Extracting prog: 7m17.99534799s Minimizing prog: 1h33m28.155067857s Simplifying prog options: 0s Extracting C: 1m9.978123049s Simplifying C: 16m11.458954935s extracting reproducer from 37 programs first checking the prog from the crash report single: executing 1 programs separately with timeout 30s testing program (duration=30s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): bpf$MAP_CREATE_TAIL_CALL-openat$cgroup_root-openat$cuse-write$cgroup_pid-prctl$PR_SCHED_CORE-prlimit64-sched_setaffinity-syz_open_dev$MSR-read$msr-write$cgroup_pid-syz_open_dev$usbfs-ioctl$USBDEVFS_ALLOW_SUSPEND-ioctl$USBDEVFS_CONTROL-getsockopt$IP_VS_SO_GET_DAEMON-syz_init_net_socket$x25-sendmsg$NFT_BATCH-sendmsg$NFT_BATCH-getsockopt$X25_QBITINCL-add_key-socket$inet_tcp-setsockopt$inet_opts-openat$cgroup_ro-mmap-getsockopt$inet_opts-futex detailed listing: executing program 0: bpf$MAP_CREATE_TAIL_CALL(0x0, &(0x7f00000007c0)=ANY=[@ANYBLOB="0300000004000000040000000a00000000000000", @ANYRES32=0x0, @ANYBLOB='\x00'/20, @ANYRES32=0x0, @ANYRES32=0x0, @ANYBLOB="000000000000000000000000000000000000000000000000000000002488b2f9e74580af107c0e1d82e10ec48719c67c3a2c410e56c69d665be4d063622980f8cb451837ec40c83579dab92e8f84c849607fcefb8f68d30f5cef9a27821ae15259e0a5f3fde268d4d90d504f96fd259153f0a0e56e8348de69c712c4745807e57b8037dcc4948ce942ee622e67b803a7993e63813551380de1382064638f188d433efa8caab4bcf04b55d3a2778b35cf869574e55126edb0a866c8c2210811f626e123984c1578eea143687583ec9cd45399277cba"], 0x48) openat$cgroup_root(0xffffffffffffff9c, 0x0, 0x200002, 0x0) openat$cuse(0xffffffffffffff9c, 0x0, 0x2, 0x0) write$cgroup_pid(0xffffffffffffffff, &(0x7f0000000500), 0x3) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x400000bce) r0 = syz_open_dev$MSR(&(0x7f0000000300), 0x100040000, 0x0) read$msr(r0, &(0x7f0000019680)=""/102392, 0x18ff8) write$cgroup_pid(0xffffffffffffffff, &(0x7f00000001c0), 0x12) r1 = syz_open_dev$usbfs(&(0x7f0000000100), 0x206, 0x8401) ioctl$USBDEVFS_ALLOW_SUSPEND(r1, 0x5522) ioctl$USBDEVFS_CONTROL(r1, 0xc0185500, &(0x7f0000001380)={0x0, 0x10, 0xf109, 0x8, 0x0, 0x4, 0x0}) getsockopt$IP_VS_SO_GET_DAEMON(0xffffffffffffffff, 0x0, 0x487, &(0x7f0000000040), &(0x7f00000000c0)=0x30) r2 = syz_init_net_socket$x25(0x9, 0x5, 0x0) sendmsg$NFT_BATCH(0xffffffffffffffff, &(0x7f000000c2c0)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000340)=ANY=[@ANYBLOB="140000001000010000000000000000000000000a28000000000a0101000000005e1affd5020000000900010073797a300000000008000240000000032c000000030a01030000e6ff00000000020000000900010073797a30000000000900030073797a320000000014000000110001"], 0x7c}}, 0x0) sendmsg$NFT_BATCH(0xffffffffffffffff, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000540)=ANY=[@ANYBLOB="14005dd31000010000000000000000000200000a54000000060a0b04000000000000002800048024000180090001006d6574610000000014000280080002400000000e080003ff000000000900010073797a30000000000900020073797a3200000000140000001100010000000000000000000000000a0000bcd9392755d0553208396b1104bd0138b9d4dcc29076671bfcd406a184eee3783779b059bf3c1d3a573e716c57ed4ab238d496fa0d3fb51054a62d7055d068124ff4184e12a61862bc0120f727e9e5c7ae925054af63819ba5f79d772ba27895dc48a6796db8d6b142c81e1c43cc58e8cef58790fddf4278fde59f4d57d0f4cb44e9f041ba703fb942342396717badaae97c20475dabfd374400"/284], 0x7c}}, 0x0) getsockopt$X25_QBITINCL(r2, 0x106, 0x1, 0x0, &(0x7f0000000240)=0xfffffffffffffee0) add_key(&(0x7f0000000140)='encrypted\x00', &(0x7f0000000180), &(0x7f0000000100), 0xca, 0xfffffffffffffffe) r3 = socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$inet_opts(r3, 0x0, 0x80000000000008, &(0x7f0000000280)="0f", 0x1) r4 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000040)='cpuacct.usage_sys\x00', 0x275a, 0x0) mmap(&(0x7f0000000000/0x400000)=nil, 0x400000, 0x1, 0x10012, r4, 0x0) getsockopt$inet_opts(r3, 0x0, 0x9, &(0x7f0000000200)=""/49, &(0x7f0000000080)=0x31) futex(&(0x7f0000000000), 0x9, 0x2, 0x0, &(0x7f0000000340)=0x2, 0x0) program did not crash single: failed to extract reproducer bisect: bisecting 37 programs with base timeout 30s testing program (duration=39s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): [4, 25, 8, 6, 28, 6, 6, 11, 22, 3, 17, 26, 23, 21, 11, 25, 19, 6, 26, 28, 9, 25, 11, 10, 16, 5, 28, 26, 6, 19, 2, 25, 28, 13, 11, 23, 21] detailed listing: executing program 3: r0 = ioctl$KVM_CREATE_VM(0xffffffffffffffff, 0xae01, 0x0) r1 = ioctl$KVM_CREATE_VCPU(r0, 0xae41, 0x1) syz_kvm_setup_cpu$x86(r0, r1, &(0x7f0000fe3000/0x18000)=nil, &(0x7f0000000080)=[@textreal={0x8, 0x0}], 0x1, 0x0, 0x0, 0x0) ioctl$KVM_CAP_ENFORCE_PV_FEATURE_CPUID(r1, 0x4068aea3, &(0x7f0000000000)={0xbe, 0x0, 0x1}) executing program 3: r0 = socket$nl_route(0x10, 0x3, 0x0) r1 = syz_io_uring_setup(0x4265, 0x0, &(0x7f00000000c0), &(0x7f0000000100)) syz_io_uring_setup(0x6dc8, &(0x7f00000001c0)={0x0, 0x314f, 0x40, 0x3, 0x281, 0x0, r1}, 0x0, &(0x7f0000000300)) sendmsg$nl_route(r0, &(0x7f00000018c0)={0x0, 0x0, &(0x7f0000000180)={0x0, 0x30}}, 0x0) r2 = openat$binfmt_register(0xffffffffffffff9c, &(0x7f00000024c0), 0x1, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000080)=0x7) r3 = getpid() sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x2) sched_setscheduler(r3, 0x2, &(0x7f0000000200)=0x4) r4 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000200)={0x18, 0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x2, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0x0, @void, @value}, 0x94) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000080)={&(0x7f0000000000)='sched_switch\x00', r4}, 0x10) r5 = syz_open_dev$MSR(&(0x7f00000001c0), 0x0, 0x0) read$msr(r5, &(0x7f0000019680)=""/102392, 0x18ff8) sched_setaffinity(0x0, 0xfffffef7, &(0x7f0000000740)=0x410000002) ioctl$FS_IOC_GET_ENCRYPTION_PWSALT(0xffffffffffffffff, 0x80041285, 0x0) r6 = syz_open_dev$tty20(0xc, 0x4, 0x0) ioctl$TCFLSH(r6, 0x5608, 0x1) ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, 0x0) write$binfmt_register(r2, &(0x7f0000002500)={0x3a, 'syz3', 0x3a, 'E', 0x3a, 0x1, 0x3a, '@&', 0x3a, 'flock=strict', 0x3a, './file0'}, 0x35) bpf$PROG_LOAD(0x5, &(0x7f0000000240)={0x12, 0x4, &(0x7f0000000440)=ANY=[], 0x0, 0x7, 0x0, 0x0, 0x40f00, 0x0, '\x00', 0x0, @cgroup_sock_addr=0xb, 0xffffffffffffffff, 0xf00, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0x0, @void, @value}, 0x94) r7 = socket(0x1e, 0x4, 0x0) setsockopt$sock_timeval(r7, 0x1, 0x42, &(0x7f0000000040)={0x0, 0x2710}, 0x10) r8 = syz_open_dev$tty1(0xc, 0x4, 0x1) dup(r8) executing program 3: open(&(0x7f0000000140)='./file1\x00', 0x60142, 0x0) r0 = openat$fuse(0xffffffffffffff9c, &(0x7f00000001c0), 0x2, 0x0) mount$fuse(0x0, &(0x7f0000000100)='./file1\x00', &(0x7f0000000140), 0x2, &(0x7f0000002380)={{'fd', 0x3d, r0}, 0x2c, {'rootmode', 0x3d, 0x8000}}) open(&(0x7f00000000c0)='./file1\x00', 0x0, 0x0) write$FUSE_INIT(r0, &(0x7f0000002300)={0x50, 0x0, 0x0, {0x7, 0x9, 0x0, 0x1030002}}, 0x50) read$FUSE(r0, &(0x7f00000065c0)={0x2020, 0x0, 0x0}, 0x2020) write$FUSE_INTERRUPT(r0, &(0x7f0000002240)={0x10, 0xffffffffffffffda, r1}, 0x10) creat(&(0x7f0000000100)='./file1\x00', 0x0) executing program 3: mkdirat(0xffffffffffffff9c, &(0x7f00000000c0)='./file0\x00', 0x0) mount$bind(&(0x7f00000002c0)='.\x00', &(0x7f0000000200)='./file0/../file0\x00', 0x0, 0x101091, 0x0) mount$bind(0x0, 0x0, 0x0, 0x100000, 0x0) mount$bind(&(0x7f0000000300)='./file0/file0\x00', &(0x7f0000000340)='./file0/file0\x00', 0x0, 0x9101a, 0x0) mount$bind(0x0, &(0x7f0000000240)='./file0/file0\x00', 0x0, 0x80000, 0x0) mount$bind(&(0x7f0000000080)='./file0/file0\x00', &(0x7f00000001c0)='./file0/../file0\x00', 0x0, 0x3041008, 0x0) executing program 3: r0 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000300)={0x11, 0x5, &(0x7f00000002c0)=ANY=[@ANYBLOB="1805000000080000000000000064ffec850000007d00000004"], &(0x7f0000000080)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x2, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0x0, @void, @value}, 0x94) bpf$BPF_GET_PROG_INFO(0xf, &(0x7f0000000000)={r0, 0xe0, &(0x7f0000000840)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, ""/16, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, &(0x7f0000001440)=[0x0], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8, 0xfffffffffffffcac, 0xfffffffffffffffd}}, 0x10) mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./file0\x00', 0x0) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000080)=0x7) r1 = getpid() sched_setaffinity(0x0, 0x0, 0x0) sched_setscheduler(r1, 0x2, &(0x7f0000000200)=0x6) ptrace$ARCH_MAP_VDSO_64(0x1e, r1, 0xfff, 0x2003) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r2, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r3, &(0x7f0000000000), 0x651, 0x0) recvmmsg(r2, &(0x7f00000000c0), 0x10106, 0x2, 0x0) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, 0x0, 0x0) sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x2) r4 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPCTNL_MSG_CT_NEW(r4, &(0x7f0000000080)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f00000002c0)={0x98, 0x0, 0x1, 0x401, 0x0, 0x0, {0xa}, [@CTA_TUPLE_ORIG={0x3c, 0x1, 0x0, 0x1, [@CTA_TUPLE_IP={0x2c, 0x1, 0x0, 0x1, @ipv6={{0x14, 0x3, @local}, {0x14, 0x4, @mcast1}}}, @CTA_TUPLE_PROTO={0xc, 0x2, 0x0, 0x1, {0x5}}]}, @CTA_TUPLE_REPLY={0x3c, 0x2, 0x0, 0x1, [@CTA_TUPLE_IP={0x2c, 0x1, 0x0, 0x1, @ipv6={{0x14, 0x3, @local}, {0x14, 0x4, @initdev={0xfe, 0x88, '\x00', 0x0, 0x0}}}}, @CTA_TUPLE_PROTO={0xc, 0x2, 0x0, 0x1, {0x5}}]}, @CTA_TIMEOUT={0x8, 0x7, 0x1, 0x0, 0x8}, @CTA_NAT_SRC={0x4}]}, 0x98}}, 0x0) sendmsg$IPCTNL_MSG_CT_NEW(r4, &(0x7f0000000080)={0x0, 0x0, &(0x7f00000003c0)={&(0x7f00000004c0)={0xac, 0x0, 0x1, 0x401, 0x0, 0x0, {0xa}, [@CTA_TUPLE_ORIG={0x3c, 0x1, 0x0, 0x1, [@CTA_TUPLE_IP={0x2c, 0x1, 0x0, 0x1, @ipv6={{0x14, 0x3, @empty}, {0x14, 0x4, @mcast1}}}, @CTA_TUPLE_PROTO={0xc, 0x2, 0x0, 0x1, {0x5}}]}, @CTA_TUPLE_REPLY={0x3c, 0x2, 0x0, 0x1, [@CTA_TUPLE_IP={0x2c, 0x1, 0x0, 0x1, @ipv6={{0x14, 0x3, @local}, {0x14, 0x4, @local}}}, @CTA_TUPLE_PROTO={0xc, 0x2, 0x0, 0x1, {0x5}}]}, @CTA_TIMEOUT={0x8}, @CTA_NAT_SRC={0x18, 0x6, 0x0, 0x1, [@CTA_NAT_V6_MINIP={0x14, 0x4, @rand_addr=' \x01\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x01'}]}]}, 0xac}}, 0x0) r5 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPSET_CMD_DESTROY(r5, 0x0, 0x5) sendmsg$BATADV_CMD_GET_BLA_BACKBONE(0xffffffffffffffff, 0x0, 0x0) r6 = add_key$keyring(&(0x7f0000000000), &(0x7f0000000840)={'syz', 0x1}, 0x0, 0x0, 0xfffffffffffffffb) add_key(&(0x7f00000003c0)='dns_resolver\x00', 0x0, &(0x7f0000000080)="00000102", 0x4, r6) socket(0x40000000015, 0x5, 0x0) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000002c80)={0x3, 0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0x0, @void, @value}, 0x94) getsockopt$sock_cred(0xffffffffffffffff, 0x1, 0x11, &(0x7f0000000000), &(0x7f0000000080)=0xc) mount(&(0x7f0000000040)=@nullb, &(0x7f00000001c0)='./file0\x00', &(0x7f0000000200)='ufs\x00', 0x8000, &(0x7f0000000040)) executing program 3: mkdirat(0xffffffffffffff9c, &(0x7f00000000c0)='./file0\x00', 0x0) mount$bind(&(0x7f00000002c0)='.\x00', &(0x7f0000000200)='./file0/../file0\x00', 0x0, 0x101091, 0x0) mount$bind(0x0, &(0x7f0000000280)='./file0/../file0\x00', 0x0, 0x100000, 0x0) mount$bind(0x0, &(0x7f0000000340)='./file0/file0\x00', 0x0, 0x9101a, 0x0) mount$bind(0x0, &(0x7f0000000240)='./file0/file0\x00', 0x0, 0x80000, 0x0) mount$bind(&(0x7f0000000080)='./file0/file0\x00', &(0x7f00000001c0)='./file0/../file0\x00', 0x0, 0x3041008, 0x0) executing program 32: mkdirat(0xffffffffffffff9c, &(0x7f00000000c0)='./file0\x00', 0x0) mount$bind(&(0x7f00000002c0)='.\x00', &(0x7f0000000200)='./file0/../file0\x00', 0x0, 0x101091, 0x0) mount$bind(0x0, &(0x7f0000000280)='./file0/../file0\x00', 0x0, 0x100000, 0x0) mount$bind(0x0, &(0x7f0000000340)='./file0/file0\x00', 0x0, 0x9101a, 0x0) mount$bind(0x0, &(0x7f0000000240)='./file0/file0\x00', 0x0, 0x80000, 0x0) mount$bind(&(0x7f0000000080)='./file0/file0\x00', &(0x7f00000001c0)='./file0/../file0\x00', 0x0, 0x3041008, 0x0) executing program 5: syz_usb_connect$cdc_ncm(0x4, 0x6e, &(0x7f00000000c0)=ANY=[@ANYBLOB="12010000020000002505a1a440000102030109025c0002010000000904000001a3f45747d649f9a30105240000000d240f"], 0x0) creat(&(0x7f0000000240)='./file0\x00', 0x0) pipe2$9p(&(0x7f0000001900)={0xffffffffffffffff, 0xffffffffffffffff}, 0x0) syz_usb_connect$hid(0x6, 0x0, 0x0, 0x0) write$P9_RVERSION(r1, &(0x7f0000000500)=ANY=[@ANYBLOB="1500000065ffff0480000008003950323030"], 0x15) r2 = dup(r1) write$FUSE_BMAP(r2, &(0x7f0000000100)={0x18}, 0x18) write$FUSE_NOTIFY_RETRIEVE(r2, &(0x7f00000000c0)={0x14c}, 0x137) mount$9p_fd(0x0, &(0x7f0000000000)='./file0\x00', &(0x7f0000000040), 0x0, &(0x7f0000000180)={'trans=fd,', {'rfdno', 0x3d, r0}, 0x2c, {'wfdno', 0x3d, r2}, 0x2c, {[{@cache_mmap}], [], 0x6b}}) chmod(&(0x7f0000000140)='./file0\x00', 0x0) open$dir(&(0x7f0000000140)='./file0\x00', 0x82c02, 0x40) executing program 4: sendmsg$NFT_BATCH(0xffffffffffffffff, &(0x7f0000000080)={0x0, 0x0, 0x0}, 0x4000) socket$nl_generic(0x10, 0x3, 0x10) prlimit64(0x0, 0xe, &(0x7f0000000240)={0xc, 0xfffffffffffff800}, 0x0) r0 = bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x11, 0xb, &(0x7f0000000ac0)=ANY=[@ANYBLOB="1800000000000000000000000000000018010000786c6c2500000000002020207b1af8ff00000000bfa100000000000007010000f8ffffffb702000008000000b7030000fdffffff850000002d00000095"], &(0x7f0000000000)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @void, @value}, 0x90) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f00000000c0)={&(0x7f0000000080)='sched_switch\x00', r0}, 0x10) sched_setscheduler(0x0, 0x1, &(0x7f0000000080)=0x7) r1 = getpid() set_mempolicy(0x5, 0x0, 0x961) kexec_load(0x0, 0x1, &(0x7f00000002c0)=[{0x0, 0x0, 0xc1000000}], 0x0) sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x2) sched_setscheduler(r1, 0x2, &(0x7f0000000200)=0x6) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f04ebbeef, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r2, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r3, &(0x7f0000000000), 0x651, 0x0) recvmmsg(r2, &(0x7f00000000c0), 0x10106, 0x2, 0x0) openat$binderfs(0xffffffffffffff9c, 0x0, 0x0, 0x0) tkill(r1, 0x35) r4 = openat$loop_ctrl(0xffffffffffffff9c, &(0x7f0000000180), 0x0, 0x0) ioctl$LOOP_CTL_REMOVE(r4, 0x4c81, 0xb) r5 = openat$uinput(0xffffffffffffff9c, &(0x7f00000001c0), 0x0, 0x0) ioctl$UI_BEGIN_FF_UPLOAD(r5, 0xc06855c8, &(0x7f0000000300)={0x8, 0x9ad, {0x57, 0x0, 0x4, {0x9, 0x1}, {0x7fff, 0x3}, @const={0x0, {0x8, 0x8000, 0x13, 0xee}}}, {0x54, 0x2, 0x1c0, {0x9, 0xd0}, {0x9, 0xfffa}, @period={0x5d, 0x1, 0x401, 0x7, 0x5, {0x0, 0x7, 0x9, 0x3f}, 0x1, &(0x7f0000000280)=[0xf]}}}) executing program 2: ioctl$BINDER_SET_CONTEXT_MGR_EXT(0xffffffffffffffff, 0x4018620d, &(0x7f0000000100)={0x73622a85, 0x1100, 0x1}) r0 = syz_open_dev$sndctrl(&(0x7f0000000040), 0x535, 0x200) ioctl$SNDRV_CTL_IOCTL_HWDEP_INFO(r0, 0x80dc5521, &(0x7f0000000100)=""/119) executing program 0: syz_open_dev$cec(0x0, 0x0, 0x0) write$evdev(0xffffffffffffffff, 0x0, 0x0) r0 = socket(0x2, 0x2, 0x1) bind$unix(r0, 0x0, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000080)=0x7) getpid() sendmmsg$unix(0xffffffffffffffff, 0x0, 0x0, 0x0) recvmmsg(0xffffffffffffffff, &(0x7f00000000c0), 0x10106, 0x2, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000200)=0x4) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000200)={0x18, 0x4, 0x0, &(0x7f0000000100)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x2, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0x0, @void, @value}, 0x94) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, 0x0, 0x0) r1 = socket$alg(0x26, 0x5, 0x0) bind$alg(r1, &(0x7f0000000000)={0x26, 'skcipher\x00', 0x0, 0x0, 'cbc(des3_ede)\x00'}, 0x58) setsockopt$ALG_SET_KEY(r1, 0x117, 0x1, &(0x7f0000c18000)="beef915d564c90c200"/24, 0x18) r2 = accept$alg(r1, 0x0, 0x0) read$alg(r2, &(0x7f0000000080)=""/4114, 0x1012) write$binfmt_script(r2, &(0x7f0000004180), 0xff77) executing program 2: r0 = socket$kcm(0x10, 0x3, 0x10) r1 = bpf$PROG_LOAD(0x5, &(0x7f0000000200)={0x11, 0x3, &(0x7f0000000140)=ANY=[@ANYBLOB="180000000000000000000000000000ac30cc90bb0c075e2eceb36e009500000000000000"], &(0x7f0000000040)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @void, @value}, 0x94) r2 = openat$nvme_fabrics(0xffffffffffffff9c, &(0x7f0000000000), 0x141002, 0x0) write$ppp(r2, &(0x7f0000000040), 0x100000) sched_setscheduler(0x0, 0x1, &(0x7f0000000080)=0x7) r3 = getpid() sched_setaffinity(r3, 0x8, &(0x7f0000000040)=0x2) sched_setscheduler(r3, 0x2, &(0x7f0000000200)=0x4) connect$unix(0xffffffffffffffff, 0x0, 0x0) sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x400000bce) r4 = syz_open_dev$MSR(&(0x7f0000000a40), 0x0, 0x0) read$msr(r4, &(0x7f0000019680)=""/102392, 0x18ff8) keyctl$restrict_keyring(0x3, 0xfffffffffffffffb, 0x0, 0x0) mkdir(&(0x7f0000000300)='./file0\x00', 0xa3) mremap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x4000, 0x3, &(0x7f0000005000/0x4000)=nil) open(&(0x7f0000000180)='./bus\x00', 0x14927e, 0x0) open(&(0x7f0000000100)='./bus\x00', 0x14113e, 0x0) socket$nl_route(0x10, 0x3, 0x0) setgid(0xffffffffffffffff) semctl$SETALL(0x0, 0x0, 0x9, &(0x7f0000000040)) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f00000001c0)={&(0x7f0000000180)='kfree\x00', r1}, 0x10) sendmsg$kcm(r0, &(0x7f0000000000)={0x0, 0xd18c9b25, &(0x7f0000000080)=[{&(0x7f0000000040)="e03f03002a000b06d25a806c8c6f94f90424fc600400037a0a000900050282c137153e370e0c1180fc0b10000300", 0x33fe0}], 0x1}, 0x0) r5 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r5, &(0x7f000000c2c0)={0x0, 0x0, &(0x7f0000000200)={&(0x7f00000003c0)=ANY=[@ANYBLOB="140000001000010000000000000000000000000a28000000000a0101000000005e1affd5020000000900010073797a300000000008000240000000032c000000030a01030000e6ff00000000020000000900010073797a30000000000900030073797a320000000014000000110001"], 0x7c}}, 0x0) sendmsg$NFT_BATCH(r5, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000b00)={&(0x7f0000000280)={{0x14, 0x10, 0x1, 0x0, 0x0, {0xa}}, [@NFT_MSG_NEWRULE={0x70, 0x6, 0xa, 0x401, 0x0, 0x0, {0x2}, [@NFTA_RULE_EXPRESSIONS={0x38, 0x4, 0x0, 0x1, [{0x34, 0x1, 0x0, 0x1, @match={{0xa}, @val={0x24, 0x2, 0x0, 0x1, [@NFTA_MATCH_NAME={0x8, 0x1, 'udp\x00'}, @NFTA_MATCH_INFO={0xe, 0x3, "7acc6338a90000b03bd9"}, @NFTA_MATCH_REV={0x8}]}}}]}, @NFTA_RULE_TABLE={0x9, 0x1, 'syz0\x00'}, @NFTA_RULE_CHAIN={0x9, 0x2, 'syz2\x00'}, @NFTA_RULE_COMPAT={0xc, 0x5, 0x0, 0x1, [@NFTA_RULE_COMPAT_PROTO_IPV4={0x8, 0x1, 0x1, 0x0, 0x5c}]}]}], {0x14}}, 0x98}}, 0x4) sendmsg$kcm(r0, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000080)=[{&(0x7f0000000100)="e03f03002a000b05d25a806c8c6f94f90524fc600400037a0a000900050282c137153e370e0c1180fc0b1000", 0x2c}], 0x1}, 0x0) executing program 5: r0 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) prlimit64(0x0, 0xe, &(0x7f0000000040)={0x8, 0x420000008b}, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000080)=0x7) r1 = getpid() sched_setscheduler(r1, 0x2, &(0x7f0000000200)=0x7) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r2, &(0x7f0000000180)=@abs, 0x6e) sendmmsg$unix(r3, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r2, &(0x7f00000000c0), 0x10106, 0x2, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000200)=0x4) r4 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000200)={0x18, 0x4, &(0x7f00000002c0)=ANY=[@ANYBLOB="18010000000000000000000000000000850000006d00000095"], &(0x7f0000000100)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x2, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0x0, @void, @value}, 0x90) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000080)={&(0x7f0000000000)='sched_switch\x00', r4}, 0x10) socketpair$unix(0x1, 0x2, 0x0, 0x0) socket$packet(0x11, 0x3, 0x300) syz_init_net_socket$ax25(0x3, 0x5, 0x0) r5 = ioctl$TIOCGPTPEER(0xffffffffffffffff, 0x5441, 0xea) ioctl$BTRFS_IOC_RM_DEV(r0, 0x5000940b, &(0x7f0000000240)={{r5}, "e26c6e0554a143b9bcba21b99bd59c17c586067a9ffb74651ccdeca5bb2e356e0b4355c6707e5f71078f6c23d0107910ccfb15af78ed4e1bf9e2a1e60cd835efa672662d9662df850be5bf7a864c8aa065da4098d39d75367be62d06c67e861d3b08aacfc243ce2e05d597655fdbeb46033792294c1cbcc45acf869bde53ab85d2556770ebc6f4f783910638133dee0e256e744b41c5385ead8c9322a56c105d82507d5c79efdc13bccbcea15b159dca01677644327a6c40ddf4755650b1c9be81f35832c3c4bdfae5bc93d5aa9339e5a4681be1f09437ab3005b3741afb2380cd1a95927552282880a0162c1dd269c913e6fa8468c25d15c1c80da2011c22743797a1f5da116edafcc5b696c5a75bd9bb9df1274ce535c483c35b2dafe76441bec40f33bfd5f5eb68c8b7514cc0ec3380d2919c9cb59280eb3a3b45c1d31fe29f08103094325c0fb13ff818b83ba7cb862f465432a9c9f0c8fc98c7b24be9c178cd2a6948c469ec7136f58795f88574f709c05fd4bac3fc98a7e25fab8f3c79c8a3ef91b97dc0146ac93d0d913d659402a2d0ee7d3318f97410fb5d5fc81708784b8848be7dedf2e76519a38954fb69e00d179877e9ddaf9276afcdd32893093bc4ec3ffc2c2ee9150e1e169ff3ad6cf00567eec64895fe6cd11a504abacff2a26e5088776d77becf9df2c51633f72f94781b251786d5b43382ae8110eb21dfab45136293e688a4f81469d1ff165e06c4b9f5e06cc199d39865d5644bb2f6b581acd617ae6133db5e322aa71c2f387dcbdb95ede2f3aa495617e56d7f8ce50fff84a496a21d5f03b10c82172154be888c1d06234576e495691a58eec889dd8937f4359bf6756286aaeab5339c4e63ae487e48c964bc2a85ba5edcb0b5ca6791b84cd031dd342ccb8c05cbb270249f0874dd52677e0898b9f70baf49e6c62d0c0769cf67515cb823de338a82a9ea687ce3b9e35be633b468d8146be0210f7137728addd9db4618e3852adc0fa9bf6e9740cded385bb8f089b89ba9fc694a797fc2577553b5bb401990730a2d8d39c9f46016b9914eb0cc254a63bf973127917a8011d59414f399918002240997aeb52347218a45dcff2765996e6bb983c9d5e0fa1decb9a529bc7f902c3b80f885979a1d9d8dc7ace50d64e012a745a340b00598616e0b400b1c2ae96c440240e855f8f5fa090c58003320cbbfaf833444c9f51f2e12e135b350e05a20b01d9624629827281b82812b3ae6490517641a018f217357b1089f59a7924e72b02871a2fde76349e96ce670b41706c84a8c858f073f11850de79adb1749f9ef2468858d91b33c4dbd01101b4c811f76fa3ccd92ace0490e222c204f20259fce9b00d8a784684032e9b2939f42b08a678a879ee538373a305ea7b51bcd5b52f6a93b3acfdf7b229246f287ceb4b4298bd069f5a4414240e95f770f3ba3b38a640648eb2c90718797aa4c7df2a32b082fcff7322ab7f0e7336186710be93d73b8840aad3135c5e5620cb2023a282950aa7c853bc87739096e25043423a3dd01d2d7be789b6f447eb387859115c050ad98ee54ed62c8013e085c9df3e1a42c353491af9a924b8dae150f7ea2ce87e9453085fccf8cdae444fe40cae4b406981874ad3394537f5bfc084594fb49a2fdaa33df2fb557b1fd6c08e08c8a4573662388df6ce14418935c17a8525d7e70816451deedf16217c9a872e8b47773a1f66cd5aa978b3041f45f92d787e84ad4db847c7f51cb3f383cb51063c6e6c06aceb5551afaac3eeead148c98ddaf4ed5c5660140900267dce7e4f2f9984e3ff192e8b40d7a545e2125fb234545abc3a47bc7f64428585d6302fb6470869295d52855e43e78b7a0c1f8bdd56cbd3f6294a1d81db5ee5526b1f81d5bb5c26e4353b89c5bd80abe04bdd850c20074b50148ee40c06909e50a15f05653489b792aa74052d1a18503a2850f23c84e389d1a473e9aa1ee1478707345ab9acfb4a85f4d171581b07d816727f781d1c5ecaff218e7abc0b95073455817bd6a13859f18748c6aee351f180b4fa7f77614398cbd663f25d30c13b1aa3938c26ff8dd06ad5fcba1146e741254fb3ef2c4f469e0b259ebfc833ac5991a52b44b119a77e190dd234d34a4f0f3c8279c869e7d4a379bd7709700e2a089b37dff32227432b8c798ceb48b69c51d941a1834a2f40ab39bc11109e3f0db0c003f6b341e4f6595cce9444a62f71dcfdcc6a435e5160425d5466090df6cdd5defd7fc281c7c22d90cbde7988258efbe35a2d38b644d3c9022f87d446dc5ceaf0046fdc1af3a0fb058b4d25347095535757c9c88019fc58d1d56af6f22c9d3b0bb936c43844fc0438657bbf61fab9c45ae3559a7b74dd1efd0889ec29106eb46f9a13065a7d6fa1053cf1aba827e32ebe38ad7cb44f0a59b5f69222459432381e00d8eb05313071a31e99b74b782a7a6fc38e84dd1ed9bac8e96a5fb26113e01ec383f3c328ed81ee74a725fa9b7cf1818764fbd90a596c1838e87562d645a47a5c594a4672b078faa02fbf9766dc3e4a247d916db75d1b12948fc2093785b27345dc38a1d566b7d55912de7b37a7c0c4df49efd0ba638b069a76ec0c9b4c25d08197bb598abfdc590a4fbb6aad9191b4b9cec89c0fa2c70aed124e8d8125a569a1d86c584fc9c7c82b4e03151e7192dd026422106f5e5d355d47bc8986f62b399787801f987325b6346ac94ae9a807472b35141af418e22d82830d8ab0d01c2f7a652b45d79bb14438925fa9b9cc4f003d1f1f3651b8cfb584210da248b643c01d4e02a13e06ad043a0bcf3c6df46c607f03056fe8cb122626f833d62cbfb171a42e3831c8596fafaa5ac26aca493a628e3ba11011f3eca36cff53219fa2b14713033b9d01645af350ff8768c4c7c65974dbd0ab9a0b7c4f6e928ce068a1e6d1dda09480fb87c7e10f4ea118f088aaf23724f877f87371ed6408db1217814965e023fb0988387c98d8df5a265baa88a85a49f1a33e2e3999c013bfc984a63cd994acf0efdf3b3f3087d86af529d30ef71b25229ba8faf373e93bdc3222df4196c3b5a61716c8ab2bd991edec0b53f3f793ead5d18fead07a1c3d68b018cf8704c6edc6dbed11a9be0bfc0b3319bcb3764ca31b6029a0ade0cc0cd93bf694bc5370093a12d75cce4af2b9557e47ac1dab89d5ce2cad86e8826f210debd9a8f01597334b5a5bfd0377a1d66a2e8fe11a94c74ea9bd0ee75678298673e2c98ea8c47594961e8fb30929a508978b14be60f9f48fb78aa76b2a519583452b9b0ce5d7225fd101dc1bbe9ae925ddf51ad301ba60627da36ab650a15b6f01022cd0976e862af821658a51e6848a03769f0902c0dadbfd0562f440a5715e32206c0024d50194906463a728d9b97fbb1695b2f05147361aa84cea4dc3b049d1a27aec4644c353d6f80260c05c96c7a713e9e39420e0b396607a91cf45a2b5ae89282134758f5f4460916c33dac9d7981651aa8440c39f89c68ea42c96d04a898c68cf16654eb90b6b39e168c93edf11f7ad9971beb7a229997134921b92bf42dc6462d5b52319f5569fc34d1ced287be793e0e02b5abb4e4f734e2a860aaf512b0eac108509f2948148c03b8f0a89302daf189ed5d384caf7d74f688d4aa2bae041687e7e37f720e581546f545d54bfa31ff76d54ea37cfc9dcfe31d5931cfc0aa4dc44b5e8a894460cda65fafc2dc9db4b573325aa274b0a25423dced5e7bb9319505025d416790e79bdf7a1a4f8b706f8325999b0d2302a7feff6877c466013c87c94ddf1ebb7163004db5d026152c22b25ee7d79cbcbcf6b744e346561e9ce9523598444ebcd1e98e72aa814fcec0a23a0d98ecf8102728ecaf5f3fe79912ccc8e7418fdc48f5901bdd4a46f4b4fb35f67b6319a6144b4563d6551f50b1134c6ff3035745dc930622c507bbd709b4e30685a699008eb7531604d595a55e884b71ae5b71911872b512cfc268205e26ad7c2226d382562be21e6a1078be3b536c25b6c0eef0da79254959a6b369011029c5f0408540623ce7c79d6ce855b30994c001d049825822bc6d065e3abfd4b8bfbcf611bf48255a33d53429f8170009359f41bb8ba3045dacd2e6bd2c77d72c0417a5a44a58b912069a41f8d24ea244203ee198bf991e41c463e7adfad5a3b8ae6ca3705307f8f21dc80a636bc13638fa2c28464a871fd2159cd5ac2be78d888d7a7f4245041f12012d99cabf6571d480a4885db235ff56629b7a4bf73a99026efbcefcb4f186ccc434f7194fe40edcaafa5bc8985616947152689fc19ac2efb186b1010f90abe33d23161f3216c09c36f74dde9c8d4697cd1754b0730f27c3a3f3b6bb94692d815df8db3dc711b924b29fe27612643809caf9aafdfd6addb62c0341a23b108a718c6e6a12d1a797c857562143712495cb391c986c3f6f142c47a3c3b67bfe664f579e16660930d185a281c547b0e89139e6368e24d18b1adbfabe8c9ff3d75381d2a35bbb685825db428cfe8824bc6712274c8f87cd1e48d34496142f3c3c96bb10a88040dfc9964e0572b801fadc4c59bfc327b925485eebee6e5e82e9bf38c2273878c20ba6a0bf1d927cdc83ad9406aee0a7b41a4bd5e058a63e246bd538a6546103f10f5d3bd58a3749ae1a7063e9cc11eac83f6510318e08e2336455130d4cb535aef6e036ab42e61ef650cb629472b0cd986e01d663d7438f39d6acb56f837d7694980c21f48c8b354597dc5ebd9c3a4222317c0cee1b2e02fc1d27af7e6ca04eca4eae7e2925200798e717a39093527626eadb5b7acedcfdba43ffdce9e23df22e119df85f9ef6fe344794711c6127617f8767577f01c5a799c907137358514607e20cde8701b17f7a8fce5078ca2b4a0f2469694fa133cd84c986f94fd9c4b977dc8127dd9446675db2945e52291706bbffb481550afc84774a1f367f2ef4ec1fd12651948a2f29e926ed1de4950ef5a539e3d3a5d6c237c6353dbf9ba0efd87a03bc90f61e3a3ffebd8917fc093b0ffec7b216ea422ea89cb5136380b1d675568a769d0b5eb64f2dba842828a9216261958368c326c22964fb6fde63c20c7a8dfee0d6570860a0416fd502170afdc86dcf310f8ff05a87ea361ea822f2945492064058b6e977f69b5233bc20d1d53f1065109e30b0d722172893fbe0b3aa71a93caa7892721cba99488997aa0036ee653d39609b5354b2939d7515ce143d642990408c0a1ee43cbafd0211de6c034f4371c0c20a8b4253bb8a193fdde7353e1bb6bc32c0a5c2763ea85f52326b7231f8e7f1ae6f8057fde25b19e4b5f1407e0fecd13924d7d0433560db591db6bd19bdaaeb014b5316ce1dc1796eef88f0c95efd5fbf1632d54b5c839d4fe6e83077a6984c8fd58d326a7b3a544527a48a7cefc85e001b5dfa2fa279026c2343d8909a9fe8618c79bc3938edf2464f6021e46d0736438656a29fad118f768c446ac194d9d3c12efe46840c17a77b57790eefd7cb0a079ac73908a25b9a077534dd5d93f71772e6bfcbaa5bf0664008d5068335f09bbce116cece72e38a286e908042e0aa130d4fd501569046fdf81a2777cb87715e2ded26899a4a70fc33b208575f96a59c2fa83821e059e1ad807e7ebace9df2efeae82b93db3ad22ea9d22f5d5b29f71237019ca37dba3e854834705da14395df514c667e8b4476cc3546dc53bf057643503bea7f690c3c744eb16efcc4fcca887303fdd2915eeb12f1391bd2ffeec867ae6049ff5a14e27ded29aba1a85327c029"}) r6 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000280)='cgroup.controllers\x00', 0x275a, 0x0) ioctl$FS_IOC_RESVSP(r6, 0x40305829, &(0x7f0000000540)={0x1100, 0x0, 0x52, 0x10000}) bpf$MAP_CREATE_CONST_STR(0x0, &(0x7f0000001240)={0x2, 0x4, 0x8, 0x1, 0x80, r6, 0x1, '\x00', 0x0, 0xffffffffffffffff, 0x4, 0x1, 0x2, 0x0, @void, @value, @void, @value}, 0x50) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000240)) mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./file0\x00', 0x0) mount(&(0x7f0000000180)=@nullb, &(0x7f00000000c0)='./file0\x00', &(0x7f0000000200)='adfs\x00', 0x8003, 0x0) executing program 0: prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x0, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) r0 = bpf$PROG_LOAD(0x5, &(0x7f0000000080)={0x11, 0x8, &(0x7f0000002ac0)=ANY=[@ANYBLOB="620af8ff0c200021bfa100000000000007010000f8ffffffb702000003000000bd120000000000008500000006000000b70000000000000095000000000000003faf4f1e7f2aa3d9b18ed81c0c869b51ec6c0af4e0e4a9446c7670568982b4e020f698393aa0f3881f9c24aa56f15199fad0093c59d66b5ece9f36c70d0f13905ea23c22624c9f87f9793f50bb546040677b0c5077da80fb982c1e9400e693146cea484a415b76966118b64f751a0f241b072e90080008002d75593a286cecc93e64c227c95aa0b784625704f07a72c234664c0af9360a1f7a5e6b607130c89f18c0c1089d8b853289e01aa27ae8b09e00e79ab20b0b8e1148f49faf2ad0000000000000006fa03c6468972089b302d7bf6023cdcedb5e0125ebbc08dee510cb2364149215108333719acd97cfa107d40224edc5465a932b77e74e802a0d42bc6099ad2300000080006ef6c1ff0900000000000010c63a949e8b7955394ffa82b8e942c89112f4ab87b1bfeda7be586602d985430cea0162ab3fcf4591c926abfb0767192302000000b0eea24492a660583eecb42cbcd3de3a83209da17a0faf60fd6ad9b97aa5fa68480366c9c6fd6fa5043aa3926b81e3b59c95c25a573dc2edcaea2b1a52496dfcaf99431412fd134a996382a1a04d5bb924cfe5f3185418d605ffff9c4d2ec7c32f2095e63c80aff9fa740b5b7632f32030916f89c6dad7603f2ba2a790d62d6faec2fed44da4928b30142ba11de6c5d50b83bae613402216b5054d1e7c13b1355d6f4a8245ffa4997da9c77af4c0eb97fca585ec6bf58351d564beb6d952aab9c70764b0a8a7583c90b3433b809bdb9fbd48bc8734c295cbff8a326eea31ae4e0f7505ebf6c9d13330ca005ace1a84521f14518c9b476fccbd6c712016219848624b87cec2dbe98223a0eb4fa39f6b5c02e6d6d90756ff57902a8f57000000009700cf0b4b8bc2294133000000000000000000030000000000000000000000000010008bc0d9559711e6e8861c46495ba585a4b2d02edc3e28dd271c896249ed85b980680b00002b435ac15fc0288d9b2a169cdcacc413038dafb7a2c8cb482bac0ac502d9ba96ffffff7f0000100000000000007d5ad897ef3b7cda42013d53046da21b40216e14ba2d6ad5656bfff17addaedab25b30002abbba7fa725f38400be7c1f001b2cd317902f19e385be9e48dccff729433282830689da6b53b263339863297771429d120000003341bf4abacac95900fca0493cf29b33dcc9ffffffffffffffd39fec2271ff01589646efd1cf870cd7bb2366fde41f94290c2a5ff870ce41fd3467decb05cfd9fcb32c8ed1dbd9d10a64c1083d5e71b5565b1768ee58969c41595229df17bcad70fb4021428ce970275d13b78100788f11f76161d46ea3abe0fa4d30dc94ef241875f3b4ce0232fcea69c271d7fa29822aea68a660e717a04becff0f719197724f4fce1093b62d7e8c7123d8ec571be54c72d978cf906df0042e36acd37d7f9e119f2c06f815312e0cfe222a06f56dd022c074eb8a322fb0bf47c0a8d154b405c37feaf3dd95f6ef2ae582786105c7df8be5877050c91301bb997316dbf17866fb84d4173731efe895ff2e1c5560926e90109b598502d3e959efc71f665c4d75cf2458e3546c1c776da64fb5abee0acfd235f2f4632c9062ece84c99a061887a20639b41c8c12ee86c50804042b3fb5aac518a75f9e7d7101d5e186c489b3a06fb99e0aa7f23a054de2f4d92d6bd72ee2c9fdc75aaaf1e3e483b4ad05573af40326993947d9a631bcbf3583784acbda216550d7aec6b79e30cbd128f54c2d3335457acf37331766e472391e358c3b377327ac9ecc34f244a3c307145452ce64dc55bff9f5f45f90400000000000000d6b2c5ea1393fdf24285bf16b99c9cc0ad1857216f1a985f369191ae954febb3df464bfe0f7f3ee9afe7befb89d2777399f5874c553aeb3729cffe86e66964ae09bb6d163118e4cbe024fd4500f8ff0700000000cc9d8046c216c1f895778cb25122a2a9f9b444aeadea2a40da8daccf080842a486721737390cbf3a74cb2003016f1514216bdf57d2a40d40b51ab63e96ec8485b3b8a8c9ae3d14f93100c2e0893862eef552fcde2981f48c482bde8a168c3f5db2fea6f26e4a4304e50c349f4f9ecee27defc93871c5f99b355b72d538ba4958ea8e4aa37094191e10096e7e60fc3541a2c905a1a95e9571bf38ae1981c4238ecaee6f75cd0a6881bd1517a8250ddc8674152f94e3a409e2a3bce109b60000000000000000d6d5210d7503000000a87a27602b81f76386f1535bef1497f92186086e29c6bc5a1fad6ec9a31137abf9a404abde7750898b1bd627e873f8703be8672d70d1ab57075228a9f46ed9bd1f08fb8191bbab2dc51de3a61f0868afc4294859323e6c257a45319f18101288d139bd3da20fed05a8fe64680b0a3fc22dd70400000000946912d6c98cd1a9fbe1e7d58c08acaf30235b918a31d2eca55f74a23641f61f2d5b308cf0d031b0c7f0ced69993e9960ff5f76015e6009556237badf4e7965bbe2777e808fcba821aa8e8c5c39609ff854352cb4900000000000000000000000000c1fee30a3f7a85d1b29e58c77685efc0ceb1c8e5729c66418d169fc03aa188546b3ad2a182068e1e3a0e2505bc7f41019645466a53f1c96e0d4b3bc19faa5449209b083dbd334b47f067bbab40743b2a42010082008df75cf43f8ecc8d3726602111b40e761fd21081920382f14d12ca3c3431ee97471c7868dcda7eaa69eb7f7f80572fdd11bb1d0d1280fbc22bf73468788df51710d7d31c632fc5ed1762eb0b428ee751c47d8e894f745a868404a0bf35f0121008b722b1eaa6aedfa1bf2e7ccb2d61d5d76331945ecefa26b8471d42645288d7226bbd9ccd628ab84875f2c50ba891cea592b0430a537a395dc73bda367bf12cb7d81691a5fe8c47be395656a297e9df0e71f96756ea5cce7daac4be290159f6bcd75f0dda9de5532e71ae9e48b0ed0254a83100000000f6fbb869604d51a36a54c832e45b2569dc0d90b075225fde44c4e0973171ad47d6b0fdf9743af932cd6db49a47613808bad959710300000000000000832d0a45fa4242e24c7e800003c9e8095e02985f28e678f66422436f949e2ab8f162d7e3f855e378f4a1f40b0c6fb2d4b205a800b6d713acebc5b014e61a543a5a194f9ac18d76b5440e3b1a569e7397f6cafa86966d7ba19e720413267a6ccea9c439671d2c680f2753ca184eeeb843450368acb4383a01d25eb3d1e23e0f2645d1cdfa9fa410632f95a5f622c66ee7e30393cd7a4d67ff2a49c4f93c0984b5c2d4523497e4d64f95f08493564a1df87111c9bf3194fef97dcecc467ace45feeb685c5870d05f88a0f463db88d377442e1349acaf766218b54a9d624778e1c4e064c98e494198276eb2df7766411bef0ebb5000000000006065d635b0b7a00ee767221d8af9753387e0cd8d718f54a29df6eba3bd4c440e6e2172e3fcc01b8babb757b5c59217b80d0db3ba582814a604e4ef7a803e9ca7c85b35c9b93a9e0885e238b44ae1c2e64cce3b27083b8246829e64056000302bffff15405bd5f2eba20000000000000000000000000000000000009a9823fd8fbc5aa165099c5ed032b48ea12d8e0588dc52702e4084913a06d468d0928bad76d697e1f85ab030e788d38788ee5b5428d4a971cc97db9fd231088e570735ce129e7e77fc2777692664a1488fd8d6dff4dad618fd54f529d4555c65070020d7df0abc55258789b24052137e9637f3efbab71720f88c3c44b3b7486f979e8a3174b531f573fe0e5239c000be2733c49546f6e8a9175ec6f14dbf72cac91643b2fd99c29eca28a3c2e60d5e5b8795fae16a7c3ea57e728eca35eaf0155a39f97580e079175426c088a0208040982a0000000000000000000000000051ceaaf0159fe61f2eade7603d0a7a56fb09cd119ac06adb6597155ae47846892bb423c024d8cbe9240b71ec6dc2124d3a19e2d714b273d95d1d3aa737cb04a33615ff2a730e51067d5d675d7122361c37c61a43b5afd865b60d4cae891b73220f17d25985a7f76834995e53a93a1c7b9eef267df691ca983a0b15bda7f6c5c1ca7aa50261a3089a1ebf0734c9b07e8951ff023263ad5aed8cfb49b49e128c697724c057d22c5df5aef27ce3db11d5ad5527d149d076e1a87e2df27c0cb8a67ad026bf953e88f10447e125c2c0f1aebee1f3390a9e3ddad4e2a6e0f6e4569fdefa19e870e04acf9493b963f98e23cfc665e4f465fa3f801e1957c399e45f61d3459b1c606204368bb931345af2823c487d2fd99db6ea6e008e7ffa06ca861551189d155bd077a79fe2c7e961352e56824f727d21d41eae78bfec4a2d7a7edbc8ef958c5ea599f7c25bf71c2340558a"], &(0x7f0000000380)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x8, &(0x7f0000000000), 0x8, 0x10, &(0x7f0000000000), 0x10, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x10, 0x0, @void, @value}, 0x94) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000180)={&(0x7f0000000540)='rcu_utilization\x00', r0}, 0x10) bpf$MAP_CREATE_CONST_STR(0x0, 0x0, 0x0) r1 = getpid() sched_setscheduler(r1, 0x2, &(0x7f0000000200)=0x4) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r2, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r3, &(0x7f0000000000), 0x651, 0x0) recvmmsg(r2, &(0x7f00000000c0), 0x10106, 0x2, 0x0) socket(0x840000000002, 0x0, 0x100) r4 = socket$inet_udp(0x2, 0x2, 0x0) r5 = socket$key(0xf, 0x3, 0x2) sendmsg$key(r5, &(0x7f0000000000)={0x40000000, 0x0, &(0x7f0000000040)={&(0x7f00000002c0)=ANY=[@ANYBLOB="0207a20802"], 0x10}}, 0x0) bind$inet(r4, &(0x7f00000001c0)={0x2, 0x0, @local}, 0x10) connect$inet(r4, &(0x7f0000000480)={0x2, 0x0, @multicast1}, 0x10) setsockopt$inet_IP_XFRM_POLICY(r4, 0x0, 0x11, &(0x7f0000000080)={{{@in=@multicast2, @in6=@private0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0xee00}, {}, {}, 0x0, 0x0, 0x1}, {{@in, 0x0, 0x32}, 0x0, @in6=@dev, 0x0, 0x0, 0x0, 0xb7, 0xae, 0xffffffff}}, 0xe8) sendmmsg(r4, &(0x7f0000000180), 0x400000000000077, 0x0) setsockopt$inet6_IPV6_FLOWLABEL_MGR(0xffffffffffffffff, 0x29, 0x20, 0x0, 0x0) executing program 4: prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) r0 = getpid() sched_setscheduler(r0, 0x1, &(0x7f0000000200)=0x6) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, 0x0) sendmmsg$unix(0xffffffffffffffff, &(0x7f0000000000), 0x651, 0x0) r1 = syz_open_dev$evdev(&(0x7f00000000c0), 0x3f, 0x822f01) sendmsg$nl_route(0xffffffffffffffff, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000001140)={&(0x7f0000000700)=ANY=[@ANYBLOB="4800000002000000000000002000000000000000", @ANYRES32=0x0, @ANYBLOB="00000000000000002800168024000180100002000000000000000000000000000c00"], 0x48}}, 0x0) r2 = openat$mice(0xffffffffffffff9c, &(0x7f0000000180), 0x0) read$FUSE(r2, 0x0, 0x0) write$char_usb(r1, &(0x7f0000000040)="e2", 0x918) executing program 1: bpf$MAP_CREATE_TAIL_CALL(0x0, &(0x7f00000007c0)=ANY=[@ANYBLOB="0300000004000000040000000a00000000000000", @ANYRES32=0x0, @ANYBLOB='\x00'/20, @ANYRES32=0x0, @ANYRES32=0x0, @ANYBLOB="000000000000000000000000000000000000000000000000000000002488b2f9e74580af107c0e1d82e10ec48719c67c3a2c410e56c69d665be4d063622980f8cb451837ec40c83579dab92e8f84c849607fcefb8f68d30f5cef9a27821ae15259e0a5f3fde268d4d90d504f96fd259153f0a0e56e8348de69c712c4745807e57b8037dcc4948ce942ee622e67b803a7993e63813551380de1382064638f188d433efa8caab4bcf04b55d3a2778b35cf869574e55126edb0a866c8c2210811f626e123984c1578eea143687583ec9cd45399277cba"], 0x48) openat$cgroup_root(0xffffffffffffff9c, 0x0, 0x200002, 0x0) openat$cuse(0xffffffffffffff9c, 0x0, 0x2, 0x0) getsockopt$sock_cred(0xffffffffffffffff, 0x1, 0x11, 0x0, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x400000bce) r0 = syz_open_dev$MSR(&(0x7f0000000300), 0x100040000, 0x0) read$msr(r0, &(0x7f0000019680)=""/102392, 0x18ff8) write$cgroup_pid(0xffffffffffffffff, &(0x7f00000001c0), 0x12) r1 = syz_open_dev$usbfs(&(0x7f0000000100), 0x206, 0x8401) ioctl$USBDEVFS_ALLOW_SUSPEND(r1, 0x5522) ioctl$USBDEVFS_CONTROL(r1, 0xc0185500, &(0x7f0000001380)={0x0, 0x10, 0xf109, 0x8, 0x0, 0x4, 0x0}) getsockopt$IP_VS_SO_GET_DAEMON(0xffffffffffffffff, 0x0, 0x487, &(0x7f0000000040), &(0x7f00000000c0)=0x30) r2 = syz_init_net_socket$x25(0x9, 0x5, 0x0) sendmsg$NFT_BATCH(0xffffffffffffffff, &(0x7f000000c2c0)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000340)=ANY=[@ANYBLOB="140000001000010000000000000000000000000a28000000000a0101000000005e1affd5020000000900010073797a300000000008000240000000032c000000030a01030000e6ff00000000020000000900010073797a30000000000900030073797a320000000014000000110001"], 0x7c}}, 0x0) sendmsg$NFT_BATCH(0xffffffffffffffff, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000540)=ANY=[@ANYBLOB="14005dd31000010000000000000000000200000a54000000060a0b04000000000000002800048024000180090001006d6574610000000014000280080002400000000e080003ff000000000900010073797a30000000000900020073797a3200000000140000001100010000000000000000000000000a0000bcd9392755d0553208396b1104bd0138b9d4dcc29076671bfcd406a184eee3783779b059bf3c1d3a573e716c57ed4ab238d496fa0d3fb51054a62d7055d068124ff4184e12a61862bc0120f727e9e5c7ae925054af63819ba5f79d772ba27895dc48a6796db8d6b142c81e1c43cc58e8cef58790fddf4278fde59f4d57d0f4cb44e9f041ba703fb942342396717badaae97c20475dabfd374400"/284], 0x7c}}, 0x0) getsockopt$X25_QBITINCL(r2, 0x106, 0x1, 0x0, &(0x7f0000000240)=0xfffffffffffffee0) add_key(&(0x7f0000000140)='encrypted\x00', &(0x7f0000000180), &(0x7f0000000100), 0xca, 0xfffffffffffffffe) r3 = socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$inet_opts(r3, 0x0, 0x80000000000008, &(0x7f0000000280)="0f", 0x1) r4 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000040)='cpuacct.usage_sys\x00', 0x275a, 0x0) mmap(&(0x7f0000000000/0x400000)=nil, 0x400000, 0x1, 0x10012, r4, 0x0) getsockopt$inet_opts(r3, 0x0, 0x9, &(0x7f0000000200)=""/49, &(0x7f0000000080)=0x31) futex(&(0x7f0000000000), 0x9, 0x2, 0x0, &(0x7f0000000340)=0x2, 0x0) executing program 5: unshare(0x62040200) mkdirat(0xffffffffffffff9c, &(0x7f0000000080)='./file1\x00', 0x0) mount$fuse(0x0, 0x0, 0x0, 0x0, &(0x7f0000000400)=ANY=[@ANYBLOB='fd=']) mount(0x0, &(0x7f0000000380)='./file1\x00', &(0x7f0000000040)='autofs\x00', 0x0, &(0x7f0000000400)) chdir(&(0x7f0000000080)='./file1\x00') r0 = open(&(0x7f0000000000)='.\x00', 0x0, 0x0) mkdir(&(0x7f0000000040)='./file0\x00', 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000400)='./file1\x00', 0x0) mkdirat(0xffffffffffffff9c, &(0x7f00000000c0)='./bus\x00', 0x0) mount$overlay(0x0, &(0x7f00000000c0)='./bus\x00', &(0x7f0000000080), 0x0, &(0x7f0000000400)={[{@workdir={'workdir', 0x3d, './bus'}}, {@lowerdir={'lowerdir', 0x3d, './file0'}}, {@upperdir={'upperdir', 0x3d, './file1'}}]}) chdir(&(0x7f0000000380)='./bus\x00') close_range(0xffffffffffffffff, 0xffffffffffffffff, 0x2) r1 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000080)='cgroup.controllers\x00', 0x275a, 0x0) lseek(r1, 0x0, 0x1) ioctl$sock_SIOCGIFINDEX(0xffffffffffffffff, 0x8933, 0x0) chdir(&(0x7f0000000140)='./bus\x00') mkdirat(0xffffffffffffff9c, &(0x7f0000000180)='./file1\x00', 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000280)='./file0\x00', 0x0) ioctl$AUTOFS_IOC_PROTOSUBVER(r0, 0x40049366, &(0x7f0000000180)) executing program 2: r0 = syz_open_dev$sndctrl(0x0, 0x0, 0x0) ioctl$SNDRV_CTL_IOCTL_PCM_PREFER_SUBDEVICE(r0, 0x40045532, &(0x7f0000000040)) r1 = openat$audio(0xffffffffffffff9c, &(0x7f0000000100), 0x80002, 0x0) r2 = syz_open_dev$sndpcmp(&(0x7f00000001c0), 0x0, 0xa2c65) ioctl$SNDCTL_DSP_CHANNELS(r1, 0xc0045006, &(0x7f00000000c0)=0x9) writev(r2, &(0x7f0000000200)=[{&(0x7f0000000400)="a2", 0x1}], 0x1) executing program 2: r0 = openat$binderfs(0xffffffffffffff9c, 0x0, 0x0, 0x0) r1 = syz_open_dev$MSR(0x0, 0x0, 0x0) preadv(r1, 0x0, 0x0, 0x6e5f, 0x0) ioctl$BINDER_SET_CONTEXT_MGR_EXT(r0, 0x4018620d, 0x0) ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000400), 0x0, 0x0, 0x0}) ioctl$BINDER_SET_CONTEXT_MGR_EXT(0xffffffffffffffff, 0x4018620d, 0x0) ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, &(0x7f00000003c0)={0x0, 0x0, &(0x7f0000000000), 0x0, 0x0, 0x0}) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x20000008b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000080)=0x7) r2 = getpid() sched_setscheduler(r2, 0x2, &(0x7f0000000200)=0x7) socketpair$unix(0x1, 0x2, 0x0, 0x0) connect$unix(0xffffffffffffffff, &(0x7f0000000400)=@abs, 0x6e) sendmmsg$unix(0xffffffffffffffff, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(0xffffffffffffffff, &(0x7f00000000c0), 0x10106, 0x2, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000200)=0x4) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, 0x0, 0x0) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, 0x0, 0x0) sendmsg$IPCTNL_MSG_TIMEOUT_NEW(0xffffffffffffffff, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000100)={0x0}}, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000040)={0xffffffffffffffff, 0xffffffffffffffff}) sendmsg$inet(r4, &(0x7f0000001b00)={0x0, 0x0, 0x0, 0x0, &(0x7f0000001d80)=ANY=[@ANYBLOB="28010000000000000100000001"], 0x128}, 0x0) recvmsg$unix(r3, 0x0, 0x0) r5 = bpf$MAP_CREATE(0x0, &(0x7f0000000200)=@base={0xb, 0xc, 0x4, 0xc4f, 0x1, 0x1, 0x0, '\x00', 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, @void, @value, @void, @value}, 0x48) ioctl$KVM_RUN(r1, 0xae80, 0x0) bpf$MAP_UPDATE_BATCH(0x1a, &(0x7f0000000680)={0x0, 0x0, &(0x7f0000000100), &(0x7f0000000100), 0x6c7, r5}, 0x38) bpf$MAP_LOOKUP_BATCH(0x18, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180), &(0x7f0000000440), 0x23, r5}, 0x38) executing program 5: r0 = syz_open_dev$video(&(0x7f0000000000), 0x800000000233b, 0x141280) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000200)={0x18, 0x4, &(0x7f00000002c0)=ANY=[], &(0x7f0000000100)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x2, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0x0, @void, @value}, 0x94) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, 0x0, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x88}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000240)=0x7) r1 = getpid() sched_setscheduler(r1, 0x2, &(0x7f0000000200)=0x7) r2 = socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$IPT_SO_SET_REPLACE(r2, 0x0, 0x40, &(0x7f0000000800)=@raw={'raw\x00', 0x8, 0x3, 0x240, 0x1d0, 0x43, 0xa0, 0x1d0, 0x98, 0x318, 0x178, 0x178, 0x318, 0x178, 0x49, 0x0, {[{{@ip={@loopback, @local, 0x0, 0x0, 'veth0_to_bond\x00', 'ip6erspan0\x00'}, 0x12a, 0xb8, 0xd8, 0x0, {0x0, 0x7a010000}, [@common=@unspec=@helper={{0x48}, {0x0, 'ftp-20000\x00'}}]}, @unspec=@TRACE={0x20}}, {{@uncond, 0x0, 0x70, 0xd0}, @common=@inet=@HMARK={0x60, 'HMARK\x00', 0x0, {@ipv4=@multicast1}}}], {{'\x00', 0x0, 0x70, 0x98}, {0x28, '\x00', 0x4}}}}, 0x2a0) r3 = openat$vcs(0xffffffffffffff9c, &(0x7f00000003c0), 0x800, 0x0) fsconfig$FSCONFIG_SET_PATH_EMPTY(r3, 0x4, &(0x7f0000000400)='HMARK\x00', 0x0, 0xffffffffffffffff) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r4, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r5, &(0x7f0000000000), 0x651, 0x0) recvmmsg(r4, &(0x7f00000000c0), 0x10106, 0x2, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000000)=0x6) r6 = syz_open_dev$sndctrl(&(0x7f0000001440), 0x0, 0x0) ioctl$SNDRV_CTL_IOCTL_RAWMIDI_PREFER_SUBDEVICE(r6, 0xc0045520, 0xffffffffffffffff) r7 = openat$sndseq(0xffffffffffffff9c, &(0x7f0000000080), 0x0) ioctl$SNDRV_SEQ_IOCTL_CREATE_QUEUE(r7, 0xc08c5332, &(0x7f0000000180)={0x0, 0x0, 0x0, 'queue0\x00'}) r8 = openat$procfs(0xffffffffffffff9c, &(0x7f0000000500)='/proc/mdstat\x00', 0x0, 0x0) r9 = openat$sysctl(0xffffffffffffff9c, 0x0, 0x1, 0x0) sendfile(r9, r8, &(0x7f0000002080)=0x64, 0x23b) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000300)={0x1e, 0x4, &(0x7f0000000040)=ANY=[@ANYBLOB="180000000000000000000000208d0000000061381c0000000000950000000000"], &(0x7f0000000100)='syzkaller\x00', 0x0, 0x0, 0x0, 0x0, 0x44, '\x00', 0x0, 0x24, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0x0, @void, @value}, 0x94) ioctl$SNDRV_SEQ_IOCTL_SET_QUEUE_TIMER(r7, 0x40605346, &(0x7f0000000440)={0x0, 0x0, {0x0, 0x0, 0x0, 0x0, 0xd53}}) bind$802154_dgram(0xffffffffffffffff, &(0x7f0000000040)={0x24, @long={0x3, 0x0, {0xaaaaaaaaaaaa0002}}}, 0x14) ioctl$VIDIOC_G_EXT_CTRLS(r0, 0xc0205647, &(0x7f0000000100)={0x9d0000, 0x6, 0x716, 0xffffffffffffffff, 0x0, &(0x7f00000000c0)={0xa10905, 0xfffffffa, '\x00', @ptr=0x6}}) executing program 2: socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000140)={0xffffffffffffffff}) r1 = syz_usb_connect$hid(0x0, 0x36, &(0x7f0000000000)=ANY=[@ANYBLOB="12013f00000000407f04ffff000000000001090224000100000000090400001503000000092140000001220f00090581d7"], 0x0) syz_usb_control_io$hid(r1, 0x0, 0x0) syz_usb_control_io$hid(r1, &(0x7f0000001540)={0x24, 0x0, 0x0, &(0x7f0000000140)=ANY=[@ANYBLOB="00220f00000003a8407a730b93bf0280b3"], 0x0}, 0x0) r2 = syz_open_dev$hiddev(0x0, 0x0, 0x0) r3 = syz_open_dev$hiddev(&(0x7f00000000c0), 0x0, 0x0) ioctl$HIDIOCSREPORT(r3, 0x81044804, &(0x7f0000000400)={0x1}) ioctl$HIDIOCGUSAGE(r2, 0x40184810, 0x0) close_range(r0, 0xffffffffffffffff, 0x0) executing program 1: memfd_create(0x0, 0x4) socket$nl_route(0x10, 0x3, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000080)=0x7) r0 = getpid() sched_setaffinity(0x0, 0x0, 0x0) sched_setscheduler(r0, 0x2, &(0x7f0000000200)=0x6) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r1, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r2, &(0x7f0000000000), 0x651, 0x0) recvmmsg(r1, &(0x7f00000000c0), 0x10106, 0x2, 0x0) bpf$PROG_LOAD(0x5, 0x0, 0x0) socket$inet(0x2, 0x0, 0x0) setsockopt$SO_TIMESTAMP(0xffffffffffffffff, 0x1, 0x3f, 0x0, 0x0) socket$inet6_icmp_raw(0xa, 0x3, 0x3a) r3 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPSET_CMD_CREATE(r3, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000380)={0x48, 0x2, 0x6, 0x3, 0x0, 0x0, {0x5}, [@IPSET_ATTR_PROTOCOL={0x5, 0x1, 0x6}, @IPSET_ATTR_TYPENAME={0xd, 0x3, 'hash:net\x00'}, @IPSET_ATTR_SETNAME={0x9, 0x2, 'syz1\x00'}, @IPSET_ATTR_FAMILY={0x5, 0x5, 0x2}, @IPSET_ATTR_REVISION={0x5}]}, 0x48}}, 0x0) r4 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPSET_CMD_ADD(r4, &(0x7f0000000000)={0x0, 0x2000, &(0x7f0000000240)={&(0x7f0000000100)={0x38, 0x9, 0x6, 0x201, 0x0, 0x0, {}, [@IPSET_ATTR_SETNAME={0x9, 0x2, 'syz1\x00'}, @IPSET_ATTR_PROTOCOL={0x5}, @IPSET_ATTR_DATA={0x10, 0x7, 0x0, 0x1, [@IPSET_ATTR_IP={0xc, 0x1, 0x0, 0x1, @IPSET_ATTR_IPADDR_IPV4={0x8, 0x1, 0x1, 0x0, @empty=0xfffffffe}}]}]}, 0x38}, 0x1, 0x0, 0x0, 0x10000047}, 0x4000084) socket$nl_route(0x10, 0x3, 0x0) r5 = socket$nl_generic(0x10, 0x3, 0x10) r6 = syz_genetlink_get_family_id$nl80211(&(0x7f00000001c0), 0xffffffffffffffff) sendmsg$NL80211_CMD_SET_REG(r5, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000080)={0x24, r6, 0x1, 0x70bd28, 0x25dfdbfe, {}, [@NL80211_ATTR_REG_ALPHA2={0x6, 0x21, 'a\x00'}, @NL80211_ATTR_REG_RULES={0x8, 0x22, 0x0, 0x1, [{0x4}]}]}, 0x24}}, 0x4) fcntl$dupfd(0xffffffffffffffff, 0x0, 0xffffffffffffffff) executing program 5: syz_usb_connect$cdc_ncm(0x4, 0x6e, &(0x7f00000000c0)=ANY=[@ANYBLOB="12010000020000002505a1a440000102030109025c0002010000000904000001a3f45747d649f9a30105240000000d240f"], 0x0) creat(&(0x7f0000000240)='./file0\x00', 0x0) pipe2$9p(&(0x7f0000001900)={0xffffffffffffffff, 0xffffffffffffffff}, 0x0) syz_usb_connect$hid(0x6, 0x0, 0x0, 0x0) write$P9_RVERSION(r1, &(0x7f0000000500)=ANY=[@ANYBLOB="1500000065ffff0480000008003950323030"], 0x15) r2 = dup(r1) write$FUSE_BMAP(r2, &(0x7f0000000100)={0x18}, 0x18) write$FUSE_NOTIFY_RETRIEVE(r2, &(0x7f00000000c0)={0x14c}, 0x137) mount$9p_fd(0x0, &(0x7f0000000000)='./file0\x00', &(0x7f0000000040), 0x0, &(0x7f0000000180)={'trans=fd,', {'rfdno', 0x3d, r0}, 0x2c, {'wfdno', 0x3d, r2}, 0x2c, {[{@cache_mmap}], [], 0x6b}}) chmod(&(0x7f0000000140)='./file0\x00', 0x0) open$dir(&(0x7f0000000140)='./file0\x00', 0x82c02, 0x40) executing program 1: r0 = socket$inet6_tcp(0xa, 0x1, 0x0) close(r0) r1 = socket$inet6_mptcp(0xa, 0x1, 0x106) bind$inet6(r0, &(0x7f0000000080)={0xa, 0x4e22, 0x0, @empty}, 0x1c) listen(r1, 0x0) r2 = socket$inet_mptcp(0x2, 0x1, 0x106) connect$inet(r2, &(0x7f0000000000)={0x2, 0x4e22, @local}, 0x10) r3 = socket$nl_generic(0x10, 0x3, 0x10) r4 = syz_genetlink_get_family_id$mptcp(&(0x7f0000000000), 0xffffffffffffffff) sendmsg$MPTCP_PM_CMD_ADD_ADDR(r3, &(0x7f0000000400)={0x0, 0x0, &(0x7f00000003c0)={&(0x7f0000000140)=ANY=[@ANYBLOB, @ANYRES16=r4, @ANYBLOB="01000000000000000000010000002800018014000400fe880000000000000000000000000001060001000a000020080006008e"], 0x3c}}, 0x4000000) executing program 4: creat(&(0x7f0000000100)='./file0\x00', 0xd931d3864d39dcca) socket$nl_netfilter(0x10, 0x3, 0xc) socket$inet6_udplite(0xa, 0x2, 0x88) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000180)={&(0x7f0000000540)='rcu_utilization\x00'}, 0x10) write$uinput_user_dev(0xffffffffffffffff, 0x0, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000080)=0x6) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x0, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000200)=0x4) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0xbb34f000) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r0, &(0x7f0000000380)=@abs, 0x6e) sendmmsg$unix(r1, &(0x7f0000000000), 0x651, 0x0) recvmmsg(r0, &(0x7f00000000c0), 0x10106, 0x2, 0x0) getdents64(0xffffffffffffffff, &(0x7f00000000c0)=""/44, 0x2c) syz_io_uring_setup(0x360b, &(0x7f0000001040), 0x0, &(0x7f00000005c0)) executing program 1: socket$inet6(0x10, 0x3, 0xf) r0 = mq_open(&(0x7f00005a1ffb)='e\xeeQ\x92o', 0x42, 0x0, 0x0) r1 = dup2(r0, r0) mq_notify(r1, &(0x7f0000000000)={0x20000000, 0x4000000000003, 0x2}) read$FUSE(r1, 0x0, 0x0) executing program 1: r0 = syz_open_dev$video(&(0x7f0000000000), 0x800000000233b, 0x141280) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000200)={0x18, 0x4, &(0x7f00000002c0)=ANY=[], &(0x7f0000000100)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x2, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0x0, @void, @value}, 0x94) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, 0x0, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x88}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000240)=0x7) r1 = getpid() sched_setscheduler(r1, 0x2, &(0x7f0000000200)=0x7) r2 = socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$IPT_SO_SET_REPLACE(r2, 0x0, 0x40, &(0x7f0000000800)=@raw={'raw\x00', 0x8, 0x3, 0x240, 0x1d0, 0x43, 0xa0, 0x1d0, 0x98, 0x318, 0x178, 0x178, 0x318, 0x178, 0x49, 0x0, {[{{@ip={@loopback, @local, 0x0, 0x0, 'veth0_to_bond\x00', 'ip6erspan0\x00'}, 0x12a, 0xb8, 0xd8, 0x0, {0x0, 0x7a010000}, [@common=@unspec=@helper={{0x48}, {0x0, 'ftp-20000\x00'}}]}, @unspec=@TRACE={0x20}}, {{@uncond, 0x0, 0x70, 0xd0}, @common=@inet=@HMARK={0x60, 'HMARK\x00', 0x0, {@ipv4=@multicast1}}}], {{'\x00', 0x0, 0x70, 0x98}, {0x28, '\x00', 0x4}}}}, 0x2a0) r3 = openat$vcs(0xffffffffffffff9c, &(0x7f00000003c0), 0x800, 0x0) fsconfig$FSCONFIG_SET_PATH_EMPTY(r3, 0x4, &(0x7f0000000400)='HMARK\x00', &(0x7f00000004c0)='./file0\x00', 0xffffffffffffffff) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r4, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r5, 0x0, 0x0, 0x0) recvmmsg(r4, &(0x7f00000000c0), 0x10106, 0x2, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000000)=0x6) r6 = syz_open_dev$sndctrl(&(0x7f0000001440), 0x0, 0x0) ioctl$SNDRV_CTL_IOCTL_RAWMIDI_PREFER_SUBDEVICE(r6, 0xc0045520, 0xffffffffffffffff) r7 = openat$sndseq(0xffffffffffffff9c, &(0x7f0000000080), 0x0) r8 = openat$procfs(0xffffffffffffff9c, &(0x7f0000000500)='/proc/mdstat\x00', 0x0, 0x0) r9 = openat$sysctl(0xffffffffffffff9c, 0x0, 0x1, 0x0) sendfile(r9, r8, &(0x7f0000002080)=0x64, 0x23b) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000300)={0x1e, 0x4, &(0x7f0000000040)=ANY=[@ANYBLOB="180000000000000000000000208d0000000061381c0000000000950000000000"], &(0x7f0000000100)='syzkaller\x00', 0x0, 0x0, 0x0, 0x0, 0x44, '\x00', 0x0, 0x24, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0x0, @void, @value}, 0x94) ioctl$SNDRV_SEQ_IOCTL_SET_QUEUE_TIMER(r7, 0x40605346, &(0x7f0000000440)={0x0, 0x0, {0x0, 0x0, 0x0, 0x0, 0xd53}}) bind$802154_dgram(0xffffffffffffffff, &(0x7f0000000040)={0x24, @long={0x3, 0x0, {0xaaaaaaaaaaaa0002}}}, 0x14) ioctl$VIDIOC_G_EXT_CTRLS(r0, 0xc0205647, &(0x7f0000000100)={0x9d0000, 0x6, 0x716, 0xffffffffffffffff, 0x0, &(0x7f00000000c0)={0xa10905, 0xfffffffa, '\x00', @ptr=0x6}}) ioctl$VIDIOC_QUERYBUF_DMABUF(r0, 0xc0585609, &(0x7f0000000040)={0x0, 0xd, 0x4, 0x1000, 0x1, {0x77359400}, {0x3, 0xc, 0xf3, 0x1, 0x9, 0x6, "1725bb85"}, 0xf70, 0x4, {}, 0x10000}) executing program 5: r0 = socket$kcm(0x10, 0x3, 0x10) r1 = bpf$PROG_LOAD(0x5, &(0x7f0000000200)={0x11, 0x3, &(0x7f0000000140)=ANY=[@ANYBLOB="180000000000000000000000000000ac30cc90bb0c075e2eceb36e009500000000000000"], &(0x7f0000000040)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @void, @value}, 0x94) r2 = openat$nvme_fabrics(0xffffffffffffff9c, &(0x7f0000000000), 0x141002, 0x0) write$ppp(r2, &(0x7f0000000040), 0x100000) sched_setscheduler(0x0, 0x1, &(0x7f0000000080)=0x7) r3 = getpid() sched_setaffinity(r3, 0x8, &(0x7f0000000040)=0x2) sched_setscheduler(r3, 0x2, &(0x7f0000000200)=0x4) connect$unix(0xffffffffffffffff, 0x0, 0x0) sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x400000bce) r4 = syz_open_dev$MSR(&(0x7f0000000a40), 0x0, 0x0) read$msr(r4, &(0x7f0000019680)=""/102392, 0x18ff8) keyctl$restrict_keyring(0x3, 0xfffffffffffffffb, 0x0, 0x0) mkdir(&(0x7f0000000300)='./file0\x00', 0xa3) mremap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x4000, 0x3, &(0x7f0000005000/0x4000)=nil) open(&(0x7f0000000180)='./bus\x00', 0x14927e, 0x0) open(&(0x7f0000000100)='./bus\x00', 0x14113e, 0x0) socket$nl_route(0x10, 0x3, 0x0) setgid(0xffffffffffffffff) semctl$SETALL(0x0, 0x0, 0x9, &(0x7f0000000040)) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f00000001c0)={&(0x7f0000000180)='kfree\x00', r1}, 0x10) sendmsg$kcm(r0, &(0x7f0000000000)={0x0, 0xd18c9b25, &(0x7f0000000080)=[{&(0x7f0000000040)="e03f03002a000b06d25a806c8c6f94f90424fc600400037a0a000900050282c137153e370e0c1180fc0b10000300", 0x33fe0}], 0x1}, 0x0) r5 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r5, &(0x7f000000c2c0)={0x0, 0x0, &(0x7f0000000200)={&(0x7f00000003c0)=ANY=[@ANYBLOB="140000001000010000000000000000000000000a28000000000a0101000000005e1affd5020000000900010073797a300000000008000240000000032c000000030a01030000e6ff00000000020000000900010073797a30000000000900030073797a320000000014000000110001"], 0x7c}}, 0x0) sendmsg$NFT_BATCH(r5, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000b00)={&(0x7f0000000280)={{0x14, 0x10, 0x1, 0x0, 0x0, {0xa}}, [@NFT_MSG_NEWRULE={0x70, 0x6, 0xa, 0x401, 0x0, 0x0, {0x2}, [@NFTA_RULE_EXPRESSIONS={0x38, 0x4, 0x0, 0x1, [{0x34, 0x1, 0x0, 0x1, @match={{0xa}, @val={0x24, 0x2, 0x0, 0x1, [@NFTA_MATCH_NAME={0x8, 0x1, 'udp\x00'}, @NFTA_MATCH_INFO={0xe, 0x3, "7acc6338a90000b03bd9"}, @NFTA_MATCH_REV={0x8}]}}}]}, @NFTA_RULE_TABLE={0x9, 0x1, 'syz0\x00'}, @NFTA_RULE_CHAIN={0x9, 0x2, 'syz2\x00'}, @NFTA_RULE_COMPAT={0xc, 0x5, 0x0, 0x1, [@NFTA_RULE_COMPAT_PROTO_IPV4={0x8, 0x1, 0x1, 0x0, 0x5c}]}]}], {0x14}}, 0x98}}, 0x4) sendmsg$kcm(r0, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000080)=[{&(0x7f0000000100)="e03f03002a000b05d25a806c8c6f94f90524fc600400037a0a000900050282c137153e370e0c1180fc0b1000", 0x2c}], 0x1}, 0x0) executing program 0: r0 = socket$inet(0x2, 0x4000000000000001, 0x0) setsockopt$inet_tcp_int(r0, 0x6, 0x80000000000002, &(0x7f00000000c0)=0x2000000000000074, 0x25d) bind$inet(r0, &(0x7f0000000080)={0x2, 0x4e23, @multicast1}, 0x10) setsockopt$SO_ATTACH_FILTER(r0, 0x1, 0x1a, &(0x7f0000000480)={0x1, &(0x7f0000000400)=[{0x6, 0x0, 0x0, 0xe8}]}, 0x10) sendto$inet(r0, 0x0, 0x0, 0x200007fd, &(0x7f0000e68000)={0x2, 0x4e23, @local}, 0x10) sendmmsg$inet(r0, &(0x7f0000000a80)=[{{0x0, 0x0, &(0x7f0000000380)=[{&(0x7f0000001340)="45f9e8e5af9f7e488a1619ea0cd4902570249f1e29b175dfa0d3ae9be1933b972b8376966d432045a33e064403006bdb8ef95b90e76baae34f74778049ff8fa4a59adf7623aaddb922b32dbbfda740b88a07e87eb2cd97c0393db1036a1ec8a376c919cdd0b40dbb899c07f1349c7a1113f57495c795bc7e38166a7bdef463457189549f4b13279fffd050bdfea3477a62d3edea8321a2e98c65330fe7199ca6bee7202aa5a5d56c4ed4c22dbb28cebcaec033c75eb78820ad1d8ceb6f90b569e165002e702e1a206666d3c9d903ce78c73f778eae82d58317c634016a3e01ae29607f7b5ff253c607e4f60c0aa49021205073cdd574a3d4c25fbf79cc8ac99ff149ae54aa56286204e628dc2dfe4384ef74c8dac04ace6c5762d03f9e19942e4b6bbbb41fefc569cc23b3319d4ebc55551fecf8f936221e9787e744f2e1422baaa25b2f5bf59205190b7fe52f0641f149c5e00b764c493afadeaa04324783c268f48772b1c532d52d211865704db5fbafc3193385adc9855a1ad9ea0c05479329efd6c08ed22c5656eab2ea050f53bf441a9dfb4157d14b99214fa59b8b0e53200795762145a63d61c5c526edb03429e1e14072e1d7dff102fdb9801234bbbb8e0274a861dd60f3a21f129326b2f6fee61f690fa3967cdc5f6f9519282c48e28d6aa7d1b0ed07bdd72ebf1dd97b46f24ffde352095f4bffd6fdd0b9f0d60f16746f1c1ec46656cf94ae2237540c558c1863fb2ffd4619e5ee5b7aa5757e252b821e003fcef57f33cd70f19ec0b5f8098c030741147e8e4319109892fd56b22d261800b7107a393b9a7d835383e3504f5f2794f30914c4f8145ed446a06e3787eb32ab90abf595d45013c8b6d9c26cf4e60812b02427a4d2a8dcbdfaf8ace4e17f0f598676a5f26dc3615eddea77e1d68c857fbe2b39b67ccacd6afcea94b4f9592490c1a51e11f4ffc6dd4d4cdc44995b09864743b906e07a12c93045b654abf2faaf1127ee92698e09efee1d8d45ceb103973c3d1d5c98090d9af08789f867873bbeb522cb367bacaf2d94bc6fa7aab57b542af353d693230a3da636762204d96f2889f7decc9ad3992a8be2be92bdd6a7367bd64c8604ec219a92c80a7536f218926b5d18677f4bc22454a843f7ec6bfaadaec1a47896f902725cddc264226a0c7f673468459528101da2368d77d37d9ae6d52cb44efb9b5af74fdd4c8341980d7b3f4a3176c8de3c3a0144e3f327fcb30c6bda7a62ec37215367d06ef1b85fa2bc329fe99071f65b0d5a48b50139016b0753bc99c389f4aba551bf2da38b78e7b4dbb3be3ecf8749b39a022c86febf3a30070def590bd2a9cb0f95d09eac8de27c370d758e340193773a7dfbb2046e0b2e34bef073ed8368f4fbf464205fbac66fbe88c3260f6974b383bcf8a000db483d822536000df416d09dfc55c920cbc3c8b24af1757099903759e9312b576b9f04e61ae20a60d7d0ce978d193dbf9e7a20c04b4f985936402823feb4c045be085b565c283602d9f4c7efe1db4d81f126855712cb5d9cc86250c4b81f4cd823b4b3204d5e88c77f671b93f8ca0d7846a4eb429ab9aa3c8283e3aabe", 0x46d}, {&(0x7f0000000140)}, {&(0x7f00000008c0)="8dd02c84b2879cda3ac86e4f8b37cd5bb2ded969c7af1fda16fd993357272aa0ac47d2bdf61023ade89fc6ae83aafa658a710a37450d827cdb74ada27cf88dfaa710f4ee42dd29fb198b336aa346b8be041032258e696475f498a50ae6fd61b1acf1b0a464439080427910", 0x6b}, {&(0x7f0000000e40)="db3b30b033f751a8941fa50a6ce5a89f135f4a7c133dc59e69c47b031089a0bc903090ea485d000000000000ce255c18d98171d69e442f6f2b25bcba1a4a00afabdaa3c94e6c3ec214024f4762e3f789a9f234958912e5e133f68d63fb2e84ad7a54d22b975d24fa9f4a3c95f0da01034a4fc583b6d76dc8cac15fbf6b97b169a191", 0x82}], 0x4}}, {{&(0x7f0000000000)={0x2, 0x4e21}, 0x10, &(0x7f0000000100)}}, {{0x0, 0x0, &(0x7f0000000640)=[{&(0x7f00000009c0)="f8318c5400"/16, 0x10}, {&(0x7f0000000180)="819eb7578a35e734a89ec80c62ad11d2ae7c20c21805daba5b2c24e1955ca3e803fb711791ae18c2c47207521d27078194f946eb72d3c0bdcf2b45604891a4f4c97943f1bc471322b64e19ae69a0db0ade5f4fe526b7c53c54d5035122a1ba6a39429d103dbde06ea01c3ac2c0f10c9a5f4352674164ff82c3426e08f17c7f6e6d1c428c52b6975e9a809adb99a233e5d594f3dd0644393b66bab7082076c2b82143f0de2593a8c8c93a7ec423c9de9876", 0xb1}, {0x0}, {&(0x7f0000000280)="0329018aa7ffac8036393cab909e0cf574e5627200f26872a5b2f7035050a7790c79fd18ee42d98d46b1049e9ba8de8d3368fe6bf6dcca433bab06e2af50bda0c7c6ef922258f43b874a6b229f0fce001a42854cd3596e69a74899", 0x5b}, {&(0x7f00000004c0)="9b9db56562609eb8138ea5d9bb6f25d12a36bc8b411275e87edfda5f32db7870e9c275dbad29d186e55b88f7d3ae69bdc364c5191094ae08d29a76a5c1b97f172a96082bb89a", 0x46}, {&(0x7f00000017c0)="23883a0888bc4a4c60c8cffed70571bc80e4af4e4bc88add1ad97b101abbcc23c9c138b983b1c810466165c3608cfdf54fb0ac214ec97affb629108f1845981fd8e25bb980e1b67798c3318810b1cdedabb1f7c195fd7d161f1ec0cfbd1c1ea7d5603bb4eb67c8e55dbe93d52bfe309c60dc07a6fe9d5296bcf57b4f4a38bca0107d4d04d2a369442c3caf4a6c3976051d819f9a3e835abbcbed88c085217f0d696e5a43b02c219a1d5a8e31520fc100a7f96904127ddd2abc25dbcad13e46d0872f61ff3352c07497451d46930aead6a1367023978fd7916001b4d0dd3163d2119c8e1a0610b15c8a9cb70d397e3b8096dd26ae2b399ea5f70c64e21df75c1aa448f2c584d284f2e4f1354f9930129f952784ab20196b630f253ad751f52d793d15ddf639be9b4a9bea04c071624c7117933a7bab3ff8db32fcaf7f72ca2cd8ff2e0ffc0775803f3b0bff13e03be752891124f9cabd9f96e538df6c4bd1a2da880af54a29d7627d99e2612ed7ae999d16437c7e403e1e5f44f73f2eb1c5a064813671fb8405e18cd223b032586aae7f5932c13ee3f737110cf5772d0e9003549e93b94bab464d335e86bf89c166f09656de4fa40e4f977c9d475c19d851bc4136e0361594b08ad39fa1874dcbc4a1b9753a26655084fa3a810b423534d6e3771c523a0f77f4b5d901e6b537c6b9fca60ebcbd71ca56ce5224508c4a2f91737707e149484e3a079fbf3a91b1b57766c6c1ece15b3bca6d22a74a5395ed5244a1446ee2f4d1f244a21f9b674d4d39730c539d47b86fa9a75dc077982e92f747a8f90e67e9e568035da14c0d442e7b9cc64fa5efc97c1e9f174867c499c9dce80bdbc41aadb6150a005fb537b772bc8d23be38584012b4b47d5614f37beaa4d1635e4ffdff30084e65c1a9bba0bbafbbf0142e58c0c5fe0498b5e2b3c978f08a8661b5eb4120996ed0d53e7e88dfdb7eae0695554e49295d6c521e557ca6df0ec6f792923b0cd634f43b301c871709ed1d1e3e8634b2e74746c91af1d1868865b236c33ef908b9c827773055af6fabdc01f9bced7992d2b080c78aa73a5946c7651468ff6d9debf0ebacb281de59f0921a7071e55cc62b65c3c49b0563effc48eef523ec15aefb3f0568c490e79fd728e5d7b5927983a883a4a3d46b447eb00c84a9e2b74dc8210631fa7884d2adcd77de8620bd9222840efa69062f2b3c8a95410e426b749b011084097db65dcadc7b7e325f703bc7217919259a8c88ad9f36cb399c2e92feadff50685bd565de3616e8f699cba83f29e4806170292d6ae788bb1f242a5f35453e40a4b5f694056043149885aeb6ffbf305408b5abc95a81b606b9fbdf7f26aba6f64fb44d2d2a407c240a7411d3792b3679eb7a5fce4cb86d6f538f390b3994731a6a794d493c3507bee4f70122f040cbd51dee5e643f73007a94b20798bfe0060e07861369a14add1e44640d0dbc35688d3208cb59301632c9faa7867a0d50fe04654ce9d02790b5be281c883d99a836c011abfac5be824e453711c40a6e3881848b590c32fd7b561a40665382a497732a8287c2b36320447fbfd0680bcd2a23ce35fbb7e4a3a250562df09ea63e0823b8ce5c13a4af0e7dc0ed1553422d0bc498b48ce7d9c220ac896881559e3ba60abfc7008a675c25df0ff75d82b111428686cd6fb457a806aed8600eeda67ed55d87a7684ec070ee6b1ed9b23364cc09bf8f09406c1d86e8a5753e123cf233db29fd0b433037d1fca3db74077441dcc790f723a71a1a7d08a9829dab50fe0a3d2d29fc1d43c63ac7bc6873d03921bb5f10a0149b773d40be220610ea0151c11c4d582c5c02ba48af10d5b1d69f1ae4f12aa3be4f90e3621e33500781db38615497c71e561d6f598c42ec81671591f662cfadf1675a6a709a834801258a56dc1eb8480f32946579c5e06b8340d4f06d948220dd04661ba4f63ab5f0a42c2f3632eee8693a5fa6e1eb9146791a054ca27d0e8c7c5f44b27bd8f35575808fd7eab1af676d20d0668acea5556b20ce1ebf42d805374bd23734d4046530b4efa5351f3df08cfc9bf0e13d47bd1acb8388a78f5a66045ec6199cec6c9e7e4aeefa854522e42a96c919bcbcb3de116da43b9f322b9159e0a80e6de7e499743fb0b36ac148f2674cd4840206c3c8a7c80b8544487ed1def3b248267ddb54ee228638e0ecb31955bf64d1bff6c4db02f06927fd68139c0c798a2dfac5d41b49c2aa18451a6b161d1d1edd9bd08d87e0418c14cdd56f01416ca05aa4604b26e4828906d1c238ec9c4fcb9add701418fa09bd4a37e22cc0cf229c35b056e324cf904e9125d522b529a85e9631d7bf345c771f397f35375334520a873697a9b96301579ff4d83e1f3777240235ca1e2b673a8afd0f6c353ac17952cee1e0e9e6bcbea273b5336c5a8cfaff36577954c33598c0bdd059ed72ec44e13e93329375adb872c191cb4729c3170276271aad5ab3d28c1b054addd77112708b3a69461c5f660be0e1aaf2f391e44805344cf7dcf7f7f0c2f6f04715611ca37c8bb0de23d6956f8a5ba1cf25392db32336929cb50721865341a07bbc59c2dcebb9656b02ee3fe29c0326661ee03cb15b299da14822bd0386e0d5118ebd38389ce545532b3331409652fafe6b1f8532da2260c9bff61da44565e2624c88148d0c58ff772503fc5b7f66843b591dd2dde4e4c02b94", 0x780}, {0x0}, {0x0}], 0x8, &(0x7f00000003c0)=[@ip_ttl={{0x14}}, @ip_tos_int={{0x14, 0x0, 0x1, 0x4}}], 0x30}}], 0x3, 0x0) executing program 0: unshare(0x62040200) mkdirat(0xffffffffffffff9c, &(0x7f0000000080)='./file1\x00', 0x0) mount$fuse(0x0, 0x0, 0x0, 0x0, &(0x7f0000000400)=ANY=[@ANYBLOB='fd=']) mount(0x0, &(0x7f0000000380)='./file1\x00', &(0x7f0000000040)='autofs\x00', 0x0, &(0x7f0000000400)) chdir(&(0x7f0000000080)='./file1\x00') r0 = open(&(0x7f0000000000)='.\x00', 0x0, 0x0) mkdir(&(0x7f0000000040)='./file0\x00', 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000400)='./file1\x00', 0x0) mkdirat(0xffffffffffffff9c, &(0x7f00000000c0)='./bus\x00', 0x0) mount$overlay(0x0, &(0x7f00000000c0)='./bus\x00', &(0x7f0000000080), 0x0, &(0x7f0000000400)={[{@workdir={'workdir', 0x3d, './bus'}}, {@lowerdir={'lowerdir', 0x3d, './file0'}}, {@upperdir={'upperdir', 0x3d, './file1'}}]}) chdir(&(0x7f0000000380)='./bus\x00') close_range(0xffffffffffffffff, 0xffffffffffffffff, 0x2) r1 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000080)='cgroup.controllers\x00', 0x275a, 0x0) lseek(r1, 0x0, 0x1) ioctl$sock_SIOCGIFINDEX(0xffffffffffffffff, 0x8933, 0x0) chdir(&(0x7f0000000140)='./bus\x00') mkdirat(0xffffffffffffff9c, &(0x7f0000000180)='./file1\x00', 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000280)='./file0\x00', 0x0) ioctl$AUTOFS_IOC_PROTOSUBVER(r0, 0x40049366, &(0x7f0000000180)) executing program 4: socket$inet_icmp_raw(0x2, 0x3, 0x1) syz_emit_ethernet(0x66, &(0x7f0000000080)={@random="9de05b7bd0c8", @random="2b89a1b7a248", @void, {@ipv4={0x800, @icmp={{0x5, 0x4, 0x0, 0x0, 0x58, 0x0, 0x0, 0x0, 0x1, 0x0, @initdev={0xac, 0x1e, 0x0, 0x0}, @local}, @time_exceeded={0x5, 0x0, 0x0, 0x3, 0x0, 0x0, {0xf, 0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, @dev={0xac, 0x14, 0x14, 0x2e}, @multicast2, {[@timestamp_addr={0x44, 0x14, 0x0, 0x1, 0x0, [{@dev={0xac, 0x14, 0x14, 0xf}}, {@empty}]}, @timestamp_prespec={0x44, 0x14, 0x0, 0x3, 0x0, [{@local}, {@loopback}]}]}}}}}}}, 0x0) executing program 1: bpf$MAP_CREATE_TAIL_CALL(0x0, &(0x7f00000007c0)=ANY=[@ANYBLOB="0300000004000000040000000a00000000000000", @ANYRES32=0x0, @ANYBLOB='\x00'/20, @ANYRES32=0x0, @ANYRES32=0x0, @ANYBLOB="000000000000000000000000000000000000000000000000000000002488b2f9e74580af107c0e1d82e10ec48719c67c3a2c410e56c69d665be4d063622980f8cb451837ec40c83579dab92e8f84c849607fcefb8f68d30f5cef9a27821ae15259e0a5f3fde268d4d90d504f96fd259153f0a0e56e8348de69c712c4745807e57b8037dcc4948ce942ee622e67b803a7993e63813551380de1382064638f188d433efa8caab4bcf04b55d3a2778b35cf869574e55126edb0a866c8c2210811f626e123984c1578eea143687583ec9cd45399277cba"], 0x48) openat$cgroup_root(0xffffffffffffff9c, 0x0, 0x200002, 0x0) openat$cuse(0xffffffffffffff9c, 0x0, 0x2, 0x0) write$cgroup_pid(0xffffffffffffffff, &(0x7f0000000500), 0x3) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x400000bce) r0 = syz_open_dev$MSR(&(0x7f0000000300), 0x100040000, 0x0) read$msr(r0, &(0x7f0000019680)=""/102392, 0x18ff8) write$cgroup_pid(0xffffffffffffffff, &(0x7f00000001c0), 0x12) r1 = syz_open_dev$usbfs(&(0x7f0000000100), 0x206, 0x8401) ioctl$USBDEVFS_ALLOW_SUSPEND(r1, 0x5522) ioctl$USBDEVFS_CONTROL(r1, 0xc0185500, &(0x7f0000001380)={0x0, 0x10, 0xf109, 0x8, 0x0, 0x4, 0x0}) getsockopt$IP_VS_SO_GET_DAEMON(0xffffffffffffffff, 0x0, 0x487, &(0x7f0000000040), &(0x7f00000000c0)=0x30) r2 = syz_init_net_socket$x25(0x9, 0x5, 0x0) sendmsg$NFT_BATCH(0xffffffffffffffff, &(0x7f000000c2c0)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000340)=ANY=[@ANYBLOB="140000001000010000000000000000000000000a28000000000a0101000000005e1affd5020000000900010073797a300000000008000240000000032c000000030a01030000e6ff00000000020000000900010073797a30000000000900030073797a320000000014000000110001"], 0x7c}}, 0x0) sendmsg$NFT_BATCH(0xffffffffffffffff, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000540)=ANY=[@ANYBLOB="14005dd31000010000000000000000000200000a54000000060a0b04000000000000002800048024000180090001006d6574610000000014000280080002400000000e080003ff000000000900010073797a30000000000900020073797a3200000000140000001100010000000000000000000000000a0000bcd9392755d0553208396b1104bd0138b9d4dcc29076671bfcd406a184eee3783779b059bf3c1d3a573e716c57ed4ab238d496fa0d3fb51054a62d7055d068124ff4184e12a61862bc0120f727e9e5c7ae925054af63819ba5f79d772ba27895dc48a6796db8d6b142c81e1c43cc58e8cef58790fddf4278fde59f4d57d0f4cb44e9f041ba703fb942342396717badaae97c20475dabfd374400"/284], 0x7c}}, 0x0) getsockopt$X25_QBITINCL(r2, 0x106, 0x1, 0x0, &(0x7f0000000240)=0xfffffffffffffee0) add_key(&(0x7f0000000140)='encrypted\x00', &(0x7f0000000180), &(0x7f0000000100), 0xca, 0xfffffffffffffffe) r3 = socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$inet_opts(r3, 0x0, 0x80000000000008, &(0x7f0000000280)="0f", 0x1) r4 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000040)='cpuacct.usage_sys\x00', 0x275a, 0x0) mmap(&(0x7f0000000000/0x400000)=nil, 0x400000, 0x1, 0x10012, r4, 0x0) getsockopt$inet_opts(r3, 0x0, 0x9, &(0x7f0000000200)=""/49, &(0x7f0000000080)=0x31) futex(&(0x7f0000000000), 0x9, 0x2, 0x0, &(0x7f0000000340)=0x2, 0x0) executing program 0: r0 = syz_open_dev$video(&(0x7f0000000000), 0x800000000233b, 0x141280) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000200)={0x18, 0x4, &(0x7f00000002c0)=ANY=[], &(0x7f0000000100)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x2, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0x0, @void, @value}, 0x94) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, 0x0, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x88}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000240)=0x7) r1 = getpid() sched_setscheduler(r1, 0x2, &(0x7f0000000200)=0x7) r2 = socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$IPT_SO_SET_REPLACE(r2, 0x0, 0x40, &(0x7f0000000800)=@raw={'raw\x00', 0x8, 0x3, 0x240, 0x1d0, 0x43, 0xa0, 0x1d0, 0x98, 0x318, 0x178, 0x178, 0x318, 0x178, 0x49, 0x0, {[{{@ip={@loopback, @local, 0x0, 0x0, 'veth0_to_bond\x00', 'ip6erspan0\x00'}, 0x12a, 0xb8, 0xd8, 0x0, {0x0, 0x7a010000}, [@common=@unspec=@helper={{0x48}, {0x0, 'ftp-20000\x00'}}]}, @unspec=@TRACE={0x20}}, {{@uncond, 0x0, 0x70, 0xd0}, @common=@inet=@HMARK={0x60, 'HMARK\x00', 0x0, {@ipv4=@multicast1}}}], {{'\x00', 0x0, 0x70, 0x98}, {0x28, '\x00', 0x4}}}}, 0x2a0) r3 = openat$vcs(0xffffffffffffff9c, &(0x7f00000003c0), 0x800, 0x0) fsconfig$FSCONFIG_SET_PATH_EMPTY(r3, 0x4, &(0x7f0000000400)='HMARK\x00', &(0x7f00000004c0)='./file0\x00', 0xffffffffffffffff) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, 0x0) connect$unix(0xffffffffffffffff, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(0xffffffffffffffff, &(0x7f0000000000), 0x651, 0x0) recvmmsg(0xffffffffffffffff, &(0x7f00000000c0), 0x10106, 0x2, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000000)=0x6) r4 = syz_open_dev$sndctrl(&(0x7f0000001440), 0x0, 0x0) ioctl$SNDRV_CTL_IOCTL_RAWMIDI_PREFER_SUBDEVICE(r4, 0xc0045520, 0xffffffffffffffff) r5 = openat$sndseq(0xffffffffffffff9c, &(0x7f0000000080), 0x0) ioctl$SNDRV_SEQ_IOCTL_CREATE_QUEUE(r5, 0xc08c5332, &(0x7f0000000180)={0x0, 0x0, 0x0, 'queue0\x00'}) r6 = openat$procfs(0xffffffffffffff9c, &(0x7f0000000500)='/proc/mdstat\x00', 0x0, 0x0) r7 = openat$sysctl(0xffffffffffffff9c, 0x0, 0x1, 0x0) sendfile(r7, r6, &(0x7f0000002080)=0x64, 0x23b) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000300)={0x1e, 0x4, &(0x7f0000000040)=ANY=[@ANYBLOB="180000000000000000000000208d0000000061381c0000000000950000000000"], &(0x7f0000000100)='syzkaller\x00', 0x0, 0x0, 0x0, 0x0, 0x44, '\x00', 0x0, 0x24, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0x0, @void, @value}, 0x94) ioctl$SNDRV_SEQ_IOCTL_SET_QUEUE_TIMER(r5, 0x40605346, &(0x7f0000000440)={0x0, 0x0, {0x0, 0x0, 0x0, 0x0, 0xd53}}) bind$802154_dgram(0xffffffffffffffff, &(0x7f0000000040)={0x24, @long={0x3, 0x0, {0xaaaaaaaaaaaa0002}}}, 0x14) ioctl$VIDIOC_G_EXT_CTRLS(r0, 0xc0205647, &(0x7f0000000100)={0x9d0000, 0x6, 0x716, 0xffffffffffffffff, 0x0, &(0x7f00000000c0)={0xa10905, 0xfffffffa, '\x00', @ptr=0x6}}) executing program 4: ioctl$sock_SIOCGIFINDEX(0xffffffffffffffff, 0x8933, 0x0) bpf$MAP_CREATE(0x0, 0x0, 0x0) r0 = socket$nl_route(0x10, 0x3, 0x0) r1 = socket$inet6_udp(0xa, 0x2, 0x0) ioctl$sock_SIOCGIFINDEX(r1, 0x8933, &(0x7f0000000040)={'lo\x00'}) sendmsg$nl_route_sched(r0, &(0x7f00000012c0)={0x0, 0x0, &(0x7f0000000000)={0x0}}, 0x0) r2 = socket$inet6(0xa, 0x806, 0x0) bind$inet6(r2, &(0x7f0000000080)={0xa, 0x4e23}, 0x1c) listen(r2, 0xfffffffd) r3 = socket$inet_dccp(0x2, 0x6, 0x0) connect$inet(r3, &(0x7f0000772000)={0x2, 0x4e23}, 0x10) r4 = accept4(r2, 0x0, 0x0, 0x0) sendmmsg(r4, &(0x7f0000001500), 0x588, 0x20) executing program 4: prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) r0 = getpid() sched_setscheduler(r0, 0x1, &(0x7f0000000200)=0x6) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, 0x0) sendmmsg$unix(0xffffffffffffffff, &(0x7f0000000000), 0x651, 0x0) r1 = syz_open_dev$evdev(&(0x7f00000000c0), 0x3f, 0x822f01) sendmsg$nl_route(0xffffffffffffffff, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000001140)={&(0x7f0000000700)=ANY=[@ANYBLOB="4800000002000000000000002000000000000000", @ANYRES32=0x0, @ANYBLOB="00000000000000002800168024000180100002000000000000000000000000000c00040000000000"], 0x48}}, 0x0) r2 = openat$mice(0xffffffffffffff9c, &(0x7f0000000180), 0x0) read$FUSE(r2, 0x0, 0x0) write$char_usb(r1, &(0x7f0000000040)="e2", 0x918) executing program 0: r0 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) prlimit64(0x0, 0xe, &(0x7f0000000040)={0x8, 0x420000008b}, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000080)=0x7) r1 = getpid() sched_setscheduler(r1, 0x2, &(0x7f0000000200)=0x7) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r2, &(0x7f0000000180)=@abs, 0x6e) sendmmsg$unix(r3, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r2, &(0x7f00000000c0), 0x10106, 0x2, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000200)=0x4) r4 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000200)={0x18, 0x4, &(0x7f00000002c0)=ANY=[@ANYBLOB="18010000000000000000000000000000850000006d00000095"], &(0x7f0000000100)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x2, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0x0, @void, @value}, 0x90) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000080)={&(0x7f0000000000)='sched_switch\x00', r4}, 0x10) socketpair$unix(0x1, 0x2, 0x0, 0x0) socket$packet(0x11, 0x3, 0x300) syz_init_net_socket$ax25(0x3, 0x5, 0x0) r5 = ioctl$TIOCGPTPEER(0xffffffffffffffff, 0x5441, 0xea) ioctl$BTRFS_IOC_RM_DEV(r0, 0x5000940b, &(0x7f0000000240)={{r5}, "e26c6e0554a143b9bcba21b99bd59c17c586067a9ffb74651ccdeca5bb2e356e0b4355c6707e5f71078f6c23d0107910ccfb15af78ed4e1bf9e2a1e60cd835efa672662d9662df850be5bf7a864c8aa065da4098d39d75367be62d06c67e861d3b08aacfc243ce2e05d597655fdbeb46033792294c1cbcc45acf869bde53ab85d2556770ebc6f4f783910638133dee0e256e744b41c5385ead8c9322a56c105d82507d5c79efdc13bccbcea15b159dca01677644327a6c40ddf4755650b1c9be81f35832c3c4bdfae5bc93d5aa9339e5a4681be1f09437ab3005b3741afb2380cd1a95927552282880a0162c1dd269c913e6fa8468c25d15c1c80da2011c22743797a1f5da116edafcc5b696c5a75bd9bb9df1274ce535c483c35b2dafe76441bec40f33bfd5f5eb68c8b7514cc0ec3380d2919c9cb59280eb3a3b45c1d31fe29f08103094325c0fb13ff818b83ba7cb862f465432a9c9f0c8fc98c7b24be9c178cd2a6948c469ec7136f58795f88574f709c05fd4bac3fc98a7e25fab8f3c79c8a3ef91b97dc0146ac93d0d913d659402a2d0ee7d3318f97410fb5d5fc81708784b8848be7dedf2e76519a38954fb69e00d179877e9ddaf9276afcdd32893093bc4ec3ffc2c2ee9150e1e169ff3ad6cf00567eec64895fe6cd11a504abacff2a26e5088776d77becf9df2c51633f72f94781b251786d5b43382ae8110eb21dfab45136293e688a4f81469d1ff165e06c4b9f5e06cc199d39865d5644bb2f6b581acd617ae6133db5e322aa71c2f387dcbdb95ede2f3aa495617e56d7f8ce50fff84a496a21d5f03b10c82172154be888c1d06234576e495691a58eec889dd8937f4359bf6756286aaeab5339c4e63ae487e48c964bc2a85ba5edcb0b5ca6791b84cd031dd342ccb8c05cbb270249f0874dd52677e0898b9f70baf49e6c62d0c0769cf67515cb823de338a82a9ea687ce3b9e35be633b468d8146be0210f7137728addd9db4618e3852adc0fa9bf6e9740cded385bb8f089b89ba9fc694a797fc2577553b5bb401990730a2d8d39c9f46016b9914eb0cc254a63bf973127917a8011d59414f399918002240997aeb52347218a45dcff2765996e6bb983c9d5e0fa1decb9a529bc7f902c3b80f885979a1d9d8dc7ace50d64e012a745a340b00598616e0b400b1c2ae96c440240e855f8f5fa090c58003320cbbfaf833444c9f51f2e12e135b350e05a20b01d9624629827281b82812b3ae6490517641a018f217357b1089f59a7924e72b02871a2fde76349e96ce670b41706c84a8c858f073f11850de79adb1749f9ef2468858d91b33c4dbd01101b4c811f76fa3ccd92ace0490e222c204f20259fce9b00d8a784684032e9b2939f42b08a678a879ee538373a305ea7b51bcd5b52f6a93b3acfdf7b229246f287ceb4b4298bd069f5a4414240e95f770f3ba3b38a640648eb2c90718797aa4c7df2a32b082fcff7322ab7f0e7336186710be93d73b8840aad3135c5e5620cb2023a282950aa7c853bc87739096e25043423a3dd01d2d7be789b6f447eb387859115c050ad98ee54ed62c8013e085c9df3e1a42c353491af9a924b8dae150f7ea2ce87e9453085fccf8cdae444fe40cae4b406981874ad3394537f5bfc084594fb49a2fdaa33df2fb557b1fd6c08e08c8a4573662388df6ce14418935c17a8525d7e70816451deedf16217c9a872e8b47773a1f66cd5aa978b3041f45f92d787e84ad4db847c7f51cb3f383cb51063c6e6c06aceb5551afaac3eeead148c98ddaf4ed5c5660140900267dce7e4f2f9984e3ff192e8b40d7a545e2125fb234545abc3a47bc7f64428585d6302fb6470869295d52855e43e78b7a0c1f8bdd56cbd3f6294a1d81db5ee5526b1f81d5bb5c26e4353b89c5bd80abe04bdd850c20074b50148ee40c06909e50a15f05653489b792aa74052d1a18503a2850f23c84e389d1a473e9aa1ee1478707345ab9acfb4a85f4d171581b07d816727f781d1c5ecaff218e7abc0b95073455817bd6a13859f18748c6aee351f180b4fa7f77614398cbd663f25d30c13b1aa3938c26ff8dd06ad5fcba1146e741254fb3ef2c4f469e0b259ebfc833ac5991a52b44b119a77e190dd234d34a4f0f3c8279c869e7d4a379bd7709700e2a089b37dff32227432b8c798ceb48b69c51d941a1834a2f40ab39bc11109e3f0db0c003f6b341e4f6595cce9444a62f71dcfdcc6a435e5160425d5466090df6cdd5defd7fc281c7c22d90cbde7988258efbe35a2d38b644d3c9022f87d446dc5ceaf0046fdc1af3a0fb058b4d25347095535757c9c88019fc58d1d56af6f22c9d3b0bb936c43844fc0438657bbf61fab9c45ae3559a7b74dd1efd0889ec29106eb46f9a13065a7d6fa1053cf1aba827e32ebe38ad7cb44f0a59b5f69222459432381e00d8eb05313071a31e99b74b782a7a6fc38e84dd1ed9bac8e96a5fb26113e01ec383f3c328ed81ee74a725fa9b7cf1818764fbd90a596c1838e87562d645a47a5c594a4672b078faa02fbf9766dc3e4a247d916db75d1b12948fc2093785b27345dc38a1d566b7d55912de7b37a7c0c4df49efd0ba638b069a76ec0c9b4c25d08197bb598abfdc590a4fbb6aad9191b4b9cec89c0fa2c70aed124e8d8125a569a1d86c584fc9c7c82b4e03151e7192dd026422106f5e5d355d47bc8986f62b399787801f987325b6346ac94ae9a807472b35141af418e22d82830d8ab0d01c2f7a652b45d79bb14438925fa9b9cc4f003d1f1f3651b8cfb584210da248b643c01d4e02a13e06ad043a0bcf3c6df46c607f03056fe8cb122626f833d62cbfb171a42e3831c8596fafaa5ac26aca493a628e3ba11011f3eca36cff53219fa2b14713033b9d01645af350ff8768c4c7c65974dbd0ab9a0b7c4f6e928ce068a1e6d1dda09480fb87c7e10f4ea118f088aaf23724f877f87371ed6408db1217814965e023fb0988387c98d8df5a265baa88a85a49f1a33e2e3999c013bfc984a63cd994acf0efdf3b3f3087d86af529d30ef71b25229ba8faf373e93bdc3222df4196c3b5a61716c8ab2bd991edec0b53f3f793ead5d18fead07a1c3d68b018cf8704c6edc6dbed11a9be0bfc0b3319bcb3764ca31b6029a0ade0cc0cd93bf694bc5370093a12d75cce4af2b9557e47ac1dab89d5ce2cad86e8826f210debd9a8f01597334b5a5bfd0377a1d66a2e8fe11a94c74ea9bd0ee75678298673e2c98ea8c47594961e8fb30929a508978b14be60f9f48fb78aa76b2a519583452b9b0ce5d7225fd101dc1bbe9ae925ddf51ad301ba60627da36ab650a15b6f01022cd0976e862af821658a51e6848a03769f0902c0dadbfd0562f440a5715e32206c0024d50194906463a728d9b97fbb1695b2f05147361aa84cea4dc3b049d1a27aec4644c353d6f80260c05c96c7a713e9e39420e0b396607a91cf45a2b5ae89282134758f5f4460916c33dac9d7981651aa8440c39f89c68ea42c96d04a898c68cf16654eb90b6b39e168c93edf11f7ad9971beb7a229997134921b92bf42dc6462d5b52319f5569fc34d1ced287be793e0e02b5abb4e4f734e2a860aaf512b0eac108509f2948148c03b8f0a89302daf189ed5d384caf7d74f688d4aa2bae041687e7e37f720e581546f545d54bfa31ff76d54ea37cfc9dcfe31d5931cfc0aa4dc44b5e8a894460cda65fafc2dc9db4b573325aa274b0a25423dced5e7bb9319505025d416790e79bdf7a1a4f8b706f8325999b0d2302a7feff6877c466013c87c94ddf1ebb7163004db5d026152c22b25ee7d79cbcbcf6b744e346561e9ce9523598444ebcd1e98e72aa814fcec0a23a0d98ecf8102728ecaf5f3fe79912ccc8e7418fdc48f5901bdd4a46f4b4fb35f67b6319a6144b4563d6551f50b1134c6ff3035745dc930622c507bbd709b4e30685a699008eb7531604d595a55e884b71ae5b71911872b512cfc268205e26ad7c2226d382562be21e6a1078be3b536c25b6c0eef0da79254959a6b369011029c5f0408540623ce7c79d6ce855b30994c001d049825822bc6d065e3abfd4b8bfbcf611bf48255a33d53429f8170009359f41bb8ba3045dacd2e6bd2c77d72c0417a5a44a58b912069a41f8d24ea244203ee198bf991e41c463e7adfad5a3b8ae6ca3705307f8f21dc80a636bc13638fa2c28464a871fd2159cd5ac2be78d888d7a7f4245041f12012d99cabf6571d480a4885db235ff56629b7a4bf73a99026efbcefcb4f186ccc434f7194fe40edcaafa5bc8985616947152689fc19ac2efb186b1010f90abe33d23161f3216c09c36f74dde9c8d4697cd1754b0730f27c3a3f3b6bb94692d815df8db3dc711b924b29fe27612643809caf9aafdfd6addb62c0341a23b108a718c6e6a12d1a797c857562143712495cb391c986c3f6f142c47a3c3b67bfe664f579e16660930d185a281c547b0e89139e6368e24d18b1adbfabe8c9ff3d75381d2a35bbb685825db428cfe8824bc6712274c8f87cd1e48d34496142f3c3c96bb10a88040dfc9964e0572b801fadc4c59bfc327b925485eebee6e5e82e9bf38c2273878c20ba6a0bf1d927cdc83ad9406aee0a7b41a4bd5e058a63e246bd538a6546103f10f5d3bd58a3749ae1a7063e9cc11eac83f6510318e08e2336455130d4cb535aef6e036ab42e61ef650cb629472b0cd986e01d663d7438f39d6acb56f837d7694980c21f48c8b354597dc5ebd9c3a4222317c0cee1b2e02fc1d27af7e6ca04eca4eae7e2925200798e717a39093527626eadb5b7acedcfdba43ffdce9e23df22e119df85f9ef6fe344794711c6127617f8767577f01c5a799c907137358514607e20cde8701b17f7a8fce5078ca2b4a0f2469694fa133cd84c986f94fd9c4b977dc8127dd9446675db2945e52291706bbffb481550afc84774a1f367f2ef4ec1fd12651948a2f29e926ed1de4950ef5a539e3d3a5d6c237c6353dbf9ba0efd87a03bc90f61e3a3ffebd8917fc093b0ffec7b216ea422ea89cb5136380b1d675568a769d0b5eb64f2dba842828a9216261958368c326c22964fb6fde63c20c7a8dfee0d6570860a0416fd502170afdc86dcf310f8ff05a87ea361ea822f2945492064058b6e977f69b5233bc20d1d53f1065109e30b0d722172893fbe0b3aa71a93caa7892721cba99488997aa0036ee653d39609b5354b2939d7515ce143d642990408c0a1ee43cbafd0211de6c034f4371c0c20a8b4253bb8a193fdde7353e1bb6bc32c0a5c2763ea85f52326b7231f8e7f1ae6f8057fde25b19e4b5f1407e0fecd13924d7d0433560db591db6bd19bdaaeb014b5316ce1dc1796eef88f0c95efd5fbf1632d54b5c839d4fe6e83077a6984c8fd58d326a7b3a544527a48a7cefc85e001b5dfa2fa279026c2343d8909a9fe8618c79bc3938edf2464f6021e46d0736438656a29fad118f768c446ac194d9d3c12efe46840c17a77b57790eefd7cb0a079ac73908a25b9a077534dd5d93f71772e6bfcbaa5bf0664008d5068335f09bbce116cece72e38a286e908042e0aa130d4fd501569046fdf81a2777cb87715e2ded26899a4a70fc33b208575f96a59c2fa83821e059e1ad807e7ebace9df2efeae82b93db3ad22ea9d22f5d5b29f71237019ca37dba3e854834705da14395df514c667e8b4476cc3546dc53bf057643503bea7f690c3c744eb16efcc4fcca887303fdd2915eeb12f1391bd2ffeec867ae6049ff5a14e27ded29aba1a85327c029"}) r6 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000280)='cgroup.controllers\x00', 0x275a, 0x0) ioctl$FS_IOC_RESVSP(r6, 0x40305829, &(0x7f0000000540)={0x1100, 0x0, 0x52, 0x10000}) bpf$MAP_CREATE_CONST_STR(0x0, &(0x7f0000001240)={0x2, 0x4, 0x8, 0x1, 0x80, r6, 0x1, '\x00', 0x0, 0xffffffffffffffff, 0x4, 0x1, 0x2, 0x0, @void, @value, @void, @value}, 0x50) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000240)) mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./file0\x00', 0x0) mount(&(0x7f0000000180)=@nullb, &(0x7f00000000c0)='./file0\x00', &(0x7f0000000200)='adfs\x00', 0x8003, 0x0) executing program 2: prlimit64(0x0, 0xe, &(0x7f0000000040)={0x8, 0x420000008b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000080)=0x7) r0 = getpid() sched_setscheduler(r0, 0x2, &(0x7f0000000200)=0x7) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r1, &(0x7f0000000180)=@abs, 0x6e) sendmmsg$unix(r2, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r1, &(0x7f00000000c0), 0x10106, 0x2, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000200)=0x4) r3 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000200)={0x18, 0x4, &(0x7f00000002c0)=ANY=[@ANYBLOB="18010000000000000000000000000000850000006d00000095"], &(0x7f0000000100)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x2, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0x0, @void, @value}, 0x90) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000080)={&(0x7f0000000000)='sched_switch\x00', r3}, 0x10) mkdirat(0xffffffffffffff9c, &(0x7f0000002000)='./file1/file4/file7\x00', 0x0) setresgid(0x0, 0x0, 0x0) write$FUSE_DIRENTPLUS(0xffffffffffffffff, &(0x7f0000004680)={0x3f0, 0x0, 0x0, [{{0x2, 0x3, 0x6, 0x2, 0x2, 0x1, {0x1, 0x6d3cb3da, 0x9, 0x6000000000000000, 0x2, 0x9, 0xa, 0x3, 0x8, 0x8000, 0x7fff, 0x0, 0x0, 0x6, 0x96}}, {0x2, 0x8, 0x3, 0x7f, '%+$'}}, {{0x0, 0x2, 0x8001, 0x4, 0x4b, 0x5, {0x0, 0x0, 0x9, 0x8, 0x0, 0xfff, 0x9, 0x6, 0xad, 0x8000, 0x2, 0xee01, 0x0, 0x3, 0x3}}, {0x3, 0x1, 0x3, 0xefc8, ')^]'}}, {{0x4, 0x2, 0x80, 0x5, 0x1, 0x0, {0x4, 0x9, 0x6, 0x5, 0xe8, 0x5, 0x539c, 0x8, 0x8, 0xc000, 0x7, 0x0, 0x0, 0x8d, 0x6}}, {0x0, 0xb, 0xd, 0x2, '/dev/video36\x00'}}, {{0x4, 0x1, 0x3f38, 0xa, 0x3, 0x87, {0x5, 0x1, 0x6, 0xfffffffffffffffb, 0xfffffffeffffffff, 0x3, 0x3, 0x1ff, 0x48, 0xc000, 0x2, 0x0, 0x0, 0x4433, 0x7}}, {0x6, 0xfffffffffffffffb, 0x4, 0x1, 'GPL\x00'}}, {{0x3, 0x3, 0x2, 0x4, 0x3, 0x80, {0x4, 0xffffffffffffffc0, 0x9, 0x3, 0xf6a, 0x5, 0x4, 0x7, 0x6, 0x1000, 0x2, 0x0, 0xffffffffffffffff, 0x1, 0xac}}, {0x6, 0x100000001, 0x18, 0x6, '%\x1a/{{\\%,\\o[*)]@[\x82\"!)\x14*}\v'}}, {{0x4, 0x1, 0xffff, 0x81b, 0x1, 0x2a11, {0x1, 0xd26, 0x6, 0x80, 0x7fffffffffffffff, 0x9, 0x3ff, 0xfffffffd, 0x4, 0x4000, 0x0, 0x0, 0x0, 0x4, 0x800}}, {0x6, 0x0, 0xd, 0x1, '/dev/video36\x00'}}]}, 0x3f0) syz_open_dev$tty1(0xc, 0x4, 0x1) syz_fuse_handle_req(0xffffffffffffffff, &(0x7f0000000000)="b635a23a2016a72187bea6f49af69fc50e62be9b91036831bdeecb48c13bb131c346c3e92f08dc3e906534c965dc3029c871de321968e3788fa100e23ffcf4070c9b5731c9e315676713c5668adcb232058a72dd3f9dcc3393a54b66f68e5013e2e74bea3da949fc18e58f7df102ad2f65aa31a773ef5c353b7f3c623a575938ff845618fd087df36099d5ca1d7d6f038c546fb310bb3178bc9a693e6cac76ca27f8afec8f31c9a8d5bca4a31a7ae7dc0cb36afe6165ec1206172879c342d63c402f7e40b6a80dfed8b53b37c7c6dd80d3032019c28cbfb59a2f9def205c9ae2523de159bf7e367b1dbdf3876a29c6dab82b439251424cfb62e9cc83178036852558af1ce423a4e05f196e061d5a25a83571b7165033e1f383acd2d854ee70ed2510a3e48f318bebe7381415a12697523e93a617b0946dfaed978c334f15b5a3453e69cf879a8c655f2066fc4bbe5ac4453118bab0be6f6130d1a1e152be82c67e9e79b51308d6a11b6b0a28d0683f4cee3a515d094f34cd7e265de644974c75598d69d42c23d6287bde741cc04419c95262e4857feb0961a04a05815bc39a36f44f5af86927075ba9770afc6d292077bab454e333c2071c7c3cbec060b9a1971de44fe264dbcdf855c6ccdd0e352dcb6829c0bca7944a71ba92290ab85d19c0da056cb03a5cfe64961a8009b29881a19e5875df770af2e8a01c83aaa6987102bf4333d47ef6163f4dd459de363c2fe2a45b1c7b884a058aa78aa24bda266734dda02c483484658f2be92b2a62f9c670415d710e10a6abc8545a84e7f63ee8b1bb030abdd2f25089c57a014b67f0c769d18f3339eddd70289ce779b374c7f811fae76c38d057e0f71fd7c53bd8f18491293c390ab97c3a9490e6b3cc6482990393b1248166e68dc532b2f0c2c375c014e738c0833d109c66c97cc1b318b44b2664aa94ae689452707465b08f5d0df59fc1662c9a96365a9a01f5de018abe3c035e069e928d7dbf1f010cb9b0c30ee806414e8cc3d2c010087892280735686d2c4fbf42bec52487ab0a8f5c46882860a51549b97c6c6cd5bafe0059ecb52963a89a4e45041041b2c7a544c09e258d757db52942943a6a091d57764d1c200c787012229bd224964ade40e3c26a11b8a73b38fdb9efd4f43affbec9d94b86fddb18ad22b70600000000000000ee10bd19a0ddff955c001eeeb27391fd19cc9e75ecc281ab175c92becf420aee960e99702d83b1fdbd6cb14b64a3f2b01a2949dfaaa2cd21c83b456721cda5fc55f2fbd4d79739c9d515d4e17a5cbee63fd7781806525107471dca76fb8630780d71737890587d64446dd8f683423047024ee0d4743d3a1c40a36dd775050b1eae69ca0b2a3eb064a8e1c24a3d465ef3fd470f844294ab23b8e6a8e88ce7ecafe84c4e31c08f3444c1a9cf8527f50f11b809235e54f4704222a473c87e3209fdc615d5a01d5dee3178c7175d2f0464042157c6249261050ca66f07635ee324535c524ed7e199d2df42666f07047069ee7bc72a788140a4aef44bd258d01a3ed28be4089f797022022f3a7e30c2e50af2888782bfd8e410d41452165e3c86cc703455fb811947defd3462621c665ae555c9bc75ce4dcdaffa3241d140774dce1d1213f0b9200813db37f6e70dbb7c518cf393daad90dba2f79bc8665da6f55e0a4e309fe2ea95868af4258df212e3ffe3ecd56a847378c4b6349c4ecf165b07521ff4d272fdb07745d5bcdd02685cb9d7833002cd9edb6331ca8f6f877df03621b67308246b7a552e61c9820fb108a9a0c89c9774956a23e2ad56fc40fa8da59f6fc6ffc21fba200ad858fe0ec974100a878552d9ff24fb80bef586375e3bbd15c72f40cd66e1eec9de67800fdcf00b2b88c4c07b27a0db91a467ee1a1294cdb077a327cf8ecafa211b60208d56d1732b87b448b039c7b5271270ed46d507a6a81716fdff750127a50e7f5b34b5b3d4e99140ce6b933be3b021cbad405d4a1d50668163b1064b879fcf267cd1ff40261aa410ee086643bf43687992b094045e409db0ad7b8b9070fef8b9b618d138f377d6eca58ba46b419ee787e35d351dd196f18645970724768122e6e7b272080b217c68d47d14cbd240811a23fecf0d580eca7e05da64d8a438479f70eae43cd676f92f8b0e77bd829c4b2b3f7e96e180b6113b1528cc13ce684f864d808210d4a8ed4f9a73005ad761ad46307413d493bf7452907c17af88a4628040c37ebd2fbb5cd7b382621105a7af874f0cf7c99ff478d7f5800b5be59d3b74ec160f22a586ba9a017cc4fe0c1cc58e289fc060ce3a415d55660e28f92eee2ace1c4b3a0cc700de3b8f617b0ece1415e2b917d906303ce018af05661a261690d3b2b1c738981791f9e5f2abf97beaa27e4deb3e12b2ffacaf68798945ee7ee7a955969ef6e7c71f6f85609c6485500e18f39f9ea927ccd26dbfd28269750149a44ab81a739a5367549364b71ea8c3f4275e0041261e356c21f58527a704af6828df7a209a4ba2a42c96b506d04000adfd16df424624a6981276a4fe4777c2d91e516195c56c8b7cbf88a091c903049d5563db8a62f39cc0c29824779fac1d8a4899d1cdac16f076202f587ae05333d208bdb3b4dfe52e65fb1ffdb740667032960114a06967910f4c8bea2e3d93f438b4e6a3b5c1144cb95d2137e508e575c49cf114d06a56bf9336548a09a8b82374622d58084fd4f740aca1704f44ec359525bfaa23058ff4fc5c3f50e1f7bf8d05abe5467f77b03c3f6188afeccc15dc0b2fd51e5f699a67475de8302fb1585f6b2e7e5c3c470efdc51fe58787417304ab43cda673883b689b3e00fab6328b40af8a0194d56ad91bb7195bdeec56eece40c5269f275bca2e23748838446a0f7d4219bce3d96038fc4f20b7272604c8f9b7c6ce4fd2b91d104c23b6e2e59c2efea536536f332cb7f2d113c7ad1613ebe9ec50c86be7acde5c703dd663f6b821c7408917a62adb7795f6508408fdb327f2a3bcecf9892bd815ba7373dd80548b92afb12ce395577ba3a638189eb9978d1941b836f7785dae64e62c5d7b0e46b62ba639b0c6a790dfa850104e0413ae0b386438e0eb87c4acababc30eb376f6f47485a11c884a187d67ea7d679a367e32337a1bbb07ec05324a3dbc2586bc0991a304aaf035ec99abf8bcad6b10295d9f832d8879b9690447ed3854806095565689e7655ba7ada3c41b814b436615dd491b13613cc8cd6e826b159c0b07d86841904d8db164b2d95b77dd8cee127e33e9f72697af5bdac028586bd580548bab55d712aa656cf9fa86f07e0bf6394b5b9e78a2f0ee6de2ce7f1f4764787fccbfd7df104b50099205e14a7e65c2fe0afa688aef20043841767e1cc18c058bd83db3d5efba9c2f40aed1712730177124f71664b00112c2a801e3f7632fd9aa67bc9b2b6fa494c1596cf96f277f50d51bba6441733f0a7d73bd8055c88068c8e566e1dd4121ec95ca6df211a7cac1c6f3dc67270b86b6bdf1b2a98db3756796d8ca726be861bf70c90151eba75ff30b8fa17e5640f6bec0a042593f2f113875b9e18114e55be082083dfb8799d9c5d0a5828cebaea60f7fad3c98c078c09c245ed56a4fc7f9a7bb407daac2cc9d4bf8d3ed454cc022ab10ce4d41a2d4c6bc1ec3d6925426a5f4eca2e9bded77515c0896ffb0001adf51d9f43462222f7e06ad6cd69c4d02a384c4d8bce93638a24364d6ba8d17a537ea78655c3305bf069e07691a78aaa3ac03dd987972cd3c79b32b90a0376b9bbe0a6fe95ebe1e95de12fd0e53f5bc9b047146ef5ff4b40a2bdcf0bd53a6887b37107b6d37c86aacfee3478d3d81a5ca8be63559ea5276a64d88657c0d59859a2d1b76c0a382ad851ba8411a7e6e17d838694b156c5550c5cc14212e65e3b3231e5837cd7866381705db015245cc258ff1bd66517feaaa4f7d154b24c51ae54dc5466846b5e9a64ba88d3bc799f6118dcb2e5a972aa3823ddf5bd2a39109e56b820194c172c7e87ef1240701659149f7b05897aa7945fe5040d7e67c635ac0dca05e5ef0e9d6f542f8b1f15fec8897667587fe7db94fe36d73e51c8ab6f2b0ae3f6c51325b27ffd344a91bcd174adaa4569b9d52c0d31191ad191c3a52129e425307dd9ec1d1dea3bccd3fd7e5774915012b0369704f3d298c175d58accb97ac897153146e7f3b1982aaa9af9433b7d3cc40a2804e8246d06ffcee41f5c771c5cfc327acd8061303acd961a22fe2483f375d5c249214aadd9c8ccc3831e31f19ebfb124df863b9809f767cdec9905257b8dfb1a4c7e78db768daf6bbb6863f649a6f3023d1d5b32bb746fab105a25b07395b10d539c691719b6f80182ec0029844881f0d41b856f8a576339d16fcf1462af2ca95125d6f4771fdb3a880bbd240b671f9d904b8740f88b691c8fd783f1bbd22679beb7170cf07c85773ebd8363e75f4343b1579c7a40a9744f1f505b9a956faaccedc1df39d1e3c7d0912640afd4f666aea9363a8d84eccdcf3cda738443640aac65baf492fffc5643e87e6922867db2037cc927ebb30398334f4f9ce3b304d4a0ffda5b7de5ce781633dabd8eebe44a6feb454414d6e766608ba9f6b1ec8ac5ca11ea6438db7d86902d99b7d0749a646bbe3b0a988ef9a9a1f2ded7e238a31ea7241ad6de45d8f33d084520c8a68334de96c32948b9baf68333d5b51ca4bd0c91b75487c00b41dc2070b8b3d8923af1bb358e64bac194e8aff8645993b018f9e8c63917d220cc7a49980c920109e62c042fc4b757422724ff875a54bc3fd1cc278c4ae08f225d4da56e2e3c5056126681c8592bd195c438ff06afd66026cd08c5ede98b7a700dd3bd5fada703baaebbb1f96c49ce5c1263de39a5c5cbb56e610e43091b4e8af3448404d8d84d9a29430949d51f141e1f12451c71f4c07af6558d987b000f1a14cc33adfd842a98fa786be36fd78fb8878b498ae174f2e8a5b9666d2c6e6ef678bb1b81b58e1bf26a64a1d73fd49005bf6b04f7a22b17f324c10b60a20da359f4df247ebc59a0895dd4559f17dc6f08e063ec8033b25d8cb0ab49c6bb302038889f15dfbaf21208e737ca121894b29d915bff2ea53ca74e67fd4adc802c3e839e586bbe2a65e843614dd96ef1c121d9989a56e2ad321d8ef5006882a8a03de4f192e057fb40ae6332e40934e78dabf392085dff93eebfe6072fca2e31603c988dd5bbdb16d95aa8a8cddcd1635905d1e347a51d2ec219b2e7581ce7d060c0de274cfbd9e6d9d132c4fc0149ca5a13c9e41fc46b88da841fb0a301c050d21f80938651029fd5dc2fce4a06e524f540a89e53eb93fe04dff0853505cc3299a97370581c7fdb8159f95f44629ca7a9e34bb447f7e5f549c18ffd06da6ccbc2d48c5bf3537360c4b185a5284dd4988dc0a6f2381e640b900cb56e0ec43ffa95b23d70f6a7b73dc29e41c710968f0ad01717aee92abfd67cde9cdea149b47641602014318998d675a141a2d3ab75e718ab382d305b4a961c9e8b621861e435d006faccc5929c0365d890b3d3973babe159e8db74d6c61d07f55b6fc49b5dcca788eddfb28916a36c80eae7c2554882ec31d1813dce2034ba8973a2919405e94589c24c3cdfa1bf2fcc0feefb87d1af27a2f80316d4462ea309a30eec785c3a597c6107897df297d930a686426b6afc2277e3c9929d00d9000ca9388427f060af654e8c4bb3993b01cf8eac473e7215f0e5cbe75e91c245a746b86a6d876bb7e624e690384cc0be32d3fad30640af8befe0f39ea10fc578214fb7db22b0b8d4a797d56335da88ae9c7a74dd685234178a4e49b8ca81893c30bb33fb3d8db2ed69c69fc2ba7ad04df26f49018088798906471f9b29392bc3fe78d612be345d838a72a00741af079446a5fc6fc7b779c0a4d8f75eb945c65e60f2894bfd9a526bdc29e277f15481b82f10dc8329d6b3f27f352a49dee12e435aaaf8e832aed574b17fc029ecfbf8862d0dfab18bf095d70b1f226c932f8ce3ccaec100477e2071dd1ca48af36ecf96cd063c9708216fd9d65d0e69658911e157cf47c64060acdb28cb05b9757db3da23b8a57705559b59667158862168d25b44b4b6e6b92f0ed2d6df1d08e328889c16da0bb46bb751b5cbb008f66493d5ab425284ade4d6a181ab708489efa3afab44511df1e217e5ae255026394ec9d89d8e8cffb9e32494ddb0fdcea1c53a6d1a962a0a886dca255cd0b58ad7ba90701a1f826c4febfd444c5d92a302fe9c99f085741dfe5082dcdb442174e825b5baa790fc03fb23f7a20f82d259fdf6708398fca2c9a9d28c953282e3c8db90b12afe96cbef7ddcde5d0552af596bc367c7a3f4ac5dcc93b885fe2ff9ad008527820524b8601313703665de05ebe7ff3f22e2cc6d6294a7732a11dbc0800951c97bc78c2875f12265ee0762c42cc0e27c3c7e6242b70a2b98e3990d0a4c337795a26e63976b470b1b4ee0e338bd8565d317f21744a3a26e8ade2685cee223dd29472ba5b9e8e83cc7e1ab322cb79274573bbedbe8d8d7194fc2d4098f3a1716e07cafa7fd89a229e278851373dc71ecd7f4ea6d1d2936e8553a95c37ce51d33878004515e84780fd9720b71c745c3248b4ea2fe1a5572908b79242d41314412b414cb303d5f30af096774632994aac2be64472215c96c5d680f3c5dcc8b148f7facc44420adf727857a0ef912b6834672ff2d6ddfcd6ff64667635c724a7294ff3bb61ccabf1c00e13c1070d000febf9ccbd8bb111827ca9d30db4ec554953db59d93e555a9502f09eef63bbe4de97de381aad868bb9fd7d6586d4c8d0dfbb200cf87295b3ae9a8f10da508dd34392f601bcf7c6e58e737a0e25a00059550b4e2b6d490d854eb209f0cbb332a59e582acc01431d250e1199c91c7f840962d1b8648938e23bf1937b61afbaf0f38af84dacaa0585d749ef7c53bef067c09fddacf3349af13f3d265e7281164d085c845bc2396ee5d02f02f619f4dbb8acdaa66fa36910582b83a49421d1494b1cb20f7b26f692c4e3f314884b79cc49962e364ab5be2d411cfbc90e235c03a2c6e505eec9a42fe5eb90bb14cd24ab483ea7113b69d1eafca2fa96d4a92c4f5ff75391f3eefb12a2ac90faeddbc8041e5c836a46a345cc4bf0c4c2f7c9cb5c15e8a36aeff8becc43c71ea0499e09aa8e21866c7e6887e24ebab1ca5f8d16389a4c4238727cea23eff3daeb5ddb960b1754087dc716c576e06c05febfd949fd7d57342036cfc6e4aa0d8712b53abaf0e644c4ca7d3734707a3f49c251178a94804aad6352ddaa22b4f27f5fb42b03537493e37c3948fba46a61f27b4017fc0e2b14a8e42b6526d341dade056f462f19cd7c950c3453fb8110cc16a731d3201a2a91279de59c18a1c1626a3dec8e21164521756b5e05913c119cb10910b4fbb6985b8fffd58b801db77f94d1f49a1e7def0eb9182c6b8e5335854020a570f0c62698b28f54cc034d67ec016374387ed340a1fee896b681916522fa9d6808af508b156629e2b59a43ea8fa8038bd42dab28592bae496170156d335949087d05399c64ff83437ecded598382d57288dc09f3fb19ee29328bfde4f600dafa49d462c8a305190044bf998495585b4812b5a2d7bbad8fb539bf65d40ec96bf14d19f20b94cb4f837bb59af74e0819a10d38978df3e06112ed6dbbfd057f52a24622050f6b59c90aadc20aca0a624cd14b65287c75222e32de6f169ef50d83a3c870fb1a119aba1b86ecc49e90511f0a038c85a36273638f791779517b525ec7e5dccec04ba74db44e81e5fb010371a9ee60eeea324ccf3dfce9f29ececc9c2e78f5e0b65ef38a472f61a747103decfb4be0932f36f1dd13f960251fb1371d1583b4a5c9d266e1dbab3fcd0a316c90cc9f52640fb8578324acc4bda0ed316ee891c2f64f573f163f05753e39197b97f119b96f0a8761a27ed952761aa9e37928037cca04069ec57f232067c6e8155c5e648f78a795eff6ddc33b8964bf6fe490f86fca8a7a269c877406032df2ae120afbf8a714910049b70b5e0355a81967a7b745d3e3d02b52ddfc105caed8f0dd2e38523a5918e920dfd024a276d00921251a48e380b09559fdf9c21a242608c2be5eb95740dfdb17f150f66704e752a23794980dcf51c6c5403a9ccb6cd1da068acb385061a4c7e195b0f3eb47ed7d4388a5fc8c039316783563d02bcd7cd33be35d91c35c4c6a68dd43b072735eb86fc01c650a2457d4d77a2c9a21878aee24ac379af9c73f3dc5e76de7516abb3b7d45c755ebbf9eb72d0ea4c97b3c34bf2609060fb20409706b82cd59aac37a392008e1e0df08bd17b56e8127ba631b0c57b2a7d6bc6c03ee347c00b4858ac0867d650db51b8e0ebed1ac770726190cc2fbb8bea49824b5286ffdf7897336863cb7900f34950c141444c784f9b787d77e8bf083c138cffdbe548569faf553aeb2ea26039a1bdd5e31ea649f69a838cf2c5134dabd1f9f2d3f4b92bd5f9728ed92fa10d750c4eb0b2e5f93a7eaeeb50c01f3af6f2b2500b0b2d8b3adf59ad0ec247d4dacd048bbba6dd28e57babef6a93a4e8eeece780225c14956a47a6f21db0077045359acd4f60686eeca084f02c57ec2724da1096c97ba635091a5ec9ddae8b60988055a456e8cf2146852e3526e2de46ba6b63f1d0c6df52af897674a09d1ed9efee6c510f893b79ae374a1bb0167356ce9741015f99b2aaecea7476c9a3922da674da08ed3e5cadfbccebfb7f651521db771c4d3e692e37d7035a7134a7baa8c7bb4f3f063cc67757236c38cb11e2ed1497e3f1c6db6921d19fb13606a51a78f6c4ec63f6dc23d77a5030000000b104fb67b42b0cc550eada029cd67a7b4bd4aa4a5479ac5c9c7bf98c08c8ad7009cf5087e6556ec54e66af1ab3f96ce74a8abf5420ff52b0390d5c40aa372c1ca53b5a0e72960a4db4da2b2fa318effcb6069d7e74f29977fbf4219be9e95299dbed57f76eb35b00ef8d6e5310c365568b5570b5a715a325dfb9eed5d12be78e0728141d866ff0c4f21a2085499d1cfb1b68a6733bad33384a258fa2465e41e45b44a2fc243127b6070fb4b56e8ff73702751d1f39967ead0155649ef2fd15abee559756014dfcb99cd37c70d387af273971a72a230638b13a18847ec72dbd27084b19b2db9fc60ce4e35ce1df93dc6d2270fb12887fd3323241444d45e2e6dc1044e6528bbc92da13f3e2c2b5b8165e6701d05d10a516f9e0186b4c642da2aa36d7bee3cc9fdc335c6bf490cf612c78e90ac299d8b796a301c6b64a932161559642b6c2d110cb37f89facfb95d5225abf15650bbc488918f40ec0b5b3200bb51ff3b26f7717c69e3117da1b1e78b2723ad96268196a5b90fa19fc0d3e7193749182582305b220d0b10a893882efee2f52e1f518a94216ddfde785dc64a430b1e40a458e035e0957cdb47d2694540e5954908a3db963a18014f3b039a59ad7e36e375f2da6030224e21a7fc368d09b911c86e5ed0a6826bbead358aaa5fa6a8d6de3ed1b2c03cd1803e9a20af367badbf0f8398613eb18f176932a970d8faa5fb3e1084c13e80985ed2f2bc8b40f9678f9c6b9c06b78eaff781fb0cebe251d3b803288fc9a5f0e3521c72bb5bda8d56d42fe82fe22c2cca2bab39f50c98a830f55fd92a69b9f82ffd4d3666770a9d67bce8d17a336c7fcef0f72ecb9098c55d36fba7d1926b91dda03ce015d9c2dab5789ba4e06e92374631a2aa3e2d3bbe8cc418b5158bd782fa9f7a934b006ab68ddff40d68912686259ee1d4b237faefc836abce067bea39fcba0190728e554a0e6b871876a70acd5f54bff40570ff6fdea36b07b23d66464810d7346c0fd1ae15338deecf6435938e1dec0e050ff405237b2f585e6046718c86f4c174d938be859454c0620a3e45db73b9120013b588916f4c6bcc4d10031d292850aeb51be2eb5d9bb84de911ccb0e583277c2f49084466d4c56bd276cbbf2d300484da635e2d37adfedb86cb16e8df8cfb18607a56ef4a5e7b57051102b166ec1c5312920ac5a5775e6b0b4ef935fd9a210d2e245a2611fdacce530079dbe3da30df27f1a758b4ed7d22f38ae0a96b556c0df0ebb7353f034d1c704252a00442b2160ade3c7d167f10f20b613a7a9dda06ae98b08e108a209bba8cfb8aca037cc83ca78ceca58f109c0ea7ae10e82474b071d261a5edfc27928c3a928949e32056eab09808542908f72d59101f2b86439e9fc67f97330dd7fb184be394dbe63c92b005be7cd567874e9903b927a76c1b709cbbaba204c679ea0a6aae1adc158cba623c1650e13fed834f411feb644e4c767255b25270f417ac80bb48e172335041d5b2b9f468eb0eaba4a9a4288bfcfeb1421efa1394a9e46c0d5e1e2d549a6ea4644b09ea2feaef5aba678ad24032ff4bee46ce1e4bbe0d06fbd7a754b1c4ac92a3093b103c78e4b5aff6e3c91fccc72d4c51e24d81e50ac1ac0b236c0cd635801746e5f84fde70f8adf69bac0c983440004c7155461a7e3cf9c38594a7f96ccafedd634126d6e85696625e8ef65ce11c051dbd66af7f448837b2871ca21f6aa5521c108ee1ab88ebab414f1e60cbddc0d07dfb98720ab7e8ec3bc1a145b1ace1807379b79123d60da7e7525f7f15e2f71341774dd11f76f3d6b179613174cb703091c11ca173a41d56111deb81235e9c9297a82621905521103d11a421f7dc6a62815ac14675de433e8a030db12505dda28b3cdd7098436c0bea1b30ae7fbd728a7bdd7fa7e96946774ca3f9a00eac6fb71ad49b597c55bca7ca6ba7fc6883ad000a29ba7be6765af00da3573a34eb29c1ec117f76103d508825c1a2f74fd04b07b0af10842fe3e54778220b4b98d14ee1919dd542ae59c7febef84d13f8b58853935736fbbd79ea4747bdbb91421a7af922378a522382b6aa96db3a72d18cc144f6c5151a9cfc677cc2933188f78c78953ed345cee4f9a55bee94ef23a37ef4caafba79aff21aa9f34d753b3f1fb85a7a30028a41b1be9099a2711c62fbdd1f9fa02d1ddde2bc859a84c26285a5243d429136ae19c9053057e99a66cfa279484d2a9ffd4f2a87837a215d3c2a64967b30e2188ecf1e71f78f221fdef3eeb7b6e260071144f7e6dc6fc511c29dc9f05a2e351de14520d474b12566800f2cc80eabcd6ab6da47ffa4fee7b6cff648dff503b25c99ae9293f71638ef158b8b75c1dc7ae07a6a85bce1f92c4e4c9ff501136a01c444b9699bf04466a577a6ba3d3699eb7bcdbf3209142f8891387f1243a3cf22b1a2f509c475c1ee9c6e7f3ed4bd833432740237d932ac8d60fa0639fed912264347fb255da9729f2e9fb41c78a4be7b3723233edda69bf69aa08857e47f413c0500942e2e136d79e21d35abeab638dd7128602a0854f2f73167794418e33d5d07dc9c226bf43822a16481f04a77595220185aa2b4b172a607fb31ac624ac648c31207071274be3cc2a2eed64516efaa9aaab1a62b18dfe1819ef4d6e6cbf75aaed931bbebbc8ee9264337693a20ebef52bf54ea3d2a86ce11e8a36d00", 0x2000, 0x0) ioctl$VIDIOC_CROPCAP(0xffffffffffffffff, 0xc02c563a, 0x0) madvise(&(0x7f0000000000/0x600000)=nil, 0x600003, 0x15) r4 = openat$vicodec0(0xffffffffffffff9c, &(0x7f0000000000), 0x2, 0x0) ioctl$VIDIOC_ENUMAUDOUT(r4, 0xc0345642, &(0x7f00000000c0)={0x0, "86f745a7ce60d43b773fd8714a5c64274fdec0adb16d4ffc728ce26885a68d3f"}) socket$kcm(0x10, 0x2, 0x10) program did not crash replaying the whole log did not cause a kernel crash single: executing 1 programs separately with timeout 1m40s testing program (duration=1m40s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): bpf$MAP_CREATE_TAIL_CALL-openat$cgroup_root-openat$cuse-write$cgroup_pid-prctl$PR_SCHED_CORE-prlimit64-sched_setaffinity-syz_open_dev$MSR-read$msr-write$cgroup_pid-syz_open_dev$usbfs-ioctl$USBDEVFS_ALLOW_SUSPEND-ioctl$USBDEVFS_CONTROL-getsockopt$IP_VS_SO_GET_DAEMON-syz_init_net_socket$x25-sendmsg$NFT_BATCH-sendmsg$NFT_BATCH-getsockopt$X25_QBITINCL-add_key-socket$inet_tcp-setsockopt$inet_opts-openat$cgroup_ro-mmap-getsockopt$inet_opts-futex detailed listing: executing program 0: bpf$MAP_CREATE_TAIL_CALL(0x0, &(0x7f00000007c0)=ANY=[@ANYBLOB="0300000004000000040000000a00000000000000", @ANYRES32=0x0, @ANYBLOB='\x00'/20, @ANYRES32=0x0, @ANYRES32=0x0, @ANYBLOB="000000000000000000000000000000000000000000000000000000002488b2f9e74580af107c0e1d82e10ec48719c67c3a2c410e56c69d665be4d063622980f8cb451837ec40c83579dab92e8f84c849607fcefb8f68d30f5cef9a27821ae15259e0a5f3fde268d4d90d504f96fd259153f0a0e56e8348de69c712c4745807e57b8037dcc4948ce942ee622e67b803a7993e63813551380de1382064638f188d433efa8caab4bcf04b55d3a2778b35cf869574e55126edb0a866c8c2210811f626e123984c1578eea143687583ec9cd45399277cba"], 0x48) openat$cgroup_root(0xffffffffffffff9c, 0x0, 0x200002, 0x0) openat$cuse(0xffffffffffffff9c, 0x0, 0x2, 0x0) write$cgroup_pid(0xffffffffffffffff, &(0x7f0000000500), 0x3) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x400000bce) r0 = syz_open_dev$MSR(&(0x7f0000000300), 0x100040000, 0x0) read$msr(r0, &(0x7f0000019680)=""/102392, 0x18ff8) write$cgroup_pid(0xffffffffffffffff, &(0x7f00000001c0), 0x12) r1 = syz_open_dev$usbfs(&(0x7f0000000100), 0x206, 0x8401) ioctl$USBDEVFS_ALLOW_SUSPEND(r1, 0x5522) ioctl$USBDEVFS_CONTROL(r1, 0xc0185500, &(0x7f0000001380)={0x0, 0x10, 0xf109, 0x8, 0x0, 0x4, 0x0}) getsockopt$IP_VS_SO_GET_DAEMON(0xffffffffffffffff, 0x0, 0x487, &(0x7f0000000040), &(0x7f00000000c0)=0x30) r2 = syz_init_net_socket$x25(0x9, 0x5, 0x0) sendmsg$NFT_BATCH(0xffffffffffffffff, &(0x7f000000c2c0)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000340)=ANY=[@ANYBLOB="140000001000010000000000000000000000000a28000000000a0101000000005e1affd5020000000900010073797a300000000008000240000000032c000000030a01030000e6ff00000000020000000900010073797a30000000000900030073797a320000000014000000110001"], 0x7c}}, 0x0) sendmsg$NFT_BATCH(0xffffffffffffffff, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000540)=ANY=[@ANYBLOB="14005dd31000010000000000000000000200000a54000000060a0b04000000000000002800048024000180090001006d6574610000000014000280080002400000000e080003ff000000000900010073797a30000000000900020073797a3200000000140000001100010000000000000000000000000a0000bcd9392755d0553208396b1104bd0138b9d4dcc29076671bfcd406a184eee3783779b059bf3c1d3a573e716c57ed4ab238d496fa0d3fb51054a62d7055d068124ff4184e12a61862bc0120f727e9e5c7ae925054af63819ba5f79d772ba27895dc48a6796db8d6b142c81e1c43cc58e8cef58790fddf4278fde59f4d57d0f4cb44e9f041ba703fb942342396717badaae97c20475dabfd374400"/284], 0x7c}}, 0x0) getsockopt$X25_QBITINCL(r2, 0x106, 0x1, 0x0, &(0x7f0000000240)=0xfffffffffffffee0) add_key(&(0x7f0000000140)='encrypted\x00', &(0x7f0000000180), &(0x7f0000000100), 0xca, 0xfffffffffffffffe) r3 = socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$inet_opts(r3, 0x0, 0x80000000000008, &(0x7f0000000280)="0f", 0x1) r4 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000040)='cpuacct.usage_sys\x00', 0x275a, 0x0) mmap(&(0x7f0000000000/0x400000)=nil, 0x400000, 0x1, 0x10012, r4, 0x0) getsockopt$inet_opts(r3, 0x0, 0x9, &(0x7f0000000200)=""/49, &(0x7f0000000080)=0x31) futex(&(0x7f0000000000), 0x9, 0x2, 0x0, &(0x7f0000000340)=0x2, 0x0) program crashed: KASAN: slab-use-after-free Read in key_put single: successfully extracted reproducer found reproducer with 25 syscalls minimizing guilty program testing program (duration=2m39.94419324s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): bpf$MAP_CREATE_TAIL_CALL-openat$cgroup_root-openat$cuse-write$cgroup_pid-prctl$PR_SCHED_CORE-prlimit64-sched_setaffinity-syz_open_dev$MSR-read$msr-write$cgroup_pid-syz_open_dev$usbfs-ioctl$USBDEVFS_ALLOW_SUSPEND-ioctl$USBDEVFS_CONTROL-getsockopt$IP_VS_SO_GET_DAEMON-syz_init_net_socket$x25-sendmsg$NFT_BATCH-sendmsg$NFT_BATCH-getsockopt$X25_QBITINCL-add_key-socket$inet_tcp-setsockopt$inet_opts-openat$cgroup_ro-mmap-getsockopt$inet_opts detailed listing: executing program 0: bpf$MAP_CREATE_TAIL_CALL(0x0, &(0x7f00000007c0)=ANY=[@ANYBLOB="0300000004000000040000000a00000000000000", @ANYRES32=0x0, @ANYBLOB='\x00'/20, @ANYRES32=0x0, @ANYRES32=0x0, @ANYBLOB="000000000000000000000000000000000000000000000000000000002488b2f9e74580af107c0e1d82e10ec48719c67c3a2c410e56c69d665be4d063622980f8cb451837ec40c83579dab92e8f84c849607fcefb8f68d30f5cef9a27821ae15259e0a5f3fde268d4d90d504f96fd259153f0a0e56e8348de69c712c4745807e57b8037dcc4948ce942ee622e67b803a7993e63813551380de1382064638f188d433efa8caab4bcf04b55d3a2778b35cf869574e55126edb0a866c8c2210811f626e123984c1578eea143687583ec9cd45399277cba"], 0x48) openat$cgroup_root(0xffffffffffffff9c, 0x0, 0x200002, 0x0) openat$cuse(0xffffffffffffff9c, 0x0, 0x2, 0x0) write$cgroup_pid(0xffffffffffffffff, &(0x7f0000000500), 0x3) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x400000bce) r0 = syz_open_dev$MSR(&(0x7f0000000300), 0x100040000, 0x0) read$msr(r0, &(0x7f0000019680)=""/102392, 0x18ff8) write$cgroup_pid(0xffffffffffffffff, &(0x7f00000001c0), 0x12) r1 = syz_open_dev$usbfs(&(0x7f0000000100), 0x206, 0x8401) ioctl$USBDEVFS_ALLOW_SUSPEND(r1, 0x5522) ioctl$USBDEVFS_CONTROL(r1, 0xc0185500, &(0x7f0000001380)={0x0, 0x10, 0xf109, 0x8, 0x0, 0x4, 0x0}) getsockopt$IP_VS_SO_GET_DAEMON(0xffffffffffffffff, 0x0, 0x487, &(0x7f0000000040), &(0x7f00000000c0)=0x30) r2 = syz_init_net_socket$x25(0x9, 0x5, 0x0) sendmsg$NFT_BATCH(0xffffffffffffffff, &(0x7f000000c2c0)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000340)=ANY=[@ANYBLOB="140000001000010000000000000000000000000a28000000000a0101000000005e1affd5020000000900010073797a300000000008000240000000032c000000030a01030000e6ff00000000020000000900010073797a30000000000900030073797a320000000014000000110001"], 0x7c}}, 0x0) sendmsg$NFT_BATCH(0xffffffffffffffff, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000540)=ANY=[@ANYBLOB="14005dd31000010000000000000000000200000a54000000060a0b04000000000000002800048024000180090001006d6574610000000014000280080002400000000e080003ff000000000900010073797a30000000000900020073797a3200000000140000001100010000000000000000000000000a0000bcd9392755d0553208396b1104bd0138b9d4dcc29076671bfcd406a184eee3783779b059bf3c1d3a573e716c57ed4ab238d496fa0d3fb51054a62d7055d068124ff4184e12a61862bc0120f727e9e5c7ae925054af63819ba5f79d772ba27895dc48a6796db8d6b142c81e1c43cc58e8cef58790fddf4278fde59f4d57d0f4cb44e9f041ba703fb942342396717badaae97c20475dabfd374400"/284], 0x7c}}, 0x0) getsockopt$X25_QBITINCL(r2, 0x106, 0x1, 0x0, &(0x7f0000000240)=0xfffffffffffffee0) add_key(&(0x7f0000000140)='encrypted\x00', &(0x7f0000000180), &(0x7f0000000100), 0xca, 0xfffffffffffffffe) r3 = socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$inet_opts(r3, 0x0, 0x80000000000008, &(0x7f0000000280)="0f", 0x1) r4 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000040)='cpuacct.usage_sys\x00', 0x275a, 0x0) mmap(&(0x7f0000000000/0x400000)=nil, 0x400000, 0x1, 0x10012, r4, 0x0) getsockopt$inet_opts(r3, 0x0, 0x9, &(0x7f0000000200)=""/49, &(0x7f0000000080)=0x31) program did not crash testing program (duration=2m39.94419324s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): bpf$MAP_CREATE_TAIL_CALL-openat$cgroup_root-openat$cuse-write$cgroup_pid-prctl$PR_SCHED_CORE-prlimit64-sched_setaffinity-syz_open_dev$MSR-read$msr-write$cgroup_pid-syz_open_dev$usbfs-ioctl$USBDEVFS_ALLOW_SUSPEND-ioctl$USBDEVFS_CONTROL-getsockopt$IP_VS_SO_GET_DAEMON-syz_init_net_socket$x25-sendmsg$NFT_BATCH-sendmsg$NFT_BATCH-getsockopt$X25_QBITINCL-add_key-socket$inet_tcp-setsockopt$inet_opts-openat$cgroup_ro-mmap-futex detailed listing: executing program 0: bpf$MAP_CREATE_TAIL_CALL(0x0, &(0x7f00000007c0)=ANY=[@ANYBLOB="0300000004000000040000000a00000000000000", @ANYRES32=0x0, @ANYBLOB='\x00'/20, @ANYRES32=0x0, @ANYRES32=0x0, @ANYBLOB="000000000000000000000000000000000000000000000000000000002488b2f9e74580af107c0e1d82e10ec48719c67c3a2c410e56c69d665be4d063622980f8cb451837ec40c83579dab92e8f84c849607fcefb8f68d30f5cef9a27821ae15259e0a5f3fde268d4d90d504f96fd259153f0a0e56e8348de69c712c4745807e57b8037dcc4948ce942ee622e67b803a7993e63813551380de1382064638f188d433efa8caab4bcf04b55d3a2778b35cf869574e55126edb0a866c8c2210811f626e123984c1578eea143687583ec9cd45399277cba"], 0x48) openat$cgroup_root(0xffffffffffffff9c, 0x0, 0x200002, 0x0) openat$cuse(0xffffffffffffff9c, 0x0, 0x2, 0x0) write$cgroup_pid(0xffffffffffffffff, &(0x7f0000000500), 0x3) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x400000bce) r0 = syz_open_dev$MSR(&(0x7f0000000300), 0x100040000, 0x0) read$msr(r0, &(0x7f0000019680)=""/102392, 0x18ff8) write$cgroup_pid(0xffffffffffffffff, &(0x7f00000001c0), 0x12) r1 = syz_open_dev$usbfs(&(0x7f0000000100), 0x206, 0x8401) ioctl$USBDEVFS_ALLOW_SUSPEND(r1, 0x5522) ioctl$USBDEVFS_CONTROL(r1, 0xc0185500, &(0x7f0000001380)={0x0, 0x10, 0xf109, 0x8, 0x0, 0x4, 0x0}) getsockopt$IP_VS_SO_GET_DAEMON(0xffffffffffffffff, 0x0, 0x487, &(0x7f0000000040), &(0x7f00000000c0)=0x30) r2 = syz_init_net_socket$x25(0x9, 0x5, 0x0) sendmsg$NFT_BATCH(0xffffffffffffffff, &(0x7f000000c2c0)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000340)=ANY=[@ANYBLOB="140000001000010000000000000000000000000a28000000000a0101000000005e1affd5020000000900010073797a300000000008000240000000032c000000030a01030000e6ff00000000020000000900010073797a30000000000900030073797a320000000014000000110001"], 0x7c}}, 0x0) sendmsg$NFT_BATCH(0xffffffffffffffff, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000540)=ANY=[@ANYBLOB="14005dd31000010000000000000000000200000a54000000060a0b04000000000000002800048024000180090001006d6574610000000014000280080002400000000e080003ff000000000900010073797a30000000000900020073797a3200000000140000001100010000000000000000000000000a0000bcd9392755d0553208396b1104bd0138b9d4dcc29076671bfcd406a184eee3783779b059bf3c1d3a573e716c57ed4ab238d496fa0d3fb51054a62d7055d068124ff4184e12a61862bc0120f727e9e5c7ae925054af63819ba5f79d772ba27895dc48a6796db8d6b142c81e1c43cc58e8cef58790fddf4278fde59f4d57d0f4cb44e9f041ba703fb942342396717badaae97c20475dabfd374400"/284], 0x7c}}, 0x0) getsockopt$X25_QBITINCL(r2, 0x106, 0x1, 0x0, &(0x7f0000000240)=0xfffffffffffffee0) add_key(&(0x7f0000000140)='encrypted\x00', &(0x7f0000000180), &(0x7f0000000100), 0xca, 0xfffffffffffffffe) r3 = socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$inet_opts(r3, 0x0, 0x80000000000008, &(0x7f0000000280)="0f", 0x1) r4 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000040)='cpuacct.usage_sys\x00', 0x275a, 0x0) mmap(&(0x7f0000000000/0x400000)=nil, 0x400000, 0x1, 0x10012, r4, 0x0) futex(&(0x7f0000000000), 0x9, 0x2, 0x0, &(0x7f0000000340)=0x2, 0x0) program crashed: KASAN: slab-use-after-free Read in key_put testing program (duration=2m39.94419324s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): bpf$MAP_CREATE_TAIL_CALL-openat$cgroup_root-openat$cuse-write$cgroup_pid-prctl$PR_SCHED_CORE-prlimit64-sched_setaffinity-syz_open_dev$MSR-read$msr-write$cgroup_pid-syz_open_dev$usbfs-ioctl$USBDEVFS_ALLOW_SUSPEND-ioctl$USBDEVFS_CONTROL-getsockopt$IP_VS_SO_GET_DAEMON-syz_init_net_socket$x25-sendmsg$NFT_BATCH-sendmsg$NFT_BATCH-getsockopt$X25_QBITINCL-add_key-socket$inet_tcp-setsockopt$inet_opts-openat$cgroup_ro-futex detailed listing: executing program 0: bpf$MAP_CREATE_TAIL_CALL(0x0, &(0x7f00000007c0)=ANY=[@ANYBLOB="0300000004000000040000000a00000000000000", @ANYRES32=0x0, @ANYBLOB='\x00'/20, @ANYRES32=0x0, @ANYRES32=0x0, @ANYBLOB="000000000000000000000000000000000000000000000000000000002488b2f9e74580af107c0e1d82e10ec48719c67c3a2c410e56c69d665be4d063622980f8cb451837ec40c83579dab92e8f84c849607fcefb8f68d30f5cef9a27821ae15259e0a5f3fde268d4d90d504f96fd259153f0a0e56e8348de69c712c4745807e57b8037dcc4948ce942ee622e67b803a7993e63813551380de1382064638f188d433efa8caab4bcf04b55d3a2778b35cf869574e55126edb0a866c8c2210811f626e123984c1578eea143687583ec9cd45399277cba"], 0x48) openat$cgroup_root(0xffffffffffffff9c, 0x0, 0x200002, 0x0) openat$cuse(0xffffffffffffff9c, 0x0, 0x2, 0x0) write$cgroup_pid(0xffffffffffffffff, &(0x7f0000000500), 0x3) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x400000bce) r0 = syz_open_dev$MSR(&(0x7f0000000300), 0x100040000, 0x0) read$msr(r0, &(0x7f0000019680)=""/102392, 0x18ff8) write$cgroup_pid(0xffffffffffffffff, &(0x7f00000001c0), 0x12) r1 = syz_open_dev$usbfs(&(0x7f0000000100), 0x206, 0x8401) ioctl$USBDEVFS_ALLOW_SUSPEND(r1, 0x5522) ioctl$USBDEVFS_CONTROL(r1, 0xc0185500, &(0x7f0000001380)={0x0, 0x10, 0xf109, 0x8, 0x0, 0x4, 0x0}) getsockopt$IP_VS_SO_GET_DAEMON(0xffffffffffffffff, 0x0, 0x487, &(0x7f0000000040), &(0x7f00000000c0)=0x30) r2 = syz_init_net_socket$x25(0x9, 0x5, 0x0) sendmsg$NFT_BATCH(0xffffffffffffffff, &(0x7f000000c2c0)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000340)=ANY=[@ANYBLOB="140000001000010000000000000000000000000a28000000000a0101000000005e1affd5020000000900010073797a300000000008000240000000032c000000030a01030000e6ff00000000020000000900010073797a30000000000900030073797a320000000014000000110001"], 0x7c}}, 0x0) sendmsg$NFT_BATCH(0xffffffffffffffff, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000540)=ANY=[@ANYBLOB="14005dd31000010000000000000000000200000a54000000060a0b04000000000000002800048024000180090001006d6574610000000014000280080002400000000e080003ff000000000900010073797a30000000000900020073797a3200000000140000001100010000000000000000000000000a0000bcd9392755d0553208396b1104bd0138b9d4dcc29076671bfcd406a184eee3783779b059bf3c1d3a573e716c57ed4ab238d496fa0d3fb51054a62d7055d068124ff4184e12a61862bc0120f727e9e5c7ae925054af63819ba5f79d772ba27895dc48a6796db8d6b142c81e1c43cc58e8cef58790fddf4278fde59f4d57d0f4cb44e9f041ba703fb942342396717badaae97c20475dabfd374400"/284], 0x7c}}, 0x0) getsockopt$X25_QBITINCL(r2, 0x106, 0x1, 0x0, &(0x7f0000000240)=0xfffffffffffffee0) add_key(&(0x7f0000000140)='encrypted\x00', &(0x7f0000000180), &(0x7f0000000100), 0xca, 0xfffffffffffffffe) r3 = socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$inet_opts(r3, 0x0, 0x80000000000008, &(0x7f0000000280)="0f", 0x1) openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000040)='cpuacct.usage_sys\x00', 0x275a, 0x0) futex(&(0x7f0000000000), 0x9, 0x2, 0x0, &(0x7f0000000340)=0x2, 0x0) program did not crash testing program (duration=2m39.94419324s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): bpf$MAP_CREATE_TAIL_CALL-openat$cgroup_root-openat$cuse-write$cgroup_pid-prctl$PR_SCHED_CORE-prlimit64-sched_setaffinity-syz_open_dev$MSR-read$msr-write$cgroup_pid-syz_open_dev$usbfs-ioctl$USBDEVFS_ALLOW_SUSPEND-ioctl$USBDEVFS_CONTROL-getsockopt$IP_VS_SO_GET_DAEMON-syz_init_net_socket$x25-sendmsg$NFT_BATCH-sendmsg$NFT_BATCH-getsockopt$X25_QBITINCL-add_key-socket$inet_tcp-setsockopt$inet_opts-mmap-futex detailed listing: executing program 0: bpf$MAP_CREATE_TAIL_CALL(0x0, &(0x7f00000007c0)=ANY=[@ANYBLOB="0300000004000000040000000a00000000000000", @ANYRES32=0x0, @ANYBLOB='\x00'/20, @ANYRES32=0x0, @ANYRES32=0x0, @ANYBLOB="000000000000000000000000000000000000000000000000000000002488b2f9e74580af107c0e1d82e10ec48719c67c3a2c410e56c69d665be4d063622980f8cb451837ec40c83579dab92e8f84c849607fcefb8f68d30f5cef9a27821ae15259e0a5f3fde268d4d90d504f96fd259153f0a0e56e8348de69c712c4745807e57b8037dcc4948ce942ee622e67b803a7993e63813551380de1382064638f188d433efa8caab4bcf04b55d3a2778b35cf869574e55126edb0a866c8c2210811f626e123984c1578eea143687583ec9cd45399277cba"], 0x48) openat$cgroup_root(0xffffffffffffff9c, 0x0, 0x200002, 0x0) openat$cuse(0xffffffffffffff9c, 0x0, 0x2, 0x0) write$cgroup_pid(0xffffffffffffffff, &(0x7f0000000500), 0x3) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x400000bce) r0 = syz_open_dev$MSR(&(0x7f0000000300), 0x100040000, 0x0) read$msr(r0, &(0x7f0000019680)=""/102392, 0x18ff8) write$cgroup_pid(0xffffffffffffffff, &(0x7f00000001c0), 0x12) r1 = syz_open_dev$usbfs(&(0x7f0000000100), 0x206, 0x8401) ioctl$USBDEVFS_ALLOW_SUSPEND(r1, 0x5522) ioctl$USBDEVFS_CONTROL(r1, 0xc0185500, &(0x7f0000001380)={0x0, 0x10, 0xf109, 0x8, 0x0, 0x4, 0x0}) getsockopt$IP_VS_SO_GET_DAEMON(0xffffffffffffffff, 0x0, 0x487, &(0x7f0000000040), &(0x7f00000000c0)=0x30) r2 = syz_init_net_socket$x25(0x9, 0x5, 0x0) sendmsg$NFT_BATCH(0xffffffffffffffff, &(0x7f000000c2c0)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000340)=ANY=[@ANYBLOB="140000001000010000000000000000000000000a28000000000a0101000000005e1affd5020000000900010073797a300000000008000240000000032c000000030a01030000e6ff00000000020000000900010073797a30000000000900030073797a320000000014000000110001"], 0x7c}}, 0x0) sendmsg$NFT_BATCH(0xffffffffffffffff, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000540)=ANY=[@ANYBLOB="14005dd31000010000000000000000000200000a54000000060a0b04000000000000002800048024000180090001006d6574610000000014000280080002400000000e080003ff000000000900010073797a30000000000900020073797a3200000000140000001100010000000000000000000000000a0000bcd9392755d0553208396b1104bd0138b9d4dcc29076671bfcd406a184eee3783779b059bf3c1d3a573e716c57ed4ab238d496fa0d3fb51054a62d7055d068124ff4184e12a61862bc0120f727e9e5c7ae925054af63819ba5f79d772ba27895dc48a6796db8d6b142c81e1c43cc58e8cef58790fddf4278fde59f4d57d0f4cb44e9f041ba703fb942342396717badaae97c20475dabfd374400"/284], 0x7c}}, 0x0) getsockopt$X25_QBITINCL(r2, 0x106, 0x1, 0x0, &(0x7f0000000240)=0xfffffffffffffee0) add_key(&(0x7f0000000140)='encrypted\x00', &(0x7f0000000180), &(0x7f0000000100), 0xca, 0xfffffffffffffffe) r3 = socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$inet_opts(r3, 0x0, 0x80000000000008, &(0x7f0000000280)="0f", 0x1) mmap(&(0x7f0000000000/0x400000)=nil, 0x400000, 0x1, 0x10012, 0xffffffffffffffff, 0x0) futex(&(0x7f0000000000), 0x9, 0x2, 0x0, &(0x7f0000000340)=0x2, 0x0) program did not crash testing program (duration=2m39.94419324s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): bpf$MAP_CREATE_TAIL_CALL-openat$cgroup_root-openat$cuse-write$cgroup_pid-prctl$PR_SCHED_CORE-prlimit64-sched_setaffinity-syz_open_dev$MSR-read$msr-write$cgroup_pid-syz_open_dev$usbfs-ioctl$USBDEVFS_ALLOW_SUSPEND-ioctl$USBDEVFS_CONTROL-getsockopt$IP_VS_SO_GET_DAEMON-syz_init_net_socket$x25-sendmsg$NFT_BATCH-sendmsg$NFT_BATCH-getsockopt$X25_QBITINCL-add_key-socket$inet_tcp-openat$cgroup_ro-mmap-futex detailed listing: executing program 0: bpf$MAP_CREATE_TAIL_CALL(0x0, &(0x7f00000007c0)=ANY=[@ANYBLOB="0300000004000000040000000a00000000000000", @ANYRES32=0x0, @ANYBLOB='\x00'/20, @ANYRES32=0x0, @ANYRES32=0x0, @ANYBLOB="000000000000000000000000000000000000000000000000000000002488b2f9e74580af107c0e1d82e10ec48719c67c3a2c410e56c69d665be4d063622980f8cb451837ec40c83579dab92e8f84c849607fcefb8f68d30f5cef9a27821ae15259e0a5f3fde268d4d90d504f96fd259153f0a0e56e8348de69c712c4745807e57b8037dcc4948ce942ee622e67b803a7993e63813551380de1382064638f188d433efa8caab4bcf04b55d3a2778b35cf869574e55126edb0a866c8c2210811f626e123984c1578eea143687583ec9cd45399277cba"], 0x48) openat$cgroup_root(0xffffffffffffff9c, 0x0, 0x200002, 0x0) openat$cuse(0xffffffffffffff9c, 0x0, 0x2, 0x0) write$cgroup_pid(0xffffffffffffffff, &(0x7f0000000500), 0x3) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x400000bce) r0 = syz_open_dev$MSR(&(0x7f0000000300), 0x100040000, 0x0) read$msr(r0, &(0x7f0000019680)=""/102392, 0x18ff8) write$cgroup_pid(0xffffffffffffffff, &(0x7f00000001c0), 0x12) r1 = syz_open_dev$usbfs(&(0x7f0000000100), 0x206, 0x8401) ioctl$USBDEVFS_ALLOW_SUSPEND(r1, 0x5522) ioctl$USBDEVFS_CONTROL(r1, 0xc0185500, &(0x7f0000001380)={0x0, 0x10, 0xf109, 0x8, 0x0, 0x4, 0x0}) getsockopt$IP_VS_SO_GET_DAEMON(0xffffffffffffffff, 0x0, 0x487, &(0x7f0000000040), &(0x7f00000000c0)=0x30) r2 = syz_init_net_socket$x25(0x9, 0x5, 0x0) sendmsg$NFT_BATCH(0xffffffffffffffff, &(0x7f000000c2c0)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000340)=ANY=[@ANYBLOB="140000001000010000000000000000000000000a28000000000a0101000000005e1affd5020000000900010073797a300000000008000240000000032c000000030a01030000e6ff00000000020000000900010073797a30000000000900030073797a320000000014000000110001"], 0x7c}}, 0x0) sendmsg$NFT_BATCH(0xffffffffffffffff, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000540)=ANY=[@ANYBLOB="14005dd31000010000000000000000000200000a54000000060a0b04000000000000002800048024000180090001006d6574610000000014000280080002400000000e080003ff000000000900010073797a30000000000900020073797a3200000000140000001100010000000000000000000000000a0000bcd9392755d0553208396b1104bd0138b9d4dcc29076671bfcd406a184eee3783779b059bf3c1d3a573e716c57ed4ab238d496fa0d3fb51054a62d7055d068124ff4184e12a61862bc0120f727e9e5c7ae925054af63819ba5f79d772ba27895dc48a6796db8d6b142c81e1c43cc58e8cef58790fddf4278fde59f4d57d0f4cb44e9f041ba703fb942342396717badaae97c20475dabfd374400"/284], 0x7c}}, 0x0) getsockopt$X25_QBITINCL(r2, 0x106, 0x1, 0x0, &(0x7f0000000240)=0xfffffffffffffee0) add_key(&(0x7f0000000140)='encrypted\x00', &(0x7f0000000180), &(0x7f0000000100), 0xca, 0xfffffffffffffffe) socket$inet_tcp(0x2, 0x1, 0x0) r3 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000040)='cpuacct.usage_sys\x00', 0x275a, 0x0) mmap(&(0x7f0000000000/0x400000)=nil, 0x400000, 0x1, 0x10012, r3, 0x0) futex(&(0x7f0000000000), 0x9, 0x2, 0x0, &(0x7f0000000340)=0x2, 0x0) program crashed: KASAN: slab-use-after-free Read in key_put testing program (duration=2m39.94419324s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): bpf$MAP_CREATE_TAIL_CALL-openat$cgroup_root-openat$cuse-write$cgroup_pid-prctl$PR_SCHED_CORE-prlimit64-sched_setaffinity-syz_open_dev$MSR-read$msr-write$cgroup_pid-syz_open_dev$usbfs-ioctl$USBDEVFS_ALLOW_SUSPEND-ioctl$USBDEVFS_CONTROL-getsockopt$IP_VS_SO_GET_DAEMON-syz_init_net_socket$x25-sendmsg$NFT_BATCH-sendmsg$NFT_BATCH-getsockopt$X25_QBITINCL-add_key-openat$cgroup_ro-mmap-futex detailed listing: executing program 0: bpf$MAP_CREATE_TAIL_CALL(0x0, &(0x7f00000007c0)=ANY=[@ANYBLOB="0300000004000000040000000a00000000000000", @ANYRES32=0x0, @ANYBLOB='\x00'/20, @ANYRES32=0x0, @ANYRES32=0x0, @ANYBLOB="000000000000000000000000000000000000000000000000000000002488b2f9e74580af107c0e1d82e10ec48719c67c3a2c410e56c69d665be4d063622980f8cb451837ec40c83579dab92e8f84c849607fcefb8f68d30f5cef9a27821ae15259e0a5f3fde268d4d90d504f96fd259153f0a0e56e8348de69c712c4745807e57b8037dcc4948ce942ee622e67b803a7993e63813551380de1382064638f188d433efa8caab4bcf04b55d3a2778b35cf869574e55126edb0a866c8c2210811f626e123984c1578eea143687583ec9cd45399277cba"], 0x48) openat$cgroup_root(0xffffffffffffff9c, 0x0, 0x200002, 0x0) openat$cuse(0xffffffffffffff9c, 0x0, 0x2, 0x0) write$cgroup_pid(0xffffffffffffffff, &(0x7f0000000500), 0x3) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x400000bce) r0 = syz_open_dev$MSR(&(0x7f0000000300), 0x100040000, 0x0) read$msr(r0, &(0x7f0000019680)=""/102392, 0x18ff8) write$cgroup_pid(0xffffffffffffffff, &(0x7f00000001c0), 0x12) r1 = syz_open_dev$usbfs(&(0x7f0000000100), 0x206, 0x8401) ioctl$USBDEVFS_ALLOW_SUSPEND(r1, 0x5522) ioctl$USBDEVFS_CONTROL(r1, 0xc0185500, &(0x7f0000001380)={0x0, 0x10, 0xf109, 0x8, 0x0, 0x4, 0x0}) getsockopt$IP_VS_SO_GET_DAEMON(0xffffffffffffffff, 0x0, 0x487, &(0x7f0000000040), &(0x7f00000000c0)=0x30) r2 = syz_init_net_socket$x25(0x9, 0x5, 0x0) sendmsg$NFT_BATCH(0xffffffffffffffff, &(0x7f000000c2c0)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000340)=ANY=[@ANYBLOB="140000001000010000000000000000000000000a28000000000a0101000000005e1affd5020000000900010073797a300000000008000240000000032c000000030a01030000e6ff00000000020000000900010073797a30000000000900030073797a320000000014000000110001"], 0x7c}}, 0x0) sendmsg$NFT_BATCH(0xffffffffffffffff, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000540)=ANY=[@ANYBLOB="14005dd31000010000000000000000000200000a54000000060a0b04000000000000002800048024000180090001006d6574610000000014000280080002400000000e080003ff000000000900010073797a30000000000900020073797a3200000000140000001100010000000000000000000000000a0000bcd9392755d0553208396b1104bd0138b9d4dcc29076671bfcd406a184eee3783779b059bf3c1d3a573e716c57ed4ab238d496fa0d3fb51054a62d7055d068124ff4184e12a61862bc0120f727e9e5c7ae925054af63819ba5f79d772ba27895dc48a6796db8d6b142c81e1c43cc58e8cef58790fddf4278fde59f4d57d0f4cb44e9f041ba703fb942342396717badaae97c20475dabfd374400"/284], 0x7c}}, 0x0) getsockopt$X25_QBITINCL(r2, 0x106, 0x1, 0x0, &(0x7f0000000240)=0xfffffffffffffee0) add_key(&(0x7f0000000140)='encrypted\x00', &(0x7f0000000180), &(0x7f0000000100), 0xca, 0xfffffffffffffffe) r3 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000040)='cpuacct.usage_sys\x00', 0x275a, 0x0) mmap(&(0x7f0000000000/0x400000)=nil, 0x400000, 0x1, 0x10012, r3, 0x0) futex(&(0x7f0000000000), 0x9, 0x2, 0x0, &(0x7f0000000340)=0x2, 0x0) program did not crash testing program (duration=2m39.94419324s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): bpf$MAP_CREATE_TAIL_CALL-openat$cgroup_root-openat$cuse-write$cgroup_pid-prctl$PR_SCHED_CORE-prlimit64-sched_setaffinity-syz_open_dev$MSR-read$msr-write$cgroup_pid-syz_open_dev$usbfs-ioctl$USBDEVFS_ALLOW_SUSPEND-ioctl$USBDEVFS_CONTROL-getsockopt$IP_VS_SO_GET_DAEMON-syz_init_net_socket$x25-sendmsg$NFT_BATCH-sendmsg$NFT_BATCH-getsockopt$X25_QBITINCL-socket$inet_tcp-openat$cgroup_ro-mmap-futex detailed listing: executing program 0: bpf$MAP_CREATE_TAIL_CALL(0x0, &(0x7f00000007c0)=ANY=[@ANYBLOB="0300000004000000040000000a00000000000000", @ANYRES32=0x0, @ANYBLOB='\x00'/20, @ANYRES32=0x0, @ANYRES32=0x0, @ANYBLOB="000000000000000000000000000000000000000000000000000000002488b2f9e74580af107c0e1d82e10ec48719c67c3a2c410e56c69d665be4d063622980f8cb451837ec40c83579dab92e8f84c849607fcefb8f68d30f5cef9a27821ae15259e0a5f3fde268d4d90d504f96fd259153f0a0e56e8348de69c712c4745807e57b8037dcc4948ce942ee622e67b803a7993e63813551380de1382064638f188d433efa8caab4bcf04b55d3a2778b35cf869574e55126edb0a866c8c2210811f626e123984c1578eea143687583ec9cd45399277cba"], 0x48) openat$cgroup_root(0xffffffffffffff9c, 0x0, 0x200002, 0x0) openat$cuse(0xffffffffffffff9c, 0x0, 0x2, 0x0) write$cgroup_pid(0xffffffffffffffff, &(0x7f0000000500), 0x3) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x400000bce) r0 = syz_open_dev$MSR(&(0x7f0000000300), 0x100040000, 0x0) read$msr(r0, &(0x7f0000019680)=""/102392, 0x18ff8) write$cgroup_pid(0xffffffffffffffff, &(0x7f00000001c0), 0x12) r1 = syz_open_dev$usbfs(&(0x7f0000000100), 0x206, 0x8401) ioctl$USBDEVFS_ALLOW_SUSPEND(r1, 0x5522) ioctl$USBDEVFS_CONTROL(r1, 0xc0185500, &(0x7f0000001380)={0x0, 0x10, 0xf109, 0x8, 0x0, 0x4, 0x0}) getsockopt$IP_VS_SO_GET_DAEMON(0xffffffffffffffff, 0x0, 0x487, &(0x7f0000000040), &(0x7f00000000c0)=0x30) r2 = syz_init_net_socket$x25(0x9, 0x5, 0x0) sendmsg$NFT_BATCH(0xffffffffffffffff, &(0x7f000000c2c0)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000340)=ANY=[@ANYBLOB="140000001000010000000000000000000000000a28000000000a0101000000005e1affd5020000000900010073797a300000000008000240000000032c000000030a01030000e6ff00000000020000000900010073797a30000000000900030073797a320000000014000000110001"], 0x7c}}, 0x0) sendmsg$NFT_BATCH(0xffffffffffffffff, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000540)=ANY=[@ANYBLOB="14005dd31000010000000000000000000200000a54000000060a0b04000000000000002800048024000180090001006d6574610000000014000280080002400000000e080003ff000000000900010073797a30000000000900020073797a3200000000140000001100010000000000000000000000000a0000bcd9392755d0553208396b1104bd0138b9d4dcc29076671bfcd406a184eee3783779b059bf3c1d3a573e716c57ed4ab238d496fa0d3fb51054a62d7055d068124ff4184e12a61862bc0120f727e9e5c7ae925054af63819ba5f79d772ba27895dc48a6796db8d6b142c81e1c43cc58e8cef58790fddf4278fde59f4d57d0f4cb44e9f041ba703fb942342396717badaae97c20475dabfd374400"/284], 0x7c}}, 0x0) getsockopt$X25_QBITINCL(r2, 0x106, 0x1, 0x0, &(0x7f0000000240)=0xfffffffffffffee0) socket$inet_tcp(0x2, 0x1, 0x0) r3 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000040)='cpuacct.usage_sys\x00', 0x275a, 0x0) mmap(&(0x7f0000000000/0x400000)=nil, 0x400000, 0x1, 0x10012, r3, 0x0) futex(&(0x7f0000000000), 0x9, 0x2, 0x0, &(0x7f0000000340)=0x2, 0x0) program did not crash testing program (duration=2m39.94419324s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): bpf$MAP_CREATE_TAIL_CALL-openat$cgroup_root-openat$cuse-write$cgroup_pid-prctl$PR_SCHED_CORE-prlimit64-sched_setaffinity-syz_open_dev$MSR-read$msr-write$cgroup_pid-syz_open_dev$usbfs-ioctl$USBDEVFS_ALLOW_SUSPEND-ioctl$USBDEVFS_CONTROL-getsockopt$IP_VS_SO_GET_DAEMON-syz_init_net_socket$x25-sendmsg$NFT_BATCH-sendmsg$NFT_BATCH-add_key-socket$inet_tcp-openat$cgroup_ro-mmap-futex detailed listing: executing program 0: bpf$MAP_CREATE_TAIL_CALL(0x0, &(0x7f00000007c0)=ANY=[@ANYBLOB="0300000004000000040000000a00000000000000", @ANYRES32=0x0, @ANYBLOB='\x00'/20, @ANYRES32=0x0, @ANYRES32=0x0, @ANYBLOB="000000000000000000000000000000000000000000000000000000002488b2f9e74580af107c0e1d82e10ec48719c67c3a2c410e56c69d665be4d063622980f8cb451837ec40c83579dab92e8f84c849607fcefb8f68d30f5cef9a27821ae15259e0a5f3fde268d4d90d504f96fd259153f0a0e56e8348de69c712c4745807e57b8037dcc4948ce942ee622e67b803a7993e63813551380de1382064638f188d433efa8caab4bcf04b55d3a2778b35cf869574e55126edb0a866c8c2210811f626e123984c1578eea143687583ec9cd45399277cba"], 0x48) openat$cgroup_root(0xffffffffffffff9c, 0x0, 0x200002, 0x0) openat$cuse(0xffffffffffffff9c, 0x0, 0x2, 0x0) write$cgroup_pid(0xffffffffffffffff, &(0x7f0000000500), 0x3) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x400000bce) r0 = syz_open_dev$MSR(&(0x7f0000000300), 0x100040000, 0x0) read$msr(r0, &(0x7f0000019680)=""/102392, 0x18ff8) write$cgroup_pid(0xffffffffffffffff, &(0x7f00000001c0), 0x12) r1 = syz_open_dev$usbfs(&(0x7f0000000100), 0x206, 0x8401) ioctl$USBDEVFS_ALLOW_SUSPEND(r1, 0x5522) ioctl$USBDEVFS_CONTROL(r1, 0xc0185500, &(0x7f0000001380)={0x0, 0x10, 0xf109, 0x8, 0x0, 0x4, 0x0}) getsockopt$IP_VS_SO_GET_DAEMON(0xffffffffffffffff, 0x0, 0x487, &(0x7f0000000040), &(0x7f00000000c0)=0x30) syz_init_net_socket$x25(0x9, 0x5, 0x0) sendmsg$NFT_BATCH(0xffffffffffffffff, &(0x7f000000c2c0)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000340)=ANY=[@ANYBLOB="140000001000010000000000000000000000000a28000000000a0101000000005e1affd5020000000900010073797a300000000008000240000000032c000000030a01030000e6ff00000000020000000900010073797a30000000000900030073797a320000000014000000110001"], 0x7c}}, 0x0) sendmsg$NFT_BATCH(0xffffffffffffffff, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000540)=ANY=[@ANYBLOB="14005dd31000010000000000000000000200000a54000000060a0b04000000000000002800048024000180090001006d6574610000000014000280080002400000000e080003ff000000000900010073797a30000000000900020073797a3200000000140000001100010000000000000000000000000a0000bcd9392755d0553208396b1104bd0138b9d4dcc29076671bfcd406a184eee3783779b059bf3c1d3a573e716c57ed4ab238d496fa0d3fb51054a62d7055d068124ff4184e12a61862bc0120f727e9e5c7ae925054af63819ba5f79d772ba27895dc48a6796db8d6b142c81e1c43cc58e8cef58790fddf4278fde59f4d57d0f4cb44e9f041ba703fb942342396717badaae97c20475dabfd374400"/284], 0x7c}}, 0x0) add_key(&(0x7f0000000140)='encrypted\x00', &(0x7f0000000180), &(0x7f0000000100), 0xca, 0xfffffffffffffffe) socket$inet_tcp(0x2, 0x1, 0x0) r2 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000040)='cpuacct.usage_sys\x00', 0x275a, 0x0) mmap(&(0x7f0000000000/0x400000)=nil, 0x400000, 0x1, 0x10012, r2, 0x0) futex(&(0x7f0000000000), 0x9, 0x2, 0x0, &(0x7f0000000340)=0x2, 0x0) program did not crash testing program (duration=2m39.94419324s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): bpf$MAP_CREATE_TAIL_CALL-openat$cgroup_root-openat$cuse-write$cgroup_pid-prctl$PR_SCHED_CORE-prlimit64-sched_setaffinity-syz_open_dev$MSR-read$msr-write$cgroup_pid-syz_open_dev$usbfs-ioctl$USBDEVFS_ALLOW_SUSPEND-ioctl$USBDEVFS_CONTROL-getsockopt$IP_VS_SO_GET_DAEMON-syz_init_net_socket$x25-sendmsg$NFT_BATCH-getsockopt$X25_QBITINCL-add_key-socket$inet_tcp-openat$cgroup_ro-mmap-futex detailed listing: executing program 0: bpf$MAP_CREATE_TAIL_CALL(0x0, &(0x7f00000007c0)=ANY=[@ANYBLOB="0300000004000000040000000a00000000000000", @ANYRES32=0x0, @ANYBLOB='\x00'/20, @ANYRES32=0x0, @ANYRES32=0x0, @ANYBLOB="000000000000000000000000000000000000000000000000000000002488b2f9e74580af107c0e1d82e10ec48719c67c3a2c410e56c69d665be4d063622980f8cb451837ec40c83579dab92e8f84c849607fcefb8f68d30f5cef9a27821ae15259e0a5f3fde268d4d90d504f96fd259153f0a0e56e8348de69c712c4745807e57b8037dcc4948ce942ee622e67b803a7993e63813551380de1382064638f188d433efa8caab4bcf04b55d3a2778b35cf869574e55126edb0a866c8c2210811f626e123984c1578eea143687583ec9cd45399277cba"], 0x48) openat$cgroup_root(0xffffffffffffff9c, 0x0, 0x200002, 0x0) openat$cuse(0xffffffffffffff9c, 0x0, 0x2, 0x0) write$cgroup_pid(0xffffffffffffffff, &(0x7f0000000500), 0x3) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x400000bce) r0 = syz_open_dev$MSR(&(0x7f0000000300), 0x100040000, 0x0) read$msr(r0, &(0x7f0000019680)=""/102392, 0x18ff8) write$cgroup_pid(0xffffffffffffffff, &(0x7f00000001c0), 0x12) r1 = syz_open_dev$usbfs(&(0x7f0000000100), 0x206, 0x8401) ioctl$USBDEVFS_ALLOW_SUSPEND(r1, 0x5522) ioctl$USBDEVFS_CONTROL(r1, 0xc0185500, &(0x7f0000001380)={0x0, 0x10, 0xf109, 0x8, 0x0, 0x4, 0x0}) getsockopt$IP_VS_SO_GET_DAEMON(0xffffffffffffffff, 0x0, 0x487, &(0x7f0000000040), &(0x7f00000000c0)=0x30) r2 = syz_init_net_socket$x25(0x9, 0x5, 0x0) sendmsg$NFT_BATCH(0xffffffffffffffff, &(0x7f000000c2c0)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000340)=ANY=[@ANYBLOB="140000001000010000000000000000000000000a28000000000a0101000000005e1affd5020000000900010073797a300000000008000240000000032c000000030a01030000e6ff00000000020000000900010073797a30000000000900030073797a320000000014000000110001"], 0x7c}}, 0x0) getsockopt$X25_QBITINCL(r2, 0x106, 0x1, 0x0, &(0x7f0000000240)=0xfffffffffffffee0) add_key(&(0x7f0000000140)='encrypted\x00', &(0x7f0000000180), &(0x7f0000000100), 0xca, 0xfffffffffffffffe) socket$inet_tcp(0x2, 0x1, 0x0) r3 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000040)='cpuacct.usage_sys\x00', 0x275a, 0x0) mmap(&(0x7f0000000000/0x400000)=nil, 0x400000, 0x1, 0x10012, r3, 0x0) futex(&(0x7f0000000000), 0x9, 0x2, 0x0, &(0x7f0000000340)=0x2, 0x0) program did not crash testing program (duration=2m39.94419324s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): bpf$MAP_CREATE_TAIL_CALL-openat$cgroup_root-openat$cuse-write$cgroup_pid-prctl$PR_SCHED_CORE-prlimit64-sched_setaffinity-syz_open_dev$MSR-read$msr-write$cgroup_pid-syz_open_dev$usbfs-ioctl$USBDEVFS_ALLOW_SUSPEND-ioctl$USBDEVFS_CONTROL-getsockopt$IP_VS_SO_GET_DAEMON-syz_init_net_socket$x25-sendmsg$NFT_BATCH-getsockopt$X25_QBITINCL-add_key-socket$inet_tcp-openat$cgroup_ro-mmap-futex detailed listing: executing program 0: bpf$MAP_CREATE_TAIL_CALL(0x0, &(0x7f00000007c0)=ANY=[@ANYBLOB="0300000004000000040000000a00000000000000", @ANYRES32=0x0, @ANYBLOB='\x00'/20, @ANYRES32=0x0, @ANYRES32=0x0, @ANYBLOB="000000000000000000000000000000000000000000000000000000002488b2f9e74580af107c0e1d82e10ec48719c67c3a2c410e56c69d665be4d063622980f8cb451837ec40c83579dab92e8f84c849607fcefb8f68d30f5cef9a27821ae15259e0a5f3fde268d4d90d504f96fd259153f0a0e56e8348de69c712c4745807e57b8037dcc4948ce942ee622e67b803a7993e63813551380de1382064638f188d433efa8caab4bcf04b55d3a2778b35cf869574e55126edb0a866c8c2210811f626e123984c1578eea143687583ec9cd45399277cba"], 0x48) openat$cgroup_root(0xffffffffffffff9c, 0x0, 0x200002, 0x0) openat$cuse(0xffffffffffffff9c, 0x0, 0x2, 0x0) write$cgroup_pid(0xffffffffffffffff, &(0x7f0000000500), 0x3) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x400000bce) r0 = syz_open_dev$MSR(&(0x7f0000000300), 0x100040000, 0x0) read$msr(r0, &(0x7f0000019680)=""/102392, 0x18ff8) write$cgroup_pid(0xffffffffffffffff, &(0x7f00000001c0), 0x12) r1 = syz_open_dev$usbfs(&(0x7f0000000100), 0x206, 0x8401) ioctl$USBDEVFS_ALLOW_SUSPEND(r1, 0x5522) ioctl$USBDEVFS_CONTROL(r1, 0xc0185500, &(0x7f0000001380)={0x0, 0x10, 0xf109, 0x8, 0x0, 0x4, 0x0}) getsockopt$IP_VS_SO_GET_DAEMON(0xffffffffffffffff, 0x0, 0x487, &(0x7f0000000040), &(0x7f00000000c0)=0x30) r2 = syz_init_net_socket$x25(0x9, 0x5, 0x0) sendmsg$NFT_BATCH(0xffffffffffffffff, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000540)=ANY=[@ANYBLOB="14005dd31000010000000000000000000200000a54000000060a0b04000000000000002800048024000180090001006d6574610000000014000280080002400000000e080003ff000000000900010073797a30000000000900020073797a3200000000140000001100010000000000000000000000000a0000bcd9392755d0553208396b1104bd0138b9d4dcc29076671bfcd406a184eee3783779b059bf3c1d3a573e716c57ed4ab238d496fa0d3fb51054a62d7055d068124ff4184e12a61862bc0120f727e9e5c7ae925054af63819ba5f79d772ba27895dc48a6796db8d6b142c81e1c43cc58e8cef58790fddf4278fde59f4d57d0f4cb44e9f041ba703fb942342396717badaae97c20475dabfd374400"/284], 0x7c}}, 0x0) getsockopt$X25_QBITINCL(r2, 0x106, 0x1, 0x0, &(0x7f0000000240)=0xfffffffffffffee0) add_key(&(0x7f0000000140)='encrypted\x00', &(0x7f0000000180), &(0x7f0000000100), 0xca, 0xfffffffffffffffe) socket$inet_tcp(0x2, 0x1, 0x0) r3 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000040)='cpuacct.usage_sys\x00', 0x275a, 0x0) mmap(&(0x7f0000000000/0x400000)=nil, 0x400000, 0x1, 0x10012, r3, 0x0) futex(&(0x7f0000000000), 0x9, 0x2, 0x0, &(0x7f0000000340)=0x2, 0x0) program crashed: KASAN: slab-use-after-free Read in key_put testing program (duration=2m39.94419324s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): bpf$MAP_CREATE_TAIL_CALL-openat$cgroup_root-openat$cuse-write$cgroup_pid-prctl$PR_SCHED_CORE-prlimit64-sched_setaffinity-syz_open_dev$MSR-read$msr-write$cgroup_pid-syz_open_dev$usbfs-ioctl$USBDEVFS_ALLOW_SUSPEND-ioctl$USBDEVFS_CONTROL-getsockopt$IP_VS_SO_GET_DAEMON-sendmsg$NFT_BATCH-getsockopt$X25_QBITINCL-add_key-socket$inet_tcp-openat$cgroup_ro-mmap-futex detailed listing: executing program 0: bpf$MAP_CREATE_TAIL_CALL(0x0, &(0x7f00000007c0)=ANY=[@ANYBLOB="0300000004000000040000000a00000000000000", @ANYRES32=0x0, @ANYBLOB='\x00'/20, @ANYRES32=0x0, @ANYRES32=0x0, @ANYBLOB="000000000000000000000000000000000000000000000000000000002488b2f9e74580af107c0e1d82e10ec48719c67c3a2c410e56c69d665be4d063622980f8cb451837ec40c83579dab92e8f84c849607fcefb8f68d30f5cef9a27821ae15259e0a5f3fde268d4d90d504f96fd259153f0a0e56e8348de69c712c4745807e57b8037dcc4948ce942ee622e67b803a7993e63813551380de1382064638f188d433efa8caab4bcf04b55d3a2778b35cf869574e55126edb0a866c8c2210811f626e123984c1578eea143687583ec9cd45399277cba"], 0x48) openat$cgroup_root(0xffffffffffffff9c, 0x0, 0x200002, 0x0) openat$cuse(0xffffffffffffff9c, 0x0, 0x2, 0x0) write$cgroup_pid(0xffffffffffffffff, &(0x7f0000000500), 0x3) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x400000bce) r0 = syz_open_dev$MSR(&(0x7f0000000300), 0x100040000, 0x0) read$msr(r0, &(0x7f0000019680)=""/102392, 0x18ff8) write$cgroup_pid(0xffffffffffffffff, &(0x7f00000001c0), 0x12) r1 = syz_open_dev$usbfs(&(0x7f0000000100), 0x206, 0x8401) ioctl$USBDEVFS_ALLOW_SUSPEND(r1, 0x5522) ioctl$USBDEVFS_CONTROL(r1, 0xc0185500, &(0x7f0000001380)={0x0, 0x10, 0xf109, 0x8, 0x0, 0x4, 0x0}) getsockopt$IP_VS_SO_GET_DAEMON(0xffffffffffffffff, 0x0, 0x487, &(0x7f0000000040), &(0x7f00000000c0)=0x30) sendmsg$NFT_BATCH(0xffffffffffffffff, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000540)=ANY=[@ANYBLOB="14005dd31000010000000000000000000200000a54000000060a0b04000000000000002800048024000180090001006d6574610000000014000280080002400000000e080003ff000000000900010073797a30000000000900020073797a3200000000140000001100010000000000000000000000000a0000bcd9392755d0553208396b1104bd0138b9d4dcc29076671bfcd406a184eee3783779b059bf3c1d3a573e716c57ed4ab238d496fa0d3fb51054a62d7055d068124ff4184e12a61862bc0120f727e9e5c7ae925054af63819ba5f79d772ba27895dc48a6796db8d6b142c81e1c43cc58e8cef58790fddf4278fde59f4d57d0f4cb44e9f041ba703fb942342396717badaae97c20475dabfd374400"/284], 0x7c}}, 0x0) getsockopt$X25_QBITINCL(0xffffffffffffffff, 0x106, 0x1, 0x0, &(0x7f0000000240)=0xfffffffffffffee0) add_key(&(0x7f0000000140)='encrypted\x00', &(0x7f0000000180), &(0x7f0000000100), 0xca, 0xfffffffffffffffe) socket$inet_tcp(0x2, 0x1, 0x0) r2 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000040)='cpuacct.usage_sys\x00', 0x275a, 0x0) mmap(&(0x7f0000000000/0x400000)=nil, 0x400000, 0x1, 0x10012, r2, 0x0) futex(&(0x7f0000000000), 0x9, 0x2, 0x0, &(0x7f0000000340)=0x2, 0x0) program crashed: KASAN: slab-use-after-free Read in key_put testing program (duration=2m39.94419324s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): bpf$MAP_CREATE_TAIL_CALL-openat$cgroup_root-openat$cuse-write$cgroup_pid-prctl$PR_SCHED_CORE-prlimit64-sched_setaffinity-syz_open_dev$MSR-read$msr-write$cgroup_pid-syz_open_dev$usbfs-ioctl$USBDEVFS_ALLOW_SUSPEND-ioctl$USBDEVFS_CONTROL-sendmsg$NFT_BATCH-getsockopt$X25_QBITINCL-add_key-socket$inet_tcp-openat$cgroup_ro-mmap-futex detailed listing: executing program 0: bpf$MAP_CREATE_TAIL_CALL(0x0, &(0x7f00000007c0)=ANY=[@ANYBLOB="0300000004000000040000000a00000000000000", @ANYRES32=0x0, @ANYBLOB='\x00'/20, @ANYRES32=0x0, @ANYRES32=0x0, @ANYBLOB="000000000000000000000000000000000000000000000000000000002488b2f9e74580af107c0e1d82e10ec48719c67c3a2c410e56c69d665be4d063622980f8cb451837ec40c83579dab92e8f84c849607fcefb8f68d30f5cef9a27821ae15259e0a5f3fde268d4d90d504f96fd259153f0a0e56e8348de69c712c4745807e57b8037dcc4948ce942ee622e67b803a7993e63813551380de1382064638f188d433efa8caab4bcf04b55d3a2778b35cf869574e55126edb0a866c8c2210811f626e123984c1578eea143687583ec9cd45399277cba"], 0x48) openat$cgroup_root(0xffffffffffffff9c, 0x0, 0x200002, 0x0) openat$cuse(0xffffffffffffff9c, 0x0, 0x2, 0x0) write$cgroup_pid(0xffffffffffffffff, &(0x7f0000000500), 0x3) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x400000bce) r0 = syz_open_dev$MSR(&(0x7f0000000300), 0x100040000, 0x0) read$msr(r0, &(0x7f0000019680)=""/102392, 0x18ff8) write$cgroup_pid(0xffffffffffffffff, &(0x7f00000001c0), 0x12) r1 = syz_open_dev$usbfs(&(0x7f0000000100), 0x206, 0x8401) ioctl$USBDEVFS_ALLOW_SUSPEND(r1, 0x5522) ioctl$USBDEVFS_CONTROL(r1, 0xc0185500, &(0x7f0000001380)={0x0, 0x10, 0xf109, 0x8, 0x0, 0x4, 0x0}) sendmsg$NFT_BATCH(0xffffffffffffffff, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000540)=ANY=[@ANYBLOB="14005dd31000010000000000000000000200000a54000000060a0b04000000000000002800048024000180090001006d6574610000000014000280080002400000000e080003ff000000000900010073797a30000000000900020073797a3200000000140000001100010000000000000000000000000a0000bcd9392755d0553208396b1104bd0138b9d4dcc29076671bfcd406a184eee3783779b059bf3c1d3a573e716c57ed4ab238d496fa0d3fb51054a62d7055d068124ff4184e12a61862bc0120f727e9e5c7ae925054af63819ba5f79d772ba27895dc48a6796db8d6b142c81e1c43cc58e8cef58790fddf4278fde59f4d57d0f4cb44e9f041ba703fb942342396717badaae97c20475dabfd374400"/284], 0x7c}}, 0x0) getsockopt$X25_QBITINCL(0xffffffffffffffff, 0x106, 0x1, 0x0, &(0x7f0000000240)=0xfffffffffffffee0) add_key(&(0x7f0000000140)='encrypted\x00', &(0x7f0000000180), &(0x7f0000000100), 0xca, 0xfffffffffffffffe) socket$inet_tcp(0x2, 0x1, 0x0) r2 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000040)='cpuacct.usage_sys\x00', 0x275a, 0x0) mmap(&(0x7f0000000000/0x400000)=nil, 0x400000, 0x1, 0x10012, r2, 0x0) futex(&(0x7f0000000000), 0x9, 0x2, 0x0, &(0x7f0000000340)=0x2, 0x0) program crashed: KASAN: slab-use-after-free Read in key_put testing program (duration=2m39.94419324s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): bpf$MAP_CREATE_TAIL_CALL-openat$cgroup_root-openat$cuse-write$cgroup_pid-prctl$PR_SCHED_CORE-prlimit64-sched_setaffinity-syz_open_dev$MSR-read$msr-write$cgroup_pid-syz_open_dev$usbfs-ioctl$USBDEVFS_ALLOW_SUSPEND-sendmsg$NFT_BATCH-getsockopt$X25_QBITINCL-add_key-socket$inet_tcp-openat$cgroup_ro-mmap-futex detailed listing: executing program 0: bpf$MAP_CREATE_TAIL_CALL(0x0, &(0x7f00000007c0)=ANY=[@ANYBLOB="0300000004000000040000000a00000000000000", @ANYRES32=0x0, @ANYBLOB='\x00'/20, @ANYRES32=0x0, @ANYRES32=0x0, @ANYBLOB="000000000000000000000000000000000000000000000000000000002488b2f9e74580af107c0e1d82e10ec48719c67c3a2c410e56c69d665be4d063622980f8cb451837ec40c83579dab92e8f84c849607fcefb8f68d30f5cef9a27821ae15259e0a5f3fde268d4d90d504f96fd259153f0a0e56e8348de69c712c4745807e57b8037dcc4948ce942ee622e67b803a7993e63813551380de1382064638f188d433efa8caab4bcf04b55d3a2778b35cf869574e55126edb0a866c8c2210811f626e123984c1578eea143687583ec9cd45399277cba"], 0x48) openat$cgroup_root(0xffffffffffffff9c, 0x0, 0x200002, 0x0) openat$cuse(0xffffffffffffff9c, 0x0, 0x2, 0x0) write$cgroup_pid(0xffffffffffffffff, &(0x7f0000000500), 0x3) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x400000bce) r0 = syz_open_dev$MSR(&(0x7f0000000300), 0x100040000, 0x0) read$msr(r0, &(0x7f0000019680)=""/102392, 0x18ff8) write$cgroup_pid(0xffffffffffffffff, &(0x7f00000001c0), 0x12) r1 = syz_open_dev$usbfs(&(0x7f0000000100), 0x206, 0x8401) ioctl$USBDEVFS_ALLOW_SUSPEND(r1, 0x5522) sendmsg$NFT_BATCH(0xffffffffffffffff, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000540)=ANY=[@ANYBLOB="14005dd31000010000000000000000000200000a54000000060a0b04000000000000002800048024000180090001006d6574610000000014000280080002400000000e080003ff000000000900010073797a30000000000900020073797a3200000000140000001100010000000000000000000000000a0000bcd9392755d0553208396b1104bd0138b9d4dcc29076671bfcd406a184eee3783779b059bf3c1d3a573e716c57ed4ab238d496fa0d3fb51054a62d7055d068124ff4184e12a61862bc0120f727e9e5c7ae925054af63819ba5f79d772ba27895dc48a6796db8d6b142c81e1c43cc58e8cef58790fddf4278fde59f4d57d0f4cb44e9f041ba703fb942342396717badaae97c20475dabfd374400"/284], 0x7c}}, 0x0) getsockopt$X25_QBITINCL(0xffffffffffffffff, 0x106, 0x1, 0x0, &(0x7f0000000240)=0xfffffffffffffee0) add_key(&(0x7f0000000140)='encrypted\x00', &(0x7f0000000180), &(0x7f0000000100), 0xca, 0xfffffffffffffffe) socket$inet_tcp(0x2, 0x1, 0x0) r2 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000040)='cpuacct.usage_sys\x00', 0x275a, 0x0) mmap(&(0x7f0000000000/0x400000)=nil, 0x400000, 0x1, 0x10012, r2, 0x0) futex(&(0x7f0000000000), 0x9, 0x2, 0x0, &(0x7f0000000340)=0x2, 0x0) program crashed: KASAN: slab-use-after-free Read in key_put testing program (duration=2m39.94419324s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): bpf$MAP_CREATE_TAIL_CALL-openat$cgroup_root-openat$cuse-write$cgroup_pid-prctl$PR_SCHED_CORE-prlimit64-sched_setaffinity-syz_open_dev$MSR-read$msr-write$cgroup_pid-syz_open_dev$usbfs-sendmsg$NFT_BATCH-getsockopt$X25_QBITINCL-add_key-socket$inet_tcp-openat$cgroup_ro-mmap-futex detailed listing: executing program 0: bpf$MAP_CREATE_TAIL_CALL(0x0, &(0x7f00000007c0)=ANY=[@ANYBLOB="0300000004000000040000000a00000000000000", @ANYRES32=0x0, @ANYBLOB='\x00'/20, @ANYRES32=0x0, @ANYRES32=0x0, @ANYBLOB="000000000000000000000000000000000000000000000000000000002488b2f9e74580af107c0e1d82e10ec48719c67c3a2c410e56c69d665be4d063622980f8cb451837ec40c83579dab92e8f84c849607fcefb8f68d30f5cef9a27821ae15259e0a5f3fde268d4d90d504f96fd259153f0a0e56e8348de69c712c4745807e57b8037dcc4948ce942ee622e67b803a7993e63813551380de1382064638f188d433efa8caab4bcf04b55d3a2778b35cf869574e55126edb0a866c8c2210811f626e123984c1578eea143687583ec9cd45399277cba"], 0x48) openat$cgroup_root(0xffffffffffffff9c, 0x0, 0x200002, 0x0) openat$cuse(0xffffffffffffff9c, 0x0, 0x2, 0x0) write$cgroup_pid(0xffffffffffffffff, &(0x7f0000000500), 0x3) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x400000bce) r0 = syz_open_dev$MSR(&(0x7f0000000300), 0x100040000, 0x0) read$msr(r0, &(0x7f0000019680)=""/102392, 0x18ff8) write$cgroup_pid(0xffffffffffffffff, &(0x7f00000001c0), 0x12) syz_open_dev$usbfs(&(0x7f0000000100), 0x206, 0x8401) sendmsg$NFT_BATCH(0xffffffffffffffff, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000540)=ANY=[@ANYBLOB="14005dd31000010000000000000000000200000a54000000060a0b04000000000000002800048024000180090001006d6574610000000014000280080002400000000e080003ff000000000900010073797a30000000000900020073797a3200000000140000001100010000000000000000000000000a0000bcd9392755d0553208396b1104bd0138b9d4dcc29076671bfcd406a184eee3783779b059bf3c1d3a573e716c57ed4ab238d496fa0d3fb51054a62d7055d068124ff4184e12a61862bc0120f727e9e5c7ae925054af63819ba5f79d772ba27895dc48a6796db8d6b142c81e1c43cc58e8cef58790fddf4278fde59f4d57d0f4cb44e9f041ba703fb942342396717badaae97c20475dabfd374400"/284], 0x7c}}, 0x0) getsockopt$X25_QBITINCL(0xffffffffffffffff, 0x106, 0x1, 0x0, &(0x7f0000000240)=0xfffffffffffffee0) add_key(&(0x7f0000000140)='encrypted\x00', &(0x7f0000000180), &(0x7f0000000100), 0xca, 0xfffffffffffffffe) socket$inet_tcp(0x2, 0x1, 0x0) r1 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000040)='cpuacct.usage_sys\x00', 0x275a, 0x0) mmap(&(0x7f0000000000/0x400000)=nil, 0x400000, 0x1, 0x10012, r1, 0x0) futex(&(0x7f0000000000), 0x9, 0x2, 0x0, &(0x7f0000000340)=0x2, 0x0) program did not crash testing program (duration=2m39.94419324s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): bpf$MAP_CREATE_TAIL_CALL-openat$cgroup_root-openat$cuse-write$cgroup_pid-prctl$PR_SCHED_CORE-prlimit64-sched_setaffinity-syz_open_dev$MSR-read$msr-write$cgroup_pid-ioctl$USBDEVFS_ALLOW_SUSPEND-sendmsg$NFT_BATCH-getsockopt$X25_QBITINCL-add_key-socket$inet_tcp-openat$cgroup_ro-mmap-futex detailed listing: executing program 0: bpf$MAP_CREATE_TAIL_CALL(0x0, &(0x7f00000007c0)=ANY=[@ANYBLOB="0300000004000000040000000a00000000000000", @ANYRES32=0x0, @ANYBLOB='\x00'/20, @ANYRES32=0x0, @ANYRES32=0x0, @ANYBLOB="000000000000000000000000000000000000000000000000000000002488b2f9e74580af107c0e1d82e10ec48719c67c3a2c410e56c69d665be4d063622980f8cb451837ec40c83579dab92e8f84c849607fcefb8f68d30f5cef9a27821ae15259e0a5f3fde268d4d90d504f96fd259153f0a0e56e8348de69c712c4745807e57b8037dcc4948ce942ee622e67b803a7993e63813551380de1382064638f188d433efa8caab4bcf04b55d3a2778b35cf869574e55126edb0a866c8c2210811f626e123984c1578eea143687583ec9cd45399277cba"], 0x48) openat$cgroup_root(0xffffffffffffff9c, 0x0, 0x200002, 0x0) openat$cuse(0xffffffffffffff9c, 0x0, 0x2, 0x0) write$cgroup_pid(0xffffffffffffffff, &(0x7f0000000500), 0x3) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x400000bce) r0 = syz_open_dev$MSR(&(0x7f0000000300), 0x100040000, 0x0) read$msr(r0, &(0x7f0000019680)=""/102392, 0x18ff8) write$cgroup_pid(0xffffffffffffffff, &(0x7f00000001c0), 0x12) ioctl$USBDEVFS_ALLOW_SUSPEND(0xffffffffffffffff, 0x5522) sendmsg$NFT_BATCH(0xffffffffffffffff, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000540)=ANY=[@ANYBLOB="14005dd31000010000000000000000000200000a54000000060a0b04000000000000002800048024000180090001006d6574610000000014000280080002400000000e080003ff000000000900010073797a30000000000900020073797a3200000000140000001100010000000000000000000000000a0000bcd9392755d0553208396b1104bd0138b9d4dcc29076671bfcd406a184eee3783779b059bf3c1d3a573e716c57ed4ab238d496fa0d3fb51054a62d7055d068124ff4184e12a61862bc0120f727e9e5c7ae925054af63819ba5f79d772ba27895dc48a6796db8d6b142c81e1c43cc58e8cef58790fddf4278fde59f4d57d0f4cb44e9f041ba703fb942342396717badaae97c20475dabfd374400"/284], 0x7c}}, 0x0) getsockopt$X25_QBITINCL(0xffffffffffffffff, 0x106, 0x1, 0x0, &(0x7f0000000240)=0xfffffffffffffee0) add_key(&(0x7f0000000140)='encrypted\x00', &(0x7f0000000180), &(0x7f0000000100), 0xca, 0xfffffffffffffffe) socket$inet_tcp(0x2, 0x1, 0x0) r1 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000040)='cpuacct.usage_sys\x00', 0x275a, 0x0) mmap(&(0x7f0000000000/0x400000)=nil, 0x400000, 0x1, 0x10012, r1, 0x0) futex(&(0x7f0000000000), 0x9, 0x2, 0x0, &(0x7f0000000340)=0x2, 0x0) program crashed: KASAN: slab-use-after-free Read in key_put testing program (duration=2m39.94419324s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): bpf$MAP_CREATE_TAIL_CALL-openat$cgroup_root-openat$cuse-write$cgroup_pid-prctl$PR_SCHED_CORE-prlimit64-sched_setaffinity-syz_open_dev$MSR-read$msr-ioctl$USBDEVFS_ALLOW_SUSPEND-sendmsg$NFT_BATCH-getsockopt$X25_QBITINCL-add_key-socket$inet_tcp-openat$cgroup_ro-mmap-futex detailed listing: executing program 0: bpf$MAP_CREATE_TAIL_CALL(0x0, &(0x7f00000007c0)=ANY=[@ANYBLOB="0300000004000000040000000a00000000000000", @ANYRES32=0x0, @ANYBLOB='\x00'/20, @ANYRES32=0x0, @ANYRES32=0x0, @ANYBLOB="000000000000000000000000000000000000000000000000000000002488b2f9e74580af107c0e1d82e10ec48719c67c3a2c410e56c69d665be4d063622980f8cb451837ec40c83579dab92e8f84c849607fcefb8f68d30f5cef9a27821ae15259e0a5f3fde268d4d90d504f96fd259153f0a0e56e8348de69c712c4745807e57b8037dcc4948ce942ee622e67b803a7993e63813551380de1382064638f188d433efa8caab4bcf04b55d3a2778b35cf869574e55126edb0a866c8c2210811f626e123984c1578eea143687583ec9cd45399277cba"], 0x48) openat$cgroup_root(0xffffffffffffff9c, 0x0, 0x200002, 0x0) openat$cuse(0xffffffffffffff9c, 0x0, 0x2, 0x0) write$cgroup_pid(0xffffffffffffffff, &(0x7f0000000500), 0x3) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x400000bce) r0 = syz_open_dev$MSR(&(0x7f0000000300), 0x100040000, 0x0) read$msr(r0, &(0x7f0000019680)=""/102392, 0x18ff8) ioctl$USBDEVFS_ALLOW_SUSPEND(0xffffffffffffffff, 0x5522) sendmsg$NFT_BATCH(0xffffffffffffffff, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000540)=ANY=[@ANYBLOB="14005dd31000010000000000000000000200000a54000000060a0b04000000000000002800048024000180090001006d6574610000000014000280080002400000000e080003ff000000000900010073797a30000000000900020073797a3200000000140000001100010000000000000000000000000a0000bcd9392755d0553208396b1104bd0138b9d4dcc29076671bfcd406a184eee3783779b059bf3c1d3a573e716c57ed4ab238d496fa0d3fb51054a62d7055d068124ff4184e12a61862bc0120f727e9e5c7ae925054af63819ba5f79d772ba27895dc48a6796db8d6b142c81e1c43cc58e8cef58790fddf4278fde59f4d57d0f4cb44e9f041ba703fb942342396717badaae97c20475dabfd374400"/284], 0x7c}}, 0x0) getsockopt$X25_QBITINCL(0xffffffffffffffff, 0x106, 0x1, 0x0, &(0x7f0000000240)=0xfffffffffffffee0) add_key(&(0x7f0000000140)='encrypted\x00', &(0x7f0000000180), &(0x7f0000000100), 0xca, 0xfffffffffffffffe) socket$inet_tcp(0x2, 0x1, 0x0) r1 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000040)='cpuacct.usage_sys\x00', 0x275a, 0x0) mmap(&(0x7f0000000000/0x400000)=nil, 0x400000, 0x1, 0x10012, r1, 0x0) futex(&(0x7f0000000000), 0x9, 0x2, 0x0, &(0x7f0000000340)=0x2, 0x0) program crashed: KASAN: slab-use-after-free Read in key_put testing program (duration=2m39.94419324s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): bpf$MAP_CREATE_TAIL_CALL-openat$cgroup_root-openat$cuse-write$cgroup_pid-prctl$PR_SCHED_CORE-prlimit64-sched_setaffinity-syz_open_dev$MSR-ioctl$USBDEVFS_ALLOW_SUSPEND-sendmsg$NFT_BATCH-getsockopt$X25_QBITINCL-add_key-socket$inet_tcp-openat$cgroup_ro-mmap-futex detailed listing: executing program 0: bpf$MAP_CREATE_TAIL_CALL(0x0, &(0x7f00000007c0)=ANY=[@ANYBLOB="0300000004000000040000000a00000000000000", @ANYRES32=0x0, @ANYBLOB='\x00'/20, @ANYRES32=0x0, @ANYRES32=0x0, @ANYBLOB="000000000000000000000000000000000000000000000000000000002488b2f9e74580af107c0e1d82e10ec48719c67c3a2c410e56c69d665be4d063622980f8cb451837ec40c83579dab92e8f84c849607fcefb8f68d30f5cef9a27821ae15259e0a5f3fde268d4d90d504f96fd259153f0a0e56e8348de69c712c4745807e57b8037dcc4948ce942ee622e67b803a7993e63813551380de1382064638f188d433efa8caab4bcf04b55d3a2778b35cf869574e55126edb0a866c8c2210811f626e123984c1578eea143687583ec9cd45399277cba"], 0x48) openat$cgroup_root(0xffffffffffffff9c, 0x0, 0x200002, 0x0) openat$cuse(0xffffffffffffff9c, 0x0, 0x2, 0x0) write$cgroup_pid(0xffffffffffffffff, &(0x7f0000000500), 0x3) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x400000bce) syz_open_dev$MSR(&(0x7f0000000300), 0x100040000, 0x0) ioctl$USBDEVFS_ALLOW_SUSPEND(0xffffffffffffffff, 0x5522) sendmsg$NFT_BATCH(0xffffffffffffffff, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000540)=ANY=[@ANYBLOB="14005dd31000010000000000000000000200000a54000000060a0b04000000000000002800048024000180090001006d6574610000000014000280080002400000000e080003ff000000000900010073797a30000000000900020073797a3200000000140000001100010000000000000000000000000a0000bcd9392755d0553208396b1104bd0138b9d4dcc29076671bfcd406a184eee3783779b059bf3c1d3a573e716c57ed4ab238d496fa0d3fb51054a62d7055d068124ff4184e12a61862bc0120f727e9e5c7ae925054af63819ba5f79d772ba27895dc48a6796db8d6b142c81e1c43cc58e8cef58790fddf4278fde59f4d57d0f4cb44e9f041ba703fb942342396717badaae97c20475dabfd374400"/284], 0x7c}}, 0x0) getsockopt$X25_QBITINCL(0xffffffffffffffff, 0x106, 0x1, 0x0, &(0x7f0000000240)=0xfffffffffffffee0) add_key(&(0x7f0000000140)='encrypted\x00', &(0x7f0000000180), &(0x7f0000000100), 0xca, 0xfffffffffffffffe) socket$inet_tcp(0x2, 0x1, 0x0) r0 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000040)='cpuacct.usage_sys\x00', 0x275a, 0x0) mmap(&(0x7f0000000000/0x400000)=nil, 0x400000, 0x1, 0x10012, r0, 0x0) futex(&(0x7f0000000000), 0x9, 0x2, 0x0, &(0x7f0000000340)=0x2, 0x0) program did not crash testing program (duration=2m39.94419324s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): bpf$MAP_CREATE_TAIL_CALL-openat$cgroup_root-openat$cuse-write$cgroup_pid-prctl$PR_SCHED_CORE-prlimit64-sched_setaffinity-read$msr-ioctl$USBDEVFS_ALLOW_SUSPEND-sendmsg$NFT_BATCH-getsockopt$X25_QBITINCL-add_key-socket$inet_tcp-openat$cgroup_ro-mmap-futex detailed listing: executing program 0: bpf$MAP_CREATE_TAIL_CALL(0x0, &(0x7f00000007c0)=ANY=[@ANYBLOB="0300000004000000040000000a00000000000000", @ANYRES32=0x0, @ANYBLOB='\x00'/20, @ANYRES32=0x0, @ANYRES32=0x0, @ANYBLOB="000000000000000000000000000000000000000000000000000000002488b2f9e74580af107c0e1d82e10ec48719c67c3a2c410e56c69d665be4d063622980f8cb451837ec40c83579dab92e8f84c849607fcefb8f68d30f5cef9a27821ae15259e0a5f3fde268d4d90d504f96fd259153f0a0e56e8348de69c712c4745807e57b8037dcc4948ce942ee622e67b803a7993e63813551380de1382064638f188d433efa8caab4bcf04b55d3a2778b35cf869574e55126edb0a866c8c2210811f626e123984c1578eea143687583ec9cd45399277cba"], 0x48) openat$cgroup_root(0xffffffffffffff9c, 0x0, 0x200002, 0x0) openat$cuse(0xffffffffffffff9c, 0x0, 0x2, 0x0) write$cgroup_pid(0xffffffffffffffff, &(0x7f0000000500), 0x3) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x400000bce) read$msr(0xffffffffffffffff, &(0x7f0000019680)=""/102392, 0x18ff8) ioctl$USBDEVFS_ALLOW_SUSPEND(0xffffffffffffffff, 0x5522) sendmsg$NFT_BATCH(0xffffffffffffffff, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000540)=ANY=[@ANYBLOB="14005dd31000010000000000000000000200000a54000000060a0b04000000000000002800048024000180090001006d6574610000000014000280080002400000000e080003ff000000000900010073797a30000000000900020073797a3200000000140000001100010000000000000000000000000a0000bcd9392755d0553208396b1104bd0138b9d4dcc29076671bfcd406a184eee3783779b059bf3c1d3a573e716c57ed4ab238d496fa0d3fb51054a62d7055d068124ff4184e12a61862bc0120f727e9e5c7ae925054af63819ba5f79d772ba27895dc48a6796db8d6b142c81e1c43cc58e8cef58790fddf4278fde59f4d57d0f4cb44e9f041ba703fb942342396717badaae97c20475dabfd374400"/284], 0x7c}}, 0x0) getsockopt$X25_QBITINCL(0xffffffffffffffff, 0x106, 0x1, 0x0, &(0x7f0000000240)=0xfffffffffffffee0) add_key(&(0x7f0000000140)='encrypted\x00', &(0x7f0000000180), &(0x7f0000000100), 0xca, 0xfffffffffffffffe) socket$inet_tcp(0x2, 0x1, 0x0) r0 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000040)='cpuacct.usage_sys\x00', 0x275a, 0x0) mmap(&(0x7f0000000000/0x400000)=nil, 0x400000, 0x1, 0x10012, r0, 0x0) futex(&(0x7f0000000000), 0x9, 0x2, 0x0, &(0x7f0000000340)=0x2, 0x0) program did not crash testing program (duration=2m39.94419324s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): bpf$MAP_CREATE_TAIL_CALL-openat$cgroup_root-openat$cuse-write$cgroup_pid-prctl$PR_SCHED_CORE-prlimit64-syz_open_dev$MSR-read$msr-ioctl$USBDEVFS_ALLOW_SUSPEND-sendmsg$NFT_BATCH-getsockopt$X25_QBITINCL-add_key-socket$inet_tcp-openat$cgroup_ro-mmap-futex detailed listing: executing program 0: bpf$MAP_CREATE_TAIL_CALL(0x0, &(0x7f00000007c0)=ANY=[@ANYBLOB="0300000004000000040000000a00000000000000", @ANYRES32=0x0, @ANYBLOB='\x00'/20, @ANYRES32=0x0, @ANYRES32=0x0, @ANYBLOB="000000000000000000000000000000000000000000000000000000002488b2f9e74580af107c0e1d82e10ec48719c67c3a2c410e56c69d665be4d063622980f8cb451837ec40c83579dab92e8f84c849607fcefb8f68d30f5cef9a27821ae15259e0a5f3fde268d4d90d504f96fd259153f0a0e56e8348de69c712c4745807e57b8037dcc4948ce942ee622e67b803a7993e63813551380de1382064638f188d433efa8caab4bcf04b55d3a2778b35cf869574e55126edb0a866c8c2210811f626e123984c1578eea143687583ec9cd45399277cba"], 0x48) openat$cgroup_root(0xffffffffffffff9c, 0x0, 0x200002, 0x0) openat$cuse(0xffffffffffffff9c, 0x0, 0x2, 0x0) write$cgroup_pid(0xffffffffffffffff, &(0x7f0000000500), 0x3) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) r0 = syz_open_dev$MSR(&(0x7f0000000300), 0x100040000, 0x0) read$msr(r0, &(0x7f0000019680)=""/102392, 0x18ff8) ioctl$USBDEVFS_ALLOW_SUSPEND(0xffffffffffffffff, 0x5522) sendmsg$NFT_BATCH(0xffffffffffffffff, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000540)=ANY=[@ANYBLOB="14005dd31000010000000000000000000200000a54000000060a0b04000000000000002800048024000180090001006d6574610000000014000280080002400000000e080003ff000000000900010073797a30000000000900020073797a3200000000140000001100010000000000000000000000000a0000bcd9392755d0553208396b1104bd0138b9d4dcc29076671bfcd406a184eee3783779b059bf3c1d3a573e716c57ed4ab238d496fa0d3fb51054a62d7055d068124ff4184e12a61862bc0120f727e9e5c7ae925054af63819ba5f79d772ba27895dc48a6796db8d6b142c81e1c43cc58e8cef58790fddf4278fde59f4d57d0f4cb44e9f041ba703fb942342396717badaae97c20475dabfd374400"/284], 0x7c}}, 0x0) getsockopt$X25_QBITINCL(0xffffffffffffffff, 0x106, 0x1, 0x0, &(0x7f0000000240)=0xfffffffffffffee0) add_key(&(0x7f0000000140)='encrypted\x00', &(0x7f0000000180), &(0x7f0000000100), 0xca, 0xfffffffffffffffe) socket$inet_tcp(0x2, 0x1, 0x0) r1 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000040)='cpuacct.usage_sys\x00', 0x275a, 0x0) mmap(&(0x7f0000000000/0x400000)=nil, 0x400000, 0x1, 0x10012, r1, 0x0) futex(&(0x7f0000000000), 0x9, 0x2, 0x0, &(0x7f0000000340)=0x2, 0x0) program did not crash testing program (duration=2m39.94419324s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): bpf$MAP_CREATE_TAIL_CALL-openat$cgroup_root-openat$cuse-write$cgroup_pid-prctl$PR_SCHED_CORE-sched_setaffinity-syz_open_dev$MSR-read$msr-ioctl$USBDEVFS_ALLOW_SUSPEND-sendmsg$NFT_BATCH-getsockopt$X25_QBITINCL-add_key-socket$inet_tcp-openat$cgroup_ro-mmap-futex detailed listing: executing program 0: bpf$MAP_CREATE_TAIL_CALL(0x0, &(0x7f00000007c0)=ANY=[@ANYBLOB="0300000004000000040000000a00000000000000", @ANYRES32=0x0, @ANYBLOB='\x00'/20, @ANYRES32=0x0, @ANYRES32=0x0, @ANYBLOB="000000000000000000000000000000000000000000000000000000002488b2f9e74580af107c0e1d82e10ec48719c67c3a2c410e56c69d665be4d063622980f8cb451837ec40c83579dab92e8f84c849607fcefb8f68d30f5cef9a27821ae15259e0a5f3fde268d4d90d504f96fd259153f0a0e56e8348de69c712c4745807e57b8037dcc4948ce942ee622e67b803a7993e63813551380de1382064638f188d433efa8caab4bcf04b55d3a2778b35cf869574e55126edb0a866c8c2210811f626e123984c1578eea143687583ec9cd45399277cba"], 0x48) openat$cgroup_root(0xffffffffffffff9c, 0x0, 0x200002, 0x0) openat$cuse(0xffffffffffffff9c, 0x0, 0x2, 0x0) write$cgroup_pid(0xffffffffffffffff, &(0x7f0000000500), 0x3) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x400000bce) r0 = syz_open_dev$MSR(&(0x7f0000000300), 0x100040000, 0x0) read$msr(r0, &(0x7f0000019680)=""/102392, 0x18ff8) ioctl$USBDEVFS_ALLOW_SUSPEND(0xffffffffffffffff, 0x5522) sendmsg$NFT_BATCH(0xffffffffffffffff, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000540)=ANY=[@ANYBLOB="14005dd31000010000000000000000000200000a54000000060a0b04000000000000002800048024000180090001006d6574610000000014000280080002400000000e080003ff000000000900010073797a30000000000900020073797a3200000000140000001100010000000000000000000000000a0000bcd9392755d0553208396b1104bd0138b9d4dcc29076671bfcd406a184eee3783779b059bf3c1d3a573e716c57ed4ab238d496fa0d3fb51054a62d7055d068124ff4184e12a61862bc0120f727e9e5c7ae925054af63819ba5f79d772ba27895dc48a6796db8d6b142c81e1c43cc58e8cef58790fddf4278fde59f4d57d0f4cb44e9f041ba703fb942342396717badaae97c20475dabfd374400"/284], 0x7c}}, 0x0) getsockopt$X25_QBITINCL(0xffffffffffffffff, 0x106, 0x1, 0x0, &(0x7f0000000240)=0xfffffffffffffee0) add_key(&(0x7f0000000140)='encrypted\x00', &(0x7f0000000180), &(0x7f0000000100), 0xca, 0xfffffffffffffffe) socket$inet_tcp(0x2, 0x1, 0x0) r1 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000040)='cpuacct.usage_sys\x00', 0x275a, 0x0) mmap(&(0x7f0000000000/0x400000)=nil, 0x400000, 0x1, 0x10012, r1, 0x0) futex(&(0x7f0000000000), 0x9, 0x2, 0x0, &(0x7f0000000340)=0x2, 0x0) program crashed: KASAN: slab-use-after-free Read in key_put testing program (duration=2m39.94419324s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): bpf$MAP_CREATE_TAIL_CALL-openat$cgroup_root-openat$cuse-write$cgroup_pid-sched_setaffinity-syz_open_dev$MSR-read$msr-ioctl$USBDEVFS_ALLOW_SUSPEND-sendmsg$NFT_BATCH-getsockopt$X25_QBITINCL-add_key-socket$inet_tcp-openat$cgroup_ro-mmap-futex detailed listing: executing program 0: bpf$MAP_CREATE_TAIL_CALL(0x0, &(0x7f00000007c0)=ANY=[@ANYBLOB="0300000004000000040000000a00000000000000", @ANYRES32=0x0, @ANYBLOB='\x00'/20, @ANYRES32=0x0, @ANYRES32=0x0, @ANYBLOB="000000000000000000000000000000000000000000000000000000002488b2f9e74580af107c0e1d82e10ec48719c67c3a2c410e56c69d665be4d063622980f8cb451837ec40c83579dab92e8f84c849607fcefb8f68d30f5cef9a27821ae15259e0a5f3fde268d4d90d504f96fd259153f0a0e56e8348de69c712c4745807e57b8037dcc4948ce942ee622e67b803a7993e63813551380de1382064638f188d433efa8caab4bcf04b55d3a2778b35cf869574e55126edb0a866c8c2210811f626e123984c1578eea143687583ec9cd45399277cba"], 0x48) openat$cgroup_root(0xffffffffffffff9c, 0x0, 0x200002, 0x0) openat$cuse(0xffffffffffffff9c, 0x0, 0x2, 0x0) write$cgroup_pid(0xffffffffffffffff, &(0x7f0000000500), 0x3) sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x400000bce) r0 = syz_open_dev$MSR(&(0x7f0000000300), 0x100040000, 0x0) read$msr(r0, &(0x7f0000019680)=""/102392, 0x18ff8) ioctl$USBDEVFS_ALLOW_SUSPEND(0xffffffffffffffff, 0x5522) sendmsg$NFT_BATCH(0xffffffffffffffff, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000540)=ANY=[@ANYBLOB="14005dd31000010000000000000000000200000a54000000060a0b04000000000000002800048024000180090001006d6574610000000014000280080002400000000e080003ff000000000900010073797a30000000000900020073797a3200000000140000001100010000000000000000000000000a0000bcd9392755d0553208396b1104bd0138b9d4dcc29076671bfcd406a184eee3783779b059bf3c1d3a573e716c57ed4ab238d496fa0d3fb51054a62d7055d068124ff4184e12a61862bc0120f727e9e5c7ae925054af63819ba5f79d772ba27895dc48a6796db8d6b142c81e1c43cc58e8cef58790fddf4278fde59f4d57d0f4cb44e9f041ba703fb942342396717badaae97c20475dabfd374400"/284], 0x7c}}, 0x0) getsockopt$X25_QBITINCL(0xffffffffffffffff, 0x106, 0x1, 0x0, &(0x7f0000000240)=0xfffffffffffffee0) add_key(&(0x7f0000000140)='encrypted\x00', &(0x7f0000000180), &(0x7f0000000100), 0xca, 0xfffffffffffffffe) socket$inet_tcp(0x2, 0x1, 0x0) r1 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000040)='cpuacct.usage_sys\x00', 0x275a, 0x0) mmap(&(0x7f0000000000/0x400000)=nil, 0x400000, 0x1, 0x10012, r1, 0x0) futex(&(0x7f0000000000), 0x9, 0x2, 0x0, &(0x7f0000000340)=0x2, 0x0) program did not crash testing program (duration=2m39.94419324s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): bpf$MAP_CREATE_TAIL_CALL-openat$cgroup_root-openat$cuse-prctl$PR_SCHED_CORE-sched_setaffinity-syz_open_dev$MSR-read$msr-ioctl$USBDEVFS_ALLOW_SUSPEND-sendmsg$NFT_BATCH-getsockopt$X25_QBITINCL-add_key-socket$inet_tcp-openat$cgroup_ro-mmap-futex detailed listing: executing program 0: bpf$MAP_CREATE_TAIL_CALL(0x0, &(0x7f00000007c0)=ANY=[@ANYBLOB="0300000004000000040000000a00000000000000", @ANYRES32=0x0, @ANYBLOB='\x00'/20, @ANYRES32=0x0, @ANYRES32=0x0, @ANYBLOB="000000000000000000000000000000000000000000000000000000002488b2f9e74580af107c0e1d82e10ec48719c67c3a2c410e56c69d665be4d063622980f8cb451837ec40c83579dab92e8f84c849607fcefb8f68d30f5cef9a27821ae15259e0a5f3fde268d4d90d504f96fd259153f0a0e56e8348de69c712c4745807e57b8037dcc4948ce942ee622e67b803a7993e63813551380de1382064638f188d433efa8caab4bcf04b55d3a2778b35cf869574e55126edb0a866c8c2210811f626e123984c1578eea143687583ec9cd45399277cba"], 0x48) openat$cgroup_root(0xffffffffffffff9c, 0x0, 0x200002, 0x0) openat$cuse(0xffffffffffffff9c, 0x0, 0x2, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x400000bce) r0 = syz_open_dev$MSR(&(0x7f0000000300), 0x100040000, 0x0) read$msr(r0, &(0x7f0000019680)=""/102392, 0x18ff8) ioctl$USBDEVFS_ALLOW_SUSPEND(0xffffffffffffffff, 0x5522) sendmsg$NFT_BATCH(0xffffffffffffffff, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000540)=ANY=[@ANYBLOB="14005dd31000010000000000000000000200000a54000000060a0b04000000000000002800048024000180090001006d6574610000000014000280080002400000000e080003ff000000000900010073797a30000000000900020073797a3200000000140000001100010000000000000000000000000a0000bcd9392755d0553208396b1104bd0138b9d4dcc29076671bfcd406a184eee3783779b059bf3c1d3a573e716c57ed4ab238d496fa0d3fb51054a62d7055d068124ff4184e12a61862bc0120f727e9e5c7ae925054af63819ba5f79d772ba27895dc48a6796db8d6b142c81e1c43cc58e8cef58790fddf4278fde59f4d57d0f4cb44e9f041ba703fb942342396717badaae97c20475dabfd374400"/284], 0x7c}}, 0x0) getsockopt$X25_QBITINCL(0xffffffffffffffff, 0x106, 0x1, 0x0, &(0x7f0000000240)=0xfffffffffffffee0) add_key(&(0x7f0000000140)='encrypted\x00', &(0x7f0000000180), &(0x7f0000000100), 0xca, 0xfffffffffffffffe) socket$inet_tcp(0x2, 0x1, 0x0) r1 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000040)='cpuacct.usage_sys\x00', 0x275a, 0x0) mmap(&(0x7f0000000000/0x400000)=nil, 0x400000, 0x1, 0x10012, r1, 0x0) futex(&(0x7f0000000000), 0x9, 0x2, 0x0, &(0x7f0000000340)=0x2, 0x0) program crashed: KASAN: slab-use-after-free Read in key_put testing program (duration=2m39.94419324s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): bpf$MAP_CREATE_TAIL_CALL-openat$cgroup_root-prctl$PR_SCHED_CORE-sched_setaffinity-syz_open_dev$MSR-read$msr-ioctl$USBDEVFS_ALLOW_SUSPEND-sendmsg$NFT_BATCH-getsockopt$X25_QBITINCL-add_key-socket$inet_tcp-openat$cgroup_ro-mmap-futex detailed listing: executing program 0: bpf$MAP_CREATE_TAIL_CALL(0x0, &(0x7f00000007c0)=ANY=[@ANYBLOB="0300000004000000040000000a00000000000000", @ANYRES32=0x0, @ANYBLOB='\x00'/20, @ANYRES32=0x0, @ANYRES32=0x0, @ANYBLOB="000000000000000000000000000000000000000000000000000000002488b2f9e74580af107c0e1d82e10ec48719c67c3a2c410e56c69d665be4d063622980f8cb451837ec40c83579dab92e8f84c849607fcefb8f68d30f5cef9a27821ae15259e0a5f3fde268d4d90d504f96fd259153f0a0e56e8348de69c712c4745807e57b8037dcc4948ce942ee622e67b803a7993e63813551380de1382064638f188d433efa8caab4bcf04b55d3a2778b35cf869574e55126edb0a866c8c2210811f626e123984c1578eea143687583ec9cd45399277cba"], 0x48) openat$cgroup_root(0xffffffffffffff9c, 0x0, 0x200002, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x400000bce) r0 = syz_open_dev$MSR(&(0x7f0000000300), 0x100040000, 0x0) read$msr(r0, &(0x7f0000019680)=""/102392, 0x18ff8) ioctl$USBDEVFS_ALLOW_SUSPEND(0xffffffffffffffff, 0x5522) sendmsg$NFT_BATCH(0xffffffffffffffff, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000540)=ANY=[@ANYBLOB="14005dd31000010000000000000000000200000a54000000060a0b04000000000000002800048024000180090001006d6574610000000014000280080002400000000e080003ff000000000900010073797a30000000000900020073797a3200000000140000001100010000000000000000000000000a0000bcd9392755d0553208396b1104bd0138b9d4dcc29076671bfcd406a184eee3783779b059bf3c1d3a573e716c57ed4ab238d496fa0d3fb51054a62d7055d068124ff4184e12a61862bc0120f727e9e5c7ae925054af63819ba5f79d772ba27895dc48a6796db8d6b142c81e1c43cc58e8cef58790fddf4278fde59f4d57d0f4cb44e9f041ba703fb942342396717badaae97c20475dabfd374400"/284], 0x7c}}, 0x0) getsockopt$X25_QBITINCL(0xffffffffffffffff, 0x106, 0x1, 0x0, &(0x7f0000000240)=0xfffffffffffffee0) add_key(&(0x7f0000000140)='encrypted\x00', &(0x7f0000000180), &(0x7f0000000100), 0xca, 0xfffffffffffffffe) socket$inet_tcp(0x2, 0x1, 0x0) r1 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000040)='cpuacct.usage_sys\x00', 0x275a, 0x0) mmap(&(0x7f0000000000/0x400000)=nil, 0x400000, 0x1, 0x10012, r1, 0x0) futex(&(0x7f0000000000), 0x9, 0x2, 0x0, &(0x7f0000000340)=0x2, 0x0) program crashed: KASAN: slab-use-after-free Read in key_put testing program (duration=2m39.94419324s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): bpf$MAP_CREATE_TAIL_CALL-prctl$PR_SCHED_CORE-sched_setaffinity-syz_open_dev$MSR-read$msr-ioctl$USBDEVFS_ALLOW_SUSPEND-sendmsg$NFT_BATCH-getsockopt$X25_QBITINCL-add_key-socket$inet_tcp-openat$cgroup_ro-mmap-futex detailed listing: executing program 0: bpf$MAP_CREATE_TAIL_CALL(0x0, &(0x7f00000007c0)=ANY=[@ANYBLOB="0300000004000000040000000a00000000000000", @ANYRES32=0x0, @ANYBLOB='\x00'/20, @ANYRES32=0x0, @ANYRES32=0x0, @ANYBLOB="000000000000000000000000000000000000000000000000000000002488b2f9e74580af107c0e1d82e10ec48719c67c3a2c410e56c69d665be4d063622980f8cb451837ec40c83579dab92e8f84c849607fcefb8f68d30f5cef9a27821ae15259e0a5f3fde268d4d90d504f96fd259153f0a0e56e8348de69c712c4745807e57b8037dcc4948ce942ee622e67b803a7993e63813551380de1382064638f188d433efa8caab4bcf04b55d3a2778b35cf869574e55126edb0a866c8c2210811f626e123984c1578eea143687583ec9cd45399277cba"], 0x48) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x400000bce) r0 = syz_open_dev$MSR(&(0x7f0000000300), 0x100040000, 0x0) read$msr(r0, &(0x7f0000019680)=""/102392, 0x18ff8) ioctl$USBDEVFS_ALLOW_SUSPEND(0xffffffffffffffff, 0x5522) sendmsg$NFT_BATCH(0xffffffffffffffff, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000540)=ANY=[@ANYBLOB="14005dd31000010000000000000000000200000a54000000060a0b04000000000000002800048024000180090001006d6574610000000014000280080002400000000e080003ff000000000900010073797a30000000000900020073797a3200000000140000001100010000000000000000000000000a0000bcd9392755d0553208396b1104bd0138b9d4dcc29076671bfcd406a184eee3783779b059bf3c1d3a573e716c57ed4ab238d496fa0d3fb51054a62d7055d068124ff4184e12a61862bc0120f727e9e5c7ae925054af63819ba5f79d772ba27895dc48a6796db8d6b142c81e1c43cc58e8cef58790fddf4278fde59f4d57d0f4cb44e9f041ba703fb942342396717badaae97c20475dabfd374400"/284], 0x7c}}, 0x0) getsockopt$X25_QBITINCL(0xffffffffffffffff, 0x106, 0x1, 0x0, &(0x7f0000000240)=0xfffffffffffffee0) add_key(&(0x7f0000000140)='encrypted\x00', &(0x7f0000000180), &(0x7f0000000100), 0xca, 0xfffffffffffffffe) socket$inet_tcp(0x2, 0x1, 0x0) r1 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000040)='cpuacct.usage_sys\x00', 0x275a, 0x0) mmap(&(0x7f0000000000/0x400000)=nil, 0x400000, 0x1, 0x10012, r1, 0x0) futex(&(0x7f0000000000), 0x9, 0x2, 0x0, &(0x7f0000000340)=0x2, 0x0) program did not crash testing program (duration=2m39.94419324s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): openat$cgroup_root-prctl$PR_SCHED_CORE-sched_setaffinity-syz_open_dev$MSR-read$msr-ioctl$USBDEVFS_ALLOW_SUSPEND-sendmsg$NFT_BATCH-getsockopt$X25_QBITINCL-add_key-socket$inet_tcp-openat$cgroup_ro-mmap-futex detailed listing: executing program 0: openat$cgroup_root(0xffffffffffffff9c, 0x0, 0x200002, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x400000bce) r0 = syz_open_dev$MSR(&(0x7f0000000300), 0x100040000, 0x0) read$msr(r0, &(0x7f0000019680)=""/102392, 0x18ff8) ioctl$USBDEVFS_ALLOW_SUSPEND(0xffffffffffffffff, 0x5522) sendmsg$NFT_BATCH(0xffffffffffffffff, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000540)=ANY=[@ANYBLOB="14005dd31000010000000000000000000200000a54000000060a0b04000000000000002800048024000180090001006d6574610000000014000280080002400000000e080003ff000000000900010073797a30000000000900020073797a3200000000140000001100010000000000000000000000000a0000bcd9392755d0553208396b1104bd0138b9d4dcc29076671bfcd406a184eee3783779b059bf3c1d3a573e716c57ed4ab238d496fa0d3fb51054a62d7055d068124ff4184e12a61862bc0120f727e9e5c7ae925054af63819ba5f79d772ba27895dc48a6796db8d6b142c81e1c43cc58e8cef58790fddf4278fde59f4d57d0f4cb44e9f041ba703fb942342396717badaae97c20475dabfd374400"/284], 0x7c}}, 0x0) getsockopt$X25_QBITINCL(0xffffffffffffffff, 0x106, 0x1, 0x0, &(0x7f0000000240)=0xfffffffffffffee0) add_key(&(0x7f0000000140)='encrypted\x00', &(0x7f0000000180), &(0x7f0000000100), 0xca, 0xfffffffffffffffe) socket$inet_tcp(0x2, 0x1, 0x0) r1 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000040)='cpuacct.usage_sys\x00', 0x275a, 0x0) mmap(&(0x7f0000000000/0x400000)=nil, 0x400000, 0x1, 0x10012, r1, 0x0) futex(&(0x7f0000000000), 0x9, 0x2, 0x0, &(0x7f0000000340)=0x2, 0x0) program crashed: KASAN: slab-use-after-free Read in key_put testing program (duration=2m39.94419324s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): openat$cgroup_root-prctl$PR_SCHED_CORE-sched_setaffinity-syz_open_dev$MSR-read$msr-ioctl$USBDEVFS_ALLOW_SUSPEND-sendmsg$NFT_BATCH-getsockopt$X25_QBITINCL-add_key-socket$inet_tcp-openat$cgroup_ro-mmap-futex detailed listing: executing program 0: openat$cgroup_root(0xffffffffffffff9c, 0x0, 0x200002, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) sched_setaffinity(0x0, 0x0, 0x0) r0 = syz_open_dev$MSR(&(0x7f0000000300), 0x100040000, 0x0) read$msr(r0, &(0x7f0000019680)=""/102392, 0x18ff8) ioctl$USBDEVFS_ALLOW_SUSPEND(0xffffffffffffffff, 0x5522) sendmsg$NFT_BATCH(0xffffffffffffffff, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000540)=ANY=[@ANYBLOB="14005dd31000010000000000000000000200000a54000000060a0b04000000000000002800048024000180090001006d6574610000000014000280080002400000000e080003ff000000000900010073797a30000000000900020073797a3200000000140000001100010000000000000000000000000a0000bcd9392755d0553208396b1104bd0138b9d4dcc29076671bfcd406a184eee3783779b059bf3c1d3a573e716c57ed4ab238d496fa0d3fb51054a62d7055d068124ff4184e12a61862bc0120f727e9e5c7ae925054af63819ba5f79d772ba27895dc48a6796db8d6b142c81e1c43cc58e8cef58790fddf4278fde59f4d57d0f4cb44e9f041ba703fb942342396717badaae97c20475dabfd374400"/284], 0x7c}}, 0x0) getsockopt$X25_QBITINCL(0xffffffffffffffff, 0x106, 0x1, 0x0, &(0x7f0000000240)=0xfffffffffffffee0) add_key(&(0x7f0000000140)='encrypted\x00', &(0x7f0000000180), &(0x7f0000000100), 0xca, 0xfffffffffffffffe) socket$inet_tcp(0x2, 0x1, 0x0) r1 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000040)='cpuacct.usage_sys\x00', 0x275a, 0x0) mmap(&(0x7f0000000000/0x400000)=nil, 0x400000, 0x1, 0x10012, r1, 0x0) futex(&(0x7f0000000000), 0x9, 0x2, 0x0, &(0x7f0000000340)=0x2, 0x0) program crashed: KASAN: slab-use-after-free Read in key_put testing program (duration=2m39.94419324s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): openat$cgroup_root-prctl$PR_SCHED_CORE-sched_setaffinity-syz_open_dev$MSR-read$msr-ioctl$USBDEVFS_ALLOW_SUSPEND-sendmsg$NFT_BATCH-getsockopt$X25_QBITINCL-add_key-socket$inet_tcp-openat$cgroup_ro-mmap-futex detailed listing: executing program 0: openat$cgroup_root(0xffffffffffffff9c, 0x0, 0x200002, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) sched_setaffinity(0x0, 0x0, 0x0) r0 = syz_open_dev$MSR(0x0, 0x100040000, 0x0) read$msr(r0, &(0x7f0000019680)=""/102392, 0x18ff8) ioctl$USBDEVFS_ALLOW_SUSPEND(0xffffffffffffffff, 0x5522) sendmsg$NFT_BATCH(0xffffffffffffffff, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000540)=ANY=[@ANYBLOB="14005dd31000010000000000000000000200000a54000000060a0b04000000000000002800048024000180090001006d6574610000000014000280080002400000000e080003ff000000000900010073797a30000000000900020073797a3200000000140000001100010000000000000000000000000a0000bcd9392755d0553208396b1104bd0138b9d4dcc29076671bfcd406a184eee3783779b059bf3c1d3a573e716c57ed4ab238d496fa0d3fb51054a62d7055d068124ff4184e12a61862bc0120f727e9e5c7ae925054af63819ba5f79d772ba27895dc48a6796db8d6b142c81e1c43cc58e8cef58790fddf4278fde59f4d57d0f4cb44e9f041ba703fb942342396717badaae97c20475dabfd374400"/284], 0x7c}}, 0x0) getsockopt$X25_QBITINCL(0xffffffffffffffff, 0x106, 0x1, 0x0, &(0x7f0000000240)=0xfffffffffffffee0) add_key(&(0x7f0000000140)='encrypted\x00', &(0x7f0000000180), &(0x7f0000000100), 0xca, 0xfffffffffffffffe) socket$inet_tcp(0x2, 0x1, 0x0) r1 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000040)='cpuacct.usage_sys\x00', 0x275a, 0x0) mmap(&(0x7f0000000000/0x400000)=nil, 0x400000, 0x1, 0x10012, r1, 0x0) futex(&(0x7f0000000000), 0x9, 0x2, 0x0, &(0x7f0000000340)=0x2, 0x0) program did not crash testing program (duration=2m39.94419324s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): openat$cgroup_root-prctl$PR_SCHED_CORE-sched_setaffinity-syz_open_dev$MSR-read$msr-ioctl$USBDEVFS_ALLOW_SUSPEND-sendmsg$NFT_BATCH-getsockopt$X25_QBITINCL-add_key-socket$inet_tcp-openat$cgroup_ro-mmap-futex detailed listing: executing program 0: openat$cgroup_root(0xffffffffffffff9c, 0x0, 0x200002, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) sched_setaffinity(0x0, 0x0, 0x0) r0 = syz_open_dev$MSR(&(0x7f0000000300), 0x100040000, 0x0) read$msr(r0, 0x0, 0x0) ioctl$USBDEVFS_ALLOW_SUSPEND(0xffffffffffffffff, 0x5522) sendmsg$NFT_BATCH(0xffffffffffffffff, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000540)=ANY=[@ANYBLOB="14005dd31000010000000000000000000200000a54000000060a0b04000000000000002800048024000180090001006d6574610000000014000280080002400000000e080003ff000000000900010073797a30000000000900020073797a3200000000140000001100010000000000000000000000000a0000bcd9392755d0553208396b1104bd0138b9d4dcc29076671bfcd406a184eee3783779b059bf3c1d3a573e716c57ed4ab238d496fa0d3fb51054a62d7055d068124ff4184e12a61862bc0120f727e9e5c7ae925054af63819ba5f79d772ba27895dc48a6796db8d6b142c81e1c43cc58e8cef58790fddf4278fde59f4d57d0f4cb44e9f041ba703fb942342396717badaae97c20475dabfd374400"/284], 0x7c}}, 0x0) getsockopt$X25_QBITINCL(0xffffffffffffffff, 0x106, 0x1, 0x0, &(0x7f0000000240)=0xfffffffffffffee0) add_key(&(0x7f0000000140)='encrypted\x00', &(0x7f0000000180), &(0x7f0000000100), 0xca, 0xfffffffffffffffe) socket$inet_tcp(0x2, 0x1, 0x0) r1 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000040)='cpuacct.usage_sys\x00', 0x275a, 0x0) mmap(&(0x7f0000000000/0x400000)=nil, 0x400000, 0x1, 0x10012, r1, 0x0) futex(&(0x7f0000000000), 0x9, 0x2, 0x0, &(0x7f0000000340)=0x2, 0x0) program did not crash testing program (duration=2m39.94419324s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): openat$cgroup_root-prctl$PR_SCHED_CORE-sched_setaffinity-syz_open_dev$MSR-read$msr-ioctl$USBDEVFS_ALLOW_SUSPEND-sendmsg$NFT_BATCH-getsockopt$X25_QBITINCL-add_key-socket$inet_tcp-openat$cgroup_ro-mmap-futex detailed listing: executing program 0: openat$cgroup_root(0xffffffffffffff9c, 0x0, 0x200002, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) sched_setaffinity(0x0, 0x0, 0x0) r0 = syz_open_dev$MSR(&(0x7f0000000300), 0x100040000, 0x0) read$msr(r0, &(0x7f0000019680)=""/102392, 0x18ff8) ioctl$USBDEVFS_ALLOW_SUSPEND(0xffffffffffffffff, 0x5522) sendmsg$NFT_BATCH(0xffffffffffffffff, 0x0, 0x0) getsockopt$X25_QBITINCL(0xffffffffffffffff, 0x106, 0x1, 0x0, &(0x7f0000000240)=0xfffffffffffffee0) add_key(&(0x7f0000000140)='encrypted\x00', &(0x7f0000000180), &(0x7f0000000100), 0xca, 0xfffffffffffffffe) socket$inet_tcp(0x2, 0x1, 0x0) r1 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000040)='cpuacct.usage_sys\x00', 0x275a, 0x0) mmap(&(0x7f0000000000/0x400000)=nil, 0x400000, 0x1, 0x10012, r1, 0x0) futex(&(0x7f0000000000), 0x9, 0x2, 0x0, &(0x7f0000000340)=0x2, 0x0) program crashed: KASAN: slab-use-after-free Read in key_put testing program (duration=2m39.94419324s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): openat$cgroup_root-prctl$PR_SCHED_CORE-sched_setaffinity-syz_open_dev$MSR-read$msr-ioctl$USBDEVFS_ALLOW_SUSPEND-sendmsg$NFT_BATCH-getsockopt$X25_QBITINCL-add_key-socket$inet_tcp-openat$cgroup_ro-mmap-futex detailed listing: executing program 0: openat$cgroup_root(0xffffffffffffff9c, 0x0, 0x200002, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) sched_setaffinity(0x0, 0x0, 0x0) r0 = syz_open_dev$MSR(&(0x7f0000000300), 0x100040000, 0x0) read$msr(r0, &(0x7f0000019680)=""/102392, 0x18ff8) ioctl$USBDEVFS_ALLOW_SUSPEND(0xffffffffffffffff, 0x5522) sendmsg$NFT_BATCH(0xffffffffffffffff, 0x0, 0x0) getsockopt$X25_QBITINCL(0xffffffffffffffff, 0x106, 0x1, 0x0, 0x0) add_key(&(0x7f0000000140)='encrypted\x00', &(0x7f0000000180), &(0x7f0000000100), 0xca, 0xfffffffffffffffe) socket$inet_tcp(0x2, 0x1, 0x0) r1 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000040)='cpuacct.usage_sys\x00', 0x275a, 0x0) mmap(&(0x7f0000000000/0x400000)=nil, 0x400000, 0x1, 0x10012, r1, 0x0) futex(&(0x7f0000000000), 0x9, 0x2, 0x0, &(0x7f0000000340)=0x2, 0x0) program did not crash testing program (duration=2m39.94419324s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): openat$cgroup_root-prctl$PR_SCHED_CORE-sched_setaffinity-syz_open_dev$MSR-read$msr-ioctl$USBDEVFS_ALLOW_SUSPEND-sendmsg$NFT_BATCH-getsockopt$X25_QBITINCL-add_key-socket$inet_tcp-openat$cgroup_ro-mmap-futex detailed listing: executing program 0: openat$cgroup_root(0xffffffffffffff9c, 0x0, 0x200002, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) sched_setaffinity(0x0, 0x0, 0x0) r0 = syz_open_dev$MSR(&(0x7f0000000300), 0x100040000, 0x0) read$msr(r0, &(0x7f0000019680)=""/102392, 0x18ff8) ioctl$USBDEVFS_ALLOW_SUSPEND(0xffffffffffffffff, 0x5522) sendmsg$NFT_BATCH(0xffffffffffffffff, 0x0, 0x0) getsockopt$X25_QBITINCL(0xffffffffffffffff, 0x106, 0x1, 0x0, &(0x7f0000000240)=0xfffffffffffffee0) add_key(0x0, &(0x7f0000000180), &(0x7f0000000100), 0x0, 0xfffffffffffffffe) socket$inet_tcp(0x2, 0x1, 0x0) r1 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000040)='cpuacct.usage_sys\x00', 0x275a, 0x0) mmap(&(0x7f0000000000/0x400000)=nil, 0x400000, 0x1, 0x10012, r1, 0x0) futex(&(0x7f0000000000), 0x9, 0x2, 0x0, &(0x7f0000000340)=0x2, 0x0) program did not crash testing program (duration=2m39.94419324s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): openat$cgroup_root-prctl$PR_SCHED_CORE-sched_setaffinity-syz_open_dev$MSR-read$msr-ioctl$USBDEVFS_ALLOW_SUSPEND-sendmsg$NFT_BATCH-getsockopt$X25_QBITINCL-add_key-socket$inet_tcp-openat$cgroup_ro-mmap-futex detailed listing: executing program 0: openat$cgroup_root(0xffffffffffffff9c, 0x0, 0x200002, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) sched_setaffinity(0x0, 0x0, 0x0) r0 = syz_open_dev$MSR(&(0x7f0000000300), 0x100040000, 0x0) read$msr(r0, &(0x7f0000019680)=""/102392, 0x18ff8) ioctl$USBDEVFS_ALLOW_SUSPEND(0xffffffffffffffff, 0x5522) sendmsg$NFT_BATCH(0xffffffffffffffff, 0x0, 0x0) getsockopt$X25_QBITINCL(0xffffffffffffffff, 0x106, 0x1, 0x0, &(0x7f0000000240)=0xfffffffffffffee0) add_key(&(0x7f0000000140)='encrypted\x00', 0x0, &(0x7f0000000100), 0x0, 0xfffffffffffffffe) socket$inet_tcp(0x2, 0x1, 0x0) r1 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000040)='cpuacct.usage_sys\x00', 0x275a, 0x0) mmap(&(0x7f0000000000/0x400000)=nil, 0x400000, 0x1, 0x10012, r1, 0x0) futex(&(0x7f0000000000), 0x9, 0x2, 0x0, &(0x7f0000000340)=0x2, 0x0) program did not crash testing program (duration=2m39.94419324s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): openat$cgroup_root-prctl$PR_SCHED_CORE-sched_setaffinity-syz_open_dev$MSR-read$msr-ioctl$USBDEVFS_ALLOW_SUSPEND-sendmsg$NFT_BATCH-getsockopt$X25_QBITINCL-add_key-socket$inet_tcp-openat$cgroup_ro-mmap-futex detailed listing: executing program 0: openat$cgroup_root(0xffffffffffffff9c, 0x0, 0x200002, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) sched_setaffinity(0x0, 0x0, 0x0) r0 = syz_open_dev$MSR(&(0x7f0000000300), 0x100040000, 0x0) read$msr(r0, &(0x7f0000019680)=""/102392, 0x18ff8) ioctl$USBDEVFS_ALLOW_SUSPEND(0xffffffffffffffff, 0x5522) sendmsg$NFT_BATCH(0xffffffffffffffff, 0x0, 0x0) getsockopt$X25_QBITINCL(0xffffffffffffffff, 0x106, 0x1, 0x0, &(0x7f0000000240)=0xfffffffffffffee0) add_key(&(0x7f0000000140)='encrypted\x00', &(0x7f0000000180), 0x0, 0x0, 0xfffffffffffffffe) socket$inet_tcp(0x2, 0x1, 0x0) r1 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000040)='cpuacct.usage_sys\x00', 0x275a, 0x0) mmap(&(0x7f0000000000/0x400000)=nil, 0x400000, 0x1, 0x10012, r1, 0x0) futex(&(0x7f0000000000), 0x9, 0x2, 0x0, &(0x7f0000000340)=0x2, 0x0) program did not crash testing program (duration=2m39.94419324s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): openat$cgroup_root-prctl$PR_SCHED_CORE-sched_setaffinity-syz_open_dev$MSR-read$msr-ioctl$USBDEVFS_ALLOW_SUSPEND-sendmsg$NFT_BATCH-getsockopt$X25_QBITINCL-add_key-socket$inet_tcp-openat$cgroup_ro-mmap-futex detailed listing: executing program 0: openat$cgroup_root(0xffffffffffffff9c, 0x0, 0x200002, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) sched_setaffinity(0x0, 0x0, 0x0) r0 = syz_open_dev$MSR(&(0x7f0000000300), 0x100040000, 0x0) read$msr(r0, &(0x7f0000019680)=""/102392, 0x18ff8) ioctl$USBDEVFS_ALLOW_SUSPEND(0xffffffffffffffff, 0x5522) sendmsg$NFT_BATCH(0xffffffffffffffff, 0x0, 0x0) getsockopt$X25_QBITINCL(0xffffffffffffffff, 0x106, 0x1, 0x0, &(0x7f0000000240)=0xfffffffffffffee0) add_key(&(0x7f0000000140)='encrypted\x00', &(0x7f0000000180), &(0x7f0000000100), 0xca, 0xfffffffffffffffe) socket$inet_tcp(0x2, 0x1, 0x0) r1 = openat$cgroup_ro(0xffffffffffffff9c, 0x0, 0x275a, 0x0) mmap(&(0x7f0000000000/0x400000)=nil, 0x400000, 0x1, 0x10012, r1, 0x0) futex(&(0x7f0000000000), 0x9, 0x2, 0x0, &(0x7f0000000340)=0x2, 0x0) program did not crash testing program (duration=2m39.94419324s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): openat$cgroup_root-prctl$PR_SCHED_CORE-sched_setaffinity-syz_open_dev$MSR-read$msr-ioctl$USBDEVFS_ALLOW_SUSPEND-sendmsg$NFT_BATCH-getsockopt$X25_QBITINCL-add_key-socket$inet_tcp-openat$cgroup_ro-mmap-futex detailed listing: executing program 0: openat$cgroup_root(0xffffffffffffff9c, 0x0, 0x200002, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) sched_setaffinity(0x0, 0x0, 0x0) r0 = syz_open_dev$MSR(&(0x7f0000000300), 0x100040000, 0x0) read$msr(r0, &(0x7f0000019680)=""/102392, 0x18ff8) ioctl$USBDEVFS_ALLOW_SUSPEND(0xffffffffffffffff, 0x5522) sendmsg$NFT_BATCH(0xffffffffffffffff, 0x0, 0x0) getsockopt$X25_QBITINCL(0xffffffffffffffff, 0x106, 0x1, 0x0, &(0x7f0000000240)=0xfffffffffffffee0) add_key(&(0x7f0000000140)='encrypted\x00', &(0x7f0000000180), &(0x7f0000000100), 0xca, 0xfffffffffffffffe) socket$inet_tcp(0x2, 0x1, 0x0) r1 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000040)='cpuacct.usage_sys\x00', 0x275a, 0x0) mmap(&(0x7f0000000000/0x400000)=nil, 0x400000, 0x1, 0x10012, r1, 0x0) futex(0x0, 0x9, 0x2, 0x0, &(0x7f0000000340)=0x2, 0x0) program crashed: KASAN: slab-use-after-free Read in key_put testing program (duration=2m39.94419324s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): openat$cgroup_root-prctl$PR_SCHED_CORE-sched_setaffinity-syz_open_dev$MSR-read$msr-ioctl$USBDEVFS_ALLOW_SUSPEND-sendmsg$NFT_BATCH-getsockopt$X25_QBITINCL-add_key-socket$inet_tcp-openat$cgroup_ro-mmap-futex detailed listing: executing program 0: openat$cgroup_root(0xffffffffffffff9c, 0x0, 0x200002, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) sched_setaffinity(0x0, 0x0, 0x0) r0 = syz_open_dev$MSR(&(0x7f0000000300), 0x100040000, 0x0) read$msr(r0, &(0x7f0000019680)=""/102392, 0x18ff8) ioctl$USBDEVFS_ALLOW_SUSPEND(0xffffffffffffffff, 0x5522) sendmsg$NFT_BATCH(0xffffffffffffffff, 0x0, 0x0) getsockopt$X25_QBITINCL(0xffffffffffffffff, 0x106, 0x1, 0x0, &(0x7f0000000240)=0xfffffffffffffee0) add_key(&(0x7f0000000140)='encrypted\x00', &(0x7f0000000180), &(0x7f0000000100), 0xca, 0xfffffffffffffffe) socket$inet_tcp(0x2, 0x1, 0x0) r1 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000040)='cpuacct.usage_sys\x00', 0x275a, 0x0) mmap(&(0x7f0000000000/0x400000)=nil, 0x400000, 0x1, 0x10012, r1, 0x0) futex(0x0, 0x9, 0x2, 0x0, 0x0, 0x0) program did not crash extracting C reproducer testing compiled C program (duration=2m39.94419324s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): openat$cgroup_root-prctl$PR_SCHED_CORE-sched_setaffinity-syz_open_dev$MSR-read$msr-ioctl$USBDEVFS_ALLOW_SUSPEND-sendmsg$NFT_BATCH-getsockopt$X25_QBITINCL-add_key-socket$inet_tcp-openat$cgroup_ro-mmap-futex program crashed: KASAN: slab-use-after-free Read in key_put simplifying C reproducer testing compiled C program (duration=2m39.94419324s, {Threaded:false Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): openat$cgroup_root-prctl$PR_SCHED_CORE-sched_setaffinity-syz_open_dev$MSR-read$msr-ioctl$USBDEVFS_ALLOW_SUSPEND-sendmsg$NFT_BATCH-getsockopt$X25_QBITINCL-add_key-socket$inet_tcp-openat$cgroup_ro-mmap-futex program did not crash testing compiled C program (duration=2m39.94419324s, {Threaded:true Repeat:true RepeatTimes:0 Procs:1 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): openat$cgroup_root-prctl$PR_SCHED_CORE-sched_setaffinity-syz_open_dev$MSR-read$msr-ioctl$USBDEVFS_ALLOW_SUSPEND-sendmsg$NFT_BATCH-getsockopt$X25_QBITINCL-add_key-socket$inet_tcp-openat$cgroup_ro-mmap-futex program did not crash testing compiled C program (duration=2m39.94419324s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox: SandboxArg:0 Leak:false NetInjection:false NetDevices:false NetReset:false Cgroups:false BinfmtMisc:false CloseFDs:false KCSAN:false DevlinkPCI:false NicVF:false USB:false VhciInjection:false Wifi:false IEEE802154:true Sysctl:true Swap:false UseTmpDir:true HandleSegv:true Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): openat$cgroup_root-prctl$PR_SCHED_CORE-sched_setaffinity-syz_open_dev$MSR-read$msr-ioctl$USBDEVFS_ALLOW_SUSPEND-sendmsg$NFT_BATCH-getsockopt$X25_QBITINCL-add_key-socket$inet_tcp-openat$cgroup_ro-mmap-futex program crashed: KASAN: slab-use-after-free Read in key_put testing compiled C program (duration=2m39.94419324s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox: SandboxArg:0 Leak:false NetInjection:false NetDevices:false NetReset:false Cgroups:false BinfmtMisc:false CloseFDs:false KCSAN:false DevlinkPCI:false NicVF:false USB:false VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:false UseTmpDir:true HandleSegv:true Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): openat$cgroup_root-prctl$PR_SCHED_CORE-sched_setaffinity-syz_open_dev$MSR-read$msr-ioctl$USBDEVFS_ALLOW_SUSPEND-sendmsg$NFT_BATCH-getsockopt$X25_QBITINCL-add_key-socket$inet_tcp-openat$cgroup_ro-mmap-futex program crashed: KASAN: slab-use-after-free Read in key_put testing compiled C program (duration=2m39.94419324s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox: SandboxArg:0 Leak:false NetInjection:false NetDevices:false NetReset:false Cgroups:false BinfmtMisc:false CloseFDs:false KCSAN:false DevlinkPCI:false NicVF:false USB:false VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:false UseTmpDir:false HandleSegv:true Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): openat$cgroup_root-prctl$PR_SCHED_CORE-sched_setaffinity-syz_open_dev$MSR-read$msr-ioctl$USBDEVFS_ALLOW_SUSPEND-sendmsg$NFT_BATCH-getsockopt$X25_QBITINCL-add_key-socket$inet_tcp-openat$cgroup_ro-mmap-futex program crashed: KASAN: slab-use-after-free Read in key_put testing compiled C program (duration=2m39.94419324s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox: SandboxArg:0 Leak:false NetInjection:false NetDevices:false NetReset:false Cgroups:false BinfmtMisc:false CloseFDs:false KCSAN:false DevlinkPCI:false NicVF:false USB:false VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:false UseTmpDir:false HandleSegv:false Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): openat$cgroup_root-prctl$PR_SCHED_CORE-sched_setaffinity-syz_open_dev$MSR-read$msr-ioctl$USBDEVFS_ALLOW_SUSPEND-sendmsg$NFT_BATCH-getsockopt$X25_QBITINCL-add_key-socket$inet_tcp-openat$cgroup_ro-mmap-futex program crashed: KASAN: slab-use-after-free Read in key_put testing compiled C program (duration=2m39.94419324s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox: SandboxArg:0 Leak:false NetInjection:false NetDevices:false NetReset:false Cgroups:false BinfmtMisc:false CloseFDs:false KCSAN:false DevlinkPCI:false NicVF:false USB:false VhciInjection:false Wifi:false IEEE802154:false Sysctl:false Swap:false UseTmpDir:false HandleSegv:false Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): openat$cgroup_root-prctl$PR_SCHED_CORE-sched_setaffinity-syz_open_dev$MSR-read$msr-ioctl$USBDEVFS_ALLOW_SUSPEND-sendmsg$NFT_BATCH-getsockopt$X25_QBITINCL-add_key-socket$inet_tcp-openat$cgroup_ro-mmap-futex program crashed: KASAN: slab-use-after-free Read in key_put reproducing took 1h58m7.58752408s repro crashed as (corrupted=false): trusted_key: encrypted_key: insufficient parameters specified ================================================================== BUG: KASAN: slab-use-after-free in constant_test_bit arch/x86/include/asm/bitops.h:206 [inline] BUG: KASAN: slab-use-after-free in arch_test_bit arch/x86/include/asm/bitops.h:238 [inline] BUG: KASAN: slab-use-after-free in _test_bit include/asm-generic/bitops/instrumented-non-atomic.h:142 [inline] BUG: KASAN: slab-use-after-free in key_put security/keys/key.c:655 [inline] BUG: KASAN: slab-use-after-free in key_put+0x277/0x2a0 security/keys/key.c:646 Read of size 8 at addr ffff8880337e42b8 by task syz-executor302/7083 CPU: 0 UID: 0 PID: 7083 Comm: syz-executor302 Not tainted 6.12.0-syzkaller #0 Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/30/2024 Call Trace: __dump_stack lib/dump_stack.c:94 [inline] dump_stack_lvl+0x116/0x1f0 lib/dump_stack.c:120 print_address_description mm/kasan/report.c:377 [inline] print_report+0xc3/0x620 mm/kasan/report.c:488 kasan_report+0xd9/0x110 mm/kasan/report.c:601 constant_test_bit arch/x86/include/asm/bitops.h:206 [inline] arch_test_bit arch/x86/include/asm/bitops.h:238 [inline] _test_bit include/asm-generic/bitops/instrumented-non-atomic.h:142 [inline] key_put security/keys/key.c:655 [inline] key_put+0x277/0x2a0 security/keys/key.c:646 __key_create_or_update+0x92b/0xe10 security/keys/key.c:940 key_create_or_update+0x42/0x60 security/keys/key.c:1018 __do_sys_add_key+0x29c/0x460 security/keys/keyctl.c:134 do_syscall_x64 arch/x86/entry/common.c:52 [inline] do_syscall_64+0xcd/0x250 arch/x86/entry/common.c:83 entry_SYSCALL_64_after_hwframe+0x77/0x7f RIP: 0033:0x7f3f88290399 Code: 28 00 00 00 75 05 48 83 c4 28 c3 e8 51 18 00 00 90 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 b0 ff ff ff f7 d8 64 89 01 48 RSP: 002b:00007f3f88227218 EFLAGS: 00000246 ORIG_RAX: 00000000000000f8 RAX: ffffffffffffffda RBX: 00007f3f88317338 RCX: 00007f3f88290399 RDX: 0000000020000100 RSI: 0000000020000180 RDI: 0000000020000140 RBP: 00007f3f88317330 R08: 00000000fffffffe R09: 0000000000000000 R10: 00000000000000ca R11: 0000000000000246 R12: 00007f3f882e4074 R13: 0072736d2f232f75 R14: 7570632f7665642f R15: 6574707972636e65 Allocated by task 7083: kasan_save_stack+0x33/0x60 mm/kasan/common.c:47 kasan_save_track+0x14/0x30 mm/kasan/common.c:68 unpoison_slab_object mm/kasan/common.c:319 [inline] __kasan_slab_alloc+0x89/0x90 mm/kasan/common.c:345 kasan_slab_alloc include/linux/kasan.h:247 [inline] slab_post_alloc_hook mm/slub.c:4085 [inline] slab_alloc_node mm/slub.c:4134 [inline] kmem_cache_alloc_noprof+0x121/0x2f0 mm/slub.c:4141 key_alloc+0x3e3/0x13a0 security/keys/key.c:277 __key_create_or_update+0x71f/0xe10 security/keys/key.c:930 key_create_or_update+0x42/0x60 security/keys/key.c:1018 __do_sys_add_key+0x29c/0x460 security/keys/keyctl.c:134 do_syscall_x64 arch/x86/entry/common.c:52 [inline] do_syscall_64+0xcd/0x250 arch/x86/entry/common.c:83 entry_SYSCALL_64_after_hwframe+0x77/0x7f Freed by task 5936: kasan_save_stack+0x33/0x60 mm/kasan/common.c:47 kasan_save_track+0x14/0x30 mm/kasan/common.c:68 kasan_save_free_info+0x3b/0x60 mm/kasan/generic.c:579 poison_slab_object mm/kasan/common.c:247 [inline] __kasan_slab_free+0x51/0x70 mm/kasan/common.c:264 kasan_slab_free include/linux/kasan.h:230 [inline] slab_free_hook mm/slub.c:2342 [inline] slab_free mm/slub.c:4579 [inline] kmem_cache_free+0x152/0x4b0 mm/slub.c:4681 key_gc_unused_keys.constprop.0+0x134/0x480 security/keys/gc.c:167 key_garbage_collector+0x432/0x990 security/keys/gc.c:300 process_one_work+0x9c5/0x1ba0 kernel/workqueue.c:3229 process_scheduled_works kernel/workqueue.c:3310 [inline] worker_thread+0x6c8/0xf00 kernel/workqueue.c:3391 kthread+0x2c1/0x3a0 kernel/kthread.c:389 ret_from_fork+0x45/0x80 arch/x86/kernel/process.c:147 ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:244 The buggy address belongs to the object at ffff8880337e41c0 which belongs to the cache key_jar of size 336 The buggy address is located 248 bytes inside of freed 336-byte region [ffff8880337e41c0, ffff8880337e4310) The buggy address belongs to the physical page: page: refcount:1 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x337e4 head: order:1 mapcount:0 entire_mapcount:0 nr_pages_mapped:0 pincount:0 flags: 0xfff00000000040(head|node=0|zone=1|lastcpupid=0x7ff) page_type: f5(slab) raw: 00fff00000000040 ffff88801c2ba140 dead000000000122 0000000000000000 raw: 0000000000000000 0000000080120012 00000001f5000000 0000000000000000 head: 00fff00000000040 ffff88801c2ba140 dead000000000122 0000000000000000 head: 0000000000000000 0000000080120012 00000001f5000000 0000000000000000 head: 00fff00000000001 ffffea0000cdf901 ffffffffffffffff 0000000000000000 head: 0000000000000002 0000000000000000 00000000ffffffff 0000000000000000 page dumped because: kasan: bad access detected page_owner tracks the page as allocated page last allocated via order 1, migratetype Unmovable, gfp_mask 0xd20c0(__GFP_IO|__GFP_FS|__GFP_NOWARN|__GFP_NORETRY|__GFP_COMP|__GFP_NOMEMALLOC), pid 7083, tgid 7069 (syz-executor302), ts 75406627820, free_ts 74663819824 set_page_owner include/linux/page_owner.h:32 [inline] post_alloc_hook+0x2d1/0x350 mm/page_alloc.c:1556 prep_new_page mm/page_alloc.c:1564 [inline] get_page_from_freelist+0xfce/0x2f80 mm/page_alloc.c:3474 __alloc_pages_noprof+0x223/0x25a0 mm/page_alloc.c:4751 alloc_pages_mpol_noprof+0x2c9/0x610 mm/mempolicy.c:2265 alloc_slab_page mm/slub.c:2412 [inline] allocate_slab mm/slub.c:2578 [inline] new_slab+0x2c9/0x410 mm/slub.c:2631 ___slab_alloc+0xdac/0x1880 mm/slub.c:3818 __slab_alloc.constprop.0+0x56/0xb0 mm/slub.c:3908 __slab_alloc_node mm/slub.c:3961 [inline] slab_alloc_node mm/slub.c:4122 [inline] kmem_cache_alloc_noprof+0x2a7/0x2f0 mm/slub.c:4141 key_alloc+0x3e3/0x13a0 security/keys/key.c:277 keyring_alloc+0x44/0xc0 security/keys/keyring.c:526 install_process_keyring_to_cred security/keys/process_keys.c:275 [inline] install_process_keyring security/keys/process_keys.c:300 [inline] lookup_user_key+0xa34/0x12f0 security/keys/process_keys.c:653 __do_sys_add_key+0x25a/0x460 security/keys/keyctl.c:126 do_syscall_x64 arch/x86/entry/common.c:52 [inline] do_syscall_64+0xcd/0x250 arch/x86/entry/common.c:83 entry_SYSCALL_64_after_hwframe+0x77/0x7f page last free pid 2140 tgid 2140 stack trace: reset_page_owner include/linux/page_owner.h:25 [inline] free_pages_prepare mm/page_alloc.c:1127 [inline] free_unref_page+0x661/0x1080 mm/page_alloc.c:2657 vfree+0x17a/0x890 mm/vmalloc.c:3361 delayed_vfree_work+0x56/0x70 mm/vmalloc.c:3282 process_one_work+0x9c5/0x1ba0 kernel/workqueue.c:3229 process_scheduled_works kernel/workqueue.c:3310 [inline] worker_thread+0x6c8/0xf00 kernel/workqueue.c:3391 kthread+0x2c1/0x3a0 kernel/kthread.c:389 ret_from_fork+0x45/0x80 arch/x86/kernel/process.c:147 ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:244 Memory state around the buggy address: ffff8880337e4180: fc fc fc fc fc fc fc fc fa fb fb fb fb fb fb fb ffff8880337e4200: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb >ffff8880337e4280: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb ^ ffff8880337e4300: fb fb fc fc fc fc fc fc fc fc fc fc fc fc fc fc ffff8880337e4380: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc ================================================================== final repro crashed as (corrupted=false): trusted_key: encrypted_key: insufficient parameters specified ================================================================== BUG: KASAN: slab-use-after-free in constant_test_bit arch/x86/include/asm/bitops.h:206 [inline] BUG: KASAN: slab-use-after-free in arch_test_bit arch/x86/include/asm/bitops.h:238 [inline] BUG: KASAN: slab-use-after-free in _test_bit include/asm-generic/bitops/instrumented-non-atomic.h:142 [inline] BUG: KASAN: slab-use-after-free in key_put security/keys/key.c:655 [inline] BUG: KASAN: slab-use-after-free in key_put+0x277/0x2a0 security/keys/key.c:646 Read of size 8 at addr ffff8880337e42b8 by task syz-executor302/7083 CPU: 0 UID: 0 PID: 7083 Comm: syz-executor302 Not tainted 6.12.0-syzkaller #0 Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/30/2024 Call Trace: __dump_stack lib/dump_stack.c:94 [inline] dump_stack_lvl+0x116/0x1f0 lib/dump_stack.c:120 print_address_description mm/kasan/report.c:377 [inline] print_report+0xc3/0x620 mm/kasan/report.c:488 kasan_report+0xd9/0x110 mm/kasan/report.c:601 constant_test_bit arch/x86/include/asm/bitops.h:206 [inline] arch_test_bit arch/x86/include/asm/bitops.h:238 [inline] _test_bit include/asm-generic/bitops/instrumented-non-atomic.h:142 [inline] key_put security/keys/key.c:655 [inline] key_put+0x277/0x2a0 security/keys/key.c:646 __key_create_or_update+0x92b/0xe10 security/keys/key.c:940 key_create_or_update+0x42/0x60 security/keys/key.c:1018 __do_sys_add_key+0x29c/0x460 security/keys/keyctl.c:134 do_syscall_x64 arch/x86/entry/common.c:52 [inline] do_syscall_64+0xcd/0x250 arch/x86/entry/common.c:83 entry_SYSCALL_64_after_hwframe+0x77/0x7f RIP: 0033:0x7f3f88290399 Code: 28 00 00 00 75 05 48 83 c4 28 c3 e8 51 18 00 00 90 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 b0 ff ff ff f7 d8 64 89 01 48 RSP: 002b:00007f3f88227218 EFLAGS: 00000246 ORIG_RAX: 00000000000000f8 RAX: ffffffffffffffda RBX: 00007f3f88317338 RCX: 00007f3f88290399 RDX: 0000000020000100 RSI: 0000000020000180 RDI: 0000000020000140 RBP: 00007f3f88317330 R08: 00000000fffffffe R09: 0000000000000000 R10: 00000000000000ca R11: 0000000000000246 R12: 00007f3f882e4074 R13: 0072736d2f232f75 R14: 7570632f7665642f R15: 6574707972636e65 Allocated by task 7083: kasan_save_stack+0x33/0x60 mm/kasan/common.c:47 kasan_save_track+0x14/0x30 mm/kasan/common.c:68 unpoison_slab_object mm/kasan/common.c:319 [inline] __kasan_slab_alloc+0x89/0x90 mm/kasan/common.c:345 kasan_slab_alloc include/linux/kasan.h:247 [inline] slab_post_alloc_hook mm/slub.c:4085 [inline] slab_alloc_node mm/slub.c:4134 [inline] kmem_cache_alloc_noprof+0x121/0x2f0 mm/slub.c:4141 key_alloc+0x3e3/0x13a0 security/keys/key.c:277 __key_create_or_update+0x71f/0xe10 security/keys/key.c:930 key_create_or_update+0x42/0x60 security/keys/key.c:1018 __do_sys_add_key+0x29c/0x460 security/keys/keyctl.c:134 do_syscall_x64 arch/x86/entry/common.c:52 [inline] do_syscall_64+0xcd/0x250 arch/x86/entry/common.c:83 entry_SYSCALL_64_after_hwframe+0x77/0x7f Freed by task 5936: kasan_save_stack+0x33/0x60 mm/kasan/common.c:47 kasan_save_track+0x14/0x30 mm/kasan/common.c:68 kasan_save_free_info+0x3b/0x60 mm/kasan/generic.c:579 poison_slab_object mm/kasan/common.c:247 [inline] __kasan_slab_free+0x51/0x70 mm/kasan/common.c:264 kasan_slab_free include/linux/kasan.h:230 [inline] slab_free_hook mm/slub.c:2342 [inline] slab_free mm/slub.c:4579 [inline] kmem_cache_free+0x152/0x4b0 mm/slub.c:4681 key_gc_unused_keys.constprop.0+0x134/0x480 security/keys/gc.c:167 key_garbage_collector+0x432/0x990 security/keys/gc.c:300 process_one_work+0x9c5/0x1ba0 kernel/workqueue.c:3229 process_scheduled_works kernel/workqueue.c:3310 [inline] worker_thread+0x6c8/0xf00 kernel/workqueue.c:3391 kthread+0x2c1/0x3a0 kernel/kthread.c:389 ret_from_fork+0x45/0x80 arch/x86/kernel/process.c:147 ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:244 The buggy address belongs to the object at ffff8880337e41c0 which belongs to the cache key_jar of size 336 The buggy address is located 248 bytes inside of freed 336-byte region [ffff8880337e41c0, ffff8880337e4310) The buggy address belongs to the physical page: page: refcount:1 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x337e4 head: order:1 mapcount:0 entire_mapcount:0 nr_pages_mapped:0 pincount:0 flags: 0xfff00000000040(head|node=0|zone=1|lastcpupid=0x7ff) page_type: f5(slab) raw: 00fff00000000040 ffff88801c2ba140 dead000000000122 0000000000000000 raw: 0000000000000000 0000000080120012 00000001f5000000 0000000000000000 head: 00fff00000000040 ffff88801c2ba140 dead000000000122 0000000000000000 head: 0000000000000000 0000000080120012 00000001f5000000 0000000000000000 head: 00fff00000000001 ffffea0000cdf901 ffffffffffffffff 0000000000000000 head: 0000000000000002 0000000000000000 00000000ffffffff 0000000000000000 page dumped because: kasan: bad access detected page_owner tracks the page as allocated page last allocated via order 1, migratetype Unmovable, gfp_mask 0xd20c0(__GFP_IO|__GFP_FS|__GFP_NOWARN|__GFP_NORETRY|__GFP_COMP|__GFP_NOMEMALLOC), pid 7083, tgid 7069 (syz-executor302), ts 75406627820, free_ts 74663819824 set_page_owner include/linux/page_owner.h:32 [inline] post_alloc_hook+0x2d1/0x350 mm/page_alloc.c:1556 prep_new_page mm/page_alloc.c:1564 [inline] get_page_from_freelist+0xfce/0x2f80 mm/page_alloc.c:3474 __alloc_pages_noprof+0x223/0x25a0 mm/page_alloc.c:4751 alloc_pages_mpol_noprof+0x2c9/0x610 mm/mempolicy.c:2265 alloc_slab_page mm/slub.c:2412 [inline] allocate_slab mm/slub.c:2578 [inline] new_slab+0x2c9/0x410 mm/slub.c:2631 ___slab_alloc+0xdac/0x1880 mm/slub.c:3818 __slab_alloc.constprop.0+0x56/0xb0 mm/slub.c:3908 __slab_alloc_node mm/slub.c:3961 [inline] slab_alloc_node mm/slub.c:4122 [inline] kmem_cache_alloc_noprof+0x2a7/0x2f0 mm/slub.c:4141 key_alloc+0x3e3/0x13a0 security/keys/key.c:277 keyring_alloc+0x44/0xc0 security/keys/keyring.c:526 install_process_keyring_to_cred security/keys/process_keys.c:275 [inline] install_process_keyring security/keys/process_keys.c:300 [inline] lookup_user_key+0xa34/0x12f0 security/keys/process_keys.c:653 __do_sys_add_key+0x25a/0x460 security/keys/keyctl.c:126 do_syscall_x64 arch/x86/entry/common.c:52 [inline] do_syscall_64+0xcd/0x250 arch/x86/entry/common.c:83 entry_SYSCALL_64_after_hwframe+0x77/0x7f page last free pid 2140 tgid 2140 stack trace: reset_page_owner include/linux/page_owner.h:25 [inline] free_pages_prepare mm/page_alloc.c:1127 [inline] free_unref_page+0x661/0x1080 mm/page_alloc.c:2657 vfree+0x17a/0x890 mm/vmalloc.c:3361 delayed_vfree_work+0x56/0x70 mm/vmalloc.c:3282 process_one_work+0x9c5/0x1ba0 kernel/workqueue.c:3229 process_scheduled_works kernel/workqueue.c:3310 [inline] worker_thread+0x6c8/0xf00 kernel/workqueue.c:3391 kthread+0x2c1/0x3a0 kernel/kthread.c:389 ret_from_fork+0x45/0x80 arch/x86/kernel/process.c:147 ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:244 Memory state around the buggy address: ffff8880337e4180: fc fc fc fc fc fc fc fc fa fb fb fb fb fb fb fb ffff8880337e4200: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb >ffff8880337e4280: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb ^ ffff8880337e4300: fb fb fc fc fc fc fc fc fc fc fc fc fc fc fc fc ffff8880337e4380: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc ==================================================================