c47f0cfb06e8ea24da40daab915ba4c8d48a5ca30f9b51870eb92a7fbb927995249844b837fcc4dcbb7a04dee8d5c58fb2f16c046f2f8ebb480272c6250f69253fff678ba0d743c227ab4cde125da60d692376174d8d50d5ec735a80a69e32b23d128f6b8304570f3d600b354904ad9ed8d1e63ad336dc32f22be895af6943678fb3c924853e8cbb94f2d67090da239978c5caada0eaabe08e4dd2ce2b1ee8bafde0caf0c7b4e4cde188672b976e5d181337ec1d9ae2fa"}]}], "d443c4cd9262f2486153ea3f91e8d049fe1b44045f39b19bb735a99b66dd4f1e4bf3983d25e227c1013778774871609abb5c0fc06a61b35269e3b9a16e0dc07de3f32c3e6f543eaede0b600656968bc5ae6c090f334ad5b844f0232249e82328a61f620284d0b7da4640bbf84af374b6bdb6397a8a9155425618b8c659d53ae48c4be4538b1c0cad4950808c933e163c4897f9f13df0956bb82390f02fd2fc82e8323c9b849b0a7978e17b8a25f378c80e6e1d2f50f5a1587ccdf0e983f45be2ab36432ef1969e33a0e0dbb64f6a441cc69eb88a7da09108caf797904ce346"}}}}}}, 0x0) program crashed: WARNING in hugetlb_split bisect: bisecting 58 programs bisect: split chunks (needed=false): <57> bisect: split chunk #0 of len 57 into 3 parts bisect: testing without sub-chunk 1/3 testing program (duration=6m9s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): [2, 2, 5, 9, 14, 13, 16, 4, 4, 2, 4, 6, 16, 1, 2, 4, 12, 9, 22, 16, 10, 8, 4, 5, 8, 3, 18, 6, 9, 13, 4, 8, 5, 8, 16, 2, 14, 1, 5] detailed listing: executing program 1: r0 = syz_io_uring_setup(0xbdc, &(0x7f0000000640)={0x0, 0xecc0, 0x400, 0x1, 0x40000333}, 0x0, &(0x7f00000001c0), &(0x7f0000000000)) syz_io_uring_setup(0x4acf, &(0x7f0000000000)={0x0, 0x9e4e, 0x125, 0x3, 0x28d, 0x0, r0}, 0x0, 0x0, 0x0) executing program 34: r0 = syz_io_uring_setup(0xbdc, &(0x7f0000000640)={0x0, 0xecc0, 0x400, 0x1, 0x40000333}, 0x0, &(0x7f00000001c0), &(0x7f0000000000)) syz_io_uring_setup(0x4acf, &(0x7f0000000000)={0x0, 0x9e4e, 0x125, 0x3, 0x28d, 0x0, r0}, 0x0, 0x0, 0x0) executing program 2: mount_setattr(0xffffffffffffffff, 0x0, 0x0, &(0x7f0000000080)={0xb, 0x0, 0x40000}, 0x20) r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000480), 0x101301, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000040)={'syzkaller0\x00', 0x4e02}) io_setup(0xbf, &(0x7f0000000100)=0x0) io_submit(r1, 0x0, &(0x7f00000001c0)) executing program 2: bpf$MAP_CREATE(0x0, &(0x7f00000000c0)=@base={0x1b, 0x0, 0x0, 0x8000, 0x80000}, 0x50) mount$fuse(0x0, &(0x7f00000020c0)='./file0\x00', 0x0, 0x80, &(0x7f00000002c0)={{}, 0x2c, {'rootmode', 0x3d, 0x4000}}) syz_fuse_handle_req(0xffffffffffffffff, 0x0, 0x0, 0x0) syz_fuse_handle_req(0xffffffffffffffff, 0x0, 0x0, 0x0) getdents64(0xffffffffffffffff, 0x0, 0x0) r0 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPSET_CMD_CREATE(r0, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)={&(0x7f00000000c0)=ANY=[@ANYBLOB="4c0000000206010800000000000000000000003f0500010006000000050005000200000005000400000000000900020073797a310020000013000300686173683a"], 0x4c}}, 0x0) r1 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPSET_CMD_ADD(r1, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000300)={0x54, 0x9, 0x6, 0x201, 0x0, 0x0, {0x2, 0x0, 0xfdff}, [@IPSET_ATTR_DATA={0x2c, 0x7, 0x0, 0x1, [@IPSET_ATTR_IP={0xc, 0x1, 0x0, 0x1, @IPSET_ATTR_IPADDR_IPV4={0x8, 0x1, 0x1, 0x0, @multicast1}}, @IPSET_ATTR_IFACE={0x14, 0x17, 'batadv_slave_0\x00'}, @IPSET_ATTR_CADT_FLAGS={0x8, 0x8, 0x1, 0x0, 0x94}]}, @IPSET_ATTR_SETNAME={0x9, 0x2, 'syz1\x00'}, @IPSET_ATTR_PROTOCOL={0x5}]}, 0x54}}, 0x40c0080) executing program 2: r0 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000380)='./binderfs/binder0\x00', 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR_EXT(r0, 0x4018620d, &(0x7f00000000c0)={0x73622a85, 0xa, 0x8000000000002}) r1 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000200)='./binderfs/binder0\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000080)={0x8, 0x0, &(0x7f0000000400)=[@increfs], 0x0, 0x0, 0x0}) r2 = dup3(r1, r0, 0x0) r3 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000000)='./binderfs/binder0\x00', 0x0, 0x0) mmap$binder(&(0x7f0000ffd000/0x3000)=nil, 0x3000, 0x1, 0x11, r3, 0x0) ioctl$BINDER_SET_CONTEXT_MGR_EXT(r3, 0x4018620d, &(0x7f0000000040)={0x73622a85, 0x10a}) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f00000003c0)={0x8, 0x0, &(0x7f0000000340)=[@acquire], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000001040)={0x4c, 0x0, &(0x7f0000000ec0)=[@transaction_sg={0x40486311, {0x1, 0x0, 0x0, 0x0, 0x41, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x1000}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000001c0)={0x4c, 0x0, &(0x7f0000000740)=[@transaction_sg={0x40486311, {0x1, 0x0, 0x0, 0x0, 0x11, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x400}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000c00)={0x44, 0x0, &(0x7f0000000a80)=[@transaction={0x40406300, {0x1, 0x0, 0x0, 0x0, 0x21, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) r4 = openat$binder_debug(0xffffffffffffff9c, 0x0, 0x0, 0x0) read$FUSE(r4, &(0x7f0000007fc0)={0x2020}, 0x2020) executing program 2: syz_mount_image$fuse(0x0, &(0x7f0000002080)='./file0\x00', 0x208000, 0x0, 0x3d, 0x0, 0x0) r0 = open_tree(0xffffffffffffff9c, &(0x7f0000000640)='\x00', 0x89901) move_mount(r0, &(0x7f0000000140)='.\x00', 0xffffffffffffff9c, &(0x7f0000000180)='./file0\x00', 0x0) r1 = open_tree(0xffffffffffffff9c, &(0x7f0000000640)='\x00', 0x9801) move_mount(r1, &(0x7f0000000140)='.\x00', 0xffffffffffffff9c, &(0x7f0000000180)='./file0\x00', 0x0) chroot(&(0x7f0000001740)='./file0\x00') syz_open_procfs(0x0, &(0x7f0000000040)='mounts\x00') r2 = fsopen(&(0x7f0000000180)='proc\x00', 0x1) r3 = fsmount(r2, 0x1, 0x0) mprotect(&(0x7f0000000000/0x4000)=nil, 0x4000, 0x1) fchdir(r3) r4 = openat$fuse(0xffffffffffffff9c, &(0x7f0000000040), 0x42, 0x0) read$FUSE(r4, &(0x7f00000102c0)={0x2020}, 0x7) executing program 2: r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000100), 0x0, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000040)={'syzkaller0\x00', 0x2}) r1 = openat$tun(0xffffffffffffff9c, &(0x7f0000000400), 0x0, 0x0) close(r1) socket$inet_udp(0x2, 0x2, 0x0) ioctl$SIOCSIFHWADDR(r1, 0x8914, &(0x7f0000002280)={'syzkaller0\x00', @multicast}) r2 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r2, 0x8933, &(0x7f0000000100)={'syzkaller0\x00', 0x0}) sendmsg$nl_route_sched(r2, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000580)={&(0x7f0000000600)=@newqdisc={0x4c, 0x24, 0x4ee4e6a52ff56541, 0x1, 0x25dfdbfd, {0x0, 0x0, 0x0, r3, {0x0, 0xb}, {0xffff, 0xffff}, {0xfff2}}, [@qdisc_kind_options=@q_netem={{0xa}, {0x1c, 0x2, {{0x3, 0x3, 0x6361, 0x5, 0xffffffff, 0x3}}}}]}, 0x4c}, 0x1, 0x0, 0x0, 0x40088c1}, 0x0) r4 = socket$unix(0x1, 0x1, 0x0) r5 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r4, 0x8933, &(0x7f0000000100)={'syzkaller0\x00', 0x0}) sendmsg$nl_route_sched(r5, &(0x7f0000000200)={0x0, 0x0, &(0x7f0000000140)={&(0x7f00000004c0)=@newqdisc={0x58, 0x24, 0x4ee4e6a52ff56541, 0x70b923, 0x80000, {0x0, 0x0, 0x0, r6, {0x0, 0x9}, {0x0, 0xb}, {0x9, 0xb}}, [@qdisc_kind_options=@q_sfb={{0x8}, {0x2c, 0x2, @TCA_SFB_PARMS={0x28, 0x1, {0xd2b1, 0x84000002, 0x10001, 0x1, 0x80000000, 0x1ff, 0x8, 0x0, 0x2}}}}]}, 0x58}, 0x1, 0x0, 0x0, 0x2000c061}, 0x0) r7 = socket$nl_generic(0x10, 0x3, 0x10) r8 = syz_genetlink_get_family_id$tipc(0x0, r7) sendmsg$TIPC_CMD_ENABLE_BEARER(r7, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000280)={&(0x7f0000000680)=ANY=[@ANYBLOB='8\x00\x00\x00', @ANYRES16=r8, @ANYBLOB="010000000d0000000000010000000000000001410000001c001700000000000000006574683a73797a6b616c6c657230"], 0x38}}, 0x0) executing program 2: socket$nl_route(0x10, 0x3, 0x0) bpf$PROG_LOAD(0x5, &(0x7f0000000340)={0xd, 0x4, &(0x7f0000000180)=ANY=[], 0x0, 0x0, 0x0, 0x0, 0x41000, 0x2a, '\x00', 0x0, @fallback=0x3c, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0x7}, 0x94) r0 = socket$inet6(0xa, 0x2, 0x0) ioctl$sock_SIOCETHTOOL(r0, 0x89f0, &(0x7f0000000000)={'bridge0\x00', &(0x7f0000000340)=@ethtool_regs={0x7}}) executing program 35: socket$nl_route(0x10, 0x3, 0x0) bpf$PROG_LOAD(0x5, &(0x7f0000000340)={0xd, 0x4, &(0x7f0000000180)=ANY=[], 0x0, 0x0, 0x0, 0x0, 0x41000, 0x2a, '\x00', 0x0, @fallback=0x3c, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0x7}, 0x94) r0 = socket$inet6(0xa, 0x2, 0x0) ioctl$sock_SIOCETHTOOL(r0, 0x89f0, &(0x7f0000000000)={'bridge0\x00', &(0x7f0000000340)=@ethtool_regs={0x7}}) executing program 0: r0 = socket$inet(0x2, 0x3, 0xa) sendmmsg$inet(r0, &(0x7f0000000900)=[{{&(0x7f00000000c0)={0x2, 0x4e20, @empty}, 0x10, 0x0, 0x0, &(0x7f0000000ac0)=ANY=[@ANYBLOB="1c000000000000000000000007000000860a00000003"], 0x20}}], 0x1, 0x24000004) executing program 0: socket$nl_netfilter(0x10, 0x3, 0xc) socket$netlink(0x10, 0x3, 0x4) r0 = socket$inet6(0xa, 0x3, 0x5) sendmmsg(r0, &(0x7f0000001500)=[{{&(0x7f0000000040)=@l2tp6={0xa, 0x0, 0x7080000, @ipv4={'\x00', '\xff\xff', @loopback}, 0x7, 0x1}, 0x80, 0x0, 0x0, &(0x7f0000001580)=ANY=[@ANYBLOB="120000000000000029000000", @ANYRES64=r0], 0x108}}], 0x1, 0xc040) executing program 0: r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$nl80211(&(0x7f00000003c0), 0xffffffffffffffff) sendmsg$NL80211_CMD_START_P2P_DEVICE(0xffffffffffffffff, 0x0, 0x0) r2 = socket$nl_netfilter(0x10, 0x3, 0xc) ioctl$sock_SIOCGIFINDEX_80211(r2, 0x8933, &(0x7f0000000200)={'wlan0\x00', 0x0}) sendmsg$NL80211_CMD_SET_PMKSA(r0, &(0x7f0000000100)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000040)={0x60, r1, 0x63d, 0x70bd2a, 0x25dfdbff, {{}, {@val={0x8, 0x3, r3}, @void}}, [@NL80211_ATTR_PMKID={0x14, 0x55, "c8cf7f4639f3a71d5048b1b814d79e0b"}, @NL80211_ATTR_SSID={0xa, 0x34, @default_ibss_ssid}, @NL80211_ATTR_PMK={0x14, 0xfe, "81954acaf42aa86b0bf1a9be0bdc6fac"}, @NL80211_ATTR_FILS_CACHE_ID={0x6, 0xfd, 0x1}, @NL80211_ATTR_PMK_LIFETIME={0x8, 0x11f, 0x7}]}, 0x60}, 0x1, 0x0, 0x0, 0x801}, 0x20002884) executing program 0: r0 = socket$inet6(0xa, 0x5, 0x0) setsockopt$inet_int(r0, 0x0, 0xf, &(0x7f0000000340)=0xfffffffffffffff9, 0x4) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000200)=@newchain={0x24, 0x1e, 0x1, 0x0, 0x8000, {0x0, 0x0, 0x0, 0x0, {0x0, 0x8}, {0x4, 0xe}, {0x10, 0xb}}}, 0x24}, 0x1, 0x0, 0x0, 0x24001090}, 0x44004) socket$inet_icmp_raw(0x2, 0x3, 0x1) syz_genetlink_get_family_id$devlink(0x0, 0xffffffffffffffff) socket$nl_route(0x10, 0x3, 0x0) ioctl$BTRFS_IOC_QGROUP_LIMIT(0xffffffffffffffff, 0x8030942b, &(0x7f0000000300)={0x6, {0x2, 0x100, 0x8, 0x1, 0x576}}) syz_emit_ethernet(0xbe, 0x0, 0x0) r1 = socket$inet6_udp(0xa, 0x2, 0x0) setsockopt$inet6_IPV6_HOPOPTS(r1, 0x29, 0x36, 0x0, 0x0) r2 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r2, 0x0, 0x0) openat$ppp(0xffffffffffffff9c, 0x0, 0x101000, 0x0) socket$nl_xfrm(0x10, 0x3, 0x6) r3 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r3, &(0x7f0000000580)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000000)=@updpolicy={0xb8, 0x13, 0xcb23c9c9931e99e9, 0x0, 0x0, {{@in6=@private0, @in=@initdev={0xac, 0x1e, 0x0, 0x0}, 0x0, 0x0, 0x0, 0x0, 0xa, 0x60, 0x30, 0x0, 0x0, 0xee01}, {0x0, 0x0, 0x0, 0x0, 0x4}}}, 0xb8}}, 0x0) executing program 0: syz_usb_connect(0x2, 0x4e, &(0x7f0000000080)={{0x12, 0x1, 0x110, 0x47, 0xfe, 0x93, 0x40, 0x2caf, 0x13a3, 0xbddc, 0x1, 0x2, 0x3, 0x1, [{{0x9, 0x2, 0x3c, 0x2, 0x1, 0x2, 0x0, 0xd, "", [{{0x9, 0x4, 0x3e, 0xe3, 0x1, 0x60, 0x6a, 0xbc, 0x8, [], [{{0x9, 0x5, 0x0, 0x1, 0x10, 0xf4, 0x29, 0x81, [@generic={0x8, 0xb, "af33248a602c"}]}}]}}, {{0x9, 0x4, 0x8b, 0x86, 0x1, 0x2, 0x2, 0xff, 0x97, [], [{{0x9, 0x5, 0x0, 0x3, 0x20, 0x5, 0x81, 0xb0, [@generic={0x7, 0xb, "001521caf6"}]}}]}}]}}]}}, 0x0) executing program 8: r0 = bpf$PROG_LOAD(0x5, &(0x7f0000000180)={0xa, 0x5, &(0x7f0000000000)=ANY=[@ANYBLOB="18020000ff0300000000000000000000850000001100000085000000a000000095"], &(0x7f00000000c0)='syzkaller\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f0000000600)={r0, 0x0, 0xe, 0x0, &(0x7f0000000300)="e02742e8680d85ff978276fcf294", 0x0, 0x4002, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x50) executing program 8: r0 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) bind$bt_hci(r0, &(0x7f0000000000)={0x1f, 0xffff, 0x2}, 0x6) recvmmsg(r0, &(0x7f0000000580)=[{{&(0x7f0000000080)=@nl=@unspec, 0x80, &(0x7f00000005c0)=[{&(0x7f0000000100)=""/230, 0xe6}, {&(0x7f0000000240)=""/200, 0xc8}, {&(0x7f0000000340)=""/175, 0xaf}, {&(0x7f0000000400)=""/53, 0x35}, {&(0x7f0000000440)=""/119, 0x77}], 0x5, &(0x7f0000000540)=""/55, 0x37}}], 0x400000000000222, 0x0, 0x0) sendmsg$inet(r0, &(0x7f00000008c0)={0x0, 0x0, &(0x7f0000000780)=[{&(0x7f0000000740)='T*/\n', 0x4}], 0x1}, 0x4000) executing program 7: r0 = socket$nl_generic(0x10, 0x3, 0x10) ioctl$sock_SIOCGIFINDEX_80211(r0, 0x8933, &(0x7f00000003c0)={'wlan0\x00'}) syz_genetlink_get_family_id$nl80211(0x0, 0xffffffffffffffff) sendmsg$NL80211_CMD_FRAME(r0, 0x0, 0x0) connect$can_bcm(0xffffffffffffffff, 0x0, 0x0) r1 = socket$netlink(0x10, 0x3, 0x0) sendmsg$nl_route(r1, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000080)=ANY=[], 0x4c}}, 0x0) r2 = socket(0x2, 0x80805, 0x0) sendmmsg$inet(r2, &(0x7f0000001d80)=[{{&(0x7f0000000280)={0x2, 0x4e22, @private=0xa010101}, 0x10, &(0x7f0000000980)=[{&(0x7f0000000200)="9c", 0x1}], 0x1}}, {{&(0x7f0000000080)={0x2, 0x4e22, @rand_addr=0x64010104}, 0x10, &(0x7f0000000180)=[{&(0x7f00000000c0)="99", 0x1}], 0x1}}, {{&(0x7f0000000380)={0x2, 0x4e21, @initdev={0xac, 0x1e, 0x1, 0x0}}, 0x10, &(0x7f0000001c80)=[{&(0x7f0000000b00)='>', 0x1}], 0x1, &(0x7f0000001f40)=ANY=[@ANYBLOB="110000000000000000000000010000000b000000000000001400000000000000000000000200000001000080000000004c"], 0x80}}], 0x3, 0x48000) getsockopt$inet_sctp_SCTP_MAX_BURST(r2, 0x84, 0xc, &(0x7f0000000040)=@assoc_value, &(0x7f0000000000)=0x8) sendmsg$can_bcm(0xffffffffffffffff, &(0x7f0000000000)={0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x15}, 0x60040090) recvmmsg(0xffffffffffffffff, &(0x7f0000000280)=[{{0x0, 0x0, 0x0}, 0x40}], 0x15, 0x10040, 0x0) executing program 8: r0 = openat$dsp(0xffffffffffffff9c, &(0x7f0000000000), 0x42, 0x0) write$dsp(r0, &(0x7f0000000200), 0x0) r1 = syz_open_dev$sndctrl(&(0x7f0000001440), 0x0, 0x801) ioctl$SNDRV_CTL_IOCTL_PCM_PREFER_SUBDEVICE(r1, 0x40045532, &(0x7f0000000100)) r2 = syz_open_dev$sndpcmp(&(0x7f0000001200), 0x0, 0xa2c65) write$snddsp(r2, &(0x7f0000000200)="a3", 0x1) ioctl$SNDRV_PCM_IOCTL_DRAIN(r2, 0x4144, 0x0) ioctl$SNDRV_PCM_IOCTL_FORWARD(r2, 0x40084149, &(0x7f0000000040)=0x80000000) ioctl$SNDRV_PCM_IOCTL_HW_FREE(r2, 0x4112, 0x0) executing program 7: socket$kcm(0x10, 0x2, 0x0) socket$igmp(0x2, 0x3, 0x2) r0 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000580), 0xffffffffffffffff) r1 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$NL80211_CMD_SET_TID_CONFIG(r1, &(0x7f0000000680)={0x0, 0x0, &(0x7f0000000340)={&(0x7f0000000140)={0x38, r0, 0x10ada85e65c25359, 0xfffffffc, 0x25dfdbfd, {{0x6b}, {@val={0x8}, @val={0xc, 0x99, {0x7431, 0x2e}}}}, [@NL80211_ATTR_TID_CONFIG={0x10, 0x11d, 0x0, 0x1, [{0xc, 0x0, 0x0, 0x1, [@NL80211_TID_CONFIG_ATTR_TX_RATE={0x8, 0xd, 0x0, 0x1, [@NL80211_BAND_5GHZ={0x4}]}]}]}]}, 0x38}, 0x1, 0x0, 0x0, 0x8441}, 0x4000000) r2 = socket$nl_generic(0x10, 0x3, 0x10) socket$kcm(0x10, 0x2, 0x0) bpf$MAP_CREATE(0x0, &(0x7f00000009c0)=ANY=[], 0x48) socket$inet6_udp(0xa, 0x2, 0x0) socket(0x10, 0x3, 0x0) r3 = socket$nl_generic(0x11, 0x3, 0x10) syz_emit_ethernet(0x2a, &(0x7f0000000000)={@local, @broadcast, @void, {@ipv4={0x800, @igmp={{0x5, 0x4, 0x0, 0x3a, 0x1c, 0x7ffd, 0x0, 0x0, 0x2, 0x0, @broadcast, @loopback}, {0x17, 0x74, 0x0, @rand_addr=0x64010100}}}}}, 0x0) sendmsg(r3, &(0x7f0000000640)={&(0x7f00000000c0)=@caif=@dgm={0x25, 0xd}, 0x80, &(0x7f00000005c0)=[{&(0x7f0000000000)="4ba72c4cfd81685544f46c3f0800", 0x36}], 0x2, 0x0, 0x0, 0x11000000}, 0x0) bpf$PROG_LOAD(0x5, 0x0, 0x0) r4 = bpf$MAP_CREATE(0x0, &(0x7f0000000780)=ANY=[@ANYBLOB="19000000040000000800000008"], 0x50) r5 = bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x6, 0xd, &(0x7f0000000200)=ANY=[@ANYBLOB="1800000000000000000000000000000085000000bc00000018110000", @ANYRES32=r4, @ANYBLOB="0000000000000000b7080000000000007b8af8ff00000000bca2000000000000a6020000f8ffffffb703000008000000b704000000000400850000003300000095"], &(0x7f0000000180)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @xdp, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$MAP_UPDATE_ELEM_TAIL_CALL(0x2, &(0x7f0000000340)={{r4, 0xffffffffffffffff}, &(0x7f00000001c0), &(0x7f0000000300)=r5}, 0x20) r7 = socket$nl_generic(0x10, 0x3, 0x10) r8 = syz_genetlink_get_family_id$tipc2(&(0x7f0000000080), r2) sendmsg$TIPC_NL_MON_GET(r7, &(0x7f00000004c0)={&(0x7f0000000040)={0x10, 0x0, 0x0, 0x1000000}, 0xc, &(0x7f0000000440)={&(0x7f0000000400)={0x3c, r8, 0x311, 0x70bd29, 0x25dfdbfd, {}, [@TIPC_NLA_PUBL={0x24, 0x3, 0x0, 0x1, [@TIPC_NLA_PUBL_UPPER={0x8, 0x3, 0x1}, @TIPC_NLA_PUBL_TYPE={0x8, 0x1, 0x80000001}, @TIPC_NLA_PUBL_TYPE={0x8, 0x1, 0x7}, @TIPC_NLA_PUBL_LOWER={0x8, 0x2, 0x810e}]}, @TIPC_NLA_SOCK={0x4}]}, 0x3c}, 0x1, 0x0, 0x0, 0xdc63f6baf90ddeb5}, 0x20044880) bpf$MAP_UPDATE_ELEM(0x2, &(0x7f0000000000)={r6, &(0x7f0000000380)="0099", &(0x7f0000000480)=@udp6=r5, 0x2}, 0x20) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f0000000280)={r5, 0x5, 0xe, 0x0, &(0x7f00000003c0)="000000000000000000000001e370", 0x0, 0xff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x20}, 0x50) executing program 8: socket$key(0xf, 0x3, 0x2) syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) sendmsg$nl_route(0xffffffffffffffff, 0x0, 0x840) r0 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$nl_generic(r0, 0x0, 0xc000) r1 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) sendmsg$NLBL_MGMT_C_REMOVE(r1, &(0x7f0000000480)={&(0x7f0000000280)={0x10, 0x0, 0x0, 0x800000}, 0xc, &(0x7f0000000440)={&(0x7f00000002c0)={0x14, 0x0, 0x8, 0x70bd28, 0x25dfdbff}, 0x14}, 0x1, 0x0, 0x0, 0x4010}, 0x0) bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x11, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x40f00, 0x0, '\x00', 0x0, @fallback=0x2b, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) r2 = socket(0x1, 0x803, 0x0) getsockname$packet(r2, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) r4 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r4, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000300)={&(0x7f0000000340)=@ipv6_newaddr={0x34, 0x14, 0x9535393fea6295b5, 0x0, 0x0, {0xa, 0x40, 0x0, 0x0, r3}, [@IFA_LOCAL={0x14, 0x2, @ipv4}, @IFA_FLAGS={0x8, 0x8, 0x100}]}, 0x34}}, 0x0) r5 = socket(0x10, 0x803, 0x0) ioctl$SIOCX25SCALLUSERDATA(r2, 0x89e5, 0x0) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f07ebbeef, 0x8031, 0xffffffffffffffff, 0x215eb000) sendmsg$nl_route(r5, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000300)={&(0x7f0000000000)=@ipv6_newaddr={0x34, 0x14, 0x9535393fea6295b5, 0x0, 0x0, {0xa, 0x0, 0x0, 0x0, r3}, [@IFA_LOCAL={0x14, 0x2, @ipv4}, @IFA_FLAGS={0x8, 0x8, 0x210}]}, 0x34}}, 0x8000) executing program 5: r0 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$nl_generic(r0, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000440)={&(0x7f0000000240)=ANY=[@ANYBLOB="140000001e00010330bd7000f8dbdf2505"], 0x14}}, 0x0) mmap(&(0x7f0000001000/0xc00000)=nil, 0xc00000, 0x0, 0x1010, 0xffffffffffffffff, 0x4000) socket(0x11, 0x2, 0x10001) bpf$PROG_LOAD(0x5, 0x0, 0x0) setsockopt$SO_TIMESTAMPING(0xffffffffffffffff, 0x1, 0x41, 0x0, 0x0) bind$inet(0xffffffffffffffff, &(0x7f00000001c0)={0x2, 0x0, @local}, 0x10) syz_open_procfs$namespace(0x0, 0x0) getpeername(0xffffffffffffffff, 0x0, &(0x7f0000000700)) mmap(&(0x7f0000000000/0x3000)=nil, 0x3000, 0x2000001, 0x12, 0xffffffffffffffff, 0x0) executing program 5: r0 = openat$dsp(0xffffffffffffff9c, &(0x7f0000000000), 0x42, 0x0) write$dsp(r0, 0x0, 0x0) r1 = syz_open_dev$sndctrl(&(0x7f0000001440), 0x0, 0x801) ioctl$SNDRV_CTL_IOCTL_PCM_PREFER_SUBDEVICE(r1, 0x40045532, &(0x7f0000000100)) r2 = syz_open_dev$sndpcmp(&(0x7f0000001200), 0x0, 0xa2c65) write$snddsp(r2, &(0x7f0000000200)="a3", 0x1) ioctl$SNDRV_PCM_IOCTL_DRAIN(r2, 0x4144, 0x0) ioctl$SNDRV_PCM_IOCTL_FORWARD(r2, 0x40084149, &(0x7f0000000040)=0x80000000) executing program 7: bpf$PROG_LOAD_XDP(0x5, &(0x7f0000000040)={0x5, 0x0, 0x0, 0x0, 0x1000d, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x25, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0x3c}, 0x94) r0 = syz_genetlink_get_family_id$ethtool(&(0x7f0000000040), 0xffffffffffffffff) r1 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$ETHTOOL_MSG_PAUSE_SET(r1, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000cc0)={&(0x7f0000000080)=ANY=[@ANYBLOB=' \x00\x00\x00', @ANYRES16=r0, @ANYBLOB="0100000010651fbe347b2c2b00000c000180080001"], 0x20}}, 0x0) executing program 5: openat$ppp(0xffffffffffffff9c, &(0x7f0000000080), 0x100, 0x0) mprotect(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x5) r0 = socket(0xa, 0x3, 0xff) setsockopt$inet6_int(r0, 0x29, 0x21, 0x0, 0x0) sendto$inet6(r0, 0x0, 0x0, 0x24000844, &(0x7f00000005c0)={0xa, 0x2, 0x6, @private0, 0xdb}, 0x1c) executing program 5: r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = openat$tun(0xffffffffffffff9c, &(0x7f0000000140), 0x0, 0x0) ioctl$TUNSETIFF(r1, 0x400454ca, &(0x7f00000000c0)={'syzkaller1\x00', 0x2}) bpf$PROG_LOAD(0x5, &(0x7f0000000080)={0x6, 0x6, &(0x7f00000001c0)=ANY=[@ANYBLOB="18020000013f00000000000003000000850000002c00000018"], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @xdp=0x25, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0x4}, 0x94) readv(r1, &(0x7f00000001c0)=[{&(0x7f0000001400)=""/227, 0x10}], 0x4) r2 = socket$kcm(0x2, 0xa, 0x2) ioctl$sock_SIOCSIFVLAN_ADD_VLAN_CMD(r0, 0x8983, &(0x7f0000000080)={0x0, 'syzkaller1\x00', {0x4}, 0x1}) ioctl$SIOCSIFHWADDR(r2, 0x8914, &(0x7f0000000000)={'syzkaller1\x00', @link_local}) executing program 7: bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f0000000000)={0xffffffffffffffff, 0x27, 0x0, 0x0, 0x0, 0x0, 0x4000, 0xf2ffffff, 0x0, 0x0, 0x0, 0x0}, 0x50) r0 = socket(0x10, 0x803, 0x0) sendmsg$nl_route(r0, &(0x7f0000000600)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000000)=ANY=[@ANYBLOB="3800000056000100000000f70000000007020000", @ANYRES32, @ANYBLOB="200001"], 0x38}}, 0x0) executing program 7: r0 = socket$alg(0x26, 0x5, 0x0) bpf$MAP_CREATE(0x0, &(0x7f00000007c0)=ANY=[@ANYBLOB='\n\x00\x00\x00\v', @ANYRES32, @ANYBLOB='\x00'/20, @ANYRES32, @ANYBLOB="0000000000000000000000000000000000a7"], 0x50) bpf$MAP_UPDATE_ELEM_TAIL_CALL(0x2, &(0x7f00000002c0)={{}, &(0x7f0000000140), &(0x7f0000000280)}, 0x20) close(0x3) socket$inet6_sctp(0xa, 0x1, 0x84) socket$nl_netfilter(0x10, 0x3, 0xc) socket$nl_netfilter(0x10, 0x3, 0xc) syz_init_net_socket$x25(0x9, 0x5, 0x0) mmap(&(0x7f0000000000/0x800000)=nil, 0x800000, 0xb, 0xc3072, 0xffffffffffffffff, 0x0) socket$unix(0x1, 0x5, 0x0) r1 = socket$nl_generic(0x10, 0x3, 0x10) r2 = syz_genetlink_get_family_id$ethtool(&(0x7f0000000180), r1) sendmsg$ETHTOOL_MSG_COALESCE_SET(r1, &(0x7f0000000540)={0x0, 0x1f, &(0x7f0000000500)={&(0x7f00000001c0)=ANY=[@ANYBLOB='\\\x00\x00\x00', @ANYRES16=r2, @ANYBLOB="010000000000000000001400000008000200fc00000018000180140002006e657464657673696d300000000000000800050000fcffff08000900fc000000080011000700000008000e00800000000800", @ANYRES32=r1], 0x5c}, 0x1, 0x0, 0x0, 0x800}, 0x0) r3 = accept(r0, 0x0, 0x0) bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x1, 0xd, &(0x7f0000000300)=ANY=[@ANYBLOB="18000000000000000000000000000000850000002f00000018110000"], &(0x7f0000000240)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x40, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$PROG_LOAD_XDP(0x5, 0x0, 0x0) socket$packet(0x11, 0x3, 0x300) sendmsg$nl_route(r3, 0x0, 0x4091) executing program 0: r0 = socket$inet6_udp(0xa, 0x2, 0x0) bind$inet6(r0, &(0x7f0000000000)={0xa, 0xe22, 0x0, @empty}, 0x1c) r1 = socket$igmp6(0xa, 0x3, 0x2) setsockopt$IP6T_SO_SET_REPLACE(r1, 0x29, 0x40, &(0x7f0000000440)=@raw={'raw\x00', 0x8, 0x3, 0x4c8, 0x0, 0xffffffff, 0xffffffff, 0x0, 0xffffffff, 0x3f8, 0xffffffff, 0xffffffff, 0x3f8, 0xffffffff, 0x3, 0x0, {[{{@ipv6={@private0, @mcast2, [], [], 'veth0_macvtap\x00', 'bridge0\x00'}, 0x0, 0x148, 0x170, 0x0, {}, [@common=@unspec=@helper={{0x48}}, @common=@inet=@hashlimit1={{0x58}, {'bond_slave_1\x00', {0x41, 0x1ff, 0x6, 0xb0e2, 0x10001, 0x84e, 0xfffffffb, 0x18, 0x8}, {0x1}}}]}, @common=@unspec=@NFQUEUE0={0x28}}, {{@ipv6={@remote, @ipv4={'\x00', '\xff\xff', @dev}, [], [], 'erspan0\x00', 'gre0\x00', {0xff}, {}, 0x0, 0x0, 0x0, 0x4b}, 0x0, 0x258, 0x288, 0x0, {}, [@common=@inet=@hashlimit1={{0x58}, {'pim6reg\x00', {0x0, 0x0, 0x5, 0x0, 0x0, 0x7, 0x3ff}}}, @common=@inet=@hashlimit3={{0x158}, {'vcan0\x00', {0x3, 0x0, 0x41, 0xfffffffe, 0x2, 0x1000, 0x6, 0x3}}}]}, @common=@unspec=@CONNMARK={0x30}}], {{'\x00', 0x0, 0xa8, 0xd0}, {0x28, '\x00', 0x7}}}}, 0x528) connect$inet6(r0, &(0x7f0000000140)={0xa, 0x4e20, 0x6, @local, 0xb}, 0x1c) syz_emit_ethernet(0x7e, &(0x7f0000000300)={@local, @local, @void, {@ipv6={0x86dd, @udp={0x0, 0x6, "fa0500", 0x48, 0x11, 0x0, @local, @local, {[], {0x4e20, 0xe22, 0x48, 0x0, @wg=@cookie={0x3, 0x2, "88c73b21f267636d01dbe5712c1c941e1cdafbbb43f09c28", "e102060872381f41e5fff9620915b6f78670dfaf9a195fcb2a79cf6b7931c9b4"}}}}}}}, 0x0) executing program 6: r0 = openat$dsp(0xffffffffffffff9c, &(0x7f0000000000), 0x42, 0x0) write$dsp(r0, &(0x7f0000000200), 0x0) r1 = syz_open_dev$sndctrl(&(0x7f0000001440), 0x0, 0x801) ioctl$SNDRV_CTL_IOCTL_PCM_PREFER_SUBDEVICE(r1, 0x40045532, &(0x7f0000000100)) r2 = syz_open_dev$sndpcmp(&(0x7f0000001200), 0x0, 0xa2c65) write$snddsp(r2, &(0x7f0000000200)="a3", 0x1) ioctl$SNDRV_PCM_IOCTL_DRAIN(r2, 0x4144, 0x0) ioctl$SNDRV_PCM_IOCTL_FORWARD(r2, 0x40084149, &(0x7f0000000040)=0x80000000) ioctl$SNDRV_PCM_IOCTL_HW_FREE(r2, 0x4112, 0x0) executing program 7: sendmsg$nl_route_sched(0xffffffffffffffff, 0x0, 0x10) r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000200), 0x0, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000040)={'syzkaller0\x00', 0x2}) r1 = openat$tun(0xffffffffffffff9c, &(0x7f0000000400), 0x0, 0x0) close(r1) socket$nl_generic(0x10, 0x3, 0x10) ioctl$SIOCSIFHWADDR(r1, 0x8914, &(0x7f0000002280)={'syzkaller0\x00', @multicast}) r2 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r2, 0x8933, &(0x7f0000000100)={'syzkaller0\x00', 0x0}) sendmsg$nl_route_sched(r2, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000580)={&(0x7f0000000340)=@newqdisc={0x4c, 0x24, 0x4ee4e6a52ff56541, 0x70bd25, 0x25dfdbfd, {0x0, 0x0, 0x0, r3, {0x0, 0xb}, {0xffff, 0xffff}, {0xfff2}}, [@qdisc_kind_options=@q_netem={{0xa}, {0x1c, 0x2, {{0x3, 0x3, 0x4361, 0x7, 0xffffffff, 0x3}}}}]}, 0x4c}, 0x1, 0x0, 0x0, 0x8000}, 0x0) sendmsg$nl_route_sched(r2, &(0x7f00000003c0)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000440)=@newqdisc={0x44, 0x24, 0x4ee4e6a52ff56541, 0x70b927, 0x25dfdbfc, {0x0, 0x0, 0x0, r3, {0x0, 0xd}, {0x6, 0xb}, {0xb, 0x2}}, [@qdisc_kind_options=@q_cake={{0x9}, {0x14, 0x2, [@TCA_CAKE_AUTORATE={0x8, 0x9, 0x6}, @TCA_CAKE_MEMORY={0x8, 0xa, 0x5}]}}]}, 0x44}, 0x1, 0x0, 0x0, 0x240040e0}, 0x4890) r4 = socket$packet(0x11, 0x3, 0x300) sendto$packet(r4, &(0x7f0000000240)="800000800000210ee7decd7a000340", 0xf, 0x40, &(0x7f00000001c0)={0x11, 0x8100, r3, 0x1, 0xd8, 0x6, @broadcast}, 0x14) executing program 8: r0 = socket$inet(0x2, 0x1, 0x100) setsockopt$sock_int(r0, 0x1, 0x48, &(0x7f0000000040)=0x3, 0x4) connect$inet(r0, &(0x7f0000002040)={0x2, 0x4e24, @loopback}, 0x10) connect(r0, &(0x7f0000000380)=@in={0x2, 0x4e22, @empty}, 0x80) executing program 6: r0 = openat$dsp(0xffffffffffffff9c, &(0x7f0000000000), 0x42, 0x0) write$dsp(r0, &(0x7f0000000200), 0x0) r1 = syz_open_dev$sndctrl(&(0x7f0000001440), 0x0, 0x801) ioctl$SNDRV_CTL_IOCTL_PCM_PREFER_SUBDEVICE(r1, 0x40045532, &(0x7f0000000100)) r2 = syz_open_dev$sndpcmp(&(0x7f0000001200), 0x0, 0xa2c65) write$snddsp(r2, &(0x7f0000000200)="a3", 0x1) ioctl$SNDRV_PCM_IOCTL_DRAIN(r2, 0x4144, 0x0) ioctl$SNDRV_PCM_IOCTL_FORWARD(r2, 0x40084149, &(0x7f0000000040)=0x80000000) executing program 6: openat$ppp(0xffffffffffffff9c, &(0x7f0000000080), 0x100, 0x0) mprotect(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x5) r0 = socket(0xa, 0x3, 0xff) setsockopt$inet6_int(r0, 0x29, 0x21, 0x0, 0x0) sendto$inet6(r0, 0x0, 0x0, 0x24000844, &(0x7f00000005c0)={0xa, 0x2, 0x6, @private0, 0xdb}, 0x1c) executing program 5: r0 = socket$inet_udp(0x2, 0x2, 0x0) setsockopt$SO_TIMESTAMPING(r0, 0x1, 0x25, &(0x7f0000000200)=0x474c, 0x4) bind$inet(r0, &(0x7f0000000240)={0x2, 0x0, @local}, 0x6f) connect$inet(r0, &(0x7f0000000480)={0x2, 0x0, @multicast1}, 0x10) sendmmsg(r0, &(0x7f0000007fc0), 0x800001d, 0x300) setsockopt$inet_int(r0, 0x0, 0x19, &(0x7f0000000180)=0x1f5, 0x4) setsockopt$inet_int(r0, 0x0, 0x17, &(0x7f0000000880)=0x8, 0x4) recvmmsg(r0, &(0x7f0000008c00)=[{{0x0, 0x0, 0x0}}], 0x1, 0x45833af96e4b39fe, 0x0) executing program 8: r0 = openat$binder_debug(0xffffffffffffff9c, &(0x7f0000000040)='/sys/kernel/debug/binder/transactions\x00', 0x0, 0x0) r1 = openat$binderfs(0xffffffffffffff9c, &(0x7f00000000c0)='./binderfs/binder0\x00', 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR_EXT(r1, 0x4018620d, &(0x7f0000000100)) r2 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000140)='./binderfs/binder0\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000080)={0x8, 0x0, &(0x7f0000000400)=[@increfs], 0x0, 0x0, 0x0}) r3 = dup3(r2, r1, 0x0) r4 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000040)='./binderfs/binder0\x00', 0x0, 0x0) mmap$binder(&(0x7f0000ffd000/0x3000)=nil, 0x3000, 0x1, 0x11, r4, 0x0) ioctl$BINDER_SET_CONTEXT_MGR_EXT(r4, 0x4018620d, &(0x7f0000004a80)={0x73622a85, 0x100, 0x1}) ioctl$BINDER_WRITE_READ(r3, 0xc0306201, &(0x7f00000004c0)={0x8, 0x0, &(0x7f0000000000)=[@acquire], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r3, 0xc0306201, &(0x7f00000001c0)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) mmap$binder(&(0x7f0000ffe000/0x2000)=nil, 0x2000, 0x1, 0x11, r1, 0x10000000000) ioctl$BINDER_WRITE_READ(r4, 0xc0306201, &(0x7f0000000180)={0x0, 0x0, 0x0, 0x50, 0x0, &(0x7f0000000580)="b3185d7bb56f70f003360fa8bf71ac3086aedebf6fff904f92849a7a07395ee7f0e4cb1d78001c08a0ab73ffcf5ad07693727980eea946e6cba1723e81bfa5c3688803c8a124dcb27df7938e7ddfdd52"}) ioctl$BINDER_WRITE_READ(r4, 0xc0306201, &(0x7f0000004a40)={0x44, 0x0, &(0x7f00000049c0)=[@transaction={0x40406300, {0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) ioctl$BINDER_THREAD_EXIT(r4, 0x40046208, 0x0) read$FUSE(r0, &(0x7f0000004800)={0x2020}, 0x2020) executing program 6: r0 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$nl_generic(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000680)={0x18, 0x40, 0x1, 0xfffffffe, 0x25dfdbff, {0x1, 0x7c}, [@nested={0x4, 0x142}]}, 0x18}, 0x1, 0x0, 0x0, 0xc081}, 0x800c000) executing program 6: socket$rds(0x15, 0x5, 0x0) r0 = socket$alg(0x26, 0x5, 0x0) bind$alg(r0, 0x0, 0x0) bpf$MAP_CREATE(0x0, &(0x7f00000009c0)=@base={0xf, 0x4, 0x8, 0x8, 0x0, 0xffffffffffffffff, 0x2}, 0x50) bpf$PROG_LOAD(0x5, &(0x7f0000000600)={0x15, 0x3, &(0x7f0000000440)=@framed={{0x18, 0x0, 0x0, 0x0, 0xfffffffd, 0x0, 0x0, 0x0, 0x800}}, 0x0, 0x0, 0x0, 0x0, 0x1e00, 0x48, '\x00', 0x0, @sk_reuseport=0x28, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0xffffffff}, 0x94) bpf$BPF_PROG_TEST_RUN(0xa, 0x0, 0x0) setsockopt$ALG_SET_KEY(r0, 0x117, 0x1, 0x0, 0x0) syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r2 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) accept4$alg(r0, 0x0, 0x0, 0x800) r3 = syz_genetlink_get_family_id$netlbl_mgmt(&(0x7f0000000040), r2) sendmsg$NLBL_MGMT_C_ADDDEF(r1, &(0x7f0000000300)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000280)={0x34, r3, 0x1, 0x70bd2c, 0x25dfdbfe, {}, [@NLBL_MGMT_A_IPV4MASK={0x8, 0x8, @local}, @NLBL_MGMT_A_PROTOCOL={0x8, 0x2, 0x3}, @NLBL_MGMT_A_IPV4ADDR={0x8, 0x7, @remote}, @NLBL_MGMT_A_CV4DOI={0x8, 0x4, 0x3}]}, 0x34}, 0x1, 0x0, 0x0, 0x2400cc04}, 0x0) executing program 5: syz_usb_connect(0x2, 0x4e, &(0x7f0000000080)={{0x12, 0x1, 0x110, 0x47, 0xfe, 0x93, 0x40, 0x2caf, 0x13a3, 0xbddc, 0x1, 0x2, 0x3, 0x1, [{{0x9, 0x2, 0x3c, 0x2, 0x1, 0x2, 0x0, 0xd, "", [{{0x9, 0x4, 0x3e, 0xe3, 0x1, 0x60, 0x6a, 0xbc, 0x8, [], [{{0x9, 0x5, 0x0, 0x1, 0x10, 0xf4, 0x29, 0x81, [@generic={0x8, 0xb, "af33248a602c"}]}}]}}, {{0x9, 0x4, 0x8b, 0x86, 0x1, 0x2, 0x2, 0xff, 0x97, [], [{{0x9, 0x5, 0x0, 0x3, 0x20, 0x5, 0x81, 0xb0, [@generic={0x7, 0xb, "001521caf6"}]}}]}}]}}]}}, 0x0) executing program 6: r0 = bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x6, 0x4, &(0x7f0000000080)=ANY=[@ANYBLOB="1800000002000000000000000000000085000000bc00000095"], &(0x7f0000000200)='GPL\x00', 0x4, 0x0, 0x0, 0x0, 0x29, '\x00', 0x0, @fallback=0x2a, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) r1 = socket$inet_tcp(0x2, 0x1, 0x0) ioctl$sock_SIOCGIFINDEX(r1, 0x8933, &(0x7f0000000180)={'syz_tun\x00', 0x0}) bpf$BPF_LINK_CREATE_XDP(0x1c, &(0x7f00000005c0)={r0, r2, 0x25, 0x0, @val=@iter={0x0}}, 0x20) syz_emit_ethernet(0xd81, &(0x7f0000000600)={@local, @link_local={0x1, 0x80, 0xc2, 0x0, 0x0, 0x1}, @val={@void, {0x8100, 0x4, 0x1}}, {@mpls_uc={0x8847, {[], @ipv6=@generic={0x9, 0x6, "42e05d", 0xd47, 0x5c, 0x1, @loopback, @private1, {[@hopopts={0x3b, 0x18b, '\x00', [@hao={0xc9, 0x10, @private1}, @calipso={0x7, 0x48, {0x3, 0x10, 0x0, 0x2, [0x7dc, 0x9, 0x7, 0x7ff, 0xfffffffffffff44f, 0xfff, 0x9, 0x8]}}, @generic={0x7, 0x7b, "15150516342241d33f2f84419cd0ade5ead47f040f3610e0e64553bf3410243438486330d290af3e2a7347207e3096c9f52ae8fa46bb92954b5c4c8ddd25c8222c8e89291bbf3708eaf1cff9de108813e7d75f55f342443d057d1370fddf3a0525054239a4a929e53efdceba1f264486dd705079a5159b644cab60"}, @generic={0xb6, 0xb7e, "dcc90b7af212186183e96f505753a6bac53a363b8fea5b6f8ae2ffa5e616fb00ce4a776634ec4850a4336077d815b910c33440425503122672698c7f18eae511fabe74fff308983388351bedd123432d693ece874bc53b7cd6236bbf793f36fe58d256038f7bc58958b28b42e670a1e6c34be414b6ae7d19038ec6c9a1c5f5e726764e536e0c9947b044d126c68feaa30e71f6e99b15d78a283fc5948a0963f563ac50bedc5d4e4cccd75473a1f7048b5ec17441be54e319a19be0a405054fe58e8a082f53b4a4cbd649e76fde6fae7a1e2e1b07e29e94bbb1096d12a4b4ffa9eead4d2945653a0f1860cbd57c218fc8bd08943eca3246fd11a13d6551798f766702da5ce0f56b7a7db290e7f01bb26be889e8abc62c18ac4d9437b2d2133bae88ba5b2847c1916ac4a926cc51bbd5a723af30fd732e0118b78accd99bcd2d5406948f5f7b5fe2f3f12bb6dd940fc079dfceada5e2be2c011a836ce08a9966986c372a872cc3d17d5d34be3dd9f3751ab3821efb99006244fd3572fa6ee4e64558bdc9e704caa56175247ba767525d36f27d0664ecf57a18b28e8fea0baae0d944bb61c81ada0bf3a82cf3022c3d38cb857710212f46327c0899a8e998065a1700a4afb0023703607b8ec5a32826fea96f7c3b6d59e5541548eb5fed861392f04d5e5d9f487e6f41a09bddec16b3eb1089d5f3a1e97a755f4350a82f054eb13e06e77cdc5e4862dcc606cc26609734220cb35e27eabe1a339da9411a100bdbe973d27ab8a5a53ca1c0356c9608c5557feb8e376f9844a0cb6fe9ae6905f565fe8d62acffb89255459e95fb1d5340e3c9b95240eff2041d580a7469d4fa0b409d43ea489fb7fb20b0ea89d4c43430532cd2a273b97187335b605dd9a453d5f343642ae852e7e25006785eac4b1027f5aa7999ff1eeb16f118ca01a394914c6358f5667df96d8428034ecd7b600e4fd749171343ac8e5557e21614eb6c42633c919ddc7a9f9cf4d08b2e94db8f5a3aec1d63e5b8665e7f5007ef415866681d0e2520bed0a97af32c04591911257c71b7a1614447f8b520099781662f68f579a84ebcda93d0fe37c6423697c3492709da0f007a293a3142620478a7aad12baf7dc3ad15e2b1db8f8af17c8419208abf86fa188eda5c563961edaa2d47104b076f442d39b87dd4d254b92b3bbe2b8a95be230721a07631fe9066e6dcfb4c96e3b74acb93ae21e55d7e9b0a9b5b59f0ac7628262b960fcbd0a86e44223ca6d76fdedce62ecabb7b02f1f705862a2b60297d17f295275c80e8fb0791453847183d7cfb3e08f87b7ecd0ae24481df38a352c54227a20c60b899854287bbae06f974e74481419a6f705fd2b516d452c55fb87df013bbd714a0fe39cec0a18e4973407f45da2cccbc3004e0c62b6ae8bfb9c65400a22622bd9ff50cdf93e9031dd05c4afc5cc30d61d3c013b1c474695ca62d452ec6cdfbc21730b3cfdbdf815b508121dbb3af2b2b7235a2dd933d4ad2f82a59ec3fe8823b9730a4d2dcdb719f341cafd458752e23dac67b028988195ec33617f91921daa1f74a32970ad36bc4793bd4c40a83fefebf94db566cb2025be3cb05c3fd2abb99df00901c444cb56c64cb96eafba1e33bb5077168a4b0b8446b2cefca6b1d9d63ff1cce61e0b3ef3021c6270a799f94e0efd62e9a9d8c628b88fc07354d7ef8ea7f9b251456ad56d943e3f0092d7042c35bd94970cc5b7fe2364da0bae7f4fb0bf7a3bb3212f079a69b53fbe11afc0dbff7f005b12d6cec9e7169ebf8dfda4bb7d3211cabc7cffe7a0c1c1e496720209041c7f95aac0f49126ca7a5620f9f709bb72ba32ac6afe0acbfe3bee20b406d98b7e7bbe263b76fdb963c9e84c06c168aaac23c921feba4b2ef064f79aa1092fd2fc435feecee01ee10ebbd11199f6ee343e45dfc69b9f10fd86c85d4d3adf2d8d9be8c692fce1d92ce544bd53f33be2f40219953fd17842e0b608eb2d9e0db97286af10da05d6d3f2cebc5ae79d5fd3a7517f51c95ebc1044cdb711d03239b713553d5f99d9fdf7ac5dfe92e2c1a16c6de7f3c157698d8f96e3f46d2c9fca0de48fe3630afb2064686ba0c1734c37f0e9303488e9209025651142a87e8b1af770de99bc0b93c1cd9cf186bee7642588ea7f2f897f765b405dced642901d755c984de04602ca607a2cdd25f45eb7380d92ac70a80155a15438654ec26a3a90fe0fb8ae0bafe187440643dd3d29de3550d97f0b67c84f101e21c158279b18c29468e8b8968fc08ab5d794407f2a0cdcd31f23ba3c8e8ef0cd14a5be81ad4260142a457962171d216983c1d9a4ba1cf7009098d8d6848b12a6d14ef2fff856a5e3064e3ff2d9047e97c58644dce9a5c1c73c7cd3dcee911fda15cdbbf1e24a7f9d800f0197fa5af4a853a63d48a3fddc593bb68ebe0cd086359b69aa3f3b22b18d55bbad6a8c878f3bbc4730344fc84967fded81a7b7c651f6b121da407b818ff3516056bec3f4b4e6e8341de95a48614af93db4a7c74a96c3da0f623e58d0b224864d58d952359f13c01e322b2a8f9c2d564aaf25b0d83804b86bedb8db62d36dbb27437d7dc953d4b91270fd31b9fb50684b7bdf3ab78be0f94601feeceaba24cfd9ca2e3e9708f724b070d6153fc44fd68aa375037fb83b77a988d6e12c05e0ff9eb954fd732017979f0bdf7ba44c2b96d47815cd1527fd57cfbffa58c0e6727f1c56ff01fb78dc0aab374ef6b9bf409f3a1751f1935fad983a8def7de2c594b37fdcc29bceaff0e8d1aecd8bd938b3cbc5eed823897be22f1c037a73831b69e5148d11baeeb9b32ad016fe327705a59f7f40dd4bf4ca7ff1c5326dc24d81cbeeacfe6bbd9e9a44b56d8cc1eddb652744c0b2201d7014f9a49f55ee2b940f84a0369d5e81b5323321c89254fffa4d201c7a1eb032efc53607c48b5ebae48d80ad49bdaa20e13c9060692d50f50353ccadffa02cae0dfec8f60bbaef885cb16c2f02077762fc7518d28004e9630273a493ff53499499d766c60b0310e39a9c6c9db6c0a63f73f9e5089dade79e1939a88d6046cabaaed7588cd651761a1ca25be434e0280744693e3134fcd9d89e11cff18a841f4e2209aa9d52c2c257c95e283957c097227c493741d8a9a7fc5ac5e4c86dac5b419c8bc4a697534c1febfd52f9353805f554e30fb3f8c0bd977a83bbf2bdfb019cdd958af21dc00f54e86a0bf3df7219e1ca9c900646921c138404be38c279dcfcdd68a012715f6f0c5d68e5365658ac8b121868afe1d7f9ec07ed3b4b2ef49a3f07facdaccc07dd87b187a2dbb9e49b37c22b818d47f8cb27045c8b6e3ef1656072d7fdc23ab9a8e28506b52d04ae642152f4d6fd03f50537e9a7baa9e3a9ceb209b04f2844be5dca1526f9f1fcc8b57f33ada774f8262da08fb7f2b73cdc818e7788a240e656794a7186f4cfc0edb4940e73807b0dd39320056d1a9750041adf833562744323e9c492b2e199bbb8b2a647293e6b1e38e8022c0924a2dcccd406eab7c0d0caaf9ad4023bb57371c2a9de61b42363a266def05c178437715af52b1d424acf73f3298e8dfd02d849bd0d0d15a99026296cb6c9043909360b3173bd317834ca84261ffed928c83e058505abacde4171b14edb48450124bb253e8c35f6f44784b35c5b7cf761d25fc840bf88e8bb15adb3ca3a548d5727122c97209ff2321d46bfa5cb18a8c03b386c9aaef40ac79d5b5efc977447ac5b85df24cbe4365c996652f210a9477e57e137423b83f43cd217caa9be580735336400ad0b954469a56c0046e1123e00654c64d70d62cb07e90b7e475b8cae3e34e47ffd8bc282c7698c25fd5befe1719c1caec7771744ac07e2892c86ec383756d0fd055d4c8dbdef397e2f2c72ae9896db73830c47f0cfb06e8ea24da40daab915ba4c8d48a5ca30f9b51870eb92a7fbb927995249844b837fcc4dcbb7a04dee8d5c58fb2f16c046f2f8ebb480272c6250f69253fff678ba0d743c227ab4cde125da60d692376174d8d50d5ec735a80a69e32b23d128f6b8304570f3d600b354904ad9ed8d1e63ad336dc32f22be895af6943678fb3c924853e8cbb94f2d67090da239978c5caada0eaabe08e4dd2ce2b1ee8bafde0caf0c7b4e4cde188672b976e5d181337ec1d9ae2fa"}]}], "d443c4cd9262f2486153ea3f91e8d049fe1b44045f39b19bb735a99b66dd4f1e4bf3983d25e227c1013778774871609abb5c0fc06a61b35269e3b9a16e0dc07de3f32c3e6f543eaede0b600656968bc5ae6c090f334ad5b844f0232249e82328a61f620284d0b7da4640bbf84af374b6bdb6397a8a9155425618b8c659d53ae48c4be4538b1c0cad4950808c933e163c4897f9f13df0956bb82390f02fd2fc82e8323c9b849b0a7978e17b8a25f378c80e6e1d2f50f5a1587ccdf0e983f45be2ab36432ef1969e33a0e0dbb64f6a441cc69eb88a7da09108caf797904ce346"}}}}}}, 0x0) program did not crash bisect: testing without sub-chunk 2/3 testing program (duration=6m9s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): [4, 7, 4, 13, 4, 17, 16, 16, 14, 13, 13, 13, 24, 23, 23, 9, 14, 13, 24, 16, 10, 8, 4, 5, 8, 3, 18, 6, 9, 13, 4, 8, 5, 8, 16, 2, 14, 1, 5] detailed listing: executing program 4: r0 = syz_open_dev$sndctrl(&(0x7f0000000040), 0x0, 0x0) madvise(&(0x7f0000000000/0x600000)=nil, 0x600000, 0x15) mprotect(&(0x7f0000000000/0x4000)=nil, 0x4000, 0x1) ioctl$SNDRV_CTL_IOCTL_SUBSCRIBE_EVENTS(r0, 0xc0045516, &(0x7f0000000000)=0xffb) executing program 4: r0 = socket$l2tp(0x2, 0x2, 0x73) bind$inet(r0, &(0x7f00000002c0)={0x2, 0x4e1c, @multicast1}, 0x10) connect$inet(r0, &(0x7f0000000200)={0x2, 0x4e22, @local}, 0x10) r1 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000001c0)='memory.events\x00', 0x275a, 0x0) write$cgroup_subtree(r1, &(0x7f0000000100)=ANY=[], 0x32600) mmap(&(0x7f0000000000/0x3000)=nil, 0x3000, 0x2000001, 0x12, r1, 0x0) getsockopt$sock_buf(r0, 0x1, 0x1c, 0x0, &(0x7f00000000c0)) executing program 4: writev(0xffffffffffffffff, &(0x7f0000000180)=[{&(0x7f0000000240)}], 0x1) mprotect(&(0x7f0000000000/0xf000)=nil, 0xf000, 0x1) r0 = socket$inet6_sctp(0xa, 0x1, 0x84) getsockopt$inet_sctp6_SCTP_STREAM_SCHEDULER(r0, 0x84, 0x7b, &(0x7f0000000140)={0x0, 0x9}, &(0x7f0000000180)=0x8) executing program 4: syz_mount_image$fuse(0x0, &(0x7f0000002080)='./file0\x00', 0x208000, 0x0, 0x3d, 0x0, 0x0) r0 = open_tree(0xffffffffffffff9c, &(0x7f0000000640)='\x00', 0x89901) move_mount(r0, &(0x7f0000000140)='.\x00', 0xffffffffffffff9c, &(0x7f0000000180)='./file0\x00', 0x0) r1 = open_tree(0xffffffffffffff9c, &(0x7f0000000640)='\x00', 0x9801) move_mount(r1, &(0x7f0000000140)='.\x00', 0xffffffffffffff9c, &(0x7f0000000180)='./file0\x00', 0x0) chroot(&(0x7f0000001740)='./file0\x00') syz_open_procfs(0x0, &(0x7f0000000040)='mounts\x00') r2 = fsopen(&(0x7f0000000180)='proc\x00', 0x1) fsconfig$FSCONFIG_CMD_CREATE(r2, 0x6, 0x0, 0x0, 0x0) mprotect(&(0x7f0000000000/0x4000)=nil, 0x4000, 0x1) fchdir(0xffffffffffffffff) r3 = openat$fuse(0xffffffffffffff9c, &(0x7f0000000040), 0x42, 0x0) read$FUSE(r3, &(0x7f00000102c0)={0x2020}, 0x7) executing program 4: mmap(&(0x7f0000000000/0xff5000)=nil, 0xff5000, 0x1000002, 0x200000005c831, 0xffffffffffffffff, 0x0) timer_create(0x2, 0x0, &(0x7f0000bbdffc)) seccomp$SECCOMP_SET_MODE_FILTER(0x1, 0x4, &(0x7f0000000140)={0x0, 0x0}) remap_file_pages(&(0x7f0000800000/0x800000)=nil, 0x800000, 0x0, 0x600, 0x102020) executing program 3: r0 = socket$unix(0x1, 0x5, 0x0) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000100)={'veth0_macvtap\x00', 0x0}) ioctl$FS_IOC_RESVSP(0xffffffffffffffff, 0xc0189436, 0x0) r2 = socket$inet6_mptcp(0xa, 0x1, 0x106) bind$inet6(r2, &(0x7f0000000040)={0xa, 0x4e22, 0x0, @empty, 0x7}, 0x1c) listen(r2, 0xfffffffc) r3 = socket$nl_generic(0x10, 0x3, 0x10) r4 = syz_genetlink_get_family_id$mptcp(&(0x7f0000000000), 0xffffffffffffffff) bpf$MAP_CREATE_CONST_STR(0x0, 0x0, 0x0) bpf$MAP_CREATE_RINGBUF(0x0, &(0x7f0000000780)={0x1b, 0x0, 0x0, 0x40000, 0x0, 0x0, 0x1, '\x00', r1, 0x0}, 0x50) bpf$PROG_LOAD(0x5, 0x0, 0x0) r5 = syz_genetlink_get_family_id$mptcp(&(0x7f0000000040), 0xffffffffffffffff) r6 = socket$inet_mptcp(0x2, 0x1, 0x106) connect$inet(r6, &(0x7f0000000000)={0x2, 0x4e22, @local}, 0x10) sendmsg$MPTCP_PM_CMD_DEL_ADDR(0xffffffffffffffff, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000000240)={0x28, r5, 0x7, 0x0, 0x0, {}, [@MPTCP_PM_ATTR_ADDR={0x14, 0x1, 0x0, 0x1, [@MPTCP_PM_ADDR_ATTR_FAMILY={0x6, 0x1, 0x2}, @MPTCP_PM_ADDR_ATTR_ADDR4={0x8, 0x3, @local}]}]}, 0x28}}, 0x0) syz_genetlink_get_family_id$mptcp(&(0x7f00000000c0), 0xffffffffffffffff) sendmsg$MPTCP_PM_CMD_ADD_ADDR(r3, &(0x7f0000000400)={0x0, 0x0, &(0x7f00000003c0)={&(0x7f00000004c0)={0x30, r4, 0x1, 0x70bd2c, 0x1000000, {}, [@MPTCP_PM_ATTR_ADDR={0x1c, 0x1, 0x0, 0x1, [@MPTCP_PM_ADDR_ATTR_FAMILY={0x6, 0x1, 0x2}, @MPTCP_PM_ADDR_ATTR_ADDR4={0x8, 0x3, @dev={0xac, 0x14, 0x14, 0x37}}, @MPTCP_PM_ADDR_ATTR_FLAGS={0x8, 0x6, 0x3}]}]}, 0x30}, 0x1, 0xff07}, 0x2000000) executing program 3: r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000100), 0x0, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000040)={'syzkaller0\x00', 0x2}) r1 = openat$tun(0xffffffffffffff9c, &(0x7f0000000400), 0x0, 0x0) close(r1) socket$inet_udp(0x2, 0x2, 0x0) ioctl$SIOCSIFHWADDR(r1, 0x8914, &(0x7f0000002280)={'syzkaller0\x00', @multicast}) r2 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r2, 0x8933, &(0x7f0000000100)={'syzkaller0\x00', 0x0}) sendmsg$nl_route_sched(r2, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000580)={&(0x7f0000000600)=@newqdisc={0x4c, 0x24, 0x4ee4e6a52ff56541, 0x1, 0x25dfdbfd, {0x0, 0x0, 0x0, r3, {0x0, 0xb}, {0xffff, 0xffff}, {0xfff2}}, [@qdisc_kind_options=@q_netem={{0xa}, {0x1c, 0x2, {{0x3, 0x3, 0x6361, 0x5, 0xffffffff, 0x3}}}}]}, 0x4c}, 0x1, 0x0, 0x0, 0x40088c1}, 0x0) r4 = socket$unix(0x1, 0x1, 0x0) r5 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r4, 0x8933, &(0x7f0000000100)={'syzkaller0\x00', 0x0}) sendmsg$nl_route_sched(r5, &(0x7f0000000200)={0x0, 0x0, &(0x7f0000000140)={&(0x7f00000004c0)=@newqdisc={0x24, 0x24, 0x4ee4e6a52ff56541, 0x70b923, 0x80000, {0x0, 0x0, 0x0, r6, {0x0, 0x9}, {0x0, 0xb}, {0x9, 0xb}}}, 0x24}, 0x1, 0x0, 0x0, 0x2000c061}, 0x0) r7 = socket$nl_generic(0x10, 0x3, 0x10) r8 = syz_genetlink_get_family_id$tipc(&(0x7f0000000080), r7) sendmsg$TIPC_CMD_ENABLE_BEARER(r7, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000280)={&(0x7f0000000680)=ANY=[@ANYBLOB='8\x00\x00\x00', @ANYRES16=r8, @ANYBLOB="010000000d0000000000010000000000000001410000001c001700000000000000006574683a73797a6b616c6c657230"], 0x38}}, 0x0) executing program 1: r0 = openat$binder_debug(0xffffffffffffff9c, &(0x7f0000000040)='/sys/kernel/debug/binder/transactions\x00', 0x0, 0x0) r1 = openat$binderfs(0xffffffffffffff9c, &(0x7f00000000c0)='./binderfs/binder0\x00', 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR_EXT(r1, 0x4018620d, &(0x7f0000000100)) r2 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000140)='./binderfs/binder0\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000080)={0x8, 0x0, &(0x7f0000000400)=[@increfs], 0x0, 0x0, 0x0}) r3 = dup3(r2, r1, 0x0) r4 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000040)='./binderfs/binder0\x00', 0x0, 0x0) mmap$binder(&(0x7f0000ffd000/0x3000)=nil, 0x3000, 0x1, 0x11, r4, 0x0) ioctl$BINDER_SET_CONTEXT_MGR_EXT(r4, 0x4018620d, 0x0) ioctl$BINDER_WRITE_READ(r3, 0xc0306201, &(0x7f00000004c0)={0x8, 0x0, &(0x7f0000000000)=[@acquire], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r3, 0xc0306201, &(0x7f00000001c0)={0x4c, 0x0, &(0x7f0000000fc0)=[@transaction_sg={0x40486311, {0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x48, 0x18, &(0x7f0000000300)={@flat=@weak_binder={0x77622a85, 0x100a, 0x8000000000}, @flat=@weak_binder={0x77622a85, 0x1100, 0x3}}, &(0x7f0000000200)={0x0, 0x18, 0x30}}}], 0x0, 0x0, 0x0}) mmap$binder(&(0x7f0000ffe000/0x2000)=nil, 0x2000, 0x1, 0x11, r1, 0x10000000000) ioctl$BINDER_WRITE_READ(r4, 0xc0306201, &(0x7f0000000180)={0x0, 0x0, 0x0, 0x50, 0x0, &(0x7f0000000580)="b3185d7bb56f70f003360fa8bf71ac3086aedebf6fff904f92849a7a07395ee7f0e4cb1d78001c08a0ab73ffcf5ad07693727980eea946e6cba1723e81bfa5c3688803c8a124dcb27df7938e7ddfdd52"}) ioctl$BINDER_WRITE_READ(r4, 0xc0306201, &(0x7f0000004a40)={0x44, 0x0, &(0x7f00000049c0)=[@transaction={0x40406300, {0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) ioctl$BINDER_THREAD_EXIT(r4, 0x40046208, 0x0) read$FUSE(r0, &(0x7f0000004800)={0x2020}, 0x2020) executing program 3: r0 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000380)='./binderfs/binder0\x00', 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR_EXT(r0, 0x4018620d, &(0x7f00000000c0)={0x73622a85, 0xa, 0x8000000000002}) r1 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000200)='./binderfs/binder0\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000080)={0x8, 0x0, &(0x7f0000000400)=[@increfs], 0x0, 0x0, 0x0}) r2 = dup3(r1, r0, 0x0) r3 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000000)='./binderfs/binder0\x00', 0x0, 0x0) mmap$binder(&(0x7f0000ffd000/0x3000)=nil, 0x3000, 0x1, 0x11, r3, 0x0) ioctl$BINDER_SET_CONTEXT_MGR_EXT(r3, 0x4018620d, &(0x7f0000000040)={0x73622a85, 0x10a}) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f00000003c0)={0x8, 0x0, &(0x7f0000000340)=[@acquire], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000001040)={0x4c, 0x0, &(0x7f0000000ec0)=[@transaction_sg={0x40486311, {0x1, 0x0, 0x0, 0x0, 0x41, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x1000}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000001c0)={0x4c, 0x0, &(0x7f0000000740)=[@transaction_sg={0x40486311, {0x1, 0x0, 0x0, 0x0, 0x11, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x400}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000c00)={0x44, 0x0, &(0x7f0000000a80)=[@transaction={0x40406300, {0x1, 0x0, 0x0, 0x0, 0x21, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) r4 = openat$binder_debug(0xffffffffffffff9c, 0x0, 0x0, 0x0) read$FUSE(r4, &(0x7f0000007fc0)={0x2020}, 0x2020) executing program 4: r0 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000380)='./binderfs/binder0\x00', 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR_EXT(r0, 0x4018620d, &(0x7f00000000c0)={0x73622a85, 0xa, 0x8000000000002}) r1 = openat$binderfs(0xffffffffffffff9c, 0x0, 0x0, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000080)={0x8, 0x0, &(0x7f0000000400)=[@increfs], 0x0, 0x0, 0x0}) r2 = dup3(r1, r0, 0x0) r3 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000000)='./binderfs/binder0\x00', 0x0, 0x0) r4 = mmap$binder(&(0x7f0000ffd000/0x3000)=nil, 0x3000, 0x1, 0x11, r3, 0x0) ioctl$BINDER_SET_CONTEXT_MGR_EXT(r3, 0x4018620d, &(0x7f0000000040)={0x73622a85, 0x10a}) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f00000003c0)={0x8, 0x0, &(0x7f0000000340)=[@acquire], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000001040)={0x4c, 0x0, &(0x7f0000000ec0)=[@transaction_sg={0x40486311, {0x1, 0x0, 0x0, 0x0, 0x41, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x1000}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000001c0)={0x4c, 0x0, &(0x7f0000000740)=[@transaction_sg={0x40486311, {0x1, 0x0, 0x0, 0x0, 0x11, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x400}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000c00)={0x44, 0x0, &(0x7f0000000a80)=[@transaction={0x40406300, {0x1, 0x0, 0x0, 0x0, 0x21, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r3, 0xc0306201, &(0x7f0000000300)={0xc, 0x0, &(0x7f0000000240)=[@free_buffer={0x40086303, r4}], 0x54, 0x0, &(0x7f0000000280)="37b82b8f41afa37c5297fe5b692d3cedbd057d6f37743560799bbf4ddd06bc810453adcec0c458de737aeadf5afcd6641ea3434a1a0bfd0debe7506939a82090490c46a6010019e855badfb0bee8561d5ee15bac"}) executing program 32: r0 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000380)='./binderfs/binder0\x00', 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR_EXT(r0, 0x4018620d, &(0x7f00000000c0)={0x73622a85, 0xa, 0x8000000000002}) r1 = openat$binderfs(0xffffffffffffff9c, 0x0, 0x0, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000080)={0x8, 0x0, &(0x7f0000000400)=[@increfs], 0x0, 0x0, 0x0}) r2 = dup3(r1, r0, 0x0) r3 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000000)='./binderfs/binder0\x00', 0x0, 0x0) r4 = mmap$binder(&(0x7f0000ffd000/0x3000)=nil, 0x3000, 0x1, 0x11, r3, 0x0) ioctl$BINDER_SET_CONTEXT_MGR_EXT(r3, 0x4018620d, &(0x7f0000000040)={0x73622a85, 0x10a}) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f00000003c0)={0x8, 0x0, &(0x7f0000000340)=[@acquire], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000001040)={0x4c, 0x0, &(0x7f0000000ec0)=[@transaction_sg={0x40486311, {0x1, 0x0, 0x0, 0x0, 0x41, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x1000}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000001c0)={0x4c, 0x0, &(0x7f0000000740)=[@transaction_sg={0x40486311, {0x1, 0x0, 0x0, 0x0, 0x11, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x400}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000c00)={0x44, 0x0, &(0x7f0000000a80)=[@transaction={0x40406300, {0x1, 0x0, 0x0, 0x0, 0x21, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r3, 0xc0306201, &(0x7f0000000300)={0xc, 0x0, &(0x7f0000000240)=[@free_buffer={0x40086303, r4}], 0x54, 0x0, &(0x7f0000000280)="37b82b8f41afa37c5297fe5b692d3cedbd057d6f37743560799bbf4ddd06bc810453adcec0c458de737aeadf5afcd6641ea3434a1a0bfd0debe7506939a82090490c46a6010019e855badfb0bee8561d5ee15bac"}) executing program 3: syz_mount_image$fuse(0x0, &(0x7f0000002080)='./file0\x00', 0x208000, 0x0, 0x3d, 0x0, 0x0) r0 = open_tree(0xffffffffffffff9c, &(0x7f0000000640)='\x00', 0x89901) move_mount(r0, &(0x7f0000000140)='.\x00', 0xffffffffffffff9c, &(0x7f0000000180)='./file0\x00', 0x0) r1 = open_tree(0xffffffffffffff9c, &(0x7f0000000640)='\x00', 0x9801) move_mount(r1, &(0x7f0000000140)='.\x00', 0xffffffffffffff9c, &(0x7f0000000180)='./file0\x00', 0x0) chroot(&(0x7f0000001740)='./file0\x00') syz_open_procfs(0x0, &(0x7f0000000040)='mounts\x00') r2 = fsopen(&(0x7f0000000180)='proc\x00', 0x1) fsconfig$FSCONFIG_CMD_CREATE(r2, 0x6, 0x0, 0x0, 0x0) mprotect(&(0x7f0000000000/0x4000)=nil, 0x4000, 0x1) fchdir(0xffffffffffffffff) r3 = openat$fuse(0xffffffffffffff9c, &(0x7f0000000040), 0x42, 0x0) read$FUSE(r3, &(0x7f00000102c0)={0x2020}, 0x7) executing program 3: r0 = socket$inet6_sctp(0xa, 0x1, 0x84) r1 = dup(r0) setsockopt$inet_sctp6_SCTP_SOCKOPT_BINDX_ADD(r1, 0x84, 0x64, 0x0, 0x0) sendmsg$inet6(r0, 0x0, 0x20000896) dup(r0) write$UHID_INPUT(r1, 0x0, 0x0) openat$ppp(0xffffffffffffff9c, &(0x7f0000000140), 0x42000, 0x0) syz_open_dev$vim2m(&(0x7f0000000000), 0x800, 0x2) socket$netlink(0x10, 0x3, 0x0) syz_open_procfs(0xffffffffffffffff, &(0x7f0000000500)='status\x00') socketpair$unix(0x1, 0x1, 0x0, &(0x7f00000001c0)) openat$fuse(0xffffffffffffff9c, &(0x7f00000000c0), 0x2, 0x0) r2 = open_tree(0xffffffffffffff9c, &(0x7f0000000640)='\x00', 0x89901) mount_setattr(r2, 0x0, 0x8000, 0x0, 0x0) socket(0x10, 0x3, 0x0) socket$nl_generic(0x10, 0x3, 0x10) socket$nl_netfilter(0x10, 0x3, 0xc) socket$kcm(0x2, 0xa, 0x2) r3 = socket$unix(0x1, 0x1, 0x0) bind$unix(r3, &(0x7f00000000c0)=@file={0x1, '\xe9\x1fq\x89Y\x1e\x923aK\x00'}, 0x6e) listen(r3, 0x0) accept(r3, 0x0, 0x0) r4 = socket$nl_netfilter(0x10, 0x3, 0xc) syz_emit_vhci(&(0x7f0000000840)=ANY=[@ANYBLOB="04050400c900", @ANYRES16=r4], 0x7) executing program 3: r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000100), 0x0, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000040)={'syzkaller0\x00', 0x2}) r1 = open_tree(0xffffffffffffff9c, &(0x7f0000000100)='\x00', 0x89901) r2 = fspick(r1, &(0x7f00000000c0)='.\x00', 0x0) fsconfig$FSCONFIG_SET_FLAG(r2, 0x0, &(0x7f0000000000)='dirsync\x00', 0x0, 0x0) fsconfig$FSCONFIG_CMD_RECONFIGURE(r2, 0x7, 0x0, 0x0, 0x0) setxattr$security_ima(&(0x7f0000000080)='./file0\x00', &(0x7f00000002c0), &(0x7f0000000380)=@ng={0x4, 0x2, "1263cdb7"}, 0x6, 0x0) r3 = openat$tun(0xffffffffffffff9c, &(0x7f0000000500), 0x40, 0x0) close(r3) r4 = socket$kcm(0x29, 0x2, 0x0) ioctl$sock_proto_private(r4, 0x89e2, &(0x7f0000000040)) socket$nl_generic(0x10, 0x3, 0x10) ioctl$SIOCSIFHWADDR(r3, 0x8914, &(0x7f0000002280)={'syzkaller0\x00', @multicast}) socket$nl_route(0x10, 0x3, 0x0) r5 = socket$nl_route(0x10, 0x3, 0x0) r6 = socket$unix(0x1, 0x1, 0x0) ioctl$sock_SIOCGIFINDEX(r6, 0x8933, &(0x7f0000000100)={'syzkaller0\x00', 0x0}) ioctl$VIDIOC_ENUMAUDOUT(r1, 0xc0345642, &(0x7f00000003c0)={0x2, "873e45dacd5291f166c9aac0b6f8ce6da80afca0fe66169480a5a6b43da5bc0e", 0x1}) sendmsg$nl_route_sched(r5, &(0x7f00000008c0)={0x0, 0x0, &(0x7f0000000900)={&(0x7f0000000140)=@newqdisc={0x44, 0x24, 0x4ee4e6a52ff56541, 0x70bd26, 0xffffffff, {0x0, 0x0, 0x0, r7, {0x0, 0xfff1}, {0xffff, 0xffff}, {0xe}}, [@qdisc_kind_options=@q_hfsc={{0x9}, {0x14, 0x2, @TCA_HFSC_FSC={0x10, 0x2, {0x5, 0x7, 0xb3}}}}]}, 0x44}, 0x1, 0x0, 0x0, 0x4000000}, 0x0) r8 = socket$nl_route(0x10, 0x3, 0x0) r9 = socket$unix(0x1, 0x1, 0x0) ioctl$sock_SIOCGIFINDEX(r9, 0x8933, &(0x7f0000000100)={'syzkaller0\x00', 0x0}) sendmsg$nl_route_sched(r8, &(0x7f0000001200)={0x0, 0x0, &(0x7f0000000280)={&(0x7f0000001240)=@newqdisc={0xc48, 0x28, 0x4ee4e6a52ff56541, 0x4001, 0xfffffdfc, {0x0, 0x0, 0x0, r10, {0x10}, {}, {0x2, 0x3}}, [@qdisc_kind_options=@q_tbf={{0x8}, {0xc1c, 0x2, [@TCA_TBF_PTAB={0x404, 0x3, [0x0, 0x4f0d, 0x5, 0x10001, 0x8, 0x10000, 0x80, 0x288, 0x9, 0x9, 0x2, 0xfff, 0xdfd, 0x1, 0x7887, 0x5, 0xdd16, 0x392, 0x31aa, 0x7fff, 0x2, 0xfffff98c, 0x4, 0x4e, 0x100, 0xa, 0x9, 0x2, 0x11, 0xffffffff, 0x3, 0x4, 0x1000, 0x800, 0x7, 0x1, 0x9, 0xd, 0x7, 0xa4f, 0x2, 0xc, 0x3, 0x0, 0xffffffef, 0x74, 0x4, 0x4, 0xffffffff, 0x6, 0x3, 0x1000, 0x6, 0x5, 0x71d, 0x2, 0xffff, 0x6, 0x6, 0x80000000, 0xce0, 0x9, 0xea5, 0x8, 0x200, 0x4, 0x8001, 0xa8, 0x9, 0x10, 0x9, 0x10000, 0x2, 0x7fff, 0xc, 0x7, 0x4800, 0x8, 0x6, 0xe87, 0x7f, 0x6, 0x0, 0x4800, 0x1, 0x12, 0x18b, 0x6, 0x2, 0x5, 0x1, 0x40, 0x5, 0x1, 0x0, 0x1da35084, 0x4, 0x1, 0x9, 0x7, 0x0, 0x4, 0x8, 0x4, 0x2, 0x0, 0x7, 0x200, 0x3, 0x8001, 0xa000, 0x0, 0x7a69, 0x764064d2, 0x92, 0x2, 0xbdc9, 0x3, 0xff, 0x2, 0x10, 0x5, 0x10000, 0x100, 0x5, 0x1022075d, 0x8, 0x5, 0x5, 0xfffffffe, 0x7f, 0x101, 0x4, 0xb, 0x9, 0x27, 0xff, 0x1, 0xf64a, 0xa78c, 0x5, 0x6, 0x7, 0xffff4fc5, 0x8, 0x7f, 0x385, 0x400, 0x100, 0x2, 0x5, 0x4, 0x7, 0x2, 0x7, 0x1, 0xb8, 0xffffff2a, 0x6, 0x8001, 0x6, 0x8, 0x3ff, 0x2, 0x6, 0x0, 0x6, 0x7fff, 0x80, 0x2, 0x5aeb, 0xe, 0x80000001, 0x39, 0x5, 0xa05, 0x3, 0x9, 0x72, 0x5, 0x4, 0x9, 0xba, 0x3, 0xc3, 0x8, 0x6, 0x7f, 0x5, 0xe8f0, 0x55, 0x8, 0x0, 0x7, 0x2, 0x8, 0x410, 0xffff03a4, 0xa8, 0x39b5, 0x8, 0xf3, 0x4, 0x10001, 0x0, 0x7f, 0x2, 0x7fff, 0x7, 0x401, 0x4, 0x0, 0x8, 0x2, 0x7, 0x2, 0x1, 0x2, 0x8, 0xffff, 0x0, 0x9, 0xc0e, 0x41, 0xf, 0xffff, 0xfffffff7, 0xffffff26, 0x7, 0x32a, 0xad95, 0x776, 0x9, 0xfffffffd, 0xfbc0, 0x3, 0xa4c9, 0x1, 0x6, 0xb, 0x3, 0x101, 0x1, 0x0, 0x2, 0x3, 0x4, 0x0, 0x80000000, 0xfffffff8, 0x400, 0x5, 0x2, 0x40, 0xfffeffff, 0x541b]}, @TCA_TBF_RTAB={0x404, 0x2, [0x9, 0x100, 0x2, 0xc91, 0x5, 0x400, 0x1000, 0x2, 0x5, 0x3ff, 0x2, 0x200, 0x7, 0x2, 0x6, 0xdb6, 0x401, 0x6, 0xf, 0x100, 0x3, 0xb, 0x5, 0x77dedf80, 0x100, 0x7, 0x2, 0x4, 0x1, 0x5, 0x5, 0x5, 0x4, 0x7, 0x6, 0x6, 0x4, 0x0, 0x0, 0x3, 0x5, 0x2, 0x10, 0x101, 0x8, 0xd6, 0x8, 0x800, 0x3, 0x4, 0x10001, 0x66a, 0x7, 0x7, 0x6c, 0xa6d, 0x4, 0x6, 0x3, 0x8, 0x2, 0x3d, 0x4, 0x80000000, 0xc, 0x2, 0x40, 0x7, 0x2, 0x4, 0xffffffff, 0x2, 0x4, 0xb0, 0xe7, 0x8, 0x8001, 0x7, 0xb, 0x4, 0x3, 0x2, 0x6, 0x1, 0x5, 0x10001, 0x3, 0x4, 0xffffffff, 0x5, 0x4, 0x7, 0x5, 0x3, 0x8, 0x8, 0x0, 0x374, 0x2, 0x4, 0x7, 0x81, 0x8, 0x7f, 0x9, 0x0, 0x4, 0x6, 0x2, 0xa08d, 0x100, 0x5, 0xffff248d, 0x5, 0x7, 0xa, 0x0, 0x671, 0x3, 0x10000, 0x8c, 0x2ea, 0xd6, 0x79, 0x9, 0x9, 0xc, 0xccf, 0x2, 0xb, 0x5, 0x100, 0x158, 0x4, 0x2, 0x7, 0x1, 0x401, 0x6, 0x5, 0xfffffffb, 0xffffffff, 0x6, 0x80000001, 0x2, 0x7, 0x5, 0xab7, 0x6f18f07b, 0x80000001, 0x0, 0x9, 0xc1, 0x5, 0x4, 0x8, 0x7, 0x3, 0x8, 0x3ff, 0x0, 0x9, 0x203a, 0x3, 0x0, 0x8, 0x2, 0x7, 0x7, 0x8, 0x0, 0x4, 0x4007ff, 0x4, 0x9, 0x2, 0x5, 0x8000, 0x200, 0x0, 0x1, 0xfffffff6, 0x0, 0x7b, 0xfd, 0x5b653309, 0xe5, 0x14f, 0x6, 0x10001, 0x1, 0x7, 0x2, 0xffffffff, 0x0, 0x40100, 0x197, 0x3ff, 0x9, 0x4, 0x200, 0xcbf, 0x1ff, 0x80, 0x9, 0x2f74, 0x4, 0x1, 0x9, 0x0, 0x4, 0x8, 0x8000, 0x5, 0x8, 0xf, 0x9, 0x6057, 0x101, 0x8001, 0xad, 0x4, 0x7, 0x7, 0x2, 0x80000001, 0x8c6b, 0xd87, 0x82, 0x100, 0x0, 0x80000000, 0x0, 0x9a, 0x9, 0xfc3, 0x89, 0xa, 0x80000001, 0x2, 0x1, 0xffffffff, 0x4, 0x8000, 0x2, 0x3, 0x10000, 0x8486, 0x3, 0x8, 0x6, 0x0, 0x1, 0x3, 0x2, 0x9]}, @TCA_TBF_PTAB={0x404, 0x3, [0x5, 0x5, 0x4, 0x5, 0x8001, 0x8, 0x5, 0x2, 0x8, 0x5, 0x4c5, 0x1, 0x6, 0x8, 0x5, 0x5, 0x1, 0x6, 0x0, 0x0, 0x0, 0x0, 0x81, 0xfff, 0x10, 0x3, 0xe55, 0xd, 0x3, 0x6, 0x2, 0x5, 0xef, 0x7, 0x1, 0x8, 0x96b, 0x8, 0x80000001, 0x3, 0x6, 0x5, 0xa4f, 0x8, 0x3, 0x7ff, 0xc68, 0x80000001, 0x10200, 0x101, 0x10100, 0x166, 0x1, 0x7, 0x7a8, 0x2d, 0x7, 0x80, 0x8, 0x9, 0x0, 0x3ff, 0x8001, 0x5, 0x0, 0x635, 0x656, 0x2, 0x6, 0x5, 0x8, 0x1, 0x6, 0xeb, 0xfffffff9, 0x8, 0x3, 0x1, 0x0, 0x0, 0x3, 0x8ca, 0xffff, 0x9, 0x8, 0x800, 0xc198, 0x8, 0x7db903f4, 0x4, 0x6, 0x2, 0xfffffffc, 0x4, 0x7, 0xa2d, 0x0, 0x0, 0x8, 0x5, 0x8, 0x1000, 0x44da11fe, 0x5, 0xfffffbff, 0xfffff2fc, 0x4, 0x7d2, 0x4, 0x7, 0xffffffff, 0x2, 0xe, 0xe, 0x7, 0x101, 0x5, 0x1, 0x98, 0xc, 0x4, 0x98, 0x7, 0xffff, 0x8e58, 0x6, 0x9, 0x77a, 0x1, 0xfffff001, 0x1, 0x0, 0x7, 0x5, 0x9, 0x0, 0x2, 0xe5, 0x51, 0x2, 0xd50, 0x80000000, 0x1ff, 0x7, 0x3, 0xfffffff2, 0x7ff, 0x1ff, 0xee, 0x0, 0xfffff8aa, 0x0, 0x0, 0x80, 0x6df0, 0x2, 0x4, 0x10001, 0x7ff, 0x1, 0xfffffe01, 0x4, 0x5, 0x81, 0x5, 0x2e7, 0xf3, 0x9, 0x6, 0x5, 0x8000, 0x8, 0xe, 0xce2a, 0x1, 0xcb, 0x5, 0x0, 0x9, 0x94, 0x9f, 0x3, 0x8, 0x401, 0x5, 0x3ff, 0x5, 0x1b, 0x2, 0x4, 0x862d, 0x0, 0xff, 0x5, 0x1, 0x1, 0x0, 0xd, 0x5, 0x4, 0xffffff5c, 0x6, 0xff, 0x3, 0x728, 0x2be55882, 0x8, 0x7, 0x7, 0x0, 0x10, 0x7, 0xff, 0x101, 0xfffff801, 0xc86, 0x3, 0x10000, 0x2, 0x2, 0x2, 0x2, 0x2400, 0x81, 0x5, 0x5, 0x3, 0xc9, 0x1, 0x13, 0x5, 0x9, 0xffffffa2, 0xf5b, 0xe, 0xe, 0xb, 0x8, 0xff, 0x2, 0x3, 0x9, 0x10, 0x67d8fb7a, 0x3, 0x8, 0x10001, 0xfffffffa, 0x8001, 0x4, 0x9, 0x0, 0x1, 0x3, 0xfffffffe, 0x100]}, @TCA_TBF_PRATE64={0xc, 0x5, 0x467944efcdcbb7e7}]}}]}, 0xc48}, 0x1, 0x0, 0x0, 0xb3538085985bb3d6}, 0x0) executing program 33: r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000100), 0x0, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000040)={'syzkaller0\x00', 0x2}) r1 = open_tree(0xffffffffffffff9c, &(0x7f0000000100)='\x00', 0x89901) r2 = fspick(r1, &(0x7f00000000c0)='.\x00', 0x0) fsconfig$FSCONFIG_SET_FLAG(r2, 0x0, &(0x7f0000000000)='dirsync\x00', 0x0, 0x0) fsconfig$FSCONFIG_CMD_RECONFIGURE(r2, 0x7, 0x0, 0x0, 0x0) setxattr$security_ima(&(0x7f0000000080)='./file0\x00', &(0x7f00000002c0), &(0x7f0000000380)=@ng={0x4, 0x2, "1263cdb7"}, 0x6, 0x0) r3 = openat$tun(0xffffffffffffff9c, &(0x7f0000000500), 0x40, 0x0) close(r3) r4 = socket$kcm(0x29, 0x2, 0x0) ioctl$sock_proto_private(r4, 0x89e2, &(0x7f0000000040)) socket$nl_generic(0x10, 0x3, 0x10) ioctl$SIOCSIFHWADDR(r3, 0x8914, &(0x7f0000002280)={'syzkaller0\x00', @multicast}) socket$nl_route(0x10, 0x3, 0x0) r5 = socket$nl_route(0x10, 0x3, 0x0) r6 = socket$unix(0x1, 0x1, 0x0) ioctl$sock_SIOCGIFINDEX(r6, 0x8933, &(0x7f0000000100)={'syzkaller0\x00', 0x0}) ioctl$VIDIOC_ENUMAUDOUT(r1, 0xc0345642, &(0x7f00000003c0)={0x2, "873e45dacd5291f166c9aac0b6f8ce6da80afca0fe66169480a5a6b43da5bc0e", 0x1}) sendmsg$nl_route_sched(r5, &(0x7f00000008c0)={0x0, 0x0, &(0x7f0000000900)={&(0x7f0000000140)=@newqdisc={0x44, 0x24, 0x4ee4e6a52ff56541, 0x70bd26, 0xffffffff, {0x0, 0x0, 0x0, r7, {0x0, 0xfff1}, {0xffff, 0xffff}, {0xe}}, [@qdisc_kind_options=@q_hfsc={{0x9}, {0x14, 0x2, @TCA_HFSC_FSC={0x10, 0x2, {0x5, 0x7, 0xb3}}}}]}, 0x44}, 0x1, 0x0, 0x0, 0x4000000}, 0x0) r8 = socket$nl_route(0x10, 0x3, 0x0) r9 = socket$unix(0x1, 0x1, 0x0) ioctl$sock_SIOCGIFINDEX(r9, 0x8933, &(0x7f0000000100)={'syzkaller0\x00', 0x0}) sendmsg$nl_route_sched(r8, &(0x7f0000001200)={0x0, 0x0, &(0x7f0000000280)={&(0x7f0000001240)=@newqdisc={0xc48, 0x28, 0x4ee4e6a52ff56541, 0x4001, 0xfffffdfc, {0x0, 0x0, 0x0, r10, {0x10}, {}, {0x2, 0x3}}, [@qdisc_kind_options=@q_tbf={{0x8}, {0xc1c, 0x2, [@TCA_TBF_PTAB={0x404, 0x3, [0x0, 0x4f0d, 0x5, 0x10001, 0x8, 0x10000, 0x80, 0x288, 0x9, 0x9, 0x2, 0xfff, 0xdfd, 0x1, 0x7887, 0x5, 0xdd16, 0x392, 0x31aa, 0x7fff, 0x2, 0xfffff98c, 0x4, 0x4e, 0x100, 0xa, 0x9, 0x2, 0x11, 0xffffffff, 0x3, 0x4, 0x1000, 0x800, 0x7, 0x1, 0x9, 0xd, 0x7, 0xa4f, 0x2, 0xc, 0x3, 0x0, 0xffffffef, 0x74, 0x4, 0x4, 0xffffffff, 0x6, 0x3, 0x1000, 0x6, 0x5, 0x71d, 0x2, 0xffff, 0x6, 0x6, 0x80000000, 0xce0, 0x9, 0xea5, 0x8, 0x200, 0x4, 0x8001, 0xa8, 0x9, 0x10, 0x9, 0x10000, 0x2, 0x7fff, 0xc, 0x7, 0x4800, 0x8, 0x6, 0xe87, 0x7f, 0x6, 0x0, 0x4800, 0x1, 0x12, 0x18b, 0x6, 0x2, 0x5, 0x1, 0x40, 0x5, 0x1, 0x0, 0x1da35084, 0x4, 0x1, 0x9, 0x7, 0x0, 0x4, 0x8, 0x4, 0x2, 0x0, 0x7, 0x200, 0x3, 0x8001, 0xa000, 0x0, 0x7a69, 0x764064d2, 0x92, 0x2, 0xbdc9, 0x3, 0xff, 0x2, 0x10, 0x5, 0x10000, 0x100, 0x5, 0x1022075d, 0x8, 0x5, 0x5, 0xfffffffe, 0x7f, 0x101, 0x4, 0xb, 0x9, 0x27, 0xff, 0x1, 0xf64a, 0xa78c, 0x5, 0x6, 0x7, 0xffff4fc5, 0x8, 0x7f, 0x385, 0x400, 0x100, 0x2, 0x5, 0x4, 0x7, 0x2, 0x7, 0x1, 0xb8, 0xffffff2a, 0x6, 0x8001, 0x6, 0x8, 0x3ff, 0x2, 0x6, 0x0, 0x6, 0x7fff, 0x80, 0x2, 0x5aeb, 0xe, 0x80000001, 0x39, 0x5, 0xa05, 0x3, 0x9, 0x72, 0x5, 0x4, 0x9, 0xba, 0x3, 0xc3, 0x8, 0x6, 0x7f, 0x5, 0xe8f0, 0x55, 0x8, 0x0, 0x7, 0x2, 0x8, 0x410, 0xffff03a4, 0xa8, 0x39b5, 0x8, 0xf3, 0x4, 0x10001, 0x0, 0x7f, 0x2, 0x7fff, 0x7, 0x401, 0x4, 0x0, 0x8, 0x2, 0x7, 0x2, 0x1, 0x2, 0x8, 0xffff, 0x0, 0x9, 0xc0e, 0x41, 0xf, 0xffff, 0xfffffff7, 0xffffff26, 0x7, 0x32a, 0xad95, 0x776, 0x9, 0xfffffffd, 0xfbc0, 0x3, 0xa4c9, 0x1, 0x6, 0xb, 0x3, 0x101, 0x1, 0x0, 0x2, 0x3, 0x4, 0x0, 0x80000000, 0xfffffff8, 0x400, 0x5, 0x2, 0x40, 0xfffeffff, 0x541b]}, @TCA_TBF_RTAB={0x404, 0x2, [0x9, 0x100, 0x2, 0xc91, 0x5, 0x400, 0x1000, 0x2, 0x5, 0x3ff, 0x2, 0x200, 0x7, 0x2, 0x6, 0xdb6, 0x401, 0x6, 0xf, 0x100, 0x3, 0xb, 0x5, 0x77dedf80, 0x100, 0x7, 0x2, 0x4, 0x1, 0x5, 0x5, 0x5, 0x4, 0x7, 0x6, 0x6, 0x4, 0x0, 0x0, 0x3, 0x5, 0x2, 0x10, 0x101, 0x8, 0xd6, 0x8, 0x800, 0x3, 0x4, 0x10001, 0x66a, 0x7, 0x7, 0x6c, 0xa6d, 0x4, 0x6, 0x3, 0x8, 0x2, 0x3d, 0x4, 0x80000000, 0xc, 0x2, 0x40, 0x7, 0x2, 0x4, 0xffffffff, 0x2, 0x4, 0xb0, 0xe7, 0x8, 0x8001, 0x7, 0xb, 0x4, 0x3, 0x2, 0x6, 0x1, 0x5, 0x10001, 0x3, 0x4, 0xffffffff, 0x5, 0x4, 0x7, 0x5, 0x3, 0x8, 0x8, 0x0, 0x374, 0x2, 0x4, 0x7, 0x81, 0x8, 0x7f, 0x9, 0x0, 0x4, 0x6, 0x2, 0xa08d, 0x100, 0x5, 0xffff248d, 0x5, 0x7, 0xa, 0x0, 0x671, 0x3, 0x10000, 0x8c, 0x2ea, 0xd6, 0x79, 0x9, 0x9, 0xc, 0xccf, 0x2, 0xb, 0x5, 0x100, 0x158, 0x4, 0x2, 0x7, 0x1, 0x401, 0x6, 0x5, 0xfffffffb, 0xffffffff, 0x6, 0x80000001, 0x2, 0x7, 0x5, 0xab7, 0x6f18f07b, 0x80000001, 0x0, 0x9, 0xc1, 0x5, 0x4, 0x8, 0x7, 0x3, 0x8, 0x3ff, 0x0, 0x9, 0x203a, 0x3, 0x0, 0x8, 0x2, 0x7, 0x7, 0x8, 0x0, 0x4, 0x4007ff, 0x4, 0x9, 0x2, 0x5, 0x8000, 0x200, 0x0, 0x1, 0xfffffff6, 0x0, 0x7b, 0xfd, 0x5b653309, 0xe5, 0x14f, 0x6, 0x10001, 0x1, 0x7, 0x2, 0xffffffff, 0x0, 0x40100, 0x197, 0x3ff, 0x9, 0x4, 0x200, 0xcbf, 0x1ff, 0x80, 0x9, 0x2f74, 0x4, 0x1, 0x9, 0x0, 0x4, 0x8, 0x8000, 0x5, 0x8, 0xf, 0x9, 0x6057, 0x101, 0x8001, 0xad, 0x4, 0x7, 0x7, 0x2, 0x80000001, 0x8c6b, 0xd87, 0x82, 0x100, 0x0, 0x80000000, 0x0, 0x9a, 0x9, 0xfc3, 0x89, 0xa, 0x80000001, 0x2, 0x1, 0xffffffff, 0x4, 0x8000, 0x2, 0x3, 0x10000, 0x8486, 0x3, 0x8, 0x6, 0x0, 0x1, 0x3, 0x2, 0x9]}, @TCA_TBF_PTAB={0x404, 0x3, [0x5, 0x5, 0x4, 0x5, 0x8001, 0x8, 0x5, 0x2, 0x8, 0x5, 0x4c5, 0x1, 0x6, 0x8, 0x5, 0x5, 0x1, 0x6, 0x0, 0x0, 0x0, 0x0, 0x81, 0xfff, 0x10, 0x3, 0xe55, 0xd, 0x3, 0x6, 0x2, 0x5, 0xef, 0x7, 0x1, 0x8, 0x96b, 0x8, 0x80000001, 0x3, 0x6, 0x5, 0xa4f, 0x8, 0x3, 0x7ff, 0xc68, 0x80000001, 0x10200, 0x101, 0x10100, 0x166, 0x1, 0x7, 0x7a8, 0x2d, 0x7, 0x80, 0x8, 0x9, 0x0, 0x3ff, 0x8001, 0x5, 0x0, 0x635, 0x656, 0x2, 0x6, 0x5, 0x8, 0x1, 0x6, 0xeb, 0xfffffff9, 0x8, 0x3, 0x1, 0x0, 0x0, 0x3, 0x8ca, 0xffff, 0x9, 0x8, 0x800, 0xc198, 0x8, 0x7db903f4, 0x4, 0x6, 0x2, 0xfffffffc, 0x4, 0x7, 0xa2d, 0x0, 0x0, 0x8, 0x5, 0x8, 0x1000, 0x44da11fe, 0x5, 0xfffffbff, 0xfffff2fc, 0x4, 0x7d2, 0x4, 0x7, 0xffffffff, 0x2, 0xe, 0xe, 0x7, 0x101, 0x5, 0x1, 0x98, 0xc, 0x4, 0x98, 0x7, 0xffff, 0x8e58, 0x6, 0x9, 0x77a, 0x1, 0xfffff001, 0x1, 0x0, 0x7, 0x5, 0x9, 0x0, 0x2, 0xe5, 0x51, 0x2, 0xd50, 0x80000000, 0x1ff, 0x7, 0x3, 0xfffffff2, 0x7ff, 0x1ff, 0xee, 0x0, 0xfffff8aa, 0x0, 0x0, 0x80, 0x6df0, 0x2, 0x4, 0x10001, 0x7ff, 0x1, 0xfffffe01, 0x4, 0x5, 0x81, 0x5, 0x2e7, 0xf3, 0x9, 0x6, 0x5, 0x8000, 0x8, 0xe, 0xce2a, 0x1, 0xcb, 0x5, 0x0, 0x9, 0x94, 0x9f, 0x3, 0x8, 0x401, 0x5, 0x3ff, 0x5, 0x1b, 0x2, 0x4, 0x862d, 0x0, 0xff, 0x5, 0x1, 0x1, 0x0, 0xd, 0x5, 0x4, 0xffffff5c, 0x6, 0xff, 0x3, 0x728, 0x2be55882, 0x8, 0x7, 0x7, 0x0, 0x10, 0x7, 0xff, 0x101, 0xfffff801, 0xc86, 0x3, 0x10000, 0x2, 0x2, 0x2, 0x2, 0x2400, 0x81, 0x5, 0x5, 0x3, 0xc9, 0x1, 0x13, 0x5, 0x9, 0xffffffa2, 0xf5b, 0xe, 0xe, 0xb, 0x8, 0xff, 0x2, 0x3, 0x9, 0x10, 0x67d8fb7a, 0x3, 0x8, 0x10001, 0xfffffffa, 0x8001, 0x4, 0x9, 0x0, 0x1, 0x3, 0xfffffffe, 0x100]}, @TCA_TBF_PRATE64={0xc, 0x5, 0x467944efcdcbb7e7}]}}]}, 0xc48}, 0x1, 0x0, 0x0, 0xb3538085985bb3d6}, 0x0) executing program 1: bpf$MAP_CREATE(0x0, &(0x7f00000000c0)=@base={0x1b, 0x0, 0x0, 0x8000, 0x80000}, 0x50) mount$fuse(0x0, &(0x7f00000020c0)='./file0\x00', 0x0, 0x80, &(0x7f00000002c0)={{}, 0x2c, {'rootmode', 0x3d, 0x4000}}) syz_fuse_handle_req(0xffffffffffffffff, 0x0, 0x0, 0x0) syz_fuse_handle_req(0xffffffffffffffff, 0x0, 0x0, 0x0) getdents64(0xffffffffffffffff, 0x0, 0x0) r0 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPSET_CMD_CREATE(r0, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)={&(0x7f00000000c0)=ANY=[@ANYBLOB="4c0000000206010800000000000000000000003f0500010006000000050005000200000005000400000000000900020073797a310020000013000300686173683a"], 0x4c}}, 0x0) r1 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPSET_CMD_ADD(r1, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000300)={0x54, 0x9, 0x6, 0x201, 0x0, 0x0, {0x2, 0x0, 0xfdff}, [@IPSET_ATTR_DATA={0x2c, 0x7, 0x0, 0x1, [@IPSET_ATTR_IP={0xc, 0x1, 0x0, 0x1, @IPSET_ATTR_IPADDR_IPV4={0x8, 0x1, 0x1, 0x0, @multicast1}}, @IPSET_ATTR_IFACE={0x14, 0x17, 'batadv_slave_0\x00'}, @IPSET_ATTR_CADT_FLAGS={0x8, 0x8, 0x1, 0x0, 0x94}]}, @IPSET_ATTR_SETNAME={0x9, 0x2, 'syz1\x00'}, @IPSET_ATTR_PROTOCOL={0x5}]}, 0x54}}, 0x40c0080) executing program 1: r0 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000380)='./binderfs/binder0\x00', 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR_EXT(r0, 0x4018620d, &(0x7f00000000c0)={0x73622a85, 0xa, 0x8000000000002}) r1 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000200)='./binderfs/binder0\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000080)={0x8, 0x0, &(0x7f0000000400)=[@increfs], 0x0, 0x0, 0x0}) r2 = dup3(r1, r0, 0x0) r3 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000000)='./binderfs/binder0\x00', 0x0, 0x0) mmap$binder(&(0x7f0000ffd000/0x3000)=nil, 0x3000, 0x1, 0x11, r3, 0x0) ioctl$BINDER_SET_CONTEXT_MGR_EXT(r3, 0x4018620d, &(0x7f0000000040)={0x73622a85, 0x10a}) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f00000003c0)={0x8, 0x0, &(0x7f0000000340)=[@acquire], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000001040)={0x4c, 0x0, &(0x7f0000000ec0)=[@transaction_sg={0x40486311, {0x1, 0x0, 0x0, 0x0, 0x41, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x1000}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000001c0)={0x4c, 0x0, &(0x7f0000000740)=[@transaction_sg={0x40486311, {0x1, 0x0, 0x0, 0x0, 0x11, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x400}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000c00)={0x44, 0x0, &(0x7f0000000a80)=[@transaction={0x40406300, {0x1, 0x0, 0x0, 0x0, 0x21, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) r4 = openat$binder_debug(0xffffffffffffff9c, 0x0, 0x0, 0x0) read$FUSE(r4, &(0x7f0000007fc0)={0x2020}, 0x2020) executing program 1: syz_mount_image$fuse(0x0, &(0x7f0000002080)='./file0\x00', 0x208000, 0x0, 0x3d, 0x0, 0x0) r0 = open_tree(0xffffffffffffff9c, &(0x7f0000000640)='\x00', 0x89901) move_mount(r0, &(0x7f0000000140)='.\x00', 0xffffffffffffff9c, &(0x7f0000000180)='./file0\x00', 0x0) r1 = open_tree(0xffffffffffffff9c, &(0x7f0000000640)='\x00', 0x9801) move_mount(r1, &(0x7f0000000140)='.\x00', 0xffffffffffffff9c, &(0x7f0000000180)='./file0\x00', 0x0) chroot(&(0x7f0000001740)='./file0\x00') syz_open_procfs(0x0, &(0x7f0000000040)='mounts\x00') r2 = fsopen(&(0x7f0000000180)='proc\x00', 0x1) r3 = fsmount(r2, 0x1, 0x0) mprotect(&(0x7f0000000000/0x4000)=nil, 0x4000, 0x1) fchdir(r3) r4 = openat$fuse(0xffffffffffffff9c, &(0x7f0000000040), 0x42, 0x0) read$FUSE(r4, &(0x7f00000102c0)={0x2020}, 0x7) executing program 1: r0 = socket$inet6_sctp(0xa, 0x1, 0x84) r1 = dup(r0) setsockopt$inet_sctp6_SCTP_SOCKOPT_BINDX_ADD(r1, 0x84, 0x64, 0x0, 0x0) sendmsg$inet6(r0, 0x0, 0x20000896) dup(r0) write$UHID_INPUT(r1, 0x0, 0x0) openat$ppp(0xffffffffffffff9c, &(0x7f0000000140), 0x42000, 0x0) syz_open_dev$vim2m(&(0x7f0000000000), 0x800, 0x2) socket$netlink(0x10, 0x3, 0x0) syz_open_procfs(0xffffffffffffffff, &(0x7f0000000500)='status\x00') socketpair$unix(0x1, 0x1, 0x0, &(0x7f00000001c0)) openat$fuse(0xffffffffffffff9c, &(0x7f00000000c0), 0x2, 0x0) r2 = open_tree(0xffffffffffffff9c, &(0x7f0000000640)='\x00', 0x89901) mount_setattr(r2, 0x0, 0x8000, 0x0, 0x0) socket(0x10, 0x3, 0x0) socket$nl_generic(0x10, 0x3, 0x10) socket$nl_netfilter(0x10, 0x3, 0xc) socket$kcm(0x2, 0xa, 0x2) r3 = socket$unix(0x1, 0x1, 0x0) bind$unix(r3, &(0x7f00000000c0)=@file={0x1, '\xe9\x1fq\x89Y\x1e\x923aK\x00'}, 0x6e) listen(r3, 0x0) accept(r3, 0x0, 0x0) r4 = socket$nl_netfilter(0x10, 0x3, 0xc) syz_emit_vhci(&(0x7f0000000840)=ANY=[@ANYBLOB="04050400c900", @ANYRES16=r4], 0x7) executing program 8: socket$key(0xf, 0x3, 0x2) syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) sendmsg$nl_route(0xffffffffffffffff, 0x0, 0x840) r0 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$nl_generic(r0, 0x0, 0xc000) r1 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) sendmsg$NLBL_MGMT_C_REMOVE(r1, &(0x7f0000000480)={&(0x7f0000000280)={0x10, 0x0, 0x0, 0x800000}, 0xc, &(0x7f0000000440)={&(0x7f00000002c0)={0x14, 0x0, 0x8, 0x70bd28, 0x25dfdbff}, 0x14}, 0x1, 0x0, 0x0, 0x4010}, 0x0) bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x11, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x40f00, 0x0, '\x00', 0x0, @fallback=0x2b, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) r2 = socket(0x1, 0x803, 0x0) getsockname$packet(r2, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) r4 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r4, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000300)={&(0x7f0000000340)=@ipv6_newaddr={0x34, 0x14, 0x9535393fea6295b5, 0x0, 0x0, {0xa, 0x40, 0x0, 0x0, r3}, [@IFA_LOCAL={0x14, 0x2, @ipv4}, @IFA_FLAGS={0x8, 0x8, 0x100}]}, 0x34}}, 0x0) r5 = socket(0x10, 0x803, 0x0) ioctl$SIOCX25SCALLUSERDATA(r2, 0x89e5, 0x0) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f07ebbeef, 0x8031, 0xffffffffffffffff, 0x215eb000) sendmsg$nl_route(r5, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000300)={&(0x7f0000000000)=@ipv6_newaddr={0x34, 0x14, 0x9535393fea6295b5, 0x0, 0x0, {0xa, 0x0, 0x0, 0x0, r3}, [@IFA_LOCAL={0x14, 0x2, @ipv4}, @IFA_FLAGS={0x8, 0x8, 0x210}]}, 0x34}}, 0x8000) executing program 5: r0 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$nl_generic(r0, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000440)={&(0x7f0000000240)=ANY=[@ANYBLOB="140000001e00010330bd7000f8dbdf2505"], 0x14}}, 0x0) mmap(&(0x7f0000001000/0xc00000)=nil, 0xc00000, 0x0, 0x1010, 0xffffffffffffffff, 0x4000) socket(0x11, 0x2, 0x10001) bpf$PROG_LOAD(0x5, 0x0, 0x0) setsockopt$SO_TIMESTAMPING(0xffffffffffffffff, 0x1, 0x41, 0x0, 0x0) bind$inet(0xffffffffffffffff, &(0x7f00000001c0)={0x2, 0x0, @local}, 0x10) syz_open_procfs$namespace(0x0, 0x0) getpeername(0xffffffffffffffff, 0x0, &(0x7f0000000700)) mmap(&(0x7f0000000000/0x3000)=nil, 0x3000, 0x2000001, 0x12, 0xffffffffffffffff, 0x0) executing program 5: r0 = openat$dsp(0xffffffffffffff9c, &(0x7f0000000000), 0x42, 0x0) write$dsp(r0, 0x0, 0x0) r1 = syz_open_dev$sndctrl(&(0x7f0000001440), 0x0, 0x801) ioctl$SNDRV_CTL_IOCTL_PCM_PREFER_SUBDEVICE(r1, 0x40045532, &(0x7f0000000100)) r2 = syz_open_dev$sndpcmp(&(0x7f0000001200), 0x0, 0xa2c65) write$snddsp(r2, &(0x7f0000000200)="a3", 0x1) ioctl$SNDRV_PCM_IOCTL_DRAIN(r2, 0x4144, 0x0) ioctl$SNDRV_PCM_IOCTL_FORWARD(r2, 0x40084149, &(0x7f0000000040)=0x80000000) executing program 7: bpf$PROG_LOAD_XDP(0x5, &(0x7f0000000040)={0x5, 0x0, 0x0, 0x0, 0x1000d, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x25, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0x3c}, 0x94) r0 = syz_genetlink_get_family_id$ethtool(&(0x7f0000000040), 0xffffffffffffffff) r1 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$ETHTOOL_MSG_PAUSE_SET(r1, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000cc0)={&(0x7f0000000080)=ANY=[@ANYBLOB=' \x00\x00\x00', @ANYRES16=r0, @ANYBLOB="0100000010651fbe347b2c2b00000c000180080001"], 0x20}}, 0x0) executing program 5: openat$ppp(0xffffffffffffff9c, &(0x7f0000000080), 0x100, 0x0) mprotect(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x5) r0 = socket(0xa, 0x3, 0xff) setsockopt$inet6_int(r0, 0x29, 0x21, 0x0, 0x0) sendto$inet6(r0, 0x0, 0x0, 0x24000844, &(0x7f00000005c0)={0xa, 0x2, 0x6, @private0, 0xdb}, 0x1c) executing program 5: r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = openat$tun(0xffffffffffffff9c, &(0x7f0000000140), 0x0, 0x0) ioctl$TUNSETIFF(r1, 0x400454ca, &(0x7f00000000c0)={'syzkaller1\x00', 0x2}) bpf$PROG_LOAD(0x5, &(0x7f0000000080)={0x6, 0x6, &(0x7f00000001c0)=ANY=[@ANYBLOB="18020000013f00000000000003000000850000002c00000018"], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @xdp=0x25, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0x4}, 0x94) readv(r1, &(0x7f00000001c0)=[{&(0x7f0000001400)=""/227, 0x10}], 0x4) r2 = socket$kcm(0x2, 0xa, 0x2) ioctl$sock_SIOCSIFVLAN_ADD_VLAN_CMD(r0, 0x8983, &(0x7f0000000080)={0x0, 'syzkaller1\x00', {0x4}, 0x1}) ioctl$SIOCSIFHWADDR(r2, 0x8914, &(0x7f0000000000)={'syzkaller1\x00', @link_local}) executing program 7: bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f0000000000)={0xffffffffffffffff, 0x27, 0x0, 0x0, 0x0, 0x0, 0x4000, 0xf2ffffff, 0x0, 0x0, 0x0, 0x0}, 0x50) r0 = socket(0x10, 0x803, 0x0) sendmsg$nl_route(r0, &(0x7f0000000600)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000000)=ANY=[@ANYBLOB="3800000056000100000000f70000000007020000", @ANYRES32, @ANYBLOB="200001"], 0x38}}, 0x0) executing program 7: r0 = socket$alg(0x26, 0x5, 0x0) bpf$MAP_CREATE(0x0, &(0x7f00000007c0)=ANY=[@ANYBLOB='\n\x00\x00\x00\v', @ANYRES32, @ANYBLOB='\x00'/20, @ANYRES32, @ANYBLOB="0000000000000000000000000000000000a7"], 0x50) bpf$MAP_UPDATE_ELEM_TAIL_CALL(0x2, &(0x7f00000002c0)={{}, &(0x7f0000000140), &(0x7f0000000280)}, 0x20) close(0x3) socket$inet6_sctp(0xa, 0x1, 0x84) socket$nl_netfilter(0x10, 0x3, 0xc) socket$nl_netfilter(0x10, 0x3, 0xc) syz_init_net_socket$x25(0x9, 0x5, 0x0) mmap(&(0x7f0000000000/0x800000)=nil, 0x800000, 0xb, 0xc3072, 0xffffffffffffffff, 0x0) socket$unix(0x1, 0x5, 0x0) r1 = socket$nl_generic(0x10, 0x3, 0x10) r2 = syz_genetlink_get_family_id$ethtool(&(0x7f0000000180), r1) sendmsg$ETHTOOL_MSG_COALESCE_SET(r1, &(0x7f0000000540)={0x0, 0x1f, &(0x7f0000000500)={&(0x7f00000001c0)=ANY=[@ANYBLOB='\\\x00\x00\x00', @ANYRES16=r2, @ANYBLOB="010000000000000000001400000008000200fc00000018000180140002006e657464657673696d300000000000000800050000fcffff08000900fc000000080011000700000008000e00800000000800", @ANYRES32=r1], 0x5c}, 0x1, 0x0, 0x0, 0x800}, 0x0) r3 = accept(r0, 0x0, 0x0) bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x1, 0xd, &(0x7f0000000300)=ANY=[@ANYBLOB="18000000000000000000000000000000850000002f00000018110000"], &(0x7f0000000240)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x40, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$PROG_LOAD_XDP(0x5, 0x0, 0x0) socket$packet(0x11, 0x3, 0x300) sendmsg$nl_route(r3, 0x0, 0x4091) executing program 0: r0 = socket$inet6_udp(0xa, 0x2, 0x0) bind$inet6(r0, &(0x7f0000000000)={0xa, 0xe22, 0x0, @empty}, 0x1c) r1 = socket$igmp6(0xa, 0x3, 0x2) setsockopt$IP6T_SO_SET_REPLACE(r1, 0x29, 0x40, &(0x7f0000000440)=@raw={'raw\x00', 0x8, 0x3, 0x4c8, 0x0, 0xffffffff, 0xffffffff, 0x0, 0xffffffff, 0x3f8, 0xffffffff, 0xffffffff, 0x3f8, 0xffffffff, 0x3, 0x0, {[{{@ipv6={@private0, @mcast2, [], [], 'veth0_macvtap\x00', 'bridge0\x00'}, 0x0, 0x148, 0x170, 0x0, {}, [@common=@unspec=@helper={{0x48}}, @common=@inet=@hashlimit1={{0x58}, {'bond_slave_1\x00', {0x41, 0x1ff, 0x6, 0xb0e2, 0x10001, 0x84e, 0xfffffffb, 0x18, 0x8}, {0x1}}}]}, @common=@unspec=@NFQUEUE0={0x28}}, {{@ipv6={@remote, @ipv4={'\x00', '\xff\xff', @dev}, [], [], 'erspan0\x00', 'gre0\x00', {0xff}, {}, 0x0, 0x0, 0x0, 0x4b}, 0x0, 0x258, 0x288, 0x0, {}, [@common=@inet=@hashlimit1={{0x58}, {'pim6reg\x00', {0x0, 0x0, 0x5, 0x0, 0x0, 0x7, 0x3ff}}}, @common=@inet=@hashlimit3={{0x158}, {'vcan0\x00', {0x3, 0x0, 0x41, 0xfffffffe, 0x2, 0x1000, 0x6, 0x3}}}]}, @common=@unspec=@CONNMARK={0x30}}], {{'\x00', 0x0, 0xa8, 0xd0}, {0x28, '\x00', 0x7}}}}, 0x528) connect$inet6(r0, &(0x7f0000000140)={0xa, 0x4e20, 0x6, @local, 0xb}, 0x1c) syz_emit_ethernet(0x7e, &(0x7f0000000300)={@local, @local, @void, {@ipv6={0x86dd, @udp={0x0, 0x6, "fa0500", 0x48, 0x11, 0x0, @local, @local, {[], {0x4e20, 0xe22, 0x48, 0x0, @wg=@cookie={0x3, 0x2, "88c73b21f267636d01dbe5712c1c941e1cdafbbb43f09c28", "e102060872381f41e5fff9620915b6f78670dfaf9a195fcb2a79cf6b7931c9b4"}}}}}}}, 0x0) executing program 6: r0 = openat$dsp(0xffffffffffffff9c, &(0x7f0000000000), 0x42, 0x0) write$dsp(r0, &(0x7f0000000200), 0x0) r1 = syz_open_dev$sndctrl(&(0x7f0000001440), 0x0, 0x801) ioctl$SNDRV_CTL_IOCTL_PCM_PREFER_SUBDEVICE(r1, 0x40045532, &(0x7f0000000100)) r2 = syz_open_dev$sndpcmp(&(0x7f0000001200), 0x0, 0xa2c65) write$snddsp(r2, &(0x7f0000000200)="a3", 0x1) ioctl$SNDRV_PCM_IOCTL_DRAIN(r2, 0x4144, 0x0) ioctl$SNDRV_PCM_IOCTL_FORWARD(r2, 0x40084149, &(0x7f0000000040)=0x80000000) ioctl$SNDRV_PCM_IOCTL_HW_FREE(r2, 0x4112, 0x0) executing program 7: sendmsg$nl_route_sched(0xffffffffffffffff, 0x0, 0x10) r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000200), 0x0, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000040)={'syzkaller0\x00', 0x2}) r1 = openat$tun(0xffffffffffffff9c, &(0x7f0000000400), 0x0, 0x0) close(r1) socket$nl_generic(0x10, 0x3, 0x10) ioctl$SIOCSIFHWADDR(r1, 0x8914, &(0x7f0000002280)={'syzkaller0\x00', @multicast}) r2 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r2, 0x8933, &(0x7f0000000100)={'syzkaller0\x00', 0x0}) sendmsg$nl_route_sched(r2, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000580)={&(0x7f0000000340)=@newqdisc={0x4c, 0x24, 0x4ee4e6a52ff56541, 0x70bd25, 0x25dfdbfd, {0x0, 0x0, 0x0, r3, {0x0, 0xb}, {0xffff, 0xffff}, {0xfff2}}, [@qdisc_kind_options=@q_netem={{0xa}, {0x1c, 0x2, {{0x3, 0x3, 0x4361, 0x7, 0xffffffff, 0x3}}}}]}, 0x4c}, 0x1, 0x0, 0x0, 0x8000}, 0x0) sendmsg$nl_route_sched(r2, &(0x7f00000003c0)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000440)=@newqdisc={0x44, 0x24, 0x4ee4e6a52ff56541, 0x70b927, 0x25dfdbfc, {0x0, 0x0, 0x0, r3, {0x0, 0xd}, {0x6, 0xb}, {0xb, 0x2}}, [@qdisc_kind_options=@q_cake={{0x9}, {0x14, 0x2, [@TCA_CAKE_AUTORATE={0x8, 0x9, 0x6}, @TCA_CAKE_MEMORY={0x8, 0xa, 0x5}]}}]}, 0x44}, 0x1, 0x0, 0x0, 0x240040e0}, 0x4890) r4 = socket$packet(0x11, 0x3, 0x300) sendto$packet(r4, &(0x7f0000000240)="800000800000210ee7decd7a000340", 0xf, 0x40, &(0x7f00000001c0)={0x11, 0x8100, r3, 0x1, 0xd8, 0x6, @broadcast}, 0x14) executing program 8: r0 = socket$inet(0x2, 0x1, 0x100) setsockopt$sock_int(r0, 0x1, 0x48, &(0x7f0000000040)=0x3, 0x4) connect$inet(r0, &(0x7f0000002040)={0x2, 0x4e24, @loopback}, 0x10) connect(r0, &(0x7f0000000380)=@in={0x2, 0x4e22, @empty}, 0x80) executing program 6: r0 = openat$dsp(0xffffffffffffff9c, &(0x7f0000000000), 0x42, 0x0) write$dsp(r0, &(0x7f0000000200), 0x0) r1 = syz_open_dev$sndctrl(&(0x7f0000001440), 0x0, 0x801) ioctl$SNDRV_CTL_IOCTL_PCM_PREFER_SUBDEVICE(r1, 0x40045532, &(0x7f0000000100)) r2 = syz_open_dev$sndpcmp(&(0x7f0000001200), 0x0, 0xa2c65) write$snddsp(r2, &(0x7f0000000200)="a3", 0x1) ioctl$SNDRV_PCM_IOCTL_DRAIN(r2, 0x4144, 0x0) ioctl$SNDRV_PCM_IOCTL_FORWARD(r2, 0x40084149, &(0x7f0000000040)=0x80000000) executing program 6: openat$ppp(0xffffffffffffff9c, &(0x7f0000000080), 0x100, 0x0) mprotect(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x5) r0 = socket(0xa, 0x3, 0xff) setsockopt$inet6_int(r0, 0x29, 0x21, 0x0, 0x0) sendto$inet6(r0, 0x0, 0x0, 0x24000844, &(0x7f00000005c0)={0xa, 0x2, 0x6, @private0, 0xdb}, 0x1c) executing program 5: r0 = socket$inet_udp(0x2, 0x2, 0x0) setsockopt$SO_TIMESTAMPING(r0, 0x1, 0x25, &(0x7f0000000200)=0x474c, 0x4) bind$inet(r0, &(0x7f0000000240)={0x2, 0x0, @local}, 0x6f) connect$inet(r0, &(0x7f0000000480)={0x2, 0x0, @multicast1}, 0x10) sendmmsg(r0, &(0x7f0000007fc0), 0x800001d, 0x300) setsockopt$inet_int(r0, 0x0, 0x19, &(0x7f0000000180)=0x1f5, 0x4) setsockopt$inet_int(r0, 0x0, 0x17, &(0x7f0000000880)=0x8, 0x4) recvmmsg(r0, &(0x7f0000008c00)=[{{0x0, 0x0, 0x0}}], 0x1, 0x45833af96e4b39fe, 0x0) executing program 8: r0 = openat$binder_debug(0xffffffffffffff9c, &(0x7f0000000040)='/sys/kernel/debug/binder/transactions\x00', 0x0, 0x0) r1 = openat$binderfs(0xffffffffffffff9c, &(0x7f00000000c0)='./binderfs/binder0\x00', 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR_EXT(r1, 0x4018620d, &(0x7f0000000100)) r2 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000140)='./binderfs/binder0\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000080)={0x8, 0x0, &(0x7f0000000400)=[@increfs], 0x0, 0x0, 0x0}) r3 = dup3(r2, r1, 0x0) r4 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000040)='./binderfs/binder0\x00', 0x0, 0x0) mmap$binder(&(0x7f0000ffd000/0x3000)=nil, 0x3000, 0x1, 0x11, r4, 0x0) ioctl$BINDER_SET_CONTEXT_MGR_EXT(r4, 0x4018620d, &(0x7f0000004a80)={0x73622a85, 0x100, 0x1}) ioctl$BINDER_WRITE_READ(r3, 0xc0306201, &(0x7f00000004c0)={0x8, 0x0, &(0x7f0000000000)=[@acquire], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r3, 0xc0306201, &(0x7f00000001c0)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) mmap$binder(&(0x7f0000ffe000/0x2000)=nil, 0x2000, 0x1, 0x11, r1, 0x10000000000) ioctl$BINDER_WRITE_READ(r4, 0xc0306201, &(0x7f0000000180)={0x0, 0x0, 0x0, 0x50, 0x0, &(0x7f0000000580)="b3185d7bb56f70f003360fa8bf71ac3086aedebf6fff904f92849a7a07395ee7f0e4cb1d78001c08a0ab73ffcf5ad07693727980eea946e6cba1723e81bfa5c3688803c8a124dcb27df7938e7ddfdd52"}) ioctl$BINDER_WRITE_READ(r4, 0xc0306201, &(0x7f0000004a40)={0x44, 0x0, &(0x7f00000049c0)=[@transaction={0x40406300, {0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) ioctl$BINDER_THREAD_EXIT(r4, 0x40046208, 0x0) read$FUSE(r0, &(0x7f0000004800)={0x2020}, 0x2020) executing program 6: r0 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$nl_generic(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000680)={0x18, 0x40, 0x1, 0xfffffffe, 0x25dfdbff, {0x1, 0x7c}, [@nested={0x4, 0x142}]}, 0x18}, 0x1, 0x0, 0x0, 0xc081}, 0x800c000) executing program 6: socket$rds(0x15, 0x5, 0x0) r0 = socket$alg(0x26, 0x5, 0x0) bind$alg(r0, 0x0, 0x0) bpf$MAP_CREATE(0x0, &(0x7f00000009c0)=@base={0xf, 0x4, 0x8, 0x8, 0x0, 0xffffffffffffffff, 0x2}, 0x50) bpf$PROG_LOAD(0x5, &(0x7f0000000600)={0x15, 0x3, &(0x7f0000000440)=@framed={{0x18, 0x0, 0x0, 0x0, 0xfffffffd, 0x0, 0x0, 0x0, 0x800}}, 0x0, 0x0, 0x0, 0x0, 0x1e00, 0x48, '\x00', 0x0, @sk_reuseport=0x28, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0xffffffff}, 0x94) bpf$BPF_PROG_TEST_RUN(0xa, 0x0, 0x0) setsockopt$ALG_SET_KEY(r0, 0x117, 0x1, 0x0, 0x0) syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r2 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) accept4$alg(r0, 0x0, 0x0, 0x800) r3 = syz_genetlink_get_family_id$netlbl_mgmt(&(0x7f0000000040), r2) sendmsg$NLBL_MGMT_C_ADDDEF(r1, &(0x7f0000000300)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000280)={0x34, r3, 0x1, 0x70bd2c, 0x25dfdbfe, {}, [@NLBL_MGMT_A_IPV4MASK={0x8, 0x8, @local}, @NLBL_MGMT_A_PROTOCOL={0x8, 0x2, 0x3}, @NLBL_MGMT_A_IPV4ADDR={0x8, 0x7, @remote}, @NLBL_MGMT_A_CV4DOI={0x8, 0x4, 0x3}]}, 0x34}, 0x1, 0x0, 0x0, 0x2400cc04}, 0x0) executing program 5: syz_usb_connect(0x2, 0x4e, &(0x7f0000000080)={{0x12, 0x1, 0x110, 0x47, 0xfe, 0x93, 0x40, 0x2caf, 0x13a3, 0xbddc, 0x1, 0x2, 0x3, 0x1, [{{0x9, 0x2, 0x3c, 0x2, 0x1, 0x2, 0x0, 0xd, "", [{{0x9, 0x4, 0x3e, 0xe3, 0x1, 0x60, 0x6a, 0xbc, 0x8, [], [{{0x9, 0x5, 0x0, 0x1, 0x10, 0xf4, 0x29, 0x81, [@generic={0x8, 0xb, "af33248a602c"}]}}]}}, {{0x9, 0x4, 0x8b, 0x86, 0x1, 0x2, 0x2, 0xff, 0x97, [], [{{0x9, 0x5, 0x0, 0x3, 0x20, 0x5, 0x81, 0xb0, [@generic={0x7, 0xb, "001521caf6"}]}}]}}]}}]}}, 0x0) executing program 6: r0 = bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x6, 0x4, &(0x7f0000000080)=ANY=[@ANYBLOB="1800000002000000000000000000000085000000bc00000095"], &(0x7f0000000200)='GPL\x00', 0x4, 0x0, 0x0, 0x0, 0x29, '\x00', 0x0, @fallback=0x2a, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) r1 = socket$inet_tcp(0x2, 0x1, 0x0) ioctl$sock_SIOCGIFINDEX(r1, 0x8933, &(0x7f0000000180)={'syz_tun\x00', 0x0}) bpf$BPF_LINK_CREATE_XDP(0x1c, &(0x7f00000005c0)={r0, r2, 0x25, 0x0, @val=@iter={0x0}}, 0x20) syz_emit_ethernet(0xd81, &(0x7f0000000600)={@local, @link_local={0x1, 0x80, 0xc2, 0x0, 0x0, 0x1}, @val={@void, {0x8100, 0x4, 0x1}}, {@mpls_uc={0x8847, {[], @ipv6=@generic={0x9, 0x6, "42e05d", 0xd47, 0x5c, 0x1, @loopback, @private1, {[@hopopts={0x3b, 0x18b, '\x00', [@hao={0xc9, 0x10, @private1}, @calipso={0x7, 0x48, {0x3, 0x10, 0x0, 0x2, [0x7dc, 0x9, 0x7, 0x7ff, 0xfffffffffffff44f, 0xfff, 0x9, 0x8]}}, @generic={0x7, 0x7b, "15150516342241d33f2f84419cd0ade5ead47f040f3610e0e64553bf3410243438486330d290af3e2a7347207e3096c9f52ae8fa46bb92954b5c4c8ddd25c8222c8e89291bbf3708eaf1cff9de108813e7d75f55f342443d057d1370fddf3a0525054239a4a929e53efdceba1f264486dd705079a5159b644cab60"}, @generic={0xb6, 0xb7e, "dcc90b7af212186183e96f505753a6bac53a363b8fea5b6f8ae2ffa5e616fb00ce4a776634ec4850a4336077d815b910c33440425503122672698c7f18eae511fabe74fff308983388351bedd123432d693ece874bc53b7cd6236bbf793f36fe58d256038f7bc58958b28b42e670a1e6c34be414b6ae7d19038ec6c9a1c5f5e726764e536e0c9947b044d126c68feaa30e71f6e99b15d78a283fc5948a0963f563ac50bedc5d4e4cccd75473a1f7048b5ec17441be54e319a19be0a405054fe58e8a082f53b4a4cbd649e76fde6fae7a1e2e1b07e29e94bbb1096d12a4b4ffa9eead4d2945653a0f1860cbd57c218fc8bd08943eca3246fd11a13d6551798f766702da5ce0f56b7a7db290e7f01bb26be889e8abc62c18ac4d9437b2d2133bae88ba5b2847c1916ac4a926cc51bbd5a723af30fd732e0118b78accd99bcd2d5406948f5f7b5fe2f3f12bb6dd940fc079dfceada5e2be2c011a836ce08a9966986c372a872cc3d17d5d34be3dd9f3751ab3821efb99006244fd3572fa6ee4e64558bdc9e704caa56175247ba767525d36f27d0664ecf57a18b28e8fea0baae0d944bb61c81ada0bf3a82cf3022c3d38cb857710212f46327c0899a8e998065a1700a4afb0023703607b8ec5a32826fea96f7c3b6d59e5541548eb5fed861392f04d5e5d9f487e6f41a09bddec16b3eb1089d5f3a1e97a755f4350a82f054eb13e06e77cdc5e4862dcc606cc26609734220cb35e27eabe1a339da9411a100bdbe973d27ab8a5a53ca1c0356c9608c5557feb8e376f9844a0cb6fe9ae6905f565fe8d62acffb89255459e95fb1d5340e3c9b95240eff2041d580a7469d4fa0b409d43ea489fb7fb20b0ea89d4c43430532cd2a273b97187335b605dd9a453d5f343642ae852e7e25006785eac4b1027f5aa7999ff1eeb16f118ca01a394914c6358f5667df96d8428034ecd7b600e4fd749171343ac8e5557e21614eb6c42633c919ddc7a9f9cf4d08b2e94db8f5a3aec1d63e5b8665e7f5007ef415866681d0e2520bed0a97af32c04591911257c71b7a1614447f8b520099781662f68f579a84ebcda93d0fe37c6423697c3492709da0f007a293a3142620478a7aad12baf7dc3ad15e2b1db8f8af17c8419208abf86fa188eda5c563961edaa2d47104b076f442d39b87dd4d254b92b3bbe2b8a95be230721a07631fe9066e6dcfb4c96e3b74acb93ae21e55d7e9b0a9b5b59f0ac7628262b960fcbd0a86e44223ca6d76fdedce62ecabb7b02f1f705862a2b60297d17f295275c80e8fb0791453847183d7cfb3e08f87b7ecd0ae24481df38a352c54227a20c60b899854287bbae06f974e74481419a6f705fd2b516d452c55fb87df013bbd714a0fe39cec0a18e4973407f45da2cccbc3004e0c62b6ae8bfb9c65400a22622bd9ff50cdf93e9031dd05c4afc5cc30d61d3c013b1c474695ca62d452ec6cdfbc21730b3cfdbdf815b508121dbb3af2b2b7235a2dd933d4ad2f82a59ec3fe8823b9730a4d2dcdb719f341cafd458752e23dac67b028988195ec33617f91921daa1f74a32970ad36bc4793bd4c40a83fefebf94db566cb2025be3cb05c3fd2abb99df00901c444cb56c64cb96eafba1e33bb5077168a4b0b8446b2cefca6b1d9d63ff1cce61e0b3ef3021c6270a799f94e0efd62e9a9d8c628b88fc07354d7ef8ea7f9b251456ad56d943e3f0092d7042c35bd94970cc5b7fe2364da0bae7f4fb0bf7a3bb3212f079a69b53fbe11afc0dbff7f005b12d6cec9e7169ebf8dfda4bb7d3211cabc7cffe7a0c1c1e496720209041c7f95aac0f49126ca7a5620f9f709bb72ba32ac6afe0acbfe3bee20b406d98b7e7bbe263b76fdb963c9e84c06c168aaac23c921feba4b2ef064f79aa1092fd2fc435feecee01ee10ebbd11199f6ee343e45dfc69b9f10fd86c85d4d3adf2d8d9be8c692fce1d92ce544bd53f33be2f40219953fd17842e0b608eb2d9e0db97286af10da05d6d3f2cebc5ae79d5fd3a7517f51c95ebc1044cdb711d03239b713553d5f99d9fdf7ac5dfe92e2c1a16c6de7f3c157698d8f96e3f46d2c9fca0de48fe3630afb2064686ba0c1734c37f0e9303488e9209025651142a87e8b1af770de99bc0b93c1cd9cf186bee7642588ea7f2f897f765b405dced642901d755c984de04602ca607a2cdd25f45eb7380d92ac70a80155a15438654ec26a3a90fe0fb8ae0bafe187440643dd3d29de3550d97f0b67c84f101e21c158279b18c29468e8b8968fc08ab5d794407f2a0cdcd31f23ba3c8e8ef0cd14a5be81ad4260142a457962171d216983c1d9a4ba1cf7009098d8d6848b12a6d14ef2fff856a5e3064e3ff2d9047e97c58644dce9a5c1c73c7cd3dcee911fda15cdbbf1e24a7f9d800f0197fa5af4a853a63d48a3fddc593bb68ebe0cd086359b69aa3f3b22b18d55bbad6a8c878f3bbc4730344fc84967fded81a7b7c651f6b121da407b818ff3516056bec3f4b4e6e8341de95a48614af93db4a7c74a96c3da0f623e58d0b224864d58d952359f13c01e322b2a8f9c2d564aaf25b0d83804b86bedb8db62d36dbb27437d7dc953d4b91270fd31b9fb50684b7bdf3ab78be0f94601feeceaba24cfd9ca2e3e9708f724b070d6153fc44fd68aa375037fb83b77a988d6e12c05e0ff9eb954fd732017979f0bdf7ba44c2b96d47815cd1527fd57cfbffa58c0e6727f1c56ff01fb78dc0aab374ef6b9bf409f3a1751f1935fad983a8def7de2c594b37fdcc29bceaff0e8d1aecd8bd938b3cbc5eed823897be22f1c037a73831b69e5148d11baeeb9b32ad016fe327705a59f7f40dd4bf4ca7ff1c5326dc24d81cbeeacfe6bbd9e9a44b56d8cc1eddb652744c0b2201d7014f9a49f55ee2b940f84a0369d5e81b5323321c89254fffa4d201c7a1eb032efc53607c48b5ebae48d80ad49bdaa20e13c9060692d50f50353ccadffa02cae0dfec8f60bbaef885cb16c2f02077762fc7518d28004e9630273a493ff53499499d766c60b0310e39a9c6c9db6c0a63f73f9e5089dade79e1939a88d6046cabaaed7588cd651761a1ca25be434e0280744693e3134fcd9d89e11cff18a841f4e2209aa9d52c2c257c95e283957c097227c493741d8a9a7fc5ac5e4c86dac5b419c8bc4a697534c1febfd52f9353805f554e30fb3f8c0bd977a83bbf2bdfb019cdd958af21dc00f54e86a0bf3df7219e1ca9c900646921c138404be38c279dcfcdd68a012715f6f0c5d68e5365658ac8b121868afe1d7f9ec07ed3b4b2ef49a3f07facdaccc07dd87b187a2dbb9e49b37c22b818d47f8cb27045c8b6e3ef1656072d7fdc23ab9a8e28506b52d04ae642152f4d6fd03f50537e9a7baa9e3a9ceb209b04f2844be5dca1526f9f1fcc8b57f33ada774f8262da08fb7f2b73cdc818e7788a240e656794a7186f4cfc0edb4940e73807b0dd39320056d1a9750041adf833562744323e9c492b2e199bbb8b2a647293e6b1e38e8022c0924a2dcccd406eab7c0d0caaf9ad4023bb57371c2a9de61b42363a266def05c178437715af52b1d424acf73f3298e8dfd02d849bd0d0d15a99026296cb6c9043909360b3173bd317834ca84261ffed928c83e058505abacde4171b14edb48450124bb253e8c35f6f44784b35c5b7cf761d25fc840bf88e8bb15adb3ca3a548d5727122c97209ff2321d46bfa5cb18a8c03b386c9aaef40ac79d5b5efc977447ac5b85df24cbe4365c996652f210a9477e57e137423b83f43cd217caa9be580735336400ad0b954469a56c0046e1123e00654c64d70d62cb07e90b7e475b8cae3e34e47ffd8bc282c7698c25fd5befe1719c1caec7771744ac07e2892c86ec383756d0fd055d4c8dbdef397e2f2c72ae9896db73830c47f0cfb06e8ea24da40daab915ba4c8d48a5ca30f9b51870eb92a7fbb927995249844b837fcc4dcbb7a04dee8d5c58fb2f16c046f2f8ebb480272c6250f69253fff678ba0d743c227ab4cde125da60d692376174d8d50d5ec735a80a69e32b23d128f6b8304570f3d600b354904ad9ed8d1e63ad336dc32f22be895af6943678fb3c924853e8cbb94f2d67090da239978c5caada0eaabe08e4dd2ce2b1ee8bafde0caf0c7b4e4cde188672b976e5d181337ec1d9ae2fa"}]}], "d443c4cd9262f2486153ea3f91e8d049fe1b44045f39b19bb735a99b66dd4f1e4bf3983d25e227c1013778774871609abb5c0fc06a61b35269e3b9a16e0dc07de3f32c3e6f543eaede0b600656968bc5ae6c090f334ad5b844f0232249e82328a61f620284d0b7da4640bbf84af374b6bdb6397a8a9155425618b8c659d53ae48c4be4538b1c0cad4950808c933e163c4897f9f13df0956bb82390f02fd2fc82e8323c9b849b0a7978e17b8a25f378c80e6e1d2f50f5a1587ccdf0e983f45be2ab36432ef1969e33a0e0dbb64f6a441cc69eb88a7da09108caf797904ce346"}}}}}}, 0x0) program crashed: WARNING in hugetlb_split bisect: the chunk can be dropped bisect: testing without sub-chunk 3/3 testing program (duration=6m5s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): [4, 7, 4, 13, 4, 17, 16, 16, 14, 13, 13, 13, 24, 23, 23, 9, 14, 13, 24, 13] detailed listing: executing program 4: r0 = syz_open_dev$sndctrl(&(0x7f0000000040), 0x0, 0x0) madvise(&(0x7f0000000000/0x600000)=nil, 0x600000, 0x15) mprotect(&(0x7f0000000000/0x4000)=nil, 0x4000, 0x1) ioctl$SNDRV_CTL_IOCTL_SUBSCRIBE_EVENTS(r0, 0xc0045516, &(0x7f0000000000)=0xffb) executing program 4: r0 = socket$l2tp(0x2, 0x2, 0x73) bind$inet(r0, &(0x7f00000002c0)={0x2, 0x4e1c, @multicast1}, 0x10) connect$inet(r0, &(0x7f0000000200)={0x2, 0x4e22, @local}, 0x10) r1 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000001c0)='memory.events\x00', 0x275a, 0x0) write$cgroup_subtree(r1, &(0x7f0000000100)=ANY=[], 0x32600) mmap(&(0x7f0000000000/0x3000)=nil, 0x3000, 0x2000001, 0x12, r1, 0x0) getsockopt$sock_buf(r0, 0x1, 0x1c, 0x0, &(0x7f00000000c0)) executing program 4: writev(0xffffffffffffffff, &(0x7f0000000180)=[{&(0x7f0000000240)}], 0x1) mprotect(&(0x7f0000000000/0xf000)=nil, 0xf000, 0x1) r0 = socket$inet6_sctp(0xa, 0x1, 0x84) getsockopt$inet_sctp6_SCTP_STREAM_SCHEDULER(r0, 0x84, 0x7b, &(0x7f0000000140)={0x0, 0x9}, &(0x7f0000000180)=0x8) executing program 4: syz_mount_image$fuse(0x0, &(0x7f0000002080)='./file0\x00', 0x208000, 0x0, 0x3d, 0x0, 0x0) r0 = open_tree(0xffffffffffffff9c, &(0x7f0000000640)='\x00', 0x89901) move_mount(r0, &(0x7f0000000140)='.\x00', 0xffffffffffffff9c, &(0x7f0000000180)='./file0\x00', 0x0) r1 = open_tree(0xffffffffffffff9c, &(0x7f0000000640)='\x00', 0x9801) move_mount(r1, &(0x7f0000000140)='.\x00', 0xffffffffffffff9c, &(0x7f0000000180)='./file0\x00', 0x0) chroot(&(0x7f0000001740)='./file0\x00') syz_open_procfs(0x0, &(0x7f0000000040)='mounts\x00') r2 = fsopen(&(0x7f0000000180)='proc\x00', 0x1) fsconfig$FSCONFIG_CMD_CREATE(r2, 0x6, 0x0, 0x0, 0x0) mprotect(&(0x7f0000000000/0x4000)=nil, 0x4000, 0x1) fchdir(0xffffffffffffffff) r3 = openat$fuse(0xffffffffffffff9c, &(0x7f0000000040), 0x42, 0x0) read$FUSE(r3, &(0x7f00000102c0)={0x2020}, 0x7) executing program 4: mmap(&(0x7f0000000000/0xff5000)=nil, 0xff5000, 0x1000002, 0x200000005c831, 0xffffffffffffffff, 0x0) timer_create(0x2, 0x0, &(0x7f0000bbdffc)) seccomp$SECCOMP_SET_MODE_FILTER(0x1, 0x4, &(0x7f0000000140)={0x0, 0x0}) remap_file_pages(&(0x7f0000800000/0x800000)=nil, 0x800000, 0x0, 0x600, 0x102020) executing program 3: r0 = socket$unix(0x1, 0x5, 0x0) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000100)={'veth0_macvtap\x00', 0x0}) ioctl$FS_IOC_RESVSP(0xffffffffffffffff, 0xc0189436, 0x0) r2 = socket$inet6_mptcp(0xa, 0x1, 0x106) bind$inet6(r2, &(0x7f0000000040)={0xa, 0x4e22, 0x0, @empty, 0x7}, 0x1c) listen(r2, 0xfffffffc) r3 = socket$nl_generic(0x10, 0x3, 0x10) r4 = syz_genetlink_get_family_id$mptcp(&(0x7f0000000000), 0xffffffffffffffff) bpf$MAP_CREATE_CONST_STR(0x0, 0x0, 0x0) bpf$MAP_CREATE_RINGBUF(0x0, &(0x7f0000000780)={0x1b, 0x0, 0x0, 0x40000, 0x0, 0x0, 0x1, '\x00', r1, 0x0}, 0x50) bpf$PROG_LOAD(0x5, 0x0, 0x0) r5 = syz_genetlink_get_family_id$mptcp(&(0x7f0000000040), 0xffffffffffffffff) r6 = socket$inet_mptcp(0x2, 0x1, 0x106) connect$inet(r6, &(0x7f0000000000)={0x2, 0x4e22, @local}, 0x10) sendmsg$MPTCP_PM_CMD_DEL_ADDR(0xffffffffffffffff, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000000240)={0x28, r5, 0x7, 0x0, 0x0, {}, [@MPTCP_PM_ATTR_ADDR={0x14, 0x1, 0x0, 0x1, [@MPTCP_PM_ADDR_ATTR_FAMILY={0x6, 0x1, 0x2}, @MPTCP_PM_ADDR_ATTR_ADDR4={0x8, 0x3, @local}]}]}, 0x28}}, 0x0) syz_genetlink_get_family_id$mptcp(&(0x7f00000000c0), 0xffffffffffffffff) sendmsg$MPTCP_PM_CMD_ADD_ADDR(r3, &(0x7f0000000400)={0x0, 0x0, &(0x7f00000003c0)={&(0x7f00000004c0)={0x30, r4, 0x1, 0x70bd2c, 0x1000000, {}, [@MPTCP_PM_ATTR_ADDR={0x1c, 0x1, 0x0, 0x1, [@MPTCP_PM_ADDR_ATTR_FAMILY={0x6, 0x1, 0x2}, @MPTCP_PM_ADDR_ATTR_ADDR4={0x8, 0x3, @dev={0xac, 0x14, 0x14, 0x37}}, @MPTCP_PM_ADDR_ATTR_FLAGS={0x8, 0x6, 0x3}]}]}, 0x30}, 0x1, 0xff07}, 0x2000000) executing program 3: r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000100), 0x0, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000040)={'syzkaller0\x00', 0x2}) r1 = openat$tun(0xffffffffffffff9c, &(0x7f0000000400), 0x0, 0x0) close(r1) socket$inet_udp(0x2, 0x2, 0x0) ioctl$SIOCSIFHWADDR(r1, 0x8914, &(0x7f0000002280)={'syzkaller0\x00', @multicast}) r2 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r2, 0x8933, &(0x7f0000000100)={'syzkaller0\x00', 0x0}) sendmsg$nl_route_sched(r2, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000580)={&(0x7f0000000600)=@newqdisc={0x4c, 0x24, 0x4ee4e6a52ff56541, 0x1, 0x25dfdbfd, {0x0, 0x0, 0x0, r3, {0x0, 0xb}, {0xffff, 0xffff}, {0xfff2}}, [@qdisc_kind_options=@q_netem={{0xa}, {0x1c, 0x2, {{0x3, 0x3, 0x6361, 0x5, 0xffffffff, 0x3}}}}]}, 0x4c}, 0x1, 0x0, 0x0, 0x40088c1}, 0x0) r4 = socket$unix(0x1, 0x1, 0x0) r5 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r4, 0x8933, &(0x7f0000000100)={'syzkaller0\x00', 0x0}) sendmsg$nl_route_sched(r5, &(0x7f0000000200)={0x0, 0x0, &(0x7f0000000140)={&(0x7f00000004c0)=@newqdisc={0x24, 0x24, 0x4ee4e6a52ff56541, 0x70b923, 0x80000, {0x0, 0x0, 0x0, r6, {0x0, 0x9}, {0x0, 0xb}, {0x9, 0xb}}}, 0x24}, 0x1, 0x0, 0x0, 0x2000c061}, 0x0) r7 = socket$nl_generic(0x10, 0x3, 0x10) r8 = syz_genetlink_get_family_id$tipc(&(0x7f0000000080), r7) sendmsg$TIPC_CMD_ENABLE_BEARER(r7, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000280)={&(0x7f0000000680)=ANY=[@ANYBLOB='8\x00\x00\x00', @ANYRES16=r8, @ANYBLOB="010000000d0000000000010000000000000001410000001c001700000000000000006574683a73797a6b616c6c657230"], 0x38}}, 0x0) executing program 1: r0 = openat$binder_debug(0xffffffffffffff9c, &(0x7f0000000040)='/sys/kernel/debug/binder/transactions\x00', 0x0, 0x0) r1 = openat$binderfs(0xffffffffffffff9c, &(0x7f00000000c0)='./binderfs/binder0\x00', 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR_EXT(r1, 0x4018620d, &(0x7f0000000100)) r2 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000140)='./binderfs/binder0\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000080)={0x8, 0x0, &(0x7f0000000400)=[@increfs], 0x0, 0x0, 0x0}) r3 = dup3(r2, r1, 0x0) r4 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000040)='./binderfs/binder0\x00', 0x0, 0x0) mmap$binder(&(0x7f0000ffd000/0x3000)=nil, 0x3000, 0x1, 0x11, r4, 0x0) ioctl$BINDER_SET_CONTEXT_MGR_EXT(r4, 0x4018620d, 0x0) ioctl$BINDER_WRITE_READ(r3, 0xc0306201, &(0x7f00000004c0)={0x8, 0x0, &(0x7f0000000000)=[@acquire], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r3, 0xc0306201, &(0x7f00000001c0)={0x4c, 0x0, &(0x7f0000000fc0)=[@transaction_sg={0x40486311, {0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x48, 0x18, &(0x7f0000000300)={@flat=@weak_binder={0x77622a85, 0x100a, 0x8000000000}, @flat=@weak_binder={0x77622a85, 0x1100, 0x3}}, &(0x7f0000000200)={0x0, 0x18, 0x30}}}], 0x0, 0x0, 0x0}) mmap$binder(&(0x7f0000ffe000/0x2000)=nil, 0x2000, 0x1, 0x11, r1, 0x10000000000) ioctl$BINDER_WRITE_READ(r4, 0xc0306201, &(0x7f0000000180)={0x0, 0x0, 0x0, 0x50, 0x0, &(0x7f0000000580)="b3185d7bb56f70f003360fa8bf71ac3086aedebf6fff904f92849a7a07395ee7f0e4cb1d78001c08a0ab73ffcf5ad07693727980eea946e6cba1723e81bfa5c3688803c8a124dcb27df7938e7ddfdd52"}) ioctl$BINDER_WRITE_READ(r4, 0xc0306201, &(0x7f0000004a40)={0x44, 0x0, &(0x7f00000049c0)=[@transaction={0x40406300, {0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) ioctl$BINDER_THREAD_EXIT(r4, 0x40046208, 0x0) read$FUSE(r0, &(0x7f0000004800)={0x2020}, 0x2020) executing program 3: r0 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000380)='./binderfs/binder0\x00', 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR_EXT(r0, 0x4018620d, &(0x7f00000000c0)={0x73622a85, 0xa, 0x8000000000002}) r1 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000200)='./binderfs/binder0\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000080)={0x8, 0x0, &(0x7f0000000400)=[@increfs], 0x0, 0x0, 0x0}) r2 = dup3(r1, r0, 0x0) r3 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000000)='./binderfs/binder0\x00', 0x0, 0x0) mmap$binder(&(0x7f0000ffd000/0x3000)=nil, 0x3000, 0x1, 0x11, r3, 0x0) ioctl$BINDER_SET_CONTEXT_MGR_EXT(r3, 0x4018620d, &(0x7f0000000040)={0x73622a85, 0x10a}) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f00000003c0)={0x8, 0x0, &(0x7f0000000340)=[@acquire], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000001040)={0x4c, 0x0, &(0x7f0000000ec0)=[@transaction_sg={0x40486311, {0x1, 0x0, 0x0, 0x0, 0x41, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x1000}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000001c0)={0x4c, 0x0, &(0x7f0000000740)=[@transaction_sg={0x40486311, {0x1, 0x0, 0x0, 0x0, 0x11, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x400}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000c00)={0x44, 0x0, &(0x7f0000000a80)=[@transaction={0x40406300, {0x1, 0x0, 0x0, 0x0, 0x21, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) r4 = openat$binder_debug(0xffffffffffffff9c, 0x0, 0x0, 0x0) read$FUSE(r4, &(0x7f0000007fc0)={0x2020}, 0x2020) executing program 4: r0 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000380)='./binderfs/binder0\x00', 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR_EXT(r0, 0x4018620d, &(0x7f00000000c0)={0x73622a85, 0xa, 0x8000000000002}) r1 = openat$binderfs(0xffffffffffffff9c, 0x0, 0x0, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000080)={0x8, 0x0, &(0x7f0000000400)=[@increfs], 0x0, 0x0, 0x0}) r2 = dup3(r1, r0, 0x0) r3 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000000)='./binderfs/binder0\x00', 0x0, 0x0) r4 = mmap$binder(&(0x7f0000ffd000/0x3000)=nil, 0x3000, 0x1, 0x11, r3, 0x0) ioctl$BINDER_SET_CONTEXT_MGR_EXT(r3, 0x4018620d, &(0x7f0000000040)={0x73622a85, 0x10a}) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f00000003c0)={0x8, 0x0, &(0x7f0000000340)=[@acquire], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000001040)={0x4c, 0x0, &(0x7f0000000ec0)=[@transaction_sg={0x40486311, {0x1, 0x0, 0x0, 0x0, 0x41, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x1000}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000001c0)={0x4c, 0x0, &(0x7f0000000740)=[@transaction_sg={0x40486311, {0x1, 0x0, 0x0, 0x0, 0x11, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x400}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000c00)={0x44, 0x0, &(0x7f0000000a80)=[@transaction={0x40406300, {0x1, 0x0, 0x0, 0x0, 0x21, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r3, 0xc0306201, &(0x7f0000000300)={0xc, 0x0, &(0x7f0000000240)=[@free_buffer={0x40086303, r4}], 0x54, 0x0, &(0x7f0000000280)="37b82b8f41afa37c5297fe5b692d3cedbd057d6f37743560799bbf4ddd06bc810453adcec0c458de737aeadf5afcd6641ea3434a1a0bfd0debe7506939a82090490c46a6010019e855badfb0bee8561d5ee15bac"}) executing program 32: r0 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000380)='./binderfs/binder0\x00', 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR_EXT(r0, 0x4018620d, &(0x7f00000000c0)={0x73622a85, 0xa, 0x8000000000002}) r1 = openat$binderfs(0xffffffffffffff9c, 0x0, 0x0, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000080)={0x8, 0x0, &(0x7f0000000400)=[@increfs], 0x0, 0x0, 0x0}) r2 = dup3(r1, r0, 0x0) r3 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000000)='./binderfs/binder0\x00', 0x0, 0x0) r4 = mmap$binder(&(0x7f0000ffd000/0x3000)=nil, 0x3000, 0x1, 0x11, r3, 0x0) ioctl$BINDER_SET_CONTEXT_MGR_EXT(r3, 0x4018620d, &(0x7f0000000040)={0x73622a85, 0x10a}) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f00000003c0)={0x8, 0x0, &(0x7f0000000340)=[@acquire], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000001040)={0x4c, 0x0, &(0x7f0000000ec0)=[@transaction_sg={0x40486311, {0x1, 0x0, 0x0, 0x0, 0x41, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x1000}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000001c0)={0x4c, 0x0, &(0x7f0000000740)=[@transaction_sg={0x40486311, {0x1, 0x0, 0x0, 0x0, 0x11, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x400}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000c00)={0x44, 0x0, &(0x7f0000000a80)=[@transaction={0x40406300, {0x1, 0x0, 0x0, 0x0, 0x21, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r3, 0xc0306201, &(0x7f0000000300)={0xc, 0x0, &(0x7f0000000240)=[@free_buffer={0x40086303, r4}], 0x54, 0x0, &(0x7f0000000280)="37b82b8f41afa37c5297fe5b692d3cedbd057d6f37743560799bbf4ddd06bc810453adcec0c458de737aeadf5afcd6641ea3434a1a0bfd0debe7506939a82090490c46a6010019e855badfb0bee8561d5ee15bac"}) executing program 3: syz_mount_image$fuse(0x0, &(0x7f0000002080)='./file0\x00', 0x208000, 0x0, 0x3d, 0x0, 0x0) r0 = open_tree(0xffffffffffffff9c, &(0x7f0000000640)='\x00', 0x89901) move_mount(r0, &(0x7f0000000140)='.\x00', 0xffffffffffffff9c, &(0x7f0000000180)='./file0\x00', 0x0) r1 = open_tree(0xffffffffffffff9c, &(0x7f0000000640)='\x00', 0x9801) move_mount(r1, &(0x7f0000000140)='.\x00', 0xffffffffffffff9c, &(0x7f0000000180)='./file0\x00', 0x0) chroot(&(0x7f0000001740)='./file0\x00') syz_open_procfs(0x0, &(0x7f0000000040)='mounts\x00') r2 = fsopen(&(0x7f0000000180)='proc\x00', 0x1) fsconfig$FSCONFIG_CMD_CREATE(r2, 0x6, 0x0, 0x0, 0x0) mprotect(&(0x7f0000000000/0x4000)=nil, 0x4000, 0x1) fchdir(0xffffffffffffffff) r3 = openat$fuse(0xffffffffffffff9c, &(0x7f0000000040), 0x42, 0x0) read$FUSE(r3, &(0x7f00000102c0)={0x2020}, 0x7) executing program 3: r0 = socket$inet6_sctp(0xa, 0x1, 0x84) r1 = dup(r0) setsockopt$inet_sctp6_SCTP_SOCKOPT_BINDX_ADD(r1, 0x84, 0x64, 0x0, 0x0) sendmsg$inet6(r0, 0x0, 0x20000896) dup(r0) write$UHID_INPUT(r1, 0x0, 0x0) openat$ppp(0xffffffffffffff9c, &(0x7f0000000140), 0x42000, 0x0) syz_open_dev$vim2m(&(0x7f0000000000), 0x800, 0x2) socket$netlink(0x10, 0x3, 0x0) syz_open_procfs(0xffffffffffffffff, &(0x7f0000000500)='status\x00') socketpair$unix(0x1, 0x1, 0x0, &(0x7f00000001c0)) openat$fuse(0xffffffffffffff9c, &(0x7f00000000c0), 0x2, 0x0) r2 = open_tree(0xffffffffffffff9c, &(0x7f0000000640)='\x00', 0x89901) mount_setattr(r2, 0x0, 0x8000, 0x0, 0x0) socket(0x10, 0x3, 0x0) socket$nl_generic(0x10, 0x3, 0x10) socket$nl_netfilter(0x10, 0x3, 0xc) socket$kcm(0x2, 0xa, 0x2) r3 = socket$unix(0x1, 0x1, 0x0) bind$unix(r3, &(0x7f00000000c0)=@file={0x1, '\xe9\x1fq\x89Y\x1e\x923aK\x00'}, 0x6e) listen(r3, 0x0) accept(r3, 0x0, 0x0) r4 = socket$nl_netfilter(0x10, 0x3, 0xc) syz_emit_vhci(&(0x7f0000000840)=ANY=[@ANYBLOB="04050400c900", @ANYRES16=r4], 0x7) executing program 3: r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000100), 0x0, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000040)={'syzkaller0\x00', 0x2}) r1 = open_tree(0xffffffffffffff9c, &(0x7f0000000100)='\x00', 0x89901) r2 = fspick(r1, &(0x7f00000000c0)='.\x00', 0x0) fsconfig$FSCONFIG_SET_FLAG(r2, 0x0, &(0x7f0000000000)='dirsync\x00', 0x0, 0x0) fsconfig$FSCONFIG_CMD_RECONFIGURE(r2, 0x7, 0x0, 0x0, 0x0) setxattr$security_ima(&(0x7f0000000080)='./file0\x00', &(0x7f00000002c0), &(0x7f0000000380)=@ng={0x4, 0x2, "1263cdb7"}, 0x6, 0x0) r3 = openat$tun(0xffffffffffffff9c, &(0x7f0000000500), 0x40, 0x0) close(r3) r4 = socket$kcm(0x29, 0x2, 0x0) ioctl$sock_proto_private(r4, 0x89e2, &(0x7f0000000040)) socket$nl_generic(0x10, 0x3, 0x10) ioctl$SIOCSIFHWADDR(r3, 0x8914, &(0x7f0000002280)={'syzkaller0\x00', @multicast}) socket$nl_route(0x10, 0x3, 0x0) r5 = socket$nl_route(0x10, 0x3, 0x0) r6 = socket$unix(0x1, 0x1, 0x0) ioctl$sock_SIOCGIFINDEX(r6, 0x8933, &(0x7f0000000100)={'syzkaller0\x00', 0x0}) ioctl$VIDIOC_ENUMAUDOUT(r1, 0xc0345642, &(0x7f00000003c0)={0x2, "873e45dacd5291f166c9aac0b6f8ce6da80afca0fe66169480a5a6b43da5bc0e", 0x1}) sendmsg$nl_route_sched(r5, &(0x7f00000008c0)={0x0, 0x0, &(0x7f0000000900)={&(0x7f0000000140)=@newqdisc={0x44, 0x24, 0x4ee4e6a52ff56541, 0x70bd26, 0xffffffff, {0x0, 0x0, 0x0, r7, {0x0, 0xfff1}, {0xffff, 0xffff}, {0xe}}, [@qdisc_kind_options=@q_hfsc={{0x9}, {0x14, 0x2, @TCA_HFSC_FSC={0x10, 0x2, {0x5, 0x7, 0xb3}}}}]}, 0x44}, 0x1, 0x0, 0x0, 0x4000000}, 0x0) r8 = socket$nl_route(0x10, 0x3, 0x0) r9 = socket$unix(0x1, 0x1, 0x0) ioctl$sock_SIOCGIFINDEX(r9, 0x8933, &(0x7f0000000100)={'syzkaller0\x00', 0x0}) sendmsg$nl_route_sched(r8, &(0x7f0000001200)={0x0, 0x0, &(0x7f0000000280)={&(0x7f0000001240)=@newqdisc={0xc48, 0x28, 0x4ee4e6a52ff56541, 0x4001, 0xfffffdfc, {0x0, 0x0, 0x0, r10, {0x10}, {}, {0x2, 0x3}}, [@qdisc_kind_options=@q_tbf={{0x8}, {0xc1c, 0x2, [@TCA_TBF_PTAB={0x404, 0x3, [0x0, 0x4f0d, 0x5, 0x10001, 0x8, 0x10000, 0x80, 0x288, 0x9, 0x9, 0x2, 0xfff, 0xdfd, 0x1, 0x7887, 0x5, 0xdd16, 0x392, 0x31aa, 0x7fff, 0x2, 0xfffff98c, 0x4, 0x4e, 0x100, 0xa, 0x9, 0x2, 0x11, 0xffffffff, 0x3, 0x4, 0x1000, 0x800, 0x7, 0x1, 0x9, 0xd, 0x7, 0xa4f, 0x2, 0xc, 0x3, 0x0, 0xffffffef, 0x74, 0x4, 0x4, 0xffffffff, 0x6, 0x3, 0x1000, 0x6, 0x5, 0x71d, 0x2, 0xffff, 0x6, 0x6, 0x80000000, 0xce0, 0x9, 0xea5, 0x8, 0x200, 0x4, 0x8001, 0xa8, 0x9, 0x10, 0x9, 0x10000, 0x2, 0x7fff, 0xc, 0x7, 0x4800, 0x8, 0x6, 0xe87, 0x7f, 0x6, 0x0, 0x4800, 0x1, 0x12, 0x18b, 0x6, 0x2, 0x5, 0x1, 0x40, 0x5, 0x1, 0x0, 0x1da35084, 0x4, 0x1, 0x9, 0x7, 0x0, 0x4, 0x8, 0x4, 0x2, 0x0, 0x7, 0x200, 0x3, 0x8001, 0xa000, 0x0, 0x7a69, 0x764064d2, 0x92, 0x2, 0xbdc9, 0x3, 0xff, 0x2, 0x10, 0x5, 0x10000, 0x100, 0x5, 0x1022075d, 0x8, 0x5, 0x5, 0xfffffffe, 0x7f, 0x101, 0x4, 0xb, 0x9, 0x27, 0xff, 0x1, 0xf64a, 0xa78c, 0x5, 0x6, 0x7, 0xffff4fc5, 0x8, 0x7f, 0x385, 0x400, 0x100, 0x2, 0x5, 0x4, 0x7, 0x2, 0x7, 0x1, 0xb8, 0xffffff2a, 0x6, 0x8001, 0x6, 0x8, 0x3ff, 0x2, 0x6, 0x0, 0x6, 0x7fff, 0x80, 0x2, 0x5aeb, 0xe, 0x80000001, 0x39, 0x5, 0xa05, 0x3, 0x9, 0x72, 0x5, 0x4, 0x9, 0xba, 0x3, 0xc3, 0x8, 0x6, 0x7f, 0x5, 0xe8f0, 0x55, 0x8, 0x0, 0x7, 0x2, 0x8, 0x410, 0xffff03a4, 0xa8, 0x39b5, 0x8, 0xf3, 0x4, 0x10001, 0x0, 0x7f, 0x2, 0x7fff, 0x7, 0x401, 0x4, 0x0, 0x8, 0x2, 0x7, 0x2, 0x1, 0x2, 0x8, 0xffff, 0x0, 0x9, 0xc0e, 0x41, 0xf, 0xffff, 0xfffffff7, 0xffffff26, 0x7, 0x32a, 0xad95, 0x776, 0x9, 0xfffffffd, 0xfbc0, 0x3, 0xa4c9, 0x1, 0x6, 0xb, 0x3, 0x101, 0x1, 0x0, 0x2, 0x3, 0x4, 0x0, 0x80000000, 0xfffffff8, 0x400, 0x5, 0x2, 0x40, 0xfffeffff, 0x541b]}, @TCA_TBF_RTAB={0x404, 0x2, [0x9, 0x100, 0x2, 0xc91, 0x5, 0x400, 0x1000, 0x2, 0x5, 0x3ff, 0x2, 0x200, 0x7, 0x2, 0x6, 0xdb6, 0x401, 0x6, 0xf, 0x100, 0x3, 0xb, 0x5, 0x77dedf80, 0x100, 0x7, 0x2, 0x4, 0x1, 0x5, 0x5, 0x5, 0x4, 0x7, 0x6, 0x6, 0x4, 0x0, 0x0, 0x3, 0x5, 0x2, 0x10, 0x101, 0x8, 0xd6, 0x8, 0x800, 0x3, 0x4, 0x10001, 0x66a, 0x7, 0x7, 0x6c, 0xa6d, 0x4, 0x6, 0x3, 0x8, 0x2, 0x3d, 0x4, 0x80000000, 0xc, 0x2, 0x40, 0x7, 0x2, 0x4, 0xffffffff, 0x2, 0x4, 0xb0, 0xe7, 0x8, 0x8001, 0x7, 0xb, 0x4, 0x3, 0x2, 0x6, 0x1, 0x5, 0x10001, 0x3, 0x4, 0xffffffff, 0x5, 0x4, 0x7, 0x5, 0x3, 0x8, 0x8, 0x0, 0x374, 0x2, 0x4, 0x7, 0x81, 0x8, 0x7f, 0x9, 0x0, 0x4, 0x6, 0x2, 0xa08d, 0x100, 0x5, 0xffff248d, 0x5, 0x7, 0xa, 0x0, 0x671, 0x3, 0x10000, 0x8c, 0x2ea, 0xd6, 0x79, 0x9, 0x9, 0xc, 0xccf, 0x2, 0xb, 0x5, 0x100, 0x158, 0x4, 0x2, 0x7, 0x1, 0x401, 0x6, 0x5, 0xfffffffb, 0xffffffff, 0x6, 0x80000001, 0x2, 0x7, 0x5, 0xab7, 0x6f18f07b, 0x80000001, 0x0, 0x9, 0xc1, 0x5, 0x4, 0x8, 0x7, 0x3, 0x8, 0x3ff, 0x0, 0x9, 0x203a, 0x3, 0x0, 0x8, 0x2, 0x7, 0x7, 0x8, 0x0, 0x4, 0x4007ff, 0x4, 0x9, 0x2, 0x5, 0x8000, 0x200, 0x0, 0x1, 0xfffffff6, 0x0, 0x7b, 0xfd, 0x5b653309, 0xe5, 0x14f, 0x6, 0x10001, 0x1, 0x7, 0x2, 0xffffffff, 0x0, 0x40100, 0x197, 0x3ff, 0x9, 0x4, 0x200, 0xcbf, 0x1ff, 0x80, 0x9, 0x2f74, 0x4, 0x1, 0x9, 0x0, 0x4, 0x8, 0x8000, 0x5, 0x8, 0xf, 0x9, 0x6057, 0x101, 0x8001, 0xad, 0x4, 0x7, 0x7, 0x2, 0x80000001, 0x8c6b, 0xd87, 0x82, 0x100, 0x0, 0x80000000, 0x0, 0x9a, 0x9, 0xfc3, 0x89, 0xa, 0x80000001, 0x2, 0x1, 0xffffffff, 0x4, 0x8000, 0x2, 0x3, 0x10000, 0x8486, 0x3, 0x8, 0x6, 0x0, 0x1, 0x3, 0x2, 0x9]}, @TCA_TBF_PTAB={0x404, 0x3, [0x5, 0x5, 0x4, 0x5, 0x8001, 0x8, 0x5, 0x2, 0x8, 0x5, 0x4c5, 0x1, 0x6, 0x8, 0x5, 0x5, 0x1, 0x6, 0x0, 0x0, 0x0, 0x0, 0x81, 0xfff, 0x10, 0x3, 0xe55, 0xd, 0x3, 0x6, 0x2, 0x5, 0xef, 0x7, 0x1, 0x8, 0x96b, 0x8, 0x80000001, 0x3, 0x6, 0x5, 0xa4f, 0x8, 0x3, 0x7ff, 0xc68, 0x80000001, 0x10200, 0x101, 0x10100, 0x166, 0x1, 0x7, 0x7a8, 0x2d, 0x7, 0x80, 0x8, 0x9, 0x0, 0x3ff, 0x8001, 0x5, 0x0, 0x635, 0x656, 0x2, 0x6, 0x5, 0x8, 0x1, 0x6, 0xeb, 0xfffffff9, 0x8, 0x3, 0x1, 0x0, 0x0, 0x3, 0x8ca, 0xffff, 0x9, 0x8, 0x800, 0xc198, 0x8, 0x7db903f4, 0x4, 0x6, 0x2, 0xfffffffc, 0x4, 0x7, 0xa2d, 0x0, 0x0, 0x8, 0x5, 0x8, 0x1000, 0x44da11fe, 0x5, 0xfffffbff, 0xfffff2fc, 0x4, 0x7d2, 0x4, 0x7, 0xffffffff, 0x2, 0xe, 0xe, 0x7, 0x101, 0x5, 0x1, 0x98, 0xc, 0x4, 0x98, 0x7, 0xffff, 0x8e58, 0x6, 0x9, 0x77a, 0x1, 0xfffff001, 0x1, 0x0, 0x7, 0x5, 0x9, 0x0, 0x2, 0xe5, 0x51, 0x2, 0xd50, 0x80000000, 0x1ff, 0x7, 0x3, 0xfffffff2, 0x7ff, 0x1ff, 0xee, 0x0, 0xfffff8aa, 0x0, 0x0, 0x80, 0x6df0, 0x2, 0x4, 0x10001, 0x7ff, 0x1, 0xfffffe01, 0x4, 0x5, 0x81, 0x5, 0x2e7, 0xf3, 0x9, 0x6, 0x5, 0x8000, 0x8, 0xe, 0xce2a, 0x1, 0xcb, 0x5, 0x0, 0x9, 0x94, 0x9f, 0x3, 0x8, 0x401, 0x5, 0x3ff, 0x5, 0x1b, 0x2, 0x4, 0x862d, 0x0, 0xff, 0x5, 0x1, 0x1, 0x0, 0xd, 0x5, 0x4, 0xffffff5c, 0x6, 0xff, 0x3, 0x728, 0x2be55882, 0x8, 0x7, 0x7, 0x0, 0x10, 0x7, 0xff, 0x101, 0xfffff801, 0xc86, 0x3, 0x10000, 0x2, 0x2, 0x2, 0x2, 0x2400, 0x81, 0x5, 0x5, 0x3, 0xc9, 0x1, 0x13, 0x5, 0x9, 0xffffffa2, 0xf5b, 0xe, 0xe, 0xb, 0x8, 0xff, 0x2, 0x3, 0x9, 0x10, 0x67d8fb7a, 0x3, 0x8, 0x10001, 0xfffffffa, 0x8001, 0x4, 0x9, 0x0, 0x1, 0x3, 0xfffffffe, 0x100]}, @TCA_TBF_PRATE64={0xc, 0x5, 0x467944efcdcbb7e7}]}}]}, 0xc48}, 0x1, 0x0, 0x0, 0xb3538085985bb3d6}, 0x0) executing program 33: r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000100), 0x0, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000040)={'syzkaller0\x00', 0x2}) r1 = open_tree(0xffffffffffffff9c, &(0x7f0000000100)='\x00', 0x89901) r2 = fspick(r1, &(0x7f00000000c0)='.\x00', 0x0) fsconfig$FSCONFIG_SET_FLAG(r2, 0x0, &(0x7f0000000000)='dirsync\x00', 0x0, 0x0) fsconfig$FSCONFIG_CMD_RECONFIGURE(r2, 0x7, 0x0, 0x0, 0x0) setxattr$security_ima(&(0x7f0000000080)='./file0\x00', &(0x7f00000002c0), &(0x7f0000000380)=@ng={0x4, 0x2, "1263cdb7"}, 0x6, 0x0) r3 = openat$tun(0xffffffffffffff9c, &(0x7f0000000500), 0x40, 0x0) close(r3) r4 = socket$kcm(0x29, 0x2, 0x0) ioctl$sock_proto_private(r4, 0x89e2, &(0x7f0000000040)) socket$nl_generic(0x10, 0x3, 0x10) ioctl$SIOCSIFHWADDR(r3, 0x8914, &(0x7f0000002280)={'syzkaller0\x00', @multicast}) socket$nl_route(0x10, 0x3, 0x0) r5 = socket$nl_route(0x10, 0x3, 0x0) r6 = socket$unix(0x1, 0x1, 0x0) ioctl$sock_SIOCGIFINDEX(r6, 0x8933, &(0x7f0000000100)={'syzkaller0\x00', 0x0}) ioctl$VIDIOC_ENUMAUDOUT(r1, 0xc0345642, &(0x7f00000003c0)={0x2, "873e45dacd5291f166c9aac0b6f8ce6da80afca0fe66169480a5a6b43da5bc0e", 0x1}) sendmsg$nl_route_sched(r5, &(0x7f00000008c0)={0x0, 0x0, &(0x7f0000000900)={&(0x7f0000000140)=@newqdisc={0x44, 0x24, 0x4ee4e6a52ff56541, 0x70bd26, 0xffffffff, {0x0, 0x0, 0x0, r7, {0x0, 0xfff1}, {0xffff, 0xffff}, {0xe}}, [@qdisc_kind_options=@q_hfsc={{0x9}, {0x14, 0x2, @TCA_HFSC_FSC={0x10, 0x2, {0x5, 0x7, 0xb3}}}}]}, 0x44}, 0x1, 0x0, 0x0, 0x4000000}, 0x0) r8 = socket$nl_route(0x10, 0x3, 0x0) r9 = socket$unix(0x1, 0x1, 0x0) ioctl$sock_SIOCGIFINDEX(r9, 0x8933, &(0x7f0000000100)={'syzkaller0\x00', 0x0}) sendmsg$nl_route_sched(r8, &(0x7f0000001200)={0x0, 0x0, &(0x7f0000000280)={&(0x7f0000001240)=@newqdisc={0xc48, 0x28, 0x4ee4e6a52ff56541, 0x4001, 0xfffffdfc, {0x0, 0x0, 0x0, r10, {0x10}, {}, {0x2, 0x3}}, [@qdisc_kind_options=@q_tbf={{0x8}, {0xc1c, 0x2, [@TCA_TBF_PTAB={0x404, 0x3, [0x0, 0x4f0d, 0x5, 0x10001, 0x8, 0x10000, 0x80, 0x288, 0x9, 0x9, 0x2, 0xfff, 0xdfd, 0x1, 0x7887, 0x5, 0xdd16, 0x392, 0x31aa, 0x7fff, 0x2, 0xfffff98c, 0x4, 0x4e, 0x100, 0xa, 0x9, 0x2, 0x11, 0xffffffff, 0x3, 0x4, 0x1000, 0x800, 0x7, 0x1, 0x9, 0xd, 0x7, 0xa4f, 0x2, 0xc, 0x3, 0x0, 0xffffffef, 0x74, 0x4, 0x4, 0xffffffff, 0x6, 0x3, 0x1000, 0x6, 0x5, 0x71d, 0x2, 0xffff, 0x6, 0x6, 0x80000000, 0xce0, 0x9, 0xea5, 0x8, 0x200, 0x4, 0x8001, 0xa8, 0x9, 0x10, 0x9, 0x10000, 0x2, 0x7fff, 0xc, 0x7, 0x4800, 0x8, 0x6, 0xe87, 0x7f, 0x6, 0x0, 0x4800, 0x1, 0x12, 0x18b, 0x6, 0x2, 0x5, 0x1, 0x40, 0x5, 0x1, 0x0, 0x1da35084, 0x4, 0x1, 0x9, 0x7, 0x0, 0x4, 0x8, 0x4, 0x2, 0x0, 0x7, 0x200, 0x3, 0x8001, 0xa000, 0x0, 0x7a69, 0x764064d2, 0x92, 0x2, 0xbdc9, 0x3, 0xff, 0x2, 0x10, 0x5, 0x10000, 0x100, 0x5, 0x1022075d, 0x8, 0x5, 0x5, 0xfffffffe, 0x7f, 0x101, 0x4, 0xb, 0x9, 0x27, 0xff, 0x1, 0xf64a, 0xa78c, 0x5, 0x6, 0x7, 0xffff4fc5, 0x8, 0x7f, 0x385, 0x400, 0x100, 0x2, 0x5, 0x4, 0x7, 0x2, 0x7, 0x1, 0xb8, 0xffffff2a, 0x6, 0x8001, 0x6, 0x8, 0x3ff, 0x2, 0x6, 0x0, 0x6, 0x7fff, 0x80, 0x2, 0x5aeb, 0xe, 0x80000001, 0x39, 0x5, 0xa05, 0x3, 0x9, 0x72, 0x5, 0x4, 0x9, 0xba, 0x3, 0xc3, 0x8, 0x6, 0x7f, 0x5, 0xe8f0, 0x55, 0x8, 0x0, 0x7, 0x2, 0x8, 0x410, 0xffff03a4, 0xa8, 0x39b5, 0x8, 0xf3, 0x4, 0x10001, 0x0, 0x7f, 0x2, 0x7fff, 0x7, 0x401, 0x4, 0x0, 0x8, 0x2, 0x7, 0x2, 0x1, 0x2, 0x8, 0xffff, 0x0, 0x9, 0xc0e, 0x41, 0xf, 0xffff, 0xfffffff7, 0xffffff26, 0x7, 0x32a, 0xad95, 0x776, 0x9, 0xfffffffd, 0xfbc0, 0x3, 0xa4c9, 0x1, 0x6, 0xb, 0x3, 0x101, 0x1, 0x0, 0x2, 0x3, 0x4, 0x0, 0x80000000, 0xfffffff8, 0x400, 0x5, 0x2, 0x40, 0xfffeffff, 0x541b]}, @TCA_TBF_RTAB={0x404, 0x2, [0x9, 0x100, 0x2, 0xc91, 0x5, 0x400, 0x1000, 0x2, 0x5, 0x3ff, 0x2, 0x200, 0x7, 0x2, 0x6, 0xdb6, 0x401, 0x6, 0xf, 0x100, 0x3, 0xb, 0x5, 0x77dedf80, 0x100, 0x7, 0x2, 0x4, 0x1, 0x5, 0x5, 0x5, 0x4, 0x7, 0x6, 0x6, 0x4, 0x0, 0x0, 0x3, 0x5, 0x2, 0x10, 0x101, 0x8, 0xd6, 0x8, 0x800, 0x3, 0x4, 0x10001, 0x66a, 0x7, 0x7, 0x6c, 0xa6d, 0x4, 0x6, 0x3, 0x8, 0x2, 0x3d, 0x4, 0x80000000, 0xc, 0x2, 0x40, 0x7, 0x2, 0x4, 0xffffffff, 0x2, 0x4, 0xb0, 0xe7, 0x8, 0x8001, 0x7, 0xb, 0x4, 0x3, 0x2, 0x6, 0x1, 0x5, 0x10001, 0x3, 0x4, 0xffffffff, 0x5, 0x4, 0x7, 0x5, 0x3, 0x8, 0x8, 0x0, 0x374, 0x2, 0x4, 0x7, 0x81, 0x8, 0x7f, 0x9, 0x0, 0x4, 0x6, 0x2, 0xa08d, 0x100, 0x5, 0xffff248d, 0x5, 0x7, 0xa, 0x0, 0x671, 0x3, 0x10000, 0x8c, 0x2ea, 0xd6, 0x79, 0x9, 0x9, 0xc, 0xccf, 0x2, 0xb, 0x5, 0x100, 0x158, 0x4, 0x2, 0x7, 0x1, 0x401, 0x6, 0x5, 0xfffffffb, 0xffffffff, 0x6, 0x80000001, 0x2, 0x7, 0x5, 0xab7, 0x6f18f07b, 0x80000001, 0x0, 0x9, 0xc1, 0x5, 0x4, 0x8, 0x7, 0x3, 0x8, 0x3ff, 0x0, 0x9, 0x203a, 0x3, 0x0, 0x8, 0x2, 0x7, 0x7, 0x8, 0x0, 0x4, 0x4007ff, 0x4, 0x9, 0x2, 0x5, 0x8000, 0x200, 0x0, 0x1, 0xfffffff6, 0x0, 0x7b, 0xfd, 0x5b653309, 0xe5, 0x14f, 0x6, 0x10001, 0x1, 0x7, 0x2, 0xffffffff, 0x0, 0x40100, 0x197, 0x3ff, 0x9, 0x4, 0x200, 0xcbf, 0x1ff, 0x80, 0x9, 0x2f74, 0x4, 0x1, 0x9, 0x0, 0x4, 0x8, 0x8000, 0x5, 0x8, 0xf, 0x9, 0x6057, 0x101, 0x8001, 0xad, 0x4, 0x7, 0x7, 0x2, 0x80000001, 0x8c6b, 0xd87, 0x82, 0x100, 0x0, 0x80000000, 0x0, 0x9a, 0x9, 0xfc3, 0x89, 0xa, 0x80000001, 0x2, 0x1, 0xffffffff, 0x4, 0x8000, 0x2, 0x3, 0x10000, 0x8486, 0x3, 0x8, 0x6, 0x0, 0x1, 0x3, 0x2, 0x9]}, @TCA_TBF_PTAB={0x404, 0x3, [0x5, 0x5, 0x4, 0x5, 0x8001, 0x8, 0x5, 0x2, 0x8, 0x5, 0x4c5, 0x1, 0x6, 0x8, 0x5, 0x5, 0x1, 0x6, 0x0, 0x0, 0x0, 0x0, 0x81, 0xfff, 0x10, 0x3, 0xe55, 0xd, 0x3, 0x6, 0x2, 0x5, 0xef, 0x7, 0x1, 0x8, 0x96b, 0x8, 0x80000001, 0x3, 0x6, 0x5, 0xa4f, 0x8, 0x3, 0x7ff, 0xc68, 0x80000001, 0x10200, 0x101, 0x10100, 0x166, 0x1, 0x7, 0x7a8, 0x2d, 0x7, 0x80, 0x8, 0x9, 0x0, 0x3ff, 0x8001, 0x5, 0x0, 0x635, 0x656, 0x2, 0x6, 0x5, 0x8, 0x1, 0x6, 0xeb, 0xfffffff9, 0x8, 0x3, 0x1, 0x0, 0x0, 0x3, 0x8ca, 0xffff, 0x9, 0x8, 0x800, 0xc198, 0x8, 0x7db903f4, 0x4, 0x6, 0x2, 0xfffffffc, 0x4, 0x7, 0xa2d, 0x0, 0x0, 0x8, 0x5, 0x8, 0x1000, 0x44da11fe, 0x5, 0xfffffbff, 0xfffff2fc, 0x4, 0x7d2, 0x4, 0x7, 0xffffffff, 0x2, 0xe, 0xe, 0x7, 0x101, 0x5, 0x1, 0x98, 0xc, 0x4, 0x98, 0x7, 0xffff, 0x8e58, 0x6, 0x9, 0x77a, 0x1, 0xfffff001, 0x1, 0x0, 0x7, 0x5, 0x9, 0x0, 0x2, 0xe5, 0x51, 0x2, 0xd50, 0x80000000, 0x1ff, 0x7, 0x3, 0xfffffff2, 0x7ff, 0x1ff, 0xee, 0x0, 0xfffff8aa, 0x0, 0x0, 0x80, 0x6df0, 0x2, 0x4, 0x10001, 0x7ff, 0x1, 0xfffffe01, 0x4, 0x5, 0x81, 0x5, 0x2e7, 0xf3, 0x9, 0x6, 0x5, 0x8000, 0x8, 0xe, 0xce2a, 0x1, 0xcb, 0x5, 0x0, 0x9, 0x94, 0x9f, 0x3, 0x8, 0x401, 0x5, 0x3ff, 0x5, 0x1b, 0x2, 0x4, 0x862d, 0x0, 0xff, 0x5, 0x1, 0x1, 0x0, 0xd, 0x5, 0x4, 0xffffff5c, 0x6, 0xff, 0x3, 0x728, 0x2be55882, 0x8, 0x7, 0x7, 0x0, 0x10, 0x7, 0xff, 0x101, 0xfffff801, 0xc86, 0x3, 0x10000, 0x2, 0x2, 0x2, 0x2, 0x2400, 0x81, 0x5, 0x5, 0x3, 0xc9, 0x1, 0x13, 0x5, 0x9, 0xffffffa2, 0xf5b, 0xe, 0xe, 0xb, 0x8, 0xff, 0x2, 0x3, 0x9, 0x10, 0x67d8fb7a, 0x3, 0x8, 0x10001, 0xfffffffa, 0x8001, 0x4, 0x9, 0x0, 0x1, 0x3, 0xfffffffe, 0x100]}, @TCA_TBF_PRATE64={0xc, 0x5, 0x467944efcdcbb7e7}]}}]}, 0xc48}, 0x1, 0x0, 0x0, 0xb3538085985bb3d6}, 0x0) executing program 1: bpf$MAP_CREATE(0x0, &(0x7f00000000c0)=@base={0x1b, 0x0, 0x0, 0x8000, 0x80000}, 0x50) mount$fuse(0x0, &(0x7f00000020c0)='./file0\x00', 0x0, 0x80, &(0x7f00000002c0)={{}, 0x2c, {'rootmode', 0x3d, 0x4000}}) syz_fuse_handle_req(0xffffffffffffffff, 0x0, 0x0, 0x0) syz_fuse_handle_req(0xffffffffffffffff, 0x0, 0x0, 0x0) getdents64(0xffffffffffffffff, 0x0, 0x0) r0 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPSET_CMD_CREATE(r0, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)={&(0x7f00000000c0)=ANY=[@ANYBLOB="4c0000000206010800000000000000000000003f0500010006000000050005000200000005000400000000000900020073797a310020000013000300686173683a"], 0x4c}}, 0x0) r1 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPSET_CMD_ADD(r1, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000300)={0x54, 0x9, 0x6, 0x201, 0x0, 0x0, {0x2, 0x0, 0xfdff}, [@IPSET_ATTR_DATA={0x2c, 0x7, 0x0, 0x1, [@IPSET_ATTR_IP={0xc, 0x1, 0x0, 0x1, @IPSET_ATTR_IPADDR_IPV4={0x8, 0x1, 0x1, 0x0, @multicast1}}, @IPSET_ATTR_IFACE={0x14, 0x17, 'batadv_slave_0\x00'}, @IPSET_ATTR_CADT_FLAGS={0x8, 0x8, 0x1, 0x0, 0x94}]}, @IPSET_ATTR_SETNAME={0x9, 0x2, 'syz1\x00'}, @IPSET_ATTR_PROTOCOL={0x5}]}, 0x54}}, 0x40c0080) executing program 1: r0 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000380)='./binderfs/binder0\x00', 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR_EXT(r0, 0x4018620d, &(0x7f00000000c0)={0x73622a85, 0xa, 0x8000000000002}) r1 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000200)='./binderfs/binder0\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000080)={0x8, 0x0, &(0x7f0000000400)=[@increfs], 0x0, 0x0, 0x0}) r2 = dup3(r1, r0, 0x0) r3 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000000)='./binderfs/binder0\x00', 0x0, 0x0) mmap$binder(&(0x7f0000ffd000/0x3000)=nil, 0x3000, 0x1, 0x11, r3, 0x0) ioctl$BINDER_SET_CONTEXT_MGR_EXT(r3, 0x4018620d, &(0x7f0000000040)={0x73622a85, 0x10a}) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f00000003c0)={0x8, 0x0, &(0x7f0000000340)=[@acquire], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000001040)={0x4c, 0x0, &(0x7f0000000ec0)=[@transaction_sg={0x40486311, {0x1, 0x0, 0x0, 0x0, 0x41, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x1000}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000001c0)={0x4c, 0x0, &(0x7f0000000740)=[@transaction_sg={0x40486311, {0x1, 0x0, 0x0, 0x0, 0x11, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x400}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000c00)={0x44, 0x0, &(0x7f0000000a80)=[@transaction={0x40406300, {0x1, 0x0, 0x0, 0x0, 0x21, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) r4 = openat$binder_debug(0xffffffffffffff9c, 0x0, 0x0, 0x0) read$FUSE(r4, &(0x7f0000007fc0)={0x2020}, 0x2020) executing program 1: syz_mount_image$fuse(0x0, &(0x7f0000002080)='./file0\x00', 0x208000, 0x0, 0x3d, 0x0, 0x0) r0 = open_tree(0xffffffffffffff9c, &(0x7f0000000640)='\x00', 0x89901) move_mount(r0, &(0x7f0000000140)='.\x00', 0xffffffffffffff9c, &(0x7f0000000180)='./file0\x00', 0x0) r1 = open_tree(0xffffffffffffff9c, &(0x7f0000000640)='\x00', 0x9801) move_mount(r1, &(0x7f0000000140)='.\x00', 0xffffffffffffff9c, &(0x7f0000000180)='./file0\x00', 0x0) chroot(&(0x7f0000001740)='./file0\x00') syz_open_procfs(0x0, &(0x7f0000000040)='mounts\x00') r2 = fsopen(&(0x7f0000000180)='proc\x00', 0x1) r3 = fsmount(r2, 0x1, 0x0) mprotect(&(0x7f0000000000/0x4000)=nil, 0x4000, 0x1) fchdir(r3) r4 = openat$fuse(0xffffffffffffff9c, &(0x7f0000000040), 0x42, 0x0) read$FUSE(r4, &(0x7f00000102c0)={0x2020}, 0x7) executing program 1: r0 = socket$inet6_sctp(0xa, 0x1, 0x84) r1 = dup(r0) setsockopt$inet_sctp6_SCTP_SOCKOPT_BINDX_ADD(r1, 0x84, 0x64, 0x0, 0x0) sendmsg$inet6(r0, 0x0, 0x20000896) dup(r0) write$UHID_INPUT(r1, 0x0, 0x0) openat$ppp(0xffffffffffffff9c, &(0x7f0000000140), 0x42000, 0x0) syz_open_dev$vim2m(&(0x7f0000000000), 0x800, 0x2) socket$netlink(0x10, 0x3, 0x0) syz_open_procfs(0xffffffffffffffff, &(0x7f0000000500)='status\x00') socketpair$unix(0x1, 0x1, 0x0, &(0x7f00000001c0)) openat$fuse(0xffffffffffffff9c, &(0x7f00000000c0), 0x2, 0x0) r2 = open_tree(0xffffffffffffff9c, &(0x7f0000000640)='\x00', 0x89901) mount_setattr(r2, 0x0, 0x8000, 0x0, 0x0) socket(0x10, 0x3, 0x0) socket$nl_generic(0x10, 0x3, 0x10) socket$nl_netfilter(0x10, 0x3, 0xc) socket$kcm(0x2, 0xa, 0x2) r3 = socket$unix(0x1, 0x1, 0x0) bind$unix(r3, &(0x7f00000000c0)=@file={0x1, '\xe9\x1fq\x89Y\x1e\x923aK\x00'}, 0x6e) listen(r3, 0x0) accept(r3, 0x0, 0x0) r4 = socket$nl_netfilter(0x10, 0x3, 0xc) syz_emit_vhci(&(0x7f0000000840)=ANY=[@ANYBLOB="04050400c900", @ANYRES16=r4], 0x7) executing program 7: sendmsg$nl_route_sched(0xffffffffffffffff, 0x0, 0x10) r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000200), 0x0, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000040)={'syzkaller0\x00', 0x2}) r1 = openat$tun(0xffffffffffffff9c, &(0x7f0000000400), 0x0, 0x0) close(r1) socket$nl_generic(0x10, 0x3, 0x10) ioctl$SIOCSIFHWADDR(r1, 0x8914, &(0x7f0000002280)={'syzkaller0\x00', @multicast}) r2 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r2, 0x8933, &(0x7f0000000100)={'syzkaller0\x00', 0x0}) sendmsg$nl_route_sched(r2, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000580)={&(0x7f0000000340)=@newqdisc={0x4c, 0x24, 0x4ee4e6a52ff56541, 0x70bd25, 0x25dfdbfd, {0x0, 0x0, 0x0, r3, {0x0, 0xb}, {0xffff, 0xffff}, {0xfff2}}, [@qdisc_kind_options=@q_netem={{0xa}, {0x1c, 0x2, {{0x3, 0x3, 0x4361, 0x7, 0xffffffff, 0x3}}}}]}, 0x4c}, 0x1, 0x0, 0x0, 0x8000}, 0x0) sendmsg$nl_route_sched(r2, &(0x7f00000003c0)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000440)=@newqdisc={0x44, 0x24, 0x4ee4e6a52ff56541, 0x70b927, 0x25dfdbfc, {0x0, 0x0, 0x0, r3, {0x0, 0xd}, {0x6, 0xb}, {0xb, 0x2}}, [@qdisc_kind_options=@q_cake={{0x9}, {0x14, 0x2, [@TCA_CAKE_AUTORATE={0x8, 0x9, 0x6}, @TCA_CAKE_MEMORY={0x8, 0xa, 0x5}]}}]}, 0x44}, 0x1, 0x0, 0x0, 0x240040e0}, 0x4890) r4 = socket$packet(0x11, 0x3, 0x300) sendto$packet(r4, &(0x7f0000000240)="800000800000210ee7decd7a000340", 0xf, 0x40, &(0x7f00000001c0)={0x11, 0x8100, r3, 0x1, 0xd8, 0x6, @broadcast}, 0x14) program crashed: WARNING in hugetlb_split bisect: the chunk can be dropped bisect: split chunks (needed=true): <19> bisect: split chunk #0 of len 19 into 2 parts bisect: testing without sub-chunk 1/2 testing program (duration=6m2s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): [13, 13, 24, 23, 23, 9, 14, 13, 24, 13] detailed listing: executing program 32: r0 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000380)='./binderfs/binder0\x00', 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR_EXT(r0, 0x4018620d, &(0x7f00000000c0)={0x73622a85, 0xa, 0x8000000000002}) r1 = openat$binderfs(0xffffffffffffff9c, 0x0, 0x0, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000080)={0x8, 0x0, &(0x7f0000000400)=[@increfs], 0x0, 0x0, 0x0}) r2 = dup3(r1, r0, 0x0) r3 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000000)='./binderfs/binder0\x00', 0x0, 0x0) r4 = mmap$binder(&(0x7f0000ffd000/0x3000)=nil, 0x3000, 0x1, 0x11, r3, 0x0) ioctl$BINDER_SET_CONTEXT_MGR_EXT(r3, 0x4018620d, &(0x7f0000000040)={0x73622a85, 0x10a}) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f00000003c0)={0x8, 0x0, &(0x7f0000000340)=[@acquire], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000001040)={0x4c, 0x0, &(0x7f0000000ec0)=[@transaction_sg={0x40486311, {0x1, 0x0, 0x0, 0x0, 0x41, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x1000}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000001c0)={0x4c, 0x0, &(0x7f0000000740)=[@transaction_sg={0x40486311, {0x1, 0x0, 0x0, 0x0, 0x11, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x400}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000c00)={0x44, 0x0, &(0x7f0000000a80)=[@transaction={0x40406300, {0x1, 0x0, 0x0, 0x0, 0x21, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r3, 0xc0306201, &(0x7f0000000300)={0xc, 0x0, &(0x7f0000000240)=[@free_buffer={0x40086303, r4}], 0x54, 0x0, &(0x7f0000000280)="37b82b8f41afa37c5297fe5b692d3cedbd057d6f37743560799bbf4ddd06bc810453adcec0c458de737aeadf5afcd6641ea3434a1a0bfd0debe7506939a82090490c46a6010019e855badfb0bee8561d5ee15bac"}) executing program 3: syz_mount_image$fuse(0x0, &(0x7f0000002080)='./file0\x00', 0x208000, 0x0, 0x3d, 0x0, 0x0) r0 = open_tree(0xffffffffffffff9c, &(0x7f0000000640)='\x00', 0x89901) move_mount(r0, &(0x7f0000000140)='.\x00', 0xffffffffffffff9c, &(0x7f0000000180)='./file0\x00', 0x0) r1 = open_tree(0xffffffffffffff9c, &(0x7f0000000640)='\x00', 0x9801) move_mount(r1, &(0x7f0000000140)='.\x00', 0xffffffffffffff9c, &(0x7f0000000180)='./file0\x00', 0x0) chroot(&(0x7f0000001740)='./file0\x00') syz_open_procfs(0x0, &(0x7f0000000040)='mounts\x00') r2 = fsopen(&(0x7f0000000180)='proc\x00', 0x1) fsconfig$FSCONFIG_CMD_CREATE(r2, 0x6, 0x0, 0x0, 0x0) mprotect(&(0x7f0000000000/0x4000)=nil, 0x4000, 0x1) fchdir(0xffffffffffffffff) r3 = openat$fuse(0xffffffffffffff9c, &(0x7f0000000040), 0x42, 0x0) read$FUSE(r3, &(0x7f00000102c0)={0x2020}, 0x7) executing program 3: r0 = socket$inet6_sctp(0xa, 0x1, 0x84) r1 = dup(r0) setsockopt$inet_sctp6_SCTP_SOCKOPT_BINDX_ADD(r1, 0x84, 0x64, 0x0, 0x0) sendmsg$inet6(r0, 0x0, 0x20000896) dup(r0) write$UHID_INPUT(r1, 0x0, 0x0) openat$ppp(0xffffffffffffff9c, &(0x7f0000000140), 0x42000, 0x0) syz_open_dev$vim2m(&(0x7f0000000000), 0x800, 0x2) socket$netlink(0x10, 0x3, 0x0) syz_open_procfs(0xffffffffffffffff, &(0x7f0000000500)='status\x00') socketpair$unix(0x1, 0x1, 0x0, &(0x7f00000001c0)) openat$fuse(0xffffffffffffff9c, &(0x7f00000000c0), 0x2, 0x0) r2 = open_tree(0xffffffffffffff9c, &(0x7f0000000640)='\x00', 0x89901) mount_setattr(r2, 0x0, 0x8000, 0x0, 0x0) socket(0x10, 0x3, 0x0) socket$nl_generic(0x10, 0x3, 0x10) socket$nl_netfilter(0x10, 0x3, 0xc) socket$kcm(0x2, 0xa, 0x2) r3 = socket$unix(0x1, 0x1, 0x0) bind$unix(r3, &(0x7f00000000c0)=@file={0x1, '\xe9\x1fq\x89Y\x1e\x923aK\x00'}, 0x6e) listen(r3, 0x0) accept(r3, 0x0, 0x0) r4 = socket$nl_netfilter(0x10, 0x3, 0xc) syz_emit_vhci(&(0x7f0000000840)=ANY=[@ANYBLOB="04050400c900", @ANYRES16=r4], 0x7) executing program 3: r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000100), 0x0, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000040)={'syzkaller0\x00', 0x2}) r1 = open_tree(0xffffffffffffff9c, &(0x7f0000000100)='\x00', 0x89901) r2 = fspick(r1, &(0x7f00000000c0)='.\x00', 0x0) fsconfig$FSCONFIG_SET_FLAG(r2, 0x0, &(0x7f0000000000)='dirsync\x00', 0x0, 0x0) fsconfig$FSCONFIG_CMD_RECONFIGURE(r2, 0x7, 0x0, 0x0, 0x0) setxattr$security_ima(&(0x7f0000000080)='./file0\x00', &(0x7f00000002c0), &(0x7f0000000380)=@ng={0x4, 0x2, "1263cdb7"}, 0x6, 0x0) r3 = openat$tun(0xffffffffffffff9c, &(0x7f0000000500), 0x40, 0x0) close(r3) r4 = socket$kcm(0x29, 0x2, 0x0) ioctl$sock_proto_private(r4, 0x89e2, &(0x7f0000000040)) socket$nl_generic(0x10, 0x3, 0x10) ioctl$SIOCSIFHWADDR(r3, 0x8914, &(0x7f0000002280)={'syzkaller0\x00', @multicast}) socket$nl_route(0x10, 0x3, 0x0) r5 = socket$nl_route(0x10, 0x3, 0x0) r6 = socket$unix(0x1, 0x1, 0x0) ioctl$sock_SIOCGIFINDEX(r6, 0x8933, &(0x7f0000000100)={'syzkaller0\x00', 0x0}) ioctl$VIDIOC_ENUMAUDOUT(r1, 0xc0345642, &(0x7f00000003c0)={0x2, "873e45dacd5291f166c9aac0b6f8ce6da80afca0fe66169480a5a6b43da5bc0e", 0x1}) sendmsg$nl_route_sched(r5, &(0x7f00000008c0)={0x0, 0x0, &(0x7f0000000900)={&(0x7f0000000140)=@newqdisc={0x44, 0x24, 0x4ee4e6a52ff56541, 0x70bd26, 0xffffffff, {0x0, 0x0, 0x0, r7, {0x0, 0xfff1}, {0xffff, 0xffff}, {0xe}}, [@qdisc_kind_options=@q_hfsc={{0x9}, {0x14, 0x2, @TCA_HFSC_FSC={0x10, 0x2, {0x5, 0x7, 0xb3}}}}]}, 0x44}, 0x1, 0x0, 0x0, 0x4000000}, 0x0) r8 = socket$nl_route(0x10, 0x3, 0x0) r9 = socket$unix(0x1, 0x1, 0x0) ioctl$sock_SIOCGIFINDEX(r9, 0x8933, &(0x7f0000000100)={'syzkaller0\x00', 0x0}) sendmsg$nl_route_sched(r8, &(0x7f0000001200)={0x0, 0x0, &(0x7f0000000280)={&(0x7f0000001240)=@newqdisc={0xc48, 0x28, 0x4ee4e6a52ff56541, 0x4001, 0xfffffdfc, {0x0, 0x0, 0x0, r10, {0x10}, {}, {0x2, 0x3}}, [@qdisc_kind_options=@q_tbf={{0x8}, {0xc1c, 0x2, [@TCA_TBF_PTAB={0x404, 0x3, [0x0, 0x4f0d, 0x5, 0x10001, 0x8, 0x10000, 0x80, 0x288, 0x9, 0x9, 0x2, 0xfff, 0xdfd, 0x1, 0x7887, 0x5, 0xdd16, 0x392, 0x31aa, 0x7fff, 0x2, 0xfffff98c, 0x4, 0x4e, 0x100, 0xa, 0x9, 0x2, 0x11, 0xffffffff, 0x3, 0x4, 0x1000, 0x800, 0x7, 0x1, 0x9, 0xd, 0x7, 0xa4f, 0x2, 0xc, 0x3, 0x0, 0xffffffef, 0x74, 0x4, 0x4, 0xffffffff, 0x6, 0x3, 0x1000, 0x6, 0x5, 0x71d, 0x2, 0xffff, 0x6, 0x6, 0x80000000, 0xce0, 0x9, 0xea5, 0x8, 0x200, 0x4, 0x8001, 0xa8, 0x9, 0x10, 0x9, 0x10000, 0x2, 0x7fff, 0xc, 0x7, 0x4800, 0x8, 0x6, 0xe87, 0x7f, 0x6, 0x0, 0x4800, 0x1, 0x12, 0x18b, 0x6, 0x2, 0x5, 0x1, 0x40, 0x5, 0x1, 0x0, 0x1da35084, 0x4, 0x1, 0x9, 0x7, 0x0, 0x4, 0x8, 0x4, 0x2, 0x0, 0x7, 0x200, 0x3, 0x8001, 0xa000, 0x0, 0x7a69, 0x764064d2, 0x92, 0x2, 0xbdc9, 0x3, 0xff, 0x2, 0x10, 0x5, 0x10000, 0x100, 0x5, 0x1022075d, 0x8, 0x5, 0x5, 0xfffffffe, 0x7f, 0x101, 0x4, 0xb, 0x9, 0x27, 0xff, 0x1, 0xf64a, 0xa78c, 0x5, 0x6, 0x7, 0xffff4fc5, 0x8, 0x7f, 0x385, 0x400, 0x100, 0x2, 0x5, 0x4, 0x7, 0x2, 0x7, 0x1, 0xb8, 0xffffff2a, 0x6, 0x8001, 0x6, 0x8, 0x3ff, 0x2, 0x6, 0x0, 0x6, 0x7fff, 0x80, 0x2, 0x5aeb, 0xe, 0x80000001, 0x39, 0x5, 0xa05, 0x3, 0x9, 0x72, 0x5, 0x4, 0x9, 0xba, 0x3, 0xc3, 0x8, 0x6, 0x7f, 0x5, 0xe8f0, 0x55, 0x8, 0x0, 0x7, 0x2, 0x8, 0x410, 0xffff03a4, 0xa8, 0x39b5, 0x8, 0xf3, 0x4, 0x10001, 0x0, 0x7f, 0x2, 0x7fff, 0x7, 0x401, 0x4, 0x0, 0x8, 0x2, 0x7, 0x2, 0x1, 0x2, 0x8, 0xffff, 0x0, 0x9, 0xc0e, 0x41, 0xf, 0xffff, 0xfffffff7, 0xffffff26, 0x7, 0x32a, 0xad95, 0x776, 0x9, 0xfffffffd, 0xfbc0, 0x3, 0xa4c9, 0x1, 0x6, 0xb, 0x3, 0x101, 0x1, 0x0, 0x2, 0x3, 0x4, 0x0, 0x80000000, 0xfffffff8, 0x400, 0x5, 0x2, 0x40, 0xfffeffff, 0x541b]}, @TCA_TBF_RTAB={0x404, 0x2, [0x9, 0x100, 0x2, 0xc91, 0x5, 0x400, 0x1000, 0x2, 0x5, 0x3ff, 0x2, 0x200, 0x7, 0x2, 0x6, 0xdb6, 0x401, 0x6, 0xf, 0x100, 0x3, 0xb, 0x5, 0x77dedf80, 0x100, 0x7, 0x2, 0x4, 0x1, 0x5, 0x5, 0x5, 0x4, 0x7, 0x6, 0x6, 0x4, 0x0, 0x0, 0x3, 0x5, 0x2, 0x10, 0x101, 0x8, 0xd6, 0x8, 0x800, 0x3, 0x4, 0x10001, 0x66a, 0x7, 0x7, 0x6c, 0xa6d, 0x4, 0x6, 0x3, 0x8, 0x2, 0x3d, 0x4, 0x80000000, 0xc, 0x2, 0x40, 0x7, 0x2, 0x4, 0xffffffff, 0x2, 0x4, 0xb0, 0xe7, 0x8, 0x8001, 0x7, 0xb, 0x4, 0x3, 0x2, 0x6, 0x1, 0x5, 0x10001, 0x3, 0x4, 0xffffffff, 0x5, 0x4, 0x7, 0x5, 0x3, 0x8, 0x8, 0x0, 0x374, 0x2, 0x4, 0x7, 0x81, 0x8, 0x7f, 0x9, 0x0, 0x4, 0x6, 0x2, 0xa08d, 0x100, 0x5, 0xffff248d, 0x5, 0x7, 0xa, 0x0, 0x671, 0x3, 0x10000, 0x8c, 0x2ea, 0xd6, 0x79, 0x9, 0x9, 0xc, 0xccf, 0x2, 0xb, 0x5, 0x100, 0x158, 0x4, 0x2, 0x7, 0x1, 0x401, 0x6, 0x5, 0xfffffffb, 0xffffffff, 0x6, 0x80000001, 0x2, 0x7, 0x5, 0xab7, 0x6f18f07b, 0x80000001, 0x0, 0x9, 0xc1, 0x5, 0x4, 0x8, 0x7, 0x3, 0x8, 0x3ff, 0x0, 0x9, 0x203a, 0x3, 0x0, 0x8, 0x2, 0x7, 0x7, 0x8, 0x0, 0x4, 0x4007ff, 0x4, 0x9, 0x2, 0x5, 0x8000, 0x200, 0x0, 0x1, 0xfffffff6, 0x0, 0x7b, 0xfd, 0x5b653309, 0xe5, 0x14f, 0x6, 0x10001, 0x1, 0x7, 0x2, 0xffffffff, 0x0, 0x40100, 0x197, 0x3ff, 0x9, 0x4, 0x200, 0xcbf, 0x1ff, 0x80, 0x9, 0x2f74, 0x4, 0x1, 0x9, 0x0, 0x4, 0x8, 0x8000, 0x5, 0x8, 0xf, 0x9, 0x6057, 0x101, 0x8001, 0xad, 0x4, 0x7, 0x7, 0x2, 0x80000001, 0x8c6b, 0xd87, 0x82, 0x100, 0x0, 0x80000000, 0x0, 0x9a, 0x9, 0xfc3, 0x89, 0xa, 0x80000001, 0x2, 0x1, 0xffffffff, 0x4, 0x8000, 0x2, 0x3, 0x10000, 0x8486, 0x3, 0x8, 0x6, 0x0, 0x1, 0x3, 0x2, 0x9]}, @TCA_TBF_PTAB={0x404, 0x3, [0x5, 0x5, 0x4, 0x5, 0x8001, 0x8, 0x5, 0x2, 0x8, 0x5, 0x4c5, 0x1, 0x6, 0x8, 0x5, 0x5, 0x1, 0x6, 0x0, 0x0, 0x0, 0x0, 0x81, 0xfff, 0x10, 0x3, 0xe55, 0xd, 0x3, 0x6, 0x2, 0x5, 0xef, 0x7, 0x1, 0x8, 0x96b, 0x8, 0x80000001, 0x3, 0x6, 0x5, 0xa4f, 0x8, 0x3, 0x7ff, 0xc68, 0x80000001, 0x10200, 0x101, 0x10100, 0x166, 0x1, 0x7, 0x7a8, 0x2d, 0x7, 0x80, 0x8, 0x9, 0x0, 0x3ff, 0x8001, 0x5, 0x0, 0x635, 0x656, 0x2, 0x6, 0x5, 0x8, 0x1, 0x6, 0xeb, 0xfffffff9, 0x8, 0x3, 0x1, 0x0, 0x0, 0x3, 0x8ca, 0xffff, 0x9, 0x8, 0x800, 0xc198, 0x8, 0x7db903f4, 0x4, 0x6, 0x2, 0xfffffffc, 0x4, 0x7, 0xa2d, 0x0, 0x0, 0x8, 0x5, 0x8, 0x1000, 0x44da11fe, 0x5, 0xfffffbff, 0xfffff2fc, 0x4, 0x7d2, 0x4, 0x7, 0xffffffff, 0x2, 0xe, 0xe, 0x7, 0x101, 0x5, 0x1, 0x98, 0xc, 0x4, 0x98, 0x7, 0xffff, 0x8e58, 0x6, 0x9, 0x77a, 0x1, 0xfffff001, 0x1, 0x0, 0x7, 0x5, 0x9, 0x0, 0x2, 0xe5, 0x51, 0x2, 0xd50, 0x80000000, 0x1ff, 0x7, 0x3, 0xfffffff2, 0x7ff, 0x1ff, 0xee, 0x0, 0xfffff8aa, 0x0, 0x0, 0x80, 0x6df0, 0x2, 0x4, 0x10001, 0x7ff, 0x1, 0xfffffe01, 0x4, 0x5, 0x81, 0x5, 0x2e7, 0xf3, 0x9, 0x6, 0x5, 0x8000, 0x8, 0xe, 0xce2a, 0x1, 0xcb, 0x5, 0x0, 0x9, 0x94, 0x9f, 0x3, 0x8, 0x401, 0x5, 0x3ff, 0x5, 0x1b, 0x2, 0x4, 0x862d, 0x0, 0xff, 0x5, 0x1, 0x1, 0x0, 0xd, 0x5, 0x4, 0xffffff5c, 0x6, 0xff, 0x3, 0x728, 0x2be55882, 0x8, 0x7, 0x7, 0x0, 0x10, 0x7, 0xff, 0x101, 0xfffff801, 0xc86, 0x3, 0x10000, 0x2, 0x2, 0x2, 0x2, 0x2400, 0x81, 0x5, 0x5, 0x3, 0xc9, 0x1, 0x13, 0x5, 0x9, 0xffffffa2, 0xf5b, 0xe, 0xe, 0xb, 0x8, 0xff, 0x2, 0x3, 0x9, 0x10, 0x67d8fb7a, 0x3, 0x8, 0x10001, 0xfffffffa, 0x8001, 0x4, 0x9, 0x0, 0x1, 0x3, 0xfffffffe, 0x100]}, @TCA_TBF_PRATE64={0xc, 0x5, 0x467944efcdcbb7e7}]}}]}, 0xc48}, 0x1, 0x0, 0x0, 0xb3538085985bb3d6}, 0x0) executing program 33: r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000100), 0x0, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000040)={'syzkaller0\x00', 0x2}) r1 = open_tree(0xffffffffffffff9c, &(0x7f0000000100)='\x00', 0x89901) r2 = fspick(r1, &(0x7f00000000c0)='.\x00', 0x0) fsconfig$FSCONFIG_SET_FLAG(r2, 0x0, &(0x7f0000000000)='dirsync\x00', 0x0, 0x0) fsconfig$FSCONFIG_CMD_RECONFIGURE(r2, 0x7, 0x0, 0x0, 0x0) setxattr$security_ima(&(0x7f0000000080)='./file0\x00', &(0x7f00000002c0), &(0x7f0000000380)=@ng={0x4, 0x2, "1263cdb7"}, 0x6, 0x0) r3 = openat$tun(0xffffffffffffff9c, &(0x7f0000000500), 0x40, 0x0) close(r3) r4 = socket$kcm(0x29, 0x2, 0x0) ioctl$sock_proto_private(r4, 0x89e2, &(0x7f0000000040)) socket$nl_generic(0x10, 0x3, 0x10) ioctl$SIOCSIFHWADDR(r3, 0x8914, &(0x7f0000002280)={'syzkaller0\x00', @multicast}) socket$nl_route(0x10, 0x3, 0x0) r5 = socket$nl_route(0x10, 0x3, 0x0) r6 = socket$unix(0x1, 0x1, 0x0) ioctl$sock_SIOCGIFINDEX(r6, 0x8933, &(0x7f0000000100)={'syzkaller0\x00', 0x0}) ioctl$VIDIOC_ENUMAUDOUT(r1, 0xc0345642, &(0x7f00000003c0)={0x2, "873e45dacd5291f166c9aac0b6f8ce6da80afca0fe66169480a5a6b43da5bc0e", 0x1}) sendmsg$nl_route_sched(r5, &(0x7f00000008c0)={0x0, 0x0, &(0x7f0000000900)={&(0x7f0000000140)=@newqdisc={0x44, 0x24, 0x4ee4e6a52ff56541, 0x70bd26, 0xffffffff, {0x0, 0x0, 0x0, r7, {0x0, 0xfff1}, {0xffff, 0xffff}, {0xe}}, [@qdisc_kind_options=@q_hfsc={{0x9}, {0x14, 0x2, @TCA_HFSC_FSC={0x10, 0x2, {0x5, 0x7, 0xb3}}}}]}, 0x44}, 0x1, 0x0, 0x0, 0x4000000}, 0x0) r8 = socket$nl_route(0x10, 0x3, 0x0) r9 = socket$unix(0x1, 0x1, 0x0) ioctl$sock_SIOCGIFINDEX(r9, 0x8933, &(0x7f0000000100)={'syzkaller0\x00', 0x0}) sendmsg$nl_route_sched(r8, &(0x7f0000001200)={0x0, 0x0, &(0x7f0000000280)={&(0x7f0000001240)=@newqdisc={0xc48, 0x28, 0x4ee4e6a52ff56541, 0x4001, 0xfffffdfc, {0x0, 0x0, 0x0, r10, {0x10}, {}, {0x2, 0x3}}, [@qdisc_kind_options=@q_tbf={{0x8}, {0xc1c, 0x2, [@TCA_TBF_PTAB={0x404, 0x3, [0x0, 0x4f0d, 0x5, 0x10001, 0x8, 0x10000, 0x80, 0x288, 0x9, 0x9, 0x2, 0xfff, 0xdfd, 0x1, 0x7887, 0x5, 0xdd16, 0x392, 0x31aa, 0x7fff, 0x2, 0xfffff98c, 0x4, 0x4e, 0x100, 0xa, 0x9, 0x2, 0x11, 0xffffffff, 0x3, 0x4, 0x1000, 0x800, 0x7, 0x1, 0x9, 0xd, 0x7, 0xa4f, 0x2, 0xc, 0x3, 0x0, 0xffffffef, 0x74, 0x4, 0x4, 0xffffffff, 0x6, 0x3, 0x1000, 0x6, 0x5, 0x71d, 0x2, 0xffff, 0x6, 0x6, 0x80000000, 0xce0, 0x9, 0xea5, 0x8, 0x200, 0x4, 0x8001, 0xa8, 0x9, 0x10, 0x9, 0x10000, 0x2, 0x7fff, 0xc, 0x7, 0x4800, 0x8, 0x6, 0xe87, 0x7f, 0x6, 0x0, 0x4800, 0x1, 0x12, 0x18b, 0x6, 0x2, 0x5, 0x1, 0x40, 0x5, 0x1, 0x0, 0x1da35084, 0x4, 0x1, 0x9, 0x7, 0x0, 0x4, 0x8, 0x4, 0x2, 0x0, 0x7, 0x200, 0x3, 0x8001, 0xa000, 0x0, 0x7a69, 0x764064d2, 0x92, 0x2, 0xbdc9, 0x3, 0xff, 0x2, 0x10, 0x5, 0x10000, 0x100, 0x5, 0x1022075d, 0x8, 0x5, 0x5, 0xfffffffe, 0x7f, 0x101, 0x4, 0xb, 0x9, 0x27, 0xff, 0x1, 0xf64a, 0xa78c, 0x5, 0x6, 0x7, 0xffff4fc5, 0x8, 0x7f, 0x385, 0x400, 0x100, 0x2, 0x5, 0x4, 0x7, 0x2, 0x7, 0x1, 0xb8, 0xffffff2a, 0x6, 0x8001, 0x6, 0x8, 0x3ff, 0x2, 0x6, 0x0, 0x6, 0x7fff, 0x80, 0x2, 0x5aeb, 0xe, 0x80000001, 0x39, 0x5, 0xa05, 0x3, 0x9, 0x72, 0x5, 0x4, 0x9, 0xba, 0x3, 0xc3, 0x8, 0x6, 0x7f, 0x5, 0xe8f0, 0x55, 0x8, 0x0, 0x7, 0x2, 0x8, 0x410, 0xffff03a4, 0xa8, 0x39b5, 0x8, 0xf3, 0x4, 0x10001, 0x0, 0x7f, 0x2, 0x7fff, 0x7, 0x401, 0x4, 0x0, 0x8, 0x2, 0x7, 0x2, 0x1, 0x2, 0x8, 0xffff, 0x0, 0x9, 0xc0e, 0x41, 0xf, 0xffff, 0xfffffff7, 0xffffff26, 0x7, 0x32a, 0xad95, 0x776, 0x9, 0xfffffffd, 0xfbc0, 0x3, 0xa4c9, 0x1, 0x6, 0xb, 0x3, 0x101, 0x1, 0x0, 0x2, 0x3, 0x4, 0x0, 0x80000000, 0xfffffff8, 0x400, 0x5, 0x2, 0x40, 0xfffeffff, 0x541b]}, @TCA_TBF_RTAB={0x404, 0x2, [0x9, 0x100, 0x2, 0xc91, 0x5, 0x400, 0x1000, 0x2, 0x5, 0x3ff, 0x2, 0x200, 0x7, 0x2, 0x6, 0xdb6, 0x401, 0x6, 0xf, 0x100, 0x3, 0xb, 0x5, 0x77dedf80, 0x100, 0x7, 0x2, 0x4, 0x1, 0x5, 0x5, 0x5, 0x4, 0x7, 0x6, 0x6, 0x4, 0x0, 0x0, 0x3, 0x5, 0x2, 0x10, 0x101, 0x8, 0xd6, 0x8, 0x800, 0x3, 0x4, 0x10001, 0x66a, 0x7, 0x7, 0x6c, 0xa6d, 0x4, 0x6, 0x3, 0x8, 0x2, 0x3d, 0x4, 0x80000000, 0xc, 0x2, 0x40, 0x7, 0x2, 0x4, 0xffffffff, 0x2, 0x4, 0xb0, 0xe7, 0x8, 0x8001, 0x7, 0xb, 0x4, 0x3, 0x2, 0x6, 0x1, 0x5, 0x10001, 0x3, 0x4, 0xffffffff, 0x5, 0x4, 0x7, 0x5, 0x3, 0x8, 0x8, 0x0, 0x374, 0x2, 0x4, 0x7, 0x81, 0x8, 0x7f, 0x9, 0x0, 0x4, 0x6, 0x2, 0xa08d, 0x100, 0x5, 0xffff248d, 0x5, 0x7, 0xa, 0x0, 0x671, 0x3, 0x10000, 0x8c, 0x2ea, 0xd6, 0x79, 0x9, 0x9, 0xc, 0xccf, 0x2, 0xb, 0x5, 0x100, 0x158, 0x4, 0x2, 0x7, 0x1, 0x401, 0x6, 0x5, 0xfffffffb, 0xffffffff, 0x6, 0x80000001, 0x2, 0x7, 0x5, 0xab7, 0x6f18f07b, 0x80000001, 0x0, 0x9, 0xc1, 0x5, 0x4, 0x8, 0x7, 0x3, 0x8, 0x3ff, 0x0, 0x9, 0x203a, 0x3, 0x0, 0x8, 0x2, 0x7, 0x7, 0x8, 0x0, 0x4, 0x4007ff, 0x4, 0x9, 0x2, 0x5, 0x8000, 0x200, 0x0, 0x1, 0xfffffff6, 0x0, 0x7b, 0xfd, 0x5b653309, 0xe5, 0x14f, 0x6, 0x10001, 0x1, 0x7, 0x2, 0xffffffff, 0x0, 0x40100, 0x197, 0x3ff, 0x9, 0x4, 0x200, 0xcbf, 0x1ff, 0x80, 0x9, 0x2f74, 0x4, 0x1, 0x9, 0x0, 0x4, 0x8, 0x8000, 0x5, 0x8, 0xf, 0x9, 0x6057, 0x101, 0x8001, 0xad, 0x4, 0x7, 0x7, 0x2, 0x80000001, 0x8c6b, 0xd87, 0x82, 0x100, 0x0, 0x80000000, 0x0, 0x9a, 0x9, 0xfc3, 0x89, 0xa, 0x80000001, 0x2, 0x1, 0xffffffff, 0x4, 0x8000, 0x2, 0x3, 0x10000, 0x8486, 0x3, 0x8, 0x6, 0x0, 0x1, 0x3, 0x2, 0x9]}, @TCA_TBF_PTAB={0x404, 0x3, [0x5, 0x5, 0x4, 0x5, 0x8001, 0x8, 0x5, 0x2, 0x8, 0x5, 0x4c5, 0x1, 0x6, 0x8, 0x5, 0x5, 0x1, 0x6, 0x0, 0x0, 0x0, 0x0, 0x81, 0xfff, 0x10, 0x3, 0xe55, 0xd, 0x3, 0x6, 0x2, 0x5, 0xef, 0x7, 0x1, 0x8, 0x96b, 0x8, 0x80000001, 0x3, 0x6, 0x5, 0xa4f, 0x8, 0x3, 0x7ff, 0xc68, 0x80000001, 0x10200, 0x101, 0x10100, 0x166, 0x1, 0x7, 0x7a8, 0x2d, 0x7, 0x80, 0x8, 0x9, 0x0, 0x3ff, 0x8001, 0x5, 0x0, 0x635, 0x656, 0x2, 0x6, 0x5, 0x8, 0x1, 0x6, 0xeb, 0xfffffff9, 0x8, 0x3, 0x1, 0x0, 0x0, 0x3, 0x8ca, 0xffff, 0x9, 0x8, 0x800, 0xc198, 0x8, 0x7db903f4, 0x4, 0x6, 0x2, 0xfffffffc, 0x4, 0x7, 0xa2d, 0x0, 0x0, 0x8, 0x5, 0x8, 0x1000, 0x44da11fe, 0x5, 0xfffffbff, 0xfffff2fc, 0x4, 0x7d2, 0x4, 0x7, 0xffffffff, 0x2, 0xe, 0xe, 0x7, 0x101, 0x5, 0x1, 0x98, 0xc, 0x4, 0x98, 0x7, 0xffff, 0x8e58, 0x6, 0x9, 0x77a, 0x1, 0xfffff001, 0x1, 0x0, 0x7, 0x5, 0x9, 0x0, 0x2, 0xe5, 0x51, 0x2, 0xd50, 0x80000000, 0x1ff, 0x7, 0x3, 0xfffffff2, 0x7ff, 0x1ff, 0xee, 0x0, 0xfffff8aa, 0x0, 0x0, 0x80, 0x6df0, 0x2, 0x4, 0x10001, 0x7ff, 0x1, 0xfffffe01, 0x4, 0x5, 0x81, 0x5, 0x2e7, 0xf3, 0x9, 0x6, 0x5, 0x8000, 0x8, 0xe, 0xce2a, 0x1, 0xcb, 0x5, 0x0, 0x9, 0x94, 0x9f, 0x3, 0x8, 0x401, 0x5, 0x3ff, 0x5, 0x1b, 0x2, 0x4, 0x862d, 0x0, 0xff, 0x5, 0x1, 0x1, 0x0, 0xd, 0x5, 0x4, 0xffffff5c, 0x6, 0xff, 0x3, 0x728, 0x2be55882, 0x8, 0x7, 0x7, 0x0, 0x10, 0x7, 0xff, 0x101, 0xfffff801, 0xc86, 0x3, 0x10000, 0x2, 0x2, 0x2, 0x2, 0x2400, 0x81, 0x5, 0x5, 0x3, 0xc9, 0x1, 0x13, 0x5, 0x9, 0xffffffa2, 0xf5b, 0xe, 0xe, 0xb, 0x8, 0xff, 0x2, 0x3, 0x9, 0x10, 0x67d8fb7a, 0x3, 0x8, 0x10001, 0xfffffffa, 0x8001, 0x4, 0x9, 0x0, 0x1, 0x3, 0xfffffffe, 0x100]}, @TCA_TBF_PRATE64={0xc, 0x5, 0x467944efcdcbb7e7}]}}]}, 0xc48}, 0x1, 0x0, 0x0, 0xb3538085985bb3d6}, 0x0) executing program 1: bpf$MAP_CREATE(0x0, &(0x7f00000000c0)=@base={0x1b, 0x0, 0x0, 0x8000, 0x80000}, 0x50) mount$fuse(0x0, &(0x7f00000020c0)='./file0\x00', 0x0, 0x80, &(0x7f00000002c0)={{}, 0x2c, {'rootmode', 0x3d, 0x4000}}) syz_fuse_handle_req(0xffffffffffffffff, 0x0, 0x0, 0x0) syz_fuse_handle_req(0xffffffffffffffff, 0x0, 0x0, 0x0) getdents64(0xffffffffffffffff, 0x0, 0x0) r0 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPSET_CMD_CREATE(r0, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)={&(0x7f00000000c0)=ANY=[@ANYBLOB="4c0000000206010800000000000000000000003f0500010006000000050005000200000005000400000000000900020073797a310020000013000300686173683a"], 0x4c}}, 0x0) r1 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPSET_CMD_ADD(r1, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000300)={0x54, 0x9, 0x6, 0x201, 0x0, 0x0, {0x2, 0x0, 0xfdff}, [@IPSET_ATTR_DATA={0x2c, 0x7, 0x0, 0x1, [@IPSET_ATTR_IP={0xc, 0x1, 0x0, 0x1, @IPSET_ATTR_IPADDR_IPV4={0x8, 0x1, 0x1, 0x0, @multicast1}}, @IPSET_ATTR_IFACE={0x14, 0x17, 'batadv_slave_0\x00'}, @IPSET_ATTR_CADT_FLAGS={0x8, 0x8, 0x1, 0x0, 0x94}]}, @IPSET_ATTR_SETNAME={0x9, 0x2, 'syz1\x00'}, @IPSET_ATTR_PROTOCOL={0x5}]}, 0x54}}, 0x40c0080) executing program 1: r0 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000380)='./binderfs/binder0\x00', 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR_EXT(r0, 0x4018620d, &(0x7f00000000c0)={0x73622a85, 0xa, 0x8000000000002}) r1 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000200)='./binderfs/binder0\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000080)={0x8, 0x0, &(0x7f0000000400)=[@increfs], 0x0, 0x0, 0x0}) r2 = dup3(r1, r0, 0x0) r3 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000000)='./binderfs/binder0\x00', 0x0, 0x0) mmap$binder(&(0x7f0000ffd000/0x3000)=nil, 0x3000, 0x1, 0x11, r3, 0x0) ioctl$BINDER_SET_CONTEXT_MGR_EXT(r3, 0x4018620d, &(0x7f0000000040)={0x73622a85, 0x10a}) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f00000003c0)={0x8, 0x0, &(0x7f0000000340)=[@acquire], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000001040)={0x4c, 0x0, &(0x7f0000000ec0)=[@transaction_sg={0x40486311, {0x1, 0x0, 0x0, 0x0, 0x41, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x1000}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000001c0)={0x4c, 0x0, &(0x7f0000000740)=[@transaction_sg={0x40486311, {0x1, 0x0, 0x0, 0x0, 0x11, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x400}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000c00)={0x44, 0x0, &(0x7f0000000a80)=[@transaction={0x40406300, {0x1, 0x0, 0x0, 0x0, 0x21, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) r4 = openat$binder_debug(0xffffffffffffff9c, 0x0, 0x0, 0x0) read$FUSE(r4, &(0x7f0000007fc0)={0x2020}, 0x2020) executing program 1: syz_mount_image$fuse(0x0, &(0x7f0000002080)='./file0\x00', 0x208000, 0x0, 0x3d, 0x0, 0x0) r0 = open_tree(0xffffffffffffff9c, &(0x7f0000000640)='\x00', 0x89901) move_mount(r0, &(0x7f0000000140)='.\x00', 0xffffffffffffff9c, &(0x7f0000000180)='./file0\x00', 0x0) r1 = open_tree(0xffffffffffffff9c, &(0x7f0000000640)='\x00', 0x9801) move_mount(r1, &(0x7f0000000140)='.\x00', 0xffffffffffffff9c, &(0x7f0000000180)='./file0\x00', 0x0) chroot(&(0x7f0000001740)='./file0\x00') syz_open_procfs(0x0, &(0x7f0000000040)='mounts\x00') r2 = fsopen(&(0x7f0000000180)='proc\x00', 0x1) r3 = fsmount(r2, 0x1, 0x0) mprotect(&(0x7f0000000000/0x4000)=nil, 0x4000, 0x1) fchdir(r3) r4 = openat$fuse(0xffffffffffffff9c, &(0x7f0000000040), 0x42, 0x0) read$FUSE(r4, &(0x7f00000102c0)={0x2020}, 0x7) executing program 1: r0 = socket$inet6_sctp(0xa, 0x1, 0x84) r1 = dup(r0) setsockopt$inet_sctp6_SCTP_SOCKOPT_BINDX_ADD(r1, 0x84, 0x64, 0x0, 0x0) sendmsg$inet6(r0, 0x0, 0x20000896) dup(r0) write$UHID_INPUT(r1, 0x0, 0x0) openat$ppp(0xffffffffffffff9c, &(0x7f0000000140), 0x42000, 0x0) syz_open_dev$vim2m(&(0x7f0000000000), 0x800, 0x2) socket$netlink(0x10, 0x3, 0x0) syz_open_procfs(0xffffffffffffffff, &(0x7f0000000500)='status\x00') socketpair$unix(0x1, 0x1, 0x0, &(0x7f00000001c0)) openat$fuse(0xffffffffffffff9c, &(0x7f00000000c0), 0x2, 0x0) r2 = open_tree(0xffffffffffffff9c, &(0x7f0000000640)='\x00', 0x89901) mount_setattr(r2, 0x0, 0x8000, 0x0, 0x0) socket(0x10, 0x3, 0x0) socket$nl_generic(0x10, 0x3, 0x10) socket$nl_netfilter(0x10, 0x3, 0xc) socket$kcm(0x2, 0xa, 0x2) r3 = socket$unix(0x1, 0x1, 0x0) bind$unix(r3, &(0x7f00000000c0)=@file={0x1, '\xe9\x1fq\x89Y\x1e\x923aK\x00'}, 0x6e) listen(r3, 0x0) accept(r3, 0x0, 0x0) r4 = socket$nl_netfilter(0x10, 0x3, 0xc) syz_emit_vhci(&(0x7f0000000840)=ANY=[@ANYBLOB="04050400c900", @ANYRES16=r4], 0x7) executing program 7: sendmsg$nl_route_sched(0xffffffffffffffff, 0x0, 0x10) r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000200), 0x0, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000040)={'syzkaller0\x00', 0x2}) r1 = openat$tun(0xffffffffffffff9c, &(0x7f0000000400), 0x0, 0x0) close(r1) socket$nl_generic(0x10, 0x3, 0x10) ioctl$SIOCSIFHWADDR(r1, 0x8914, &(0x7f0000002280)={'syzkaller0\x00', @multicast}) r2 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r2, 0x8933, &(0x7f0000000100)={'syzkaller0\x00', 0x0}) sendmsg$nl_route_sched(r2, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000580)={&(0x7f0000000340)=@newqdisc={0x4c, 0x24, 0x4ee4e6a52ff56541, 0x70bd25, 0x25dfdbfd, {0x0, 0x0, 0x0, r3, {0x0, 0xb}, {0xffff, 0xffff}, {0xfff2}}, [@qdisc_kind_options=@q_netem={{0xa}, {0x1c, 0x2, {{0x3, 0x3, 0x4361, 0x7, 0xffffffff, 0x3}}}}]}, 0x4c}, 0x1, 0x0, 0x0, 0x8000}, 0x0) sendmsg$nl_route_sched(r2, &(0x7f00000003c0)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000440)=@newqdisc={0x44, 0x24, 0x4ee4e6a52ff56541, 0x70b927, 0x25dfdbfc, {0x0, 0x0, 0x0, r3, {0x0, 0xd}, {0x6, 0xb}, {0xb, 0x2}}, [@qdisc_kind_options=@q_cake={{0x9}, {0x14, 0x2, [@TCA_CAKE_AUTORATE={0x8, 0x9, 0x6}, @TCA_CAKE_MEMORY={0x8, 0xa, 0x5}]}}]}, 0x44}, 0x1, 0x0, 0x0, 0x240040e0}, 0x4890) r4 = socket$packet(0x11, 0x3, 0x300) sendto$packet(r4, &(0x7f0000000240)="800000800000210ee7decd7a000340", 0xf, 0x40, &(0x7f00000001c0)={0x11, 0x8100, r3, 0x1, 0xd8, 0x6, @broadcast}, 0x14) program did not crash bisect: testing without sub-chunk 2/2 testing program (duration=6m2s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): [4, 7, 4, 13, 4, 17, 16, 16, 14, 13, 13] detailed listing: executing program 4: r0 = syz_open_dev$sndctrl(&(0x7f0000000040), 0x0, 0x0) madvise(&(0x7f0000000000/0x600000)=nil, 0x600000, 0x15) mprotect(&(0x7f0000000000/0x4000)=nil, 0x4000, 0x1) ioctl$SNDRV_CTL_IOCTL_SUBSCRIBE_EVENTS(r0, 0xc0045516, &(0x7f0000000000)=0xffb) executing program 4: r0 = socket$l2tp(0x2, 0x2, 0x73) bind$inet(r0, &(0x7f00000002c0)={0x2, 0x4e1c, @multicast1}, 0x10) connect$inet(r0, &(0x7f0000000200)={0x2, 0x4e22, @local}, 0x10) r1 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000001c0)='memory.events\x00', 0x275a, 0x0) write$cgroup_subtree(r1, &(0x7f0000000100)=ANY=[], 0x32600) mmap(&(0x7f0000000000/0x3000)=nil, 0x3000, 0x2000001, 0x12, r1, 0x0) getsockopt$sock_buf(r0, 0x1, 0x1c, 0x0, &(0x7f00000000c0)) executing program 4: writev(0xffffffffffffffff, &(0x7f0000000180)=[{&(0x7f0000000240)}], 0x1) mprotect(&(0x7f0000000000/0xf000)=nil, 0xf000, 0x1) r0 = socket$inet6_sctp(0xa, 0x1, 0x84) getsockopt$inet_sctp6_SCTP_STREAM_SCHEDULER(r0, 0x84, 0x7b, &(0x7f0000000140)={0x0, 0x9}, &(0x7f0000000180)=0x8) executing program 4: syz_mount_image$fuse(0x0, &(0x7f0000002080)='./file0\x00', 0x208000, 0x0, 0x3d, 0x0, 0x0) r0 = open_tree(0xffffffffffffff9c, &(0x7f0000000640)='\x00', 0x89901) move_mount(r0, &(0x7f0000000140)='.\x00', 0xffffffffffffff9c, &(0x7f0000000180)='./file0\x00', 0x0) r1 = open_tree(0xffffffffffffff9c, &(0x7f0000000640)='\x00', 0x9801) move_mount(r1, &(0x7f0000000140)='.\x00', 0xffffffffffffff9c, &(0x7f0000000180)='./file0\x00', 0x0) chroot(&(0x7f0000001740)='./file0\x00') syz_open_procfs(0x0, &(0x7f0000000040)='mounts\x00') r2 = fsopen(&(0x7f0000000180)='proc\x00', 0x1) fsconfig$FSCONFIG_CMD_CREATE(r2, 0x6, 0x0, 0x0, 0x0) mprotect(&(0x7f0000000000/0x4000)=nil, 0x4000, 0x1) fchdir(0xffffffffffffffff) r3 = openat$fuse(0xffffffffffffff9c, &(0x7f0000000040), 0x42, 0x0) read$FUSE(r3, &(0x7f00000102c0)={0x2020}, 0x7) executing program 4: mmap(&(0x7f0000000000/0xff5000)=nil, 0xff5000, 0x1000002, 0x200000005c831, 0xffffffffffffffff, 0x0) timer_create(0x2, 0x0, &(0x7f0000bbdffc)) seccomp$SECCOMP_SET_MODE_FILTER(0x1, 0x4, &(0x7f0000000140)={0x0, 0x0}) remap_file_pages(&(0x7f0000800000/0x800000)=nil, 0x800000, 0x0, 0x600, 0x102020) executing program 3: r0 = socket$unix(0x1, 0x5, 0x0) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000100)={'veth0_macvtap\x00', 0x0}) ioctl$FS_IOC_RESVSP(0xffffffffffffffff, 0xc0189436, 0x0) r2 = socket$inet6_mptcp(0xa, 0x1, 0x106) bind$inet6(r2, &(0x7f0000000040)={0xa, 0x4e22, 0x0, @empty, 0x7}, 0x1c) listen(r2, 0xfffffffc) r3 = socket$nl_generic(0x10, 0x3, 0x10) r4 = syz_genetlink_get_family_id$mptcp(&(0x7f0000000000), 0xffffffffffffffff) bpf$MAP_CREATE_CONST_STR(0x0, 0x0, 0x0) bpf$MAP_CREATE_RINGBUF(0x0, &(0x7f0000000780)={0x1b, 0x0, 0x0, 0x40000, 0x0, 0x0, 0x1, '\x00', r1, 0x0}, 0x50) bpf$PROG_LOAD(0x5, 0x0, 0x0) r5 = syz_genetlink_get_family_id$mptcp(&(0x7f0000000040), 0xffffffffffffffff) r6 = socket$inet_mptcp(0x2, 0x1, 0x106) connect$inet(r6, &(0x7f0000000000)={0x2, 0x4e22, @local}, 0x10) sendmsg$MPTCP_PM_CMD_DEL_ADDR(0xffffffffffffffff, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000000240)={0x28, r5, 0x7, 0x0, 0x0, {}, [@MPTCP_PM_ATTR_ADDR={0x14, 0x1, 0x0, 0x1, [@MPTCP_PM_ADDR_ATTR_FAMILY={0x6, 0x1, 0x2}, @MPTCP_PM_ADDR_ATTR_ADDR4={0x8, 0x3, @local}]}]}, 0x28}}, 0x0) syz_genetlink_get_family_id$mptcp(&(0x7f00000000c0), 0xffffffffffffffff) sendmsg$MPTCP_PM_CMD_ADD_ADDR(r3, &(0x7f0000000400)={0x0, 0x0, &(0x7f00000003c0)={&(0x7f00000004c0)={0x30, r4, 0x1, 0x70bd2c, 0x1000000, {}, [@MPTCP_PM_ATTR_ADDR={0x1c, 0x1, 0x0, 0x1, [@MPTCP_PM_ADDR_ATTR_FAMILY={0x6, 0x1, 0x2}, @MPTCP_PM_ADDR_ATTR_ADDR4={0x8, 0x3, @dev={0xac, 0x14, 0x14, 0x37}}, @MPTCP_PM_ADDR_ATTR_FLAGS={0x8, 0x6, 0x3}]}]}, 0x30}, 0x1, 0xff07}, 0x2000000) executing program 3: r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000100), 0x0, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000040)={'syzkaller0\x00', 0x2}) r1 = openat$tun(0xffffffffffffff9c, &(0x7f0000000400), 0x0, 0x0) close(r1) socket$inet_udp(0x2, 0x2, 0x0) ioctl$SIOCSIFHWADDR(r1, 0x8914, &(0x7f0000002280)={'syzkaller0\x00', @multicast}) r2 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r2, 0x8933, &(0x7f0000000100)={'syzkaller0\x00', 0x0}) sendmsg$nl_route_sched(r2, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000580)={&(0x7f0000000600)=@newqdisc={0x4c, 0x24, 0x4ee4e6a52ff56541, 0x1, 0x25dfdbfd, {0x0, 0x0, 0x0, r3, {0x0, 0xb}, {0xffff, 0xffff}, {0xfff2}}, [@qdisc_kind_options=@q_netem={{0xa}, {0x1c, 0x2, {{0x3, 0x3, 0x6361, 0x5, 0xffffffff, 0x3}}}}]}, 0x4c}, 0x1, 0x0, 0x0, 0x40088c1}, 0x0) r4 = socket$unix(0x1, 0x1, 0x0) r5 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r4, 0x8933, &(0x7f0000000100)={'syzkaller0\x00', 0x0}) sendmsg$nl_route_sched(r5, &(0x7f0000000200)={0x0, 0x0, &(0x7f0000000140)={&(0x7f00000004c0)=@newqdisc={0x24, 0x24, 0x4ee4e6a52ff56541, 0x70b923, 0x80000, {0x0, 0x0, 0x0, r6, {0x0, 0x9}, {0x0, 0xb}, {0x9, 0xb}}}, 0x24}, 0x1, 0x0, 0x0, 0x2000c061}, 0x0) r7 = socket$nl_generic(0x10, 0x3, 0x10) r8 = syz_genetlink_get_family_id$tipc(&(0x7f0000000080), r7) sendmsg$TIPC_CMD_ENABLE_BEARER(r7, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000280)={&(0x7f0000000680)=ANY=[@ANYBLOB='8\x00\x00\x00', @ANYRES16=r8, @ANYBLOB="010000000d0000000000010000000000000001410000001c001700000000000000006574683a73797a6b616c6c657230"], 0x38}}, 0x0) executing program 1: r0 = openat$binder_debug(0xffffffffffffff9c, &(0x7f0000000040)='/sys/kernel/debug/binder/transactions\x00', 0x0, 0x0) r1 = openat$binderfs(0xffffffffffffff9c, &(0x7f00000000c0)='./binderfs/binder0\x00', 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR_EXT(r1, 0x4018620d, &(0x7f0000000100)) r2 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000140)='./binderfs/binder0\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000080)={0x8, 0x0, &(0x7f0000000400)=[@increfs], 0x0, 0x0, 0x0}) r3 = dup3(r2, r1, 0x0) r4 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000040)='./binderfs/binder0\x00', 0x0, 0x0) mmap$binder(&(0x7f0000ffd000/0x3000)=nil, 0x3000, 0x1, 0x11, r4, 0x0) ioctl$BINDER_SET_CONTEXT_MGR_EXT(r4, 0x4018620d, 0x0) ioctl$BINDER_WRITE_READ(r3, 0xc0306201, &(0x7f00000004c0)={0x8, 0x0, &(0x7f0000000000)=[@acquire], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r3, 0xc0306201, &(0x7f00000001c0)={0x4c, 0x0, &(0x7f0000000fc0)=[@transaction_sg={0x40486311, {0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x48, 0x18, &(0x7f0000000300)={@flat=@weak_binder={0x77622a85, 0x100a, 0x8000000000}, @flat=@weak_binder={0x77622a85, 0x1100, 0x3}}, &(0x7f0000000200)={0x0, 0x18, 0x30}}}], 0x0, 0x0, 0x0}) mmap$binder(&(0x7f0000ffe000/0x2000)=nil, 0x2000, 0x1, 0x11, r1, 0x10000000000) ioctl$BINDER_WRITE_READ(r4, 0xc0306201, &(0x7f0000000180)={0x0, 0x0, 0x0, 0x50, 0x0, &(0x7f0000000580)="b3185d7bb56f70f003360fa8bf71ac3086aedebf6fff904f92849a7a07395ee7f0e4cb1d78001c08a0ab73ffcf5ad07693727980eea946e6cba1723e81bfa5c3688803c8a124dcb27df7938e7ddfdd52"}) ioctl$BINDER_WRITE_READ(r4, 0xc0306201, &(0x7f0000004a40)={0x44, 0x0, &(0x7f00000049c0)=[@transaction={0x40406300, {0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) ioctl$BINDER_THREAD_EXIT(r4, 0x40046208, 0x0) read$FUSE(r0, &(0x7f0000004800)={0x2020}, 0x2020) executing program 3: r0 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000380)='./binderfs/binder0\x00', 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR_EXT(r0, 0x4018620d, &(0x7f00000000c0)={0x73622a85, 0xa, 0x8000000000002}) r1 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000200)='./binderfs/binder0\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000080)={0x8, 0x0, &(0x7f0000000400)=[@increfs], 0x0, 0x0, 0x0}) r2 = dup3(r1, r0, 0x0) r3 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000000)='./binderfs/binder0\x00', 0x0, 0x0) mmap$binder(&(0x7f0000ffd000/0x3000)=nil, 0x3000, 0x1, 0x11, r3, 0x0) ioctl$BINDER_SET_CONTEXT_MGR_EXT(r3, 0x4018620d, &(0x7f0000000040)={0x73622a85, 0x10a}) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f00000003c0)={0x8, 0x0, &(0x7f0000000340)=[@acquire], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000001040)={0x4c, 0x0, &(0x7f0000000ec0)=[@transaction_sg={0x40486311, {0x1, 0x0, 0x0, 0x0, 0x41, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x1000}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000001c0)={0x4c, 0x0, &(0x7f0000000740)=[@transaction_sg={0x40486311, {0x1, 0x0, 0x0, 0x0, 0x11, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x400}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000c00)={0x44, 0x0, &(0x7f0000000a80)=[@transaction={0x40406300, {0x1, 0x0, 0x0, 0x0, 0x21, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) r4 = openat$binder_debug(0xffffffffffffff9c, 0x0, 0x0, 0x0) read$FUSE(r4, &(0x7f0000007fc0)={0x2020}, 0x2020) executing program 4: r0 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000380)='./binderfs/binder0\x00', 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR_EXT(r0, 0x4018620d, &(0x7f00000000c0)={0x73622a85, 0xa, 0x8000000000002}) r1 = openat$binderfs(0xffffffffffffff9c, 0x0, 0x0, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000080)={0x8, 0x0, &(0x7f0000000400)=[@increfs], 0x0, 0x0, 0x0}) r2 = dup3(r1, r0, 0x0) r3 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000000)='./binderfs/binder0\x00', 0x0, 0x0) r4 = mmap$binder(&(0x7f0000ffd000/0x3000)=nil, 0x3000, 0x1, 0x11, r3, 0x0) ioctl$BINDER_SET_CONTEXT_MGR_EXT(r3, 0x4018620d, &(0x7f0000000040)={0x73622a85, 0x10a}) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f00000003c0)={0x8, 0x0, &(0x7f0000000340)=[@acquire], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000001040)={0x4c, 0x0, &(0x7f0000000ec0)=[@transaction_sg={0x40486311, {0x1, 0x0, 0x0, 0x0, 0x41, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x1000}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000001c0)={0x4c, 0x0, &(0x7f0000000740)=[@transaction_sg={0x40486311, {0x1, 0x0, 0x0, 0x0, 0x11, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x400}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000c00)={0x44, 0x0, &(0x7f0000000a80)=[@transaction={0x40406300, {0x1, 0x0, 0x0, 0x0, 0x21, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r3, 0xc0306201, &(0x7f0000000300)={0xc, 0x0, &(0x7f0000000240)=[@free_buffer={0x40086303, r4}], 0x54, 0x0, &(0x7f0000000280)="37b82b8f41afa37c5297fe5b692d3cedbd057d6f37743560799bbf4ddd06bc810453adcec0c458de737aeadf5afcd6641ea3434a1a0bfd0debe7506939a82090490c46a6010019e855badfb0bee8561d5ee15bac"}) executing program 7: sendmsg$nl_route_sched(0xffffffffffffffff, 0x0, 0x10) r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000200), 0x0, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000040)={'syzkaller0\x00', 0x2}) r1 = openat$tun(0xffffffffffffff9c, &(0x7f0000000400), 0x0, 0x0) close(r1) socket$nl_generic(0x10, 0x3, 0x10) ioctl$SIOCSIFHWADDR(r1, 0x8914, &(0x7f0000002280)={'syzkaller0\x00', @multicast}) r2 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r2, 0x8933, &(0x7f0000000100)={'syzkaller0\x00', 0x0}) sendmsg$nl_route_sched(r2, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000580)={&(0x7f0000000340)=@newqdisc={0x4c, 0x24, 0x4ee4e6a52ff56541, 0x70bd25, 0x25dfdbfd, {0x0, 0x0, 0x0, r3, {0x0, 0xb}, {0xffff, 0xffff}, {0xfff2}}, [@qdisc_kind_options=@q_netem={{0xa}, {0x1c, 0x2, {{0x3, 0x3, 0x4361, 0x7, 0xffffffff, 0x3}}}}]}, 0x4c}, 0x1, 0x0, 0x0, 0x8000}, 0x0) sendmsg$nl_route_sched(r2, &(0x7f00000003c0)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000440)=@newqdisc={0x44, 0x24, 0x4ee4e6a52ff56541, 0x70b927, 0x25dfdbfc, {0x0, 0x0, 0x0, r3, {0x0, 0xd}, {0x6, 0xb}, {0xb, 0x2}}, [@qdisc_kind_options=@q_cake={{0x9}, {0x14, 0x2, [@TCA_CAKE_AUTORATE={0x8, 0x9, 0x6}, @TCA_CAKE_MEMORY={0x8, 0xa, 0x5}]}}]}, 0x44}, 0x1, 0x0, 0x0, 0x240040e0}, 0x4890) r4 = socket$packet(0x11, 0x3, 0x300) sendto$packet(r4, &(0x7f0000000240)="800000800000210ee7decd7a000340", 0xf, 0x40, &(0x7f00000001c0)={0x11, 0x8100, r3, 0x1, 0xd8, 0x6, @broadcast}, 0x14) program crashed: WARNING in hugetlb_split bisect: the chunk can be dropped bisect: split chunks (needed=true): <10> bisect: split chunk #0 of len 10 into 2 parts bisect: testing without sub-chunk 1/2 testing program (duration=6m1s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): [17, 16, 16, 14, 13, 13] detailed listing: executing program 3: r0 = socket$unix(0x1, 0x5, 0x0) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000100)={'veth0_macvtap\x00', 0x0}) ioctl$FS_IOC_RESVSP(0xffffffffffffffff, 0xc0189436, 0x0) r2 = socket$inet6_mptcp(0xa, 0x1, 0x106) bind$inet6(r2, &(0x7f0000000040)={0xa, 0x4e22, 0x0, @empty, 0x7}, 0x1c) listen(r2, 0xfffffffc) r3 = socket$nl_generic(0x10, 0x3, 0x10) r4 = syz_genetlink_get_family_id$mptcp(&(0x7f0000000000), 0xffffffffffffffff) bpf$MAP_CREATE_CONST_STR(0x0, 0x0, 0x0) bpf$MAP_CREATE_RINGBUF(0x0, &(0x7f0000000780)={0x1b, 0x0, 0x0, 0x40000, 0x0, 0x0, 0x1, '\x00', r1, 0x0}, 0x50) bpf$PROG_LOAD(0x5, 0x0, 0x0) r5 = syz_genetlink_get_family_id$mptcp(&(0x7f0000000040), 0xffffffffffffffff) r6 = socket$inet_mptcp(0x2, 0x1, 0x106) connect$inet(r6, &(0x7f0000000000)={0x2, 0x4e22, @local}, 0x10) sendmsg$MPTCP_PM_CMD_DEL_ADDR(0xffffffffffffffff, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000000240)={0x28, r5, 0x7, 0x0, 0x0, {}, [@MPTCP_PM_ATTR_ADDR={0x14, 0x1, 0x0, 0x1, [@MPTCP_PM_ADDR_ATTR_FAMILY={0x6, 0x1, 0x2}, @MPTCP_PM_ADDR_ATTR_ADDR4={0x8, 0x3, @local}]}]}, 0x28}}, 0x0) syz_genetlink_get_family_id$mptcp(&(0x7f00000000c0), 0xffffffffffffffff) sendmsg$MPTCP_PM_CMD_ADD_ADDR(r3, &(0x7f0000000400)={0x0, 0x0, &(0x7f00000003c0)={&(0x7f00000004c0)={0x30, r4, 0x1, 0x70bd2c, 0x1000000, {}, [@MPTCP_PM_ATTR_ADDR={0x1c, 0x1, 0x0, 0x1, [@MPTCP_PM_ADDR_ATTR_FAMILY={0x6, 0x1, 0x2}, @MPTCP_PM_ADDR_ATTR_ADDR4={0x8, 0x3, @dev={0xac, 0x14, 0x14, 0x37}}, @MPTCP_PM_ADDR_ATTR_FLAGS={0x8, 0x6, 0x3}]}]}, 0x30}, 0x1, 0xff07}, 0x2000000) executing program 3: r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000100), 0x0, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000040)={'syzkaller0\x00', 0x2}) r1 = openat$tun(0xffffffffffffff9c, &(0x7f0000000400), 0x0, 0x0) close(r1) socket$inet_udp(0x2, 0x2, 0x0) ioctl$SIOCSIFHWADDR(r1, 0x8914, &(0x7f0000002280)={'syzkaller0\x00', @multicast}) r2 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r2, 0x8933, &(0x7f0000000100)={'syzkaller0\x00', 0x0}) sendmsg$nl_route_sched(r2, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000580)={&(0x7f0000000600)=@newqdisc={0x4c, 0x24, 0x4ee4e6a52ff56541, 0x1, 0x25dfdbfd, {0x0, 0x0, 0x0, r3, {0x0, 0xb}, {0xffff, 0xffff}, {0xfff2}}, [@qdisc_kind_options=@q_netem={{0xa}, {0x1c, 0x2, {{0x3, 0x3, 0x6361, 0x5, 0xffffffff, 0x3}}}}]}, 0x4c}, 0x1, 0x0, 0x0, 0x40088c1}, 0x0) r4 = socket$unix(0x1, 0x1, 0x0) r5 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r4, 0x8933, &(0x7f0000000100)={'syzkaller0\x00', 0x0}) sendmsg$nl_route_sched(r5, &(0x7f0000000200)={0x0, 0x0, &(0x7f0000000140)={&(0x7f00000004c0)=@newqdisc={0x24, 0x24, 0x4ee4e6a52ff56541, 0x70b923, 0x80000, {0x0, 0x0, 0x0, r6, {0x0, 0x9}, {0x0, 0xb}, {0x9, 0xb}}}, 0x24}, 0x1, 0x0, 0x0, 0x2000c061}, 0x0) r7 = socket$nl_generic(0x10, 0x3, 0x10) r8 = syz_genetlink_get_family_id$tipc(&(0x7f0000000080), r7) sendmsg$TIPC_CMD_ENABLE_BEARER(r7, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000280)={&(0x7f0000000680)=ANY=[@ANYBLOB='8\x00\x00\x00', @ANYRES16=r8, @ANYBLOB="010000000d0000000000010000000000000001410000001c001700000000000000006574683a73797a6b616c6c657230"], 0x38}}, 0x0) executing program 1: r0 = openat$binder_debug(0xffffffffffffff9c, &(0x7f0000000040)='/sys/kernel/debug/binder/transactions\x00', 0x0, 0x0) r1 = openat$binderfs(0xffffffffffffff9c, &(0x7f00000000c0)='./binderfs/binder0\x00', 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR_EXT(r1, 0x4018620d, &(0x7f0000000100)) r2 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000140)='./binderfs/binder0\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000080)={0x8, 0x0, &(0x7f0000000400)=[@increfs], 0x0, 0x0, 0x0}) r3 = dup3(r2, r1, 0x0) r4 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000040)='./binderfs/binder0\x00', 0x0, 0x0) mmap$binder(&(0x7f0000ffd000/0x3000)=nil, 0x3000, 0x1, 0x11, r4, 0x0) ioctl$BINDER_SET_CONTEXT_MGR_EXT(r4, 0x4018620d, 0x0) ioctl$BINDER_WRITE_READ(r3, 0xc0306201, &(0x7f00000004c0)={0x8, 0x0, &(0x7f0000000000)=[@acquire], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r3, 0xc0306201, &(0x7f00000001c0)={0x4c, 0x0, &(0x7f0000000fc0)=[@transaction_sg={0x40486311, {0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x48, 0x18, &(0x7f0000000300)={@flat=@weak_binder={0x77622a85, 0x100a, 0x8000000000}, @flat=@weak_binder={0x77622a85, 0x1100, 0x3}}, &(0x7f0000000200)={0x0, 0x18, 0x30}}}], 0x0, 0x0, 0x0}) mmap$binder(&(0x7f0000ffe000/0x2000)=nil, 0x2000, 0x1, 0x11, r1, 0x10000000000) ioctl$BINDER_WRITE_READ(r4, 0xc0306201, &(0x7f0000000180)={0x0, 0x0, 0x0, 0x50, 0x0, &(0x7f0000000580)="b3185d7bb56f70f003360fa8bf71ac3086aedebf6fff904f92849a7a07395ee7f0e4cb1d78001c08a0ab73ffcf5ad07693727980eea946e6cba1723e81bfa5c3688803c8a124dcb27df7938e7ddfdd52"}) ioctl$BINDER_WRITE_READ(r4, 0xc0306201, &(0x7f0000004a40)={0x44, 0x0, &(0x7f00000049c0)=[@transaction={0x40406300, {0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) ioctl$BINDER_THREAD_EXIT(r4, 0x40046208, 0x0) read$FUSE(r0, &(0x7f0000004800)={0x2020}, 0x2020) executing program 3: r0 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000380)='./binderfs/binder0\x00', 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR_EXT(r0, 0x4018620d, &(0x7f00000000c0)={0x73622a85, 0xa, 0x8000000000002}) r1 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000200)='./binderfs/binder0\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000080)={0x8, 0x0, &(0x7f0000000400)=[@increfs], 0x0, 0x0, 0x0}) r2 = dup3(r1, r0, 0x0) r3 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000000)='./binderfs/binder0\x00', 0x0, 0x0) mmap$binder(&(0x7f0000ffd000/0x3000)=nil, 0x3000, 0x1, 0x11, r3, 0x0) ioctl$BINDER_SET_CONTEXT_MGR_EXT(r3, 0x4018620d, &(0x7f0000000040)={0x73622a85, 0x10a}) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f00000003c0)={0x8, 0x0, &(0x7f0000000340)=[@acquire], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000001040)={0x4c, 0x0, &(0x7f0000000ec0)=[@transaction_sg={0x40486311, {0x1, 0x0, 0x0, 0x0, 0x41, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x1000}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000001c0)={0x4c, 0x0, &(0x7f0000000740)=[@transaction_sg={0x40486311, {0x1, 0x0, 0x0, 0x0, 0x11, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x400}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000c00)={0x44, 0x0, &(0x7f0000000a80)=[@transaction={0x40406300, {0x1, 0x0, 0x0, 0x0, 0x21, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) r4 = openat$binder_debug(0xffffffffffffff9c, 0x0, 0x0, 0x0) read$FUSE(r4, &(0x7f0000007fc0)={0x2020}, 0x2020) executing program 4: r0 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000380)='./binderfs/binder0\x00', 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR_EXT(r0, 0x4018620d, &(0x7f00000000c0)={0x73622a85, 0xa, 0x8000000000002}) r1 = openat$binderfs(0xffffffffffffff9c, 0x0, 0x0, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000080)={0x8, 0x0, &(0x7f0000000400)=[@increfs], 0x0, 0x0, 0x0}) r2 = dup3(r1, r0, 0x0) r3 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000000)='./binderfs/binder0\x00', 0x0, 0x0) r4 = mmap$binder(&(0x7f0000ffd000/0x3000)=nil, 0x3000, 0x1, 0x11, r3, 0x0) ioctl$BINDER_SET_CONTEXT_MGR_EXT(r3, 0x4018620d, &(0x7f0000000040)={0x73622a85, 0x10a}) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f00000003c0)={0x8, 0x0, &(0x7f0000000340)=[@acquire], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000001040)={0x4c, 0x0, &(0x7f0000000ec0)=[@transaction_sg={0x40486311, {0x1, 0x0, 0x0, 0x0, 0x41, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x1000}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000001c0)={0x4c, 0x0, &(0x7f0000000740)=[@transaction_sg={0x40486311, {0x1, 0x0, 0x0, 0x0, 0x11, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x400}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000c00)={0x44, 0x0, &(0x7f0000000a80)=[@transaction={0x40406300, {0x1, 0x0, 0x0, 0x0, 0x21, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r3, 0xc0306201, &(0x7f0000000300)={0xc, 0x0, &(0x7f0000000240)=[@free_buffer={0x40086303, r4}], 0x54, 0x0, &(0x7f0000000280)="37b82b8f41afa37c5297fe5b692d3cedbd057d6f37743560799bbf4ddd06bc810453adcec0c458de737aeadf5afcd6641ea3434a1a0bfd0debe7506939a82090490c46a6010019e855badfb0bee8561d5ee15bac"}) executing program 7: sendmsg$nl_route_sched(0xffffffffffffffff, 0x0, 0x10) r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000200), 0x0, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000040)={'syzkaller0\x00', 0x2}) r1 = openat$tun(0xffffffffffffff9c, &(0x7f0000000400), 0x0, 0x0) close(r1) socket$nl_generic(0x10, 0x3, 0x10) ioctl$SIOCSIFHWADDR(r1, 0x8914, &(0x7f0000002280)={'syzkaller0\x00', @multicast}) r2 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r2, 0x8933, &(0x7f0000000100)={'syzkaller0\x00', 0x0}) sendmsg$nl_route_sched(r2, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000580)={&(0x7f0000000340)=@newqdisc={0x4c, 0x24, 0x4ee4e6a52ff56541, 0x70bd25, 0x25dfdbfd, {0x0, 0x0, 0x0, r3, {0x0, 0xb}, {0xffff, 0xffff}, {0xfff2}}, [@qdisc_kind_options=@q_netem={{0xa}, {0x1c, 0x2, {{0x3, 0x3, 0x4361, 0x7, 0xffffffff, 0x3}}}}]}, 0x4c}, 0x1, 0x0, 0x0, 0x8000}, 0x0) sendmsg$nl_route_sched(r2, &(0x7f00000003c0)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000440)=@newqdisc={0x44, 0x24, 0x4ee4e6a52ff56541, 0x70b927, 0x25dfdbfc, {0x0, 0x0, 0x0, r3, {0x0, 0xd}, {0x6, 0xb}, {0xb, 0x2}}, [@qdisc_kind_options=@q_cake={{0x9}, {0x14, 0x2, [@TCA_CAKE_AUTORATE={0x8, 0x9, 0x6}, @TCA_CAKE_MEMORY={0x8, 0xa, 0x5}]}}]}, 0x44}, 0x1, 0x0, 0x0, 0x240040e0}, 0x4890) r4 = socket$packet(0x11, 0x3, 0x300) sendto$packet(r4, &(0x7f0000000240)="800000800000210ee7decd7a000340", 0xf, 0x40, &(0x7f00000001c0)={0x11, 0x8100, r3, 0x1, 0xd8, 0x6, @broadcast}, 0x14) program did not crash bisect: testing without sub-chunk 2/2 testing program (duration=6m1s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): [4, 7, 4, 13, 4, 13] detailed listing: executing program 4: r0 = syz_open_dev$sndctrl(&(0x7f0000000040), 0x0, 0x0) madvise(&(0x7f0000000000/0x600000)=nil, 0x600000, 0x15) mprotect(&(0x7f0000000000/0x4000)=nil, 0x4000, 0x1) ioctl$SNDRV_CTL_IOCTL_SUBSCRIBE_EVENTS(r0, 0xc0045516, &(0x7f0000000000)=0xffb) executing program 4: r0 = socket$l2tp(0x2, 0x2, 0x73) bind$inet(r0, &(0x7f00000002c0)={0x2, 0x4e1c, @multicast1}, 0x10) connect$inet(r0, &(0x7f0000000200)={0x2, 0x4e22, @local}, 0x10) r1 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000001c0)='memory.events\x00', 0x275a, 0x0) write$cgroup_subtree(r1, &(0x7f0000000100)=ANY=[], 0x32600) mmap(&(0x7f0000000000/0x3000)=nil, 0x3000, 0x2000001, 0x12, r1, 0x0) getsockopt$sock_buf(r0, 0x1, 0x1c, 0x0, &(0x7f00000000c0)) executing program 4: writev(0xffffffffffffffff, &(0x7f0000000180)=[{&(0x7f0000000240)}], 0x1) mprotect(&(0x7f0000000000/0xf000)=nil, 0xf000, 0x1) r0 = socket$inet6_sctp(0xa, 0x1, 0x84) getsockopt$inet_sctp6_SCTP_STREAM_SCHEDULER(r0, 0x84, 0x7b, &(0x7f0000000140)={0x0, 0x9}, &(0x7f0000000180)=0x8) executing program 4: syz_mount_image$fuse(0x0, &(0x7f0000002080)='./file0\x00', 0x208000, 0x0, 0x3d, 0x0, 0x0) r0 = open_tree(0xffffffffffffff9c, &(0x7f0000000640)='\x00', 0x89901) move_mount(r0, &(0x7f0000000140)='.\x00', 0xffffffffffffff9c, &(0x7f0000000180)='./file0\x00', 0x0) r1 = open_tree(0xffffffffffffff9c, &(0x7f0000000640)='\x00', 0x9801) move_mount(r1, &(0x7f0000000140)='.\x00', 0xffffffffffffff9c, &(0x7f0000000180)='./file0\x00', 0x0) chroot(&(0x7f0000001740)='./file0\x00') syz_open_procfs(0x0, &(0x7f0000000040)='mounts\x00') r2 = fsopen(&(0x7f0000000180)='proc\x00', 0x1) fsconfig$FSCONFIG_CMD_CREATE(r2, 0x6, 0x0, 0x0, 0x0) mprotect(&(0x7f0000000000/0x4000)=nil, 0x4000, 0x1) fchdir(0xffffffffffffffff) r3 = openat$fuse(0xffffffffffffff9c, &(0x7f0000000040), 0x42, 0x0) read$FUSE(r3, &(0x7f00000102c0)={0x2020}, 0x7) executing program 4: mmap(&(0x7f0000000000/0xff5000)=nil, 0xff5000, 0x1000002, 0x200000005c831, 0xffffffffffffffff, 0x0) timer_create(0x2, 0x0, &(0x7f0000bbdffc)) seccomp$SECCOMP_SET_MODE_FILTER(0x1, 0x4, &(0x7f0000000140)={0x0, 0x0}) remap_file_pages(&(0x7f0000800000/0x800000)=nil, 0x800000, 0x0, 0x600, 0x102020) executing program 7: sendmsg$nl_route_sched(0xffffffffffffffff, 0x0, 0x10) r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000200), 0x0, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000040)={'syzkaller0\x00', 0x2}) r1 = openat$tun(0xffffffffffffff9c, &(0x7f0000000400), 0x0, 0x0) close(r1) socket$nl_generic(0x10, 0x3, 0x10) ioctl$SIOCSIFHWADDR(r1, 0x8914, &(0x7f0000002280)={'syzkaller0\x00', @multicast}) r2 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r2, 0x8933, &(0x7f0000000100)={'syzkaller0\x00', 0x0}) sendmsg$nl_route_sched(r2, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000580)={&(0x7f0000000340)=@newqdisc={0x4c, 0x24, 0x4ee4e6a52ff56541, 0x70bd25, 0x25dfdbfd, {0x0, 0x0, 0x0, r3, {0x0, 0xb}, {0xffff, 0xffff}, {0xfff2}}, [@qdisc_kind_options=@q_netem={{0xa}, {0x1c, 0x2, {{0x3, 0x3, 0x4361, 0x7, 0xffffffff, 0x3}}}}]}, 0x4c}, 0x1, 0x0, 0x0, 0x8000}, 0x0) sendmsg$nl_route_sched(r2, &(0x7f00000003c0)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000440)=@newqdisc={0x44, 0x24, 0x4ee4e6a52ff56541, 0x70b927, 0x25dfdbfc, {0x0, 0x0, 0x0, r3, {0x0, 0xd}, {0x6, 0xb}, {0xb, 0x2}}, [@qdisc_kind_options=@q_cake={{0x9}, {0x14, 0x2, [@TCA_CAKE_AUTORATE={0x8, 0x9, 0x6}, @TCA_CAKE_MEMORY={0x8, 0xa, 0x5}]}}]}, 0x44}, 0x1, 0x0, 0x0, 0x240040e0}, 0x4890) r4 = socket$packet(0x11, 0x3, 0x300) sendto$packet(r4, &(0x7f0000000240)="800000800000210ee7decd7a000340", 0xf, 0x40, &(0x7f00000001c0)={0x11, 0x8100, r3, 0x1, 0xd8, 0x6, @broadcast}, 0x14) program crashed: WARNING in hugetlb_split bisect: the chunk can be dropped bisect: split chunks (needed=true): <5> bisect: split chunk #0 of len 5 into 2 parts bisect: testing without sub-chunk 1/2 testing program (duration=6m0s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): [13, 4, 13] detailed listing: executing program 4: syz_mount_image$fuse(0x0, &(0x7f0000002080)='./file0\x00', 0x208000, 0x0, 0x3d, 0x0, 0x0) r0 = open_tree(0xffffffffffffff9c, &(0x7f0000000640)='\x00', 0x89901) move_mount(r0, &(0x7f0000000140)='.\x00', 0xffffffffffffff9c, &(0x7f0000000180)='./file0\x00', 0x0) r1 = open_tree(0xffffffffffffff9c, &(0x7f0000000640)='\x00', 0x9801) move_mount(r1, &(0x7f0000000140)='.\x00', 0xffffffffffffff9c, &(0x7f0000000180)='./file0\x00', 0x0) chroot(&(0x7f0000001740)='./file0\x00') syz_open_procfs(0x0, &(0x7f0000000040)='mounts\x00') r2 = fsopen(&(0x7f0000000180)='proc\x00', 0x1) fsconfig$FSCONFIG_CMD_CREATE(r2, 0x6, 0x0, 0x0, 0x0) mprotect(&(0x7f0000000000/0x4000)=nil, 0x4000, 0x1) fchdir(0xffffffffffffffff) r3 = openat$fuse(0xffffffffffffff9c, &(0x7f0000000040), 0x42, 0x0) read$FUSE(r3, &(0x7f00000102c0)={0x2020}, 0x7) executing program 4: mmap(&(0x7f0000000000/0xff5000)=nil, 0xff5000, 0x1000002, 0x200000005c831, 0xffffffffffffffff, 0x0) timer_create(0x2, 0x0, &(0x7f0000bbdffc)) seccomp$SECCOMP_SET_MODE_FILTER(0x1, 0x4, &(0x7f0000000140)={0x0, 0x0}) remap_file_pages(&(0x7f0000800000/0x800000)=nil, 0x800000, 0x0, 0x600, 0x102020) executing program 7: sendmsg$nl_route_sched(0xffffffffffffffff, 0x0, 0x10) r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000200), 0x0, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000040)={'syzkaller0\x00', 0x2}) r1 = openat$tun(0xffffffffffffff9c, &(0x7f0000000400), 0x0, 0x0) close(r1) socket$nl_generic(0x10, 0x3, 0x10) ioctl$SIOCSIFHWADDR(r1, 0x8914, &(0x7f0000002280)={'syzkaller0\x00', @multicast}) r2 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r2, 0x8933, &(0x7f0000000100)={'syzkaller0\x00', 0x0}) sendmsg$nl_route_sched(r2, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000580)={&(0x7f0000000340)=@newqdisc={0x4c, 0x24, 0x4ee4e6a52ff56541, 0x70bd25, 0x25dfdbfd, {0x0, 0x0, 0x0, r3, {0x0, 0xb}, {0xffff, 0xffff}, {0xfff2}}, [@qdisc_kind_options=@q_netem={{0xa}, {0x1c, 0x2, {{0x3, 0x3, 0x4361, 0x7, 0xffffffff, 0x3}}}}]}, 0x4c}, 0x1, 0x0, 0x0, 0x8000}, 0x0) sendmsg$nl_route_sched(r2, &(0x7f00000003c0)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000440)=@newqdisc={0x44, 0x24, 0x4ee4e6a52ff56541, 0x70b927, 0x25dfdbfc, {0x0, 0x0, 0x0, r3, {0x0, 0xd}, {0x6, 0xb}, {0xb, 0x2}}, [@qdisc_kind_options=@q_cake={{0x9}, {0x14, 0x2, [@TCA_CAKE_AUTORATE={0x8, 0x9, 0x6}, @TCA_CAKE_MEMORY={0x8, 0xa, 0x5}]}}]}, 0x44}, 0x1, 0x0, 0x0, 0x240040e0}, 0x4890) r4 = socket$packet(0x11, 0x3, 0x300) sendto$packet(r4, &(0x7f0000000240)="800000800000210ee7decd7a000340", 0xf, 0x40, &(0x7f00000001c0)={0x11, 0x8100, r3, 0x1, 0xd8, 0x6, @broadcast}, 0x14) program crashed: WARNING in hugetlb_split bisect: the chunk can be dropped bisect: testing without sub-chunk 2/2 bisect: no need to test this chunk, it's definitely needed bisect: split chunks (needed=true): <2> bisect: split chunk #0 of len 2 into 2 parts bisect: testing without sub-chunk 1/2 testing program (duration=6m0s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): [4, 13] detailed listing: executing program 4: mmap(&(0x7f0000000000/0xff5000)=nil, 0xff5000, 0x1000002, 0x200000005c831, 0xffffffffffffffff, 0x0) timer_create(0x2, 0x0, &(0x7f0000bbdffc)) seccomp$SECCOMP_SET_MODE_FILTER(0x1, 0x4, &(0x7f0000000140)={0x0, 0x0}) remap_file_pages(&(0x7f0000800000/0x800000)=nil, 0x800000, 0x0, 0x600, 0x102020) executing program 7: sendmsg$nl_route_sched(0xffffffffffffffff, 0x0, 0x10) r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000200), 0x0, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000040)={'syzkaller0\x00', 0x2}) r1 = openat$tun(0xffffffffffffff9c, &(0x7f0000000400), 0x0, 0x0) close(r1) socket$nl_generic(0x10, 0x3, 0x10) ioctl$SIOCSIFHWADDR(r1, 0x8914, &(0x7f0000002280)={'syzkaller0\x00', @multicast}) r2 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r2, 0x8933, &(0x7f0000000100)={'syzkaller0\x00', 0x0}) sendmsg$nl_route_sched(r2, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000580)={&(0x7f0000000340)=@newqdisc={0x4c, 0x24, 0x4ee4e6a52ff56541, 0x70bd25, 0x25dfdbfd, {0x0, 0x0, 0x0, r3, {0x0, 0xb}, {0xffff, 0xffff}, {0xfff2}}, [@qdisc_kind_options=@q_netem={{0xa}, {0x1c, 0x2, {{0x3, 0x3, 0x4361, 0x7, 0xffffffff, 0x3}}}}]}, 0x4c}, 0x1, 0x0, 0x0, 0x8000}, 0x0) sendmsg$nl_route_sched(r2, &(0x7f00000003c0)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000440)=@newqdisc={0x44, 0x24, 0x4ee4e6a52ff56541, 0x70b927, 0x25dfdbfc, {0x0, 0x0, 0x0, r3, {0x0, 0xd}, {0x6, 0xb}, {0xb, 0x2}}, [@qdisc_kind_options=@q_cake={{0x9}, {0x14, 0x2, [@TCA_CAKE_AUTORATE={0x8, 0x9, 0x6}, @TCA_CAKE_MEMORY={0x8, 0xa, 0x5}]}}]}, 0x44}, 0x1, 0x0, 0x0, 0x240040e0}, 0x4890) r4 = socket$packet(0x11, 0x3, 0x300) sendto$packet(r4, &(0x7f0000000240)="800000800000210ee7decd7a000340", 0xf, 0x40, &(0x7f00000001c0)={0x11, 0x8100, r3, 0x1, 0xd8, 0x6, @broadcast}, 0x14) program crashed: WARNING in hugetlb_split bisect: the chunk can be dropped bisect: testing without sub-chunk 2/2 bisect: no need to test this chunk, it's definitely needed bisect: split chunks (needed=true): <1> bisect: split chunk #0 of len 1 into 2 parts bisect: no way to further split the chunk bisect: 2 programs left: executing program 4: mmap(&(0x7f0000000000/0xff5000)=nil, 0xff5000, 0x1000002, 0x200000005c831, 0xffffffffffffffff, 0x0) timer_create(0x2, 0x0, &(0x7f0000bbdffc)) seccomp$SECCOMP_SET_MODE_FILTER(0x1, 0x4, &(0x7f0000000140)={0x0, 0x0}) remap_file_pages(&(0x7f0000800000/0x800000)=nil, 0x800000, 0x0, 0x600, 0x102020) executing program 7: sendmsg$nl_route_sched(0xffffffffffffffff, 0x0, 0x10) r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000200), 0x0, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000040)={'syzkaller0\x00', 0x2}) r1 = openat$tun(0xffffffffffffff9c, &(0x7f0000000400), 0x0, 0x0) close(r1) socket$nl_generic(0x10, 0x3, 0x10) ioctl$SIOCSIFHWADDR(r1, 0x8914, &(0x7f0000002280)={'syzkaller0\x00', @multicast}) r2 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r2, 0x8933, &(0x7f0000000100)={'syzkaller0\x00', 0x0}) sendmsg$nl_route_sched(r2, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000580)={&(0x7f0000000340)=@newqdisc={0x4c, 0x24, 0x4ee4e6a52ff56541, 0x70bd25, 0x25dfdbfd, {0x0, 0x0, 0x0, r3, {0x0, 0xb}, {0xffff, 0xffff}, {0xfff2}}, [@qdisc_kind_options=@q_netem={{0xa}, {0x1c, 0x2, {{0x3, 0x3, 0x4361, 0x7, 0xffffffff, 0x3}}}}]}, 0x4c}, 0x1, 0x0, 0x0, 0x8000}, 0x0) sendmsg$nl_route_sched(r2, &(0x7f00000003c0)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000440)=@newqdisc={0x44, 0x24, 0x4ee4e6a52ff56541, 0x70b927, 0x25dfdbfc, {0x0, 0x0, 0x0, r3, {0x0, 0xd}, {0x6, 0xb}, {0xb, 0x2}}, [@qdisc_kind_options=@q_cake={{0x9}, {0x14, 0x2, [@TCA_CAKE_AUTORATE={0x8, 0x9, 0x6}, @TCA_CAKE_MEMORY={0x8, 0xa, 0x5}]}}]}, 0x44}, 0x1, 0x0, 0x0, 0x240040e0}, 0x4890) r4 = socket$packet(0x11, 0x3, 0x300) sendto$packet(r4, &(0x7f0000000240)="800000800000210ee7decd7a000340", 0xf, 0x40, &(0x7f00000001c0)={0x11, 0x8100, r3, 0x1, 0xd8, 0x6, @broadcast}, 0x14) bisect: trying to concatenate bisect: concatenate 2 entries minimizing program #0 before concatenation testing program (duration=9m0s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): [3, 13] detailed listing: executing program 0: mmap(&(0x7f0000000000/0xff5000)=nil, 0xff5000, 0x1000002, 0x200000005c831, 0xffffffffffffffff, 0x0) timer_create(0x2, 0x0, &(0x7f0000bbdffc)) seccomp$SECCOMP_SET_MODE_FILTER(0x1, 0x4, &(0x7f0000000140)={0x0, 0x0}) executing program 7: sendmsg$nl_route_sched(0xffffffffffffffff, 0x0, 0x10) r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000200), 0x0, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000040)={'syzkaller0\x00', 0x2}) r1 = openat$tun(0xffffffffffffff9c, &(0x7f0000000400), 0x0, 0x0) close(r1) socket$nl_generic(0x10, 0x3, 0x10) ioctl$SIOCSIFHWADDR(r1, 0x8914, &(0x7f0000002280)={'syzkaller0\x00', @multicast}) r2 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r2, 0x8933, &(0x7f0000000100)={'syzkaller0\x00', 0x0}) sendmsg$nl_route_sched(r2, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000580)={&(0x7f0000000340)=@newqdisc={0x4c, 0x24, 0x4ee4e6a52ff56541, 0x70bd25, 0x25dfdbfd, {0x0, 0x0, 0x0, r3, {0x0, 0xb}, {0xffff, 0xffff}, {0xfff2}}, [@qdisc_kind_options=@q_netem={{0xa}, {0x1c, 0x2, {{0x3, 0x3, 0x4361, 0x7, 0xffffffff, 0x3}}}}]}, 0x4c}, 0x1, 0x0, 0x0, 0x8000}, 0x0) sendmsg$nl_route_sched(r2, &(0x7f00000003c0)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000440)=@newqdisc={0x44, 0x24, 0x4ee4e6a52ff56541, 0x70b927, 0x25dfdbfc, {0x0, 0x0, 0x0, r3, {0x0, 0xd}, {0x6, 0xb}, {0xb, 0x2}}, [@qdisc_kind_options=@q_cake={{0x9}, {0x14, 0x2, [@TCA_CAKE_AUTORATE={0x8, 0x9, 0x6}, @TCA_CAKE_MEMORY={0x8, 0xa, 0x5}]}}]}, 0x44}, 0x1, 0x0, 0x0, 0x240040e0}, 0x4890) r4 = socket$packet(0x11, 0x3, 0x300) sendto$packet(r4, &(0x7f0000000240)="800000800000210ee7decd7a000340", 0xf, 0x40, &(0x7f00000001c0)={0x11, 0x8100, r3, 0x1, 0xd8, 0x6, @broadcast}, 0x14) program did not crash testing program (duration=9m0s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): [3, 13] detailed listing: executing program 0: mmap(&(0x7f0000000000/0xff5000)=nil, 0xff5000, 0x1000002, 0x200000005c831, 0xffffffffffffffff, 0x0) timer_create(0x2, 0x0, &(0x7f0000bbdffc)) remap_file_pages(&(0x7f0000800000/0x800000)=nil, 0x800000, 0x0, 0x600, 0x102020) executing program 7: sendmsg$nl_route_sched(0xffffffffffffffff, 0x0, 0x10) r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000200), 0x0, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000040)={'syzkaller0\x00', 0x2}) r1 = openat$tun(0xffffffffffffff9c, &(0x7f0000000400), 0x0, 0x0) close(r1) socket$nl_generic(0x10, 0x3, 0x10) ioctl$SIOCSIFHWADDR(r1, 0x8914, &(0x7f0000002280)={'syzkaller0\x00', @multicast}) r2 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r2, 0x8933, &(0x7f0000000100)={'syzkaller0\x00', 0x0}) sendmsg$nl_route_sched(r2, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000580)={&(0x7f0000000340)=@newqdisc={0x4c, 0x24, 0x4ee4e6a52ff56541, 0x70bd25, 0x25dfdbfd, {0x0, 0x0, 0x0, r3, {0x0, 0xb}, {0xffff, 0xffff}, {0xfff2}}, [@qdisc_kind_options=@q_netem={{0xa}, {0x1c, 0x2, {{0x3, 0x3, 0x4361, 0x7, 0xffffffff, 0x3}}}}]}, 0x4c}, 0x1, 0x0, 0x0, 0x8000}, 0x0) sendmsg$nl_route_sched(r2, &(0x7f00000003c0)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000440)=@newqdisc={0x44, 0x24, 0x4ee4e6a52ff56541, 0x70b927, 0x25dfdbfc, {0x0, 0x0, 0x0, r3, {0x0, 0xd}, {0x6, 0xb}, {0xb, 0x2}}, [@qdisc_kind_options=@q_cake={{0x9}, {0x14, 0x2, [@TCA_CAKE_AUTORATE={0x8, 0x9, 0x6}, @TCA_CAKE_MEMORY={0x8, 0xa, 0x5}]}}]}, 0x44}, 0x1, 0x0, 0x0, 0x240040e0}, 0x4890) r4 = socket$packet(0x11, 0x3, 0x300) sendto$packet(r4, &(0x7f0000000240)="800000800000210ee7decd7a000340", 0xf, 0x40, &(0x7f00000001c0)={0x11, 0x8100, r3, 0x1, 0xd8, 0x6, @broadcast}, 0x14) program crashed: WARNING in hugetlb_split testing program (duration=9m0s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): [2, 13] detailed listing: executing program 0: mmap(&(0x7f0000000000/0xff5000)=nil, 0xff5000, 0x1000002, 0x200000005c831, 0xffffffffffffffff, 0x0) remap_file_pages(&(0x7f0000800000/0x800000)=nil, 0x800000, 0x0, 0x600, 0x102020) executing program 7: sendmsg$nl_route_sched(0xffffffffffffffff, 0x0, 0x10) r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000200), 0x0, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000040)={'syzkaller0\x00', 0x2}) r1 = openat$tun(0xffffffffffffff9c, &(0x7f0000000400), 0x0, 0x0) close(r1) socket$nl_generic(0x10, 0x3, 0x10) ioctl$SIOCSIFHWADDR(r1, 0x8914, &(0x7f0000002280)={'syzkaller0\x00', @multicast}) r2 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r2, 0x8933, &(0x7f0000000100)={'syzkaller0\x00', 0x0}) sendmsg$nl_route_sched(r2, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000580)={&(0x7f0000000340)=@newqdisc={0x4c, 0x24, 0x4ee4e6a52ff56541, 0x70bd25, 0x25dfdbfd, {0x0, 0x0, 0x0, r3, {0x0, 0xb}, {0xffff, 0xffff}, {0xfff2}}, [@qdisc_kind_options=@q_netem={{0xa}, {0x1c, 0x2, {{0x3, 0x3, 0x4361, 0x7, 0xffffffff, 0x3}}}}]}, 0x4c}, 0x1, 0x0, 0x0, 0x8000}, 0x0) sendmsg$nl_route_sched(r2, &(0x7f00000003c0)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000440)=@newqdisc={0x44, 0x24, 0x4ee4e6a52ff56541, 0x70b927, 0x25dfdbfc, {0x0, 0x0, 0x0, r3, {0x0, 0xd}, {0x6, 0xb}, {0xb, 0x2}}, [@qdisc_kind_options=@q_cake={{0x9}, {0x14, 0x2, [@TCA_CAKE_AUTORATE={0x8, 0x9, 0x6}, @TCA_CAKE_MEMORY={0x8, 0xa, 0x5}]}}]}, 0x44}, 0x1, 0x0, 0x0, 0x240040e0}, 0x4890) r4 = socket$packet(0x11, 0x3, 0x300) sendto$packet(r4, &(0x7f0000000240)="800000800000210ee7decd7a000340", 0xf, 0x40, &(0x7f00000001c0)={0x11, 0x8100, r3, 0x1, 0xd8, 0x6, @broadcast}, 0x14) program crashed: WARNING in hugetlb_split testing program (duration=9m0s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): [1, 13] detailed listing: executing program 0: remap_file_pages(&(0x7f0000800000/0x800000)=nil, 0x800000, 0x0, 0x600, 0x102020) executing program 7: sendmsg$nl_route_sched(0xffffffffffffffff, 0x0, 0x10) r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000200), 0x0, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000040)={'syzkaller0\x00', 0x2}) r1 = openat$tun(0xffffffffffffff9c, &(0x7f0000000400), 0x0, 0x0) close(r1) socket$nl_generic(0x10, 0x3, 0x10) ioctl$SIOCSIFHWADDR(r1, 0x8914, &(0x7f0000002280)={'syzkaller0\x00', @multicast}) r2 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r2, 0x8933, &(0x7f0000000100)={'syzkaller0\x00', 0x0}) sendmsg$nl_route_sched(r2, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000580)={&(0x7f0000000340)=@newqdisc={0x4c, 0x24, 0x4ee4e6a52ff56541, 0x70bd25, 0x25dfdbfd, {0x0, 0x0, 0x0, r3, {0x0, 0xb}, {0xffff, 0xffff}, {0xfff2}}, [@qdisc_kind_options=@q_netem={{0xa}, {0x1c, 0x2, {{0x3, 0x3, 0x4361, 0x7, 0xffffffff, 0x3}}}}]}, 0x4c}, 0x1, 0x0, 0x0, 0x8000}, 0x0) sendmsg$nl_route_sched(r2, &(0x7f00000003c0)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000440)=@newqdisc={0x44, 0x24, 0x4ee4e6a52ff56541, 0x70b927, 0x25dfdbfc, {0x0, 0x0, 0x0, r3, {0x0, 0xd}, {0x6, 0xb}, {0xb, 0x2}}, [@qdisc_kind_options=@q_cake={{0x9}, {0x14, 0x2, [@TCA_CAKE_AUTORATE={0x8, 0x9, 0x6}, @TCA_CAKE_MEMORY={0x8, 0xa, 0x5}]}}]}, 0x44}, 0x1, 0x0, 0x0, 0x240040e0}, 0x4890) r4 = socket$packet(0x11, 0x3, 0x300) sendto$packet(r4, &(0x7f0000000240)="800000800000210ee7decd7a000340", 0xf, 0x40, &(0x7f00000001c0)={0x11, 0x8100, r3, 0x1, 0xd8, 0x6, @broadcast}, 0x14) program did not crash minimized 4 calls -> 2 calls minimizing program #1 before concatenation testing program (duration=9m0s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): [2, 12] detailed listing: executing program 4: mmap(&(0x7f0000000000/0xff5000)=nil, 0xff5000, 0x1000002, 0x200000005c831, 0xffffffffffffffff, 0x0) remap_file_pages(&(0x7f0000800000/0x800000)=nil, 0x800000, 0x0, 0x600, 0x102020) executing program 0: sendmsg$nl_route_sched(0xffffffffffffffff, 0x0, 0x10) r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000200), 0x0, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000040)={'syzkaller0\x00', 0x2}) r1 = openat$tun(0xffffffffffffff9c, &(0x7f0000000400), 0x0, 0x0) close(r1) socket$nl_generic(0x10, 0x3, 0x10) ioctl$SIOCSIFHWADDR(r1, 0x8914, &(0x7f0000002280)={'syzkaller0\x00', @multicast}) r2 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r2, 0x8933, &(0x7f0000000100)={'syzkaller0\x00', 0x0}) sendmsg$nl_route_sched(r2, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000580)={&(0x7f0000000340)=@newqdisc={0x4c, 0x24, 0x4ee4e6a52ff56541, 0x70bd25, 0x25dfdbfd, {0x0, 0x0, 0x0, r3, {0x0, 0xb}, {0xffff, 0xffff}, {0xfff2}}, [@qdisc_kind_options=@q_netem={{0xa}, {0x1c, 0x2, {{0x3, 0x3, 0x4361, 0x7, 0xffffffff, 0x3}}}}]}, 0x4c}, 0x1, 0x0, 0x0, 0x8000}, 0x0) sendmsg$nl_route_sched(r2, &(0x7f00000003c0)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000440)=@newqdisc={0x44, 0x24, 0x4ee4e6a52ff56541, 0x70b927, 0x25dfdbfc, {0x0, 0x0, 0x0, r3, {0x0, 0xd}, {0x6, 0xb}, {0xb, 0x2}}, [@qdisc_kind_options=@q_cake={{0x9}, {0x14, 0x2, [@TCA_CAKE_AUTORATE={0x8, 0x9, 0x6}, @TCA_CAKE_MEMORY={0x8, 0xa, 0x5}]}}]}, 0x44}, 0x1, 0x0, 0x0, 0x240040e0}, 0x4890) socket$packet(0x11, 0x3, 0x300) program crashed: WARNING in hugetlb_split testing program (duration=9m0s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): [2, 11] detailed listing: executing program 4: mmap(&(0x7f0000000000/0xff5000)=nil, 0xff5000, 0x1000002, 0x200000005c831, 0xffffffffffffffff, 0x0) remap_file_pages(&(0x7f0000800000/0x800000)=nil, 0x800000, 0x0, 0x600, 0x102020) executing program 0: sendmsg$nl_route_sched(0xffffffffffffffff, 0x0, 0x10) r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000200), 0x0, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000040)={'syzkaller0\x00', 0x2}) r1 = openat$tun(0xffffffffffffff9c, &(0x7f0000000400), 0x0, 0x0) close(r1) socket$nl_generic(0x10, 0x3, 0x10) ioctl$SIOCSIFHWADDR(r1, 0x8914, &(0x7f0000002280)={'syzkaller0\x00', @multicast}) r2 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r2, 0x8933, &(0x7f0000000100)={'syzkaller0\x00', 0x0}) sendmsg$nl_route_sched(r2, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000580)={&(0x7f0000000340)=@newqdisc={0x4c, 0x24, 0x4ee4e6a52ff56541, 0x70bd25, 0x25dfdbfd, {0x0, 0x0, 0x0, r3, {0x0, 0xb}, {0xffff, 0xffff}, {0xfff2}}, [@qdisc_kind_options=@q_netem={{0xa}, {0x1c, 0x2, {{0x3, 0x3, 0x4361, 0x7, 0xffffffff, 0x3}}}}]}, 0x4c}, 0x1, 0x0, 0x0, 0x8000}, 0x0) sendmsg$nl_route_sched(r2, &(0x7f00000003c0)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000440)=@newqdisc={0x44, 0x24, 0x4ee4e6a52ff56541, 0x70b927, 0x25dfdbfc, {0x0, 0x0, 0x0, r3, {0x0, 0xd}, {0x6, 0xb}, {0xb, 0x2}}, [@qdisc_kind_options=@q_cake={{0x9}, {0x14, 0x2, [@TCA_CAKE_AUTORATE={0x8, 0x9, 0x6}, @TCA_CAKE_MEMORY={0x8, 0xa, 0x5}]}}]}, 0x44}, 0x1, 0x0, 0x0, 0x240040e0}, 0x4890) program crashed: WARNING in hugetlb_split testing program (duration=9m0s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): [2, 10] detailed listing: executing program 4: mmap(&(0x7f0000000000/0xff5000)=nil, 0xff5000, 0x1000002, 0x200000005c831, 0xffffffffffffffff, 0x0) remap_file_pages(&(0x7f0000800000/0x800000)=nil, 0x800000, 0x0, 0x600, 0x102020) executing program 0: sendmsg$nl_route_sched(0xffffffffffffffff, 0x0, 0x10) r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000200), 0x0, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000040)={'syzkaller0\x00', 0x2}) r1 = openat$tun(0xffffffffffffff9c, &(0x7f0000000400), 0x0, 0x0) close(r1) socket$nl_generic(0x10, 0x3, 0x10) ioctl$SIOCSIFHWADDR(r1, 0x8914, &(0x7f0000002280)={'syzkaller0\x00', @multicast}) r2 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r2, 0x8933, &(0x7f0000000100)={'syzkaller0\x00', 0x0}) sendmsg$nl_route_sched(r2, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000580)={&(0x7f0000000340)=@newqdisc={0x4c, 0x24, 0x4ee4e6a52ff56541, 0x70bd25, 0x25dfdbfd, {0x0, 0x0, 0x0, r3, {0x0, 0xb}, {0xffff, 0xffff}, {0xfff2}}, [@qdisc_kind_options=@q_netem={{0xa}, {0x1c, 0x2, {{0x3, 0x3, 0x4361, 0x7, 0xffffffff, 0x3}}}}]}, 0x4c}, 0x1, 0x0, 0x0, 0x8000}, 0x0) program crashed: WARNING in hugetlb_split testing program (duration=9m0s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): [2, 9] detailed listing: executing program 4: mmap(&(0x7f0000000000/0xff5000)=nil, 0xff5000, 0x1000002, 0x200000005c831, 0xffffffffffffffff, 0x0) remap_file_pages(&(0x7f0000800000/0x800000)=nil, 0x800000, 0x0, 0x600, 0x102020) executing program 0: sendmsg$nl_route_sched(0xffffffffffffffff, 0x0, 0x10) r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000200), 0x0, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000040)={'syzkaller0\x00', 0x2}) r1 = openat$tun(0xffffffffffffff9c, &(0x7f0000000400), 0x0, 0x0) close(r1) socket$nl_generic(0x10, 0x3, 0x10) ioctl$SIOCSIFHWADDR(r1, 0x8914, &(0x7f0000002280)={'syzkaller0\x00', @multicast}) r2 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r2, 0x8933, &(0x7f0000000100)={'syzkaller0\x00'}) program crashed: WARNING in hugetlb_split testing program (duration=9m0s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): [2, 8] detailed listing: executing program 4: mmap(&(0x7f0000000000/0xff5000)=nil, 0xff5000, 0x1000002, 0x200000005c831, 0xffffffffffffffff, 0x0) remap_file_pages(&(0x7f0000800000/0x800000)=nil, 0x800000, 0x0, 0x600, 0x102020) executing program 0: sendmsg$nl_route_sched(0xffffffffffffffff, 0x0, 0x10) r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000200), 0x0, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000040)={'syzkaller0\x00', 0x2}) r1 = openat$tun(0xffffffffffffff9c, &(0x7f0000000400), 0x0, 0x0) close(r1) socket$nl_generic(0x10, 0x3, 0x10) ioctl$SIOCSIFHWADDR(r1, 0x8914, &(0x7f0000002280)={'syzkaller0\x00', @multicast}) socket$nl_route(0x10, 0x3, 0x0) program crashed: WARNING in hugetlb_split testing program (duration=9m0s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): [2, 7] detailed listing: executing program 4: mmap(&(0x7f0000000000/0xff5000)=nil, 0xff5000, 0x1000002, 0x200000005c831, 0xffffffffffffffff, 0x0) remap_file_pages(&(0x7f0000800000/0x800000)=nil, 0x800000, 0x0, 0x600, 0x102020) executing program 0: sendmsg$nl_route_sched(0xffffffffffffffff, 0x0, 0x10) r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000200), 0x0, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000040)={'syzkaller0\x00', 0x2}) r1 = openat$tun(0xffffffffffffff9c, &(0x7f0000000400), 0x0, 0x0) close(r1) socket$nl_generic(0x10, 0x3, 0x10) ioctl$SIOCSIFHWADDR(r1, 0x8914, &(0x7f0000002280)={'syzkaller0\x00', @multicast}) program crashed: WARNING in hugetlb_split testing program (duration=9m0s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): [2, 6] detailed listing: executing program 4: mmap(&(0x7f0000000000/0xff5000)=nil, 0xff5000, 0x1000002, 0x200000005c831, 0xffffffffffffffff, 0x0) remap_file_pages(&(0x7f0000800000/0x800000)=nil, 0x800000, 0x0, 0x600, 0x102020) executing program 0: sendmsg$nl_route_sched(0xffffffffffffffff, 0x0, 0x10) r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000200), 0x0, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000040)={'syzkaller0\x00', 0x2}) r1 = openat$tun(0xffffffffffffff9c, &(0x7f0000000400), 0x0, 0x0) close(r1) socket$nl_generic(0x10, 0x3, 0x10) program crashed: WARNING in hugetlb_split testing program (duration=9m0s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): [2, 5] detailed listing: executing program 4: mmap(&(0x7f0000000000/0xff5000)=nil, 0xff5000, 0x1000002, 0x200000005c831, 0xffffffffffffffff, 0x0) remap_file_pages(&(0x7f0000800000/0x800000)=nil, 0x800000, 0x0, 0x600, 0x102020) executing program 0: sendmsg$nl_route_sched(0xffffffffffffffff, 0x0, 0x10) r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000200), 0x0, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000040)={'syzkaller0\x00', 0x2}) r1 = openat$tun(0xffffffffffffff9c, &(0x7f0000000400), 0x0, 0x0) close(r1) program crashed: WARNING in hugetlb_split testing program (duration=9m0s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): [2, 4] detailed listing: executing program 4: mmap(&(0x7f0000000000/0xff5000)=nil, 0xff5000, 0x1000002, 0x200000005c831, 0xffffffffffffffff, 0x0) remap_file_pages(&(0x7f0000800000/0x800000)=nil, 0x800000, 0x0, 0x600, 0x102020) executing program 0: sendmsg$nl_route_sched(0xffffffffffffffff, 0x0, 0x10) r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000200), 0x0, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000040)={'syzkaller0\x00', 0x2}) openat$tun(0xffffffffffffff9c, &(0x7f0000000400), 0x0, 0x0) program crashed: WARNING in hugetlb_split testing program (duration=9m0s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): [2, 3] detailed listing: executing program 4: mmap(&(0x7f0000000000/0xff5000)=nil, 0xff5000, 0x1000002, 0x200000005c831, 0xffffffffffffffff, 0x0) remap_file_pages(&(0x7f0000800000/0x800000)=nil, 0x800000, 0x0, 0x600, 0x102020) executing program 0: sendmsg$nl_route_sched(0xffffffffffffffff, 0x0, 0x10) r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000200), 0x0, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000040)={'syzkaller0\x00', 0x2}) program crashed: WARNING in hugetlb_split testing program (duration=9m0s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): [2, 2] detailed listing: executing program 4: mmap(&(0x7f0000000000/0xff5000)=nil, 0xff5000, 0x1000002, 0x200000005c831, 0xffffffffffffffff, 0x0) remap_file_pages(&(0x7f0000800000/0x800000)=nil, 0x800000, 0x0, 0x600, 0x102020) executing program 0: sendmsg$nl_route_sched(0xffffffffffffffff, 0x0, 0x10) openat$tun(0xffffffffffffff9c, &(0x7f0000000200), 0x0, 0x0) program crashed: WARNING in hugetlb_split testing program (duration=9m0s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): [2, 1] detailed listing: executing program 4: mmap(&(0x7f0000000000/0xff5000)=nil, 0xff5000, 0x1000002, 0x200000005c831, 0xffffffffffffffff, 0x0) remap_file_pages(&(0x7f0000800000/0x800000)=nil, 0x800000, 0x0, 0x600, 0x102020) executing program 0: sendmsg$nl_route_sched(0xffffffffffffffff, 0x0, 0x10) program crashed: WARNING in hugetlb_split testing program (duration=9m0s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): [2, 0] detailed listing: executing program 4: mmap(&(0x7f0000000000/0xff5000)=nil, 0xff5000, 0x1000002, 0x200000005c831, 0xffffffffffffffff, 0x0) remap_file_pages(&(0x7f0000800000/0x800000)=nil, 0x800000, 0x0, 0x600, 0x102020) executing program 0: program crashed: WARNING in hugetlb_split minimized 13 calls -> 0 calls testing program (duration=9m0s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): mmap-remap_file_pages detailed listing: executing program 0: mmap(&(0x7f0000000000/0xff5000)=nil, 0xff5000, 0x1000002, 0x200000005c831, 0xffffffffffffffff, 0x0) remap_file_pages(&(0x7f0000800000/0x800000)=nil, 0x800000, 0x0, 0x600, 0x102020) program crashed: WARNING in hugetlb_split bisect: concatenation succeeded found reproducer with 2 syscalls minimizing guilty program testing program (duration=1m18.326327716s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): mmap detailed listing: executing program 0: mmap(&(0x7f0000000000/0xff5000)=nil, 0xff5000, 0x1000002, 0x200000005c831, 0xffffffffffffffff, 0x0) program did not crash testing program (duration=1m18.326327716s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): remap_file_pages detailed listing: executing program 0: remap_file_pages(&(0x7f0000800000/0x800000)=nil, 0x800000, 0x0, 0x600, 0x102020) program did not crash extracting C reproducer testing compiled C program (duration=1m18.326327716s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): mmap-remap_file_pages program crashed: WARNING in hugetlb_split simplifying C reproducer testing compiled C program (duration=1m18.326327716s, {Threaded:false Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): mmap-remap_file_pages program crashed: WARNING in hugetlb_split testing compiled C program (duration=1m18.326327716s, {Threaded:false Repeat:true RepeatTimes:0 Procs:1 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): mmap-remap_file_pages program crashed: WARNING in hugetlb_split testing compiled C program (duration=1m18.326327716s, {Threaded:false Repeat:true RepeatTimes:0 Procs:1 Slowdown:1 Sandbox: SandboxArg:0 Leak:false NetInjection:false NetDevices:false NetReset:false Cgroups:false BinfmtMisc:false CloseFDs:false KCSAN:false DevlinkPCI:false NicVF:false USB:false VhciInjection:false Wifi:false IEEE802154:true Sysctl:true Swap:false UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): mmap-remap_file_pages program crashed: WARNING in hugetlb_split testing compiled C program (duration=1m18.326327716s, {Threaded:false Repeat:true RepeatTimes:0 Procs:1 Slowdown:1 Sandbox: SandboxArg:0 Leak:false NetInjection:false NetDevices:false NetReset:false Cgroups:false BinfmtMisc:false CloseFDs:false KCSAN:false DevlinkPCI:false NicVF:false USB:false VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:false UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): mmap-remap_file_pages program crashed: WARNING in hugetlb_split testing compiled C program (duration=1m18.326327716s, {Threaded:false Repeat:true RepeatTimes:0 Procs:1 Slowdown:1 Sandbox: SandboxArg:0 Leak:false NetInjection:false NetDevices:false NetReset:false Cgroups:false BinfmtMisc:false CloseFDs:false KCSAN:false DevlinkPCI:false NicVF:false USB:false VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:false UseTmpDir:false HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): mmap-remap_file_pages program crashed: WARNING in hugetlb_split testing compiled C program (duration=1m18.326327716s, {Threaded:false Repeat:true RepeatTimes:0 Procs:1 Slowdown:1 Sandbox: SandboxArg:0 Leak:false NetInjection:false NetDevices:false NetReset:false Cgroups:false BinfmtMisc:false CloseFDs:false KCSAN:false DevlinkPCI:false NicVF:false USB:false VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:false UseTmpDir:false HandleSegv:false Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): mmap-remap_file_pages program crashed: WARNING in hugetlb_split testing compiled C program (duration=1m18.326327716s, {Threaded:false Repeat:true RepeatTimes:0 Procs:1 Slowdown:1 Sandbox: SandboxArg:0 Leak:false NetInjection:false NetDevices:false NetReset:false Cgroups:false BinfmtMisc:false CloseFDs:false KCSAN:false DevlinkPCI:false NicVF:false USB:false VhciInjection:false Wifi:false IEEE802154:false Sysctl:false Swap:false UseTmpDir:false HandleSegv:false Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): mmap-remap_file_pages program crashed: WARNING in hugetlb_split testing program (duration=1m18.326327716s, {Threaded:false Repeat:true RepeatTimes:0 Procs:1 Slowdown:1 Sandbox: SandboxArg:0 Leak:false NetInjection:false NetDevices:false NetReset:false Cgroups:false BinfmtMisc:false CloseFDs:false KCSAN:false DevlinkPCI:false NicVF:false USB:false VhciInjection:false Wifi:false IEEE802154:false Sysctl:false Swap:false UseTmpDir:false HandleSegv:false Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): mmap-remap_file_pages detailed listing: executing program 0: mmap(&(0x7f0000000000/0xff5000)=nil, 0xff5000, 0x1000002, 0x200000005c831, 0xffffffffffffffff, 0x0) remap_file_pages(&(0x7f0000800000/0x800000)=nil, 0x800000, 0x0, 0x600, 0x102020) program crashed: WARNING in hugetlb_split validation run: crashed=true testing program (duration=1m18.326327716s, {Threaded:false Repeat:true RepeatTimes:0 Procs:1 Slowdown:1 Sandbox: SandboxArg:0 Leak:false NetInjection:false NetDevices:false NetReset:false Cgroups:false BinfmtMisc:false CloseFDs:false KCSAN:false DevlinkPCI:false NicVF:false USB:false VhciInjection:false Wifi:false IEEE802154:false Sysctl:false Swap:false UseTmpDir:false HandleSegv:false Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): mmap-remap_file_pages detailed listing: executing program 0: mmap(&(0x7f0000000000/0xff5000)=nil, 0xff5000, 0x1000002, 0x200000005c831, 0xffffffffffffffff, 0x0) remap_file_pages(&(0x7f0000800000/0x800000)=nil, 0x800000, 0x0, 0x600, 0x102020) program crashed: WARNING in hugetlb_split validation run: crashed=true testing program (duration=1m18.326327716s, {Threaded:false Repeat:true RepeatTimes:0 Procs:1 Slowdown:1 Sandbox: SandboxArg:0 Leak:false NetInjection:false NetDevices:false NetReset:false Cgroups:false BinfmtMisc:false CloseFDs:false KCSAN:false DevlinkPCI:false NicVF:false USB:false VhciInjection:false Wifi:false IEEE802154:false Sysctl:false Swap:false UseTmpDir:false HandleSegv:false Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): mmap-remap_file_pages detailed listing: executing program 0: mmap(&(0x7f0000000000/0xff5000)=nil, 0xff5000, 0x1000002, 0x200000005c831, 0xffffffffffffffff, 0x0) remap_file_pages(&(0x7f0000800000/0x800000)=nil, 0x800000, 0x0, 0x600, 0x102020) program crashed: WARNING in hugetlb_split validation run: crashed=true reproducing took 1h24m25.324943969s repro crashed as (corrupted=false): mmap: syz.0.17 (4488) uses deprecated remap_file_pages() syscall. See Documentation/mm/remap_file_pages.rst. ------------[ cut here ]------------ WARNING: CPU: 0 PID: 4488 at include/linux/fs.h:503 i_mmap_assert_write_locked include/linux/fs.h:503 [inline] WARNING: CPU: 0 PID: 4488 at include/linux/fs.h:503 hugetlb_split+0x234/0x29c mm/hugetlb.c:4920 Modules linked in: CPU: 0 PID: 4488 Comm: syz.0.17 Not tainted syzkaller #0 Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 03/18/2026 pstate: 82400005 (Nzcv daif +PAN -UAO +TCO -DIT -SSBS BTYPE=--) pc : i_mmap_assert_write_locked include/linux/fs.h:503 [inline] pc : hugetlb_split+0x234/0x29c mm/hugetlb.c:4920 lr : i_mmap_assert_write_locked include/linux/fs.h:503 [inline] lr : hugetlb_split+0x234/0x29c mm/hugetlb.c:4920 sp : ffff8000215573d0 x29: ffff8000215573d0 x28: dfff800000000000 x27: 0000000020800000 x26: ffff0000da1b2948 x25: ffff800015220000 x24: 1ffff00002a44070 x23: dfff800000000000 x22: 0000000000000001 x21: 0000000000000000 x20: 0000000020000000 x19: ffff0000da1b2948 x18: ffff800011b9bf60 x17: ffff8000087fc9ec x16: ffff8000082d7db8 x15: 0000000000000000 x14: 0000000000000001 x13: 1fffe0001aa8701b x12: 0000000000ff0100 x11: ff00800008897c90 x10: 0000000000000000 x9 : ffff800008897c90 x8 : ffff0000d2deb780 x7 : 0000000000000000 x6 : 000000000000003f x5 : 0000000000000040 x4 : 0000000000000000 x3 : ffff800008897b10 x2 : 0000000000000000 x1 : 0000000000000000 x0 : 0000000000000000 Call trace: i_mmap_assert_write_locked include/linux/fs.h:503 [inline] hugetlb_split+0x234/0x29c mm/hugetlb.c:4920 __vma_adjust+0x3a0/0x1724 mm/mmap.c:737 vma_adjust include/linux/mm.h:2810 [inline] __split_vma+0x324/0x444 mm/mmap.c:-1 do_mas_align_munmap+0x2ec/0xf38 mm/mmap.c:2480 do_mas_munmap mm/mmap.c:2650 [inline] __mmap_region mm/mmap.c:2698 [inline] mmap_region+0x780/0x1900 mm/mmap.c:2916 do_mmap+0x9cc/0x1138 mm/mmap.c:1436 __do_sys_remap_file_pages mm/mmap.c:3039 [inline] __se_sys_remap_file_pages mm/mmap.c:2968 [inline] __arm64_sys_remap_file_pages+0x4c4/0x64c mm/mmap.c:2968 __invoke_syscall arch/arm64/kernel/syscall.c:38 [inline] invoke_syscall+0x98/0x2b4 arch/arm64/kernel/syscall.c:52 el0_svc_common+0x138/0x258 arch/arm64/kernel/syscall.c:140 do_el0_svc+0x58/0x130 arch/arm64/kernel/syscall.c:204 el0_svc+0x58/0x128 arch/arm64/kernel/entry-common.c:637 el0t_64_sync_handler+0x84/0xf0 arch/arm64/kernel/entry-common.c:655 el0t_64_sync+0x18c/0x190 arch/arm64/kernel/entry.S:585 irq event stamp: 1622 hardirqs last enabled at (1621): [] __raw_spin_unlock_irqrestore include/linux/spinlock_api_smp.h:151 [inline] hardirqs last enabled at (1621): [] _raw_spin_unlock_irqrestore+0x48/0xac kernel/locking/spinlock.c:194 hardirqs last disabled at (1622): [] el1_dbg+0x24/0x80 arch/arm64/kernel/entry-common.c:405 softirqs last enabled at (1570): [] local_bh_enable+0x10/0x34 include/linux/bottom_half.h:32 softirqs last disabled at (1568): [] local_bh_disable+0x10/0x34 include/linux/bottom_half.h:19 ---[ end trace 0000000000000000 ]--- ------------[ cut here ]------------ WARNING: CPU: 1 PID: 4488 at include/linux/fs.h:503 i_mmap_assert_write_locked include/linux/fs.h:503 [inline] WARNING: CPU: 1 PID: 4488 at include/linux/fs.h:503 hugetlb_split+0x234/0x29c mm/hugetlb.c:4920 Modules linked in: CPU: 1 PID: 4488 Comm: syz.0.17 Tainted: G W syzkaller #0 Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 03/18/2026 pstate: 82400005 (Nzcv daif +PAN -UAO +TCO -DIT -SSBS BTYPE=--) pc : i_mmap_assert_write_locked include/linux/fs.h:503 [inline] pc : hugetlb_split+0x234/0x29c mm/hugetlb.c:4920 lr : i_mmap_assert_write_locked include/linux/fs.h:503 [inline] lr : hugetlb_split+0x234/0x29c mm/hugetlb.c:4920 sp : ffff8000215573d0 x29: ffff8000215573d0 x28: dfff800000000000 x27: 0000000020800000 x26: ffff0000da1b2948 x25: ffff800015220000 x24: 1ffff00002a44070 x23: dfff800000000000 x22: 0000000000000001 x21: 0000000000000000 x20: 0000000020800000 x19: ffff0000da1b2948 x18: ffff800011b9bf60 x17: ffff8000087fc9ec x16: ffff8000082d7db8 x15: 0000000000000000 x14: 0000000000000001 x13: 1fffe0001aa8701b x12: 0000000000ff0100 x11: ff00800008897c90 x10: 0000000000000000 x9 : ffff800008897c90 x8 : ffff0000d2deb780 x7 : 0000000000000000 x6 : 000000000000003f x5 : 0000000000000040 x4 : 0000000000000000 x3 : ffff800008897b10 x2 : 0000000000000000 x1 : 0000000000000000 x0 : 0000000000000000 Call trace: i_mmap_assert_write_locked include/linux/fs.h:503 [inline] hugetlb_split+0x234/0x29c mm/hugetlb.c:4920 __vma_adjust+0x3ac/0x1724 mm/mmap.c:738 vma_adjust include/linux/mm.h:2810 [inline] __split_vma+0x324/0x444 mm/mmap.c:-1 do_mas_align_munmap+0x2ec/0xf38 mm/mmap.c:2480 do_mas_munmap mm/mmap.c:2650 [inline] __mmap_region mm/mmap.c:2698 [inline] mmap_region+0x780/0x1900 mm/mmap.c:2916 do_mmap+0x9cc/0x1138 mm/mmap.c:1436 __do_sys_remap_file_pages mm/mmap.c:3039 [inline] __se_sys_remap_file_pages mm/mmap.c:2968 [inline] __arm64_sys_remap_file_pages+0x4c4/0x64c mm/mmap.c:2968 __invoke_syscall arch/arm64/kernel/syscall.c:38 [inline] invoke_syscall+0x98/0x2b4 arch/arm64/kernel/syscall.c:52 el0_svc_common+0x138/0x258 arch/arm64/kernel/syscall.c:140 do_el0_svc+0x58/0x130 arch/arm64/kernel/syscall.c:204 el0_svc+0x58/0x128 arch/arm64/kernel/entry-common.c:637 el0t_64_sync_handler+0x84/0xf0 arch/arm64/kernel/entry-common.c:655 el0t_64_sync+0x18c/0x190 arch/arm64/kernel/entry.S:585 irq event stamp: 1684 hardirqs last enabled at (1683): [] __exit_to_kernel_mode arch/arm64/kernel/entry-common.c:84 [inline] hardirqs last enabled at (1683): [] exit_to_kernel_mode+0xcc/0xfc arch/arm64/kernel/entry-common.c:94 hardirqs last disabled at (1684): [] el1_dbg+0x24/0x80 arch/arm64/kernel/entry-common.c:405 softirqs last enabled at (1678): [] softirq_handle_end kernel/softirq.c:439 [inline] softirqs last enabled at (1678): [] handle_softirqs+0xaec/0xc60 kernel/softirq.c:624 softirqs last disabled at (1625): [] __do_softirq+0x14/0x20 kernel/softirq.c:630 ---[ end trace 0000000000000000 ]--- final repro crashed as (corrupted=false): mmap: syz.0.17 (4488) uses deprecated remap_file_pages() syscall. See Documentation/mm/remap_file_pages.rst. ------------[ cut here ]------------ WARNING: CPU: 0 PID: 4488 at include/linux/fs.h:503 i_mmap_assert_write_locked include/linux/fs.h:503 [inline] WARNING: CPU: 0 PID: 4488 at include/linux/fs.h:503 hugetlb_split+0x234/0x29c mm/hugetlb.c:4920 Modules linked in: CPU: 0 PID: 4488 Comm: syz.0.17 Not tainted syzkaller #0 Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 03/18/2026 pstate: 82400005 (Nzcv daif +PAN -UAO +TCO -DIT -SSBS BTYPE=--) pc : i_mmap_assert_write_locked include/linux/fs.h:503 [inline] pc : hugetlb_split+0x234/0x29c mm/hugetlb.c:4920 lr : i_mmap_assert_write_locked include/linux/fs.h:503 [inline] lr : hugetlb_split+0x234/0x29c mm/hugetlb.c:4920 sp : ffff8000215573d0 x29: ffff8000215573d0 x28: dfff800000000000 x27: 0000000020800000 x26: ffff0000da1b2948 x25: ffff800015220000 x24: 1ffff00002a44070 x23: dfff800000000000 x22: 0000000000000001 x21: 0000000000000000 x20: 0000000020000000 x19: ffff0000da1b2948 x18: ffff800011b9bf60 x17: ffff8000087fc9ec x16: ffff8000082d7db8 x15: 0000000000000000 x14: 0000000000000001 x13: 1fffe0001aa8701b x12: 0000000000ff0100 x11: ff00800008897c90 x10: 0000000000000000 x9 : ffff800008897c90 x8 : ffff0000d2deb780 x7 : 0000000000000000 x6 : 000000000000003f x5 : 0000000000000040 x4 : 0000000000000000 x3 : ffff800008897b10 x2 : 0000000000000000 x1 : 0000000000000000 x0 : 0000000000000000 Call trace: i_mmap_assert_write_locked include/linux/fs.h:503 [inline] hugetlb_split+0x234/0x29c mm/hugetlb.c:4920 __vma_adjust+0x3a0/0x1724 mm/mmap.c:737 vma_adjust include/linux/mm.h:2810 [inline] __split_vma+0x324/0x444 mm/mmap.c:-1 do_mas_align_munmap+0x2ec/0xf38 mm/mmap.c:2480 do_mas_munmap mm/mmap.c:2650 [inline] __mmap_region mm/mmap.c:2698 [inline] mmap_region+0x780/0x1900 mm/mmap.c:2916 do_mmap+0x9cc/0x1138 mm/mmap.c:1436 __do_sys_remap_file_pages mm/mmap.c:3039 [inline] __se_sys_remap_file_pages mm/mmap.c:2968 [inline] __arm64_sys_remap_file_pages+0x4c4/0x64c mm/mmap.c:2968 __invoke_syscall arch/arm64/kernel/syscall.c:38 [inline] invoke_syscall+0x98/0x2b4 arch/arm64/kernel/syscall.c:52 el0_svc_common+0x138/0x258 arch/arm64/kernel/syscall.c:140 do_el0_svc+0x58/0x130 arch/arm64/kernel/syscall.c:204 el0_svc+0x58/0x128 arch/arm64/kernel/entry-common.c:637 el0t_64_sync_handler+0x84/0xf0 arch/arm64/kernel/entry-common.c:655 el0t_64_sync+0x18c/0x190 arch/arm64/kernel/entry.S:585 irq event stamp: 1622 hardirqs last enabled at (1621): [] __raw_spin_unlock_irqrestore include/linux/spinlock_api_smp.h:151 [inline] hardirqs last enabled at (1621): [] _raw_spin_unlock_irqrestore+0x48/0xac kernel/locking/spinlock.c:194 hardirqs last disabled at (1622): [] el1_dbg+0x24/0x80 arch/arm64/kernel/entry-common.c:405 softirqs last enabled at (1570): [] local_bh_enable+0x10/0x34 include/linux/bottom_half.h:32 softirqs last disabled at (1568): [] local_bh_disable+0x10/0x34 include/linux/bottom_half.h:19 ---[ end trace 0000000000000000 ]--- ------------[ cut here ]------------ WARNING: CPU: 1 PID: 4488 at include/linux/fs.h:503 i_mmap_assert_write_locked include/linux/fs.h:503 [inline] WARNING: CPU: 1 PID: 4488 at include/linux/fs.h:503 hugetlb_split+0x234/0x29c mm/hugetlb.c:4920 Modules linked in: CPU: 1 PID: 4488 Comm: syz.0.17 Tainted: G W syzkaller #0 Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 03/18/2026 pstate: 82400005 (Nzcv daif +PAN -UAO +TCO -DIT -SSBS BTYPE=--) pc : i_mmap_assert_write_locked include/linux/fs.h:503 [inline] pc : hugetlb_split+0x234/0x29c mm/hugetlb.c:4920 lr : i_mmap_assert_write_locked include/linux/fs.h:503 [inline] lr : hugetlb_split+0x234/0x29c mm/hugetlb.c:4920 sp : ffff8000215573d0 x29: ffff8000215573d0 x28: dfff800000000000 x27: 0000000020800000 x26: ffff0000da1b2948 x25: ffff800015220000 x24: 1ffff00002a44070 x23: dfff800000000000 x22: 0000000000000001 x21: 0000000000000000 x20: 0000000020800000 x19: ffff0000da1b2948 x18: ffff800011b9bf60 x17: ffff8000087fc9ec x16: ffff8000082d7db8 x15: 0000000000000000 x14: 0000000000000001 x13: 1fffe0001aa8701b x12: 0000000000ff0100 x11: ff00800008897c90 x10: 0000000000000000 x9 : ffff800008897c90 x8 : ffff0000d2deb780 x7 : 0000000000000000 x6 : 000000000000003f x5 : 0000000000000040 x4 : 0000000000000000 x3 : ffff800008897b10 x2 : 0000000000000000 x1 : 0000000000000000 x0 : 0000000000000000 Call trace: i_mmap_assert_write_locked include/linux/fs.h:503 [inline] hugetlb_split+0x234/0x29c mm/hugetlb.c:4920 __vma_adjust+0x3ac/0x1724 mm/mmap.c:738 vma_adjust include/linux/mm.h:2810 [inline] __split_vma+0x324/0x444 mm/mmap.c:-1 do_mas_align_munmap+0x2ec/0xf38 mm/mmap.c:2480 do_mas_munmap mm/mmap.c:2650 [inline] __mmap_region mm/mmap.c:2698 [inline] mmap_region+0x780/0x1900 mm/mmap.c:2916 do_mmap+0x9cc/0x1138 mm/mmap.c:1436 __do_sys_remap_file_pages mm/mmap.c:3039 [inline] __se_sys_remap_file_pages mm/mmap.c:2968 [inline] __arm64_sys_remap_file_pages+0x4c4/0x64c mm/mmap.c:2968 __invoke_syscall arch/arm64/kernel/syscall.c:38 [inline] invoke_syscall+0x98/0x2b4 arch/arm64/kernel/syscall.c:52 el0_svc_common+0x138/0x258 arch/arm64/kernel/syscall.c:140 do_el0_svc+0x58/0x130 arch/arm64/kernel/syscall.c:204 el0_svc+0x58/0x128 arch/arm64/kernel/entry-common.c:637 el0t_64_sync_handler+0x84/0xf0 arch/arm64/kernel/entry-common.c:655 el0t_64_sync+0x18c/0x190 arch/arm64/kernel/entry.S:585 irq event stamp: 1684 hardirqs last enabled at (1683): [] __exit_to_kernel_mode arch/arm64/kernel/entry-common.c:84 [inline] hardirqs last enabled at (1683): [] exit_to_kernel_mode+0xcc/0xfc arch/arm64/kernel/entry-common.c:94 hardirqs last disabled at (1684): [] el1_dbg+0x24/0x80 arch/arm64/kernel/entry-common.c:405 softirqs last enabled at (1678): [] softirq_handle_end kernel/softirq.c:439 [inline] softirqs last enabled at (1678): [] handle_softirqs+0xaec/0xc60 kernel/softirq.c:624 softirqs last disabled at (1625): [] __do_softirq+0x14/0x20 kernel/softirq.c:630 ---[ end trace 0000000000000000 ]---