Extracting prog: 3h16m53.677422111s Minimizing prog: 1h51m26.722686551s Simplifying prog options: 0s Extracting C: 3m41.948173061s Simplifying C: 34m13.514065555s extracting reproducer from 70 programs testing a last program of every proc single: executing 20 programs separately with timeout 6m0s testing program (duration=6m0s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): openat$kvm-ioctl$KVM_CREATE_VM-ioctl$KVM_CREATE_GUEST_MEMFD-mmap$KVM_VCPU detailed listing: executing program 0: r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000000), 0x401, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) r2 = ioctl$KVM_CREATE_GUEST_MEMFD(r1, 0xc040aed4, &(0x7f00000001c0)={0x200001fe0000, 0x3}) mmap$KVM_VCPU(&(0x7f0000dfe000/0x4000)=nil, 0x930, 0x80000a, 0x8011, r2, 0x200001fe0000) program did not crash testing program (duration=6m0s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): socket$nl_netfilter-socket$nl_netfilter-sendmsg$IPSET_CMD_CREATE-sendmsg$IPSET_CMD_ADD detailed listing: executing program 0: r0 = socket$nl_netfilter(0x10, 0x3, 0xc) r1 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPSET_CMD_CREATE(r1, &(0x7f0000000000)={0x0, 0x0, &(0x7f00000004c0)={&(0x7f00000001c0)={0x6c, 0x2, 0x6, 0x5, 0x0, 0x0, {0x0, 0x0, 0xfffc}, [@IPSET_ATTR_TYPENAME={0x12, 0x3, 'bitmap:ip,mac\x00'}, @IPSET_ATTR_REVISION={0x5}, @IPSET_ATTR_SETNAME={0x9, 0x2, 'syz1\x00'}, @IPSET_ATTR_DATA={0x20, 0x7, 0x0, 0x1, [@IPSET_ATTR_CIDR={0x5, 0x3, 0x1f}, @IPSET_ATTR_IP={0xc, 0x1, 0x0, 0x1, @IPSET_ATTR_IPADDR_IPV4={0x8, 0x1, 0x1, 0x0, @broadcast}}, @IPSET_ATTR_CADT_FLAGS={0x8, 0x8, 0x1, 0x0, 0xed}]}, @IPSET_ATTR_FAMILY={0x5, 0x5, 0x2}, @IPSET_ATTR_PROTOCOL={0x5, 0x1, 0x6}]}, 0x6c}, 0x1, 0x0, 0x0, 0x4010}, 0x0) sendmsg$IPSET_CMD_ADD(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000240)={&(0x7f0000000080)=ANY=[@ANYBLOB="400000000906010200000000000a0000000000000900020073797a31000000000500010007000000180007800c00018008000140ffffffff080009"], 0x40}, 0x1, 0x0, 0x0, 0x10000047}, 0x4000084) program did not crash testing program (duration=6m0s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): socket-setsockopt$inet_sctp_SCTP_SOCKOPT_BINDX_ADD-sendmsg$inet_sctp-recvmmsg$unix detailed listing: executing program 0: r0 = socket(0xa, 0x5, 0x0) setsockopt$inet_sctp_SCTP_SOCKOPT_BINDX_ADD(r0, 0x84, 0x64, &(0x7f0000000080)=[@in6={0xa, 0x4e24, 0xf1, @loopback, 0x19f49a9}], 0x1c) sendmsg$inet_sctp(r0, &(0x7f00000000c0)={&(0x7f0000000000)=@in6={0xa, 0x4e24, 0xff, @loopback, 0x5}, 0x1c, &(0x7f0000000040)=[{&(0x7f0000000100)="e6", 0xfffd}], 0x1, &(0x7f00000002c0)=ANY=[@ANYBLOB="18000000000000008400000007000000ac1414aa0000000020000000000000008400000008000000200100"/56], 0x38, 0x4855}, 0x24000052) recvmmsg$unix(r0, &(0x7f0000001480)=[{{0x0, 0x0, &(0x7f00000001c0)=[{&(0x7f0000000300)=""/4105, 0x1009}], 0x1}}], 0x1, 0x40010040, 0x0) program did not crash testing program (duration=6m0s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): socket-setsockopt$inet_sctp_SCTP_SOCKOPT_BINDX_ADD-sendmsg$inet_sctp-recvmmsg$unix detailed listing: executing program 0: r0 = socket(0xa, 0x5, 0x0) setsockopt$inet_sctp_SCTP_SOCKOPT_BINDX_ADD(r0, 0x84, 0x64, &(0x7f0000000080)=[@in6={0xa, 0x4e24, 0xf1, @loopback, 0x19f49a9}], 0x1c) sendmsg$inet_sctp(r0, &(0x7f00000000c0)={&(0x7f0000000000)=@in6={0xa, 0x4e24, 0xff, @loopback, 0x5}, 0x1c, &(0x7f0000000040)=[{&(0x7f0000000100)="e6", 0xfffd}], 0x1, &(0x7f00000002c0)=ANY=[@ANYBLOB="18000000000000008400000007000000ac1414aa0000000020000000000000008400000008000000200100"/56], 0x38, 0x4855}, 0x24000052) recvmmsg$unix(r0, &(0x7f0000001480)=[{{0x0, 0x0, &(0x7f00000001c0)=[{&(0x7f0000000300)=""/4105, 0x1009}], 0x1}}], 0x1, 0x40010040, 0x0) program did not crash testing program (duration=6m0s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): socket$nl_generic-mkdirat-getsockopt$sock_cred-mount$bpf detailed listing: executing program 0: r0 = socket$nl_generic(0x10, 0x3, 0x10) mkdirat(0xffffffffffffff9c, &(0x7f0000000100)='./file0\x00', 0x181) getsockopt$sock_cred(r0, 0x1, 0x11, &(0x7f00000003c0)={0x0, 0x0}, &(0x7f0000000480)=0xc) mount$bpf(0x0, &(0x7f0000000340)='./file0\x00', &(0x7f0000000380), 0x2000000, &(0x7f0000000500)={[{@uid={'uid', 0x3d, r1}}]}) program did not crash testing program (duration=6m0s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): socket$nl_generic-mkdirat-getsockopt$sock_cred-mount$bpf detailed listing: executing program 0: r0 = socket$nl_generic(0x10, 0x3, 0x10) mkdirat(0xffffffffffffff9c, &(0x7f0000000100)='./file0\x00', 0x181) getsockopt$sock_cred(r0, 0x1, 0x11, &(0x7f00000003c0)={0x0, 0x0}, &(0x7f0000000480)=0xc) mount$bpf(0x0, &(0x7f0000000340)='./file0\x00', &(0x7f0000000380), 0x2000000, &(0x7f0000000500)={[{@uid={'uid', 0x3d, r1}}]}) program did not crash testing program (duration=6m0s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): openat$sysctl-writev-write$uinput_user_dev-ppoll detailed listing: executing program 0: r0 = openat$sysctl(0xffffffffffffff9c, &(0x7f0000000300)='/proc/sys/vm/drop_caches\x00', 0x1, 0x0) writev(r0, &(0x7f0000000080)=[{&(0x7f0000000140)='3', 0x1}], 0x1) write$uinput_user_dev(0xffffffffffffffff, &(0x7f0000000400)={'syz0\x00', {0x3, 0x2, 0x6, 0xfffa}, 0x3f, [0x8000, 0xc95a, 0xf, 0x8, 0x80, 0x2, 0x7, 0x7f, 0x20000006, 0x4c, 0x6, 0x5f, 0x9, 0x5, 0xffff2d37, 0xffffff01, 0x6, 0x4, 0x0, 0x5, 0x4, 0x0, 0x7, 0x3c5b, 0x1, 0x824, 0xd, 0x1, 0x2, 0xffffffff, 0xe661, 0x4, 0x7, 0x3, 0x8, 0x0, 0x80000000, 0x242, 0x3, 0xe, 0x0, 0x80008071, 0x2, 0x17, 0x1, 0x7, 0x5, 0x3e, 0x8c, 0x6, 0x6, 0x0, 0x5, 0x4, 0xfffffffa, 0x3fc, 0x80, 0x0, 0x2, 0x6, 0x8, 0x4, 0x1, 0x40], [0x10000007, 0x9, 0x8000012f, 0x8004, 0xf292, 0xfffffff3, 0x129432e6, 0xc9, 0xf9, 0x7fff, 0x78, 0x6e7, 0x9, 0xfffffffc, 0x3, 0x0, 0x0, 0x5, 0x31, 0xe, 0x312, 0x78, 0xea4, 0x2, 0x4, 0x7, 0x7fff, 0x6, 0x400, 0x401, 0x6, 0x1, 0xff, 0x5, 0x1000005, 0x5f31, 0xa, 0x4e0, 0x2, 0x4, 0xb, 0x4, 0x9, 0x8, 0x9, 0x6, 0x47, 0x8000, 0x1, 0xfff, 0xffff, 0x2, 0x4, 0x9, 0x3, 0x3, 0x7, 0x1, 0x3, 0x3, 0xbc45, 0x48c93690, 0x42, 0x2], [0x7, 0x408, 0x4, 0x5, 0xfffffffe, 0x100, 0x8d2, 0x9, 0x6, 0x7ff7, 0x0, 0x5, 0xb, 0xd, 0x5, 0x405, 0x0, 0x1ef, 0x5, 0x8, 0x86, 0x3, 0x303c, 0x3e7, 0xb, 0x5, 0x3e, 0xd9, 0x3, 0x20000009, 0x4, 0x6d01, 0x6, 0x38, 0x800003, 0x200, 0x80, 0x3, 0x4, 0x2950bfaf, 0x1002, 0x8, 0x7, 0x953a, 0x5, 0x6, 0x4, 0xbf, 0x2, 0x3, 0x7ff, 0x12b, 0x4, 0x1, 0xa, 0x0, 0x5, 0x1c, 0x120000, 0x3, 0x2006, 0x80a2ed, 0x4, 0x25], [0x6, 0xbb33, 0x6, 0xb, 0x5, 0x893a, 0x6, 0x6, 0x0, 0xb9, 0xce7, 0x1ff, 0x2, 0x57, 0x5, 0x3, 0x3, 0x10000, 0x4, 0x7fff, 0xffff, 0xa620, 0x2, 0x5, 0x1, 0x2, 0x14a, 0x60a7, 0x6, 0x16, 0xffffffff, 0x80000000, 0x1, 0x4, 0xc8, 0x1, 0x400, 0x10000, 0x3, 0x7e, 0x100, 0x9602, 0x7, 0x8af, 0x8, 0x6, 0x226, 0x5, 0x5, 0x28, 0x30b1d693, 0xa1f, 0xf43, 0x6, 0x1, 0x6c1b, 0x0, 0x4, 0x5, 0xb1e, 0x1, 0x200, 0xffff3441, 0xfff]}, 0x45c) ppoll(&(0x7f00000000c0)=[{}, {}], 0x20000000000000dc, 0x0, 0x0, 0x0) program did not crash testing program (duration=6m0s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): openat$cgroup_ro-close-socket$inet6_icmp_raw-ioctl$SIOCSIFHWADDR detailed listing: executing program 0: r0 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000100)='memory.numa_stat\x00', 0x26e1, 0x0) close(r0) socket$inet6_icmp_raw(0xa, 0x3, 0x3a) ioctl$SIOCSIFHWADDR(r0, 0x8b14, &(0x7f0000000000)={'wlan1\x00', @random="01000000008d"}) program did not crash testing program (duration=6m0s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): openat$cgroup_ro-close-socket$inet6_icmp_raw-ioctl$SIOCSIFHWADDR detailed listing: executing program 0: r0 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000100)='memory.numa_stat\x00', 0x26e1, 0x0) close(r0) socket$inet6_icmp_raw(0xa, 0x3, 0x3a) ioctl$SIOCSIFHWADDR(r0, 0x8b14, &(0x7f0000000000)={'wlan1\x00', @random="01000000008d"}) program did not crash testing program (duration=6m0s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): socket$inet6_sctp-setsockopt$sock_timeval-sendmmsg$inet6-sendmmsg$inet6 detailed listing: executing program 0: r0 = socket$inet6_sctp(0xa, 0x1, 0x84) setsockopt$sock_timeval(r0, 0x1, 0x15, &(0x7f0000000000)={0x0, 0x2710}, 0x10) sendmmsg$inet6(r0, &(0x7f0000000200)=[{{&(0x7f00000000c0)={0xa, 0x0, 0x0, @loopback={0xfec0ffff00000000}}, 0x1c, &(0x7f0000000580)=[{&(0x7f0000000180)='i', 0x20086}], 0x1}}], 0x1, 0x0) sendmmsg$inet6(r0, &(0x7f00000071c0)=[{{&(0x7f00000001c0)={0xa, 0x1, 0x0, @loopback, 0x7}, 0x1c, &(0x7f0000000100)=[{&(0x7f0000000240)="8f", 0x1}], 0x1}}], 0x1, 0x24044004) program did not crash testing program (duration=6m0s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): socket$inet6_sctp-setsockopt$sock_timeval-sendmmsg$inet6-sendmmsg$inet6 detailed listing: executing program 0: r0 = socket$inet6_sctp(0xa, 0x1, 0x84) setsockopt$sock_timeval(r0, 0x1, 0x15, &(0x7f0000000000)={0x0, 0x2710}, 0x10) sendmmsg$inet6(r0, &(0x7f0000000200)=[{{&(0x7f00000000c0)={0xa, 0x0, 0x0, @loopback={0xfec0ffff00000000}}, 0x1c, &(0x7f0000000580)=[{&(0x7f0000000180)='i', 0x20086}], 0x1}}], 0x1, 0x0) sendmmsg$inet6(r0, &(0x7f00000071c0)=[{{&(0x7f00000001c0)={0xa, 0x1, 0x0, @loopback, 0x7}, 0x1c, &(0x7f0000000100)=[{&(0x7f0000000240)="8f", 0x1}], 0x1}}], 0x1, 0x24044004) program did not crash testing program (duration=6m0s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): openat$sysctl-writev-write$uinput_user_dev-ppoll detailed listing: executing program 0: r0 = openat$sysctl(0xffffffffffffff9c, &(0x7f0000000300)='/proc/sys/vm/drop_caches\x00', 0x1, 0x0) writev(r0, &(0x7f0000000080)=[{&(0x7f0000000140)='3', 0x1}], 0x1) write$uinput_user_dev(0xffffffffffffffff, &(0x7f0000000400)={'syz0\x00', {0x3, 0x2, 0x6, 0xfffa}, 0x3f, [0x8000, 0xc95a, 0xf, 0x8, 0x80, 0x2, 0x7, 0x7f, 0x20000006, 0x4c, 0x6, 0x5f, 0x9, 0x5, 0xffff2d37, 0xffffff01, 0x6, 0x4, 0x0, 0x5, 0x4, 0x0, 0x7, 0x3c5b, 0x1, 0x824, 0xd, 0x1, 0x2, 0xffffffff, 0xe661, 0x4, 0x7, 0x3, 0x8, 0x0, 0x80000000, 0x242, 0x3, 0xe, 0x0, 0x80008071, 0x2, 0x17, 0x1, 0x7, 0x5, 0x3e, 0x8c, 0x6, 0x6, 0x0, 0x5, 0x4, 0xfffffffa, 0x3fc, 0x80, 0x0, 0x2, 0x6, 0x8, 0x4, 0x1, 0x40], [0x10000007, 0x9, 0x8000012f, 0x8004, 0xf292, 0xfffffff3, 0x129432e6, 0xc9, 0xf9, 0x7fff, 0x78, 0x6e7, 0x9, 0xfffffffc, 0x3, 0x0, 0x0, 0x5, 0x31, 0xe, 0x312, 0x78, 0xea4, 0x2, 0x4, 0x7, 0x7fff, 0x6, 0x400, 0x401, 0x6, 0x1, 0xff, 0x5, 0x1000005, 0x5f31, 0xa, 0x4e0, 0x2, 0x4, 0xb, 0x4, 0x9, 0x8, 0x9, 0x6, 0x47, 0x8000, 0x1, 0xfff, 0xffff, 0x2, 0x4, 0x9, 0x3, 0x3, 0x7, 0x1, 0x3, 0x3, 0xbc45, 0x48c93690, 0x42, 0x2], [0x7, 0x408, 0x4, 0x5, 0xfffffffe, 0x100, 0x8d2, 0x9, 0x6, 0x7ff7, 0x0, 0x5, 0xb, 0xd, 0x5, 0x405, 0x0, 0x1ef, 0x5, 0x8, 0x86, 0x3, 0x303c, 0x3e7, 0xb, 0x5, 0x3e, 0xd9, 0x3, 0x20000009, 0x4, 0x6d01, 0x6, 0x38, 0x800003, 0x200, 0x80, 0x3, 0x4, 0x2950bfaf, 0x1002, 0x8, 0x7, 0x953a, 0x5, 0x6, 0x4, 0xbf, 0x2, 0x3, 0x7ff, 0x12b, 0x4, 0x1, 0xa, 0x0, 0x5, 0x1c, 0x120000, 0x3, 0x2006, 0x80a2ed, 0x4, 0x25], [0x6, 0xbb33, 0x6, 0xb, 0x5, 0x893a, 0x6, 0x6, 0x0, 0xb9, 0xce7, 0x1ff, 0x2, 0x57, 0x5, 0x3, 0x3, 0x10000, 0x4, 0x7fff, 0xffff, 0xa620, 0x2, 0x5, 0x1, 0x2, 0x14a, 0x60a7, 0x6, 0x16, 0xffffffff, 0x80000000, 0x1, 0x4, 0xc8, 0x1, 0x400, 0x10000, 0x3, 0x7e, 0x100, 0x9602, 0x7, 0x8af, 0x8, 0x6, 0x226, 0x5, 0x5, 0x28, 0x30b1d693, 0xa1f, 0xf43, 0x6, 0x1, 0x6c1b, 0x0, 0x4, 0x5, 0xb1e, 0x1, 0x200, 0xffff3441, 0xfff]}, 0x45c) ppoll(&(0x7f00000000c0)=[{}, {}], 0x20000000000000dc, 0x0, 0x0, 0x0) program did not crash testing program (duration=6m0s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): msgget$private-msgsnd-msgsnd-msgctl$IPC_RMID detailed listing: executing program 0: r0 = msgget$private(0x0, 0x480) msgsnd(r0, &(0x7f0000001200)=ANY=[@ANYBLOB="01000000"], 0x401, 0x0) msgsnd(r0, &(0x7f0000000dc0)=ANY=[@ANYRES16], 0x401, 0x0) msgctl$IPC_RMID(r0, 0x0) program did not crash testing program (duration=6m0s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): socketpair$unix-bind$unix-socket$unix-connect$unix detailed listing: executing program 0: socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) bind$unix(r0, &(0x7f0000000100)=@file={0x1, '\xe9\x1fq\x89Y\x1e\x923aK\x00'}, 0x6e) r1 = socket$unix(0x1, 0x2, 0x0) connect$unix(r1, &(0x7f0000000180)=@file={0x1, '\xe9\x1fq\x89Y\x1e\x923aK\x00'}, 0x6e) program did not crash testing program (duration=6m0s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): socketpair$unix-bind$unix-socket$unix-connect$unix detailed listing: executing program 0: socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) bind$unix(r0, &(0x7f0000000100)=@file={0x1, '\xe9\x1fq\x89Y\x1e\x923aK\x00'}, 0x6e) r1 = socket$unix(0x1, 0x2, 0x0) connect$unix(r1, &(0x7f0000000180)=@file={0x1, '\xe9\x1fq\x89Y\x1e\x923aK\x00'}, 0x6e) program did not crash testing program (duration=6m0s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): msgget$private-msgsnd-msgsnd-msgctl$IPC_RMID detailed listing: executing program 0: r0 = msgget$private(0x0, 0x480) msgsnd(r0, &(0x7f0000001200)=ANY=[@ANYBLOB="01000000"], 0x401, 0x0) msgsnd(r0, &(0x7f0000000dc0)=ANY=[@ANYRES16], 0x401, 0x0) msgctl$IPC_RMID(r0, 0x0) program crashed: lost connection to test machine suppressed program crash: lost connection to test machine testing program (duration=6m0s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): openat$kvm-ioctl$KVM_CREATE_VM-ioctl$KVM_CREATE_VCPU-ioctl$KVM_SET_MSRS detailed listing: executing program 0: r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) r2 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0) ioctl$KVM_SET_MSRS(r2, 0x4008ae89, &(0x7f00000002c0)={0x1, 0x0, [{0x1c4, 0x0, 0x81}]}) program did not crash testing program (duration=6m0s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): openat$kvm-ioctl$KVM_CREATE_VM-ioctl$KVM_CREATE_VCPU-ioctl$KVM_SET_MSRS detailed listing: executing program 0: r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) r2 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0) ioctl$KVM_SET_MSRS(r2, 0x4008ae89, &(0x7f00000002c0)={0x1, 0x0, [{0x1c4, 0x0, 0x81}]}) program did not crash testing program (duration=6m0s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): openat$kvm-ioctl$KVM_CREATE_VM-ioctl$KVM_CREATE_VCPU-ioctl$KVM_PRE_FAULT_MEMORY detailed listing: executing program 0: r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000240), 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) r2 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x2) ioctl$KVM_PRE_FAULT_MEMORY(r2, 0xc040aed5, 0x0) program crashed: lost connection to test machine suppressed program crash: lost connection to test machine testing program (duration=6m0s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): socket$nl_generic-syz_genetlink_get_family_id$team-ioctl$ifreq_SIOCGIFINDEX_team-sendmsg$TEAM_CMD_OPTIONS_SET detailed listing: executing program 0: r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$team(&(0x7f0000000100), 0xffffffffffffffff) ioctl$ifreq_SIOCGIFINDEX_team(r0, 0x8933, &(0x7f0000000040)={'team0\x00', 0x0}) sendmsg$TEAM_CMD_OPTIONS_SET(r0, &(0x7f0000000200)={0x0, 0x0, &(0x7f0000000000)={&(0x7f00000002c0)={0x58, r1, 0x1, 0x80000000, 0x25dfdc01, {}, [{{0x8, 0x1, r2}, {0x3c, 0x2, 0x0, 0x1, [{0x3a, 0x1, @notify_peers_count={{0x24}, {0x5}, {0x8, 0x4, 0x8}}}]}}]}, 0x58}, 0x1, 0x0, 0x0, 0x800}, 0x40000) program did not crash single: failed to extract reproducer bisect: bisecting 70 programs with base timeout 6m0s testing program (duration=6m17s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): [4, 4, 4, 4, 4, 4, 4, 4, 4, 4, 4, 4, 4, 4, 4, 4, 4, 4, 4, 4, 4, 4, 4, 4, 4, 4, 4, 4, 4, 4, 4, 4, 4, 4, 4, 4, 4, 4, 4, 4, 4, 4, 4, 4, 4, 4, 4, 4, 4, 4, 4, 4, 4, 4, 4, 4, 4, 4, 4, 4, 4, 4, 4, 4, 4, 4, 4, 4, 4, 4] detailed listing: executing program 32: r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$team(&(0x7f0000000100), 0xffffffffffffffff) ioctl$ifreq_SIOCGIFINDEX_team(r0, 0x8933, &(0x7f0000000040)={'team0\x00', 0x0}) sendmsg$TEAM_CMD_OPTIONS_SET(r0, &(0x7f0000000200)={0x0, 0x0, &(0x7f0000000000)={&(0x7f00000002c0)={0x58, r1, 0x1, 0x80000000, 0x25dfdc01, {}, [{{0x8, 0x1, r2}, {0x3c, 0x2, 0x0, 0x1, [{0x3a, 0x1, @notify_peers_count={{0x24}, {0x5}, {0x8, 0x4, 0x8}}}]}}]}, 0x58}, 0x1, 0x0, 0x0, 0x800}, 0x40000) executing program 33: r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000240), 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) r2 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x2) ioctl$KVM_PRE_FAULT_MEMORY(r2, 0xc040aed5, 0x0) executing program 2: r0 = syz_usb_connect(0x2, 0x36, &(0x7f0000000040)=ANY=[@ANYBLOB="12010000751c0110e60f00989ad1010203010902240001000000000904290202b48cbb0009050402100000fa000905820240"], 0x0) syz_usb_control_io$printer(r0, 0x0, 0x0) syz_usb_control_io$uac1(r0, 0x0, 0x0) syz_usb_control_io(r0, 0x0, &(0x7f0000000900)={0x84, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f0000000740)={0x40, 0x13, 0x6, @link_local}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) executing program 2: r0 = socket$can_bcm(0x1d, 0x2, 0x2) connect$can_bcm(r0, &(0x7f0000000180), 0x10) io_setup(0x9, &(0x7f0000000240)=0x0) io_submit(r1, 0x1, &(0x7f0000000100)=[&(0x7f00000000c0)={0x400000, 0x0, 0x0, 0x1, 0x0, r0, &(0x7f0000000200)="0500000093c21faf16da39de706f646800580f02000000003f420f000000000000580f02000000003f420f00000000000029ffffff000000", 0x20000238}]) executing program 2: r0 = openat$nullb(0xffffffffffffff9c, &(0x7f0000000100), 0xa8282, 0x0) r1 = dup(r0) write$6lowpan_enable(r1, &(0x7f0000000000)='1', 0x1) read$FUSE(r1, &(0x7f0000000440)={0x2020}, 0x2020) executing program 2: r0 = openat(0xffffffffffffff9c, &(0x7f0000000040)='.\x00', 0x0, 0x0) ioctl$FS_IOC_SETFLAGS(r0, 0x40086602, &(0x7f00000002c0)=0x20) mkdirat(0xffffffffffffff9c, &(0x7f0000000080)='./file0\x00', 0x0) rename(&(0x7f0000000280)='./file0\x00', &(0x7f0000000300)='./file1\x00') executing program 2: r0 = syz_init_net_socket$netrom(0x6, 0x5, 0x0) ioctl$int_in(r0, 0x5421, &(0x7f0000000080)=0x7) listen(r0, 0x1ad72f7) accept4(r0, 0x0, 0x0, 0x80000) executing program 2: r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) r2 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0) ioctl$KVM_SET_MSRS(r2, 0x4008ae89, &(0x7f00000002c0)={0x1, 0x0, [{0x1c4, 0x0, 0x81}]}) executing program 34: r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) r2 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0) ioctl$KVM_SET_MSRS(r2, 0x4008ae89, &(0x7f00000002c0)={0x1, 0x0, [{0x1c4, 0x0, 0x81}]}) executing program 6: r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000080), 0xffffffffffffffff) ioctl$sock_SIOCGIFINDEX_80211(r0, 0x8933, &(0x7f00000000c0)={'wlan1\x00', 0x0}) sendmsg$NL80211_CMD_CONNECT(r0, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000240)=ANY=[@ANYBLOB='(\x00\x00\x00', @ANYRES16=r1, @ANYBLOB="050013000104000000609600000008000300", @ANYRES32=r2, @ANYBLOB='\n\x004'], 0x28}}, 0x0) executing program 6: r0 = syz_init_net_socket$bt_sco(0x1f, 0x5, 0x2) setsockopt$sock_linger(r0, 0x1, 0xd, 0x0, 0x0) shutdown(r0, 0x0) shutdown(r0, 0x1) executing program 6: r0 = socket(0xa, 0x2400000001, 0x0) setsockopt$inet6_MCAST_JOIN_GROUP(r0, 0x29, 0x2a, &(0x7f0000034000)={0x9, {{0xa, 0x0, 0x4, @mcast2, 0x2}}}, 0xc6) setsockopt$inet6_MCAST_JOIN_GROUP(r0, 0x29, 0x2a, &(0x7f0000000040)={0x6, {{0xa, 0x0, 0x0, @mcast1}}}, 0x88) getsockopt$inet6_buf(r0, 0x29, 0x10000000000030, &(0x7f0000034000)=""/144, &(0x7f0000002280)=0x90) executing program 6: r0 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$netlbl_unlabel(&(0x7f0000000440), r0) sendmsg$NLBL_UNLABEL_C_STATICLISTDEF(r0, &(0x7f0000000500)={0x0, 0x0, &(0x7f00000004c0)={&(0x7f0000000080)={0x14, r1, 0xc8036ab6d6cbef07, 0x70bd28, 0x25dfdbfb}, 0x14}, 0x1, 0x0, 0x0, 0x1}, 0x45080) syz_genetlink_get_family_id$nfc(&(0x7f0000000240), r0) executing program 6: mknodat$loop(0xffffffffffffff9c, &(0x7f0000000040)='./file0\x00', 0x6000, 0x1) r0 = openat$fuse(0xffffffffffffff9c, &(0x7f0000000280), 0x2, 0x0) mount$fuse(0x0, &(0x7f0000000100)='./file0\x00', &(0x7f0000000140), 0x0, &(0x7f0000000540)=ANY=[@ANYBLOB='fd=', @ANYRESHEX=r0, @ANYBLOB=',rootmode=00000000000000000060000,user_id=', @ANYRESDEC=0x0, @ANYBLOB=',group_id=', @ANYRESDEC=0x0]) ioctl$FUSE_DEV_IOC_CLONE(r0, 0x8004e500, &(0x7f0000000000)=r0) executing program 6: r0 = msgget$private(0x0, 0x480) msgsnd(r0, &(0x7f0000001200)=ANY=[@ANYBLOB="01000000"], 0x401, 0x0) msgsnd(r0, &(0x7f0000000dc0)=ANY=[@ANYRES16], 0x401, 0x0) msgctl$IPC_RMID(r0, 0x0) executing program 5: r0 = syz_init_net_socket$bt_l2cap(0x1f, 0x1, 0x0) bind$bt_l2cap(r0, &(0x7f00000002c0)={0x1f, 0x0, @any, 0xfffa}, 0xe) connect$bt_l2cap(r0, &(0x7f0000000080)={0x1f, 0x0, @fixed={'\xaa\xaa\xaa\xaa\xaa', 0x10}, 0x7ff}, 0xe) sendmsg$inet(r0, &(0x7f00000023c0)={0x0, 0x0, &(0x7f0000002380)=[{&(0x7f0000001380)="8627878d6b8212d45c2dd9ccf83ce81dd30b8eec06fa665f95ae3ab8f9611f1810bdbd00b643780d07ac9dd292e631c72bf910161bf0731207cd60493e185ec9cb1de90d8bbdf54818dd722f5e78bc6b387221e6e7c46b2e37608179df7ad28279fbd622a61ddd81938d2fe4f26f2edcc7683f3925bd7a90a133b9871addb4f7cda5c4702d7a24be0756d20d25943ad911b8141c4039dc30dbcb0aefbf3f92beea6de191a25cf69f9a9ec393782723e72203f4b7c5dca02111d28ebb4e90b6787a84ba6fb79c4924c7e96734d33effee545c71f36446d00a2228bacc54355c44049ecad2c0b6028abbf23f9891ede6ca5c9e08f5d435e72d97b7eb03e27f94a34e642510cc0c983d894818e4694daeb2f46d3bc44a74c877302d317e4c80252a2954dca4bc0036592d66a9ceedecf531c23dfec82b372bcf8ca0631ea9e42313fdad73d4ca232221736541ba958c1bd4a97c415ca47b5c82b373c6851f95c54b833b5d23c176579d8288adfac40c1d43e38963ecf0456a35d1a45aa0a4847c68acf8865af0a054d2c5efce89c866ad390f6fb39ff1a5b4918054e28b114243b042265aaacf782913ef82880fe19e130372be48a5510ac7fb0388fef51b1bd65d35a5f28c2d4f3df40c902a9b004a5bfee3f3043d1ea337b6f795cf5b4047fa0454d3249da8d43e040ad435f67c1fe47275135b57ba777762b80255298b9dd84334704cc4d79bfb40f7e270d13597ebe3f8cd701cdeb0675246263a4e84daefecc4fbe31ca3fe32ab680c13f0d81ed6768f8f15f238b49ea8b3245dfdbea550183e611b68fb660e14c0441f2fd252370efd71ac563c7bf6475f7fb33f588c92a2fc3109acdfb64fb8b08c40bec207b398561128641d27d6ed4cbd40a75be4252d01a18a192f695271e26e76ed87d64ca862bc0ea14a63b25b9f25380da2272f7957", 0x2a1}], 0x1}, 0x0) executing program 5: setsockopt$SO_TIMESTAMPING(0xffffffffffffffff, 0x1, 0x25, &(0x7f0000000000)=0x3c33f, 0x4) r0 = syz_open_dev$dmmidi(&(0x7f0000000300), 0x2, 0x0) ioctl$SNDRV_RAWMIDI_IOCTL_PVERSION(r0, 0x40045702, &(0x7f0000000000)) ioctl$SNDRV_RAWMIDI_IOCTL_PARAMS(r0, 0xc0305710, &(0x7f0000000040)={0x1, 0x3, 0x3f6, 0x1, 0x21}) executing program 5: r0 = userfaultfd(0x80001) munmap(&(0x7f0000800000/0x800000)=nil, 0x800000) ioctl$UFFDIO_API(r0, 0xc018aa3f, &(0x7f0000000040)={0xaa, 0x110}) ioctl$UFFDIO_MOVE(r0, 0xc028aa05, &(0x7f0000000000)={&(0x7f0000724000/0x2000)=nil, &(0x7f0000ffb000/0x2000)=nil, 0x2000, 0x3}) executing program 5: mkdirat(0xffffffffffffff9c, &(0x7f0000000040)='./file0\x00', 0x1c0) mount$bind(&(0x7f0000000000)='.\x00', &(0x7f0000000200)='./file0/../file0\x00', 0x0, 0x101091, 0x0) mount$bind(&(0x7f0000000080)='./file0/../file0\x00', &(0x7f00000000c0)='./file0/file0\x00', 0x0, 0x8b101a, 0x0) umount2(&(0x7f0000000380)='./file0\x00', 0x0) executing program 5: r0 = socket$nl_xfrm(0x10, 0x3, 0x6) getsockopt$inet_IP_XFRM_POLICY(0xffffffffffffffff, 0x0, 0x11, 0x0, 0x0) r1 = openat$vcsa(0xffffffffffffff9c, &(0x7f0000000840), 0x1, 0x0) epoll_ctl$EPOLL_CTL_DEL(r1, 0x2, r0) executing program 5: socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) bind$unix(r0, &(0x7f0000000100)=@file={0x1, '\xe9\x1fq\x89Y\x1e\x923aK\x00'}, 0x6e) r1 = socket$unix(0x1, 0x2, 0x0) connect$unix(r1, &(0x7f0000000180)=@file={0x1, '\xe9\x1fq\x89Y\x1e\x923aK\x00'}, 0x6e) executing program 35: socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) bind$unix(r0, &(0x7f0000000100)=@file={0x1, '\xe9\x1fq\x89Y\x1e\x923aK\x00'}, 0x6e) r1 = socket$unix(0x1, 0x2, 0x0) connect$unix(r1, &(0x7f0000000180)=@file={0x1, '\xe9\x1fq\x89Y\x1e\x923aK\x00'}, 0x6e) executing program 36: r0 = msgget$private(0x0, 0x480) msgsnd(r0, &(0x7f0000001200)=ANY=[@ANYBLOB="01000000"], 0x401, 0x0) msgsnd(r0, &(0x7f0000000dc0)=ANY=[@ANYRES16], 0x401, 0x0) msgctl$IPC_RMID(r0, 0x0) executing program 4: sendmsg$ETHTOOL_MSG_STRSET_GET(0xffffffffffffffff, &(0x7f0000000a80)={0x0, 0x0, &(0x7f0000000a40)={&(0x7f00000002c0)={0x18, 0x0, 0x1, 0x70bd2d, 0x25dfdbff, {}, [@ETHTOOL_A_STRSET_HEADER={0x4}]}, 0x18}, 0x1, 0x0, 0x0, 0x880}, 0x4000004) r0 = socket(0x10, 0x3, 0x0) setsockopt$netlink_NETLINK_TX_RING(r0, 0x10e, 0xc, &(0x7f0000000280)={0x40bb, 0x2}, 0x10) sendmsg$netlink(r0, &(0x7f0000000040)={0x0, 0x0, &(0x7f00000001c0)=[{&(0x7f00000002c0)=ANY=[@ANYBLOB="780000001a0001002abd7000000000000a"], 0x78}], 0x1, 0x0, 0x0, 0x20400}, 0x0) executing program 4: sendmmsg$alg(0xffffffffffffffff, &(0x7f0000000040)=[{0x0, 0x0, &(0x7f0000000000)=[{0x0}, {0x0}, {&(0x7f00000003c0)}], 0x3}], 0x1, 0x40800) r0 = socket$kcm(0x10, 0x2, 0x0) write(0xffffffffffffffff, &(0x7f0000000000)="240000001a005f0214f9f407000904001f000000fe0000000000000008000f", 0x1f) write$cgroup_subtree(r0, &(0x7f0000000000)=ANY=[@ANYBLOB="563f00001a00599c6d0e000091d028ef80"], 0xfe33) executing program 4: getsockopt$inet_sctp6_SCTP_STATUS(0xffffffffffffffff, 0x84, 0xe, &(0x7f0000000280)={0x0, 0x99, 0xb, 0x4, 0xf, 0x5392, 0xfb9d, 0x9, {0x0, @in={{0x2, 0x4e22, @multicast1}}, 0x81, 0xb57, 0xc, 0x4b, 0x9}}, 0x0) r0 = socket$kcm(0x10, 0x2, 0x10) sendmsg$NFT_BATCH(0xffffffffffffffff, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000040)={&(0x7f00000001c0)=ANY=[@ANYBLOB="140000001000010000000000000000000000000a20000000000a03000000000000000000070000040900010073797a30000000009c000000090a010400000000000000000700000308000a40000000000900020073797a30000000000900010073797a3000000000080005400000000d58001280200001800e000100636f6e6e6c696d69740000000c0002800800014000000008200001800e000100636f6e6e6c696d69740000000c000280080001400000000014000180090001006cdbf80789f3f947dd000280080003"], 0xe4}}, 0x20050840) sendmsg$kcm(r0, &(0x7f0000000000)={0x0, 0xd18c9b25, &(0x7f0000000080)=[{&(0x7f0000000040)="e03f030041000b05d25a806c8c6394f90324fc60100000000a000200053582c137153e3704020180fc5409000c00", 0x33fe0}], 0x1}, 0x0) executing program 4: r0 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000080)='memory.numa_stat\x00', 0x26e1, 0x0) close(r0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f00000000c0)) ioctl$SIOCSIFHWADDR(r0, 0x8b0b, &(0x7f0000000000)={'wlan1\x00', @random='\x00\x00 \x00'}) executing program 4: r0 = socket$can_bcm(0x1d, 0x2, 0x2) connect$can_bcm(r0, &(0x7f0000000080), 0x10) sendmsg$can_bcm(r0, &(0x7f00000003c0)={0x0, 0x0, &(0x7f0000000380)={&(0x7f0000000600)=ANY=[@ANYBLOB="0500"/16, @ANYRES64=0x0, @ANYRES64=0x0, @ANYRES64=0x0, @ANYRES64=0x0, @ANYBLOB="0000000001000000000000000029"], 0x48}, 0x1, 0x0, 0x0, 0x48850}, 0x0) sendmsg$can_bcm(r0, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000100)={0x7, 0x0, 0x0, {}, {0x77359400}, {}, 0x1, @can={{}, 0x3, 0x2}}, 0x48}, 0x1, 0x0, 0x0, 0x4}, 0x0) executing program 4: r0 = openat$sysctl(0xffffffffffffff9c, &(0x7f0000000300)='/proc/sys/vm/drop_caches\x00', 0x1, 0x0) writev(r0, &(0x7f0000000080)=[{&(0x7f0000000140)='3', 0x1}], 0x1) write$uinput_user_dev(0xffffffffffffffff, &(0x7f0000000400)={'syz0\x00', {0x3, 0x2, 0x6, 0xfffa}, 0x3f, [0x8000, 0xc95a, 0xf, 0x8, 0x80, 0x2, 0x7, 0x7f, 0x20000006, 0x4c, 0x6, 0x5f, 0x9, 0x5, 0xffff2d37, 0xffffff01, 0x6, 0x4, 0x0, 0x5, 0x4, 0x0, 0x7, 0x3c5b, 0x1, 0x824, 0xd, 0x1, 0x2, 0xffffffff, 0xe661, 0x4, 0x7, 0x3, 0x8, 0x0, 0x80000000, 0x242, 0x3, 0xe, 0x0, 0x80008071, 0x2, 0x17, 0x1, 0x7, 0x5, 0x3e, 0x8c, 0x6, 0x6, 0x0, 0x5, 0x4, 0xfffffffa, 0x3fc, 0x80, 0x0, 0x2, 0x6, 0x8, 0x4, 0x1, 0x40], [0x10000007, 0x9, 0x8000012f, 0x8004, 0xf292, 0xfffffff3, 0x129432e6, 0xc9, 0xf9, 0x7fff, 0x78, 0x6e7, 0x9, 0xfffffffc, 0x3, 0x0, 0x0, 0x5, 0x31, 0xe, 0x312, 0x78, 0xea4, 0x2, 0x4, 0x7, 0x7fff, 0x6, 0x400, 0x401, 0x6, 0x1, 0xff, 0x5, 0x1000005, 0x5f31, 0xa, 0x4e0, 0x2, 0x4, 0xb, 0x4, 0x9, 0x8, 0x9, 0x6, 0x47, 0x8000, 0x1, 0xfff, 0xffff, 0x2, 0x4, 0x9, 0x3, 0x3, 0x7, 0x1, 0x3, 0x3, 0xbc45, 0x48c93690, 0x42, 0x2], [0x7, 0x408, 0x4, 0x5, 0xfffffffe, 0x100, 0x8d2, 0x9, 0x6, 0x7ff7, 0x0, 0x5, 0xb, 0xd, 0x5, 0x405, 0x0, 0x1ef, 0x5, 0x8, 0x86, 0x3, 0x303c, 0x3e7, 0xb, 0x5, 0x3e, 0xd9, 0x3, 0x20000009, 0x4, 0x6d01, 0x6, 0x38, 0x800003, 0x200, 0x80, 0x3, 0x4, 0x2950bfaf, 0x1002, 0x8, 0x7, 0x953a, 0x5, 0x6, 0x4, 0xbf, 0x2, 0x3, 0x7ff, 0x12b, 0x4, 0x1, 0xa, 0x0, 0x5, 0x1c, 0x120000, 0x3, 0x2006, 0x80a2ed, 0x4, 0x25], [0x6, 0xbb33, 0x6, 0xb, 0x5, 0x893a, 0x6, 0x6, 0x0, 0xb9, 0xce7, 0x1ff, 0x2, 0x57, 0x5, 0x3, 0x3, 0x10000, 0x4, 0x7fff, 0xffff, 0xa620, 0x2, 0x5, 0x1, 0x2, 0x14a, 0x60a7, 0x6, 0x16, 0xffffffff, 0x80000000, 0x1, 0x4, 0xc8, 0x1, 0x400, 0x10000, 0x3, 0x7e, 0x100, 0x9602, 0x7, 0x8af, 0x8, 0x6, 0x226, 0x5, 0x5, 0x28, 0x30b1d693, 0xa1f, 0xf43, 0x6, 0x1, 0x6c1b, 0x0, 0x4, 0x5, 0xb1e, 0x1, 0x200, 0xffff3441, 0xfff]}, 0x45c) ppoll(&(0x7f00000000c0)=[{}, {}], 0x20000000000000dc, 0x0, 0x0, 0x0) executing program 3: r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000100), 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) r2 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x2) ioctl$KVM_SET_MSRS(r2, 0x4008ae89, &(0x7f0000000040)={0x1, 0x0, [{0xd90, 0x0, 0x5}]}) executing program 3: r0 = openat$rdma_cm(0xffffffffffffff9c, &(0x7f00000001c0), 0x2, 0x0) r1 = openat$rdma_cm(0xffffffffffffff9c, &(0x7f00000004c0), 0x2, 0x0) write$RDMA_USER_CM_CMD_CREATE_ID(r1, &(0x7f00000000c0)={0x0, 0x18, 0xfa00, {0x0, &(0x7f0000000000)={0xffffffffffffffff}, 0x2, 0x9}}, 0xffffff69) write$RDMA_USER_CM_CMD_QUERY(r0, &(0x7f0000000040)={0x13, 0x10, 0xfa00, {0x0, r2, 0x1}}, 0x18) executing program 3: syz_fuse_handle_req(0xffffffffffffffff, 0x0, 0x0, &(0x7f0000000c80)={&(0x7f0000000140)={0x50, 0xffffffffffffffda, 0x1ff, {0x7, 0x2d, 0xfffffffb, 0x0, 0x5, 0x400, 0x8, 0x4, 0x0, 0x0, 0x20, 0x4}}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) mprotect(&(0x7f0000000000/0xf000)=nil, 0xf000, 0x1) r0 = socket$inet6_sctp(0xa, 0x5, 0x84) getsockopt$inet_sctp6_SCTP_DEFAULT_SEND_PARAM(r0, 0x84, 0xa, &(0x7f0000000100)={0x0, 0xa3, 0x4, 0x7, 0xffff, 0xd3a, 0x4, 0x9}, &(0x7f0000000140)=0x20) executing program 3: mkdirat(0xffffffffffffff9c, &(0x7f0000000040)='./file0\x00', 0x1c0) mount$bind(&(0x7f0000000000)='.\x00', &(0x7f0000000200)='./file0/../file0\x00', 0x0, 0x101091, 0x0) mount$bind(&(0x7f0000000080)='./file0/../file0\x00', &(0x7f00000000c0)='./file0/file0\x00', 0x0, 0x8b101a, 0x0) umount2(&(0x7f0000000380)='./file0\x00', 0x4) executing program 3: setsockopt$MRT_ADD_MFC_PROXY(0xffffffffffffffff, 0x0, 0xd2, &(0x7f0000000040)={@dev={0xac, 0x14, 0x14, 0x15}, @empty, 0x2, "4f6fb4d1af0f724e6118ecfbac0200843af29708e2355d0e7ea0c543011a00", 0xfffffffc, 0x4, 0x81, 0x81}, 0x3c) r0 = socket$kcm(0x10, 0x2, 0x10) sendmsg$NFT_BATCH(0xffffffffffffffff, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000040)={&(0x7f00000001c0)=ANY=[@ANYBLOB="140000001000010000000000000000000000000a20000000000a03000000000000000000070000040900010073797a30000000009c000000090a010400000000000000000700000308000a40000000000900020073797a30000000000900010073797a3000000000080005400000000d58001280200001800e000100636f6e6e6c696d69740000000c0002800800014000000008200001800e000100636f6e6e6c696d69740000000c00028008000140000000001400017b090001006cdbf80789f3f947dd000280080003"], 0xe4}, 0x1, 0x0, 0x0, 0x8001}, 0x20050840) sendmsg$kcm(r0, &(0x7f0000000000)={0x0, 0xd18c9b25, &(0x7f0000000080)=[{&(0x7f0000000040)="e03f030041000b05d25a806c8c6394f90324fc60100000000a000200053582c137153e3704020180fc5409000c00", 0x33fe0}], 0x1}, 0x0) executing program 3: r0 = socket$inet6_sctp(0xa, 0x1, 0x84) setsockopt$sock_timeval(r0, 0x1, 0x15, &(0x7f0000000000)={0x0, 0x2710}, 0x10) sendmmsg$inet6(r0, &(0x7f0000000200)=[{{&(0x7f00000000c0)={0xa, 0x0, 0x0, @loopback={0xfec0ffff00000000}}, 0x1c, &(0x7f0000000580)=[{&(0x7f0000000180)='i', 0x20086}], 0x1}}], 0x1, 0x0) sendmmsg$inet6(r0, &(0x7f00000071c0)=[{{&(0x7f00000001c0)={0xa, 0x1, 0x0, @loopback, 0x7}, 0x1c, &(0x7f0000000100)=[{&(0x7f0000000240)="8f", 0x1}], 0x1}}], 0x1, 0x24044004) executing program 37: r0 = socket$inet6_sctp(0xa, 0x1, 0x84) setsockopt$sock_timeval(r0, 0x1, 0x15, &(0x7f0000000000)={0x0, 0x2710}, 0x10) sendmmsg$inet6(r0, &(0x7f0000000200)=[{{&(0x7f00000000c0)={0xa, 0x0, 0x0, @loopback={0xfec0ffff00000000}}, 0x1c, &(0x7f0000000580)=[{&(0x7f0000000180)='i', 0x20086}], 0x1}}], 0x1, 0x0) sendmmsg$inet6(r0, &(0x7f00000071c0)=[{{&(0x7f00000001c0)={0xa, 0x1, 0x0, @loopback, 0x7}, 0x1c, &(0x7f0000000100)=[{&(0x7f0000000240)="8f", 0x1}], 0x1}}], 0x1, 0x24044004) executing program 7: r0 = syz_open_dev$loop(&(0x7f0000000100), 0x3, 0x1a7a40) r1 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000200)='blkio.bfq.io_service_bytes\x00', 0x275a, 0x0) write$binfmt_misc(r1, &(0x7f0000000040), 0xe09) ioctl$LOOP_CONFIGURE(r0, 0x4c0a, &(0x7f00000002c0)={r1, 0x0, {0x2a00, 0x80010000, 0x0, 0x6, 0x48dd, 0x0, 0x0, 0x0, 0x1c, "fee8a2ab78fc979fd1e00d96072000001ea89de2b7fb0000e60080b8785d96000100", "2809e8dbe108598948224ad54afac100875397bdb22d0000b420a1a93c9e01177d3d058dd4992861ac00", "90be8b1c551265406c7f306003d8a0f4bd000000000000516c08601a410b5800", [0x100000000, 0x7]}}) executing program 7: r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000000), 0xffffffffffffffff) ioctl$sock_SIOCGIFINDEX_80211(r0, 0x8933, &(0x7f0000000080)={'wlan1\x00', 0x0}) sendmsg$NL80211_CMD_JOIN_IBSS(r0, &(0x7f0000000300)={0x0, 0x0, &(0x7f0000000580)={&(0x7f0000001500)={0x40, r1, 0x101, 0x20000, 0x0, {{}, {@val={0x8, 0x3, r2}, @void}}, [@NL80211_ATTR_PRIVACY={0x4}, @NL80211_ATTR_SSID={0x5, 0x34, @random="81"}, @chandef_params=[@NL80211_ATTR_WIPHY_FREQ={0x8}], @NL80211_ATTR_KEYS={0x10, 0x51, 0x0, 0x1, [{0xc, 0x0, 0x0, 0x1, [@NL80211_KEY_TYPE={0x8, 0x7, 0x3}]}]}]}, 0x40}, 0x1, 0x0, 0x0, 0x4010}, 0x0) executing program 7: r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000080), 0xffffffffffffffff) ioctl$sock_SIOCGIFINDEX_80211(r0, 0x8933, &(0x7f0000000640)={'wlan0\x00', 0x0}) sendmsg$NL80211_CMD_CONNECT(r0, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000001a00)={&(0x7f0000000100)={0x34, r1, 0x5, 0x70bd29, 0x0, {{}, {@val={0x8, 0x3, r2}, @void}}, [@NL80211_ATTR_SSID={0xa, 0x34, @default_ibss_ssid}, @crypto_settings=[@NL80211_ATTR_CONTROL_PORT_OVER_NL80211={0x4}, @NL80211_ATTR_SOCKET_OWNER={0x4}, @NL80211_ATTR_CONTROL_PORT_NO_PREAUTH={0x4}]]}, 0x34}, 0x1, 0x0, 0x0, 0x40}, 0x810) executing program 7: r0 = openat(0xffffffffffffff9c, &(0x7f0000000040)='.\x00', 0x0, 0x0) ioctl$FS_IOC_SETFLAGS(r0, 0x40086602, &(0x7f00000002c0)=0x20) mkdirat(0xffffffffffffff9c, &(0x7f0000000080)='./file0\x00', 0x0) rename(&(0x7f0000000280)='./file0\x00', &(0x7f0000000300)='./file1\x00') executing program 7: syz_fuse_handle_req(0xffffffffffffffff, 0x0, 0x0, &(0x7f00000002c0)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f0000000540)={0xfffffffffffffeff, 0xfffffffffffffffe, 0xe81, {0x6, 0x3, 0x1002, 0x4, 0xc, 0x0, {0x1005, 0xfffffffffffffffd, 0x80000000000, 0x80000000004, 0x400000000000, 0x6, 0x5, 0x9, 0x1, 0x1000, 0x7, 0x0, 0x0, 0x0, 0x5}}}, 0x0, 0x0, 0x0, 0x0, 0x0}) r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$devlink(&(0x7f0000000dc0), 0xffffffffffffffff) sendmsg$DEVLINK_CMD_TRAP_GET(r0, &(0x7f0000000640)={0x0, 0x0, &(0x7f0000000600)={&(0x7f0000000540)=ANY=[@ANYBLOB='P\x00\x00\x00', @ANYRES16=r1, @ANYBLOB="010000000000fbdbdf25270000000e0001006e657464657673696d0000000f0002006e657464657673696d3000001c0053"], 0x50}, 0x1, 0x0, 0x0, 0x24040011}, 0x0) executing program 7: r0 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000100)='memory.numa_stat\x00', 0x26e1, 0x0) close(r0) socket$inet6_icmp_raw(0xa, 0x3, 0x3a) ioctl$SIOCSIFHWADDR(r0, 0x8b14, &(0x7f0000000000)={'wlan1\x00', @random="01000000008d"}) executing program 38: r0 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000100)='memory.numa_stat\x00', 0x26e1, 0x0) close(r0) socket$inet6_icmp_raw(0xa, 0x3, 0x3a) ioctl$SIOCSIFHWADDR(r0, 0x8b14, &(0x7f0000000000)={'wlan1\x00', @random="01000000008d"}) executing program 39: r0 = openat$sysctl(0xffffffffffffff9c, &(0x7f0000000300)='/proc/sys/vm/drop_caches\x00', 0x1, 0x0) writev(r0, &(0x7f0000000080)=[{&(0x7f0000000140)='3', 0x1}], 0x1) write$uinput_user_dev(0xffffffffffffffff, &(0x7f0000000400)={'syz0\x00', {0x3, 0x2, 0x6, 0xfffa}, 0x3f, [0x8000, 0xc95a, 0xf, 0x8, 0x80, 0x2, 0x7, 0x7f, 0x20000006, 0x4c, 0x6, 0x5f, 0x9, 0x5, 0xffff2d37, 0xffffff01, 0x6, 0x4, 0x0, 0x5, 0x4, 0x0, 0x7, 0x3c5b, 0x1, 0x824, 0xd, 0x1, 0x2, 0xffffffff, 0xe661, 0x4, 0x7, 0x3, 0x8, 0x0, 0x80000000, 0x242, 0x3, 0xe, 0x0, 0x80008071, 0x2, 0x17, 0x1, 0x7, 0x5, 0x3e, 0x8c, 0x6, 0x6, 0x0, 0x5, 0x4, 0xfffffffa, 0x3fc, 0x80, 0x0, 0x2, 0x6, 0x8, 0x4, 0x1, 0x40], [0x10000007, 0x9, 0x8000012f, 0x8004, 0xf292, 0xfffffff3, 0x129432e6, 0xc9, 0xf9, 0x7fff, 0x78, 0x6e7, 0x9, 0xfffffffc, 0x3, 0x0, 0x0, 0x5, 0x31, 0xe, 0x312, 0x78, 0xea4, 0x2, 0x4, 0x7, 0x7fff, 0x6, 0x400, 0x401, 0x6, 0x1, 0xff, 0x5, 0x1000005, 0x5f31, 0xa, 0x4e0, 0x2, 0x4, 0xb, 0x4, 0x9, 0x8, 0x9, 0x6, 0x47, 0x8000, 0x1, 0xfff, 0xffff, 0x2, 0x4, 0x9, 0x3, 0x3, 0x7, 0x1, 0x3, 0x3, 0xbc45, 0x48c93690, 0x42, 0x2], [0x7, 0x408, 0x4, 0x5, 0xfffffffe, 0x100, 0x8d2, 0x9, 0x6, 0x7ff7, 0x0, 0x5, 0xb, 0xd, 0x5, 0x405, 0x0, 0x1ef, 0x5, 0x8, 0x86, 0x3, 0x303c, 0x3e7, 0xb, 0x5, 0x3e, 0xd9, 0x3, 0x20000009, 0x4, 0x6d01, 0x6, 0x38, 0x800003, 0x200, 0x80, 0x3, 0x4, 0x2950bfaf, 0x1002, 0x8, 0x7, 0x953a, 0x5, 0x6, 0x4, 0xbf, 0x2, 0x3, 0x7ff, 0x12b, 0x4, 0x1, 0xa, 0x0, 0x5, 0x1c, 0x120000, 0x3, 0x2006, 0x80a2ed, 0x4, 0x25], [0x6, 0xbb33, 0x6, 0xb, 0x5, 0x893a, 0x6, 0x6, 0x0, 0xb9, 0xce7, 0x1ff, 0x2, 0x57, 0x5, 0x3, 0x3, 0x10000, 0x4, 0x7fff, 0xffff, 0xa620, 0x2, 0x5, 0x1, 0x2, 0x14a, 0x60a7, 0x6, 0x16, 0xffffffff, 0x80000000, 0x1, 0x4, 0xc8, 0x1, 0x400, 0x10000, 0x3, 0x7e, 0x100, 0x9602, 0x7, 0x8af, 0x8, 0x6, 0x226, 0x5, 0x5, 0x28, 0x30b1d693, 0xa1f, 0xf43, 0x6, 0x1, 0x6c1b, 0x0, 0x4, 0x5, 0xb1e, 0x1, 0x200, 0xffff3441, 0xfff]}, 0x45c) ppoll(&(0x7f00000000c0)=[{}, {}], 0x20000000000000dc, 0x0, 0x0, 0x0) executing program 8: bind$inet6(0xffffffffffffffff, &(0x7f0000000000)={0xa, 0x4e22, 0x13, @local, 0x2}, 0x1c) r0 = syz_open_dev$sg(&(0x7f00000060c0), 0x0, 0x0) mprotect(&(0x7f0000000000/0x3000)=nil, 0x3000, 0x1) ioctl$SG_IO(r0, 0x2285, &(0x7f00000033c0)={0x53, 0x0, 0x6, 0x6b, @scatter={0x0, 0x0, 0x0}, &(0x7f0000000000)="1c3513000000", 0x0, 0x0, 0x30520cf7f25f0c64, 0x0, 0x0}) executing program 8: r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$tipc2(&(0x7f0000000180), r0) sendmsg$TIPC_NL_KEY_SET(r0, &(0x7f0000000100)={0x0, 0x2844, &(0x7f0000000080)={&(0x7f00000001c0)={0x54, r1, 0x1, 0x0, 0x0, {0x3}, [@TIPC_NLA_BEARER={0x40, 0x1, 0x0, 0x1, [@TIPC_NLA_BEARER_UDP_OPTS={0x2c, 0x4, {{0x14, 0x1, @in={0x2, 0x0, @dev={0xac, 0x14, 0x14, 0xf}}}, {0x14, 0x2, @in={0x2, 0x0, @broadcast}}}}, @TIPC_NLA_BEARER_NAME={0xd, 0x1, @udp='udp:syz2\x00'}]}]}, 0x54}}, 0x0) sendmsg$TIPC_NL_BEARER_SET(r0, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000140)=ANY=[@ANYBLOB='4\x00\x00\x00', @ANYRES16=r1, @ANYBLOB="0100280000000000000002000000200001800d0001007564703a73797a32"], 0x34}}, 0x0) executing program 8: r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000080), 0x8002, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) r2 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x2) ioctl$KVM_SET_MSRS(r2, 0x4008ae89, &(0x7f0000000100)={0x1, 0x0, [{0x250, 0x0, 0xdd2}]}) executing program 8: mkdirat(0xffffffffffffff9c, &(0x7f0000000040)='./file0\x00', 0x1c0) mount$bind(&(0x7f0000000000)='.\x00', &(0x7f0000000200)='./file0/../file0\x00', 0x0, 0x101091, 0x0) mount$bind(&(0x7f0000000080)='./file0/../file0\x00', &(0x7f00000000c0)='./file0/file0\x00', 0x0, 0x8b101a, 0x0) umount2(&(0x7f0000000380)='./file0\x00', 0x0) executing program 8: setsockopt$SO_TIMESTAMPING(0xffffffffffffffff, 0x1, 0x25, &(0x7f0000000000)=0x3c33f, 0x4) r0 = syz_open_dev$dmmidi(&(0x7f0000000300), 0x2, 0x0) ioctl$SNDRV_RAWMIDI_IOCTL_PVERSION(r0, 0x40045702, &(0x7f0000000000)) ioctl$SNDRV_RAWMIDI_IOCTL_PARAMS(r0, 0xc0305710, &(0x7f0000000040)={0x1, 0x3, 0x3f6, 0x1, 0x21}) executing program 8: r0 = socket$nl_generic(0x10, 0x3, 0x10) mkdirat(0xffffffffffffff9c, &(0x7f0000000100)='./file0\x00', 0x181) getsockopt$sock_cred(r0, 0x1, 0x11, &(0x7f00000003c0)={0x0, 0x0}, &(0x7f0000000480)=0xc) mount$bpf(0x0, &(0x7f0000000340)='./file0\x00', &(0x7f0000000380), 0x2000000, &(0x7f0000000500)={[{@uid={'uid', 0x3d, r1}}]}) executing program 40: r0 = socket$nl_generic(0x10, 0x3, 0x10) mkdirat(0xffffffffffffff9c, &(0x7f0000000100)='./file0\x00', 0x181) getsockopt$sock_cred(r0, 0x1, 0x11, &(0x7f00000003c0)={0x0, 0x0}, &(0x7f0000000480)=0xc) mount$bpf(0x0, &(0x7f0000000340)='./file0\x00', &(0x7f0000000380), 0x2000000, &(0x7f0000000500)={[{@uid={'uid', 0x3d, r1}}]}) executing program 1: r0 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000001c0)='memory.events\x00', 0x275a, 0x0) mmap(&(0x7f0000000000/0x3000)=nil, 0x3000, 0x2000001, 0x12, r0, 0x0) r1 = socket$xdp(0x2c, 0x3, 0x0) setsockopt$XDP_UMEM_COMPLETION_RING(r1, 0x11b, 0x6, &(0x7f0000000000)=0x1104c0, 0x4) executing program 1: r0 = socket$packet(0x11, 0x3, 0x300) setsockopt$packet_int(r0, 0x107, 0xf, &(0x7f0000000100)=0x9, 0x4) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f00000000c0)={'erspan0\x00', 0x0}) sendto$packet(r0, &(0x7f0000000180)="0b032200eb1025120212475400f6a13bb1000000080089064803", 0x10300, 0x0, &(0x7f0000000140)={0x11, 0x0, r1}, 0x14) executing program 1: r0 = userfaultfd(0x80801) ioctl$UFFDIO_API(0xffffffffffffffff, 0xc018aa3f, &(0x7f0000000080)={0xaa, 0x260}) mprotect(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x1) ioctl$UFFDIO_API(r0, 0xc018aa3f, &(0x7f0000000080)={0xaa, 0x54}) executing program 1: mkdirat(0xffffffffffffff9c, &(0x7f0000000040)='./file0\x00', 0x1c0) mount$bind(&(0x7f0000000000)='.\x00', &(0x7f0000000200)='./file0/../file0\x00', 0x0, 0x101091, 0x0) mount$bind(&(0x7f0000000080)='./file0/../file0\x00', &(0x7f00000000c0)='./file0/file0\x00', 0x0, 0x8b101a, 0x0) umount2(&(0x7f0000000380)='./file0\x00', 0x0) executing program 1: r0 = socket$inet6_sctp(0xa, 0x1, 0x84) setsockopt$inet_sctp6_SCTP_STREAM_SCHEDULER(r0, 0x84, 0x7b, &(0x7f0000000000)={0x0, 0x1}, 0x8) sendmmsg$inet(r0, &(0x7f0000001980)=[{{&(0x7f0000000040)={0x2, 0x4e23, @rand_addr=0x64010102}, 0x10, &(0x7f00000003c0)=[{&(0x7f0000001500)='8', 0x1}], 0x1}}, {{&(0x7f00000000c0)={0x2, 0x4e24, @private=0xa010100}, 0x10, &(0x7f0000001880)=[{&(0x7f0000001540)="e9", 0x1}], 0x1}}], 0x2, 0x44042) setsockopt$inet_sctp6_SCTP_STREAM_SCHEDULER_VALUE(r0, 0x84, 0x7c, &(0x7f0000000100)={0x0, 0x6}, 0x8) executing program 1: r0 = socket(0xa, 0x5, 0x0) setsockopt$inet_sctp_SCTP_SOCKOPT_BINDX_ADD(r0, 0x84, 0x64, &(0x7f0000000080)=[@in6={0xa, 0x4e24, 0xf1, @loopback, 0x19f49a9}], 0x1c) sendmsg$inet_sctp(r0, &(0x7f00000000c0)={&(0x7f0000000000)=@in6={0xa, 0x4e24, 0xff, @loopback, 0x5}, 0x1c, &(0x7f0000000040)=[{&(0x7f0000000100)="e6", 0xfffd}], 0x1, &(0x7f00000002c0)=ANY=[@ANYBLOB="18000000000000008400000007000000ac1414aa0000000020000000000000008400000008000000200100"/56], 0x38, 0x4855}, 0x24000052) recvmmsg$unix(r0, &(0x7f0000001480)=[{{0x0, 0x0, &(0x7f00000001c0)=[{&(0x7f0000000300)=""/4105, 0x1009}], 0x1}}], 0x1, 0x40010040, 0x0) executing program 41: r0 = socket(0xa, 0x5, 0x0) setsockopt$inet_sctp_SCTP_SOCKOPT_BINDX_ADD(r0, 0x84, 0x64, &(0x7f0000000080)=[@in6={0xa, 0x4e24, 0xf1, @loopback, 0x19f49a9}], 0x1c) sendmsg$inet_sctp(r0, &(0x7f00000000c0)={&(0x7f0000000000)=@in6={0xa, 0x4e24, 0xff, @loopback, 0x5}, 0x1c, &(0x7f0000000040)=[{&(0x7f0000000100)="e6", 0xfffd}], 0x1, &(0x7f00000002c0)=ANY=[@ANYBLOB="18000000000000008400000007000000ac1414aa0000000020000000000000008400000008000000200100"/56], 0x38, 0x4855}, 0x24000052) recvmmsg$unix(r0, &(0x7f0000001480)=[{{0x0, 0x0, &(0x7f00000001c0)=[{&(0x7f0000000300)=""/4105, 0x1009}], 0x1}}], 0x1, 0x40010040, 0x0) executing program 9: r0 = syz_usb_connect(0x2, 0x24, &(0x7f0000000540)={{0x12, 0x1, 0x0, 0xa0, 0x14, 0xf, 0x20, 0x2304, 0x22e, 0x80f8, 0x1, 0x2, 0x3, 0x1, [{{0x9, 0x2, 0x12, 0x1, 0xfd, 0x4, 0x0, 0x7, "", [{{0x9, 0x4, 0xb7, 0x5, 0x0, 0xad, 0xdd, 0xc9, 0x7}}]}}]}}, 0x0) syz_usb_control_io$hid(r0, &(0x7f0000001940)={0x24, 0x0, &(0x7f0000001800)={0x0, 0x3, 0x2, @string={0x2}}, 0x0, 0x0}, 0x0) syz_usb_control_io$uac2(r0, &(0x7f00000020c0)={0x14, 0x0, &(0x7f0000002000)={0x0, 0x3, 0x2, @string={0x2}}}, 0x0) syz_usb_control_io$cdc_ecm(r0, 0x0, &(0x7f00000001c0)={0x1c, &(0x7f00000000c0)={0x40, 0x31, 0x2, "f7bc"}, 0x0, 0x0}) executing program 0: r0 = socket$kcm(0x10, 0x100000000002, 0x4) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) sendmmsg$unix(r1, &(0x7f0000000000), 0x651, 0x0) sendmsg$kcm(r0, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000300)=[{&(0x7f0000000200)="39000000140081ae00002c000500015601618575e285af0180000000171300883795c04a31ba377a1b2cc32b38d3740000ffffffffffffffff", 0x39}], 0x1, 0x0, 0x0, 0xc00e}, 0x0) executing program 0: lstat(&(0x7f0000000000)='\xe9\x1fq\x89Y\x1e\x923aK\x00', &(0x7f0000000180)) mprotect(&(0x7f0000000000/0xf000)=nil, 0xf000, 0x1) r0 = syz_open_dev$tty1(0xc, 0x4, 0x1) ioctl$VT_RESIZE(r0, 0x5609, &(0x7f0000000000)={0x8d, 0x7fff, 0x101}) executing program 0: r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000140), r0) ioctl$sock_SIOCGIFINDEX_80211(r0, 0x8933, &(0x7f00000001c0)={'wlan0\x00', 0x0}) sendmsg$NL80211_CMD_DEL_KEY(r0, &(0x7f0000000300)={0x0, 0x0, &(0x7f00000002c0)={&(0x7f0000000080)=ANY=[@ANYBLOB='4\x00\x00\x00', @ANYRES16=r1, @ANYBLOB="010028bd7000fddbdf250c00000008000300", @ANYRES32=r2, @ANYBLOB="0c0050800800070003"], 0x34}, 0x1, 0x0, 0x0, 0x8000}, 0x20005004) executing program 9: syz_init_net_socket$bt_sco(0x1f, 0x5, 0x2) r0 = syz_init_net_socket$bt_sco(0x1f, 0x5, 0x2) bind$bt_sco(r0, &(0x7f0000000000)={0x1f, @none}, 0x8) listen(r0, 0xffffff74) executing program 9: r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000000), 0x2900, 0x0) ioctl$TIOCSETD(r0, 0x5423, &(0x7f00000000c0)=0xf) ioctl$TCFLSH(r0, 0x400455c8, 0x2) ioctl$TIOCSETD(r0, 0x5412, &(0x7f0000000140)) executing program 0: quotactl_fd$Q_QUOTAON(0xffffffffffffffff, 0xffffffff80000201, 0x0, &(0x7f0000000080)='./cgroup\x00') mprotect(&(0x7f0000000000/0x4000)=nil, 0x4000, 0x1) r0 = socket$inet6_sctp(0xa, 0x5, 0x84) getsockopt$inet_sctp6_SCTP_PEER_ADDR_THLDS(r0, 0x84, 0x1f, &(0x7f0000000240)={0x0, @in6={{0xa, 0x4e21, 0x47, @ipv4={'\x00', '\xff\xff', @multicast2}, 0x400}}, 0x5, 0x40}, &(0x7f0000000080)=0x90) executing program 9: r0 = socket$alg(0x26, 0x5, 0x0) bind$alg(r0, &(0x7f0000000400)={0x26, 'hash\x00', 0x0, 0x0, 'sha384\x00'}, 0x58) accept$alg(r0, 0x0, 0x0) setsockopt$ALG_SET_KEY(r0, 0x117, 0x1, 0x0, 0x0) executing program 0: mkdirat(0xffffffffffffff9c, &(0x7f0000000200)='./file0\x00', 0x0) mount(0x0, &(0x7f00000001c0)='./file0\x00', &(0x7f0000000300)='debugfs\x00', 0x0, 0x0) mount$overlay(0x0, &(0x7f0000000140)='./file0\x00', &(0x7f0000000180), 0x0, &(0x7f0000000040)={[{@lowerdir={'lowerdir', 0x3d, './file0'}, 0x3a}], [], 0x2f}) openat2$dir(0xffffffffffffff9c, &(0x7f0000000080)='./file0\x00', &(0x7f00000000c0)={0x0, 0x0, 0xc}, 0x18) executing program 9: r0 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) setsockopt$sock_int(r0, 0x1, 0x29, &(0x7f0000000480)=0x7f, 0x4) bind$bt_hci(r0, &(0x7f0000000040)={0x1f, 0xffffffffffffffff, 0x2}, 0x6) recvmmsg(r0, &(0x7f0000002cc0)=[{{0x0, 0x0, 0x0}, 0x71d8e07a}], 0x1, 0x12020, 0x0) executing program 0: r0 = socket$nl_netfilter(0x10, 0x3, 0xc) r1 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPSET_CMD_CREATE(r1, &(0x7f0000000000)={0x0, 0x0, &(0x7f00000004c0)={&(0x7f00000001c0)={0x6c, 0x2, 0x6, 0x5, 0x0, 0x0, {0x0, 0x0, 0xfffc}, [@IPSET_ATTR_TYPENAME={0x12, 0x3, 'bitmap:ip,mac\x00'}, @IPSET_ATTR_REVISION={0x5}, @IPSET_ATTR_SETNAME={0x9, 0x2, 'syz1\x00'}, @IPSET_ATTR_DATA={0x20, 0x7, 0x0, 0x1, [@IPSET_ATTR_CIDR={0x5, 0x3, 0x1f}, @IPSET_ATTR_IP={0xc, 0x1, 0x0, 0x1, @IPSET_ATTR_IPADDR_IPV4={0x8, 0x1, 0x1, 0x0, @broadcast}}, @IPSET_ATTR_CADT_FLAGS={0x8, 0x8, 0x1, 0x0, 0xed}]}, @IPSET_ATTR_FAMILY={0x5, 0x5, 0x2}, @IPSET_ATTR_PROTOCOL={0x5, 0x1, 0x6}]}, 0x6c}, 0x1, 0x0, 0x0, 0x4010}, 0x0) sendmsg$IPSET_CMD_ADD(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000240)={&(0x7f0000000080)=ANY=[@ANYBLOB="400000000906010200000000000a0000000000000900020073797a31000000000500010007000000180007800c00018008000140ffffffff080009"], 0x40}, 0x1, 0x0, 0x0, 0x10000047}, 0x4000084) executing program 9: r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000000), 0x401, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) r2 = ioctl$KVM_CREATE_GUEST_MEMFD(r1, 0xc040aed4, &(0x7f00000001c0)={0x200001fe0000, 0x3}) mmap$KVM_VCPU(&(0x7f0000dfe000/0x4000)=nil, 0x930, 0x80000a, 0x8011, r2, 0x200001fe0000) program crashed: INFO: task hung in fuse_conn_destroy bisect: bisecting 70 programs bisect: split chunks (needed=false): <70> bisect: split chunk #0 of len 70 into 3 parts bisect: testing without sub-chunk 1/3 testing program (duration=6m11s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): [4, 4, 4, 4, 4, 4, 4, 4, 4, 4, 4, 4, 4, 4, 4, 4, 4, 4, 4, 4, 4, 4, 4, 4, 4, 4, 4, 4, 4, 4, 4, 4, 4, 4, 4, 4, 4, 4, 4, 4, 4, 4, 4, 4, 4, 4] detailed listing: executing program 4: sendmmsg$alg(0xffffffffffffffff, &(0x7f0000000040)=[{0x0, 0x0, &(0x7f0000000000)=[{0x0}, {0x0}, {&(0x7f00000003c0)}], 0x3}], 0x1, 0x40800) r0 = socket$kcm(0x10, 0x2, 0x0) write(0xffffffffffffffff, &(0x7f0000000000)="240000001a005f0214f9f407000904001f000000fe0000000000000008000f", 0x1f) write$cgroup_subtree(r0, &(0x7f0000000000)=ANY=[@ANYBLOB="563f00001a00599c6d0e000091d028ef80"], 0xfe33) executing program 4: getsockopt$inet_sctp6_SCTP_STATUS(0xffffffffffffffff, 0x84, 0xe, &(0x7f0000000280)={0x0, 0x99, 0xb, 0x4, 0xf, 0x5392, 0xfb9d, 0x9, {0x0, @in={{0x2, 0x4e22, @multicast1}}, 0x81, 0xb57, 0xc, 0x4b, 0x9}}, 0x0) r0 = socket$kcm(0x10, 0x2, 0x10) sendmsg$NFT_BATCH(0xffffffffffffffff, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000040)={&(0x7f00000001c0)=ANY=[@ANYBLOB="140000001000010000000000000000000000000a20000000000a03000000000000000000070000040900010073797a30000000009c000000090a010400000000000000000700000308000a40000000000900020073797a30000000000900010073797a3000000000080005400000000d58001280200001800e000100636f6e6e6c696d69740000000c0002800800014000000008200001800e000100636f6e6e6c696d69740000000c000280080001400000000014000180090001006cdbf80789f3f947dd000280080003"], 0xe4}}, 0x20050840) sendmsg$kcm(r0, &(0x7f0000000000)={0x0, 0xd18c9b25, &(0x7f0000000080)=[{&(0x7f0000000040)="e03f030041000b05d25a806c8c6394f90324fc60100000000a000200053582c137153e3704020180fc5409000c00", 0x33fe0}], 0x1}, 0x0) executing program 4: r0 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000080)='memory.numa_stat\x00', 0x26e1, 0x0) close(r0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f00000000c0)) ioctl$SIOCSIFHWADDR(r0, 0x8b0b, &(0x7f0000000000)={'wlan1\x00', @random='\x00\x00 \x00'}) executing program 4: r0 = socket$can_bcm(0x1d, 0x2, 0x2) connect$can_bcm(r0, &(0x7f0000000080), 0x10) sendmsg$can_bcm(r0, &(0x7f00000003c0)={0x0, 0x0, &(0x7f0000000380)={&(0x7f0000000600)=ANY=[@ANYBLOB="0500"/16, @ANYRES64=0x0, @ANYRES64=0x0, @ANYRES64=0x0, @ANYRES64=0x0, @ANYBLOB="0000000001000000000000000029"], 0x48}, 0x1, 0x0, 0x0, 0x48850}, 0x0) sendmsg$can_bcm(r0, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000100)={0x7, 0x0, 0x0, {}, {0x77359400}, {}, 0x1, @can={{}, 0x3, 0x2}}, 0x48}, 0x1, 0x0, 0x0, 0x4}, 0x0) executing program 4: r0 = openat$sysctl(0xffffffffffffff9c, &(0x7f0000000300)='/proc/sys/vm/drop_caches\x00', 0x1, 0x0) writev(r0, &(0x7f0000000080)=[{&(0x7f0000000140)='3', 0x1}], 0x1) write$uinput_user_dev(0xffffffffffffffff, &(0x7f0000000400)={'syz0\x00', {0x3, 0x2, 0x6, 0xfffa}, 0x3f, [0x8000, 0xc95a, 0xf, 0x8, 0x80, 0x2, 0x7, 0x7f, 0x20000006, 0x4c, 0x6, 0x5f, 0x9, 0x5, 0xffff2d37, 0xffffff01, 0x6, 0x4, 0x0, 0x5, 0x4, 0x0, 0x7, 0x3c5b, 0x1, 0x824, 0xd, 0x1, 0x2, 0xffffffff, 0xe661, 0x4, 0x7, 0x3, 0x8, 0x0, 0x80000000, 0x242, 0x3, 0xe, 0x0, 0x80008071, 0x2, 0x17, 0x1, 0x7, 0x5, 0x3e, 0x8c, 0x6, 0x6, 0x0, 0x5, 0x4, 0xfffffffa, 0x3fc, 0x80, 0x0, 0x2, 0x6, 0x8, 0x4, 0x1, 0x40], [0x10000007, 0x9, 0x8000012f, 0x8004, 0xf292, 0xfffffff3, 0x129432e6, 0xc9, 0xf9, 0x7fff, 0x78, 0x6e7, 0x9, 0xfffffffc, 0x3, 0x0, 0x0, 0x5, 0x31, 0xe, 0x312, 0x78, 0xea4, 0x2, 0x4, 0x7, 0x7fff, 0x6, 0x400, 0x401, 0x6, 0x1, 0xff, 0x5, 0x1000005, 0x5f31, 0xa, 0x4e0, 0x2, 0x4, 0xb, 0x4, 0x9, 0x8, 0x9, 0x6, 0x47, 0x8000, 0x1, 0xfff, 0xffff, 0x2, 0x4, 0x9, 0x3, 0x3, 0x7, 0x1, 0x3, 0x3, 0xbc45, 0x48c93690, 0x42, 0x2], [0x7, 0x408, 0x4, 0x5, 0xfffffffe, 0x100, 0x8d2, 0x9, 0x6, 0x7ff7, 0x0, 0x5, 0xb, 0xd, 0x5, 0x405, 0x0, 0x1ef, 0x5, 0x8, 0x86, 0x3, 0x303c, 0x3e7, 0xb, 0x5, 0x3e, 0xd9, 0x3, 0x20000009, 0x4, 0x6d01, 0x6, 0x38, 0x800003, 0x200, 0x80, 0x3, 0x4, 0x2950bfaf, 0x1002, 0x8, 0x7, 0x953a, 0x5, 0x6, 0x4, 0xbf, 0x2, 0x3, 0x7ff, 0x12b, 0x4, 0x1, 0xa, 0x0, 0x5, 0x1c, 0x120000, 0x3, 0x2006, 0x80a2ed, 0x4, 0x25], [0x6, 0xbb33, 0x6, 0xb, 0x5, 0x893a, 0x6, 0x6, 0x0, 0xb9, 0xce7, 0x1ff, 0x2, 0x57, 0x5, 0x3, 0x3, 0x10000, 0x4, 0x7fff, 0xffff, 0xa620, 0x2, 0x5, 0x1, 0x2, 0x14a, 0x60a7, 0x6, 0x16, 0xffffffff, 0x80000000, 0x1, 0x4, 0xc8, 0x1, 0x400, 0x10000, 0x3, 0x7e, 0x100, 0x9602, 0x7, 0x8af, 0x8, 0x6, 0x226, 0x5, 0x5, 0x28, 0x30b1d693, 0xa1f, 0xf43, 0x6, 0x1, 0x6c1b, 0x0, 0x4, 0x5, 0xb1e, 0x1, 0x200, 0xffff3441, 0xfff]}, 0x45c) ppoll(&(0x7f00000000c0)=[{}, {}], 0x20000000000000dc, 0x0, 0x0, 0x0) executing program 3: r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000100), 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) r2 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x2) ioctl$KVM_SET_MSRS(r2, 0x4008ae89, &(0x7f0000000040)={0x1, 0x0, [{0xd90, 0x0, 0x5}]}) executing program 3: r0 = openat$rdma_cm(0xffffffffffffff9c, &(0x7f00000001c0), 0x2, 0x0) r1 = openat$rdma_cm(0xffffffffffffff9c, &(0x7f00000004c0), 0x2, 0x0) write$RDMA_USER_CM_CMD_CREATE_ID(r1, &(0x7f00000000c0)={0x0, 0x18, 0xfa00, {0x0, &(0x7f0000000000)={0xffffffffffffffff}, 0x2, 0x9}}, 0xffffff69) write$RDMA_USER_CM_CMD_QUERY(r0, &(0x7f0000000040)={0x13, 0x10, 0xfa00, {0x0, r2, 0x1}}, 0x18) executing program 3: syz_fuse_handle_req(0xffffffffffffffff, 0x0, 0x0, &(0x7f0000000c80)={&(0x7f0000000140)={0x50, 0xffffffffffffffda, 0x1ff, {0x7, 0x2d, 0xfffffffb, 0x0, 0x5, 0x400, 0x8, 0x4, 0x0, 0x0, 0x20, 0x4}}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) mprotect(&(0x7f0000000000/0xf000)=nil, 0xf000, 0x1) r0 = socket$inet6_sctp(0xa, 0x5, 0x84) getsockopt$inet_sctp6_SCTP_DEFAULT_SEND_PARAM(r0, 0x84, 0xa, &(0x7f0000000100)={0x0, 0xa3, 0x4, 0x7, 0xffff, 0xd3a, 0x4, 0x9}, &(0x7f0000000140)=0x20) executing program 3: mkdirat(0xffffffffffffff9c, &(0x7f0000000040)='./file0\x00', 0x1c0) mount$bind(&(0x7f0000000000)='.\x00', &(0x7f0000000200)='./file0/../file0\x00', 0x0, 0x101091, 0x0) mount$bind(&(0x7f0000000080)='./file0/../file0\x00', &(0x7f00000000c0)='./file0/file0\x00', 0x0, 0x8b101a, 0x0) umount2(&(0x7f0000000380)='./file0\x00', 0x4) executing program 3: setsockopt$MRT_ADD_MFC_PROXY(0xffffffffffffffff, 0x0, 0xd2, &(0x7f0000000040)={@dev={0xac, 0x14, 0x14, 0x15}, @empty, 0x2, "4f6fb4d1af0f724e6118ecfbac0200843af29708e2355d0e7ea0c543011a00", 0xfffffffc, 0x4, 0x81, 0x81}, 0x3c) r0 = socket$kcm(0x10, 0x2, 0x10) sendmsg$NFT_BATCH(0xffffffffffffffff, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000040)={&(0x7f00000001c0)=ANY=[@ANYBLOB="140000001000010000000000000000000000000a20000000000a03000000000000000000070000040900010073797a30000000009c000000090a010400000000000000000700000308000a40000000000900020073797a30000000000900010073797a3000000000080005400000000d58001280200001800e000100636f6e6e6c696d69740000000c0002800800014000000008200001800e000100636f6e6e6c696d69740000000c00028008000140000000001400017b090001006cdbf80789f3f947dd000280080003"], 0xe4}, 0x1, 0x0, 0x0, 0x8001}, 0x20050840) sendmsg$kcm(r0, &(0x7f0000000000)={0x0, 0xd18c9b25, &(0x7f0000000080)=[{&(0x7f0000000040)="e03f030041000b05d25a806c8c6394f90324fc60100000000a000200053582c137153e3704020180fc5409000c00", 0x33fe0}], 0x1}, 0x0) executing program 3: r0 = socket$inet6_sctp(0xa, 0x1, 0x84) setsockopt$sock_timeval(r0, 0x1, 0x15, &(0x7f0000000000)={0x0, 0x2710}, 0x10) sendmmsg$inet6(r0, &(0x7f0000000200)=[{{&(0x7f00000000c0)={0xa, 0x0, 0x0, @loopback={0xfec0ffff00000000}}, 0x1c, &(0x7f0000000580)=[{&(0x7f0000000180)='i', 0x20086}], 0x1}}], 0x1, 0x0) sendmmsg$inet6(r0, &(0x7f00000071c0)=[{{&(0x7f00000001c0)={0xa, 0x1, 0x0, @loopback, 0x7}, 0x1c, &(0x7f0000000100)=[{&(0x7f0000000240)="8f", 0x1}], 0x1}}], 0x1, 0x24044004) executing program 37: r0 = socket$inet6_sctp(0xa, 0x1, 0x84) setsockopt$sock_timeval(r0, 0x1, 0x15, &(0x7f0000000000)={0x0, 0x2710}, 0x10) sendmmsg$inet6(r0, &(0x7f0000000200)=[{{&(0x7f00000000c0)={0xa, 0x0, 0x0, @loopback={0xfec0ffff00000000}}, 0x1c, &(0x7f0000000580)=[{&(0x7f0000000180)='i', 0x20086}], 0x1}}], 0x1, 0x0) sendmmsg$inet6(r0, &(0x7f00000071c0)=[{{&(0x7f00000001c0)={0xa, 0x1, 0x0, @loopback, 0x7}, 0x1c, &(0x7f0000000100)=[{&(0x7f0000000240)="8f", 0x1}], 0x1}}], 0x1, 0x24044004) executing program 7: r0 = syz_open_dev$loop(&(0x7f0000000100), 0x3, 0x1a7a40) r1 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000200)='blkio.bfq.io_service_bytes\x00', 0x275a, 0x0) write$binfmt_misc(r1, &(0x7f0000000040), 0xe09) ioctl$LOOP_CONFIGURE(r0, 0x4c0a, &(0x7f00000002c0)={r1, 0x0, {0x2a00, 0x80010000, 0x0, 0x6, 0x48dd, 0x0, 0x0, 0x0, 0x1c, "fee8a2ab78fc979fd1e00d96072000001ea89de2b7fb0000e60080b8785d96000100", "2809e8dbe108598948224ad54afac100875397bdb22d0000b420a1a93c9e01177d3d058dd4992861ac00", "90be8b1c551265406c7f306003d8a0f4bd000000000000516c08601a410b5800", [0x100000000, 0x7]}}) executing program 7: r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000000), 0xffffffffffffffff) ioctl$sock_SIOCGIFINDEX_80211(r0, 0x8933, &(0x7f0000000080)={'wlan1\x00', 0x0}) sendmsg$NL80211_CMD_JOIN_IBSS(r0, &(0x7f0000000300)={0x0, 0x0, &(0x7f0000000580)={&(0x7f0000001500)={0x40, r1, 0x101, 0x20000, 0x0, {{}, {@val={0x8, 0x3, r2}, @void}}, [@NL80211_ATTR_PRIVACY={0x4}, @NL80211_ATTR_SSID={0x5, 0x34, @random="81"}, @chandef_params=[@NL80211_ATTR_WIPHY_FREQ={0x8}], @NL80211_ATTR_KEYS={0x10, 0x51, 0x0, 0x1, [{0xc, 0x0, 0x0, 0x1, [@NL80211_KEY_TYPE={0x8, 0x7, 0x3}]}]}]}, 0x40}, 0x1, 0x0, 0x0, 0x4010}, 0x0) executing program 7: r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000080), 0xffffffffffffffff) ioctl$sock_SIOCGIFINDEX_80211(r0, 0x8933, &(0x7f0000000640)={'wlan0\x00', 0x0}) sendmsg$NL80211_CMD_CONNECT(r0, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000001a00)={&(0x7f0000000100)={0x34, r1, 0x5, 0x70bd29, 0x0, {{}, {@val={0x8, 0x3, r2}, @void}}, [@NL80211_ATTR_SSID={0xa, 0x34, @default_ibss_ssid}, @crypto_settings=[@NL80211_ATTR_CONTROL_PORT_OVER_NL80211={0x4}, @NL80211_ATTR_SOCKET_OWNER={0x4}, @NL80211_ATTR_CONTROL_PORT_NO_PREAUTH={0x4}]]}, 0x34}, 0x1, 0x0, 0x0, 0x40}, 0x810) executing program 7: r0 = openat(0xffffffffffffff9c, &(0x7f0000000040)='.\x00', 0x0, 0x0) ioctl$FS_IOC_SETFLAGS(r0, 0x40086602, &(0x7f00000002c0)=0x20) mkdirat(0xffffffffffffff9c, &(0x7f0000000080)='./file0\x00', 0x0) rename(&(0x7f0000000280)='./file0\x00', &(0x7f0000000300)='./file1\x00') executing program 7: syz_fuse_handle_req(0xffffffffffffffff, 0x0, 0x0, &(0x7f00000002c0)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f0000000540)={0xfffffffffffffeff, 0xfffffffffffffffe, 0xe81, {0x6, 0x3, 0x1002, 0x4, 0xc, 0x0, {0x1005, 0xfffffffffffffffd, 0x80000000000, 0x80000000004, 0x400000000000, 0x6, 0x5, 0x9, 0x1, 0x1000, 0x7, 0x0, 0x0, 0x0, 0x5}}}, 0x0, 0x0, 0x0, 0x0, 0x0}) r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$devlink(&(0x7f0000000dc0), 0xffffffffffffffff) sendmsg$DEVLINK_CMD_TRAP_GET(r0, &(0x7f0000000640)={0x0, 0x0, &(0x7f0000000600)={&(0x7f0000000540)=ANY=[@ANYBLOB='P\x00\x00\x00', @ANYRES16=r1, @ANYBLOB="010000000000fbdbdf25270000000e0001006e657464657673696d0000000f0002006e657464657673696d3000001c0053"], 0x50}, 0x1, 0x0, 0x0, 0x24040011}, 0x0) executing program 7: r0 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000100)='memory.numa_stat\x00', 0x26e1, 0x0) close(r0) socket$inet6_icmp_raw(0xa, 0x3, 0x3a) ioctl$SIOCSIFHWADDR(r0, 0x8b14, &(0x7f0000000000)={'wlan1\x00', @random="01000000008d"}) executing program 38: r0 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000100)='memory.numa_stat\x00', 0x26e1, 0x0) close(r0) socket$inet6_icmp_raw(0xa, 0x3, 0x3a) ioctl$SIOCSIFHWADDR(r0, 0x8b14, &(0x7f0000000000)={'wlan1\x00', @random="01000000008d"}) executing program 39: r0 = openat$sysctl(0xffffffffffffff9c, &(0x7f0000000300)='/proc/sys/vm/drop_caches\x00', 0x1, 0x0) writev(r0, &(0x7f0000000080)=[{&(0x7f0000000140)='3', 0x1}], 0x1) write$uinput_user_dev(0xffffffffffffffff, &(0x7f0000000400)={'syz0\x00', {0x3, 0x2, 0x6, 0xfffa}, 0x3f, [0x8000, 0xc95a, 0xf, 0x8, 0x80, 0x2, 0x7, 0x7f, 0x20000006, 0x4c, 0x6, 0x5f, 0x9, 0x5, 0xffff2d37, 0xffffff01, 0x6, 0x4, 0x0, 0x5, 0x4, 0x0, 0x7, 0x3c5b, 0x1, 0x824, 0xd, 0x1, 0x2, 0xffffffff, 0xe661, 0x4, 0x7, 0x3, 0x8, 0x0, 0x80000000, 0x242, 0x3, 0xe, 0x0, 0x80008071, 0x2, 0x17, 0x1, 0x7, 0x5, 0x3e, 0x8c, 0x6, 0x6, 0x0, 0x5, 0x4, 0xfffffffa, 0x3fc, 0x80, 0x0, 0x2, 0x6, 0x8, 0x4, 0x1, 0x40], [0x10000007, 0x9, 0x8000012f, 0x8004, 0xf292, 0xfffffff3, 0x129432e6, 0xc9, 0xf9, 0x7fff, 0x78, 0x6e7, 0x9, 0xfffffffc, 0x3, 0x0, 0x0, 0x5, 0x31, 0xe, 0x312, 0x78, 0xea4, 0x2, 0x4, 0x7, 0x7fff, 0x6, 0x400, 0x401, 0x6, 0x1, 0xff, 0x5, 0x1000005, 0x5f31, 0xa, 0x4e0, 0x2, 0x4, 0xb, 0x4, 0x9, 0x8, 0x9, 0x6, 0x47, 0x8000, 0x1, 0xfff, 0xffff, 0x2, 0x4, 0x9, 0x3, 0x3, 0x7, 0x1, 0x3, 0x3, 0xbc45, 0x48c93690, 0x42, 0x2], [0x7, 0x408, 0x4, 0x5, 0xfffffffe, 0x100, 0x8d2, 0x9, 0x6, 0x7ff7, 0x0, 0x5, 0xb, 0xd, 0x5, 0x405, 0x0, 0x1ef, 0x5, 0x8, 0x86, 0x3, 0x303c, 0x3e7, 0xb, 0x5, 0x3e, 0xd9, 0x3, 0x20000009, 0x4, 0x6d01, 0x6, 0x38, 0x800003, 0x200, 0x80, 0x3, 0x4, 0x2950bfaf, 0x1002, 0x8, 0x7, 0x953a, 0x5, 0x6, 0x4, 0xbf, 0x2, 0x3, 0x7ff, 0x12b, 0x4, 0x1, 0xa, 0x0, 0x5, 0x1c, 0x120000, 0x3, 0x2006, 0x80a2ed, 0x4, 0x25], [0x6, 0xbb33, 0x6, 0xb, 0x5, 0x893a, 0x6, 0x6, 0x0, 0xb9, 0xce7, 0x1ff, 0x2, 0x57, 0x5, 0x3, 0x3, 0x10000, 0x4, 0x7fff, 0xffff, 0xa620, 0x2, 0x5, 0x1, 0x2, 0x14a, 0x60a7, 0x6, 0x16, 0xffffffff, 0x80000000, 0x1, 0x4, 0xc8, 0x1, 0x400, 0x10000, 0x3, 0x7e, 0x100, 0x9602, 0x7, 0x8af, 0x8, 0x6, 0x226, 0x5, 0x5, 0x28, 0x30b1d693, 0xa1f, 0xf43, 0x6, 0x1, 0x6c1b, 0x0, 0x4, 0x5, 0xb1e, 0x1, 0x200, 0xffff3441, 0xfff]}, 0x45c) ppoll(&(0x7f00000000c0)=[{}, {}], 0x20000000000000dc, 0x0, 0x0, 0x0) executing program 8: bind$inet6(0xffffffffffffffff, &(0x7f0000000000)={0xa, 0x4e22, 0x13, @local, 0x2}, 0x1c) r0 = syz_open_dev$sg(&(0x7f00000060c0), 0x0, 0x0) mprotect(&(0x7f0000000000/0x3000)=nil, 0x3000, 0x1) ioctl$SG_IO(r0, 0x2285, &(0x7f00000033c0)={0x53, 0x0, 0x6, 0x6b, @scatter={0x0, 0x0, 0x0}, &(0x7f0000000000)="1c3513000000", 0x0, 0x0, 0x30520cf7f25f0c64, 0x0, 0x0}) executing program 8: r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$tipc2(&(0x7f0000000180), r0) sendmsg$TIPC_NL_KEY_SET(r0, &(0x7f0000000100)={0x0, 0x2844, &(0x7f0000000080)={&(0x7f00000001c0)={0x54, r1, 0x1, 0x0, 0x0, {0x3}, [@TIPC_NLA_BEARER={0x40, 0x1, 0x0, 0x1, [@TIPC_NLA_BEARER_UDP_OPTS={0x2c, 0x4, {{0x14, 0x1, @in={0x2, 0x0, @dev={0xac, 0x14, 0x14, 0xf}}}, {0x14, 0x2, @in={0x2, 0x0, @broadcast}}}}, @TIPC_NLA_BEARER_NAME={0xd, 0x1, @udp='udp:syz2\x00'}]}]}, 0x54}}, 0x0) sendmsg$TIPC_NL_BEARER_SET(r0, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000140)=ANY=[@ANYBLOB='4\x00\x00\x00', @ANYRES16=r1, @ANYBLOB="0100280000000000000002000000200001800d0001007564703a73797a32"], 0x34}}, 0x0) executing program 8: r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000080), 0x8002, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) r2 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x2) ioctl$KVM_SET_MSRS(r2, 0x4008ae89, &(0x7f0000000100)={0x1, 0x0, [{0x250, 0x0, 0xdd2}]}) executing program 8: mkdirat(0xffffffffffffff9c, &(0x7f0000000040)='./file0\x00', 0x1c0) mount$bind(&(0x7f0000000000)='.\x00', &(0x7f0000000200)='./file0/../file0\x00', 0x0, 0x101091, 0x0) mount$bind(&(0x7f0000000080)='./file0/../file0\x00', &(0x7f00000000c0)='./file0/file0\x00', 0x0, 0x8b101a, 0x0) umount2(&(0x7f0000000380)='./file0\x00', 0x0) executing program 8: setsockopt$SO_TIMESTAMPING(0xffffffffffffffff, 0x1, 0x25, &(0x7f0000000000)=0x3c33f, 0x4) r0 = syz_open_dev$dmmidi(&(0x7f0000000300), 0x2, 0x0) ioctl$SNDRV_RAWMIDI_IOCTL_PVERSION(r0, 0x40045702, &(0x7f0000000000)) ioctl$SNDRV_RAWMIDI_IOCTL_PARAMS(r0, 0xc0305710, &(0x7f0000000040)={0x1, 0x3, 0x3f6, 0x1, 0x21}) executing program 8: r0 = socket$nl_generic(0x10, 0x3, 0x10) mkdirat(0xffffffffffffff9c, &(0x7f0000000100)='./file0\x00', 0x181) getsockopt$sock_cred(r0, 0x1, 0x11, &(0x7f00000003c0)={0x0, 0x0}, &(0x7f0000000480)=0xc) mount$bpf(0x0, &(0x7f0000000340)='./file0\x00', &(0x7f0000000380), 0x2000000, &(0x7f0000000500)={[{@uid={'uid', 0x3d, r1}}]}) executing program 40: r0 = socket$nl_generic(0x10, 0x3, 0x10) mkdirat(0xffffffffffffff9c, &(0x7f0000000100)='./file0\x00', 0x181) getsockopt$sock_cred(r0, 0x1, 0x11, &(0x7f00000003c0)={0x0, 0x0}, &(0x7f0000000480)=0xc) mount$bpf(0x0, &(0x7f0000000340)='./file0\x00', &(0x7f0000000380), 0x2000000, &(0x7f0000000500)={[{@uid={'uid', 0x3d, r1}}]}) executing program 1: r0 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000001c0)='memory.events\x00', 0x275a, 0x0) mmap(&(0x7f0000000000/0x3000)=nil, 0x3000, 0x2000001, 0x12, r0, 0x0) r1 = socket$xdp(0x2c, 0x3, 0x0) setsockopt$XDP_UMEM_COMPLETION_RING(r1, 0x11b, 0x6, &(0x7f0000000000)=0x1104c0, 0x4) executing program 1: r0 = socket$packet(0x11, 0x3, 0x300) setsockopt$packet_int(r0, 0x107, 0xf, &(0x7f0000000100)=0x9, 0x4) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f00000000c0)={'erspan0\x00', 0x0}) sendto$packet(r0, &(0x7f0000000180)="0b032200eb1025120212475400f6a13bb1000000080089064803", 0x10300, 0x0, &(0x7f0000000140)={0x11, 0x0, r1}, 0x14) executing program 1: r0 = userfaultfd(0x80801) ioctl$UFFDIO_API(0xffffffffffffffff, 0xc018aa3f, &(0x7f0000000080)={0xaa, 0x260}) mprotect(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x1) ioctl$UFFDIO_API(r0, 0xc018aa3f, &(0x7f0000000080)={0xaa, 0x54}) executing program 1: mkdirat(0xffffffffffffff9c, &(0x7f0000000040)='./file0\x00', 0x1c0) mount$bind(&(0x7f0000000000)='.\x00', &(0x7f0000000200)='./file0/../file0\x00', 0x0, 0x101091, 0x0) mount$bind(&(0x7f0000000080)='./file0/../file0\x00', &(0x7f00000000c0)='./file0/file0\x00', 0x0, 0x8b101a, 0x0) umount2(&(0x7f0000000380)='./file0\x00', 0x0) executing program 1: r0 = socket$inet6_sctp(0xa, 0x1, 0x84) setsockopt$inet_sctp6_SCTP_STREAM_SCHEDULER(r0, 0x84, 0x7b, &(0x7f0000000000)={0x0, 0x1}, 0x8) sendmmsg$inet(r0, &(0x7f0000001980)=[{{&(0x7f0000000040)={0x2, 0x4e23, @rand_addr=0x64010102}, 0x10, &(0x7f00000003c0)=[{&(0x7f0000001500)='8', 0x1}], 0x1}}, {{&(0x7f00000000c0)={0x2, 0x4e24, @private=0xa010100}, 0x10, &(0x7f0000001880)=[{&(0x7f0000001540)="e9", 0x1}], 0x1}}], 0x2, 0x44042) setsockopt$inet_sctp6_SCTP_STREAM_SCHEDULER_VALUE(r0, 0x84, 0x7c, &(0x7f0000000100)={0x0, 0x6}, 0x8) executing program 1: r0 = socket(0xa, 0x5, 0x0) setsockopt$inet_sctp_SCTP_SOCKOPT_BINDX_ADD(r0, 0x84, 0x64, &(0x7f0000000080)=[@in6={0xa, 0x4e24, 0xf1, @loopback, 0x19f49a9}], 0x1c) sendmsg$inet_sctp(r0, &(0x7f00000000c0)={&(0x7f0000000000)=@in6={0xa, 0x4e24, 0xff, @loopback, 0x5}, 0x1c, &(0x7f0000000040)=[{&(0x7f0000000100)="e6", 0xfffd}], 0x1, &(0x7f00000002c0)=ANY=[@ANYBLOB="18000000000000008400000007000000ac1414aa0000000020000000000000008400000008000000200100"/56], 0x38, 0x4855}, 0x24000052) recvmmsg$unix(r0, &(0x7f0000001480)=[{{0x0, 0x0, &(0x7f00000001c0)=[{&(0x7f0000000300)=""/4105, 0x1009}], 0x1}}], 0x1, 0x40010040, 0x0) executing program 41: r0 = socket(0xa, 0x5, 0x0) setsockopt$inet_sctp_SCTP_SOCKOPT_BINDX_ADD(r0, 0x84, 0x64, &(0x7f0000000080)=[@in6={0xa, 0x4e24, 0xf1, @loopback, 0x19f49a9}], 0x1c) sendmsg$inet_sctp(r0, &(0x7f00000000c0)={&(0x7f0000000000)=@in6={0xa, 0x4e24, 0xff, @loopback, 0x5}, 0x1c, &(0x7f0000000040)=[{&(0x7f0000000100)="e6", 0xfffd}], 0x1, &(0x7f00000002c0)=ANY=[@ANYBLOB="18000000000000008400000007000000ac1414aa0000000020000000000000008400000008000000200100"/56], 0x38, 0x4855}, 0x24000052) recvmmsg$unix(r0, &(0x7f0000001480)=[{{0x0, 0x0, &(0x7f00000001c0)=[{&(0x7f0000000300)=""/4105, 0x1009}], 0x1}}], 0x1, 0x40010040, 0x0) executing program 9: r0 = syz_usb_connect(0x2, 0x24, &(0x7f0000000540)={{0x12, 0x1, 0x0, 0xa0, 0x14, 0xf, 0x20, 0x2304, 0x22e, 0x80f8, 0x1, 0x2, 0x3, 0x1, [{{0x9, 0x2, 0x12, 0x1, 0xfd, 0x4, 0x0, 0x7, "", [{{0x9, 0x4, 0xb7, 0x5, 0x0, 0xad, 0xdd, 0xc9, 0x7}}]}}]}}, 0x0) syz_usb_control_io$hid(r0, &(0x7f0000001940)={0x24, 0x0, &(0x7f0000001800)={0x0, 0x3, 0x2, @string={0x2}}, 0x0, 0x0}, 0x0) syz_usb_control_io$uac2(r0, &(0x7f00000020c0)={0x14, 0x0, &(0x7f0000002000)={0x0, 0x3, 0x2, @string={0x2}}}, 0x0) syz_usb_control_io$cdc_ecm(r0, 0x0, &(0x7f00000001c0)={0x1c, &(0x7f00000000c0)={0x40, 0x31, 0x2, "f7bc"}, 0x0, 0x0}) executing program 0: r0 = socket$kcm(0x10, 0x100000000002, 0x4) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) sendmmsg$unix(r1, &(0x7f0000000000), 0x651, 0x0) sendmsg$kcm(r0, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000300)=[{&(0x7f0000000200)="39000000140081ae00002c000500015601618575e285af0180000000171300883795c04a31ba377a1b2cc32b38d3740000ffffffffffffffff", 0x39}], 0x1, 0x0, 0x0, 0xc00e}, 0x0) executing program 0: lstat(&(0x7f0000000000)='\xe9\x1fq\x89Y\x1e\x923aK\x00', &(0x7f0000000180)) mprotect(&(0x7f0000000000/0xf000)=nil, 0xf000, 0x1) r0 = syz_open_dev$tty1(0xc, 0x4, 0x1) ioctl$VT_RESIZE(r0, 0x5609, &(0x7f0000000000)={0x8d, 0x7fff, 0x101}) executing program 0: r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000140), r0) ioctl$sock_SIOCGIFINDEX_80211(r0, 0x8933, &(0x7f00000001c0)={'wlan0\x00', 0x0}) sendmsg$NL80211_CMD_DEL_KEY(r0, &(0x7f0000000300)={0x0, 0x0, &(0x7f00000002c0)={&(0x7f0000000080)=ANY=[@ANYBLOB='4\x00\x00\x00', @ANYRES16=r1, @ANYBLOB="010028bd7000fddbdf250c00000008000300", @ANYRES32=r2, @ANYBLOB="0c0050800800070003"], 0x34}, 0x1, 0x0, 0x0, 0x8000}, 0x20005004) executing program 9: syz_init_net_socket$bt_sco(0x1f, 0x5, 0x2) r0 = syz_init_net_socket$bt_sco(0x1f, 0x5, 0x2) bind$bt_sco(r0, &(0x7f0000000000)={0x1f, @none}, 0x8) listen(r0, 0xffffff74) executing program 9: r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000000), 0x2900, 0x0) ioctl$TIOCSETD(r0, 0x5423, &(0x7f00000000c0)=0xf) ioctl$TCFLSH(r0, 0x400455c8, 0x2) ioctl$TIOCSETD(r0, 0x5412, &(0x7f0000000140)) executing program 0: quotactl_fd$Q_QUOTAON(0xffffffffffffffff, 0xffffffff80000201, 0x0, &(0x7f0000000080)='./cgroup\x00') mprotect(&(0x7f0000000000/0x4000)=nil, 0x4000, 0x1) r0 = socket$inet6_sctp(0xa, 0x5, 0x84) getsockopt$inet_sctp6_SCTP_PEER_ADDR_THLDS(r0, 0x84, 0x1f, &(0x7f0000000240)={0x0, @in6={{0xa, 0x4e21, 0x47, @ipv4={'\x00', '\xff\xff', @multicast2}, 0x400}}, 0x5, 0x40}, &(0x7f0000000080)=0x90) executing program 9: r0 = socket$alg(0x26, 0x5, 0x0) bind$alg(r0, &(0x7f0000000400)={0x26, 'hash\x00', 0x0, 0x0, 'sha384\x00'}, 0x58) accept$alg(r0, 0x0, 0x0) setsockopt$ALG_SET_KEY(r0, 0x117, 0x1, 0x0, 0x0) executing program 0: mkdirat(0xffffffffffffff9c, &(0x7f0000000200)='./file0\x00', 0x0) mount(0x0, &(0x7f00000001c0)='./file0\x00', &(0x7f0000000300)='debugfs\x00', 0x0, 0x0) mount$overlay(0x0, &(0x7f0000000140)='./file0\x00', &(0x7f0000000180), 0x0, &(0x7f0000000040)={[{@lowerdir={'lowerdir', 0x3d, './file0'}, 0x3a}], [], 0x2f}) openat2$dir(0xffffffffffffff9c, &(0x7f0000000080)='./file0\x00', &(0x7f00000000c0)={0x0, 0x0, 0xc}, 0x18) executing program 9: r0 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) setsockopt$sock_int(r0, 0x1, 0x29, &(0x7f0000000480)=0x7f, 0x4) bind$bt_hci(r0, &(0x7f0000000040)={0x1f, 0xffffffffffffffff, 0x2}, 0x6) recvmmsg(r0, &(0x7f0000002cc0)=[{{0x0, 0x0, 0x0}, 0x71d8e07a}], 0x1, 0x12020, 0x0) executing program 0: r0 = socket$nl_netfilter(0x10, 0x3, 0xc) r1 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPSET_CMD_CREATE(r1, &(0x7f0000000000)={0x0, 0x0, &(0x7f00000004c0)={&(0x7f00000001c0)={0x6c, 0x2, 0x6, 0x5, 0x0, 0x0, {0x0, 0x0, 0xfffc}, [@IPSET_ATTR_TYPENAME={0x12, 0x3, 'bitmap:ip,mac\x00'}, @IPSET_ATTR_REVISION={0x5}, @IPSET_ATTR_SETNAME={0x9, 0x2, 'syz1\x00'}, @IPSET_ATTR_DATA={0x20, 0x7, 0x0, 0x1, [@IPSET_ATTR_CIDR={0x5, 0x3, 0x1f}, @IPSET_ATTR_IP={0xc, 0x1, 0x0, 0x1, @IPSET_ATTR_IPADDR_IPV4={0x8, 0x1, 0x1, 0x0, @broadcast}}, @IPSET_ATTR_CADT_FLAGS={0x8, 0x8, 0x1, 0x0, 0xed}]}, @IPSET_ATTR_FAMILY={0x5, 0x5, 0x2}, @IPSET_ATTR_PROTOCOL={0x5, 0x1, 0x6}]}, 0x6c}, 0x1, 0x0, 0x0, 0x4010}, 0x0) sendmsg$IPSET_CMD_ADD(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000240)={&(0x7f0000000080)=ANY=[@ANYBLOB="400000000906010200000000000a0000000000000900020073797a31000000000500010007000000180007800c00018008000140ffffffff080009"], 0x40}, 0x1, 0x0, 0x0, 0x10000047}, 0x4000084) executing program 9: r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000000), 0x401, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) r2 = ioctl$KVM_CREATE_GUEST_MEMFD(r1, 0xc040aed4, &(0x7f00000001c0)={0x200001fe0000, 0x3}) mmap$KVM_VCPU(&(0x7f0000dfe000/0x4000)=nil, 0x930, 0x80000a, 0x8011, r2, 0x200001fe0000) program did not crash bisect: testing without sub-chunk 2/3 testing program (duration=6m11s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): [4, 4, 4, 4, 4, 4, 4, 4, 4, 4, 4, 4, 4, 4, 4, 4, 4, 4, 4, 4, 4, 4, 4, 4, 4, 4, 4, 4, 4, 4, 4, 4, 4, 4, 4, 4, 4, 4, 4, 4, 4, 4, 4, 4, 4, 4] detailed listing: executing program 32: r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$team(&(0x7f0000000100), 0xffffffffffffffff) ioctl$ifreq_SIOCGIFINDEX_team(r0, 0x8933, &(0x7f0000000040)={'team0\x00', 0x0}) sendmsg$TEAM_CMD_OPTIONS_SET(r0, &(0x7f0000000200)={0x0, 0x0, &(0x7f0000000000)={&(0x7f00000002c0)={0x58, r1, 0x1, 0x80000000, 0x25dfdc01, {}, [{{0x8, 0x1, r2}, {0x3c, 0x2, 0x0, 0x1, [{0x3a, 0x1, @notify_peers_count={{0x24}, {0x5}, {0x8, 0x4, 0x8}}}]}}]}, 0x58}, 0x1, 0x0, 0x0, 0x800}, 0x40000) executing program 33: r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000240), 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) r2 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x2) ioctl$KVM_PRE_FAULT_MEMORY(r2, 0xc040aed5, 0x0) executing program 2: r0 = syz_usb_connect(0x2, 0x36, &(0x7f0000000040)=ANY=[@ANYBLOB="12010000751c0110e60f00989ad1010203010902240001000000000904290202b48cbb0009050402100000fa000905820240"], 0x0) syz_usb_control_io$printer(r0, 0x0, 0x0) syz_usb_control_io$uac1(r0, 0x0, 0x0) syz_usb_control_io(r0, 0x0, &(0x7f0000000900)={0x84, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f0000000740)={0x40, 0x13, 0x6, @link_local}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) executing program 2: r0 = socket$can_bcm(0x1d, 0x2, 0x2) connect$can_bcm(r0, &(0x7f0000000180), 0x10) io_setup(0x9, &(0x7f0000000240)=0x0) io_submit(r1, 0x1, &(0x7f0000000100)=[&(0x7f00000000c0)={0x400000, 0x0, 0x0, 0x1, 0x0, r0, &(0x7f0000000200)="0500000093c21faf16da39de706f646800580f02000000003f420f000000000000580f02000000003f420f00000000000029ffffff000000", 0x20000238}]) executing program 2: r0 = openat$nullb(0xffffffffffffff9c, &(0x7f0000000100), 0xa8282, 0x0) r1 = dup(r0) write$6lowpan_enable(r1, &(0x7f0000000000)='1', 0x1) read$FUSE(r1, &(0x7f0000000440)={0x2020}, 0x2020) executing program 2: r0 = openat(0xffffffffffffff9c, &(0x7f0000000040)='.\x00', 0x0, 0x0) ioctl$FS_IOC_SETFLAGS(r0, 0x40086602, &(0x7f00000002c0)=0x20) mkdirat(0xffffffffffffff9c, &(0x7f0000000080)='./file0\x00', 0x0) rename(&(0x7f0000000280)='./file0\x00', &(0x7f0000000300)='./file1\x00') executing program 2: r0 = syz_init_net_socket$netrom(0x6, 0x5, 0x0) ioctl$int_in(r0, 0x5421, &(0x7f0000000080)=0x7) listen(r0, 0x1ad72f7) accept4(r0, 0x0, 0x0, 0x80000) executing program 2: r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) r2 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0) ioctl$KVM_SET_MSRS(r2, 0x4008ae89, &(0x7f00000002c0)={0x1, 0x0, [{0x1c4, 0x0, 0x81}]}) executing program 34: r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) r2 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0) ioctl$KVM_SET_MSRS(r2, 0x4008ae89, &(0x7f00000002c0)={0x1, 0x0, [{0x1c4, 0x0, 0x81}]}) executing program 6: r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000080), 0xffffffffffffffff) ioctl$sock_SIOCGIFINDEX_80211(r0, 0x8933, &(0x7f00000000c0)={'wlan1\x00', 0x0}) sendmsg$NL80211_CMD_CONNECT(r0, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000240)=ANY=[@ANYBLOB='(\x00\x00\x00', @ANYRES16=r1, @ANYBLOB="050013000104000000609600000008000300", @ANYRES32=r2, @ANYBLOB='\n\x004'], 0x28}}, 0x0) executing program 6: r0 = syz_init_net_socket$bt_sco(0x1f, 0x5, 0x2) setsockopt$sock_linger(r0, 0x1, 0xd, 0x0, 0x0) shutdown(r0, 0x0) shutdown(r0, 0x1) executing program 6: r0 = socket(0xa, 0x2400000001, 0x0) setsockopt$inet6_MCAST_JOIN_GROUP(r0, 0x29, 0x2a, &(0x7f0000034000)={0x9, {{0xa, 0x0, 0x4, @mcast2, 0x2}}}, 0xc6) setsockopt$inet6_MCAST_JOIN_GROUP(r0, 0x29, 0x2a, &(0x7f0000000040)={0x6, {{0xa, 0x0, 0x0, @mcast1}}}, 0x88) getsockopt$inet6_buf(r0, 0x29, 0x10000000000030, &(0x7f0000034000)=""/144, &(0x7f0000002280)=0x90) executing program 6: r0 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$netlbl_unlabel(&(0x7f0000000440), r0) sendmsg$NLBL_UNLABEL_C_STATICLISTDEF(r0, &(0x7f0000000500)={0x0, 0x0, &(0x7f00000004c0)={&(0x7f0000000080)={0x14, r1, 0xc8036ab6d6cbef07, 0x70bd28, 0x25dfdbfb}, 0x14}, 0x1, 0x0, 0x0, 0x1}, 0x45080) syz_genetlink_get_family_id$nfc(&(0x7f0000000240), r0) executing program 6: mknodat$loop(0xffffffffffffff9c, &(0x7f0000000040)='./file0\x00', 0x6000, 0x1) r0 = openat$fuse(0xffffffffffffff9c, &(0x7f0000000280), 0x2, 0x0) mount$fuse(0x0, &(0x7f0000000100)='./file0\x00', &(0x7f0000000140), 0x0, &(0x7f0000000540)=ANY=[@ANYBLOB='fd=', @ANYRESHEX=r0, @ANYBLOB=',rootmode=00000000000000000060000,user_id=', @ANYRESDEC=0x0, @ANYBLOB=',group_id=', @ANYRESDEC=0x0]) ioctl$FUSE_DEV_IOC_CLONE(r0, 0x8004e500, &(0x7f0000000000)=r0) executing program 6: r0 = msgget$private(0x0, 0x480) msgsnd(r0, &(0x7f0000001200)=ANY=[@ANYBLOB="01000000"], 0x401, 0x0) msgsnd(r0, &(0x7f0000000dc0)=ANY=[@ANYRES16], 0x401, 0x0) msgctl$IPC_RMID(r0, 0x0) executing program 5: r0 = syz_init_net_socket$bt_l2cap(0x1f, 0x1, 0x0) bind$bt_l2cap(r0, &(0x7f00000002c0)={0x1f, 0x0, @any, 0xfffa}, 0xe) connect$bt_l2cap(r0, &(0x7f0000000080)={0x1f, 0x0, @fixed={'\xaa\xaa\xaa\xaa\xaa', 0x10}, 0x7ff}, 0xe) sendmsg$inet(r0, &(0x7f00000023c0)={0x0, 0x0, &(0x7f0000002380)=[{&(0x7f0000001380)="8627878d6b8212d45c2dd9ccf83ce81dd30b8eec06fa665f95ae3ab8f9611f1810bdbd00b643780d07ac9dd292e631c72bf910161bf0731207cd60493e185ec9cb1de90d8bbdf54818dd722f5e78bc6b387221e6e7c46b2e37608179df7ad28279fbd622a61ddd81938d2fe4f26f2edcc7683f3925bd7a90a133b9871addb4f7cda5c4702d7a24be0756d20d25943ad911b8141c4039dc30dbcb0aefbf3f92beea6de191a25cf69f9a9ec393782723e72203f4b7c5dca02111d28ebb4e90b6787a84ba6fb79c4924c7e96734d33effee545c71f36446d00a2228bacc54355c44049ecad2c0b6028abbf23f9891ede6ca5c9e08f5d435e72d97b7eb03e27f94a34e642510cc0c983d894818e4694daeb2f46d3bc44a74c877302d317e4c80252a2954dca4bc0036592d66a9ceedecf531c23dfec82b372bcf8ca0631ea9e42313fdad73d4ca232221736541ba958c1bd4a97c415ca47b5c82b373c6851f95c54b833b5d23c176579d8288adfac40c1d43e38963ecf0456a35d1a45aa0a4847c68acf8865af0a054d2c5efce89c866ad390f6fb39ff1a5b4918054e28b114243b042265aaacf782913ef82880fe19e130372be48a5510ac7fb0388fef51b1bd65d35a5f28c2d4f3df40c902a9b004a5bfee3f3043d1ea337b6f795cf5b4047fa0454d3249da8d43e040ad435f67c1fe47275135b57ba777762b80255298b9dd84334704cc4d79bfb40f7e270d13597ebe3f8cd701cdeb0675246263a4e84daefecc4fbe31ca3fe32ab680c13f0d81ed6768f8f15f238b49ea8b3245dfdbea550183e611b68fb660e14c0441f2fd252370efd71ac563c7bf6475f7fb33f588c92a2fc3109acdfb64fb8b08c40bec207b398561128641d27d6ed4cbd40a75be4252d01a18a192f695271e26e76ed87d64ca862bc0ea14a63b25b9f25380da2272f7957", 0x2a1}], 0x1}, 0x0) executing program 5: setsockopt$SO_TIMESTAMPING(0xffffffffffffffff, 0x1, 0x25, &(0x7f0000000000)=0x3c33f, 0x4) r0 = syz_open_dev$dmmidi(&(0x7f0000000300), 0x2, 0x0) ioctl$SNDRV_RAWMIDI_IOCTL_PVERSION(r0, 0x40045702, &(0x7f0000000000)) ioctl$SNDRV_RAWMIDI_IOCTL_PARAMS(r0, 0xc0305710, &(0x7f0000000040)={0x1, 0x3, 0x3f6, 0x1, 0x21}) executing program 5: r0 = userfaultfd(0x80001) munmap(&(0x7f0000800000/0x800000)=nil, 0x800000) ioctl$UFFDIO_API(r0, 0xc018aa3f, &(0x7f0000000040)={0xaa, 0x110}) ioctl$UFFDIO_MOVE(r0, 0xc028aa05, &(0x7f0000000000)={&(0x7f0000724000/0x2000)=nil, &(0x7f0000ffb000/0x2000)=nil, 0x2000, 0x3}) executing program 5: mkdirat(0xffffffffffffff9c, &(0x7f0000000040)='./file0\x00', 0x1c0) mount$bind(&(0x7f0000000000)='.\x00', &(0x7f0000000200)='./file0/../file0\x00', 0x0, 0x101091, 0x0) mount$bind(&(0x7f0000000080)='./file0/../file0\x00', &(0x7f00000000c0)='./file0/file0\x00', 0x0, 0x8b101a, 0x0) umount2(&(0x7f0000000380)='./file0\x00', 0x0) executing program 5: r0 = socket$nl_xfrm(0x10, 0x3, 0x6) getsockopt$inet_IP_XFRM_POLICY(0xffffffffffffffff, 0x0, 0x11, 0x0, 0x0) r1 = openat$vcsa(0xffffffffffffff9c, &(0x7f0000000840), 0x1, 0x0) epoll_ctl$EPOLL_CTL_DEL(r1, 0x2, r0) executing program 5: socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) bind$unix(r0, &(0x7f0000000100)=@file={0x1, '\xe9\x1fq\x89Y\x1e\x923aK\x00'}, 0x6e) r1 = socket$unix(0x1, 0x2, 0x0) connect$unix(r1, &(0x7f0000000180)=@file={0x1, '\xe9\x1fq\x89Y\x1e\x923aK\x00'}, 0x6e) executing program 35: socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) bind$unix(r0, &(0x7f0000000100)=@file={0x1, '\xe9\x1fq\x89Y\x1e\x923aK\x00'}, 0x6e) r1 = socket$unix(0x1, 0x2, 0x0) connect$unix(r1, &(0x7f0000000180)=@file={0x1, '\xe9\x1fq\x89Y\x1e\x923aK\x00'}, 0x6e) executing program 36: r0 = msgget$private(0x0, 0x480) msgsnd(r0, &(0x7f0000001200)=ANY=[@ANYBLOB="01000000"], 0x401, 0x0) msgsnd(r0, &(0x7f0000000dc0)=ANY=[@ANYRES16], 0x401, 0x0) msgctl$IPC_RMID(r0, 0x0) executing program 4: sendmsg$ETHTOOL_MSG_STRSET_GET(0xffffffffffffffff, &(0x7f0000000a80)={0x0, 0x0, &(0x7f0000000a40)={&(0x7f00000002c0)={0x18, 0x0, 0x1, 0x70bd2d, 0x25dfdbff, {}, [@ETHTOOL_A_STRSET_HEADER={0x4}]}, 0x18}, 0x1, 0x0, 0x0, 0x880}, 0x4000004) r0 = socket(0x10, 0x3, 0x0) setsockopt$netlink_NETLINK_TX_RING(r0, 0x10e, 0xc, &(0x7f0000000280)={0x40bb, 0x2}, 0x10) sendmsg$netlink(r0, &(0x7f0000000040)={0x0, 0x0, &(0x7f00000001c0)=[{&(0x7f00000002c0)=ANY=[@ANYBLOB="780000001a0001002abd7000000000000a"], 0x78}], 0x1, 0x0, 0x0, 0x20400}, 0x0) executing program 8: setsockopt$SO_TIMESTAMPING(0xffffffffffffffff, 0x1, 0x25, &(0x7f0000000000)=0x3c33f, 0x4) r0 = syz_open_dev$dmmidi(&(0x7f0000000300), 0x2, 0x0) ioctl$SNDRV_RAWMIDI_IOCTL_PVERSION(r0, 0x40045702, &(0x7f0000000000)) ioctl$SNDRV_RAWMIDI_IOCTL_PARAMS(r0, 0xc0305710, &(0x7f0000000040)={0x1, 0x3, 0x3f6, 0x1, 0x21}) executing program 8: r0 = socket$nl_generic(0x10, 0x3, 0x10) mkdirat(0xffffffffffffff9c, &(0x7f0000000100)='./file0\x00', 0x181) getsockopt$sock_cred(r0, 0x1, 0x11, &(0x7f00000003c0)={0x0, 0x0}, &(0x7f0000000480)=0xc) mount$bpf(0x0, &(0x7f0000000340)='./file0\x00', &(0x7f0000000380), 0x2000000, &(0x7f0000000500)={[{@uid={'uid', 0x3d, r1}}]}) executing program 40: r0 = socket$nl_generic(0x10, 0x3, 0x10) mkdirat(0xffffffffffffff9c, &(0x7f0000000100)='./file0\x00', 0x181) getsockopt$sock_cred(r0, 0x1, 0x11, &(0x7f00000003c0)={0x0, 0x0}, &(0x7f0000000480)=0xc) mount$bpf(0x0, &(0x7f0000000340)='./file0\x00', &(0x7f0000000380), 0x2000000, &(0x7f0000000500)={[{@uid={'uid', 0x3d, r1}}]}) executing program 1: r0 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000001c0)='memory.events\x00', 0x275a, 0x0) mmap(&(0x7f0000000000/0x3000)=nil, 0x3000, 0x2000001, 0x12, r0, 0x0) r1 = socket$xdp(0x2c, 0x3, 0x0) setsockopt$XDP_UMEM_COMPLETION_RING(r1, 0x11b, 0x6, &(0x7f0000000000)=0x1104c0, 0x4) executing program 1: r0 = socket$packet(0x11, 0x3, 0x300) setsockopt$packet_int(r0, 0x107, 0xf, &(0x7f0000000100)=0x9, 0x4) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f00000000c0)={'erspan0\x00', 0x0}) sendto$packet(r0, &(0x7f0000000180)="0b032200eb1025120212475400f6a13bb1000000080089064803", 0x10300, 0x0, &(0x7f0000000140)={0x11, 0x0, r1}, 0x14) executing program 1: r0 = userfaultfd(0x80801) ioctl$UFFDIO_API(0xffffffffffffffff, 0xc018aa3f, &(0x7f0000000080)={0xaa, 0x260}) mprotect(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x1) ioctl$UFFDIO_API(r0, 0xc018aa3f, &(0x7f0000000080)={0xaa, 0x54}) executing program 1: mkdirat(0xffffffffffffff9c, &(0x7f0000000040)='./file0\x00', 0x1c0) mount$bind(&(0x7f0000000000)='.\x00', &(0x7f0000000200)='./file0/../file0\x00', 0x0, 0x101091, 0x0) mount$bind(&(0x7f0000000080)='./file0/../file0\x00', &(0x7f00000000c0)='./file0/file0\x00', 0x0, 0x8b101a, 0x0) umount2(&(0x7f0000000380)='./file0\x00', 0x0) executing program 1: r0 = socket$inet6_sctp(0xa, 0x1, 0x84) setsockopt$inet_sctp6_SCTP_STREAM_SCHEDULER(r0, 0x84, 0x7b, &(0x7f0000000000)={0x0, 0x1}, 0x8) sendmmsg$inet(r0, &(0x7f0000001980)=[{{&(0x7f0000000040)={0x2, 0x4e23, @rand_addr=0x64010102}, 0x10, &(0x7f00000003c0)=[{&(0x7f0000001500)='8', 0x1}], 0x1}}, {{&(0x7f00000000c0)={0x2, 0x4e24, @private=0xa010100}, 0x10, &(0x7f0000001880)=[{&(0x7f0000001540)="e9", 0x1}], 0x1}}], 0x2, 0x44042) setsockopt$inet_sctp6_SCTP_STREAM_SCHEDULER_VALUE(r0, 0x84, 0x7c, &(0x7f0000000100)={0x0, 0x6}, 0x8) executing program 1: r0 = socket(0xa, 0x5, 0x0) setsockopt$inet_sctp_SCTP_SOCKOPT_BINDX_ADD(r0, 0x84, 0x64, &(0x7f0000000080)=[@in6={0xa, 0x4e24, 0xf1, @loopback, 0x19f49a9}], 0x1c) sendmsg$inet_sctp(r0, &(0x7f00000000c0)={&(0x7f0000000000)=@in6={0xa, 0x4e24, 0xff, @loopback, 0x5}, 0x1c, &(0x7f0000000040)=[{&(0x7f0000000100)="e6", 0xfffd}], 0x1, &(0x7f00000002c0)=ANY=[@ANYBLOB="18000000000000008400000007000000ac1414aa0000000020000000000000008400000008000000200100"/56], 0x38, 0x4855}, 0x24000052) recvmmsg$unix(r0, &(0x7f0000001480)=[{{0x0, 0x0, &(0x7f00000001c0)=[{&(0x7f0000000300)=""/4105, 0x1009}], 0x1}}], 0x1, 0x40010040, 0x0) executing program 41: r0 = socket(0xa, 0x5, 0x0) setsockopt$inet_sctp_SCTP_SOCKOPT_BINDX_ADD(r0, 0x84, 0x64, &(0x7f0000000080)=[@in6={0xa, 0x4e24, 0xf1, @loopback, 0x19f49a9}], 0x1c) sendmsg$inet_sctp(r0, &(0x7f00000000c0)={&(0x7f0000000000)=@in6={0xa, 0x4e24, 0xff, @loopback, 0x5}, 0x1c, &(0x7f0000000040)=[{&(0x7f0000000100)="e6", 0xfffd}], 0x1, &(0x7f00000002c0)=ANY=[@ANYBLOB="18000000000000008400000007000000ac1414aa0000000020000000000000008400000008000000200100"/56], 0x38, 0x4855}, 0x24000052) recvmmsg$unix(r0, &(0x7f0000001480)=[{{0x0, 0x0, &(0x7f00000001c0)=[{&(0x7f0000000300)=""/4105, 0x1009}], 0x1}}], 0x1, 0x40010040, 0x0) executing program 9: r0 = syz_usb_connect(0x2, 0x24, &(0x7f0000000540)={{0x12, 0x1, 0x0, 0xa0, 0x14, 0xf, 0x20, 0x2304, 0x22e, 0x80f8, 0x1, 0x2, 0x3, 0x1, [{{0x9, 0x2, 0x12, 0x1, 0xfd, 0x4, 0x0, 0x7, "", [{{0x9, 0x4, 0xb7, 0x5, 0x0, 0xad, 0xdd, 0xc9, 0x7}}]}}]}}, 0x0) syz_usb_control_io$hid(r0, &(0x7f0000001940)={0x24, 0x0, &(0x7f0000001800)={0x0, 0x3, 0x2, @string={0x2}}, 0x0, 0x0}, 0x0) syz_usb_control_io$uac2(r0, &(0x7f00000020c0)={0x14, 0x0, &(0x7f0000002000)={0x0, 0x3, 0x2, @string={0x2}}}, 0x0) syz_usb_control_io$cdc_ecm(r0, 0x0, &(0x7f00000001c0)={0x1c, &(0x7f00000000c0)={0x40, 0x31, 0x2, "f7bc"}, 0x0, 0x0}) executing program 0: r0 = socket$kcm(0x10, 0x100000000002, 0x4) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) sendmmsg$unix(r1, &(0x7f0000000000), 0x651, 0x0) sendmsg$kcm(r0, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000300)=[{&(0x7f0000000200)="39000000140081ae00002c000500015601618575e285af0180000000171300883795c04a31ba377a1b2cc32b38d3740000ffffffffffffffff", 0x39}], 0x1, 0x0, 0x0, 0xc00e}, 0x0) executing program 0: lstat(&(0x7f0000000000)='\xe9\x1fq\x89Y\x1e\x923aK\x00', &(0x7f0000000180)) mprotect(&(0x7f0000000000/0xf000)=nil, 0xf000, 0x1) r0 = syz_open_dev$tty1(0xc, 0x4, 0x1) ioctl$VT_RESIZE(r0, 0x5609, &(0x7f0000000000)={0x8d, 0x7fff, 0x101}) executing program 0: r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000140), r0) ioctl$sock_SIOCGIFINDEX_80211(r0, 0x8933, &(0x7f00000001c0)={'wlan0\x00', 0x0}) sendmsg$NL80211_CMD_DEL_KEY(r0, &(0x7f0000000300)={0x0, 0x0, &(0x7f00000002c0)={&(0x7f0000000080)=ANY=[@ANYBLOB='4\x00\x00\x00', @ANYRES16=r1, @ANYBLOB="010028bd7000fddbdf250c00000008000300", @ANYRES32=r2, @ANYBLOB="0c0050800800070003"], 0x34}, 0x1, 0x0, 0x0, 0x8000}, 0x20005004) executing program 9: syz_init_net_socket$bt_sco(0x1f, 0x5, 0x2) r0 = syz_init_net_socket$bt_sco(0x1f, 0x5, 0x2) bind$bt_sco(r0, &(0x7f0000000000)={0x1f, @none}, 0x8) listen(r0, 0xffffff74) executing program 9: r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000000), 0x2900, 0x0) ioctl$TIOCSETD(r0, 0x5423, &(0x7f00000000c0)=0xf) ioctl$TCFLSH(r0, 0x400455c8, 0x2) ioctl$TIOCSETD(r0, 0x5412, &(0x7f0000000140)) executing program 0: quotactl_fd$Q_QUOTAON(0xffffffffffffffff, 0xffffffff80000201, 0x0, &(0x7f0000000080)='./cgroup\x00') mprotect(&(0x7f0000000000/0x4000)=nil, 0x4000, 0x1) r0 = socket$inet6_sctp(0xa, 0x5, 0x84) getsockopt$inet_sctp6_SCTP_PEER_ADDR_THLDS(r0, 0x84, 0x1f, &(0x7f0000000240)={0x0, @in6={{0xa, 0x4e21, 0x47, @ipv4={'\x00', '\xff\xff', @multicast2}, 0x400}}, 0x5, 0x40}, &(0x7f0000000080)=0x90) executing program 9: r0 = socket$alg(0x26, 0x5, 0x0) bind$alg(r0, &(0x7f0000000400)={0x26, 'hash\x00', 0x0, 0x0, 'sha384\x00'}, 0x58) accept$alg(r0, 0x0, 0x0) setsockopt$ALG_SET_KEY(r0, 0x117, 0x1, 0x0, 0x0) executing program 0: mkdirat(0xffffffffffffff9c, &(0x7f0000000200)='./file0\x00', 0x0) mount(0x0, &(0x7f00000001c0)='./file0\x00', &(0x7f0000000300)='debugfs\x00', 0x0, 0x0) mount$overlay(0x0, &(0x7f0000000140)='./file0\x00', &(0x7f0000000180), 0x0, &(0x7f0000000040)={[{@lowerdir={'lowerdir', 0x3d, './file0'}, 0x3a}], [], 0x2f}) openat2$dir(0xffffffffffffff9c, &(0x7f0000000080)='./file0\x00', &(0x7f00000000c0)={0x0, 0x0, 0xc}, 0x18) executing program 9: r0 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) setsockopt$sock_int(r0, 0x1, 0x29, &(0x7f0000000480)=0x7f, 0x4) bind$bt_hci(r0, &(0x7f0000000040)={0x1f, 0xffffffffffffffff, 0x2}, 0x6) recvmmsg(r0, &(0x7f0000002cc0)=[{{0x0, 0x0, 0x0}, 0x71d8e07a}], 0x1, 0x12020, 0x0) executing program 0: r0 = socket$nl_netfilter(0x10, 0x3, 0xc) r1 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPSET_CMD_CREATE(r1, &(0x7f0000000000)={0x0, 0x0, &(0x7f00000004c0)={&(0x7f00000001c0)={0x6c, 0x2, 0x6, 0x5, 0x0, 0x0, {0x0, 0x0, 0xfffc}, [@IPSET_ATTR_TYPENAME={0x12, 0x3, 'bitmap:ip,mac\x00'}, @IPSET_ATTR_REVISION={0x5}, @IPSET_ATTR_SETNAME={0x9, 0x2, 'syz1\x00'}, @IPSET_ATTR_DATA={0x20, 0x7, 0x0, 0x1, [@IPSET_ATTR_CIDR={0x5, 0x3, 0x1f}, @IPSET_ATTR_IP={0xc, 0x1, 0x0, 0x1, @IPSET_ATTR_IPADDR_IPV4={0x8, 0x1, 0x1, 0x0, @broadcast}}, @IPSET_ATTR_CADT_FLAGS={0x8, 0x8, 0x1, 0x0, 0xed}]}, @IPSET_ATTR_FAMILY={0x5, 0x5, 0x2}, @IPSET_ATTR_PROTOCOL={0x5, 0x1, 0x6}]}, 0x6c}, 0x1, 0x0, 0x0, 0x4010}, 0x0) sendmsg$IPSET_CMD_ADD(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000240)={&(0x7f0000000080)=ANY=[@ANYBLOB="400000000906010200000000000a0000000000000900020073797a31000000000500010007000000180007800c00018008000140ffffffff080009"], 0x40}, 0x1, 0x0, 0x0, 0x10000047}, 0x4000084) executing program 9: r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000000), 0x401, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) r2 = ioctl$KVM_CREATE_GUEST_MEMFD(r1, 0xc040aed4, &(0x7f00000001c0)={0x200001fe0000, 0x3}) mmap$KVM_VCPU(&(0x7f0000dfe000/0x4000)=nil, 0x930, 0x80000a, 0x8011, r2, 0x200001fe0000) program crashed: INFO: task hung in fuse_conn_destroy bisect: the chunk can be dropped bisect: testing without sub-chunk 3/3 testing program (duration=6m6s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): [4, 4, 4, 4, 4, 4, 4, 4, 4, 4, 4, 4, 4, 4, 4, 4, 4, 4, 4, 4, 4, 4, 4, 4] detailed listing: executing program 32: r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$team(&(0x7f0000000100), 0xffffffffffffffff) ioctl$ifreq_SIOCGIFINDEX_team(r0, 0x8933, &(0x7f0000000040)={'team0\x00', 0x0}) sendmsg$TEAM_CMD_OPTIONS_SET(r0, &(0x7f0000000200)={0x0, 0x0, &(0x7f0000000000)={&(0x7f00000002c0)={0x58, r1, 0x1, 0x80000000, 0x25dfdc01, {}, [{{0x8, 0x1, r2}, {0x3c, 0x2, 0x0, 0x1, [{0x3a, 0x1, @notify_peers_count={{0x24}, {0x5}, {0x8, 0x4, 0x8}}}]}}]}, 0x58}, 0x1, 0x0, 0x0, 0x800}, 0x40000) executing program 33: r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000240), 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) r2 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x2) ioctl$KVM_PRE_FAULT_MEMORY(r2, 0xc040aed5, 0x0) executing program 2: r0 = syz_usb_connect(0x2, 0x36, &(0x7f0000000040)=ANY=[@ANYBLOB="12010000751c0110e60f00989ad1010203010902240001000000000904290202b48cbb0009050402100000fa000905820240"], 0x0) syz_usb_control_io$printer(r0, 0x0, 0x0) syz_usb_control_io$uac1(r0, 0x0, 0x0) syz_usb_control_io(r0, 0x0, &(0x7f0000000900)={0x84, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f0000000740)={0x40, 0x13, 0x6, @link_local}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) executing program 2: r0 = socket$can_bcm(0x1d, 0x2, 0x2) connect$can_bcm(r0, &(0x7f0000000180), 0x10) io_setup(0x9, &(0x7f0000000240)=0x0) io_submit(r1, 0x1, &(0x7f0000000100)=[&(0x7f00000000c0)={0x400000, 0x0, 0x0, 0x1, 0x0, r0, &(0x7f0000000200)="0500000093c21faf16da39de706f646800580f02000000003f420f000000000000580f02000000003f420f00000000000029ffffff000000", 0x20000238}]) executing program 2: r0 = openat$nullb(0xffffffffffffff9c, &(0x7f0000000100), 0xa8282, 0x0) r1 = dup(r0) write$6lowpan_enable(r1, &(0x7f0000000000)='1', 0x1) read$FUSE(r1, &(0x7f0000000440)={0x2020}, 0x2020) executing program 2: r0 = openat(0xffffffffffffff9c, &(0x7f0000000040)='.\x00', 0x0, 0x0) ioctl$FS_IOC_SETFLAGS(r0, 0x40086602, &(0x7f00000002c0)=0x20) mkdirat(0xffffffffffffff9c, &(0x7f0000000080)='./file0\x00', 0x0) rename(&(0x7f0000000280)='./file0\x00', &(0x7f0000000300)='./file1\x00') executing program 2: r0 = syz_init_net_socket$netrom(0x6, 0x5, 0x0) ioctl$int_in(r0, 0x5421, &(0x7f0000000080)=0x7) listen(r0, 0x1ad72f7) accept4(r0, 0x0, 0x0, 0x80000) executing program 2: r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) r2 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0) ioctl$KVM_SET_MSRS(r2, 0x4008ae89, &(0x7f00000002c0)={0x1, 0x0, [{0x1c4, 0x0, 0x81}]}) executing program 34: r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) r2 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0) ioctl$KVM_SET_MSRS(r2, 0x4008ae89, &(0x7f00000002c0)={0x1, 0x0, [{0x1c4, 0x0, 0x81}]}) executing program 6: r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000080), 0xffffffffffffffff) ioctl$sock_SIOCGIFINDEX_80211(r0, 0x8933, &(0x7f00000000c0)={'wlan1\x00', 0x0}) sendmsg$NL80211_CMD_CONNECT(r0, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000240)=ANY=[@ANYBLOB='(\x00\x00\x00', @ANYRES16=r1, @ANYBLOB="050013000104000000609600000008000300", @ANYRES32=r2, @ANYBLOB='\n\x004'], 0x28}}, 0x0) executing program 6: r0 = syz_init_net_socket$bt_sco(0x1f, 0x5, 0x2) setsockopt$sock_linger(r0, 0x1, 0xd, 0x0, 0x0) shutdown(r0, 0x0) shutdown(r0, 0x1) executing program 6: r0 = socket(0xa, 0x2400000001, 0x0) setsockopt$inet6_MCAST_JOIN_GROUP(r0, 0x29, 0x2a, &(0x7f0000034000)={0x9, {{0xa, 0x0, 0x4, @mcast2, 0x2}}}, 0xc6) setsockopt$inet6_MCAST_JOIN_GROUP(r0, 0x29, 0x2a, &(0x7f0000000040)={0x6, {{0xa, 0x0, 0x0, @mcast1}}}, 0x88) getsockopt$inet6_buf(r0, 0x29, 0x10000000000030, &(0x7f0000034000)=""/144, &(0x7f0000002280)=0x90) executing program 6: r0 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$netlbl_unlabel(&(0x7f0000000440), r0) sendmsg$NLBL_UNLABEL_C_STATICLISTDEF(r0, &(0x7f0000000500)={0x0, 0x0, &(0x7f00000004c0)={&(0x7f0000000080)={0x14, r1, 0xc8036ab6d6cbef07, 0x70bd28, 0x25dfdbfb}, 0x14}, 0x1, 0x0, 0x0, 0x1}, 0x45080) syz_genetlink_get_family_id$nfc(&(0x7f0000000240), r0) executing program 6: mknodat$loop(0xffffffffffffff9c, &(0x7f0000000040)='./file0\x00', 0x6000, 0x1) r0 = openat$fuse(0xffffffffffffff9c, &(0x7f0000000280), 0x2, 0x0) mount$fuse(0x0, &(0x7f0000000100)='./file0\x00', &(0x7f0000000140), 0x0, &(0x7f0000000540)=ANY=[@ANYBLOB='fd=', @ANYRESHEX=r0, @ANYBLOB=',rootmode=00000000000000000060000,user_id=', @ANYRESDEC=0x0, @ANYBLOB=',group_id=', @ANYRESDEC=0x0]) ioctl$FUSE_DEV_IOC_CLONE(r0, 0x8004e500, &(0x7f0000000000)=r0) executing program 6: r0 = msgget$private(0x0, 0x480) msgsnd(r0, &(0x7f0000001200)=ANY=[@ANYBLOB="01000000"], 0x401, 0x0) msgsnd(r0, &(0x7f0000000dc0)=ANY=[@ANYRES16], 0x401, 0x0) msgctl$IPC_RMID(r0, 0x0) executing program 5: r0 = syz_init_net_socket$bt_l2cap(0x1f, 0x1, 0x0) bind$bt_l2cap(r0, &(0x7f00000002c0)={0x1f, 0x0, @any, 0xfffa}, 0xe) connect$bt_l2cap(r0, &(0x7f0000000080)={0x1f, 0x0, @fixed={'\xaa\xaa\xaa\xaa\xaa', 0x10}, 0x7ff}, 0xe) sendmsg$inet(r0, &(0x7f00000023c0)={0x0, 0x0, &(0x7f0000002380)=[{&(0x7f0000001380)="8627878d6b8212d45c2dd9ccf83ce81dd30b8eec06fa665f95ae3ab8f9611f1810bdbd00b643780d07ac9dd292e631c72bf910161bf0731207cd60493e185ec9cb1de90d8bbdf54818dd722f5e78bc6b387221e6e7c46b2e37608179df7ad28279fbd622a61ddd81938d2fe4f26f2edcc7683f3925bd7a90a133b9871addb4f7cda5c4702d7a24be0756d20d25943ad911b8141c4039dc30dbcb0aefbf3f92beea6de191a25cf69f9a9ec393782723e72203f4b7c5dca02111d28ebb4e90b6787a84ba6fb79c4924c7e96734d33effee545c71f36446d00a2228bacc54355c44049ecad2c0b6028abbf23f9891ede6ca5c9e08f5d435e72d97b7eb03e27f94a34e642510cc0c983d894818e4694daeb2f46d3bc44a74c877302d317e4c80252a2954dca4bc0036592d66a9ceedecf531c23dfec82b372bcf8ca0631ea9e42313fdad73d4ca232221736541ba958c1bd4a97c415ca47b5c82b373c6851f95c54b833b5d23c176579d8288adfac40c1d43e38963ecf0456a35d1a45aa0a4847c68acf8865af0a054d2c5efce89c866ad390f6fb39ff1a5b4918054e28b114243b042265aaacf782913ef82880fe19e130372be48a5510ac7fb0388fef51b1bd65d35a5f28c2d4f3df40c902a9b004a5bfee3f3043d1ea337b6f795cf5b4047fa0454d3249da8d43e040ad435f67c1fe47275135b57ba777762b80255298b9dd84334704cc4d79bfb40f7e270d13597ebe3f8cd701cdeb0675246263a4e84daefecc4fbe31ca3fe32ab680c13f0d81ed6768f8f15f238b49ea8b3245dfdbea550183e611b68fb660e14c0441f2fd252370efd71ac563c7bf6475f7fb33f588c92a2fc3109acdfb64fb8b08c40bec207b398561128641d27d6ed4cbd40a75be4252d01a18a192f695271e26e76ed87d64ca862bc0ea14a63b25b9f25380da2272f7957", 0x2a1}], 0x1}, 0x0) executing program 5: setsockopt$SO_TIMESTAMPING(0xffffffffffffffff, 0x1, 0x25, &(0x7f0000000000)=0x3c33f, 0x4) r0 = syz_open_dev$dmmidi(&(0x7f0000000300), 0x2, 0x0) ioctl$SNDRV_RAWMIDI_IOCTL_PVERSION(r0, 0x40045702, &(0x7f0000000000)) ioctl$SNDRV_RAWMIDI_IOCTL_PARAMS(r0, 0xc0305710, &(0x7f0000000040)={0x1, 0x3, 0x3f6, 0x1, 0x21}) executing program 5: r0 = userfaultfd(0x80001) munmap(&(0x7f0000800000/0x800000)=nil, 0x800000) ioctl$UFFDIO_API(r0, 0xc018aa3f, &(0x7f0000000040)={0xaa, 0x110}) ioctl$UFFDIO_MOVE(r0, 0xc028aa05, &(0x7f0000000000)={&(0x7f0000724000/0x2000)=nil, &(0x7f0000ffb000/0x2000)=nil, 0x2000, 0x3}) executing program 5: mkdirat(0xffffffffffffff9c, &(0x7f0000000040)='./file0\x00', 0x1c0) mount$bind(&(0x7f0000000000)='.\x00', &(0x7f0000000200)='./file0/../file0\x00', 0x0, 0x101091, 0x0) mount$bind(&(0x7f0000000080)='./file0/../file0\x00', &(0x7f00000000c0)='./file0/file0\x00', 0x0, 0x8b101a, 0x0) umount2(&(0x7f0000000380)='./file0\x00', 0x0) executing program 5: r0 = socket$nl_xfrm(0x10, 0x3, 0x6) getsockopt$inet_IP_XFRM_POLICY(0xffffffffffffffff, 0x0, 0x11, 0x0, 0x0) r1 = openat$vcsa(0xffffffffffffff9c, &(0x7f0000000840), 0x1, 0x0) epoll_ctl$EPOLL_CTL_DEL(r1, 0x2, r0) executing program 5: socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) bind$unix(r0, &(0x7f0000000100)=@file={0x1, '\xe9\x1fq\x89Y\x1e\x923aK\x00'}, 0x6e) r1 = socket$unix(0x1, 0x2, 0x0) connect$unix(r1, &(0x7f0000000180)=@file={0x1, '\xe9\x1fq\x89Y\x1e\x923aK\x00'}, 0x6e) executing program 35: socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) bind$unix(r0, &(0x7f0000000100)=@file={0x1, '\xe9\x1fq\x89Y\x1e\x923aK\x00'}, 0x6e) r1 = socket$unix(0x1, 0x2, 0x0) connect$unix(r1, &(0x7f0000000180)=@file={0x1, '\xe9\x1fq\x89Y\x1e\x923aK\x00'}, 0x6e) executing program 36: r0 = msgget$private(0x0, 0x480) msgsnd(r0, &(0x7f0000001200)=ANY=[@ANYBLOB="01000000"], 0x401, 0x0) msgsnd(r0, &(0x7f0000000dc0)=ANY=[@ANYRES16], 0x401, 0x0) msgctl$IPC_RMID(r0, 0x0) executing program 4: sendmsg$ETHTOOL_MSG_STRSET_GET(0xffffffffffffffff, &(0x7f0000000a80)={0x0, 0x0, &(0x7f0000000a40)={&(0x7f00000002c0)={0x18, 0x0, 0x1, 0x70bd2d, 0x25dfdbff, {}, [@ETHTOOL_A_STRSET_HEADER={0x4}]}, 0x18}, 0x1, 0x0, 0x0, 0x880}, 0x4000004) r0 = socket(0x10, 0x3, 0x0) setsockopt$netlink_NETLINK_TX_RING(r0, 0x10e, 0xc, &(0x7f0000000280)={0x40bb, 0x2}, 0x10) sendmsg$netlink(r0, &(0x7f0000000040)={0x0, 0x0, &(0x7f00000001c0)=[{&(0x7f00000002c0)=ANY=[@ANYBLOB="780000001a0001002abd7000000000000a"], 0x78}], 0x1, 0x0, 0x0, 0x20400}, 0x0) program crashed: INFO: task hung in fuse_conn_destroy bisect: the chunk can be dropped bisect: split chunks (needed=true): <24> bisect: split chunk #0 of len 24 into 2 parts bisect: testing without sub-chunk 1/2 testing program (duration=6m3s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): [4, 4, 4, 4, 4, 4, 4, 4, 4, 4, 4, 4] detailed listing: executing program 6: r0 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$netlbl_unlabel(&(0x7f0000000440), r0) sendmsg$NLBL_UNLABEL_C_STATICLISTDEF(r0, &(0x7f0000000500)={0x0, 0x0, &(0x7f00000004c0)={&(0x7f0000000080)={0x14, r1, 0xc8036ab6d6cbef07, 0x70bd28, 0x25dfdbfb}, 0x14}, 0x1, 0x0, 0x0, 0x1}, 0x45080) syz_genetlink_get_family_id$nfc(&(0x7f0000000240), r0) executing program 6: mknodat$loop(0xffffffffffffff9c, &(0x7f0000000040)='./file0\x00', 0x6000, 0x1) r0 = openat$fuse(0xffffffffffffff9c, &(0x7f0000000280), 0x2, 0x0) mount$fuse(0x0, &(0x7f0000000100)='./file0\x00', &(0x7f0000000140), 0x0, &(0x7f0000000540)=ANY=[@ANYBLOB='fd=', @ANYRESHEX=r0, @ANYBLOB=',rootmode=00000000000000000060000,user_id=', @ANYRESDEC=0x0, @ANYBLOB=',group_id=', @ANYRESDEC=0x0]) ioctl$FUSE_DEV_IOC_CLONE(r0, 0x8004e500, &(0x7f0000000000)=r0) executing program 6: r0 = msgget$private(0x0, 0x480) msgsnd(r0, &(0x7f0000001200)=ANY=[@ANYBLOB="01000000"], 0x401, 0x0) msgsnd(r0, &(0x7f0000000dc0)=ANY=[@ANYRES16], 0x401, 0x0) msgctl$IPC_RMID(r0, 0x0) executing program 5: r0 = syz_init_net_socket$bt_l2cap(0x1f, 0x1, 0x0) bind$bt_l2cap(r0, &(0x7f00000002c0)={0x1f, 0x0, @any, 0xfffa}, 0xe) connect$bt_l2cap(r0, &(0x7f0000000080)={0x1f, 0x0, @fixed={'\xaa\xaa\xaa\xaa\xaa', 0x10}, 0x7ff}, 0xe) sendmsg$inet(r0, &(0x7f00000023c0)={0x0, 0x0, &(0x7f0000002380)=[{&(0x7f0000001380)="8627878d6b8212d45c2dd9ccf83ce81dd30b8eec06fa665f95ae3ab8f9611f1810bdbd00b643780d07ac9dd292e631c72bf910161bf0731207cd60493e185ec9cb1de90d8bbdf54818dd722f5e78bc6b387221e6e7c46b2e37608179df7ad28279fbd622a61ddd81938d2fe4f26f2edcc7683f3925bd7a90a133b9871addb4f7cda5c4702d7a24be0756d20d25943ad911b8141c4039dc30dbcb0aefbf3f92beea6de191a25cf69f9a9ec393782723e72203f4b7c5dca02111d28ebb4e90b6787a84ba6fb79c4924c7e96734d33effee545c71f36446d00a2228bacc54355c44049ecad2c0b6028abbf23f9891ede6ca5c9e08f5d435e72d97b7eb03e27f94a34e642510cc0c983d894818e4694daeb2f46d3bc44a74c877302d317e4c80252a2954dca4bc0036592d66a9ceedecf531c23dfec82b372bcf8ca0631ea9e42313fdad73d4ca232221736541ba958c1bd4a97c415ca47b5c82b373c6851f95c54b833b5d23c176579d8288adfac40c1d43e38963ecf0456a35d1a45aa0a4847c68acf8865af0a054d2c5efce89c866ad390f6fb39ff1a5b4918054e28b114243b042265aaacf782913ef82880fe19e130372be48a5510ac7fb0388fef51b1bd65d35a5f28c2d4f3df40c902a9b004a5bfee3f3043d1ea337b6f795cf5b4047fa0454d3249da8d43e040ad435f67c1fe47275135b57ba777762b80255298b9dd84334704cc4d79bfb40f7e270d13597ebe3f8cd701cdeb0675246263a4e84daefecc4fbe31ca3fe32ab680c13f0d81ed6768f8f15f238b49ea8b3245dfdbea550183e611b68fb660e14c0441f2fd252370efd71ac563c7bf6475f7fb33f588c92a2fc3109acdfb64fb8b08c40bec207b398561128641d27d6ed4cbd40a75be4252d01a18a192f695271e26e76ed87d64ca862bc0ea14a63b25b9f25380da2272f7957", 0x2a1}], 0x1}, 0x0) executing program 5: setsockopt$SO_TIMESTAMPING(0xffffffffffffffff, 0x1, 0x25, &(0x7f0000000000)=0x3c33f, 0x4) r0 = syz_open_dev$dmmidi(&(0x7f0000000300), 0x2, 0x0) ioctl$SNDRV_RAWMIDI_IOCTL_PVERSION(r0, 0x40045702, &(0x7f0000000000)) ioctl$SNDRV_RAWMIDI_IOCTL_PARAMS(r0, 0xc0305710, &(0x7f0000000040)={0x1, 0x3, 0x3f6, 0x1, 0x21}) executing program 5: r0 = userfaultfd(0x80001) munmap(&(0x7f0000800000/0x800000)=nil, 0x800000) ioctl$UFFDIO_API(r0, 0xc018aa3f, &(0x7f0000000040)={0xaa, 0x110}) ioctl$UFFDIO_MOVE(r0, 0xc028aa05, &(0x7f0000000000)={&(0x7f0000724000/0x2000)=nil, &(0x7f0000ffb000/0x2000)=nil, 0x2000, 0x3}) executing program 5: mkdirat(0xffffffffffffff9c, &(0x7f0000000040)='./file0\x00', 0x1c0) mount$bind(&(0x7f0000000000)='.\x00', &(0x7f0000000200)='./file0/../file0\x00', 0x0, 0x101091, 0x0) mount$bind(&(0x7f0000000080)='./file0/../file0\x00', &(0x7f00000000c0)='./file0/file0\x00', 0x0, 0x8b101a, 0x0) umount2(&(0x7f0000000380)='./file0\x00', 0x0) executing program 5: r0 = socket$nl_xfrm(0x10, 0x3, 0x6) getsockopt$inet_IP_XFRM_POLICY(0xffffffffffffffff, 0x0, 0x11, 0x0, 0x0) r1 = openat$vcsa(0xffffffffffffff9c, &(0x7f0000000840), 0x1, 0x0) epoll_ctl$EPOLL_CTL_DEL(r1, 0x2, r0) executing program 5: socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) bind$unix(r0, &(0x7f0000000100)=@file={0x1, '\xe9\x1fq\x89Y\x1e\x923aK\x00'}, 0x6e) r1 = socket$unix(0x1, 0x2, 0x0) connect$unix(r1, &(0x7f0000000180)=@file={0x1, '\xe9\x1fq\x89Y\x1e\x923aK\x00'}, 0x6e) executing program 35: socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) bind$unix(r0, &(0x7f0000000100)=@file={0x1, '\xe9\x1fq\x89Y\x1e\x923aK\x00'}, 0x6e) r1 = socket$unix(0x1, 0x2, 0x0) connect$unix(r1, &(0x7f0000000180)=@file={0x1, '\xe9\x1fq\x89Y\x1e\x923aK\x00'}, 0x6e) executing program 36: r0 = msgget$private(0x0, 0x480) msgsnd(r0, &(0x7f0000001200)=ANY=[@ANYBLOB="01000000"], 0x401, 0x0) msgsnd(r0, &(0x7f0000000dc0)=ANY=[@ANYRES16], 0x401, 0x0) msgctl$IPC_RMID(r0, 0x0) executing program 4: sendmsg$ETHTOOL_MSG_STRSET_GET(0xffffffffffffffff, &(0x7f0000000a80)={0x0, 0x0, &(0x7f0000000a40)={&(0x7f00000002c0)={0x18, 0x0, 0x1, 0x70bd2d, 0x25dfdbff, {}, [@ETHTOOL_A_STRSET_HEADER={0x4}]}, 0x18}, 0x1, 0x0, 0x0, 0x880}, 0x4000004) r0 = socket(0x10, 0x3, 0x0) setsockopt$netlink_NETLINK_TX_RING(r0, 0x10e, 0xc, &(0x7f0000000280)={0x40bb, 0x2}, 0x10) sendmsg$netlink(r0, &(0x7f0000000040)={0x0, 0x0, &(0x7f00000001c0)=[{&(0x7f00000002c0)=ANY=[@ANYBLOB="780000001a0001002abd7000000000000a"], 0x78}], 0x1, 0x0, 0x0, 0x20400}, 0x0) program crashed: INFO: task hung in fuse_conn_destroy bisect: the chunk can be dropped bisect: testing without sub-chunk 2/2 bisect: no need to test this chunk, it's definitely needed bisect: split chunks (needed=true): <12> bisect: split chunk #0 of len 12 into 2 parts bisect: testing without sub-chunk 1/2 testing program (duration=6m1s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): [4, 4, 4, 4, 4, 4] detailed listing: executing program 5: mkdirat(0xffffffffffffff9c, &(0x7f0000000040)='./file0\x00', 0x1c0) mount$bind(&(0x7f0000000000)='.\x00', &(0x7f0000000200)='./file0/../file0\x00', 0x0, 0x101091, 0x0) mount$bind(&(0x7f0000000080)='./file0/../file0\x00', &(0x7f00000000c0)='./file0/file0\x00', 0x0, 0x8b101a, 0x0) umount2(&(0x7f0000000380)='./file0\x00', 0x0) executing program 5: r0 = socket$nl_xfrm(0x10, 0x3, 0x6) getsockopt$inet_IP_XFRM_POLICY(0xffffffffffffffff, 0x0, 0x11, 0x0, 0x0) r1 = openat$vcsa(0xffffffffffffff9c, &(0x7f0000000840), 0x1, 0x0) epoll_ctl$EPOLL_CTL_DEL(r1, 0x2, r0) executing program 5: socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) bind$unix(r0, &(0x7f0000000100)=@file={0x1, '\xe9\x1fq\x89Y\x1e\x923aK\x00'}, 0x6e) r1 = socket$unix(0x1, 0x2, 0x0) connect$unix(r1, &(0x7f0000000180)=@file={0x1, '\xe9\x1fq\x89Y\x1e\x923aK\x00'}, 0x6e) executing program 35: socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) bind$unix(r0, &(0x7f0000000100)=@file={0x1, '\xe9\x1fq\x89Y\x1e\x923aK\x00'}, 0x6e) r1 = socket$unix(0x1, 0x2, 0x0) connect$unix(r1, &(0x7f0000000180)=@file={0x1, '\xe9\x1fq\x89Y\x1e\x923aK\x00'}, 0x6e) executing program 36: r0 = msgget$private(0x0, 0x480) msgsnd(r0, &(0x7f0000001200)=ANY=[@ANYBLOB="01000000"], 0x401, 0x0) msgsnd(r0, &(0x7f0000000dc0)=ANY=[@ANYRES16], 0x401, 0x0) msgctl$IPC_RMID(r0, 0x0) executing program 4: sendmsg$ETHTOOL_MSG_STRSET_GET(0xffffffffffffffff, &(0x7f0000000a80)={0x0, 0x0, &(0x7f0000000a40)={&(0x7f00000002c0)={0x18, 0x0, 0x1, 0x70bd2d, 0x25dfdbff, {}, [@ETHTOOL_A_STRSET_HEADER={0x4}]}, 0x18}, 0x1, 0x0, 0x0, 0x880}, 0x4000004) r0 = socket(0x10, 0x3, 0x0) setsockopt$netlink_NETLINK_TX_RING(r0, 0x10e, 0xc, &(0x7f0000000280)={0x40bb, 0x2}, 0x10) sendmsg$netlink(r0, &(0x7f0000000040)={0x0, 0x0, &(0x7f00000001c0)=[{&(0x7f00000002c0)=ANY=[@ANYBLOB="780000001a0001002abd7000000000000a"], 0x78}], 0x1, 0x0, 0x0, 0x20400}, 0x0) program did not crash bisect: testing without sub-chunk 2/2 testing program (duration=6m1s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): [4, 4, 4, 4, 4, 4] detailed listing: executing program 6: r0 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$netlbl_unlabel(&(0x7f0000000440), r0) sendmsg$NLBL_UNLABEL_C_STATICLISTDEF(r0, &(0x7f0000000500)={0x0, 0x0, &(0x7f00000004c0)={&(0x7f0000000080)={0x14, r1, 0xc8036ab6d6cbef07, 0x70bd28, 0x25dfdbfb}, 0x14}, 0x1, 0x0, 0x0, 0x1}, 0x45080) syz_genetlink_get_family_id$nfc(&(0x7f0000000240), r0) executing program 6: mknodat$loop(0xffffffffffffff9c, &(0x7f0000000040)='./file0\x00', 0x6000, 0x1) r0 = openat$fuse(0xffffffffffffff9c, &(0x7f0000000280), 0x2, 0x0) mount$fuse(0x0, &(0x7f0000000100)='./file0\x00', &(0x7f0000000140), 0x0, &(0x7f0000000540)=ANY=[@ANYBLOB='fd=', @ANYRESHEX=r0, @ANYBLOB=',rootmode=00000000000000000060000,user_id=', @ANYRESDEC=0x0, @ANYBLOB=',group_id=', @ANYRESDEC=0x0]) ioctl$FUSE_DEV_IOC_CLONE(r0, 0x8004e500, &(0x7f0000000000)=r0) executing program 6: r0 = msgget$private(0x0, 0x480) msgsnd(r0, &(0x7f0000001200)=ANY=[@ANYBLOB="01000000"], 0x401, 0x0) msgsnd(r0, &(0x7f0000000dc0)=ANY=[@ANYRES16], 0x401, 0x0) msgctl$IPC_RMID(r0, 0x0) executing program 5: r0 = syz_init_net_socket$bt_l2cap(0x1f, 0x1, 0x0) bind$bt_l2cap(r0, &(0x7f00000002c0)={0x1f, 0x0, @any, 0xfffa}, 0xe) connect$bt_l2cap(r0, &(0x7f0000000080)={0x1f, 0x0, @fixed={'\xaa\xaa\xaa\xaa\xaa', 0x10}, 0x7ff}, 0xe) sendmsg$inet(r0, &(0x7f00000023c0)={0x0, 0x0, &(0x7f0000002380)=[{&(0x7f0000001380)="8627878d6b8212d45c2dd9ccf83ce81dd30b8eec06fa665f95ae3ab8f9611f1810bdbd00b643780d07ac9dd292e631c72bf910161bf0731207cd60493e185ec9cb1de90d8bbdf54818dd722f5e78bc6b387221e6e7c46b2e37608179df7ad28279fbd622a61ddd81938d2fe4f26f2edcc7683f3925bd7a90a133b9871addb4f7cda5c4702d7a24be0756d20d25943ad911b8141c4039dc30dbcb0aefbf3f92beea6de191a25cf69f9a9ec393782723e72203f4b7c5dca02111d28ebb4e90b6787a84ba6fb79c4924c7e96734d33effee545c71f36446d00a2228bacc54355c44049ecad2c0b6028abbf23f9891ede6ca5c9e08f5d435e72d97b7eb03e27f94a34e642510cc0c983d894818e4694daeb2f46d3bc44a74c877302d317e4c80252a2954dca4bc0036592d66a9ceedecf531c23dfec82b372bcf8ca0631ea9e42313fdad73d4ca232221736541ba958c1bd4a97c415ca47b5c82b373c6851f95c54b833b5d23c176579d8288adfac40c1d43e38963ecf0456a35d1a45aa0a4847c68acf8865af0a054d2c5efce89c866ad390f6fb39ff1a5b4918054e28b114243b042265aaacf782913ef82880fe19e130372be48a5510ac7fb0388fef51b1bd65d35a5f28c2d4f3df40c902a9b004a5bfee3f3043d1ea337b6f795cf5b4047fa0454d3249da8d43e040ad435f67c1fe47275135b57ba777762b80255298b9dd84334704cc4d79bfb40f7e270d13597ebe3f8cd701cdeb0675246263a4e84daefecc4fbe31ca3fe32ab680c13f0d81ed6768f8f15f238b49ea8b3245dfdbea550183e611b68fb660e14c0441f2fd252370efd71ac563c7bf6475f7fb33f588c92a2fc3109acdfb64fb8b08c40bec207b398561128641d27d6ed4cbd40a75be4252d01a18a192f695271e26e76ed87d64ca862bc0ea14a63b25b9f25380da2272f7957", 0x2a1}], 0x1}, 0x0) executing program 5: setsockopt$SO_TIMESTAMPING(0xffffffffffffffff, 0x1, 0x25, &(0x7f0000000000)=0x3c33f, 0x4) r0 = syz_open_dev$dmmidi(&(0x7f0000000300), 0x2, 0x0) ioctl$SNDRV_RAWMIDI_IOCTL_PVERSION(r0, 0x40045702, &(0x7f0000000000)) ioctl$SNDRV_RAWMIDI_IOCTL_PARAMS(r0, 0xc0305710, &(0x7f0000000040)={0x1, 0x3, 0x3f6, 0x1, 0x21}) executing program 5: r0 = userfaultfd(0x80001) munmap(&(0x7f0000800000/0x800000)=nil, 0x800000) ioctl$UFFDIO_API(r0, 0xc018aa3f, &(0x7f0000000040)={0xaa, 0x110}) ioctl$UFFDIO_MOVE(r0, 0xc028aa05, &(0x7f0000000000)={&(0x7f0000724000/0x2000)=nil, &(0x7f0000ffb000/0x2000)=nil, 0x2000, 0x3}) program crashed: INFO: task hung in fuse_conn_destroy bisect: the chunk can be dropped bisect: split chunks (needed=true): <6> bisect: split chunk #0 of len 6 into 2 parts bisect: testing without sub-chunk 1/2 testing program (duration=6m0s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): [4, 4, 4] detailed listing: executing program 5: r0 = syz_init_net_socket$bt_l2cap(0x1f, 0x1, 0x0) bind$bt_l2cap(r0, &(0x7f00000002c0)={0x1f, 0x0, @any, 0xfffa}, 0xe) connect$bt_l2cap(r0, &(0x7f0000000080)={0x1f, 0x0, @fixed={'\xaa\xaa\xaa\xaa\xaa', 0x10}, 0x7ff}, 0xe) sendmsg$inet(r0, &(0x7f00000023c0)={0x0, 0x0, &(0x7f0000002380)=[{&(0x7f0000001380)="8627878d6b8212d45c2dd9ccf83ce81dd30b8eec06fa665f95ae3ab8f9611f1810bdbd00b643780d07ac9dd292e631c72bf910161bf0731207cd60493e185ec9cb1de90d8bbdf54818dd722f5e78bc6b387221e6e7c46b2e37608179df7ad28279fbd622a61ddd81938d2fe4f26f2edcc7683f3925bd7a90a133b9871addb4f7cda5c4702d7a24be0756d20d25943ad911b8141c4039dc30dbcb0aefbf3f92beea6de191a25cf69f9a9ec393782723e72203f4b7c5dca02111d28ebb4e90b6787a84ba6fb79c4924c7e96734d33effee545c71f36446d00a2228bacc54355c44049ecad2c0b6028abbf23f9891ede6ca5c9e08f5d435e72d97b7eb03e27f94a34e642510cc0c983d894818e4694daeb2f46d3bc44a74c877302d317e4c80252a2954dca4bc0036592d66a9ceedecf531c23dfec82b372bcf8ca0631ea9e42313fdad73d4ca232221736541ba958c1bd4a97c415ca47b5c82b373c6851f95c54b833b5d23c176579d8288adfac40c1d43e38963ecf0456a35d1a45aa0a4847c68acf8865af0a054d2c5efce89c866ad390f6fb39ff1a5b4918054e28b114243b042265aaacf782913ef82880fe19e130372be48a5510ac7fb0388fef51b1bd65d35a5f28c2d4f3df40c902a9b004a5bfee3f3043d1ea337b6f795cf5b4047fa0454d3249da8d43e040ad435f67c1fe47275135b57ba777762b80255298b9dd84334704cc4d79bfb40f7e270d13597ebe3f8cd701cdeb0675246263a4e84daefecc4fbe31ca3fe32ab680c13f0d81ed6768f8f15f238b49ea8b3245dfdbea550183e611b68fb660e14c0441f2fd252370efd71ac563c7bf6475f7fb33f588c92a2fc3109acdfb64fb8b08c40bec207b398561128641d27d6ed4cbd40a75be4252d01a18a192f695271e26e76ed87d64ca862bc0ea14a63b25b9f25380da2272f7957", 0x2a1}], 0x1}, 0x0) executing program 5: setsockopt$SO_TIMESTAMPING(0xffffffffffffffff, 0x1, 0x25, &(0x7f0000000000)=0x3c33f, 0x4) r0 = syz_open_dev$dmmidi(&(0x7f0000000300), 0x2, 0x0) ioctl$SNDRV_RAWMIDI_IOCTL_PVERSION(r0, 0x40045702, &(0x7f0000000000)) ioctl$SNDRV_RAWMIDI_IOCTL_PARAMS(r0, 0xc0305710, &(0x7f0000000040)={0x1, 0x3, 0x3f6, 0x1, 0x21}) executing program 5: r0 = userfaultfd(0x80001) munmap(&(0x7f0000800000/0x800000)=nil, 0x800000) ioctl$UFFDIO_API(r0, 0xc018aa3f, &(0x7f0000000040)={0xaa, 0x110}) ioctl$UFFDIO_MOVE(r0, 0xc028aa05, &(0x7f0000000000)={&(0x7f0000724000/0x2000)=nil, &(0x7f0000ffb000/0x2000)=nil, 0x2000, 0x3}) program did not crash bisect: testing without sub-chunk 2/2 testing program (duration=6m0s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): [4, 4, 4] detailed listing: executing program 6: r0 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$netlbl_unlabel(&(0x7f0000000440), r0) sendmsg$NLBL_UNLABEL_C_STATICLISTDEF(r0, &(0x7f0000000500)={0x0, 0x0, &(0x7f00000004c0)={&(0x7f0000000080)={0x14, r1, 0xc8036ab6d6cbef07, 0x70bd28, 0x25dfdbfb}, 0x14}, 0x1, 0x0, 0x0, 0x1}, 0x45080) syz_genetlink_get_family_id$nfc(&(0x7f0000000240), r0) executing program 6: mknodat$loop(0xffffffffffffff9c, &(0x7f0000000040)='./file0\x00', 0x6000, 0x1) r0 = openat$fuse(0xffffffffffffff9c, &(0x7f0000000280), 0x2, 0x0) mount$fuse(0x0, &(0x7f0000000100)='./file0\x00', &(0x7f0000000140), 0x0, &(0x7f0000000540)=ANY=[@ANYBLOB='fd=', @ANYRESHEX=r0, @ANYBLOB=',rootmode=00000000000000000060000,user_id=', @ANYRESDEC=0x0, @ANYBLOB=',group_id=', @ANYRESDEC=0x0]) ioctl$FUSE_DEV_IOC_CLONE(r0, 0x8004e500, &(0x7f0000000000)=r0) executing program 6: r0 = msgget$private(0x0, 0x480) msgsnd(r0, &(0x7f0000001200)=ANY=[@ANYBLOB="01000000"], 0x401, 0x0) msgsnd(r0, &(0x7f0000000dc0)=ANY=[@ANYRES16], 0x401, 0x0) msgctl$IPC_RMID(r0, 0x0) program crashed: INFO: task hung in fuse_conn_destroy bisect: the chunk can be dropped bisect: split chunks (needed=true): <3> bisect: split chunk #0 of len 3 into 2 parts bisect: testing without sub-chunk 1/2 testing program (duration=6m0s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): msgget$private-msgsnd-msgsnd-msgctl$IPC_RMID detailed listing: executing program 6: r0 = msgget$private(0x0, 0x480) msgsnd(r0, &(0x7f0000001200)=ANY=[@ANYBLOB="01000000"], 0x401, 0x0) msgsnd(r0, &(0x7f0000000dc0)=ANY=[@ANYRES16], 0x401, 0x0) msgctl$IPC_RMID(r0, 0x0) program did not crash bisect: testing without sub-chunk 2/2 testing program (duration=6m0s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): [4, 4] detailed listing: executing program 6: r0 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$netlbl_unlabel(&(0x7f0000000440), r0) sendmsg$NLBL_UNLABEL_C_STATICLISTDEF(r0, &(0x7f0000000500)={0x0, 0x0, &(0x7f00000004c0)={&(0x7f0000000080)={0x14, r1, 0xc8036ab6d6cbef07, 0x70bd28, 0x25dfdbfb}, 0x14}, 0x1, 0x0, 0x0, 0x1}, 0x45080) syz_genetlink_get_family_id$nfc(&(0x7f0000000240), r0) executing program 6: mknodat$loop(0xffffffffffffff9c, &(0x7f0000000040)='./file0\x00', 0x6000, 0x1) r0 = openat$fuse(0xffffffffffffff9c, &(0x7f0000000280), 0x2, 0x0) mount$fuse(0x0, &(0x7f0000000100)='./file0\x00', &(0x7f0000000140), 0x0, &(0x7f0000000540)=ANY=[@ANYBLOB='fd=', @ANYRESHEX=r0, @ANYBLOB=',rootmode=00000000000000000060000,user_id=', @ANYRESDEC=0x0, @ANYBLOB=',group_id=', @ANYRESDEC=0x0]) ioctl$FUSE_DEV_IOC_CLONE(r0, 0x8004e500, &(0x7f0000000000)=r0) program crashed: INFO: task hung in fuse_conn_destroy bisect: the chunk can be dropped bisect: split chunks (needed=true): <2> bisect: split chunk #0 of len 2 into 2 parts bisect: testing without sub-chunk 1/2 testing program (duration=6m0s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): mknodat$loop-openat$fuse-mount$fuse-ioctl$FUSE_DEV_IOC_CLONE detailed listing: executing program 6: mknodat$loop(0xffffffffffffff9c, &(0x7f0000000040)='./file0\x00', 0x6000, 0x1) r0 = openat$fuse(0xffffffffffffff9c, &(0x7f0000000280), 0x2, 0x0) mount$fuse(0x0, &(0x7f0000000100)='./file0\x00', &(0x7f0000000140), 0x0, &(0x7f0000000540)=ANY=[@ANYBLOB='fd=', @ANYRESHEX=r0, @ANYBLOB=',rootmode=00000000000000000060000,user_id=', @ANYRESDEC=0x0, @ANYBLOB=',group_id=', @ANYRESDEC=0x0]) ioctl$FUSE_DEV_IOC_CLONE(r0, 0x8004e500, &(0x7f0000000000)=r0) program crashed: INFO: task hung in fuse_conn_destroy bisect: the chunk can be dropped bisect: testing without sub-chunk 2/2 bisect: no need to test this chunk, it's definitely needed bisect: split chunks (needed=true): <1> bisect: split chunk #0 of len 1 into 2 parts bisect: no way to further split the chunk bisect: 1 programs left: executing program 6: mknodat$loop(0xffffffffffffff9c, &(0x7f0000000040)='./file0\x00', 0x6000, 0x1) r0 = openat$fuse(0xffffffffffffff9c, &(0x7f0000000280), 0x2, 0x0) mount$fuse(0x0, &(0x7f0000000100)='./file0\x00', &(0x7f0000000140), 0x0, &(0x7f0000000540)=ANY=[@ANYBLOB='fd=', @ANYRESHEX=r0, @ANYBLOB=',rootmode=00000000000000000060000,user_id=', @ANYRESDEC=0x0, @ANYBLOB=',group_id=', @ANYRESDEC=0x0]) ioctl$FUSE_DEV_IOC_CLONE(r0, 0x8004e500, &(0x7f0000000000)=r0) bisect: trying to concatenate bisect: concatenate 1 entries testing program (duration=9m0s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): mknodat$loop-openat$fuse-mount$fuse-ioctl$FUSE_DEV_IOC_CLONE detailed listing: executing program 0: mknodat$loop(0xffffffffffffff9c, &(0x7f0000000040)='./file0\x00', 0x6000, 0x1) r0 = openat$fuse(0xffffffffffffff9c, &(0x7f0000000280), 0x2, 0x0) mount$fuse(0x0, &(0x7f0000000100)='./file0\x00', &(0x7f0000000140), 0x0, &(0x7f0000000540)=ANY=[@ANYBLOB='fd=', @ANYRESHEX=r0, @ANYBLOB=',rootmode=00000000000000000060000,user_id=', @ANYRESDEC=0x0, @ANYBLOB=',group_id=', @ANYRESDEC=0x0]) ioctl$FUSE_DEV_IOC_CLONE(r0, 0x8004e500, &(0x7f0000000000)=r0) program crashed: INFO: task hung in fuse_conn_destroy bisect: concatenation succeeded found reproducer with 4 syscalls minimizing guilty program testing program (duration=6m56.41316578s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): mknodat$loop-openat$fuse-mount$fuse detailed listing: executing program 0: mknodat$loop(0xffffffffffffff9c, &(0x7f0000000040)='./file0\x00', 0x6000, 0x1) r0 = openat$fuse(0xffffffffffffff9c, &(0x7f0000000280), 0x2, 0x0) mount$fuse(0x0, &(0x7f0000000100)='./file0\x00', &(0x7f0000000140), 0x0, &(0x7f0000000540)=ANY=[@ANYBLOB='fd=', @ANYRESHEX=r0, @ANYBLOB=',rootmode=00000000000000000060000,user_id=', @ANYRESDEC=0x0, @ANYBLOB=',group_id=', @ANYRESDEC=0x0]) program did not crash testing program (duration=6m56.41316578s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): mknodat$loop-openat$fuse-ioctl$FUSE_DEV_IOC_CLONE detailed listing: executing program 0: mknodat$loop(0xffffffffffffff9c, &(0x7f0000000040)='./file0\x00', 0x6000, 0x1) r0 = openat$fuse(0xffffffffffffff9c, &(0x7f0000000280), 0x2, 0x0) ioctl$FUSE_DEV_IOC_CLONE(r0, 0x8004e500, &(0x7f0000000000)=r0) program did not crash testing program (duration=6m56.41316578s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): mknodat$loop-mount$fuse-ioctl$FUSE_DEV_IOC_CLONE detailed listing: executing program 0: mknodat$loop(0xffffffffffffff9c, &(0x7f0000000040)='./file0\x00', 0x6000, 0x1) mount$fuse(0x0, &(0x7f0000000100)='./file0\x00', &(0x7f0000000140), 0x0, &(0x7f0000000540)=ANY=[@ANYBLOB='fd=', @ANYRESHEX, @ANYBLOB=',rootmode=00000000000000000060000,user_id=', @ANYRESDEC=0x0, @ANYBLOB=',group_id=', @ANYRESDEC=0x0]) ioctl$FUSE_DEV_IOC_CLONE(0xffffffffffffffff, 0x8004e500, &(0x7f0000000000)) program did not crash testing program (duration=6m56.41316578s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): openat$fuse-mount$fuse-ioctl$FUSE_DEV_IOC_CLONE detailed listing: executing program 0: r0 = openat$fuse(0xffffffffffffff9c, &(0x7f0000000280), 0x2, 0x0) mount$fuse(0x0, &(0x7f0000000100)='./file0\x00', &(0x7f0000000140), 0x0, &(0x7f0000000540)=ANY=[@ANYBLOB='fd=', @ANYRESHEX=r0, @ANYBLOB=',rootmode=00000000000000000060000,user_id=', @ANYRESDEC=0x0, @ANYBLOB=',group_id=', @ANYRESDEC=0x0]) ioctl$FUSE_DEV_IOC_CLONE(r0, 0x8004e500, &(0x7f0000000000)=r0) program did not crash testing program (duration=6m56.41316578s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): mknodat$loop-openat$fuse-mount$fuse-ioctl$FUSE_DEV_IOC_CLONE detailed listing: executing program 0: mknodat$loop(0xffffffffffffff9c, 0x0, 0x6000, 0x1) r0 = openat$fuse(0xffffffffffffff9c, &(0x7f0000000280), 0x2, 0x0) mount$fuse(0x0, &(0x7f0000000100)='./file0\x00', &(0x7f0000000140), 0x0, &(0x7f0000000540)=ANY=[@ANYBLOB='fd=', @ANYRESHEX=r0, @ANYBLOB=',rootmode=00000000000000000060000,user_id=', @ANYRESDEC=0x0, @ANYBLOB=',group_id=', @ANYRESDEC=0x0]) ioctl$FUSE_DEV_IOC_CLONE(r0, 0x8004e500, &(0x7f0000000000)=r0) program did not crash testing program (duration=6m56.41316578s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): mknodat$loop-openat$fuse-mount$fuse-ioctl$FUSE_DEV_IOC_CLONE detailed listing: executing program 0: mknodat$loop(0xffffffffffffff9c, &(0x7f0000000040)='./file0\x00', 0x6000, 0x1) r0 = openat$fuse(0xffffffffffffff9c, 0x0, 0x2, 0x0) mount$fuse(0x0, &(0x7f0000000100)='./file0\x00', &(0x7f0000000140), 0x0, &(0x7f0000000540)=ANY=[@ANYBLOB='fd=', @ANYRESHEX=r0, @ANYBLOB=',rootmode=00000000000000000060000,user_id=', @ANYRESDEC=0x0, @ANYBLOB=',group_id=', @ANYRESDEC=0x0]) ioctl$FUSE_DEV_IOC_CLONE(r0, 0x8004e500, &(0x7f0000000000)=r0) program did not crash testing program (duration=6m56.41316578s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): mknodat$loop-openat$fuse-mount$fuse-ioctl$FUSE_DEV_IOC_CLONE detailed listing: executing program 0: mknodat$loop(0xffffffffffffff9c, &(0x7f0000000040)='./file0\x00', 0x6000, 0x1) r0 = openat$fuse(0xffffffffffffff9c, &(0x7f0000000280), 0x2, 0x0) mount$fuse(0x0, 0x0, &(0x7f0000000140), 0x0, &(0x7f0000000540)=ANY=[@ANYBLOB='fd=', @ANYRESHEX=r0, @ANYBLOB=',rootmode=00000000000000000060000,user_id=', @ANYRESDEC=0x0, @ANYBLOB=',group_id=', @ANYRESDEC=0x0]) ioctl$FUSE_DEV_IOC_CLONE(r0, 0x8004e500, &(0x7f0000000000)=r0) program did not crash testing program (duration=6m56.41316578s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): mknodat$loop-openat$fuse-mount$fuse-ioctl$FUSE_DEV_IOC_CLONE detailed listing: executing program 0: mknodat$loop(0xffffffffffffff9c, &(0x7f0000000040)='./file0\x00', 0x6000, 0x1) r0 = openat$fuse(0xffffffffffffff9c, &(0x7f0000000280), 0x2, 0x0) mount$fuse(0x0, &(0x7f0000000100)='./file0\x00', 0x0, 0x0, &(0x7f0000000540)=ANY=[@ANYBLOB='fd=', @ANYRESHEX=r0, @ANYBLOB=',rootmode=00000000000000000060000,user_id=', @ANYRESDEC=0x0, @ANYBLOB=',group_id=', @ANYRESDEC=0x0]) ioctl$FUSE_DEV_IOC_CLONE(r0, 0x8004e500, &(0x7f0000000000)=r0) program did not crash testing program (duration=6m56.41316578s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): mknodat$loop-openat$fuse-mount$fuse-ioctl$FUSE_DEV_IOC_CLONE detailed listing: executing program 0: mknodat$loop(0xffffffffffffff9c, &(0x7f0000000040)='./file0\x00', 0x6000, 0x1) r0 = openat$fuse(0xffffffffffffff9c, &(0x7f0000000280), 0x2, 0x0) mount$fuse(0x0, &(0x7f0000000100)='./file0\x00', &(0x7f0000000140), 0x0, 0x0) ioctl$FUSE_DEV_IOC_CLONE(r0, 0x8004e500, &(0x7f0000000000)=r0) program did not crash testing program (duration=6m56.41316578s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): mknodat$loop-openat$fuse-mount$fuse-ioctl$FUSE_DEV_IOC_CLONE detailed listing: executing program 0: mknodat$loop(0xffffffffffffff9c, &(0x7f0000000040)='./file0\x00', 0x6000, 0x1) r0 = openat$fuse(0xffffffffffffff9c, &(0x7f0000000280), 0x2, 0x0) mount$fuse(0x0, &(0x7f0000000100)='./file0\x00', &(0x7f0000000140), 0x0, &(0x7f0000000540)=ANY=[]) ioctl$FUSE_DEV_IOC_CLONE(r0, 0x8004e500, &(0x7f0000000000)=r0) program did not crash testing program (duration=6m56.41316578s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): mknodat$loop-openat$fuse-mount$fuse-ioctl$FUSE_DEV_IOC_CLONE detailed listing: executing program 0: mknodat$loop(0xffffffffffffff9c, &(0x7f0000000040)='./file0\x00', 0x6000, 0x1) r0 = openat$fuse(0xffffffffffffff9c, &(0x7f0000000280), 0x2, 0x0) mount$fuse(0x0, &(0x7f0000000100)='./file0\x00', &(0x7f0000000140), 0x0, &(0x7f0000000540)=ANY=[@ANYBLOB='fd=', @ANYRESHEX=r0, @ANYBLOB=',rootmode=00000000000000000060000,user_id=', @ANYRESDEC=0x0, @ANYBLOB, @ANYRESDEC=0x0]) ioctl$FUSE_DEV_IOC_CLONE(r0, 0x8004e500, &(0x7f0000000000)=r0) program did not crash testing program (duration=6m56.41316578s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): mknodat$loop-openat$fuse-mount$fuse-ioctl$FUSE_DEV_IOC_CLONE detailed listing: executing program 0: mknodat$loop(0xffffffffffffff9c, &(0x7f0000000040)='./file0\x00', 0x6000, 0x1) r0 = openat$fuse(0xffffffffffffff9c, &(0x7f0000000280), 0x2, 0x0) mount$fuse(0x0, &(0x7f0000000100)='./file0\x00', &(0x7f0000000140), 0x0, &(0x7f0000000540)=ANY=[@ANYBLOB='fd=', @ANYRESHEX=r0, @ANYBLOB, @ANYRESDEC=0x0, @ANYBLOB=',group_id=', @ANYRESDEC=0x0]) ioctl$FUSE_DEV_IOC_CLONE(r0, 0x8004e500, &(0x7f0000000000)=r0) program did not crash testing program (duration=6m56.41316578s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): mknodat$loop-openat$fuse-mount$fuse-ioctl$FUSE_DEV_IOC_CLONE detailed listing: executing program 0: mknodat$loop(0xffffffffffffff9c, &(0x7f0000000040)='./file0\x00', 0x6000, 0x1) r0 = openat$fuse(0xffffffffffffff9c, &(0x7f0000000280), 0x2, 0x0) mount$fuse(0x0, &(0x7f0000000100)='./file0\x00', &(0x7f0000000140), 0x0, &(0x7f0000000540)=ANY=[@ANYBLOB, @ANYRESHEX=r0, @ANYBLOB=',rootmode=00000000000000000060000,user_id=', @ANYRESDEC=0x0, @ANYBLOB=',group_id=', @ANYRESDEC=0x0]) ioctl$FUSE_DEV_IOC_CLONE(r0, 0x8004e500, &(0x7f0000000000)=r0) program did not crash testing program (duration=6m56.41316578s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): mknodat$loop-openat$fuse-mount$fuse-ioctl$FUSE_DEV_IOC_CLONE detailed listing: executing program 0: mknodat$loop(0xffffffffffffff9c, &(0x7f0000000040)='./file0\x00', 0x6000, 0x1) r0 = openat$fuse(0xffffffffffffff9c, &(0x7f0000000280), 0x2, 0x0) mount$fuse(0x0, &(0x7f0000000100)='./file0\x00', &(0x7f0000000140), 0x0, &(0x7f0000000540)=ANY=[@ANYBLOB='fd=', @ANYRESHEX=r0, @ANYBLOB=',rootmode=00000000000000000060000,user_id=', @ANYRESDEC=0x0, @ANYBLOB=',group_id=', @ANYRESDEC=0x0]) ioctl$FUSE_DEV_IOC_CLONE(r0, 0x8004e500, 0x0) program did not crash extracting C reproducer testing compiled C program (duration=6m56.41316578s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): mknodat$loop-openat$fuse-mount$fuse-ioctl$FUSE_DEV_IOC_CLONE program crashed: INFO: task hung in fuse_conn_destroy simplifying C reproducer testing compiled C program (duration=6m56.41316578s, {Threaded:false Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): mknodat$loop-openat$fuse-mount$fuse-ioctl$FUSE_DEV_IOC_CLONE program crashed: INFO: task hung in fuse_conn_destroy testing compiled C program (duration=6m56.41316578s, {Threaded:false Repeat:true RepeatTimes:0 Procs:1 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): mknodat$loop-openat$fuse-mount$fuse-ioctl$FUSE_DEV_IOC_CLONE program crashed: INFO: task hung in fuse_conn_destroy testing compiled C program (duration=6m56.41316578s, {Threaded:false Repeat:true RepeatTimes:0 Procs:1 Slowdown:1 Sandbox: SandboxArg:0 Leak:false NetInjection:false NetDevices:false NetReset:false Cgroups:false BinfmtMisc:false CloseFDs:false KCSAN:false DevlinkPCI:false NicVF:false USB:false VhciInjection:false Wifi:false IEEE802154:true Sysctl:true Swap:false UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): mknodat$loop-openat$fuse-mount$fuse-ioctl$FUSE_DEV_IOC_CLONE program crashed: INFO: task hung in fuse_conn_destroy testing compiled C program (duration=6m56.41316578s, {Threaded:false Repeat:true RepeatTimes:0 Procs:1 Slowdown:1 Sandbox: SandboxArg:0 Leak:false NetInjection:false NetDevices:false NetReset:false Cgroups:false BinfmtMisc:false CloseFDs:false KCSAN:false DevlinkPCI:false NicVF:false USB:false VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:false UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): mknodat$loop-openat$fuse-mount$fuse-ioctl$FUSE_DEV_IOC_CLONE program crashed: INFO: task hung in fuse_conn_destroy testing compiled C program (duration=6m56.41316578s, {Threaded:false Repeat:true RepeatTimes:0 Procs:1 Slowdown:1 Sandbox: SandboxArg:0 Leak:false NetInjection:false NetDevices:false NetReset:false Cgroups:false BinfmtMisc:false CloseFDs:false KCSAN:false DevlinkPCI:false NicVF:false USB:false VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:false UseTmpDir:false HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): mknodat$loop-openat$fuse-mount$fuse-ioctl$FUSE_DEV_IOC_CLONE program crashed: no output from test machine a never seen crash title: no output from test machine, ignore testing compiled C program (duration=6m56.41316578s, {Threaded:false Repeat:true RepeatTimes:0 Procs:1 Slowdown:1 Sandbox: SandboxArg:0 Leak:false NetInjection:false NetDevices:false NetReset:false Cgroups:false BinfmtMisc:false CloseFDs:false KCSAN:false DevlinkPCI:false NicVF:false USB:false VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:false UseTmpDir:true HandleSegv:false Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): mknodat$loop-openat$fuse-mount$fuse-ioctl$FUSE_DEV_IOC_CLONE program crashed: INFO: task hung in fuse_conn_destroy testing compiled C program (duration=6m56.41316578s, {Threaded:false Repeat:true RepeatTimes:0 Procs:1 Slowdown:1 Sandbox: SandboxArg:0 Leak:false NetInjection:false NetDevices:false NetReset:false Cgroups:false BinfmtMisc:false CloseFDs:false KCSAN:false DevlinkPCI:false NicVF:false USB:false VhciInjection:false Wifi:false IEEE802154:false Sysctl:false Swap:false UseTmpDir:true HandleSegv:false Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): mknodat$loop-openat$fuse-mount$fuse-ioctl$FUSE_DEV_IOC_CLONE program crashed: INFO: task hung in fuse_conn_destroy testing program (duration=6m56.41316578s, {Threaded:false Repeat:true RepeatTimes:0 Procs:1 Slowdown:1 Sandbox: SandboxArg:0 Leak:false NetInjection:false NetDevices:false NetReset:false Cgroups:false BinfmtMisc:false CloseFDs:false KCSAN:false DevlinkPCI:false NicVF:false USB:false VhciInjection:false Wifi:false IEEE802154:false Sysctl:false Swap:false UseTmpDir:true HandleSegv:false Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): mknodat$loop-openat$fuse-mount$fuse-ioctl$FUSE_DEV_IOC_CLONE detailed listing: executing program 0: mknodat$loop(0xffffffffffffff9c, &(0x7f0000000040)='./file0\x00', 0x6000, 0x1) r0 = openat$fuse(0xffffffffffffff9c, &(0x7f0000000280), 0x2, 0x0) mount$fuse(0x0, &(0x7f0000000100)='./file0\x00', &(0x7f0000000140), 0x0, &(0x7f0000000540)=ANY=[@ANYBLOB='fd=', @ANYRESHEX=r0, @ANYBLOB=',rootmode=00000000000000000060000,user_id=', @ANYRESDEC=0x0, @ANYBLOB=',group_id=', @ANYRESDEC=0x0]) ioctl$FUSE_DEV_IOC_CLONE(r0, 0x8004e500, &(0x7f0000000000)=r0) program crashed: INFO: task hung in fuse_conn_destroy validation run: crashed=true testing program (duration=6m56.41316578s, {Threaded:false Repeat:true RepeatTimes:0 Procs:1 Slowdown:1 Sandbox: SandboxArg:0 Leak:false NetInjection:false NetDevices:false NetReset:false Cgroups:false BinfmtMisc:false CloseFDs:false KCSAN:false DevlinkPCI:false NicVF:false USB:false VhciInjection:false Wifi:false IEEE802154:false Sysctl:false Swap:false UseTmpDir:true HandleSegv:false Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): mknodat$loop-openat$fuse-mount$fuse-ioctl$FUSE_DEV_IOC_CLONE detailed listing: executing program 0: mknodat$loop(0xffffffffffffff9c, &(0x7f0000000040)='./file0\x00', 0x6000, 0x1) r0 = openat$fuse(0xffffffffffffff9c, &(0x7f0000000280), 0x2, 0x0) mount$fuse(0x0, &(0x7f0000000100)='./file0\x00', &(0x7f0000000140), 0x0, &(0x7f0000000540)=ANY=[@ANYBLOB='fd=', @ANYRESHEX=r0, @ANYBLOB=',rootmode=00000000000000000060000,user_id=', @ANYRESDEC=0x0, @ANYBLOB=',group_id=', @ANYRESDEC=0x0]) ioctl$FUSE_DEV_IOC_CLONE(r0, 0x8004e500, &(0x7f0000000000)=r0) program crashed: INFO: task hung in nmi_cpu_backtrace validation run: crashed=true testing program (duration=6m56.41316578s, {Threaded:false Repeat:true RepeatTimes:0 Procs:1 Slowdown:1 Sandbox: SandboxArg:0 Leak:false NetInjection:false NetDevices:false NetReset:false Cgroups:false BinfmtMisc:false CloseFDs:false KCSAN:false DevlinkPCI:false NicVF:false USB:false VhciInjection:false Wifi:false IEEE802154:false Sysctl:false Swap:false UseTmpDir:true HandleSegv:false Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): mknodat$loop-openat$fuse-mount$fuse-ioctl$FUSE_DEV_IOC_CLONE detailed listing: executing program 0: mknodat$loop(0xffffffffffffff9c, &(0x7f0000000040)='./file0\x00', 0x6000, 0x1) r0 = openat$fuse(0xffffffffffffff9c, &(0x7f0000000280), 0x2, 0x0) mount$fuse(0x0, &(0x7f0000000100)='./file0\x00', &(0x7f0000000140), 0x0, &(0x7f0000000540)=ANY=[@ANYBLOB='fd=', @ANYRESHEX=r0, @ANYBLOB=',rootmode=00000000000000000060000,user_id=', @ANYRESDEC=0x0, @ANYBLOB=',group_id=', @ANYRESDEC=0x0]) ioctl$FUSE_DEV_IOC_CLONE(r0, 0x8004e500, &(0x7f0000000000)=r0) program crashed: INFO: task hung in fuse_conn_destroy validation run: crashed=true reproducing took 5h58m51.288209801s repro crashed as (corrupted=false): I[ 388.859854][ T38] INFO: task syz-executor:6024 blocked for more than 143 seconds. Not tainted syzkaller #0 "echo 0 > /proc/sys/kernel/hung_task_timeout_secs" disables this message. task:syz-executor state:D stack:21912 pid:6024 tgid:6024 ppid:1 task_flags:0x400140 flags:0x00080002 Call Trace: context_switch kernel/sched/core.c:5387 [inline] __schedule+0x169e/0x54f0 kernel/sched/core.c:7188 __schedule_loop kernel/sched/core.c:7267 [inline] schedule+0x164/0x360 kernel/sched/core.c:7282 fuse_chan_wait_aborted+0x15b/0x250 fs/fuse/dev.c:2212 fuse_conn_destroy+0x1e7/0x3e0 fs/fuse/inode.c:1969 fuse_sb_destroy fs/fuse/inode.c:1988 [inline] fuse_kill_sb_anon+0x1ef/0x270 fs/fuse/inode.c:2001 deactivate_locked_super+0xbc/0x130 fs/super.c:476 cleanup_mnt+0x437/0x4d0 fs/namespace.c:1312 task_work_run+0x1d9/0x270 kernel/task_work.c:233 resume_user_mode_work include/linux/resume_user_mode.h:50 [inline] __exit_to_user_mode_loop kernel/entry/common.c:67 [inline] exit_to_user_mode_loop+0xed/0x480 kernel/entry/common.c:98 __exit_to_user_mode_prepare include/linux/irq-entry-common.h:207 [inline] syscall_exit_to_user_mode_prepare include/linux/irq-entry-common.h:238 [inline] syscall_exit_to_user_mode include/linux/entry-common.h:328 [inline] do_syscall_64+0x33e/0xf80 arch/x86/entry/syscall_64.c:100 entry_SYSCALL_64_after_hwframe+0x77/0x7f RIP: 0033:0x7fdebeb4da57 RSP: 002b:00007fff9c868808 EFLAGS: 00000246 ORIG_RAX: 00000000000000a6 RAX: 0000000000000000 RBX: 00007fdebebe2048 RCX: 00007fdebeb4da57 RDX: 0000000000000000 RSI: 0000000000000009 RDI: 00007fff9c8688c0 RBP: 00007fff9c8688c0 R08: 00007fff9c8698c0 R09: 00000000ffffffff R10: 0000000000000000 R11: 0000000000000246 R12: 00007fff9c869950 R13: 00007fdebebe2048 R14: 0000000000037d82 R15: 00007fff9c869990 Showing all locks held in the system: 1 lock held by khungtaskd/38: #0: ffffffff8e3c80c0 (rcu_read_lock){....}-{1:3}, at: rcu_lock_acquire include/linux/rcupdate.h:300 [inline] #0: ffffffff8e3c80c0 (rcu_read_lock){....}-{1:3}, at: rcu_read_lock include/linux/rcupdate.h:838 [inline] #0: ffffffff8e3c80c0 (rcu_read_lock){....}-{1:3}, at: debug_show_all_locks+0x2e/0x180 kernel/locking/lockdep.c:6777 5 locks held by kworker/u8:6/163: #0: ffff8880339d3938 ((wq_completion)bat_events){+.+.}-{0:0}, at: process_one_work kernel/workqueue.c:3280 [inline] #0: ffff8880339d3938 ((wq_completion)bat_events){+.+.}-{0:0}, at: process_scheduled_works+0xa2e/0x1910 kernel/workqueue.c:3399 #1: ffffc90003a07c40 ((work_completion)(&(&bat_priv->dat.work)->work)){+.+.}-{0:0}, at: process_one_work kernel/workqueue.c:3281 [inline] #1: ffffc90003a07c40 ((work_completion)(&(&bat_priv->dat.work)->work)){+.+.}-{0:0}, at: process_scheduled_works+0xa69/0x1910 kernel/workqueue.c:3399 #2: ffffffff8e25f260 (local_bh){.+.+}-{1:3}, at: __local_bh_disable_ip+0x3c/0x420 kernel/softirq.c:163 #3: ffffffff8e3c80c0 (rcu_read_lock){....}-{1:3}, at: __local_bh_disable_ip+0x3c/0x420 kernel/softirq.c:163 #4: ffff88805daf1858 (&hash->list_locks[i]){+...}-{3:3}, at: spin_lock_bh include/linux/spinlock_rt.h:90 [inline] #4: ffff88805daf1858 (&hash->list_locks[i]){+...}-{3:3}, at: __batadv_dat_purge+0x131/0x400 net/batman-adv/distributed-arp-table.c:173 2 locks held by getty/5582: #0: ffff888037ef60a0 (&tty->ldisc_sem){++++}-{0:0}, at: tty_ldisc_ref_wait+0x25/0x70 drivers/tty/tty_ldisc.c:243 #1: ffffc90003cbb2e0 (&ldata->atomic_read_lock){+.+.}-{4:4}, at: n_tty_read+0x462/0x13a0 drivers/tty/n_tty.c:2211 1 lock held by syz-executor/6024: #0: ffff88803b3680d0 (&type->s_umount_key#55){+.+.}-{4:4}, at: __super_lock fs/super.c:58 [inline] #0: ffff88803b3680d0 (&type->s_umount_key#55){+.+.}-{4:4}, at: __super_lock_excl fs/super.c:73 [inline] #0: ffff88803b3680d0 (&type->s_umount_key#55){+.+.}-{4:4}, at: deactivate_super+0xa9/0xe0 fs/super.c:508 1 lock held by syz-executor/6164: #0: ffff888059e960d0 (&type->s_umount_key#55){+.+.}-{4:4}, at: __super_lock fs/super.c:58 [inline] #0: ffff888059e960d0 (&type->s_umount_key#55){+.+.}-{4:4}, at: __super_lock_excl fs/super.c:73 [inline] #0: ffff888059e960d0 (&type->s_umount_key#55){+.+.}-{4:4}, at: deactivate_super+0xa9/0xe0 fs/super.c:508 1 lock held by syz-executor/6193: #0: ffff888034ce60d0 (&type->s_umount_key#55){+.+.}-{4:4}, at: __super_lock fs/super.c:58 [inline] #0: ffff888034ce60d0 (&type->s_umount_key#55){+.+.}-{4:4}, at: __super_lock_excl fs/super.c:73 [inline] #0: ffff888034ce60d0 (&type->s_umount_key#55){+.+.}-{4:4}, at: deactivate_super+0xa9/0xe0 fs/super.c:508 1 lock held by syz-executor/6215: #0: ffff88805c4280d0 (&type->s_umount_key#55){+.+.}-{4:4}, at: __super_lock fs/super.c:58 [inline] #0: ffff88805c4280d0 (&type->s_umount_key#55){+.+.}-{4:4}, at: __super_lock_excl fs/super.c:73 [inline] #0: ffff88805c4280d0 (&type->s_umount_key#55){+.+.}-{4:4}, at: deactivate_super+0xa9/0xe0 fs/super.c:508 1 lock held by syz-executor/6237: #0: ffff888036fd00d0 (&type->s_umount_key#55){+.+.}-{4:4}, at: __super_lock fs/super.c:58 [inline] #0: ffff888036fd00d0 (&type->s_umount_key#55){+.+.}-{4:4}, at: __super_lock_excl fs/super.c:73 [inline] #0: ffff888036fd00d0 (&type->s_umount_key#55){+.+.}-{4:4}, at: deactivate_super+0xa9/0xe0 fs/super.c:508 1 lock held by syz-executor/6268: #0: ffff888045b380d0 (&type->s_umount_key#55){+.+.}-{4:4}, at: __super_lock fs/super.c:58 [inline] #0: ffff888045b380d0 (&type->s_umount_key#55){+.+.}-{4:4}, at: __super_lock_excl fs/super.c:73 [inline] #0: ffff888045b380d0 (&type->s_umount_key#55){+.+.}-{4:4}, at: deactivate_super+0xa9/0xe0 fs/super.c:508 1 lock held by syz-executor/6301: #0: ffff888025e0a0d0 (&type->s_umount_key#55){+.+.}-{4:4}, at: __super_lock fs/super.c:58 [inline] #0: ffff888025e0a0d0 (&type->s_umount_key#55){+.+.}-{4:4}, at: __super_lock_excl fs/super.c:73 [inline] #0: ffff888025e0a0d0 (&type->s_umount_key#55){+.+.}-{4:4}, at: deactivate_super+0xa9/0xe0 fs/super.c:508 1 lock held by syz-executor/6330: #0: ffff8880213880d0 (&type->s_umount_key#55){+.+.}-{4:4}, at: __super_lock fs/super.c:58 [inline] #0: ffff8880213880d0 (&type->s_umount_key#55){+.+.}-{4:4}, at: __super_lock_excl fs/super.c:73 [inline] #0: ffff8880213880d0 (&type->s_umount_key#55){+.+.}-{4:4}, at: deactivate_super+0xa9/0xe0 fs/super.c:508 1 lock held by syz-executor/6359: #0: ffff88804ecca0d0 (&type->s_umount_key#55){+.+.}-{4:4}, at: __super_lock fs/super.c:58 [inline] #0: ffff88804ecca0d0 (&type->s_umount_key#55){+.+.}-{4:4}, at: __super_lock_excl fs/super.c:73 [inline] #0: ffff88804ecca0d0 (&type->s_umount_key#55){+.+.}-{4:4}, at: deactivate_super+0xa9/0xe0 fs/super.c:508 3 locks held by syz-executor/6396: #0: ffffffff8eec8948 (&ops->srcu#2){.+.+}-{0:0}, at: rcu_lock_acquire include/linux/rcupdate.h:300 [inline] #0: ffffffff8eec8948 (&ops->srcu#2){.+.+}-{0:0}, at: rcu_read_lock include/linux/rcupdate.h:838 [inline] #0: ffffffff8eec8948 (&ops->srcu#2){.+.+}-{0:0}, at: rtnl_link_ops_get+0x23/0x250 net/core/rtnetlink.c:570 #1: ffffffff8f79f5f8 (rtnl_mutex){+.+.}-{4:4}, at: rtnl_lock net/core/rtnetlink.c:80 [inline] #1: ffffffff8f79f5f8 (rtnl_mutex){+.+.}-{4:4}, at: rtnl_nets_lock net/core/rtnetlink.c:341 [inline] #1: ffffffff8f79f5f8 (rtnl_mutex){+.+.}-{4:4}, at: rtnl_newlink+0x883/0x1bb0 net/core/rtnetlink.c:4107 #2: ffffffff8e3c80c0 (rcu_read_lock){....}-{1:3}, at: rcu_lock_acquire include/linux/rcupdate.h:300 [inline] #2: ffffffff8e3c80c0 (rcu_read_lock){....}-{1:3}, at: rcu_read_lock include/linux/rcupdate.h:838 [inline] #2: ffffffff8e3c80c0 (rcu_read_lock){....}-{1:3}, at: class_rcu_constructor include/linux/rcupdate.h:1181 [inline] #2: ffffffff8e3c80c0 (rcu_read_lock){....}-{1:3}, at: unwind_next_frame+0xa6/0x2550 arch/x86/kernel/unwind_orc.c:495 ============================================= NMI backtrace for cpu 1 CPU: 1 UID: 0 PID: 38 Comm: khungtaskd Not tainted syzkaller #0 PREEMPT_{RT,(full)} Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 03/18/2026 Call Trace: dump_stack_lvl+0xe8/0x150 lib/dump_stack.c:120 nmi_cpu_backtrace+0x274/0x2d0 lib/nmi_backtrace.c:113 nmi_trigger_cpumask_backtrace+0x17a/0x300 lib/nmi_backtrace.c:62 trigger_all_cpu_backtrace include/linux/nmi.h:162 [inline] __sys_info lib/sys_info.c:157 [inline] sys_info+0x135/0x170 lib/sys_info.c:165 check_hung_uninterruptible_tasks kernel/hung_task.c:353 [inline] watchdog+0xfd3/0x1030 kernel/hung_task.c:561 kthread+0x388/0x470 kernel/kthread.c:436 ret_from_fork+0x514/0xb70 arch/x86/kernel/process.c:158 ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:245 Sending NMI from CPU 1 to CPUs 0: NMI backtrace for cpu 0 CPU: 0 UID: 0 PID: 6396 Comm: syz-executor Not tainted syzkaller #0 PREEMPT_{RT,(full)} Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 03/18/2026 RIP: 0010:match_held_lock+0x2/0xb0 kernel/locking/lockdep.c:5307 Code: 0f b9 3a 90 31 db 48 89 d8 5b 41 5e 41 5f e9 15 be 03 00 cc 0f 1f 40 00 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 41 56 <53> bb 01 00 00 00 48 39 77 10 74 6a 81 7f 20 00 00 20 00 72 5f 48 RSP: 0018:ffffc90004666ae8 EFLAGS: 00000083 RAX: 0000000000000005 RBX: ffff8880380749a0 RCX: 0000000000000046 RDX: 0000000000000000 RSI: ffffffff8e3c80c0 RDI: ffff8880380749a0 RBP: 00000000ffffffff R08: 0000000000000000 R09: 0000000000000000 R10: dffffc0000000000 R11: fffffbfff1f9e17f R12: 0000000000000246 R13: ffff888038073d80 R14: ffffffff8e3c80c0 R15: 0000000000000001 FS: 000055558214c500(0000) GS:ffff888125a6b000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: 00007fdc7fe40e9c CR3: 0000000035fd6000 CR4: 00000000003526f0 Call Trace: __lock_is_held kernel/locking/lockdep.c:5603 [inline] lock_is_held_type+0x89/0x150 kernel/locking/lockdep.c:5942 kernfs_root+0xf6/0x230 fs/kernfs/kernfs-internal.h:75 kernfs_link_sibling+0x570/0x5c0 fs/kernfs/dir.c:415 kernfs_add_one+0x1ca/0x5c0 fs/kernfs/dir.c:845 __kernfs_create_file+0x22b/0x2e0 fs/kernfs/file.c:1086 sysfs_add_file_mode_ns+0x238/0x300 fs/sysfs/file.c:313 create_files fs/sysfs/group.c:82 [inline] internal_create_group+0x673/0x1180 fs/sysfs/group.c:189 internal_create_groups fs/sysfs/group.c:229 [inline] sysfs_create_groups+0x59/0x120 fs/sysfs/group.c:255 device_add_groups drivers/base/core.c:2837 [inline] device_add_attrs+0xdd/0x5b0 drivers/base/core.c:2901 device_add+0x496/0xbb0 drivers/base/core.c:3645 netdev_register_kobject+0x178/0x310 net/core/net-sysfs.c:2343 register_netdevice+0x12d7/0x1d10 net/core/dev.c:11470 ipvlan_link_new+0x3e9/0xa70 drivers/net/ipvlan/ipvlan_main.c:593 rtnl_newlink_create+0x329/0xb70 net/core/rtnetlink.c:3862 __rtnl_newlink net/core/rtnetlink.c:3993 [inline] rtnl_newlink+0x166a/0x1bb0 net/core/rtnetlink.c:4108 rtnetlink_rcv_msg+0x7d5/0xbe0 net/core/rtnetlink.c:6994 netlink_rcv_skb+0x232/0x4b0 net/netlink/af_netlink.c:2550 netlink_unicast_kernel net/netlink/af_netlink.c:1318 [inline] netlink_unicast+0x780/0x920 net/netlink/af_netlink.c:1344 netlink_sendmsg+0x813/0xb40 net/netlink/af_netlink.c:1894 sock_sendmsg_nosec net/socket.c:786 [inline] __sock_sendmsg net/socket.c:801 [inline] __sys_sendto+0x67f/0x710 net/socket.c:2264 __do_sys_sendto net/socket.c:2271 [inline] __se_sys_sendto net/socket.c:2267 [inline] __x64_sys_sendto+0xde/0x100 net/socket.c:2267 do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline] do_syscall_64+0x15f/0xf80 arch/x86/entry/syscall_64.c:94 entry_SYSCALL_64_after_hwframe+0x77/0x7f RIP: 0033:0x7efff8d1d04e Code: 08 0f 85 a5 a8 ff ff 49 89 fb 48 89 f0 48 89 d7 48 89 ce 4c 89 c2 4d 89 ca 4c 8b 44 24 08 4c 8b 4c 24 10 4c 89 5c 24 08 0f 05 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 80 00 00 00 00 48 83 ec 08 RSP: 002b:00007fffde05f5b8 EFLAGS: 00000246 ORIG_RAX: 000000000000002c RAX: ffffffffffffffda RBX: 000055558214c500 RCX: 00007efff8d1d04e RDX: 0000000000000068 RSI: 00007efff9b04670 RDI: 0000000000000003 RBP: 0000000000000001 R08: 00007fffde05f634 R09: 000000000000000c R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000003 R13: 0000000000000000 R14: 00007efff9b04670 R15: 0000000000000000 final repro crashed as (corrupted=false): I[ 388.859854][ T38] INFO: task syz-executor:6024 blocked for more than 143 seconds. Not tainted syzkaller #0 "echo 0 > /proc/sys/kernel/hung_task_timeout_secs" disables this message. task:syz-executor state:D stack:21912 pid:6024 tgid:6024 ppid:1 task_flags:0x400140 flags:0x00080002 Call Trace: context_switch kernel/sched/core.c:5387 [inline] __schedule+0x169e/0x54f0 kernel/sched/core.c:7188 __schedule_loop kernel/sched/core.c:7267 [inline] schedule+0x164/0x360 kernel/sched/core.c:7282 fuse_chan_wait_aborted+0x15b/0x250 fs/fuse/dev.c:2212 fuse_conn_destroy+0x1e7/0x3e0 fs/fuse/inode.c:1969 fuse_sb_destroy fs/fuse/inode.c:1988 [inline] fuse_kill_sb_anon+0x1ef/0x270 fs/fuse/inode.c:2001 deactivate_locked_super+0xbc/0x130 fs/super.c:476 cleanup_mnt+0x437/0x4d0 fs/namespace.c:1312 task_work_run+0x1d9/0x270 kernel/task_work.c:233 resume_user_mode_work include/linux/resume_user_mode.h:50 [inline] __exit_to_user_mode_loop kernel/entry/common.c:67 [inline] exit_to_user_mode_loop+0xed/0x480 kernel/entry/common.c:98 __exit_to_user_mode_prepare include/linux/irq-entry-common.h:207 [inline] syscall_exit_to_user_mode_prepare include/linux/irq-entry-common.h:238 [inline] syscall_exit_to_user_mode include/linux/entry-common.h:328 [inline] do_syscall_64+0x33e/0xf80 arch/x86/entry/syscall_64.c:100 entry_SYSCALL_64_after_hwframe+0x77/0x7f RIP: 0033:0x7fdebeb4da57 RSP: 002b:00007fff9c868808 EFLAGS: 00000246 ORIG_RAX: 00000000000000a6 RAX: 0000000000000000 RBX: 00007fdebebe2048 RCX: 00007fdebeb4da57 RDX: 0000000000000000 RSI: 0000000000000009 RDI: 00007fff9c8688c0 RBP: 00007fff9c8688c0 R08: 00007fff9c8698c0 R09: 00000000ffffffff R10: 0000000000000000 R11: 0000000000000246 R12: 00007fff9c869950 R13: 00007fdebebe2048 R14: 0000000000037d82 R15: 00007fff9c869990 Showing all locks held in the system: 1 lock held by khungtaskd/38: #0: ffffffff8e3c80c0 (rcu_read_lock){....}-{1:3}, at: rcu_lock_acquire include/linux/rcupdate.h:300 [inline] #0: ffffffff8e3c80c0 (rcu_read_lock){....}-{1:3}, at: rcu_read_lock include/linux/rcupdate.h:838 [inline] #0: ffffffff8e3c80c0 (rcu_read_lock){....}-{1:3}, at: debug_show_all_locks+0x2e/0x180 kernel/locking/lockdep.c:6777 5 locks held by kworker/u8:6/163: #0: ffff8880339d3938 ((wq_completion)bat_events){+.+.}-{0:0}, at: process_one_work kernel/workqueue.c:3280 [inline] #0: ffff8880339d3938 ((wq_completion)bat_events){+.+.}-{0:0}, at: process_scheduled_works+0xa2e/0x1910 kernel/workqueue.c:3399 #1: ffffc90003a07c40 ((work_completion)(&(&bat_priv->dat.work)->work)){+.+.}-{0:0}, at: process_one_work kernel/workqueue.c:3281 [inline] #1: ffffc90003a07c40 ((work_completion)(&(&bat_priv->dat.work)->work)){+.+.}-{0:0}, at: process_scheduled_works+0xa69/0x1910 kernel/workqueue.c:3399 #2: ffffffff8e25f260 (local_bh){.+.+}-{1:3}, at: __local_bh_disable_ip+0x3c/0x420 kernel/softirq.c:163 #3: ffffffff8e3c80c0 (rcu_read_lock){....}-{1:3}, at: __local_bh_disable_ip+0x3c/0x420 kernel/softirq.c:163 #4: ffff88805daf1858 (&hash->list_locks[i]){+...}-{3:3}, at: spin_lock_bh include/linux/spinlock_rt.h:90 [inline] #4: ffff88805daf1858 (&hash->list_locks[i]){+...}-{3:3}, at: __batadv_dat_purge+0x131/0x400 net/batman-adv/distributed-arp-table.c:173 2 locks held by getty/5582: #0: ffff888037ef60a0 (&tty->ldisc_sem){++++}-{0:0}, at: tty_ldisc_ref_wait+0x25/0x70 drivers/tty/tty_ldisc.c:243 #1: ffffc90003cbb2e0 (&ldata->atomic_read_lock){+.+.}-{4:4}, at: n_tty_read+0x462/0x13a0 drivers/tty/n_tty.c:2211 1 lock held by syz-executor/6024: #0: ffff88803b3680d0 (&type->s_umount_key#55){+.+.}-{4:4}, at: __super_lock fs/super.c:58 [inline] #0: ffff88803b3680d0 (&type->s_umount_key#55){+.+.}-{4:4}, at: __super_lock_excl fs/super.c:73 [inline] #0: ffff88803b3680d0 (&type->s_umount_key#55){+.+.}-{4:4}, at: deactivate_super+0xa9/0xe0 fs/super.c:508 1 lock held by syz-executor/6164: #0: ffff888059e960d0 (&type->s_umount_key#55){+.+.}-{4:4}, at: __super_lock fs/super.c:58 [inline] #0: ffff888059e960d0 (&type->s_umount_key#55){+.+.}-{4:4}, at: __super_lock_excl fs/super.c:73 [inline] #0: ffff888059e960d0 (&type->s_umount_key#55){+.+.}-{4:4}, at: deactivate_super+0xa9/0xe0 fs/super.c:508 1 lock held by syz-executor/6193: #0: ffff888034ce60d0 (&type->s_umount_key#55){+.+.}-{4:4}, at: __super_lock fs/super.c:58 [inline] #0: ffff888034ce60d0 (&type->s_umount_key#55){+.+.}-{4:4}, at: __super_lock_excl fs/super.c:73 [inline] #0: ffff888034ce60d0 (&type->s_umount_key#55){+.+.}-{4:4}, at: deactivate_super+0xa9/0xe0 fs/super.c:508 1 lock held by syz-executor/6215: #0: ffff88805c4280d0 (&type->s_umount_key#55){+.+.}-{4:4}, at: __super_lock fs/super.c:58 [inline] #0: ffff88805c4280d0 (&type->s_umount_key#55){+.+.}-{4:4}, at: __super_lock_excl fs/super.c:73 [inline] #0: ffff88805c4280d0 (&type->s_umount_key#55){+.+.}-{4:4}, at: deactivate_super+0xa9/0xe0 fs/super.c:508 1 lock held by syz-executor/6237: #0: ffff888036fd00d0 (&type->s_umount_key#55){+.+.}-{4:4}, at: __super_lock fs/super.c:58 [inline] #0: ffff888036fd00d0 (&type->s_umount_key#55){+.+.}-{4:4}, at: __super_lock_excl fs/super.c:73 [inline] #0: ffff888036fd00d0 (&type->s_umount_key#55){+.+.}-{4:4}, at: deactivate_super+0xa9/0xe0 fs/super.c:508 1 lock held by syz-executor/6268: #0: ffff888045b380d0 (&type->s_umount_key#55){+.+.}-{4:4}, at: __super_lock fs/super.c:58 [inline] #0: ffff888045b380d0 (&type->s_umount_key#55){+.+.}-{4:4}, at: __super_lock_excl fs/super.c:73 [inline] #0: ffff888045b380d0 (&type->s_umount_key#55){+.+.}-{4:4}, at: deactivate_super+0xa9/0xe0 fs/super.c:508 1 lock held by syz-executor/6301: #0: ffff888025e0a0d0 (&type->s_umount_key#55){+.+.}-{4:4}, at: __super_lock fs/super.c:58 [inline] #0: ffff888025e0a0d0 (&type->s_umount_key#55){+.+.}-{4:4}, at: __super_lock_excl fs/super.c:73 [inline] #0: ffff888025e0a0d0 (&type->s_umount_key#55){+.+.}-{4:4}, at: deactivate_super+0xa9/0xe0 fs/super.c:508 1 lock held by syz-executor/6330: #0: ffff8880213880d0 (&type->s_umount_key#55){+.+.}-{4:4}, at: __super_lock fs/super.c:58 [inline] #0: ffff8880213880d0 (&type->s_umount_key#55){+.+.}-{4:4}, at: __super_lock_excl fs/super.c:73 [inline] #0: ffff8880213880d0 (&type->s_umount_key#55){+.+.}-{4:4}, at: deactivate_super+0xa9/0xe0 fs/super.c:508 1 lock held by syz-executor/6359: #0: ffff88804ecca0d0 (&type->s_umount_key#55){+.+.}-{4:4}, at: __super_lock fs/super.c:58 [inline] #0: ffff88804ecca0d0 (&type->s_umount_key#55){+.+.}-{4:4}, at: __super_lock_excl fs/super.c:73 [inline] #0: ffff88804ecca0d0 (&type->s_umount_key#55){+.+.}-{4:4}, at: deactivate_super+0xa9/0xe0 fs/super.c:508 3 locks held by syz-executor/6396: #0: ffffffff8eec8948 (&ops->srcu#2){.+.+}-{0:0}, at: rcu_lock_acquire include/linux/rcupdate.h:300 [inline] #0: ffffffff8eec8948 (&ops->srcu#2){.+.+}-{0:0}, at: rcu_read_lock include/linux/rcupdate.h:838 [inline] #0: ffffffff8eec8948 (&ops->srcu#2){.+.+}-{0:0}, at: rtnl_link_ops_get+0x23/0x250 net/core/rtnetlink.c:570 #1: ffffffff8f79f5f8 (rtnl_mutex){+.+.}-{4:4}, at: rtnl_lock net/core/rtnetlink.c:80 [inline] #1: ffffffff8f79f5f8 (rtnl_mutex){+.+.}-{4:4}, at: rtnl_nets_lock net/core/rtnetlink.c:341 [inline] #1: ffffffff8f79f5f8 (rtnl_mutex){+.+.}-{4:4}, at: rtnl_newlink+0x883/0x1bb0 net/core/rtnetlink.c:4107 #2: ffffffff8e3c80c0 (rcu_read_lock){....}-{1:3}, at: rcu_lock_acquire include/linux/rcupdate.h:300 [inline] #2: ffffffff8e3c80c0 (rcu_read_lock){....}-{1:3}, at: rcu_read_lock include/linux/rcupdate.h:838 [inline] #2: ffffffff8e3c80c0 (rcu_read_lock){....}-{1:3}, at: class_rcu_constructor include/linux/rcupdate.h:1181 [inline] #2: ffffffff8e3c80c0 (rcu_read_lock){....}-{1:3}, at: unwind_next_frame+0xa6/0x2550 arch/x86/kernel/unwind_orc.c:495 ============================================= NMI backtrace for cpu 1 CPU: 1 UID: 0 PID: 38 Comm: khungtaskd Not tainted syzkaller #0 PREEMPT_{RT,(full)} Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 03/18/2026 Call Trace: dump_stack_lvl+0xe8/0x150 lib/dump_stack.c:120 nmi_cpu_backtrace+0x274/0x2d0 lib/nmi_backtrace.c:113 nmi_trigger_cpumask_backtrace+0x17a/0x300 lib/nmi_backtrace.c:62 trigger_all_cpu_backtrace include/linux/nmi.h:162 [inline] __sys_info lib/sys_info.c:157 [inline] sys_info+0x135/0x170 lib/sys_info.c:165 check_hung_uninterruptible_tasks kernel/hung_task.c:353 [inline] watchdog+0xfd3/0x1030 kernel/hung_task.c:561 kthread+0x388/0x470 kernel/kthread.c:436 ret_from_fork+0x514/0xb70 arch/x86/kernel/process.c:158 ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:245 Sending NMI from CPU 1 to CPUs 0: NMI backtrace for cpu 0 CPU: 0 UID: 0 PID: 6396 Comm: syz-executor Not tainted syzkaller #0 PREEMPT_{RT,(full)} Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 03/18/2026 RIP: 0010:match_held_lock+0x2/0xb0 kernel/locking/lockdep.c:5307 Code: 0f b9 3a 90 31 db 48 89 d8 5b 41 5e 41 5f e9 15 be 03 00 cc 0f 1f 40 00 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 41 56 <53> bb 01 00 00 00 48 39 77 10 74 6a 81 7f 20 00 00 20 00 72 5f 48 RSP: 0018:ffffc90004666ae8 EFLAGS: 00000083 RAX: 0000000000000005 RBX: ffff8880380749a0 RCX: 0000000000000046 RDX: 0000000000000000 RSI: ffffffff8e3c80c0 RDI: ffff8880380749a0 RBP: 00000000ffffffff R08: 0000000000000000 R09: 0000000000000000 R10: dffffc0000000000 R11: fffffbfff1f9e17f R12: 0000000000000246 R13: ffff888038073d80 R14: ffffffff8e3c80c0 R15: 0000000000000001 FS: 000055558214c500(0000) GS:ffff888125a6b000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: 00007fdc7fe40e9c CR3: 0000000035fd6000 CR4: 00000000003526f0 Call Trace: __lock_is_held kernel/locking/lockdep.c:5603 [inline] lock_is_held_type+0x89/0x150 kernel/locking/lockdep.c:5942 kernfs_root+0xf6/0x230 fs/kernfs/kernfs-internal.h:75 kernfs_link_sibling+0x570/0x5c0 fs/kernfs/dir.c:415 kernfs_add_one+0x1ca/0x5c0 fs/kernfs/dir.c:845 __kernfs_create_file+0x22b/0x2e0 fs/kernfs/file.c:1086 sysfs_add_file_mode_ns+0x238/0x300 fs/sysfs/file.c:313 create_files fs/sysfs/group.c:82 [inline] internal_create_group+0x673/0x1180 fs/sysfs/group.c:189 internal_create_groups fs/sysfs/group.c:229 [inline] sysfs_create_groups+0x59/0x120 fs/sysfs/group.c:255 device_add_groups drivers/base/core.c:2837 [inline] device_add_attrs+0xdd/0x5b0 drivers/base/core.c:2901 device_add+0x496/0xbb0 drivers/base/core.c:3645 netdev_register_kobject+0x178/0x310 net/core/net-sysfs.c:2343 register_netdevice+0x12d7/0x1d10 net/core/dev.c:11470 ipvlan_link_new+0x3e9/0xa70 drivers/net/ipvlan/ipvlan_main.c:593 rtnl_newlink_create+0x329/0xb70 net/core/rtnetlink.c:3862 __rtnl_newlink net/core/rtnetlink.c:3993 [inline] rtnl_newlink+0x166a/0x1bb0 net/core/rtnetlink.c:4108 rtnetlink_rcv_msg+0x7d5/0xbe0 net/core/rtnetlink.c:6994 netlink_rcv_skb+0x232/0x4b0 net/netlink/af_netlink.c:2550 netlink_unicast_kernel net/netlink/af_netlink.c:1318 [inline] netlink_unicast+0x780/0x920 net/netlink/af_netlink.c:1344 netlink_sendmsg+0x813/0xb40 net/netlink/af_netlink.c:1894 sock_sendmsg_nosec net/socket.c:786 [inline] __sock_sendmsg net/socket.c:801 [inline] __sys_sendto+0x67f/0x710 net/socket.c:2264 __do_sys_sendto net/socket.c:2271 [inline] __se_sys_sendto net/socket.c:2267 [inline] __x64_sys_sendto+0xde/0x100 net/socket.c:2267 do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline] do_syscall_64+0x15f/0xf80 arch/x86/entry/syscall_64.c:94 entry_SYSCALL_64_after_hwframe+0x77/0x7f RIP: 0033:0x7efff8d1d04e Code: 08 0f 85 a5 a8 ff ff 49 89 fb 48 89 f0 48 89 d7 48 89 ce 4c 89 c2 4d 89 ca 4c 8b 44 24 08 4c 8b 4c 24 10 4c 89 5c 24 08 0f 05 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 80 00 00 00 00 48 83 ec 08 RSP: 002b:00007fffde05f5b8 EFLAGS: 00000246 ORIG_RAX: 000000000000002c RAX: ffffffffffffffda RBX: 000055558214c500 RCX: 00007efff8d1d04e RDX: 0000000000000068 RSI: 00007efff9b04670 RDI: 0000000000000003 RBP: 0000000000000001 R08: 00007fffde05f634 R09: 000000000000000c R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000003 R13: 0000000000000000 R14: 00007efff9b04670 R15: 0000000000000000