Extracting prog: 42m6.274948882s Minimizing prog: 6m48.13766116s Simplifying prog options: 4m1.838907802s Extracting C: 51.746672922s Simplifying C: 0s extracting reproducer from 24 programs testing a last program of every proc single: executing 4 programs separately with timeout 30s testing program (duration=30s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): creat-open$dir-ioctl$TIOCL_GETSHIFTSTATE-mmap$xdp-add_key-bpf$PROG_LOAD-accept4$inet6-openat$ptmx-ioctl$TIOCSETD-ioctl$TCFLSH-syz_init_net_socket$bt_hci-bpf$ITER_CREATE-bind$bt_hci-setsockopt$packet_fanout_data-write$binfmt_misc-ioctl$sock_inet_SIOCSIFFLAGS-kexec_load-prlimit64-madvise-mremap-gettid-process_vm_writev-openat$full-syz_kvm_setup_cpu$x86-creat-write$uinput_user_dev-openat$drirender128-ioctl$DRM_IOCTL_GEM_OPEN-ioctl$DRM_IOCTL_GEM_FLINK-bpf$BPF_LINK_CREATE_XDP detailed listing: executing program 0: r0 = creat(&(0x7f00000002c0)='./file0\x00', 0x0) r1 = open$dir(&(0x7f0000000080)='./file0\x00', 0x0, 0x0) ioctl$TIOCL_GETSHIFTSTATE(r0, 0x541c, &(0x7f0000000300)={0x6, 0xf9}) mmap$xdp(&(0x7f0000ffc000/0x4000)=nil, 0x4000, 0x0, 0x12, r1, 0x0) add_key(&(0x7f0000000040)='dns_resolver\x00', &(0x7f0000000400)={'syz', 0x3}, &(0x7f0000000080)="000001020200", 0x6, 0xfffffffffffffffb) r2 = bpf$PROG_LOAD(0x5, &(0x7f0000000040)={0x2, 0x4, &(0x7f0000000200)=ANY=[@ANYBLOB="180000000300000000000000feffff10850000000700000095"], &(0x7f0000000000)='GPL\x00', 0x0, 0x0, 0x0, 0x100, 0x70, '\x00', 0x0, @fallback=0x30, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @void, @value}, 0x94) r3 = accept4$inet6(r0, &(0x7f0000000100)={0xa, 0x0, 0x0, @loopback}, &(0x7f0000000240)=0x1c, 0x800) r4 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000100), 0x0, 0x0) ioctl$TIOCSETD(r4, 0x5423, &(0x7f00000000c0)=0xf) ioctl$TCFLSH(r4, 0x400455c8, 0x0) r5 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) r6 = bpf$ITER_CREATE(0xb, &(0x7f0000000100), 0x8) bind$bt_hci(r5, &(0x7f0000000000)={0x1f, 0xffff, 0x3}, 0x6) setsockopt$packet_fanout_data(r6, 0x107, 0x16, &(0x7f0000000100)={0x3c, &(0x7f0000000180)=[{0x0, 0x80}, {0x1, 0x1}]}, 0x10) write$binfmt_misc(r5, &(0x7f0000000100), 0x6) ioctl$sock_inet_SIOCSIFFLAGS(r3, 0x8914, &(0x7f0000000280)={'pim6reg1\x00', 0x2}) kexec_load(0x10001, 0x7, &(0x7f0000000d00)=[{&(0x7f0000000880)="37fb79c14b452fe422d277f3feab89bd5416dfcf3bf47545e5ab096dcb018ccf5e7834151fe735f3c37c51b7a72535bc3d1eacead7abed2865da31aa63967c330aedc3705baa61a5607cd0a3a2070d37edfceeb570c4f4a4779225903bdcdbe4dd42df2455794ccc41f4f35f7dad393d2e51029b4d4bb0121453837f0c8d7f83382871fb357ccea66bf27d0105b51f7fa7efff0e8c858dd71b23ffa2276f6066701df8d656ef5e7a6668eaf28a714efaf6abc7f50e1d41f8d18212b678c2f51952f9b14cd732d94abd44ee9c6c3e70cf5e8092eefed3562b38b60acf756feb66dc1e85179ea011d05e29ff33", 0xec, 0x3, 0x1}, {&(0x7f0000000980)="48f8c31e4b57576b253e8835a21c3715777121e4dc6de0b9fafa8105e0c0df84680beb46d29d31f8ddbfe7b650c091ab6cca47192b1c695ce7b539954ebbdad07798399cb6d201b26b806df11ce19cbc0520448b0546ae61a7d3c41d94f4b8479e568ce09b2473975832593dbb2a8fc24ce235fee4f907116cb4aae39c7273cfc3250d6de2cdf5dff4eb4a1763747daccc20cb58a91676a9d65828edef6e4dca63d8c2893a333a4db2c3f68b47774b3d389b3875eaf38f6ce0294b0ca716e2241b6c", 0xc2, 0x200, 0xd}, {&(0x7f0000000a80)="d31588bf1cc6434b3a9c34146e87304d2812f1adc1fce1ada8825cb60b0f401ce94eb0bf9d06f365fc41797047fb1a1511704466190641d88412d4bfaf56b5e2f262551b745377985bae27ccbcfbf9e8dc8ee84d8cb0867f9caddd604bf6120303f320552e5f42a2afce6451e1185180fc94db6a6568c12c50c712b22770a36eb53c48ee784828ab7e25f7c78e7516f3de43a55dc0ed9a98a24c8568da239d6971cd80de47ae31eb6e122978b09fd5a7f8eca3c9e686d76fe4e9bf0283a866924077c4140803b11d", 0xc8, 0x100, 0x401}, {&(0x7f0000000340)="b4c41b984999d0f22ae0a8652c4241723bafb2abfc0c6cefb4cac1c9b1c6ce734a220870622163ae660f6002c28843f998226a50ce5a7c25b51b5795954c9b4a7c74ac986a913d2e9c40a614f763e17b899da790e83c98e75b3fe9f0d72ffd6c6383f518cf60a676817dfc62cfd8670038834c08e3dcf04e86640519cedd6a6cc9920dfbfeff9645b72dcb2a548cfd7fe4002f9cdc33a1214ab90dc395c41ac61fc135e503f1f2e9afaa", 0xaa, 0xcf08, 0x2}, {&(0x7f0000000b80)="32d4889f45e46d6733b3c814ffa3ec8714c220123e79e89519a82c46485e8ca855b7a01d10408bf0d22463ea0a5b0b9fef1117c033426d8ca87a387bdc541ffecbdc2e9716bb6f318a04b3168cca67c5563258bc6aa13a7d78e1b08d01e06e48b7c0448aa0d999a594ec6dd68cceb9d2eac9a5c2b8d73b28f405a5e3d5f027d4747d42d0b76837e4e33acdc54b074946817301ac0cf672a2a4619b07", 0x9c, 0xfffffffffffffff9, 0x7}, {&(0x7f0000000c40)="8028ef083379d18393b5d3e4669cdd95af8f9c2eb285c1e224c2d76b8a423968ee045ad4f67eb8229cedc4359421b5a666c62169862fe46eca1e78ec506eaa", 0x3f, 0x1, 0x1}, {&(0x7f0000000c80)="cd609bb880c2613aa52cfe0c08fa20ef63e04e48074357f528334250ccabfe87effcf3bd7dc9155a80850ff98cc915fc10adc3c4f98443f708783c5b618f9b750ccf7d53e23bbe377644025cdb0733cb7c7c28f56fbe53bb2d60eb80c2d43b14caa6df3e66ed5782cc", 0x69, 0x3, 0x9}], 0x150000) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) madvise(&(0x7f0000a93000/0x4000)=nil, 0x4000, 0xe) mremap(&(0x7f0000a96000/0x1000)=nil, 0x1000, 0x800000, 0x3, &(0x7f0000130000/0x800000)=nil) r7 = gettid() process_vm_writev(r7, &(0x7f0000000000)=[{&(0x7f00008f9f09)=""/247, 0xf7}], 0x3cb, &(0x7f0000121000)=[{&(0x7f0000217f28)=""/231, 0xffffff4e}], 0x23a, 0x0) r8 = openat$full(0xffffffffffffff9c, &(0x7f0000000e00), 0x2000, 0x0) syz_kvm_setup_cpu$x86(r6, r8, &(0x7f0000292000/0x18000)=nil, &(0x7f0000000ec0)=[@text16={0x10, &(0x7f0000000e40)="66b80500000066b9003000000f01d926f30fa6d066b8010000000f01d9640fc73cf081954400008088b2ecc42e676664260f2002670f994bf20f22d4ba4200b80000ef", 0x43}], 0x1, 0x20, &(0x7f0000000f00)=[@flags={0x3, 0x1800}, @cr4={0x1, 0x220}], 0x2) r9 = creat(&(0x7f00000001c0)='./file0\x00', 0x0) write$uinput_user_dev(r9, &(0x7f0000000400)={'syz0\x00', {0x7, 0x6, 0x6, 0xfffa}, 0x1d, [0x200006, 0xc95a, 0xfffffff3, 0x9, 0x80, 0x2, 0x1, 0x7f, 0x6, 0x4d, 0xfffffff2, 0x5f, 0xa, 0x0, 0xffff2d37, 0x1dd2, 0x6, 0x7, 0x0, 0x80000001, 0x4, 0x7, 0x3, 0x3c57, 0x1, 0x24, 0xffffffff, 0x1, 0x1f461e2c, 0x2, 0xe661, 0x8, 0x7, 0x3, 0x7fff, 0x4c72, 0x8f00, 0x642, 0x3, 0xa, 0x0, 0x71, 0x7, 0x7, 0x103, 0x0, 0x5, 0xba1, 0x8f, 0x6, 0x6, 0x3, 0x5, 0x4, 0x8, 0x0, 0x80, 0x0, 0x5, 0x6, 0x8, 0x4, 0x5, 0x40], [0x10000007, 0xffff, 0x12f, 0x8000, 0x10, 0xfffffff3, 0x129432e6, 0xcb, 0xf9, 0xd, 0x2bf, 0x8, 0x9, 0xfffffffc, 0x3, 0x80000, 0x7, 0x0, 0x2f, 0xb, 0x312, 0x78, 0xea4, 0xa, 0x4, 0x7fffffff, 0xffffffd0, 0x9, 0x400, 0x1, 0x6, 0x1, 0xff, 0x1005, 0x7ff, 0x5f31, 0x4, 0x0, 0x6, 0x2, 0x9, 0x4, 0x9, 0x8, 0xb, 0x6, 0x5, 0x0, 0x1, 0x8000, 0xffff, 0x2, 0x77, 0x9, 0x5, 0x3, 0x4, 0x1, 0x7, 0x6, 0x9, 0x48c93690, 0x2, 0xff], [0x7, 0x4, 0x0, 0x64e, 0xfffffdfe, 0x7fffffff, 0x8d2, 0x49, 0x5, 0x7fff, 0x0, 0x5, 0xb, 0x4, 0x5, 0x5, 0x0, 0x16f, 0x5, 0x8, 0x86, 0x3, 0x0, 0x3e7, 0x2, 0x5, 0x2, 0x2, 0xf, 0x8, 0x4, 0x6d01, 0x5, 0x3b, 0x3, 0x200, 0x80, 0x3, 0x4, 0x2950bfaf, 0x0, 0xa2, 0x7, 0x53cf697b, 0x5, 0x6, 0x54fe12d2, 0xbf, 0x100b, 0x3, 0x400000, 0xfffffff9, 0x0, 0x1, 0x5, 0x0, 0x6, 0x0, 0x120000, 0x3, 0x6, 0x2, 0x4, 0x3], [0x9, 0xbb31, 0x3, 0xb, 0x5, 0x938, 0x6, 0x6, 0x0, 0x5, 0xce7, 0x1ff, 0x6, 0x7, 0x5, 0x3, 0x101, 0x10000, 0x6, 0x7fff, 0xffff, 0xa620, 0x2, 0x5, 0x1, 0x2, 0x14c, 0x60a7, 0x6, 0x6, 0xffffffff, 0x9, 0x5, 0x8, 0xc8, 0x3, 0x3, 0xffff, 0x3, 0x9, 0x100, 0x9605, 0xa, 0x2, 0x4, 0x6, 0x1, 0x10000, 0x5, 0x8, 0x2b91, 0xa1f, 0x8, 0x9, 0x1, 0x6c1b, 0x0, 0x4, 0x5, 0xb1c, 0x1, 0x200, 0xffff3441, 0xfff]}, 0x45c) r10 = openat$drirender128(0xffffffffffffff9c, &(0x7f0000000f40), 0x301001, 0x0) ioctl$DRM_IOCTL_GEM_OPEN(r9, 0xc010640b, &(0x7f0000000f80)={0x0, 0x0}) ioctl$DRM_IOCTL_GEM_FLINK(r10, 0xc008640a, &(0x7f0000000fc0)={r11}) bpf$BPF_LINK_CREATE_XDP(0x1c, &(0x7f00000012c0)={r2, 0x0, 0x30, 0xe1515f8735398fb, @val=@uprobe_multi={&(0x7f0000000140)='./file0\x00', &(0x7f0000000180)=[0x400], 0x0, 0x0, 0x1, 0x1}}, 0x40) program did not crash testing program (duration=30s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): socket$inet_mptcp-socket$nl_generic-socket$inet_udp-socket$nl_generic-syz_init_net_socket$ax25-socket$alg-socket$packet-syz_open_dev$vim2m-socket$vsock_stream-setsockopt$SO_VM_SOCKETS_CONNECT_TIMEOUT_OLD-bpf$BPF_PROG_RAW_TRACEPOINT_LOAD-socket$packet-socket$nl_route-socket$nl_route-socket-pipe-syz_open_procfs-add_key-read$FUSE-getsockname$packet-socket$inet6_icmp_raw-ioctl$ifreq_SIOCGIFINDEX_wireguard-ioctl$sock_SIOCGIFINDEX-socket$netlink-setsockopt$netlink_NETLINK_BROADCAST_ERROR-socket-syz_genetlink_get_family_id$tipc2-getsockopt$IP_VS_SO_GET_SERVICES-getsockname$packet-sendmsg$nl_route detailed listing: executing program 0: socket$inet_mptcp(0x2, 0x1, 0x106) socket$nl_generic(0x10, 0x3, 0x10) socket$inet_udp(0x2, 0x2, 0x0) socket$nl_generic(0x10, 0x3, 0x10) syz_init_net_socket$ax25(0x3, 0x5, 0x0) socket$alg(0x26, 0x5, 0x0) r0 = socket$packet(0x11, 0x3, 0x300) syz_open_dev$vim2m(&(0x7f0000000000), 0x0, 0x2) r1 = socket$vsock_stream(0x28, 0x1, 0x0) setsockopt$SO_VM_SOCKETS_CONNECT_TIMEOUT_OLD(r1, 0x28, 0x6, &(0x7f00000000c0)={0x0, 0xea60}, 0x10) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000200)={0x9, 0x4, &(0x7f0000000000)=ANY=[@ANYBLOB="18000000000000000000000000000000611948000000000095"], &(0x7f0000000080)='GPL\x00', 0x5, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0x0, @void, @value}, 0x94) socket$packet(0x11, 0x3, 0x300) socket$nl_route(0x10, 0x3, 0x0) socket$nl_route(0x10, 0x3, 0x0) socket(0x1, 0x803, 0x0) pipe(&(0x7f0000000100)) r2 = syz_open_procfs(0x0, &(0x7f00000021c0)='net/fib_triestat\x00') add_key(&(0x7f0000002100)='.dead\x00', 0x0, &(0x7f00000003c0)="4e09237282d50692dd8177cd88ec84d5b65831daeb3ab2428fe6e301f5364e9e808c904cfe56c7897e8da5bd029e86304fc396b7b7541a2b7135c4c5fe58c8bb82e9b45cd1d2853c1c22568f3f9f44b85f4e05a4589c4f71688840bad10e7e62f42fad010cee932737c512b7fbc476bafeb5cb4e9f8a01a8ca025fa4bd5ac67323c02adb999b1c37747866fe7465751a913e9a419c36b2120cc6efbf46e791760d06b3e029fd5bb96649610d2819fd10ababef8512852d12", 0xb8, 0xfffffffffffffffe) read$FUSE(r2, &(0x7f0000004480)={0x2020}, 0x2020) getsockname$packet(r0, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f00000002c0)=0x14) r3 = socket$inet6_icmp_raw(0xa, 0x3, 0x3a) ioctl$ifreq_SIOCGIFINDEX_wireguard(r3, 0x8933, &(0x7f0000000180)={'wg2\x00'}) ioctl$sock_SIOCGIFINDEX(r3, 0x8933, &(0x7f0000000240)={'dummy0\x00'}) r4 = socket$netlink(0x10, 0x3, 0x0) setsockopt$netlink_NETLINK_BROADCAST_ERROR(r4, 0x10e, 0x4, &(0x7f0000000f40)=0xe498, 0x4) r5 = socket(0x10, 0x803, 0x0) syz_genetlink_get_family_id$tipc2(&(0x7f0000000580), r5) getsockopt$IP_VS_SO_GET_SERVICES(r4, 0x0, 0x482, &(0x7f00000002c0)=""/140, &(0x7f0000000140)=0x8c) getsockname$packet(r5, &(0x7f0000000380)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) sendmsg$nl_route(r4, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000001140)={&(0x7f0000000040)=@newlink={0x20, 0x10, 0x503, 0x70bd2b, 0x29d24, {0x0, 0x0, 0x0, 0x0, 0x14415, 0x48041}}, 0x20}}, 0x4050) program did not crash testing program (duration=30s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_genetlink_get_family_id$ethtool-openat$nullb-openat$nullb-ioctl$BLKZEROOUT-sendmsg$ETHTOOL_MSG_STRSET_GET-openat$cgroup_ro-openat$cgroup_ro-fchdir-syz_genetlink_get_family_id$mptcp-sendmsg$MPTCP_PM_CMD_DEL_ADDR-write$binfmt_script-mmap-preadv-socket$nl_generic-socket$netlink-socket-sendmsg$nl_route_sched-getsockname$packet-sendmsg$nl_route-mkdirat-mount$tmpfs-socket$kcm-sendmsg$kcm-openat$cgroup_ro-io_setup-socket$inet6-io_submit-write$binfmt_script-socket$nl_rdma-sendmsg$RDMA_NLDEV_CMD_NEWLINK detailed listing: executing program 0: r0 = syz_genetlink_get_family_id$ethtool(&(0x7f00000003c0), 0xffffffffffffffff) openat$nullb(0xffffffffffffff9c, &(0x7f0000000440), 0x1c1482, 0x0) r1 = openat$nullb(0xffffffffffffff9c, &(0x7f0000000040), 0x1, 0x0) ioctl$BLKZEROOUT(r1, 0x127f, &(0x7f0000000240)={0x0, 0x1000000}) sendmsg$ETHTOOL_MSG_STRSET_GET(0xffffffffffffffff, &(0x7f0000000540)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000040)=ANY=[@ANYBLOB="18000000", @ANYRES16=r0, @ANYBLOB="09030000000000fdff072000adce04000280"], 0x18}, 0x1, 0xf000000}, 0x0) openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000400)='cgroup.controllers\x00', 0x275a, 0x0) r2 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000200)='memory.swap.current\x00', 0x275a, 0x0) fchdir(0xffffffffffffffff) r3 = syz_genetlink_get_family_id$mptcp(&(0x7f0000000700), r2) sendmsg$MPTCP_PM_CMD_DEL_ADDR(0xffffffffffffffff, &(0x7f00000007c0)={&(0x7f00000006c0)={0x10, 0x0, 0x0, 0x40000}, 0xc, &(0x7f0000000780)={&(0x7f0000000480)=ANY=[@ANYBLOB="0300"/11, @ANYRES16=r3, @ANYBLOB="000129bd7000fcdbdf2502000000080004000800000008000200030000000800030004000000"], 0x2c}, 0x1, 0x0, 0x0, 0x40000}, 0x40) write$binfmt_script(r2, &(0x7f0000000000), 0x208e24b) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x2, 0x28011, r2, 0x0) preadv(r2, &(0x7f00000015c0)=[{&(0x7f0000000080)=""/124, 0xffffffff000}], 0x5, 0x0, 0x0) socket$nl_generic(0x10, 0x3, 0x10) r4 = socket$netlink(0x10, 0x3, 0x0) socket(0x10, 0x803, 0x0) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000240)={0x0}}, 0x0) getsockname$packet(0xffffffffffffffff, &(0x7f00000002c0)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000300)=0xffffff4e) sendmsg$nl_route(r4, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000980)=ANY=[@ANYBLOB="3c0000001800100000000000000000000a00000000030000000000000c00090008000000", @ANYRES32=r5, @ANYBLOB="14000500fe80000000627b00000000000000000022def77d0b43139408806b55dc7831e10a7dc40125cb228f36b3dda7388ea2912000319ba1a4d8d644ef85366ee397efd254cd6e7fac766c89557368e19de583367076431733d101000000344f9675ec680873ac9cd94fba2c6c6d748e60d1617b02e6adc79a9833becc726f3f106297d91db1a0d7d1231b271bd09c22348ac8ce3265006f0800000000000000f040d52440c67ff5407811d7953c09d170ca829808fcee72018000006bc5fc1eeeb8de9c5b4d89524a48fdf3fec1d61480591debd18b13b1f108c607d4a14c5742f8568ed07a24382a7b6e4423269a5e09bacfd1c821cc6f83678c98574eb5fb2b6877ccc02f34c1521e5b6e8e8165e19d75be8f4ba1e2e39029d40c714b36c109e10f42a8f4b717ad9e4693f54f031d3b0a"], 0x3c}, 0x1, 0x0, 0x0, 0x8010}, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000002040)='./file0\x00', 0x0) mount$tmpfs(0x0, &(0x7f0000000080)='./file0\x00', &(0x7f0000000280), 0x0, &(0x7f00000000c0)=ANY=[@ANYBLOB="6d706f6c3d62696e641a302d4e3a332f4e00"]) r6 = socket$kcm(0x10, 0x2, 0x0) sendmsg$kcm(r6, &(0x7f0000000940)={0x0, 0x0, &(0x7f0000000180)=[{}], 0x1}, 0x0) r7 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000000c0)='cgroup.controllers\x00', 0x275a, 0x0) io_setup(0x7, &(0x7f0000000100)=0x0) socket$inet6(0xa, 0x1, 0x9) io_submit(r8, 0x1, &(0x7f0000000380)=[&(0x7f0000000340)={0x0, 0x0, 0x0, 0x7, 0x2, r4, &(0x7f00000001c0)="4066462d53860daab083a0de4f4c44ad7a3f1ea42c80e16e98f51316944121c5a1e0c4e8c616", 0x26, 0xf, 0x0, 0x2}]) write$binfmt_script(r7, &(0x7f0000000500)={'#! ', '', [{0x20, 'memory.swap.current\x00'}]}, 0x19) socket$nl_rdma(0x10, 0x3, 0x14) sendmsg$RDMA_NLDEV_CMD_NEWLINK(r4, &(0x7f00000000c0)={0x0, 0x4c, &(0x7f0000000080)={&(0x7f00000004c0)={0x38, 0x1403, 0x1, 0x70bd2a, 0x25dfdbfb, "", [{{0x9, 0x2, 'syz1\x00'}, {0x8, 0x41, 'siw\x00'}, {0x14, 0x33, 'netdevsim0\x00'}}]}, 0x38}, 0x1, 0x0, 0x0, 0x8800}, 0x20000044) program did not crash testing program (duration=30s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): io_uring_setup-openat$snapshot-openat$uinput-openat$kvm-syz_open_procfs-lseek-openat$cdrom-capset-fanotify_init-ioctl$CDROM_SEND_PACKET-socket-syz_genetlink_get_family_id$mptcp-getsockname$packet-syz_usb_connect$hid-close_range detailed listing: executing program 0: r0 = io_uring_setup(0x1065, &(0x7f0000001240)={0x0, 0x10, 0x800, 0x1}) r1 = openat$snapshot(0xffffffffffffff9c, &(0x7f0000000000), 0x481, 0x0) (async) openat$uinput(0xffffffffffffff9c, &(0x7f0000000000), 0x2, 0x0) (async) openat$kvm(0xffffffffffffff9c, &(0x7f0000000140), 0x0, 0x0) (async) r2 = syz_open_procfs(0x0, &(0x7f0000000600)='fd/4\x00') lseek(r2, 0x600, 0x4) (async) r3 = openat$cdrom(0xffffffffffffff9c, &(0x7f00000011c0), 0x2000, 0x0) capset(&(0x7f0000000080)={0x19980330}, &(0x7f0000000040)={0x200000, 0x200002}) (async) fanotify_init(0x20, 0x400) (async) ioctl$CDROM_SEND_PACKET(r3, 0x5393, &(0x7f0000001300)={"cdb755b1e57be73fc299a365", 0x0, 0x0, 0x5, 0x0, 0x0, 0x1, 0x1, 0x0}) r4 = socket(0x10, 0x803, 0x2) r5 = syz_genetlink_get_family_id$mptcp(&(0x7f00000000c0), r4) (async) getsockname$packet(r4, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f00000003c0)=0x14) syz_usb_connect$hid(0x0, 0x36, &(0x7f0000000140)=ANY=[@ANYBLOB="02bf91121a7d55fbb5c4ad52e805867ec7d1b3db3bd511fe6ef830b610bd2e696ee57d43797629e81fc6cd77ee526d1956c46658c3159fef57", @ANYRESDEC=r0, @ANYRESHEX=r1, @ANYRESDEC=r4, @ANYRESHEX=r5, @ANYRES16=r5, @ANYRESOCT=r6, @ANYRESHEX=r1], 0x0) close_range(r0, 0xffffffffffffffff, 0x0) program did not crash single: failed to extract reproducer bisect: bisecting 24 programs with base timeout 30s testing program (duration=36s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): [18, 30, 12, 30, 20, 29, 21, 30, 6, 5, 16, 6, 30, 8, 24, 14, 30, 24, 15, 4, 11, 30, 30, 30] detailed listing: executing program 3: r0 = openat$binderfs(0xffffffffffffff9c, &(0x7f00000000c0)='./binderfs/binder0\x00', 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR_EXT(r0, 0x4018620d, &(0x7f0000000300)) r1 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000180)='./binderfs/binder0\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000080)={0x8, 0x0, &(0x7f0000000400)=[@increfs], 0x0, 0x0, 0x0}) r2 = dup3(r1, r0, 0x0) r3 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000040)='./binderfs/binder0\x00', 0x0, 0x0) r4 = openat$tun(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) ioctl$TUNSETIFF(r4, 0x400454ca, &(0x7f0000000200)={'rose0\x00', 0x112}) pread64(r4, 0x0, 0x0, 0x0) mmap$binder(&(0x7f0000ffc000/0x2000)=nil, 0x2000, 0x1, 0x11, r3, 0x0) ioctl$BINDER_SET_CONTEXT_MGR_EXT(r3, 0x4018620d, &(0x7f0000000040)) bpf$OBJ_PIN_PROG(0x6, &(0x7f0000000380)=@generic={&(0x7f0000000340)='./file0\x00', r2}, 0x18) write$tun(r2, &(0x7f0000000140)={@val={0x0, 0x88f7}, @void, @arp=@ether_ipv6={0x1, 0x86dd, 0x6, 0x10, 0x9, @empty, @rand_addr=' \x01\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x02', @empty, @loopback}}, 0x38) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000100)={0x14, 0x0, &(0x7f00000002c0)=[@enter_looper, @request_death={0x400c630e, 0x880003}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000500)={0x4c, 0x0, &(0x7f0000000580)=[@transaction_sg={0x40486311, {0x1, 0x0, 0x0, 0x0, 0x21, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000280)={0x4c, 0x0, &(0x7f0000000680)=[@transaction_sg={0x40486311, {0x1, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) r5 = openat$binder_debug(0xffffffffffffff9c, &(0x7f00000001c0)='/sys/kernel/debug/binder/transactions\x00', 0x0, 0x0) preadv(r5, &(0x7f0000000180)=[{&(0x7f0000000240)=""/52, 0x34}], 0x1, 0x0, 0x0) executing program 3: r0 = socket$nl_route(0x10, 0x3, 0x0) socket$nl_generic(0x10, 0x3, 0x10) (async) r1 = socket$inet6_udp(0xa, 0x2, 0x0) (async) r2 = socket$rds(0x15, 0x5, 0x0) bind$rds(r2, &(0x7f0000000040)={0x2, 0x4e21, @local}, 0x10) (async) r3 = syz_open_dev$vim2m(&(0x7f00000000c0), 0x6, 0x2) ioctl$vim2m_VIDIOC_S_FMT(r3, 0xc0d05605, &(0x7f0000000140)={0x1, @vbi={0x0, 0x0, 0x30314752}}) sendmsg$rds(r2, &(0x7f0000000080)={&(0x7f0000000180)={0x2, 0x0, @initdev={0xac, 0x1e, 0x0, 0x0}}, 0x10, 0x0}, 0x0) (async) sendmsg$rds(r2, &(0x7f0000000000)={&(0x7f0000000400)={0x2, 0xfffd, @multicast2}, 0x10, 0x0, 0x0, 0x0, 0x0, 0x20000000}, 0x0) (async) r4 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000001c0)='cgroup.controllers\x00', 0x275a, 0x0) writev(r4, &(0x7f0000000740)=[{&(0x7f0000000640)="5387", 0x2}, {&(0x7f0000001840)='u', 0x1}, {&(0x7f0000000380)="d3", 0x1}, {&(0x7f0000000300)="a9", 0x1}], 0x4) write$binfmt_script(r4, &(0x7f0000000040), 0x18a3c85) (async) r5 = socket$alg(0x26, 0x5, 0x0) bind$alg(r5, &(0x7f00000000c0)={0x26, 'hash\x00', 0x0, 0x0, 'crc32-pclmul\x00'}, 0x58) r6 = accept$alg(r5, 0x0, 0x0) accept$packet(0xffffffffffffffff, &(0x7f00000000c0)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @multicast}, &(0x7f0000000100)=0x14) openat2$dir(0xffffffffffffff9c, &(0x7f0000000000)='./cgroup\x00', &(0x7f00000000c0)={0x0, 0x0, 0x3}, 0x65) (async) sendfile(r6, r4, 0x0, 0x2) (async) setsockopt$RDS_CANCEL_SENT_TO(r2, 0x114, 0x1, &(0x7f0000000100)={0x2, 0x0, @initdev={0xac, 0x1e, 0x0, 0x0}}, 0x10) unshare(0x68040200) (async) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x3, 0x8031, 0xffffffffffffffff, 0x0) (async) write(0xffffffffffffffff, 0x0, 0x0) ioctl$SNDRV_TIMER_IOCTL_SELECT(0xffffffffffffffff, 0x40345410, &(0x7f00000002c0)={{0x0, 0x2, 0x3, 0x0, 0x10001}}) (async) r7 = socket$nl_route(0x10, 0x3, 0x0) (async) r8 = userfaultfd(0x801) mmap$IORING_OFF_SQ_RING(&(0x7f0000400000/0xc00000)=nil, 0xc00000, 0x3000002, 0x5d031, 0xffffffffffffffff, 0x0) ioctl$UFFDIO_UNREGISTER(r8, 0x8010aa01, &(0x7f0000000080)={&(0x7f00002c7000/0x400000)=nil, 0x400000}) (async) sendmsg$nl_route(r7, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000000)={&(0x7f00000004c0)=@newlink={0x48, 0x10, 0x581, 0x0, 0x0, {}, [@IFLA_LINKINFO={0x28, 0x12, 0x0, 0x1, @geneve={{0xb}, {0x18, 0x2, 0x0, 0x1, [@IFLA_GENEVE_REMOTE6={0x14, 0x7, @loopback={0xfec0ffff00000000}}]}}}]}, 0x48}}, 0x0) ioctl$sock_SIOCGIFINDEX(r1, 0x8933, &(0x7f0000000c80)={'lo\x00', 0x0}) sendmsg$nl_route_sched(r0, &(0x7f0000001200)={0x0, 0x48000009, &(0x7f0000000000)={&(0x7f00000002c0)=@newqdisc={0x78, 0x24, 0x4ee4e6a52ff56541, 0x0, 0x0, {0x0, 0x0, 0x0, r9, {}, {0xffff, 0xffff}}, [@qdisc_kind_options=@q_fq={{0x7}, {0x4c, 0x2, [@TCA_FQ_INITIAL_QUANTUM={0x8, 0xe}, @TCA_FQ_TIMER_SLACK={0x8}, @TCA_FQ_TIMER_SLACK={0x8}, @TCA_FQ_FLOW_DEFAULT_RATE={0x8}, @TCA_FQ_FLOW_PLIMIT={0x8, 0x8}, @TCA_FQ_TIMER_SLACK={0x8}, @TCA_FQ_LOW_RATE_THRESHOLD={0x8}, @TCA_FQ_FLOW_DEFAULT_RATE={0x8}, @TCA_FQ_QUANTUM={0x5, 0xf}]}}]}, 0x78}}, 0x0) executing program 3: r0 = socket$nl_route(0x10, 0x3, 0x0) socket$inet_tcp(0x2, 0x1, 0x0) (async) r1 = socket$inet_tcp(0x2, 0x1, 0x0) ioctl$sock_SIOCGIFINDEX(r1, 0x8933, &(0x7f0000000000)={'bridge_slave_1\x00', 0x0}) setsockopt$MRT_ADD_VIF(0xffffffffffffffff, 0x0, 0xca, &(0x7f00000000c0)={0x1, 0x8, 0x1, 0xfffffffa, @vifc_lcl_ifindex=r2, @local}, 0x10) (async) setsockopt$MRT_ADD_VIF(0xffffffffffffffff, 0x0, 0xca, &(0x7f00000000c0)={0x1, 0x8, 0x1, 0xfffffffa, @vifc_lcl_ifindex=r2, @local}, 0x10) r3 = socket$inet_udp(0x2, 0x2, 0x0) r4 = socket$inet6(0xa, 0x3, 0xff) sendto$l2tp6(r4, 0x0, 0x0, 0x0, &(0x7f00000000c0)={0xa, 0x0, 0x0, @local}, 0x20) ioctl$sock_inet_SIOCSIFFLAGS(r3, 0x8914, &(0x7f0000000000)={'lo\x00'}) (async) ioctl$sock_inet_SIOCSIFFLAGS(r3, 0x8914, &(0x7f0000000000)={'lo\x00'}) sendmsg$nl_route(r0, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000100)=ANY=[@ANYRES64=r2, @ANYRES16=r1, @ANYRES32=r2, @ANYRESHEX=r1, @ANYRES64=r2, @ANYRES32=r1, @ANYRES32=r2, @ANYRES16=r2, @ANYBLOB="f2c3dfc4c259cca34a00a575668241f088257a90f159a7580c38b141574cb9ce2eb57767c2bd6d79b453aacb28c147e4b9464535d77db14037afdbf59ab82c209fad6f85d06139ad9b8a46a249400f0294d1abb5939a036afc1e15a5c089194edaeb0315fc05fa5146afa2517c910a8cd110dba872043c10037a088726989ca035268aaac6dd4147d8465d05593fc8f24648c8dbd79192dad9befc4bf2ccaf97e26d5419a206c8377fb4c3ba44b977647b6abda5c3fcb94bd8cc69a72ca3ebf17c7e363d20b099bc510a80e4b089ee7d004c6ba41b7fbe3d8e3747fced6a48baa27ccd77"], 0x20}}, 0x0) executing program 3: socket$netlink(0x10, 0x3, 0x0) r0 = openat$binderfs(0xffffffffffffff9c, &(0x7f00000000c0)='./binderfs/binder0\x00', 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR_EXT(r0, 0x4018620d, &(0x7f0000000100)) r1 = openat$binderfs(0xffffffffffffff9c, 0x0, 0x800, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000380), 0x0, 0x0, 0x0}) dup3(r1, r0, 0x0) mmap$binder(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x1, 0x11, 0xffffffffffffffff, 0x0) read$FUSE(0xffffffffffffffff, 0x0, 0x0) r2 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000180)={0x18, 0x5, &(0x7f0000000280)=ANY=[@ANYBLOB="1801000000000000000000004b64ffec850000006d000000670000000500000095"], &(0x7f0000000100)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x2, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0x0, @void, @value}, 0x80) r3 = bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000140)={&(0x7f0000000180)='tlb_flush\x00', r2}, 0x10) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) r4 = getpid() process_vm_readv(r4, &(0x7f0000008400)=[{&(0x7f0000000300)=""/54, 0x7ffff000}, {&(0x7f0000006180)=""/152, 0x98}], 0x2, &(0x7f0000008640)=[{&(0x7f0000008480)=""/95, 0x7ffff000}], 0x286, 0x0) close_range(r2, r3, 0x2) mkdirat(0xffffffffffffff9c, &(0x7f00000000c0)='./file0\x00', 0x0) pipe2$9p(&(0x7f0000000240)={0xffffffffffffffff, 0xffffffffffffffff}, 0x0) write$P9_RVERSION(r6, &(0x7f00000003c0)=ANY=[@ANYBLOB="150000006851f49b7fbbb110ff14b357467b65"], 0x15) mount$9p_fd(0x0, &(0x7f0000000100)='./file0\x00', &(0x7f00000001c0), 0x0, 0x0) pipe2$watch_queue(&(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}, 0x80) r9 = add_key$keyring(&(0x7f0000000140), &(0x7f0000000180)={'syz', 0x0}, 0x0, 0x0, 0xfffffffffffffffd) keyctl$KEYCTL_WATCH_KEY(0x20, r9, r8, 0x0) r10 = add_key$fscrypt_v1(&(0x7f0000000280), &(0x7f0000000100)={'fscrypt:', @desc1}, &(0x7f0000000300)={0x0, "87e41f3f2518cf22b058fe40b3bfb0888226e54e123436d75a884ae89b4b8ea5dc074df2550d8bfaf75fd05332be6fb3df1d0756f1193298e53b21d91ba047f0"}, 0x48, r9) keyctl$KEYCTL_WATCH_KEY(0x20, r10, r7, 0x0) close_range(r7, 0xffffffffffffffff, 0x0) write$FUSE_BMAP(0xffffffffffffffff, &(0x7f0000000080)={0x18}, 0x18) write$FUSE_NOTIFY_RETRIEVE(0xffffffffffffffff, &(0x7f00000000c0)={0x14c}, 0x137) mount$9p_fd(0x0, &(0x7f0000000040)='./file0\x00', &(0x7f0000000b80), 0x0, &(0x7f0000000400)=ANY=[@ANYBLOB='trans=fd,rfdno=', @ANYRESHEX=r5, @ANYBLOB=',wfdno=', @ANYRESHEX, @ANYBLOB="2c6c6f6f73652c63616368653d6e6f6e652c6163636573733d616e792c008711f7367f19ea3b149678cabc0a37643c721f65291f044c544d47a0ca72d83d8ae025fe168af70675743843d9d8b6669ab9bb551a07fcff121076bbab99f92363bd6f25d97c71c48a64e682cb74f057e2b723e428c5b93615fd2e990db0bda42119ca8e4a"]) chdir(&(0x7f0000000540)='./file0\x00') sched_setscheduler(0x0, 0x0, 0x0) syz_usb_connect(0x1, 0x3f, &(0x7f0000000000)=ANY=[], 0x0) executing program 1: r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000100), 0x0, 0x0) ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) (async) mmap(&(0x7f0000000000/0xff5000)=nil, 0xff5000, 0x3, 0x200000005c832, 0xffffffffffffffff, 0x0) (async) mremap(&(0x7f0000000000/0x9000)=nil, 0xa00000, 0x600000, 0x3, &(0x7f0000a00000/0x600000)=nil) (async) r1 = openat$sndtimer(0xffffffffffffff9c, &(0x7f0000000140), 0x0) (async) r2 = syz_open_dev$vim2m(&(0x7f0000000000), 0x0, 0x2) ioctl$vim2m_VIDIOC_REQBUFS(r2, 0xc0145608, &(0x7f00000000c0)={0x1, 0x2, 0x1}) (async) ioctl$vim2m_VIDIOC_EXPBUF(r2, 0xc0405610, &(0x7f0000000280)={0x2, 0x0, 0x0, 0x0, 0xffffffffffffffff}) r4 = fcntl$dupfd(r3, 0x0, r1) mmap(&(0x7f0000000000/0x2000)=nil, 0x152000, 0x0, 0x12, r4, 0x0) (async) r5 = io_uring_setup(0x253b, &(0x7f0000000180)={0x0, 0x80000001}) (async) setfsuid(0xee01) (async) setresuid(0xffffffffffffffff, 0x0, 0x0) (async) r6 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000040), 0x0, 0x0) r7 = ioctl$KVM_CREATE_VM(r6, 0xae01, 0x0) ioctl$KVM_CAP_SPLIT_IRQCHIP(r7, 0x4068aea3, &(0x7f0000000080)) (async) r8 = ioctl$KVM_CREATE_VCPU(r7, 0xae41, 0x200) ioctl$KVM_GET_NESTED_STATE(r8, 0xae80, 0x0) (async) close_range(r5, 0xffffffffffffffff, 0x0) (async) sendmsg$IPSET_CMD_CREATE(r4, &(0x7f00000002c0)={&(0x7f0000000100)={0x10, 0x0, 0x0, 0x80000000}, 0xc, &(0x7f0000000240)={&(0x7f0000000200)={0x20, 0x2, 0x6, 0x301, 0x0, 0x0, {0x0, 0x0, 0x5}, [@IPSET_ATTR_TYPENAME={0xc, 0x3, 'hash:ip\x00'}]}, 0x20}, 0x1, 0x0, 0x0, 0x4000001}, 0x10) executing program 1: r0 = socket$nl_generic(0x10, 0x3, 0x10) (async) sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x2) r1 = syz_open_dev$MSR(&(0x7f00000001c0), 0x0, 0x0) read$msr(r1, &(0x7f0000019680)=""/102392, 0x18ff8) (async) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) (async) socket$nl_route(0x10, 0x3, 0x0) (async) r2 = io_uring_setup(0x177f, 0x0) r3 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$inet6_tcp_TCP_MD5SIG(r3, 0x6, 0xe, &(0x7f0000000580)={@in6={{0xa, 0x0, 0x0, @rand_addr=' \x01\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x01'}}, 0x0, 0x0, 0x42, 0x0, "bd1c790806ed6dcd18899f9ea77ca9fb5184ff0ba54b7dfe784d2f6b7dcd9474d9b295588ac0b991d5c66461eca3f1ff5543acc6c970d0ad22d692e84d692972368e64c272da633a217b45fcc8b1ff3b"}, 0xd8) (async) setsockopt$inet6_tcp_int(r3, 0x6, 0x13, &(0x7f0000000180)=0x100000001, 0x4) (async) setsockopt$inet6_tcp_TCP_REPAIR_QUEUE(r3, 0x6, 0x14, &(0x7f0000000340)=0x2, 0xa2) (async) mkdir(&(0x7f0000000440)='./file1\x00', 0x0) (async) mount(0x0, &(0x7f0000000240)='./file1\x00', &(0x7f0000000000)='tmpfs\x00', 0x0, &(0x7f0000000300)='usrquota') chdir(&(0x7f0000000140)='./file1\x00') (async) r4 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000040)='net_prio.prioidx\x00', 0x275a, 0x0) quotactl_fd$Q_SETQUOTA(r4, 0xffffffff80000800, 0x0, &(0x7f00000000c0)={0x0, 0x5, 0x10000000000002, 0x0, 0x0, 0x0, 0x0, 0x0, 0xe3}) (async) connect$inet6(r3, &(0x7f0000000080)={0xa, 0x0, 0x0, @empty}, 0x1c) (async) setsockopt$inet6_tcp_TCP_ULP(r3, 0x6, 0x1f, &(0x7f0000000540), 0x3c) (async, rerun: 32) r5 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000040)='cpuacct.usage_sys\x00', 0x275a, 0x0) (rerun: 32) write$binfmt_script(r5, &(0x7f000000e0c0), 0x10010) setsockopt$inet6_tcp_TLS_TX(r3, 0x11a, 0x1, &(0x7f0000000200)=@gcm_256={{0x304}, "00e0f07600", "832b4d2434b35bca8c0b78d2afff6d70d2025c7f53123828322d5af0d5c6c3a5", '`\a-N', "298f0e6df9ae9b3d"}, 0x38) (async, rerun: 64) close_range(r2, 0xffffffffffffffff, 0x0) (rerun: 64) connect$inet6(0xffffffffffffffff, &(0x7f0000000040)={0xa, 0x0, 0x0, @mcast1, 0x5}, 0x1c) bpf$MAP_CREATE(0x0, &(0x7f00000003c0)=@base={0x20, 0x80, 0x9, 0x1bbc, 0x10, 0xffffffffffffffff, 0xfffffff8, '\x00', 0x0, r5, 0x2, 0x2, 0x0, 0x0, @void, @value, @void, @value}, 0x48) (async) mmap(&(0x7f0000000000/0xff5000)=nil, 0xff5000, 0x2, 0x5c831, 0xffffffffffffffff, 0x0) (async, rerun: 32) socket$can_bcm(0x1d, 0x2, 0x2) (async, rerun: 32) sendmsg$can_bcm(0xffffffffffffffff, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000240)={&(0x7f0000000180)=ANY=[@ANYBLOB="0500"/14, @ANYRES64=0x0, @ANYRES64=0x0, @ANYRES64=0x0, @ANYRES64=0x0, @ANYBLOB="00000000010000000000000000000000b0a2a7cfced89e25"], 0x48}}, 0x0) r6 = syz_genetlink_get_family_id$ethtool(&(0x7f0000000040), 0xffffffffffffffff) sendmsg$ETHTOOL_MSG_COALESCE_SET(r0, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000280)={&(0x7f0000000000)={0x34, r6, 0x1, 0x0, 0x0, {0x10}, [@ETHTOOL_A_COALESCE_HEADER={0x18, 0x1, 0x0, 0x1, [@ETHTOOL_A_HEADER_DEV_NAME={0x14, 0x2, 'veth0\x00'}]}, @ETHTOOL_A_COALESCE_STATS_BLOCK_USECS={0x8, 0xa, 0xfffffffd}]}, 0x34}}, 0x0) executing program 1: r0 = syz_open_dev$ttys(0xc, 0x2, 0x1) (async) r1 = syz_open_dev$tty1(0xc, 0x4, 0x1) r2 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000280)='hugetlb.2MB.usage_in_bytes\x00', 0x275a, 0x0) r3 = socket(0x10, 0x2, 0x0) getsockopt$sock_cred(r3, 0x1, 0x11, &(0x7f0000caaffb)={0x0, 0x0}, &(0x7f0000cab000)=0xc) setfsuid(r4) utimensat(r2, 0x0, 0x0, 0x0) r5 = fcntl$dupfd(r0, 0x406, r1) ioctl$AUTOFS_DEV_IOCTL_SETPIPEFD(r5, 0xc0189378, &(0x7f0000000080)={{0x1, 0x1, 0x18, r5, {r5}}, './file0\x00'}) ioctl$TIOCSIG(r6, 0x40045436, 0x33) ioctl$TIOCSETD(r5, 0x5423, &(0x7f00000000c0)=0xf) (async, rerun: 64) ioctl$KDSIGACCEPT(r0, 0x400455cb, 0x0) (rerun: 64) bpf$OBJ_GET_PROG(0x7, &(0x7f0000000040)=@generic={&(0x7f0000000000)='./file0\x00', 0x0, 0x8}, 0x18) r7 = openat$nci(0xffffffffffffff9c, &(0x7f0000000080), 0x2, 0x0) ioctl$IOCTL_GET_NCIDEV_IDX(r7, 0x0, &(0x7f00000000c0)=0x0) (async) r9 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r10 = syz_genetlink_get_family_id$nfc(&(0x7f0000000100), r9) sendmsg$NFC_CMD_DEV_UP(r9, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000180)={&(0x7f00000001c0)={0x1c, r10, 0x1, 0x0, 0x0, {}, [@NFC_ATTR_DEVICE_INDEX={0x8, 0x1, r8}]}, 0x1c}}, 0x0) (async) write$nci(r7, &(0x7f0000000200)=@NCI_GID_PROPRIETARY_NFT={0xf, 0x1, 0x3, 0x0, 0x40, "fbac657e23c41206c904951a0ecb5cf08a0d5193d6002f42b092fae87ab21e35aaed4d200c0b"}, 0x29) (async) r11 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPCTNL_MSG_TIMEOUT_GET(r11, &(0x7f0000000340)={0x0, 0x0, &(0x7f00000002c0)={&(0x7f0000000380)=ANY=[@ANYBLOB="140000000108010200344460eea333ebd6000000000a000008dba248d0df7f9dd9d85532580600000000000000d93ea40eca05a0c576551c27507b9abdca6dedf3fb3721060000003020ccbd3bfb4a014c53267fc2419a9c7d022e8cfa1213a7247adf8b7132a8fc97a7b293adf33455748ee3b0661caf29f982208ab92e0da7b5796120bbeb1a4e0fe636546ff5de142cc353f558a37d27cf33d642ff96ad68c11d86916f5e8f052f822cf4f3b4a2993ee01f473fff17c3ab30c77865887afeb84085790702df1e"], 0xec565d2b9b8f150f}}, 0x848) executing program 2: sendmsg$WG_CMD_SET_DEVICE(0xffffffffffffffff, &(0x7f0000001680)={0x0, 0x0, &(0x7f0000001640)={&(0x7f0000000040)=ANY=[@ANYBLOB="840e0000", @ANYBLOB="000000000000000000000100000024000300a05ca84f6c9c8e3853e2fd7a70ae0fb2"], 0xe84}}, 0x0) r0 = socket$pppl2tp(0x18, 0x1, 0x1) r1 = socket$inet_udp(0x2, 0x2, 0x0) connect$pppl2tp(r0, &(0x7f0000000040)=@pppol2tpv3in6={0x18, 0x1, {0x0, r1, 0x3, 0x0, 0x0, 0x0, {0xa, 0x0, 0x0, @local}}}, 0x3a) getpeername(r0, 0x0, &(0x7f0000000100)) mkdirat(0xffffffffffffff9c, &(0x7f0000002040)='./file0\x00', 0x0) r2 = openat$fuse(0xffffffffffffff9c, &(0x7f0000000180), 0x42, 0x0) mount$fuse(0x0, &(0x7f0000000200)='./file0\x00', &(0x7f0000002100), 0x230c70, &(0x7f0000002140)=ANY=[@ANYBLOB='fd=', @ANYRESHEX=r1, @ANYBLOB="2c726f02006d6f64653d30303030303048303030303030303030303034303030302c757365725f69643d", @ANYRESDEC=0x0, @ANYBLOB=',group_id=', @ANYRESHEX=r2]) read$FUSE(r2, &(0x7f00000021c0)={0x2020, 0x0, 0x0}, 0x2020) write$FUSE_INIT(r2, &(0x7f00000000c0)={0x50, 0x0, r3, {0x7, 0x27}}, 0x50) syz_fuse_handle_req(r2, &(0x7f0000004200)="cf1fc973183963b07b5823193225a2c64adb9f2ac029e9ef8e195975158509d41050c90b0dbfc596a0927e523462687dbbc7c04eef673b56986d2044f894882a08dfca225431d7f72482a378fab35906d53f07a17fb5342bea9784d33cbd06d7f80a51922b7facb2a10d90391709545d4f764ed797e699720ef64bf771b9d09e4fc6915e9d5d1001235806a3bb2f8dcf3aea7190f59cc082be48c650cf5260f99b206175ead1790f3330a15c01c203a4ec2b18d209c15d341bb977023d005d274e564ffb71b20af3c0aca85900b939fb65268da4d73629ea13a99a14ef00fe3f01ff312b6e4727b33c5be9f4632427ba315868c2621523163156da893a9ebd923add7f8d11f04844bc9061651bfc6632421bd89b407e35ac780053b08566385d29c11f9ac0b036de7da92ec611ebbafd674c532cc2c111fca868356c1611b830a8b4eff0e097f878ce1434af44b373f70d7cd67aac2291ce809e9d24b75bc912c3b250cb7e6cf7e00fe96f6e3c1188fdd7923689bcd7b99c0e9453ba7bf054171dc82ed9306e45c2dc9e633519133528fc9d6565b0564a5e95459715a9684e14e3c5e20beda9e203c24845f916c486d809a76b677ca1bdd42035ddef2a8a5ca8cc728af57173f8cd63299cd4c9f5501a5540e6dfb29343f57a78f3d3d2c6909c6760093d486280be7400fd416b99165e71cf46927e4c358d70011f8f60f7d92d10ecc33063214c8a889ddadca5c7e090eed0fdf358bf708f57da6b4fd048cd6468188aa5fafde2cb7962be86bfde01386289695ad338e6e815f9d70266f6dc020ed039d0bbda355a9cf304ab531b6bbea1cb6f08e63d41571888cc9c629bca4216d6f0eeb410d30d26a4b7cf4a5a2214ee62dc11f4675b86fa685e85f346e6994ea09e4349826d5a2e8de6871ce46d0fdfdd171d406cc5de2ffce25bcaa23d3d07c7bfba97874e6fe038bd91c8026f2454ea6662c121d4cc9a461c81b61c9c7fe35b3a97e629545ee2b06ff4f97ee8ab1f1a4a21dc0be507c3af200d8e9994a0e1e69f843dc294674d801bae035f96ca87d8f0feda09e53e073a50cc94cb92b17ed3443064f75b69bd125e2152649bc55928beccf1c1556844ffa017dd03ef2ee73ecb6ea563b2303bff346b090944338af5bd62dc23e8f6741477ad86bd1d033894b5d7a1fbec2243feee3a278eb00e5a77929be6def166b1777d3e4910aea59c205880f82e82fee779eee799c8ce0c5eee72316ce9bc4c0d7a543d3683b74cd50dfc9dc12b46d82f282f6f71ad444de5a1cd60055a7f16c363f9fc99d51416c4cecef7b538e493f264ac270f3e9a4bbadd416cdd2856cf0d7e5d75ed921432d6a5b5e4ceb901e4b60ab558933f1a731119e4f66f9fc563f2356aeae54e9605734df37a9022cdc1a526e53a20c3c1903e464c50db872129ace496c5175274799069e4dda8bc0da7874c3467911aa49b59ea3ac1d221cb7b9f9b0188abae0d6838e41d3040ea8fb991e0d4690c2e1e446fcd1d7d01e9582da92ed3063199a6ac93933305c45ce25df67255e2469c1b8fd37e263323d7885d24638e4e3100bbc0fb1da7f6bc336979048b5422062aa19d769913b14069bed9d952c9be30672d3625e9946c2e4fb436afcb01131b37bc1ad63e67d0d6a8135bd2062a95664daf521e1e71883a3ab51b09c70f4c180493b6e134d7b435f690fc1cbe000ec3d981b021abccf57db0357d73c54ea8cf0fa60294b3b6a94c293ffb4c158fa89e79d96813b05c2e78ddfaf3f0d8bd87cf525d76e28b6b34e75600fdbe8782b0dd5e01c957fe00e3d829f601626a765fc78676c863f6cba6fe7c88a7eea3cdeb832d9a87f6938120eb267fad2c0e90fb0793592c828205fa3b25f15369b2ee6202a0cfff2b0f525a409650a6aec5ddd766c8642d8584920d0faa9be997463ee9aed84e9a6218af8b2a7f41466f8284e1b3cdc515e9baea98b8129bae79a4a33126f55888db4208b914f39af9d80dbdd2c8759ab72ce24b70901745294a277987d1393bf4ae8b1609cbc3ca565ac1415223175c09c9b0b957672ba067928606595cc6aa2fd63ab5d0e3b7f577760aa699d791e6df9f94dc38de3afd42f8c702842b875b7c0f915078d592026f237c850156e3c7be09e1106189f7f3bd57e9d5565de4682245b082216dcbeaf3616aaf91ee77aabca6986bde0b2ef9047fbfe063f1dcb84c6d19db9a6000613fb2a3fc612b9ea0aca1db89f0c0b08972e396f975499e98cd7976fc961c08e7967a4fed0f26c4310d45775f2de261bffd8b448af529da41f49669623ac91c512335ccaed0045374a7849dd981acf6fbe0e2710b308fc035fdf906ea2a8248cc2d8f4d0eb05f443ac856f9bf09a26d214428ac13ef6c6e212d4b5fe810cd72743c9ba00abf23edc90e73d5bf39e05421efb9e90f7352dfd8572770a7768bd1a4a5f3e6a90d83fe6320c9eaecf539a190cec93fc8d70004c70bc833000b889370ad0ef9db1ebce7a131bb77612721e8eed5764e11eb4e0535e5dd7b694b9b3f13fc856735ed5bf09a4a561c65b717fdc806b26179726a6f27cc67728ee88f41ab6dc9ce67af7298de4dff24c227c49ffbad54424c9adb0406b45cfd0a01cdbba47a4ba11ec9c8a7147b58e5abe3ec1d05a51efcffca6e278d880c465a3757d863226701a3527b9fa3a5ea621060b752c43fc603b732fd9edb6b3a06bdc5a82ca327ef726d12c3e9ecb87fff002550739b35e07daf11502f4465d7a853009ff214cf09068379b7d09ba6b1dd6cf7ba695c0c83da8ab89871872b272260e9b9219b91713ecac34017f5c1111109608926801d4a9718d002dc863f62d1a301e9d49b69db8712904c9bbcf4ed13a49122cebcbad48780ac57f7dc50bdd1802deaec3f4896b7a03502ab0fff9697d3d1763ca7a5838cc092b4052071850bec486e0d753f1059fb5004514fc76043ab6d228c84a335cc529337ce15eedf509d98b9c70f1f2ada43a27ea2c310956c5f93f9c078fc6320f77bad31c9592cdb0619afd6106610cd8dee4218e434217724666551dce3e14865942e34ec11bec6fc7061189176e2c265e2d09e4a7c46c3f77e75329e87bee9e7b6b05cb7662e7c961d2e370a1584cd8dd5d6823c89dc36d636625fef9f1394fbad54f9c43210141735140b8c91d831aa8e0c0c180cc900a40de0b4027d037c6e5a837515eec8fb3b8ca855540f6b584777153ca4dc3822da456e0a18c415ef777eff6dc90853d6247203960a575bde47a49920064f267c0b61810bdbf932a62af215db0236703e0e5ea21be29a8c2c9943901826e95b710026eafedb3f7ed930fc55cc5c17fa614e34009339939d10ea0e7ad800d0664177be80a79c856e3bc592a7b388a08cffb8fbd30cbdfe63990e536c477b1f7591921e1778ddc3c88940f85e69e44ba7b05fb3a711bea6b149f8d82d0d81ec3681edc0105cc5e6b92e5d40e6d653a67a50c5c4391aacea28dcb2af5dc5d7104bda60823a34dd29128497fbfd630b49d0376d2d0ec58157a1b6e6774cf89faf942075ce88d84b52958f63a82de777531386c64d3984dbf1ef708f3144702d94eec9208b00438b348d1a6a98a759a27b858c237a3782d921ca99692f4e9a137be5bfcededc5fa28e31e597e016214c2d728766c5831c9c4c37fd696a0a0a9c1347799e978522392c31a4fc9b1f175789baff72eafa8567b6c790697c9812c04a2b9ff27103bc4e0e1a1ebd41065729bda2e76e61aac0f0333d0e71c83db7b31f385fd02e387ab2408a232cc2598db8002a62d9012b8cb7ed1cc4da4449ad30448f531d81402cb5f47203dd2fa642fb613cd319a787207befc0fcd1dbe3a9e7e913dae4bf85b216100a20585fe0261e03eb51f30f594b9aeef7a072d913e1982cc0f59ed37feba8639f064b14ab38095d759191d6e61a4f2e15fa7133467764be160a043b7fd80b99dad626408efcd65c1184e64fc30a5910011aef401ae4e37fb25bc285da2622ecb5c646bd2813cd248ffdf5e2ea68f17abfdb73a3ec2f2e152e1794467986999fc9a558ede01ff8640e830546edda32a484781b11d8c3f48fac9544e1f412497da53e0f69ea611a13214f12f6070d13a9ec62c256620ca6503aae49f06d85b922d9670186a33fed235d46be734a1a143e6c2467bdda7f7714722b89c30006cb36c64cc13010a6c42ba5de871d157abf52045d115808a71362a2b3929a4f24a5ea2b868e788f6b4a73e8cbd5b7cb43b079a91973c5a75c4694957e6f0a88370e63783798d043f82d3fdd1fa846e53e9259ad97de78212d243fdf6352a232ac00085d723a580a9a1ede0edccf3d552cc234768d868305660c223771072183a0336c949915eda4252db3b61f89d14a5c7ec3a39c3d92b5c7c3624504cc7dbb35bb870a2283a08b6482419cf464ceca5477890f59d79c5d0eb4e72d2f0e058a790ebfbeef11c36a7a3f791bcf107c64ce3414160f6d5e03fddc00d3ef2eee56aa9c458e8442d978ae3919d7a073cc0d0ad2f02042d20c913f52359cfbde4496834646e269c087d432093113e416834968bd93c730c85943d0f1f0cb984f8ad96388da71c19e17af3164b64910153d5a3f57e2f99d4fcc30428a83d3b9fa0e317e843b9dd6dbcc525f5d70f76e7f9a973f242b28537ce27e743dbd93faa1e8729a32055c8ac785bb1d8e6113f80bdac3ae9cc1052e4e1d02f28332b8f39b55ef6c3ccd54ceec67aa2469f8742a81616c1e8f2a0c077229ce3c52eda855f308bdf3bf1dcaeeb0e8cbbf2538f3d6dab2980b63d1817b56ca18ef22994ca130e4a6d5ee526036996698346bc56b137ed110e4890fdaae2f2ba74df9f1d4dd55eba386baeada5ccc9671d1216bfec8d1185747255b2002282f08a6c368306be6ed52a7a99c96782fb32b8aa461b8a242cb1ec828cbbffe7a984ac8c1b6c758c60a9693e562d1d699b2ba5ee4123fde8e5798ed0c753c3318002456819e65920183c31362304afb24f30b1e65e8c9922d452846bcf1600493b64cc974cf9c80327fa16275eb77e9838d88439fe29b1b17b66231ed36626ee2cf2cce7f3015a6935afe6898c84894a7dd894c656cfd8eaa6798a0e5e6e6c89493c3f0b9fe76e33509987b810762a4d8b621fc7c2f0d519bd8464f4c6db5a967d216f0fe049c45790d5f9914c044bcd4616436ce31751bde8510690964dfe6ba9fcca556a2367234017244501ea9ef9bd351d401b0115eaea047214a5d8618ef825e3433666fca468d4d13cf2f7ea4a3b3948ae7605c9539b141ca30b9f56e158dc1e071d191c7a8cd442c88e7bad0c1e5138a41dd86d8d42ad8caa7fc723f349db0975fb7016dcde40234329bf97f0c90af5e6f593fd95f0e8d960482731d07b5335e5302e4a7d6c4c86f8d9f5a208b67e856fb87b4b2037ce75ef53d1c4043c75e7a336b7beba6f119eb0b5ef8008692019185c8412be3ed9a554b92669860d71f14cf3926f89cdbe51cdc83bcc295e6f32161b06df57ecc48bda6aa5adf87562a5eb91029ae3a0d737854a9f87c2e22efa45212fda71f3cbbfc5a19ef92dad653e86886241170cef14c375e33cb4e64c3359dcacdb7d3a120016f5c261b196a10a3c1a90504676b93073f154c3700bb42846d263d497dde98b1e450abd56fbca3b72434018c79e086301c90f08fd4adc12ca5dce50f99b8b1ce3c6295eafc68330d7b16bbdbc378b193b482583ed6a66ed2025d80d386242c2790539d21af153672c6a0c426c6b1b537329bfba3d03340d7c00ca52673f48cf13b4c9dd5b8d630aa0cc3df7abd9a0fcdc1c713b5f3fe25428c734909433fde266048921101abe88330ea5a43aea701fc86968d8a8b6cf585fc99cb543dc522a20d3c884f79e1b067f0fd30a0751f2fbea91d94de6c1099ca41552b41659c3f60afb618db4b5bf16ed567b890021ea554c4a3ae96706423b9556615cf78096fd7321e26c75f12557c3413ae02c06c1ca109d101fed13a678dd3cefaa1ddaebbe074f4beb30916ab41890a6cb756dd78ac72290d7f36d4f271e8994fdf1289499094fc77aa2ea05317cfdb4f19110cfc02ede55231be4d3c35bd8d75697c0b99fcf13a9a48c135daa1397127c760d338fb570ff841d5449f1ed32335fed7087ce6f0280910309113b1a951d44df4b82115d8f61d5fbbcc617288929bb4a59664b7c933074753a49584fa8ee116ed457411c159c89fa1b00957dc6fc3b9513b3d067ffab39440bfcb4988e141a1180635af41685c14b76238acefa5b0341c5d7d25fbc55ed7a5cb8acc35bc41d1327f884bbfa8b79f6d4cec763717929c7e9c74f1e62a3c0f6d9078f3f27b5fb2ab5e264b5aeee0bbae5333b62da2092dce0929c24c63b18955fc99219dfd7d35af51260f8a6c70edd5f8bbfd5386b28bf412d9d2c661bbe85689bd5bf80daac0ae04d580eec8c7c60ff2d6f0e29c9322bb310e6c5f13016b9ccef1fedec392dcd51012d8123d719b0303b948c877bba5a6f9851d4b02e467fd79fbc353d4afaedf5e389977e1b7debef2beb88d8e616d06a5865d786ee01ac7eed9dd88436e5f2c5729183a2272ddedc17698e27b62673b196d04645f7b78b4d823d0f7a196896b077270a27b9e84c780968b562d07b495a5f771fcdf3d15ebe70d446fcf206dce2c2a3fec0f7a51d6cb0e17407fc6841011a5e89452b9b94a55cf1c61925a41438098fa8873b5c77b6315758cbdcf9d78cd003387e23e5a9d5eba24b45d427e4cfdc8d2e0e0421d99eec6db76c83ee3d1eeb2d6c6a347bc48c66791650c17b4a99a679e7674f72c4c794212c20edd23c91edb089e158f27d8646f0b03919f548ed7d3173d6112d3a6045cc4cdd9656f8a91f187cdd0f07bb2af444252342f12821ea5f84659821a3cf0eae45da2b4c23728eecc95ee8be67e110a8e94dda8727903a87443caa09e670423976afeadea6ac6541b53d46a3312c863b0090943c33b7414c4135da051bc54f7f6f32d9f6d92e8ed6398ab8bcf16db3140dd2a7bfc6cb6bad0671a3ef8e14c5a95d70b83c60333e3f472f356cef56b5008a62196b3c9842267425cf15b6953adac8c244cab7c818718f53b08f58647ad9d56cd5fe7a3ae7d429be4f6f6bcd50baac964925fdbca23c4973eb7e7e924bbfc98b79a7162593a717f7e42b508353d9fa8f8a896501d8b4ec9b28365bcc56d358e21c08881ef6936f77fd13d7a0c1b9cad0cbe6d5db89a1f7beeea67cf4025f9c14a0e14c1b1a17bf43dbec6746dac98c904c023245bf16b590241d8a4f94be3f2086362c60da9dd955db49bd85501ed2b27ff63a4886f078744363c6d5903025bfcda83fa7d9f6659c56f6d37cc102b28c5aee9bcc19160c6f7c49dcab7184acaa3db7ecbca816445508a4ac1d493bfce3e9881a1f314323e473406e7ba29e2d8466ab01d2d4c1e16e4d1448f6c0432840889d1cd368987c6bed5a5348d23a54d22aeb8b3eff2299393bfcf751dd303ca5e82f58c9b1f7921d9f9e2deca1a7b79e9d2618b060a0fd312908eb3f73bfc7b5e3bab820842cec338378d0ad8529e310239ec16e91813c27e7affc8d13afaf25ebf39568223f11935d96e9c3530cffaf08b0a6b268a7b00bd0c8356961b9bc2002ee0027388671f3bf9068ddbff12a4e1b969bd8cf968df512e8e52e70b0ef1cf2b2c80a21548f324848dff4860057eca7b8e3b789fad689a18dc40c91dd0dcc06c6514eb046c374a40221c7c0e636057d7310862b9d8ba4912018eb59b75ed7e6513a7ba971653d036095bcc63289c76b112854a6757fddee69c0b0b5293e18630d57772489ff28018e40df31d0e3cc7ccc445e2fb9de4671091fa2b8317d2ed9040a0a1538ad51f62d5aba75db02d465aefab476b869360d2db2e385ff286fdafd6946ffa7c032ae085fa0300e21d11110530a570842bb594a1e1b784dfc37eadb66e9d010d4fca740146766f91c8514662e7d3c4bfd6102c9644a7dff9348c4f67d58fea22b9b7a5f6a71192b3535d71903a3ce407e661f0023cca7ba70a4c77098749dac21a63b6ea53bf1c9930b257ac1cead80cc7c462ff991be40e123c38d946d5981a9c5201e71d65c3df1bebd42d16b567f8aaf510b490c914d868207bfc8cf9cd12dafb22b6fad9998d7d50e12b2051972c73086c0f5e5db98e4f9cda559af551ef9c331b54f50e0ead8fbb092b5216d9a16562ed4fb01e1f45d3ebb18886d742c295a905da4912764ebaad6c5b0a210599db5f6924aa3e662ceec6c7fce3c07aaacec767ba96571b3838f1adcd03e08d1060d56f70f2fe3684eaa7e3df3cba2d3742005bc82e055cd201713661a660c795a10f9ae91f1a793af04a47d3fe064ce699cff20a605f2259e307eddb6ddf9ebd34494658ede30e0d118e08f4997d0ba8401deefbdb8e69ada943398ef2a05d9c4195627fbc8eb90ff7efebae2e40dcf242a132ff35c9eadefe9e47a4ffd15098d8a9d6587e390185e049ccd7a09f1d8634a4fc9e908fdbb8ba218a38898662ad64088a759e05e88a5da87d62ce36998a51f8956b57be633758cb2a15ce39a2b989b4105c1e13dfeb6dfc211d17568310eba5840accbf817f9cab1cb9ea3faffd0ba7aa9390e48863cd1fc11315a237596a1168c5f00e6603a3a0d84d464b187789b56372c6e8ebfcbe69c7243f4c80809078b97c630f0c734cb76c29c13757119e529155f3b21c2fbf92b2d602faea9cb404e545907dcba7804b3af21a6a8ddf476bab2043c051a95692dd824b685ca2e815cf405cedc52b1f2394389a0a01365ed4bfcfb35f6d2c2b57faa72cf4aeac66b597a9f62b2081613e52d281f300b2026f3877a715c31f6b4e051c33e9f30a507d9f7e6910ec54e351da071485a603e825a638690c36e605312b128263497d101bf3dd34ba9f183db5559a4da743604fb3f72f863ccc767390a571eb66543f0c8b9c2dc2e1f2fad7412937d27f4f2e05fc5a15d3e097ea9f17a8a9b3b8518af82e5ea46d2a7205b4af4be164adceab61d621c723a99cb69f7df57242983bb4aaa4095881d4957ab8c794193b18eee5e27ec8699a8255df5efd3ff20004f9ecbba42ddb676a01d6dc2bedbdf70893c6fb1e288f84f7a9ba6d47471db394145ba7ae2641785ef8899b0360e162d978bc775785c23e9272b0d20203d1f3c7414436b99ceed410316f9e61b8a007f3894fbb019fb6c36f6510cca81150d9cdd99982f47998d6ca6ea726592a72fcd2a7285496d58c61771efee3eb4674841f2ee721d72082c7d2b9df2a3fc01db2df008a12739baf6beeca9708286384da2999860281b22cf9711bcb14ba35a4423cfe2ce8e2e31a66c367d244a319cad7f00683d2029aeba4af99510b2a50312f1565b69382a3fdaa55b4d0ae32121918fe381fa3f741798586e0f582ca93c3ace551c569ba01276b61c00377d9e5ac70bf29da8b678894281c02f28b7bb72a31b00105946537bec0f0cecff59d3f035f2f61fdd764e3199deafa4c5a46958e68cb0b9e110a21ec2a635bb6f262289f2de259093531d3e9d14b05be673e2bc4094ad8e097c80e90a1f03ff1015037ba9af2903e54a04630338f16e55b069b2bbb67ad20052d15bd592773c43904dc75da5874903d24d6317a27a33d227824e07e86558cbbe0a7d4e135fee43724e6ed12608b6740a91c91db8c702bd55afbe477dbdb9bf53af95941bc91871919d7688e36474ea987604d2b53184a241eab2e4f7df3eea8793b03f7db969f83363cd295789276d18660d8b74a6ef28504cc5fc05b5e87d39a26c8b652fc5386273c7f2a01245e5005e8c3095e5b9745a011b82bc0ed2fd7e57d5c75c006a20a33246ae2833afa33f30aa5e832f6827e417fa4b12edac3d3f92b06c23aa19aca4fb8d726a380b6421a63a3c0bfde137e877c64b81cc83c87fe9a6e6c262a64bca7312cc803369384c5a376faa2c71c1cef0e2fc32eb88b5c7c30ca27dd49842da3234ec0d0c354cf2b6e8d1b51b10ec899e53e4f5315ece7c3e615c4edd87640254917a7bfcb8c4557cf7be413a59d46efc5eee19cb04768df60e000409c3dd4e7abd5b251745d906fd3cf24b063b8e0438cd33a365e9be47f14c2c54952fb366a922f4d7e6415c6c9fb02d6b0bbc0de4454eeb19503a5ea6c36ccc782e2761be888a78959e1610985c71f3ad11e100ebbcc7ebb282e0c4034204e867131a03b5e6be8a83243c03172d1210c0e1211cc5a6554804839cd7dd6f0b5fb9d03a5b5915b98a2ea4d7dba1573b18da32f24655e1365bd7868e9704342cf0481c255ec6333ec23e2f753a41092c38a6f18b6df73d162dcca08cbf9bc846366c872bdba5cf36d5e242b90f04096ceb5222aa3cac2318c1acb6ed45ff01799f07608a471f0391221a95c4b1dbbacb760c9ab40b56bea536180a0635554e7706c2404a6ee7daa5fe171da04e8af0f946f1726f8446f12663c5f71798ba52c2cf797749dbcbcb9672caec69bbfbbb18fea698674735a4b11b6a30a20f66d9ddd37d595f2e5c431674f3dfd434f07fd115837aeb8d116cdff8265f5d69c02df09dccc58382ae5235bb40276d894a1824ba19fbb55bee68cbb669c20ec3a6c75c8fca2ad9648092dfacc12be0a54ddaea800699088a981f11bf301712018e0de29048af7b54ca1dd3d67e1d6b9ef58064c2d601807f6fd1b5fad1111ce39216d0784901122ea04deb4e516c43cbe04616d965c4bf1fe3a00a49b39e7ff8a1b47580857bdf4f3839a58309a81b0efc294d858cf8a872ced55f22fe9e5e449b82919de8b2e68e7e698b25698142428f8cae21334402196fcad6e8d99fd378118793771b99b539b68bed236ffb441a4fa33477ea8a63d37a1fb08ba429bae5ea5d0757cc2e0c69abd72f2d081304f78c5e982f1dc72dbe2aab3120300846522afe7fd52f575829f7cec7f50f7c385456fd204b94084397bb6b95d92129e5b57a9634895f49af1c05116da39cbb1e7b5366e4c79b7638bda9df8df90cfb8a9768aaa752ae2e0ab7131297b75d5627ba6df0019fb229a0570181f996695ee17ed0fa78dbd5f00546661e6c391f0d142400a43791696a2de7d4f585ffc1ee44113aeba5c0b9901008259d2a28ee9b6a215fdcdd4fc387b225206e957d19883f2f4329198591b2476ea60da78d4263d8af5dc7cb488f7410edcb948747d5f640de0ad5c31ab85f1fa7e89690c92b92aed7717e72f5a9b5c6616cdf4d89ea4d31332bc9324be874d172d71b41db1178db9690b5d313f280296328410d47270e485a45f3656a6f68360598d0a9484dd056c153143571578edb9f1b2e328dfc2714e2b729cc99b2edd41f6351de60c58ae5d1608384eb11c690e4c0b62cd7d43eba7545214a6210eaa48500c04471d8e1207b0739b02add89bb1c13e31ace06aacff7d86e9dce5545ac4ea9474d49bdc6e82b8705b492c78b4be3af31c4c5fb2dc0cafb6d3401cc32ceae7ab4a2572bb28381fc256bac69b22ab827475c5a4000ace83f327d15ef3edc7c32f445039a851724bfb7ebff872231b7405bf878ae5f577ac63e40045991a2b12bb", 0x2000, &(0x7f0000000a40)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f00000006c0)={0x90, 0x0, 0x0, {0x1, 0x2, 0x0, 0x0, 0x0, 0x144, {0x0, 0x0, 0x4, 0x0, 0x0, 0x8000000000000000, 0x0, 0x0, 0x0, 0x2000}}}, 0x0, 0x0, 0x0, 0x0}) statx(0xffffffffffffff9c, &(0x7f0000000380)='./file0/file0\x00', 0x0, 0x0, 0x0) r4 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000140), 0x0, 0x0) r5 = ioctl$KVM_CREATE_VM(r4, 0xae01, 0x0) r6 = dup(r5) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x1, 0x0) read$msr(0xffffffffffffffff, 0x0, 0x0) sendmsg$ETHTOOL_MSG_PAUSE_SET(r6, 0x0, 0x80) r7 = syz_init_net_socket$bt_l2cap(0x1f, 0x2, 0x0) connect$bt_l2cap(r7, &(0x7f0000000080)={0x1f, 0x0, @fixed={'\xaa\xaa\xaa\xaa\xaa', 0x10}, 0x7ff}, 0xe) r8 = syz_init_net_socket$bt_hidp(0x1f, 0x3, 0x6) ioctl$sock_bt_hidp_HIDPCONNADD(r8, 0x400448c8, &(0x7f0000000340)={r7, r7, 0x8, 0x1, &(0x7f0000000180)="e2", 0xb, 0x1, 0xc45, 0x1010, 0x3, 0x0, 0x8, 'syz0\x00'}) ioctl$KVM_CREATE_VCPU(r6, 0xae41, 0x0) syz_open_dev$ttys(0xc, 0x2, 0x1) writev(0xffffffffffffffff, &(0x7f00000001c0)=[{&(0x7f0000000000)="480000001500190a20ffff7fffffff5602113e850e1de0974881030491720000de213ee23f", 0x25}], 0x1) ioctl$KVM_SET_USER_MEMORY_REGION(r5, 0x4020ae46, &(0x7f0000000180)={0x0, 0x3, 0x0, 0x2000, &(0x7f0000000000/0x2000)=nil}) ioctl$KVM_SET_PIT(0xffffffffffffffff, 0x8048ae66, &(0x7f00000000c0)={[{}, {0x0, 0x3}]}) r9 = syz_open_dev$tty1(0xc, 0x4, 0x1) dup(r9) executing program 2: r0 = syz_open_dev$vim2m(&(0x7f0000000080), 0xa, 0x2) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000040)={0xffffffffffffffff, 0xffffffffffffffff}) r2 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r2, &(0x7f0000000400)={0x0, 0x0, &(0x7f00000003c0)={&(0x7f0000000140)=@newlink={0x3c, 0x10, 0x23, 0x70bd25, 0x25dfdbfb, {0x0, 0x0, 0x0, 0x0, 0x8022, 0x8000}, [@IFLA_IFNAME={0x14, 0x3, 'pimreg1\x00'}, @IFLA_NET_NS_PID={0x8}]}, 0x3c}, 0x1, 0x0, 0x0, 0x20000004}, 0x24000000) copy_file_range(r1, &(0x7f00000000c0)=0x5, r0, &(0x7f0000000100)=0xffffffff00000001, 0x8, 0x0) ioctl$vim2m_VIDIOC_ENUM_FMT(r0, 0xc0405602, &(0x7f0000000000)={0x4000008, 0x1, 0x0, "6d460defc877bb4c91f2ffece3b9f8f10d000000000000356487f66094419a85", 0x34343459}) executing program 0: pipe2$watch_queue(&(0x7f00000002c0)={0xffffffffffffffff, 0xffffffffffffffff}, 0x80) r2 = request_key(&(0x7f0000000080)='ceph\x00', &(0x7f00000000c0)={'syz', 0x2}, &(0x7f0000000100)='cifs.spnego\x00', 0xffffffffffffffff) r3 = add_key(&(0x7f0000000040)='cifs.spnego\x00', &(0x7f0000000000)={'syz', 0x2}, 0x0, 0x0, r2) keyctl$KEYCTL_WATCH_KEY(0x20, r3, r1, 0x0) keyctl$KEYCTL_WATCH_KEY(0x20, r3, r0, 0xf8) executing program 2: r0 = socket$inet6_icmp_raw(0xa, 0x3, 0x3a) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f00000001c0)={'dummy0\x00', 0x0}) r2 = socket$inet6_sctp(0xa, 0x1, 0x84) (async) r3 = socket$inet_sctp(0x2, 0x1, 0x84) (async) r4 = socket$inet6_sctp(0xa, 0x5, 0x84) getsockopt$inet_sctp6_SCTP_MAX_BURST(r4, 0x84, 0xc, &(0x7f0000000000)=@assoc_value={0x0}, &(0x7f0000000040)=0x8) getsockopt$inet_sctp_SCTP_RECONFIG_SUPPORTED(r3, 0x84, 0x75, &(0x7f0000000180)={r5, 0x7f}, &(0x7f00000001c0)=0x8) (async) mmap(&(0x7f0000000000/0xa000)=nil, 0xa000, 0x7, 0x2172, 0xffffffffffffffff, 0x0) (async) munmap(&(0x7f0000000000/0x4000)=nil, 0x4000) r6 = syz_clone(0x0, 0x0, 0x0, 0x0, 0x0, 0x0) sched_rr_get_interval(r6, &(0x7f0000000000)) (async) getsockopt$inet_sctp6_SCTP_PR_SUPPORTED(r2, 0x84, 0x71, &(0x7f0000000080)={r5, 0xc196}, &(0x7f00000000c0)=0x8) r7 = socket$netlink(0x10, 0x3, 0x0) sendmsg$nl_route(r7, &(0x7f0000000100)={0x0, 0x0, &(0x7f0000001140)={&(0x7f0000000000)=ANY=[@ANYBLOB="440000001000030500"/20, @ANYRES32=0x0, @ANYBLOB="00000000000000001c1012800600023ea2007d91933048f479cdeae1714e21000008000500000000000000006a709bfe0000000002301753b23fcafaa39c7fa21484858974", @ANYRES32=r1, @ANYBLOB], 0x44}}, 0x0) r8 = openat$uinput(0xffffffffffffff9c, &(0x7f0000000140), 0x802, 0x0) ioctl$UI_DEV_SETUP(r8, 0x405c5503, &(0x7f0000000200)={{0x1, 0x40, 0x9d3, 0x3}, 'syz0\x00', 0x34}) executing program 0: r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000040), 0x0, 0x0) close(r0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000200)={'rose0\x00', 0x112}) r1 = socket$inet6_mptcp(0xa, 0x1, 0x106) connect$inet6(r1, &(0x7f0000000000)={0xa, 0x4e24, 0x0, @mcast1, 0x8}, 0x1c) ioctl$TUNATTACHFILTER(r0, 0x400454d1, &(0x7f00000000c0)={0x0, 0x0}) executing program 2: r0 = socket$unix(0x1, 0x5, 0x0) r1 = syz_open_dev$dri(&(0x7f0000000000), 0x1ff, 0x0) r2 = socket$igmp(0x2, 0x3, 0x2) getsockopt$IPT_SO_GET_INFO(r2, 0x0, 0x40, &(0x7f0000000ac0)={'mangle\x00', 0x0, [0x8b45, 0xe0000000, 0xfffff066, 0xffffffff, 0x6]}, &(0x7f0000000a40)=0x54) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r1, 0xc02064b2, &(0x7f0000000200)={0x8000, 0x101, 0x4, 0x0, 0x0}) r4 = syz_open_dev$dri(&(0x7f00000000c0), 0x1ff, 0x0) ioctl$DRM_IOCTL_MODE_GETRESOURCES(r4, 0xc04064a0, &(0x7f0000000040)={0x0, &(0x7f00000002c0)=[0x0], 0x0, 0x0, 0xfffffd52, 0x1}) ioctl$DRM_IOCTL_MODE_CURSOR(r1, 0xc01c64a3, &(0x7f0000000280)={0x3, r5, 0x3, 0x0, 0xa, 0x1ff, 0x1}) ioctl$DRM_IOCTL_MODE_DESTROY_DUMB(r1, 0xc00464b4, &(0x7f0000000100)={r3}) mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./file0\x00', 0x0) r6 = socket$tipc(0x1e, 0x5, 0x0) listen(r6, 0x0) ioctl$int_in(r6, 0x5421, &(0x7f0000000180)=0x7) accept4(r6, 0x0, 0x0, 0x0) mount$9p_virtio(&(0x7f00000001c0), &(0x7f0000000480)='./file0\x00', &(0x7f00000004c0), 0x0, &(0x7f0000000840)=ANY=[@ANYBLOB='x\"no']) ioctl$DRM_IOCTL_MODE_CURSOR2(r1, 0xc02464bb, &(0x7f0000000080)={0x3, r5}) r7 = syz_open_dev$dmmidi(&(0x7f0000000080), 0x2, 0x2003) ioctl$SNDRV_RAWMIDI_IOCTL_STATUS32(r7, 0xc0245720, &(0x7f0000000040)) r8 = bpf$MAP_CREATE(0x0, &(0x7f0000000100)=ANY=[@ANYBLOB="15000000080000000800"/20, @ANYRES32, @ANYBLOB='\x00'/20, @ANYRES32=0x0, @ANYRES32, @ANYBLOB="00000005000700"/26], 0x50) bpf$MAP_LOOKUP_ELEM(0x1, &(0x7f0000001e40)={r8, 0x0, 0x0}, 0x20) bind$unix(r0, &(0x7f0000000280)=@file={0x1, '\xe9\x1fq\x89Y\x1e\x923aK\x00'}, 0x6e) listen(r0, 0x3f) ioctl$sock_SIOCETHTOOL(0xffffffffffffffff, 0x8946, &(0x7f0000000340)={'wlan1\x00', &(0x7f0000000240)=@ethtool_drvinfo={0x3, "818f700db6a0f45ab6f59ab99cba2bae81a61e730bec8a0916e000", "2892d406cc52b53f98b142327ce3fc933ca0bd0fef46ae917e31a290b03ea5e4", "6a6d4d079bb5a071f3047e941bdf839b228c5339034dc4dbc9aac62885f89b13", "399a72fa7e8ea566ce68ce40bb2a1dea7df91b40b35f27aef90000000000cc33", "e110d3b10300000000005a912004b96100000000000000000000c4b54a4500", "a0149a2235537562b318fec0", 0x7, 0x7, 0x0, 0x101}}) r9 = openat$vcs(0xffffffffffffff9c, &(0x7f0000000040), 0x800, 0x0) sendmsg$tipc(r9, &(0x7f00000000c0)={&(0x7f0000000080)=@name={0x1e, 0x2, 0x2, {{0x41, 0x3}, 0x1}}, 0x10, &(0x7f0000000800)=[{&(0x7f0000000140)="9b71ed49cba007909d1ad1b017e217e63abdda56543ac6f16126edaed34b1c1469f242bf55f6694682ff87c15492f6012b439f63614e881fcdc47f1d2bb517f1a44ae159e228815772", 0x49}, {&(0x7f0000000300)="4ed2929b2dd2c3b3850e245302bf57e333e160d370022f3d0cc4ea262e300b95e6be04d407d19e46a7321b042447bb49e99cf063a990dcc4b23fb7e8575910d1368cb30458706f4d244a30c33a4c3fab", 0x50}, {&(0x7f0000000380)="d0a19ff70bd33105189d2a24712378caf196ac2a19a474ae274ff8f4feefec78973cbbb0b25146ab0fb401cd207c1896efab16a7a74abdb80bb8cf45743ea3975fff00fef0c5d430f05cadfe9378bd6d942282d7e0c8a31a80ffbd72cb114391e62565b3334ef4fc629580285d46de9f831eb4bbf325ed2a45819aa6dcf4cbeae77403bce402f41312954c7eeb5ca4bb2acece", 0x93}, {&(0x7f0000000440)="125abff2b57e0a62fd8274ca437bcc020ee5eabb96cba37adb6362683e9a5938fb2eff81b73d1602006cd09c9acccbb2ab56b042d0d189acb59cbff6dc1e6e10d6d9c942ed777fb73edb1831", 0x4c}, {&(0x7f00000004c0)="1ccd49cfa8d8782cf10ec55e5d6bcf74ec13847306d1381441fa94cadbc2e90a6337d8b11ae01592d7fe6c822dede0bf8ddf178b4b923de86c41f4603cfed0a6369d1080fbe704d58cda07388ebfad615f4842b214b30ae4adb17e5784c81284687acfcfca9ef01849da456c10309ff07c507d357f3f9592fecce1f4e047ea37734031a64b76158b659f6b87e1d332c86d10323378841615263324ad46796f73eb01923812bbe9c3fafc2e03d0f7c8c255b76c678a4590c3bcf662162680779346", 0xc1}, {&(0x7f00000005c0)="9574e96113167503569a75b55026bd2125544680b10e24ffd3558866fa3f8ccc1a526854f81ae7a68e76f02105789cb7d6307fa4d4c9ca06b2389b7464791c5cc8caafcb12ae40065cd0768410a5ec179428f5a4e109006aa83fc4b29d6e6bf676492186e6d495c19c9e766e18888ada7172c3487438d2dd845c2aed84780645bc562823a77115fc31db4478d952a134c8b631ee717d3eb1c86a845fa117319a0c2484417061b6d7c8f31537ce983d0a1c0949bb64ddaae60b073b732281691a5fa3b0b90ac9be78a00a608fab2267819f40740578de36a7429185840e1920e63446a5922dbd22cfc4ed21b931a30c4b07572f28", 0xf4}, {&(0x7f00000006c0)="2e03cee78d9786a7c81488d80880298b8498fd604036615c59b1083ffaa4a4fc9a680acdc3a94d8852a24db18c5e519243b38e49ad5424850d67c02f5c20e2015ba94a5bf316198b3104541bdc4990f498d469b2e886bf390f1147d4", 0x5c}, {&(0x7f0000000740)="220a49d79d7992f58fa8ae5fcc6f7f456b68a94399fdadcc6dedaeb360238652a5315c696929196e38cdab42fb6ffe10f8c8b9a3cb3bc45d41493233d6e06282894610549c604523214a0c41e222fc37db9c1d98df7073258b376b4439c63b052b9199b2fd796ea64a58ea319c20bad05fd8d3ecc7c952390db4ad9d8c1dfaff29fb7671b1972cbca36268a31501e07f17c467eff3", 0x95}], 0x8, &(0x7f0000000880)="349a3f2a5244ac15a697d77289340172d7e9f86f7902abfd6c5ea3be63de14bc2707aa1bd7d5621e6bcb8335d4806808a8cfc794a5990f2cde6e9bd23bd4db8000d6b862d8c082fed9bc230234aee65d97c9508429594fe6d153720cb1ab828116769518d8d2aba71a184bfcf9c3e0b3ce83fba8e8273e9879a4bf8ced9f4f17b4fcf5df7d7ea4443fbe31a9933d3a9887401608593d6ef933a84d8a6fa1b6260ffd2ae7d039c916aa01551730b4e0ba0a13e1ffe88ea389e51786d9ad06323ab67302e5c42cfca184dbe24a", 0xcc, 0x20000010}, 0x4000000) r10 = syz_open_procfs(0x0, &(0x7f0000000100)='fdinfo/3\x00') preadv(r10, &(0x7f0000000000)=[{&(0x7f00000001c0)=""/147, 0x93}], 0x1, 0x0, 0x0) setsockopt$MRT_ADD_VIF(r10, 0x0, 0xca, &(0x7f0000000a80)={0xffffffffffffffff, 0x8, 0x40, 0x1, @vifc_lcl_addr=@multicast1, @broadcast}, 0x10) r11 = accept4$inet6(r10, 0x0, &(0x7f0000000980), 0x80000) getsockopt$IP6T_SO_GET_REVISION_TARGET(r11, 0x29, 0x45, &(0x7f00000009c0)={'ah\x00'}, &(0x7f0000000a00)=0x1e) executing program 0: mkdirat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000)='./cgroup/syz0\x00', 0x1ff) r0 = socket$inet(0x2, 0x3, 0x2) setsockopt$inet_mreqsrc(r0, 0x0, 0x27, &(0x7f0000000040)={@multicast2, @local, @local}, 0xc) syz_emit_ethernet(0x36, &(0x7f0000001800)={@link_local, @dev, @void, {@ipv4={0x800, @icmp={{0x5, 0x4, 0x0, 0x0, 0x28, 0x0, 0x0, 0x0, 0x2, 0x0, @empty, @multicast2}, @timestamp_reply={0x11, 0x0, 0x0, 0xe000, 0x2, 0x2, 0x20020, 0x400000}}}}}, 0x0) bpf$PROG_LOAD(0x5, &(0x7f000000e000)={0x3, 0x4, &(0x7f0000000040)=ANY=[], &(0x7f0000003ff6)='GPL\x00', 0x5, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @sched_cls, 0xffffffffffffffff, 0x19, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x10, 0x0, @void, @value}, 0x94) bpf$PROG_LOAD(0x5, &(0x7f0000000080)={0x5, 0x3, &(0x7f0000001ac0)=ANY=[@ANYBLOB="850000002a00000025000000000000009500000000000000afcd48d6494d614dcc6fab5335ec470db2c6161dba392176dd2963038e1d69ba7ea94c500dc4ef2fad96ed406f21caf5adcf920569c00cc1199684fa7c93836d9ea2cfb0e60436e05425cc4686b066707de94a4f4d5fc79c987d669f381faca0f9d9b24be41a9169b740ac03d7c64cee49ee1c6eee84309e7a23c19a39484809539fca4e0b6eab1aa7d54f45a24effa077faa56d59e88254f54077f799bf168301000000bf2255d6a0244d35b213bda84cc172afd8cc2e59a7d8b85a5e3d77ac463920e231b7ae0da8616d2b7958f91f5da6c025d0faab186d94af98af1da2b5952eb15855933a212304e035f7a35dfc72c81256a55a25f8fe3b28d7e53c78fbfe5ab0255f347160ec83070000000000004015cf10453f6c0b973b81a484ebad04859d928365a7ea3fab8b4b380a00d72bc0480f949c479757306720399379d9271cf555c14d56b51c2298237bebfc08e0d5976a942b846970cfd98b9d4139f1111f2dc5e46ac1c60a9b030074bfbcd4b09012175484135f0e519f0b1e4aaa026d570ecb5e8cddbed65ff702000000a3ff4f8a4cf796b07a6ff61c5552417fd703f7f14d8b78a602ca3cdf6a9120072a5d00dcdd8595356c9b2492aaf1264d4ef4a410c882834867bcd2b6e559d17879570c8ad9433269af3be5fa6a9a5c24e392955f4e979ea13201bafe4f0f6ea508000000a0c548552b571bed5647223c78a992810000000571cbb17d9f37282462f0e9c147c0d497c61433c6ccc35601eef97ee611be8c97f4151ffdf6f7820549cda6cb799c6e924966a7f90bf8fd1e75ee76bd72346cfbb526890aa7fe5e68949a3b30567e54d3504723177d356c4604bca492ede62fc28839b5301160ecec37e83efceefd7ca2533659edc8be05cc85451c6a145074343caea5c4bf690441974b155f5adc681a03c0bbb8358856175e2ce8b0cbbbe3c033e54ffcebde1d9d3d35a142a9ec9a7a3755e0f209150a07682c4e14e3a83558df6f3fc97f1730a136bdee07e98cb984b2e2304a1b63afefdb636e56bbaae4e62136574bc6371a0bb2be1a962aae9c1258da6ef590e1d85ea9e12b3025f43e7e08ccffc5064dea4c39cf4b98e1fc6efb5978f51e16b678eca0b658a56008948e561a9845e4ff29e2bdb1d0b923b272341c5e093fd66a2946501559335781092cf8ce3c7c56cd31121624d76517fd3666276c3c0e812b28e2f30d035cee5d0e77a3c70008ec651cc0ae637fa474816bc59d2e2a00092419304b338a987e9d3044d856cf24f370030be3b5f79f030b8d3ebce68663ef5af469abe753314fae31651e0ecea5ece8fb11a4ee288eb149f1fa33669cc8d901fa8e46354c9c3a041a1e7b55c4e81dba1e12289ee34463baf28345bde0c195bc9f021da8f3025ee9c8e3168b4177ce37ed85464c31679053e7f9d04bb5cb51da0b7958989fd70f241262fa3f1dabeb4fc4bda345360200000001fbddeacd3adaa4d2715e21c7724e9e7e7babf61fe358ae791ee8b489a7c9efe3625a9d971b5997485d6a063dc6f7359e2eccc2fb39d419de1a7b5c9dc22c96295a4601adf59d44e58eb1c60b3475be31a9b7cf42b6402312d2725b8d9fa700a86407e79ae29d2c117ca65fc86c2dce97aa03279a66ec87122219b0f796ab92b1adecae50fdb408c8a80f7f02f750d6c977a1919f9f69a6cfefdf879d447df53f3b9b70d10355b07466d1ef0056b5af553d18a6cc50feeb7bfad9b7be3283b6450d014e7712d2f1d7004548b19162cef04d18d4f5987baab97a9bfbd8f185b5671820420bf5b6522c0e21c882c66f4f25ffb6d95e07de02205fca4f18a2eb5b63e45d5d80fe52734093ae5aa3c0b4f3f45bfff2418a18217747ae442e31560e5b741445ea2a1acee2e98c9f3427834ba0a765d20b30f87af976a46f9a9a1ac7dea1ea6845f9aa6623920dacc107f532348cc21164efe794874eac73381e961f3d9c8c21578fe3245097c280abe51427a7f6cd72b5da6d0252803c66730cd5eac907f09b9695906313f8873522608c6fc01e1b9e16587bb5f721303e6b89e5c54d680ac66d09af90dbf50ee69a39265964279d17eb0000000000000000000000fa08ad0731c4b839688b22c4da2a6b00008a1949a6ba49fbf981f8265e7f1f4c2d97f4680b135f87c228ce69418a282bffff2481a0df1774fa7d94944bb92d2b89f73f0e8b63f6316c5762f3288bc970720f48b5647dd177db6810fae05334d5a44a020000001c0d882a564d74a7c72bf9a2152b261ed1d4515f46290d5c6579b63358fea6d2f93589cfe261dc0410b5ccc92a5a0eab327a33431d62d2b7c75ce654d556c9e1817c1abca762ab53d40da51560351b673363652e1ecb56cfe4a746a45ab13c6014e9f361ab687d1cd1795ce9e05c817b83d76046bdb3709de5df7499a02d2f636a454b85b987580ada025d83bd7b8df28a540d5ec5537942e79f2f1ab25ea5f563bc77e4f9468bd309"], 0x0, 0x5, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x10, 0x0, @void, @value}, 0x94) r1 = socket$kcm(0x10, 0x2, 0x4) sendmsg$inet(r1, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000180)=[{&(0x7f0000000200)="9902000012006b9c9e3fe3d86e6c1d0000147ea60864160af36504b68675f8001d000a00a0e69ee517d24460bc24eab556a705251e6182949a36c2151fef08d8cdbf9367b41ad206000000f408000300040100000800000000000000", 0x5c}, {&(0x7f00000000c0)="d557fc16674b56c0a96a733c232d6790c63ca969a688b06e3da58f3c4568bf0a77bdff6f41d7890e18defe94ef1a392dc00dea94a1bfe64982de7cf1c91e1103cc1840210cbb57222bc2bfa30369992a6bc5156c00aeadd359a7991ad1de01feec401dba6d7694a14785839d3c2d67188cd07827c934897de4676743c192c4a4b24f7f8747141a1325d29da89694574c32eba56e5bbc8f80376f3325dd89937e990089294183a4829e21849004c538378d41066cb7de399450b3544067", 0xbd}, {&(0x7f0000000280)="5e191aea3468a5eab1c3d6024b43dece099475c81c53aa9244d866f68b8e31e93b41b432fb0454234620a25706bfb6f01ce01093b7ff634785d8b345ef8f7a928034820bbd37467d1049ac7a724c153c358d6f7efd919bb918734e846598b03733a6f4bbce06471d3a440e14dae67170cbfea76bc33481c28ec2cfad1f3d83ddece3006d5bb30dc4288dd40bd476cc7f94d143c56e54ed4d84b9c1ecc87fc035c7c992767edcfe2218bc6542a6a3a9b879e8aa6d652d277ee640cc15d2e9efe30584ed57ab208ca4db6cf63381804a5ee5950020", 0xd4}, {&(0x7f0000000380)="fd7617adb877574c4a4489fcaccde0c97bdb2d9d89dba8ab9fc9ebbdcedc770661e1971989a787890de32eebe4008ac8bfafa034add91f6ea4acc741521abecc6cbb4fcfeb61d7d08a8911e59550055d17897194afc1ffd04c18c2506d41bec374a6e5b1ed5fd07db55483fef2dc9ad8ae7c6044b08a303f256ff7e7dd720c72fc0d513110468d44e31a8fc9833d521b95c3b04378ca1c67b4faca350009045628c7f7196510f14ebdc68ba7", 0xac}], 0x4, 0x0, 0x0, 0x1f00c00e}, 0x0) executing program 0: socket$inet6_tcp(0xa, 0x1, 0x0) (async) r0 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$inet6_tcp_int(r0, 0x6, 0x13, &(0x7f0000000040)=0x100000001, 0x76dc) connect$inet6(r0, &(0x7f0000000080), 0x1c) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000000)={0x0, 0x0}) ioctl$sock_ifreq(r2, 0x8990, &(0x7f0000000200)={'bond0\x00', @ifru_names='lo\x00'}) (async) ioctl$sock_ifreq(r2, 0x8990, &(0x7f0000000200)={'bond0\x00', @ifru_names='lo\x00'}) setsockopt$inet6_tcp_TCP_ULP(r0, 0x6, 0x1f, &(0x7f00000000c0), 0x4) ioctl$AUTOFS_DEV_IOCTL_PROTOVER(0xffffffffffffffff, 0xc0189372, &(0x7f0000000140)={{0x1, 0x1, 0x18, r1, {0x3}}, './file0\x00'}) (async) ioctl$AUTOFS_DEV_IOCTL_PROTOVER(0xffffffffffffffff, 0xc0189372, &(0x7f0000000140)={{0x1, 0x1, 0x18, r1, {0x3}}, './file0\x00'}) fcntl$dupfd(r3, 0x406, r2) setsockopt$inet6_IPV6_RTHDRDSTOPTS(r0, 0x29, 0x37, 0x0, 0x0) setsockopt$inet6_tcp_TLS_TX(r0, 0x11a, 0x2, &(0x7f0000000500)=@gcm_256={{0x303}, "2a4001011f891d5b", "11682d84dd05bb63ae661f051e1e79ceafeaa60a5bd1dc83db142ade2bd907fd", "fd6ed24e", "d4e9e1c90d89691c"}, 0x38) openat$binfmt_register(0xffffffffffffff9c, &(0x7f0000000000), 0x1, 0x0) (async) r4 = openat$binfmt_register(0xffffffffffffff9c, &(0x7f0000000000), 0x1, 0x0) timerfd_create(0x0, 0x0) (async) timerfd_create(0x0, 0x0) timerfd_settime(0xffffffffffffffff, 0x3, &(0x7f0000000440)={{0x0, 0x989680}}, 0x0) memfd_create(0x0, 0x0) (async) memfd_create(0x0, 0x0) r5 = socket$inet6_icmp_raw(0xa, 0x3, 0x3a) connect$inet6(r5, &(0x7f0000000040)={0xa, 0x0, 0x0, @empty}, 0x1c) getsockopt$inet6_buf(r5, 0x29, 0x10, 0x0, &(0x7f0000000080)) ioctl$int_out(r4, 0x5460, &(0x7f0000000100)) executing program 0: r0 = socket$nl_route(0x10, 0x3, 0x0) ioctl$ifreq_SIOCGIFINDEX_batadv_hard(r0, 0x8933, &(0x7f0000000200)={'batadv_slave_0\x00', 0x0}) r2 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r2, 0x8933, &(0x7f0000000180)={'syz_tun\x00', 0x0}) sendmsg$nl_route(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f00000002c0)={&(0x7f0000000080)=ANY=[@ANYRES64=r1, @ANYRES64=r3, @ANYRES64=r2, @ANYRESDEC=r2, @ANYBLOB="08000100", @ANYRES32=r3], 0x48}, 0x1, 0x0, 0x0, 0x40841}, 0x800) r4 = socket$nl_generic(0x10, 0x3, 0x10) r5 = syz_genetlink_get_family_id$nl80211(&(0x7f00000000c0), 0xffffffffffffffff) r6 = socket$nl_rdma(0x10, 0x3, 0x14) r7 = socket$nl_generic(0x10, 0x3, 0x10) r8 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000900), 0xffffffffffffffff) ioctl$sock_SIOCGIFINDEX_80211(r6, 0x8933, &(0x7f0000000a40)={'wlan1\x00', 0x0}) sendmsg$NL80211_CMD_ADD_TX_TS(r7, &(0x7f0000000b00)={0x0, 0x0, &(0x7f0000000ac0)={&(0x7f0000000a80)={0x1c, r8, 0x1, 0x70bd27, 0x25dfdbff, {{}, {@val={0x8, 0x3, r9}, @void}}}, 0x1c}, 0x1, 0x0, 0x0, 0x20000010}, 0x44000) socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NL80211_CMD_SET_MAC_ACL(r4, &(0x7f0000000140)={&(0x7f0000000040)={0x10, 0x0, 0x0, 0x1}, 0xc, &(0x7f0000000100)={&(0x7f0000000300)={0x94, r5, 0x20, 0x70bd27, 0x25dfdbfc, {{}, {@val={0x8, 0x3, r9}, @void}}, [@NL80211_ATTR_MAC_ADDRS={0x70, 0xa6, 0x0, 0x1, [{0xa, 0x6, @broadcast}, {0xa, 0x6, @broadcast}, {0xa, 0x6, @device_b}, {0xa, 0x6, @broadcast}, {0xa, 0x6, @broadcast}, {0xa, 0x6, @device_b}, {0xa, 0x6, @broadcast}, {0xa, 0x6, @broadcast}, {0xa, 0x6, @broadcast}]}, @NL80211_ATTR_ACL_POLICY={0x8, 0xa5, 0x1}]}, 0x94}}, 0x40c1) executing program 2: r0 = syz_open_dev$dri(&(0x7f0000000080), 0x1, 0x0) r1 = openat(0xffffffffffffff9c, &(0x7f0000000040)='./cgroup/pids.max\x00', 0x2, 0x0) write$cgroup_pid(r1, &(0x7f00000000c0), 0x12) r2 = socket$kcm(0x11, 0x2, 0x300) r3 = socket$alg(0x26, 0x5, 0x0) bind$alg(r3, &(0x7f0000000000)={0x26, 'hash\x00', 0x0, 0x0, 'sha1-avx\x00'}, 0x58) r4 = accept4(r3, 0x0, 0x0, 0x0) recvmsg$unix(r4, &(0x7f0000000400)={0x0, 0x0, 0x0, 0x0, &(0x7f00000003c0)=[@rights={{0x14, 0x1, 0x1, [0xffffffffffffffff]}}], 0x18}, 0x0) setsockopt$sock_attach_bpf(r2, 0x107, 0x12, &(0x7f00000008c0)=r5, 0x4) r6 = bpf$OBJ_GET_MAP(0x7, &(0x7f00000003c0)=@o_path={&(0x7f0000000380)='./file0\x00', 0x0, 0x4000, r0}, 0x18) r7 = bpf$MAP_CREATE(0x0, &(0x7f0000001440)=@base={0xf, 0xa, 0xa, 0x1, 0x800, 0x1, 0xff, '\x00', 0x0, 0xffffffffffffffff, 0x1, 0x2, 0x4, 0x0, @void, @value, @void, @value}, 0x50) r8 = bpf$MAP_CREATE_RINGBUF(0x0, &(0x7f00000014c0)={0x1b, 0x0, 0x0, 0x9, 0x0, 0x1, 0x0, '\x00', 0x0, 0xffffffffffffffff, 0x0, 0x4, 0x5, 0x0, @void, @value, @void, @value}, 0x50) r9 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000300), 0x0, 0x0) r10 = ioctl$KVM_CREATE_VM(r9, 0xae01, 0x0) r11 = ioctl$KVM_CREATE_VCPU(r10, 0xae41, 0x0) r12 = dup(r11) ioctl$KVM_SET_MSRS(r12, 0x4048aecb, &(0x7f00000000c0)=ANY=[@ANYRES64=r9, @ANYRES64]) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000001600)={0x11, 0x10, &(0x7f00000002c0)=@framed={{0x18, 0x0, 0x0, 0x0, 0x2, 0x0, 0x0, 0x0, 0x3}, [@snprintf={{}, {}, {0x7, 0x0, 0xb, 0x8, 0x0, 0x0, 0x7}}]}, &(0x7f0000000140)='GPL\x00', 0x5, 0x1000, &(0x7f0000000440)=""/4096, 0x40f00, 0xa, '\x00', 0x0, 0x0, r1, 0x8, 0x0, 0x0, 0x10, &(0x7f0000000340)={0x5, 0x0, 0x3, 0x3}, 0x10, 0x0, 0x0, 0x8, &(0x7f0000001540)=[r5, r6, r7, r8, r12], &(0x7f0000001580)=[{0x4, 0x5, 0x6, 0x5}, {0x3, 0x3, 0xc, 0x5}, {0x0, 0x2, 0x8, 0x7}, {0x0, 0x5, 0xa, 0x5}, {0x1, 0xb, 0x2, 0xb}, {0x2, 0x4, 0x0, 0x7}, {0x5, 0x4, 0x6, 0x2}, {0x4, 0x5, 0xb, 0x1}], 0x10, 0x40, @void, @value}, 0x94) ioctl$DRM_IOCTL_SET_CLIENT_CAP(r0, 0x4010640d, &(0x7f0000000000)={0x3, 0x2}) r13 = socket$nl_route(0x10, 0x3, 0x0) socket$nl_netfilter(0x10, 0x3, 0xc) io_setup(0x7ff, 0x0) r14 = socket$inet6(0xa, 0x2, 0x0) r15 = dup(r14) mknod$loop(&(0x7f0000000100)='./file0\x00', 0x40, 0x1) r16 = socket$netlink(0x10, 0x3, 0xa) sendmsg$nl_route(r16, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000400)={&(0x7f0000000080)=@bridge_delneigh={0x1c, 0x1d, 0x1, 0x0, 0x0, {0x7}}, 0x1c}}, 0x0) bind$unix(r15, &(0x7f00000001c0)=@abs={0x1, 0x0, 0x4e22}, 0x6e) sendmsg$IPSET_CMD_SWAP(r15, &(0x7f0000000280)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000040)=ANY=[@ANYRESOCT=r13], 0x34}, 0x1, 0x0, 0x0, 0x240040c4}, 0x4000004) ioctl$DRM_IOCTL_MODE_ATOMIC(r0, 0xc03864bc, &(0x7f0000000180)={0x1, 0x0, 0x0, 0x0, 0x0, 0x0}) executing program 1: r0 = syz_open_dev$radio(&(0x7f0000000000), 0x3, 0x2) ioctl$VIDIOC_S_EXT_CTRLS(r0, 0xc0205648, &(0x7f0000000100)={0x9b0000, 0x1, 0x0, 0xffffffffffffffff, 0x0, &(0x7f0000000180)={0x9b090b, 0x0, '\x00', @value=0xa}}) ioctl$EVIOCGBITSW(0xffffffffffffffff, 0x80404525, &(0x7f0000000000)=""/52) preadv(0xffffffffffffffff, &(0x7f0000000080), 0x0, 0x0, 0x0) r1 = socket$inet6_tcp(0xa, 0x1, 0x0) r2 = socket$nl_generic(0x10, 0x3, 0x10) ioctl$sock_SIOCGIFVLAN_GET_VLAN_VID_CMD(r2, 0x8982, &(0x7f0000000080)) r3 = syz_genetlink_get_family_id$ethtool(&(0x7f00000007c0), 0xffffffffffffffff) sendmsg$ETHTOOL_MSG_CHANNELS_SET(r2, &(0x7f0000000ec0)={0x0, 0x0, &(0x7f0000000e80)={&(0x7f00000001c0)=ANY=[@ANYBLOB="3c000000fce274a3b11e32bfd81ab3df83e7af8f885c760322f66a9358a955aaa727876377476222215de720", @ANYRES16=r3, @ANYBLOB="01000010000000000000120000000800090000000000080007000400000018000180140002006261746164765f736c6176655f310000"], 0x3c}, 0x1, 0x0, 0x0, 0x44001}, 0x0) setsockopt$sock_int(r1, 0x1, 0x14, &(0x7f0000000040)=0x9, 0x4) listen(r1, 0x6) accept$inet6(r1, 0x0, 0x0) syz_open_dev$radio(&(0x7f0000000000), 0x3, 0x2) (async) ioctl$VIDIOC_S_EXT_CTRLS(r0, 0xc0205648, &(0x7f0000000100)={0x9b0000, 0x1, 0x0, 0xffffffffffffffff, 0x0, &(0x7f0000000180)={0x9b090b, 0x0, '\x00', @value=0xa}}) (async) ioctl$EVIOCGBITSW(0xffffffffffffffff, 0x80404525, &(0x7f0000000000)=""/52) (async) preadv(0xffffffffffffffff, &(0x7f0000000080), 0x0, 0x0, 0x0) (async) socket$inet6_tcp(0xa, 0x1, 0x0) (async) socket$nl_generic(0x10, 0x3, 0x10) (async) ioctl$sock_SIOCGIFVLAN_GET_VLAN_VID_CMD(r2, 0x8982, &(0x7f0000000080)) (async) syz_genetlink_get_family_id$ethtool(&(0x7f00000007c0), 0xffffffffffffffff) (async) sendmsg$ETHTOOL_MSG_CHANNELS_SET(r2, &(0x7f0000000ec0)={0x0, 0x0, &(0x7f0000000e80)={&(0x7f00000001c0)=ANY=[@ANYBLOB="3c000000fce274a3b11e32bfd81ab3df83e7af8f885c760322f66a9358a955aaa727876377476222215de720", @ANYRES16=r3, @ANYBLOB="01000010000000000000120000000800090000000000080007000400000018000180140002006261746164765f736c6176655f310000"], 0x3c}, 0x1, 0x0, 0x0, 0x44001}, 0x0) (async) setsockopt$sock_int(r1, 0x1, 0x14, &(0x7f0000000040)=0x9, 0x4) (async) listen(r1, 0x6) (async) accept$inet6(r1, 0x0, 0x0) (async) executing program 0: r0 = io_uring_setup(0x1065, &(0x7f0000001240)={0x0, 0x10, 0x800, 0x1}) r1 = openat$snapshot(0xffffffffffffff9c, &(0x7f0000000000), 0x481, 0x0) (async) openat$uinput(0xffffffffffffff9c, &(0x7f0000000000), 0x2, 0x0) (async) openat$kvm(0xffffffffffffff9c, &(0x7f0000000140), 0x0, 0x0) (async) r2 = syz_open_procfs(0x0, &(0x7f0000000600)='fd/4\x00') lseek(r2, 0x600, 0x4) (async) r3 = openat$cdrom(0xffffffffffffff9c, &(0x7f00000011c0), 0x2000, 0x0) capset(&(0x7f0000000080)={0x19980330}, &(0x7f0000000040)={0x200000, 0x200002}) (async) fanotify_init(0x20, 0x400) (async) ioctl$CDROM_SEND_PACKET(r3, 0x5393, &(0x7f0000001300)={"cdb755b1e57be73fc299a365", 0x0, 0x0, 0x5, 0x0, 0x0, 0x1, 0x1, 0x0}) r4 = socket(0x10, 0x803, 0x2) r5 = syz_genetlink_get_family_id$mptcp(&(0x7f00000000c0), r4) (async) getsockname$packet(r4, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f00000003c0)=0x14) syz_usb_connect$hid(0x0, 0x36, &(0x7f0000000140)=ANY=[@ANYBLOB="02bf91121a7d55fbb5c4ad52e805867ec7d1b3db3bd511fe6ef830b610bd2e696ee57d43797629e81fc6cd77ee526d1956c46658c3159fef57", @ANYRESDEC=r0, @ANYRESHEX=r1, @ANYRESDEC=r4, @ANYRESHEX=r5, @ANYRES16=r5, @ANYRESOCT=r6, @ANYRESHEX=r1], 0x0) close_range(r0, 0xffffffffffffffff, 0x0) executing program 1: r0 = openat(0xffffffffffffff9c, &(0x7f0000000080)='./file0\x00', 0x181942, 0x0) ioctl$FS_IOC_SETFLAGS(r0, 0x40086602, &(0x7f0000000040)=0x20) syz_open_procfs(0x0, &(0x7f0000000000)='fd/3\x00') ioctl$SNDRV_PCM_IOCTL_LINK(r0, 0x40044160, &(0x7f00000000c0)=0xa1) executing program 3: r0 = socket$inet_smc(0x2b, 0x1, 0x0) r1 = syz_init_net_socket$bt_l2cap(0x1f, 0x2, 0x0) bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x11, 0x3, &(0x7f0000000640)=ANY=[@ANYBLOB="180000000031288e8e"], &(0x7f0000000200)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @void, @value}, 0x90) connect$bt_l2cap(r1, &(0x7f0000000040)={0x1f, 0x0, @fixed={'\xaa\xaa\xaa\xaa\xaa', 0x10}, 0x7ff}, 0xe) r2 = openat$kvm(0xffffffffffffff9c, 0x0, 0x0, 0x0) r3 = syz_init_net_socket$bt_bnep(0x1f, 0x3, 0x4) ioctl$sock_bt_bnep_BNEPCONNADD(r3, 0x400442c8, &(0x7f0000000000)=ANY=[@ANYRES32=r1, @ANYBLOB='\x00\x00\x00\x00\x00', @ANYRESHEX, @ANYRES32=r2]) setsockopt$IP_VS_SO_SET_ADD(r0, 0x0, 0x482, &(0x7f0000000000)={0x6, @local, 0x0, 0x0, 'sh\x00', 0x0, 0x0, 0x35}, 0x2c) setsockopt$IP_VS_SO_SET_ADD(r0, 0x0, 0x483, &(0x7f0000000000)={0x6, @local, 0x0, 0x0, 'sh\x00'}, 0x2c) r4 = syz_open_dev$radio(&(0x7f0000000080), 0x3, 0x2) ioctl$VIDIOC_SUBDEV_G_FMT(r4, 0xc0585604, &(0x7f00000000c0)={0x1, 0x0, {0x7ff, 0xf, 0x200e, 0xb, 0x2, 0x4, 0x0, 0x5}}) executing program 1: r0 = syz_genetlink_get_family_id$ethtool(&(0x7f00000003c0), 0xffffffffffffffff) openat$nullb(0xffffffffffffff9c, &(0x7f0000000440), 0x1c1482, 0x0) r1 = openat$nullb(0xffffffffffffff9c, &(0x7f0000000040), 0x1, 0x0) ioctl$BLKZEROOUT(r1, 0x127f, &(0x7f0000000240)={0x0, 0x1000000}) sendmsg$ETHTOOL_MSG_STRSET_GET(0xffffffffffffffff, &(0x7f0000000540)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000040)=ANY=[@ANYBLOB="18000000", @ANYRES16=r0, @ANYBLOB="09030000000000fdff072000adce04000280"], 0x18}, 0x1, 0xf000000}, 0x0) openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000400)='cgroup.controllers\x00', 0x275a, 0x0) r2 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000200)='memory.swap.current\x00', 0x275a, 0x0) fchdir(0xffffffffffffffff) r3 = syz_genetlink_get_family_id$mptcp(&(0x7f0000000700), r2) sendmsg$MPTCP_PM_CMD_DEL_ADDR(0xffffffffffffffff, &(0x7f00000007c0)={&(0x7f00000006c0)={0x10, 0x0, 0x0, 0x40000}, 0xc, &(0x7f0000000780)={&(0x7f0000000480)=ANY=[@ANYBLOB="0300"/11, @ANYRES16=r3, @ANYBLOB="000129bd7000fcdbdf2502000000080004000800000008000200030000000800030004000000"], 0x2c}, 0x1, 0x0, 0x0, 0x40000}, 0x40) write$binfmt_script(r2, &(0x7f0000000000), 0x208e24b) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x2, 0x28011, r2, 0x0) preadv(r2, &(0x7f00000015c0)=[{&(0x7f0000000080)=""/124, 0xffffffff000}], 0x5, 0x0, 0x0) socket$nl_generic(0x10, 0x3, 0x10) r4 = socket$netlink(0x10, 0x3, 0x0) socket(0x10, 0x803, 0x0) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000240)={0x0}}, 0x0) getsockname$packet(0xffffffffffffffff, &(0x7f00000002c0)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000300)=0xffffff4e) sendmsg$nl_route(r4, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000980)=ANY=[@ANYBLOB="3c0000001800100000000000000000000a00000000030000000000000c00090008000000", @ANYRES32=r5, @ANYBLOB="14000500fe80000000627b00000000000000000022def77d0b43139408806b55dc7831e10a7dc40125cb228f36b3dda7388ea2912000319ba1a4d8d644ef85366ee397efd254cd6e7fac766c89557368e19de583367076431733d101000000344f9675ec680873ac9cd94fba2c6c6d748e60d1617b02e6adc79a9833becc726f3f106297d91db1a0d7d1231b271bd09c22348ac8ce3265006f0800000000000000f040d52440c67ff5407811d7953c09d170ca829808fcee72018000006bc5fc1eeeb8de9c5b4d89524a48fdf3fec1d61480591debd18b13b1f108c607d4a14c5742f8568ed07a24382a7b6e4423269a5e09bacfd1c821cc6f83678c98574eb5fb2b6877ccc02f34c1521e5b6e8e8165e19d75be8f4ba1e2e39029d40c714b36c109e10f42a8f4b717ad9e4693f54f031d3b0a"], 0x3c}, 0x1, 0x0, 0x0, 0x8010}, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000002040)='./file0\x00', 0x0) mount$tmpfs(0x0, &(0x7f0000000080)='./file0\x00', &(0x7f0000000280), 0x0, &(0x7f00000000c0)=ANY=[@ANYBLOB="6d706f6c3d62696e641a302d4e3a332f4e00"]) r6 = socket$kcm(0x10, 0x2, 0x0) sendmsg$kcm(r6, &(0x7f0000000940)={0x0, 0x0, &(0x7f0000000180)=[{}], 0x1}, 0x0) r7 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000000c0)='cgroup.controllers\x00', 0x275a, 0x0) io_setup(0x7, &(0x7f0000000100)=0x0) socket$inet6(0xa, 0x1, 0x9) io_submit(r8, 0x1, &(0x7f0000000380)=[&(0x7f0000000340)={0x0, 0x0, 0x0, 0x7, 0x2, r4, &(0x7f00000001c0)="4066462d53860daab083a0de4f4c44ad7a3f1ea42c80e16e98f51316944121c5a1e0c4e8c616", 0x26, 0xf, 0x0, 0x2}]) write$binfmt_script(r7, &(0x7f0000000500)={'#! ', '', [{0x20, 'memory.swap.current\x00'}]}, 0x19) socket$nl_rdma(0x10, 0x3, 0x14) sendmsg$RDMA_NLDEV_CMD_NEWLINK(r4, &(0x7f00000000c0)={0x0, 0x4c, &(0x7f0000000080)={&(0x7f00000004c0)={0x38, 0x1403, 0x1, 0x70bd2a, 0x25dfdbfb, "", [{{0x9, 0x2, 'syz1\x00'}, {0x8, 0x41, 'siw\x00'}, {0x14, 0x33, 'netdevsim0\x00'}}]}, 0x38}, 0x1, 0x0, 0x0, 0x8800}, 0x20000044) executing program 3: socket$inet_mptcp(0x2, 0x1, 0x106) socket$nl_generic(0x10, 0x3, 0x10) socket$inet_udp(0x2, 0x2, 0x0) socket$nl_generic(0x10, 0x3, 0x10) syz_init_net_socket$ax25(0x3, 0x5, 0x0) socket$alg(0x26, 0x5, 0x0) r0 = socket$packet(0x11, 0x3, 0x300) syz_open_dev$vim2m(&(0x7f0000000000), 0x0, 0x2) r1 = socket$vsock_stream(0x28, 0x1, 0x0) setsockopt$SO_VM_SOCKETS_CONNECT_TIMEOUT_OLD(r1, 0x28, 0x6, &(0x7f00000000c0)={0x0, 0xea60}, 0x10) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000200)={0x9, 0x4, &(0x7f0000000000)=ANY=[@ANYBLOB="18000000000000000000000000000000611948000000000095"], &(0x7f0000000080)='GPL\x00', 0x5, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0x0, @void, @value}, 0x94) socket$packet(0x11, 0x3, 0x300) socket$nl_route(0x10, 0x3, 0x0) socket$nl_route(0x10, 0x3, 0x0) socket(0x1, 0x803, 0x0) pipe(&(0x7f0000000100)) r2 = syz_open_procfs(0x0, &(0x7f00000021c0)='net/fib_triestat\x00') add_key(&(0x7f0000002100)='.dead\x00', 0x0, &(0x7f00000003c0)="4e09237282d50692dd8177cd88ec84d5b65831daeb3ab2428fe6e301f5364e9e808c904cfe56c7897e8da5bd029e86304fc396b7b7541a2b7135c4c5fe58c8bb82e9b45cd1d2853c1c22568f3f9f44b85f4e05a4589c4f71688840bad10e7e62f42fad010cee932737c512b7fbc476bafeb5cb4e9f8a01a8ca025fa4bd5ac67323c02adb999b1c37747866fe7465751a913e9a419c36b2120cc6efbf46e791760d06b3e029fd5bb96649610d2819fd10ababef8512852d12", 0xb8, 0xfffffffffffffffe) read$FUSE(r2, &(0x7f0000004480)={0x2020}, 0x2020) getsockname$packet(r0, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f00000002c0)=0x14) r3 = socket$inet6_icmp_raw(0xa, 0x3, 0x3a) ioctl$ifreq_SIOCGIFINDEX_wireguard(r3, 0x8933, &(0x7f0000000180)={'wg2\x00'}) ioctl$sock_SIOCGIFINDEX(r3, 0x8933, &(0x7f0000000240)={'dummy0\x00'}) r4 = socket$netlink(0x10, 0x3, 0x0) setsockopt$netlink_NETLINK_BROADCAST_ERROR(r4, 0x10e, 0x4, &(0x7f0000000f40)=0xe498, 0x4) r5 = socket(0x10, 0x803, 0x0) syz_genetlink_get_family_id$tipc2(&(0x7f0000000580), r5) getsockopt$IP_VS_SO_GET_SERVICES(r4, 0x0, 0x482, &(0x7f00000002c0)=""/140, &(0x7f0000000140)=0x8c) getsockname$packet(r5, &(0x7f0000000380)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) sendmsg$nl_route(r4, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000001140)={&(0x7f0000000040)=@newlink={0x20, 0x10, 0x503, 0x70bd2b, 0x29d24, {0x0, 0x0, 0x0, 0x0, 0x14415, 0x48041}}, 0x20}}, 0x4050) executing program 2: r0 = creat(&(0x7f00000002c0)='./file0\x00', 0x0) r1 = open$dir(&(0x7f0000000080)='./file0\x00', 0x0, 0x0) ioctl$TIOCL_GETSHIFTSTATE(r0, 0x541c, &(0x7f0000000300)={0x6, 0xf9}) mmap$xdp(&(0x7f0000ffc000/0x4000)=nil, 0x4000, 0x0, 0x12, r1, 0x0) add_key(&(0x7f0000000040)='dns_resolver\x00', &(0x7f0000000400)={'syz', 0x3}, &(0x7f0000000080)="000001020200", 0x6, 0xfffffffffffffffb) r2 = bpf$PROG_LOAD(0x5, &(0x7f0000000040)={0x2, 0x4, &(0x7f0000000200)=ANY=[@ANYBLOB="180000000300000000000000feffff10850000000700000095"], &(0x7f0000000000)='GPL\x00', 0x0, 0x0, 0x0, 0x100, 0x70, '\x00', 0x0, @fallback=0x30, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @void, @value}, 0x94) r3 = accept4$inet6(r0, &(0x7f0000000100)={0xa, 0x0, 0x0, @loopback}, &(0x7f0000000240)=0x1c, 0x800) r4 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000100), 0x0, 0x0) ioctl$TIOCSETD(r4, 0x5423, &(0x7f00000000c0)=0xf) ioctl$TCFLSH(r4, 0x400455c8, 0x0) r5 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) r6 = bpf$ITER_CREATE(0xb, &(0x7f0000000100), 0x8) bind$bt_hci(r5, &(0x7f0000000000)={0x1f, 0xffff, 0x3}, 0x6) setsockopt$packet_fanout_data(r6, 0x107, 0x16, &(0x7f0000000100)={0x3c, &(0x7f0000000180)=[{0x0, 0x80}, {0x1, 0x1}]}, 0x10) write$binfmt_misc(r5, &(0x7f0000000100), 0x6) ioctl$sock_inet_SIOCSIFFLAGS(r3, 0x8914, &(0x7f0000000280)={'pim6reg1\x00', 0x2}) kexec_load(0x10001, 0x7, &(0x7f0000000d00)=[{&(0x7f0000000880)="37fb79c14b452fe422d277f3feab89bd5416dfcf3bf47545e5ab096dcb018ccf5e7834151fe735f3c37c51b7a72535bc3d1eacead7abed2865da31aa63967c330aedc3705baa61a5607cd0a3a2070d37edfceeb570c4f4a4779225903bdcdbe4dd42df2455794ccc41f4f35f7dad393d2e51029b4d4bb0121453837f0c8d7f83382871fb357ccea66bf27d0105b51f7fa7efff0e8c858dd71b23ffa2276f6066701df8d656ef5e7a6668eaf28a714efaf6abc7f50e1d41f8d18212b678c2f51952f9b14cd732d94abd44ee9c6c3e70cf5e8092eefed3562b38b60acf756feb66dc1e85179ea011d05e29ff33", 0xec, 0x3, 0x1}, {&(0x7f0000000980)="48f8c31e4b57576b253e8835a21c3715777121e4dc6de0b9fafa8105e0c0df84680beb46d29d31f8ddbfe7b650c091ab6cca47192b1c695ce7b539954ebbdad07798399cb6d201b26b806df11ce19cbc0520448b0546ae61a7d3c41d94f4b8479e568ce09b2473975832593dbb2a8fc24ce235fee4f907116cb4aae39c7273cfc3250d6de2cdf5dff4eb4a1763747daccc20cb58a91676a9d65828edef6e4dca63d8c2893a333a4db2c3f68b47774b3d389b3875eaf38f6ce0294b0ca716e2241b6c", 0xc2, 0x200, 0xd}, {&(0x7f0000000a80)="d31588bf1cc6434b3a9c34146e87304d2812f1adc1fce1ada8825cb60b0f401ce94eb0bf9d06f365fc41797047fb1a1511704466190641d88412d4bfaf56b5e2f262551b745377985bae27ccbcfbf9e8dc8ee84d8cb0867f9caddd604bf6120303f320552e5f42a2afce6451e1185180fc94db6a6568c12c50c712b22770a36eb53c48ee784828ab7e25f7c78e7516f3de43a55dc0ed9a98a24c8568da239d6971cd80de47ae31eb6e122978b09fd5a7f8eca3c9e686d76fe4e9bf0283a866924077c4140803b11d", 0xc8, 0x100, 0x401}, {&(0x7f0000000340)="b4c41b984999d0f22ae0a8652c4241723bafb2abfc0c6cefb4cac1c9b1c6ce734a220870622163ae660f6002c28843f998226a50ce5a7c25b51b5795954c9b4a7c74ac986a913d2e9c40a614f763e17b899da790e83c98e75b3fe9f0d72ffd6c6383f518cf60a676817dfc62cfd8670038834c08e3dcf04e86640519cedd6a6cc9920dfbfeff9645b72dcb2a548cfd7fe4002f9cdc33a1214ab90dc395c41ac61fc135e503f1f2e9afaa", 0xaa, 0xcf08, 0x2}, {&(0x7f0000000b80)="32d4889f45e46d6733b3c814ffa3ec8714c220123e79e89519a82c46485e8ca855b7a01d10408bf0d22463ea0a5b0b9fef1117c033426d8ca87a387bdc541ffecbdc2e9716bb6f318a04b3168cca67c5563258bc6aa13a7d78e1b08d01e06e48b7c0448aa0d999a594ec6dd68cceb9d2eac9a5c2b8d73b28f405a5e3d5f027d4747d42d0b76837e4e33acdc54b074946817301ac0cf672a2a4619b07", 0x9c, 0xfffffffffffffff9, 0x7}, {&(0x7f0000000c40)="8028ef083379d18393b5d3e4669cdd95af8f9c2eb285c1e224c2d76b8a423968ee045ad4f67eb8229cedc4359421b5a666c62169862fe46eca1e78ec506eaa", 0x3f, 0x1, 0x1}, {&(0x7f0000000c80)="cd609bb880c2613aa52cfe0c08fa20ef63e04e48074357f528334250ccabfe87effcf3bd7dc9155a80850ff98cc915fc10adc3c4f98443f708783c5b618f9b750ccf7d53e23bbe377644025cdb0733cb7c7c28f56fbe53bb2d60eb80c2d43b14caa6df3e66ed5782cc", 0x69, 0x3, 0x9}], 0x150000) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) madvise(&(0x7f0000a93000/0x4000)=nil, 0x4000, 0xe) mremap(&(0x7f0000a96000/0x1000)=nil, 0x1000, 0x800000, 0x3, &(0x7f0000130000/0x800000)=nil) r7 = gettid() process_vm_writev(r7, &(0x7f0000000000)=[{&(0x7f00008f9f09)=""/247, 0xf7}], 0x3cb, &(0x7f0000121000)=[{&(0x7f0000217f28)=""/231, 0xffffff4e}], 0x23a, 0x0) r8 = openat$full(0xffffffffffffff9c, &(0x7f0000000e00), 0x2000, 0x0) syz_kvm_setup_cpu$x86(r6, r8, &(0x7f0000292000/0x18000)=nil, &(0x7f0000000ec0)=[@text16={0x10, &(0x7f0000000e40)="66b80500000066b9003000000f01d926f30fa6d066b8010000000f01d9640fc73cf081954400008088b2ecc42e676664260f2002670f994bf20f22d4ba4200b80000ef", 0x43}], 0x1, 0x20, &(0x7f0000000f00)=[@flags={0x3, 0x1800}, @cr4={0x1, 0x220}], 0x2) r9 = creat(&(0x7f00000001c0)='./file0\x00', 0x0) write$uinput_user_dev(r9, &(0x7f0000000400)={'syz0\x00', {0x7, 0x6, 0x6, 0xfffa}, 0x1d, [0x200006, 0xc95a, 0xfffffff3, 0x9, 0x80, 0x2, 0x1, 0x7f, 0x6, 0x4d, 0xfffffff2, 0x5f, 0xa, 0x0, 0xffff2d37, 0x1dd2, 0x6, 0x7, 0x0, 0x80000001, 0x4, 0x7, 0x3, 0x3c57, 0x1, 0x24, 0xffffffff, 0x1, 0x1f461e2c, 0x2, 0xe661, 0x8, 0x7, 0x3, 0x7fff, 0x4c72, 0x8f00, 0x642, 0x3, 0xa, 0x0, 0x71, 0x7, 0x7, 0x103, 0x0, 0x5, 0xba1, 0x8f, 0x6, 0x6, 0x3, 0x5, 0x4, 0x8, 0x0, 0x80, 0x0, 0x5, 0x6, 0x8, 0x4, 0x5, 0x40], [0x10000007, 0xffff, 0x12f, 0x8000, 0x10, 0xfffffff3, 0x129432e6, 0xcb, 0xf9, 0xd, 0x2bf, 0x8, 0x9, 0xfffffffc, 0x3, 0x80000, 0x7, 0x0, 0x2f, 0xb, 0x312, 0x78, 0xea4, 0xa, 0x4, 0x7fffffff, 0xffffffd0, 0x9, 0x400, 0x1, 0x6, 0x1, 0xff, 0x1005, 0x7ff, 0x5f31, 0x4, 0x0, 0x6, 0x2, 0x9, 0x4, 0x9, 0x8, 0xb, 0x6, 0x5, 0x0, 0x1, 0x8000, 0xffff, 0x2, 0x77, 0x9, 0x5, 0x3, 0x4, 0x1, 0x7, 0x6, 0x9, 0x48c93690, 0x2, 0xff], [0x7, 0x4, 0x0, 0x64e, 0xfffffdfe, 0x7fffffff, 0x8d2, 0x49, 0x5, 0x7fff, 0x0, 0x5, 0xb, 0x4, 0x5, 0x5, 0x0, 0x16f, 0x5, 0x8, 0x86, 0x3, 0x0, 0x3e7, 0x2, 0x5, 0x2, 0x2, 0xf, 0x8, 0x4, 0x6d01, 0x5, 0x3b, 0x3, 0x200, 0x80, 0x3, 0x4, 0x2950bfaf, 0x0, 0xa2, 0x7, 0x53cf697b, 0x5, 0x6, 0x54fe12d2, 0xbf, 0x100b, 0x3, 0x400000, 0xfffffff9, 0x0, 0x1, 0x5, 0x0, 0x6, 0x0, 0x120000, 0x3, 0x6, 0x2, 0x4, 0x3], [0x9, 0xbb31, 0x3, 0xb, 0x5, 0x938, 0x6, 0x6, 0x0, 0x5, 0xce7, 0x1ff, 0x6, 0x7, 0x5, 0x3, 0x101, 0x10000, 0x6, 0x7fff, 0xffff, 0xa620, 0x2, 0x5, 0x1, 0x2, 0x14c, 0x60a7, 0x6, 0x6, 0xffffffff, 0x9, 0x5, 0x8, 0xc8, 0x3, 0x3, 0xffff, 0x3, 0x9, 0x100, 0x9605, 0xa, 0x2, 0x4, 0x6, 0x1, 0x10000, 0x5, 0x8, 0x2b91, 0xa1f, 0x8, 0x9, 0x1, 0x6c1b, 0x0, 0x4, 0x5, 0xb1c, 0x1, 0x200, 0xffff3441, 0xfff]}, 0x45c) r10 = openat$drirender128(0xffffffffffffff9c, &(0x7f0000000f40), 0x301001, 0x0) ioctl$DRM_IOCTL_GEM_OPEN(r9, 0xc010640b, &(0x7f0000000f80)={0x0, 0x0}) ioctl$DRM_IOCTL_GEM_FLINK(r10, 0xc008640a, &(0x7f0000000fc0)={r11}) bpf$BPF_LINK_CREATE_XDP(0x1c, &(0x7f00000012c0)={r2, 0x0, 0x30, 0xe1515f8735398fb, @val=@uprobe_multi={&(0x7f0000000140)='./file0\x00', &(0x7f0000000180)=[0x400], 0x0, 0x0, 0x1, 0x1}}, 0x40) program crashed: KASAN: slab-use-after-free Read in netdev_unregister_kobject bisect: bisecting 24 programs bisect: split chunks (needed=false): <24> bisect: split chunk #0 of len 24 into 3 parts bisect: testing without sub-chunk 1/3 testing program (duration=34s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): [6, 5, 16, 6, 30, 8, 24, 14, 30, 24, 15, 4, 11, 30, 30, 30] detailed listing: executing program 2: r0 = syz_open_dev$vim2m(&(0x7f0000000080), 0xa, 0x2) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000040)={0xffffffffffffffff, 0xffffffffffffffff}) r2 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r2, &(0x7f0000000400)={0x0, 0x0, &(0x7f00000003c0)={&(0x7f0000000140)=@newlink={0x3c, 0x10, 0x23, 0x70bd25, 0x25dfdbfb, {0x0, 0x0, 0x0, 0x0, 0x8022, 0x8000}, [@IFLA_IFNAME={0x14, 0x3, 'pimreg1\x00'}, @IFLA_NET_NS_PID={0x8}]}, 0x3c}, 0x1, 0x0, 0x0, 0x20000004}, 0x24000000) copy_file_range(r1, &(0x7f00000000c0)=0x5, r0, &(0x7f0000000100)=0xffffffff00000001, 0x8, 0x0) ioctl$vim2m_VIDIOC_ENUM_FMT(r0, 0xc0405602, &(0x7f0000000000)={0x4000008, 0x1, 0x0, "6d460defc877bb4c91f2ffece3b9f8f10d000000000000356487f66094419a85", 0x34343459}) executing program 0: pipe2$watch_queue(&(0x7f00000002c0)={0xffffffffffffffff, 0xffffffffffffffff}, 0x80) r2 = request_key(&(0x7f0000000080)='ceph\x00', &(0x7f00000000c0)={'syz', 0x2}, &(0x7f0000000100)='cifs.spnego\x00', 0xffffffffffffffff) r3 = add_key(&(0x7f0000000040)='cifs.spnego\x00', &(0x7f0000000000)={'syz', 0x2}, 0x0, 0x0, r2) keyctl$KEYCTL_WATCH_KEY(0x20, r3, r1, 0x0) keyctl$KEYCTL_WATCH_KEY(0x20, r3, r0, 0xf8) executing program 2: r0 = socket$inet6_icmp_raw(0xa, 0x3, 0x3a) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f00000001c0)={'dummy0\x00', 0x0}) r2 = socket$inet6_sctp(0xa, 0x1, 0x84) (async) r3 = socket$inet_sctp(0x2, 0x1, 0x84) (async) r4 = socket$inet6_sctp(0xa, 0x5, 0x84) getsockopt$inet_sctp6_SCTP_MAX_BURST(r4, 0x84, 0xc, &(0x7f0000000000)=@assoc_value={0x0}, &(0x7f0000000040)=0x8) getsockopt$inet_sctp_SCTP_RECONFIG_SUPPORTED(r3, 0x84, 0x75, &(0x7f0000000180)={r5, 0x7f}, &(0x7f00000001c0)=0x8) (async) mmap(&(0x7f0000000000/0xa000)=nil, 0xa000, 0x7, 0x2172, 0xffffffffffffffff, 0x0) (async) munmap(&(0x7f0000000000/0x4000)=nil, 0x4000) r6 = syz_clone(0x0, 0x0, 0x0, 0x0, 0x0, 0x0) sched_rr_get_interval(r6, &(0x7f0000000000)) (async) getsockopt$inet_sctp6_SCTP_PR_SUPPORTED(r2, 0x84, 0x71, &(0x7f0000000080)={r5, 0xc196}, &(0x7f00000000c0)=0x8) r7 = socket$netlink(0x10, 0x3, 0x0) sendmsg$nl_route(r7, &(0x7f0000000100)={0x0, 0x0, &(0x7f0000001140)={&(0x7f0000000000)=ANY=[@ANYBLOB="440000001000030500"/20, @ANYRES32=0x0, @ANYBLOB="00000000000000001c1012800600023ea2007d91933048f479cdeae1714e21000008000500000000000000006a709bfe0000000002301753b23fcafaa39c7fa21484858974", @ANYRES32=r1, @ANYBLOB], 0x44}}, 0x0) r8 = openat$uinput(0xffffffffffffff9c, &(0x7f0000000140), 0x802, 0x0) ioctl$UI_DEV_SETUP(r8, 0x405c5503, &(0x7f0000000200)={{0x1, 0x40, 0x9d3, 0x3}, 'syz0\x00', 0x34}) executing program 0: r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000040), 0x0, 0x0) close(r0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000200)={'rose0\x00', 0x112}) r1 = socket$inet6_mptcp(0xa, 0x1, 0x106) connect$inet6(r1, &(0x7f0000000000)={0xa, 0x4e24, 0x0, @mcast1, 0x8}, 0x1c) ioctl$TUNATTACHFILTER(r0, 0x400454d1, &(0x7f00000000c0)={0x0, 0x0}) executing program 2: r0 = socket$unix(0x1, 0x5, 0x0) r1 = syz_open_dev$dri(&(0x7f0000000000), 0x1ff, 0x0) r2 = socket$igmp(0x2, 0x3, 0x2) getsockopt$IPT_SO_GET_INFO(r2, 0x0, 0x40, &(0x7f0000000ac0)={'mangle\x00', 0x0, [0x8b45, 0xe0000000, 0xfffff066, 0xffffffff, 0x6]}, &(0x7f0000000a40)=0x54) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r1, 0xc02064b2, &(0x7f0000000200)={0x8000, 0x101, 0x4, 0x0, 0x0}) r4 = syz_open_dev$dri(&(0x7f00000000c0), 0x1ff, 0x0) ioctl$DRM_IOCTL_MODE_GETRESOURCES(r4, 0xc04064a0, &(0x7f0000000040)={0x0, &(0x7f00000002c0)=[0x0], 0x0, 0x0, 0xfffffd52, 0x1}) ioctl$DRM_IOCTL_MODE_CURSOR(r1, 0xc01c64a3, &(0x7f0000000280)={0x3, r5, 0x3, 0x0, 0xa, 0x1ff, 0x1}) ioctl$DRM_IOCTL_MODE_DESTROY_DUMB(r1, 0xc00464b4, &(0x7f0000000100)={r3}) mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./file0\x00', 0x0) r6 = socket$tipc(0x1e, 0x5, 0x0) listen(r6, 0x0) ioctl$int_in(r6, 0x5421, &(0x7f0000000180)=0x7) accept4(r6, 0x0, 0x0, 0x0) mount$9p_virtio(&(0x7f00000001c0), &(0x7f0000000480)='./file0\x00', &(0x7f00000004c0), 0x0, &(0x7f0000000840)=ANY=[@ANYBLOB='x\"no']) ioctl$DRM_IOCTL_MODE_CURSOR2(r1, 0xc02464bb, &(0x7f0000000080)={0x3, r5}) r7 = syz_open_dev$dmmidi(&(0x7f0000000080), 0x2, 0x2003) ioctl$SNDRV_RAWMIDI_IOCTL_STATUS32(r7, 0xc0245720, &(0x7f0000000040)) r8 = bpf$MAP_CREATE(0x0, &(0x7f0000000100)=ANY=[@ANYBLOB="15000000080000000800"/20, @ANYRES32, @ANYBLOB='\x00'/20, @ANYRES32=0x0, @ANYRES32, @ANYBLOB="00000005000700"/26], 0x50) bpf$MAP_LOOKUP_ELEM(0x1, &(0x7f0000001e40)={r8, 0x0, 0x0}, 0x20) bind$unix(r0, &(0x7f0000000280)=@file={0x1, '\xe9\x1fq\x89Y\x1e\x923aK\x00'}, 0x6e) listen(r0, 0x3f) ioctl$sock_SIOCETHTOOL(0xffffffffffffffff, 0x8946, &(0x7f0000000340)={'wlan1\x00', &(0x7f0000000240)=@ethtool_drvinfo={0x3, "818f700db6a0f45ab6f59ab99cba2bae81a61e730bec8a0916e000", "2892d406cc52b53f98b142327ce3fc933ca0bd0fef46ae917e31a290b03ea5e4", "6a6d4d079bb5a071f3047e941bdf839b228c5339034dc4dbc9aac62885f89b13", "399a72fa7e8ea566ce68ce40bb2a1dea7df91b40b35f27aef90000000000cc33", "e110d3b10300000000005a912004b96100000000000000000000c4b54a4500", "a0149a2235537562b318fec0", 0x7, 0x7, 0x0, 0x101}}) r9 = openat$vcs(0xffffffffffffff9c, &(0x7f0000000040), 0x800, 0x0) sendmsg$tipc(r9, &(0x7f00000000c0)={&(0x7f0000000080)=@name={0x1e, 0x2, 0x2, {{0x41, 0x3}, 0x1}}, 0x10, &(0x7f0000000800)=[{&(0x7f0000000140)="9b71ed49cba007909d1ad1b017e217e63abdda56543ac6f16126edaed34b1c1469f242bf55f6694682ff87c15492f6012b439f63614e881fcdc47f1d2bb517f1a44ae159e228815772", 0x49}, {&(0x7f0000000300)="4ed2929b2dd2c3b3850e245302bf57e333e160d370022f3d0cc4ea262e300b95e6be04d407d19e46a7321b042447bb49e99cf063a990dcc4b23fb7e8575910d1368cb30458706f4d244a30c33a4c3fab", 0x50}, {&(0x7f0000000380)="d0a19ff70bd33105189d2a24712378caf196ac2a19a474ae274ff8f4feefec78973cbbb0b25146ab0fb401cd207c1896efab16a7a74abdb80bb8cf45743ea3975fff00fef0c5d430f05cadfe9378bd6d942282d7e0c8a31a80ffbd72cb114391e62565b3334ef4fc629580285d46de9f831eb4bbf325ed2a45819aa6dcf4cbeae77403bce402f41312954c7eeb5ca4bb2acece", 0x93}, {&(0x7f0000000440)="125abff2b57e0a62fd8274ca437bcc020ee5eabb96cba37adb6362683e9a5938fb2eff81b73d1602006cd09c9acccbb2ab56b042d0d189acb59cbff6dc1e6e10d6d9c942ed777fb73edb1831", 0x4c}, {&(0x7f00000004c0)="1ccd49cfa8d8782cf10ec55e5d6bcf74ec13847306d1381441fa94cadbc2e90a6337d8b11ae01592d7fe6c822dede0bf8ddf178b4b923de86c41f4603cfed0a6369d1080fbe704d58cda07388ebfad615f4842b214b30ae4adb17e5784c81284687acfcfca9ef01849da456c10309ff07c507d357f3f9592fecce1f4e047ea37734031a64b76158b659f6b87e1d332c86d10323378841615263324ad46796f73eb01923812bbe9c3fafc2e03d0f7c8c255b76c678a4590c3bcf662162680779346", 0xc1}, {&(0x7f00000005c0)="9574e96113167503569a75b55026bd2125544680b10e24ffd3558866fa3f8ccc1a526854f81ae7a68e76f02105789cb7d6307fa4d4c9ca06b2389b7464791c5cc8caafcb12ae40065cd0768410a5ec179428f5a4e109006aa83fc4b29d6e6bf676492186e6d495c19c9e766e18888ada7172c3487438d2dd845c2aed84780645bc562823a77115fc31db4478d952a134c8b631ee717d3eb1c86a845fa117319a0c2484417061b6d7c8f31537ce983d0a1c0949bb64ddaae60b073b732281691a5fa3b0b90ac9be78a00a608fab2267819f40740578de36a7429185840e1920e63446a5922dbd22cfc4ed21b931a30c4b07572f28", 0xf4}, {&(0x7f00000006c0)="2e03cee78d9786a7c81488d80880298b8498fd604036615c59b1083ffaa4a4fc9a680acdc3a94d8852a24db18c5e519243b38e49ad5424850d67c02f5c20e2015ba94a5bf316198b3104541bdc4990f498d469b2e886bf390f1147d4", 0x5c}, {&(0x7f0000000740)="220a49d79d7992f58fa8ae5fcc6f7f456b68a94399fdadcc6dedaeb360238652a5315c696929196e38cdab42fb6ffe10f8c8b9a3cb3bc45d41493233d6e06282894610549c604523214a0c41e222fc37db9c1d98df7073258b376b4439c63b052b9199b2fd796ea64a58ea319c20bad05fd8d3ecc7c952390db4ad9d8c1dfaff29fb7671b1972cbca36268a31501e07f17c467eff3", 0x95}], 0x8, &(0x7f0000000880)="349a3f2a5244ac15a697d77289340172d7e9f86f7902abfd6c5ea3be63de14bc2707aa1bd7d5621e6bcb8335d4806808a8cfc794a5990f2cde6e9bd23bd4db8000d6b862d8c082fed9bc230234aee65d97c9508429594fe6d153720cb1ab828116769518d8d2aba71a184bfcf9c3e0b3ce83fba8e8273e9879a4bf8ced9f4f17b4fcf5df7d7ea4443fbe31a9933d3a9887401608593d6ef933a84d8a6fa1b6260ffd2ae7d039c916aa01551730b4e0ba0a13e1ffe88ea389e51786d9ad06323ab67302e5c42cfca184dbe24a", 0xcc, 0x20000010}, 0x4000000) r10 = syz_open_procfs(0x0, &(0x7f0000000100)='fdinfo/3\x00') preadv(r10, &(0x7f0000000000)=[{&(0x7f00000001c0)=""/147, 0x93}], 0x1, 0x0, 0x0) setsockopt$MRT_ADD_VIF(r10, 0x0, 0xca, &(0x7f0000000a80)={0xffffffffffffffff, 0x8, 0x40, 0x1, @vifc_lcl_addr=@multicast1, @broadcast}, 0x10) r11 = accept4$inet6(r10, 0x0, &(0x7f0000000980), 0x80000) getsockopt$IP6T_SO_GET_REVISION_TARGET(r11, 0x29, 0x45, &(0x7f00000009c0)={'ah\x00'}, &(0x7f0000000a00)=0x1e) executing program 0: mkdirat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000)='./cgroup/syz0\x00', 0x1ff) r0 = socket$inet(0x2, 0x3, 0x2) setsockopt$inet_mreqsrc(r0, 0x0, 0x27, &(0x7f0000000040)={@multicast2, @local, @local}, 0xc) syz_emit_ethernet(0x36, &(0x7f0000001800)={@link_local, @dev, @void, {@ipv4={0x800, @icmp={{0x5, 0x4, 0x0, 0x0, 0x28, 0x0, 0x0, 0x0, 0x2, 0x0, @empty, @multicast2}, @timestamp_reply={0x11, 0x0, 0x0, 0xe000, 0x2, 0x2, 0x20020, 0x400000}}}}}, 0x0) bpf$PROG_LOAD(0x5, &(0x7f000000e000)={0x3, 0x4, &(0x7f0000000040)=ANY=[], &(0x7f0000003ff6)='GPL\x00', 0x5, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @sched_cls, 0xffffffffffffffff, 0x19, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x10, 0x0, @void, @value}, 0x94) bpf$PROG_LOAD(0x5, &(0x7f0000000080)={0x5, 0x3, &(0x7f0000001ac0)=ANY=[@ANYBLOB="850000002a00000025000000000000009500000000000000afcd48d6494d614dcc6fab5335ec470db2c6161dba392176dd2963038e1d69ba7ea94c500dc4ef2fad96ed406f21caf5adcf920569c00cc1199684fa7c93836d9ea2cfb0e60436e05425cc4686b066707de94a4f4d5fc79c987d669f381faca0f9d9b24be41a9169b740ac03d7c64cee49ee1c6eee84309e7a23c19a39484809539fca4e0b6eab1aa7d54f45a24effa077faa56d59e88254f54077f799bf168301000000bf2255d6a0244d35b213bda84cc172afd8cc2e59a7d8b85a5e3d77ac463920e231b7ae0da8616d2b7958f91f5da6c025d0faab186d94af98af1da2b5952eb15855933a212304e035f7a35dfc72c81256a55a25f8fe3b28d7e53c78fbfe5ab0255f347160ec83070000000000004015cf10453f6c0b973b81a484ebad04859d928365a7ea3fab8b4b380a00d72bc0480f949c479757306720399379d9271cf555c14d56b51c2298237bebfc08e0d5976a942b846970cfd98b9d4139f1111f2dc5e46ac1c60a9b030074bfbcd4b09012175484135f0e519f0b1e4aaa026d570ecb5e8cddbed65ff702000000a3ff4f8a4cf796b07a6ff61c5552417fd703f7f14d8b78a602ca3cdf6a9120072a5d00dcdd8595356c9b2492aaf1264d4ef4a410c882834867bcd2b6e559d17879570c8ad9433269af3be5fa6a9a5c24e392955f4e979ea13201bafe4f0f6ea508000000a0c548552b571bed5647223c78a992810000000571cbb17d9f37282462f0e9c147c0d497c61433c6ccc35601eef97ee611be8c97f4151ffdf6f7820549cda6cb799c6e924966a7f90bf8fd1e75ee76bd72346cfbb526890aa7fe5e68949a3b30567e54d3504723177d356c4604bca492ede62fc28839b5301160ecec37e83efceefd7ca2533659edc8be05cc85451c6a145074343caea5c4bf690441974b155f5adc681a03c0bbb8358856175e2ce8b0cbbbe3c033e54ffcebde1d9d3d35a142a9ec9a7a3755e0f209150a07682c4e14e3a83558df6f3fc97f1730a136bdee07e98cb984b2e2304a1b63afefdb636e56bbaae4e62136574bc6371a0bb2be1a962aae9c1258da6ef590e1d85ea9e12b3025f43e7e08ccffc5064dea4c39cf4b98e1fc6efb5978f51e16b678eca0b658a56008948e561a9845e4ff29e2bdb1d0b923b272341c5e093fd66a2946501559335781092cf8ce3c7c56cd31121624d76517fd3666276c3c0e812b28e2f30d035cee5d0e77a3c70008ec651cc0ae637fa474816bc59d2e2a00092419304b338a987e9d3044d856cf24f370030be3b5f79f030b8d3ebce68663ef5af469abe753314fae31651e0ecea5ece8fb11a4ee288eb149f1fa33669cc8d901fa8e46354c9c3a041a1e7b55c4e81dba1e12289ee34463baf28345bde0c195bc9f021da8f3025ee9c8e3168b4177ce37ed85464c31679053e7f9d04bb5cb51da0b7958989fd70f241262fa3f1dabeb4fc4bda345360200000001fbddeacd3adaa4d2715e21c7724e9e7e7babf61fe358ae791ee8b489a7c9efe3625a9d971b5997485d6a063dc6f7359e2eccc2fb39d419de1a7b5c9dc22c96295a4601adf59d44e58eb1c60b3475be31a9b7cf42b6402312d2725b8d9fa700a86407e79ae29d2c117ca65fc86c2dce97aa03279a66ec87122219b0f796ab92b1adecae50fdb408c8a80f7f02f750d6c977a1919f9f69a6cfefdf879d447df53f3b9b70d10355b07466d1ef0056b5af553d18a6cc50feeb7bfad9b7be3283b6450d014e7712d2f1d7004548b19162cef04d18d4f5987baab97a9bfbd8f185b5671820420bf5b6522c0e21c882c66f4f25ffb6d95e07de02205fca4f18a2eb5b63e45d5d80fe52734093ae5aa3c0b4f3f45bfff2418a18217747ae442e31560e5b741445ea2a1acee2e98c9f3427834ba0a765d20b30f87af976a46f9a9a1ac7dea1ea6845f9aa6623920dacc107f532348cc21164efe794874eac73381e961f3d9c8c21578fe3245097c280abe51427a7f6cd72b5da6d0252803c66730cd5eac907f09b9695906313f8873522608c6fc01e1b9e16587bb5f721303e6b89e5c54d680ac66d09af90dbf50ee69a39265964279d17eb0000000000000000000000fa08ad0731c4b839688b22c4da2a6b00008a1949a6ba49fbf981f8265e7f1f4c2d97f4680b135f87c228ce69418a282bffff2481a0df1774fa7d94944bb92d2b89f73f0e8b63f6316c5762f3288bc970720f48b5647dd177db6810fae05334d5a44a020000001c0d882a564d74a7c72bf9a2152b261ed1d4515f46290d5c6579b63358fea6d2f93589cfe261dc0410b5ccc92a5a0eab327a33431d62d2b7c75ce654d556c9e1817c1abca762ab53d40da51560351b673363652e1ecb56cfe4a746a45ab13c6014e9f361ab687d1cd1795ce9e05c817b83d76046bdb3709de5df7499a02d2f636a454b85b987580ada025d83bd7b8df28a540d5ec5537942e79f2f1ab25ea5f563bc77e4f9468bd309"], 0x0, 0x5, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x10, 0x0, @void, @value}, 0x94) r1 = socket$kcm(0x10, 0x2, 0x4) sendmsg$inet(r1, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000180)=[{&(0x7f0000000200)="9902000012006b9c9e3fe3d86e6c1d0000147ea60864160af36504b68675f8001d000a00a0e69ee517d24460bc24eab556a705251e6182949a36c2151fef08d8cdbf9367b41ad206000000f408000300040100000800000000000000", 0x5c}, {&(0x7f00000000c0)="d557fc16674b56c0a96a733c232d6790c63ca969a688b06e3da58f3c4568bf0a77bdff6f41d7890e18defe94ef1a392dc00dea94a1bfe64982de7cf1c91e1103cc1840210cbb57222bc2bfa30369992a6bc5156c00aeadd359a7991ad1de01feec401dba6d7694a14785839d3c2d67188cd07827c934897de4676743c192c4a4b24f7f8747141a1325d29da89694574c32eba56e5bbc8f80376f3325dd89937e990089294183a4829e21849004c538378d41066cb7de399450b3544067", 0xbd}, {&(0x7f0000000280)="5e191aea3468a5eab1c3d6024b43dece099475c81c53aa9244d866f68b8e31e93b41b432fb0454234620a25706bfb6f01ce01093b7ff634785d8b345ef8f7a928034820bbd37467d1049ac7a724c153c358d6f7efd919bb918734e846598b03733a6f4bbce06471d3a440e14dae67170cbfea76bc33481c28ec2cfad1f3d83ddece3006d5bb30dc4288dd40bd476cc7f94d143c56e54ed4d84b9c1ecc87fc035c7c992767edcfe2218bc6542a6a3a9b879e8aa6d652d277ee640cc15d2e9efe30584ed57ab208ca4db6cf63381804a5ee5950020", 0xd4}, {&(0x7f0000000380)="fd7617adb877574c4a4489fcaccde0c97bdb2d9d89dba8ab9fc9ebbdcedc770661e1971989a787890de32eebe4008ac8bfafa034add91f6ea4acc741521abecc6cbb4fcfeb61d7d08a8911e59550055d17897194afc1ffd04c18c2506d41bec374a6e5b1ed5fd07db55483fef2dc9ad8ae7c6044b08a303f256ff7e7dd720c72fc0d513110468d44e31a8fc9833d521b95c3b04378ca1c67b4faca350009045628c7f7196510f14ebdc68ba7", 0xac}], 0x4, 0x0, 0x0, 0x1f00c00e}, 0x0) executing program 0: socket$inet6_tcp(0xa, 0x1, 0x0) (async) r0 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$inet6_tcp_int(r0, 0x6, 0x13, &(0x7f0000000040)=0x100000001, 0x76dc) connect$inet6(r0, &(0x7f0000000080), 0x1c) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000000)={0x0, 0x0}) ioctl$sock_ifreq(r2, 0x8990, &(0x7f0000000200)={'bond0\x00', @ifru_names='lo\x00'}) (async) ioctl$sock_ifreq(r2, 0x8990, &(0x7f0000000200)={'bond0\x00', @ifru_names='lo\x00'}) setsockopt$inet6_tcp_TCP_ULP(r0, 0x6, 0x1f, &(0x7f00000000c0), 0x4) ioctl$AUTOFS_DEV_IOCTL_PROTOVER(0xffffffffffffffff, 0xc0189372, &(0x7f0000000140)={{0x1, 0x1, 0x18, r1, {0x3}}, './file0\x00'}) (async) ioctl$AUTOFS_DEV_IOCTL_PROTOVER(0xffffffffffffffff, 0xc0189372, &(0x7f0000000140)={{0x1, 0x1, 0x18, r1, {0x3}}, './file0\x00'}) fcntl$dupfd(r3, 0x406, r2) setsockopt$inet6_IPV6_RTHDRDSTOPTS(r0, 0x29, 0x37, 0x0, 0x0) setsockopt$inet6_tcp_TLS_TX(r0, 0x11a, 0x2, &(0x7f0000000500)=@gcm_256={{0x303}, "2a4001011f891d5b", "11682d84dd05bb63ae661f051e1e79ceafeaa60a5bd1dc83db142ade2bd907fd", "fd6ed24e", "d4e9e1c90d89691c"}, 0x38) openat$binfmt_register(0xffffffffffffff9c, &(0x7f0000000000), 0x1, 0x0) (async) r4 = openat$binfmt_register(0xffffffffffffff9c, &(0x7f0000000000), 0x1, 0x0) timerfd_create(0x0, 0x0) (async) timerfd_create(0x0, 0x0) timerfd_settime(0xffffffffffffffff, 0x3, &(0x7f0000000440)={{0x0, 0x989680}}, 0x0) memfd_create(0x0, 0x0) (async) memfd_create(0x0, 0x0) r5 = socket$inet6_icmp_raw(0xa, 0x3, 0x3a) connect$inet6(r5, &(0x7f0000000040)={0xa, 0x0, 0x0, @empty}, 0x1c) getsockopt$inet6_buf(r5, 0x29, 0x10, 0x0, &(0x7f0000000080)) ioctl$int_out(r4, 0x5460, &(0x7f0000000100)) executing program 0: r0 = socket$nl_route(0x10, 0x3, 0x0) ioctl$ifreq_SIOCGIFINDEX_batadv_hard(r0, 0x8933, &(0x7f0000000200)={'batadv_slave_0\x00', 0x0}) r2 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r2, 0x8933, &(0x7f0000000180)={'syz_tun\x00', 0x0}) sendmsg$nl_route(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f00000002c0)={&(0x7f0000000080)=ANY=[@ANYRES64=r1, @ANYRES64=r3, @ANYRES64=r2, @ANYRESDEC=r2, @ANYBLOB="08000100", @ANYRES32=r3], 0x48}, 0x1, 0x0, 0x0, 0x40841}, 0x800) r4 = socket$nl_generic(0x10, 0x3, 0x10) r5 = syz_genetlink_get_family_id$nl80211(&(0x7f00000000c0), 0xffffffffffffffff) r6 = socket$nl_rdma(0x10, 0x3, 0x14) r7 = socket$nl_generic(0x10, 0x3, 0x10) r8 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000900), 0xffffffffffffffff) ioctl$sock_SIOCGIFINDEX_80211(r6, 0x8933, &(0x7f0000000a40)={'wlan1\x00', 0x0}) sendmsg$NL80211_CMD_ADD_TX_TS(r7, &(0x7f0000000b00)={0x0, 0x0, &(0x7f0000000ac0)={&(0x7f0000000a80)={0x1c, r8, 0x1, 0x70bd27, 0x25dfdbff, {{}, {@val={0x8, 0x3, r9}, @void}}}, 0x1c}, 0x1, 0x0, 0x0, 0x20000010}, 0x44000) socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NL80211_CMD_SET_MAC_ACL(r4, &(0x7f0000000140)={&(0x7f0000000040)={0x10, 0x0, 0x0, 0x1}, 0xc, &(0x7f0000000100)={&(0x7f0000000300)={0x94, r5, 0x20, 0x70bd27, 0x25dfdbfc, {{}, {@val={0x8, 0x3, r9}, @void}}, [@NL80211_ATTR_MAC_ADDRS={0x70, 0xa6, 0x0, 0x1, [{0xa, 0x6, @broadcast}, {0xa, 0x6, @broadcast}, {0xa, 0x6, @device_b}, {0xa, 0x6, @broadcast}, {0xa, 0x6, @broadcast}, {0xa, 0x6, @device_b}, {0xa, 0x6, @broadcast}, {0xa, 0x6, @broadcast}, {0xa, 0x6, @broadcast}]}, @NL80211_ATTR_ACL_POLICY={0x8, 0xa5, 0x1}]}, 0x94}}, 0x40c1) executing program 2: r0 = syz_open_dev$dri(&(0x7f0000000080), 0x1, 0x0) r1 = openat(0xffffffffffffff9c, &(0x7f0000000040)='./cgroup/pids.max\x00', 0x2, 0x0) write$cgroup_pid(r1, &(0x7f00000000c0), 0x12) r2 = socket$kcm(0x11, 0x2, 0x300) r3 = socket$alg(0x26, 0x5, 0x0) bind$alg(r3, &(0x7f0000000000)={0x26, 'hash\x00', 0x0, 0x0, 'sha1-avx\x00'}, 0x58) r4 = accept4(r3, 0x0, 0x0, 0x0) recvmsg$unix(r4, &(0x7f0000000400)={0x0, 0x0, 0x0, 0x0, &(0x7f00000003c0)=[@rights={{0x14, 0x1, 0x1, [0xffffffffffffffff]}}], 0x18}, 0x0) setsockopt$sock_attach_bpf(r2, 0x107, 0x12, &(0x7f00000008c0)=r5, 0x4) r6 = bpf$OBJ_GET_MAP(0x7, &(0x7f00000003c0)=@o_path={&(0x7f0000000380)='./file0\x00', 0x0, 0x4000, r0}, 0x18) r7 = bpf$MAP_CREATE(0x0, &(0x7f0000001440)=@base={0xf, 0xa, 0xa, 0x1, 0x800, 0x1, 0xff, '\x00', 0x0, 0xffffffffffffffff, 0x1, 0x2, 0x4, 0x0, @void, @value, @void, @value}, 0x50) r8 = bpf$MAP_CREATE_RINGBUF(0x0, &(0x7f00000014c0)={0x1b, 0x0, 0x0, 0x9, 0x0, 0x1, 0x0, '\x00', 0x0, 0xffffffffffffffff, 0x0, 0x4, 0x5, 0x0, @void, @value, @void, @value}, 0x50) r9 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000300), 0x0, 0x0) r10 = ioctl$KVM_CREATE_VM(r9, 0xae01, 0x0) r11 = ioctl$KVM_CREATE_VCPU(r10, 0xae41, 0x0) r12 = dup(r11) ioctl$KVM_SET_MSRS(r12, 0x4048aecb, &(0x7f00000000c0)=ANY=[@ANYRES64=r9, @ANYRES64]) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000001600)={0x11, 0x10, &(0x7f00000002c0)=@framed={{0x18, 0x0, 0x0, 0x0, 0x2, 0x0, 0x0, 0x0, 0x3}, [@snprintf={{}, {}, {0x7, 0x0, 0xb, 0x8, 0x0, 0x0, 0x7}}]}, &(0x7f0000000140)='GPL\x00', 0x5, 0x1000, &(0x7f0000000440)=""/4096, 0x40f00, 0xa, '\x00', 0x0, 0x0, r1, 0x8, 0x0, 0x0, 0x10, &(0x7f0000000340)={0x5, 0x0, 0x3, 0x3}, 0x10, 0x0, 0x0, 0x8, &(0x7f0000001540)=[r5, r6, r7, r8, r12], &(0x7f0000001580)=[{0x4, 0x5, 0x6, 0x5}, {0x3, 0x3, 0xc, 0x5}, {0x0, 0x2, 0x8, 0x7}, {0x0, 0x5, 0xa, 0x5}, {0x1, 0xb, 0x2, 0xb}, {0x2, 0x4, 0x0, 0x7}, {0x5, 0x4, 0x6, 0x2}, {0x4, 0x5, 0xb, 0x1}], 0x10, 0x40, @void, @value}, 0x94) ioctl$DRM_IOCTL_SET_CLIENT_CAP(r0, 0x4010640d, &(0x7f0000000000)={0x3, 0x2}) r13 = socket$nl_route(0x10, 0x3, 0x0) socket$nl_netfilter(0x10, 0x3, 0xc) io_setup(0x7ff, 0x0) r14 = socket$inet6(0xa, 0x2, 0x0) r15 = dup(r14) mknod$loop(&(0x7f0000000100)='./file0\x00', 0x40, 0x1) r16 = socket$netlink(0x10, 0x3, 0xa) sendmsg$nl_route(r16, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000400)={&(0x7f0000000080)=@bridge_delneigh={0x1c, 0x1d, 0x1, 0x0, 0x0, {0x7}}, 0x1c}}, 0x0) bind$unix(r15, &(0x7f00000001c0)=@abs={0x1, 0x0, 0x4e22}, 0x6e) sendmsg$IPSET_CMD_SWAP(r15, &(0x7f0000000280)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000040)=ANY=[@ANYRESOCT=r13], 0x34}, 0x1, 0x0, 0x0, 0x240040c4}, 0x4000004) ioctl$DRM_IOCTL_MODE_ATOMIC(r0, 0xc03864bc, &(0x7f0000000180)={0x1, 0x0, 0x0, 0x0, 0x0, 0x0}) executing program 1: r0 = syz_open_dev$radio(&(0x7f0000000000), 0x3, 0x2) ioctl$VIDIOC_S_EXT_CTRLS(r0, 0xc0205648, &(0x7f0000000100)={0x9b0000, 0x1, 0x0, 0xffffffffffffffff, 0x0, &(0x7f0000000180)={0x9b090b, 0x0, '\x00', @value=0xa}}) ioctl$EVIOCGBITSW(0xffffffffffffffff, 0x80404525, &(0x7f0000000000)=""/52) preadv(0xffffffffffffffff, &(0x7f0000000080), 0x0, 0x0, 0x0) r1 = socket$inet6_tcp(0xa, 0x1, 0x0) r2 = socket$nl_generic(0x10, 0x3, 0x10) ioctl$sock_SIOCGIFVLAN_GET_VLAN_VID_CMD(r2, 0x8982, &(0x7f0000000080)) r3 = syz_genetlink_get_family_id$ethtool(&(0x7f00000007c0), 0xffffffffffffffff) sendmsg$ETHTOOL_MSG_CHANNELS_SET(r2, &(0x7f0000000ec0)={0x0, 0x0, &(0x7f0000000e80)={&(0x7f00000001c0)=ANY=[@ANYBLOB="3c000000fce274a3b11e32bfd81ab3df83e7af8f885c760322f66a9358a955aaa727876377476222215de720", @ANYRES16=r3, @ANYBLOB="01000010000000000000120000000800090000000000080007000400000018000180140002006261746164765f736c6176655f310000"], 0x3c}, 0x1, 0x0, 0x0, 0x44001}, 0x0) setsockopt$sock_int(r1, 0x1, 0x14, &(0x7f0000000040)=0x9, 0x4) listen(r1, 0x6) accept$inet6(r1, 0x0, 0x0) syz_open_dev$radio(&(0x7f0000000000), 0x3, 0x2) (async) ioctl$VIDIOC_S_EXT_CTRLS(r0, 0xc0205648, &(0x7f0000000100)={0x9b0000, 0x1, 0x0, 0xffffffffffffffff, 0x0, &(0x7f0000000180)={0x9b090b, 0x0, '\x00', @value=0xa}}) (async) ioctl$EVIOCGBITSW(0xffffffffffffffff, 0x80404525, &(0x7f0000000000)=""/52) (async) preadv(0xffffffffffffffff, &(0x7f0000000080), 0x0, 0x0, 0x0) (async) socket$inet6_tcp(0xa, 0x1, 0x0) (async) socket$nl_generic(0x10, 0x3, 0x10) (async) ioctl$sock_SIOCGIFVLAN_GET_VLAN_VID_CMD(r2, 0x8982, &(0x7f0000000080)) (async) syz_genetlink_get_family_id$ethtool(&(0x7f00000007c0), 0xffffffffffffffff) (async) sendmsg$ETHTOOL_MSG_CHANNELS_SET(r2, &(0x7f0000000ec0)={0x0, 0x0, &(0x7f0000000e80)={&(0x7f00000001c0)=ANY=[@ANYBLOB="3c000000fce274a3b11e32bfd81ab3df83e7af8f885c760322f66a9358a955aaa727876377476222215de720", @ANYRES16=r3, @ANYBLOB="01000010000000000000120000000800090000000000080007000400000018000180140002006261746164765f736c6176655f310000"], 0x3c}, 0x1, 0x0, 0x0, 0x44001}, 0x0) (async) setsockopt$sock_int(r1, 0x1, 0x14, &(0x7f0000000040)=0x9, 0x4) (async) listen(r1, 0x6) (async) accept$inet6(r1, 0x0, 0x0) (async) executing program 0: r0 = io_uring_setup(0x1065, &(0x7f0000001240)={0x0, 0x10, 0x800, 0x1}) r1 = openat$snapshot(0xffffffffffffff9c, &(0x7f0000000000), 0x481, 0x0) (async) openat$uinput(0xffffffffffffff9c, &(0x7f0000000000), 0x2, 0x0) (async) openat$kvm(0xffffffffffffff9c, &(0x7f0000000140), 0x0, 0x0) (async) r2 = syz_open_procfs(0x0, &(0x7f0000000600)='fd/4\x00') lseek(r2, 0x600, 0x4) (async) r3 = openat$cdrom(0xffffffffffffff9c, &(0x7f00000011c0), 0x2000, 0x0) capset(&(0x7f0000000080)={0x19980330}, &(0x7f0000000040)={0x200000, 0x200002}) (async) fanotify_init(0x20, 0x400) (async) ioctl$CDROM_SEND_PACKET(r3, 0x5393, &(0x7f0000001300)={"cdb755b1e57be73fc299a365", 0x0, 0x0, 0x5, 0x0, 0x0, 0x1, 0x1, 0x0}) r4 = socket(0x10, 0x803, 0x2) r5 = syz_genetlink_get_family_id$mptcp(&(0x7f00000000c0), r4) (async) getsockname$packet(r4, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f00000003c0)=0x14) syz_usb_connect$hid(0x0, 0x36, &(0x7f0000000140)=ANY=[@ANYBLOB="02bf91121a7d55fbb5c4ad52e805867ec7d1b3db3bd511fe6ef830b610bd2e696ee57d43797629e81fc6cd77ee526d1956c46658c3159fef57", @ANYRESDEC=r0, @ANYRESHEX=r1, @ANYRESDEC=r4, @ANYRESHEX=r5, @ANYRES16=r5, @ANYRESOCT=r6, @ANYRESHEX=r1], 0x0) close_range(r0, 0xffffffffffffffff, 0x0) executing program 1: r0 = openat(0xffffffffffffff9c, &(0x7f0000000080)='./file0\x00', 0x181942, 0x0) ioctl$FS_IOC_SETFLAGS(r0, 0x40086602, &(0x7f0000000040)=0x20) syz_open_procfs(0x0, &(0x7f0000000000)='fd/3\x00') ioctl$SNDRV_PCM_IOCTL_LINK(r0, 0x40044160, &(0x7f00000000c0)=0xa1) executing program 3: r0 = socket$inet_smc(0x2b, 0x1, 0x0) r1 = syz_init_net_socket$bt_l2cap(0x1f, 0x2, 0x0) bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x11, 0x3, &(0x7f0000000640)=ANY=[@ANYBLOB="180000000031288e8e"], &(0x7f0000000200)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @void, @value}, 0x90) connect$bt_l2cap(r1, &(0x7f0000000040)={0x1f, 0x0, @fixed={'\xaa\xaa\xaa\xaa\xaa', 0x10}, 0x7ff}, 0xe) r2 = openat$kvm(0xffffffffffffff9c, 0x0, 0x0, 0x0) r3 = syz_init_net_socket$bt_bnep(0x1f, 0x3, 0x4) ioctl$sock_bt_bnep_BNEPCONNADD(r3, 0x400442c8, &(0x7f0000000000)=ANY=[@ANYRES32=r1, @ANYBLOB='\x00\x00\x00\x00\x00', @ANYRESHEX, @ANYRES32=r2]) setsockopt$IP_VS_SO_SET_ADD(r0, 0x0, 0x482, &(0x7f0000000000)={0x6, @local, 0x0, 0x0, 'sh\x00', 0x0, 0x0, 0x35}, 0x2c) setsockopt$IP_VS_SO_SET_ADD(r0, 0x0, 0x483, &(0x7f0000000000)={0x6, @local, 0x0, 0x0, 'sh\x00'}, 0x2c) r4 = syz_open_dev$radio(&(0x7f0000000080), 0x3, 0x2) ioctl$VIDIOC_SUBDEV_G_FMT(r4, 0xc0585604, &(0x7f00000000c0)={0x1, 0x0, {0x7ff, 0xf, 0x200e, 0xb, 0x2, 0x4, 0x0, 0x5}}) executing program 1: r0 = syz_genetlink_get_family_id$ethtool(&(0x7f00000003c0), 0xffffffffffffffff) openat$nullb(0xffffffffffffff9c, &(0x7f0000000440), 0x1c1482, 0x0) r1 = openat$nullb(0xffffffffffffff9c, &(0x7f0000000040), 0x1, 0x0) ioctl$BLKZEROOUT(r1, 0x127f, &(0x7f0000000240)={0x0, 0x1000000}) sendmsg$ETHTOOL_MSG_STRSET_GET(0xffffffffffffffff, &(0x7f0000000540)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000040)=ANY=[@ANYBLOB="18000000", @ANYRES16=r0, @ANYBLOB="09030000000000fdff072000adce04000280"], 0x18}, 0x1, 0xf000000}, 0x0) openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000400)='cgroup.controllers\x00', 0x275a, 0x0) r2 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000200)='memory.swap.current\x00', 0x275a, 0x0) fchdir(0xffffffffffffffff) r3 = syz_genetlink_get_family_id$mptcp(&(0x7f0000000700), r2) sendmsg$MPTCP_PM_CMD_DEL_ADDR(0xffffffffffffffff, &(0x7f00000007c0)={&(0x7f00000006c0)={0x10, 0x0, 0x0, 0x40000}, 0xc, &(0x7f0000000780)={&(0x7f0000000480)=ANY=[@ANYBLOB="0300"/11, @ANYRES16=r3, @ANYBLOB="000129bd7000fcdbdf2502000000080004000800000008000200030000000800030004000000"], 0x2c}, 0x1, 0x0, 0x0, 0x40000}, 0x40) write$binfmt_script(r2, &(0x7f0000000000), 0x208e24b) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x2, 0x28011, r2, 0x0) preadv(r2, &(0x7f00000015c0)=[{&(0x7f0000000080)=""/124, 0xffffffff000}], 0x5, 0x0, 0x0) socket$nl_generic(0x10, 0x3, 0x10) r4 = socket$netlink(0x10, 0x3, 0x0) socket(0x10, 0x803, 0x0) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000240)={0x0}}, 0x0) getsockname$packet(0xffffffffffffffff, &(0x7f00000002c0)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000300)=0xffffff4e) sendmsg$nl_route(r4, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000980)=ANY=[@ANYBLOB="3c0000001800100000000000000000000a00000000030000000000000c00090008000000", @ANYRES32=r5, @ANYBLOB="14000500fe80000000627b00000000000000000022def77d0b43139408806b55dc7831e10a7dc40125cb228f36b3dda7388ea2912000319ba1a4d8d644ef85366ee397efd254cd6e7fac766c89557368e19de583367076431733d101000000344f9675ec680873ac9cd94fba2c6c6d748e60d1617b02e6adc79a9833becc726f3f106297d91db1a0d7d1231b271bd09c22348ac8ce3265006f0800000000000000f040d52440c67ff5407811d7953c09d170ca829808fcee72018000006bc5fc1eeeb8de9c5b4d89524a48fdf3fec1d61480591debd18b13b1f108c607d4a14c5742f8568ed07a24382a7b6e4423269a5e09bacfd1c821cc6f83678c98574eb5fb2b6877ccc02f34c1521e5b6e8e8165e19d75be8f4ba1e2e39029d40c714b36c109e10f42a8f4b717ad9e4693f54f031d3b0a"], 0x3c}, 0x1, 0x0, 0x0, 0x8010}, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000002040)='./file0\x00', 0x0) mount$tmpfs(0x0, &(0x7f0000000080)='./file0\x00', &(0x7f0000000280), 0x0, &(0x7f00000000c0)=ANY=[@ANYBLOB="6d706f6c3d62696e641a302d4e3a332f4e00"]) r6 = socket$kcm(0x10, 0x2, 0x0) sendmsg$kcm(r6, &(0x7f0000000940)={0x0, 0x0, &(0x7f0000000180)=[{}], 0x1}, 0x0) r7 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000000c0)='cgroup.controllers\x00', 0x275a, 0x0) io_setup(0x7, &(0x7f0000000100)=0x0) socket$inet6(0xa, 0x1, 0x9) io_submit(r8, 0x1, &(0x7f0000000380)=[&(0x7f0000000340)={0x0, 0x0, 0x0, 0x7, 0x2, r4, &(0x7f00000001c0)="4066462d53860daab083a0de4f4c44ad7a3f1ea42c80e16e98f51316944121c5a1e0c4e8c616", 0x26, 0xf, 0x0, 0x2}]) write$binfmt_script(r7, &(0x7f0000000500)={'#! ', '', [{0x20, 'memory.swap.current\x00'}]}, 0x19) socket$nl_rdma(0x10, 0x3, 0x14) sendmsg$RDMA_NLDEV_CMD_NEWLINK(r4, &(0x7f00000000c0)={0x0, 0x4c, &(0x7f0000000080)={&(0x7f00000004c0)={0x38, 0x1403, 0x1, 0x70bd2a, 0x25dfdbfb, "", [{{0x9, 0x2, 'syz1\x00'}, {0x8, 0x41, 'siw\x00'}, {0x14, 0x33, 'netdevsim0\x00'}}]}, 0x38}, 0x1, 0x0, 0x0, 0x8800}, 0x20000044) executing program 3: socket$inet_mptcp(0x2, 0x1, 0x106) socket$nl_generic(0x10, 0x3, 0x10) socket$inet_udp(0x2, 0x2, 0x0) socket$nl_generic(0x10, 0x3, 0x10) syz_init_net_socket$ax25(0x3, 0x5, 0x0) socket$alg(0x26, 0x5, 0x0) r0 = socket$packet(0x11, 0x3, 0x300) syz_open_dev$vim2m(&(0x7f0000000000), 0x0, 0x2) r1 = socket$vsock_stream(0x28, 0x1, 0x0) setsockopt$SO_VM_SOCKETS_CONNECT_TIMEOUT_OLD(r1, 0x28, 0x6, &(0x7f00000000c0)={0x0, 0xea60}, 0x10) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000200)={0x9, 0x4, &(0x7f0000000000)=ANY=[@ANYBLOB="18000000000000000000000000000000611948000000000095"], &(0x7f0000000080)='GPL\x00', 0x5, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0x0, @void, @value}, 0x94) socket$packet(0x11, 0x3, 0x300) socket$nl_route(0x10, 0x3, 0x0) socket$nl_route(0x10, 0x3, 0x0) socket(0x1, 0x803, 0x0) pipe(&(0x7f0000000100)) r2 = syz_open_procfs(0x0, &(0x7f00000021c0)='net/fib_triestat\x00') add_key(&(0x7f0000002100)='.dead\x00', 0x0, &(0x7f00000003c0)="4e09237282d50692dd8177cd88ec84d5b65831daeb3ab2428fe6e301f5364e9e808c904cfe56c7897e8da5bd029e86304fc396b7b7541a2b7135c4c5fe58c8bb82e9b45cd1d2853c1c22568f3f9f44b85f4e05a4589c4f71688840bad10e7e62f42fad010cee932737c512b7fbc476bafeb5cb4e9f8a01a8ca025fa4bd5ac67323c02adb999b1c37747866fe7465751a913e9a419c36b2120cc6efbf46e791760d06b3e029fd5bb96649610d2819fd10ababef8512852d12", 0xb8, 0xfffffffffffffffe) read$FUSE(r2, &(0x7f0000004480)={0x2020}, 0x2020) getsockname$packet(r0, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f00000002c0)=0x14) r3 = socket$inet6_icmp_raw(0xa, 0x3, 0x3a) ioctl$ifreq_SIOCGIFINDEX_wireguard(r3, 0x8933, &(0x7f0000000180)={'wg2\x00'}) ioctl$sock_SIOCGIFINDEX(r3, 0x8933, &(0x7f0000000240)={'dummy0\x00'}) r4 = socket$netlink(0x10, 0x3, 0x0) setsockopt$netlink_NETLINK_BROADCAST_ERROR(r4, 0x10e, 0x4, &(0x7f0000000f40)=0xe498, 0x4) r5 = socket(0x10, 0x803, 0x0) syz_genetlink_get_family_id$tipc2(&(0x7f0000000580), r5) getsockopt$IP_VS_SO_GET_SERVICES(r4, 0x0, 0x482, &(0x7f00000002c0)=""/140, &(0x7f0000000140)=0x8c) getsockname$packet(r5, &(0x7f0000000380)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) sendmsg$nl_route(r4, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000001140)={&(0x7f0000000040)=@newlink={0x20, 0x10, 0x503, 0x70bd2b, 0x29d24, {0x0, 0x0, 0x0, 0x0, 0x14415, 0x48041}}, 0x20}}, 0x4050) executing program 2: r0 = creat(&(0x7f00000002c0)='./file0\x00', 0x0) r1 = open$dir(&(0x7f0000000080)='./file0\x00', 0x0, 0x0) ioctl$TIOCL_GETSHIFTSTATE(r0, 0x541c, &(0x7f0000000300)={0x6, 0xf9}) mmap$xdp(&(0x7f0000ffc000/0x4000)=nil, 0x4000, 0x0, 0x12, r1, 0x0) add_key(&(0x7f0000000040)='dns_resolver\x00', &(0x7f0000000400)={'syz', 0x3}, &(0x7f0000000080)="000001020200", 0x6, 0xfffffffffffffffb) r2 = bpf$PROG_LOAD(0x5, &(0x7f0000000040)={0x2, 0x4, &(0x7f0000000200)=ANY=[@ANYBLOB="180000000300000000000000feffff10850000000700000095"], &(0x7f0000000000)='GPL\x00', 0x0, 0x0, 0x0, 0x100, 0x70, '\x00', 0x0, @fallback=0x30, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @void, @value}, 0x94) r3 = accept4$inet6(r0, &(0x7f0000000100)={0xa, 0x0, 0x0, @loopback}, &(0x7f0000000240)=0x1c, 0x800) r4 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000100), 0x0, 0x0) ioctl$TIOCSETD(r4, 0x5423, &(0x7f00000000c0)=0xf) ioctl$TCFLSH(r4, 0x400455c8, 0x0) r5 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) r6 = bpf$ITER_CREATE(0xb, &(0x7f0000000100), 0x8) bind$bt_hci(r5, &(0x7f0000000000)={0x1f, 0xffff, 0x3}, 0x6) setsockopt$packet_fanout_data(r6, 0x107, 0x16, &(0x7f0000000100)={0x3c, &(0x7f0000000180)=[{0x0, 0x80}, {0x1, 0x1}]}, 0x10) write$binfmt_misc(r5, &(0x7f0000000100), 0x6) ioctl$sock_inet_SIOCSIFFLAGS(r3, 0x8914, &(0x7f0000000280)={'pim6reg1\x00', 0x2}) kexec_load(0x10001, 0x7, &(0x7f0000000d00)=[{&(0x7f0000000880)="37fb79c14b452fe422d277f3feab89bd5416dfcf3bf47545e5ab096dcb018ccf5e7834151fe735f3c37c51b7a72535bc3d1eacead7abed2865da31aa63967c330aedc3705baa61a5607cd0a3a2070d37edfceeb570c4f4a4779225903bdcdbe4dd42df2455794ccc41f4f35f7dad393d2e51029b4d4bb0121453837f0c8d7f83382871fb357ccea66bf27d0105b51f7fa7efff0e8c858dd71b23ffa2276f6066701df8d656ef5e7a6668eaf28a714efaf6abc7f50e1d41f8d18212b678c2f51952f9b14cd732d94abd44ee9c6c3e70cf5e8092eefed3562b38b60acf756feb66dc1e85179ea011d05e29ff33", 0xec, 0x3, 0x1}, {&(0x7f0000000980)="48f8c31e4b57576b253e8835a21c3715777121e4dc6de0b9fafa8105e0c0df84680beb46d29d31f8ddbfe7b650c091ab6cca47192b1c695ce7b539954ebbdad07798399cb6d201b26b806df11ce19cbc0520448b0546ae61a7d3c41d94f4b8479e568ce09b2473975832593dbb2a8fc24ce235fee4f907116cb4aae39c7273cfc3250d6de2cdf5dff4eb4a1763747daccc20cb58a91676a9d65828edef6e4dca63d8c2893a333a4db2c3f68b47774b3d389b3875eaf38f6ce0294b0ca716e2241b6c", 0xc2, 0x200, 0xd}, {&(0x7f0000000a80)="d31588bf1cc6434b3a9c34146e87304d2812f1adc1fce1ada8825cb60b0f401ce94eb0bf9d06f365fc41797047fb1a1511704466190641d88412d4bfaf56b5e2f262551b745377985bae27ccbcfbf9e8dc8ee84d8cb0867f9caddd604bf6120303f320552e5f42a2afce6451e1185180fc94db6a6568c12c50c712b22770a36eb53c48ee784828ab7e25f7c78e7516f3de43a55dc0ed9a98a24c8568da239d6971cd80de47ae31eb6e122978b09fd5a7f8eca3c9e686d76fe4e9bf0283a866924077c4140803b11d", 0xc8, 0x100, 0x401}, {&(0x7f0000000340)="b4c41b984999d0f22ae0a8652c4241723bafb2abfc0c6cefb4cac1c9b1c6ce734a220870622163ae660f6002c28843f998226a50ce5a7c25b51b5795954c9b4a7c74ac986a913d2e9c40a614f763e17b899da790e83c98e75b3fe9f0d72ffd6c6383f518cf60a676817dfc62cfd8670038834c08e3dcf04e86640519cedd6a6cc9920dfbfeff9645b72dcb2a548cfd7fe4002f9cdc33a1214ab90dc395c41ac61fc135e503f1f2e9afaa", 0xaa, 0xcf08, 0x2}, {&(0x7f0000000b80)="32d4889f45e46d6733b3c814ffa3ec8714c220123e79e89519a82c46485e8ca855b7a01d10408bf0d22463ea0a5b0b9fef1117c033426d8ca87a387bdc541ffecbdc2e9716bb6f318a04b3168cca67c5563258bc6aa13a7d78e1b08d01e06e48b7c0448aa0d999a594ec6dd68cceb9d2eac9a5c2b8d73b28f405a5e3d5f027d4747d42d0b76837e4e33acdc54b074946817301ac0cf672a2a4619b07", 0x9c, 0xfffffffffffffff9, 0x7}, {&(0x7f0000000c40)="8028ef083379d18393b5d3e4669cdd95af8f9c2eb285c1e224c2d76b8a423968ee045ad4f67eb8229cedc4359421b5a666c62169862fe46eca1e78ec506eaa", 0x3f, 0x1, 0x1}, {&(0x7f0000000c80)="cd609bb880c2613aa52cfe0c08fa20ef63e04e48074357f528334250ccabfe87effcf3bd7dc9155a80850ff98cc915fc10adc3c4f98443f708783c5b618f9b750ccf7d53e23bbe377644025cdb0733cb7c7c28f56fbe53bb2d60eb80c2d43b14caa6df3e66ed5782cc", 0x69, 0x3, 0x9}], 0x150000) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) madvise(&(0x7f0000a93000/0x4000)=nil, 0x4000, 0xe) mremap(&(0x7f0000a96000/0x1000)=nil, 0x1000, 0x800000, 0x3, &(0x7f0000130000/0x800000)=nil) r7 = gettid() process_vm_writev(r7, &(0x7f0000000000)=[{&(0x7f00008f9f09)=""/247, 0xf7}], 0x3cb, &(0x7f0000121000)=[{&(0x7f0000217f28)=""/231, 0xffffff4e}], 0x23a, 0x0) r8 = openat$full(0xffffffffffffff9c, &(0x7f0000000e00), 0x2000, 0x0) syz_kvm_setup_cpu$x86(r6, r8, &(0x7f0000292000/0x18000)=nil, &(0x7f0000000ec0)=[@text16={0x10, &(0x7f0000000e40)="66b80500000066b9003000000f01d926f30fa6d066b8010000000f01d9640fc73cf081954400008088b2ecc42e676664260f2002670f994bf20f22d4ba4200b80000ef", 0x43}], 0x1, 0x20, &(0x7f0000000f00)=[@flags={0x3, 0x1800}, @cr4={0x1, 0x220}], 0x2) r9 = creat(&(0x7f00000001c0)='./file0\x00', 0x0) write$uinput_user_dev(r9, &(0x7f0000000400)={'syz0\x00', {0x7, 0x6, 0x6, 0xfffa}, 0x1d, [0x200006, 0xc95a, 0xfffffff3, 0x9, 0x80, 0x2, 0x1, 0x7f, 0x6, 0x4d, 0xfffffff2, 0x5f, 0xa, 0x0, 0xffff2d37, 0x1dd2, 0x6, 0x7, 0x0, 0x80000001, 0x4, 0x7, 0x3, 0x3c57, 0x1, 0x24, 0xffffffff, 0x1, 0x1f461e2c, 0x2, 0xe661, 0x8, 0x7, 0x3, 0x7fff, 0x4c72, 0x8f00, 0x642, 0x3, 0xa, 0x0, 0x71, 0x7, 0x7, 0x103, 0x0, 0x5, 0xba1, 0x8f, 0x6, 0x6, 0x3, 0x5, 0x4, 0x8, 0x0, 0x80, 0x0, 0x5, 0x6, 0x8, 0x4, 0x5, 0x40], [0x10000007, 0xffff, 0x12f, 0x8000, 0x10, 0xfffffff3, 0x129432e6, 0xcb, 0xf9, 0xd, 0x2bf, 0x8, 0x9, 0xfffffffc, 0x3, 0x80000, 0x7, 0x0, 0x2f, 0xb, 0x312, 0x78, 0xea4, 0xa, 0x4, 0x7fffffff, 0xffffffd0, 0x9, 0x400, 0x1, 0x6, 0x1, 0xff, 0x1005, 0x7ff, 0x5f31, 0x4, 0x0, 0x6, 0x2, 0x9, 0x4, 0x9, 0x8, 0xb, 0x6, 0x5, 0x0, 0x1, 0x8000, 0xffff, 0x2, 0x77, 0x9, 0x5, 0x3, 0x4, 0x1, 0x7, 0x6, 0x9, 0x48c93690, 0x2, 0xff], [0x7, 0x4, 0x0, 0x64e, 0xfffffdfe, 0x7fffffff, 0x8d2, 0x49, 0x5, 0x7fff, 0x0, 0x5, 0xb, 0x4, 0x5, 0x5, 0x0, 0x16f, 0x5, 0x8, 0x86, 0x3, 0x0, 0x3e7, 0x2, 0x5, 0x2, 0x2, 0xf, 0x8, 0x4, 0x6d01, 0x5, 0x3b, 0x3, 0x200, 0x80, 0x3, 0x4, 0x2950bfaf, 0x0, 0xa2, 0x7, 0x53cf697b, 0x5, 0x6, 0x54fe12d2, 0xbf, 0x100b, 0x3, 0x400000, 0xfffffff9, 0x0, 0x1, 0x5, 0x0, 0x6, 0x0, 0x120000, 0x3, 0x6, 0x2, 0x4, 0x3], [0x9, 0xbb31, 0x3, 0xb, 0x5, 0x938, 0x6, 0x6, 0x0, 0x5, 0xce7, 0x1ff, 0x6, 0x7, 0x5, 0x3, 0x101, 0x10000, 0x6, 0x7fff, 0xffff, 0xa620, 0x2, 0x5, 0x1, 0x2, 0x14c, 0x60a7, 0x6, 0x6, 0xffffffff, 0x9, 0x5, 0x8, 0xc8, 0x3, 0x3, 0xffff, 0x3, 0x9, 0x100, 0x9605, 0xa, 0x2, 0x4, 0x6, 0x1, 0x10000, 0x5, 0x8, 0x2b91, 0xa1f, 0x8, 0x9, 0x1, 0x6c1b, 0x0, 0x4, 0x5, 0xb1c, 0x1, 0x200, 0xffff3441, 0xfff]}, 0x45c) r10 = openat$drirender128(0xffffffffffffff9c, &(0x7f0000000f40), 0x301001, 0x0) ioctl$DRM_IOCTL_GEM_OPEN(r9, 0xc010640b, &(0x7f0000000f80)={0x0, 0x0}) ioctl$DRM_IOCTL_GEM_FLINK(r10, 0xc008640a, &(0x7f0000000fc0)={r11}) bpf$BPF_LINK_CREATE_XDP(0x1c, &(0x7f00000012c0)={r2, 0x0, 0x30, 0xe1515f8735398fb, @val=@uprobe_multi={&(0x7f0000000140)='./file0\x00', &(0x7f0000000180)=[0x400], 0x0, 0x0, 0x1, 0x1}}, 0x40) program crashed: KASAN: slab-use-after-free Read in netdev_unregister_kobject bisect: the chunk can be dropped bisect: testing without sub-chunk 2/3 testing program (duration=32s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): [30, 24, 15, 4, 11, 30, 30, 30] detailed listing: executing program 2: r0 = syz_open_dev$dri(&(0x7f0000000080), 0x1, 0x0) r1 = openat(0xffffffffffffff9c, &(0x7f0000000040)='./cgroup/pids.max\x00', 0x2, 0x0) write$cgroup_pid(r1, &(0x7f00000000c0), 0x12) r2 = socket$kcm(0x11, 0x2, 0x300) r3 = socket$alg(0x26, 0x5, 0x0) bind$alg(r3, &(0x7f0000000000)={0x26, 'hash\x00', 0x0, 0x0, 'sha1-avx\x00'}, 0x58) r4 = accept4(r3, 0x0, 0x0, 0x0) recvmsg$unix(r4, &(0x7f0000000400)={0x0, 0x0, 0x0, 0x0, &(0x7f00000003c0)=[@rights={{0x14, 0x1, 0x1, [0xffffffffffffffff]}}], 0x18}, 0x0) setsockopt$sock_attach_bpf(r2, 0x107, 0x12, &(0x7f00000008c0)=r5, 0x4) r6 = bpf$OBJ_GET_MAP(0x7, &(0x7f00000003c0)=@o_path={&(0x7f0000000380)='./file0\x00', 0x0, 0x4000, r0}, 0x18) r7 = bpf$MAP_CREATE(0x0, &(0x7f0000001440)=@base={0xf, 0xa, 0xa, 0x1, 0x800, 0x1, 0xff, '\x00', 0x0, 0xffffffffffffffff, 0x1, 0x2, 0x4, 0x0, @void, @value, @void, @value}, 0x50) r8 = bpf$MAP_CREATE_RINGBUF(0x0, &(0x7f00000014c0)={0x1b, 0x0, 0x0, 0x9, 0x0, 0x1, 0x0, '\x00', 0x0, 0xffffffffffffffff, 0x0, 0x4, 0x5, 0x0, @void, @value, @void, @value}, 0x50) r9 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000300), 0x0, 0x0) r10 = ioctl$KVM_CREATE_VM(r9, 0xae01, 0x0) r11 = ioctl$KVM_CREATE_VCPU(r10, 0xae41, 0x0) r12 = dup(r11) ioctl$KVM_SET_MSRS(r12, 0x4048aecb, &(0x7f00000000c0)=ANY=[@ANYRES64=r9, @ANYRES64]) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000001600)={0x11, 0x10, &(0x7f00000002c0)=@framed={{0x18, 0x0, 0x0, 0x0, 0x2, 0x0, 0x0, 0x0, 0x3}, [@snprintf={{}, {}, {0x7, 0x0, 0xb, 0x8, 0x0, 0x0, 0x7}}]}, &(0x7f0000000140)='GPL\x00', 0x5, 0x1000, &(0x7f0000000440)=""/4096, 0x40f00, 0xa, '\x00', 0x0, 0x0, r1, 0x8, 0x0, 0x0, 0x10, &(0x7f0000000340)={0x5, 0x0, 0x3, 0x3}, 0x10, 0x0, 0x0, 0x8, &(0x7f0000001540)=[r5, r6, r7, r8, r12], &(0x7f0000001580)=[{0x4, 0x5, 0x6, 0x5}, {0x3, 0x3, 0xc, 0x5}, {0x0, 0x2, 0x8, 0x7}, {0x0, 0x5, 0xa, 0x5}, {0x1, 0xb, 0x2, 0xb}, {0x2, 0x4, 0x0, 0x7}, {0x5, 0x4, 0x6, 0x2}, {0x4, 0x5, 0xb, 0x1}], 0x10, 0x40, @void, @value}, 0x94) ioctl$DRM_IOCTL_SET_CLIENT_CAP(r0, 0x4010640d, &(0x7f0000000000)={0x3, 0x2}) r13 = socket$nl_route(0x10, 0x3, 0x0) socket$nl_netfilter(0x10, 0x3, 0xc) io_setup(0x7ff, 0x0) r14 = socket$inet6(0xa, 0x2, 0x0) r15 = dup(r14) mknod$loop(&(0x7f0000000100)='./file0\x00', 0x40, 0x1) r16 = socket$netlink(0x10, 0x3, 0xa) sendmsg$nl_route(r16, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000400)={&(0x7f0000000080)=@bridge_delneigh={0x1c, 0x1d, 0x1, 0x0, 0x0, {0x7}}, 0x1c}}, 0x0) bind$unix(r15, &(0x7f00000001c0)=@abs={0x1, 0x0, 0x4e22}, 0x6e) sendmsg$IPSET_CMD_SWAP(r15, &(0x7f0000000280)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000040)=ANY=[@ANYRESOCT=r13], 0x34}, 0x1, 0x0, 0x0, 0x240040c4}, 0x4000004) ioctl$DRM_IOCTL_MODE_ATOMIC(r0, 0xc03864bc, &(0x7f0000000180)={0x1, 0x0, 0x0, 0x0, 0x0, 0x0}) executing program 1: r0 = syz_open_dev$radio(&(0x7f0000000000), 0x3, 0x2) ioctl$VIDIOC_S_EXT_CTRLS(r0, 0xc0205648, &(0x7f0000000100)={0x9b0000, 0x1, 0x0, 0xffffffffffffffff, 0x0, &(0x7f0000000180)={0x9b090b, 0x0, '\x00', @value=0xa}}) ioctl$EVIOCGBITSW(0xffffffffffffffff, 0x80404525, &(0x7f0000000000)=""/52) preadv(0xffffffffffffffff, &(0x7f0000000080), 0x0, 0x0, 0x0) r1 = socket$inet6_tcp(0xa, 0x1, 0x0) r2 = socket$nl_generic(0x10, 0x3, 0x10) ioctl$sock_SIOCGIFVLAN_GET_VLAN_VID_CMD(r2, 0x8982, &(0x7f0000000080)) r3 = syz_genetlink_get_family_id$ethtool(&(0x7f00000007c0), 0xffffffffffffffff) sendmsg$ETHTOOL_MSG_CHANNELS_SET(r2, &(0x7f0000000ec0)={0x0, 0x0, &(0x7f0000000e80)={&(0x7f00000001c0)=ANY=[@ANYBLOB="3c000000fce274a3b11e32bfd81ab3df83e7af8f885c760322f66a9358a955aaa727876377476222215de720", @ANYRES16=r3, @ANYBLOB="01000010000000000000120000000800090000000000080007000400000018000180140002006261746164765f736c6176655f310000"], 0x3c}, 0x1, 0x0, 0x0, 0x44001}, 0x0) setsockopt$sock_int(r1, 0x1, 0x14, &(0x7f0000000040)=0x9, 0x4) listen(r1, 0x6) accept$inet6(r1, 0x0, 0x0) syz_open_dev$radio(&(0x7f0000000000), 0x3, 0x2) (async) ioctl$VIDIOC_S_EXT_CTRLS(r0, 0xc0205648, &(0x7f0000000100)={0x9b0000, 0x1, 0x0, 0xffffffffffffffff, 0x0, &(0x7f0000000180)={0x9b090b, 0x0, '\x00', @value=0xa}}) (async) ioctl$EVIOCGBITSW(0xffffffffffffffff, 0x80404525, &(0x7f0000000000)=""/52) (async) preadv(0xffffffffffffffff, &(0x7f0000000080), 0x0, 0x0, 0x0) (async) socket$inet6_tcp(0xa, 0x1, 0x0) (async) socket$nl_generic(0x10, 0x3, 0x10) (async) ioctl$sock_SIOCGIFVLAN_GET_VLAN_VID_CMD(r2, 0x8982, &(0x7f0000000080)) (async) syz_genetlink_get_family_id$ethtool(&(0x7f00000007c0), 0xffffffffffffffff) (async) sendmsg$ETHTOOL_MSG_CHANNELS_SET(r2, &(0x7f0000000ec0)={0x0, 0x0, &(0x7f0000000e80)={&(0x7f00000001c0)=ANY=[@ANYBLOB="3c000000fce274a3b11e32bfd81ab3df83e7af8f885c760322f66a9358a955aaa727876377476222215de720", @ANYRES16=r3, @ANYBLOB="01000010000000000000120000000800090000000000080007000400000018000180140002006261746164765f736c6176655f310000"], 0x3c}, 0x1, 0x0, 0x0, 0x44001}, 0x0) (async) setsockopt$sock_int(r1, 0x1, 0x14, &(0x7f0000000040)=0x9, 0x4) (async) listen(r1, 0x6) (async) accept$inet6(r1, 0x0, 0x0) (async) executing program 0: r0 = io_uring_setup(0x1065, &(0x7f0000001240)={0x0, 0x10, 0x800, 0x1}) r1 = openat$snapshot(0xffffffffffffff9c, &(0x7f0000000000), 0x481, 0x0) (async) openat$uinput(0xffffffffffffff9c, &(0x7f0000000000), 0x2, 0x0) (async) openat$kvm(0xffffffffffffff9c, &(0x7f0000000140), 0x0, 0x0) (async) r2 = syz_open_procfs(0x0, &(0x7f0000000600)='fd/4\x00') lseek(r2, 0x600, 0x4) (async) r3 = openat$cdrom(0xffffffffffffff9c, &(0x7f00000011c0), 0x2000, 0x0) capset(&(0x7f0000000080)={0x19980330}, &(0x7f0000000040)={0x200000, 0x200002}) (async) fanotify_init(0x20, 0x400) (async) ioctl$CDROM_SEND_PACKET(r3, 0x5393, &(0x7f0000001300)={"cdb755b1e57be73fc299a365", 0x0, 0x0, 0x5, 0x0, 0x0, 0x1, 0x1, 0x0}) r4 = socket(0x10, 0x803, 0x2) r5 = syz_genetlink_get_family_id$mptcp(&(0x7f00000000c0), r4) (async) getsockname$packet(r4, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f00000003c0)=0x14) syz_usb_connect$hid(0x0, 0x36, &(0x7f0000000140)=ANY=[@ANYBLOB="02bf91121a7d55fbb5c4ad52e805867ec7d1b3db3bd511fe6ef830b610bd2e696ee57d43797629e81fc6cd77ee526d1956c46658c3159fef57", @ANYRESDEC=r0, @ANYRESHEX=r1, @ANYRESDEC=r4, @ANYRESHEX=r5, @ANYRES16=r5, @ANYRESOCT=r6, @ANYRESHEX=r1], 0x0) close_range(r0, 0xffffffffffffffff, 0x0) executing program 1: r0 = openat(0xffffffffffffff9c, &(0x7f0000000080)='./file0\x00', 0x181942, 0x0) ioctl$FS_IOC_SETFLAGS(r0, 0x40086602, &(0x7f0000000040)=0x20) syz_open_procfs(0x0, &(0x7f0000000000)='fd/3\x00') ioctl$SNDRV_PCM_IOCTL_LINK(r0, 0x40044160, &(0x7f00000000c0)=0xa1) executing program 3: r0 = socket$inet_smc(0x2b, 0x1, 0x0) r1 = syz_init_net_socket$bt_l2cap(0x1f, 0x2, 0x0) bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x11, 0x3, &(0x7f0000000640)=ANY=[@ANYBLOB="180000000031288e8e"], &(0x7f0000000200)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @void, @value}, 0x90) connect$bt_l2cap(r1, &(0x7f0000000040)={0x1f, 0x0, @fixed={'\xaa\xaa\xaa\xaa\xaa', 0x10}, 0x7ff}, 0xe) r2 = openat$kvm(0xffffffffffffff9c, 0x0, 0x0, 0x0) r3 = syz_init_net_socket$bt_bnep(0x1f, 0x3, 0x4) ioctl$sock_bt_bnep_BNEPCONNADD(r3, 0x400442c8, &(0x7f0000000000)=ANY=[@ANYRES32=r1, @ANYBLOB='\x00\x00\x00\x00\x00', @ANYRESHEX, @ANYRES32=r2]) setsockopt$IP_VS_SO_SET_ADD(r0, 0x0, 0x482, &(0x7f0000000000)={0x6, @local, 0x0, 0x0, 'sh\x00', 0x0, 0x0, 0x35}, 0x2c) setsockopt$IP_VS_SO_SET_ADD(r0, 0x0, 0x483, &(0x7f0000000000)={0x6, @local, 0x0, 0x0, 'sh\x00'}, 0x2c) r4 = syz_open_dev$radio(&(0x7f0000000080), 0x3, 0x2) ioctl$VIDIOC_SUBDEV_G_FMT(r4, 0xc0585604, &(0x7f00000000c0)={0x1, 0x0, {0x7ff, 0xf, 0x200e, 0xb, 0x2, 0x4, 0x0, 0x5}}) executing program 1: r0 = syz_genetlink_get_family_id$ethtool(&(0x7f00000003c0), 0xffffffffffffffff) openat$nullb(0xffffffffffffff9c, &(0x7f0000000440), 0x1c1482, 0x0) r1 = openat$nullb(0xffffffffffffff9c, &(0x7f0000000040), 0x1, 0x0) ioctl$BLKZEROOUT(r1, 0x127f, &(0x7f0000000240)={0x0, 0x1000000}) sendmsg$ETHTOOL_MSG_STRSET_GET(0xffffffffffffffff, &(0x7f0000000540)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000040)=ANY=[@ANYBLOB="18000000", @ANYRES16=r0, @ANYBLOB="09030000000000fdff072000adce04000280"], 0x18}, 0x1, 0xf000000}, 0x0) openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000400)='cgroup.controllers\x00', 0x275a, 0x0) r2 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000200)='memory.swap.current\x00', 0x275a, 0x0) fchdir(0xffffffffffffffff) r3 = syz_genetlink_get_family_id$mptcp(&(0x7f0000000700), r2) sendmsg$MPTCP_PM_CMD_DEL_ADDR(0xffffffffffffffff, &(0x7f00000007c0)={&(0x7f00000006c0)={0x10, 0x0, 0x0, 0x40000}, 0xc, &(0x7f0000000780)={&(0x7f0000000480)=ANY=[@ANYBLOB="0300"/11, @ANYRES16=r3, @ANYBLOB="000129bd7000fcdbdf2502000000080004000800000008000200030000000800030004000000"], 0x2c}, 0x1, 0x0, 0x0, 0x40000}, 0x40) write$binfmt_script(r2, &(0x7f0000000000), 0x208e24b) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x2, 0x28011, r2, 0x0) preadv(r2, &(0x7f00000015c0)=[{&(0x7f0000000080)=""/124, 0xffffffff000}], 0x5, 0x0, 0x0) socket$nl_generic(0x10, 0x3, 0x10) r4 = socket$netlink(0x10, 0x3, 0x0) socket(0x10, 0x803, 0x0) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000240)={0x0}}, 0x0) getsockname$packet(0xffffffffffffffff, &(0x7f00000002c0)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000300)=0xffffff4e) sendmsg$nl_route(r4, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000980)=ANY=[@ANYBLOB="3c0000001800100000000000000000000a00000000030000000000000c00090008000000", @ANYRES32=r5, @ANYBLOB="14000500fe80000000627b00000000000000000022def77d0b43139408806b55dc7831e10a7dc40125cb228f36b3dda7388ea2912000319ba1a4d8d644ef85366ee397efd254cd6e7fac766c89557368e19de583367076431733d101000000344f9675ec680873ac9cd94fba2c6c6d748e60d1617b02e6adc79a9833becc726f3f106297d91db1a0d7d1231b271bd09c22348ac8ce3265006f0800000000000000f040d52440c67ff5407811d7953c09d170ca829808fcee72018000006bc5fc1eeeb8de9c5b4d89524a48fdf3fec1d61480591debd18b13b1f108c607d4a14c5742f8568ed07a24382a7b6e4423269a5e09bacfd1c821cc6f83678c98574eb5fb2b6877ccc02f34c1521e5b6e8e8165e19d75be8f4ba1e2e39029d40c714b36c109e10f42a8f4b717ad9e4693f54f031d3b0a"], 0x3c}, 0x1, 0x0, 0x0, 0x8010}, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000002040)='./file0\x00', 0x0) mount$tmpfs(0x0, &(0x7f0000000080)='./file0\x00', &(0x7f0000000280), 0x0, &(0x7f00000000c0)=ANY=[@ANYBLOB="6d706f6c3d62696e641a302d4e3a332f4e00"]) r6 = socket$kcm(0x10, 0x2, 0x0) sendmsg$kcm(r6, &(0x7f0000000940)={0x0, 0x0, &(0x7f0000000180)=[{}], 0x1}, 0x0) r7 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000000c0)='cgroup.controllers\x00', 0x275a, 0x0) io_setup(0x7, &(0x7f0000000100)=0x0) socket$inet6(0xa, 0x1, 0x9) io_submit(r8, 0x1, &(0x7f0000000380)=[&(0x7f0000000340)={0x0, 0x0, 0x0, 0x7, 0x2, r4, &(0x7f00000001c0)="4066462d53860daab083a0de4f4c44ad7a3f1ea42c80e16e98f51316944121c5a1e0c4e8c616", 0x26, 0xf, 0x0, 0x2}]) write$binfmt_script(r7, &(0x7f0000000500)={'#! ', '', [{0x20, 'memory.swap.current\x00'}]}, 0x19) socket$nl_rdma(0x10, 0x3, 0x14) sendmsg$RDMA_NLDEV_CMD_NEWLINK(r4, &(0x7f00000000c0)={0x0, 0x4c, &(0x7f0000000080)={&(0x7f00000004c0)={0x38, 0x1403, 0x1, 0x70bd2a, 0x25dfdbfb, "", [{{0x9, 0x2, 'syz1\x00'}, {0x8, 0x41, 'siw\x00'}, {0x14, 0x33, 'netdevsim0\x00'}}]}, 0x38}, 0x1, 0x0, 0x0, 0x8800}, 0x20000044) executing program 3: socket$inet_mptcp(0x2, 0x1, 0x106) socket$nl_generic(0x10, 0x3, 0x10) socket$inet_udp(0x2, 0x2, 0x0) socket$nl_generic(0x10, 0x3, 0x10) syz_init_net_socket$ax25(0x3, 0x5, 0x0) socket$alg(0x26, 0x5, 0x0) r0 = socket$packet(0x11, 0x3, 0x300) syz_open_dev$vim2m(&(0x7f0000000000), 0x0, 0x2) r1 = socket$vsock_stream(0x28, 0x1, 0x0) setsockopt$SO_VM_SOCKETS_CONNECT_TIMEOUT_OLD(r1, 0x28, 0x6, &(0x7f00000000c0)={0x0, 0xea60}, 0x10) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000200)={0x9, 0x4, &(0x7f0000000000)=ANY=[@ANYBLOB="18000000000000000000000000000000611948000000000095"], &(0x7f0000000080)='GPL\x00', 0x5, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0x0, @void, @value}, 0x94) socket$packet(0x11, 0x3, 0x300) socket$nl_route(0x10, 0x3, 0x0) socket$nl_route(0x10, 0x3, 0x0) socket(0x1, 0x803, 0x0) pipe(&(0x7f0000000100)) r2 = syz_open_procfs(0x0, &(0x7f00000021c0)='net/fib_triestat\x00') add_key(&(0x7f0000002100)='.dead\x00', 0x0, &(0x7f00000003c0)="4e09237282d50692dd8177cd88ec84d5b65831daeb3ab2428fe6e301f5364e9e808c904cfe56c7897e8da5bd029e86304fc396b7b7541a2b7135c4c5fe58c8bb82e9b45cd1d2853c1c22568f3f9f44b85f4e05a4589c4f71688840bad10e7e62f42fad010cee932737c512b7fbc476bafeb5cb4e9f8a01a8ca025fa4bd5ac67323c02adb999b1c37747866fe7465751a913e9a419c36b2120cc6efbf46e791760d06b3e029fd5bb96649610d2819fd10ababef8512852d12", 0xb8, 0xfffffffffffffffe) read$FUSE(r2, &(0x7f0000004480)={0x2020}, 0x2020) getsockname$packet(r0, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f00000002c0)=0x14) r3 = socket$inet6_icmp_raw(0xa, 0x3, 0x3a) ioctl$ifreq_SIOCGIFINDEX_wireguard(r3, 0x8933, &(0x7f0000000180)={'wg2\x00'}) ioctl$sock_SIOCGIFINDEX(r3, 0x8933, &(0x7f0000000240)={'dummy0\x00'}) r4 = socket$netlink(0x10, 0x3, 0x0) setsockopt$netlink_NETLINK_BROADCAST_ERROR(r4, 0x10e, 0x4, &(0x7f0000000f40)=0xe498, 0x4) r5 = socket(0x10, 0x803, 0x0) syz_genetlink_get_family_id$tipc2(&(0x7f0000000580), r5) getsockopt$IP_VS_SO_GET_SERVICES(r4, 0x0, 0x482, &(0x7f00000002c0)=""/140, &(0x7f0000000140)=0x8c) getsockname$packet(r5, &(0x7f0000000380)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) sendmsg$nl_route(r4, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000001140)={&(0x7f0000000040)=@newlink={0x20, 0x10, 0x503, 0x70bd2b, 0x29d24, {0x0, 0x0, 0x0, 0x0, 0x14415, 0x48041}}, 0x20}}, 0x4050) executing program 2: r0 = creat(&(0x7f00000002c0)='./file0\x00', 0x0) r1 = open$dir(&(0x7f0000000080)='./file0\x00', 0x0, 0x0) ioctl$TIOCL_GETSHIFTSTATE(r0, 0x541c, &(0x7f0000000300)={0x6, 0xf9}) mmap$xdp(&(0x7f0000ffc000/0x4000)=nil, 0x4000, 0x0, 0x12, r1, 0x0) add_key(&(0x7f0000000040)='dns_resolver\x00', &(0x7f0000000400)={'syz', 0x3}, &(0x7f0000000080)="000001020200", 0x6, 0xfffffffffffffffb) r2 = bpf$PROG_LOAD(0x5, &(0x7f0000000040)={0x2, 0x4, &(0x7f0000000200)=ANY=[@ANYBLOB="180000000300000000000000feffff10850000000700000095"], &(0x7f0000000000)='GPL\x00', 0x0, 0x0, 0x0, 0x100, 0x70, '\x00', 0x0, @fallback=0x30, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @void, @value}, 0x94) r3 = accept4$inet6(r0, &(0x7f0000000100)={0xa, 0x0, 0x0, @loopback}, &(0x7f0000000240)=0x1c, 0x800) r4 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000100), 0x0, 0x0) ioctl$TIOCSETD(r4, 0x5423, &(0x7f00000000c0)=0xf) ioctl$TCFLSH(r4, 0x400455c8, 0x0) r5 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) r6 = bpf$ITER_CREATE(0xb, &(0x7f0000000100), 0x8) bind$bt_hci(r5, &(0x7f0000000000)={0x1f, 0xffff, 0x3}, 0x6) setsockopt$packet_fanout_data(r6, 0x107, 0x16, &(0x7f0000000100)={0x3c, &(0x7f0000000180)=[{0x0, 0x80}, {0x1, 0x1}]}, 0x10) write$binfmt_misc(r5, &(0x7f0000000100), 0x6) ioctl$sock_inet_SIOCSIFFLAGS(r3, 0x8914, &(0x7f0000000280)={'pim6reg1\x00', 0x2}) kexec_load(0x10001, 0x7, &(0x7f0000000d00)=[{&(0x7f0000000880)="37fb79c14b452fe422d277f3feab89bd5416dfcf3bf47545e5ab096dcb018ccf5e7834151fe735f3c37c51b7a72535bc3d1eacead7abed2865da31aa63967c330aedc3705baa61a5607cd0a3a2070d37edfceeb570c4f4a4779225903bdcdbe4dd42df2455794ccc41f4f35f7dad393d2e51029b4d4bb0121453837f0c8d7f83382871fb357ccea66bf27d0105b51f7fa7efff0e8c858dd71b23ffa2276f6066701df8d656ef5e7a6668eaf28a714efaf6abc7f50e1d41f8d18212b678c2f51952f9b14cd732d94abd44ee9c6c3e70cf5e8092eefed3562b38b60acf756feb66dc1e85179ea011d05e29ff33", 0xec, 0x3, 0x1}, {&(0x7f0000000980)="48f8c31e4b57576b253e8835a21c3715777121e4dc6de0b9fafa8105e0c0df84680beb46d29d31f8ddbfe7b650c091ab6cca47192b1c695ce7b539954ebbdad07798399cb6d201b26b806df11ce19cbc0520448b0546ae61a7d3c41d94f4b8479e568ce09b2473975832593dbb2a8fc24ce235fee4f907116cb4aae39c7273cfc3250d6de2cdf5dff4eb4a1763747daccc20cb58a91676a9d65828edef6e4dca63d8c2893a333a4db2c3f68b47774b3d389b3875eaf38f6ce0294b0ca716e2241b6c", 0xc2, 0x200, 0xd}, {&(0x7f0000000a80)="d31588bf1cc6434b3a9c34146e87304d2812f1adc1fce1ada8825cb60b0f401ce94eb0bf9d06f365fc41797047fb1a1511704466190641d88412d4bfaf56b5e2f262551b745377985bae27ccbcfbf9e8dc8ee84d8cb0867f9caddd604bf6120303f320552e5f42a2afce6451e1185180fc94db6a6568c12c50c712b22770a36eb53c48ee784828ab7e25f7c78e7516f3de43a55dc0ed9a98a24c8568da239d6971cd80de47ae31eb6e122978b09fd5a7f8eca3c9e686d76fe4e9bf0283a866924077c4140803b11d", 0xc8, 0x100, 0x401}, {&(0x7f0000000340)="b4c41b984999d0f22ae0a8652c4241723bafb2abfc0c6cefb4cac1c9b1c6ce734a220870622163ae660f6002c28843f998226a50ce5a7c25b51b5795954c9b4a7c74ac986a913d2e9c40a614f763e17b899da790e83c98e75b3fe9f0d72ffd6c6383f518cf60a676817dfc62cfd8670038834c08e3dcf04e86640519cedd6a6cc9920dfbfeff9645b72dcb2a548cfd7fe4002f9cdc33a1214ab90dc395c41ac61fc135e503f1f2e9afaa", 0xaa, 0xcf08, 0x2}, {&(0x7f0000000b80)="32d4889f45e46d6733b3c814ffa3ec8714c220123e79e89519a82c46485e8ca855b7a01d10408bf0d22463ea0a5b0b9fef1117c033426d8ca87a387bdc541ffecbdc2e9716bb6f318a04b3168cca67c5563258bc6aa13a7d78e1b08d01e06e48b7c0448aa0d999a594ec6dd68cceb9d2eac9a5c2b8d73b28f405a5e3d5f027d4747d42d0b76837e4e33acdc54b074946817301ac0cf672a2a4619b07", 0x9c, 0xfffffffffffffff9, 0x7}, {&(0x7f0000000c40)="8028ef083379d18393b5d3e4669cdd95af8f9c2eb285c1e224c2d76b8a423968ee045ad4f67eb8229cedc4359421b5a666c62169862fe46eca1e78ec506eaa", 0x3f, 0x1, 0x1}, {&(0x7f0000000c80)="cd609bb880c2613aa52cfe0c08fa20ef63e04e48074357f528334250ccabfe87effcf3bd7dc9155a80850ff98cc915fc10adc3c4f98443f708783c5b618f9b750ccf7d53e23bbe377644025cdb0733cb7c7c28f56fbe53bb2d60eb80c2d43b14caa6df3e66ed5782cc", 0x69, 0x3, 0x9}], 0x150000) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) madvise(&(0x7f0000a93000/0x4000)=nil, 0x4000, 0xe) mremap(&(0x7f0000a96000/0x1000)=nil, 0x1000, 0x800000, 0x3, &(0x7f0000130000/0x800000)=nil) r7 = gettid() process_vm_writev(r7, &(0x7f0000000000)=[{&(0x7f00008f9f09)=""/247, 0xf7}], 0x3cb, &(0x7f0000121000)=[{&(0x7f0000217f28)=""/231, 0xffffff4e}], 0x23a, 0x0) r8 = openat$full(0xffffffffffffff9c, &(0x7f0000000e00), 0x2000, 0x0) syz_kvm_setup_cpu$x86(r6, r8, &(0x7f0000292000/0x18000)=nil, &(0x7f0000000ec0)=[@text16={0x10, &(0x7f0000000e40)="66b80500000066b9003000000f01d926f30fa6d066b8010000000f01d9640fc73cf081954400008088b2ecc42e676664260f2002670f994bf20f22d4ba4200b80000ef", 0x43}], 0x1, 0x20, &(0x7f0000000f00)=[@flags={0x3, 0x1800}, @cr4={0x1, 0x220}], 0x2) r9 = creat(&(0x7f00000001c0)='./file0\x00', 0x0) write$uinput_user_dev(r9, &(0x7f0000000400)={'syz0\x00', {0x7, 0x6, 0x6, 0xfffa}, 0x1d, [0x200006, 0xc95a, 0xfffffff3, 0x9, 0x80, 0x2, 0x1, 0x7f, 0x6, 0x4d, 0xfffffff2, 0x5f, 0xa, 0x0, 0xffff2d37, 0x1dd2, 0x6, 0x7, 0x0, 0x80000001, 0x4, 0x7, 0x3, 0x3c57, 0x1, 0x24, 0xffffffff, 0x1, 0x1f461e2c, 0x2, 0xe661, 0x8, 0x7, 0x3, 0x7fff, 0x4c72, 0x8f00, 0x642, 0x3, 0xa, 0x0, 0x71, 0x7, 0x7, 0x103, 0x0, 0x5, 0xba1, 0x8f, 0x6, 0x6, 0x3, 0x5, 0x4, 0x8, 0x0, 0x80, 0x0, 0x5, 0x6, 0x8, 0x4, 0x5, 0x40], [0x10000007, 0xffff, 0x12f, 0x8000, 0x10, 0xfffffff3, 0x129432e6, 0xcb, 0xf9, 0xd, 0x2bf, 0x8, 0x9, 0xfffffffc, 0x3, 0x80000, 0x7, 0x0, 0x2f, 0xb, 0x312, 0x78, 0xea4, 0xa, 0x4, 0x7fffffff, 0xffffffd0, 0x9, 0x400, 0x1, 0x6, 0x1, 0xff, 0x1005, 0x7ff, 0x5f31, 0x4, 0x0, 0x6, 0x2, 0x9, 0x4, 0x9, 0x8, 0xb, 0x6, 0x5, 0x0, 0x1, 0x8000, 0xffff, 0x2, 0x77, 0x9, 0x5, 0x3, 0x4, 0x1, 0x7, 0x6, 0x9, 0x48c93690, 0x2, 0xff], [0x7, 0x4, 0x0, 0x64e, 0xfffffdfe, 0x7fffffff, 0x8d2, 0x49, 0x5, 0x7fff, 0x0, 0x5, 0xb, 0x4, 0x5, 0x5, 0x0, 0x16f, 0x5, 0x8, 0x86, 0x3, 0x0, 0x3e7, 0x2, 0x5, 0x2, 0x2, 0xf, 0x8, 0x4, 0x6d01, 0x5, 0x3b, 0x3, 0x200, 0x80, 0x3, 0x4, 0x2950bfaf, 0x0, 0xa2, 0x7, 0x53cf697b, 0x5, 0x6, 0x54fe12d2, 0xbf, 0x100b, 0x3, 0x400000, 0xfffffff9, 0x0, 0x1, 0x5, 0x0, 0x6, 0x0, 0x120000, 0x3, 0x6, 0x2, 0x4, 0x3], [0x9, 0xbb31, 0x3, 0xb, 0x5, 0x938, 0x6, 0x6, 0x0, 0x5, 0xce7, 0x1ff, 0x6, 0x7, 0x5, 0x3, 0x101, 0x10000, 0x6, 0x7fff, 0xffff, 0xa620, 0x2, 0x5, 0x1, 0x2, 0x14c, 0x60a7, 0x6, 0x6, 0xffffffff, 0x9, 0x5, 0x8, 0xc8, 0x3, 0x3, 0xffff, 0x3, 0x9, 0x100, 0x9605, 0xa, 0x2, 0x4, 0x6, 0x1, 0x10000, 0x5, 0x8, 0x2b91, 0xa1f, 0x8, 0x9, 0x1, 0x6c1b, 0x0, 0x4, 0x5, 0xb1c, 0x1, 0x200, 0xffff3441, 0xfff]}, 0x45c) r10 = openat$drirender128(0xffffffffffffff9c, &(0x7f0000000f40), 0x301001, 0x0) ioctl$DRM_IOCTL_GEM_OPEN(r9, 0xc010640b, &(0x7f0000000f80)={0x0, 0x0}) ioctl$DRM_IOCTL_GEM_FLINK(r10, 0xc008640a, &(0x7f0000000fc0)={r11}) bpf$BPF_LINK_CREATE_XDP(0x1c, &(0x7f00000012c0)={r2, 0x0, 0x30, 0xe1515f8735398fb, @val=@uprobe_multi={&(0x7f0000000140)='./file0\x00', &(0x7f0000000180)=[0x400], 0x0, 0x0, 0x1, 0x1}}, 0x40) program crashed: KASAN: slab-use-after-free Read in netdev_unregister_kobject bisect: the chunk can be dropped bisect: testing without sub-chunk 3/3 bisect: split chunks (needed=true): <8> bisect: split chunk #0 of len 8 into 2 parts bisect: testing without sub-chunk 1/2 testing program (duration=31s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): [11, 30, 30, 30] detailed listing: executing program 3: r0 = socket$inet_smc(0x2b, 0x1, 0x0) r1 = syz_init_net_socket$bt_l2cap(0x1f, 0x2, 0x0) bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x11, 0x3, &(0x7f0000000640)=ANY=[@ANYBLOB="180000000031288e8e"], &(0x7f0000000200)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @void, @value}, 0x90) connect$bt_l2cap(r1, &(0x7f0000000040)={0x1f, 0x0, @fixed={'\xaa\xaa\xaa\xaa\xaa', 0x10}, 0x7ff}, 0xe) r2 = openat$kvm(0xffffffffffffff9c, 0x0, 0x0, 0x0) r3 = syz_init_net_socket$bt_bnep(0x1f, 0x3, 0x4) ioctl$sock_bt_bnep_BNEPCONNADD(r3, 0x400442c8, &(0x7f0000000000)=ANY=[@ANYRES32=r1, @ANYBLOB='\x00\x00\x00\x00\x00', @ANYRESHEX, @ANYRES32=r2]) setsockopt$IP_VS_SO_SET_ADD(r0, 0x0, 0x482, &(0x7f0000000000)={0x6, @local, 0x0, 0x0, 'sh\x00', 0x0, 0x0, 0x35}, 0x2c) setsockopt$IP_VS_SO_SET_ADD(r0, 0x0, 0x483, &(0x7f0000000000)={0x6, @local, 0x0, 0x0, 'sh\x00'}, 0x2c) r4 = syz_open_dev$radio(&(0x7f0000000080), 0x3, 0x2) ioctl$VIDIOC_SUBDEV_G_FMT(r4, 0xc0585604, &(0x7f00000000c0)={0x1, 0x0, {0x7ff, 0xf, 0x200e, 0xb, 0x2, 0x4, 0x0, 0x5}}) executing program 1: r0 = syz_genetlink_get_family_id$ethtool(&(0x7f00000003c0), 0xffffffffffffffff) openat$nullb(0xffffffffffffff9c, &(0x7f0000000440), 0x1c1482, 0x0) r1 = openat$nullb(0xffffffffffffff9c, &(0x7f0000000040), 0x1, 0x0) ioctl$BLKZEROOUT(r1, 0x127f, &(0x7f0000000240)={0x0, 0x1000000}) sendmsg$ETHTOOL_MSG_STRSET_GET(0xffffffffffffffff, &(0x7f0000000540)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000040)=ANY=[@ANYBLOB="18000000", @ANYRES16=r0, @ANYBLOB="09030000000000fdff072000adce04000280"], 0x18}, 0x1, 0xf000000}, 0x0) openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000400)='cgroup.controllers\x00', 0x275a, 0x0) r2 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000200)='memory.swap.current\x00', 0x275a, 0x0) fchdir(0xffffffffffffffff) r3 = syz_genetlink_get_family_id$mptcp(&(0x7f0000000700), r2) sendmsg$MPTCP_PM_CMD_DEL_ADDR(0xffffffffffffffff, &(0x7f00000007c0)={&(0x7f00000006c0)={0x10, 0x0, 0x0, 0x40000}, 0xc, &(0x7f0000000780)={&(0x7f0000000480)=ANY=[@ANYBLOB="0300"/11, @ANYRES16=r3, @ANYBLOB="000129bd7000fcdbdf2502000000080004000800000008000200030000000800030004000000"], 0x2c}, 0x1, 0x0, 0x0, 0x40000}, 0x40) write$binfmt_script(r2, &(0x7f0000000000), 0x208e24b) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x2, 0x28011, r2, 0x0) preadv(r2, &(0x7f00000015c0)=[{&(0x7f0000000080)=""/124, 0xffffffff000}], 0x5, 0x0, 0x0) socket$nl_generic(0x10, 0x3, 0x10) r4 = socket$netlink(0x10, 0x3, 0x0) socket(0x10, 0x803, 0x0) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000240)={0x0}}, 0x0) getsockname$packet(0xffffffffffffffff, &(0x7f00000002c0)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000300)=0xffffff4e) sendmsg$nl_route(r4, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000980)=ANY=[@ANYBLOB="3c0000001800100000000000000000000a00000000030000000000000c00090008000000", @ANYRES32=r5, @ANYBLOB="14000500fe80000000627b00000000000000000022def77d0b43139408806b55dc7831e10a7dc40125cb228f36b3dda7388ea2912000319ba1a4d8d644ef85366ee397efd254cd6e7fac766c89557368e19de583367076431733d101000000344f9675ec680873ac9cd94fba2c6c6d748e60d1617b02e6adc79a9833becc726f3f106297d91db1a0d7d1231b271bd09c22348ac8ce3265006f0800000000000000f040d52440c67ff5407811d7953c09d170ca829808fcee72018000006bc5fc1eeeb8de9c5b4d89524a48fdf3fec1d61480591debd18b13b1f108c607d4a14c5742f8568ed07a24382a7b6e4423269a5e09bacfd1c821cc6f83678c98574eb5fb2b6877ccc02f34c1521e5b6e8e8165e19d75be8f4ba1e2e39029d40c714b36c109e10f42a8f4b717ad9e4693f54f031d3b0a"], 0x3c}, 0x1, 0x0, 0x0, 0x8010}, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000002040)='./file0\x00', 0x0) mount$tmpfs(0x0, &(0x7f0000000080)='./file0\x00', &(0x7f0000000280), 0x0, &(0x7f00000000c0)=ANY=[@ANYBLOB="6d706f6c3d62696e641a302d4e3a332f4e00"]) r6 = socket$kcm(0x10, 0x2, 0x0) sendmsg$kcm(r6, &(0x7f0000000940)={0x0, 0x0, &(0x7f0000000180)=[{}], 0x1}, 0x0) r7 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000000c0)='cgroup.controllers\x00', 0x275a, 0x0) io_setup(0x7, &(0x7f0000000100)=0x0) socket$inet6(0xa, 0x1, 0x9) io_submit(r8, 0x1, &(0x7f0000000380)=[&(0x7f0000000340)={0x0, 0x0, 0x0, 0x7, 0x2, r4, &(0x7f00000001c0)="4066462d53860daab083a0de4f4c44ad7a3f1ea42c80e16e98f51316944121c5a1e0c4e8c616", 0x26, 0xf, 0x0, 0x2}]) write$binfmt_script(r7, &(0x7f0000000500)={'#! ', '', [{0x20, 'memory.swap.current\x00'}]}, 0x19) socket$nl_rdma(0x10, 0x3, 0x14) sendmsg$RDMA_NLDEV_CMD_NEWLINK(r4, &(0x7f00000000c0)={0x0, 0x4c, &(0x7f0000000080)={&(0x7f00000004c0)={0x38, 0x1403, 0x1, 0x70bd2a, 0x25dfdbfb, "", [{{0x9, 0x2, 'syz1\x00'}, {0x8, 0x41, 'siw\x00'}, {0x14, 0x33, 'netdevsim0\x00'}}]}, 0x38}, 0x1, 0x0, 0x0, 0x8800}, 0x20000044) executing program 3: socket$inet_mptcp(0x2, 0x1, 0x106) socket$nl_generic(0x10, 0x3, 0x10) socket$inet_udp(0x2, 0x2, 0x0) socket$nl_generic(0x10, 0x3, 0x10) syz_init_net_socket$ax25(0x3, 0x5, 0x0) socket$alg(0x26, 0x5, 0x0) r0 = socket$packet(0x11, 0x3, 0x300) syz_open_dev$vim2m(&(0x7f0000000000), 0x0, 0x2) r1 = socket$vsock_stream(0x28, 0x1, 0x0) setsockopt$SO_VM_SOCKETS_CONNECT_TIMEOUT_OLD(r1, 0x28, 0x6, &(0x7f00000000c0)={0x0, 0xea60}, 0x10) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000200)={0x9, 0x4, &(0x7f0000000000)=ANY=[@ANYBLOB="18000000000000000000000000000000611948000000000095"], &(0x7f0000000080)='GPL\x00', 0x5, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0x0, @void, @value}, 0x94) socket$packet(0x11, 0x3, 0x300) socket$nl_route(0x10, 0x3, 0x0) socket$nl_route(0x10, 0x3, 0x0) socket(0x1, 0x803, 0x0) pipe(&(0x7f0000000100)) r2 = syz_open_procfs(0x0, &(0x7f00000021c0)='net/fib_triestat\x00') add_key(&(0x7f0000002100)='.dead\x00', 0x0, &(0x7f00000003c0)="4e09237282d50692dd8177cd88ec84d5b65831daeb3ab2428fe6e301f5364e9e808c904cfe56c7897e8da5bd029e86304fc396b7b7541a2b7135c4c5fe58c8bb82e9b45cd1d2853c1c22568f3f9f44b85f4e05a4589c4f71688840bad10e7e62f42fad010cee932737c512b7fbc476bafeb5cb4e9f8a01a8ca025fa4bd5ac67323c02adb999b1c37747866fe7465751a913e9a419c36b2120cc6efbf46e791760d06b3e029fd5bb96649610d2819fd10ababef8512852d12", 0xb8, 0xfffffffffffffffe) read$FUSE(r2, &(0x7f0000004480)={0x2020}, 0x2020) getsockname$packet(r0, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f00000002c0)=0x14) r3 = socket$inet6_icmp_raw(0xa, 0x3, 0x3a) ioctl$ifreq_SIOCGIFINDEX_wireguard(r3, 0x8933, &(0x7f0000000180)={'wg2\x00'}) ioctl$sock_SIOCGIFINDEX(r3, 0x8933, &(0x7f0000000240)={'dummy0\x00'}) r4 = socket$netlink(0x10, 0x3, 0x0) setsockopt$netlink_NETLINK_BROADCAST_ERROR(r4, 0x10e, 0x4, &(0x7f0000000f40)=0xe498, 0x4) r5 = socket(0x10, 0x803, 0x0) syz_genetlink_get_family_id$tipc2(&(0x7f0000000580), r5) getsockopt$IP_VS_SO_GET_SERVICES(r4, 0x0, 0x482, &(0x7f00000002c0)=""/140, &(0x7f0000000140)=0x8c) getsockname$packet(r5, &(0x7f0000000380)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) sendmsg$nl_route(r4, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000001140)={&(0x7f0000000040)=@newlink={0x20, 0x10, 0x503, 0x70bd2b, 0x29d24, {0x0, 0x0, 0x0, 0x0, 0x14415, 0x48041}}, 0x20}}, 0x4050) executing program 2: r0 = creat(&(0x7f00000002c0)='./file0\x00', 0x0) r1 = open$dir(&(0x7f0000000080)='./file0\x00', 0x0, 0x0) ioctl$TIOCL_GETSHIFTSTATE(r0, 0x541c, &(0x7f0000000300)={0x6, 0xf9}) mmap$xdp(&(0x7f0000ffc000/0x4000)=nil, 0x4000, 0x0, 0x12, r1, 0x0) add_key(&(0x7f0000000040)='dns_resolver\x00', &(0x7f0000000400)={'syz', 0x3}, &(0x7f0000000080)="000001020200", 0x6, 0xfffffffffffffffb) r2 = bpf$PROG_LOAD(0x5, &(0x7f0000000040)={0x2, 0x4, &(0x7f0000000200)=ANY=[@ANYBLOB="180000000300000000000000feffff10850000000700000095"], &(0x7f0000000000)='GPL\x00', 0x0, 0x0, 0x0, 0x100, 0x70, '\x00', 0x0, @fallback=0x30, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @void, @value}, 0x94) r3 = accept4$inet6(r0, &(0x7f0000000100)={0xa, 0x0, 0x0, @loopback}, &(0x7f0000000240)=0x1c, 0x800) r4 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000100), 0x0, 0x0) ioctl$TIOCSETD(r4, 0x5423, &(0x7f00000000c0)=0xf) ioctl$TCFLSH(r4, 0x400455c8, 0x0) r5 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) r6 = bpf$ITER_CREATE(0xb, &(0x7f0000000100), 0x8) bind$bt_hci(r5, &(0x7f0000000000)={0x1f, 0xffff, 0x3}, 0x6) setsockopt$packet_fanout_data(r6, 0x107, 0x16, &(0x7f0000000100)={0x3c, &(0x7f0000000180)=[{0x0, 0x80}, {0x1, 0x1}]}, 0x10) write$binfmt_misc(r5, &(0x7f0000000100), 0x6) ioctl$sock_inet_SIOCSIFFLAGS(r3, 0x8914, &(0x7f0000000280)={'pim6reg1\x00', 0x2}) kexec_load(0x10001, 0x7, &(0x7f0000000d00)=[{&(0x7f0000000880)="37fb79c14b452fe422d277f3feab89bd5416dfcf3bf47545e5ab096dcb018ccf5e7834151fe735f3c37c51b7a72535bc3d1eacead7abed2865da31aa63967c330aedc3705baa61a5607cd0a3a2070d37edfceeb570c4f4a4779225903bdcdbe4dd42df2455794ccc41f4f35f7dad393d2e51029b4d4bb0121453837f0c8d7f83382871fb357ccea66bf27d0105b51f7fa7efff0e8c858dd71b23ffa2276f6066701df8d656ef5e7a6668eaf28a714efaf6abc7f50e1d41f8d18212b678c2f51952f9b14cd732d94abd44ee9c6c3e70cf5e8092eefed3562b38b60acf756feb66dc1e85179ea011d05e29ff33", 0xec, 0x3, 0x1}, {&(0x7f0000000980)="48f8c31e4b57576b253e8835a21c3715777121e4dc6de0b9fafa8105e0c0df84680beb46d29d31f8ddbfe7b650c091ab6cca47192b1c695ce7b539954ebbdad07798399cb6d201b26b806df11ce19cbc0520448b0546ae61a7d3c41d94f4b8479e568ce09b2473975832593dbb2a8fc24ce235fee4f907116cb4aae39c7273cfc3250d6de2cdf5dff4eb4a1763747daccc20cb58a91676a9d65828edef6e4dca63d8c2893a333a4db2c3f68b47774b3d389b3875eaf38f6ce0294b0ca716e2241b6c", 0xc2, 0x200, 0xd}, {&(0x7f0000000a80)="d31588bf1cc6434b3a9c34146e87304d2812f1adc1fce1ada8825cb60b0f401ce94eb0bf9d06f365fc41797047fb1a1511704466190641d88412d4bfaf56b5e2f262551b745377985bae27ccbcfbf9e8dc8ee84d8cb0867f9caddd604bf6120303f320552e5f42a2afce6451e1185180fc94db6a6568c12c50c712b22770a36eb53c48ee784828ab7e25f7c78e7516f3de43a55dc0ed9a98a24c8568da239d6971cd80de47ae31eb6e122978b09fd5a7f8eca3c9e686d76fe4e9bf0283a866924077c4140803b11d", 0xc8, 0x100, 0x401}, {&(0x7f0000000340)="b4c41b984999d0f22ae0a8652c4241723bafb2abfc0c6cefb4cac1c9b1c6ce734a220870622163ae660f6002c28843f998226a50ce5a7c25b51b5795954c9b4a7c74ac986a913d2e9c40a614f763e17b899da790e83c98e75b3fe9f0d72ffd6c6383f518cf60a676817dfc62cfd8670038834c08e3dcf04e86640519cedd6a6cc9920dfbfeff9645b72dcb2a548cfd7fe4002f9cdc33a1214ab90dc395c41ac61fc135e503f1f2e9afaa", 0xaa, 0xcf08, 0x2}, {&(0x7f0000000b80)="32d4889f45e46d6733b3c814ffa3ec8714c220123e79e89519a82c46485e8ca855b7a01d10408bf0d22463ea0a5b0b9fef1117c033426d8ca87a387bdc541ffecbdc2e9716bb6f318a04b3168cca67c5563258bc6aa13a7d78e1b08d01e06e48b7c0448aa0d999a594ec6dd68cceb9d2eac9a5c2b8d73b28f405a5e3d5f027d4747d42d0b76837e4e33acdc54b074946817301ac0cf672a2a4619b07", 0x9c, 0xfffffffffffffff9, 0x7}, {&(0x7f0000000c40)="8028ef083379d18393b5d3e4669cdd95af8f9c2eb285c1e224c2d76b8a423968ee045ad4f67eb8229cedc4359421b5a666c62169862fe46eca1e78ec506eaa", 0x3f, 0x1, 0x1}, {&(0x7f0000000c80)="cd609bb880c2613aa52cfe0c08fa20ef63e04e48074357f528334250ccabfe87effcf3bd7dc9155a80850ff98cc915fc10adc3c4f98443f708783c5b618f9b750ccf7d53e23bbe377644025cdb0733cb7c7c28f56fbe53bb2d60eb80c2d43b14caa6df3e66ed5782cc", 0x69, 0x3, 0x9}], 0x150000) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) madvise(&(0x7f0000a93000/0x4000)=nil, 0x4000, 0xe) mremap(&(0x7f0000a96000/0x1000)=nil, 0x1000, 0x800000, 0x3, &(0x7f0000130000/0x800000)=nil) r7 = gettid() process_vm_writev(r7, &(0x7f0000000000)=[{&(0x7f00008f9f09)=""/247, 0xf7}], 0x3cb, &(0x7f0000121000)=[{&(0x7f0000217f28)=""/231, 0xffffff4e}], 0x23a, 0x0) r8 = openat$full(0xffffffffffffff9c, &(0x7f0000000e00), 0x2000, 0x0) syz_kvm_setup_cpu$x86(r6, r8, &(0x7f0000292000/0x18000)=nil, &(0x7f0000000ec0)=[@text16={0x10, &(0x7f0000000e40)="66b80500000066b9003000000f01d926f30fa6d066b8010000000f01d9640fc73cf081954400008088b2ecc42e676664260f2002670f994bf20f22d4ba4200b80000ef", 0x43}], 0x1, 0x20, &(0x7f0000000f00)=[@flags={0x3, 0x1800}, @cr4={0x1, 0x220}], 0x2) r9 = creat(&(0x7f00000001c0)='./file0\x00', 0x0) write$uinput_user_dev(r9, &(0x7f0000000400)={'syz0\x00', {0x7, 0x6, 0x6, 0xfffa}, 0x1d, [0x200006, 0xc95a, 0xfffffff3, 0x9, 0x80, 0x2, 0x1, 0x7f, 0x6, 0x4d, 0xfffffff2, 0x5f, 0xa, 0x0, 0xffff2d37, 0x1dd2, 0x6, 0x7, 0x0, 0x80000001, 0x4, 0x7, 0x3, 0x3c57, 0x1, 0x24, 0xffffffff, 0x1, 0x1f461e2c, 0x2, 0xe661, 0x8, 0x7, 0x3, 0x7fff, 0x4c72, 0x8f00, 0x642, 0x3, 0xa, 0x0, 0x71, 0x7, 0x7, 0x103, 0x0, 0x5, 0xba1, 0x8f, 0x6, 0x6, 0x3, 0x5, 0x4, 0x8, 0x0, 0x80, 0x0, 0x5, 0x6, 0x8, 0x4, 0x5, 0x40], [0x10000007, 0xffff, 0x12f, 0x8000, 0x10, 0xfffffff3, 0x129432e6, 0xcb, 0xf9, 0xd, 0x2bf, 0x8, 0x9, 0xfffffffc, 0x3, 0x80000, 0x7, 0x0, 0x2f, 0xb, 0x312, 0x78, 0xea4, 0xa, 0x4, 0x7fffffff, 0xffffffd0, 0x9, 0x400, 0x1, 0x6, 0x1, 0xff, 0x1005, 0x7ff, 0x5f31, 0x4, 0x0, 0x6, 0x2, 0x9, 0x4, 0x9, 0x8, 0xb, 0x6, 0x5, 0x0, 0x1, 0x8000, 0xffff, 0x2, 0x77, 0x9, 0x5, 0x3, 0x4, 0x1, 0x7, 0x6, 0x9, 0x48c93690, 0x2, 0xff], [0x7, 0x4, 0x0, 0x64e, 0xfffffdfe, 0x7fffffff, 0x8d2, 0x49, 0x5, 0x7fff, 0x0, 0x5, 0xb, 0x4, 0x5, 0x5, 0x0, 0x16f, 0x5, 0x8, 0x86, 0x3, 0x0, 0x3e7, 0x2, 0x5, 0x2, 0x2, 0xf, 0x8, 0x4, 0x6d01, 0x5, 0x3b, 0x3, 0x200, 0x80, 0x3, 0x4, 0x2950bfaf, 0x0, 0xa2, 0x7, 0x53cf697b, 0x5, 0x6, 0x54fe12d2, 0xbf, 0x100b, 0x3, 0x400000, 0xfffffff9, 0x0, 0x1, 0x5, 0x0, 0x6, 0x0, 0x120000, 0x3, 0x6, 0x2, 0x4, 0x3], [0x9, 0xbb31, 0x3, 0xb, 0x5, 0x938, 0x6, 0x6, 0x0, 0x5, 0xce7, 0x1ff, 0x6, 0x7, 0x5, 0x3, 0x101, 0x10000, 0x6, 0x7fff, 0xffff, 0xa620, 0x2, 0x5, 0x1, 0x2, 0x14c, 0x60a7, 0x6, 0x6, 0xffffffff, 0x9, 0x5, 0x8, 0xc8, 0x3, 0x3, 0xffff, 0x3, 0x9, 0x100, 0x9605, 0xa, 0x2, 0x4, 0x6, 0x1, 0x10000, 0x5, 0x8, 0x2b91, 0xa1f, 0x8, 0x9, 0x1, 0x6c1b, 0x0, 0x4, 0x5, 0xb1c, 0x1, 0x200, 0xffff3441, 0xfff]}, 0x45c) r10 = openat$drirender128(0xffffffffffffff9c, &(0x7f0000000f40), 0x301001, 0x0) ioctl$DRM_IOCTL_GEM_OPEN(r9, 0xc010640b, &(0x7f0000000f80)={0x0, 0x0}) ioctl$DRM_IOCTL_GEM_FLINK(r10, 0xc008640a, &(0x7f0000000fc0)={r11}) bpf$BPF_LINK_CREATE_XDP(0x1c, &(0x7f00000012c0)={r2, 0x0, 0x30, 0xe1515f8735398fb, @val=@uprobe_multi={&(0x7f0000000140)='./file0\x00', &(0x7f0000000180)=[0x400], 0x0, 0x0, 0x1, 0x1}}, 0x40) program did not crash bisect: testing without sub-chunk 2/2 testing program (duration=31s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): [30, 24, 15, 4] detailed listing: executing program 2: r0 = syz_open_dev$dri(&(0x7f0000000080), 0x1, 0x0) r1 = openat(0xffffffffffffff9c, &(0x7f0000000040)='./cgroup/pids.max\x00', 0x2, 0x0) write$cgroup_pid(r1, &(0x7f00000000c0), 0x12) r2 = socket$kcm(0x11, 0x2, 0x300) r3 = socket$alg(0x26, 0x5, 0x0) bind$alg(r3, &(0x7f0000000000)={0x26, 'hash\x00', 0x0, 0x0, 'sha1-avx\x00'}, 0x58) r4 = accept4(r3, 0x0, 0x0, 0x0) recvmsg$unix(r4, &(0x7f0000000400)={0x0, 0x0, 0x0, 0x0, &(0x7f00000003c0)=[@rights={{0x14, 0x1, 0x1, [0xffffffffffffffff]}}], 0x18}, 0x0) setsockopt$sock_attach_bpf(r2, 0x107, 0x12, &(0x7f00000008c0)=r5, 0x4) r6 = bpf$OBJ_GET_MAP(0x7, &(0x7f00000003c0)=@o_path={&(0x7f0000000380)='./file0\x00', 0x0, 0x4000, r0}, 0x18) r7 = bpf$MAP_CREATE(0x0, &(0x7f0000001440)=@base={0xf, 0xa, 0xa, 0x1, 0x800, 0x1, 0xff, '\x00', 0x0, 0xffffffffffffffff, 0x1, 0x2, 0x4, 0x0, @void, @value, @void, @value}, 0x50) r8 = bpf$MAP_CREATE_RINGBUF(0x0, &(0x7f00000014c0)={0x1b, 0x0, 0x0, 0x9, 0x0, 0x1, 0x0, '\x00', 0x0, 0xffffffffffffffff, 0x0, 0x4, 0x5, 0x0, @void, @value, @void, @value}, 0x50) r9 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000300), 0x0, 0x0) r10 = ioctl$KVM_CREATE_VM(r9, 0xae01, 0x0) r11 = ioctl$KVM_CREATE_VCPU(r10, 0xae41, 0x0) r12 = dup(r11) ioctl$KVM_SET_MSRS(r12, 0x4048aecb, &(0x7f00000000c0)=ANY=[@ANYRES64=r9, @ANYRES64]) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000001600)={0x11, 0x10, &(0x7f00000002c0)=@framed={{0x18, 0x0, 0x0, 0x0, 0x2, 0x0, 0x0, 0x0, 0x3}, [@snprintf={{}, {}, {0x7, 0x0, 0xb, 0x8, 0x0, 0x0, 0x7}}]}, &(0x7f0000000140)='GPL\x00', 0x5, 0x1000, &(0x7f0000000440)=""/4096, 0x40f00, 0xa, '\x00', 0x0, 0x0, r1, 0x8, 0x0, 0x0, 0x10, &(0x7f0000000340)={0x5, 0x0, 0x3, 0x3}, 0x10, 0x0, 0x0, 0x8, &(0x7f0000001540)=[r5, r6, r7, r8, r12], &(0x7f0000001580)=[{0x4, 0x5, 0x6, 0x5}, {0x3, 0x3, 0xc, 0x5}, {0x0, 0x2, 0x8, 0x7}, {0x0, 0x5, 0xa, 0x5}, {0x1, 0xb, 0x2, 0xb}, {0x2, 0x4, 0x0, 0x7}, {0x5, 0x4, 0x6, 0x2}, {0x4, 0x5, 0xb, 0x1}], 0x10, 0x40, @void, @value}, 0x94) ioctl$DRM_IOCTL_SET_CLIENT_CAP(r0, 0x4010640d, &(0x7f0000000000)={0x3, 0x2}) r13 = socket$nl_route(0x10, 0x3, 0x0) socket$nl_netfilter(0x10, 0x3, 0xc) io_setup(0x7ff, 0x0) r14 = socket$inet6(0xa, 0x2, 0x0) r15 = dup(r14) mknod$loop(&(0x7f0000000100)='./file0\x00', 0x40, 0x1) r16 = socket$netlink(0x10, 0x3, 0xa) sendmsg$nl_route(r16, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000400)={&(0x7f0000000080)=@bridge_delneigh={0x1c, 0x1d, 0x1, 0x0, 0x0, {0x7}}, 0x1c}}, 0x0) bind$unix(r15, &(0x7f00000001c0)=@abs={0x1, 0x0, 0x4e22}, 0x6e) sendmsg$IPSET_CMD_SWAP(r15, &(0x7f0000000280)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000040)=ANY=[@ANYRESOCT=r13], 0x34}, 0x1, 0x0, 0x0, 0x240040c4}, 0x4000004) ioctl$DRM_IOCTL_MODE_ATOMIC(r0, 0xc03864bc, &(0x7f0000000180)={0x1, 0x0, 0x0, 0x0, 0x0, 0x0}) executing program 1: r0 = syz_open_dev$radio(&(0x7f0000000000), 0x3, 0x2) ioctl$VIDIOC_S_EXT_CTRLS(r0, 0xc0205648, &(0x7f0000000100)={0x9b0000, 0x1, 0x0, 0xffffffffffffffff, 0x0, &(0x7f0000000180)={0x9b090b, 0x0, '\x00', @value=0xa}}) ioctl$EVIOCGBITSW(0xffffffffffffffff, 0x80404525, &(0x7f0000000000)=""/52) preadv(0xffffffffffffffff, &(0x7f0000000080), 0x0, 0x0, 0x0) r1 = socket$inet6_tcp(0xa, 0x1, 0x0) r2 = socket$nl_generic(0x10, 0x3, 0x10) ioctl$sock_SIOCGIFVLAN_GET_VLAN_VID_CMD(r2, 0x8982, &(0x7f0000000080)) r3 = syz_genetlink_get_family_id$ethtool(&(0x7f00000007c0), 0xffffffffffffffff) sendmsg$ETHTOOL_MSG_CHANNELS_SET(r2, &(0x7f0000000ec0)={0x0, 0x0, &(0x7f0000000e80)={&(0x7f00000001c0)=ANY=[@ANYBLOB="3c000000fce274a3b11e32bfd81ab3df83e7af8f885c760322f66a9358a955aaa727876377476222215de720", @ANYRES16=r3, @ANYBLOB="01000010000000000000120000000800090000000000080007000400000018000180140002006261746164765f736c6176655f310000"], 0x3c}, 0x1, 0x0, 0x0, 0x44001}, 0x0) setsockopt$sock_int(r1, 0x1, 0x14, &(0x7f0000000040)=0x9, 0x4) listen(r1, 0x6) accept$inet6(r1, 0x0, 0x0) syz_open_dev$radio(&(0x7f0000000000), 0x3, 0x2) (async) ioctl$VIDIOC_S_EXT_CTRLS(r0, 0xc0205648, &(0x7f0000000100)={0x9b0000, 0x1, 0x0, 0xffffffffffffffff, 0x0, &(0x7f0000000180)={0x9b090b, 0x0, '\x00', @value=0xa}}) (async) ioctl$EVIOCGBITSW(0xffffffffffffffff, 0x80404525, &(0x7f0000000000)=""/52) (async) preadv(0xffffffffffffffff, &(0x7f0000000080), 0x0, 0x0, 0x0) (async) socket$inet6_tcp(0xa, 0x1, 0x0) (async) socket$nl_generic(0x10, 0x3, 0x10) (async) ioctl$sock_SIOCGIFVLAN_GET_VLAN_VID_CMD(r2, 0x8982, &(0x7f0000000080)) (async) syz_genetlink_get_family_id$ethtool(&(0x7f00000007c0), 0xffffffffffffffff) (async) sendmsg$ETHTOOL_MSG_CHANNELS_SET(r2, &(0x7f0000000ec0)={0x0, 0x0, &(0x7f0000000e80)={&(0x7f00000001c0)=ANY=[@ANYBLOB="3c000000fce274a3b11e32bfd81ab3df83e7af8f885c760322f66a9358a955aaa727876377476222215de720", @ANYRES16=r3, @ANYBLOB="01000010000000000000120000000800090000000000080007000400000018000180140002006261746164765f736c6176655f310000"], 0x3c}, 0x1, 0x0, 0x0, 0x44001}, 0x0) (async) setsockopt$sock_int(r1, 0x1, 0x14, &(0x7f0000000040)=0x9, 0x4) (async) listen(r1, 0x6) (async) accept$inet6(r1, 0x0, 0x0) (async) executing program 0: r0 = io_uring_setup(0x1065, &(0x7f0000001240)={0x0, 0x10, 0x800, 0x1}) r1 = openat$snapshot(0xffffffffffffff9c, &(0x7f0000000000), 0x481, 0x0) (async) openat$uinput(0xffffffffffffff9c, &(0x7f0000000000), 0x2, 0x0) (async) openat$kvm(0xffffffffffffff9c, &(0x7f0000000140), 0x0, 0x0) (async) r2 = syz_open_procfs(0x0, &(0x7f0000000600)='fd/4\x00') lseek(r2, 0x600, 0x4) (async) r3 = openat$cdrom(0xffffffffffffff9c, &(0x7f00000011c0), 0x2000, 0x0) capset(&(0x7f0000000080)={0x19980330}, &(0x7f0000000040)={0x200000, 0x200002}) (async) fanotify_init(0x20, 0x400) (async) ioctl$CDROM_SEND_PACKET(r3, 0x5393, &(0x7f0000001300)={"cdb755b1e57be73fc299a365", 0x0, 0x0, 0x5, 0x0, 0x0, 0x1, 0x1, 0x0}) r4 = socket(0x10, 0x803, 0x2) r5 = syz_genetlink_get_family_id$mptcp(&(0x7f00000000c0), r4) (async) getsockname$packet(r4, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f00000003c0)=0x14) syz_usb_connect$hid(0x0, 0x36, &(0x7f0000000140)=ANY=[@ANYBLOB="02bf91121a7d55fbb5c4ad52e805867ec7d1b3db3bd511fe6ef830b610bd2e696ee57d43797629e81fc6cd77ee526d1956c46658c3159fef57", @ANYRESDEC=r0, @ANYRESHEX=r1, @ANYRESDEC=r4, @ANYRESHEX=r5, @ANYRES16=r5, @ANYRESOCT=r6, @ANYRESHEX=r1], 0x0) close_range(r0, 0xffffffffffffffff, 0x0) executing program 1: r0 = openat(0xffffffffffffff9c, &(0x7f0000000080)='./file0\x00', 0x181942, 0x0) ioctl$FS_IOC_SETFLAGS(r0, 0x40086602, &(0x7f0000000040)=0x20) syz_open_procfs(0x0, &(0x7f0000000000)='fd/3\x00') ioctl$SNDRV_PCM_IOCTL_LINK(r0, 0x40044160, &(0x7f00000000c0)=0xa1) program did not crash bisect: split chunks (needed=true): <4>, <4> bisect: split chunk #0 of len 4 into 2 parts bisect: testing without sub-chunk 1/2 testing program (duration=31s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): [15, 4, 11, 30, 30, 30] detailed listing: executing program 0: r0 = io_uring_setup(0x1065, &(0x7f0000001240)={0x0, 0x10, 0x800, 0x1}) r1 = openat$snapshot(0xffffffffffffff9c, &(0x7f0000000000), 0x481, 0x0) (async) openat$uinput(0xffffffffffffff9c, &(0x7f0000000000), 0x2, 0x0) (async) openat$kvm(0xffffffffffffff9c, &(0x7f0000000140), 0x0, 0x0) (async) r2 = syz_open_procfs(0x0, &(0x7f0000000600)='fd/4\x00') lseek(r2, 0x600, 0x4) (async) r3 = openat$cdrom(0xffffffffffffff9c, &(0x7f00000011c0), 0x2000, 0x0) capset(&(0x7f0000000080)={0x19980330}, &(0x7f0000000040)={0x200000, 0x200002}) (async) fanotify_init(0x20, 0x400) (async) ioctl$CDROM_SEND_PACKET(r3, 0x5393, &(0x7f0000001300)={"cdb755b1e57be73fc299a365", 0x0, 0x0, 0x5, 0x0, 0x0, 0x1, 0x1, 0x0}) r4 = socket(0x10, 0x803, 0x2) r5 = syz_genetlink_get_family_id$mptcp(&(0x7f00000000c0), r4) (async) getsockname$packet(r4, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f00000003c0)=0x14) syz_usb_connect$hid(0x0, 0x36, &(0x7f0000000140)=ANY=[@ANYBLOB="02bf91121a7d55fbb5c4ad52e805867ec7d1b3db3bd511fe6ef830b610bd2e696ee57d43797629e81fc6cd77ee526d1956c46658c3159fef57", @ANYRESDEC=r0, @ANYRESHEX=r1, @ANYRESDEC=r4, @ANYRESHEX=r5, @ANYRES16=r5, @ANYRESOCT=r6, @ANYRESHEX=r1], 0x0) close_range(r0, 0xffffffffffffffff, 0x0) executing program 1: r0 = openat(0xffffffffffffff9c, &(0x7f0000000080)='./file0\x00', 0x181942, 0x0) ioctl$FS_IOC_SETFLAGS(r0, 0x40086602, &(0x7f0000000040)=0x20) syz_open_procfs(0x0, &(0x7f0000000000)='fd/3\x00') ioctl$SNDRV_PCM_IOCTL_LINK(r0, 0x40044160, &(0x7f00000000c0)=0xa1) executing program 3: r0 = socket$inet_smc(0x2b, 0x1, 0x0) r1 = syz_init_net_socket$bt_l2cap(0x1f, 0x2, 0x0) bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x11, 0x3, &(0x7f0000000640)=ANY=[@ANYBLOB="180000000031288e8e"], &(0x7f0000000200)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @void, @value}, 0x90) connect$bt_l2cap(r1, &(0x7f0000000040)={0x1f, 0x0, @fixed={'\xaa\xaa\xaa\xaa\xaa', 0x10}, 0x7ff}, 0xe) r2 = openat$kvm(0xffffffffffffff9c, 0x0, 0x0, 0x0) r3 = syz_init_net_socket$bt_bnep(0x1f, 0x3, 0x4) ioctl$sock_bt_bnep_BNEPCONNADD(r3, 0x400442c8, &(0x7f0000000000)=ANY=[@ANYRES32=r1, @ANYBLOB='\x00\x00\x00\x00\x00', @ANYRESHEX, @ANYRES32=r2]) setsockopt$IP_VS_SO_SET_ADD(r0, 0x0, 0x482, &(0x7f0000000000)={0x6, @local, 0x0, 0x0, 'sh\x00', 0x0, 0x0, 0x35}, 0x2c) setsockopt$IP_VS_SO_SET_ADD(r0, 0x0, 0x483, &(0x7f0000000000)={0x6, @local, 0x0, 0x0, 'sh\x00'}, 0x2c) r4 = syz_open_dev$radio(&(0x7f0000000080), 0x3, 0x2) ioctl$VIDIOC_SUBDEV_G_FMT(r4, 0xc0585604, &(0x7f00000000c0)={0x1, 0x0, {0x7ff, 0xf, 0x200e, 0xb, 0x2, 0x4, 0x0, 0x5}}) executing program 1: r0 = syz_genetlink_get_family_id$ethtool(&(0x7f00000003c0), 0xffffffffffffffff) openat$nullb(0xffffffffffffff9c, &(0x7f0000000440), 0x1c1482, 0x0) r1 = openat$nullb(0xffffffffffffff9c, &(0x7f0000000040), 0x1, 0x0) ioctl$BLKZEROOUT(r1, 0x127f, &(0x7f0000000240)={0x0, 0x1000000}) sendmsg$ETHTOOL_MSG_STRSET_GET(0xffffffffffffffff, &(0x7f0000000540)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000040)=ANY=[@ANYBLOB="18000000", @ANYRES16=r0, @ANYBLOB="09030000000000fdff072000adce04000280"], 0x18}, 0x1, 0xf000000}, 0x0) openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000400)='cgroup.controllers\x00', 0x275a, 0x0) r2 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000200)='memory.swap.current\x00', 0x275a, 0x0) fchdir(0xffffffffffffffff) r3 = syz_genetlink_get_family_id$mptcp(&(0x7f0000000700), r2) sendmsg$MPTCP_PM_CMD_DEL_ADDR(0xffffffffffffffff, &(0x7f00000007c0)={&(0x7f00000006c0)={0x10, 0x0, 0x0, 0x40000}, 0xc, &(0x7f0000000780)={&(0x7f0000000480)=ANY=[@ANYBLOB="0300"/11, @ANYRES16=r3, @ANYBLOB="000129bd7000fcdbdf2502000000080004000800000008000200030000000800030004000000"], 0x2c}, 0x1, 0x0, 0x0, 0x40000}, 0x40) write$binfmt_script(r2, &(0x7f0000000000), 0x208e24b) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x2, 0x28011, r2, 0x0) preadv(r2, &(0x7f00000015c0)=[{&(0x7f0000000080)=""/124, 0xffffffff000}], 0x5, 0x0, 0x0) socket$nl_generic(0x10, 0x3, 0x10) r4 = socket$netlink(0x10, 0x3, 0x0) socket(0x10, 0x803, 0x0) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000240)={0x0}}, 0x0) getsockname$packet(0xffffffffffffffff, &(0x7f00000002c0)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000300)=0xffffff4e) sendmsg$nl_route(r4, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000980)=ANY=[@ANYBLOB="3c0000001800100000000000000000000a00000000030000000000000c00090008000000", @ANYRES32=r5, @ANYBLOB="14000500fe80000000627b00000000000000000022def77d0b43139408806b55dc7831e10a7dc40125cb228f36b3dda7388ea2912000319ba1a4d8d644ef85366ee397efd254cd6e7fac766c89557368e19de583367076431733d101000000344f9675ec680873ac9cd94fba2c6c6d748e60d1617b02e6adc79a9833becc726f3f106297d91db1a0d7d1231b271bd09c22348ac8ce3265006f0800000000000000f040d52440c67ff5407811d7953c09d170ca829808fcee72018000006bc5fc1eeeb8de9c5b4d89524a48fdf3fec1d61480591debd18b13b1f108c607d4a14c5742f8568ed07a24382a7b6e4423269a5e09bacfd1c821cc6f83678c98574eb5fb2b6877ccc02f34c1521e5b6e8e8165e19d75be8f4ba1e2e39029d40c714b36c109e10f42a8f4b717ad9e4693f54f031d3b0a"], 0x3c}, 0x1, 0x0, 0x0, 0x8010}, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000002040)='./file0\x00', 0x0) mount$tmpfs(0x0, &(0x7f0000000080)='./file0\x00', &(0x7f0000000280), 0x0, &(0x7f00000000c0)=ANY=[@ANYBLOB="6d706f6c3d62696e641a302d4e3a332f4e00"]) r6 = socket$kcm(0x10, 0x2, 0x0) sendmsg$kcm(r6, &(0x7f0000000940)={0x0, 0x0, &(0x7f0000000180)=[{}], 0x1}, 0x0) r7 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000000c0)='cgroup.controllers\x00', 0x275a, 0x0) io_setup(0x7, &(0x7f0000000100)=0x0) socket$inet6(0xa, 0x1, 0x9) io_submit(r8, 0x1, &(0x7f0000000380)=[&(0x7f0000000340)={0x0, 0x0, 0x0, 0x7, 0x2, r4, &(0x7f00000001c0)="4066462d53860daab083a0de4f4c44ad7a3f1ea42c80e16e98f51316944121c5a1e0c4e8c616", 0x26, 0xf, 0x0, 0x2}]) write$binfmt_script(r7, &(0x7f0000000500)={'#! ', '', [{0x20, 'memory.swap.current\x00'}]}, 0x19) socket$nl_rdma(0x10, 0x3, 0x14) sendmsg$RDMA_NLDEV_CMD_NEWLINK(r4, &(0x7f00000000c0)={0x0, 0x4c, &(0x7f0000000080)={&(0x7f00000004c0)={0x38, 0x1403, 0x1, 0x70bd2a, 0x25dfdbfb, "", [{{0x9, 0x2, 'syz1\x00'}, {0x8, 0x41, 'siw\x00'}, {0x14, 0x33, 'netdevsim0\x00'}}]}, 0x38}, 0x1, 0x0, 0x0, 0x8800}, 0x20000044) executing program 3: socket$inet_mptcp(0x2, 0x1, 0x106) socket$nl_generic(0x10, 0x3, 0x10) socket$inet_udp(0x2, 0x2, 0x0) socket$nl_generic(0x10, 0x3, 0x10) syz_init_net_socket$ax25(0x3, 0x5, 0x0) socket$alg(0x26, 0x5, 0x0) r0 = socket$packet(0x11, 0x3, 0x300) syz_open_dev$vim2m(&(0x7f0000000000), 0x0, 0x2) r1 = socket$vsock_stream(0x28, 0x1, 0x0) setsockopt$SO_VM_SOCKETS_CONNECT_TIMEOUT_OLD(r1, 0x28, 0x6, &(0x7f00000000c0)={0x0, 0xea60}, 0x10) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000200)={0x9, 0x4, &(0x7f0000000000)=ANY=[@ANYBLOB="18000000000000000000000000000000611948000000000095"], &(0x7f0000000080)='GPL\x00', 0x5, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0x0, @void, @value}, 0x94) socket$packet(0x11, 0x3, 0x300) socket$nl_route(0x10, 0x3, 0x0) socket$nl_route(0x10, 0x3, 0x0) socket(0x1, 0x803, 0x0) pipe(&(0x7f0000000100)) r2 = syz_open_procfs(0x0, &(0x7f00000021c0)='net/fib_triestat\x00') add_key(&(0x7f0000002100)='.dead\x00', 0x0, &(0x7f00000003c0)="4e09237282d50692dd8177cd88ec84d5b65831daeb3ab2428fe6e301f5364e9e808c904cfe56c7897e8da5bd029e86304fc396b7b7541a2b7135c4c5fe58c8bb82e9b45cd1d2853c1c22568f3f9f44b85f4e05a4589c4f71688840bad10e7e62f42fad010cee932737c512b7fbc476bafeb5cb4e9f8a01a8ca025fa4bd5ac67323c02adb999b1c37747866fe7465751a913e9a419c36b2120cc6efbf46e791760d06b3e029fd5bb96649610d2819fd10ababef8512852d12", 0xb8, 0xfffffffffffffffe) read$FUSE(r2, &(0x7f0000004480)={0x2020}, 0x2020) getsockname$packet(r0, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f00000002c0)=0x14) r3 = socket$inet6_icmp_raw(0xa, 0x3, 0x3a) ioctl$ifreq_SIOCGIFINDEX_wireguard(r3, 0x8933, &(0x7f0000000180)={'wg2\x00'}) ioctl$sock_SIOCGIFINDEX(r3, 0x8933, &(0x7f0000000240)={'dummy0\x00'}) r4 = socket$netlink(0x10, 0x3, 0x0) setsockopt$netlink_NETLINK_BROADCAST_ERROR(r4, 0x10e, 0x4, &(0x7f0000000f40)=0xe498, 0x4) r5 = socket(0x10, 0x803, 0x0) syz_genetlink_get_family_id$tipc2(&(0x7f0000000580), r5) getsockopt$IP_VS_SO_GET_SERVICES(r4, 0x0, 0x482, &(0x7f00000002c0)=""/140, &(0x7f0000000140)=0x8c) getsockname$packet(r5, &(0x7f0000000380)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) sendmsg$nl_route(r4, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000001140)={&(0x7f0000000040)=@newlink={0x20, 0x10, 0x503, 0x70bd2b, 0x29d24, {0x0, 0x0, 0x0, 0x0, 0x14415, 0x48041}}, 0x20}}, 0x4050) executing program 2: r0 = creat(&(0x7f00000002c0)='./file0\x00', 0x0) r1 = open$dir(&(0x7f0000000080)='./file0\x00', 0x0, 0x0) ioctl$TIOCL_GETSHIFTSTATE(r0, 0x541c, &(0x7f0000000300)={0x6, 0xf9}) mmap$xdp(&(0x7f0000ffc000/0x4000)=nil, 0x4000, 0x0, 0x12, r1, 0x0) add_key(&(0x7f0000000040)='dns_resolver\x00', &(0x7f0000000400)={'syz', 0x3}, &(0x7f0000000080)="000001020200", 0x6, 0xfffffffffffffffb) r2 = bpf$PROG_LOAD(0x5, &(0x7f0000000040)={0x2, 0x4, &(0x7f0000000200)=ANY=[@ANYBLOB="180000000300000000000000feffff10850000000700000095"], &(0x7f0000000000)='GPL\x00', 0x0, 0x0, 0x0, 0x100, 0x70, '\x00', 0x0, @fallback=0x30, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @void, @value}, 0x94) r3 = accept4$inet6(r0, &(0x7f0000000100)={0xa, 0x0, 0x0, @loopback}, &(0x7f0000000240)=0x1c, 0x800) r4 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000100), 0x0, 0x0) ioctl$TIOCSETD(r4, 0x5423, &(0x7f00000000c0)=0xf) ioctl$TCFLSH(r4, 0x400455c8, 0x0) r5 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) r6 = bpf$ITER_CREATE(0xb, &(0x7f0000000100), 0x8) bind$bt_hci(r5, &(0x7f0000000000)={0x1f, 0xffff, 0x3}, 0x6) setsockopt$packet_fanout_data(r6, 0x107, 0x16, &(0x7f0000000100)={0x3c, &(0x7f0000000180)=[{0x0, 0x80}, {0x1, 0x1}]}, 0x10) write$binfmt_misc(r5, &(0x7f0000000100), 0x6) ioctl$sock_inet_SIOCSIFFLAGS(r3, 0x8914, &(0x7f0000000280)={'pim6reg1\x00', 0x2}) kexec_load(0x10001, 0x7, &(0x7f0000000d00)=[{&(0x7f0000000880)="37fb79c14b452fe422d277f3feab89bd5416dfcf3bf47545e5ab096dcb018ccf5e7834151fe735f3c37c51b7a72535bc3d1eacead7abed2865da31aa63967c330aedc3705baa61a5607cd0a3a2070d37edfceeb570c4f4a4779225903bdcdbe4dd42df2455794ccc41f4f35f7dad393d2e51029b4d4bb0121453837f0c8d7f83382871fb357ccea66bf27d0105b51f7fa7efff0e8c858dd71b23ffa2276f6066701df8d656ef5e7a6668eaf28a714efaf6abc7f50e1d41f8d18212b678c2f51952f9b14cd732d94abd44ee9c6c3e70cf5e8092eefed3562b38b60acf756feb66dc1e85179ea011d05e29ff33", 0xec, 0x3, 0x1}, {&(0x7f0000000980)="48f8c31e4b57576b253e8835a21c3715777121e4dc6de0b9fafa8105e0c0df84680beb46d29d31f8ddbfe7b650c091ab6cca47192b1c695ce7b539954ebbdad07798399cb6d201b26b806df11ce19cbc0520448b0546ae61a7d3c41d94f4b8479e568ce09b2473975832593dbb2a8fc24ce235fee4f907116cb4aae39c7273cfc3250d6de2cdf5dff4eb4a1763747daccc20cb58a91676a9d65828edef6e4dca63d8c2893a333a4db2c3f68b47774b3d389b3875eaf38f6ce0294b0ca716e2241b6c", 0xc2, 0x200, 0xd}, {&(0x7f0000000a80)="d31588bf1cc6434b3a9c34146e87304d2812f1adc1fce1ada8825cb60b0f401ce94eb0bf9d06f365fc41797047fb1a1511704466190641d88412d4bfaf56b5e2f262551b745377985bae27ccbcfbf9e8dc8ee84d8cb0867f9caddd604bf6120303f320552e5f42a2afce6451e1185180fc94db6a6568c12c50c712b22770a36eb53c48ee784828ab7e25f7c78e7516f3de43a55dc0ed9a98a24c8568da239d6971cd80de47ae31eb6e122978b09fd5a7f8eca3c9e686d76fe4e9bf0283a866924077c4140803b11d", 0xc8, 0x100, 0x401}, {&(0x7f0000000340)="b4c41b984999d0f22ae0a8652c4241723bafb2abfc0c6cefb4cac1c9b1c6ce734a220870622163ae660f6002c28843f998226a50ce5a7c25b51b5795954c9b4a7c74ac986a913d2e9c40a614f763e17b899da790e83c98e75b3fe9f0d72ffd6c6383f518cf60a676817dfc62cfd8670038834c08e3dcf04e86640519cedd6a6cc9920dfbfeff9645b72dcb2a548cfd7fe4002f9cdc33a1214ab90dc395c41ac61fc135e503f1f2e9afaa", 0xaa, 0xcf08, 0x2}, {&(0x7f0000000b80)="32d4889f45e46d6733b3c814ffa3ec8714c220123e79e89519a82c46485e8ca855b7a01d10408bf0d22463ea0a5b0b9fef1117c033426d8ca87a387bdc541ffecbdc2e9716bb6f318a04b3168cca67c5563258bc6aa13a7d78e1b08d01e06e48b7c0448aa0d999a594ec6dd68cceb9d2eac9a5c2b8d73b28f405a5e3d5f027d4747d42d0b76837e4e33acdc54b074946817301ac0cf672a2a4619b07", 0x9c, 0xfffffffffffffff9, 0x7}, {&(0x7f0000000c40)="8028ef083379d18393b5d3e4669cdd95af8f9c2eb285c1e224c2d76b8a423968ee045ad4f67eb8229cedc4359421b5a666c62169862fe46eca1e78ec506eaa", 0x3f, 0x1, 0x1}, {&(0x7f0000000c80)="cd609bb880c2613aa52cfe0c08fa20ef63e04e48074357f528334250ccabfe87effcf3bd7dc9155a80850ff98cc915fc10adc3c4f98443f708783c5b618f9b750ccf7d53e23bbe377644025cdb0733cb7c7c28f56fbe53bb2d60eb80c2d43b14caa6df3e66ed5782cc", 0x69, 0x3, 0x9}], 0x150000) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) madvise(&(0x7f0000a93000/0x4000)=nil, 0x4000, 0xe) mremap(&(0x7f0000a96000/0x1000)=nil, 0x1000, 0x800000, 0x3, &(0x7f0000130000/0x800000)=nil) r7 = gettid() process_vm_writev(r7, &(0x7f0000000000)=[{&(0x7f00008f9f09)=""/247, 0xf7}], 0x3cb, &(0x7f0000121000)=[{&(0x7f0000217f28)=""/231, 0xffffff4e}], 0x23a, 0x0) r8 = openat$full(0xffffffffffffff9c, &(0x7f0000000e00), 0x2000, 0x0) syz_kvm_setup_cpu$x86(r6, r8, &(0x7f0000292000/0x18000)=nil, &(0x7f0000000ec0)=[@text16={0x10, &(0x7f0000000e40)="66b80500000066b9003000000f01d926f30fa6d066b8010000000f01d9640fc73cf081954400008088b2ecc42e676664260f2002670f994bf20f22d4ba4200b80000ef", 0x43}], 0x1, 0x20, &(0x7f0000000f00)=[@flags={0x3, 0x1800}, @cr4={0x1, 0x220}], 0x2) r9 = creat(&(0x7f00000001c0)='./file0\x00', 0x0) write$uinput_user_dev(r9, &(0x7f0000000400)={'syz0\x00', {0x7, 0x6, 0x6, 0xfffa}, 0x1d, [0x200006, 0xc95a, 0xfffffff3, 0x9, 0x80, 0x2, 0x1, 0x7f, 0x6, 0x4d, 0xfffffff2, 0x5f, 0xa, 0x0, 0xffff2d37, 0x1dd2, 0x6, 0x7, 0x0, 0x80000001, 0x4, 0x7, 0x3, 0x3c57, 0x1, 0x24, 0xffffffff, 0x1, 0x1f461e2c, 0x2, 0xe661, 0x8, 0x7, 0x3, 0x7fff, 0x4c72, 0x8f00, 0x642, 0x3, 0xa, 0x0, 0x71, 0x7, 0x7, 0x103, 0x0, 0x5, 0xba1, 0x8f, 0x6, 0x6, 0x3, 0x5, 0x4, 0x8, 0x0, 0x80, 0x0, 0x5, 0x6, 0x8, 0x4, 0x5, 0x40], [0x10000007, 0xffff, 0x12f, 0x8000, 0x10, 0xfffffff3, 0x129432e6, 0xcb, 0xf9, 0xd, 0x2bf, 0x8, 0x9, 0xfffffffc, 0x3, 0x80000, 0x7, 0x0, 0x2f, 0xb, 0x312, 0x78, 0xea4, 0xa, 0x4, 0x7fffffff, 0xffffffd0, 0x9, 0x400, 0x1, 0x6, 0x1, 0xff, 0x1005, 0x7ff, 0x5f31, 0x4, 0x0, 0x6, 0x2, 0x9, 0x4, 0x9, 0x8, 0xb, 0x6, 0x5, 0x0, 0x1, 0x8000, 0xffff, 0x2, 0x77, 0x9, 0x5, 0x3, 0x4, 0x1, 0x7, 0x6, 0x9, 0x48c93690, 0x2, 0xff], [0x7, 0x4, 0x0, 0x64e, 0xfffffdfe, 0x7fffffff, 0x8d2, 0x49, 0x5, 0x7fff, 0x0, 0x5, 0xb, 0x4, 0x5, 0x5, 0x0, 0x16f, 0x5, 0x8, 0x86, 0x3, 0x0, 0x3e7, 0x2, 0x5, 0x2, 0x2, 0xf, 0x8, 0x4, 0x6d01, 0x5, 0x3b, 0x3, 0x200, 0x80, 0x3, 0x4, 0x2950bfaf, 0x0, 0xa2, 0x7, 0x53cf697b, 0x5, 0x6, 0x54fe12d2, 0xbf, 0x100b, 0x3, 0x400000, 0xfffffff9, 0x0, 0x1, 0x5, 0x0, 0x6, 0x0, 0x120000, 0x3, 0x6, 0x2, 0x4, 0x3], [0x9, 0xbb31, 0x3, 0xb, 0x5, 0x938, 0x6, 0x6, 0x0, 0x5, 0xce7, 0x1ff, 0x6, 0x7, 0x5, 0x3, 0x101, 0x10000, 0x6, 0x7fff, 0xffff, 0xa620, 0x2, 0x5, 0x1, 0x2, 0x14c, 0x60a7, 0x6, 0x6, 0xffffffff, 0x9, 0x5, 0x8, 0xc8, 0x3, 0x3, 0xffff, 0x3, 0x9, 0x100, 0x9605, 0xa, 0x2, 0x4, 0x6, 0x1, 0x10000, 0x5, 0x8, 0x2b91, 0xa1f, 0x8, 0x9, 0x1, 0x6c1b, 0x0, 0x4, 0x5, 0xb1c, 0x1, 0x200, 0xffff3441, 0xfff]}, 0x45c) r10 = openat$drirender128(0xffffffffffffff9c, &(0x7f0000000f40), 0x301001, 0x0) ioctl$DRM_IOCTL_GEM_OPEN(r9, 0xc010640b, &(0x7f0000000f80)={0x0, 0x0}) ioctl$DRM_IOCTL_GEM_FLINK(r10, 0xc008640a, &(0x7f0000000fc0)={r11}) bpf$BPF_LINK_CREATE_XDP(0x1c, &(0x7f00000012c0)={r2, 0x0, 0x30, 0xe1515f8735398fb, @val=@uprobe_multi={&(0x7f0000000140)='./file0\x00', &(0x7f0000000180)=[0x400], 0x0, 0x0, 0x1, 0x1}}, 0x40) program did not crash bisect: testing without sub-chunk 2/2 testing program (duration=31s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): [30, 24, 11, 30, 30, 30] detailed listing: executing program 2: r0 = syz_open_dev$dri(&(0x7f0000000080), 0x1, 0x0) r1 = openat(0xffffffffffffff9c, &(0x7f0000000040)='./cgroup/pids.max\x00', 0x2, 0x0) write$cgroup_pid(r1, &(0x7f00000000c0), 0x12) r2 = socket$kcm(0x11, 0x2, 0x300) r3 = socket$alg(0x26, 0x5, 0x0) bind$alg(r3, &(0x7f0000000000)={0x26, 'hash\x00', 0x0, 0x0, 'sha1-avx\x00'}, 0x58) r4 = accept4(r3, 0x0, 0x0, 0x0) recvmsg$unix(r4, &(0x7f0000000400)={0x0, 0x0, 0x0, 0x0, &(0x7f00000003c0)=[@rights={{0x14, 0x1, 0x1, [0xffffffffffffffff]}}], 0x18}, 0x0) setsockopt$sock_attach_bpf(r2, 0x107, 0x12, &(0x7f00000008c0)=r5, 0x4) r6 = bpf$OBJ_GET_MAP(0x7, &(0x7f00000003c0)=@o_path={&(0x7f0000000380)='./file0\x00', 0x0, 0x4000, r0}, 0x18) r7 = bpf$MAP_CREATE(0x0, &(0x7f0000001440)=@base={0xf, 0xa, 0xa, 0x1, 0x800, 0x1, 0xff, '\x00', 0x0, 0xffffffffffffffff, 0x1, 0x2, 0x4, 0x0, @void, @value, @void, @value}, 0x50) r8 = bpf$MAP_CREATE_RINGBUF(0x0, &(0x7f00000014c0)={0x1b, 0x0, 0x0, 0x9, 0x0, 0x1, 0x0, '\x00', 0x0, 0xffffffffffffffff, 0x0, 0x4, 0x5, 0x0, @void, @value, @void, @value}, 0x50) r9 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000300), 0x0, 0x0) r10 = ioctl$KVM_CREATE_VM(r9, 0xae01, 0x0) r11 = ioctl$KVM_CREATE_VCPU(r10, 0xae41, 0x0) r12 = dup(r11) ioctl$KVM_SET_MSRS(r12, 0x4048aecb, &(0x7f00000000c0)=ANY=[@ANYRES64=r9, @ANYRES64]) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000001600)={0x11, 0x10, &(0x7f00000002c0)=@framed={{0x18, 0x0, 0x0, 0x0, 0x2, 0x0, 0x0, 0x0, 0x3}, [@snprintf={{}, {}, {0x7, 0x0, 0xb, 0x8, 0x0, 0x0, 0x7}}]}, &(0x7f0000000140)='GPL\x00', 0x5, 0x1000, &(0x7f0000000440)=""/4096, 0x40f00, 0xa, '\x00', 0x0, 0x0, r1, 0x8, 0x0, 0x0, 0x10, &(0x7f0000000340)={0x5, 0x0, 0x3, 0x3}, 0x10, 0x0, 0x0, 0x8, &(0x7f0000001540)=[r5, r6, r7, r8, r12], &(0x7f0000001580)=[{0x4, 0x5, 0x6, 0x5}, {0x3, 0x3, 0xc, 0x5}, {0x0, 0x2, 0x8, 0x7}, {0x0, 0x5, 0xa, 0x5}, {0x1, 0xb, 0x2, 0xb}, {0x2, 0x4, 0x0, 0x7}, {0x5, 0x4, 0x6, 0x2}, {0x4, 0x5, 0xb, 0x1}], 0x10, 0x40, @void, @value}, 0x94) ioctl$DRM_IOCTL_SET_CLIENT_CAP(r0, 0x4010640d, &(0x7f0000000000)={0x3, 0x2}) r13 = socket$nl_route(0x10, 0x3, 0x0) socket$nl_netfilter(0x10, 0x3, 0xc) io_setup(0x7ff, 0x0) r14 = socket$inet6(0xa, 0x2, 0x0) r15 = dup(r14) mknod$loop(&(0x7f0000000100)='./file0\x00', 0x40, 0x1) r16 = socket$netlink(0x10, 0x3, 0xa) sendmsg$nl_route(r16, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000400)={&(0x7f0000000080)=@bridge_delneigh={0x1c, 0x1d, 0x1, 0x0, 0x0, {0x7}}, 0x1c}}, 0x0) bind$unix(r15, &(0x7f00000001c0)=@abs={0x1, 0x0, 0x4e22}, 0x6e) sendmsg$IPSET_CMD_SWAP(r15, &(0x7f0000000280)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000040)=ANY=[@ANYRESOCT=r13], 0x34}, 0x1, 0x0, 0x0, 0x240040c4}, 0x4000004) ioctl$DRM_IOCTL_MODE_ATOMIC(r0, 0xc03864bc, &(0x7f0000000180)={0x1, 0x0, 0x0, 0x0, 0x0, 0x0}) executing program 1: r0 = syz_open_dev$radio(&(0x7f0000000000), 0x3, 0x2) ioctl$VIDIOC_S_EXT_CTRLS(r0, 0xc0205648, &(0x7f0000000100)={0x9b0000, 0x1, 0x0, 0xffffffffffffffff, 0x0, &(0x7f0000000180)={0x9b090b, 0x0, '\x00', @value=0xa}}) ioctl$EVIOCGBITSW(0xffffffffffffffff, 0x80404525, &(0x7f0000000000)=""/52) preadv(0xffffffffffffffff, &(0x7f0000000080), 0x0, 0x0, 0x0) r1 = socket$inet6_tcp(0xa, 0x1, 0x0) r2 = socket$nl_generic(0x10, 0x3, 0x10) ioctl$sock_SIOCGIFVLAN_GET_VLAN_VID_CMD(r2, 0x8982, &(0x7f0000000080)) r3 = syz_genetlink_get_family_id$ethtool(&(0x7f00000007c0), 0xffffffffffffffff) sendmsg$ETHTOOL_MSG_CHANNELS_SET(r2, &(0x7f0000000ec0)={0x0, 0x0, &(0x7f0000000e80)={&(0x7f00000001c0)=ANY=[@ANYBLOB="3c000000fce274a3b11e32bfd81ab3df83e7af8f885c760322f66a9358a955aaa727876377476222215de720", @ANYRES16=r3, @ANYBLOB="01000010000000000000120000000800090000000000080007000400000018000180140002006261746164765f736c6176655f310000"], 0x3c}, 0x1, 0x0, 0x0, 0x44001}, 0x0) setsockopt$sock_int(r1, 0x1, 0x14, &(0x7f0000000040)=0x9, 0x4) listen(r1, 0x6) accept$inet6(r1, 0x0, 0x0) syz_open_dev$radio(&(0x7f0000000000), 0x3, 0x2) (async) ioctl$VIDIOC_S_EXT_CTRLS(r0, 0xc0205648, &(0x7f0000000100)={0x9b0000, 0x1, 0x0, 0xffffffffffffffff, 0x0, &(0x7f0000000180)={0x9b090b, 0x0, '\x00', @value=0xa}}) (async) ioctl$EVIOCGBITSW(0xffffffffffffffff, 0x80404525, &(0x7f0000000000)=""/52) (async) preadv(0xffffffffffffffff, &(0x7f0000000080), 0x0, 0x0, 0x0) (async) socket$inet6_tcp(0xa, 0x1, 0x0) (async) socket$nl_generic(0x10, 0x3, 0x10) (async) ioctl$sock_SIOCGIFVLAN_GET_VLAN_VID_CMD(r2, 0x8982, &(0x7f0000000080)) (async) syz_genetlink_get_family_id$ethtool(&(0x7f00000007c0), 0xffffffffffffffff) (async) sendmsg$ETHTOOL_MSG_CHANNELS_SET(r2, &(0x7f0000000ec0)={0x0, 0x0, &(0x7f0000000e80)={&(0x7f00000001c0)=ANY=[@ANYBLOB="3c000000fce274a3b11e32bfd81ab3df83e7af8f885c760322f66a9358a955aaa727876377476222215de720", @ANYRES16=r3, @ANYBLOB="01000010000000000000120000000800090000000000080007000400000018000180140002006261746164765f736c6176655f310000"], 0x3c}, 0x1, 0x0, 0x0, 0x44001}, 0x0) (async) setsockopt$sock_int(r1, 0x1, 0x14, &(0x7f0000000040)=0x9, 0x4) (async) listen(r1, 0x6) (async) accept$inet6(r1, 0x0, 0x0) (async) executing program 3: r0 = socket$inet_smc(0x2b, 0x1, 0x0) r1 = syz_init_net_socket$bt_l2cap(0x1f, 0x2, 0x0) bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x11, 0x3, &(0x7f0000000640)=ANY=[@ANYBLOB="180000000031288e8e"], &(0x7f0000000200)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @void, @value}, 0x90) connect$bt_l2cap(r1, &(0x7f0000000040)={0x1f, 0x0, @fixed={'\xaa\xaa\xaa\xaa\xaa', 0x10}, 0x7ff}, 0xe) r2 = openat$kvm(0xffffffffffffff9c, 0x0, 0x0, 0x0) r3 = syz_init_net_socket$bt_bnep(0x1f, 0x3, 0x4) ioctl$sock_bt_bnep_BNEPCONNADD(r3, 0x400442c8, &(0x7f0000000000)=ANY=[@ANYRES32=r1, @ANYBLOB='\x00\x00\x00\x00\x00', @ANYRESHEX, @ANYRES32=r2]) setsockopt$IP_VS_SO_SET_ADD(r0, 0x0, 0x482, &(0x7f0000000000)={0x6, @local, 0x0, 0x0, 'sh\x00', 0x0, 0x0, 0x35}, 0x2c) setsockopt$IP_VS_SO_SET_ADD(r0, 0x0, 0x483, &(0x7f0000000000)={0x6, @local, 0x0, 0x0, 'sh\x00'}, 0x2c) r4 = syz_open_dev$radio(&(0x7f0000000080), 0x3, 0x2) ioctl$VIDIOC_SUBDEV_G_FMT(r4, 0xc0585604, &(0x7f00000000c0)={0x1, 0x0, {0x7ff, 0xf, 0x200e, 0xb, 0x2, 0x4, 0x0, 0x5}}) executing program 1: r0 = syz_genetlink_get_family_id$ethtool(&(0x7f00000003c0), 0xffffffffffffffff) openat$nullb(0xffffffffffffff9c, &(0x7f0000000440), 0x1c1482, 0x0) r1 = openat$nullb(0xffffffffffffff9c, &(0x7f0000000040), 0x1, 0x0) ioctl$BLKZEROOUT(r1, 0x127f, &(0x7f0000000240)={0x0, 0x1000000}) sendmsg$ETHTOOL_MSG_STRSET_GET(0xffffffffffffffff, &(0x7f0000000540)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000040)=ANY=[@ANYBLOB="18000000", @ANYRES16=r0, @ANYBLOB="09030000000000fdff072000adce04000280"], 0x18}, 0x1, 0xf000000}, 0x0) openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000400)='cgroup.controllers\x00', 0x275a, 0x0) r2 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000200)='memory.swap.current\x00', 0x275a, 0x0) fchdir(0xffffffffffffffff) r3 = syz_genetlink_get_family_id$mptcp(&(0x7f0000000700), r2) sendmsg$MPTCP_PM_CMD_DEL_ADDR(0xffffffffffffffff, &(0x7f00000007c0)={&(0x7f00000006c0)={0x10, 0x0, 0x0, 0x40000}, 0xc, &(0x7f0000000780)={&(0x7f0000000480)=ANY=[@ANYBLOB="0300"/11, @ANYRES16=r3, @ANYBLOB="000129bd7000fcdbdf2502000000080004000800000008000200030000000800030004000000"], 0x2c}, 0x1, 0x0, 0x0, 0x40000}, 0x40) write$binfmt_script(r2, &(0x7f0000000000), 0x208e24b) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x2, 0x28011, r2, 0x0) preadv(r2, &(0x7f00000015c0)=[{&(0x7f0000000080)=""/124, 0xffffffff000}], 0x5, 0x0, 0x0) socket$nl_generic(0x10, 0x3, 0x10) r4 = socket$netlink(0x10, 0x3, 0x0) socket(0x10, 0x803, 0x0) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000240)={0x0}}, 0x0) getsockname$packet(0xffffffffffffffff, &(0x7f00000002c0)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000300)=0xffffff4e) sendmsg$nl_route(r4, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000980)=ANY=[@ANYBLOB="3c0000001800100000000000000000000a00000000030000000000000c00090008000000", @ANYRES32=r5, @ANYBLOB="14000500fe80000000627b00000000000000000022def77d0b43139408806b55dc7831e10a7dc40125cb228f36b3dda7388ea2912000319ba1a4d8d644ef85366ee397efd254cd6e7fac766c89557368e19de583367076431733d101000000344f9675ec680873ac9cd94fba2c6c6d748e60d1617b02e6adc79a9833becc726f3f106297d91db1a0d7d1231b271bd09c22348ac8ce3265006f0800000000000000f040d52440c67ff5407811d7953c09d170ca829808fcee72018000006bc5fc1eeeb8de9c5b4d89524a48fdf3fec1d61480591debd18b13b1f108c607d4a14c5742f8568ed07a24382a7b6e4423269a5e09bacfd1c821cc6f83678c98574eb5fb2b6877ccc02f34c1521e5b6e8e8165e19d75be8f4ba1e2e39029d40c714b36c109e10f42a8f4b717ad9e4693f54f031d3b0a"], 0x3c}, 0x1, 0x0, 0x0, 0x8010}, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000002040)='./file0\x00', 0x0) mount$tmpfs(0x0, &(0x7f0000000080)='./file0\x00', &(0x7f0000000280), 0x0, &(0x7f00000000c0)=ANY=[@ANYBLOB="6d706f6c3d62696e641a302d4e3a332f4e00"]) r6 = socket$kcm(0x10, 0x2, 0x0) sendmsg$kcm(r6, &(0x7f0000000940)={0x0, 0x0, &(0x7f0000000180)=[{}], 0x1}, 0x0) r7 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000000c0)='cgroup.controllers\x00', 0x275a, 0x0) io_setup(0x7, &(0x7f0000000100)=0x0) socket$inet6(0xa, 0x1, 0x9) io_submit(r8, 0x1, &(0x7f0000000380)=[&(0x7f0000000340)={0x0, 0x0, 0x0, 0x7, 0x2, r4, &(0x7f00000001c0)="4066462d53860daab083a0de4f4c44ad7a3f1ea42c80e16e98f51316944121c5a1e0c4e8c616", 0x26, 0xf, 0x0, 0x2}]) write$binfmt_script(r7, &(0x7f0000000500)={'#! ', '', [{0x20, 'memory.swap.current\x00'}]}, 0x19) socket$nl_rdma(0x10, 0x3, 0x14) sendmsg$RDMA_NLDEV_CMD_NEWLINK(r4, &(0x7f00000000c0)={0x0, 0x4c, &(0x7f0000000080)={&(0x7f00000004c0)={0x38, 0x1403, 0x1, 0x70bd2a, 0x25dfdbfb, "", [{{0x9, 0x2, 'syz1\x00'}, {0x8, 0x41, 'siw\x00'}, {0x14, 0x33, 'netdevsim0\x00'}}]}, 0x38}, 0x1, 0x0, 0x0, 0x8800}, 0x20000044) executing program 3: socket$inet_mptcp(0x2, 0x1, 0x106) socket$nl_generic(0x10, 0x3, 0x10) socket$inet_udp(0x2, 0x2, 0x0) socket$nl_generic(0x10, 0x3, 0x10) syz_init_net_socket$ax25(0x3, 0x5, 0x0) socket$alg(0x26, 0x5, 0x0) r0 = socket$packet(0x11, 0x3, 0x300) syz_open_dev$vim2m(&(0x7f0000000000), 0x0, 0x2) r1 = socket$vsock_stream(0x28, 0x1, 0x0) setsockopt$SO_VM_SOCKETS_CONNECT_TIMEOUT_OLD(r1, 0x28, 0x6, &(0x7f00000000c0)={0x0, 0xea60}, 0x10) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000200)={0x9, 0x4, &(0x7f0000000000)=ANY=[@ANYBLOB="18000000000000000000000000000000611948000000000095"], &(0x7f0000000080)='GPL\x00', 0x5, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0x0, @void, @value}, 0x94) socket$packet(0x11, 0x3, 0x300) socket$nl_route(0x10, 0x3, 0x0) socket$nl_route(0x10, 0x3, 0x0) socket(0x1, 0x803, 0x0) pipe(&(0x7f0000000100)) r2 = syz_open_procfs(0x0, &(0x7f00000021c0)='net/fib_triestat\x00') add_key(&(0x7f0000002100)='.dead\x00', 0x0, &(0x7f00000003c0)="4e09237282d50692dd8177cd88ec84d5b65831daeb3ab2428fe6e301f5364e9e808c904cfe56c7897e8da5bd029e86304fc396b7b7541a2b7135c4c5fe58c8bb82e9b45cd1d2853c1c22568f3f9f44b85f4e05a4589c4f71688840bad10e7e62f42fad010cee932737c512b7fbc476bafeb5cb4e9f8a01a8ca025fa4bd5ac67323c02adb999b1c37747866fe7465751a913e9a419c36b2120cc6efbf46e791760d06b3e029fd5bb96649610d2819fd10ababef8512852d12", 0xb8, 0xfffffffffffffffe) read$FUSE(r2, &(0x7f0000004480)={0x2020}, 0x2020) getsockname$packet(r0, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f00000002c0)=0x14) r3 = socket$inet6_icmp_raw(0xa, 0x3, 0x3a) ioctl$ifreq_SIOCGIFINDEX_wireguard(r3, 0x8933, &(0x7f0000000180)={'wg2\x00'}) ioctl$sock_SIOCGIFINDEX(r3, 0x8933, &(0x7f0000000240)={'dummy0\x00'}) r4 = socket$netlink(0x10, 0x3, 0x0) setsockopt$netlink_NETLINK_BROADCAST_ERROR(r4, 0x10e, 0x4, &(0x7f0000000f40)=0xe498, 0x4) r5 = socket(0x10, 0x803, 0x0) syz_genetlink_get_family_id$tipc2(&(0x7f0000000580), r5) getsockopt$IP_VS_SO_GET_SERVICES(r4, 0x0, 0x482, &(0x7f00000002c0)=""/140, &(0x7f0000000140)=0x8c) getsockname$packet(r5, &(0x7f0000000380)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) sendmsg$nl_route(r4, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000001140)={&(0x7f0000000040)=@newlink={0x20, 0x10, 0x503, 0x70bd2b, 0x29d24, {0x0, 0x0, 0x0, 0x0, 0x14415, 0x48041}}, 0x20}}, 0x4050) executing program 2: r0 = creat(&(0x7f00000002c0)='./file0\x00', 0x0) r1 = open$dir(&(0x7f0000000080)='./file0\x00', 0x0, 0x0) ioctl$TIOCL_GETSHIFTSTATE(r0, 0x541c, &(0x7f0000000300)={0x6, 0xf9}) mmap$xdp(&(0x7f0000ffc000/0x4000)=nil, 0x4000, 0x0, 0x12, r1, 0x0) add_key(&(0x7f0000000040)='dns_resolver\x00', &(0x7f0000000400)={'syz', 0x3}, &(0x7f0000000080)="000001020200", 0x6, 0xfffffffffffffffb) r2 = bpf$PROG_LOAD(0x5, &(0x7f0000000040)={0x2, 0x4, &(0x7f0000000200)=ANY=[@ANYBLOB="180000000300000000000000feffff10850000000700000095"], &(0x7f0000000000)='GPL\x00', 0x0, 0x0, 0x0, 0x100, 0x70, '\x00', 0x0, @fallback=0x30, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @void, @value}, 0x94) r3 = accept4$inet6(r0, &(0x7f0000000100)={0xa, 0x0, 0x0, @loopback}, &(0x7f0000000240)=0x1c, 0x800) r4 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000100), 0x0, 0x0) ioctl$TIOCSETD(r4, 0x5423, &(0x7f00000000c0)=0xf) ioctl$TCFLSH(r4, 0x400455c8, 0x0) r5 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) r6 = bpf$ITER_CREATE(0xb, &(0x7f0000000100), 0x8) bind$bt_hci(r5, &(0x7f0000000000)={0x1f, 0xffff, 0x3}, 0x6) setsockopt$packet_fanout_data(r6, 0x107, 0x16, &(0x7f0000000100)={0x3c, &(0x7f0000000180)=[{0x0, 0x80}, {0x1, 0x1}]}, 0x10) write$binfmt_misc(r5, &(0x7f0000000100), 0x6) ioctl$sock_inet_SIOCSIFFLAGS(r3, 0x8914, &(0x7f0000000280)={'pim6reg1\x00', 0x2}) kexec_load(0x10001, 0x7, &(0x7f0000000d00)=[{&(0x7f0000000880)="37fb79c14b452fe422d277f3feab89bd5416dfcf3bf47545e5ab096dcb018ccf5e7834151fe735f3c37c51b7a72535bc3d1eacead7abed2865da31aa63967c330aedc3705baa61a5607cd0a3a2070d37edfceeb570c4f4a4779225903bdcdbe4dd42df2455794ccc41f4f35f7dad393d2e51029b4d4bb0121453837f0c8d7f83382871fb357ccea66bf27d0105b51f7fa7efff0e8c858dd71b23ffa2276f6066701df8d656ef5e7a6668eaf28a714efaf6abc7f50e1d41f8d18212b678c2f51952f9b14cd732d94abd44ee9c6c3e70cf5e8092eefed3562b38b60acf756feb66dc1e85179ea011d05e29ff33", 0xec, 0x3, 0x1}, {&(0x7f0000000980)="48f8c31e4b57576b253e8835a21c3715777121e4dc6de0b9fafa8105e0c0df84680beb46d29d31f8ddbfe7b650c091ab6cca47192b1c695ce7b539954ebbdad07798399cb6d201b26b806df11ce19cbc0520448b0546ae61a7d3c41d94f4b8479e568ce09b2473975832593dbb2a8fc24ce235fee4f907116cb4aae39c7273cfc3250d6de2cdf5dff4eb4a1763747daccc20cb58a91676a9d65828edef6e4dca63d8c2893a333a4db2c3f68b47774b3d389b3875eaf38f6ce0294b0ca716e2241b6c", 0xc2, 0x200, 0xd}, {&(0x7f0000000a80)="d31588bf1cc6434b3a9c34146e87304d2812f1adc1fce1ada8825cb60b0f401ce94eb0bf9d06f365fc41797047fb1a1511704466190641d88412d4bfaf56b5e2f262551b745377985bae27ccbcfbf9e8dc8ee84d8cb0867f9caddd604bf6120303f320552e5f42a2afce6451e1185180fc94db6a6568c12c50c712b22770a36eb53c48ee784828ab7e25f7c78e7516f3de43a55dc0ed9a98a24c8568da239d6971cd80de47ae31eb6e122978b09fd5a7f8eca3c9e686d76fe4e9bf0283a866924077c4140803b11d", 0xc8, 0x100, 0x401}, {&(0x7f0000000340)="b4c41b984999d0f22ae0a8652c4241723bafb2abfc0c6cefb4cac1c9b1c6ce734a220870622163ae660f6002c28843f998226a50ce5a7c25b51b5795954c9b4a7c74ac986a913d2e9c40a614f763e17b899da790e83c98e75b3fe9f0d72ffd6c6383f518cf60a676817dfc62cfd8670038834c08e3dcf04e86640519cedd6a6cc9920dfbfeff9645b72dcb2a548cfd7fe4002f9cdc33a1214ab90dc395c41ac61fc135e503f1f2e9afaa", 0xaa, 0xcf08, 0x2}, {&(0x7f0000000b80)="32d4889f45e46d6733b3c814ffa3ec8714c220123e79e89519a82c46485e8ca855b7a01d10408bf0d22463ea0a5b0b9fef1117c033426d8ca87a387bdc541ffecbdc2e9716bb6f318a04b3168cca67c5563258bc6aa13a7d78e1b08d01e06e48b7c0448aa0d999a594ec6dd68cceb9d2eac9a5c2b8d73b28f405a5e3d5f027d4747d42d0b76837e4e33acdc54b074946817301ac0cf672a2a4619b07", 0x9c, 0xfffffffffffffff9, 0x7}, {&(0x7f0000000c40)="8028ef083379d18393b5d3e4669cdd95af8f9c2eb285c1e224c2d76b8a423968ee045ad4f67eb8229cedc4359421b5a666c62169862fe46eca1e78ec506eaa", 0x3f, 0x1, 0x1}, {&(0x7f0000000c80)="cd609bb880c2613aa52cfe0c08fa20ef63e04e48074357f528334250ccabfe87effcf3bd7dc9155a80850ff98cc915fc10adc3c4f98443f708783c5b618f9b750ccf7d53e23bbe377644025cdb0733cb7c7c28f56fbe53bb2d60eb80c2d43b14caa6df3e66ed5782cc", 0x69, 0x3, 0x9}], 0x150000) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) madvise(&(0x7f0000a93000/0x4000)=nil, 0x4000, 0xe) mremap(&(0x7f0000a96000/0x1000)=nil, 0x1000, 0x800000, 0x3, &(0x7f0000130000/0x800000)=nil) r7 = gettid() process_vm_writev(r7, &(0x7f0000000000)=[{&(0x7f00008f9f09)=""/247, 0xf7}], 0x3cb, &(0x7f0000121000)=[{&(0x7f0000217f28)=""/231, 0xffffff4e}], 0x23a, 0x0) r8 = openat$full(0xffffffffffffff9c, &(0x7f0000000e00), 0x2000, 0x0) syz_kvm_setup_cpu$x86(r6, r8, &(0x7f0000292000/0x18000)=nil, &(0x7f0000000ec0)=[@text16={0x10, &(0x7f0000000e40)="66b80500000066b9003000000f01d926f30fa6d066b8010000000f01d9640fc73cf081954400008088b2ecc42e676664260f2002670f994bf20f22d4ba4200b80000ef", 0x43}], 0x1, 0x20, &(0x7f0000000f00)=[@flags={0x3, 0x1800}, @cr4={0x1, 0x220}], 0x2) r9 = creat(&(0x7f00000001c0)='./file0\x00', 0x0) write$uinput_user_dev(r9, &(0x7f0000000400)={'syz0\x00', {0x7, 0x6, 0x6, 0xfffa}, 0x1d, [0x200006, 0xc95a, 0xfffffff3, 0x9, 0x80, 0x2, 0x1, 0x7f, 0x6, 0x4d, 0xfffffff2, 0x5f, 0xa, 0x0, 0xffff2d37, 0x1dd2, 0x6, 0x7, 0x0, 0x80000001, 0x4, 0x7, 0x3, 0x3c57, 0x1, 0x24, 0xffffffff, 0x1, 0x1f461e2c, 0x2, 0xe661, 0x8, 0x7, 0x3, 0x7fff, 0x4c72, 0x8f00, 0x642, 0x3, 0xa, 0x0, 0x71, 0x7, 0x7, 0x103, 0x0, 0x5, 0xba1, 0x8f, 0x6, 0x6, 0x3, 0x5, 0x4, 0x8, 0x0, 0x80, 0x0, 0x5, 0x6, 0x8, 0x4, 0x5, 0x40], [0x10000007, 0xffff, 0x12f, 0x8000, 0x10, 0xfffffff3, 0x129432e6, 0xcb, 0xf9, 0xd, 0x2bf, 0x8, 0x9, 0xfffffffc, 0x3, 0x80000, 0x7, 0x0, 0x2f, 0xb, 0x312, 0x78, 0xea4, 0xa, 0x4, 0x7fffffff, 0xffffffd0, 0x9, 0x400, 0x1, 0x6, 0x1, 0xff, 0x1005, 0x7ff, 0x5f31, 0x4, 0x0, 0x6, 0x2, 0x9, 0x4, 0x9, 0x8, 0xb, 0x6, 0x5, 0x0, 0x1, 0x8000, 0xffff, 0x2, 0x77, 0x9, 0x5, 0x3, 0x4, 0x1, 0x7, 0x6, 0x9, 0x48c93690, 0x2, 0xff], [0x7, 0x4, 0x0, 0x64e, 0xfffffdfe, 0x7fffffff, 0x8d2, 0x49, 0x5, 0x7fff, 0x0, 0x5, 0xb, 0x4, 0x5, 0x5, 0x0, 0x16f, 0x5, 0x8, 0x86, 0x3, 0x0, 0x3e7, 0x2, 0x5, 0x2, 0x2, 0xf, 0x8, 0x4, 0x6d01, 0x5, 0x3b, 0x3, 0x200, 0x80, 0x3, 0x4, 0x2950bfaf, 0x0, 0xa2, 0x7, 0x53cf697b, 0x5, 0x6, 0x54fe12d2, 0xbf, 0x100b, 0x3, 0x400000, 0xfffffff9, 0x0, 0x1, 0x5, 0x0, 0x6, 0x0, 0x120000, 0x3, 0x6, 0x2, 0x4, 0x3], [0x9, 0xbb31, 0x3, 0xb, 0x5, 0x938, 0x6, 0x6, 0x0, 0x5, 0xce7, 0x1ff, 0x6, 0x7, 0x5, 0x3, 0x101, 0x10000, 0x6, 0x7fff, 0xffff, 0xa620, 0x2, 0x5, 0x1, 0x2, 0x14c, 0x60a7, 0x6, 0x6, 0xffffffff, 0x9, 0x5, 0x8, 0xc8, 0x3, 0x3, 0xffff, 0x3, 0x9, 0x100, 0x9605, 0xa, 0x2, 0x4, 0x6, 0x1, 0x10000, 0x5, 0x8, 0x2b91, 0xa1f, 0x8, 0x9, 0x1, 0x6c1b, 0x0, 0x4, 0x5, 0xb1c, 0x1, 0x200, 0xffff3441, 0xfff]}, 0x45c) r10 = openat$drirender128(0xffffffffffffff9c, &(0x7f0000000f40), 0x301001, 0x0) ioctl$DRM_IOCTL_GEM_OPEN(r9, 0xc010640b, &(0x7f0000000f80)={0x0, 0x0}) ioctl$DRM_IOCTL_GEM_FLINK(r10, 0xc008640a, &(0x7f0000000fc0)={r11}) bpf$BPF_LINK_CREATE_XDP(0x1c, &(0x7f00000012c0)={r2, 0x0, 0x30, 0xe1515f8735398fb, @val=@uprobe_multi={&(0x7f0000000140)='./file0\x00', &(0x7f0000000180)=[0x400], 0x0, 0x0, 0x1, 0x1}}, 0x40) program crashed: KASAN: slab-use-after-free Read in netdev_unregister_kobject bisect: the chunk can be dropped bisect: split chunk #1 of len 4 into 2 parts bisect: testing without sub-chunk 1/2 testing program (duration=31s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): [30, 24, 30, 30] detailed listing: executing program 2: r0 = syz_open_dev$dri(&(0x7f0000000080), 0x1, 0x0) r1 = openat(0xffffffffffffff9c, &(0x7f0000000040)='./cgroup/pids.max\x00', 0x2, 0x0) write$cgroup_pid(r1, &(0x7f00000000c0), 0x12) r2 = socket$kcm(0x11, 0x2, 0x300) r3 = socket$alg(0x26, 0x5, 0x0) bind$alg(r3, &(0x7f0000000000)={0x26, 'hash\x00', 0x0, 0x0, 'sha1-avx\x00'}, 0x58) r4 = accept4(r3, 0x0, 0x0, 0x0) recvmsg$unix(r4, &(0x7f0000000400)={0x0, 0x0, 0x0, 0x0, &(0x7f00000003c0)=[@rights={{0x14, 0x1, 0x1, [0xffffffffffffffff]}}], 0x18}, 0x0) setsockopt$sock_attach_bpf(r2, 0x107, 0x12, &(0x7f00000008c0)=r5, 0x4) r6 = bpf$OBJ_GET_MAP(0x7, &(0x7f00000003c0)=@o_path={&(0x7f0000000380)='./file0\x00', 0x0, 0x4000, r0}, 0x18) r7 = bpf$MAP_CREATE(0x0, &(0x7f0000001440)=@base={0xf, 0xa, 0xa, 0x1, 0x800, 0x1, 0xff, '\x00', 0x0, 0xffffffffffffffff, 0x1, 0x2, 0x4, 0x0, @void, @value, @void, @value}, 0x50) r8 = bpf$MAP_CREATE_RINGBUF(0x0, &(0x7f00000014c0)={0x1b, 0x0, 0x0, 0x9, 0x0, 0x1, 0x0, '\x00', 0x0, 0xffffffffffffffff, 0x0, 0x4, 0x5, 0x0, @void, @value, @void, @value}, 0x50) r9 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000300), 0x0, 0x0) r10 = ioctl$KVM_CREATE_VM(r9, 0xae01, 0x0) r11 = ioctl$KVM_CREATE_VCPU(r10, 0xae41, 0x0) r12 = dup(r11) ioctl$KVM_SET_MSRS(r12, 0x4048aecb, &(0x7f00000000c0)=ANY=[@ANYRES64=r9, @ANYRES64]) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000001600)={0x11, 0x10, &(0x7f00000002c0)=@framed={{0x18, 0x0, 0x0, 0x0, 0x2, 0x0, 0x0, 0x0, 0x3}, [@snprintf={{}, {}, {0x7, 0x0, 0xb, 0x8, 0x0, 0x0, 0x7}}]}, &(0x7f0000000140)='GPL\x00', 0x5, 0x1000, &(0x7f0000000440)=""/4096, 0x40f00, 0xa, '\x00', 0x0, 0x0, r1, 0x8, 0x0, 0x0, 0x10, &(0x7f0000000340)={0x5, 0x0, 0x3, 0x3}, 0x10, 0x0, 0x0, 0x8, &(0x7f0000001540)=[r5, r6, r7, r8, r12], &(0x7f0000001580)=[{0x4, 0x5, 0x6, 0x5}, {0x3, 0x3, 0xc, 0x5}, {0x0, 0x2, 0x8, 0x7}, {0x0, 0x5, 0xa, 0x5}, {0x1, 0xb, 0x2, 0xb}, {0x2, 0x4, 0x0, 0x7}, {0x5, 0x4, 0x6, 0x2}, {0x4, 0x5, 0xb, 0x1}], 0x10, 0x40, @void, @value}, 0x94) ioctl$DRM_IOCTL_SET_CLIENT_CAP(r0, 0x4010640d, &(0x7f0000000000)={0x3, 0x2}) r13 = socket$nl_route(0x10, 0x3, 0x0) socket$nl_netfilter(0x10, 0x3, 0xc) io_setup(0x7ff, 0x0) r14 = socket$inet6(0xa, 0x2, 0x0) r15 = dup(r14) mknod$loop(&(0x7f0000000100)='./file0\x00', 0x40, 0x1) r16 = socket$netlink(0x10, 0x3, 0xa) sendmsg$nl_route(r16, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000400)={&(0x7f0000000080)=@bridge_delneigh={0x1c, 0x1d, 0x1, 0x0, 0x0, {0x7}}, 0x1c}}, 0x0) bind$unix(r15, &(0x7f00000001c0)=@abs={0x1, 0x0, 0x4e22}, 0x6e) sendmsg$IPSET_CMD_SWAP(r15, &(0x7f0000000280)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000040)=ANY=[@ANYRESOCT=r13], 0x34}, 0x1, 0x0, 0x0, 0x240040c4}, 0x4000004) ioctl$DRM_IOCTL_MODE_ATOMIC(r0, 0xc03864bc, &(0x7f0000000180)={0x1, 0x0, 0x0, 0x0, 0x0, 0x0}) executing program 1: r0 = syz_open_dev$radio(&(0x7f0000000000), 0x3, 0x2) ioctl$VIDIOC_S_EXT_CTRLS(r0, 0xc0205648, &(0x7f0000000100)={0x9b0000, 0x1, 0x0, 0xffffffffffffffff, 0x0, &(0x7f0000000180)={0x9b090b, 0x0, '\x00', @value=0xa}}) ioctl$EVIOCGBITSW(0xffffffffffffffff, 0x80404525, &(0x7f0000000000)=""/52) preadv(0xffffffffffffffff, &(0x7f0000000080), 0x0, 0x0, 0x0) r1 = socket$inet6_tcp(0xa, 0x1, 0x0) r2 = socket$nl_generic(0x10, 0x3, 0x10) ioctl$sock_SIOCGIFVLAN_GET_VLAN_VID_CMD(r2, 0x8982, &(0x7f0000000080)) r3 = syz_genetlink_get_family_id$ethtool(&(0x7f00000007c0), 0xffffffffffffffff) sendmsg$ETHTOOL_MSG_CHANNELS_SET(r2, &(0x7f0000000ec0)={0x0, 0x0, &(0x7f0000000e80)={&(0x7f00000001c0)=ANY=[@ANYBLOB="3c000000fce274a3b11e32bfd81ab3df83e7af8f885c760322f66a9358a955aaa727876377476222215de720", @ANYRES16=r3, @ANYBLOB="01000010000000000000120000000800090000000000080007000400000018000180140002006261746164765f736c6176655f310000"], 0x3c}, 0x1, 0x0, 0x0, 0x44001}, 0x0) setsockopt$sock_int(r1, 0x1, 0x14, &(0x7f0000000040)=0x9, 0x4) listen(r1, 0x6) accept$inet6(r1, 0x0, 0x0) syz_open_dev$radio(&(0x7f0000000000), 0x3, 0x2) (async) ioctl$VIDIOC_S_EXT_CTRLS(r0, 0xc0205648, &(0x7f0000000100)={0x9b0000, 0x1, 0x0, 0xffffffffffffffff, 0x0, &(0x7f0000000180)={0x9b090b, 0x0, '\x00', @value=0xa}}) (async) ioctl$EVIOCGBITSW(0xffffffffffffffff, 0x80404525, &(0x7f0000000000)=""/52) (async) preadv(0xffffffffffffffff, &(0x7f0000000080), 0x0, 0x0, 0x0) (async) socket$inet6_tcp(0xa, 0x1, 0x0) (async) socket$nl_generic(0x10, 0x3, 0x10) (async) ioctl$sock_SIOCGIFVLAN_GET_VLAN_VID_CMD(r2, 0x8982, &(0x7f0000000080)) (async) syz_genetlink_get_family_id$ethtool(&(0x7f00000007c0), 0xffffffffffffffff) (async) sendmsg$ETHTOOL_MSG_CHANNELS_SET(r2, &(0x7f0000000ec0)={0x0, 0x0, &(0x7f0000000e80)={&(0x7f00000001c0)=ANY=[@ANYBLOB="3c000000fce274a3b11e32bfd81ab3df83e7af8f885c760322f66a9358a955aaa727876377476222215de720", @ANYRES16=r3, @ANYBLOB="01000010000000000000120000000800090000000000080007000400000018000180140002006261746164765f736c6176655f310000"], 0x3c}, 0x1, 0x0, 0x0, 0x44001}, 0x0) (async) setsockopt$sock_int(r1, 0x1, 0x14, &(0x7f0000000040)=0x9, 0x4) (async) listen(r1, 0x6) (async) accept$inet6(r1, 0x0, 0x0) (async) executing program 3: socket$inet_mptcp(0x2, 0x1, 0x106) socket$nl_generic(0x10, 0x3, 0x10) socket$inet_udp(0x2, 0x2, 0x0) socket$nl_generic(0x10, 0x3, 0x10) syz_init_net_socket$ax25(0x3, 0x5, 0x0) socket$alg(0x26, 0x5, 0x0) r0 = socket$packet(0x11, 0x3, 0x300) syz_open_dev$vim2m(&(0x7f0000000000), 0x0, 0x2) r1 = socket$vsock_stream(0x28, 0x1, 0x0) setsockopt$SO_VM_SOCKETS_CONNECT_TIMEOUT_OLD(r1, 0x28, 0x6, &(0x7f00000000c0)={0x0, 0xea60}, 0x10) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000200)={0x9, 0x4, &(0x7f0000000000)=ANY=[@ANYBLOB="18000000000000000000000000000000611948000000000095"], &(0x7f0000000080)='GPL\x00', 0x5, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0x0, @void, @value}, 0x94) socket$packet(0x11, 0x3, 0x300) socket$nl_route(0x10, 0x3, 0x0) socket$nl_route(0x10, 0x3, 0x0) socket(0x1, 0x803, 0x0) pipe(&(0x7f0000000100)) r2 = syz_open_procfs(0x0, &(0x7f00000021c0)='net/fib_triestat\x00') add_key(&(0x7f0000002100)='.dead\x00', 0x0, &(0x7f00000003c0)="4e09237282d50692dd8177cd88ec84d5b65831daeb3ab2428fe6e301f5364e9e808c904cfe56c7897e8da5bd029e86304fc396b7b7541a2b7135c4c5fe58c8bb82e9b45cd1d2853c1c22568f3f9f44b85f4e05a4589c4f71688840bad10e7e62f42fad010cee932737c512b7fbc476bafeb5cb4e9f8a01a8ca025fa4bd5ac67323c02adb999b1c37747866fe7465751a913e9a419c36b2120cc6efbf46e791760d06b3e029fd5bb96649610d2819fd10ababef8512852d12", 0xb8, 0xfffffffffffffffe) read$FUSE(r2, &(0x7f0000004480)={0x2020}, 0x2020) getsockname$packet(r0, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f00000002c0)=0x14) r3 = socket$inet6_icmp_raw(0xa, 0x3, 0x3a) ioctl$ifreq_SIOCGIFINDEX_wireguard(r3, 0x8933, &(0x7f0000000180)={'wg2\x00'}) ioctl$sock_SIOCGIFINDEX(r3, 0x8933, &(0x7f0000000240)={'dummy0\x00'}) r4 = socket$netlink(0x10, 0x3, 0x0) setsockopt$netlink_NETLINK_BROADCAST_ERROR(r4, 0x10e, 0x4, &(0x7f0000000f40)=0xe498, 0x4) r5 = socket(0x10, 0x803, 0x0) syz_genetlink_get_family_id$tipc2(&(0x7f0000000580), r5) getsockopt$IP_VS_SO_GET_SERVICES(r4, 0x0, 0x482, &(0x7f00000002c0)=""/140, &(0x7f0000000140)=0x8c) getsockname$packet(r5, &(0x7f0000000380)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) sendmsg$nl_route(r4, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000001140)={&(0x7f0000000040)=@newlink={0x20, 0x10, 0x503, 0x70bd2b, 0x29d24, {0x0, 0x0, 0x0, 0x0, 0x14415, 0x48041}}, 0x20}}, 0x4050) executing program 2: r0 = creat(&(0x7f00000002c0)='./file0\x00', 0x0) r1 = open$dir(&(0x7f0000000080)='./file0\x00', 0x0, 0x0) ioctl$TIOCL_GETSHIFTSTATE(r0, 0x541c, &(0x7f0000000300)={0x6, 0xf9}) mmap$xdp(&(0x7f0000ffc000/0x4000)=nil, 0x4000, 0x0, 0x12, r1, 0x0) add_key(&(0x7f0000000040)='dns_resolver\x00', &(0x7f0000000400)={'syz', 0x3}, &(0x7f0000000080)="000001020200", 0x6, 0xfffffffffffffffb) r2 = bpf$PROG_LOAD(0x5, &(0x7f0000000040)={0x2, 0x4, &(0x7f0000000200)=ANY=[@ANYBLOB="180000000300000000000000feffff10850000000700000095"], &(0x7f0000000000)='GPL\x00', 0x0, 0x0, 0x0, 0x100, 0x70, '\x00', 0x0, @fallback=0x30, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @void, @value}, 0x94) r3 = accept4$inet6(r0, &(0x7f0000000100)={0xa, 0x0, 0x0, @loopback}, &(0x7f0000000240)=0x1c, 0x800) r4 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000100), 0x0, 0x0) ioctl$TIOCSETD(r4, 0x5423, &(0x7f00000000c0)=0xf) ioctl$TCFLSH(r4, 0x400455c8, 0x0) r5 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) r6 = bpf$ITER_CREATE(0xb, &(0x7f0000000100), 0x8) bind$bt_hci(r5, &(0x7f0000000000)={0x1f, 0xffff, 0x3}, 0x6) setsockopt$packet_fanout_data(r6, 0x107, 0x16, &(0x7f0000000100)={0x3c, &(0x7f0000000180)=[{0x0, 0x80}, {0x1, 0x1}]}, 0x10) write$binfmt_misc(r5, &(0x7f0000000100), 0x6) ioctl$sock_inet_SIOCSIFFLAGS(r3, 0x8914, &(0x7f0000000280)={'pim6reg1\x00', 0x2}) kexec_load(0x10001, 0x7, &(0x7f0000000d00)=[{&(0x7f0000000880)="37fb79c14b452fe422d277f3feab89bd5416dfcf3bf47545e5ab096dcb018ccf5e7834151fe735f3c37c51b7a72535bc3d1eacead7abed2865da31aa63967c330aedc3705baa61a5607cd0a3a2070d37edfceeb570c4f4a4779225903bdcdbe4dd42df2455794ccc41f4f35f7dad393d2e51029b4d4bb0121453837f0c8d7f83382871fb357ccea66bf27d0105b51f7fa7efff0e8c858dd71b23ffa2276f6066701df8d656ef5e7a6668eaf28a714efaf6abc7f50e1d41f8d18212b678c2f51952f9b14cd732d94abd44ee9c6c3e70cf5e8092eefed3562b38b60acf756feb66dc1e85179ea011d05e29ff33", 0xec, 0x3, 0x1}, {&(0x7f0000000980)="48f8c31e4b57576b253e8835a21c3715777121e4dc6de0b9fafa8105e0c0df84680beb46d29d31f8ddbfe7b650c091ab6cca47192b1c695ce7b539954ebbdad07798399cb6d201b26b806df11ce19cbc0520448b0546ae61a7d3c41d94f4b8479e568ce09b2473975832593dbb2a8fc24ce235fee4f907116cb4aae39c7273cfc3250d6de2cdf5dff4eb4a1763747daccc20cb58a91676a9d65828edef6e4dca63d8c2893a333a4db2c3f68b47774b3d389b3875eaf38f6ce0294b0ca716e2241b6c", 0xc2, 0x200, 0xd}, {&(0x7f0000000a80)="d31588bf1cc6434b3a9c34146e87304d2812f1adc1fce1ada8825cb60b0f401ce94eb0bf9d06f365fc41797047fb1a1511704466190641d88412d4bfaf56b5e2f262551b745377985bae27ccbcfbf9e8dc8ee84d8cb0867f9caddd604bf6120303f320552e5f42a2afce6451e1185180fc94db6a6568c12c50c712b22770a36eb53c48ee784828ab7e25f7c78e7516f3de43a55dc0ed9a98a24c8568da239d6971cd80de47ae31eb6e122978b09fd5a7f8eca3c9e686d76fe4e9bf0283a866924077c4140803b11d", 0xc8, 0x100, 0x401}, {&(0x7f0000000340)="b4c41b984999d0f22ae0a8652c4241723bafb2abfc0c6cefb4cac1c9b1c6ce734a220870622163ae660f6002c28843f998226a50ce5a7c25b51b5795954c9b4a7c74ac986a913d2e9c40a614f763e17b899da790e83c98e75b3fe9f0d72ffd6c6383f518cf60a676817dfc62cfd8670038834c08e3dcf04e86640519cedd6a6cc9920dfbfeff9645b72dcb2a548cfd7fe4002f9cdc33a1214ab90dc395c41ac61fc135e503f1f2e9afaa", 0xaa, 0xcf08, 0x2}, {&(0x7f0000000b80)="32d4889f45e46d6733b3c814ffa3ec8714c220123e79e89519a82c46485e8ca855b7a01d10408bf0d22463ea0a5b0b9fef1117c033426d8ca87a387bdc541ffecbdc2e9716bb6f318a04b3168cca67c5563258bc6aa13a7d78e1b08d01e06e48b7c0448aa0d999a594ec6dd68cceb9d2eac9a5c2b8d73b28f405a5e3d5f027d4747d42d0b76837e4e33acdc54b074946817301ac0cf672a2a4619b07", 0x9c, 0xfffffffffffffff9, 0x7}, {&(0x7f0000000c40)="8028ef083379d18393b5d3e4669cdd95af8f9c2eb285c1e224c2d76b8a423968ee045ad4f67eb8229cedc4359421b5a666c62169862fe46eca1e78ec506eaa", 0x3f, 0x1, 0x1}, {&(0x7f0000000c80)="cd609bb880c2613aa52cfe0c08fa20ef63e04e48074357f528334250ccabfe87effcf3bd7dc9155a80850ff98cc915fc10adc3c4f98443f708783c5b618f9b750ccf7d53e23bbe377644025cdb0733cb7c7c28f56fbe53bb2d60eb80c2d43b14caa6df3e66ed5782cc", 0x69, 0x3, 0x9}], 0x150000) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) madvise(&(0x7f0000a93000/0x4000)=nil, 0x4000, 0xe) mremap(&(0x7f0000a96000/0x1000)=nil, 0x1000, 0x800000, 0x3, &(0x7f0000130000/0x800000)=nil) r7 = gettid() process_vm_writev(r7, &(0x7f0000000000)=[{&(0x7f00008f9f09)=""/247, 0xf7}], 0x3cb, &(0x7f0000121000)=[{&(0x7f0000217f28)=""/231, 0xffffff4e}], 0x23a, 0x0) r8 = openat$full(0xffffffffffffff9c, &(0x7f0000000e00), 0x2000, 0x0) syz_kvm_setup_cpu$x86(r6, r8, &(0x7f0000292000/0x18000)=nil, &(0x7f0000000ec0)=[@text16={0x10, &(0x7f0000000e40)="66b80500000066b9003000000f01d926f30fa6d066b8010000000f01d9640fc73cf081954400008088b2ecc42e676664260f2002670f994bf20f22d4ba4200b80000ef", 0x43}], 0x1, 0x20, &(0x7f0000000f00)=[@flags={0x3, 0x1800}, @cr4={0x1, 0x220}], 0x2) r9 = creat(&(0x7f00000001c0)='./file0\x00', 0x0) write$uinput_user_dev(r9, &(0x7f0000000400)={'syz0\x00', {0x7, 0x6, 0x6, 0xfffa}, 0x1d, [0x200006, 0xc95a, 0xfffffff3, 0x9, 0x80, 0x2, 0x1, 0x7f, 0x6, 0x4d, 0xfffffff2, 0x5f, 0xa, 0x0, 0xffff2d37, 0x1dd2, 0x6, 0x7, 0x0, 0x80000001, 0x4, 0x7, 0x3, 0x3c57, 0x1, 0x24, 0xffffffff, 0x1, 0x1f461e2c, 0x2, 0xe661, 0x8, 0x7, 0x3, 0x7fff, 0x4c72, 0x8f00, 0x642, 0x3, 0xa, 0x0, 0x71, 0x7, 0x7, 0x103, 0x0, 0x5, 0xba1, 0x8f, 0x6, 0x6, 0x3, 0x5, 0x4, 0x8, 0x0, 0x80, 0x0, 0x5, 0x6, 0x8, 0x4, 0x5, 0x40], [0x10000007, 0xffff, 0x12f, 0x8000, 0x10, 0xfffffff3, 0x129432e6, 0xcb, 0xf9, 0xd, 0x2bf, 0x8, 0x9, 0xfffffffc, 0x3, 0x80000, 0x7, 0x0, 0x2f, 0xb, 0x312, 0x78, 0xea4, 0xa, 0x4, 0x7fffffff, 0xffffffd0, 0x9, 0x400, 0x1, 0x6, 0x1, 0xff, 0x1005, 0x7ff, 0x5f31, 0x4, 0x0, 0x6, 0x2, 0x9, 0x4, 0x9, 0x8, 0xb, 0x6, 0x5, 0x0, 0x1, 0x8000, 0xffff, 0x2, 0x77, 0x9, 0x5, 0x3, 0x4, 0x1, 0x7, 0x6, 0x9, 0x48c93690, 0x2, 0xff], [0x7, 0x4, 0x0, 0x64e, 0xfffffdfe, 0x7fffffff, 0x8d2, 0x49, 0x5, 0x7fff, 0x0, 0x5, 0xb, 0x4, 0x5, 0x5, 0x0, 0x16f, 0x5, 0x8, 0x86, 0x3, 0x0, 0x3e7, 0x2, 0x5, 0x2, 0x2, 0xf, 0x8, 0x4, 0x6d01, 0x5, 0x3b, 0x3, 0x200, 0x80, 0x3, 0x4, 0x2950bfaf, 0x0, 0xa2, 0x7, 0x53cf697b, 0x5, 0x6, 0x54fe12d2, 0xbf, 0x100b, 0x3, 0x400000, 0xfffffff9, 0x0, 0x1, 0x5, 0x0, 0x6, 0x0, 0x120000, 0x3, 0x6, 0x2, 0x4, 0x3], [0x9, 0xbb31, 0x3, 0xb, 0x5, 0x938, 0x6, 0x6, 0x0, 0x5, 0xce7, 0x1ff, 0x6, 0x7, 0x5, 0x3, 0x101, 0x10000, 0x6, 0x7fff, 0xffff, 0xa620, 0x2, 0x5, 0x1, 0x2, 0x14c, 0x60a7, 0x6, 0x6, 0xffffffff, 0x9, 0x5, 0x8, 0xc8, 0x3, 0x3, 0xffff, 0x3, 0x9, 0x100, 0x9605, 0xa, 0x2, 0x4, 0x6, 0x1, 0x10000, 0x5, 0x8, 0x2b91, 0xa1f, 0x8, 0x9, 0x1, 0x6c1b, 0x0, 0x4, 0x5, 0xb1c, 0x1, 0x200, 0xffff3441, 0xfff]}, 0x45c) r10 = openat$drirender128(0xffffffffffffff9c, &(0x7f0000000f40), 0x301001, 0x0) ioctl$DRM_IOCTL_GEM_OPEN(r9, 0xc010640b, &(0x7f0000000f80)={0x0, 0x0}) ioctl$DRM_IOCTL_GEM_FLINK(r10, 0xc008640a, &(0x7f0000000fc0)={r11}) bpf$BPF_LINK_CREATE_XDP(0x1c, &(0x7f00000012c0)={r2, 0x0, 0x30, 0xe1515f8735398fb, @val=@uprobe_multi={&(0x7f0000000140)='./file0\x00', &(0x7f0000000180)=[0x400], 0x0, 0x0, 0x1, 0x1}}, 0x40) program did not crash bisect: testing without sub-chunk 2/2 testing program (duration=31s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): [30, 24, 11, 30] detailed listing: executing program 2: r0 = syz_open_dev$dri(&(0x7f0000000080), 0x1, 0x0) r1 = openat(0xffffffffffffff9c, &(0x7f0000000040)='./cgroup/pids.max\x00', 0x2, 0x0) write$cgroup_pid(r1, &(0x7f00000000c0), 0x12) r2 = socket$kcm(0x11, 0x2, 0x300) r3 = socket$alg(0x26, 0x5, 0x0) bind$alg(r3, &(0x7f0000000000)={0x26, 'hash\x00', 0x0, 0x0, 'sha1-avx\x00'}, 0x58) r4 = accept4(r3, 0x0, 0x0, 0x0) recvmsg$unix(r4, &(0x7f0000000400)={0x0, 0x0, 0x0, 0x0, &(0x7f00000003c0)=[@rights={{0x14, 0x1, 0x1, [0xffffffffffffffff]}}], 0x18}, 0x0) setsockopt$sock_attach_bpf(r2, 0x107, 0x12, &(0x7f00000008c0)=r5, 0x4) r6 = bpf$OBJ_GET_MAP(0x7, &(0x7f00000003c0)=@o_path={&(0x7f0000000380)='./file0\x00', 0x0, 0x4000, r0}, 0x18) r7 = bpf$MAP_CREATE(0x0, &(0x7f0000001440)=@base={0xf, 0xa, 0xa, 0x1, 0x800, 0x1, 0xff, '\x00', 0x0, 0xffffffffffffffff, 0x1, 0x2, 0x4, 0x0, @void, @value, @void, @value}, 0x50) r8 = bpf$MAP_CREATE_RINGBUF(0x0, &(0x7f00000014c0)={0x1b, 0x0, 0x0, 0x9, 0x0, 0x1, 0x0, '\x00', 0x0, 0xffffffffffffffff, 0x0, 0x4, 0x5, 0x0, @void, @value, @void, @value}, 0x50) r9 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000300), 0x0, 0x0) r10 = ioctl$KVM_CREATE_VM(r9, 0xae01, 0x0) r11 = ioctl$KVM_CREATE_VCPU(r10, 0xae41, 0x0) r12 = dup(r11) ioctl$KVM_SET_MSRS(r12, 0x4048aecb, &(0x7f00000000c0)=ANY=[@ANYRES64=r9, @ANYRES64]) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000001600)={0x11, 0x10, &(0x7f00000002c0)=@framed={{0x18, 0x0, 0x0, 0x0, 0x2, 0x0, 0x0, 0x0, 0x3}, [@snprintf={{}, {}, {0x7, 0x0, 0xb, 0x8, 0x0, 0x0, 0x7}}]}, &(0x7f0000000140)='GPL\x00', 0x5, 0x1000, &(0x7f0000000440)=""/4096, 0x40f00, 0xa, '\x00', 0x0, 0x0, r1, 0x8, 0x0, 0x0, 0x10, &(0x7f0000000340)={0x5, 0x0, 0x3, 0x3}, 0x10, 0x0, 0x0, 0x8, &(0x7f0000001540)=[r5, r6, r7, r8, r12], &(0x7f0000001580)=[{0x4, 0x5, 0x6, 0x5}, {0x3, 0x3, 0xc, 0x5}, {0x0, 0x2, 0x8, 0x7}, {0x0, 0x5, 0xa, 0x5}, {0x1, 0xb, 0x2, 0xb}, {0x2, 0x4, 0x0, 0x7}, {0x5, 0x4, 0x6, 0x2}, {0x4, 0x5, 0xb, 0x1}], 0x10, 0x40, @void, @value}, 0x94) ioctl$DRM_IOCTL_SET_CLIENT_CAP(r0, 0x4010640d, &(0x7f0000000000)={0x3, 0x2}) r13 = socket$nl_route(0x10, 0x3, 0x0) socket$nl_netfilter(0x10, 0x3, 0xc) io_setup(0x7ff, 0x0) r14 = socket$inet6(0xa, 0x2, 0x0) r15 = dup(r14) mknod$loop(&(0x7f0000000100)='./file0\x00', 0x40, 0x1) r16 = socket$netlink(0x10, 0x3, 0xa) sendmsg$nl_route(r16, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000400)={&(0x7f0000000080)=@bridge_delneigh={0x1c, 0x1d, 0x1, 0x0, 0x0, {0x7}}, 0x1c}}, 0x0) bind$unix(r15, &(0x7f00000001c0)=@abs={0x1, 0x0, 0x4e22}, 0x6e) sendmsg$IPSET_CMD_SWAP(r15, &(0x7f0000000280)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000040)=ANY=[@ANYRESOCT=r13], 0x34}, 0x1, 0x0, 0x0, 0x240040c4}, 0x4000004) ioctl$DRM_IOCTL_MODE_ATOMIC(r0, 0xc03864bc, &(0x7f0000000180)={0x1, 0x0, 0x0, 0x0, 0x0, 0x0}) executing program 1: r0 = syz_open_dev$radio(&(0x7f0000000000), 0x3, 0x2) ioctl$VIDIOC_S_EXT_CTRLS(r0, 0xc0205648, &(0x7f0000000100)={0x9b0000, 0x1, 0x0, 0xffffffffffffffff, 0x0, &(0x7f0000000180)={0x9b090b, 0x0, '\x00', @value=0xa}}) ioctl$EVIOCGBITSW(0xffffffffffffffff, 0x80404525, &(0x7f0000000000)=""/52) preadv(0xffffffffffffffff, &(0x7f0000000080), 0x0, 0x0, 0x0) r1 = socket$inet6_tcp(0xa, 0x1, 0x0) r2 = socket$nl_generic(0x10, 0x3, 0x10) ioctl$sock_SIOCGIFVLAN_GET_VLAN_VID_CMD(r2, 0x8982, &(0x7f0000000080)) r3 = syz_genetlink_get_family_id$ethtool(&(0x7f00000007c0), 0xffffffffffffffff) sendmsg$ETHTOOL_MSG_CHANNELS_SET(r2, &(0x7f0000000ec0)={0x0, 0x0, &(0x7f0000000e80)={&(0x7f00000001c0)=ANY=[@ANYBLOB="3c000000fce274a3b11e32bfd81ab3df83e7af8f885c760322f66a9358a955aaa727876377476222215de720", @ANYRES16=r3, @ANYBLOB="01000010000000000000120000000800090000000000080007000400000018000180140002006261746164765f736c6176655f310000"], 0x3c}, 0x1, 0x0, 0x0, 0x44001}, 0x0) setsockopt$sock_int(r1, 0x1, 0x14, &(0x7f0000000040)=0x9, 0x4) listen(r1, 0x6) accept$inet6(r1, 0x0, 0x0) syz_open_dev$radio(&(0x7f0000000000), 0x3, 0x2) (async) ioctl$VIDIOC_S_EXT_CTRLS(r0, 0xc0205648, &(0x7f0000000100)={0x9b0000, 0x1, 0x0, 0xffffffffffffffff, 0x0, &(0x7f0000000180)={0x9b090b, 0x0, '\x00', @value=0xa}}) (async) ioctl$EVIOCGBITSW(0xffffffffffffffff, 0x80404525, &(0x7f0000000000)=""/52) (async) preadv(0xffffffffffffffff, &(0x7f0000000080), 0x0, 0x0, 0x0) (async) socket$inet6_tcp(0xa, 0x1, 0x0) (async) socket$nl_generic(0x10, 0x3, 0x10) (async) ioctl$sock_SIOCGIFVLAN_GET_VLAN_VID_CMD(r2, 0x8982, &(0x7f0000000080)) (async) syz_genetlink_get_family_id$ethtool(&(0x7f00000007c0), 0xffffffffffffffff) (async) sendmsg$ETHTOOL_MSG_CHANNELS_SET(r2, &(0x7f0000000ec0)={0x0, 0x0, &(0x7f0000000e80)={&(0x7f00000001c0)=ANY=[@ANYBLOB="3c000000fce274a3b11e32bfd81ab3df83e7af8f885c760322f66a9358a955aaa727876377476222215de720", @ANYRES16=r3, @ANYBLOB="01000010000000000000120000000800090000000000080007000400000018000180140002006261746164765f736c6176655f310000"], 0x3c}, 0x1, 0x0, 0x0, 0x44001}, 0x0) (async) setsockopt$sock_int(r1, 0x1, 0x14, &(0x7f0000000040)=0x9, 0x4) (async) listen(r1, 0x6) (async) accept$inet6(r1, 0x0, 0x0) (async) executing program 3: r0 = socket$inet_smc(0x2b, 0x1, 0x0) r1 = syz_init_net_socket$bt_l2cap(0x1f, 0x2, 0x0) bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x11, 0x3, &(0x7f0000000640)=ANY=[@ANYBLOB="180000000031288e8e"], &(0x7f0000000200)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @void, @value}, 0x90) connect$bt_l2cap(r1, &(0x7f0000000040)={0x1f, 0x0, @fixed={'\xaa\xaa\xaa\xaa\xaa', 0x10}, 0x7ff}, 0xe) r2 = openat$kvm(0xffffffffffffff9c, 0x0, 0x0, 0x0) r3 = syz_init_net_socket$bt_bnep(0x1f, 0x3, 0x4) ioctl$sock_bt_bnep_BNEPCONNADD(r3, 0x400442c8, &(0x7f0000000000)=ANY=[@ANYRES32=r1, @ANYBLOB='\x00\x00\x00\x00\x00', @ANYRESHEX, @ANYRES32=r2]) setsockopt$IP_VS_SO_SET_ADD(r0, 0x0, 0x482, &(0x7f0000000000)={0x6, @local, 0x0, 0x0, 'sh\x00', 0x0, 0x0, 0x35}, 0x2c) setsockopt$IP_VS_SO_SET_ADD(r0, 0x0, 0x483, &(0x7f0000000000)={0x6, @local, 0x0, 0x0, 'sh\x00'}, 0x2c) r4 = syz_open_dev$radio(&(0x7f0000000080), 0x3, 0x2) ioctl$VIDIOC_SUBDEV_G_FMT(r4, 0xc0585604, &(0x7f00000000c0)={0x1, 0x0, {0x7ff, 0xf, 0x200e, 0xb, 0x2, 0x4, 0x0, 0x5}}) executing program 1: r0 = syz_genetlink_get_family_id$ethtool(&(0x7f00000003c0), 0xffffffffffffffff) openat$nullb(0xffffffffffffff9c, &(0x7f0000000440), 0x1c1482, 0x0) r1 = openat$nullb(0xffffffffffffff9c, &(0x7f0000000040), 0x1, 0x0) ioctl$BLKZEROOUT(r1, 0x127f, &(0x7f0000000240)={0x0, 0x1000000}) sendmsg$ETHTOOL_MSG_STRSET_GET(0xffffffffffffffff, &(0x7f0000000540)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000040)=ANY=[@ANYBLOB="18000000", @ANYRES16=r0, @ANYBLOB="09030000000000fdff072000adce04000280"], 0x18}, 0x1, 0xf000000}, 0x0) openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000400)='cgroup.controllers\x00', 0x275a, 0x0) r2 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000200)='memory.swap.current\x00', 0x275a, 0x0) fchdir(0xffffffffffffffff) r3 = syz_genetlink_get_family_id$mptcp(&(0x7f0000000700), r2) sendmsg$MPTCP_PM_CMD_DEL_ADDR(0xffffffffffffffff, &(0x7f00000007c0)={&(0x7f00000006c0)={0x10, 0x0, 0x0, 0x40000}, 0xc, &(0x7f0000000780)={&(0x7f0000000480)=ANY=[@ANYBLOB="0300"/11, @ANYRES16=r3, @ANYBLOB="000129bd7000fcdbdf2502000000080004000800000008000200030000000800030004000000"], 0x2c}, 0x1, 0x0, 0x0, 0x40000}, 0x40) write$binfmt_script(r2, &(0x7f0000000000), 0x208e24b) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x2, 0x28011, r2, 0x0) preadv(r2, &(0x7f00000015c0)=[{&(0x7f0000000080)=""/124, 0xffffffff000}], 0x5, 0x0, 0x0) socket$nl_generic(0x10, 0x3, 0x10) r4 = socket$netlink(0x10, 0x3, 0x0) socket(0x10, 0x803, 0x0) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000240)={0x0}}, 0x0) getsockname$packet(0xffffffffffffffff, &(0x7f00000002c0)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000300)=0xffffff4e) sendmsg$nl_route(r4, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000980)=ANY=[@ANYBLOB="3c0000001800100000000000000000000a00000000030000000000000c00090008000000", @ANYRES32=r5, @ANYBLOB="14000500fe80000000627b00000000000000000022def77d0b43139408806b55dc7831e10a7dc40125cb228f36b3dda7388ea2912000319ba1a4d8d644ef85366ee397efd254cd6e7fac766c89557368e19de583367076431733d101000000344f9675ec680873ac9cd94fba2c6c6d748e60d1617b02e6adc79a9833becc726f3f106297d91db1a0d7d1231b271bd09c22348ac8ce3265006f0800000000000000f040d52440c67ff5407811d7953c09d170ca829808fcee72018000006bc5fc1eeeb8de9c5b4d89524a48fdf3fec1d61480591debd18b13b1f108c607d4a14c5742f8568ed07a24382a7b6e4423269a5e09bacfd1c821cc6f83678c98574eb5fb2b6877ccc02f34c1521e5b6e8e8165e19d75be8f4ba1e2e39029d40c714b36c109e10f42a8f4b717ad9e4693f54f031d3b0a"], 0x3c}, 0x1, 0x0, 0x0, 0x8010}, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000002040)='./file0\x00', 0x0) mount$tmpfs(0x0, &(0x7f0000000080)='./file0\x00', &(0x7f0000000280), 0x0, &(0x7f00000000c0)=ANY=[@ANYBLOB="6d706f6c3d62696e641a302d4e3a332f4e00"]) r6 = socket$kcm(0x10, 0x2, 0x0) sendmsg$kcm(r6, &(0x7f0000000940)={0x0, 0x0, &(0x7f0000000180)=[{}], 0x1}, 0x0) r7 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000000c0)='cgroup.controllers\x00', 0x275a, 0x0) io_setup(0x7, &(0x7f0000000100)=0x0) socket$inet6(0xa, 0x1, 0x9) io_submit(r8, 0x1, &(0x7f0000000380)=[&(0x7f0000000340)={0x0, 0x0, 0x0, 0x7, 0x2, r4, &(0x7f00000001c0)="4066462d53860daab083a0de4f4c44ad7a3f1ea42c80e16e98f51316944121c5a1e0c4e8c616", 0x26, 0xf, 0x0, 0x2}]) write$binfmt_script(r7, &(0x7f0000000500)={'#! ', '', [{0x20, 'memory.swap.current\x00'}]}, 0x19) socket$nl_rdma(0x10, 0x3, 0x14) sendmsg$RDMA_NLDEV_CMD_NEWLINK(r4, &(0x7f00000000c0)={0x0, 0x4c, &(0x7f0000000080)={&(0x7f00000004c0)={0x38, 0x1403, 0x1, 0x70bd2a, 0x25dfdbfb, "", [{{0x9, 0x2, 'syz1\x00'}, {0x8, 0x41, 'siw\x00'}, {0x14, 0x33, 'netdevsim0\x00'}}]}, 0x38}, 0x1, 0x0, 0x0, 0x8800}, 0x20000044) program crashed: KASAN: slab-use-after-free Read in netdev_unregister_kobject bisect: the chunk can be dropped bisect: split chunks (needed=true): <2>, <2> bisect: split chunk #0 of len 2 into 2 parts bisect: testing without sub-chunk 1/2 testing program (duration=30s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): [24, 11, 30] detailed listing: executing program 1: r0 = syz_open_dev$radio(&(0x7f0000000000), 0x3, 0x2) ioctl$VIDIOC_S_EXT_CTRLS(r0, 0xc0205648, &(0x7f0000000100)={0x9b0000, 0x1, 0x0, 0xffffffffffffffff, 0x0, &(0x7f0000000180)={0x9b090b, 0x0, '\x00', @value=0xa}}) ioctl$EVIOCGBITSW(0xffffffffffffffff, 0x80404525, &(0x7f0000000000)=""/52) preadv(0xffffffffffffffff, &(0x7f0000000080), 0x0, 0x0, 0x0) r1 = socket$inet6_tcp(0xa, 0x1, 0x0) r2 = socket$nl_generic(0x10, 0x3, 0x10) ioctl$sock_SIOCGIFVLAN_GET_VLAN_VID_CMD(r2, 0x8982, &(0x7f0000000080)) r3 = syz_genetlink_get_family_id$ethtool(&(0x7f00000007c0), 0xffffffffffffffff) sendmsg$ETHTOOL_MSG_CHANNELS_SET(r2, &(0x7f0000000ec0)={0x0, 0x0, &(0x7f0000000e80)={&(0x7f00000001c0)=ANY=[@ANYBLOB="3c000000fce274a3b11e32bfd81ab3df83e7af8f885c760322f66a9358a955aaa727876377476222215de720", @ANYRES16=r3, @ANYBLOB="01000010000000000000120000000800090000000000080007000400000018000180140002006261746164765f736c6176655f310000"], 0x3c}, 0x1, 0x0, 0x0, 0x44001}, 0x0) setsockopt$sock_int(r1, 0x1, 0x14, &(0x7f0000000040)=0x9, 0x4) listen(r1, 0x6) accept$inet6(r1, 0x0, 0x0) syz_open_dev$radio(&(0x7f0000000000), 0x3, 0x2) (async) ioctl$VIDIOC_S_EXT_CTRLS(r0, 0xc0205648, &(0x7f0000000100)={0x9b0000, 0x1, 0x0, 0xffffffffffffffff, 0x0, &(0x7f0000000180)={0x9b090b, 0x0, '\x00', @value=0xa}}) (async) ioctl$EVIOCGBITSW(0xffffffffffffffff, 0x80404525, &(0x7f0000000000)=""/52) (async) preadv(0xffffffffffffffff, &(0x7f0000000080), 0x0, 0x0, 0x0) (async) socket$inet6_tcp(0xa, 0x1, 0x0) (async) socket$nl_generic(0x10, 0x3, 0x10) (async) ioctl$sock_SIOCGIFVLAN_GET_VLAN_VID_CMD(r2, 0x8982, &(0x7f0000000080)) (async) syz_genetlink_get_family_id$ethtool(&(0x7f00000007c0), 0xffffffffffffffff) (async) sendmsg$ETHTOOL_MSG_CHANNELS_SET(r2, &(0x7f0000000ec0)={0x0, 0x0, &(0x7f0000000e80)={&(0x7f00000001c0)=ANY=[@ANYBLOB="3c000000fce274a3b11e32bfd81ab3df83e7af8f885c760322f66a9358a955aaa727876377476222215de720", @ANYRES16=r3, @ANYBLOB="01000010000000000000120000000800090000000000080007000400000018000180140002006261746164765f736c6176655f310000"], 0x3c}, 0x1, 0x0, 0x0, 0x44001}, 0x0) (async) setsockopt$sock_int(r1, 0x1, 0x14, &(0x7f0000000040)=0x9, 0x4) (async) listen(r1, 0x6) (async) accept$inet6(r1, 0x0, 0x0) (async) executing program 3: r0 = socket$inet_smc(0x2b, 0x1, 0x0) r1 = syz_init_net_socket$bt_l2cap(0x1f, 0x2, 0x0) bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x11, 0x3, &(0x7f0000000640)=ANY=[@ANYBLOB="180000000031288e8e"], &(0x7f0000000200)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @void, @value}, 0x90) connect$bt_l2cap(r1, &(0x7f0000000040)={0x1f, 0x0, @fixed={'\xaa\xaa\xaa\xaa\xaa', 0x10}, 0x7ff}, 0xe) r2 = openat$kvm(0xffffffffffffff9c, 0x0, 0x0, 0x0) r3 = syz_init_net_socket$bt_bnep(0x1f, 0x3, 0x4) ioctl$sock_bt_bnep_BNEPCONNADD(r3, 0x400442c8, &(0x7f0000000000)=ANY=[@ANYRES32=r1, @ANYBLOB='\x00\x00\x00\x00\x00', @ANYRESHEX, @ANYRES32=r2]) setsockopt$IP_VS_SO_SET_ADD(r0, 0x0, 0x482, &(0x7f0000000000)={0x6, @local, 0x0, 0x0, 'sh\x00', 0x0, 0x0, 0x35}, 0x2c) setsockopt$IP_VS_SO_SET_ADD(r0, 0x0, 0x483, &(0x7f0000000000)={0x6, @local, 0x0, 0x0, 'sh\x00'}, 0x2c) r4 = syz_open_dev$radio(&(0x7f0000000080), 0x3, 0x2) ioctl$VIDIOC_SUBDEV_G_FMT(r4, 0xc0585604, &(0x7f00000000c0)={0x1, 0x0, {0x7ff, 0xf, 0x200e, 0xb, 0x2, 0x4, 0x0, 0x5}}) executing program 1: r0 = syz_genetlink_get_family_id$ethtool(&(0x7f00000003c0), 0xffffffffffffffff) openat$nullb(0xffffffffffffff9c, &(0x7f0000000440), 0x1c1482, 0x0) r1 = openat$nullb(0xffffffffffffff9c, &(0x7f0000000040), 0x1, 0x0) ioctl$BLKZEROOUT(r1, 0x127f, &(0x7f0000000240)={0x0, 0x1000000}) sendmsg$ETHTOOL_MSG_STRSET_GET(0xffffffffffffffff, &(0x7f0000000540)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000040)=ANY=[@ANYBLOB="18000000", @ANYRES16=r0, @ANYBLOB="09030000000000fdff072000adce04000280"], 0x18}, 0x1, 0xf000000}, 0x0) openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000400)='cgroup.controllers\x00', 0x275a, 0x0) r2 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000200)='memory.swap.current\x00', 0x275a, 0x0) fchdir(0xffffffffffffffff) r3 = syz_genetlink_get_family_id$mptcp(&(0x7f0000000700), r2) sendmsg$MPTCP_PM_CMD_DEL_ADDR(0xffffffffffffffff, &(0x7f00000007c0)={&(0x7f00000006c0)={0x10, 0x0, 0x0, 0x40000}, 0xc, &(0x7f0000000780)={&(0x7f0000000480)=ANY=[@ANYBLOB="0300"/11, @ANYRES16=r3, @ANYBLOB="000129bd7000fcdbdf2502000000080004000800000008000200030000000800030004000000"], 0x2c}, 0x1, 0x0, 0x0, 0x40000}, 0x40) write$binfmt_script(r2, &(0x7f0000000000), 0x208e24b) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x2, 0x28011, r2, 0x0) preadv(r2, &(0x7f00000015c0)=[{&(0x7f0000000080)=""/124, 0xffffffff000}], 0x5, 0x0, 0x0) socket$nl_generic(0x10, 0x3, 0x10) r4 = socket$netlink(0x10, 0x3, 0x0) socket(0x10, 0x803, 0x0) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000240)={0x0}}, 0x0) getsockname$packet(0xffffffffffffffff, &(0x7f00000002c0)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000300)=0xffffff4e) sendmsg$nl_route(r4, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000980)=ANY=[@ANYBLOB="3c0000001800100000000000000000000a00000000030000000000000c00090008000000", @ANYRES32=r5, @ANYBLOB="14000500fe80000000627b00000000000000000022def77d0b43139408806b55dc7831e10a7dc40125cb228f36b3dda7388ea2912000319ba1a4d8d644ef85366ee397efd254cd6e7fac766c89557368e19de583367076431733d101000000344f9675ec680873ac9cd94fba2c6c6d748e60d1617b02e6adc79a9833becc726f3f106297d91db1a0d7d1231b271bd09c22348ac8ce3265006f0800000000000000f040d52440c67ff5407811d7953c09d170ca829808fcee72018000006bc5fc1eeeb8de9c5b4d89524a48fdf3fec1d61480591debd18b13b1f108c607d4a14c5742f8568ed07a24382a7b6e4423269a5e09bacfd1c821cc6f83678c98574eb5fb2b6877ccc02f34c1521e5b6e8e8165e19d75be8f4ba1e2e39029d40c714b36c109e10f42a8f4b717ad9e4693f54f031d3b0a"], 0x3c}, 0x1, 0x0, 0x0, 0x8010}, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000002040)='./file0\x00', 0x0) mount$tmpfs(0x0, &(0x7f0000000080)='./file0\x00', &(0x7f0000000280), 0x0, &(0x7f00000000c0)=ANY=[@ANYBLOB="6d706f6c3d62696e641a302d4e3a332f4e00"]) r6 = socket$kcm(0x10, 0x2, 0x0) sendmsg$kcm(r6, &(0x7f0000000940)={0x0, 0x0, &(0x7f0000000180)=[{}], 0x1}, 0x0) r7 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000000c0)='cgroup.controllers\x00', 0x275a, 0x0) io_setup(0x7, &(0x7f0000000100)=0x0) socket$inet6(0xa, 0x1, 0x9) io_submit(r8, 0x1, &(0x7f0000000380)=[&(0x7f0000000340)={0x0, 0x0, 0x0, 0x7, 0x2, r4, &(0x7f00000001c0)="4066462d53860daab083a0de4f4c44ad7a3f1ea42c80e16e98f51316944121c5a1e0c4e8c616", 0x26, 0xf, 0x0, 0x2}]) write$binfmt_script(r7, &(0x7f0000000500)={'#! ', '', [{0x20, 'memory.swap.current\x00'}]}, 0x19) socket$nl_rdma(0x10, 0x3, 0x14) sendmsg$RDMA_NLDEV_CMD_NEWLINK(r4, &(0x7f00000000c0)={0x0, 0x4c, &(0x7f0000000080)={&(0x7f00000004c0)={0x38, 0x1403, 0x1, 0x70bd2a, 0x25dfdbfb, "", [{{0x9, 0x2, 'syz1\x00'}, {0x8, 0x41, 'siw\x00'}, {0x14, 0x33, 'netdevsim0\x00'}}]}, 0x38}, 0x1, 0x0, 0x0, 0x8800}, 0x20000044) program did not crash bisect: testing without sub-chunk 2/2 testing program (duration=30s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): [30, 11, 30] detailed listing: executing program 2: r0 = syz_open_dev$dri(&(0x7f0000000080), 0x1, 0x0) r1 = openat(0xffffffffffffff9c, &(0x7f0000000040)='./cgroup/pids.max\x00', 0x2, 0x0) write$cgroup_pid(r1, &(0x7f00000000c0), 0x12) r2 = socket$kcm(0x11, 0x2, 0x300) r3 = socket$alg(0x26, 0x5, 0x0) bind$alg(r3, &(0x7f0000000000)={0x26, 'hash\x00', 0x0, 0x0, 'sha1-avx\x00'}, 0x58) r4 = accept4(r3, 0x0, 0x0, 0x0) recvmsg$unix(r4, &(0x7f0000000400)={0x0, 0x0, 0x0, 0x0, &(0x7f00000003c0)=[@rights={{0x14, 0x1, 0x1, [0xffffffffffffffff]}}], 0x18}, 0x0) setsockopt$sock_attach_bpf(r2, 0x107, 0x12, &(0x7f00000008c0)=r5, 0x4) r6 = bpf$OBJ_GET_MAP(0x7, &(0x7f00000003c0)=@o_path={&(0x7f0000000380)='./file0\x00', 0x0, 0x4000, r0}, 0x18) r7 = bpf$MAP_CREATE(0x0, &(0x7f0000001440)=@base={0xf, 0xa, 0xa, 0x1, 0x800, 0x1, 0xff, '\x00', 0x0, 0xffffffffffffffff, 0x1, 0x2, 0x4, 0x0, @void, @value, @void, @value}, 0x50) r8 = bpf$MAP_CREATE_RINGBUF(0x0, &(0x7f00000014c0)={0x1b, 0x0, 0x0, 0x9, 0x0, 0x1, 0x0, '\x00', 0x0, 0xffffffffffffffff, 0x0, 0x4, 0x5, 0x0, @void, @value, @void, @value}, 0x50) r9 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000300), 0x0, 0x0) r10 = ioctl$KVM_CREATE_VM(r9, 0xae01, 0x0) r11 = ioctl$KVM_CREATE_VCPU(r10, 0xae41, 0x0) r12 = dup(r11) ioctl$KVM_SET_MSRS(r12, 0x4048aecb, &(0x7f00000000c0)=ANY=[@ANYRES64=r9, @ANYRES64]) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000001600)={0x11, 0x10, &(0x7f00000002c0)=@framed={{0x18, 0x0, 0x0, 0x0, 0x2, 0x0, 0x0, 0x0, 0x3}, [@snprintf={{}, {}, {0x7, 0x0, 0xb, 0x8, 0x0, 0x0, 0x7}}]}, &(0x7f0000000140)='GPL\x00', 0x5, 0x1000, &(0x7f0000000440)=""/4096, 0x40f00, 0xa, '\x00', 0x0, 0x0, r1, 0x8, 0x0, 0x0, 0x10, &(0x7f0000000340)={0x5, 0x0, 0x3, 0x3}, 0x10, 0x0, 0x0, 0x8, &(0x7f0000001540)=[r5, r6, r7, r8, r12], &(0x7f0000001580)=[{0x4, 0x5, 0x6, 0x5}, {0x3, 0x3, 0xc, 0x5}, {0x0, 0x2, 0x8, 0x7}, {0x0, 0x5, 0xa, 0x5}, {0x1, 0xb, 0x2, 0xb}, {0x2, 0x4, 0x0, 0x7}, {0x5, 0x4, 0x6, 0x2}, {0x4, 0x5, 0xb, 0x1}], 0x10, 0x40, @void, @value}, 0x94) ioctl$DRM_IOCTL_SET_CLIENT_CAP(r0, 0x4010640d, &(0x7f0000000000)={0x3, 0x2}) r13 = socket$nl_route(0x10, 0x3, 0x0) socket$nl_netfilter(0x10, 0x3, 0xc) io_setup(0x7ff, 0x0) r14 = socket$inet6(0xa, 0x2, 0x0) r15 = dup(r14) mknod$loop(&(0x7f0000000100)='./file0\x00', 0x40, 0x1) r16 = socket$netlink(0x10, 0x3, 0xa) sendmsg$nl_route(r16, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000400)={&(0x7f0000000080)=@bridge_delneigh={0x1c, 0x1d, 0x1, 0x0, 0x0, {0x7}}, 0x1c}}, 0x0) bind$unix(r15, &(0x7f00000001c0)=@abs={0x1, 0x0, 0x4e22}, 0x6e) sendmsg$IPSET_CMD_SWAP(r15, &(0x7f0000000280)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000040)=ANY=[@ANYRESOCT=r13], 0x34}, 0x1, 0x0, 0x0, 0x240040c4}, 0x4000004) ioctl$DRM_IOCTL_MODE_ATOMIC(r0, 0xc03864bc, &(0x7f0000000180)={0x1, 0x0, 0x0, 0x0, 0x0, 0x0}) executing program 3: r0 = socket$inet_smc(0x2b, 0x1, 0x0) r1 = syz_init_net_socket$bt_l2cap(0x1f, 0x2, 0x0) bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x11, 0x3, &(0x7f0000000640)=ANY=[@ANYBLOB="180000000031288e8e"], &(0x7f0000000200)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @void, @value}, 0x90) connect$bt_l2cap(r1, &(0x7f0000000040)={0x1f, 0x0, @fixed={'\xaa\xaa\xaa\xaa\xaa', 0x10}, 0x7ff}, 0xe) r2 = openat$kvm(0xffffffffffffff9c, 0x0, 0x0, 0x0) r3 = syz_init_net_socket$bt_bnep(0x1f, 0x3, 0x4) ioctl$sock_bt_bnep_BNEPCONNADD(r3, 0x400442c8, &(0x7f0000000000)=ANY=[@ANYRES32=r1, @ANYBLOB='\x00\x00\x00\x00\x00', @ANYRESHEX, @ANYRES32=r2]) setsockopt$IP_VS_SO_SET_ADD(r0, 0x0, 0x482, &(0x7f0000000000)={0x6, @local, 0x0, 0x0, 'sh\x00', 0x0, 0x0, 0x35}, 0x2c) setsockopt$IP_VS_SO_SET_ADD(r0, 0x0, 0x483, &(0x7f0000000000)={0x6, @local, 0x0, 0x0, 'sh\x00'}, 0x2c) r4 = syz_open_dev$radio(&(0x7f0000000080), 0x3, 0x2) ioctl$VIDIOC_SUBDEV_G_FMT(r4, 0xc0585604, &(0x7f00000000c0)={0x1, 0x0, {0x7ff, 0xf, 0x200e, 0xb, 0x2, 0x4, 0x0, 0x5}}) executing program 1: r0 = syz_genetlink_get_family_id$ethtool(&(0x7f00000003c0), 0xffffffffffffffff) openat$nullb(0xffffffffffffff9c, &(0x7f0000000440), 0x1c1482, 0x0) r1 = openat$nullb(0xffffffffffffff9c, &(0x7f0000000040), 0x1, 0x0) ioctl$BLKZEROOUT(r1, 0x127f, &(0x7f0000000240)={0x0, 0x1000000}) sendmsg$ETHTOOL_MSG_STRSET_GET(0xffffffffffffffff, &(0x7f0000000540)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000040)=ANY=[@ANYBLOB="18000000", @ANYRES16=r0, @ANYBLOB="09030000000000fdff072000adce04000280"], 0x18}, 0x1, 0xf000000}, 0x0) openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000400)='cgroup.controllers\x00', 0x275a, 0x0) r2 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000200)='memory.swap.current\x00', 0x275a, 0x0) fchdir(0xffffffffffffffff) r3 = syz_genetlink_get_family_id$mptcp(&(0x7f0000000700), r2) sendmsg$MPTCP_PM_CMD_DEL_ADDR(0xffffffffffffffff, &(0x7f00000007c0)={&(0x7f00000006c0)={0x10, 0x0, 0x0, 0x40000}, 0xc, &(0x7f0000000780)={&(0x7f0000000480)=ANY=[@ANYBLOB="0300"/11, @ANYRES16=r3, @ANYBLOB="000129bd7000fcdbdf2502000000080004000800000008000200030000000800030004000000"], 0x2c}, 0x1, 0x0, 0x0, 0x40000}, 0x40) write$binfmt_script(r2, &(0x7f0000000000), 0x208e24b) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x2, 0x28011, r2, 0x0) preadv(r2, &(0x7f00000015c0)=[{&(0x7f0000000080)=""/124, 0xffffffff000}], 0x5, 0x0, 0x0) socket$nl_generic(0x10, 0x3, 0x10) r4 = socket$netlink(0x10, 0x3, 0x0) socket(0x10, 0x803, 0x0) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000240)={0x0}}, 0x0) getsockname$packet(0xffffffffffffffff, &(0x7f00000002c0)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000300)=0xffffff4e) sendmsg$nl_route(r4, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000980)=ANY=[@ANYBLOB="3c0000001800100000000000000000000a00000000030000000000000c00090008000000", @ANYRES32=r5, @ANYBLOB="14000500fe80000000627b00000000000000000022def77d0b43139408806b55dc7831e10a7dc40125cb228f36b3dda7388ea2912000319ba1a4d8d644ef85366ee397efd254cd6e7fac766c89557368e19de583367076431733d101000000344f9675ec680873ac9cd94fba2c6c6d748e60d1617b02e6adc79a9833becc726f3f106297d91db1a0d7d1231b271bd09c22348ac8ce3265006f0800000000000000f040d52440c67ff5407811d7953c09d170ca829808fcee72018000006bc5fc1eeeb8de9c5b4d89524a48fdf3fec1d61480591debd18b13b1f108c607d4a14c5742f8568ed07a24382a7b6e4423269a5e09bacfd1c821cc6f83678c98574eb5fb2b6877ccc02f34c1521e5b6e8e8165e19d75be8f4ba1e2e39029d40c714b36c109e10f42a8f4b717ad9e4693f54f031d3b0a"], 0x3c}, 0x1, 0x0, 0x0, 0x8010}, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000002040)='./file0\x00', 0x0) mount$tmpfs(0x0, &(0x7f0000000080)='./file0\x00', &(0x7f0000000280), 0x0, &(0x7f00000000c0)=ANY=[@ANYBLOB="6d706f6c3d62696e641a302d4e3a332f4e00"]) r6 = socket$kcm(0x10, 0x2, 0x0) sendmsg$kcm(r6, &(0x7f0000000940)={0x0, 0x0, &(0x7f0000000180)=[{}], 0x1}, 0x0) r7 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000000c0)='cgroup.controllers\x00', 0x275a, 0x0) io_setup(0x7, &(0x7f0000000100)=0x0) socket$inet6(0xa, 0x1, 0x9) io_submit(r8, 0x1, &(0x7f0000000380)=[&(0x7f0000000340)={0x0, 0x0, 0x0, 0x7, 0x2, r4, &(0x7f00000001c0)="4066462d53860daab083a0de4f4c44ad7a3f1ea42c80e16e98f51316944121c5a1e0c4e8c616", 0x26, 0xf, 0x0, 0x2}]) write$binfmt_script(r7, &(0x7f0000000500)={'#! ', '', [{0x20, 'memory.swap.current\x00'}]}, 0x19) socket$nl_rdma(0x10, 0x3, 0x14) sendmsg$RDMA_NLDEV_CMD_NEWLINK(r4, &(0x7f00000000c0)={0x0, 0x4c, &(0x7f0000000080)={&(0x7f00000004c0)={0x38, 0x1403, 0x1, 0x70bd2a, 0x25dfdbfb, "", [{{0x9, 0x2, 'syz1\x00'}, {0x8, 0x41, 'siw\x00'}, {0x14, 0x33, 'netdevsim0\x00'}}]}, 0x38}, 0x1, 0x0, 0x0, 0x8800}, 0x20000044) program crashed: KASAN: slab-use-after-free Read in netdev_unregister_kobject bisect: the chunk can be dropped bisect: split chunk #1 of len 2 into 2 parts bisect: testing without sub-chunk 1/2 testing program (duration=30s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): [30, 30] detailed listing: executing program 2: r0 = syz_open_dev$dri(&(0x7f0000000080), 0x1, 0x0) r1 = openat(0xffffffffffffff9c, &(0x7f0000000040)='./cgroup/pids.max\x00', 0x2, 0x0) write$cgroup_pid(r1, &(0x7f00000000c0), 0x12) r2 = socket$kcm(0x11, 0x2, 0x300) r3 = socket$alg(0x26, 0x5, 0x0) bind$alg(r3, &(0x7f0000000000)={0x26, 'hash\x00', 0x0, 0x0, 'sha1-avx\x00'}, 0x58) r4 = accept4(r3, 0x0, 0x0, 0x0) recvmsg$unix(r4, &(0x7f0000000400)={0x0, 0x0, 0x0, 0x0, &(0x7f00000003c0)=[@rights={{0x14, 0x1, 0x1, [0xffffffffffffffff]}}], 0x18}, 0x0) setsockopt$sock_attach_bpf(r2, 0x107, 0x12, &(0x7f00000008c0)=r5, 0x4) r6 = bpf$OBJ_GET_MAP(0x7, &(0x7f00000003c0)=@o_path={&(0x7f0000000380)='./file0\x00', 0x0, 0x4000, r0}, 0x18) r7 = bpf$MAP_CREATE(0x0, &(0x7f0000001440)=@base={0xf, 0xa, 0xa, 0x1, 0x800, 0x1, 0xff, '\x00', 0x0, 0xffffffffffffffff, 0x1, 0x2, 0x4, 0x0, @void, @value, @void, @value}, 0x50) r8 = bpf$MAP_CREATE_RINGBUF(0x0, &(0x7f00000014c0)={0x1b, 0x0, 0x0, 0x9, 0x0, 0x1, 0x0, '\x00', 0x0, 0xffffffffffffffff, 0x0, 0x4, 0x5, 0x0, @void, @value, @void, @value}, 0x50) r9 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000300), 0x0, 0x0) r10 = ioctl$KVM_CREATE_VM(r9, 0xae01, 0x0) r11 = ioctl$KVM_CREATE_VCPU(r10, 0xae41, 0x0) r12 = dup(r11) ioctl$KVM_SET_MSRS(r12, 0x4048aecb, &(0x7f00000000c0)=ANY=[@ANYRES64=r9, @ANYRES64]) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000001600)={0x11, 0x10, &(0x7f00000002c0)=@framed={{0x18, 0x0, 0x0, 0x0, 0x2, 0x0, 0x0, 0x0, 0x3}, [@snprintf={{}, {}, {0x7, 0x0, 0xb, 0x8, 0x0, 0x0, 0x7}}]}, &(0x7f0000000140)='GPL\x00', 0x5, 0x1000, &(0x7f0000000440)=""/4096, 0x40f00, 0xa, '\x00', 0x0, 0x0, r1, 0x8, 0x0, 0x0, 0x10, &(0x7f0000000340)={0x5, 0x0, 0x3, 0x3}, 0x10, 0x0, 0x0, 0x8, &(0x7f0000001540)=[r5, r6, r7, r8, r12], &(0x7f0000001580)=[{0x4, 0x5, 0x6, 0x5}, {0x3, 0x3, 0xc, 0x5}, {0x0, 0x2, 0x8, 0x7}, {0x0, 0x5, 0xa, 0x5}, {0x1, 0xb, 0x2, 0xb}, {0x2, 0x4, 0x0, 0x7}, {0x5, 0x4, 0x6, 0x2}, {0x4, 0x5, 0xb, 0x1}], 0x10, 0x40, @void, @value}, 0x94) ioctl$DRM_IOCTL_SET_CLIENT_CAP(r0, 0x4010640d, &(0x7f0000000000)={0x3, 0x2}) r13 = socket$nl_route(0x10, 0x3, 0x0) socket$nl_netfilter(0x10, 0x3, 0xc) io_setup(0x7ff, 0x0) r14 = socket$inet6(0xa, 0x2, 0x0) r15 = dup(r14) mknod$loop(&(0x7f0000000100)='./file0\x00', 0x40, 0x1) r16 = socket$netlink(0x10, 0x3, 0xa) sendmsg$nl_route(r16, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000400)={&(0x7f0000000080)=@bridge_delneigh={0x1c, 0x1d, 0x1, 0x0, 0x0, {0x7}}, 0x1c}}, 0x0) bind$unix(r15, &(0x7f00000001c0)=@abs={0x1, 0x0, 0x4e22}, 0x6e) sendmsg$IPSET_CMD_SWAP(r15, &(0x7f0000000280)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000040)=ANY=[@ANYRESOCT=r13], 0x34}, 0x1, 0x0, 0x0, 0x240040c4}, 0x4000004) ioctl$DRM_IOCTL_MODE_ATOMIC(r0, 0xc03864bc, &(0x7f0000000180)={0x1, 0x0, 0x0, 0x0, 0x0, 0x0}) executing program 1: r0 = syz_genetlink_get_family_id$ethtool(&(0x7f00000003c0), 0xffffffffffffffff) openat$nullb(0xffffffffffffff9c, &(0x7f0000000440), 0x1c1482, 0x0) r1 = openat$nullb(0xffffffffffffff9c, &(0x7f0000000040), 0x1, 0x0) ioctl$BLKZEROOUT(r1, 0x127f, &(0x7f0000000240)={0x0, 0x1000000}) sendmsg$ETHTOOL_MSG_STRSET_GET(0xffffffffffffffff, &(0x7f0000000540)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000040)=ANY=[@ANYBLOB="18000000", @ANYRES16=r0, @ANYBLOB="09030000000000fdff072000adce04000280"], 0x18}, 0x1, 0xf000000}, 0x0) openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000400)='cgroup.controllers\x00', 0x275a, 0x0) r2 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000200)='memory.swap.current\x00', 0x275a, 0x0) fchdir(0xffffffffffffffff) r3 = syz_genetlink_get_family_id$mptcp(&(0x7f0000000700), r2) sendmsg$MPTCP_PM_CMD_DEL_ADDR(0xffffffffffffffff, &(0x7f00000007c0)={&(0x7f00000006c0)={0x10, 0x0, 0x0, 0x40000}, 0xc, &(0x7f0000000780)={&(0x7f0000000480)=ANY=[@ANYBLOB="0300"/11, @ANYRES16=r3, @ANYBLOB="000129bd7000fcdbdf2502000000080004000800000008000200030000000800030004000000"], 0x2c}, 0x1, 0x0, 0x0, 0x40000}, 0x40) write$binfmt_script(r2, &(0x7f0000000000), 0x208e24b) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x2, 0x28011, r2, 0x0) preadv(r2, &(0x7f00000015c0)=[{&(0x7f0000000080)=""/124, 0xffffffff000}], 0x5, 0x0, 0x0) socket$nl_generic(0x10, 0x3, 0x10) r4 = socket$netlink(0x10, 0x3, 0x0) socket(0x10, 0x803, 0x0) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000240)={0x0}}, 0x0) getsockname$packet(0xffffffffffffffff, &(0x7f00000002c0)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000300)=0xffffff4e) sendmsg$nl_route(r4, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000980)=ANY=[@ANYBLOB="3c0000001800100000000000000000000a00000000030000000000000c00090008000000", @ANYRES32=r5, @ANYBLOB="14000500fe80000000627b00000000000000000022def77d0b43139408806b55dc7831e10a7dc40125cb228f36b3dda7388ea2912000319ba1a4d8d644ef85366ee397efd254cd6e7fac766c89557368e19de583367076431733d101000000344f9675ec680873ac9cd94fba2c6c6d748e60d1617b02e6adc79a9833becc726f3f106297d91db1a0d7d1231b271bd09c22348ac8ce3265006f0800000000000000f040d52440c67ff5407811d7953c09d170ca829808fcee72018000006bc5fc1eeeb8de9c5b4d89524a48fdf3fec1d61480591debd18b13b1f108c607d4a14c5742f8568ed07a24382a7b6e4423269a5e09bacfd1c821cc6f83678c98574eb5fb2b6877ccc02f34c1521e5b6e8e8165e19d75be8f4ba1e2e39029d40c714b36c109e10f42a8f4b717ad9e4693f54f031d3b0a"], 0x3c}, 0x1, 0x0, 0x0, 0x8010}, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000002040)='./file0\x00', 0x0) mount$tmpfs(0x0, &(0x7f0000000080)='./file0\x00', &(0x7f0000000280), 0x0, &(0x7f00000000c0)=ANY=[@ANYBLOB="6d706f6c3d62696e641a302d4e3a332f4e00"]) r6 = socket$kcm(0x10, 0x2, 0x0) sendmsg$kcm(r6, &(0x7f0000000940)={0x0, 0x0, &(0x7f0000000180)=[{}], 0x1}, 0x0) r7 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000000c0)='cgroup.controllers\x00', 0x275a, 0x0) io_setup(0x7, &(0x7f0000000100)=0x0) socket$inet6(0xa, 0x1, 0x9) io_submit(r8, 0x1, &(0x7f0000000380)=[&(0x7f0000000340)={0x0, 0x0, 0x0, 0x7, 0x2, r4, &(0x7f00000001c0)="4066462d53860daab083a0de4f4c44ad7a3f1ea42c80e16e98f51316944121c5a1e0c4e8c616", 0x26, 0xf, 0x0, 0x2}]) write$binfmt_script(r7, &(0x7f0000000500)={'#! ', '', [{0x20, 'memory.swap.current\x00'}]}, 0x19) socket$nl_rdma(0x10, 0x3, 0x14) sendmsg$RDMA_NLDEV_CMD_NEWLINK(r4, &(0x7f00000000c0)={0x0, 0x4c, &(0x7f0000000080)={&(0x7f00000004c0)={0x38, 0x1403, 0x1, 0x70bd2a, 0x25dfdbfb, "", [{{0x9, 0x2, 'syz1\x00'}, {0x8, 0x41, 'siw\x00'}, {0x14, 0x33, 'netdevsim0\x00'}}]}, 0x38}, 0x1, 0x0, 0x0, 0x8800}, 0x20000044) program did not crash bisect: testing without sub-chunk 2/2 testing program (duration=30s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): [30, 11] detailed listing: executing program 2: r0 = syz_open_dev$dri(&(0x7f0000000080), 0x1, 0x0) r1 = openat(0xffffffffffffff9c, &(0x7f0000000040)='./cgroup/pids.max\x00', 0x2, 0x0) write$cgroup_pid(r1, &(0x7f00000000c0), 0x12) r2 = socket$kcm(0x11, 0x2, 0x300) r3 = socket$alg(0x26, 0x5, 0x0) bind$alg(r3, &(0x7f0000000000)={0x26, 'hash\x00', 0x0, 0x0, 'sha1-avx\x00'}, 0x58) r4 = accept4(r3, 0x0, 0x0, 0x0) recvmsg$unix(r4, &(0x7f0000000400)={0x0, 0x0, 0x0, 0x0, &(0x7f00000003c0)=[@rights={{0x14, 0x1, 0x1, [0xffffffffffffffff]}}], 0x18}, 0x0) setsockopt$sock_attach_bpf(r2, 0x107, 0x12, &(0x7f00000008c0)=r5, 0x4) r6 = bpf$OBJ_GET_MAP(0x7, &(0x7f00000003c0)=@o_path={&(0x7f0000000380)='./file0\x00', 0x0, 0x4000, r0}, 0x18) r7 = bpf$MAP_CREATE(0x0, &(0x7f0000001440)=@base={0xf, 0xa, 0xa, 0x1, 0x800, 0x1, 0xff, '\x00', 0x0, 0xffffffffffffffff, 0x1, 0x2, 0x4, 0x0, @void, @value, @void, @value}, 0x50) r8 = bpf$MAP_CREATE_RINGBUF(0x0, &(0x7f00000014c0)={0x1b, 0x0, 0x0, 0x9, 0x0, 0x1, 0x0, '\x00', 0x0, 0xffffffffffffffff, 0x0, 0x4, 0x5, 0x0, @void, @value, @void, @value}, 0x50) r9 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000300), 0x0, 0x0) r10 = ioctl$KVM_CREATE_VM(r9, 0xae01, 0x0) r11 = ioctl$KVM_CREATE_VCPU(r10, 0xae41, 0x0) r12 = dup(r11) ioctl$KVM_SET_MSRS(r12, 0x4048aecb, &(0x7f00000000c0)=ANY=[@ANYRES64=r9, @ANYRES64]) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000001600)={0x11, 0x10, &(0x7f00000002c0)=@framed={{0x18, 0x0, 0x0, 0x0, 0x2, 0x0, 0x0, 0x0, 0x3}, [@snprintf={{}, {}, {0x7, 0x0, 0xb, 0x8, 0x0, 0x0, 0x7}}]}, &(0x7f0000000140)='GPL\x00', 0x5, 0x1000, &(0x7f0000000440)=""/4096, 0x40f00, 0xa, '\x00', 0x0, 0x0, r1, 0x8, 0x0, 0x0, 0x10, &(0x7f0000000340)={0x5, 0x0, 0x3, 0x3}, 0x10, 0x0, 0x0, 0x8, &(0x7f0000001540)=[r5, r6, r7, r8, r12], &(0x7f0000001580)=[{0x4, 0x5, 0x6, 0x5}, {0x3, 0x3, 0xc, 0x5}, {0x0, 0x2, 0x8, 0x7}, {0x0, 0x5, 0xa, 0x5}, {0x1, 0xb, 0x2, 0xb}, {0x2, 0x4, 0x0, 0x7}, {0x5, 0x4, 0x6, 0x2}, {0x4, 0x5, 0xb, 0x1}], 0x10, 0x40, @void, @value}, 0x94) ioctl$DRM_IOCTL_SET_CLIENT_CAP(r0, 0x4010640d, &(0x7f0000000000)={0x3, 0x2}) r13 = socket$nl_route(0x10, 0x3, 0x0) socket$nl_netfilter(0x10, 0x3, 0xc) io_setup(0x7ff, 0x0) r14 = socket$inet6(0xa, 0x2, 0x0) r15 = dup(r14) mknod$loop(&(0x7f0000000100)='./file0\x00', 0x40, 0x1) r16 = socket$netlink(0x10, 0x3, 0xa) sendmsg$nl_route(r16, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000400)={&(0x7f0000000080)=@bridge_delneigh={0x1c, 0x1d, 0x1, 0x0, 0x0, {0x7}}, 0x1c}}, 0x0) bind$unix(r15, &(0x7f00000001c0)=@abs={0x1, 0x0, 0x4e22}, 0x6e) sendmsg$IPSET_CMD_SWAP(r15, &(0x7f0000000280)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000040)=ANY=[@ANYRESOCT=r13], 0x34}, 0x1, 0x0, 0x0, 0x240040c4}, 0x4000004) ioctl$DRM_IOCTL_MODE_ATOMIC(r0, 0xc03864bc, &(0x7f0000000180)={0x1, 0x0, 0x0, 0x0, 0x0, 0x0}) executing program 3: r0 = socket$inet_smc(0x2b, 0x1, 0x0) r1 = syz_init_net_socket$bt_l2cap(0x1f, 0x2, 0x0) bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x11, 0x3, &(0x7f0000000640)=ANY=[@ANYBLOB="180000000031288e8e"], &(0x7f0000000200)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @void, @value}, 0x90) connect$bt_l2cap(r1, &(0x7f0000000040)={0x1f, 0x0, @fixed={'\xaa\xaa\xaa\xaa\xaa', 0x10}, 0x7ff}, 0xe) r2 = openat$kvm(0xffffffffffffff9c, 0x0, 0x0, 0x0) r3 = syz_init_net_socket$bt_bnep(0x1f, 0x3, 0x4) ioctl$sock_bt_bnep_BNEPCONNADD(r3, 0x400442c8, &(0x7f0000000000)=ANY=[@ANYRES32=r1, @ANYBLOB='\x00\x00\x00\x00\x00', @ANYRESHEX, @ANYRES32=r2]) setsockopt$IP_VS_SO_SET_ADD(r0, 0x0, 0x482, &(0x7f0000000000)={0x6, @local, 0x0, 0x0, 'sh\x00', 0x0, 0x0, 0x35}, 0x2c) setsockopt$IP_VS_SO_SET_ADD(r0, 0x0, 0x483, &(0x7f0000000000)={0x6, @local, 0x0, 0x0, 'sh\x00'}, 0x2c) r4 = syz_open_dev$radio(&(0x7f0000000080), 0x3, 0x2) ioctl$VIDIOC_SUBDEV_G_FMT(r4, 0xc0585604, &(0x7f00000000c0)={0x1, 0x0, {0x7ff, 0xf, 0x200e, 0xb, 0x2, 0x4, 0x0, 0x5}}) program crashed: KASAN: slab-use-after-free Read in netdev_unregister_kobject bisect: the chunk can be dropped bisect: split chunks (needed=true): <1>, <1> bisect: split chunk #0 of len 1 into 2 parts bisect: no way to further split the chunk bisect: split chunk #1 of len 1 into 2 parts bisect: no way to further split the chunk bisect: 2 programs left: executing program 2: r0 = syz_open_dev$dri(&(0x7f0000000080), 0x1, 0x0) r1 = openat(0xffffffffffffff9c, &(0x7f0000000040)='./cgroup/pids.max\x00', 0x2, 0x0) write$cgroup_pid(r1, &(0x7f00000000c0), 0x12) r2 = socket$kcm(0x11, 0x2, 0x300) r3 = socket$alg(0x26, 0x5, 0x0) bind$alg(r3, &(0x7f0000000000)={0x26, 'hash\x00', 0x0, 0x0, 'sha1-avx\x00'}, 0x58) r4 = accept4(r3, 0x0, 0x0, 0x0) recvmsg$unix(r4, &(0x7f0000000400)={0x0, 0x0, 0x0, 0x0, &(0x7f00000003c0)=[@rights={{0x14, 0x1, 0x1, [0xffffffffffffffff]}}], 0x18}, 0x0) setsockopt$sock_attach_bpf(r2, 0x107, 0x12, &(0x7f00000008c0)=r5, 0x4) r6 = bpf$OBJ_GET_MAP(0x7, &(0x7f00000003c0)=@o_path={&(0x7f0000000380)='./file0\x00', 0x0, 0x4000, r0}, 0x18) r7 = bpf$MAP_CREATE(0x0, &(0x7f0000001440)=@base={0xf, 0xa, 0xa, 0x1, 0x800, 0x1, 0xff, '\x00', 0x0, 0xffffffffffffffff, 0x1, 0x2, 0x4, 0x0, @void, @value, @void, @value}, 0x50) r8 = bpf$MAP_CREATE_RINGBUF(0x0, &(0x7f00000014c0)={0x1b, 0x0, 0x0, 0x9, 0x0, 0x1, 0x0, '\x00', 0x0, 0xffffffffffffffff, 0x0, 0x4, 0x5, 0x0, @void, @value, @void, @value}, 0x50) r9 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000300), 0x0, 0x0) r10 = ioctl$KVM_CREATE_VM(r9, 0xae01, 0x0) r11 = ioctl$KVM_CREATE_VCPU(r10, 0xae41, 0x0) r12 = dup(r11) ioctl$KVM_SET_MSRS(r12, 0x4048aecb, &(0x7f00000000c0)=ANY=[@ANYRES64=r9, @ANYRES64]) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000001600)={0x11, 0x10, &(0x7f00000002c0)=@framed={{0x18, 0x0, 0x0, 0x0, 0x2, 0x0, 0x0, 0x0, 0x3}, [@snprintf={{}, {}, {0x7, 0x0, 0xb, 0x8, 0x0, 0x0, 0x7}}]}, &(0x7f0000000140)='GPL\x00', 0x5, 0x1000, &(0x7f0000000440)=""/4096, 0x40f00, 0xa, '\x00', 0x0, 0x0, r1, 0x8, 0x0, 0x0, 0x10, &(0x7f0000000340)={0x5, 0x0, 0x3, 0x3}, 0x10, 0x0, 0x0, 0x8, &(0x7f0000001540)=[r5, r6, r7, r8, r12], &(0x7f0000001580)=[{0x4, 0x5, 0x6, 0x5}, {0x3, 0x3, 0xc, 0x5}, {0x0, 0x2, 0x8, 0x7}, {0x0, 0x5, 0xa, 0x5}, {0x1, 0xb, 0x2, 0xb}, {0x2, 0x4, 0x0, 0x7}, {0x5, 0x4, 0x6, 0x2}, {0x4, 0x5, 0xb, 0x1}], 0x10, 0x40, @void, @value}, 0x94) ioctl$DRM_IOCTL_SET_CLIENT_CAP(r0, 0x4010640d, &(0x7f0000000000)={0x3, 0x2}) r13 = socket$nl_route(0x10, 0x3, 0x0) socket$nl_netfilter(0x10, 0x3, 0xc) io_setup(0x7ff, 0x0) r14 = socket$inet6(0xa, 0x2, 0x0) r15 = dup(r14) mknod$loop(&(0x7f0000000100)='./file0\x00', 0x40, 0x1) r16 = socket$netlink(0x10, 0x3, 0xa) sendmsg$nl_route(r16, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000400)={&(0x7f0000000080)=@bridge_delneigh={0x1c, 0x1d, 0x1, 0x0, 0x0, {0x7}}, 0x1c}}, 0x0) bind$unix(r15, &(0x7f00000001c0)=@abs={0x1, 0x0, 0x4e22}, 0x6e) sendmsg$IPSET_CMD_SWAP(r15, &(0x7f0000000280)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000040)=ANY=[@ANYRESOCT=r13], 0x34}, 0x1, 0x0, 0x0, 0x240040c4}, 0x4000004) ioctl$DRM_IOCTL_MODE_ATOMIC(r0, 0xc03864bc, &(0x7f0000000180)={0x1, 0x0, 0x0, 0x0, 0x0, 0x0}) executing program 3: r0 = socket$inet_smc(0x2b, 0x1, 0x0) r1 = syz_init_net_socket$bt_l2cap(0x1f, 0x2, 0x0) bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x11, 0x3, &(0x7f0000000640)=ANY=[@ANYBLOB="180000000031288e8e"], &(0x7f0000000200)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @void, @value}, 0x90) connect$bt_l2cap(r1, &(0x7f0000000040)={0x1f, 0x0, @fixed={'\xaa\xaa\xaa\xaa\xaa', 0x10}, 0x7ff}, 0xe) r2 = openat$kvm(0xffffffffffffff9c, 0x0, 0x0, 0x0) r3 = syz_init_net_socket$bt_bnep(0x1f, 0x3, 0x4) ioctl$sock_bt_bnep_BNEPCONNADD(r3, 0x400442c8, &(0x7f0000000000)=ANY=[@ANYRES32=r1, @ANYBLOB='\x00\x00\x00\x00\x00', @ANYRESHEX, @ANYRES32=r2]) setsockopt$IP_VS_SO_SET_ADD(r0, 0x0, 0x482, &(0x7f0000000000)={0x6, @local, 0x0, 0x0, 'sh\x00', 0x0, 0x0, 0x35}, 0x2c) setsockopt$IP_VS_SO_SET_ADD(r0, 0x0, 0x483, &(0x7f0000000000)={0x6, @local, 0x0, 0x0, 'sh\x00'}, 0x2c) r4 = syz_open_dev$radio(&(0x7f0000000080), 0x3, 0x2) ioctl$VIDIOC_SUBDEV_G_FMT(r4, 0xc0585604, &(0x7f00000000c0)={0x1, 0x0, {0x7ff, 0xf, 0x200e, 0xb, 0x2, 0x4, 0x0, 0x5}}) bisect: trying to concatenate bisect: concatenate 2 entries minimizing program #0 before concatenation testing program (duration=45s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): [29, 11] detailed listing: executing program 0: r0 = syz_open_dev$dri(&(0x7f0000000080), 0x1, 0x0) r1 = openat(0xffffffffffffff9c, &(0x7f0000000040)='./cgroup/pids.max\x00', 0x2, 0x0) write$cgroup_pid(r1, &(0x7f00000000c0), 0x12) r2 = socket$kcm(0x11, 0x2, 0x300) r3 = socket$alg(0x26, 0x5, 0x0) bind$alg(r3, &(0x7f0000000000)={0x26, 'hash\x00', 0x0, 0x0, 'sha1-avx\x00'}, 0x58) r4 = accept4(r3, 0x0, 0x0, 0x0) recvmsg$unix(r4, &(0x7f0000000400)={0x0, 0x0, 0x0, 0x0, &(0x7f00000003c0)=[@rights={{0x14, 0x1, 0x1, [0xffffffffffffffff]}}], 0x18}, 0x0) setsockopt$sock_attach_bpf(r2, 0x107, 0x12, &(0x7f00000008c0)=r5, 0x4) r6 = bpf$OBJ_GET_MAP(0x7, &(0x7f00000003c0)=@o_path={&(0x7f0000000380)='./file0\x00', 0x0, 0x4000, r0}, 0x18) r7 = bpf$MAP_CREATE(0x0, &(0x7f0000001440)=@base={0xf, 0xa, 0xa, 0x1, 0x800, 0x1, 0xff, '\x00', 0x0, 0xffffffffffffffff, 0x1, 0x2, 0x4, 0x0, @void, @value, @void, @value}, 0x50) r8 = bpf$MAP_CREATE_RINGBUF(0x0, &(0x7f00000014c0)={0x1b, 0x0, 0x0, 0x9, 0x0, 0x1, 0x0, '\x00', 0x0, 0xffffffffffffffff, 0x0, 0x4, 0x5, 0x0, @void, @value, @void, @value}, 0x50) r9 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000300), 0x0, 0x0) r10 = ioctl$KVM_CREATE_VM(r9, 0xae01, 0x0) r11 = ioctl$KVM_CREATE_VCPU(r10, 0xae41, 0x0) r12 = dup(r11) ioctl$KVM_SET_MSRS(r12, 0x4048aecb, &(0x7f00000000c0)=ANY=[@ANYRES64=r9, @ANYRES64]) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000001600)={0x11, 0x10, &(0x7f00000002c0)=@framed={{0x18, 0x0, 0x0, 0x0, 0x2, 0x0, 0x0, 0x0, 0x3}, [@snprintf={{}, {}, {0x7, 0x0, 0xb, 0x8, 0x0, 0x0, 0x7}}]}, &(0x7f0000000140)='GPL\x00', 0x5, 0x1000, &(0x7f0000000440)=""/4096, 0x40f00, 0xa, '\x00', 0x0, 0x0, r1, 0x8, 0x0, 0x0, 0x10, &(0x7f0000000340)={0x5, 0x0, 0x3, 0x3}, 0x10, 0x0, 0x0, 0x8, &(0x7f0000001540)=[r5, r6, r7, r8, r12], &(0x7f0000001580)=[{0x4, 0x5, 0x6, 0x5}, {0x3, 0x3, 0xc, 0x5}, {0x0, 0x2, 0x8, 0x7}, {0x0, 0x5, 0xa, 0x5}, {0x1, 0xb, 0x2, 0xb}, {0x2, 0x4, 0x0, 0x7}, {0x5, 0x4, 0x6, 0x2}, {0x4, 0x5, 0xb, 0x1}], 0x10, 0x40, @void, @value}, 0x94) ioctl$DRM_IOCTL_SET_CLIENT_CAP(r0, 0x4010640d, &(0x7f0000000000)={0x3, 0x2}) r13 = socket$nl_route(0x10, 0x3, 0x0) socket$nl_netfilter(0x10, 0x3, 0xc) io_setup(0x7ff, 0x0) r14 = socket$inet6(0xa, 0x2, 0x0) r15 = dup(r14) mknod$loop(&(0x7f0000000100)='./file0\x00', 0x40, 0x1) r16 = socket$netlink(0x10, 0x3, 0xa) sendmsg$nl_route(r16, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000400)={&(0x7f0000000080)=@bridge_delneigh={0x1c, 0x1d, 0x1, 0x0, 0x0, {0x7}}, 0x1c}}, 0x0) bind$unix(r15, &(0x7f00000001c0)=@abs={0x1, 0x0, 0x4e22}, 0x6e) sendmsg$IPSET_CMD_SWAP(r15, &(0x7f0000000280)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000040)=ANY=[@ANYRESOCT=r13], 0x34}, 0x1, 0x0, 0x0, 0x240040c4}, 0x4000004) executing program 3: r0 = socket$inet_smc(0x2b, 0x1, 0x0) r1 = syz_init_net_socket$bt_l2cap(0x1f, 0x2, 0x0) bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x11, 0x3, &(0x7f0000000640)=ANY=[@ANYBLOB="180000000031288e8e"], &(0x7f0000000200)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @void, @value}, 0x90) connect$bt_l2cap(r1, &(0x7f0000000040)={0x1f, 0x0, @fixed={'\xaa\xaa\xaa\xaa\xaa', 0x10}, 0x7ff}, 0xe) r2 = openat$kvm(0xffffffffffffff9c, 0x0, 0x0, 0x0) r3 = syz_init_net_socket$bt_bnep(0x1f, 0x3, 0x4) ioctl$sock_bt_bnep_BNEPCONNADD(r3, 0x400442c8, &(0x7f0000000000)=ANY=[@ANYRES32=r1, @ANYBLOB='\x00\x00\x00\x00\x00', @ANYRESHEX, @ANYRES32=r2]) setsockopt$IP_VS_SO_SET_ADD(r0, 0x0, 0x482, &(0x7f0000000000)={0x6, @local, 0x0, 0x0, 'sh\x00', 0x0, 0x0, 0x35}, 0x2c) setsockopt$IP_VS_SO_SET_ADD(r0, 0x0, 0x483, &(0x7f0000000000)={0x6, @local, 0x0, 0x0, 'sh\x00'}, 0x2c) r4 = syz_open_dev$radio(&(0x7f0000000080), 0x3, 0x2) ioctl$VIDIOC_SUBDEV_G_FMT(r4, 0xc0585604, &(0x7f00000000c0)={0x1, 0x0, {0x7ff, 0xf, 0x200e, 0xb, 0x2, 0x4, 0x0, 0x5}}) program crashed: KASAN: slab-use-after-free Read in netdev_unregister_kobject testing program (duration=45s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): [28, 11] detailed listing: executing program 0: r0 = syz_open_dev$dri(&(0x7f0000000080), 0x1, 0x0) r1 = openat(0xffffffffffffff9c, &(0x7f0000000040)='./cgroup/pids.max\x00', 0x2, 0x0) write$cgroup_pid(r1, &(0x7f00000000c0), 0x12) r2 = socket$kcm(0x11, 0x2, 0x300) r3 = socket$alg(0x26, 0x5, 0x0) bind$alg(r3, &(0x7f0000000000)={0x26, 'hash\x00', 0x0, 0x0, 'sha1-avx\x00'}, 0x58) r4 = accept4(r3, 0x0, 0x0, 0x0) recvmsg$unix(r4, &(0x7f0000000400)={0x0, 0x0, 0x0, 0x0, &(0x7f00000003c0)=[@rights={{0x14, 0x1, 0x1, [0xffffffffffffffff]}}], 0x18}, 0x0) setsockopt$sock_attach_bpf(r2, 0x107, 0x12, &(0x7f00000008c0)=r5, 0x4) r6 = bpf$OBJ_GET_MAP(0x7, &(0x7f00000003c0)=@o_path={&(0x7f0000000380)='./file0\x00', 0x0, 0x4000, r0}, 0x18) r7 = bpf$MAP_CREATE(0x0, &(0x7f0000001440)=@base={0xf, 0xa, 0xa, 0x1, 0x800, 0x1, 0xff, '\x00', 0x0, 0xffffffffffffffff, 0x1, 0x2, 0x4, 0x0, @void, @value, @void, @value}, 0x50) r8 = bpf$MAP_CREATE_RINGBUF(0x0, &(0x7f00000014c0)={0x1b, 0x0, 0x0, 0x9, 0x0, 0x1, 0x0, '\x00', 0x0, 0xffffffffffffffff, 0x0, 0x4, 0x5, 0x0, @void, @value, @void, @value}, 0x50) r9 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000300), 0x0, 0x0) r10 = ioctl$KVM_CREATE_VM(r9, 0xae01, 0x0) r11 = ioctl$KVM_CREATE_VCPU(r10, 0xae41, 0x0) r12 = dup(r11) ioctl$KVM_SET_MSRS(r12, 0x4048aecb, &(0x7f00000000c0)=ANY=[@ANYRES64=r9, @ANYRES64]) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000001600)={0x11, 0x10, &(0x7f00000002c0)=@framed={{0x18, 0x0, 0x0, 0x0, 0x2, 0x0, 0x0, 0x0, 0x3}, [@snprintf={{}, {}, {0x7, 0x0, 0xb, 0x8, 0x0, 0x0, 0x7}}]}, &(0x7f0000000140)='GPL\x00', 0x5, 0x1000, &(0x7f0000000440)=""/4096, 0x40f00, 0xa, '\x00', 0x0, 0x0, r1, 0x8, 0x0, 0x0, 0x10, &(0x7f0000000340)={0x5, 0x0, 0x3, 0x3}, 0x10, 0x0, 0x0, 0x8, &(0x7f0000001540)=[r5, r6, r7, r8, r12], &(0x7f0000001580)=[{0x4, 0x5, 0x6, 0x5}, {0x3, 0x3, 0xc, 0x5}, {0x0, 0x2, 0x8, 0x7}, {0x0, 0x5, 0xa, 0x5}, {0x1, 0xb, 0x2, 0xb}, {0x2, 0x4, 0x0, 0x7}, {0x5, 0x4, 0x6, 0x2}, {0x4, 0x5, 0xb, 0x1}], 0x10, 0x40, @void, @value}, 0x94) ioctl$DRM_IOCTL_SET_CLIENT_CAP(r0, 0x4010640d, &(0x7f0000000000)={0x3, 0x2}) socket$nl_route(0x10, 0x3, 0x0) socket$nl_netfilter(0x10, 0x3, 0xc) io_setup(0x7ff, 0x0) r13 = socket$inet6(0xa, 0x2, 0x0) r14 = dup(r13) mknod$loop(&(0x7f0000000100)='./file0\x00', 0x40, 0x1) r15 = socket$netlink(0x10, 0x3, 0xa) sendmsg$nl_route(r15, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000400)={&(0x7f0000000080)=@bridge_delneigh={0x1c, 0x1d, 0x1, 0x0, 0x0, {0x7}}, 0x1c}}, 0x0) bind$unix(r14, &(0x7f00000001c0)=@abs={0x1, 0x0, 0x4e22}, 0x6e) executing program 3: r0 = socket$inet_smc(0x2b, 0x1, 0x0) r1 = syz_init_net_socket$bt_l2cap(0x1f, 0x2, 0x0) bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x11, 0x3, &(0x7f0000000640)=ANY=[@ANYBLOB="180000000031288e8e"], &(0x7f0000000200)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @void, @value}, 0x90) connect$bt_l2cap(r1, &(0x7f0000000040)={0x1f, 0x0, @fixed={'\xaa\xaa\xaa\xaa\xaa', 0x10}, 0x7ff}, 0xe) r2 = openat$kvm(0xffffffffffffff9c, 0x0, 0x0, 0x0) r3 = syz_init_net_socket$bt_bnep(0x1f, 0x3, 0x4) ioctl$sock_bt_bnep_BNEPCONNADD(r3, 0x400442c8, &(0x7f0000000000)=ANY=[@ANYRES32=r1, @ANYBLOB='\x00\x00\x00\x00\x00', @ANYRESHEX, @ANYRES32=r2]) setsockopt$IP_VS_SO_SET_ADD(r0, 0x0, 0x482, &(0x7f0000000000)={0x6, @local, 0x0, 0x0, 'sh\x00', 0x0, 0x0, 0x35}, 0x2c) setsockopt$IP_VS_SO_SET_ADD(r0, 0x0, 0x483, &(0x7f0000000000)={0x6, @local, 0x0, 0x0, 'sh\x00'}, 0x2c) r4 = syz_open_dev$radio(&(0x7f0000000080), 0x3, 0x2) ioctl$VIDIOC_SUBDEV_G_FMT(r4, 0xc0585604, &(0x7f00000000c0)={0x1, 0x0, {0x7ff, 0xf, 0x200e, 0xb, 0x2, 0x4, 0x0, 0x5}}) program crashed: KASAN: slab-use-after-free Read in netdev_unregister_kobject testing program (duration=45s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): [27, 11] detailed listing: executing program 0: r0 = syz_open_dev$dri(&(0x7f0000000080), 0x1, 0x0) r1 = openat(0xffffffffffffff9c, &(0x7f0000000040)='./cgroup/pids.max\x00', 0x2, 0x0) write$cgroup_pid(r1, &(0x7f00000000c0), 0x12) r2 = socket$kcm(0x11, 0x2, 0x300) r3 = socket$alg(0x26, 0x5, 0x0) bind$alg(r3, &(0x7f0000000000)={0x26, 'hash\x00', 0x0, 0x0, 'sha1-avx\x00'}, 0x58) r4 = accept4(r3, 0x0, 0x0, 0x0) recvmsg$unix(r4, &(0x7f0000000400)={0x0, 0x0, 0x0, 0x0, &(0x7f00000003c0)=[@rights={{0x14, 0x1, 0x1, [0xffffffffffffffff]}}], 0x18}, 0x0) setsockopt$sock_attach_bpf(r2, 0x107, 0x12, &(0x7f00000008c0)=r5, 0x4) r6 = bpf$OBJ_GET_MAP(0x7, &(0x7f00000003c0)=@o_path={&(0x7f0000000380)='./file0\x00', 0x0, 0x4000, r0}, 0x18) r7 = bpf$MAP_CREATE(0x0, &(0x7f0000001440)=@base={0xf, 0xa, 0xa, 0x1, 0x800, 0x1, 0xff, '\x00', 0x0, 0xffffffffffffffff, 0x1, 0x2, 0x4, 0x0, @void, @value, @void, @value}, 0x50) r8 = bpf$MAP_CREATE_RINGBUF(0x0, &(0x7f00000014c0)={0x1b, 0x0, 0x0, 0x9, 0x0, 0x1, 0x0, '\x00', 0x0, 0xffffffffffffffff, 0x0, 0x4, 0x5, 0x0, @void, @value, @void, @value}, 0x50) r9 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000300), 0x0, 0x0) r10 = ioctl$KVM_CREATE_VM(r9, 0xae01, 0x0) r11 = ioctl$KVM_CREATE_VCPU(r10, 0xae41, 0x0) r12 = dup(r11) ioctl$KVM_SET_MSRS(r12, 0x4048aecb, &(0x7f00000000c0)=ANY=[@ANYRES64=r9, @ANYRES64]) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000001600)={0x11, 0x10, &(0x7f00000002c0)=@framed={{0x18, 0x0, 0x0, 0x0, 0x2, 0x0, 0x0, 0x0, 0x3}, [@snprintf={{}, {}, {0x7, 0x0, 0xb, 0x8, 0x0, 0x0, 0x7}}]}, &(0x7f0000000140)='GPL\x00', 0x5, 0x1000, &(0x7f0000000440)=""/4096, 0x40f00, 0xa, '\x00', 0x0, 0x0, r1, 0x8, 0x0, 0x0, 0x10, &(0x7f0000000340)={0x5, 0x0, 0x3, 0x3}, 0x10, 0x0, 0x0, 0x8, &(0x7f0000001540)=[r5, r6, r7, r8, r12], &(0x7f0000001580)=[{0x4, 0x5, 0x6, 0x5}, {0x3, 0x3, 0xc, 0x5}, {0x0, 0x2, 0x8, 0x7}, {0x0, 0x5, 0xa, 0x5}, {0x1, 0xb, 0x2, 0xb}, {0x2, 0x4, 0x0, 0x7}, {0x5, 0x4, 0x6, 0x2}, {0x4, 0x5, 0xb, 0x1}], 0x10, 0x40, @void, @value}, 0x94) ioctl$DRM_IOCTL_SET_CLIENT_CAP(r0, 0x4010640d, &(0x7f0000000000)={0x3, 0x2}) socket$nl_route(0x10, 0x3, 0x0) socket$nl_netfilter(0x10, 0x3, 0xc) io_setup(0x7ff, 0x0) r13 = socket$inet6(0xa, 0x2, 0x0) dup(r13) mknod$loop(&(0x7f0000000100)='./file0\x00', 0x40, 0x1) r14 = socket$netlink(0x10, 0x3, 0xa) sendmsg$nl_route(r14, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000400)={&(0x7f0000000080)=@bridge_delneigh={0x1c, 0x1d, 0x1, 0x0, 0x0, {0x7}}, 0x1c}}, 0x0) executing program 3: r0 = socket$inet_smc(0x2b, 0x1, 0x0) r1 = syz_init_net_socket$bt_l2cap(0x1f, 0x2, 0x0) bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x11, 0x3, &(0x7f0000000640)=ANY=[@ANYBLOB="180000000031288e8e"], &(0x7f0000000200)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @void, @value}, 0x90) connect$bt_l2cap(r1, &(0x7f0000000040)={0x1f, 0x0, @fixed={'\xaa\xaa\xaa\xaa\xaa', 0x10}, 0x7ff}, 0xe) r2 = openat$kvm(0xffffffffffffff9c, 0x0, 0x0, 0x0) r3 = syz_init_net_socket$bt_bnep(0x1f, 0x3, 0x4) ioctl$sock_bt_bnep_BNEPCONNADD(r3, 0x400442c8, &(0x7f0000000000)=ANY=[@ANYRES32=r1, @ANYBLOB='\x00\x00\x00\x00\x00', @ANYRESHEX, @ANYRES32=r2]) setsockopt$IP_VS_SO_SET_ADD(r0, 0x0, 0x482, &(0x7f0000000000)={0x6, @local, 0x0, 0x0, 'sh\x00', 0x0, 0x0, 0x35}, 0x2c) setsockopt$IP_VS_SO_SET_ADD(r0, 0x0, 0x483, &(0x7f0000000000)={0x6, @local, 0x0, 0x0, 'sh\x00'}, 0x2c) r4 = syz_open_dev$radio(&(0x7f0000000080), 0x3, 0x2) ioctl$VIDIOC_SUBDEV_G_FMT(r4, 0xc0585604, &(0x7f00000000c0)={0x1, 0x0, {0x7ff, 0xf, 0x200e, 0xb, 0x2, 0x4, 0x0, 0x5}}) program crashed: KASAN: slab-use-after-free Read in netdev_unregister_kobject testing program (duration=45s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): [26, 11] detailed listing: executing program 0: r0 = syz_open_dev$dri(&(0x7f0000000080), 0x1, 0x0) r1 = openat(0xffffffffffffff9c, &(0x7f0000000040)='./cgroup/pids.max\x00', 0x2, 0x0) write$cgroup_pid(r1, &(0x7f00000000c0), 0x12) r2 = socket$kcm(0x11, 0x2, 0x300) r3 = socket$alg(0x26, 0x5, 0x0) bind$alg(r3, &(0x7f0000000000)={0x26, 'hash\x00', 0x0, 0x0, 'sha1-avx\x00'}, 0x58) r4 = accept4(r3, 0x0, 0x0, 0x0) recvmsg$unix(r4, &(0x7f0000000400)={0x0, 0x0, 0x0, 0x0, &(0x7f00000003c0)=[@rights={{0x14, 0x1, 0x1, [0xffffffffffffffff]}}], 0x18}, 0x0) setsockopt$sock_attach_bpf(r2, 0x107, 0x12, &(0x7f00000008c0)=r5, 0x4) r6 = bpf$OBJ_GET_MAP(0x7, &(0x7f00000003c0)=@o_path={&(0x7f0000000380)='./file0\x00', 0x0, 0x4000, r0}, 0x18) r7 = bpf$MAP_CREATE(0x0, &(0x7f0000001440)=@base={0xf, 0xa, 0xa, 0x1, 0x800, 0x1, 0xff, '\x00', 0x0, 0xffffffffffffffff, 0x1, 0x2, 0x4, 0x0, @void, @value, @void, @value}, 0x50) r8 = bpf$MAP_CREATE_RINGBUF(0x0, &(0x7f00000014c0)={0x1b, 0x0, 0x0, 0x9, 0x0, 0x1, 0x0, '\x00', 0x0, 0xffffffffffffffff, 0x0, 0x4, 0x5, 0x0, @void, @value, @void, @value}, 0x50) r9 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000300), 0x0, 0x0) r10 = ioctl$KVM_CREATE_VM(r9, 0xae01, 0x0) r11 = ioctl$KVM_CREATE_VCPU(r10, 0xae41, 0x0) r12 = dup(r11) ioctl$KVM_SET_MSRS(r12, 0x4048aecb, &(0x7f00000000c0)=ANY=[@ANYRES64=r9, @ANYRES64]) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000001600)={0x11, 0x10, &(0x7f00000002c0)=@framed={{0x18, 0x0, 0x0, 0x0, 0x2, 0x0, 0x0, 0x0, 0x3}, [@snprintf={{}, {}, {0x7, 0x0, 0xb, 0x8, 0x0, 0x0, 0x7}}]}, &(0x7f0000000140)='GPL\x00', 0x5, 0x1000, &(0x7f0000000440)=""/4096, 0x40f00, 0xa, '\x00', 0x0, 0x0, r1, 0x8, 0x0, 0x0, 0x10, &(0x7f0000000340)={0x5, 0x0, 0x3, 0x3}, 0x10, 0x0, 0x0, 0x8, &(0x7f0000001540)=[r5, r6, r7, r8, r12], &(0x7f0000001580)=[{0x4, 0x5, 0x6, 0x5}, {0x3, 0x3, 0xc, 0x5}, {0x0, 0x2, 0x8, 0x7}, {0x0, 0x5, 0xa, 0x5}, {0x1, 0xb, 0x2, 0xb}, {0x2, 0x4, 0x0, 0x7}, {0x5, 0x4, 0x6, 0x2}, {0x4, 0x5, 0xb, 0x1}], 0x10, 0x40, @void, @value}, 0x94) ioctl$DRM_IOCTL_SET_CLIENT_CAP(r0, 0x4010640d, &(0x7f0000000000)={0x3, 0x2}) socket$nl_route(0x10, 0x3, 0x0) socket$nl_netfilter(0x10, 0x3, 0xc) io_setup(0x7ff, 0x0) r13 = socket$inet6(0xa, 0x2, 0x0) dup(r13) mknod$loop(&(0x7f0000000100)='./file0\x00', 0x40, 0x1) socket$netlink(0x10, 0x3, 0xa) executing program 3: r0 = socket$inet_smc(0x2b, 0x1, 0x0) r1 = syz_init_net_socket$bt_l2cap(0x1f, 0x2, 0x0) bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x11, 0x3, &(0x7f0000000640)=ANY=[@ANYBLOB="180000000031288e8e"], &(0x7f0000000200)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @void, @value}, 0x90) connect$bt_l2cap(r1, &(0x7f0000000040)={0x1f, 0x0, @fixed={'\xaa\xaa\xaa\xaa\xaa', 0x10}, 0x7ff}, 0xe) r2 = openat$kvm(0xffffffffffffff9c, 0x0, 0x0, 0x0) r3 = syz_init_net_socket$bt_bnep(0x1f, 0x3, 0x4) ioctl$sock_bt_bnep_BNEPCONNADD(r3, 0x400442c8, &(0x7f0000000000)=ANY=[@ANYRES32=r1, @ANYBLOB='\x00\x00\x00\x00\x00', @ANYRESHEX, @ANYRES32=r2]) setsockopt$IP_VS_SO_SET_ADD(r0, 0x0, 0x482, &(0x7f0000000000)={0x6, @local, 0x0, 0x0, 'sh\x00', 0x0, 0x0, 0x35}, 0x2c) setsockopt$IP_VS_SO_SET_ADD(r0, 0x0, 0x483, &(0x7f0000000000)={0x6, @local, 0x0, 0x0, 'sh\x00'}, 0x2c) r4 = syz_open_dev$radio(&(0x7f0000000080), 0x3, 0x2) ioctl$VIDIOC_SUBDEV_G_FMT(r4, 0xc0585604, &(0x7f00000000c0)={0x1, 0x0, {0x7ff, 0xf, 0x200e, 0xb, 0x2, 0x4, 0x0, 0x5}}) program crashed: KASAN: slab-use-after-free Read in netdev_unregister_kobject testing program (duration=45s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): [25, 11] detailed listing: executing program 0: r0 = syz_open_dev$dri(&(0x7f0000000080), 0x1, 0x0) r1 = openat(0xffffffffffffff9c, &(0x7f0000000040)='./cgroup/pids.max\x00', 0x2, 0x0) write$cgroup_pid(r1, &(0x7f00000000c0), 0x12) r2 = socket$kcm(0x11, 0x2, 0x300) r3 = socket$alg(0x26, 0x5, 0x0) bind$alg(r3, &(0x7f0000000000)={0x26, 'hash\x00', 0x0, 0x0, 'sha1-avx\x00'}, 0x58) r4 = accept4(r3, 0x0, 0x0, 0x0) recvmsg$unix(r4, &(0x7f0000000400)={0x0, 0x0, 0x0, 0x0, &(0x7f00000003c0)=[@rights={{0x14, 0x1, 0x1, [0xffffffffffffffff]}}], 0x18}, 0x0) setsockopt$sock_attach_bpf(r2, 0x107, 0x12, &(0x7f00000008c0)=r5, 0x4) r6 = bpf$OBJ_GET_MAP(0x7, &(0x7f00000003c0)=@o_path={&(0x7f0000000380)='./file0\x00', 0x0, 0x4000, r0}, 0x18) r7 = bpf$MAP_CREATE(0x0, &(0x7f0000001440)=@base={0xf, 0xa, 0xa, 0x1, 0x800, 0x1, 0xff, '\x00', 0x0, 0xffffffffffffffff, 0x1, 0x2, 0x4, 0x0, @void, @value, @void, @value}, 0x50) r8 = bpf$MAP_CREATE_RINGBUF(0x0, &(0x7f00000014c0)={0x1b, 0x0, 0x0, 0x9, 0x0, 0x1, 0x0, '\x00', 0x0, 0xffffffffffffffff, 0x0, 0x4, 0x5, 0x0, @void, @value, @void, @value}, 0x50) r9 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000300), 0x0, 0x0) r10 = ioctl$KVM_CREATE_VM(r9, 0xae01, 0x0) r11 = ioctl$KVM_CREATE_VCPU(r10, 0xae41, 0x0) r12 = dup(r11) ioctl$KVM_SET_MSRS(r12, 0x4048aecb, &(0x7f00000000c0)=ANY=[@ANYRES64=r9, @ANYRES64]) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000001600)={0x11, 0x10, &(0x7f00000002c0)=@framed={{0x18, 0x0, 0x0, 0x0, 0x2, 0x0, 0x0, 0x0, 0x3}, [@snprintf={{}, {}, {0x7, 0x0, 0xb, 0x8, 0x0, 0x0, 0x7}}]}, &(0x7f0000000140)='GPL\x00', 0x5, 0x1000, &(0x7f0000000440)=""/4096, 0x40f00, 0xa, '\x00', 0x0, 0x0, r1, 0x8, 0x0, 0x0, 0x10, &(0x7f0000000340)={0x5, 0x0, 0x3, 0x3}, 0x10, 0x0, 0x0, 0x8, &(0x7f0000001540)=[r5, r6, r7, r8, r12], &(0x7f0000001580)=[{0x4, 0x5, 0x6, 0x5}, {0x3, 0x3, 0xc, 0x5}, {0x0, 0x2, 0x8, 0x7}, {0x0, 0x5, 0xa, 0x5}, {0x1, 0xb, 0x2, 0xb}, {0x2, 0x4, 0x0, 0x7}, {0x5, 0x4, 0x6, 0x2}, {0x4, 0x5, 0xb, 0x1}], 0x10, 0x40, @void, @value}, 0x94) ioctl$DRM_IOCTL_SET_CLIENT_CAP(r0, 0x4010640d, &(0x7f0000000000)={0x3, 0x2}) socket$nl_route(0x10, 0x3, 0x0) socket$nl_netfilter(0x10, 0x3, 0xc) io_setup(0x7ff, 0x0) r13 = socket$inet6(0xa, 0x2, 0x0) dup(r13) mknod$loop(&(0x7f0000000100)='./file0\x00', 0x40, 0x1) executing program 3: r0 = socket$inet_smc(0x2b, 0x1, 0x0) r1 = syz_init_net_socket$bt_l2cap(0x1f, 0x2, 0x0) bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x11, 0x3, &(0x7f0000000640)=ANY=[@ANYBLOB="180000000031288e8e"], &(0x7f0000000200)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @void, @value}, 0x90) connect$bt_l2cap(r1, &(0x7f0000000040)={0x1f, 0x0, @fixed={'\xaa\xaa\xaa\xaa\xaa', 0x10}, 0x7ff}, 0xe) r2 = openat$kvm(0xffffffffffffff9c, 0x0, 0x0, 0x0) r3 = syz_init_net_socket$bt_bnep(0x1f, 0x3, 0x4) ioctl$sock_bt_bnep_BNEPCONNADD(r3, 0x400442c8, &(0x7f0000000000)=ANY=[@ANYRES32=r1, @ANYBLOB='\x00\x00\x00\x00\x00', @ANYRESHEX, @ANYRES32=r2]) setsockopt$IP_VS_SO_SET_ADD(r0, 0x0, 0x482, &(0x7f0000000000)={0x6, @local, 0x0, 0x0, 'sh\x00', 0x0, 0x0, 0x35}, 0x2c) setsockopt$IP_VS_SO_SET_ADD(r0, 0x0, 0x483, &(0x7f0000000000)={0x6, @local, 0x0, 0x0, 'sh\x00'}, 0x2c) r4 = syz_open_dev$radio(&(0x7f0000000080), 0x3, 0x2) ioctl$VIDIOC_SUBDEV_G_FMT(r4, 0xc0585604, &(0x7f00000000c0)={0x1, 0x0, {0x7ff, 0xf, 0x200e, 0xb, 0x2, 0x4, 0x0, 0x5}}) program crashed: KASAN: slab-use-after-free Read in netdev_unregister_kobject testing program (duration=45s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): [24, 11] detailed listing: executing program 0: r0 = syz_open_dev$dri(&(0x7f0000000080), 0x1, 0x0) r1 = openat(0xffffffffffffff9c, &(0x7f0000000040)='./cgroup/pids.max\x00', 0x2, 0x0) write$cgroup_pid(r1, &(0x7f00000000c0), 0x12) r2 = socket$kcm(0x11, 0x2, 0x300) r3 = socket$alg(0x26, 0x5, 0x0) bind$alg(r3, &(0x7f0000000000)={0x26, 'hash\x00', 0x0, 0x0, 'sha1-avx\x00'}, 0x58) r4 = accept4(r3, 0x0, 0x0, 0x0) recvmsg$unix(r4, &(0x7f0000000400)={0x0, 0x0, 0x0, 0x0, &(0x7f00000003c0)=[@rights={{0x14, 0x1, 0x1, [0xffffffffffffffff]}}], 0x18}, 0x0) setsockopt$sock_attach_bpf(r2, 0x107, 0x12, &(0x7f00000008c0)=r5, 0x4) r6 = bpf$OBJ_GET_MAP(0x7, &(0x7f00000003c0)=@o_path={&(0x7f0000000380)='./file0\x00', 0x0, 0x4000, r0}, 0x18) r7 = bpf$MAP_CREATE(0x0, &(0x7f0000001440)=@base={0xf, 0xa, 0xa, 0x1, 0x800, 0x1, 0xff, '\x00', 0x0, 0xffffffffffffffff, 0x1, 0x2, 0x4, 0x0, @void, @value, @void, @value}, 0x50) r8 = bpf$MAP_CREATE_RINGBUF(0x0, &(0x7f00000014c0)={0x1b, 0x0, 0x0, 0x9, 0x0, 0x1, 0x0, '\x00', 0x0, 0xffffffffffffffff, 0x0, 0x4, 0x5, 0x0, @void, @value, @void, @value}, 0x50) r9 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000300), 0x0, 0x0) r10 = ioctl$KVM_CREATE_VM(r9, 0xae01, 0x0) r11 = ioctl$KVM_CREATE_VCPU(r10, 0xae41, 0x0) r12 = dup(r11) ioctl$KVM_SET_MSRS(r12, 0x4048aecb, &(0x7f00000000c0)=ANY=[@ANYRES64=r9, @ANYRES64]) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000001600)={0x11, 0x10, &(0x7f00000002c0)=@framed={{0x18, 0x0, 0x0, 0x0, 0x2, 0x0, 0x0, 0x0, 0x3}, [@snprintf={{}, {}, {0x7, 0x0, 0xb, 0x8, 0x0, 0x0, 0x7}}]}, &(0x7f0000000140)='GPL\x00', 0x5, 0x1000, &(0x7f0000000440)=""/4096, 0x40f00, 0xa, '\x00', 0x0, 0x0, r1, 0x8, 0x0, 0x0, 0x10, &(0x7f0000000340)={0x5, 0x0, 0x3, 0x3}, 0x10, 0x0, 0x0, 0x8, &(0x7f0000001540)=[r5, r6, r7, r8, r12], &(0x7f0000001580)=[{0x4, 0x5, 0x6, 0x5}, {0x3, 0x3, 0xc, 0x5}, {0x0, 0x2, 0x8, 0x7}, {0x0, 0x5, 0xa, 0x5}, {0x1, 0xb, 0x2, 0xb}, {0x2, 0x4, 0x0, 0x7}, {0x5, 0x4, 0x6, 0x2}, {0x4, 0x5, 0xb, 0x1}], 0x10, 0x40, @void, @value}, 0x94) ioctl$DRM_IOCTL_SET_CLIENT_CAP(r0, 0x4010640d, &(0x7f0000000000)={0x3, 0x2}) socket$nl_route(0x10, 0x3, 0x0) socket$nl_netfilter(0x10, 0x3, 0xc) io_setup(0x7ff, 0x0) r13 = socket$inet6(0xa, 0x2, 0x0) dup(r13) executing program 3: r0 = socket$inet_smc(0x2b, 0x1, 0x0) r1 = syz_init_net_socket$bt_l2cap(0x1f, 0x2, 0x0) bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x11, 0x3, &(0x7f0000000640)=ANY=[@ANYBLOB="180000000031288e8e"], &(0x7f0000000200)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @void, @value}, 0x90) connect$bt_l2cap(r1, &(0x7f0000000040)={0x1f, 0x0, @fixed={'\xaa\xaa\xaa\xaa\xaa', 0x10}, 0x7ff}, 0xe) r2 = openat$kvm(0xffffffffffffff9c, 0x0, 0x0, 0x0) r3 = syz_init_net_socket$bt_bnep(0x1f, 0x3, 0x4) ioctl$sock_bt_bnep_BNEPCONNADD(r3, 0x400442c8, &(0x7f0000000000)=ANY=[@ANYRES32=r1, @ANYBLOB='\x00\x00\x00\x00\x00', @ANYRESHEX, @ANYRES32=r2]) setsockopt$IP_VS_SO_SET_ADD(r0, 0x0, 0x482, &(0x7f0000000000)={0x6, @local, 0x0, 0x0, 'sh\x00', 0x0, 0x0, 0x35}, 0x2c) setsockopt$IP_VS_SO_SET_ADD(r0, 0x0, 0x483, &(0x7f0000000000)={0x6, @local, 0x0, 0x0, 'sh\x00'}, 0x2c) r4 = syz_open_dev$radio(&(0x7f0000000080), 0x3, 0x2) ioctl$VIDIOC_SUBDEV_G_FMT(r4, 0xc0585604, &(0x7f00000000c0)={0x1, 0x0, {0x7ff, 0xf, 0x200e, 0xb, 0x2, 0x4, 0x0, 0x5}}) program crashed: KASAN: slab-use-after-free Read in netdev_unregister_kobject testing program (duration=45s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): [23, 11] detailed listing: executing program 0: r0 = syz_open_dev$dri(&(0x7f0000000080), 0x1, 0x0) r1 = openat(0xffffffffffffff9c, &(0x7f0000000040)='./cgroup/pids.max\x00', 0x2, 0x0) write$cgroup_pid(r1, &(0x7f00000000c0), 0x12) r2 = socket$kcm(0x11, 0x2, 0x300) r3 = socket$alg(0x26, 0x5, 0x0) bind$alg(r3, &(0x7f0000000000)={0x26, 'hash\x00', 0x0, 0x0, 'sha1-avx\x00'}, 0x58) r4 = accept4(r3, 0x0, 0x0, 0x0) recvmsg$unix(r4, &(0x7f0000000400)={0x0, 0x0, 0x0, 0x0, &(0x7f00000003c0)=[@rights={{0x14, 0x1, 0x1, [0xffffffffffffffff]}}], 0x18}, 0x0) setsockopt$sock_attach_bpf(r2, 0x107, 0x12, &(0x7f00000008c0)=r5, 0x4) r6 = bpf$OBJ_GET_MAP(0x7, &(0x7f00000003c0)=@o_path={&(0x7f0000000380)='./file0\x00', 0x0, 0x4000, r0}, 0x18) r7 = bpf$MAP_CREATE(0x0, &(0x7f0000001440)=@base={0xf, 0xa, 0xa, 0x1, 0x800, 0x1, 0xff, '\x00', 0x0, 0xffffffffffffffff, 0x1, 0x2, 0x4, 0x0, @void, @value, @void, @value}, 0x50) r8 = bpf$MAP_CREATE_RINGBUF(0x0, &(0x7f00000014c0)={0x1b, 0x0, 0x0, 0x9, 0x0, 0x1, 0x0, '\x00', 0x0, 0xffffffffffffffff, 0x0, 0x4, 0x5, 0x0, @void, @value, @void, @value}, 0x50) r9 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000300), 0x0, 0x0) r10 = ioctl$KVM_CREATE_VM(r9, 0xae01, 0x0) r11 = ioctl$KVM_CREATE_VCPU(r10, 0xae41, 0x0) r12 = dup(r11) ioctl$KVM_SET_MSRS(r12, 0x4048aecb, &(0x7f00000000c0)=ANY=[@ANYRES64=r9, @ANYRES64]) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000001600)={0x11, 0x10, &(0x7f00000002c0)=@framed={{0x18, 0x0, 0x0, 0x0, 0x2, 0x0, 0x0, 0x0, 0x3}, [@snprintf={{}, {}, {0x7, 0x0, 0xb, 0x8, 0x0, 0x0, 0x7}}]}, &(0x7f0000000140)='GPL\x00', 0x5, 0x1000, &(0x7f0000000440)=""/4096, 0x40f00, 0xa, '\x00', 0x0, 0x0, r1, 0x8, 0x0, 0x0, 0x10, &(0x7f0000000340)={0x5, 0x0, 0x3, 0x3}, 0x10, 0x0, 0x0, 0x8, &(0x7f0000001540)=[r5, r6, r7, r8, r12], &(0x7f0000001580)=[{0x4, 0x5, 0x6, 0x5}, {0x3, 0x3, 0xc, 0x5}, {0x0, 0x2, 0x8, 0x7}, {0x0, 0x5, 0xa, 0x5}, {0x1, 0xb, 0x2, 0xb}, {0x2, 0x4, 0x0, 0x7}, {0x5, 0x4, 0x6, 0x2}, {0x4, 0x5, 0xb, 0x1}], 0x10, 0x40, @void, @value}, 0x94) ioctl$DRM_IOCTL_SET_CLIENT_CAP(r0, 0x4010640d, &(0x7f0000000000)={0x3, 0x2}) socket$nl_route(0x10, 0x3, 0x0) socket$nl_netfilter(0x10, 0x3, 0xc) io_setup(0x7ff, 0x0) socket$inet6(0xa, 0x2, 0x0) executing program 3: r0 = socket$inet_smc(0x2b, 0x1, 0x0) r1 = syz_init_net_socket$bt_l2cap(0x1f, 0x2, 0x0) bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x11, 0x3, &(0x7f0000000640)=ANY=[@ANYBLOB="180000000031288e8e"], &(0x7f0000000200)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @void, @value}, 0x90) connect$bt_l2cap(r1, &(0x7f0000000040)={0x1f, 0x0, @fixed={'\xaa\xaa\xaa\xaa\xaa', 0x10}, 0x7ff}, 0xe) r2 = openat$kvm(0xffffffffffffff9c, 0x0, 0x0, 0x0) r3 = syz_init_net_socket$bt_bnep(0x1f, 0x3, 0x4) ioctl$sock_bt_bnep_BNEPCONNADD(r3, 0x400442c8, &(0x7f0000000000)=ANY=[@ANYRES32=r1, @ANYBLOB='\x00\x00\x00\x00\x00', @ANYRESHEX, @ANYRES32=r2]) setsockopt$IP_VS_SO_SET_ADD(r0, 0x0, 0x482, &(0x7f0000000000)={0x6, @local, 0x0, 0x0, 'sh\x00', 0x0, 0x0, 0x35}, 0x2c) setsockopt$IP_VS_SO_SET_ADD(r0, 0x0, 0x483, &(0x7f0000000000)={0x6, @local, 0x0, 0x0, 'sh\x00'}, 0x2c) r4 = syz_open_dev$radio(&(0x7f0000000080), 0x3, 0x2) ioctl$VIDIOC_SUBDEV_G_FMT(r4, 0xc0585604, &(0x7f00000000c0)={0x1, 0x0, {0x7ff, 0xf, 0x200e, 0xb, 0x2, 0x4, 0x0, 0x5}}) program crashed: WARNING in kernfs_get testing program (duration=45s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): [22, 11] detailed listing: executing program 0: r0 = syz_open_dev$dri(&(0x7f0000000080), 0x1, 0x0) r1 = openat(0xffffffffffffff9c, &(0x7f0000000040)='./cgroup/pids.max\x00', 0x2, 0x0) write$cgroup_pid(r1, &(0x7f00000000c0), 0x12) r2 = socket$kcm(0x11, 0x2, 0x300) r3 = socket$alg(0x26, 0x5, 0x0) bind$alg(r3, &(0x7f0000000000)={0x26, 'hash\x00', 0x0, 0x0, 'sha1-avx\x00'}, 0x58) r4 = accept4(r3, 0x0, 0x0, 0x0) recvmsg$unix(r4, &(0x7f0000000400)={0x0, 0x0, 0x0, 0x0, &(0x7f00000003c0)=[@rights={{0x14, 0x1, 0x1, [0xffffffffffffffff]}}], 0x18}, 0x0) setsockopt$sock_attach_bpf(r2, 0x107, 0x12, &(0x7f00000008c0)=r5, 0x4) r6 = bpf$OBJ_GET_MAP(0x7, &(0x7f00000003c0)=@o_path={&(0x7f0000000380)='./file0\x00', 0x0, 0x4000, r0}, 0x18) r7 = bpf$MAP_CREATE(0x0, &(0x7f0000001440)=@base={0xf, 0xa, 0xa, 0x1, 0x800, 0x1, 0xff, '\x00', 0x0, 0xffffffffffffffff, 0x1, 0x2, 0x4, 0x0, @void, @value, @void, @value}, 0x50) r8 = bpf$MAP_CREATE_RINGBUF(0x0, &(0x7f00000014c0)={0x1b, 0x0, 0x0, 0x9, 0x0, 0x1, 0x0, '\x00', 0x0, 0xffffffffffffffff, 0x0, 0x4, 0x5, 0x0, @void, @value, @void, @value}, 0x50) r9 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000300), 0x0, 0x0) r10 = ioctl$KVM_CREATE_VM(r9, 0xae01, 0x0) r11 = ioctl$KVM_CREATE_VCPU(r10, 0xae41, 0x0) r12 = dup(r11) ioctl$KVM_SET_MSRS(r12, 0x4048aecb, &(0x7f00000000c0)=ANY=[@ANYRES64=r9, @ANYRES64]) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000001600)={0x11, 0x10, &(0x7f00000002c0)=@framed={{0x18, 0x0, 0x0, 0x0, 0x2, 0x0, 0x0, 0x0, 0x3}, [@snprintf={{}, {}, {0x7, 0x0, 0xb, 0x8, 0x0, 0x0, 0x7}}]}, &(0x7f0000000140)='GPL\x00', 0x5, 0x1000, &(0x7f0000000440)=""/4096, 0x40f00, 0xa, '\x00', 0x0, 0x0, r1, 0x8, 0x0, 0x0, 0x10, &(0x7f0000000340)={0x5, 0x0, 0x3, 0x3}, 0x10, 0x0, 0x0, 0x8, &(0x7f0000001540)=[r5, r6, r7, r8, r12], &(0x7f0000001580)=[{0x4, 0x5, 0x6, 0x5}, {0x3, 0x3, 0xc, 0x5}, {0x0, 0x2, 0x8, 0x7}, {0x0, 0x5, 0xa, 0x5}, {0x1, 0xb, 0x2, 0xb}, {0x2, 0x4, 0x0, 0x7}, {0x5, 0x4, 0x6, 0x2}, {0x4, 0x5, 0xb, 0x1}], 0x10, 0x40, @void, @value}, 0x94) ioctl$DRM_IOCTL_SET_CLIENT_CAP(r0, 0x4010640d, &(0x7f0000000000)={0x3, 0x2}) socket$nl_route(0x10, 0x3, 0x0) socket$nl_netfilter(0x10, 0x3, 0xc) io_setup(0x7ff, 0x0) executing program 3: r0 = socket$inet_smc(0x2b, 0x1, 0x0) r1 = syz_init_net_socket$bt_l2cap(0x1f, 0x2, 0x0) bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x11, 0x3, &(0x7f0000000640)=ANY=[@ANYBLOB="180000000031288e8e"], &(0x7f0000000200)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @void, @value}, 0x90) connect$bt_l2cap(r1, &(0x7f0000000040)={0x1f, 0x0, @fixed={'\xaa\xaa\xaa\xaa\xaa', 0x10}, 0x7ff}, 0xe) r2 = openat$kvm(0xffffffffffffff9c, 0x0, 0x0, 0x0) r3 = syz_init_net_socket$bt_bnep(0x1f, 0x3, 0x4) ioctl$sock_bt_bnep_BNEPCONNADD(r3, 0x400442c8, &(0x7f0000000000)=ANY=[@ANYRES32=r1, @ANYBLOB='\x00\x00\x00\x00\x00', @ANYRESHEX, @ANYRES32=r2]) setsockopt$IP_VS_SO_SET_ADD(r0, 0x0, 0x482, &(0x7f0000000000)={0x6, @local, 0x0, 0x0, 'sh\x00', 0x0, 0x0, 0x35}, 0x2c) setsockopt$IP_VS_SO_SET_ADD(r0, 0x0, 0x483, &(0x7f0000000000)={0x6, @local, 0x0, 0x0, 'sh\x00'}, 0x2c) r4 = syz_open_dev$radio(&(0x7f0000000080), 0x3, 0x2) ioctl$VIDIOC_SUBDEV_G_FMT(r4, 0xc0585604, &(0x7f00000000c0)={0x1, 0x0, {0x7ff, 0xf, 0x200e, 0xb, 0x2, 0x4, 0x0, 0x5}}) program crashed: KASAN: slab-use-after-free Read in netdev_unregister_kobject testing program (duration=45s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): [21, 11] detailed listing: executing program 0: r0 = syz_open_dev$dri(&(0x7f0000000080), 0x1, 0x0) r1 = openat(0xffffffffffffff9c, &(0x7f0000000040)='./cgroup/pids.max\x00', 0x2, 0x0) write$cgroup_pid(r1, &(0x7f00000000c0), 0x12) r2 = socket$kcm(0x11, 0x2, 0x300) r3 = socket$alg(0x26, 0x5, 0x0) bind$alg(r3, &(0x7f0000000000)={0x26, 'hash\x00', 0x0, 0x0, 'sha1-avx\x00'}, 0x58) r4 = accept4(r3, 0x0, 0x0, 0x0) recvmsg$unix(r4, &(0x7f0000000400)={0x0, 0x0, 0x0, 0x0, &(0x7f00000003c0)=[@rights={{0x14, 0x1, 0x1, [0xffffffffffffffff]}}], 0x18}, 0x0) setsockopt$sock_attach_bpf(r2, 0x107, 0x12, &(0x7f00000008c0)=r5, 0x4) r6 = bpf$OBJ_GET_MAP(0x7, &(0x7f00000003c0)=@o_path={&(0x7f0000000380)='./file0\x00', 0x0, 0x4000, r0}, 0x18) r7 = bpf$MAP_CREATE(0x0, &(0x7f0000001440)=@base={0xf, 0xa, 0xa, 0x1, 0x800, 0x1, 0xff, '\x00', 0x0, 0xffffffffffffffff, 0x1, 0x2, 0x4, 0x0, @void, @value, @void, @value}, 0x50) r8 = bpf$MAP_CREATE_RINGBUF(0x0, &(0x7f00000014c0)={0x1b, 0x0, 0x0, 0x9, 0x0, 0x1, 0x0, '\x00', 0x0, 0xffffffffffffffff, 0x0, 0x4, 0x5, 0x0, @void, @value, @void, @value}, 0x50) r9 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000300), 0x0, 0x0) r10 = ioctl$KVM_CREATE_VM(r9, 0xae01, 0x0) r11 = ioctl$KVM_CREATE_VCPU(r10, 0xae41, 0x0) r12 = dup(r11) ioctl$KVM_SET_MSRS(r12, 0x4048aecb, &(0x7f00000000c0)=ANY=[@ANYRES64=r9, @ANYRES64]) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000001600)={0x11, 0x10, &(0x7f00000002c0)=@framed={{0x18, 0x0, 0x0, 0x0, 0x2, 0x0, 0x0, 0x0, 0x3}, [@snprintf={{}, {}, {0x7, 0x0, 0xb, 0x8, 0x0, 0x0, 0x7}}]}, &(0x7f0000000140)='GPL\x00', 0x5, 0x1000, &(0x7f0000000440)=""/4096, 0x40f00, 0xa, '\x00', 0x0, 0x0, r1, 0x8, 0x0, 0x0, 0x10, &(0x7f0000000340)={0x5, 0x0, 0x3, 0x3}, 0x10, 0x0, 0x0, 0x8, &(0x7f0000001540)=[r5, r6, r7, r8, r12], &(0x7f0000001580)=[{0x4, 0x5, 0x6, 0x5}, {0x3, 0x3, 0xc, 0x5}, {0x0, 0x2, 0x8, 0x7}, {0x0, 0x5, 0xa, 0x5}, {0x1, 0xb, 0x2, 0xb}, {0x2, 0x4, 0x0, 0x7}, {0x5, 0x4, 0x6, 0x2}, {0x4, 0x5, 0xb, 0x1}], 0x10, 0x40, @void, @value}, 0x94) ioctl$DRM_IOCTL_SET_CLIENT_CAP(r0, 0x4010640d, &(0x7f0000000000)={0x3, 0x2}) socket$nl_route(0x10, 0x3, 0x0) socket$nl_netfilter(0x10, 0x3, 0xc) executing program 3: r0 = socket$inet_smc(0x2b, 0x1, 0x0) r1 = syz_init_net_socket$bt_l2cap(0x1f, 0x2, 0x0) bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x11, 0x3, &(0x7f0000000640)=ANY=[@ANYBLOB="180000000031288e8e"], &(0x7f0000000200)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @void, @value}, 0x90) connect$bt_l2cap(r1, &(0x7f0000000040)={0x1f, 0x0, @fixed={'\xaa\xaa\xaa\xaa\xaa', 0x10}, 0x7ff}, 0xe) r2 = openat$kvm(0xffffffffffffff9c, 0x0, 0x0, 0x0) r3 = syz_init_net_socket$bt_bnep(0x1f, 0x3, 0x4) ioctl$sock_bt_bnep_BNEPCONNADD(r3, 0x400442c8, &(0x7f0000000000)=ANY=[@ANYRES32=r1, @ANYBLOB='\x00\x00\x00\x00\x00', @ANYRESHEX, @ANYRES32=r2]) setsockopt$IP_VS_SO_SET_ADD(r0, 0x0, 0x482, &(0x7f0000000000)={0x6, @local, 0x0, 0x0, 'sh\x00', 0x0, 0x0, 0x35}, 0x2c) setsockopt$IP_VS_SO_SET_ADD(r0, 0x0, 0x483, &(0x7f0000000000)={0x6, @local, 0x0, 0x0, 'sh\x00'}, 0x2c) r4 = syz_open_dev$radio(&(0x7f0000000080), 0x3, 0x2) ioctl$VIDIOC_SUBDEV_G_FMT(r4, 0xc0585604, &(0x7f00000000c0)={0x1, 0x0, {0x7ff, 0xf, 0x200e, 0xb, 0x2, 0x4, 0x0, 0x5}}) program crashed: KASAN: slab-use-after-free Read in netdev_unregister_kobject testing program (duration=45s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): [20, 11] detailed listing: executing program 0: r0 = syz_open_dev$dri(&(0x7f0000000080), 0x1, 0x0) r1 = openat(0xffffffffffffff9c, &(0x7f0000000040)='./cgroup/pids.max\x00', 0x2, 0x0) write$cgroup_pid(r1, &(0x7f00000000c0), 0x12) r2 = socket$kcm(0x11, 0x2, 0x300) r3 = socket$alg(0x26, 0x5, 0x0) bind$alg(r3, &(0x7f0000000000)={0x26, 'hash\x00', 0x0, 0x0, 'sha1-avx\x00'}, 0x58) r4 = accept4(r3, 0x0, 0x0, 0x0) recvmsg$unix(r4, &(0x7f0000000400)={0x0, 0x0, 0x0, 0x0, &(0x7f00000003c0)=[@rights={{0x14, 0x1, 0x1, [0xffffffffffffffff]}}], 0x18}, 0x0) setsockopt$sock_attach_bpf(r2, 0x107, 0x12, &(0x7f00000008c0)=r5, 0x4) r6 = bpf$OBJ_GET_MAP(0x7, &(0x7f00000003c0)=@o_path={&(0x7f0000000380)='./file0\x00', 0x0, 0x4000, r0}, 0x18) r7 = bpf$MAP_CREATE(0x0, &(0x7f0000001440)=@base={0xf, 0xa, 0xa, 0x1, 0x800, 0x1, 0xff, '\x00', 0x0, 0xffffffffffffffff, 0x1, 0x2, 0x4, 0x0, @void, @value, @void, @value}, 0x50) r8 = bpf$MAP_CREATE_RINGBUF(0x0, &(0x7f00000014c0)={0x1b, 0x0, 0x0, 0x9, 0x0, 0x1, 0x0, '\x00', 0x0, 0xffffffffffffffff, 0x0, 0x4, 0x5, 0x0, @void, @value, @void, @value}, 0x50) r9 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000300), 0x0, 0x0) r10 = ioctl$KVM_CREATE_VM(r9, 0xae01, 0x0) r11 = ioctl$KVM_CREATE_VCPU(r10, 0xae41, 0x0) r12 = dup(r11) ioctl$KVM_SET_MSRS(r12, 0x4048aecb, &(0x7f00000000c0)=ANY=[@ANYRES64=r9, @ANYRES64]) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000001600)={0x11, 0x10, &(0x7f00000002c0)=@framed={{0x18, 0x0, 0x0, 0x0, 0x2, 0x0, 0x0, 0x0, 0x3}, [@snprintf={{}, {}, {0x7, 0x0, 0xb, 0x8, 0x0, 0x0, 0x7}}]}, &(0x7f0000000140)='GPL\x00', 0x5, 0x1000, &(0x7f0000000440)=""/4096, 0x40f00, 0xa, '\x00', 0x0, 0x0, r1, 0x8, 0x0, 0x0, 0x10, &(0x7f0000000340)={0x5, 0x0, 0x3, 0x3}, 0x10, 0x0, 0x0, 0x8, &(0x7f0000001540)=[r5, r6, r7, r8, r12], &(0x7f0000001580)=[{0x4, 0x5, 0x6, 0x5}, {0x3, 0x3, 0xc, 0x5}, {0x0, 0x2, 0x8, 0x7}, {0x0, 0x5, 0xa, 0x5}, {0x1, 0xb, 0x2, 0xb}, {0x2, 0x4, 0x0, 0x7}, {0x5, 0x4, 0x6, 0x2}, {0x4, 0x5, 0xb, 0x1}], 0x10, 0x40, @void, @value}, 0x94) ioctl$DRM_IOCTL_SET_CLIENT_CAP(r0, 0x4010640d, &(0x7f0000000000)={0x3, 0x2}) socket$nl_route(0x10, 0x3, 0x0) executing program 3: r0 = socket$inet_smc(0x2b, 0x1, 0x0) r1 = syz_init_net_socket$bt_l2cap(0x1f, 0x2, 0x0) bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x11, 0x3, &(0x7f0000000640)=ANY=[@ANYBLOB="180000000031288e8e"], &(0x7f0000000200)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @void, @value}, 0x90) connect$bt_l2cap(r1, &(0x7f0000000040)={0x1f, 0x0, @fixed={'\xaa\xaa\xaa\xaa\xaa', 0x10}, 0x7ff}, 0xe) r2 = openat$kvm(0xffffffffffffff9c, 0x0, 0x0, 0x0) r3 = syz_init_net_socket$bt_bnep(0x1f, 0x3, 0x4) ioctl$sock_bt_bnep_BNEPCONNADD(r3, 0x400442c8, &(0x7f0000000000)=ANY=[@ANYRES32=r1, @ANYBLOB='\x00\x00\x00\x00\x00', @ANYRESHEX, @ANYRES32=r2]) setsockopt$IP_VS_SO_SET_ADD(r0, 0x0, 0x482, &(0x7f0000000000)={0x6, @local, 0x0, 0x0, 'sh\x00', 0x0, 0x0, 0x35}, 0x2c) setsockopt$IP_VS_SO_SET_ADD(r0, 0x0, 0x483, &(0x7f0000000000)={0x6, @local, 0x0, 0x0, 'sh\x00'}, 0x2c) r4 = syz_open_dev$radio(&(0x7f0000000080), 0x3, 0x2) ioctl$VIDIOC_SUBDEV_G_FMT(r4, 0xc0585604, &(0x7f00000000c0)={0x1, 0x0, {0x7ff, 0xf, 0x200e, 0xb, 0x2, 0x4, 0x0, 0x5}}) program crashed: KASAN: slab-use-after-free Read in netdev_unregister_kobject testing program (duration=45s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): [19, 11] detailed listing: executing program 0: r0 = syz_open_dev$dri(&(0x7f0000000080), 0x1, 0x0) r1 = openat(0xffffffffffffff9c, &(0x7f0000000040)='./cgroup/pids.max\x00', 0x2, 0x0) write$cgroup_pid(r1, &(0x7f00000000c0), 0x12) r2 = socket$kcm(0x11, 0x2, 0x300) r3 = socket$alg(0x26, 0x5, 0x0) bind$alg(r3, &(0x7f0000000000)={0x26, 'hash\x00', 0x0, 0x0, 'sha1-avx\x00'}, 0x58) r4 = accept4(r3, 0x0, 0x0, 0x0) recvmsg$unix(r4, &(0x7f0000000400)={0x0, 0x0, 0x0, 0x0, &(0x7f00000003c0)=[@rights={{0x14, 0x1, 0x1, [0xffffffffffffffff]}}], 0x18}, 0x0) setsockopt$sock_attach_bpf(r2, 0x107, 0x12, &(0x7f00000008c0)=r5, 0x4) r6 = bpf$OBJ_GET_MAP(0x7, &(0x7f00000003c0)=@o_path={&(0x7f0000000380)='./file0\x00', 0x0, 0x4000, r0}, 0x18) r7 = bpf$MAP_CREATE(0x0, &(0x7f0000001440)=@base={0xf, 0xa, 0xa, 0x1, 0x800, 0x1, 0xff, '\x00', 0x0, 0xffffffffffffffff, 0x1, 0x2, 0x4, 0x0, @void, @value, @void, @value}, 0x50) r8 = bpf$MAP_CREATE_RINGBUF(0x0, &(0x7f00000014c0)={0x1b, 0x0, 0x0, 0x9, 0x0, 0x1, 0x0, '\x00', 0x0, 0xffffffffffffffff, 0x0, 0x4, 0x5, 0x0, @void, @value, @void, @value}, 0x50) r9 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000300), 0x0, 0x0) r10 = ioctl$KVM_CREATE_VM(r9, 0xae01, 0x0) r11 = ioctl$KVM_CREATE_VCPU(r10, 0xae41, 0x0) r12 = dup(r11) ioctl$KVM_SET_MSRS(r12, 0x4048aecb, &(0x7f00000000c0)=ANY=[@ANYRES64=r9, @ANYRES64]) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000001600)={0x11, 0x10, &(0x7f00000002c0)=@framed={{0x18, 0x0, 0x0, 0x0, 0x2, 0x0, 0x0, 0x0, 0x3}, [@snprintf={{}, {}, {0x7, 0x0, 0xb, 0x8, 0x0, 0x0, 0x7}}]}, &(0x7f0000000140)='GPL\x00', 0x5, 0x1000, &(0x7f0000000440)=""/4096, 0x40f00, 0xa, '\x00', 0x0, 0x0, r1, 0x8, 0x0, 0x0, 0x10, &(0x7f0000000340)={0x5, 0x0, 0x3, 0x3}, 0x10, 0x0, 0x0, 0x8, &(0x7f0000001540)=[r5, r6, r7, r8, r12], &(0x7f0000001580)=[{0x4, 0x5, 0x6, 0x5}, {0x3, 0x3, 0xc, 0x5}, {0x0, 0x2, 0x8, 0x7}, {0x0, 0x5, 0xa, 0x5}, {0x1, 0xb, 0x2, 0xb}, {0x2, 0x4, 0x0, 0x7}, {0x5, 0x4, 0x6, 0x2}, {0x4, 0x5, 0xb, 0x1}], 0x10, 0x40, @void, @value}, 0x94) ioctl$DRM_IOCTL_SET_CLIENT_CAP(r0, 0x4010640d, &(0x7f0000000000)={0x3, 0x2}) executing program 3: r0 = socket$inet_smc(0x2b, 0x1, 0x0) r1 = syz_init_net_socket$bt_l2cap(0x1f, 0x2, 0x0) bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x11, 0x3, &(0x7f0000000640)=ANY=[@ANYBLOB="180000000031288e8e"], &(0x7f0000000200)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @void, @value}, 0x90) connect$bt_l2cap(r1, &(0x7f0000000040)={0x1f, 0x0, @fixed={'\xaa\xaa\xaa\xaa\xaa', 0x10}, 0x7ff}, 0xe) r2 = openat$kvm(0xffffffffffffff9c, 0x0, 0x0, 0x0) r3 = syz_init_net_socket$bt_bnep(0x1f, 0x3, 0x4) ioctl$sock_bt_bnep_BNEPCONNADD(r3, 0x400442c8, &(0x7f0000000000)=ANY=[@ANYRES32=r1, @ANYBLOB='\x00\x00\x00\x00\x00', @ANYRESHEX, @ANYRES32=r2]) setsockopt$IP_VS_SO_SET_ADD(r0, 0x0, 0x482, &(0x7f0000000000)={0x6, @local, 0x0, 0x0, 'sh\x00', 0x0, 0x0, 0x35}, 0x2c) setsockopt$IP_VS_SO_SET_ADD(r0, 0x0, 0x483, &(0x7f0000000000)={0x6, @local, 0x0, 0x0, 'sh\x00'}, 0x2c) r4 = syz_open_dev$radio(&(0x7f0000000080), 0x3, 0x2) ioctl$VIDIOC_SUBDEV_G_FMT(r4, 0xc0585604, &(0x7f00000000c0)={0x1, 0x0, {0x7ff, 0xf, 0x200e, 0xb, 0x2, 0x4, 0x0, 0x5}}) program crashed: KASAN: slab-use-after-free Read in netdev_unregister_kobject testing program (duration=45s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): [18, 11] detailed listing: executing program 0: r0 = syz_open_dev$dri(&(0x7f0000000080), 0x1, 0x0) r1 = openat(0xffffffffffffff9c, &(0x7f0000000040)='./cgroup/pids.max\x00', 0x2, 0x0) write$cgroup_pid(r1, &(0x7f00000000c0), 0x12) r2 = socket$kcm(0x11, 0x2, 0x300) r3 = socket$alg(0x26, 0x5, 0x0) bind$alg(r3, &(0x7f0000000000)={0x26, 'hash\x00', 0x0, 0x0, 'sha1-avx\x00'}, 0x58) r4 = accept4(r3, 0x0, 0x0, 0x0) recvmsg$unix(r4, &(0x7f0000000400)={0x0, 0x0, 0x0, 0x0, &(0x7f00000003c0)=[@rights={{0x14, 0x1, 0x1, [0xffffffffffffffff]}}], 0x18}, 0x0) setsockopt$sock_attach_bpf(r2, 0x107, 0x12, &(0x7f00000008c0)=r5, 0x4) r6 = bpf$OBJ_GET_MAP(0x7, &(0x7f00000003c0)=@o_path={&(0x7f0000000380)='./file0\x00', 0x0, 0x4000, r0}, 0x18) r7 = bpf$MAP_CREATE(0x0, &(0x7f0000001440)=@base={0xf, 0xa, 0xa, 0x1, 0x800, 0x1, 0xff, '\x00', 0x0, 0xffffffffffffffff, 0x1, 0x2, 0x4, 0x0, @void, @value, @void, @value}, 0x50) r8 = bpf$MAP_CREATE_RINGBUF(0x0, &(0x7f00000014c0)={0x1b, 0x0, 0x0, 0x9, 0x0, 0x1, 0x0, '\x00', 0x0, 0xffffffffffffffff, 0x0, 0x4, 0x5, 0x0, @void, @value, @void, @value}, 0x50) r9 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000300), 0x0, 0x0) r10 = ioctl$KVM_CREATE_VM(r9, 0xae01, 0x0) r11 = ioctl$KVM_CREATE_VCPU(r10, 0xae41, 0x0) r12 = dup(r11) ioctl$KVM_SET_MSRS(r12, 0x4048aecb, &(0x7f00000000c0)=ANY=[@ANYRES64=r9, @ANYRES64]) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000001600)={0x11, 0x10, &(0x7f00000002c0)=@framed={{0x18, 0x0, 0x0, 0x0, 0x2, 0x0, 0x0, 0x0, 0x3}, [@snprintf={{}, {}, {0x7, 0x0, 0xb, 0x8, 0x0, 0x0, 0x7}}]}, &(0x7f0000000140)='GPL\x00', 0x5, 0x1000, &(0x7f0000000440)=""/4096, 0x40f00, 0xa, '\x00', 0x0, 0x0, r1, 0x8, 0x0, 0x0, 0x10, &(0x7f0000000340)={0x5, 0x0, 0x3, 0x3}, 0x10, 0x0, 0x0, 0x8, &(0x7f0000001540)=[r5, r6, r7, r8, r12], &(0x7f0000001580)=[{0x4, 0x5, 0x6, 0x5}, {0x3, 0x3, 0xc, 0x5}, {0x0, 0x2, 0x8, 0x7}, {0x0, 0x5, 0xa, 0x5}, {0x1, 0xb, 0x2, 0xb}, {0x2, 0x4, 0x0, 0x7}, {0x5, 0x4, 0x6, 0x2}, {0x4, 0x5, 0xb, 0x1}], 0x10, 0x40, @void, @value}, 0x94) executing program 3: r0 = socket$inet_smc(0x2b, 0x1, 0x0) r1 = syz_init_net_socket$bt_l2cap(0x1f, 0x2, 0x0) bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x11, 0x3, &(0x7f0000000640)=ANY=[@ANYBLOB="180000000031288e8e"], &(0x7f0000000200)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @void, @value}, 0x90) connect$bt_l2cap(r1, &(0x7f0000000040)={0x1f, 0x0, @fixed={'\xaa\xaa\xaa\xaa\xaa', 0x10}, 0x7ff}, 0xe) r2 = openat$kvm(0xffffffffffffff9c, 0x0, 0x0, 0x0) r3 = syz_init_net_socket$bt_bnep(0x1f, 0x3, 0x4) ioctl$sock_bt_bnep_BNEPCONNADD(r3, 0x400442c8, &(0x7f0000000000)=ANY=[@ANYRES32=r1, @ANYBLOB='\x00\x00\x00\x00\x00', @ANYRESHEX, @ANYRES32=r2]) setsockopt$IP_VS_SO_SET_ADD(r0, 0x0, 0x482, &(0x7f0000000000)={0x6, @local, 0x0, 0x0, 'sh\x00', 0x0, 0x0, 0x35}, 0x2c) setsockopt$IP_VS_SO_SET_ADD(r0, 0x0, 0x483, &(0x7f0000000000)={0x6, @local, 0x0, 0x0, 'sh\x00'}, 0x2c) r4 = syz_open_dev$radio(&(0x7f0000000080), 0x3, 0x2) ioctl$VIDIOC_SUBDEV_G_FMT(r4, 0xc0585604, &(0x7f00000000c0)={0x1, 0x0, {0x7ff, 0xf, 0x200e, 0xb, 0x2, 0x4, 0x0, 0x5}}) program crashed: KASAN: slab-use-after-free Read in netdev_unregister_kobject testing program (duration=45s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): [17, 11] detailed listing: executing program 0: r0 = syz_open_dev$dri(&(0x7f0000000080), 0x1, 0x0) r1 = openat(0xffffffffffffff9c, &(0x7f0000000040)='./cgroup/pids.max\x00', 0x2, 0x0) write$cgroup_pid(r1, &(0x7f00000000c0), 0x12) r2 = socket$kcm(0x11, 0x2, 0x300) r3 = socket$alg(0x26, 0x5, 0x0) bind$alg(r3, &(0x7f0000000000)={0x26, 'hash\x00', 0x0, 0x0, 'sha1-avx\x00'}, 0x58) r4 = accept4(r3, 0x0, 0x0, 0x0) recvmsg$unix(r4, &(0x7f0000000400)={0x0, 0x0, 0x0, 0x0, &(0x7f00000003c0)=[@rights={{0x14, 0x1, 0x1, [0xffffffffffffffff]}}], 0x18}, 0x0) setsockopt$sock_attach_bpf(r2, 0x107, 0x12, &(0x7f00000008c0)=r5, 0x4) bpf$OBJ_GET_MAP(0x7, &(0x7f00000003c0)=@o_path={&(0x7f0000000380)='./file0\x00', 0x0, 0x4000, r0}, 0x18) bpf$MAP_CREATE(0x0, &(0x7f0000001440)=@base={0xf, 0xa, 0xa, 0x1, 0x800, 0x1, 0xff, '\x00', 0x0, 0xffffffffffffffff, 0x1, 0x2, 0x4, 0x0, @void, @value, @void, @value}, 0x50) bpf$MAP_CREATE_RINGBUF(0x0, &(0x7f00000014c0)={0x1b, 0x0, 0x0, 0x9, 0x0, 0x1, 0x0, '\x00', 0x0, 0xffffffffffffffff, 0x0, 0x4, 0x5, 0x0, @void, @value, @void, @value}, 0x50) r6 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000300), 0x0, 0x0) r7 = ioctl$KVM_CREATE_VM(r6, 0xae01, 0x0) r8 = ioctl$KVM_CREATE_VCPU(r7, 0xae41, 0x0) r9 = dup(r8) ioctl$KVM_SET_MSRS(r9, 0x4048aecb, &(0x7f00000000c0)=ANY=[@ANYRES64=r6, @ANYRES64]) executing program 3: r0 = socket$inet_smc(0x2b, 0x1, 0x0) r1 = syz_init_net_socket$bt_l2cap(0x1f, 0x2, 0x0) bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x11, 0x3, &(0x7f0000000640)=ANY=[@ANYBLOB="180000000031288e8e"], &(0x7f0000000200)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @void, @value}, 0x90) connect$bt_l2cap(r1, &(0x7f0000000040)={0x1f, 0x0, @fixed={'\xaa\xaa\xaa\xaa\xaa', 0x10}, 0x7ff}, 0xe) r2 = openat$kvm(0xffffffffffffff9c, 0x0, 0x0, 0x0) r3 = syz_init_net_socket$bt_bnep(0x1f, 0x3, 0x4) ioctl$sock_bt_bnep_BNEPCONNADD(r3, 0x400442c8, &(0x7f0000000000)=ANY=[@ANYRES32=r1, @ANYBLOB='\x00\x00\x00\x00\x00', @ANYRESHEX, @ANYRES32=r2]) setsockopt$IP_VS_SO_SET_ADD(r0, 0x0, 0x482, &(0x7f0000000000)={0x6, @local, 0x0, 0x0, 'sh\x00', 0x0, 0x0, 0x35}, 0x2c) setsockopt$IP_VS_SO_SET_ADD(r0, 0x0, 0x483, &(0x7f0000000000)={0x6, @local, 0x0, 0x0, 'sh\x00'}, 0x2c) r4 = syz_open_dev$radio(&(0x7f0000000080), 0x3, 0x2) ioctl$VIDIOC_SUBDEV_G_FMT(r4, 0xc0585604, &(0x7f00000000c0)={0x1, 0x0, {0x7ff, 0xf, 0x200e, 0xb, 0x2, 0x4, 0x0, 0x5}}) program crashed: KASAN: slab-use-after-free Read in netdev_unregister_kobject testing program (duration=45s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): [16, 11] detailed listing: executing program 0: r0 = syz_open_dev$dri(&(0x7f0000000080), 0x1, 0x0) r1 = openat(0xffffffffffffff9c, &(0x7f0000000040)='./cgroup/pids.max\x00', 0x2, 0x0) write$cgroup_pid(r1, &(0x7f00000000c0), 0x12) r2 = socket$kcm(0x11, 0x2, 0x300) r3 = socket$alg(0x26, 0x5, 0x0) bind$alg(r3, &(0x7f0000000000)={0x26, 'hash\x00', 0x0, 0x0, 'sha1-avx\x00'}, 0x58) r4 = accept4(r3, 0x0, 0x0, 0x0) recvmsg$unix(r4, &(0x7f0000000400)={0x0, 0x0, 0x0, 0x0, &(0x7f00000003c0)=[@rights={{0x14, 0x1, 0x1, [0xffffffffffffffff]}}], 0x18}, 0x0) setsockopt$sock_attach_bpf(r2, 0x107, 0x12, &(0x7f00000008c0)=r5, 0x4) bpf$OBJ_GET_MAP(0x7, &(0x7f00000003c0)=@o_path={&(0x7f0000000380)='./file0\x00', 0x0, 0x4000, r0}, 0x18) bpf$MAP_CREATE(0x0, &(0x7f0000001440)=@base={0xf, 0xa, 0xa, 0x1, 0x800, 0x1, 0xff, '\x00', 0x0, 0xffffffffffffffff, 0x1, 0x2, 0x4, 0x0, @void, @value, @void, @value}, 0x50) bpf$MAP_CREATE_RINGBUF(0x0, &(0x7f00000014c0)={0x1b, 0x0, 0x0, 0x9, 0x0, 0x1, 0x0, '\x00', 0x0, 0xffffffffffffffff, 0x0, 0x4, 0x5, 0x0, @void, @value, @void, @value}, 0x50) r6 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000300), 0x0, 0x0) r7 = ioctl$KVM_CREATE_VM(r6, 0xae01, 0x0) r8 = ioctl$KVM_CREATE_VCPU(r7, 0xae41, 0x0) dup(r8) executing program 3: r0 = socket$inet_smc(0x2b, 0x1, 0x0) r1 = syz_init_net_socket$bt_l2cap(0x1f, 0x2, 0x0) bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x11, 0x3, &(0x7f0000000640)=ANY=[@ANYBLOB="180000000031288e8e"], &(0x7f0000000200)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @void, @value}, 0x90) connect$bt_l2cap(r1, &(0x7f0000000040)={0x1f, 0x0, @fixed={'\xaa\xaa\xaa\xaa\xaa', 0x10}, 0x7ff}, 0xe) r2 = openat$kvm(0xffffffffffffff9c, 0x0, 0x0, 0x0) r3 = syz_init_net_socket$bt_bnep(0x1f, 0x3, 0x4) ioctl$sock_bt_bnep_BNEPCONNADD(r3, 0x400442c8, &(0x7f0000000000)=ANY=[@ANYRES32=r1, @ANYBLOB='\x00\x00\x00\x00\x00', @ANYRESHEX, @ANYRES32=r2]) setsockopt$IP_VS_SO_SET_ADD(r0, 0x0, 0x482, &(0x7f0000000000)={0x6, @local, 0x0, 0x0, 'sh\x00', 0x0, 0x0, 0x35}, 0x2c) setsockopt$IP_VS_SO_SET_ADD(r0, 0x0, 0x483, &(0x7f0000000000)={0x6, @local, 0x0, 0x0, 'sh\x00'}, 0x2c) r4 = syz_open_dev$radio(&(0x7f0000000080), 0x3, 0x2) ioctl$VIDIOC_SUBDEV_G_FMT(r4, 0xc0585604, &(0x7f00000000c0)={0x1, 0x0, {0x7ff, 0xf, 0x200e, 0xb, 0x2, 0x4, 0x0, 0x5}}) program crashed: KASAN: slab-use-after-free Read in netdev_unregister_kobject testing program (duration=45s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): [15, 11] detailed listing: executing program 0: r0 = syz_open_dev$dri(&(0x7f0000000080), 0x1, 0x0) r1 = openat(0xffffffffffffff9c, &(0x7f0000000040)='./cgroup/pids.max\x00', 0x2, 0x0) write$cgroup_pid(r1, &(0x7f00000000c0), 0x12) r2 = socket$kcm(0x11, 0x2, 0x300) r3 = socket$alg(0x26, 0x5, 0x0) bind$alg(r3, &(0x7f0000000000)={0x26, 'hash\x00', 0x0, 0x0, 'sha1-avx\x00'}, 0x58) r4 = accept4(r3, 0x0, 0x0, 0x0) recvmsg$unix(r4, &(0x7f0000000400)={0x0, 0x0, 0x0, 0x0, &(0x7f00000003c0)=[@rights={{0x14, 0x1, 0x1, [0xffffffffffffffff]}}], 0x18}, 0x0) setsockopt$sock_attach_bpf(r2, 0x107, 0x12, &(0x7f00000008c0)=r5, 0x4) bpf$OBJ_GET_MAP(0x7, &(0x7f00000003c0)=@o_path={&(0x7f0000000380)='./file0\x00', 0x0, 0x4000, r0}, 0x18) bpf$MAP_CREATE(0x0, &(0x7f0000001440)=@base={0xf, 0xa, 0xa, 0x1, 0x800, 0x1, 0xff, '\x00', 0x0, 0xffffffffffffffff, 0x1, 0x2, 0x4, 0x0, @void, @value, @void, @value}, 0x50) bpf$MAP_CREATE_RINGBUF(0x0, &(0x7f00000014c0)={0x1b, 0x0, 0x0, 0x9, 0x0, 0x1, 0x0, '\x00', 0x0, 0xffffffffffffffff, 0x0, 0x4, 0x5, 0x0, @void, @value, @void, @value}, 0x50) r6 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000300), 0x0, 0x0) r7 = ioctl$KVM_CREATE_VM(r6, 0xae01, 0x0) ioctl$KVM_CREATE_VCPU(r7, 0xae41, 0x0) executing program 3: r0 = socket$inet_smc(0x2b, 0x1, 0x0) r1 = syz_init_net_socket$bt_l2cap(0x1f, 0x2, 0x0) bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x11, 0x3, &(0x7f0000000640)=ANY=[@ANYBLOB="180000000031288e8e"], &(0x7f0000000200)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @void, @value}, 0x90) connect$bt_l2cap(r1, &(0x7f0000000040)={0x1f, 0x0, @fixed={'\xaa\xaa\xaa\xaa\xaa', 0x10}, 0x7ff}, 0xe) r2 = openat$kvm(0xffffffffffffff9c, 0x0, 0x0, 0x0) r3 = syz_init_net_socket$bt_bnep(0x1f, 0x3, 0x4) ioctl$sock_bt_bnep_BNEPCONNADD(r3, 0x400442c8, &(0x7f0000000000)=ANY=[@ANYRES32=r1, @ANYBLOB='\x00\x00\x00\x00\x00', @ANYRESHEX, @ANYRES32=r2]) setsockopt$IP_VS_SO_SET_ADD(r0, 0x0, 0x482, &(0x7f0000000000)={0x6, @local, 0x0, 0x0, 'sh\x00', 0x0, 0x0, 0x35}, 0x2c) setsockopt$IP_VS_SO_SET_ADD(r0, 0x0, 0x483, &(0x7f0000000000)={0x6, @local, 0x0, 0x0, 'sh\x00'}, 0x2c) r4 = syz_open_dev$radio(&(0x7f0000000080), 0x3, 0x2) ioctl$VIDIOC_SUBDEV_G_FMT(r4, 0xc0585604, &(0x7f00000000c0)={0x1, 0x0, {0x7ff, 0xf, 0x200e, 0xb, 0x2, 0x4, 0x0, 0x5}}) program crashed: KASAN: slab-use-after-free Read in netdev_unregister_kobject testing program (duration=45s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): [14, 11] detailed listing: executing program 0: r0 = syz_open_dev$dri(&(0x7f0000000080), 0x1, 0x0) r1 = openat(0xffffffffffffff9c, &(0x7f0000000040)='./cgroup/pids.max\x00', 0x2, 0x0) write$cgroup_pid(r1, &(0x7f00000000c0), 0x12) r2 = socket$kcm(0x11, 0x2, 0x300) r3 = socket$alg(0x26, 0x5, 0x0) bind$alg(r3, &(0x7f0000000000)={0x26, 'hash\x00', 0x0, 0x0, 'sha1-avx\x00'}, 0x58) r4 = accept4(r3, 0x0, 0x0, 0x0) recvmsg$unix(r4, &(0x7f0000000400)={0x0, 0x0, 0x0, 0x0, &(0x7f00000003c0)=[@rights={{0x14, 0x1, 0x1, [0xffffffffffffffff]}}], 0x18}, 0x0) setsockopt$sock_attach_bpf(r2, 0x107, 0x12, &(0x7f00000008c0)=r5, 0x4) bpf$OBJ_GET_MAP(0x7, &(0x7f00000003c0)=@o_path={&(0x7f0000000380)='./file0\x00', 0x0, 0x4000, r0}, 0x18) bpf$MAP_CREATE(0x0, &(0x7f0000001440)=@base={0xf, 0xa, 0xa, 0x1, 0x800, 0x1, 0xff, '\x00', 0x0, 0xffffffffffffffff, 0x1, 0x2, 0x4, 0x0, @void, @value, @void, @value}, 0x50) bpf$MAP_CREATE_RINGBUF(0x0, &(0x7f00000014c0)={0x1b, 0x0, 0x0, 0x9, 0x0, 0x1, 0x0, '\x00', 0x0, 0xffffffffffffffff, 0x0, 0x4, 0x5, 0x0, @void, @value, @void, @value}, 0x50) r6 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000300), 0x0, 0x0) ioctl$KVM_CREATE_VM(r6, 0xae01, 0x0) executing program 3: r0 = socket$inet_smc(0x2b, 0x1, 0x0) r1 = syz_init_net_socket$bt_l2cap(0x1f, 0x2, 0x0) bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x11, 0x3, &(0x7f0000000640)=ANY=[@ANYBLOB="180000000031288e8e"], &(0x7f0000000200)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @void, @value}, 0x90) connect$bt_l2cap(r1, &(0x7f0000000040)={0x1f, 0x0, @fixed={'\xaa\xaa\xaa\xaa\xaa', 0x10}, 0x7ff}, 0xe) r2 = openat$kvm(0xffffffffffffff9c, 0x0, 0x0, 0x0) r3 = syz_init_net_socket$bt_bnep(0x1f, 0x3, 0x4) ioctl$sock_bt_bnep_BNEPCONNADD(r3, 0x400442c8, &(0x7f0000000000)=ANY=[@ANYRES32=r1, @ANYBLOB='\x00\x00\x00\x00\x00', @ANYRESHEX, @ANYRES32=r2]) setsockopt$IP_VS_SO_SET_ADD(r0, 0x0, 0x482, &(0x7f0000000000)={0x6, @local, 0x0, 0x0, 'sh\x00', 0x0, 0x0, 0x35}, 0x2c) setsockopt$IP_VS_SO_SET_ADD(r0, 0x0, 0x483, &(0x7f0000000000)={0x6, @local, 0x0, 0x0, 'sh\x00'}, 0x2c) r4 = syz_open_dev$radio(&(0x7f0000000080), 0x3, 0x2) ioctl$VIDIOC_SUBDEV_G_FMT(r4, 0xc0585604, &(0x7f00000000c0)={0x1, 0x0, {0x7ff, 0xf, 0x200e, 0xb, 0x2, 0x4, 0x0, 0x5}}) program crashed: KASAN: slab-use-after-free Read in netdev_unregister_kobject testing program (duration=45s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): [13, 11] detailed listing: executing program 0: r0 = syz_open_dev$dri(&(0x7f0000000080), 0x1, 0x0) r1 = openat(0xffffffffffffff9c, &(0x7f0000000040)='./cgroup/pids.max\x00', 0x2, 0x0) write$cgroup_pid(r1, &(0x7f00000000c0), 0x12) r2 = socket$kcm(0x11, 0x2, 0x300) r3 = socket$alg(0x26, 0x5, 0x0) bind$alg(r3, &(0x7f0000000000)={0x26, 'hash\x00', 0x0, 0x0, 'sha1-avx\x00'}, 0x58) r4 = accept4(r3, 0x0, 0x0, 0x0) recvmsg$unix(r4, &(0x7f0000000400)={0x0, 0x0, 0x0, 0x0, &(0x7f00000003c0)=[@rights={{0x14, 0x1, 0x1, [0xffffffffffffffff]}}], 0x18}, 0x0) setsockopt$sock_attach_bpf(r2, 0x107, 0x12, &(0x7f00000008c0)=r5, 0x4) bpf$OBJ_GET_MAP(0x7, &(0x7f00000003c0)=@o_path={&(0x7f0000000380)='./file0\x00', 0x0, 0x4000, r0}, 0x18) bpf$MAP_CREATE(0x0, &(0x7f0000001440)=@base={0xf, 0xa, 0xa, 0x1, 0x800, 0x1, 0xff, '\x00', 0x0, 0xffffffffffffffff, 0x1, 0x2, 0x4, 0x0, @void, @value, @void, @value}, 0x50) bpf$MAP_CREATE_RINGBUF(0x0, &(0x7f00000014c0)={0x1b, 0x0, 0x0, 0x9, 0x0, 0x1, 0x0, '\x00', 0x0, 0xffffffffffffffff, 0x0, 0x4, 0x5, 0x0, @void, @value, @void, @value}, 0x50) openat$kvm(0xffffffffffffff9c, &(0x7f0000000300), 0x0, 0x0) executing program 3: r0 = socket$inet_smc(0x2b, 0x1, 0x0) r1 = syz_init_net_socket$bt_l2cap(0x1f, 0x2, 0x0) bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x11, 0x3, &(0x7f0000000640)=ANY=[@ANYBLOB="180000000031288e8e"], &(0x7f0000000200)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @void, @value}, 0x90) connect$bt_l2cap(r1, &(0x7f0000000040)={0x1f, 0x0, @fixed={'\xaa\xaa\xaa\xaa\xaa', 0x10}, 0x7ff}, 0xe) r2 = openat$kvm(0xffffffffffffff9c, 0x0, 0x0, 0x0) r3 = syz_init_net_socket$bt_bnep(0x1f, 0x3, 0x4) ioctl$sock_bt_bnep_BNEPCONNADD(r3, 0x400442c8, &(0x7f0000000000)=ANY=[@ANYRES32=r1, @ANYBLOB='\x00\x00\x00\x00\x00', @ANYRESHEX, @ANYRES32=r2]) setsockopt$IP_VS_SO_SET_ADD(r0, 0x0, 0x482, &(0x7f0000000000)={0x6, @local, 0x0, 0x0, 'sh\x00', 0x0, 0x0, 0x35}, 0x2c) setsockopt$IP_VS_SO_SET_ADD(r0, 0x0, 0x483, &(0x7f0000000000)={0x6, @local, 0x0, 0x0, 'sh\x00'}, 0x2c) r4 = syz_open_dev$radio(&(0x7f0000000080), 0x3, 0x2) ioctl$VIDIOC_SUBDEV_G_FMT(r4, 0xc0585604, &(0x7f00000000c0)={0x1, 0x0, {0x7ff, 0xf, 0x200e, 0xb, 0x2, 0x4, 0x0, 0x5}}) program crashed: KASAN: slab-use-after-free Read in netdev_unregister_kobject testing program (duration=45s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): [12, 11] detailed listing: executing program 0: r0 = syz_open_dev$dri(&(0x7f0000000080), 0x1, 0x0) r1 = openat(0xffffffffffffff9c, &(0x7f0000000040)='./cgroup/pids.max\x00', 0x2, 0x0) write$cgroup_pid(r1, &(0x7f00000000c0), 0x12) r2 = socket$kcm(0x11, 0x2, 0x300) r3 = socket$alg(0x26, 0x5, 0x0) bind$alg(r3, &(0x7f0000000000)={0x26, 'hash\x00', 0x0, 0x0, 'sha1-avx\x00'}, 0x58) r4 = accept4(r3, 0x0, 0x0, 0x0) recvmsg$unix(r4, &(0x7f0000000400)={0x0, 0x0, 0x0, 0x0, &(0x7f00000003c0)=[@rights={{0x14, 0x1, 0x1, [0xffffffffffffffff]}}], 0x18}, 0x0) setsockopt$sock_attach_bpf(r2, 0x107, 0x12, &(0x7f00000008c0)=r5, 0x4) bpf$OBJ_GET_MAP(0x7, &(0x7f00000003c0)=@o_path={&(0x7f0000000380)='./file0\x00', 0x0, 0x4000, r0}, 0x18) bpf$MAP_CREATE(0x0, &(0x7f0000001440)=@base={0xf, 0xa, 0xa, 0x1, 0x800, 0x1, 0xff, '\x00', 0x0, 0xffffffffffffffff, 0x1, 0x2, 0x4, 0x0, @void, @value, @void, @value}, 0x50) bpf$MAP_CREATE_RINGBUF(0x0, &(0x7f00000014c0)={0x1b, 0x0, 0x0, 0x9, 0x0, 0x1, 0x0, '\x00', 0x0, 0xffffffffffffffff, 0x0, 0x4, 0x5, 0x0, @void, @value, @void, @value}, 0x50) executing program 3: r0 = socket$inet_smc(0x2b, 0x1, 0x0) r1 = syz_init_net_socket$bt_l2cap(0x1f, 0x2, 0x0) bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x11, 0x3, &(0x7f0000000640)=ANY=[@ANYBLOB="180000000031288e8e"], &(0x7f0000000200)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @void, @value}, 0x90) connect$bt_l2cap(r1, &(0x7f0000000040)={0x1f, 0x0, @fixed={'\xaa\xaa\xaa\xaa\xaa', 0x10}, 0x7ff}, 0xe) r2 = openat$kvm(0xffffffffffffff9c, 0x0, 0x0, 0x0) r3 = syz_init_net_socket$bt_bnep(0x1f, 0x3, 0x4) ioctl$sock_bt_bnep_BNEPCONNADD(r3, 0x400442c8, &(0x7f0000000000)=ANY=[@ANYRES32=r1, @ANYBLOB='\x00\x00\x00\x00\x00', @ANYRESHEX, @ANYRES32=r2]) setsockopt$IP_VS_SO_SET_ADD(r0, 0x0, 0x482, &(0x7f0000000000)={0x6, @local, 0x0, 0x0, 'sh\x00', 0x0, 0x0, 0x35}, 0x2c) setsockopt$IP_VS_SO_SET_ADD(r0, 0x0, 0x483, &(0x7f0000000000)={0x6, @local, 0x0, 0x0, 'sh\x00'}, 0x2c) r4 = syz_open_dev$radio(&(0x7f0000000080), 0x3, 0x2) ioctl$VIDIOC_SUBDEV_G_FMT(r4, 0xc0585604, &(0x7f00000000c0)={0x1, 0x0, {0x7ff, 0xf, 0x200e, 0xb, 0x2, 0x4, 0x0, 0x5}}) program crashed: KASAN: slab-use-after-free Read in netdev_unregister_kobject testing program (duration=45s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): [11, 11] detailed listing: executing program 0: r0 = syz_open_dev$dri(&(0x7f0000000080), 0x1, 0x0) r1 = openat(0xffffffffffffff9c, &(0x7f0000000040)='./cgroup/pids.max\x00', 0x2, 0x0) write$cgroup_pid(r1, &(0x7f00000000c0), 0x12) r2 = socket$kcm(0x11, 0x2, 0x300) r3 = socket$alg(0x26, 0x5, 0x0) bind$alg(r3, &(0x7f0000000000)={0x26, 'hash\x00', 0x0, 0x0, 'sha1-avx\x00'}, 0x58) r4 = accept4(r3, 0x0, 0x0, 0x0) recvmsg$unix(r4, &(0x7f0000000400)={0x0, 0x0, 0x0, 0x0, &(0x7f00000003c0)=[@rights={{0x14, 0x1, 0x1, [0xffffffffffffffff]}}], 0x18}, 0x0) setsockopt$sock_attach_bpf(r2, 0x107, 0x12, &(0x7f00000008c0)=r5, 0x4) bpf$OBJ_GET_MAP(0x7, &(0x7f00000003c0)=@o_path={&(0x7f0000000380)='./file0\x00', 0x0, 0x4000, r0}, 0x18) bpf$MAP_CREATE(0x0, &(0x7f0000001440)=@base={0xf, 0xa, 0xa, 0x1, 0x800, 0x1, 0xff, '\x00', 0x0, 0xffffffffffffffff, 0x1, 0x2, 0x4, 0x0, @void, @value, @void, @value}, 0x50) executing program 3: r0 = socket$inet_smc(0x2b, 0x1, 0x0) r1 = syz_init_net_socket$bt_l2cap(0x1f, 0x2, 0x0) bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x11, 0x3, &(0x7f0000000640)=ANY=[@ANYBLOB="180000000031288e8e"], &(0x7f0000000200)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @void, @value}, 0x90) connect$bt_l2cap(r1, &(0x7f0000000040)={0x1f, 0x0, @fixed={'\xaa\xaa\xaa\xaa\xaa', 0x10}, 0x7ff}, 0xe) r2 = openat$kvm(0xffffffffffffff9c, 0x0, 0x0, 0x0) r3 = syz_init_net_socket$bt_bnep(0x1f, 0x3, 0x4) ioctl$sock_bt_bnep_BNEPCONNADD(r3, 0x400442c8, &(0x7f0000000000)=ANY=[@ANYRES32=r1, @ANYBLOB='\x00\x00\x00\x00\x00', @ANYRESHEX, @ANYRES32=r2]) setsockopt$IP_VS_SO_SET_ADD(r0, 0x0, 0x482, &(0x7f0000000000)={0x6, @local, 0x0, 0x0, 'sh\x00', 0x0, 0x0, 0x35}, 0x2c) setsockopt$IP_VS_SO_SET_ADD(r0, 0x0, 0x483, &(0x7f0000000000)={0x6, @local, 0x0, 0x0, 'sh\x00'}, 0x2c) r4 = syz_open_dev$radio(&(0x7f0000000080), 0x3, 0x2) ioctl$VIDIOC_SUBDEV_G_FMT(r4, 0xc0585604, &(0x7f00000000c0)={0x1, 0x0, {0x7ff, 0xf, 0x200e, 0xb, 0x2, 0x4, 0x0, 0x5}}) program crashed: KASAN: slab-use-after-free Read in netdev_unregister_kobject testing program (duration=45s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): [10, 11] detailed listing: executing program 0: r0 = syz_open_dev$dri(&(0x7f0000000080), 0x1, 0x0) r1 = openat(0xffffffffffffff9c, &(0x7f0000000040)='./cgroup/pids.max\x00', 0x2, 0x0) write$cgroup_pid(r1, &(0x7f00000000c0), 0x12) r2 = socket$kcm(0x11, 0x2, 0x300) r3 = socket$alg(0x26, 0x5, 0x0) bind$alg(r3, &(0x7f0000000000)={0x26, 'hash\x00', 0x0, 0x0, 'sha1-avx\x00'}, 0x58) r4 = accept4(r3, 0x0, 0x0, 0x0) recvmsg$unix(r4, &(0x7f0000000400)={0x0, 0x0, 0x0, 0x0, &(0x7f00000003c0)=[@rights={{0x14, 0x1, 0x1, [0xffffffffffffffff]}}], 0x18}, 0x0) setsockopt$sock_attach_bpf(r2, 0x107, 0x12, &(0x7f00000008c0)=r5, 0x4) bpf$OBJ_GET_MAP(0x7, &(0x7f00000003c0)=@o_path={&(0x7f0000000380)='./file0\x00', 0x0, 0x4000, r0}, 0x18) executing program 3: r0 = socket$inet_smc(0x2b, 0x1, 0x0) r1 = syz_init_net_socket$bt_l2cap(0x1f, 0x2, 0x0) bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x11, 0x3, &(0x7f0000000640)=ANY=[@ANYBLOB="180000000031288e8e"], &(0x7f0000000200)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @void, @value}, 0x90) connect$bt_l2cap(r1, &(0x7f0000000040)={0x1f, 0x0, @fixed={'\xaa\xaa\xaa\xaa\xaa', 0x10}, 0x7ff}, 0xe) r2 = openat$kvm(0xffffffffffffff9c, 0x0, 0x0, 0x0) r3 = syz_init_net_socket$bt_bnep(0x1f, 0x3, 0x4) ioctl$sock_bt_bnep_BNEPCONNADD(r3, 0x400442c8, &(0x7f0000000000)=ANY=[@ANYRES32=r1, @ANYBLOB='\x00\x00\x00\x00\x00', @ANYRESHEX, @ANYRES32=r2]) setsockopt$IP_VS_SO_SET_ADD(r0, 0x0, 0x482, &(0x7f0000000000)={0x6, @local, 0x0, 0x0, 'sh\x00', 0x0, 0x0, 0x35}, 0x2c) setsockopt$IP_VS_SO_SET_ADD(r0, 0x0, 0x483, &(0x7f0000000000)={0x6, @local, 0x0, 0x0, 'sh\x00'}, 0x2c) r4 = syz_open_dev$radio(&(0x7f0000000080), 0x3, 0x2) ioctl$VIDIOC_SUBDEV_G_FMT(r4, 0xc0585604, &(0x7f00000000c0)={0x1, 0x0, {0x7ff, 0xf, 0x200e, 0xb, 0x2, 0x4, 0x0, 0x5}}) program crashed: KASAN: slab-use-after-free Read in netdev_unregister_kobject testing program (duration=45s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): [9, 11] detailed listing: executing program 0: syz_open_dev$dri(&(0x7f0000000080), 0x1, 0x0) r0 = openat(0xffffffffffffff9c, &(0x7f0000000040)='./cgroup/pids.max\x00', 0x2, 0x0) write$cgroup_pid(r0, &(0x7f00000000c0), 0x12) r1 = socket$kcm(0x11, 0x2, 0x300) r2 = socket$alg(0x26, 0x5, 0x0) bind$alg(r2, &(0x7f0000000000)={0x26, 'hash\x00', 0x0, 0x0, 'sha1-avx\x00'}, 0x58) r3 = accept4(r2, 0x0, 0x0, 0x0) recvmsg$unix(r3, &(0x7f0000000400)={0x0, 0x0, 0x0, 0x0, &(0x7f00000003c0)=[@rights={{0x14, 0x1, 0x1, [0xffffffffffffffff]}}], 0x18}, 0x0) setsockopt$sock_attach_bpf(r1, 0x107, 0x12, &(0x7f00000008c0)=r4, 0x4) executing program 3: r0 = socket$inet_smc(0x2b, 0x1, 0x0) r1 = syz_init_net_socket$bt_l2cap(0x1f, 0x2, 0x0) bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x11, 0x3, &(0x7f0000000640)=ANY=[@ANYBLOB="180000000031288e8e"], &(0x7f0000000200)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @void, @value}, 0x90) connect$bt_l2cap(r1, &(0x7f0000000040)={0x1f, 0x0, @fixed={'\xaa\xaa\xaa\xaa\xaa', 0x10}, 0x7ff}, 0xe) r2 = openat$kvm(0xffffffffffffff9c, 0x0, 0x0, 0x0) r3 = syz_init_net_socket$bt_bnep(0x1f, 0x3, 0x4) ioctl$sock_bt_bnep_BNEPCONNADD(r3, 0x400442c8, &(0x7f0000000000)=ANY=[@ANYRES32=r1, @ANYBLOB='\x00\x00\x00\x00\x00', @ANYRESHEX, @ANYRES32=r2]) setsockopt$IP_VS_SO_SET_ADD(r0, 0x0, 0x482, &(0x7f0000000000)={0x6, @local, 0x0, 0x0, 'sh\x00', 0x0, 0x0, 0x35}, 0x2c) setsockopt$IP_VS_SO_SET_ADD(r0, 0x0, 0x483, &(0x7f0000000000)={0x6, @local, 0x0, 0x0, 'sh\x00'}, 0x2c) r4 = syz_open_dev$radio(&(0x7f0000000080), 0x3, 0x2) ioctl$VIDIOC_SUBDEV_G_FMT(r4, 0xc0585604, &(0x7f00000000c0)={0x1, 0x0, {0x7ff, 0xf, 0x200e, 0xb, 0x2, 0x4, 0x0, 0x5}}) program crashed: KASAN: slab-use-after-free Read in netdev_unregister_kobject testing program (duration=45s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): [8, 11] detailed listing: executing program 0: syz_open_dev$dri(&(0x7f0000000080), 0x1, 0x0) r0 = openat(0xffffffffffffff9c, &(0x7f0000000040)='./cgroup/pids.max\x00', 0x2, 0x0) write$cgroup_pid(r0, &(0x7f00000000c0), 0x12) socket$kcm(0x11, 0x2, 0x300) r1 = socket$alg(0x26, 0x5, 0x0) bind$alg(r1, &(0x7f0000000000)={0x26, 'hash\x00', 0x0, 0x0, 'sha1-avx\x00'}, 0x58) r2 = accept4(r1, 0x0, 0x0, 0x0) recvmsg$unix(r2, &(0x7f0000000400)={0x0, 0x0, 0x0, 0x0, &(0x7f00000003c0)=[@rights={{0x14, 0x1, 0x1, [0xffffffffffffffff]}}], 0x18}, 0x0) executing program 3: r0 = socket$inet_smc(0x2b, 0x1, 0x0) r1 = syz_init_net_socket$bt_l2cap(0x1f, 0x2, 0x0) bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x11, 0x3, &(0x7f0000000640)=ANY=[@ANYBLOB="180000000031288e8e"], &(0x7f0000000200)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @void, @value}, 0x90) connect$bt_l2cap(r1, &(0x7f0000000040)={0x1f, 0x0, @fixed={'\xaa\xaa\xaa\xaa\xaa', 0x10}, 0x7ff}, 0xe) r2 = openat$kvm(0xffffffffffffff9c, 0x0, 0x0, 0x0) r3 = syz_init_net_socket$bt_bnep(0x1f, 0x3, 0x4) ioctl$sock_bt_bnep_BNEPCONNADD(r3, 0x400442c8, &(0x7f0000000000)=ANY=[@ANYRES32=r1, @ANYBLOB='\x00\x00\x00\x00\x00', @ANYRESHEX, @ANYRES32=r2]) setsockopt$IP_VS_SO_SET_ADD(r0, 0x0, 0x482, &(0x7f0000000000)={0x6, @local, 0x0, 0x0, 'sh\x00', 0x0, 0x0, 0x35}, 0x2c) setsockopt$IP_VS_SO_SET_ADD(r0, 0x0, 0x483, &(0x7f0000000000)={0x6, @local, 0x0, 0x0, 'sh\x00'}, 0x2c) r4 = syz_open_dev$radio(&(0x7f0000000080), 0x3, 0x2) ioctl$VIDIOC_SUBDEV_G_FMT(r4, 0xc0585604, &(0x7f00000000c0)={0x1, 0x0, {0x7ff, 0xf, 0x200e, 0xb, 0x2, 0x4, 0x0, 0x5}}) program crashed: KASAN: slab-use-after-free Read in netdev_unregister_kobject testing program (duration=45s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): [7, 11] detailed listing: executing program 0: syz_open_dev$dri(&(0x7f0000000080), 0x1, 0x0) r0 = openat(0xffffffffffffff9c, &(0x7f0000000040)='./cgroup/pids.max\x00', 0x2, 0x0) write$cgroup_pid(r0, &(0x7f00000000c0), 0x12) socket$kcm(0x11, 0x2, 0x300) r1 = socket$alg(0x26, 0x5, 0x0) bind$alg(r1, &(0x7f0000000000)={0x26, 'hash\x00', 0x0, 0x0, 'sha1-avx\x00'}, 0x58) accept4(r1, 0x0, 0x0, 0x0) executing program 3: r0 = socket$inet_smc(0x2b, 0x1, 0x0) r1 = syz_init_net_socket$bt_l2cap(0x1f, 0x2, 0x0) bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x11, 0x3, &(0x7f0000000640)=ANY=[@ANYBLOB="180000000031288e8e"], &(0x7f0000000200)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @void, @value}, 0x90) connect$bt_l2cap(r1, &(0x7f0000000040)={0x1f, 0x0, @fixed={'\xaa\xaa\xaa\xaa\xaa', 0x10}, 0x7ff}, 0xe) r2 = openat$kvm(0xffffffffffffff9c, 0x0, 0x0, 0x0) r3 = syz_init_net_socket$bt_bnep(0x1f, 0x3, 0x4) ioctl$sock_bt_bnep_BNEPCONNADD(r3, 0x400442c8, &(0x7f0000000000)=ANY=[@ANYRES32=r1, @ANYBLOB='\x00\x00\x00\x00\x00', @ANYRESHEX, @ANYRES32=r2]) setsockopt$IP_VS_SO_SET_ADD(r0, 0x0, 0x482, &(0x7f0000000000)={0x6, @local, 0x0, 0x0, 'sh\x00', 0x0, 0x0, 0x35}, 0x2c) setsockopt$IP_VS_SO_SET_ADD(r0, 0x0, 0x483, &(0x7f0000000000)={0x6, @local, 0x0, 0x0, 'sh\x00'}, 0x2c) r4 = syz_open_dev$radio(&(0x7f0000000080), 0x3, 0x2) ioctl$VIDIOC_SUBDEV_G_FMT(r4, 0xc0585604, &(0x7f00000000c0)={0x1, 0x0, {0x7ff, 0xf, 0x200e, 0xb, 0x2, 0x4, 0x0, 0x5}}) program crashed: KASAN: slab-use-after-free Read in netdev_unregister_kobject testing program (duration=45s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): [6, 11] detailed listing: executing program 0: syz_open_dev$dri(&(0x7f0000000080), 0x1, 0x0) r0 = openat(0xffffffffffffff9c, &(0x7f0000000040)='./cgroup/pids.max\x00', 0x2, 0x0) write$cgroup_pid(r0, &(0x7f00000000c0), 0x12) socket$kcm(0x11, 0x2, 0x300) r1 = socket$alg(0x26, 0x5, 0x0) bind$alg(r1, &(0x7f0000000000)={0x26, 'hash\x00', 0x0, 0x0, 'sha1-avx\x00'}, 0x58) executing program 3: r0 = socket$inet_smc(0x2b, 0x1, 0x0) r1 = syz_init_net_socket$bt_l2cap(0x1f, 0x2, 0x0) bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x11, 0x3, &(0x7f0000000640)=ANY=[@ANYBLOB="180000000031288e8e"], &(0x7f0000000200)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @void, @value}, 0x90) connect$bt_l2cap(r1, &(0x7f0000000040)={0x1f, 0x0, @fixed={'\xaa\xaa\xaa\xaa\xaa', 0x10}, 0x7ff}, 0xe) r2 = openat$kvm(0xffffffffffffff9c, 0x0, 0x0, 0x0) r3 = syz_init_net_socket$bt_bnep(0x1f, 0x3, 0x4) ioctl$sock_bt_bnep_BNEPCONNADD(r3, 0x400442c8, &(0x7f0000000000)=ANY=[@ANYRES32=r1, @ANYBLOB='\x00\x00\x00\x00\x00', @ANYRESHEX, @ANYRES32=r2]) setsockopt$IP_VS_SO_SET_ADD(r0, 0x0, 0x482, &(0x7f0000000000)={0x6, @local, 0x0, 0x0, 'sh\x00', 0x0, 0x0, 0x35}, 0x2c) setsockopt$IP_VS_SO_SET_ADD(r0, 0x0, 0x483, &(0x7f0000000000)={0x6, @local, 0x0, 0x0, 'sh\x00'}, 0x2c) r4 = syz_open_dev$radio(&(0x7f0000000080), 0x3, 0x2) ioctl$VIDIOC_SUBDEV_G_FMT(r4, 0xc0585604, &(0x7f00000000c0)={0x1, 0x0, {0x7ff, 0xf, 0x200e, 0xb, 0x2, 0x4, 0x0, 0x5}}) program crashed: KASAN: slab-use-after-free Read in netdev_unregister_kobject testing program (duration=45s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): [5, 11] detailed listing: executing program 0: syz_open_dev$dri(&(0x7f0000000080), 0x1, 0x0) r0 = openat(0xffffffffffffff9c, &(0x7f0000000040)='./cgroup/pids.max\x00', 0x2, 0x0) write$cgroup_pid(r0, &(0x7f00000000c0), 0x12) socket$kcm(0x11, 0x2, 0x300) socket$alg(0x26, 0x5, 0x0) executing program 3: r0 = socket$inet_smc(0x2b, 0x1, 0x0) r1 = syz_init_net_socket$bt_l2cap(0x1f, 0x2, 0x0) bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x11, 0x3, &(0x7f0000000640)=ANY=[@ANYBLOB="180000000031288e8e"], &(0x7f0000000200)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @void, @value}, 0x90) connect$bt_l2cap(r1, &(0x7f0000000040)={0x1f, 0x0, @fixed={'\xaa\xaa\xaa\xaa\xaa', 0x10}, 0x7ff}, 0xe) r2 = openat$kvm(0xffffffffffffff9c, 0x0, 0x0, 0x0) r3 = syz_init_net_socket$bt_bnep(0x1f, 0x3, 0x4) ioctl$sock_bt_bnep_BNEPCONNADD(r3, 0x400442c8, &(0x7f0000000000)=ANY=[@ANYRES32=r1, @ANYBLOB='\x00\x00\x00\x00\x00', @ANYRESHEX, @ANYRES32=r2]) setsockopt$IP_VS_SO_SET_ADD(r0, 0x0, 0x482, &(0x7f0000000000)={0x6, @local, 0x0, 0x0, 'sh\x00', 0x0, 0x0, 0x35}, 0x2c) setsockopt$IP_VS_SO_SET_ADD(r0, 0x0, 0x483, &(0x7f0000000000)={0x6, @local, 0x0, 0x0, 'sh\x00'}, 0x2c) r4 = syz_open_dev$radio(&(0x7f0000000080), 0x3, 0x2) ioctl$VIDIOC_SUBDEV_G_FMT(r4, 0xc0585604, &(0x7f00000000c0)={0x1, 0x0, {0x7ff, 0xf, 0x200e, 0xb, 0x2, 0x4, 0x0, 0x5}}) program crashed: KASAN: slab-use-after-free Read in netdev_unregister_kobject testing program (duration=45s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): [4, 11] detailed listing: executing program 0: syz_open_dev$dri(&(0x7f0000000080), 0x1, 0x0) r0 = openat(0xffffffffffffff9c, &(0x7f0000000040)='./cgroup/pids.max\x00', 0x2, 0x0) write$cgroup_pid(r0, &(0x7f00000000c0), 0x12) socket$kcm(0x11, 0x2, 0x300) executing program 3: r0 = socket$inet_smc(0x2b, 0x1, 0x0) r1 = syz_init_net_socket$bt_l2cap(0x1f, 0x2, 0x0) bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x11, 0x3, &(0x7f0000000640)=ANY=[@ANYBLOB="180000000031288e8e"], &(0x7f0000000200)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @void, @value}, 0x90) connect$bt_l2cap(r1, &(0x7f0000000040)={0x1f, 0x0, @fixed={'\xaa\xaa\xaa\xaa\xaa', 0x10}, 0x7ff}, 0xe) r2 = openat$kvm(0xffffffffffffff9c, 0x0, 0x0, 0x0) r3 = syz_init_net_socket$bt_bnep(0x1f, 0x3, 0x4) ioctl$sock_bt_bnep_BNEPCONNADD(r3, 0x400442c8, &(0x7f0000000000)=ANY=[@ANYRES32=r1, @ANYBLOB='\x00\x00\x00\x00\x00', @ANYRESHEX, @ANYRES32=r2]) setsockopt$IP_VS_SO_SET_ADD(r0, 0x0, 0x482, &(0x7f0000000000)={0x6, @local, 0x0, 0x0, 'sh\x00', 0x0, 0x0, 0x35}, 0x2c) setsockopt$IP_VS_SO_SET_ADD(r0, 0x0, 0x483, &(0x7f0000000000)={0x6, @local, 0x0, 0x0, 'sh\x00'}, 0x2c) r4 = syz_open_dev$radio(&(0x7f0000000080), 0x3, 0x2) ioctl$VIDIOC_SUBDEV_G_FMT(r4, 0xc0585604, &(0x7f00000000c0)={0x1, 0x0, {0x7ff, 0xf, 0x200e, 0xb, 0x2, 0x4, 0x0, 0x5}}) program crashed: KASAN: slab-use-after-free Read in netdev_unregister_kobject testing program (duration=45s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): [3, 11] detailed listing: executing program 0: syz_open_dev$dri(&(0x7f0000000080), 0x1, 0x0) r0 = openat(0xffffffffffffff9c, &(0x7f0000000040)='./cgroup/pids.max\x00', 0x2, 0x0) write$cgroup_pid(r0, &(0x7f00000000c0), 0x12) executing program 3: r0 = socket$inet_smc(0x2b, 0x1, 0x0) r1 = syz_init_net_socket$bt_l2cap(0x1f, 0x2, 0x0) bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x11, 0x3, &(0x7f0000000640)=ANY=[@ANYBLOB="180000000031288e8e"], &(0x7f0000000200)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @void, @value}, 0x90) connect$bt_l2cap(r1, &(0x7f0000000040)={0x1f, 0x0, @fixed={'\xaa\xaa\xaa\xaa\xaa', 0x10}, 0x7ff}, 0xe) r2 = openat$kvm(0xffffffffffffff9c, 0x0, 0x0, 0x0) r3 = syz_init_net_socket$bt_bnep(0x1f, 0x3, 0x4) ioctl$sock_bt_bnep_BNEPCONNADD(r3, 0x400442c8, &(0x7f0000000000)=ANY=[@ANYRES32=r1, @ANYBLOB='\x00\x00\x00\x00\x00', @ANYRESHEX, @ANYRES32=r2]) setsockopt$IP_VS_SO_SET_ADD(r0, 0x0, 0x482, &(0x7f0000000000)={0x6, @local, 0x0, 0x0, 'sh\x00', 0x0, 0x0, 0x35}, 0x2c) setsockopt$IP_VS_SO_SET_ADD(r0, 0x0, 0x483, &(0x7f0000000000)={0x6, @local, 0x0, 0x0, 'sh\x00'}, 0x2c) r4 = syz_open_dev$radio(&(0x7f0000000080), 0x3, 0x2) ioctl$VIDIOC_SUBDEV_G_FMT(r4, 0xc0585604, &(0x7f00000000c0)={0x1, 0x0, {0x7ff, 0xf, 0x200e, 0xb, 0x2, 0x4, 0x0, 0x5}}) program crashed: KASAN: slab-use-after-free Read in netdev_unregister_kobject testing program (duration=45s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): [2, 11] detailed listing: executing program 0: syz_open_dev$dri(&(0x7f0000000080), 0x1, 0x0) openat(0xffffffffffffff9c, &(0x7f0000000040)='./cgroup/pids.max\x00', 0x2, 0x0) executing program 3: r0 = socket$inet_smc(0x2b, 0x1, 0x0) r1 = syz_init_net_socket$bt_l2cap(0x1f, 0x2, 0x0) bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x11, 0x3, &(0x7f0000000640)=ANY=[@ANYBLOB="180000000031288e8e"], &(0x7f0000000200)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @void, @value}, 0x90) connect$bt_l2cap(r1, &(0x7f0000000040)={0x1f, 0x0, @fixed={'\xaa\xaa\xaa\xaa\xaa', 0x10}, 0x7ff}, 0xe) r2 = openat$kvm(0xffffffffffffff9c, 0x0, 0x0, 0x0) r3 = syz_init_net_socket$bt_bnep(0x1f, 0x3, 0x4) ioctl$sock_bt_bnep_BNEPCONNADD(r3, 0x400442c8, &(0x7f0000000000)=ANY=[@ANYRES32=r1, @ANYBLOB='\x00\x00\x00\x00\x00', @ANYRESHEX, @ANYRES32=r2]) setsockopt$IP_VS_SO_SET_ADD(r0, 0x0, 0x482, &(0x7f0000000000)={0x6, @local, 0x0, 0x0, 'sh\x00', 0x0, 0x0, 0x35}, 0x2c) setsockopt$IP_VS_SO_SET_ADD(r0, 0x0, 0x483, &(0x7f0000000000)={0x6, @local, 0x0, 0x0, 'sh\x00'}, 0x2c) r4 = syz_open_dev$radio(&(0x7f0000000080), 0x3, 0x2) ioctl$VIDIOC_SUBDEV_G_FMT(r4, 0xc0585604, &(0x7f00000000c0)={0x1, 0x0, {0x7ff, 0xf, 0x200e, 0xb, 0x2, 0x4, 0x0, 0x5}}) program crashed: KASAN: slab-use-after-free Read in netdev_unregister_kobject testing program (duration=45s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): [1, 11] detailed listing: executing program 0: syz_open_dev$dri(&(0x7f0000000080), 0x1, 0x0) executing program 3: r0 = socket$inet_smc(0x2b, 0x1, 0x0) r1 = syz_init_net_socket$bt_l2cap(0x1f, 0x2, 0x0) bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x11, 0x3, &(0x7f0000000640)=ANY=[@ANYBLOB="180000000031288e8e"], &(0x7f0000000200)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @void, @value}, 0x90) connect$bt_l2cap(r1, &(0x7f0000000040)={0x1f, 0x0, @fixed={'\xaa\xaa\xaa\xaa\xaa', 0x10}, 0x7ff}, 0xe) r2 = openat$kvm(0xffffffffffffff9c, 0x0, 0x0, 0x0) r3 = syz_init_net_socket$bt_bnep(0x1f, 0x3, 0x4) ioctl$sock_bt_bnep_BNEPCONNADD(r3, 0x400442c8, &(0x7f0000000000)=ANY=[@ANYRES32=r1, @ANYBLOB='\x00\x00\x00\x00\x00', @ANYRESHEX, @ANYRES32=r2]) setsockopt$IP_VS_SO_SET_ADD(r0, 0x0, 0x482, &(0x7f0000000000)={0x6, @local, 0x0, 0x0, 'sh\x00', 0x0, 0x0, 0x35}, 0x2c) setsockopt$IP_VS_SO_SET_ADD(r0, 0x0, 0x483, &(0x7f0000000000)={0x6, @local, 0x0, 0x0, 'sh\x00'}, 0x2c) r4 = syz_open_dev$radio(&(0x7f0000000080), 0x3, 0x2) ioctl$VIDIOC_SUBDEV_G_FMT(r4, 0xc0585604, &(0x7f00000000c0)={0x1, 0x0, {0x7ff, 0xf, 0x200e, 0xb, 0x2, 0x4, 0x0, 0x5}}) program crashed: KASAN: slab-use-after-free Read in netdev_unregister_kobject testing program (duration=45s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): [0, 11] detailed listing: executing program 0: executing program 3: r0 = socket$inet_smc(0x2b, 0x1, 0x0) r1 = syz_init_net_socket$bt_l2cap(0x1f, 0x2, 0x0) bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x11, 0x3, &(0x7f0000000640)=ANY=[@ANYBLOB="180000000031288e8e"], &(0x7f0000000200)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @void, @value}, 0x90) connect$bt_l2cap(r1, &(0x7f0000000040)={0x1f, 0x0, @fixed={'\xaa\xaa\xaa\xaa\xaa', 0x10}, 0x7ff}, 0xe) r2 = openat$kvm(0xffffffffffffff9c, 0x0, 0x0, 0x0) r3 = syz_init_net_socket$bt_bnep(0x1f, 0x3, 0x4) ioctl$sock_bt_bnep_BNEPCONNADD(r3, 0x400442c8, &(0x7f0000000000)=ANY=[@ANYRES32=r1, @ANYBLOB='\x00\x00\x00\x00\x00', @ANYRESHEX, @ANYRES32=r2]) setsockopt$IP_VS_SO_SET_ADD(r0, 0x0, 0x482, &(0x7f0000000000)={0x6, @local, 0x0, 0x0, 'sh\x00', 0x0, 0x0, 0x35}, 0x2c) setsockopt$IP_VS_SO_SET_ADD(r0, 0x0, 0x483, &(0x7f0000000000)={0x6, @local, 0x0, 0x0, 'sh\x00'}, 0x2c) r4 = syz_open_dev$radio(&(0x7f0000000080), 0x3, 0x2) ioctl$VIDIOC_SUBDEV_G_FMT(r4, 0xc0585604, &(0x7f00000000c0)={0x1, 0x0, {0x7ff, 0xf, 0x200e, 0xb, 0x2, 0x4, 0x0, 0x5}}) program crashed: KASAN: slab-use-after-free Read in netdev_unregister_kobject minimized 30 calls -> 0 calls minimizing program #1 before concatenation testing program (duration=45s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): [0, 10] detailed listing: executing program 2: executing program 0: r0 = socket$inet_smc(0x2b, 0x1, 0x0) r1 = syz_init_net_socket$bt_l2cap(0x1f, 0x2, 0x0) bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x11, 0x3, &(0x7f0000000640)=ANY=[@ANYBLOB="180000000031288e8e"], &(0x7f0000000200)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @void, @value}, 0x90) connect$bt_l2cap(r1, &(0x7f0000000040)={0x1f, 0x0, @fixed={'\xaa\xaa\xaa\xaa\xaa', 0x10}, 0x7ff}, 0xe) r2 = openat$kvm(0xffffffffffffff9c, 0x0, 0x0, 0x0) r3 = syz_init_net_socket$bt_bnep(0x1f, 0x3, 0x4) ioctl$sock_bt_bnep_BNEPCONNADD(r3, 0x400442c8, &(0x7f0000000000)=ANY=[@ANYRES32=r1, @ANYBLOB='\x00\x00\x00\x00\x00', @ANYRESHEX, @ANYRES32=r2]) setsockopt$IP_VS_SO_SET_ADD(r0, 0x0, 0x482, &(0x7f0000000000)={0x6, @local, 0x0, 0x0, 'sh\x00', 0x0, 0x0, 0x35}, 0x2c) setsockopt$IP_VS_SO_SET_ADD(r0, 0x0, 0x483, &(0x7f0000000000)={0x6, @local, 0x0, 0x0, 'sh\x00'}, 0x2c) syz_open_dev$radio(&(0x7f0000000080), 0x3, 0x2) program crashed: KASAN: slab-use-after-free Read in netdev_unregister_kobject testing program (duration=45s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): [0, 9] detailed listing: executing program 2: executing program 0: r0 = socket$inet_smc(0x2b, 0x1, 0x0) r1 = syz_init_net_socket$bt_l2cap(0x1f, 0x2, 0x0) bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x11, 0x3, &(0x7f0000000640)=ANY=[@ANYBLOB="180000000031288e8e"], &(0x7f0000000200)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @void, @value}, 0x90) connect$bt_l2cap(r1, &(0x7f0000000040)={0x1f, 0x0, @fixed={'\xaa\xaa\xaa\xaa\xaa', 0x10}, 0x7ff}, 0xe) r2 = openat$kvm(0xffffffffffffff9c, 0x0, 0x0, 0x0) r3 = syz_init_net_socket$bt_bnep(0x1f, 0x3, 0x4) ioctl$sock_bt_bnep_BNEPCONNADD(r3, 0x400442c8, &(0x7f0000000000)=ANY=[@ANYRES32=r1, @ANYBLOB='\x00\x00\x00\x00\x00', @ANYRESHEX, @ANYRES32=r2]) setsockopt$IP_VS_SO_SET_ADD(r0, 0x0, 0x482, &(0x7f0000000000)={0x6, @local, 0x0, 0x0, 'sh\x00', 0x0, 0x0, 0x35}, 0x2c) setsockopt$IP_VS_SO_SET_ADD(r0, 0x0, 0x483, &(0x7f0000000000)={0x6, @local, 0x0, 0x0, 'sh\x00'}, 0x2c) program crashed: KASAN: slab-use-after-free Read in netdev_unregister_kobject testing program (duration=45s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): [0, 8] detailed listing: executing program 2: executing program 0: r0 = socket$inet_smc(0x2b, 0x1, 0x0) r1 = syz_init_net_socket$bt_l2cap(0x1f, 0x2, 0x0) bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x11, 0x3, &(0x7f0000000640)=ANY=[@ANYBLOB="180000000031288e8e"], &(0x7f0000000200)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @void, @value}, 0x90) connect$bt_l2cap(r1, &(0x7f0000000040)={0x1f, 0x0, @fixed={'\xaa\xaa\xaa\xaa\xaa', 0x10}, 0x7ff}, 0xe) r2 = openat$kvm(0xffffffffffffff9c, 0x0, 0x0, 0x0) r3 = syz_init_net_socket$bt_bnep(0x1f, 0x3, 0x4) ioctl$sock_bt_bnep_BNEPCONNADD(r3, 0x400442c8, &(0x7f0000000000)=ANY=[@ANYRES32=r1, @ANYBLOB='\x00\x00\x00\x00\x00', @ANYRESHEX, @ANYRES32=r2]) setsockopt$IP_VS_SO_SET_ADD(r0, 0x0, 0x482, &(0x7f0000000000)={0x6, @local, 0x0, 0x0, 'sh\x00', 0x0, 0x0, 0x35}, 0x2c) program crashed: KASAN: slab-use-after-free Read in netdev_unregister_kobject testing program (duration=45s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): [0, 7] detailed listing: executing program 2: executing program 0: socket$inet_smc(0x2b, 0x1, 0x0) r0 = syz_init_net_socket$bt_l2cap(0x1f, 0x2, 0x0) bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x11, 0x3, &(0x7f0000000640)=ANY=[@ANYBLOB="180000000031288e8e"], &(0x7f0000000200)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @void, @value}, 0x90) connect$bt_l2cap(r0, &(0x7f0000000040)={0x1f, 0x0, @fixed={'\xaa\xaa\xaa\xaa\xaa', 0x10}, 0x7ff}, 0xe) r1 = openat$kvm(0xffffffffffffff9c, 0x0, 0x0, 0x0) r2 = syz_init_net_socket$bt_bnep(0x1f, 0x3, 0x4) ioctl$sock_bt_bnep_BNEPCONNADD(r2, 0x400442c8, &(0x7f0000000000)=ANY=[@ANYRES32=r0, @ANYBLOB='\x00\x00\x00\x00\x00', @ANYRESHEX, @ANYRES32=r1]) program crashed: KASAN: slab-use-after-free Read in netdev_unregister_kobject testing program (duration=45s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): [0, 6] detailed listing: executing program 2: executing program 0: socket$inet_smc(0x2b, 0x1, 0x0) r0 = syz_init_net_socket$bt_l2cap(0x1f, 0x2, 0x0) bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x11, 0x3, &(0x7f0000000640)=ANY=[@ANYBLOB="180000000031288e8e"], &(0x7f0000000200)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @void, @value}, 0x90) connect$bt_l2cap(r0, &(0x7f0000000040)={0x1f, 0x0, @fixed={'\xaa\xaa\xaa\xaa\xaa', 0x10}, 0x7ff}, 0xe) openat$kvm(0xffffffffffffff9c, 0x0, 0x0, 0x0) syz_init_net_socket$bt_bnep(0x1f, 0x3, 0x4) program did not crash testing program (duration=45s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): [0, 6] detailed listing: executing program 2: executing program 0: socket$inet_smc(0x2b, 0x1, 0x0) r0 = syz_init_net_socket$bt_l2cap(0x1f, 0x2, 0x0) bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x11, 0x3, &(0x7f0000000640)=ANY=[@ANYBLOB="180000000031288e8e"], &(0x7f0000000200)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @void, @value}, 0x90) connect$bt_l2cap(r0, &(0x7f0000000040)={0x1f, 0x0, @fixed={'\xaa\xaa\xaa\xaa\xaa', 0x10}, 0x7ff}, 0xe) r1 = openat$kvm(0xffffffffffffff9c, 0x0, 0x0, 0x0) ioctl$sock_bt_bnep_BNEPCONNADD(0xffffffffffffffff, 0x400442c8, &(0x7f0000000000)=ANY=[@ANYRES32=r0, @ANYBLOB='\x00\x00\x00\x00\x00', @ANYRESHEX, @ANYRES32=r1]) program did not crash testing program (duration=45s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): [0, 6] detailed listing: executing program 2: executing program 0: socket$inet_smc(0x2b, 0x1, 0x0) r0 = syz_init_net_socket$bt_l2cap(0x1f, 0x2, 0x0) bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x11, 0x3, &(0x7f0000000640)=ANY=[@ANYBLOB="180000000031288e8e"], &(0x7f0000000200)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @void, @value}, 0x90) connect$bt_l2cap(r0, &(0x7f0000000040)={0x1f, 0x0, @fixed={'\xaa\xaa\xaa\xaa\xaa', 0x10}, 0x7ff}, 0xe) r1 = syz_init_net_socket$bt_bnep(0x1f, 0x3, 0x4) ioctl$sock_bt_bnep_BNEPCONNADD(r1, 0x400442c8, &(0x7f0000000000)=ANY=[@ANYRES32=r0, @ANYBLOB='\x00\x00\x00\x00\x00', @ANYRESHEX, @ANYRES32]) program crashed: KASAN: slab-use-after-free Read in netdev_unregister_kobject testing program (duration=45s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): [0, 5] detailed listing: executing program 2: executing program 0: socket$inet_smc(0x2b, 0x1, 0x0) r0 = syz_init_net_socket$bt_l2cap(0x1f, 0x2, 0x0) bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x11, 0x3, &(0x7f0000000640)=ANY=[@ANYBLOB="180000000031288e8e"], &(0x7f0000000200)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @void, @value}, 0x90) r1 = syz_init_net_socket$bt_bnep(0x1f, 0x3, 0x4) ioctl$sock_bt_bnep_BNEPCONNADD(r1, 0x400442c8, &(0x7f0000000000)=ANY=[@ANYRES32=r0, @ANYBLOB='\x00\x00\x00\x00\x00', @ANYRESHEX, @ANYRES32]) program did not crash testing program (duration=45s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): [0, 5] detailed listing: executing program 2: executing program 0: socket$inet_smc(0x2b, 0x1, 0x0) r0 = syz_init_net_socket$bt_l2cap(0x1f, 0x2, 0x0) connect$bt_l2cap(r0, &(0x7f0000000040)={0x1f, 0x0, @fixed={'\xaa\xaa\xaa\xaa\xaa', 0x10}, 0x7ff}, 0xe) r1 = syz_init_net_socket$bt_bnep(0x1f, 0x3, 0x4) ioctl$sock_bt_bnep_BNEPCONNADD(r1, 0x400442c8, &(0x7f0000000000)=ANY=[@ANYRES32=r0, @ANYBLOB='\x00\x00\x00\x00\x00', @ANYRESHEX, @ANYRES32]) program crashed: KASAN: slab-use-after-free Read in netdev_unregister_kobject testing program (duration=45s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): [0, 4] detailed listing: executing program 2: executing program 0: socket$inet_smc(0x2b, 0x1, 0x0) connect$bt_l2cap(0xffffffffffffffff, &(0x7f0000000040)={0x1f, 0x0, @fixed={'\xaa\xaa\xaa\xaa\xaa', 0x10}, 0x7ff}, 0xe) r0 = syz_init_net_socket$bt_bnep(0x1f, 0x3, 0x4) ioctl$sock_bt_bnep_BNEPCONNADD(r0, 0x400442c8, &(0x7f0000000000)=ANY=[@ANYRES32, @ANYBLOB='\x00\x00\x00\x00\x00', @ANYRESHEX, @ANYRES32]) program did not crash testing program (duration=45s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): [0, 4] detailed listing: executing program 2: executing program 0: r0 = syz_init_net_socket$bt_l2cap(0x1f, 0x2, 0x0) connect$bt_l2cap(r0, &(0x7f0000000040)={0x1f, 0x0, @fixed={'\xaa\xaa\xaa\xaa\xaa', 0x10}, 0x7ff}, 0xe) r1 = syz_init_net_socket$bt_bnep(0x1f, 0x3, 0x4) ioctl$sock_bt_bnep_BNEPCONNADD(r1, 0x400442c8, &(0x7f0000000000)=ANY=[@ANYRES32=r0, @ANYBLOB='\x00\x00\x00\x00\x00', @ANYRESHEX, @ANYRES32]) program crashed: KASAN: slab-use-after-free Read in netdev_unregister_kobject minimized 11 calls -> 4 calls testing program (duration=45s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_init_net_socket$bt_l2cap-connect$bt_l2cap-syz_init_net_socket$bt_bnep-ioctl$sock_bt_bnep_BNEPCONNADD detailed listing: executing program 0: r0 = syz_init_net_socket$bt_l2cap(0x1f, 0x2, 0x0) connect$bt_l2cap(r0, &(0x7f0000000040)={0x1f, 0x0, @fixed={'\xaa\xaa\xaa\xaa\xaa', 0x10}, 0x7ff}, 0xe) r1 = syz_init_net_socket$bt_bnep(0x1f, 0x3, 0x4) ioctl$sock_bt_bnep_BNEPCONNADD(r1, 0x400442c8, &(0x7f0000000000)=ANY=[@ANYRES32=r0, @ANYBLOB='\x00\x00\x00\x00\x00', @ANYRESHEX, @ANYRES32]) program crashed: KASAN: slab-use-after-free Read in netdev_unregister_kobject bisect: concatenation succeeded found reproducer with 4 syscalls minimizing guilty program testing program (duration=45s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_init_net_socket$bt_l2cap-connect$bt_l2cap-syz_init_net_socket$bt_bnep detailed listing: executing program 0: r0 = syz_init_net_socket$bt_l2cap(0x1f, 0x2, 0x0) connect$bt_l2cap(r0, &(0x7f0000000040)={0x1f, 0x0, @fixed={'\xaa\xaa\xaa\xaa\xaa', 0x10}, 0x7ff}, 0xe) syz_init_net_socket$bt_bnep(0x1f, 0x3, 0x4) program did not crash testing program (duration=45s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_init_net_socket$bt_l2cap-connect$bt_l2cap-ioctl$sock_bt_bnep_BNEPCONNADD detailed listing: executing program 0: r0 = syz_init_net_socket$bt_l2cap(0x1f, 0x2, 0x0) connect$bt_l2cap(r0, &(0x7f0000000040)={0x1f, 0x0, @fixed={'\xaa\xaa\xaa\xaa\xaa', 0x10}, 0x7ff}, 0xe) ioctl$sock_bt_bnep_BNEPCONNADD(0xffffffffffffffff, 0x400442c8, &(0x7f0000000000)=ANY=[@ANYRES32=r0, @ANYBLOB='\x00\x00\x00\x00\x00', @ANYRESHEX, @ANYRES32]) program did not crash testing program (duration=45s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_init_net_socket$bt_l2cap-syz_init_net_socket$bt_bnep-ioctl$sock_bt_bnep_BNEPCONNADD detailed listing: executing program 0: r0 = syz_init_net_socket$bt_l2cap(0x1f, 0x2, 0x0) r1 = syz_init_net_socket$bt_bnep(0x1f, 0x3, 0x4) ioctl$sock_bt_bnep_BNEPCONNADD(r1, 0x400442c8, &(0x7f0000000000)=ANY=[@ANYRES32=r0, @ANYBLOB='\x00\x00\x00\x00\x00', @ANYRESHEX, @ANYRES32]) program did not crash testing program (duration=45s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): connect$bt_l2cap-syz_init_net_socket$bt_bnep-ioctl$sock_bt_bnep_BNEPCONNADD detailed listing: executing program 0: connect$bt_l2cap(0xffffffffffffffff, &(0x7f0000000040)={0x1f, 0x0, @fixed={'\xaa\xaa\xaa\xaa\xaa', 0x10}, 0x7ff}, 0xe) r0 = syz_init_net_socket$bt_bnep(0x1f, 0x3, 0x4) ioctl$sock_bt_bnep_BNEPCONNADD(r0, 0x400442c8, &(0x7f0000000000)=ANY=[@ANYRES32, @ANYBLOB='\x00\x00\x00\x00\x00', @ANYRESHEX, @ANYRES32]) program did not crash testing program (duration=45s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_init_net_socket$bt_l2cap-connect$bt_l2cap-syz_init_net_socket$bt_bnep-ioctl$sock_bt_bnep_BNEPCONNADD detailed listing: executing program 0: r0 = syz_init_net_socket$bt_l2cap(0x1f, 0x2, 0x0) connect$bt_l2cap(r0, 0x0, 0x0) r1 = syz_init_net_socket$bt_bnep(0x1f, 0x3, 0x4) ioctl$sock_bt_bnep_BNEPCONNADD(r1, 0x400442c8, &(0x7f0000000000)=ANY=[@ANYRES32=r0, @ANYBLOB='\x00\x00\x00\x00\x00', @ANYRESHEX, @ANYRES32]) program did not crash testing program (duration=45s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_init_net_socket$bt_l2cap-connect$bt_l2cap-syz_init_net_socket$bt_bnep-ioctl$sock_bt_bnep_BNEPCONNADD detailed listing: executing program 0: r0 = syz_init_net_socket$bt_l2cap(0x1f, 0x2, 0x0) connect$bt_l2cap(r0, &(0x7f0000000040)={0x1f, 0x0, @fixed={'\xaa\xaa\xaa\xaa\xaa', 0x10}, 0x7ff}, 0xe) r1 = syz_init_net_socket$bt_bnep(0x1f, 0x3, 0x4) ioctl$sock_bt_bnep_BNEPCONNADD(r1, 0x400442c8, 0x0) program did not crash testing program (duration=45s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_init_net_socket$bt_l2cap-connect$bt_l2cap-syz_init_net_socket$bt_bnep-ioctl$sock_bt_bnep_BNEPCONNADD detailed listing: executing program 0: r0 = syz_init_net_socket$bt_l2cap(0x1f, 0x2, 0x0) connect$bt_l2cap(r0, &(0x7f0000000040)={0x1f, 0x0, @fixed={'\xaa\xaa\xaa\xaa\xaa', 0x10}, 0x7ff}, 0xe) r1 = syz_init_net_socket$bt_bnep(0x1f, 0x3, 0x4) ioctl$sock_bt_bnep_BNEPCONNADD(r1, 0x400442c8, &(0x7f0000000000)=ANY=[]) program did not crash testing program (duration=45s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_init_net_socket$bt_l2cap-connect$bt_l2cap-syz_init_net_socket$bt_bnep-ioctl$sock_bt_bnep_BNEPCONNADD detailed listing: executing program 0: r0 = syz_init_net_socket$bt_l2cap(0x1f, 0x2, 0x0) connect$bt_l2cap(r0, &(0x7f0000000040)={0x1f, 0x0, @fixed={'\xaa\xaa\xaa\xaa\xaa', 0x10}, 0x7ff}, 0xe) r1 = syz_init_net_socket$bt_bnep(0x1f, 0x3, 0x4) ioctl$sock_bt_bnep_BNEPCONNADD(r1, 0x400442c8, &(0x7f0000000000)=ANY=[@ANYRES32=r0, @ANYBLOB, @ANYRESHEX, @ANYRES32]) program did not crash extracting C reproducer testing compiled C program (duration=45s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_init_net_socket$bt_l2cap-connect$bt_l2cap-syz_init_net_socket$bt_bnep-ioctl$sock_bt_bnep_BNEPCONNADD program did not crash simplifying guilty program options testing program (duration=45s, {Threaded:false Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_init_net_socket$bt_l2cap-connect$bt_l2cap-syz_init_net_socket$bt_bnep-ioctl$sock_bt_bnep_BNEPCONNADD detailed listing: executing program 0: r0 = syz_init_net_socket$bt_l2cap(0x1f, 0x2, 0x0) connect$bt_l2cap(r0, &(0x7f0000000040)={0x1f, 0x0, @fixed={'\xaa\xaa\xaa\xaa\xaa', 0x10}, 0x7ff}, 0xe) r1 = syz_init_net_socket$bt_bnep(0x1f, 0x3, 0x4) ioctl$sock_bt_bnep_BNEPCONNADD(r1, 0x400442c8, &(0x7f0000000000)=ANY=[@ANYRES32=r0, @ANYBLOB='\x00\x00\x00\x00\x00', @ANYRESHEX, @ANYRES32]) program crashed: KASAN: slab-use-after-free Read in netdev_unregister_kobject extracting C reproducer testing compiled C program (duration=45s, {Threaded:false Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_init_net_socket$bt_l2cap-connect$bt_l2cap-syz_init_net_socket$bt_bnep-ioctl$sock_bt_bnep_BNEPCONNADD program did not crash testing program (duration=45s, {Threaded:false Repeat:false RepeatTimes:0 Procs:1 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:false Cgroups:false BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_init_net_socket$bt_l2cap-connect$bt_l2cap-syz_init_net_socket$bt_bnep-ioctl$sock_bt_bnep_BNEPCONNADD detailed listing: executing program 0: r0 = syz_init_net_socket$bt_l2cap(0x1f, 0x2, 0x0) connect$bt_l2cap(r0, &(0x7f0000000040)={0x1f, 0x0, @fixed={'\xaa\xaa\xaa\xaa\xaa', 0x10}, 0x7ff}, 0xe) r1 = syz_init_net_socket$bt_bnep(0x1f, 0x3, 0x4) ioctl$sock_bt_bnep_BNEPCONNADD(r1, 0x400442c8, &(0x7f0000000000)=ANY=[@ANYRES32=r0, @ANYBLOB='\x00\x00\x00\x00\x00', @ANYRESHEX, @ANYRES32]) program did not crash testing program (duration=45s, {Threaded:false Repeat:true RepeatTimes:0 Procs:1 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_init_net_socket$bt_l2cap-connect$bt_l2cap-syz_init_net_socket$bt_bnep-ioctl$sock_bt_bnep_BNEPCONNADD detailed listing: executing program 0: r0 = syz_init_net_socket$bt_l2cap(0x1f, 0x2, 0x0) connect$bt_l2cap(r0, &(0x7f0000000040)={0x1f, 0x0, @fixed={'\xaa\xaa\xaa\xaa\xaa', 0x10}, 0x7ff}, 0xe) r1 = syz_init_net_socket$bt_bnep(0x1f, 0x3, 0x4) ioctl$sock_bt_bnep_BNEPCONNADD(r1, 0x400442c8, &(0x7f0000000000)=ANY=[@ANYRES32=r0, @ANYBLOB='\x00\x00\x00\x00\x00', @ANYRESHEX, @ANYRES32]) program crashed: KASAN: slab-use-after-free Read in netdev_unregister_kobject extracting C reproducer testing compiled C program (duration=45s, {Threaded:false Repeat:true RepeatTimes:0 Procs:1 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_init_net_socket$bt_l2cap-connect$bt_l2cap-syz_init_net_socket$bt_bnep-ioctl$sock_bt_bnep_BNEPCONNADD program did not crash reproducing took 53m49.174285486s repro crashed as (corrupted=false): ================================================================== BUG: KASAN: slab-use-after-free in device_for_each_child+0x18f/0x1a0 drivers/base/core.c:3996 Read of size 8 at addr ffff88802430d308 by task kbnepd xfffffff/6089 CPU: 0 UID: 0 PID: 6089 Comm: kbnepd xfffffff Not tainted 6.12.0-rc6-syzkaller-00077-g2e1b3cc9d7f7 #0 Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2~bpo12+1 04/01/2014 Call Trace: __dump_stack lib/dump_stack.c:94 [inline] dump_stack_lvl+0x116/0x1f0 lib/dump_stack.c:120 print_address_description mm/kasan/report.c:377 [inline] print_report+0xc3/0x620 mm/kasan/report.c:488 kasan_report+0xd9/0x110 mm/kasan/report.c:601 device_for_each_child+0x18f/0x1a0 drivers/base/core.c:3996 pm_runtime_set_memalloc_noio+0xf2/0x180 drivers/base/power/runtime.c:248 netdev_unregister_kobject+0x1ed/0x270 net/core/net-sysfs.c:2109 unregister_netdevice_many_notify+0x1055/0x1e50 net/core/dev.c:11441 unregister_netdevice_many net/core/dev.c:11469 [inline] unregister_netdevice_queue+0x307/0x3f0 net/core/dev.c:11343 unregister_netdevice include/linux/netdevice.h:3118 [inline] unregister_netdev+0x1c/0x30 net/core/dev.c:11487 bnep_session+0x2210/0x2d60 net/bluetooth/bnep/core.c:525 kthread+0x2c1/0x3a0 kernel/kthread.c:389 ret_from_fork+0x45/0x80 arch/x86/kernel/process.c:147 ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:244 Allocated by task 6038: kasan_save_stack+0x33/0x60 mm/kasan/common.c:47 kasan_save_track+0x14/0x30 mm/kasan/common.c:68 poison_kmalloc_redzone mm/kasan/common.c:377 [inline] __kasan_kmalloc+0xaa/0xb0 mm/kasan/common.c:394 kasan_kmalloc include/linux/kasan.h:257 [inline] __do_kmalloc_node mm/slub.c:4264 [inline] __kmalloc_noprof+0x1e8/0x400 mm/slub.c:4276 kmalloc_noprof include/linux/slab.h:882 [inline] kzalloc_noprof include/linux/slab.h:1014 [inline] hci_alloc_dev_priv+0x1d/0x2820 net/bluetooth/hci_core.c:2440 hci_alloc_dev include/net/bluetooth/hci_core.h:1621 [inline] __vhci_create_device+0xef/0x7d0 drivers/bluetooth/hci_vhci.c:399 vhci_create_device drivers/bluetooth/hci_vhci.c:470 [inline] vhci_get_user drivers/bluetooth/hci_vhci.c:527 [inline] vhci_write+0x2c3/0x470 drivers/bluetooth/hci_vhci.c:607 new_sync_write fs/read_write.c:590 [inline] vfs_write+0x5ae/0x1150 fs/read_write.c:683 ksys_write+0x12f/0x260 fs/read_write.c:736 do_syscall_x64 arch/x86/entry/common.c:52 [inline] do_syscall_64+0xcd/0x250 arch/x86/entry/common.c:83 entry_SYSCALL_64_after_hwframe+0x77/0x7f Freed by task 6038: kasan_save_stack+0x33/0x60 mm/kasan/common.c:47 kasan_save_track+0x14/0x30 mm/kasan/common.c:68 kasan_save_free_info+0x3b/0x60 mm/kasan/generic.c:579 poison_slab_object mm/kasan/common.c:247 [inline] __kasan_slab_free+0x51/0x70 mm/kasan/common.c:264 kasan_slab_free include/linux/kasan.h:230 [inline] slab_free_hook mm/slub.c:2342 [inline] slab_free mm/slub.c:4579 [inline] kfree+0x14f/0x4b0 mm/slub.c:4727 hci_release_dev+0x4d9/0x600 net/bluetooth/hci_core.c:2759 bt_host_release+0x6a/0xb0 net/bluetooth/hci_sysfs.c:94 device_release+0xa1/0x240 drivers/base/core.c:2574 kobject_cleanup lib/kobject.c:689 [inline] kobject_release lib/kobject.c:720 [inline] kref_put include/linux/kref.h:65 [inline] kobject_put+0x1e4/0x5a0 lib/kobject.c:737 put_device+0x1f/0x30 drivers/base/core.c:3780 vhci_release+0x81/0xf0 drivers/bluetooth/hci_vhci.c:665 __fput+0x3f6/0xb60 fs/file_table.c:431 task_work_run+0x14e/0x250 kernel/task_work.c:239 exit_task_work include/linux/task_work.h:43 [inline] do_exit+0xadd/0x2d70 kernel/exit.c:939 do_group_exit+0xd3/0x2a0 kernel/exit.c:1088 get_signal+0x25fb/0x2770 kernel/signal.c:2917 arch_do_signal_or_restart+0x90/0x7e0 arch/x86/kernel/signal.c:337 exit_to_user_mode_loop kernel/entry/common.c:111 [inline] exit_to_user_mode_prepare include/linux/entry-common.h:328 [inline] __syscall_exit_to_user_mode_work kernel/entry/common.c:207 [inline] syscall_exit_to_user_mode+0x150/0x2a0 kernel/entry/common.c:218 do_syscall_64+0xda/0x250 arch/x86/entry/common.c:89 entry_SYSCALL_64_after_hwframe+0x77/0x7f Last potentially related work creation: kasan_save_stack+0x33/0x60 mm/kasan/common.c:47 __kasan_record_aux_stack+0xba/0xd0 mm/kasan/generic.c:541 insert_work+0x36/0x230 kernel/workqueue.c:2183 __queue_work+0x97e/0x1080 kernel/workqueue.c:2339 queue_work_on+0x11a/0x140 kernel/workqueue.c:2390 l2cap_chan_send+0xb86/0x2a30 net/bluetooth/l2cap_core.c:2577 l2cap_sock_sendmsg+0x228/0x300 net/bluetooth/l2cap_sock.c:1128 sock_sendmsg_nosec net/socket.c:729 [inline] __sock_sendmsg net/socket.c:744 [inline] sock_sendmsg+0x3cb/0x470 net/socket.c:767 bnep_tx_frame net/bluetooth/bnep/core.c:466 [inline] bnep_session+0x12fb/0x2d60 net/bluetooth/bnep/core.c:509 kthread+0x2c1/0x3a0 kernel/kthread.c:389 ret_from_fork+0x45/0x80 arch/x86/kernel/process.c:147 ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:244 Second to last potentially related work creation: kasan_save_stack+0x33/0x60 mm/kasan/common.c:47 __kasan_record_aux_stack+0xba/0xd0 mm/kasan/generic.c:541 insert_work+0x36/0x230 kernel/workqueue.c:2183 __queue_work+0x97e/0x1080 kernel/workqueue.c:2339 queue_work_on+0x11a/0x140 kernel/workqueue.c:2390 l2cap_chan_send+0xb86/0x2a30 net/bluetooth/l2cap_core.c:2577 l2cap_sock_sendmsg+0x228/0x300 net/bluetooth/l2cap_sock.c:1128 sock_sendmsg_nosec net/socket.c:729 [inline] __sock_sendmsg net/socket.c:744 [inline] sock_sendmsg+0x3cb/0x470 net/socket.c:767 bnep_tx_frame net/bluetooth/bnep/core.c:466 [inline] bnep_session+0x12fb/0x2d60 net/bluetooth/bnep/core.c:509 kthread+0x2c1/0x3a0 kernel/kthread.c:389 ret_from_fork+0x45/0x80 arch/x86/kernel/process.c:147 ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:244 The buggy address belongs to the object at ffff88802430c000 which belongs to the cache kmalloc-8k of size 8192 The buggy address is located 4872 bytes inside of freed 8192-byte region [ffff88802430c000, ffff88802430e000) The buggy address belongs to the physical page: page: refcount:1 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x24308 head: order:3 mapcount:0 entire_mapcount:0 nr_pages_mapped:0 pincount:0 ksm flags: 0xfff00000000040(head|node=0|zone=1|lastcpupid=0x7ff) page_type: f5(slab) raw: 00fff00000000040 ffff88801b043180 ffffea0000ccbc00 0000000000000003 raw: 0000000000000000 0000000000020002 00000001f5000000 0000000000000000 head: 00fff00000000040 ffff88801b043180 ffffea0000ccbc00 0000000000000003 head: 0000000000000000 0000000000020002 00000001f5000000 0000000000000000 head: 00fff00000000003 ffffea000090c201 ffffffffffffffff 0000000000000000 head: 0000000000000008 0000000000000000 00000000ffffffff 0000000000000000 page dumped because: kasan: bad access detected page_owner tracks the page as allocated page last allocated via order 3, migratetype Unmovable, gfp_mask 0xd2040(__GFP_IO|__GFP_NOWARN|__GFP_NORETRY|__GFP_COMP|__GFP_NOMEMALLOC), pid 5658, tgid 5658 (start-stop-daem), ts 22690023177, free_ts 22572459437 set_page_owner include/linux/page_owner.h:32 [inline] post_alloc_hook+0x2d1/0x350 mm/page_alloc.c:1537 prep_new_page mm/page_alloc.c:1545 [inline] get_page_from_freelist+0xf7d/0x2d10 mm/page_alloc.c:3457 __alloc_pages_noprof+0x223/0x25a0 mm/page_alloc.c:4733 alloc_pages_mpol_noprof+0x2c9/0x610 mm/mempolicy.c:2265 alloc_slab_page mm/slub.c:2412 [inline] allocate_slab mm/slub.c:2578 [inline] new_slab+0x2c9/0x410 mm/slub.c:2631 ___slab_alloc+0xdac/0x1880 mm/slub.c:3818 __slab_alloc.constprop.0+0x56/0xb0 mm/slub.c:3908 __slab_alloc_node mm/slub.c:3961 [inline] slab_alloc_node mm/slub.c:4122 [inline] __kmalloc_cache_noprof+0x2b4/0x300 mm/slub.c:4290 kmalloc_noprof include/linux/slab.h:878 [inline] kzalloc_noprof include/linux/slab.h:1014 [inline] tomoyo_print_bprm security/tomoyo/audit.c:26 [inline] tomoyo_init_log+0xcb3/0x2170 security/tomoyo/audit.c:264 tomoyo_supervisor+0x30c/0xea0 security/tomoyo/common.c:2089 tomoyo_audit_env_log security/tomoyo/environ.c:36 [inline] tomoyo_env_perm+0x193/0x210 security/tomoyo/environ.c:63 tomoyo_environ security/tomoyo/domain.c:672 [inline] tomoyo_find_next_domain+0xe8e/0x2070 security/tomoyo/domain.c:881 tomoyo_bprm_check_security security/tomoyo/tomoyo.c:102 [inline] tomoyo_bprm_check_security+0x12b/0x1d0 security/tomoyo/tomoyo.c:92 security_bprm_check+0x1b9/0x1e0 security/security.c:1297 search_binary_handler fs/exec.c:1740 [inline] exec_binprm fs/exec.c:1794 [inline] bprm_execve fs/exec.c:1845 [inline] bprm_execve+0x642/0x1960 fs/exec.c:1821 do_execveat_common.isra.0+0x4f1/0x630 fs/exec.c:1952 page last free pid 5654 tgid 5654 stack trace: reset_page_owner include/linux/page_owner.h:25 [inline] free_pages_prepare mm/page_alloc.c:1108 [inline] free_unref_page+0x5f4/0xdc0 mm/page_alloc.c:2638 __put_partials+0x14c/0x170 mm/slub.c:3145 qlink_free mm/kasan/quarantine.c:163 [inline] qlist_free_all+0x4e/0x120 mm/kasan/quarantine.c:179 kasan_quarantine_reduce+0x192/0x1e0 mm/kasan/quarantine.c:286 __kasan_slab_alloc+0x69/0x90 mm/kasan/common.c:329 kasan_slab_alloc include/linux/kasan.h:247 [inline] slab_post_alloc_hook mm/slub.c:4085 [inline] slab_alloc_node mm/slub.c:4134 [inline] kmem_cache_alloc_noprof+0x121/0x2f0 mm/slub.c:4141 getname_flags.part.0+0x4c/0x550 fs/namei.c:139 getname_flags+0x93/0xf0 include/linux/audit.h:322 vfs_fstatat+0x86/0x160 fs/stat.c:340 __do_sys_newfstatat+0xa2/0x130 fs/stat.c:505 do_syscall_x64 arch/x86/entry/common.c:52 [inline] do_syscall_64+0xcd/0x250 arch/x86/entry/common.c:83 entry_SYSCALL_64_after_hwframe+0x77/0x7f Memory state around the buggy address: ffff88802430d200: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb ffff88802430d280: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb >ffff88802430d300: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb ^ ffff88802430d380: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb ffff88802430d400: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb ================================================================== final repro crashed as (corrupted=false): ================================================================== BUG: KASAN: slab-use-after-free in device_for_each_child+0x18f/0x1a0 drivers/base/core.c:3996 Read of size 8 at addr ffff88802430d308 by task kbnepd xfffffff/6089 CPU: 0 UID: 0 PID: 6089 Comm: kbnepd xfffffff Not tainted 6.12.0-rc6-syzkaller-00077-g2e1b3cc9d7f7 #0 Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2~bpo12+1 04/01/2014 Call Trace: __dump_stack lib/dump_stack.c:94 [inline] dump_stack_lvl+0x116/0x1f0 lib/dump_stack.c:120 print_address_description mm/kasan/report.c:377 [inline] print_report+0xc3/0x620 mm/kasan/report.c:488 kasan_report+0xd9/0x110 mm/kasan/report.c:601 device_for_each_child+0x18f/0x1a0 drivers/base/core.c:3996 pm_runtime_set_memalloc_noio+0xf2/0x180 drivers/base/power/runtime.c:248 netdev_unregister_kobject+0x1ed/0x270 net/core/net-sysfs.c:2109 unregister_netdevice_many_notify+0x1055/0x1e50 net/core/dev.c:11441 unregister_netdevice_many net/core/dev.c:11469 [inline] unregister_netdevice_queue+0x307/0x3f0 net/core/dev.c:11343 unregister_netdevice include/linux/netdevice.h:3118 [inline] unregister_netdev+0x1c/0x30 net/core/dev.c:11487 bnep_session+0x2210/0x2d60 net/bluetooth/bnep/core.c:525 kthread+0x2c1/0x3a0 kernel/kthread.c:389 ret_from_fork+0x45/0x80 arch/x86/kernel/process.c:147 ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:244 Allocated by task 6038: kasan_save_stack+0x33/0x60 mm/kasan/common.c:47 kasan_save_track+0x14/0x30 mm/kasan/common.c:68 poison_kmalloc_redzone mm/kasan/common.c:377 [inline] __kasan_kmalloc+0xaa/0xb0 mm/kasan/common.c:394 kasan_kmalloc include/linux/kasan.h:257 [inline] __do_kmalloc_node mm/slub.c:4264 [inline] __kmalloc_noprof+0x1e8/0x400 mm/slub.c:4276 kmalloc_noprof include/linux/slab.h:882 [inline] kzalloc_noprof include/linux/slab.h:1014 [inline] hci_alloc_dev_priv+0x1d/0x2820 net/bluetooth/hci_core.c:2440 hci_alloc_dev include/net/bluetooth/hci_core.h:1621 [inline] __vhci_create_device+0xef/0x7d0 drivers/bluetooth/hci_vhci.c:399 vhci_create_device drivers/bluetooth/hci_vhci.c:470 [inline] vhci_get_user drivers/bluetooth/hci_vhci.c:527 [inline] vhci_write+0x2c3/0x470 drivers/bluetooth/hci_vhci.c:607 new_sync_write fs/read_write.c:590 [inline] vfs_write+0x5ae/0x1150 fs/read_write.c:683 ksys_write+0x12f/0x260 fs/read_write.c:736 do_syscall_x64 arch/x86/entry/common.c:52 [inline] do_syscall_64+0xcd/0x250 arch/x86/entry/common.c:83 entry_SYSCALL_64_after_hwframe+0x77/0x7f Freed by task 6038: kasan_save_stack+0x33/0x60 mm/kasan/common.c:47 kasan_save_track+0x14/0x30 mm/kasan/common.c:68 kasan_save_free_info+0x3b/0x60 mm/kasan/generic.c:579 poison_slab_object mm/kasan/common.c:247 [inline] __kasan_slab_free+0x51/0x70 mm/kasan/common.c:264 kasan_slab_free include/linux/kasan.h:230 [inline] slab_free_hook mm/slub.c:2342 [inline] slab_free mm/slub.c:4579 [inline] kfree+0x14f/0x4b0 mm/slub.c:4727 hci_release_dev+0x4d9/0x600 net/bluetooth/hci_core.c:2759 bt_host_release+0x6a/0xb0 net/bluetooth/hci_sysfs.c:94 device_release+0xa1/0x240 drivers/base/core.c:2574 kobject_cleanup lib/kobject.c:689 [inline] kobject_release lib/kobject.c:720 [inline] kref_put include/linux/kref.h:65 [inline] kobject_put+0x1e4/0x5a0 lib/kobject.c:737 put_device+0x1f/0x30 drivers/base/core.c:3780 vhci_release+0x81/0xf0 drivers/bluetooth/hci_vhci.c:665 __fput+0x3f6/0xb60 fs/file_table.c:431 task_work_run+0x14e/0x250 kernel/task_work.c:239 exit_task_work include/linux/task_work.h:43 [inline] do_exit+0xadd/0x2d70 kernel/exit.c:939 do_group_exit+0xd3/0x2a0 kernel/exit.c:1088 get_signal+0x25fb/0x2770 kernel/signal.c:2917 arch_do_signal_or_restart+0x90/0x7e0 arch/x86/kernel/signal.c:337 exit_to_user_mode_loop kernel/entry/common.c:111 [inline] exit_to_user_mode_prepare include/linux/entry-common.h:328 [inline] __syscall_exit_to_user_mode_work kernel/entry/common.c:207 [inline] syscall_exit_to_user_mode+0x150/0x2a0 kernel/entry/common.c:218 do_syscall_64+0xda/0x250 arch/x86/entry/common.c:89 entry_SYSCALL_64_after_hwframe+0x77/0x7f Last potentially related work creation: kasan_save_stack+0x33/0x60 mm/kasan/common.c:47 __kasan_record_aux_stack+0xba/0xd0 mm/kasan/generic.c:541 insert_work+0x36/0x230 kernel/workqueue.c:2183 __queue_work+0x97e/0x1080 kernel/workqueue.c:2339 queue_work_on+0x11a/0x140 kernel/workqueue.c:2390 l2cap_chan_send+0xb86/0x2a30 net/bluetooth/l2cap_core.c:2577 l2cap_sock_sendmsg+0x228/0x300 net/bluetooth/l2cap_sock.c:1128 sock_sendmsg_nosec net/socket.c:729 [inline] __sock_sendmsg net/socket.c:744 [inline] sock_sendmsg+0x3cb/0x470 net/socket.c:767 bnep_tx_frame net/bluetooth/bnep/core.c:466 [inline] bnep_session+0x12fb/0x2d60 net/bluetooth/bnep/core.c:509 kthread+0x2c1/0x3a0 kernel/kthread.c:389 ret_from_fork+0x45/0x80 arch/x86/kernel/process.c:147 ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:244 Second to last potentially related work creation: kasan_save_stack+0x33/0x60 mm/kasan/common.c:47 __kasan_record_aux_stack+0xba/0xd0 mm/kasan/generic.c:541 insert_work+0x36/0x230 kernel/workqueue.c:2183 __queue_work+0x97e/0x1080 kernel/workqueue.c:2339 queue_work_on+0x11a/0x140 kernel/workqueue.c:2390 l2cap_chan_send+0xb86/0x2a30 net/bluetooth/l2cap_core.c:2577 l2cap_sock_sendmsg+0x228/0x300 net/bluetooth/l2cap_sock.c:1128 sock_sendmsg_nosec net/socket.c:729 [inline] __sock_sendmsg net/socket.c:744 [inline] sock_sendmsg+0x3cb/0x470 net/socket.c:767 bnep_tx_frame net/bluetooth/bnep/core.c:466 [inline] bnep_session+0x12fb/0x2d60 net/bluetooth/bnep/core.c:509 kthread+0x2c1/0x3a0 kernel/kthread.c:389 ret_from_fork+0x45/0x80 arch/x86/kernel/process.c:147 ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:244 The buggy address belongs to the object at ffff88802430c000 which belongs to the cache kmalloc-8k of size 8192 The buggy address is located 4872 bytes inside of freed 8192-byte region [ffff88802430c000, ffff88802430e000) The buggy address belongs to the physical page: page: refcount:1 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x24308 head: order:3 mapcount:0 entire_mapcount:0 nr_pages_mapped:0 pincount:0 ksm flags: 0xfff00000000040(head|node=0|zone=1|lastcpupid=0x7ff) page_type: f5(slab) raw: 00fff00000000040 ffff88801b043180 ffffea0000ccbc00 0000000000000003 raw: 0000000000000000 0000000000020002 00000001f5000000 0000000000000000 head: 00fff00000000040 ffff88801b043180 ffffea0000ccbc00 0000000000000003 head: 0000000000000000 0000000000020002 00000001f5000000 0000000000000000 head: 00fff00000000003 ffffea000090c201 ffffffffffffffff 0000000000000000 head: 0000000000000008 0000000000000000 00000000ffffffff 0000000000000000 page dumped because: kasan: bad access detected page_owner tracks the page as allocated page last allocated via order 3, migratetype Unmovable, gfp_mask 0xd2040(__GFP_IO|__GFP_NOWARN|__GFP_NORETRY|__GFP_COMP|__GFP_NOMEMALLOC), pid 5658, tgid 5658 (start-stop-daem), ts 22690023177, free_ts 22572459437 set_page_owner include/linux/page_owner.h:32 [inline] post_alloc_hook+0x2d1/0x350 mm/page_alloc.c:1537 prep_new_page mm/page_alloc.c:1545 [inline] get_page_from_freelist+0xf7d/0x2d10 mm/page_alloc.c:3457 __alloc_pages_noprof+0x223/0x25a0 mm/page_alloc.c:4733 alloc_pages_mpol_noprof+0x2c9/0x610 mm/mempolicy.c:2265 alloc_slab_page mm/slub.c:2412 [inline] allocate_slab mm/slub.c:2578 [inline] new_slab+0x2c9/0x410 mm/slub.c:2631 ___slab_alloc+0xdac/0x1880 mm/slub.c:3818 __slab_alloc.constprop.0+0x56/0xb0 mm/slub.c:3908 __slab_alloc_node mm/slub.c:3961 [inline] slab_alloc_node mm/slub.c:4122 [inline] __kmalloc_cache_noprof+0x2b4/0x300 mm/slub.c:4290 kmalloc_noprof include/linux/slab.h:878 [inline] kzalloc_noprof include/linux/slab.h:1014 [inline] tomoyo_print_bprm security/tomoyo/audit.c:26 [inline] tomoyo_init_log+0xcb3/0x2170 security/tomoyo/audit.c:264 tomoyo_supervisor+0x30c/0xea0 security/tomoyo/common.c:2089 tomoyo_audit_env_log security/tomoyo/environ.c:36 [inline] tomoyo_env_perm+0x193/0x210 security/tomoyo/environ.c:63 tomoyo_environ security/tomoyo/domain.c:672 [inline] tomoyo_find_next_domain+0xe8e/0x2070 security/tomoyo/domain.c:881 tomoyo_bprm_check_security security/tomoyo/tomoyo.c:102 [inline] tomoyo_bprm_check_security+0x12b/0x1d0 security/tomoyo/tomoyo.c:92 security_bprm_check+0x1b9/0x1e0 security/security.c:1297 search_binary_handler fs/exec.c:1740 [inline] exec_binprm fs/exec.c:1794 [inline] bprm_execve fs/exec.c:1845 [inline] bprm_execve+0x642/0x1960 fs/exec.c:1821 do_execveat_common.isra.0+0x4f1/0x630 fs/exec.c:1952 page last free pid 5654 tgid 5654 stack trace: reset_page_owner include/linux/page_owner.h:25 [inline] free_pages_prepare mm/page_alloc.c:1108 [inline] free_unref_page+0x5f4/0xdc0 mm/page_alloc.c:2638 __put_partials+0x14c/0x170 mm/slub.c:3145 qlink_free mm/kasan/quarantine.c:163 [inline] qlist_free_all+0x4e/0x120 mm/kasan/quarantine.c:179 kasan_quarantine_reduce+0x192/0x1e0 mm/kasan/quarantine.c:286 __kasan_slab_alloc+0x69/0x90 mm/kasan/common.c:329 kasan_slab_alloc include/linux/kasan.h:247 [inline] slab_post_alloc_hook mm/slub.c:4085 [inline] slab_alloc_node mm/slub.c:4134 [inline] kmem_cache_alloc_noprof+0x121/0x2f0 mm/slub.c:4141 getname_flags.part.0+0x4c/0x550 fs/namei.c:139 getname_flags+0x93/0xf0 include/linux/audit.h:322 vfs_fstatat+0x86/0x160 fs/stat.c:340 __do_sys_newfstatat+0xa2/0x130 fs/stat.c:505 do_syscall_x64 arch/x86/entry/common.c:52 [inline] do_syscall_64+0xcd/0x250 arch/x86/entry/common.c:83 entry_SYSCALL_64_after_hwframe+0x77/0x7f Memory state around the buggy address: ffff88802430d200: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb ffff88802430d280: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb >ffff88802430d300: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb ^ ffff88802430d380: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb ffff88802430d400: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb ==================================================================