Extracting prog: 4h44m59.731936144s Minimizing prog: 20m2.584560621s Simplifying prog options: 0s Extracting C: 49.119415093s Simplifying C: 10m4.204162361s extracting reproducer from 50 programs first checking the prog from the crash report single: executing 1 programs separately with timeout 30s testing program (duration=30s, {Threaded:true Repeat:true RepeatTimes:0 Procs:6 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_usb_connect-syz_open_dev$dvb_demux-ioctl$DVB_DEMUX_DMX_SET_PES_FILTER detailed listing: executing program 0: syz_usb_connect(0x0, 0x4b, &(0x7f0000000000)=ANY=[@ANYBLOB="1201000200000040480b051000010102000109023900020100803209040000000000000009"], 0x0) r0 = syz_open_dev$dvb_demux(&(0x7f0000000200), 0x1, 0x2) ioctl$DVB_DEMUX_DMX_SET_PES_FILTER(r0, 0x40146f2c, &(0x7f0000000100)={0x1ff, 0x0, 0x3, 0xa, 0x4}) program did not crash single: failed to extract reproducer bisect: bisecting 50 programs with base timeout 30s testing program (duration=42s, {Threaded:true Repeat:true RepeatTimes:0 Procs:6 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): [1, 2, 23, 21, 5, 13, 13, 22, 5, 5, 5, 6, 12, 12, 4, 7, 24, 20, 4, 2, 19, 5, 5, 2, 4, 28, 20, 3, 7, 3, 24, 16, 3, 12, 11, 4, 19, 6, 2, 2, 24, 7, 5, 30, 7, 3, 4, 19, 4, 4] detailed listing: executing program 2: syz_mount_image$vfat(&(0x7f0000000000), &(0x7f0000000500)='./file0\x00', 0x2200810, &(0x7f0000000040)=ANY=[@ANYRES64=0x0, @ANYRES16, @ANYRESOCT, @ANYRESHEX, @ANYRESDEC, @ANYRES64], 0x1, 0x265, &(0x7f00000006c0)="$eJzs2k9rXFUYB+D3pimpKenE/7YgHnShboYmaxcNkoI4IGgjVEF6a250yHUm5A6BEbFZKbjq2pVrcelCEKRLN9n4CVzoKpssuxCvJJO0SYxoGscJ9nk288I5P86595w5nMXdfOX2R8tL47GU92Isy2LsSqzH3SymYyz2rMfLL17/8dm3rr/z+lyrNf9mSlfnrs3MppQuPPfDu5988/yd3vm3v73w/URsTL+3uTX7y8ZTGxc3f7/2YbtK7Sp1ur2Up5vdbi+/WRZpsV0tN1O6XRZ5VaR2pypWD7Qvld2VlX7KO4tTkyurRVWlvNNPy0U/9bqpt9pP+Qd5u5OazWaamgxOYuHru3UdW/XZG1HX9SNfxfk7MfVzNCJ7NGWPX8mevJE9vZ5d3KrrxqinylBY/4fbvkP9XET5+drC2sLgd9A+txTtKKOIy9GI32J7m+wa1Fdfa81fTjum47Py1m7+1trCmZ38F3v5mWjE9NH5mUE+HcxPxOT+8We/eyye+HP+1zOt+dkj8+fipRf25ZvRiJ/ej26UsRjb2fvjfzqT0qtvtA7lL+30AwD4v2mme468vzWbf9U+yB/jfnjofjUel8ZH++xEVP2Pl/OyLFYfoJiI46a299Q/6Nx9sPkcq8h2X8Dfd35mbIjTOA3Fl6djGkMqBudY3Fvvf3mIk/6JDhRndzfk3sE4ylc3gsOI/9z9RR/1TAAAAAAAAAAAADiOQx/9NYbxyeGonxEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAADjd/ggAAP//tpTCRA==") executing program 2: r0 = socket$inet(0x2, 0x5, 0x0) setsockopt$IP_VS_SO_SET_DELDEST(r0, 0x0, 0x488, &(0x7f0000000200)={{0x6, @multicast1, 0x4e1f, 0x0, 'rr\x00'}, {@loopback, 0x4e1f, 0x1, 0x1}}, 0x44) executing program 2: socket$nl_route(0x10, 0x3, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000140)={0xa, 0x8b}, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000280)=0x8) r0 = getpid() sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x2) sched_setscheduler(r0, 0x2, &(0x7f0000000200)=0x7) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeea, 0x8031, 0xffffffffffffffff, 0x28f43000) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r1, &(0x7f0000000180)=@abs, 0x6e) sendmmsg$unix(r2, &(0x7f0000000000), 0x651, 0x0) recvmmsg(r1, &(0x7f00000000c0), 0x10106, 0x2, 0x0) mmap$IORING_OFF_SQ_RING(0x110c230000, 0x8000002, 0x2000007, 0x401d031, 0xffffffffffffffff, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./sys\x00', 0x1ff) mount(0x0, &(0x7f0000000040)='./sys\x00', &(0x7f0000000080)='sysfs\x00', 0x0, 0x0) r3 = openat(0xffffffffffffff9c, &(0x7f00000000c0)='./sys/module/usbcore/parameters/quirks\x00', 0x2, 0x0) write(r3, &(0x7f00000005c0)="306663353a313232373a3f7092c0f0bc085a193376cf620afaf6379a248d1d6534058f1095109da34b6d6537a6e78b0dc4b7bc0b", 0x34) r4 = socket$inet_tcp(0x2, 0x1, 0x0) ioctl$sock_SIOCGIFINDEX(r4, 0x8933, &(0x7f0000000180)={'syz_tun\x00'}) mkdirat(0xffffffffffffff9c, &(0x7f0000000080)='./file1\x00', 0x1c0) mkdirat(0xffffffffffffff9c, &(0x7f00000000c0)='./file0\x00', 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000240)='./file2\x00', 0x207) mount$overlay(0x0, &(0x7f0000000100)='./file0\x00', &(0x7f0000000000), 0x0, &(0x7f00000000c0)={[{@workdir={'workdir', 0x3d, './file0'}}, {@lowerdir={'lowerdir', 0x3d, '.'}}, {@upperdir={'upperdir', 0x3d, './file2'}}], [], 0x2c}) fsync(0xffffffffffffffff) executing program 2: r0 = syz_open_procfs(0x0, &(0x7f0000000c80)='fdinfo\x00') mmap(&(0x7f0000000000/0xe7e000)=nil, 0xe7e000, 0xfffffffffffffffe, 0x4031, 0xffffffffffffffff, 0x0) syz_emit_vhci(0x0, 0x4) ioctl$UFFDIO_COPY(0xffffffffffffffff, 0xc028aa03, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000200)={0x8, 0x8a}, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000180)=0x3) r1 = socket$inet_udp(0x2, 0x2, 0x0) setsockopt$IPT_SO_SET_REPLACE(r1, 0x0, 0x40, 0x0, 0x0) sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x2) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) r2 = syz_open_dev$MSR(&(0x7f00000001c0), 0x0, 0x0) read$msr(r2, &(0x7f0000019680)=""/102392, 0x18ff8) socket$igmp(0x2, 0x3, 0x2) getdents64(r0, &(0x7f0000002440)=""/181, 0xb5) mkdir(&(0x7f0000000040)='./file0\x00', 0x0) ioctl(0xffffffffffffffff, 0x890b, 0x0) bpf$MAP_CREATE(0x0, 0x0, 0x50) setns(0xc9, 0x0) r3 = socket$netlink(0x10, 0x3, 0x8) writev(r3, &(0x7f0000000300)=[{&(0x7f0000000080)='X\x00', 0xfdef}], 0x1) sendmsg$kcm(0xffffffffffffffff, &(0x7f0000000600)={0x0, 0x0, &(0x7f00000003c0)=[{0x0}, {&(0x7f0000000000)="11c9064268", 0x5}], 0x2}, 0x40) executing program 2: r0 = socket$inet_sctp(0x2, 0x5, 0x84) setsockopt$IP_VS_SO_SET_ADD(r0, 0x0, 0x482, &(0x7f00000000c0)={0x84, @dev={0xac, 0x14, 0x14, 0x8b}, 0x15, 0x3, 'fo\x00', 0x1, 0x400000, 0x4}, 0x2c) r1 = socket$kcm(0xa, 0x2, 0x0) setsockopt$IP_VS_SO_SET_ADDDEST(r0, 0x0, 0x487, &(0x7f0000000000)={{0x84, @remote, 0x4e21, 0x3, 'wrr\x00', 0x23, 0x81, 0x36}, {@dev={0xac, 0x14, 0x14, 0x40}, 0x4e23, 0x10000, 0x1cb, 0x12d61, 0x12d58}}, 0x44) sendmsg$sock(r1, &(0x7f0000000400)={&(0x7f0000000580)=@in6={0x2, 0x4e22, 0x0, @dev}, 0x80, 0x0, 0x0, &(0x7f0000000000)=[@mark={{0x14, 0x1, 0x24, 0x3}}], 0x18}, 0x0) executing program 2: socket$netlink(0x10, 0x3, 0x0) syz_open_dev$sndpcmp(0x0, 0xfffffffffffffff1, 0x402000) r0 = openat$cgroup_ro(0xffffffffffffffff, &(0x7f0000000000)='cpuacct.usage_sys\x00', 0x0, 0x0) sendmmsg$unix(r0, 0x0, 0x0, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) sched_setattr(0x0, &(0x7f0000000280)={0x38, 0x6, 0x8, 0x3, 0x0, 0x9, 0x1, 0xfffffe0000000001, 0xfa11, 0xffffffff}, 0x0) madvise(&(0x7f0000284000/0x1000)=nil, 0x1000, 0x3) landlock_create_ruleset(0x0, 0x0, 0x0) syz_clone(0x11, 0x0, 0x0, 0x0, 0x0, 0x0) socket$nl_generic(0x10, 0x3, 0x10) r1 = openat$procfs(0xffffffffffffff9c, &(0x7f00000000c0)='/proc/partitions\x00', 0x0, 0x0) r2 = openat$sysctl(0xffffffffffffff9c, &(0x7f0000000040)='/proc/sys/vm/drop_caches\x00', 0x1, 0x0) sendfile(r2, r1, &(0x7f0000002080)=0x58, 0x12) executing program 32: socket$netlink(0x10, 0x3, 0x0) syz_open_dev$sndpcmp(0x0, 0xfffffffffffffff1, 0x402000) r0 = openat$cgroup_ro(0xffffffffffffffff, &(0x7f0000000000)='cpuacct.usage_sys\x00', 0x0, 0x0) sendmmsg$unix(r0, 0x0, 0x0, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) sched_setattr(0x0, &(0x7f0000000280)={0x38, 0x6, 0x8, 0x3, 0x0, 0x9, 0x1, 0xfffffe0000000001, 0xfa11, 0xffffffff}, 0x0) madvise(&(0x7f0000284000/0x1000)=nil, 0x1000, 0x3) landlock_create_ruleset(0x0, 0x0, 0x0) syz_clone(0x11, 0x0, 0x0, 0x0, 0x0, 0x0) socket$nl_generic(0x10, 0x3, 0x10) r1 = openat$procfs(0xffffffffffffff9c, &(0x7f00000000c0)='/proc/partitions\x00', 0x0, 0x0) r2 = openat$sysctl(0xffffffffffffff9c, &(0x7f0000000040)='/proc/sys/vm/drop_caches\x00', 0x1, 0x0) sendfile(r2, r1, &(0x7f0000002080)=0x58, 0x12) executing program 5: prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x1, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000380)={0x8, 0x100008b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000200)=0x5) openat$sequencer(0xffffffffffffff9c, &(0x7f0000000300), 0x80200, 0x0) r0 = syz_open_dev$sndmidi(&(0x7f00000004c0), 0x2, 0x141102) writev(r0, &(0x7f0000000840), 0x0) r1 = socket$unix(0x1, 0x2, 0x0) sendmsg$kcm(0xffffffffffffffff, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)=[{0x0}, {&(0x7f0000000580)="d4fa0c511aad03aa5ed217677bc41c027d9c830c439c7f821ddd78b6915cb170e7603acf9e433c2903bb6773f4b0130668a1e5b5e08d21d0b69c28ca3455aed65855c86f3d1e5789d26375a0d85eaf5e92e19c9affcf76e7a94e76556d2b104ebf645747fadc91460f4b3c94e1a89b51be4a6aa4c65285f988329a8163b69c51b801500a5bacd0463976e2960e2679ef2feee5e6ce6bb78a51fb0e15820d13e4a5aa9e0742a6f8d677ad28fea356657bb550c8311b682d9003c82267a15aa7334bc53b65b9119a1a7d905c7dd365b85c230bbad0d5d0a79819e112637819d9a187cfdf782c6127d2d4281926ab0e22f7346b616fe28ed0b9f4a0c9fdac6d3a90a9c38b5e31448a45546388c95045bc22fe88c43b", 0x114}], 0x2}, 0x0) r2 = syz_genetlink_get_family_id$tipc(&(0x7f0000000040), 0xffffffffffffffff) sendmsg$TIPC_CMD_SET_LINK_PRI(0xffffffffffffffff, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000000080)={0x68, r2, 0x1, 0x0, 0x0, {{}, {0x0, 0x410c}, {0x4c, 0x14, {0xfffffff0, @link='broadcast-link\x00'}}}}, 0x68}}, 0x0) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f00000005c0)={0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x9, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x4}, 0x50) ioctl$sock_SIOCGIFINDEX_80211(r1, 0x8b18, &(0x7f0000000000)={'wlan0\x00'}) r3 = openat$vnet(0xffffffffffffff9c, 0x0, 0x2, 0x0) r4 = openat$tun(0xffffffffffffff9c, &(0x7f0000000080), 0x2, 0x0) ioctl$TUNSETIFF(r4, 0x400454ca, &(0x7f0000000100)={'\x00', 0x1}) ioctl$VHOST_SET_OWNER(r3, 0xaf01, 0x0) syz_open_procfs(0x0, &(0x7f0000000240)='clear_refs\x00') getsockopt$TIPC_DEST_DROPPABLE(0xffffffffffffffff, 0x10f, 0x81, &(0x7f0000000080), &(0x7f00000000c0)=0x4) add_key$user(&(0x7f00000003c0), &(0x7f0000000440), &(0x7f00000000c0), 0xc9, 0xfffffffffffffffd) syz_genetlink_get_family_id$tipc2(&(0x7f0000000400), 0xffffffffffffffff) mkdirat(0xffffffffffffff9c, &(0x7f0000000440)='./mnt\x00', 0x1ff) mount(&(0x7f0000000400), &(0x7f0000000000)='./mnt\x00', &(0x7f0000000480)='ecryptfs\x00', 0x0, &(0x7f0000000500)='ecryptfs_sig=syz,ecryptfs_fnek_sig=syz,ecryptfs_cipher=aes,ecryptfs_key_bytes=16\x00') executing program 5: r0 = socket$inet6_sctp(0xa, 0x5, 0x84) r1 = socket$inet6_sctp(0xa, 0x1, 0x84) getsockopt$inet_sctp6_SCTP_SOCKOPT_CONNECTX3(r1, 0x84, 0x6f, &(0x7f0000000280)={0x0, 0x1c, &(0x7f0000000000)=[@in6={0xa, 0x0, 0x0, @rand_addr=' \x01\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x01', 0x9}]}, 0x0) getsockopt$inet_sctp6_SCTP_MAX_BURST(r1, 0x84, 0x83, &(0x7f0000000000)=@assoc_value={0x0}, &(0x7f0000000300)=0x8) setsockopt$inet_sctp6_SCTP_AUTH_KEY(r0, 0x84, 0x17, &(0x7f0000000ac0)={r2, 0x8, 0x1, 'x'}, 0x9) executing program 5: r0 = bpf$PROG_LOAD(0x5, &(0x7f0000000a40)={0x1, 0x4, &(0x7f0000000300)=ANY=[@ANYBLOB], &(0x7f0000000200)='GPL\x00', 0x0, 0x0, 0x0, 0x41100, 0x0, '\x00', 0x0, @fallback=0x2a, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) r1 = socket$kcm(0x11, 0xa, 0x300) setsockopt$sock_attach_bpf(r1, 0x1, 0x32, &(0x7f0000000040)=r0, 0x4) r2 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPSET_CMD_CREATE(r2, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000480)=ANY=[], 0x4c}}, 0x2) executing program 5: r0 = syz_ublk_setup_io_uring(0x1d, &(0x7f0000000500)={0x0, 0x30b5, 0x0, 0x2, 0x158}, &(0x7f0000000100)=0x0, &(0x7f0000000400)=0x0, &(0x7f0000000140)=0x0) syz_ublk_add_dev(r0, r1, r2, r3, &(0x7f0000000200)={0x2e, 0x14, 0x0, 0xffffffffffffffff, 0xc0207504, 0x0, 0x0, 0x0, 0x0, 0x4, 0x0, 0x0, '\x00', {0xffffffff, 0xffff, 0x40, &(0x7f00000004c0)=@any_dev={0x3, 0xe26, 0x0, 0x0, 0x1000, 0x10000, 0xffffffffffffffff, 0x0, 0x4d}}}, &(0x7f0000000480)=0x0) r5 = dup(0xffffffffffffffff) syz_ublk_setup_queues(r5, r4, &(0x7f0000000180)={0x0, 0x1, 0x0, 0x3, 0x255}, &(0x7f0000000800)=[{0x0, 0x0, 0xffffffffffffffff, {0x0, 0x92e0, 0x400, 0x2100, 0x10000004, 0x0, r5}}, {0x0, 0x0, 0xffffffffffffffff, {0x0, 0x19e0, 0x400, 0x0, 0x146}}, {0x0, 0x0, 0xffffffffffffffff, {0x0, 0xf910, 0x2000, 0x0, 0x801f0, 0x0, r5}}, {0x0, 0x0, 0xffffffffffffffff, {0x0, 0x587e, 0x80, 0x2, 0x367}}], 0x1, &(0x7f0000000340)={0x2e, 0x50, 0x0, 0xffffffffffffffff, 0xc0107520, 0x0, 0x0, 0x0, 0x0, {}, 0x1f, 0x0, '\x00', {0xfff9, 0x1, 0x0, 0x0}}, 0x0) bpf$MAP_CREATE(0x0, &(0x7f0000000340)=@base={0x1f, 0x7fff, 0x10001, 0x80, 0x80, r5, 0x2, '\x00', 0x0, 0xffffffffffffffff, 0x4, 0x3, 0x5}, 0x50) executing program 5: r0 = socket$kcm(0x2, 0x200000000000001, 0x0) sendmsg$inet(r0, &(0x7f0000000080)={&(0x7f0000000340)={0x2, 0x4001, @dev}, 0x10, 0x0}, 0x3000c085) r1 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000280)='hugetlb.1GB.usage_in_bytes\x00', 0x26e1, 0x0) setsockopt$sock_attach_bpf(r0, 0x1, 0x3e, &(0x7f0000000100)=r1, 0x4) sendmsg$kcm(r0, &(0x7f0000002480)={0x0, 0x0, &(0x7f0000001e40)=[{&(0x7f0000000e40)}], 0x1}, 0x10) sendmsg$inet(r0, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)=[{&(0x7f0000000300)="b8", 0x2ee0}], 0x13, 0x0, 0x0, 0x10000000}, 0x12cd) executing program 5: prlimit64(0x0, 0xe, &(0x7f0000000140)={0xa, 0x400000000008d}, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000080)=0x8) getpid() sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x2) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r0, &(0x7f0000000180)=@abs, 0x6e) sendmmsg$unix(r1, &(0x7f0000000000), 0x651, 0x0) recvmmsg(r0, &(0x7f00000000c0), 0x4000087, 0x2, 0x0) r2 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r2, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000000)=@updpolicy={0xb8, 0x13, 0xcb23c9c9931e99e9, 0x0, 0x0, {{@in=@private=0xa010101, @in=@remote, 0x0, 0x400, 0x1000, 0x0, 0x2, 0x20, 0x10, 0x84, 0x0, 0xffffffffffffffff}, {}, {0x0, 0x4000000000000, 0x0, 0xffffffffffffffff}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1}}, 0xb8}}, 0x80) sendmsg$nl_xfrm(r2, &(0x7f0000000480)={0x0, 0x0, &(0x7f0000000800)={&(0x7f0000000000)=ANY=[@ANYBLOB="650100001b"], 0x168}}, 0xc0) executing program 33: prlimit64(0x0, 0xe, &(0x7f0000000140)={0xa, 0x400000000008d}, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000080)=0x8) getpid() sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x2) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r0, &(0x7f0000000180)=@abs, 0x6e) sendmmsg$unix(r1, &(0x7f0000000000), 0x651, 0x0) recvmmsg(r0, &(0x7f00000000c0), 0x4000087, 0x2, 0x0) r2 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r2, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000000)=@updpolicy={0xb8, 0x13, 0xcb23c9c9931e99e9, 0x0, 0x0, {{@in=@private=0xa010101, @in=@remote, 0x0, 0x400, 0x1000, 0x0, 0x2, 0x20, 0x10, 0x84, 0x0, 0xffffffffffffffff}, {}, {0x0, 0x4000000000000, 0x0, 0xffffffffffffffff}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1}}, 0xb8}}, 0x80) sendmsg$nl_xfrm(r2, &(0x7f0000000480)={0x0, 0x0, &(0x7f0000000800)={&(0x7f0000000000)=ANY=[@ANYBLOB="650100001b"], 0x168}}, 0xc0) executing program 3: ioctl$VIDIOC_QUERYSTD(0xffffffffffffffff, 0x8008563f, &(0x7f0000000000)) r0 = syz_usb_connect(0x2, 0xb3, &(0x7f0000000640)=ANY=[@ANYBLOB="12010002ef0201406d0425080001000000010902a1000201008032080b00020e03000009040000000e0100000d240100012700006cdc0201011124020101020000000000000000020d000924030201010001"], &(0x7f0000000a40)={0x0, 0x0, 0x0, 0x0}) syz_usb_control_io$rtl8150(r0, 0x0, &(0x7f00000003c0)={0x2c, &(0x7f00000000c0)=ANY=[], 0x0, 0x0, 0x0, 0x0}) write(0xffffffffffffffff, &(0x7f0000000500)='transport=rdma,nqn=nqn.2014-08.org.n', 0x24) executing program 3: r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000000), 0x40241, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000200)={'syzkaller1\x00', 0xc201}) r1 = socket$kcm(0x2, 0xa, 0x2) ioctl$SIOCSIFHWADDR(r1, 0x8914, &(0x7f0000000180)={'syzkaller1\x00', @link_local={0x1, 0x80, 0xc2, 0x0, 0x0, 0xe}}) r2 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r2, &(0x7f0000000200)={0x0, 0x0, &(0x7f0000000000)={&(0x7f00000009c0)=ANY=[@ANYBLOB="140000001000010000000000000000000000000a20000000000a01020000000000000000010000000900010073797a300000000040000000160a01000900000000000000010000000900010073797a30000000000900020073797a3000000000140003800800014000000000080002400000000048000000160a0101000b000000000000010000000900020073797a30000000000900010073797a30000000001c0003801800"], 0xd0}, 0x1, 0x0, 0x0, 0x24040841}, 0x20048010) write$tun(r0, &(0x7f0000001280)=ANY=[@ANYBLOB="000086dd00001100"], 0xfce) executing program 0: socket$nl_route(0x10, 0x3, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000140)={0xa, 0x8b}, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000280)=0x8) r0 = getpid() sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x2) sched_setscheduler(r0, 0x2, &(0x7f0000000200)=0x7) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeea, 0x8031, 0xffffffffffffffff, 0x28f43000) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r1, &(0x7f0000000180)=@abs, 0x6e) sendmmsg$unix(r2, &(0x7f0000000000), 0x651, 0x0) recvmmsg(r1, &(0x7f00000000c0), 0x10106, 0x2, 0x0) mmap$IORING_OFF_SQ_RING(0x110c230000, 0x8000002, 0x2000007, 0x401d031, 0xffffffffffffffff, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./sys\x00', 0x1ff) mount(0x0, &(0x7f0000000040)='./sys\x00', &(0x7f0000000080)='sysfs\x00', 0x0, 0x0) r3 = openat(0xffffffffffffff9c, 0x0, 0x2, 0x0) write(r3, &(0x7f00000005c0)="306663353a313232373a3f7092c0f0bc085a193376cf620afaf6379a248d1d6534058f1095109da34b6d6537a6e78b0dc4b7bc0b", 0x34) r4 = socket$inet_tcp(0x2, 0x1, 0x0) ioctl$sock_SIOCGIFINDEX(r4, 0x8933, &(0x7f0000000180)={'syz_tun\x00'}) mkdirat(0xffffffffffffff9c, &(0x7f0000000080)='./file1\x00', 0x1c0) mkdirat(0xffffffffffffff9c, &(0x7f00000000c0)='./file0\x00', 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000240)='./file2\x00', 0x207) mount$overlay(0x0, &(0x7f0000000100)='./file0\x00', &(0x7f0000000000), 0x0, &(0x7f00000000c0)={[{@workdir={'workdir', 0x3d, './file0'}}, {@lowerdir={'lowerdir', 0x3d, '.'}}, {@upperdir={'upperdir', 0x3d, './file2'}}], [], 0x2c}) r5 = openat$dir(0xffffffffffffff9c, &(0x7f0000000000)='./file0/file1\x00', 0x20400, 0x20) fsync(r5) executing program 4: r0 = syz_usb_connect(0x0, 0x2d, &(0x7f0000000000)=ANY=[@ANYBLOB="1201000083667d1040206402d14e0102030109021b000100000000090400000190f19c00090584"], 0x0) syz_usb_control_io$hid(r0, 0x0, 0x0) ioctl$sock_FIOGETOWN(0xffffffffffffffff, 0x8903, 0x0) syz_usb_control_io(r0, 0x0, 0x0) syz_usb_control_io(r0, 0x0, 0x0) syz_usb_control_io$cdc_ncm(r0, 0x0, 0x0) syz_usb_control_io$uac2(r0, 0x0, 0x0) munmap(&(0x7f0000001000/0x3000)=nil, 0x3000) add_key$keyring(&(0x7f00000101c0), &(0x7f0000010180)={'syz', 0x1}, 0x0, 0x0, 0xfffffffffffffffd) syz_usb_control_io$uac1(r0, 0x0, 0x0) syz_usb_control_io$hid(r0, 0x0, 0x0) syz_usb_control_io$printer(r0, 0x0, 0x0) r1 = syz_open_dev$I2C(&(0x7f0000000100), 0x2, 0x1) ioctl$I2C_RDWR(r1, 0x707, &(0x7f0000000180)={&(0x7f0000000140)=[{0x7, 0x0, 0x1, &(0x7f0000000080)="ce"}], 0x1}) syz_usb_control_io$lan78xx(r0, 0x0, 0x0) syz_usb_control_io(0xffffffffffffffff, 0x0, 0x0) syz_open_dev$tty1(0xc, 0x4, 0x1) syz_usb_control_io$hid(0xffffffffffffffff, 0x0, 0x0) r2 = seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0x0, &(0x7f00000000c0)={0x1, &(0x7f0000000040)=[{0x6, 0x0, 0x0, 0x7fffffff}]}) close_range(r2, 0xffffffffffffffff, 0x0) executing program 3: r0 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r0, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000001680)=ANY=[@ANYBLOB="140000001000010000000000000000000500000a28000000000a030000000000000000000a00000708000240000000020900010073797a31000000002c000000030a010100000000000000000a0000070900010073797a3100000000090003007379"], 0x7c}, 0x1, 0x0, 0x0, 0x40001}, 0x4040850) sendmsg$NFT_BATCH(r0, &(0x7f0000009b40)={0x0, 0x0, &(0x7f0000009b00)={&(0x7f0000000240)=ANY=[@ANYBLOB="140000001000010000000000000000000500000a48000000030a0fdb00000000000000000a0000050900030073797a30000000000900010073797a310000000014000480080002403cb140bb0800014000000003080005400000000014000000110001"], 0x70}, 0x1, 0x0, 0x0, 0x4000850}, 0x24000840) sendmsg$NFT_BATCH(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000cc0)={&(0x7f00000002c0)={{0x14, 0x10, 0x1, 0x0, 0x0, {0x3}}, [@NFT_MSG_DELCHAIN={0x2c, 0x5, 0xa, 0x101, 0x0, 0x0, {0xa, 0x0, 0xa}, [@NFTA_CHAIN_TABLE={0x9, 0x1, 'syz1\x00'}, @NFTA_CHAIN_HANDLE={0xc, 0x2, 0x1, 0x0, 0x1}]}, @NFT_MSG_DELRULE={0x20, 0x8, 0xa, 0x101, 0x0, 0x0, {0xa, 0x0, 0x9}, [@NFTA_RULE_TABLE={0x9, 0x1, 'syz1\x00'}]}], {0x14}}, 0x74}, 0x1, 0x0, 0x0, 0xb0}, 0x20008890) executing program 0: r0 = socket(0x1e, 0x1, 0x0) sendto$rxrpc(r0, &(0x7f0000000000)="fb5a0c5a28bff4d1eabc9b5e1b002907e42f898086b6bd3a0e8ac1187bc611911486c8bac2fbe135179cc1af68b7b1b77ef66df43b71636ab0f3e86a90855ff090e2ed7b1f446091934082de9b302cdf509d5038867b833afdd95183930c0ab8ccdc74c131f83b97caa6739b434bdf1c", 0x70, 0xc0, &(0x7f0000000100)=@in4={0x21, 0x4, 0x2, 0x10, {0x2, 0x4e21, @multicast1}}, 0x24) executing program 7: socket$inet_smc(0x2b, 0x1, 0x0) socket$inet_udp(0x2, 0x2, 0x0) socket$nl_generic(0x10, 0x3, 0x10) socket$nl_netfilter(0x10, 0x3, 0xc) r0 = bpf$MAP_CREATE(0x0, 0x0, 0x0) bpf$PROG_LOAD(0x5, &(0x7f0000000600)={0x1, 0xf, &(0x7f00000006c0)=@ringbuf={{0x18, 0x0, 0x0, 0x0, 0x107a655, 0x0, 0x0, 0x0, 0x10}, {{0x18, 0x1, 0x1, 0x0, r0}}, {}, [], {{}, {}, {0x85, 0x0, 0x0, 0x85}}}, &(0x7f0000000000)='GPL\x00', 0x0, 0x0, 0x0, 0x41000, 0x8, '\x00', 0x0, @fallback=0x6, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) openat$sndtimer(0xffffffffffffff9c, &(0x7f00000006c0), 0x1a0001) openat$udambuf(0xffffffffffffff9c, &(0x7f0000000480), 0x2) socket(0x400000000010, 0x3, 0x0) openat$sndseq(0xffffffffffffff9c, &(0x7f0000000600), 0x183c81) socket(0x10, 0x3, 0x0) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000140)) r1 = openat$iommufd(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) ioctl$IOMMU_IOAS_ALLOC(r1, 0x3b81, &(0x7f00000003c0)={0xc, 0x0, 0x0}) ioctl$IOMMU_TEST_OP_CREATE_ACCESS(r1, 0x3ba0, &(0x7f0000000340)={0x48, 0x5, r2, 0x0, 0xffffffffffffffff, 0x1}) r3 = openat$rdma_cm(0xffffffffffffff9c, &(0x7f0000000940), 0x2, 0x0) socketpair(0x1, 0x1, 0x0, &(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}) bpf$MAP_UPDATE_ELEM_TAIL_CALL(0x2, &(0x7f00000001c0)={{}, 0x0, &(0x7f0000000100)=r4}, 0x20) writev(r3, &(0x7f0000000040)=[{&(0x7f0000000100), 0x6b82}], 0x2) executing program 6: r0 = socket$inet6_tcp(0xa, 0x1, 0x0) socketpair$tipc(0x1e, 0x1, 0x0, &(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}) sendmsg$tipc(r1, &(0x7f00000003c0)={&(0x7f0000000180), 0x10, &(0x7f0000000380)=[{&(0x7f0000000480)="c3e972bd85a6d84136d6dd55048d3593a74f338ce6772ab9a6f64041c2f6fbbecdc08ebcd3192b6a53662dae7c8e9c665e80a5d0925f728dcac30c29793992e588952653d414cb8ccdabc38767fee819ec5af0c5ee936880fe8549b4ed347779cab4ffd4e0b62c53a1c01db28f2b3f91c34211c9353bc1dece61511917c2245fd66cb8dffeacb4d46d627c97b498bf1ff6b313bfbc9765457c831771d5eec7997ec242e4505f01c1bb3e06", 0xab}, {&(0x7f0000000300)='V', 0x1}, {&(0x7f0000001600)="3eed50d0125719a810f88e3f47186fe4dae74182dfd109a2587c4797410c9b8e39bd3d9aa144d5908647c30c8db69b5c17084c9b1bfbb8680737c4f88abcdbc7d294d72ab1b344270915df9ddf5635644c351c22b29d948ac4106bce7107570beed63077cfbc98ef71699eae65d37724d995b553e7a3ade619b522313ab382caf879feb48942878e605ee3ee2872794e3abe22a3f025068b628a5d92468092a5cc649bbbd978b5772e537939432a502122235ced312dafd108c9ffeb0b38cc16da9418ca01d485a6afb5827da4df6e1121ec307de14bb32b6a977608e4576a998182dd93d592ff43e55bfdbbce23ecd501e43b3e93ef8d9d01711dff54c301e299d3801a3cffe6c9883fbd0e47124dc02569f62d48b878fcb58ce99fcffcd2a5166eff3ad93cf1d137274993d86a3b3730d63ded759f6ca88fa449e5575b15321e5a58a1f888eed7466db4976ce35f6d2efb5ad05d99a66482dc607cb5acb24d326803bd337519cc98103f59c63b5962cd72e4497d1b00817d6e09de70270a09b493c2226617b1c9ef9d506be00d6e07f14633a966f04ecca90fb8d2b963ad6f3817935bd6534fa3da1c5dc468789cbf1192f3c0bff3777f1edd2ada5d35f88f12f29e952c44445ce623509d66811c80a9e0f13ad85aba37d86ff0da4dda601d9e8acb264233bc939fb056316612cff687d5c44157be05bcc88b333ff2a40041d98f1acfe6e2231a84e09bd7a54a0442cf87ce3ee8fd8da39da1862862ae40fc3cb3055c8b70e62f243850707341f51426bb3e71c7a4fffefab060db786000618b05eb087a424a2f30f6a232ff44b605f70ceec0a8f70e37907f6e0bbba21e9d5b7ecb6d287742b75c101ba79525918c3473eae38f3c177249dfa8816661c9921f0b0c858d53ab87c8407b97950c842111002edd1d1e80b801b495da28bcd5409bc971e55dab1857e188ac9728efc8f9a4543945f86ade13b445eacecbbf848a96410ac37c57e3e9e8bc8b8fadd559d225c7468639da2b5d1208558b51e94c14faa7947a7c60e81a96bb5d194cc7289adbc02ebb4b49be1f1efc429db2f9b79b5a22919dba0c35341042c5776942c52365367c4bfc95b42be383cca7107161ded7e851d0126da33d581f1e2b08d0c061e86d31e7a83f9b51c79b4034c7deda7697034e1404c6e8e459f76c2efe64350146c7437ef808e04ca14df5f6f500264fd977272bbf8fc096774e8eb61d0963430751ac1425a073f84346b0eba368cba7fa34adc420800d4f99927280eba199f9695cf88124fafc3a2b1226d2f2ab3ea27c69a127650cf5c725b54c02bd8729033cf699ce7f030f9a3442056244da3cfb61a8126dba11377624f39eb009242152fd7b8b88de7dd86057f29bfcb7b7df0e65e7e9ac9eeaa41afa62743698bff03d5b2d51fb6bca2d92294e8e177cfa3661b26f1c040e9bed983b7bc0aa154eb9c92e4ee25091318c53113a1c23ac62d2d71504cba99041f29a4f332133292cf20abec9222a2acca57cac48fa6c0668ee5eecb494741a64d33b011dcca74696d4614c5b45a5d20983b1708d365ed3ffa60f9161972a611c22642c3c259b41f943f6d7a8b60f284d325e38fe76f0645e069ff70cae38850ccf973193b6232c987df26239a574691f7f07fffa6deae1eb0324fe546573c36f2a2c31cd442517a9b036ae6a2a491e7343864693c107a5dc2585820863c146c1ba6caa4fea9b87d567716f4c8ca1a9d2848055cd750512d3b7415d090019dc8a04a1a1d28931093cd8f00e94c407ca1fa2a5ce903d9df26e008c07cd13afa783220e1bd5e6b60645f3dbb6ecb4156fedafa2dd25498c6a99d94f0b38125ea7741b75109dcac9f80635f79f5c8a0483bb9f05a3a5bf721c7541edb252449f8b13e63c370a6146332f03ca1f1b6fe0bed984f13744bb7fa0fe322e83ddf9ffb2083e94f33604a0a199220c450dad94bf154805e7f9e4350ca2d81adf2978c87dcc8a8a7d56297ec124bfef0d28f35777205e973272c87e01070f14f5b14daa3b5104d9ff6b296c4f16ed49eb42d35e7ba3bccb7a26c33a263df88aadd596e9d9de0abbd4d449df11081f2cd62e1d8962b9b9feb25a3b8e03537d61a61c11ac22b7211d12c84e60a6abcc219e558b2513d8c530b3c7a57cdc47de545aafbb2a13c0e6c75b1b92fa241c713c83a09c92b2b61d565120372a9143415583c9596f27a663d4967cd653b08cebd6cb96c1f0dc80d57267ac9a8281d7149bde880828ee27d69a6818db58320db29d1b044eaf6ab8a5108bc522de406990b5393b1f7e7bab71bf6cf8eed1cd59c7607d662e8b313f5c4fce0f59b1027371381011b63dd5b2b09739082c0d62ffad96e30153a395234937d377c32fe7af82aca3a19d0ebc4a5c5fb5ff190f14d5695c703b571fb4bf03756635cafc6cf6267eab836c347a9d07e8089fc105346934cf3364e5be370b3c42b94bc5ae3d17a817398566a2953251eb91697d67278145df9a4b917bcca1bf211780b22f4caacfcb7604c84f943d05f6fdf8edbd258d7d8dbf84f9d99e57472c5b1c2337d749a1f345e662e2536d23c7a63bbbbf00f8b5b0a2106a0342ab27b9a10b82e82668cd49e0cbb09d7be0217645f1dda3be59c8232fa290d34791cda52aa5b5cec6339ab96a2eb3f5328cc7c0e6717c2824344547a2ed518f6b2b4e4fe5b684596aa6a9d3988fc5d5ff4cb46cec99d951b8386b10949a163af974b7543df97b4882a4ed60e927a1deb67c5f814235bef65fea79a2c712815be7403c93a3707fb90d4604ec3a6a3b0928f253f6ab6bd56c958e026c8c58172c4ac2a3efe2ecd5cea70c8313f9ac2d638bc296ba99e2ca86d2fd06b5402cdcddc3f3c9845d5ae77f6f36963b91e8f6cdccd17abe8d40ed02463af4bb0e496344f350097f1cc13313fa1e172b63556ed2b8a8121c01a5fb343ff7767821626fc49b0d6bd522e1c9bf137d5a5bccb4bc8dbb64c83a82ef6c2894f3896c9f6bf0c3764011d53eeb6db9ea9dae22d3ebcca4942d5828c0bca0d9ea37701d5a06c066ac4fe318e11e9c0d6c658ac810fb5d7836cfffe4ccbb0934e5567d74695980a156d4bf1c18861c5a29ccd349999dc20562d00e1f6c1851ae563541086438d60b975c8ceb466414ff60efa0b2dee790fd0659ffa98b92414c13d5a6825368f56c4984412205041cd8e006c7127d4395ecdffb5addf80ef938ce54a367154c4fc286d5f969325c12b13655a9a956dd3b98281f537e837669fc55d8930676e807aa8cd046e0f4583d59f86cb99f3f7a7ddde1fb39111fdec7677d2fee4b8f4814a5def5ebcc67c653384ce80eaffd880405f7edf8fd3ea049f040595df4a75e2f892e7a85e0ba351fb8d263bfff7168bb85017b360fcd2ba89346682a6ea7ccc46afbdb5ab444e3f477238b2ab503bde914d3cf1789539cde9c0621152cd97bff9f235d88a1ef4ea4309db3a05d401af7fb82784b050ef529dab4f1f003eb29710a962f7538c521e617e2f0efac36182d09985e1d725cc38c3833a53742a02f76fb2854a9e45f0febacf3bda83f11183ef5b9fef02ebcdf56d4104b175bad937d8f61964f97d673577cdcbbb48d8eb62b063ee6563b9ff053719baff871bcd83822d865b2f7ef023076425ac5cd71b1f2309de0c6f14cc9c4d3e8fad945f756a7c8a084ea1bfdf5ac6e740043e7f7bdaca06774b084ae314c2636529d4fdcd965c7f8c07156572620b827d694efdc9d2bfc5aa9391220a83765f2c71fcd48d4acaed60afb53d1013fa3b15e948ec4159f7d130ef85b594018346e99034c18738285223ea53a6b1d5cf11a607de2e19608ba03ec970a915b773824261f3fc931dd6d3b934d89f07baf14776314c3eeb8cd0537ef5736f565fbd14e520d4ab2f77ed9597b76ff91f8d1f99ebd6e473efda7accb273975a06944d1037032129992b994ca791a09b4d83980a1e494b0f97098df5f6fb6bbb02722adb11dc319c565c2c363cbd19d9fb3efb4613b62d6584cd53f7bd80e3e89304f444ce9dd1835661e3bb4de02ccf568a2a5daaf0d56898d4286c3fb62e22af62d7ac318685834467f337561dde2e0c1e2827cdffcf42c17728ee64b3ff4ccc0227590badd0bd7e448b8cca0892d6a5e0130d2ac665f47c6b28daa101c1b319869bdd39fa924d6d9ba7d72feda5f21ac78641c7d4801d41c7879721b3be4dab40d9c4a78552440101f373489cc5240b0144a9ce32691a784b6dfe971a21bb5980ff67da2d1bb90b223c9e192a39c1aeadd1f5c790811079c0b51a97105c99b6f95d71bb3ea47c33d9dcb0a53c929c44499e184a3cd722c908d3b0d157e28ffdeb2ed7192e780d96a7a2f0fd5a87bdc973e049da0caf931f26f5a21813e2e602ceb2259997e0205ce48fd9424bd6d4d75dd4301f429ee30745cd839a40dbeab4c3db2f0f10bbaea071ca41d1392385681730a3678a5f60f604dbe19cb9d7dd234337e327451b8cc65394af399432ef7fc3765d055874ebdca14e5999292d6f72f31e92bacf25db5ef8f5212952c1910de06ddbe1687a0e1837922f2228289916ed3aeb7b9cc24da3ae47139e371930afa6d3573df6732c26c0c7ae06d9cedfa77160711bcb06e6553338deae4c5731cf53cc154113096d02f3036d7d9edfcdc331e4bb860c5208489212e904eab70e7f860b0379895cbdecbf7a0b7a25e5b853c7dbe08a4e296a30afec8cf5a9f6ea4aef32a508655d539a770b21e660c9ee1d7688c56abeb7cf1afccc8d59780cf26312589e0c8e1bc00ad7b1325cd9a5dd69246e0b33407c381ea09265154aec297e4ccdf9785a1042a83e77c13d4ce4360782f2428f9916b5cd123b089eb683d30c1e895b9944aa905a1a5b52301d8cc5e4741834ead6ebdb5dc05c9c49c5e883e99d40b9838037beaf876534d747856103e59caf6266fbbe760b6ef83d004634b74f14f8eb4aef93c4cc9cbbd78d83d532c70feef51ea3f170b25d81a6a9b074bfca7e9b3771bf83517e0dd9d0600f70b86b20f61fe36076f8bada334b2390fa954973bc901619a3cfd039349cb328625f495ab288dbdd6dbfd022c2a83f59e0b998619a12e35891b5ae9e83a71765507b4a571cd2241e5885c705244c1022688bef7c5065fbcf219fc01753adb611b3fbc09403dcb10a4f99d788667eff75fa27074ca8481a633530e26163ccf7dada049d23e717e067b6fa5b2f652bc50abda9e7ccdc5f2f3c35ecc2c4431c819c9691be4422e379750774e9f39dae06f26423c8a4278789c9f3111b43f6dd25b0ad47c4cc5fda3f3ed82079c9366e0adced883488f429c1d7e1b351fd0bb204dd7977ef224c4df6d7a5f7697bc6500a7d03a8a914154779fa7092bf1be6bad4092367ce5d295a5d5d0e7c469f372ca2011d612637025e89f178ae9ada0c5b73bcb7d7c034ff595263cd4216e3c76ba5f3d81932a088a90bf8043e877e299c670ef1622a098d5519d9adc4ee7d4cd00e5934a4375fa83fdb81214b892482b31bdde59a70aaf25cb7f417c3a2a91c4e54b48149f6c41d9d396ee6ff13e3028c64a7c9b1f2e7c6e67184a3d52d6f570db3d225c947423c4c6533f22df57d15c5e5a3183422bd378b06fe4732a9401dcb19840fb8fa5c50a0ff497fef362c507753e46b8881d3e767f3b1d893a3805941c94f2efa05ce34b9ea81d716984af6834230d4707a87089d40779503ee6a9bb245d7d997f14acb80e89731c042bbbbe3dcd05177b0ee0eec23455830ef5b65aca357f2b0b887e0b9821c0", 0x1000}, {&(0x7f0000000340)="b768eb20304f2fdc5a9694a4867840d93170ca1a86406f", 0x17}], 0x4, 0x0, 0x0, 0x8010}, 0x0) sendmmsg(r2, &(0x7f0000005280), 0x4000000000001cd, 0x1008c811) close_range(r0, 0xffffffffffffffff, 0x0) executing program 3: r0 = socket$nl_generic(0x10, 0x3, 0x10) ioctl$sock_SIOCGIFINDEX_80211(r0, 0x8933, &(0x7f00000000c0)={'wlan0\x00', 0x0}) r2 = socket$packet(0x11, 0x2, 0x300) bind$packet(r2, &(0x7f0000000040)={0x11, 0x7, r1}, 0x14) write(r2, 0x0, 0x0) executing program 0: r0 = syz_open_dev$hiddev(&(0x7f00000000c0), 0x0, 0x0) ioctl$HIDIOCSREPORT(r0, 0x81044804, &(0x7f0000000400)={0x1}) executing program 7: fcntl$lock(0xffffffffffffffff, 0x7, &(0x7f0000000040)={0x0, 0x0, 0x8000, 0x3ff}) mprotect(&(0x7f0000000000/0xf000)=nil, 0xf000, 0x9) r0 = socket$netlink(0x10, 0x3, 0x14) ioctl$FIDEDUPERANGE(r0, 0xc0189436, &(0x7f0000000040)=ANY=[]) executing program 0: prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x1, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000380)={0x8, 0x100008b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000200)=0x5) openat$sequencer(0xffffffffffffff9c, &(0x7f0000000300), 0x80200, 0x0) r0 = syz_open_dev$sndmidi(&(0x7f00000004c0), 0x2, 0x141102) writev(r0, &(0x7f0000000840)=[{&(0x7f00000002c0)="94", 0xf000}, {0x0}], 0x2) r1 = socket$unix(0x1, 0x2, 0x0) sendmsg$kcm(0xffffffffffffffff, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)=[{0x0}], 0x1}, 0x0) r2 = syz_genetlink_get_family_id$tipc(&(0x7f0000000040), 0xffffffffffffffff) sendmsg$TIPC_CMD_SET_LINK_PRI(0xffffffffffffffff, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000000080)={0x68, r2, 0x1, 0x0, 0x0, {{}, {0x0, 0x410c}, {0x4c, 0x14, {0xfffffff0, @link='broadcast-link\x00'}}}}, 0x68}}, 0x0) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f00000005c0)={0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x9, 0x0, 0x0, 0x1, 0x0, &(0x7f0000000400)="14", 0x2, 0x0, 0x4}, 0x50) ioctl$sock_SIOCGIFINDEX_80211(r1, 0x8b18, 0x0) r3 = openat$vnet(0xffffffffffffff9c, &(0x7f0000000000), 0x2, 0x0) r4 = openat$tun(0xffffffffffffff9c, &(0x7f0000000080), 0x2, 0x0) ioctl$TUNSETIFF(r4, 0x400454ca, &(0x7f0000000100)={'\x00', 0x1}) ioctl$VHOST_SET_OWNER(r3, 0xaf01, 0x0) r5 = syz_open_procfs(0x0, &(0x7f0000000240)='clear_refs\x00') writev(r5, &(0x7f0000000000)=[{0x0}], 0x1) bpf$BPF_PROG_QUERY(0x10, &(0x7f0000000340)={@fallback=r3, 0x10, 0x1, 0xa43a, &(0x7f0000000180)=[0x0, 0x0, 0x0, 0x0], 0x4, 0x0, &(0x7f00000001c0)=[0x0], 0x0, 0x0, 0x0}, 0x40) ioctl$ifreq_SIOCGIFINDEX_wireguard(r1, 0x8933, &(0x7f0000000440)={'wg0\x00', 0x0}) r8 = bpf$PROG_LOAD_XDP(0x5, &(0x7f00000008c0)={0x6, 0x2, &(0x7f0000000480)=@raw=[@map_idx={0x18, 0x2, 0x5, 0x0, 0xc}], &(0x7f0000000500)='GPL\x00', 0x7, 0x85, &(0x7f00000006c0)=""/133, 0x40f00, 0x0, '\x00', 0x0, 0x25, 0xffffffffffffffff, 0x8, &(0x7f0000000780)={0x9, 0x2}, 0x8, 0x10, &(0x7f00000007c0)={0x4, 0x7, 0x7fffffff, 0x8}, 0x10, 0x0, 0x0, 0x0, &(0x7f0000000800)=[0x1, 0x1], 0x0, 0x10, 0x6}, 0x94) bpf$BPF_PROG_DETACH(0x9, &(0x7f0000000540)=ANY=[@ANYRES32=r7, @ANYRES32=r5, @ANYBLOB="1d0000001000000000000000", @ANYRES32=r8, @ANYBLOB="27983b", @ANYRES64=r6], 0x20) ioctl$VHOST_SET_MEM_TABLE(r3, 0x4008af03, &(0x7f0000000300)) r9 = syz_open_procfs(0x0, &(0x7f0000002500)='net/wireless\x00') read$FUSE(r9, &(0x7f00000046c0)={0x2020}, 0x2021) ioctl$SNDRV_PCM_IOCTL_REWIND(r9, 0x40084146, &(0x7f0000000040)=0x8) ioctl$VHOST_SET_VRING_ADDR(r3, 0x4028af11, &(0x7f0000000400)={0x1, 0x0, 0x0, &(0x7f0000020000), 0x0}) seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0x0, &(0x7f0000000000)={0x1, &(0x7f0000000100)=[{0x6, 0x72, 0x0, 0x7fff0000}]}) executing program 3: syz_open_dev$sg(0x0, 0x8, 0x0) prctl$PR_SET_SECCOMP(0x16, 0x2, &(0x7f0000000300)={0x0, 0x0}) setitimer(0x2, &(0x7f0000000040)={{0x0, 0x2710}, {0x0, 0x2710}}, 0x0) unshare(0x60000600) syz_usb_connect(0x0, 0x36, &(0x7f0000000040)=ANY=[@ANYBLOB="120100004107f540f30c7593de1a000000010902"], 0x0) mremap(&(0x7f0000ffe000/0x1000)=nil, 0x1000, 0x4000, 0x3, &(0x7f0000ff9000/0x4000)=nil) munmap(&(0x7f000045e000/0x1000)=nil, 0x1000) madvise(&(0x7f0000a93000/0x4000)=nil, 0x4000, 0x80000000e) syz_io_uring_setup(0x7a31, &(0x7f0000000080)={0x0, 0x4e36, 0x800, 0x1, 0x2fe}, &(0x7f0000000280), 0x0, 0x0) madvise(&(0x7f0000bdc000/0x4000)=nil, 0x86ac726dff2f4713, 0xa) mremap(&(0x7f00006bd000/0x2000)=nil, 0x2000, 0x4000, 0x3, &(0x7f0000721000/0x4000)=nil) r0 = syz_open_procfs(0xffffffffffffffff, &(0x7f0000000000)='cmdline\x00') preadv(r0, &(0x7f00000001c0)=[{&(0x7f0000000300)=""/147, 0x93}, {&(0x7f00000003c0)=""/118, 0x76}, {&(0x7f0000000600)=""/14, 0xe}], 0x3, 0x7, 0x10000) setsockopt$packet_fanout_data(r0, 0x107, 0x16, &(0x7f0000000180)={0x1, &(0x7f0000000100)=[{0x9, 0xfc, 0x3, 0xa9c}]}, 0x10) munmap(&(0x7f0000a88000/0x1000)=nil, 0x1000) munmap(&(0x7f00003fe000/0xc00000)=nil, 0xc00000) prctl$PR_SET_SYSCALL_USER_DISPATCH_ON(0x3b, 0x1, 0x0, 0x0, &(0x7f0000006680)) unshare(0xa020480) socket$inet(0x2, 0x1, 0x0) openat$nvme_fabrics(0xffffffffffffff9c, &(0x7f0000000040), 0x2, 0x0) executing program 6: r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$tipc2(&(0x7f0000000000), r0) sendmsg$TIPC_NL_KEY_SET(r0, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000280)={&(0x7f0000000040)={0x14, r1, 0x1}, 0x14}}, 0x0) executing program 7: r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000000), 0x40241, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000200)={'syzkaller1\x00', 0xc201}) r1 = socket$kcm(0x2, 0xa, 0x2) ioctl$SIOCSIFHWADDR(r1, 0x8914, &(0x7f0000000180)={'syzkaller1\x00', @link_local={0x1, 0x80, 0xc2, 0x0, 0x0, 0xe}}) r2 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r2, &(0x7f0000000200)={0x0, 0x0, &(0x7f0000000000)={&(0x7f00000009c0)=ANY=[@ANYBLOB="140000001000010000000000000000000000000a20000000000a01020000000000000000010000000900010073797a300000000040000000160a01000900000000000000010000000900010073797a30000000000900020073797a3000000000140003800800014000000000080002400000000048000000160a0101000b000000000000010000000900020073797a30000000000900010073797a30000000001c0003801800"], 0xd0}, 0x1, 0x0, 0x0, 0x24040841}, 0x20048010) write$tun(r0, &(0x7f0000001280)=ANY=[@ANYBLOB="000086dd00001100"], 0xfce) executing program 1: syz_usb_connect(0x0, 0x4b, &(0x7f0000000000)=ANY=[@ANYBLOB="1201000200000040480b051000010102000109023900020100803209040000000000000009"], 0x0) r0 = syz_open_dev$dvb_demux(&(0x7f0000000200), 0x1, 0x2) ioctl$DVB_DEMUX_DMX_SET_PES_FILTER(r0, 0x40146f2c, &(0x7f0000000100)={0x1ff, 0x0, 0x3, 0xa, 0x4}) executing program 6: socket$nl_route(0x10, 0x3, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000140)={0xa, 0x8b}, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000280)=0x8) r0 = getpid() sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x2) sched_setscheduler(r0, 0x2, &(0x7f0000000200)=0x7) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeea, 0x8031, 0xffffffffffffffff, 0x28f43000) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r1, &(0x7f0000000180)=@abs, 0x6e) sendmmsg$unix(r2, &(0x7f0000000000), 0x651, 0x0) recvmmsg(r1, &(0x7f00000000c0), 0x10106, 0x2, 0x0) mmap$IORING_OFF_SQ_RING(0x110c230000, 0x8000002, 0x2000007, 0x401d031, 0xffffffffffffffff, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./sys\x00', 0x1ff) mount(0x0, &(0x7f0000000040)='./sys\x00', &(0x7f0000000080)='sysfs\x00', 0x0, 0x0) r3 = openat(0xffffffffffffff9c, 0x0, 0x2, 0x0) write(r3, &(0x7f00000005c0)="306663353a313232373a3f7092c0f0bc085a193376cf620afaf6379a248d1d6534058f1095109da34b6d6537a6e78b0dc4b7bc0b", 0x34) r4 = socket$inet_tcp(0x2, 0x1, 0x0) ioctl$sock_SIOCGIFINDEX(r4, 0x8933, &(0x7f0000000180)={'syz_tun\x00'}) mkdirat(0xffffffffffffff9c, &(0x7f0000000080)='./file1\x00', 0x1c0) mkdirat(0xffffffffffffff9c, &(0x7f00000000c0)='./file0\x00', 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000240)='./file2\x00', 0x207) mount$overlay(0x0, &(0x7f0000000100)='./file0\x00', &(0x7f0000000000), 0x0, &(0x7f00000000c0)={[{@workdir={'workdir', 0x3d, './file0'}}, {@lowerdir={'lowerdir', 0x3d, '.'}}, {@upperdir={'upperdir', 0x3d, './file2'}}], [], 0x2c}) r5 = openat$dir(0xffffffffffffff9c, &(0x7f0000000000)='./file0/file1\x00', 0x20400, 0x20) fsync(r5) executing program 0: r0 = openat$qrtrtun(0xffffffffffffff9c, &(0x7f0000002740), 0x101002) mmap(&(0x7f0000000000/0xfbe000)=nil, 0xfbe000, 0x2, 0x31, 0xffffffffffffffff, 0x0) r1 = openat$ppp(0xffffffffffffff9c, &(0x7f0000000040), 0x0, 0x0) ioctl$TUNSETOFFLOAD(r1, 0xc004743e, 0x110e22fff6) r2 = socket$kcm(0x2, 0x3, 0x2) ioctl$SIOCSIFHWADDR(r2, 0x8b0f, &(0x7f0000000180)={'virt_wifi0\x00', @dev={'\xaa\xaa\xaa\xaa\xaa', 0x35}}) r3 = openat$ppp(0xffffffffffffff9c, &(0x7f0000000080), 0x1, 0x0) ioctl$TUNSETOFFLOAD(r3, 0x4004743d, 0x110e22fff6) io_setup(0x81, &(0x7f0000001440)=0x0) io_submit(r4, 0x1, &(0x7f00000008c0)=[&(0x7f0000000280)={0x0, 0x0, 0x0, 0x5, 0x800, r3, 0x0, 0x0, 0x0, 0x0, 0x2}]) r5 = openat$sysfs(0xffffffffffffff9c, &(0x7f00000002c0)='/sys/power/resume', 0x149a82, 0x10) write$cgroup_int(r5, &(0x7f0000000000)=0x2b00, 0x12) ioctl$TUNSETIFF(r5, 0x400454ca, &(0x7f0000000000)={'dummy0\x00', 0x8000}) r6 = socket$netlink(0x10, 0x3, 0x0) sendmsg$nl_route(r6, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000180)=ANY=[@ANYBLOB, @ANYRES32=0x0, @ANYBLOB="00000000000000002c00128009000100626f6e64000000001c0002800500"], 0x4c}}, 0x0) close_range(r0, 0xffffffffffffffff, 0x0) executing program 4: r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$ethtool(&(0x7f0000000740), r0) sendmsg$ETHTOOL_MSG_PAUSE_SET(r0, &(0x7f0000000880)={0x0, 0x0, &(0x7f0000000840)={&(0x7f00000012c0)=ANY=[@ANYBLOB='D\x00\x00\x00', @ANYRES16=r1, @ANYBLOB="010029bd7000ffdbdf251600000018000180140002006e657464657673696d3000000000000005000200400000000500020000000000050004"], 0x44}}, 0x0) executing program 1: socket$nl_route(0x10, 0x3, 0x0) socket(0x10, 0x803, 0x0) socket$unix(0x1, 0x2, 0x0) socket$nl_generic(0x10, 0x3, 0x10) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000280)={&(0x7f0000000500)=@newqdisc={0x24, 0x24, 0x400, 0x70bd28, 0x25dfdbfd, {0x0, 0x0, 0x0, 0x0, {0x10, 0xc}, {0x2, 0xe}, {0xfff2, 0x4}}}, 0x24}}, 0x0) r0 = socket$rxrpc(0x21, 0x2, 0xa) sendmsg$IPCTNL_MSG_CT_NEW(0xffffffffffffffff, &(0x7f0000000300)={0x0, 0x0, &(0x7f00000000c0)={0x0}}, 0x0) r1 = socket$netlink(0x10, 0x3, 0x0) r2 = socket$inet6_icmp_raw(0xa, 0x3, 0x3a) ioctl$sock_SIOCGIFINDEX(r2, 0x8933, &(0x7f0000000000)={'bridge0\x00'}) sendmsg$nl_route(0xffffffffffffffff, &(0x7f0000000100)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000080)=ANY=[@ANYBLOB="280000007000010010ab4be68e8da23507000000", @ANYBLOB="100001800400", @ANYRES8=r0], 0x28}}, 0x0) sendmmsg(r1, &(0x7f00000002c0), 0x40000000000009f, 0x0) executing program 6: r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000000), 0x2, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000200)={'syzkaller1\x00', 0x5001}) bpf$PROG_LOAD(0x5, &(0x7f0000000180)={0x5, 0x4, &(0x7f0000000080)=ANY=[@ANYBLOB="b40500000000000069108e0000000000bc0010"], 0x0, 0x5, 0x0, 0x0, 0x0, 0x8}, 0x94) r1 = socket$inet_udp(0x2, 0x2, 0x0) r2 = socket$nl_route(0x10, 0x3, 0x0) r3 = socket$unix(0x1, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r3, 0x8933, 0x0) sendmsg$nl_route_sched(r2, &(0x7f00000012c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f00000000c0)=@newqdisc={0x30, 0x24, 0x601, 0x0, 0x0, {0x0, 0x0, 0x0, 0x0, {}, {0xfff1, 0xffff}}, [@qdisc_kind_options=@q_ingress={0xc}]}, 0x30}}, 0x0) sendmsg$nl_route_sched(r2, &(0x7f0000000580)={0x0, 0x0, &(0x7f0000000300)={&(0x7f0000001300)=@newtfilter={0x80, 0x2c, 0x601, 0x0, 0x0, {0x0, 0x0, 0x0, 0x0, {0xb, 0x7}, {0xfff1, 0xffff}, {0x300}}, [@filter_kind_options=@f_matchall={{0xd}, {0x4c, 0x2, [@TCA_MATCHALL_ACT={0x48, 0x2, [@m_ct={0x44, 0x1, 0x0, 0x0, {{0x7}, {0x1c, 0x2, 0x0, 0x1, [@TCA_CT_PARMS={0x18, 0x1, {0x0, 0x0, 0x3}}]}, {0x4}, {0xc}, {0xc}}}]}]}}]}, 0x80}}, 0x0) ioctl$sock_inet_SIOCSIFFLAGS(r1, 0x8914, &(0x7f0000000200)={'syzkaller1\x00', 0x1}) write$tun(r0, &(0x7f0000000040)=ANY=[@ANYBLOB="03031b003a003200060063"], 0x76) executing program 4: r0 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r0, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000001680)=ANY=[@ANYBLOB="140000001000010000000000000000000500000a28000000000a030000000000000000000a00000708000240000000020900010073797a31000000002c000000030a010100000000000000000a0000070900010073797a3100000000090003007379"], 0x7c}, 0x1, 0x0, 0x0, 0x40001}, 0x4040850) sendmsg$NFT_BATCH(r0, &(0x7f0000009b40)={0x0, 0x0, &(0x7f0000009b00)={&(0x7f0000000240)=ANY=[@ANYBLOB="140000001000010000000000000000000500000a48000000030a0fdb00000000000000000a0000050900030073797a30000000000900010073797a310000000014000480080002403cb140bb0800014000000003080005400000000014000000110001"], 0x70}, 0x1, 0x0, 0x0, 0x4000850}, 0x24000840) sendmsg$NFT_BATCH(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000cc0)={&(0x7f00000002c0)={{0x14, 0x10, 0x1, 0x0, 0x0, {0x3}}, [@NFT_MSG_DELCHAIN={0x2c, 0x5, 0xa, 0x101, 0x0, 0x0, {0xa, 0x0, 0xa}, [@NFTA_CHAIN_TABLE={0x9, 0x1, 'syz1\x00'}, @NFTA_CHAIN_HANDLE={0xc, 0x2, 0x1, 0x0, 0x1}]}, @NFT_MSG_DELRULE={0x20, 0x8, 0xa, 0x101, 0x0, 0x0, {0xa, 0x0, 0x9}, [@NFTA_RULE_TABLE={0x9, 0x1, 'syz1\x00'}]}], {0x14}}, 0x74}, 0x1, 0x0, 0x0, 0xb0}, 0x20008890) executing program 4: socket$inet_smc(0x2b, 0x1, 0x0) socket$inet_udp(0x2, 0x2, 0x0) socket$nl_generic(0x10, 0x3, 0x10) socket$nl_netfilter(0x10, 0x3, 0xc) r0 = bpf$MAP_CREATE(0x0, 0x0, 0x0) bpf$PROG_LOAD(0x5, &(0x7f0000000600)={0x1, 0xf, &(0x7f00000006c0)=@ringbuf={{0x18, 0x0, 0x0, 0x0, 0x107a655, 0x0, 0x0, 0x0, 0x10}, {{0x18, 0x1, 0x1, 0x0, r0}}, {}, [], {{}, {}, {0x85, 0x0, 0x0, 0x85}}}, &(0x7f0000000000)='GPL\x00', 0x0, 0x0, 0x0, 0x41000, 0x8, '\x00', 0x0, @fallback=0x6, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) openat$sndtimer(0xffffffffffffff9c, &(0x7f00000006c0), 0x1a0001) openat$udambuf(0xffffffffffffff9c, &(0x7f0000000480), 0x2) socket(0x400000000010, 0x3, 0x0) openat$sndseq(0xffffffffffffff9c, &(0x7f0000000600), 0x183c81) socket(0x10, 0x3, 0x0) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000140)) r1 = openat$iommufd(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) ioctl$IOMMU_IOAS_ALLOC(r1, 0x3b81, &(0x7f00000003c0)={0xc, 0x0, 0x0}) ioctl$IOMMU_TEST_OP_CREATE_ACCESS(r1, 0x3ba0, &(0x7f0000000340)={0x48, 0x5, r2, 0x0, 0xffffffffffffffff, 0x1}) r3 = openat$rdma_cm(0xffffffffffffff9c, &(0x7f0000000940), 0x2, 0x0) socketpair(0x1, 0x1, 0x0, &(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}) bpf$MAP_UPDATE_ELEM_TAIL_CALL(0x2, &(0x7f00000001c0)={{}, 0x0, &(0x7f0000000100)=r4}, 0x20) writev(r3, &(0x7f0000000040)=[{&(0x7f0000000100), 0x6b82}], 0x2) executing program 1: ioctl$vim2m_VIDIOC_S_FMT(0xffffffffffffffff, 0xc0d05605, 0x0) r0 = userfaultfd(0x801) close_range(0xffffffffffffffff, 0xffffffffffffffff, 0x2) ioctl$UFFDIO_API(r0, 0xc018aa3f, &(0x7f00000000c0)) mprotect(&(0x7f0000000000/0xf000)=nil, 0xf000, 0x1) ioctl$UFFDIO_CONTINUE(r0, 0xc020aa08, &(0x7f0000000080)={{&(0x7f0000400000/0xc00000)=nil, 0xc00000}}) executing program 4: r0 = syz_open_dev$hiddev(&(0x7f00000000c0), 0x0, 0x0) ioctl$HIDIOCSREPORT(r0, 0x81044804, &(0x7f0000000400)={0x1}) executing program 7: r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f00000018c0)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000001900)=ANY=[@ANYBLOB="280000001e0001"], 0x28}}, 0x0) executing program 1: ioctl$SNDRV_CTL_IOCTL_ELEM_WRITE(0xffffffffffffffff, 0xc1105518, &(0x7f0000000040)={{0x0, 0x0, 0x0, 0x0, 'syz0\x00'}, 0x1, [0x4, 0x3, 0xfffffffffffffffe, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x801, 0x0, 0x0, 0xfffffffffffffffe, 0x0, 0x40000000, 0x0, 0x0, 0x0, 0x0, 0x2d8, 0x0, 0x470, 0xa7, 0x8, 0x8000000000000000, 0x0, 0xfffffffffffffffe, 0x9, 0x0, 0x2, 0x0, 0xfffffffa, 0x3, 0xfffffffffffffffe, 0x0, 0x400, 0x0, 0x0, 0x0, 0x2, 0x3, 0x7, 0x1, 0x0, 0x8000, 0x7, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4, 0x0, 0x0, 0x4, 0x4, 0x0, 0x0, 0xfffffffffffffffc, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x0, 0x8, 0xf5, 0x0, 0x4, 0x0, 0xd318, 0x2000000000, 0x0, 0x4, 0x0, 0x1000000000000000, 0x0, 0x0, 0xfffffffffffffffc, 0xffffffffffffffff, 0x0, 0xfffffffffffffffc, 0x0, 0x6, 0x0, 0xfffffffd, 0x8, 0x7, 0x6, 0x800000, 0x0, 0x101, 0x272f, 0xd721, 0x0, 0x4, 0x0, 0xffffffffffffffff, 0x1, 0xfffffffffffffffd, 0x0, 0x0, 0x0, 0x1, 0x4, 0x5, 0x1, 0x4000000, 0x5, 0x0, 0xdc5d, 0x0, 0x0, 0x1000, 0x0, 0x0, 0x0, 0x4000000000006fd, 0x0, 0x6, 0x0, 0x0, 0x0, 0x100]}) r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000140), 0x40241, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000000)={'syzkaller1\x00', 0xc201}) r1 = socket$kcm(0x2, 0xa, 0x2) ioctl$SIOCSIFHWADDR(r1, 0x8914, &(0x7f0000000080)={'syzkaller1\x00', @link_local={0x1, 0x80, 0xc2, 0x0, 0x0, 0x1c}}) write$tun(r0, 0x0, 0xfdef) openat$iommufd(0xffffffffffffff9c, 0x0, 0x0, 0x0) fstat(0xffffffffffffffff, 0x0) r2 = syz_open_dev$usbfs(&(0x7f0000000240), 0xb, 0x101301) r3 = socket$nl_generic(0x10, 0x3, 0x10) setsockopt$inet_sctp_SCTP_DEFAULT_SEND_PARAM(0xffffffffffffffff, 0x84, 0xa, &(0x7f00000001c0)={0x8, 0x6, 0x6, 0x0, 0x2, 0x5775d27c, 0x158, 0x20100}, 0x20) sendmsg$nl_generic(r3, &(0x7f0000000100)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000180)=ANY=[@ANYBLOB="4800000041000501010000000000000001010000000000001c0001000600060008000000100007007f0000017f000001910040001400020010000c00040006"], 0x48}, 0x1, 0x0, 0x0, 0x2c048040}, 0xe800) ioctl$USBDEVFS_IOCTL(r2, 0xc0105512, &(0x7f0000000200)) ioctl$USBDEVFS_GET_SPEED(r2, 0x551f) ioctl$USBDEVFS_IOCTL(r2, 0x80045505, &(0x7f0000000040)=@usbdevfs_connect) ioctl$USBDEVFS_CLAIM_PORT(r2, 0x80045518, 0x0) r4 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000040)='memory.events\x00', 0x275a, 0x0) syz_open_dev$mtd(&(0x7f0000000240), 0x0, 0x82000) write$tun(r4, &(0x7f0000000340)=ANY=[], 0x141) r5 = openat$userio(0xffffffffffffff9c, &(0x7f0000000300), 0x22242, 0x0) write$USERIO_CMD_REGISTER(r5, &(0x7f00000000c0), 0x2) mmap(&(0x7f0000000000/0x4000)=nil, 0x4000, 0x1, 0x10012, r4, 0x0) syz_clone3(&(0x7f0000000280)={0x84000000, &(0x7f0000000000), &(0x7f0000000080), &(0x7f00000000c0)=0x0, {0x1f}, &(0x7f0000000100)=""/36, 0x24, &(0x7f0000000140)=""/22, &(0x7f0000000180)=[0xffffffffffffffff, 0x0, 0x0], 0x3}, 0x58) ioctl$BLKTRACESETUP(r4, 0xc0481273, &(0x7f0000000300)={'\x00', 0x4, 0x8, 0x5, 0x2, 0xd, r6}) executing program 4: r0 = syz_usb_connect(0x0, 0x39, &(0x7f0000000100)=ANY=[], 0x0) syz_usb_disconnect(r0) r1 = syz_usb_connect(0x0, 0x3f, &(0x7f0000000540)=ANY=[], 0x0) syz_usb_control_io(r1, 0x0, 0x0) syz_usb_control_io$printer(r1, 0x0, 0x0) r2 = syz_open_dev$char_usb(0xc, 0xb4, 0x0) ioctl$EVIOCGMASK(r2, 0x5b03, 0x0) executing program 7: r0 = syz_open_dev$vim2m(&(0x7f0000000100), 0x0, 0x2) ioctl$vim2m_VIDIOC_STREAMOFF(r0, 0x40045612, &(0x7f0000000040)=0x1) ioctl$vim2m_VIDIOC_QBUF(r0, 0xc058560f, &(0x7f0000000180)=@mmap={0x1, 0x1, 0x4, 0x100, 0x81, {}, {0x4, 0x8, 0x8, 0x5, 0x29, 0x9, "0adb3fb8"}, 0x3}) write$uinput_user_dev(0xffffffffffffffff, &(0x7f0000000400)={'syz0\x00', {0x3, 0x2, 0x6, 0xfffa}, 0x3a, [0x8001, 0xc95a, 0xf, 0x8, 0x80, 0x2, 0x7, 0x7f, 0xa9, 0x4d, 0x6, 0x5f, 0x9, 0x15, 0xffff2d37, 0xff7fff01, 0x6, 0x5, 0x7, 0x5, 0x4, 0x0, 0x7, 0x3c5b, 0x1, 0x20, 0xd, 0x1, 0x0, 0xffffffff, 0xe661, 0x6, 0x7, 0x5, 0x8, 0x4c74, 0xffff7fff, 0x7, 0x3, 0xe, 0x0, 0x80008071, 0x7, 0x17, 0xffffffff, 0x7, 0x5, 0x80003e, 0x18e, 0x6, 0x6, 0x0, 0x8, 0x4, 0x8, 0x3ff, 0x80, 0x0, 0x5, 0x6, 0x8, 0x7, 0x1, 0x40], [0x10000007, 0x9, 0x8000012f, 0x8004, 0x5, 0xfffffff3, 0x129432f6, 0xc8, 0xf1, 0xe, 0x2bf, 0x6c7, 0x2009, 0xfffffffc, 0x573a, 0x0, 0x0, 0x5, 0x2f, 0x8, 0x312, 0x66abcbd2, 0xea4, 0x0, 0x4, 0x1007, 0x7fff, 0x6, 0x400, 0x401, 0x6, 0x1, 0xff, 0x7, 0x1000005, 0x5f31, 0xd, 0x4e0, 0x381, 0x4, 0xb, 0x4, 0x9, 0x8, 0x40, 0x6, 0x47, 0x8000, 0x1, 0xfe000000, 0xffff, 0x2, 0x4, 0x200009, 0x3, 0x3, 0x4000009, 0x6, 0x0, 0x3, 0xbc45, 0x48c93690, 0x42, 0x3], [0x6, 0x40a, 0x3ff, 0x5, 0xfffffffd, 0x100, 0x5, 0x9, 0x5, 0x7fff, 0x0, 0x5, 0xb, 0x4, 0x5, 0x5, 0x0, 0x1ef, 0x3, 0x8, 0x86, 0x1000515, 0x303c, 0x3e7, 0xb, 0x5, 0x2, 0x2, 0x3, 0x20000008, 0x4, 0x6cff, 0x6, 0x20000038, 0x200, 0x1fd, 0x80, 0x7, 0x4, 0x2950bfaf, 0x1000, 0xa2, 0x7, 0xcc, 0x5, 0x6, 0xac8, 0xbf, 0x2, 0x3, 0x7ff, 0x12b, 0x4, 0x1, 0xa, 0xffffffff, 0x5, 0x1c, 0x120000, 0x7ef, 0x2006, 0x80a2cd, 0x4, 0x25], [0xc, 0xbb33, 0x7, 0xb, 0x5, 0x938, 0x6, 0x6, 0x0, 0xb9, 0xce4, 0x1ff, 0x2, 0x57, 0x5, 0x3, 0x2, 0x10000, 0x4, 0x7fff, 0xfff4, 0xa620, 0x1, 0x5, 0x801, 0x2000002, 0x150, 0x60a7, 0x6, 0x16, 0xffffffff, 0x8, 0x4, 0x5, 0xca, 0x1, 0xfffff000, 0x10000, 0xf, 0x7e, 0x9, 0x9622, 0x7, 0xaf, 0x20000008, 0x5, 0x226, 0x2, 0x5, 0x0, 0x30b1d693, 0xa1f, 0xf40, 0x7, 0x530e, 0xe1c4, 0x0, 0x0, 0x5, 0x7ff, 0xd7, 0x200, 0xb, 0xfff]}, 0x45c) ppoll(&(0x7f00000000c0)=[{}, {}], 0x20000000000000dc, 0x0, 0x0, 0x0) executing program 7: bpf$MAP_CREATE(0x0, &(0x7f0000000080)=ANY=[], 0x50) bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x0, 0xc, 0x0, 0x0, 0xfffffffd, 0x0, 0x0, 0x0, 0x40, '\x00', 0x0, @fallback=0x10, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) socket(0x10, 0x803, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x1, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000380)={0xa, 0x100008b}, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000200)=0x8) openat$sequencer(0xffffffffffffff9c, &(0x7f00000001c0), 0x80200, 0x0) r0 = syz_open_dev$sndmidi(&(0x7f00000004c0), 0x2, 0x141102) writev(r0, &(0x7f0000000840)=[{&(0x7f00000002c0)="94", 0xf000}, {0x0}], 0x2) ioctl$sock_SIOCGIFINDEX(0xffffffffffffffff, 0x8933, 0x0) r1 = socket$kcm(0xa, 0x3, 0x3a) r2 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r2, &(0x7f0000000480)={0x0, 0x0, &(0x7f0000001f40)={&(0x7f00000004c0)=ANY=[@ANYBLOB="fc000000190001002dbd700000000000ac1e0001000000000000000000000000ac1414aa00"/48, @ANYRES32=0x0, @ANYRES32, @ANYBLOB="00000000000000000c00000000000000000000000000000000000000000000000000000000000000ffffffffffffffff000000000000000000000000000000000000000000000000000a000000000000feffffffff7f40000200000000000008ffffffff00000000010006000000000044000500ac1414bb000000000000000000000000000000003c0000000200000000000000000000000000000000000001060000"], 0xfc}, 0x1, 0x0, 0x0, 0x4008000}, 0x600c010) sendmsg$kcm(r1, &(0x7f0000000080)={&(0x7f0000000000)=@l2tp6={0xa, 0x0, 0x0, @loopback={0xfe80000000000000, 0xac14140c}}, 0x80, &(0x7f00000000c0)=[{&(0x7f0000000140)='\x00\x00', 0xffe3}], 0x1, 0x0, 0x0, 0x900}, 0x60) setsockopt$IPT_SO_SET_REPLACE(0xffffffffffffffff, 0x0, 0x40, 0x0, 0x0) syz_usb_connect(0x3, 0x57, &(0x7f0000000000)=ANY=[@ANYBLOB="1201000200000040402001c60100000000010902450001010080fa0904"], 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000340)='./file1\x00', 0x0) mkdirat(0xffffffffffffff9c, &(0x7f00000000c0)='./bus\x00', 0x1d7) mkdirat(0xffffffffffffff9c, &(0x7f0000000400)='./file1/file0\x00', 0x100) mount$bind(&(0x7f0000000100)='.\x00', &(0x7f0000000080)='./file1/file0\x00', 0x0, 0x1085408, 0x0) r3 = openat$sw_sync(0xffffffffffffff9c, &(0x7f0000000ac0), 0x800, 0x0) ioctl$SW_SYNC_IOC_CREATE_FENCE(r3, 0xc0285700, &(0x7f0000000b00)={0x4, "abacd211119ca94c63377526aeb5ab2c7b9ca5fa07558139ede6dc06270ee042", 0xffffffffffffffff}) ioctl$SYNC_IOC_MERGE(r4, 0xc0303e03, &(0x7f0000000780)={"d1ed39d88b014076ab94c1fb10628c46d2e66ccdb9e581a38ebb0ddd5f307e56", 0xffffffffffffffff, 0xffffffffffffffff}) ioctl$SYNC_IOC_FILE_INFO(r5, 0xc0383e04, 0x0) mount$overlay(0x0, &(0x7f00000000c0)='./bus\x00', &(0x7f00000003c0), 0x40, &(0x7f0000000300)={[{@workdir={'workdir', 0x3d, './bus'}}, {@upperdir={'upperdir', 0x3d, './file1'}}]}) bpf$PROG_LOAD(0x5, 0x0, 0x0) r6 = syz_usb_connect$hid(0x1, 0x36, &(0x7f0000000040)=ANY=[@ANYBLOB="12010000090024206d041cc340000000000109022400010000a00009040000010301010009"], 0x0) r7 = syz_open_procfs(0xffffffffffffffff, &(0x7f0000000080)='stat\x00') read$FUSE(r7, &(0x7f0000004180)={0x2020}, 0x2020) syz_usb_control_io$hid(r6, &(0x7f0000000240)={0x24, &(0x7f00000003c0)=ANY=[@ANYBLOB="00000c000000070001"], 0x0, 0x0, 0x0}, 0x0) executing program 6: r0 = socket$packet(0x11, 0x2, 0x300) setsockopt$SO_ATTACH_FILTER(r0, 0x1, 0x1a, &(0x7f0000000100)={0x2, &(0x7f0000000040)=[{0x0, 0x0, 0xfd, 0xc8e}, {0x16, 0xff, 0x6, 0x6}]}, 0x10) setsockopt$packet_fanout(r0, 0x107, 0x12, 0x0, 0x0) r1 = socket$inet_udp(0x2, 0x2, 0x0) bind$inet(r1, &(0x7f0000000140)={0x2, 0x80, @dev={0xac, 0x14, 0x14, 0xf}}, 0x10) sendmmsg$inet(r1, &(0x7f0000000c00)=[{{&(0x7f0000010940)={0x2, 0x4e22, @multicast2}, 0x10, 0x0}}], 0x1, 0x2000c044) sendto$inet(r1, &(0x7f0000000c80)="e8", 0x6200, 0x0, 0x0, 0x0) executing program 6: syz_usb_connect(0x0, 0x4b, &(0x7f0000000000)=ANY=[@ANYBLOB="1201000200000040480b051000010102000109023900020100803209040000000000000009"], 0x0) r0 = syz_open_dev$dvb_demux(&(0x7f0000000200), 0x1, 0x2) ioctl$DVB_DEMUX_DMX_SET_PES_FILTER(r0, 0x40146f2c, &(0x7f0000000100)={0x1ff, 0x0, 0x3, 0xa, 0x4}) executing program 3: ioctl$VIDIOC_QUERYSTD(0xffffffffffffffff, 0x8008563f, &(0x7f0000000000)) r0 = syz_usb_connect(0x2, 0xb3, &(0x7f0000000640)=ANY=[@ANYBLOB="12010002ef0201406d0425080001000000010902a1000201008032080b00020e03000009040000000e0100000d240100012700006cdc0201011124020101020000000000000000020d000924030201010001"], &(0x7f0000000a40)={0x0, 0x0, 0x0, 0x0}) syz_usb_control_io$rtl8150(r0, 0x0, &(0x7f00000003c0)={0x2c, &(0x7f00000000c0)=ANY=[], 0x0, 0x0, 0x0, 0x0}) write(0xffffffffffffffff, &(0x7f0000000500)='transport=rdma,nqn=nqn.2014-08.org.nvmexpress:NVMf:uui', 0x36) executing program 0: socket$can_raw(0x1d, 0x3, 0x1) socket(0x18, 0x80000, 0x1) socket$key(0xf, 0x3, 0x2) syz_open_procfs$namespace(0x0, &(0x7f0000000280)='ns/ipc\x00') syz_open_procfs$namespace(0x0, &(0x7f0000000040)='ns/ipc\x00') socket$inet_udp(0x2, 0x2, 0x0) syz_open_dev$vim2m(&(0x7f0000000080), 0x7, 0x2) socket$inet_icmp_raw(0x2, 0x3, 0x1) bpf$PROG_LOAD(0x5, &(0x7f0000000000)={0x13, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x40, '\x00', 0x0, @fallback=0x2e, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0x1}, 0x94) socket$netlink(0x10, 0x3, 0x0) openat$rdma_cm(0xffffffffffffff9c, &(0x7f0000000180), 0x2, 0x0) socket$nl_xfrm(0x10, 0x3, 0x6) mkdirat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000)='./cgroup/syz0\x00', 0x1ff) openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000), 0x200002, 0x0) r0 = epoll_create1(0x0) socket$nl_route(0x10, 0x3, 0x0) r1 = socket$netlink(0x10, 0x3, 0x0) sendmsg$nl_route(0xffffffffffffffff, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000000080)=ANY=[@ANYBLOB="540000001000010400000000000000ffff000000", @ANYRES32=0x0, @ANYBLOB="0380000000000000240012800c0001006d6163766c616e00140002800800010008000000060002000100000008000500", @ANYRES32=r0, @ANYBLOB='\b\x00\n\x00', @ANYRES8=r1], 0x54}, 0x1, 0x0, 0x0, 0x4000085}, 0x0) sendmmsg(r1, &(0x7f00000002c0), 0x40000000000009f, 0x20) executing program 1: r0 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r0, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000001680)=ANY=[@ANYBLOB="140000001000010000000000000000000500000a28000000000a030000000000000000000a00000708000240000000020900010073797a31000000002c000000030a010100000000000000000a0000070900010073797a31000000000900030073797a320000000014"], 0x7c}, 0x1, 0x0, 0x0, 0x40001}, 0x4040850) sendmsg$NFT_BATCH(r0, &(0x7f0000009b40)={0x0, 0x0, &(0x7f0000009b00)={&(0x7f0000000240)=ANY=[@ANYBLOB="140000001000010000000000000000000500000a48000000030a0fdb00000000000000000a0000050900030073797a30000000000900010073797a310000000014000480080002403cb140bb0800014000000003080005400000000014000000110001"], 0x70}, 0x1, 0x0, 0x0, 0x4000850}, 0x24000840) sendmsg$NFT_BATCH(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000cc0)={&(0x7f00000002c0)={{0x14, 0x10, 0x1, 0x0, 0x0, {0x3}}, [@NFT_MSG_DELCHAIN={0x2c, 0x5, 0xa, 0x101, 0x0, 0x0, {0xa, 0x0, 0xa}, [@NFTA_CHAIN_TABLE={0x9, 0x1, 'syz1\x00'}, @NFTA_CHAIN_HANDLE={0xc, 0x2, 0x1, 0x0, 0x1}]}, @NFT_MSG_DELRULE={0x20, 0x8, 0xa, 0x101, 0x0, 0x0, {0xa, 0x0, 0x9}, [@NFTA_RULE_TABLE={0x9, 0x1, 'syz1\x00'}]}], {0x14}}, 0x74}, 0x1, 0x0, 0x0, 0xb0}, 0x20008890) executing program 1: sendmmsg$inet(0xffffffffffffffff, &(0x7f0000002140)=[{{0x0, 0x0, &(0x7f0000000540)=[{&(0x7f0000002280)="21ae1baf930b4569b9ddef9797ffd935c7d80e6466b3e4e62dd4603583f5d4b61fbc65b6ac744d7319535e75bf552062e4cfde1ba7ce29263322e18ea9740aa89f69c47a63133708cda00d2b1f4e799bd41e3f76258180fa91a42aaa8b1ebc4e0ea8fb12f2c71e6e5bc57a8e91f254005514721d93c13c5606ae1fea7f31f558d562bd5a8dfb0b9fed873efa221fccffa84fcd374c92e6cbb03e6a9de890ce323f000000abcc6c01326d588495b7c1a7db31ec4129e6336f26bb9e0b7552af3cd2d5dda1632799bbc98425c433384d8a8e4071ff39a36dfde5f05af35a4ddd340cfecd7ec935f4ce7d3e851583ba1cf53a90a7f7bce5703de57ce93ddef7849b30a01de0637e6d5e507b801d32e582e0c2d564539ebfc84c098a23e765552767b122885fb1629e9c180be47da7931bd125b80de1594b75e5371a81c2c32d0c4a028a5aab0c56a2edf2e0483b87f5ab299dc046076203dea10ccbfc631d5bf4a87ce67004519f248f086346ce6a8a9d181789a59f81d9b7f6781daac3e229914b8b8998c15c3b6302a519331cb05995bc60b7cb872dd3b5b43331c77c5d72e21f7bd2b1a915ff3204e3f20d3a20b22d6a58155b5a4ebf6d1d1cd90c656ecada531c07ff91deb3efa91762cdecfbcc43553750f22ac5c18cc5e8b6f790c2f4e6373af9f98d10e6df49ff8e5cbcbd68e11ed0b967add11410dc2e34f08dbfaf8eb95d4d1153b4c6093192a340eb30fcc71619888c6486746a049585d249efb96b9cace83320b8f96b40ebe3a9a788d05a053380d1026b9434df87a3a387549bcabe88684c4d0948a6e219b5769480e6d0a9bf0da9a5212f3dbc8d1dff240856691243b203d7edd4d3cc89a38a6c80fdb1229a01044af7aaecb20d5570ebf24b30bbc6dfc3f70d85cd9f0d60ebd8fedd161d199d9997a0e2d18d1c99bc7158564e0ddb4673055de196535d706d142e1dc7d404583923cb1b286cfc5418884ac7e605d93652dc48ff8261c63790a91ee2c5ff9a21677b4bc7e73ddf2d0e46807c57bf64b0b9df7fc67ecba6521767dcc7d4299c740e73bc49cbcf0049faf222c48896378497c0a7be6238217f85c83a2c45376ddf1a8f631c22c8cf453e8a4fe7bf8160a82bd069be9a9e163724a7412bbc30b68bb31bd571f0571297726a309691408af62ecfc77ea52718c39e802f00a726aaa625407f3b18fd4f66db2bbd05dfd62e448fc6bb9fc51960e12b67c5d42e82df55f5d87428137874e27db5cc", 0x37d}, {0x0}, {&(0x7f0000002200)="f610e61ac81cc3edc86f0500", 0xc}], 0x3, 0x0, 0x0, 0x900}}], 0x1, 0x0) r0 = socket(0x10, 0x803, 0x0) sendto(r0, &(0x7f00000000c0)="120000001200e7ef007b00000000000000a1", 0x12, 0x0, 0x0, 0x0) recvmmsg(r0, &(0x7f00000037c0)=[{{&(0x7f00000004c0)=@ethernet={0x0, @random}, 0xfdf4, &(0x7f0000000380)=[{&(0x7f0000000000)=""/102, 0x365}, {&(0x7f0000000280)=""/76, 0x14c}, {&(0x7f0000000fc0)=""/4096, 0x197}, {&(0x7f0000000400)=""/92, 0x645}, {&(0x7f0000000980)=""/73, 0x1b}, {&(0x7f0000000200)=""/77, 0x188}, {&(0x7f00000007c0)=""/154, 0x2c}, {&(0x7f00000001c0)=""/17, 0x1d8}], 0x21, &(0x7f0000000600)=""/191, 0x41}}], 0x4000000000003b4, 0x0, &(0x7f0000003700)={0x77359400}) program did not crash replaying the whole log did not cause a kernel crash single: executing 1 programs separately with timeout 1m40s testing program (duration=1m40s, {Threaded:true Repeat:true RepeatTimes:0 Procs:6 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_usb_connect-syz_open_dev$dvb_demux-ioctl$DVB_DEMUX_DMX_SET_PES_FILTER detailed listing: executing program 0: syz_usb_connect(0x0, 0x4b, &(0x7f0000000000)=ANY=[@ANYBLOB="1201000200000040480b051000010102000109023900020100803209040000000000000009"], 0x0) r0 = syz_open_dev$dvb_demux(&(0x7f0000000200), 0x1, 0x2) ioctl$DVB_DEMUX_DMX_SET_PES_FILTER(r0, 0x40146f2c, &(0x7f0000000100)={0x1ff, 0x0, 0x3, 0xa, 0x4}) program did not crash single: failed to extract reproducer bisect: bisecting 50 programs with base timeout 1m40s testing program (duration=1m52s, {Threaded:true Repeat:true RepeatTimes:0 Procs:6 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): [1, 2, 23, 21, 5, 13, 13, 22, 5, 5, 5, 6, 12, 12, 4, 7, 24, 20, 4, 2, 19, 5, 5, 2, 4, 28, 20, 3, 7, 3, 24, 16, 3, 12, 11, 4, 19, 6, 2, 2, 24, 7, 5, 30, 7, 3, 4, 19, 4, 4] detailed listing: executing program 2: syz_mount_image$vfat(&(0x7f0000000000), &(0x7f0000000500)='./file0\x00', 0x2200810, &(0x7f0000000040)=ANY=[@ANYRES64=0x0, @ANYRES16, @ANYRESOCT, @ANYRESHEX, @ANYRESDEC, @ANYRES64], 0x1, 0x265, &(0x7f00000006c0)="$eJzs2k9rXFUYB+D3pimpKenE/7YgHnShboYmaxcNkoI4IGgjVEF6a250yHUm5A6BEbFZKbjq2pVrcelCEKRLN9n4CVzoKpssuxCvJJO0SYxoGscJ9nk288I5P86595w5nMXdfOX2R8tL47GU92Isy2LsSqzH3SymYyz2rMfLL17/8dm3rr/z+lyrNf9mSlfnrs3MppQuPPfDu5988/yd3vm3v73w/URsTL+3uTX7y8ZTGxc3f7/2YbtK7Sp1ur2Up5vdbi+/WRZpsV0tN1O6XRZ5VaR2pypWD7Qvld2VlX7KO4tTkyurRVWlvNNPy0U/9bqpt9pP+Qd5u5OazWaamgxOYuHru3UdW/XZG1HX9SNfxfk7MfVzNCJ7NGWPX8mevJE9vZ5d3KrrxqinylBY/4fbvkP9XET5+drC2sLgd9A+txTtKKOIy9GI32J7m+wa1Fdfa81fTjum47Py1m7+1trCmZ38F3v5mWjE9NH5mUE+HcxPxOT+8We/eyye+HP+1zOt+dkj8+fipRf25ZvRiJ/ej26UsRjb2fvjfzqT0qtvtA7lL+30AwD4v2mme468vzWbf9U+yB/jfnjofjUel8ZH++xEVP2Pl/OyLFYfoJiI46a299Q/6Nx9sPkcq8h2X8Dfd35mbIjTOA3Fl6djGkMqBudY3Fvvf3mIk/6JDhRndzfk3sE4ylc3gsOI/9z9RR/1TAAAAAAAAAAAADiOQx/9NYbxyeGonxEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAADjd/ggAAP//tpTCRA==") executing program 2: r0 = socket$inet(0x2, 0x5, 0x0) setsockopt$IP_VS_SO_SET_DELDEST(r0, 0x0, 0x488, &(0x7f0000000200)={{0x6, @multicast1, 0x4e1f, 0x0, 'rr\x00'}, {@loopback, 0x4e1f, 0x1, 0x1}}, 0x44) executing program 2: socket$nl_route(0x10, 0x3, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000140)={0xa, 0x8b}, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000280)=0x8) r0 = getpid() sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x2) sched_setscheduler(r0, 0x2, &(0x7f0000000200)=0x7) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeea, 0x8031, 0xffffffffffffffff, 0x28f43000) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r1, &(0x7f0000000180)=@abs, 0x6e) sendmmsg$unix(r2, &(0x7f0000000000), 0x651, 0x0) recvmmsg(r1, &(0x7f00000000c0), 0x10106, 0x2, 0x0) mmap$IORING_OFF_SQ_RING(0x110c230000, 0x8000002, 0x2000007, 0x401d031, 0xffffffffffffffff, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./sys\x00', 0x1ff) mount(0x0, &(0x7f0000000040)='./sys\x00', &(0x7f0000000080)='sysfs\x00', 0x0, 0x0) r3 = openat(0xffffffffffffff9c, &(0x7f00000000c0)='./sys/module/usbcore/parameters/quirks\x00', 0x2, 0x0) write(r3, &(0x7f00000005c0)="306663353a313232373a3f7092c0f0bc085a193376cf620afaf6379a248d1d6534058f1095109da34b6d6537a6e78b0dc4b7bc0b", 0x34) r4 = socket$inet_tcp(0x2, 0x1, 0x0) ioctl$sock_SIOCGIFINDEX(r4, 0x8933, &(0x7f0000000180)={'syz_tun\x00'}) mkdirat(0xffffffffffffff9c, &(0x7f0000000080)='./file1\x00', 0x1c0) mkdirat(0xffffffffffffff9c, &(0x7f00000000c0)='./file0\x00', 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000240)='./file2\x00', 0x207) mount$overlay(0x0, &(0x7f0000000100)='./file0\x00', &(0x7f0000000000), 0x0, &(0x7f00000000c0)={[{@workdir={'workdir', 0x3d, './file0'}}, {@lowerdir={'lowerdir', 0x3d, '.'}}, {@upperdir={'upperdir', 0x3d, './file2'}}], [], 0x2c}) fsync(0xffffffffffffffff) executing program 2: r0 = syz_open_procfs(0x0, &(0x7f0000000c80)='fdinfo\x00') mmap(&(0x7f0000000000/0xe7e000)=nil, 0xe7e000, 0xfffffffffffffffe, 0x4031, 0xffffffffffffffff, 0x0) syz_emit_vhci(0x0, 0x4) ioctl$UFFDIO_COPY(0xffffffffffffffff, 0xc028aa03, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000200)={0x8, 0x8a}, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000180)=0x3) r1 = socket$inet_udp(0x2, 0x2, 0x0) setsockopt$IPT_SO_SET_REPLACE(r1, 0x0, 0x40, 0x0, 0x0) sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x2) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) r2 = syz_open_dev$MSR(&(0x7f00000001c0), 0x0, 0x0) read$msr(r2, &(0x7f0000019680)=""/102392, 0x18ff8) socket$igmp(0x2, 0x3, 0x2) getdents64(r0, &(0x7f0000002440)=""/181, 0xb5) mkdir(&(0x7f0000000040)='./file0\x00', 0x0) ioctl(0xffffffffffffffff, 0x890b, 0x0) bpf$MAP_CREATE(0x0, 0x0, 0x50) setns(0xc9, 0x0) r3 = socket$netlink(0x10, 0x3, 0x8) writev(r3, &(0x7f0000000300)=[{&(0x7f0000000080)='X\x00', 0xfdef}], 0x1) sendmsg$kcm(0xffffffffffffffff, &(0x7f0000000600)={0x0, 0x0, &(0x7f00000003c0)=[{0x0}, {&(0x7f0000000000)="11c9064268", 0x5}], 0x2}, 0x40) executing program 2: r0 = socket$inet_sctp(0x2, 0x5, 0x84) setsockopt$IP_VS_SO_SET_ADD(r0, 0x0, 0x482, &(0x7f00000000c0)={0x84, @dev={0xac, 0x14, 0x14, 0x8b}, 0x15, 0x3, 'fo\x00', 0x1, 0x400000, 0x4}, 0x2c) r1 = socket$kcm(0xa, 0x2, 0x0) setsockopt$IP_VS_SO_SET_ADDDEST(r0, 0x0, 0x487, &(0x7f0000000000)={{0x84, @remote, 0x4e21, 0x3, 'wrr\x00', 0x23, 0x81, 0x36}, {@dev={0xac, 0x14, 0x14, 0x40}, 0x4e23, 0x10000, 0x1cb, 0x12d61, 0x12d58}}, 0x44) sendmsg$sock(r1, &(0x7f0000000400)={&(0x7f0000000580)=@in6={0x2, 0x4e22, 0x0, @dev}, 0x80, 0x0, 0x0, &(0x7f0000000000)=[@mark={{0x14, 0x1, 0x24, 0x3}}], 0x18}, 0x0) executing program 2: socket$netlink(0x10, 0x3, 0x0) syz_open_dev$sndpcmp(0x0, 0xfffffffffffffff1, 0x402000) r0 = openat$cgroup_ro(0xffffffffffffffff, &(0x7f0000000000)='cpuacct.usage_sys\x00', 0x0, 0x0) sendmmsg$unix(r0, 0x0, 0x0, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) sched_setattr(0x0, &(0x7f0000000280)={0x38, 0x6, 0x8, 0x3, 0x0, 0x9, 0x1, 0xfffffe0000000001, 0xfa11, 0xffffffff}, 0x0) madvise(&(0x7f0000284000/0x1000)=nil, 0x1000, 0x3) landlock_create_ruleset(0x0, 0x0, 0x0) syz_clone(0x11, 0x0, 0x0, 0x0, 0x0, 0x0) socket$nl_generic(0x10, 0x3, 0x10) r1 = openat$procfs(0xffffffffffffff9c, &(0x7f00000000c0)='/proc/partitions\x00', 0x0, 0x0) r2 = openat$sysctl(0xffffffffffffff9c, &(0x7f0000000040)='/proc/sys/vm/drop_caches\x00', 0x1, 0x0) sendfile(r2, r1, &(0x7f0000002080)=0x58, 0x12) executing program 32: socket$netlink(0x10, 0x3, 0x0) syz_open_dev$sndpcmp(0x0, 0xfffffffffffffff1, 0x402000) r0 = openat$cgroup_ro(0xffffffffffffffff, &(0x7f0000000000)='cpuacct.usage_sys\x00', 0x0, 0x0) sendmmsg$unix(r0, 0x0, 0x0, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) sched_setattr(0x0, &(0x7f0000000280)={0x38, 0x6, 0x8, 0x3, 0x0, 0x9, 0x1, 0xfffffe0000000001, 0xfa11, 0xffffffff}, 0x0) madvise(&(0x7f0000284000/0x1000)=nil, 0x1000, 0x3) landlock_create_ruleset(0x0, 0x0, 0x0) syz_clone(0x11, 0x0, 0x0, 0x0, 0x0, 0x0) socket$nl_generic(0x10, 0x3, 0x10) r1 = openat$procfs(0xffffffffffffff9c, &(0x7f00000000c0)='/proc/partitions\x00', 0x0, 0x0) r2 = openat$sysctl(0xffffffffffffff9c, &(0x7f0000000040)='/proc/sys/vm/drop_caches\x00', 0x1, 0x0) sendfile(r2, r1, &(0x7f0000002080)=0x58, 0x12) executing program 5: prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x1, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000380)={0x8, 0x100008b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000200)=0x5) openat$sequencer(0xffffffffffffff9c, &(0x7f0000000300), 0x80200, 0x0) r0 = syz_open_dev$sndmidi(&(0x7f00000004c0), 0x2, 0x141102) writev(r0, &(0x7f0000000840), 0x0) r1 = socket$unix(0x1, 0x2, 0x0) sendmsg$kcm(0xffffffffffffffff, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)=[{0x0}, {&(0x7f0000000580)="d4fa0c511aad03aa5ed217677bc41c027d9c830c439c7f821ddd78b6915cb170e7603acf9e433c2903bb6773f4b0130668a1e5b5e08d21d0b69c28ca3455aed65855c86f3d1e5789d26375a0d85eaf5e92e19c9affcf76e7a94e76556d2b104ebf645747fadc91460f4b3c94e1a89b51be4a6aa4c65285f988329a8163b69c51b801500a5bacd0463976e2960e2679ef2feee5e6ce6bb78a51fb0e15820d13e4a5aa9e0742a6f8d677ad28fea356657bb550c8311b682d9003c82267a15aa7334bc53b65b9119a1a7d905c7dd365b85c230bbad0d5d0a79819e112637819d9a187cfdf782c6127d2d4281926ab0e22f7346b616fe28ed0b9f4a0c9fdac6d3a90a9c38b5e31448a45546388c95045bc22fe88c43b", 0x114}], 0x2}, 0x0) r2 = syz_genetlink_get_family_id$tipc(&(0x7f0000000040), 0xffffffffffffffff) sendmsg$TIPC_CMD_SET_LINK_PRI(0xffffffffffffffff, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000000080)={0x68, r2, 0x1, 0x0, 0x0, {{}, {0x0, 0x410c}, {0x4c, 0x14, {0xfffffff0, @link='broadcast-link\x00'}}}}, 0x68}}, 0x0) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f00000005c0)={0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x9, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x4}, 0x50) ioctl$sock_SIOCGIFINDEX_80211(r1, 0x8b18, &(0x7f0000000000)={'wlan0\x00'}) r3 = openat$vnet(0xffffffffffffff9c, 0x0, 0x2, 0x0) r4 = openat$tun(0xffffffffffffff9c, &(0x7f0000000080), 0x2, 0x0) ioctl$TUNSETIFF(r4, 0x400454ca, &(0x7f0000000100)={'\x00', 0x1}) ioctl$VHOST_SET_OWNER(r3, 0xaf01, 0x0) syz_open_procfs(0x0, &(0x7f0000000240)='clear_refs\x00') getsockopt$TIPC_DEST_DROPPABLE(0xffffffffffffffff, 0x10f, 0x81, &(0x7f0000000080), &(0x7f00000000c0)=0x4) add_key$user(&(0x7f00000003c0), &(0x7f0000000440), &(0x7f00000000c0), 0xc9, 0xfffffffffffffffd) syz_genetlink_get_family_id$tipc2(&(0x7f0000000400), 0xffffffffffffffff) mkdirat(0xffffffffffffff9c, &(0x7f0000000440)='./mnt\x00', 0x1ff) mount(&(0x7f0000000400), &(0x7f0000000000)='./mnt\x00', &(0x7f0000000480)='ecryptfs\x00', 0x0, &(0x7f0000000500)='ecryptfs_sig=syz,ecryptfs_fnek_sig=syz,ecryptfs_cipher=aes,ecryptfs_key_bytes=16\x00') executing program 5: r0 = socket$inet6_sctp(0xa, 0x5, 0x84) r1 = socket$inet6_sctp(0xa, 0x1, 0x84) getsockopt$inet_sctp6_SCTP_SOCKOPT_CONNECTX3(r1, 0x84, 0x6f, &(0x7f0000000280)={0x0, 0x1c, &(0x7f0000000000)=[@in6={0xa, 0x0, 0x0, @rand_addr=' \x01\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x01', 0x9}]}, 0x0) getsockopt$inet_sctp6_SCTP_MAX_BURST(r1, 0x84, 0x83, &(0x7f0000000000)=@assoc_value={0x0}, &(0x7f0000000300)=0x8) setsockopt$inet_sctp6_SCTP_AUTH_KEY(r0, 0x84, 0x17, &(0x7f0000000ac0)={r2, 0x8, 0x1, 'x'}, 0x9) executing program 5: r0 = bpf$PROG_LOAD(0x5, &(0x7f0000000a40)={0x1, 0x4, &(0x7f0000000300)=ANY=[@ANYBLOB], &(0x7f0000000200)='GPL\x00', 0x0, 0x0, 0x0, 0x41100, 0x0, '\x00', 0x0, @fallback=0x2a, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) r1 = socket$kcm(0x11, 0xa, 0x300) setsockopt$sock_attach_bpf(r1, 0x1, 0x32, &(0x7f0000000040)=r0, 0x4) r2 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPSET_CMD_CREATE(r2, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000480)=ANY=[], 0x4c}}, 0x2) executing program 5: r0 = syz_ublk_setup_io_uring(0x1d, &(0x7f0000000500)={0x0, 0x30b5, 0x0, 0x2, 0x158}, &(0x7f0000000100)=0x0, &(0x7f0000000400)=0x0, &(0x7f0000000140)=0x0) syz_ublk_add_dev(r0, r1, r2, r3, &(0x7f0000000200)={0x2e, 0x14, 0x0, 0xffffffffffffffff, 0xc0207504, 0x0, 0x0, 0x0, 0x0, 0x4, 0x0, 0x0, '\x00', {0xffffffff, 0xffff, 0x40, &(0x7f00000004c0)=@any_dev={0x3, 0xe26, 0x0, 0x0, 0x1000, 0x10000, 0xffffffffffffffff, 0x0, 0x4d}}}, &(0x7f0000000480)=0x0) r5 = dup(0xffffffffffffffff) syz_ublk_setup_queues(r5, r4, &(0x7f0000000180)={0x0, 0x1, 0x0, 0x3, 0x255}, &(0x7f0000000800)=[{0x0, 0x0, 0xffffffffffffffff, {0x0, 0x92e0, 0x400, 0x2100, 0x10000004, 0x0, r5}}, {0x0, 0x0, 0xffffffffffffffff, {0x0, 0x19e0, 0x400, 0x0, 0x146}}, {0x0, 0x0, 0xffffffffffffffff, {0x0, 0xf910, 0x2000, 0x0, 0x801f0, 0x0, r5}}, {0x0, 0x0, 0xffffffffffffffff, {0x0, 0x587e, 0x80, 0x2, 0x367}}], 0x1, &(0x7f0000000340)={0x2e, 0x50, 0x0, 0xffffffffffffffff, 0xc0107520, 0x0, 0x0, 0x0, 0x0, {}, 0x1f, 0x0, '\x00', {0xfff9, 0x1, 0x0, 0x0}}, 0x0) bpf$MAP_CREATE(0x0, &(0x7f0000000340)=@base={0x1f, 0x7fff, 0x10001, 0x80, 0x80, r5, 0x2, '\x00', 0x0, 0xffffffffffffffff, 0x4, 0x3, 0x5}, 0x50) executing program 5: r0 = socket$kcm(0x2, 0x200000000000001, 0x0) sendmsg$inet(r0, &(0x7f0000000080)={&(0x7f0000000340)={0x2, 0x4001, @dev}, 0x10, 0x0}, 0x3000c085) r1 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000280)='hugetlb.1GB.usage_in_bytes\x00', 0x26e1, 0x0) setsockopt$sock_attach_bpf(r0, 0x1, 0x3e, &(0x7f0000000100)=r1, 0x4) sendmsg$kcm(r0, &(0x7f0000002480)={0x0, 0x0, &(0x7f0000001e40)=[{&(0x7f0000000e40)}], 0x1}, 0x10) sendmsg$inet(r0, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)=[{&(0x7f0000000300)="b8", 0x2ee0}], 0x13, 0x0, 0x0, 0x10000000}, 0x12cd) executing program 5: prlimit64(0x0, 0xe, &(0x7f0000000140)={0xa, 0x400000000008d}, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000080)=0x8) getpid() sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x2) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r0, &(0x7f0000000180)=@abs, 0x6e) sendmmsg$unix(r1, &(0x7f0000000000), 0x651, 0x0) recvmmsg(r0, &(0x7f00000000c0), 0x4000087, 0x2, 0x0) r2 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r2, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000000)=@updpolicy={0xb8, 0x13, 0xcb23c9c9931e99e9, 0x0, 0x0, {{@in=@private=0xa010101, @in=@remote, 0x0, 0x400, 0x1000, 0x0, 0x2, 0x20, 0x10, 0x84, 0x0, 0xffffffffffffffff}, {}, {0x0, 0x4000000000000, 0x0, 0xffffffffffffffff}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1}}, 0xb8}}, 0x80) sendmsg$nl_xfrm(r2, &(0x7f0000000480)={0x0, 0x0, &(0x7f0000000800)={&(0x7f0000000000)=ANY=[@ANYBLOB="650100001b"], 0x168}}, 0xc0) executing program 33: prlimit64(0x0, 0xe, &(0x7f0000000140)={0xa, 0x400000000008d}, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000080)=0x8) getpid() sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x2) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r0, &(0x7f0000000180)=@abs, 0x6e) sendmmsg$unix(r1, &(0x7f0000000000), 0x651, 0x0) recvmmsg(r0, &(0x7f00000000c0), 0x4000087, 0x2, 0x0) r2 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r2, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000000)=@updpolicy={0xb8, 0x13, 0xcb23c9c9931e99e9, 0x0, 0x0, {{@in=@private=0xa010101, @in=@remote, 0x0, 0x400, 0x1000, 0x0, 0x2, 0x20, 0x10, 0x84, 0x0, 0xffffffffffffffff}, {}, {0x0, 0x4000000000000, 0x0, 0xffffffffffffffff}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1}}, 0xb8}}, 0x80) sendmsg$nl_xfrm(r2, &(0x7f0000000480)={0x0, 0x0, &(0x7f0000000800)={&(0x7f0000000000)=ANY=[@ANYBLOB="650100001b"], 0x168}}, 0xc0) executing program 3: ioctl$VIDIOC_QUERYSTD(0xffffffffffffffff, 0x8008563f, &(0x7f0000000000)) r0 = syz_usb_connect(0x2, 0xb3, &(0x7f0000000640)=ANY=[@ANYBLOB="12010002ef0201406d0425080001000000010902a1000201008032080b00020e03000009040000000e0100000d240100012700006cdc0201011124020101020000000000000000020d000924030201010001"], &(0x7f0000000a40)={0x0, 0x0, 0x0, 0x0}) syz_usb_control_io$rtl8150(r0, 0x0, &(0x7f00000003c0)={0x2c, &(0x7f00000000c0)=ANY=[], 0x0, 0x0, 0x0, 0x0}) write(0xffffffffffffffff, &(0x7f0000000500)='transport=rdma,nqn=nqn.2014-08.org.n', 0x24) executing program 3: r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000000), 0x40241, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000200)={'syzkaller1\x00', 0xc201}) r1 = socket$kcm(0x2, 0xa, 0x2) ioctl$SIOCSIFHWADDR(r1, 0x8914, &(0x7f0000000180)={'syzkaller1\x00', @link_local={0x1, 0x80, 0xc2, 0x0, 0x0, 0xe}}) r2 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r2, &(0x7f0000000200)={0x0, 0x0, &(0x7f0000000000)={&(0x7f00000009c0)=ANY=[@ANYBLOB="140000001000010000000000000000000000000a20000000000a01020000000000000000010000000900010073797a300000000040000000160a01000900000000000000010000000900010073797a30000000000900020073797a3000000000140003800800014000000000080002400000000048000000160a0101000b000000000000010000000900020073797a30000000000900010073797a30000000001c0003801800"], 0xd0}, 0x1, 0x0, 0x0, 0x24040841}, 0x20048010) write$tun(r0, &(0x7f0000001280)=ANY=[@ANYBLOB="000086dd00001100"], 0xfce) executing program 0: socket$nl_route(0x10, 0x3, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000140)={0xa, 0x8b}, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000280)=0x8) r0 = getpid() sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x2) sched_setscheduler(r0, 0x2, &(0x7f0000000200)=0x7) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeea, 0x8031, 0xffffffffffffffff, 0x28f43000) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r1, &(0x7f0000000180)=@abs, 0x6e) sendmmsg$unix(r2, &(0x7f0000000000), 0x651, 0x0) recvmmsg(r1, &(0x7f00000000c0), 0x10106, 0x2, 0x0) mmap$IORING_OFF_SQ_RING(0x110c230000, 0x8000002, 0x2000007, 0x401d031, 0xffffffffffffffff, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./sys\x00', 0x1ff) mount(0x0, &(0x7f0000000040)='./sys\x00', &(0x7f0000000080)='sysfs\x00', 0x0, 0x0) r3 = openat(0xffffffffffffff9c, 0x0, 0x2, 0x0) write(r3, &(0x7f00000005c0)="306663353a313232373a3f7092c0f0bc085a193376cf620afaf6379a248d1d6534058f1095109da34b6d6537a6e78b0dc4b7bc0b", 0x34) r4 = socket$inet_tcp(0x2, 0x1, 0x0) ioctl$sock_SIOCGIFINDEX(r4, 0x8933, &(0x7f0000000180)={'syz_tun\x00'}) mkdirat(0xffffffffffffff9c, &(0x7f0000000080)='./file1\x00', 0x1c0) mkdirat(0xffffffffffffff9c, &(0x7f00000000c0)='./file0\x00', 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000240)='./file2\x00', 0x207) mount$overlay(0x0, &(0x7f0000000100)='./file0\x00', &(0x7f0000000000), 0x0, &(0x7f00000000c0)={[{@workdir={'workdir', 0x3d, './file0'}}, {@lowerdir={'lowerdir', 0x3d, '.'}}, {@upperdir={'upperdir', 0x3d, './file2'}}], [], 0x2c}) r5 = openat$dir(0xffffffffffffff9c, &(0x7f0000000000)='./file0/file1\x00', 0x20400, 0x20) fsync(r5) executing program 4: r0 = syz_usb_connect(0x0, 0x2d, &(0x7f0000000000)=ANY=[@ANYBLOB="1201000083667d1040206402d14e0102030109021b000100000000090400000190f19c00090584"], 0x0) syz_usb_control_io$hid(r0, 0x0, 0x0) ioctl$sock_FIOGETOWN(0xffffffffffffffff, 0x8903, 0x0) syz_usb_control_io(r0, 0x0, 0x0) syz_usb_control_io(r0, 0x0, 0x0) syz_usb_control_io$cdc_ncm(r0, 0x0, 0x0) syz_usb_control_io$uac2(r0, 0x0, 0x0) munmap(&(0x7f0000001000/0x3000)=nil, 0x3000) add_key$keyring(&(0x7f00000101c0), &(0x7f0000010180)={'syz', 0x1}, 0x0, 0x0, 0xfffffffffffffffd) syz_usb_control_io$uac1(r0, 0x0, 0x0) syz_usb_control_io$hid(r0, 0x0, 0x0) syz_usb_control_io$printer(r0, 0x0, 0x0) r1 = syz_open_dev$I2C(&(0x7f0000000100), 0x2, 0x1) ioctl$I2C_RDWR(r1, 0x707, &(0x7f0000000180)={&(0x7f0000000140)=[{0x7, 0x0, 0x1, &(0x7f0000000080)="ce"}], 0x1}) syz_usb_control_io$lan78xx(r0, 0x0, 0x0) syz_usb_control_io(0xffffffffffffffff, 0x0, 0x0) syz_open_dev$tty1(0xc, 0x4, 0x1) syz_usb_control_io$hid(0xffffffffffffffff, 0x0, 0x0) r2 = seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0x0, &(0x7f00000000c0)={0x1, &(0x7f0000000040)=[{0x6, 0x0, 0x0, 0x7fffffff}]}) close_range(r2, 0xffffffffffffffff, 0x0) executing program 3: r0 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r0, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000001680)=ANY=[@ANYBLOB="140000001000010000000000000000000500000a28000000000a030000000000000000000a00000708000240000000020900010073797a31000000002c000000030a010100000000000000000a0000070900010073797a3100000000090003007379"], 0x7c}, 0x1, 0x0, 0x0, 0x40001}, 0x4040850) sendmsg$NFT_BATCH(r0, &(0x7f0000009b40)={0x0, 0x0, &(0x7f0000009b00)={&(0x7f0000000240)=ANY=[@ANYBLOB="140000001000010000000000000000000500000a48000000030a0fdb00000000000000000a0000050900030073797a30000000000900010073797a310000000014000480080002403cb140bb0800014000000003080005400000000014000000110001"], 0x70}, 0x1, 0x0, 0x0, 0x4000850}, 0x24000840) sendmsg$NFT_BATCH(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000cc0)={&(0x7f00000002c0)={{0x14, 0x10, 0x1, 0x0, 0x0, {0x3}}, [@NFT_MSG_DELCHAIN={0x2c, 0x5, 0xa, 0x101, 0x0, 0x0, {0xa, 0x0, 0xa}, [@NFTA_CHAIN_TABLE={0x9, 0x1, 'syz1\x00'}, @NFTA_CHAIN_HANDLE={0xc, 0x2, 0x1, 0x0, 0x1}]}, @NFT_MSG_DELRULE={0x20, 0x8, 0xa, 0x101, 0x0, 0x0, {0xa, 0x0, 0x9}, [@NFTA_RULE_TABLE={0x9, 0x1, 'syz1\x00'}]}], {0x14}}, 0x74}, 0x1, 0x0, 0x0, 0xb0}, 0x20008890) executing program 0: r0 = socket(0x1e, 0x1, 0x0) sendto$rxrpc(r0, &(0x7f0000000000)="fb5a0c5a28bff4d1eabc9b5e1b002907e42f898086b6bd3a0e8ac1187bc611911486c8bac2fbe135179cc1af68b7b1b77ef66df43b71636ab0f3e86a90855ff090e2ed7b1f446091934082de9b302cdf509d5038867b833afdd95183930c0ab8ccdc74c131f83b97caa6739b434bdf1c", 0x70, 0xc0, &(0x7f0000000100)=@in4={0x21, 0x4, 0x2, 0x10, {0x2, 0x4e21, @multicast1}}, 0x24) executing program 7: socket$inet_smc(0x2b, 0x1, 0x0) socket$inet_udp(0x2, 0x2, 0x0) socket$nl_generic(0x10, 0x3, 0x10) socket$nl_netfilter(0x10, 0x3, 0xc) r0 = bpf$MAP_CREATE(0x0, 0x0, 0x0) bpf$PROG_LOAD(0x5, &(0x7f0000000600)={0x1, 0xf, &(0x7f00000006c0)=@ringbuf={{0x18, 0x0, 0x0, 0x0, 0x107a655, 0x0, 0x0, 0x0, 0x10}, {{0x18, 0x1, 0x1, 0x0, r0}}, {}, [], {{}, {}, {0x85, 0x0, 0x0, 0x85}}}, &(0x7f0000000000)='GPL\x00', 0x0, 0x0, 0x0, 0x41000, 0x8, '\x00', 0x0, @fallback=0x6, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) openat$sndtimer(0xffffffffffffff9c, &(0x7f00000006c0), 0x1a0001) openat$udambuf(0xffffffffffffff9c, &(0x7f0000000480), 0x2) socket(0x400000000010, 0x3, 0x0) openat$sndseq(0xffffffffffffff9c, &(0x7f0000000600), 0x183c81) socket(0x10, 0x3, 0x0) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000140)) r1 = openat$iommufd(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) ioctl$IOMMU_IOAS_ALLOC(r1, 0x3b81, &(0x7f00000003c0)={0xc, 0x0, 0x0}) ioctl$IOMMU_TEST_OP_CREATE_ACCESS(r1, 0x3ba0, &(0x7f0000000340)={0x48, 0x5, r2, 0x0, 0xffffffffffffffff, 0x1}) r3 = openat$rdma_cm(0xffffffffffffff9c, &(0x7f0000000940), 0x2, 0x0) socketpair(0x1, 0x1, 0x0, &(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}) bpf$MAP_UPDATE_ELEM_TAIL_CALL(0x2, &(0x7f00000001c0)={{}, 0x0, &(0x7f0000000100)=r4}, 0x20) writev(r3, &(0x7f0000000040)=[{&(0x7f0000000100), 0x6b82}], 0x2) executing program 6: r0 = socket$inet6_tcp(0xa, 0x1, 0x0) socketpair$tipc(0x1e, 0x1, 0x0, &(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}) sendmsg$tipc(r1, &(0x7f00000003c0)={&(0x7f0000000180), 0x10, &(0x7f0000000380)=[{&(0x7f0000000480)="c3e972bd85a6d84136d6dd55048d3593a74f338ce6772ab9a6f64041c2f6fbbecdc08ebcd3192b6a53662dae7c8e9c665e80a5d0925f728dcac30c29793992e588952653d414cb8ccdabc38767fee819ec5af0c5ee936880fe8549b4ed347779cab4ffd4e0b62c53a1c01db28f2b3f91c34211c9353bc1dece61511917c2245fd66cb8dffeacb4d46d627c97b498bf1ff6b313bfbc9765457c831771d5eec7997ec242e4505f01c1bb3e06", 0xab}, {&(0x7f0000000300)='V', 0x1}, {&(0x7f0000001600)="3eed50d0125719a810f88e3f47186fe4dae74182dfd109a2587c4797410c9b8e39bd3d9aa144d5908647c30c8db69b5c17084c9b1bfbb8680737c4f88abcdbc7d294d72ab1b344270915df9ddf5635644c351c22b29d948ac4106bce7107570beed63077cfbc98ef71699eae65d37724d995b553e7a3ade619b522313ab382caf879feb48942878e605ee3ee2872794e3abe22a3f025068b628a5d92468092a5cc649bbbd978b5772e537939432a502122235ced312dafd108c9ffeb0b38cc16da9418ca01d485a6afb5827da4df6e1121ec307de14bb32b6a977608e4576a998182dd93d592ff43e55bfdbbce23ecd501e43b3e93ef8d9d01711dff54c301e299d3801a3cffe6c9883fbd0e47124dc02569f62d48b878fcb58ce99fcffcd2a5166eff3ad93cf1d137274993d86a3b3730d63ded759f6ca88fa449e5575b15321e5a58a1f888eed7466db4976ce35f6d2efb5ad05d99a66482dc607cb5acb24d326803bd337519cc98103f59c63b5962cd72e4497d1b00817d6e09de70270a09b493c2226617b1c9ef9d506be00d6e07f14633a966f04ecca90fb8d2b963ad6f3817935bd6534fa3da1c5dc468789cbf1192f3c0bff3777f1edd2ada5d35f88f12f29e952c44445ce623509d66811c80a9e0f13ad85aba37d86ff0da4dda601d9e8acb264233bc939fb056316612cff687d5c44157be05bcc88b333ff2a40041d98f1acfe6e2231a84e09bd7a54a0442cf87ce3ee8fd8da39da1862862ae40fc3cb3055c8b70e62f243850707341f51426bb3e71c7a4fffefab060db786000618b05eb087a424a2f30f6a232ff44b605f70ceec0a8f70e37907f6e0bbba21e9d5b7ecb6d287742b75c101ba79525918c3473eae38f3c177249dfa8816661c9921f0b0c858d53ab87c8407b97950c842111002edd1d1e80b801b495da28bcd5409bc971e55dab1857e188ac9728efc8f9a4543945f86ade13b445eacecbbf848a96410ac37c57e3e9e8bc8b8fadd559d225c7468639da2b5d1208558b51e94c14faa7947a7c60e81a96bb5d194cc7289adbc02ebb4b49be1f1efc429db2f9b79b5a22919dba0c35341042c5776942c52365367c4bfc95b42be383cca7107161ded7e851d0126da33d581f1e2b08d0c061e86d31e7a83f9b51c79b4034c7deda7697034e1404c6e8e459f76c2efe64350146c7437ef808e04ca14df5f6f500264fd977272bbf8fc096774e8eb61d0963430751ac1425a073f84346b0eba368cba7fa34adc420800d4f99927280eba199f9695cf88124fafc3a2b1226d2f2ab3ea27c69a127650cf5c725b54c02bd8729033cf699ce7f030f9a3442056244da3cfb61a8126dba11377624f39eb009242152fd7b8b88de7dd86057f29bfcb7b7df0e65e7e9ac9eeaa41afa62743698bff03d5b2d51fb6bca2d92294e8e177cfa3661b26f1c040e9bed983b7bc0aa154eb9c92e4ee25091318c53113a1c23ac62d2d71504cba99041f29a4f332133292cf20abec9222a2acca57cac48fa6c0668ee5eecb494741a64d33b011dcca74696d4614c5b45a5d20983b1708d365ed3ffa60f9161972a611c22642c3c259b41f943f6d7a8b60f284d325e38fe76f0645e069ff70cae38850ccf973193b6232c987df26239a574691f7f07fffa6deae1eb0324fe546573c36f2a2c31cd442517a9b036ae6a2a491e7343864693c107a5dc2585820863c146c1ba6caa4fea9b87d567716f4c8ca1a9d2848055cd750512d3b7415d090019dc8a04a1a1d28931093cd8f00e94c407ca1fa2a5ce903d9df26e008c07cd13afa783220e1bd5e6b60645f3dbb6ecb4156fedafa2dd25498c6a99d94f0b38125ea7741b75109dcac9f80635f79f5c8a0483bb9f05a3a5bf721c7541edb252449f8b13e63c370a6146332f03ca1f1b6fe0bed984f13744bb7fa0fe322e83ddf9ffb2083e94f33604a0a199220c450dad94bf154805e7f9e4350ca2d81adf2978c87dcc8a8a7d56297ec124bfef0d28f35777205e973272c87e01070f14f5b14daa3b5104d9ff6b296c4f16ed49eb42d35e7ba3bccb7a26c33a263df88aadd596e9d9de0abbd4d449df11081f2cd62e1d8962b9b9feb25a3b8e03537d61a61c11ac22b7211d12c84e60a6abcc219e558b2513d8c530b3c7a57cdc47de545aafbb2a13c0e6c75b1b92fa241c713c83a09c92b2b61d565120372a9143415583c9596f27a663d4967cd653b08cebd6cb96c1f0dc80d57267ac9a8281d7149bde880828ee27d69a6818db58320db29d1b044eaf6ab8a5108bc522de406990b5393b1f7e7bab71bf6cf8eed1cd59c7607d662e8b313f5c4fce0f59b1027371381011b63dd5b2b09739082c0d62ffad96e30153a395234937d377c32fe7af82aca3a19d0ebc4a5c5fb5ff190f14d5695c703b571fb4bf03756635cafc6cf6267eab836c347a9d07e8089fc105346934cf3364e5be370b3c42b94bc5ae3d17a817398566a2953251eb91697d67278145df9a4b917bcca1bf211780b22f4caacfcb7604c84f943d05f6fdf8edbd258d7d8dbf84f9d99e57472c5b1c2337d749a1f345e662e2536d23c7a63bbbbf00f8b5b0a2106a0342ab27b9a10b82e82668cd49e0cbb09d7be0217645f1dda3be59c8232fa290d34791cda52aa5b5cec6339ab96a2eb3f5328cc7c0e6717c2824344547a2ed518f6b2b4e4fe5b684596aa6a9d3988fc5d5ff4cb46cec99d951b8386b10949a163af974b7543df97b4882a4ed60e927a1deb67c5f814235bef65fea79a2c712815be7403c93a3707fb90d4604ec3a6a3b0928f253f6ab6bd56c958e026c8c58172c4ac2a3efe2ecd5cea70c8313f9ac2d638bc296ba99e2ca86d2fd06b5402cdcddc3f3c9845d5ae77f6f36963b91e8f6cdccd17abe8d40ed02463af4bb0e496344f350097f1cc13313fa1e172b63556ed2b8a8121c01a5fb343ff7767821626fc49b0d6bd522e1c9bf137d5a5bccb4bc8dbb64c83a82ef6c2894f3896c9f6bf0c3764011d53eeb6db9ea9dae22d3ebcca4942d5828c0bca0d9ea37701d5a06c066ac4fe318e11e9c0d6c658ac810fb5d7836cfffe4ccbb0934e5567d74695980a156d4bf1c18861c5a29ccd349999dc20562d00e1f6c1851ae563541086438d60b975c8ceb466414ff60efa0b2dee790fd0659ffa98b92414c13d5a6825368f56c4984412205041cd8e006c7127d4395ecdffb5addf80ef938ce54a367154c4fc286d5f969325c12b13655a9a956dd3b98281f537e837669fc55d8930676e807aa8cd046e0f4583d59f86cb99f3f7a7ddde1fb39111fdec7677d2fee4b8f4814a5def5ebcc67c653384ce80eaffd880405f7edf8fd3ea049f040595df4a75e2f892e7a85e0ba351fb8d263bfff7168bb85017b360fcd2ba89346682a6ea7ccc46afbdb5ab444e3f477238b2ab503bde914d3cf1789539cde9c0621152cd97bff9f235d88a1ef4ea4309db3a05d401af7fb82784b050ef529dab4f1f003eb29710a962f7538c521e617e2f0efac36182d09985e1d725cc38c3833a53742a02f76fb2854a9e45f0febacf3bda83f11183ef5b9fef02ebcdf56d4104b175bad937d8f61964f97d673577cdcbbb48d8eb62b063ee6563b9ff053719baff871bcd83822d865b2f7ef023076425ac5cd71b1f2309de0c6f14cc9c4d3e8fad945f756a7c8a084ea1bfdf5ac6e740043e7f7bdaca06774b084ae314c2636529d4fdcd965c7f8c07156572620b827d694efdc9d2bfc5aa9391220a83765f2c71fcd48d4acaed60afb53d1013fa3b15e948ec4159f7d130ef85b594018346e99034c18738285223ea53a6b1d5cf11a607de2e19608ba03ec970a915b773824261f3fc931dd6d3b934d89f07baf14776314c3eeb8cd0537ef5736f565fbd14e520d4ab2f77ed9597b76ff91f8d1f99ebd6e473efda7accb273975a06944d1037032129992b994ca791a09b4d83980a1e494b0f97098df5f6fb6bbb02722adb11dc319c565c2c363cbd19d9fb3efb4613b62d6584cd53f7bd80e3e89304f444ce9dd1835661e3bb4de02ccf568a2a5daaf0d56898d4286c3fb62e22af62d7ac318685834467f337561dde2e0c1e2827cdffcf42c17728ee64b3ff4ccc0227590badd0bd7e448b8cca0892d6a5e0130d2ac665f47c6b28daa101c1b319869bdd39fa924d6d9ba7d72feda5f21ac78641c7d4801d41c7879721b3be4dab40d9c4a78552440101f373489cc5240b0144a9ce32691a784b6dfe971a21bb5980ff67da2d1bb90b223c9e192a39c1aeadd1f5c790811079c0b51a97105c99b6f95d71bb3ea47c33d9dcb0a53c929c44499e184a3cd722c908d3b0d157e28ffdeb2ed7192e780d96a7a2f0fd5a87bdc973e049da0caf931f26f5a21813e2e602ceb2259997e0205ce48fd9424bd6d4d75dd4301f429ee30745cd839a40dbeab4c3db2f0f10bbaea071ca41d1392385681730a3678a5f60f604dbe19cb9d7dd234337e327451b8cc65394af399432ef7fc3765d055874ebdca14e5999292d6f72f31e92bacf25db5ef8f5212952c1910de06ddbe1687a0e1837922f2228289916ed3aeb7b9cc24da3ae47139e371930afa6d3573df6732c26c0c7ae06d9cedfa77160711bcb06e6553338deae4c5731cf53cc154113096d02f3036d7d9edfcdc331e4bb860c5208489212e904eab70e7f860b0379895cbdecbf7a0b7a25e5b853c7dbe08a4e296a30afec8cf5a9f6ea4aef32a508655d539a770b21e660c9ee1d7688c56abeb7cf1afccc8d59780cf26312589e0c8e1bc00ad7b1325cd9a5dd69246e0b33407c381ea09265154aec297e4ccdf9785a1042a83e77c13d4ce4360782f2428f9916b5cd123b089eb683d30c1e895b9944aa905a1a5b52301d8cc5e4741834ead6ebdb5dc05c9c49c5e883e99d40b9838037beaf876534d747856103e59caf6266fbbe760b6ef83d004634b74f14f8eb4aef93c4cc9cbbd78d83d532c70feef51ea3f170b25d81a6a9b074bfca7e9b3771bf83517e0dd9d0600f70b86b20f61fe36076f8bada334b2390fa954973bc901619a3cfd039349cb328625f495ab288dbdd6dbfd022c2a83f59e0b998619a12e35891b5ae9e83a71765507b4a571cd2241e5885c705244c1022688bef7c5065fbcf219fc01753adb611b3fbc09403dcb10a4f99d788667eff75fa27074ca8481a633530e26163ccf7dada049d23e717e067b6fa5b2f652bc50abda9e7ccdc5f2f3c35ecc2c4431c819c9691be4422e379750774e9f39dae06f26423c8a4278789c9f3111b43f6dd25b0ad47c4cc5fda3f3ed82079c9366e0adced883488f429c1d7e1b351fd0bb204dd7977ef224c4df6d7a5f7697bc6500a7d03a8a914154779fa7092bf1be6bad4092367ce5d295a5d5d0e7c469f372ca2011d612637025e89f178ae9ada0c5b73bcb7d7c034ff595263cd4216e3c76ba5f3d81932a088a90bf8043e877e299c670ef1622a098d5519d9adc4ee7d4cd00e5934a4375fa83fdb81214b892482b31bdde59a70aaf25cb7f417c3a2a91c4e54b48149f6c41d9d396ee6ff13e3028c64a7c9b1f2e7c6e67184a3d52d6f570db3d225c947423c4c6533f22df57d15c5e5a3183422bd378b06fe4732a9401dcb19840fb8fa5c50a0ff497fef362c507753e46b8881d3e767f3b1d893a3805941c94f2efa05ce34b9ea81d716984af6834230d4707a87089d40779503ee6a9bb245d7d997f14acb80e89731c042bbbbe3dcd05177b0ee0eec23455830ef5b65aca357f2b0b887e0b9821c0", 0x1000}, {&(0x7f0000000340)="b768eb20304f2fdc5a9694a4867840d93170ca1a86406f", 0x17}], 0x4, 0x0, 0x0, 0x8010}, 0x0) sendmmsg(r2, &(0x7f0000005280), 0x4000000000001cd, 0x1008c811) close_range(r0, 0xffffffffffffffff, 0x0) executing program 3: r0 = socket$nl_generic(0x10, 0x3, 0x10) ioctl$sock_SIOCGIFINDEX_80211(r0, 0x8933, &(0x7f00000000c0)={'wlan0\x00', 0x0}) r2 = socket$packet(0x11, 0x2, 0x300) bind$packet(r2, &(0x7f0000000040)={0x11, 0x7, r1}, 0x14) write(r2, 0x0, 0x0) executing program 0: r0 = syz_open_dev$hiddev(&(0x7f00000000c0), 0x0, 0x0) ioctl$HIDIOCSREPORT(r0, 0x81044804, &(0x7f0000000400)={0x1}) executing program 7: fcntl$lock(0xffffffffffffffff, 0x7, &(0x7f0000000040)={0x0, 0x0, 0x8000, 0x3ff}) mprotect(&(0x7f0000000000/0xf000)=nil, 0xf000, 0x9) r0 = socket$netlink(0x10, 0x3, 0x14) ioctl$FIDEDUPERANGE(r0, 0xc0189436, &(0x7f0000000040)=ANY=[]) executing program 0: prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x1, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000380)={0x8, 0x100008b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000200)=0x5) openat$sequencer(0xffffffffffffff9c, &(0x7f0000000300), 0x80200, 0x0) r0 = syz_open_dev$sndmidi(&(0x7f00000004c0), 0x2, 0x141102) writev(r0, &(0x7f0000000840)=[{&(0x7f00000002c0)="94", 0xf000}, {0x0}], 0x2) r1 = socket$unix(0x1, 0x2, 0x0) sendmsg$kcm(0xffffffffffffffff, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)=[{0x0}], 0x1}, 0x0) r2 = syz_genetlink_get_family_id$tipc(&(0x7f0000000040), 0xffffffffffffffff) sendmsg$TIPC_CMD_SET_LINK_PRI(0xffffffffffffffff, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000000080)={0x68, r2, 0x1, 0x0, 0x0, {{}, {0x0, 0x410c}, {0x4c, 0x14, {0xfffffff0, @link='broadcast-link\x00'}}}}, 0x68}}, 0x0) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f00000005c0)={0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x9, 0x0, 0x0, 0x1, 0x0, &(0x7f0000000400)="14", 0x2, 0x0, 0x4}, 0x50) ioctl$sock_SIOCGIFINDEX_80211(r1, 0x8b18, 0x0) r3 = openat$vnet(0xffffffffffffff9c, &(0x7f0000000000), 0x2, 0x0) r4 = openat$tun(0xffffffffffffff9c, &(0x7f0000000080), 0x2, 0x0) ioctl$TUNSETIFF(r4, 0x400454ca, &(0x7f0000000100)={'\x00', 0x1}) ioctl$VHOST_SET_OWNER(r3, 0xaf01, 0x0) r5 = syz_open_procfs(0x0, &(0x7f0000000240)='clear_refs\x00') writev(r5, &(0x7f0000000000)=[{0x0}], 0x1) bpf$BPF_PROG_QUERY(0x10, &(0x7f0000000340)={@fallback=r3, 0x10, 0x1, 0xa43a, &(0x7f0000000180)=[0x0, 0x0, 0x0, 0x0], 0x4, 0x0, &(0x7f00000001c0)=[0x0], 0x0, 0x0, 0x0}, 0x40) ioctl$ifreq_SIOCGIFINDEX_wireguard(r1, 0x8933, &(0x7f0000000440)={'wg0\x00', 0x0}) r8 = bpf$PROG_LOAD_XDP(0x5, &(0x7f00000008c0)={0x6, 0x2, &(0x7f0000000480)=@raw=[@map_idx={0x18, 0x2, 0x5, 0x0, 0xc}], &(0x7f0000000500)='GPL\x00', 0x7, 0x85, &(0x7f00000006c0)=""/133, 0x40f00, 0x0, '\x00', 0x0, 0x25, 0xffffffffffffffff, 0x8, &(0x7f0000000780)={0x9, 0x2}, 0x8, 0x10, &(0x7f00000007c0)={0x4, 0x7, 0x7fffffff, 0x8}, 0x10, 0x0, 0x0, 0x0, &(0x7f0000000800)=[0x1, 0x1], 0x0, 0x10, 0x6}, 0x94) bpf$BPF_PROG_DETACH(0x9, &(0x7f0000000540)=ANY=[@ANYRES32=r7, @ANYRES32=r5, @ANYBLOB="1d0000001000000000000000", @ANYRES32=r8, @ANYBLOB="27983b", @ANYRES64=r6], 0x20) ioctl$VHOST_SET_MEM_TABLE(r3, 0x4008af03, &(0x7f0000000300)) r9 = syz_open_procfs(0x0, &(0x7f0000002500)='net/wireless\x00') read$FUSE(r9, &(0x7f00000046c0)={0x2020}, 0x2021) ioctl$SNDRV_PCM_IOCTL_REWIND(r9, 0x40084146, &(0x7f0000000040)=0x8) ioctl$VHOST_SET_VRING_ADDR(r3, 0x4028af11, &(0x7f0000000400)={0x1, 0x0, 0x0, &(0x7f0000020000), 0x0}) seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0x0, &(0x7f0000000000)={0x1, &(0x7f0000000100)=[{0x6, 0x72, 0x0, 0x7fff0000}]}) executing program 3: syz_open_dev$sg(0x0, 0x8, 0x0) prctl$PR_SET_SECCOMP(0x16, 0x2, &(0x7f0000000300)={0x0, 0x0}) setitimer(0x2, &(0x7f0000000040)={{0x0, 0x2710}, {0x0, 0x2710}}, 0x0) unshare(0x60000600) syz_usb_connect(0x0, 0x36, &(0x7f0000000040)=ANY=[@ANYBLOB="120100004107f540f30c7593de1a000000010902"], 0x0) mremap(&(0x7f0000ffe000/0x1000)=nil, 0x1000, 0x4000, 0x3, &(0x7f0000ff9000/0x4000)=nil) munmap(&(0x7f000045e000/0x1000)=nil, 0x1000) madvise(&(0x7f0000a93000/0x4000)=nil, 0x4000, 0x80000000e) syz_io_uring_setup(0x7a31, &(0x7f0000000080)={0x0, 0x4e36, 0x800, 0x1, 0x2fe}, &(0x7f0000000280), 0x0, 0x0) madvise(&(0x7f0000bdc000/0x4000)=nil, 0x86ac726dff2f4713, 0xa) mremap(&(0x7f00006bd000/0x2000)=nil, 0x2000, 0x4000, 0x3, &(0x7f0000721000/0x4000)=nil) r0 = syz_open_procfs(0xffffffffffffffff, &(0x7f0000000000)='cmdline\x00') preadv(r0, &(0x7f00000001c0)=[{&(0x7f0000000300)=""/147, 0x93}, {&(0x7f00000003c0)=""/118, 0x76}, {&(0x7f0000000600)=""/14, 0xe}], 0x3, 0x7, 0x10000) setsockopt$packet_fanout_data(r0, 0x107, 0x16, &(0x7f0000000180)={0x1, &(0x7f0000000100)=[{0x9, 0xfc, 0x3, 0xa9c}]}, 0x10) munmap(&(0x7f0000a88000/0x1000)=nil, 0x1000) munmap(&(0x7f00003fe000/0xc00000)=nil, 0xc00000) prctl$PR_SET_SYSCALL_USER_DISPATCH_ON(0x3b, 0x1, 0x0, 0x0, &(0x7f0000006680)) unshare(0xa020480) socket$inet(0x2, 0x1, 0x0) openat$nvme_fabrics(0xffffffffffffff9c, &(0x7f0000000040), 0x2, 0x0) executing program 6: r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$tipc2(&(0x7f0000000000), r0) sendmsg$TIPC_NL_KEY_SET(r0, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000280)={&(0x7f0000000040)={0x14, r1, 0x1}, 0x14}}, 0x0) executing program 7: r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000000), 0x40241, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000200)={'syzkaller1\x00', 0xc201}) r1 = socket$kcm(0x2, 0xa, 0x2) ioctl$SIOCSIFHWADDR(r1, 0x8914, &(0x7f0000000180)={'syzkaller1\x00', @link_local={0x1, 0x80, 0xc2, 0x0, 0x0, 0xe}}) r2 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r2, &(0x7f0000000200)={0x0, 0x0, &(0x7f0000000000)={&(0x7f00000009c0)=ANY=[@ANYBLOB="140000001000010000000000000000000000000a20000000000a01020000000000000000010000000900010073797a300000000040000000160a01000900000000000000010000000900010073797a30000000000900020073797a3000000000140003800800014000000000080002400000000048000000160a0101000b000000000000010000000900020073797a30000000000900010073797a30000000001c0003801800"], 0xd0}, 0x1, 0x0, 0x0, 0x24040841}, 0x20048010) write$tun(r0, &(0x7f0000001280)=ANY=[@ANYBLOB="000086dd00001100"], 0xfce) executing program 1: syz_usb_connect(0x0, 0x4b, &(0x7f0000000000)=ANY=[@ANYBLOB="1201000200000040480b051000010102000109023900020100803209040000000000000009"], 0x0) r0 = syz_open_dev$dvb_demux(&(0x7f0000000200), 0x1, 0x2) ioctl$DVB_DEMUX_DMX_SET_PES_FILTER(r0, 0x40146f2c, &(0x7f0000000100)={0x1ff, 0x0, 0x3, 0xa, 0x4}) executing program 6: socket$nl_route(0x10, 0x3, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000140)={0xa, 0x8b}, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000280)=0x8) r0 = getpid() sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x2) sched_setscheduler(r0, 0x2, &(0x7f0000000200)=0x7) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeea, 0x8031, 0xffffffffffffffff, 0x28f43000) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r1, &(0x7f0000000180)=@abs, 0x6e) sendmmsg$unix(r2, &(0x7f0000000000), 0x651, 0x0) recvmmsg(r1, &(0x7f00000000c0), 0x10106, 0x2, 0x0) mmap$IORING_OFF_SQ_RING(0x110c230000, 0x8000002, 0x2000007, 0x401d031, 0xffffffffffffffff, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./sys\x00', 0x1ff) mount(0x0, &(0x7f0000000040)='./sys\x00', &(0x7f0000000080)='sysfs\x00', 0x0, 0x0) r3 = openat(0xffffffffffffff9c, 0x0, 0x2, 0x0) write(r3, &(0x7f00000005c0)="306663353a313232373a3f7092c0f0bc085a193376cf620afaf6379a248d1d6534058f1095109da34b6d6537a6e78b0dc4b7bc0b", 0x34) r4 = socket$inet_tcp(0x2, 0x1, 0x0) ioctl$sock_SIOCGIFINDEX(r4, 0x8933, &(0x7f0000000180)={'syz_tun\x00'}) mkdirat(0xffffffffffffff9c, &(0x7f0000000080)='./file1\x00', 0x1c0) mkdirat(0xffffffffffffff9c, &(0x7f00000000c0)='./file0\x00', 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000240)='./file2\x00', 0x207) mount$overlay(0x0, &(0x7f0000000100)='./file0\x00', &(0x7f0000000000), 0x0, &(0x7f00000000c0)={[{@workdir={'workdir', 0x3d, './file0'}}, {@lowerdir={'lowerdir', 0x3d, '.'}}, {@upperdir={'upperdir', 0x3d, './file2'}}], [], 0x2c}) r5 = openat$dir(0xffffffffffffff9c, &(0x7f0000000000)='./file0/file1\x00', 0x20400, 0x20) fsync(r5) executing program 0: r0 = openat$qrtrtun(0xffffffffffffff9c, &(0x7f0000002740), 0x101002) mmap(&(0x7f0000000000/0xfbe000)=nil, 0xfbe000, 0x2, 0x31, 0xffffffffffffffff, 0x0) r1 = openat$ppp(0xffffffffffffff9c, &(0x7f0000000040), 0x0, 0x0) ioctl$TUNSETOFFLOAD(r1, 0xc004743e, 0x110e22fff6) r2 = socket$kcm(0x2, 0x3, 0x2) ioctl$SIOCSIFHWADDR(r2, 0x8b0f, &(0x7f0000000180)={'virt_wifi0\x00', @dev={'\xaa\xaa\xaa\xaa\xaa', 0x35}}) r3 = openat$ppp(0xffffffffffffff9c, &(0x7f0000000080), 0x1, 0x0) ioctl$TUNSETOFFLOAD(r3, 0x4004743d, 0x110e22fff6) io_setup(0x81, &(0x7f0000001440)=0x0) io_submit(r4, 0x1, &(0x7f00000008c0)=[&(0x7f0000000280)={0x0, 0x0, 0x0, 0x5, 0x800, r3, 0x0, 0x0, 0x0, 0x0, 0x2}]) r5 = openat$sysfs(0xffffffffffffff9c, &(0x7f00000002c0)='/sys/power/resume', 0x149a82, 0x10) write$cgroup_int(r5, &(0x7f0000000000)=0x2b00, 0x12) ioctl$TUNSETIFF(r5, 0x400454ca, &(0x7f0000000000)={'dummy0\x00', 0x8000}) r6 = socket$netlink(0x10, 0x3, 0x0) sendmsg$nl_route(r6, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000180)=ANY=[@ANYBLOB, @ANYRES32=0x0, @ANYBLOB="00000000000000002c00128009000100626f6e64000000001c0002800500"], 0x4c}}, 0x0) close_range(r0, 0xffffffffffffffff, 0x0) executing program 4: r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$ethtool(&(0x7f0000000740), r0) sendmsg$ETHTOOL_MSG_PAUSE_SET(r0, &(0x7f0000000880)={0x0, 0x0, &(0x7f0000000840)={&(0x7f00000012c0)=ANY=[@ANYBLOB='D\x00\x00\x00', @ANYRES16=r1, @ANYBLOB="010029bd7000ffdbdf251600000018000180140002006e657464657673696d3000000000000005000200400000000500020000000000050004"], 0x44}}, 0x0) executing program 1: socket$nl_route(0x10, 0x3, 0x0) socket(0x10, 0x803, 0x0) socket$unix(0x1, 0x2, 0x0) socket$nl_generic(0x10, 0x3, 0x10) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000280)={&(0x7f0000000500)=@newqdisc={0x24, 0x24, 0x400, 0x70bd28, 0x25dfdbfd, {0x0, 0x0, 0x0, 0x0, {0x10, 0xc}, {0x2, 0xe}, {0xfff2, 0x4}}}, 0x24}}, 0x0) r0 = socket$rxrpc(0x21, 0x2, 0xa) sendmsg$IPCTNL_MSG_CT_NEW(0xffffffffffffffff, &(0x7f0000000300)={0x0, 0x0, &(0x7f00000000c0)={0x0}}, 0x0) r1 = socket$netlink(0x10, 0x3, 0x0) r2 = socket$inet6_icmp_raw(0xa, 0x3, 0x3a) ioctl$sock_SIOCGIFINDEX(r2, 0x8933, &(0x7f0000000000)={'bridge0\x00'}) sendmsg$nl_route(0xffffffffffffffff, &(0x7f0000000100)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000080)=ANY=[@ANYBLOB="280000007000010010ab4be68e8da23507000000", @ANYBLOB="100001800400", @ANYRES8=r0], 0x28}}, 0x0) sendmmsg(r1, &(0x7f00000002c0), 0x40000000000009f, 0x0) executing program 6: r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000000), 0x2, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000200)={'syzkaller1\x00', 0x5001}) bpf$PROG_LOAD(0x5, &(0x7f0000000180)={0x5, 0x4, &(0x7f0000000080)=ANY=[@ANYBLOB="b40500000000000069108e0000000000bc0010"], 0x0, 0x5, 0x0, 0x0, 0x0, 0x8}, 0x94) r1 = socket$inet_udp(0x2, 0x2, 0x0) r2 = socket$nl_route(0x10, 0x3, 0x0) r3 = socket$unix(0x1, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r3, 0x8933, 0x0) sendmsg$nl_route_sched(r2, &(0x7f00000012c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f00000000c0)=@newqdisc={0x30, 0x24, 0x601, 0x0, 0x0, {0x0, 0x0, 0x0, 0x0, {}, {0xfff1, 0xffff}}, [@qdisc_kind_options=@q_ingress={0xc}]}, 0x30}}, 0x0) sendmsg$nl_route_sched(r2, &(0x7f0000000580)={0x0, 0x0, &(0x7f0000000300)={&(0x7f0000001300)=@newtfilter={0x80, 0x2c, 0x601, 0x0, 0x0, {0x0, 0x0, 0x0, 0x0, {0xb, 0x7}, {0xfff1, 0xffff}, {0x300}}, [@filter_kind_options=@f_matchall={{0xd}, {0x4c, 0x2, [@TCA_MATCHALL_ACT={0x48, 0x2, [@m_ct={0x44, 0x1, 0x0, 0x0, {{0x7}, {0x1c, 0x2, 0x0, 0x1, [@TCA_CT_PARMS={0x18, 0x1, {0x0, 0x0, 0x3}}]}, {0x4}, {0xc}, {0xc}}}]}]}}]}, 0x80}}, 0x0) ioctl$sock_inet_SIOCSIFFLAGS(r1, 0x8914, &(0x7f0000000200)={'syzkaller1\x00', 0x1}) write$tun(r0, &(0x7f0000000040)=ANY=[@ANYBLOB="03031b003a003200060063"], 0x76) executing program 4: r0 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r0, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000001680)=ANY=[@ANYBLOB="140000001000010000000000000000000500000a28000000000a030000000000000000000a00000708000240000000020900010073797a31000000002c000000030a010100000000000000000a0000070900010073797a3100000000090003007379"], 0x7c}, 0x1, 0x0, 0x0, 0x40001}, 0x4040850) sendmsg$NFT_BATCH(r0, &(0x7f0000009b40)={0x0, 0x0, &(0x7f0000009b00)={&(0x7f0000000240)=ANY=[@ANYBLOB="140000001000010000000000000000000500000a48000000030a0fdb00000000000000000a0000050900030073797a30000000000900010073797a310000000014000480080002403cb140bb0800014000000003080005400000000014000000110001"], 0x70}, 0x1, 0x0, 0x0, 0x4000850}, 0x24000840) sendmsg$NFT_BATCH(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000cc0)={&(0x7f00000002c0)={{0x14, 0x10, 0x1, 0x0, 0x0, {0x3}}, [@NFT_MSG_DELCHAIN={0x2c, 0x5, 0xa, 0x101, 0x0, 0x0, {0xa, 0x0, 0xa}, [@NFTA_CHAIN_TABLE={0x9, 0x1, 'syz1\x00'}, @NFTA_CHAIN_HANDLE={0xc, 0x2, 0x1, 0x0, 0x1}]}, @NFT_MSG_DELRULE={0x20, 0x8, 0xa, 0x101, 0x0, 0x0, {0xa, 0x0, 0x9}, [@NFTA_RULE_TABLE={0x9, 0x1, 'syz1\x00'}]}], {0x14}}, 0x74}, 0x1, 0x0, 0x0, 0xb0}, 0x20008890) executing program 4: socket$inet_smc(0x2b, 0x1, 0x0) socket$inet_udp(0x2, 0x2, 0x0) socket$nl_generic(0x10, 0x3, 0x10) socket$nl_netfilter(0x10, 0x3, 0xc) r0 = bpf$MAP_CREATE(0x0, 0x0, 0x0) bpf$PROG_LOAD(0x5, &(0x7f0000000600)={0x1, 0xf, &(0x7f00000006c0)=@ringbuf={{0x18, 0x0, 0x0, 0x0, 0x107a655, 0x0, 0x0, 0x0, 0x10}, {{0x18, 0x1, 0x1, 0x0, r0}}, {}, [], {{}, {}, {0x85, 0x0, 0x0, 0x85}}}, &(0x7f0000000000)='GPL\x00', 0x0, 0x0, 0x0, 0x41000, 0x8, '\x00', 0x0, @fallback=0x6, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) openat$sndtimer(0xffffffffffffff9c, &(0x7f00000006c0), 0x1a0001) openat$udambuf(0xffffffffffffff9c, &(0x7f0000000480), 0x2) socket(0x400000000010, 0x3, 0x0) openat$sndseq(0xffffffffffffff9c, &(0x7f0000000600), 0x183c81) socket(0x10, 0x3, 0x0) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000140)) r1 = openat$iommufd(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) ioctl$IOMMU_IOAS_ALLOC(r1, 0x3b81, &(0x7f00000003c0)={0xc, 0x0, 0x0}) ioctl$IOMMU_TEST_OP_CREATE_ACCESS(r1, 0x3ba0, &(0x7f0000000340)={0x48, 0x5, r2, 0x0, 0xffffffffffffffff, 0x1}) r3 = openat$rdma_cm(0xffffffffffffff9c, &(0x7f0000000940), 0x2, 0x0) socketpair(0x1, 0x1, 0x0, &(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}) bpf$MAP_UPDATE_ELEM_TAIL_CALL(0x2, &(0x7f00000001c0)={{}, 0x0, &(0x7f0000000100)=r4}, 0x20) writev(r3, &(0x7f0000000040)=[{&(0x7f0000000100), 0x6b82}], 0x2) executing program 1: ioctl$vim2m_VIDIOC_S_FMT(0xffffffffffffffff, 0xc0d05605, 0x0) r0 = userfaultfd(0x801) close_range(0xffffffffffffffff, 0xffffffffffffffff, 0x2) ioctl$UFFDIO_API(r0, 0xc018aa3f, &(0x7f00000000c0)) mprotect(&(0x7f0000000000/0xf000)=nil, 0xf000, 0x1) ioctl$UFFDIO_CONTINUE(r0, 0xc020aa08, &(0x7f0000000080)={{&(0x7f0000400000/0xc00000)=nil, 0xc00000}}) executing program 4: r0 = syz_open_dev$hiddev(&(0x7f00000000c0), 0x0, 0x0) ioctl$HIDIOCSREPORT(r0, 0x81044804, &(0x7f0000000400)={0x1}) executing program 7: r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f00000018c0)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000001900)=ANY=[@ANYBLOB="280000001e0001"], 0x28}}, 0x0) executing program 1: ioctl$SNDRV_CTL_IOCTL_ELEM_WRITE(0xffffffffffffffff, 0xc1105518, &(0x7f0000000040)={{0x0, 0x0, 0x0, 0x0, 'syz0\x00'}, 0x1, [0x4, 0x3, 0xfffffffffffffffe, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x801, 0x0, 0x0, 0xfffffffffffffffe, 0x0, 0x40000000, 0x0, 0x0, 0x0, 0x0, 0x2d8, 0x0, 0x470, 0xa7, 0x8, 0x8000000000000000, 0x0, 0xfffffffffffffffe, 0x9, 0x0, 0x2, 0x0, 0xfffffffa, 0x3, 0xfffffffffffffffe, 0x0, 0x400, 0x0, 0x0, 0x0, 0x2, 0x3, 0x7, 0x1, 0x0, 0x8000, 0x7, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4, 0x0, 0x0, 0x4, 0x4, 0x0, 0x0, 0xfffffffffffffffc, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x0, 0x8, 0xf5, 0x0, 0x4, 0x0, 0xd318, 0x2000000000, 0x0, 0x4, 0x0, 0x1000000000000000, 0x0, 0x0, 0xfffffffffffffffc, 0xffffffffffffffff, 0x0, 0xfffffffffffffffc, 0x0, 0x6, 0x0, 0xfffffffd, 0x8, 0x7, 0x6, 0x800000, 0x0, 0x101, 0x272f, 0xd721, 0x0, 0x4, 0x0, 0xffffffffffffffff, 0x1, 0xfffffffffffffffd, 0x0, 0x0, 0x0, 0x1, 0x4, 0x5, 0x1, 0x4000000, 0x5, 0x0, 0xdc5d, 0x0, 0x0, 0x1000, 0x0, 0x0, 0x0, 0x4000000000006fd, 0x0, 0x6, 0x0, 0x0, 0x0, 0x100]}) r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000140), 0x40241, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000000)={'syzkaller1\x00', 0xc201}) r1 = socket$kcm(0x2, 0xa, 0x2) ioctl$SIOCSIFHWADDR(r1, 0x8914, &(0x7f0000000080)={'syzkaller1\x00', @link_local={0x1, 0x80, 0xc2, 0x0, 0x0, 0x1c}}) write$tun(r0, 0x0, 0xfdef) openat$iommufd(0xffffffffffffff9c, 0x0, 0x0, 0x0) fstat(0xffffffffffffffff, 0x0) r2 = syz_open_dev$usbfs(&(0x7f0000000240), 0xb, 0x101301) r3 = socket$nl_generic(0x10, 0x3, 0x10) setsockopt$inet_sctp_SCTP_DEFAULT_SEND_PARAM(0xffffffffffffffff, 0x84, 0xa, &(0x7f00000001c0)={0x8, 0x6, 0x6, 0x0, 0x2, 0x5775d27c, 0x158, 0x20100}, 0x20) sendmsg$nl_generic(r3, &(0x7f0000000100)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000180)=ANY=[@ANYBLOB="4800000041000501010000000000000001010000000000001c0001000600060008000000100007007f0000017f000001910040001400020010000c00040006"], 0x48}, 0x1, 0x0, 0x0, 0x2c048040}, 0xe800) ioctl$USBDEVFS_IOCTL(r2, 0xc0105512, &(0x7f0000000200)) ioctl$USBDEVFS_GET_SPEED(r2, 0x551f) ioctl$USBDEVFS_IOCTL(r2, 0x80045505, &(0x7f0000000040)=@usbdevfs_connect) ioctl$USBDEVFS_CLAIM_PORT(r2, 0x80045518, 0x0) r4 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000040)='memory.events\x00', 0x275a, 0x0) syz_open_dev$mtd(&(0x7f0000000240), 0x0, 0x82000) write$tun(r4, &(0x7f0000000340)=ANY=[], 0x141) r5 = openat$userio(0xffffffffffffff9c, &(0x7f0000000300), 0x22242, 0x0) write$USERIO_CMD_REGISTER(r5, &(0x7f00000000c0), 0x2) mmap(&(0x7f0000000000/0x4000)=nil, 0x4000, 0x1, 0x10012, r4, 0x0) syz_clone3(&(0x7f0000000280)={0x84000000, &(0x7f0000000000), &(0x7f0000000080), &(0x7f00000000c0)=0x0, {0x1f}, &(0x7f0000000100)=""/36, 0x24, &(0x7f0000000140)=""/22, &(0x7f0000000180)=[0xffffffffffffffff, 0x0, 0x0], 0x3}, 0x58) ioctl$BLKTRACESETUP(r4, 0xc0481273, &(0x7f0000000300)={'\x00', 0x4, 0x8, 0x5, 0x2, 0xd, r6}) executing program 4: r0 = syz_usb_connect(0x0, 0x39, &(0x7f0000000100)=ANY=[], 0x0) syz_usb_disconnect(r0) r1 = syz_usb_connect(0x0, 0x3f, &(0x7f0000000540)=ANY=[], 0x0) syz_usb_control_io(r1, 0x0, 0x0) syz_usb_control_io$printer(r1, 0x0, 0x0) r2 = syz_open_dev$char_usb(0xc, 0xb4, 0x0) ioctl$EVIOCGMASK(r2, 0x5b03, 0x0) executing program 7: r0 = syz_open_dev$vim2m(&(0x7f0000000100), 0x0, 0x2) ioctl$vim2m_VIDIOC_STREAMOFF(r0, 0x40045612, &(0x7f0000000040)=0x1) ioctl$vim2m_VIDIOC_QBUF(r0, 0xc058560f, &(0x7f0000000180)=@mmap={0x1, 0x1, 0x4, 0x100, 0x81, {}, {0x4, 0x8, 0x8, 0x5, 0x29, 0x9, "0adb3fb8"}, 0x3}) write$uinput_user_dev(0xffffffffffffffff, &(0x7f0000000400)={'syz0\x00', {0x3, 0x2, 0x6, 0xfffa}, 0x3a, [0x8001, 0xc95a, 0xf, 0x8, 0x80, 0x2, 0x7, 0x7f, 0xa9, 0x4d, 0x6, 0x5f, 0x9, 0x15, 0xffff2d37, 0xff7fff01, 0x6, 0x5, 0x7, 0x5, 0x4, 0x0, 0x7, 0x3c5b, 0x1, 0x20, 0xd, 0x1, 0x0, 0xffffffff, 0xe661, 0x6, 0x7, 0x5, 0x8, 0x4c74, 0xffff7fff, 0x7, 0x3, 0xe, 0x0, 0x80008071, 0x7, 0x17, 0xffffffff, 0x7, 0x5, 0x80003e, 0x18e, 0x6, 0x6, 0x0, 0x8, 0x4, 0x8, 0x3ff, 0x80, 0x0, 0x5, 0x6, 0x8, 0x7, 0x1, 0x40], [0x10000007, 0x9, 0x8000012f, 0x8004, 0x5, 0xfffffff3, 0x129432f6, 0xc8, 0xf1, 0xe, 0x2bf, 0x6c7, 0x2009, 0xfffffffc, 0x573a, 0x0, 0x0, 0x5, 0x2f, 0x8, 0x312, 0x66abcbd2, 0xea4, 0x0, 0x4, 0x1007, 0x7fff, 0x6, 0x400, 0x401, 0x6, 0x1, 0xff, 0x7, 0x1000005, 0x5f31, 0xd, 0x4e0, 0x381, 0x4, 0xb, 0x4, 0x9, 0x8, 0x40, 0x6, 0x47, 0x8000, 0x1, 0xfe000000, 0xffff, 0x2, 0x4, 0x200009, 0x3, 0x3, 0x4000009, 0x6, 0x0, 0x3, 0xbc45, 0x48c93690, 0x42, 0x3], [0x6, 0x40a, 0x3ff, 0x5, 0xfffffffd, 0x100, 0x5, 0x9, 0x5, 0x7fff, 0x0, 0x5, 0xb, 0x4, 0x5, 0x5, 0x0, 0x1ef, 0x3, 0x8, 0x86, 0x1000515, 0x303c, 0x3e7, 0xb, 0x5, 0x2, 0x2, 0x3, 0x20000008, 0x4, 0x6cff, 0x6, 0x20000038, 0x200, 0x1fd, 0x80, 0x7, 0x4, 0x2950bfaf, 0x1000, 0xa2, 0x7, 0xcc, 0x5, 0x6, 0xac8, 0xbf, 0x2, 0x3, 0x7ff, 0x12b, 0x4, 0x1, 0xa, 0xffffffff, 0x5, 0x1c, 0x120000, 0x7ef, 0x2006, 0x80a2cd, 0x4, 0x25], [0xc, 0xbb33, 0x7, 0xb, 0x5, 0x938, 0x6, 0x6, 0x0, 0xb9, 0xce4, 0x1ff, 0x2, 0x57, 0x5, 0x3, 0x2, 0x10000, 0x4, 0x7fff, 0xfff4, 0xa620, 0x1, 0x5, 0x801, 0x2000002, 0x150, 0x60a7, 0x6, 0x16, 0xffffffff, 0x8, 0x4, 0x5, 0xca, 0x1, 0xfffff000, 0x10000, 0xf, 0x7e, 0x9, 0x9622, 0x7, 0xaf, 0x20000008, 0x5, 0x226, 0x2, 0x5, 0x0, 0x30b1d693, 0xa1f, 0xf40, 0x7, 0x530e, 0xe1c4, 0x0, 0x0, 0x5, 0x7ff, 0xd7, 0x200, 0xb, 0xfff]}, 0x45c) ppoll(&(0x7f00000000c0)=[{}, {}], 0x20000000000000dc, 0x0, 0x0, 0x0) executing program 7: bpf$MAP_CREATE(0x0, &(0x7f0000000080)=ANY=[], 0x50) bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x0, 0xc, 0x0, 0x0, 0xfffffffd, 0x0, 0x0, 0x0, 0x40, '\x00', 0x0, @fallback=0x10, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) socket(0x10, 0x803, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x1, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000380)={0xa, 0x100008b}, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000200)=0x8) openat$sequencer(0xffffffffffffff9c, &(0x7f00000001c0), 0x80200, 0x0) r0 = syz_open_dev$sndmidi(&(0x7f00000004c0), 0x2, 0x141102) writev(r0, &(0x7f0000000840)=[{&(0x7f00000002c0)="94", 0xf000}, {0x0}], 0x2) ioctl$sock_SIOCGIFINDEX(0xffffffffffffffff, 0x8933, 0x0) r1 = socket$kcm(0xa, 0x3, 0x3a) r2 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r2, &(0x7f0000000480)={0x0, 0x0, &(0x7f0000001f40)={&(0x7f00000004c0)=ANY=[@ANYBLOB="fc000000190001002dbd700000000000ac1e0001000000000000000000000000ac1414aa00"/48, @ANYRES32=0x0, @ANYRES32, @ANYBLOB="00000000000000000c00000000000000000000000000000000000000000000000000000000000000ffffffffffffffff000000000000000000000000000000000000000000000000000a000000000000feffffffff7f40000200000000000008ffffffff00000000010006000000000044000500ac1414bb000000000000000000000000000000003c0000000200000000000000000000000000000000000001060000"], 0xfc}, 0x1, 0x0, 0x0, 0x4008000}, 0x600c010) sendmsg$kcm(r1, &(0x7f0000000080)={&(0x7f0000000000)=@l2tp6={0xa, 0x0, 0x0, @loopback={0xfe80000000000000, 0xac14140c}}, 0x80, &(0x7f00000000c0)=[{&(0x7f0000000140)='\x00\x00', 0xffe3}], 0x1, 0x0, 0x0, 0x900}, 0x60) setsockopt$IPT_SO_SET_REPLACE(0xffffffffffffffff, 0x0, 0x40, 0x0, 0x0) syz_usb_connect(0x3, 0x57, &(0x7f0000000000)=ANY=[@ANYBLOB="1201000200000040402001c60100000000010902450001010080fa0904"], 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000340)='./file1\x00', 0x0) mkdirat(0xffffffffffffff9c, &(0x7f00000000c0)='./bus\x00', 0x1d7) mkdirat(0xffffffffffffff9c, &(0x7f0000000400)='./file1/file0\x00', 0x100) mount$bind(&(0x7f0000000100)='.\x00', &(0x7f0000000080)='./file1/file0\x00', 0x0, 0x1085408, 0x0) r3 = openat$sw_sync(0xffffffffffffff9c, &(0x7f0000000ac0), 0x800, 0x0) ioctl$SW_SYNC_IOC_CREATE_FENCE(r3, 0xc0285700, &(0x7f0000000b00)={0x4, "abacd211119ca94c63377526aeb5ab2c7b9ca5fa07558139ede6dc06270ee042", 0xffffffffffffffff}) ioctl$SYNC_IOC_MERGE(r4, 0xc0303e03, &(0x7f0000000780)={"d1ed39d88b014076ab94c1fb10628c46d2e66ccdb9e581a38ebb0ddd5f307e56", 0xffffffffffffffff, 0xffffffffffffffff}) ioctl$SYNC_IOC_FILE_INFO(r5, 0xc0383e04, 0x0) mount$overlay(0x0, &(0x7f00000000c0)='./bus\x00', &(0x7f00000003c0), 0x40, &(0x7f0000000300)={[{@workdir={'workdir', 0x3d, './bus'}}, {@upperdir={'upperdir', 0x3d, './file1'}}]}) bpf$PROG_LOAD(0x5, 0x0, 0x0) r6 = syz_usb_connect$hid(0x1, 0x36, &(0x7f0000000040)=ANY=[@ANYBLOB="12010000090024206d041cc340000000000109022400010000a00009040000010301010009"], 0x0) r7 = syz_open_procfs(0xffffffffffffffff, &(0x7f0000000080)='stat\x00') read$FUSE(r7, &(0x7f0000004180)={0x2020}, 0x2020) syz_usb_control_io$hid(r6, &(0x7f0000000240)={0x24, &(0x7f00000003c0)=ANY=[@ANYBLOB="00000c000000070001"], 0x0, 0x0, 0x0}, 0x0) executing program 6: r0 = socket$packet(0x11, 0x2, 0x300) setsockopt$SO_ATTACH_FILTER(r0, 0x1, 0x1a, &(0x7f0000000100)={0x2, &(0x7f0000000040)=[{0x0, 0x0, 0xfd, 0xc8e}, {0x16, 0xff, 0x6, 0x6}]}, 0x10) setsockopt$packet_fanout(r0, 0x107, 0x12, 0x0, 0x0) r1 = socket$inet_udp(0x2, 0x2, 0x0) bind$inet(r1, &(0x7f0000000140)={0x2, 0x80, @dev={0xac, 0x14, 0x14, 0xf}}, 0x10) sendmmsg$inet(r1, &(0x7f0000000c00)=[{{&(0x7f0000010940)={0x2, 0x4e22, @multicast2}, 0x10, 0x0}}], 0x1, 0x2000c044) sendto$inet(r1, &(0x7f0000000c80)="e8", 0x6200, 0x0, 0x0, 0x0) executing program 6: syz_usb_connect(0x0, 0x4b, &(0x7f0000000000)=ANY=[@ANYBLOB="1201000200000040480b051000010102000109023900020100803209040000000000000009"], 0x0) r0 = syz_open_dev$dvb_demux(&(0x7f0000000200), 0x1, 0x2) ioctl$DVB_DEMUX_DMX_SET_PES_FILTER(r0, 0x40146f2c, &(0x7f0000000100)={0x1ff, 0x0, 0x3, 0xa, 0x4}) executing program 3: ioctl$VIDIOC_QUERYSTD(0xffffffffffffffff, 0x8008563f, &(0x7f0000000000)) r0 = syz_usb_connect(0x2, 0xb3, &(0x7f0000000640)=ANY=[@ANYBLOB="12010002ef0201406d0425080001000000010902a1000201008032080b00020e03000009040000000e0100000d240100012700006cdc0201011124020101020000000000000000020d000924030201010001"], &(0x7f0000000a40)={0x0, 0x0, 0x0, 0x0}) syz_usb_control_io$rtl8150(r0, 0x0, &(0x7f00000003c0)={0x2c, &(0x7f00000000c0)=ANY=[], 0x0, 0x0, 0x0, 0x0}) write(0xffffffffffffffff, &(0x7f0000000500)='transport=rdma,nqn=nqn.2014-08.org.nvmexpress:NVMf:uui', 0x36) executing program 0: socket$can_raw(0x1d, 0x3, 0x1) socket(0x18, 0x80000, 0x1) socket$key(0xf, 0x3, 0x2) syz_open_procfs$namespace(0x0, &(0x7f0000000280)='ns/ipc\x00') syz_open_procfs$namespace(0x0, &(0x7f0000000040)='ns/ipc\x00') socket$inet_udp(0x2, 0x2, 0x0) syz_open_dev$vim2m(&(0x7f0000000080), 0x7, 0x2) socket$inet_icmp_raw(0x2, 0x3, 0x1) bpf$PROG_LOAD(0x5, &(0x7f0000000000)={0x13, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x40, '\x00', 0x0, @fallback=0x2e, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0x1}, 0x94) socket$netlink(0x10, 0x3, 0x0) openat$rdma_cm(0xffffffffffffff9c, &(0x7f0000000180), 0x2, 0x0) socket$nl_xfrm(0x10, 0x3, 0x6) mkdirat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000)='./cgroup/syz0\x00', 0x1ff) openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000), 0x200002, 0x0) r0 = epoll_create1(0x0) socket$nl_route(0x10, 0x3, 0x0) r1 = socket$netlink(0x10, 0x3, 0x0) sendmsg$nl_route(0xffffffffffffffff, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000000080)=ANY=[@ANYBLOB="540000001000010400000000000000ffff000000", @ANYRES32=0x0, @ANYBLOB="0380000000000000240012800c0001006d6163766c616e00140002800800010008000000060002000100000008000500", @ANYRES32=r0, @ANYBLOB='\b\x00\n\x00', @ANYRES8=r1], 0x54}, 0x1, 0x0, 0x0, 0x4000085}, 0x0) sendmmsg(r1, &(0x7f00000002c0), 0x40000000000009f, 0x20) executing program 1: r0 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r0, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000001680)=ANY=[@ANYBLOB="140000001000010000000000000000000500000a28000000000a030000000000000000000a00000708000240000000020900010073797a31000000002c000000030a010100000000000000000a0000070900010073797a31000000000900030073797a320000000014"], 0x7c}, 0x1, 0x0, 0x0, 0x40001}, 0x4040850) sendmsg$NFT_BATCH(r0, &(0x7f0000009b40)={0x0, 0x0, &(0x7f0000009b00)={&(0x7f0000000240)=ANY=[@ANYBLOB="140000001000010000000000000000000500000a48000000030a0fdb00000000000000000a0000050900030073797a30000000000900010073797a310000000014000480080002403cb140bb0800014000000003080005400000000014000000110001"], 0x70}, 0x1, 0x0, 0x0, 0x4000850}, 0x24000840) sendmsg$NFT_BATCH(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000cc0)={&(0x7f00000002c0)={{0x14, 0x10, 0x1, 0x0, 0x0, {0x3}}, [@NFT_MSG_DELCHAIN={0x2c, 0x5, 0xa, 0x101, 0x0, 0x0, {0xa, 0x0, 0xa}, [@NFTA_CHAIN_TABLE={0x9, 0x1, 'syz1\x00'}, @NFTA_CHAIN_HANDLE={0xc, 0x2, 0x1, 0x0, 0x1}]}, @NFT_MSG_DELRULE={0x20, 0x8, 0xa, 0x101, 0x0, 0x0, {0xa, 0x0, 0x9}, [@NFTA_RULE_TABLE={0x9, 0x1, 'syz1\x00'}]}], {0x14}}, 0x74}, 0x1, 0x0, 0x0, 0xb0}, 0x20008890) executing program 1: sendmmsg$inet(0xffffffffffffffff, &(0x7f0000002140)=[{{0x0, 0x0, &(0x7f0000000540)=[{&(0x7f0000002280)="21ae1baf930b4569b9ddef9797ffd935c7d80e6466b3e4e62dd4603583f5d4b61fbc65b6ac744d7319535e75bf552062e4cfde1ba7ce29263322e18ea9740aa89f69c47a63133708cda00d2b1f4e799bd41e3f76258180fa91a42aaa8b1ebc4e0ea8fb12f2c71e6e5bc57a8e91f254005514721d93c13c5606ae1fea7f31f558d562bd5a8dfb0b9fed873efa221fccffa84fcd374c92e6cbb03e6a9de890ce323f000000abcc6c01326d588495b7c1a7db31ec4129e6336f26bb9e0b7552af3cd2d5dda1632799bbc98425c433384d8a8e4071ff39a36dfde5f05af35a4ddd340cfecd7ec935f4ce7d3e851583ba1cf53a90a7f7bce5703de57ce93ddef7849b30a01de0637e6d5e507b801d32e582e0c2d564539ebfc84c098a23e765552767b122885fb1629e9c180be47da7931bd125b80de1594b75e5371a81c2c32d0c4a028a5aab0c56a2edf2e0483b87f5ab299dc046076203dea10ccbfc631d5bf4a87ce67004519f248f086346ce6a8a9d181789a59f81d9b7f6781daac3e229914b8b8998c15c3b6302a519331cb05995bc60b7cb872dd3b5b43331c77c5d72e21f7bd2b1a915ff3204e3f20d3a20b22d6a58155b5a4ebf6d1d1cd90c656ecada531c07ff91deb3efa91762cdecfbcc43553750f22ac5c18cc5e8b6f790c2f4e6373af9f98d10e6df49ff8e5cbcbd68e11ed0b967add11410dc2e34f08dbfaf8eb95d4d1153b4c6093192a340eb30fcc71619888c6486746a049585d249efb96b9cace83320b8f96b40ebe3a9a788d05a053380d1026b9434df87a3a387549bcabe88684c4d0948a6e219b5769480e6d0a9bf0da9a5212f3dbc8d1dff240856691243b203d7edd4d3cc89a38a6c80fdb1229a01044af7aaecb20d5570ebf24b30bbc6dfc3f70d85cd9f0d60ebd8fedd161d199d9997a0e2d18d1c99bc7158564e0ddb4673055de196535d706d142e1dc7d404583923cb1b286cfc5418884ac7e605d93652dc48ff8261c63790a91ee2c5ff9a21677b4bc7e73ddf2d0e46807c57bf64b0b9df7fc67ecba6521767dcc7d4299c740e73bc49cbcf0049faf222c48896378497c0a7be6238217f85c83a2c45376ddf1a8f631c22c8cf453e8a4fe7bf8160a82bd069be9a9e163724a7412bbc30b68bb31bd571f0571297726a309691408af62ecfc77ea52718c39e802f00a726aaa625407f3b18fd4f66db2bbd05dfd62e448fc6bb9fc51960e12b67c5d42e82df55f5d87428137874e27db5cc", 0x37d}, {0x0}, {&(0x7f0000002200)="f610e61ac81cc3edc86f0500", 0xc}], 0x3, 0x0, 0x0, 0x900}}], 0x1, 0x0) r0 = socket(0x10, 0x803, 0x0) sendto(r0, &(0x7f00000000c0)="120000001200e7ef007b00000000000000a1", 0x12, 0x0, 0x0, 0x0) recvmmsg(r0, &(0x7f00000037c0)=[{{&(0x7f00000004c0)=@ethernet={0x0, @random}, 0xfdf4, &(0x7f0000000380)=[{&(0x7f0000000000)=""/102, 0x365}, {&(0x7f0000000280)=""/76, 0x14c}, {&(0x7f0000000fc0)=""/4096, 0x197}, {&(0x7f0000000400)=""/92, 0x645}, {&(0x7f0000000980)=""/73, 0x1b}, {&(0x7f0000000200)=""/77, 0x188}, {&(0x7f00000007c0)=""/154, 0x2c}, {&(0x7f00000001c0)=""/17, 0x1d8}], 0x21, &(0x7f0000000600)=""/191, 0x41}}], 0x4000000000003b4, 0x0, &(0x7f0000003700)={0x77359400}) program did not crash replaying the whole log did not cause a kernel crash single: executing 1 programs separately with timeout 6m0s testing program (duration=6m0s, {Threaded:true Repeat:true RepeatTimes:0 Procs:6 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_usb_connect-syz_open_dev$dvb_demux-ioctl$DVB_DEMUX_DMX_SET_PES_FILTER detailed listing: executing program 0: syz_usb_connect(0x0, 0x4b, &(0x7f0000000000)=ANY=[@ANYBLOB="1201000200000040480b051000010102000109023900020100803209040000000000000009"], 0x0) r0 = syz_open_dev$dvb_demux(&(0x7f0000000200), 0x1, 0x2) ioctl$DVB_DEMUX_DMX_SET_PES_FILTER(r0, 0x40146f2c, &(0x7f0000000100)={0x1ff, 0x0, 0x3, 0xa, 0x4}) program did not crash single: failed to extract reproducer bisect: bisecting 50 programs with base timeout 6m0s testing program (duration=6m12s, {Threaded:true Repeat:true RepeatTimes:0 Procs:6 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): [1, 2, 23, 21, 5, 13, 13, 22, 5, 5, 5, 6, 12, 12, 4, 7, 24, 20, 4, 2, 19, 5, 5, 2, 4, 28, 20, 3, 7, 3, 24, 16, 3, 12, 11, 4, 19, 6, 2, 2, 24, 7, 5, 30, 7, 3, 4, 19, 4, 4] detailed listing: executing program 2: syz_mount_image$vfat(&(0x7f0000000000), &(0x7f0000000500)='./file0\x00', 0x2200810, &(0x7f0000000040)=ANY=[@ANYRES64=0x0, @ANYRES16, @ANYRESOCT, @ANYRESHEX, @ANYRESDEC, @ANYRES64], 0x1, 0x265, &(0x7f00000006c0)="$eJzs2k9rXFUYB+D3pimpKenE/7YgHnShboYmaxcNkoI4IGgjVEF6a250yHUm5A6BEbFZKbjq2pVrcelCEKRLN9n4CVzoKpssuxCvJJO0SYxoGscJ9nk288I5P86595w5nMXdfOX2R8tL47GU92Isy2LsSqzH3SymYyz2rMfLL17/8dm3rr/z+lyrNf9mSlfnrs3MppQuPPfDu5988/yd3vm3v73w/URsTL+3uTX7y8ZTGxc3f7/2YbtK7Sp1ur2Up5vdbi+/WRZpsV0tN1O6XRZ5VaR2pypWD7Qvld2VlX7KO4tTkyurRVWlvNNPy0U/9bqpt9pP+Qd5u5OazWaamgxOYuHru3UdW/XZG1HX9SNfxfk7MfVzNCJ7NGWPX8mevJE9vZ5d3KrrxqinylBY/4fbvkP9XET5+drC2sLgd9A+txTtKKOIy9GI32J7m+wa1Fdfa81fTjum47Py1m7+1trCmZ38F3v5mWjE9NH5mUE+HcxPxOT+8We/eyye+HP+1zOt+dkj8+fipRf25ZvRiJ/ej26UsRjb2fvjfzqT0qtvtA7lL+30AwD4v2mme468vzWbf9U+yB/jfnjofjUel8ZH++xEVP2Pl/OyLFYfoJiI46a299Q/6Nx9sPkcq8h2X8Dfd35mbIjTOA3Fl6djGkMqBudY3Fvvf3mIk/6JDhRndzfk3sE4ylc3gsOI/9z9RR/1TAAAAAAAAAAAADiOQx/9NYbxyeGonxEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAADjd/ggAAP//tpTCRA==") executing program 2: r0 = socket$inet(0x2, 0x5, 0x0) setsockopt$IP_VS_SO_SET_DELDEST(r0, 0x0, 0x488, &(0x7f0000000200)={{0x6, @multicast1, 0x4e1f, 0x0, 'rr\x00'}, {@loopback, 0x4e1f, 0x1, 0x1}}, 0x44) executing program 2: socket$nl_route(0x10, 0x3, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000140)={0xa, 0x8b}, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000280)=0x8) r0 = getpid() sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x2) sched_setscheduler(r0, 0x2, &(0x7f0000000200)=0x7) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeea, 0x8031, 0xffffffffffffffff, 0x28f43000) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r1, &(0x7f0000000180)=@abs, 0x6e) sendmmsg$unix(r2, &(0x7f0000000000), 0x651, 0x0) recvmmsg(r1, &(0x7f00000000c0), 0x10106, 0x2, 0x0) mmap$IORING_OFF_SQ_RING(0x110c230000, 0x8000002, 0x2000007, 0x401d031, 0xffffffffffffffff, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./sys\x00', 0x1ff) mount(0x0, &(0x7f0000000040)='./sys\x00', &(0x7f0000000080)='sysfs\x00', 0x0, 0x0) r3 = openat(0xffffffffffffff9c, &(0x7f00000000c0)='./sys/module/usbcore/parameters/quirks\x00', 0x2, 0x0) write(r3, &(0x7f00000005c0)="306663353a313232373a3f7092c0f0bc085a193376cf620afaf6379a248d1d6534058f1095109da34b6d6537a6e78b0dc4b7bc0b", 0x34) r4 = socket$inet_tcp(0x2, 0x1, 0x0) ioctl$sock_SIOCGIFINDEX(r4, 0x8933, &(0x7f0000000180)={'syz_tun\x00'}) mkdirat(0xffffffffffffff9c, &(0x7f0000000080)='./file1\x00', 0x1c0) mkdirat(0xffffffffffffff9c, &(0x7f00000000c0)='./file0\x00', 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000240)='./file2\x00', 0x207) mount$overlay(0x0, &(0x7f0000000100)='./file0\x00', &(0x7f0000000000), 0x0, &(0x7f00000000c0)={[{@workdir={'workdir', 0x3d, './file0'}}, {@lowerdir={'lowerdir', 0x3d, '.'}}, {@upperdir={'upperdir', 0x3d, './file2'}}], [], 0x2c}) fsync(0xffffffffffffffff) executing program 2: r0 = syz_open_procfs(0x0, &(0x7f0000000c80)='fdinfo\x00') mmap(&(0x7f0000000000/0xe7e000)=nil, 0xe7e000, 0xfffffffffffffffe, 0x4031, 0xffffffffffffffff, 0x0) syz_emit_vhci(0x0, 0x4) ioctl$UFFDIO_COPY(0xffffffffffffffff, 0xc028aa03, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000200)={0x8, 0x8a}, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000180)=0x3) r1 = socket$inet_udp(0x2, 0x2, 0x0) setsockopt$IPT_SO_SET_REPLACE(r1, 0x0, 0x40, 0x0, 0x0) sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x2) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) r2 = syz_open_dev$MSR(&(0x7f00000001c0), 0x0, 0x0) read$msr(r2, &(0x7f0000019680)=""/102392, 0x18ff8) socket$igmp(0x2, 0x3, 0x2) getdents64(r0, &(0x7f0000002440)=""/181, 0xb5) mkdir(&(0x7f0000000040)='./file0\x00', 0x0) ioctl(0xffffffffffffffff, 0x890b, 0x0) bpf$MAP_CREATE(0x0, 0x0, 0x50) setns(0xc9, 0x0) r3 = socket$netlink(0x10, 0x3, 0x8) writev(r3, &(0x7f0000000300)=[{&(0x7f0000000080)='X\x00', 0xfdef}], 0x1) sendmsg$kcm(0xffffffffffffffff, &(0x7f0000000600)={0x0, 0x0, &(0x7f00000003c0)=[{0x0}, {&(0x7f0000000000)="11c9064268", 0x5}], 0x2}, 0x40) executing program 2: r0 = socket$inet_sctp(0x2, 0x5, 0x84) setsockopt$IP_VS_SO_SET_ADD(r0, 0x0, 0x482, &(0x7f00000000c0)={0x84, @dev={0xac, 0x14, 0x14, 0x8b}, 0x15, 0x3, 'fo\x00', 0x1, 0x400000, 0x4}, 0x2c) r1 = socket$kcm(0xa, 0x2, 0x0) setsockopt$IP_VS_SO_SET_ADDDEST(r0, 0x0, 0x487, &(0x7f0000000000)={{0x84, @remote, 0x4e21, 0x3, 'wrr\x00', 0x23, 0x81, 0x36}, {@dev={0xac, 0x14, 0x14, 0x40}, 0x4e23, 0x10000, 0x1cb, 0x12d61, 0x12d58}}, 0x44) sendmsg$sock(r1, &(0x7f0000000400)={&(0x7f0000000580)=@in6={0x2, 0x4e22, 0x0, @dev}, 0x80, 0x0, 0x0, &(0x7f0000000000)=[@mark={{0x14, 0x1, 0x24, 0x3}}], 0x18}, 0x0) executing program 2: socket$netlink(0x10, 0x3, 0x0) syz_open_dev$sndpcmp(0x0, 0xfffffffffffffff1, 0x402000) r0 = openat$cgroup_ro(0xffffffffffffffff, &(0x7f0000000000)='cpuacct.usage_sys\x00', 0x0, 0x0) sendmmsg$unix(r0, 0x0, 0x0, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) sched_setattr(0x0, &(0x7f0000000280)={0x38, 0x6, 0x8, 0x3, 0x0, 0x9, 0x1, 0xfffffe0000000001, 0xfa11, 0xffffffff}, 0x0) madvise(&(0x7f0000284000/0x1000)=nil, 0x1000, 0x3) landlock_create_ruleset(0x0, 0x0, 0x0) syz_clone(0x11, 0x0, 0x0, 0x0, 0x0, 0x0) socket$nl_generic(0x10, 0x3, 0x10) r1 = openat$procfs(0xffffffffffffff9c, &(0x7f00000000c0)='/proc/partitions\x00', 0x0, 0x0) r2 = openat$sysctl(0xffffffffffffff9c, &(0x7f0000000040)='/proc/sys/vm/drop_caches\x00', 0x1, 0x0) sendfile(r2, r1, &(0x7f0000002080)=0x58, 0x12) executing program 32: socket$netlink(0x10, 0x3, 0x0) syz_open_dev$sndpcmp(0x0, 0xfffffffffffffff1, 0x402000) r0 = openat$cgroup_ro(0xffffffffffffffff, &(0x7f0000000000)='cpuacct.usage_sys\x00', 0x0, 0x0) sendmmsg$unix(r0, 0x0, 0x0, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) sched_setattr(0x0, &(0x7f0000000280)={0x38, 0x6, 0x8, 0x3, 0x0, 0x9, 0x1, 0xfffffe0000000001, 0xfa11, 0xffffffff}, 0x0) madvise(&(0x7f0000284000/0x1000)=nil, 0x1000, 0x3) landlock_create_ruleset(0x0, 0x0, 0x0) syz_clone(0x11, 0x0, 0x0, 0x0, 0x0, 0x0) socket$nl_generic(0x10, 0x3, 0x10) r1 = openat$procfs(0xffffffffffffff9c, &(0x7f00000000c0)='/proc/partitions\x00', 0x0, 0x0) r2 = openat$sysctl(0xffffffffffffff9c, &(0x7f0000000040)='/proc/sys/vm/drop_caches\x00', 0x1, 0x0) sendfile(r2, r1, &(0x7f0000002080)=0x58, 0x12) executing program 5: prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x1, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000380)={0x8, 0x100008b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000200)=0x5) openat$sequencer(0xffffffffffffff9c, &(0x7f0000000300), 0x80200, 0x0) r0 = syz_open_dev$sndmidi(&(0x7f00000004c0), 0x2, 0x141102) writev(r0, &(0x7f0000000840), 0x0) r1 = socket$unix(0x1, 0x2, 0x0) sendmsg$kcm(0xffffffffffffffff, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)=[{0x0}, {&(0x7f0000000580)="d4fa0c511aad03aa5ed217677bc41c027d9c830c439c7f821ddd78b6915cb170e7603acf9e433c2903bb6773f4b0130668a1e5b5e08d21d0b69c28ca3455aed65855c86f3d1e5789d26375a0d85eaf5e92e19c9affcf76e7a94e76556d2b104ebf645747fadc91460f4b3c94e1a89b51be4a6aa4c65285f988329a8163b69c51b801500a5bacd0463976e2960e2679ef2feee5e6ce6bb78a51fb0e15820d13e4a5aa9e0742a6f8d677ad28fea356657bb550c8311b682d9003c82267a15aa7334bc53b65b9119a1a7d905c7dd365b85c230bbad0d5d0a79819e112637819d9a187cfdf782c6127d2d4281926ab0e22f7346b616fe28ed0b9f4a0c9fdac6d3a90a9c38b5e31448a45546388c95045bc22fe88c43b", 0x114}], 0x2}, 0x0) r2 = syz_genetlink_get_family_id$tipc(&(0x7f0000000040), 0xffffffffffffffff) sendmsg$TIPC_CMD_SET_LINK_PRI(0xffffffffffffffff, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000000080)={0x68, r2, 0x1, 0x0, 0x0, {{}, {0x0, 0x410c}, {0x4c, 0x14, {0xfffffff0, @link='broadcast-link\x00'}}}}, 0x68}}, 0x0) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f00000005c0)={0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x9, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x4}, 0x50) ioctl$sock_SIOCGIFINDEX_80211(r1, 0x8b18, &(0x7f0000000000)={'wlan0\x00'}) r3 = openat$vnet(0xffffffffffffff9c, 0x0, 0x2, 0x0) r4 = openat$tun(0xffffffffffffff9c, &(0x7f0000000080), 0x2, 0x0) ioctl$TUNSETIFF(r4, 0x400454ca, &(0x7f0000000100)={'\x00', 0x1}) ioctl$VHOST_SET_OWNER(r3, 0xaf01, 0x0) syz_open_procfs(0x0, &(0x7f0000000240)='clear_refs\x00') getsockopt$TIPC_DEST_DROPPABLE(0xffffffffffffffff, 0x10f, 0x81, &(0x7f0000000080), &(0x7f00000000c0)=0x4) add_key$user(&(0x7f00000003c0), &(0x7f0000000440), &(0x7f00000000c0), 0xc9, 0xfffffffffffffffd) syz_genetlink_get_family_id$tipc2(&(0x7f0000000400), 0xffffffffffffffff) mkdirat(0xffffffffffffff9c, &(0x7f0000000440)='./mnt\x00', 0x1ff) mount(&(0x7f0000000400), &(0x7f0000000000)='./mnt\x00', &(0x7f0000000480)='ecryptfs\x00', 0x0, &(0x7f0000000500)='ecryptfs_sig=syz,ecryptfs_fnek_sig=syz,ecryptfs_cipher=aes,ecryptfs_key_bytes=16\x00') executing program 5: r0 = socket$inet6_sctp(0xa, 0x5, 0x84) r1 = socket$inet6_sctp(0xa, 0x1, 0x84) getsockopt$inet_sctp6_SCTP_SOCKOPT_CONNECTX3(r1, 0x84, 0x6f, &(0x7f0000000280)={0x0, 0x1c, &(0x7f0000000000)=[@in6={0xa, 0x0, 0x0, @rand_addr=' \x01\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x01', 0x9}]}, 0x0) getsockopt$inet_sctp6_SCTP_MAX_BURST(r1, 0x84, 0x83, &(0x7f0000000000)=@assoc_value={0x0}, &(0x7f0000000300)=0x8) setsockopt$inet_sctp6_SCTP_AUTH_KEY(r0, 0x84, 0x17, &(0x7f0000000ac0)={r2, 0x8, 0x1, 'x'}, 0x9) executing program 5: r0 = bpf$PROG_LOAD(0x5, &(0x7f0000000a40)={0x1, 0x4, &(0x7f0000000300)=ANY=[@ANYBLOB], &(0x7f0000000200)='GPL\x00', 0x0, 0x0, 0x0, 0x41100, 0x0, '\x00', 0x0, @fallback=0x2a, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) r1 = socket$kcm(0x11, 0xa, 0x300) setsockopt$sock_attach_bpf(r1, 0x1, 0x32, &(0x7f0000000040)=r0, 0x4) r2 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPSET_CMD_CREATE(r2, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000480)=ANY=[], 0x4c}}, 0x2) executing program 5: r0 = syz_ublk_setup_io_uring(0x1d, &(0x7f0000000500)={0x0, 0x30b5, 0x0, 0x2, 0x158}, &(0x7f0000000100)=0x0, &(0x7f0000000400)=0x0, &(0x7f0000000140)=0x0) syz_ublk_add_dev(r0, r1, r2, r3, &(0x7f0000000200)={0x2e, 0x14, 0x0, 0xffffffffffffffff, 0xc0207504, 0x0, 0x0, 0x0, 0x0, 0x4, 0x0, 0x0, '\x00', {0xffffffff, 0xffff, 0x40, &(0x7f00000004c0)=@any_dev={0x3, 0xe26, 0x0, 0x0, 0x1000, 0x10000, 0xffffffffffffffff, 0x0, 0x4d}}}, &(0x7f0000000480)=0x0) r5 = dup(0xffffffffffffffff) syz_ublk_setup_queues(r5, r4, &(0x7f0000000180)={0x0, 0x1, 0x0, 0x3, 0x255}, &(0x7f0000000800)=[{0x0, 0x0, 0xffffffffffffffff, {0x0, 0x92e0, 0x400, 0x2100, 0x10000004, 0x0, r5}}, {0x0, 0x0, 0xffffffffffffffff, {0x0, 0x19e0, 0x400, 0x0, 0x146}}, {0x0, 0x0, 0xffffffffffffffff, {0x0, 0xf910, 0x2000, 0x0, 0x801f0, 0x0, r5}}, {0x0, 0x0, 0xffffffffffffffff, {0x0, 0x587e, 0x80, 0x2, 0x367}}], 0x1, &(0x7f0000000340)={0x2e, 0x50, 0x0, 0xffffffffffffffff, 0xc0107520, 0x0, 0x0, 0x0, 0x0, {}, 0x1f, 0x0, '\x00', {0xfff9, 0x1, 0x0, 0x0}}, 0x0) bpf$MAP_CREATE(0x0, &(0x7f0000000340)=@base={0x1f, 0x7fff, 0x10001, 0x80, 0x80, r5, 0x2, '\x00', 0x0, 0xffffffffffffffff, 0x4, 0x3, 0x5}, 0x50) executing program 5: r0 = socket$kcm(0x2, 0x200000000000001, 0x0) sendmsg$inet(r0, &(0x7f0000000080)={&(0x7f0000000340)={0x2, 0x4001, @dev}, 0x10, 0x0}, 0x3000c085) r1 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000280)='hugetlb.1GB.usage_in_bytes\x00', 0x26e1, 0x0) setsockopt$sock_attach_bpf(r0, 0x1, 0x3e, &(0x7f0000000100)=r1, 0x4) sendmsg$kcm(r0, &(0x7f0000002480)={0x0, 0x0, &(0x7f0000001e40)=[{&(0x7f0000000e40)}], 0x1}, 0x10) sendmsg$inet(r0, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)=[{&(0x7f0000000300)="b8", 0x2ee0}], 0x13, 0x0, 0x0, 0x10000000}, 0x12cd) executing program 5: prlimit64(0x0, 0xe, &(0x7f0000000140)={0xa, 0x400000000008d}, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000080)=0x8) getpid() sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x2) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r0, &(0x7f0000000180)=@abs, 0x6e) sendmmsg$unix(r1, &(0x7f0000000000), 0x651, 0x0) recvmmsg(r0, &(0x7f00000000c0), 0x4000087, 0x2, 0x0) r2 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r2, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000000)=@updpolicy={0xb8, 0x13, 0xcb23c9c9931e99e9, 0x0, 0x0, {{@in=@private=0xa010101, @in=@remote, 0x0, 0x400, 0x1000, 0x0, 0x2, 0x20, 0x10, 0x84, 0x0, 0xffffffffffffffff}, {}, {0x0, 0x4000000000000, 0x0, 0xffffffffffffffff}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1}}, 0xb8}}, 0x80) sendmsg$nl_xfrm(r2, &(0x7f0000000480)={0x0, 0x0, &(0x7f0000000800)={&(0x7f0000000000)=ANY=[@ANYBLOB="650100001b"], 0x168}}, 0xc0) executing program 33: prlimit64(0x0, 0xe, &(0x7f0000000140)={0xa, 0x400000000008d}, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000080)=0x8) getpid() sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x2) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r0, &(0x7f0000000180)=@abs, 0x6e) sendmmsg$unix(r1, &(0x7f0000000000), 0x651, 0x0) recvmmsg(r0, &(0x7f00000000c0), 0x4000087, 0x2, 0x0) r2 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r2, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000000)=@updpolicy={0xb8, 0x13, 0xcb23c9c9931e99e9, 0x0, 0x0, {{@in=@private=0xa010101, @in=@remote, 0x0, 0x400, 0x1000, 0x0, 0x2, 0x20, 0x10, 0x84, 0x0, 0xffffffffffffffff}, {}, {0x0, 0x4000000000000, 0x0, 0xffffffffffffffff}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1}}, 0xb8}}, 0x80) sendmsg$nl_xfrm(r2, &(0x7f0000000480)={0x0, 0x0, &(0x7f0000000800)={&(0x7f0000000000)=ANY=[@ANYBLOB="650100001b"], 0x168}}, 0xc0) executing program 3: ioctl$VIDIOC_QUERYSTD(0xffffffffffffffff, 0x8008563f, &(0x7f0000000000)) r0 = syz_usb_connect(0x2, 0xb3, &(0x7f0000000640)=ANY=[@ANYBLOB="12010002ef0201406d0425080001000000010902a1000201008032080b00020e03000009040000000e0100000d240100012700006cdc0201011124020101020000000000000000020d000924030201010001"], &(0x7f0000000a40)={0x0, 0x0, 0x0, 0x0}) syz_usb_control_io$rtl8150(r0, 0x0, &(0x7f00000003c0)={0x2c, &(0x7f00000000c0)=ANY=[], 0x0, 0x0, 0x0, 0x0}) write(0xffffffffffffffff, &(0x7f0000000500)='transport=rdma,nqn=nqn.2014-08.org.n', 0x24) executing program 3: r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000000), 0x40241, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000200)={'syzkaller1\x00', 0xc201}) r1 = socket$kcm(0x2, 0xa, 0x2) ioctl$SIOCSIFHWADDR(r1, 0x8914, &(0x7f0000000180)={'syzkaller1\x00', @link_local={0x1, 0x80, 0xc2, 0x0, 0x0, 0xe}}) r2 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r2, &(0x7f0000000200)={0x0, 0x0, &(0x7f0000000000)={&(0x7f00000009c0)=ANY=[@ANYBLOB="140000001000010000000000000000000000000a20000000000a01020000000000000000010000000900010073797a300000000040000000160a01000900000000000000010000000900010073797a30000000000900020073797a3000000000140003800800014000000000080002400000000048000000160a0101000b000000000000010000000900020073797a30000000000900010073797a30000000001c0003801800"], 0xd0}, 0x1, 0x0, 0x0, 0x24040841}, 0x20048010) write$tun(r0, &(0x7f0000001280)=ANY=[@ANYBLOB="000086dd00001100"], 0xfce) executing program 0: socket$nl_route(0x10, 0x3, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000140)={0xa, 0x8b}, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000280)=0x8) r0 = getpid() sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x2) sched_setscheduler(r0, 0x2, &(0x7f0000000200)=0x7) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeea, 0x8031, 0xffffffffffffffff, 0x28f43000) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r1, &(0x7f0000000180)=@abs, 0x6e) sendmmsg$unix(r2, &(0x7f0000000000), 0x651, 0x0) recvmmsg(r1, &(0x7f00000000c0), 0x10106, 0x2, 0x0) mmap$IORING_OFF_SQ_RING(0x110c230000, 0x8000002, 0x2000007, 0x401d031, 0xffffffffffffffff, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./sys\x00', 0x1ff) mount(0x0, &(0x7f0000000040)='./sys\x00', &(0x7f0000000080)='sysfs\x00', 0x0, 0x0) r3 = openat(0xffffffffffffff9c, 0x0, 0x2, 0x0) write(r3, &(0x7f00000005c0)="306663353a313232373a3f7092c0f0bc085a193376cf620afaf6379a248d1d6534058f1095109da34b6d6537a6e78b0dc4b7bc0b", 0x34) r4 = socket$inet_tcp(0x2, 0x1, 0x0) ioctl$sock_SIOCGIFINDEX(r4, 0x8933, &(0x7f0000000180)={'syz_tun\x00'}) mkdirat(0xffffffffffffff9c, &(0x7f0000000080)='./file1\x00', 0x1c0) mkdirat(0xffffffffffffff9c, &(0x7f00000000c0)='./file0\x00', 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000240)='./file2\x00', 0x207) mount$overlay(0x0, &(0x7f0000000100)='./file0\x00', &(0x7f0000000000), 0x0, &(0x7f00000000c0)={[{@workdir={'workdir', 0x3d, './file0'}}, {@lowerdir={'lowerdir', 0x3d, '.'}}, {@upperdir={'upperdir', 0x3d, './file2'}}], [], 0x2c}) r5 = openat$dir(0xffffffffffffff9c, &(0x7f0000000000)='./file0/file1\x00', 0x20400, 0x20) fsync(r5) executing program 4: r0 = syz_usb_connect(0x0, 0x2d, &(0x7f0000000000)=ANY=[@ANYBLOB="1201000083667d1040206402d14e0102030109021b000100000000090400000190f19c00090584"], 0x0) syz_usb_control_io$hid(r0, 0x0, 0x0) ioctl$sock_FIOGETOWN(0xffffffffffffffff, 0x8903, 0x0) syz_usb_control_io(r0, 0x0, 0x0) syz_usb_control_io(r0, 0x0, 0x0) syz_usb_control_io$cdc_ncm(r0, 0x0, 0x0) syz_usb_control_io$uac2(r0, 0x0, 0x0) munmap(&(0x7f0000001000/0x3000)=nil, 0x3000) add_key$keyring(&(0x7f00000101c0), &(0x7f0000010180)={'syz', 0x1}, 0x0, 0x0, 0xfffffffffffffffd) syz_usb_control_io$uac1(r0, 0x0, 0x0) syz_usb_control_io$hid(r0, 0x0, 0x0) syz_usb_control_io$printer(r0, 0x0, 0x0) r1 = syz_open_dev$I2C(&(0x7f0000000100), 0x2, 0x1) ioctl$I2C_RDWR(r1, 0x707, &(0x7f0000000180)={&(0x7f0000000140)=[{0x7, 0x0, 0x1, &(0x7f0000000080)="ce"}], 0x1}) syz_usb_control_io$lan78xx(r0, 0x0, 0x0) syz_usb_control_io(0xffffffffffffffff, 0x0, 0x0) syz_open_dev$tty1(0xc, 0x4, 0x1) syz_usb_control_io$hid(0xffffffffffffffff, 0x0, 0x0) r2 = seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0x0, &(0x7f00000000c0)={0x1, &(0x7f0000000040)=[{0x6, 0x0, 0x0, 0x7fffffff}]}) close_range(r2, 0xffffffffffffffff, 0x0) executing program 3: r0 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r0, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000001680)=ANY=[@ANYBLOB="140000001000010000000000000000000500000a28000000000a030000000000000000000a00000708000240000000020900010073797a31000000002c000000030a010100000000000000000a0000070900010073797a3100000000090003007379"], 0x7c}, 0x1, 0x0, 0x0, 0x40001}, 0x4040850) sendmsg$NFT_BATCH(r0, &(0x7f0000009b40)={0x0, 0x0, &(0x7f0000009b00)={&(0x7f0000000240)=ANY=[@ANYBLOB="140000001000010000000000000000000500000a48000000030a0fdb00000000000000000a0000050900030073797a30000000000900010073797a310000000014000480080002403cb140bb0800014000000003080005400000000014000000110001"], 0x70}, 0x1, 0x0, 0x0, 0x4000850}, 0x24000840) sendmsg$NFT_BATCH(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000cc0)={&(0x7f00000002c0)={{0x14, 0x10, 0x1, 0x0, 0x0, {0x3}}, [@NFT_MSG_DELCHAIN={0x2c, 0x5, 0xa, 0x101, 0x0, 0x0, {0xa, 0x0, 0xa}, [@NFTA_CHAIN_TABLE={0x9, 0x1, 'syz1\x00'}, @NFTA_CHAIN_HANDLE={0xc, 0x2, 0x1, 0x0, 0x1}]}, @NFT_MSG_DELRULE={0x20, 0x8, 0xa, 0x101, 0x0, 0x0, {0xa, 0x0, 0x9}, [@NFTA_RULE_TABLE={0x9, 0x1, 'syz1\x00'}]}], {0x14}}, 0x74}, 0x1, 0x0, 0x0, 0xb0}, 0x20008890) executing program 0: r0 = socket(0x1e, 0x1, 0x0) sendto$rxrpc(r0, &(0x7f0000000000)="fb5a0c5a28bff4d1eabc9b5e1b002907e42f898086b6bd3a0e8ac1187bc611911486c8bac2fbe135179cc1af68b7b1b77ef66df43b71636ab0f3e86a90855ff090e2ed7b1f446091934082de9b302cdf509d5038867b833afdd95183930c0ab8ccdc74c131f83b97caa6739b434bdf1c", 0x70, 0xc0, &(0x7f0000000100)=@in4={0x21, 0x4, 0x2, 0x10, {0x2, 0x4e21, @multicast1}}, 0x24) executing program 7: socket$inet_smc(0x2b, 0x1, 0x0) socket$inet_udp(0x2, 0x2, 0x0) socket$nl_generic(0x10, 0x3, 0x10) socket$nl_netfilter(0x10, 0x3, 0xc) r0 = bpf$MAP_CREATE(0x0, 0x0, 0x0) bpf$PROG_LOAD(0x5, &(0x7f0000000600)={0x1, 0xf, &(0x7f00000006c0)=@ringbuf={{0x18, 0x0, 0x0, 0x0, 0x107a655, 0x0, 0x0, 0x0, 0x10}, {{0x18, 0x1, 0x1, 0x0, r0}}, {}, [], {{}, {}, {0x85, 0x0, 0x0, 0x85}}}, &(0x7f0000000000)='GPL\x00', 0x0, 0x0, 0x0, 0x41000, 0x8, '\x00', 0x0, @fallback=0x6, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) openat$sndtimer(0xffffffffffffff9c, &(0x7f00000006c0), 0x1a0001) openat$udambuf(0xffffffffffffff9c, &(0x7f0000000480), 0x2) socket(0x400000000010, 0x3, 0x0) openat$sndseq(0xffffffffffffff9c, &(0x7f0000000600), 0x183c81) socket(0x10, 0x3, 0x0) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000140)) r1 = openat$iommufd(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) ioctl$IOMMU_IOAS_ALLOC(r1, 0x3b81, &(0x7f00000003c0)={0xc, 0x0, 0x0}) ioctl$IOMMU_TEST_OP_CREATE_ACCESS(r1, 0x3ba0, &(0x7f0000000340)={0x48, 0x5, r2, 0x0, 0xffffffffffffffff, 0x1}) r3 = openat$rdma_cm(0xffffffffffffff9c, &(0x7f0000000940), 0x2, 0x0) socketpair(0x1, 0x1, 0x0, &(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}) bpf$MAP_UPDATE_ELEM_TAIL_CALL(0x2, &(0x7f00000001c0)={{}, 0x0, &(0x7f0000000100)=r4}, 0x20) writev(r3, &(0x7f0000000040)=[{&(0x7f0000000100), 0x6b82}], 0x2) executing program 6: r0 = socket$inet6_tcp(0xa, 0x1, 0x0) socketpair$tipc(0x1e, 0x1, 0x0, &(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}) sendmsg$tipc(r1, &(0x7f00000003c0)={&(0x7f0000000180), 0x10, &(0x7f0000000380)=[{&(0x7f0000000480)="c3e972bd85a6d84136d6dd55048d3593a74f338ce6772ab9a6f64041c2f6fbbecdc08ebcd3192b6a53662dae7c8e9c665e80a5d0925f728dcac30c29793992e588952653d414cb8ccdabc38767fee819ec5af0c5ee936880fe8549b4ed347779cab4ffd4e0b62c53a1c01db28f2b3f91c34211c9353bc1dece61511917c2245fd66cb8dffeacb4d46d627c97b498bf1ff6b313bfbc9765457c831771d5eec7997ec242e4505f01c1bb3e06", 0xab}, {&(0x7f0000000300)='V', 0x1}, {&(0x7f0000001600)="3eed50d0125719a810f88e3f47186fe4dae74182dfd109a2587c4797410c9b8e39bd3d9aa144d5908647c30c8db69b5c17084c9b1bfbb8680737c4f88abcdbc7d294d72ab1b344270915df9ddf5635644c351c22b29d948ac4106bce7107570beed63077cfbc98ef71699eae65d37724d995b553e7a3ade619b522313ab382caf879feb48942878e605ee3ee2872794e3abe22a3f025068b628a5d92468092a5cc649bbbd978b5772e537939432a502122235ced312dafd108c9ffeb0b38cc16da9418ca01d485a6afb5827da4df6e1121ec307de14bb32b6a977608e4576a998182dd93d592ff43e55bfdbbce23ecd501e43b3e93ef8d9d01711dff54c301e299d3801a3cffe6c9883fbd0e47124dc02569f62d48b878fcb58ce99fcffcd2a5166eff3ad93cf1d137274993d86a3b3730d63ded759f6ca88fa449e5575b15321e5a58a1f888eed7466db4976ce35f6d2efb5ad05d99a66482dc607cb5acb24d326803bd337519cc98103f59c63b5962cd72e4497d1b00817d6e09de70270a09b493c2226617b1c9ef9d506be00d6e07f14633a966f04ecca90fb8d2b963ad6f3817935bd6534fa3da1c5dc468789cbf1192f3c0bff3777f1edd2ada5d35f88f12f29e952c44445ce623509d66811c80a9e0f13ad85aba37d86ff0da4dda601d9e8acb264233bc939fb056316612cff687d5c44157be05bcc88b333ff2a40041d98f1acfe6e2231a84e09bd7a54a0442cf87ce3ee8fd8da39da1862862ae40fc3cb3055c8b70e62f243850707341f51426bb3e71c7a4fffefab060db786000618b05eb087a424a2f30f6a232ff44b605f70ceec0a8f70e37907f6e0bbba21e9d5b7ecb6d287742b75c101ba79525918c3473eae38f3c177249dfa8816661c9921f0b0c858d53ab87c8407b97950c842111002edd1d1e80b801b495da28bcd5409bc971e55dab1857e188ac9728efc8f9a4543945f86ade13b445eacecbbf848a96410ac37c57e3e9e8bc8b8fadd559d225c7468639da2b5d1208558b51e94c14faa7947a7c60e81a96bb5d194cc7289adbc02ebb4b49be1f1efc429db2f9b79b5a22919dba0c35341042c5776942c52365367c4bfc95b42be383cca7107161ded7e851d0126da33d581f1e2b08d0c061e86d31e7a83f9b51c79b4034c7deda7697034e1404c6e8e459f76c2efe64350146c7437ef808e04ca14df5f6f500264fd977272bbf8fc096774e8eb61d0963430751ac1425a073f84346b0eba368cba7fa34adc420800d4f99927280eba199f9695cf88124fafc3a2b1226d2f2ab3ea27c69a127650cf5c725b54c02bd8729033cf699ce7f030f9a3442056244da3cfb61a8126dba11377624f39eb009242152fd7b8b88de7dd86057f29bfcb7b7df0e65e7e9ac9eeaa41afa62743698bff03d5b2d51fb6bca2d92294e8e177cfa3661b26f1c040e9bed983b7bc0aa154eb9c92e4ee25091318c53113a1c23ac62d2d71504cba99041f29a4f332133292cf20abec9222a2acca57cac48fa6c0668ee5eecb494741a64d33b011dcca74696d4614c5b45a5d20983b1708d365ed3ffa60f9161972a611c22642c3c259b41f943f6d7a8b60f284d325e38fe76f0645e069ff70cae38850ccf973193b6232c987df26239a574691f7f07fffa6deae1eb0324fe546573c36f2a2c31cd442517a9b036ae6a2a491e7343864693c107a5dc2585820863c146c1ba6caa4fea9b87d567716f4c8ca1a9d2848055cd750512d3b7415d090019dc8a04a1a1d28931093cd8f00e94c407ca1fa2a5ce903d9df26e008c07cd13afa783220e1bd5e6b60645f3dbb6ecb4156fedafa2dd25498c6a99d94f0b38125ea7741b75109dcac9f80635f79f5c8a0483bb9f05a3a5bf721c7541edb252449f8b13e63c370a6146332f03ca1f1b6fe0bed984f13744bb7fa0fe322e83ddf9ffb2083e94f33604a0a199220c450dad94bf154805e7f9e4350ca2d81adf2978c87dcc8a8a7d56297ec124bfef0d28f35777205e973272c87e01070f14f5b14daa3b5104d9ff6b296c4f16ed49eb42d35e7ba3bccb7a26c33a263df88aadd596e9d9de0abbd4d449df11081f2cd62e1d8962b9b9feb25a3b8e03537d61a61c11ac22b7211d12c84e60a6abcc219e558b2513d8c530b3c7a57cdc47de545aafbb2a13c0e6c75b1b92fa241c713c83a09c92b2b61d565120372a9143415583c9596f27a663d4967cd653b08cebd6cb96c1f0dc80d57267ac9a8281d7149bde880828ee27d69a6818db58320db29d1b044eaf6ab8a5108bc522de406990b5393b1f7e7bab71bf6cf8eed1cd59c7607d662e8b313f5c4fce0f59b1027371381011b63dd5b2b09739082c0d62ffad96e30153a395234937d377c32fe7af82aca3a19d0ebc4a5c5fb5ff190f14d5695c703b571fb4bf03756635cafc6cf6267eab836c347a9d07e8089fc105346934cf3364e5be370b3c42b94bc5ae3d17a817398566a2953251eb91697d67278145df9a4b917bcca1bf211780b22f4caacfcb7604c84f943d05f6fdf8edbd258d7d8dbf84f9d99e57472c5b1c2337d749a1f345e662e2536d23c7a63bbbbf00f8b5b0a2106a0342ab27b9a10b82e82668cd49e0cbb09d7be0217645f1dda3be59c8232fa290d34791cda52aa5b5cec6339ab96a2eb3f5328cc7c0e6717c2824344547a2ed518f6b2b4e4fe5b684596aa6a9d3988fc5d5ff4cb46cec99d951b8386b10949a163af974b7543df97b4882a4ed60e927a1deb67c5f814235bef65fea79a2c712815be7403c93a3707fb90d4604ec3a6a3b0928f253f6ab6bd56c958e026c8c58172c4ac2a3efe2ecd5cea70c8313f9ac2d638bc296ba99e2ca86d2fd06b5402cdcddc3f3c9845d5ae77f6f36963b91e8f6cdccd17abe8d40ed02463af4bb0e496344f350097f1cc13313fa1e172b63556ed2b8a8121c01a5fb343ff7767821626fc49b0d6bd522e1c9bf137d5a5bccb4bc8dbb64c83a82ef6c2894f3896c9f6bf0c3764011d53eeb6db9ea9dae22d3ebcca4942d5828c0bca0d9ea37701d5a06c066ac4fe318e11e9c0d6c658ac810fb5d7836cfffe4ccbb0934e5567d74695980a156d4bf1c18861c5a29ccd349999dc20562d00e1f6c1851ae563541086438d60b975c8ceb466414ff60efa0b2dee790fd0659ffa98b92414c13d5a6825368f56c4984412205041cd8e006c7127d4395ecdffb5addf80ef938ce54a367154c4fc286d5f969325c12b13655a9a956dd3b98281f537e837669fc55d8930676e807aa8cd046e0f4583d59f86cb99f3f7a7ddde1fb39111fdec7677d2fee4b8f4814a5def5ebcc67c653384ce80eaffd880405f7edf8fd3ea049f040595df4a75e2f892e7a85e0ba351fb8d263bfff7168bb85017b360fcd2ba89346682a6ea7ccc46afbdb5ab444e3f477238b2ab503bde914d3cf1789539cde9c0621152cd97bff9f235d88a1ef4ea4309db3a05d401af7fb82784b050ef529dab4f1f003eb29710a962f7538c521e617e2f0efac36182d09985e1d725cc38c3833a53742a02f76fb2854a9e45f0febacf3bda83f11183ef5b9fef02ebcdf56d4104b175bad937d8f61964f97d673577cdcbbb48d8eb62b063ee6563b9ff053719baff871bcd83822d865b2f7ef023076425ac5cd71b1f2309de0c6f14cc9c4d3e8fad945f756a7c8a084ea1bfdf5ac6e740043e7f7bdaca06774b084ae314c2636529d4fdcd965c7f8c07156572620b827d694efdc9d2bfc5aa9391220a83765f2c71fcd48d4acaed60afb53d1013fa3b15e948ec4159f7d130ef85b594018346e99034c18738285223ea53a6b1d5cf11a607de2e19608ba03ec970a915b773824261f3fc931dd6d3b934d89f07baf14776314c3eeb8cd0537ef5736f565fbd14e520d4ab2f77ed9597b76ff91f8d1f99ebd6e473efda7accb273975a06944d1037032129992b994ca791a09b4d83980a1e494b0f97098df5f6fb6bbb02722adb11dc319c565c2c363cbd19d9fb3efb4613b62d6584cd53f7bd80e3e89304f444ce9dd1835661e3bb4de02ccf568a2a5daaf0d56898d4286c3fb62e22af62d7ac318685834467f337561dde2e0c1e2827cdffcf42c17728ee64b3ff4ccc0227590badd0bd7e448b8cca0892d6a5e0130d2ac665f47c6b28daa101c1b319869bdd39fa924d6d9ba7d72feda5f21ac78641c7d4801d41c7879721b3be4dab40d9c4a78552440101f373489cc5240b0144a9ce32691a784b6dfe971a21bb5980ff67da2d1bb90b223c9e192a39c1aeadd1f5c790811079c0b51a97105c99b6f95d71bb3ea47c33d9dcb0a53c929c44499e184a3cd722c908d3b0d157e28ffdeb2ed7192e780d96a7a2f0fd5a87bdc973e049da0caf931f26f5a21813e2e602ceb2259997e0205ce48fd9424bd6d4d75dd4301f429ee30745cd839a40dbeab4c3db2f0f10bbaea071ca41d1392385681730a3678a5f60f604dbe19cb9d7dd234337e327451b8cc65394af399432ef7fc3765d055874ebdca14e5999292d6f72f31e92bacf25db5ef8f5212952c1910de06ddbe1687a0e1837922f2228289916ed3aeb7b9cc24da3ae47139e371930afa6d3573df6732c26c0c7ae06d9cedfa77160711bcb06e6553338deae4c5731cf53cc154113096d02f3036d7d9edfcdc331e4bb860c5208489212e904eab70e7f860b0379895cbdecbf7a0b7a25e5b853c7dbe08a4e296a30afec8cf5a9f6ea4aef32a508655d539a770b21e660c9ee1d7688c56abeb7cf1afccc8d59780cf26312589e0c8e1bc00ad7b1325cd9a5dd69246e0b33407c381ea09265154aec297e4ccdf9785a1042a83e77c13d4ce4360782f2428f9916b5cd123b089eb683d30c1e895b9944aa905a1a5b52301d8cc5e4741834ead6ebdb5dc05c9c49c5e883e99d40b9838037beaf876534d747856103e59caf6266fbbe760b6ef83d004634b74f14f8eb4aef93c4cc9cbbd78d83d532c70feef51ea3f170b25d81a6a9b074bfca7e9b3771bf83517e0dd9d0600f70b86b20f61fe36076f8bada334b2390fa954973bc901619a3cfd039349cb328625f495ab288dbdd6dbfd022c2a83f59e0b998619a12e35891b5ae9e83a71765507b4a571cd2241e5885c705244c1022688bef7c5065fbcf219fc01753adb611b3fbc09403dcb10a4f99d788667eff75fa27074ca8481a633530e26163ccf7dada049d23e717e067b6fa5b2f652bc50abda9e7ccdc5f2f3c35ecc2c4431c819c9691be4422e379750774e9f39dae06f26423c8a4278789c9f3111b43f6dd25b0ad47c4cc5fda3f3ed82079c9366e0adced883488f429c1d7e1b351fd0bb204dd7977ef224c4df6d7a5f7697bc6500a7d03a8a914154779fa7092bf1be6bad4092367ce5d295a5d5d0e7c469f372ca2011d612637025e89f178ae9ada0c5b73bcb7d7c034ff595263cd4216e3c76ba5f3d81932a088a90bf8043e877e299c670ef1622a098d5519d9adc4ee7d4cd00e5934a4375fa83fdb81214b892482b31bdde59a70aaf25cb7f417c3a2a91c4e54b48149f6c41d9d396ee6ff13e3028c64a7c9b1f2e7c6e67184a3d52d6f570db3d225c947423c4c6533f22df57d15c5e5a3183422bd378b06fe4732a9401dcb19840fb8fa5c50a0ff497fef362c507753e46b8881d3e767f3b1d893a3805941c94f2efa05ce34b9ea81d716984af6834230d4707a87089d40779503ee6a9bb245d7d997f14acb80e89731c042bbbbe3dcd05177b0ee0eec23455830ef5b65aca357f2b0b887e0b9821c0", 0x1000}, {&(0x7f0000000340)="b768eb20304f2fdc5a9694a4867840d93170ca1a86406f", 0x17}], 0x4, 0x0, 0x0, 0x8010}, 0x0) sendmmsg(r2, &(0x7f0000005280), 0x4000000000001cd, 0x1008c811) close_range(r0, 0xffffffffffffffff, 0x0) executing program 3: r0 = socket$nl_generic(0x10, 0x3, 0x10) ioctl$sock_SIOCGIFINDEX_80211(r0, 0x8933, &(0x7f00000000c0)={'wlan0\x00', 0x0}) r2 = socket$packet(0x11, 0x2, 0x300) bind$packet(r2, &(0x7f0000000040)={0x11, 0x7, r1}, 0x14) write(r2, 0x0, 0x0) executing program 0: r0 = syz_open_dev$hiddev(&(0x7f00000000c0), 0x0, 0x0) ioctl$HIDIOCSREPORT(r0, 0x81044804, &(0x7f0000000400)={0x1}) executing program 7: fcntl$lock(0xffffffffffffffff, 0x7, &(0x7f0000000040)={0x0, 0x0, 0x8000, 0x3ff}) mprotect(&(0x7f0000000000/0xf000)=nil, 0xf000, 0x9) r0 = socket$netlink(0x10, 0x3, 0x14) ioctl$FIDEDUPERANGE(r0, 0xc0189436, &(0x7f0000000040)=ANY=[]) executing program 0: prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x1, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000380)={0x8, 0x100008b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000200)=0x5) openat$sequencer(0xffffffffffffff9c, &(0x7f0000000300), 0x80200, 0x0) r0 = syz_open_dev$sndmidi(&(0x7f00000004c0), 0x2, 0x141102) writev(r0, &(0x7f0000000840)=[{&(0x7f00000002c0)="94", 0xf000}, {0x0}], 0x2) r1 = socket$unix(0x1, 0x2, 0x0) sendmsg$kcm(0xffffffffffffffff, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)=[{0x0}], 0x1}, 0x0) r2 = syz_genetlink_get_family_id$tipc(&(0x7f0000000040), 0xffffffffffffffff) sendmsg$TIPC_CMD_SET_LINK_PRI(0xffffffffffffffff, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000000080)={0x68, r2, 0x1, 0x0, 0x0, {{}, {0x0, 0x410c}, {0x4c, 0x14, {0xfffffff0, @link='broadcast-link\x00'}}}}, 0x68}}, 0x0) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f00000005c0)={0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x9, 0x0, 0x0, 0x1, 0x0, &(0x7f0000000400)="14", 0x2, 0x0, 0x4}, 0x50) ioctl$sock_SIOCGIFINDEX_80211(r1, 0x8b18, 0x0) r3 = openat$vnet(0xffffffffffffff9c, &(0x7f0000000000), 0x2, 0x0) r4 = openat$tun(0xffffffffffffff9c, &(0x7f0000000080), 0x2, 0x0) ioctl$TUNSETIFF(r4, 0x400454ca, &(0x7f0000000100)={'\x00', 0x1}) ioctl$VHOST_SET_OWNER(r3, 0xaf01, 0x0) r5 = syz_open_procfs(0x0, &(0x7f0000000240)='clear_refs\x00') writev(r5, &(0x7f0000000000)=[{0x0}], 0x1) bpf$BPF_PROG_QUERY(0x10, &(0x7f0000000340)={@fallback=r3, 0x10, 0x1, 0xa43a, &(0x7f0000000180)=[0x0, 0x0, 0x0, 0x0], 0x4, 0x0, &(0x7f00000001c0)=[0x0], 0x0, 0x0, 0x0}, 0x40) ioctl$ifreq_SIOCGIFINDEX_wireguard(r1, 0x8933, &(0x7f0000000440)={'wg0\x00', 0x0}) r8 = bpf$PROG_LOAD_XDP(0x5, &(0x7f00000008c0)={0x6, 0x2, &(0x7f0000000480)=@raw=[@map_idx={0x18, 0x2, 0x5, 0x0, 0xc}], &(0x7f0000000500)='GPL\x00', 0x7, 0x85, &(0x7f00000006c0)=""/133, 0x40f00, 0x0, '\x00', 0x0, 0x25, 0xffffffffffffffff, 0x8, &(0x7f0000000780)={0x9, 0x2}, 0x8, 0x10, &(0x7f00000007c0)={0x4, 0x7, 0x7fffffff, 0x8}, 0x10, 0x0, 0x0, 0x0, &(0x7f0000000800)=[0x1, 0x1], 0x0, 0x10, 0x6}, 0x94) bpf$BPF_PROG_DETACH(0x9, &(0x7f0000000540)=ANY=[@ANYRES32=r7, @ANYRES32=r5, @ANYBLOB="1d0000001000000000000000", @ANYRES32=r8, @ANYBLOB="27983b", @ANYRES64=r6], 0x20) ioctl$VHOST_SET_MEM_TABLE(r3, 0x4008af03, &(0x7f0000000300)) r9 = syz_open_procfs(0x0, &(0x7f0000002500)='net/wireless\x00') read$FUSE(r9, &(0x7f00000046c0)={0x2020}, 0x2021) ioctl$SNDRV_PCM_IOCTL_REWIND(r9, 0x40084146, &(0x7f0000000040)=0x8) ioctl$VHOST_SET_VRING_ADDR(r3, 0x4028af11, &(0x7f0000000400)={0x1, 0x0, 0x0, &(0x7f0000020000), 0x0}) seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0x0, &(0x7f0000000000)={0x1, &(0x7f0000000100)=[{0x6, 0x72, 0x0, 0x7fff0000}]}) executing program 3: syz_open_dev$sg(0x0, 0x8, 0x0) prctl$PR_SET_SECCOMP(0x16, 0x2, &(0x7f0000000300)={0x0, 0x0}) setitimer(0x2, &(0x7f0000000040)={{0x0, 0x2710}, {0x0, 0x2710}}, 0x0) unshare(0x60000600) syz_usb_connect(0x0, 0x36, &(0x7f0000000040)=ANY=[@ANYBLOB="120100004107f540f30c7593de1a000000010902"], 0x0) mremap(&(0x7f0000ffe000/0x1000)=nil, 0x1000, 0x4000, 0x3, &(0x7f0000ff9000/0x4000)=nil) munmap(&(0x7f000045e000/0x1000)=nil, 0x1000) madvise(&(0x7f0000a93000/0x4000)=nil, 0x4000, 0x80000000e) syz_io_uring_setup(0x7a31, &(0x7f0000000080)={0x0, 0x4e36, 0x800, 0x1, 0x2fe}, &(0x7f0000000280), 0x0, 0x0) madvise(&(0x7f0000bdc000/0x4000)=nil, 0x86ac726dff2f4713, 0xa) mremap(&(0x7f00006bd000/0x2000)=nil, 0x2000, 0x4000, 0x3, &(0x7f0000721000/0x4000)=nil) r0 = syz_open_procfs(0xffffffffffffffff, &(0x7f0000000000)='cmdline\x00') preadv(r0, &(0x7f00000001c0)=[{&(0x7f0000000300)=""/147, 0x93}, {&(0x7f00000003c0)=""/118, 0x76}, {&(0x7f0000000600)=""/14, 0xe}], 0x3, 0x7, 0x10000) setsockopt$packet_fanout_data(r0, 0x107, 0x16, &(0x7f0000000180)={0x1, &(0x7f0000000100)=[{0x9, 0xfc, 0x3, 0xa9c}]}, 0x10) munmap(&(0x7f0000a88000/0x1000)=nil, 0x1000) munmap(&(0x7f00003fe000/0xc00000)=nil, 0xc00000) prctl$PR_SET_SYSCALL_USER_DISPATCH_ON(0x3b, 0x1, 0x0, 0x0, &(0x7f0000006680)) unshare(0xa020480) socket$inet(0x2, 0x1, 0x0) openat$nvme_fabrics(0xffffffffffffff9c, &(0x7f0000000040), 0x2, 0x0) executing program 6: r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$tipc2(&(0x7f0000000000), r0) sendmsg$TIPC_NL_KEY_SET(r0, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000280)={&(0x7f0000000040)={0x14, r1, 0x1}, 0x14}}, 0x0) executing program 7: r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000000), 0x40241, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000200)={'syzkaller1\x00', 0xc201}) r1 = socket$kcm(0x2, 0xa, 0x2) ioctl$SIOCSIFHWADDR(r1, 0x8914, &(0x7f0000000180)={'syzkaller1\x00', @link_local={0x1, 0x80, 0xc2, 0x0, 0x0, 0xe}}) r2 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r2, &(0x7f0000000200)={0x0, 0x0, &(0x7f0000000000)={&(0x7f00000009c0)=ANY=[@ANYBLOB="140000001000010000000000000000000000000a20000000000a01020000000000000000010000000900010073797a300000000040000000160a01000900000000000000010000000900010073797a30000000000900020073797a3000000000140003800800014000000000080002400000000048000000160a0101000b000000000000010000000900020073797a30000000000900010073797a30000000001c0003801800"], 0xd0}, 0x1, 0x0, 0x0, 0x24040841}, 0x20048010) write$tun(r0, &(0x7f0000001280)=ANY=[@ANYBLOB="000086dd00001100"], 0xfce) executing program 1: syz_usb_connect(0x0, 0x4b, &(0x7f0000000000)=ANY=[@ANYBLOB="1201000200000040480b051000010102000109023900020100803209040000000000000009"], 0x0) r0 = syz_open_dev$dvb_demux(&(0x7f0000000200), 0x1, 0x2) ioctl$DVB_DEMUX_DMX_SET_PES_FILTER(r0, 0x40146f2c, &(0x7f0000000100)={0x1ff, 0x0, 0x3, 0xa, 0x4}) executing program 6: socket$nl_route(0x10, 0x3, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000140)={0xa, 0x8b}, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000280)=0x8) r0 = getpid() sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x2) sched_setscheduler(r0, 0x2, &(0x7f0000000200)=0x7) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeea, 0x8031, 0xffffffffffffffff, 0x28f43000) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r1, &(0x7f0000000180)=@abs, 0x6e) sendmmsg$unix(r2, &(0x7f0000000000), 0x651, 0x0) recvmmsg(r1, &(0x7f00000000c0), 0x10106, 0x2, 0x0) mmap$IORING_OFF_SQ_RING(0x110c230000, 0x8000002, 0x2000007, 0x401d031, 0xffffffffffffffff, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./sys\x00', 0x1ff) mount(0x0, &(0x7f0000000040)='./sys\x00', &(0x7f0000000080)='sysfs\x00', 0x0, 0x0) r3 = openat(0xffffffffffffff9c, 0x0, 0x2, 0x0) write(r3, &(0x7f00000005c0)="306663353a313232373a3f7092c0f0bc085a193376cf620afaf6379a248d1d6534058f1095109da34b6d6537a6e78b0dc4b7bc0b", 0x34) r4 = socket$inet_tcp(0x2, 0x1, 0x0) ioctl$sock_SIOCGIFINDEX(r4, 0x8933, &(0x7f0000000180)={'syz_tun\x00'}) mkdirat(0xffffffffffffff9c, &(0x7f0000000080)='./file1\x00', 0x1c0) mkdirat(0xffffffffffffff9c, &(0x7f00000000c0)='./file0\x00', 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000240)='./file2\x00', 0x207) mount$overlay(0x0, &(0x7f0000000100)='./file0\x00', &(0x7f0000000000), 0x0, &(0x7f00000000c0)={[{@workdir={'workdir', 0x3d, './file0'}}, {@lowerdir={'lowerdir', 0x3d, '.'}}, {@upperdir={'upperdir', 0x3d, './file2'}}], [], 0x2c}) r5 = openat$dir(0xffffffffffffff9c, &(0x7f0000000000)='./file0/file1\x00', 0x20400, 0x20) fsync(r5) executing program 0: r0 = openat$qrtrtun(0xffffffffffffff9c, &(0x7f0000002740), 0x101002) mmap(&(0x7f0000000000/0xfbe000)=nil, 0xfbe000, 0x2, 0x31, 0xffffffffffffffff, 0x0) r1 = openat$ppp(0xffffffffffffff9c, &(0x7f0000000040), 0x0, 0x0) ioctl$TUNSETOFFLOAD(r1, 0xc004743e, 0x110e22fff6) r2 = socket$kcm(0x2, 0x3, 0x2) ioctl$SIOCSIFHWADDR(r2, 0x8b0f, &(0x7f0000000180)={'virt_wifi0\x00', @dev={'\xaa\xaa\xaa\xaa\xaa', 0x35}}) r3 = openat$ppp(0xffffffffffffff9c, &(0x7f0000000080), 0x1, 0x0) ioctl$TUNSETOFFLOAD(r3, 0x4004743d, 0x110e22fff6) io_setup(0x81, &(0x7f0000001440)=0x0) io_submit(r4, 0x1, &(0x7f00000008c0)=[&(0x7f0000000280)={0x0, 0x0, 0x0, 0x5, 0x800, r3, 0x0, 0x0, 0x0, 0x0, 0x2}]) r5 = openat$sysfs(0xffffffffffffff9c, &(0x7f00000002c0)='/sys/power/resume', 0x149a82, 0x10) write$cgroup_int(r5, &(0x7f0000000000)=0x2b00, 0x12) ioctl$TUNSETIFF(r5, 0x400454ca, &(0x7f0000000000)={'dummy0\x00', 0x8000}) r6 = socket$netlink(0x10, 0x3, 0x0) sendmsg$nl_route(r6, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000180)=ANY=[@ANYBLOB, @ANYRES32=0x0, @ANYBLOB="00000000000000002c00128009000100626f6e64000000001c0002800500"], 0x4c}}, 0x0) close_range(r0, 0xffffffffffffffff, 0x0) executing program 4: r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$ethtool(&(0x7f0000000740), r0) sendmsg$ETHTOOL_MSG_PAUSE_SET(r0, &(0x7f0000000880)={0x0, 0x0, &(0x7f0000000840)={&(0x7f00000012c0)=ANY=[@ANYBLOB='D\x00\x00\x00', @ANYRES16=r1, @ANYBLOB="010029bd7000ffdbdf251600000018000180140002006e657464657673696d3000000000000005000200400000000500020000000000050004"], 0x44}}, 0x0) executing program 1: socket$nl_route(0x10, 0x3, 0x0) socket(0x10, 0x803, 0x0) socket$unix(0x1, 0x2, 0x0) socket$nl_generic(0x10, 0x3, 0x10) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000280)={&(0x7f0000000500)=@newqdisc={0x24, 0x24, 0x400, 0x70bd28, 0x25dfdbfd, {0x0, 0x0, 0x0, 0x0, {0x10, 0xc}, {0x2, 0xe}, {0xfff2, 0x4}}}, 0x24}}, 0x0) r0 = socket$rxrpc(0x21, 0x2, 0xa) sendmsg$IPCTNL_MSG_CT_NEW(0xffffffffffffffff, &(0x7f0000000300)={0x0, 0x0, &(0x7f00000000c0)={0x0}}, 0x0) r1 = socket$netlink(0x10, 0x3, 0x0) r2 = socket$inet6_icmp_raw(0xa, 0x3, 0x3a) ioctl$sock_SIOCGIFINDEX(r2, 0x8933, &(0x7f0000000000)={'bridge0\x00'}) sendmsg$nl_route(0xffffffffffffffff, &(0x7f0000000100)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000080)=ANY=[@ANYBLOB="280000007000010010ab4be68e8da23507000000", @ANYBLOB="100001800400", @ANYRES8=r0], 0x28}}, 0x0) sendmmsg(r1, &(0x7f00000002c0), 0x40000000000009f, 0x0) executing program 6: r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000000), 0x2, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000200)={'syzkaller1\x00', 0x5001}) bpf$PROG_LOAD(0x5, &(0x7f0000000180)={0x5, 0x4, &(0x7f0000000080)=ANY=[@ANYBLOB="b40500000000000069108e0000000000bc0010"], 0x0, 0x5, 0x0, 0x0, 0x0, 0x8}, 0x94) r1 = socket$inet_udp(0x2, 0x2, 0x0) r2 = socket$nl_route(0x10, 0x3, 0x0) r3 = socket$unix(0x1, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r3, 0x8933, 0x0) sendmsg$nl_route_sched(r2, &(0x7f00000012c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f00000000c0)=@newqdisc={0x30, 0x24, 0x601, 0x0, 0x0, {0x0, 0x0, 0x0, 0x0, {}, {0xfff1, 0xffff}}, [@qdisc_kind_options=@q_ingress={0xc}]}, 0x30}}, 0x0) sendmsg$nl_route_sched(r2, &(0x7f0000000580)={0x0, 0x0, &(0x7f0000000300)={&(0x7f0000001300)=@newtfilter={0x80, 0x2c, 0x601, 0x0, 0x0, {0x0, 0x0, 0x0, 0x0, {0xb, 0x7}, {0xfff1, 0xffff}, {0x300}}, [@filter_kind_options=@f_matchall={{0xd}, {0x4c, 0x2, [@TCA_MATCHALL_ACT={0x48, 0x2, [@m_ct={0x44, 0x1, 0x0, 0x0, {{0x7}, {0x1c, 0x2, 0x0, 0x1, [@TCA_CT_PARMS={0x18, 0x1, {0x0, 0x0, 0x3}}]}, {0x4}, {0xc}, {0xc}}}]}]}}]}, 0x80}}, 0x0) ioctl$sock_inet_SIOCSIFFLAGS(r1, 0x8914, &(0x7f0000000200)={'syzkaller1\x00', 0x1}) write$tun(r0, &(0x7f0000000040)=ANY=[@ANYBLOB="03031b003a003200060063"], 0x76) executing program 4: r0 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r0, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000001680)=ANY=[@ANYBLOB="140000001000010000000000000000000500000a28000000000a030000000000000000000a00000708000240000000020900010073797a31000000002c000000030a010100000000000000000a0000070900010073797a3100000000090003007379"], 0x7c}, 0x1, 0x0, 0x0, 0x40001}, 0x4040850) sendmsg$NFT_BATCH(r0, &(0x7f0000009b40)={0x0, 0x0, &(0x7f0000009b00)={&(0x7f0000000240)=ANY=[@ANYBLOB="140000001000010000000000000000000500000a48000000030a0fdb00000000000000000a0000050900030073797a30000000000900010073797a310000000014000480080002403cb140bb0800014000000003080005400000000014000000110001"], 0x70}, 0x1, 0x0, 0x0, 0x4000850}, 0x24000840) sendmsg$NFT_BATCH(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000cc0)={&(0x7f00000002c0)={{0x14, 0x10, 0x1, 0x0, 0x0, {0x3}}, [@NFT_MSG_DELCHAIN={0x2c, 0x5, 0xa, 0x101, 0x0, 0x0, {0xa, 0x0, 0xa}, [@NFTA_CHAIN_TABLE={0x9, 0x1, 'syz1\x00'}, @NFTA_CHAIN_HANDLE={0xc, 0x2, 0x1, 0x0, 0x1}]}, @NFT_MSG_DELRULE={0x20, 0x8, 0xa, 0x101, 0x0, 0x0, {0xa, 0x0, 0x9}, [@NFTA_RULE_TABLE={0x9, 0x1, 'syz1\x00'}]}], {0x14}}, 0x74}, 0x1, 0x0, 0x0, 0xb0}, 0x20008890) executing program 4: socket$inet_smc(0x2b, 0x1, 0x0) socket$inet_udp(0x2, 0x2, 0x0) socket$nl_generic(0x10, 0x3, 0x10) socket$nl_netfilter(0x10, 0x3, 0xc) r0 = bpf$MAP_CREATE(0x0, 0x0, 0x0) bpf$PROG_LOAD(0x5, &(0x7f0000000600)={0x1, 0xf, &(0x7f00000006c0)=@ringbuf={{0x18, 0x0, 0x0, 0x0, 0x107a655, 0x0, 0x0, 0x0, 0x10}, {{0x18, 0x1, 0x1, 0x0, r0}}, {}, [], {{}, {}, {0x85, 0x0, 0x0, 0x85}}}, &(0x7f0000000000)='GPL\x00', 0x0, 0x0, 0x0, 0x41000, 0x8, '\x00', 0x0, @fallback=0x6, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) openat$sndtimer(0xffffffffffffff9c, &(0x7f00000006c0), 0x1a0001) openat$udambuf(0xffffffffffffff9c, &(0x7f0000000480), 0x2) socket(0x400000000010, 0x3, 0x0) openat$sndseq(0xffffffffffffff9c, &(0x7f0000000600), 0x183c81) socket(0x10, 0x3, 0x0) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000140)) r1 = openat$iommufd(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) ioctl$IOMMU_IOAS_ALLOC(r1, 0x3b81, &(0x7f00000003c0)={0xc, 0x0, 0x0}) ioctl$IOMMU_TEST_OP_CREATE_ACCESS(r1, 0x3ba0, &(0x7f0000000340)={0x48, 0x5, r2, 0x0, 0xffffffffffffffff, 0x1}) r3 = openat$rdma_cm(0xffffffffffffff9c, &(0x7f0000000940), 0x2, 0x0) socketpair(0x1, 0x1, 0x0, &(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}) bpf$MAP_UPDATE_ELEM_TAIL_CALL(0x2, &(0x7f00000001c0)={{}, 0x0, &(0x7f0000000100)=r4}, 0x20) writev(r3, &(0x7f0000000040)=[{&(0x7f0000000100), 0x6b82}], 0x2) executing program 1: ioctl$vim2m_VIDIOC_S_FMT(0xffffffffffffffff, 0xc0d05605, 0x0) r0 = userfaultfd(0x801) close_range(0xffffffffffffffff, 0xffffffffffffffff, 0x2) ioctl$UFFDIO_API(r0, 0xc018aa3f, &(0x7f00000000c0)) mprotect(&(0x7f0000000000/0xf000)=nil, 0xf000, 0x1) ioctl$UFFDIO_CONTINUE(r0, 0xc020aa08, &(0x7f0000000080)={{&(0x7f0000400000/0xc00000)=nil, 0xc00000}}) executing program 4: r0 = syz_open_dev$hiddev(&(0x7f00000000c0), 0x0, 0x0) ioctl$HIDIOCSREPORT(r0, 0x81044804, &(0x7f0000000400)={0x1}) executing program 7: r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f00000018c0)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000001900)=ANY=[@ANYBLOB="280000001e0001"], 0x28}}, 0x0) executing program 1: ioctl$SNDRV_CTL_IOCTL_ELEM_WRITE(0xffffffffffffffff, 0xc1105518, &(0x7f0000000040)={{0x0, 0x0, 0x0, 0x0, 'syz0\x00'}, 0x1, [0x4, 0x3, 0xfffffffffffffffe, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x801, 0x0, 0x0, 0xfffffffffffffffe, 0x0, 0x40000000, 0x0, 0x0, 0x0, 0x0, 0x2d8, 0x0, 0x470, 0xa7, 0x8, 0x8000000000000000, 0x0, 0xfffffffffffffffe, 0x9, 0x0, 0x2, 0x0, 0xfffffffa, 0x3, 0xfffffffffffffffe, 0x0, 0x400, 0x0, 0x0, 0x0, 0x2, 0x3, 0x7, 0x1, 0x0, 0x8000, 0x7, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4, 0x0, 0x0, 0x4, 0x4, 0x0, 0x0, 0xfffffffffffffffc, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x0, 0x8, 0xf5, 0x0, 0x4, 0x0, 0xd318, 0x2000000000, 0x0, 0x4, 0x0, 0x1000000000000000, 0x0, 0x0, 0xfffffffffffffffc, 0xffffffffffffffff, 0x0, 0xfffffffffffffffc, 0x0, 0x6, 0x0, 0xfffffffd, 0x8, 0x7, 0x6, 0x800000, 0x0, 0x101, 0x272f, 0xd721, 0x0, 0x4, 0x0, 0xffffffffffffffff, 0x1, 0xfffffffffffffffd, 0x0, 0x0, 0x0, 0x1, 0x4, 0x5, 0x1, 0x4000000, 0x5, 0x0, 0xdc5d, 0x0, 0x0, 0x1000, 0x0, 0x0, 0x0, 0x4000000000006fd, 0x0, 0x6, 0x0, 0x0, 0x0, 0x100]}) r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000140), 0x40241, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000000)={'syzkaller1\x00', 0xc201}) r1 = socket$kcm(0x2, 0xa, 0x2) ioctl$SIOCSIFHWADDR(r1, 0x8914, &(0x7f0000000080)={'syzkaller1\x00', @link_local={0x1, 0x80, 0xc2, 0x0, 0x0, 0x1c}}) write$tun(r0, 0x0, 0xfdef) openat$iommufd(0xffffffffffffff9c, 0x0, 0x0, 0x0) fstat(0xffffffffffffffff, 0x0) r2 = syz_open_dev$usbfs(&(0x7f0000000240), 0xb, 0x101301) r3 = socket$nl_generic(0x10, 0x3, 0x10) setsockopt$inet_sctp_SCTP_DEFAULT_SEND_PARAM(0xffffffffffffffff, 0x84, 0xa, &(0x7f00000001c0)={0x8, 0x6, 0x6, 0x0, 0x2, 0x5775d27c, 0x158, 0x20100}, 0x20) sendmsg$nl_generic(r3, &(0x7f0000000100)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000180)=ANY=[@ANYBLOB="4800000041000501010000000000000001010000000000001c0001000600060008000000100007007f0000017f000001910040001400020010000c00040006"], 0x48}, 0x1, 0x0, 0x0, 0x2c048040}, 0xe800) ioctl$USBDEVFS_IOCTL(r2, 0xc0105512, &(0x7f0000000200)) ioctl$USBDEVFS_GET_SPEED(r2, 0x551f) ioctl$USBDEVFS_IOCTL(r2, 0x80045505, &(0x7f0000000040)=@usbdevfs_connect) ioctl$USBDEVFS_CLAIM_PORT(r2, 0x80045518, 0x0) r4 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000040)='memory.events\x00', 0x275a, 0x0) syz_open_dev$mtd(&(0x7f0000000240), 0x0, 0x82000) write$tun(r4, &(0x7f0000000340)=ANY=[], 0x141) r5 = openat$userio(0xffffffffffffff9c, &(0x7f0000000300), 0x22242, 0x0) write$USERIO_CMD_REGISTER(r5, &(0x7f00000000c0), 0x2) mmap(&(0x7f0000000000/0x4000)=nil, 0x4000, 0x1, 0x10012, r4, 0x0) syz_clone3(&(0x7f0000000280)={0x84000000, &(0x7f0000000000), &(0x7f0000000080), &(0x7f00000000c0)=0x0, {0x1f}, &(0x7f0000000100)=""/36, 0x24, &(0x7f0000000140)=""/22, &(0x7f0000000180)=[0xffffffffffffffff, 0x0, 0x0], 0x3}, 0x58) ioctl$BLKTRACESETUP(r4, 0xc0481273, &(0x7f0000000300)={'\x00', 0x4, 0x8, 0x5, 0x2, 0xd, r6}) executing program 4: r0 = syz_usb_connect(0x0, 0x39, &(0x7f0000000100)=ANY=[], 0x0) syz_usb_disconnect(r0) r1 = syz_usb_connect(0x0, 0x3f, &(0x7f0000000540)=ANY=[], 0x0) syz_usb_control_io(r1, 0x0, 0x0) syz_usb_control_io$printer(r1, 0x0, 0x0) r2 = syz_open_dev$char_usb(0xc, 0xb4, 0x0) ioctl$EVIOCGMASK(r2, 0x5b03, 0x0) executing program 7: r0 = syz_open_dev$vim2m(&(0x7f0000000100), 0x0, 0x2) ioctl$vim2m_VIDIOC_STREAMOFF(r0, 0x40045612, &(0x7f0000000040)=0x1) ioctl$vim2m_VIDIOC_QBUF(r0, 0xc058560f, &(0x7f0000000180)=@mmap={0x1, 0x1, 0x4, 0x100, 0x81, {}, {0x4, 0x8, 0x8, 0x5, 0x29, 0x9, "0adb3fb8"}, 0x3}) write$uinput_user_dev(0xffffffffffffffff, &(0x7f0000000400)={'syz0\x00', {0x3, 0x2, 0x6, 0xfffa}, 0x3a, [0x8001, 0xc95a, 0xf, 0x8, 0x80, 0x2, 0x7, 0x7f, 0xa9, 0x4d, 0x6, 0x5f, 0x9, 0x15, 0xffff2d37, 0xff7fff01, 0x6, 0x5, 0x7, 0x5, 0x4, 0x0, 0x7, 0x3c5b, 0x1, 0x20, 0xd, 0x1, 0x0, 0xffffffff, 0xe661, 0x6, 0x7, 0x5, 0x8, 0x4c74, 0xffff7fff, 0x7, 0x3, 0xe, 0x0, 0x80008071, 0x7, 0x17, 0xffffffff, 0x7, 0x5, 0x80003e, 0x18e, 0x6, 0x6, 0x0, 0x8, 0x4, 0x8, 0x3ff, 0x80, 0x0, 0x5, 0x6, 0x8, 0x7, 0x1, 0x40], [0x10000007, 0x9, 0x8000012f, 0x8004, 0x5, 0xfffffff3, 0x129432f6, 0xc8, 0xf1, 0xe, 0x2bf, 0x6c7, 0x2009, 0xfffffffc, 0x573a, 0x0, 0x0, 0x5, 0x2f, 0x8, 0x312, 0x66abcbd2, 0xea4, 0x0, 0x4, 0x1007, 0x7fff, 0x6, 0x400, 0x401, 0x6, 0x1, 0xff, 0x7, 0x1000005, 0x5f31, 0xd, 0x4e0, 0x381, 0x4, 0xb, 0x4, 0x9, 0x8, 0x40, 0x6, 0x47, 0x8000, 0x1, 0xfe000000, 0xffff, 0x2, 0x4, 0x200009, 0x3, 0x3, 0x4000009, 0x6, 0x0, 0x3, 0xbc45, 0x48c93690, 0x42, 0x3], [0x6, 0x40a, 0x3ff, 0x5, 0xfffffffd, 0x100, 0x5, 0x9, 0x5, 0x7fff, 0x0, 0x5, 0xb, 0x4, 0x5, 0x5, 0x0, 0x1ef, 0x3, 0x8, 0x86, 0x1000515, 0x303c, 0x3e7, 0xb, 0x5, 0x2, 0x2, 0x3, 0x20000008, 0x4, 0x6cff, 0x6, 0x20000038, 0x200, 0x1fd, 0x80, 0x7, 0x4, 0x2950bfaf, 0x1000, 0xa2, 0x7, 0xcc, 0x5, 0x6, 0xac8, 0xbf, 0x2, 0x3, 0x7ff, 0x12b, 0x4, 0x1, 0xa, 0xffffffff, 0x5, 0x1c, 0x120000, 0x7ef, 0x2006, 0x80a2cd, 0x4, 0x25], [0xc, 0xbb33, 0x7, 0xb, 0x5, 0x938, 0x6, 0x6, 0x0, 0xb9, 0xce4, 0x1ff, 0x2, 0x57, 0x5, 0x3, 0x2, 0x10000, 0x4, 0x7fff, 0xfff4, 0xa620, 0x1, 0x5, 0x801, 0x2000002, 0x150, 0x60a7, 0x6, 0x16, 0xffffffff, 0x8, 0x4, 0x5, 0xca, 0x1, 0xfffff000, 0x10000, 0xf, 0x7e, 0x9, 0x9622, 0x7, 0xaf, 0x20000008, 0x5, 0x226, 0x2, 0x5, 0x0, 0x30b1d693, 0xa1f, 0xf40, 0x7, 0x530e, 0xe1c4, 0x0, 0x0, 0x5, 0x7ff, 0xd7, 0x200, 0xb, 0xfff]}, 0x45c) ppoll(&(0x7f00000000c0)=[{}, {}], 0x20000000000000dc, 0x0, 0x0, 0x0) executing program 7: bpf$MAP_CREATE(0x0, &(0x7f0000000080)=ANY=[], 0x50) bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x0, 0xc, 0x0, 0x0, 0xfffffffd, 0x0, 0x0, 0x0, 0x40, '\x00', 0x0, @fallback=0x10, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) socket(0x10, 0x803, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x1, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000380)={0xa, 0x100008b}, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000200)=0x8) openat$sequencer(0xffffffffffffff9c, &(0x7f00000001c0), 0x80200, 0x0) r0 = syz_open_dev$sndmidi(&(0x7f00000004c0), 0x2, 0x141102) writev(r0, &(0x7f0000000840)=[{&(0x7f00000002c0)="94", 0xf000}, {0x0}], 0x2) ioctl$sock_SIOCGIFINDEX(0xffffffffffffffff, 0x8933, 0x0) r1 = socket$kcm(0xa, 0x3, 0x3a) r2 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r2, &(0x7f0000000480)={0x0, 0x0, &(0x7f0000001f40)={&(0x7f00000004c0)=ANY=[@ANYBLOB="fc000000190001002dbd700000000000ac1e0001000000000000000000000000ac1414aa00"/48, @ANYRES32=0x0, @ANYRES32, @ANYBLOB="00000000000000000c00000000000000000000000000000000000000000000000000000000000000ffffffffffffffff000000000000000000000000000000000000000000000000000a000000000000feffffffff7f40000200000000000008ffffffff00000000010006000000000044000500ac1414bb000000000000000000000000000000003c0000000200000000000000000000000000000000000001060000"], 0xfc}, 0x1, 0x0, 0x0, 0x4008000}, 0x600c010) sendmsg$kcm(r1, &(0x7f0000000080)={&(0x7f0000000000)=@l2tp6={0xa, 0x0, 0x0, @loopback={0xfe80000000000000, 0xac14140c}}, 0x80, &(0x7f00000000c0)=[{&(0x7f0000000140)='\x00\x00', 0xffe3}], 0x1, 0x0, 0x0, 0x900}, 0x60) setsockopt$IPT_SO_SET_REPLACE(0xffffffffffffffff, 0x0, 0x40, 0x0, 0x0) syz_usb_connect(0x3, 0x57, &(0x7f0000000000)=ANY=[@ANYBLOB="1201000200000040402001c60100000000010902450001010080fa0904"], 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000340)='./file1\x00', 0x0) mkdirat(0xffffffffffffff9c, &(0x7f00000000c0)='./bus\x00', 0x1d7) mkdirat(0xffffffffffffff9c, &(0x7f0000000400)='./file1/file0\x00', 0x100) mount$bind(&(0x7f0000000100)='.\x00', &(0x7f0000000080)='./file1/file0\x00', 0x0, 0x1085408, 0x0) r3 = openat$sw_sync(0xffffffffffffff9c, &(0x7f0000000ac0), 0x800, 0x0) ioctl$SW_SYNC_IOC_CREATE_FENCE(r3, 0xc0285700, &(0x7f0000000b00)={0x4, "abacd211119ca94c63377526aeb5ab2c7b9ca5fa07558139ede6dc06270ee042", 0xffffffffffffffff}) ioctl$SYNC_IOC_MERGE(r4, 0xc0303e03, &(0x7f0000000780)={"d1ed39d88b014076ab94c1fb10628c46d2e66ccdb9e581a38ebb0ddd5f307e56", 0xffffffffffffffff, 0xffffffffffffffff}) ioctl$SYNC_IOC_FILE_INFO(r5, 0xc0383e04, 0x0) mount$overlay(0x0, &(0x7f00000000c0)='./bus\x00', &(0x7f00000003c0), 0x40, &(0x7f0000000300)={[{@workdir={'workdir', 0x3d, './bus'}}, {@upperdir={'upperdir', 0x3d, './file1'}}]}) bpf$PROG_LOAD(0x5, 0x0, 0x0) r6 = syz_usb_connect$hid(0x1, 0x36, &(0x7f0000000040)=ANY=[@ANYBLOB="12010000090024206d041cc340000000000109022400010000a00009040000010301010009"], 0x0) r7 = syz_open_procfs(0xffffffffffffffff, &(0x7f0000000080)='stat\x00') read$FUSE(r7, &(0x7f0000004180)={0x2020}, 0x2020) syz_usb_control_io$hid(r6, &(0x7f0000000240)={0x24, &(0x7f00000003c0)=ANY=[@ANYBLOB="00000c000000070001"], 0x0, 0x0, 0x0}, 0x0) executing program 6: r0 = socket$packet(0x11, 0x2, 0x300) setsockopt$SO_ATTACH_FILTER(r0, 0x1, 0x1a, &(0x7f0000000100)={0x2, &(0x7f0000000040)=[{0x0, 0x0, 0xfd, 0xc8e}, {0x16, 0xff, 0x6, 0x6}]}, 0x10) setsockopt$packet_fanout(r0, 0x107, 0x12, 0x0, 0x0) r1 = socket$inet_udp(0x2, 0x2, 0x0) bind$inet(r1, &(0x7f0000000140)={0x2, 0x80, @dev={0xac, 0x14, 0x14, 0xf}}, 0x10) sendmmsg$inet(r1, &(0x7f0000000c00)=[{{&(0x7f0000010940)={0x2, 0x4e22, @multicast2}, 0x10, 0x0}}], 0x1, 0x2000c044) sendto$inet(r1, &(0x7f0000000c80)="e8", 0x6200, 0x0, 0x0, 0x0) executing program 6: syz_usb_connect(0x0, 0x4b, &(0x7f0000000000)=ANY=[@ANYBLOB="1201000200000040480b051000010102000109023900020100803209040000000000000009"], 0x0) r0 = syz_open_dev$dvb_demux(&(0x7f0000000200), 0x1, 0x2) ioctl$DVB_DEMUX_DMX_SET_PES_FILTER(r0, 0x40146f2c, &(0x7f0000000100)={0x1ff, 0x0, 0x3, 0xa, 0x4}) executing program 3: ioctl$VIDIOC_QUERYSTD(0xffffffffffffffff, 0x8008563f, &(0x7f0000000000)) r0 = syz_usb_connect(0x2, 0xb3, &(0x7f0000000640)=ANY=[@ANYBLOB="12010002ef0201406d0425080001000000010902a1000201008032080b00020e03000009040000000e0100000d240100012700006cdc0201011124020101020000000000000000020d000924030201010001"], &(0x7f0000000a40)={0x0, 0x0, 0x0, 0x0}) syz_usb_control_io$rtl8150(r0, 0x0, &(0x7f00000003c0)={0x2c, &(0x7f00000000c0)=ANY=[], 0x0, 0x0, 0x0, 0x0}) write(0xffffffffffffffff, &(0x7f0000000500)='transport=rdma,nqn=nqn.2014-08.org.nvmexpress:NVMf:uui', 0x36) executing program 0: socket$can_raw(0x1d, 0x3, 0x1) socket(0x18, 0x80000, 0x1) socket$key(0xf, 0x3, 0x2) syz_open_procfs$namespace(0x0, &(0x7f0000000280)='ns/ipc\x00') syz_open_procfs$namespace(0x0, &(0x7f0000000040)='ns/ipc\x00') socket$inet_udp(0x2, 0x2, 0x0) syz_open_dev$vim2m(&(0x7f0000000080), 0x7, 0x2) socket$inet_icmp_raw(0x2, 0x3, 0x1) bpf$PROG_LOAD(0x5, &(0x7f0000000000)={0x13, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x40, '\x00', 0x0, @fallback=0x2e, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0x1}, 0x94) socket$netlink(0x10, 0x3, 0x0) openat$rdma_cm(0xffffffffffffff9c, &(0x7f0000000180), 0x2, 0x0) socket$nl_xfrm(0x10, 0x3, 0x6) mkdirat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000)='./cgroup/syz0\x00', 0x1ff) openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000), 0x200002, 0x0) r0 = epoll_create1(0x0) socket$nl_route(0x10, 0x3, 0x0) r1 = socket$netlink(0x10, 0x3, 0x0) sendmsg$nl_route(0xffffffffffffffff, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000000080)=ANY=[@ANYBLOB="540000001000010400000000000000ffff000000", @ANYRES32=0x0, @ANYBLOB="0380000000000000240012800c0001006d6163766c616e00140002800800010008000000060002000100000008000500", @ANYRES32=r0, @ANYBLOB='\b\x00\n\x00', @ANYRES8=r1], 0x54}, 0x1, 0x0, 0x0, 0x4000085}, 0x0) sendmmsg(r1, &(0x7f00000002c0), 0x40000000000009f, 0x20) executing program 1: r0 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r0, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000001680)=ANY=[@ANYBLOB="140000001000010000000000000000000500000a28000000000a030000000000000000000a00000708000240000000020900010073797a31000000002c000000030a010100000000000000000a0000070900010073797a31000000000900030073797a320000000014"], 0x7c}, 0x1, 0x0, 0x0, 0x40001}, 0x4040850) sendmsg$NFT_BATCH(r0, &(0x7f0000009b40)={0x0, 0x0, &(0x7f0000009b00)={&(0x7f0000000240)=ANY=[@ANYBLOB="140000001000010000000000000000000500000a48000000030a0fdb00000000000000000a0000050900030073797a30000000000900010073797a310000000014000480080002403cb140bb0800014000000003080005400000000014000000110001"], 0x70}, 0x1, 0x0, 0x0, 0x4000850}, 0x24000840) sendmsg$NFT_BATCH(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000cc0)={&(0x7f00000002c0)={{0x14, 0x10, 0x1, 0x0, 0x0, {0x3}}, [@NFT_MSG_DELCHAIN={0x2c, 0x5, 0xa, 0x101, 0x0, 0x0, {0xa, 0x0, 0xa}, [@NFTA_CHAIN_TABLE={0x9, 0x1, 'syz1\x00'}, @NFTA_CHAIN_HANDLE={0xc, 0x2, 0x1, 0x0, 0x1}]}, @NFT_MSG_DELRULE={0x20, 0x8, 0xa, 0x101, 0x0, 0x0, {0xa, 0x0, 0x9}, [@NFTA_RULE_TABLE={0x9, 0x1, 'syz1\x00'}]}], {0x14}}, 0x74}, 0x1, 0x0, 0x0, 0xb0}, 0x20008890) executing program 1: sendmmsg$inet(0xffffffffffffffff, &(0x7f0000002140)=[{{0x0, 0x0, &(0x7f0000000540)=[{&(0x7f0000002280)="21ae1baf930b4569b9ddef9797ffd935c7d80e6466b3e4e62dd4603583f5d4b61fbc65b6ac744d7319535e75bf552062e4cfde1ba7ce29263322e18ea9740aa89f69c47a63133708cda00d2b1f4e799bd41e3f76258180fa91a42aaa8b1ebc4e0ea8fb12f2c71e6e5bc57a8e91f254005514721d93c13c5606ae1fea7f31f558d562bd5a8dfb0b9fed873efa221fccffa84fcd374c92e6cbb03e6a9de890ce323f000000abcc6c01326d588495b7c1a7db31ec4129e6336f26bb9e0b7552af3cd2d5dda1632799bbc98425c433384d8a8e4071ff39a36dfde5f05af35a4ddd340cfecd7ec935f4ce7d3e851583ba1cf53a90a7f7bce5703de57ce93ddef7849b30a01de0637e6d5e507b801d32e582e0c2d564539ebfc84c098a23e765552767b122885fb1629e9c180be47da7931bd125b80de1594b75e5371a81c2c32d0c4a028a5aab0c56a2edf2e0483b87f5ab299dc046076203dea10ccbfc631d5bf4a87ce67004519f248f086346ce6a8a9d181789a59f81d9b7f6781daac3e229914b8b8998c15c3b6302a519331cb05995bc60b7cb872dd3b5b43331c77c5d72e21f7bd2b1a915ff3204e3f20d3a20b22d6a58155b5a4ebf6d1d1cd90c656ecada531c07ff91deb3efa91762cdecfbcc43553750f22ac5c18cc5e8b6f790c2f4e6373af9f98d10e6df49ff8e5cbcbd68e11ed0b967add11410dc2e34f08dbfaf8eb95d4d1153b4c6093192a340eb30fcc71619888c6486746a049585d249efb96b9cace83320b8f96b40ebe3a9a788d05a053380d1026b9434df87a3a387549bcabe88684c4d0948a6e219b5769480e6d0a9bf0da9a5212f3dbc8d1dff240856691243b203d7edd4d3cc89a38a6c80fdb1229a01044af7aaecb20d5570ebf24b30bbc6dfc3f70d85cd9f0d60ebd8fedd161d199d9997a0e2d18d1c99bc7158564e0ddb4673055de196535d706d142e1dc7d404583923cb1b286cfc5418884ac7e605d93652dc48ff8261c63790a91ee2c5ff9a21677b4bc7e73ddf2d0e46807c57bf64b0b9df7fc67ecba6521767dcc7d4299c740e73bc49cbcf0049faf222c48896378497c0a7be6238217f85c83a2c45376ddf1a8f631c22c8cf453e8a4fe7bf8160a82bd069be9a9e163724a7412bbc30b68bb31bd571f0571297726a309691408af62ecfc77ea52718c39e802f00a726aaa625407f3b18fd4f66db2bbd05dfd62e448fc6bb9fc51960e12b67c5d42e82df55f5d87428137874e27db5cc", 0x37d}, {0x0}, {&(0x7f0000002200)="f610e61ac81cc3edc86f0500", 0xc}], 0x3, 0x0, 0x0, 0x900}}], 0x1, 0x0) r0 = socket(0x10, 0x803, 0x0) sendto(r0, &(0x7f00000000c0)="120000001200e7ef007b00000000000000a1", 0x12, 0x0, 0x0, 0x0) recvmmsg(r0, &(0x7f00000037c0)=[{{&(0x7f00000004c0)=@ethernet={0x0, @random}, 0xfdf4, &(0x7f0000000380)=[{&(0x7f0000000000)=""/102, 0x365}, {&(0x7f0000000280)=""/76, 0x14c}, {&(0x7f0000000fc0)=""/4096, 0x197}, {&(0x7f0000000400)=""/92, 0x645}, {&(0x7f0000000980)=""/73, 0x1b}, {&(0x7f0000000200)=""/77, 0x188}, {&(0x7f00000007c0)=""/154, 0x2c}, {&(0x7f00000001c0)=""/17, 0x1d8}], 0x21, &(0x7f0000000600)=""/191, 0x41}}], 0x4000000000003b4, 0x0, &(0x7f0000003700)={0x77359400}) program crashed: general protection fault in mxl111sf_ep6_streaming_ctrl bisect: bisecting 50 programs bisect: split chunks (needed=false): <49> bisect: split chunk #0 of len 49 into 3 parts bisect: testing without sub-chunk 1/3 testing program (duration=6m8s, {Threaded:true Repeat:true RepeatTimes:0 Procs:6 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): [20, 4, 2, 19, 5, 5, 2, 4, 28, 20, 3, 7, 3, 24, 16, 3, 12, 11, 4, 19, 6, 2, 2, 24, 7, 5, 30, 7, 3, 4, 19, 4, 4] detailed listing: executing program 4: r0 = syz_usb_connect(0x0, 0x2d, &(0x7f0000000000)=ANY=[@ANYBLOB="1201000083667d1040206402d14e0102030109021b000100000000090400000190f19c00090584"], 0x0) syz_usb_control_io$hid(r0, 0x0, 0x0) ioctl$sock_FIOGETOWN(0xffffffffffffffff, 0x8903, 0x0) syz_usb_control_io(r0, 0x0, 0x0) syz_usb_control_io(r0, 0x0, 0x0) syz_usb_control_io$cdc_ncm(r0, 0x0, 0x0) syz_usb_control_io$uac2(r0, 0x0, 0x0) munmap(&(0x7f0000001000/0x3000)=nil, 0x3000) add_key$keyring(&(0x7f00000101c0), &(0x7f0000010180)={'syz', 0x1}, 0x0, 0x0, 0xfffffffffffffffd) syz_usb_control_io$uac1(r0, 0x0, 0x0) syz_usb_control_io$hid(r0, 0x0, 0x0) syz_usb_control_io$printer(r0, 0x0, 0x0) r1 = syz_open_dev$I2C(&(0x7f0000000100), 0x2, 0x1) ioctl$I2C_RDWR(r1, 0x707, &(0x7f0000000180)={&(0x7f0000000140)=[{0x7, 0x0, 0x1, &(0x7f0000000080)="ce"}], 0x1}) syz_usb_control_io$lan78xx(r0, 0x0, 0x0) syz_usb_control_io(0xffffffffffffffff, 0x0, 0x0) syz_open_dev$tty1(0xc, 0x4, 0x1) syz_usb_control_io$hid(0xffffffffffffffff, 0x0, 0x0) r2 = seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0x0, &(0x7f00000000c0)={0x1, &(0x7f0000000040)=[{0x6, 0x0, 0x0, 0x7fffffff}]}) close_range(r2, 0xffffffffffffffff, 0x0) executing program 3: r0 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r0, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000001680)=ANY=[@ANYBLOB="140000001000010000000000000000000500000a28000000000a030000000000000000000a00000708000240000000020900010073797a31000000002c000000030a010100000000000000000a0000070900010073797a3100000000090003007379"], 0x7c}, 0x1, 0x0, 0x0, 0x40001}, 0x4040850) sendmsg$NFT_BATCH(r0, &(0x7f0000009b40)={0x0, 0x0, &(0x7f0000009b00)={&(0x7f0000000240)=ANY=[@ANYBLOB="140000001000010000000000000000000500000a48000000030a0fdb00000000000000000a0000050900030073797a30000000000900010073797a310000000014000480080002403cb140bb0800014000000003080005400000000014000000110001"], 0x70}, 0x1, 0x0, 0x0, 0x4000850}, 0x24000840) sendmsg$NFT_BATCH(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000cc0)={&(0x7f00000002c0)={{0x14, 0x10, 0x1, 0x0, 0x0, {0x3}}, [@NFT_MSG_DELCHAIN={0x2c, 0x5, 0xa, 0x101, 0x0, 0x0, {0xa, 0x0, 0xa}, [@NFTA_CHAIN_TABLE={0x9, 0x1, 'syz1\x00'}, @NFTA_CHAIN_HANDLE={0xc, 0x2, 0x1, 0x0, 0x1}]}, @NFT_MSG_DELRULE={0x20, 0x8, 0xa, 0x101, 0x0, 0x0, {0xa, 0x0, 0x9}, [@NFTA_RULE_TABLE={0x9, 0x1, 'syz1\x00'}]}], {0x14}}, 0x74}, 0x1, 0x0, 0x0, 0xb0}, 0x20008890) executing program 0: r0 = socket(0x1e, 0x1, 0x0) sendto$rxrpc(r0, &(0x7f0000000000)="fb5a0c5a28bff4d1eabc9b5e1b002907e42f898086b6bd3a0e8ac1187bc611911486c8bac2fbe135179cc1af68b7b1b77ef66df43b71636ab0f3e86a90855ff090e2ed7b1f446091934082de9b302cdf509d5038867b833afdd95183930c0ab8ccdc74c131f83b97caa6739b434bdf1c", 0x70, 0xc0, &(0x7f0000000100)=@in4={0x21, 0x4, 0x2, 0x10, {0x2, 0x4e21, @multicast1}}, 0x24) executing program 7: socket$inet_smc(0x2b, 0x1, 0x0) socket$inet_udp(0x2, 0x2, 0x0) socket$nl_generic(0x10, 0x3, 0x10) socket$nl_netfilter(0x10, 0x3, 0xc) r0 = bpf$MAP_CREATE(0x0, 0x0, 0x0) bpf$PROG_LOAD(0x5, &(0x7f0000000600)={0x1, 0xf, &(0x7f00000006c0)=@ringbuf={{0x18, 0x0, 0x0, 0x0, 0x107a655, 0x0, 0x0, 0x0, 0x10}, {{0x18, 0x1, 0x1, 0x0, r0}}, {}, [], {{}, {}, {0x85, 0x0, 0x0, 0x85}}}, &(0x7f0000000000)='GPL\x00', 0x0, 0x0, 0x0, 0x41000, 0x8, '\x00', 0x0, @fallback=0x6, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) openat$sndtimer(0xffffffffffffff9c, &(0x7f00000006c0), 0x1a0001) openat$udambuf(0xffffffffffffff9c, &(0x7f0000000480), 0x2) socket(0x400000000010, 0x3, 0x0) openat$sndseq(0xffffffffffffff9c, &(0x7f0000000600), 0x183c81) socket(0x10, 0x3, 0x0) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000140)) r1 = openat$iommufd(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) ioctl$IOMMU_IOAS_ALLOC(r1, 0x3b81, &(0x7f00000003c0)={0xc, 0x0, 0x0}) ioctl$IOMMU_TEST_OP_CREATE_ACCESS(r1, 0x3ba0, &(0x7f0000000340)={0x48, 0x5, r2, 0x0, 0xffffffffffffffff, 0x1}) r3 = openat$rdma_cm(0xffffffffffffff9c, &(0x7f0000000940), 0x2, 0x0) socketpair(0x1, 0x1, 0x0, &(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}) bpf$MAP_UPDATE_ELEM_TAIL_CALL(0x2, &(0x7f00000001c0)={{}, 0x0, &(0x7f0000000100)=r4}, 0x20) writev(r3, &(0x7f0000000040)=[{&(0x7f0000000100), 0x6b82}], 0x2) executing program 6: r0 = socket$inet6_tcp(0xa, 0x1, 0x0) socketpair$tipc(0x1e, 0x1, 0x0, &(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}) sendmsg$tipc(r1, &(0x7f00000003c0)={&(0x7f0000000180), 0x10, &(0x7f0000000380)=[{&(0x7f0000000480)="c3e972bd85a6d84136d6dd55048d3593a74f338ce6772ab9a6f64041c2f6fbbecdc08ebcd3192b6a53662dae7c8e9c665e80a5d0925f728dcac30c29793992e588952653d414cb8ccdabc38767fee819ec5af0c5ee936880fe8549b4ed347779cab4ffd4e0b62c53a1c01db28f2b3f91c34211c9353bc1dece61511917c2245fd66cb8dffeacb4d46d627c97b498bf1ff6b313bfbc9765457c831771d5eec7997ec242e4505f01c1bb3e06", 0xab}, {&(0x7f0000000300)='V', 0x1}, {&(0x7f0000001600)="3eed50d0125719a810f88e3f47186fe4dae74182dfd109a2587c4797410c9b8e39bd3d9aa144d5908647c30c8db69b5c17084c9b1bfbb8680737c4f88abcdbc7d294d72ab1b344270915df9ddf5635644c351c22b29d948ac4106bce7107570beed63077cfbc98ef71699eae65d37724d995b553e7a3ade619b522313ab382caf879feb48942878e605ee3ee2872794e3abe22a3f025068b628a5d92468092a5cc649bbbd978b5772e537939432a502122235ced312dafd108c9ffeb0b38cc16da9418ca01d485a6afb5827da4df6e1121ec307de14bb32b6a977608e4576a998182dd93d592ff43e55bfdbbce23ecd501e43b3e93ef8d9d01711dff54c301e299d3801a3cffe6c9883fbd0e47124dc02569f62d48b878fcb58ce99fcffcd2a5166eff3ad93cf1d137274993d86a3b3730d63ded759f6ca88fa449e5575b15321e5a58a1f888eed7466db4976ce35f6d2efb5ad05d99a66482dc607cb5acb24d326803bd337519cc98103f59c63b5962cd72e4497d1b00817d6e09de70270a09b493c2226617b1c9ef9d506be00d6e07f14633a966f04ecca90fb8d2b963ad6f3817935bd6534fa3da1c5dc468789cbf1192f3c0bff3777f1edd2ada5d35f88f12f29e952c44445ce623509d66811c80a9e0f13ad85aba37d86ff0da4dda601d9e8acb264233bc939fb056316612cff687d5c44157be05bcc88b333ff2a40041d98f1acfe6e2231a84e09bd7a54a0442cf87ce3ee8fd8da39da1862862ae40fc3cb3055c8b70e62f243850707341f51426bb3e71c7a4fffefab060db786000618b05eb087a424a2f30f6a232ff44b605f70ceec0a8f70e37907f6e0bbba21e9d5b7ecb6d287742b75c101ba79525918c3473eae38f3c177249dfa8816661c9921f0b0c858d53ab87c8407b97950c842111002edd1d1e80b801b495da28bcd5409bc971e55dab1857e188ac9728efc8f9a4543945f86ade13b445eacecbbf848a96410ac37c57e3e9e8bc8b8fadd559d225c7468639da2b5d1208558b51e94c14faa7947a7c60e81a96bb5d194cc7289adbc02ebb4b49be1f1efc429db2f9b79b5a22919dba0c35341042c5776942c52365367c4bfc95b42be383cca7107161ded7e851d0126da33d581f1e2b08d0c061e86d31e7a83f9b51c79b4034c7deda7697034e1404c6e8e459f76c2efe64350146c7437ef808e04ca14df5f6f500264fd977272bbf8fc096774e8eb61d0963430751ac1425a073f84346b0eba368cba7fa34adc420800d4f99927280eba199f9695cf88124fafc3a2b1226d2f2ab3ea27c69a127650cf5c725b54c02bd8729033cf699ce7f030f9a3442056244da3cfb61a8126dba11377624f39eb009242152fd7b8b88de7dd86057f29bfcb7b7df0e65e7e9ac9eeaa41afa62743698bff03d5b2d51fb6bca2d92294e8e177cfa3661b26f1c040e9bed983b7bc0aa154eb9c92e4ee25091318c53113a1c23ac62d2d71504cba99041f29a4f332133292cf20abec9222a2acca57cac48fa6c0668ee5eecb494741a64d33b011dcca74696d4614c5b45a5d20983b1708d365ed3ffa60f9161972a611c22642c3c259b41f943f6d7a8b60f284d325e38fe76f0645e069ff70cae38850ccf973193b6232c987df26239a574691f7f07fffa6deae1eb0324fe546573c36f2a2c31cd442517a9b036ae6a2a491e7343864693c107a5dc2585820863c146c1ba6caa4fea9b87d567716f4c8ca1a9d2848055cd750512d3b7415d090019dc8a04a1a1d28931093cd8f00e94c407ca1fa2a5ce903d9df26e008c07cd13afa783220e1bd5e6b60645f3dbb6ecb4156fedafa2dd25498c6a99d94f0b38125ea7741b75109dcac9f80635f79f5c8a0483bb9f05a3a5bf721c7541edb252449f8b13e63c370a6146332f03ca1f1b6fe0bed984f13744bb7fa0fe322e83ddf9ffb2083e94f33604a0a199220c450dad94bf154805e7f9e4350ca2d81adf2978c87dcc8a8a7d56297ec124bfef0d28f35777205e973272c87e01070f14f5b14daa3b5104d9ff6b296c4f16ed49eb42d35e7ba3bccb7a26c33a263df88aadd596e9d9de0abbd4d449df11081f2cd62e1d8962b9b9feb25a3b8e03537d61a61c11ac22b7211d12c84e60a6abcc219e558b2513d8c530b3c7a57cdc47de545aafbb2a13c0e6c75b1b92fa241c713c83a09c92b2b61d565120372a9143415583c9596f27a663d4967cd653b08cebd6cb96c1f0dc80d57267ac9a8281d7149bde880828ee27d69a6818db58320db29d1b044eaf6ab8a5108bc522de406990b5393b1f7e7bab71bf6cf8eed1cd59c7607d662e8b313f5c4fce0f59b1027371381011b63dd5b2b09739082c0d62ffad96e30153a395234937d377c32fe7af82aca3a19d0ebc4a5c5fb5ff190f14d5695c703b571fb4bf03756635cafc6cf6267eab836c347a9d07e8089fc105346934cf3364e5be370b3c42b94bc5ae3d17a817398566a2953251eb91697d67278145df9a4b917bcca1bf211780b22f4caacfcb7604c84f943d05f6fdf8edbd258d7d8dbf84f9d99e57472c5b1c2337d749a1f345e662e2536d23c7a63bbbbf00f8b5b0a2106a0342ab27b9a10b82e82668cd49e0cbb09d7be0217645f1dda3be59c8232fa290d34791cda52aa5b5cec6339ab96a2eb3f5328cc7c0e6717c2824344547a2ed518f6b2b4e4fe5b684596aa6a9d3988fc5d5ff4cb46cec99d951b8386b10949a163af974b7543df97b4882a4ed60e927a1deb67c5f814235bef65fea79a2c712815be7403c93a3707fb90d4604ec3a6a3b0928f253f6ab6bd56c958e026c8c58172c4ac2a3efe2ecd5cea70c8313f9ac2d638bc296ba99e2ca86d2fd06b5402cdcddc3f3c9845d5ae77f6f36963b91e8f6cdccd17abe8d40ed02463af4bb0e496344f350097f1cc13313fa1e172b63556ed2b8a8121c01a5fb343ff7767821626fc49b0d6bd522e1c9bf137d5a5bccb4bc8dbb64c83a82ef6c2894f3896c9f6bf0c3764011d53eeb6db9ea9dae22d3ebcca4942d5828c0bca0d9ea37701d5a06c066ac4fe318e11e9c0d6c658ac810fb5d7836cfffe4ccbb0934e5567d74695980a156d4bf1c18861c5a29ccd349999dc20562d00e1f6c1851ae563541086438d60b975c8ceb466414ff60efa0b2dee790fd0659ffa98b92414c13d5a6825368f56c4984412205041cd8e006c7127d4395ecdffb5addf80ef938ce54a367154c4fc286d5f969325c12b13655a9a956dd3b98281f537e837669fc55d8930676e807aa8cd046e0f4583d59f86cb99f3f7a7ddde1fb39111fdec7677d2fee4b8f4814a5def5ebcc67c653384ce80eaffd880405f7edf8fd3ea049f040595df4a75e2f892e7a85e0ba351fb8d263bfff7168bb85017b360fcd2ba89346682a6ea7ccc46afbdb5ab444e3f477238b2ab503bde914d3cf1789539cde9c0621152cd97bff9f235d88a1ef4ea4309db3a05d401af7fb82784b050ef529dab4f1f003eb29710a962f7538c521e617e2f0efac36182d09985e1d725cc38c3833a53742a02f76fb2854a9e45f0febacf3bda83f11183ef5b9fef02ebcdf56d4104b175bad937d8f61964f97d673577cdcbbb48d8eb62b063ee6563b9ff053719baff871bcd83822d865b2f7ef023076425ac5cd71b1f2309de0c6f14cc9c4d3e8fad945f756a7c8a084ea1bfdf5ac6e740043e7f7bdaca06774b084ae314c2636529d4fdcd965c7f8c07156572620b827d694efdc9d2bfc5aa9391220a83765f2c71fcd48d4acaed60afb53d1013fa3b15e948ec4159f7d130ef85b594018346e99034c18738285223ea53a6b1d5cf11a607de2e19608ba03ec970a915b773824261f3fc931dd6d3b934d89f07baf14776314c3eeb8cd0537ef5736f565fbd14e520d4ab2f77ed9597b76ff91f8d1f99ebd6e473efda7accb273975a06944d1037032129992b994ca791a09b4d83980a1e494b0f97098df5f6fb6bbb02722adb11dc319c565c2c363cbd19d9fb3efb4613b62d6584cd53f7bd80e3e89304f444ce9dd1835661e3bb4de02ccf568a2a5daaf0d56898d4286c3fb62e22af62d7ac318685834467f337561dde2e0c1e2827cdffcf42c17728ee64b3ff4ccc0227590badd0bd7e448b8cca0892d6a5e0130d2ac665f47c6b28daa101c1b319869bdd39fa924d6d9ba7d72feda5f21ac78641c7d4801d41c7879721b3be4dab40d9c4a78552440101f373489cc5240b0144a9ce32691a784b6dfe971a21bb5980ff67da2d1bb90b223c9e192a39c1aeadd1f5c790811079c0b51a97105c99b6f95d71bb3ea47c33d9dcb0a53c929c44499e184a3cd722c908d3b0d157e28ffdeb2ed7192e780d96a7a2f0fd5a87bdc973e049da0caf931f26f5a21813e2e602ceb2259997e0205ce48fd9424bd6d4d75dd4301f429ee30745cd839a40dbeab4c3db2f0f10bbaea071ca41d1392385681730a3678a5f60f604dbe19cb9d7dd234337e327451b8cc65394af399432ef7fc3765d055874ebdca14e5999292d6f72f31e92bacf25db5ef8f5212952c1910de06ddbe1687a0e1837922f2228289916ed3aeb7b9cc24da3ae47139e371930afa6d3573df6732c26c0c7ae06d9cedfa77160711bcb06e6553338deae4c5731cf53cc154113096d02f3036d7d9edfcdc331e4bb860c5208489212e904eab70e7f860b0379895cbdecbf7a0b7a25e5b853c7dbe08a4e296a30afec8cf5a9f6ea4aef32a508655d539a770b21e660c9ee1d7688c56abeb7cf1afccc8d59780cf26312589e0c8e1bc00ad7b1325cd9a5dd69246e0b33407c381ea09265154aec297e4ccdf9785a1042a83e77c13d4ce4360782f2428f9916b5cd123b089eb683d30c1e895b9944aa905a1a5b52301d8cc5e4741834ead6ebdb5dc05c9c49c5e883e99d40b9838037beaf876534d747856103e59caf6266fbbe760b6ef83d004634b74f14f8eb4aef93c4cc9cbbd78d83d532c70feef51ea3f170b25d81a6a9b074bfca7e9b3771bf83517e0dd9d0600f70b86b20f61fe36076f8bada334b2390fa954973bc901619a3cfd039349cb328625f495ab288dbdd6dbfd022c2a83f59e0b998619a12e35891b5ae9e83a71765507b4a571cd2241e5885c705244c1022688bef7c5065fbcf219fc01753adb611b3fbc09403dcb10a4f99d788667eff75fa27074ca8481a633530e26163ccf7dada049d23e717e067b6fa5b2f652bc50abda9e7ccdc5f2f3c35ecc2c4431c819c9691be4422e379750774e9f39dae06f26423c8a4278789c9f3111b43f6dd25b0ad47c4cc5fda3f3ed82079c9366e0adced883488f429c1d7e1b351fd0bb204dd7977ef224c4df6d7a5f7697bc6500a7d03a8a914154779fa7092bf1be6bad4092367ce5d295a5d5d0e7c469f372ca2011d612637025e89f178ae9ada0c5b73bcb7d7c034ff595263cd4216e3c76ba5f3d81932a088a90bf8043e877e299c670ef1622a098d5519d9adc4ee7d4cd00e5934a4375fa83fdb81214b892482b31bdde59a70aaf25cb7f417c3a2a91c4e54b48149f6c41d9d396ee6ff13e3028c64a7c9b1f2e7c6e67184a3d52d6f570db3d225c947423c4c6533f22df57d15c5e5a3183422bd378b06fe4732a9401dcb19840fb8fa5c50a0ff497fef362c507753e46b8881d3e767f3b1d893a3805941c94f2efa05ce34b9ea81d716984af6834230d4707a87089d40779503ee6a9bb245d7d997f14acb80e89731c042bbbbe3dcd05177b0ee0eec23455830ef5b65aca357f2b0b887e0b9821c0", 0x1000}, {&(0x7f0000000340)="b768eb20304f2fdc5a9694a4867840d93170ca1a86406f", 0x17}], 0x4, 0x0, 0x0, 0x8010}, 0x0) sendmmsg(r2, &(0x7f0000005280), 0x4000000000001cd, 0x1008c811) close_range(r0, 0xffffffffffffffff, 0x0) executing program 3: r0 = socket$nl_generic(0x10, 0x3, 0x10) ioctl$sock_SIOCGIFINDEX_80211(r0, 0x8933, &(0x7f00000000c0)={'wlan0\x00', 0x0}) r2 = socket$packet(0x11, 0x2, 0x300) bind$packet(r2, &(0x7f0000000040)={0x11, 0x7, r1}, 0x14) write(r2, 0x0, 0x0) executing program 0: r0 = syz_open_dev$hiddev(&(0x7f00000000c0), 0x0, 0x0) ioctl$HIDIOCSREPORT(r0, 0x81044804, &(0x7f0000000400)={0x1}) executing program 7: fcntl$lock(0xffffffffffffffff, 0x7, &(0x7f0000000040)={0x0, 0x0, 0x8000, 0x3ff}) mprotect(&(0x7f0000000000/0xf000)=nil, 0xf000, 0x9) r0 = socket$netlink(0x10, 0x3, 0x14) ioctl$FIDEDUPERANGE(r0, 0xc0189436, &(0x7f0000000040)=ANY=[]) executing program 0: prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x1, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000380)={0x8, 0x100008b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000200)=0x5) openat$sequencer(0xffffffffffffff9c, &(0x7f0000000300), 0x80200, 0x0) r0 = syz_open_dev$sndmidi(&(0x7f00000004c0), 0x2, 0x141102) writev(r0, &(0x7f0000000840)=[{&(0x7f00000002c0)="94", 0xf000}, {0x0}], 0x2) r1 = socket$unix(0x1, 0x2, 0x0) sendmsg$kcm(0xffffffffffffffff, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)=[{0x0}], 0x1}, 0x0) r2 = syz_genetlink_get_family_id$tipc(&(0x7f0000000040), 0xffffffffffffffff) sendmsg$TIPC_CMD_SET_LINK_PRI(0xffffffffffffffff, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000000080)={0x68, r2, 0x1, 0x0, 0x0, {{}, {0x0, 0x410c}, {0x4c, 0x14, {0xfffffff0, @link='broadcast-link\x00'}}}}, 0x68}}, 0x0) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f00000005c0)={0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x9, 0x0, 0x0, 0x1, 0x0, &(0x7f0000000400)="14", 0x2, 0x0, 0x4}, 0x50) ioctl$sock_SIOCGIFINDEX_80211(r1, 0x8b18, 0x0) r3 = openat$vnet(0xffffffffffffff9c, &(0x7f0000000000), 0x2, 0x0) r4 = openat$tun(0xffffffffffffff9c, &(0x7f0000000080), 0x2, 0x0) ioctl$TUNSETIFF(r4, 0x400454ca, &(0x7f0000000100)={'\x00', 0x1}) ioctl$VHOST_SET_OWNER(r3, 0xaf01, 0x0) r5 = syz_open_procfs(0x0, &(0x7f0000000240)='clear_refs\x00') writev(r5, &(0x7f0000000000)=[{0x0}], 0x1) bpf$BPF_PROG_QUERY(0x10, &(0x7f0000000340)={@fallback=r3, 0x10, 0x1, 0xa43a, &(0x7f0000000180)=[0x0, 0x0, 0x0, 0x0], 0x4, 0x0, &(0x7f00000001c0)=[0x0], 0x0, 0x0, 0x0}, 0x40) ioctl$ifreq_SIOCGIFINDEX_wireguard(r1, 0x8933, &(0x7f0000000440)={'wg0\x00', 0x0}) r8 = bpf$PROG_LOAD_XDP(0x5, &(0x7f00000008c0)={0x6, 0x2, &(0x7f0000000480)=@raw=[@map_idx={0x18, 0x2, 0x5, 0x0, 0xc}], &(0x7f0000000500)='GPL\x00', 0x7, 0x85, &(0x7f00000006c0)=""/133, 0x40f00, 0x0, '\x00', 0x0, 0x25, 0xffffffffffffffff, 0x8, &(0x7f0000000780)={0x9, 0x2}, 0x8, 0x10, &(0x7f00000007c0)={0x4, 0x7, 0x7fffffff, 0x8}, 0x10, 0x0, 0x0, 0x0, &(0x7f0000000800)=[0x1, 0x1], 0x0, 0x10, 0x6}, 0x94) bpf$BPF_PROG_DETACH(0x9, &(0x7f0000000540)=ANY=[@ANYRES32=r7, @ANYRES32=r5, @ANYBLOB="1d0000001000000000000000", @ANYRES32=r8, @ANYBLOB="27983b", @ANYRES64=r6], 0x20) ioctl$VHOST_SET_MEM_TABLE(r3, 0x4008af03, &(0x7f0000000300)) r9 = syz_open_procfs(0x0, &(0x7f0000002500)='net/wireless\x00') read$FUSE(r9, &(0x7f00000046c0)={0x2020}, 0x2021) ioctl$SNDRV_PCM_IOCTL_REWIND(r9, 0x40084146, &(0x7f0000000040)=0x8) ioctl$VHOST_SET_VRING_ADDR(r3, 0x4028af11, &(0x7f0000000400)={0x1, 0x0, 0x0, &(0x7f0000020000), 0x0}) seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0x0, &(0x7f0000000000)={0x1, &(0x7f0000000100)=[{0x6, 0x72, 0x0, 0x7fff0000}]}) executing program 3: syz_open_dev$sg(0x0, 0x8, 0x0) prctl$PR_SET_SECCOMP(0x16, 0x2, &(0x7f0000000300)={0x0, 0x0}) setitimer(0x2, &(0x7f0000000040)={{0x0, 0x2710}, {0x0, 0x2710}}, 0x0) unshare(0x60000600) syz_usb_connect(0x0, 0x36, &(0x7f0000000040)=ANY=[@ANYBLOB="120100004107f540f30c7593de1a000000010902"], 0x0) mremap(&(0x7f0000ffe000/0x1000)=nil, 0x1000, 0x4000, 0x3, &(0x7f0000ff9000/0x4000)=nil) munmap(&(0x7f000045e000/0x1000)=nil, 0x1000) madvise(&(0x7f0000a93000/0x4000)=nil, 0x4000, 0x80000000e) syz_io_uring_setup(0x7a31, &(0x7f0000000080)={0x0, 0x4e36, 0x800, 0x1, 0x2fe}, &(0x7f0000000280), 0x0, 0x0) madvise(&(0x7f0000bdc000/0x4000)=nil, 0x86ac726dff2f4713, 0xa) mremap(&(0x7f00006bd000/0x2000)=nil, 0x2000, 0x4000, 0x3, &(0x7f0000721000/0x4000)=nil) r0 = syz_open_procfs(0xffffffffffffffff, &(0x7f0000000000)='cmdline\x00') preadv(r0, &(0x7f00000001c0)=[{&(0x7f0000000300)=""/147, 0x93}, {&(0x7f00000003c0)=""/118, 0x76}, {&(0x7f0000000600)=""/14, 0xe}], 0x3, 0x7, 0x10000) setsockopt$packet_fanout_data(r0, 0x107, 0x16, &(0x7f0000000180)={0x1, &(0x7f0000000100)=[{0x9, 0xfc, 0x3, 0xa9c}]}, 0x10) munmap(&(0x7f0000a88000/0x1000)=nil, 0x1000) munmap(&(0x7f00003fe000/0xc00000)=nil, 0xc00000) prctl$PR_SET_SYSCALL_USER_DISPATCH_ON(0x3b, 0x1, 0x0, 0x0, &(0x7f0000006680)) unshare(0xa020480) socket$inet(0x2, 0x1, 0x0) openat$nvme_fabrics(0xffffffffffffff9c, &(0x7f0000000040), 0x2, 0x0) executing program 6: r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$tipc2(&(0x7f0000000000), r0) sendmsg$TIPC_NL_KEY_SET(r0, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000280)={&(0x7f0000000040)={0x14, r1, 0x1}, 0x14}}, 0x0) executing program 7: r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000000), 0x40241, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000200)={'syzkaller1\x00', 0xc201}) r1 = socket$kcm(0x2, 0xa, 0x2) ioctl$SIOCSIFHWADDR(r1, 0x8914, &(0x7f0000000180)={'syzkaller1\x00', @link_local={0x1, 0x80, 0xc2, 0x0, 0x0, 0xe}}) r2 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r2, &(0x7f0000000200)={0x0, 0x0, &(0x7f0000000000)={&(0x7f00000009c0)=ANY=[@ANYBLOB="140000001000010000000000000000000000000a20000000000a01020000000000000000010000000900010073797a300000000040000000160a01000900000000000000010000000900010073797a30000000000900020073797a3000000000140003800800014000000000080002400000000048000000160a0101000b000000000000010000000900020073797a30000000000900010073797a30000000001c0003801800"], 0xd0}, 0x1, 0x0, 0x0, 0x24040841}, 0x20048010) write$tun(r0, &(0x7f0000001280)=ANY=[@ANYBLOB="000086dd00001100"], 0xfce) executing program 1: syz_usb_connect(0x0, 0x4b, &(0x7f0000000000)=ANY=[@ANYBLOB="1201000200000040480b051000010102000109023900020100803209040000000000000009"], 0x0) r0 = syz_open_dev$dvb_demux(&(0x7f0000000200), 0x1, 0x2) ioctl$DVB_DEMUX_DMX_SET_PES_FILTER(r0, 0x40146f2c, &(0x7f0000000100)={0x1ff, 0x0, 0x3, 0xa, 0x4}) executing program 6: socket$nl_route(0x10, 0x3, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000140)={0xa, 0x8b}, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000280)=0x8) r0 = getpid() sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x2) sched_setscheduler(r0, 0x2, &(0x7f0000000200)=0x7) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeea, 0x8031, 0xffffffffffffffff, 0x28f43000) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r1, &(0x7f0000000180)=@abs, 0x6e) sendmmsg$unix(r2, &(0x7f0000000000), 0x651, 0x0) recvmmsg(r1, &(0x7f00000000c0), 0x10106, 0x2, 0x0) mmap$IORING_OFF_SQ_RING(0x110c230000, 0x8000002, 0x2000007, 0x401d031, 0xffffffffffffffff, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./sys\x00', 0x1ff) mount(0x0, &(0x7f0000000040)='./sys\x00', &(0x7f0000000080)='sysfs\x00', 0x0, 0x0) r3 = openat(0xffffffffffffff9c, 0x0, 0x2, 0x0) write(r3, &(0x7f00000005c0)="306663353a313232373a3f7092c0f0bc085a193376cf620afaf6379a248d1d6534058f1095109da34b6d6537a6e78b0dc4b7bc0b", 0x34) r4 = socket$inet_tcp(0x2, 0x1, 0x0) ioctl$sock_SIOCGIFINDEX(r4, 0x8933, &(0x7f0000000180)={'syz_tun\x00'}) mkdirat(0xffffffffffffff9c, &(0x7f0000000080)='./file1\x00', 0x1c0) mkdirat(0xffffffffffffff9c, &(0x7f00000000c0)='./file0\x00', 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000240)='./file2\x00', 0x207) mount$overlay(0x0, &(0x7f0000000100)='./file0\x00', &(0x7f0000000000), 0x0, &(0x7f00000000c0)={[{@workdir={'workdir', 0x3d, './file0'}}, {@lowerdir={'lowerdir', 0x3d, '.'}}, {@upperdir={'upperdir', 0x3d, './file2'}}], [], 0x2c}) r5 = openat$dir(0xffffffffffffff9c, &(0x7f0000000000)='./file0/file1\x00', 0x20400, 0x20) fsync(r5) executing program 0: r0 = openat$qrtrtun(0xffffffffffffff9c, &(0x7f0000002740), 0x101002) mmap(&(0x7f0000000000/0xfbe000)=nil, 0xfbe000, 0x2, 0x31, 0xffffffffffffffff, 0x0) r1 = openat$ppp(0xffffffffffffff9c, &(0x7f0000000040), 0x0, 0x0) ioctl$TUNSETOFFLOAD(r1, 0xc004743e, 0x110e22fff6) r2 = socket$kcm(0x2, 0x3, 0x2) ioctl$SIOCSIFHWADDR(r2, 0x8b0f, &(0x7f0000000180)={'virt_wifi0\x00', @dev={'\xaa\xaa\xaa\xaa\xaa', 0x35}}) r3 = openat$ppp(0xffffffffffffff9c, &(0x7f0000000080), 0x1, 0x0) ioctl$TUNSETOFFLOAD(r3, 0x4004743d, 0x110e22fff6) io_setup(0x81, &(0x7f0000001440)=0x0) io_submit(r4, 0x1, &(0x7f00000008c0)=[&(0x7f0000000280)={0x0, 0x0, 0x0, 0x5, 0x800, r3, 0x0, 0x0, 0x0, 0x0, 0x2}]) r5 = openat$sysfs(0xffffffffffffff9c, &(0x7f00000002c0)='/sys/power/resume', 0x149a82, 0x10) write$cgroup_int(r5, &(0x7f0000000000)=0x2b00, 0x12) ioctl$TUNSETIFF(r5, 0x400454ca, &(0x7f0000000000)={'dummy0\x00', 0x8000}) r6 = socket$netlink(0x10, 0x3, 0x0) sendmsg$nl_route(r6, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000180)=ANY=[@ANYBLOB, @ANYRES32=0x0, @ANYBLOB="00000000000000002c00128009000100626f6e64000000001c0002800500"], 0x4c}}, 0x0) close_range(r0, 0xffffffffffffffff, 0x0) executing program 4: r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$ethtool(&(0x7f0000000740), r0) sendmsg$ETHTOOL_MSG_PAUSE_SET(r0, &(0x7f0000000880)={0x0, 0x0, &(0x7f0000000840)={&(0x7f00000012c0)=ANY=[@ANYBLOB='D\x00\x00\x00', @ANYRES16=r1, @ANYBLOB="010029bd7000ffdbdf251600000018000180140002006e657464657673696d3000000000000005000200400000000500020000000000050004"], 0x44}}, 0x0) executing program 1: socket$nl_route(0x10, 0x3, 0x0) socket(0x10, 0x803, 0x0) socket$unix(0x1, 0x2, 0x0) socket$nl_generic(0x10, 0x3, 0x10) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000280)={&(0x7f0000000500)=@newqdisc={0x24, 0x24, 0x400, 0x70bd28, 0x25dfdbfd, {0x0, 0x0, 0x0, 0x0, {0x10, 0xc}, {0x2, 0xe}, {0xfff2, 0x4}}}, 0x24}}, 0x0) r0 = socket$rxrpc(0x21, 0x2, 0xa) sendmsg$IPCTNL_MSG_CT_NEW(0xffffffffffffffff, &(0x7f0000000300)={0x0, 0x0, &(0x7f00000000c0)={0x0}}, 0x0) r1 = socket$netlink(0x10, 0x3, 0x0) r2 = socket$inet6_icmp_raw(0xa, 0x3, 0x3a) ioctl$sock_SIOCGIFINDEX(r2, 0x8933, &(0x7f0000000000)={'bridge0\x00'}) sendmsg$nl_route(0xffffffffffffffff, &(0x7f0000000100)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000080)=ANY=[@ANYBLOB="280000007000010010ab4be68e8da23507000000", @ANYBLOB="100001800400", @ANYRES8=r0], 0x28}}, 0x0) sendmmsg(r1, &(0x7f00000002c0), 0x40000000000009f, 0x0) executing program 6: r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000000), 0x2, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000200)={'syzkaller1\x00', 0x5001}) bpf$PROG_LOAD(0x5, &(0x7f0000000180)={0x5, 0x4, &(0x7f0000000080)=ANY=[@ANYBLOB="b40500000000000069108e0000000000bc0010"], 0x0, 0x5, 0x0, 0x0, 0x0, 0x8}, 0x94) r1 = socket$inet_udp(0x2, 0x2, 0x0) r2 = socket$nl_route(0x10, 0x3, 0x0) r3 = socket$unix(0x1, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r3, 0x8933, 0x0) sendmsg$nl_route_sched(r2, &(0x7f00000012c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f00000000c0)=@newqdisc={0x30, 0x24, 0x601, 0x0, 0x0, {0x0, 0x0, 0x0, 0x0, {}, {0xfff1, 0xffff}}, [@qdisc_kind_options=@q_ingress={0xc}]}, 0x30}}, 0x0) sendmsg$nl_route_sched(r2, &(0x7f0000000580)={0x0, 0x0, &(0x7f0000000300)={&(0x7f0000001300)=@newtfilter={0x80, 0x2c, 0x601, 0x0, 0x0, {0x0, 0x0, 0x0, 0x0, {0xb, 0x7}, {0xfff1, 0xffff}, {0x300}}, [@filter_kind_options=@f_matchall={{0xd}, {0x4c, 0x2, [@TCA_MATCHALL_ACT={0x48, 0x2, [@m_ct={0x44, 0x1, 0x0, 0x0, {{0x7}, {0x1c, 0x2, 0x0, 0x1, [@TCA_CT_PARMS={0x18, 0x1, {0x0, 0x0, 0x3}}]}, {0x4}, {0xc}, {0xc}}}]}]}}]}, 0x80}}, 0x0) ioctl$sock_inet_SIOCSIFFLAGS(r1, 0x8914, &(0x7f0000000200)={'syzkaller1\x00', 0x1}) write$tun(r0, &(0x7f0000000040)=ANY=[@ANYBLOB="03031b003a003200060063"], 0x76) executing program 4: r0 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r0, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000001680)=ANY=[@ANYBLOB="140000001000010000000000000000000500000a28000000000a030000000000000000000a00000708000240000000020900010073797a31000000002c000000030a010100000000000000000a0000070900010073797a3100000000090003007379"], 0x7c}, 0x1, 0x0, 0x0, 0x40001}, 0x4040850) sendmsg$NFT_BATCH(r0, &(0x7f0000009b40)={0x0, 0x0, &(0x7f0000009b00)={&(0x7f0000000240)=ANY=[@ANYBLOB="140000001000010000000000000000000500000a48000000030a0fdb00000000000000000a0000050900030073797a30000000000900010073797a310000000014000480080002403cb140bb0800014000000003080005400000000014000000110001"], 0x70}, 0x1, 0x0, 0x0, 0x4000850}, 0x24000840) sendmsg$NFT_BATCH(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000cc0)={&(0x7f00000002c0)={{0x14, 0x10, 0x1, 0x0, 0x0, {0x3}}, [@NFT_MSG_DELCHAIN={0x2c, 0x5, 0xa, 0x101, 0x0, 0x0, {0xa, 0x0, 0xa}, [@NFTA_CHAIN_TABLE={0x9, 0x1, 'syz1\x00'}, @NFTA_CHAIN_HANDLE={0xc, 0x2, 0x1, 0x0, 0x1}]}, @NFT_MSG_DELRULE={0x20, 0x8, 0xa, 0x101, 0x0, 0x0, {0xa, 0x0, 0x9}, [@NFTA_RULE_TABLE={0x9, 0x1, 'syz1\x00'}]}], {0x14}}, 0x74}, 0x1, 0x0, 0x0, 0xb0}, 0x20008890) executing program 4: socket$inet_smc(0x2b, 0x1, 0x0) socket$inet_udp(0x2, 0x2, 0x0) socket$nl_generic(0x10, 0x3, 0x10) socket$nl_netfilter(0x10, 0x3, 0xc) r0 = bpf$MAP_CREATE(0x0, 0x0, 0x0) bpf$PROG_LOAD(0x5, &(0x7f0000000600)={0x1, 0xf, &(0x7f00000006c0)=@ringbuf={{0x18, 0x0, 0x0, 0x0, 0x107a655, 0x0, 0x0, 0x0, 0x10}, {{0x18, 0x1, 0x1, 0x0, r0}}, {}, [], {{}, {}, {0x85, 0x0, 0x0, 0x85}}}, &(0x7f0000000000)='GPL\x00', 0x0, 0x0, 0x0, 0x41000, 0x8, '\x00', 0x0, @fallback=0x6, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) openat$sndtimer(0xffffffffffffff9c, &(0x7f00000006c0), 0x1a0001) openat$udambuf(0xffffffffffffff9c, &(0x7f0000000480), 0x2) socket(0x400000000010, 0x3, 0x0) openat$sndseq(0xffffffffffffff9c, &(0x7f0000000600), 0x183c81) socket(0x10, 0x3, 0x0) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000140)) r1 = openat$iommufd(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) ioctl$IOMMU_IOAS_ALLOC(r1, 0x3b81, &(0x7f00000003c0)={0xc, 0x0, 0x0}) ioctl$IOMMU_TEST_OP_CREATE_ACCESS(r1, 0x3ba0, &(0x7f0000000340)={0x48, 0x5, r2, 0x0, 0xffffffffffffffff, 0x1}) r3 = openat$rdma_cm(0xffffffffffffff9c, &(0x7f0000000940), 0x2, 0x0) socketpair(0x1, 0x1, 0x0, &(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}) bpf$MAP_UPDATE_ELEM_TAIL_CALL(0x2, &(0x7f00000001c0)={{}, 0x0, &(0x7f0000000100)=r4}, 0x20) writev(r3, &(0x7f0000000040)=[{&(0x7f0000000100), 0x6b82}], 0x2) executing program 1: ioctl$vim2m_VIDIOC_S_FMT(0xffffffffffffffff, 0xc0d05605, 0x0) r0 = userfaultfd(0x801) close_range(0xffffffffffffffff, 0xffffffffffffffff, 0x2) ioctl$UFFDIO_API(r0, 0xc018aa3f, &(0x7f00000000c0)) mprotect(&(0x7f0000000000/0xf000)=nil, 0xf000, 0x1) ioctl$UFFDIO_CONTINUE(r0, 0xc020aa08, &(0x7f0000000080)={{&(0x7f0000400000/0xc00000)=nil, 0xc00000}}) executing program 4: r0 = syz_open_dev$hiddev(&(0x7f00000000c0), 0x0, 0x0) ioctl$HIDIOCSREPORT(r0, 0x81044804, &(0x7f0000000400)={0x1}) executing program 7: r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f00000018c0)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000001900)=ANY=[@ANYBLOB="280000001e0001"], 0x28}}, 0x0) executing program 1: ioctl$SNDRV_CTL_IOCTL_ELEM_WRITE(0xffffffffffffffff, 0xc1105518, &(0x7f0000000040)={{0x0, 0x0, 0x0, 0x0, 'syz0\x00'}, 0x1, [0x4, 0x3, 0xfffffffffffffffe, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x801, 0x0, 0x0, 0xfffffffffffffffe, 0x0, 0x40000000, 0x0, 0x0, 0x0, 0x0, 0x2d8, 0x0, 0x470, 0xa7, 0x8, 0x8000000000000000, 0x0, 0xfffffffffffffffe, 0x9, 0x0, 0x2, 0x0, 0xfffffffa, 0x3, 0xfffffffffffffffe, 0x0, 0x400, 0x0, 0x0, 0x0, 0x2, 0x3, 0x7, 0x1, 0x0, 0x8000, 0x7, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4, 0x0, 0x0, 0x4, 0x4, 0x0, 0x0, 0xfffffffffffffffc, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x0, 0x8, 0xf5, 0x0, 0x4, 0x0, 0xd318, 0x2000000000, 0x0, 0x4, 0x0, 0x1000000000000000, 0x0, 0x0, 0xfffffffffffffffc, 0xffffffffffffffff, 0x0, 0xfffffffffffffffc, 0x0, 0x6, 0x0, 0xfffffffd, 0x8, 0x7, 0x6, 0x800000, 0x0, 0x101, 0x272f, 0xd721, 0x0, 0x4, 0x0, 0xffffffffffffffff, 0x1, 0xfffffffffffffffd, 0x0, 0x0, 0x0, 0x1, 0x4, 0x5, 0x1, 0x4000000, 0x5, 0x0, 0xdc5d, 0x0, 0x0, 0x1000, 0x0, 0x0, 0x0, 0x4000000000006fd, 0x0, 0x6, 0x0, 0x0, 0x0, 0x100]}) r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000140), 0x40241, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000000)={'syzkaller1\x00', 0xc201}) r1 = socket$kcm(0x2, 0xa, 0x2) ioctl$SIOCSIFHWADDR(r1, 0x8914, &(0x7f0000000080)={'syzkaller1\x00', @link_local={0x1, 0x80, 0xc2, 0x0, 0x0, 0x1c}}) write$tun(r0, 0x0, 0xfdef) openat$iommufd(0xffffffffffffff9c, 0x0, 0x0, 0x0) fstat(0xffffffffffffffff, 0x0) r2 = syz_open_dev$usbfs(&(0x7f0000000240), 0xb, 0x101301) r3 = socket$nl_generic(0x10, 0x3, 0x10) setsockopt$inet_sctp_SCTP_DEFAULT_SEND_PARAM(0xffffffffffffffff, 0x84, 0xa, &(0x7f00000001c0)={0x8, 0x6, 0x6, 0x0, 0x2, 0x5775d27c, 0x158, 0x20100}, 0x20) sendmsg$nl_generic(r3, &(0x7f0000000100)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000180)=ANY=[@ANYBLOB="4800000041000501010000000000000001010000000000001c0001000600060008000000100007007f0000017f000001910040001400020010000c00040006"], 0x48}, 0x1, 0x0, 0x0, 0x2c048040}, 0xe800) ioctl$USBDEVFS_IOCTL(r2, 0xc0105512, &(0x7f0000000200)) ioctl$USBDEVFS_GET_SPEED(r2, 0x551f) ioctl$USBDEVFS_IOCTL(r2, 0x80045505, &(0x7f0000000040)=@usbdevfs_connect) ioctl$USBDEVFS_CLAIM_PORT(r2, 0x80045518, 0x0) r4 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000040)='memory.events\x00', 0x275a, 0x0) syz_open_dev$mtd(&(0x7f0000000240), 0x0, 0x82000) write$tun(r4, &(0x7f0000000340)=ANY=[], 0x141) r5 = openat$userio(0xffffffffffffff9c, &(0x7f0000000300), 0x22242, 0x0) write$USERIO_CMD_REGISTER(r5, &(0x7f00000000c0), 0x2) mmap(&(0x7f0000000000/0x4000)=nil, 0x4000, 0x1, 0x10012, r4, 0x0) syz_clone3(&(0x7f0000000280)={0x84000000, &(0x7f0000000000), &(0x7f0000000080), &(0x7f00000000c0)=0x0, {0x1f}, &(0x7f0000000100)=""/36, 0x24, &(0x7f0000000140)=""/22, &(0x7f0000000180)=[0xffffffffffffffff, 0x0, 0x0], 0x3}, 0x58) ioctl$BLKTRACESETUP(r4, 0xc0481273, &(0x7f0000000300)={'\x00', 0x4, 0x8, 0x5, 0x2, 0xd, r6}) executing program 4: r0 = syz_usb_connect(0x0, 0x39, &(0x7f0000000100)=ANY=[], 0x0) syz_usb_disconnect(r0) r1 = syz_usb_connect(0x0, 0x3f, &(0x7f0000000540)=ANY=[], 0x0) syz_usb_control_io(r1, 0x0, 0x0) syz_usb_control_io$printer(r1, 0x0, 0x0) r2 = syz_open_dev$char_usb(0xc, 0xb4, 0x0) ioctl$EVIOCGMASK(r2, 0x5b03, 0x0) executing program 7: r0 = syz_open_dev$vim2m(&(0x7f0000000100), 0x0, 0x2) ioctl$vim2m_VIDIOC_STREAMOFF(r0, 0x40045612, &(0x7f0000000040)=0x1) ioctl$vim2m_VIDIOC_QBUF(r0, 0xc058560f, &(0x7f0000000180)=@mmap={0x1, 0x1, 0x4, 0x100, 0x81, {}, {0x4, 0x8, 0x8, 0x5, 0x29, 0x9, "0adb3fb8"}, 0x3}) write$uinput_user_dev(0xffffffffffffffff, &(0x7f0000000400)={'syz0\x00', {0x3, 0x2, 0x6, 0xfffa}, 0x3a, [0x8001, 0xc95a, 0xf, 0x8, 0x80, 0x2, 0x7, 0x7f, 0xa9, 0x4d, 0x6, 0x5f, 0x9, 0x15, 0xffff2d37, 0xff7fff01, 0x6, 0x5, 0x7, 0x5, 0x4, 0x0, 0x7, 0x3c5b, 0x1, 0x20, 0xd, 0x1, 0x0, 0xffffffff, 0xe661, 0x6, 0x7, 0x5, 0x8, 0x4c74, 0xffff7fff, 0x7, 0x3, 0xe, 0x0, 0x80008071, 0x7, 0x17, 0xffffffff, 0x7, 0x5, 0x80003e, 0x18e, 0x6, 0x6, 0x0, 0x8, 0x4, 0x8, 0x3ff, 0x80, 0x0, 0x5, 0x6, 0x8, 0x7, 0x1, 0x40], [0x10000007, 0x9, 0x8000012f, 0x8004, 0x5, 0xfffffff3, 0x129432f6, 0xc8, 0xf1, 0xe, 0x2bf, 0x6c7, 0x2009, 0xfffffffc, 0x573a, 0x0, 0x0, 0x5, 0x2f, 0x8, 0x312, 0x66abcbd2, 0xea4, 0x0, 0x4, 0x1007, 0x7fff, 0x6, 0x400, 0x401, 0x6, 0x1, 0xff, 0x7, 0x1000005, 0x5f31, 0xd, 0x4e0, 0x381, 0x4, 0xb, 0x4, 0x9, 0x8, 0x40, 0x6, 0x47, 0x8000, 0x1, 0xfe000000, 0xffff, 0x2, 0x4, 0x200009, 0x3, 0x3, 0x4000009, 0x6, 0x0, 0x3, 0xbc45, 0x48c93690, 0x42, 0x3], [0x6, 0x40a, 0x3ff, 0x5, 0xfffffffd, 0x100, 0x5, 0x9, 0x5, 0x7fff, 0x0, 0x5, 0xb, 0x4, 0x5, 0x5, 0x0, 0x1ef, 0x3, 0x8, 0x86, 0x1000515, 0x303c, 0x3e7, 0xb, 0x5, 0x2, 0x2, 0x3, 0x20000008, 0x4, 0x6cff, 0x6, 0x20000038, 0x200, 0x1fd, 0x80, 0x7, 0x4, 0x2950bfaf, 0x1000, 0xa2, 0x7, 0xcc, 0x5, 0x6, 0xac8, 0xbf, 0x2, 0x3, 0x7ff, 0x12b, 0x4, 0x1, 0xa, 0xffffffff, 0x5, 0x1c, 0x120000, 0x7ef, 0x2006, 0x80a2cd, 0x4, 0x25], [0xc, 0xbb33, 0x7, 0xb, 0x5, 0x938, 0x6, 0x6, 0x0, 0xb9, 0xce4, 0x1ff, 0x2, 0x57, 0x5, 0x3, 0x2, 0x10000, 0x4, 0x7fff, 0xfff4, 0xa620, 0x1, 0x5, 0x801, 0x2000002, 0x150, 0x60a7, 0x6, 0x16, 0xffffffff, 0x8, 0x4, 0x5, 0xca, 0x1, 0xfffff000, 0x10000, 0xf, 0x7e, 0x9, 0x9622, 0x7, 0xaf, 0x20000008, 0x5, 0x226, 0x2, 0x5, 0x0, 0x30b1d693, 0xa1f, 0xf40, 0x7, 0x530e, 0xe1c4, 0x0, 0x0, 0x5, 0x7ff, 0xd7, 0x200, 0xb, 0xfff]}, 0x45c) ppoll(&(0x7f00000000c0)=[{}, {}], 0x20000000000000dc, 0x0, 0x0, 0x0) executing program 7: bpf$MAP_CREATE(0x0, &(0x7f0000000080)=ANY=[], 0x50) bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x0, 0xc, 0x0, 0x0, 0xfffffffd, 0x0, 0x0, 0x0, 0x40, '\x00', 0x0, @fallback=0x10, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) socket(0x10, 0x803, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x1, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000380)={0xa, 0x100008b}, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000200)=0x8) openat$sequencer(0xffffffffffffff9c, &(0x7f00000001c0), 0x80200, 0x0) r0 = syz_open_dev$sndmidi(&(0x7f00000004c0), 0x2, 0x141102) writev(r0, &(0x7f0000000840)=[{&(0x7f00000002c0)="94", 0xf000}, {0x0}], 0x2) ioctl$sock_SIOCGIFINDEX(0xffffffffffffffff, 0x8933, 0x0) r1 = socket$kcm(0xa, 0x3, 0x3a) r2 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r2, &(0x7f0000000480)={0x0, 0x0, &(0x7f0000001f40)={&(0x7f00000004c0)=ANY=[@ANYBLOB="fc000000190001002dbd700000000000ac1e0001000000000000000000000000ac1414aa00"/48, @ANYRES32=0x0, @ANYRES32, @ANYBLOB="00000000000000000c00000000000000000000000000000000000000000000000000000000000000ffffffffffffffff000000000000000000000000000000000000000000000000000a000000000000feffffffff7f40000200000000000008ffffffff00000000010006000000000044000500ac1414bb000000000000000000000000000000003c0000000200000000000000000000000000000000000001060000"], 0xfc}, 0x1, 0x0, 0x0, 0x4008000}, 0x600c010) sendmsg$kcm(r1, &(0x7f0000000080)={&(0x7f0000000000)=@l2tp6={0xa, 0x0, 0x0, @loopback={0xfe80000000000000, 0xac14140c}}, 0x80, &(0x7f00000000c0)=[{&(0x7f0000000140)='\x00\x00', 0xffe3}], 0x1, 0x0, 0x0, 0x900}, 0x60) setsockopt$IPT_SO_SET_REPLACE(0xffffffffffffffff, 0x0, 0x40, 0x0, 0x0) syz_usb_connect(0x3, 0x57, &(0x7f0000000000)=ANY=[@ANYBLOB="1201000200000040402001c60100000000010902450001010080fa0904"], 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000340)='./file1\x00', 0x0) mkdirat(0xffffffffffffff9c, &(0x7f00000000c0)='./bus\x00', 0x1d7) mkdirat(0xffffffffffffff9c, &(0x7f0000000400)='./file1/file0\x00', 0x100) mount$bind(&(0x7f0000000100)='.\x00', &(0x7f0000000080)='./file1/file0\x00', 0x0, 0x1085408, 0x0) r3 = openat$sw_sync(0xffffffffffffff9c, &(0x7f0000000ac0), 0x800, 0x0) ioctl$SW_SYNC_IOC_CREATE_FENCE(r3, 0xc0285700, &(0x7f0000000b00)={0x4, "abacd211119ca94c63377526aeb5ab2c7b9ca5fa07558139ede6dc06270ee042", 0xffffffffffffffff}) ioctl$SYNC_IOC_MERGE(r4, 0xc0303e03, &(0x7f0000000780)={"d1ed39d88b014076ab94c1fb10628c46d2e66ccdb9e581a38ebb0ddd5f307e56", 0xffffffffffffffff, 0xffffffffffffffff}) ioctl$SYNC_IOC_FILE_INFO(r5, 0xc0383e04, 0x0) mount$overlay(0x0, &(0x7f00000000c0)='./bus\x00', &(0x7f00000003c0), 0x40, &(0x7f0000000300)={[{@workdir={'workdir', 0x3d, './bus'}}, {@upperdir={'upperdir', 0x3d, './file1'}}]}) bpf$PROG_LOAD(0x5, 0x0, 0x0) r6 = syz_usb_connect$hid(0x1, 0x36, &(0x7f0000000040)=ANY=[@ANYBLOB="12010000090024206d041cc340000000000109022400010000a00009040000010301010009"], 0x0) r7 = syz_open_procfs(0xffffffffffffffff, &(0x7f0000000080)='stat\x00') read$FUSE(r7, &(0x7f0000004180)={0x2020}, 0x2020) syz_usb_control_io$hid(r6, &(0x7f0000000240)={0x24, &(0x7f00000003c0)=ANY=[@ANYBLOB="00000c000000070001"], 0x0, 0x0, 0x0}, 0x0) executing program 6: r0 = socket$packet(0x11, 0x2, 0x300) setsockopt$SO_ATTACH_FILTER(r0, 0x1, 0x1a, &(0x7f0000000100)={0x2, &(0x7f0000000040)=[{0x0, 0x0, 0xfd, 0xc8e}, {0x16, 0xff, 0x6, 0x6}]}, 0x10) setsockopt$packet_fanout(r0, 0x107, 0x12, 0x0, 0x0) r1 = socket$inet_udp(0x2, 0x2, 0x0) bind$inet(r1, &(0x7f0000000140)={0x2, 0x80, @dev={0xac, 0x14, 0x14, 0xf}}, 0x10) sendmmsg$inet(r1, &(0x7f0000000c00)=[{{&(0x7f0000010940)={0x2, 0x4e22, @multicast2}, 0x10, 0x0}}], 0x1, 0x2000c044) sendto$inet(r1, &(0x7f0000000c80)="e8", 0x6200, 0x0, 0x0, 0x0) executing program 6: syz_usb_connect(0x0, 0x4b, &(0x7f0000000000)=ANY=[@ANYBLOB="1201000200000040480b051000010102000109023900020100803209040000000000000009"], 0x0) r0 = syz_open_dev$dvb_demux(&(0x7f0000000200), 0x1, 0x2) ioctl$DVB_DEMUX_DMX_SET_PES_FILTER(r0, 0x40146f2c, &(0x7f0000000100)={0x1ff, 0x0, 0x3, 0xa, 0x4}) executing program 3: ioctl$VIDIOC_QUERYSTD(0xffffffffffffffff, 0x8008563f, &(0x7f0000000000)) r0 = syz_usb_connect(0x2, 0xb3, &(0x7f0000000640)=ANY=[@ANYBLOB="12010002ef0201406d0425080001000000010902a1000201008032080b00020e03000009040000000e0100000d240100012700006cdc0201011124020101020000000000000000020d000924030201010001"], &(0x7f0000000a40)={0x0, 0x0, 0x0, 0x0}) syz_usb_control_io$rtl8150(r0, 0x0, &(0x7f00000003c0)={0x2c, &(0x7f00000000c0)=ANY=[], 0x0, 0x0, 0x0, 0x0}) write(0xffffffffffffffff, &(0x7f0000000500)='transport=rdma,nqn=nqn.2014-08.org.nvmexpress:NVMf:uui', 0x36) executing program 0: socket$can_raw(0x1d, 0x3, 0x1) socket(0x18, 0x80000, 0x1) socket$key(0xf, 0x3, 0x2) syz_open_procfs$namespace(0x0, &(0x7f0000000280)='ns/ipc\x00') syz_open_procfs$namespace(0x0, &(0x7f0000000040)='ns/ipc\x00') socket$inet_udp(0x2, 0x2, 0x0) syz_open_dev$vim2m(&(0x7f0000000080), 0x7, 0x2) socket$inet_icmp_raw(0x2, 0x3, 0x1) bpf$PROG_LOAD(0x5, &(0x7f0000000000)={0x13, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x40, '\x00', 0x0, @fallback=0x2e, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0x1}, 0x94) socket$netlink(0x10, 0x3, 0x0) openat$rdma_cm(0xffffffffffffff9c, &(0x7f0000000180), 0x2, 0x0) socket$nl_xfrm(0x10, 0x3, 0x6) mkdirat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000)='./cgroup/syz0\x00', 0x1ff) openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000), 0x200002, 0x0) r0 = epoll_create1(0x0) socket$nl_route(0x10, 0x3, 0x0) r1 = socket$netlink(0x10, 0x3, 0x0) sendmsg$nl_route(0xffffffffffffffff, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000000080)=ANY=[@ANYBLOB="540000001000010400000000000000ffff000000", @ANYRES32=0x0, @ANYBLOB="0380000000000000240012800c0001006d6163766c616e00140002800800010008000000060002000100000008000500", @ANYRES32=r0, @ANYBLOB='\b\x00\n\x00', @ANYRES8=r1], 0x54}, 0x1, 0x0, 0x0, 0x4000085}, 0x0) sendmmsg(r1, &(0x7f00000002c0), 0x40000000000009f, 0x20) executing program 1: r0 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r0, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000001680)=ANY=[@ANYBLOB="140000001000010000000000000000000500000a28000000000a030000000000000000000a00000708000240000000020900010073797a31000000002c000000030a010100000000000000000a0000070900010073797a31000000000900030073797a320000000014"], 0x7c}, 0x1, 0x0, 0x0, 0x40001}, 0x4040850) sendmsg$NFT_BATCH(r0, &(0x7f0000009b40)={0x0, 0x0, &(0x7f0000009b00)={&(0x7f0000000240)=ANY=[@ANYBLOB="140000001000010000000000000000000500000a48000000030a0fdb00000000000000000a0000050900030073797a30000000000900010073797a310000000014000480080002403cb140bb0800014000000003080005400000000014000000110001"], 0x70}, 0x1, 0x0, 0x0, 0x4000850}, 0x24000840) sendmsg$NFT_BATCH(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000cc0)={&(0x7f00000002c0)={{0x14, 0x10, 0x1, 0x0, 0x0, {0x3}}, [@NFT_MSG_DELCHAIN={0x2c, 0x5, 0xa, 0x101, 0x0, 0x0, {0xa, 0x0, 0xa}, [@NFTA_CHAIN_TABLE={0x9, 0x1, 'syz1\x00'}, @NFTA_CHAIN_HANDLE={0xc, 0x2, 0x1, 0x0, 0x1}]}, @NFT_MSG_DELRULE={0x20, 0x8, 0xa, 0x101, 0x0, 0x0, {0xa, 0x0, 0x9}, [@NFTA_RULE_TABLE={0x9, 0x1, 'syz1\x00'}]}], {0x14}}, 0x74}, 0x1, 0x0, 0x0, 0xb0}, 0x20008890) executing program 1: sendmmsg$inet(0xffffffffffffffff, &(0x7f0000002140)=[{{0x0, 0x0, &(0x7f0000000540)=[{&(0x7f0000002280)="21ae1baf930b4569b9ddef9797ffd935c7d80e6466b3e4e62dd4603583f5d4b61fbc65b6ac744d7319535e75bf552062e4cfde1ba7ce29263322e18ea9740aa89f69c47a63133708cda00d2b1f4e799bd41e3f76258180fa91a42aaa8b1ebc4e0ea8fb12f2c71e6e5bc57a8e91f254005514721d93c13c5606ae1fea7f31f558d562bd5a8dfb0b9fed873efa221fccffa84fcd374c92e6cbb03e6a9de890ce323f000000abcc6c01326d588495b7c1a7db31ec4129e6336f26bb9e0b7552af3cd2d5dda1632799bbc98425c433384d8a8e4071ff39a36dfde5f05af35a4ddd340cfecd7ec935f4ce7d3e851583ba1cf53a90a7f7bce5703de57ce93ddef7849b30a01de0637e6d5e507b801d32e582e0c2d564539ebfc84c098a23e765552767b122885fb1629e9c180be47da7931bd125b80de1594b75e5371a81c2c32d0c4a028a5aab0c56a2edf2e0483b87f5ab299dc046076203dea10ccbfc631d5bf4a87ce67004519f248f086346ce6a8a9d181789a59f81d9b7f6781daac3e229914b8b8998c15c3b6302a519331cb05995bc60b7cb872dd3b5b43331c77c5d72e21f7bd2b1a915ff3204e3f20d3a20b22d6a58155b5a4ebf6d1d1cd90c656ecada531c07ff91deb3efa91762cdecfbcc43553750f22ac5c18cc5e8b6f790c2f4e6373af9f98d10e6df49ff8e5cbcbd68e11ed0b967add11410dc2e34f08dbfaf8eb95d4d1153b4c6093192a340eb30fcc71619888c6486746a049585d249efb96b9cace83320b8f96b40ebe3a9a788d05a053380d1026b9434df87a3a387549bcabe88684c4d0948a6e219b5769480e6d0a9bf0da9a5212f3dbc8d1dff240856691243b203d7edd4d3cc89a38a6c80fdb1229a01044af7aaecb20d5570ebf24b30bbc6dfc3f70d85cd9f0d60ebd8fedd161d199d9997a0e2d18d1c99bc7158564e0ddb4673055de196535d706d142e1dc7d404583923cb1b286cfc5418884ac7e605d93652dc48ff8261c63790a91ee2c5ff9a21677b4bc7e73ddf2d0e46807c57bf64b0b9df7fc67ecba6521767dcc7d4299c740e73bc49cbcf0049faf222c48896378497c0a7be6238217f85c83a2c45376ddf1a8f631c22c8cf453e8a4fe7bf8160a82bd069be9a9e163724a7412bbc30b68bb31bd571f0571297726a309691408af62ecfc77ea52718c39e802f00a726aaa625407f3b18fd4f66db2bbd05dfd62e448fc6bb9fc51960e12b67c5d42e82df55f5d87428137874e27db5cc", 0x37d}, {0x0}, {&(0x7f0000002200)="f610e61ac81cc3edc86f0500", 0xc}], 0x3, 0x0, 0x0, 0x900}}], 0x1, 0x0) r0 = socket(0x10, 0x803, 0x0) sendto(r0, &(0x7f00000000c0)="120000001200e7ef007b00000000000000a1", 0x12, 0x0, 0x0, 0x0) recvmmsg(r0, &(0x7f00000037c0)=[{{&(0x7f00000004c0)=@ethernet={0x0, @random}, 0xfdf4, &(0x7f0000000380)=[{&(0x7f0000000000)=""/102, 0x365}, {&(0x7f0000000280)=""/76, 0x14c}, {&(0x7f0000000fc0)=""/4096, 0x197}, {&(0x7f0000000400)=""/92, 0x645}, {&(0x7f0000000980)=""/73, 0x1b}, {&(0x7f0000000200)=""/77, 0x188}, {&(0x7f00000007c0)=""/154, 0x2c}, {&(0x7f00000001c0)=""/17, 0x1d8}], 0x21, &(0x7f0000000600)=""/191, 0x41}}], 0x4000000000003b4, 0x0, &(0x7f0000003700)={0x77359400}) program did not crash bisect: testing without sub-chunk 2/3 testing program (duration=6m8s, {Threaded:true Repeat:true RepeatTimes:0 Procs:6 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): [1, 2, 23, 21, 5, 13, 13, 22, 5, 5, 5, 6, 12, 12, 4, 7, 24, 11, 4, 19, 6, 2, 2, 24, 7, 5, 30, 7, 3, 4, 19, 4, 4] detailed listing: executing program 2: syz_mount_image$vfat(&(0x7f0000000000), &(0x7f0000000500)='./file0\x00', 0x2200810, &(0x7f0000000040)=ANY=[@ANYRES64=0x0, @ANYRES16, @ANYRESOCT, @ANYRESHEX, @ANYRESDEC, @ANYRES64], 0x1, 0x265, &(0x7f00000006c0)="$eJzs2k9rXFUYB+D3pimpKenE/7YgHnShboYmaxcNkoI4IGgjVEF6a250yHUm5A6BEbFZKbjq2pVrcelCEKRLN9n4CVzoKpssuxCvJJO0SYxoGscJ9nk288I5P86595w5nMXdfOX2R8tL47GU92Isy2LsSqzH3SymYyz2rMfLL17/8dm3rr/z+lyrNf9mSlfnrs3MppQuPPfDu5988/yd3vm3v73w/URsTL+3uTX7y8ZTGxc3f7/2YbtK7Sp1ur2Up5vdbi+/WRZpsV0tN1O6XRZ5VaR2pypWD7Qvld2VlX7KO4tTkyurRVWlvNNPy0U/9bqpt9pP+Qd5u5OazWaamgxOYuHru3UdW/XZG1HX9SNfxfk7MfVzNCJ7NGWPX8mevJE9vZ5d3KrrxqinylBY/4fbvkP9XET5+drC2sLgd9A+txTtKKOIy9GI32J7m+wa1Fdfa81fTjum47Py1m7+1trCmZ38F3v5mWjE9NH5mUE+HcxPxOT+8We/eyye+HP+1zOt+dkj8+fipRf25ZvRiJ/ej26UsRjb2fvjfzqT0qtvtA7lL+30AwD4v2mme468vzWbf9U+yB/jfnjofjUel8ZH++xEVP2Pl/OyLFYfoJiI46a299Q/6Nx9sPkcq8h2X8Dfd35mbIjTOA3Fl6djGkMqBudY3Fvvf3mIk/6JDhRndzfk3sE4ylc3gsOI/9z9RR/1TAAAAAAAAAAAADiOQx/9NYbxyeGonxEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAADjd/ggAAP//tpTCRA==") executing program 2: r0 = socket$inet(0x2, 0x5, 0x0) setsockopt$IP_VS_SO_SET_DELDEST(r0, 0x0, 0x488, &(0x7f0000000200)={{0x6, @multicast1, 0x4e1f, 0x0, 'rr\x00'}, {@loopback, 0x4e1f, 0x1, 0x1}}, 0x44) executing program 2: socket$nl_route(0x10, 0x3, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000140)={0xa, 0x8b}, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000280)=0x8) r0 = getpid() sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x2) sched_setscheduler(r0, 0x2, &(0x7f0000000200)=0x7) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeea, 0x8031, 0xffffffffffffffff, 0x28f43000) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r1, &(0x7f0000000180)=@abs, 0x6e) sendmmsg$unix(r2, &(0x7f0000000000), 0x651, 0x0) recvmmsg(r1, &(0x7f00000000c0), 0x10106, 0x2, 0x0) mmap$IORING_OFF_SQ_RING(0x110c230000, 0x8000002, 0x2000007, 0x401d031, 0xffffffffffffffff, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./sys\x00', 0x1ff) mount(0x0, &(0x7f0000000040)='./sys\x00', &(0x7f0000000080)='sysfs\x00', 0x0, 0x0) r3 = openat(0xffffffffffffff9c, &(0x7f00000000c0)='./sys/module/usbcore/parameters/quirks\x00', 0x2, 0x0) write(r3, &(0x7f00000005c0)="306663353a313232373a3f7092c0f0bc085a193376cf620afaf6379a248d1d6534058f1095109da34b6d6537a6e78b0dc4b7bc0b", 0x34) r4 = socket$inet_tcp(0x2, 0x1, 0x0) ioctl$sock_SIOCGIFINDEX(r4, 0x8933, &(0x7f0000000180)={'syz_tun\x00'}) mkdirat(0xffffffffffffff9c, &(0x7f0000000080)='./file1\x00', 0x1c0) mkdirat(0xffffffffffffff9c, &(0x7f00000000c0)='./file0\x00', 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000240)='./file2\x00', 0x207) mount$overlay(0x0, &(0x7f0000000100)='./file0\x00', &(0x7f0000000000), 0x0, &(0x7f00000000c0)={[{@workdir={'workdir', 0x3d, './file0'}}, {@lowerdir={'lowerdir', 0x3d, '.'}}, {@upperdir={'upperdir', 0x3d, './file2'}}], [], 0x2c}) fsync(0xffffffffffffffff) executing program 2: r0 = syz_open_procfs(0x0, &(0x7f0000000c80)='fdinfo\x00') mmap(&(0x7f0000000000/0xe7e000)=nil, 0xe7e000, 0xfffffffffffffffe, 0x4031, 0xffffffffffffffff, 0x0) syz_emit_vhci(0x0, 0x4) ioctl$UFFDIO_COPY(0xffffffffffffffff, 0xc028aa03, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000200)={0x8, 0x8a}, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000180)=0x3) r1 = socket$inet_udp(0x2, 0x2, 0x0) setsockopt$IPT_SO_SET_REPLACE(r1, 0x0, 0x40, 0x0, 0x0) sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x2) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) r2 = syz_open_dev$MSR(&(0x7f00000001c0), 0x0, 0x0) read$msr(r2, &(0x7f0000019680)=""/102392, 0x18ff8) socket$igmp(0x2, 0x3, 0x2) getdents64(r0, &(0x7f0000002440)=""/181, 0xb5) mkdir(&(0x7f0000000040)='./file0\x00', 0x0) ioctl(0xffffffffffffffff, 0x890b, 0x0) bpf$MAP_CREATE(0x0, 0x0, 0x50) setns(0xc9, 0x0) r3 = socket$netlink(0x10, 0x3, 0x8) writev(r3, &(0x7f0000000300)=[{&(0x7f0000000080)='X\x00', 0xfdef}], 0x1) sendmsg$kcm(0xffffffffffffffff, &(0x7f0000000600)={0x0, 0x0, &(0x7f00000003c0)=[{0x0}, {&(0x7f0000000000)="11c9064268", 0x5}], 0x2}, 0x40) executing program 2: r0 = socket$inet_sctp(0x2, 0x5, 0x84) setsockopt$IP_VS_SO_SET_ADD(r0, 0x0, 0x482, &(0x7f00000000c0)={0x84, @dev={0xac, 0x14, 0x14, 0x8b}, 0x15, 0x3, 'fo\x00', 0x1, 0x400000, 0x4}, 0x2c) r1 = socket$kcm(0xa, 0x2, 0x0) setsockopt$IP_VS_SO_SET_ADDDEST(r0, 0x0, 0x487, &(0x7f0000000000)={{0x84, @remote, 0x4e21, 0x3, 'wrr\x00', 0x23, 0x81, 0x36}, {@dev={0xac, 0x14, 0x14, 0x40}, 0x4e23, 0x10000, 0x1cb, 0x12d61, 0x12d58}}, 0x44) sendmsg$sock(r1, &(0x7f0000000400)={&(0x7f0000000580)=@in6={0x2, 0x4e22, 0x0, @dev}, 0x80, 0x0, 0x0, &(0x7f0000000000)=[@mark={{0x14, 0x1, 0x24, 0x3}}], 0x18}, 0x0) executing program 2: socket$netlink(0x10, 0x3, 0x0) syz_open_dev$sndpcmp(0x0, 0xfffffffffffffff1, 0x402000) r0 = openat$cgroup_ro(0xffffffffffffffff, &(0x7f0000000000)='cpuacct.usage_sys\x00', 0x0, 0x0) sendmmsg$unix(r0, 0x0, 0x0, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) sched_setattr(0x0, &(0x7f0000000280)={0x38, 0x6, 0x8, 0x3, 0x0, 0x9, 0x1, 0xfffffe0000000001, 0xfa11, 0xffffffff}, 0x0) madvise(&(0x7f0000284000/0x1000)=nil, 0x1000, 0x3) landlock_create_ruleset(0x0, 0x0, 0x0) syz_clone(0x11, 0x0, 0x0, 0x0, 0x0, 0x0) socket$nl_generic(0x10, 0x3, 0x10) r1 = openat$procfs(0xffffffffffffff9c, &(0x7f00000000c0)='/proc/partitions\x00', 0x0, 0x0) r2 = openat$sysctl(0xffffffffffffff9c, &(0x7f0000000040)='/proc/sys/vm/drop_caches\x00', 0x1, 0x0) sendfile(r2, r1, &(0x7f0000002080)=0x58, 0x12) executing program 32: socket$netlink(0x10, 0x3, 0x0) syz_open_dev$sndpcmp(0x0, 0xfffffffffffffff1, 0x402000) r0 = openat$cgroup_ro(0xffffffffffffffff, &(0x7f0000000000)='cpuacct.usage_sys\x00', 0x0, 0x0) sendmmsg$unix(r0, 0x0, 0x0, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) sched_setattr(0x0, &(0x7f0000000280)={0x38, 0x6, 0x8, 0x3, 0x0, 0x9, 0x1, 0xfffffe0000000001, 0xfa11, 0xffffffff}, 0x0) madvise(&(0x7f0000284000/0x1000)=nil, 0x1000, 0x3) landlock_create_ruleset(0x0, 0x0, 0x0) syz_clone(0x11, 0x0, 0x0, 0x0, 0x0, 0x0) socket$nl_generic(0x10, 0x3, 0x10) r1 = openat$procfs(0xffffffffffffff9c, &(0x7f00000000c0)='/proc/partitions\x00', 0x0, 0x0) r2 = openat$sysctl(0xffffffffffffff9c, &(0x7f0000000040)='/proc/sys/vm/drop_caches\x00', 0x1, 0x0) sendfile(r2, r1, &(0x7f0000002080)=0x58, 0x12) executing program 5: prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x1, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000380)={0x8, 0x100008b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000200)=0x5) openat$sequencer(0xffffffffffffff9c, &(0x7f0000000300), 0x80200, 0x0) r0 = syz_open_dev$sndmidi(&(0x7f00000004c0), 0x2, 0x141102) writev(r0, &(0x7f0000000840), 0x0) r1 = socket$unix(0x1, 0x2, 0x0) sendmsg$kcm(0xffffffffffffffff, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)=[{0x0}, {&(0x7f0000000580)="d4fa0c511aad03aa5ed217677bc41c027d9c830c439c7f821ddd78b6915cb170e7603acf9e433c2903bb6773f4b0130668a1e5b5e08d21d0b69c28ca3455aed65855c86f3d1e5789d26375a0d85eaf5e92e19c9affcf76e7a94e76556d2b104ebf645747fadc91460f4b3c94e1a89b51be4a6aa4c65285f988329a8163b69c51b801500a5bacd0463976e2960e2679ef2feee5e6ce6bb78a51fb0e15820d13e4a5aa9e0742a6f8d677ad28fea356657bb550c8311b682d9003c82267a15aa7334bc53b65b9119a1a7d905c7dd365b85c230bbad0d5d0a79819e112637819d9a187cfdf782c6127d2d4281926ab0e22f7346b616fe28ed0b9f4a0c9fdac6d3a90a9c38b5e31448a45546388c95045bc22fe88c43b", 0x114}], 0x2}, 0x0) r2 = syz_genetlink_get_family_id$tipc(&(0x7f0000000040), 0xffffffffffffffff) sendmsg$TIPC_CMD_SET_LINK_PRI(0xffffffffffffffff, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000000080)={0x68, r2, 0x1, 0x0, 0x0, {{}, {0x0, 0x410c}, {0x4c, 0x14, {0xfffffff0, @link='broadcast-link\x00'}}}}, 0x68}}, 0x0) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f00000005c0)={0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x9, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x4}, 0x50) ioctl$sock_SIOCGIFINDEX_80211(r1, 0x8b18, &(0x7f0000000000)={'wlan0\x00'}) r3 = openat$vnet(0xffffffffffffff9c, 0x0, 0x2, 0x0) r4 = openat$tun(0xffffffffffffff9c, &(0x7f0000000080), 0x2, 0x0) ioctl$TUNSETIFF(r4, 0x400454ca, &(0x7f0000000100)={'\x00', 0x1}) ioctl$VHOST_SET_OWNER(r3, 0xaf01, 0x0) syz_open_procfs(0x0, &(0x7f0000000240)='clear_refs\x00') getsockopt$TIPC_DEST_DROPPABLE(0xffffffffffffffff, 0x10f, 0x81, &(0x7f0000000080), &(0x7f00000000c0)=0x4) add_key$user(&(0x7f00000003c0), &(0x7f0000000440), &(0x7f00000000c0), 0xc9, 0xfffffffffffffffd) syz_genetlink_get_family_id$tipc2(&(0x7f0000000400), 0xffffffffffffffff) mkdirat(0xffffffffffffff9c, &(0x7f0000000440)='./mnt\x00', 0x1ff) mount(&(0x7f0000000400), &(0x7f0000000000)='./mnt\x00', &(0x7f0000000480)='ecryptfs\x00', 0x0, &(0x7f0000000500)='ecryptfs_sig=syz,ecryptfs_fnek_sig=syz,ecryptfs_cipher=aes,ecryptfs_key_bytes=16\x00') executing program 5: r0 = socket$inet6_sctp(0xa, 0x5, 0x84) r1 = socket$inet6_sctp(0xa, 0x1, 0x84) getsockopt$inet_sctp6_SCTP_SOCKOPT_CONNECTX3(r1, 0x84, 0x6f, &(0x7f0000000280)={0x0, 0x1c, &(0x7f0000000000)=[@in6={0xa, 0x0, 0x0, @rand_addr=' \x01\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x01', 0x9}]}, 0x0) getsockopt$inet_sctp6_SCTP_MAX_BURST(r1, 0x84, 0x83, &(0x7f0000000000)=@assoc_value={0x0}, &(0x7f0000000300)=0x8) setsockopt$inet_sctp6_SCTP_AUTH_KEY(r0, 0x84, 0x17, &(0x7f0000000ac0)={r2, 0x8, 0x1, 'x'}, 0x9) executing program 5: r0 = bpf$PROG_LOAD(0x5, &(0x7f0000000a40)={0x1, 0x4, &(0x7f0000000300)=ANY=[@ANYBLOB], &(0x7f0000000200)='GPL\x00', 0x0, 0x0, 0x0, 0x41100, 0x0, '\x00', 0x0, @fallback=0x2a, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) r1 = socket$kcm(0x11, 0xa, 0x300) setsockopt$sock_attach_bpf(r1, 0x1, 0x32, &(0x7f0000000040)=r0, 0x4) r2 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPSET_CMD_CREATE(r2, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000480)=ANY=[], 0x4c}}, 0x2) executing program 5: r0 = syz_ublk_setup_io_uring(0x1d, &(0x7f0000000500)={0x0, 0x30b5, 0x0, 0x2, 0x158}, &(0x7f0000000100)=0x0, &(0x7f0000000400)=0x0, &(0x7f0000000140)=0x0) syz_ublk_add_dev(r0, r1, r2, r3, &(0x7f0000000200)={0x2e, 0x14, 0x0, 0xffffffffffffffff, 0xc0207504, 0x0, 0x0, 0x0, 0x0, 0x4, 0x0, 0x0, '\x00', {0xffffffff, 0xffff, 0x40, &(0x7f00000004c0)=@any_dev={0x3, 0xe26, 0x0, 0x0, 0x1000, 0x10000, 0xffffffffffffffff, 0x0, 0x4d}}}, &(0x7f0000000480)=0x0) r5 = dup(0xffffffffffffffff) syz_ublk_setup_queues(r5, r4, &(0x7f0000000180)={0x0, 0x1, 0x0, 0x3, 0x255}, &(0x7f0000000800)=[{0x0, 0x0, 0xffffffffffffffff, {0x0, 0x92e0, 0x400, 0x2100, 0x10000004, 0x0, r5}}, {0x0, 0x0, 0xffffffffffffffff, {0x0, 0x19e0, 0x400, 0x0, 0x146}}, {0x0, 0x0, 0xffffffffffffffff, {0x0, 0xf910, 0x2000, 0x0, 0x801f0, 0x0, r5}}, {0x0, 0x0, 0xffffffffffffffff, {0x0, 0x587e, 0x80, 0x2, 0x367}}], 0x1, &(0x7f0000000340)={0x2e, 0x50, 0x0, 0xffffffffffffffff, 0xc0107520, 0x0, 0x0, 0x0, 0x0, {}, 0x1f, 0x0, '\x00', {0xfff9, 0x1, 0x0, 0x0}}, 0x0) bpf$MAP_CREATE(0x0, &(0x7f0000000340)=@base={0x1f, 0x7fff, 0x10001, 0x80, 0x80, r5, 0x2, '\x00', 0x0, 0xffffffffffffffff, 0x4, 0x3, 0x5}, 0x50) executing program 5: r0 = socket$kcm(0x2, 0x200000000000001, 0x0) sendmsg$inet(r0, &(0x7f0000000080)={&(0x7f0000000340)={0x2, 0x4001, @dev}, 0x10, 0x0}, 0x3000c085) r1 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000280)='hugetlb.1GB.usage_in_bytes\x00', 0x26e1, 0x0) setsockopt$sock_attach_bpf(r0, 0x1, 0x3e, &(0x7f0000000100)=r1, 0x4) sendmsg$kcm(r0, &(0x7f0000002480)={0x0, 0x0, &(0x7f0000001e40)=[{&(0x7f0000000e40)}], 0x1}, 0x10) sendmsg$inet(r0, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)=[{&(0x7f0000000300)="b8", 0x2ee0}], 0x13, 0x0, 0x0, 0x10000000}, 0x12cd) executing program 5: prlimit64(0x0, 0xe, &(0x7f0000000140)={0xa, 0x400000000008d}, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000080)=0x8) getpid() sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x2) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r0, &(0x7f0000000180)=@abs, 0x6e) sendmmsg$unix(r1, &(0x7f0000000000), 0x651, 0x0) recvmmsg(r0, &(0x7f00000000c0), 0x4000087, 0x2, 0x0) r2 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r2, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000000)=@updpolicy={0xb8, 0x13, 0xcb23c9c9931e99e9, 0x0, 0x0, {{@in=@private=0xa010101, @in=@remote, 0x0, 0x400, 0x1000, 0x0, 0x2, 0x20, 0x10, 0x84, 0x0, 0xffffffffffffffff}, {}, {0x0, 0x4000000000000, 0x0, 0xffffffffffffffff}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1}}, 0xb8}}, 0x80) sendmsg$nl_xfrm(r2, &(0x7f0000000480)={0x0, 0x0, &(0x7f0000000800)={&(0x7f0000000000)=ANY=[@ANYBLOB="650100001b"], 0x168}}, 0xc0) executing program 33: prlimit64(0x0, 0xe, &(0x7f0000000140)={0xa, 0x400000000008d}, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000080)=0x8) getpid() sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x2) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r0, &(0x7f0000000180)=@abs, 0x6e) sendmmsg$unix(r1, &(0x7f0000000000), 0x651, 0x0) recvmmsg(r0, &(0x7f00000000c0), 0x4000087, 0x2, 0x0) r2 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r2, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000000)=@updpolicy={0xb8, 0x13, 0xcb23c9c9931e99e9, 0x0, 0x0, {{@in=@private=0xa010101, @in=@remote, 0x0, 0x400, 0x1000, 0x0, 0x2, 0x20, 0x10, 0x84, 0x0, 0xffffffffffffffff}, {}, {0x0, 0x4000000000000, 0x0, 0xffffffffffffffff}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1}}, 0xb8}}, 0x80) sendmsg$nl_xfrm(r2, &(0x7f0000000480)={0x0, 0x0, &(0x7f0000000800)={&(0x7f0000000000)=ANY=[@ANYBLOB="650100001b"], 0x168}}, 0xc0) executing program 3: ioctl$VIDIOC_QUERYSTD(0xffffffffffffffff, 0x8008563f, &(0x7f0000000000)) r0 = syz_usb_connect(0x2, 0xb3, &(0x7f0000000640)=ANY=[@ANYBLOB="12010002ef0201406d0425080001000000010902a1000201008032080b00020e03000009040000000e0100000d240100012700006cdc0201011124020101020000000000000000020d000924030201010001"], &(0x7f0000000a40)={0x0, 0x0, 0x0, 0x0}) syz_usb_control_io$rtl8150(r0, 0x0, &(0x7f00000003c0)={0x2c, &(0x7f00000000c0)=ANY=[], 0x0, 0x0, 0x0, 0x0}) write(0xffffffffffffffff, &(0x7f0000000500)='transport=rdma,nqn=nqn.2014-08.org.n', 0x24) executing program 3: r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000000), 0x40241, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000200)={'syzkaller1\x00', 0xc201}) r1 = socket$kcm(0x2, 0xa, 0x2) ioctl$SIOCSIFHWADDR(r1, 0x8914, &(0x7f0000000180)={'syzkaller1\x00', @link_local={0x1, 0x80, 0xc2, 0x0, 0x0, 0xe}}) r2 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r2, &(0x7f0000000200)={0x0, 0x0, &(0x7f0000000000)={&(0x7f00000009c0)=ANY=[@ANYBLOB="140000001000010000000000000000000000000a20000000000a01020000000000000000010000000900010073797a300000000040000000160a01000900000000000000010000000900010073797a30000000000900020073797a3000000000140003800800014000000000080002400000000048000000160a0101000b000000000000010000000900020073797a30000000000900010073797a30000000001c0003801800"], 0xd0}, 0x1, 0x0, 0x0, 0x24040841}, 0x20048010) write$tun(r0, &(0x7f0000001280)=ANY=[@ANYBLOB="000086dd00001100"], 0xfce) executing program 0: socket$nl_route(0x10, 0x3, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000140)={0xa, 0x8b}, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000280)=0x8) r0 = getpid() sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x2) sched_setscheduler(r0, 0x2, &(0x7f0000000200)=0x7) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeea, 0x8031, 0xffffffffffffffff, 0x28f43000) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r1, &(0x7f0000000180)=@abs, 0x6e) sendmmsg$unix(r2, &(0x7f0000000000), 0x651, 0x0) recvmmsg(r1, &(0x7f00000000c0), 0x10106, 0x2, 0x0) mmap$IORING_OFF_SQ_RING(0x110c230000, 0x8000002, 0x2000007, 0x401d031, 0xffffffffffffffff, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./sys\x00', 0x1ff) mount(0x0, &(0x7f0000000040)='./sys\x00', &(0x7f0000000080)='sysfs\x00', 0x0, 0x0) r3 = openat(0xffffffffffffff9c, 0x0, 0x2, 0x0) write(r3, &(0x7f00000005c0)="306663353a313232373a3f7092c0f0bc085a193376cf620afaf6379a248d1d6534058f1095109da34b6d6537a6e78b0dc4b7bc0b", 0x34) r4 = socket$inet_tcp(0x2, 0x1, 0x0) ioctl$sock_SIOCGIFINDEX(r4, 0x8933, &(0x7f0000000180)={'syz_tun\x00'}) mkdirat(0xffffffffffffff9c, &(0x7f0000000080)='./file1\x00', 0x1c0) mkdirat(0xffffffffffffff9c, &(0x7f00000000c0)='./file0\x00', 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000240)='./file2\x00', 0x207) mount$overlay(0x0, &(0x7f0000000100)='./file0\x00', &(0x7f0000000000), 0x0, &(0x7f00000000c0)={[{@workdir={'workdir', 0x3d, './file0'}}, {@lowerdir={'lowerdir', 0x3d, '.'}}, {@upperdir={'upperdir', 0x3d, './file2'}}], [], 0x2c}) r5 = openat$dir(0xffffffffffffff9c, &(0x7f0000000000)='./file0/file1\x00', 0x20400, 0x20) fsync(r5) executing program 6: r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000000), 0x2, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000200)={'syzkaller1\x00', 0x5001}) bpf$PROG_LOAD(0x5, &(0x7f0000000180)={0x5, 0x4, &(0x7f0000000080)=ANY=[@ANYBLOB="b40500000000000069108e0000000000bc0010"], 0x0, 0x5, 0x0, 0x0, 0x0, 0x8}, 0x94) r1 = socket$inet_udp(0x2, 0x2, 0x0) r2 = socket$nl_route(0x10, 0x3, 0x0) r3 = socket$unix(0x1, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r3, 0x8933, 0x0) sendmsg$nl_route_sched(r2, &(0x7f00000012c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f00000000c0)=@newqdisc={0x30, 0x24, 0x601, 0x0, 0x0, {0x0, 0x0, 0x0, 0x0, {}, {0xfff1, 0xffff}}, [@qdisc_kind_options=@q_ingress={0xc}]}, 0x30}}, 0x0) sendmsg$nl_route_sched(r2, &(0x7f0000000580)={0x0, 0x0, &(0x7f0000000300)={&(0x7f0000001300)=@newtfilter={0x80, 0x2c, 0x601, 0x0, 0x0, {0x0, 0x0, 0x0, 0x0, {0xb, 0x7}, {0xfff1, 0xffff}, {0x300}}, [@filter_kind_options=@f_matchall={{0xd}, {0x4c, 0x2, [@TCA_MATCHALL_ACT={0x48, 0x2, [@m_ct={0x44, 0x1, 0x0, 0x0, {{0x7}, {0x1c, 0x2, 0x0, 0x1, [@TCA_CT_PARMS={0x18, 0x1, {0x0, 0x0, 0x3}}]}, {0x4}, {0xc}, {0xc}}}]}]}}]}, 0x80}}, 0x0) ioctl$sock_inet_SIOCSIFFLAGS(r1, 0x8914, &(0x7f0000000200)={'syzkaller1\x00', 0x1}) write$tun(r0, &(0x7f0000000040)=ANY=[@ANYBLOB="03031b003a003200060063"], 0x76) executing program 4: r0 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r0, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000001680)=ANY=[@ANYBLOB="140000001000010000000000000000000500000a28000000000a030000000000000000000a00000708000240000000020900010073797a31000000002c000000030a010100000000000000000a0000070900010073797a3100000000090003007379"], 0x7c}, 0x1, 0x0, 0x0, 0x40001}, 0x4040850) sendmsg$NFT_BATCH(r0, &(0x7f0000009b40)={0x0, 0x0, &(0x7f0000009b00)={&(0x7f0000000240)=ANY=[@ANYBLOB="140000001000010000000000000000000500000a48000000030a0fdb00000000000000000a0000050900030073797a30000000000900010073797a310000000014000480080002403cb140bb0800014000000003080005400000000014000000110001"], 0x70}, 0x1, 0x0, 0x0, 0x4000850}, 0x24000840) sendmsg$NFT_BATCH(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000cc0)={&(0x7f00000002c0)={{0x14, 0x10, 0x1, 0x0, 0x0, {0x3}}, [@NFT_MSG_DELCHAIN={0x2c, 0x5, 0xa, 0x101, 0x0, 0x0, {0xa, 0x0, 0xa}, [@NFTA_CHAIN_TABLE={0x9, 0x1, 'syz1\x00'}, @NFTA_CHAIN_HANDLE={0xc, 0x2, 0x1, 0x0, 0x1}]}, @NFT_MSG_DELRULE={0x20, 0x8, 0xa, 0x101, 0x0, 0x0, {0xa, 0x0, 0x9}, [@NFTA_RULE_TABLE={0x9, 0x1, 'syz1\x00'}]}], {0x14}}, 0x74}, 0x1, 0x0, 0x0, 0xb0}, 0x20008890) executing program 4: socket$inet_smc(0x2b, 0x1, 0x0) socket$inet_udp(0x2, 0x2, 0x0) socket$nl_generic(0x10, 0x3, 0x10) socket$nl_netfilter(0x10, 0x3, 0xc) r0 = bpf$MAP_CREATE(0x0, 0x0, 0x0) bpf$PROG_LOAD(0x5, &(0x7f0000000600)={0x1, 0xf, &(0x7f00000006c0)=@ringbuf={{0x18, 0x0, 0x0, 0x0, 0x107a655, 0x0, 0x0, 0x0, 0x10}, {{0x18, 0x1, 0x1, 0x0, r0}}, {}, [], {{}, {}, {0x85, 0x0, 0x0, 0x85}}}, &(0x7f0000000000)='GPL\x00', 0x0, 0x0, 0x0, 0x41000, 0x8, '\x00', 0x0, @fallback=0x6, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) openat$sndtimer(0xffffffffffffff9c, &(0x7f00000006c0), 0x1a0001) openat$udambuf(0xffffffffffffff9c, &(0x7f0000000480), 0x2) socket(0x400000000010, 0x3, 0x0) openat$sndseq(0xffffffffffffff9c, &(0x7f0000000600), 0x183c81) socket(0x10, 0x3, 0x0) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000140)) r1 = openat$iommufd(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) ioctl$IOMMU_IOAS_ALLOC(r1, 0x3b81, &(0x7f00000003c0)={0xc, 0x0, 0x0}) ioctl$IOMMU_TEST_OP_CREATE_ACCESS(r1, 0x3ba0, &(0x7f0000000340)={0x48, 0x5, r2, 0x0, 0xffffffffffffffff, 0x1}) r3 = openat$rdma_cm(0xffffffffffffff9c, &(0x7f0000000940), 0x2, 0x0) socketpair(0x1, 0x1, 0x0, &(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}) bpf$MAP_UPDATE_ELEM_TAIL_CALL(0x2, &(0x7f00000001c0)={{}, 0x0, &(0x7f0000000100)=r4}, 0x20) writev(r3, &(0x7f0000000040)=[{&(0x7f0000000100), 0x6b82}], 0x2) executing program 1: ioctl$vim2m_VIDIOC_S_FMT(0xffffffffffffffff, 0xc0d05605, 0x0) r0 = userfaultfd(0x801) close_range(0xffffffffffffffff, 0xffffffffffffffff, 0x2) ioctl$UFFDIO_API(r0, 0xc018aa3f, &(0x7f00000000c0)) mprotect(&(0x7f0000000000/0xf000)=nil, 0xf000, 0x1) ioctl$UFFDIO_CONTINUE(r0, 0xc020aa08, &(0x7f0000000080)={{&(0x7f0000400000/0xc00000)=nil, 0xc00000}}) executing program 4: r0 = syz_open_dev$hiddev(&(0x7f00000000c0), 0x0, 0x0) ioctl$HIDIOCSREPORT(r0, 0x81044804, &(0x7f0000000400)={0x1}) executing program 7: r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f00000018c0)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000001900)=ANY=[@ANYBLOB="280000001e0001"], 0x28}}, 0x0) executing program 1: ioctl$SNDRV_CTL_IOCTL_ELEM_WRITE(0xffffffffffffffff, 0xc1105518, &(0x7f0000000040)={{0x0, 0x0, 0x0, 0x0, 'syz0\x00'}, 0x1, [0x4, 0x3, 0xfffffffffffffffe, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x801, 0x0, 0x0, 0xfffffffffffffffe, 0x0, 0x40000000, 0x0, 0x0, 0x0, 0x0, 0x2d8, 0x0, 0x470, 0xa7, 0x8, 0x8000000000000000, 0x0, 0xfffffffffffffffe, 0x9, 0x0, 0x2, 0x0, 0xfffffffa, 0x3, 0xfffffffffffffffe, 0x0, 0x400, 0x0, 0x0, 0x0, 0x2, 0x3, 0x7, 0x1, 0x0, 0x8000, 0x7, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4, 0x0, 0x0, 0x4, 0x4, 0x0, 0x0, 0xfffffffffffffffc, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x0, 0x8, 0xf5, 0x0, 0x4, 0x0, 0xd318, 0x2000000000, 0x0, 0x4, 0x0, 0x1000000000000000, 0x0, 0x0, 0xfffffffffffffffc, 0xffffffffffffffff, 0x0, 0xfffffffffffffffc, 0x0, 0x6, 0x0, 0xfffffffd, 0x8, 0x7, 0x6, 0x800000, 0x0, 0x101, 0x272f, 0xd721, 0x0, 0x4, 0x0, 0xffffffffffffffff, 0x1, 0xfffffffffffffffd, 0x0, 0x0, 0x0, 0x1, 0x4, 0x5, 0x1, 0x4000000, 0x5, 0x0, 0xdc5d, 0x0, 0x0, 0x1000, 0x0, 0x0, 0x0, 0x4000000000006fd, 0x0, 0x6, 0x0, 0x0, 0x0, 0x100]}) r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000140), 0x40241, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000000)={'syzkaller1\x00', 0xc201}) r1 = socket$kcm(0x2, 0xa, 0x2) ioctl$SIOCSIFHWADDR(r1, 0x8914, &(0x7f0000000080)={'syzkaller1\x00', @link_local={0x1, 0x80, 0xc2, 0x0, 0x0, 0x1c}}) write$tun(r0, 0x0, 0xfdef) openat$iommufd(0xffffffffffffff9c, 0x0, 0x0, 0x0) fstat(0xffffffffffffffff, 0x0) r2 = syz_open_dev$usbfs(&(0x7f0000000240), 0xb, 0x101301) r3 = socket$nl_generic(0x10, 0x3, 0x10) setsockopt$inet_sctp_SCTP_DEFAULT_SEND_PARAM(0xffffffffffffffff, 0x84, 0xa, &(0x7f00000001c0)={0x8, 0x6, 0x6, 0x0, 0x2, 0x5775d27c, 0x158, 0x20100}, 0x20) sendmsg$nl_generic(r3, &(0x7f0000000100)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000180)=ANY=[@ANYBLOB="4800000041000501010000000000000001010000000000001c0001000600060008000000100007007f0000017f000001910040001400020010000c00040006"], 0x48}, 0x1, 0x0, 0x0, 0x2c048040}, 0xe800) ioctl$USBDEVFS_IOCTL(r2, 0xc0105512, &(0x7f0000000200)) ioctl$USBDEVFS_GET_SPEED(r2, 0x551f) ioctl$USBDEVFS_IOCTL(r2, 0x80045505, &(0x7f0000000040)=@usbdevfs_connect) ioctl$USBDEVFS_CLAIM_PORT(r2, 0x80045518, 0x0) r4 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000040)='memory.events\x00', 0x275a, 0x0) syz_open_dev$mtd(&(0x7f0000000240), 0x0, 0x82000) write$tun(r4, &(0x7f0000000340)=ANY=[], 0x141) r5 = openat$userio(0xffffffffffffff9c, &(0x7f0000000300), 0x22242, 0x0) write$USERIO_CMD_REGISTER(r5, &(0x7f00000000c0), 0x2) mmap(&(0x7f0000000000/0x4000)=nil, 0x4000, 0x1, 0x10012, r4, 0x0) syz_clone3(&(0x7f0000000280)={0x84000000, &(0x7f0000000000), &(0x7f0000000080), &(0x7f00000000c0)=0x0, {0x1f}, &(0x7f0000000100)=""/36, 0x24, &(0x7f0000000140)=""/22, &(0x7f0000000180)=[0xffffffffffffffff, 0x0, 0x0], 0x3}, 0x58) ioctl$BLKTRACESETUP(r4, 0xc0481273, &(0x7f0000000300)={'\x00', 0x4, 0x8, 0x5, 0x2, 0xd, r6}) executing program 4: r0 = syz_usb_connect(0x0, 0x39, &(0x7f0000000100)=ANY=[], 0x0) syz_usb_disconnect(r0) r1 = syz_usb_connect(0x0, 0x3f, &(0x7f0000000540)=ANY=[], 0x0) syz_usb_control_io(r1, 0x0, 0x0) syz_usb_control_io$printer(r1, 0x0, 0x0) r2 = syz_open_dev$char_usb(0xc, 0xb4, 0x0) ioctl$EVIOCGMASK(r2, 0x5b03, 0x0) executing program 7: r0 = syz_open_dev$vim2m(&(0x7f0000000100), 0x0, 0x2) ioctl$vim2m_VIDIOC_STREAMOFF(r0, 0x40045612, &(0x7f0000000040)=0x1) ioctl$vim2m_VIDIOC_QBUF(r0, 0xc058560f, &(0x7f0000000180)=@mmap={0x1, 0x1, 0x4, 0x100, 0x81, {}, {0x4, 0x8, 0x8, 0x5, 0x29, 0x9, "0adb3fb8"}, 0x3}) write$uinput_user_dev(0xffffffffffffffff, &(0x7f0000000400)={'syz0\x00', {0x3, 0x2, 0x6, 0xfffa}, 0x3a, [0x8001, 0xc95a, 0xf, 0x8, 0x80, 0x2, 0x7, 0x7f, 0xa9, 0x4d, 0x6, 0x5f, 0x9, 0x15, 0xffff2d37, 0xff7fff01, 0x6, 0x5, 0x7, 0x5, 0x4, 0x0, 0x7, 0x3c5b, 0x1, 0x20, 0xd, 0x1, 0x0, 0xffffffff, 0xe661, 0x6, 0x7, 0x5, 0x8, 0x4c74, 0xffff7fff, 0x7, 0x3, 0xe, 0x0, 0x80008071, 0x7, 0x17, 0xffffffff, 0x7, 0x5, 0x80003e, 0x18e, 0x6, 0x6, 0x0, 0x8, 0x4, 0x8, 0x3ff, 0x80, 0x0, 0x5, 0x6, 0x8, 0x7, 0x1, 0x40], [0x10000007, 0x9, 0x8000012f, 0x8004, 0x5, 0xfffffff3, 0x129432f6, 0xc8, 0xf1, 0xe, 0x2bf, 0x6c7, 0x2009, 0xfffffffc, 0x573a, 0x0, 0x0, 0x5, 0x2f, 0x8, 0x312, 0x66abcbd2, 0xea4, 0x0, 0x4, 0x1007, 0x7fff, 0x6, 0x400, 0x401, 0x6, 0x1, 0xff, 0x7, 0x1000005, 0x5f31, 0xd, 0x4e0, 0x381, 0x4, 0xb, 0x4, 0x9, 0x8, 0x40, 0x6, 0x47, 0x8000, 0x1, 0xfe000000, 0xffff, 0x2, 0x4, 0x200009, 0x3, 0x3, 0x4000009, 0x6, 0x0, 0x3, 0xbc45, 0x48c93690, 0x42, 0x3], [0x6, 0x40a, 0x3ff, 0x5, 0xfffffffd, 0x100, 0x5, 0x9, 0x5, 0x7fff, 0x0, 0x5, 0xb, 0x4, 0x5, 0x5, 0x0, 0x1ef, 0x3, 0x8, 0x86, 0x1000515, 0x303c, 0x3e7, 0xb, 0x5, 0x2, 0x2, 0x3, 0x20000008, 0x4, 0x6cff, 0x6, 0x20000038, 0x200, 0x1fd, 0x80, 0x7, 0x4, 0x2950bfaf, 0x1000, 0xa2, 0x7, 0xcc, 0x5, 0x6, 0xac8, 0xbf, 0x2, 0x3, 0x7ff, 0x12b, 0x4, 0x1, 0xa, 0xffffffff, 0x5, 0x1c, 0x120000, 0x7ef, 0x2006, 0x80a2cd, 0x4, 0x25], [0xc, 0xbb33, 0x7, 0xb, 0x5, 0x938, 0x6, 0x6, 0x0, 0xb9, 0xce4, 0x1ff, 0x2, 0x57, 0x5, 0x3, 0x2, 0x10000, 0x4, 0x7fff, 0xfff4, 0xa620, 0x1, 0x5, 0x801, 0x2000002, 0x150, 0x60a7, 0x6, 0x16, 0xffffffff, 0x8, 0x4, 0x5, 0xca, 0x1, 0xfffff000, 0x10000, 0xf, 0x7e, 0x9, 0x9622, 0x7, 0xaf, 0x20000008, 0x5, 0x226, 0x2, 0x5, 0x0, 0x30b1d693, 0xa1f, 0xf40, 0x7, 0x530e, 0xe1c4, 0x0, 0x0, 0x5, 0x7ff, 0xd7, 0x200, 0xb, 0xfff]}, 0x45c) ppoll(&(0x7f00000000c0)=[{}, {}], 0x20000000000000dc, 0x0, 0x0, 0x0) executing program 7: bpf$MAP_CREATE(0x0, &(0x7f0000000080)=ANY=[], 0x50) bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x0, 0xc, 0x0, 0x0, 0xfffffffd, 0x0, 0x0, 0x0, 0x40, '\x00', 0x0, @fallback=0x10, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) socket(0x10, 0x803, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x1, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000380)={0xa, 0x100008b}, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000200)=0x8) openat$sequencer(0xffffffffffffff9c, &(0x7f00000001c0), 0x80200, 0x0) r0 = syz_open_dev$sndmidi(&(0x7f00000004c0), 0x2, 0x141102) writev(r0, &(0x7f0000000840)=[{&(0x7f00000002c0)="94", 0xf000}, {0x0}], 0x2) ioctl$sock_SIOCGIFINDEX(0xffffffffffffffff, 0x8933, 0x0) r1 = socket$kcm(0xa, 0x3, 0x3a) r2 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r2, &(0x7f0000000480)={0x0, 0x0, &(0x7f0000001f40)={&(0x7f00000004c0)=ANY=[@ANYBLOB="fc000000190001002dbd700000000000ac1e0001000000000000000000000000ac1414aa00"/48, @ANYRES32=0x0, @ANYRES32, @ANYBLOB="00000000000000000c00000000000000000000000000000000000000000000000000000000000000ffffffffffffffff000000000000000000000000000000000000000000000000000a000000000000feffffffff7f40000200000000000008ffffffff00000000010006000000000044000500ac1414bb000000000000000000000000000000003c0000000200000000000000000000000000000000000001060000"], 0xfc}, 0x1, 0x0, 0x0, 0x4008000}, 0x600c010) sendmsg$kcm(r1, &(0x7f0000000080)={&(0x7f0000000000)=@l2tp6={0xa, 0x0, 0x0, @loopback={0xfe80000000000000, 0xac14140c}}, 0x80, &(0x7f00000000c0)=[{&(0x7f0000000140)='\x00\x00', 0xffe3}], 0x1, 0x0, 0x0, 0x900}, 0x60) setsockopt$IPT_SO_SET_REPLACE(0xffffffffffffffff, 0x0, 0x40, 0x0, 0x0) syz_usb_connect(0x3, 0x57, &(0x7f0000000000)=ANY=[@ANYBLOB="1201000200000040402001c60100000000010902450001010080fa0904"], 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000340)='./file1\x00', 0x0) mkdirat(0xffffffffffffff9c, &(0x7f00000000c0)='./bus\x00', 0x1d7) mkdirat(0xffffffffffffff9c, &(0x7f0000000400)='./file1/file0\x00', 0x100) mount$bind(&(0x7f0000000100)='.\x00', &(0x7f0000000080)='./file1/file0\x00', 0x0, 0x1085408, 0x0) r3 = openat$sw_sync(0xffffffffffffff9c, &(0x7f0000000ac0), 0x800, 0x0) ioctl$SW_SYNC_IOC_CREATE_FENCE(r3, 0xc0285700, &(0x7f0000000b00)={0x4, "abacd211119ca94c63377526aeb5ab2c7b9ca5fa07558139ede6dc06270ee042", 0xffffffffffffffff}) ioctl$SYNC_IOC_MERGE(r4, 0xc0303e03, &(0x7f0000000780)={"d1ed39d88b014076ab94c1fb10628c46d2e66ccdb9e581a38ebb0ddd5f307e56", 0xffffffffffffffff, 0xffffffffffffffff}) ioctl$SYNC_IOC_FILE_INFO(r5, 0xc0383e04, 0x0) mount$overlay(0x0, &(0x7f00000000c0)='./bus\x00', &(0x7f00000003c0), 0x40, &(0x7f0000000300)={[{@workdir={'workdir', 0x3d, './bus'}}, {@upperdir={'upperdir', 0x3d, './file1'}}]}) bpf$PROG_LOAD(0x5, 0x0, 0x0) r6 = syz_usb_connect$hid(0x1, 0x36, &(0x7f0000000040)=ANY=[@ANYBLOB="12010000090024206d041cc340000000000109022400010000a00009040000010301010009"], 0x0) r7 = syz_open_procfs(0xffffffffffffffff, &(0x7f0000000080)='stat\x00') read$FUSE(r7, &(0x7f0000004180)={0x2020}, 0x2020) syz_usb_control_io$hid(r6, &(0x7f0000000240)={0x24, &(0x7f00000003c0)=ANY=[@ANYBLOB="00000c000000070001"], 0x0, 0x0, 0x0}, 0x0) executing program 6: r0 = socket$packet(0x11, 0x2, 0x300) setsockopt$SO_ATTACH_FILTER(r0, 0x1, 0x1a, &(0x7f0000000100)={0x2, &(0x7f0000000040)=[{0x0, 0x0, 0xfd, 0xc8e}, {0x16, 0xff, 0x6, 0x6}]}, 0x10) setsockopt$packet_fanout(r0, 0x107, 0x12, 0x0, 0x0) r1 = socket$inet_udp(0x2, 0x2, 0x0) bind$inet(r1, &(0x7f0000000140)={0x2, 0x80, @dev={0xac, 0x14, 0x14, 0xf}}, 0x10) sendmmsg$inet(r1, &(0x7f0000000c00)=[{{&(0x7f0000010940)={0x2, 0x4e22, @multicast2}, 0x10, 0x0}}], 0x1, 0x2000c044) sendto$inet(r1, &(0x7f0000000c80)="e8", 0x6200, 0x0, 0x0, 0x0) executing program 6: syz_usb_connect(0x0, 0x4b, &(0x7f0000000000)=ANY=[@ANYBLOB="1201000200000040480b051000010102000109023900020100803209040000000000000009"], 0x0) r0 = syz_open_dev$dvb_demux(&(0x7f0000000200), 0x1, 0x2) ioctl$DVB_DEMUX_DMX_SET_PES_FILTER(r0, 0x40146f2c, &(0x7f0000000100)={0x1ff, 0x0, 0x3, 0xa, 0x4}) executing program 3: ioctl$VIDIOC_QUERYSTD(0xffffffffffffffff, 0x8008563f, &(0x7f0000000000)) r0 = syz_usb_connect(0x2, 0xb3, &(0x7f0000000640)=ANY=[@ANYBLOB="12010002ef0201406d0425080001000000010902a1000201008032080b00020e03000009040000000e0100000d240100012700006cdc0201011124020101020000000000000000020d000924030201010001"], &(0x7f0000000a40)={0x0, 0x0, 0x0, 0x0}) syz_usb_control_io$rtl8150(r0, 0x0, &(0x7f00000003c0)={0x2c, &(0x7f00000000c0)=ANY=[], 0x0, 0x0, 0x0, 0x0}) write(0xffffffffffffffff, &(0x7f0000000500)='transport=rdma,nqn=nqn.2014-08.org.nvmexpress:NVMf:uui', 0x36) executing program 0: socket$can_raw(0x1d, 0x3, 0x1) socket(0x18, 0x80000, 0x1) socket$key(0xf, 0x3, 0x2) syz_open_procfs$namespace(0x0, &(0x7f0000000280)='ns/ipc\x00') syz_open_procfs$namespace(0x0, &(0x7f0000000040)='ns/ipc\x00') socket$inet_udp(0x2, 0x2, 0x0) syz_open_dev$vim2m(&(0x7f0000000080), 0x7, 0x2) socket$inet_icmp_raw(0x2, 0x3, 0x1) bpf$PROG_LOAD(0x5, &(0x7f0000000000)={0x13, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x40, '\x00', 0x0, @fallback=0x2e, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0x1}, 0x94) socket$netlink(0x10, 0x3, 0x0) openat$rdma_cm(0xffffffffffffff9c, &(0x7f0000000180), 0x2, 0x0) socket$nl_xfrm(0x10, 0x3, 0x6) mkdirat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000)='./cgroup/syz0\x00', 0x1ff) openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000), 0x200002, 0x0) r0 = epoll_create1(0x0) socket$nl_route(0x10, 0x3, 0x0) r1 = socket$netlink(0x10, 0x3, 0x0) sendmsg$nl_route(0xffffffffffffffff, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000000080)=ANY=[@ANYBLOB="540000001000010400000000000000ffff000000", @ANYRES32=0x0, @ANYBLOB="0380000000000000240012800c0001006d6163766c616e00140002800800010008000000060002000100000008000500", @ANYRES32=r0, @ANYBLOB='\b\x00\n\x00', @ANYRES8=r1], 0x54}, 0x1, 0x0, 0x0, 0x4000085}, 0x0) sendmmsg(r1, &(0x7f00000002c0), 0x40000000000009f, 0x20) executing program 1: r0 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r0, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000001680)=ANY=[@ANYBLOB="140000001000010000000000000000000500000a28000000000a030000000000000000000a00000708000240000000020900010073797a31000000002c000000030a010100000000000000000a0000070900010073797a31000000000900030073797a320000000014"], 0x7c}, 0x1, 0x0, 0x0, 0x40001}, 0x4040850) sendmsg$NFT_BATCH(r0, &(0x7f0000009b40)={0x0, 0x0, &(0x7f0000009b00)={&(0x7f0000000240)=ANY=[@ANYBLOB="140000001000010000000000000000000500000a48000000030a0fdb00000000000000000a0000050900030073797a30000000000900010073797a310000000014000480080002403cb140bb0800014000000003080005400000000014000000110001"], 0x70}, 0x1, 0x0, 0x0, 0x4000850}, 0x24000840) sendmsg$NFT_BATCH(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000cc0)={&(0x7f00000002c0)={{0x14, 0x10, 0x1, 0x0, 0x0, {0x3}}, [@NFT_MSG_DELCHAIN={0x2c, 0x5, 0xa, 0x101, 0x0, 0x0, {0xa, 0x0, 0xa}, [@NFTA_CHAIN_TABLE={0x9, 0x1, 'syz1\x00'}, @NFTA_CHAIN_HANDLE={0xc, 0x2, 0x1, 0x0, 0x1}]}, @NFT_MSG_DELRULE={0x20, 0x8, 0xa, 0x101, 0x0, 0x0, {0xa, 0x0, 0x9}, [@NFTA_RULE_TABLE={0x9, 0x1, 'syz1\x00'}]}], {0x14}}, 0x74}, 0x1, 0x0, 0x0, 0xb0}, 0x20008890) executing program 1: sendmmsg$inet(0xffffffffffffffff, &(0x7f0000002140)=[{{0x0, 0x0, &(0x7f0000000540)=[{&(0x7f0000002280)="21ae1baf930b4569b9ddef9797ffd935c7d80e6466b3e4e62dd4603583f5d4b61fbc65b6ac744d7319535e75bf552062e4cfde1ba7ce29263322e18ea9740aa89f69c47a63133708cda00d2b1f4e799bd41e3f76258180fa91a42aaa8b1ebc4e0ea8fb12f2c71e6e5bc57a8e91f254005514721d93c13c5606ae1fea7f31f558d562bd5a8dfb0b9fed873efa221fccffa84fcd374c92e6cbb03e6a9de890ce323f000000abcc6c01326d588495b7c1a7db31ec4129e6336f26bb9e0b7552af3cd2d5dda1632799bbc98425c433384d8a8e4071ff39a36dfde5f05af35a4ddd340cfecd7ec935f4ce7d3e851583ba1cf53a90a7f7bce5703de57ce93ddef7849b30a01de0637e6d5e507b801d32e582e0c2d564539ebfc84c098a23e765552767b122885fb1629e9c180be47da7931bd125b80de1594b75e5371a81c2c32d0c4a028a5aab0c56a2edf2e0483b87f5ab299dc046076203dea10ccbfc631d5bf4a87ce67004519f248f086346ce6a8a9d181789a59f81d9b7f6781daac3e229914b8b8998c15c3b6302a519331cb05995bc60b7cb872dd3b5b43331c77c5d72e21f7bd2b1a915ff3204e3f20d3a20b22d6a58155b5a4ebf6d1d1cd90c656ecada531c07ff91deb3efa91762cdecfbcc43553750f22ac5c18cc5e8b6f790c2f4e6373af9f98d10e6df49ff8e5cbcbd68e11ed0b967add11410dc2e34f08dbfaf8eb95d4d1153b4c6093192a340eb30fcc71619888c6486746a049585d249efb96b9cace83320b8f96b40ebe3a9a788d05a053380d1026b9434df87a3a387549bcabe88684c4d0948a6e219b5769480e6d0a9bf0da9a5212f3dbc8d1dff240856691243b203d7edd4d3cc89a38a6c80fdb1229a01044af7aaecb20d5570ebf24b30bbc6dfc3f70d85cd9f0d60ebd8fedd161d199d9997a0e2d18d1c99bc7158564e0ddb4673055de196535d706d142e1dc7d404583923cb1b286cfc5418884ac7e605d93652dc48ff8261c63790a91ee2c5ff9a21677b4bc7e73ddf2d0e46807c57bf64b0b9df7fc67ecba6521767dcc7d4299c740e73bc49cbcf0049faf222c48896378497c0a7be6238217f85c83a2c45376ddf1a8f631c22c8cf453e8a4fe7bf8160a82bd069be9a9e163724a7412bbc30b68bb31bd571f0571297726a309691408af62ecfc77ea52718c39e802f00a726aaa625407f3b18fd4f66db2bbd05dfd62e448fc6bb9fc51960e12b67c5d42e82df55f5d87428137874e27db5cc", 0x37d}, {0x0}, {&(0x7f0000002200)="f610e61ac81cc3edc86f0500", 0xc}], 0x3, 0x0, 0x0, 0x900}}], 0x1, 0x0) r0 = socket(0x10, 0x803, 0x0) sendto(r0, &(0x7f00000000c0)="120000001200e7ef007b00000000000000a1", 0x12, 0x0, 0x0, 0x0) recvmmsg(r0, &(0x7f00000037c0)=[{{&(0x7f00000004c0)=@ethernet={0x0, @random}, 0xfdf4, &(0x7f0000000380)=[{&(0x7f0000000000)=""/102, 0x365}, {&(0x7f0000000280)=""/76, 0x14c}, {&(0x7f0000000fc0)=""/4096, 0x197}, {&(0x7f0000000400)=""/92, 0x645}, {&(0x7f0000000980)=""/73, 0x1b}, {&(0x7f0000000200)=""/77, 0x188}, {&(0x7f00000007c0)=""/154, 0x2c}, {&(0x7f00000001c0)=""/17, 0x1d8}], 0x21, &(0x7f0000000600)=""/191, 0x41}}], 0x4000000000003b4, 0x0, &(0x7f0000003700)={0x77359400}) program crashed: general protection fault in mxl111sf_ep6_streaming_ctrl bisect: the chunk can be dropped bisect: testing without sub-chunk 3/3 testing program (duration=6m4s, {Threaded:true Repeat:true RepeatTimes:0 Procs:6 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): [1, 2, 23, 21, 5, 13, 13, 22, 5, 5, 5, 6, 12, 12, 4, 7, 24, 3] detailed listing: executing program 2: syz_mount_image$vfat(&(0x7f0000000000), &(0x7f0000000500)='./file0\x00', 0x2200810, &(0x7f0000000040)=ANY=[@ANYRES64=0x0, @ANYRES16, @ANYRESOCT, @ANYRESHEX, @ANYRESDEC, @ANYRES64], 0x1, 0x265, &(0x7f00000006c0)="$eJzs2k9rXFUYB+D3pimpKenE/7YgHnShboYmaxcNkoI4IGgjVEF6a250yHUm5A6BEbFZKbjq2pVrcelCEKRLN9n4CVzoKpssuxCvJJO0SYxoGscJ9nk288I5P86595w5nMXdfOX2R8tL47GU92Isy2LsSqzH3SymYyz2rMfLL17/8dm3rr/z+lyrNf9mSlfnrs3MppQuPPfDu5988/yd3vm3v73w/URsTL+3uTX7y8ZTGxc3f7/2YbtK7Sp1ur2Up5vdbi+/WRZpsV0tN1O6XRZ5VaR2pypWD7Qvld2VlX7KO4tTkyurRVWlvNNPy0U/9bqpt9pP+Qd5u5OazWaamgxOYuHru3UdW/XZG1HX9SNfxfk7MfVzNCJ7NGWPX8mevJE9vZ5d3KrrxqinylBY/4fbvkP9XET5+drC2sLgd9A+txTtKKOIy9GI32J7m+wa1Fdfa81fTjum47Py1m7+1trCmZ38F3v5mWjE9NH5mUE+HcxPxOT+8We/eyye+HP+1zOt+dkj8+fipRf25ZvRiJ/ej26UsRjb2fvjfzqT0qtvtA7lL+30AwD4v2mme468vzWbf9U+yB/jfnjofjUel8ZH++xEVP2Pl/OyLFYfoJiI46a299Q/6Nx9sPkcq8h2X8Dfd35mbIjTOA3Fl6djGkMqBudY3Fvvf3mIk/6JDhRndzfk3sE4ylc3gsOI/9z9RR/1TAAAAAAAAAAAADiOQx/9NYbxyeGonxEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAADjd/ggAAP//tpTCRA==") executing program 2: r0 = socket$inet(0x2, 0x5, 0x0) setsockopt$IP_VS_SO_SET_DELDEST(r0, 0x0, 0x488, &(0x7f0000000200)={{0x6, @multicast1, 0x4e1f, 0x0, 'rr\x00'}, {@loopback, 0x4e1f, 0x1, 0x1}}, 0x44) executing program 2: socket$nl_route(0x10, 0x3, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000140)={0xa, 0x8b}, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000280)=0x8) r0 = getpid() sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x2) sched_setscheduler(r0, 0x2, &(0x7f0000000200)=0x7) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeea, 0x8031, 0xffffffffffffffff, 0x28f43000) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r1, &(0x7f0000000180)=@abs, 0x6e) sendmmsg$unix(r2, &(0x7f0000000000), 0x651, 0x0) recvmmsg(r1, &(0x7f00000000c0), 0x10106, 0x2, 0x0) mmap$IORING_OFF_SQ_RING(0x110c230000, 0x8000002, 0x2000007, 0x401d031, 0xffffffffffffffff, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./sys\x00', 0x1ff) mount(0x0, &(0x7f0000000040)='./sys\x00', &(0x7f0000000080)='sysfs\x00', 0x0, 0x0) r3 = openat(0xffffffffffffff9c, &(0x7f00000000c0)='./sys/module/usbcore/parameters/quirks\x00', 0x2, 0x0) write(r3, &(0x7f00000005c0)="306663353a313232373a3f7092c0f0bc085a193376cf620afaf6379a248d1d6534058f1095109da34b6d6537a6e78b0dc4b7bc0b", 0x34) r4 = socket$inet_tcp(0x2, 0x1, 0x0) ioctl$sock_SIOCGIFINDEX(r4, 0x8933, &(0x7f0000000180)={'syz_tun\x00'}) mkdirat(0xffffffffffffff9c, &(0x7f0000000080)='./file1\x00', 0x1c0) mkdirat(0xffffffffffffff9c, &(0x7f00000000c0)='./file0\x00', 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000240)='./file2\x00', 0x207) mount$overlay(0x0, &(0x7f0000000100)='./file0\x00', &(0x7f0000000000), 0x0, &(0x7f00000000c0)={[{@workdir={'workdir', 0x3d, './file0'}}, {@lowerdir={'lowerdir', 0x3d, '.'}}, {@upperdir={'upperdir', 0x3d, './file2'}}], [], 0x2c}) fsync(0xffffffffffffffff) executing program 2: r0 = syz_open_procfs(0x0, &(0x7f0000000c80)='fdinfo\x00') mmap(&(0x7f0000000000/0xe7e000)=nil, 0xe7e000, 0xfffffffffffffffe, 0x4031, 0xffffffffffffffff, 0x0) syz_emit_vhci(0x0, 0x4) ioctl$UFFDIO_COPY(0xffffffffffffffff, 0xc028aa03, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000200)={0x8, 0x8a}, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000180)=0x3) r1 = socket$inet_udp(0x2, 0x2, 0x0) setsockopt$IPT_SO_SET_REPLACE(r1, 0x0, 0x40, 0x0, 0x0) sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x2) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) r2 = syz_open_dev$MSR(&(0x7f00000001c0), 0x0, 0x0) read$msr(r2, &(0x7f0000019680)=""/102392, 0x18ff8) socket$igmp(0x2, 0x3, 0x2) getdents64(r0, &(0x7f0000002440)=""/181, 0xb5) mkdir(&(0x7f0000000040)='./file0\x00', 0x0) ioctl(0xffffffffffffffff, 0x890b, 0x0) bpf$MAP_CREATE(0x0, 0x0, 0x50) setns(0xc9, 0x0) r3 = socket$netlink(0x10, 0x3, 0x8) writev(r3, &(0x7f0000000300)=[{&(0x7f0000000080)='X\x00', 0xfdef}], 0x1) sendmsg$kcm(0xffffffffffffffff, &(0x7f0000000600)={0x0, 0x0, &(0x7f00000003c0)=[{0x0}, {&(0x7f0000000000)="11c9064268", 0x5}], 0x2}, 0x40) executing program 2: r0 = socket$inet_sctp(0x2, 0x5, 0x84) setsockopt$IP_VS_SO_SET_ADD(r0, 0x0, 0x482, &(0x7f00000000c0)={0x84, @dev={0xac, 0x14, 0x14, 0x8b}, 0x15, 0x3, 'fo\x00', 0x1, 0x400000, 0x4}, 0x2c) r1 = socket$kcm(0xa, 0x2, 0x0) setsockopt$IP_VS_SO_SET_ADDDEST(r0, 0x0, 0x487, &(0x7f0000000000)={{0x84, @remote, 0x4e21, 0x3, 'wrr\x00', 0x23, 0x81, 0x36}, {@dev={0xac, 0x14, 0x14, 0x40}, 0x4e23, 0x10000, 0x1cb, 0x12d61, 0x12d58}}, 0x44) sendmsg$sock(r1, &(0x7f0000000400)={&(0x7f0000000580)=@in6={0x2, 0x4e22, 0x0, @dev}, 0x80, 0x0, 0x0, &(0x7f0000000000)=[@mark={{0x14, 0x1, 0x24, 0x3}}], 0x18}, 0x0) executing program 2: socket$netlink(0x10, 0x3, 0x0) syz_open_dev$sndpcmp(0x0, 0xfffffffffffffff1, 0x402000) r0 = openat$cgroup_ro(0xffffffffffffffff, &(0x7f0000000000)='cpuacct.usage_sys\x00', 0x0, 0x0) sendmmsg$unix(r0, 0x0, 0x0, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) sched_setattr(0x0, &(0x7f0000000280)={0x38, 0x6, 0x8, 0x3, 0x0, 0x9, 0x1, 0xfffffe0000000001, 0xfa11, 0xffffffff}, 0x0) madvise(&(0x7f0000284000/0x1000)=nil, 0x1000, 0x3) landlock_create_ruleset(0x0, 0x0, 0x0) syz_clone(0x11, 0x0, 0x0, 0x0, 0x0, 0x0) socket$nl_generic(0x10, 0x3, 0x10) r1 = openat$procfs(0xffffffffffffff9c, &(0x7f00000000c0)='/proc/partitions\x00', 0x0, 0x0) r2 = openat$sysctl(0xffffffffffffff9c, &(0x7f0000000040)='/proc/sys/vm/drop_caches\x00', 0x1, 0x0) sendfile(r2, r1, &(0x7f0000002080)=0x58, 0x12) executing program 32: socket$netlink(0x10, 0x3, 0x0) syz_open_dev$sndpcmp(0x0, 0xfffffffffffffff1, 0x402000) r0 = openat$cgroup_ro(0xffffffffffffffff, &(0x7f0000000000)='cpuacct.usage_sys\x00', 0x0, 0x0) sendmmsg$unix(r0, 0x0, 0x0, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) sched_setattr(0x0, &(0x7f0000000280)={0x38, 0x6, 0x8, 0x3, 0x0, 0x9, 0x1, 0xfffffe0000000001, 0xfa11, 0xffffffff}, 0x0) madvise(&(0x7f0000284000/0x1000)=nil, 0x1000, 0x3) landlock_create_ruleset(0x0, 0x0, 0x0) syz_clone(0x11, 0x0, 0x0, 0x0, 0x0, 0x0) socket$nl_generic(0x10, 0x3, 0x10) r1 = openat$procfs(0xffffffffffffff9c, &(0x7f00000000c0)='/proc/partitions\x00', 0x0, 0x0) r2 = openat$sysctl(0xffffffffffffff9c, &(0x7f0000000040)='/proc/sys/vm/drop_caches\x00', 0x1, 0x0) sendfile(r2, r1, &(0x7f0000002080)=0x58, 0x12) executing program 5: prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x1, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000380)={0x8, 0x100008b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000200)=0x5) openat$sequencer(0xffffffffffffff9c, &(0x7f0000000300), 0x80200, 0x0) r0 = syz_open_dev$sndmidi(&(0x7f00000004c0), 0x2, 0x141102) writev(r0, &(0x7f0000000840), 0x0) r1 = socket$unix(0x1, 0x2, 0x0) sendmsg$kcm(0xffffffffffffffff, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)=[{0x0}, {&(0x7f0000000580)="d4fa0c511aad03aa5ed217677bc41c027d9c830c439c7f821ddd78b6915cb170e7603acf9e433c2903bb6773f4b0130668a1e5b5e08d21d0b69c28ca3455aed65855c86f3d1e5789d26375a0d85eaf5e92e19c9affcf76e7a94e76556d2b104ebf645747fadc91460f4b3c94e1a89b51be4a6aa4c65285f988329a8163b69c51b801500a5bacd0463976e2960e2679ef2feee5e6ce6bb78a51fb0e15820d13e4a5aa9e0742a6f8d677ad28fea356657bb550c8311b682d9003c82267a15aa7334bc53b65b9119a1a7d905c7dd365b85c230bbad0d5d0a79819e112637819d9a187cfdf782c6127d2d4281926ab0e22f7346b616fe28ed0b9f4a0c9fdac6d3a90a9c38b5e31448a45546388c95045bc22fe88c43b", 0x114}], 0x2}, 0x0) r2 = syz_genetlink_get_family_id$tipc(&(0x7f0000000040), 0xffffffffffffffff) sendmsg$TIPC_CMD_SET_LINK_PRI(0xffffffffffffffff, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000000080)={0x68, r2, 0x1, 0x0, 0x0, {{}, {0x0, 0x410c}, {0x4c, 0x14, {0xfffffff0, @link='broadcast-link\x00'}}}}, 0x68}}, 0x0) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f00000005c0)={0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x9, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x4}, 0x50) ioctl$sock_SIOCGIFINDEX_80211(r1, 0x8b18, &(0x7f0000000000)={'wlan0\x00'}) r3 = openat$vnet(0xffffffffffffff9c, 0x0, 0x2, 0x0) r4 = openat$tun(0xffffffffffffff9c, &(0x7f0000000080), 0x2, 0x0) ioctl$TUNSETIFF(r4, 0x400454ca, &(0x7f0000000100)={'\x00', 0x1}) ioctl$VHOST_SET_OWNER(r3, 0xaf01, 0x0) syz_open_procfs(0x0, &(0x7f0000000240)='clear_refs\x00') getsockopt$TIPC_DEST_DROPPABLE(0xffffffffffffffff, 0x10f, 0x81, &(0x7f0000000080), &(0x7f00000000c0)=0x4) add_key$user(&(0x7f00000003c0), &(0x7f0000000440), &(0x7f00000000c0), 0xc9, 0xfffffffffffffffd) syz_genetlink_get_family_id$tipc2(&(0x7f0000000400), 0xffffffffffffffff) mkdirat(0xffffffffffffff9c, &(0x7f0000000440)='./mnt\x00', 0x1ff) mount(&(0x7f0000000400), &(0x7f0000000000)='./mnt\x00', &(0x7f0000000480)='ecryptfs\x00', 0x0, &(0x7f0000000500)='ecryptfs_sig=syz,ecryptfs_fnek_sig=syz,ecryptfs_cipher=aes,ecryptfs_key_bytes=16\x00') executing program 5: r0 = socket$inet6_sctp(0xa, 0x5, 0x84) r1 = socket$inet6_sctp(0xa, 0x1, 0x84) getsockopt$inet_sctp6_SCTP_SOCKOPT_CONNECTX3(r1, 0x84, 0x6f, &(0x7f0000000280)={0x0, 0x1c, &(0x7f0000000000)=[@in6={0xa, 0x0, 0x0, @rand_addr=' \x01\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x01', 0x9}]}, 0x0) getsockopt$inet_sctp6_SCTP_MAX_BURST(r1, 0x84, 0x83, &(0x7f0000000000)=@assoc_value={0x0}, &(0x7f0000000300)=0x8) setsockopt$inet_sctp6_SCTP_AUTH_KEY(r0, 0x84, 0x17, &(0x7f0000000ac0)={r2, 0x8, 0x1, 'x'}, 0x9) executing program 5: r0 = bpf$PROG_LOAD(0x5, &(0x7f0000000a40)={0x1, 0x4, &(0x7f0000000300)=ANY=[@ANYBLOB], &(0x7f0000000200)='GPL\x00', 0x0, 0x0, 0x0, 0x41100, 0x0, '\x00', 0x0, @fallback=0x2a, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) r1 = socket$kcm(0x11, 0xa, 0x300) setsockopt$sock_attach_bpf(r1, 0x1, 0x32, &(0x7f0000000040)=r0, 0x4) r2 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPSET_CMD_CREATE(r2, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000480)=ANY=[], 0x4c}}, 0x2) executing program 5: r0 = syz_ublk_setup_io_uring(0x1d, &(0x7f0000000500)={0x0, 0x30b5, 0x0, 0x2, 0x158}, &(0x7f0000000100)=0x0, &(0x7f0000000400)=0x0, &(0x7f0000000140)=0x0) syz_ublk_add_dev(r0, r1, r2, r3, &(0x7f0000000200)={0x2e, 0x14, 0x0, 0xffffffffffffffff, 0xc0207504, 0x0, 0x0, 0x0, 0x0, 0x4, 0x0, 0x0, '\x00', {0xffffffff, 0xffff, 0x40, &(0x7f00000004c0)=@any_dev={0x3, 0xe26, 0x0, 0x0, 0x1000, 0x10000, 0xffffffffffffffff, 0x0, 0x4d}}}, &(0x7f0000000480)=0x0) r5 = dup(0xffffffffffffffff) syz_ublk_setup_queues(r5, r4, &(0x7f0000000180)={0x0, 0x1, 0x0, 0x3, 0x255}, &(0x7f0000000800)=[{0x0, 0x0, 0xffffffffffffffff, {0x0, 0x92e0, 0x400, 0x2100, 0x10000004, 0x0, r5}}, {0x0, 0x0, 0xffffffffffffffff, {0x0, 0x19e0, 0x400, 0x0, 0x146}}, {0x0, 0x0, 0xffffffffffffffff, {0x0, 0xf910, 0x2000, 0x0, 0x801f0, 0x0, r5}}, {0x0, 0x0, 0xffffffffffffffff, {0x0, 0x587e, 0x80, 0x2, 0x367}}], 0x1, &(0x7f0000000340)={0x2e, 0x50, 0x0, 0xffffffffffffffff, 0xc0107520, 0x0, 0x0, 0x0, 0x0, {}, 0x1f, 0x0, '\x00', {0xfff9, 0x1, 0x0, 0x0}}, 0x0) bpf$MAP_CREATE(0x0, &(0x7f0000000340)=@base={0x1f, 0x7fff, 0x10001, 0x80, 0x80, r5, 0x2, '\x00', 0x0, 0xffffffffffffffff, 0x4, 0x3, 0x5}, 0x50) executing program 5: r0 = socket$kcm(0x2, 0x200000000000001, 0x0) sendmsg$inet(r0, &(0x7f0000000080)={&(0x7f0000000340)={0x2, 0x4001, @dev}, 0x10, 0x0}, 0x3000c085) r1 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000280)='hugetlb.1GB.usage_in_bytes\x00', 0x26e1, 0x0) setsockopt$sock_attach_bpf(r0, 0x1, 0x3e, &(0x7f0000000100)=r1, 0x4) sendmsg$kcm(r0, &(0x7f0000002480)={0x0, 0x0, &(0x7f0000001e40)=[{&(0x7f0000000e40)}], 0x1}, 0x10) sendmsg$inet(r0, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)=[{&(0x7f0000000300)="b8", 0x2ee0}], 0x13, 0x0, 0x0, 0x10000000}, 0x12cd) executing program 5: prlimit64(0x0, 0xe, &(0x7f0000000140)={0xa, 0x400000000008d}, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000080)=0x8) getpid() sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x2) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r0, &(0x7f0000000180)=@abs, 0x6e) sendmmsg$unix(r1, &(0x7f0000000000), 0x651, 0x0) recvmmsg(r0, &(0x7f00000000c0), 0x4000087, 0x2, 0x0) r2 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r2, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000000)=@updpolicy={0xb8, 0x13, 0xcb23c9c9931e99e9, 0x0, 0x0, {{@in=@private=0xa010101, @in=@remote, 0x0, 0x400, 0x1000, 0x0, 0x2, 0x20, 0x10, 0x84, 0x0, 0xffffffffffffffff}, {}, {0x0, 0x4000000000000, 0x0, 0xffffffffffffffff}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1}}, 0xb8}}, 0x80) sendmsg$nl_xfrm(r2, &(0x7f0000000480)={0x0, 0x0, &(0x7f0000000800)={&(0x7f0000000000)=ANY=[@ANYBLOB="650100001b"], 0x168}}, 0xc0) executing program 33: prlimit64(0x0, 0xe, &(0x7f0000000140)={0xa, 0x400000000008d}, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000080)=0x8) getpid() sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x2) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r0, &(0x7f0000000180)=@abs, 0x6e) sendmmsg$unix(r1, &(0x7f0000000000), 0x651, 0x0) recvmmsg(r0, &(0x7f00000000c0), 0x4000087, 0x2, 0x0) r2 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r2, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000000)=@updpolicy={0xb8, 0x13, 0xcb23c9c9931e99e9, 0x0, 0x0, {{@in=@private=0xa010101, @in=@remote, 0x0, 0x400, 0x1000, 0x0, 0x2, 0x20, 0x10, 0x84, 0x0, 0xffffffffffffffff}, {}, {0x0, 0x4000000000000, 0x0, 0xffffffffffffffff}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1}}, 0xb8}}, 0x80) sendmsg$nl_xfrm(r2, &(0x7f0000000480)={0x0, 0x0, &(0x7f0000000800)={&(0x7f0000000000)=ANY=[@ANYBLOB="650100001b"], 0x168}}, 0xc0) executing program 3: ioctl$VIDIOC_QUERYSTD(0xffffffffffffffff, 0x8008563f, &(0x7f0000000000)) r0 = syz_usb_connect(0x2, 0xb3, &(0x7f0000000640)=ANY=[@ANYBLOB="12010002ef0201406d0425080001000000010902a1000201008032080b00020e03000009040000000e0100000d240100012700006cdc0201011124020101020000000000000000020d000924030201010001"], &(0x7f0000000a40)={0x0, 0x0, 0x0, 0x0}) syz_usb_control_io$rtl8150(r0, 0x0, &(0x7f00000003c0)={0x2c, &(0x7f00000000c0)=ANY=[], 0x0, 0x0, 0x0, 0x0}) write(0xffffffffffffffff, &(0x7f0000000500)='transport=rdma,nqn=nqn.2014-08.org.n', 0x24) executing program 3: r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000000), 0x40241, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000200)={'syzkaller1\x00', 0xc201}) r1 = socket$kcm(0x2, 0xa, 0x2) ioctl$SIOCSIFHWADDR(r1, 0x8914, &(0x7f0000000180)={'syzkaller1\x00', @link_local={0x1, 0x80, 0xc2, 0x0, 0x0, 0xe}}) r2 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r2, &(0x7f0000000200)={0x0, 0x0, &(0x7f0000000000)={&(0x7f00000009c0)=ANY=[@ANYBLOB="140000001000010000000000000000000000000a20000000000a01020000000000000000010000000900010073797a300000000040000000160a01000900000000000000010000000900010073797a30000000000900020073797a3000000000140003800800014000000000080002400000000048000000160a0101000b000000000000010000000900020073797a30000000000900010073797a30000000001c0003801800"], 0xd0}, 0x1, 0x0, 0x0, 0x24040841}, 0x20048010) write$tun(r0, &(0x7f0000001280)=ANY=[@ANYBLOB="000086dd00001100"], 0xfce) executing program 0: socket$nl_route(0x10, 0x3, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000140)={0xa, 0x8b}, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000280)=0x8) r0 = getpid() sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x2) sched_setscheduler(r0, 0x2, &(0x7f0000000200)=0x7) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeea, 0x8031, 0xffffffffffffffff, 0x28f43000) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r1, &(0x7f0000000180)=@abs, 0x6e) sendmmsg$unix(r2, &(0x7f0000000000), 0x651, 0x0) recvmmsg(r1, &(0x7f00000000c0), 0x10106, 0x2, 0x0) mmap$IORING_OFF_SQ_RING(0x110c230000, 0x8000002, 0x2000007, 0x401d031, 0xffffffffffffffff, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./sys\x00', 0x1ff) mount(0x0, &(0x7f0000000040)='./sys\x00', &(0x7f0000000080)='sysfs\x00', 0x0, 0x0) r3 = openat(0xffffffffffffff9c, 0x0, 0x2, 0x0) write(r3, &(0x7f00000005c0)="306663353a313232373a3f7092c0f0bc085a193376cf620afaf6379a248d1d6534058f1095109da34b6d6537a6e78b0dc4b7bc0b", 0x34) r4 = socket$inet_tcp(0x2, 0x1, 0x0) ioctl$sock_SIOCGIFINDEX(r4, 0x8933, &(0x7f0000000180)={'syz_tun\x00'}) mkdirat(0xffffffffffffff9c, &(0x7f0000000080)='./file1\x00', 0x1c0) mkdirat(0xffffffffffffff9c, &(0x7f00000000c0)='./file0\x00', 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000240)='./file2\x00', 0x207) mount$overlay(0x0, &(0x7f0000000100)='./file0\x00', &(0x7f0000000000), 0x0, &(0x7f00000000c0)={[{@workdir={'workdir', 0x3d, './file0'}}, {@lowerdir={'lowerdir', 0x3d, '.'}}, {@upperdir={'upperdir', 0x3d, './file2'}}], [], 0x2c}) r5 = openat$dir(0xffffffffffffff9c, &(0x7f0000000000)='./file0/file1\x00', 0x20400, 0x20) fsync(r5) executing program 6: syz_usb_connect(0x0, 0x4b, &(0x7f0000000000)=ANY=[@ANYBLOB="1201000200000040480b051000010102000109023900020100803209040000000000000009"], 0x0) r0 = syz_open_dev$dvb_demux(&(0x7f0000000200), 0x1, 0x2) ioctl$DVB_DEMUX_DMX_SET_PES_FILTER(r0, 0x40146f2c, &(0x7f0000000100)={0x1ff, 0x0, 0x3, 0xa, 0x4}) program did not crash bisect: split chunks (needed=true): <17>, <15> bisect: split chunk #0 of len 17 into 2 parts bisect: testing without sub-chunk 1/2 testing program (duration=6m6s, {Threaded:true Repeat:true RepeatTimes:0 Procs:6 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): [5, 5, 6, 12, 12, 4, 7, 24, 11, 4, 19, 6, 2, 2, 24, 7, 5, 30, 7, 3, 4, 19, 4, 4] detailed listing: executing program 5: r0 = bpf$PROG_LOAD(0x5, &(0x7f0000000a40)={0x1, 0x4, &(0x7f0000000300)=ANY=[@ANYBLOB], &(0x7f0000000200)='GPL\x00', 0x0, 0x0, 0x0, 0x41100, 0x0, '\x00', 0x0, @fallback=0x2a, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) r1 = socket$kcm(0x11, 0xa, 0x300) setsockopt$sock_attach_bpf(r1, 0x1, 0x32, &(0x7f0000000040)=r0, 0x4) r2 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPSET_CMD_CREATE(r2, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000480)=ANY=[], 0x4c}}, 0x2) executing program 5: r0 = syz_ublk_setup_io_uring(0x1d, &(0x7f0000000500)={0x0, 0x30b5, 0x0, 0x2, 0x158}, &(0x7f0000000100)=0x0, &(0x7f0000000400)=0x0, &(0x7f0000000140)=0x0) syz_ublk_add_dev(r0, r1, r2, r3, &(0x7f0000000200)={0x2e, 0x14, 0x0, 0xffffffffffffffff, 0xc0207504, 0x0, 0x0, 0x0, 0x0, 0x4, 0x0, 0x0, '\x00', {0xffffffff, 0xffff, 0x40, &(0x7f00000004c0)=@any_dev={0x3, 0xe26, 0x0, 0x0, 0x1000, 0x10000, 0xffffffffffffffff, 0x0, 0x4d}}}, &(0x7f0000000480)=0x0) r5 = dup(0xffffffffffffffff) syz_ublk_setup_queues(r5, r4, &(0x7f0000000180)={0x0, 0x1, 0x0, 0x3, 0x255}, &(0x7f0000000800)=[{0x0, 0x0, 0xffffffffffffffff, {0x0, 0x92e0, 0x400, 0x2100, 0x10000004, 0x0, r5}}, {0x0, 0x0, 0xffffffffffffffff, {0x0, 0x19e0, 0x400, 0x0, 0x146}}, {0x0, 0x0, 0xffffffffffffffff, {0x0, 0xf910, 0x2000, 0x0, 0x801f0, 0x0, r5}}, {0x0, 0x0, 0xffffffffffffffff, {0x0, 0x587e, 0x80, 0x2, 0x367}}], 0x1, &(0x7f0000000340)={0x2e, 0x50, 0x0, 0xffffffffffffffff, 0xc0107520, 0x0, 0x0, 0x0, 0x0, {}, 0x1f, 0x0, '\x00', {0xfff9, 0x1, 0x0, 0x0}}, 0x0) bpf$MAP_CREATE(0x0, &(0x7f0000000340)=@base={0x1f, 0x7fff, 0x10001, 0x80, 0x80, r5, 0x2, '\x00', 0x0, 0xffffffffffffffff, 0x4, 0x3, 0x5}, 0x50) executing program 5: r0 = socket$kcm(0x2, 0x200000000000001, 0x0) sendmsg$inet(r0, &(0x7f0000000080)={&(0x7f0000000340)={0x2, 0x4001, @dev}, 0x10, 0x0}, 0x3000c085) r1 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000280)='hugetlb.1GB.usage_in_bytes\x00', 0x26e1, 0x0) setsockopt$sock_attach_bpf(r0, 0x1, 0x3e, &(0x7f0000000100)=r1, 0x4) sendmsg$kcm(r0, &(0x7f0000002480)={0x0, 0x0, &(0x7f0000001e40)=[{&(0x7f0000000e40)}], 0x1}, 0x10) sendmsg$inet(r0, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)=[{&(0x7f0000000300)="b8", 0x2ee0}], 0x13, 0x0, 0x0, 0x10000000}, 0x12cd) executing program 5: prlimit64(0x0, 0xe, &(0x7f0000000140)={0xa, 0x400000000008d}, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000080)=0x8) getpid() sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x2) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r0, &(0x7f0000000180)=@abs, 0x6e) sendmmsg$unix(r1, &(0x7f0000000000), 0x651, 0x0) recvmmsg(r0, &(0x7f00000000c0), 0x4000087, 0x2, 0x0) r2 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r2, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000000)=@updpolicy={0xb8, 0x13, 0xcb23c9c9931e99e9, 0x0, 0x0, {{@in=@private=0xa010101, @in=@remote, 0x0, 0x400, 0x1000, 0x0, 0x2, 0x20, 0x10, 0x84, 0x0, 0xffffffffffffffff}, {}, {0x0, 0x4000000000000, 0x0, 0xffffffffffffffff}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1}}, 0xb8}}, 0x80) sendmsg$nl_xfrm(r2, &(0x7f0000000480)={0x0, 0x0, &(0x7f0000000800)={&(0x7f0000000000)=ANY=[@ANYBLOB="650100001b"], 0x168}}, 0xc0) executing program 33: prlimit64(0x0, 0xe, &(0x7f0000000140)={0xa, 0x400000000008d}, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000080)=0x8) getpid() sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x2) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r0, &(0x7f0000000180)=@abs, 0x6e) sendmmsg$unix(r1, &(0x7f0000000000), 0x651, 0x0) recvmmsg(r0, &(0x7f00000000c0), 0x4000087, 0x2, 0x0) r2 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r2, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000000)=@updpolicy={0xb8, 0x13, 0xcb23c9c9931e99e9, 0x0, 0x0, {{@in=@private=0xa010101, @in=@remote, 0x0, 0x400, 0x1000, 0x0, 0x2, 0x20, 0x10, 0x84, 0x0, 0xffffffffffffffff}, {}, {0x0, 0x4000000000000, 0x0, 0xffffffffffffffff}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1}}, 0xb8}}, 0x80) sendmsg$nl_xfrm(r2, &(0x7f0000000480)={0x0, 0x0, &(0x7f0000000800)={&(0x7f0000000000)=ANY=[@ANYBLOB="650100001b"], 0x168}}, 0xc0) executing program 3: ioctl$VIDIOC_QUERYSTD(0xffffffffffffffff, 0x8008563f, &(0x7f0000000000)) r0 = syz_usb_connect(0x2, 0xb3, &(0x7f0000000640)=ANY=[@ANYBLOB="12010002ef0201406d0425080001000000010902a1000201008032080b00020e03000009040000000e0100000d240100012700006cdc0201011124020101020000000000000000020d000924030201010001"], &(0x7f0000000a40)={0x0, 0x0, 0x0, 0x0}) syz_usb_control_io$rtl8150(r0, 0x0, &(0x7f00000003c0)={0x2c, &(0x7f00000000c0)=ANY=[], 0x0, 0x0, 0x0, 0x0}) write(0xffffffffffffffff, &(0x7f0000000500)='transport=rdma,nqn=nqn.2014-08.org.n', 0x24) executing program 3: r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000000), 0x40241, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000200)={'syzkaller1\x00', 0xc201}) r1 = socket$kcm(0x2, 0xa, 0x2) ioctl$SIOCSIFHWADDR(r1, 0x8914, &(0x7f0000000180)={'syzkaller1\x00', @link_local={0x1, 0x80, 0xc2, 0x0, 0x0, 0xe}}) r2 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r2, &(0x7f0000000200)={0x0, 0x0, &(0x7f0000000000)={&(0x7f00000009c0)=ANY=[@ANYBLOB="140000001000010000000000000000000000000a20000000000a01020000000000000000010000000900010073797a300000000040000000160a01000900000000000000010000000900010073797a30000000000900020073797a3000000000140003800800014000000000080002400000000048000000160a0101000b000000000000010000000900020073797a30000000000900010073797a30000000001c0003801800"], 0xd0}, 0x1, 0x0, 0x0, 0x24040841}, 0x20048010) write$tun(r0, &(0x7f0000001280)=ANY=[@ANYBLOB="000086dd00001100"], 0xfce) executing program 0: socket$nl_route(0x10, 0x3, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000140)={0xa, 0x8b}, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000280)=0x8) r0 = getpid() sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x2) sched_setscheduler(r0, 0x2, &(0x7f0000000200)=0x7) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeea, 0x8031, 0xffffffffffffffff, 0x28f43000) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r1, &(0x7f0000000180)=@abs, 0x6e) sendmmsg$unix(r2, &(0x7f0000000000), 0x651, 0x0) recvmmsg(r1, &(0x7f00000000c0), 0x10106, 0x2, 0x0) mmap$IORING_OFF_SQ_RING(0x110c230000, 0x8000002, 0x2000007, 0x401d031, 0xffffffffffffffff, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./sys\x00', 0x1ff) mount(0x0, &(0x7f0000000040)='./sys\x00', &(0x7f0000000080)='sysfs\x00', 0x0, 0x0) r3 = openat(0xffffffffffffff9c, 0x0, 0x2, 0x0) write(r3, &(0x7f00000005c0)="306663353a313232373a3f7092c0f0bc085a193376cf620afaf6379a248d1d6534058f1095109da34b6d6537a6e78b0dc4b7bc0b", 0x34) r4 = socket$inet_tcp(0x2, 0x1, 0x0) ioctl$sock_SIOCGIFINDEX(r4, 0x8933, &(0x7f0000000180)={'syz_tun\x00'}) mkdirat(0xffffffffffffff9c, &(0x7f0000000080)='./file1\x00', 0x1c0) mkdirat(0xffffffffffffff9c, &(0x7f00000000c0)='./file0\x00', 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000240)='./file2\x00', 0x207) mount$overlay(0x0, &(0x7f0000000100)='./file0\x00', &(0x7f0000000000), 0x0, &(0x7f00000000c0)={[{@workdir={'workdir', 0x3d, './file0'}}, {@lowerdir={'lowerdir', 0x3d, '.'}}, {@upperdir={'upperdir', 0x3d, './file2'}}], [], 0x2c}) r5 = openat$dir(0xffffffffffffff9c, &(0x7f0000000000)='./file0/file1\x00', 0x20400, 0x20) fsync(r5) executing program 6: r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000000), 0x2, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000200)={'syzkaller1\x00', 0x5001}) bpf$PROG_LOAD(0x5, &(0x7f0000000180)={0x5, 0x4, &(0x7f0000000080)=ANY=[@ANYBLOB="b40500000000000069108e0000000000bc0010"], 0x0, 0x5, 0x0, 0x0, 0x0, 0x8}, 0x94) r1 = socket$inet_udp(0x2, 0x2, 0x0) r2 = socket$nl_route(0x10, 0x3, 0x0) r3 = socket$unix(0x1, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r3, 0x8933, 0x0) sendmsg$nl_route_sched(r2, &(0x7f00000012c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f00000000c0)=@newqdisc={0x30, 0x24, 0x601, 0x0, 0x0, {0x0, 0x0, 0x0, 0x0, {}, {0xfff1, 0xffff}}, [@qdisc_kind_options=@q_ingress={0xc}]}, 0x30}}, 0x0) sendmsg$nl_route_sched(r2, &(0x7f0000000580)={0x0, 0x0, &(0x7f0000000300)={&(0x7f0000001300)=@newtfilter={0x80, 0x2c, 0x601, 0x0, 0x0, {0x0, 0x0, 0x0, 0x0, {0xb, 0x7}, {0xfff1, 0xffff}, {0x300}}, [@filter_kind_options=@f_matchall={{0xd}, {0x4c, 0x2, [@TCA_MATCHALL_ACT={0x48, 0x2, [@m_ct={0x44, 0x1, 0x0, 0x0, {{0x7}, {0x1c, 0x2, 0x0, 0x1, [@TCA_CT_PARMS={0x18, 0x1, {0x0, 0x0, 0x3}}]}, {0x4}, {0xc}, {0xc}}}]}]}}]}, 0x80}}, 0x0) ioctl$sock_inet_SIOCSIFFLAGS(r1, 0x8914, &(0x7f0000000200)={'syzkaller1\x00', 0x1}) write$tun(r0, &(0x7f0000000040)=ANY=[@ANYBLOB="03031b003a003200060063"], 0x76) executing program 4: r0 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r0, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000001680)=ANY=[@ANYBLOB="140000001000010000000000000000000500000a28000000000a030000000000000000000a00000708000240000000020900010073797a31000000002c000000030a010100000000000000000a0000070900010073797a3100000000090003007379"], 0x7c}, 0x1, 0x0, 0x0, 0x40001}, 0x4040850) sendmsg$NFT_BATCH(r0, &(0x7f0000009b40)={0x0, 0x0, &(0x7f0000009b00)={&(0x7f0000000240)=ANY=[@ANYBLOB="140000001000010000000000000000000500000a48000000030a0fdb00000000000000000a0000050900030073797a30000000000900010073797a310000000014000480080002403cb140bb0800014000000003080005400000000014000000110001"], 0x70}, 0x1, 0x0, 0x0, 0x4000850}, 0x24000840) sendmsg$NFT_BATCH(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000cc0)={&(0x7f00000002c0)={{0x14, 0x10, 0x1, 0x0, 0x0, {0x3}}, [@NFT_MSG_DELCHAIN={0x2c, 0x5, 0xa, 0x101, 0x0, 0x0, {0xa, 0x0, 0xa}, [@NFTA_CHAIN_TABLE={0x9, 0x1, 'syz1\x00'}, @NFTA_CHAIN_HANDLE={0xc, 0x2, 0x1, 0x0, 0x1}]}, @NFT_MSG_DELRULE={0x20, 0x8, 0xa, 0x101, 0x0, 0x0, {0xa, 0x0, 0x9}, [@NFTA_RULE_TABLE={0x9, 0x1, 'syz1\x00'}]}], {0x14}}, 0x74}, 0x1, 0x0, 0x0, 0xb0}, 0x20008890) executing program 4: socket$inet_smc(0x2b, 0x1, 0x0) socket$inet_udp(0x2, 0x2, 0x0) socket$nl_generic(0x10, 0x3, 0x10) socket$nl_netfilter(0x10, 0x3, 0xc) r0 = bpf$MAP_CREATE(0x0, 0x0, 0x0) bpf$PROG_LOAD(0x5, &(0x7f0000000600)={0x1, 0xf, &(0x7f00000006c0)=@ringbuf={{0x18, 0x0, 0x0, 0x0, 0x107a655, 0x0, 0x0, 0x0, 0x10}, {{0x18, 0x1, 0x1, 0x0, r0}}, {}, [], {{}, {}, {0x85, 0x0, 0x0, 0x85}}}, &(0x7f0000000000)='GPL\x00', 0x0, 0x0, 0x0, 0x41000, 0x8, '\x00', 0x0, @fallback=0x6, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) openat$sndtimer(0xffffffffffffff9c, &(0x7f00000006c0), 0x1a0001) openat$udambuf(0xffffffffffffff9c, &(0x7f0000000480), 0x2) socket(0x400000000010, 0x3, 0x0) openat$sndseq(0xffffffffffffff9c, &(0x7f0000000600), 0x183c81) socket(0x10, 0x3, 0x0) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000140)) r1 = openat$iommufd(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) ioctl$IOMMU_IOAS_ALLOC(r1, 0x3b81, &(0x7f00000003c0)={0xc, 0x0, 0x0}) ioctl$IOMMU_TEST_OP_CREATE_ACCESS(r1, 0x3ba0, &(0x7f0000000340)={0x48, 0x5, r2, 0x0, 0xffffffffffffffff, 0x1}) r3 = openat$rdma_cm(0xffffffffffffff9c, &(0x7f0000000940), 0x2, 0x0) socketpair(0x1, 0x1, 0x0, &(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}) bpf$MAP_UPDATE_ELEM_TAIL_CALL(0x2, &(0x7f00000001c0)={{}, 0x0, &(0x7f0000000100)=r4}, 0x20) writev(r3, &(0x7f0000000040)=[{&(0x7f0000000100), 0x6b82}], 0x2) executing program 1: ioctl$vim2m_VIDIOC_S_FMT(0xffffffffffffffff, 0xc0d05605, 0x0) r0 = userfaultfd(0x801) close_range(0xffffffffffffffff, 0xffffffffffffffff, 0x2) ioctl$UFFDIO_API(r0, 0xc018aa3f, &(0x7f00000000c0)) mprotect(&(0x7f0000000000/0xf000)=nil, 0xf000, 0x1) ioctl$UFFDIO_CONTINUE(r0, 0xc020aa08, &(0x7f0000000080)={{&(0x7f0000400000/0xc00000)=nil, 0xc00000}}) executing program 4: r0 = syz_open_dev$hiddev(&(0x7f00000000c0), 0x0, 0x0) ioctl$HIDIOCSREPORT(r0, 0x81044804, &(0x7f0000000400)={0x1}) executing program 7: r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f00000018c0)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000001900)=ANY=[@ANYBLOB="280000001e0001"], 0x28}}, 0x0) executing program 1: ioctl$SNDRV_CTL_IOCTL_ELEM_WRITE(0xffffffffffffffff, 0xc1105518, &(0x7f0000000040)={{0x0, 0x0, 0x0, 0x0, 'syz0\x00'}, 0x1, [0x4, 0x3, 0xfffffffffffffffe, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x801, 0x0, 0x0, 0xfffffffffffffffe, 0x0, 0x40000000, 0x0, 0x0, 0x0, 0x0, 0x2d8, 0x0, 0x470, 0xa7, 0x8, 0x8000000000000000, 0x0, 0xfffffffffffffffe, 0x9, 0x0, 0x2, 0x0, 0xfffffffa, 0x3, 0xfffffffffffffffe, 0x0, 0x400, 0x0, 0x0, 0x0, 0x2, 0x3, 0x7, 0x1, 0x0, 0x8000, 0x7, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4, 0x0, 0x0, 0x4, 0x4, 0x0, 0x0, 0xfffffffffffffffc, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x0, 0x8, 0xf5, 0x0, 0x4, 0x0, 0xd318, 0x2000000000, 0x0, 0x4, 0x0, 0x1000000000000000, 0x0, 0x0, 0xfffffffffffffffc, 0xffffffffffffffff, 0x0, 0xfffffffffffffffc, 0x0, 0x6, 0x0, 0xfffffffd, 0x8, 0x7, 0x6, 0x800000, 0x0, 0x101, 0x272f, 0xd721, 0x0, 0x4, 0x0, 0xffffffffffffffff, 0x1, 0xfffffffffffffffd, 0x0, 0x0, 0x0, 0x1, 0x4, 0x5, 0x1, 0x4000000, 0x5, 0x0, 0xdc5d, 0x0, 0x0, 0x1000, 0x0, 0x0, 0x0, 0x4000000000006fd, 0x0, 0x6, 0x0, 0x0, 0x0, 0x100]}) r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000140), 0x40241, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000000)={'syzkaller1\x00', 0xc201}) r1 = socket$kcm(0x2, 0xa, 0x2) ioctl$SIOCSIFHWADDR(r1, 0x8914, &(0x7f0000000080)={'syzkaller1\x00', @link_local={0x1, 0x80, 0xc2, 0x0, 0x0, 0x1c}}) write$tun(r0, 0x0, 0xfdef) openat$iommufd(0xffffffffffffff9c, 0x0, 0x0, 0x0) fstat(0xffffffffffffffff, 0x0) r2 = syz_open_dev$usbfs(&(0x7f0000000240), 0xb, 0x101301) r3 = socket$nl_generic(0x10, 0x3, 0x10) setsockopt$inet_sctp_SCTP_DEFAULT_SEND_PARAM(0xffffffffffffffff, 0x84, 0xa, &(0x7f00000001c0)={0x8, 0x6, 0x6, 0x0, 0x2, 0x5775d27c, 0x158, 0x20100}, 0x20) sendmsg$nl_generic(r3, &(0x7f0000000100)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000180)=ANY=[@ANYBLOB="4800000041000501010000000000000001010000000000001c0001000600060008000000100007007f0000017f000001910040001400020010000c00040006"], 0x48}, 0x1, 0x0, 0x0, 0x2c048040}, 0xe800) ioctl$USBDEVFS_IOCTL(r2, 0xc0105512, &(0x7f0000000200)) ioctl$USBDEVFS_GET_SPEED(r2, 0x551f) ioctl$USBDEVFS_IOCTL(r2, 0x80045505, &(0x7f0000000040)=@usbdevfs_connect) ioctl$USBDEVFS_CLAIM_PORT(r2, 0x80045518, 0x0) r4 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000040)='memory.events\x00', 0x275a, 0x0) syz_open_dev$mtd(&(0x7f0000000240), 0x0, 0x82000) write$tun(r4, &(0x7f0000000340)=ANY=[], 0x141) r5 = openat$userio(0xffffffffffffff9c, &(0x7f0000000300), 0x22242, 0x0) write$USERIO_CMD_REGISTER(r5, &(0x7f00000000c0), 0x2) mmap(&(0x7f0000000000/0x4000)=nil, 0x4000, 0x1, 0x10012, r4, 0x0) syz_clone3(&(0x7f0000000280)={0x84000000, &(0x7f0000000000), &(0x7f0000000080), &(0x7f00000000c0)=0x0, {0x1f}, &(0x7f0000000100)=""/36, 0x24, &(0x7f0000000140)=""/22, &(0x7f0000000180)=[0xffffffffffffffff, 0x0, 0x0], 0x3}, 0x58) ioctl$BLKTRACESETUP(r4, 0xc0481273, &(0x7f0000000300)={'\x00', 0x4, 0x8, 0x5, 0x2, 0xd, r6}) executing program 4: r0 = syz_usb_connect(0x0, 0x39, &(0x7f0000000100)=ANY=[], 0x0) syz_usb_disconnect(r0) r1 = syz_usb_connect(0x0, 0x3f, &(0x7f0000000540)=ANY=[], 0x0) syz_usb_control_io(r1, 0x0, 0x0) syz_usb_control_io$printer(r1, 0x0, 0x0) r2 = syz_open_dev$char_usb(0xc, 0xb4, 0x0) ioctl$EVIOCGMASK(r2, 0x5b03, 0x0) executing program 7: r0 = syz_open_dev$vim2m(&(0x7f0000000100), 0x0, 0x2) ioctl$vim2m_VIDIOC_STREAMOFF(r0, 0x40045612, &(0x7f0000000040)=0x1) ioctl$vim2m_VIDIOC_QBUF(r0, 0xc058560f, &(0x7f0000000180)=@mmap={0x1, 0x1, 0x4, 0x100, 0x81, {}, {0x4, 0x8, 0x8, 0x5, 0x29, 0x9, "0adb3fb8"}, 0x3}) write$uinput_user_dev(0xffffffffffffffff, &(0x7f0000000400)={'syz0\x00', {0x3, 0x2, 0x6, 0xfffa}, 0x3a, [0x8001, 0xc95a, 0xf, 0x8, 0x80, 0x2, 0x7, 0x7f, 0xa9, 0x4d, 0x6, 0x5f, 0x9, 0x15, 0xffff2d37, 0xff7fff01, 0x6, 0x5, 0x7, 0x5, 0x4, 0x0, 0x7, 0x3c5b, 0x1, 0x20, 0xd, 0x1, 0x0, 0xffffffff, 0xe661, 0x6, 0x7, 0x5, 0x8, 0x4c74, 0xffff7fff, 0x7, 0x3, 0xe, 0x0, 0x80008071, 0x7, 0x17, 0xffffffff, 0x7, 0x5, 0x80003e, 0x18e, 0x6, 0x6, 0x0, 0x8, 0x4, 0x8, 0x3ff, 0x80, 0x0, 0x5, 0x6, 0x8, 0x7, 0x1, 0x40], [0x10000007, 0x9, 0x8000012f, 0x8004, 0x5, 0xfffffff3, 0x129432f6, 0xc8, 0xf1, 0xe, 0x2bf, 0x6c7, 0x2009, 0xfffffffc, 0x573a, 0x0, 0x0, 0x5, 0x2f, 0x8, 0x312, 0x66abcbd2, 0xea4, 0x0, 0x4, 0x1007, 0x7fff, 0x6, 0x400, 0x401, 0x6, 0x1, 0xff, 0x7, 0x1000005, 0x5f31, 0xd, 0x4e0, 0x381, 0x4, 0xb, 0x4, 0x9, 0x8, 0x40, 0x6, 0x47, 0x8000, 0x1, 0xfe000000, 0xffff, 0x2, 0x4, 0x200009, 0x3, 0x3, 0x4000009, 0x6, 0x0, 0x3, 0xbc45, 0x48c93690, 0x42, 0x3], [0x6, 0x40a, 0x3ff, 0x5, 0xfffffffd, 0x100, 0x5, 0x9, 0x5, 0x7fff, 0x0, 0x5, 0xb, 0x4, 0x5, 0x5, 0x0, 0x1ef, 0x3, 0x8, 0x86, 0x1000515, 0x303c, 0x3e7, 0xb, 0x5, 0x2, 0x2, 0x3, 0x20000008, 0x4, 0x6cff, 0x6, 0x20000038, 0x200, 0x1fd, 0x80, 0x7, 0x4, 0x2950bfaf, 0x1000, 0xa2, 0x7, 0xcc, 0x5, 0x6, 0xac8, 0xbf, 0x2, 0x3, 0x7ff, 0x12b, 0x4, 0x1, 0xa, 0xffffffff, 0x5, 0x1c, 0x120000, 0x7ef, 0x2006, 0x80a2cd, 0x4, 0x25], [0xc, 0xbb33, 0x7, 0xb, 0x5, 0x938, 0x6, 0x6, 0x0, 0xb9, 0xce4, 0x1ff, 0x2, 0x57, 0x5, 0x3, 0x2, 0x10000, 0x4, 0x7fff, 0xfff4, 0xa620, 0x1, 0x5, 0x801, 0x2000002, 0x150, 0x60a7, 0x6, 0x16, 0xffffffff, 0x8, 0x4, 0x5, 0xca, 0x1, 0xfffff000, 0x10000, 0xf, 0x7e, 0x9, 0x9622, 0x7, 0xaf, 0x20000008, 0x5, 0x226, 0x2, 0x5, 0x0, 0x30b1d693, 0xa1f, 0xf40, 0x7, 0x530e, 0xe1c4, 0x0, 0x0, 0x5, 0x7ff, 0xd7, 0x200, 0xb, 0xfff]}, 0x45c) ppoll(&(0x7f00000000c0)=[{}, {}], 0x20000000000000dc, 0x0, 0x0, 0x0) executing program 7: bpf$MAP_CREATE(0x0, &(0x7f0000000080)=ANY=[], 0x50) bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x0, 0xc, 0x0, 0x0, 0xfffffffd, 0x0, 0x0, 0x0, 0x40, '\x00', 0x0, @fallback=0x10, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) socket(0x10, 0x803, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x1, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000380)={0xa, 0x100008b}, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000200)=0x8) openat$sequencer(0xffffffffffffff9c, &(0x7f00000001c0), 0x80200, 0x0) r0 = syz_open_dev$sndmidi(&(0x7f00000004c0), 0x2, 0x141102) writev(r0, &(0x7f0000000840)=[{&(0x7f00000002c0)="94", 0xf000}, {0x0}], 0x2) ioctl$sock_SIOCGIFINDEX(0xffffffffffffffff, 0x8933, 0x0) r1 = socket$kcm(0xa, 0x3, 0x3a) r2 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r2, &(0x7f0000000480)={0x0, 0x0, &(0x7f0000001f40)={&(0x7f00000004c0)=ANY=[@ANYBLOB="fc000000190001002dbd700000000000ac1e0001000000000000000000000000ac1414aa00"/48, @ANYRES32=0x0, @ANYRES32, @ANYBLOB="00000000000000000c00000000000000000000000000000000000000000000000000000000000000ffffffffffffffff000000000000000000000000000000000000000000000000000a000000000000feffffffff7f40000200000000000008ffffffff00000000010006000000000044000500ac1414bb000000000000000000000000000000003c0000000200000000000000000000000000000000000001060000"], 0xfc}, 0x1, 0x0, 0x0, 0x4008000}, 0x600c010) sendmsg$kcm(r1, &(0x7f0000000080)={&(0x7f0000000000)=@l2tp6={0xa, 0x0, 0x0, @loopback={0xfe80000000000000, 0xac14140c}}, 0x80, &(0x7f00000000c0)=[{&(0x7f0000000140)='\x00\x00', 0xffe3}], 0x1, 0x0, 0x0, 0x900}, 0x60) setsockopt$IPT_SO_SET_REPLACE(0xffffffffffffffff, 0x0, 0x40, 0x0, 0x0) syz_usb_connect(0x3, 0x57, &(0x7f0000000000)=ANY=[@ANYBLOB="1201000200000040402001c60100000000010902450001010080fa0904"], 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000340)='./file1\x00', 0x0) mkdirat(0xffffffffffffff9c, &(0x7f00000000c0)='./bus\x00', 0x1d7) mkdirat(0xffffffffffffff9c, &(0x7f0000000400)='./file1/file0\x00', 0x100) mount$bind(&(0x7f0000000100)='.\x00', &(0x7f0000000080)='./file1/file0\x00', 0x0, 0x1085408, 0x0) r3 = openat$sw_sync(0xffffffffffffff9c, &(0x7f0000000ac0), 0x800, 0x0) ioctl$SW_SYNC_IOC_CREATE_FENCE(r3, 0xc0285700, &(0x7f0000000b00)={0x4, "abacd211119ca94c63377526aeb5ab2c7b9ca5fa07558139ede6dc06270ee042", 0xffffffffffffffff}) ioctl$SYNC_IOC_MERGE(r4, 0xc0303e03, &(0x7f0000000780)={"d1ed39d88b014076ab94c1fb10628c46d2e66ccdb9e581a38ebb0ddd5f307e56", 0xffffffffffffffff, 0xffffffffffffffff}) ioctl$SYNC_IOC_FILE_INFO(r5, 0xc0383e04, 0x0) mount$overlay(0x0, &(0x7f00000000c0)='./bus\x00', &(0x7f00000003c0), 0x40, &(0x7f0000000300)={[{@workdir={'workdir', 0x3d, './bus'}}, {@upperdir={'upperdir', 0x3d, './file1'}}]}) bpf$PROG_LOAD(0x5, 0x0, 0x0) r6 = syz_usb_connect$hid(0x1, 0x36, &(0x7f0000000040)=ANY=[@ANYBLOB="12010000090024206d041cc340000000000109022400010000a00009040000010301010009"], 0x0) r7 = syz_open_procfs(0xffffffffffffffff, &(0x7f0000000080)='stat\x00') read$FUSE(r7, &(0x7f0000004180)={0x2020}, 0x2020) syz_usb_control_io$hid(r6, &(0x7f0000000240)={0x24, &(0x7f00000003c0)=ANY=[@ANYBLOB="00000c000000070001"], 0x0, 0x0, 0x0}, 0x0) executing program 6: r0 = socket$packet(0x11, 0x2, 0x300) setsockopt$SO_ATTACH_FILTER(r0, 0x1, 0x1a, &(0x7f0000000100)={0x2, &(0x7f0000000040)=[{0x0, 0x0, 0xfd, 0xc8e}, {0x16, 0xff, 0x6, 0x6}]}, 0x10) setsockopt$packet_fanout(r0, 0x107, 0x12, 0x0, 0x0) r1 = socket$inet_udp(0x2, 0x2, 0x0) bind$inet(r1, &(0x7f0000000140)={0x2, 0x80, @dev={0xac, 0x14, 0x14, 0xf}}, 0x10) sendmmsg$inet(r1, &(0x7f0000000c00)=[{{&(0x7f0000010940)={0x2, 0x4e22, @multicast2}, 0x10, 0x0}}], 0x1, 0x2000c044) sendto$inet(r1, &(0x7f0000000c80)="e8", 0x6200, 0x0, 0x0, 0x0) executing program 6: syz_usb_connect(0x0, 0x4b, &(0x7f0000000000)=ANY=[@ANYBLOB="1201000200000040480b051000010102000109023900020100803209040000000000000009"], 0x0) r0 = syz_open_dev$dvb_demux(&(0x7f0000000200), 0x1, 0x2) ioctl$DVB_DEMUX_DMX_SET_PES_FILTER(r0, 0x40146f2c, &(0x7f0000000100)={0x1ff, 0x0, 0x3, 0xa, 0x4}) executing program 3: ioctl$VIDIOC_QUERYSTD(0xffffffffffffffff, 0x8008563f, &(0x7f0000000000)) r0 = syz_usb_connect(0x2, 0xb3, &(0x7f0000000640)=ANY=[@ANYBLOB="12010002ef0201406d0425080001000000010902a1000201008032080b00020e03000009040000000e0100000d240100012700006cdc0201011124020101020000000000000000020d000924030201010001"], &(0x7f0000000a40)={0x0, 0x0, 0x0, 0x0}) syz_usb_control_io$rtl8150(r0, 0x0, &(0x7f00000003c0)={0x2c, &(0x7f00000000c0)=ANY=[], 0x0, 0x0, 0x0, 0x0}) write(0xffffffffffffffff, &(0x7f0000000500)='transport=rdma,nqn=nqn.2014-08.org.nvmexpress:NVMf:uui', 0x36) executing program 0: socket$can_raw(0x1d, 0x3, 0x1) socket(0x18, 0x80000, 0x1) socket$key(0xf, 0x3, 0x2) syz_open_procfs$namespace(0x0, &(0x7f0000000280)='ns/ipc\x00') syz_open_procfs$namespace(0x0, &(0x7f0000000040)='ns/ipc\x00') socket$inet_udp(0x2, 0x2, 0x0) syz_open_dev$vim2m(&(0x7f0000000080), 0x7, 0x2) socket$inet_icmp_raw(0x2, 0x3, 0x1) bpf$PROG_LOAD(0x5, &(0x7f0000000000)={0x13, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x40, '\x00', 0x0, @fallback=0x2e, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0x1}, 0x94) socket$netlink(0x10, 0x3, 0x0) openat$rdma_cm(0xffffffffffffff9c, &(0x7f0000000180), 0x2, 0x0) socket$nl_xfrm(0x10, 0x3, 0x6) mkdirat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000)='./cgroup/syz0\x00', 0x1ff) openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000), 0x200002, 0x0) r0 = epoll_create1(0x0) socket$nl_route(0x10, 0x3, 0x0) r1 = socket$netlink(0x10, 0x3, 0x0) sendmsg$nl_route(0xffffffffffffffff, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000000080)=ANY=[@ANYBLOB="540000001000010400000000000000ffff000000", @ANYRES32=0x0, @ANYBLOB="0380000000000000240012800c0001006d6163766c616e00140002800800010008000000060002000100000008000500", @ANYRES32=r0, @ANYBLOB='\b\x00\n\x00', @ANYRES8=r1], 0x54}, 0x1, 0x0, 0x0, 0x4000085}, 0x0) sendmmsg(r1, &(0x7f00000002c0), 0x40000000000009f, 0x20) executing program 1: r0 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r0, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000001680)=ANY=[@ANYBLOB="140000001000010000000000000000000500000a28000000000a030000000000000000000a00000708000240000000020900010073797a31000000002c000000030a010100000000000000000a0000070900010073797a31000000000900030073797a320000000014"], 0x7c}, 0x1, 0x0, 0x0, 0x40001}, 0x4040850) sendmsg$NFT_BATCH(r0, &(0x7f0000009b40)={0x0, 0x0, &(0x7f0000009b00)={&(0x7f0000000240)=ANY=[@ANYBLOB="140000001000010000000000000000000500000a48000000030a0fdb00000000000000000a0000050900030073797a30000000000900010073797a310000000014000480080002403cb140bb0800014000000003080005400000000014000000110001"], 0x70}, 0x1, 0x0, 0x0, 0x4000850}, 0x24000840) sendmsg$NFT_BATCH(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000cc0)={&(0x7f00000002c0)={{0x14, 0x10, 0x1, 0x0, 0x0, {0x3}}, [@NFT_MSG_DELCHAIN={0x2c, 0x5, 0xa, 0x101, 0x0, 0x0, {0xa, 0x0, 0xa}, [@NFTA_CHAIN_TABLE={0x9, 0x1, 'syz1\x00'}, @NFTA_CHAIN_HANDLE={0xc, 0x2, 0x1, 0x0, 0x1}]}, @NFT_MSG_DELRULE={0x20, 0x8, 0xa, 0x101, 0x0, 0x0, {0xa, 0x0, 0x9}, [@NFTA_RULE_TABLE={0x9, 0x1, 'syz1\x00'}]}], {0x14}}, 0x74}, 0x1, 0x0, 0x0, 0xb0}, 0x20008890) executing program 1: sendmmsg$inet(0xffffffffffffffff, &(0x7f0000002140)=[{{0x0, 0x0, &(0x7f0000000540)=[{&(0x7f0000002280)="21ae1baf930b4569b9ddef9797ffd935c7d80e6466b3e4e62dd4603583f5d4b61fbc65b6ac744d7319535e75bf552062e4cfde1ba7ce29263322e18ea9740aa89f69c47a63133708cda00d2b1f4e799bd41e3f76258180fa91a42aaa8b1ebc4e0ea8fb12f2c71e6e5bc57a8e91f254005514721d93c13c5606ae1fea7f31f558d562bd5a8dfb0b9fed873efa221fccffa84fcd374c92e6cbb03e6a9de890ce323f000000abcc6c01326d588495b7c1a7db31ec4129e6336f26bb9e0b7552af3cd2d5dda1632799bbc98425c433384d8a8e4071ff39a36dfde5f05af35a4ddd340cfecd7ec935f4ce7d3e851583ba1cf53a90a7f7bce5703de57ce93ddef7849b30a01de0637e6d5e507b801d32e582e0c2d564539ebfc84c098a23e765552767b122885fb1629e9c180be47da7931bd125b80de1594b75e5371a81c2c32d0c4a028a5aab0c56a2edf2e0483b87f5ab299dc046076203dea10ccbfc631d5bf4a87ce67004519f248f086346ce6a8a9d181789a59f81d9b7f6781daac3e229914b8b8998c15c3b6302a519331cb05995bc60b7cb872dd3b5b43331c77c5d72e21f7bd2b1a915ff3204e3f20d3a20b22d6a58155b5a4ebf6d1d1cd90c656ecada531c07ff91deb3efa91762cdecfbcc43553750f22ac5c18cc5e8b6f790c2f4e6373af9f98d10e6df49ff8e5cbcbd68e11ed0b967add11410dc2e34f08dbfaf8eb95d4d1153b4c6093192a340eb30fcc71619888c6486746a049585d249efb96b9cace83320b8f96b40ebe3a9a788d05a053380d1026b9434df87a3a387549bcabe88684c4d0948a6e219b5769480e6d0a9bf0da9a5212f3dbc8d1dff240856691243b203d7edd4d3cc89a38a6c80fdb1229a01044af7aaecb20d5570ebf24b30bbc6dfc3f70d85cd9f0d60ebd8fedd161d199d9997a0e2d18d1c99bc7158564e0ddb4673055de196535d706d142e1dc7d404583923cb1b286cfc5418884ac7e605d93652dc48ff8261c63790a91ee2c5ff9a21677b4bc7e73ddf2d0e46807c57bf64b0b9df7fc67ecba6521767dcc7d4299c740e73bc49cbcf0049faf222c48896378497c0a7be6238217f85c83a2c45376ddf1a8f631c22c8cf453e8a4fe7bf8160a82bd069be9a9e163724a7412bbc30b68bb31bd571f0571297726a309691408af62ecfc77ea52718c39e802f00a726aaa625407f3b18fd4f66db2bbd05dfd62e448fc6bb9fc51960e12b67c5d42e82df55f5d87428137874e27db5cc", 0x37d}, {0x0}, {&(0x7f0000002200)="f610e61ac81cc3edc86f0500", 0xc}], 0x3, 0x0, 0x0, 0x900}}], 0x1, 0x0) r0 = socket(0x10, 0x803, 0x0) sendto(r0, &(0x7f00000000c0)="120000001200e7ef007b00000000000000a1", 0x12, 0x0, 0x0, 0x0) recvmmsg(r0, &(0x7f00000037c0)=[{{&(0x7f00000004c0)=@ethernet={0x0, @random}, 0xfdf4, &(0x7f0000000380)=[{&(0x7f0000000000)=""/102, 0x365}, {&(0x7f0000000280)=""/76, 0x14c}, {&(0x7f0000000fc0)=""/4096, 0x197}, {&(0x7f0000000400)=""/92, 0x645}, {&(0x7f0000000980)=""/73, 0x1b}, {&(0x7f0000000200)=""/77, 0x188}, {&(0x7f00000007c0)=""/154, 0x2c}, {&(0x7f00000001c0)=""/17, 0x1d8}], 0x21, &(0x7f0000000600)=""/191, 0x41}}], 0x4000000000003b4, 0x0, &(0x7f0000003700)={0x77359400}) program crashed: general protection fault in mxl111sf_ep6_streaming_ctrl bisect: the chunk can be dropped bisect: testing without sub-chunk 2/2 bisect: no need to test this chunk, it's definitely needed bisect: split chunk #1 of len 15 into 2 parts bisect: testing without sub-chunk 1/2 testing program (duration=6m4s, {Threaded:true Repeat:true RepeatTimes:0 Procs:6 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): [5, 5, 6, 12, 12, 4, 7, 24, 5, 30, 7, 3, 4, 19, 4, 4] detailed listing: executing program 5: r0 = bpf$PROG_LOAD(0x5, &(0x7f0000000a40)={0x1, 0x4, &(0x7f0000000300)=ANY=[@ANYBLOB], &(0x7f0000000200)='GPL\x00', 0x0, 0x0, 0x0, 0x41100, 0x0, '\x00', 0x0, @fallback=0x2a, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) r1 = socket$kcm(0x11, 0xa, 0x300) setsockopt$sock_attach_bpf(r1, 0x1, 0x32, &(0x7f0000000040)=r0, 0x4) r2 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPSET_CMD_CREATE(r2, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000480)=ANY=[], 0x4c}}, 0x2) executing program 5: r0 = syz_ublk_setup_io_uring(0x1d, &(0x7f0000000500)={0x0, 0x30b5, 0x0, 0x2, 0x158}, &(0x7f0000000100)=0x0, &(0x7f0000000400)=0x0, &(0x7f0000000140)=0x0) syz_ublk_add_dev(r0, r1, r2, r3, &(0x7f0000000200)={0x2e, 0x14, 0x0, 0xffffffffffffffff, 0xc0207504, 0x0, 0x0, 0x0, 0x0, 0x4, 0x0, 0x0, '\x00', {0xffffffff, 0xffff, 0x40, &(0x7f00000004c0)=@any_dev={0x3, 0xe26, 0x0, 0x0, 0x1000, 0x10000, 0xffffffffffffffff, 0x0, 0x4d}}}, &(0x7f0000000480)=0x0) r5 = dup(0xffffffffffffffff) syz_ublk_setup_queues(r5, r4, &(0x7f0000000180)={0x0, 0x1, 0x0, 0x3, 0x255}, &(0x7f0000000800)=[{0x0, 0x0, 0xffffffffffffffff, {0x0, 0x92e0, 0x400, 0x2100, 0x10000004, 0x0, r5}}, {0x0, 0x0, 0xffffffffffffffff, {0x0, 0x19e0, 0x400, 0x0, 0x146}}, {0x0, 0x0, 0xffffffffffffffff, {0x0, 0xf910, 0x2000, 0x0, 0x801f0, 0x0, r5}}, {0x0, 0x0, 0xffffffffffffffff, {0x0, 0x587e, 0x80, 0x2, 0x367}}], 0x1, &(0x7f0000000340)={0x2e, 0x50, 0x0, 0xffffffffffffffff, 0xc0107520, 0x0, 0x0, 0x0, 0x0, {}, 0x1f, 0x0, '\x00', {0xfff9, 0x1, 0x0, 0x0}}, 0x0) bpf$MAP_CREATE(0x0, &(0x7f0000000340)=@base={0x1f, 0x7fff, 0x10001, 0x80, 0x80, r5, 0x2, '\x00', 0x0, 0xffffffffffffffff, 0x4, 0x3, 0x5}, 0x50) executing program 5: r0 = socket$kcm(0x2, 0x200000000000001, 0x0) sendmsg$inet(r0, &(0x7f0000000080)={&(0x7f0000000340)={0x2, 0x4001, @dev}, 0x10, 0x0}, 0x3000c085) r1 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000280)='hugetlb.1GB.usage_in_bytes\x00', 0x26e1, 0x0) setsockopt$sock_attach_bpf(r0, 0x1, 0x3e, &(0x7f0000000100)=r1, 0x4) sendmsg$kcm(r0, &(0x7f0000002480)={0x0, 0x0, &(0x7f0000001e40)=[{&(0x7f0000000e40)}], 0x1}, 0x10) sendmsg$inet(r0, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)=[{&(0x7f0000000300)="b8", 0x2ee0}], 0x13, 0x0, 0x0, 0x10000000}, 0x12cd) executing program 5: prlimit64(0x0, 0xe, &(0x7f0000000140)={0xa, 0x400000000008d}, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000080)=0x8) getpid() sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x2) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r0, &(0x7f0000000180)=@abs, 0x6e) sendmmsg$unix(r1, &(0x7f0000000000), 0x651, 0x0) recvmmsg(r0, &(0x7f00000000c0), 0x4000087, 0x2, 0x0) r2 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r2, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000000)=@updpolicy={0xb8, 0x13, 0xcb23c9c9931e99e9, 0x0, 0x0, {{@in=@private=0xa010101, @in=@remote, 0x0, 0x400, 0x1000, 0x0, 0x2, 0x20, 0x10, 0x84, 0x0, 0xffffffffffffffff}, {}, {0x0, 0x4000000000000, 0x0, 0xffffffffffffffff}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1}}, 0xb8}}, 0x80) sendmsg$nl_xfrm(r2, &(0x7f0000000480)={0x0, 0x0, &(0x7f0000000800)={&(0x7f0000000000)=ANY=[@ANYBLOB="650100001b"], 0x168}}, 0xc0) executing program 33: prlimit64(0x0, 0xe, &(0x7f0000000140)={0xa, 0x400000000008d}, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000080)=0x8) getpid() sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x2) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r0, &(0x7f0000000180)=@abs, 0x6e) sendmmsg$unix(r1, &(0x7f0000000000), 0x651, 0x0) recvmmsg(r0, &(0x7f00000000c0), 0x4000087, 0x2, 0x0) r2 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r2, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000000)=@updpolicy={0xb8, 0x13, 0xcb23c9c9931e99e9, 0x0, 0x0, {{@in=@private=0xa010101, @in=@remote, 0x0, 0x400, 0x1000, 0x0, 0x2, 0x20, 0x10, 0x84, 0x0, 0xffffffffffffffff}, {}, {0x0, 0x4000000000000, 0x0, 0xffffffffffffffff}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1}}, 0xb8}}, 0x80) sendmsg$nl_xfrm(r2, &(0x7f0000000480)={0x0, 0x0, &(0x7f0000000800)={&(0x7f0000000000)=ANY=[@ANYBLOB="650100001b"], 0x168}}, 0xc0) executing program 3: ioctl$VIDIOC_QUERYSTD(0xffffffffffffffff, 0x8008563f, &(0x7f0000000000)) r0 = syz_usb_connect(0x2, 0xb3, &(0x7f0000000640)=ANY=[@ANYBLOB="12010002ef0201406d0425080001000000010902a1000201008032080b00020e03000009040000000e0100000d240100012700006cdc0201011124020101020000000000000000020d000924030201010001"], &(0x7f0000000a40)={0x0, 0x0, 0x0, 0x0}) syz_usb_control_io$rtl8150(r0, 0x0, &(0x7f00000003c0)={0x2c, &(0x7f00000000c0)=ANY=[], 0x0, 0x0, 0x0, 0x0}) write(0xffffffffffffffff, &(0x7f0000000500)='transport=rdma,nqn=nqn.2014-08.org.n', 0x24) executing program 3: r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000000), 0x40241, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000200)={'syzkaller1\x00', 0xc201}) r1 = socket$kcm(0x2, 0xa, 0x2) ioctl$SIOCSIFHWADDR(r1, 0x8914, &(0x7f0000000180)={'syzkaller1\x00', @link_local={0x1, 0x80, 0xc2, 0x0, 0x0, 0xe}}) r2 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r2, &(0x7f0000000200)={0x0, 0x0, &(0x7f0000000000)={&(0x7f00000009c0)=ANY=[@ANYBLOB="140000001000010000000000000000000000000a20000000000a01020000000000000000010000000900010073797a300000000040000000160a01000900000000000000010000000900010073797a30000000000900020073797a3000000000140003800800014000000000080002400000000048000000160a0101000b000000000000010000000900020073797a30000000000900010073797a30000000001c0003801800"], 0xd0}, 0x1, 0x0, 0x0, 0x24040841}, 0x20048010) write$tun(r0, &(0x7f0000001280)=ANY=[@ANYBLOB="000086dd00001100"], 0xfce) executing program 0: socket$nl_route(0x10, 0x3, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000140)={0xa, 0x8b}, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000280)=0x8) r0 = getpid() sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x2) sched_setscheduler(r0, 0x2, &(0x7f0000000200)=0x7) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeea, 0x8031, 0xffffffffffffffff, 0x28f43000) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r1, &(0x7f0000000180)=@abs, 0x6e) sendmmsg$unix(r2, &(0x7f0000000000), 0x651, 0x0) recvmmsg(r1, &(0x7f00000000c0), 0x10106, 0x2, 0x0) mmap$IORING_OFF_SQ_RING(0x110c230000, 0x8000002, 0x2000007, 0x401d031, 0xffffffffffffffff, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./sys\x00', 0x1ff) mount(0x0, &(0x7f0000000040)='./sys\x00', &(0x7f0000000080)='sysfs\x00', 0x0, 0x0) r3 = openat(0xffffffffffffff9c, 0x0, 0x2, 0x0) write(r3, &(0x7f00000005c0)="306663353a313232373a3f7092c0f0bc085a193376cf620afaf6379a248d1d6534058f1095109da34b6d6537a6e78b0dc4b7bc0b", 0x34) r4 = socket$inet_tcp(0x2, 0x1, 0x0) ioctl$sock_SIOCGIFINDEX(r4, 0x8933, &(0x7f0000000180)={'syz_tun\x00'}) mkdirat(0xffffffffffffff9c, &(0x7f0000000080)='./file1\x00', 0x1c0) mkdirat(0xffffffffffffff9c, &(0x7f00000000c0)='./file0\x00', 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000240)='./file2\x00', 0x207) mount$overlay(0x0, &(0x7f0000000100)='./file0\x00', &(0x7f0000000000), 0x0, &(0x7f00000000c0)={[{@workdir={'workdir', 0x3d, './file0'}}, {@lowerdir={'lowerdir', 0x3d, '.'}}, {@upperdir={'upperdir', 0x3d, './file2'}}], [], 0x2c}) r5 = openat$dir(0xffffffffffffff9c, &(0x7f0000000000)='./file0/file1\x00', 0x20400, 0x20) fsync(r5) executing program 7: r0 = syz_open_dev$vim2m(&(0x7f0000000100), 0x0, 0x2) ioctl$vim2m_VIDIOC_STREAMOFF(r0, 0x40045612, &(0x7f0000000040)=0x1) ioctl$vim2m_VIDIOC_QBUF(r0, 0xc058560f, &(0x7f0000000180)=@mmap={0x1, 0x1, 0x4, 0x100, 0x81, {}, {0x4, 0x8, 0x8, 0x5, 0x29, 0x9, "0adb3fb8"}, 0x3}) write$uinput_user_dev(0xffffffffffffffff, &(0x7f0000000400)={'syz0\x00', {0x3, 0x2, 0x6, 0xfffa}, 0x3a, [0x8001, 0xc95a, 0xf, 0x8, 0x80, 0x2, 0x7, 0x7f, 0xa9, 0x4d, 0x6, 0x5f, 0x9, 0x15, 0xffff2d37, 0xff7fff01, 0x6, 0x5, 0x7, 0x5, 0x4, 0x0, 0x7, 0x3c5b, 0x1, 0x20, 0xd, 0x1, 0x0, 0xffffffff, 0xe661, 0x6, 0x7, 0x5, 0x8, 0x4c74, 0xffff7fff, 0x7, 0x3, 0xe, 0x0, 0x80008071, 0x7, 0x17, 0xffffffff, 0x7, 0x5, 0x80003e, 0x18e, 0x6, 0x6, 0x0, 0x8, 0x4, 0x8, 0x3ff, 0x80, 0x0, 0x5, 0x6, 0x8, 0x7, 0x1, 0x40], [0x10000007, 0x9, 0x8000012f, 0x8004, 0x5, 0xfffffff3, 0x129432f6, 0xc8, 0xf1, 0xe, 0x2bf, 0x6c7, 0x2009, 0xfffffffc, 0x573a, 0x0, 0x0, 0x5, 0x2f, 0x8, 0x312, 0x66abcbd2, 0xea4, 0x0, 0x4, 0x1007, 0x7fff, 0x6, 0x400, 0x401, 0x6, 0x1, 0xff, 0x7, 0x1000005, 0x5f31, 0xd, 0x4e0, 0x381, 0x4, 0xb, 0x4, 0x9, 0x8, 0x40, 0x6, 0x47, 0x8000, 0x1, 0xfe000000, 0xffff, 0x2, 0x4, 0x200009, 0x3, 0x3, 0x4000009, 0x6, 0x0, 0x3, 0xbc45, 0x48c93690, 0x42, 0x3], [0x6, 0x40a, 0x3ff, 0x5, 0xfffffffd, 0x100, 0x5, 0x9, 0x5, 0x7fff, 0x0, 0x5, 0xb, 0x4, 0x5, 0x5, 0x0, 0x1ef, 0x3, 0x8, 0x86, 0x1000515, 0x303c, 0x3e7, 0xb, 0x5, 0x2, 0x2, 0x3, 0x20000008, 0x4, 0x6cff, 0x6, 0x20000038, 0x200, 0x1fd, 0x80, 0x7, 0x4, 0x2950bfaf, 0x1000, 0xa2, 0x7, 0xcc, 0x5, 0x6, 0xac8, 0xbf, 0x2, 0x3, 0x7ff, 0x12b, 0x4, 0x1, 0xa, 0xffffffff, 0x5, 0x1c, 0x120000, 0x7ef, 0x2006, 0x80a2cd, 0x4, 0x25], [0xc, 0xbb33, 0x7, 0xb, 0x5, 0x938, 0x6, 0x6, 0x0, 0xb9, 0xce4, 0x1ff, 0x2, 0x57, 0x5, 0x3, 0x2, 0x10000, 0x4, 0x7fff, 0xfff4, 0xa620, 0x1, 0x5, 0x801, 0x2000002, 0x150, 0x60a7, 0x6, 0x16, 0xffffffff, 0x8, 0x4, 0x5, 0xca, 0x1, 0xfffff000, 0x10000, 0xf, 0x7e, 0x9, 0x9622, 0x7, 0xaf, 0x20000008, 0x5, 0x226, 0x2, 0x5, 0x0, 0x30b1d693, 0xa1f, 0xf40, 0x7, 0x530e, 0xe1c4, 0x0, 0x0, 0x5, 0x7ff, 0xd7, 0x200, 0xb, 0xfff]}, 0x45c) ppoll(&(0x7f00000000c0)=[{}, {}], 0x20000000000000dc, 0x0, 0x0, 0x0) executing program 7: bpf$MAP_CREATE(0x0, &(0x7f0000000080)=ANY=[], 0x50) bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x0, 0xc, 0x0, 0x0, 0xfffffffd, 0x0, 0x0, 0x0, 0x40, '\x00', 0x0, @fallback=0x10, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) socket(0x10, 0x803, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x1, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000380)={0xa, 0x100008b}, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000200)=0x8) openat$sequencer(0xffffffffffffff9c, &(0x7f00000001c0), 0x80200, 0x0) r0 = syz_open_dev$sndmidi(&(0x7f00000004c0), 0x2, 0x141102) writev(r0, &(0x7f0000000840)=[{&(0x7f00000002c0)="94", 0xf000}, {0x0}], 0x2) ioctl$sock_SIOCGIFINDEX(0xffffffffffffffff, 0x8933, 0x0) r1 = socket$kcm(0xa, 0x3, 0x3a) r2 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r2, &(0x7f0000000480)={0x0, 0x0, &(0x7f0000001f40)={&(0x7f00000004c0)=ANY=[@ANYBLOB="fc000000190001002dbd700000000000ac1e0001000000000000000000000000ac1414aa00"/48, @ANYRES32=0x0, @ANYRES32, @ANYBLOB="00000000000000000c00000000000000000000000000000000000000000000000000000000000000ffffffffffffffff000000000000000000000000000000000000000000000000000a000000000000feffffffff7f40000200000000000008ffffffff00000000010006000000000044000500ac1414bb000000000000000000000000000000003c0000000200000000000000000000000000000000000001060000"], 0xfc}, 0x1, 0x0, 0x0, 0x4008000}, 0x600c010) sendmsg$kcm(r1, &(0x7f0000000080)={&(0x7f0000000000)=@l2tp6={0xa, 0x0, 0x0, @loopback={0xfe80000000000000, 0xac14140c}}, 0x80, &(0x7f00000000c0)=[{&(0x7f0000000140)='\x00\x00', 0xffe3}], 0x1, 0x0, 0x0, 0x900}, 0x60) setsockopt$IPT_SO_SET_REPLACE(0xffffffffffffffff, 0x0, 0x40, 0x0, 0x0) syz_usb_connect(0x3, 0x57, &(0x7f0000000000)=ANY=[@ANYBLOB="1201000200000040402001c60100000000010902450001010080fa0904"], 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000340)='./file1\x00', 0x0) mkdirat(0xffffffffffffff9c, &(0x7f00000000c0)='./bus\x00', 0x1d7) mkdirat(0xffffffffffffff9c, &(0x7f0000000400)='./file1/file0\x00', 0x100) mount$bind(&(0x7f0000000100)='.\x00', &(0x7f0000000080)='./file1/file0\x00', 0x0, 0x1085408, 0x0) r3 = openat$sw_sync(0xffffffffffffff9c, &(0x7f0000000ac0), 0x800, 0x0) ioctl$SW_SYNC_IOC_CREATE_FENCE(r3, 0xc0285700, &(0x7f0000000b00)={0x4, "abacd211119ca94c63377526aeb5ab2c7b9ca5fa07558139ede6dc06270ee042", 0xffffffffffffffff}) ioctl$SYNC_IOC_MERGE(r4, 0xc0303e03, &(0x7f0000000780)={"d1ed39d88b014076ab94c1fb10628c46d2e66ccdb9e581a38ebb0ddd5f307e56", 0xffffffffffffffff, 0xffffffffffffffff}) ioctl$SYNC_IOC_FILE_INFO(r5, 0xc0383e04, 0x0) mount$overlay(0x0, &(0x7f00000000c0)='./bus\x00', &(0x7f00000003c0), 0x40, &(0x7f0000000300)={[{@workdir={'workdir', 0x3d, './bus'}}, {@upperdir={'upperdir', 0x3d, './file1'}}]}) bpf$PROG_LOAD(0x5, 0x0, 0x0) r6 = syz_usb_connect$hid(0x1, 0x36, &(0x7f0000000040)=ANY=[@ANYBLOB="12010000090024206d041cc340000000000109022400010000a00009040000010301010009"], 0x0) r7 = syz_open_procfs(0xffffffffffffffff, &(0x7f0000000080)='stat\x00') read$FUSE(r7, &(0x7f0000004180)={0x2020}, 0x2020) syz_usb_control_io$hid(r6, &(0x7f0000000240)={0x24, &(0x7f00000003c0)=ANY=[@ANYBLOB="00000c000000070001"], 0x0, 0x0, 0x0}, 0x0) executing program 6: r0 = socket$packet(0x11, 0x2, 0x300) setsockopt$SO_ATTACH_FILTER(r0, 0x1, 0x1a, &(0x7f0000000100)={0x2, &(0x7f0000000040)=[{0x0, 0x0, 0xfd, 0xc8e}, {0x16, 0xff, 0x6, 0x6}]}, 0x10) setsockopt$packet_fanout(r0, 0x107, 0x12, 0x0, 0x0) r1 = socket$inet_udp(0x2, 0x2, 0x0) bind$inet(r1, &(0x7f0000000140)={0x2, 0x80, @dev={0xac, 0x14, 0x14, 0xf}}, 0x10) sendmmsg$inet(r1, &(0x7f0000000c00)=[{{&(0x7f0000010940)={0x2, 0x4e22, @multicast2}, 0x10, 0x0}}], 0x1, 0x2000c044) sendto$inet(r1, &(0x7f0000000c80)="e8", 0x6200, 0x0, 0x0, 0x0) executing program 6: syz_usb_connect(0x0, 0x4b, &(0x7f0000000000)=ANY=[@ANYBLOB="1201000200000040480b051000010102000109023900020100803209040000000000000009"], 0x0) r0 = syz_open_dev$dvb_demux(&(0x7f0000000200), 0x1, 0x2) ioctl$DVB_DEMUX_DMX_SET_PES_FILTER(r0, 0x40146f2c, &(0x7f0000000100)={0x1ff, 0x0, 0x3, 0xa, 0x4}) executing program 3: ioctl$VIDIOC_QUERYSTD(0xffffffffffffffff, 0x8008563f, &(0x7f0000000000)) r0 = syz_usb_connect(0x2, 0xb3, &(0x7f0000000640)=ANY=[@ANYBLOB="12010002ef0201406d0425080001000000010902a1000201008032080b00020e03000009040000000e0100000d240100012700006cdc0201011124020101020000000000000000020d000924030201010001"], &(0x7f0000000a40)={0x0, 0x0, 0x0, 0x0}) syz_usb_control_io$rtl8150(r0, 0x0, &(0x7f00000003c0)={0x2c, &(0x7f00000000c0)=ANY=[], 0x0, 0x0, 0x0, 0x0}) write(0xffffffffffffffff, &(0x7f0000000500)='transport=rdma,nqn=nqn.2014-08.org.nvmexpress:NVMf:uui', 0x36) executing program 0: socket$can_raw(0x1d, 0x3, 0x1) socket(0x18, 0x80000, 0x1) socket$key(0xf, 0x3, 0x2) syz_open_procfs$namespace(0x0, &(0x7f0000000280)='ns/ipc\x00') syz_open_procfs$namespace(0x0, &(0x7f0000000040)='ns/ipc\x00') socket$inet_udp(0x2, 0x2, 0x0) syz_open_dev$vim2m(&(0x7f0000000080), 0x7, 0x2) socket$inet_icmp_raw(0x2, 0x3, 0x1) bpf$PROG_LOAD(0x5, &(0x7f0000000000)={0x13, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x40, '\x00', 0x0, @fallback=0x2e, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0x1}, 0x94) socket$netlink(0x10, 0x3, 0x0) openat$rdma_cm(0xffffffffffffff9c, &(0x7f0000000180), 0x2, 0x0) socket$nl_xfrm(0x10, 0x3, 0x6) mkdirat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000)='./cgroup/syz0\x00', 0x1ff) openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000), 0x200002, 0x0) r0 = epoll_create1(0x0) socket$nl_route(0x10, 0x3, 0x0) r1 = socket$netlink(0x10, 0x3, 0x0) sendmsg$nl_route(0xffffffffffffffff, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000000080)=ANY=[@ANYBLOB="540000001000010400000000000000ffff000000", @ANYRES32=0x0, @ANYBLOB="0380000000000000240012800c0001006d6163766c616e00140002800800010008000000060002000100000008000500", @ANYRES32=r0, @ANYBLOB='\b\x00\n\x00', @ANYRES8=r1], 0x54}, 0x1, 0x0, 0x0, 0x4000085}, 0x0) sendmmsg(r1, &(0x7f00000002c0), 0x40000000000009f, 0x20) executing program 1: r0 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r0, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000001680)=ANY=[@ANYBLOB="140000001000010000000000000000000500000a28000000000a030000000000000000000a00000708000240000000020900010073797a31000000002c000000030a010100000000000000000a0000070900010073797a31000000000900030073797a320000000014"], 0x7c}, 0x1, 0x0, 0x0, 0x40001}, 0x4040850) sendmsg$NFT_BATCH(r0, &(0x7f0000009b40)={0x0, 0x0, &(0x7f0000009b00)={&(0x7f0000000240)=ANY=[@ANYBLOB="140000001000010000000000000000000500000a48000000030a0fdb00000000000000000a0000050900030073797a30000000000900010073797a310000000014000480080002403cb140bb0800014000000003080005400000000014000000110001"], 0x70}, 0x1, 0x0, 0x0, 0x4000850}, 0x24000840) sendmsg$NFT_BATCH(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000cc0)={&(0x7f00000002c0)={{0x14, 0x10, 0x1, 0x0, 0x0, {0x3}}, [@NFT_MSG_DELCHAIN={0x2c, 0x5, 0xa, 0x101, 0x0, 0x0, {0xa, 0x0, 0xa}, [@NFTA_CHAIN_TABLE={0x9, 0x1, 'syz1\x00'}, @NFTA_CHAIN_HANDLE={0xc, 0x2, 0x1, 0x0, 0x1}]}, @NFT_MSG_DELRULE={0x20, 0x8, 0xa, 0x101, 0x0, 0x0, {0xa, 0x0, 0x9}, [@NFTA_RULE_TABLE={0x9, 0x1, 'syz1\x00'}]}], {0x14}}, 0x74}, 0x1, 0x0, 0x0, 0xb0}, 0x20008890) executing program 1: sendmmsg$inet(0xffffffffffffffff, &(0x7f0000002140)=[{{0x0, 0x0, &(0x7f0000000540)=[{&(0x7f0000002280)="21ae1baf930b4569b9ddef9797ffd935c7d80e6466b3e4e62dd4603583f5d4b61fbc65b6ac744d7319535e75bf552062e4cfde1ba7ce29263322e18ea9740aa89f69c47a63133708cda00d2b1f4e799bd41e3f76258180fa91a42aaa8b1ebc4e0ea8fb12f2c71e6e5bc57a8e91f254005514721d93c13c5606ae1fea7f31f558d562bd5a8dfb0b9fed873efa221fccffa84fcd374c92e6cbb03e6a9de890ce323f000000abcc6c01326d588495b7c1a7db31ec4129e6336f26bb9e0b7552af3cd2d5dda1632799bbc98425c433384d8a8e4071ff39a36dfde5f05af35a4ddd340cfecd7ec935f4ce7d3e851583ba1cf53a90a7f7bce5703de57ce93ddef7849b30a01de0637e6d5e507b801d32e582e0c2d564539ebfc84c098a23e765552767b122885fb1629e9c180be47da7931bd125b80de1594b75e5371a81c2c32d0c4a028a5aab0c56a2edf2e0483b87f5ab299dc046076203dea10ccbfc631d5bf4a87ce67004519f248f086346ce6a8a9d181789a59f81d9b7f6781daac3e229914b8b8998c15c3b6302a519331cb05995bc60b7cb872dd3b5b43331c77c5d72e21f7bd2b1a915ff3204e3f20d3a20b22d6a58155b5a4ebf6d1d1cd90c656ecada531c07ff91deb3efa91762cdecfbcc43553750f22ac5c18cc5e8b6f790c2f4e6373af9f98d10e6df49ff8e5cbcbd68e11ed0b967add11410dc2e34f08dbfaf8eb95d4d1153b4c6093192a340eb30fcc71619888c6486746a049585d249efb96b9cace83320b8f96b40ebe3a9a788d05a053380d1026b9434df87a3a387549bcabe88684c4d0948a6e219b5769480e6d0a9bf0da9a5212f3dbc8d1dff240856691243b203d7edd4d3cc89a38a6c80fdb1229a01044af7aaecb20d5570ebf24b30bbc6dfc3f70d85cd9f0d60ebd8fedd161d199d9997a0e2d18d1c99bc7158564e0ddb4673055de196535d706d142e1dc7d404583923cb1b286cfc5418884ac7e605d93652dc48ff8261c63790a91ee2c5ff9a21677b4bc7e73ddf2d0e46807c57bf64b0b9df7fc67ecba6521767dcc7d4299c740e73bc49cbcf0049faf222c48896378497c0a7be6238217f85c83a2c45376ddf1a8f631c22c8cf453e8a4fe7bf8160a82bd069be9a9e163724a7412bbc30b68bb31bd571f0571297726a309691408af62ecfc77ea52718c39e802f00a726aaa625407f3b18fd4f66db2bbd05dfd62e448fc6bb9fc51960e12b67c5d42e82df55f5d87428137874e27db5cc", 0x37d}, {0x0}, {&(0x7f0000002200)="f610e61ac81cc3edc86f0500", 0xc}], 0x3, 0x0, 0x0, 0x900}}], 0x1, 0x0) r0 = socket(0x10, 0x803, 0x0) sendto(r0, &(0x7f00000000c0)="120000001200e7ef007b00000000000000a1", 0x12, 0x0, 0x0, 0x0) recvmmsg(r0, &(0x7f00000037c0)=[{{&(0x7f00000004c0)=@ethernet={0x0, @random}, 0xfdf4, &(0x7f0000000380)=[{&(0x7f0000000000)=""/102, 0x365}, {&(0x7f0000000280)=""/76, 0x14c}, {&(0x7f0000000fc0)=""/4096, 0x197}, {&(0x7f0000000400)=""/92, 0x645}, {&(0x7f0000000980)=""/73, 0x1b}, {&(0x7f0000000200)=""/77, 0x188}, {&(0x7f00000007c0)=""/154, 0x2c}, {&(0x7f00000001c0)=""/17, 0x1d8}], 0x21, &(0x7f0000000600)=""/191, 0x41}}], 0x4000000000003b4, 0x0, &(0x7f0000003700)={0x77359400}) program crashed: general protection fault in mxl111sf_ep6_streaming_ctrl bisect: the chunk can be dropped bisect: testing without sub-chunk 2/2 bisect: no need to test this chunk, it's definitely needed bisect: split chunks (needed=true): <8>, <7> bisect: split chunk #0 of len 8 into 2 parts bisect: testing without sub-chunk 1/2 testing program (duration=6m3s, {Threaded:true Repeat:true RepeatTimes:0 Procs:6 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): [12, 4, 7, 24, 5, 30, 7, 3, 4, 19, 4, 4] detailed listing: executing program 33: prlimit64(0x0, 0xe, &(0x7f0000000140)={0xa, 0x400000000008d}, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000080)=0x8) getpid() sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x2) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r0, &(0x7f0000000180)=@abs, 0x6e) sendmmsg$unix(r1, &(0x7f0000000000), 0x651, 0x0) recvmmsg(r0, &(0x7f00000000c0), 0x4000087, 0x2, 0x0) r2 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r2, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000000)=@updpolicy={0xb8, 0x13, 0xcb23c9c9931e99e9, 0x0, 0x0, {{@in=@private=0xa010101, @in=@remote, 0x0, 0x400, 0x1000, 0x0, 0x2, 0x20, 0x10, 0x84, 0x0, 0xffffffffffffffff}, {}, {0x0, 0x4000000000000, 0x0, 0xffffffffffffffff}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1}}, 0xb8}}, 0x80) sendmsg$nl_xfrm(r2, &(0x7f0000000480)={0x0, 0x0, &(0x7f0000000800)={&(0x7f0000000000)=ANY=[@ANYBLOB="650100001b"], 0x168}}, 0xc0) executing program 3: ioctl$VIDIOC_QUERYSTD(0xffffffffffffffff, 0x8008563f, &(0x7f0000000000)) r0 = syz_usb_connect(0x2, 0xb3, &(0x7f0000000640)=ANY=[@ANYBLOB="12010002ef0201406d0425080001000000010902a1000201008032080b00020e03000009040000000e0100000d240100012700006cdc0201011124020101020000000000000000020d000924030201010001"], &(0x7f0000000a40)={0x0, 0x0, 0x0, 0x0}) syz_usb_control_io$rtl8150(r0, 0x0, &(0x7f00000003c0)={0x2c, &(0x7f00000000c0)=ANY=[], 0x0, 0x0, 0x0, 0x0}) write(0xffffffffffffffff, &(0x7f0000000500)='transport=rdma,nqn=nqn.2014-08.org.n', 0x24) executing program 3: r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000000), 0x40241, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000200)={'syzkaller1\x00', 0xc201}) r1 = socket$kcm(0x2, 0xa, 0x2) ioctl$SIOCSIFHWADDR(r1, 0x8914, &(0x7f0000000180)={'syzkaller1\x00', @link_local={0x1, 0x80, 0xc2, 0x0, 0x0, 0xe}}) r2 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r2, &(0x7f0000000200)={0x0, 0x0, &(0x7f0000000000)={&(0x7f00000009c0)=ANY=[@ANYBLOB="140000001000010000000000000000000000000a20000000000a01020000000000000000010000000900010073797a300000000040000000160a01000900000000000000010000000900010073797a30000000000900020073797a3000000000140003800800014000000000080002400000000048000000160a0101000b000000000000010000000900020073797a30000000000900010073797a30000000001c0003801800"], 0xd0}, 0x1, 0x0, 0x0, 0x24040841}, 0x20048010) write$tun(r0, &(0x7f0000001280)=ANY=[@ANYBLOB="000086dd00001100"], 0xfce) executing program 0: socket$nl_route(0x10, 0x3, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000140)={0xa, 0x8b}, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000280)=0x8) r0 = getpid() sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x2) sched_setscheduler(r0, 0x2, &(0x7f0000000200)=0x7) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeea, 0x8031, 0xffffffffffffffff, 0x28f43000) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r1, &(0x7f0000000180)=@abs, 0x6e) sendmmsg$unix(r2, &(0x7f0000000000), 0x651, 0x0) recvmmsg(r1, &(0x7f00000000c0), 0x10106, 0x2, 0x0) mmap$IORING_OFF_SQ_RING(0x110c230000, 0x8000002, 0x2000007, 0x401d031, 0xffffffffffffffff, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./sys\x00', 0x1ff) mount(0x0, &(0x7f0000000040)='./sys\x00', &(0x7f0000000080)='sysfs\x00', 0x0, 0x0) r3 = openat(0xffffffffffffff9c, 0x0, 0x2, 0x0) write(r3, &(0x7f00000005c0)="306663353a313232373a3f7092c0f0bc085a193376cf620afaf6379a248d1d6534058f1095109da34b6d6537a6e78b0dc4b7bc0b", 0x34) r4 = socket$inet_tcp(0x2, 0x1, 0x0) ioctl$sock_SIOCGIFINDEX(r4, 0x8933, &(0x7f0000000180)={'syz_tun\x00'}) mkdirat(0xffffffffffffff9c, &(0x7f0000000080)='./file1\x00', 0x1c0) mkdirat(0xffffffffffffff9c, &(0x7f00000000c0)='./file0\x00', 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000240)='./file2\x00', 0x207) mount$overlay(0x0, &(0x7f0000000100)='./file0\x00', &(0x7f0000000000), 0x0, &(0x7f00000000c0)={[{@workdir={'workdir', 0x3d, './file0'}}, {@lowerdir={'lowerdir', 0x3d, '.'}}, {@upperdir={'upperdir', 0x3d, './file2'}}], [], 0x2c}) r5 = openat$dir(0xffffffffffffff9c, &(0x7f0000000000)='./file0/file1\x00', 0x20400, 0x20) fsync(r5) executing program 7: r0 = syz_open_dev$vim2m(&(0x7f0000000100), 0x0, 0x2) ioctl$vim2m_VIDIOC_STREAMOFF(r0, 0x40045612, &(0x7f0000000040)=0x1) ioctl$vim2m_VIDIOC_QBUF(r0, 0xc058560f, &(0x7f0000000180)=@mmap={0x1, 0x1, 0x4, 0x100, 0x81, {}, {0x4, 0x8, 0x8, 0x5, 0x29, 0x9, "0adb3fb8"}, 0x3}) write$uinput_user_dev(0xffffffffffffffff, &(0x7f0000000400)={'syz0\x00', {0x3, 0x2, 0x6, 0xfffa}, 0x3a, [0x8001, 0xc95a, 0xf, 0x8, 0x80, 0x2, 0x7, 0x7f, 0xa9, 0x4d, 0x6, 0x5f, 0x9, 0x15, 0xffff2d37, 0xff7fff01, 0x6, 0x5, 0x7, 0x5, 0x4, 0x0, 0x7, 0x3c5b, 0x1, 0x20, 0xd, 0x1, 0x0, 0xffffffff, 0xe661, 0x6, 0x7, 0x5, 0x8, 0x4c74, 0xffff7fff, 0x7, 0x3, 0xe, 0x0, 0x80008071, 0x7, 0x17, 0xffffffff, 0x7, 0x5, 0x80003e, 0x18e, 0x6, 0x6, 0x0, 0x8, 0x4, 0x8, 0x3ff, 0x80, 0x0, 0x5, 0x6, 0x8, 0x7, 0x1, 0x40], [0x10000007, 0x9, 0x8000012f, 0x8004, 0x5, 0xfffffff3, 0x129432f6, 0xc8, 0xf1, 0xe, 0x2bf, 0x6c7, 0x2009, 0xfffffffc, 0x573a, 0x0, 0x0, 0x5, 0x2f, 0x8, 0x312, 0x66abcbd2, 0xea4, 0x0, 0x4, 0x1007, 0x7fff, 0x6, 0x400, 0x401, 0x6, 0x1, 0xff, 0x7, 0x1000005, 0x5f31, 0xd, 0x4e0, 0x381, 0x4, 0xb, 0x4, 0x9, 0x8, 0x40, 0x6, 0x47, 0x8000, 0x1, 0xfe000000, 0xffff, 0x2, 0x4, 0x200009, 0x3, 0x3, 0x4000009, 0x6, 0x0, 0x3, 0xbc45, 0x48c93690, 0x42, 0x3], [0x6, 0x40a, 0x3ff, 0x5, 0xfffffffd, 0x100, 0x5, 0x9, 0x5, 0x7fff, 0x0, 0x5, 0xb, 0x4, 0x5, 0x5, 0x0, 0x1ef, 0x3, 0x8, 0x86, 0x1000515, 0x303c, 0x3e7, 0xb, 0x5, 0x2, 0x2, 0x3, 0x20000008, 0x4, 0x6cff, 0x6, 0x20000038, 0x200, 0x1fd, 0x80, 0x7, 0x4, 0x2950bfaf, 0x1000, 0xa2, 0x7, 0xcc, 0x5, 0x6, 0xac8, 0xbf, 0x2, 0x3, 0x7ff, 0x12b, 0x4, 0x1, 0xa, 0xffffffff, 0x5, 0x1c, 0x120000, 0x7ef, 0x2006, 0x80a2cd, 0x4, 0x25], [0xc, 0xbb33, 0x7, 0xb, 0x5, 0x938, 0x6, 0x6, 0x0, 0xb9, 0xce4, 0x1ff, 0x2, 0x57, 0x5, 0x3, 0x2, 0x10000, 0x4, 0x7fff, 0xfff4, 0xa620, 0x1, 0x5, 0x801, 0x2000002, 0x150, 0x60a7, 0x6, 0x16, 0xffffffff, 0x8, 0x4, 0x5, 0xca, 0x1, 0xfffff000, 0x10000, 0xf, 0x7e, 0x9, 0x9622, 0x7, 0xaf, 0x20000008, 0x5, 0x226, 0x2, 0x5, 0x0, 0x30b1d693, 0xa1f, 0xf40, 0x7, 0x530e, 0xe1c4, 0x0, 0x0, 0x5, 0x7ff, 0xd7, 0x200, 0xb, 0xfff]}, 0x45c) ppoll(&(0x7f00000000c0)=[{}, {}], 0x20000000000000dc, 0x0, 0x0, 0x0) executing program 7: bpf$MAP_CREATE(0x0, &(0x7f0000000080)=ANY=[], 0x50) bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x0, 0xc, 0x0, 0x0, 0xfffffffd, 0x0, 0x0, 0x0, 0x40, '\x00', 0x0, @fallback=0x10, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) socket(0x10, 0x803, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x1, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000380)={0xa, 0x100008b}, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000200)=0x8) openat$sequencer(0xffffffffffffff9c, &(0x7f00000001c0), 0x80200, 0x0) r0 = syz_open_dev$sndmidi(&(0x7f00000004c0), 0x2, 0x141102) writev(r0, &(0x7f0000000840)=[{&(0x7f00000002c0)="94", 0xf000}, {0x0}], 0x2) ioctl$sock_SIOCGIFINDEX(0xffffffffffffffff, 0x8933, 0x0) r1 = socket$kcm(0xa, 0x3, 0x3a) r2 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r2, &(0x7f0000000480)={0x0, 0x0, &(0x7f0000001f40)={&(0x7f00000004c0)=ANY=[@ANYBLOB="fc000000190001002dbd700000000000ac1e0001000000000000000000000000ac1414aa00"/48, @ANYRES32=0x0, @ANYRES32, @ANYBLOB="00000000000000000c00000000000000000000000000000000000000000000000000000000000000ffffffffffffffff000000000000000000000000000000000000000000000000000a000000000000feffffffff7f40000200000000000008ffffffff00000000010006000000000044000500ac1414bb000000000000000000000000000000003c0000000200000000000000000000000000000000000001060000"], 0xfc}, 0x1, 0x0, 0x0, 0x4008000}, 0x600c010) sendmsg$kcm(r1, &(0x7f0000000080)={&(0x7f0000000000)=@l2tp6={0xa, 0x0, 0x0, @loopback={0xfe80000000000000, 0xac14140c}}, 0x80, &(0x7f00000000c0)=[{&(0x7f0000000140)='\x00\x00', 0xffe3}], 0x1, 0x0, 0x0, 0x900}, 0x60) setsockopt$IPT_SO_SET_REPLACE(0xffffffffffffffff, 0x0, 0x40, 0x0, 0x0) syz_usb_connect(0x3, 0x57, &(0x7f0000000000)=ANY=[@ANYBLOB="1201000200000040402001c60100000000010902450001010080fa0904"], 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000340)='./file1\x00', 0x0) mkdirat(0xffffffffffffff9c, &(0x7f00000000c0)='./bus\x00', 0x1d7) mkdirat(0xffffffffffffff9c, &(0x7f0000000400)='./file1/file0\x00', 0x100) mount$bind(&(0x7f0000000100)='.\x00', &(0x7f0000000080)='./file1/file0\x00', 0x0, 0x1085408, 0x0) r3 = openat$sw_sync(0xffffffffffffff9c, &(0x7f0000000ac0), 0x800, 0x0) ioctl$SW_SYNC_IOC_CREATE_FENCE(r3, 0xc0285700, &(0x7f0000000b00)={0x4, "abacd211119ca94c63377526aeb5ab2c7b9ca5fa07558139ede6dc06270ee042", 0xffffffffffffffff}) ioctl$SYNC_IOC_MERGE(r4, 0xc0303e03, &(0x7f0000000780)={"d1ed39d88b014076ab94c1fb10628c46d2e66ccdb9e581a38ebb0ddd5f307e56", 0xffffffffffffffff, 0xffffffffffffffff}) ioctl$SYNC_IOC_FILE_INFO(r5, 0xc0383e04, 0x0) mount$overlay(0x0, &(0x7f00000000c0)='./bus\x00', &(0x7f00000003c0), 0x40, &(0x7f0000000300)={[{@workdir={'workdir', 0x3d, './bus'}}, {@upperdir={'upperdir', 0x3d, './file1'}}]}) bpf$PROG_LOAD(0x5, 0x0, 0x0) r6 = syz_usb_connect$hid(0x1, 0x36, &(0x7f0000000040)=ANY=[@ANYBLOB="12010000090024206d041cc340000000000109022400010000a00009040000010301010009"], 0x0) r7 = syz_open_procfs(0xffffffffffffffff, &(0x7f0000000080)='stat\x00') read$FUSE(r7, &(0x7f0000004180)={0x2020}, 0x2020) syz_usb_control_io$hid(r6, &(0x7f0000000240)={0x24, &(0x7f00000003c0)=ANY=[@ANYBLOB="00000c000000070001"], 0x0, 0x0, 0x0}, 0x0) executing program 6: r0 = socket$packet(0x11, 0x2, 0x300) setsockopt$SO_ATTACH_FILTER(r0, 0x1, 0x1a, &(0x7f0000000100)={0x2, &(0x7f0000000040)=[{0x0, 0x0, 0xfd, 0xc8e}, {0x16, 0xff, 0x6, 0x6}]}, 0x10) setsockopt$packet_fanout(r0, 0x107, 0x12, 0x0, 0x0) r1 = socket$inet_udp(0x2, 0x2, 0x0) bind$inet(r1, &(0x7f0000000140)={0x2, 0x80, @dev={0xac, 0x14, 0x14, 0xf}}, 0x10) sendmmsg$inet(r1, &(0x7f0000000c00)=[{{&(0x7f0000010940)={0x2, 0x4e22, @multicast2}, 0x10, 0x0}}], 0x1, 0x2000c044) sendto$inet(r1, &(0x7f0000000c80)="e8", 0x6200, 0x0, 0x0, 0x0) executing program 6: syz_usb_connect(0x0, 0x4b, &(0x7f0000000000)=ANY=[@ANYBLOB="1201000200000040480b051000010102000109023900020100803209040000000000000009"], 0x0) r0 = syz_open_dev$dvb_demux(&(0x7f0000000200), 0x1, 0x2) ioctl$DVB_DEMUX_DMX_SET_PES_FILTER(r0, 0x40146f2c, &(0x7f0000000100)={0x1ff, 0x0, 0x3, 0xa, 0x4}) executing program 3: ioctl$VIDIOC_QUERYSTD(0xffffffffffffffff, 0x8008563f, &(0x7f0000000000)) r0 = syz_usb_connect(0x2, 0xb3, &(0x7f0000000640)=ANY=[@ANYBLOB="12010002ef0201406d0425080001000000010902a1000201008032080b00020e03000009040000000e0100000d240100012700006cdc0201011124020101020000000000000000020d000924030201010001"], &(0x7f0000000a40)={0x0, 0x0, 0x0, 0x0}) syz_usb_control_io$rtl8150(r0, 0x0, &(0x7f00000003c0)={0x2c, &(0x7f00000000c0)=ANY=[], 0x0, 0x0, 0x0, 0x0}) write(0xffffffffffffffff, &(0x7f0000000500)='transport=rdma,nqn=nqn.2014-08.org.nvmexpress:NVMf:uui', 0x36) executing program 0: socket$can_raw(0x1d, 0x3, 0x1) socket(0x18, 0x80000, 0x1) socket$key(0xf, 0x3, 0x2) syz_open_procfs$namespace(0x0, &(0x7f0000000280)='ns/ipc\x00') syz_open_procfs$namespace(0x0, &(0x7f0000000040)='ns/ipc\x00') socket$inet_udp(0x2, 0x2, 0x0) syz_open_dev$vim2m(&(0x7f0000000080), 0x7, 0x2) socket$inet_icmp_raw(0x2, 0x3, 0x1) bpf$PROG_LOAD(0x5, &(0x7f0000000000)={0x13, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x40, '\x00', 0x0, @fallback=0x2e, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0x1}, 0x94) socket$netlink(0x10, 0x3, 0x0) openat$rdma_cm(0xffffffffffffff9c, &(0x7f0000000180), 0x2, 0x0) socket$nl_xfrm(0x10, 0x3, 0x6) mkdirat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000)='./cgroup/syz0\x00', 0x1ff) openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000), 0x200002, 0x0) r0 = epoll_create1(0x0) socket$nl_route(0x10, 0x3, 0x0) r1 = socket$netlink(0x10, 0x3, 0x0) sendmsg$nl_route(0xffffffffffffffff, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000000080)=ANY=[@ANYBLOB="540000001000010400000000000000ffff000000", @ANYRES32=0x0, @ANYBLOB="0380000000000000240012800c0001006d6163766c616e00140002800800010008000000060002000100000008000500", @ANYRES32=r0, @ANYBLOB='\b\x00\n\x00', @ANYRES8=r1], 0x54}, 0x1, 0x0, 0x0, 0x4000085}, 0x0) sendmmsg(r1, &(0x7f00000002c0), 0x40000000000009f, 0x20) executing program 1: r0 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r0, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000001680)=ANY=[@ANYBLOB="140000001000010000000000000000000500000a28000000000a030000000000000000000a00000708000240000000020900010073797a31000000002c000000030a010100000000000000000a0000070900010073797a31000000000900030073797a320000000014"], 0x7c}, 0x1, 0x0, 0x0, 0x40001}, 0x4040850) sendmsg$NFT_BATCH(r0, &(0x7f0000009b40)={0x0, 0x0, &(0x7f0000009b00)={&(0x7f0000000240)=ANY=[@ANYBLOB="140000001000010000000000000000000500000a48000000030a0fdb00000000000000000a0000050900030073797a30000000000900010073797a310000000014000480080002403cb140bb0800014000000003080005400000000014000000110001"], 0x70}, 0x1, 0x0, 0x0, 0x4000850}, 0x24000840) sendmsg$NFT_BATCH(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000cc0)={&(0x7f00000002c0)={{0x14, 0x10, 0x1, 0x0, 0x0, {0x3}}, [@NFT_MSG_DELCHAIN={0x2c, 0x5, 0xa, 0x101, 0x0, 0x0, {0xa, 0x0, 0xa}, [@NFTA_CHAIN_TABLE={0x9, 0x1, 'syz1\x00'}, @NFTA_CHAIN_HANDLE={0xc, 0x2, 0x1, 0x0, 0x1}]}, @NFT_MSG_DELRULE={0x20, 0x8, 0xa, 0x101, 0x0, 0x0, {0xa, 0x0, 0x9}, [@NFTA_RULE_TABLE={0x9, 0x1, 'syz1\x00'}]}], {0x14}}, 0x74}, 0x1, 0x0, 0x0, 0xb0}, 0x20008890) executing program 1: sendmmsg$inet(0xffffffffffffffff, &(0x7f0000002140)=[{{0x0, 0x0, &(0x7f0000000540)=[{&(0x7f0000002280)="21ae1baf930b4569b9ddef9797ffd935c7d80e6466b3e4e62dd4603583f5d4b61fbc65b6ac744d7319535e75bf552062e4cfde1ba7ce29263322e18ea9740aa89f69c47a63133708cda00d2b1f4e799bd41e3f76258180fa91a42aaa8b1ebc4e0ea8fb12f2c71e6e5bc57a8e91f254005514721d93c13c5606ae1fea7f31f558d562bd5a8dfb0b9fed873efa221fccffa84fcd374c92e6cbb03e6a9de890ce323f000000abcc6c01326d588495b7c1a7db31ec4129e6336f26bb9e0b7552af3cd2d5dda1632799bbc98425c433384d8a8e4071ff39a36dfde5f05af35a4ddd340cfecd7ec935f4ce7d3e851583ba1cf53a90a7f7bce5703de57ce93ddef7849b30a01de0637e6d5e507b801d32e582e0c2d564539ebfc84c098a23e765552767b122885fb1629e9c180be47da7931bd125b80de1594b75e5371a81c2c32d0c4a028a5aab0c56a2edf2e0483b87f5ab299dc046076203dea10ccbfc631d5bf4a87ce67004519f248f086346ce6a8a9d181789a59f81d9b7f6781daac3e229914b8b8998c15c3b6302a519331cb05995bc60b7cb872dd3b5b43331c77c5d72e21f7bd2b1a915ff3204e3f20d3a20b22d6a58155b5a4ebf6d1d1cd90c656ecada531c07ff91deb3efa91762cdecfbcc43553750f22ac5c18cc5e8b6f790c2f4e6373af9f98d10e6df49ff8e5cbcbd68e11ed0b967add11410dc2e34f08dbfaf8eb95d4d1153b4c6093192a340eb30fcc71619888c6486746a049585d249efb96b9cace83320b8f96b40ebe3a9a788d05a053380d1026b9434df87a3a387549bcabe88684c4d0948a6e219b5769480e6d0a9bf0da9a5212f3dbc8d1dff240856691243b203d7edd4d3cc89a38a6c80fdb1229a01044af7aaecb20d5570ebf24b30bbc6dfc3f70d85cd9f0d60ebd8fedd161d199d9997a0e2d18d1c99bc7158564e0ddb4673055de196535d706d142e1dc7d404583923cb1b286cfc5418884ac7e605d93652dc48ff8261c63790a91ee2c5ff9a21677b4bc7e73ddf2d0e46807c57bf64b0b9df7fc67ecba6521767dcc7d4299c740e73bc49cbcf0049faf222c48896378497c0a7be6238217f85c83a2c45376ddf1a8f631c22c8cf453e8a4fe7bf8160a82bd069be9a9e163724a7412bbc30b68bb31bd571f0571297726a309691408af62ecfc77ea52718c39e802f00a726aaa625407f3b18fd4f66db2bbd05dfd62e448fc6bb9fc51960e12b67c5d42e82df55f5d87428137874e27db5cc", 0x37d}, {0x0}, {&(0x7f0000002200)="f610e61ac81cc3edc86f0500", 0xc}], 0x3, 0x0, 0x0, 0x900}}], 0x1, 0x0) r0 = socket(0x10, 0x803, 0x0) sendto(r0, &(0x7f00000000c0)="120000001200e7ef007b00000000000000a1", 0x12, 0x0, 0x0, 0x0) recvmmsg(r0, &(0x7f00000037c0)=[{{&(0x7f00000004c0)=@ethernet={0x0, @random}, 0xfdf4, &(0x7f0000000380)=[{&(0x7f0000000000)=""/102, 0x365}, {&(0x7f0000000280)=""/76, 0x14c}, {&(0x7f0000000fc0)=""/4096, 0x197}, {&(0x7f0000000400)=""/92, 0x645}, {&(0x7f0000000980)=""/73, 0x1b}, {&(0x7f0000000200)=""/77, 0x188}, {&(0x7f00000007c0)=""/154, 0x2c}, {&(0x7f00000001c0)=""/17, 0x1d8}], 0x21, &(0x7f0000000600)=""/191, 0x41}}], 0x4000000000003b4, 0x0, &(0x7f0000003700)={0x77359400}) program crashed: UBSAN: array-index-out-of-bounds in dvb_usb_start_feed bisect: the chunk can be dropped bisect: testing without sub-chunk 2/2 bisect: no need to test this chunk, it's definitely needed bisect: split chunk #1 of len 7 into 2 parts bisect: testing without sub-chunk 1/2 testing program (duration=6m2s, {Threaded:true Repeat:true RepeatTimes:0 Procs:6 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): [12, 4, 7, 24, 3, 19, 4, 4] detailed listing: executing program 33: prlimit64(0x0, 0xe, &(0x7f0000000140)={0xa, 0x400000000008d}, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000080)=0x8) getpid() sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x2) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r0, &(0x7f0000000180)=@abs, 0x6e) sendmmsg$unix(r1, &(0x7f0000000000), 0x651, 0x0) recvmmsg(r0, &(0x7f00000000c0), 0x4000087, 0x2, 0x0) r2 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r2, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000000)=@updpolicy={0xb8, 0x13, 0xcb23c9c9931e99e9, 0x0, 0x0, {{@in=@private=0xa010101, @in=@remote, 0x0, 0x400, 0x1000, 0x0, 0x2, 0x20, 0x10, 0x84, 0x0, 0xffffffffffffffff}, {}, {0x0, 0x4000000000000, 0x0, 0xffffffffffffffff}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1}}, 0xb8}}, 0x80) sendmsg$nl_xfrm(r2, &(0x7f0000000480)={0x0, 0x0, &(0x7f0000000800)={&(0x7f0000000000)=ANY=[@ANYBLOB="650100001b"], 0x168}}, 0xc0) executing program 3: ioctl$VIDIOC_QUERYSTD(0xffffffffffffffff, 0x8008563f, &(0x7f0000000000)) r0 = syz_usb_connect(0x2, 0xb3, &(0x7f0000000640)=ANY=[@ANYBLOB="12010002ef0201406d0425080001000000010902a1000201008032080b00020e03000009040000000e0100000d240100012700006cdc0201011124020101020000000000000000020d000924030201010001"], &(0x7f0000000a40)={0x0, 0x0, 0x0, 0x0}) syz_usb_control_io$rtl8150(r0, 0x0, &(0x7f00000003c0)={0x2c, &(0x7f00000000c0)=ANY=[], 0x0, 0x0, 0x0, 0x0}) write(0xffffffffffffffff, &(0x7f0000000500)='transport=rdma,nqn=nqn.2014-08.org.n', 0x24) executing program 3: r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000000), 0x40241, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000200)={'syzkaller1\x00', 0xc201}) r1 = socket$kcm(0x2, 0xa, 0x2) ioctl$SIOCSIFHWADDR(r1, 0x8914, &(0x7f0000000180)={'syzkaller1\x00', @link_local={0x1, 0x80, 0xc2, 0x0, 0x0, 0xe}}) r2 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r2, &(0x7f0000000200)={0x0, 0x0, &(0x7f0000000000)={&(0x7f00000009c0)=ANY=[@ANYBLOB="140000001000010000000000000000000000000a20000000000a01020000000000000000010000000900010073797a300000000040000000160a01000900000000000000010000000900010073797a30000000000900020073797a3000000000140003800800014000000000080002400000000048000000160a0101000b000000000000010000000900020073797a30000000000900010073797a30000000001c0003801800"], 0xd0}, 0x1, 0x0, 0x0, 0x24040841}, 0x20048010) write$tun(r0, &(0x7f0000001280)=ANY=[@ANYBLOB="000086dd00001100"], 0xfce) executing program 0: socket$nl_route(0x10, 0x3, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000140)={0xa, 0x8b}, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000280)=0x8) r0 = getpid() sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x2) sched_setscheduler(r0, 0x2, &(0x7f0000000200)=0x7) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeea, 0x8031, 0xffffffffffffffff, 0x28f43000) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r1, &(0x7f0000000180)=@abs, 0x6e) sendmmsg$unix(r2, &(0x7f0000000000), 0x651, 0x0) recvmmsg(r1, &(0x7f00000000c0), 0x10106, 0x2, 0x0) mmap$IORING_OFF_SQ_RING(0x110c230000, 0x8000002, 0x2000007, 0x401d031, 0xffffffffffffffff, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./sys\x00', 0x1ff) mount(0x0, &(0x7f0000000040)='./sys\x00', &(0x7f0000000080)='sysfs\x00', 0x0, 0x0) r3 = openat(0xffffffffffffff9c, 0x0, 0x2, 0x0) write(r3, &(0x7f00000005c0)="306663353a313232373a3f7092c0f0bc085a193376cf620afaf6379a248d1d6534058f1095109da34b6d6537a6e78b0dc4b7bc0b", 0x34) r4 = socket$inet_tcp(0x2, 0x1, 0x0) ioctl$sock_SIOCGIFINDEX(r4, 0x8933, &(0x7f0000000180)={'syz_tun\x00'}) mkdirat(0xffffffffffffff9c, &(0x7f0000000080)='./file1\x00', 0x1c0) mkdirat(0xffffffffffffff9c, &(0x7f00000000c0)='./file0\x00', 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000240)='./file2\x00', 0x207) mount$overlay(0x0, &(0x7f0000000100)='./file0\x00', &(0x7f0000000000), 0x0, &(0x7f00000000c0)={[{@workdir={'workdir', 0x3d, './file0'}}, {@lowerdir={'lowerdir', 0x3d, '.'}}, {@upperdir={'upperdir', 0x3d, './file2'}}], [], 0x2c}) r5 = openat$dir(0xffffffffffffff9c, &(0x7f0000000000)='./file0/file1\x00', 0x20400, 0x20) fsync(r5) executing program 6: syz_usb_connect(0x0, 0x4b, &(0x7f0000000000)=ANY=[@ANYBLOB="1201000200000040480b051000010102000109023900020100803209040000000000000009"], 0x0) r0 = syz_open_dev$dvb_demux(&(0x7f0000000200), 0x1, 0x2) ioctl$DVB_DEMUX_DMX_SET_PES_FILTER(r0, 0x40146f2c, &(0x7f0000000100)={0x1ff, 0x0, 0x3, 0xa, 0x4}) executing program 0: socket$can_raw(0x1d, 0x3, 0x1) socket(0x18, 0x80000, 0x1) socket$key(0xf, 0x3, 0x2) syz_open_procfs$namespace(0x0, &(0x7f0000000280)='ns/ipc\x00') syz_open_procfs$namespace(0x0, &(0x7f0000000040)='ns/ipc\x00') socket$inet_udp(0x2, 0x2, 0x0) syz_open_dev$vim2m(&(0x7f0000000080), 0x7, 0x2) socket$inet_icmp_raw(0x2, 0x3, 0x1) bpf$PROG_LOAD(0x5, &(0x7f0000000000)={0x13, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x40, '\x00', 0x0, @fallback=0x2e, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0x1}, 0x94) socket$netlink(0x10, 0x3, 0x0) openat$rdma_cm(0xffffffffffffff9c, &(0x7f0000000180), 0x2, 0x0) socket$nl_xfrm(0x10, 0x3, 0x6) mkdirat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000)='./cgroup/syz0\x00', 0x1ff) openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000), 0x200002, 0x0) r0 = epoll_create1(0x0) socket$nl_route(0x10, 0x3, 0x0) r1 = socket$netlink(0x10, 0x3, 0x0) sendmsg$nl_route(0xffffffffffffffff, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000000080)=ANY=[@ANYBLOB="540000001000010400000000000000ffff000000", @ANYRES32=0x0, @ANYBLOB="0380000000000000240012800c0001006d6163766c616e00140002800800010008000000060002000100000008000500", @ANYRES32=r0, @ANYBLOB='\b\x00\n\x00', @ANYRES8=r1], 0x54}, 0x1, 0x0, 0x0, 0x4000085}, 0x0) sendmmsg(r1, &(0x7f00000002c0), 0x40000000000009f, 0x20) executing program 1: r0 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r0, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000001680)=ANY=[@ANYBLOB="140000001000010000000000000000000500000a28000000000a030000000000000000000a00000708000240000000020900010073797a31000000002c000000030a010100000000000000000a0000070900010073797a31000000000900030073797a320000000014"], 0x7c}, 0x1, 0x0, 0x0, 0x40001}, 0x4040850) sendmsg$NFT_BATCH(r0, &(0x7f0000009b40)={0x0, 0x0, &(0x7f0000009b00)={&(0x7f0000000240)=ANY=[@ANYBLOB="140000001000010000000000000000000500000a48000000030a0fdb00000000000000000a0000050900030073797a30000000000900010073797a310000000014000480080002403cb140bb0800014000000003080005400000000014000000110001"], 0x70}, 0x1, 0x0, 0x0, 0x4000850}, 0x24000840) sendmsg$NFT_BATCH(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000cc0)={&(0x7f00000002c0)={{0x14, 0x10, 0x1, 0x0, 0x0, {0x3}}, [@NFT_MSG_DELCHAIN={0x2c, 0x5, 0xa, 0x101, 0x0, 0x0, {0xa, 0x0, 0xa}, [@NFTA_CHAIN_TABLE={0x9, 0x1, 'syz1\x00'}, @NFTA_CHAIN_HANDLE={0xc, 0x2, 0x1, 0x0, 0x1}]}, @NFT_MSG_DELRULE={0x20, 0x8, 0xa, 0x101, 0x0, 0x0, {0xa, 0x0, 0x9}, [@NFTA_RULE_TABLE={0x9, 0x1, 'syz1\x00'}]}], {0x14}}, 0x74}, 0x1, 0x0, 0x0, 0xb0}, 0x20008890) executing program 1: sendmmsg$inet(0xffffffffffffffff, &(0x7f0000002140)=[{{0x0, 0x0, &(0x7f0000000540)=[{&(0x7f0000002280)="21ae1baf930b4569b9ddef9797ffd935c7d80e6466b3e4e62dd4603583f5d4b61fbc65b6ac744d7319535e75bf552062e4cfde1ba7ce29263322e18ea9740aa89f69c47a63133708cda00d2b1f4e799bd41e3f76258180fa91a42aaa8b1ebc4e0ea8fb12f2c71e6e5bc57a8e91f254005514721d93c13c5606ae1fea7f31f558d562bd5a8dfb0b9fed873efa221fccffa84fcd374c92e6cbb03e6a9de890ce323f000000abcc6c01326d588495b7c1a7db31ec4129e6336f26bb9e0b7552af3cd2d5dda1632799bbc98425c433384d8a8e4071ff39a36dfde5f05af35a4ddd340cfecd7ec935f4ce7d3e851583ba1cf53a90a7f7bce5703de57ce93ddef7849b30a01de0637e6d5e507b801d32e582e0c2d564539ebfc84c098a23e765552767b122885fb1629e9c180be47da7931bd125b80de1594b75e5371a81c2c32d0c4a028a5aab0c56a2edf2e0483b87f5ab299dc046076203dea10ccbfc631d5bf4a87ce67004519f248f086346ce6a8a9d181789a59f81d9b7f6781daac3e229914b8b8998c15c3b6302a519331cb05995bc60b7cb872dd3b5b43331c77c5d72e21f7bd2b1a915ff3204e3f20d3a20b22d6a58155b5a4ebf6d1d1cd90c656ecada531c07ff91deb3efa91762cdecfbcc43553750f22ac5c18cc5e8b6f790c2f4e6373af9f98d10e6df49ff8e5cbcbd68e11ed0b967add11410dc2e34f08dbfaf8eb95d4d1153b4c6093192a340eb30fcc71619888c6486746a049585d249efb96b9cace83320b8f96b40ebe3a9a788d05a053380d1026b9434df87a3a387549bcabe88684c4d0948a6e219b5769480e6d0a9bf0da9a5212f3dbc8d1dff240856691243b203d7edd4d3cc89a38a6c80fdb1229a01044af7aaecb20d5570ebf24b30bbc6dfc3f70d85cd9f0d60ebd8fedd161d199d9997a0e2d18d1c99bc7158564e0ddb4673055de196535d706d142e1dc7d404583923cb1b286cfc5418884ac7e605d93652dc48ff8261c63790a91ee2c5ff9a21677b4bc7e73ddf2d0e46807c57bf64b0b9df7fc67ecba6521767dcc7d4299c740e73bc49cbcf0049faf222c48896378497c0a7be6238217f85c83a2c45376ddf1a8f631c22c8cf453e8a4fe7bf8160a82bd069be9a9e163724a7412bbc30b68bb31bd571f0571297726a309691408af62ecfc77ea52718c39e802f00a726aaa625407f3b18fd4f66db2bbd05dfd62e448fc6bb9fc51960e12b67c5d42e82df55f5d87428137874e27db5cc", 0x37d}, {0x0}, {&(0x7f0000002200)="f610e61ac81cc3edc86f0500", 0xc}], 0x3, 0x0, 0x0, 0x900}}], 0x1, 0x0) r0 = socket(0x10, 0x803, 0x0) sendto(r0, &(0x7f00000000c0)="120000001200e7ef007b00000000000000a1", 0x12, 0x0, 0x0, 0x0) recvmmsg(r0, &(0x7f00000037c0)=[{{&(0x7f00000004c0)=@ethernet={0x0, @random}, 0xfdf4, &(0x7f0000000380)=[{&(0x7f0000000000)=""/102, 0x365}, {&(0x7f0000000280)=""/76, 0x14c}, {&(0x7f0000000fc0)=""/4096, 0x197}, {&(0x7f0000000400)=""/92, 0x645}, {&(0x7f0000000980)=""/73, 0x1b}, {&(0x7f0000000200)=""/77, 0x188}, {&(0x7f00000007c0)=""/154, 0x2c}, {&(0x7f00000001c0)=""/17, 0x1d8}], 0x21, &(0x7f0000000600)=""/191, 0x41}}], 0x4000000000003b4, 0x0, &(0x7f0000003700)={0x77359400}) program did not crash bisect: testing without sub-chunk 2/2 testing program (duration=6m2s, {Threaded:true Repeat:true RepeatTimes:0 Procs:6 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): [12, 4, 7, 24, 5, 30, 7, 3, 4] detailed listing: executing program 33: prlimit64(0x0, 0xe, &(0x7f0000000140)={0xa, 0x400000000008d}, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000080)=0x8) getpid() sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x2) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r0, &(0x7f0000000180)=@abs, 0x6e) sendmmsg$unix(r1, &(0x7f0000000000), 0x651, 0x0) recvmmsg(r0, &(0x7f00000000c0), 0x4000087, 0x2, 0x0) r2 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r2, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000000)=@updpolicy={0xb8, 0x13, 0xcb23c9c9931e99e9, 0x0, 0x0, {{@in=@private=0xa010101, @in=@remote, 0x0, 0x400, 0x1000, 0x0, 0x2, 0x20, 0x10, 0x84, 0x0, 0xffffffffffffffff}, {}, {0x0, 0x4000000000000, 0x0, 0xffffffffffffffff}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1}}, 0xb8}}, 0x80) sendmsg$nl_xfrm(r2, &(0x7f0000000480)={0x0, 0x0, &(0x7f0000000800)={&(0x7f0000000000)=ANY=[@ANYBLOB="650100001b"], 0x168}}, 0xc0) executing program 3: ioctl$VIDIOC_QUERYSTD(0xffffffffffffffff, 0x8008563f, &(0x7f0000000000)) r0 = syz_usb_connect(0x2, 0xb3, &(0x7f0000000640)=ANY=[@ANYBLOB="12010002ef0201406d0425080001000000010902a1000201008032080b00020e03000009040000000e0100000d240100012700006cdc0201011124020101020000000000000000020d000924030201010001"], &(0x7f0000000a40)={0x0, 0x0, 0x0, 0x0}) syz_usb_control_io$rtl8150(r0, 0x0, &(0x7f00000003c0)={0x2c, &(0x7f00000000c0)=ANY=[], 0x0, 0x0, 0x0, 0x0}) write(0xffffffffffffffff, &(0x7f0000000500)='transport=rdma,nqn=nqn.2014-08.org.n', 0x24) executing program 3: r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000000), 0x40241, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000200)={'syzkaller1\x00', 0xc201}) r1 = socket$kcm(0x2, 0xa, 0x2) ioctl$SIOCSIFHWADDR(r1, 0x8914, &(0x7f0000000180)={'syzkaller1\x00', @link_local={0x1, 0x80, 0xc2, 0x0, 0x0, 0xe}}) r2 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r2, &(0x7f0000000200)={0x0, 0x0, &(0x7f0000000000)={&(0x7f00000009c0)=ANY=[@ANYBLOB="140000001000010000000000000000000000000a20000000000a01020000000000000000010000000900010073797a300000000040000000160a01000900000000000000010000000900010073797a30000000000900020073797a3000000000140003800800014000000000080002400000000048000000160a0101000b000000000000010000000900020073797a30000000000900010073797a30000000001c0003801800"], 0xd0}, 0x1, 0x0, 0x0, 0x24040841}, 0x20048010) write$tun(r0, &(0x7f0000001280)=ANY=[@ANYBLOB="000086dd00001100"], 0xfce) executing program 0: socket$nl_route(0x10, 0x3, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000140)={0xa, 0x8b}, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000280)=0x8) r0 = getpid() sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x2) sched_setscheduler(r0, 0x2, &(0x7f0000000200)=0x7) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeea, 0x8031, 0xffffffffffffffff, 0x28f43000) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r1, &(0x7f0000000180)=@abs, 0x6e) sendmmsg$unix(r2, &(0x7f0000000000), 0x651, 0x0) recvmmsg(r1, &(0x7f00000000c0), 0x10106, 0x2, 0x0) mmap$IORING_OFF_SQ_RING(0x110c230000, 0x8000002, 0x2000007, 0x401d031, 0xffffffffffffffff, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./sys\x00', 0x1ff) mount(0x0, &(0x7f0000000040)='./sys\x00', &(0x7f0000000080)='sysfs\x00', 0x0, 0x0) r3 = openat(0xffffffffffffff9c, 0x0, 0x2, 0x0) write(r3, &(0x7f00000005c0)="306663353a313232373a3f7092c0f0bc085a193376cf620afaf6379a248d1d6534058f1095109da34b6d6537a6e78b0dc4b7bc0b", 0x34) r4 = socket$inet_tcp(0x2, 0x1, 0x0) ioctl$sock_SIOCGIFINDEX(r4, 0x8933, &(0x7f0000000180)={'syz_tun\x00'}) mkdirat(0xffffffffffffff9c, &(0x7f0000000080)='./file1\x00', 0x1c0) mkdirat(0xffffffffffffff9c, &(0x7f00000000c0)='./file0\x00', 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000240)='./file2\x00', 0x207) mount$overlay(0x0, &(0x7f0000000100)='./file0\x00', &(0x7f0000000000), 0x0, &(0x7f00000000c0)={[{@workdir={'workdir', 0x3d, './file0'}}, {@lowerdir={'lowerdir', 0x3d, '.'}}, {@upperdir={'upperdir', 0x3d, './file2'}}], [], 0x2c}) r5 = openat$dir(0xffffffffffffff9c, &(0x7f0000000000)='./file0/file1\x00', 0x20400, 0x20) fsync(r5) executing program 7: r0 = syz_open_dev$vim2m(&(0x7f0000000100), 0x0, 0x2) ioctl$vim2m_VIDIOC_STREAMOFF(r0, 0x40045612, &(0x7f0000000040)=0x1) ioctl$vim2m_VIDIOC_QBUF(r0, 0xc058560f, &(0x7f0000000180)=@mmap={0x1, 0x1, 0x4, 0x100, 0x81, {}, {0x4, 0x8, 0x8, 0x5, 0x29, 0x9, "0adb3fb8"}, 0x3}) write$uinput_user_dev(0xffffffffffffffff, &(0x7f0000000400)={'syz0\x00', {0x3, 0x2, 0x6, 0xfffa}, 0x3a, [0x8001, 0xc95a, 0xf, 0x8, 0x80, 0x2, 0x7, 0x7f, 0xa9, 0x4d, 0x6, 0x5f, 0x9, 0x15, 0xffff2d37, 0xff7fff01, 0x6, 0x5, 0x7, 0x5, 0x4, 0x0, 0x7, 0x3c5b, 0x1, 0x20, 0xd, 0x1, 0x0, 0xffffffff, 0xe661, 0x6, 0x7, 0x5, 0x8, 0x4c74, 0xffff7fff, 0x7, 0x3, 0xe, 0x0, 0x80008071, 0x7, 0x17, 0xffffffff, 0x7, 0x5, 0x80003e, 0x18e, 0x6, 0x6, 0x0, 0x8, 0x4, 0x8, 0x3ff, 0x80, 0x0, 0x5, 0x6, 0x8, 0x7, 0x1, 0x40], [0x10000007, 0x9, 0x8000012f, 0x8004, 0x5, 0xfffffff3, 0x129432f6, 0xc8, 0xf1, 0xe, 0x2bf, 0x6c7, 0x2009, 0xfffffffc, 0x573a, 0x0, 0x0, 0x5, 0x2f, 0x8, 0x312, 0x66abcbd2, 0xea4, 0x0, 0x4, 0x1007, 0x7fff, 0x6, 0x400, 0x401, 0x6, 0x1, 0xff, 0x7, 0x1000005, 0x5f31, 0xd, 0x4e0, 0x381, 0x4, 0xb, 0x4, 0x9, 0x8, 0x40, 0x6, 0x47, 0x8000, 0x1, 0xfe000000, 0xffff, 0x2, 0x4, 0x200009, 0x3, 0x3, 0x4000009, 0x6, 0x0, 0x3, 0xbc45, 0x48c93690, 0x42, 0x3], [0x6, 0x40a, 0x3ff, 0x5, 0xfffffffd, 0x100, 0x5, 0x9, 0x5, 0x7fff, 0x0, 0x5, 0xb, 0x4, 0x5, 0x5, 0x0, 0x1ef, 0x3, 0x8, 0x86, 0x1000515, 0x303c, 0x3e7, 0xb, 0x5, 0x2, 0x2, 0x3, 0x20000008, 0x4, 0x6cff, 0x6, 0x20000038, 0x200, 0x1fd, 0x80, 0x7, 0x4, 0x2950bfaf, 0x1000, 0xa2, 0x7, 0xcc, 0x5, 0x6, 0xac8, 0xbf, 0x2, 0x3, 0x7ff, 0x12b, 0x4, 0x1, 0xa, 0xffffffff, 0x5, 0x1c, 0x120000, 0x7ef, 0x2006, 0x80a2cd, 0x4, 0x25], [0xc, 0xbb33, 0x7, 0xb, 0x5, 0x938, 0x6, 0x6, 0x0, 0xb9, 0xce4, 0x1ff, 0x2, 0x57, 0x5, 0x3, 0x2, 0x10000, 0x4, 0x7fff, 0xfff4, 0xa620, 0x1, 0x5, 0x801, 0x2000002, 0x150, 0x60a7, 0x6, 0x16, 0xffffffff, 0x8, 0x4, 0x5, 0xca, 0x1, 0xfffff000, 0x10000, 0xf, 0x7e, 0x9, 0x9622, 0x7, 0xaf, 0x20000008, 0x5, 0x226, 0x2, 0x5, 0x0, 0x30b1d693, 0xa1f, 0xf40, 0x7, 0x530e, 0xe1c4, 0x0, 0x0, 0x5, 0x7ff, 0xd7, 0x200, 0xb, 0xfff]}, 0x45c) ppoll(&(0x7f00000000c0)=[{}, {}], 0x20000000000000dc, 0x0, 0x0, 0x0) executing program 7: bpf$MAP_CREATE(0x0, &(0x7f0000000080)=ANY=[], 0x50) bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x0, 0xc, 0x0, 0x0, 0xfffffffd, 0x0, 0x0, 0x0, 0x40, '\x00', 0x0, @fallback=0x10, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) socket(0x10, 0x803, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x1, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000380)={0xa, 0x100008b}, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000200)=0x8) openat$sequencer(0xffffffffffffff9c, &(0x7f00000001c0), 0x80200, 0x0) r0 = syz_open_dev$sndmidi(&(0x7f00000004c0), 0x2, 0x141102) writev(r0, &(0x7f0000000840)=[{&(0x7f00000002c0)="94", 0xf000}, {0x0}], 0x2) ioctl$sock_SIOCGIFINDEX(0xffffffffffffffff, 0x8933, 0x0) r1 = socket$kcm(0xa, 0x3, 0x3a) r2 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r2, &(0x7f0000000480)={0x0, 0x0, &(0x7f0000001f40)={&(0x7f00000004c0)=ANY=[@ANYBLOB="fc000000190001002dbd700000000000ac1e0001000000000000000000000000ac1414aa00"/48, @ANYRES32=0x0, @ANYRES32, @ANYBLOB="00000000000000000c00000000000000000000000000000000000000000000000000000000000000ffffffffffffffff000000000000000000000000000000000000000000000000000a000000000000feffffffff7f40000200000000000008ffffffff00000000010006000000000044000500ac1414bb000000000000000000000000000000003c0000000200000000000000000000000000000000000001060000"], 0xfc}, 0x1, 0x0, 0x0, 0x4008000}, 0x600c010) sendmsg$kcm(r1, &(0x7f0000000080)={&(0x7f0000000000)=@l2tp6={0xa, 0x0, 0x0, @loopback={0xfe80000000000000, 0xac14140c}}, 0x80, &(0x7f00000000c0)=[{&(0x7f0000000140)='\x00\x00', 0xffe3}], 0x1, 0x0, 0x0, 0x900}, 0x60) setsockopt$IPT_SO_SET_REPLACE(0xffffffffffffffff, 0x0, 0x40, 0x0, 0x0) syz_usb_connect(0x3, 0x57, &(0x7f0000000000)=ANY=[@ANYBLOB="1201000200000040402001c60100000000010902450001010080fa0904"], 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000340)='./file1\x00', 0x0) mkdirat(0xffffffffffffff9c, &(0x7f00000000c0)='./bus\x00', 0x1d7) mkdirat(0xffffffffffffff9c, &(0x7f0000000400)='./file1/file0\x00', 0x100) mount$bind(&(0x7f0000000100)='.\x00', &(0x7f0000000080)='./file1/file0\x00', 0x0, 0x1085408, 0x0) r3 = openat$sw_sync(0xffffffffffffff9c, &(0x7f0000000ac0), 0x800, 0x0) ioctl$SW_SYNC_IOC_CREATE_FENCE(r3, 0xc0285700, &(0x7f0000000b00)={0x4, "abacd211119ca94c63377526aeb5ab2c7b9ca5fa07558139ede6dc06270ee042", 0xffffffffffffffff}) ioctl$SYNC_IOC_MERGE(r4, 0xc0303e03, &(0x7f0000000780)={"d1ed39d88b014076ab94c1fb10628c46d2e66ccdb9e581a38ebb0ddd5f307e56", 0xffffffffffffffff, 0xffffffffffffffff}) ioctl$SYNC_IOC_FILE_INFO(r5, 0xc0383e04, 0x0) mount$overlay(0x0, &(0x7f00000000c0)='./bus\x00', &(0x7f00000003c0), 0x40, &(0x7f0000000300)={[{@workdir={'workdir', 0x3d, './bus'}}, {@upperdir={'upperdir', 0x3d, './file1'}}]}) bpf$PROG_LOAD(0x5, 0x0, 0x0) r6 = syz_usb_connect$hid(0x1, 0x36, &(0x7f0000000040)=ANY=[@ANYBLOB="12010000090024206d041cc340000000000109022400010000a00009040000010301010009"], 0x0) r7 = syz_open_procfs(0xffffffffffffffff, &(0x7f0000000080)='stat\x00') read$FUSE(r7, &(0x7f0000004180)={0x2020}, 0x2020) syz_usb_control_io$hid(r6, &(0x7f0000000240)={0x24, &(0x7f00000003c0)=ANY=[@ANYBLOB="00000c000000070001"], 0x0, 0x0, 0x0}, 0x0) executing program 6: r0 = socket$packet(0x11, 0x2, 0x300) setsockopt$SO_ATTACH_FILTER(r0, 0x1, 0x1a, &(0x7f0000000100)={0x2, &(0x7f0000000040)=[{0x0, 0x0, 0xfd, 0xc8e}, {0x16, 0xff, 0x6, 0x6}]}, 0x10) setsockopt$packet_fanout(r0, 0x107, 0x12, 0x0, 0x0) r1 = socket$inet_udp(0x2, 0x2, 0x0) bind$inet(r1, &(0x7f0000000140)={0x2, 0x80, @dev={0xac, 0x14, 0x14, 0xf}}, 0x10) sendmmsg$inet(r1, &(0x7f0000000c00)=[{{&(0x7f0000010940)={0x2, 0x4e22, @multicast2}, 0x10, 0x0}}], 0x1, 0x2000c044) sendto$inet(r1, &(0x7f0000000c80)="e8", 0x6200, 0x0, 0x0, 0x0) executing program 6: syz_usb_connect(0x0, 0x4b, &(0x7f0000000000)=ANY=[@ANYBLOB="1201000200000040480b051000010102000109023900020100803209040000000000000009"], 0x0) r0 = syz_open_dev$dvb_demux(&(0x7f0000000200), 0x1, 0x2) ioctl$DVB_DEMUX_DMX_SET_PES_FILTER(r0, 0x40146f2c, &(0x7f0000000100)={0x1ff, 0x0, 0x3, 0xa, 0x4}) executing program 3: ioctl$VIDIOC_QUERYSTD(0xffffffffffffffff, 0x8008563f, &(0x7f0000000000)) r0 = syz_usb_connect(0x2, 0xb3, &(0x7f0000000640)=ANY=[@ANYBLOB="12010002ef0201406d0425080001000000010902a1000201008032080b00020e03000009040000000e0100000d240100012700006cdc0201011124020101020000000000000000020d000924030201010001"], &(0x7f0000000a40)={0x0, 0x0, 0x0, 0x0}) syz_usb_control_io$rtl8150(r0, 0x0, &(0x7f00000003c0)={0x2c, &(0x7f00000000c0)=ANY=[], 0x0, 0x0, 0x0, 0x0}) write(0xffffffffffffffff, &(0x7f0000000500)='transport=rdma,nqn=nqn.2014-08.org.nvmexpress:NVMf:uui', 0x36) program crashed: UBSAN: array-index-out-of-bounds in dvb_usb_start_feed bisect: the chunk can be dropped bisect: split chunks (needed=true): <4>, <4> bisect: split chunk #0 of len 4 into 2 parts bisect: testing without sub-chunk 1/2 testing program (duration=6m1s, {Threaded:true Repeat:true RepeatTimes:0 Procs:6 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): [7, 24, 5, 30, 7, 3, 4] detailed listing: executing program 3: r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000000), 0x40241, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000200)={'syzkaller1\x00', 0xc201}) r1 = socket$kcm(0x2, 0xa, 0x2) ioctl$SIOCSIFHWADDR(r1, 0x8914, &(0x7f0000000180)={'syzkaller1\x00', @link_local={0x1, 0x80, 0xc2, 0x0, 0x0, 0xe}}) r2 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r2, &(0x7f0000000200)={0x0, 0x0, &(0x7f0000000000)={&(0x7f00000009c0)=ANY=[@ANYBLOB="140000001000010000000000000000000000000a20000000000a01020000000000000000010000000900010073797a300000000040000000160a01000900000000000000010000000900010073797a30000000000900020073797a3000000000140003800800014000000000080002400000000048000000160a0101000b000000000000010000000900020073797a30000000000900010073797a30000000001c0003801800"], 0xd0}, 0x1, 0x0, 0x0, 0x24040841}, 0x20048010) write$tun(r0, &(0x7f0000001280)=ANY=[@ANYBLOB="000086dd00001100"], 0xfce) executing program 0: socket$nl_route(0x10, 0x3, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000140)={0xa, 0x8b}, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000280)=0x8) r0 = getpid() sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x2) sched_setscheduler(r0, 0x2, &(0x7f0000000200)=0x7) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeea, 0x8031, 0xffffffffffffffff, 0x28f43000) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r1, &(0x7f0000000180)=@abs, 0x6e) sendmmsg$unix(r2, &(0x7f0000000000), 0x651, 0x0) recvmmsg(r1, &(0x7f00000000c0), 0x10106, 0x2, 0x0) mmap$IORING_OFF_SQ_RING(0x110c230000, 0x8000002, 0x2000007, 0x401d031, 0xffffffffffffffff, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./sys\x00', 0x1ff) mount(0x0, &(0x7f0000000040)='./sys\x00', &(0x7f0000000080)='sysfs\x00', 0x0, 0x0) r3 = openat(0xffffffffffffff9c, 0x0, 0x2, 0x0) write(r3, &(0x7f00000005c0)="306663353a313232373a3f7092c0f0bc085a193376cf620afaf6379a248d1d6534058f1095109da34b6d6537a6e78b0dc4b7bc0b", 0x34) r4 = socket$inet_tcp(0x2, 0x1, 0x0) ioctl$sock_SIOCGIFINDEX(r4, 0x8933, &(0x7f0000000180)={'syz_tun\x00'}) mkdirat(0xffffffffffffff9c, &(0x7f0000000080)='./file1\x00', 0x1c0) mkdirat(0xffffffffffffff9c, &(0x7f00000000c0)='./file0\x00', 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000240)='./file2\x00', 0x207) mount$overlay(0x0, &(0x7f0000000100)='./file0\x00', &(0x7f0000000000), 0x0, &(0x7f00000000c0)={[{@workdir={'workdir', 0x3d, './file0'}}, {@lowerdir={'lowerdir', 0x3d, '.'}}, {@upperdir={'upperdir', 0x3d, './file2'}}], [], 0x2c}) r5 = openat$dir(0xffffffffffffff9c, &(0x7f0000000000)='./file0/file1\x00', 0x20400, 0x20) fsync(r5) executing program 7: r0 = syz_open_dev$vim2m(&(0x7f0000000100), 0x0, 0x2) ioctl$vim2m_VIDIOC_STREAMOFF(r0, 0x40045612, &(0x7f0000000040)=0x1) ioctl$vim2m_VIDIOC_QBUF(r0, 0xc058560f, &(0x7f0000000180)=@mmap={0x1, 0x1, 0x4, 0x100, 0x81, {}, {0x4, 0x8, 0x8, 0x5, 0x29, 0x9, "0adb3fb8"}, 0x3}) write$uinput_user_dev(0xffffffffffffffff, &(0x7f0000000400)={'syz0\x00', {0x3, 0x2, 0x6, 0xfffa}, 0x3a, [0x8001, 0xc95a, 0xf, 0x8, 0x80, 0x2, 0x7, 0x7f, 0xa9, 0x4d, 0x6, 0x5f, 0x9, 0x15, 0xffff2d37, 0xff7fff01, 0x6, 0x5, 0x7, 0x5, 0x4, 0x0, 0x7, 0x3c5b, 0x1, 0x20, 0xd, 0x1, 0x0, 0xffffffff, 0xe661, 0x6, 0x7, 0x5, 0x8, 0x4c74, 0xffff7fff, 0x7, 0x3, 0xe, 0x0, 0x80008071, 0x7, 0x17, 0xffffffff, 0x7, 0x5, 0x80003e, 0x18e, 0x6, 0x6, 0x0, 0x8, 0x4, 0x8, 0x3ff, 0x80, 0x0, 0x5, 0x6, 0x8, 0x7, 0x1, 0x40], [0x10000007, 0x9, 0x8000012f, 0x8004, 0x5, 0xfffffff3, 0x129432f6, 0xc8, 0xf1, 0xe, 0x2bf, 0x6c7, 0x2009, 0xfffffffc, 0x573a, 0x0, 0x0, 0x5, 0x2f, 0x8, 0x312, 0x66abcbd2, 0xea4, 0x0, 0x4, 0x1007, 0x7fff, 0x6, 0x400, 0x401, 0x6, 0x1, 0xff, 0x7, 0x1000005, 0x5f31, 0xd, 0x4e0, 0x381, 0x4, 0xb, 0x4, 0x9, 0x8, 0x40, 0x6, 0x47, 0x8000, 0x1, 0xfe000000, 0xffff, 0x2, 0x4, 0x200009, 0x3, 0x3, 0x4000009, 0x6, 0x0, 0x3, 0xbc45, 0x48c93690, 0x42, 0x3], [0x6, 0x40a, 0x3ff, 0x5, 0xfffffffd, 0x100, 0x5, 0x9, 0x5, 0x7fff, 0x0, 0x5, 0xb, 0x4, 0x5, 0x5, 0x0, 0x1ef, 0x3, 0x8, 0x86, 0x1000515, 0x303c, 0x3e7, 0xb, 0x5, 0x2, 0x2, 0x3, 0x20000008, 0x4, 0x6cff, 0x6, 0x20000038, 0x200, 0x1fd, 0x80, 0x7, 0x4, 0x2950bfaf, 0x1000, 0xa2, 0x7, 0xcc, 0x5, 0x6, 0xac8, 0xbf, 0x2, 0x3, 0x7ff, 0x12b, 0x4, 0x1, 0xa, 0xffffffff, 0x5, 0x1c, 0x120000, 0x7ef, 0x2006, 0x80a2cd, 0x4, 0x25], [0xc, 0xbb33, 0x7, 0xb, 0x5, 0x938, 0x6, 0x6, 0x0, 0xb9, 0xce4, 0x1ff, 0x2, 0x57, 0x5, 0x3, 0x2, 0x10000, 0x4, 0x7fff, 0xfff4, 0xa620, 0x1, 0x5, 0x801, 0x2000002, 0x150, 0x60a7, 0x6, 0x16, 0xffffffff, 0x8, 0x4, 0x5, 0xca, 0x1, 0xfffff000, 0x10000, 0xf, 0x7e, 0x9, 0x9622, 0x7, 0xaf, 0x20000008, 0x5, 0x226, 0x2, 0x5, 0x0, 0x30b1d693, 0xa1f, 0xf40, 0x7, 0x530e, 0xe1c4, 0x0, 0x0, 0x5, 0x7ff, 0xd7, 0x200, 0xb, 0xfff]}, 0x45c) ppoll(&(0x7f00000000c0)=[{}, {}], 0x20000000000000dc, 0x0, 0x0, 0x0) executing program 7: bpf$MAP_CREATE(0x0, &(0x7f0000000080)=ANY=[], 0x50) bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x0, 0xc, 0x0, 0x0, 0xfffffffd, 0x0, 0x0, 0x0, 0x40, '\x00', 0x0, @fallback=0x10, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) socket(0x10, 0x803, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x1, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000380)={0xa, 0x100008b}, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000200)=0x8) openat$sequencer(0xffffffffffffff9c, &(0x7f00000001c0), 0x80200, 0x0) r0 = syz_open_dev$sndmidi(&(0x7f00000004c0), 0x2, 0x141102) writev(r0, &(0x7f0000000840)=[{&(0x7f00000002c0)="94", 0xf000}, {0x0}], 0x2) ioctl$sock_SIOCGIFINDEX(0xffffffffffffffff, 0x8933, 0x0) r1 = socket$kcm(0xa, 0x3, 0x3a) r2 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r2, &(0x7f0000000480)={0x0, 0x0, &(0x7f0000001f40)={&(0x7f00000004c0)=ANY=[@ANYBLOB="fc000000190001002dbd700000000000ac1e0001000000000000000000000000ac1414aa00"/48, @ANYRES32=0x0, @ANYRES32, @ANYBLOB="00000000000000000c00000000000000000000000000000000000000000000000000000000000000ffffffffffffffff000000000000000000000000000000000000000000000000000a000000000000feffffffff7f40000200000000000008ffffffff00000000010006000000000044000500ac1414bb000000000000000000000000000000003c0000000200000000000000000000000000000000000001060000"], 0xfc}, 0x1, 0x0, 0x0, 0x4008000}, 0x600c010) sendmsg$kcm(r1, &(0x7f0000000080)={&(0x7f0000000000)=@l2tp6={0xa, 0x0, 0x0, @loopback={0xfe80000000000000, 0xac14140c}}, 0x80, &(0x7f00000000c0)=[{&(0x7f0000000140)='\x00\x00', 0xffe3}], 0x1, 0x0, 0x0, 0x900}, 0x60) setsockopt$IPT_SO_SET_REPLACE(0xffffffffffffffff, 0x0, 0x40, 0x0, 0x0) syz_usb_connect(0x3, 0x57, &(0x7f0000000000)=ANY=[@ANYBLOB="1201000200000040402001c60100000000010902450001010080fa0904"], 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000340)='./file1\x00', 0x0) mkdirat(0xffffffffffffff9c, &(0x7f00000000c0)='./bus\x00', 0x1d7) mkdirat(0xffffffffffffff9c, &(0x7f0000000400)='./file1/file0\x00', 0x100) mount$bind(&(0x7f0000000100)='.\x00', &(0x7f0000000080)='./file1/file0\x00', 0x0, 0x1085408, 0x0) r3 = openat$sw_sync(0xffffffffffffff9c, &(0x7f0000000ac0), 0x800, 0x0) ioctl$SW_SYNC_IOC_CREATE_FENCE(r3, 0xc0285700, &(0x7f0000000b00)={0x4, "abacd211119ca94c63377526aeb5ab2c7b9ca5fa07558139ede6dc06270ee042", 0xffffffffffffffff}) ioctl$SYNC_IOC_MERGE(r4, 0xc0303e03, &(0x7f0000000780)={"d1ed39d88b014076ab94c1fb10628c46d2e66ccdb9e581a38ebb0ddd5f307e56", 0xffffffffffffffff, 0xffffffffffffffff}) ioctl$SYNC_IOC_FILE_INFO(r5, 0xc0383e04, 0x0) mount$overlay(0x0, &(0x7f00000000c0)='./bus\x00', &(0x7f00000003c0), 0x40, &(0x7f0000000300)={[{@workdir={'workdir', 0x3d, './bus'}}, {@upperdir={'upperdir', 0x3d, './file1'}}]}) bpf$PROG_LOAD(0x5, 0x0, 0x0) r6 = syz_usb_connect$hid(0x1, 0x36, &(0x7f0000000040)=ANY=[@ANYBLOB="12010000090024206d041cc340000000000109022400010000a00009040000010301010009"], 0x0) r7 = syz_open_procfs(0xffffffffffffffff, &(0x7f0000000080)='stat\x00') read$FUSE(r7, &(0x7f0000004180)={0x2020}, 0x2020) syz_usb_control_io$hid(r6, &(0x7f0000000240)={0x24, &(0x7f00000003c0)=ANY=[@ANYBLOB="00000c000000070001"], 0x0, 0x0, 0x0}, 0x0) executing program 6: r0 = socket$packet(0x11, 0x2, 0x300) setsockopt$SO_ATTACH_FILTER(r0, 0x1, 0x1a, &(0x7f0000000100)={0x2, &(0x7f0000000040)=[{0x0, 0x0, 0xfd, 0xc8e}, {0x16, 0xff, 0x6, 0x6}]}, 0x10) setsockopt$packet_fanout(r0, 0x107, 0x12, 0x0, 0x0) r1 = socket$inet_udp(0x2, 0x2, 0x0) bind$inet(r1, &(0x7f0000000140)={0x2, 0x80, @dev={0xac, 0x14, 0x14, 0xf}}, 0x10) sendmmsg$inet(r1, &(0x7f0000000c00)=[{{&(0x7f0000010940)={0x2, 0x4e22, @multicast2}, 0x10, 0x0}}], 0x1, 0x2000c044) sendto$inet(r1, &(0x7f0000000c80)="e8", 0x6200, 0x0, 0x0, 0x0) executing program 6: syz_usb_connect(0x0, 0x4b, &(0x7f0000000000)=ANY=[@ANYBLOB="1201000200000040480b051000010102000109023900020100803209040000000000000009"], 0x0) r0 = syz_open_dev$dvb_demux(&(0x7f0000000200), 0x1, 0x2) ioctl$DVB_DEMUX_DMX_SET_PES_FILTER(r0, 0x40146f2c, &(0x7f0000000100)={0x1ff, 0x0, 0x3, 0xa, 0x4}) executing program 3: ioctl$VIDIOC_QUERYSTD(0xffffffffffffffff, 0x8008563f, &(0x7f0000000000)) r0 = syz_usb_connect(0x2, 0xb3, &(0x7f0000000640)=ANY=[@ANYBLOB="12010002ef0201406d0425080001000000010902a1000201008032080b00020e03000009040000000e0100000d240100012700006cdc0201011124020101020000000000000000020d000924030201010001"], &(0x7f0000000a40)={0x0, 0x0, 0x0, 0x0}) syz_usb_control_io$rtl8150(r0, 0x0, &(0x7f00000003c0)={0x2c, &(0x7f00000000c0)=ANY=[], 0x0, 0x0, 0x0, 0x0}) write(0xffffffffffffffff, &(0x7f0000000500)='transport=rdma,nqn=nqn.2014-08.org.nvmexpress:NVMf:uui', 0x36) program crashed: general protection fault in mxl111sf_ep6_streaming_ctrl bisect: the chunk can be dropped bisect: testing without sub-chunk 2/2 bisect: no need to test this chunk, it's definitely needed bisect: split chunk #1 of len 4 into 2 parts bisect: testing without sub-chunk 1/2 testing program (duration=6m1s, {Threaded:true Repeat:true RepeatTimes:0 Procs:6 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): [7, 24, 7, 3, 4] detailed listing: executing program 3: r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000000), 0x40241, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000200)={'syzkaller1\x00', 0xc201}) r1 = socket$kcm(0x2, 0xa, 0x2) ioctl$SIOCSIFHWADDR(r1, 0x8914, &(0x7f0000000180)={'syzkaller1\x00', @link_local={0x1, 0x80, 0xc2, 0x0, 0x0, 0xe}}) r2 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r2, &(0x7f0000000200)={0x0, 0x0, &(0x7f0000000000)={&(0x7f00000009c0)=ANY=[@ANYBLOB="140000001000010000000000000000000000000a20000000000a01020000000000000000010000000900010073797a300000000040000000160a01000900000000000000010000000900010073797a30000000000900020073797a3000000000140003800800014000000000080002400000000048000000160a0101000b000000000000010000000900020073797a30000000000900010073797a30000000001c0003801800"], 0xd0}, 0x1, 0x0, 0x0, 0x24040841}, 0x20048010) write$tun(r0, &(0x7f0000001280)=ANY=[@ANYBLOB="000086dd00001100"], 0xfce) executing program 0: socket$nl_route(0x10, 0x3, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000140)={0xa, 0x8b}, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000280)=0x8) r0 = getpid() sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x2) sched_setscheduler(r0, 0x2, &(0x7f0000000200)=0x7) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeea, 0x8031, 0xffffffffffffffff, 0x28f43000) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r1, &(0x7f0000000180)=@abs, 0x6e) sendmmsg$unix(r2, &(0x7f0000000000), 0x651, 0x0) recvmmsg(r1, &(0x7f00000000c0), 0x10106, 0x2, 0x0) mmap$IORING_OFF_SQ_RING(0x110c230000, 0x8000002, 0x2000007, 0x401d031, 0xffffffffffffffff, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./sys\x00', 0x1ff) mount(0x0, &(0x7f0000000040)='./sys\x00', &(0x7f0000000080)='sysfs\x00', 0x0, 0x0) r3 = openat(0xffffffffffffff9c, 0x0, 0x2, 0x0) write(r3, &(0x7f00000005c0)="306663353a313232373a3f7092c0f0bc085a193376cf620afaf6379a248d1d6534058f1095109da34b6d6537a6e78b0dc4b7bc0b", 0x34) r4 = socket$inet_tcp(0x2, 0x1, 0x0) ioctl$sock_SIOCGIFINDEX(r4, 0x8933, &(0x7f0000000180)={'syz_tun\x00'}) mkdirat(0xffffffffffffff9c, &(0x7f0000000080)='./file1\x00', 0x1c0) mkdirat(0xffffffffffffff9c, &(0x7f00000000c0)='./file0\x00', 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000240)='./file2\x00', 0x207) mount$overlay(0x0, &(0x7f0000000100)='./file0\x00', &(0x7f0000000000), 0x0, &(0x7f00000000c0)={[{@workdir={'workdir', 0x3d, './file0'}}, {@lowerdir={'lowerdir', 0x3d, '.'}}, {@upperdir={'upperdir', 0x3d, './file2'}}], [], 0x2c}) r5 = openat$dir(0xffffffffffffff9c, &(0x7f0000000000)='./file0/file1\x00', 0x20400, 0x20) fsync(r5) executing program 6: r0 = socket$packet(0x11, 0x2, 0x300) setsockopt$SO_ATTACH_FILTER(r0, 0x1, 0x1a, &(0x7f0000000100)={0x2, &(0x7f0000000040)=[{0x0, 0x0, 0xfd, 0xc8e}, {0x16, 0xff, 0x6, 0x6}]}, 0x10) setsockopt$packet_fanout(r0, 0x107, 0x12, 0x0, 0x0) r1 = socket$inet_udp(0x2, 0x2, 0x0) bind$inet(r1, &(0x7f0000000140)={0x2, 0x80, @dev={0xac, 0x14, 0x14, 0xf}}, 0x10) sendmmsg$inet(r1, &(0x7f0000000c00)=[{{&(0x7f0000010940)={0x2, 0x4e22, @multicast2}, 0x10, 0x0}}], 0x1, 0x2000c044) sendto$inet(r1, &(0x7f0000000c80)="e8", 0x6200, 0x0, 0x0, 0x0) executing program 6: syz_usb_connect(0x0, 0x4b, &(0x7f0000000000)=ANY=[@ANYBLOB="1201000200000040480b051000010102000109023900020100803209040000000000000009"], 0x0) r0 = syz_open_dev$dvb_demux(&(0x7f0000000200), 0x1, 0x2) ioctl$DVB_DEMUX_DMX_SET_PES_FILTER(r0, 0x40146f2c, &(0x7f0000000100)={0x1ff, 0x0, 0x3, 0xa, 0x4}) executing program 3: ioctl$VIDIOC_QUERYSTD(0xffffffffffffffff, 0x8008563f, &(0x7f0000000000)) r0 = syz_usb_connect(0x2, 0xb3, &(0x7f0000000640)=ANY=[@ANYBLOB="12010002ef0201406d0425080001000000010902a1000201008032080b00020e03000009040000000e0100000d240100012700006cdc0201011124020101020000000000000000020d000924030201010001"], &(0x7f0000000a40)={0x0, 0x0, 0x0, 0x0}) syz_usb_control_io$rtl8150(r0, 0x0, &(0x7f00000003c0)={0x2c, &(0x7f00000000c0)=ANY=[], 0x0, 0x0, 0x0, 0x0}) write(0xffffffffffffffff, &(0x7f0000000500)='transport=rdma,nqn=nqn.2014-08.org.nvmexpress:NVMf:uui', 0x36) program did not crash bisect: testing without sub-chunk 2/2 testing program (duration=6m1s, {Threaded:true Repeat:true RepeatTimes:0 Procs:6 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): [7, 24, 5, 30, 3] detailed listing: executing program 3: r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000000), 0x40241, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000200)={'syzkaller1\x00', 0xc201}) r1 = socket$kcm(0x2, 0xa, 0x2) ioctl$SIOCSIFHWADDR(r1, 0x8914, &(0x7f0000000180)={'syzkaller1\x00', @link_local={0x1, 0x80, 0xc2, 0x0, 0x0, 0xe}}) r2 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r2, &(0x7f0000000200)={0x0, 0x0, &(0x7f0000000000)={&(0x7f00000009c0)=ANY=[@ANYBLOB="140000001000010000000000000000000000000a20000000000a01020000000000000000010000000900010073797a300000000040000000160a01000900000000000000010000000900010073797a30000000000900020073797a3000000000140003800800014000000000080002400000000048000000160a0101000b000000000000010000000900020073797a30000000000900010073797a30000000001c0003801800"], 0xd0}, 0x1, 0x0, 0x0, 0x24040841}, 0x20048010) write$tun(r0, &(0x7f0000001280)=ANY=[@ANYBLOB="000086dd00001100"], 0xfce) executing program 0: socket$nl_route(0x10, 0x3, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000140)={0xa, 0x8b}, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000280)=0x8) r0 = getpid() sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x2) sched_setscheduler(r0, 0x2, &(0x7f0000000200)=0x7) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeea, 0x8031, 0xffffffffffffffff, 0x28f43000) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r1, &(0x7f0000000180)=@abs, 0x6e) sendmmsg$unix(r2, &(0x7f0000000000), 0x651, 0x0) recvmmsg(r1, &(0x7f00000000c0), 0x10106, 0x2, 0x0) mmap$IORING_OFF_SQ_RING(0x110c230000, 0x8000002, 0x2000007, 0x401d031, 0xffffffffffffffff, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./sys\x00', 0x1ff) mount(0x0, &(0x7f0000000040)='./sys\x00', &(0x7f0000000080)='sysfs\x00', 0x0, 0x0) r3 = openat(0xffffffffffffff9c, 0x0, 0x2, 0x0) write(r3, &(0x7f00000005c0)="306663353a313232373a3f7092c0f0bc085a193376cf620afaf6379a248d1d6534058f1095109da34b6d6537a6e78b0dc4b7bc0b", 0x34) r4 = socket$inet_tcp(0x2, 0x1, 0x0) ioctl$sock_SIOCGIFINDEX(r4, 0x8933, &(0x7f0000000180)={'syz_tun\x00'}) mkdirat(0xffffffffffffff9c, &(0x7f0000000080)='./file1\x00', 0x1c0) mkdirat(0xffffffffffffff9c, &(0x7f00000000c0)='./file0\x00', 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000240)='./file2\x00', 0x207) mount$overlay(0x0, &(0x7f0000000100)='./file0\x00', &(0x7f0000000000), 0x0, &(0x7f00000000c0)={[{@workdir={'workdir', 0x3d, './file0'}}, {@lowerdir={'lowerdir', 0x3d, '.'}}, {@upperdir={'upperdir', 0x3d, './file2'}}], [], 0x2c}) r5 = openat$dir(0xffffffffffffff9c, &(0x7f0000000000)='./file0/file1\x00', 0x20400, 0x20) fsync(r5) executing program 7: r0 = syz_open_dev$vim2m(&(0x7f0000000100), 0x0, 0x2) ioctl$vim2m_VIDIOC_STREAMOFF(r0, 0x40045612, &(0x7f0000000040)=0x1) ioctl$vim2m_VIDIOC_QBUF(r0, 0xc058560f, &(0x7f0000000180)=@mmap={0x1, 0x1, 0x4, 0x100, 0x81, {}, {0x4, 0x8, 0x8, 0x5, 0x29, 0x9, "0adb3fb8"}, 0x3}) write$uinput_user_dev(0xffffffffffffffff, &(0x7f0000000400)={'syz0\x00', {0x3, 0x2, 0x6, 0xfffa}, 0x3a, [0x8001, 0xc95a, 0xf, 0x8, 0x80, 0x2, 0x7, 0x7f, 0xa9, 0x4d, 0x6, 0x5f, 0x9, 0x15, 0xffff2d37, 0xff7fff01, 0x6, 0x5, 0x7, 0x5, 0x4, 0x0, 0x7, 0x3c5b, 0x1, 0x20, 0xd, 0x1, 0x0, 0xffffffff, 0xe661, 0x6, 0x7, 0x5, 0x8, 0x4c74, 0xffff7fff, 0x7, 0x3, 0xe, 0x0, 0x80008071, 0x7, 0x17, 0xffffffff, 0x7, 0x5, 0x80003e, 0x18e, 0x6, 0x6, 0x0, 0x8, 0x4, 0x8, 0x3ff, 0x80, 0x0, 0x5, 0x6, 0x8, 0x7, 0x1, 0x40], [0x10000007, 0x9, 0x8000012f, 0x8004, 0x5, 0xfffffff3, 0x129432f6, 0xc8, 0xf1, 0xe, 0x2bf, 0x6c7, 0x2009, 0xfffffffc, 0x573a, 0x0, 0x0, 0x5, 0x2f, 0x8, 0x312, 0x66abcbd2, 0xea4, 0x0, 0x4, 0x1007, 0x7fff, 0x6, 0x400, 0x401, 0x6, 0x1, 0xff, 0x7, 0x1000005, 0x5f31, 0xd, 0x4e0, 0x381, 0x4, 0xb, 0x4, 0x9, 0x8, 0x40, 0x6, 0x47, 0x8000, 0x1, 0xfe000000, 0xffff, 0x2, 0x4, 0x200009, 0x3, 0x3, 0x4000009, 0x6, 0x0, 0x3, 0xbc45, 0x48c93690, 0x42, 0x3], [0x6, 0x40a, 0x3ff, 0x5, 0xfffffffd, 0x100, 0x5, 0x9, 0x5, 0x7fff, 0x0, 0x5, 0xb, 0x4, 0x5, 0x5, 0x0, 0x1ef, 0x3, 0x8, 0x86, 0x1000515, 0x303c, 0x3e7, 0xb, 0x5, 0x2, 0x2, 0x3, 0x20000008, 0x4, 0x6cff, 0x6, 0x20000038, 0x200, 0x1fd, 0x80, 0x7, 0x4, 0x2950bfaf, 0x1000, 0xa2, 0x7, 0xcc, 0x5, 0x6, 0xac8, 0xbf, 0x2, 0x3, 0x7ff, 0x12b, 0x4, 0x1, 0xa, 0xffffffff, 0x5, 0x1c, 0x120000, 0x7ef, 0x2006, 0x80a2cd, 0x4, 0x25], [0xc, 0xbb33, 0x7, 0xb, 0x5, 0x938, 0x6, 0x6, 0x0, 0xb9, 0xce4, 0x1ff, 0x2, 0x57, 0x5, 0x3, 0x2, 0x10000, 0x4, 0x7fff, 0xfff4, 0xa620, 0x1, 0x5, 0x801, 0x2000002, 0x150, 0x60a7, 0x6, 0x16, 0xffffffff, 0x8, 0x4, 0x5, 0xca, 0x1, 0xfffff000, 0x10000, 0xf, 0x7e, 0x9, 0x9622, 0x7, 0xaf, 0x20000008, 0x5, 0x226, 0x2, 0x5, 0x0, 0x30b1d693, 0xa1f, 0xf40, 0x7, 0x530e, 0xe1c4, 0x0, 0x0, 0x5, 0x7ff, 0xd7, 0x200, 0xb, 0xfff]}, 0x45c) ppoll(&(0x7f00000000c0)=[{}, {}], 0x20000000000000dc, 0x0, 0x0, 0x0) executing program 7: bpf$MAP_CREATE(0x0, &(0x7f0000000080)=ANY=[], 0x50) bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x0, 0xc, 0x0, 0x0, 0xfffffffd, 0x0, 0x0, 0x0, 0x40, '\x00', 0x0, @fallback=0x10, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) socket(0x10, 0x803, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x1, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000380)={0xa, 0x100008b}, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000200)=0x8) openat$sequencer(0xffffffffffffff9c, &(0x7f00000001c0), 0x80200, 0x0) r0 = syz_open_dev$sndmidi(&(0x7f00000004c0), 0x2, 0x141102) writev(r0, &(0x7f0000000840)=[{&(0x7f00000002c0)="94", 0xf000}, {0x0}], 0x2) ioctl$sock_SIOCGIFINDEX(0xffffffffffffffff, 0x8933, 0x0) r1 = socket$kcm(0xa, 0x3, 0x3a) r2 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r2, &(0x7f0000000480)={0x0, 0x0, &(0x7f0000001f40)={&(0x7f00000004c0)=ANY=[@ANYBLOB="fc000000190001002dbd700000000000ac1e0001000000000000000000000000ac1414aa00"/48, @ANYRES32=0x0, @ANYRES32, @ANYBLOB="00000000000000000c00000000000000000000000000000000000000000000000000000000000000ffffffffffffffff000000000000000000000000000000000000000000000000000a000000000000feffffffff7f40000200000000000008ffffffff00000000010006000000000044000500ac1414bb000000000000000000000000000000003c0000000200000000000000000000000000000000000001060000"], 0xfc}, 0x1, 0x0, 0x0, 0x4008000}, 0x600c010) sendmsg$kcm(r1, &(0x7f0000000080)={&(0x7f0000000000)=@l2tp6={0xa, 0x0, 0x0, @loopback={0xfe80000000000000, 0xac14140c}}, 0x80, &(0x7f00000000c0)=[{&(0x7f0000000140)='\x00\x00', 0xffe3}], 0x1, 0x0, 0x0, 0x900}, 0x60) setsockopt$IPT_SO_SET_REPLACE(0xffffffffffffffff, 0x0, 0x40, 0x0, 0x0) syz_usb_connect(0x3, 0x57, &(0x7f0000000000)=ANY=[@ANYBLOB="1201000200000040402001c60100000000010902450001010080fa0904"], 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000340)='./file1\x00', 0x0) mkdirat(0xffffffffffffff9c, &(0x7f00000000c0)='./bus\x00', 0x1d7) mkdirat(0xffffffffffffff9c, &(0x7f0000000400)='./file1/file0\x00', 0x100) mount$bind(&(0x7f0000000100)='.\x00', &(0x7f0000000080)='./file1/file0\x00', 0x0, 0x1085408, 0x0) r3 = openat$sw_sync(0xffffffffffffff9c, &(0x7f0000000ac0), 0x800, 0x0) ioctl$SW_SYNC_IOC_CREATE_FENCE(r3, 0xc0285700, &(0x7f0000000b00)={0x4, "abacd211119ca94c63377526aeb5ab2c7b9ca5fa07558139ede6dc06270ee042", 0xffffffffffffffff}) ioctl$SYNC_IOC_MERGE(r4, 0xc0303e03, &(0x7f0000000780)={"d1ed39d88b014076ab94c1fb10628c46d2e66ccdb9e581a38ebb0ddd5f307e56", 0xffffffffffffffff, 0xffffffffffffffff}) ioctl$SYNC_IOC_FILE_INFO(r5, 0xc0383e04, 0x0) mount$overlay(0x0, &(0x7f00000000c0)='./bus\x00', &(0x7f00000003c0), 0x40, &(0x7f0000000300)={[{@workdir={'workdir', 0x3d, './bus'}}, {@upperdir={'upperdir', 0x3d, './file1'}}]}) bpf$PROG_LOAD(0x5, 0x0, 0x0) r6 = syz_usb_connect$hid(0x1, 0x36, &(0x7f0000000040)=ANY=[@ANYBLOB="12010000090024206d041cc340000000000109022400010000a00009040000010301010009"], 0x0) r7 = syz_open_procfs(0xffffffffffffffff, &(0x7f0000000080)='stat\x00') read$FUSE(r7, &(0x7f0000004180)={0x2020}, 0x2020) syz_usb_control_io$hid(r6, &(0x7f0000000240)={0x24, &(0x7f00000003c0)=ANY=[@ANYBLOB="00000c000000070001"], 0x0, 0x0, 0x0}, 0x0) executing program 6: syz_usb_connect(0x0, 0x4b, &(0x7f0000000000)=ANY=[@ANYBLOB="1201000200000040480b051000010102000109023900020100803209040000000000000009"], 0x0) r0 = syz_open_dev$dvb_demux(&(0x7f0000000200), 0x1, 0x2) ioctl$DVB_DEMUX_DMX_SET_PES_FILTER(r0, 0x40146f2c, &(0x7f0000000100)={0x1ff, 0x0, 0x3, 0xa, 0x4}) program crashed: general protection fault in mxl111sf_ep6_streaming_ctrl bisect: the chunk can be dropped bisect: split chunks (needed=true): <2>, <2> bisect: split chunk #0 of len 2 into 2 parts bisect: testing without sub-chunk 1/2 testing program (duration=6m1s, {Threaded:true Repeat:true RepeatTimes:0 Procs:6 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): [24, 5, 30, 3] detailed listing: executing program 0: socket$nl_route(0x10, 0x3, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000140)={0xa, 0x8b}, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000280)=0x8) r0 = getpid() sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x2) sched_setscheduler(r0, 0x2, &(0x7f0000000200)=0x7) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeea, 0x8031, 0xffffffffffffffff, 0x28f43000) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r1, &(0x7f0000000180)=@abs, 0x6e) sendmmsg$unix(r2, &(0x7f0000000000), 0x651, 0x0) recvmmsg(r1, &(0x7f00000000c0), 0x10106, 0x2, 0x0) mmap$IORING_OFF_SQ_RING(0x110c230000, 0x8000002, 0x2000007, 0x401d031, 0xffffffffffffffff, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./sys\x00', 0x1ff) mount(0x0, &(0x7f0000000040)='./sys\x00', &(0x7f0000000080)='sysfs\x00', 0x0, 0x0) r3 = openat(0xffffffffffffff9c, 0x0, 0x2, 0x0) write(r3, &(0x7f00000005c0)="306663353a313232373a3f7092c0f0bc085a193376cf620afaf6379a248d1d6534058f1095109da34b6d6537a6e78b0dc4b7bc0b", 0x34) r4 = socket$inet_tcp(0x2, 0x1, 0x0) ioctl$sock_SIOCGIFINDEX(r4, 0x8933, &(0x7f0000000180)={'syz_tun\x00'}) mkdirat(0xffffffffffffff9c, &(0x7f0000000080)='./file1\x00', 0x1c0) mkdirat(0xffffffffffffff9c, &(0x7f00000000c0)='./file0\x00', 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000240)='./file2\x00', 0x207) mount$overlay(0x0, &(0x7f0000000100)='./file0\x00', &(0x7f0000000000), 0x0, &(0x7f00000000c0)={[{@workdir={'workdir', 0x3d, './file0'}}, {@lowerdir={'lowerdir', 0x3d, '.'}}, {@upperdir={'upperdir', 0x3d, './file2'}}], [], 0x2c}) r5 = openat$dir(0xffffffffffffff9c, &(0x7f0000000000)='./file0/file1\x00', 0x20400, 0x20) fsync(r5) executing program 7: r0 = syz_open_dev$vim2m(&(0x7f0000000100), 0x0, 0x2) ioctl$vim2m_VIDIOC_STREAMOFF(r0, 0x40045612, &(0x7f0000000040)=0x1) ioctl$vim2m_VIDIOC_QBUF(r0, 0xc058560f, &(0x7f0000000180)=@mmap={0x1, 0x1, 0x4, 0x100, 0x81, {}, {0x4, 0x8, 0x8, 0x5, 0x29, 0x9, "0adb3fb8"}, 0x3}) write$uinput_user_dev(0xffffffffffffffff, &(0x7f0000000400)={'syz0\x00', {0x3, 0x2, 0x6, 0xfffa}, 0x3a, [0x8001, 0xc95a, 0xf, 0x8, 0x80, 0x2, 0x7, 0x7f, 0xa9, 0x4d, 0x6, 0x5f, 0x9, 0x15, 0xffff2d37, 0xff7fff01, 0x6, 0x5, 0x7, 0x5, 0x4, 0x0, 0x7, 0x3c5b, 0x1, 0x20, 0xd, 0x1, 0x0, 0xffffffff, 0xe661, 0x6, 0x7, 0x5, 0x8, 0x4c74, 0xffff7fff, 0x7, 0x3, 0xe, 0x0, 0x80008071, 0x7, 0x17, 0xffffffff, 0x7, 0x5, 0x80003e, 0x18e, 0x6, 0x6, 0x0, 0x8, 0x4, 0x8, 0x3ff, 0x80, 0x0, 0x5, 0x6, 0x8, 0x7, 0x1, 0x40], [0x10000007, 0x9, 0x8000012f, 0x8004, 0x5, 0xfffffff3, 0x129432f6, 0xc8, 0xf1, 0xe, 0x2bf, 0x6c7, 0x2009, 0xfffffffc, 0x573a, 0x0, 0x0, 0x5, 0x2f, 0x8, 0x312, 0x66abcbd2, 0xea4, 0x0, 0x4, 0x1007, 0x7fff, 0x6, 0x400, 0x401, 0x6, 0x1, 0xff, 0x7, 0x1000005, 0x5f31, 0xd, 0x4e0, 0x381, 0x4, 0xb, 0x4, 0x9, 0x8, 0x40, 0x6, 0x47, 0x8000, 0x1, 0xfe000000, 0xffff, 0x2, 0x4, 0x200009, 0x3, 0x3, 0x4000009, 0x6, 0x0, 0x3, 0xbc45, 0x48c93690, 0x42, 0x3], [0x6, 0x40a, 0x3ff, 0x5, 0xfffffffd, 0x100, 0x5, 0x9, 0x5, 0x7fff, 0x0, 0x5, 0xb, 0x4, 0x5, 0x5, 0x0, 0x1ef, 0x3, 0x8, 0x86, 0x1000515, 0x303c, 0x3e7, 0xb, 0x5, 0x2, 0x2, 0x3, 0x20000008, 0x4, 0x6cff, 0x6, 0x20000038, 0x200, 0x1fd, 0x80, 0x7, 0x4, 0x2950bfaf, 0x1000, 0xa2, 0x7, 0xcc, 0x5, 0x6, 0xac8, 0xbf, 0x2, 0x3, 0x7ff, 0x12b, 0x4, 0x1, 0xa, 0xffffffff, 0x5, 0x1c, 0x120000, 0x7ef, 0x2006, 0x80a2cd, 0x4, 0x25], [0xc, 0xbb33, 0x7, 0xb, 0x5, 0x938, 0x6, 0x6, 0x0, 0xb9, 0xce4, 0x1ff, 0x2, 0x57, 0x5, 0x3, 0x2, 0x10000, 0x4, 0x7fff, 0xfff4, 0xa620, 0x1, 0x5, 0x801, 0x2000002, 0x150, 0x60a7, 0x6, 0x16, 0xffffffff, 0x8, 0x4, 0x5, 0xca, 0x1, 0xfffff000, 0x10000, 0xf, 0x7e, 0x9, 0x9622, 0x7, 0xaf, 0x20000008, 0x5, 0x226, 0x2, 0x5, 0x0, 0x30b1d693, 0xa1f, 0xf40, 0x7, 0x530e, 0xe1c4, 0x0, 0x0, 0x5, 0x7ff, 0xd7, 0x200, 0xb, 0xfff]}, 0x45c) ppoll(&(0x7f00000000c0)=[{}, {}], 0x20000000000000dc, 0x0, 0x0, 0x0) executing program 7: bpf$MAP_CREATE(0x0, &(0x7f0000000080)=ANY=[], 0x50) bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x0, 0xc, 0x0, 0x0, 0xfffffffd, 0x0, 0x0, 0x0, 0x40, '\x00', 0x0, @fallback=0x10, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) socket(0x10, 0x803, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x1, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000380)={0xa, 0x100008b}, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000200)=0x8) openat$sequencer(0xffffffffffffff9c, &(0x7f00000001c0), 0x80200, 0x0) r0 = syz_open_dev$sndmidi(&(0x7f00000004c0), 0x2, 0x141102) writev(r0, &(0x7f0000000840)=[{&(0x7f00000002c0)="94", 0xf000}, {0x0}], 0x2) ioctl$sock_SIOCGIFINDEX(0xffffffffffffffff, 0x8933, 0x0) r1 = socket$kcm(0xa, 0x3, 0x3a) r2 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r2, &(0x7f0000000480)={0x0, 0x0, &(0x7f0000001f40)={&(0x7f00000004c0)=ANY=[@ANYBLOB="fc000000190001002dbd700000000000ac1e0001000000000000000000000000ac1414aa00"/48, @ANYRES32=0x0, @ANYRES32, @ANYBLOB="00000000000000000c00000000000000000000000000000000000000000000000000000000000000ffffffffffffffff000000000000000000000000000000000000000000000000000a000000000000feffffffff7f40000200000000000008ffffffff00000000010006000000000044000500ac1414bb000000000000000000000000000000003c0000000200000000000000000000000000000000000001060000"], 0xfc}, 0x1, 0x0, 0x0, 0x4008000}, 0x600c010) sendmsg$kcm(r1, &(0x7f0000000080)={&(0x7f0000000000)=@l2tp6={0xa, 0x0, 0x0, @loopback={0xfe80000000000000, 0xac14140c}}, 0x80, &(0x7f00000000c0)=[{&(0x7f0000000140)='\x00\x00', 0xffe3}], 0x1, 0x0, 0x0, 0x900}, 0x60) setsockopt$IPT_SO_SET_REPLACE(0xffffffffffffffff, 0x0, 0x40, 0x0, 0x0) syz_usb_connect(0x3, 0x57, &(0x7f0000000000)=ANY=[@ANYBLOB="1201000200000040402001c60100000000010902450001010080fa0904"], 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000340)='./file1\x00', 0x0) mkdirat(0xffffffffffffff9c, &(0x7f00000000c0)='./bus\x00', 0x1d7) mkdirat(0xffffffffffffff9c, &(0x7f0000000400)='./file1/file0\x00', 0x100) mount$bind(&(0x7f0000000100)='.\x00', &(0x7f0000000080)='./file1/file0\x00', 0x0, 0x1085408, 0x0) r3 = openat$sw_sync(0xffffffffffffff9c, &(0x7f0000000ac0), 0x800, 0x0) ioctl$SW_SYNC_IOC_CREATE_FENCE(r3, 0xc0285700, &(0x7f0000000b00)={0x4, "abacd211119ca94c63377526aeb5ab2c7b9ca5fa07558139ede6dc06270ee042", 0xffffffffffffffff}) ioctl$SYNC_IOC_MERGE(r4, 0xc0303e03, &(0x7f0000000780)={"d1ed39d88b014076ab94c1fb10628c46d2e66ccdb9e581a38ebb0ddd5f307e56", 0xffffffffffffffff, 0xffffffffffffffff}) ioctl$SYNC_IOC_FILE_INFO(r5, 0xc0383e04, 0x0) mount$overlay(0x0, &(0x7f00000000c0)='./bus\x00', &(0x7f00000003c0), 0x40, &(0x7f0000000300)={[{@workdir={'workdir', 0x3d, './bus'}}, {@upperdir={'upperdir', 0x3d, './file1'}}]}) bpf$PROG_LOAD(0x5, 0x0, 0x0) r6 = syz_usb_connect$hid(0x1, 0x36, &(0x7f0000000040)=ANY=[@ANYBLOB="12010000090024206d041cc340000000000109022400010000a00009040000010301010009"], 0x0) r7 = syz_open_procfs(0xffffffffffffffff, &(0x7f0000000080)='stat\x00') read$FUSE(r7, &(0x7f0000004180)={0x2020}, 0x2020) syz_usb_control_io$hid(r6, &(0x7f0000000240)={0x24, &(0x7f00000003c0)=ANY=[@ANYBLOB="00000c000000070001"], 0x0, 0x0, 0x0}, 0x0) executing program 6: syz_usb_connect(0x0, 0x4b, &(0x7f0000000000)=ANY=[@ANYBLOB="1201000200000040480b051000010102000109023900020100803209040000000000000009"], 0x0) r0 = syz_open_dev$dvb_demux(&(0x7f0000000200), 0x1, 0x2) ioctl$DVB_DEMUX_DMX_SET_PES_FILTER(r0, 0x40146f2c, &(0x7f0000000100)={0x1ff, 0x0, 0x3, 0xa, 0x4}) program crashed: general protection fault in mxl111sf_ep6_streaming_ctrl bisect: the chunk can be dropped bisect: testing without sub-chunk 2/2 bisect: no need to test this chunk, it's definitely needed bisect: split chunk #1 of len 2 into 2 parts bisect: testing without sub-chunk 1/2 testing program (duration=6m0s, {Threaded:true Repeat:true RepeatTimes:0 Procs:6 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): [24, 30, 3] detailed listing: executing program 0: socket$nl_route(0x10, 0x3, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000140)={0xa, 0x8b}, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000280)=0x8) r0 = getpid() sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x2) sched_setscheduler(r0, 0x2, &(0x7f0000000200)=0x7) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeea, 0x8031, 0xffffffffffffffff, 0x28f43000) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r1, &(0x7f0000000180)=@abs, 0x6e) sendmmsg$unix(r2, &(0x7f0000000000), 0x651, 0x0) recvmmsg(r1, &(0x7f00000000c0), 0x10106, 0x2, 0x0) mmap$IORING_OFF_SQ_RING(0x110c230000, 0x8000002, 0x2000007, 0x401d031, 0xffffffffffffffff, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./sys\x00', 0x1ff) mount(0x0, &(0x7f0000000040)='./sys\x00', &(0x7f0000000080)='sysfs\x00', 0x0, 0x0) r3 = openat(0xffffffffffffff9c, 0x0, 0x2, 0x0) write(r3, &(0x7f00000005c0)="306663353a313232373a3f7092c0f0bc085a193376cf620afaf6379a248d1d6534058f1095109da34b6d6537a6e78b0dc4b7bc0b", 0x34) r4 = socket$inet_tcp(0x2, 0x1, 0x0) ioctl$sock_SIOCGIFINDEX(r4, 0x8933, &(0x7f0000000180)={'syz_tun\x00'}) mkdirat(0xffffffffffffff9c, &(0x7f0000000080)='./file1\x00', 0x1c0) mkdirat(0xffffffffffffff9c, &(0x7f00000000c0)='./file0\x00', 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000240)='./file2\x00', 0x207) mount$overlay(0x0, &(0x7f0000000100)='./file0\x00', &(0x7f0000000000), 0x0, &(0x7f00000000c0)={[{@workdir={'workdir', 0x3d, './file0'}}, {@lowerdir={'lowerdir', 0x3d, '.'}}, {@upperdir={'upperdir', 0x3d, './file2'}}], [], 0x2c}) r5 = openat$dir(0xffffffffffffff9c, &(0x7f0000000000)='./file0/file1\x00', 0x20400, 0x20) fsync(r5) executing program 7: bpf$MAP_CREATE(0x0, &(0x7f0000000080)=ANY=[], 0x50) bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x0, 0xc, 0x0, 0x0, 0xfffffffd, 0x0, 0x0, 0x0, 0x40, '\x00', 0x0, @fallback=0x10, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) socket(0x10, 0x803, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x1, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000380)={0xa, 0x100008b}, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000200)=0x8) openat$sequencer(0xffffffffffffff9c, &(0x7f00000001c0), 0x80200, 0x0) r0 = syz_open_dev$sndmidi(&(0x7f00000004c0), 0x2, 0x141102) writev(r0, &(0x7f0000000840)=[{&(0x7f00000002c0)="94", 0xf000}, {0x0}], 0x2) ioctl$sock_SIOCGIFINDEX(0xffffffffffffffff, 0x8933, 0x0) r1 = socket$kcm(0xa, 0x3, 0x3a) r2 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r2, &(0x7f0000000480)={0x0, 0x0, &(0x7f0000001f40)={&(0x7f00000004c0)=ANY=[@ANYBLOB="fc000000190001002dbd700000000000ac1e0001000000000000000000000000ac1414aa00"/48, @ANYRES32=0x0, @ANYRES32, @ANYBLOB="00000000000000000c00000000000000000000000000000000000000000000000000000000000000ffffffffffffffff000000000000000000000000000000000000000000000000000a000000000000feffffffff7f40000200000000000008ffffffff00000000010006000000000044000500ac1414bb000000000000000000000000000000003c0000000200000000000000000000000000000000000001060000"], 0xfc}, 0x1, 0x0, 0x0, 0x4008000}, 0x600c010) sendmsg$kcm(r1, &(0x7f0000000080)={&(0x7f0000000000)=@l2tp6={0xa, 0x0, 0x0, @loopback={0xfe80000000000000, 0xac14140c}}, 0x80, &(0x7f00000000c0)=[{&(0x7f0000000140)='\x00\x00', 0xffe3}], 0x1, 0x0, 0x0, 0x900}, 0x60) setsockopt$IPT_SO_SET_REPLACE(0xffffffffffffffff, 0x0, 0x40, 0x0, 0x0) syz_usb_connect(0x3, 0x57, &(0x7f0000000000)=ANY=[@ANYBLOB="1201000200000040402001c60100000000010902450001010080fa0904"], 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000340)='./file1\x00', 0x0) mkdirat(0xffffffffffffff9c, &(0x7f00000000c0)='./bus\x00', 0x1d7) mkdirat(0xffffffffffffff9c, &(0x7f0000000400)='./file1/file0\x00', 0x100) mount$bind(&(0x7f0000000100)='.\x00', &(0x7f0000000080)='./file1/file0\x00', 0x0, 0x1085408, 0x0) r3 = openat$sw_sync(0xffffffffffffff9c, &(0x7f0000000ac0), 0x800, 0x0) ioctl$SW_SYNC_IOC_CREATE_FENCE(r3, 0xc0285700, &(0x7f0000000b00)={0x4, "abacd211119ca94c63377526aeb5ab2c7b9ca5fa07558139ede6dc06270ee042", 0xffffffffffffffff}) ioctl$SYNC_IOC_MERGE(r4, 0xc0303e03, &(0x7f0000000780)={"d1ed39d88b014076ab94c1fb10628c46d2e66ccdb9e581a38ebb0ddd5f307e56", 0xffffffffffffffff, 0xffffffffffffffff}) ioctl$SYNC_IOC_FILE_INFO(r5, 0xc0383e04, 0x0) mount$overlay(0x0, &(0x7f00000000c0)='./bus\x00', &(0x7f00000003c0), 0x40, &(0x7f0000000300)={[{@workdir={'workdir', 0x3d, './bus'}}, {@upperdir={'upperdir', 0x3d, './file1'}}]}) bpf$PROG_LOAD(0x5, 0x0, 0x0) r6 = syz_usb_connect$hid(0x1, 0x36, &(0x7f0000000040)=ANY=[@ANYBLOB="12010000090024206d041cc340000000000109022400010000a00009040000010301010009"], 0x0) r7 = syz_open_procfs(0xffffffffffffffff, &(0x7f0000000080)='stat\x00') read$FUSE(r7, &(0x7f0000004180)={0x2020}, 0x2020) syz_usb_control_io$hid(r6, &(0x7f0000000240)={0x24, &(0x7f00000003c0)=ANY=[@ANYBLOB="00000c000000070001"], 0x0, 0x0, 0x0}, 0x0) executing program 6: syz_usb_connect(0x0, 0x4b, &(0x7f0000000000)=ANY=[@ANYBLOB="1201000200000040480b051000010102000109023900020100803209040000000000000009"], 0x0) r0 = syz_open_dev$dvb_demux(&(0x7f0000000200), 0x1, 0x2) ioctl$DVB_DEMUX_DMX_SET_PES_FILTER(r0, 0x40146f2c, &(0x7f0000000100)={0x1ff, 0x0, 0x3, 0xa, 0x4}) program crashed: general protection fault in mxl111sf_ep6_streaming_ctrl bisect: the chunk can be dropped bisect: testing without sub-chunk 2/2 bisect: no need to test this chunk, it's definitely needed bisect: split chunks (needed=true): <1>, <1> bisect: split chunk #0 of len 1 into 2 parts bisect: no way to further split the chunk bisect: split chunk #1 of len 1 into 2 parts bisect: no way to further split the chunk bisect: 3 programs left: executing program 0: socket$nl_route(0x10, 0x3, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000140)={0xa, 0x8b}, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000280)=0x8) r0 = getpid() sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x2) sched_setscheduler(r0, 0x2, &(0x7f0000000200)=0x7) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeea, 0x8031, 0xffffffffffffffff, 0x28f43000) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r1, &(0x7f0000000180)=@abs, 0x6e) sendmmsg$unix(r2, &(0x7f0000000000), 0x651, 0x0) recvmmsg(r1, &(0x7f00000000c0), 0x10106, 0x2, 0x0) mmap$IORING_OFF_SQ_RING(0x110c230000, 0x8000002, 0x2000007, 0x401d031, 0xffffffffffffffff, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./sys\x00', 0x1ff) mount(0x0, &(0x7f0000000040)='./sys\x00', &(0x7f0000000080)='sysfs\x00', 0x0, 0x0) r3 = openat(0xffffffffffffff9c, 0x0, 0x2, 0x0) write(r3, &(0x7f00000005c0)="306663353a313232373a3f7092c0f0bc085a193376cf620afaf6379a248d1d6534058f1095109da34b6d6537a6e78b0dc4b7bc0b", 0x34) r4 = socket$inet_tcp(0x2, 0x1, 0x0) ioctl$sock_SIOCGIFINDEX(r4, 0x8933, &(0x7f0000000180)={'syz_tun\x00'}) mkdirat(0xffffffffffffff9c, &(0x7f0000000080)='./file1\x00', 0x1c0) mkdirat(0xffffffffffffff9c, &(0x7f00000000c0)='./file0\x00', 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000240)='./file2\x00', 0x207) mount$overlay(0x0, &(0x7f0000000100)='./file0\x00', &(0x7f0000000000), 0x0, &(0x7f00000000c0)={[{@workdir={'workdir', 0x3d, './file0'}}, {@lowerdir={'lowerdir', 0x3d, '.'}}, {@upperdir={'upperdir', 0x3d, './file2'}}], [], 0x2c}) r5 = openat$dir(0xffffffffffffff9c, &(0x7f0000000000)='./file0/file1\x00', 0x20400, 0x20) fsync(r5) executing program 7: bpf$MAP_CREATE(0x0, &(0x7f0000000080)=ANY=[], 0x50) bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x0, 0xc, 0x0, 0x0, 0xfffffffd, 0x0, 0x0, 0x0, 0x40, '\x00', 0x0, @fallback=0x10, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) socket(0x10, 0x803, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x1, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000380)={0xa, 0x100008b}, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000200)=0x8) openat$sequencer(0xffffffffffffff9c, &(0x7f00000001c0), 0x80200, 0x0) r0 = syz_open_dev$sndmidi(&(0x7f00000004c0), 0x2, 0x141102) writev(r0, &(0x7f0000000840)=[{&(0x7f00000002c0)="94", 0xf000}, {0x0}], 0x2) ioctl$sock_SIOCGIFINDEX(0xffffffffffffffff, 0x8933, 0x0) r1 = socket$kcm(0xa, 0x3, 0x3a) r2 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r2, &(0x7f0000000480)={0x0, 0x0, &(0x7f0000001f40)={&(0x7f00000004c0)=ANY=[@ANYBLOB="fc000000190001002dbd700000000000ac1e0001000000000000000000000000ac1414aa00"/48, @ANYRES32=0x0, @ANYRES32, @ANYBLOB="00000000000000000c00000000000000000000000000000000000000000000000000000000000000ffffffffffffffff000000000000000000000000000000000000000000000000000a000000000000feffffffff7f40000200000000000008ffffffff00000000010006000000000044000500ac1414bb000000000000000000000000000000003c0000000200000000000000000000000000000000000001060000"], 0xfc}, 0x1, 0x0, 0x0, 0x4008000}, 0x600c010) sendmsg$kcm(r1, &(0x7f0000000080)={&(0x7f0000000000)=@l2tp6={0xa, 0x0, 0x0, @loopback={0xfe80000000000000, 0xac14140c}}, 0x80, &(0x7f00000000c0)=[{&(0x7f0000000140)='\x00\x00', 0xffe3}], 0x1, 0x0, 0x0, 0x900}, 0x60) setsockopt$IPT_SO_SET_REPLACE(0xffffffffffffffff, 0x0, 0x40, 0x0, 0x0) syz_usb_connect(0x3, 0x57, &(0x7f0000000000)=ANY=[@ANYBLOB="1201000200000040402001c60100000000010902450001010080fa0904"], 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000340)='./file1\x00', 0x0) mkdirat(0xffffffffffffff9c, &(0x7f00000000c0)='./bus\x00', 0x1d7) mkdirat(0xffffffffffffff9c, &(0x7f0000000400)='./file1/file0\x00', 0x100) mount$bind(&(0x7f0000000100)='.\x00', &(0x7f0000000080)='./file1/file0\x00', 0x0, 0x1085408, 0x0) r3 = openat$sw_sync(0xffffffffffffff9c, &(0x7f0000000ac0), 0x800, 0x0) ioctl$SW_SYNC_IOC_CREATE_FENCE(r3, 0xc0285700, &(0x7f0000000b00)={0x4, "abacd211119ca94c63377526aeb5ab2c7b9ca5fa07558139ede6dc06270ee042", 0xffffffffffffffff}) ioctl$SYNC_IOC_MERGE(r4, 0xc0303e03, &(0x7f0000000780)={"d1ed39d88b014076ab94c1fb10628c46d2e66ccdb9e581a38ebb0ddd5f307e56", 0xffffffffffffffff, 0xffffffffffffffff}) ioctl$SYNC_IOC_FILE_INFO(r5, 0xc0383e04, 0x0) mount$overlay(0x0, &(0x7f00000000c0)='./bus\x00', &(0x7f00000003c0), 0x40, &(0x7f0000000300)={[{@workdir={'workdir', 0x3d, './bus'}}, {@upperdir={'upperdir', 0x3d, './file1'}}]}) bpf$PROG_LOAD(0x5, 0x0, 0x0) r6 = syz_usb_connect$hid(0x1, 0x36, &(0x7f0000000040)=ANY=[@ANYBLOB="12010000090024206d041cc340000000000109022400010000a00009040000010301010009"], 0x0) r7 = syz_open_procfs(0xffffffffffffffff, &(0x7f0000000080)='stat\x00') read$FUSE(r7, &(0x7f0000004180)={0x2020}, 0x2020) syz_usb_control_io$hid(r6, &(0x7f0000000240)={0x24, &(0x7f00000003c0)=ANY=[@ANYBLOB="00000c000000070001"], 0x0, 0x0, 0x0}, 0x0) executing program 6: syz_usb_connect(0x0, 0x4b, &(0x7f0000000000)=ANY=[@ANYBLOB="1201000200000040480b051000010102000109023900020100803209040000000000000009"], 0x0) r0 = syz_open_dev$dvb_demux(&(0x7f0000000200), 0x1, 0x2) ioctl$DVB_DEMUX_DMX_SET_PES_FILTER(r0, 0x40146f2c, &(0x7f0000000100)={0x1ff, 0x0, 0x3, 0xa, 0x4}) bisect: trying to concatenate bisect: concatenate 3 entries minimizing program #0 before concatenation testing program (duration=9m0s, {Threaded:true Repeat:true RepeatTimes:0 Procs:6 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): [23, 30, 3] detailed listing: executing program 0: socket$nl_route(0x10, 0x3, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000140)={0xa, 0x8b}, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000280)=0x8) r0 = getpid() sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x2) sched_setscheduler(r0, 0x2, &(0x7f0000000200)=0x7) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeea, 0x8031, 0xffffffffffffffff, 0x28f43000) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r1, &(0x7f0000000180)=@abs, 0x6e) sendmmsg$unix(r2, &(0x7f0000000000), 0x651, 0x0) recvmmsg(r1, &(0x7f00000000c0), 0x10106, 0x2, 0x0) mmap$IORING_OFF_SQ_RING(0x110c230000, 0x8000002, 0x2000007, 0x401d031, 0xffffffffffffffff, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./sys\x00', 0x1ff) mount(0x0, &(0x7f0000000040)='./sys\x00', &(0x7f0000000080)='sysfs\x00', 0x0, 0x0) r3 = openat(0xffffffffffffff9c, 0x0, 0x2, 0x0) write(r3, &(0x7f00000005c0)="306663353a313232373a3f7092c0f0bc085a193376cf620afaf6379a248d1d6534058f1095109da34b6d6537a6e78b0dc4b7bc0b", 0x34) r4 = socket$inet_tcp(0x2, 0x1, 0x0) ioctl$sock_SIOCGIFINDEX(r4, 0x8933, &(0x7f0000000180)={'syz_tun\x00'}) mkdirat(0xffffffffffffff9c, &(0x7f0000000080)='./file1\x00', 0x1c0) mkdirat(0xffffffffffffff9c, &(0x7f00000000c0)='./file0\x00', 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000240)='./file2\x00', 0x207) mount$overlay(0x0, &(0x7f0000000100)='./file0\x00', &(0x7f0000000000), 0x0, &(0x7f00000000c0)={[{@workdir={'workdir', 0x3d, './file0'}}, {@lowerdir={'lowerdir', 0x3d, '.'}}, {@upperdir={'upperdir', 0x3d, './file2'}}], [], 0x2c}) openat$dir(0xffffffffffffff9c, &(0x7f0000000000)='./file0/file1\x00', 0x20400, 0x20) executing program 7: bpf$MAP_CREATE(0x0, &(0x7f0000000080)=ANY=[], 0x50) bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x0, 0xc, 0x0, 0x0, 0xfffffffd, 0x0, 0x0, 0x0, 0x40, '\x00', 0x0, @fallback=0x10, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) socket(0x10, 0x803, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x1, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000380)={0xa, 0x100008b}, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000200)=0x8) openat$sequencer(0xffffffffffffff9c, &(0x7f00000001c0), 0x80200, 0x0) r0 = syz_open_dev$sndmidi(&(0x7f00000004c0), 0x2, 0x141102) writev(r0, &(0x7f0000000840)=[{&(0x7f00000002c0)="94", 0xf000}, {0x0}], 0x2) ioctl$sock_SIOCGIFINDEX(0xffffffffffffffff, 0x8933, 0x0) r1 = socket$kcm(0xa, 0x3, 0x3a) r2 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r2, &(0x7f0000000480)={0x0, 0x0, &(0x7f0000001f40)={&(0x7f00000004c0)=ANY=[@ANYBLOB="fc000000190001002dbd700000000000ac1e0001000000000000000000000000ac1414aa00"/48, @ANYRES32=0x0, @ANYRES32, @ANYBLOB="00000000000000000c00000000000000000000000000000000000000000000000000000000000000ffffffffffffffff000000000000000000000000000000000000000000000000000a000000000000feffffffff7f40000200000000000008ffffffff00000000010006000000000044000500ac1414bb000000000000000000000000000000003c0000000200000000000000000000000000000000000001060000"], 0xfc}, 0x1, 0x0, 0x0, 0x4008000}, 0x600c010) sendmsg$kcm(r1, &(0x7f0000000080)={&(0x7f0000000000)=@l2tp6={0xa, 0x0, 0x0, @loopback={0xfe80000000000000, 0xac14140c}}, 0x80, &(0x7f00000000c0)=[{&(0x7f0000000140)='\x00\x00', 0xffe3}], 0x1, 0x0, 0x0, 0x900}, 0x60) setsockopt$IPT_SO_SET_REPLACE(0xffffffffffffffff, 0x0, 0x40, 0x0, 0x0) syz_usb_connect(0x3, 0x57, &(0x7f0000000000)=ANY=[@ANYBLOB="1201000200000040402001c60100000000010902450001010080fa0904"], 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000340)='./file1\x00', 0x0) mkdirat(0xffffffffffffff9c, &(0x7f00000000c0)='./bus\x00', 0x1d7) mkdirat(0xffffffffffffff9c, &(0x7f0000000400)='./file1/file0\x00', 0x100) mount$bind(&(0x7f0000000100)='.\x00', &(0x7f0000000080)='./file1/file0\x00', 0x0, 0x1085408, 0x0) r3 = openat$sw_sync(0xffffffffffffff9c, &(0x7f0000000ac0), 0x800, 0x0) ioctl$SW_SYNC_IOC_CREATE_FENCE(r3, 0xc0285700, &(0x7f0000000b00)={0x4, "abacd211119ca94c63377526aeb5ab2c7b9ca5fa07558139ede6dc06270ee042", 0xffffffffffffffff}) ioctl$SYNC_IOC_MERGE(r4, 0xc0303e03, &(0x7f0000000780)={"d1ed39d88b014076ab94c1fb10628c46d2e66ccdb9e581a38ebb0ddd5f307e56", 0xffffffffffffffff, 0xffffffffffffffff}) ioctl$SYNC_IOC_FILE_INFO(r5, 0xc0383e04, 0x0) mount$overlay(0x0, &(0x7f00000000c0)='./bus\x00', &(0x7f00000003c0), 0x40, &(0x7f0000000300)={[{@workdir={'workdir', 0x3d, './bus'}}, {@upperdir={'upperdir', 0x3d, './file1'}}]}) bpf$PROG_LOAD(0x5, 0x0, 0x0) r6 = syz_usb_connect$hid(0x1, 0x36, &(0x7f0000000040)=ANY=[@ANYBLOB="12010000090024206d041cc340000000000109022400010000a00009040000010301010009"], 0x0) r7 = syz_open_procfs(0xffffffffffffffff, &(0x7f0000000080)='stat\x00') read$FUSE(r7, &(0x7f0000004180)={0x2020}, 0x2020) syz_usb_control_io$hid(r6, &(0x7f0000000240)={0x24, &(0x7f00000003c0)=ANY=[@ANYBLOB="00000c000000070001"], 0x0, 0x0, 0x0}, 0x0) executing program 6: syz_usb_connect(0x0, 0x4b, &(0x7f0000000000)=ANY=[@ANYBLOB="1201000200000040480b051000010102000109023900020100803209040000000000000009"], 0x0) r0 = syz_open_dev$dvb_demux(&(0x7f0000000200), 0x1, 0x2) ioctl$DVB_DEMUX_DMX_SET_PES_FILTER(r0, 0x40146f2c, &(0x7f0000000100)={0x1ff, 0x0, 0x3, 0xa, 0x4}) program crashed: general protection fault in mxl111sf_ep6_streaming_ctrl testing program (duration=9m0s, {Threaded:true Repeat:true RepeatTimes:0 Procs:6 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): [22, 30, 3] detailed listing: executing program 0: socket$nl_route(0x10, 0x3, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000140)={0xa, 0x8b}, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000280)=0x8) r0 = getpid() sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x2) sched_setscheduler(r0, 0x2, &(0x7f0000000200)=0x7) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeea, 0x8031, 0xffffffffffffffff, 0x28f43000) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r1, &(0x7f0000000180)=@abs, 0x6e) sendmmsg$unix(r2, &(0x7f0000000000), 0x651, 0x0) recvmmsg(r1, &(0x7f00000000c0), 0x10106, 0x2, 0x0) mmap$IORING_OFF_SQ_RING(0x110c230000, 0x8000002, 0x2000007, 0x401d031, 0xffffffffffffffff, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./sys\x00', 0x1ff) mount(0x0, &(0x7f0000000040)='./sys\x00', &(0x7f0000000080)='sysfs\x00', 0x0, 0x0) r3 = openat(0xffffffffffffff9c, 0x0, 0x2, 0x0) write(r3, &(0x7f00000005c0)="306663353a313232373a3f7092c0f0bc085a193376cf620afaf6379a248d1d6534058f1095109da34b6d6537a6e78b0dc4b7bc0b", 0x34) r4 = socket$inet_tcp(0x2, 0x1, 0x0) ioctl$sock_SIOCGIFINDEX(r4, 0x8933, &(0x7f0000000180)={'syz_tun\x00'}) mkdirat(0xffffffffffffff9c, &(0x7f0000000080)='./file1\x00', 0x1c0) mkdirat(0xffffffffffffff9c, &(0x7f00000000c0)='./file0\x00', 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000240)='./file2\x00', 0x207) mount$overlay(0x0, &(0x7f0000000100)='./file0\x00', &(0x7f0000000000), 0x0, &(0x7f00000000c0)={[{@workdir={'workdir', 0x3d, './file0'}}, {@lowerdir={'lowerdir', 0x3d, '.'}}, {@upperdir={'upperdir', 0x3d, './file2'}}], [], 0x2c}) executing program 7: bpf$MAP_CREATE(0x0, &(0x7f0000000080)=ANY=[], 0x50) bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x0, 0xc, 0x0, 0x0, 0xfffffffd, 0x0, 0x0, 0x0, 0x40, '\x00', 0x0, @fallback=0x10, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) socket(0x10, 0x803, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x1, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000380)={0xa, 0x100008b}, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000200)=0x8) openat$sequencer(0xffffffffffffff9c, &(0x7f00000001c0), 0x80200, 0x0) r0 = syz_open_dev$sndmidi(&(0x7f00000004c0), 0x2, 0x141102) writev(r0, &(0x7f0000000840)=[{&(0x7f00000002c0)="94", 0xf000}, {0x0}], 0x2) ioctl$sock_SIOCGIFINDEX(0xffffffffffffffff, 0x8933, 0x0) r1 = socket$kcm(0xa, 0x3, 0x3a) r2 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r2, &(0x7f0000000480)={0x0, 0x0, &(0x7f0000001f40)={&(0x7f00000004c0)=ANY=[@ANYBLOB="fc000000190001002dbd700000000000ac1e0001000000000000000000000000ac1414aa00"/48, @ANYRES32=0x0, @ANYRES32, @ANYBLOB="00000000000000000c00000000000000000000000000000000000000000000000000000000000000ffffffffffffffff000000000000000000000000000000000000000000000000000a000000000000feffffffff7f40000200000000000008ffffffff00000000010006000000000044000500ac1414bb000000000000000000000000000000003c0000000200000000000000000000000000000000000001060000"], 0xfc}, 0x1, 0x0, 0x0, 0x4008000}, 0x600c010) sendmsg$kcm(r1, &(0x7f0000000080)={&(0x7f0000000000)=@l2tp6={0xa, 0x0, 0x0, @loopback={0xfe80000000000000, 0xac14140c}}, 0x80, &(0x7f00000000c0)=[{&(0x7f0000000140)='\x00\x00', 0xffe3}], 0x1, 0x0, 0x0, 0x900}, 0x60) setsockopt$IPT_SO_SET_REPLACE(0xffffffffffffffff, 0x0, 0x40, 0x0, 0x0) syz_usb_connect(0x3, 0x57, &(0x7f0000000000)=ANY=[@ANYBLOB="1201000200000040402001c60100000000010902450001010080fa0904"], 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000340)='./file1\x00', 0x0) mkdirat(0xffffffffffffff9c, &(0x7f00000000c0)='./bus\x00', 0x1d7) mkdirat(0xffffffffffffff9c, &(0x7f0000000400)='./file1/file0\x00', 0x100) mount$bind(&(0x7f0000000100)='.\x00', &(0x7f0000000080)='./file1/file0\x00', 0x0, 0x1085408, 0x0) r3 = openat$sw_sync(0xffffffffffffff9c, &(0x7f0000000ac0), 0x800, 0x0) ioctl$SW_SYNC_IOC_CREATE_FENCE(r3, 0xc0285700, &(0x7f0000000b00)={0x4, "abacd211119ca94c63377526aeb5ab2c7b9ca5fa07558139ede6dc06270ee042", 0xffffffffffffffff}) ioctl$SYNC_IOC_MERGE(r4, 0xc0303e03, &(0x7f0000000780)={"d1ed39d88b014076ab94c1fb10628c46d2e66ccdb9e581a38ebb0ddd5f307e56", 0xffffffffffffffff, 0xffffffffffffffff}) ioctl$SYNC_IOC_FILE_INFO(r5, 0xc0383e04, 0x0) mount$overlay(0x0, &(0x7f00000000c0)='./bus\x00', &(0x7f00000003c0), 0x40, &(0x7f0000000300)={[{@workdir={'workdir', 0x3d, './bus'}}, {@upperdir={'upperdir', 0x3d, './file1'}}]}) bpf$PROG_LOAD(0x5, 0x0, 0x0) r6 = syz_usb_connect$hid(0x1, 0x36, &(0x7f0000000040)=ANY=[@ANYBLOB="12010000090024206d041cc340000000000109022400010000a00009040000010301010009"], 0x0) r7 = syz_open_procfs(0xffffffffffffffff, &(0x7f0000000080)='stat\x00') read$FUSE(r7, &(0x7f0000004180)={0x2020}, 0x2020) syz_usb_control_io$hid(r6, &(0x7f0000000240)={0x24, &(0x7f00000003c0)=ANY=[@ANYBLOB="00000c000000070001"], 0x0, 0x0, 0x0}, 0x0) executing program 6: syz_usb_connect(0x0, 0x4b, &(0x7f0000000000)=ANY=[@ANYBLOB="1201000200000040480b051000010102000109023900020100803209040000000000000009"], 0x0) r0 = syz_open_dev$dvb_demux(&(0x7f0000000200), 0x1, 0x2) ioctl$DVB_DEMUX_DMX_SET_PES_FILTER(r0, 0x40146f2c, &(0x7f0000000100)={0x1ff, 0x0, 0x3, 0xa, 0x4}) program crashed: UBSAN: array-index-out-of-bounds in dvb_usb_start_feed testing program (duration=9m0s, {Threaded:true Repeat:true RepeatTimes:0 Procs:6 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): [21, 30, 3] detailed listing: executing program 0: socket$nl_route(0x10, 0x3, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000140)={0xa, 0x8b}, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000280)=0x8) r0 = getpid() sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x2) sched_setscheduler(r0, 0x2, &(0x7f0000000200)=0x7) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeea, 0x8031, 0xffffffffffffffff, 0x28f43000) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r1, &(0x7f0000000180)=@abs, 0x6e) sendmmsg$unix(r2, &(0x7f0000000000), 0x651, 0x0) recvmmsg(r1, &(0x7f00000000c0), 0x10106, 0x2, 0x0) mmap$IORING_OFF_SQ_RING(0x110c230000, 0x8000002, 0x2000007, 0x401d031, 0xffffffffffffffff, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./sys\x00', 0x1ff) mount(0x0, &(0x7f0000000040)='./sys\x00', &(0x7f0000000080)='sysfs\x00', 0x0, 0x0) r3 = openat(0xffffffffffffff9c, 0x0, 0x2, 0x0) write(r3, &(0x7f00000005c0)="306663353a313232373a3f7092c0f0bc085a193376cf620afaf6379a248d1d6534058f1095109da34b6d6537a6e78b0dc4b7bc0b", 0x34) r4 = socket$inet_tcp(0x2, 0x1, 0x0) ioctl$sock_SIOCGIFINDEX(r4, 0x8933, &(0x7f0000000180)={'syz_tun\x00'}) mkdirat(0xffffffffffffff9c, &(0x7f0000000080)='./file1\x00', 0x1c0) mkdirat(0xffffffffffffff9c, &(0x7f00000000c0)='./file0\x00', 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000240)='./file2\x00', 0x207) executing program 7: bpf$MAP_CREATE(0x0, &(0x7f0000000080)=ANY=[], 0x50) bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x0, 0xc, 0x0, 0x0, 0xfffffffd, 0x0, 0x0, 0x0, 0x40, '\x00', 0x0, @fallback=0x10, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) socket(0x10, 0x803, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x1, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000380)={0xa, 0x100008b}, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000200)=0x8) openat$sequencer(0xffffffffffffff9c, &(0x7f00000001c0), 0x80200, 0x0) r0 = syz_open_dev$sndmidi(&(0x7f00000004c0), 0x2, 0x141102) writev(r0, &(0x7f0000000840)=[{&(0x7f00000002c0)="94", 0xf000}, {0x0}], 0x2) ioctl$sock_SIOCGIFINDEX(0xffffffffffffffff, 0x8933, 0x0) r1 = socket$kcm(0xa, 0x3, 0x3a) r2 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r2, &(0x7f0000000480)={0x0, 0x0, &(0x7f0000001f40)={&(0x7f00000004c0)=ANY=[@ANYBLOB="fc000000190001002dbd700000000000ac1e0001000000000000000000000000ac1414aa00"/48, @ANYRES32=0x0, @ANYRES32, @ANYBLOB="00000000000000000c00000000000000000000000000000000000000000000000000000000000000ffffffffffffffff000000000000000000000000000000000000000000000000000a000000000000feffffffff7f40000200000000000008ffffffff00000000010006000000000044000500ac1414bb000000000000000000000000000000003c0000000200000000000000000000000000000000000001060000"], 0xfc}, 0x1, 0x0, 0x0, 0x4008000}, 0x600c010) sendmsg$kcm(r1, &(0x7f0000000080)={&(0x7f0000000000)=@l2tp6={0xa, 0x0, 0x0, @loopback={0xfe80000000000000, 0xac14140c}}, 0x80, &(0x7f00000000c0)=[{&(0x7f0000000140)='\x00\x00', 0xffe3}], 0x1, 0x0, 0x0, 0x900}, 0x60) setsockopt$IPT_SO_SET_REPLACE(0xffffffffffffffff, 0x0, 0x40, 0x0, 0x0) syz_usb_connect(0x3, 0x57, &(0x7f0000000000)=ANY=[@ANYBLOB="1201000200000040402001c60100000000010902450001010080fa0904"], 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000340)='./file1\x00', 0x0) mkdirat(0xffffffffffffff9c, &(0x7f00000000c0)='./bus\x00', 0x1d7) mkdirat(0xffffffffffffff9c, &(0x7f0000000400)='./file1/file0\x00', 0x100) mount$bind(&(0x7f0000000100)='.\x00', &(0x7f0000000080)='./file1/file0\x00', 0x0, 0x1085408, 0x0) r3 = openat$sw_sync(0xffffffffffffff9c, &(0x7f0000000ac0), 0x800, 0x0) ioctl$SW_SYNC_IOC_CREATE_FENCE(r3, 0xc0285700, &(0x7f0000000b00)={0x4, "abacd211119ca94c63377526aeb5ab2c7b9ca5fa07558139ede6dc06270ee042", 0xffffffffffffffff}) ioctl$SYNC_IOC_MERGE(r4, 0xc0303e03, &(0x7f0000000780)={"d1ed39d88b014076ab94c1fb10628c46d2e66ccdb9e581a38ebb0ddd5f307e56", 0xffffffffffffffff, 0xffffffffffffffff}) ioctl$SYNC_IOC_FILE_INFO(r5, 0xc0383e04, 0x0) mount$overlay(0x0, &(0x7f00000000c0)='./bus\x00', &(0x7f00000003c0), 0x40, &(0x7f0000000300)={[{@workdir={'workdir', 0x3d, './bus'}}, {@upperdir={'upperdir', 0x3d, './file1'}}]}) bpf$PROG_LOAD(0x5, 0x0, 0x0) r6 = syz_usb_connect$hid(0x1, 0x36, &(0x7f0000000040)=ANY=[@ANYBLOB="12010000090024206d041cc340000000000109022400010000a00009040000010301010009"], 0x0) r7 = syz_open_procfs(0xffffffffffffffff, &(0x7f0000000080)='stat\x00') read$FUSE(r7, &(0x7f0000004180)={0x2020}, 0x2020) syz_usb_control_io$hid(r6, &(0x7f0000000240)={0x24, &(0x7f00000003c0)=ANY=[@ANYBLOB="00000c000000070001"], 0x0, 0x0, 0x0}, 0x0) executing program 6: syz_usb_connect(0x0, 0x4b, &(0x7f0000000000)=ANY=[@ANYBLOB="1201000200000040480b051000010102000109023900020100803209040000000000000009"], 0x0) r0 = syz_open_dev$dvb_demux(&(0x7f0000000200), 0x1, 0x2) ioctl$DVB_DEMUX_DMX_SET_PES_FILTER(r0, 0x40146f2c, &(0x7f0000000100)={0x1ff, 0x0, 0x3, 0xa, 0x4}) program crashed: general protection fault in mxl111sf_ep6_streaming_ctrl testing program (duration=9m0s, {Threaded:true Repeat:true RepeatTimes:0 Procs:6 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): [20, 30, 3] detailed listing: executing program 0: socket$nl_route(0x10, 0x3, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000140)={0xa, 0x8b}, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000280)=0x8) r0 = getpid() sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x2) sched_setscheduler(r0, 0x2, &(0x7f0000000200)=0x7) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeea, 0x8031, 0xffffffffffffffff, 0x28f43000) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r1, &(0x7f0000000180)=@abs, 0x6e) sendmmsg$unix(r2, &(0x7f0000000000), 0x651, 0x0) recvmmsg(r1, &(0x7f00000000c0), 0x10106, 0x2, 0x0) mmap$IORING_OFF_SQ_RING(0x110c230000, 0x8000002, 0x2000007, 0x401d031, 0xffffffffffffffff, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./sys\x00', 0x1ff) mount(0x0, &(0x7f0000000040)='./sys\x00', &(0x7f0000000080)='sysfs\x00', 0x0, 0x0) r3 = openat(0xffffffffffffff9c, 0x0, 0x2, 0x0) write(r3, &(0x7f00000005c0)="306663353a313232373a3f7092c0f0bc085a193376cf620afaf6379a248d1d6534058f1095109da34b6d6537a6e78b0dc4b7bc0b", 0x34) r4 = socket$inet_tcp(0x2, 0x1, 0x0) ioctl$sock_SIOCGIFINDEX(r4, 0x8933, &(0x7f0000000180)={'syz_tun\x00'}) mkdirat(0xffffffffffffff9c, &(0x7f0000000080)='./file1\x00', 0x1c0) mkdirat(0xffffffffffffff9c, &(0x7f00000000c0)='./file0\x00', 0x0) executing program 7: bpf$MAP_CREATE(0x0, &(0x7f0000000080)=ANY=[], 0x50) bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x0, 0xc, 0x0, 0x0, 0xfffffffd, 0x0, 0x0, 0x0, 0x40, '\x00', 0x0, @fallback=0x10, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) socket(0x10, 0x803, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x1, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000380)={0xa, 0x100008b}, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000200)=0x8) openat$sequencer(0xffffffffffffff9c, &(0x7f00000001c0), 0x80200, 0x0) r0 = syz_open_dev$sndmidi(&(0x7f00000004c0), 0x2, 0x141102) writev(r0, &(0x7f0000000840)=[{&(0x7f00000002c0)="94", 0xf000}, {0x0}], 0x2) ioctl$sock_SIOCGIFINDEX(0xffffffffffffffff, 0x8933, 0x0) r1 = socket$kcm(0xa, 0x3, 0x3a) r2 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r2, &(0x7f0000000480)={0x0, 0x0, &(0x7f0000001f40)={&(0x7f00000004c0)=ANY=[@ANYBLOB="fc000000190001002dbd700000000000ac1e0001000000000000000000000000ac1414aa00"/48, @ANYRES32=0x0, @ANYRES32, @ANYBLOB="00000000000000000c00000000000000000000000000000000000000000000000000000000000000ffffffffffffffff000000000000000000000000000000000000000000000000000a000000000000feffffffff7f40000200000000000008ffffffff00000000010006000000000044000500ac1414bb000000000000000000000000000000003c0000000200000000000000000000000000000000000001060000"], 0xfc}, 0x1, 0x0, 0x0, 0x4008000}, 0x600c010) sendmsg$kcm(r1, &(0x7f0000000080)={&(0x7f0000000000)=@l2tp6={0xa, 0x0, 0x0, @loopback={0xfe80000000000000, 0xac14140c}}, 0x80, &(0x7f00000000c0)=[{&(0x7f0000000140)='\x00\x00', 0xffe3}], 0x1, 0x0, 0x0, 0x900}, 0x60) setsockopt$IPT_SO_SET_REPLACE(0xffffffffffffffff, 0x0, 0x40, 0x0, 0x0) syz_usb_connect(0x3, 0x57, &(0x7f0000000000)=ANY=[@ANYBLOB="1201000200000040402001c60100000000010902450001010080fa0904"], 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000340)='./file1\x00', 0x0) mkdirat(0xffffffffffffff9c, &(0x7f00000000c0)='./bus\x00', 0x1d7) mkdirat(0xffffffffffffff9c, &(0x7f0000000400)='./file1/file0\x00', 0x100) mount$bind(&(0x7f0000000100)='.\x00', &(0x7f0000000080)='./file1/file0\x00', 0x0, 0x1085408, 0x0) r3 = openat$sw_sync(0xffffffffffffff9c, &(0x7f0000000ac0), 0x800, 0x0) ioctl$SW_SYNC_IOC_CREATE_FENCE(r3, 0xc0285700, &(0x7f0000000b00)={0x4, "abacd211119ca94c63377526aeb5ab2c7b9ca5fa07558139ede6dc06270ee042", 0xffffffffffffffff}) ioctl$SYNC_IOC_MERGE(r4, 0xc0303e03, &(0x7f0000000780)={"d1ed39d88b014076ab94c1fb10628c46d2e66ccdb9e581a38ebb0ddd5f307e56", 0xffffffffffffffff, 0xffffffffffffffff}) ioctl$SYNC_IOC_FILE_INFO(r5, 0xc0383e04, 0x0) mount$overlay(0x0, &(0x7f00000000c0)='./bus\x00', &(0x7f00000003c0), 0x40, &(0x7f0000000300)={[{@workdir={'workdir', 0x3d, './bus'}}, {@upperdir={'upperdir', 0x3d, './file1'}}]}) bpf$PROG_LOAD(0x5, 0x0, 0x0) r6 = syz_usb_connect$hid(0x1, 0x36, &(0x7f0000000040)=ANY=[@ANYBLOB="12010000090024206d041cc340000000000109022400010000a00009040000010301010009"], 0x0) r7 = syz_open_procfs(0xffffffffffffffff, &(0x7f0000000080)='stat\x00') read$FUSE(r7, &(0x7f0000004180)={0x2020}, 0x2020) syz_usb_control_io$hid(r6, &(0x7f0000000240)={0x24, &(0x7f00000003c0)=ANY=[@ANYBLOB="00000c000000070001"], 0x0, 0x0, 0x0}, 0x0) executing program 6: syz_usb_connect(0x0, 0x4b, &(0x7f0000000000)=ANY=[@ANYBLOB="1201000200000040480b051000010102000109023900020100803209040000000000000009"], 0x0) r0 = syz_open_dev$dvb_demux(&(0x7f0000000200), 0x1, 0x2) ioctl$DVB_DEMUX_DMX_SET_PES_FILTER(r0, 0x40146f2c, &(0x7f0000000100)={0x1ff, 0x0, 0x3, 0xa, 0x4}) program crashed: general protection fault in mxl111sf_ep6_streaming_ctrl testing program (duration=9m0s, {Threaded:true Repeat:true RepeatTimes:0 Procs:6 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): [19, 30, 3] detailed listing: executing program 0: socket$nl_route(0x10, 0x3, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000140)={0xa, 0x8b}, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000280)=0x8) r0 = getpid() sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x2) sched_setscheduler(r0, 0x2, &(0x7f0000000200)=0x7) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeea, 0x8031, 0xffffffffffffffff, 0x28f43000) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r1, &(0x7f0000000180)=@abs, 0x6e) sendmmsg$unix(r2, &(0x7f0000000000), 0x651, 0x0) recvmmsg(r1, &(0x7f00000000c0), 0x10106, 0x2, 0x0) mmap$IORING_OFF_SQ_RING(0x110c230000, 0x8000002, 0x2000007, 0x401d031, 0xffffffffffffffff, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./sys\x00', 0x1ff) mount(0x0, &(0x7f0000000040)='./sys\x00', &(0x7f0000000080)='sysfs\x00', 0x0, 0x0) r3 = openat(0xffffffffffffff9c, 0x0, 0x2, 0x0) write(r3, &(0x7f00000005c0)="306663353a313232373a3f7092c0f0bc085a193376cf620afaf6379a248d1d6534058f1095109da34b6d6537a6e78b0dc4b7bc0b", 0x34) r4 = socket$inet_tcp(0x2, 0x1, 0x0) ioctl$sock_SIOCGIFINDEX(r4, 0x8933, &(0x7f0000000180)={'syz_tun\x00'}) mkdirat(0xffffffffffffff9c, &(0x7f0000000080)='./file1\x00', 0x1c0) executing program 7: bpf$MAP_CREATE(0x0, &(0x7f0000000080)=ANY=[], 0x50) bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x0, 0xc, 0x0, 0x0, 0xfffffffd, 0x0, 0x0, 0x0, 0x40, '\x00', 0x0, @fallback=0x10, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) socket(0x10, 0x803, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x1, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000380)={0xa, 0x100008b}, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000200)=0x8) openat$sequencer(0xffffffffffffff9c, &(0x7f00000001c0), 0x80200, 0x0) r0 = syz_open_dev$sndmidi(&(0x7f00000004c0), 0x2, 0x141102) writev(r0, &(0x7f0000000840)=[{&(0x7f00000002c0)="94", 0xf000}, {0x0}], 0x2) ioctl$sock_SIOCGIFINDEX(0xffffffffffffffff, 0x8933, 0x0) r1 = socket$kcm(0xa, 0x3, 0x3a) r2 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r2, &(0x7f0000000480)={0x0, 0x0, &(0x7f0000001f40)={&(0x7f00000004c0)=ANY=[@ANYBLOB="fc000000190001002dbd700000000000ac1e0001000000000000000000000000ac1414aa00"/48, @ANYRES32=0x0, @ANYRES32, @ANYBLOB="00000000000000000c00000000000000000000000000000000000000000000000000000000000000ffffffffffffffff000000000000000000000000000000000000000000000000000a000000000000feffffffff7f40000200000000000008ffffffff00000000010006000000000044000500ac1414bb000000000000000000000000000000003c0000000200000000000000000000000000000000000001060000"], 0xfc}, 0x1, 0x0, 0x0, 0x4008000}, 0x600c010) sendmsg$kcm(r1, &(0x7f0000000080)={&(0x7f0000000000)=@l2tp6={0xa, 0x0, 0x0, @loopback={0xfe80000000000000, 0xac14140c}}, 0x80, &(0x7f00000000c0)=[{&(0x7f0000000140)='\x00\x00', 0xffe3}], 0x1, 0x0, 0x0, 0x900}, 0x60) setsockopt$IPT_SO_SET_REPLACE(0xffffffffffffffff, 0x0, 0x40, 0x0, 0x0) syz_usb_connect(0x3, 0x57, &(0x7f0000000000)=ANY=[@ANYBLOB="1201000200000040402001c60100000000010902450001010080fa0904"], 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000340)='./file1\x00', 0x0) mkdirat(0xffffffffffffff9c, &(0x7f00000000c0)='./bus\x00', 0x1d7) mkdirat(0xffffffffffffff9c, &(0x7f0000000400)='./file1/file0\x00', 0x100) mount$bind(&(0x7f0000000100)='.\x00', &(0x7f0000000080)='./file1/file0\x00', 0x0, 0x1085408, 0x0) r3 = openat$sw_sync(0xffffffffffffff9c, &(0x7f0000000ac0), 0x800, 0x0) ioctl$SW_SYNC_IOC_CREATE_FENCE(r3, 0xc0285700, &(0x7f0000000b00)={0x4, "abacd211119ca94c63377526aeb5ab2c7b9ca5fa07558139ede6dc06270ee042", 0xffffffffffffffff}) ioctl$SYNC_IOC_MERGE(r4, 0xc0303e03, &(0x7f0000000780)={"d1ed39d88b014076ab94c1fb10628c46d2e66ccdb9e581a38ebb0ddd5f307e56", 0xffffffffffffffff, 0xffffffffffffffff}) ioctl$SYNC_IOC_FILE_INFO(r5, 0xc0383e04, 0x0) mount$overlay(0x0, &(0x7f00000000c0)='./bus\x00', &(0x7f00000003c0), 0x40, &(0x7f0000000300)={[{@workdir={'workdir', 0x3d, './bus'}}, {@upperdir={'upperdir', 0x3d, './file1'}}]}) bpf$PROG_LOAD(0x5, 0x0, 0x0) r6 = syz_usb_connect$hid(0x1, 0x36, &(0x7f0000000040)=ANY=[@ANYBLOB="12010000090024206d041cc340000000000109022400010000a00009040000010301010009"], 0x0) r7 = syz_open_procfs(0xffffffffffffffff, &(0x7f0000000080)='stat\x00') read$FUSE(r7, &(0x7f0000004180)={0x2020}, 0x2020) syz_usb_control_io$hid(r6, &(0x7f0000000240)={0x24, &(0x7f00000003c0)=ANY=[@ANYBLOB="00000c000000070001"], 0x0, 0x0, 0x0}, 0x0) executing program 6: syz_usb_connect(0x0, 0x4b, &(0x7f0000000000)=ANY=[@ANYBLOB="1201000200000040480b051000010102000109023900020100803209040000000000000009"], 0x0) r0 = syz_open_dev$dvb_demux(&(0x7f0000000200), 0x1, 0x2) ioctl$DVB_DEMUX_DMX_SET_PES_FILTER(r0, 0x40146f2c, &(0x7f0000000100)={0x1ff, 0x0, 0x3, 0xa, 0x4}) program crashed: general protection fault in mxl111sf_ep6_streaming_ctrl testing program (duration=9m0s, {Threaded:true Repeat:true RepeatTimes:0 Procs:6 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): [18, 30, 3] detailed listing: executing program 0: socket$nl_route(0x10, 0x3, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000140)={0xa, 0x8b}, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000280)=0x8) r0 = getpid() sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x2) sched_setscheduler(r0, 0x2, &(0x7f0000000200)=0x7) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeea, 0x8031, 0xffffffffffffffff, 0x28f43000) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r1, &(0x7f0000000180)=@abs, 0x6e) sendmmsg$unix(r2, &(0x7f0000000000), 0x651, 0x0) recvmmsg(r1, &(0x7f00000000c0), 0x10106, 0x2, 0x0) mmap$IORING_OFF_SQ_RING(0x110c230000, 0x8000002, 0x2000007, 0x401d031, 0xffffffffffffffff, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./sys\x00', 0x1ff) mount(0x0, &(0x7f0000000040)='./sys\x00', &(0x7f0000000080)='sysfs\x00', 0x0, 0x0) r3 = openat(0xffffffffffffff9c, 0x0, 0x2, 0x0) write(r3, &(0x7f00000005c0)="306663353a313232373a3f7092c0f0bc085a193376cf620afaf6379a248d1d6534058f1095109da34b6d6537a6e78b0dc4b7bc0b", 0x34) r4 = socket$inet_tcp(0x2, 0x1, 0x0) ioctl$sock_SIOCGIFINDEX(r4, 0x8933, &(0x7f0000000180)={'syz_tun\x00'}) executing program 7: bpf$MAP_CREATE(0x0, &(0x7f0000000080)=ANY=[], 0x50) bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x0, 0xc, 0x0, 0x0, 0xfffffffd, 0x0, 0x0, 0x0, 0x40, '\x00', 0x0, @fallback=0x10, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) socket(0x10, 0x803, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x1, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000380)={0xa, 0x100008b}, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000200)=0x8) openat$sequencer(0xffffffffffffff9c, &(0x7f00000001c0), 0x80200, 0x0) r0 = syz_open_dev$sndmidi(&(0x7f00000004c0), 0x2, 0x141102) writev(r0, &(0x7f0000000840)=[{&(0x7f00000002c0)="94", 0xf000}, {0x0}], 0x2) ioctl$sock_SIOCGIFINDEX(0xffffffffffffffff, 0x8933, 0x0) r1 = socket$kcm(0xa, 0x3, 0x3a) r2 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r2, &(0x7f0000000480)={0x0, 0x0, &(0x7f0000001f40)={&(0x7f00000004c0)=ANY=[@ANYBLOB="fc000000190001002dbd700000000000ac1e0001000000000000000000000000ac1414aa00"/48, @ANYRES32=0x0, @ANYRES32, @ANYBLOB="00000000000000000c00000000000000000000000000000000000000000000000000000000000000ffffffffffffffff000000000000000000000000000000000000000000000000000a000000000000feffffffff7f40000200000000000008ffffffff00000000010006000000000044000500ac1414bb000000000000000000000000000000003c0000000200000000000000000000000000000000000001060000"], 0xfc}, 0x1, 0x0, 0x0, 0x4008000}, 0x600c010) sendmsg$kcm(r1, &(0x7f0000000080)={&(0x7f0000000000)=@l2tp6={0xa, 0x0, 0x0, @loopback={0xfe80000000000000, 0xac14140c}}, 0x80, &(0x7f00000000c0)=[{&(0x7f0000000140)='\x00\x00', 0xffe3}], 0x1, 0x0, 0x0, 0x900}, 0x60) setsockopt$IPT_SO_SET_REPLACE(0xffffffffffffffff, 0x0, 0x40, 0x0, 0x0) syz_usb_connect(0x3, 0x57, &(0x7f0000000000)=ANY=[@ANYBLOB="1201000200000040402001c60100000000010902450001010080fa0904"], 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000340)='./file1\x00', 0x0) mkdirat(0xffffffffffffff9c, &(0x7f00000000c0)='./bus\x00', 0x1d7) mkdirat(0xffffffffffffff9c, &(0x7f0000000400)='./file1/file0\x00', 0x100) mount$bind(&(0x7f0000000100)='.\x00', &(0x7f0000000080)='./file1/file0\x00', 0x0, 0x1085408, 0x0) r3 = openat$sw_sync(0xffffffffffffff9c, &(0x7f0000000ac0), 0x800, 0x0) ioctl$SW_SYNC_IOC_CREATE_FENCE(r3, 0xc0285700, &(0x7f0000000b00)={0x4, "abacd211119ca94c63377526aeb5ab2c7b9ca5fa07558139ede6dc06270ee042", 0xffffffffffffffff}) ioctl$SYNC_IOC_MERGE(r4, 0xc0303e03, &(0x7f0000000780)={"d1ed39d88b014076ab94c1fb10628c46d2e66ccdb9e581a38ebb0ddd5f307e56", 0xffffffffffffffff, 0xffffffffffffffff}) ioctl$SYNC_IOC_FILE_INFO(r5, 0xc0383e04, 0x0) mount$overlay(0x0, &(0x7f00000000c0)='./bus\x00', &(0x7f00000003c0), 0x40, &(0x7f0000000300)={[{@workdir={'workdir', 0x3d, './bus'}}, {@upperdir={'upperdir', 0x3d, './file1'}}]}) bpf$PROG_LOAD(0x5, 0x0, 0x0) r6 = syz_usb_connect$hid(0x1, 0x36, &(0x7f0000000040)=ANY=[@ANYBLOB="12010000090024206d041cc340000000000109022400010000a00009040000010301010009"], 0x0) r7 = syz_open_procfs(0xffffffffffffffff, &(0x7f0000000080)='stat\x00') read$FUSE(r7, &(0x7f0000004180)={0x2020}, 0x2020) syz_usb_control_io$hid(r6, &(0x7f0000000240)={0x24, &(0x7f00000003c0)=ANY=[@ANYBLOB="00000c000000070001"], 0x0, 0x0, 0x0}, 0x0) executing program 6: syz_usb_connect(0x0, 0x4b, &(0x7f0000000000)=ANY=[@ANYBLOB="1201000200000040480b051000010102000109023900020100803209040000000000000009"], 0x0) r0 = syz_open_dev$dvb_demux(&(0x7f0000000200), 0x1, 0x2) ioctl$DVB_DEMUX_DMX_SET_PES_FILTER(r0, 0x40146f2c, &(0x7f0000000100)={0x1ff, 0x0, 0x3, 0xa, 0x4}) program crashed: general protection fault in mxl111sf_ep6_streaming_ctrl testing program (duration=9m0s, {Threaded:true Repeat:true RepeatTimes:0 Procs:6 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): [17, 30, 3] detailed listing: executing program 0: socket$nl_route(0x10, 0x3, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000140)={0xa, 0x8b}, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000280)=0x8) r0 = getpid() sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x2) sched_setscheduler(r0, 0x2, &(0x7f0000000200)=0x7) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeea, 0x8031, 0xffffffffffffffff, 0x28f43000) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r1, &(0x7f0000000180)=@abs, 0x6e) sendmmsg$unix(r2, &(0x7f0000000000), 0x651, 0x0) recvmmsg(r1, &(0x7f00000000c0), 0x10106, 0x2, 0x0) mmap$IORING_OFF_SQ_RING(0x110c230000, 0x8000002, 0x2000007, 0x401d031, 0xffffffffffffffff, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./sys\x00', 0x1ff) mount(0x0, &(0x7f0000000040)='./sys\x00', &(0x7f0000000080)='sysfs\x00', 0x0, 0x0) r3 = openat(0xffffffffffffff9c, 0x0, 0x2, 0x0) write(r3, &(0x7f00000005c0)="306663353a313232373a3f7092c0f0bc085a193376cf620afaf6379a248d1d6534058f1095109da34b6d6537a6e78b0dc4b7bc0b", 0x34) socket$inet_tcp(0x2, 0x1, 0x0) executing program 7: bpf$MAP_CREATE(0x0, &(0x7f0000000080)=ANY=[], 0x50) bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x0, 0xc, 0x0, 0x0, 0xfffffffd, 0x0, 0x0, 0x0, 0x40, '\x00', 0x0, @fallback=0x10, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) socket(0x10, 0x803, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x1, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000380)={0xa, 0x100008b}, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000200)=0x8) openat$sequencer(0xffffffffffffff9c, &(0x7f00000001c0), 0x80200, 0x0) r0 = syz_open_dev$sndmidi(&(0x7f00000004c0), 0x2, 0x141102) writev(r0, &(0x7f0000000840)=[{&(0x7f00000002c0)="94", 0xf000}, {0x0}], 0x2) ioctl$sock_SIOCGIFINDEX(0xffffffffffffffff, 0x8933, 0x0) r1 = socket$kcm(0xa, 0x3, 0x3a) r2 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r2, &(0x7f0000000480)={0x0, 0x0, &(0x7f0000001f40)={&(0x7f00000004c0)=ANY=[@ANYBLOB="fc000000190001002dbd700000000000ac1e0001000000000000000000000000ac1414aa00"/48, @ANYRES32=0x0, @ANYRES32, @ANYBLOB="00000000000000000c00000000000000000000000000000000000000000000000000000000000000ffffffffffffffff000000000000000000000000000000000000000000000000000a000000000000feffffffff7f40000200000000000008ffffffff00000000010006000000000044000500ac1414bb000000000000000000000000000000003c0000000200000000000000000000000000000000000001060000"], 0xfc}, 0x1, 0x0, 0x0, 0x4008000}, 0x600c010) sendmsg$kcm(r1, &(0x7f0000000080)={&(0x7f0000000000)=@l2tp6={0xa, 0x0, 0x0, @loopback={0xfe80000000000000, 0xac14140c}}, 0x80, &(0x7f00000000c0)=[{&(0x7f0000000140)='\x00\x00', 0xffe3}], 0x1, 0x0, 0x0, 0x900}, 0x60) setsockopt$IPT_SO_SET_REPLACE(0xffffffffffffffff, 0x0, 0x40, 0x0, 0x0) syz_usb_connect(0x3, 0x57, &(0x7f0000000000)=ANY=[@ANYBLOB="1201000200000040402001c60100000000010902450001010080fa0904"], 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000340)='./file1\x00', 0x0) mkdirat(0xffffffffffffff9c, &(0x7f00000000c0)='./bus\x00', 0x1d7) mkdirat(0xffffffffffffff9c, &(0x7f0000000400)='./file1/file0\x00', 0x100) mount$bind(&(0x7f0000000100)='.\x00', &(0x7f0000000080)='./file1/file0\x00', 0x0, 0x1085408, 0x0) r3 = openat$sw_sync(0xffffffffffffff9c, &(0x7f0000000ac0), 0x800, 0x0) ioctl$SW_SYNC_IOC_CREATE_FENCE(r3, 0xc0285700, &(0x7f0000000b00)={0x4, "abacd211119ca94c63377526aeb5ab2c7b9ca5fa07558139ede6dc06270ee042", 0xffffffffffffffff}) ioctl$SYNC_IOC_MERGE(r4, 0xc0303e03, &(0x7f0000000780)={"d1ed39d88b014076ab94c1fb10628c46d2e66ccdb9e581a38ebb0ddd5f307e56", 0xffffffffffffffff, 0xffffffffffffffff}) ioctl$SYNC_IOC_FILE_INFO(r5, 0xc0383e04, 0x0) mount$overlay(0x0, &(0x7f00000000c0)='./bus\x00', &(0x7f00000003c0), 0x40, &(0x7f0000000300)={[{@workdir={'workdir', 0x3d, './bus'}}, {@upperdir={'upperdir', 0x3d, './file1'}}]}) bpf$PROG_LOAD(0x5, 0x0, 0x0) r6 = syz_usb_connect$hid(0x1, 0x36, &(0x7f0000000040)=ANY=[@ANYBLOB="12010000090024206d041cc340000000000109022400010000a00009040000010301010009"], 0x0) r7 = syz_open_procfs(0xffffffffffffffff, &(0x7f0000000080)='stat\x00') read$FUSE(r7, &(0x7f0000004180)={0x2020}, 0x2020) syz_usb_control_io$hid(r6, &(0x7f0000000240)={0x24, &(0x7f00000003c0)=ANY=[@ANYBLOB="00000c000000070001"], 0x0, 0x0, 0x0}, 0x0) executing program 6: syz_usb_connect(0x0, 0x4b, &(0x7f0000000000)=ANY=[@ANYBLOB="1201000200000040480b051000010102000109023900020100803209040000000000000009"], 0x0) r0 = syz_open_dev$dvb_demux(&(0x7f0000000200), 0x1, 0x2) ioctl$DVB_DEMUX_DMX_SET_PES_FILTER(r0, 0x40146f2c, &(0x7f0000000100)={0x1ff, 0x0, 0x3, 0xa, 0x4}) program crashed: general protection fault in mxl111sf_ep6_streaming_ctrl testing program (duration=9m0s, {Threaded:true Repeat:true RepeatTimes:0 Procs:6 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): [16, 30, 3] detailed listing: executing program 0: socket$nl_route(0x10, 0x3, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000140)={0xa, 0x8b}, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000280)=0x8) r0 = getpid() sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x2) sched_setscheduler(r0, 0x2, &(0x7f0000000200)=0x7) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeea, 0x8031, 0xffffffffffffffff, 0x28f43000) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r1, &(0x7f0000000180)=@abs, 0x6e) sendmmsg$unix(r2, &(0x7f0000000000), 0x651, 0x0) recvmmsg(r1, &(0x7f00000000c0), 0x10106, 0x2, 0x0) mmap$IORING_OFF_SQ_RING(0x110c230000, 0x8000002, 0x2000007, 0x401d031, 0xffffffffffffffff, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./sys\x00', 0x1ff) mount(0x0, &(0x7f0000000040)='./sys\x00', &(0x7f0000000080)='sysfs\x00', 0x0, 0x0) r3 = openat(0xffffffffffffff9c, 0x0, 0x2, 0x0) write(r3, &(0x7f00000005c0)="306663353a313232373a3f7092c0f0bc085a193376cf620afaf6379a248d1d6534058f1095109da34b6d6537a6e78b0dc4b7bc0b", 0x34) executing program 7: bpf$MAP_CREATE(0x0, &(0x7f0000000080)=ANY=[], 0x50) bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x0, 0xc, 0x0, 0x0, 0xfffffffd, 0x0, 0x0, 0x0, 0x40, '\x00', 0x0, @fallback=0x10, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) socket(0x10, 0x803, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x1, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000380)={0xa, 0x100008b}, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000200)=0x8) openat$sequencer(0xffffffffffffff9c, &(0x7f00000001c0), 0x80200, 0x0) r0 = syz_open_dev$sndmidi(&(0x7f00000004c0), 0x2, 0x141102) writev(r0, &(0x7f0000000840)=[{&(0x7f00000002c0)="94", 0xf000}, {0x0}], 0x2) ioctl$sock_SIOCGIFINDEX(0xffffffffffffffff, 0x8933, 0x0) r1 = socket$kcm(0xa, 0x3, 0x3a) r2 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r2, &(0x7f0000000480)={0x0, 0x0, &(0x7f0000001f40)={&(0x7f00000004c0)=ANY=[@ANYBLOB="fc000000190001002dbd700000000000ac1e0001000000000000000000000000ac1414aa00"/48, @ANYRES32=0x0, @ANYRES32, @ANYBLOB="00000000000000000c00000000000000000000000000000000000000000000000000000000000000ffffffffffffffff000000000000000000000000000000000000000000000000000a000000000000feffffffff7f40000200000000000008ffffffff00000000010006000000000044000500ac1414bb000000000000000000000000000000003c0000000200000000000000000000000000000000000001060000"], 0xfc}, 0x1, 0x0, 0x0, 0x4008000}, 0x600c010) sendmsg$kcm(r1, &(0x7f0000000080)={&(0x7f0000000000)=@l2tp6={0xa, 0x0, 0x0, @loopback={0xfe80000000000000, 0xac14140c}}, 0x80, &(0x7f00000000c0)=[{&(0x7f0000000140)='\x00\x00', 0xffe3}], 0x1, 0x0, 0x0, 0x900}, 0x60) setsockopt$IPT_SO_SET_REPLACE(0xffffffffffffffff, 0x0, 0x40, 0x0, 0x0) syz_usb_connect(0x3, 0x57, &(0x7f0000000000)=ANY=[@ANYBLOB="1201000200000040402001c60100000000010902450001010080fa0904"], 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000340)='./file1\x00', 0x0) mkdirat(0xffffffffffffff9c, &(0x7f00000000c0)='./bus\x00', 0x1d7) mkdirat(0xffffffffffffff9c, &(0x7f0000000400)='./file1/file0\x00', 0x100) mount$bind(&(0x7f0000000100)='.\x00', &(0x7f0000000080)='./file1/file0\x00', 0x0, 0x1085408, 0x0) r3 = openat$sw_sync(0xffffffffffffff9c, &(0x7f0000000ac0), 0x800, 0x0) ioctl$SW_SYNC_IOC_CREATE_FENCE(r3, 0xc0285700, &(0x7f0000000b00)={0x4, "abacd211119ca94c63377526aeb5ab2c7b9ca5fa07558139ede6dc06270ee042", 0xffffffffffffffff}) ioctl$SYNC_IOC_MERGE(r4, 0xc0303e03, &(0x7f0000000780)={"d1ed39d88b014076ab94c1fb10628c46d2e66ccdb9e581a38ebb0ddd5f307e56", 0xffffffffffffffff, 0xffffffffffffffff}) ioctl$SYNC_IOC_FILE_INFO(r5, 0xc0383e04, 0x0) mount$overlay(0x0, &(0x7f00000000c0)='./bus\x00', &(0x7f00000003c0), 0x40, &(0x7f0000000300)={[{@workdir={'workdir', 0x3d, './bus'}}, {@upperdir={'upperdir', 0x3d, './file1'}}]}) bpf$PROG_LOAD(0x5, 0x0, 0x0) r6 = syz_usb_connect$hid(0x1, 0x36, &(0x7f0000000040)=ANY=[@ANYBLOB="12010000090024206d041cc340000000000109022400010000a00009040000010301010009"], 0x0) r7 = syz_open_procfs(0xffffffffffffffff, &(0x7f0000000080)='stat\x00') read$FUSE(r7, &(0x7f0000004180)={0x2020}, 0x2020) syz_usb_control_io$hid(r6, &(0x7f0000000240)={0x24, &(0x7f00000003c0)=ANY=[@ANYBLOB="00000c000000070001"], 0x0, 0x0, 0x0}, 0x0) executing program 6: syz_usb_connect(0x0, 0x4b, &(0x7f0000000000)=ANY=[@ANYBLOB="1201000200000040480b051000010102000109023900020100803209040000000000000009"], 0x0) r0 = syz_open_dev$dvb_demux(&(0x7f0000000200), 0x1, 0x2) ioctl$DVB_DEMUX_DMX_SET_PES_FILTER(r0, 0x40146f2c, &(0x7f0000000100)={0x1ff, 0x0, 0x3, 0xa, 0x4}) program crashed: general protection fault in mxl111sf_ep6_streaming_ctrl testing program (duration=9m0s, {Threaded:true Repeat:true RepeatTimes:0 Procs:6 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): [15, 30, 3] detailed listing: executing program 0: socket$nl_route(0x10, 0x3, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000140)={0xa, 0x8b}, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000280)=0x8) r0 = getpid() sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x2) sched_setscheduler(r0, 0x2, &(0x7f0000000200)=0x7) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeea, 0x8031, 0xffffffffffffffff, 0x28f43000) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r1, &(0x7f0000000180)=@abs, 0x6e) sendmmsg$unix(r2, &(0x7f0000000000), 0x651, 0x0) recvmmsg(r1, &(0x7f00000000c0), 0x10106, 0x2, 0x0) mmap$IORING_OFF_SQ_RING(0x110c230000, 0x8000002, 0x2000007, 0x401d031, 0xffffffffffffffff, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./sys\x00', 0x1ff) mount(0x0, &(0x7f0000000040)='./sys\x00', &(0x7f0000000080)='sysfs\x00', 0x0, 0x0) openat(0xffffffffffffff9c, 0x0, 0x2, 0x0) executing program 7: bpf$MAP_CREATE(0x0, &(0x7f0000000080)=ANY=[], 0x50) bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x0, 0xc, 0x0, 0x0, 0xfffffffd, 0x0, 0x0, 0x0, 0x40, '\x00', 0x0, @fallback=0x10, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) socket(0x10, 0x803, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x1, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000380)={0xa, 0x100008b}, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000200)=0x8) openat$sequencer(0xffffffffffffff9c, &(0x7f00000001c0), 0x80200, 0x0) r0 = syz_open_dev$sndmidi(&(0x7f00000004c0), 0x2, 0x141102) writev(r0, &(0x7f0000000840)=[{&(0x7f00000002c0)="94", 0xf000}, {0x0}], 0x2) ioctl$sock_SIOCGIFINDEX(0xffffffffffffffff, 0x8933, 0x0) r1 = socket$kcm(0xa, 0x3, 0x3a) r2 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r2, &(0x7f0000000480)={0x0, 0x0, &(0x7f0000001f40)={&(0x7f00000004c0)=ANY=[@ANYBLOB="fc000000190001002dbd700000000000ac1e0001000000000000000000000000ac1414aa00"/48, @ANYRES32=0x0, @ANYRES32, @ANYBLOB="00000000000000000c00000000000000000000000000000000000000000000000000000000000000ffffffffffffffff000000000000000000000000000000000000000000000000000a000000000000feffffffff7f40000200000000000008ffffffff00000000010006000000000044000500ac1414bb000000000000000000000000000000003c0000000200000000000000000000000000000000000001060000"], 0xfc}, 0x1, 0x0, 0x0, 0x4008000}, 0x600c010) sendmsg$kcm(r1, &(0x7f0000000080)={&(0x7f0000000000)=@l2tp6={0xa, 0x0, 0x0, @loopback={0xfe80000000000000, 0xac14140c}}, 0x80, &(0x7f00000000c0)=[{&(0x7f0000000140)='\x00\x00', 0xffe3}], 0x1, 0x0, 0x0, 0x900}, 0x60) setsockopt$IPT_SO_SET_REPLACE(0xffffffffffffffff, 0x0, 0x40, 0x0, 0x0) syz_usb_connect(0x3, 0x57, &(0x7f0000000000)=ANY=[@ANYBLOB="1201000200000040402001c60100000000010902450001010080fa0904"], 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000340)='./file1\x00', 0x0) mkdirat(0xffffffffffffff9c, &(0x7f00000000c0)='./bus\x00', 0x1d7) mkdirat(0xffffffffffffff9c, &(0x7f0000000400)='./file1/file0\x00', 0x100) mount$bind(&(0x7f0000000100)='.\x00', &(0x7f0000000080)='./file1/file0\x00', 0x0, 0x1085408, 0x0) r3 = openat$sw_sync(0xffffffffffffff9c, &(0x7f0000000ac0), 0x800, 0x0) ioctl$SW_SYNC_IOC_CREATE_FENCE(r3, 0xc0285700, &(0x7f0000000b00)={0x4, "abacd211119ca94c63377526aeb5ab2c7b9ca5fa07558139ede6dc06270ee042", 0xffffffffffffffff}) ioctl$SYNC_IOC_MERGE(r4, 0xc0303e03, &(0x7f0000000780)={"d1ed39d88b014076ab94c1fb10628c46d2e66ccdb9e581a38ebb0ddd5f307e56", 0xffffffffffffffff, 0xffffffffffffffff}) ioctl$SYNC_IOC_FILE_INFO(r5, 0xc0383e04, 0x0) mount$overlay(0x0, &(0x7f00000000c0)='./bus\x00', &(0x7f00000003c0), 0x40, &(0x7f0000000300)={[{@workdir={'workdir', 0x3d, './bus'}}, {@upperdir={'upperdir', 0x3d, './file1'}}]}) bpf$PROG_LOAD(0x5, 0x0, 0x0) r6 = syz_usb_connect$hid(0x1, 0x36, &(0x7f0000000040)=ANY=[@ANYBLOB="12010000090024206d041cc340000000000109022400010000a00009040000010301010009"], 0x0) r7 = syz_open_procfs(0xffffffffffffffff, &(0x7f0000000080)='stat\x00') read$FUSE(r7, &(0x7f0000004180)={0x2020}, 0x2020) syz_usb_control_io$hid(r6, &(0x7f0000000240)={0x24, &(0x7f00000003c0)=ANY=[@ANYBLOB="00000c000000070001"], 0x0, 0x0, 0x0}, 0x0) executing program 6: syz_usb_connect(0x0, 0x4b, &(0x7f0000000000)=ANY=[@ANYBLOB="1201000200000040480b051000010102000109023900020100803209040000000000000009"], 0x0) r0 = syz_open_dev$dvb_demux(&(0x7f0000000200), 0x1, 0x2) ioctl$DVB_DEMUX_DMX_SET_PES_FILTER(r0, 0x40146f2c, &(0x7f0000000100)={0x1ff, 0x0, 0x3, 0xa, 0x4}) program crashed: general protection fault in mxl111sf_ep6_streaming_ctrl testing program (duration=9m0s, {Threaded:true Repeat:true RepeatTimes:0 Procs:6 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): [14, 30, 3] detailed listing: executing program 0: socket$nl_route(0x10, 0x3, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000140)={0xa, 0x8b}, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000280)=0x8) r0 = getpid() sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x2) sched_setscheduler(r0, 0x2, &(0x7f0000000200)=0x7) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeea, 0x8031, 0xffffffffffffffff, 0x28f43000) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r1, &(0x7f0000000180)=@abs, 0x6e) sendmmsg$unix(r2, &(0x7f0000000000), 0x651, 0x0) recvmmsg(r1, &(0x7f00000000c0), 0x10106, 0x2, 0x0) mmap$IORING_OFF_SQ_RING(0x110c230000, 0x8000002, 0x2000007, 0x401d031, 0xffffffffffffffff, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./sys\x00', 0x1ff) mount(0x0, &(0x7f0000000040)='./sys\x00', &(0x7f0000000080)='sysfs\x00', 0x0, 0x0) executing program 7: bpf$MAP_CREATE(0x0, &(0x7f0000000080)=ANY=[], 0x50) bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x0, 0xc, 0x0, 0x0, 0xfffffffd, 0x0, 0x0, 0x0, 0x40, '\x00', 0x0, @fallback=0x10, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) socket(0x10, 0x803, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x1, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000380)={0xa, 0x100008b}, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000200)=0x8) openat$sequencer(0xffffffffffffff9c, &(0x7f00000001c0), 0x80200, 0x0) r0 = syz_open_dev$sndmidi(&(0x7f00000004c0), 0x2, 0x141102) writev(r0, &(0x7f0000000840)=[{&(0x7f00000002c0)="94", 0xf000}, {0x0}], 0x2) ioctl$sock_SIOCGIFINDEX(0xffffffffffffffff, 0x8933, 0x0) r1 = socket$kcm(0xa, 0x3, 0x3a) r2 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r2, &(0x7f0000000480)={0x0, 0x0, &(0x7f0000001f40)={&(0x7f00000004c0)=ANY=[@ANYBLOB="fc000000190001002dbd700000000000ac1e0001000000000000000000000000ac1414aa00"/48, @ANYRES32=0x0, @ANYRES32, @ANYBLOB="00000000000000000c00000000000000000000000000000000000000000000000000000000000000ffffffffffffffff000000000000000000000000000000000000000000000000000a000000000000feffffffff7f40000200000000000008ffffffff00000000010006000000000044000500ac1414bb000000000000000000000000000000003c0000000200000000000000000000000000000000000001060000"], 0xfc}, 0x1, 0x0, 0x0, 0x4008000}, 0x600c010) sendmsg$kcm(r1, &(0x7f0000000080)={&(0x7f0000000000)=@l2tp6={0xa, 0x0, 0x0, @loopback={0xfe80000000000000, 0xac14140c}}, 0x80, &(0x7f00000000c0)=[{&(0x7f0000000140)='\x00\x00', 0xffe3}], 0x1, 0x0, 0x0, 0x900}, 0x60) setsockopt$IPT_SO_SET_REPLACE(0xffffffffffffffff, 0x0, 0x40, 0x0, 0x0) syz_usb_connect(0x3, 0x57, &(0x7f0000000000)=ANY=[@ANYBLOB="1201000200000040402001c60100000000010902450001010080fa0904"], 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000340)='./file1\x00', 0x0) mkdirat(0xffffffffffffff9c, &(0x7f00000000c0)='./bus\x00', 0x1d7) mkdirat(0xffffffffffffff9c, &(0x7f0000000400)='./file1/file0\x00', 0x100) mount$bind(&(0x7f0000000100)='.\x00', &(0x7f0000000080)='./file1/file0\x00', 0x0, 0x1085408, 0x0) r3 = openat$sw_sync(0xffffffffffffff9c, &(0x7f0000000ac0), 0x800, 0x0) ioctl$SW_SYNC_IOC_CREATE_FENCE(r3, 0xc0285700, &(0x7f0000000b00)={0x4, "abacd211119ca94c63377526aeb5ab2c7b9ca5fa07558139ede6dc06270ee042", 0xffffffffffffffff}) ioctl$SYNC_IOC_MERGE(r4, 0xc0303e03, &(0x7f0000000780)={"d1ed39d88b014076ab94c1fb10628c46d2e66ccdb9e581a38ebb0ddd5f307e56", 0xffffffffffffffff, 0xffffffffffffffff}) ioctl$SYNC_IOC_FILE_INFO(r5, 0xc0383e04, 0x0) mount$overlay(0x0, &(0x7f00000000c0)='./bus\x00', &(0x7f00000003c0), 0x40, &(0x7f0000000300)={[{@workdir={'workdir', 0x3d, './bus'}}, {@upperdir={'upperdir', 0x3d, './file1'}}]}) bpf$PROG_LOAD(0x5, 0x0, 0x0) r6 = syz_usb_connect$hid(0x1, 0x36, &(0x7f0000000040)=ANY=[@ANYBLOB="12010000090024206d041cc340000000000109022400010000a00009040000010301010009"], 0x0) r7 = syz_open_procfs(0xffffffffffffffff, &(0x7f0000000080)='stat\x00') read$FUSE(r7, &(0x7f0000004180)={0x2020}, 0x2020) syz_usb_control_io$hid(r6, &(0x7f0000000240)={0x24, &(0x7f00000003c0)=ANY=[@ANYBLOB="00000c000000070001"], 0x0, 0x0, 0x0}, 0x0) executing program 6: syz_usb_connect(0x0, 0x4b, &(0x7f0000000000)=ANY=[@ANYBLOB="1201000200000040480b051000010102000109023900020100803209040000000000000009"], 0x0) r0 = syz_open_dev$dvb_demux(&(0x7f0000000200), 0x1, 0x2) ioctl$DVB_DEMUX_DMX_SET_PES_FILTER(r0, 0x40146f2c, &(0x7f0000000100)={0x1ff, 0x0, 0x3, 0xa, 0x4}) program crashed: general protection fault in mxl111sf_ep6_streaming_ctrl testing program (duration=9m0s, {Threaded:true Repeat:true RepeatTimes:0 Procs:6 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): [13, 30, 3] detailed listing: executing program 0: socket$nl_route(0x10, 0x3, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000140)={0xa, 0x8b}, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000280)=0x8) r0 = getpid() sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x2) sched_setscheduler(r0, 0x2, &(0x7f0000000200)=0x7) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeea, 0x8031, 0xffffffffffffffff, 0x28f43000) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r1, &(0x7f0000000180)=@abs, 0x6e) sendmmsg$unix(r2, &(0x7f0000000000), 0x651, 0x0) recvmmsg(r1, &(0x7f00000000c0), 0x10106, 0x2, 0x0) mmap$IORING_OFF_SQ_RING(0x110c230000, 0x8000002, 0x2000007, 0x401d031, 0xffffffffffffffff, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./sys\x00', 0x1ff) executing program 7: bpf$MAP_CREATE(0x0, &(0x7f0000000080)=ANY=[], 0x50) bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x0, 0xc, 0x0, 0x0, 0xfffffffd, 0x0, 0x0, 0x0, 0x40, '\x00', 0x0, @fallback=0x10, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) socket(0x10, 0x803, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x1, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000380)={0xa, 0x100008b}, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000200)=0x8) openat$sequencer(0xffffffffffffff9c, &(0x7f00000001c0), 0x80200, 0x0) r0 = syz_open_dev$sndmidi(&(0x7f00000004c0), 0x2, 0x141102) writev(r0, &(0x7f0000000840)=[{&(0x7f00000002c0)="94", 0xf000}, {0x0}], 0x2) ioctl$sock_SIOCGIFINDEX(0xffffffffffffffff, 0x8933, 0x0) r1 = socket$kcm(0xa, 0x3, 0x3a) r2 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r2, &(0x7f0000000480)={0x0, 0x0, &(0x7f0000001f40)={&(0x7f00000004c0)=ANY=[@ANYBLOB="fc000000190001002dbd700000000000ac1e0001000000000000000000000000ac1414aa00"/48, @ANYRES32=0x0, @ANYRES32, @ANYBLOB="00000000000000000c00000000000000000000000000000000000000000000000000000000000000ffffffffffffffff000000000000000000000000000000000000000000000000000a000000000000feffffffff7f40000200000000000008ffffffff00000000010006000000000044000500ac1414bb000000000000000000000000000000003c0000000200000000000000000000000000000000000001060000"], 0xfc}, 0x1, 0x0, 0x0, 0x4008000}, 0x600c010) sendmsg$kcm(r1, &(0x7f0000000080)={&(0x7f0000000000)=@l2tp6={0xa, 0x0, 0x0, @loopback={0xfe80000000000000, 0xac14140c}}, 0x80, &(0x7f00000000c0)=[{&(0x7f0000000140)='\x00\x00', 0xffe3}], 0x1, 0x0, 0x0, 0x900}, 0x60) setsockopt$IPT_SO_SET_REPLACE(0xffffffffffffffff, 0x0, 0x40, 0x0, 0x0) syz_usb_connect(0x3, 0x57, &(0x7f0000000000)=ANY=[@ANYBLOB="1201000200000040402001c60100000000010902450001010080fa0904"], 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000340)='./file1\x00', 0x0) mkdirat(0xffffffffffffff9c, &(0x7f00000000c0)='./bus\x00', 0x1d7) mkdirat(0xffffffffffffff9c, &(0x7f0000000400)='./file1/file0\x00', 0x100) mount$bind(&(0x7f0000000100)='.\x00', &(0x7f0000000080)='./file1/file0\x00', 0x0, 0x1085408, 0x0) r3 = openat$sw_sync(0xffffffffffffff9c, &(0x7f0000000ac0), 0x800, 0x0) ioctl$SW_SYNC_IOC_CREATE_FENCE(r3, 0xc0285700, &(0x7f0000000b00)={0x4, "abacd211119ca94c63377526aeb5ab2c7b9ca5fa07558139ede6dc06270ee042", 0xffffffffffffffff}) ioctl$SYNC_IOC_MERGE(r4, 0xc0303e03, &(0x7f0000000780)={"d1ed39d88b014076ab94c1fb10628c46d2e66ccdb9e581a38ebb0ddd5f307e56", 0xffffffffffffffff, 0xffffffffffffffff}) ioctl$SYNC_IOC_FILE_INFO(r5, 0xc0383e04, 0x0) mount$overlay(0x0, &(0x7f00000000c0)='./bus\x00', &(0x7f00000003c0), 0x40, &(0x7f0000000300)={[{@workdir={'workdir', 0x3d, './bus'}}, {@upperdir={'upperdir', 0x3d, './file1'}}]}) bpf$PROG_LOAD(0x5, 0x0, 0x0) r6 = syz_usb_connect$hid(0x1, 0x36, &(0x7f0000000040)=ANY=[@ANYBLOB="12010000090024206d041cc340000000000109022400010000a00009040000010301010009"], 0x0) r7 = syz_open_procfs(0xffffffffffffffff, &(0x7f0000000080)='stat\x00') read$FUSE(r7, &(0x7f0000004180)={0x2020}, 0x2020) syz_usb_control_io$hid(r6, &(0x7f0000000240)={0x24, &(0x7f00000003c0)=ANY=[@ANYBLOB="00000c000000070001"], 0x0, 0x0, 0x0}, 0x0) executing program 6: syz_usb_connect(0x0, 0x4b, &(0x7f0000000000)=ANY=[@ANYBLOB="1201000200000040480b051000010102000109023900020100803209040000000000000009"], 0x0) r0 = syz_open_dev$dvb_demux(&(0x7f0000000200), 0x1, 0x2) ioctl$DVB_DEMUX_DMX_SET_PES_FILTER(r0, 0x40146f2c, &(0x7f0000000100)={0x1ff, 0x0, 0x3, 0xa, 0x4}) program crashed: general protection fault in mxl111sf_ep6_streaming_ctrl testing program (duration=9m0s, {Threaded:true Repeat:true RepeatTimes:0 Procs:6 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): [12, 30, 3] detailed listing: executing program 0: socket$nl_route(0x10, 0x3, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000140)={0xa, 0x8b}, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000280)=0x8) r0 = getpid() sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x2) sched_setscheduler(r0, 0x2, &(0x7f0000000200)=0x7) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeea, 0x8031, 0xffffffffffffffff, 0x28f43000) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r1, &(0x7f0000000180)=@abs, 0x6e) sendmmsg$unix(r2, &(0x7f0000000000), 0x651, 0x0) recvmmsg(r1, &(0x7f00000000c0), 0x10106, 0x2, 0x0) mmap$IORING_OFF_SQ_RING(0x110c230000, 0x8000002, 0x2000007, 0x401d031, 0xffffffffffffffff, 0x0) executing program 7: bpf$MAP_CREATE(0x0, &(0x7f0000000080)=ANY=[], 0x50) bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x0, 0xc, 0x0, 0x0, 0xfffffffd, 0x0, 0x0, 0x0, 0x40, '\x00', 0x0, @fallback=0x10, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) socket(0x10, 0x803, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x1, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000380)={0xa, 0x100008b}, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000200)=0x8) openat$sequencer(0xffffffffffffff9c, &(0x7f00000001c0), 0x80200, 0x0) r0 = syz_open_dev$sndmidi(&(0x7f00000004c0), 0x2, 0x141102) writev(r0, &(0x7f0000000840)=[{&(0x7f00000002c0)="94", 0xf000}, {0x0}], 0x2) ioctl$sock_SIOCGIFINDEX(0xffffffffffffffff, 0x8933, 0x0) r1 = socket$kcm(0xa, 0x3, 0x3a) r2 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r2, &(0x7f0000000480)={0x0, 0x0, &(0x7f0000001f40)={&(0x7f00000004c0)=ANY=[@ANYBLOB="fc000000190001002dbd700000000000ac1e0001000000000000000000000000ac1414aa00"/48, @ANYRES32=0x0, @ANYRES32, @ANYBLOB="00000000000000000c00000000000000000000000000000000000000000000000000000000000000ffffffffffffffff000000000000000000000000000000000000000000000000000a000000000000feffffffff7f40000200000000000008ffffffff00000000010006000000000044000500ac1414bb000000000000000000000000000000003c0000000200000000000000000000000000000000000001060000"], 0xfc}, 0x1, 0x0, 0x0, 0x4008000}, 0x600c010) sendmsg$kcm(r1, &(0x7f0000000080)={&(0x7f0000000000)=@l2tp6={0xa, 0x0, 0x0, @loopback={0xfe80000000000000, 0xac14140c}}, 0x80, &(0x7f00000000c0)=[{&(0x7f0000000140)='\x00\x00', 0xffe3}], 0x1, 0x0, 0x0, 0x900}, 0x60) setsockopt$IPT_SO_SET_REPLACE(0xffffffffffffffff, 0x0, 0x40, 0x0, 0x0) syz_usb_connect(0x3, 0x57, &(0x7f0000000000)=ANY=[@ANYBLOB="1201000200000040402001c60100000000010902450001010080fa0904"], 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000340)='./file1\x00', 0x0) mkdirat(0xffffffffffffff9c, &(0x7f00000000c0)='./bus\x00', 0x1d7) mkdirat(0xffffffffffffff9c, &(0x7f0000000400)='./file1/file0\x00', 0x100) mount$bind(&(0x7f0000000100)='.\x00', &(0x7f0000000080)='./file1/file0\x00', 0x0, 0x1085408, 0x0) r3 = openat$sw_sync(0xffffffffffffff9c, &(0x7f0000000ac0), 0x800, 0x0) ioctl$SW_SYNC_IOC_CREATE_FENCE(r3, 0xc0285700, &(0x7f0000000b00)={0x4, "abacd211119ca94c63377526aeb5ab2c7b9ca5fa07558139ede6dc06270ee042", 0xffffffffffffffff}) ioctl$SYNC_IOC_MERGE(r4, 0xc0303e03, &(0x7f0000000780)={"d1ed39d88b014076ab94c1fb10628c46d2e66ccdb9e581a38ebb0ddd5f307e56", 0xffffffffffffffff, 0xffffffffffffffff}) ioctl$SYNC_IOC_FILE_INFO(r5, 0xc0383e04, 0x0) mount$overlay(0x0, &(0x7f00000000c0)='./bus\x00', &(0x7f00000003c0), 0x40, &(0x7f0000000300)={[{@workdir={'workdir', 0x3d, './bus'}}, {@upperdir={'upperdir', 0x3d, './file1'}}]}) bpf$PROG_LOAD(0x5, 0x0, 0x0) r6 = syz_usb_connect$hid(0x1, 0x36, &(0x7f0000000040)=ANY=[@ANYBLOB="12010000090024206d041cc340000000000109022400010000a00009040000010301010009"], 0x0) r7 = syz_open_procfs(0xffffffffffffffff, &(0x7f0000000080)='stat\x00') read$FUSE(r7, &(0x7f0000004180)={0x2020}, 0x2020) syz_usb_control_io$hid(r6, &(0x7f0000000240)={0x24, &(0x7f00000003c0)=ANY=[@ANYBLOB="00000c000000070001"], 0x0, 0x0, 0x0}, 0x0) executing program 6: syz_usb_connect(0x0, 0x4b, &(0x7f0000000000)=ANY=[@ANYBLOB="1201000200000040480b051000010102000109023900020100803209040000000000000009"], 0x0) r0 = syz_open_dev$dvb_demux(&(0x7f0000000200), 0x1, 0x2) ioctl$DVB_DEMUX_DMX_SET_PES_FILTER(r0, 0x40146f2c, &(0x7f0000000100)={0x1ff, 0x0, 0x3, 0xa, 0x4}) program crashed: general protection fault in mxl111sf_ep6_streaming_ctrl testing program (duration=9m0s, {Threaded:true Repeat:true RepeatTimes:0 Procs:6 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): [11, 30, 3] detailed listing: executing program 0: socket$nl_route(0x10, 0x3, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000140)={0xa, 0x8b}, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000280)=0x8) r0 = getpid() sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x2) sched_setscheduler(r0, 0x2, &(0x7f0000000200)=0x7) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeea, 0x8031, 0xffffffffffffffff, 0x28f43000) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r1, &(0x7f0000000180)=@abs, 0x6e) sendmmsg$unix(r2, &(0x7f0000000000), 0x651, 0x0) recvmmsg(r1, &(0x7f00000000c0), 0x10106, 0x2, 0x0) executing program 7: bpf$MAP_CREATE(0x0, &(0x7f0000000080)=ANY=[], 0x50) bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x0, 0xc, 0x0, 0x0, 0xfffffffd, 0x0, 0x0, 0x0, 0x40, '\x00', 0x0, @fallback=0x10, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) socket(0x10, 0x803, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x1, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000380)={0xa, 0x100008b}, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000200)=0x8) openat$sequencer(0xffffffffffffff9c, &(0x7f00000001c0), 0x80200, 0x0) r0 = syz_open_dev$sndmidi(&(0x7f00000004c0), 0x2, 0x141102) writev(r0, &(0x7f0000000840)=[{&(0x7f00000002c0)="94", 0xf000}, {0x0}], 0x2) ioctl$sock_SIOCGIFINDEX(0xffffffffffffffff, 0x8933, 0x0) r1 = socket$kcm(0xa, 0x3, 0x3a) r2 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r2, &(0x7f0000000480)={0x0, 0x0, &(0x7f0000001f40)={&(0x7f00000004c0)=ANY=[@ANYBLOB="fc000000190001002dbd700000000000ac1e0001000000000000000000000000ac1414aa00"/48, @ANYRES32=0x0, @ANYRES32, @ANYBLOB="00000000000000000c00000000000000000000000000000000000000000000000000000000000000ffffffffffffffff000000000000000000000000000000000000000000000000000a000000000000feffffffff7f40000200000000000008ffffffff00000000010006000000000044000500ac1414bb000000000000000000000000000000003c0000000200000000000000000000000000000000000001060000"], 0xfc}, 0x1, 0x0, 0x0, 0x4008000}, 0x600c010) sendmsg$kcm(r1, &(0x7f0000000080)={&(0x7f0000000000)=@l2tp6={0xa, 0x0, 0x0, @loopback={0xfe80000000000000, 0xac14140c}}, 0x80, &(0x7f00000000c0)=[{&(0x7f0000000140)='\x00\x00', 0xffe3}], 0x1, 0x0, 0x0, 0x900}, 0x60) setsockopt$IPT_SO_SET_REPLACE(0xffffffffffffffff, 0x0, 0x40, 0x0, 0x0) syz_usb_connect(0x3, 0x57, &(0x7f0000000000)=ANY=[@ANYBLOB="1201000200000040402001c60100000000010902450001010080fa0904"], 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000340)='./file1\x00', 0x0) mkdirat(0xffffffffffffff9c, &(0x7f00000000c0)='./bus\x00', 0x1d7) mkdirat(0xffffffffffffff9c, &(0x7f0000000400)='./file1/file0\x00', 0x100) mount$bind(&(0x7f0000000100)='.\x00', &(0x7f0000000080)='./file1/file0\x00', 0x0, 0x1085408, 0x0) r3 = openat$sw_sync(0xffffffffffffff9c, &(0x7f0000000ac0), 0x800, 0x0) ioctl$SW_SYNC_IOC_CREATE_FENCE(r3, 0xc0285700, &(0x7f0000000b00)={0x4, "abacd211119ca94c63377526aeb5ab2c7b9ca5fa07558139ede6dc06270ee042", 0xffffffffffffffff}) ioctl$SYNC_IOC_MERGE(r4, 0xc0303e03, &(0x7f0000000780)={"d1ed39d88b014076ab94c1fb10628c46d2e66ccdb9e581a38ebb0ddd5f307e56", 0xffffffffffffffff, 0xffffffffffffffff}) ioctl$SYNC_IOC_FILE_INFO(r5, 0xc0383e04, 0x0) mount$overlay(0x0, &(0x7f00000000c0)='./bus\x00', &(0x7f00000003c0), 0x40, &(0x7f0000000300)={[{@workdir={'workdir', 0x3d, './bus'}}, {@upperdir={'upperdir', 0x3d, './file1'}}]}) bpf$PROG_LOAD(0x5, 0x0, 0x0) r6 = syz_usb_connect$hid(0x1, 0x36, &(0x7f0000000040)=ANY=[@ANYBLOB="12010000090024206d041cc340000000000109022400010000a00009040000010301010009"], 0x0) r7 = syz_open_procfs(0xffffffffffffffff, &(0x7f0000000080)='stat\x00') read$FUSE(r7, &(0x7f0000004180)={0x2020}, 0x2020) syz_usb_control_io$hid(r6, &(0x7f0000000240)={0x24, &(0x7f00000003c0)=ANY=[@ANYBLOB="00000c000000070001"], 0x0, 0x0, 0x0}, 0x0) executing program 6: syz_usb_connect(0x0, 0x4b, &(0x7f0000000000)=ANY=[@ANYBLOB="1201000200000040480b051000010102000109023900020100803209040000000000000009"], 0x0) r0 = syz_open_dev$dvb_demux(&(0x7f0000000200), 0x1, 0x2) ioctl$DVB_DEMUX_DMX_SET_PES_FILTER(r0, 0x40146f2c, &(0x7f0000000100)={0x1ff, 0x0, 0x3, 0xa, 0x4}) program crashed: general protection fault in mxl111sf_ep6_streaming_ctrl testing program (duration=9m0s, {Threaded:true Repeat:true RepeatTimes:0 Procs:6 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): [10, 30, 3] detailed listing: executing program 0: socket$nl_route(0x10, 0x3, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000140)={0xa, 0x8b}, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000280)=0x8) r0 = getpid() sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x2) sched_setscheduler(r0, 0x2, &(0x7f0000000200)=0x7) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeea, 0x8031, 0xffffffffffffffff, 0x28f43000) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r1, &(0x7f0000000180)=@abs, 0x6e) sendmmsg$unix(r2, &(0x7f0000000000), 0x651, 0x0) executing program 7: bpf$MAP_CREATE(0x0, &(0x7f0000000080)=ANY=[], 0x50) bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x0, 0xc, 0x0, 0x0, 0xfffffffd, 0x0, 0x0, 0x0, 0x40, '\x00', 0x0, @fallback=0x10, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) socket(0x10, 0x803, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x1, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000380)={0xa, 0x100008b}, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000200)=0x8) openat$sequencer(0xffffffffffffff9c, &(0x7f00000001c0), 0x80200, 0x0) r0 = syz_open_dev$sndmidi(&(0x7f00000004c0), 0x2, 0x141102) writev(r0, &(0x7f0000000840)=[{&(0x7f00000002c0)="94", 0xf000}, {0x0}], 0x2) ioctl$sock_SIOCGIFINDEX(0xffffffffffffffff, 0x8933, 0x0) r1 = socket$kcm(0xa, 0x3, 0x3a) r2 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r2, &(0x7f0000000480)={0x0, 0x0, &(0x7f0000001f40)={&(0x7f00000004c0)=ANY=[@ANYBLOB="fc000000190001002dbd700000000000ac1e0001000000000000000000000000ac1414aa00"/48, @ANYRES32=0x0, @ANYRES32, @ANYBLOB="00000000000000000c00000000000000000000000000000000000000000000000000000000000000ffffffffffffffff000000000000000000000000000000000000000000000000000a000000000000feffffffff7f40000200000000000008ffffffff00000000010006000000000044000500ac1414bb000000000000000000000000000000003c0000000200000000000000000000000000000000000001060000"], 0xfc}, 0x1, 0x0, 0x0, 0x4008000}, 0x600c010) sendmsg$kcm(r1, &(0x7f0000000080)={&(0x7f0000000000)=@l2tp6={0xa, 0x0, 0x0, @loopback={0xfe80000000000000, 0xac14140c}}, 0x80, &(0x7f00000000c0)=[{&(0x7f0000000140)='\x00\x00', 0xffe3}], 0x1, 0x0, 0x0, 0x900}, 0x60) setsockopt$IPT_SO_SET_REPLACE(0xffffffffffffffff, 0x0, 0x40, 0x0, 0x0) syz_usb_connect(0x3, 0x57, &(0x7f0000000000)=ANY=[@ANYBLOB="1201000200000040402001c60100000000010902450001010080fa0904"], 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000340)='./file1\x00', 0x0) mkdirat(0xffffffffffffff9c, &(0x7f00000000c0)='./bus\x00', 0x1d7) mkdirat(0xffffffffffffff9c, &(0x7f0000000400)='./file1/file0\x00', 0x100) mount$bind(&(0x7f0000000100)='.\x00', &(0x7f0000000080)='./file1/file0\x00', 0x0, 0x1085408, 0x0) r3 = openat$sw_sync(0xffffffffffffff9c, &(0x7f0000000ac0), 0x800, 0x0) ioctl$SW_SYNC_IOC_CREATE_FENCE(r3, 0xc0285700, &(0x7f0000000b00)={0x4, "abacd211119ca94c63377526aeb5ab2c7b9ca5fa07558139ede6dc06270ee042", 0xffffffffffffffff}) ioctl$SYNC_IOC_MERGE(r4, 0xc0303e03, &(0x7f0000000780)={"d1ed39d88b014076ab94c1fb10628c46d2e66ccdb9e581a38ebb0ddd5f307e56", 0xffffffffffffffff, 0xffffffffffffffff}) ioctl$SYNC_IOC_FILE_INFO(r5, 0xc0383e04, 0x0) mount$overlay(0x0, &(0x7f00000000c0)='./bus\x00', &(0x7f00000003c0), 0x40, &(0x7f0000000300)={[{@workdir={'workdir', 0x3d, './bus'}}, {@upperdir={'upperdir', 0x3d, './file1'}}]}) bpf$PROG_LOAD(0x5, 0x0, 0x0) r6 = syz_usb_connect$hid(0x1, 0x36, &(0x7f0000000040)=ANY=[@ANYBLOB="12010000090024206d041cc340000000000109022400010000a00009040000010301010009"], 0x0) r7 = syz_open_procfs(0xffffffffffffffff, &(0x7f0000000080)='stat\x00') read$FUSE(r7, &(0x7f0000004180)={0x2020}, 0x2020) syz_usb_control_io$hid(r6, &(0x7f0000000240)={0x24, &(0x7f00000003c0)=ANY=[@ANYBLOB="00000c000000070001"], 0x0, 0x0, 0x0}, 0x0) executing program 6: syz_usb_connect(0x0, 0x4b, &(0x7f0000000000)=ANY=[@ANYBLOB="1201000200000040480b051000010102000109023900020100803209040000000000000009"], 0x0) r0 = syz_open_dev$dvb_demux(&(0x7f0000000200), 0x1, 0x2) ioctl$DVB_DEMUX_DMX_SET_PES_FILTER(r0, 0x40146f2c, &(0x7f0000000100)={0x1ff, 0x0, 0x3, 0xa, 0x4}) program crashed: UBSAN: array-index-out-of-bounds in dvb_usb_start_feed testing program (duration=9m0s, {Threaded:true Repeat:true RepeatTimes:0 Procs:6 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): [9, 30, 3] detailed listing: executing program 0: socket$nl_route(0x10, 0x3, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000140)={0xa, 0x8b}, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000280)=0x8) r0 = getpid() sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x2) sched_setscheduler(r0, 0x2, &(0x7f0000000200)=0x7) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeea, 0x8031, 0xffffffffffffffff, 0x28f43000) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff}) connect$unix(r1, &(0x7f0000000180)=@abs, 0x6e) executing program 7: bpf$MAP_CREATE(0x0, &(0x7f0000000080)=ANY=[], 0x50) bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x0, 0xc, 0x0, 0x0, 0xfffffffd, 0x0, 0x0, 0x0, 0x40, '\x00', 0x0, @fallback=0x10, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) socket(0x10, 0x803, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x1, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000380)={0xa, 0x100008b}, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000200)=0x8) openat$sequencer(0xffffffffffffff9c, &(0x7f00000001c0), 0x80200, 0x0) r0 = syz_open_dev$sndmidi(&(0x7f00000004c0), 0x2, 0x141102) writev(r0, &(0x7f0000000840)=[{&(0x7f00000002c0)="94", 0xf000}, {0x0}], 0x2) ioctl$sock_SIOCGIFINDEX(0xffffffffffffffff, 0x8933, 0x0) r1 = socket$kcm(0xa, 0x3, 0x3a) r2 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r2, &(0x7f0000000480)={0x0, 0x0, &(0x7f0000001f40)={&(0x7f00000004c0)=ANY=[@ANYBLOB="fc000000190001002dbd700000000000ac1e0001000000000000000000000000ac1414aa00"/48, @ANYRES32=0x0, @ANYRES32, @ANYBLOB="00000000000000000c00000000000000000000000000000000000000000000000000000000000000ffffffffffffffff000000000000000000000000000000000000000000000000000a000000000000feffffffff7f40000200000000000008ffffffff00000000010006000000000044000500ac1414bb000000000000000000000000000000003c0000000200000000000000000000000000000000000001060000"], 0xfc}, 0x1, 0x0, 0x0, 0x4008000}, 0x600c010) sendmsg$kcm(r1, &(0x7f0000000080)={&(0x7f0000000000)=@l2tp6={0xa, 0x0, 0x0, @loopback={0xfe80000000000000, 0xac14140c}}, 0x80, &(0x7f00000000c0)=[{&(0x7f0000000140)='\x00\x00', 0xffe3}], 0x1, 0x0, 0x0, 0x900}, 0x60) setsockopt$IPT_SO_SET_REPLACE(0xffffffffffffffff, 0x0, 0x40, 0x0, 0x0) syz_usb_connect(0x3, 0x57, &(0x7f0000000000)=ANY=[@ANYBLOB="1201000200000040402001c60100000000010902450001010080fa0904"], 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000340)='./file1\x00', 0x0) mkdirat(0xffffffffffffff9c, &(0x7f00000000c0)='./bus\x00', 0x1d7) mkdirat(0xffffffffffffff9c, &(0x7f0000000400)='./file1/file0\x00', 0x100) mount$bind(&(0x7f0000000100)='.\x00', &(0x7f0000000080)='./file1/file0\x00', 0x0, 0x1085408, 0x0) r3 = openat$sw_sync(0xffffffffffffff9c, &(0x7f0000000ac0), 0x800, 0x0) ioctl$SW_SYNC_IOC_CREATE_FENCE(r3, 0xc0285700, &(0x7f0000000b00)={0x4, "abacd211119ca94c63377526aeb5ab2c7b9ca5fa07558139ede6dc06270ee042", 0xffffffffffffffff}) ioctl$SYNC_IOC_MERGE(r4, 0xc0303e03, &(0x7f0000000780)={"d1ed39d88b014076ab94c1fb10628c46d2e66ccdb9e581a38ebb0ddd5f307e56", 0xffffffffffffffff, 0xffffffffffffffff}) ioctl$SYNC_IOC_FILE_INFO(r5, 0xc0383e04, 0x0) mount$overlay(0x0, &(0x7f00000000c0)='./bus\x00', &(0x7f00000003c0), 0x40, &(0x7f0000000300)={[{@workdir={'workdir', 0x3d, './bus'}}, {@upperdir={'upperdir', 0x3d, './file1'}}]}) bpf$PROG_LOAD(0x5, 0x0, 0x0) r6 = syz_usb_connect$hid(0x1, 0x36, &(0x7f0000000040)=ANY=[@ANYBLOB="12010000090024206d041cc340000000000109022400010000a00009040000010301010009"], 0x0) r7 = syz_open_procfs(0xffffffffffffffff, &(0x7f0000000080)='stat\x00') read$FUSE(r7, &(0x7f0000004180)={0x2020}, 0x2020) syz_usb_control_io$hid(r6, &(0x7f0000000240)={0x24, &(0x7f00000003c0)=ANY=[@ANYBLOB="00000c000000070001"], 0x0, 0x0, 0x0}, 0x0) executing program 6: syz_usb_connect(0x0, 0x4b, &(0x7f0000000000)=ANY=[@ANYBLOB="1201000200000040480b051000010102000109023900020100803209040000000000000009"], 0x0) r0 = syz_open_dev$dvb_demux(&(0x7f0000000200), 0x1, 0x2) ioctl$DVB_DEMUX_DMX_SET_PES_FILTER(r0, 0x40146f2c, &(0x7f0000000100)={0x1ff, 0x0, 0x3, 0xa, 0x4}) program crashed: general protection fault in mxl111sf_ep6_streaming_ctrl testing program (duration=9m0s, {Threaded:true Repeat:true RepeatTimes:0 Procs:6 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): [8, 30, 3] detailed listing: executing program 0: socket$nl_route(0x10, 0x3, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000140)={0xa, 0x8b}, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000280)=0x8) r0 = getpid() sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x2) sched_setscheduler(r0, 0x2, &(0x7f0000000200)=0x7) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeea, 0x8031, 0xffffffffffffffff, 0x28f43000) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)) executing program 7: bpf$MAP_CREATE(0x0, &(0x7f0000000080)=ANY=[], 0x50) bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x0, 0xc, 0x0, 0x0, 0xfffffffd, 0x0, 0x0, 0x0, 0x40, '\x00', 0x0, @fallback=0x10, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) socket(0x10, 0x803, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x1, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000380)={0xa, 0x100008b}, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000200)=0x8) openat$sequencer(0xffffffffffffff9c, &(0x7f00000001c0), 0x80200, 0x0) r0 = syz_open_dev$sndmidi(&(0x7f00000004c0), 0x2, 0x141102) writev(r0, &(0x7f0000000840)=[{&(0x7f00000002c0)="94", 0xf000}, {0x0}], 0x2) ioctl$sock_SIOCGIFINDEX(0xffffffffffffffff, 0x8933, 0x0) r1 = socket$kcm(0xa, 0x3, 0x3a) r2 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r2, &(0x7f0000000480)={0x0, 0x0, &(0x7f0000001f40)={&(0x7f00000004c0)=ANY=[@ANYBLOB="fc000000190001002dbd700000000000ac1e0001000000000000000000000000ac1414aa00"/48, @ANYRES32=0x0, @ANYRES32, @ANYBLOB="00000000000000000c00000000000000000000000000000000000000000000000000000000000000ffffffffffffffff000000000000000000000000000000000000000000000000000a000000000000feffffffff7f40000200000000000008ffffffff00000000010006000000000044000500ac1414bb000000000000000000000000000000003c0000000200000000000000000000000000000000000001060000"], 0xfc}, 0x1, 0x0, 0x0, 0x4008000}, 0x600c010) sendmsg$kcm(r1, &(0x7f0000000080)={&(0x7f0000000000)=@l2tp6={0xa, 0x0, 0x0, @loopback={0xfe80000000000000, 0xac14140c}}, 0x80, &(0x7f00000000c0)=[{&(0x7f0000000140)='\x00\x00', 0xffe3}], 0x1, 0x0, 0x0, 0x900}, 0x60) setsockopt$IPT_SO_SET_REPLACE(0xffffffffffffffff, 0x0, 0x40, 0x0, 0x0) syz_usb_connect(0x3, 0x57, &(0x7f0000000000)=ANY=[@ANYBLOB="1201000200000040402001c60100000000010902450001010080fa0904"], 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000340)='./file1\x00', 0x0) mkdirat(0xffffffffffffff9c, &(0x7f00000000c0)='./bus\x00', 0x1d7) mkdirat(0xffffffffffffff9c, &(0x7f0000000400)='./file1/file0\x00', 0x100) mount$bind(&(0x7f0000000100)='.\x00', &(0x7f0000000080)='./file1/file0\x00', 0x0, 0x1085408, 0x0) r3 = openat$sw_sync(0xffffffffffffff9c, &(0x7f0000000ac0), 0x800, 0x0) ioctl$SW_SYNC_IOC_CREATE_FENCE(r3, 0xc0285700, &(0x7f0000000b00)={0x4, "abacd211119ca94c63377526aeb5ab2c7b9ca5fa07558139ede6dc06270ee042", 0xffffffffffffffff}) ioctl$SYNC_IOC_MERGE(r4, 0xc0303e03, &(0x7f0000000780)={"d1ed39d88b014076ab94c1fb10628c46d2e66ccdb9e581a38ebb0ddd5f307e56", 0xffffffffffffffff, 0xffffffffffffffff}) ioctl$SYNC_IOC_FILE_INFO(r5, 0xc0383e04, 0x0) mount$overlay(0x0, &(0x7f00000000c0)='./bus\x00', &(0x7f00000003c0), 0x40, &(0x7f0000000300)={[{@workdir={'workdir', 0x3d, './bus'}}, {@upperdir={'upperdir', 0x3d, './file1'}}]}) bpf$PROG_LOAD(0x5, 0x0, 0x0) r6 = syz_usb_connect$hid(0x1, 0x36, &(0x7f0000000040)=ANY=[@ANYBLOB="12010000090024206d041cc340000000000109022400010000a00009040000010301010009"], 0x0) r7 = syz_open_procfs(0xffffffffffffffff, &(0x7f0000000080)='stat\x00') read$FUSE(r7, &(0x7f0000004180)={0x2020}, 0x2020) syz_usb_control_io$hid(r6, &(0x7f0000000240)={0x24, &(0x7f00000003c0)=ANY=[@ANYBLOB="00000c000000070001"], 0x0, 0x0, 0x0}, 0x0) executing program 6: syz_usb_connect(0x0, 0x4b, &(0x7f0000000000)=ANY=[@ANYBLOB="1201000200000040480b051000010102000109023900020100803209040000000000000009"], 0x0) r0 = syz_open_dev$dvb_demux(&(0x7f0000000200), 0x1, 0x2) ioctl$DVB_DEMUX_DMX_SET_PES_FILTER(r0, 0x40146f2c, &(0x7f0000000100)={0x1ff, 0x0, 0x3, 0xa, 0x4}) program crashed: general protection fault in mxl111sf_ep6_streaming_ctrl testing program (duration=9m0s, {Threaded:true Repeat:true RepeatTimes:0 Procs:6 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): [7, 30, 3] detailed listing: executing program 0: socket$nl_route(0x10, 0x3, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000140)={0xa, 0x8b}, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000280)=0x8) r0 = getpid() sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x2) sched_setscheduler(r0, 0x2, &(0x7f0000000200)=0x7) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeea, 0x8031, 0xffffffffffffffff, 0x28f43000) executing program 7: bpf$MAP_CREATE(0x0, &(0x7f0000000080)=ANY=[], 0x50) bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x0, 0xc, 0x0, 0x0, 0xfffffffd, 0x0, 0x0, 0x0, 0x40, '\x00', 0x0, @fallback=0x10, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) socket(0x10, 0x803, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x1, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000380)={0xa, 0x100008b}, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000200)=0x8) openat$sequencer(0xffffffffffffff9c, &(0x7f00000001c0), 0x80200, 0x0) r0 = syz_open_dev$sndmidi(&(0x7f00000004c0), 0x2, 0x141102) writev(r0, &(0x7f0000000840)=[{&(0x7f00000002c0)="94", 0xf000}, {0x0}], 0x2) ioctl$sock_SIOCGIFINDEX(0xffffffffffffffff, 0x8933, 0x0) r1 = socket$kcm(0xa, 0x3, 0x3a) r2 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r2, &(0x7f0000000480)={0x0, 0x0, &(0x7f0000001f40)={&(0x7f00000004c0)=ANY=[@ANYBLOB="fc000000190001002dbd700000000000ac1e0001000000000000000000000000ac1414aa00"/48, @ANYRES32=0x0, @ANYRES32, @ANYBLOB="00000000000000000c00000000000000000000000000000000000000000000000000000000000000ffffffffffffffff000000000000000000000000000000000000000000000000000a000000000000feffffffff7f40000200000000000008ffffffff00000000010006000000000044000500ac1414bb000000000000000000000000000000003c0000000200000000000000000000000000000000000001060000"], 0xfc}, 0x1, 0x0, 0x0, 0x4008000}, 0x600c010) sendmsg$kcm(r1, &(0x7f0000000080)={&(0x7f0000000000)=@l2tp6={0xa, 0x0, 0x0, @loopback={0xfe80000000000000, 0xac14140c}}, 0x80, &(0x7f00000000c0)=[{&(0x7f0000000140)='\x00\x00', 0xffe3}], 0x1, 0x0, 0x0, 0x900}, 0x60) setsockopt$IPT_SO_SET_REPLACE(0xffffffffffffffff, 0x0, 0x40, 0x0, 0x0) syz_usb_connect(0x3, 0x57, &(0x7f0000000000)=ANY=[@ANYBLOB="1201000200000040402001c60100000000010902450001010080fa0904"], 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000340)='./file1\x00', 0x0) mkdirat(0xffffffffffffff9c, &(0x7f00000000c0)='./bus\x00', 0x1d7) mkdirat(0xffffffffffffff9c, &(0x7f0000000400)='./file1/file0\x00', 0x100) mount$bind(&(0x7f0000000100)='.\x00', &(0x7f0000000080)='./file1/file0\x00', 0x0, 0x1085408, 0x0) r3 = openat$sw_sync(0xffffffffffffff9c, &(0x7f0000000ac0), 0x800, 0x0) ioctl$SW_SYNC_IOC_CREATE_FENCE(r3, 0xc0285700, &(0x7f0000000b00)={0x4, "abacd211119ca94c63377526aeb5ab2c7b9ca5fa07558139ede6dc06270ee042", 0xffffffffffffffff}) ioctl$SYNC_IOC_MERGE(r4, 0xc0303e03, &(0x7f0000000780)={"d1ed39d88b014076ab94c1fb10628c46d2e66ccdb9e581a38ebb0ddd5f307e56", 0xffffffffffffffff, 0xffffffffffffffff}) ioctl$SYNC_IOC_FILE_INFO(r5, 0xc0383e04, 0x0) mount$overlay(0x0, &(0x7f00000000c0)='./bus\x00', &(0x7f00000003c0), 0x40, &(0x7f0000000300)={[{@workdir={'workdir', 0x3d, './bus'}}, {@upperdir={'upperdir', 0x3d, './file1'}}]}) bpf$PROG_LOAD(0x5, 0x0, 0x0) r6 = syz_usb_connect$hid(0x1, 0x36, &(0x7f0000000040)=ANY=[@ANYBLOB="12010000090024206d041cc340000000000109022400010000a00009040000010301010009"], 0x0) r7 = syz_open_procfs(0xffffffffffffffff, &(0x7f0000000080)='stat\x00') read$FUSE(r7, &(0x7f0000004180)={0x2020}, 0x2020) syz_usb_control_io$hid(r6, &(0x7f0000000240)={0x24, &(0x7f00000003c0)=ANY=[@ANYBLOB="00000c000000070001"], 0x0, 0x0, 0x0}, 0x0) executing program 6: syz_usb_connect(0x0, 0x4b, &(0x7f0000000000)=ANY=[@ANYBLOB="1201000200000040480b051000010102000109023900020100803209040000000000000009"], 0x0) r0 = syz_open_dev$dvb_demux(&(0x7f0000000200), 0x1, 0x2) ioctl$DVB_DEMUX_DMX_SET_PES_FILTER(r0, 0x40146f2c, &(0x7f0000000100)={0x1ff, 0x0, 0x3, 0xa, 0x4}) program crashed: general protection fault in mxl111sf_ep6_streaming_ctrl testing program (duration=9m0s, {Threaded:true Repeat:true RepeatTimes:0 Procs:6 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): [6, 30, 3] detailed listing: executing program 0: socket$nl_route(0x10, 0x3, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000140)={0xa, 0x8b}, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000280)=0x8) r0 = getpid() sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x2) sched_setscheduler(r0, 0x2, &(0x7f0000000200)=0x7) executing program 7: bpf$MAP_CREATE(0x0, &(0x7f0000000080)=ANY=[], 0x50) bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x0, 0xc, 0x0, 0x0, 0xfffffffd, 0x0, 0x0, 0x0, 0x40, '\x00', 0x0, @fallback=0x10, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) socket(0x10, 0x803, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x1, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000380)={0xa, 0x100008b}, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000200)=0x8) openat$sequencer(0xffffffffffffff9c, &(0x7f00000001c0), 0x80200, 0x0) r0 = syz_open_dev$sndmidi(&(0x7f00000004c0), 0x2, 0x141102) writev(r0, &(0x7f0000000840)=[{&(0x7f00000002c0)="94", 0xf000}, {0x0}], 0x2) ioctl$sock_SIOCGIFINDEX(0xffffffffffffffff, 0x8933, 0x0) r1 = socket$kcm(0xa, 0x3, 0x3a) r2 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r2, &(0x7f0000000480)={0x0, 0x0, &(0x7f0000001f40)={&(0x7f00000004c0)=ANY=[@ANYBLOB="fc000000190001002dbd700000000000ac1e0001000000000000000000000000ac1414aa00"/48, @ANYRES32=0x0, @ANYRES32, @ANYBLOB="00000000000000000c00000000000000000000000000000000000000000000000000000000000000ffffffffffffffff000000000000000000000000000000000000000000000000000a000000000000feffffffff7f40000200000000000008ffffffff00000000010006000000000044000500ac1414bb000000000000000000000000000000003c0000000200000000000000000000000000000000000001060000"], 0xfc}, 0x1, 0x0, 0x0, 0x4008000}, 0x600c010) sendmsg$kcm(r1, &(0x7f0000000080)={&(0x7f0000000000)=@l2tp6={0xa, 0x0, 0x0, @loopback={0xfe80000000000000, 0xac14140c}}, 0x80, &(0x7f00000000c0)=[{&(0x7f0000000140)='\x00\x00', 0xffe3}], 0x1, 0x0, 0x0, 0x900}, 0x60) setsockopt$IPT_SO_SET_REPLACE(0xffffffffffffffff, 0x0, 0x40, 0x0, 0x0) syz_usb_connect(0x3, 0x57, &(0x7f0000000000)=ANY=[@ANYBLOB="1201000200000040402001c60100000000010902450001010080fa0904"], 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000340)='./file1\x00', 0x0) mkdirat(0xffffffffffffff9c, &(0x7f00000000c0)='./bus\x00', 0x1d7) mkdirat(0xffffffffffffff9c, &(0x7f0000000400)='./file1/file0\x00', 0x100) mount$bind(&(0x7f0000000100)='.\x00', &(0x7f0000000080)='./file1/file0\x00', 0x0, 0x1085408, 0x0) r3 = openat$sw_sync(0xffffffffffffff9c, &(0x7f0000000ac0), 0x800, 0x0) ioctl$SW_SYNC_IOC_CREATE_FENCE(r3, 0xc0285700, &(0x7f0000000b00)={0x4, "abacd211119ca94c63377526aeb5ab2c7b9ca5fa07558139ede6dc06270ee042", 0xffffffffffffffff}) ioctl$SYNC_IOC_MERGE(r4, 0xc0303e03, &(0x7f0000000780)={"d1ed39d88b014076ab94c1fb10628c46d2e66ccdb9e581a38ebb0ddd5f307e56", 0xffffffffffffffff, 0xffffffffffffffff}) ioctl$SYNC_IOC_FILE_INFO(r5, 0xc0383e04, 0x0) mount$overlay(0x0, &(0x7f00000000c0)='./bus\x00', &(0x7f00000003c0), 0x40, &(0x7f0000000300)={[{@workdir={'workdir', 0x3d, './bus'}}, {@upperdir={'upperdir', 0x3d, './file1'}}]}) bpf$PROG_LOAD(0x5, 0x0, 0x0) r6 = syz_usb_connect$hid(0x1, 0x36, &(0x7f0000000040)=ANY=[@ANYBLOB="12010000090024206d041cc340000000000109022400010000a00009040000010301010009"], 0x0) r7 = syz_open_procfs(0xffffffffffffffff, &(0x7f0000000080)='stat\x00') read$FUSE(r7, &(0x7f0000004180)={0x2020}, 0x2020) syz_usb_control_io$hid(r6, &(0x7f0000000240)={0x24, &(0x7f00000003c0)=ANY=[@ANYBLOB="00000c000000070001"], 0x0, 0x0, 0x0}, 0x0) executing program 6: syz_usb_connect(0x0, 0x4b, &(0x7f0000000000)=ANY=[@ANYBLOB="1201000200000040480b051000010102000109023900020100803209040000000000000009"], 0x0) r0 = syz_open_dev$dvb_demux(&(0x7f0000000200), 0x1, 0x2) ioctl$DVB_DEMUX_DMX_SET_PES_FILTER(r0, 0x40146f2c, &(0x7f0000000100)={0x1ff, 0x0, 0x3, 0xa, 0x4}) program crashed: UBSAN: array-index-out-of-bounds in dvb_usb_start_feed testing program (duration=9m0s, {Threaded:true Repeat:true RepeatTimes:0 Procs:6 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): [5, 30, 3] detailed listing: executing program 0: socket$nl_route(0x10, 0x3, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000140)={0xa, 0x8b}, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000280)=0x8) getpid() sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x2) executing program 7: bpf$MAP_CREATE(0x0, &(0x7f0000000080)=ANY=[], 0x50) bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x0, 0xc, 0x0, 0x0, 0xfffffffd, 0x0, 0x0, 0x0, 0x40, '\x00', 0x0, @fallback=0x10, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) socket(0x10, 0x803, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x1, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000380)={0xa, 0x100008b}, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000200)=0x8) openat$sequencer(0xffffffffffffff9c, &(0x7f00000001c0), 0x80200, 0x0) r0 = syz_open_dev$sndmidi(&(0x7f00000004c0), 0x2, 0x141102) writev(r0, &(0x7f0000000840)=[{&(0x7f00000002c0)="94", 0xf000}, {0x0}], 0x2) ioctl$sock_SIOCGIFINDEX(0xffffffffffffffff, 0x8933, 0x0) r1 = socket$kcm(0xa, 0x3, 0x3a) r2 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r2, &(0x7f0000000480)={0x0, 0x0, &(0x7f0000001f40)={&(0x7f00000004c0)=ANY=[@ANYBLOB="fc000000190001002dbd700000000000ac1e0001000000000000000000000000ac1414aa00"/48, @ANYRES32=0x0, @ANYRES32, @ANYBLOB="00000000000000000c00000000000000000000000000000000000000000000000000000000000000ffffffffffffffff000000000000000000000000000000000000000000000000000a000000000000feffffffff7f40000200000000000008ffffffff00000000010006000000000044000500ac1414bb000000000000000000000000000000003c0000000200000000000000000000000000000000000001060000"], 0xfc}, 0x1, 0x0, 0x0, 0x4008000}, 0x600c010) sendmsg$kcm(r1, &(0x7f0000000080)={&(0x7f0000000000)=@l2tp6={0xa, 0x0, 0x0, @loopback={0xfe80000000000000, 0xac14140c}}, 0x80, &(0x7f00000000c0)=[{&(0x7f0000000140)='\x00\x00', 0xffe3}], 0x1, 0x0, 0x0, 0x900}, 0x60) setsockopt$IPT_SO_SET_REPLACE(0xffffffffffffffff, 0x0, 0x40, 0x0, 0x0) syz_usb_connect(0x3, 0x57, &(0x7f0000000000)=ANY=[@ANYBLOB="1201000200000040402001c60100000000010902450001010080fa0904"], 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000340)='./file1\x00', 0x0) mkdirat(0xffffffffffffff9c, &(0x7f00000000c0)='./bus\x00', 0x1d7) mkdirat(0xffffffffffffff9c, &(0x7f0000000400)='./file1/file0\x00', 0x100) mount$bind(&(0x7f0000000100)='.\x00', &(0x7f0000000080)='./file1/file0\x00', 0x0, 0x1085408, 0x0) r3 = openat$sw_sync(0xffffffffffffff9c, &(0x7f0000000ac0), 0x800, 0x0) ioctl$SW_SYNC_IOC_CREATE_FENCE(r3, 0xc0285700, &(0x7f0000000b00)={0x4, "abacd211119ca94c63377526aeb5ab2c7b9ca5fa07558139ede6dc06270ee042", 0xffffffffffffffff}) ioctl$SYNC_IOC_MERGE(r4, 0xc0303e03, &(0x7f0000000780)={"d1ed39d88b014076ab94c1fb10628c46d2e66ccdb9e581a38ebb0ddd5f307e56", 0xffffffffffffffff, 0xffffffffffffffff}) ioctl$SYNC_IOC_FILE_INFO(r5, 0xc0383e04, 0x0) mount$overlay(0x0, &(0x7f00000000c0)='./bus\x00', &(0x7f00000003c0), 0x40, &(0x7f0000000300)={[{@workdir={'workdir', 0x3d, './bus'}}, {@upperdir={'upperdir', 0x3d, './file1'}}]}) bpf$PROG_LOAD(0x5, 0x0, 0x0) r6 = syz_usb_connect$hid(0x1, 0x36, &(0x7f0000000040)=ANY=[@ANYBLOB="12010000090024206d041cc340000000000109022400010000a00009040000010301010009"], 0x0) r7 = syz_open_procfs(0xffffffffffffffff, &(0x7f0000000080)='stat\x00') read$FUSE(r7, &(0x7f0000004180)={0x2020}, 0x2020) syz_usb_control_io$hid(r6, &(0x7f0000000240)={0x24, &(0x7f00000003c0)=ANY=[@ANYBLOB="00000c000000070001"], 0x0, 0x0, 0x0}, 0x0) executing program 6: syz_usb_connect(0x0, 0x4b, &(0x7f0000000000)=ANY=[@ANYBLOB="1201000200000040480b051000010102000109023900020100803209040000000000000009"], 0x0) r0 = syz_open_dev$dvb_demux(&(0x7f0000000200), 0x1, 0x2) ioctl$DVB_DEMUX_DMX_SET_PES_FILTER(r0, 0x40146f2c, &(0x7f0000000100)={0x1ff, 0x0, 0x3, 0xa, 0x4}) program crashed: general protection fault in mxl111sf_ep6_streaming_ctrl testing program (duration=9m0s, {Threaded:true Repeat:true RepeatTimes:0 Procs:6 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): [4, 30, 3] detailed listing: executing program 0: socket$nl_route(0x10, 0x3, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000140)={0xa, 0x8b}, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000280)=0x8) getpid() executing program 7: bpf$MAP_CREATE(0x0, &(0x7f0000000080)=ANY=[], 0x50) bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x0, 0xc, 0x0, 0x0, 0xfffffffd, 0x0, 0x0, 0x0, 0x40, '\x00', 0x0, @fallback=0x10, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) socket(0x10, 0x803, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x1, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000380)={0xa, 0x100008b}, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000200)=0x8) openat$sequencer(0xffffffffffffff9c, &(0x7f00000001c0), 0x80200, 0x0) r0 = syz_open_dev$sndmidi(&(0x7f00000004c0), 0x2, 0x141102) writev(r0, &(0x7f0000000840)=[{&(0x7f00000002c0)="94", 0xf000}, {0x0}], 0x2) ioctl$sock_SIOCGIFINDEX(0xffffffffffffffff, 0x8933, 0x0) r1 = socket$kcm(0xa, 0x3, 0x3a) r2 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r2, &(0x7f0000000480)={0x0, 0x0, &(0x7f0000001f40)={&(0x7f00000004c0)=ANY=[@ANYBLOB="fc000000190001002dbd700000000000ac1e0001000000000000000000000000ac1414aa00"/48, @ANYRES32=0x0, @ANYRES32, @ANYBLOB="00000000000000000c00000000000000000000000000000000000000000000000000000000000000ffffffffffffffff000000000000000000000000000000000000000000000000000a000000000000feffffffff7f40000200000000000008ffffffff00000000010006000000000044000500ac1414bb000000000000000000000000000000003c0000000200000000000000000000000000000000000001060000"], 0xfc}, 0x1, 0x0, 0x0, 0x4008000}, 0x600c010) sendmsg$kcm(r1, &(0x7f0000000080)={&(0x7f0000000000)=@l2tp6={0xa, 0x0, 0x0, @loopback={0xfe80000000000000, 0xac14140c}}, 0x80, &(0x7f00000000c0)=[{&(0x7f0000000140)='\x00\x00', 0xffe3}], 0x1, 0x0, 0x0, 0x900}, 0x60) setsockopt$IPT_SO_SET_REPLACE(0xffffffffffffffff, 0x0, 0x40, 0x0, 0x0) syz_usb_connect(0x3, 0x57, &(0x7f0000000000)=ANY=[@ANYBLOB="1201000200000040402001c60100000000010902450001010080fa0904"], 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000340)='./file1\x00', 0x0) mkdirat(0xffffffffffffff9c, &(0x7f00000000c0)='./bus\x00', 0x1d7) mkdirat(0xffffffffffffff9c, &(0x7f0000000400)='./file1/file0\x00', 0x100) mount$bind(&(0x7f0000000100)='.\x00', &(0x7f0000000080)='./file1/file0\x00', 0x0, 0x1085408, 0x0) r3 = openat$sw_sync(0xffffffffffffff9c, &(0x7f0000000ac0), 0x800, 0x0) ioctl$SW_SYNC_IOC_CREATE_FENCE(r3, 0xc0285700, &(0x7f0000000b00)={0x4, "abacd211119ca94c63377526aeb5ab2c7b9ca5fa07558139ede6dc06270ee042", 0xffffffffffffffff}) ioctl$SYNC_IOC_MERGE(r4, 0xc0303e03, &(0x7f0000000780)={"d1ed39d88b014076ab94c1fb10628c46d2e66ccdb9e581a38ebb0ddd5f307e56", 0xffffffffffffffff, 0xffffffffffffffff}) ioctl$SYNC_IOC_FILE_INFO(r5, 0xc0383e04, 0x0) mount$overlay(0x0, &(0x7f00000000c0)='./bus\x00', &(0x7f00000003c0), 0x40, &(0x7f0000000300)={[{@workdir={'workdir', 0x3d, './bus'}}, {@upperdir={'upperdir', 0x3d, './file1'}}]}) bpf$PROG_LOAD(0x5, 0x0, 0x0) r6 = syz_usb_connect$hid(0x1, 0x36, &(0x7f0000000040)=ANY=[@ANYBLOB="12010000090024206d041cc340000000000109022400010000a00009040000010301010009"], 0x0) r7 = syz_open_procfs(0xffffffffffffffff, &(0x7f0000000080)='stat\x00') read$FUSE(r7, &(0x7f0000004180)={0x2020}, 0x2020) syz_usb_control_io$hid(r6, &(0x7f0000000240)={0x24, &(0x7f00000003c0)=ANY=[@ANYBLOB="00000c000000070001"], 0x0, 0x0, 0x0}, 0x0) executing program 6: syz_usb_connect(0x0, 0x4b, &(0x7f0000000000)=ANY=[@ANYBLOB="1201000200000040480b051000010102000109023900020100803209040000000000000009"], 0x0) r0 = syz_open_dev$dvb_demux(&(0x7f0000000200), 0x1, 0x2) ioctl$DVB_DEMUX_DMX_SET_PES_FILTER(r0, 0x40146f2c, &(0x7f0000000100)={0x1ff, 0x0, 0x3, 0xa, 0x4}) program crashed: general protection fault in mxl111sf_ep6_streaming_ctrl testing program (duration=9m0s, {Threaded:true Repeat:true RepeatTimes:0 Procs:6 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): [3, 30, 3] detailed listing: executing program 0: socket$nl_route(0x10, 0x3, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000140)={0xa, 0x8b}, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000280)=0x8) executing program 7: bpf$MAP_CREATE(0x0, &(0x7f0000000080)=ANY=[], 0x50) bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x0, 0xc, 0x0, 0x0, 0xfffffffd, 0x0, 0x0, 0x0, 0x40, '\x00', 0x0, @fallback=0x10, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) socket(0x10, 0x803, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x1, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000380)={0xa, 0x100008b}, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000200)=0x8) openat$sequencer(0xffffffffffffff9c, &(0x7f00000001c0), 0x80200, 0x0) r0 = syz_open_dev$sndmidi(&(0x7f00000004c0), 0x2, 0x141102) writev(r0, &(0x7f0000000840)=[{&(0x7f00000002c0)="94", 0xf000}, {0x0}], 0x2) ioctl$sock_SIOCGIFINDEX(0xffffffffffffffff, 0x8933, 0x0) r1 = socket$kcm(0xa, 0x3, 0x3a) r2 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r2, &(0x7f0000000480)={0x0, 0x0, &(0x7f0000001f40)={&(0x7f00000004c0)=ANY=[@ANYBLOB="fc000000190001002dbd700000000000ac1e0001000000000000000000000000ac1414aa00"/48, @ANYRES32=0x0, @ANYRES32, @ANYBLOB="00000000000000000c00000000000000000000000000000000000000000000000000000000000000ffffffffffffffff000000000000000000000000000000000000000000000000000a000000000000feffffffff7f40000200000000000008ffffffff00000000010006000000000044000500ac1414bb000000000000000000000000000000003c0000000200000000000000000000000000000000000001060000"], 0xfc}, 0x1, 0x0, 0x0, 0x4008000}, 0x600c010) sendmsg$kcm(r1, &(0x7f0000000080)={&(0x7f0000000000)=@l2tp6={0xa, 0x0, 0x0, @loopback={0xfe80000000000000, 0xac14140c}}, 0x80, &(0x7f00000000c0)=[{&(0x7f0000000140)='\x00\x00', 0xffe3}], 0x1, 0x0, 0x0, 0x900}, 0x60) setsockopt$IPT_SO_SET_REPLACE(0xffffffffffffffff, 0x0, 0x40, 0x0, 0x0) syz_usb_connect(0x3, 0x57, &(0x7f0000000000)=ANY=[@ANYBLOB="1201000200000040402001c60100000000010902450001010080fa0904"], 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000340)='./file1\x00', 0x0) mkdirat(0xffffffffffffff9c, &(0x7f00000000c0)='./bus\x00', 0x1d7) mkdirat(0xffffffffffffff9c, &(0x7f0000000400)='./file1/file0\x00', 0x100) mount$bind(&(0x7f0000000100)='.\x00', &(0x7f0000000080)='./file1/file0\x00', 0x0, 0x1085408, 0x0) r3 = openat$sw_sync(0xffffffffffffff9c, &(0x7f0000000ac0), 0x800, 0x0) ioctl$SW_SYNC_IOC_CREATE_FENCE(r3, 0xc0285700, &(0x7f0000000b00)={0x4, "abacd211119ca94c63377526aeb5ab2c7b9ca5fa07558139ede6dc06270ee042", 0xffffffffffffffff}) ioctl$SYNC_IOC_MERGE(r4, 0xc0303e03, &(0x7f0000000780)={"d1ed39d88b014076ab94c1fb10628c46d2e66ccdb9e581a38ebb0ddd5f307e56", 0xffffffffffffffff, 0xffffffffffffffff}) ioctl$SYNC_IOC_FILE_INFO(r5, 0xc0383e04, 0x0) mount$overlay(0x0, &(0x7f00000000c0)='./bus\x00', &(0x7f00000003c0), 0x40, &(0x7f0000000300)={[{@workdir={'workdir', 0x3d, './bus'}}, {@upperdir={'upperdir', 0x3d, './file1'}}]}) bpf$PROG_LOAD(0x5, 0x0, 0x0) r6 = syz_usb_connect$hid(0x1, 0x36, &(0x7f0000000040)=ANY=[@ANYBLOB="12010000090024206d041cc340000000000109022400010000a00009040000010301010009"], 0x0) r7 = syz_open_procfs(0xffffffffffffffff, &(0x7f0000000080)='stat\x00') read$FUSE(r7, &(0x7f0000004180)={0x2020}, 0x2020) syz_usb_control_io$hid(r6, &(0x7f0000000240)={0x24, &(0x7f00000003c0)=ANY=[@ANYBLOB="00000c000000070001"], 0x0, 0x0, 0x0}, 0x0) executing program 6: syz_usb_connect(0x0, 0x4b, &(0x7f0000000000)=ANY=[@ANYBLOB="1201000200000040480b051000010102000109023900020100803209040000000000000009"], 0x0) r0 = syz_open_dev$dvb_demux(&(0x7f0000000200), 0x1, 0x2) ioctl$DVB_DEMUX_DMX_SET_PES_FILTER(r0, 0x40146f2c, &(0x7f0000000100)={0x1ff, 0x0, 0x3, 0xa, 0x4}) program crashed: general protection fault in mxl111sf_ep6_streaming_ctrl testing program (duration=9m0s, {Threaded:true Repeat:true RepeatTimes:0 Procs:6 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): [2, 30, 3] detailed listing: executing program 0: socket$nl_route(0x10, 0x3, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000140)={0xa, 0x8b}, 0x0) executing program 7: bpf$MAP_CREATE(0x0, &(0x7f0000000080)=ANY=[], 0x50) bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x0, 0xc, 0x0, 0x0, 0xfffffffd, 0x0, 0x0, 0x0, 0x40, '\x00', 0x0, @fallback=0x10, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) socket(0x10, 0x803, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x1, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000380)={0xa, 0x100008b}, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000200)=0x8) openat$sequencer(0xffffffffffffff9c, &(0x7f00000001c0), 0x80200, 0x0) r0 = syz_open_dev$sndmidi(&(0x7f00000004c0), 0x2, 0x141102) writev(r0, &(0x7f0000000840)=[{&(0x7f00000002c0)="94", 0xf000}, {0x0}], 0x2) ioctl$sock_SIOCGIFINDEX(0xffffffffffffffff, 0x8933, 0x0) r1 = socket$kcm(0xa, 0x3, 0x3a) r2 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r2, &(0x7f0000000480)={0x0, 0x0, &(0x7f0000001f40)={&(0x7f00000004c0)=ANY=[@ANYBLOB="fc000000190001002dbd700000000000ac1e0001000000000000000000000000ac1414aa00"/48, @ANYRES32=0x0, @ANYRES32, @ANYBLOB="00000000000000000c00000000000000000000000000000000000000000000000000000000000000ffffffffffffffff000000000000000000000000000000000000000000000000000a000000000000feffffffff7f40000200000000000008ffffffff00000000010006000000000044000500ac1414bb000000000000000000000000000000003c0000000200000000000000000000000000000000000001060000"], 0xfc}, 0x1, 0x0, 0x0, 0x4008000}, 0x600c010) sendmsg$kcm(r1, &(0x7f0000000080)={&(0x7f0000000000)=@l2tp6={0xa, 0x0, 0x0, @loopback={0xfe80000000000000, 0xac14140c}}, 0x80, &(0x7f00000000c0)=[{&(0x7f0000000140)='\x00\x00', 0xffe3}], 0x1, 0x0, 0x0, 0x900}, 0x60) setsockopt$IPT_SO_SET_REPLACE(0xffffffffffffffff, 0x0, 0x40, 0x0, 0x0) syz_usb_connect(0x3, 0x57, &(0x7f0000000000)=ANY=[@ANYBLOB="1201000200000040402001c60100000000010902450001010080fa0904"], 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000340)='./file1\x00', 0x0) mkdirat(0xffffffffffffff9c, &(0x7f00000000c0)='./bus\x00', 0x1d7) mkdirat(0xffffffffffffff9c, &(0x7f0000000400)='./file1/file0\x00', 0x100) mount$bind(&(0x7f0000000100)='.\x00', &(0x7f0000000080)='./file1/file0\x00', 0x0, 0x1085408, 0x0) r3 = openat$sw_sync(0xffffffffffffff9c, &(0x7f0000000ac0), 0x800, 0x0) ioctl$SW_SYNC_IOC_CREATE_FENCE(r3, 0xc0285700, &(0x7f0000000b00)={0x4, "abacd211119ca94c63377526aeb5ab2c7b9ca5fa07558139ede6dc06270ee042", 0xffffffffffffffff}) ioctl$SYNC_IOC_MERGE(r4, 0xc0303e03, &(0x7f0000000780)={"d1ed39d88b014076ab94c1fb10628c46d2e66ccdb9e581a38ebb0ddd5f307e56", 0xffffffffffffffff, 0xffffffffffffffff}) ioctl$SYNC_IOC_FILE_INFO(r5, 0xc0383e04, 0x0) mount$overlay(0x0, &(0x7f00000000c0)='./bus\x00', &(0x7f00000003c0), 0x40, &(0x7f0000000300)={[{@workdir={'workdir', 0x3d, './bus'}}, {@upperdir={'upperdir', 0x3d, './file1'}}]}) bpf$PROG_LOAD(0x5, 0x0, 0x0) r6 = syz_usb_connect$hid(0x1, 0x36, &(0x7f0000000040)=ANY=[@ANYBLOB="12010000090024206d041cc340000000000109022400010000a00009040000010301010009"], 0x0) r7 = syz_open_procfs(0xffffffffffffffff, &(0x7f0000000080)='stat\x00') read$FUSE(r7, &(0x7f0000004180)={0x2020}, 0x2020) syz_usb_control_io$hid(r6, &(0x7f0000000240)={0x24, &(0x7f00000003c0)=ANY=[@ANYBLOB="00000c000000070001"], 0x0, 0x0, 0x0}, 0x0) executing program 6: syz_usb_connect(0x0, 0x4b, &(0x7f0000000000)=ANY=[@ANYBLOB="1201000200000040480b051000010102000109023900020100803209040000000000000009"], 0x0) r0 = syz_open_dev$dvb_demux(&(0x7f0000000200), 0x1, 0x2) ioctl$DVB_DEMUX_DMX_SET_PES_FILTER(r0, 0x40146f2c, &(0x7f0000000100)={0x1ff, 0x0, 0x3, 0xa, 0x4}) program crashed: general protection fault in mxl111sf_ep6_streaming_ctrl testing program (duration=9m0s, {Threaded:true Repeat:true RepeatTimes:0 Procs:6 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): [1, 30, 3] detailed listing: executing program 0: socket$nl_route(0x10, 0x3, 0x0) executing program 7: bpf$MAP_CREATE(0x0, &(0x7f0000000080)=ANY=[], 0x50) bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x0, 0xc, 0x0, 0x0, 0xfffffffd, 0x0, 0x0, 0x0, 0x40, '\x00', 0x0, @fallback=0x10, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) socket(0x10, 0x803, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x1, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000380)={0xa, 0x100008b}, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000200)=0x8) openat$sequencer(0xffffffffffffff9c, &(0x7f00000001c0), 0x80200, 0x0) r0 = syz_open_dev$sndmidi(&(0x7f00000004c0), 0x2, 0x141102) writev(r0, &(0x7f0000000840)=[{&(0x7f00000002c0)="94", 0xf000}, {0x0}], 0x2) ioctl$sock_SIOCGIFINDEX(0xffffffffffffffff, 0x8933, 0x0) r1 = socket$kcm(0xa, 0x3, 0x3a) r2 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r2, &(0x7f0000000480)={0x0, 0x0, &(0x7f0000001f40)={&(0x7f00000004c0)=ANY=[@ANYBLOB="fc000000190001002dbd700000000000ac1e0001000000000000000000000000ac1414aa00"/48, @ANYRES32=0x0, @ANYRES32, @ANYBLOB="00000000000000000c00000000000000000000000000000000000000000000000000000000000000ffffffffffffffff000000000000000000000000000000000000000000000000000a000000000000feffffffff7f40000200000000000008ffffffff00000000010006000000000044000500ac1414bb000000000000000000000000000000003c0000000200000000000000000000000000000000000001060000"], 0xfc}, 0x1, 0x0, 0x0, 0x4008000}, 0x600c010) sendmsg$kcm(r1, &(0x7f0000000080)={&(0x7f0000000000)=@l2tp6={0xa, 0x0, 0x0, @loopback={0xfe80000000000000, 0xac14140c}}, 0x80, &(0x7f00000000c0)=[{&(0x7f0000000140)='\x00\x00', 0xffe3}], 0x1, 0x0, 0x0, 0x900}, 0x60) setsockopt$IPT_SO_SET_REPLACE(0xffffffffffffffff, 0x0, 0x40, 0x0, 0x0) syz_usb_connect(0x3, 0x57, &(0x7f0000000000)=ANY=[@ANYBLOB="1201000200000040402001c60100000000010902450001010080fa0904"], 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000340)='./file1\x00', 0x0) mkdirat(0xffffffffffffff9c, &(0x7f00000000c0)='./bus\x00', 0x1d7) mkdirat(0xffffffffffffff9c, &(0x7f0000000400)='./file1/file0\x00', 0x100) mount$bind(&(0x7f0000000100)='.\x00', &(0x7f0000000080)='./file1/file0\x00', 0x0, 0x1085408, 0x0) r3 = openat$sw_sync(0xffffffffffffff9c, &(0x7f0000000ac0), 0x800, 0x0) ioctl$SW_SYNC_IOC_CREATE_FENCE(r3, 0xc0285700, &(0x7f0000000b00)={0x4, "abacd211119ca94c63377526aeb5ab2c7b9ca5fa07558139ede6dc06270ee042", 0xffffffffffffffff}) ioctl$SYNC_IOC_MERGE(r4, 0xc0303e03, &(0x7f0000000780)={"d1ed39d88b014076ab94c1fb10628c46d2e66ccdb9e581a38ebb0ddd5f307e56", 0xffffffffffffffff, 0xffffffffffffffff}) ioctl$SYNC_IOC_FILE_INFO(r5, 0xc0383e04, 0x0) mount$overlay(0x0, &(0x7f00000000c0)='./bus\x00', &(0x7f00000003c0), 0x40, &(0x7f0000000300)={[{@workdir={'workdir', 0x3d, './bus'}}, {@upperdir={'upperdir', 0x3d, './file1'}}]}) bpf$PROG_LOAD(0x5, 0x0, 0x0) r6 = syz_usb_connect$hid(0x1, 0x36, &(0x7f0000000040)=ANY=[@ANYBLOB="12010000090024206d041cc340000000000109022400010000a00009040000010301010009"], 0x0) r7 = syz_open_procfs(0xffffffffffffffff, &(0x7f0000000080)='stat\x00') read$FUSE(r7, &(0x7f0000004180)={0x2020}, 0x2020) syz_usb_control_io$hid(r6, &(0x7f0000000240)={0x24, &(0x7f00000003c0)=ANY=[@ANYBLOB="00000c000000070001"], 0x0, 0x0, 0x0}, 0x0) executing program 6: syz_usb_connect(0x0, 0x4b, &(0x7f0000000000)=ANY=[@ANYBLOB="1201000200000040480b051000010102000109023900020100803209040000000000000009"], 0x0) r0 = syz_open_dev$dvb_demux(&(0x7f0000000200), 0x1, 0x2) ioctl$DVB_DEMUX_DMX_SET_PES_FILTER(r0, 0x40146f2c, &(0x7f0000000100)={0x1ff, 0x0, 0x3, 0xa, 0x4}) program crashed: general protection fault in mxl111sf_ep6_streaming_ctrl testing program (duration=9m0s, {Threaded:true Repeat:true RepeatTimes:0 Procs:6 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): [0, 30, 3] detailed listing: executing program 0: executing program 7: bpf$MAP_CREATE(0x0, &(0x7f0000000080)=ANY=[], 0x50) bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x0, 0xc, 0x0, 0x0, 0xfffffffd, 0x0, 0x0, 0x0, 0x40, '\x00', 0x0, @fallback=0x10, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) socket(0x10, 0x803, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x1, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000380)={0xa, 0x100008b}, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000200)=0x8) openat$sequencer(0xffffffffffffff9c, &(0x7f00000001c0), 0x80200, 0x0) r0 = syz_open_dev$sndmidi(&(0x7f00000004c0), 0x2, 0x141102) writev(r0, &(0x7f0000000840)=[{&(0x7f00000002c0)="94", 0xf000}, {0x0}], 0x2) ioctl$sock_SIOCGIFINDEX(0xffffffffffffffff, 0x8933, 0x0) r1 = socket$kcm(0xa, 0x3, 0x3a) r2 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r2, &(0x7f0000000480)={0x0, 0x0, &(0x7f0000001f40)={&(0x7f00000004c0)=ANY=[@ANYBLOB="fc000000190001002dbd700000000000ac1e0001000000000000000000000000ac1414aa00"/48, @ANYRES32=0x0, @ANYRES32, @ANYBLOB="00000000000000000c00000000000000000000000000000000000000000000000000000000000000ffffffffffffffff000000000000000000000000000000000000000000000000000a000000000000feffffffff7f40000200000000000008ffffffff00000000010006000000000044000500ac1414bb000000000000000000000000000000003c0000000200000000000000000000000000000000000001060000"], 0xfc}, 0x1, 0x0, 0x0, 0x4008000}, 0x600c010) sendmsg$kcm(r1, &(0x7f0000000080)={&(0x7f0000000000)=@l2tp6={0xa, 0x0, 0x0, @loopback={0xfe80000000000000, 0xac14140c}}, 0x80, &(0x7f00000000c0)=[{&(0x7f0000000140)='\x00\x00', 0xffe3}], 0x1, 0x0, 0x0, 0x900}, 0x60) setsockopt$IPT_SO_SET_REPLACE(0xffffffffffffffff, 0x0, 0x40, 0x0, 0x0) syz_usb_connect(0x3, 0x57, &(0x7f0000000000)=ANY=[@ANYBLOB="1201000200000040402001c60100000000010902450001010080fa0904"], 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000340)='./file1\x00', 0x0) mkdirat(0xffffffffffffff9c, &(0x7f00000000c0)='./bus\x00', 0x1d7) mkdirat(0xffffffffffffff9c, &(0x7f0000000400)='./file1/file0\x00', 0x100) mount$bind(&(0x7f0000000100)='.\x00', &(0x7f0000000080)='./file1/file0\x00', 0x0, 0x1085408, 0x0) r3 = openat$sw_sync(0xffffffffffffff9c, &(0x7f0000000ac0), 0x800, 0x0) ioctl$SW_SYNC_IOC_CREATE_FENCE(r3, 0xc0285700, &(0x7f0000000b00)={0x4, "abacd211119ca94c63377526aeb5ab2c7b9ca5fa07558139ede6dc06270ee042", 0xffffffffffffffff}) ioctl$SYNC_IOC_MERGE(r4, 0xc0303e03, &(0x7f0000000780)={"d1ed39d88b014076ab94c1fb10628c46d2e66ccdb9e581a38ebb0ddd5f307e56", 0xffffffffffffffff, 0xffffffffffffffff}) ioctl$SYNC_IOC_FILE_INFO(r5, 0xc0383e04, 0x0) mount$overlay(0x0, &(0x7f00000000c0)='./bus\x00', &(0x7f00000003c0), 0x40, &(0x7f0000000300)={[{@workdir={'workdir', 0x3d, './bus'}}, {@upperdir={'upperdir', 0x3d, './file1'}}]}) bpf$PROG_LOAD(0x5, 0x0, 0x0) r6 = syz_usb_connect$hid(0x1, 0x36, &(0x7f0000000040)=ANY=[@ANYBLOB="12010000090024206d041cc340000000000109022400010000a00009040000010301010009"], 0x0) r7 = syz_open_procfs(0xffffffffffffffff, &(0x7f0000000080)='stat\x00') read$FUSE(r7, &(0x7f0000004180)={0x2020}, 0x2020) syz_usb_control_io$hid(r6, &(0x7f0000000240)={0x24, &(0x7f00000003c0)=ANY=[@ANYBLOB="00000c000000070001"], 0x0, 0x0, 0x0}, 0x0) executing program 6: syz_usb_connect(0x0, 0x4b, &(0x7f0000000000)=ANY=[@ANYBLOB="1201000200000040480b051000010102000109023900020100803209040000000000000009"], 0x0) r0 = syz_open_dev$dvb_demux(&(0x7f0000000200), 0x1, 0x2) ioctl$DVB_DEMUX_DMX_SET_PES_FILTER(r0, 0x40146f2c, &(0x7f0000000100)={0x1ff, 0x0, 0x3, 0xa, 0x4}) program crashed: general protection fault in mxl111sf_ep6_streaming_ctrl minimized 24 calls -> 0 calls minimizing program #1 before concatenation testing program (duration=9m0s, {Threaded:true Repeat:true RepeatTimes:0 Procs:6 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): [0, 29, 3] detailed listing: executing program 0: executing program 0: bpf$MAP_CREATE(0x0, &(0x7f0000000080)=ANY=[], 0x50) bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x0, 0xc, 0x0, 0x0, 0xfffffffd, 0x0, 0x0, 0x0, 0x40, '\x00', 0x0, @fallback=0x10, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) socket(0x10, 0x803, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x1, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000380)={0xa, 0x100008b}, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000200)=0x8) openat$sequencer(0xffffffffffffff9c, &(0x7f00000001c0), 0x80200, 0x0) r0 = syz_open_dev$sndmidi(&(0x7f00000004c0), 0x2, 0x141102) writev(r0, &(0x7f0000000840)=[{&(0x7f00000002c0)="94", 0xf000}, {0x0}], 0x2) ioctl$sock_SIOCGIFINDEX(0xffffffffffffffff, 0x8933, 0x0) r1 = socket$kcm(0xa, 0x3, 0x3a) r2 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r2, &(0x7f0000000480)={0x0, 0x0, &(0x7f0000001f40)={&(0x7f00000004c0)=ANY=[@ANYBLOB="fc000000190001002dbd700000000000ac1e0001000000000000000000000000ac1414aa00"/48, @ANYRES32=0x0, @ANYRES32, @ANYBLOB="00000000000000000c00000000000000000000000000000000000000000000000000000000000000ffffffffffffffff000000000000000000000000000000000000000000000000000a000000000000feffffffff7f40000200000000000008ffffffff00000000010006000000000044000500ac1414bb000000000000000000000000000000003c0000000200000000000000000000000000000000000001060000"], 0xfc}, 0x1, 0x0, 0x0, 0x4008000}, 0x600c010) sendmsg$kcm(r1, &(0x7f0000000080)={&(0x7f0000000000)=@l2tp6={0xa, 0x0, 0x0, @loopback={0xfe80000000000000, 0xac14140c}}, 0x80, &(0x7f00000000c0)=[{&(0x7f0000000140)='\x00\x00', 0xffe3}], 0x1, 0x0, 0x0, 0x900}, 0x60) setsockopt$IPT_SO_SET_REPLACE(0xffffffffffffffff, 0x0, 0x40, 0x0, 0x0) syz_usb_connect(0x3, 0x57, &(0x7f0000000000)=ANY=[@ANYBLOB="1201000200000040402001c60100000000010902450001010080fa0904"], 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000340)='./file1\x00', 0x0) mkdirat(0xffffffffffffff9c, &(0x7f00000000c0)='./bus\x00', 0x1d7) mkdirat(0xffffffffffffff9c, &(0x7f0000000400)='./file1/file0\x00', 0x100) mount$bind(&(0x7f0000000100)='.\x00', &(0x7f0000000080)='./file1/file0\x00', 0x0, 0x1085408, 0x0) r3 = openat$sw_sync(0xffffffffffffff9c, &(0x7f0000000ac0), 0x800, 0x0) ioctl$SW_SYNC_IOC_CREATE_FENCE(r3, 0xc0285700, &(0x7f0000000b00)={0x4, "abacd211119ca94c63377526aeb5ab2c7b9ca5fa07558139ede6dc06270ee042", 0xffffffffffffffff}) ioctl$SYNC_IOC_MERGE(r4, 0xc0303e03, &(0x7f0000000780)={"d1ed39d88b014076ab94c1fb10628c46d2e66ccdb9e581a38ebb0ddd5f307e56", 0xffffffffffffffff, 0xffffffffffffffff}) ioctl$SYNC_IOC_FILE_INFO(r5, 0xc0383e04, 0x0) mount$overlay(0x0, &(0x7f00000000c0)='./bus\x00', &(0x7f00000003c0), 0x40, &(0x7f0000000300)={[{@workdir={'workdir', 0x3d, './bus'}}, {@upperdir={'upperdir', 0x3d, './file1'}}]}) bpf$PROG_LOAD(0x5, 0x0, 0x0) syz_usb_connect$hid(0x1, 0x36, &(0x7f0000000040)=ANY=[@ANYBLOB="12010000090024206d041cc340000000000109022400010000a00009040000010301010009"], 0x0) r6 = syz_open_procfs(0xffffffffffffffff, &(0x7f0000000080)='stat\x00') read$FUSE(r6, &(0x7f0000004180)={0x2020}, 0x2020) executing program 6: syz_usb_connect(0x0, 0x4b, &(0x7f0000000000)=ANY=[@ANYBLOB="1201000200000040480b051000010102000109023900020100803209040000000000000009"], 0x0) r0 = syz_open_dev$dvb_demux(&(0x7f0000000200), 0x1, 0x2) ioctl$DVB_DEMUX_DMX_SET_PES_FILTER(r0, 0x40146f2c, &(0x7f0000000100)={0x1ff, 0x0, 0x3, 0xa, 0x4}) program crashed: general protection fault in mxl111sf_ep6_streaming_ctrl testing program (duration=9m0s, {Threaded:true Repeat:true RepeatTimes:0 Procs:6 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): [0, 28, 3] detailed listing: executing program 0: executing program 0: bpf$MAP_CREATE(0x0, &(0x7f0000000080)=ANY=[], 0x50) bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x0, 0xc, 0x0, 0x0, 0xfffffffd, 0x0, 0x0, 0x0, 0x40, '\x00', 0x0, @fallback=0x10, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) socket(0x10, 0x803, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x1, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000380)={0xa, 0x100008b}, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000200)=0x8) openat$sequencer(0xffffffffffffff9c, &(0x7f00000001c0), 0x80200, 0x0) r0 = syz_open_dev$sndmidi(&(0x7f00000004c0), 0x2, 0x141102) writev(r0, &(0x7f0000000840)=[{&(0x7f00000002c0)="94", 0xf000}, {0x0}], 0x2) ioctl$sock_SIOCGIFINDEX(0xffffffffffffffff, 0x8933, 0x0) r1 = socket$kcm(0xa, 0x3, 0x3a) r2 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r2, &(0x7f0000000480)={0x0, 0x0, &(0x7f0000001f40)={&(0x7f00000004c0)=ANY=[@ANYBLOB="fc000000190001002dbd700000000000ac1e0001000000000000000000000000ac1414aa00"/48, @ANYRES32=0x0, @ANYRES32, @ANYBLOB="00000000000000000c00000000000000000000000000000000000000000000000000000000000000ffffffffffffffff000000000000000000000000000000000000000000000000000a000000000000feffffffff7f40000200000000000008ffffffff00000000010006000000000044000500ac1414bb000000000000000000000000000000003c0000000200000000000000000000000000000000000001060000"], 0xfc}, 0x1, 0x0, 0x0, 0x4008000}, 0x600c010) sendmsg$kcm(r1, &(0x7f0000000080)={&(0x7f0000000000)=@l2tp6={0xa, 0x0, 0x0, @loopback={0xfe80000000000000, 0xac14140c}}, 0x80, &(0x7f00000000c0)=[{&(0x7f0000000140)='\x00\x00', 0xffe3}], 0x1, 0x0, 0x0, 0x900}, 0x60) setsockopt$IPT_SO_SET_REPLACE(0xffffffffffffffff, 0x0, 0x40, 0x0, 0x0) syz_usb_connect(0x3, 0x57, &(0x7f0000000000)=ANY=[@ANYBLOB="1201000200000040402001c60100000000010902450001010080fa0904"], 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000340)='./file1\x00', 0x0) mkdirat(0xffffffffffffff9c, &(0x7f00000000c0)='./bus\x00', 0x1d7) mkdirat(0xffffffffffffff9c, &(0x7f0000000400)='./file1/file0\x00', 0x100) mount$bind(&(0x7f0000000100)='.\x00', &(0x7f0000000080)='./file1/file0\x00', 0x0, 0x1085408, 0x0) r3 = openat$sw_sync(0xffffffffffffff9c, &(0x7f0000000ac0), 0x800, 0x0) ioctl$SW_SYNC_IOC_CREATE_FENCE(r3, 0xc0285700, &(0x7f0000000b00)={0x4, "abacd211119ca94c63377526aeb5ab2c7b9ca5fa07558139ede6dc06270ee042", 0xffffffffffffffff}) ioctl$SYNC_IOC_MERGE(r4, 0xc0303e03, &(0x7f0000000780)={"d1ed39d88b014076ab94c1fb10628c46d2e66ccdb9e581a38ebb0ddd5f307e56", 0xffffffffffffffff, 0xffffffffffffffff}) ioctl$SYNC_IOC_FILE_INFO(r5, 0xc0383e04, 0x0) mount$overlay(0x0, &(0x7f00000000c0)='./bus\x00', &(0x7f00000003c0), 0x40, &(0x7f0000000300)={[{@workdir={'workdir', 0x3d, './bus'}}, {@upperdir={'upperdir', 0x3d, './file1'}}]}) bpf$PROG_LOAD(0x5, 0x0, 0x0) syz_usb_connect$hid(0x1, 0x36, &(0x7f0000000040)=ANY=[@ANYBLOB="12010000090024206d041cc340000000000109022400010000a00009040000010301010009"], 0x0) syz_open_procfs(0xffffffffffffffff, &(0x7f0000000080)='stat\x00') executing program 6: syz_usb_connect(0x0, 0x4b, &(0x7f0000000000)=ANY=[@ANYBLOB="1201000200000040480b051000010102000109023900020100803209040000000000000009"], 0x0) r0 = syz_open_dev$dvb_demux(&(0x7f0000000200), 0x1, 0x2) ioctl$DVB_DEMUX_DMX_SET_PES_FILTER(r0, 0x40146f2c, &(0x7f0000000100)={0x1ff, 0x0, 0x3, 0xa, 0x4}) program crashed: general protection fault in mxl111sf_ep6_streaming_ctrl testing program (duration=9m0s, {Threaded:true Repeat:true RepeatTimes:0 Procs:6 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): [0, 27, 3] detailed listing: executing program 0: executing program 0: bpf$MAP_CREATE(0x0, &(0x7f0000000080)=ANY=[], 0x50) bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x0, 0xc, 0x0, 0x0, 0xfffffffd, 0x0, 0x0, 0x0, 0x40, '\x00', 0x0, @fallback=0x10, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) socket(0x10, 0x803, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x1, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000380)={0xa, 0x100008b}, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000200)=0x8) openat$sequencer(0xffffffffffffff9c, &(0x7f00000001c0), 0x80200, 0x0) r0 = syz_open_dev$sndmidi(&(0x7f00000004c0), 0x2, 0x141102) writev(r0, &(0x7f0000000840)=[{&(0x7f00000002c0)="94", 0xf000}, {0x0}], 0x2) ioctl$sock_SIOCGIFINDEX(0xffffffffffffffff, 0x8933, 0x0) r1 = socket$kcm(0xa, 0x3, 0x3a) r2 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r2, &(0x7f0000000480)={0x0, 0x0, &(0x7f0000001f40)={&(0x7f00000004c0)=ANY=[@ANYBLOB="fc000000190001002dbd700000000000ac1e0001000000000000000000000000ac1414aa00"/48, @ANYRES32=0x0, @ANYRES32, @ANYBLOB="00000000000000000c00000000000000000000000000000000000000000000000000000000000000ffffffffffffffff000000000000000000000000000000000000000000000000000a000000000000feffffffff7f40000200000000000008ffffffff00000000010006000000000044000500ac1414bb000000000000000000000000000000003c0000000200000000000000000000000000000000000001060000"], 0xfc}, 0x1, 0x0, 0x0, 0x4008000}, 0x600c010) sendmsg$kcm(r1, &(0x7f0000000080)={&(0x7f0000000000)=@l2tp6={0xa, 0x0, 0x0, @loopback={0xfe80000000000000, 0xac14140c}}, 0x80, &(0x7f00000000c0)=[{&(0x7f0000000140)='\x00\x00', 0xffe3}], 0x1, 0x0, 0x0, 0x900}, 0x60) setsockopt$IPT_SO_SET_REPLACE(0xffffffffffffffff, 0x0, 0x40, 0x0, 0x0) syz_usb_connect(0x3, 0x57, &(0x7f0000000000)=ANY=[@ANYBLOB="1201000200000040402001c60100000000010902450001010080fa0904"], 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000340)='./file1\x00', 0x0) mkdirat(0xffffffffffffff9c, &(0x7f00000000c0)='./bus\x00', 0x1d7) mkdirat(0xffffffffffffff9c, &(0x7f0000000400)='./file1/file0\x00', 0x100) mount$bind(&(0x7f0000000100)='.\x00', &(0x7f0000000080)='./file1/file0\x00', 0x0, 0x1085408, 0x0) r3 = openat$sw_sync(0xffffffffffffff9c, &(0x7f0000000ac0), 0x800, 0x0) ioctl$SW_SYNC_IOC_CREATE_FENCE(r3, 0xc0285700, &(0x7f0000000b00)={0x4, "abacd211119ca94c63377526aeb5ab2c7b9ca5fa07558139ede6dc06270ee042", 0xffffffffffffffff}) ioctl$SYNC_IOC_MERGE(r4, 0xc0303e03, &(0x7f0000000780)={"d1ed39d88b014076ab94c1fb10628c46d2e66ccdb9e581a38ebb0ddd5f307e56", 0xffffffffffffffff, 0xffffffffffffffff}) ioctl$SYNC_IOC_FILE_INFO(r5, 0xc0383e04, 0x0) mount$overlay(0x0, &(0x7f00000000c0)='./bus\x00', &(0x7f00000003c0), 0x40, &(0x7f0000000300)={[{@workdir={'workdir', 0x3d, './bus'}}, {@upperdir={'upperdir', 0x3d, './file1'}}]}) bpf$PROG_LOAD(0x5, 0x0, 0x0) syz_usb_connect$hid(0x1, 0x36, &(0x7f0000000040)=ANY=[@ANYBLOB="12010000090024206d041cc340000000000109022400010000a00009040000010301010009"], 0x0) executing program 6: syz_usb_connect(0x0, 0x4b, &(0x7f0000000000)=ANY=[@ANYBLOB="1201000200000040480b051000010102000109023900020100803209040000000000000009"], 0x0) r0 = syz_open_dev$dvb_demux(&(0x7f0000000200), 0x1, 0x2) ioctl$DVB_DEMUX_DMX_SET_PES_FILTER(r0, 0x40146f2c, &(0x7f0000000100)={0x1ff, 0x0, 0x3, 0xa, 0x4}) program crashed: general protection fault in mxl111sf_ep6_streaming_ctrl testing program (duration=9m0s, {Threaded:true Repeat:true RepeatTimes:0 Procs:6 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): [0, 26, 3] detailed listing: executing program 0: executing program 0: bpf$MAP_CREATE(0x0, &(0x7f0000000080)=ANY=[], 0x50) bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x0, 0xc, 0x0, 0x0, 0xfffffffd, 0x0, 0x0, 0x0, 0x40, '\x00', 0x0, @fallback=0x10, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) socket(0x10, 0x803, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x1, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000380)={0xa, 0x100008b}, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000200)=0x8) openat$sequencer(0xffffffffffffff9c, &(0x7f00000001c0), 0x80200, 0x0) r0 = syz_open_dev$sndmidi(&(0x7f00000004c0), 0x2, 0x141102) writev(r0, &(0x7f0000000840)=[{&(0x7f00000002c0)="94", 0xf000}, {0x0}], 0x2) ioctl$sock_SIOCGIFINDEX(0xffffffffffffffff, 0x8933, 0x0) r1 = socket$kcm(0xa, 0x3, 0x3a) r2 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r2, &(0x7f0000000480)={0x0, 0x0, &(0x7f0000001f40)={&(0x7f00000004c0)=ANY=[@ANYBLOB="fc000000190001002dbd700000000000ac1e0001000000000000000000000000ac1414aa00"/48, @ANYRES32=0x0, @ANYRES32, @ANYBLOB="00000000000000000c00000000000000000000000000000000000000000000000000000000000000ffffffffffffffff000000000000000000000000000000000000000000000000000a000000000000feffffffff7f40000200000000000008ffffffff00000000010006000000000044000500ac1414bb000000000000000000000000000000003c0000000200000000000000000000000000000000000001060000"], 0xfc}, 0x1, 0x0, 0x0, 0x4008000}, 0x600c010) sendmsg$kcm(r1, &(0x7f0000000080)={&(0x7f0000000000)=@l2tp6={0xa, 0x0, 0x0, @loopback={0xfe80000000000000, 0xac14140c}}, 0x80, &(0x7f00000000c0)=[{&(0x7f0000000140)='\x00\x00', 0xffe3}], 0x1, 0x0, 0x0, 0x900}, 0x60) setsockopt$IPT_SO_SET_REPLACE(0xffffffffffffffff, 0x0, 0x40, 0x0, 0x0) syz_usb_connect(0x3, 0x57, &(0x7f0000000000)=ANY=[@ANYBLOB="1201000200000040402001c60100000000010902450001010080fa0904"], 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000340)='./file1\x00', 0x0) mkdirat(0xffffffffffffff9c, &(0x7f00000000c0)='./bus\x00', 0x1d7) mkdirat(0xffffffffffffff9c, &(0x7f0000000400)='./file1/file0\x00', 0x100) mount$bind(&(0x7f0000000100)='.\x00', &(0x7f0000000080)='./file1/file0\x00', 0x0, 0x1085408, 0x0) r3 = openat$sw_sync(0xffffffffffffff9c, &(0x7f0000000ac0), 0x800, 0x0) ioctl$SW_SYNC_IOC_CREATE_FENCE(r3, 0xc0285700, &(0x7f0000000b00)={0x4, "abacd211119ca94c63377526aeb5ab2c7b9ca5fa07558139ede6dc06270ee042", 0xffffffffffffffff}) ioctl$SYNC_IOC_MERGE(r4, 0xc0303e03, &(0x7f0000000780)={"d1ed39d88b014076ab94c1fb10628c46d2e66ccdb9e581a38ebb0ddd5f307e56", 0xffffffffffffffff, 0xffffffffffffffff}) ioctl$SYNC_IOC_FILE_INFO(r5, 0xc0383e04, 0x0) mount$overlay(0x0, &(0x7f00000000c0)='./bus\x00', &(0x7f00000003c0), 0x40, &(0x7f0000000300)={[{@workdir={'workdir', 0x3d, './bus'}}, {@upperdir={'upperdir', 0x3d, './file1'}}]}) bpf$PROG_LOAD(0x5, 0x0, 0x0) executing program 6: syz_usb_connect(0x0, 0x4b, &(0x7f0000000000)=ANY=[@ANYBLOB="1201000200000040480b051000010102000109023900020100803209040000000000000009"], 0x0) r0 = syz_open_dev$dvb_demux(&(0x7f0000000200), 0x1, 0x2) ioctl$DVB_DEMUX_DMX_SET_PES_FILTER(r0, 0x40146f2c, &(0x7f0000000100)={0x1ff, 0x0, 0x3, 0xa, 0x4}) program crashed: general protection fault in mxl111sf_ep6_streaming_ctrl testing program (duration=9m0s, {Threaded:true Repeat:true RepeatTimes:0 Procs:6 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): [0, 25, 3] detailed listing: executing program 0: executing program 0: bpf$MAP_CREATE(0x0, &(0x7f0000000080)=ANY=[], 0x50) bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x0, 0xc, 0x0, 0x0, 0xfffffffd, 0x0, 0x0, 0x0, 0x40, '\x00', 0x0, @fallback=0x10, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) socket(0x10, 0x803, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x1, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000380)={0xa, 0x100008b}, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000200)=0x8) openat$sequencer(0xffffffffffffff9c, &(0x7f00000001c0), 0x80200, 0x0) r0 = syz_open_dev$sndmidi(&(0x7f00000004c0), 0x2, 0x141102) writev(r0, &(0x7f0000000840)=[{&(0x7f00000002c0)="94", 0xf000}, {0x0}], 0x2) ioctl$sock_SIOCGIFINDEX(0xffffffffffffffff, 0x8933, 0x0) r1 = socket$kcm(0xa, 0x3, 0x3a) r2 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r2, &(0x7f0000000480)={0x0, 0x0, &(0x7f0000001f40)={&(0x7f00000004c0)=ANY=[@ANYBLOB="fc000000190001002dbd700000000000ac1e0001000000000000000000000000ac1414aa00"/48, @ANYRES32=0x0, @ANYRES32, @ANYBLOB="00000000000000000c00000000000000000000000000000000000000000000000000000000000000ffffffffffffffff000000000000000000000000000000000000000000000000000a000000000000feffffffff7f40000200000000000008ffffffff00000000010006000000000044000500ac1414bb000000000000000000000000000000003c0000000200000000000000000000000000000000000001060000"], 0xfc}, 0x1, 0x0, 0x0, 0x4008000}, 0x600c010) sendmsg$kcm(r1, &(0x7f0000000080)={&(0x7f0000000000)=@l2tp6={0xa, 0x0, 0x0, @loopback={0xfe80000000000000, 0xac14140c}}, 0x80, &(0x7f00000000c0)=[{&(0x7f0000000140)='\x00\x00', 0xffe3}], 0x1, 0x0, 0x0, 0x900}, 0x60) setsockopt$IPT_SO_SET_REPLACE(0xffffffffffffffff, 0x0, 0x40, 0x0, 0x0) syz_usb_connect(0x3, 0x57, &(0x7f0000000000)=ANY=[@ANYBLOB="1201000200000040402001c60100000000010902450001010080fa0904"], 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000340)='./file1\x00', 0x0) mkdirat(0xffffffffffffff9c, &(0x7f00000000c0)='./bus\x00', 0x1d7) mkdirat(0xffffffffffffff9c, &(0x7f0000000400)='./file1/file0\x00', 0x100) mount$bind(&(0x7f0000000100)='.\x00', &(0x7f0000000080)='./file1/file0\x00', 0x0, 0x1085408, 0x0) r3 = openat$sw_sync(0xffffffffffffff9c, &(0x7f0000000ac0), 0x800, 0x0) ioctl$SW_SYNC_IOC_CREATE_FENCE(r3, 0xc0285700, &(0x7f0000000b00)={0x4, "abacd211119ca94c63377526aeb5ab2c7b9ca5fa07558139ede6dc06270ee042", 0xffffffffffffffff}) ioctl$SYNC_IOC_MERGE(r4, 0xc0303e03, &(0x7f0000000780)={"d1ed39d88b014076ab94c1fb10628c46d2e66ccdb9e581a38ebb0ddd5f307e56", 0xffffffffffffffff, 0xffffffffffffffff}) ioctl$SYNC_IOC_FILE_INFO(r5, 0xc0383e04, 0x0) mount$overlay(0x0, &(0x7f00000000c0)='./bus\x00', &(0x7f00000003c0), 0x40, &(0x7f0000000300)={[{@workdir={'workdir', 0x3d, './bus'}}, {@upperdir={'upperdir', 0x3d, './file1'}}]}) executing program 6: syz_usb_connect(0x0, 0x4b, &(0x7f0000000000)=ANY=[@ANYBLOB="1201000200000040480b051000010102000109023900020100803209040000000000000009"], 0x0) r0 = syz_open_dev$dvb_demux(&(0x7f0000000200), 0x1, 0x2) ioctl$DVB_DEMUX_DMX_SET_PES_FILTER(r0, 0x40146f2c, &(0x7f0000000100)={0x1ff, 0x0, 0x3, 0xa, 0x4}) program did not crash testing program (duration=9m0s, {Threaded:true Repeat:true RepeatTimes:0 Procs:6 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): [0, 25, 3] detailed listing: executing program 0: executing program 0: bpf$MAP_CREATE(0x0, &(0x7f0000000080)=ANY=[], 0x50) bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x0, 0xc, 0x0, 0x0, 0xfffffffd, 0x0, 0x0, 0x0, 0x40, '\x00', 0x0, @fallback=0x10, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) socket(0x10, 0x803, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x1, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000380)={0xa, 0x100008b}, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000200)=0x8) openat$sequencer(0xffffffffffffff9c, &(0x7f00000001c0), 0x80200, 0x0) r0 = syz_open_dev$sndmidi(&(0x7f00000004c0), 0x2, 0x141102) writev(r0, &(0x7f0000000840)=[{&(0x7f00000002c0)="94", 0xf000}, {0x0}], 0x2) ioctl$sock_SIOCGIFINDEX(0xffffffffffffffff, 0x8933, 0x0) r1 = socket$kcm(0xa, 0x3, 0x3a) r2 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r2, &(0x7f0000000480)={0x0, 0x0, &(0x7f0000001f40)={&(0x7f00000004c0)=ANY=[@ANYBLOB="fc000000190001002dbd700000000000ac1e0001000000000000000000000000ac1414aa00"/48, @ANYRES32=0x0, @ANYRES32, @ANYBLOB="00000000000000000c00000000000000000000000000000000000000000000000000000000000000ffffffffffffffff000000000000000000000000000000000000000000000000000a000000000000feffffffff7f40000200000000000008ffffffff00000000010006000000000044000500ac1414bb000000000000000000000000000000003c0000000200000000000000000000000000000000000001060000"], 0xfc}, 0x1, 0x0, 0x0, 0x4008000}, 0x600c010) sendmsg$kcm(r1, &(0x7f0000000080)={&(0x7f0000000000)=@l2tp6={0xa, 0x0, 0x0, @loopback={0xfe80000000000000, 0xac14140c}}, 0x80, &(0x7f00000000c0)=[{&(0x7f0000000140)='\x00\x00', 0xffe3}], 0x1, 0x0, 0x0, 0x900}, 0x60) setsockopt$IPT_SO_SET_REPLACE(0xffffffffffffffff, 0x0, 0x40, 0x0, 0x0) syz_usb_connect(0x3, 0x57, &(0x7f0000000000)=ANY=[@ANYBLOB="1201000200000040402001c60100000000010902450001010080fa0904"], 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000340)='./file1\x00', 0x0) mkdirat(0xffffffffffffff9c, &(0x7f00000000c0)='./bus\x00', 0x1d7) mkdirat(0xffffffffffffff9c, &(0x7f0000000400)='./file1/file0\x00', 0x100) mount$bind(&(0x7f0000000100)='.\x00', &(0x7f0000000080)='./file1/file0\x00', 0x0, 0x1085408, 0x0) r3 = openat$sw_sync(0xffffffffffffff9c, &(0x7f0000000ac0), 0x800, 0x0) ioctl$SW_SYNC_IOC_CREATE_FENCE(r3, 0xc0285700, &(0x7f0000000b00)={0x4, "abacd211119ca94c63377526aeb5ab2c7b9ca5fa07558139ede6dc06270ee042", 0xffffffffffffffff}) ioctl$SYNC_IOC_MERGE(r4, 0xc0303e03, &(0x7f0000000780)={"d1ed39d88b014076ab94c1fb10628c46d2e66ccdb9e581a38ebb0ddd5f307e56", 0xffffffffffffffff, 0xffffffffffffffff}) ioctl$SYNC_IOC_FILE_INFO(r5, 0xc0383e04, 0x0) bpf$PROG_LOAD(0x5, 0x0, 0x0) executing program 6: syz_usb_connect(0x0, 0x4b, &(0x7f0000000000)=ANY=[@ANYBLOB="1201000200000040480b051000010102000109023900020100803209040000000000000009"], 0x0) r0 = syz_open_dev$dvb_demux(&(0x7f0000000200), 0x1, 0x2) ioctl$DVB_DEMUX_DMX_SET_PES_FILTER(r0, 0x40146f2c, &(0x7f0000000100)={0x1ff, 0x0, 0x3, 0xa, 0x4}) program crashed: general protection fault in mxl111sf_ep6_streaming_ctrl testing program (duration=9m0s, {Threaded:true Repeat:true RepeatTimes:0 Procs:6 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): [0, 24, 3] detailed listing: executing program 0: executing program 0: bpf$MAP_CREATE(0x0, &(0x7f0000000080)=ANY=[], 0x50) bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x0, 0xc, 0x0, 0x0, 0xfffffffd, 0x0, 0x0, 0x0, 0x40, '\x00', 0x0, @fallback=0x10, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) socket(0x10, 0x803, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x1, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000380)={0xa, 0x100008b}, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000200)=0x8) openat$sequencer(0xffffffffffffff9c, &(0x7f00000001c0), 0x80200, 0x0) r0 = syz_open_dev$sndmidi(&(0x7f00000004c0), 0x2, 0x141102) writev(r0, &(0x7f0000000840)=[{&(0x7f00000002c0)="94", 0xf000}, {0x0}], 0x2) ioctl$sock_SIOCGIFINDEX(0xffffffffffffffff, 0x8933, 0x0) r1 = socket$kcm(0xa, 0x3, 0x3a) r2 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r2, &(0x7f0000000480)={0x0, 0x0, &(0x7f0000001f40)={&(0x7f00000004c0)=ANY=[@ANYBLOB="fc000000190001002dbd700000000000ac1e0001000000000000000000000000ac1414aa00"/48, @ANYRES32=0x0, @ANYRES32, @ANYBLOB="00000000000000000c00000000000000000000000000000000000000000000000000000000000000ffffffffffffffff000000000000000000000000000000000000000000000000000a000000000000feffffffff7f40000200000000000008ffffffff00000000010006000000000044000500ac1414bb000000000000000000000000000000003c0000000200000000000000000000000000000000000001060000"], 0xfc}, 0x1, 0x0, 0x0, 0x4008000}, 0x600c010) sendmsg$kcm(r1, &(0x7f0000000080)={&(0x7f0000000000)=@l2tp6={0xa, 0x0, 0x0, @loopback={0xfe80000000000000, 0xac14140c}}, 0x80, &(0x7f00000000c0)=[{&(0x7f0000000140)='\x00\x00', 0xffe3}], 0x1, 0x0, 0x0, 0x900}, 0x60) setsockopt$IPT_SO_SET_REPLACE(0xffffffffffffffff, 0x0, 0x40, 0x0, 0x0) syz_usb_connect(0x3, 0x57, &(0x7f0000000000)=ANY=[@ANYBLOB="1201000200000040402001c60100000000010902450001010080fa0904"], 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000340)='./file1\x00', 0x0) mkdirat(0xffffffffffffff9c, &(0x7f00000000c0)='./bus\x00', 0x1d7) mkdirat(0xffffffffffffff9c, &(0x7f0000000400)='./file1/file0\x00', 0x100) mount$bind(&(0x7f0000000100)='.\x00', &(0x7f0000000080)='./file1/file0\x00', 0x0, 0x1085408, 0x0) r3 = openat$sw_sync(0xffffffffffffff9c, &(0x7f0000000ac0), 0x800, 0x0) ioctl$SW_SYNC_IOC_CREATE_FENCE(r3, 0xc0285700, &(0x7f0000000b00)={0x4, "abacd211119ca94c63377526aeb5ab2c7b9ca5fa07558139ede6dc06270ee042", 0xffffffffffffffff}) ioctl$SYNC_IOC_MERGE(r4, 0xc0303e03, &(0x7f0000000780)={"d1ed39d88b014076ab94c1fb10628c46d2e66ccdb9e581a38ebb0ddd5f307e56"}) bpf$PROG_LOAD(0x5, 0x0, 0x0) executing program 6: syz_usb_connect(0x0, 0x4b, &(0x7f0000000000)=ANY=[@ANYBLOB="1201000200000040480b051000010102000109023900020100803209040000000000000009"], 0x0) r0 = syz_open_dev$dvb_demux(&(0x7f0000000200), 0x1, 0x2) ioctl$DVB_DEMUX_DMX_SET_PES_FILTER(r0, 0x40146f2c, &(0x7f0000000100)={0x1ff, 0x0, 0x3, 0xa, 0x4}) program crashed: general protection fault in mxl111sf_ep6_streaming_ctrl testing program (duration=9m0s, {Threaded:true Repeat:true RepeatTimes:0 Procs:6 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): [0, 23, 3] detailed listing: executing program 0: executing program 0: bpf$MAP_CREATE(0x0, &(0x7f0000000080)=ANY=[], 0x50) bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x0, 0xc, 0x0, 0x0, 0xfffffffd, 0x0, 0x0, 0x0, 0x40, '\x00', 0x0, @fallback=0x10, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) socket(0x10, 0x803, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x1, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000380)={0xa, 0x100008b}, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000200)=0x8) openat$sequencer(0xffffffffffffff9c, &(0x7f00000001c0), 0x80200, 0x0) r0 = syz_open_dev$sndmidi(&(0x7f00000004c0), 0x2, 0x141102) writev(r0, &(0x7f0000000840)=[{&(0x7f00000002c0)="94", 0xf000}, {0x0}], 0x2) ioctl$sock_SIOCGIFINDEX(0xffffffffffffffff, 0x8933, 0x0) r1 = socket$kcm(0xa, 0x3, 0x3a) r2 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r2, &(0x7f0000000480)={0x0, 0x0, &(0x7f0000001f40)={&(0x7f00000004c0)=ANY=[@ANYBLOB="fc000000190001002dbd700000000000ac1e0001000000000000000000000000ac1414aa00"/48, @ANYRES32=0x0, @ANYRES32, @ANYBLOB="00000000000000000c00000000000000000000000000000000000000000000000000000000000000ffffffffffffffff000000000000000000000000000000000000000000000000000a000000000000feffffffff7f40000200000000000008ffffffff00000000010006000000000044000500ac1414bb000000000000000000000000000000003c0000000200000000000000000000000000000000000001060000"], 0xfc}, 0x1, 0x0, 0x0, 0x4008000}, 0x600c010) sendmsg$kcm(r1, &(0x7f0000000080)={&(0x7f0000000000)=@l2tp6={0xa, 0x0, 0x0, @loopback={0xfe80000000000000, 0xac14140c}}, 0x80, &(0x7f00000000c0)=[{&(0x7f0000000140)='\x00\x00', 0xffe3}], 0x1, 0x0, 0x0, 0x900}, 0x60) setsockopt$IPT_SO_SET_REPLACE(0xffffffffffffffff, 0x0, 0x40, 0x0, 0x0) syz_usb_connect(0x3, 0x57, &(0x7f0000000000)=ANY=[@ANYBLOB="1201000200000040402001c60100000000010902450001010080fa0904"], 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000340)='./file1\x00', 0x0) mkdirat(0xffffffffffffff9c, &(0x7f00000000c0)='./bus\x00', 0x1d7) mkdirat(0xffffffffffffff9c, &(0x7f0000000400)='./file1/file0\x00', 0x100) mount$bind(&(0x7f0000000100)='.\x00', &(0x7f0000000080)='./file1/file0\x00', 0x0, 0x1085408, 0x0) r3 = openat$sw_sync(0xffffffffffffff9c, &(0x7f0000000ac0), 0x800, 0x0) ioctl$SW_SYNC_IOC_CREATE_FENCE(r3, 0xc0285700, &(0x7f0000000b00)={0x4, "abacd211119ca94c63377526aeb5ab2c7b9ca5fa07558139ede6dc06270ee042"}) bpf$PROG_LOAD(0x5, 0x0, 0x0) executing program 6: syz_usb_connect(0x0, 0x4b, &(0x7f0000000000)=ANY=[@ANYBLOB="1201000200000040480b051000010102000109023900020100803209040000000000000009"], 0x0) r0 = syz_open_dev$dvb_demux(&(0x7f0000000200), 0x1, 0x2) ioctl$DVB_DEMUX_DMX_SET_PES_FILTER(r0, 0x40146f2c, &(0x7f0000000100)={0x1ff, 0x0, 0x3, 0xa, 0x4}) program crashed: general protection fault in mxl111sf_ep6_streaming_ctrl testing program (duration=9m0s, {Threaded:true Repeat:true RepeatTimes:0 Procs:6 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): [0, 22, 3] detailed listing: executing program 0: executing program 0: bpf$MAP_CREATE(0x0, &(0x7f0000000080)=ANY=[], 0x50) bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x0, 0xc, 0x0, 0x0, 0xfffffffd, 0x0, 0x0, 0x0, 0x40, '\x00', 0x0, @fallback=0x10, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) socket(0x10, 0x803, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x1, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000380)={0xa, 0x100008b}, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000200)=0x8) openat$sequencer(0xffffffffffffff9c, &(0x7f00000001c0), 0x80200, 0x0) r0 = syz_open_dev$sndmidi(&(0x7f00000004c0), 0x2, 0x141102) writev(r0, &(0x7f0000000840)=[{&(0x7f00000002c0)="94", 0xf000}, {0x0}], 0x2) ioctl$sock_SIOCGIFINDEX(0xffffffffffffffff, 0x8933, 0x0) r1 = socket$kcm(0xa, 0x3, 0x3a) r2 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r2, &(0x7f0000000480)={0x0, 0x0, &(0x7f0000001f40)={&(0x7f00000004c0)=ANY=[@ANYBLOB="fc000000190001002dbd700000000000ac1e0001000000000000000000000000ac1414aa00"/48, @ANYRES32=0x0, @ANYRES32, @ANYBLOB="00000000000000000c00000000000000000000000000000000000000000000000000000000000000ffffffffffffffff000000000000000000000000000000000000000000000000000a000000000000feffffffff7f40000200000000000008ffffffff00000000010006000000000044000500ac1414bb000000000000000000000000000000003c0000000200000000000000000000000000000000000001060000"], 0xfc}, 0x1, 0x0, 0x0, 0x4008000}, 0x600c010) sendmsg$kcm(r1, &(0x7f0000000080)={&(0x7f0000000000)=@l2tp6={0xa, 0x0, 0x0, @loopback={0xfe80000000000000, 0xac14140c}}, 0x80, &(0x7f00000000c0)=[{&(0x7f0000000140)='\x00\x00', 0xffe3}], 0x1, 0x0, 0x0, 0x900}, 0x60) setsockopt$IPT_SO_SET_REPLACE(0xffffffffffffffff, 0x0, 0x40, 0x0, 0x0) syz_usb_connect(0x3, 0x57, &(0x7f0000000000)=ANY=[@ANYBLOB="1201000200000040402001c60100000000010902450001010080fa0904"], 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000340)='./file1\x00', 0x0) mkdirat(0xffffffffffffff9c, &(0x7f00000000c0)='./bus\x00', 0x1d7) mkdirat(0xffffffffffffff9c, &(0x7f0000000400)='./file1/file0\x00', 0x100) mount$bind(&(0x7f0000000100)='.\x00', &(0x7f0000000080)='./file1/file0\x00', 0x0, 0x1085408, 0x0) openat$sw_sync(0xffffffffffffff9c, &(0x7f0000000ac0), 0x800, 0x0) bpf$PROG_LOAD(0x5, 0x0, 0x0) executing program 6: syz_usb_connect(0x0, 0x4b, &(0x7f0000000000)=ANY=[@ANYBLOB="1201000200000040480b051000010102000109023900020100803209040000000000000009"], 0x0) r0 = syz_open_dev$dvb_demux(&(0x7f0000000200), 0x1, 0x2) ioctl$DVB_DEMUX_DMX_SET_PES_FILTER(r0, 0x40146f2c, &(0x7f0000000100)={0x1ff, 0x0, 0x3, 0xa, 0x4}) program crashed: general protection fault in mxl111sf_ep6_streaming_ctrl testing program (duration=9m0s, {Threaded:true Repeat:true RepeatTimes:0 Procs:6 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): [0, 21, 3] detailed listing: executing program 0: executing program 0: bpf$MAP_CREATE(0x0, &(0x7f0000000080)=ANY=[], 0x50) bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x0, 0xc, 0x0, 0x0, 0xfffffffd, 0x0, 0x0, 0x0, 0x40, '\x00', 0x0, @fallback=0x10, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) socket(0x10, 0x803, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x1, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000380)={0xa, 0x100008b}, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000200)=0x8) openat$sequencer(0xffffffffffffff9c, &(0x7f00000001c0), 0x80200, 0x0) r0 = syz_open_dev$sndmidi(&(0x7f00000004c0), 0x2, 0x141102) writev(r0, &(0x7f0000000840)=[{&(0x7f00000002c0)="94", 0xf000}, {0x0}], 0x2) ioctl$sock_SIOCGIFINDEX(0xffffffffffffffff, 0x8933, 0x0) r1 = socket$kcm(0xa, 0x3, 0x3a) r2 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r2, &(0x7f0000000480)={0x0, 0x0, &(0x7f0000001f40)={&(0x7f00000004c0)=ANY=[@ANYBLOB="fc000000190001002dbd700000000000ac1e0001000000000000000000000000ac1414aa00"/48, @ANYRES32=0x0, @ANYRES32, @ANYBLOB="00000000000000000c00000000000000000000000000000000000000000000000000000000000000ffffffffffffffff000000000000000000000000000000000000000000000000000a000000000000feffffffff7f40000200000000000008ffffffff00000000010006000000000044000500ac1414bb000000000000000000000000000000003c0000000200000000000000000000000000000000000001060000"], 0xfc}, 0x1, 0x0, 0x0, 0x4008000}, 0x600c010) sendmsg$kcm(r1, &(0x7f0000000080)={&(0x7f0000000000)=@l2tp6={0xa, 0x0, 0x0, @loopback={0xfe80000000000000, 0xac14140c}}, 0x80, &(0x7f00000000c0)=[{&(0x7f0000000140)='\x00\x00', 0xffe3}], 0x1, 0x0, 0x0, 0x900}, 0x60) setsockopt$IPT_SO_SET_REPLACE(0xffffffffffffffff, 0x0, 0x40, 0x0, 0x0) syz_usb_connect(0x3, 0x57, &(0x7f0000000000)=ANY=[@ANYBLOB="1201000200000040402001c60100000000010902450001010080fa0904"], 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000340)='./file1\x00', 0x0) mkdirat(0xffffffffffffff9c, &(0x7f00000000c0)='./bus\x00', 0x1d7) mkdirat(0xffffffffffffff9c, &(0x7f0000000400)='./file1/file0\x00', 0x100) mount$bind(&(0x7f0000000100)='.\x00', &(0x7f0000000080)='./file1/file0\x00', 0x0, 0x1085408, 0x0) bpf$PROG_LOAD(0x5, 0x0, 0x0) executing program 6: syz_usb_connect(0x0, 0x4b, &(0x7f0000000000)=ANY=[@ANYBLOB="1201000200000040480b051000010102000109023900020100803209040000000000000009"], 0x0) r0 = syz_open_dev$dvb_demux(&(0x7f0000000200), 0x1, 0x2) ioctl$DVB_DEMUX_DMX_SET_PES_FILTER(r0, 0x40146f2c, &(0x7f0000000100)={0x1ff, 0x0, 0x3, 0xa, 0x4}) program crashed: general protection fault in mxl111sf_ep6_streaming_ctrl testing program (duration=9m0s, {Threaded:true Repeat:true RepeatTimes:0 Procs:6 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): [0, 20, 3] detailed listing: executing program 0: executing program 0: bpf$MAP_CREATE(0x0, &(0x7f0000000080)=ANY=[], 0x50) bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x0, 0xc, 0x0, 0x0, 0xfffffffd, 0x0, 0x0, 0x0, 0x40, '\x00', 0x0, @fallback=0x10, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) socket(0x10, 0x803, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x1, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000380)={0xa, 0x100008b}, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000200)=0x8) openat$sequencer(0xffffffffffffff9c, &(0x7f00000001c0), 0x80200, 0x0) r0 = syz_open_dev$sndmidi(&(0x7f00000004c0), 0x2, 0x141102) writev(r0, &(0x7f0000000840)=[{&(0x7f00000002c0)="94", 0xf000}, {0x0}], 0x2) ioctl$sock_SIOCGIFINDEX(0xffffffffffffffff, 0x8933, 0x0) r1 = socket$kcm(0xa, 0x3, 0x3a) r2 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r2, &(0x7f0000000480)={0x0, 0x0, &(0x7f0000001f40)={&(0x7f00000004c0)=ANY=[@ANYBLOB="fc000000190001002dbd700000000000ac1e0001000000000000000000000000ac1414aa00"/48, @ANYRES32=0x0, @ANYRES32, @ANYBLOB="00000000000000000c00000000000000000000000000000000000000000000000000000000000000ffffffffffffffff000000000000000000000000000000000000000000000000000a000000000000feffffffff7f40000200000000000008ffffffff00000000010006000000000044000500ac1414bb000000000000000000000000000000003c0000000200000000000000000000000000000000000001060000"], 0xfc}, 0x1, 0x0, 0x0, 0x4008000}, 0x600c010) sendmsg$kcm(r1, &(0x7f0000000080)={&(0x7f0000000000)=@l2tp6={0xa, 0x0, 0x0, @loopback={0xfe80000000000000, 0xac14140c}}, 0x80, &(0x7f00000000c0)=[{&(0x7f0000000140)='\x00\x00', 0xffe3}], 0x1, 0x0, 0x0, 0x900}, 0x60) setsockopt$IPT_SO_SET_REPLACE(0xffffffffffffffff, 0x0, 0x40, 0x0, 0x0) syz_usb_connect(0x3, 0x57, &(0x7f0000000000)=ANY=[@ANYBLOB="1201000200000040402001c60100000000010902450001010080fa0904"], 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000340)='./file1\x00', 0x0) mkdirat(0xffffffffffffff9c, &(0x7f00000000c0)='./bus\x00', 0x1d7) mkdirat(0xffffffffffffff9c, &(0x7f0000000400)='./file1/file0\x00', 0x100) bpf$PROG_LOAD(0x5, 0x0, 0x0) executing program 6: syz_usb_connect(0x0, 0x4b, &(0x7f0000000000)=ANY=[@ANYBLOB="1201000200000040480b051000010102000109023900020100803209040000000000000009"], 0x0) r0 = syz_open_dev$dvb_demux(&(0x7f0000000200), 0x1, 0x2) ioctl$DVB_DEMUX_DMX_SET_PES_FILTER(r0, 0x40146f2c, &(0x7f0000000100)={0x1ff, 0x0, 0x3, 0xa, 0x4}) program crashed: general protection fault in mxl111sf_ep6_streaming_ctrl testing program (duration=9m0s, {Threaded:true Repeat:true RepeatTimes:0 Procs:6 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): [0, 19, 3] detailed listing: executing program 0: executing program 0: bpf$MAP_CREATE(0x0, &(0x7f0000000080)=ANY=[], 0x50) bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x0, 0xc, 0x0, 0x0, 0xfffffffd, 0x0, 0x0, 0x0, 0x40, '\x00', 0x0, @fallback=0x10, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) socket(0x10, 0x803, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x1, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000380)={0xa, 0x100008b}, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000200)=0x8) openat$sequencer(0xffffffffffffff9c, &(0x7f00000001c0), 0x80200, 0x0) r0 = syz_open_dev$sndmidi(&(0x7f00000004c0), 0x2, 0x141102) writev(r0, &(0x7f0000000840)=[{&(0x7f00000002c0)="94", 0xf000}, {0x0}], 0x2) ioctl$sock_SIOCGIFINDEX(0xffffffffffffffff, 0x8933, 0x0) r1 = socket$kcm(0xa, 0x3, 0x3a) r2 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r2, &(0x7f0000000480)={0x0, 0x0, &(0x7f0000001f40)={&(0x7f00000004c0)=ANY=[@ANYBLOB="fc000000190001002dbd700000000000ac1e0001000000000000000000000000ac1414aa00"/48, @ANYRES32=0x0, @ANYRES32, @ANYBLOB="00000000000000000c00000000000000000000000000000000000000000000000000000000000000ffffffffffffffff000000000000000000000000000000000000000000000000000a000000000000feffffffff7f40000200000000000008ffffffff00000000010006000000000044000500ac1414bb000000000000000000000000000000003c0000000200000000000000000000000000000000000001060000"], 0xfc}, 0x1, 0x0, 0x0, 0x4008000}, 0x600c010) sendmsg$kcm(r1, &(0x7f0000000080)={&(0x7f0000000000)=@l2tp6={0xa, 0x0, 0x0, @loopback={0xfe80000000000000, 0xac14140c}}, 0x80, &(0x7f00000000c0)=[{&(0x7f0000000140)='\x00\x00', 0xffe3}], 0x1, 0x0, 0x0, 0x900}, 0x60) setsockopt$IPT_SO_SET_REPLACE(0xffffffffffffffff, 0x0, 0x40, 0x0, 0x0) syz_usb_connect(0x3, 0x57, &(0x7f0000000000)=ANY=[@ANYBLOB="1201000200000040402001c60100000000010902450001010080fa0904"], 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000340)='./file1\x00', 0x0) mkdirat(0xffffffffffffff9c, &(0x7f00000000c0)='./bus\x00', 0x1d7) bpf$PROG_LOAD(0x5, 0x0, 0x0) executing program 6: syz_usb_connect(0x0, 0x4b, &(0x7f0000000000)=ANY=[@ANYBLOB="1201000200000040480b051000010102000109023900020100803209040000000000000009"], 0x0) r0 = syz_open_dev$dvb_demux(&(0x7f0000000200), 0x1, 0x2) ioctl$DVB_DEMUX_DMX_SET_PES_FILTER(r0, 0x40146f2c, &(0x7f0000000100)={0x1ff, 0x0, 0x3, 0xa, 0x4}) program did not crash testing program (duration=9m0s, {Threaded:true Repeat:true RepeatTimes:0 Procs:6 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): [0, 19, 3] detailed listing: executing program 0: executing program 0: bpf$MAP_CREATE(0x0, &(0x7f0000000080)=ANY=[], 0x50) bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x0, 0xc, 0x0, 0x0, 0xfffffffd, 0x0, 0x0, 0x0, 0x40, '\x00', 0x0, @fallback=0x10, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) socket(0x10, 0x803, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x1, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000380)={0xa, 0x100008b}, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000200)=0x8) openat$sequencer(0xffffffffffffff9c, &(0x7f00000001c0), 0x80200, 0x0) r0 = syz_open_dev$sndmidi(&(0x7f00000004c0), 0x2, 0x141102) writev(r0, &(0x7f0000000840)=[{&(0x7f00000002c0)="94", 0xf000}, {0x0}], 0x2) ioctl$sock_SIOCGIFINDEX(0xffffffffffffffff, 0x8933, 0x0) r1 = socket$kcm(0xa, 0x3, 0x3a) r2 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r2, &(0x7f0000000480)={0x0, 0x0, &(0x7f0000001f40)={&(0x7f00000004c0)=ANY=[@ANYBLOB="fc000000190001002dbd700000000000ac1e0001000000000000000000000000ac1414aa00"/48, @ANYRES32=0x0, @ANYRES32, @ANYBLOB="00000000000000000c00000000000000000000000000000000000000000000000000000000000000ffffffffffffffff000000000000000000000000000000000000000000000000000a000000000000feffffffff7f40000200000000000008ffffffff00000000010006000000000044000500ac1414bb000000000000000000000000000000003c0000000200000000000000000000000000000000000001060000"], 0xfc}, 0x1, 0x0, 0x0, 0x4008000}, 0x600c010) sendmsg$kcm(r1, &(0x7f0000000080)={&(0x7f0000000000)=@l2tp6={0xa, 0x0, 0x0, @loopback={0xfe80000000000000, 0xac14140c}}, 0x80, &(0x7f00000000c0)=[{&(0x7f0000000140)='\x00\x00', 0xffe3}], 0x1, 0x0, 0x0, 0x900}, 0x60) setsockopt$IPT_SO_SET_REPLACE(0xffffffffffffffff, 0x0, 0x40, 0x0, 0x0) syz_usb_connect(0x3, 0x57, &(0x7f0000000000)=ANY=[@ANYBLOB="1201000200000040402001c60100000000010902450001010080fa0904"], 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000340)='./file1\x00', 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000400)='./file1/file0\x00', 0x100) bpf$PROG_LOAD(0x5, 0x0, 0x0) executing program 6: syz_usb_connect(0x0, 0x4b, &(0x7f0000000000)=ANY=[@ANYBLOB="1201000200000040480b051000010102000109023900020100803209040000000000000009"], 0x0) r0 = syz_open_dev$dvb_demux(&(0x7f0000000200), 0x1, 0x2) ioctl$DVB_DEMUX_DMX_SET_PES_FILTER(r0, 0x40146f2c, &(0x7f0000000100)={0x1ff, 0x0, 0x3, 0xa, 0x4}) program crashed: general protection fault in mxl111sf_ep6_streaming_ctrl testing program (duration=9m0s, {Threaded:true Repeat:true RepeatTimes:0 Procs:6 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): [0, 18, 3] detailed listing: executing program 0: executing program 0: bpf$MAP_CREATE(0x0, &(0x7f0000000080)=ANY=[], 0x50) bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x0, 0xc, 0x0, 0x0, 0xfffffffd, 0x0, 0x0, 0x0, 0x40, '\x00', 0x0, @fallback=0x10, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) socket(0x10, 0x803, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x1, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000380)={0xa, 0x100008b}, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000200)=0x8) openat$sequencer(0xffffffffffffff9c, &(0x7f00000001c0), 0x80200, 0x0) r0 = syz_open_dev$sndmidi(&(0x7f00000004c0), 0x2, 0x141102) writev(r0, &(0x7f0000000840)=[{&(0x7f00000002c0)="94", 0xf000}, {0x0}], 0x2) ioctl$sock_SIOCGIFINDEX(0xffffffffffffffff, 0x8933, 0x0) r1 = socket$kcm(0xa, 0x3, 0x3a) r2 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r2, &(0x7f0000000480)={0x0, 0x0, &(0x7f0000001f40)={&(0x7f00000004c0)=ANY=[@ANYBLOB="fc000000190001002dbd700000000000ac1e0001000000000000000000000000ac1414aa00"/48, @ANYRES32=0x0, @ANYRES32, @ANYBLOB="00000000000000000c00000000000000000000000000000000000000000000000000000000000000ffffffffffffffff000000000000000000000000000000000000000000000000000a000000000000feffffffff7f40000200000000000008ffffffff00000000010006000000000044000500ac1414bb000000000000000000000000000000003c0000000200000000000000000000000000000000000001060000"], 0xfc}, 0x1, 0x0, 0x0, 0x4008000}, 0x600c010) sendmsg$kcm(r1, &(0x7f0000000080)={&(0x7f0000000000)=@l2tp6={0xa, 0x0, 0x0, @loopback={0xfe80000000000000, 0xac14140c}}, 0x80, &(0x7f00000000c0)=[{&(0x7f0000000140)='\x00\x00', 0xffe3}], 0x1, 0x0, 0x0, 0x900}, 0x60) setsockopt$IPT_SO_SET_REPLACE(0xffffffffffffffff, 0x0, 0x40, 0x0, 0x0) syz_usb_connect(0x3, 0x57, &(0x7f0000000000)=ANY=[@ANYBLOB="1201000200000040402001c60100000000010902450001010080fa0904"], 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000400)='./file1/file0\x00', 0x100) bpf$PROG_LOAD(0x5, 0x0, 0x0) executing program 6: syz_usb_connect(0x0, 0x4b, &(0x7f0000000000)=ANY=[@ANYBLOB="1201000200000040480b051000010102000109023900020100803209040000000000000009"], 0x0) r0 = syz_open_dev$dvb_demux(&(0x7f0000000200), 0x1, 0x2) ioctl$DVB_DEMUX_DMX_SET_PES_FILTER(r0, 0x40146f2c, &(0x7f0000000100)={0x1ff, 0x0, 0x3, 0xa, 0x4}) program crashed: general protection fault in mxl111sf_ep6_streaming_ctrl testing program (duration=9m0s, {Threaded:true Repeat:true RepeatTimes:0 Procs:6 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): [0, 17, 3] detailed listing: executing program 0: executing program 0: bpf$MAP_CREATE(0x0, &(0x7f0000000080)=ANY=[], 0x50) bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x0, 0xc, 0x0, 0x0, 0xfffffffd, 0x0, 0x0, 0x0, 0x40, '\x00', 0x0, @fallback=0x10, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) socket(0x10, 0x803, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x1, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000380)={0xa, 0x100008b}, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000200)=0x8) openat$sequencer(0xffffffffffffff9c, &(0x7f00000001c0), 0x80200, 0x0) r0 = syz_open_dev$sndmidi(&(0x7f00000004c0), 0x2, 0x141102) writev(r0, &(0x7f0000000840)=[{&(0x7f00000002c0)="94", 0xf000}, {0x0}], 0x2) ioctl$sock_SIOCGIFINDEX(0xffffffffffffffff, 0x8933, 0x0) r1 = socket$kcm(0xa, 0x3, 0x3a) r2 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r2, &(0x7f0000000480)={0x0, 0x0, &(0x7f0000001f40)={&(0x7f00000004c0)=ANY=[@ANYBLOB="fc000000190001002dbd700000000000ac1e0001000000000000000000000000ac1414aa00"/48, @ANYRES32=0x0, @ANYRES32, @ANYBLOB="00000000000000000c00000000000000000000000000000000000000000000000000000000000000ffffffffffffffff000000000000000000000000000000000000000000000000000a000000000000feffffffff7f40000200000000000008ffffffff00000000010006000000000044000500ac1414bb000000000000000000000000000000003c0000000200000000000000000000000000000000000001060000"], 0xfc}, 0x1, 0x0, 0x0, 0x4008000}, 0x600c010) sendmsg$kcm(r1, &(0x7f0000000080)={&(0x7f0000000000)=@l2tp6={0xa, 0x0, 0x0, @loopback={0xfe80000000000000, 0xac14140c}}, 0x80, &(0x7f00000000c0)=[{&(0x7f0000000140)='\x00\x00', 0xffe3}], 0x1, 0x0, 0x0, 0x900}, 0x60) setsockopt$IPT_SO_SET_REPLACE(0xffffffffffffffff, 0x0, 0x40, 0x0, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000400)='./file1/file0\x00', 0x100) bpf$PROG_LOAD(0x5, 0x0, 0x0) executing program 6: syz_usb_connect(0x0, 0x4b, &(0x7f0000000000)=ANY=[@ANYBLOB="1201000200000040480b051000010102000109023900020100803209040000000000000009"], 0x0) r0 = syz_open_dev$dvb_demux(&(0x7f0000000200), 0x1, 0x2) ioctl$DVB_DEMUX_DMX_SET_PES_FILTER(r0, 0x40146f2c, &(0x7f0000000100)={0x1ff, 0x0, 0x3, 0xa, 0x4}) program did not crash testing program (duration=9m0s, {Threaded:true Repeat:true RepeatTimes:0 Procs:6 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): [0, 17, 3] detailed listing: executing program 0: executing program 0: bpf$MAP_CREATE(0x0, &(0x7f0000000080)=ANY=[], 0x50) bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x0, 0xc, 0x0, 0x0, 0xfffffffd, 0x0, 0x0, 0x0, 0x40, '\x00', 0x0, @fallback=0x10, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) socket(0x10, 0x803, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x1, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000380)={0xa, 0x100008b}, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000200)=0x8) openat$sequencer(0xffffffffffffff9c, &(0x7f00000001c0), 0x80200, 0x0) r0 = syz_open_dev$sndmidi(&(0x7f00000004c0), 0x2, 0x141102) writev(r0, &(0x7f0000000840)=[{&(0x7f00000002c0)="94", 0xf000}, {0x0}], 0x2) ioctl$sock_SIOCGIFINDEX(0xffffffffffffffff, 0x8933, 0x0) r1 = socket$kcm(0xa, 0x3, 0x3a) r2 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r2, &(0x7f0000000480)={0x0, 0x0, &(0x7f0000001f40)={&(0x7f00000004c0)=ANY=[@ANYBLOB="fc000000190001002dbd700000000000ac1e0001000000000000000000000000ac1414aa00"/48, @ANYRES32=0x0, @ANYRES32, @ANYBLOB="00000000000000000c00000000000000000000000000000000000000000000000000000000000000ffffffffffffffff000000000000000000000000000000000000000000000000000a000000000000feffffffff7f40000200000000000008ffffffff00000000010006000000000044000500ac1414bb000000000000000000000000000000003c0000000200000000000000000000000000000000000001060000"], 0xfc}, 0x1, 0x0, 0x0, 0x4008000}, 0x600c010) sendmsg$kcm(r1, &(0x7f0000000080)={&(0x7f0000000000)=@l2tp6={0xa, 0x0, 0x0, @loopback={0xfe80000000000000, 0xac14140c}}, 0x80, &(0x7f00000000c0)=[{&(0x7f0000000140)='\x00\x00', 0xffe3}], 0x1, 0x0, 0x0, 0x900}, 0x60) syz_usb_connect(0x3, 0x57, &(0x7f0000000000)=ANY=[@ANYBLOB="1201000200000040402001c60100000000010902450001010080fa0904"], 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000400)='./file1/file0\x00', 0x100) bpf$PROG_LOAD(0x5, 0x0, 0x0) executing program 6: syz_usb_connect(0x0, 0x4b, &(0x7f0000000000)=ANY=[@ANYBLOB="1201000200000040480b051000010102000109023900020100803209040000000000000009"], 0x0) r0 = syz_open_dev$dvb_demux(&(0x7f0000000200), 0x1, 0x2) ioctl$DVB_DEMUX_DMX_SET_PES_FILTER(r0, 0x40146f2c, &(0x7f0000000100)={0x1ff, 0x0, 0x3, 0xa, 0x4}) program crashed: general protection fault in mxl111sf_ep6_streaming_ctrl testing program (duration=9m0s, {Threaded:true Repeat:true RepeatTimes:0 Procs:6 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): [0, 16, 3] detailed listing: executing program 0: executing program 0: bpf$MAP_CREATE(0x0, &(0x7f0000000080)=ANY=[], 0x50) bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x0, 0xc, 0x0, 0x0, 0xfffffffd, 0x0, 0x0, 0x0, 0x40, '\x00', 0x0, @fallback=0x10, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) socket(0x10, 0x803, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x1, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000380)={0xa, 0x100008b}, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000200)=0x8) openat$sequencer(0xffffffffffffff9c, &(0x7f00000001c0), 0x80200, 0x0) r0 = syz_open_dev$sndmidi(&(0x7f00000004c0), 0x2, 0x141102) writev(r0, &(0x7f0000000840)=[{&(0x7f00000002c0)="94", 0xf000}, {0x0}], 0x2) ioctl$sock_SIOCGIFINDEX(0xffffffffffffffff, 0x8933, 0x0) socket$kcm(0xa, 0x3, 0x3a) r1 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r1, &(0x7f0000000480)={0x0, 0x0, &(0x7f0000001f40)={&(0x7f00000004c0)=ANY=[@ANYBLOB="fc000000190001002dbd700000000000ac1e0001000000000000000000000000ac1414aa00"/48, @ANYRES32=0x0, @ANYRES32, @ANYBLOB="00000000000000000c00000000000000000000000000000000000000000000000000000000000000ffffffffffffffff000000000000000000000000000000000000000000000000000a000000000000feffffffff7f40000200000000000008ffffffff00000000010006000000000044000500ac1414bb000000000000000000000000000000003c0000000200000000000000000000000000000000000001060000"], 0xfc}, 0x1, 0x0, 0x0, 0x4008000}, 0x600c010) syz_usb_connect(0x3, 0x57, &(0x7f0000000000)=ANY=[@ANYBLOB="1201000200000040402001c60100000000010902450001010080fa0904"], 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000400)='./file1/file0\x00', 0x100) bpf$PROG_LOAD(0x5, 0x0, 0x0) executing program 6: syz_usb_connect(0x0, 0x4b, &(0x7f0000000000)=ANY=[@ANYBLOB="1201000200000040480b051000010102000109023900020100803209040000000000000009"], 0x0) r0 = syz_open_dev$dvb_demux(&(0x7f0000000200), 0x1, 0x2) ioctl$DVB_DEMUX_DMX_SET_PES_FILTER(r0, 0x40146f2c, &(0x7f0000000100)={0x1ff, 0x0, 0x3, 0xa, 0x4}) program did not crash testing program (duration=9m0s, {Threaded:true Repeat:true RepeatTimes:0 Procs:6 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): [0, 16, 3] detailed listing: executing program 0: executing program 0: bpf$MAP_CREATE(0x0, &(0x7f0000000080)=ANY=[], 0x50) bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x0, 0xc, 0x0, 0x0, 0xfffffffd, 0x0, 0x0, 0x0, 0x40, '\x00', 0x0, @fallback=0x10, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) socket(0x10, 0x803, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x1, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000380)={0xa, 0x100008b}, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000200)=0x8) openat$sequencer(0xffffffffffffff9c, &(0x7f00000001c0), 0x80200, 0x0) r0 = syz_open_dev$sndmidi(&(0x7f00000004c0), 0x2, 0x141102) writev(r0, &(0x7f0000000840)=[{&(0x7f00000002c0)="94", 0xf000}, {0x0}], 0x2) ioctl$sock_SIOCGIFINDEX(0xffffffffffffffff, 0x8933, 0x0) r1 = socket$kcm(0xa, 0x3, 0x3a) socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$kcm(r1, &(0x7f0000000080)={&(0x7f0000000000)=@l2tp6={0xa, 0x0, 0x0, @loopback={0xfe80000000000000, 0xac14140c}}, 0x80, &(0x7f00000000c0)=[{&(0x7f0000000140)='\x00\x00', 0xffe3}], 0x1, 0x0, 0x0, 0x900}, 0x60) syz_usb_connect(0x3, 0x57, &(0x7f0000000000)=ANY=[@ANYBLOB="1201000200000040402001c60100000000010902450001010080fa0904"], 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000400)='./file1/file0\x00', 0x100) bpf$PROG_LOAD(0x5, 0x0, 0x0) executing program 6: syz_usb_connect(0x0, 0x4b, &(0x7f0000000000)=ANY=[@ANYBLOB="1201000200000040480b051000010102000109023900020100803209040000000000000009"], 0x0) r0 = syz_open_dev$dvb_demux(&(0x7f0000000200), 0x1, 0x2) ioctl$DVB_DEMUX_DMX_SET_PES_FILTER(r0, 0x40146f2c, &(0x7f0000000100)={0x1ff, 0x0, 0x3, 0xa, 0x4}) program did not crash testing program (duration=9m0s, {Threaded:true Repeat:true RepeatTimes:0 Procs:6 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): [0, 16, 3] detailed listing: executing program 0: executing program 0: bpf$MAP_CREATE(0x0, &(0x7f0000000080)=ANY=[], 0x50) bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x0, 0xc, 0x0, 0x0, 0xfffffffd, 0x0, 0x0, 0x0, 0x40, '\x00', 0x0, @fallback=0x10, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) socket(0x10, 0x803, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x1, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000380)={0xa, 0x100008b}, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000200)=0x8) openat$sequencer(0xffffffffffffff9c, &(0x7f00000001c0), 0x80200, 0x0) r0 = syz_open_dev$sndmidi(&(0x7f00000004c0), 0x2, 0x141102) writev(r0, &(0x7f0000000840)=[{&(0x7f00000002c0)="94", 0xf000}, {0x0}], 0x2) ioctl$sock_SIOCGIFINDEX(0xffffffffffffffff, 0x8933, 0x0) r1 = socket$kcm(0xa, 0x3, 0x3a) sendmsg$nl_xfrm(0xffffffffffffffff, &(0x7f0000000480)={0x0, 0x0, &(0x7f0000001f40)={&(0x7f00000004c0)=ANY=[@ANYBLOB="fc000000190001002dbd700000000000ac1e0001000000000000000000000000ac1414aa00"/48, @ANYRES32=0x0, @ANYRES32, @ANYBLOB="00000000000000000c00000000000000000000000000000000000000000000000000000000000000ffffffffffffffff000000000000000000000000000000000000000000000000000a000000000000feffffffff7f40000200000000000008ffffffff00000000010006000000000044000500ac1414bb000000000000000000000000000000003c0000000200000000000000000000000000000000000001060000"], 0xfc}, 0x1, 0x0, 0x0, 0x4008000}, 0x600c010) sendmsg$kcm(r1, &(0x7f0000000080)={&(0x7f0000000000)=@l2tp6={0xa, 0x0, 0x0, @loopback={0xfe80000000000000, 0xac14140c}}, 0x80, &(0x7f00000000c0)=[{&(0x7f0000000140)='\x00\x00', 0xffe3}], 0x1, 0x0, 0x0, 0x900}, 0x60) syz_usb_connect(0x3, 0x57, &(0x7f0000000000)=ANY=[@ANYBLOB="1201000200000040402001c60100000000010902450001010080fa0904"], 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000400)='./file1/file0\x00', 0x100) bpf$PROG_LOAD(0x5, 0x0, 0x0) executing program 6: syz_usb_connect(0x0, 0x4b, &(0x7f0000000000)=ANY=[@ANYBLOB="1201000200000040480b051000010102000109023900020100803209040000000000000009"], 0x0) r0 = syz_open_dev$dvb_demux(&(0x7f0000000200), 0x1, 0x2) ioctl$DVB_DEMUX_DMX_SET_PES_FILTER(r0, 0x40146f2c, &(0x7f0000000100)={0x1ff, 0x0, 0x3, 0xa, 0x4}) program crashed: general protection fault in mxl111sf_ep6_streaming_ctrl testing program (duration=9m0s, {Threaded:true Repeat:true RepeatTimes:0 Procs:6 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): [0, 15, 3] detailed listing: executing program 0: executing program 0: bpf$MAP_CREATE(0x0, &(0x7f0000000080)=ANY=[], 0x50) bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x0, 0xc, 0x0, 0x0, 0xfffffffd, 0x0, 0x0, 0x0, 0x40, '\x00', 0x0, @fallback=0x10, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) socket(0x10, 0x803, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x1, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000380)={0xa, 0x100008b}, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000200)=0x8) openat$sequencer(0xffffffffffffff9c, &(0x7f00000001c0), 0x80200, 0x0) r0 = syz_open_dev$sndmidi(&(0x7f00000004c0), 0x2, 0x141102) writev(r0, &(0x7f0000000840)=[{&(0x7f00000002c0)="94", 0xf000}, {0x0}], 0x2) ioctl$sock_SIOCGIFINDEX(0xffffffffffffffff, 0x8933, 0x0) sendmsg$nl_xfrm(0xffffffffffffffff, &(0x7f0000000480)={0x0, 0x0, &(0x7f0000001f40)={&(0x7f00000004c0)=ANY=[@ANYBLOB="fc000000190001002dbd700000000000ac1e0001000000000000000000000000ac1414aa00"/48, @ANYRES32=0x0, @ANYRES32, @ANYBLOB="00000000000000000c00000000000000000000000000000000000000000000000000000000000000ffffffffffffffff000000000000000000000000000000000000000000000000000a000000000000feffffffff7f40000200000000000008ffffffff00000000010006000000000044000500ac1414bb000000000000000000000000000000003c0000000200000000000000000000000000000000000001060000"], 0xfc}, 0x1, 0x0, 0x0, 0x4008000}, 0x600c010) sendmsg$kcm(0xffffffffffffffff, &(0x7f0000000080)={&(0x7f0000000000)=@l2tp6={0xa, 0x0, 0x0, @loopback={0xfe80000000000000, 0xac14140c}}, 0x80, &(0x7f00000000c0)=[{&(0x7f0000000140)='\x00\x00', 0xffe3}], 0x1, 0x0, 0x0, 0x900}, 0x60) syz_usb_connect(0x3, 0x57, &(0x7f0000000000)=ANY=[@ANYBLOB="1201000200000040402001c60100000000010902450001010080fa0904"], 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000400)='./file1/file0\x00', 0x100) bpf$PROG_LOAD(0x5, 0x0, 0x0) executing program 6: syz_usb_connect(0x0, 0x4b, &(0x7f0000000000)=ANY=[@ANYBLOB="1201000200000040480b051000010102000109023900020100803209040000000000000009"], 0x0) r0 = syz_open_dev$dvb_demux(&(0x7f0000000200), 0x1, 0x2) ioctl$DVB_DEMUX_DMX_SET_PES_FILTER(r0, 0x40146f2c, &(0x7f0000000100)={0x1ff, 0x0, 0x3, 0xa, 0x4}) program crashed: general protection fault in mxl111sf_ep6_streaming_ctrl testing program (duration=9m0s, {Threaded:true Repeat:true RepeatTimes:0 Procs:6 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): [0, 14, 3] detailed listing: executing program 0: executing program 0: bpf$MAP_CREATE(0x0, &(0x7f0000000080)=ANY=[], 0x50) bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x0, 0xc, 0x0, 0x0, 0xfffffffd, 0x0, 0x0, 0x0, 0x40, '\x00', 0x0, @fallback=0x10, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) socket(0x10, 0x803, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x1, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000380)={0xa, 0x100008b}, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000200)=0x8) openat$sequencer(0xffffffffffffff9c, &(0x7f00000001c0), 0x80200, 0x0) r0 = syz_open_dev$sndmidi(&(0x7f00000004c0), 0x2, 0x141102) writev(r0, &(0x7f0000000840)=[{&(0x7f00000002c0)="94", 0xf000}, {0x0}], 0x2) sendmsg$nl_xfrm(0xffffffffffffffff, &(0x7f0000000480)={0x0, 0x0, &(0x7f0000001f40)={&(0x7f00000004c0)=ANY=[@ANYBLOB="fc000000190001002dbd700000000000ac1e0001000000000000000000000000ac1414aa00"/48, @ANYRES32=0x0, @ANYRES32, @ANYBLOB="00000000000000000c00000000000000000000000000000000000000000000000000000000000000ffffffffffffffff000000000000000000000000000000000000000000000000000a000000000000feffffffff7f40000200000000000008ffffffff00000000010006000000000044000500ac1414bb000000000000000000000000000000003c0000000200000000000000000000000000000000000001060000"], 0xfc}, 0x1, 0x0, 0x0, 0x4008000}, 0x600c010) sendmsg$kcm(0xffffffffffffffff, &(0x7f0000000080)={&(0x7f0000000000)=@l2tp6={0xa, 0x0, 0x0, @loopback={0xfe80000000000000, 0xac14140c}}, 0x80, &(0x7f00000000c0)=[{&(0x7f0000000140)='\x00\x00', 0xffe3}], 0x1, 0x0, 0x0, 0x900}, 0x60) syz_usb_connect(0x3, 0x57, &(0x7f0000000000)=ANY=[@ANYBLOB="1201000200000040402001c60100000000010902450001010080fa0904"], 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000400)='./file1/file0\x00', 0x100) bpf$PROG_LOAD(0x5, 0x0, 0x0) executing program 6: syz_usb_connect(0x0, 0x4b, &(0x7f0000000000)=ANY=[@ANYBLOB="1201000200000040480b051000010102000109023900020100803209040000000000000009"], 0x0) r0 = syz_open_dev$dvb_demux(&(0x7f0000000200), 0x1, 0x2) ioctl$DVB_DEMUX_DMX_SET_PES_FILTER(r0, 0x40146f2c, &(0x7f0000000100)={0x1ff, 0x0, 0x3, 0xa, 0x4}) program crashed: general protection fault in mxl111sf_ep6_streaming_ctrl testing program (duration=9m0s, {Threaded:true Repeat:true RepeatTimes:0 Procs:6 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): [0, 13, 3] detailed listing: executing program 0: executing program 0: bpf$MAP_CREATE(0x0, &(0x7f0000000080)=ANY=[], 0x50) bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x0, 0xc, 0x0, 0x0, 0xfffffffd, 0x0, 0x0, 0x0, 0x40, '\x00', 0x0, @fallback=0x10, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) socket(0x10, 0x803, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x1, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000380)={0xa, 0x100008b}, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000200)=0x8) openat$sequencer(0xffffffffffffff9c, &(0x7f00000001c0), 0x80200, 0x0) syz_open_dev$sndmidi(&(0x7f00000004c0), 0x2, 0x141102) sendmsg$nl_xfrm(0xffffffffffffffff, &(0x7f0000000480)={0x0, 0x0, &(0x7f0000001f40)={&(0x7f00000004c0)=ANY=[@ANYBLOB="fc000000190001002dbd700000000000ac1e0001000000000000000000000000ac1414aa00"/48, @ANYRES32=0x0, @ANYRES32, @ANYBLOB="00000000000000000c00000000000000000000000000000000000000000000000000000000000000ffffffffffffffff000000000000000000000000000000000000000000000000000a000000000000feffffffff7f40000200000000000008ffffffff00000000010006000000000044000500ac1414bb000000000000000000000000000000003c0000000200000000000000000000000000000000000001060000"], 0xfc}, 0x1, 0x0, 0x0, 0x4008000}, 0x600c010) sendmsg$kcm(0xffffffffffffffff, &(0x7f0000000080)={&(0x7f0000000000)=@l2tp6={0xa, 0x0, 0x0, @loopback={0xfe80000000000000, 0xac14140c}}, 0x80, &(0x7f00000000c0)=[{&(0x7f0000000140)='\x00\x00', 0xffe3}], 0x1, 0x0, 0x0, 0x900}, 0x60) syz_usb_connect(0x3, 0x57, &(0x7f0000000000)=ANY=[@ANYBLOB="1201000200000040402001c60100000000010902450001010080fa0904"], 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000400)='./file1/file0\x00', 0x100) bpf$PROG_LOAD(0x5, 0x0, 0x0) executing program 6: syz_usb_connect(0x0, 0x4b, &(0x7f0000000000)=ANY=[@ANYBLOB="1201000200000040480b051000010102000109023900020100803209040000000000000009"], 0x0) r0 = syz_open_dev$dvb_demux(&(0x7f0000000200), 0x1, 0x2) ioctl$DVB_DEMUX_DMX_SET_PES_FILTER(r0, 0x40146f2c, &(0x7f0000000100)={0x1ff, 0x0, 0x3, 0xa, 0x4}) program crashed: general protection fault in mxl111sf_ep6_streaming_ctrl testing program (duration=9m0s, {Threaded:true Repeat:true RepeatTimes:0 Procs:6 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): [0, 12, 3] detailed listing: executing program 0: executing program 0: bpf$MAP_CREATE(0x0, &(0x7f0000000080)=ANY=[], 0x50) bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x0, 0xc, 0x0, 0x0, 0xfffffffd, 0x0, 0x0, 0x0, 0x40, '\x00', 0x0, @fallback=0x10, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) socket(0x10, 0x803, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x1, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000380)={0xa, 0x100008b}, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000200)=0x8) openat$sequencer(0xffffffffffffff9c, &(0x7f00000001c0), 0x80200, 0x0) sendmsg$nl_xfrm(0xffffffffffffffff, &(0x7f0000000480)={0x0, 0x0, &(0x7f0000001f40)={&(0x7f00000004c0)=ANY=[@ANYBLOB="fc000000190001002dbd700000000000ac1e0001000000000000000000000000ac1414aa00"/48, @ANYRES32=0x0, @ANYRES32, @ANYBLOB="00000000000000000c00000000000000000000000000000000000000000000000000000000000000ffffffffffffffff000000000000000000000000000000000000000000000000000a000000000000feffffffff7f40000200000000000008ffffffff00000000010006000000000044000500ac1414bb000000000000000000000000000000003c0000000200000000000000000000000000000000000001060000"], 0xfc}, 0x1, 0x0, 0x0, 0x4008000}, 0x600c010) sendmsg$kcm(0xffffffffffffffff, &(0x7f0000000080)={&(0x7f0000000000)=@l2tp6={0xa, 0x0, 0x0, @loopback={0xfe80000000000000, 0xac14140c}}, 0x80, &(0x7f00000000c0)=[{&(0x7f0000000140)='\x00\x00', 0xffe3}], 0x1, 0x0, 0x0, 0x900}, 0x60) syz_usb_connect(0x3, 0x57, &(0x7f0000000000)=ANY=[@ANYBLOB="1201000200000040402001c60100000000010902450001010080fa0904"], 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000400)='./file1/file0\x00', 0x100) bpf$PROG_LOAD(0x5, 0x0, 0x0) executing program 6: syz_usb_connect(0x0, 0x4b, &(0x7f0000000000)=ANY=[@ANYBLOB="1201000200000040480b051000010102000109023900020100803209040000000000000009"], 0x0) r0 = syz_open_dev$dvb_demux(&(0x7f0000000200), 0x1, 0x2) ioctl$DVB_DEMUX_DMX_SET_PES_FILTER(r0, 0x40146f2c, &(0x7f0000000100)={0x1ff, 0x0, 0x3, 0xa, 0x4}) program crashed: general protection fault in mxl111sf_ep6_streaming_ctrl testing program (duration=9m0s, {Threaded:true Repeat:true RepeatTimes:0 Procs:6 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): [0, 11, 3] detailed listing: executing program 0: executing program 0: bpf$MAP_CREATE(0x0, &(0x7f0000000080)=ANY=[], 0x50) bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x0, 0xc, 0x0, 0x0, 0xfffffffd, 0x0, 0x0, 0x0, 0x40, '\x00', 0x0, @fallback=0x10, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) socket(0x10, 0x803, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x1, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000380)={0xa, 0x100008b}, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000200)=0x8) sendmsg$nl_xfrm(0xffffffffffffffff, &(0x7f0000000480)={0x0, 0x0, &(0x7f0000001f40)={&(0x7f00000004c0)=ANY=[@ANYBLOB="fc000000190001002dbd700000000000ac1e0001000000000000000000000000ac1414aa00"/48, @ANYRES32=0x0, @ANYRES32, @ANYBLOB="00000000000000000c00000000000000000000000000000000000000000000000000000000000000ffffffffffffffff000000000000000000000000000000000000000000000000000a000000000000feffffffff7f40000200000000000008ffffffff00000000010006000000000044000500ac1414bb000000000000000000000000000000003c0000000200000000000000000000000000000000000001060000"], 0xfc}, 0x1, 0x0, 0x0, 0x4008000}, 0x600c010) sendmsg$kcm(0xffffffffffffffff, &(0x7f0000000080)={&(0x7f0000000000)=@l2tp6={0xa, 0x0, 0x0, @loopback={0xfe80000000000000, 0xac14140c}}, 0x80, &(0x7f00000000c0)=[{&(0x7f0000000140)='\x00\x00', 0xffe3}], 0x1, 0x0, 0x0, 0x900}, 0x60) syz_usb_connect(0x3, 0x57, &(0x7f0000000000)=ANY=[@ANYBLOB="1201000200000040402001c60100000000010902450001010080fa0904"], 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000400)='./file1/file0\x00', 0x100) bpf$PROG_LOAD(0x5, 0x0, 0x0) executing program 6: syz_usb_connect(0x0, 0x4b, &(0x7f0000000000)=ANY=[@ANYBLOB="1201000200000040480b051000010102000109023900020100803209040000000000000009"], 0x0) r0 = syz_open_dev$dvb_demux(&(0x7f0000000200), 0x1, 0x2) ioctl$DVB_DEMUX_DMX_SET_PES_FILTER(r0, 0x40146f2c, &(0x7f0000000100)={0x1ff, 0x0, 0x3, 0xa, 0x4}) program crashed: general protection fault in mxl111sf_ep6_streaming_ctrl testing program (duration=9m0s, {Threaded:true Repeat:true RepeatTimes:0 Procs:6 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): [0, 10, 3] detailed listing: executing program 0: executing program 0: bpf$MAP_CREATE(0x0, &(0x7f0000000080)=ANY=[], 0x50) bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x0, 0xc, 0x0, 0x0, 0xfffffffd, 0x0, 0x0, 0x0, 0x40, '\x00', 0x0, @fallback=0x10, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) socket(0x10, 0x803, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x1, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000380)={0xa, 0x100008b}, 0x0) sendmsg$nl_xfrm(0xffffffffffffffff, &(0x7f0000000480)={0x0, 0x0, &(0x7f0000001f40)={&(0x7f00000004c0)=ANY=[@ANYBLOB="fc000000190001002dbd700000000000ac1e0001000000000000000000000000ac1414aa00"/48, @ANYRES32=0x0, @ANYRES32, @ANYBLOB="00000000000000000c00000000000000000000000000000000000000000000000000000000000000ffffffffffffffff000000000000000000000000000000000000000000000000000a000000000000feffffffff7f40000200000000000008ffffffff00000000010006000000000044000500ac1414bb000000000000000000000000000000003c0000000200000000000000000000000000000000000001060000"], 0xfc}, 0x1, 0x0, 0x0, 0x4008000}, 0x600c010) sendmsg$kcm(0xffffffffffffffff, &(0x7f0000000080)={&(0x7f0000000000)=@l2tp6={0xa, 0x0, 0x0, @loopback={0xfe80000000000000, 0xac14140c}}, 0x80, &(0x7f00000000c0)=[{&(0x7f0000000140)='\x00\x00', 0xffe3}], 0x1, 0x0, 0x0, 0x900}, 0x60) syz_usb_connect(0x3, 0x57, &(0x7f0000000000)=ANY=[@ANYBLOB="1201000200000040402001c60100000000010902450001010080fa0904"], 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000400)='./file1/file0\x00', 0x100) bpf$PROG_LOAD(0x5, 0x0, 0x0) executing program 6: syz_usb_connect(0x0, 0x4b, &(0x7f0000000000)=ANY=[@ANYBLOB="1201000200000040480b051000010102000109023900020100803209040000000000000009"], 0x0) r0 = syz_open_dev$dvb_demux(&(0x7f0000000200), 0x1, 0x2) ioctl$DVB_DEMUX_DMX_SET_PES_FILTER(r0, 0x40146f2c, &(0x7f0000000100)={0x1ff, 0x0, 0x3, 0xa, 0x4}) program crashed: general protection fault in mxl111sf_ep6_streaming_ctrl testing program (duration=9m0s, {Threaded:true Repeat:true RepeatTimes:0 Procs:6 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): [0, 9, 3] detailed listing: executing program 0: executing program 0: bpf$MAP_CREATE(0x0, &(0x7f0000000080)=ANY=[], 0x50) bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x0, 0xc, 0x0, 0x0, 0xfffffffd, 0x0, 0x0, 0x0, 0x40, '\x00', 0x0, @fallback=0x10, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) socket(0x10, 0x803, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x1, 0x0) sendmsg$nl_xfrm(0xffffffffffffffff, &(0x7f0000000480)={0x0, 0x0, &(0x7f0000001f40)={&(0x7f00000004c0)=ANY=[@ANYBLOB="fc000000190001002dbd700000000000ac1e0001000000000000000000000000ac1414aa00"/48, @ANYRES32=0x0, @ANYRES32, @ANYBLOB="00000000000000000c00000000000000000000000000000000000000000000000000000000000000ffffffffffffffff000000000000000000000000000000000000000000000000000a000000000000feffffffff7f40000200000000000008ffffffff00000000010006000000000044000500ac1414bb000000000000000000000000000000003c0000000200000000000000000000000000000000000001060000"], 0xfc}, 0x1, 0x0, 0x0, 0x4008000}, 0x600c010) sendmsg$kcm(0xffffffffffffffff, &(0x7f0000000080)={&(0x7f0000000000)=@l2tp6={0xa, 0x0, 0x0, @loopback={0xfe80000000000000, 0xac14140c}}, 0x80, &(0x7f00000000c0)=[{&(0x7f0000000140)='\x00\x00', 0xffe3}], 0x1, 0x0, 0x0, 0x900}, 0x60) syz_usb_connect(0x3, 0x57, &(0x7f0000000000)=ANY=[@ANYBLOB="1201000200000040402001c60100000000010902450001010080fa0904"], 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000400)='./file1/file0\x00', 0x100) bpf$PROG_LOAD(0x5, 0x0, 0x0) executing program 6: syz_usb_connect(0x0, 0x4b, &(0x7f0000000000)=ANY=[@ANYBLOB="1201000200000040480b051000010102000109023900020100803209040000000000000009"], 0x0) r0 = syz_open_dev$dvb_demux(&(0x7f0000000200), 0x1, 0x2) ioctl$DVB_DEMUX_DMX_SET_PES_FILTER(r0, 0x40146f2c, &(0x7f0000000100)={0x1ff, 0x0, 0x3, 0xa, 0x4}) program crashed: general protection fault in mxl111sf_ep6_streaming_ctrl testing program (duration=9m0s, {Threaded:true Repeat:true RepeatTimes:0 Procs:6 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): [0, 8, 3] detailed listing: executing program 0: executing program 0: bpf$MAP_CREATE(0x0, &(0x7f0000000080)=ANY=[], 0x50) bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x0, 0xc, 0x0, 0x0, 0xfffffffd, 0x0, 0x0, 0x0, 0x40, '\x00', 0x0, @fallback=0x10, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) socket(0x10, 0x803, 0x0) sendmsg$nl_xfrm(0xffffffffffffffff, &(0x7f0000000480)={0x0, 0x0, &(0x7f0000001f40)={&(0x7f00000004c0)=ANY=[@ANYBLOB="fc000000190001002dbd700000000000ac1e0001000000000000000000000000ac1414aa00"/48, @ANYRES32=0x0, @ANYRES32, @ANYBLOB="00000000000000000c00000000000000000000000000000000000000000000000000000000000000ffffffffffffffff000000000000000000000000000000000000000000000000000a000000000000feffffffff7f40000200000000000008ffffffff00000000010006000000000044000500ac1414bb000000000000000000000000000000003c0000000200000000000000000000000000000000000001060000"], 0xfc}, 0x1, 0x0, 0x0, 0x4008000}, 0x600c010) sendmsg$kcm(0xffffffffffffffff, &(0x7f0000000080)={&(0x7f0000000000)=@l2tp6={0xa, 0x0, 0x0, @loopback={0xfe80000000000000, 0xac14140c}}, 0x80, &(0x7f00000000c0)=[{&(0x7f0000000140)='\x00\x00', 0xffe3}], 0x1, 0x0, 0x0, 0x900}, 0x60) syz_usb_connect(0x3, 0x57, &(0x7f0000000000)=ANY=[@ANYBLOB="1201000200000040402001c60100000000010902450001010080fa0904"], 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000400)='./file1/file0\x00', 0x100) bpf$PROG_LOAD(0x5, 0x0, 0x0) executing program 6: syz_usb_connect(0x0, 0x4b, &(0x7f0000000000)=ANY=[@ANYBLOB="1201000200000040480b051000010102000109023900020100803209040000000000000009"], 0x0) r0 = syz_open_dev$dvb_demux(&(0x7f0000000200), 0x1, 0x2) ioctl$DVB_DEMUX_DMX_SET_PES_FILTER(r0, 0x40146f2c, &(0x7f0000000100)={0x1ff, 0x0, 0x3, 0xa, 0x4}) program crashed: general protection fault in mxl111sf_ep6_streaming_ctrl testing program (duration=9m0s, {Threaded:true Repeat:true RepeatTimes:0 Procs:6 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): [0, 7, 3] detailed listing: executing program 0: executing program 0: bpf$MAP_CREATE(0x0, &(0x7f0000000080)=ANY=[], 0x50) bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x0, 0xc, 0x0, 0x0, 0xfffffffd, 0x0, 0x0, 0x0, 0x40, '\x00', 0x0, @fallback=0x10, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) sendmsg$nl_xfrm(0xffffffffffffffff, &(0x7f0000000480)={0x0, 0x0, &(0x7f0000001f40)={&(0x7f00000004c0)=ANY=[@ANYBLOB="fc000000190001002dbd700000000000ac1e0001000000000000000000000000ac1414aa00"/48, @ANYRES32=0x0, @ANYRES32, @ANYBLOB="00000000000000000c00000000000000000000000000000000000000000000000000000000000000ffffffffffffffff000000000000000000000000000000000000000000000000000a000000000000feffffffff7f40000200000000000008ffffffff00000000010006000000000044000500ac1414bb000000000000000000000000000000003c0000000200000000000000000000000000000000000001060000"], 0xfc}, 0x1, 0x0, 0x0, 0x4008000}, 0x600c010) sendmsg$kcm(0xffffffffffffffff, &(0x7f0000000080)={&(0x7f0000000000)=@l2tp6={0xa, 0x0, 0x0, @loopback={0xfe80000000000000, 0xac14140c}}, 0x80, &(0x7f00000000c0)=[{&(0x7f0000000140)='\x00\x00', 0xffe3}], 0x1, 0x0, 0x0, 0x900}, 0x60) syz_usb_connect(0x3, 0x57, &(0x7f0000000000)=ANY=[@ANYBLOB="1201000200000040402001c60100000000010902450001010080fa0904"], 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000400)='./file1/file0\x00', 0x100) bpf$PROG_LOAD(0x5, 0x0, 0x0) executing program 6: syz_usb_connect(0x0, 0x4b, &(0x7f0000000000)=ANY=[@ANYBLOB="1201000200000040480b051000010102000109023900020100803209040000000000000009"], 0x0) r0 = syz_open_dev$dvb_demux(&(0x7f0000000200), 0x1, 0x2) ioctl$DVB_DEMUX_DMX_SET_PES_FILTER(r0, 0x40146f2c, &(0x7f0000000100)={0x1ff, 0x0, 0x3, 0xa, 0x4}) program crashed: general protection fault in mxl111sf_ep6_streaming_ctrl testing program (duration=9m0s, {Threaded:true Repeat:true RepeatTimes:0 Procs:6 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): [0, 6, 3] detailed listing: executing program 0: executing program 0: bpf$MAP_CREATE(0x0, &(0x7f0000000080)=ANY=[], 0x50) sendmsg$nl_xfrm(0xffffffffffffffff, &(0x7f0000000480)={0x0, 0x0, &(0x7f0000001f40)={&(0x7f00000004c0)=ANY=[@ANYBLOB="fc000000190001002dbd700000000000ac1e0001000000000000000000000000ac1414aa00"/48, @ANYRES32=0x0, @ANYRES32, @ANYBLOB="00000000000000000c00000000000000000000000000000000000000000000000000000000000000ffffffffffffffff000000000000000000000000000000000000000000000000000a000000000000feffffffff7f40000200000000000008ffffffff00000000010006000000000044000500ac1414bb000000000000000000000000000000003c0000000200000000000000000000000000000000000001060000"], 0xfc}, 0x1, 0x0, 0x0, 0x4008000}, 0x600c010) sendmsg$kcm(0xffffffffffffffff, &(0x7f0000000080)={&(0x7f0000000000)=@l2tp6={0xa, 0x0, 0x0, @loopback={0xfe80000000000000, 0xac14140c}}, 0x80, &(0x7f00000000c0)=[{&(0x7f0000000140)='\x00\x00', 0xffe3}], 0x1, 0x0, 0x0, 0x900}, 0x60) syz_usb_connect(0x3, 0x57, &(0x7f0000000000)=ANY=[@ANYBLOB="1201000200000040402001c60100000000010902450001010080fa0904"], 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000400)='./file1/file0\x00', 0x100) bpf$PROG_LOAD(0x5, 0x0, 0x0) executing program 6: syz_usb_connect(0x0, 0x4b, &(0x7f0000000000)=ANY=[@ANYBLOB="1201000200000040480b051000010102000109023900020100803209040000000000000009"], 0x0) r0 = syz_open_dev$dvb_demux(&(0x7f0000000200), 0x1, 0x2) ioctl$DVB_DEMUX_DMX_SET_PES_FILTER(r0, 0x40146f2c, &(0x7f0000000100)={0x1ff, 0x0, 0x3, 0xa, 0x4}) program crashed: general protection fault in mxl111sf_ep6_streaming_ctrl testing program (duration=9m0s, {Threaded:true Repeat:true RepeatTimes:0 Procs:6 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): [0, 5, 3] detailed listing: executing program 0: executing program 0: sendmsg$nl_xfrm(0xffffffffffffffff, &(0x7f0000000480)={0x0, 0x0, &(0x7f0000001f40)={&(0x7f00000004c0)=ANY=[@ANYBLOB="fc000000190001002dbd700000000000ac1e0001000000000000000000000000ac1414aa00"/48, @ANYRES32=0x0, @ANYRES32, @ANYBLOB="00000000000000000c00000000000000000000000000000000000000000000000000000000000000ffffffffffffffff000000000000000000000000000000000000000000000000000a000000000000feffffffff7f40000200000000000008ffffffff00000000010006000000000044000500ac1414bb000000000000000000000000000000003c0000000200000000000000000000000000000000000001060000"], 0xfc}, 0x1, 0x0, 0x0, 0x4008000}, 0x600c010) sendmsg$kcm(0xffffffffffffffff, &(0x7f0000000080)={&(0x7f0000000000)=@l2tp6={0xa, 0x0, 0x0, @loopback={0xfe80000000000000, 0xac14140c}}, 0x80, &(0x7f00000000c0)=[{&(0x7f0000000140)='\x00\x00', 0xffe3}], 0x1, 0x0, 0x0, 0x900}, 0x60) syz_usb_connect(0x3, 0x57, &(0x7f0000000000)=ANY=[@ANYBLOB="1201000200000040402001c60100000000010902450001010080fa0904"], 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000400)='./file1/file0\x00', 0x100) bpf$PROG_LOAD(0x5, 0x0, 0x0) executing program 6: syz_usb_connect(0x0, 0x4b, &(0x7f0000000000)=ANY=[@ANYBLOB="1201000200000040480b051000010102000109023900020100803209040000000000000009"], 0x0) r0 = syz_open_dev$dvb_demux(&(0x7f0000000200), 0x1, 0x2) ioctl$DVB_DEMUX_DMX_SET_PES_FILTER(r0, 0x40146f2c, &(0x7f0000000100)={0x1ff, 0x0, 0x3, 0xa, 0x4}) program crashed: general protection fault in mxl111sf_ep6_streaming_ctrl minimized 30 calls -> 5 calls minimizing program #2 before concatenation testing program (duration=9m0s, {Threaded:true Repeat:true RepeatTimes:0 Procs:6 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): [0, 5, 2] detailed listing: executing program 0: executing program 7: sendmsg$nl_xfrm(0xffffffffffffffff, &(0x7f0000000480)={0x0, 0x0, &(0x7f0000001f40)={&(0x7f00000004c0)=ANY=[@ANYBLOB="fc000000190001002dbd700000000000ac1e0001000000000000000000000000ac1414aa00"/48, @ANYRES32=0x0, @ANYRES32, @ANYBLOB="00000000000000000c00000000000000000000000000000000000000000000000000000000000000ffffffffffffffff000000000000000000000000000000000000000000000000000a000000000000feffffffff7f40000200000000000008ffffffff00000000010006000000000044000500ac1414bb000000000000000000000000000000003c0000000200000000000000000000000000000000000001060000"], 0xfc}, 0x1, 0x0, 0x0, 0x4008000}, 0x600c010) sendmsg$kcm(0xffffffffffffffff, &(0x7f0000000080)={&(0x7f0000000000)=@l2tp6={0xa, 0x0, 0x0, @loopback={0xfe80000000000000, 0xac14140c}}, 0x80, &(0x7f00000000c0)=[{&(0x7f0000000140)='\x00\x00', 0xffe3}], 0x1, 0x0, 0x0, 0x900}, 0x60) syz_usb_connect(0x3, 0x57, &(0x7f0000000000)=ANY=[@ANYBLOB="1201000200000040402001c60100000000010902450001010080fa0904"], 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000400)='./file1/file0\x00', 0x100) bpf$PROG_LOAD(0x5, 0x0, 0x0) executing program 0: syz_usb_connect(0x0, 0x4b, &(0x7f0000000000)=ANY=[@ANYBLOB="1201000200000040480b051000010102000109023900020100803209040000000000000009"], 0x0) syz_open_dev$dvb_demux(&(0x7f0000000200), 0x1, 0x2) program did not crash testing program (duration=9m0s, {Threaded:true Repeat:true RepeatTimes:0 Procs:6 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): [0, 5, 2] detailed listing: executing program 0: executing program 7: sendmsg$nl_xfrm(0xffffffffffffffff, &(0x7f0000000480)={0x0, 0x0, &(0x7f0000001f40)={&(0x7f00000004c0)=ANY=[@ANYBLOB="fc000000190001002dbd700000000000ac1e0001000000000000000000000000ac1414aa00"/48, @ANYRES32=0x0, @ANYRES32, @ANYBLOB="00000000000000000c00000000000000000000000000000000000000000000000000000000000000ffffffffffffffff000000000000000000000000000000000000000000000000000a000000000000feffffffff7f40000200000000000008ffffffff00000000010006000000000044000500ac1414bb000000000000000000000000000000003c0000000200000000000000000000000000000000000001060000"], 0xfc}, 0x1, 0x0, 0x0, 0x4008000}, 0x600c010) sendmsg$kcm(0xffffffffffffffff, &(0x7f0000000080)={&(0x7f0000000000)=@l2tp6={0xa, 0x0, 0x0, @loopback={0xfe80000000000000, 0xac14140c}}, 0x80, &(0x7f00000000c0)=[{&(0x7f0000000140)='\x00\x00', 0xffe3}], 0x1, 0x0, 0x0, 0x900}, 0x60) syz_usb_connect(0x3, 0x57, &(0x7f0000000000)=ANY=[@ANYBLOB="1201000200000040402001c60100000000010902450001010080fa0904"], 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000400)='./file1/file0\x00', 0x100) bpf$PROG_LOAD(0x5, 0x0, 0x0) executing program 0: syz_usb_connect(0x0, 0x4b, &(0x7f0000000000)=ANY=[@ANYBLOB="1201000200000040480b051000010102000109023900020100803209040000000000000009"], 0x0) ioctl$DVB_DEMUX_DMX_SET_PES_FILTER(0xffffffffffffffff, 0x40146f2c, &(0x7f0000000100)={0x1ff, 0x0, 0x3, 0xa, 0x4}) program did not crash testing program (duration=9m0s, {Threaded:true Repeat:true RepeatTimes:0 Procs:6 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): [0, 5, 2] detailed listing: executing program 0: executing program 7: sendmsg$nl_xfrm(0xffffffffffffffff, &(0x7f0000000480)={0x0, 0x0, &(0x7f0000001f40)={&(0x7f00000004c0)=ANY=[@ANYBLOB="fc000000190001002dbd700000000000ac1e0001000000000000000000000000ac1414aa00"/48, @ANYRES32=0x0, @ANYRES32, @ANYBLOB="00000000000000000c00000000000000000000000000000000000000000000000000000000000000ffffffffffffffff000000000000000000000000000000000000000000000000000a000000000000feffffffff7f40000200000000000008ffffffff00000000010006000000000044000500ac1414bb000000000000000000000000000000003c0000000200000000000000000000000000000000000001060000"], 0xfc}, 0x1, 0x0, 0x0, 0x4008000}, 0x600c010) sendmsg$kcm(0xffffffffffffffff, &(0x7f0000000080)={&(0x7f0000000000)=@l2tp6={0xa, 0x0, 0x0, @loopback={0xfe80000000000000, 0xac14140c}}, 0x80, &(0x7f00000000c0)=[{&(0x7f0000000140)='\x00\x00', 0xffe3}], 0x1, 0x0, 0x0, 0x900}, 0x60) syz_usb_connect(0x3, 0x57, &(0x7f0000000000)=ANY=[@ANYBLOB="1201000200000040402001c60100000000010902450001010080fa0904"], 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000400)='./file1/file0\x00', 0x100) bpf$PROG_LOAD(0x5, 0x0, 0x0) executing program 0: r0 = syz_open_dev$dvb_demux(&(0x7f0000000200), 0x1, 0x2) ioctl$DVB_DEMUX_DMX_SET_PES_FILTER(r0, 0x40146f2c, &(0x7f0000000100)={0x1ff, 0x0, 0x3, 0xa, 0x4}) program crashed: general protection fault in mxl111sf_ep6_streaming_ctrl minimized 3 calls -> 2 calls testing program (duration=9m0s, {Threaded:true Repeat:true RepeatTimes:0 Procs:6 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): sendmsg$nl_xfrm-sendmsg$kcm-syz_usb_connect-mkdirat-bpf$PROG_LOAD-syz_open_dev$dvb_demux-ioctl$DVB_DEMUX_DMX_SET_PES_FILTER detailed listing: executing program 0: sendmsg$nl_xfrm(0xffffffffffffffff, &(0x7f0000000480)={0x0, 0x0, &(0x7f0000001f40)={&(0x7f00000004c0)=ANY=[@ANYBLOB="fc000000190001002dbd700000000000ac1e0001000000000000000000000000ac1414aa00"/48, @ANYRES32=0x0, @ANYRES32, @ANYBLOB="00000000000000000c00000000000000000000000000000000000000000000000000000000000000ffffffffffffffff000000000000000000000000000000000000000000000000000a000000000000feffffffff7f40000200000000000008ffffffff00000000010006000000000044000500ac1414bb000000000000000000000000000000003c0000000200000000000000000000000000000000000001060000"], 0xfc}, 0x1, 0x0, 0x0, 0x4008000}, 0x600c010) sendmsg$kcm(0xffffffffffffffff, &(0x7f0000000080)={&(0x7f0000000000)=@l2tp6={0xa, 0x0, 0x0, @loopback={0xfe80000000000000, 0xac14140c}}, 0x80, &(0x7f00000000c0)=[{&(0x7f0000000140)='\x00\x00', 0xffe3}], 0x1, 0x0, 0x0, 0x900}, 0x60) syz_usb_connect(0x3, 0x57, &(0x7f0000000000)=ANY=[@ANYBLOB="1201000200000040402001c60100000000010902450001010080fa0904"], 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000400)='./file1/file0\x00', 0x100) bpf$PROG_LOAD(0x5, 0x0, 0x0) r0 = syz_open_dev$dvb_demux(&(0x7f0000000200), 0x1, 0x2) ioctl$DVB_DEMUX_DMX_SET_PES_FILTER(r0, 0x40146f2c, &(0x7f0000000100)={0x1ff, 0x0, 0x3, 0xa, 0x4}) program crashed: general protection fault in mxl111sf_ep6_streaming_ctrl bisect: concatenation succeeded found reproducer with 7 syscalls minimizing guilty program testing program (duration=1m41.621518484s, {Threaded:true Repeat:true RepeatTimes:0 Procs:6 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): sendmsg$nl_xfrm-sendmsg$kcm-syz_usb_connect-mkdirat-bpf$PROG_LOAD-syz_open_dev$dvb_demux detailed listing: executing program 0: sendmsg$nl_xfrm(0xffffffffffffffff, &(0x7f0000000480)={0x0, 0x0, &(0x7f0000001f40)={&(0x7f00000004c0)=ANY=[@ANYBLOB="fc000000190001002dbd700000000000ac1e0001000000000000000000000000ac1414aa00"/48, @ANYRES32=0x0, @ANYRES32, @ANYBLOB="00000000000000000c00000000000000000000000000000000000000000000000000000000000000ffffffffffffffff000000000000000000000000000000000000000000000000000a000000000000feffffffff7f40000200000000000008ffffffff00000000010006000000000044000500ac1414bb000000000000000000000000000000003c0000000200000000000000000000000000000000000001060000"], 0xfc}, 0x1, 0x0, 0x0, 0x4008000}, 0x600c010) sendmsg$kcm(0xffffffffffffffff, &(0x7f0000000080)={&(0x7f0000000000)=@l2tp6={0xa, 0x0, 0x0, @loopback={0xfe80000000000000, 0xac14140c}}, 0x80, &(0x7f00000000c0)=[{&(0x7f0000000140)='\x00\x00', 0xffe3}], 0x1, 0x0, 0x0, 0x900}, 0x60) syz_usb_connect(0x3, 0x57, &(0x7f0000000000)=ANY=[@ANYBLOB="1201000200000040402001c60100000000010902450001010080fa0904"], 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000400)='./file1/file0\x00', 0x100) bpf$PROG_LOAD(0x5, 0x0, 0x0) syz_open_dev$dvb_demux(&(0x7f0000000200), 0x1, 0x2) program did not crash testing program (duration=1m41.621518484s, {Threaded:true Repeat:true RepeatTimes:0 Procs:6 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): sendmsg$nl_xfrm-sendmsg$kcm-syz_usb_connect-mkdirat-bpf$PROG_LOAD-ioctl$DVB_DEMUX_DMX_SET_PES_FILTER detailed listing: executing program 0: sendmsg$nl_xfrm(0xffffffffffffffff, &(0x7f0000000480)={0x0, 0x0, &(0x7f0000001f40)={&(0x7f00000004c0)=ANY=[@ANYBLOB="fc000000190001002dbd700000000000ac1e0001000000000000000000000000ac1414aa00"/48, @ANYRES32=0x0, @ANYRES32, @ANYBLOB="00000000000000000c00000000000000000000000000000000000000000000000000000000000000ffffffffffffffff000000000000000000000000000000000000000000000000000a000000000000feffffffff7f40000200000000000008ffffffff00000000010006000000000044000500ac1414bb000000000000000000000000000000003c0000000200000000000000000000000000000000000001060000"], 0xfc}, 0x1, 0x0, 0x0, 0x4008000}, 0x600c010) sendmsg$kcm(0xffffffffffffffff, &(0x7f0000000080)={&(0x7f0000000000)=@l2tp6={0xa, 0x0, 0x0, @loopback={0xfe80000000000000, 0xac14140c}}, 0x80, &(0x7f00000000c0)=[{&(0x7f0000000140)='\x00\x00', 0xffe3}], 0x1, 0x0, 0x0, 0x900}, 0x60) syz_usb_connect(0x3, 0x57, &(0x7f0000000000)=ANY=[@ANYBLOB="1201000200000040402001c60100000000010902450001010080fa0904"], 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000400)='./file1/file0\x00', 0x100) bpf$PROG_LOAD(0x5, 0x0, 0x0) ioctl$DVB_DEMUX_DMX_SET_PES_FILTER(0xffffffffffffffff, 0x40146f2c, &(0x7f0000000100)={0x1ff, 0x0, 0x3, 0xa, 0x4}) program did not crash testing program (duration=1m41.621518484s, {Threaded:true Repeat:true RepeatTimes:0 Procs:6 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): sendmsg$nl_xfrm-sendmsg$kcm-syz_usb_connect-mkdirat-syz_open_dev$dvb_demux-ioctl$DVB_DEMUX_DMX_SET_PES_FILTER detailed listing: executing program 0: sendmsg$nl_xfrm(0xffffffffffffffff, &(0x7f0000000480)={0x0, 0x0, &(0x7f0000001f40)={&(0x7f00000004c0)=ANY=[@ANYBLOB="fc000000190001002dbd700000000000ac1e0001000000000000000000000000ac1414aa00"/48, @ANYRES32=0x0, @ANYRES32, @ANYBLOB="00000000000000000c00000000000000000000000000000000000000000000000000000000000000ffffffffffffffff000000000000000000000000000000000000000000000000000a000000000000feffffffff7f40000200000000000008ffffffff00000000010006000000000044000500ac1414bb000000000000000000000000000000003c0000000200000000000000000000000000000000000001060000"], 0xfc}, 0x1, 0x0, 0x0, 0x4008000}, 0x600c010) sendmsg$kcm(0xffffffffffffffff, &(0x7f0000000080)={&(0x7f0000000000)=@l2tp6={0xa, 0x0, 0x0, @loopback={0xfe80000000000000, 0xac14140c}}, 0x80, &(0x7f00000000c0)=[{&(0x7f0000000140)='\x00\x00', 0xffe3}], 0x1, 0x0, 0x0, 0x900}, 0x60) syz_usb_connect(0x3, 0x57, &(0x7f0000000000)=ANY=[@ANYBLOB="1201000200000040402001c60100000000010902450001010080fa0904"], 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000400)='./file1/file0\x00', 0x100) r0 = syz_open_dev$dvb_demux(&(0x7f0000000200), 0x1, 0x2) ioctl$DVB_DEMUX_DMX_SET_PES_FILTER(r0, 0x40146f2c, &(0x7f0000000100)={0x1ff, 0x0, 0x3, 0xa, 0x4}) program crashed: general protection fault in mxl111sf_ep6_streaming_ctrl testing program (duration=1m41.621518484s, {Threaded:true Repeat:true RepeatTimes:0 Procs:6 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): sendmsg$nl_xfrm-sendmsg$kcm-syz_usb_connect-syz_open_dev$dvb_demux-ioctl$DVB_DEMUX_DMX_SET_PES_FILTER detailed listing: executing program 0: sendmsg$nl_xfrm(0xffffffffffffffff, &(0x7f0000000480)={0x0, 0x0, &(0x7f0000001f40)={&(0x7f00000004c0)=ANY=[@ANYBLOB="fc000000190001002dbd700000000000ac1e0001000000000000000000000000ac1414aa00"/48, @ANYRES32=0x0, @ANYRES32, @ANYBLOB="00000000000000000c00000000000000000000000000000000000000000000000000000000000000ffffffffffffffff000000000000000000000000000000000000000000000000000a000000000000feffffffff7f40000200000000000008ffffffff00000000010006000000000044000500ac1414bb000000000000000000000000000000003c0000000200000000000000000000000000000000000001060000"], 0xfc}, 0x1, 0x0, 0x0, 0x4008000}, 0x600c010) sendmsg$kcm(0xffffffffffffffff, &(0x7f0000000080)={&(0x7f0000000000)=@l2tp6={0xa, 0x0, 0x0, @loopback={0xfe80000000000000, 0xac14140c}}, 0x80, &(0x7f00000000c0)=[{&(0x7f0000000140)='\x00\x00', 0xffe3}], 0x1, 0x0, 0x0, 0x900}, 0x60) syz_usb_connect(0x3, 0x57, &(0x7f0000000000)=ANY=[@ANYBLOB="1201000200000040402001c60100000000010902450001010080fa0904"], 0x0) r0 = syz_open_dev$dvb_demux(&(0x7f0000000200), 0x1, 0x2) ioctl$DVB_DEMUX_DMX_SET_PES_FILTER(r0, 0x40146f2c, &(0x7f0000000100)={0x1ff, 0x0, 0x3, 0xa, 0x4}) program crashed: general protection fault in mxl111sf_ep6_streaming_ctrl testing program (duration=1m41.621518484s, {Threaded:true Repeat:true RepeatTimes:0 Procs:6 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): sendmsg$nl_xfrm-sendmsg$kcm-syz_open_dev$dvb_demux-ioctl$DVB_DEMUX_DMX_SET_PES_FILTER detailed listing: executing program 0: sendmsg$nl_xfrm(0xffffffffffffffff, &(0x7f0000000480)={0x0, 0x0, &(0x7f0000001f40)={&(0x7f00000004c0)=ANY=[@ANYBLOB="fc000000190001002dbd700000000000ac1e0001000000000000000000000000ac1414aa00"/48, @ANYRES32=0x0, @ANYRES32, @ANYBLOB="00000000000000000c00000000000000000000000000000000000000000000000000000000000000ffffffffffffffff000000000000000000000000000000000000000000000000000a000000000000feffffffff7f40000200000000000008ffffffff00000000010006000000000044000500ac1414bb000000000000000000000000000000003c0000000200000000000000000000000000000000000001060000"], 0xfc}, 0x1, 0x0, 0x0, 0x4008000}, 0x600c010) sendmsg$kcm(0xffffffffffffffff, &(0x7f0000000080)={&(0x7f0000000000)=@l2tp6={0xa, 0x0, 0x0, @loopback={0xfe80000000000000, 0xac14140c}}, 0x80, &(0x7f00000000c0)=[{&(0x7f0000000140)='\x00\x00', 0xffe3}], 0x1, 0x0, 0x0, 0x900}, 0x60) r0 = syz_open_dev$dvb_demux(&(0x7f0000000200), 0x1, 0x2) ioctl$DVB_DEMUX_DMX_SET_PES_FILTER(r0, 0x40146f2c, &(0x7f0000000100)={0x1ff, 0x0, 0x3, 0xa, 0x4}) program did not crash testing program (duration=1m41.621518484s, {Threaded:true Repeat:true RepeatTimes:0 Procs:6 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): sendmsg$nl_xfrm-syz_usb_connect-syz_open_dev$dvb_demux-ioctl$DVB_DEMUX_DMX_SET_PES_FILTER detailed listing: executing program 0: sendmsg$nl_xfrm(0xffffffffffffffff, &(0x7f0000000480)={0x0, 0x0, &(0x7f0000001f40)={&(0x7f00000004c0)=ANY=[@ANYBLOB="fc000000190001002dbd700000000000ac1e0001000000000000000000000000ac1414aa00"/48, @ANYRES32=0x0, @ANYRES32, @ANYBLOB="00000000000000000c00000000000000000000000000000000000000000000000000000000000000ffffffffffffffff000000000000000000000000000000000000000000000000000a000000000000feffffffff7f40000200000000000008ffffffff00000000010006000000000044000500ac1414bb000000000000000000000000000000003c0000000200000000000000000000000000000000000001060000"], 0xfc}, 0x1, 0x0, 0x0, 0x4008000}, 0x600c010) syz_usb_connect(0x3, 0x57, &(0x7f0000000000)=ANY=[@ANYBLOB="1201000200000040402001c60100000000010902450001010080fa0904"], 0x0) r0 = syz_open_dev$dvb_demux(&(0x7f0000000200), 0x1, 0x2) ioctl$DVB_DEMUX_DMX_SET_PES_FILTER(r0, 0x40146f2c, &(0x7f0000000100)={0x1ff, 0x0, 0x3, 0xa, 0x4}) program crashed: general protection fault in mxl111sf_ep6_streaming_ctrl testing program (duration=1m41.621518484s, {Threaded:true Repeat:true RepeatTimes:0 Procs:6 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_usb_connect-syz_open_dev$dvb_demux-ioctl$DVB_DEMUX_DMX_SET_PES_FILTER detailed listing: executing program 0: syz_usb_connect(0x3, 0x57, &(0x7f0000000000)=ANY=[@ANYBLOB="1201000200000040402001c60100000000010902450001010080fa0904"], 0x0) r0 = syz_open_dev$dvb_demux(&(0x7f0000000200), 0x1, 0x2) ioctl$DVB_DEMUX_DMX_SET_PES_FILTER(r0, 0x40146f2c, &(0x7f0000000100)={0x1ff, 0x0, 0x3, 0xa, 0x4}) program crashed: general protection fault in mxl111sf_ep6_streaming_ctrl testing program (duration=1m41.621518484s, {Threaded:true Repeat:true RepeatTimes:0 Procs:6 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_usb_connect-syz_open_dev$dvb_demux-ioctl$DVB_DEMUX_DMX_SET_PES_FILTER detailed listing: executing program 0: syz_usb_connect(0x3, 0x57, 0x0, 0x0) r0 = syz_open_dev$dvb_demux(&(0x7f0000000200), 0x1, 0x2) ioctl$DVB_DEMUX_DMX_SET_PES_FILTER(r0, 0x40146f2c, &(0x7f0000000100)={0x1ff, 0x0, 0x3, 0xa, 0x4}) program did not crash testing program (duration=1m41.621518484s, {Threaded:true Repeat:true RepeatTimes:0 Procs:6 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_usb_connect-syz_open_dev$dvb_demux-ioctl$DVB_DEMUX_DMX_SET_PES_FILTER detailed listing: executing program 0: syz_usb_connect(0x3, 0x57, &(0x7f0000000000)=ANY=[@ANYBLOB], 0x0) r0 = syz_open_dev$dvb_demux(&(0x7f0000000200), 0x1, 0x2) ioctl$DVB_DEMUX_DMX_SET_PES_FILTER(r0, 0x40146f2c, &(0x7f0000000100)={0x1ff, 0x0, 0x3, 0xa, 0x4}) program did not crash testing program (duration=1m41.621518484s, {Threaded:true Repeat:true RepeatTimes:0 Procs:6 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_usb_connect-syz_open_dev$dvb_demux-ioctl$DVB_DEMUX_DMX_SET_PES_FILTER detailed listing: executing program 0: syz_usb_connect(0x3, 0x57, &(0x7f0000000000)=ANY=[@ANYBLOB="1201000200000040402001c60100000000010902450001010080fa0904"], 0x0) r0 = syz_open_dev$dvb_demux(0x0, 0x1, 0x2) ioctl$DVB_DEMUX_DMX_SET_PES_FILTER(r0, 0x40146f2c, &(0x7f0000000100)={0x1ff, 0x0, 0x3, 0xa, 0x4}) program did not crash testing program (duration=1m41.621518484s, {Threaded:true Repeat:true RepeatTimes:0 Procs:6 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_usb_connect-syz_open_dev$dvb_demux-ioctl$DVB_DEMUX_DMX_SET_PES_FILTER detailed listing: executing program 0: syz_usb_connect(0x3, 0x57, &(0x7f0000000000)=ANY=[@ANYBLOB="1201000200000040402001c60100000000010902450001010080fa0904"], 0x0) r0 = syz_open_dev$dvb_demux(&(0x7f0000000200), 0x1, 0x2) ioctl$DVB_DEMUX_DMX_SET_PES_FILTER(r0, 0x40146f2c, 0x0) program did not crash extracting C reproducer testing compiled C program (duration=1m41.621518484s, {Threaded:true Repeat:true RepeatTimes:0 Procs:6 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_usb_connect-syz_open_dev$dvb_demux-ioctl$DVB_DEMUX_DMX_SET_PES_FILTER program crashed: general protection fault in mxl111sf_ep6_streaming_ctrl simplifying C reproducer testing compiled C program (duration=1m41.621518484s, {Threaded:false Repeat:true RepeatTimes:0 Procs:6 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_usb_connect-syz_open_dev$dvb_demux-ioctl$DVB_DEMUX_DMX_SET_PES_FILTER program crashed: general protection fault in mxl111sf_ep6_streaming_ctrl testing compiled C program (duration=1m41.621518484s, {Threaded:false Repeat:true RepeatTimes:0 Procs:1 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_usb_connect-syz_open_dev$dvb_demux-ioctl$DVB_DEMUX_DMX_SET_PES_FILTER program did not crash testing compiled C program (duration=1m41.621518484s, {Threaded:false Repeat:true RepeatTimes:0 Procs:6 Slowdown:1 Sandbox: SandboxArg:0 Leak:false NetInjection:false NetDevices:false NetReset:false Cgroups:false BinfmtMisc:false CloseFDs:false KCSAN:false DevlinkPCI:false NicVF:false USB:false VhciInjection:false Wifi:false IEEE802154:true Sysctl:true Swap:false UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_usb_connect-syz_open_dev$dvb_demux-ioctl$DVB_DEMUX_DMX_SET_PES_FILTER program crashed: general protection fault in mxl111sf_ep6_streaming_ctrl testing compiled C program (duration=1m41.621518484s, {Threaded:false Repeat:true RepeatTimes:0 Procs:6 Slowdown:1 Sandbox: SandboxArg:0 Leak:false NetInjection:false NetDevices:false NetReset:false Cgroups:false BinfmtMisc:false CloseFDs:false KCSAN:false DevlinkPCI:false NicVF:false USB:false VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:false UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_usb_connect-syz_open_dev$dvb_demux-ioctl$DVB_DEMUX_DMX_SET_PES_FILTER program crashed: general protection fault in mxl111sf_ep6_streaming_ctrl testing compiled C program (duration=1m41.621518484s, {Threaded:false Repeat:true RepeatTimes:0 Procs:6 Slowdown:1 Sandbox: SandboxArg:0 Leak:false NetInjection:false NetDevices:false NetReset:false Cgroups:false BinfmtMisc:false CloseFDs:false KCSAN:false DevlinkPCI:false NicVF:false USB:false VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:false UseTmpDir:false HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_usb_connect-syz_open_dev$dvb_demux-ioctl$DVB_DEMUX_DMX_SET_PES_FILTER program crashed: general protection fault in mxl111sf_ep6_streaming_ctrl testing compiled C program (duration=1m41.621518484s, {Threaded:false Repeat:true RepeatTimes:0 Procs:6 Slowdown:1 Sandbox: SandboxArg:0 Leak:false NetInjection:false NetDevices:false NetReset:false Cgroups:false BinfmtMisc:false CloseFDs:false KCSAN:false DevlinkPCI:false NicVF:false USB:false VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:false UseTmpDir:false HandleSegv:false Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_usb_connect-syz_open_dev$dvb_demux-ioctl$DVB_DEMUX_DMX_SET_PES_FILTER program crashed: general protection fault in mxl111sf_ep6_streaming_ctrl testing compiled C program (duration=1m41.621518484s, {Threaded:false Repeat:true RepeatTimes:0 Procs:6 Slowdown:1 Sandbox: SandboxArg:0 Leak:false NetInjection:false NetDevices:false NetReset:false Cgroups:false BinfmtMisc:false CloseFDs:false KCSAN:false DevlinkPCI:false NicVF:false USB:false VhciInjection:false Wifi:false IEEE802154:false Sysctl:false Swap:false UseTmpDir:false HandleSegv:false Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_usb_connect-syz_open_dev$dvb_demux-ioctl$DVB_DEMUX_DMX_SET_PES_FILTER program crashed: UBSAN: array-index-out-of-bounds in dvb_usb_start_feed testing program (duration=1m41.621518484s, {Threaded:false Repeat:true RepeatTimes:0 Procs:6 Slowdown:1 Sandbox: SandboxArg:0 Leak:false NetInjection:false NetDevices:false NetReset:false Cgroups:false BinfmtMisc:false CloseFDs:false KCSAN:false DevlinkPCI:false NicVF:false USB:false VhciInjection:false Wifi:false IEEE802154:false Sysctl:false Swap:false UseTmpDir:false HandleSegv:false Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_usb_connect-syz_open_dev$dvb_demux-ioctl$DVB_DEMUX_DMX_SET_PES_FILTER detailed listing: executing program 0: syz_usb_connect(0x3, 0x57, &(0x7f0000000000)=ANY=[@ANYBLOB="1201000200000040402001c60100000000010902450001010080fa0904"], 0x0) r0 = syz_open_dev$dvb_demux(&(0x7f0000000200), 0x1, 0x2) ioctl$DVB_DEMUX_DMX_SET_PES_FILTER(r0, 0x40146f2c, &(0x7f0000000100)={0x1ff, 0x0, 0x3, 0xa, 0x4}) program crashed: general protection fault in mxl111sf_ep6_streaming_ctrl validation run: crashed=true testing program (duration=1m41.621518484s, {Threaded:false Repeat:true RepeatTimes:0 Procs:6 Slowdown:1 Sandbox: SandboxArg:0 Leak:false NetInjection:false NetDevices:false NetReset:false Cgroups:false BinfmtMisc:false CloseFDs:false KCSAN:false DevlinkPCI:false NicVF:false USB:false VhciInjection:false Wifi:false IEEE802154:false Sysctl:false Swap:false UseTmpDir:false HandleSegv:false Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_usb_connect-syz_open_dev$dvb_demux-ioctl$DVB_DEMUX_DMX_SET_PES_FILTER detailed listing: executing program 0: syz_usb_connect(0x3, 0x57, &(0x7f0000000000)=ANY=[@ANYBLOB="1201000200000040402001c60100000000010902450001010080fa0904"], 0x0) r0 = syz_open_dev$dvb_demux(&(0x7f0000000200), 0x1, 0x2) ioctl$DVB_DEMUX_DMX_SET_PES_FILTER(r0, 0x40146f2c, &(0x7f0000000100)={0x1ff, 0x0, 0x3, 0xa, 0x4}) program crashed: general protection fault in mxl111sf_ep6_streaming_ctrl validation run: crashed=true testing program (duration=1m41.621518484s, {Threaded:false Repeat:true RepeatTimes:0 Procs:6 Slowdown:1 Sandbox: SandboxArg:0 Leak:false NetInjection:false NetDevices:false NetReset:false Cgroups:false BinfmtMisc:false CloseFDs:false KCSAN:false DevlinkPCI:false NicVF:false USB:false VhciInjection:false Wifi:false IEEE802154:false Sysctl:false Swap:false UseTmpDir:false HandleSegv:false Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_usb_connect-syz_open_dev$dvb_demux-ioctl$DVB_DEMUX_DMX_SET_PES_FILTER detailed listing: executing program 0: syz_usb_connect(0x3, 0x57, &(0x7f0000000000)=ANY=[@ANYBLOB="1201000200000040402001c60100000000010902450001010080fa0904"], 0x0) r0 = syz_open_dev$dvb_demux(&(0x7f0000000200), 0x1, 0x2) ioctl$DVB_DEMUX_DMX_SET_PES_FILTER(r0, 0x40146f2c, &(0x7f0000000100)={0x1ff, 0x0, 0x3, 0xa, 0x4}) program crashed: general protection fault in mxl111sf_ep6_streaming_ctrl validation run: crashed=true reproducing took 5h20m40.445214381s repro crashed as (corrupted=false): usb 1-1: dvb_usb_v2: could not submit urb no. 0 - get them all back Oops: general protection fault, probably for non-canonical address 0xdffffc0000000061: 0000 [#1] SMP KASAN NOPTI KASAN: null-ptr-deref in range [0x0000000000000308-0x000000000000030f] CPU: 0 UID: 0 PID: 6066 Comm: syz.0.23 Not tainted syzkaller #0 PREEMPT(full) Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 08/05/2026 RIP: 0010:mxl111sf_ep6_streaming_ctrl+0x2e/0x2e0 drivers/media/usb/dvb-usb-v2/mxl111sf.c:348 Code: 55 41 57 41 56 41 54 53 89 f5 49 89 fe 49 bc 00 00 00 00 00 fc ff df e8 10 62 93 f9 49 8d 9e 08 03 00 00 48 89 d8 48 c1 e8 03 <42> 80 3c 20 00 74 08 48 89 df e8 53 66 03 fa 48 8b 1b 48 83 c3 38 RSP: 0018:ffffc900042cfb30 EFLAGS: 00010212 RAX: 0000000000000061 RBX: 0000000000000308 RCX: ffff88807c950000 RDX: 0000000000000000 RSI: 0000000000000001 RDI: 0000000000000000 RBP: 0000000000000001 R08: ffffc900042cf647 R09: 1ffff92000859ec8 R10: dffffc0000000000 R11: ffffffff883479d0 R12: dffffc0000000000 R13: ffff888055c053b8 R14: 0000000000000000 R15: ffff888055c048d8 FS: 0000555559586500(0000) GS:ffff888124cca000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: 00007f5668a70050 CR3: 0000000074c5e000 CR4: 0000000000350ef0 Call Trace: dvb_usb_start_feed+0x57a/0xc70 drivers/media/usb/dvb-usb-v2/dvb_usb_core.c:308 dmx_ts_feed_start_filtering+0x129/0x220 drivers/media/dvb-core/dvb_demux.c:747 dvb_dmxdev_start_feed drivers/media/dvb-core/dmxdev.c:658 [inline] dvb_dmxdev_filter_start+0x434/0x10d0 drivers/media/dvb-core/dmxdev.c:769 dvb_demux_do_ioctl+0x48b/0x540 drivers/media/dvb-core/dmxdev.c:1099 dvb_usercopy+0x199/0x2e0 drivers/media/dvb-core/dvbdev.c:996 dvb_demux_ioctl+0x29/0x40 drivers/media/dvb-core/dmxdev.c:1208 vfs_ioctl fs/ioctl.c:51 [inline] __do_sys_ioctl fs/ioctl.c:597 [inline] __se_sys_ioctl+0xfc/0x170 fs/ioctl.c:583 do_syscall_x64 arch/x86/entry/syscall_64.c:61 [inline] do_syscall_64+0x166/0x520 arch/x86/entry/syscall_64.c:84 entry_SYSCALL_64_after_hwframe+0x77/0x7f RIP: 0033:0x7f5668b9e159 Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 RSP: 002b:00007ffd22830028 EFLAGS: 00000246 ORIG_RAX: 0000000000000010 RAX: ffffffffffffffda RBX: 00007f5668e25fa0 RCX: 00007f5668b9e159 RDX: 0000200000000100 RSI: 0000000040146f2c RDI: 0000000000000004 RBP: 00007f5668c3506b R08: 0000000000000000 R09: 0000000000000000 R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 R13: 00007f5668e25fac R14: 00007f5668e25fa0 R15: 00007f5668e25fa0 Modules linked in: ---[ end trace 0000000000000000 ]--- RIP: 0010:mxl111sf_ep6_streaming_ctrl+0x2e/0x2e0 drivers/media/usb/dvb-usb-v2/mxl111sf.c:348 Code: 55 41 57 41 56 41 54 53 89 f5 49 89 fe 49 bc 00 00 00 00 00 fc ff df e8 10 62 93 f9 49 8d 9e 08 03 00 00 48 89 d8 48 c1 e8 03 <42> 80 3c 20 00 74 08 48 89 df e8 53 66 03 fa 48 8b 1b 48 83 c3 38 RSP: 0018:ffffc900042cfb30 EFLAGS: 00010212 RAX: 0000000000000061 RBX: 0000000000000308 RCX: ffff88807c950000 RDX: 0000000000000000 RSI: 0000000000000001 RDI: 0000000000000000 RBP: 0000000000000001 R08: ffffc900042cf647 R09: 1ffff92000859ec8 R10: dffffc0000000000 R11: ffffffff883479d0 R12: dffffc0000000000 R13: ffff888055c053b8 R14: 0000000000000000 R15: ffff888055c048d8 FS: 0000555559586500(0000) GS:ffff888124cca000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: 00007f5668a70050 CR3: 0000000074c5e000 CR4: 0000000000350ef0 ---------------- Code disassembly (best guess): 0: 55 push %rbp 1: 41 57 push %r15 3: 41 56 push %r14 5: 41 54 push %r12 7: 53 push %rbx 8: 89 f5 mov %esi,%ebp a: 49 89 fe mov %rdi,%r14 d: 49 bc 00 00 00 00 00 movabs $0xdffffc0000000000,%r12 14: fc ff df 17: e8 10 62 93 f9 call 0xf993622c 1c: 49 8d 9e 08 03 00 00 lea 0x308(%r14),%rbx 23: 48 89 d8 mov %rbx,%rax 26: 48 c1 e8 03 shr $0x3,%rax * 2a: 42 80 3c 20 00 cmpb $0x0,(%rax,%r12,1) <-- trapping instruction 2f: 74 08 je 0x39 31: 48 89 df mov %rbx,%rdi 34: e8 53 66 03 fa call 0xfa03668c 39: 48 8b 1b mov (%rbx),%rbx 3c: 48 83 c3 38 add $0x38,%rbx final repro crashed as (corrupted=false): usb 1-1: dvb_usb_v2: could not submit urb no. 0 - get them all back Oops: general protection fault, probably for non-canonical address 0xdffffc0000000061: 0000 [#1] SMP KASAN NOPTI KASAN: null-ptr-deref in range [0x0000000000000308-0x000000000000030f] CPU: 0 UID: 0 PID: 6066 Comm: syz.0.23 Not tainted syzkaller #0 PREEMPT(full) Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 08/05/2026 RIP: 0010:mxl111sf_ep6_streaming_ctrl+0x2e/0x2e0 drivers/media/usb/dvb-usb-v2/mxl111sf.c:348 Code: 55 41 57 41 56 41 54 53 89 f5 49 89 fe 49 bc 00 00 00 00 00 fc ff df e8 10 62 93 f9 49 8d 9e 08 03 00 00 48 89 d8 48 c1 e8 03 <42> 80 3c 20 00 74 08 48 89 df e8 53 66 03 fa 48 8b 1b 48 83 c3 38 RSP: 0018:ffffc900042cfb30 EFLAGS: 00010212 RAX: 0000000000000061 RBX: 0000000000000308 RCX: ffff88807c950000 RDX: 0000000000000000 RSI: 0000000000000001 RDI: 0000000000000000 RBP: 0000000000000001 R08: ffffc900042cf647 R09: 1ffff92000859ec8 R10: dffffc0000000000 R11: ffffffff883479d0 R12: dffffc0000000000 R13: ffff888055c053b8 R14: 0000000000000000 R15: ffff888055c048d8 FS: 0000555559586500(0000) GS:ffff888124cca000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: 00007f5668a70050 CR3: 0000000074c5e000 CR4: 0000000000350ef0 Call Trace: dvb_usb_start_feed+0x57a/0xc70 drivers/media/usb/dvb-usb-v2/dvb_usb_core.c:308 dmx_ts_feed_start_filtering+0x129/0x220 drivers/media/dvb-core/dvb_demux.c:747 dvb_dmxdev_start_feed drivers/media/dvb-core/dmxdev.c:658 [inline] dvb_dmxdev_filter_start+0x434/0x10d0 drivers/media/dvb-core/dmxdev.c:769 dvb_demux_do_ioctl+0x48b/0x540 drivers/media/dvb-core/dmxdev.c:1099 dvb_usercopy+0x199/0x2e0 drivers/media/dvb-core/dvbdev.c:996 dvb_demux_ioctl+0x29/0x40 drivers/media/dvb-core/dmxdev.c:1208 vfs_ioctl fs/ioctl.c:51 [inline] __do_sys_ioctl fs/ioctl.c:597 [inline] __se_sys_ioctl+0xfc/0x170 fs/ioctl.c:583 do_syscall_x64 arch/x86/entry/syscall_64.c:61 [inline] do_syscall_64+0x166/0x520 arch/x86/entry/syscall_64.c:84 entry_SYSCALL_64_after_hwframe+0x77/0x7f RIP: 0033:0x7f5668b9e159 Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 RSP: 002b:00007ffd22830028 EFLAGS: 00000246 ORIG_RAX: 0000000000000010 RAX: ffffffffffffffda RBX: 00007f5668e25fa0 RCX: 00007f5668b9e159 RDX: 0000200000000100 RSI: 0000000040146f2c RDI: 0000000000000004 RBP: 00007f5668c3506b R08: 0000000000000000 R09: 0000000000000000 R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 R13: 00007f5668e25fac R14: 00007f5668e25fa0 R15: 00007f5668e25fa0 Modules linked in: ---[ end trace 0000000000000000 ]--- RIP: 0010:mxl111sf_ep6_streaming_ctrl+0x2e/0x2e0 drivers/media/usb/dvb-usb-v2/mxl111sf.c:348 Code: 55 41 57 41 56 41 54 53 89 f5 49 89 fe 49 bc 00 00 00 00 00 fc ff df e8 10 62 93 f9 49 8d 9e 08 03 00 00 48 89 d8 48 c1 e8 03 <42> 80 3c 20 00 74 08 48 89 df e8 53 66 03 fa 48 8b 1b 48 83 c3 38 RSP: 0018:ffffc900042cfb30 EFLAGS: 00010212 RAX: 0000000000000061 RBX: 0000000000000308 RCX: ffff88807c950000 RDX: 0000000000000000 RSI: 0000000000000001 RDI: 0000000000000000 RBP: 0000000000000001 R08: ffffc900042cf647 R09: 1ffff92000859ec8 R10: dffffc0000000000 R11: ffffffff883479d0 R12: dffffc0000000000 R13: ffff888055c053b8 R14: 0000000000000000 R15: ffff888055c048d8 FS: 0000555559586500(0000) GS:ffff888124cca000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: 00007f5668a70050 CR3: 0000000074c5e000 CR4: 0000000000350ef0 ---------------- Code disassembly (best guess): 0: 55 push %rbp 1: 41 57 push %r15 3: 41 56 push %r14 5: 41 54 push %r12 7: 53 push %rbx 8: 89 f5 mov %esi,%ebp a: 49 89 fe mov %rdi,%r14 d: 49 bc 00 00 00 00 00 movabs $0xdffffc0000000000,%r12 14: fc ff df 17: e8 10 62 93 f9 call 0xf993622c 1c: 49 8d 9e 08 03 00 00 lea 0x308(%r14),%rbx 23: 48 89 d8 mov %rbx,%rax 26: 48 c1 e8 03 shr $0x3,%rax * 2a: 42 80 3c 20 00 cmpb $0x0,(%rax,%r12,1) <-- trapping instruction 2f: 74 08 je 0x39 31: 48 89 df mov %rbx,%rdi 34: e8 53 66 03 fa call 0xfa03668c 39: 48 8b 1b mov (%rbx),%rbx 3c: 48 83 c3 38 add $0x38,%rbx