Extracting prog: 2h48m39.250142308s Minimizing prog: 28m10.203737709s Simplifying prog options: 3m14.74871688s Extracting C: 1m5.314304376s Simplifying C: 0s extracting reproducer from 67 programs first checking the prog from the crash report single: executing 1 programs separately with timeout 30s testing program (duration=30s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_open_dev$dri-ioctl$DRM_IOCTL_MODE_CREATE_DUMB-ioctl$DRM_IOCTL_MODE_CREATE_DUMB-ioctl$DRM_IOCTL_PANTHOR_VM_CREATE-socket$kcm-socket$nl_route-socket-getsockname$packet-sendmsg$nl_route-sendmsg$IPSET_CMD_ADD-sendmsg$IPSET_CMD_TEST-socket$inet6_udp-socket-socket-mkdirat-mount-mkdirat-mkdirat-mkdirat-openat-write-write$P9_RVERSION-syz_usb_connect$midi-socket$nl_route-ioctl$ifreq_SIOCGIFINDEX_vcan-getuid-socket$nl_netfilter-sendmsg$IPSET_CMD_CREATE-socket$nl_netfilter-sendmsg$IPSET_CMD_ADD detailed listing: executing program 0: r0 = syz_open_dev$dri(&(0x7f0000000000), 0x0, 0x0) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r0, 0xc02064b2, &(0x7f0000000040)={0x1, 0xd00, 0x6}) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r0, 0xc02064b2, &(0x7f0000000100)={0x1, 0x3, 0x9}) ioctl$DRM_IOCTL_PANTHOR_VM_CREATE(r0, 0xc0106441, &(0x7f0000000080)={0x0, 0x0, 0xffffffffffffffff}) socket$kcm(0xa, 0x2, 0x0) socket$nl_route(0x10, 0x3, 0x0) r1 = socket(0x10, 0x3, 0x0) getsockname$packet(r1, &(0x7f00000002c0)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000100)=0x14) sendmsg$nl_route(0xffffffffffffffff, &(0x7f0000000040)={0x0, 0x0, 0x0}, 0x0) sendmsg$IPSET_CMD_ADD(0xffffffffffffffff, 0x0, 0x0) sendmsg$IPSET_CMD_TEST(0xffffffffffffffff, &(0x7f0000000280)={0x0, 0x0, &(0x7f00000002c0)={&(0x7f0000000300)={0x48, 0xb, 0x6, 0x1, 0x0, 0x0, {0x2}, [@IPSET_ATTR_SETNAME={0x9, 0x2, 'syz1\x00'}, @IPSET_ATTR_DATA={0x28, 0x7, 0x0, 0x1, [@IPSET_ATTR_IP={0xc, 0x1, 0x0, 0x1, @IPSET_ATTR_IPADDR_IPV4={0x8, 0x1, 0x1, 0x0, @local}}, @IPSET_ATTR_PORT={0x6, 0x4, 0x1, 0x0, 0x5000}, @IPSET_ATTR_MARK={0x8, 0xa, 0x1, 0x0, 0xc}, @IPSET_ATTR_CIDR2={0x5, 0x15, 0x18}]}]}, 0x48}}, 0x0) socket$inet6_udp(0xa, 0x2, 0x0) socket(0x10, 0x803, 0x0) socket(0x10, 0x3, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./config\x00', 0x1ff) mount(0x0, &(0x7f0000000000)='./config\x00', &(0x7f0000000080)='configfs\x00', 0x0, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000140)='./config/usb_gadget/g1\x00', 0xbf) mkdirat(0xffffffffffffff9c, &(0x7f00000001c0)='./config/usb_gadget/g1/functions/uvc.0\x00', 0x1ff) mkdirat(0xffffffffffffff9c, &(0x7f0000000280)='./config/usb_gadget/g1/functions/uvc.0/streaming/mjpeg/m1\x00', 0x1ff) r2 = openat(0xffffffffffffff9c, &(0x7f00000002c0)='./config/usb_gadget/g1/functions/uvc.0/streaming/mjpeg/m1/bmaControls\x00', 0x2, 0x0) write(r2, &(0x7f0000000640)='12', 0x2) write$P9_RVERSION(r2, &(0x7f0000000180)={0x13, 0x65, 0xffff, 0x1017, 0xffffffffffffff96, '9P2000.L'}, 0x13) syz_usb_connect$midi(0x0, 0x4f, &(0x7f0000000280)=ANY=[], 0x0) r3 = socket$nl_route(0x10, 0x3, 0x0) ioctl$ifreq_SIOCGIFINDEX_vcan(r3, 0x8933, &(0x7f0000000040)={'vxcan0\x00'}) getuid() r4 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPSET_CMD_CREATE(r4, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000200)=ANY=[@ANYBLOB="600000000206010800000000000000000000000005000400000000000900020073797a31000000001400078008001240000000000500140008000000050005000a000000050001000600000011000300686173683a69702c706f7274"], 0x60}}, 0x24000800) r5 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPSET_CMD_ADD(r5, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000240)={&(0x7f0000000c80)=ANY=[@ANYBLOB="5c000000090601080000000000000000070000000900020073797a31000000000500010007000000340007801800018014000240fe8000000000000000000000000000bb060004400e1f00cd050007008800000006000540"], 0x5c}, 0x1, 0x0, 0x0, 0x10000042}, 0x90) program did not crash single: failed to extract reproducer bisect: bisecting 67 programs with base timeout 30s testing program (duration=46s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): [11, 3, 3, 4, 30, 12, 5, 12, 30, 30, 11, 30, 3, 40, 40, 30, 6, 30, 27, 23, 8, 8, 13, 25, 30, 22, 7, 10, 30, 9, 16, 16, 30, 20, 40, 40, 26, 9, 15, 26, 19, 5, 5, 19, 30, 13, 6, 9, 28, 21, 30, 26, 8, 20, 14, 30, 16, 4, 12, 11, 5, 25, 11, 30, 30, 4, 7] detailed listing: executing program 32: r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$sock(r0, &(0x7f0000000100)={0x0, 0x0, &(0x7f0000000200)=[{&(0x7f0000000300)="3400000010000104000000000000000000000000000200000000000000000000140012000c000100626172657564700004000200", 0x34}], 0x1}, 0x0) r1 = socket(0x10, 0x3, 0x0) r2 = bpf$MAP_CREATE(0x0, &(0x7f0000000640)=ANY=[@ANYBLOB="170000000000000004000000ff"], 0x48) r3 = bpf$MAP_CREATE(0x0, &(0x7f00000009c0)=ANY=[@ANYBLOB="1b00000000000000000000000080"], 0x50) r4 = bpf$TOKEN_CREATE(0x24, &(0x7f0000000000)={0x0, r3}, 0x8) r5 = pidfd_getfd(0xffffffffffffffff, r4, 0x0) bpf$PROG_LOAD(0x5, &(0x7f0000000240)={0x11, 0x19, &(0x7f0000000040)=ANY=[@ANYRESOCT=r1, @ANYRES32=r3, @ANYBLOB="0000000000000000b70200001400ffb0b7030000000000008500000083000000810000000000000055090100f3ffffff940000000000000018110000", @ANYRES32=r3, @ANYRESHEX=r1], &(0x7f00000000c0)='syzkaller\x00', 0x8, 0x0, 0x0, 0x41100, 0x0, '\x00', 0x0, @fallback=0x3, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, r5, 0x0, 0x0, 0x0, 0x0, 0x5}, 0x94) bpf$MAP_DELETE_ELEM(0x3, &(0x7f0000000340)={r2, &(0x7f0000000400)="af02286954fb794c12dcb477713ae2d5cf878451de6ca54215f79cb8a90c4b5a6f9f2db242ee7799d16f30eb49f92eb130086e6142ae6f311ac72f1c912c0fe8bf4cc8fabad7839aa3cddd6ddb96b9b07d6b8ab4f9f1cb5b000000000000009f6b69daca6920629099f3b0bcabefbf43ad76570ac5b12afb0a7494cfdcdd032c3e8549b7445359ce151f4553ab11592245d1ed2ff82f224d22dd67400e4d79d0792de8039f6b47fd750d2e83eda9eaeaaa656ceda7e7bedd46a2b4a9900aca1ab4f645cd4d43c46ac7afac83dd66f3664a4b392be3273486fbf09de43ff0d8a125e6de4bb07bb13671e724767fb147df4efb2be6acc6b4403f76b177ae13e4b0739c883091ae6ffd2e9c9423a05192a2cf360000000000000000000000ed000000"}, 0x20) ioctl$sock_SIOCGIFINDEX(r1, 0x8933, &(0x7f0000000180)={'erspan0\x00', 0x0}) sendmsg$nl_route_sched(r1, &(0x7f00000007c0)={0x0, 0x0, &(0x7f0000000780)={&(0x7f0000000b00)=@newqdisc={0x78, 0x24, 0xf0b, 0x70bd2b, 0xfffffffd, {0x0, 0x0, 0x0, r6, {0x0, 0x5}, {0xffff, 0xffff}, {0x2}}, [@qdisc_kind_options=@q_netem={{0xa}, {0x48, 0x2, {{0x7fff, 0x7d, 0x192, 0xf, 0x7fff, 0x205}, [@TCA_NETEM_SLOT={0x2c, 0xc, {0x5, 0x8000000001, 0x0, 0x0, 0x1bb, 0x2000000000004}}]}}}]}, 0x78}, 0x1, 0x0, 0x0, 0x45}, 0x4000) executing program 3: syz_emit_ethernet(0xca, &(0x7f0000000180)={@empty, @empty, @void, {@ipv4={0x800, @icmp={{0x15, 0x4, 0x2, 0x7, 0xbc, 0x65, 0x0, 0x4, 0x1, 0x0, @loopback, @multicast1, {[@ssrr={0x89, 0xb, 0x68, [@multicast1, @empty]}, @ra={0x94, 0x4, 0x1}, @noop, @timestamp_prespec={0x44, 0x2c, 0xa1, 0x3, 0xa, [{@remote, 0x8}, {@multicast2, 0x9}, {@private=0xa010100, 0x7fffffff}, {@loopback, 0x4}, {@initdev={0xac, 0x1e, 0x0, 0x0}, 0xb0}]}, @ra={0x94, 0x4, 0x1}]}}, @time_exceeded={0xb, 0x1, 0x0, 0x0, 0x6b, 0x0, {0x17, 0x4, 0x2, 0x9, 0x1, 0x68, 0x200, 0x2, 0x67, 0x2e0, @multicast2, @multicast2, {[@timestamp={0x44, 0x10, 0xa3, 0x0, 0x8, [0xfffff046, 0x9, 0xe]}, @end, @noop, @generic={0x86, 0x9, "50a631770059ca"}, @cipso={0x86, 0x2a, 0x1, [{0x0, 0x12, "62e10654397654944d3e5de72faadfbc"}, {0x5, 0x12, "039c50637f3056caca97576cf21f19a5"}]}]}}, "78febdfd"}}}}}, 0x0) (async) r0 = socket$inet6_sctp(0xa, 0x43c07280f065fb6c, 0x84) sendto$inet6(r0, &(0x7f0000000000)="6a276bf231b9f247dafe01f8465d7bfaa95c7045aea4b490f933cc8558c118069c0ca98b3fd18cce32c39bea70dce43db84d5ef2a1fd06768b0682adfa7f3d1374e3b055d9d575e994e73e85e8078daf2d4df0a8dadad586675aeb965e", 0x5d, 0x0, &(0x7f0000000080)={0xa, 0x4e21, 0x8, @rand_addr=' \x01\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x01', 0x8}, 0x1c) executing program 3: mount$9p_virtio(&(0x7f0000000100), &(0x7f00000000c0)='.\x00', &(0x7f0000000000), 0x0, &(0x7f0000000200)=ANY=[@ANYBLOB='trans=virtio,access=', @ANYRESDEC=0x0, @ANYBLOB="9ef46fbe7c052fdcfccea457059ae544b046bbed1f765e244299de1e386d7848a18c525583c32d0d51c6bc6724e47260a3a1b9722c925117ad3a9487a79c2ccbb2bec2f3e3a95be6ffffffff9f4ab4c39347312b9af5227f15ce4a5c877fd17c23b52823560d15bb6b39a85e7fdbe0737b9058a4efd909"]) r0 = syz_open_procfs(0x0, &(0x7f00000001c0)='mountinfo\x00') read$FUSE(r0, &(0x7f0000002540)={0x2020}, 0x2020) executing program 3: r0 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r0, &(0x7f0000007040)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000000240)=ANY=[@ANYBLOB="140000001000010000000100000000000000000a20000000000a030000000000000000000a00ecff0800010073797a300000000074000000160a010100000000000000000a00000008000740000000014000038008000140000000002c000380140001006e657464657673696d300000000000001400010076657468305f766c616e00000000000008000240000000070900010073797a3000000000090002"], 0xbc}}, 0xc0) (async) pipe2$9p(&(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}, 0x4000) write$P9_RREADDIR(r1, &(0x7f0000000040)={0x24, 0x29, 0x1, {0x8, [{{0x0, 0x4, 0x3}, 0x9, 0x0, 0x1, '.'}]}}, 0x24) executing program 3: mkdirat(0xffffffffffffff9c, &(0x7f0000000100)='./gadget\x00', 0x1ff) mount(0x0, &(0x7f0000000140)='./gadget\x00', &(0x7f0000000180)='gadgetfs\x00', 0x0, 0x0) r0 = openat(0xffffffffffffff9c, &(0x7f00000001c0)='./gadget/dummy_udc\x00', 0x2, 0x0) bpf$MAP_UPDATE_ELEM_TAIL_CALL(0x2, &(0x7f0000000380)={{}, &(0x7f0000000300), &(0x7f0000000340)=r0}, 0x20) mprotect(&(0x7f0000362000/0x2000)=nil, 0x2000, 0x1) write(r0, &(0x7f0000000200)="000000000902190001010080320904000001ff000000070581024000000902190001010080320904000001ff00000007058102000200120100020000004034127856000100000001", 0x48) r1 = openat(0xffffffffffffff9c, &(0x7f0000000000)='./gadget/ep1in-bulk\x00', 0x2, 0x24) write(r1, &(0x7f00000005c0)="010000000705810240000007058102000200", 0x12) r2 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r2, 0x8933, &(0x7f0000000040)={'bridge0\x00', 0x0}) sendmsg$nl_route(r2, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000440)=ANY=[@ANYBLOB="580000001000ffff27bd7000fadbdf2500000000", @ANYRES32=0x0, @ANYBLOB="15010000000000003000128009000100766c616e00000000200002800600050088a8000006000100010000000c000200130000001000000008000500", @ANYRES32=r3], 0x58}, 0x1, 0x0, 0x0, 0x880}, 0x8048802) madvise(&(0x7f0000bdc000/0x4000)=nil, 0x86ac726dff2f4713, 0xa) r4 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) getsockopt$bt_hci(r4, 0x0, 0x3, &(0x7f00000000c0)=""/151, &(0x7f0000000180)=0x97) r5 = syz_open_procfs(0xffffffffffffffff, &(0x7f0000000000)='attr/fscreate\x00') write$P9_RRENAME(r5, 0x0, 0x0) r6 = syz_open_dev$dvb_dvr(&(0x7f0000000280), 0x7, 0x111400) ioctl$DVB_DVR_DMX_EXPBUF(r6, 0xc00c6f3e, &(0x7f0000000040)={0x200, 0x80000, r5}) socket$inet_sctp(0x2, 0x5, 0x84) r7 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000000)='hugetlb.2MB.rsvd.usage_in_bytes\x00', 0x275a, 0x0) mmap(&(0x7f0000215000/0x1000)=nil, 0x1000, 0x0, 0x6011, r7, 0x0) mmap(&(0x7f0000ffa000/0x3000)=nil, 0x3000, 0x200000c, 0x11, r7, 0xaa0f4000) mmap(&(0x7f0000362000/0x4000)=nil, 0x4000, 0x0, 0x12, r7, 0xfffff000) setsockopt$inet_sctp_SCTP_SOCKOPT_BINDX_ADD(r7, 0x84, 0x64, &(0x7f0000000080)=[@in={0x2, 0x4e22, @local}], 0x10) r8 = syz_clone(0x21000200, 0x0, 0x0, 0x0, 0x0, 0x0) rt_tgsigqueueinfo(r8, r8, 0x8, 0x0) r9 = syz_pidfd_open(r8, 0x0) setns(r9, 0x24020000) syz_clone(0xa3802080, 0x0, 0x0, 0x0, 0x0, 0x0) signalfd(r7, &(0x7f00000000c0)={[0xea]}, 0x8) executing program 3: r0 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000280)='cpuacct.usage_percpu\x00', 0x275a, 0x0) r1 = socket$nl_netfilter(0x10, 0x3, 0xc) bpf$PROG_LOAD(0x5, &(0x7f0000000040)={0x1, 0x10, &(0x7f0000000740)=ANY=[], 0x0, 0x0, 0x0, 0x0, 0x41000, 0x2, '\x00', 0x0, @fallback=0x5350a0e2ad0fd2e6, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) r2 = socket(0x840000000002, 0x3, 0x100) setsockopt$inet_buf(r2, 0x0, 0x20, &(0x7f0000000040)="929d547c", 0x4) sendmsg$NFT_BATCH(r1, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000580)=ANY=[@ANYRES8], 0x248}}, 0x0) r3 = openat$fb0(0xffffffffffffff9c, &(0x7f0000000140), 0x1, 0x0) write$fb(r3, &(0x7f0000000000)="0aa06542f1c7481ad05437c9e0425cb6a9dfd45c2f6e6de29e3689bf7ed58a652195950768465b55704cb0bbed6a0ac5ba437025b9dbf3b1b274a5cceb00bffba6d0449ea7a0d3ed7e0ac2b0b853e97f160fded16033a8ec7f7e9071c722676605", 0xffffff18) write$UHID_CREATE2(r0, &(0x7f0000000040)=ANY=[], 0x118) mmap(&(0x7f0000000000/0x2000)=nil, 0x2000, 0x88fd537e5d114b60, 0x4010, r0, 0xa8c0c000) r4 = syz_open_dev$radio(&(0x7f00000000c0), 0xffffffffffffffff, 0x2) readv(r4, &(0x7f0000002b80)=[{&(0x7f00000019c0)=""/4096, 0x1000}], 0x1) executing program 1: r0 = syz_clone(0x11, 0x0, 0x0, 0x0, 0x0, 0x0) ptrace(0x10, r0) ptrace$PTRACE_SECCOMP_GET_METADATA(0x420d, r0, 0x10, &(0x7f0000000040)) r1 = syz_open_procfs$userns(0xffffffffffffffff, &(0x7f0000000080)) ioctl$NS_GET_NSTYPE(r1, 0xb703, 0x0) executing program 1: r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000000), 0x40980, 0x0) ioctl$TIOCSETD(r0, 0x5423, &(0x7f00000000c0)=0xf) (async) ioctl$TCFLSH(r0, 0x400455c8, 0x4) (async) ioctl$TIOCSTI(r0, 0x5412, &(0x7f00000002c0)=0xb2) (async) syslog(0x2, &(0x7f00000001c0)=""/229, 0xe5) setrlimit(0x40000000000008, &(0x7f0000000000)={0x4848, 0xfffffffffffff006}) (async) capset(&(0x7f0000000040)={0x20080522}, &(0x7f0000000080)) mlock2(&(0x7f0000007000/0x2000)=nil, 0x2000, 0x0) mlock2(&(0x7f0000007000/0x4000)=nil, 0x4000, 0x0) getsockopt$SO_TIMESTAMP(0xffffffffffffffff, 0x1, 0x23, &(0x7f0000000080), &(0x7f0000000100)=0x4) (async) r1 = socket$inet_smc(0x2b, 0x1, 0x0) setsockopt$inet_tcp_TCP_QUEUE_SEQ(r1, 0x6, 0x15, &(0x7f0000000040)=0x9, 0x4) executing program 3: r0 = openat$vhost_vsock(0xffffffffffffff9c, &(0x7f0000000000), 0x2, 0x0) ioctl$VHOST_SET_VRING_CALL(r0, 0x4008af21, &(0x7f0000000040)={0x1}) (async) fdatasync(r0) setsockopt$inet6_tcp_TCP_FASTOPEN_KEY(0xffffffffffffffff, 0x6, 0x21, &(0x7f0000000080)="efeb92f1053fbfa7c72c5c9985b4e48e", 0x10) r1 = openat$cgroup_freezer_state(0xffffffffffffffff, &(0x7f00000000c0), 0x2, 0x0) ioctl$BTRFS_IOC_SEND(r0, 0x40489426, &(0x7f0000000140)={{r1}, 0x1, &(0x7f0000000100)=[0x1], 0xfffffffffffffffc, 0xf}) (async) ioctl$VHOST_SET_OWNER(r0, 0xaf01, 0x0) ioctl$FIGETBSZ(r0, 0x2, &(0x7f00000001c0)) (async) r2 = syz_open_dev$tty20(0xc, 0x4, 0x1) ioctl$VT_WAITACTIVE(r2, 0x5607) (async) ioctl$BTRFS_IOC_SUBVOL_CREATE_V2(r2, 0x50009418, &(0x7f0000000280)={{r2}, 0x0, 0x0, @inherit={0x60, &(0x7f0000000200)={0x1, 0x3, 0x10, 0x0, {0x31, 0x100000000, 0xb542, 0x2, 0xffffffffffff0001}, [0x8da8, 0x2, 0x4]}}, @subvolid=0x7}) r3 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) (async) write$RDMA_USER_CM_CMD_CREATE_ID(0xffffffffffffffff, &(0x7f00000012c0)={0x0, 0x18, 0xfa00, {0x4, &(0x7f0000001280), 0x13f, 0x3}}, 0x20) (async) r4 = eventfd2(0x4, 0x800) ioctl$VHOST_NET_SET_BACKEND(0xffffffffffffffff, 0x4008af30, &(0x7f0000001300)={0x3, r4}) ioctl$OCFS2_IOC_RESVSP(r3, 0x40305828, &(0x7f0000001340)={0x1, 0x0, 0x9e0, 0x1, 0xc, 0x1000}) (async) ioctl$XFS_IOC_PATH_TO_HANDLE(r0, 0xc0385869, &(0x7f0000001480)={r3, &(0x7f0000001380)='^%:^+-)\x00', 0x81, &(0x7f00000013c0)={@_ha_fsid={[0x400]}, {0x9, 0x6, 0x0, 0x100000001}}, 0x2, &(0x7f0000001400), &(0x7f0000001440)=0x1}) bind$802154_raw(r5, &(0x7f00000014c0)={0x24, @short={0x2, 0xffff, 0xaaa1}}, 0x14) ioctl$HDIO_GETGEO(r2, 0x301, &(0x7f0000001500)) ioctl$SG_BLKTRACESTART(r5, 0x1274, 0x0) (async) sendmsg$RDMA_NLDEV_CMD_NEWLINK(r5, &(0x7f0000001640)={&(0x7f0000001540)={0x10, 0x0, 0x0, 0x20}, 0xc, &(0x7f0000001600)={&(0x7f0000001580)={0x60, 0x1403, 0x2, 0x70bd25, 0x25dfdbff, "", [{{0x9, 0x2, 'syz0\x00'}, {0x8, 0x41, 'rxe\x00'}, {0x14, 0x33, 'vlan0\x00'}}, {{0x9, 0x2, 'syz2\x00'}, {0x8, 0x41, 'rxe\x00'}, {0x14, 0x33, 'vlan1\x00'}}]}, 0x60}, 0x1, 0x0, 0x0, 0x804}, 0x0) syz_usb_connect$hid(0x6, 0x3f, &(0x7f0000001680)={{0x12, 0x1, 0x201, 0x0, 0x0, 0x0, 0x8, 0x28bd, 0x78, 0x40, 0x1, 0x2, 0x3, 0x1, [{{0x9, 0x2, 0x2d, 0x1, 0x1, 0x82, 0x80, 0x7, "", [{{0x9, 0x4, 0x0, 0xff, 0x2, 0x3, 0x1, 0x1, 0xb6, {0x9, 0x21, 0x5, 0x25, 0x1, {0x22, 0x1c0}}, {{{0x9, 0x5, 0x81, 0x3, 0x200, 0x7f, 0xe, 0x5}}, [{{0x9, 0x5, 0x2, 0x3, 0x20, 0x7f, 0x2a, 0x9}}]}}}]}}]}}, &(0x7f0000001b80)={0xa, &(0x7f00000016c0)={0xa, 0x6, 0x201, 0xff, 0x7, 0x4, 0xd7, 0x54}, 0xaa, &(0x7f0000001700)={0x5, 0xf, 0xaa, 0x6, [@ss_cap={0xa, 0x10, 0x3, 0x2, 0x8, 0x1, 0x5, 0x2}, @generic={0x6e, 0x10, 0x2, "169b7d64f515fcd937925232042e5ed1797408164afc4d6262b196decb682996da78be8ef93d6d4fa1922053d5bf88135a6183d42cc0bce5aebb8752dbe389ad874cbc99a01843098695f3c6909d0da65f7823f9974e9e5944c325e5979360c3197cc26b0e69d1665d14c3"}, @wireless={0xb, 0x10, 0x1, 0x4, 0x10, 0x78, 0x9, 0x0, 0x2}, @ss_container_id={0x14, 0x10, 0x4, 0x7, "eab4d29998765348b33d70e7155dacf7"}, @wireless={0xb, 0x10, 0x1, 0x2, 0x0, 0x4, 0x5, 0x8, 0x8}, @ptm_cap={0x3}]}, 0xa, [{0xf, &(0x7f00000017c0)=@string={0xf, 0x3, "64f982b1475c11107a57dec541"}}, {0x4, &(0x7f0000001800)=@lang_id={0x4, 0x3, 0x180c}}, {0x86, &(0x7f0000001840)=@string={0x86, 0x3, "ec80f05c6d5d3539025786eb2ed2befe3f565018ebe44d461c62b6b478b81c346b324841dce0b37ef3733aba54d6a66df7df77602d045d96f356433ceca9c8ec8eeabb531fef053a09f84e1d9e686626440a2e6cce6dc2be0299ea0a925ee5ef5d80468bdb27da48811b82737887a2db2c8303922f203fad7a3ebe616a7aa252bcfb7bf9"}}, {0x4, &(0x7f0000001900)=@lang_id={0x4, 0x3, 0xf4ff}}, {0x4, &(0x7f0000001940)=@lang_id={0x4, 0x3, 0x406}}, {0x63, &(0x7f0000001980)=@string={0x63, 0x3, "cb513e4356ef0246954b528d2561331efeacaabf9d620e2233525acc7b144771d1725d5271aa5d5ba871d16e17b9a2f19aad62117eaf6a40ea9a2ecad2b9a093d868751afcb36926d42e4d4564ec1a7609be3a8bcc5c598de214f8a0eb0df4d7b5"}}, {0x4c, &(0x7f0000001a00)=@string={0x4c, 0x3, "11a2badf13eca09def275048fafe698bb25a2edb0de068a8d0d726d2ffb5a72d1070068aa93b900cdb085149360ec0c9acc9a8e5e4c05dbb76afdc75d6f7e891884cf31405074d7f831e"}}, {0xe, &(0x7f0000001a80)=@string={0xe, 0x3, "f63dc66d0abc5db1dc0ab9f5"}}, {0x66, &(0x7f0000001ac0)=@string={0x66, 0x3, "d2072b40cdd05fca95476d9f42021694fad871e05acc29babe15c8c22b30e0b876f3502a7e7f1d109ea9ca9ea3a38f3b9898fdcdd456eb594c7312089d959c3bc68e706a0ae9c0f2112b7d8ae03880c43ea3d9b69e274dae748e7f8281d7805947bcdeba"}}, {0x4, &(0x7f0000001b40)=@lang_id={0x4, 0x3, 0x41c}}]}) (async) ioctl$KDDISABIO(r5, 0x4b37) (async) ioctl$AUTOFS_DEV_IOCTL_PROTOSUBVER(r5, 0xc0189373, &(0x7f0000001c40)={{0x1, 0x1, 0x18, r2, {0x3}}, './file0\x00'}) write(r3, &(0x7f0000001c80)="4e5661016ad3de10f0caa8e1b915b8c0c264ae22ff6b9bee96736c92016c1a3ddc67c1963afccd97020105a3e2197dc87d067dced5c630ef6b02ac3d8dd616f9c2755325d318601b390edeedfbc382bd67e96b77c9dad0799ad8e55d048e5ce613c1490111232f4c12f185c52df73c4d0d4968ee2e91b8b15ce3a5c52a80242078b67a94b3bca5b8ca0cb3f4a64b8d156b979fc947b59f6a9a0d4c99be215ef77d3da3066191fae6cb284261ea5bbf113f793c784d1296e3b9da2ff596af14182dc07fee3b8c79228b569c89c8131f6ed8899c68c8039d59f4d2ce5fbae729394234e20e6b084abccc1e2e86435833dd05c25f89b45e945e8cdcdddb216848", 0xff) (async) r7 = syz_genetlink_get_family_id$nl80211(&(0x7f0000001dc0), r5) (async) ioctl$sock_SIOCGIFINDEX_80211(r6, 0x8933, &(0x7f0000001e00)={'wlan0\x00', 0x0}) sendmsg$NL80211_CMD_DEL_STATION(r5, &(0x7f0000002000)={&(0x7f0000001d80)={0x10, 0x0, 0x0, 0x80000}, 0xc, &(0x7f0000001fc0)={&(0x7f0000001e40)={0x170, r7, 0x800, 0x70bd26, 0x25dfdbff, {{}, {@val={0x8, 0x3, r8}, @val={0xc, 0x99, {0x401, 0x5}}}}, [@NL80211_ATTR_STA_EXT_CAPABILITY={0x101, 0xac, "7c8a3c93c470f02ef9d53b1191fc108dbafe6d2060d20e5fe51ee46f3bede438e6c2cde92f6f661030fc8007c3cbc17c6e6594b598d966a8498b1a7314a03e9d30f2e600609ec56fdd7a9caafff35cd6f02491954d1d470d9b1cf86fcbd978834bb6c10670c3670edeae752d1e303ea30e1c63c87de4953dda2dee525e93f8e355cfe823f9de3a0439d8ebff80b10f988655651cfb5b99438d2a78d568264afacf251b4d47e50a293a51dbb5d2eb875feeb22bee65b0b572daa9c0ecd68f83aac988dbf0b8a17235968fd6f1c52d7ebe91f830e3b716c67ca833e137c015f3ac9887b247fb1f960a1eb422207ab9c77491fc1fcd6fe15dd18959753ae9"}, @NL80211_ATTR_STA_TX_POWER={0x6}, @NL80211_ATTR_STA_TX_POWER_SETTING={0x5, 0x113, 0x1}, @NL80211_ATTR_OPMODE_NOTIF={0x5, 0xc2, 0x6}, @NL80211_ATTR_STA_AID={0x6, 0x10, 0x193}, @NL80211_ATTR_STA_WME={0xc, 0x81, [@NL80211_STA_WME_UAPSD_QUEUES={0x5}]}, @NL80211_ATTR_MGMT_SUBTYPE={0x5, 0x29, 0xa}, @NL80211_ATTR_OPMODE_NOTIF={0x5, 0xc2, 0x4}, @NL80211_ATTR_STA_PLINK_ACTION={0x5}]}, 0x170}, 0x1, 0x0, 0x0, 0x10}, 0x10) r9 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$NL80211_CMD_TRIGGER_SCAN(r9, &(0x7f0000002180)={&(0x7f0000002040)={0x10, 0x0, 0x0, 0x4000}, 0xc, &(0x7f0000002140)={&(0x7f0000002080)={0x90, r7, 0x100, 0x70bd2d, 0x25dfdbfd, {{}, {@void, @val={0xc, 0x99, {0x769e3930, 0x3a}}}}, [@NL80211_ATTR_SCAN_SSIDS={0x28, 0x2d, 0x0, 0x1, [{0xa, 0x0, @default_ibss_ssid}, {0xa, 0x0, @default_ap_ssid}, {0xa, 0x0, @default_ibss_ssid}]}, @NL80211_ATTR_SCHED_SCAN_DELAY={0x8, 0xdc, 0x3}, @NL80211_ATTR_SCAN_FREQUENCIES={0x24, 0x2c, 0x0, 0x1, [{0x8, 0x0, 0x8}, {0x8, 0x0, 0x7fffffff}, {0x8, 0x0, 0x401}, {0x8, 0x0, 0x80000000}]}, @NL80211_ATTR_SCHED_SCAN_RELATIVE_RSSI={0x5, 0xf6, 0x9}, @NL80211_ATTR_MEASUREMENT_DURATION_MANDATORY={0x4}, @NL80211_ATTR_MEASUREMENT_DURATION={0x6, 0xeb, 0x2}, @NL80211_ATTR_SCHED_SCAN_INTERVAL={0x8, 0x77, 0x10001}]}, 0x90}, 0x1, 0x0, 0x0, 0x8000}, 0x4001) executing program 33: r0 = openat$vhost_vsock(0xffffffffffffff9c, &(0x7f0000000000), 0x2, 0x0) ioctl$VHOST_SET_VRING_CALL(r0, 0x4008af21, &(0x7f0000000040)={0x1}) (async) fdatasync(r0) setsockopt$inet6_tcp_TCP_FASTOPEN_KEY(0xffffffffffffffff, 0x6, 0x21, &(0x7f0000000080)="efeb92f1053fbfa7c72c5c9985b4e48e", 0x10) r1 = openat$cgroup_freezer_state(0xffffffffffffffff, &(0x7f00000000c0), 0x2, 0x0) ioctl$BTRFS_IOC_SEND(r0, 0x40489426, &(0x7f0000000140)={{r1}, 0x1, &(0x7f0000000100)=[0x1], 0xfffffffffffffffc, 0xf}) (async) ioctl$VHOST_SET_OWNER(r0, 0xaf01, 0x0) ioctl$FIGETBSZ(r0, 0x2, &(0x7f00000001c0)) (async) r2 = syz_open_dev$tty20(0xc, 0x4, 0x1) ioctl$VT_WAITACTIVE(r2, 0x5607) (async) ioctl$BTRFS_IOC_SUBVOL_CREATE_V2(r2, 0x50009418, &(0x7f0000000280)={{r2}, 0x0, 0x0, @inherit={0x60, &(0x7f0000000200)={0x1, 0x3, 0x10, 0x0, {0x31, 0x100000000, 0xb542, 0x2, 0xffffffffffff0001}, [0x8da8, 0x2, 0x4]}}, @subvolid=0x7}) r3 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) (async) write$RDMA_USER_CM_CMD_CREATE_ID(0xffffffffffffffff, &(0x7f00000012c0)={0x0, 0x18, 0xfa00, {0x4, &(0x7f0000001280), 0x13f, 0x3}}, 0x20) (async) r4 = eventfd2(0x4, 0x800) ioctl$VHOST_NET_SET_BACKEND(0xffffffffffffffff, 0x4008af30, &(0x7f0000001300)={0x3, r4}) ioctl$OCFS2_IOC_RESVSP(r3, 0x40305828, &(0x7f0000001340)={0x1, 0x0, 0x9e0, 0x1, 0xc, 0x1000}) (async) ioctl$XFS_IOC_PATH_TO_HANDLE(r0, 0xc0385869, &(0x7f0000001480)={r3, &(0x7f0000001380)='^%:^+-)\x00', 0x81, &(0x7f00000013c0)={@_ha_fsid={[0x400]}, {0x9, 0x6, 0x0, 0x100000001}}, 0x2, &(0x7f0000001400), &(0x7f0000001440)=0x1}) bind$802154_raw(r5, &(0x7f00000014c0)={0x24, @short={0x2, 0xffff, 0xaaa1}}, 0x14) ioctl$HDIO_GETGEO(r2, 0x301, &(0x7f0000001500)) ioctl$SG_BLKTRACESTART(r5, 0x1274, 0x0) (async) sendmsg$RDMA_NLDEV_CMD_NEWLINK(r5, &(0x7f0000001640)={&(0x7f0000001540)={0x10, 0x0, 0x0, 0x20}, 0xc, &(0x7f0000001600)={&(0x7f0000001580)={0x60, 0x1403, 0x2, 0x70bd25, 0x25dfdbff, "", [{{0x9, 0x2, 'syz0\x00'}, {0x8, 0x41, 'rxe\x00'}, {0x14, 0x33, 'vlan0\x00'}}, {{0x9, 0x2, 'syz2\x00'}, {0x8, 0x41, 'rxe\x00'}, {0x14, 0x33, 'vlan1\x00'}}]}, 0x60}, 0x1, 0x0, 0x0, 0x804}, 0x0) syz_usb_connect$hid(0x6, 0x3f, &(0x7f0000001680)={{0x12, 0x1, 0x201, 0x0, 0x0, 0x0, 0x8, 0x28bd, 0x78, 0x40, 0x1, 0x2, 0x3, 0x1, [{{0x9, 0x2, 0x2d, 0x1, 0x1, 0x82, 0x80, 0x7, "", [{{0x9, 0x4, 0x0, 0xff, 0x2, 0x3, 0x1, 0x1, 0xb6, {0x9, 0x21, 0x5, 0x25, 0x1, {0x22, 0x1c0}}, {{{0x9, 0x5, 0x81, 0x3, 0x200, 0x7f, 0xe, 0x5}}, [{{0x9, 0x5, 0x2, 0x3, 0x20, 0x7f, 0x2a, 0x9}}]}}}]}}]}}, &(0x7f0000001b80)={0xa, &(0x7f00000016c0)={0xa, 0x6, 0x201, 0xff, 0x7, 0x4, 0xd7, 0x54}, 0xaa, &(0x7f0000001700)={0x5, 0xf, 0xaa, 0x6, [@ss_cap={0xa, 0x10, 0x3, 0x2, 0x8, 0x1, 0x5, 0x2}, @generic={0x6e, 0x10, 0x2, "169b7d64f515fcd937925232042e5ed1797408164afc4d6262b196decb682996da78be8ef93d6d4fa1922053d5bf88135a6183d42cc0bce5aebb8752dbe389ad874cbc99a01843098695f3c6909d0da65f7823f9974e9e5944c325e5979360c3197cc26b0e69d1665d14c3"}, @wireless={0xb, 0x10, 0x1, 0x4, 0x10, 0x78, 0x9, 0x0, 0x2}, @ss_container_id={0x14, 0x10, 0x4, 0x7, "eab4d29998765348b33d70e7155dacf7"}, @wireless={0xb, 0x10, 0x1, 0x2, 0x0, 0x4, 0x5, 0x8, 0x8}, @ptm_cap={0x3}]}, 0xa, [{0xf, &(0x7f00000017c0)=@string={0xf, 0x3, "64f982b1475c11107a57dec541"}}, {0x4, &(0x7f0000001800)=@lang_id={0x4, 0x3, 0x180c}}, {0x86, &(0x7f0000001840)=@string={0x86, 0x3, "ec80f05c6d5d3539025786eb2ed2befe3f565018ebe44d461c62b6b478b81c346b324841dce0b37ef3733aba54d6a66df7df77602d045d96f356433ceca9c8ec8eeabb531fef053a09f84e1d9e686626440a2e6cce6dc2be0299ea0a925ee5ef5d80468bdb27da48811b82737887a2db2c8303922f203fad7a3ebe616a7aa252bcfb7bf9"}}, {0x4, &(0x7f0000001900)=@lang_id={0x4, 0x3, 0xf4ff}}, {0x4, &(0x7f0000001940)=@lang_id={0x4, 0x3, 0x406}}, {0x63, &(0x7f0000001980)=@string={0x63, 0x3, "cb513e4356ef0246954b528d2561331efeacaabf9d620e2233525acc7b144771d1725d5271aa5d5ba871d16e17b9a2f19aad62117eaf6a40ea9a2ecad2b9a093d868751afcb36926d42e4d4564ec1a7609be3a8bcc5c598de214f8a0eb0df4d7b5"}}, {0x4c, &(0x7f0000001a00)=@string={0x4c, 0x3, "11a2badf13eca09def275048fafe698bb25a2edb0de068a8d0d726d2ffb5a72d1070068aa93b900cdb085149360ec0c9acc9a8e5e4c05dbb76afdc75d6f7e891884cf31405074d7f831e"}}, {0xe, &(0x7f0000001a80)=@string={0xe, 0x3, "f63dc66d0abc5db1dc0ab9f5"}}, {0x66, &(0x7f0000001ac0)=@string={0x66, 0x3, "d2072b40cdd05fca95476d9f42021694fad871e05acc29babe15c8c22b30e0b876f3502a7e7f1d109ea9ca9ea3a38f3b9898fdcdd456eb594c7312089d959c3bc68e706a0ae9c0f2112b7d8ae03880c43ea3d9b69e274dae748e7f8281d7805947bcdeba"}}, {0x4, &(0x7f0000001b40)=@lang_id={0x4, 0x3, 0x41c}}]}) (async) ioctl$KDDISABIO(r5, 0x4b37) (async) ioctl$AUTOFS_DEV_IOCTL_PROTOSUBVER(r5, 0xc0189373, &(0x7f0000001c40)={{0x1, 0x1, 0x18, r2, {0x3}}, './file0\x00'}) write(r3, &(0x7f0000001c80)="4e5661016ad3de10f0caa8e1b915b8c0c264ae22ff6b9bee96736c92016c1a3ddc67c1963afccd97020105a3e2197dc87d067dced5c630ef6b02ac3d8dd616f9c2755325d318601b390edeedfbc382bd67e96b77c9dad0799ad8e55d048e5ce613c1490111232f4c12f185c52df73c4d0d4968ee2e91b8b15ce3a5c52a80242078b67a94b3bca5b8ca0cb3f4a64b8d156b979fc947b59f6a9a0d4c99be215ef77d3da3066191fae6cb284261ea5bbf113f793c784d1296e3b9da2ff596af14182dc07fee3b8c79228b569c89c8131f6ed8899c68c8039d59f4d2ce5fbae729394234e20e6b084abccc1e2e86435833dd05c25f89b45e945e8cdcdddb216848", 0xff) (async) r7 = syz_genetlink_get_family_id$nl80211(&(0x7f0000001dc0), r5) (async) ioctl$sock_SIOCGIFINDEX_80211(r6, 0x8933, &(0x7f0000001e00)={'wlan0\x00', 0x0}) sendmsg$NL80211_CMD_DEL_STATION(r5, &(0x7f0000002000)={&(0x7f0000001d80)={0x10, 0x0, 0x0, 0x80000}, 0xc, &(0x7f0000001fc0)={&(0x7f0000001e40)={0x170, r7, 0x800, 0x70bd26, 0x25dfdbff, {{}, {@val={0x8, 0x3, r8}, @val={0xc, 0x99, {0x401, 0x5}}}}, [@NL80211_ATTR_STA_EXT_CAPABILITY={0x101, 0xac, "7c8a3c93c470f02ef9d53b1191fc108dbafe6d2060d20e5fe51ee46f3bede438e6c2cde92f6f661030fc8007c3cbc17c6e6594b598d966a8498b1a7314a03e9d30f2e600609ec56fdd7a9caafff35cd6f02491954d1d470d9b1cf86fcbd978834bb6c10670c3670edeae752d1e303ea30e1c63c87de4953dda2dee525e93f8e355cfe823f9de3a0439d8ebff80b10f988655651cfb5b99438d2a78d568264afacf251b4d47e50a293a51dbb5d2eb875feeb22bee65b0b572daa9c0ecd68f83aac988dbf0b8a17235968fd6f1c52d7ebe91f830e3b716c67ca833e137c015f3ac9887b247fb1f960a1eb422207ab9c77491fc1fcd6fe15dd18959753ae9"}, @NL80211_ATTR_STA_TX_POWER={0x6}, @NL80211_ATTR_STA_TX_POWER_SETTING={0x5, 0x113, 0x1}, @NL80211_ATTR_OPMODE_NOTIF={0x5, 0xc2, 0x6}, @NL80211_ATTR_STA_AID={0x6, 0x10, 0x193}, @NL80211_ATTR_STA_WME={0xc, 0x81, [@NL80211_STA_WME_UAPSD_QUEUES={0x5}]}, @NL80211_ATTR_MGMT_SUBTYPE={0x5, 0x29, 0xa}, @NL80211_ATTR_OPMODE_NOTIF={0x5, 0xc2, 0x4}, @NL80211_ATTR_STA_PLINK_ACTION={0x5}]}, 0x170}, 0x1, 0x0, 0x0, 0x10}, 0x10) r9 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$NL80211_CMD_TRIGGER_SCAN(r9, &(0x7f0000002180)={&(0x7f0000002040)={0x10, 0x0, 0x0, 0x4000}, 0xc, &(0x7f0000002140)={&(0x7f0000002080)={0x90, r7, 0x100, 0x70bd2d, 0x25dfdbfd, {{}, {@void, @val={0xc, 0x99, {0x769e3930, 0x3a}}}}, [@NL80211_ATTR_SCAN_SSIDS={0x28, 0x2d, 0x0, 0x1, [{0xa, 0x0, @default_ibss_ssid}, {0xa, 0x0, @default_ap_ssid}, {0xa, 0x0, @default_ibss_ssid}]}, @NL80211_ATTR_SCHED_SCAN_DELAY={0x8, 0xdc, 0x3}, @NL80211_ATTR_SCAN_FREQUENCIES={0x24, 0x2c, 0x0, 0x1, [{0x8, 0x0, 0x8}, {0x8, 0x0, 0x7fffffff}, {0x8, 0x0, 0x401}, {0x8, 0x0, 0x80000000}]}, @NL80211_ATTR_SCHED_SCAN_RELATIVE_RSSI={0x5, 0xf6, 0x9}, @NL80211_ATTR_MEASUREMENT_DURATION_MANDATORY={0x4}, @NL80211_ATTR_MEASUREMENT_DURATION={0x6, 0xeb, 0x2}, @NL80211_ATTR_SCHED_SCAN_INTERVAL={0x8, 0x77, 0x10001}]}, 0x90}, 0x1, 0x0, 0x0, 0x8000}, 0x4001) executing program 1: r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000000040)=@newlink={0x38, 0x10, 0x439, 0x3, 0x0, {0x0, 0x0, 0x0, 0x0, 0x9801, 0x1303}, [@IFLA_LINKINFO={0x18, 0x12, 0x0, 0x1, @sit={{0x8}, {0xc, 0x2, 0x0, 0x1, [@IFLA_IPTUN_FLAGS={0x6, 0x8, 0x40}]}}}]}, 0x38}, 0x1, 0x0, 0x0, 0x1}, 0x4000000) ioctl$XFS_IOC_START_COMMIT(0xffffffffffffffff, 0x80585882, &(0x7f0000000280)={0xffffffffffffffff}) r2 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000040)='memory.events\x00', 0x275a, 0x0) write$tun(r2, &(0x7f0000000340)=ANY=[], 0x141) mmap(&(0x7f0000000000/0x4000)=nil, 0x4000, 0x1, 0x10012, r2, 0x0) ioctl$SECCOMP_IOCTL_NOTIF_RECV(r2, 0xc0502100, &(0x7f00000003c0)={0x0}) ioctl$SECCOMP_IOCTL_NOTIF_ID_VALID(r1, 0x40082102, &(0x7f0000000380)=r3) r4 = bpf$MAP_CREATE(0x0, &(0x7f0000000640)=@base={0x17, 0x0, 0x1, 0xff, 0x0, 0x1}, 0x48) r5 = bpf$MAP_CREATE(0x0, &(0x7f0000000040)=@base={0xd, 0x4, 0x4, 0x9, 0x0, r4}, 0x50) bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x11, 0xc, &(0x7f0000000180)=ANY=[@ANYBLOB="1800000000000100000000000000fe0018110000", @ANYRES32=r5, @ANYBLOB="0000000000000000b708000000000e007b8af8ff00000000bfa200000000000007020000f8ffffffb703000008000000b704000000000020850000000100000095"], &(0x7f0000000240)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x90) executing program 1: r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000180), 0x2002, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) r2 = syz_open_dev$I2C(&(0x7f0000000040), 0x1, 0x402) mkdirat(0xffffffffffffff9c, &(0x7f0000000080)='./dev\x00', 0x1ff) mount(0x0, &(0x7f00000000c0)='./dev\x00', &(0x7f00000003c0)='devtmpfs\x00', 0x0, 0x0) r3 = openat(0xffffffffffffff9c, &(0x7f0000000400)='./dev/mapper/control\x00', 0x2, 0x0) ioctl(r3, 0xc178fd02, &(0x7f0000000100)="0400000032000000000000003801") pwrite64(r2, 0x0, 0x39, 0x26c) r4 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0) syz_kvm_setup_cpu$x86(r1, r4, &(0x7f0000fe5000/0x18000)=nil, &(0x7f0000000140)=[@text64={0x40, 0x0}], 0x1, 0x7c, 0x0, 0x0) r5 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000000), 0x80800, 0x0) r6 = ioctl$KVM_CREATE_VM(r5, 0xae01, 0xffffffffffffffff) r7 = ioctl$KVM_CREATE_VCPU(r6, 0xae41, 0x0) syz_kvm_setup_cpu$x86(r1, r7, &(0x7f0000fe6000/0x18000)=nil, &(0x7f0000000200)=[@textreal={0x8, &(0x7f00000001c0)="0f01390ff2f63e0fa10f01c966b80adcc8890000ba000000000f300f79d80f236f0f01c966b9024d564b0f32350280660f38dfec", 0x34}], 0x1, 0x21, 0x0, 0x0) ioctl$KVM_RUN(r7, 0xae80, 0x0) ioctl$KVM_SET_VCPU_EVENTS(r7, 0x4040aea0, &(0x7f0000000080)=@arm64={0x5, 0x9, 0x4d, '\x00', 0xfffffffffffffffe}) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeea, 0x8031, 0xffffffffffffffff, 0x28f43000) madvise(&(0x7f0000000000/0x600000)=nil, 0x600003, 0x19) mlock2(&(0x7f000000e000/0x1000)=nil, 0x1000, 0x0) mlock(&(0x7f0000000000/0x800000)=nil, 0x800000) syz_clone(0xa0000, &(0x7f0000000180), 0x0, &(0x7f0000000280), 0x0, 0x0) madvise(&(0x7f0000000000/0x600000)=nil, 0x600003, 0x19) ioctl$KVM_RUN(r7, 0xae80, 0x0) ioctl$KVM_SET_NESTED_STATE(r7, 0x4080aebf, &(0x7f0000000580)=@svm={0x100, 0x1, 0x1080, {0xe000}, {"a349917fc78302bc9638bfb9f5765bb1d19f9ca20846136a1245392909e3619ad5c5ce5919824b0e65ba661823abb2008dfa8ae56ff107b703f95dd5ed7a49f650c51eb4efc9ad7044c8ae479c1828d41e71cc8b1877bbd3555c10bda5c20e0bc99641995e1594b919617c3e1466e77fcb90ddd499e1ebe8ecbe86d304d019a47d742e942070bfcc6012914ac521ddcc3b1a691a0a07816c6d19d7eecb1db1acddfd57e0a10e033cd18107f5f9c6f4a1c98526428e7bd5b48fdad233786865ef779baa040bd5c796d0d0b545d96fb3422b0fa8bc1cf000a75d1726fb0f861e06f22549563031d32dc3869469834231b45260d37eda2dc32858f193c9d1e9d2a9e1f4384a0d436c1222c8236708eaa7c6371265651c940f460c823e7636a6e9634e4722bf74223b19120988dc166a733e3c15aa75ad79adba03431b0d8a52e9536534d5173477497f53f91c9a44a1f1f41f4b0319d970ec5bccb61b7f1c909b6cf8a6750660abaab85839d19a8fd30749b9b59d7a0a9d8c7ff45bc85d9c49a1b3dc5d900440407d1a420cefc9215bb6960380b4564fbc063988492bcf91610ee756e97e6c632d5e1060b738c66f247cccda332217f8c39c54e48f30af47e9edda42185ecee7ef0e800cca5b8b9f77cdb9611d1d24dedc3cab47bb29186bd6b3cccc6d460a5029cfb355f633972a913c6d049ccee1965a21888f6dfef19cb0b9cc30f95c01b68a26040edeebc721ec067d3acb2495124118f83bb0dabc01853bb3e27a7211f0af6c2e1663dc7b98b31acc737ce7d4447559c206d12f92548957a9eadf94f302bada7355c31339982f8e055def1aee5d67e66525144c9765c761943db0cacb9cdc2c83938c7011f677416c0b95487d4c7415bdfd9263da7ef16ddd0e880eb6fd55acf23a5b73eb084f4a2fae6642fff547f881149fe2dc436a52075b2234a41ffc2d4a023791c8e8b9352c58227596e31e01b46c7174de887e3045631ccc802d8c7db6b560cd44162f68b86a20edf8b0d3d7fb3f929d605cb81c4a2d8fb13e959da89cbdd906ef3a49a2efe736885112d1963dcc2de4feb5db3d1a6a5b7d70ef9996f20a9762f8b890528352563ceb7d8c3fb6dee111632f86db7e19e4d02f6ad9d7e9c8f0f6b42bb5c866c28b378e01f156ca453d5feb01b7b90df1bdd3170517a31d489b3bb2d4863da90abe5d6e21c5e23264e98de4236ad870f996392831ca79082e487b55810d8e99a7a316e660ac223806d202a7b7dfdb90b42d54bca0888d28c6856e7944f12fa9f2b9febc2fab10af355668fe3df2a3b063847d77763fc64b7b313a277e355f71525f3b0e140c57f9011eb7ad5983252ed2ce28d6418ed659ed3d0b04b190c7eafb0097d61eba0c72117dbe6a8eb8e24516fb242d392eed19082e5cbfbc124f1fcbe1e500fa9cd631e5e9a997514830f8d865a2eb7f70e2f6f505f3532331a7184d8c7375348bee7a813a46aae1a56b949cb12423da8b0c4b803a6cb0dbfd3f3d9b3709ae0ca6851fa5f209618bde8195d4099687b8d1a4acc079d5897d3e25bea9bf9e6971269f328a478dd7638e526da367bf14f847c9f01050b1aed129e8123c1d2b4b694ac2b4b809047ddbbcc0701319b40795cdda399ce24d9b5ad2ab4f0d9b029932fa4a94faf617c3039b9b1a8987ad0076091f66734990012dccf7009f7e72dbde5ca4eb60c7c8a0eedfca9d221c2bd8ea408feb86712fad259bf031c31b4b754a574cd4ec511889f51f6ed5730ab6952ccaad47cd8569c7b9d9e791ab58fa1a7431af01b9ea0aa02a0e19ab41008505fd28e7d96977b291518775891b4efc860981254e6769e37cd153770a34190da002b141a4db4f7e5dd94a5ed5b489a9d5f7b2874bde1e9ac969f8486ccc4d759f4bb54343f9abe143ab2dce69cb5c5ba8594e0e71d9a4778a64bb588f1926308d030819aac9ec3f4568b611a5c3df533da038fda8d221b4e135ada802f70c4d952541338aa5afbd3032a42382fb4ba8b6f9ec972077fbce4f5214df9d0ce0b208b1d617933035a8ec494045a5d8e6f5cec6583c844f012eb36c053cf097d8a6a3a55765d234dc1d4aad7d79714038038b850d7895be8819e78d012ba45e18d8ebfdd88013595acb5c7a25c9608f71c6e6413c7ae29e3683a6b95c894b1529d071593b7d2a32f41288d5897f6c0b7d0f9a115521e8f720240c1476b5485743243e15e0db138c736e950d983e730bccf02b5a0f2353229ab90d15bc8f74d0d9b7e203e5cc8f793add56dbb917134eb24e6f3b22e6292ca242328cdc25a6cf6e48da193b450377cdf79abc0cd3a61c8c9c6419f2839be4109721ebd34bad56e8022ec9ac837ee33fd28fde75ea443900ba5a3caa60d87dae10480fb439f78c92d361879d9857994d844c8d77d2895cab49242e5108a1dbbd0d0c7a9caee80c98fbee158f494cd401afffdd5518780ec22410ed680c1edb3959f8076ded8d8af44099585f4715780b2373ba3950383f61b10be5486d7a09711ecef8154052e73c723cef60a2ed2c2e37b073b05d28c98704aecefd27def2fb940068a026a1883656f9daa041a75a27cd4aa705a87863a3b96f9562b4c764a4fc64b57b6eb17dc1611cf50757f1d88b6173e6fc4d3acdcbf32c14b3e7857a84db0765f5655914d4b74b9823fb4fa0df3393b9016540f5cbf5525b3e8aad6d5b49c9ee331708bf292d9f155b965eea636d716b49a80037ffbdfae050f8619c7d083c8826e1b691aea0060f7fee5a845ef1bc76dd1e0553e73a2cb0960f72fc11d7e907e507ecb08c394d2c48fbd28e1b0375c28c4171c760d59c2612381c6e88e2e5ac85570f845c58495121f3b1cd996a8c9c2bf0e9d833aa3985ef80be10465a768899d65d19f26962e1fcdc9db0b25e680e3ebb1839dd0a39952be4f2ef5ae2a4b6afa1f4016f2baa0634d05cba0f46417de11167da8cc1db075335ff30730f5b4bd3a906903b8eb74715750e222f01778a7edcfd2343a7a2596feaf6285c321acf6f4863649d3d4c6892dd1a798c0cb091e46170d6236ec8a0b90cf370c4eb480a6f4abd8419090a3237521620dcf057612ca723d4af5488af39aeb9f8a470832dfabd79d9efe2c1dface0719b7ad4e3f6a03a3068df1edb28f6a81afcc7917d989c84ed739cc15467f599863ff4ac94f6db8c23794cf1523fafe3dfe3253cee480d3a985aca8e9e49aa911b5b4118c05a96ca900f3fb695f4b2fa705fdee27941d6227c7bab9432d71e471a0b9493e8ee5b233208631698b4ea9eb75abdbed905bc26c8b034cc20c9df78b8f49e59c0f9ce28b0b7258019121252ac9513074daf6b6e9c5b1b251a3b4e68ae0b54e7c9949c0ce968424674ffb4907e8040fdf98dcad0c43a96809702fc5d1725600ca5ca2d9811ea694b0c4a9070d0150d8d7450b886eaa62d1d4969e161661b3d0f934db2e7ae603d889f6ce7feb6bb1c41a6d2cfde24e436cc4990062b87445a1756807b358a45cc1cf774c6315bf5768239d95bf94e05202bb6ff244649fa305a4b7ffedd79b868ee1d92f2a307e189bd9ac80ee44b4da6ec07aed60ece435196a737f10d729818c56eef410b2e99637da0e73c4d5b3faf45c514e20c7fcf519a59565fdb7663b6d844c8e690442be37e9acef647d3bf42b042e0afbc2cd35e328065462eee2886d0f33301fbe641d684064650ddac0c106ed23b06c4204600a0a4799f5547cf0655ab0abc0d79f466cb70636af925dbd1a52871dc524031dea80c3748e20aa144cf15c3e6ee4c710704c2556c229981161352401bec2ae05c4f0b56621f61766809249d9fe192da2a995a66f7b978e9eff5d0b5e2f620e6bc94cb24aecd02688cd825b97afc53e37774e7c6c8de99278319848952e0abe70227141e3acbd07274e8cc700b18b60ee67965bac9bb6192c1732055e508c3e3d2e11fc76f31b9fba12e9b405c8f0772b3d4c4a2f56ae6627ad9a41acfb3a7a86e477340226cb53b5e8b6ebbbdfd094661cf33f5db4c4e12250a3f3a626cd038d87874765a1ac120b094f0f2c48e9f520f4c7a8ea0df88b9b625199dc41d56275997de9d10e1edecc2a56384357624ff2879e17a9b1cd1f263392cc951d6190d884ebacb869d0288f16959120f94adfeefb8aec95e11933e6e6598f53b9fe2ebcbc7fd917d1cd9be012f266492c7823ee8aafe77c5fe7b7d9b824473064dece6c1f32df773e021ba3063f48545617761e4b62195f5720798e824db21179222b3f01c3f145edac902738f6415fa22f6b9757778cca52472fd8fbe52aed27133f41d79c618a2771c9f1b60e008539bc4e02578b3efa69315efc7ebbea26ce4d3618a0a553fd87fb0b37e724d6b4c2ba91d2ba820ce3a7172d566148b920106f83aa1ac4e31d25404b700439d32dd694e5af67340825aa567670cb742c60093d1f1e9b7836b9b1377a07e25145ba8f2b6b9a5fa7e1aea6b219d3287b94691b546759a82d04055128087caa801135a9602fd8b221cb013595d4539344a08ce3c670b31701ef5f74d391a0f61989af022e0b96fd10e4d6e2a28e92dd36a2c29b30d82de8c239ecc0ccd82d2468c00807f4252b2315797f198bbf35f58d5d1d78692560af0ee6a78ff144c68fee7c210640329b7b372ab37f85bdf16c5cf7f012503520980cddaeb079adb06b35bf18f644b5d8d78e0bed21a610b94eb15c2ff74828074f09c61bca8fca2c8eda5399fc0c84bd571d01d1e71a734cd03fca04cf712ab453fc65a9a0ae3e6be328596aab714deb3076718ec34e7c62a2198823ba04d203b153ab0b313a10996a8f89f56070685c5ad5a79d68275f27a233fe40e4f9b2401183ba087a0a77f29a04377439afba744cd77ab8ca424a5920ae263802bceda75009976cbd4790ed92a260e976e8e7757abfebed48006f03f29fe5cb7464a3a504d6e1e2f5c16ea8e9158a0a34db236fbc007bebb9dff31bbff10ded7998dcaa06cfddd34f421ad5cb86be4658484810eb8b94c7b0c3e82b100f32362f34fcff1b544efc810b75d0f3c2a62478463ebfd07f793d96784365e4b26623f7b4b0d51ba6f539ef4d5926f89705b2376d56637958591d4c441e4c6a30fbccbc173b86714862ff8e7741bc33218f6c342b18722be0c6c7f0d0872a411e05808deac3257791f0a9008d402260a2aec1eff817298ef04e144c90369f5554a65842968908f1aed32f98736f464c88e8b0fb76dc6cd21e77511f9760e94b433447e3cd59c5493fe4aff915b25e92f3cc0cdce85c54db683f31c333c86c61cf027a2695f772fdb179ad14b2184155384a74f6d00ef35cf68598a50f9497248d7ea55e9c34cb8cc005dd03b25c9d9bd126a74d99719edbd1d103692395be2a7c13a20cc90b5f22cadb199b4264de44a9ae44542adbfa0ff03b319f0fae431796954155507427820a6c49fa6e9567dea4ca7e181cefe3fa85260ec5ae735eb445a48e1b5ccdf5625fffe91e911a9e3ad662021cfea2b6bdac0bd2853c78ae193b11a1bc695ba08f099f77319e90f26000370bd533c39aa3838f225f21469ee3ccd2960a080f5623551c18a406ccb569a8fea254c753d0260380ba4a0bb03f86068da832262b306947c8280f5e03541194addfc931a88a3bbaceb7ee757864781b277601befc1da88663607bd3cd22fbebc462ea8ee25248955ee1d473d9ba8543893f6ea9201087170eff931cf22e9b5c01b855090071930778d02f5e1b7d4bb21929543b30c198633e8e5b0a0128509b558a9af43e861f0eb8132a0a5"}}) ioctl$KVM_RUN(r4, 0xae80, 0x0) r8 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) r9 = ioctl$KVM_CREATE_VM(r8, 0xae01, 0x1) ioctl$KVM_SET_MEMORY_ATTRIBUTES(r1, 0x4020aed2, &(0x7f0000000200)={0xeeef0000, 0x1002000}) r10 = ioctl$KVM_CREATE_VCPU(r9, 0xae41, 0x0) ioctl$KVM_PRE_FAULT_MEMORY(r10, 0xc040aed5, &(0x7f0000000040)={0x10000, 0x1f000}) executing program 1: r0 = socket$nl_route(0x10, 0x3, 0x0) setsockopt$netlink_NETLINK_RX_RING(r0, 0x10e, 0x6, &(0x7f0000000040)={0xc9f3, 0x8, 0x0, 0x8}, 0x10) (async) sendmsg$nl_route(r0, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000000)=@newlink={0x40, 0x10, 0x403, 0x0, 0x25dfdbff, {0x0, 0x0, 0x74, 0x0, 0x0, 0x5b2f3}, [@IFLA_LINKINFO={0x20, 0x12, 0x0, 0x1, @bridge={{0xb}, {0x10, 0x2, 0x0, 0x1, [@IFLA_BR_MCAST_STARTUP_QUERY_INTVL={0xc, 0x23, 0x2}]}}}]}, 0x40}, 0x1, 0x0, 0x0, 0x800}, 0x2000c014) executing program 1: socket$nl_route(0x10, 0x3, 0x0) (async) r0 = socket$nl_route(0x10, 0x3, 0x0) r1 = openat$audio(0xffffffffffffff9c, &(0x7f0000000000), 0x10002, 0x0) ioctl$SNDCTL_DSP_GETISPACE(r1, 0x8010500d, &(0x7f0000000040)) ioctl$KVM_CAP_HYPERV_VP_INDEX(0xffffffffffffffff, 0x4068aea3, &(0x7f0000000080)) stat(&(0x7f0000001740)='./file0\x00', &(0x7f0000001780)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) getsockopt$sock_cred(r0, 0x1, 0x11, &(0x7f0000001800)={0x0, 0x0, 0x0}, &(0x7f0000001840)=0xc) ioctl$SECCOMP_IOCTL_NOTIF_RECV(0xffffffffffffffff, 0xc0502100, &(0x7f0000001880)={0x0, 0x0}) ioctl$DRM_IOCTL_GET_CLIENT(0xffffffffffffffff, 0xc0286405, &(0x7f0000001900)={0x8, 0x10, {0xffffffffffffffff}, {0xee01}, 0x4, 0x80000001}) (async) ioctl$DRM_IOCTL_GET_CLIENT(0xffffffffffffffff, 0xc0286405, &(0x7f0000001900)={0x8, 0x10, {0xffffffffffffffff}, {0xee01}, 0x4, 0x80000001}) read$FUSE(0xffffffffffffffff, &(0x7f0000001940)={0x2020, 0x0, 0x0, 0x0, 0x0}, 0x2020) sendmmsg$unix(0xffffffffffffffff, &(0x7f0000003a40)=[{{&(0x7f0000000100)=@file={0x0, './file0\x00'}, 0x6e, &(0x7f0000001400)=[{&(0x7f0000000180)="3a9de706c6b2502c2dfa7fdf503181cc4118349d16e941f1243859b21de6b64465c92047e9e5395f016cc1e801779cacb3ff4e267f763d5a83e3bf1906d65bc44ddd5cc65c5d7b4ce42375380f16fdc76183fac0d96b30aaebcf7dab9c5e0b5ad4e554", 0x63}, {&(0x7f0000000200)="5c2353c0cc61fc022b09535713b22b87a34d5cb3d34b2629cf361714d48666f183e5c4a3a7a91a96d7d1", 0x2a}, {&(0x7f0000000240)="374cb43ff74840450baac4fee32db7009d732f8f3786066b35127ddb3e590c61a4b9b3215617ac9d40", 0x29}, {&(0x7f0000000280)="85e300c44aedb8f8b84174ff610be37d5e1dd632676d8c383ef9a5d2e75f6d0ff8ff3f89d552c27e1c609e34891f09c1b7577551555573f8c3b29b9b2ef7a5ad2dd45642f26e7732e1c230de3140d463dd70788df23cc31aa05d4df5354f1bd9975c298ea37aed90f54505091651ccb4022afcb4be577ee13d5675033247e698184c5b65811664f6228e67fb7fbe077e4ab93385f6d2cb21152e7f8fe6d85042a9d2657c6359a60870aa3a38005c3ac0d513fd79f306a4c80b10a01e296f898b2f5ea3ceb97d5193328e90d3dc741e5f98f740a263ea4547eb3f8bcf8f53", 0xde}, {&(0x7f0000000380)="594ce80edb1b9729bf2c80283f3cd80c91239e4a10fdf6a5494dfec12a7450ef9b86237618a93d540c6e36895c2772ad5756154c1f7ea6176e0a064e1492c2a49df73370d897c97cd597628cf34f7537db8d95ab9a5b731fb238ced33c3339f1a33acc", 0x63}, {&(0x7f0000000400)="a814711f2748f2511de3bddb80ca8d886d3445e912413ce9e367328ba3b8703005b0222bbb108b280c24288edb3b5667eaeec74d40a6f6fe57cdf1fddb424ae92c9da201b8ed148df4db00d83785fcfbb46a54fc431aa1a66ab8e8a0394ca922f74f10ad5ee0185a1c83c10703934d9a982ca804ed55e6137e259f344562d83f04c977d1881fa00c363e2eacca4e2fbbab17164da9dab2cfe2ad765307fec165922b0fb5c3dfa5503851e6530cc17a0cc583f93dd71c874b97acf2e614d4746d21496515aefbc3567da446ae394ffdbbf69a07e0b95db22b5d8ac12bdc7c3ea3646aba16b321e5eb64ef78c72e7f24188e12bd1aa20c51f232a2efdb2b08da2a92f9261e6de050187292fe04df85ce5650c0c00e5fb9e4d1d700e381266e828541afa9454a1e25ba48003d65f31045a86fff56f5121b7e9a210c63b1632efdd5844b8cfcd660b0b7b5af43425231b543acde383e2faf93c2bac93243cba6fc2fdd779a332d84ee0484db317693760fc3c3559c06e3adfbf1f279ad50aa7d80dd90dd32b21a3e219a15a92153f39de1b97d5a3f7b04d0063924829a942ee0b226dd397f11cc67e1301a9ce0fb4adacae37bc0aa9e9b9c2fe7f90bb663b66568837c6fbd313d34574720abaa6bd91a783c7831e9833f1e844e85dc471568b6a090ee852adbbc2e7b12c455ca638fc6c1858fa4f589a50792d54ebd3b60d60a9bbc424e3e3e43e14929ffc4c68e253c06d0cfdc4625df9855a1070d19227af72f0baa5c2ef698bce1577e2e57f9ce46ed289db0b9b0935eb1e75fe6f771d6cba80e254496b982066bf3d2fc99f95dfe8971f536835ad01393e9a958ea105d872b5e571dfd60872201b0a577a5b20d582e6a632260ad756a6dd16cb767d42f03a61574e58158166fd508151a07898b01e46bcb582a7358103c796807a6fd963d860d571f5bf768195dfb15255bd2192adc67913236c22c6e0e4ce9033d1a48f4fcc1328b6e087eb3f64b6bbb12b9f6040000b02574ab872347d66cc0dfefceb25a7c06f00372a3df2aba8db488126397724ca704d2d3b56ffd5ec03aa9d262512c54b19e59b9684a57cb26351147215016603f3b8b165bca2ce1d6f1aada629aa9271934f2f521a2eed3454ebc527178b326a5b23de8534be73ee1405a34750ce9519357c66dd1784a15d6d7ad25f1fae43621e25f39c5d3f99e96c1d8c50237281c6b1c54f03b212b057ca75dc9962bde7b1e172c5d1a6bf3d8b189f9cb2190de70190d67abcb9b25b6d2aa1d5ae574ab1514cbda9474940af71479cc6bb789d769b6585401d309c8f129ac4af92e4c8133eb905e8ba7fcdb17c4476826781659b9de2c6664461a7292271b79d09157b7bf17cf9151b67aa4e8c4190cbd3777e190dde2d78eeaa8be5d7f8e13d38db06bd7d7456b0842a9194e3d2748b7f216be4f8626159e3b969f18fba136f4ac2c34a7145c3df456983151d7dd98c8ad89d493d0fd6dc84ab2114d8c805c84f5dbd7225903b83113a5f174af8d6324091208a1abcf8df916cf5eac94aca4eafb379279f589e16b74644d99d31238832f8cb626855f21a21a0efcf8625d50fe020807f8f8b241338990c2321295c9d8c1c53688d74d0ec519fbc372060882c8110eb87b20d3bdfb0a7c82849cc91bf3258d83d15aab845c9bdf88dcf4ae73296a40fbcc9f39b2251466f2714a13bda88159aad851e9f1e5ada8ac818f69fa757fa681bddb3fd9dbceb4ecde4a8ff0a9d3386d2ca59827a8c08c83ba03cca298bf1ce2ade80856309f26222764268ba91013bdc3f7323cd4219fa42f7399f962e1cf7d5082bce9420c49e3891c38bc7ee8a9ee67338265bca84ce39d0dea978fccae8a84b844a8f4ec91887d0d6c702b364f58dd125d755b113e607e29389fc7bc7b5eb0a57da34368142e1fe73d7f073b278b43174e424ab6cc2f74cee45959d446ecf66210757c6c47efd3e90d38b299ab30212deba762d677630881cfe73b5075ebdc3b15366210013aa5b2613df8d5fb5f4bd3e6418f745491595c49ef0ced0ac4a4b4bae44a30947d1e9ecd747560935c66e9f32aed46406c6f18a8dc53d35fd4c8f07d470b51a0805e0a89351c055d179acb43eaa576f46abe8867e9d51d7f4e82f8802d9b3cca839734cf385921968598053d0a293967184bd4af20baf59146a95355bee3d0fdb76977dcbf71793b885c7ce8202f5c7fdc0ba595094dd6a0690536c5d41b364c34a8b619a8ce07ae3e686790d3929dabef080b213ffddba1262f237d65b8052a8d9ea572ef92dd7bcbe4d7bb1cded9082d2ac01d312c3370cfa0a0554398e2e71d075167ac07e3a8dabdf3cfd9c02e7e957c5346912d8e70cd8925e51cbb08c7ec1296e5f3f04d591696abc90e4d326faece51574b382f677455d4b452b5f3c1ee646b94cd1f98a4304a04d55cff582c8ddf7beecc767d688b55182a27b37d09727e05e2809e180ae8ac16fe436107141286678d51462abed9376e893ef521f9780688a45a0f63a150a82d7cddc87ac5a77845a7f9a29a1c6324d2b7621e902cd9635e9157a113a06a9793453a6b8b7d7e46d271523f18faf9649c55c4efe3495e269a953edc8543cd0f9e5e6d94a8b907377558b167eae95b2770bdc173b9bfd3542e97cb501199651e625f518757aa5900379fd5d1615bcb4da0c0fd2927bd9249627d9c19d522d702220511ebe5c5842af1e8f779b56d2d92019bc3c652b6fba3e9c472c87ce64edfe79b412df96946154a36acb06cab0abc134e0c7762608e950bd15e865fbbab8ca417fe08822336bc49c5eea265859a925a7951c947480076edb4a16521ae8ab840bf8dfd2be111f44eed1dd11303e624c14c61546241b9c5e8a48526428a0aad1eaf18b24ab353d55077b148192846056212c70d5df8e34645b91c5a36f7824c18fda5a85efc9cf10b3be52b01e8685b15da518c0b0cdb88cf078e589c2f95c4a786fb3be44d08e78d836b5c5bd3c5c58fccfaaa5f2c513b07adb1d3fd6f8261657be7fbdad20ba7034f51c0e25743b973204322850f13d1ddf7104e0ceab74736c1ef5aa804c837df6bca73ba3f280ec7f62148381a6e3a4399b7fe27f4d69423d52e607141be07c529c14d6aa316715d4c5346588608eb8739c88a2b3790e1782f2de6808f8a4fb33cfd92f72e5b4be1e7b0e0f09f2a8724f5cdd14b3f428e62343a7f47ddc553bd7fe12fd6ef38af9e5d7a96c517f3a8d942dd6a2b2a9a91edd09993c311100b1c33dcb58eb6dfdf6170640c743818bf691e9749ed4a724adabf11203aead85f3411309ac2c14c9b763fb023b2d17ba1d48cd9fd35ea957e59583b58a01e924215214eb8167667034de67c1c355d53908be893cffeac7cf3426c94746f06a497e300504cef60935519c8997728b33569395bf165604defd6feae8bcf9f0355e5432f362949064e539dfbb1d3a4062a63cd1e4850b6874ec76d348bc9024052e393f500a1e8831c4652e548e8204495ed9f907ad3e7cfc278d1afd4abf0b2873f8a5c0b2ae5f68430a1755955a312d9edcc5056d2b4cf317e51f3d396a675ca1b701b6e833f78d2442925fa8c364380af182f475e1624cf1f4adf8a74ff0b2c3ede85f24a1635e6ade0fa48fbf451a61bdc7ab93c703a4284f66079e62faaf5618457c0fccf87ddcdc42c8959683a61c513d67652494d7a8d5a043ddc04c4c6c98ef15eed011b0f56cabbad9e9a5ae37be79b489042212385b26699c6d08832a3083c30acf744b1df05097af26d534ce951005a874372adac52be70f874c4a541a51e86f34dc9a805b14f3a97db7b8c25edd187d359decaf5da98369520acedb8e6387aa3247c4cdd9367dfeaf5537c599144c8fe106ae482c239e023ba2bec993cf0505d2a2a88359915d159ba048364379bab18149d3ebbf291d001596c4ab85996c31011ddddf875723c0bb014b00eb427199677150df61958866ccdf54b45d9da7db1022c962d6c9e26e2fa07f7b478a7101e81a6165edd0ee0c88b7fa15a58d90cb06acc86246ba74069865932195752290c3c11153f01feacd1362e8e1f45f5064d4181fd18ead59a02f3f76c9f0b6c5c89179badfc27644e70afaa65ffaec350d747220085f517720dffe9479bc29f861df6698e8c9e1729b4dc45b281fb819a1d49900d24eb03e123caef6579cd7f1cbcdde248025eeda8dbb56ebea2473c899e4ac0e218dc57b56bf2743c79a179077850a0708e4a28dc4ef19aeb5f5ae291b85fa4bffd4a5cb108d7f09426f52e56b1aa1a0186e425e4715d10e9c6936dc5f41e63f1dbb6a464740884d017d6a1e77a9860a54a2d003c3e4b02f84303b5c80119945c5fdb6241a6b063e3ebd653ad6580c4a567dc414917958247821083d1f61405d7b8d4366384db646c6daaafacc17f9b4ad7183f3de7de5175a234c6d569850f563f65fb8ae215b7dea64f8c541d7211a048f8754a9a0e20364a25feb672befd498ef7705f42c256c6427a6800c0118aa6f7e56efea1b8f44bccf3829c55a5d33652b8287192ee3e0bc65872d3e36bc31d682828dfe5e790b8f36b2c6c1ed7ec3913bd0b8c423598e9a53d90cdccc06d45947e751e86f4241845b5d126ffbd027f7697c41a49a13e843c5fb469d42a0c5012bcbb5425cd7d313a447b21a37b521fb2d61fbcc0ece936d7971b411ed3e959cc74ec398520f63cb74f51450bf6e43d38b20ceb3292c75b8a88cbb4d96cfe161e99bc85fbd19dfc1fdc27b0d88f09fa3e7cae9a041b18e67f1dbb9be69353c1ca49a438bcf1251cc6046ec0be9f5d94bf4a544beefc8e5f2ac94e5c4d7f92067098eb6758d760fdb780cc3d5749083e0de61e5845a205d4aef1351c3719d55c279cd838eac263b11f1b87196b8c97ae129f26d884fbea0da21f1c8fd967bb12385064f9a7c07d5e50bc5ebf156568dc083ec32bd3dd5330c460c8b583b985e961770b7b3ced9b9897698d6714efc0f33bacf1831d6f3cc0dae43cef1c684b8e1e8dc178f78e54c07fbefad2b26438303c159dde1f1432f6ffb96138fe86c3547da07efb722eaa8b7e1321ba8bdeb50235242a582cf95d6fdd3057ca95ab667387608e5bddcc7d27b56c1984137e2cfc607a4ac55cec66c3f14d32d85af2918fdf63611ff81405de7aede3b0ba49852f776eae184040c13cf367ebe8581e44a8c1c0869296f0f5d163df925076e1dcf2e2d2d99218bcba4cd30a2d32be1bef701b4e3036edc7ea87e532c32b313df08d305dff5d134e2fd05ccfc8499907d76ec751dd0eb6d5708d4269f48614e8befb7833db470e5e9e23addc117b322606b0d47d895d39f3139d55c2163a74810313e1d1d74e3e92b3dd12ff694e789f96b8d8aaaa923b12ba09b35d809295f09f9e4747fe536736991b18f191de3e7682a15965f583c5b0cd26622b267f0febbfd611882cc0310b1850c90ee1ed7af9244a81aa42b04c5112a225af575687972bdc0b4b7bd7fd1b50ba866ad6edae20cf3eb81bcf6f92d91ea1086d6fd653ad114466ff20210be14bdc76962e0183a4a252a363a73339367d788c45acf6de3d5b7d5aceacb9255e4b7f5a2f946cbc74f7fb8b9e57d564b6b9da28fabb05c1c7162dedc9e9345105ae69a5a1cda9bf84febad7d496bc4e396bf5d4ca8f86e8f69b96b91b9ccb0a45359b5691c54105a6ef2e94639b341f6f5b55a4791a68c53a651396f3d6ce003fc8c28f8adf4e544add2aafb90ac111a244d3f99919d4db0f4ea857ff822e8e26205d28d0ec59fa5103d7ef", 0x1000}], 0x6, &(0x7f0000001480)=[@rights={{0x20, 0x1, 0x1, [0xffffffffffffffff, r0, r1, r1]}}], 0x20, 0x4000}}, {{&(0x7f00000014c0)=@file={0x1, './file0\x00'}, 0x6e, &(0x7f0000001700)=[{&(0x7f0000001540)="cca3b0b95775f6dd3aec5ff6722e5f208911ec87619f74bfd3264a6accc4726551dbd079813d8851e7510b5456faef84c4d01d5a69a66d5c17028fe4e4fa9250b56dc9f09750bae039a6d876cdbcd32d97a65ba9e30f42a245b0e3dde82a8985a38601ec73b3a7eae9705876d563b3c2cb79aa285ad216f85357f5914fe8e14956e42856885188f344b3752886edd6fc10755f5dbfb2e8a42d9f5d5740ae33bbff17987be9e13c22e199d1006ef6", 0xae}, {&(0x7f0000001600)="bb2e60d2acd984b4ab8162c72ac395eac6aef452b5108b44d80e87af161d104072a0a2c1e2b2dbb27e15fa340d3904ffb362c61c560042b84d7b0bcaf24f04b30841c5e8f3e3ce49562708697acabc75b635549c65562b3ca8b6f2256c43fb62a9b5b023a5ed9573f3c509a0056972da92c54908f435645e716d9169202ba8fe6cf4c20a5f7bffd389aa7149dabfa051eb334981e8b6591ced141810a52b9d690537d8d185cab304832783b87e09254039cb0a013a97d9cd22bc2f59bf27a5d65e0d6cc36061c8ba2829744645f68de06c8118973026c30a97", 0xd9}], 0x2, &(0x7f0000003980)=[@cred={{0x1c, 0x1, 0x2, {0xffffffffffffffff, r2, r5}}}, @rights={{0x1c, 0x1, 0x1, [r0, r1, r0]}}, @cred={{0x1c, 0x1, 0x2, {r6, r7, r9}}}, @rights={{0x18, 0x1, 0x1, [r0, r1]}}, @rights={{0x24, 0x1, 0x1, [r0, r1, r1, r0, r0]}}], 0xa0, 0x40841c0}}], 0x2, 0x8010) quotactl_fd$Q_GETQUOTA(r1, 0xffffffff80000701, r2, &(0x7f0000003ac0)) r10 = openat$audio1(0xffffffffffffff9c, &(0x7f0000003b40), 0x8000, 0x0) ioctl$SNDCTL_DSP_GETOSPACE(r10, 0x8010500c, &(0x7f0000003b80)) syz_genetlink_get_family_id$tipc(&(0x7f0000003c00), 0xffffffffffffffff) (async) r11 = syz_genetlink_get_family_id$tipc(&(0x7f0000003c00), 0xffffffffffffffff) sendmsg$TIPC_CMD_SET_NODE_ADDR(0xffffffffffffffff, &(0x7f0000003cc0)={&(0x7f0000003bc0)={0x10, 0x0, 0x0, 0x80000}, 0xc, &(0x7f0000003c80)={&(0x7f0000003c40)={0x24, r11, 0x1, 0x70bd2d, 0x25dfdbfc, {{}, {}, {0x8, 0x11, 0xe98}}, ["", "", ""]}, 0x24}, 0x1, 0x0, 0x0, 0x20040000}, 0x2) seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0xc, &(0x7f0000003d40)={0x5, &(0x7f0000003d00)=[{0x1, 0x3, 0x9, 0x4}, {0x1, 0x2, 0x9, 0x3}, {0x9c66, 0xb, 0x2d, 0x7ca}, {0xe0, 0x2, 0xbc}, {0x3, 0x3, 0xd, 0x5}]}) (async) seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0xc, &(0x7f0000003d40)={0x5, &(0x7f0000003d00)=[{0x1, 0x3, 0x9, 0x4}, {0x1, 0x2, 0x9, 0x3}, {0x9c66, 0xb, 0x2d, 0x7ca}, {0xe0, 0x2, 0xbc}, {0x3, 0x3, 0xd, 0x5}]}) r12 = openat$fuse(0xffffffffffffff9c, &(0x7f0000003d80), 0x2, 0x0) write$FUSE_ATTR(r12, &(0x7f0000003dc0)={0x78, 0x0, r8, {0x3, 0x8, 0x0, {0x0, 0x8000000000000000, 0x0, 0xfffffffffffffffd, 0xd, 0x4, 0x1ff, 0x5, 0xff, 0x2000, 0x7, r4, r3, 0x13, 0x9}}}, 0x78) (async) write$FUSE_ATTR(r12, &(0x7f0000003dc0)={0x78, 0x0, r8, {0x3, 0x8, 0x0, {0x0, 0x8000000000000000, 0x0, 0xfffffffffffffffd, 0xd, 0x4, 0x1ff, 0x5, 0xff, 0x2000, 0x7, r4, r3, 0x13, 0x9}}}, 0x78) socket$igmp(0x2, 0x3, 0x2) (async) r13 = socket$igmp(0x2, 0x3, 0x2) ioctl$SIOCGETSGCNT_IN6(r13, 0x89e1, &(0x7f0000003e40)={@private0={0xfc, 0x0, '\x00', 0x1}, @mcast1}) (async) ioctl$SIOCGETSGCNT_IN6(r13, 0x89e1, &(0x7f0000003e40)={@private0={0xfc, 0x0, '\x00', 0x1}, @mcast1}) r14 = socket$pppoe(0x18, 0x1, 0x0) ioctl$PPPOEIOCDFWD(r14, 0xb101, 0x0) syz_open_dev$midi(&(0x7f0000003e80), 0x9, 0x10800) (async) r15 = syz_open_dev$midi(&(0x7f0000003e80), 0x9, 0x10800) ppoll(&(0x7f0000003ec0)=[{r15, 0x202}, {r12, 0x200}], 0x2, &(0x7f0000003f00)={0x0, 0x989680}, &(0x7f0000003f40)={[0x5]}, 0x8) syz_open_dev$vbi(&(0x7f0000003f80), 0x1, 0x2) (async) r16 = syz_open_dev$vbi(&(0x7f0000003f80), 0x1, 0x2) ioctl$BTRFS_IOC_SUBVOL_SYNC_WAIT(r16, 0x40109441, &(0x7f0000003fc0)={0x80, 0x1, 0x7ff}) r17 = openat$ttynull(0xffffffffffffff9c, &(0x7f0000004000), 0x0, 0x0) ioctl$KDSKBMODE(r17, 0x4b45, &(0x7f0000004040)=0xf3c) (async) ioctl$KDSKBMODE(r17, 0x4b45, &(0x7f0000004040)=0xf3c) ioctl$NILFS_IOCTL_CLEAN_SEGMENTS(r16, 0x40786e88, &(0x7f0000004300)={{&(0x7f0000004080)=[{0x1, 0x1, 0x6, {0x6, 0x5}, 0xb766, 0x8, 0x7}], 0x1, 0x40, 0x5, 0xe7a1}, {&(0x7f00000040c0)=[{0x9, 0x8000000000000000}, {0x4, 0x6}, {0x7fffffff, 0xf0e3}, {0x4, 0x5800000000000}, {0x5, 0x3}, {0x6, 0x9}, {0x7fffffff, 0x2}, {0x5, 0x35d5}, {0x81, 0x158}, {0x7fffffff, 0x8}], 0xa, 0x10, 0xe, 0x49b9}, {&(0x7f0000004180)=[0xf, 0x80, 0x0, 0x81, 0x0, 0x4, 0x16, 0x5, 0x7], 0x9, 0x8, 0x6, 0x1}, {&(0x7f0000004200)=[{0xe26, 0x4, 0x6, 0x5, 0x7}, {0x5, 0x8001, 0x3, 0x2, 0x3}, {0xea73, 0x1, 0x6, 0xda2, 0x8c4}, {0x3, 0x5, 0x3, 0x1, 0x8}], 0x4, 0x28, 0xc, 0xe2}, {&(0x7f00000042c0)=[0x4, 0x2, 0x663e, 0xff23, 0x1, 0xffffffffffffffff, 0xffff], 0x7, 0x8, 0x9, 0x2}}) sendmsg$TIPC_CMD_GET_NETID(0xffffffffffffffff, &(0x7f0000004480)={&(0x7f0000004380)={0x10, 0x0, 0x0, 0x1000}, 0xc, &(0x7f0000004440)={&(0x7f0000004400)={0x1c, 0x0, 0x300, 0x70bd29, 0x25dfdbfb, {}, [""]}, 0x1c}, 0x1, 0x0, 0x0, 0x20040050}, 0x440c0) executing program 34: socket$nl_route(0x10, 0x3, 0x0) (async) r0 = socket$nl_route(0x10, 0x3, 0x0) r1 = openat$audio(0xffffffffffffff9c, &(0x7f0000000000), 0x10002, 0x0) ioctl$SNDCTL_DSP_GETISPACE(r1, 0x8010500d, &(0x7f0000000040)) ioctl$KVM_CAP_HYPERV_VP_INDEX(0xffffffffffffffff, 0x4068aea3, &(0x7f0000000080)) stat(&(0x7f0000001740)='./file0\x00', &(0x7f0000001780)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) getsockopt$sock_cred(r0, 0x1, 0x11, &(0x7f0000001800)={0x0, 0x0, 0x0}, &(0x7f0000001840)=0xc) ioctl$SECCOMP_IOCTL_NOTIF_RECV(0xffffffffffffffff, 0xc0502100, &(0x7f0000001880)={0x0, 0x0}) ioctl$DRM_IOCTL_GET_CLIENT(0xffffffffffffffff, 0xc0286405, &(0x7f0000001900)={0x8, 0x10, {0xffffffffffffffff}, {0xee01}, 0x4, 0x80000001}) (async) ioctl$DRM_IOCTL_GET_CLIENT(0xffffffffffffffff, 0xc0286405, &(0x7f0000001900)={0x8, 0x10, {0xffffffffffffffff}, {0xee01}, 0x4, 0x80000001}) read$FUSE(0xffffffffffffffff, &(0x7f0000001940)={0x2020, 0x0, 0x0, 0x0, 0x0}, 0x2020) sendmmsg$unix(0xffffffffffffffff, &(0x7f0000003a40)=[{{&(0x7f0000000100)=@file={0x0, './file0\x00'}, 0x6e, &(0x7f0000001400)=[{&(0x7f0000000180)="3a9de706c6b2502c2dfa7fdf503181cc4118349d16e941f1243859b21de6b64465c92047e9e5395f016cc1e801779cacb3ff4e267f763d5a83e3bf1906d65bc44ddd5cc65c5d7b4ce42375380f16fdc76183fac0d96b30aaebcf7dab9c5e0b5ad4e554", 0x63}, {&(0x7f0000000200)="5c2353c0cc61fc022b09535713b22b87a34d5cb3d34b2629cf361714d48666f183e5c4a3a7a91a96d7d1", 0x2a}, {&(0x7f0000000240)="374cb43ff74840450baac4fee32db7009d732f8f3786066b35127ddb3e590c61a4b9b3215617ac9d40", 0x29}, {&(0x7f0000000280)="85e300c44aedb8f8b84174ff610be37d5e1dd632676d8c383ef9a5d2e75f6d0ff8ff3f89d552c27e1c609e34891f09c1b7577551555573f8c3b29b9b2ef7a5ad2dd45642f26e7732e1c230de3140d463dd70788df23cc31aa05d4df5354f1bd9975c298ea37aed90f54505091651ccb4022afcb4be577ee13d5675033247e698184c5b65811664f6228e67fb7fbe077e4ab93385f6d2cb21152e7f8fe6d85042a9d2657c6359a60870aa3a38005c3ac0d513fd79f306a4c80b10a01e296f898b2f5ea3ceb97d5193328e90d3dc741e5f98f740a263ea4547eb3f8bcf8f53", 0xde}, {&(0x7f0000000380)="594ce80edb1b9729bf2c80283f3cd80c91239e4a10fdf6a5494dfec12a7450ef9b86237618a93d540c6e36895c2772ad5756154c1f7ea6176e0a064e1492c2a49df73370d897c97cd597628cf34f7537db8d95ab9a5b731fb238ced33c3339f1a33acc", 0x63}, {&(0x7f0000000400)="a814711f2748f2511de3bddb80ca8d886d3445e912413ce9e367328ba3b8703005b0222bbb108b280c24288edb3b5667eaeec74d40a6f6fe57cdf1fddb424ae92c9da201b8ed148df4db00d83785fcfbb46a54fc431aa1a66ab8e8a0394ca922f74f10ad5ee0185a1c83c10703934d9a982ca804ed55e6137e259f344562d83f04c977d1881fa00c363e2eacca4e2fbbab17164da9dab2cfe2ad765307fec165922b0fb5c3dfa5503851e6530cc17a0cc583f93dd71c874b97acf2e614d4746d21496515aefbc3567da446ae394ffdbbf69a07e0b95db22b5d8ac12bdc7c3ea3646aba16b321e5eb64ef78c72e7f24188e12bd1aa20c51f232a2efdb2b08da2a92f9261e6de050187292fe04df85ce5650c0c00e5fb9e4d1d700e381266e828541afa9454a1e25ba48003d65f31045a86fff56f5121b7e9a210c63b1632efdd5844b8cfcd660b0b7b5af43425231b543acde383e2faf93c2bac93243cba6fc2fdd779a332d84ee0484db317693760fc3c3559c06e3adfbf1f279ad50aa7d80dd90dd32b21a3e219a15a92153f39de1b97d5a3f7b04d0063924829a942ee0b226dd397f11cc67e1301a9ce0fb4adacae37bc0aa9e9b9c2fe7f90bb663b66568837c6fbd313d34574720abaa6bd91a783c7831e9833f1e844e85dc471568b6a090ee852adbbc2e7b12c455ca638fc6c1858fa4f589a50792d54ebd3b60d60a9bbc424e3e3e43e14929ffc4c68e253c06d0cfdc4625df9855a1070d19227af72f0baa5c2ef698bce1577e2e57f9ce46ed289db0b9b0935eb1e75fe6f771d6cba80e254496b982066bf3d2fc99f95dfe8971f536835ad01393e9a958ea105d872b5e571dfd60872201b0a577a5b20d582e6a632260ad756a6dd16cb767d42f03a61574e58158166fd508151a07898b01e46bcb582a7358103c796807a6fd963d860d571f5bf768195dfb15255bd2192adc67913236c22c6e0e4ce9033d1a48f4fcc1328b6e087eb3f64b6bbb12b9f6040000b02574ab872347d66cc0dfefceb25a7c06f00372a3df2aba8db488126397724ca704d2d3b56ffd5ec03aa9d262512c54b19e59b9684a57cb26351147215016603f3b8b165bca2ce1d6f1aada629aa9271934f2f521a2eed3454ebc527178b326a5b23de8534be73ee1405a34750ce9519357c66dd1784a15d6d7ad25f1fae43621e25f39c5d3f99e96c1d8c50237281c6b1c54f03b212b057ca75dc9962bde7b1e172c5d1a6bf3d8b189f9cb2190de70190d67abcb9b25b6d2aa1d5ae574ab1514cbda9474940af71479cc6bb789d769b6585401d309c8f129ac4af92e4c8133eb905e8ba7fcdb17c4476826781659b9de2c6664461a7292271b79d09157b7bf17cf9151b67aa4e8c4190cbd3777e190dde2d78eeaa8be5d7f8e13d38db06bd7d7456b0842a9194e3d2748b7f216be4f8626159e3b969f18fba136f4ac2c34a7145c3df456983151d7dd98c8ad89d493d0fd6dc84ab2114d8c805c84f5dbd7225903b83113a5f174af8d6324091208a1abcf8df916cf5eac94aca4eafb379279f589e16b74644d99d31238832f8cb626855f21a21a0efcf8625d50fe020807f8f8b241338990c2321295c9d8c1c53688d74d0ec519fbc372060882c8110eb87b20d3bdfb0a7c82849cc91bf3258d83d15aab845c9bdf88dcf4ae73296a40fbcc9f39b2251466f2714a13bda88159aad851e9f1e5ada8ac818f69fa757fa681bddb3fd9dbceb4ecde4a8ff0a9d3386d2ca59827a8c08c83ba03cca298bf1ce2ade80856309f26222764268ba91013bdc3f7323cd4219fa42f7399f962e1cf7d5082bce9420c49e3891c38bc7ee8a9ee67338265bca84ce39d0dea978fccae8a84b844a8f4ec91887d0d6c702b364f58dd125d755b113e607e29389fc7bc7b5eb0a57da34368142e1fe73d7f073b278b43174e424ab6cc2f74cee45959d446ecf66210757c6c47efd3e90d38b299ab30212deba762d677630881cfe73b5075ebdc3b15366210013aa5b2613df8d5fb5f4bd3e6418f745491595c49ef0ced0ac4a4b4bae44a30947d1e9ecd747560935c66e9f32aed46406c6f18a8dc53d35fd4c8f07d470b51a0805e0a89351c055d179acb43eaa576f46abe8867e9d51d7f4e82f8802d9b3cca839734cf385921968598053d0a293967184bd4af20baf59146a95355bee3d0fdb76977dcbf71793b885c7ce8202f5c7fdc0ba595094dd6a0690536c5d41b364c34a8b619a8ce07ae3e686790d3929dabef080b213ffddba1262f237d65b8052a8d9ea572ef92dd7bcbe4d7bb1cded9082d2ac01d312c3370cfa0a0554398e2e71d075167ac07e3a8dabdf3cfd9c02e7e957c5346912d8e70cd8925e51cbb08c7ec1296e5f3f04d591696abc90e4d326faece51574b382f677455d4b452b5f3c1ee646b94cd1f98a4304a04d55cff582c8ddf7beecc767d688b55182a27b37d09727e05e2809e180ae8ac16fe436107141286678d51462abed9376e893ef521f9780688a45a0f63a150a82d7cddc87ac5a77845a7f9a29a1c6324d2b7621e902cd9635e9157a113a06a9793453a6b8b7d7e46d271523f18faf9649c55c4efe3495e269a953edc8543cd0f9e5e6d94a8b907377558b167eae95b2770bdc173b9bfd3542e97cb501199651e625f518757aa5900379fd5d1615bcb4da0c0fd2927bd9249627d9c19d522d702220511ebe5c5842af1e8f779b56d2d92019bc3c652b6fba3e9c472c87ce64edfe79b412df96946154a36acb06cab0abc134e0c7762608e950bd15e865fbbab8ca417fe08822336bc49c5eea265859a925a7951c947480076edb4a16521ae8ab840bf8dfd2be111f44eed1dd11303e624c14c61546241b9c5e8a48526428a0aad1eaf18b24ab353d55077b148192846056212c70d5df8e34645b91c5a36f7824c18fda5a85efc9cf10b3be52b01e8685b15da518c0b0cdb88cf078e589c2f95c4a786fb3be44d08e78d836b5c5bd3c5c58fccfaaa5f2c513b07adb1d3fd6f8261657be7fbdad20ba7034f51c0e25743b973204322850f13d1ddf7104e0ceab74736c1ef5aa804c837df6bca73ba3f280ec7f62148381a6e3a4399b7fe27f4d69423d52e607141be07c529c14d6aa316715d4c5346588608eb8739c88a2b3790e1782f2de6808f8a4fb33cfd92f72e5b4be1e7b0e0f09f2a8724f5cdd14b3f428e62343a7f47ddc553bd7fe12fd6ef38af9e5d7a96c517f3a8d942dd6a2b2a9a91edd09993c311100b1c33dcb58eb6dfdf6170640c743818bf691e9749ed4a724adabf11203aead85f3411309ac2c14c9b763fb023b2d17ba1d48cd9fd35ea957e59583b58a01e924215214eb8167667034de67c1c355d53908be893cffeac7cf3426c94746f06a497e300504cef60935519c8997728b33569395bf165604defd6feae8bcf9f0355e5432f362949064e539dfbb1d3a4062a63cd1e4850b6874ec76d348bc9024052e393f500a1e8831c4652e548e8204495ed9f907ad3e7cfc278d1afd4abf0b2873f8a5c0b2ae5f68430a1755955a312d9edcc5056d2b4cf317e51f3d396a675ca1b701b6e833f78d2442925fa8c364380af182f475e1624cf1f4adf8a74ff0b2c3ede85f24a1635e6ade0fa48fbf451a61bdc7ab93c703a4284f66079e62faaf5618457c0fccf87ddcdc42c8959683a61c513d67652494d7a8d5a043ddc04c4c6c98ef15eed011b0f56cabbad9e9a5ae37be79b489042212385b26699c6d08832a3083c30acf744b1df05097af26d534ce951005a874372adac52be70f874c4a541a51e86f34dc9a805b14f3a97db7b8c25edd187d359decaf5da98369520acedb8e6387aa3247c4cdd9367dfeaf5537c599144c8fe106ae482c239e023ba2bec993cf0505d2a2a88359915d159ba048364379bab18149d3ebbf291d001596c4ab85996c31011ddddf875723c0bb014b00eb427199677150df61958866ccdf54b45d9da7db1022c962d6c9e26e2fa07f7b478a7101e81a6165edd0ee0c88b7fa15a58d90cb06acc86246ba74069865932195752290c3c11153f01feacd1362e8e1f45f5064d4181fd18ead59a02f3f76c9f0b6c5c89179badfc27644e70afaa65ffaec350d747220085f517720dffe9479bc29f861df6698e8c9e1729b4dc45b281fb819a1d49900d24eb03e123caef6579cd7f1cbcdde248025eeda8dbb56ebea2473c899e4ac0e218dc57b56bf2743c79a179077850a0708e4a28dc4ef19aeb5f5ae291b85fa4bffd4a5cb108d7f09426f52e56b1aa1a0186e425e4715d10e9c6936dc5f41e63f1dbb6a464740884d017d6a1e77a9860a54a2d003c3e4b02f84303b5c80119945c5fdb6241a6b063e3ebd653ad6580c4a567dc414917958247821083d1f61405d7b8d4366384db646c6daaafacc17f9b4ad7183f3de7de5175a234c6d569850f563f65fb8ae215b7dea64f8c541d7211a048f8754a9a0e20364a25feb672befd498ef7705f42c256c6427a6800c0118aa6f7e56efea1b8f44bccf3829c55a5d33652b8287192ee3e0bc65872d3e36bc31d682828dfe5e790b8f36b2c6c1ed7ec3913bd0b8c423598e9a53d90cdccc06d45947e751e86f4241845b5d126ffbd027f7697c41a49a13e843c5fb469d42a0c5012bcbb5425cd7d313a447b21a37b521fb2d61fbcc0ece936d7971b411ed3e959cc74ec398520f63cb74f51450bf6e43d38b20ceb3292c75b8a88cbb4d96cfe161e99bc85fbd19dfc1fdc27b0d88f09fa3e7cae9a041b18e67f1dbb9be69353c1ca49a438bcf1251cc6046ec0be9f5d94bf4a544beefc8e5f2ac94e5c4d7f92067098eb6758d760fdb780cc3d5749083e0de61e5845a205d4aef1351c3719d55c279cd838eac263b11f1b87196b8c97ae129f26d884fbea0da21f1c8fd967bb12385064f9a7c07d5e50bc5ebf156568dc083ec32bd3dd5330c460c8b583b985e961770b7b3ced9b9897698d6714efc0f33bacf1831d6f3cc0dae43cef1c684b8e1e8dc178f78e54c07fbefad2b26438303c159dde1f1432f6ffb96138fe86c3547da07efb722eaa8b7e1321ba8bdeb50235242a582cf95d6fdd3057ca95ab667387608e5bddcc7d27b56c1984137e2cfc607a4ac55cec66c3f14d32d85af2918fdf63611ff81405de7aede3b0ba49852f776eae184040c13cf367ebe8581e44a8c1c0869296f0f5d163df925076e1dcf2e2d2d99218bcba4cd30a2d32be1bef701b4e3036edc7ea87e532c32b313df08d305dff5d134e2fd05ccfc8499907d76ec751dd0eb6d5708d4269f48614e8befb7833db470e5e9e23addc117b322606b0d47d895d39f3139d55c2163a74810313e1d1d74e3e92b3dd12ff694e789f96b8d8aaaa923b12ba09b35d809295f09f9e4747fe536736991b18f191de3e7682a15965f583c5b0cd26622b267f0febbfd611882cc0310b1850c90ee1ed7af9244a81aa42b04c5112a225af575687972bdc0b4b7bd7fd1b50ba866ad6edae20cf3eb81bcf6f92d91ea1086d6fd653ad114466ff20210be14bdc76962e0183a4a252a363a73339367d788c45acf6de3d5b7d5aceacb9255e4b7f5a2f946cbc74f7fb8b9e57d564b6b9da28fabb05c1c7162dedc9e9345105ae69a5a1cda9bf84febad7d496bc4e396bf5d4ca8f86e8f69b96b91b9ccb0a45359b5691c54105a6ef2e94639b341f6f5b55a4791a68c53a651396f3d6ce003fc8c28f8adf4e544add2aafb90ac111a244d3f99919d4db0f4ea857ff822e8e26205d28d0ec59fa5103d7ef", 0x1000}], 0x6, &(0x7f0000001480)=[@rights={{0x20, 0x1, 0x1, [0xffffffffffffffff, r0, r1, r1]}}], 0x20, 0x4000}}, {{&(0x7f00000014c0)=@file={0x1, './file0\x00'}, 0x6e, &(0x7f0000001700)=[{&(0x7f0000001540)="cca3b0b95775f6dd3aec5ff6722e5f208911ec87619f74bfd3264a6accc4726551dbd079813d8851e7510b5456faef84c4d01d5a69a66d5c17028fe4e4fa9250b56dc9f09750bae039a6d876cdbcd32d97a65ba9e30f42a245b0e3dde82a8985a38601ec73b3a7eae9705876d563b3c2cb79aa285ad216f85357f5914fe8e14956e42856885188f344b3752886edd6fc10755f5dbfb2e8a42d9f5d5740ae33bbff17987be9e13c22e199d1006ef6", 0xae}, {&(0x7f0000001600)="bb2e60d2acd984b4ab8162c72ac395eac6aef452b5108b44d80e87af161d104072a0a2c1e2b2dbb27e15fa340d3904ffb362c61c560042b84d7b0bcaf24f04b30841c5e8f3e3ce49562708697acabc75b635549c65562b3ca8b6f2256c43fb62a9b5b023a5ed9573f3c509a0056972da92c54908f435645e716d9169202ba8fe6cf4c20a5f7bffd389aa7149dabfa051eb334981e8b6591ced141810a52b9d690537d8d185cab304832783b87e09254039cb0a013a97d9cd22bc2f59bf27a5d65e0d6cc36061c8ba2829744645f68de06c8118973026c30a97", 0xd9}], 0x2, &(0x7f0000003980)=[@cred={{0x1c, 0x1, 0x2, {0xffffffffffffffff, r2, r5}}}, @rights={{0x1c, 0x1, 0x1, [r0, r1, r0]}}, @cred={{0x1c, 0x1, 0x2, {r6, r7, r9}}}, @rights={{0x18, 0x1, 0x1, [r0, r1]}}, @rights={{0x24, 0x1, 0x1, [r0, r1, r1, r0, r0]}}], 0xa0, 0x40841c0}}], 0x2, 0x8010) quotactl_fd$Q_GETQUOTA(r1, 0xffffffff80000701, r2, &(0x7f0000003ac0)) r10 = openat$audio1(0xffffffffffffff9c, &(0x7f0000003b40), 0x8000, 0x0) ioctl$SNDCTL_DSP_GETOSPACE(r10, 0x8010500c, &(0x7f0000003b80)) syz_genetlink_get_family_id$tipc(&(0x7f0000003c00), 0xffffffffffffffff) (async) r11 = syz_genetlink_get_family_id$tipc(&(0x7f0000003c00), 0xffffffffffffffff) sendmsg$TIPC_CMD_SET_NODE_ADDR(0xffffffffffffffff, &(0x7f0000003cc0)={&(0x7f0000003bc0)={0x10, 0x0, 0x0, 0x80000}, 0xc, &(0x7f0000003c80)={&(0x7f0000003c40)={0x24, r11, 0x1, 0x70bd2d, 0x25dfdbfc, {{}, {}, {0x8, 0x11, 0xe98}}, ["", "", ""]}, 0x24}, 0x1, 0x0, 0x0, 0x20040000}, 0x2) seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0xc, &(0x7f0000003d40)={0x5, &(0x7f0000003d00)=[{0x1, 0x3, 0x9, 0x4}, {0x1, 0x2, 0x9, 0x3}, {0x9c66, 0xb, 0x2d, 0x7ca}, {0xe0, 0x2, 0xbc}, {0x3, 0x3, 0xd, 0x5}]}) (async) seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0xc, &(0x7f0000003d40)={0x5, &(0x7f0000003d00)=[{0x1, 0x3, 0x9, 0x4}, {0x1, 0x2, 0x9, 0x3}, {0x9c66, 0xb, 0x2d, 0x7ca}, {0xe0, 0x2, 0xbc}, {0x3, 0x3, 0xd, 0x5}]}) r12 = openat$fuse(0xffffffffffffff9c, &(0x7f0000003d80), 0x2, 0x0) write$FUSE_ATTR(r12, &(0x7f0000003dc0)={0x78, 0x0, r8, {0x3, 0x8, 0x0, {0x0, 0x8000000000000000, 0x0, 0xfffffffffffffffd, 0xd, 0x4, 0x1ff, 0x5, 0xff, 0x2000, 0x7, r4, r3, 0x13, 0x9}}}, 0x78) (async) write$FUSE_ATTR(r12, &(0x7f0000003dc0)={0x78, 0x0, r8, {0x3, 0x8, 0x0, {0x0, 0x8000000000000000, 0x0, 0xfffffffffffffffd, 0xd, 0x4, 0x1ff, 0x5, 0xff, 0x2000, 0x7, r4, r3, 0x13, 0x9}}}, 0x78) socket$igmp(0x2, 0x3, 0x2) (async) r13 = socket$igmp(0x2, 0x3, 0x2) ioctl$SIOCGETSGCNT_IN6(r13, 0x89e1, &(0x7f0000003e40)={@private0={0xfc, 0x0, '\x00', 0x1}, @mcast1}) (async) ioctl$SIOCGETSGCNT_IN6(r13, 0x89e1, &(0x7f0000003e40)={@private0={0xfc, 0x0, '\x00', 0x1}, @mcast1}) r14 = socket$pppoe(0x18, 0x1, 0x0) ioctl$PPPOEIOCDFWD(r14, 0xb101, 0x0) syz_open_dev$midi(&(0x7f0000003e80), 0x9, 0x10800) (async) r15 = syz_open_dev$midi(&(0x7f0000003e80), 0x9, 0x10800) ppoll(&(0x7f0000003ec0)=[{r15, 0x202}, {r12, 0x200}], 0x2, &(0x7f0000003f00)={0x0, 0x989680}, &(0x7f0000003f40)={[0x5]}, 0x8) syz_open_dev$vbi(&(0x7f0000003f80), 0x1, 0x2) (async) r16 = syz_open_dev$vbi(&(0x7f0000003f80), 0x1, 0x2) ioctl$BTRFS_IOC_SUBVOL_SYNC_WAIT(r16, 0x40109441, &(0x7f0000003fc0)={0x80, 0x1, 0x7ff}) r17 = openat$ttynull(0xffffffffffffff9c, &(0x7f0000004000), 0x0, 0x0) ioctl$KDSKBMODE(r17, 0x4b45, &(0x7f0000004040)=0xf3c) (async) ioctl$KDSKBMODE(r17, 0x4b45, &(0x7f0000004040)=0xf3c) ioctl$NILFS_IOCTL_CLEAN_SEGMENTS(r16, 0x40786e88, &(0x7f0000004300)={{&(0x7f0000004080)=[{0x1, 0x1, 0x6, {0x6, 0x5}, 0xb766, 0x8, 0x7}], 0x1, 0x40, 0x5, 0xe7a1}, {&(0x7f00000040c0)=[{0x9, 0x8000000000000000}, {0x4, 0x6}, {0x7fffffff, 0xf0e3}, {0x4, 0x5800000000000}, {0x5, 0x3}, {0x6, 0x9}, {0x7fffffff, 0x2}, {0x5, 0x35d5}, {0x81, 0x158}, {0x7fffffff, 0x8}], 0xa, 0x10, 0xe, 0x49b9}, {&(0x7f0000004180)=[0xf, 0x80, 0x0, 0x81, 0x0, 0x4, 0x16, 0x5, 0x7], 0x9, 0x8, 0x6, 0x1}, {&(0x7f0000004200)=[{0xe26, 0x4, 0x6, 0x5, 0x7}, {0x5, 0x8001, 0x3, 0x2, 0x3}, {0xea73, 0x1, 0x6, 0xda2, 0x8c4}, {0x3, 0x5, 0x3, 0x1, 0x8}], 0x4, 0x28, 0xc, 0xe2}, {&(0x7f00000042c0)=[0x4, 0x2, 0x663e, 0xff23, 0x1, 0xffffffffffffffff, 0xffff], 0x7, 0x8, 0x9, 0x2}}) sendmsg$TIPC_CMD_GET_NETID(0xffffffffffffffff, &(0x7f0000004480)={&(0x7f0000004380)={0x10, 0x0, 0x0, 0x1000}, 0xc, &(0x7f0000004440)={&(0x7f0000004400)={0x1c, 0x0, 0x300, 0x70bd29, 0x25dfdbfb, {}, [""]}, 0x1c}, 0x1, 0x0, 0x0, 0x20040050}, 0x440c0) executing program 5: r0 = openat$snapshot(0xffffffffffffff9c, &(0x7f0000000000), 0x1, 0x0) r1 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000240)={0x11, 0x3, &(0x7f0000000680)=ANY=[@ANYBLOB="1800000000000000000000000000000095000000000000002815c180535a968d12134e46a3dae86a81de0f844b7eb2d9321a86340276b944ce530f2d50c95069fdfa8457ccd291"], &(0x7f00000001c0)='GPL\x00'}, 0x80) socket$nl_generic(0x10, 0x3, 0x10) bpf$BPF_GET_PROG_INFO(0xf, &(0x7f0000000580)={r1, 0xe0, &(0x7f0000000480)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, ""/16, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x88, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8, 0x0, 0x0}}, 0x10) bpf$MAP_CREATE(0x0, &(0x7f0000000700)=ANY=[@ANYBLOB="190000000400000004000000bc4c8c5300000000", @ANYRES32, @ANYBLOB="0000000000000000000000000000000000000000f49af77cb626fe4585e1241c1f40b5bf38f9a73d984bca4ab1131fae1fe0dfafb2fc19486462c08510d28033607882c0e2453c8ba4e4f4f3061238e1b086d6241720f399c6530abbfcf782c34438f46f80a316bf9bf1d7988133eedf18079fa2cb4e8da044147eb351ddbb9604d9a0bf3a70d72b3766487a3e143c479c653dc94de756d608ed473a64d35304f1204e110fbe2afc9448e2783f84c1c7b42304a5fc342a746f0ed0732c34c9d2d4ac2de00408dc462ddd2dcd41685d6cf55af2ae8f002dddf13fbe2b943822c009a5ca6d06b22d52e7c97c05074f12aa1a1431b7e3a384af38e52b03fe5ca88095ab2c6733d5b4e8954d6415d9a6ccd980ac87b37f18b632cee80c02bccd58bf347fb7ccd717c9aaace450711f3fa78b9b05ee62d0a3", @ANYRES32=0x0, @ANYRES32, @ANYBLOB='\x00'/28], 0x48) r3 = socket$nl_generic(0x10, 0x3, 0x10) r4 = syz_genetlink_get_family_id$fou(&(0x7f0000000b80), 0xffffffffffffffff) sendmsg$FOU_CMD_ADD(r3, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000640)={&(0x7f0000000340)={0x24, r4, 0x1, 0x70bd28, 0x25dfdbfc, {}, [@FOU_ATTR_PEER_V4={0x8, 0x8, @empty}, @FOU_ATTR_PEER_PORT={0x6, 0xa, 0x4e25}]}, 0x24}, 0x1, 0x0, 0x0, 0x60044831}, 0x40080) r5 = bpf$BPF_PROG_GET_FD_BY_ID(0xd, &(0x7f00000000c0)={r2}, 0x4) r6 = openat$mixer(0xffffffffffffff9c, &(0x7f0000000700), 0x101180, 0x0) r7 = socket$nl_rdma(0x10, 0x3, 0x14) pipe(&(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}) pipe(&(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) splice(r7, 0x0, r10, 0x0, 0x400000008000f28, 0x0) splice(r9, 0x0, r8, 0x0, 0x110, 0xe) sendmsg$RDMA_NLDEV_CMD_NEWLINK(r7, &(0x7f0000000340)={0x0, 0x0, &(0x7f0000000080)={&(0x7f00000003c0)=ANY=[@ANYBLOB="00010000031401"], 0x100}, 0x1, 0x0, 0x0, 0x4040030}, 0x0) ioctl$SOUND_MIXER_WRITE_VOLUME(r6, 0xc0040d07, &(0x7f0000000040)=0x121) bpf$BPF_GET_PROG_INFO(0xf, &(0x7f0000001440)={r5, 0x77, &(0x7f0000000440)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2d, 0x0, ""/16, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x0, 0x7, 0x0, 0x0, 0x0, 0xaa, 0x8, 0x0, 0x0}}, 0x10) bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x3, 0x3, &(0x7f0000000040)=ANY=[], &(0x7f0000000200)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', r11, @sched_cls=0x37, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) r12 = syz_open_dev$sg(&(0x7f0000001600), 0x0, 0x40042) write$binfmt_aout(r12, &(0x7f0000000480)=ANY=[@ANYBLOB="0000000000000000000000800080000014000091ff0f00004500f5ff06ff00010100fc5e15f4c3d3fbd80dad00000a"], 0x125) bpf$PROG_LOAD(0x5, &(0x7f00000017c0)={0x1, 0xe, &(0x7f0000001880)=ANY=[@ANYBLOB="b70000000100000bbfa30000000000000703000000feffff720af0fff8ffffff71a4f0ff00000000ae04020000000000be400300000000006504030001ed00007b130000000000004d44000000000000630a04fe0000000071330000000000009f030000000000009500000000000000023bc065b7a379d17cf9333379fc05000000912435f1a864a710aad58db6a693002e7f3be361917adef6ee1c8a2a4f8ef1e50bec919bc461e91a7168c5181554d1b583c587e436fe275daf51efd601b6bf01c8e8b1b526375ec5dd6fcd82e4fee5bef7af9a0200000000000000e3ff3128e599b0eaebbdbd732c9cc00eec363e4a8f645679c294392cf538b07ce2646cb7798b3e6440c2fbdb00a3e35208b0bb1d2cd871c5548930be3835f2554b4a28610643a98d9ec21ead2ed51b104d4d91af25b84550a7925c3109b151b8b9f75d80000000eda88c658d42ecbf28bf7076c15b463bebc72f526d8e4a9e231d512381e7a78afcb913466aae7f6df70252e79166d858fc152b659da074e1320060d0b11008e59a5923906f88b53987ad1714e72ba7a5b74f0c33d39000d06a59ff61622cfd9aa58fe8d485ae2c0cc65c2a36aaec2477584b6a89adaf17b0a6041bde4cc3ed54d27f777e92b87496e6649cf728d236619074d6ebdf098bc908c423d228a40f9411fe7226a40409d6e37c4f46756d31cb46761bade70063e5291569b33d21dae356e1c51f03fb8a63e089679216da18de0ae564162a27afea62d84f3a10746443d64364f56e24e6d21053d901204a1deeed41556175cbd4041b7d301bcb72652d950ad31928b0b093778b68e2e9853c02d0f5ad94b081fcd507acb4b9c65fee9d5a17f48a7382f98928d5e9b94ff9ae49cee383dc5049076b98fb6853ab39a21514da60d2ae20cfb91d6a49964757cff538f9ce2bdb1ab062cd54e67011d355d84ce97bb0c6b4a595bcf50ab32d710b651f898ba749e40bc6980fe78683ac5c0c31030699ddd71063b59261b2e1aab1675b34a220488c126aeef5f510a8f1aded94a129e4aec6f8c3a13596c2ea3e2e04cfdce669e51731b2875353193f82ade69d0540059fe6c7fe7c00fb7502c7596566d674e425da5e87e59602a9f6590521d31d3804b3e0a1053abd47b64a1b304502dda787343ce3c95300000000010000003baae244e7bf37548c7f1a4cad2422ee965a38f7defbd2960242b104e20dc2d9b0c35608d402ccdd9069bd50b994fda7a9de44022af46667cf25c5d3038816106dec28eaeb88343261a48a18f562ae00003ea96d10f172c0374d6eed82641687f3b3a70bfeff59d54d1f92ecc4e95dd2d18383117c03987d198899b212c55318294270a1ad10d30fef7c24b78b29d83238273f4fc87afce829ba0f85da6d888f18ea40ab959f6074ab2a4009b9e5f07ab513cdc6c0e57fb1c1ca571380d7b4ead8eaf68b0c5dda0467d35a3807000000b702396df7e0cbe02b6e4114f244a9bf93f04beb72f0861f7580e69db384ac7eeedcf2ba1a9508f9d6aba582a896a9f1ffa968eacea75caf822a7a63ba34015ea5aacb1188883ad2a3b1832371fe5bc621426d1ea1e717d29135753208165b9cdbae037f315c7d951680f6f2f9a6a8346962a350845ffa0d829e4f79adc287906943408e6df3adbfd03aac93df8866fb010aec0e92bed1fe39af169d2a466f0db6f3d9436a7d55fc30511d00000000c95265b2bd83d64a532869d7012c1b45f6ada1ee7baa5b6a686b50f09b7f778af083e055f6138a757ebd0ed91114a6b244f9acf41ac4d73a008364e0602a594817031fc2ff2c32a1989e00f52f8785fe0721719b3d654026c6ea08b83b123145ab5703dad844ceb201ddeb6dc5f6a9037d2283c42efc54fa84323a3c3e6e4fd2e016820f78b796a825b3dad9ce7b37507e0b83c3ecd01549bca6a016b3e18a00c748894dc3bfe5efda8b0a477d6a6562fdee45eb16e276dee992094ba9830f6c164179e7d532d86060bea930118d3cae1b8f916b9671b7000000000040f4bee5ad2dea2d14e195265504c05bba38b095e1679f96ddef65ba5de9c8cfb6465ae4165c0689a314a6eb6b36aa705b957edef3035e14b879d4e7dc00624708042e00bf9a7f7ae5f308744770759558e4fcb99c0dc957521ef255362bf2f3966f3754e81fb9bdef22c19f5a49147b85343f9f36bcda9f64b7a5c5b2f5452f5b1de02e6f15c5640bf89d4a74d51dc233dee628c1dfbb5566b98478c174b34eb234481547e484c6af101396b6977dd668b401391c1dc54f2edccf1cabe6be9868d383eb937efdfd9ade018106f544f04fc07ad525497f65fbad3cf145396acf3b0d38e6b46e28d86880fd6f62c373000000000000000000005d194c27cd4d8f6727f59c71dc84311c0f1fb6c87081c7be9355288610c32c2d8c18bf2027212182903687f48262aea54c5f8a315c9aa4a5af1aa2c4007d1baae38c270012b7eb9411ae451204dba30f8321b07a18db97c3e0cf6a15170e515b1cc463a67a5b2b23ec5662ccfa898b8d5075647bdfb390cde56efb8fd42df12c5c8f66bdc58449ec2b38bf12f5f0a49dcbcf4e6f11c47d23fa34793a0000a1cbb1e06e9a8d2449451d7a05ec0a0d3c9716f505ddeba488c60ebf44cac05c2739694359c925148137376dd3f1330ed0e9211f73ee279cc0b5c298422395ce438f48a39ff569375e609f9e904aacc3d8011326d5e4d654c74501cf16bbf72d3984f9b4ef000000003a8a3d49fc837001e4622e58e3a4ef6b55a8dd0680d951cdb6e54ed92a9a6a0e5e494b7b7b0ef4b4bafc5d964551b2a22bfd12b0761ef07a103e51e84917ee44f860b9785e264343f6a80e9318edecf73df6940856cd56c56eb3831445833c701044aaa49439a44a624267580b3c0980d7f87437bf498f6e1915450400000000000000564a02552c0a5fedbcf4da0db6ed03b9dbc224ee76d20aaf1ac74bcb7eb6f202209e64cc4d130dcf6ab3df8ae4911deb4bb5c7df97fc348d151e834be73915f854272f69d88123f666448b6a8e73322b04fffea9cc05e4129debf311c73b4d1a244b1e5b9943028745a0b6477686740ab877315e35624d791e6f71adb1acd3e22cf472ff7e048b16c11c84da9a3b16b92665912132a4dba680052919c20e191311d8092a09f3c609823fed1bd651ce1c34de105790ba2ca3afa26647f66efbf97b109e7226c74e32beb14ff3fd6918e255fc9b42f86b0188cf885afcc9bb77a7fc3ca7ec1015af494add960f8a11422ca005f24006867cd156e0350022943e301b2c07f4d37d07b05ac2fa1f1d5a0d6eb7e992b076bd77509c26034d2a740d578476410b413591884136259693effaf27e7bcfb58efa92625fb9bd68ecca42047f6e7d24b0446ea16a310073c163d1c6aa3ba1fe76b4e88d5f98cc05c6d033e2c28b4990892230d6b4e5c083a601a25145eb22f4f77313117f8147810d95c64fb78b0a000000000000000000000000e92ba8b066e4bd82bb6003d5da8791d838bcd6eefb13000000000000000000000000000000b652ff6fbad82da75114742bc6a27cba894ef490531be709a3a3c81b267dfafa55e6f855200b4e7518682c30f40808cd5bb8f00beb63b4989cc01d8e75a182337b9f9e08430ccec9bda0134d07a9f54b60033182f5d2bb61fd130d65e68bf148d26470060c707a8cf750ca954ee63c78cd975c7f565783383f02edcb7ce4a9ed0c511d18fe32352276d72eefe0d566f97ccae16b3492f60b96574aac4f1862fb6e4932c181dbf8c68ca16b765de9edba0bf5bfb9c4950d19c0bc31db02f374ce62141160436639d4b6cb0033a47ffdc54d55f1136743b1b26946f200000000000000007590ab8f29c7accd9d11786c4ca1271cd2293b572f14a3dfcaa3467f2783fc09e3eee3fa4b82b7b6ce904e05fa797a2f7ff63e4f874bd870821f6460904e05d7a3f8295a9a5fba1e3587b9d9e878c86ba9b66c4491fcff607d9cbf156f3fc0fb8c827d4e6cac493a3e2746bd5f0f8bc024352200a4250785cdca4fe3c546972d0a56e3905d1e72c33d64f6591fe25f312f47e7ec6b4640f1f6dc4efee4b8d3cfbfcbf77bfd52f0a99adc7d359233cfea0a11f5dcb87603885f08d633e842644988d2f45a1824361b5df707f726fad22d53727b4396b3d05df34933262fdb09f19837fdc2af1c721b17d54076e25ab625ae0a4c9cd900"/3002], &(0x7f00000001c0)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x8, &(0x7f0000000000), 0x0, 0x10, &(0x7f0000000080), 0xfffffffffffffdbb}, 0x48) r13 = socket$nl_xfrm(0x10, 0x3, 0x6) r14 = openat(0xffffffffffffff9c, &(0x7f0000000000)='./file1\x00', 0x2040, 0x0) fcntl$getflags(r14, 0x401) clock_gettime(0x0, &(0x7f0000000880)={0x0, 0x0}) mq_timedsend(r14, &(0x7f0000000600)="53afc0576f834b3d3da0c09a9bad1b934897811508589f1b9b6009cc6a4f5d0030ba6900735377684f84acf6d32e24691d8bf92c121660f3beae191ac79d02fe465af4c10bb3c29a8452253481dfdfddea5b46665ba224156d1c1486fdf0963ebe6032a21563b7297f138e1bd1535180b7a91cac8e06826f9f26aa74847773", 0x7f, 0x6, &(0x7f00000008c0)={r15, r16+60000000}) sendmsg$nl_xfrm(r13, &(0x7f00000005c0)={0x0, 0x0, &(0x7f0000000580)={&(0x7f0000000240)=@migrate={0x27c, 0x21, 0x1, 0x0, 0x1, {{@in, @in6=@remote}}, [@migrate={0x219, 0x11, [{@in=@multicast1, @in=@local, @in=@local, @in=@broadcast, 0x3c, 0x4, 0x0, 0x3505, 0xa, 0x2}, {@in=@empty, @in=@initdev={0xac, 0x1e, 0x0, 0x0}, @in=@multicast2, @in6=@empty, 0x6c, 0x1, 0x0, 0x3506, 0x2, 0x2}, {@in=@empty, @in=@private=0xa010100, @in6=@remote, @in6=@mcast2, 0x33, 0x2, 0x0, 0x0, 0xa, 0xa}, {@in=@local, @in6=@local, @in6=@empty, @in6=@private2, 0xff, 0x3, 0x0, 0x3503, 0x8, 0x2}, {@in=@broadcast, @in6=@ipv4={'\x00', '\xff\xff', @multicast2}, @in=@private, @in=@dev, 0x0, 0x1, 0x0, 0x3506, 0x2, 0xf}, {@in6=@mcast2, @in=@broadcast, @in6=@private2, @in6=@remote}]}, @policy_type={0xa}, @replay_esn_val={0x40, 0x17, {0x9, 0x70bd29, 0x70bd2d, 0x70bd27, 0x70bd28, 0x7f, [0x0, 0x7, 0x7, 0x5, 0x80, 0x0, 0x5, 0xfffffff7, 0x6]}}, @proto={0x5, 0x19, 0x6c}, @mark={0xc, 0x15, {0x35075d, 0x3}}]}, 0x27c}}, 0x0) ioctl$SNAPSHOT_PREF_IMAGE_SIZE(r0, 0x3312, 0x80) gettid() executing program 5: r0 = socket$kcm(0x10, 0x2, 0x0) sendmsg$kcm(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000300)=[{&(0x7f0000000040)="2e00000010008108040f80ecdb4cb92e0a480e000f000000e8bd6efb250314000e000100240248ff050005001200", 0x2e}], 0x1}, 0x40880) bpf$PROG_LOAD_XDP(0x5, &(0x7f0000000240)={0x6, 0x5, &(0x7f0000000080)=ANY=[@ANYBLOB="180000000000000000000000000000002e0000000000000085100100fbff14fe0e11096014ff3a997c6942932ebca456de6d6918dc1fffa9dd55962bb08de1"], &(0x7f0000000040)='syzkaller\x00', 0x0, 0x0, 0x0, 0x0, 0x9}, 0x94) socket$kcm(0x10, 0x2, 0x0) (async) sendmsg$kcm(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000300)=[{&(0x7f0000000040)="2e00000010008108040f80ecdb4cb92e0a480e000f000000e8bd6efb250314000e000100240248ff050005001200", 0x2e}], 0x1}, 0x40880) (async) bpf$PROG_LOAD_XDP(0x5, &(0x7f0000000240)={0x6, 0x5, &(0x7f0000000080)=ANY=[@ANYBLOB="180000000000000000000000000000002e0000000000000085100100fbff14fe0e11096014ff3a997c6942932ebca456de6d6918dc1fffa9dd55962bb08de1"], &(0x7f0000000040)='syzkaller\x00', 0x0, 0x0, 0x0, 0x0, 0x9}, 0x94) (async) executing program 5: prctl$PR_SET_MM_MAP(0x23, 0xe, &(0x7f0000000080)={&(0x7f0000ff0000/0x1000)=nil, &(0x7f0000ffd000/0x3000)=nil, &(0x7f0000ba3000/0x4000)=nil, &(0x7f0000ffc000/0x4000)=nil, &(0x7f0000ff8000/0x4000)=nil, &(0x7f0000fff000/0x1000)=nil, &(0x7f0000ffb000/0x3000)=nil, &(0x7f0000a18000/0x2000)=nil, &(0x7f0000e1d000/0x1000)=nil, &(0x7f0000ffa000/0x1000)=nil, &(0x7f0000ff8000/0x2000)=nil, 0x0}, 0x68) sendmsg$NFT_BATCH(0xffffffffffffffff, &(0x7f0000000080)={0x0, 0x0, 0x0}, 0x4004045) r0 = io_uring_setup(0x1b7e, &(0x7f0000000040)={0x0, 0x970, 0x1f480, 0x0, 0x399}) openat$fb0(0xffffffffffffff9c, &(0x7f0000000140), 0x4000, 0x0) syz_clone(0x11, 0x0, 0x0, 0x0, 0x0, 0x0) r1 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000400)={0x32, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xa}, 0x94) ioctl$BTRFS_IOC_GET_DEV_STATS(0xffffffffffffffff, 0xc4089434, &(0x7f0000000780)={0x0, 0x1, 0x0, [0x806f, 0x0, 0x2d5, 0x9793, 0x6], [0x9d8, 0x5, 0x1, 0x6, 0x8002, 0x0, 0x5, 0x2, 0xf86, 0x802, 0x9, 0x200000100, 0x3, 0xfffffffffffffff4, 0x4a, 0x5, 0x100, 0xd, 0xdd, 0x5, 0x1, 0x2a9, 0x2, 0xc3c, 0x3, 0x8, 0x100000000, 0x2, 0xa51, 0x8, 0x401, 0x800000000000003, 0x7, 0xfffffffffffffffa, 0x81, 0x100, 0x5, 0x931, 0x4, 0x3, 0x8001, 0x9, 0x7, 0x1, 0x8, 0x5, 0x6aa, 0x102, 0x1, 0x83, 0x538a, 0x9, 0xfffffffffffffffb, 0x4, 0xfffffffffffffffe, 0x4, 0x805, 0x8, 0x8000, 0x8000000000000000, 0x4, 0xfffffffffffffffc, 0x14, 0x5bc, 0x1, 0x7ffffffb, 0x4, 0x8000, 0x2, 0x7, 0x6, 0x9, 0x82c, 0x7ff, 0xe000000000000, 0xe4, 0xf, 0x0, 0x8, 0x22, 0xfffffffffffffff9, 0x7, 0x1, 0x8000000000000000, 0x2000000009, 0x7, 0x0, 0x6, 0x6, 0xb, 0x100000002, 0x4, 0x4, 0xb, 0x7, 0xa, 0x8, 0x5, 0x16d, 0x6, 0x68d, 0xffffffffffff43b0, 0x8, 0x50000000000000, 0xe, 0x0, 0x0, 0x4000, 0x4, 0x7, 0x406, 0x3, 0x6, 0x2, 0x0, 0x3, 0x40, 0x7fffffff, 0x7, 0xe, 0x3]}) r2 = openat$tun(0xffffffffffffff9c, &(0x7f0000000080), 0x80, 0x0) close(r2) r3 = openat$ppp(0xffffffffffffff9c, &(0x7f0000000080), 0x0, 0x0) ioctl$TUNSETOFFLOAD(r3, 0xc004743e, 0x110e22fff6) ioctl$TUNATTACHFILTER(0xffffffffffffffff, 0x401054d5, &(0x7f0000000180)={0x2, &(0x7f0000000040)=[{0x40, 0x1, 0x0, 0xfffffc00}, {0x6, 0x0, 0x0, 0x2000000}]}) ioctl$TUNGETVNETLE(r2, 0x40107446, &(0x7f0000000180)) bpf$ENABLE_STATS(0x20, 0x0, 0x0) r4 = openat$ppp(0xffffffffffffff9c, &(0x7f0000000080), 0x1, 0x0) r5 = socket$can_raw(0x1d, 0x3, 0x1) setsockopt$CAN_RAW_ERR_FILTER(r5, 0x65, 0x7, &(0x7f0000000200)=0xd, 0x4) ioctl$ifreq_SIOCGIFINDEX_vcan(r5, 0x8933, &(0x7f0000000280)={'vxcan0\x00', 0x0}) sendmsg$can_raw(r5, &(0x7f00000004c0)={&(0x7f0000000140)={0x1d, r6}, 0x10, &(0x7f0000000080)={&(0x7f0000000000)=@can={{0x0, 0x0, 0x0, 0x1}, 0xfe, 0x1, 0x4, 0x0, "36e932c486d275cc"}, 0x80c}, 0x1, 0x0, 0x0, 0x84844}, 0x0) ioctl$TUNSETOFFLOAD(r4, 0x4004743d, 0x110e22fff6) write$cgroup_type(r4, &(0x7f0000000280), 0x9) ioctl$sock_SIOCGIFINDEX_80211(0xffffffffffffffff, 0x8933, &(0x7f0000000000)={'wlan1\x00'}) r7 = openat$vimc2(0xffffffffffffff9c, &(0x7f0000000100), 0x2, 0x0) io_uring_register$IORING_REGISTER_FILES(r0, 0x2, &(0x7f0000000140)=[r1, r0, r0, r0, r3, r4, r3, r4, r7, r3], 0xa) syz_open_dev$char_usb(0xc, 0xb4, 0x1) r8 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000240), 0xffffffffffffffff) sendmsg$NL80211_CMD_GET_WIPHY(r1, &(0x7f00000003c0)={&(0x7f00000001c0)={0x10, 0x0, 0x0, 0x42764e17fb2b46bf}, 0xc, &(0x7f0000000380)={&(0x7f0000000340)=ANY=[@ANYBLOB="14000000", @ANYRES16=r8, @ANYBLOB="000100"/14], 0x14}, 0x1, 0x0, 0x0, 0x4000040}, 0x40801) io_uring_enter(r0, 0x8ae, 0x6933, 0x17, 0x0, 0xeffd) r9 = bpf$MAP_CREATE(0x0, &(0x7f00000002c0)=ANY=[@ANYBLOB="1b00000000000000000000000080000000000000", @ANYRES32, @ANYBLOB='\x00'/20, @ANYRES32=0x0, @ANYRES32, @ANYBLOB='\x00'/28], 0x50) bpf$PROG_LOAD(0x5, &(0x7f0000001540)={0x6, 0xc, &(0x7f0000001480)=@framed={{0x18, 0x0, 0x0, 0x0, 0xfffffffe, 0x0, 0x0, 0x0, 0x9}, [@ringbuf_output={{0x18, 0x1, 0x1, 0x0, r9}, {}, {}, {0x4}, {0x6, 0x0, 0xa}, {}, {}, {0x85, 0x0, 0x0, 0x83}}]}, &(0x7f0000000080)='syzkaller\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @xdp=0x25, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) executing program 5: r0 = socket$nl_xfrm(0x10, 0x3, 0x6) r1 = openat(0xffffffffffffff9c, &(0x7f0000000040)='./file2\x00', 0x18f442, 0x15) pwrite64(r1, &(0x7f0000000000)="ff", 0x58200, 0x2200) r2 = ioctl$KVM_GET_STATS_FD_cpu(r1, 0xaece) mkdirat(0xffffffffffffff9c, &(0x7f0000000100)='./file0\x00', 0x1c1) mount$9p_virtio(&(0x7f00000001c0), &(0x7f0000000480)='./file0\x00', &(0x7f00000004c0), 0x0, &(0x7f0000000c00)=ANY=[@ANYBLOB="56c78e3c733d76697274696f2c6e6f657874656e642c6163638173733d616e792c63616368653d667363616368652c76657273696f6e3d3970323030302e75"]) chdir(&(0x7f0000000080)='./file0\x00') unlink(&(0x7f00000002c0)='./file0\x00') mknodat$loop(0xffffffffffffff9c, &(0x7f0000000000)='./file0\x00', 0xffffffffffffc000, 0x1) ioctl$KVM_CREATE_VCPU(r2, 0xae41, 0x1) r3 = socket$can_j1939(0x1d, 0x2, 0x7) ioctl$ifreq_SIOCGIFINDEX_vcan(r3, 0x8933, &(0x7f00000004c0)={'vcan0\x00', 0x0}) ioctl$AUTOFS_IOC_PROTOVER(r2, 0x80049363, &(0x7f0000000380)) bind$can_j1939(r3, &(0x7f00000000c0)={0x1d, r4, 0x0, {0x1, 0x0, 0x4}, 0x1}, 0x18) r5 = socket$nl_generic(0x10, 0x3, 0x10) r6 = syz_genetlink_get_family_id$ethtool(&(0x7f0000000040), 0xffffffffffffffff) getpeername(r3, &(0x7f00000003c0)=@pppol2tpin6={0x18, 0x1, {0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, {0xa, 0x0, 0x0, @local}}}, &(0x7f0000000440)=0x80) mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./proc\x00', 0x1ff) mount(0x0, &(0x7f0000000000)='./proc\x00', &(0x7f0000000000)='proc\x00', 0x0, 0x0) r7 = openat(0xffffffffffffff9c, &(0x7f00000000a0)='./proc/net/afs/rootcell\x00', 0x2, 0x4) write(r7, &(0x7f00000000c0)='s', 0x1) sendmsg$ETHTOOL_MSG_TSINFO_GET(r5, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000080)={0x2c, r6, 0x6a98047402e98331, 0x0, 0x0, {}, [@HEADER={0x18, 0x1, 0x0, 0x1, [@ETHTOOL_A_HEADER_DEV_NAME={0x14, 0x2, 'geneve1\x00'}]}]}, 0x2c}}, 0x4000000) r8 = accept$packet(r2, &(0x7f00000001c0)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @random}, &(0x7f0000000280)=0x14) getsockopt$IP_VS_SO_GET_DAEMON(r8, 0x0, 0x487, &(0x7f0000000300), &(0x7f0000000340)=0x30) connect$can_j1939(r3, &(0x7f0000000640)={0x1d, r4, 0x0, {0x0, 0x0, 0x3}, 0x1}, 0x28) writev(r3, &(0x7f0000000280), 0x0) sendmsg$nl_xfrm(r0, &(0x7f0000000180)={0x0, 0x0, &(0x7f00000002c0)={&(0x7f0000000000)=ANY=[@ANYBLOB="50010000100001002b7acea236aee725fbd0a066809122bc700000000004fe80000000001443000013fb0000000000000007000000080003f7040a0060000000000000000000", @ANYRES32=0x0, @ANYRES32=0x0, @ANYBLOB="00000000000000000000ffffe00000010000000032000000e0000002000000000000000000000000feffffffffffffff0400000000000000030000000000000000000000000000000000000000000000fcffffffffffffff0000000000000000890000000000000003000000000000000408400000000000090000000000000092020000000000000000b01c000000000000000026bd700000000000020004006c00000000000000600002006362632874776f666973682900000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000c000000072f01afe02000000366a6a849a73904500240062227c0219"], 0x150}, 0x1, 0x0, 0x0, 0x8000}, 0x4050) executing program 5: r0 = socket$nl_xfrm(0x10, 0x3, 0x6) mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./sys\x00', 0x1ff) r1 = socket$nl_generic(0x10, 0x3, 0x10) r2 = socket$nl_generic(0x10, 0x3, 0x10) signalfd4(r2, &(0x7f0000000080)={[0x100000001]}, 0x8, 0x800) ioctl$ifreq_SIOCGIFINDEX_batadv_mesh(r0, 0x8933, &(0x7f00000003c0)) r3 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000480), 0xffffffffffffffff) ioctl$sock_SIOCGIFINDEX_80211(r2, 0x8933, &(0x7f0000000100)={'wlan1\x00', 0x0}) sendmsg$NL80211_CMD_FRAME(r2, &(0x7f0000001380)={0x0, 0x0, &(0x7f0000001340)={&(0x7f0000000000)=ANY=[@ANYBLOB="f4060000", @ANYRES16=r3, @ANYBLOB="01000000000000e14f003b00000008000300", @ANYRES32=r4, @ANYBLOB="d506330080000000ffffffffffff080211000001"], 0x6f4}}, 0x0) ioctl$sock_SIOCGIFINDEX_80211(r0, 0x8933, &(0x7f0000000080)={'wlan0\x00', 0x0}) sendmsg$NL80211_CMD_DEL_PMK(r1, &(0x7f0000000340)={&(0x7f0000000040)={0x10, 0x0, 0x0, 0x8000}, 0xc, &(0x7f0000000300)={&(0x7f00000002c0)={0x40, r3, 0x100, 0x70bd26, 0x25dfdbfd, {{}, {@val={0x8, 0x3, r5}, @void}}, [@NL80211_ATTR_MAC={0xa, 0x6, @broadcast}, @NL80211_ATTR_MAC={0xa, 0x6, @device_b}, @NL80211_ATTR_MAC={0xa, 0x6, @broadcast}]}, 0x40}, 0x1, 0x0, 0x0, 0x20000000}, 0x40000) mount(0x0, &(0x7f0000000180)='./sys\x00', &(0x7f00000000c0)='sysfs\x00', 0x0, 0x0) r6 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./sys/kernel/mm/lru_gen/enabled\x00', 0x100141, 0xa) syz_genetlink_get_family_id$nl80211(0x0, 0xffffffffffffffff) syz_genetlink_get_family_id$l2tp(&(0x7f0000000380), 0xffffffffffffffff) mkdirat(0xffffffffffffff9c, &(0x7f00000021c0)='./file0\x00', 0x3a) mount$tmpfs(0x0, &(0x7f0000002040)='./file0\x00', &(0x7f0000002200), 0x1000000, &(0x7f0000000000)={[{@noswap}]}) mount$tmpfs(0x0, &(0x7f00000000c0)='./file0\x00', 0x0, 0x2b00ad, &(0x7f00000004c0)={[{@noswap}]}) r7 = getpid() r8 = syz_pidfd_open(r7, 0x0) open_by_handle_at(r8, &(0x7f0000000180)=ANY=[], 0x20a081) write(r6, &(0x7f0000000140)='n', 0x1) sendmsg$nl_xfrm(r0, &(0x7f0000000180)={0x0, 0x0, &(0x7f00000001c0)={&(0x7f0000000200)=@updpolicy={0xb8, 0x15, 0x1, 0x0, 0x0, {{@in=@multicast1=0xe0000002, @in6=@empty, 0x0, 0x0, 0x0, 0x0, 0xa}, {0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0xffffffff}, {}, 0x0, 0x6e6bb5}}, 0xb8}, 0x1, 0x0, 0x0, 0x810}, 0x0) executing program 5: syz_fuse_handle_req(0xffffffffffffffff, &(0x7f0000000000)="d2c113c29ca1f0329c09333c4e57bb838cfea716579dab7d1cbdce058b04b86cd2573f5a46ec9ad1bb3c276903ebcad8758f3bdb0ea994c5ea01d7771c5b21040018c812e3b3d2c92d14193a28633e7a06c3239d8e97c69f11a821f535082d74ee0c1925c46bfba566d8c9647889a9dde67089b24871471415a695730085f81a0b7c8dc2eae85ccd015b85d7d1fecd2528f2a8369ee0315327ba0d506a583c716ea4fa23575566c8cf1a2a844691717179b82f10998b7d540188e57e864820665ab70db2d483c4fdcb115ea6bbd4a888f9d383f6fea063635b69686590f540c638a77fe8e8cb266cf72667e61871faf1d1810c749c30c5a7b61609d81114f7aa0355967a7513f659d021338ddb687b0f7372386170902b612c56f58dc73a1ccecb389ccd39f926ee91220a5c053dc277919ed4e32b63da14781cb46227a71388f2aeb37e8971d4a554824bb05f7e6861a916c94204feae48f115680a40b7b2da6ec3af295979016cb78ee53d347a2a8de81c26d0468db8b59df449513e109f26ccdff64403180deba17211813b69ef3f0c42f498a6f3d05a4e7f47f99a8b9ff6bb375fcd1cf444a794a7c2a274f2786c8c220b1f80f2d0c1f311960b37357e31198a44f1e25aaa320f6daad7a42c0367de29a2d0d5567098dfc4ac2b0393a7accfaed79afeec5c9d526503e8fbbd3d1f6365c698775999e5109bada3ec51a9d4b884631086bcfa4fe99135a7c482d9e3d2cbd0a58a42f8cd737a812c21185d909bab234d412bd450da975be70eac2a8db479f7030ff5f41817cd798d59a2db9d8d829765459531044ba3bfa6fc89d046c75e707133e5211fd05d20f63d4f493b23bcd966e3f4314a512451b761fb3b3ed815da07c604f71d2a86937142ede6fce427766dbde15f74f2c45d4c3c08e815b507bb05ee97ddf7ed79ea2ddd5c6ef057d455d84c79bdfd6e68ba6f5cd806a6b9dfd5ed65e394554fb59df7aba2676779a547cf8a7c97379abc760e94e01264a2a23c8c63296ec0d9a4e0aa5c9c470fe46beb8db8322372f3649b7d2ad0b8d09e77e4757a2f40835860b56d41382fabc35d891deedd2168ff3b20f3345ec3238ce795fd9b0311fbd7cf10bbefe4e9349bdf7ea5294f3fc3ded1203c01c9a057641ea122eea48e30b942fdebdc4e7263353361dfcf3562eb3f7eb491fe5394ac1e9af734950b3de71b557bd1baf334d39c5dd9e6842a3ef24004eafc5eb85fbdad5c1e49f60f565da146b119f27ec9077774e21300edf2883f34e299ae0465779ab80ba2d097f5d791a72785f35090dbc369864476c33d3279382a49ac45be1706211659d6fac1ae12d772fa270eb3746a69082e67664f4be335f2d172d52f5083a0768e5d4332352be40eb41e3406de4498e740a470141032ea251c144cdb5352d8049281898c72f13a5d3509c9c77308fe45016abfd7d42b1a022a60b9a5bbcece7c0a10bf9f157995465729b38fdcadd0d977574636206982a6b4e8f24bc75e3eb054fb9ae81e878afd24cfa9756f053bb89f0e4a42e195bd2af8a91a6dd5c9fbccd938681a7387ed22a0e3a8284d3182aa7ef1905a267850fc405494d7079f6d0364287cf7b16dc2310b15bc49fb68d1a96075cb5f30f4fc2ec0c51d0b7e806e78f108f4060a55b8c23b3c89a2f2fa321d5138019c417a504d230ec496583933daba2998e20d8f9a2e6798f681e1d4df88fa4e084513d3648ed4f6624d8b894470cf325e837ad177a634bf58d21378fa0d3370bcb724fa88314bbd0749bbe6ff9dd5d7826701891c180278833c3327a8b1500c3e86fbdaacaaba0e0f708052ddecaae4fe142689c812aeccc7211f61159e0787a8f639d1f0a4db373c17317fea5d3ca1c6060fc44a2d02502f0230334acb69861f0cdb82220827f5887a14e7eab133ce4ecd9a414b2a6b31d8c631325319bbb65ad01aaea7e157fea6cbb434c67f4582028c32f5890ceb243dc972e61e122cb36840d5838dff32d4b613ae1909f3970404fb1973f1e80b0e388141b2e24d47276be045880a4ac18fd136c08cf266b35c75e9b796f6210817439833b613195fe4688b22127a978d20f8b32e3df3297e09a565e659857d8052bf69c5006c5870bd25e6c3aeb411553924d06ccb849cdeca659448cb220d259b4ee20d256d44149814b5e13ab365c448369a43553e01874acded99d24da7d1c9c283dae95b0b5311344af85c7c9a8483fb18a5bfd7a4fb4bbade211edfa4c30f3d1b5bc9672a02adb5d638faea66424e2c82540937dc4cf21392fe16e05811f1bcfb83132deb1cf2a522f9b543758b25d6949400af5d2a7a566f4ab0f5fe0b0a8e8379850e3ed78cb823f5b59b3df4de700427b197720ec69b86c76080b2cfdc4a2619e9d2a901e247e591d79dea91257c0d4a3c7ebb86af42de6833aaaa2d69b71e684236705744b79c62079236759def4a37a0b97742dcdc1af8e54385ad496af31cffe7539e4a69d65ae28845439e5e3eea34785e6065c32f3c7b71ef4edfdb16ca9ee9d5d4e066a60f9919461ce932a61c4100276dad7a22447c681bfebac9186f23dd38509090e0c0fd60219d33174d0d1f5a2b3eb194ae1c7003b159dd560e909fcd0b14b803ded8a94f2a61ca59f9015a673c018515b7605512ecdec58b60aafcba88e88b790e6dabc09a6721613d4e60ffd8d01b07ccacc1c7f2415347f5f5aab1b7e5d27090403a55d0364721bf0363e34bdf9d92c8e83fe39e8d23e0a038717c00f82dd27709ea69a7a857575f0e039b067750b0e226dd01091b6aecae409d563a72e0805c8c101401a9d4356c532ec27cf25ad0ea92eb137e5bb367623155b3e62baa1cb29d86e4765a635d180d26f37f58a24683494cca93547b1f9ff0cc81c085cc4509b746c5327f1f169ca3bd059d324ac91e3c05bb225e5f81655d2f5b5f0cd6389d35be14f63cf76ef856634c5c42f5f6763a457be1745d9ddc4e7a77cbe86398585dd18159eb7dadc2da143cabd5794c4caafab774c5b0ad661f6f9e7bd5163af6f214bbd6351560cfb5e9fe42d3b67912e0bb52926429a43c27aa6c52e904660029285c4b763d6becb5cd4e9a029fb092ae20df18e073627d896a8de5f89474cbc2d2a525edbaa635a9704ec9f30bc0d18dea437a986553da723befb7f91d73a9976a528d2ff2ff80aef0fb80b4c84fca0d810e1f0c3857aef2616c9908aa7dc6a02e28085ccbb88e13c8c8c1acc631e4121e39b453a5897602dfcff5629f88d75ae7375cb9d08969dc6e870870c7aaad3c62f1f39c363d7edfda2d5ce1e9e62b25cf3b31bf4da9b90616a79d3be8f031837844c13fa6ea8af83db6eaa6abcb5158c38abe7fd39b8710c7d8d830ac93d5d3cec1d038c7947861c4ea118b3c205be5c441d35ef856c9a81f970c2850397e735a2fb991fe2dd0f293224ed263963a1041dcefc67b77b25b82d6ab047eb282702ddab528cc4bfb8c82d86352057e893bfd4b41e3396d64d7f1a78f6a0d4cd420d4bf84eb791a513163f837556c1a2e7c4e84ab9bfaa3a23a7114bfd301ea1f6b5e5c94e076e8f42a4da7e05224589005625245672ef85a11d6ac4b379b72660583ccb62b3d6cf00090c9c0ef7f3e3bce7bc6e10baa0498799de647451281afb45cf053c7a57eca0732a8f9e9f02437be51649bc7d1a391aca1561fb6b2d47817394e97e426afda0fb9fdd248579b8eb768ef9e249dbef8b0ebbd0e8dec2f149e2356df3a9f728b5392875ea476b54a1c990040ef4e63373566611c5b555b5d60a0e69f32e05db3f9047ea3e261ee6e3d87516bb0fff783333eef6444c8d9d17f8b23514d6358c62cd34dbf0e9dd60f54f286c533d68f2610c82eaedd9e512884f37211f190a08cd3766c7ca6a5043ee9dbabf5994c48d03a2fa5ccedce7ffbe9cee1e9d54036ca4ca7c4fdc339011448c7aad3d14b639dc179e7a97f03b606b0e47a32b8c9ab82c59fbba5e0ab663538aba9ba71d27216614f59bdccb050cc2512f65f465e8476d36855df64b8bb181907e91f45c6262dba02b35dc238bb32b9cc7070d31f7f95f2193b5fca347874a64041ab629cb5c3a3d77ba999793badacf01c4244ae13c0d77fe01fae16c489fcd58010afc3084ffadb9bf7264f23f1ad0e8d9d762dcc431163c343054181812c9cd1a6ecdc9964caa0a2ba8cd29271e6824891129b89efc1ea2996100f1932940a49a324e8eb688d05ac7d6ba273aade15c2be8cc74ef1eafad9b9ebfdfa36edc5c6d109485a48ac6a8395ccdf23779919953cf3c61c3a635c7e782f84098f3cc6bea7644cf3924c2352c97c76bc7141227dd29f1d47ef209adc3aaefd8cf204fb265e6b262e83736c2f26b22d80870af83095338c23a47a5a86af2ae7decd1aaabd925ae900bfe8e82728e14fd82677769bc9962dbb507a61e206821ac9c0940b12d79ecb7a916b9f6573fa3d9a7ef773f66de8cf8db6536d986a29d7b50a2973d228ec48468c5ebec6253130c578e5ec2848b62e8e1082a3d584e84b86e24211a9546e1abf79e568827af5d9ba98ba7b33b5cd9cb7a81dc873ea11276049d9d6206d2ed0933ada7ef9b6823f24b756ebea834297743ffb146350f320ec9044df55b20df0ff84584c16350f465b5ad7d364f9b166fb534c2a0e65f6bb4d61feeb84463ceb4a4f7853c0c2410955881a60170b0bbc131f6699e2616752851063c7e8b0a82e4357b84e48bad8002610e5770c17ee0cb301f9dfe8d5cbb66c6962b5edcae17b5c5dd42026737ea9e2c79bfb9392d290b44d66ade6eb62e26321ee214a6d15facb7cca610b6209392179a50f3dcba1494d3f302745461f6172d329a12d68405be5ee05ad2a641a7aa3da1d1fd3198671bf1af5b39e2bdeed49df80cf0c6e0edc5c4812350097bda47d3fafb3827d73eeb0b29320c74dae0104000000000000835f5a7f98710c644dd50d3af618651b41916bbabb9ea7cc46c8208dd7fb99474be66e1a970c899f17129a9ed17ccce0d93411e71b8f1c7790c787f7a97a50d54acbc6f4eee49a38882c34e3477c97e1c6da0b39a1e9d0d25a3cea9364033bf4f625a02412174d03dafd642526867578f71f2e52920833b8d23713d5ac48165f49545f6c7c75b5b4ef2e0682f8f2e191fdb6c0ba529856f887391f8d5aa3f7dfc5230170b97662611e53a4436bf4e98a5ceaeb16a79bb95f960b2675cb6da9f1cfcdc1ab604ef7749fe87ccb5a3660f463ff5f488b5c544cf847be84dab22d038730a7021cdc7f7ab714c1561c98a39cc92cd6aaf53c82b28665114ac18b2149ee7f1b52f894c28a49eb45d4cf6a0e65df39b3c717039ae41958fe810c1e05ad62ceef2980e0cfd891bfae0db61fb1c8d65b6812ef1bf5d426f955ab4826eae69f531979699685f5312882032a5f47ed8cf2e98e67d9e6c299d2060a04b4aa677500b48a33586b10f71293d57de846d2683621b588630a6ef06a41437bd99366787b787a68c71779132d0ee73aa5f97d5b9ca18a7ae26b7002512df1073e2eccdb4d2f137a15d9604e10547fa465aeb4f2e5899b531adeb5e72fb76c2c1c9d18ceb4a23a5f6174ba86a7119d82e35cb5a5d1c6a093351aaee0094b32b92417dc50c1d3806fffdafd2ec0e3ba176d84bdb7d59755e9083e61ded802e2a089ae9d6746f738b55845bcd4ff0a21888c2c6b972db043973fb323fd1c15e70137aa6a4bce3f60f27c1d1488f3751e5425a5776c7cc3a3c8acbfbd2171407e1a242e8e241e6e9e1287d8995265a8092ec59ad99652e63a41b744f34392017f29c1b1ca4ce7728200743d4497a70cfd2369d0ecf9e0ba6f28da25b2d918a06ad1173091b8d750b8c2120321818a0912bf47b96c9a8962930a843ea8419b24b8618b7b43482291906e151bf39d3634756d9e1ff5a6e787d1fc4be7349c38a3b882e059a5da930a9cb2a01eb8b24b54def200009538fc063542921947f1997dbee59842a50a043d431649ea0adde68c43259ab51592107b2618c5f761364d4d3d5d0f4d4ae1b94650cb4b695db5831c6dd789140b87525d9ed46fb8dce8fa75d68f317dfc3858d810928fb3530b7ae8701d622b0e69ab16cbbd46c8165c467850d081292da8147fe07f472776d1e2c75c17bdc0f8bafbc964da953a5efe64af69944f0f8858b2a4dece04428ede8967d0e93827910400af8a859b59579d9628191b291732bae90a3b50f8b2b7728725568a83e006ed21e940d4b7e7291ad6365138aa2d59c0b303cc298f7a70d0c39e4f17a878083631b1f96a65d7b4c5a4403929180694f55b71ba29685bdf472f0e21a1c8b3c2dbfc4892ffbc0f0f23f38ed0b785080c11b0766ffc5a0c2c750080b764df159e42ac8eb82681baec5b0ad7948153679162c223f63bf22545718accf2a30bc4402f6b54996baa00508c6def488975a2e2bf2a8dbcff49293e83f998f8baebe722cdfef96c46ac3d945d56ada194353f7cd03d2b86cb9844f7d63f008fbe553fe0023f6968e8bea9054ed3c567e5c55b283fb2337fbd20510e5e098537f5c1baa6b509f63b1e812840aaf470690894a2725f4460a106a3b0e14b12b47c3fc1a083ae7e8cd2e710b5d428b2063f7bb91105255cc0fcc8ac51398ec3df6416d283c4aba6ed44846e82be02d242c710c973c5f0a9b3b16da8a96f5cd2a164a3fa040075b0cb99944f1b34f7e79ae039d15a6c992cb40aa423de90992c064e1771f2a396734480f43b024dc799b8e242df235dc0d33cfdce41755722907f4533a1480d78e99320412326c27e15434fd3fdb19ed33a07063a8a62b39ce14be2ea1e0adadec65fcf4f19901bd801b87e90fc91f1270b420fb530b71b7aea9ad23c4a4ad28d4b63444bc2fa7b44247d5e9f0ca0209a489035b4521b5e886a419df1f9d0e27b9c5007ee75fd3909d4e0156973bdf2ff8d1a88cad1d534ba93648ecb34a30b1e760f1ee8cfb90c27c36385fd68ee48982e5f0c190e8786bf2eb5dd386d3f1600efc19a92020b509d3e2c74b4265bdc765085bc49c6fc61476aa22cff375a78c59f33394cc6ff460584ebbd8dba2cbfe97feb1c9147068dbc1d3e25631ad8478d826d88c28b2cf967d07d3ff845cbb25699406d106eabd31066e9cf8abbe7598f71cca663a6f63bfb63caa95d3a363e69e9a3bc889d026df28c37e41786bf8c9a1ccc06c3499986a72bb10367f32b1b8a55365c2a5b46061b58b81c5da69ad39db6c468906f1c1225527f1b26a3dbad94b1419f3671086b061117206a634cd08beee1fcdfb4a3a7cc78b3cb1293dc900d0859505018b38033a1cc9a0051960200000000000000328b6834f9c30bb1734949fcdab62cc6904b285322da3d49f188019648cac314d65a7c57f4e25864f17e346e7ebbe411695a237622356ecc10e66c8ba33e7106a756b8d3abc1a1aababc26413adcfda74a59b9002a7e2e3edb3e7551d32c461c2e40c25cb9de751ffda44d7f353513c5bbbc473594127c09775844dec5dc922caea5532dfa98fe80d80243233a4f0c15520d9dc76da3623aabef3582380ca4d2f9558d6c71b672f259b94f26710aa1d933b3ad79c8755a96c18fcfd62a972ca80ea0d33afbfc80045ba7dab492aa06c73ea3a598b2bc6eb1549627d183c25c3486814960eb1e1b02200a92f51b8642683f88185a9ee91c6dbb576dd8a869e1338b81ec205d979242bd963308af90ec23e01d253a70440edd3ebfac8e489db0a70bb5c887f22e7a5de33918374a9ae5229d419b1948eeb23bdf8dce3c5df3b81d1a3e3b38e095f261cb9e00f5567413a5c13abb469fdf64adc830cc442a099609cf0ebd3ffe936d77d6099d816be2b4cdd31e4fdf5af5904120ec65e81138416462f9e9bbe9ba6d5980c7de01288bd9f4741848802c32f3774678367c70014e531ad7f95b5527d022232ada51148012328f1693b2d08b8eba80dc26d8e9fc369b410331ed720e410ded5bd03ce69942ffb97489a2c5b6e4da93cc73811738a141c3a16d4ff6edf2ad1b3d3ae45a21c5ca2613b92e7871dea89d3cd699b86520c80f6a391cc2911538f8108dc90203b0e74ee43a087e033265e0745a9c991facff49339c40601420bb72ef014bc4b9a51cad1dcde9f1567b4ae9d11b1416ff3d8dee15f4672bdbca4348e7e71f8d75a73851bc0ad539312b7d52c498602a5eda4630296fb40aaa90d8f6122da7fb56d02755f861df193bdc5effd8a0e54c2ef78a284f7543c2b25a81bf545be3a3f549aabe86700bf058877e3fec53813f9992814a2cebf341cedcad346dba70596da899add4d723d98366ab60997cae7e5b9d417252734d9145ab8c5ece5b5b0efdc2f2578838c500ee17b866323a951979c6f1a50da2833bc437bcddd6efaed0244df44e6069daf359289d9c50c073f0fef4be1fb3802be5ea643761ed6347a35a3f537cbde402911c28d7c7c7e6b8612facbe87221f3505ff078d0dbb28ec469fe6eba2efcb4efdcfc5745299c0850e21ee2c9ef77db8070d589c547cc7379b58677d16077093514849869ab5bf8f896fa933ba3edc676dcb73e91386cc48f01782ba635564e0f91988cf98a3a17544abfedcdc1d80540e9499bf98180feb80325194cbc369be3275ed390f8e91b8d75b1364e9fabe50a1e3b9531c3fe1aaf6523e54bb05738bd3a67ca5de01b2e479ef7678a86b13d6b747fb3cb5fe1be8913228705fc232ce422186cb79c3b66c944f6124eb414322806d47978044336221f26d3a09ed8dceb52e3c7e3413535faf1f7868cb47bbbf02b36650b673a4e51387c64d44daf58057adaa5610d22a15329804cd51a42f663311c4e5ece9d99b5a813c4025e8e0a98c0f3ec13cf07de0b18d7e1ba7d3eb143f5825f62ae5b5f6d92b167f9dbb2177e84f23322566814296277fc2933956f818f5475b6aa031545e6e2265679d16cbedff96c4f419d5fabe99ee652feac8acf9a90771ab8ade8291b42d25ebbdc03faac02b9599fdb83621f6ae1e2e7f946520f3cff881cd600c17b4a00c08d0996f7d2bb97d35647f72b80ba8ad3b4a16cb71094b2d1193a5fa1456e4671788bc51c0d506f4809ca34620d4a75a62ddfa20ab5c4d347a08eb8784d4c572fcb473b766f5e1ce9d92db70ebee83accd58b8253da36b9542686edce545261f309144a3d64900f796620003b36ee3d44a06cc4d088f73aa45288b90476d2e1e461795d473d59500aa23a6b7724a2f0d6473dc2f0af6ea311a648e193072016e199b920bc8c0830ae18f1c17e33d73badadc0f9d34cd52b54f4d3d480a7ddfe0f140f8de1a382a4c5a722d3e0f875b69054d88b8bab94e9394ba8d28937f1ffd871d1666a377620e7f032633fe58ebc87e533bd6461b537cdde38352ece085378dd7b24fa3fd5a3dc3f5b77492e4fc91238a8bfcc4e20bb396bd3317155981ec593926f2e9f15e5ac1aa533e122441649a681d88142a93386a6ed6b2d5b18d7fb57541e31a69acee17345b08c6667ebbc53a082fbcd980b4751937ba729dd2fd9b43d06091517922dd3ea524db002db7525902a465081843191d2d7ac76adb7724ac2bb88e4cb2f3188dbf0cd47acf5011b4519ec100a44b2ee6a1dacac5aade2cdcdca777c6b5edf596b05691d247f671491f68bf2e04007e8674309ea98ab794d05c664ade246288796270e10f4a308420a62bf0df1d1636330e88bf4cc78051e5f715c8f97b8a83119b3fb5129ac6d0733256bec96d8cf435fa005e14d88884a0ca24266a4e78e25e2519796ba31971e4d0cb44ea58c5ddf54a15e3b449642e395679fc5ba600cc6bb7f2b004bfb0d621e51f9cf16309e4a02ce4f23f4a2d225aa8c84840bf2d3522a5f7a983cfbbfe4adb62d6ea622ebb784072bc6673878c5eaa865a7657b619f48cf0c51a4b0d47b20f426adc7f8ab68238b97abf68443f0eaac3796bfd99e0bc644e4f6fc43e551eccd615db802dfb031444e09aedcb04846bb894a2cf42dd0a578dc94d727736e502194ae25bf8556373969cb7f27788b6edf5b2bf25a79c7f89289f827ed4be611d65f6bd89698b130aaadd0f2d914819f41a0185dfc73adcea80d2ee592bf32d15010cb32a95ef112bccb2b780b461637ffa1641d34e1b114cdd3dd1ceb365933efef1781f9ec620a73097594c945969c2ea036e36b2380b33599c3e1d4eb2b7f210324aee3bba5a944b71cf0246ceed878897fe00e30d0bd32b3dde08c8805e30efe39cbc9d11b97491d82fbb5d93b1997e5f3128252472ecd256b9f79611175b6f686629ee744d0ba2494607a4476ea5f934c936403509c14bddbc2403ad5d97bfed0da36707b66f39ffdcee7ab39602e740c1ca9761570cdbab5f56b2060db428921457445b15c4c92b9c4b0ebb0746936bc3053836fa884e97c96e44d18a5a52feca033ec4caf950927bf9a281ea1aacb2a8b1a1f74b20de25ad5f3e459ab8b61ba5d00eaedcb6b5467dcd8608cfd48cc8c1a01f2c9f68bc9ef9adf2fd81cb3e28277c52d58f42ea87c8896383c2fa88dd15dba7172990893fe28ad1b50095b2ca20856de64693f3a663be6e34a9ccbb09add5724c5599495d0c95d2b900444651048bf418070b324016678d694b82565931159ffc37d3eefd7b482c41637cdd69b8f7051b6e88cf87a01d26d0689057ca0f66f65a2c3fbca608f7dec52d8e41ea98d21be162eeb38b27e9465d5525e0ffac3bd989adae19bdcf98edc48ff9d9d2a2f0850fa2cac8421ee6e211b1930f9fe9cb7138e8058ae476aa93c0ca49b170eb4ebbbb6fb4020d000eae537b4dd4bdfc63e3fb281848c057b900c14dc12f8833d5ada50c8f0178137964c3b1524c59eae7ae19066a8003b9f4036b0be91f6f24baf6839f360473907135a8eb777dfe4dcf18d15fb8e16d069c48c5a128f046667f66bb22d36e986c73d2ebaa1a9638a9e8c049d0c766e2008fb19c4aabd96e3443c48377214b01dec0f73538fa5a882553a60664e549030fc9cc21a74a73cf79cfdbbfa3676a474910a295044d804b9f6a30104fc8250da4efcfddc379c3a1b84a2050ee78b18ba84ec5cb4db62540ea7be026b48d2b9294f06aa48e44087dbc494d92fe3e8648792c2b9f5d0d580afac814f8fc74208239b5f8fa6c20fc75c9d73fbe448a4fd1eb1af10165c37e7aa72c83c47dbb92bf3203bc0bea3b3ae261636b9a6b621725aed16de5c33502f152ca3704b1e83a60cfc5807177d9e561b12f43c3ded0951c4ec7af0ab29f55e3745df0f10bedcdcee2d443c0023d7547018c94e2cbb04a5c67a81d33df4dda99f80777b1db00f91bf8abb96ca360353c08b8979d00860ee3af86988171d6739a0f546f64ec34c045afd1be790176228204782836484f6d118d734c8e1b302788aa20e704502da74cd11bc5a22bb717a1d10d5176a4426e88cc132479aa7e8370772b9776ea38d5bd217b08c50f94072acbdf93e732e6ce41f92159b626e59e39925b458465ec3b0191a56d8e1c3a76110200e38380ccfcc1a05f85608bc3ea0bdbbf326bfe003158c8c9e01e90a7b1164cc20de5b23146baa978611100", 0x2000, 0x0) r0 = syz_usb_connect(0x0, 0x3f, &(0x7f00000000c0)=ANY=[@ANYBLOB="11010000733336088dee1adb23610000000109022d0001100000000904000003fe03010009cd8d1f00020000000905050200000000100905"], 0x0) syz_usb_control_io(r0, 0x0, &(0x7f0000000300)={0x44, &(0x7f0000000100)=ANY=[], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) (async) r1 = syz_open_dev$char_usb(0xc, 0xb4, 0x0) ioctl$FS_IOC_GETVERSION(r1, 0x40015b19, &(0x7f0000000040)) (async) r2 = bpf$MAP_CREATE_CONST_STR(0x0, &(0x7f0000001280), 0x50) bpf$BPF_MAP_CONST_STR_FREEZE(0x16, &(0x7f00000000c0)={r2}, 0x4) (async) bpf$PROG_LOAD_XDP(0x5, &(0x7f0000000dc0)={0x6, 0x6, &(0x7f0000000640)=@framed={{0x18, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3}, [@map_fd={0x18, 0x0, 0x2, 0x0, r2}, @ldst={0x1, 0x0, 0x4}]}, &(0x7f0000000000)='syzkaller\x00', 0x6}, 0x94) executing program 35: syz_fuse_handle_req(0xffffffffffffffff, &(0x7f0000000000)="d2c113c29ca1f0329c09333c4e57bb838cfea716579dab7d1cbdce058b04b86cd2573f5a46ec9ad1bb3c276903ebcad8758f3bdb0ea994c5ea01d7771c5b21040018c812e3b3d2c92d14193a28633e7a06c3239d8e97c69f11a821f535082d74ee0c1925c46bfba566d8c9647889a9dde67089b24871471415a695730085f81a0b7c8dc2eae85ccd015b85d7d1fecd2528f2a8369ee0315327ba0d506a583c716ea4fa23575566c8cf1a2a844691717179b82f10998b7d540188e57e864820665ab70db2d483c4fdcb115ea6bbd4a888f9d383f6fea063635b69686590f540c638a77fe8e8cb266cf72667e61871faf1d1810c749c30c5a7b61609d81114f7aa0355967a7513f659d021338ddb687b0f7372386170902b612c56f58dc73a1ccecb389ccd39f926ee91220a5c053dc277919ed4e32b63da14781cb46227a71388f2aeb37e8971d4a554824bb05f7e6861a916c94204feae48f115680a40b7b2da6ec3af295979016cb78ee53d347a2a8de81c26d0468db8b59df449513e109f26ccdff64403180deba17211813b69ef3f0c42f498a6f3d05a4e7f47f99a8b9ff6bb375fcd1cf444a794a7c2a274f2786c8c220b1f80f2d0c1f311960b37357e31198a44f1e25aaa320f6daad7a42c0367de29a2d0d5567098dfc4ac2b0393a7accfaed79afeec5c9d526503e8fbbd3d1f6365c698775999e5109bada3ec51a9d4b884631086bcfa4fe99135a7c482d9e3d2cbd0a58a42f8cd737a812c21185d909bab234d412bd450da975be70eac2a8db479f7030ff5f41817cd798d59a2db9d8d829765459531044ba3bfa6fc89d046c75e707133e5211fd05d20f63d4f493b23bcd966e3f4314a512451b761fb3b3ed815da07c604f71d2a86937142ede6fce427766dbde15f74f2c45d4c3c08e815b507bb05ee97ddf7ed79ea2ddd5c6ef057d455d84c79bdfd6e68ba6f5cd806a6b9dfd5ed65e394554fb59df7aba2676779a547cf8a7c97379abc760e94e01264a2a23c8c63296ec0d9a4e0aa5c9c470fe46beb8db8322372f3649b7d2ad0b8d09e77e4757a2f40835860b56d41382fabc35d891deedd2168ff3b20f3345ec3238ce795fd9b0311fbd7cf10bbefe4e9349bdf7ea5294f3fc3ded1203c01c9a057641ea122eea48e30b942fdebdc4e7263353361dfcf3562eb3f7eb491fe5394ac1e9af734950b3de71b557bd1baf334d39c5dd9e6842a3ef24004eafc5eb85fbdad5c1e49f60f565da146b119f27ec9077774e21300edf2883f34e299ae0465779ab80ba2d097f5d791a72785f35090dbc369864476c33d3279382a49ac45be1706211659d6fac1ae12d772fa270eb3746a69082e67664f4be335f2d172d52f5083a0768e5d4332352be40eb41e3406de4498e740a470141032ea251c144cdb5352d8049281898c72f13a5d3509c9c77308fe45016abfd7d42b1a022a60b9a5bbcece7c0a10bf9f157995465729b38fdcadd0d977574636206982a6b4e8f24bc75e3eb054fb9ae81e878afd24cfa9756f053bb89f0e4a42e195bd2af8a91a6dd5c9fbccd938681a7387ed22a0e3a8284d3182aa7ef1905a267850fc405494d7079f6d0364287cf7b16dc2310b15bc49fb68d1a96075cb5f30f4fc2ec0c51d0b7e806e78f108f4060a55b8c23b3c89a2f2fa321d5138019c417a504d230ec496583933daba2998e20d8f9a2e6798f681e1d4df88fa4e084513d3648ed4f6624d8b894470cf325e837ad177a634bf58d21378fa0d3370bcb724fa88314bbd0749bbe6ff9dd5d7826701891c180278833c3327a8b1500c3e86fbdaacaaba0e0f708052ddecaae4fe142689c812aeccc7211f61159e0787a8f639d1f0a4db373c17317fea5d3ca1c6060fc44a2d02502f0230334acb69861f0cdb82220827f5887a14e7eab133ce4ecd9a414b2a6b31d8c631325319bbb65ad01aaea7e157fea6cbb434c67f4582028c32f5890ceb243dc972e61e122cb36840d5838dff32d4b613ae1909f3970404fb1973f1e80b0e388141b2e24d47276be045880a4ac18fd136c08cf266b35c75e9b796f6210817439833b613195fe4688b22127a978d20f8b32e3df3297e09a565e659857d8052bf69c5006c5870bd25e6c3aeb411553924d06ccb849cdeca659448cb220d259b4ee20d256d44149814b5e13ab365c448369a43553e01874acded99d24da7d1c9c283dae95b0b5311344af85c7c9a8483fb18a5bfd7a4fb4bbade211edfa4c30f3d1b5bc9672a02adb5d638faea66424e2c82540937dc4cf21392fe16e05811f1bcfb83132deb1cf2a522f9b543758b25d6949400af5d2a7a566f4ab0f5fe0b0a8e8379850e3ed78cb823f5b59b3df4de700427b197720ec69b86c76080b2cfdc4a2619e9d2a901e247e591d79dea91257c0d4a3c7ebb86af42de6833aaaa2d69b71e684236705744b79c62079236759def4a37a0b97742dcdc1af8e54385ad496af31cffe7539e4a69d65ae28845439e5e3eea34785e6065c32f3c7b71ef4edfdb16ca9ee9d5d4e066a60f9919461ce932a61c4100276dad7a22447c681bfebac9186f23dd38509090e0c0fd60219d33174d0d1f5a2b3eb194ae1c7003b159dd560e909fcd0b14b803ded8a94f2a61ca59f9015a673c018515b7605512ecdec58b60aafcba88e88b790e6dabc09a6721613d4e60ffd8d01b07ccacc1c7f2415347f5f5aab1b7e5d27090403a55d0364721bf0363e34bdf9d92c8e83fe39e8d23e0a038717c00f82dd27709ea69a7a857575f0e039b067750b0e226dd01091b6aecae409d563a72e0805c8c101401a9d4356c532ec27cf25ad0ea92eb137e5bb367623155b3e62baa1cb29d86e4765a635d180d26f37f58a24683494cca93547b1f9ff0cc81c085cc4509b746c5327f1f169ca3bd059d324ac91e3c05bb225e5f81655d2f5b5f0cd6389d35be14f63cf76ef856634c5c42f5f6763a457be1745d9ddc4e7a77cbe86398585dd18159eb7dadc2da143cabd5794c4caafab774c5b0ad661f6f9e7bd5163af6f214bbd6351560cfb5e9fe42d3b67912e0bb52926429a43c27aa6c52e904660029285c4b763d6becb5cd4e9a029fb092ae20df18e073627d896a8de5f89474cbc2d2a525edbaa635a9704ec9f30bc0d18dea437a986553da723befb7f91d73a9976a528d2ff2ff80aef0fb80b4c84fca0d810e1f0c3857aef2616c9908aa7dc6a02e28085ccbb88e13c8c8c1acc631e4121e39b453a5897602dfcff5629f88d75ae7375cb9d08969dc6e870870c7aaad3c62f1f39c363d7edfda2d5ce1e9e62b25cf3b31bf4da9b90616a79d3be8f031837844c13fa6ea8af83db6eaa6abcb5158c38abe7fd39b8710c7d8d830ac93d5d3cec1d038c7947861c4ea118b3c205be5c441d35ef856c9a81f970c2850397e735a2fb991fe2dd0f293224ed263963a1041dcefc67b77b25b82d6ab047eb282702ddab528cc4bfb8c82d86352057e893bfd4b41e3396d64d7f1a78f6a0d4cd420d4bf84eb791a513163f837556c1a2e7c4e84ab9bfaa3a23a7114bfd301ea1f6b5e5c94e076e8f42a4da7e05224589005625245672ef85a11d6ac4b379b72660583ccb62b3d6cf00090c9c0ef7f3e3bce7bc6e10baa0498799de647451281afb45cf053c7a57eca0732a8f9e9f02437be51649bc7d1a391aca1561fb6b2d47817394e97e426afda0fb9fdd248579b8eb768ef9e249dbef8b0ebbd0e8dec2f149e2356df3a9f728b5392875ea476b54a1c990040ef4e63373566611c5b555b5d60a0e69f32e05db3f9047ea3e261ee6e3d87516bb0fff783333eef6444c8d9d17f8b23514d6358c62cd34dbf0e9dd60f54f286c533d68f2610c82eaedd9e512884f37211f190a08cd3766c7ca6a5043ee9dbabf5994c48d03a2fa5ccedce7ffbe9cee1e9d54036ca4ca7c4fdc339011448c7aad3d14b639dc179e7a97f03b606b0e47a32b8c9ab82c59fbba5e0ab663538aba9ba71d27216614f59bdccb050cc2512f65f465e8476d36855df64b8bb181907e91f45c6262dba02b35dc238bb32b9cc7070d31f7f95f2193b5fca347874a64041ab629cb5c3a3d77ba999793badacf01c4244ae13c0d77fe01fae16c489fcd58010afc3084ffadb9bf7264f23f1ad0e8d9d762dcc431163c343054181812c9cd1a6ecdc9964caa0a2ba8cd29271e6824891129b89efc1ea2996100f1932940a49a324e8eb688d05ac7d6ba273aade15c2be8cc74ef1eafad9b9ebfdfa36edc5c6d109485a48ac6a8395ccdf23779919953cf3c61c3a635c7e782f84098f3cc6bea7644cf3924c2352c97c76bc7141227dd29f1d47ef209adc3aaefd8cf204fb265e6b262e83736c2f26b22d80870af83095338c23a47a5a86af2ae7decd1aaabd925ae900bfe8e82728e14fd82677769bc9962dbb507a61e206821ac9c0940b12d79ecb7a916b9f6573fa3d9a7ef773f66de8cf8db6536d986a29d7b50a2973d228ec48468c5ebec6253130c578e5ec2848b62e8e1082a3d584e84b86e24211a9546e1abf79e568827af5d9ba98ba7b33b5cd9cb7a81dc873ea11276049d9d6206d2ed0933ada7ef9b6823f24b756ebea834297743ffb146350f320ec9044df55b20df0ff84584c16350f465b5ad7d364f9b166fb534c2a0e65f6bb4d61feeb84463ceb4a4f7853c0c2410955881a60170b0bbc131f6699e2616752851063c7e8b0a82e4357b84e48bad8002610e5770c17ee0cb301f9dfe8d5cbb66c6962b5edcae17b5c5dd42026737ea9e2c79bfb9392d290b44d66ade6eb62e26321ee214a6d15facb7cca610b6209392179a50f3dcba1494d3f302745461f6172d329a12d68405be5ee05ad2a641a7aa3da1d1fd3198671bf1af5b39e2bdeed49df80cf0c6e0edc5c4812350097bda47d3fafb3827d73eeb0b29320c74dae0104000000000000835f5a7f98710c644dd50d3af618651b41916bbabb9ea7cc46c8208dd7fb99474be66e1a970c899f17129a9ed17ccce0d93411e71b8f1c7790c787f7a97a50d54acbc6f4eee49a38882c34e3477c97e1c6da0b39a1e9d0d25a3cea9364033bf4f625a02412174d03dafd642526867578f71f2e52920833b8d23713d5ac48165f49545f6c7c75b5b4ef2e0682f8f2e191fdb6c0ba529856f887391f8d5aa3f7dfc5230170b97662611e53a4436bf4e98a5ceaeb16a79bb95f960b2675cb6da9f1cfcdc1ab604ef7749fe87ccb5a3660f463ff5f488b5c544cf847be84dab22d038730a7021cdc7f7ab714c1561c98a39cc92cd6aaf53c82b28665114ac18b2149ee7f1b52f894c28a49eb45d4cf6a0e65df39b3c717039ae41958fe810c1e05ad62ceef2980e0cfd891bfae0db61fb1c8d65b6812ef1bf5d426f955ab4826eae69f531979699685f5312882032a5f47ed8cf2e98e67d9e6c299d2060a04b4aa677500b48a33586b10f71293d57de846d2683621b588630a6ef06a41437bd99366787b787a68c71779132d0ee73aa5f97d5b9ca18a7ae26b7002512df1073e2eccdb4d2f137a15d9604e10547fa465aeb4f2e5899b531adeb5e72fb76c2c1c9d18ceb4a23a5f6174ba86a7119d82e35cb5a5d1c6a093351aaee0094b32b92417dc50c1d3806fffdafd2ec0e3ba176d84bdb7d59755e9083e61ded802e2a089ae9d6746f738b55845bcd4ff0a21888c2c6b972db043973fb323fd1c15e70137aa6a4bce3f60f27c1d1488f3751e5425a5776c7cc3a3c8acbfbd2171407e1a242e8e241e6e9e1287d8995265a8092ec59ad99652e63a41b744f34392017f29c1b1ca4ce7728200743d4497a70cfd2369d0ecf9e0ba6f28da25b2d918a06ad1173091b8d750b8c2120321818a0912bf47b96c9a8962930a843ea8419b24b8618b7b43482291906e151bf39d3634756d9e1ff5a6e787d1fc4be7349c38a3b882e059a5da930a9cb2a01eb8b24b54def200009538fc063542921947f1997dbee59842a50a043d431649ea0adde68c43259ab51592107b2618c5f761364d4d3d5d0f4d4ae1b94650cb4b695db5831c6dd789140b87525d9ed46fb8dce8fa75d68f317dfc3858d810928fb3530b7ae8701d622b0e69ab16cbbd46c8165c467850d081292da8147fe07f472776d1e2c75c17bdc0f8bafbc964da953a5efe64af69944f0f8858b2a4dece04428ede8967d0e93827910400af8a859b59579d9628191b291732bae90a3b50f8b2b7728725568a83e006ed21e940d4b7e7291ad6365138aa2d59c0b303cc298f7a70d0c39e4f17a878083631b1f96a65d7b4c5a4403929180694f55b71ba29685bdf472f0e21a1c8b3c2dbfc4892ffbc0f0f23f38ed0b785080c11b0766ffc5a0c2c750080b764df159e42ac8eb82681baec5b0ad7948153679162c223f63bf22545718accf2a30bc4402f6b54996baa00508c6def488975a2e2bf2a8dbcff49293e83f998f8baebe722cdfef96c46ac3d945d56ada194353f7cd03d2b86cb9844f7d63f008fbe553fe0023f6968e8bea9054ed3c567e5c55b283fb2337fbd20510e5e098537f5c1baa6b509f63b1e812840aaf470690894a2725f4460a106a3b0e14b12b47c3fc1a083ae7e8cd2e710b5d428b2063f7bb91105255cc0fcc8ac51398ec3df6416d283c4aba6ed44846e82be02d242c710c973c5f0a9b3b16da8a96f5cd2a164a3fa040075b0cb99944f1b34f7e79ae039d15a6c992cb40aa423de90992c064e1771f2a396734480f43b024dc799b8e242df235dc0d33cfdce41755722907f4533a1480d78e99320412326c27e15434fd3fdb19ed33a07063a8a62b39ce14be2ea1e0adadec65fcf4f19901bd801b87e90fc91f1270b420fb530b71b7aea9ad23c4a4ad28d4b63444bc2fa7b44247d5e9f0ca0209a489035b4521b5e886a419df1f9d0e27b9c5007ee75fd3909d4e0156973bdf2ff8d1a88cad1d534ba93648ecb34a30b1e760f1ee8cfb90c27c36385fd68ee48982e5f0c190e8786bf2eb5dd386d3f1600efc19a92020b509d3e2c74b4265bdc765085bc49c6fc61476aa22cff375a78c59f33394cc6ff460584ebbd8dba2cbfe97feb1c9147068dbc1d3e25631ad8478d826d88c28b2cf967d07d3ff845cbb25699406d106eabd31066e9cf8abbe7598f71cca663a6f63bfb63caa95d3a363e69e9a3bc889d026df28c37e41786bf8c9a1ccc06c3499986a72bb10367f32b1b8a55365c2a5b46061b58b81c5da69ad39db6c468906f1c1225527f1b26a3dbad94b1419f3671086b061117206a634cd08beee1fcdfb4a3a7cc78b3cb1293dc900d0859505018b38033a1cc9a0051960200000000000000328b6834f9c30bb1734949fcdab62cc6904b285322da3d49f188019648cac314d65a7c57f4e25864f17e346e7ebbe411695a237622356ecc10e66c8ba33e7106a756b8d3abc1a1aababc26413adcfda74a59b9002a7e2e3edb3e7551d32c461c2e40c25cb9de751ffda44d7f353513c5bbbc473594127c09775844dec5dc922caea5532dfa98fe80d80243233a4f0c15520d9dc76da3623aabef3582380ca4d2f9558d6c71b672f259b94f26710aa1d933b3ad79c8755a96c18fcfd62a972ca80ea0d33afbfc80045ba7dab492aa06c73ea3a598b2bc6eb1549627d183c25c3486814960eb1e1b02200a92f51b8642683f88185a9ee91c6dbb576dd8a869e1338b81ec205d979242bd963308af90ec23e01d253a70440edd3ebfac8e489db0a70bb5c887f22e7a5de33918374a9ae5229d419b1948eeb23bdf8dce3c5df3b81d1a3e3b38e095f261cb9e00f5567413a5c13abb469fdf64adc830cc442a099609cf0ebd3ffe936d77d6099d816be2b4cdd31e4fdf5af5904120ec65e81138416462f9e9bbe9ba6d5980c7de01288bd9f4741848802c32f3774678367c70014e531ad7f95b5527d022232ada51148012328f1693b2d08b8eba80dc26d8e9fc369b410331ed720e410ded5bd03ce69942ffb97489a2c5b6e4da93cc73811738a141c3a16d4ff6edf2ad1b3d3ae45a21c5ca2613b92e7871dea89d3cd699b86520c80f6a391cc2911538f8108dc90203b0e74ee43a087e033265e0745a9c991facff49339c40601420bb72ef014bc4b9a51cad1dcde9f1567b4ae9d11b1416ff3d8dee15f4672bdbca4348e7e71f8d75a73851bc0ad539312b7d52c498602a5eda4630296fb40aaa90d8f6122da7fb56d02755f861df193bdc5effd8a0e54c2ef78a284f7543c2b25a81bf545be3a3f549aabe86700bf058877e3fec53813f9992814a2cebf341cedcad346dba70596da899add4d723d98366ab60997cae7e5b9d417252734d9145ab8c5ece5b5b0efdc2f2578838c500ee17b866323a951979c6f1a50da2833bc437bcddd6efaed0244df44e6069daf359289d9c50c073f0fef4be1fb3802be5ea643761ed6347a35a3f537cbde402911c28d7c7c7e6b8612facbe87221f3505ff078d0dbb28ec469fe6eba2efcb4efdcfc5745299c0850e21ee2c9ef77db8070d589c547cc7379b58677d16077093514849869ab5bf8f896fa933ba3edc676dcb73e91386cc48f01782ba635564e0f91988cf98a3a17544abfedcdc1d80540e9499bf98180feb80325194cbc369be3275ed390f8e91b8d75b1364e9fabe50a1e3b9531c3fe1aaf6523e54bb05738bd3a67ca5de01b2e479ef7678a86b13d6b747fb3cb5fe1be8913228705fc232ce422186cb79c3b66c944f6124eb414322806d47978044336221f26d3a09ed8dceb52e3c7e3413535faf1f7868cb47bbbf02b36650b673a4e51387c64d44daf58057adaa5610d22a15329804cd51a42f663311c4e5ece9d99b5a813c4025e8e0a98c0f3ec13cf07de0b18d7e1ba7d3eb143f5825f62ae5b5f6d92b167f9dbb2177e84f23322566814296277fc2933956f818f5475b6aa031545e6e2265679d16cbedff96c4f419d5fabe99ee652feac8acf9a90771ab8ade8291b42d25ebbdc03faac02b9599fdb83621f6ae1e2e7f946520f3cff881cd600c17b4a00c08d0996f7d2bb97d35647f72b80ba8ad3b4a16cb71094b2d1193a5fa1456e4671788bc51c0d506f4809ca34620d4a75a62ddfa20ab5c4d347a08eb8784d4c572fcb473b766f5e1ce9d92db70ebee83accd58b8253da36b9542686edce545261f309144a3d64900f796620003b36ee3d44a06cc4d088f73aa45288b90476d2e1e461795d473d59500aa23a6b7724a2f0d6473dc2f0af6ea311a648e193072016e199b920bc8c0830ae18f1c17e33d73badadc0f9d34cd52b54f4d3d480a7ddfe0f140f8de1a382a4c5a722d3e0f875b69054d88b8bab94e9394ba8d28937f1ffd871d1666a377620e7f032633fe58ebc87e533bd6461b537cdde38352ece085378dd7b24fa3fd5a3dc3f5b77492e4fc91238a8bfcc4e20bb396bd3317155981ec593926f2e9f15e5ac1aa533e122441649a681d88142a93386a6ed6b2d5b18d7fb57541e31a69acee17345b08c6667ebbc53a082fbcd980b4751937ba729dd2fd9b43d06091517922dd3ea524db002db7525902a465081843191d2d7ac76adb7724ac2bb88e4cb2f3188dbf0cd47acf5011b4519ec100a44b2ee6a1dacac5aade2cdcdca777c6b5edf596b05691d247f671491f68bf2e04007e8674309ea98ab794d05c664ade246288796270e10f4a308420a62bf0df1d1636330e88bf4cc78051e5f715c8f97b8a83119b3fb5129ac6d0733256bec96d8cf435fa005e14d88884a0ca24266a4e78e25e2519796ba31971e4d0cb44ea58c5ddf54a15e3b449642e395679fc5ba600cc6bb7f2b004bfb0d621e51f9cf16309e4a02ce4f23f4a2d225aa8c84840bf2d3522a5f7a983cfbbfe4adb62d6ea622ebb784072bc6673878c5eaa865a7657b619f48cf0c51a4b0d47b20f426adc7f8ab68238b97abf68443f0eaac3796bfd99e0bc644e4f6fc43e551eccd615db802dfb031444e09aedcb04846bb894a2cf42dd0a578dc94d727736e502194ae25bf8556373969cb7f27788b6edf5b2bf25a79c7f89289f827ed4be611d65f6bd89698b130aaadd0f2d914819f41a0185dfc73adcea80d2ee592bf32d15010cb32a95ef112bccb2b780b461637ffa1641d34e1b114cdd3dd1ceb365933efef1781f9ec620a73097594c945969c2ea036e36b2380b33599c3e1d4eb2b7f210324aee3bba5a944b71cf0246ceed878897fe00e30d0bd32b3dde08c8805e30efe39cbc9d11b97491d82fbb5d93b1997e5f3128252472ecd256b9f79611175b6f686629ee744d0ba2494607a4476ea5f934c936403509c14bddbc2403ad5d97bfed0da36707b66f39ffdcee7ab39602e740c1ca9761570cdbab5f56b2060db428921457445b15c4c92b9c4b0ebb0746936bc3053836fa884e97c96e44d18a5a52feca033ec4caf950927bf9a281ea1aacb2a8b1a1f74b20de25ad5f3e459ab8b61ba5d00eaedcb6b5467dcd8608cfd48cc8c1a01f2c9f68bc9ef9adf2fd81cb3e28277c52d58f42ea87c8896383c2fa88dd15dba7172990893fe28ad1b50095b2ca20856de64693f3a663be6e34a9ccbb09add5724c5599495d0c95d2b900444651048bf418070b324016678d694b82565931159ffc37d3eefd7b482c41637cdd69b8f7051b6e88cf87a01d26d0689057ca0f66f65a2c3fbca608f7dec52d8e41ea98d21be162eeb38b27e9465d5525e0ffac3bd989adae19bdcf98edc48ff9d9d2a2f0850fa2cac8421ee6e211b1930f9fe9cb7138e8058ae476aa93c0ca49b170eb4ebbbb6fb4020d000eae537b4dd4bdfc63e3fb281848c057b900c14dc12f8833d5ada50c8f0178137964c3b1524c59eae7ae19066a8003b9f4036b0be91f6f24baf6839f360473907135a8eb777dfe4dcf18d15fb8e16d069c48c5a128f046667f66bb22d36e986c73d2ebaa1a9638a9e8c049d0c766e2008fb19c4aabd96e3443c48377214b01dec0f73538fa5a882553a60664e549030fc9cc21a74a73cf79cfdbbfa3676a474910a295044d804b9f6a30104fc8250da4efcfddc379c3a1b84a2050ee78b18ba84ec5cb4db62540ea7be026b48d2b9294f06aa48e44087dbc494d92fe3e8648792c2b9f5d0d580afac814f8fc74208239b5f8fa6c20fc75c9d73fbe448a4fd1eb1af10165c37e7aa72c83c47dbb92bf3203bc0bea3b3ae261636b9a6b621725aed16de5c33502f152ca3704b1e83a60cfc5807177d9e561b12f43c3ded0951c4ec7af0ab29f55e3745df0f10bedcdcee2d443c0023d7547018c94e2cbb04a5c67a81d33df4dda99f80777b1db00f91bf8abb96ca360353c08b8979d00860ee3af86988171d6739a0f546f64ec34c045afd1be790176228204782836484f6d118d734c8e1b302788aa20e704502da74cd11bc5a22bb717a1d10d5176a4426e88cc132479aa7e8370772b9776ea38d5bd217b08c50f94072acbdf93e732e6ce41f92159b626e59e39925b458465ec3b0191a56d8e1c3a76110200e38380ccfcc1a05f85608bc3ea0bdbbf326bfe003158c8c9e01e90a7b1164cc20de5b23146baa978611100", 0x2000, 0x0) r0 = syz_usb_connect(0x0, 0x3f, &(0x7f00000000c0)=ANY=[@ANYBLOB="11010000733336088dee1adb23610000000109022d0001100000000904000003fe03010009cd8d1f00020000000905050200000000100905"], 0x0) syz_usb_control_io(r0, 0x0, &(0x7f0000000300)={0x44, &(0x7f0000000100)=ANY=[], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) (async) r1 = syz_open_dev$char_usb(0xc, 0xb4, 0x0) ioctl$FS_IOC_GETVERSION(r1, 0x40015b19, &(0x7f0000000040)) (async) r2 = bpf$MAP_CREATE_CONST_STR(0x0, &(0x7f0000001280), 0x50) bpf$BPF_MAP_CONST_STR_FREEZE(0x16, &(0x7f00000000c0)={r2}, 0x4) (async) bpf$PROG_LOAD_XDP(0x5, &(0x7f0000000dc0)={0x6, 0x6, &(0x7f0000000640)=@framed={{0x18, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3}, [@map_fd={0x18, 0x0, 0x2, 0x0, r2}, @ldst={0x1, 0x0, 0x4}]}, &(0x7f0000000000)='syzkaller\x00', 0x6}, 0x94) executing program 2: openat$vnet(0xffffffffffffff9c, &(0x7f00000000c0), 0x2, 0x0) r0 = openat$userfaultfd(0xffffffffffffff9c, &(0x7f0000000040), 0x0, 0x0) r1 = ioctl$USERFAULTFD_IOC_NEW(r0, 0xaa00) ioctl$KVM_SET_MSRS(0xffffffffffffffff, 0x4008ae89, &(0x7f0000000380)={0x1, 0x0, [{0x40000075, 0x0, 0x1001}]}) r2 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000180), 0x0, 0x0) r3 = ioctl$KVM_CREATE_VM(r2, 0xae01, 0x0) r4 = ioctl$KVM_CREATE_VCPU(r3, 0xae41, 0x2) ioctl$KVM_GET_MSRS_cpu(r4, 0xc008ae88, &(0x7f0000000340)={0x10000000000000e6, 0x0, [{0x40000091, 0x0, 0x3}]}) ioctl$UFFDIO_API(r1, 0xc018aa3f, &(0x7f0000000240)) ioctl$UFFDIO_REGISTER(r1, 0xc020aa00, &(0x7f0000001080)={{&(0x7f0000ffc000/0x4000)=nil, 0x4000}, 0x3}) mlock2(&(0x7f0000ffc000/0x4000)=nil, 0x4000, 0x0) r5 = syz_open_procfs(0x0, &(0x7f00000000c0)='fd/3\x00') mount$9p_fd(0x0, &(0x7f00000001c0)='.\x00', &(0x7f0000000180), 0x0, &(0x7f0000000000)=ANY=[@ANYBLOB='trans=fd,rf', @ANYRESHEX=r5, @ANYBLOB]) executing program 2: r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000240), 0x0, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000040)={'syzkaller0\x00', 0x7101}) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000000)={0x0}, 0x1, 0x0, 0x0, 0x20044040}, 0x44040) r1 = socket$netlink(0x10, 0x3, 0x0) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f0000000300)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000100)=@newtaction={0x70, 0x30, 0x871a15abc695f30d, 0x5, 0x25dfdbfc, {}, [{0x5c, 0x1, [@m_sample={0x58, 0x1, 0x0, 0x0, {{0xb}, {0x2c, 0x2, 0x0, 0x1, [@TCA_SAMPLE_RATE={0x8, 0x3, 0x2}, @TCA_SAMPLE_PARMS={0x18, 0x2, {0x10000, 0x6e34, 0x4, 0x10, 0xffffffa6}}, @TCA_SAMPLE_PSAMPLE_GROUP={0x8}]}, {0x4}, {0xc}, {0xc, 0x8, {0x0, 0x3}}}}]}]}, 0x70}, 0x1, 0x0, 0x0, 0x4004045}, 0x80) sendmmsg(r1, &(0x7f00000002c0), 0x40000000000009f, 0x0) r2 = socket$unix(0x1, 0x1, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000140)='./bus\x00', 0x11d) mkdirat(0xffffffffffffff9c, &(0x7f0000000040)='./file0\x00', 0x1a2) capset(&(0x7f0000000080)={0x20080522}, &(0x7f00000000c0)={0x200004, 0x200004, 0x3}) mount$overlay(0x0, &(0x7f0000000000)='./file0\x00', &(0x7f0000000b80), 0x0, &(0x7f0000000180)={[{@workdir={'workdir', 0x3d, './bus'}}, {@lowerdir={'lowerdir', 0x3d, '.'}}, {@upperdir={'upperdir', 0x3d, './file0'}}]}) r3 = socket$kcm(0x11, 0x3, 0x0) r4 = openat$tun(0xffffffffffffff9c, &(0x7f0000000400), 0x0, 0x0) close(r4) r5 = socket$nl_route(0x10, 0x3, 0x0) r6 = socket$unix(0x1, 0x1, 0x0) ioctl$KVM_GET_VCPU_MMAP_SIZE(0xffffffffffffffff, 0xae04) ioctl$sock_SIOCGIFINDEX(r6, 0x8933, &(0x7f0000000100)={'syzkaller0\x00', 0x0}) sendmsg$nl_route_sched(r5, &(0x7f00000012c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000140)=@newqdisc={0x44, 0x24, 0x4ee4e6a52ff56541, 0x70bd2a, 0xffffffff, {0x0, 0x0, 0x0, r7, {0x0, 0xfff1}, {0xffff, 0xffff}}, [@qdisc_kind_options=@q_hfsc={{0x9}, {0x14, 0x2, @TCA_HFSC_FSC={0x10, 0x2, {0x4d, 0xfffffffb, 0x7fffffff}}}}]}, 0x44}, 0x1, 0x0, 0x0, 0x28000000}, 0x20040084) r8 = syz_open_dev$vim2m(&(0x7f00000002c0), 0x10001, 0x2) ioctl$vim2m_VIDIOC_S_CTRL(r8, 0xc008561c, &(0x7f0000000000)={0xf0f009, 0x7fffffff}) sendmsg$nl_route_sched(r5, &(0x7f0000001200)={0x0, 0x0, &(0x7f0000000280)={&(0x7f0000000700)=@newqdisc={0x838, 0x28, 0x4ee4e6a52ff56541, 0x4001, 0xfffffdf8, {0x0, 0x0, 0x0, r7, {0x10}, {}, {0xa, 0x3}}, [@qdisc_kind_options=@q_tbf={{0x8}, {0x80c, 0x2, [@TCA_TBF_RTAB={0x404, 0x2, [0x200000, 0x1, 0x9, 0x9, 0x3, 0x5, 0x5, 0xb762, 0x4, 0x100006, 0x8, 0x10, 0x2, 0x2, 0x8001, 0x1007fb, 0xffff8000, 0x6, 0x403, 0x9, 0x8, 0xfffffff8, 0xd6, 0x4, 0xfffb, 0x40000007, 0x0, 0xfffff4f0, 0x9, 0x1, 0xfffffffc, 0x4, 0x1, 0x6f2151b1, 0x9, 0x2, 0x20001000, 0x4, 0xfffffffe, 0x7, 0x4, 0x99, 0x9, 0x5, 0x6, 0x7, 0xfffffff7, 0x1, 0x2, 0x9, 0x9, 0x1000044, 0x8, 0x8, 0x39e1, 0x4, 0x7ff, 0x8, 0x7, 0x7fbffffe, 0x4da5, 0x8, 0xfffffa71, 0xcd, 0x4, 0x80000000, 0xc, 0x6, 0x65, 0x91, 0x659, 0x9, 0xf, 0x9, 0xc28, 0x9, 0x7, 0x3, 0x401, 0x3, 0x2, 0xfffffffa, 0x1, 0x10001, 0x3, 0x1, 0x4, 0x7, 0x8, 0x7, 0x1, 0x1, 0x1, 0x5, 0x3c, 0x7, 0x12, 0x40008000, 0x1, 0x4dc, 0x80, 0xffffff80, 0x7fffffff, 0xff, 0x9, 0xa7, 0xf, 0x1, 0x0, 0x3, 0x1001, 0x4, 0x401, 0x7, 0x80000000, 0xffff, 0x6, 0x5, 0x4f, 0xffffffff, 0x80000000, 0x1966f9ad, 0x200, 0x20200, 0xed5, 0xfffffc00, 0x6, 0x4, 0x8, 0x485e, 0xa85, 0x80000040, 0x2, 0xa, 0x7, 0x102, 0x2d5421e8, 0x7, 0x10000, 0x2, 0x6, 0x3ff, 0x40000f04, 0x0, 0x2, 0x5, 0xfffffc00, 0x5, 0x8d, 0x4, 0x401, 0x4, 0x9, 0x50200523, 0xfffffffb, 0x1, 0x0, 0x3, 0x8, 0x5, 0x8, 0x3, 0x0, 0x800, 0x2, 0x6, 0x7ff, 0x1, 0x9, 0x6, 0x4, 0x400001, 0x4d15, 0x1ff, 0xfffff068, 0x3, 0x469, 0x3, 0x0, 0x200, 0x10000005, 0x7, 0x2, 0x8, 0x42ba, 0x4, 0x800009, 0x3, 0x8, 0x8, 0x53, 0x6, 0x4, 0x400, 0x8000, 0x0, 0x2c310b18, 0xfff, 0x0, 0x5, 0xcd34, 0x9, 0x81, 0xdf3, 0x2, 0x7, 0x8, 0x40fff, 0x1ff, 0x8000, 0x3, 0x8, 0x80, 0x6, 0x9a6, 0xe4cb, 0x174, 0x9, 0x1ff, 0x5, 0x9b4, 0x1, 0x6, 0x0, 0x9, 0x0, 0x9, 0x0, 0x4, 0x10, 0x901, 0x5, 0x2, 0x7d, 0x7420, 0x6, 0x6, 0xc, 0x1000, 0x9, 0x9, 0xe6, 0xab, 0x400, 0x7fffffff, 0xed, 0x7ff, 0xd83, 0x68, 0x80000001, 0x6, 0x9fd, 0x10000006, 0x200, 0x4, 0x2]}, @TCA_TBF_PTAB={0x404, 0x3, [0x800, 0x1, 0x1, 0x0, 0x7, 0x196, 0x2, 0x6, 0x0, 0xe, 0x8, 0xc9cd, 0x2, 0x9, 0x37, 0x200, 0x8003, 0x9, 0xd, 0x2, 0x7, 0x4, 0x6, 0x9, 0x8000000a, 0xc4, 0x60, 0x8000, 0x7, 0x2000db3a, 0x800, 0x3, 0x9, 0x3, 0x9, 0x0, 0x401, 0x3, 0x6, 0x33, 0x6, 0xfffffffc, 0x8001, 0x6, 0x6, 0x4, 0x5, 0xd, 0x2, 0x7, 0x1, 0x0, 0x3, 0x81, 0x3, 0x1ff, 0xfffffff5, 0xc9, 0x5, 0x65e1, 0x10001, 0xc, 0x8001, 0xffffb5ca, 0xe, 0x3, 0x97, 0x7, 0xb, 0x0, 0x1, 0x7ff, 0xb4, 0xf, 0x1, 0x3, 0xff, 0xfff, 0x0, 0xee3, 0x43, 0x9, 0x1, 0x3, 0x92a1, 0x3796, 0x8, 0x6, 0xbe, 0x3, 0x45, 0xdd1, 0x5, 0x7, 0x7de, 0x0, 0x3, 0x345, 0x4, 0x9da, 0x4, 0x6, 0xea6, 0x3, 0x5, 0x3, 0x3, 0xffffffff, 0x3ff, 0x96, 0x7, 0x2, 0xf, 0x9, 0xffffffff, 0x5, 0x3, 0xd7da, 0x82, 0x7f, 0x9, 0x1, 0xb8, 0x6, 0x4, 0x6, 0x3f0a, 0x4, 0x9, 0x5, 0x1ff, 0x4, 0x6, 0x1, 0x7, 0x2, 0xfffffffe, 0x3, 0xb, 0xfffffff7, 0x8, 0x101, 0xc57, 0x5, 0x2, 0x5, 0x8, 0xfffffffc, 0xf, 0x1982, 0x1, 0x80000000, 0x5, 0xa, 0x6, 0x8000, 0x40000002, 0x1, 0x2, 0x2, 0x5, 0x4, 0x2, 0x5, 0x5, 0x7, 0x692, 0x92, 0x4, 0xffffffff, 0x2, 0x8043d, 0x1b8c, 0x14, 0x65, 0xc00, 0x9, 0x9, 0x3, 0x8, 0x10001, 0x295, 0x6, 0x9, 0x1, 0xb7e, 0x10001, 0x2, 0x7, 0x4, 0x1, 0x2, 0x103ff, 0xfb5, 0x8, 0xa, 0x0, 0x9, 0xc, 0xc3d5, 0x2, 0x8000, 0xec, 0xd, 0x5, 0x84d3, 0xfffffeff, 0x2, 0x7ff, 0x7fffffff, 0x80, 0x2, 0x4, 0x2, 0x6, 0x3, 0x70, 0x0, 0x0, 0x400, 0x8, 0x10000, 0x9, 0x101, 0xefba, 0x7, 0x3, 0xbe4, 0xa4a, 0x7, 0x400, 0xf, 0xfffffff9, 0x8001, 0xd, 0x1, 0x9, 0xffe, 0x421, 0x3ff, 0x2, 0xd, 0x7, 0x5, 0xfffffffd, 0xac, 0x7fff, 0xa, 0x0, 0x6, 0x7f, 0x2dd, 0x7, 0x4, 0x7, 0x1]}]}}]}, 0x838}, 0x1, 0x0, 0x0, 0x40098}, 0x0) ioctl$SIOCSIFHWADDR(r4, 0x8914, &(0x7f0000002280)={'syzkaller0\x00', @multicast}) ioctl$sock_SIOCGIFINDEX(r2, 0x8933, &(0x7f0000000100)={'syzkaller0\x00', 0x0}) sendmsg$kcm(r3, &(0x7f00000000c0)={&(0x7f0000000380)=@xdp={0x2c, 0xdd86, r9, 0x3e}, 0x80, &(0x7f0000000080)=[{&(0x7f0000000180)="80", 0x1}], 0x1}, 0x4) executing program 7: mkdir(&(0x7f00000000c0)='./file0\x00', 0x0) mount$bpf(0x0, &(0x7f00000001c0)='./file0\x00', &(0x7f0000000200), 0x200, &(0x7f0000000640)=ANY=[@ANYBLOB='gid=', @ANYRESHEX=0x0, @ANYBLOB="00cdb24da2595100000000"]) openat$selinux_commit_pending_bools(0xffffffffffffff9c, &(0x7f0000000000), 0x1, 0x0) syz_genetlink_get_family_id$nl80211(&(0x7f0000000080), 0xffffffffffffffff) r0 = socket$nl_route(0x10, 0x3, 0x0) r1 = socket$nl_generic(0x10, 0x3, 0x10) r2 = syz_genetlink_get_family_id$ethtool(&(0x7f0000000080), 0xffffffffffffffff) sendmsg$ETHTOOL_MSG_LINKMODES_SET(0xffffffffffffffff, &(0x7f0000000200)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000100)=ANY=[@ANYBLOB='<\x00\x00\x00', @ANYRES16=r2, @ANYBLOB="010025bd7000fddbdf250500000014000380040004000400010008000200000000000c0001"], 0x3c}, 0x1, 0x0, 0x0, 0x20004000}, 0x4044094) socket$nl_generic(0x10, 0x3, 0x10) syz_genetlink_get_family_id$nl80211(&(0x7f00000000c0), r1) mkdir(&(0x7f0000000000)='./my_configfs\x00', 0x1ff) mount(0x0, &(0x7f0000000000)='./my_configfs\x00', &(0x7f0000000100)='configfs\x00', 0x0, 0x0) mkdir(&(0x7f0000000200)='./my_configfs/usb_gadget/g1\x00', 0x1ff) mkdir(&(0x7f0000000300)='./my_configfs/usb_gadget/g1/functions/tcm.usb0\x00', 0x1ff) mkdir(&(0x7f0000000400)='./my_configfs/target/usb_gadget\x00', 0x1ff) mkdir(&(0x7f0000000500)='./my_configfs/target/usb_gadget/naa.1234567890abcdef\x00', 0x1ff) syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) syz_genetlink_get_family_id$nl802154(&(0x7f00000015c0), 0xffffffffffffffff) mkdir(&(0x7f0000000600)='./my_configfs/target/usb_gadget/naa.1234567890abcdef/tpgt_1\x00', 0x1ff) mkdir(0x0, 0x1ff) mkdir(&(0x7f0000000800)='./my_configfs/target/core/rd_mcp_0/dev0\x00', 0x1ff) r3 = openat(0xffffffffffffff9c, &(0x7f0000000900)='./my_configfs/target/core/rd_mcp_0/dev0/control\x00', 0x1, 0x0) write(r3, &(0x7f0000000a00)='rd_pages=8', 0xa) r4 = openat(0xffffffffffffff9c, &(0x7f0000000b00)='./my_configfs/target/core/rd_mcp_0/dev0/enable\x00', 0x1, 0x0) write(r4, &(0x7f0000000c00), 0x0) mkdir(&(0x7f0000000d00)='./my_configfs/target/usb_gadget/naa.1234567890abcdef/tpgt_1/lun/lun_0\x00', 0x1ff) symlink(&(0x7f0000000e00)='./my_configfs/target/core/rd_mcp_0/dev0\x00', &(0x7f0000000f00)='./my_configfs/target/usb_gadget/naa.1234567890abcdef/tpgt_1/lun/lun_0/virtual_lun\x00') sendmsg$nl_route(r0, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000080)={0x0, 0x4c}, 0x1, 0x0, 0x0, 0x8d4}, 0x800) ioctl$sock_SIOCGIFINDEX_80211(0xffffffffffffffff, 0x8933, &(0x7f0000000100)={'wlan1\x00'}) openat$vmci(0xffffffffffffff9c, &(0x7f0000000140), 0x2, 0x0) executing program 2: r0 = socket$nl_netfilter(0x10, 0x3, 0xc) r1 = socket$inet6_mptcp(0xa, 0x1, 0x106) setsockopt$inet6_tcp_buf(r1, 0x6, 0xb, &(0x7f0000000300)="d84475f3d9a9691596371ec5e4b1c7b9865d33ccd5e19118b4b9c436b17914862fd116878c2538699183d24b33e514a3c2447cfc2b4aea7d5711d71accf4f4ecb90619f5fddd2e4705a359fdfacb1b710a9d69347b4fab627475e1a545d21053ffb85afb1480779393c73e15ce4253931140da7ef17c47298652fd4d39dae219a33fbad317291a3ce05efe56f537454e195093088dba6a27d717b1a4ba051c2241e11ab8c430c2e3b16449e664a6da9382118df3a987b1299bfc5aebc8dc", 0xbe) r2 = socket(0x400000000010, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r2, 0x8933, &(0x7f0000000100)={'batadv_slave_0\x00', 0x0}) sendmsg$nl_route_sched(r2, &(0x7f00000012c0)={0x0, 0x0, &(0x7f0000000000)={&(0x7f00000000c0)=@newqdisc={0x38, 0x24, 0x4ee4e6a52ff56541, 0x70bd2a, 0xfffffffd, {0x0, 0x0, 0x0, r3, {0x0, 0x1}, {0xffff, 0xffff}, {0xffe0, 0x9}}, [@qdisc_kind_options=@q_multiq={{0xb}, {0x8}}]}, 0x38}}, 0x0) sendmsg$nl_route_sched(r2, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000300)={&(0x7f0000001380)=@newtfilter={0x40, 0x2c, 0xf3f, 0x30bd2c, 0x25dfdbfd, {0x0, 0x0, 0x0, r3, {0xfff3, 0xfff3}, {}, {0x7, 0x300}}, [@filter_kind_options=@f_fw={{0x7}, {0x14, 0x2, [@TCA_FW_CLASSID={0x8, 0x1, {0xfff2, 0x2}}, @TCA_FW_MASK={0x8, 0x5, 0xb08}]}}]}, 0x40}, 0x1, 0x0, 0x0, 0x1}, 0x0) r4 = openat$comedi(0xffffffffffffff9c, &(0x7f0000000c00)='/dev/comedi4\x00', 0x40000, 0x0) ioctl$COMEDI_RANGEINFO(r4, 0x80106408, &(0x7f0000000c80)={0x4e3, 0x0}) sendmsg$IPSET_CMD_CREATE(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f00000004c0)={&(0x7f0000000040)={0x44, 0x2, 0x6, 0x3, 0x0, 0x0, {0xd}, [@IPSET_ATTR_TYPENAME={0xc, 0x3, 'hash:ip\x00'}, @IPSET_ATTR_REVISION={0x5}, @IPSET_ATTR_SETNAME={0x9, 0x2, 'syz1\x00'}, @IPSET_ATTR_FAMILY={0x5, 0x5, 0x2}, @IPSET_ATTR_PROTOCOL={0x5, 0x1, 0x6}]}, 0x44}, 0x1, 0x0, 0x0, 0x8011}, 0x0) r5 = socket$nl_netfilter(0x10, 0x3, 0xc) r6 = syz_usb_connect(0x0, 0x371, &(0x7f0000000280)=ANY=[@ANYBLOB="1201000057ec0020c215dcff30bd0102030109025f03019b000000090400000b403b4e000905e2379c"], 0x0) syz_usb_control_io$cdc_ncm(r6, 0x0, 0x0) syz_usb_control_io$hid(r6, 0x0, 0x0) syz_usb_control_io$uac1(r6, 0x0, 0x0) syz_usb_disconnect(r6) syz_usb_control_io$uac1(r6, &(0x7f00000003c0)={0x14, &(0x7f0000000400)=ANY=[@ANYBLOB="00e822499724b4278bb0e1dfe408a0d617b6bdd0c7fb39707f62ecac95a89869e63685ec8eb1fd7407141804cc71b6fe5cd91a2d6cfdfc1937ccb40898949d62d466236f08e2979d41cbdbcabd1dd1e3a606c62be656cb6033"], &(0x7f0000000200)={0x0, 0x3, 0x4, @lang_id={0x4, 0x3, 0x1007}}}, &(0x7f00000007c0)={0x44, &(0x7f0000000500)={0x40, 0x16, 0xe8, "6f45b1c120157929f8593d72c17edfe726ba3c64c83facf1c539d523e142865d57220635e2800c3fcc57a5056cbbd0d90e4e2569cf2ac2b1c6a000ecf9d80f5fd31d5e544ca8ae8b2992118af4ada1a3a83e0a14c98f859d208eed419738ba7ad3dbded36e7ba13d9e02eebeb57aa266bfa68c68a8c2302199ac17cacf591ae1fff644c219c83d0cb1ac9730063c34b89f7413649d5a9b6581f9e7d41ce13d34123d265451f547751b6c2fdc847c57a36294aa98d8ec80db4bff261930820074c42b76e1d4661d8798e34238439603b14e7348d2daaa2dfd934f6283a93a6aaf90221eff25f7a94a"}, &(0x7f0000000600)={0x0, 0xa, 0x1, 0x2}, &(0x7f0000000640)={0x0, 0x8, 0x1, 0xd}, &(0x7f0000000680)={0x20, 0x81, 0x2, "d962"}, &(0x7f00000006c0)={0x20, 0x82, 0x3, "a74d43"}, &(0x7f0000000700)={0x20, 0x83, 0x3, "7dda87"}, &(0x7f0000000740)={0x20, 0x84, 0x4, "0cb58062"}, &(0x7f0000000780)={0x20, 0x85, 0x3, "5cef0e"}}) sendmsg$IPSET_CMD_ADD(r5, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000240)={&(0x7f0000000280)={0x44, 0x9, 0x6, 0x201, 0x0, 0x0, {}, [@IPSET_ATTR_SETNAME={0x9, 0x2, 'syz1\x00'}, @IPSET_ATTR_PROTOCOL={0x5}, @IPSET_ATTR_DATA={0x1c, 0x7, 0x0, 0x1, [@IPSET_ATTR_IP={0xc, 0x1, 0x0, 0x1, @IPSET_ATTR_IPADDR_IPV4={0x8, 0x1, 0x1, 0x0, @broadcast}}, @IPSET_ATTR_IP_TO={0xc, 0x2, 0x0, 0x1, @IPSET_ATTR_IPADDR_IPV4={0x8, 0x1, 0x1, 0x0, @loopback}}]}]}, 0x44}, 0x1, 0x0, 0x0, 0x10040047}, 0x240008c4) sendmsg$IPSET_CMD_LIST(r0, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000100)=ANY=[@ANYBLOB="1c000000070601080000000000000000050000020500010006"], 0x1c}, 0x1, 0x0, 0x0, 0x24000840}, 0x4800) syz_usb_connect$hid(0x0, 0x36, &(0x7f0000000040)={{0x12, 0x1, 0x0, 0x0, 0x0, 0x0, 0x40, 0x56e, 0x10d, 0x0, 0x0, 0x0, 0x0, 0x1, [{{0x9, 0x2, 0x24, 0x1, 0x0, 0x0, 0xe0}}]}}, 0x0) r7 = seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0x0, &(0x7f0000000040)={0x1, &(0x7f0000000000)=[{0x6, 0x0, 0x0, 0x7fff7ffc}]}) close_range(r7, 0xffffffffffffffff, 0x0) executing program 7: mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./proc\x00', 0x1ff) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f0000000600)={0xffffffffffffffff, 0x5, 0x0, 0x0, 0x0, 0x0, 0xd01, 0x2000, 0x0, 0x0, 0x0, 0x0, 0x2}, 0x50) r0 = socket$can_bcm(0x1d, 0x2, 0x2) ioctl$ifreq_SIOCGIFINDEX_vcan(r0, 0x8933, &(0x7f0000000100)={'vcan0\x00', 0x0}) connect$can_bcm(r0, &(0x7f00000000c0)={0x1d, r1}, 0x10) sendmsg$can_bcm(r0, &(0x7f0000000440)={0x0, 0x0, &(0x7f0000000340)={&(0x7f0000000140)={0x1, 0x804, 0x0, {}, {}, {}, 0x1, @canfd={{0x2, 0x0, 0x0, 0x1}, 0x1d, 0x3, 0x0, 0x0, "f9537550367ffdd81f44ca7ad063335957189016d2bd7dc3f3d4eb21a9ea521f2d8dc0cc8014fa44e0da9de07392cdeebc2e9650f6eb00484047d3d9f4dcc3d5"}}, 0x80}}, 0x4008004) sendmsg$can_bcm(r0, &(0x7f0000000380)={0x0, 0x0, &(0x7f0000000300)={&(0x7f0000000640)=ANY=[], 0x48}, 0x1, 0x0, 0x0, 0x2000a041}, 0x800) executing program 7: r0 = syz_open_dev$sndctrl(&(0x7f0000000000), 0x0, 0x0) socket$nl_route(0x10, 0x3, 0x0) (async) r1 = socket$nl_route(0x10, 0x3, 0x0) r2 = socket$netlink(0x10, 0x3, 0x0) sendmsg$nl_route(r2, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000700)=@newlink={0x38, 0x12, 0xff05, 0x0, 0x0, {0x0, 0x0, 0x4a00}, [@IFLA_LINKINFO={0x18, 0x12, 0x0, 0x1, @wireguard={{0xe}, {0x4}}}]}, 0x38}}, 0x0) r3 = socket(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r3, 0x8933, &(0x7f0000000000)={'bridge0\x00', 0x0}) sendmsg$nl_route(r1, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000040)={&(0x7f00000001c0)=ANY=[@ANYBLOB="380000005500e50226bd70000100000007000000", @ANYRES32=r4, @ANYBLOB="20000100", @ANYRES32=r1], 0x38}, 0x1, 0x0, 0x0, 0x44}, 0x20000100) ioctl$SNDRV_CTL_IOCTL_ELEM_WRITE(r0, 0xc0185502, &(0x7f0000002500)={{0x0, 0x0, 0x0, 0xfffffffe, 'syz1\x00'}, 0x0, [0xffffffbffffffdfc, 0xfffffffc, 0x2a, 0x0, 0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7, 0x0, 0x2, 0x0, 0x0, 0x0, 0x40, 0xfffffffffffffffe, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x0, 0x4, 0x400, 0x1, 0x0, 0x0, 0xffff, 0xfffffffffffffffe, 0x4, 0x0, 0x0, 0x3, 0x0, 0x4, 0x0, 0xffffffffffffffff, 0x10000, 0x0, 0x0, 0x0, 0x1, 0xffffffffffffffff, 0xfffffffffffffffe, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x789, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x80000000000000, 0x7fff, 0x5, 0x3, 0x0, 0x0, 0x5, 0x0, 0x0, 0x0, 0x1, 0x0, 0x400000, 0x0, 0x40008, 0x1fc, 0xfffffffffffffffe, 0x0, 0x0, 0x0, 0xffffff6e, 0x8000000000000, 0x0, 0xfffffffffffffffe, 0x0, 0xfffffffd, 0x1fe, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0, 0xffffffff, 0x0, 0x0, 0x0, 0xfff, 0xa2, 0x200, 0x0, 0x0, 0xfffffffffffffffc, 0x80, 0xc0ab, 0x0, 0x201, 0x0, 0xfffffffe, 0x0, 0xfffffffc]}) (async) ioctl$SNDRV_CTL_IOCTL_ELEM_WRITE(r0, 0xc0185502, &(0x7f0000002500)={{0x0, 0x0, 0x0, 0xfffffffe, 'syz1\x00'}, 0x0, [0xffffffbffffffdfc, 0xfffffffc, 0x2a, 0x0, 0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7, 0x0, 0x2, 0x0, 0x0, 0x0, 0x40, 0xfffffffffffffffe, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x0, 0x4, 0x400, 0x1, 0x0, 0x0, 0xffff, 0xfffffffffffffffe, 0x4, 0x0, 0x0, 0x3, 0x0, 0x4, 0x0, 0xffffffffffffffff, 0x10000, 0x0, 0x0, 0x0, 0x1, 0xffffffffffffffff, 0xfffffffffffffffe, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x789, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x80000000000000, 0x7fff, 0x5, 0x3, 0x0, 0x0, 0x5, 0x0, 0x0, 0x0, 0x1, 0x0, 0x400000, 0x0, 0x40008, 0x1fc, 0xfffffffffffffffe, 0x0, 0x0, 0x0, 0xffffff6e, 0x8000000000000, 0x0, 0xfffffffffffffffe, 0x0, 0xfffffffd, 0x1fe, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0, 0xffffffff, 0x0, 0x0, 0x0, 0xfff, 0xa2, 0x200, 0x0, 0x0, 0xfffffffffffffffc, 0x80, 0xc0ab, 0x0, 0x201, 0x0, 0xfffffffe, 0x0, 0xfffffffc]}) executing program 7: r0 = socket$nl_route(0x10, 0x3, 0x0) r1 = socket$unix(0x1, 0x1, 0x0) ioctl$sock_SIOCGIFINDEX(r1, 0x8933, &(0x7f0000000100)={'netdevsim0\x00', 0x0}) mkdirat(0xffffffffffffff9c, &(0x7f0000000280)='./file0\x00', 0x0) mount$9p_virtio(&(0x7f00000001c0), &(0x7f0000000080)='./file0\x00', &(0x7f00000004c0), 0x80, 0x0) r3 = socket$vsock_stream(0x28, 0x1, 0x0) connect$vsock_stream(r3, &(0x7f0000000080)={0x28, 0x0, 0xfd4b31285978d6ce}, 0x10) ioctl$sock_SIOCINQ(r3, 0x541b, &(0x7f00000000c0)) chdir(&(0x7f0000000040)='./file0\x00') r4 = syz_clone(0x0, 0x0, 0x0, 0x0, 0x0, 0x0) setreuid(0xee01, 0xee01) tkill(r4, 0x12) fsync(r3) r5 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000100)='cpuacct.usage_percpu\x00', 0x275a, 0x0) read$FUSE(r5, &(0x7f0000000500)={0x2020, 0x0, 0x0, 0x0, 0x0}, 0x2020) sendmsg$nl_route_sched(r0, &(0x7f00000012c0)={0x0, 0x0, &(0x7f0000000000)={&(0x7f00000000c0)=@newqdisc={0x30, 0x24, 0xf3f, 0x70bd2a, 0xfffffffd, {0x0, 0x0, 0x0, r2, {}, {0xfff1, 0xffff}, {0x0, 0xc}}, [@qdisc_kind_options=@q_ingress={0xc}]}, 0x30}}, 0x0) socket$key(0xf, 0x3, 0x2) r7 = openat$pfkey(0xffffffffffffff9c, &(0x7f0000001580), 0x0, 0x0) pread64(r7, &(0x7f00000000c0)=""/70, 0x46, 0x4) r8 = syz_open_procfs(0x0, &(0x7f0000000040)='loginuid\x00') writev(r8, &(0x7f0000000000)=[{&(0x7f00000004c0)='4', 0x1}], 0x1) vmsplice(0xffffffffffffffff, &(0x7f0000000480)=[{&(0x7f0000000180)="77690add7dbebb00", 0x8}, {&(0x7f0000000400)="58957efe75b22709e4cfe3d6b78e799e83f6ab812a5be5370668e5c2751c069a3941c25fa6289224626af98ddadc5b8f9cd781e434ec6c523f80297fa6d9eba67f7e18f4de665edfd88ff4486ddbd733ef4644e7ab43a0bb4481f8ff0300003281a6cd189b1ab8f0badfd988bab4126862209581", 0x74}], 0x2, 0x7) r9 = creat(&(0x7f00000002c0)='./file0\x00', 0x0) r10 = open$dir(&(0x7f0000000380)='./file0\x00', 0x0, 0x0) mmap$xdp(&(0x7f0000ffc000/0x4000)=nil, 0x4000, 0x0, 0x12, r10, 0x0) r11 = bpf$PROG_LOAD(0x5, &(0x7f0000003bc0)={0x2, 0x4, &(0x7f0000000200)=ANY=[@ANYBLOB="180000000300000000000000fe020010850000000700000095"], &(0x7f0000000000)='GPL\x00', 0x0, 0x0, 0x0, 0x100, 0x70, '\x00', 0x0, @fallback=0x11, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x100000}, 0x94) write$P9_RVERSION(r9, &(0x7f0000000300)=ANY=[@ANYRES64=r6, @ANYBLOB="6d4c8d", @ANYRES8=r9], 0x13) ioctl$sock_ipv4_tunnel_SIOCADDTUNNEL(r9, 0x89f1, &(0x7f0000002640)={'syztnl1\x00', &(0x7f0000002540)={'syztnl0\x00', r2, 0x7800, 0x7, 0x20, 0xffffffff, {{0x2d, 0x4, 0x2, 0x34, 0xb4, 0x66, 0x0, 0x94, 0x4, 0x0, @multicast2, @remote, {[@noop, @timestamp={0x44, 0x20, 0x3f, 0x0, 0x6, [0x7fff, 0x3, 0xfd, 0x2, 0x2, 0x9c5d, 0x8]}, @ra={0x94, 0x4, 0x1}, @ssrr={0x89, 0x7, 0x71, [@dev={0xac, 0x14, 0x14, 0x42}]}, @timestamp_prespec={0x44, 0x14, 0xc, 0x3, 0xe, [{@multicast1, 0x8}, {@initdev={0xac, 0x1e, 0x0, 0x0}, 0x1000}]}, @timestamp_addr={0x44, 0x34, 0x43, 0x1, 0x2, [{@private=0xa010101, 0x7}, {@multicast2, 0x6}, {@broadcast, 0x9}, {@rand_addr=0x64010100}, {@dev={0xac, 0x14, 0x14, 0x32}, 0x7}, {@dev={0xac, 0x14, 0x14, 0x42}, 0x435}]}, @end, @timestamp_prespec={0x44, 0x4, 0xf5, 0x3, 0xa}, @end, @rr={0x7, 0x17, 0x34, [@rand_addr=0x64010101, @dev={0xac, 0x14, 0x14, 0x37}, @local, @empty, @private=0xa010101]}, @lsrr={0x83, 0xf, 0xbd, [@private=0xa012101, @loopback, @loopback]}]}}}}}) bpf$BPF_LINK_CREATE_XDP(0x1c, &(0x7f00000003c0)={r11, 0x0, 0x30, 0x0, @val=@uprobe_multi={&(0x7f00000000c0)='./file0\x00', &(0x7f0000000040)=[0x5], 0x0, 0x0, 0x1, 0x1}}, 0x40) sendmsg$nl_route_sched(r0, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000002680)=@newtfilter={0x180, 0x2c, 0x20, 0x30bd29, 0x25dfdbfc, {0x0, 0x0, 0x0, r2, {}, {0xfff3, 0x10}, {0xe, 0x1}}}, 0x180}, 0x1, 0x0, 0x0, 0x600050d4}, 0x40) executing program 7: r0 = bpf$PROG_LOAD(0x5, &(0x7f000000e000)={0x10, 0x4, &(0x7f0000000040)=ANY=[@ANYBLOB="b4000000000000007910480000000000610400000000000095000000"], &(0x7f0000003ff6)='GPL\x00', 0x2, 0xfd90, &(0x7f000000cf3d)=""/195, 0x0, 0x0, '\x00', 0x0, @sk_msg}, 0x48) close(r0) socket(0x10, 0x3, 0x0) r1 = openat$selinux_attr(0xffffffffffffff9c, &(0x7f0000000080)='/proc/self/attr/exec\x00', 0x2, 0x0) close(r1) r2 = bpf$MAP_CREATE(0x0, &(0x7f0000000700)=ANY=[@ANYBLOB="0f000000040000000400000012"], 0x48) bpf$MAP_UPDATE_ELEM_TAIL_CALL(0x2, &(0x7f00000000c0)={{r2}, &(0x7f0000000000), &(0x7f00000002c0)=r0}, 0x20) r3 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r3, &(0x7f00000001c0)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000200)=ANY=[@ANYBLOB="24000000190001002cbd700000c8c3532d"], 0x24}}, 0x0) executing program 7: r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000000), 0x2, 0x0) r1 = openat$tun(0xffffffffffffff9c, &(0x7f0000000540), 0x40241, 0x0) ioctl$TUNSETIFF(r1, 0x400454ca, &(0x7f00000000c0)={'syzkaller1\x00', 0x6bf1c2d5adba8c32}) r2 = socket$inet6_tcp(0xa, 0x1, 0x0) r3 = dup(r2) ioctl$SIOCSIFHWADDR(r3, 0x8914, &(0x7f0000000040)={'syzkaller1\x00', @link_local={0x1, 0x80, 0xc2, 0x0, 0x0, 0x2}}) writev(r1, &(0x7f0000000000)=[{&(0x7f0000000180)="0e1221b23bb601c477d3df163e75963d86dd606712e9000d118db0049d90491c0748040000c32700b7afd3e04fb862b3c6e612", 0x33}, {&(0x7f0000000ac0)="b00c7037e07686acd2c8dd812560e8ae47", 0x11}, {&(0x7f0000000100)="13cfb6", 0x3}], 0x3) r4 = socket$inet_udp(0x2, 0x2, 0x0) ioctl$TIOCSETD(r0, 0x5423, &(0x7f0000000040)=0x3) r5 = fcntl$dupfd(r0, 0x0, r4) ioctl$TIOCSETD(r5, 0x5412, &(0x7f0000000140)=0xffffffc0) r6 = semget$private(0x0, 0x0, 0x500) semctl$IPC_STAT(r6, 0x0, 0x2, &(0x7f00000002c0)=""/172) fsconfig$FSCONFIG_CMD_CREATE(r5, 0x6, 0x0, 0x0, 0x0) r7 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r7, &(0x7f0000000380)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000240)=@getae={0x4c, 0x1f, 0x1, 0x70bd27, 0x25dfdbff, {{@in6=@remote, 0x4da, 0x2, 0x6c}, @in=@loopback, 0x2, 0x34fd}, [@mark={0xc, 0x15, {0x35075c, 0x81}}]}, 0x4c}, 0x1, 0x0, 0x0, 0x20004045}, 0x40040) executing program 36: r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000000), 0x2, 0x0) r1 = openat$tun(0xffffffffffffff9c, &(0x7f0000000540), 0x40241, 0x0) ioctl$TUNSETIFF(r1, 0x400454ca, &(0x7f00000000c0)={'syzkaller1\x00', 0x6bf1c2d5adba8c32}) r2 = socket$inet6_tcp(0xa, 0x1, 0x0) r3 = dup(r2) ioctl$SIOCSIFHWADDR(r3, 0x8914, &(0x7f0000000040)={'syzkaller1\x00', @link_local={0x1, 0x80, 0xc2, 0x0, 0x0, 0x2}}) writev(r1, &(0x7f0000000000)=[{&(0x7f0000000180)="0e1221b23bb601c477d3df163e75963d86dd606712e9000d118db0049d90491c0748040000c32700b7afd3e04fb862b3c6e612", 0x33}, {&(0x7f0000000ac0)="b00c7037e07686acd2c8dd812560e8ae47", 0x11}, {&(0x7f0000000100)="13cfb6", 0x3}], 0x3) r4 = socket$inet_udp(0x2, 0x2, 0x0) ioctl$TIOCSETD(r0, 0x5423, &(0x7f0000000040)=0x3) r5 = fcntl$dupfd(r0, 0x0, r4) ioctl$TIOCSETD(r5, 0x5412, &(0x7f0000000140)=0xffffffc0) r6 = semget$private(0x0, 0x0, 0x500) semctl$IPC_STAT(r6, 0x0, 0x2, &(0x7f00000002c0)=""/172) fsconfig$FSCONFIG_CMD_CREATE(r5, 0x6, 0x0, 0x0, 0x0) r7 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r7, &(0x7f0000000380)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000240)=@getae={0x4c, 0x1f, 0x1, 0x70bd27, 0x25dfdbff, {{@in6=@remote, 0x4da, 0x2, 0x6c}, @in=@loopback, 0x2, 0x34fd}, [@mark={0xc, 0x15, {0x35075c, 0x81}}]}, 0x4c}, 0x1, 0x0, 0x0, 0x20004045}, 0x40040) executing program 2: mkdirat(0xffffffffffffff9c, &(0x7f0000000040)='./file1\x00', 0x1) r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000240), 0x0, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000040)={'syzkaller0\x00', 0x7101}) r1 = socket(0x400000000010, 0x3, 0x0) r2 = socket$unix(0x1, 0x5, 0x0) ioctl$sock_SIOCGIFINDEX(r2, 0x8933, &(0x7f0000000100)={'syzkaller0\x00', 0x0}) sendmsg$nl_route_sched(r1, &(0x7f00000012c0)={0x0, 0x4e, &(0x7f0000000080)={&(0x7f00000001c0)=@newqdisc={0x44, 0x24, 0x4ee4e6a52ff56541, 0x70bd2a, 0xffffffff, {0x0, 0x0, 0x0, r3, {0x0, 0xfff1}, {0xffff, 0xffff}, {0x0, 0xf}}, [@qdisc_kind_options=@q_hfsc={{0x9}, {0x14, 0x2, @TCA_HFSC_FSC={0x10, 0x2, {0xa30e, 0x1, 0xfffffffa}}}}]}, 0x44}}, 0x0) sendmsg$nl_route_sched(r1, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000380)={&(0x7f0000000880)=@deltfilter={0x288, 0x2d, 0x10, 0x70bd26, 0x25dfdbfd, {0x0, 0x0, 0x0, r3, {0x3, 0x6}, {0xfff3, 0x10}, {0xfff1, 0xe}}, [@TCA_RATE={0x6, 0x5, {0x0, 0x6}}, @TCA_RATE={0x6, 0x5, {0x4, 0xbf}}, @filter_kind_options=@f_cgroup={{0xb}, {0x248, 0x2, [@TCA_CGROUP_EMATCHES={0x244, 0x3, 0x0, 0x1, [@TCA_EMATCH_TREE_LIST={0x180, 0x2, 0x0, 0x1, [@TCF_EM_IPT={0xdc, 0x1, 0x0, 0x0, {{0x363f, 0x9, 0x1000}, [@TCA_EM_IPT_MATCH_DATA={0x11, 0x5, "cb246ca1261c82eb8a5d175147"}, @TCA_EM_IPT_HOOK={0x8, 0x1, 0x1}, @TCA_EM_IPT_MATCH_DATA={0x94, 0x5, "e445f50c88bdf013fc2da850fdf6b42000d691b102366c3614686911b72e4722cf999a5c03056bb04d6e20998688618ebf48af1c9f2206f74636cfb23a6ac31c6fe2952c325b6c7016452bc03f1c30b58f8414bb6efac6d4a270cc8137091d71d9a078d96cce4ca218cf905fef8104a631c32b900216961aae87d9623b64a357407e75077581b0d6b18b3a7a6be50ad2"}, @TCA_EM_IPT_MATCH_REVISION={0x5, 0x3, 0x9}, @TCA_EM_IPT_MATCH_NAME={0xb}, @TCA_EM_IPT_MATCH_NAME={0xb}]}}, @TCF_EM_META={0x24, 0x1, 0x0, 0x0, {{0x5, 0x4, 0x7}, [@TCA_EM_META_HDR={0xc, 0x1, {{0xfffd, 0x5, 0x1}, {0x0, 0x40, 0x1}}}, @TCA_EM_META_LVALUE={0x9, 0x2, [@TCF_META_TYPE_VAR="cb3c18e51b"]}]}}, @TCF_EM_NBYTE={0x14, 0x3, 0x0, 0x0, {{0x5, 0x2, 0x4}, {0x6, 0x4, 0x2, "6f807fc0"}}}, @TCF_EM_U32={0x1c, 0x2, 0x0, 0x0, {{0x7, 0x3, 0x4}, {0xfffffff9, 0x7, 0x3ff}}}, @TCF_EM_META={0x4c, 0x1, 0x0, 0x0, {{0x1}, [@TCA_EM_META_HDR={0xc, 0x1, {{0x4, 0xfb}, {0x4, 0xb}}}, @TCA_EM_META_LVALUE={0x2e, 0x2, [@TCF_META_TYPE_VAR="fbe4b1e589a9c6", @TCF_META_TYPE_VAR, @TCF_META_TYPE_INT=0x5, @TCF_META_TYPE_VAR="b0c209d1dacf0bd9", @TCF_META_TYPE_INT=0x4, @TCF_META_TYPE_VAR=':', @TCF_META_TYPE_INT=0x5, @TCF_META_TYPE_VAR="aaa02ef0e1dda31da977", @TCF_META_TYPE_INT=0xa, @TCF_META_TYPE_VAR]}, @TCA_EM_META_LVALUE={0x4}]}}]}, @TCA_EMATCH_TREE_HDR={0x8, 0x1, {0x4}}, @TCA_EMATCH_TREE_LIST={0xa8, 0x2, 0x0, 0x1, [@TCF_EM_META={0x3c, 0x2, 0x0, 0x0, {{0x8, 0x4, 0x1}, [@TCA_EM_META_RVALUE={0x2d, 0x3, [@TCF_META_TYPE_VAR="82d033", @TCF_META_TYPE_INT, @TCF_META_TYPE_VAR="bd8b453c69600ab27923", @TCF_META_TYPE_INT=0x3, @TCF_META_TYPE_INT=0x9, @TCF_META_TYPE_INT, @TCF_META_TYPE_INT=0xa, @TCF_META_TYPE_INT=0x9, @TCF_META_TYPE_INT]}]}}, @TCF_EM_U32={0x1c, 0x2, 0x0, 0x0, {{0xfff, 0x3, 0x7}, {0x9, 0x7, 0x7, 0x4}}}, @TCF_EM_CONTAINER={0x4c, 0x3, 0x0, 0x0, {{0xae02, 0x0, 0x3}, "b4eaf55a1425a349228c845c0a3ca0f13f6650a80840a18d09769d45792aac69fe81b569953f65bb04a7c51a0dec34a9731101ad53fcd32cd7370e53b6439682"}}]}, @TCA_EMATCH_TREE_HDR={0x8, 0x1, {0x9}}, @TCA_EMATCH_TREE_HDR={0x8, 0x1, {0x8}}]}]}}]}, 0x288}, 0x1, 0x0, 0x0, 0x4008848}, 0xc884) mkdirat(0xffffffffffffff9c, &(0x7f00000000c0)='./bus\x00', 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000100)='./sys\x00', 0x1ff) mount(0x0, &(0x7f0000000100)='./sys\x00', &(0x7f0000000200)='sysfs\x00', 0x0, 0x0) ioctl$SNDRV_CTL_IOCTL_ELEM_UNLOCK(0xffffffffffffffff, 0xc1105511, &(0x7f0000000040)={0xa, 0x0, 0x3d, 0x10000, 'syz1\x00', 0x5}) sendmsg$ETHTOOL_MSG_COALESCE_SET(0xffffffffffffffff, &(0x7f0000000540)={0x0, 0x0, &(0x7f0000000500)={&(0x7f00000000c0)=ANY=[@ANYBLOB='\\\x00\x00\x00', @ANYRES16, @ANYBLOB="010000000000000000001400000008000200fc00000018000180140002006e657464657673696d300000000000000800050000fcffff08000900fc000000080011000700000008000e008000", @ANYRES32], 0x5c}, 0x1, 0x0, 0x0, 0x40800}, 0x40090) r4 = add_key$user(&(0x7f00000001c0), &(0x7f0000000300)={'syz', 0x0}, &(0x7f0000000240)="166ec4b1", 0x4, 0xfffffffffffffffe) r5 = add_key$user(&(0x7f00000003c0), &(0x7f0000000440), &(0x7f00000000c0), 0xc9, 0xfffffffffffffffd) keyctl$dh_compute(0x17, &(0x7f0000000140)={r4, r5, r4}, &(0x7f00000000c0)=""/83, 0xfffffffffffffe4f, 0x0) r6 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000000), 0x20042, 0x0) add_key$user(&(0x7f0000000080), 0x0, 0x0, 0x0, 0x0) r7 = ioctl$KVM_CREATE_VM(r6, 0xae01, 0x0) r8 = dup(r7) ioctl$KVM_SET_USER_MEMORY_REGION(r7, 0x4020ae46, &(0x7f0000000840)={0x1fe, 0x2, 0x2000, 0x1000, &(0x7f0000003000/0x1000)=nil}) r9 = ioctl$KVM_CREATE_VCPU(r8, 0xae41, 0x2) syz_kvm_setup_cpu$x86(0xffffffffffffffff, r9, &(0x7f0000000000/0x18000)=nil, &(0x7f0000000040)=[@text64={0x40, 0x0}], 0x1, 0x11, 0x0, 0x0) syz_kvm_setup_cpu$x86(r7, r9, &(0x7f0000000000/0x18000)=nil, &(0x7f0000000200)=[@text64={0x40, 0x0}], 0x1, 0x0, 0x0, 0x0) ioctl$KVM_RUN(r9, 0xae80, 0x0) r10 = openat(0xffffffffffffff9c, &(0x7f0000000400)='./sys/class/video4linux/video0/name\x00', 0x0, 0x0) read(r10, &(0x7f0000000700), 0x40) mkdirat(0xffffffffffffff9c, &(0x7f0000000240)='./file1/file0\x00', 0x0) mount$bind(&(0x7f0000000100)='.\x00', &(0x7f0000000280)='./file1/file0\x00', 0x0, 0x1085408, 0x0) mount$overlay(0x0, &(0x7f00000000c0)='./bus\x00', &(0x7f00000003c0), 0x0, &(0x7f00000004c0)={[{@workdir={'workdir', 0x3d, './bus'}}, {@lowerdir={'lowerdir', 0x3d, './file1/file0'}}, {@upperdir={'upperdir', 0x3d, './file1'}}]}) executing program 2: r0 = syz_usb_connect$hid(0x3, 0x36, &(0x7f0000000140)=ANY=[@ANYBLOB="1201000000000040ac054382408b0b00000109022400010000002009040000fd0301000009210000000122010009058103"], 0x0) r1 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r1, &(0x7f0000000200)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000000000)=ANY=[@ANYBLOB="480000001000ffff25bd7000fedbdf2520000000", @ANYRES32=0x0, @ANYBLOB="2402000000200500280012800b00010065727370616e0000180002800400120006001800050000000500160002000000"], 0x48}}, 0x8000) syz_usb_control_io$hid(r0, 0x0, 0x0) r2 = syz_open_procfs(0x0, &(0x7f0000000180)='net/ip_vs_stats_percpu\x00') read(r2, &(0x7f0000001a00)=""/177, 0xb1) syz_usb_control_io$hid(r0, &(0x7f00000003c0)={0x24, 0x0, 0x0, &(0x7f0000000a80)=ANY=[@ANYBLOB="002281"], 0x0}, 0x0) r3 = syz_open_dev$hiddev(&(0x7f00000000c0), 0x0, 0x0) ioctl$HIDIOCSREPORT(r3, 0x81044804, &(0x7f0000000400)={0x1, 0x2}) syz_usb_control_io$hid(r0, &(0x7f0000000900)={0x24, 0x0, &(0x7f0000000280)={0x0, 0x3, 0xb6, @string={0xb6, 0x3, "fcc56026ad515e0ffc96cb84f9a85c129e4247cac3d83d4e4a92bcd4724a62bc2cd906dbbb3e372be473612a2c13a8205e79a5ca24ccdf0ffc286e91c5860521721725027343d38942910ce0dd035f0e27b6ae2437a035f2d7d79237519ff2bc4b8888cff8fc733bb537c03418bcb462c98f8d247d097510cb57ec337603c840c24b511886deba5347b9b70b85a1c0a46ec8b248ba2a1d6cf3a34b211056154c5d969c78449c0b32a298c3c6bbd5318e7014d05b"}}, 0x0, 0x0}, 0x0) syz_usb_connect$hid(0x3, 0x36, &(0x7f0000000140)=ANY=[@ANYBLOB="1201000000000040ac054382408b0b00000109022400010000002009040000fd0301000009210000000122010009058103"], 0x0) (async) socket$nl_route(0x10, 0x3, 0x0) (async) sendmsg$nl_route(r1, &(0x7f0000000200)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000000000)=ANY=[@ANYBLOB="480000001000ffff25bd7000fedbdf2520000000", @ANYRES32=0x0, @ANYBLOB="2402000000200500280012800b00010065727370616e0000180002800400120006001800050000000500160002000000"], 0x48}}, 0x8000) (async) syz_usb_control_io$hid(r0, 0x0, 0x0) (async) syz_open_procfs(0x0, &(0x7f0000000180)='net/ip_vs_stats_percpu\x00') (async) read(r2, &(0x7f0000001a00)=""/177, 0xb1) (async) syz_usb_control_io$hid(r0, &(0x7f00000003c0)={0x24, 0x0, 0x0, &(0x7f0000000a80)=ANY=[@ANYBLOB="002281"], 0x0}, 0x0) (async) syz_open_dev$hiddev(&(0x7f00000000c0), 0x0, 0x0) (async) ioctl$HIDIOCSREPORT(r3, 0x81044804, &(0x7f0000000400)={0x1, 0x2}) (async) syz_usb_control_io$hid(r0, &(0x7f0000000900)={0x24, 0x0, &(0x7f0000000280)={0x0, 0x3, 0xb6, @string={0xb6, 0x3, "fcc56026ad515e0ffc96cb84f9a85c129e4247cac3d83d4e4a92bcd4724a62bc2cd906dbbb3e372be473612a2c13a8205e79a5ca24ccdf0ffc286e91c5860521721725027343d38942910ce0dd035f0e27b6ae2437a035f2d7d79237519ff2bc4b8888cff8fc733bb537c03418bcb462c98f8d247d097510cb57ec337603c840c24b511886deba5347b9b70b85a1c0a46ec8b248ba2a1d6cf3a34b211056154c5d969c78449c0b32a298c3c6bbd5318e7014d05b"}}, 0x0, 0x0}, 0x0) (async) executing program 2: r0 = socket$nl_netfilter(0x10, 0x3, 0xc) close(r0) r1 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000000), 0x121002, 0x0) ioctl$KVM_CREATE_VM(r1, 0xae01, 0x0) (async) r2 = ioctl$KVM_CREATE_VM(r1, 0xae01, 0x0) ioctl$KVM_CREATE_IRQCHIP(r2, 0xae60) (async) ioctl$KVM_CREATE_IRQCHIP(r2, 0xae60) ioctl$KVM_SET_MSRS(0xffffffffffffffff, 0x4008ae89, &(0x7f00000002c0)={0x7, 0x0, [{0x342, 0x0, 0xf}, {0xbd5, 0x0, 0xf018}, {0x935, 0x0, 0x7fff}, {0xa96, 0x0, 0xff}, {0x488, 0x0, 0x4}, {0xaa2, 0x0, 0x40}, {0xeab, 0x0, 0xa1}]}) (async) ioctl$KVM_SET_MSRS(0xffffffffffffffff, 0x4008ae89, &(0x7f00000002c0)={0x7, 0x0, [{0x342, 0x0, 0xf}, {0xbd5, 0x0, 0xf018}, {0x935, 0x0, 0x7fff}, {0xa96, 0x0, 0xff}, {0x488, 0x0, 0x4}, {0xaa2, 0x0, 0x40}, {0xeab, 0x0, 0xa1}]}) ioctl$KVM_CREATE_VCPU(r2, 0xae41, 0x0) (async) r3 = ioctl$KVM_CREATE_VCPU(r2, 0xae41, 0x0) ioctl$KVM_SET_REGS(r3, 0x4090ae82, &(0x7f00000001c0)={[0xffff, 0xfffffffffffffffe, 0x2f, 0xa50, 0xffff, 0xffff, 0x5, 0x7, 0x100000006, 0xfe, 0x0, 0x5, 0x100, 0x40000000001, 0xffffffffffffffff, 0x9], 0x1, 0x360200}) (async) ioctl$KVM_SET_REGS(r3, 0x4090ae82, &(0x7f00000001c0)={[0xffff, 0xfffffffffffffffe, 0x2f, 0xa50, 0xffff, 0xffff, 0x5, 0x7, 0x100000006, 0xfe, 0x0, 0x5, 0x100, 0x40000000001, 0xffffffffffffffff, 0x9], 0x1, 0x360200}) ioctl$KVM_SET_VCPU_EVENTS(r3, 0x4400ae8f, &(0x7f0000000140)=@arm64={0x6, 0x14, 0x0, '\x00', 0x8001}) (async) ioctl$KVM_SET_VCPU_EVENTS(r3, 0x4400ae8f, &(0x7f0000000140)=@arm64={0x6, 0x14, 0x0, '\x00', 0x8001}) ioctl$KVM_RUN(r3, 0xae80, 0x0) ioctl$KVM_SET_MSRS(r3, 0x4008ae89, &(0x7f0000000280)={0x1, 0x0, [{0x40000070, 0x0, 0x6}]}) (async) ioctl$KVM_SET_MSRS(r3, 0x4008ae89, &(0x7f0000000280)={0x1, 0x0, [{0x40000070, 0x0, 0x6}]}) r4 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r4, &(0x7f00000000c0)={0x0, 0xfb, &(0x7f0000000180)={&(0x7f0000000100)=ANY=[@ANYBLOB="140000001000010000000000000000000500000a28000000000a030000000000000000000a00000708000240000000020900010073797a31000000002c000000030a010100000000000000000a0000070900010073797a31000000000900030073797a320000000014000000110001"], 0x7c}}, 0x0) sendmsg$NFT_BATCH(r4, &(0x7f0000009b40)={0x0, 0x0, &(0x7f0000009b00)={&(0x7f0000000240)=ANY=[@ANYRES32=r2], 0x78}, 0x1, 0x0, 0x0, 0x4000850}, 0x40) statx(0xffffffffffffffff, &(0x7f0000000340)='./file0\x00', 0x0, 0x1, &(0x7f0000000a40)) getsockopt$inet_pktinfo(0xffffffffffffffff, 0x0, 0x8, &(0x7f0000000800)={0x0, @empty, @empty}, &(0x7f0000000840)=0xc) sendmsg$nl_route(0xffffffffffffffff, &(0x7f0000000580)={&(0x7f0000000200)={0x10, 0x0, 0x0, 0x80}, 0xc, &(0x7f0000000540)={&(0x7f00000003c0)=ANY=[@ANYBLOB="540000001800000825bd7000fedbdf251d01040005000d00385760a42524b79567f30684c30e0000000000090020be9b33e6de9ebb36863e23c5fba33ca3172ed89b721fd6df0f5f8ac205c253f489fd7c5b24cb01e9e7e248ee6554b84778c43f4897", @ANYRES32=r5, @ANYBLOB='\x00\x00\n\x00', @ANYRES32=r5, @ANYBLOB="150003000300004005020000ba00dd7d20bc400105000000"], 0x54}, 0x1, 0x0, 0x0, 0x80}, 0x4000094) sendmsg$NFT_BATCH(r4, &(0x7f0000009b40)={0x0, 0x0, &(0x7f0000009b00)={&(0x7f00000002c0)=ANY=[@ANYBLOB="140000001000010000000000000000000500000a400000000c0a011e00000000000000000a0000060900020073797a31000000000900010073797a310000000014000380100000800c0001800600010058c6000014000000110001"], 0x68}, 0x1, 0x0, 0x0, 0x4000850}, 0x40) r6 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$ETHTOOL_MSG_LINKINFO_GET(0xffffffffffffffff, &(0x7f0000000380)={0x0, 0x0, &(0x7f0000000340)={&(0x7f00000002c0)=ANY=[@ANYBLOB=',\x00\x00\x00', @ANYRES16=0x0, @ANYBLOB="010000000000000000"], 0x2c}, 0x1, 0x0, 0x0, 0x4000}, 0x0) sendmsg$ETHTOOL_MSG_RINGS_SET(0xffffffffffffffff, &(0x7f00000008c0)={&(0x7f0000000040)={0x10, 0x0, 0x0, 0x800000}, 0xc, &(0x7f0000000880)={&(0x7f0000000900)=ANY=[@ANYBLOB="1c000000", @ANYRES16=0x0, @ANYBLOB="00c8377f0227bd7000fc02000000000000000007000400000019a41a803bbcd8508735f59bde2d0e50e711d3e426dbe305169b3520ce3d70d54a51eb1d693912acf00daf76383a9aa3100276759649f321b46aff6cb78208404ec102c3e7068a8be07754d48dd205b266e8d5c7ec5a05009d9f3d390371d94205b7cf3c85860fafa748d0bdca0785be19f867fa268db7e9b88f18dbaf05eafed4bce34981b6b1c0a4694a906e377eb5074f89071605280ea32c0693b98789c3575996e6fe46906e00872118dc5d7b04160f48acfadb5cd8cd69d748d966c6e4e25145cf9451481c025bb46bb702acbff53eff01edfb45910c66d2909cce892f77f378db6f164d75c40fda5c4207"], 0x1c}, 0x1, 0x0, 0x0, 0x40000}, 0x44) (async) sendmsg$ETHTOOL_MSG_RINGS_SET(0xffffffffffffffff, &(0x7f00000008c0)={&(0x7f0000000040)={0x10, 0x0, 0x0, 0x800000}, 0xc, &(0x7f0000000880)={&(0x7f0000000900)=ANY=[@ANYBLOB="1c000000", @ANYRES16=0x0, @ANYBLOB="00c8377f0227bd7000fc02000000000000000007000400000019a41a803bbcd8508735f59bde2d0e50e711d3e426dbe305169b3520ce3d70d54a51eb1d693912acf00daf76383a9aa3100276759649f321b46aff6cb78208404ec102c3e7068a8be07754d48dd205b266e8d5c7ec5a05009d9f3d390371d94205b7cf3c85860fafa748d0bdca0785be19f867fa268db7e9b88f18dbaf05eafed4bce34981b6b1c0a4694a906e377eb5074f89071605280ea32c0693b98789c3575996e6fe46906e00872118dc5d7b04160f48acfadb5cd8cd69d748d966c6e4e25145cf9451481c025bb46bb702acbff53eff01edfb45910c66d2909cce892f77f378db6f164d75c40fda5c4207"], 0x1c}, 0x1, 0x0, 0x0, 0x40000}, 0x44) sendmsg$nl_xfrm(r4, &(0x7f0000000180)={0x0, 0x0, &(0x7f00000001c0)={&(0x7f0000000000)=ANY=[@ANYBLOB="140000002569000000"], 0x14}}, 0x0) sendmsg$nl_xfrm(r6, &(0x7f0000000180)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000000)=ANY=[@ANYBLOB="b800000015"], 0xb8}}, 0x0) ioctl$KVM_GET_MP_STATE(r3, 0x8004ae98, &(0x7f0000000640)) syz_open_dev$dri(&(0x7f00000005c0), 0x2, 0x94a00) (async) r7 = syz_open_dev$dri(&(0x7f00000005c0), 0x2, 0x94a00) ioctl$DRM_IOCTL_SET_CLIENT_CAP(r7, 0x4010640d, &(0x7f0000000600)={0x14}) sendmsg$NFT_BATCH(r0, &(0x7f0000009b40)={0x0, 0x0, &(0x7f0000000500)={&(0x7f00000002c0)=ANY=[], 0x68}, 0x1, 0x0, 0x0, 0x4000850}, 0x40) r8 = open(&(0x7f0000000680)='./file0\x00', 0x612102, 0x180) syz_genetlink_get_family_id$tipc(&(0x7f0000000700), 0xffffffffffffffff) (async) r9 = syz_genetlink_get_family_id$tipc(&(0x7f0000000700), 0xffffffffffffffff) sendmsg$TIPC_CMD_GET_REMOTE_MNG(r8, &(0x7f00000007c0)={&(0x7f00000006c0)={0x10, 0x0, 0x0, 0x10000}, 0xc, &(0x7f0000000780)={&(0x7f0000000740)={0x1c, r9, 0x4, 0x70bd2a, 0x25dfdbfc, {}, ["", "", "", ""]}, 0x1c}, 0x1, 0x0, 0x0, 0x40000}, 0x10004000) executing program 37: r0 = socket$nl_netfilter(0x10, 0x3, 0xc) close(r0) r1 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000000), 0x121002, 0x0) ioctl$KVM_CREATE_VM(r1, 0xae01, 0x0) (async) r2 = ioctl$KVM_CREATE_VM(r1, 0xae01, 0x0) ioctl$KVM_CREATE_IRQCHIP(r2, 0xae60) (async) ioctl$KVM_CREATE_IRQCHIP(r2, 0xae60) ioctl$KVM_SET_MSRS(0xffffffffffffffff, 0x4008ae89, &(0x7f00000002c0)={0x7, 0x0, [{0x342, 0x0, 0xf}, {0xbd5, 0x0, 0xf018}, {0x935, 0x0, 0x7fff}, {0xa96, 0x0, 0xff}, {0x488, 0x0, 0x4}, {0xaa2, 0x0, 0x40}, {0xeab, 0x0, 0xa1}]}) (async) ioctl$KVM_SET_MSRS(0xffffffffffffffff, 0x4008ae89, &(0x7f00000002c0)={0x7, 0x0, [{0x342, 0x0, 0xf}, {0xbd5, 0x0, 0xf018}, {0x935, 0x0, 0x7fff}, {0xa96, 0x0, 0xff}, {0x488, 0x0, 0x4}, {0xaa2, 0x0, 0x40}, {0xeab, 0x0, 0xa1}]}) ioctl$KVM_CREATE_VCPU(r2, 0xae41, 0x0) (async) r3 = ioctl$KVM_CREATE_VCPU(r2, 0xae41, 0x0) ioctl$KVM_SET_REGS(r3, 0x4090ae82, &(0x7f00000001c0)={[0xffff, 0xfffffffffffffffe, 0x2f, 0xa50, 0xffff, 0xffff, 0x5, 0x7, 0x100000006, 0xfe, 0x0, 0x5, 0x100, 0x40000000001, 0xffffffffffffffff, 0x9], 0x1, 0x360200}) (async) ioctl$KVM_SET_REGS(r3, 0x4090ae82, &(0x7f00000001c0)={[0xffff, 0xfffffffffffffffe, 0x2f, 0xa50, 0xffff, 0xffff, 0x5, 0x7, 0x100000006, 0xfe, 0x0, 0x5, 0x100, 0x40000000001, 0xffffffffffffffff, 0x9], 0x1, 0x360200}) ioctl$KVM_SET_VCPU_EVENTS(r3, 0x4400ae8f, &(0x7f0000000140)=@arm64={0x6, 0x14, 0x0, '\x00', 0x8001}) (async) ioctl$KVM_SET_VCPU_EVENTS(r3, 0x4400ae8f, &(0x7f0000000140)=@arm64={0x6, 0x14, 0x0, '\x00', 0x8001}) ioctl$KVM_RUN(r3, 0xae80, 0x0) ioctl$KVM_SET_MSRS(r3, 0x4008ae89, &(0x7f0000000280)={0x1, 0x0, [{0x40000070, 0x0, 0x6}]}) (async) ioctl$KVM_SET_MSRS(r3, 0x4008ae89, &(0x7f0000000280)={0x1, 0x0, [{0x40000070, 0x0, 0x6}]}) r4 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r4, &(0x7f00000000c0)={0x0, 0xfb, &(0x7f0000000180)={&(0x7f0000000100)=ANY=[@ANYBLOB="140000001000010000000000000000000500000a28000000000a030000000000000000000a00000708000240000000020900010073797a31000000002c000000030a010100000000000000000a0000070900010073797a31000000000900030073797a320000000014000000110001"], 0x7c}}, 0x0) sendmsg$NFT_BATCH(r4, &(0x7f0000009b40)={0x0, 0x0, &(0x7f0000009b00)={&(0x7f0000000240)=ANY=[@ANYRES32=r2], 0x78}, 0x1, 0x0, 0x0, 0x4000850}, 0x40) statx(0xffffffffffffffff, &(0x7f0000000340)='./file0\x00', 0x0, 0x1, &(0x7f0000000a40)) getsockopt$inet_pktinfo(0xffffffffffffffff, 0x0, 0x8, &(0x7f0000000800)={0x0, @empty, @empty}, &(0x7f0000000840)=0xc) sendmsg$nl_route(0xffffffffffffffff, &(0x7f0000000580)={&(0x7f0000000200)={0x10, 0x0, 0x0, 0x80}, 0xc, &(0x7f0000000540)={&(0x7f00000003c0)=ANY=[@ANYBLOB="540000001800000825bd7000fedbdf251d01040005000d00385760a42524b79567f30684c30e0000000000090020be9b33e6de9ebb36863e23c5fba33ca3172ed89b721fd6df0f5f8ac205c253f489fd7c5b24cb01e9e7e248ee6554b84778c43f4897", @ANYRES32=r5, @ANYBLOB='\x00\x00\n\x00', @ANYRES32=r5, @ANYBLOB="150003000300004005020000ba00dd7d20bc400105000000"], 0x54}, 0x1, 0x0, 0x0, 0x80}, 0x4000094) sendmsg$NFT_BATCH(r4, &(0x7f0000009b40)={0x0, 0x0, &(0x7f0000009b00)={&(0x7f00000002c0)=ANY=[@ANYBLOB="140000001000010000000000000000000500000a400000000c0a011e00000000000000000a0000060900020073797a31000000000900010073797a310000000014000380100000800c0001800600010058c6000014000000110001"], 0x68}, 0x1, 0x0, 0x0, 0x4000850}, 0x40) r6 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$ETHTOOL_MSG_LINKINFO_GET(0xffffffffffffffff, &(0x7f0000000380)={0x0, 0x0, &(0x7f0000000340)={&(0x7f00000002c0)=ANY=[@ANYBLOB=',\x00\x00\x00', @ANYRES16=0x0, @ANYBLOB="010000000000000000"], 0x2c}, 0x1, 0x0, 0x0, 0x4000}, 0x0) sendmsg$ETHTOOL_MSG_RINGS_SET(0xffffffffffffffff, &(0x7f00000008c0)={&(0x7f0000000040)={0x10, 0x0, 0x0, 0x800000}, 0xc, &(0x7f0000000880)={&(0x7f0000000900)=ANY=[@ANYBLOB="1c000000", @ANYRES16=0x0, @ANYBLOB="00c8377f0227bd7000fc02000000000000000007000400000019a41a803bbcd8508735f59bde2d0e50e711d3e426dbe305169b3520ce3d70d54a51eb1d693912acf00daf76383a9aa3100276759649f321b46aff6cb78208404ec102c3e7068a8be07754d48dd205b266e8d5c7ec5a05009d9f3d390371d94205b7cf3c85860fafa748d0bdca0785be19f867fa268db7e9b88f18dbaf05eafed4bce34981b6b1c0a4694a906e377eb5074f89071605280ea32c0693b98789c3575996e6fe46906e00872118dc5d7b04160f48acfadb5cd8cd69d748d966c6e4e25145cf9451481c025bb46bb702acbff53eff01edfb45910c66d2909cce892f77f378db6f164d75c40fda5c4207"], 0x1c}, 0x1, 0x0, 0x0, 0x40000}, 0x44) (async) sendmsg$ETHTOOL_MSG_RINGS_SET(0xffffffffffffffff, &(0x7f00000008c0)={&(0x7f0000000040)={0x10, 0x0, 0x0, 0x800000}, 0xc, &(0x7f0000000880)={&(0x7f0000000900)=ANY=[@ANYBLOB="1c000000", @ANYRES16=0x0, @ANYBLOB="00c8377f0227bd7000fc02000000000000000007000400000019a41a803bbcd8508735f59bde2d0e50e711d3e426dbe305169b3520ce3d70d54a51eb1d693912acf00daf76383a9aa3100276759649f321b46aff6cb78208404ec102c3e7068a8be07754d48dd205b266e8d5c7ec5a05009d9f3d390371d94205b7cf3c85860fafa748d0bdca0785be19f867fa268db7e9b88f18dbaf05eafed4bce34981b6b1c0a4694a906e377eb5074f89071605280ea32c0693b98789c3575996e6fe46906e00872118dc5d7b04160f48acfadb5cd8cd69d748d966c6e4e25145cf9451481c025bb46bb702acbff53eff01edfb45910c66d2909cce892f77f378db6f164d75c40fda5c4207"], 0x1c}, 0x1, 0x0, 0x0, 0x40000}, 0x44) sendmsg$nl_xfrm(r4, &(0x7f0000000180)={0x0, 0x0, &(0x7f00000001c0)={&(0x7f0000000000)=ANY=[@ANYBLOB="140000002569000000"], 0x14}}, 0x0) sendmsg$nl_xfrm(r6, &(0x7f0000000180)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000000)=ANY=[@ANYBLOB="b800000015"], 0xb8}}, 0x0) ioctl$KVM_GET_MP_STATE(r3, 0x8004ae98, &(0x7f0000000640)) syz_open_dev$dri(&(0x7f00000005c0), 0x2, 0x94a00) (async) r7 = syz_open_dev$dri(&(0x7f00000005c0), 0x2, 0x94a00) ioctl$DRM_IOCTL_SET_CLIENT_CAP(r7, 0x4010640d, &(0x7f0000000600)={0x14}) sendmsg$NFT_BATCH(r0, &(0x7f0000009b40)={0x0, 0x0, &(0x7f0000000500)={&(0x7f00000002c0)=ANY=[], 0x68}, 0x1, 0x0, 0x0, 0x4000850}, 0x40) r8 = open(&(0x7f0000000680)='./file0\x00', 0x612102, 0x180) syz_genetlink_get_family_id$tipc(&(0x7f0000000700), 0xffffffffffffffff) (async) r9 = syz_genetlink_get_family_id$tipc(&(0x7f0000000700), 0xffffffffffffffff) sendmsg$TIPC_CMD_GET_REMOTE_MNG(r8, &(0x7f00000007c0)={&(0x7f00000006c0)={0x10, 0x0, 0x0, 0x10000}, 0xc, &(0x7f0000000780)={&(0x7f0000000740)={0x1c, r9, 0x4, 0x70bd2a, 0x25dfdbfc, {}, ["", "", "", ""]}, 0x1c}, 0x1, 0x0, 0x0, 0x40000}, 0x10004000) executing program 9: r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000080), 0x60280, 0x0) r1 = socket$inet_sctp(0x2, 0x5, 0x84) setsockopt$inet_sctp_SCTP_DEFAULT_SEND_PARAM(r1, 0x84, 0xa, &(0x7f0000000a80)={0x2, 0x7, 0x6, 0x2005fe7, 0x5, 0x904, 0x0, 0x34}, 0x20) r2 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) ioctl$AUTOFS_DEV_IOCTL_VERSION(0xffffffffffffffff, 0xc0189371, &(0x7f00000000c0)={{0x1, 0x1, 0x18, r2}, './file0aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa\x00'}) r4 = ioctl$KVM_CREATE_VCPU(r3, 0xae41, 0x2) r5 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0xc) ioctl$KVM_CAP_XEN_HVM(r5, 0x4068aea3, &(0x7f0000000380)={0x26, 0x0, 0xa}) r6 = syz_open_dev$usbmon(&(0x7f0000000900), 0x7, 0x0) bpf$MAP_CREATE(0x0, &(0x7f0000000200)=ANY=[@ANYBLOB="12000000040000000400000012"], 0x48) r7 = socket$nl_generic(0x10, 0x3, 0x10) r8 = syz_genetlink_get_family_id$mptcp(&(0x7f0000000300), 0xffffffffffffffff) sendmsg$MPTCP_PM_CMD_GET_ADDR(r7, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000c40)={&(0x7f0000000340)={0x1c, r8, 0xffffffffffffffff, 0x70bd2a, 0x25dfdbf8, {}, [@MPTCP_PM_ATTR_TOKEN={0x8, 0x4, 0x8000}]}, 0x1c}, 0x1, 0x0, 0x0, 0x4004c}, 0x20000000) r9 = bpf$PROG_LOAD_XDP(0x5, &(0x7f00000004c0)={0xe, 0x4, &(0x7f0000000080)=ANY=[@ANYBLOB="18020000801000000000000004000000850000002700000095"], &(0x7f0000000000)='syzkaller\x00'}, 0x94) bpf$BPF_PROG_DETACH(0x8, &(0x7f0000000480)=ANY=[@ANYRESHEX=r5, @ANYRES32=r9, @ANYBLOB="05"], 0x10) close_range(r6, r9, 0x0) writev(0xffffffffffffffff, &(0x7f0000000300)=[{&(0x7f00000001c0)="390000001300034700bb5be1c3e4feff06000000010000004500000025000000190004000400ad000d0000000000000604", 0x31}], 0x1) mknod(&(0x7f0000000580)='./file0aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa\x00', 0x8000, 0x7) r10 = timerfd_create(0x0, 0x80000) timerfd_settime(r10, 0x3, &(0x7f00000000c0)={{0x0, 0x3938700}, {0x0, 0x3938700}}, 0x0) timerfd_settime(r10, 0x1, &(0x7f0000000000)={{0x0, 0x3938700}}, 0x0) r11 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$kcm(r3, &(0x7f0000000440)={0x0, 0x0, &(0x7f0000000400)=[{&(0x7f00000001c0)="27030200dc0f14000e000f000713c1020000ff8407c2fb7fe0406e52534b4f6b3d327db412f40000000003", 0x2b}], 0x1}, 0x4005) sendmsg$nl_generic(r11, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000180)={&(0x7f00000001c0)=ANY=[@ANYBLOB="30000000410007012bbd700000000000047c00000400c2800c0001800600060086dd00000c00078008"], 0x30}, 0x1, 0x0, 0x0, 0x4048011}, 0xc000) ioctl$CEC_G_MODE(r3, 0x80046108, &(0x7f0000000040)) ioctl$KVM_SET_MSRS(r4, 0x4008ae89, &(0x7f0000000000)={0x1, 0x0, [{0xc0010015, 0x0, 0x200000000}]}) executing program 9: r0 = socket$inet(0x2, 0x3, 0x2) setsockopt$inet_mreqsrc(r0, 0x0, 0x27, 0x0, 0x0) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f0000000600)={0xffffffffffffffff, 0x5, 0x0, 0x0, 0x0, 0x0, 0xd01, 0x2000, 0x0, 0x0, 0x0, 0x0, 0x2}, 0x50) r1 = socket$can_bcm(0x1d, 0x2, 0x2) ioctl$ifreq_SIOCGIFINDEX_vcan(r1, 0x8933, &(0x7f0000000100)={'vcan0\x00', 0x0}) connect$can_bcm(r1, &(0x7f00000000c0)={0x1d, r2}, 0x10) ioctl$sock_bt_bnep_BNEPCONNADD(0xffffffffffffffff, 0x400442c8, &(0x7f0000000000)={r1, 0xffffffff, 0x2, "dba6ba2e2c1bb808ed5b90ca33db01f8886fbe5e585f2fe7dd3d4b44cc6ae420"}) sendmsg$can_bcm(r1, &(0x7f0000000440)={0x0, 0x0, &(0x7f0000000340)={&(0x7f0000000140)={0x1, 0x804, 0x0, {}, {}, {}, 0x1, @canfd={{0x2, 0x0, 0x0, 0x1}, 0x1d, 0x3, 0x0, 0x0, "f9537550367ffdd81f44ca7ad063335957189016d2bd7dc3f3d4eb21a9ea521f2d8dc0cc8014fa44e0da9de07392cdeebc2e9650f6eb00484047d3d9f4dcc3d5"}}, 0x80}}, 0x4008004) sendmsg$can_bcm(r1, &(0x7f0000000380)={0x0, 0x0, &(0x7f0000000300)={&(0x7f0000000640)=ANY=[], 0x48}, 0x1, 0x0, 0x0, 0x2000a041}, 0x800) executing program 9: mknodat(0xffffffffffffff9c, &(0x7f0000000040)='./file0\x00', 0x2, 0x4) openat$fuse(0xffffffffffffff9c, &(0x7f0000002080), 0x42, 0x0) openat(0xffffffffffffff9c, &(0x7f0000000480)='./file0\x00', 0x26d01, 0x0) prctl$PR_SET_MM_MAP(0x23, 0xe, &(0x7f0000000080)={&(0x7f0000ff0000/0x1000)=nil, &(0x7f0000ffd000/0x3000)=nil, &(0x7f0000ffc000/0x4000)=nil, &(0x7f0000ffc000/0x4000)=nil, &(0x7f0000ff8000/0x4000)=nil, &(0x7f0000ffc000/0x4000)=nil, &(0x7f0000ffb000/0x3000)=nil, &(0x7f0000ffb000/0x3000)=nil, &(0x7f0000ffc000/0x3000)=nil, &(0x7f0000ffa000/0x1000)=nil, &(0x7f0000ffa000/0x2000)=nil, 0x0}, 0x68) sendmsg$NFT_BATCH(0xffffffffffffffff, &(0x7f0000000080)={0x0, 0x0, 0x0}, 0x0) r0 = io_uring_setup(0xfd2, &(0x7f0000000040)={0x0, 0x36e, 0xc000, 0x2, 0xa0002f5}) bpf$PROG_LOAD(0x5, &(0x7f0000000000)={0x12, 0x0, 0x0, &(0x7f0000000240)='syzkaller\x00', 0x80000000, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback=0x21, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$MAP_CREATE(0x0, &(0x7f0000000000)=ANY=[@ANYBLOB="1700000004"], 0x50) io_uring_enter(r0, 0x2219, 0x7721, 0x16, 0x0, 0x0) r1 = socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$inet_tcp_int(r1, 0x6, 0x210000000013, &(0x7f00000000c0)=0x100000001, 0x4) connect$inet(r1, &(0x7f0000000180)={0x2, 0x4e22, @remote}, 0x10) setsockopt$inet_tcp_TCP_CONGESTION(r1, 0x6, 0xd, &(0x7f0000000140)='cdg', 0x3) close(0x3) connect$inet(r1, &(0x7f0000000100)={0x2, 0x4e22, @remote}, 0x10) executing program 9: ioctl$DRM_IOCTL_MODE_CREATE_DUMB(0xffffffffffffffff, 0xc02064b2, &(0x7f0000000100)={0x19f, 0x10, 0x4, 0x0, 0x0}) mkdirat(0xffffffffffffff9c, &(0x7f0000000100)='./file0\x00', 0x1c1) r1 = openat$fuse(0xffffffffffffff9c, &(0x7f0000002080), 0x2, 0x0) mount$fuse(0x0, &(0x7f00000020c0)='./file0\x00', &(0x7f0000002100), 0x80, &(0x7f00000002c0)={{'fd', 0x3d, r1}, 0x2c, {'rootmode', 0x3d, 0x4000}}) read$FUSE(r1, &(0x7f00000021c0)={0x2020, 0x0, 0x0}, 0x2020) write$FUSE_INIT(r1, &(0x7f0000000080)={0x50, 0x0, r2, {0x7, 0x29, 0x9, 0xffffffff90adedc4, 0x3, 0x3, 0x0, 0x4, 0x0, 0x0, 0x10}}, 0x50) r3 = openat$dir(0xffffffffffffff9c, &(0x7f0000004280)='./file0\x00', 0x0, 0x18) syz_fuse_handle_req(r1, &(0x7f00000042c0)="000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000001e000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000002000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000100", 0x2000, &(0x7f00000062c0)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f0000006380)={0x20, 0x0, 0x0, {0x0, 0x1c}}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) syz_fuse_handle_req(r1, &(0x7f00000083c0)="c91443d5daaf04b192358b692f84d66c60492a57cffd585b0068ccde45d94ded1e86d3670791c21f8e0b2153d10d45d37b72ee2fa06ad61b0a9354045a8dae1bd1cfb49f3c11fe54c17eee632d95574681e6c472eb8a1beaf3a4b88561847a0a0f05fa4a26639d7e74a0c1c2790d6a59d4073b1c55539b35c56642f4be57d170e36a6bf3a995f418554f0cab342769089d0777b28daad5c0c4ba56a0bd6c0515d9bf488fdcf49a9a7bbfcf5ad78733f8119f56000000bd0985a9916c0d048e38765cc7bb1c82e0f3c81d98e7179ec782331bc3cfb2caf58a99668420795e6a00ef41dcf5283bbb61ebaedbb7a675be4fb2d11c31f9b76936d1112c68978c73f42e145b094490d748c1456a14c23fe25e2fdaeaaa7dc0d35dcc9bbfe86361f99f4d04090d1e66aa9714ee9f4608ad66c60f500bf06a1b5b90fbe2f6c42c4b5f337393b0bb201473712c48f898c514fff84c46b50d3aaf44578f41d312bb5a73526db7818617dcb938ebdb17f92423ca2cf7ea2c611483e0baff012fd97e28558317049e4fe2d27f72796d7260b33900cd61f984c087d3c54f6aa11e389a49069ef99ca86c279598b42dd3485f09fc7e119f707438498316cf2f2bc8a293eeb1a35635989327d4f6c9ba6b2d5b9b8ee89a1e13d538b954479663223b6a12404763ee497734410ea43bfdb008cb7155df2432c44e8468a7b77b807d345c9b94fedadfdeba12f4b6d11d16fd6dd5fff6cf896d0f40785ffca538dae61d8a5ffee814e96628cd945553e788b8d915762ca3b40124149b3c186ddd5f7af5b75f4725444f2f7e54b999c93e8c5fd4d4fbd7a3b3d7e85df3053c866f1dd247cac6912ed8b0e491101ca5a0b999a21014b573ba3996c76065c9d8bebf431f8be6435837193efd6e5a565b2ced30d04355435f166b09f9dc91ee50412d0daf72b28ec14c505cb155de1a46362f140ac2b633fa42b12109f0a29fa8ba271d6fc2a77af3b16032ee46b3ddead76a481ef52f6bd2ffcc058a067fcdae6c9de670cd6fde6eb8086a65fc05df17cf69f654516ba30ee04a1427b40fb8e81fe46787d557046854ad342442bacd781c7a6063892402fb0d765397448991206b28193e20f285e50d9219ace39b311e572ebcd80702164315656e7fa92960d0fd28c6489406f0b3061218417548e7e78b8aaaf5a623eb47c92aebfebd1c78343bc781f184e0122a28f56b18832da5646ee8405fa2fc040ab30377c447b42d0bfdddc65e064ccdf1ad52a94309a819caeb523e22b25d1ba288b7f2c726290d50021b9839c5d3c471aadb08025d97619935a9880942cf653508a0b2c43838e5aada8b84d22042928dd372dedec14672266ddceb0744c7464ab282d7fbfb2767e891832aa25d1425b33a60c6894a8d5292fdd73e05a868b8e50cb1a412d1249a77ccfc3d3eb35a67221f80bb8960fd93ceb74e102f2a6946b50caae3ccb86a8ec441d6e58dbf24b3eb962c8a28cffeded9b7cf4a54f524a1ef49fbdc91e125aad65a54df6a0f10cd8799f48aa144f7aec977b4a347c5c9628c4805ecf71f305adc9e5ca7c1f313f9ea3e99b3590efd94d831e1ff5cd7a26b72281109547f2cfa3abac2cfc9177b117a3757b778e95b5069236abb25d8fb032c38d296f87388fdd364b491cb828732177a2c6bcaaf831d138c898bb60c0d9d8a02d8b4b8e7efa87d3ed66221ac52e31ba9c2da488b999eaf82994bc8f1ac29d5e60b8b1cdc30a1c9829aca1cd7881c8aaac9ede0f5d8b85538d2b13751cfc6b37587b0223b9f6b6dd9340753106b1eecdf4f63c51cc2c63a1f86235bad7602e115d1e0ed78a6b170b88eb9584d2098b187695627612189998171d245797391b2b79bb690a79dac4b769e3f18c4d49359f7b460d997c03c793f51a830d5b21faed2ae1c3eb0fce0cdadde3c789ec931b6397c2a2fb2eda87756fec031e5f50f07619130f8e39f1e00004a1f204e5d87780542bdedf0b1ca5168779ad7cb2ebf27e0a5d760a2492b4d92eab24f2bc9af0a3e51140c415a6f885d0faa38ee6dcffc41652b28e628b859db0e7a0f961e37c5806df137e68c5316667f36051eb05c971e208721fdb8a49b8c49f85114be9dd7288f4e95c5f6fb8c1bc1bc7d79f32ba5419d90130a0328ba70d10c770a1540718f7d890dba9c39a116623d492275a1268c91149bfe026ca1c6a458449d4004d653f4b0a234eacd1f4da495fd1f936b4b335f64514fc8091b1dab132f599e26cb127e25011efa30a922b5a3e8807db9a00a9cc732fd323708767c905c8a3cd53e2e8d377d3b43cb971cbd0e66e2e47f3d601d49e29941b2ea4d3c8b7f5698e1a633ebba00f6c178d6d04b9f1544f04cd173e2d49f129a8725a647e1a9e798b5581c6a461b585012a302353178188e55f8102a49343c9c370ee505d09e4be8580d95f5bf39267b00e93adb6b52b2029160d78ac271e4e0c70ed835484e80302b93efd599707d4d22c806476fd04d18ebd6a9bf88c11dc2c96041ac8c3e04ac0aa5d2ac6740972717b543fb871884a7a0434a433571fd621977777984ea9c06914be966da9f349cb1ef3a116c49f0c716eae1df118cd3d5b350b917c06d853c1e1514213f5a29071e42eecee264ff20529c53c3a060a18a680ade2a08b4549e6998f06e61e4f4c36d578e9ad83dd38d1eeb100e7ab023edb38426d5165b867b9507a6b644aa0322da335b208105f2e74a9841ea7c629ea20cef740f6364e9d84a4485d3bb6b5f4e14c7764f78b65c0647870638a8f618381ec0823faed0424a448f753a59fb22e5138e0ca537b6935befb99fc6eea2d9457c01345afbbaaf3a7a96a39478b222af322f86730d137c3f570b38c7363bb9a89bb4b3b8979b9afd232927becbc91c8d4a276febe47bacd4a84c0bfdd54e685080f2c3be0b1e37bc6d21b13b7b1bfd507880f6ad7fa39bf99eaf6b7088d758d9383e38326381088e9e3e792f75d682cf61cf1176953960b0e160b2a535495d52c28f14fa45ed7a3f91e219dcd05afdda2b7e6c1b742b29f6c5f62a040a5fe6606433fce7de757ed76372dfc0b1af9af10c0128bcd335eff1c6c9660b0893730c3ef8de6e50dba419b35d1766eb9a5dce4c2fa518f8e3e2a27855e04d06b89e97578a4406ac03f3314575143db5e43ae3d03a7e90a590b4c188a5acbe1cf23cd4cf60ca98248d4e740122a55ac6e463511b4c4cd47040aafc0bed7878348a4caad4d977671cf4ac319773767ee28f8ccc4c9deae531b029eff5345470f20865549b2f2c4089306304e13e42ca37fbca6839bbcd2f10bd20c81d44ab73ad5ffcc55f51b53efb00d3c68d8d8505e005247ba23e86a803b199f36447fd01f192994b2fa27c9db59ae66b56b30c1ae5cd717407068a9b13ca941b86db254f4ecdbd1751a3f8f1061031bb41af5c04a33ffc98509f456830cf3c94c14451f04d84844e41c618e82958710d07daeba666329b914f2cc7c1d34ffbf6b50620b7c78c25c5d82a5aadcc4d824b3b68c34231fa7c0befe5241c447f90111c55848feed9d1ee67f61095ec2c0b4ac82f5cf169201516082a804c9d1775990d430d21bc65877041905caf385918f44191c134e493d960724b28f01e79fbf3b99eac1e75fbc8ab8dcfdd98b573fa6d7e6a6ead6b15ed78e2a8d564f61d8c52be8104306c104146696e16c9e9bff79a5fc1d92326cf0f2ff5e5c5c252773f2bd2c554bc409aaec03055f71d439daebc1d8b06c9ca0e1fe4729e8e6119616e8fb861b1e2694d1df267cbc496ba4a87013c3317a16b4c1e369748507794a20ad06aad20e4dbfc1834d789d2a8e9395ddad33a74c6c7cf54e61e533cae228909536eba8020f0c3845d2063270cae4d8e8dd8cfe3f112c46751444546ced9f6434741656dcda2185be13eebcc0392c256f384fc16353e89cbdeef8fb2e3cadc1ed2142f3b6485dc2d540fe799d027413128f624aaf8bc1933d3a0e6a954931bfc914921dec7ec822a31ebb652d4f312ab4068cedc6203b0de98e60c5f82296abdd8ac40faf145928e7563dbcb14d0625c92b542860993bb0388d8390dae727ae4086d4de1b7fea9d79f4844374bcd67fa5e1a3a28cd6d8da3f171fcf9d13062bb149fde18917c6650cdfa2be8de33b556ad34fad454db13a446e8a7c40167117e884d874c786768975df0b201ea0077ba735d31d65a832dc122d13c6559601b83899af1f14808f55f077ad465ed61378c63abff3ad742691168fe1e31bfd0dbb9f43d364ddf0bb185f69e69110c9eb1ab808354fdd2cf571838d5ec63bac3d70ca40878dc3c3cea26adffd5a197206d7c80d6a86c202338e72f17dc7185e1df0cfefa9475a2156738f90c6410c1698d1a160fd396548323c796ec5dca3cd59e468ff6a14caf34b4fdb16f1c92acb6bff2e859f9de1266dea0d1828598319b40a3edef657be02188fc94490c1da088d3ec2f315d6b5bb2f262764b67ba321379f4c93bb3ef9bc7db0c0e5f1e680ebfa84463e904d5351ecf25d1d22a98f81f7a1fc4c4fee3934b7672661f0bcd94109706644d0fdac4b7933b5db2acf39b98c0a8106a7a757408404a4c299a077379458e2118fb0a53b798adc1b85d3eb20b539e572741b9855e44a545809f897dde06730145b5caefe9db1c321783450d25d38834532c3e372fa92a53ac9cb4330eaaf65fe1b69a66459058e02d20c6641b7d8edfa8e356baaeb011b61208ef36ed33235144c86d6ce65da89d66da06291d4acc05e3136559ab77a7c4ad229c5307b48ed642d96c28cd06c82dedd4a16ed90bceda81292120438fd5c47b7b41b2646fe0899643f896ddb2d11e7311f8a0cbb9bfa38106507e06f35b3052ad6b6a11ac5f0129bedc59d04aee3737ebbf10f97c80f1a4e3f51ac8ac4488ad9e3f685a7c0dd4074b07774f4efe4b9f2cba400ef49f73b12fc7d96d8f3283a1eaf8c003931fc24a9248e201ac31bb49226c37d535592e00308d86ba0765a7eda13b72686101d352fb959598038b8dec44a0f18e5c8ec089912d325880390ce5186d4585df46e5662987c164f0ccfb8f12f6144f91349051d3ffa35ba597d2b5920e279ca8e139dfe2ba9923c0190fd444c8bf12a627618791a8781d6b54470777e6a5dac8cb505ae1e534b0c3af7db010dd602b1459964e1e15a812f3b4c8038e6bc1dc568ba482ee4944582abeeda1ed012391706ddb1e0ce60efd15acde8283d3612de5d0cf76185ad3a1ce89488e1cea4009573b55a2766d100ecefc5d53c99876cfec65daea82f55cf9687ec70e45cfdba9fe69fc3a822c29ff4be34857bdcd4313fb23d1d01d8a79cbd0057eeb5c1c0b39f75d5a753a2e10bd0ebb91dab1312bdf1a984332d566ab56dfd838d285995bec8726c5d1358fe10b0b6aaa99b9d9b08894c1dbd06356e5c693ddebb9d8b3060633efb160db9d8f02ae3df59697866f5adeb34c8c5b27b63b09675030f344197b3bff097b996819dec9059aaf5ec1a6c585a86d16528091543a9e6bca4d850b7963fd1e7d981814dedb165c1a6444ec0a21743a4de8845b386ad4e1e9c9f2873f6a353487c05693cf6ae1d0f69124ee56b5c2b2a48c78cc6ba6b313b889adf0acfaebb4e2dc71054a4992366a2b6ff1f5972d7d2f0e9e3b17d7fbe931f43871819dc6e6040ba239ebce2cfa424ff7344b8a880040321909dcd16956594f5d99fdd39ea5d7209b906d2601572c56c72db899f986185194fe5aab45f27d9ac12aa8600b3c2728ef2e589a6886d711edf4d7f95b2e10d9adde3009560ad754f9e7a52808720a973dc475f8177fd5b199b69925f03a44a8bd9fcb3369861802ce5ca4b40cb47d19e2e1bda1b054f16b66ac7b7c0e5205112e011d6957f1df50505003544631ff4385d8128d46838338930aebc0496348045a7c05abd7a56e1079947d3eb1c50e4d8be001d03d8973f8f08f2f21a415174173ccb90f7ab615be5036947e164a434c059637bfeebb8b9f2e87b9774a4595c71122c9fac74347488b9a054e2e7b9c45b7b12fcca0fe789db614c70d4149d44e50fb64aabccee7447288a5b865a60c2640171f89afecda2cb18b7ecea214bd32f43d5ff66e90741697d085f3ee9bfd8662a3cc570999bb151090160d3bf5bf1d85e896d66276cba7ed97f341f595b13c02ac2a1352aec7a5980de2c8f9d890951108947b7602dcf2bdd2aef680667572b87aadf7c54338492eae763df73e89e3c438c196da83d98bc65233a242e08894f2390d8714f0abb801d9e5c42f169555284b6cf079005b373e9938db71a93ee5945c2a43a06e3df580d372318b3d203503c6e968206d7db8116cca2f2a1fae7f5b5195bea92914d66516bc3ceb2d9dc4de59d0d52ab80910aba7ebb696c7deaddcf0fedf56e2a88c3496bb79897c6420a0ef1b03ad89c76b24f67ffd41c9227d464565457bb25f0b32c83e676b0a3284f2acbed39c6875871c5e866a8284f12e383f87f12dd9bbe3078c68b3711eaa9bc17a7ac8413a8ef486922eddf43f01625671b7c3d0a4c6c2dc38217b4135c8cb46df7d936aabfd253e95e0816dd1f92b257e2f96d2a259a320756ba77d99b709711326f2ea42def974d60f817a1f6779121dd32a1cb194c7809e4c8fd052ba357323436491ec45a49fa601ed373aadd2199e4483704fb2f4edd7bf2815b552fb84d09094cab9700b5125887ee508570217c16799bc11d9e3658de8d9812f30dc8078bbecaf887a6527686b026eea70229df1e61759adf19c1b96673419decb382ae29bd685c5f32120b2d56d3e97c9ef00a2c0598c2181b8fa53172312590a9549ff55dffb9070b042c74654b2ae56371b2a6bac8e2808a40fd5d6d0af184c035101394e347521467e0ddb962e0d63614cf1461ac7b9d744084e9f6f26c88d515dbb1b7392b8e9384b81f186224d5c09e266682d8044d8afb1bd6483962b03ed6884759d2647b8f174a6695a437a1f1aac3e6a2f8ca658ee8a8ae44a77393cec61a9f335a1e859825e73df4125828fbde19d3695125992ddb2826ffbc6c7cfbfdbae19ba864c4170c79cce408e8b280a7632c855d802029ebac8627fbd6fec1c3bd858411c969ca035992f2ab909c423158dff0c2d9b180440996e09e10100b4e42f365371d9dd58c4609455253c44c2ba73f592e360ab5fcccdb6e90ae0c60ada9325c4824242c0d866e7dfbefe091067d5c7ff0432814f733591eb0096659738b34cfa8c6c988ec628f34fe08f31dc0156dc39866412932d045168f4f3a48f24fb3b884be1384845d496c3009626f1c41b0189e95c9055d24eb5a0390596f6ccf50d3727e607875a3b2cf076a277e12ac07ddc59da78ee16e1952706ac6a1a9ade80b867d889789c935d196cc4da67aa35ba80ef2077ee4dd69c5f31a0410f7fd0739303ddcdbff2f53e0a44ec5de0f062e533444bd946959a1d9c25b297b6fc7675ca4add9e24e8ff390e0375f3b15e1d3e8129007d743e384659f191bd23ffe02140fa64d5c6d75937b28d51afcaa9d207f57c878f2f54493025e9eff5b5ce0c997d11c9690262e38e1e83c7f1a0ed3f200d9d0472739d59dea3cc6e8783758e3e3201731cf27211267702594356345449b42fa64b64c6f00a8f26665524fe2208b1a7c5fbdc822ea611c1811526471e4f52ab5e3a43de8fd4eba2fb2796a206e348de9b0be78ded78204dc82d9e9adccbe408d7ff538aab3d663eab189927a9cd597388e8dc5063d2db42cd65415fa32d20288da017c9f94e788dfe7cc3a0f6b6ab06116ed3f72f3c048cb1e51abf308ed7169908d1ad5b7ab3a86a3316d164084f8d88c6f96142d888ccb158efa586015914c116db114aa82c44a55d4c33bd901dc34e820d3120d57def03ea4f01b263913cc02ca586b208506d149ef03a706fd5360a12b83acb7bf97ac1f1f85389d4fbfdcf38551e9dbce760a05e8e4023d85038570d3697b3e7de73aac9c7feb39b6ccd1a775c8ce01b08d7190e28866aa7bb8d0cff0fc45b452fcb6a290f98f4b5ec125224c8a93918b1f2888befba6de3d294ee1f13a9c56e92eaac0b8e6c6905e77a60ea7e1d1ed979b6b2606652e7d75750a065c57c7efb1ef5708719ef04e354bd861b15e0a1cbc7cfe65c8a3d9a2b790260d6e6eb60bd4e0fb3f040dfa27fa00797664122add0750a23a8b20fcd68b6be1e21620dda4bf0561f4c5ed7e441612a0676dcdbf669df3436cbf2ce253e69319e3ab36e6e6314f11e0d0882ee3d7f3d3b3dcfe3cd7f061e301369207545676e09801f9bc4bc4c3dcaf48e5320a4b3211051a7525868a0ac1278ed6fc9531ed89cf4205458acc05d5351bcab7ea50250b6cb4c6fdd0cd96f30cdc9a820f495d0a3e14eb6c493a85a87e3b7fb8e5f23431c3c5359f5802f1fc11ff71c3172c6b57b5587ab38579b79e328792edb7a81d60762bc6c88693a00712f811cab9b075a97535c904396dbd2fa0994ba9c9b06fe9c042cb6860d22844b94863bf7b68a1ab8639e4487b38d48e40da4a98dedd7d73ca4b575bf4c604a364a9247c2ea5e3b127ff42f9bce1d3d37c2428edab1708ebd71ac0e4a408a9c6eb97407a4a8b5e912e2c63fadd1abad9a772a96fc4666f7d2b604adbde6f1136de2adfe38994491ab0f34ff1fd20cb8034ad39aae4c5c0076da2e7a157764b770e1c5f35b6f323ce809b2e92be1345204021d74712368e0ef77056afd85f065bba085793c9b6950d3c3fc6c445afbdd5a80cf7b0bb13055fd486700be1500bdf8771e286a63962e56d4771ed5eefbf111ba7380f02d6f96eed174246820b73bd772689c072bb3d8e43ef96f5466dce5c9392e34b7176821d2f4df3dab4c6ef5e0238ffe61582812fdacc987fbb6d98cad5a2d7af0e4c8dd3f800cd75c38a515d4d4c7118c5f81c6f7504e7ae452370c56c4b7fb4daa65bf26919c12081485d09e9d142965320211f483ed2a0a6836fa248aa878eaf9653b0528c3680b75a1920a25b5c5c17548c7ceb9a1656a0cf6a404aec14f7ed8a1dcf8ed32e1cf94dc2f60b65aa102650b7a22d9e708c606ce8403ceb81434bd9938b2c4e5a8530a156a1df7d143b2da54071ba3e673ce11760f72c32273b7bcd9a48da2a6caeb4b782cf1c3a044c1731f3ad61ce32bbd0b52cbb187cb3ecc1e85a67ffe27cf86769a0d69fe293dd30f060b8a0f26ccd0287d0b8d941ee7410a7c6aa430add67c2dd60db292e24f294ce80b0321aaa4d054a6f5d9981e1d5e859b454f5005be082bd59baca5775eedb7994333c62c452ef7b2893e4d03a28c0e368928b4bdd6e31f52a83cd7e162975405fd128321e0a8e3e77fd93257b0c46b309e16203974382ced818faac3a02e74141e9ea36c4a1b98bd859fafce43b2984d856c832f61b1ca562cee96f5843adc14b35bec1ccdafedd214f1a344345373f3c9eccee8324950a23c3e77d55dbde9a7ac1b7804927affb8b0e1488dcd8919d227bd1f50a35abf25e3f120c25b0dfb4d85b4c2a2c69cf7047c76c45e4e901e7396140496f9a322c2c2ac777a27adff5a6daf32e852b1bac89f1086739a603cf0f6838f792351c08e38ab130e5a83aa5a4f2da19df131770a308d810eed0059a2e5546a2169b9d0119f6df7c18981f4b4f119c76fdaac031ce7551f25678b5c4d8815a7ea9565e63389fca6ea0bcd40e71ac72124113dc0041ce26a0c9979ff76d7f1f2c0cd2c16d8c7a36930b909ed7e2d4adfa8352b12b99bdcbc25b485f652539fab7ac983c1ae925967c15ba2345e45d6bafe13b3e9d7acf1a592422ea09c3a45f7fe24e235bd70b106cdaa665584e74cdaf9f39b804bc6c4e7f0bf57223bacd4dfe010081b91c2d5970d4f43d2e1a0e05f84baaf50642991b3704034aed74572e6a4715b79276432d06660b39c989570fc0d5d0071a7c690658caee447370d3295db3b5dc625e697e1ca2675b5430b9969024835c7d001fbce86c5165c4fe8f2d46b883daaa3fbf42dc5cf61209379013896df740b9cc32638358ea8079a33f04197f650471086e67e5cf9779268d7973c73bbbde2f1c11e1a8e2b154aaa8b4b74f8a03f14ceb7afc4ba35e6620b7af89c969021d20cb260c1868f3fa432ce7e509db06001ae6540531b126c1e3a851acbf0a9c1354bece05c094d69d9bd87f99391e23306911383d2082997339daebd67d8a707c9b496a309b7921696f39a07864f31208802db7188881e346b41c34f4129fca9c6a13172a4dabfe791584d240fc03685057d53c08737aa1d486233318eb4545f2e8d18087705b9d3a7658564592f56aea3aee53d66c249988bf353853728553a1577062e24af533f47dc012ae90c5c085babc121be2993c063e203ab949a088041271ac0527c56edd4b7a87e98323a0137cd493aa05fe38d02754a66d89348b119e6200d5919bc366788eb67115fc57c4c1a9dd42c7411d6709ad82de8662a1849445b39beb2ba8f894860e41a054f61337179a9214b0884f3964c95ed2a4ab37de8038566bba76fbaa7502c0460558ff4bf4793ca68d78e50f384a81da4cfa23723747e906b82290e0b8ea07e3404bee0915800d4c3c07f94c43e7aafbc7a44d923de97963d0d1586bee06fc90aadbe5758fb9933ff7df346d62e082223741f5cb26ef953ca654ab983a72b30b296891c9e3f1ed5216b0e588eb25f5d4ccad6f96973cc2d26196bbd37c83266473071ccd84d9e3c74f22621e8bd60afa4bcad6c853c7591fe5d4298a954ea5006f682a7a65aeb26b230f3866a28a58bf532aca8fd5eaec64f442ac510a7df4114f00fd6ff7e02d77f8e72797222556959958c4c4d166c5af18a6e25588cac9871a3d5bb453889ff8d13db22024a997bf97a5afdf698b1deaff3101e27868d2de47b92c403ce82e15f3239d8923e8ca0c01e3781b5dd6121f57d2238dc3ff8a1bde3e371efd33838c552e43588042b360f55d7ca92f11987630364b263428e18601d7bf23f6432b3a9aa2c500cd9ac5f73cbe309443858a2806956b0cdcfc19904567bb1703641017c6199e768410e03d8ba603eb34249d567370202f39639ae8f6d52d9d5dbfc544c5b85ac8187095c63f1f613fe4af179fc5c837e6e0ccc21e62ac22ac045c4ac3b1ca6a4cbdbe29ea465240fc0aed1f0e086d7580bcf81d4e2a4d55a8e3bc57110e7cf1e1895df07974f0686dd2ea2b12bbfd64e7a9d0c62c662f0370e6ed495eeb2ee5029042147a1f2e5fcd6068b06567be893cb80e2cbb5fbb12847313811c13cf685698d5e2175959579e510279b9e959ac2c3f94fec653c6b521f8909d633ccedbc1109285ecbd52d27cd2891eaf354db2c966d1e3086718848433c12658fe7f6fbfef930b963139a63f6c4caee5a1964d3a038dd0db403c0a251d702c07a0fba4a3576ec6668a78e9e26efc6ad83a670a47708bf4207979bf196b3160c95e7ccc6406d46f529d34676b76d72396262e1448df051130a21484e0e977df1f7f0a259ac762eef9506877498b9998e1286d6294cf60b95352e81c300", 0x2000, &(0x7f0000001180)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f0000000340)={0x10, 0x0, 0x3}, 0x0, 0x0, 0x0}) getdents64(r3, 0x0, 0x20000) ioctl$DRM_IOCTL_MODE_MAP_DUMB(0xffffffffffffffff, 0xc01064b3, &(0x7f0000000140)={r0}) r4 = syz_open_dev$dri(&(0x7f0000000080), 0x1, 0x0) ioctl$DRM_IOCTL_MODE_GET_LEASE(r4, 0xc01064c8, &(0x7f0000000200)={0x2, 0x0, &(0x7f0000000040)=[0x0, 0x0]}) r6 = openat$vga_arbiter(0xffffffffffffff9c, &(0x7f0000000000), 0x1c0102, 0x0) write$vga_arbiter(r6, &(0x7f0000000280)=ANY=[@ANYBLOB='lock io'], 0xc) write$vga_arbiter(r6, &(0x7f0000000500)=ANY=[@ANYBLOB="6c6f636b20696f009a017d931e09"], 0x3c) close_range(r6, 0xffffffffffffffff, 0x0) ioctl$DRM_IOCTL_MODE_GETPROPERTY(r4, 0xc04064aa, &(0x7f00000002c0)={&(0x7f0000000240), 0x0, r5, 0x0, '\x00', 0x1, 0x42}) syz_clone(0x80842111, 0x0, 0x0, 0x0, 0x0, 0x0) pipe(&(0x7f0000000040)={0xffffffffffffffff, 0xffffffffffffffff}) io_setup(0x3ff, &(0x7f0000000500)=0x0) io_submit(r9, 0xf000, &(0x7f0000000300)=[&(0x7f0000000000)={0x0, 0x0, 0x0, 0x5, 0x0, r7, 0x0}, &(0x7f0000000080)={0x0, 0x0, 0x0, 0x1, 0x0, r8, &(0x7f00000001c0)='m', 0xfffffdfc}]) io_destroy(r9) bpf$BPF_PROG_WITH_BTFID_LOAD(0x5, &(0x7f0000000300)=@bpf_lsm={0xd, 0x0, 0x0, &(0x7f0000000000)='GPL\x00'}, 0x94) ioctl$AUTOFS_DEV_IOCTL_PROTOVER(0xffffffffffffffff, 0xc0189372, &(0x7f0000000180)={{0x1, 0x1, 0x18, 0xffffffffffffffff, {0xb}}, './file0\x00'}) mkdirat(r10, &(0x7f00000001c0)='./file0\x00', 0x42) executing program 9: mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./dbg\x00', 0x1ff) mount(0x0, &(0x7f0000000000)='./dbg\x00', &(0x7f0000000040)='debugfs\x00', 0x0, 0x0) r0 = syz_init_net_socket$nl_rdma(0x10, 0x3, 0x10) sendmsg$netlink(r0, &(0x7f00000001c0)={0x0, 0x0, &(0x7f00000000c0)=[{&(0x7f0000000240)={0x114, 0x20, 0x1, 0x3, 0x25dfdbfb, "", [@nested={0x101, 0x117, 0x0, 0x1, [@typed={0xc, 0x3, 0x0, 0x0, @u64=0xfac08}, @typed={0x14, 0x1, 0x0, 0x0, @ipv6=@empty}, @generic="50bb2d6f67d29d6fabadb107d0def49c88ea04abde1d5e8d3fb22a1b5046778bdafefc46b0449ade68bf84b36ec72dd71265fc2e882348c26c2126237dd5b37f5ae655b1086cda40e00aec58754734be31d750351dc076eb43d9621dc08c029d1608a46cf26fbe816b89f7cb81bff81a8b9482565856555ee923c65973deb0a99b962bc0fe94a3fcae3697bd7b85b3a682167c43dbf137115a40ebddcad74875ec58e9a3ddb9ad02a078cf0d972df9e99f079767734f69ce475f00ac64337803f5eb4e5842f4d98fe3fa370d47eb640dc5061dc358", @typed={0x8, 0xeb, 0x0, 0x0, @pid}]}]}, 0x114}], 0x1, 0x0, 0x0, 0x1}, 0x0) openat$selinux_member(0xffffffffffffff9c, &(0x7f00000000c0), 0x2, 0x0) ioctl$SNDRV_CTL_IOCTL_ELEM_UNLOCK(0xffffffffffffffff, 0xc1105511, &(0x7f0000000040)={0xa, 0x0, 0x3d, 0x10000, 'syz1\x00', 0x5}) syz_genetlink_get_family_id$ethtool(&(0x7f0000000180), 0xffffffffffffffff) r1 = add_key$user(&(0x7f00000001c0), &(0x7f0000000300)={'syz', 0x0}, &(0x7f0000000240)="166ec4b16abf8d77", 0x8, 0xfffffffffffffffe) r2 = add_key$user(&(0x7f00000003c0), &(0x7f0000000440), &(0x7f00000000c0), 0xc9, 0xfffffffffffffffd) keyctl$dh_compute(0x17, &(0x7f0000000140)={r1, r2, r1}, &(0x7f00000000c0)=""/83, 0xfffffffffffffe4f, 0x0) r3 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000000), 0x20042, 0x0) add_key$user(&(0x7f0000000080), 0x0, 0x0, 0x0, 0x0) r4 = ioctl$KVM_CREATE_VM(r3, 0xae01, 0x0) r5 = dup(r4) ioctl$KVM_SET_USER_MEMORY_REGION(r4, 0x4020ae46, &(0x7f0000000840)={0x1fe, 0x2, 0x2000, 0x1000, &(0x7f0000003000/0x1000)=nil}) r6 = ioctl$KVM_CREATE_VCPU(r5, 0xae41, 0x2) syz_kvm_setup_cpu$x86(0xffffffffffffffff, r6, &(0x7f0000000000/0x18000)=nil, &(0x7f0000000040)=[@text64={0x40, 0x0}], 0x1, 0x11, 0x0, 0x0) syz_kvm_setup_cpu$x86(r4, r6, &(0x7f0000000000/0x18000)=nil, &(0x7f0000000200)=[@text64={0x40, 0x0}], 0x1, 0x0, 0x0, 0x0) ioctl$KVM_RUN(r6, 0xae80, 0x0) executing program 9: mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./sys\x00', 0x1ed) (async) mount(0x0, &(0x7f0000000200)='./sys\x00', &(0x7f0000000300)='sysfs\x00', 0x0, 0x0) r0 = openat$hwrng(0xffffffffffffff9c, &(0x7f0000000040), 0x80000, 0x0) r1 = openat(r0, &(0x7f0000000080)='./sys\x00', 0x1, 0x122) write$tcp_congestion(r1, &(0x7f0000000600)='scalable\x00', 0x9) executing program 38: mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./sys\x00', 0x1ed) (async) mount(0x0, &(0x7f0000000200)='./sys\x00', &(0x7f0000000300)='sysfs\x00', 0x0, 0x0) r0 = openat$hwrng(0xffffffffffffff9c, &(0x7f0000000040), 0x80000, 0x0) r1 = openat(r0, &(0x7f0000000080)='./sys\x00', 0x1, 0x122) write$tcp_congestion(r1, &(0x7f0000000600)='scalable\x00', 0x9) executing program 8: r0 = socket(0x10, 0x3, 0x0) sendmsg$nl_route(0xffffffffffffffff, &(0x7f0000000300)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000100)=ANY=[@ANYBLOB="4800e80010000d0428bd7000fcdbff2500008000", @ANYRES32=r0, @ANYBLOB="1000000000000000280012800b00010062726964676500001800028005001900840000000c001e"], 0x48}}, 0x4084) sendmsg$nl_route(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000080)={&(0x7f00000001c0)=ANY=[@ANYBLOB="500000001000010425bbe5ad600027842cf52300", @ANYRES32=0x0, @ANYRESDEC=0x0, @ANYRES64=r0, @ANYRES16=r0], 0x50}, 0x1, 0x0, 0x0, 0x13d33d22c8a65c15}, 0x4008840) getsockopt$inet_sctp6_SCTP_NODELAY(r0, 0x84, 0x3, &(0x7f0000000280), &(0x7f00000002c0)=0x4) mkdirat(0xffffffffffffff9c, &(0x7f0000000040)='./mnt\x00', 0x1ff) mount$nfs(&(0x7f0000000080)=':27.0.0.1:/export\x00', &(0x7f00000000c0)='./mnt\x00', &(0x7f0000000180), 0x20800, &(0x7f0000000140)=ANY=[@ANYRES16=r0]) r1 = socket$inet6_icmp_raw(0xa, 0x3, 0x3a) bind$inet6(r1, &(0x7f00000001c0)={0xa, 0x4e20, 0xfffffffb, @empty, 0x2}, 0x1c) sendmmsg(r0, &(0x7f0000000000), 0x4000000000001f2, 0x0) r2 = socket$inet6_sctp(0xa, 0x1, 0x84) r3 = dup(r2) setsockopt$inet_sctp6_SCTP_SOCKOPT_BINDX_ADD(r3, 0x84, 0x64, &(0x7f0000000040)=[@in6={0xa, 0x4e24, 0x6, @loopback, 0x3}], 0x1c) getsockopt$inet_sctp_SCTP_GET_ASSOC_STATS(r3, 0x84, 0x70, &(0x7f0000000680)={0x0, @in6={{0xa, 0x4e22, 0x1, @ipv4={'\x00', '\xff\xff', @multicast1}, 0x8}}, [0xfffffffffffffffa, 0x3, 0x7, 0x3, 0x4, 0x3, 0xc, 0x8, 0x3, 0x5, 0x7, 0x100000000, 0x6, 0x2, 0x6]}, &(0x7f00000007c0)=0x100) r4 = socket$packet(0x11, 0x2, 0x300) r5 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r5, 0x8933, &(0x7f0000000040)={'ip6gretap0\x00', 0x0}) sendto$packet(r4, 0x0, 0x0, 0x0, &(0x7f0000000400)={0x11, 0x88a8, r6, 0x1, 0x0, 0x6, @local}, 0x14) r7 = openat$selinux_checkreqprot(0xffffffffffffff9c, &(0x7f0000000200), 0xa00, 0x0) io_uring_register$IORING_REGISTER_FILES(r3, 0x2, &(0x7f0000000240)=[r0, r0, r7, r0, r0, r0, r0], 0x7) executing program 8: r0 = socket$inet_tcp(0x2, 0x1, 0x0) r1 = syz_open_dev$dri(&(0x7f0000000300), 0x40100001, 0x189002) ioctl$DRM_IOCTL_SYNCOBJ_WAIT(r1, 0xc02864c3, &(0x7f00000001c0)={&(0x7f0000000180)=[0x0], 0x9, 0x1}) bind$inet(r0, &(0x7f0000000040)={0x2, 0x4e21, @local}, 0x10) setsockopt$inet_tcp_int(r0, 0x6, 0x210000000013, &(0x7f00000000c0)=0x100000001, 0x4) r2 = openat$sndseq(0xffffffffffffff9c, &(0x7f0000000140), 0x0) ioctl$SNDRV_SEQ_IOCTL_QUERY_NEXT_PORT(r2, 0x40045304, &(0x7f0000000540)={{}, 'port0\x00'}) setuid(0xee01) bpf$PROG_LOAD(0x5, &(0x7f00000017c0)={0x1, 0xe, &(0x7f0000001880)=ANY=[@ANYBLOB="b7000000000000febfa30000000000000703000028feffff620af0fff8ffffff61a4f0ff000000003e040000000000003f040100000000005504000001ed0aff9404010017ffffffbf040000000000007b0a00fe000000006e04000000000000c6000000000000009500000000000000023bc065b7a379d17cf9333379fc9e84af69912435f1b6a693002e7f3be3619184e50b91f32050e436fe275daf51efd601b6482a0800000098efd2a102ee010400006e7a1de4a21f379dbf01de00b1b564fef3bef70548aed0d600c095199fe3ff3128e599b0eaebbdbd7359a48f5b0afc532ef58de3c1b7646cb7798b3e6440c2fbdb00a3e35208b0bbf12cd8dff095edc710e4000000000000009fbe4b61a615c6c57a2b649dc74a1a610643b08d9e104d4d91af25b8123deda8a3658d42ecbf28bf6d8e8afcb913466aaa7f6df70252e79166d8582755a314d31a76e42f2460d0b11008e59a5923906f88b53987ad1714e72ba7a54f0800000000000000d5f728d236619074d6ebdf098bc908f50ae728a40f9411fe7226a4040b96e37c4f46010400000000c3da29faf75ddd1aa96960bca97af133824b881cc1f62c0f8f8f0e8d76b86f9c45636614786f5a2cb77230a874640dcbe0b20bb77c022d4cab080078fce8c5c81b7037181fc2f18f781aaa6e2957d7e39cc1baddcb7ec6667e699f24e41697ee7ea23e4b29a8b6cc9a1f5a7b3caae05f1300010000949b3aab06b1e042ff2164d80c8ab1c156b97e5889685a96949e4cb40df77b8bb84b0e733a63784ccc214d930cbb7e090df9a2867b3acec439c163fc8706869ada11390d4dbcf840fa68e7d7071b53ac29df826f8ae6d6e18c1e0600bf870768d5217e9bb5a05d9e224e67f1231bd236ed200073824d93c4e1a0f50a74bb4850486727d970acc546087acbf30f2f8165b47ba56dfadd14b306e98931485747292c6fe6e188750cf4f87cce2aa7d67c7133a9f05954cde298a35ea6d715ba80aee6330000000000000000000000000000000000004000000000000000038600008fb854adb4f8080064e8407c6bdb37114c80fbaa4a0ec5aaf4b0ac6f2128668279eb6fc144344e2d461c9a1be8fa0061ea9d55ee4716bea8e1cebf9ed39325ab4c5530dd6ee9fffc00000000000000d7c5af73c683625aaad5eda5004a76c9f8975ed4c5e4eb3e77e9885f69754932609f19e2f615a01cb6d17fbf5cb539403cb0572534f054d5514ad8264f7b029b2bdf2ca4958a62a6e744f9a4c1e646e1dd2ca19583f0f8b0dc53debd7d44f334e6ed7445a9580f970e483b307c4b3c018bc194b23d37e6a2e52d8265e5aab6fec586d52386e8c07a88c88e8faec5f1b16b2014f6952ce7d6be12c6bdb9651ca6fc907061be311d1354e6295698594a73136237bee068d3819400e43544830a3f74b7942f22336953978a5b2032da4238cc61162c04c1297395b73e18c9387615a2bc87d9e2445f3d323d3fac347926a4bac694c55fe9d145906d410f58f1951405d10504efe402cae085afef5dbd617e87ddbd239e4a50d7eb8e327fb5db12cbd6a9efe8e671c4f251cafffe3400a670d14b9b3cd8d86e492997a0168c022ef3536bd1dc731f4f9f8cb66701f4578ba4cb9b706e605a88c3857fb8aaaa95024f8da775f72950212b84fc6133ae14d1429cd4905dabb52e43af7e65acf97b4951fa1e967d16a5ed642efc855a4a46b85cd079934ad3188276efae9387eaa232697526e24b5d4fded86c3811ccd00520150b16000080122965558074956da5e4c3bbefcb64aa8be4456ed2caf0f467b6bbf3aa4371f5e76ab3f6a20278a3c779e03afd9a6af6fd518e5dce030f88ec5a5cb7601a161da0f80893220800c523040d13e1f1300c2c6555bce60d95dd3288e53435713f03add23f14c8db5555c62de4f626483632a2ab547f88dd6efec73a0271a19ca3aa860aa4dcaeeb9bd91a0cb429efae2a5fcc08b3a572969bbe917d1767e38ba49e3e57fafea83e495a6a1d1a4ebf83434986091dd66ffe3ffed0c39552a312e2db596d9c827e02f6fc13c8ddbb50bfd7dd8aa2f35f259fc83e007fe79d2d25e30830b92fca00a292dd3b856faa4b7e66e1b64505f65900839df71a97d4d07d37f7ecf8ed9a22da26ae674bba16c204f6b2f8f74fc56b7126d7c11ece6e88ec41192aaee75415c58d264a2b6adae02c821b62428902aad499825ab85a348638384cd12e61dbde5c47056f0a20b4e2a2328d5db5cf026657a129e6be231acf5f57995c60d9fca5f63a0dfd18054717120bda466d04774b53208ad8b022719ca77a4e0a66b4708f791d849a5e2aaa0074a9560ede2600df5a5c41392fe9460080fcb1e65233fb8dbeec4c86dbcf6a0673e38d2d3615e5bfbde44afe0fa7564231fff7e7f1f3ad68492dd2cccb15b5d7d3e37e8b7d28921c4b9280979521173f322df408d9818b6cc400090300000021911480a876fbba698801937e8b4264eb6f5137bdaa075f1488d22230592a79000000000000000000000000000000000000000000110000000000000000000000000000000000000000000000000000000000000000002f316aa0886c174b73decb46c1c85edf50d8fcbac5ff76b365611666da86a8e65b308706bd7c000000000000003f7cd4d5cb9076b81b7741ec03877afb5237ea1694addebc14c3ae49f88c462ea2050acf2d9a97d3be29a5614d1eba2c98cf0236401e02d7c445e50f76419ab4f78f67a09e63dd4faa2e7b59399f055f2fa278783f26d0a52aefb0a5ef0b41e14a6fe6ba306206670b84894e901a523fcbadfeff535f2514bc834e876810d9a6a78e70a9e22860c36a724770b4185de44db6bf21fef32a8d5b36d9014f38fee012365f963b2a85e7d8075c333475b9f0284405e3127dde7e41285fbe0bdd370c06c6a41744c3d24eab511317f97b7b4a1c2ec33fedc46e9bf0fa640eebd3d58f0ebdb7cb8ccffd6d6ab7e0e843591d2618e2d2cdc7081c8fafffe9c3500800000087de4ee7aac6478d99de7dd82bef044a6d33c789d566c90c46ad581aa22f910547a77d55e26bf19f1d4661550b177ef53933a305e69b8a95119dcf5bda599d625054776151b2cd1fcde238bdc527594a6c17aa9728af24e2bb7a3830e7092b01b119ea4e7e7f0e21527d622cc29c9f0c8720195368f8374337ab4d130619d93c5ef37e7ddd0b2da147e6e513455b88753452de959a6cbfa1ffbc7ad5d8c3b48017fd31dcf72f337b639253f44cb27a12174bc4c191e21015d0c431a71906eb9c6a14c8a060459ef26787ce3d1cbfd5cc459f0048b5d06f6cbd3e9b34c89f3fb2f951ae81d7fcc8bc0000000000000000000000000000000000000000009231feef3117197c796369f776c8b2ea3970f358107945d9e74e9bdfa58e68b65a8f01bc4b73cc31df5aa29f363917f90e3fa1eaf553db1c761dd9b634a9c4d7c21c24fe6d953ed9438cad0f8dfe03e5e2f73019352f1fb682a5a6ebbf24ebc49e3d7058e696eb3f4b642f36c9006c0067e24a64aa8c53dd824a3c08bfda74a143c855030ae004ac797c575c202d8091eb77565212548ead770d68000000000099347593f67da85d1c962bfb320d1553a74ec3bf003ba62b1784dbf0168a7e85f28b77bdebce96bf386a6dd5df162a16f2b7e8a4de0ffc464a87f91f81866d2ef0af71ebb07a739c3cb1b7000000000000"], &(0x7f00000001c0)='GPL\x00'}, 0x48) r3 = socket$nl_netfilter(0x10, 0x3, 0xc) close(r3) close(0xffffffffffffffff) socket$nl_route(0x10, 0x3, 0x0) r4 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r4, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000240)=ANY=[@ANYBLOB="140000001000010000000000000000000500000a28000000000a030000000000000000000a00000708000240000000020900010073797a31000000002c000000030a010100000000000000000a0000070900010073797a31000000000900030073797a320000000014000000110001"], 0x7c}, 0x1, 0x0, 0x0, 0x4000}, 0x0) sendmsg$NFT_BATCH(r4, &(0x7f0000009b40)={0x0, 0x0, &(0x7f0000000380)={&(0x7f0000000580)=ANY=[@ANYBLOB="140000001000010000000000000000000500000a50000000090a010400000000000000000ae8ff030900010073797a310000000008000540000000020900020073797a310000000008000a40fffffffc0c0009800800014000000002080008400000000114000000110001"], 0x78}, 0x1, 0x0, 0x0, 0x4000850}, 0x40) sendmsg$NFT_BATCH(r3, &(0x7f0000009b40)={0x0, 0x0, &(0x7f0000009b00)={&(0x7f00000002c0)=ANY=[@ANYBLOB="140000001000010000000000000000000500000a400000000c0a01010000000000f9ff000a0000090900020073797a31840000200900010073797a310000000014000380"], 0x68}, 0x1, 0x0, 0x0, 0x4004850}, 0x40) setsockopt$SO_TIMESTAMPING(r0, 0x1, 0x25, &(0x7f0000000200)=0x437b, 0x4) connect$inet(r0, &(0x7f0000000180)={0x2, 0x4e21, @local}, 0x10) setsockopt$inet_tcp_TCP_REPAIR_OPTIONS(r0, 0x6, 0x16, &(0x7f0000000340)=[@mss={0x2, 0xf}, @window={0x3, 0x6, 0x7}, @mss={0x2, 0x51a}, @window={0x3, 0x0, 0x4}, @mss={0x2, 0x4}, @timestamp, @sack_perm, @sack_perm], 0x8) sendmsg$inet(r0, &(0x7f0000000300)={0x0, 0x0, &(0x7f0000000140)=[{&(0x7f0000000380)="9ad024c2775e1e2ab8e46a2877fcb21d4bb90500ebb1cfaea615b04f758b1754ce82525f728b072274a6388145b8991b", 0x30}], 0x1}, 0x0) setsockopt$inet_tcp_TCP_REPAIR(r0, 0x6, 0x13, &(0x7f00000001c0), 0x4) sendto$inet(r0, &(0x7f00000004c0)='<', 0x381, 0x805, 0x0, 0x0) r5 = openat$cdrom(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) ioctl$sock_inet_SIOCGARP(r0, 0x8954, &(0x7f0000000240)={{0x2, 0x4e24, @multicast2}, {0x306, @broadcast}, 0x54, {0x2, 0x4e21, @empty}, 'veth1_to_hsr\x00'}) ioctl$CDROM_SET_OPTIONS(r5, 0x5320, 0x8) getsockopt$inet_pktinfo(r0, 0x0, 0x8, &(0x7f00000003c0)={0x0, @remote, @empty}, &(0x7f0000000400)=0xc) r7 = openat(0xffffffffffffff9c, &(0x7f0000000180)='./config/nvmet/subsystems/testsubsys/attr_allow_any_host\x00', 0x1, 0x0) write(r7, &(0x7f0000000200)='1', 0x1) bpf$MAP_CREATE(0x0, &(0x7f0000000440)=ANY=[@ANYBLOB="1e00000001040000f9ffffff0010000000000000", @ANYRES32, @ANYBLOB='\a\x00'/20, @ANYRES32=r6, @ANYRES32=r7, @ANYBLOB="050000000200000004e4114473c20000000900"/28], 0x50) executing program 8: r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000280), 0x109a42, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000200)={'rose0\x00', 0x112}) ioctl$TUNSETTXFILTER(r0, 0x400454d1, &(0x7f0000000080)={0x0, 0x9, [@link_local={0x1, 0x80, 0xc2, 0x0, 0x0, 0xe}, @random="b9127df5f77a", @multicast, @remote, @dev={'\xaa\xaa\xaa\xaa\xaa', 0x37}, @remote, @remote, @local, @multicast]}) (async) r1 = socket$nl_route(0x10, 0x3, 0x0) socketpair$unix(0x1, 0x1, 0x0, &(0x7f00000004c0)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$int_in(r2, 0x5452, &(0x7f00000000c0)=0x400) (async) ioctl$sock_SIOCSPGRP(r2, 0x8902, &(0x7f0000000480)=0xffffffffffffffff) (async) r4 = socket$nl_generic(0x10, 0x3, 0x10) (async, rerun: 32) r5 = syz_genetlink_get_family_id$nl80211(&(0x7f00000001c0), 0xffffffffffffffff) (rerun: 32) sendmsg$NL80211_CMD_REQ_SET_REG(r4, &(0x7f0000000580)={&(0x7f0000000180)={0x10, 0x0, 0x0, 0x1}, 0xc, &(0x7f0000000540)={&(0x7f00000002c0)={0x194, r5, 0x2, 0x70bd25, 0x25dfdbfd, {}, [@NL80211_ATTR_REG_ALPHA2={0x7, 0x21, 'bb\x00'}, @NL80211_ATTR_REG_RULES={0x98, 0x22, 0x0, 0x1, [{0x4c, 0x0, 0x0, 0x1, [@NL80211_ATTR_FREQ_RANGE_MAX_BW={0x8, 0x4, 0xb}, @NL80211_ATTR_FREQ_RANGE_START={0x8, 0x2, 0x7}, @NL80211_ATTR_POWER_RULE_MAX_ANT_GAIN={0x8, 0x5, 0x100000}, @NL80211_ATTR_POWER_RULE_MAX_EIRP={0x8, 0x6, 0x8732}, @NL80211_ATTR_FREQ_RANGE_END={0x8, 0x3, 0x6}, @NL80211_ATTR_FREQ_RANGE_END={0x8, 0x3, 0x6}, @NL80211_ATTR_FREQ_RANGE_START={0x8, 0x2, 0x10000000}, @NL80211_ATTR_POWER_RULE_MAX_ANT_GAIN={0x8, 0x5, 0x9}, @NL80211_ATTR_FREQ_RANGE_START={0x8, 0x2, 0x4}]}, {0x2c, 0x0, 0x0, 0x1, [@NL80211_ATTR_POWER_RULE_MAX_ANT_GAIN={0x8, 0x5, 0x2}, @NL80211_ATTR_FREQ_RANGE_END={0x8}, @NL80211_ATTR_POWER_RULE_MAX_EIRP={0x8, 0x6, 0x9}, @NL80211_ATTR_DFS_CAC_TIME={0x8, 0x7, 0x4}, @NL80211_ATTR_REG_RULE_FLAGS={0x8, 0x1, 0x2}]}, {0x1c, 0x0, 0x0, 0x1, [@NL80211_ATTR_DFS_CAC_TIME={0x8, 0x7, 0x9}, @NL80211_ATTR_FREQ_RANGE_END={0x8, 0x3, 0x94c}, @NL80211_ATTR_DFS_CAC_TIME={0x8, 0x7, 0x1}]}]}, @NL80211_ATTR_DFS_REGION={0x5, 0x92, 0x8}, @NL80211_ATTR_WIPHY={0x8, 0x1, 0x7e}, @NL80211_ATTR_DFS_REGION={0x5, 0x92, 0x2}, @NL80211_ATTR_REG_RULES={0x90, 0x22, 0x0, 0x1, [{0x2c, 0x0, 0x0, 0x1, [@NL80211_ATTR_FREQ_RANGE_MAX_BW={0x8, 0x4, 0x6}, @NL80211_ATTR_POWER_RULE_MAX_EIRP={0x8, 0x6, 0x3}, @NL80211_ATTR_DFS_CAC_TIME={0x8, 0x7, 0x7}, @NL80211_ATTR_REG_RULE_FLAGS={0x8, 0x1, 0xfffff88f}, @NL80211_ATTR_FREQ_RANGE_START={0x8, 0x2, 0x4}]}, {0x3c, 0x0, 0x0, 0x1, [@NL80211_ATTR_FREQ_RANGE_MAX_BW={0x8, 0x4, 0x3}, @NL80211_ATTR_DFS_CAC_TIME={0x8, 0x7, 0x8}, @NL80211_ATTR_REG_RULE_FLAGS={0x8, 0x1, 0xffffffff}, @NL80211_ATTR_REG_RULE_FLAGS={0x8, 0x1, 0x8}, @NL80211_ATTR_FREQ_RANGE_END={0x8}, @NL80211_ATTR_FREQ_RANGE_MAX_BW={0x8, 0x4, 0x94}, @NL80211_ATTR_POWER_RULE_MAX_EIRP={0x8, 0x6, 0x5}]}, {0x24, 0x0, 0x0, 0x1, [@NL80211_ATTR_REG_RULE_FLAGS={0x8, 0x1, 0x56}, @NL80211_ATTR_FREQ_RANGE_MAX_BW={0x8, 0x4, 0x1}, @NL80211_ATTR_POWER_RULE_MAX_EIRP={0x8, 0x6, 0x8}, @NL80211_ATTR_FREQ_RANGE_MAX_BW={0x8, 0x4, 0x7}]}]}, @NL80211_ATTR_REG_ALPHA2={0x7, 0x21, 'bb\x00'}, @NL80211_ATTR_REG_RULES={0x30, 0x22, 0x0, 0x1, [{0xc, 0x0, 0x0, 0x1, [@NL80211_ATTR_POWER_RULE_MAX_EIRP={0x8, 0x6, 0x7f}]}, {0x14, 0x0, 0x0, 0x1, [@NL80211_ATTR_DFS_CAC_TIME={0x8, 0x7, 0x152575de}, @NL80211_ATTR_DFS_CAC_TIME={0x8, 0x7, 0x3}]}, {0xc, 0x0, 0x0, 0x1, [@NL80211_ATTR_POWER_RULE_MAX_EIRP={0x8, 0x6, 0x7}]}]}]}, 0x194}, 0x1, 0x0, 0x0, 0x4800}, 0x40000) (async) sendmsg$inet(r3, &(0x7f0000000100)={0x0, 0x0, &(0x7f0000000040)=[{&(0x7f0000000640)="8285", 0x2}], 0x1}, 0x400c9c1) (async) ioctl$sock_ipv6_tunnel_SIOCADDTUNNEL(0xffffffffffffffff, 0x89f1, &(0x7f0000000140)={'ip6gre0\x00', &(0x7f00000000c0)={'ip6tnl0\x00', 0x0, 0x29, 0x0, 0x5, 0x6, 0x41, @remote, @private0={0xfc, 0x0, '\x00', 0x1}, 0x40, 0x8010, 0x9, 0x6}}) sendmsg$nl_route(r1, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000500)={&(0x7f0000000000)=ANY=[@ANYBLOB="3c000000100000", @ANYRES32=0x0, @ANYBLOB="00400000000000001c00128009000100626f6e64000000000c00028008000200", @ANYRES32=r6, @ANYBLOB], 0x3c}}, 0x0) executing program 8: r0 = socket$netlink(0x10, 0x3, 0x0) r1 = socket$inet(0x2, 0x4000000000000001, 0x0) setsockopt$IPT_SO_SET_REPLACE(r1, 0x0, 0x40, &(0x7f00000007c0)=@raw={'raw\x00', 0x8, 0x3, 0x4e8, 0x0, 0xa, 0x148, 0x368, 0x60, 0x450, 0x2a8, 0x2a8, 0x450, 0x2a8, 0x7fffffe, 0x0, {[{{@ip={@multicast2, @multicast2, 0x0, 0x0, 'bridge0\x00', 'rose0\x00'}, 0x0, 0x2f8, 0x368, 0x0, {0x200003ae, 0x7f00}, [@common=@inet=@hashlimit1={{0x58}, {'veth1_to_team\x00', {0x0, 0x0, 0x2, 0x0, 0x0, 0xffffffff, 0x7}}}, @common=@unspec=@bpf1={{0x230, 'bpf\x00', 0x0}, @bytecode={0x0, 0x12, 0x0, [{0x5, 0x1, 0x9, 0x800}, {0x6, 0x3, 0x0, 0x7}, {0x0, 0x7, 0x6, 0x40}, {0x3ffd, 0x10, 0x0, 0xf98}, {0xab, 0x0, 0x8a, 0x6}, {0x7, 0x6, 0x5, 0x3}, {0x8e1, 0x1, 0x6}, {0x0, 0x6, 0xfe, 0xb0}, {0x9, 0x81, 0x9, 0xfffffff9}, {0x9, 0xb, 0xb2, 0x4}, {0x3, 0x2, 0x10, 0x1e56}, {0x38a, 0x1, 0x92, 0x1}, {0x80, 0x7f, 0xc6, 0x1200000}, {0x4, 0x3, 0x3, 0xff}, {0x100, 0x6, 0x9, 0x8b}, {0x4, 0x5, 0x8b, 0x16}, {0x4, 0x3e, 0x1, 0x9}, {0x4, 0x8, 0x0, 0x6}, {0x3, 0x10, 0xfa, 0x4}, {0x8000, 0x0, 0xa, 0x2}, {0xfff, 0x4, 0x3, 0x9}, {0x438, 0x4, 0xc, 0x800}, {0xffff, 0x0, 0x5, 0x401}, {0xf0, 0x7, 0x2, 0x2}, {0xfff, 0x1, 0x2, 0x5}, {0x7ff, 0x2, 0x1, 0x7}, {0x9, 0x5, 0x8, 0xdf4c}, {0x6, 0x3, 0x81, 0x8}, {0x9, 0x3, 0x95, 0x6307}, {0x1, 0x5, 0x8, 0x9}, {0x1, 0x10, 0x8, 0xac7b7f12}, {0xd969, 0x3, 0x89, 0x1000}, {0x3, 0xec, 0x7}, {0x8, 0xec, 0x6, 0x7f}, {0x1ff, 0x7, 0x2f, 0x1000}, {0x238, 0x3d, 0x4, 0x4}, {0x1, 0x20, 0x7, 0xfffffff9}, {0x100, 0x5, 0x3, 0xe00}, {0xfff, 0x95, 0x4, 0x81}, {0x4, 0x9, 0x2, 0x8}, {0x34, 0xa, 0x6d, 0x2}, {0x7, 0x2, 0x4, 0xa6}, {0x307, 0x0, 0xa, 0x800}, {0x1ff, 0x3, 0x2, 0x7}, {0x2, 0xdb, 0xb, 0x5}, {0x328, 0x9, 0x9, 0x4}, {0x362e, 0xcc, 0xb6, 0x6}, {0x7, 0x1, 0x3, 0xfffffff9}, {0xa, 0x7f, 0xb, 0x2}, {0x1d57, 0x2, 0x3, 0xfffffff7}, {0x2ea, 0x1, 0x4, 0x2}, {0x0, 0x7f, 0x31, 0x7}, {0x4, 0x4, 0x10, 0xffff}, {0x80, 0x0, 0xd9, 0x9}, {0x6, 0x6, 0x8}, {0x800, 0x7, 0xe, 0xfffffffe}, {0x8, 0x7, 0xe0, 0x1}, {0x8001, 0x4, 0xd, 0x5}, {0x0, 0x4, 0x1c, 0x5}, {0x7, 0xe, 0x9}, {0x7, 0x0, 0xc, 0x80}, {0xccf4, 0xf7, 0xfe, 0x1}, {0xfff, 0x5, 0x5, 0x7fffffff}, {0x7, 0xf0, 0x91, 0x2}], {0x3}}}]}, @common=@unspec=@NFLOG={0x70, 'NFLOG\x00', 0x0, {0x0, 0x0, 0x0, 0x0, 0x0, "f2f7b9f28413d9d8ad470ad2b60c45cb4ea6e7bf902bdc2ff8a9304d9f655c746adc0bdc773506378bc2d27efd6abb05175089830cc46186074d7de46d5af300"}}}, {{@ip={@empty, @empty, 0x0, 0x0, 'syzkaller0\x00', 'veth0_to_team\x00'}, 0x0, 0xc0, 0xe8, 0x0, {}, [@inet=@rpfilter={{0x28}, {0x3}}, @inet=@rpfilter={{0x28}, {0x1}}]}, @common=@unspec=@MARK={0x28}}], {{'\x00', 0xc8, 0x70, 0x98}, {0x28}}}}, 0x548) syz_clone3(&(0x7f0000000340)={0x2210000, &(0x7f0000000000), &(0x7f0000000040)=0x0, &(0x7f0000000080), {0x32}, &(0x7f0000000100)=""/226, 0xe2, &(0x7f0000000200)=""/186, &(0x7f00000002c0)=[0x0], 0x1}, 0x58) capset(&(0x7f00000003c0)={0x19980330, r2}, &(0x7f0000000400)={0x10, 0x3, 0x9, 0x4, 0xa6, 0x3}) sendmsg$nl_route(r0, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000300)={&(0x7f0000000440)=@newlink={0x3c, 0x10, 0xffffff1f, 0x0, 0x1, {}, [@IFLA_LINKINFO={0x1c, 0x12, 0x0, 0x1, @bond={{0x9}, {0xc, 0x2, 0x0, 0x1, [@IFLA_BOND_FAIL_OVER_MAC={0x5, 0xd, 0x1}]}}}]}, 0x3c}, 0x1, 0x0, 0x0, 0x40000}, 0x24000000) executing program 8: syz_genetlink_get_family_id$nl80211(&(0x7f0000000380), 0xffffffffffffffff) mmap(&(0x7f0000001000/0xc00000)=nil, 0xc00000, 0x3000004, 0x3032, 0xffffffffffffffff, 0x0) r0 = socket(0x10, 0x3, 0x0) r1 = socket$packet(0x11, 0x3, 0x300) r2 = openat$audio(0xffffffffffffff9c, &(0x7f00000005c0), 0x82000, 0x0) ioctl$SNDCTL_DSP_GETODELAY(r2, 0x80045017, 0x0) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000080)={0xd, 0x4, &(0x7f0000000000)=ANY=[@ANYBLOB="18000000000000000000000000004000611240001e0000009500000000000000"], &(0x7f0000000040)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x24}, 0x80) ioctl$sock_SIOCGIFINDEX(r1, 0x8933, &(0x7f0000000080)={'ip6tnl0\x00', 0x0}) sendmsg$nl_route_sched(r0, &(0x7f0000000040)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000d40)=@newqdisc={0x24, 0x24, 0x3fe3aa0262d8c783, 0x0, 0x0, {0x0, 0x0, 0x0, r3, {}, {0xffff, 0xffff}, {0x8}}}, 0x24}}, 0x0) executing program 8: prctl$PR_SET_IO_FLUSHER(0x43, 0x1) (async) r0 = syz_open_dev$sndpcmc(&(0x7f0000000120), 0x1, 0x2) ioctl$SNDRV_PCM_IOCTL_HW_PARAMS(r0, 0xc2604111, &(0x7f0000000680)={0x0, [[0xff7ffffe, 0xffffffff, 0xffffffff, 0x1, 0xffffffff, 0xfffffffc, 0xffffffff, 0xffffffff], [0xffffffff, 0x2, 0xfffffffd, 0xa, 0xffffffff, 0xffffffff, 0xffffffff, 0xffffffff], [0xffffffff, 0xfffffffe, 0x83, 0xffffffff, 0xffffffff, 0xffffffff, 0x3, 0xffffffff]], '\x00', [{0x10, 0x10, 0x0, 0x0, 0x1}, {0x20, 0x20, 0x0, 0x0, 0x1}, {0x2, 0x9, 0x0, 0x0, 0x1}, {0xac44, 0xac44, 0x0, 0x0, 0x1}, {0xa, 0x186a0, 0x0, 0x0, 0x1}, {0x7, 0x400, 0x0, 0x0, 0x1}, {0x400, 0x101000, 0x0, 0x0, 0x1}, {0x2, 0x8, 0x0, 0x0, 0x1}, {0x2710, 0xf4240, 0x0, 0x0, 0x1}, {0x400, 0xffd, 0x0, 0x0, 0x1}, {0x1000, 0x4000, 0x0, 0x0, 0x1}, {0x0, 0xf4240, 0x0, 0x0, 0x1}], '\x00', 0x4}) (async) ioctl$SNDRV_PCM_IOCTL_PREPARE(r0, 0x4140, 0x0) (async) r1 = openat$adsp1(0xffffffffffffff9c, &(0x7f0000000040), 0xa0201, 0x0) (async) r2 = userfaultfd(0x80001) ioctl$UFFDIO_API(r2, 0xc018aa3f, &(0x7f0000000000)={0xaa, 0x54}) ioctl$UFFDIO_REGISTER(r2, 0xc020aa00, &(0x7f0000000080)={{&(0x7f0000000000/0x400000)=nil, 0x400000}, 0x1}) (async) madvise(&(0x7f0000000000/0x600000)=nil, 0x600003, 0x19) (async) write$dsp(r1, &(0x7f00000012c0)="a52876830a602214f6b4e928d758f38a5a7cb4b31c4c09289e9ebb6286784ca3", 0x4000) (async) mknodat(0xffffffffffffff9c, 0x0, 0x1000, 0x0) (async) openat$fuse(0xffffffffffffff9c, 0x0, 0x42, 0x0) (async) r3 = socket(0x10, 0x803, 0x0) ioctl$sock_SIOCGIFINDEX(r3, 0x8933, &(0x7f0000000400)={'veth0_to_hsr\x00', 0x0}) sendmsg$nl_route_sched(r3, &(0x7f00000012c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000180)=@newqdisc={0x48, 0x24, 0x4ee4e6a52ff56541, 0x70bd25, 0x25dfdbff, {0x0, 0x0, 0x0, r4, {0x0, 0xffe1}, {0xffff, 0xffff}, {0xffe0}}, [@qdisc_kind_options=@q_htb={{0x8}, {0x1c, 0x2, [@TCA_HTB_INIT={0x18, 0x2, {0x3, 0x4, 0x9}}]}}]}, 0x48}}, 0xc840) sendmsg$nl_route_sched(r3, &(0x7f0000006040)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000800)=@newtfilter={0x54, 0x2c, 0xd2b, 0x70bd2b, 0x25dfdbfb, {0x0, 0x0, 0x0, r4, {0x6}, {}, {0x7, 0xfff1}}, [@filter_kind_options=@f_u32={{0x8}, {0x28, 0x2, [@TCA_U32_SEL={0x24, 0x5, {0xd, 0x7, 0x1, 0x3d3f, 0x0, 0xfff, 0xb709, 0x58f, [{0x0, 0x20008000, 0x4, 0x1}]}}]}}]}, 0x54}, 0x1, 0x0, 0x0, 0x4084}, 0x24040084) recvmmsg$unix(r3, &(0x7f0000000580)=[{{0x0, 0x0, &(0x7f0000000040)=[{&(0x7f00000002c0)=""/219, 0xdb}], 0x1}}], 0x1, 0x60, 0x0) (async) socket$nl_route(0x10, 0x3, 0x0) r5 = socket$inet_tcp(0x2, 0x1, 0x0) getsockopt$IPT_SO_GET_ENTRIES(r5, 0x0, 0x41, &(0x7f0000000540)=ANY=[], &(0x7f0000000000)=0x28) (async) sysfs$1(0x1, 0x0) r6 = socket$inet_udp(0x2, 0x2, 0x0) connect$inet(r6, &(0x7f0000000040)={0x2, 0x0, @multicast1}, 0x10) sendmsg$nl_route(0xffffffffffffffff, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000140)={0x0}}, 0x0) (async) sendmsg$nl_route(0xffffffffffffffff, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000140)={&(0x7f00000002c0)=ANY=[], 0xc3}, 0x1, 0x100000000000000, 0x0, 0x2000}, 0x40400c0) (async) r7 = socket(0x10, 0x3, 0x0) openat(0xffffffffffffff9c, &(0x7f0000000300)='./sys/class/net/bond0/bonding/slaves\x00', 0x1, 0x0) (async) sendmmsg(r7, &(0x7f0000000000), 0x4000000000001f2, 0x0) executing program 0: r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000180), 0x903c00, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000002040)='./file0\x00', 0x0) r2 = openat$fuse(0xffffffffffffff9c, &(0x7f0000008300), 0x2, 0x0) mount$fuse(0x0, &(0x7f0000002080)='./file0\x00', &(0x7f00000020c0), 0x0, &(0x7f0000002100)=ANY=[@ANYBLOB='fd=', @ANYRESHEX=r2, @ANYBLOB=',rootmode=00000000000000000040000,user_id=', @ANYRESDEC=0x0, @ANYBLOB=',group_id=', @ANYRESDEC=0x0]) syz_fuse_handle_req(r2, &(0x7f0000006300), 0x2000, &(0x7f00000041c0)={&(0x7f00000001c0)={0x50, 0x0, 0x0, {0x7, 0x29, 0x7, 0x22110079, 0x1000, 0x0, 0x7fc, 0x58, 0x0, 0x0, 0x6, 0x8}}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) fchmodat(0xffffffffffffff9c, &(0x7f0000000000)='./file0\x00', 0x2) syz_fuse_handle_req(r2, &(0x7f0000009380)="d5c2280baf4e05cfa1d1112770cf43a123827586f0f2675b130041ff58ba6533ea7947f2f65b1d458fe88a96133ea3927f41fa6976fad8c967c88679769ee674b80debcd1ec6ce1eb490888bd66a52141fa82f51882b22a8e36ff462b51560307cd0048156800ad137f359719a9c5d6ad6a8c999984f22461c4ca6614ca4cbbd5e9103a3459228e3bd35e3c1cd5f2a83fbefafe7c5a39617ba1d856f37977da077ffcf4d52f5bb3feffa9e100b0279cb635a61ae9f5f4491bb1c9f04c041818a1ae9a25cbca38c4b4754a8be4f52db20ca464b3b4faf0ea8ff193b414e7b7a4ec8aec2e77adc43d09c62d37fc0aa6296a56a9445f264a245d41e77de43c2694cc5885ebd454a3b78b60172e3e6a2fd79efa8b5fbbe827512aa0656920858da51616244ad32e53ed039a270c042662bc966a8fa05e23a51c76585a6f753e57c63b5a1dd11c4ce8773702c5c759471b79ee9bed600d99853afda9b675f071bdf6ff4eb99cb1ae0128ac1f8132f9b7bef82221276395e59f1323c9f9f6bb937a9db0bc2088670ffc3e6233ba73d4e324df7bc866e84e82ab707ab8aadd593913dd3533cddb396e804a63155ad6911962bc49bad21faba90b5570b62d98eb5328214a7198b36ea6df9a72dc248311040e01539112e1d6bcb4ed9d7fb70d22768ec6603e4727b6ed2616eb9108524985ccd70f1361f68b1fb7088829acdd59ec5af9e84409737f0d852a3c55993cb7398b5640c458bc036115b86de7b8e68f1cff882ee5707040571c3e5c9602c773459cfecad4917d8ba2902bd64a676e2c6e507d06dbc806c13c0fd18175087440ce7d7300dfe745b8e98ac63b400e449a3f2518c6112c9864fde68f580ebc2d72e4bbd03f16a7289be813c258b02f76ce901afdafc69046c947c9e801ac635b2a95cca291c052c7f8149c92aaeaab41edb34a70604a7538c4bb6486b983416843fe6a65d7b828d66deb991e71526b7627e71c6a795a02e787bc561ec4b65d4742a129c59bc71b323850cb416f3d32494d6dbfe3ea73cb473b093ae0b0ebbbd3e3251ece756b3cc381f05ea1b8c3f7fbcbb16fc446fc084725e6c3a608221aad8d8179112f9e5ee3697346a0dc0645e530df523cf4daea14764c25da2da863adebaccefc2c83a9257b3131ac2fe04a27bf3aea8979b6f3091b4fef99e203725368d297bad3b020273d0b606d2368e2ecb0776349cb86bbcbaa5c910636527e3cbeca06b4135170d8808c5f113fcd77ecb2f099d1e663617a46ffc5275c8fcc339d315ca1583f66fe7a7e6430405c0be889826c07fcafa17f04e08bc39570a1f499092d390c5dba82d259f652307ff941e9f1f569a48144da846f14452df295553de6ef4e9ba0cd98dd16cf89d8bead08eacd4eea71cc5f8232349f2d8519b1172c724d3bbc415c19c9e679b5a96bc9051cf6f243f243366622023ab1b7039a89152e7db97f291bb3f0213c445c25caf5f0a5a2b382c841cd8a490dc97d008966e94ed0b5ce07bcc0c13b39c349e4b596147a633f3a73ab6012a1582d3d283293bd7c01f99cdbad8e18d24867c39ed0dc3fc3cc800edd23af24b225acb2cca5aa264bcda40e1432cf2cc0050efdff48fd49ae4225a983d1b12facbaaba73294eb225fff64a677d0ed2cd71bab61b3fde8a1fdae638d2036283a8a4ff5a548d05cb706f56ce7e3f55a688fa6c70393c53c33be11f34a38f61f80c8e94e50fc9d7c3695d234705bb9e0b2a8316cf54d7963f548d49f153bf796d0970ed1264c19d79eb77fd0aad4844796cec73a08206b9eca76f2ad76318a20d52e7d3338eac40d03775cca0c2b29a451cb10bc141289c2703198e7137200a360463000fab97d0da72a7b4e8aadfa8a2e559a7d06bf49d6d4a932cb29994ef7ca0c1beabf05b898bb2338e89a67373d50614300f13523fe451d4058e5a522d364ec884099ee3c6e6db8d4ec1e5dc08d127b6301a308a1d6798878c28ef828b91b529a22b7519d249a189a7eb942b94ce26148ea8bf16a44261cd9691ba980ec2d0c710dbee41756cb39b88213ad5763239ae7636e983580c41a40b0f3a3af9fa6f995ed1981d073f63a623554bb01869bdfda190bc8d9507cc067b897e1c5f0d087cf8dfcb171169541fa3cce7c3a620544c74f2d3234935a0acf6c804c43992812925cbaaa24f497e7a00efb20c45c7acb80adb3322cbe0f08d1015b40f5ae1366003ebea977b7b95f803487d10aedca3fd018cfa7b267dae604ed0ada202cbebd731f86b7c6764911d4ff0c75a318ee43b1b556781ac58fbd773b2bd0dd693f9b12fa149bbe392cb2d6bf72015912f4a120e47654d42d14107c67b4502b5ad62044d0022c7f8b255a3e46da4bb8f9e44515e4076ce7b1aefd57c4e264b2cbee4a9e8612ce8517b028067644c927a9ce7564449c8fb0471a87b9b76f374c7c2559379a3004326bdc91be5ec52672dc5fac0883ec527f2a1248601bb9267c3123568b815b90b40ba06c250e3068dee2d7fc232141eaaa130443a5775d049464ec454a7c980d9eebaa4f67a75075a6bc28ded9a5f07fe658a2b9eafa37f14055155409d1aa50be6343d13d515d0531b84644d2f58c280d6d008dee95607f67eb74c900f664d97f411f4ac6afc18f11b6fb75e78b3ff25680ed3bbf5b20969678475b86faa02a751e4cec87735645753f245047371c9e6e2e7ab5a9ea3182b4c96934a21b9df3628b478f5ef705aeda49a0609d4b8f5bf34424581557d029438306002fd4e9cff5a2d4e7d5e23c2992032d314b8fbb46ccda250070fc1b679c9c8646c5fe22d8fe2e0fff73d8153fc46ef7885aeaa2d1eabbe455544d46fdef8e3ef9debfe589870942bcc7196e62736e927c311782b5e4da2889d530a7c1550bff4909d2055941655cbcc5c924a477c80fc3b8a904cd9e62f5fb005b5b00154db5becbe327c0f3ec8314ef3fb53977ec24ff7d15aa83a13b23ab99c5332306023005d2dfb70d3ea2aefababd019ae16d304c083e38997cc94bdeb746fc151849c98dc2a23554e6fe789d3aba8bf4e31133c7f93a3cdcd884271dfdd2c45be398a5349ef5d08456178dfafa31cb4c607f09394d71b3405b3d615c7c59c125db88f72380140345d24c56094711dd833221d6b7c5864d049585605c1301c31982d19e403b601b797fe99d0bbfe30d647a913da72b4c5306f6123e7c572828308a9a8f4c686d07125d0006229c2e890ff7d3c354dde61ccd3b26069a81a98e112e61a930f253d607cda5023f002a09df6b1371638d9661c5a06bed166434f07120ad21476de8ad47296af4b449d581cddc74f9be42a84596fb0634f330a856216a9b32b080c8b66e9f51a758b9ca2e1215ddfe633714ca512032f6547217b1a60fcdb27ac8a04bc7851718b38607bc92c13118a323c3221bad99a8639762abcc4a08654da9938aeb301c55546f5ae7f61439dd883a1b2dede156a57c805ab12337d5381a2fb25b32916a8827fc4de8e2ecc70eeebeb01659d6bf88055477b863fb897d5db275a0c222d261e7df79474858b721e57747fe8997faaf36f5f175b23dd3c5efb2b93fb5824da18d635cd7027a3b0b1c87e7c90a5681682b8a7c47dc82fdd3f329c7b60270100dec8ccdd310245b92f4b0bd9a92e1f2a5733b1b91966be15a4761b06f6fe3b05b60ee7964b4d028257c2210ca88031db0590190d3714c1b6ec86e2821dca03db2fc0c9f0ad9800d1773c8037e9b38c7eb7c99618b731e0526f8453c7e1bb67cffcc2d96cc297e1f917b13dd7dda2a8b12191ed107c1e076ffd4965b9415f830be97935cac23a87f07e26354273c2663c7ef19a27dfe08543fa057e1285c909051602981f5929078214058684bc80bed493f6ef853012cb654d180e414fd484f5cb2cfd06c9b753f417697ff42794649e05fcaa3d53ad0fdfbb0db57dc549115e59978b14dd621370d136176098af2f39a2de72482a29b616e8b308b3d9b46ac9abf3d57ff89fe59b5a97966cc4b97d06c20ee4fd765e1c2abce54dc271a7c7efe656648800c27a9988583b4b76572222cb28916b9ff5f6f649de93923179809405c879a90cb450f604cbe8af55cf2a6d844a59ab0393b394e09c79e1b3c403af6eba69330f6969f78a49eb7022e77a39363f11e07fcc69f670f63c11497352f3f5bfea0aee446da35428cebe28f1c2d23ef3ff97e16ceeb2f88ab19b2b69dcdcc81b947b483cc06c776c52232489f86f4c377eb38056042e2e9e0943fc0ef1490df472b9b244235598894a2ffc296f0a2e4257baca6a3ea8cfb1a22ea8295ab9e5faaa2a9e964ae7625dbf945cdbb369265f429d475ab69413cc5bcb89af57b1b966bd0076f799a401d4b46e5045aceb1ef36e5bbfb037bb7681f2a38ef1df9b84baa3598201d13a813165355bf052bb5e456dc0abdefed995b4eb37a39b313af800f6029243a6a7bec75a23389a90034cac8df6713b919028a14649d756d0093550278aad494de2dfeb76220fd3ee5be31f73839ace7f0d6da650e26f5ded30471ed55d2e814fc1b89102e5917b4e58840ecc211eaffa5a2937abeb882ccdf29308e3ac30e23d66ee79c29b4fb7e793a55e344cac298e30f1ca3333df8b58f43126a3404a61501ce06b75e6e6a4bf13dbfb05efd7b9b4219efd428c8f7f345884640d19f5515abcce05f315f00e65d9aa8022890a23da45ede06f455d66e0c96bbf7e9cc74eddca999a51174b4784eba8a9ebed13415de6bd0f160443d43b78181cfa381313a54e25f6751a38f290e5972ff7f70692e18c4737af2a7f6d4eac52ea594a22be4fd00fac1484e6d2d4d3196b49212b49598f5bc77b34d8a3633cf7212c869557d6eb27bf0d0a02555d9318194e9de9c9730ac72daee7cad6c2d4b248a8744515670766a8f1c739917fb859d98974532477989f4c24345f120f5320fdb8d8d56fa6ff2511e701bab399513cecb3e740e3761d02685a765f5267554d0f9243b51620197adc3b561b59c58f334307220db357c1121d7dbf593898b5d2c505f333445c084a6cbc6a7e5252724c83fcee85e304534780a01e7ecceb2ef53ffb6bc6cb9051b1400493ce55d62c01e972fff3cc7d0b68a2dd4d263c9191df1b629e323797f570083f122db3df6abb6fd6c4a351bb7500c7241e4392ac76e04259968e517a43e907cb0b0533d6750b9587a1a5d852639c6b789d333e848e3ad66cbf19c5ee5a641036cb7a858f822f657dec36cc134d6c1a629cfce1f1e24dbb73d09fba04f53b2c6309d71d92211a1f08535244eefcbb52e095626bcc78b950db1cb8facc3660fa705dceef155b00aef3291367ffcea06b5abe588bbdcea2637761308dc65509798b6a494dae4a75c1922c1234248dbfcabfaab3088a0dad09a135a45d75105314020f3ba8901dc39ee624a32e9f863ff55844974b44e57b30302cd0c349f3cc091befd5665f918c298ba89454fb811ce573e41f27490853a52abd6144e85d77de88c3f2e5506c8de40a3957e65936f3b294ce92610b63cec888cb16fe0e8a7af3dd142da96b57f602cc64ba69966724584c2872e5fc42348a324ff082a3ecfded82c3e5b7292d3726c4800176acab6a7a1479a0b5fea79f299e90ffdb1b3843e2349b8f8dc7881145b3796380474c2ceb57e27726c9e50b746a2b12a214fea9cfd6c668363fe6e402710665118928fedb2f4900322b0c7d2c348881ea52278dae765c14b51fd5e8f000602aa3978d83b76056410c2260931e35d841793c8a36b191f93c33c0e4e6367ef45a1cf5145d774861224afbb11a7b77bb94492ec49827f713f8309d80d22e17701046e04c5b277f7b423cbbada01e6d40beb56e755e583b8f3de4b67c4b5ac83771b805fa7af49de2fc8b9a223293d83e7eb4eea3a3af1d1221e5d458e7cab60eaf1b51550a1b125ce018d76096f16d922f4aba48a728ec1b7d4812fe2ca789261b6d8e0c8edb3ba9007649084899c4f6b7986c1cb4a98d412c801fb91675ee42e2bb511bff6700772d3c03a7cb6adb41cbddc33053f8f65c164e9bd47b931510046506b169216d0a04edc479bc51c28acc536ced3834a7a9ce8fb55b72fa186a559437bf41f04b733e05986c915bc19f1b2f99d3bae6c13873d32e3c809b71881c3075f8dd1746f36409ac7934c25236ee2752560fcdd5175037a6fc5f0da58a229418ce30f3e64f9eb6ff3fe4498f47fdd69ceac5e792c8c9f087316f334b7f75e3432d3f1d03ee97c8f16485ec906c94e6c9580f7d03d98a8da85ec118b77c6c1d3b2e99fbf4b45e66cb4f8817f786d1f90e1e5e250be8c240a9648a219a02e62acbd72d1b0c0b42c75065a35664ea6a03cb05ea179f2e8e50e3d7ed53d31cdc10cf5fce48781fa338e3ee819f410540f045cb0edd7b2d219993faaa97cf95aa6144e889a02069421291d05eade30693a751039fece452c22d1afba081d1c40178fed7684cae475fcc365484118a184670cd7aa2758bdb01058ea9b244d5241f627bc5be11c9395e3cb839b0eac7842a312e1fc8b4ddae2aa4ef907ca5c9b847785051323e16d5497c4424289496277475bba67da750fa05bd8be730e4aabaeb94641fa2263dd3d4eb511b4fa40b8cf8b16d7aded1163f2258add79b04e1eb888afa27d057de2523863fc2da38d44cc69ae2d455900eede5fce69d7e9f8707cdb2456a45dda14d257eee4982f86259b855a0293068aa4aeff9439bc06c8ed5a370fe46fa88fa9bb92872166ac69152d1cbb4720eec5b9a057890cbb838aef12091454fe721395b46f9fa29ec1829fedf65aaec1176bb9eb15511bd77e7d4fe7321b3e0dfda95e5c90c3663956477885d6d94b280f58edbc77e864dca73536cd4988bcde2a3edb91704ad59148d85a001e393cebdb56ee088fa1033cdc6fbcbea30e2974035bfe29cee1eace13e30950bb4658886dae7e565ffd7b71e41feecbcac35fd97c81a8fff9d2a1d43f183c6e984671e06645eb0a60228d1b6c12c28bc6eaa4b9125c57b48ced2e199ed3acf12dbe10af4a56f2f5dca829fd07fc3f7e0de6913c73be0ada3e43bcbe70de784de699d0b51d7a56a3eacaf5d7dcd77d73cfb82e04633574213e05dc98850d822bc6dc90dc3fd6184296287342e2243fe6f0cf94e6d02a1b900d0c718e2afbe7fea2fafa375f209fb9cef5d844b861a1029aa3dd7081e81fe6501bbb413dcd23e013f279ef87e082335ade324b7688054992ccc63fbf9153213ab6d07ed0b79945d19639aaa5dd10e53aafe57f1e323300246cb1d6ede1eb1f319ca6fe1b0cc8e733b34818425888110b6eabe2db302310d0a8bcdd5342146b29c535cc9a95a455c8926d77323a31b948d47dc611815a329654a252fd09dbcec5f3cd8bc7e465759eb8e72ff6fd4ef1f375e4e8762a58148622d14480b7bb9aca2eeab3367a7376c9c85e6ba1735e56a2fcc6baf92c8d21942883f318eab7a568fc7ff01885a7089aa7661b15d73799bc0b8f8ce6a3b61adb6949965a223850b6825616c036e099952e04fde7cf086b5e76d45b86ab78b322f9af580173f2e798a39df7cade0d365c9d46d3fb36970f8a99d7b20a1b275afff852126f21ac24ca8c34deb49ba511f4d9edb4f56941aaaa477253f9bfc9a25a2694bbbe3b917074dd4eb6f1be20395ac33dd932a7ccf0604d64257b5af3faf271c145c190a528e471a7f23a53b5f9ea1bd0cc36410e9c538e91dd01d162edde856087b60dcba2042e65b6ae7b81787bd3308db9eb025b6fd930a9eb74a30883b83cfa8be5270dd3ee3408db7f7b136adebb3ee30f0e0b8835a0ded325363e4a2991cafd4a73483954c0f5d3358b25780608fa48f3f527c7e617ec12eb017df33f5088676d8bc476da251e608394e3d8fc0883fd4d1804f8e07f5e12ffa4ee80365a88abf29936bf1b255539fef95f5cf3bebcd26817edb28e7b6adf4851dcfe8aa1aa097f67c51557326ccf9c46ee2780d491e87774324d4dcf26f2e472a5e199b0cdef01094ea72bd5ad5fe1be6c9d545df3dc5de550665d220718a2c0baed2833cfb1428e2d1c2b9ea1e29f4b07fd6c51492643d4000716cd1e8a4f9d58b6b04b805d8962495323fd62949b17348418201664c6f2f651f99d73f8d17bb5e52dba2e6f94fa33f816d74bb6a45bd6cbdbd07f530406227c8fd11f390e805bbc17bc0e81076a27c0be023b64777afec0a7a0c3f53f03bc2ca72ae2873d68217a1a6905f414c2cb1b9561dfd07850a026da5f5775a66f8f3a6bc29b48c8a81b06ba30994ba8e7e233e3a3a5d886767ea6de91fbfc0a594c2375d62e71c7209d87d0f6c7a79a0d80da328e93f08650ec745495c771410913d094e4190075b7225761172eb420c82ab493548f6de38e17d3e687a89ce77c67c58b875c48c8a4d1664cbc6f67df357e040444fcd515d92d5823fc3ef6485208b6f3eda8cd09ea3b004f7eb06ac268ae8c3bf571aa3f619222a47540f9af340c80c587f7226e3d715b18c3ee41f64777d3a0a09f32190ad67922f6ecc63c956a715c3c42a6aaaf5e588d119210083ceaa414820b62fef87a678cd3f24f8fa3cdb6629b041cd7555974313f56d1b0e117ea925dc95e18b5d3f4ba9812f1067022945c3f5d547370d45853c4db3c9ca4436d7e649e1ac3ec02f9c1e9139849b46027d4b276cb0eb4b09848999f466f528290e47ba9540ceca89390db3fcbacb1d566e22e917f01f4442bd4dd0d350d057ffdf5b3549ca559901e6ff5147bdc25c11b23f1678f02c20e4e2e6f339b262e2b82eae0b15b4227f1d514f99ec78fbcf80c8f6f243536f2d7a809de05ae5e1d676fe950ad3513f801bbe4d16737def4b5ec4b62f8562cd5432bd372645202edeb286662d7e8d0dadac5b91c903c2756bdc4f5a7c931f2c3f7feace2b83f5459a196000e2ed1e1b2accaa9d637d5e408340161331c4b0047bf2ab31d317bb1c8f6e1b3d52f9f240bd971a447942dd4b73301781656aad9ce9b01aed907b7eb3a78397b97e601b04a4cb028d327ef32cf20c34e8dad9c9b1f981ab5c06a2b0271852e2a1016ee460d8568391c9ece5a2b8f29cbc6f2d6cc2e66c30c96df548e67dd6ad8c1ff09dfa22b2e8b2c52a3948c4febb09e3c2d34c0604a5ef930cd53be69a4bed9c9ee057178ece02a6b4df4624191590952888bdfafd2dbeca128d500872a8b236fba9623672c4dc15f56a761ee0c54026112fc464f72d3039587f009b94930dac0dbe444a939b38c0f5bce7aa366bfc2bb909db231178228846f71a56ab219e28cef1b102c1bfadbe8f0916d10a573b8cb38cc2cc2ec496a410a4e82847006d2ed4bac927a63a00416d0bfce59cc69aaf78ddc9566f23582999a655c8ad3b217486fb5a037ce089baf344d55bbd475be4e90b10e92c9c1bae3202c2d63355549f0ac95058724fea81ff9cec027e7b93e2cee43af81c6978fee5faf6216118785251b8ca023115b2f87d5d4b10c29aa3616628ab40a8ef36668ef57d7f9be505eabc01947ca222362818a71b3d63e5725a4d8a2c619b1867f70daa07703360d026d6f65247330be1ba84ddaaa7779591ca261beda4f4c094af65c5c276fe3bfb89f067c8c54af67e78f61bdc114ed4aa869c3adf282d7a8e7272579e9fd9e47611e0dc89f97561110e0141c69b1fa114e27b3d1e2c825ea008a370e08cd0a0610edef20cdd8a7cda0922fff046edfd2ff391a10ffce5dd6045619ce9af6b03f4193d858a76b201ed5beb0f11321707b7b593b23adaee4a0c0caf39dfeebcbd2948030435dc94ca00990c728502ec4686194f0f454304a422023c1b2c5b1ebbcd8cd50fa2d11361e3bbdc306e2739e27de300eda27b1c1ea62d773104cea77c18037c6bcc76423621b45abbe789b384bfdfb46efa1627ff29d9d840bf6e1f05e7e13fae6383e42ce153dcb062fa0cefd0fe9298ddbe77fd78d7036b5a815504b48267203da08ca685bfe8ae89c031074bbe5d3d6dcc6a3a8a8a4d3102765c3b714867f4516df62f214351b97bb8b5697a9f9a9dd78627342b239c524a3943d1d70f8cdd7391f05e7395731a8fc05210c6733ea256040bbbb53389229b84dafaaa3db1d5eca2971d9e550149461f1a672eae2319a99beed48934520666bc54b63085a744b5fc9a9b089b16c50ae945f74adcd4c5d064a12a6e103ef59bcc035a755ad31836eb7d04e5900d3800c822b96b466a9f6611f46b8a7d6131f91c625a5604de5bf01e5ca5d99a714c8dc1160260010f8d55f9125ee453b61c911bdf0824caa804c76d6512802875c5433de9b2e8b6c579a67fec5d2bc64ed3d1c313854221b75c9a0ed42af6f5354e7b1d1bf8661baa1261e68fc20d14b5652d25a536f208bff2b90fefa163a232696e655bcf95bed39355ec865e272fed582aae18858f5096ece40b9108efb00147f9c2ced59bfe2a79826851850ed95b35908dfb4d9ab7da0668a1fa8933ac4f6534e9598481477791fd1a1c269011ac9fe81f0491790e8aac121ffc00e38a7619a1855e6899abc2c670375a3ba4ac0cf652da89a70628cee1a35ae17b3490102e3c88ca324d06fce2151bc9de49472cf6e76ccb16d2a9cbf4161812e2c7758d73631024190fe9b71935de6968b289d3503b497f3f4b6306446ae9c312f8f1c63c1f7e62652173d9ed48cb128815bd44a12061f9b73fbdc6674ab9e0d01807f7bcfa0aa59168420e5ad8b72d7b576e273a1d229934fce2867689a41cb17767cf9defe1a96515a677ba08e10e187a3ce2f1d78e6b43b0d46c36163a1967b203df4f53379ee98422e973ab5c090adff21b5cc84fc78358021f681a0f0fd744f687e4f6c295470bf8f548d2d3dc841481dd51db9124cacde83bc9fef44a3e69e1cb28579d897f3013ac6133395328247fdcc152e5563678258936576196ced017c79bb6a4ea501a44cb25e5af1697afbdb3abb316837470ffdbe985ac3967334a90731602d3fac4f5c2758f04ec9c161a7cf330b7c7549fb62e6c15d07a7203c94edd3a8141c91b2029d6a90b14322337e6610822d9d7bff58c10d9c6cff71822f6456a421a65fdaa5d2c793f256a4e7a39f0d85d65fb95479eff79345c0615c9bbb4fb3324f9360b70dc709b0200042e8461b8cee9ce30beab3e276df48f41f001262fc14153f9764e13b50397442e00d7b11266bde10a3b7f83818086ff0015409679e4472d9e0215804fa9d21cebfa5cb5099cf88750cbeaaf58c2743f2746ea4cb73760ba88a07b91b68553716d563af5d7702219d0c600916dc54242d825c6d68320baf234a39f0b9ea9e6a4a72c4d5829b2f28508f54b33c7e0394a43fe23e7940d9b04bbe790d903a2d2c979e0ea79931b934d094fa2d5948c05cf278c341d788f2061ff617c9fa4700b1e1f0fbfa1b8c42848f2ea01cd318a8748c3336622ead25527ddbcd8a12ba3a5183f4419deb13558ed0ec99e73448c21ede0dbee9c01fc7675e54c60d4dee29c0f8fe81af6fe7b726f5d3c50dac634aefbf1ca6aa4df1b340a4109acf30939f6094c8591218729788111bfde98cd96d4b04b25bcd1bcb7f826241995573bae", 0x2000, &(0x7f00000002c0)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f00000003c0)={0x78, 0x0, 0x100000000, {0x20000, 0xcb7b, 0x0, {0x5, 0x0, 0x48b, 0xa, 0x400000000000000, 0xd, 0xfff7ffff, 0x6, 0x101, 0x4000, 0xffff1854, 0xffffffffffffffff, 0x0, 0x3, 0xf}}}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) openat$dir(0xffffffffffffff9c, &(0x7f0000002180)='./file0\x00', 0x0, 0x80) r3 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r3, &(0x7f00000018c0)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000080)=ANY=[@ANYBLOB="280000001e000100000000000000000007000000", @ANYRES32=r3, @ANYBLOB="000004000a0002"], 0x28}}, 0x0) r4 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file0\x00', 0x0, 0x0) openat(r4, &(0x7f0000000140)='test\x00', 0x42, 0x93) ioctl$KVM_SET_CPUID2(r4, 0x4008ae90, &(0x7f0000000100)={0x1, 0x0, [{0xa, 0x1, 0x6, 0x8001, 0xe0000000, 0x40, 0x4}]}) r5 = openat(0xffffffffffffff9c, &(0x7f0000000340)='./file0\x00', 0x0, 0x3f46137792f68265) ioctl$AUTOFS_IOC_ASKUMOUNT(r5, 0xc0049364, &(0x7f00000001c0)) ioctl$VIDIOC_SUBDEV_G_DV_TIMINGS(r5, 0xc0845658, &(0x7f0000000000)={0x0, @reserved}) setuid(0xee00) r6 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x6) syz_kvm_setup_cpu$x86(r1, r6, &(0x7f00009b3000/0x18000)=nil, &(0x7f00000000c0)=[@text32={0x20, &(0x7f0000000240)="b9800000c00f3235004000000f30b9fa000000130f01d9300d76c4020a1bf7b805000000b90000c0fe0f3cae0a41d941d90066b841000f00d0ba00e500000f30660fc775022e0fba600c983166b85766baa00066ed00d0", 0x57}], 0x1, 0x1, 0x0, 0x0) ioctl$KVM_RUN(r6, 0xae80, 0x0) executing program 6: r0 = openat$sndseq(0xffffffffffffff9c, &(0x7f0000000000), 0x45e882) ioctl$SNDRV_SEQ_IOCTL_DELETE_QUEUE(r0, 0x408c5333, &(0x7f0000000040)={0x9, 0x400, 0x0, 'queue1\x00', 0x7}) ioctl$SNDRV_SEQ_IOCTL_QUERY_NEXT_PORT(r0, 0xc0a85352, &(0x7f0000000100)={{0xe9, 0xaa}, 'port1\x00', 0x50, 0xa0050, 0x8001, 0x9, 0xffffffff, 0xc02, 0xfffffc01, 0x0, 0x1, 0xd}) r1 = syz_open_dev$swradio(&(0x7f00000001c0), 0x0, 0x2) ioctl$VIDIOC_QBUF(r1, 0xc058560f, &(0x7f0000000280)=@multiplanar_overlay={0x8001, 0x6, 0x4, 0x10, 0xfffffc00, {0x77359400}, {0x2, 0x1, 0xf, 0x6, 0x6, 0x45, "9cbce7b6"}, 0x9, 0x3, {&(0x7f0000000200)=[{0xb, 0x3ff, {0x401}, 0xffffffff}, {0x0, 0xe, {0x2}, 0x6}]}, 0xb, 0x0, 0xffffffffffffffff}) (async, rerun: 32) ioctl$FIBMAP(r1, 0x1, &(0x7f0000000300)=0x7) (async, rerun: 32) r3 = socket$inet6_sctp(0xa, 0x1, 0x84) getsockopt$inet_sctp_SCTP_RECONFIG_SUPPORTED(0xffffffffffffffff, 0x84, 0x75, &(0x7f0000000340)={0x0, 0x9}, &(0x7f0000000380)=0x8) (async) getsockopt$inet_sctp_SCTP_STREAM_SCHEDULER(0xffffffffffffffff, 0x84, 0x7b, &(0x7f00000003c0)={0x0, 0x5}, &(0x7f0000000400)=0x8) getsockopt$inet_sctp6_SCTP_STATUS(r3, 0x84, 0xe, &(0x7f0000000440)={r4, 0xe, 0x6f, 0x9, 0x1000, 0x80, 0x9, 0x6, {r5, @in6={{0xa, 0x4e24, 0x4, @private0={0xfc, 0x0, '\x00', 0x40}, 0x9}}, 0x7, 0xb, 0x4c, 0x4a40d37e, 0x80000001}}, &(0x7f0000000500)=0xb0) (async) r7 = syz_open_dev$evdev(&(0x7f0000000540), 0x5, 0x200400) ioctl$EVIOCGBITKEY(r7, 0x80404521, &(0x7f0000000580)=""/190) r8 = openat$binfmt(0xffffffffffffff9c, 0x0, 0x41, 0x1ff) write$binfmt_misc(r8, &(0x7f0000000640)="4ae41401e6392efb443a5faf9b227b98969171", 0x13) (async) ioctl$VIDIOC_S_CTRL(r1, 0xc008561c, &(0x7f0000000680)={0x10, 0x1}) (async) r9 = openat$selinux_policy(0xffffffffffffff9c, &(0x7f00000006c0), 0x0, 0x0) getsockopt$inet_sctp_SCTP_PRIMARY_ADDR(r9, 0x84, 0x6, &(0x7f0000000700)={0x0, @in6={{0xa, 0x4e24, 0x4, @rand_addr=' \x01\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x02', 0x7f}}}, &(0x7f00000007c0)=0x84) getsockopt$inet_sctp6_SCTP_RECVRCVINFO(r3, 0x84, 0x20, &(0x7f0000000800), &(0x7f0000000840)=0x4) preadv(r3, &(0x7f0000002b80)=[{&(0x7f0000000880)=""/118, 0x76}, {&(0x7f0000000900)=""/89, 0x59}, {&(0x7f0000000980)=""/35, 0x23}, {&(0x7f00000009c0)=""/163, 0xa3}, {&(0x7f0000000a80)=""/4096, 0x1000}, {&(0x7f0000001a80)=""/67, 0x43}, {&(0x7f0000001b00)=""/76, 0x4c}, {&(0x7f0000001b80)=""/4096, 0x1000}], 0x8, 0x2, 0xe5) (async, rerun: 32) ioctl$IOC_PR_PREEMPT(r9, 0x401870cb, &(0x7f0000002c00)={0x4, 0x87, 0xfffffffb, 0x9566}) (async, rerun: 32) getsockopt$inet_IP_IPSEC_POLICY(r9, 0x0, 0x10, &(0x7f0000002c40)={{{@in6=@private2}}, {{@in=@empty}, 0x0, @in6=@private1}}, &(0x7f0000002d40)=0xe8) write$binfmt_misc(r8, &(0x7f0000002d80)="7574eea135a0171347a96e20659fb96259becea545cac7ec961a9cb533eaee3d6863972bf3a873dc9935cd85c231505aa0ce95121b8035537928e960a3cbe13f7cd5304dbfb8220b54ed38648c825df75632a805fcdf74ec2ef5b236f451f9f87dbd63e8bde183a045f66f79a8de3c05c8f780df543263c15bf53b7c8196be8ff77076", 0x83) (async, rerun: 32) ioctl$F2FS_IOC_MOVE_RANGE(r8, 0xc020f509, &(0x7f0000002e40)={r2, 0x1ff, 0xe, 0xfffffffffffffff9}) (rerun: 32) r11 = socket$inet6_sctp(0xa, 0x5, 0x84) setsockopt$inet_sctp6_SCTP_AUTH_KEY(r11, 0x84, 0x17, &(0x7f0000002e80)={r6, 0x6, 0x4a, "9134ea049ac09aa717a22aebeb596977a3fa0498c086934cd3bd3d25da5d3c5c25a8323d627d83ea56d55c3b3a855c005dd7ed764068b00a86147f7e09e8740c86a859f53666c54f32f9"}, 0x52) (async) close_range(r10, r1, 0x2) (async) clock_adjtime(0x0, &(0x7f0000002f00)={0x0, 0x4, 0x9, 0xfffffffffffffff4, 0x28, 0x8000000000000001, 0x9, 0x3, 0x6, 0xe, 0x28, 0x1, 0x8e, 0x5, 0x1, 0x1, 0x5, 0x3, 0x8, 0x2, 0xc, 0x8, 0x9, 0x80, 0x8, 0x4}) r12 = openat$incfs(r10, &(0x7f0000003000)='.pending_reads\x00', 0x824081, 0x4) getpeername(r12, &(0x7f0000003040)=@ll={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @dev}, &(0x7f00000030c0)=0x80) setsockopt$inet_sctp6_SCTP_AUTH_ACTIVE_KEY(r12, 0x84, 0x18, &(0x7f0000003100)={r5}, 0x8) executing program 6: r0 = syz_open_dev$I2C(&(0x7f0000002400), 0xa, 0x480) ioctl$I2C_SMBUS(r0, 0x720, &(0x7f0000002480)={0x0, 0x6, 0x7, &(0x7f0000002440)={0x19, "0e8222606612b745338752553a42f61981a54d27ce3a4313c752f3f77a1c2155bb"}}) r1 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r1, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000100)=ANY=[], 0x48}}, 0x0) r2 = socket$inet6_udp(0xa, 0x2, 0x0) ioctl$sock_SIOCGIFINDEX(r2, 0x8933, &(0x7f0000000200)={'syzkaller0\x00'}) pipe2$9p(&(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}, 0x84880) lstat(&(0x7f00000001c0)='./file0\x00', &(0x7f0000000440)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) write$P9_RGETATTR(r3, &(0x7f0000000380)={0xa0, 0x19, 0x1, {0x3221, {0x40, 0x1}, 0x1, 0xee01, r4, 0x5, 0x2, 0x0, 0x80000001, 0x6, 0xa, 0x8, 0x3, 0xd, 0x1, 0x6fa8, 0x5, 0x2, 0x9, 0x2}}, 0xa0) ioctl$sock_SIOCGIFINDEX(r2, 0x8933, 0x0) r5 = openat$binfmt_format(0xffffffffffffff9c, &(0x7f0000000040)='/proc/sys/fs/binfmt_misc/syz0\x00', 0x2, 0x0) write$binfmt_format(r5, &(0x7f00000000c0)='1\x00', 0x1) sendmsg$nl_route(r1, 0x0, 0x0) sendmsg$nl_route(r1, &(0x7f0000000120)={0x0, 0x0, 0x0}, 0x0) r6 = socket$vsock_stream(0x28, 0x1, 0x0) bind$vsock_stream(r6, &(0x7f0000000140)={0x28, 0x0, 0x2710, @local}, 0x10) r7 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) r8 = ioctl$KVM_CREATE_VM(r7, 0xae01, 0x0) ioctl$KVM_CAP_SPLIT_IRQCHIP(r8, 0x4068aea3, &(0x7f0000000040)={0x79, 0x0, 0x18}) ioctl$KVM_CAP_X2APIC_API(r8, 0x4068aea3, &(0x7f0000000240)={0x81, 0x0, 0x6}) r9 = dup(r1) listen(r6, 0x0) r10 = accept4(r6, 0x0, 0x0, 0x80000) sendto(r10, &(0x7f0000000840)="96d103a989b3cc949eca7bbea746636b5732fa7efcbb3da255398c4b593a74a4f8ae8e3ab7ebecadb627fe194d30fc", 0x2f, 0x4c000, 0x0, 0x0) sendmsg$nl_route(r10, &(0x7f0000000160)={0x0, 0x0, &(0x7f0000000700)={&(0x7f0000000240)=ANY=[@ANYRESDEC=r1, @ANYBLOB="9917b3e3d667ad4fb89945d35ea7e5652553b9900edc23169afa1454cbc8025749d71f5e0cda2f40a6e711de4287727f98827c36e8423d1c9937e932d07afe67580ad744e29509d21fe503335be00cce9df12262aa92d3e68b15ef43897134394e4eb6f1271daba92d60a1198361a1dd94bb01392883ddcd29b81ed054d6d0ddba59af8d84d9ef98dbf18735fb03da487a586edb2ef702ffdedf"], 0x34}}, 0x4000041) ioctl$SNDRV_PCM_IOCTL_WRITEI_FRAMES(r9, 0x40184150, &(0x7f00000004c0)={0x0, &(0x7f0000000300)="d43a29a27b2c3e56494b80206cbd846d22c0688c0fb9efc10d23054f8645e55e2dcf1501270a7324080ea7ec29bbee35cb0d08491992171f8a9ab4887322f6282a7a0698dec6ecafdd2f9896a23ef1d825d80fe6844e3d45f2f4035796d094315fa0cd3480424c68d8d7", 0x6a}) executing program 4: r0 = syz_io_uring_setup(0x24, &(0x7f0000000040)={0x0, 0x0, 0x800, 0x0, 0xfffffffe}, &(0x7f00000000c0)=0x0, &(0x7f0000000100)=0x0, &(0x7f0000000140)=0x0) r4 = openat(0xffffffffffffff9c, &(0x7f0000000200)='./file0\x00', 0x442, 0x1ff) (async) io_uring_register$IORING_REGISTER_BUFFERS2(r0, 0xf, &(0x7f0000000300)={0x1, 0x0, 0x0, &(0x7f0000000340)=[{&(0x7f0000001500)=""/4106, 0x100a}], 0x0}, 0x20) (async, rerun: 64) bpf$BPF_BTF_LOAD(0x12, &(0x7f00000005c0)={&(0x7f0000000940)={{0xeb9f, 0x1, 0x0, 0x18, 0x0, 0x18, 0x18, 0x2, [@struct={0x0, 0x1, 0x0, 0x4, 0x0, 0x0, [{0x1}]}]}}, 0x0, 0x32}, 0x28) (async, rerun: 64) r5 = openat$sequencer2(0xffffffffffffff9c, &(0x7f0000000d40), 0x0, 0x0) ioctl$SNDCTL_SEQ_OUTOFBAND(r5, 0x40085112, &(0x7f0000000d80)=@v={0x93, 0x1, 0x90, 0xb, @MIDI_NOTEON=@note=0x9, 0x2, 0xec}) syz_io_uring_submit(r1, r2, r3, &(0x7f0000000600)=@IORING_OP_READV_FIXED={0x3c, 0x0, 0x0, @fd=r4, 0x0, 0x0, 0x0, 0x0, 0x0, {0x0, 0x0, 0x0, '\x00', 0x0}}) (async) io_uring_enter(r0, 0x1, 0x1, 0x1, 0x0, 0x0) executing program 4: socketpair(0x1, 0x1, 0x0, &(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}) r2 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r3 = syz_genetlink_get_family_id$nbd(&(0x7f0000000040), r2) sendmsg$NBD_CMD_CONNECT(r2, &(0x7f0000000400)={0x0, 0x0, &(0x7f0000001a80)={&(0x7f0000000480)={0x5c, r3, 0x1, 0x70bd2c, 0xffe, {}, [@NBD_ATTR_SIZE_BYTES={0xc, 0x2, 0x2}, @NBD_ATTR_SOCKETS={0x28, 0x7, 0x0, 0x1, [{0xc, 0x1, 0x0, 0x1, {0x8, 0x1, r0}}, {0xc, 0x1, 0x0, 0x1, {0x8, 0x1, r0}}, {0xc, 0x1, 0x0, 0x1, {0x8, 0x1, r1}}]}, @NBD_ATTR_SERVER_FLAGS={0xc, 0x5, 0x128}, @NBD_ATTR_BACKEND_IDENTIFIER={0x8, 0xa, 'nbd\x00'}]}, 0x5c}}, 0x20000000) r4 = syz_genetlink_get_family_id$netlbl_calipso(&(0x7f0000000080), 0xffffffffffffffff) sendmsg$NLBL_CALIPSO_C_ADD(r2, &(0x7f0000000180)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x80}, 0xc, &(0x7f0000000100)={&(0x7f00000000c0)={0x34, r4, 0x2, 0x70bd2b, 0x25dfdbfc, {}, [@NLBL_CALIPSO_A_MTYPE={0x8}, @NLBL_CALIPSO_A_MTYPE={0x8}, @NLBL_CALIPSO_A_DOI={0x8, 0x1, 0x3}, @NLBL_CALIPSO_A_MTYPE={0x8}]}, 0x34}, 0x1, 0x0, 0x0, 0x20000000}, 0x84) mknodat$loop(0xffffffffffffff9c, &(0x7f0000000140)='./file0\x00', 0x20, 0x1) unshare(0x6020400) acct(&(0x7f0000000040)='./file0\x00') unshare(0x22060600) socketpair(0x1, 0x1, 0x0, &(0x7f0000000000)) (async) syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) (async) syz_genetlink_get_family_id$nbd(&(0x7f0000000040), r2) (async) sendmsg$NBD_CMD_CONNECT(r2, &(0x7f0000000400)={0x0, 0x0, &(0x7f0000001a80)={&(0x7f0000000480)={0x5c, r3, 0x1, 0x70bd2c, 0xffe, {}, [@NBD_ATTR_SIZE_BYTES={0xc, 0x2, 0x2}, @NBD_ATTR_SOCKETS={0x28, 0x7, 0x0, 0x1, [{0xc, 0x1, 0x0, 0x1, {0x8, 0x1, r0}}, {0xc, 0x1, 0x0, 0x1, {0x8, 0x1, r0}}, {0xc, 0x1, 0x0, 0x1, {0x8, 0x1, r1}}]}, @NBD_ATTR_SERVER_FLAGS={0xc, 0x5, 0x128}, @NBD_ATTR_BACKEND_IDENTIFIER={0x8, 0xa, 'nbd\x00'}]}, 0x5c}}, 0x20000000) (async) syz_genetlink_get_family_id$netlbl_calipso(&(0x7f0000000080), 0xffffffffffffffff) (async) sendmsg$NLBL_CALIPSO_C_ADD(r2, &(0x7f0000000180)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x80}, 0xc, &(0x7f0000000100)={&(0x7f00000000c0)={0x34, r4, 0x2, 0x70bd2b, 0x25dfdbfc, {}, [@NLBL_CALIPSO_A_MTYPE={0x8}, @NLBL_CALIPSO_A_MTYPE={0x8}, @NLBL_CALIPSO_A_DOI={0x8, 0x1, 0x3}, @NLBL_CALIPSO_A_MTYPE={0x8}]}, 0x34}, 0x1, 0x0, 0x0, 0x20000000}, 0x84) (async) mknodat$loop(0xffffffffffffff9c, &(0x7f0000000140)='./file0\x00', 0x20, 0x1) (async) unshare(0x6020400) (async) acct(&(0x7f0000000040)='./file0\x00') (async) unshare(0x22060600) (async) executing program 4: mkdirat(0xffffffffffffff9c, &(0x7f0000002040)='./file0\x00', 0x0) r0 = openat$fuse(0xffffffffffffff9c, &(0x7f0000008300), 0x2, 0x0) mount$fuse(0x0, &(0x7f0000002080)='./file0\x00', &(0x7f00000020c0), 0x0, &(0x7f0000002100)=ANY=[@ANYBLOB='fd=', @ANYRESHEX=r0, @ANYBLOB=',rootmode=00000000000000000040000,user_id=', @ANYRESDEC=0x0, @ANYBLOB=',group_id=', @ANYRESDEC=0x0]) ioctl$KVM_CREATE_VM(0xffffffffffffffff, 0xae01, 0x30) syz_fuse_handle_req(r0, &(0x7f0000006300), 0x2000, &(0x7f00000041c0)={&(0x7f00000001c0)={0x50, 0x0, 0x0, {0x7, 0x29, 0x7, 0x22110079, 0x1000, 0x0, 0x7fc, 0x58, 0x0, 0x0, 0x6, 0x8}}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) r1 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000040)='memory.events\x00', 0x275a, 0x0) write$tun(r1, &(0x7f0000000340)=ANY=[], 0x141) mmap(&(0x7f0000000000/0x4000)=nil, 0x4000, 0x1, 0x10012, r1, 0x0) r2 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000080), 0xffffffffffffffff) getsockopt$inet_sctp6_SCTP_PARTIAL_DELIVERY_POINT(r1, 0x84, 0x13, &(0x7f0000000180)={0x0, 0xffffb999}, &(0x7f0000000240)=0x8) getsockopt$inet_sctp_SCTP_CONTEXT(r1, 0x84, 0x11, &(0x7f0000000280)={r3, 0x8001}, &(0x7f0000000380)=0x8) sendmsg$NL80211_CMD_START_NAN(r1, &(0x7f0000000140)={&(0x7f0000000040)={0x10, 0x0, 0x0, 0x2000000}, 0xc, &(0x7f0000000100)={&(0x7f00000000c0)={0x30, r2, 0x400, 0x70bd27, 0x25dfdbfd, {{}, {@void, @val={0xc, 0x99, {0xffffffff, 0x4}}}}, [@NL80211_ATTR_BANDS={0x8}, @NL80211_ATTR_BANDS={0x8, 0xef, 0x2}]}, 0x30}, 0x1, 0x0, 0x0, 0x1}, 0x200400c4) fchmodat(0xffffffffffffff9c, &(0x7f0000000000)='./file0\x00', 0x2) syz_fuse_handle_req(r0, &(0x7f0000009380)="d5c2280baf4e05cfa1d1112770cf43a123827586f0f2675b130041ff58ba6533ea7947f2f65b1d458fe88a96133ea3927f41fa6976fad8c967c88679769ee674b80debcd1ec6ce1eb490888bd66a52141fa82f51882b22a8e36ff462b51560307cd0048156800ad137f359719a9c5d6ad6a8c999984f22461c4ca6614ca4cbbd5e9103a3459228e3bd35e3c1cd5f2a83fbefafe7c5a39617ba1d856f37977da077ffcf4d52f5bb3feffa9e100b0279cb635a61ae9f5f4491bb1c9f04c041818a1ae9a25cbca38c4b4754a8be4f52db20ca464b3b4faf0ea8ff193b414e7b7a4ec8aec2e77adc43d09c62d37fc0aa6296a56a9445f264a245d41e77de43c2694cc5885ebd454a3b78b60172e3e6a2fd79efa8b5fbbe827512aa0656920858da51616244ad32e53ed039a270c042662bc966a8fa05e23a51c76585a6f753e57c63b5a1dd11c4ce8773702c5c759471b79ee9bed600d99853afda9b675f071bdf6ff4eb99cb1ae0128ac1f8132f9b7bef82221276395e59f1323c9f9f6bb937a9db0bc2088670ffc3e6233ba73d4e324df7bc866e84e82ab707ab8aadd593913dd3533cddb396e804a63155ad6911962bc49bad21faba90b5570b62d98eb5328214a7198b36ea6df9a72dc248311040e01539112e1d6bcb4ed9d7fb70d22768ec6603e4727b6ed2616eb9108524985ccd70f1361f68b1fb7088829acdd59ec5af9e84409737f0d852a3c55993cb7398b5640c458bc036115b86de7b8e68f1cff882ee5707040571c3e5c9602c773459cfecad4917d8ba2902bd64a676e2c6e507d06dbc806c13c0fd18175087440ce7d7300dfe745b8e98ac63b400e449a3f2518c6112c9864fde68f580ebc2d72e4bbd03f16a7289be813c258b02f76ce901afdafc69046c947c9e801ac635b2a95cca291c052c7f8149c92aaeaab41edb34a70604a7538c4bb6486b983416843fe6a65d7b828d66deb991e71526b7627e71c6a795a02e787bc561ec4b65d4742a129c59bc71b323850cb416f3d32494d6dbfe3ea73cb473b093ae0b0ebbbd3e3251ece756b3cc381f05ea1b8c3f7fbcbb16fc446fc084725e6c3a608221aad8d8179112f9e5ee3697346a0dc0645e530df523cf4daea14764c25da2da863adebaccefc2c83a9257b3131ac2fe04a27bf3aea8979b6f3091b4fef99e203725368d297bad3b020273d0b606d2368e2ecb0776349cb86bbcbaa5c910636527e3cbeca06b4135170d8808c5f113fcd77ecb2f099d1e663617a46ffc5275c8fcc339d315ca1583f66fe7a7e6430405c0be889826c07fcafa17f04e08bc39570a1f499092d390c5dba82d259f652307ff941e9f1f569a48144da846f14452df295553de6ef4e9ba0cd98dd16cf89d8bead08eacd4eea71cc5f8232349f2d8519b1172c724d3bbc415c19c9e679b5a96bc9051cf6f243f243366622023ab1b7039a89152e7db97f291bb3f0213c445c25caf5f0a5a2b382c841cd8a490dc97d008966e94ed0b5ce07bcc0c13b39c349e4b596147a633f3a73ab6012a1582d3d283293bd7c01f99cdbad8e18d24867c39ed0dc3fc3cc800edd23af24b225acb2cca5aa264bcda40e1432cf2cc0050efdff48fd49ae4225a983d1b12facbaaba73294eb225fff64a677d0ed2cd71bab61b3fde8a1fdae638d2036283a8a4ff5a548d05cb706f56ce7e3f55a688fa6c70393c53c33be11f34a38f61f80c8e94e50fc9d7c3695d234705bb9e0b2a8316cf54d7963f548d49f153bf796d0970ed1264c19d79eb77fd0aad4844796cec73a08206b9eca76f2ad76318a20d52e7d3338eac40d03775cca0c2b29a451cb10bc141289c2703198e7137200a360463000fab97d0da72a7b4e8aadfa8a2e559a7d06bf49d6d4a932cb29994ef7ca0c1beabf05b898bb2338e89a67373d50614300f13523fe451d4058e5a522d364ec884099ee3c6e6db8d4ec1e5dc08d127b6301a308a1d6798878c28ef828b91b529a22b7519d249a189a7eb942b94ce26148ea8bf16a44261cd9691ba980ec2d0c710dbee41756cb39b88213ad5763239ae7636e983580c41a40b0f3a3af9fa6f995ed1981d073f63a623554bb01869bdfda190bc8d9507cc067b897e1c5f0d087cf8dfcb171169541fa3cce7c3a620544c74f2d3234935a0acf6c804c43992812925cbaaa24f497e7a00efb20c45c7acb80adb3322cbe0f08d1015b40f5ae1366003ebea977b7b95f803487d10aedca3fd018cfa7b267dae604ed0ada202cbebd731f86b7c6764911d4ff0c75a318ee43b1b556781ac58fbd773b2bd0dd693f9b12fa149bbe392cb2d6bf72015912f4a120e47654d42d14107c67b4502b5ad62044d0022c7f8b255a3e46da4bb8f9e44515e4076ce7b1aefd57c4e264b2cbee4a9e8612ce8517b028067644c927a9ce7564449c8fb0471a87b9b76f374c7c2559379a3004326bdc91be5ec52672dc5fac0883ec527f2a1248601bb9267c3123568b815b90b40ba06c250e3068dee2d7fc232141eaaa130443a5775d049464ec454a7c980d9eebaa4f67a75075a6bc28ded9a5f07fe658a2b9eafa37f14055155409d1aa50be6343d13d515d0531b84644d2f58c280d6d008dee95607f67eb74c900f664d97f411f4ac6afc18f11b6fb75e78b3ff25680ed3bbf5b20969678475b86faa02a751e4cec87735645753f245047371c9e6e2e7ab5a9ea3182b4c96934a21b9df3628b478f5ef705aeda49a0609d4b8f5bf34424581557d029438306002fd4e9cff5a2d4e7d5e23c2992032d314b8fbb46ccda250070fc1b679c9c8646c5fe22d8fe2e0fff73d8153fc46ef7885aeaa2d1eabbe455544d46fdef8e3ef9debfe589870942bcc7196e62736e927c311782b5e4da2889d530a7c1550bff4909d2055941655cbcc5c924a477c80fc3b8a904cd9e62f5fb005b5b00154db5becbe327c0f3ec8314ef3fb53977ec24ff7d15aa83a13b23ab99c5332306023005d2dfb70d3ea2aefababd019ae16d304c083e38997cc94bdeb746fc151849c98dc2a23554e6fe789d3aba8bf4e31133c7f93a3cdcd884271dfdd2c45be398a5349ef5d08456178dfafa31cb4c607f09394d71b3405b3d615c7c59c125db88f72380140345d24c56094711dd833221d6b7c5864d049585605c1301c31982d19e403b601b797fe99d0bbfe30d647a913da72b4c5306f6123e7c572828308a9a8f4c686d07125d0006229c2e890ff7d3c354dde61ccd3b26069a81a98e112e61a930f253d607cda5023f002a09df6b1371638d9661c5a06bed166434f07120ad21476de8ad47296af4b449d581cddc74f9be42a84596fb0634f330a856216a9b32b080c8b66e9f51a758b9ca2e1215ddfe633714ca512032f6547217b1a60fcdb27ac8a04bc7851718b38607bc92c13118a323c3221bad99a8639762abcc4a08654da9938aeb301c55546f5ae7f61439dd883a1b2dede156a57c805ab12337d5381a2fb25b32916a8827fc4de8e2ecc70eeebeb01659d6bf88055477b863fb897d5db275a0c222d261e7df79474858b721e57747fe8997faaf36f5f175b23dd3c5efb2b93fb5824da18d635cd7027a3b0b1c87e7c90a5681682b8a7c47dc82fdd3f329c7b60270100dec8ccdd310245b92f4b0bd9a92e1f2a5733b1b91966be15a4761b06f6fe3b05b60ee7964b4d028257c2210ca88031db0590190d3714c1b6ec86e2821dca03db2fc0c9f0ad9800d1773c8037e9b38c7eb7c99618b731e0526f8453c7e1bb67cffcc2d96cc297e1f917b13dd7dda2a8b12191ed107c1e076ffd4965b9415f830be97935cac23a87f07e26354273c2663c7ef19a27dfe08543fa057e1285c909051602981f5929078214058684bc80bed493f6ef853012cb654d180e414fd484f5cb2cfd06c9b753f417697ff42794649e05fcaa3d53ad0fdfbb0db57dc549115e59978b14dd621370d136176098af2f39a2de72482a29b616e8b308b3d9b46ac9abf3d57ff89fe59b5a97966cc4b97d06c20ee4fd765e1c2abce54dc271a7c7efe656648800c27a9988583b4b76572222cb28916b9ff5f6f649de93923179809405c879a90cb450f604cbe8af55cf2a6d844a59ab0393b394e09c79e1b3c403af6eba69330f6969f78a49eb7022e77a39363f11e07fcc69f670f63c11497352f3f5bfea0aee446da35428cebe28f1c2d23ef3ff97e16ceeb2f88ab19b2b69dcdcc81b947b483cc06c776c52232489f86f4c377eb38056042e2e9e0943fc0ef1490df472b9b244235598894a2ffc296f0a2e4257baca6a3ea8cfb1a22ea8295ab9e5faaa2a9e964ae7625dbf945cdbb369265f429d475ab69413cc5bcb89af57b1b966bd0076f799a401d4b46e5045aceb1ef36e5bbfb037bb7681f2a38ef1df9b84baa3598201d13a813165355bf052bb5e456dc0abdefed995b4eb37a39b313af800f6029243a6a7bec75a23389a90034cac8df6713b919028a14649d756d0093550278aad494de2dfeb76220fd3ee5be31f73839ace7f0d6da650e26f5ded30471ed55d2e814fc1b89102e5917b4e58840ecc211eaffa5a2937abeb882ccdf29308e3ac30e23d66ee79c29b4fb7e793a55e344cac298e30f1ca3333df8b58f43126a3404a61501ce06b75e6e6a4bf13dbfb05efd7b9b4219efd428c8f7f345884640d19f5515abcce05f315f00e65d9aa8022890a23da45ede06f455d66e0c96bbf7e9cc74eddca999a51174b4784eba8a9ebed13415de6bd0f160443d43b78181cfa381313a54e25f6751a38f290e5972ff7f70692e18c4737af2a7f6d4eac52ea594a22be4fd00fac1484e6d2d4d3196b49212b49598f5bc77b34d8a3633cf7212c869557d6eb27bf0d0a02555d9318194e9de9c9730ac72daee7cad6c2d4b248a8744515670766a8f1c739917fb859d98974532477989f4c24345f120f5320fdb8d8d56fa6ff2511e701bab399513cecb3e740e3761d02685a765f5267554d0f9243b51620197adc3b561b59c58f334307220db357c1121d7dbf593898b5d2c505f333445c084a6cbc6a7e5252724c83fcee85e304534780a01e7ecceb2ef53ffb6bc6cb9051b1400493ce55d62c01e972fff3cc7d0b68a2dd4d263c9191df1b629e323797f570083f122db3df6abb6fd6c4a351bb7500c7241e4392ac76e04259968e517a43e907cb0b0533d6750b9587a1a5d852639c6b789d333e848e3ad66cbf19c5ee5a641036cb7a858f822f657dec36cc134d6c1a629cfce1f1e24dbb73d09fba04f53b2c6309d71d92211a1f08535244eefcbb52e095626bcc78b950db1cb8facc3660fa705dceef155b00aef3291367ffcea06b5abe588bbdcea2637761308dc65509798b6a494dae4a75c1922c1234248dbfcabfaab3088a0dad09a135a45d75105314020f3ba8901dc39ee624a32e9f863ff55844974b44e57b30302cd0c349f3cc091befd5665f918c298ba89454fb811ce573e41f27490853a52abd6144e85d77de88c3f2e5506c8de40a3957e65936f3b294ce92610b63cec888cb16fe0e8a7af3dd142da96b57f602cc64ba69966724584c2872e5fc42348a324ff082a3ecfded82c3e5b7292d3726c4800176acab6a7a1479a0b5fea79f299e90ffdb1b3843e2349b8f8dc7881145b3796380474c2ceb57e27726c9e50b746a2b12a214fea9cfd6c668363fe6e402710665118928fedb2f4900322b0c7d2c348881ea52278dae765c14b51fd5e8f000602aa3978d83b76056410c2260931e35d841793c8a36b191f93c33c0e4e6367ef45a1cf5145d774861224afbb11a7b77bb94492ec49827f713f8309d80d22e17701046e04c5b277f7b423cbbada01e6d40beb56e755e583b8f3de4b67c4b5ac83771b805fa7af49de2fc8b9a223293d83e7eb4eea3a3af1d1221e5d458e7cab60eaf1b51550a1b125ce018d76096f16d922f4aba48a728ec1b7d4812fe2ca789261b6d8e0c8edb3ba9007649084899c4f6b7986c1cb4a98d412c801fb91675ee42e2bb511bff6700772d3c03a7cb6adb41cbddc33053f8f65c164e9bd47b931510046506b169216d0a04edc479bc51c28acc536ced3834a7a9ce8fb55b72fa186a559437bf41f04b733e05986c915bc19f1b2f99d3bae6c13873d32e3c809b71881c3075f8dd1746f36409ac7934c25236ee2752560fcdd5175037a6fc5f0da58a229418ce30f3e64f9eb6ff3fe4498f47fdd69ceac5e792c8c9f087316f334b7f75e3432d3f1d03ee97c8f16485ec906c94e6c9580f7d03d98a8da85ec118b77c6c1d3b2e99fbf4b45e66cb4f8817f786d1f90e1e5e250be8c240a9648a219a02e62acbd72d1b0c0b42c75065a35664ea6a03cb05ea179f2e8e50e3d7ed53d31cdc10cf5fce48781fa338e3ee819f410540f045cb0edd7b2d219993faaa97cf95aa6144e889a02069421291d05eade30693a751039fece452c22d1afba081d1c40178fed7684cae475fcc365484118a184670cd7aa2758bdb01058ea9b244d5241f627bc5be11c9395e3cb839b0eac7842a312e1fc8b4ddae2aa4ef907ca5c9b847785051323e16d5497c4424289496277475bba67da750fa05bd8be730e4aabaeb94641fa2263dd3d4eb511b4fa40b8cf8b16d7aded1163f2258add79b04e1eb888afa27d057de2523863fc2da38d44cc69ae2d455900eede5fce69d7e9f8707cdb2456a45dda14d257eee4982f86259b855a0293068aa4aeff9439bc06c8ed5a370fe46fa88fa9bb92872166ac69152d1cbb4720eec5b9a057890cbb838aef12091454fe721395b46f9fa29ec1829fedf65aaec1176bb9eb15511bd77e7d4fe7321b3e0dfda95e5c90c3663956477885d6d94b280f58edbc77e864dca73536cd4988bcde2a3edb91704ad59148d85a001e393cebdb56ee088fa1033cdc6fbcbea30e2974035bfe29cee1eace13e30950bb4658886dae7e565ffd7b71e41feecbcac35fd97c81a8fff9d2a1d43f183c6e984671e06645eb0a60228d1b6c12c28bc6eaa4b9125c57b48ced2e199ed3acf12dbe10af4a56f2f5dca829fd07fc3f7e0de6913c73be0ada3e43bcbe70de784de699d0b51d7a56a3eacaf5d7dcd77d73cfb82e04633574213e05dc98850d822bc6dc90dc3fd6184296287342e2243fe6f0cf94e6d02a1b900d0c718e2afbe7fea2fafa375f209fb9cef5d844b861a1029aa3dd7081e81fe6501bbb413dcd23e013f279ef87e082335ade324b7688054992ccc63fbf9153213ab6d07ed0b79945d19639aaa5dd10e53aafe57f1e323300246cb1d6ede1eb1f319ca6fe1b0cc8e733b34818425888110b6eabe2db302310d0a8bcdd5342146b29c535cc9a95a455c8926d77323a31b948d47dc611815a329654a252fd09dbcec5f3cd8bc7e465759eb8e72ff6fd4ef1f375e4e8762a58148622d14480b7bb9aca2eeab3367a7376c9c85e6ba1735e56a2fcc6baf92c8d21942883f318eab7a568fc7ff01885a7089aa7661b15d73799bc0b8f8ce6a3b61adb6949965a223850b6825616c036e099952e04fde7cf086b5e76d45b86ab78b322f9af580173f2e798a39df7cade0d365c9d46d3fb36970f8a99d7b20a1b275afff852126f21ac24ca8c34deb49ba511f4d9edb4f56941aaaa477253f9bfc9a25a2694bbbe3b917074dd4eb6f1be20395ac33dd932a7ccf0604d64257b5af3faf271c145c190a528e471a7f23a53b5f9ea1bd0cc36410e9c538e91dd01d162edde856087b60dcba2042e65b6ae7b81787bd3308db9eb025b6fd930a9eb74a30883b83cfa8be5270dd3ee3408db7f7b136adebb3ee30f0e0b8835a0ded325363e4a2991cafd4a73483954c0f5d3358b25780608fa48f3f527c7e617ec12eb017df33f5088676d8bc476da251e608394e3d8fc0883fd4d1804f8e07f5e12ffa4ee80365a88abf29936bf1b255539fef95f5cf3bebcd26817edb28e7b6adf4851dcfe8aa1aa097f67c51557326ccf9c46ee2780d491e87774324d4dcf26f2e472a5e199b0cdef01094ea72bd5ad5fe1be6c9d545df3dc5de550665d220718a2c0baed2833cfb1428e2d1c2b9ea1e29f4b07fd6c51492643d4000716cd1e8a4f9d58b6b04b805d8962495323fd62949b17348418201664c6f2f651f99d73f8d17bb5e52dba2e6f94fa33f816d74bb6a45bd6cbdbd07f530406227c8fd11f390e805bbc17bc0e81076a27c0be023b64777afec0a7a0c3f53f03bc2ca72ae2873d68217a1a6905f414c2cb1b9561dfd07850a026da5f5775a66f8f3a6bc29b48c8a81b06ba30994ba8e7e233e3a3a5d886767ea6de91fbfc0a594c2375d62e71c7209d87d0f6c7a79a0d80da328e93f08650ec745495c771410913d094e4190075b7225761172eb420c82ab493548f6de38e17d3e687a89ce77c67c58b875c48c8a4d1664cbc6f67df357e040444fcd515d92d5823fc3ef6485208b6f3eda8cd09ea3b004f7eb06ac268ae8c3bf571aa3f619222a47540f9af340c80c587f7226e3d715b18c3ee41f64777d3a0a09f32190ad67922f6ecc63c956a715c3c42a6aaaf5e588d119210083ceaa414820b62fef87a678cd3f24f8fa3cdb6629b041cd7555974313f56d1b0e117ea925dc95e18b5d3f4ba9812f1067022945c3f5d547370d45853c4db3c9ca4436d7e649e1ac3ec02f9c1e9139849b46027d4b276cb0eb4b09848999f466f528290e47ba9540ceca89390db3fcbacb1d566e22e917f01f4442bd4dd0d350d057ffdf5b3549ca559901e6ff5147bdc25c11b23f1678f02c20e4e2e6f339b262e2b82eae0b15b4227f1d514f99ec78fbcf80c8f6f243536f2d7a809de05ae5e1d676fe950ad3513f801bbe4d16737def4b5ec4b62f8562cd5432bd372645202edeb286662d7e8d0dadac5b91c903c2756bdc4f5a7c931f2c3f7feace2b83f5459a196000e2ed1e1b2accaa9d637d5e408340161331c4b0047bf2ab31d317bb1c8f6e1b3d52f9f240bd971a447942dd4b73301781656aad9ce9b01aed907b7eb3a78397b97e601b04a4cb028d327ef32cf20c34e8dad9c9b1f981ab5c06a2b0271852e2a1016ee460d8568391c9ece5a2b8f29cbc6f2d6cc2e66c30c96df548e67dd6ad8c1ff09dfa22b2e8b2c52a3948c4febb09e3c2d34c0604a5ef930cd53be69a4bed9c9ee057178ece02a6b4df4624191590952888bdfafd2dbeca128d500872a8b236fba9623672c4dc15f56a761ee0c54026112fc464f72d3039587f009b94930dac0dbe444a939b38c0f5bce7aa366bfc2bb909db231178228846f71a56ab219e28cef1b102c1bfadbe8f0916d10a573b8cb38cc2cc2ec496a410a4e82847006d2ed4bac927a63a00416d0bfce59cc69aaf78ddc9566f23582999a655c8ad3b217486fb5a037ce089baf344d55bbd475be4e90b10e92c9c1bae3202c2d63355549f0ac95058724fea81ff9cec027e7b93e2cee43af81c6978fee5faf6216118785251b8ca023115b2f87d5d4b10c29aa3616628ab40a8ef36668ef57d7f9be505eabc01947ca222362818a71b3d63e5725a4d8a2c619b1867f70daa07703360d026d6f65247330be1ba84ddaaa7779591ca261beda4f4c094af65c5c276fe3bfb89f067c8c54af67e78f61bdc114ed4aa869c3adf282d7a8e7272579e9fd9e47611e0dc89f97561110e0141c69b1fa114e27b3d1e2c825ea008a370e08cd0a0610edef20cdd8a7cda0922fff046edfd2ff391a10ffce5dd6045619ce9af6b03f4193d858a76b201ed5beb0f11321707b7b593b23adaee4a0c0caf39dfeebcbd2948030435dc94ca00990c728502ec4686194f0f454304a422023c1b2c5b1ebbcd8cd50fa2d11361e3bbdc306e2739e27de300eda27b1c1ea62d773104cea77c18037c6bcc76423621b45abbe789b384bfdfb46efa1627ff29d9d840bf6e1f05e7e13fae6383e42ce153dcb062fa0cefd0fe9298ddbe77fd78d7036b5a815504b48267203da08ca685bfe8ae89c031074bbe5d3d6dcc6a3a8a8a4d3102765c3b714867f4516df62f214351b97bb8b5697a9f9a9dd78627342b239c524a3943d1d70f8cdd7391f05e7395731a8fc05210c6733ea256040bbbb53389229b84dafaaa3db1d5eca2971d9e550149461f1a672eae2319a99beed48934520666bc54b63085a744b5fc9a9b089b16c50ae945f74adcd4c5d064a12a6e103ef59bcc035a755ad31836eb7d04e5900d3800c822b96b466a9f6611f46b8a7d6131f91c625a5604de5bf01e5ca5d99a714c8dc1160260010f8d55f9125ee453b61c911bdf0824caa804c76d6512802875c5433de9b2e8b6c579a67fec5d2bc64ed3d1c313854221b75c9a0ed42af6f5354e7b1d1bf8661baa1261e68fc20d14b5652d25a536f208bff2b90fefa163a232696e655bcf95bed39355ec865e272fed582aae18858f5096ece40b9108efb00147f9c2ced59bfe2a79826851850ed95b35908dfb4d9ab7da0668a1fa8933ac4f6534e9598481477791fd1a1c269011ac9fe81f0491790e8aac121ffc00e38a7619a1855e6899abc2c670375a3ba4ac0cf652da89a70628cee1a35ae17b3490102e3c88ca324d06fce2151bc9de49472cf6e76ccb16d2a9cbf4161812e2c7758d73631024190fe9b71935de6968b289d3503b497f3f4b6306446ae9c312f8f1c63c1f7e62652173d9ed48cb128815bd44a12061f9b73fbdc6674ab9e0d01807f7bcfa0aa59168420e5ad8b72d7b576e273a1d229934fce2867689a41cb17767cf9defe1a96515a677ba08e10e187a3ce2f1d78e6b43b0d46c36163a1967b203df4f53379ee98422e973ab5c090adff21b5cc84fc78358021f681a0f0fd744f687e4f6c295470bf8f548d2d3dc841481dd51db9124cacde83bc9fef44a3e69e1cb28579d897f3013ac6133395328247fdcc152e5563678258936576196ced017c79bb6a4ea501a44cb25e5af1697afbdb3abb316837470ffdbe985ac3967334a90731602d3fac4f5c2758f04ec9c161a7cf330b7c7549fb62e6c15d07a7203c94edd3a8141c91b2029d6a90b14322337e6610822d9d7bff58c10d9c6cff71822f6456a421a65fdaa5d2c793f256a4e7a39f0d85d65fb95479eff79345c0615c9bbb4fb3324f9360b70dc709b0200042e8461b8cee9ce30beab3e276df48f41f001262fc14153f9764e13b50397442e00d7b11266bde10a3b7f83818086ff0015409679e4472d9e0215804fa9d21cebfa5cb5099cf88750cbeaaf58c2743f2746ea4cb73760ba88a07b91b68553716d563af5d7702219d0c600916dc54242d825c6d68320baf234a39f0b9ea9e6a4a72c4d5829b2f28508f54b33c7e0394a43fe23e7940d9b04bbe790d903a2d2c979e0ea79931b934d094fa2d5948c05cf278c341d788f2061ff617c9fa4700b1e1f0fbfa1b8c42848f2ea01cd318a8748c3336622ead25527ddbcd8a12ba3a5183f4419deb13558ed0ec99e73448c21ede0dbee9c01fc7675e54c60d4dee29c0f8fe81af6fe7b726f5d3c50dac634aefbf1ca6aa4df1b340a4109acf30939f6094c8591218729788111bfde98cd96d4b04b25bcd1bcb7f826241995573bae", 0x2000, &(0x7f00000002c0)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f00000003c0)={0x78, 0x0, 0x100000000, {0x20000, 0xcb7b, 0x0, {0x5, 0x0, 0x48b, 0xa, 0x400000000000000, 0xd, 0xfff7ffff, 0x6, 0x101, 0x4000, 0xffff1854, 0xffffffffffffffff, 0x0, 0x3, 0xf}}}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) executing program 0: openat(0xffffffffffffff9c, 0x0, 0x101042, 0x15) r0 = socket$rxrpc(0x21, 0x2, 0xa) connect$rxrpc(r0, &(0x7f0000000000)=@in4={0x21, 0x3, 0x2, 0x10, {0x2, 0x4e24, @broadcast}}, 0x24) sendmsg$inet(r0, &(0x7f0000000180)={0x0, 0xfffffffffffffd6b, 0x0, 0x0, &(0x7f00000000c0)=[@ip_tos_int={{0x18, 0x110}}], 0x18, 0x4c00}, 0x0) mprotect(&(0x7f0000000000/0xf000)=nil, 0xf000, 0x1) timer_settime(0x0, 0x1, &(0x7f0000000040)={{}, {0x0, 0x989680}}, 0x0) syz_usb_control_io$hid(0xffffffffffffffff, 0x0, &(0x7f0000000500)={0x18, &(0x7f0000000080)=ANY=[@ANYBLOB='@'], 0x0, 0x0, 0x0, 0x0}) r1 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$inet6_tcp_TCP_ULP(r1, 0x6, 0x1f, &(0x7f0000000540), 0x28) r2 = socket$inet_tcp(0x2, 0x1, 0x0) fsconfig$FSCONFIG_SET_STRING(0xffffffffffffffff, 0x1, 0x0, 0x0, 0x0) r3 = openat$tun(0xffffffffffffff9c, &(0x7f0000000100), 0x0, 0x0) ioctl$TUNSETIFF(r3, 0x400454ca, &(0x7f0000000040)={'syzkaller0\x00', 0x2}) ioctl$TUNSETTXFILTER(r3, 0x400454d1, &(0x7f0000000280)) pipe(&(0x7f0000000600)={0xffffffffffffffff, 0xffffffffffffffff}) r6 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r6, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000080)={&(0x7f00000003c0)=ANY=[@ANYBLOB="010000041000010400080000", @ANYRES32=0x0, @ANYBLOB="09000000000000002c0012800e00010069703667726574617000000018000280140007000000000000000000000000000000000108000d0006000020"], 0x54}}, 0x0) r7 = openat$fuse(0xffffffffffffff9c, &(0x7f0000001180), 0x2, 0x0) mount$fuse(0x0, &(0x7f00000020c0)='./file0\x00', &(0x7f0000000080), 0x0, &(0x7f00000010c0)={{'fd', 0x3d, r7}, 0x2c, {'rootmode', 0x3d, 0x8000}}) read$FUSE(r7, &(0x7f0000002100)={0x2020, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x2020) syz_fuse_handle_req(r7, &(0x7f00000062c0)="23db5037805f177d136115e6a1a5903469af39c1fb9cb38215fe64cff9f2f0444a57e22b0cc5cb4f74c9792365400d9e1c68539ea5eff0a5ed0864814d39251bee8dfea69aa052d900bc0c792e1c9752b7d3a3222f6a1ad3e44c1f65617b128aea51911861ca36ba7c96b96b2fba0fdaa49ffb2612f3e81fe565327dd9965a60046442c9dcd0d552c6a00388be3b438a08883c7349761531880294ad9887db97d8c2f74921c57910cf1f5cc528e17bd5c3746b6202f26d621535aac5f7872c2cb3295e42524b5acb249b2d1ac1b53a4e31271decfca3fad2e2f740768adf00875c18cb7d115150f83ceb73f77a1f61f1666c2bb9f6bd9f0fb55b3a619446e32bae2a1d99aa49e5f3822e048f8be44b707f2db10d7916ec9a10a695d573d871cf24959c3d15e61344a68309d186956537c6ea8532fc2e1c7649f8409d8dcde4c8ee1530470ac9c870f9f1837574e444ba6addf5ddb2dec67c0e76df79f265b403818dddb4efc27c90985ed69a48b12056e548f9c99edf80d2b195d26acb1127661727a0600257f4b2546513d03930a0638a71bd3223e51fbb75c832ef737907f2f4d3f0505f431ea02783c798b5c4579c99961fb73dc623a0d99c1b306435464d413b537d42c6444851b36482597140b22fbc0ebc7e795b2f96739bf139f5823bc869ede547da4f394fa1b1787836095e1013264042e53d5006ea059d0488cb2f5ccd44b30d25ea53c2dda71d112d7d441dbfc9f8462c99c098b1958c80b237d83c32f2759c9a9c081d7d7666a477cfda59354309b09f2a8b9f6c3077b0df1e8d0c71ac07232de4f437107cb0eb9b47b2267efe31938a337cf11cadad72ced56895bb14763cca5bdadd245d801e829a1eb3bb4ed851a345918efd2dcf8d38f66badc773068e6a2ef59b2bb838abd8b043cf6ac54550f3fde1bbb9e761095e4b8ef1891757d376be1f778142610c0acbbfc697f51fbb7a1602ed46e82813c74f41ee2bae818174809f3692084bea7310ebec3d6166702ae62aad84313e19b4d145167185ea8d53cb21d099fb592d7d7f8bc305dd375b5c0cd73be44f49ff53cee220085d4706bbf50c6f63b02e7e805e8fa4c73046a57a8700886da29ea53e5a316e7b011c44a0f7be5cc5cb5641ba0069ff591eee18966c7f005ef40046a5fe2bf325b2545b009867761264aa9611d184fa372ba3c5c33d9a50717210f7cec7f6dc4418a87a797eb6aaf6ab3892bd3f559547c88d8c29646c8173fad1588f52beb34ff863be65e7ec1598cfb465f270bd5532fa7035aae077eedbc846058fa19f58ffb1cf0f1863f6d33f2e5c454d18b66be766ca369af2cc9656fa34c6c10e4d4da44ce5e2370aaf60c4e130da331d3489e8f44c600246323409fdd35d11da27128c9d64be65dd3a90c1546a6eb9185cb6d3a4a9cfad0e41ea03896fd2346f745eb3563d7a79fd345b037c040e56f0677840bf9b0d295bcfa98b931464c5ce9fcaf745720deac2d8b4edeffc0fe6f089ed7c3880959fcf8e31f7b7054bc4f5c9d3ed3f66c968d0bc20b2d66c374f030f3f1965f43a98519e527caf693362412d523eeb38c8b016ff77f78f833d7513e4b5a53d5ed5143916673f822ceac9967b8788bc6428283181eaf8d99e48286aacf4f658a903e9f08659450f7f9483807c2e013a1d9d199f18886a8cb4e14d41c71e5731455a4394551281eca12a1bb6ae717f5da2949175d0f1f3d718b761dfc1099c7d9d8928c899ac8e936e69d19fcbfcfdee83b68ef8e15eed41a8ac0d54aa92d7d2ee58bb4799f378225ec9ba4709e5ce2b77208ecc85c22c64967a9ef3360c54d311b8917ceb7b432c90cc5e98de9327c1400f8ec89261b1d77d8874b0bbdd2c5eb59df415705de52b08b0e12c07fb7367c6d461c19f282d51e482cb4fb9ceb0249ac2d6400ca170fbd6c0063224179c616bb030a5c10102aa2eea92f1e6f5828590b250b09e6d1a9535c298a68160b7c281fecdd295dc3396c4e6eb3395d5a677d5fa95a732dfdef81f4346545dd1a74bb3aa9b516699bdf0a59165077ab459a5ffe0dbb3ef8afa7a8382a8441e0c36ffabbed8f93f4bbeb97e5f6a704bf63a0de9ccf8fef643ebc530a80920931002003b027014de317c42f861d98ef4fef66d232d9706e6bd263347384dadadaa43a7e106bbb21bd822d468ace171b3f04b996112135b63dcbd612b5888ec40da583ab549c340ddaf5d7406c3e99322c68874214356c1fd9b5f84348e629cc3487a901d1b7a2fa531b1509ac1c93de3da9f1c3773e3a2aba2b29d2419f240ae6d24ed9f14bf0b9b0f1e740a2db06dab64d6386f950bff4e4c94160ef4b832bbde3af4937b7528658b5c16a51cb22193fe99385721ce5b048d9338e289dcb40683140c413eca52c8e4b64b306f47569477379c864cfb3aa3e349262407d3935ab9a0916eb0f6db2be71a7eb8f9968dfac44995d5bff8ef617fceeaa448f5e5f8d4b39e3512fe7ae9ee1d8a0d5912b6148969ab0325f3f76e2340fbd67ce156bdf638140b3ccdb08e5049db15957915cb05db8901249b10c59cc5c3ff836290e3334eee2df387e44c57b4d6198c3749f5dc57f6c3de115ced6b43cbddd762b58f1fb40b2baf3b381febdc073142e30d2e9a1a69e8d86314221e540f195509d223b206173dc5406865d8064817c30c284c034035a63190ab86df3bae4168c58e01d2251748fd5d9d610024129e83a5730fe83cf0918790e6854ab765c78649b91c06655f0cb9e26d8432df78bbadd99583b6a8afcf177ed6f339e08c0b36a16c6d31d8a24cb6f2bc3ba58d7711b6f8b988dc3e3144be619548457d4f40509f17eeb186cb93a2928ecb951593d1907c8bbb9f4c8999caba3059c8e73dce54ad6f87bcd51d559f7759902b14e68d3b845c0b179b38f4e6f0bd3a89cbcd5ebed9972102048647da1eda5c8456442369f4ae871d4037ba26f27d27371ce57e23adca5af8dc93f934f2ef8d69ad3b2db66657b3868dd839c2b522f5461f24407ef091b77242fc70a48b7eec45f3bcbcfbc6bdc36e4b67295020a345233a32a0a0af4d03a53ef67e69716d5ae35342722afbe7558946475a9ebf5b39c18558a0011f68bc8a78590b0cb63618379a512790c42d94bb239dd3ef5b8d1036cf0391aded8802a7a447c38f231ae611aeeab9bba44cd14369473758b64108d0bc9b6bc9e9b497c2d1d2acbae7c620a55c226cf371331688eaddec61fe961c5fcef71dad45820ed0ac8dc7641d82150f1318ac15aa41e7be585b6a50da1b3cd95239ee61cfde15aba80ae8ebc21ba4540883c6f44cd35b6b97da4640c97f5a2b6efa8d184fec823abc754ab8a0db6c45c2293e90d9c154c4a3e0b9ec2b6113ce6583b80f0d234dec9a9815067244733e2134b9ba93bb9692fb44200bb5501bb109f2401e8baaf0115d795bb0346dfafaf953bed8e9a52a5b9b02d490c55fd89daf311ad5e08b070a9571f696d6df4715c8b69b840e4e03d6f361326e20d9546c47b3a63163e7df9bd260621358c166177ee7c69ed63a8c43dd4a78543aa9f922c0ef527f4aa61ff65bb14595f518412ce25a1e103df89cd4b363593da16c11d80a23a9b5ad8e3a7be8f697cecf82c8fbd889a4f743c839b67f7ba5453b10bbf59b1e4f4e821872c061a4125c0c15c1ca5164efe61a58bb54dcedc849800a6021a448d4660c3b85e2362b7cd8ce95156fbf408a09a30a8ccfc3554004e9f9a35382907eec00617e2ae1f8803146bc8c28b4f3bf3c6b183ae9248e7f05c4adce3e0b7ff29252b5be9b19431e3fe612d471f52c5c34cc12c83049189f4d2e5ca516df78766ba3449d07ef9436c68052c986d9dde8802c931194e2ce34acb8cc26663a09348b15c6c145d26306bded0d1f482803ae6dee26562b03fcb183b69ee4a0491e8776ecdadfca395cb4eac2948d4d64321a4e669f2f663eb54f05f12ed9c685835c3e79f982152dbe701073b9a4ab2932b46ee2424a5e18bbe5f25ce0b898ff6937927f4670defe430ac86021226ae055daf39b535cdc0899fcc99d15e67d66bd2dd89bb21b8d2689a8af10a1b0bd44103c469922c36fc0228d7b6febf5e366dceecf8bb1db385c8ab95d86ff09b76c2fa6282de81fd6864c495a4c8295df61a2548e1b81c3e3f30d7a41216801d6c2d1743f66ae2055756083e8bf403d436b8244ac214f4d84a693d13f299ba267401d094f2df70840e8a980622794212f0992ecf5a47980ab2cf7d5a6f12b0a489af3c3c847ac59bc89f36fbb0e08bf283b68213a17de38b3a45eade6f0b198def408f7711c16367bcc0ded794a9a323c7e7f07fad96ea9c4d7344c26e43844a27c21076b8d7cd07677602d91eac825eb5fd0631755c2dd1dbf7bce3eb3c3f7377fc6080ecd0b894e29769845725943e25932d4249abb4ab78d4e2ff2e2df42c8d884cd6bd13886cef080c6491c217abae0eec6e9d4d49eab6657f15cfd38e6cd6d0bd33198c4685ab302d0f46e42f4a5d5bb7d2840a0a8817b98a856700d4de74351896fe7d7d5a0d1bc57fb4c828aa51f9637807aeb905780f239527ed4affd83f68be8b7ad1e10d9e797ba39cdee24f7be0a0ab0ac22ea3968dac61eb4bdd522c9ce570edf63a439abfd9954bf6a16c88d86157d05477200a83255cde279b454979cee4de00e81cb44acdc4295c877566a749ab5b91d250f03d46ecc14210c196700338eea028c930ce104f20a9e7fabb0ad1d314ec1a2d97d1d1b9e09114dee0e3e513eacede01971ff85dc98634156073df4e8acd6c3aadd615adaffa7a81573813bc4ca21886ddd532021bba5c84b34c34665534db48d61903a03c1cca4ed955ca92c1e33b7664b494e3db6d1e637a49e537808a2669ebeca301691acd4fab0af197b9c7db01b7862466b568ab3a4712a25210264fb297a6b679dfc3fceb65bddd1a23d5b507a0d6da83d73b716d971c5179a92e57b9b93451eb943845a549de737f2d082a83682c32649b4941e787758ead9d2c256b2b4ed1e0255952ce83cccecc39e5bbdd38490f1960b26e5379943be3d9a64b5149c84d577e5fd099560baa292befa06ce9065fb03ed432a9e055ca4ad0e952f8368b3d230fd5239726f79f4c98a0b4a9648382b245d324cb61049562f765f923fc657ef36747658494d78590a1e27a2d09856acf50c3b26271c6d5aa96e8ff9bdb9043859665e21ea53a050c335cac414bbf27b0328ac2c7450acb26b093bf232358afd1135ee50ac3fb26b5f0256ccdd37033c8a59740607cfd549d4c6540afe4a6b4425ae1f633872dcfb5da8d0547cf0c4888817b71fbc7c45b2a641e9c1a76b6a6be124402422ada35edc02ed997d6b87b361aee95a16d2c528d89a52fe40dfd83434969bd86f02e63fc1ae72941209af39a08cfbb4c320bc47d853f5dbaf0cd60ec54608aadbc382fa6b5cab3e9cac57bea26609f4c79f6a6b4eb4a9336fa95783b0c0c366f36d5d6b8310b3cfdb800207919a131bc7f984f7fa11fd0bf2c89e060e9d1286e453fe97363ef72bd6eba29a85ffeccdc3bee72e12284333a5a40622c01619558d2750fc45abfa22059ebdf743f8e50ad29770d19f84d8a34232d6918514769b3bb2a1ea5e59e9556332ba669675764458e9349a1835c501a93e91dd3b31018979880a9913f54ec1e8526b8cffcb776b97fbb9424faa5c5eb60d2ac74955bba4b5182571d0d9f84f0df1baa722b20a78c9c0011c667f688b58489c9e450d83e40ac5eb41c5564b6d76a226448abe4a3f499927074125aa9c0e7e704c36df5bb110a0f15f8433a470e81db414827d5ce21ca1da1c8d51d746d1e1ca110127c15e92afd75d3cd05ce0b632cfa03745de3cdd4b57373d46676583c89f045c26c6fc5793e5489555ced08f83ba351135834a2028113c319af30cc85bc01a7f8208822d7d607aed0d2e12c80aa009100441b75beaccfe0adbda7e8bb870edf4963158794c8c3a5baacf6eec7b5efaefb7602dab8409d161beeb281cba21f1da0ccdc092d0433fb940d79699ffeb87ea775829a6e7e3b308a2ee0b7aec8ac5f35eed61be374c7c77196f7119a8882deff68230f461cb917b0ccb2b8597efcbdd1003b7b77b2c601ebd4b45c35b8426f7b9138ab3df0ec00819604ab8e1e64cf2aa2282b1269585af127a268cd207f964edff172e555398a16df44bdc52889538c3a27f8fbfffb61f7aeb55b259952bbfea81d73058d8b0f78ece9dc08e660437d21d4e3ec38b19e5afda7a6e33023f9158db8a1c14dabd9b8b307ddc66927f7b19df5e0da2237d98ddd890b81f1963808977d02198e8ae2e97419dbb1f8e51cad36a3424b955500fbdaab6ff8dbf028708b1f951fe43864b59b6c2368b816c98023d4480a91b3f1059e9c214bf55a7f8c7da907f79ff5568fd787d3aa022ab9d03cde551f7e3295f02c4f3aa37e4cebdd968c0f82f09eb004fbdb1a4ef3a0d426691bde3964c29ea65622f5d3ffd854053545ba1ec164495e4bef4845439c058f9438d13be7922b656db499c246ee6176a15b97e6a68e42f0c703033b699504e1f92b43054c7237199bd013d96faab47433b6b3f91dc66368706439d4ef7da3942ce8b9c1c9a9d0643fc4540e7d3f1c3821267e866cacd3e904be9f9df80381eec09eb2b0d745ff03ffb199b917a14fdd8fbfbffe8bfb0cf7023aa7183301a8a41e7097ff9f5247f8b78f7d08bbfc596a81047807cf0929677222e7e9e921b294e04088c3746d8dc19294645f1c093a21b4c5e6d92e54dd90465b11dd5d9d42af849070edff4ec63970f4088daaa33afdebb28d01df5ee043a8150ab1b25d864ef31e20c84696596cfbea92d02ea29c4a3933c41ec68aee7d68d7eea7f30d8920e14e62be42bcf856d7a58f46fdb2438b023e974f77281c5a462553627e9614504cbd3f1cae6e0fd9f7e89d9bce48946d0508616fbe542303dc542982c61d7bb4afbf3e76bf1fb2381cdc99f2175ef944dcd826aabdca2b7678db5262733c69ce504c38e7deb7adfb9b6d8bb00d8e4251e0438417ea615cde58bd76c2427b3d7a0578bbbff9fde2abbc5d60307aff0050b18176158aaedb34e283886378ff798b4f74e0a0c95d64271f1916280dd247304d9201c67f5e2640d9706add8703cac81795a0190107e2bb2941ed13738595da1c86ba0f68e2283a435cb5f162c74071a13dfe2266d05abaef080dd6b1dade115e883e04f0bb4be4d91f535ae6f822b02e814e65d2b7807d199a23d3f26209f6c9f93602a3a93ccfdebb5f8161b7928059674e15820d1848a980c8d1af5a73aadc5c402fbb6e730ba51227913ca27f0d78d331d6325d0a7926c238296b2a22b10a69cdffeb087dfe175511ed8e2cde8d7dae140e4ce92f892b129d9940e4a30b19f822ef7611b8750eaea8e55502604b7d2358c09a217af8be6c86d67cf6ff6130c971c9765d56631fe6224fbe1e833d497b534fbf6b030af93691f59295279aa1bdfb5d5d9d4668d5aea70e2b8fc117df0042e91c7e6225f27329727ed6e14a87c7943c040dfee4e5c06a20251c39a45ab4865951b0daefb9c05571fdcc21d1761945bd2b8047ccedd6f1e708646fbe61e75bb2728e8cee893d7e6f642119e786155a6cbab057d6d83b77716145119e974ad7355179d2adc3d748fa249cb58e32e6791d646240c05da4427b2f359976c8fd1486c604cb7ee647e24633d8fca8314cf1f85110ca6351156a2b26e44b040f7d2810acd36f45a3969c1fafd1a7e0bc14fd9b26593375be8e750c3f6534ffb85904d15d75fba05dac4a673de97f7543ee931724cd35474cd7ff5cf3e8abaf206f3030e92895633fa9d8499ea763601560260109dad18bd64b990531fc5377e6eaa5da050b98e1c6515ea48c7de1a15b63283d4a694cbad379356bfdac50e6c343879e29f6b9ab425600d51f257ceb35d0ca00f83cf5bd734223de716747614666ba1f1a8fa756e5f3ff0fc94fa4bd4073bddb0098cf565ee40af5732ee9218d262e5b64ad6b8118c54eeaf7072f2e15514a401779b425fa89d8abb1750e56cc3108dffdcf2d3fd86b8af4560d56f7ff0702154211f9949e3992d93e66892b297fa2d4bfe18de3fd74e96c9d30eb14fd458fdbc9e9a34e00f3280dd732520147fa2a8fa83e91dd0687501466a300015bf888c03fc08190c2753d7719acf6f84885c4c5642f466c1984f15a7716a9b608ee5f1b395726bcc8519766667d24d11e396e62ea39640c9e73e4e9e9e5076d7019ca1bebbd7097807f46b3b6fcb96ed4b433b25ec551fb176a5fa252ed1d81b0350cfdfb8069c9916495bef3a262b6668910896c0b37eee40547c663a901e92f41b417ac50e88d058d021a8f9a5783bd936cca4962bec1c9886689cc547970f9215232596392515182e563f720bb79d29baaabf0e2697de6500bc677e346847011ee3450358c0b16ca528368b5cbb8df5ab974a3cef072d20c9906fa585e0f3083ec6d8507b8561f64e65aa1aecf825fc47ad1459c87771549fd5c9a9cc094e7b1179ee1e90eff7158f28f59f029d90e708f4ec50b4f67d8b4bb7140065528354a7e25d63e92977183a0284ec22aa923210f0bfea89cca53547137381e5de0f60bc484bc2daf129b0380244f1ed4bfb674eb2791e76dce33cae684ad36620d5d67cb587f840caed316b7439b0e8c3de0e065e62680f3997369be3466670278168c9a1a644d870e3a8d0a79b2b720e8c3c51bb9133532beee64319e98714bb2e6d5c0b723962d923b0ef454361d4b3cb470bf8c39031ed4a75267f499741be15aacac92d8e6afdcb01a2e7d2dbf549ceb2a2108c4079c620f05ca1bd31d631c2c8d35ca0d73155f56ed020c25e389db356edf510ae088d11b5e4fed51d0dce4d3aa04924b09c28200ede5bec1a8f38cc5f081055e0f28d75afc4d588ca0e828d00085d150beafdda17b8df9e7d9218ea7d81f2e076412901c5ae04d6929d717fea2fcc8e5a1e69dbd7b5258799a2fa5eb108b6cc35dfab599fb27e6d75f1030b83f452af8137830337141f031942eba83123d3f87b5f01623d4613e5a44b4952c300baf3d4d3dbbfb0ad024a19b3810a174ef8453d85a25822f66e45eba2490f29de1077683ccc32e3517f88b51e010672a982f7c8591450c9ab1573143aefb61c17ebb0c92dcb0494d116b970c2a827a6b3608ae10d583d1f7d092263fa873de9f31cd59bc9491ff012059b63a9120af89477f2ccc34eee7bd66de60af64730c879128b49d31da6400c2471e0d5abf707e560574b477b8e20ca45d92182d639eb434e14aea1a3f91ad8fb60e4859b77389753990513181ea3a82884235e8520294359435cfba220502b591fc28ac36ec697442657d290bd7aad7fce53a3f1766f2bf7d55c24d7c0e9c7a71d6f1282ea1478e0a36378b50e4fee281f686bc53f50138036e2a5d6199d40caff084fde7b63b3c0a47da0791107c3218330f7c2e2c7609aba202fae5290243b6033379eb15edc572eee452008e04c9b53efd5f3d88327317b38934745bc3de4c55bd818febc7a7953bf03c4029f77177c2a974310f0485aa46252f1000dc71934947287c38ea5854f29c7b82f630afb8caf1fd880670307b155a6e7feddc019cfbbbdc18f3bc03da3bd371d93ccbf56bcb39eea55c2d113efc148127c30089d21ce6a5088dbfbcf8f8d75c19456bc962c371548634a95382acb5a0886efc46a87bdc111dc0d1e54084cea0d58054f00762c91d7fe0f0fbcf4c280f29f9cd5999a5e8c6f507f8080d7c7ea9a8685be50722cf1a082f3728dec8d6152cdc72f8da6b1805643c042f4f6780ba79cc8a2165d9d7acec8ab2f421bc3e77b51c62c4bbb262b5674ea7d2dcf9acb894d050e91b052364322a5b08bd9667249571c004fb495da7e24fc5620adda3af6848ccf238911a52bdbff766e4e279ac274afa2c2302faba25b5fe98d972a04aa13f77c0c05d7dd82b0a19f1ded8cf5f99c80e392b0aab1264a29e9fbcf0b69f6b0a9f2332e09ab74dea7277106d0883bb264e279c67e5bc69009225bf4fd1a8532f9392a011b55a73a7cf8d16a59d695b2a65b57fad64a2041f8c28804ee1a48845c5dab757d04f1d95520aa9ddb69904d6529c0e14bd789dfe37067073b3e0e136ae2aebb1c34c55b94ce942f786be4b45f801f35f7c768d91a460b92ffa57ff675f0b4b00437a07f871a8650f21b2bf7c722c1d9e860e8955fef5699ee53a5f6fe46fb9e5e17a1c69fe2538af4718b7215ad2c00c3d420589a8653ee511b809945451fb8205b19ce377c8d0253b05493c557cf2bd8ef208e8fc01beceea1acca38d025f328f28d69bcfaa3adc6d9573a3832dc3f3c758fe08cf9cd0c32acfddae81b3682869e8aa9725b64336252aeb2ee8eb78f0721aa3158217a3009948adb297c5ea45ec26cb6d963c7be47ee1b93fa136ebe73a21936df0148fa311206f8bca2e80719aeca8745ff74ddaad5182644762c66333f942d9a93c467d5f9fd5d0dbbe57480362d4bb0f760294f4eba3e1b08047d256dbda157635d21a43aff3a71f6ad574b402bb36e5270d7ed082c6fbae07771721513ae9ddb22d23b00733046c898ee6ac05ef8a51ce41919e1f241cb98e0592ace68214620ba1a748ef81131661f58f1635713ca2873e150a3e848c8d2ebd039769fda112b73050efa4d1c35dbb46ca5a7b7ccbed1dcded36af272f6838b4c1e7e6778e7e9ca3d794f275d49c9e32e768097349118d2337e7c031ada38d0cc5c04c286ff93083f6d58d73a821118c93432fda9a8c76fa2cbcc093a7decac8e4f001ecc9f67faf1c2f102120f0618469cf653bbd5fcefd4ef2bae86dc4f5393b840f9f47140cf7f46a186c21878a43612a71d3b540b9994f010ab623f878264cf46c7366d0bec5d43d481b47846091fd3cda73a9a28ceb7f839eca695c9f084a16c812475f6575ef2368c88cc6655f47663ef69ce4779fe3ccc4dd85a07a9e4c6f39f42690d231f5727f45c247a53fd8df029fcefda4f328658435892519c17205a3c715ad6bb7387d09a5e387c83f008daf626f5977c66203af1143ef7b59ccd8e3c17bb156bca317861f0b9f222ea63c044075a3a74beaf05c23d0a75caa60397d831bbe507234fff154960faf0f02776d3f9038c955bf0c1ec9c92523cf0b855c18d6ac3b35d437796420ba3dfd581dc6adac64315c1cb1a2c3a45ec4655bb2bd6e0b4a3082281ed0697a213d1d93142e96b4fd57431d2f4547451d008ab58bcd9765ccf3ca3297becd5de9e2be0263cfca09935c9334b5e687bc7e7057dc2ed03873be22200c9fe32a9497dd00a336cf4c723ead302340b5cd1fef8cd88330a9089fc93af4ef739295b94407b291bf33f4f39c936736e1166106428f8796a4b92805f4dfcf46d8692b54e40a9e8584c0eaac4caada87bb33f553eafeef5051b889402176ab766936a38ddd7e5205d2c87e133a02e84ab24ba2d889a4c4db8cbe18b271455e84da716f4a32acdbc0a5aaba25a2ec757c73847dd1c4ccb2967c651e5257692a4553dde227846bfe2977021805f46a287c835ea8dc5", 0x2000, &(0x7f00000015c0)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f0000000440)={0x10, 0xffffffffffffffda, 0x3ff, {0x0, 0xb}}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) write$FUSE_INIT(r7, &(0x7f0000000180)={0x50, 0x0, r8, {0x7, 0x2b, 0xfffffffe, 0x30024404, 0x0, 0xfffe, 0x9, 0xfffffffe, 0x0, 0x0, 0x10, 0x4}}, 0x50) write(r7, &(0x7f0000000000)="fc0000001d000724ab09254ec100070007ab08001b000000f0ffff002100057e0000000000000e000039000000039815fad151ba0101099cecb94b46fe0000000a00020025", 0x45) pipe(&(0x7f0000000200)={0xffffffffffffffff}) splice(r10, 0x0, r5, 0x0, 0xffffffffffff8000, 0x0) close_range(r2, 0xffffffffffffffff, 0x0) syz_kvm_setup_syzos_vm$x86(r4, &(0x7f0000bfe000/0x400000)=nil) bpf$PROG_LOAD(0x5, &(0x7f0000000080)={0x3, 0xe, &(0x7f0000002b00)=ANY=[@ANYBLOB="b702000007000000bfa300000000000007030000f0ffffff7a0af0ff0000008179a4f0ff00000000b706000000000081ad64020000000000450404000100ff0f1704000001130a00b7050000000000006a0af2fe0000000085000000b5000000b700000000000000950000000000000000e154cd8445974b26ffffffe4fbffffff55bb2007ee51050512b5b42128aa090a79507df79f298129daa7a6b2f91af50342115e17392ac627c87867c000006146001e04aeacea799a22a2fa798b5adc43eb27d53319d0ad229e5752548300000000dbc2777df150b7cdd77b85b941092314fd085f028f2ed1a4535550614e09d6378198a6097a670838337af2abd55a87ac0394b2f92ffab7d153d62058d0a413b2173619ccf55520f22c9ca8b6712f3024b7041b1df65b3e1b9bf115646d14ce53d13d0ccacda1ef0900094fa737c28b99938512c816fdcceaede3faedc51d29a47fc813a2ec00f4c7a53ac271d6d7f4ea6bf97f2f33e2ea2e534300bcb3fdc4b4861004eefbda7f54f82a804da4f86bb47a4a69bf9bc5fa96ee293fbd165a5a68488e40b030166565a097b1b44b451de736bb6d43db8db03d4b7745fef1d04ec633dee254a6d491b849a55b000000c4fd21a18986252a70f8f92eb6f0e8c7db4bf23242a1f2d90addedc28159f09943b1b0452d1b72183aacf4a84f9130b775dd4e9e3070756f97ad91935a6ddfa8f90e79321a0574fb30ff0000801989328c8ddc20ea011bf5742e0e0d4334db8b20ce3f9f16cb7fc20fb4791ec85821d0c48fb657c29b309c73f0977e7cde65a82b94c461d7962b0d2277a84af326f37f3e2c25a61ec45c3af97a8f17da954aff3fc8c108755f75ca13fb7c8bbd8b6e7dac1aba4b20dc7de058a4dfa7e85a8bdf1d41a2d8bda74d66f47cc180f82c5f573c1f860d050d694cc7806d294d3665016a7b29da0fde4745db06753a7ac74a2d32f7528751313694bf5700b20ef0c248ddd3da32396a614cacad4aff2066bb5d40887c58559b7dcb98a6273b8c651e57f727041c62cea5b7bd24d9f679e4fbe948dfb4cc4a389469608241630459f0123fd39206000000000000eb55dad46de56ef907b059b90b8aa49afb9a79ae5498f6589880ed6eea7b9c670012be05e7de0940313c5870786554df26236ebced9390cb6941b83720eca291963eb2d537d8ee4de5c183c960119451c31539b22809e1d7f0cda06a9fa87d64cb89872a2cd8a104e16bb1a2bacf13464ca03aff14a9aa4bd9539f5096412b92012e095b84c20243ff98df3347f0e399d1b9f27e3c33269c0e153b28b2d4410572bc45b9d3fa02208d304d455c36300000000022320178b00cc6ed7966130b547dbf8b497af002000000cd1d0000002000000000000000000000000928ee53595a779d243a48cea769470424d28804c04b2c4324ab7f4a5c81921f0128dfd70b438af60b060000000000000056642b49b745f3bf2cf7908b6d7d748308eea09fc361b4735efbf3411718d6ee7aebed161980f2fde4f9ef679dbfae9fb4a79f8a836804ed3a1079b0282a12043408cd60b687dcff91af19010000000000000000456f7d2a42bd13da202274f20675eb781925441578e93046aaddea8ec4ca37f71c2710a7ea8ae0dc214e1cc275b26adfa892e6de92000000000000000000ddff004cff9ec780f535e62f4eeee50e5bafecea4d4134d006c8d6883eca5c9c58c9e9338c73de2f04f15d005387577f480000ea65559eb00e76e9d0ada201bcbb5c252b28a60ca770663da451790cc36000906d5a9fad98c308e39bd5ffb6151d79c1cee1cd102e3c8e63e9fba05e3633be3f00000015762e5f5a3a0bc33fdbe28a5ffc83f2b485185cc92fe7f791e8f6429309d6adab4b7e508e4bf024ed8f8a005f2bbf96c89739f5cf1e750d50517a59a3ad09e8802c8f4f535447cc0fc9d5f99a73145dfcedad69da9cd4375c624600e78f4458542b14f29611f95d4a31838eeb20c20bb82aa31771cd379ec83554cea5e6539db7384e1f58d81f2f2653c4d9818708e27c89b552d7fcd116bce9c764c714c9402c21d181aac59efb28d4f91652f6750b6ec962802c0320f8059195729d60c534ee8e8ff0755b67fe4c25edb85bcff24c757aa8090000000000008c420eb4304f66e3a37aaf000000c42a570f0e9dd5fd545470f862f8c3c14fa9ecd1e877b0d8ca84c044859e85e6158f9184bc61a9a284db80e4636c25b96174327d82761c26e329555f9290af4100000000000000ff0ffd3763655500344bae34137f5ab0d534b8d63e4ca3b671f2de1cdf519192c6b59a601fd419adc16e2055b85058f793484305d7a1759782e4c571ee855a47bc00edf5e9020c09ab004321610b857e8717764b633b21cb32f0e03280e09758bd445ab91d20baca005452b79d7b574a247f1d2fe45b3c4e93da3d51de647c10dd49944dc87c92332af0be61e58c79d497247d278888901d442ad7f8536607a644e9e3d769db497c3960dfde12182334caee994adc38a436367a54b9e182b78e9a0ceb9a2c4f63902c1ad1a7c5a08d0920a23c2a86abbdf357849a651733e57f31019876026888c8ccb85c86b4f8ffffff7f000000002c331fca0e541b7ca211c28ed61c525708a13d115b43f8b1894c8fa8a14dc4810f61ae96c18cc7130000000000002100000000000000000001000027c9a46157a3609b6fd9843ee19ec647249a9375de5858818f3c4a4fa6ce46f4d42b07199de8b99231ace58c77819ee214e49666c464d35ca9b5143ed3b3dc8c17a23692759ccf5a205311b7ab22532697b861dfb54609fd88e6043bd52ae84c1bb0c8a6c769f952283a1f4e3842edb3d42c68a27ef6a1296dfff4a979369b0e8ebc62887aa46e820a74f91381dcc198e353047db70686d147357024eb3cb94f1e89cb5ba0a56aa046b4dc521a3d9356b4b8b5917c4c860495b240e80063bde261fd00000000007271e28ef6806bc8e139c49b91c76bea3858f7f05b47d3e519f1634e8fbd8d31330d89069f9648a2ff93060ff073b3a113e47edf76f7d116d2b0976cf2ec447c030931651dd315003b7a6a5433a2bb560ae99e85b227eda2e63a1c31a2c2bd48a822cbe92b6524e0cd8020ecaa34e19e7141d5e221509342bfe7d294d1eb3de6a50ca0301f89c2ee627e949c68b3a4a426a996d503a26e9a714ee5f72d8805dd1bfbd081f6a5359dbdfbf31a562395020becaf3fd1f1289dfe14cb9194e26a44fac273461fc5c0e0a33db7f2d43ea8086cf059f40fa2640b6bfb74dd35f5a31059c01517cf4b6641fce9a24b96767b837ca037a1199735c375c705c798e0e208e4a5259d0bfa526b462af45a6eab34000000000000000000000000c4426344ec1a3366515dee221e747f55d7dd02534bc503b9b28277c253e410986bef2111a99cc448d652929f8a67a6a1d3f00dcad91aff428aade3f85714a1d3ef29acd4d49b62339c10c2ec0dac4b28288e78980c1184d8223edbc4bf9258b7374e79a8f8bf3fb73c8c6dbb7bbdfc399847a11921f97eba0ea14c4fed9a71eedb97c02461792e3a49dac16c60c3fcaab222025d78963c3ac899fa8b63f58a30212c9b2d7fe751e2046b78f86e22861b6504c667350244dd6d9189a8b9c45f8aaff9db694811ca86ed978f23eed7459c0382074170cf1e25b0e9ba3d1cc309353eea4cd8ab96bafda393276bdd8d32ead8db9e1b54d2d3d50e2815268fc1a6ec566981bc8ca2a4583f3d40e817433d0f4f25cfe6cc1897449ba5f26a9d66ac73e6f5c401376f23a314e0b9ff997d22f3e34b5524642c248aa813edaa626f0000000000000000000000000000000003ba5bac34b611569a451564d3a5400f9097ffe7a37e765bc652be71ee24250d6d9cf19878dd62c53062d6000c40bde6a6135eae8a00000000008d797190a26c933f933aff5c521eeb7a84a62d148a846e74e76b515b6b8be29e8b69310fa130cf6d6b74f33205d3cc218ca554ed8085ae044f5bf2e89ad07963acbd4dd4dc5b4552591edde7a22ad06f7567e6fec2f65011b579bf609d61a3ff4d6f490824bb035995449fc34106ae6889f036d67b6aaee784f855ebc746ac871b5d2031ac0a252ac1f86e93e245f3793cea80b6de773899d49d11d3b1ed79163b111c976cf840a2ef6214a43338fba8c9edb6be26e68fcc5d47ed74a66ce8aba726ab955b9b32ab1890e84a5e2d7476252af25e5c95c5a8b2b1b5c8a2645b01b823c0f169d6ab529cc889bb07889d9e155114cf3e26a50c527ec6d4021cd2cacfea6d7e41e39e26b3967cad65c648b170f12ea9cc69dcee64be0c27b1f4f7f5ce3e62c35602c9d2921326891901661c85b988494f094abb91ed813b42828aa93105896e0aee851a8087e169a1d69e841257d9053d0cdc3a6ac4f12084cc6470abebe8b344b1f56690a2687b428686c854c21831da277e8b8a21b7b91a46d22ba083eca7b1f8268048cde7d6f237dca42035881b29ca9c8c2937971821b613894297ff6f7796053a4de1fd77e180cc22b205d43bb4a1b59962c1f605ea1b74585cf5e8d579f157cb45561c357f9976cec6a43388b3049a0d9c171ff6145266ba119d00000000001ef3794a930eb12f3a6215c510bf0bca70c127e9c70cc7bef921249a7f18a0034ce3264a9e96656b47233e2ed7c76520e649c3fd550bdafd77c5cd72b4446d3e157ddd97e7622a6891fb739acd3b2cdaf65ac78490f0641be6e8c6f55bf3d228786895ff5fd5970faacd8a5025aca0aa1931f477ba06aa60051298c8bf7f3b399194f98dc3f4e8513ad06da09dc393c1284515986b8c70ac69512f6c0c04f42edb3a097a11f2ab480e3e391abffae097752300576337c6dd24c4a98280684aa1fe8c7b43ee8bce05fe979b34da18cdb44dbb030b8009cd3b3b44fd8e7b534acd3f1839cb54817668ab446d3d47848429ea831a57f222c714870582a8832c2a326c5d1e406c8b05dedddceb24483f8f998b05c3ddf85c3799c9000000000000000000000000001e57cf839eb3150d6a076fb7b86fae98dbb46014f483aecb4ec4f0877371bcae8912c78aff857c669760f0e55041563c5c3e8ee4a0eef885fd43fe34a1febc82370d1d07fdfe705ada47288e41e7e6ee82d66b99ae4b0889fe949e7342ca97c1a64dcc7f6a0c0da07de8c808b4caec54820f856889fc5f1af3d675206e3257f974d6e45ff1e905c2f0fc0173ac6714acaaca2397bee23630ecaa2c1c6ddc3085689a033d6d41a1a7ac59baec299158faa52308856805f2130863f4668e27b8bbef4f4cd43a2fd294b5b0bf2b0e4afbe570c54aa214579ca0caf54231d00a94eda2be6f037e2befdd03bf152f696ca1d1ea86eb7ee1f021062ad71246dae1580c4f959a320912032ed468a8ed9f27a2258ddf465de77a51b4713bc6b789a0e8b203f0f592ddb27aa90989a9e0cb624bc34e7d6ebf156ea251e3a2f83ada9f0b70035e8ed200a52b00"/3910], &(0x7f0000000b80)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @sched_cls, 0xffffffffffffffff, 0x8, &(0x7f0000000000), 0xfffffedf, 0x10, &(0x7f0000000040)}, 0x48) r11 = syz_pidfd_open(r9, 0x0) ioctl$XFS_IOC_ERROR_INJECTION(r5, 0x40085874, &(0x7f0000000140)={r11, 0x724}) executing program 6: openat$selinux_member(0xffffffffffffff9c, &(0x7f00000000c0), 0x2, 0x0) ioctl$SNDRV_CTL_IOCTL_ELEM_UNLOCK(0xffffffffffffffff, 0xc1105511, &(0x7f0000000040)={0xa, 0x0, 0x3d, 0x10000, 'syz1\x00', 0x5}) syz_genetlink_get_family_id$ethtool(&(0x7f0000000180), 0xffffffffffffffff) sendmsg$ETHTOOL_MSG_COALESCE_SET(0xffffffffffffffff, &(0x7f0000000540)={0x0, 0x0, &(0x7f0000000500)={&(0x7f00000000c0)=ANY=[@ANYRES64], 0x5c}, 0x1, 0x0, 0x0, 0x40800}, 0x40090) r0 = add_key$user(&(0x7f00000001c0), &(0x7f0000000300)={'syz', 0x0}, 0x0, 0x0, 0xfffffffffffffffe) r1 = add_key$user(&(0x7f00000003c0), &(0x7f0000000440), &(0x7f00000000c0), 0xc9, 0xfffffffffffffffd) keyctl$dh_compute(0x17, &(0x7f0000000140)={r0, r1, r0}, &(0x7f00000000c0)=""/83, 0xfffffffffffffe4f, 0x0) r2 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000000), 0x20042, 0x0) add_key$user(&(0x7f0000000080), 0x0, 0x0, 0x0, 0x0) r3 = ioctl$KVM_CREATE_VM(r2, 0xae01, 0x0) r4 = dup(r3) ioctl$KVM_SET_USER_MEMORY_REGION(r3, 0x4020ae46, &(0x7f0000000840)={0x1fe, 0x2, 0x2000, 0x1000, &(0x7f0000003000/0x1000)=nil}) r5 = ioctl$KVM_CREATE_VCPU(r4, 0xae41, 0x2) syz_kvm_setup_cpu$x86(0xffffffffffffffff, r5, &(0x7f0000000000/0x18000)=nil, &(0x7f0000000040)=[@text64={0x40, 0x0}], 0x1, 0x11, 0x0, 0x0) syz_kvm_setup_cpu$x86(r3, r5, &(0x7f0000000000/0x18000)=nil, &(0x7f0000000200)=[@text64={0x40, 0x0}], 0x1, 0x0, 0x0, 0x0) ioctl$KVM_RUN(r5, 0xae80, 0x0) executing program 6: mount(0x0, &(0x7f0000000000)='./trace\x00', &(0x7f0000000040)='tracefs\x00', 0x0, 0x0) r0 = openat(0xffffffffffffff9c, &(0x7f0000000140)='./trace/trace\x00', 0x0, 0x0) read$FUSE(r0, &(0x7f0000004800)={0x2020}, 0x2020) readv(r0, &(0x7f0000000700)=[{&(0x7f00000006c0)=""/18, 0x12}], 0x1) executing program 6: r0 = openat(0xffffffffffffff9c, &(0x7f0000000000)='./file1\x00', 0x2040, 0x0) fcntl$getflags(r0, 0x401) getsockopt$inet_sctp_SCTP_ENABLE_STREAM_RESET(0xffffffffffffffff, 0x84, 0x76, &(0x7f0000000000)={0x0, 0x9}, &(0x7f0000000040)=0x8) setsockopt$inet_sctp6_SCTP_AUTH_DEACTIVATE_KEY(r0, 0x84, 0x23, &(0x7f0000000080)={r1, 0xf}, 0x8) r2 = openat(0xffffffffffffff9c, &(0x7f0000000340)='./file0\x00', 0x101c42, 0x0) write$binfmt_aout(r2, &(0x7f0000000080)=ANY=[], 0xfffffee2) (async, rerun: 64) r3 = gettid() (rerun: 64) tgkill(r3, r3, 0xd) timer_create(0x1, &(0x7f0000533fa0)={0x0, 0x21, 0x800000000004, @tid=r3}, &(0x7f0000000480)=0x0) timer_settime(r4, 0x1, &(0x7f0000000280)={{0x0, 0x989680}, {0x0, 0x3938700}}, 0x0) landlock_restrict_self(0xffffffffffffffff, 0xc) (async) syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) executing program 0: r0 = bpf$MAP_CREATE_CONST_STR(0x0, &(0x7f0000000240)=ANY=[@ANYBLOB="0200000004000000080000000100000080000000", @ANYRES32, @ANYBLOB="00000000000300000000000000000000000000006ce45aa13ca6f4914daaacbc6ff3665cad5b684d084f9b8c5adf7a3ab642ae14b7a53bc8bc4143c34c75cbe966bfc9f3e33d", @ANYRES32=0x0, @ANYRES32, @ANYBLOB='\x00'/28], 0x50) bpf$PROG_LOAD_XDP(0x5, &(0x7f0000000dc0)={0x6, 0x6, &(0x7f0000000640)=@framed={{}, [@map_fd={0x18, 0x0, 0x2, 0x0, r0}, @ldst={0x1, 0x2, 0x3}]}, &(0x7f0000000d40)='syzkaller\x00'}, 0x90) r1 = socket(0x10, 0x803, 0x0) r2 = socket(0x10, 0x803, 0x0) sendmsg$nl_route(r2, &(0x7f0000000600)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000000)=ANY=[@ANYBLOB="3800000056000100000000f70000000007020000", @ANYRES32, @ANYBLOB="200001"], 0x38}}, 0x0) getsockname$packet(r1, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x9) sendmsg$nl_route(r1, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000200)=ANY=[@ANYBLOB="a000000010003b0e2a1a86eb2636037f00000000", @ANYRES32=r3, @ANYBLOB="0200000000008000800012000800010076746936740002"], 0xa0}}, 0x0) r4 = socket(0x10, 0x3, 0x0) sendmsg$nl_route(0xffffffffffffffff, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000001080)={&(0x7f0000000540)=ANY=[@ANYBLOB="4800000010000305000000000000000000cf0000", @ANYRES32=0x0, @ANYBLOB="03000000000000002000128008000100677265001400028008000600ac14142e08000700e000030a08000a00", @ANYRES32], 0x48}, 0x1, 0x0, 0x0, 0x24040000}, 0x2000800) sendmmsg(r4, &(0x7f0000000000), 0x4000000000001f2, 0x0) bpf$BPF_PROG_QUERY(0x10, &(0x7f0000000180)={@ifindex=r3, 0x2f, 0x0, 0x2, &(0x7f0000000000)=[0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0], 0x8, 0x0, &(0x7f00000000c0)=[0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0], &(0x7f0000000100)=[0x0], &(0x7f0000000140)=[0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0]}, 0x40) executing program 4: r0 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r0, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000240)=ANY=[@ANYBLOB="140000001000010000000000000000000500000a28000000000a030000000000000000000a00000708000240000000020900010073797a31000000002c000000030a010100000000000000000a0000070900010073797a31000000000900030073797a320000000014000000110001"], 0x7c}, 0x1, 0x0, 0x0, 0x4000}, 0x0) sendmsg$NFT_BATCH(r0, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000009b00)={&(0x7f0000009b40)={{0x14, 0x10, 0x1, 0x0, 0x0, {0x2}}, [@NFT_MSG_NEWRULE={0x80, 0x6, 0xa, 0x401, 0x0, 0x0, {0xa, 0x0, 0x405}, [@NFTA_RULE_TABLE={0x9, 0x1, 'syz1\x00'}, @NFTA_RULE_EXPRESSIONS={0x54, 0x4, 0x0, 0x1, [{0x50, 0x1, 0x0, 0x1, @inner={{0xa}, @val={0x40, 0x2, 0x0, 0x1, [@NFTA_INNER_HDRSIZE={0x8, 0x4, 0x1, 0x0, 0x17}, @NFTA_INNER_EXPR={0x1c, 0x5, 0x0, 0x1, @payload={{0xc}, @val={0xc, 0x2, 0x0, 0x1, [@NFTA_PAYLOAD_CSUM_OFFSET={0x8, 0x7, 0x1, 0x0, 0xfffffff8}]}}}, @NFTA_INNER_FLAGS={0x8, 0x3, 0x1, 0x0, 0x2}, @NFTA_INNER_TYPE={0x8, 0x2, 0x1, 0x0, 0x84}, @NFTA_INNER_NUM={0x8}]}}}]}, @NFTA_RULE_CHAIN={0x9, 0x2, 'syz2\x00'}]}], {0x14, 0x11, 0x1, 0x0, 0x0, {0x1}}}, 0xa8}, 0x1, 0x0, 0x0, 0x8890}, 0x20000000) r1 = openat$loop_ctrl(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) ioctl$LOOP_CTL_REMOVE(r1, 0x4c81, 0x0) executing program 0: personality(0x5d28870e52b2f29b) r0 = inotify_init() poll(&(0x7f00000002c0)=[{r0, 0x8003}], 0x1, 0x100) uname(&(0x7f0000000640)=""/4096) r1 = socket$inet_udp(0x2, 0x2, 0x0) pipe2(&(0x7f0000000040)={0xffffffffffffffff, 0xffffffffffffffff}, 0x0) r4 = fanotify_init(0x200, 0x2) fanotify_mark(r4, 0x1, 0x1010, r2, 0x0) pipe(&(0x7f0000005880)={0xffffffffffffffff, 0xffffffffffffffff}) fsetxattr$security_selinux(r5, &(0x7f00000000c0), &(0x7f0000000040)='system_u:object_r:dhcp_state_t:s0\x00', 0x1e, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000040)='my_configfs\x00', 0x1ff) mount(0x0, &(0x7f00000000c0)='my_configfs\x00', &(0x7f0000000100)='configfs\x00', 0x0, 0x0) r6 = openat(0xffffffffffffff9c, &(0x7f0000000140)='my_configfs/nullb\x00', 0x10000, 0x0) unlinkat(r6, &(0x7f0000000680)='nullb1\x00', 0x200) ioctl$sock_SIOCGIFINDEX(r3, 0x8933, &(0x7f0000000000)={'netdevsim0\x00'}) r7 = socket$pppl2tp(0x18, 0x1, 0x1) ioctl$TUNSETOFFLOAD(r0, 0x400454d0, 0x10) listns(&(0x7f0000000440)={0x20, 0x0, 0x0, 0x0, 0x0, 0x3}, &(0x7f0000000480)=[0x0], 0x1, 0x0) connect$inet(r1, &(0x7f0000000280)={0x2, 0x4e22, @loopback}, 0x10) connect$pppl2tp(r7, &(0x7f0000000180)=@pppol2tpin6={0x18, 0x1, {0x0, 0xffffffffffffffff, 0x2, 0x2, 0x1, 0x1, {0xa, 0x4e22, 0x0, @remote, 0x8171}}}, 0x9) socket$nl_generic(0x10, 0x3, 0x10) fanotify_init(0x200, 0x1) r8 = syz_genetlink_get_family_id$l2tp(&(0x7f0000000040), 0xffffffffffffffff) r9 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$L2TP_CMD_SESSION_DELETE(r9, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000000080)=ANY=[@ANYBLOB="3400005db1cf7f62f0568b0000000000000074015fc8733b76536481fd278f773b965b48", @ANYRES16=r8, @ANYBLOB="01002cbd70100400000005000000080009000200000008000c00a80a0000060001000500000008000b0002000000"], 0x34}}, 0x20000034) executing program 4: r0 = socket$l2tp(0x2, 0x2, 0x73) setsockopt$SO_BINDTODEVICE(r0, 0x1, 0x19, &(0x7f0000000240)='wlan0\x00', 0x10) bind$inet(r0, &(0x7f0000000080)={0x2, 0x0, @remote}, 0x10) connect$inet(r0, &(0x7f0000000200)={0x2, 0x0, @local}, 0x10) r1 = socket$vsock_stream(0x28, 0x1, 0x0) shutdown(r1, 0x0) r2 = socket$nl_route(0x10, 0x3, 0x0) r3 = socket(0x1, 0x803, 0x0) getsockname$packet(r3, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f00000002c0)=0x14) sendmsg$nl_route(r2, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000380)=ANY=[@ANYBLOB="540000001000010400"/20, @ANYRES32=0x0, @ANYBLOB="00000000000000002c0012800e0001006970366772657461700000001800028014000700ff01000000000000000000000000000108000a00", @ANYRES32=r4], 0x54}}, 0x0) sendmmsg$inet(r0, &(0x7f00000051c0)=[{{0x0, 0x0, 0x0}}, {{&(0x7f0000000040)={0x2, 0x4e22, @broadcast}, 0x10, &(0x7f0000002740)=[{&(0x7f00000000c0)="02643d7b7266f48da38a7b06db1abc9528cf8dc9edd741c78a58e9ab4d830907c8a7f4aae6214945a336fc2b9266e01a7b034baa39399066c60ed9f93612e652ddc92f6879227c58dcc003382b8c50e769e0e6780ffcd2382703030d6d0ad176ce9249e4ab4c7447a197c6c7e9e435159f803ce149c6c13720154e033393f3b43894a712883d41b8a310ba7e47f0a34d8c79b31cf1d2f096", 0x98}, {&(0x7f0000000180)="0f43beeb91e03b187fb66b7e32764af7f1bf96af", 0x14}, {&(0x7f0000000280)="2a60d9b672022881e21f3339747765d1663410baf9fe7fa0a73a68fe04e827e8898ebdbc63e137772dc318652b63bcf459dbfa82dd1bac33bd666255d9fe0e5528b8766160e4d51f11223890ae426081038ac7cc9b79776498c1329d7bc6f93ebb22164508c19f015c33f53e2d0cdfecff8ea7a61e6cac89542f92a31acf0e976ed21ad5661501d3a3b57401f498f0307578f519542b910017478aaa84c4c7b2caff8a629cfa8eaeae40546b74359372349ba384cb938a9aaaa5758c2f340eeb8938d771bfec0865a692ccb3bfe640dd5b98cd06a55c556e79901e6a181c1c8f394183e4f9bda91a7dca727d69ec5218995f02319b0fa6ca4d607cf5", 0xfc}, {&(0x7f0000000380)="be3372fe3aa5af52d7528b3dad891fc76f79cd1e4d73754a71f844dfd1525b388437642c967d7045ea9d0f65887dc9d8e3bb763281fbfe86193e8ab7052c6325ae0f8807c5c34102a756d7b9edac2d0d87c532f6ab023eb79b5068a78c1d7f24f74e319a85dd058ef994c587e034d06dbc2a43508f4482f505ff6313884060035c99b2f8686d304b9daeb6e8101947578d4ed4f8c756105aa66d1a23e1508bb65071cea398461a4ac59396a1d0438728042e3d657eef3f8509b5895b10019c05203b2172e44c55ec7346f7297f94f7dc0396705921b76222049039f9accd3bea8b8895d25e6c6b6a2f68b0a304bcf5e64cf7b263ff3dd57dac52a856c364d3cd3890a85cd56ac313aad8bb6a4d6b27829ca3debe73824747199f3b7072c2299f0451c394e085938a99752bd8d2858bf0e096c0a16e4f2180ff68e40008d50a438c00ad482217640b9a288149a2960d9e3d2ec5f386f7398cf998156d6825652a38e89ee868ae2bc099ba83a11b0382508b2c5eec93835ca63533fcc48bc95bb8f74ae800b4717bf922c817c83febfc545c389434d58419630803100bc10f289d8046c43658ab2b306bc9a5aad223b10db9db399b3f11be7fe287c5341c973cc6e42644826d408f41e23daac8891ce08804afe3c89151f8df41a2d89b434ea28e4bd5b145bf36b935c6ba053aed44be6b5f047daf2689fd6c8176f25a27c984a8b14c8114fffacb842ceda614caf8f84502d4332d2869f45ebd4f4e48998179120cd47b507d5f8bacedab6bee2f590206fb9c1ec9393cdb02042a9396f0efa11a29211aa49b2cf83bfecadb6169f52722dcec03dee432be2f59faa476a192e9ccd2af2c0099354a11de85d6c2f787ecd5a30607ec5cddf89cb9de9a55f4773c0688ef59f56a04c947434598854154a23f746d7c69fbb2f79437ad7f1cf5a210ab63e43f5af71787c0b9dfbcfdb7ef1daf62b23c6f399763c780d47131c75148a95beb75be78459fb713a80ea668ec04f9f02777d4c6f035944046513308e9203d22b7a74c35c19d958df78ae8b48ba530dc20cd789bcf915fa3e0dde78b78fb0edc2ea815f541d4c3ff1818c39eaff288d7eeb100043f80d539b649b71566fd1980234618797d5568a4b578cddc915e7ca87c2d9c07df82903d27a417bc6b448e8f906e7d35a5a70a6ab4cd9752e6d6ee12dc8519e270a9a58da7209ec63dc260b28548d849a84669071464f1e1c915856fb06e9f82e07c63b019f548852026f126679ae771ef689211e4b66dda80671d9d4891c7448b85c9b02845a15b4b982e4021b69f8160be91bdb8f622b302414ed929d8c55231a38159cf4d25221c195697019ba51d6457fd8204768c3549a2d3d5b9d70942d5ebd5ea106c9a70c4a5fb44d9272b4542e9585c570e901e043d7c75b7eb7dd04f25a5989e024cf8dc292576a1562523c7fffc28488bb00a3c86b5e916c9e727b4c1b74ac54c355ada75d6af1c701f4093806313e47ed2d3f6ef02c864ecd86a725d960b7c51bc1b7e1fa95259c1ecd3c015494a4262925c7ad6a3930c3f9506331128815d0ff561d68f873a94f18514adf4d69334bcea96be82c434e6b370413d0603b8555dfe735bdb215aea00ebff0d8c6a0f1b0825a28827218d4531d4244cf16dbca47ba65d7c9a913eb7ed2df33dc683938b8aaf97826e751a43009bd2408f178c612f98b59cce13fd062971fb9c4282062f9244ac0ff1bd5c9eeef783160110db1c596b0471502ac32eaf410d0b1c2f1a8395aeef12041a69c14223de3dd62106dc7403332eb0a161b511e395570fdf85559bba3c158c8cd8b2118fbc868e80d0997a530153e6e1a05fd4412cc76bd45f596cb5225fd466fe27f037107628c1a9641786bbf33311b96fb021990707eb8d95650647c0aefcca1fd25cbc6420b82a2829ee0b5889b3d23c2235d6dbf610419a20ada5535f6676ec94f6c594832e8cdcebd25194d703e87bfe2dee97a5aab93122398fd1d7849d878708cb829dca91b433c490e616b6b2fcc26779cc575c228a3cce8d336aad6ec4d1cf9d9de2542bb32950ec59e320fa631c4a4318a9972cf0531061ca223ec46ca6ab5277fff29bfc781764d3001824f68660e6eba912f5918a33eb6c8eed7355f6f3cc92d4cc576025f0f98740443c2060c4839cce94dafdff2706747c89ca3a7b631439d869aed27abed7556b248e74572ff4148310844726af9da327bb9b78681717189c56e5ccf3dc79c85b183f26523679facf8518b7f5358af970a9c8a5ed8071beada08990e25ee370e6249d2145f523bc604901b5d8342b910d73c99b2449e9979241d68ecf7b881b2a0f83e60bd58a46f896120aafbfc84097a067d553699f4c2db0270bed3db7af7b2ade5f745ac9e1cbe70cf446903f678aaac2f291c89a8af5d9ba31809ea51cbba541604ae57d92747688e79ec00f6f1e1807aed35d87491c61ec89efc66b3deb7c29c457a5b8dfe10f0ea4221b9f8bf58e5d55caabacd85966b77037e7b086fecda56182ea3193166858e110bc7367fc5b873dbb320413b35af50995b4c3d5887a90f3ab76ff56bbdf99411727cec912c7c37c6bda45f5245e2dddb22b21eeceebea4aba76223347b7d97a7ae2ef7de2c4d982493073501bd6618dbb28643b9ad15eda8883d8819d32f6254a1e736ffcbfd7afb1027cb23c31e37b09d9881172aed29edd5110556cf29a4243f2da5c812836731e1b4cb207a1fb2a906bb2fc52511017f6ed70a737bb468d1134fe66ac464ab0bc31beea99f50f36e251e8c91a5ce6e42868a4919b3673dbdf25f205833191d6560f7a00c0005374b9f055e772079405dbc2f52df4d5920fc27f9843c18904b0cd232856a972c34268b201b641a88a1fbd437704357bf0f43ec41b1b336c927630208813e7411b8132fd165688f7bfa387fe4badaae04b481af67ee6144ce6369ffeedff4957dc11587cfacfe137be4adc52c6ef081af0b7119d97b0dc4240e03e8708f7009e18ff6b746a30c11fe53a46cdcd41e4f6d360b4c29ce1c5650cd93d9dbcb0ea4c0570e42274df948a332fdea51700c2c078092ba67dafcd0e273ab5f469adab51be8e1fbcba3674c14e89a998161c371f59f0601b6523a51bf7fd9868ac1d48c04c29ebf4a5e58b4a678fa6e0ed1f339aabe76b0de3f63ce4f80a2e120036d272c4435667401c1406189dace1557396d30a02338231ec87dadce76f7a0e22de1ce07f4d7a2f146da0e9790b9704f33db5670ad2a8198c61049b1ce857ce6dddefad7192e4e1d7c074ccdc5caeb2fc897029ba42426c346f8fa593010f47670f97693b0f86336a623d113edc58ddce0f58fbfe2cf808f05d3e8d88f5892b1f55c08a279fc124957e81a3c3cb6f1a1f5f588029bcdfdc668b495ca06c4be0809cda0068157898245c5558b74f3df47790838d1c98b2eb86a757079f0a249b3b5ff09e2a344d954c9bb759e1b1d828b06485cc39710e3a9dfb4e4498ba1ce831f299ac1518c55600f503f57f8070e94a503ee597485f64a2a562f9189223922a511616b5c1f31f56a50f83d65b3e676c286db4073531c4c2454b7936b9f9935c1491fe9b6ee67f833e98f1d3d5df2145de25a9f2b44be0db5ab750a5aaca819ee94dec4a5cbb7134e948e9c3848ce86aa351ca8c9685e96409514b23ecd7ae73fcdce4e3aa972adf3b03958055f63c3c3ca2a62cbaa8c9f5f467eede6204ae8641d29a64b02eaf4998e85e4acc6d8d609b46b5c9ecbbdd580211f8d4e3538301617bdab326d236645d4bece39eb8f88b61e8231a5f935eac71438bf8b53c3d3dce6c95e6989381ccbe65a1e3f2d013a3554fa7b0c8ccfe718edc989768bad0294f7d8438aedb3efbbce0888a65875ecd28c5fa61d7b5a71b6501dd331c3d21d39755afc9b9bc3ff82dd991d7bea92455ebca20425c3ea3ec64cc4a38cac5eb13bee7fcd3c4f067388494d423cecf15cb7c6d825eb7d30a249f35958a3b81fd6a062a4f95e65a316c26c247f78597e9b538953558573fb2ae19e15217d684c3bbdc689521f4d7a2fd6a21eef704424a444707df1866db84b2b917eb04fb64191b581d22f4a6e9bd3795dde0f97666f7ec3ca8dd6d0ccabb104e340446a19bda6b5048b747adcd929dcccfee5482964f0d718b351cf69306a5f303deeef2e61f0822ca2333a093fec1e982826750920b4c96c96ac2dfa083df0b4bee976d1df06964e0774772ed627df2319f630782d92f82d0a640178a41ca451880f4d54608faa7282e0fd96fda0371beb92d7011b4b1572471477ca443e64f34789cfb59e5834589f4558ff18a3fa3bdaefb11f37650988b216de1fe8d6387c82d8e3fb700086529829b230dd3ff2894b516fa24cc4da8ebc197f54afdd6ce20dad91b17c23bcc4f4bf64c779557bd9cb7ae553ef1eb299170cb52b89ae848e458a7f0989f5fd646a24dffe55fc24aabeac0e41da9f741010fd73f87c517eee6828ac3f704e13928f239297effa45837f889d38a067ebc1bd54ecd96319bee18f2da2c300a4cea566edfb4207342a8898433e42f225caac9f6dddb6a88f228d761e46bfe194c1f312d1bf08eea1cc86996ba04fa7e8caf19aa63024f45658eea0683b68a843bab5c84cd134dee9f1531fb1facced169e2ca438da3381b4b47fcb66f69ae4f831dec0b0adbfe71014bf1186b6c0ffd3bd3ec3abd228e62191b3b5517b5e11cc6ce1cc3cf4920fa49430f5392159d8429ce5f8b5a50ca29380006c7d2541cf863a358b57b5334432aaf60f799833f6dad05ec91a735ef63f92408d582744151afd3256534bbbaf11e7d1d07277606631ccc58a45921090afef8e0362642e187b0229097f63171f3ebda36de0822adad3d776f814a78dc2d1986ab4ece0d9646e2e6523cca256f949cbddd0ff71d77755253c96ed5ba38d22d5a938d7f98fe4a7a79ccbd9cc798a11ecf09d0d74b63eb55f5fc9f3ae5ac9f3951cdb03856df66cfd56761573195ec12347c3f881a0698f6c6e0797a6019f2e2a3f320ee05ccd6f43305fde320a1fa05cec964060175fae54d88aeebaa5edd7c4d3a8886895d78621b4a34acaa840b554bbb9f5c9a8e119e96745dda598bea3f62c40429d81d982c51fc6f65ca2bce9bf6b93338e309cd4f8815a0321f971a935f28fdf3f368c2b237fa422098bf2f06b6d303e775ea92e93bf4934733481e78e6aaab46de770ec9464ff3c867f4083292adf7314a0e2f309ce4278c412e48c20bb410f920e4e8798cc265cdc10d34ebb53e5aa40cff826f74561d8f82c057dd801585ff8fbcd64b98f6176eba19fb1dd84554719c41f58c7c89a3fd248cb09004529394cf5045257ee836c9b9e551f870495684c25c5d23eaaab62eee6331db2a27576bb92553824c35c02e9ad35c9b6b2727041d272881bd2ae3d94ea99422dd2faecf051bc11a167ba39f79957ba6e6e3f58d8108e9287bc5ae37fbefea9940513f56e71ecabcfb1a417028482bff715de3b1f7aa867bf7948a129de6771597ad289de7328ceb3c931f7b309098668478936903f0a3959f71b764aefbd94a420ceab8c892b06006fec4dc672d9261873a3cc0e463a0dd28d1aa4492912d09395a7f4b4d4372d288515f7bc18459f723034e93388d91ed651d6a9abd250758f38bc1cee65daf5594d98bd84974ded4fa873dfb06f3d8a2a43d503877c418f3fd0f6b975323f1181c137fd56e17788ac6e35ab6417c8ebc94ff33aea5e6fed7a4bf17641a093f44752774dc9d83ffefb839", 0x1000}, {&(0x7f0000001380)="2e78a74cbb0a7a666d01b72ff9a6bf0268a2a24d7bc7aa71efc7642bae06fa33f070b717b6b6894c19cecc73961b4b6ce7d7be90dc1ddfcde8011e167fda595c7f14909d7594a28a1b2acef3914ce87dce9eba81f578abb498ec45dffbb42a12e217da73eb7ecada0e0de6a00cfe1dc77b52bfdfd31d62e9ba512405e1688447d93146d564d91d67526df4268c6315de7d90f2da98367470612c24c36c9362541a92fae728837f12db17b82020f741fbfb3fc8e7a73e035aec2bbe2bf77237b97947ea4a2820be2168edc57ea5ce1c7314bc1ef29805b82c80f7aaa1f540b6a682548d", 0xe3}, {&(0x7f0000001480)="c103b6da833fd6dc7b9b29f51a7ff9ccf4bcd9d2b416fe6424649d78b39b92b6f79cf5607f053d39ae31b97a109d6329c494628bd9fc846b4301f8f41e2bf178eb36227fccb6bf42d54a7816ef9f4d7f6f6e9d113f15ca1adea8ca0ac269460a0b42ffc32c466eeb937fb00261c55da32f76e7b696f51a966910a54f5be565cfc65448bac9748ecbb946d4fc2e55178af85f56b4f3ca959a8025b1a4ce848e0b", 0xa0}, {&(0x7f0000001540)="539176453850a312962c6116d401669251de52093d5abf65f9888664aad45be777c4d1ec097a94e106ce8e07a3b410ab429c31b48afa329f90de3a9f0cedfe33366eca16b03bc969da4de80e0487ecb4c975ffbb66b38013f1e5f09cdd984a5a89300521408df91855dcdf5dbf61455caefd878d6a15082c175b38e994891ac432c53fd7cd4b8213f20d8c276b006c7ac95a0642393fa2095c1f4dee9ca189ac5688e9681bbe67f3111032abc6e703aeac46af11768352d935aaefd3fb24566d74b5fe2d2f35e8e70f80eade23a88e41ee7c65", 0xd3}, {&(0x7f0000001640)="c2f7574e1dcfd80a9d779ee6909cda99d1b3479dd7ac0f41b61cace6777b89feaab78b13e40ba0d6112e22288ae6e10767fd7035aaa26dd80154f26a10509e94d0b8a233a1f6b85f1d916045709ef2ba295d207a7eff105e6c472d56c085161b5cacbb7aba0dd17ec21d92e2a82fd15176855e70b25701f5a74f573c50339af815fab0afb1c22c6bd95aa8f00162d145301006cc7d27114ef9777e4d9c998495a88c123c0563dcd23d5d15ce1e7ece661047f5fe0377ecee7546825dbcb20f86c4c9fd3d35ade68c685a3f4800d55eac545e284eb753a7c9218057f87e291ec241bb810e55d36cca9edd32eb1d8c8c11ad48f3b5a4bbc8b8fd28218bb4635193d2609bab13a0d5bf9eefc0f3ba9f1413873d08f5b247936d6d28519b6afbdfdc91c6d2738f4f97466336e863a6b951d477c0a62b60637b0f73236d38f2a4c589d272bfd97bb5aeafd7c58038d8fce41e44d219679045252e46d42756600608035f79b905df4dc665a72710a2e58b3f5def59db1191440531d476115c7843aff6031a53e3febd7053c8fbe0ce8188833d0aab2712c686c492fe2b39fbf93ebd91aa2a998d3128fb6d35713c4f39a6131977ae5ba144a818ec7e7ff94683a8790005a1262f9d0f64eb21acb44d736cedd9f09f17e64b3934d24032cf3e046788dec0464419eb95ebf123abb15d19beb618da9697616b1435b2274ddbba7987a2953ec4a32c9e3845e27c2fee616381aed3a6c56e28d27ea1423a684ac736f3deb61de45c56e34fe81d19c3b03a0386ba46cfa3d6051e56379bf5107c98751c3da3adad6b95fe5c88d17ce8d86c6622daad70e1f3aab79f5e3df1c541e59ebbcaa6169c2136376950c2a6e5bab7f23b9fdab7a71690b1ef8e7c81530e881d6e8aea147b6cbf1d321b175ff69f9b42594a17f3734ffd866c9672a7bb65f11e201d54f5acdfc9087fe6e1235f71a99aecf9e6eecba4178c418768b463c7fcd550c270c5332915ae1527da0a1062a27654faef856412d9879f050c3b79e905800e6402d3a04fc8a878a50e2ce922d1a1d6adb9efc712c240fce3e569a1f84ef69d545fa4edd39dc548e7720f3c1cf93847edb2dd33c2a7a38b26bb28fe8daa147208739da402a3d5b80b099c7ab14b9c94a03315463214a98b18099d71bb2f632248fb0151b12bd88b20d57927fb9a25012deaeba0620f51c61486f99e748ccfb8b5ad0e0b8c064a8d5ffc2cb1b9fb85b2cf52e31e91d47ecbd6bdebf78025b3d11731a0891aa5e04935f1b269b7b4416e4202aabaa7cd2398428f3acd2f924008e21c8ab34dcbb3341b6d3728f33eed023f62260f146f0f2eae2db54bb5d1b0a3f0595fa8d0846452a62e90c505ad8814adb2c9a044ba5ab447fb511b6ddae5254bfd09d9481197f8f3ce071c476a8d044c6faefbb2154f6d0aa33a65e51c105e6758e3885443eb3c691956a5f131f40ab6cb0d008e1746dd3566f208829fa2b148f354036360b708774868dc4b0117014bf812b48b4edd0a8b4c3c6cb9b5b2257361795a5f1da9957c3bb44fced4ed1a3a239299b21d400d3d482255e17521c7966bae8fcd014797a890b5e7ffd70e7e8b5c727c335f84eccf99657679efef6469ec364075752366e8ef809c3183ac6d18e6d4778e39fc17e52a012e022cd17e11efaf1650a629ab6abe78133996b41ab552fd7d5d056a12710d33780d92f9b8a955fe48464bd85ff154126f03a70c507da70076398273f2cf27829e4d221c13fec12d366062ed75cca7f1f0b7b0342f3d3f7159d7ce7d2d6a9b896d0d668bab58421b8dc4ba94354e2e03ab0f7f080945562388a0e08472a51e7c1ea2c681b67a7cfe36153d2d6db73f7654abf8f39ca1ce5867ddeb00bc14b2c251e2cc107c041f98627d34c68219b7355e3e5a8b5fde63288b1c9f1a8c7be6ddad9dc5724279df116636776528804d843f4e1abd0f79749f7136708d6d52d08f4392134916f12901751f091790f56c1316c2168490977f3369541e003b6f85613ccb95a6f5691a3786a367c51ded5e52fdc9272eff68fd901225a26d3d31635ceca0094e6ac7c35e8a83a892ca0f9ebeec749344c80a8d73901cc416af1cdc4b9295b67923811e301b1c19cba9e481913a538f915e15a97cd50384fa2f0506742182f7b8164cc7f2be258a03999aa1c37dabfb69ca0d7f512ffdd3e942630379b87dc022f862a5fef30c04332ba135e382cc2ada2e68441d43f16ff17468095be42f901e3f9aaba7a07874e3f38b1cce09bc6fd05cebb21a4a77cca1d126531d1a7b4eb9f3b7c2ec7ccf07db84a6d18bcede92cf290d86dfa07e7c549a8e725607def1cc0502ce7703d1ed7904b5baadda45aa15940e04dd8dc4fc13a2dc32d9cdcc743cf7f110d99286fdb47d7724d53011b8afe118fcb3eaa3e475036510b33472eaeec56b178c5d136c3915cde74b5cc3ae87dac73a3f92e908946263741538db63f7aeb541cde8053f2afe9f9d787c164124920a5695bf551831b0d4e6b09367250ea24ec5bfcd7b2c3064ee7d1aaeb736126e694a4550c3909c74a6ce1ad10fa5b3131f0cc7987bd633da9675737d608910a09f631b377580f7025224d431a4e83ed9f0967b7da5dee4bd1b5af9129463c05c7e0b047e6ff6a24d8e1489dc70481b299f0740df050c02ef0029fe2d9a8458ff49db4a8c5d547a81a222f02d9560494aa50bbdf5ddabe90cda05c70100d28e6dd45a3555efd1aa8db6770c8fa7552719b4a6665ac18a7f2c5a1191172758d41a5b1a9cf532a18a2f6355d272f583fa28c02a62ea61090cf550ea4f024f30f968390b88c3cea1da8ce65d2bde700dc47903c8af5f9b01988acf778ad74f5ff38e2de8aa2207057b9a8400da4311bd368dac42dc39271a351e0e27e479ba952477a0dfd7e46fe86a62c84a6abab805a1d931c8d4c8f9565aab1365ba8e64546dbea0939ce45d91854fb6e2080933daad91bed07e3851412adb84e45e27c1354753826c6c7f02a00eeac4907b7c0a4d7a0d2371ca290972903def519235d8d91228a8f1373db2ef4e65f37ae27cedbd7cbba448ce5791917f1bb686a4bc586f8eb28fc24eaf64cf20521536e9f6921f1128187cfbaecad2c535a98581c8ff78b213cccef1de27625ca67f782c0c66e14b8cdd48976cfd0e253001ef23b005c4ac08afa0cae067b6a49b68a7f12df31b35fc36b10f59b147a590479438708885a2d37de055735baea375bda844564c8b57e59f067a311fbc82f3bf5930ebfcc19e4f8a602c801d9c1e9a2fc25b5763a95b8f8e2c3ceb51a9fe384914a72e693fdf6814715abed18eb9bd20289e96f15b0322ff6e7ca124889024ed2f5f1f4a576cb7e85490d45082f1fec23477c54dcfd895194239e7ab3205fc68df3f33b31cbbe45769c28db9a6e7370b0922a1da8bed32357089b213e5c9e5db67f74205fd5e1c1ec08044d78894d1408ab849a596497e480a40f38e498d3cac0f487e5a537b8f341dfb6aa46c20534a3362f2101aa1511a0cadf7ea2a525ccf7ea5c790bee0956727d4f5c0788fc853f21db8104e0f52136d95a88b51c27ea02fa8f10081890a576b07fe2b5bd55c085324dfc6af9f5679e43b17fedadbfe874ebf6cae21a6b3003bfcacd2aaece64891cc266ff7e95f7aec4a8d892a926e847fc4aa875d11949b16ef0b8c2c35e59575f2173b2db8e331c4d0f6c06a198835aaffedf6e5ea300aaa9084a79f221424c77271dc81e518f9c48db7ef86a10025a6ad325b71467875f127a9d01694cd47d299f73954f6edac2c31bbe41452fa9cc59787f6484a8ec6d154e643983580c7e4702a1db38f1ced9df8d185016418b59fb2797feceacbebb48942949c3351cc278b53ccd5609f00fe4704dd34a910a5dc693acc23434942514a60e6399046d6b2fa93850d7984dd367e65863f93454ef8af75289f009e14621cfa77aca3d8b48a263b1111aaa286521ad1d1f0917fe28a1c235778c26c246bc263795b815b76b35b254df9ad83fb97a8fabaf8daeed56c42d2eb1bff98ff45cdb2432dc5fb1576adb8c6bc5a4846aa70a15232bc7d79cde67a9ddd0036c386382ca564dfd63179004c794ecb893785dbb0402a93e26e55b36e327ad170782645ab540d21d1c381fd11dbb601d5a5b1dd7952ce4edee1ee00023719bc0a5f07eb03499dd172223b5c89e2f96a49fc4273786ed4bd23af2603ba82896b77717d7249547700264d2d65ff485882040e259c357599999b300c5b3f6f88b9b708c28c01abc46cb419c87e44c6b95578b9cc035d46b01e6cadcdf50091e32a98445d7b56ee1b11d4d00642540c711e49a95556ab4304e84fe7fd09818e8ca0debf82bdbe3df144dbb2447c2c3ef8cadd78d263ad8dccb850da1c7bebe42d8e15aad08d687249c02de0f3255320fa6d130595ed590306ac662bbe68ad3950c7b1b44da89cfc278ec5d09eadac2a3c337a1bff9d360780626724f0e5af6d1f01ccc53331ae5a2d10db743b7c22661bd94b5cc3b3ced5e77ca550872c846fed4b9cec95bd6aa588b4e353d4063c30effcedcf2ffdab6e6226071c2228526fcc2a75f48dc61b1791e8e1eb2298e03c68a2653cfe3561cff67826ccfa60c0718fd1f7f535ce6c4b0966e06eca039593667665e33a7e7015fdbf087ab14f758c11471c4a0eb347f67c30e6501df812b3200017353d2f01575233c773827fc140f73d09fe3398ea477756b4777351d656ee2ba1dc06879af3e701eab81c7f485082420c2ec23349e61d128e03d5b001f95db16c4c293614a7068f0e268f684ef221998275228f6505a6de61f151fa79bee3f24e04ce1e798d8ea6704fecc10425eca858e6dd62179288dbd91a7f1633a91ba2fd636d2eeca6351be648b60d673e65b4d9902a75f7fc9ae2921cfd3ff341c93591475d36109c61052eb1394ea3193126c074075ba20f4e3957801d6ea2a03b5561facf3e0745ab7457379e91ca5a0dd81a8b82a9896ff0c73ca7c90c3c77726577a9d2ae213b99e748ce6fcd3aae5071d56dce3dc80ee770e244d63b326ef75b445ebe86211bb39fdf0d53d87b9b1f987294a7868479587880f4d882c81ac2fb4c2f9b680d83e01287c0d2b3c05e0fa633646807325f5f9c1bb237604601a5fbfcd8322079fa048abf5cf8d541e423f6f6cac77f242fb9da5f1568e475c0106b42d8cccdd36aedf6c65ffad388055fc1b1d0c18c5c6bd26959b5cb1900fdefca212a498aefe44ad9b6f6966bfa6038314dcdf1d5a0366663fcda6d0a2e62ac78b96f7e8379fda9010d5184aa7943087be9dfeff933382b27d6cc5ee679df4dac41bf123e632272b55d4866cddcc1a1071b952c7d98345686e992b3c1f7e6345935de3e517f70eb9617c3d44e7c29c30f510c663c53a9f07d3b1cd5abfd2aab3e40056a7aac2b35ee8d056d28abfe996c4fd125d99eb304958b02a53414e33d84d570c909557af17e447b5599f358ebb9f081fd08b417eac18151c4684726d4758a6de3d91c301f6816cd02acec5749c1460b8c7a16f62aebdadd550a8961e53a2b34fac8d77663804de2952a246cfe1a6a7570b7154ac0a26d3ab0d0297730019eb8575c80446dbc22763514698240fcf8e45e93710df6d8dc8ba697645812a47d7703057da6c574898c42bbfc4ffb2feedcffe48820dc0af25f4bfe695d35577fb7fd6987c1df9b76c38d630c6588a5921f212ad0ebfe4bd0dd5f9976f7649f6b88c31823ce503dcea09f1bff5c9a0eea5f53364d1a537db21503c78f465e5456ae43", 0x1000}, {&(0x7f0000002640)="af1e2f756b78c52f506bb347610c89fa648d6faa730fc9e754fa661e0f2c1f49285bcd2993708e22bc580f571a537846412d260e88911066bd6262c3301f444efe328ff11efe169897aae259aaabe804a001aced09341be3b28d200491ad96ca960af82eb5d0a6a8fa57cfd3ba7e422fefe37526645d44e7684a4905de7e3af65d486340ed712f391e646507bf8abce0e0896f59d67c160f7d3dd52b04d88d7697b635d560e77c884e096f45f6273436802489f170", 0xb5}, {&(0x7f0000002700)="bb3e07bba9d24e7516a36aec32", 0xd}], 0xa, &(0x7f0000002800)=[@ip_tos_int={{0x14, 0x0, 0x1, 0x800}}, @ip_ttl={{0x14, 0x0, 0x2, 0x9}}, @ip_pktinfo={{0x1c, 0x0, 0x8, {r4, @rand_addr=0x64010100, @private=0xa010101}}}], 0x50}}, {{&(0x7f0000002880)={0x2, 0x4e21, @broadcast}, 0x10, &(0x7f0000003c40)=[{&(0x7f00000028c0)="9158b5bc091e058fb2d897d16fd2de409ed353736dffd25620db5b6dcf04d8b3fcacf9ec14fe514c90e90b5029b5f81ab4b8091ab9ea512e478ea225e2ef9f92cf448d61ba3eb6bcceb6f4503a7715d6fa572bfc4bf6feaaa5e1694ba0affd852b340166714b9ad913494b5a6c37c17516f1f2fe4436abef0c81d3574e71c84be9a7c4610d30c941c77cb69b04273c51e8b9b7946a6b26e70aa5ed3b60a9a39adf1a0b05b4ac78cc077e0a7d4cac81b102b4556d333609e94d151ec1b1386fcd3b3acbc59b1a5e22ee07bc18731e4282ea42a04d38f5eddc6e29b0a70724e0db71391da49bd732f82d0afc4f495c497f8d053d9ac93bfded68f5e08dc33c9225c2ef92e237517648373a79511a3f6b78c7667b302f217877f9c299a4f42485880567cc62e215e9d5a9857ce6417b9f9aa2d9a085dbfb25327a7d764cbcadc5ed9e4c19efacf20ac4f6e94e0508edeef3d2a7445949106703f1a5c08262cde3b295ff77d628b6c9a7e5b265cea245f9190461aaf90f2d77673412eede7bbef69cdfc421898c17f8022eb1dbd310eadb400301ab98ca6126e8d4360efe1b8373ed7ddb94f30445fb34ff9e12bccbc915e5ad32c841e0e7474696095b5267a6df02e426f063c3ce73b334299d43e4b5ace7495ec4ba7bc8c4df65bd75a8672b937e520a2744a3f1e3af38d5f7b6dec3f5fd78e53f5c630317ab1ea08541b0a0b3cc2e3ff09b8f769245635f28ff735656fcf9fd037a14274d9ff7e105802d072f8c183c39f20b347249ce51afea2e2470dfd4d8e23bbfcacf286886f25bead9a3cb5d35c40b725cd9952482ca842199df30cbaf28dff06924a3acac961373abda804b87634d784f9f1adc88773054400d8286e972e5d6fa0ce982411f35d37bf9f5c5fe4dbef8617a07503f62189474d8ab55e8deda74dd463f90d0d7bdc2af7daa84916366d7801df49fc886497630596e45a8d7e0ea02f0a11568eab26bc94f401aaf98398c7ac05a8fe164c78a281cf5f3d724349a6ebe7f340880ecb5ad01958e0dbfd2eb450a8c5b1c5879d0a47c7b37099f91b0cad8ee542510585f825dd51884eaf409dbd01f29281dd1ee3152b58184ac23d19860e05b8120da38e2249236c5c39f94724a3ca7b4fa799f708919ceb98972e7f910e0727ef8b70e0f00e119f17c7e13f2c3fd3364d63bb7335930d19bcf8d476f4a428a04108ec0b3bfa1205d92603066b15bdd25feb153de23a1e7c7b7936ff0c798dd762d6b55dac912ea534b55fac0cfb66eff2761b073159bce668329b91d94f484c78c1fc5596276f76ed88bcd7ea23c29ded5e0abb0a24f52c9ebad763e840f9a5f4be9175ae3ee6dbd7f0097b3aad5537b378cf865e253a2c4a9a76604e1f56c7ec0e08580c5fbba1560b04c9270ed3110db90d690ed05973aa68933112edec36a1a73fd4491fa56ccfda3d6acfed88c66e1dc2274670b07e0c5cbdb51216628857b8478cd3437db71e86ff2454b9509f8c5058fe4ca6df0fb7f3e685951aff91c5d61a432eedb24f6fe2d64cba848b56a35d77a040c78c7594ee0822b9de19db9a686dc6a00886fc1365f04d9b4ada1b30483e517b0b89f23d8a6877e06a93de3a62bb8826a3cdd20b9c3c7e13996ea8c605c90c5b99deacc8f0b1fcae8383d615a113b533f72d09372f68593b3b8774f4badb8a48a2d26204dc9f4f2224ee9c0f2498c8531eed6b61663fd1659609811909f2924dc69d8e0a256fba49d2c1773b10b07f25aa852f082a209e00b3235cf9654545e2c1ae499f0d58e93d201bd08ce9d40533b7297fba07d095106cda74ab491a456b2d6a32eade7a6c64d144177194da571b582bb9f1952469cabb1488c4d05ad94c3280e00a682deb1c4809d89e47ab2917a597ab0cd6b8472e6accb52962e0521ae25e5c388aef73cb9fc6ec6c29459d8da25fcb24d58bc524ac70abb8a95b72e20810c1ce508f764b9102fc28e3c6609a9e67d62c36d18d1baae5d375c459b429b39f56792a0bcd7c2ac14e3436e6b90a7d28f674ba2fde2c71c9d139d11459484100ea020b966d0d63dbd87dd0c617746ab8bb8807e2fa64e0073e7714527b02618b58d498653c4ae36d6c57ce57af337c6bd24359c16cb5a0b2b3fd4617f1d8e290fd6193cbf9dd590f9c1ee5baeb7d42389bd24bd5330cffbe093e9794ee3a28e3c82a817bc8d60a02df333cbeb87452094222f449b509ca190790312b288c5574665477f5628911830086cd28673907d3d6fb0f3144f9ef690791aba0ba0961193203a017db251a916e6c69372971b05f2e2675e5bf615466350a2e509c0e3e106c27d29a9ddb9734d86400362eb66fcf3f48cd84d43f9c208f4c71e2130769ae2fda02bc76981b4cabb9801788a1dbf30f495f66c642077164ababe7378096e2bdd48cdcd9bc465d5449a797c451cf4d1440024921b7d78f1c20bc2231130e5cf635e08fc36508be31a1329c892ec04386f5011678d5b99c336220daa339022934c2f5566ff03986d865110b5be905fbd81cc9ed072554cdf456fa70038e5fa44d68719b0757fb8bbd2dc75ff7fd1784453e6a52d15eef8b1bd935defc7f11d0036792ae8387db41541840b040d301748c9075160625bc6e7c65dc131b28e75162d453e86e6515cfe5f175a0d47132d0c349d4452837ff9f3ca776aea256ebf349fca0d25a90a56bd7d9d4856bf439f811f15c4c5548f01ff9a8bed98261374fc9a766a8912c4974ced6f7aaf9b89f04aaf68249ead154c0761e99e2327b00383b8a28c3326618f3dd9de13964d9e05207935041f1863cf2060d951a89dc62810b74df8894c2bad3a7ffe71ccccf8ae4792d176dab7e4adc2405fae6c63cce26ccb100de8293a6f7c07a58e9d52062089deee2d382e1ba1ab0a9896a43ace9e00dd3a336ea6b013d4bd52d11e46e371b3c554b6bffe75f3a02c180425269787058ed93a6adc4cc5be2ea20d50268dae4135d38ff54344a9f3eaa2032893363fed6105c6ee35f25588d6220b7905d617333beb986f56e231f0e8d8653db0d54fb0b54b59d1b324adec279562f22f4502e263e4665ec24b9acfc18f4fd01b178904c99f6bec576dbf0a6c6c126128a451e4ac8d8bba2808541167a87a1b45ad1d1184b1e5d7ef572c33cdf55b363f2ca2e6ea16fe83486dc5dfe0bee8d47a2fa4c89ea2dfe1d98bb05560633c3d0e99ba1c9d8f9b3b820f34a1029d20a24266daabe8be98e05b6baf695b42d8388a23fcd601c27c7109a150b937c51906a6c032fdd1acbcc8fc93f1e6458315dbc02ea0e30002cd4eec1fa2d5e08075e34f2bb3d511cd51ed0f8a590db356e197122ad0f6569f41c7c57510fce13b4d41e14821fa718a3a8ff9dbb12f44fa58c1b8f2f3c1ba00d6394482d19af87d22445f001beeba549c0eef0f9d04cd5dd7e40f281aa3965b786fc0acd66a7f84852ae34d45385b8dcd9edc7660dc54cd945c01335f520b1a00cd471e5486672e9dc4f09ebb7f29eb14720b8507b328c1b6c22e73ba51aec8046957e94bf6aa38df80a4fe6042b0f83ca78d9f2b427c2814a7171ab1c4dd62673371db8b4ae04efb6251839554930719adff1a5c21117d4dbb2c33b18a140d5c45f6a8721152fa65ffe98da7b4798ef6a3d398df2a984a5c67a4ace1ab33d5ccd42cccb351bf972cb2a2e93f5830f88c19799a5921d4524c42dbfd7245a688a708d1bd4d9a6d62c24564f5979b0763876b0135f217a16fd9a04701d2ffe89ec268ab9b87bbc7db9e929057f2d1fbed6e7de957578fecc99c6827d0b3e04371149a84e2afca1dd283fd7c972da87cd0c555bc856a040d8dd4acb8918f7a0beb8310e2856a4a7f57f627934121c058d20935c09ca72aa872a8a39b08d1f66ac25b6a543c76ef8c8dff66987e236f9c089ab78d04d5728c0d2a0fc6a7e0c3271657fff2286eedd2ccf830bfa11e7b63494fbfa131e5f8b7f3b02407a26842e21ec242b5542bc3ca8c9892684944363cfae44c9d22db4006ae30a52b8b7391cb77113f119977bfe9811fd79648757f4d12b7a560dc2114b5fcd53b4b5c06dce7cb340e29ad3c5cbff4f48fa9b6a85b033e6902738027a9dc459b4c6860cc995e84d5910c52ef29ddbb7580607affa4aca567bffb9c81cd3fdcb65fc1313af3d4c83b5b9c8c2c370f62adeb94dba6c5ad945e2425def06320fe6995284c8e8447bd988bcbcc814b405bceb5f5d98c0005457a7dec93b4af44d719af1a8702dbc02f0b4eb891379fa8cab607a4b6f68c4b06d14a79f241434c64720e8eb221baca15785b64636e55f611370d5c0bdf3b51f4b533765204c2ba6729f9631ef42a95641696ddf5b74d2755b8a0c3c222912df691cdc7bc085384804ec706239bf3ff40633b35e8198578e62fd5a38cce248a081f9fde3cdbf4e7fe2937f1480c52e2b5462980ec270262b05f26bfe1b199e40178342985cf4dd90caf21c25a40bd6860845faae69279a3424584d9101546275427a82aec7c88743a221a2d4225327a787a938bafee41646b8f594800896aeb60e2b5f6f6ad00895ca488e806204c4d559d30e273785dc5e243cd8bc0e795e7cf2899c1bde423ba1afb16b6c7d9759fc8ae2618734f7c8ae269aa060d59fec92facf5a50f2124694433ded8589739fd60a1552c29bc5e15d062eea5bc5a9e8a906b34e0ce687ce2cabdef9feb86eb26d50597b8e09d831ab08ebc3b84de4dfc9f9ad633842060c0cff953a894b98c548861e50a3eac95e184e7e6462a9238fc9af8f13f0b5ba593a2f6f57c8450f53be10811c74d29aec0df2ee8d80fc3709b3174e75b66e4def512d566c9272393b7a6432e89544899d9729f186a07917cb74cac218286269827d4e871104da1e1be39933842a1ab66099311b862a2c17345321eda70adc4a33d3aa7dbb64edd70361f6f0b6232526df47eeb4d3f9161248bb65711b1091c55a3612eac2e57594619bd6035ecb0e7c1de309a5c90b56c851a0788aac29a408e5941422bdb40002ec6058b4881d2473086162fc7ba7e1d44ce5b85c7331c8ddc5d7f658b3b3341a15b231c3600621aa9d7b07fb2c92bec8c31a152f12b6d90e15b345fa9443d609f7c08ed52686a23c92a77d79d0a9f20059325d3dbd74b81f8fa5492769867e45d4e74f55c54ae6051b7cbb052005cbfa1e9f0147e64cc0fe315ead99106cc3958d4b2c751dd12b40b33adb39829ecb9508948730bea91a8cd1a2839a63b05fb90bd1b88e10a9c0c9f7f56aa8bfdde712beaddd972751d96926432cb02016ff5a4298c5c9ec697af27549d6166bc67e7c272ae549990317f2c7aa49faea87f4eca840f1602f74383c098e8e508bc449d819a41658a2169385bfb004ac79eb6e8e7fd949b1459b1dba5fae99a8a2b64aaeb8fa9ba813e2fd3d18c2b9e17cddacb6b996b8c683aab7a52bea04df04b22c9287184bdddf4e485d5c3d2c7367aa2a08c54dfc76b647aea1ac4c5de65b69d3b2ace28fd93628a8e8c0d5d56aff5a1d91e65357aff0593aa97c95c433833f3066feeb9a8d62bbd2a431c75bb503e8747e677ee88cc5f01502a94a4a61516e51935f86f89fbd6fe7274db2c015b2de2790dd9eb2e7e4997278a51010e7fd0ce3ef82ab50cc8ec65419f41754c26104dd4ac0df2efa1bf9ecc5772921aa312c4e091d59d73b705ab75a5392a032b8edffa9f68b5dcddeed8cb599e19bd0ab63afc0617303199881edcaa948059f5555e265bbb2e79a82ccdcf42ef0db9ad6a602a2d1a1b6f0bc11e5519dfa1c450d909d5", 0x1000}, {&(0x7f00000038c0)="b51db3919dc84f7879dda92fff5622f17c3d7156011db3ed4d7c48a568e2e6d1baa98edca664055d2f57ebe728bb93dc898a06a509435b06f0b9a5b6cc022f5a707f65aaba15a23c24102e12e6a77aebfdae1c927008172ee77e6c749562920bf0a938466601f49c28847b2b137888cae0b43aefe3ab5ef34deb537784963ee5c1f266fac79debb2ca0bfa4ee70c33acc606cacb9021dfe478a7e7b52c8c6c1f1261764db7f96af2c84c82cfefbd9d2170546dcf82e1414c2420704b1db5449def51cab9b6a952edc22c17473084e8dcc0c76f96a6e581d8c0f910b1cab9229f123b3594bd5b013e0c57d4c68a113994a0eec5c2603374ba0fba1d5f0453", 0xfe}, {&(0x7f00000039c0)="36a37145aab6400880b7c1cb478f5f98454f33bd176dee26215df8fa836638f37480f416990599f509c1e52703234b5cdc12c737a2655025cd0ed4ce25502ef0e33be24b032cf6911c1e50a25baceadbafaf397b47404154f2ebfa7e80130653375a97e42fa9651f33a1359d06e74fe8e48ebe1b29d4bbd2a2271cb768584f36452f240aa8703d5904898fa153be3b78247cf586d5fb4262bfadd36c4d42adaccb9a7462597e221cab9bee251b4515f53d1ea190d36e254206d4", 0xba}, {&(0x7f0000003a80)="ac25eecf55bdfa1685e8613b068a811524cd98c54f3d2d91d65448f00f9055096f175a095f9621f7e7905890c84ea9f46f2e67ffa17633ffd14d651ca4a87397032835608d921ad3c68f5e227ffdf1daf12d2dbfe119167ed4ba6b965fb26134fd6c3c861e1b8c", 0x67}, {&(0x7f0000003b00)="f8dc5c5afe11b497d17c925c9fab195f8e4b67e841e2329df389a9e20927af1efe902e3801e841bf3ab2", 0x2a}, {&(0x7f0000003b40)="2aa5f1466b25f431ae5a61088f404c01cabfb91ffe22ea51a0729043c48e5bb4981cf6e167d90a1783d8a1f976c0342221870313be8a4fd74a45e2da3cea386765af61f6febb5592d1ad2fbbdece370a2912205291d2947be6383f5cc95d0a7d7a8766a188203050b72635bf2e8385a3857097aabe31e7433f318dda28bf3969580ad3d3b5b28a20bffbe6bffec017da1944a05f433ef79d88b6361d24d4efb800db5f383f46f4da16148190de4c59709ef2999ae7ec946610b8747ca32f0f735b1feab0ce6e9cb33577e07ef77998c2696c96e783de90364a10bd34ab1dc4010e34f123098d261320b0c6d3061050b7a0ea25b66312f1f97a77d3", 0xfb}], 0x6, &(0x7f0000003cc0)=[@ip_pktinfo={{0x1c, 0x0, 0x8, {r4, @loopback, @remote}}}, @ip_retopts={{0x28, 0x0, 0x7, {[@end, @timestamp={0x44, 0xc, 0x83, 0x0, 0x0, [0x3, 0x1000]}, @timestamp={0x44, 0x8, 0x9e, 0x0, 0x3, [0x0]}]}}}, @ip_retopts={{0x14, 0x0, 0x7, {[@ssrr={0x89, 0x3, 0xa4}]}}}, @ip_tos_int={{0x14, 0x0, 0x1, 0x1}}, @ip_retopts={{0x30, 0x0, 0x7, {[@ra={0x94, 0x4, 0x1}, @rr={0x7, 0xf, 0x7d, [@empty, @rand_addr=0x64010100, @multicast1]}, @timestamp_prespec={0x44, 0xc, 0x73, 0x3, 0x5, [{@local, 0xfffffff8}]}]}}}, @ip_tos_u8={{0x11, 0x0, 0x1, 0x4}}, @ip_pktinfo={{0x1c, 0x0, 0x8, {r4, @empty, @multicast2}}}, @ip_tos_u8={{0x11, 0x0, 0x1, 0x7f}}, @ip_pktinfo={{0x1c, 0x0, 0x8, {r4, @empty, @initdev={0xac, 0x1e, 0x0, 0x0}}}}, @ip_tos_int={{0x14, 0x0, 0x1, 0x80}}], 0x130}}, {{&(0x7f0000003e40)={0x2, 0x4e24, @multicast2}, 0x10, &(0x7f0000005140)=[{&(0x7f0000003e80)="bfaf7fdd2cdfc434a06e", 0xa}, {&(0x7f0000003ec0)="1236a644d2612926f9438125b658efb2d7030fa6ce35a62a99bdb487f7133399a5616bc793423ebce89e8c82eb57371b834f18c5757d445088ee4f425b0b8588fca2ad33194c66dddc0d41e15919e10d7de98dbcd7f639c50f6dd743d1b08e25382c4a78c6734f5a9598b2c137d7f42e214faae2971f59510e19c05d678b8ee340d8c3be28ee472086a6703d005a9442b6e7b2e8c7a71a61e086a2aca309800b0b9fc4181fb619143d048b643628ddf0861e3051051114db561cc10e734dd6410fd90085da810fc1367b5301c420b233957d68a4bd41b42f903b8c6293b2d6248a0fb652d973fe70fef6ae3732a192917e1f922b5fc116b1cf9cc5", 0xfb}, {&(0x7f0000003fc0)="7e233655ec38423422629d766ef2d156f5e22ca010ce030bca8230cd1636d74078afadbdc30e66e50fc06e391df7c5efb0bc4fdc7f909c82fa3f9748d6ccc8e0314e2f04dff612ceeee3422288372eef719641711f506329bfc1fcc6be0f4ff5cc17845d6885356fb9a231a6555a2261e6d836f661f6968a745d8e86bcbb4f5eeb15dfe823b0f3e7d7fa3b34d023705984085b13647d0a3204c50345808b2d33e650a1b3dd8f0b0de2cccd8ef7a1d995444019fd471cdb1d1a87cd23e0085b539595c9ec23f30aab06cf0c681c645b745b111044570cc3d3589633e34d75931d95daabcb437fc2f37d498bd1b9a1b1f06314e013ee216a23f149dc650aecc383b6217e0a96488ba2fb3c917736073fe93ab52b456f3925e2e29aa3e0b040cdbaa690719472191bcceda51893a5737b2b1e57ab21c8ff02add2e61c159a2a0e703490f2b2de3729d3ca31638f53a9fa34f0517b3ac38e76f0fbcda776c2f7e9d2ea84cce8b5f1b18d4fb9047eec74673fa8a31a940436badc99525fe62d4c6e56fb8c3aa2bdf439d5475dfc1b09a81287796e65f7ae982e373760e88b762b2ff5e281aa08467ec9710fe0d34427d9a40f4063392e6fb48645d3f13aa4d2c95167ba7d6d63760d8f2a78af207fe518df4f81b7e573ceba1364fc15e8cdc683efe9589bead4027ffb0bf3df3da3214dd0285f4cc25eb30a26dc545ecf2e7d5cab31fc6eb4a42b0ed783372f4e67ca4015a0743d3fae5b9c5aa07d51595285a955152a498e2bcb49bb34a31916f6e1746080ed3b0eda382f5bcffc7ee0a5f538255150a9676274a272001ed0ddcb4dcdcca102b2b085de3ef940859acd28117fad785726a7677306c3985298441669944ddeb41724ddb7b8fd7b107f861bb5c4b5e0ef5661dda36a1cca9d088c7cdef23b1f124b68b9325a763314dea5d2e7d28944d6a97245eec1661c1b7a8270c3a51ba18c24f2c958aaa789320ca6915377cf7026c5c1a1b3a5243fe705978ffff42b3840f174ce5a0c9704880636dd3b3576ca6560a00824c2a1ea5e3849b9f136dd74f1b3af4e510db1ffd0f625bd2e4f81b67801009feebf1808a921ecc7cf57f1f072156cfbc1062bf20a05532f6f2593aa363d2a62a26647616f8ab975b7e11db0263a8ee6388e1c14cbd6fc636c7591f65a99065159fb23d91887509946a729896631bc5583dfc56449fa35e7b8105083c281bd47cd69e0f47d171103305068e82d826b16a198e8a533f678f456364ef36f25ab97f7d285ea2128132b8f30efd3389b782adca518eeb0ba1d26a7ed6370af05fd46f05c2d4164786ef97ce106799652e336d464b162eac3f04467ad770526590ca7bb0937f742378a9305bbb777144059c5d86d82be9247ebc5dc6e4a26c47a9332c393e2df61842140854ebdf038cb584ea152f9d94b46c3c0e5212cbff59cbbf5cd1b7ec1e0a33a4c96d35ec11ab12f70547404ecfae3c6be9020beac6de079e3095131a4a12b8539474e7515621bb1f91db5ca4476585880f9a7cb754c100f9066349a10f308791eb13c9df1431cf8ba5c7fd77738e8b5cef6f2d925f81bd6e8635b62fc949761ff27cdb1c5c0023019e3280a5e45d66a97ac85659231bcae36605ccd8bbf49ed5969b7b63c2f7dffe4c652a2816901cd0963b582407d9ffdeccc4fa536bf8d856bf3748e66225f8adb84e99db3db32a07f782a595ea03db9573c97fd04fa2ed95ad8b58b2c1d4b36c460b8854876c8533f57bb9ca6cd761dfc30f5371fc71fc4c9b8178d5c722d34c68c3ac7f6bd075709120f92949aab10460f086f1553cdb7876600c2b9e3e76614a074a4b1cd87358ec466448587dc53e31578b4ecf19273c6b3bb58fe9ee2afd4f0a055baaad808c06ebe19da760323d5bbbfa0297cc01249b7d61bbd29fb5f609e17346a0618c6a86d32f315f243bce6797487819925af8425e7e24c3b641797ef8f4d6d01e8c6d125bb78e702eb65d27f2b8a79e8ff4c2178ca368ccdbfa3e7c57d709861bcad59cefbae11d636cf58dfe92cba09b99b14b08c3ee9713af480cb91b4ef31f5743e7c44f750e7e0a7584565de1acbed35d1d0e11287e10c545aef243d30fa7222309127a9fb51c8e22e96e6a3a6708af4e270478ed44145a1faa248e3e8d9e4466cb71b873c6270742523ba7b2c6f2c00d4eb198829e67ee1e4abc16a59d844121f34de06e912f08f221dd86ce6e9571a3a497bdd58c5e0a12b5097374734dc574f34fde21d7932147267d27fb73ecc198e0e2caf52a5ce51c528b598eb6f4081f76ae4961059e4f12c7c1dd9140e41655d7bcbf40ec722b3105b7e60816560e33fa5e394502cb54820e92133ef9886210e209ad1db03b3e482884a6f00d2418045c84340829ddc50091b5f8d63a1dbda5e966becf12ecef12bd7b76164a2be87910689b23604472258db2e8e488792f49c0b2d09b85317f98b804fc323f13584e256367444448f42b4b7bdaffc7ae7cc8be84864d97850ada98038680ca83e935797f3870b743f326d49477fa3755f5039e04581aa9cec4cf90fc06d575e10ac79fe45772967a0d51d7ba9c56487b29eebd4c00a233449b4efdaa320e3af3c9771f5e622abcfe3ddd22088b6fe66f8a60f67c15a554aaef8a0ac2ec93dbe96d62b9da1c049fdb61561cd97caecb927c7e8f82d9d7af8c0f891a120cfa69b43cf29c3bf507cea1a05c989106a5214d82797fbfde23232db8938c13edbdec7a04790cd397548de2689a0412973ecc1e48a371ce400697dfd3def214fca947b678347918a81df35eab56aa05f38fb895242ac78e8d5ed9b1cdf12e7299b90314e63195884150ca3b8ea79b60ac9ac233d56fdac8dc34104e7770832275511b827419a8696593a0f48a98c93adf371c5435244e4d6dcf84569c0fdfffd37b098ea9dcc7ed796688b4344915eedda384493e17c5b11cc5835bbfac442b9dabfd7a9e230127ebb5cec17774bd67d4a906da31f07b884bb64f170dd801a047190e3ac645d2aeffebcc5bed31b5a285a386abf6ac14426cba6c7de9ac12238f0a231cb46fbc6ff17b06b87e216690e06b8fdb67e19a4a118165d8c465660c0589e2f6b285b94de1b5c64464ef00b41f61aaae12e55bc7c8b1b1730ecb155da14e32c43dbf51bb3f55a4d6f2ab90cfa64d9d5e1c4ff1386994801e8fb10e801e19d5c6d92e7900c3902a2e33cc8341b183316535c84b4295f18c0883a72c3260b9beda3831f41ed0f601e55f19268c08bf7ec9286d7067388880800738043f511962f4cd459ce960de13f68c29c2c8d46be438d87a9fa888fe98084cec5e12211cc6dc97638b3cf5511e87870b282f2b554a7a335cb78765734ac99c1f8843e8af3cf01fab7fa40902fa323de27c89aa8e6ef33e644a3ac9a9ba911b8e2dbc87fb94816396906bc4f32469cfc166ae89d7754d0b61bbcd1234bf91f77bdba89f1b6f4952874ffc64ce7fa3a5e67df17bfbe97d67b8f1def33650a5ce7fb1fd47fb5b0800ccbf77dc589d12c91ba481fc7ce0af32bd423b92eed1b4600ccdadca0001da40a88be6402836206b185215353f57683048de5723f6bde2b1cfe070ff9e0d45ee329bd29723d3f4a287c9b3713cd7f78dba00342568d5d5c4412e23254075f70da18628752bd73be6b13df7bf19be972f84d42a483a8fd1f7ba9c5c71d780ca7a7df2d0f9533a16afd85d0abcf3409c4c723c5761059f95f80a2d9d8036d7ce83ebc62d2b1667c552654a577af4f362245df8dd738d6996321dd25ff4a40d18cff651c391525dfeda316cfb601c44d2a93947ad21584ed41613ecf44a875213700c999772d0f63706a4d3b051a5e59139de1f9ba2a3d58d7bb796b50a7a26bfc34a57f1cabf924dd7841237a0de9741a4151f2c2238d676ceeb4f239c2f89951eff2d33a699975fd5d6adae1949eb69bbeae29d77a5f0fa95c124679f182609edf996c00cfa3b22c1c273ffd29a4c103b4a0a64944896d2cfb7d57b01a3f105b6df754f99da4fc8816510d460c29e8246fed9efbd053a66ece5415c1194d087b5a885a7ba6268c3ae7afc5ddfb34cb692b5b098d2855bbdcddc1acdc46bdd88de40810d5d62fafeaf1e96264cff00002c0452fea5aba67efd6694ab70edf9c0b7b13759ab8783f5b004d6b6cbd8dcd5836f9eeab2295aaaeb38539e1826e8dc3624663cfe4fdfc5ef3e33185994f1856027940f0acdaa92469ee8cc5f8e95f54cb982189e9ce6136ff8313133797d55241d75219b7540adcc0540aa2335600ad83470d41f46a296482589c8fb016c9506cabc4f68662b8edbb17f3cb978933df10bd7575be749a6e103b2905388958db2dfc88a066d90099273bfbbeb2da25cdcfab1d6cd216b5ffe6449d1e7e25333c2f90b082e6b8eafd54f02dad4729cef2ac2d51a17e335957f3f0a768b68fd00d093ffb99e68452a838eebfbebecf92af93e8857bcb689fe35879f8bfa9c635b42ee84b6662348bf3fdd41cb76c2e60da1a22cd81a8cd78d203b6e53b52f7519459beb7f943b597ba05c51489e4ca357437630983dfc400a833843008158c3354e627bc7429de5c7d00cdbb35f215375712654bf1572830d0790e663b152f0ba533586f59608331821425825e540823d5b85d11673e9642aef3900b0b6780809442fe1a22c5e2ac8ba3529d4404d24ec91a0623f106e9d3233af61c0e29f09dd0c009779fb3164c56e77b8cd1a7a4858d81ac1834998bb779db4ab509a827f4661fc16e41f93a82a4b3d87d5f171876222f03cb191b5cb648672ed1c24cfec48da1d504cc018edcb6693a6998eb172dafa67540ca3d99b16ecf77ebe8637fd3464f3932c90439949b61af2a13ffba22a3ab82e1e80b5fbca2450a1b28e15453d0c8b91d9dd44e3c47261877fe885b73ab1db4395e20cfef7e6acaa310beb03360d041f132d99aa0de69e06077c5ee1a185df6fc93a4d8c94e6763328b26f318f79d4250a5abbe18063ac3c5751bb13b87b8a9f327d29fde32d07f9140ec216059cfa60933fde944f6332c718d7af443e2daa6cdff20c2409f6fd4d737941d2950425af6cfccb00e3c11c7bb15f889456869e192616d144d4cd9fa8fc3687df7c664d4c6d089a46877cde5ede85fa8d478ae2d0263ac239e05fc50682e76e068e3cef3f9517cd449715f5bf9684b80ddd44a164bc3409cfcecf2933fa12244f35bac2f16a6a43e32d9a9cb369ec2884da2f26da504dfba387ae0fecea83932f651345c04c8a0f65d109273b86251af46fffd195b9cd12ea63037cd812d8d59687ceb194e20e37277286c298961e0505fc74855bcbc9b797ef95762a00a3efaa34800a85d5fc730ccc623831a9eba86ce321a6ac3f87323911cbc1fff186d6c45954670a237dd6a5ae4f7e508760a219698bdd82ae8f8fe91787a6334871aae492a0a971af7dd7c40416d2a09ca4ccb753bb68e4b4df8fc80884b7803d144042e78c1d83bf3e49f9761715b58e3cb8c52af23753c0567cc525c08d8f05469df3d1776c94fc84558ae41579a956d00c4aa83e9f1e5003a4ff784677c6a2359e8519ddec2b6feda8df2e4687e65e645a7d17508c564af325cb70d235fd4dfc5b7ef6c6460af9f3e625eec535d5de5c1b0542654ff762024573ec53e63350460163ce8d502e55c2bade4106aa0666d45bb090ff12be48cb995e047a05812ece1b397af007b1ec1f62f14e0a881769fc4609d4fcae29069bf84d212d13eabfbf20d5696ec38089847af6bb835331e8873e01863497fcfc207cd", 0x1000}, {&(0x7f0000004fc0)="9bf5c6263e8166d9af0b038398dcfa59dbdbfa7634c6a721072bbfd0a6cba7a59fb630bd64c3127d0633f70c1102ba4b11ed1e82808be722b4000d92c3d167e1029c45052ce621562da93aeeabc2868879666a49adc218bd44c96f8b86f81d162ed1298b2915eddde0c1b1b0498c094b239162ac9e50ba7f7023241328d9cbdef741cd643d6d3549ce95ed549ad484f3114834889a309e9966c35bc2dd675b3dbb8cd3c5299323194e50f2f56dc8", 0xae}, {&(0x7f0000005080)="cb80843eeb87fe20c626f92899d6a3a94289b13816b53e08d288caec6e8a13d6f6d5742e568a1da67ffe7b2faaf4de772ab0d2bbb2d2abcf", 0x38}, {&(0x7f00000050c0)="1d95648589a1fdab390c54af47d5d9c6eddfa286b661ace1dc5c037c98a0b3357ff555ee38fdd5178605cabb966ba67c0292345df9e519f4197dc74f7e66f3ef9c6dee2bbf3d70b68b97de7d41fea61b9d2dbfda4a295b8bc815d158c4ecdd", 0x5f}], 0x6}}], 0x4, 0x40001) executing program 4: r0 = syz_open_dev$dri(&(0x7f0000000000), 0x0, 0x0) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r0, 0xc02064b2, &(0x7f0000000040)={0x1, 0xd00, 0x6}) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r0, 0xc02064b2, &(0x7f0000000100)={0x1, 0x3, 0x9}) ioctl$DRM_IOCTL_PANTHOR_VM_CREATE(r0, 0xc0106441, &(0x7f0000000080)={0x0, 0x0, 0xffffffffffffffff}) socket$kcm(0xa, 0x2, 0x0) socket$nl_route(0x10, 0x3, 0x0) r1 = socket(0x10, 0x3, 0x0) getsockname$packet(r1, &(0x7f00000002c0)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000100)=0x14) sendmsg$nl_route(0xffffffffffffffff, &(0x7f0000000040)={0x0, 0x0, 0x0}, 0x0) sendmsg$IPSET_CMD_ADD(0xffffffffffffffff, 0x0, 0x0) sendmsg$IPSET_CMD_TEST(0xffffffffffffffff, &(0x7f0000000280)={0x0, 0x0, &(0x7f00000002c0)={&(0x7f0000000300)={0x48, 0xb, 0x6, 0x1, 0x0, 0x0, {0x2}, [@IPSET_ATTR_SETNAME={0x9, 0x2, 'syz1\x00'}, @IPSET_ATTR_DATA={0x28, 0x7, 0x0, 0x1, [@IPSET_ATTR_IP={0xc, 0x1, 0x0, 0x1, @IPSET_ATTR_IPADDR_IPV4={0x8, 0x1, 0x1, 0x0, @local}}, @IPSET_ATTR_PORT={0x6, 0x4, 0x1, 0x0, 0x5000}, @IPSET_ATTR_MARK={0x8, 0xa, 0x1, 0x0, 0xc}, @IPSET_ATTR_CIDR2={0x5, 0x15, 0x18}]}]}, 0x48}}, 0x0) socket$inet6_udp(0xa, 0x2, 0x0) socket(0x10, 0x803, 0x0) socket(0x10, 0x3, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./config\x00', 0x1ff) mount(0x0, &(0x7f0000000000)='./config\x00', &(0x7f0000000080)='configfs\x00', 0x0, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000140)='./config/usb_gadget/g1\x00', 0xbf) mkdirat(0xffffffffffffff9c, &(0x7f00000001c0)='./config/usb_gadget/g1/functions/uvc.0\x00', 0x1ff) mkdirat(0xffffffffffffff9c, &(0x7f0000000280)='./config/usb_gadget/g1/functions/uvc.0/streaming/mjpeg/m1\x00', 0x1ff) r2 = openat(0xffffffffffffff9c, &(0x7f00000002c0)='./config/usb_gadget/g1/functions/uvc.0/streaming/mjpeg/m1/bmaControls\x00', 0x2, 0x0) write(r2, &(0x7f0000000640)='12', 0x2) write$P9_RVERSION(r2, &(0x7f0000000180)={0x13, 0x65, 0xffff, 0x1017, 0xffffffffffffff96, '9P2000.L'}, 0x13) syz_usb_connect$midi(0x0, 0x4f, &(0x7f0000000280)=ANY=[], 0x0) r3 = socket$nl_route(0x10, 0x3, 0x0) ioctl$ifreq_SIOCGIFINDEX_vcan(r3, 0x8933, &(0x7f0000000040)={'vxcan0\x00'}) getuid() r4 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPSET_CMD_CREATE(r4, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000200)=ANY=[@ANYBLOB="600000000206010800000000000000000000000005000400000000000900020073797a31000000001400078008001240000000000500140008000000050005000a000000050001000600000011000300686173683a69702c706f7274"], 0x60}}, 0x24000800) r5 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPSET_CMD_ADD(r5, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000240)={&(0x7f0000000c80)=ANY=[@ANYBLOB="5c000000090601080000000000000000070000000900020073797a31000000000500010007000000340007801800018014000240fe8000000000000000000000000000bb060004400e1f00cd050007008800000006000540"], 0x5c}, 0x1, 0x0, 0x0, 0x10000042}, 0x90) executing program 0: r0 = socket$nl_audit(0x10, 0x3, 0x9) ioctl$ifreq_SIOCGIFINDEX_team(r0, 0x8933, &(0x7f0000000000)) write$binfmt_misc(0xffffffffffffffff, &(0x7f0000000040)="143ad6ea0d0b86e8aa6a13a552d3b43734724bb7d19aac67d8c69863ad8d05d4c6c969c4054f3af17f81ccb72816a70f4d7499ec697759b6f8d378e6d28f0e2f62cab3653f84ec5f1bb836a38be530ba235d29f1122b0d893b8cb9657f8eee8e5ecf57551f7e9e089f4ad95ccf50b5f1e31022d7f197c3a40b8b86b3698ec261116bf12c54046b540841cf3b336aa3da6037a9f492ea8fe11efb7b3ff02a8bd0ffc25030849b809a1509c6150f125828de41ac58d5d8d871f95828", 0xbb) r1 = openat$vimc2(0xffffffffffffff9c, &(0x7f0000000100), 0x2, 0x0) ioctl$VIDIOC_S_CTRL(r1, 0xc008561c, &(0x7f0000000140)={0xffffffff, 0xe91}) r2 = openat$cachefiles(0xffffffffffffff9c, &(0x7f0000000180), 0x4302, 0x0) sendmsg$AUDIT_DEL_RULE(r2, &(0x7f00000006c0)={&(0x7f00000001c0)={0x10, 0x0, 0x0, 0x8}, 0xc, &(0x7f0000000680)={&(0x7f0000000200)={0x444, 0x3f4, 0x10, 0x70bd2c, 0x25dfdbff, {0x6, 0x0, 0x35, [0x4, 0x0, 0x204, 0xcd7, 0x6, 0x2, 0x1, 0x31b3bd72, 0x5, 0x8, 0x7, 0x18000000, 0x5, 0x3, 0xd5, 0x4, 0x1, 0x9, 0x3, 0x9, 0x7ff, 0xd, 0x2, 0x2, 0x3, 0x9, 0x6, 0xc03, 0x6, 0xfffffffd, 0x33, 0xdbe, 0x3, 0x9, 0x0, 0xa6b, 0x2, 0x2, 0x1, 0x3, 0x2, 0xc5, 0x7, 0xffffffff, 0x1, 0x3, 0x8, 0x6, 0x0, 0xff, 0x1, 0x1, 0xff, 0x401, 0x90e, 0x7fffffff, 0xff, 0x7, 0x8, 0x3bab, 0x9, 0x0, 0x2, 0xff], [0x0, 0xfffffffe, 0x0, 0x1, 0x1, 0x1, 0xb, 0x9, 0x8, 0x1, 0x9, 0x1, 0x8, 0x8, 0x2, 0x8, 0x8, 0x0, 0x4, 0x5, 0x3, 0x7, 0xc89, 0x1, 0x2, 0xa, 0x8, 0xc, 0x7, 0x3, 0x9, 0x8, 0x4, 0x6, 0x4, 0xa, 0x7, 0x1, 0x8, 0x2, 0x7fff, 0x4, 0xe8, 0x3, 0xff, 0x2, 0x5, 0x8, 0x4, 0x1e, 0x0, 0xf122, 0x1000, 0x9, 0xffffffd1, 0x1000, 0x5, 0x6, 0x4, 0x7, 0xe, 0xe, 0x0, 0x80000000], [0x7, 0x8, 0x9, 0x7, 0xffff, 0x2, 0x7, 0x4c5e, 0xfffffffc, 0x9, 0x3, 0x0, 0x10, 0x1, 0x3ff, 0x0, 0xf, 0x7, 0x80000001, 0x5, 0x1, 0x631e, 0x4, 0x3ff, 0x30, 0xe, 0x0, 0x9, 0x9, 0x8000, 0x1, 0x8, 0x6, 0x47b, 0x7300, 0x1, 0x3, 0x50, 0xf6f7, 0x3, 0x0, 0xb, 0x6, 0x2, 0x2507, 0x8000, 0x5713, 0x800, 0x8, 0x67, 0x4, 0x9cc, 0x0, 0xfffffffe, 0x2, 0xc, 0x2bda, 0x101, 0x5, 0x5fb, 0x6, 0x9, 0x8001, 0xcb], [0x3, 0x4, 0x5, 0x8, 0x970, 0x3, 0x815, 0x0, 0x81, 0x4, 0x6, 0x68b9, 0x9, 0x38000, 0x1, 0x0, 0x10000, 0xd3f1, 0x41, 0x6, 0x7, 0x1e3, 0x100, 0x0, 0x3, 0x2, 0xea9, 0x80, 0xffffff00, 0x2, 0x4, 0x2, 0x3, 0x6, 0x8001, 0x3, 0x9, 0x5faa0b68, 0x2, 0x2, 0x20, 0xa604, 0x9c56, 0x5, 0x4, 0xe, 0x1d, 0xfffffffe, 0x80, 0x96, 0x1, 0x80000000, 0xf5d2, 0x4, 0x8, 0xffffffff, 0xfffffffa, 0x5, 0x3, 0x3, 0x1, 0x5, 0xc, 0x1], 0x23, ['team0\x00', '\x00', ']/,+}\x00', '.#\xca\x00', '/dev/video2\x00', 'team0\x00']}, ["", "", "", "", "", "", ""]}, 0x444}, 0x1, 0x0, 0x0, 0x10}, 0x4004000) r3 = socket$inet6_sctp(0xa, 0x1, 0x84) setsockopt$inet_sctp6_SCTP_AUTO_ASCONF(r3, 0x84, 0x1e, &(0x7f0000000700)=0x7, 0x4) ioctl$VIDIOC_EXPBUF(r1, 0xc0405610, &(0x7f0000000740)={0x2, 0xfffffffd, 0x7, 0x0, 0xffffffffffffffff}) ioctl$CDROM_DISC_STATUS(r1, 0x5327) mmap(&(0x7f0000ffd000/0x2000)=nil, 0x2000, 0x3, 0x100010, r2, 0x18619000) ioctl$BTRFS_IOC_DEV_INFO(r3, 0xd000941e, &(0x7f0000000780)={0x0, "7ab0e6f0fd239f707c9b12707f0b6450"}) ioctl$BTRFS_IOC_SCRUB(r0, 0xc400941b, &(0x7f0000001780)={r5, 0x7, 0xd4, 0x1}) ioctl$TIOCL_SELLOADLUT(r2, 0x541c, &(0x7f0000001b80)={0x5, 0x8, 0x200, 0x1, 0x6}) ioctl$IOMMU_IOAS_ALLOC(r2, 0x3b81, &(0x7f0000001bc0)={0xc}) ioctl$SNDRV_RAWMIDI_IOCTL_STATUS64(r4, 0xc0385720, &(0x7f0000001c00)={0x1}) write(r4, &(0x7f0000001c40)="aa830ad3cccd3d1e3f96b836ca8aae46be53f80a90df1490d600bc677ee9262fc01ef3568370fd8fe62a08b7a2a1e1fa48acc22c2b794a7de5ef07cff39e83168d729a46d8c97a5a96c377688bb6cdbe957e2cad72fa9d32c6731081b3e29d7ac5df7c58db8d1807a843c3a071e4c9c436df09393239c70406dd0dcdd4b7d9d619cfe27fa7c2f977a529f57fe6879b6854074cce9f571ac5dffa9cd8d992f46129b16de06fd8365d932cba57c6936a337cfffc02a479689be2c24c0489b9aa1668afe21abe9ed8f46958eb318cb4630459c9c0d1875b6dec81c7da952fbc7acd7d18920bd0c5cadd502b50c8b91d5853e47769427e5e9808e3eb22e116dd484f72a21b48da8e2cb1d6faaeec5c853ba861389e7ef5ef1c1a45fde1c690fe84c637affadf40eb0dc149e51315035aab08630f7933e78cedcbd597b8e72c1fca1b768966712043ba67cdc0a2bfb5646877cf9cf7acb78bf9e6693df10a3ca556a1e4f95379070935470932f44b33dbff206088127de637eaab3056aff623c9869b06f9e502b53aeeedf3c4d7828baca54b25e1662d4b9efb11f7ac2f956094992e0caf6baa1ba849d5e2e67a9d23c4f9985d433a41fd40638ecae202378ab75070fadb865f0c722428d1fb4c729d02321e1e10963351dd36b5164c284b6edc0cb615714074a358d22972c4b495c5ddcc8edef17c56446a3f7ac3402874682a9af46555f774a6cf3009fd362f44afb81bcb9fd95372192f14e9c17b3e02e04b8d13c76b7d18c455cd36a2994a0b72021195b320ff97215036705533f34a30c933c77242c643d73c7f121ee93f4209653e884802142bcc22ffe4954683f711ba0312fbd96fc37af4aa397d2274bb94eaeb14f5dd04e4591c990c48c69a72345a0bbf3e54de96eee4c6d0d6380e529704c4ce48c826107cffb7d4dcfa94ca200fc333bebf273ef6c6f992d46f15ba4c2e532fac395ddea4b8da0f49f2682e7fc13fbf77da9b15cf16470bd28e82741c537c874f0415b898d4762a05dec8202a77d94bee00903ef64b55dbdf0bcb0ed30a4461be613fe0cbbd1eb1240f9c8e28ba3ff5404cd2ec2f7ac8d2a77e97ef07d25d16f362579bed0f6a12cc493ab8fd5acf837b81f31210f1247e41adaccab64350e6dc873d047332414efe7d2f79c7edcf8eae452bcf5ceb2d869ba6fbad68881c173fdc8545a2704562fe40cb551f51b5b02b634aefbaf8d3d5de4333df7c4d62644b9a5865b3970eef365ee904b919b023c4f0bd44cf67dde2f25bdb9dcde0626eceb887c623dbb09c688f203b7161203b58ae3a4753366784947fba492f888792d0b56bdec9f0ac62d0c5795160a2d0382900b365e7da00e4423d3e9b097fe19f478a58824dbac178628185a63ea2ee82813507caf386c269efdc6054ccd0c2ff2d542ddcddf25c4d880ea02ca36c395111290c5b88149300989eacbf5321529d397a8dcf2c920993b5a9b522a6584358f17ac1640d11373b0e18bcd8bb3079ed9312b545f047a73aca69f81ba6c2fa65581dfbe05d465cb413b313f557937cad802b9c703a9b66f1c6c41a64d7027c826c36502b14d37943982e857b0e3a1d548a7ed5641fcee295511c45132a0a6029d0c8b21dbb80cdb18981695b06cbaf6343c387de9505d73315e6a60b6700a7d5b195fc5e03a2eece85a8d129a0b0ea683d6cda066a531bfdca1876cb04329b826c3f79e5d37429298544810e3c4cb7c5152de40d8280e749aadcaf72f6153f20f326214667138a98b070d31dab0271364ba74583caaa5b9f6483a781638f0380be549224a2d68430bc9dc9ec5bf69be58a6e08b0136224ddf300cc2c8193e1ca77d5905de5749ddb22381dd17622df925c06325939843c3c19d639e650957c67ee2350ab90452387459678cb26eb24b8c798fdc79e7bf880c3af413baf9689bcf95317cbea036e0d6f5eb3223735186fe4c4d13d3b7fe6468cd3e683d5ddbe99d57d91e656434c2342fde7fc567bf03cb00dcd264ffdcfcb2eb8fb3149d65a5da96f93e3cac38c73da11930e948318e6b136db9fce4905ed0f51fdf17b566015cc885b94ff3d28fa40fef7f3186697e71cc4a52c7de26360886e483b28ec6f7cb5d372b4756063d9a4857a7d5359840ed97bec442217aff328d1ab447fcb3dc9e586ee98ba322fef1e1ecdd709ea22d3362a325c144f3954f636ef298f2b2ec4e63ed4ef8a1446661b319cd6ac63322855cf58dd17a7ec005ca7de5b7365a560c764d126e0fbee2b197a2a06b61294a9bb1c002d9ded92ab95e6c31b385f3c35e2d3f386db327b901e706f955c0234c2378722445ef49623b624805a7a7a8d0aeaa528df4f72baf45e48aca2b34fcb51ab8bc3812efe7e178d3b198dbe51e0485aacee2a6cacb1e27e41ad52c4c584db8846dfcd7f30b45237f4756b111005851d0262f072488c9e1b94cc0c2c99aaea94a2ec7b63e1d37a17861122fd798f67afcfe260ad4a93ece1f2ca4f07d750b23f3cb107ba4d9379bf4b91e17dfb2e35a4d5daefe710e5359bf9fa4cf569347a36c08d58ecd62ffa0895ead109a56d8e13af1005d03e78be9878452b7646f044f2ca4b5770715df142cba492ebeb84264e7616bff0a2409d7130c48a5de49bf0080de89cd03c9b53aec0fb8e95ba9353fd4e41a204221e4f495fd21e12d444c7a3ea8406e9000f6f91eb9cf1283dccab98c7e508b8fbd0b85cd3f6f77d5a0dea101cff61648cafd4ca972ffc3830b6ba75fb3654c65185c4ae06073f78e20aa8e058738ca6652c7592c07c5de94e827d2ea012cad0ee3e24b1eb16aca02980ea49ef409d6f588e19710118a2eaea328068258943beb0051678fe82689deeb540757df5325d7c16c1a5dc2313256135fa21d3207bcb46c06e8a5359256595e2e06b7f74a839ecfdf58799eb75a3567f000292558c9614d070f8ff880337a18d8953b8dc8de7349e012de1b36d18e5c2a617647fc0b7d34b0276bd48f7eb6ffa5da23bbb38d6a096686e1d7543569aae8177f6a6a2ceff2cb9717b970579b88dc97d30aa56f13e7614853989614940982a0578da0e1a2f672ba02dc148545b66217bf0a4fdafa5fc2c5f3b2e695c22bad54ee242e05d52b7c84ff59ee60fccd972d67529d44159fc1baa71223f9eb518ed7cd4de4fbf22f54be50256d95f1d11b90550e470be6712f449324691272e336a8f71ce8f10294ced611ea4cbf1b53cdd0c2ca6b7413dc79251918c41b97e3710ed63a762de0f5f9503532fe8d8a93cbe4000a0a0ac8099f86200be6a366b1affe2ce6fe7f1c58a198a53a6170e4e4013a2ef0db86e6a8fe7f60922867cc7083c5935198ad87a2180f3f730ba45699702e3c96c3a0e4b4d0a4d089ec5f31aa49e337c2ba349bcd63262696a6aac8a14e442044f9278fef9344e5c4ca1abe646a1798d357b946afd0f8cca65ffa83a848af551cf4a807820aaf645bfad34d882b59892b0959fef436d5d24c58c4ef713c3e2367e131cf8a565894b8433a1a320d7c118172ef65fa9467a7d8f3413e37cbbd800dac750ce91873681f37f172bc9a980ea589d6c8e206ec83f29c4eb341944878fd3331cbffe1785911bdcfca86fb1d942806d08c601769959d00524c427186860f04ec80a84f15580b019365b276a5e52ca718eeaa44ae479ad5f94b75563ee236bde3f80defc1aa2f6900141cfa9382b32cc69738007e57871c07432077eba4f677606ee3cc65c170a561b7a63b9d503443780ceb9d75da72e035bd5fa101ea825648f47b15dcb4dde0dc02b8b17769791e5a7496ef134d75f844238709a5a561b1daf336b2af040387de46be09bef7512871ecb7a97673e3dab1c2e3524f054ca86363658b28ad2671b26fc798bba89d94d1349b117e12151fdec2f6c9d076c6e096c6d742e7f03dfd974ac0e8234b20ff5f7b7f932b4f8ca47da7d4d459a24e8084368bb80a9f7a985e6a6096826ca703085d3884d0d23782ba9d61b46270217c1c705e1ace7bb986fba3cb1a3ec46b0af70be5669f3ac590f3647142dbb43c289d9a0dfed7c2a0ad48ec722e4d5bdb37b088b6e401bbf6ee8453e1fdbd5dfe373093106d29872b92b3fab42f4e262b14686658440198cffe3005838a3ba76a4f1b71ac71cd81c12646e75d4ddde8d8f172a1a603bb17264ed5b013f2d068450ff4f363064fb575ddb4b4b75c9d073e0f398d0b45f2121fb7de77c6ec3655baf20d26bd6c7a0050430c5c1cd69a11bf714420c68ba1bf43c13a63be1bb8f091b524b0c7d00732ec2fde332d0e62b3de70373697c01f9e4038813f83703d304fc8f6d1861f07774a5fe205d33e6d74aba87f886d518a46f83f77dfa69ec9fa5de8d282a391198915719cec9addc5e3f310d21704b5b2977efac5237f789a3c70e007e01458deae72b713b00f1941714e02e17f90ea72da5eef609a80ca974a8f0cf3b06a3f3d2369c6a90b5f0f81e554deb390ba79f2b6977ddef66c4aa55d2b079500a57d9c0caa5363e27c397f685e832db5c64ab95857ba61cc3d9c3004a6cce9709167bdda702662f2aab78593950b973d03d16dc6c17d20d52c9301837eae7e2d59711762c7717f84a3644c7a99330ef8b43336ece095f05c0d2eb11c680865bf3693407f902fc3f3153585220efc29bb9feb1d8d2b2053553cd2a3d465b9736de946c413162e7f3f3942679e68b1b5be7b0c92eb51fc22d5582233aa2d0f0be503860ea0b8ba9f4f686237579f3f1d6da411a32e98e43483b66b548cc489d7a959fca5f0850635960b92c3cb2bc05b87833f985b52f06ef89468cb9001c2397d379b89ed62bd59c12103374e4d876a2c353b0164a614540abfc17fb351715f01bb88e5ac3d83219a109b0f106822037a7734b861adadc7e53547edab80ec1d3bb49e1d6a05a096e3ea8af81b4c6745a0549313a4c9048a44e0580573cac5aeb7aa2d6889698567e4f47ab92ca7e704d6615b19d7610776f30eef0ba6b9b4b4ab6a71b4f813378d5da9eb179a0deaaa0bc2f1ba66be75dfe7e5f5adca3203ff9cc1ef90836aefd50ab1d9d9e1d3af368ea3db68d3daf496462b7f98228065d8631af50cf32e5e584fabe233f31b613fc260a5355271f31e5d5b2152c90cc3efe53dbb549f4e67276192192f330d0bb07f79698ae6291635c90648d3039422a1d1a68ab6e2ab44f63226f1dd6748715aa6deb1d2722cda8d005feb0d9527101a0dbd4ec426e64300eed885a572c4238863b76e20549702b69112bac77ff0600227c345e32b18b16dc70e86c92bbe726bae1627687c59763b17be81d577183027bfef91c68d6b620fd944723d6a528e6669219cd40007387bc42fa9d7e4244ce7aa440d57b42ac4f9f32c8e476a29e77a7af623da1cb274f3caf9d9ffbe56f75b3b7370dc3a8d21787a9f6b8932d5c940f37e2fa662008bb501adb36d589051cc8fffbb4e20554a7939ba67fa31658f6e9c9651e1ed892eba656e6d0eabfb81207665a114d57245e62382e05361b5367f8fc05b387fbf91cc643435ed94ec7069a9b63d8c9104a8457f1b7dd73bb549d12cde396608dede1a4e546a9c0a7644665e2cdd628b2ccc29f57297329cc4448dbe2f606d6d1b2ac6b75a3d127a0cabdcd2506d6ea56adc98c223d675f3405bf785676b91361b77b9f23fca16cafdf7ef9349a014db29b3376c2ae5c0130e725c5cfae1067ca1cf6ccfaac4359eeba18011e21749118328c29c6f2eca300637b76eef0c6f0561e2ba2f4b1a29d85647132f19039defcd4968de55e1e", 0x1000) r6 = openat$vimc1(0xffffffffffffff9c, &(0x7f0000002c40), 0x2, 0x0) ioctl$VIDIOC_ENUM_FRAMESIZES(r6, 0xc02c564a, &(0x7f0000002c80)={0x2, 0x30395056, 0x2, @discrete={0x0, 0x7}}) r7 = socket$l2tp6(0xa, 0x2, 0x73) write(r7, &(0x7f0000002cc0)="61eb3f61a2ac91e5b49f515167c544075f70c86959ce3681017d35b422ddc1920aa8575a4d3416f60de936f84ac8e3e1e27c13412ff1d852f1157859afe70fea39067a19dacec11eb2c9467371dc630985db76bb616c703623fd47e4b197516c5504f60a429bb69740fbbd4328c58c089701f75bd1b464bdb4397cba0959f0af6ea0a15f23d9e001e4e4c7", 0x8b) ioctl$TIOCSPTLCK(r2, 0x40045431, &(0x7f0000002d80)=0x1) r8 = openat$selinux_status(0xffffffffffffff9c, &(0x7f0000002dc0), 0x0, 0x0) ioctl$VHOST_SET_MEM_TABLE(r8, 0x4008af03, &(0x7f0000003140)={0x8, 0x0, [{0x26000, 0x9b, &(0x7f0000002e00)=""/155}, {0xdddd0000, 0x1, &(0x7f0000002ec0)=""/1}, {0xffff1000, 0x7c, &(0x7f0000002f00)=""/124}, {0xe000, 0x5e, &(0x7f0000002f80)=""/94}, {0xeeee8000, 0x18, &(0x7f0000003000)=""/24}, {0x40000, 0x2, &(0x7f0000003040)=""/2}, {0xfec00000, 0x49, &(0x7f0000003080)=""/73}, {0xd000, 0x0, &(0x7f0000003100)}]}) r9 = syz_genetlink_get_family_id$nl80211(&(0x7f00000032c0), r8) sendmsg$NL80211_CMD_LEAVE_IBSS(r2, &(0x7f0000003380)={&(0x7f0000003280)={0x10, 0x0, 0x0, 0x4000}, 0xc, &(0x7f0000003340)={&(0x7f0000003300)={0x14, r9, 0x200, 0x70bd25, 0x25dfdbfd, {{}, {@void, @void}}, ["", "", ""]}, 0x14}, 0x1, 0x0, 0x0, 0x8000011}, 0x20004000) r10 = syz_genetlink_get_family_id$devlink(&(0x7f0000003400), r2) sendmsg$DEVLINK_CMD_SB_TC_POOL_BIND_SET(r8, &(0x7f0000003600)={&(0x7f00000033c0)={0x10, 0x0, 0x0, 0x4000000}, 0xc, &(0x7f00000035c0)={&(0x7f0000003440)={0x150, r10, 0x800, 0x70bd2c, 0x25dfdbfd, {}, [{{@nsim={{0xe}, {0xf, 0x2, {'netdevsim', 0x0}}}, {0x8, 0x3, 0x3}}, {0x8, 0xb, 0x1}, {0x6, 0x16, 0x4}, {0x5}, {0x6, 0x11, 0x1}, {0x8, 0xb, 0x9}}, {{@pci={{0x8}, {0x11}}, {0x8, 0x3, 0x1}}, {0x8, 0xb, 0x4}, {0x6, 0x16, 0x7f}, {0x5}, {0x6, 0x11, 0x2}, {0x8, 0xb, 0x10}}, {{@nsim={{0xe}, {0xf, 0x2, {'netdevsim', 0x0}}}, {0x8, 0x3, 0x1}}, {0x8, 0xb, 0x6}, {0x6, 0x16, 0x3}, {0x5}, {0x6, 0x11, 0x5}, {0x8, 0xb, 0x8}}, {{@nsim={{0xe}, {0xf, 0x2, {'netdevsim', 0x0}}}, {0x8, 0x3, 0x3}}, {0x8, 0xb, 0x7fff}, {0x6, 0x16, 0x2cd}, {0x5, 0x12, 0x1}, {0x6, 0x11, 0xb}, {0x8, 0xb, 0x47}}]}, 0x150}, 0x1, 0x0, 0x0, 0x8090}, 0x20000004) ioctl$CDROM_SEND_PACKET(r2, 0x5393, &(0x7f0000003740)={"74ff0c0e58240f8767377525", &(0x7f0000003640)="5d74fd15425add534828354a941a5f6b42c2b8c8ef8ba4afb9d02606e24bbc4782781601fe246067034c1590ea963ebb60a615f08ba00d235b12aa392f046d25de824699b942af0a0120", 0x4a, 0x0, &(0x7f00000036c0)={0x6f, 0x0, 0x6, 0x1, 0x0, 0x0, 0x0, "89d25f7b", 0x2, "9bdfeea6", 0x9, 0x1c, 0x2e, "0383bb", "1068452e6ad95a41d36784f9ccfd5d3d8f724f066c105783a30905e5362aa92a93dc45477da446070458e9253128"}, 0x2, 0x5, 0x8, &(0x7f0000003700)}) executing program 6: r0 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r0, &(0x7f000000c2c0)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000300)={{0x14}, [@NFT_MSG_NEWTABLE={0x20, 0x0, 0xa, 0x7, 0x0, 0x0, {0x2}, [@NFTA_TABLE_NAME={0x9, 0x1, 'syz0\x00'}]}, @NFT_MSG_NEWCHAIN={0x3c, 0x3, 0xa, 0x201, 0x0, 0x0, {0x2}, [@NFTA_CHAIN_TABLE={0x9, 0x1, 'syz0\x00'}, @NFTA_CHAIN_USERDATA={0x1a, 0x3, "91abc12404cf378042f26c43f91f68d8a90767c0bc71"}]}, @NFT_MSG_DELTABLE={0x14, 0x2, 0xa, 0x9}], {0x14}}, 0x98}}, 0x0) (async, rerun: 64) sendmsg$IPCTNL_MSG_CT_NEW(r0, &(0x7f0000000100)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x10000}, 0xc, &(0x7f0000000080)={&(0x7f0000000040)={0x24, 0x0, 0x1, 0x5, 0x0, 0x0, {}, [@CTA_PROTOINFO={0x10, 0x4, 0x0, 0x1, @CTA_PROTOINFO_DCCP={0xc, 0x2, 0x0, 0x1, [@CTA_PROTOINFO_DCCP_ROLE={0x5, 0x2, 0x1}]}}]}, 0x24}, 0x1, 0x0, 0x0, 0x40000}, 0x20000000) (rerun: 64) syz_emit_vhci(&(0x7f00000000c0)=ANY=[@ANYRES8=0x0], 0x7) executing program 0: r0 = openat$nci(0xffffffffffffff9c, &(0x7f0000000000), 0x2, 0x0) ioctl$IOCTL_GET_NCIDEV_IDX(r0, 0x0, &(0x7f0000000040)=0x0) r2 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r3 = syz_genetlink_get_family_id$nfc(&(0x7f0000000080), r2) sendmsg$NFC_CMD_DEV_UP(r2, &(0x7f0000000100)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000340)={0x1c, r3, 0x1, 0x123, 0x234, {}, [@NFC_ATTR_DEVICE_INDEX={0x8, 0x1, r1}]}, 0x1c}}, 0x0) write$nci(r0, &(0x7f00000000c0)=@NCI_OP_RF_DISCOVER_NTF={0x1, 0x1, 0x3, 0x3, 0x5, @v={0x7, 0x4, 0x6, 0x5, {0x7, 0x12, "ec8d49bfae1181b1"}, 0x2}}, 0x12) openat(0xffffffffffffff9c, 0x0, 0x43, 0xb9) program did not crash replaying the whole log did not cause a kernel crash single: executing 1 programs separately with timeout 1m40s testing program (duration=1m40s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_open_dev$dri-ioctl$DRM_IOCTL_MODE_CREATE_DUMB-ioctl$DRM_IOCTL_MODE_CREATE_DUMB-ioctl$DRM_IOCTL_PANTHOR_VM_CREATE-socket$kcm-socket$nl_route-socket-getsockname$packet-sendmsg$nl_route-sendmsg$IPSET_CMD_ADD-sendmsg$IPSET_CMD_TEST-socket$inet6_udp-socket-socket-mkdirat-mount-mkdirat-mkdirat-mkdirat-openat-write-write$P9_RVERSION-syz_usb_connect$midi-socket$nl_route-ioctl$ifreq_SIOCGIFINDEX_vcan-getuid-socket$nl_netfilter-sendmsg$IPSET_CMD_CREATE-socket$nl_netfilter-sendmsg$IPSET_CMD_ADD detailed listing: executing program 0: r0 = syz_open_dev$dri(&(0x7f0000000000), 0x0, 0x0) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r0, 0xc02064b2, &(0x7f0000000040)={0x1, 0xd00, 0x6}) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r0, 0xc02064b2, &(0x7f0000000100)={0x1, 0x3, 0x9}) ioctl$DRM_IOCTL_PANTHOR_VM_CREATE(r0, 0xc0106441, &(0x7f0000000080)={0x0, 0x0, 0xffffffffffffffff}) socket$kcm(0xa, 0x2, 0x0) socket$nl_route(0x10, 0x3, 0x0) r1 = socket(0x10, 0x3, 0x0) getsockname$packet(r1, &(0x7f00000002c0)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000100)=0x14) sendmsg$nl_route(0xffffffffffffffff, &(0x7f0000000040)={0x0, 0x0, 0x0}, 0x0) sendmsg$IPSET_CMD_ADD(0xffffffffffffffff, 0x0, 0x0) sendmsg$IPSET_CMD_TEST(0xffffffffffffffff, &(0x7f0000000280)={0x0, 0x0, &(0x7f00000002c0)={&(0x7f0000000300)={0x48, 0xb, 0x6, 0x1, 0x0, 0x0, {0x2}, [@IPSET_ATTR_SETNAME={0x9, 0x2, 'syz1\x00'}, @IPSET_ATTR_DATA={0x28, 0x7, 0x0, 0x1, [@IPSET_ATTR_IP={0xc, 0x1, 0x0, 0x1, @IPSET_ATTR_IPADDR_IPV4={0x8, 0x1, 0x1, 0x0, @local}}, @IPSET_ATTR_PORT={0x6, 0x4, 0x1, 0x0, 0x5000}, @IPSET_ATTR_MARK={0x8, 0xa, 0x1, 0x0, 0xc}, @IPSET_ATTR_CIDR2={0x5, 0x15, 0x18}]}]}, 0x48}}, 0x0) socket$inet6_udp(0xa, 0x2, 0x0) socket(0x10, 0x803, 0x0) socket(0x10, 0x3, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./config\x00', 0x1ff) mount(0x0, &(0x7f0000000000)='./config\x00', &(0x7f0000000080)='configfs\x00', 0x0, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000140)='./config/usb_gadget/g1\x00', 0xbf) mkdirat(0xffffffffffffff9c, &(0x7f00000001c0)='./config/usb_gadget/g1/functions/uvc.0\x00', 0x1ff) mkdirat(0xffffffffffffff9c, &(0x7f0000000280)='./config/usb_gadget/g1/functions/uvc.0/streaming/mjpeg/m1\x00', 0x1ff) r2 = openat(0xffffffffffffff9c, &(0x7f00000002c0)='./config/usb_gadget/g1/functions/uvc.0/streaming/mjpeg/m1/bmaControls\x00', 0x2, 0x0) write(r2, &(0x7f0000000640)='12', 0x2) write$P9_RVERSION(r2, &(0x7f0000000180)={0x13, 0x65, 0xffff, 0x1017, 0xffffffffffffff96, '9P2000.L'}, 0x13) syz_usb_connect$midi(0x0, 0x4f, &(0x7f0000000280)=ANY=[], 0x0) r3 = socket$nl_route(0x10, 0x3, 0x0) ioctl$ifreq_SIOCGIFINDEX_vcan(r3, 0x8933, &(0x7f0000000040)={'vxcan0\x00'}) getuid() r4 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPSET_CMD_CREATE(r4, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000200)=ANY=[@ANYBLOB="600000000206010800000000000000000000000005000400000000000900020073797a31000000001400078008001240000000000500140008000000050005000a000000050001000600000011000300686173683a69702c706f7274"], 0x60}}, 0x24000800) r5 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPSET_CMD_ADD(r5, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000240)={&(0x7f0000000c80)=ANY=[@ANYBLOB="5c000000090601080000000000000000070000000900020073797a31000000000500010007000000340007801800018014000240fe8000000000000000000000000000bb060004400e1f00cd050007008800000006000540"], 0x5c}, 0x1, 0x0, 0x0, 0x10000042}, 0x90) program did not crash single: failed to extract reproducer bisect: bisecting 67 programs with base timeout 1m40s testing program (duration=1m56s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): [11, 3, 3, 4, 30, 12, 5, 12, 30, 30, 11, 30, 3, 40, 40, 30, 6, 30, 27, 23, 8, 8, 13, 25, 30, 22, 7, 10, 30, 9, 16, 16, 30, 20, 40, 40, 26, 9, 15, 26, 19, 5, 5, 19, 30, 13, 6, 9, 28, 21, 30, 26, 8, 20, 14, 30, 16, 4, 12, 11, 5, 25, 11, 30, 30, 4, 7] detailed listing: executing program 32: r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$sock(r0, &(0x7f0000000100)={0x0, 0x0, &(0x7f0000000200)=[{&(0x7f0000000300)="3400000010000104000000000000000000000000000200000000000000000000140012000c000100626172657564700004000200", 0x34}], 0x1}, 0x0) r1 = socket(0x10, 0x3, 0x0) r2 = bpf$MAP_CREATE(0x0, &(0x7f0000000640)=ANY=[@ANYBLOB="170000000000000004000000ff"], 0x48) r3 = bpf$MAP_CREATE(0x0, &(0x7f00000009c0)=ANY=[@ANYBLOB="1b00000000000000000000000080"], 0x50) r4 = bpf$TOKEN_CREATE(0x24, &(0x7f0000000000)={0x0, r3}, 0x8) r5 = pidfd_getfd(0xffffffffffffffff, r4, 0x0) bpf$PROG_LOAD(0x5, &(0x7f0000000240)={0x11, 0x19, &(0x7f0000000040)=ANY=[@ANYRESOCT=r1, @ANYRES32=r3, @ANYBLOB="0000000000000000b70200001400ffb0b7030000000000008500000083000000810000000000000055090100f3ffffff940000000000000018110000", @ANYRES32=r3, @ANYRESHEX=r1], &(0x7f00000000c0)='syzkaller\x00', 0x8, 0x0, 0x0, 0x41100, 0x0, '\x00', 0x0, @fallback=0x3, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, r5, 0x0, 0x0, 0x0, 0x0, 0x5}, 0x94) bpf$MAP_DELETE_ELEM(0x3, &(0x7f0000000340)={r2, &(0x7f0000000400)="af02286954fb794c12dcb477713ae2d5cf878451de6ca54215f79cb8a90c4b5a6f9f2db242ee7799d16f30eb49f92eb130086e6142ae6f311ac72f1c912c0fe8bf4cc8fabad7839aa3cddd6ddb96b9b07d6b8ab4f9f1cb5b000000000000009f6b69daca6920629099f3b0bcabefbf43ad76570ac5b12afb0a7494cfdcdd032c3e8549b7445359ce151f4553ab11592245d1ed2ff82f224d22dd67400e4d79d0792de8039f6b47fd750d2e83eda9eaeaaa656ceda7e7bedd46a2b4a9900aca1ab4f645cd4d43c46ac7afac83dd66f3664a4b392be3273486fbf09de43ff0d8a125e6de4bb07bb13671e724767fb147df4efb2be6acc6b4403f76b177ae13e4b0739c883091ae6ffd2e9c9423a05192a2cf360000000000000000000000ed000000"}, 0x20) ioctl$sock_SIOCGIFINDEX(r1, 0x8933, &(0x7f0000000180)={'erspan0\x00', 0x0}) sendmsg$nl_route_sched(r1, &(0x7f00000007c0)={0x0, 0x0, &(0x7f0000000780)={&(0x7f0000000b00)=@newqdisc={0x78, 0x24, 0xf0b, 0x70bd2b, 0xfffffffd, {0x0, 0x0, 0x0, r6, {0x0, 0x5}, {0xffff, 0xffff}, {0x2}}, [@qdisc_kind_options=@q_netem={{0xa}, {0x48, 0x2, {{0x7fff, 0x7d, 0x192, 0xf, 0x7fff, 0x205}, [@TCA_NETEM_SLOT={0x2c, 0xc, {0x5, 0x8000000001, 0x0, 0x0, 0x1bb, 0x2000000000004}}]}}}]}, 0x78}, 0x1, 0x0, 0x0, 0x45}, 0x4000) executing program 3: syz_emit_ethernet(0xca, &(0x7f0000000180)={@empty, @empty, @void, {@ipv4={0x800, @icmp={{0x15, 0x4, 0x2, 0x7, 0xbc, 0x65, 0x0, 0x4, 0x1, 0x0, @loopback, @multicast1, {[@ssrr={0x89, 0xb, 0x68, [@multicast1, @empty]}, @ra={0x94, 0x4, 0x1}, @noop, @timestamp_prespec={0x44, 0x2c, 0xa1, 0x3, 0xa, [{@remote, 0x8}, {@multicast2, 0x9}, {@private=0xa010100, 0x7fffffff}, {@loopback, 0x4}, {@initdev={0xac, 0x1e, 0x0, 0x0}, 0xb0}]}, @ra={0x94, 0x4, 0x1}]}}, @time_exceeded={0xb, 0x1, 0x0, 0x0, 0x6b, 0x0, {0x17, 0x4, 0x2, 0x9, 0x1, 0x68, 0x200, 0x2, 0x67, 0x2e0, @multicast2, @multicast2, {[@timestamp={0x44, 0x10, 0xa3, 0x0, 0x8, [0xfffff046, 0x9, 0xe]}, @end, @noop, @generic={0x86, 0x9, "50a631770059ca"}, @cipso={0x86, 0x2a, 0x1, [{0x0, 0x12, "62e10654397654944d3e5de72faadfbc"}, {0x5, 0x12, "039c50637f3056caca97576cf21f19a5"}]}]}}, "78febdfd"}}}}}, 0x0) (async) r0 = socket$inet6_sctp(0xa, 0x43c07280f065fb6c, 0x84) sendto$inet6(r0, &(0x7f0000000000)="6a276bf231b9f247dafe01f8465d7bfaa95c7045aea4b490f933cc8558c118069c0ca98b3fd18cce32c39bea70dce43db84d5ef2a1fd06768b0682adfa7f3d1374e3b055d9d575e994e73e85e8078daf2d4df0a8dadad586675aeb965e", 0x5d, 0x0, &(0x7f0000000080)={0xa, 0x4e21, 0x8, @rand_addr=' \x01\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x01', 0x8}, 0x1c) executing program 3: mount$9p_virtio(&(0x7f0000000100), &(0x7f00000000c0)='.\x00', &(0x7f0000000000), 0x0, &(0x7f0000000200)=ANY=[@ANYBLOB='trans=virtio,access=', @ANYRESDEC=0x0, @ANYBLOB="9ef46fbe7c052fdcfccea457059ae544b046bbed1f765e244299de1e386d7848a18c525583c32d0d51c6bc6724e47260a3a1b9722c925117ad3a9487a79c2ccbb2bec2f3e3a95be6ffffffff9f4ab4c39347312b9af5227f15ce4a5c877fd17c23b52823560d15bb6b39a85e7fdbe0737b9058a4efd909"]) r0 = syz_open_procfs(0x0, &(0x7f00000001c0)='mountinfo\x00') read$FUSE(r0, &(0x7f0000002540)={0x2020}, 0x2020) executing program 3: r0 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r0, &(0x7f0000007040)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000000240)=ANY=[@ANYBLOB="140000001000010000000100000000000000000a20000000000a030000000000000000000a00ecff0800010073797a300000000074000000160a010100000000000000000a00000008000740000000014000038008000140000000002c000380140001006e657464657673696d300000000000001400010076657468305f766c616e00000000000008000240000000070900010073797a3000000000090002"], 0xbc}}, 0xc0) (async) pipe2$9p(&(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}, 0x4000) write$P9_RREADDIR(r1, &(0x7f0000000040)={0x24, 0x29, 0x1, {0x8, [{{0x0, 0x4, 0x3}, 0x9, 0x0, 0x1, '.'}]}}, 0x24) executing program 3: mkdirat(0xffffffffffffff9c, &(0x7f0000000100)='./gadget\x00', 0x1ff) mount(0x0, &(0x7f0000000140)='./gadget\x00', &(0x7f0000000180)='gadgetfs\x00', 0x0, 0x0) r0 = openat(0xffffffffffffff9c, &(0x7f00000001c0)='./gadget/dummy_udc\x00', 0x2, 0x0) bpf$MAP_UPDATE_ELEM_TAIL_CALL(0x2, &(0x7f0000000380)={{}, &(0x7f0000000300), &(0x7f0000000340)=r0}, 0x20) mprotect(&(0x7f0000362000/0x2000)=nil, 0x2000, 0x1) write(r0, &(0x7f0000000200)="000000000902190001010080320904000001ff000000070581024000000902190001010080320904000001ff00000007058102000200120100020000004034127856000100000001", 0x48) r1 = openat(0xffffffffffffff9c, &(0x7f0000000000)='./gadget/ep1in-bulk\x00', 0x2, 0x24) write(r1, &(0x7f00000005c0)="010000000705810240000007058102000200", 0x12) r2 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r2, 0x8933, &(0x7f0000000040)={'bridge0\x00', 0x0}) sendmsg$nl_route(r2, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000440)=ANY=[@ANYBLOB="580000001000ffff27bd7000fadbdf2500000000", @ANYRES32=0x0, @ANYBLOB="15010000000000003000128009000100766c616e00000000200002800600050088a8000006000100010000000c000200130000001000000008000500", @ANYRES32=r3], 0x58}, 0x1, 0x0, 0x0, 0x880}, 0x8048802) madvise(&(0x7f0000bdc000/0x4000)=nil, 0x86ac726dff2f4713, 0xa) r4 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) getsockopt$bt_hci(r4, 0x0, 0x3, &(0x7f00000000c0)=""/151, &(0x7f0000000180)=0x97) r5 = syz_open_procfs(0xffffffffffffffff, &(0x7f0000000000)='attr/fscreate\x00') write$P9_RRENAME(r5, 0x0, 0x0) r6 = syz_open_dev$dvb_dvr(&(0x7f0000000280), 0x7, 0x111400) ioctl$DVB_DVR_DMX_EXPBUF(r6, 0xc00c6f3e, &(0x7f0000000040)={0x200, 0x80000, r5}) socket$inet_sctp(0x2, 0x5, 0x84) r7 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000000)='hugetlb.2MB.rsvd.usage_in_bytes\x00', 0x275a, 0x0) mmap(&(0x7f0000215000/0x1000)=nil, 0x1000, 0x0, 0x6011, r7, 0x0) mmap(&(0x7f0000ffa000/0x3000)=nil, 0x3000, 0x200000c, 0x11, r7, 0xaa0f4000) mmap(&(0x7f0000362000/0x4000)=nil, 0x4000, 0x0, 0x12, r7, 0xfffff000) setsockopt$inet_sctp_SCTP_SOCKOPT_BINDX_ADD(r7, 0x84, 0x64, &(0x7f0000000080)=[@in={0x2, 0x4e22, @local}], 0x10) r8 = syz_clone(0x21000200, 0x0, 0x0, 0x0, 0x0, 0x0) rt_tgsigqueueinfo(r8, r8, 0x8, 0x0) r9 = syz_pidfd_open(r8, 0x0) setns(r9, 0x24020000) syz_clone(0xa3802080, 0x0, 0x0, 0x0, 0x0, 0x0) signalfd(r7, &(0x7f00000000c0)={[0xea]}, 0x8) executing program 3: r0 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000280)='cpuacct.usage_percpu\x00', 0x275a, 0x0) r1 = socket$nl_netfilter(0x10, 0x3, 0xc) bpf$PROG_LOAD(0x5, &(0x7f0000000040)={0x1, 0x10, &(0x7f0000000740)=ANY=[], 0x0, 0x0, 0x0, 0x0, 0x41000, 0x2, '\x00', 0x0, @fallback=0x5350a0e2ad0fd2e6, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) r2 = socket(0x840000000002, 0x3, 0x100) setsockopt$inet_buf(r2, 0x0, 0x20, &(0x7f0000000040)="929d547c", 0x4) sendmsg$NFT_BATCH(r1, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000580)=ANY=[@ANYRES8], 0x248}}, 0x0) r3 = openat$fb0(0xffffffffffffff9c, &(0x7f0000000140), 0x1, 0x0) write$fb(r3, &(0x7f0000000000)="0aa06542f1c7481ad05437c9e0425cb6a9dfd45c2f6e6de29e3689bf7ed58a652195950768465b55704cb0bbed6a0ac5ba437025b9dbf3b1b274a5cceb00bffba6d0449ea7a0d3ed7e0ac2b0b853e97f160fded16033a8ec7f7e9071c722676605", 0xffffff18) write$UHID_CREATE2(r0, &(0x7f0000000040)=ANY=[], 0x118) mmap(&(0x7f0000000000/0x2000)=nil, 0x2000, 0x88fd537e5d114b60, 0x4010, r0, 0xa8c0c000) r4 = syz_open_dev$radio(&(0x7f00000000c0), 0xffffffffffffffff, 0x2) readv(r4, &(0x7f0000002b80)=[{&(0x7f00000019c0)=""/4096, 0x1000}], 0x1) executing program 1: r0 = syz_clone(0x11, 0x0, 0x0, 0x0, 0x0, 0x0) ptrace(0x10, r0) ptrace$PTRACE_SECCOMP_GET_METADATA(0x420d, r0, 0x10, &(0x7f0000000040)) r1 = syz_open_procfs$userns(0xffffffffffffffff, &(0x7f0000000080)) ioctl$NS_GET_NSTYPE(r1, 0xb703, 0x0) executing program 1: r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000000), 0x40980, 0x0) ioctl$TIOCSETD(r0, 0x5423, &(0x7f00000000c0)=0xf) (async) ioctl$TCFLSH(r0, 0x400455c8, 0x4) (async) ioctl$TIOCSTI(r0, 0x5412, &(0x7f00000002c0)=0xb2) (async) syslog(0x2, &(0x7f00000001c0)=""/229, 0xe5) setrlimit(0x40000000000008, &(0x7f0000000000)={0x4848, 0xfffffffffffff006}) (async) capset(&(0x7f0000000040)={0x20080522}, &(0x7f0000000080)) mlock2(&(0x7f0000007000/0x2000)=nil, 0x2000, 0x0) mlock2(&(0x7f0000007000/0x4000)=nil, 0x4000, 0x0) getsockopt$SO_TIMESTAMP(0xffffffffffffffff, 0x1, 0x23, &(0x7f0000000080), &(0x7f0000000100)=0x4) (async) r1 = socket$inet_smc(0x2b, 0x1, 0x0) setsockopt$inet_tcp_TCP_QUEUE_SEQ(r1, 0x6, 0x15, &(0x7f0000000040)=0x9, 0x4) executing program 3: r0 = openat$vhost_vsock(0xffffffffffffff9c, &(0x7f0000000000), 0x2, 0x0) ioctl$VHOST_SET_VRING_CALL(r0, 0x4008af21, &(0x7f0000000040)={0x1}) (async) fdatasync(r0) setsockopt$inet6_tcp_TCP_FASTOPEN_KEY(0xffffffffffffffff, 0x6, 0x21, &(0x7f0000000080)="efeb92f1053fbfa7c72c5c9985b4e48e", 0x10) r1 = openat$cgroup_freezer_state(0xffffffffffffffff, &(0x7f00000000c0), 0x2, 0x0) ioctl$BTRFS_IOC_SEND(r0, 0x40489426, &(0x7f0000000140)={{r1}, 0x1, &(0x7f0000000100)=[0x1], 0xfffffffffffffffc, 0xf}) (async) ioctl$VHOST_SET_OWNER(r0, 0xaf01, 0x0) ioctl$FIGETBSZ(r0, 0x2, &(0x7f00000001c0)) (async) r2 = syz_open_dev$tty20(0xc, 0x4, 0x1) ioctl$VT_WAITACTIVE(r2, 0x5607) (async) ioctl$BTRFS_IOC_SUBVOL_CREATE_V2(r2, 0x50009418, &(0x7f0000000280)={{r2}, 0x0, 0x0, @inherit={0x60, &(0x7f0000000200)={0x1, 0x3, 0x10, 0x0, {0x31, 0x100000000, 0xb542, 0x2, 0xffffffffffff0001}, [0x8da8, 0x2, 0x4]}}, @subvolid=0x7}) r3 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) (async) write$RDMA_USER_CM_CMD_CREATE_ID(0xffffffffffffffff, &(0x7f00000012c0)={0x0, 0x18, 0xfa00, {0x4, &(0x7f0000001280), 0x13f, 0x3}}, 0x20) (async) r4 = eventfd2(0x4, 0x800) ioctl$VHOST_NET_SET_BACKEND(0xffffffffffffffff, 0x4008af30, &(0x7f0000001300)={0x3, r4}) ioctl$OCFS2_IOC_RESVSP(r3, 0x40305828, &(0x7f0000001340)={0x1, 0x0, 0x9e0, 0x1, 0xc, 0x1000}) (async) ioctl$XFS_IOC_PATH_TO_HANDLE(r0, 0xc0385869, &(0x7f0000001480)={r3, &(0x7f0000001380)='^%:^+-)\x00', 0x81, &(0x7f00000013c0)={@_ha_fsid={[0x400]}, {0x9, 0x6, 0x0, 0x100000001}}, 0x2, &(0x7f0000001400), &(0x7f0000001440)=0x1}) bind$802154_raw(r5, &(0x7f00000014c0)={0x24, @short={0x2, 0xffff, 0xaaa1}}, 0x14) ioctl$HDIO_GETGEO(r2, 0x301, &(0x7f0000001500)) ioctl$SG_BLKTRACESTART(r5, 0x1274, 0x0) (async) sendmsg$RDMA_NLDEV_CMD_NEWLINK(r5, &(0x7f0000001640)={&(0x7f0000001540)={0x10, 0x0, 0x0, 0x20}, 0xc, &(0x7f0000001600)={&(0x7f0000001580)={0x60, 0x1403, 0x2, 0x70bd25, 0x25dfdbff, "", [{{0x9, 0x2, 'syz0\x00'}, {0x8, 0x41, 'rxe\x00'}, {0x14, 0x33, 'vlan0\x00'}}, {{0x9, 0x2, 'syz2\x00'}, {0x8, 0x41, 'rxe\x00'}, {0x14, 0x33, 'vlan1\x00'}}]}, 0x60}, 0x1, 0x0, 0x0, 0x804}, 0x0) syz_usb_connect$hid(0x6, 0x3f, &(0x7f0000001680)={{0x12, 0x1, 0x201, 0x0, 0x0, 0x0, 0x8, 0x28bd, 0x78, 0x40, 0x1, 0x2, 0x3, 0x1, [{{0x9, 0x2, 0x2d, 0x1, 0x1, 0x82, 0x80, 0x7, "", [{{0x9, 0x4, 0x0, 0xff, 0x2, 0x3, 0x1, 0x1, 0xb6, {0x9, 0x21, 0x5, 0x25, 0x1, {0x22, 0x1c0}}, {{{0x9, 0x5, 0x81, 0x3, 0x200, 0x7f, 0xe, 0x5}}, [{{0x9, 0x5, 0x2, 0x3, 0x20, 0x7f, 0x2a, 0x9}}]}}}]}}]}}, &(0x7f0000001b80)={0xa, &(0x7f00000016c0)={0xa, 0x6, 0x201, 0xff, 0x7, 0x4, 0xd7, 0x54}, 0xaa, &(0x7f0000001700)={0x5, 0xf, 0xaa, 0x6, [@ss_cap={0xa, 0x10, 0x3, 0x2, 0x8, 0x1, 0x5, 0x2}, @generic={0x6e, 0x10, 0x2, "169b7d64f515fcd937925232042e5ed1797408164afc4d6262b196decb682996da78be8ef93d6d4fa1922053d5bf88135a6183d42cc0bce5aebb8752dbe389ad874cbc99a01843098695f3c6909d0da65f7823f9974e9e5944c325e5979360c3197cc26b0e69d1665d14c3"}, @wireless={0xb, 0x10, 0x1, 0x4, 0x10, 0x78, 0x9, 0x0, 0x2}, @ss_container_id={0x14, 0x10, 0x4, 0x7, "eab4d29998765348b33d70e7155dacf7"}, @wireless={0xb, 0x10, 0x1, 0x2, 0x0, 0x4, 0x5, 0x8, 0x8}, @ptm_cap={0x3}]}, 0xa, [{0xf, &(0x7f00000017c0)=@string={0xf, 0x3, "64f982b1475c11107a57dec541"}}, {0x4, &(0x7f0000001800)=@lang_id={0x4, 0x3, 0x180c}}, {0x86, &(0x7f0000001840)=@string={0x86, 0x3, "ec80f05c6d5d3539025786eb2ed2befe3f565018ebe44d461c62b6b478b81c346b324841dce0b37ef3733aba54d6a66df7df77602d045d96f356433ceca9c8ec8eeabb531fef053a09f84e1d9e686626440a2e6cce6dc2be0299ea0a925ee5ef5d80468bdb27da48811b82737887a2db2c8303922f203fad7a3ebe616a7aa252bcfb7bf9"}}, {0x4, &(0x7f0000001900)=@lang_id={0x4, 0x3, 0xf4ff}}, {0x4, &(0x7f0000001940)=@lang_id={0x4, 0x3, 0x406}}, {0x63, &(0x7f0000001980)=@string={0x63, 0x3, "cb513e4356ef0246954b528d2561331efeacaabf9d620e2233525acc7b144771d1725d5271aa5d5ba871d16e17b9a2f19aad62117eaf6a40ea9a2ecad2b9a093d868751afcb36926d42e4d4564ec1a7609be3a8bcc5c598de214f8a0eb0df4d7b5"}}, {0x4c, &(0x7f0000001a00)=@string={0x4c, 0x3, "11a2badf13eca09def275048fafe698bb25a2edb0de068a8d0d726d2ffb5a72d1070068aa93b900cdb085149360ec0c9acc9a8e5e4c05dbb76afdc75d6f7e891884cf31405074d7f831e"}}, {0xe, &(0x7f0000001a80)=@string={0xe, 0x3, "f63dc66d0abc5db1dc0ab9f5"}}, {0x66, &(0x7f0000001ac0)=@string={0x66, 0x3, "d2072b40cdd05fca95476d9f42021694fad871e05acc29babe15c8c22b30e0b876f3502a7e7f1d109ea9ca9ea3a38f3b9898fdcdd456eb594c7312089d959c3bc68e706a0ae9c0f2112b7d8ae03880c43ea3d9b69e274dae748e7f8281d7805947bcdeba"}}, {0x4, &(0x7f0000001b40)=@lang_id={0x4, 0x3, 0x41c}}]}) (async) ioctl$KDDISABIO(r5, 0x4b37) (async) ioctl$AUTOFS_DEV_IOCTL_PROTOSUBVER(r5, 0xc0189373, &(0x7f0000001c40)={{0x1, 0x1, 0x18, r2, {0x3}}, './file0\x00'}) write(r3, &(0x7f0000001c80)="4e5661016ad3de10f0caa8e1b915b8c0c264ae22ff6b9bee96736c92016c1a3ddc67c1963afccd97020105a3e2197dc87d067dced5c630ef6b02ac3d8dd616f9c2755325d318601b390edeedfbc382bd67e96b77c9dad0799ad8e55d048e5ce613c1490111232f4c12f185c52df73c4d0d4968ee2e91b8b15ce3a5c52a80242078b67a94b3bca5b8ca0cb3f4a64b8d156b979fc947b59f6a9a0d4c99be215ef77d3da3066191fae6cb284261ea5bbf113f793c784d1296e3b9da2ff596af14182dc07fee3b8c79228b569c89c8131f6ed8899c68c8039d59f4d2ce5fbae729394234e20e6b084abccc1e2e86435833dd05c25f89b45e945e8cdcdddb216848", 0xff) (async) r7 = syz_genetlink_get_family_id$nl80211(&(0x7f0000001dc0), r5) (async) ioctl$sock_SIOCGIFINDEX_80211(r6, 0x8933, &(0x7f0000001e00)={'wlan0\x00', 0x0}) sendmsg$NL80211_CMD_DEL_STATION(r5, &(0x7f0000002000)={&(0x7f0000001d80)={0x10, 0x0, 0x0, 0x80000}, 0xc, &(0x7f0000001fc0)={&(0x7f0000001e40)={0x170, r7, 0x800, 0x70bd26, 0x25dfdbff, {{}, {@val={0x8, 0x3, r8}, @val={0xc, 0x99, {0x401, 0x5}}}}, [@NL80211_ATTR_STA_EXT_CAPABILITY={0x101, 0xac, "7c8a3c93c470f02ef9d53b1191fc108dbafe6d2060d20e5fe51ee46f3bede438e6c2cde92f6f661030fc8007c3cbc17c6e6594b598d966a8498b1a7314a03e9d30f2e600609ec56fdd7a9caafff35cd6f02491954d1d470d9b1cf86fcbd978834bb6c10670c3670edeae752d1e303ea30e1c63c87de4953dda2dee525e93f8e355cfe823f9de3a0439d8ebff80b10f988655651cfb5b99438d2a78d568264afacf251b4d47e50a293a51dbb5d2eb875feeb22bee65b0b572daa9c0ecd68f83aac988dbf0b8a17235968fd6f1c52d7ebe91f830e3b716c67ca833e137c015f3ac9887b247fb1f960a1eb422207ab9c77491fc1fcd6fe15dd18959753ae9"}, @NL80211_ATTR_STA_TX_POWER={0x6}, @NL80211_ATTR_STA_TX_POWER_SETTING={0x5, 0x113, 0x1}, @NL80211_ATTR_OPMODE_NOTIF={0x5, 0xc2, 0x6}, @NL80211_ATTR_STA_AID={0x6, 0x10, 0x193}, @NL80211_ATTR_STA_WME={0xc, 0x81, [@NL80211_STA_WME_UAPSD_QUEUES={0x5}]}, @NL80211_ATTR_MGMT_SUBTYPE={0x5, 0x29, 0xa}, @NL80211_ATTR_OPMODE_NOTIF={0x5, 0xc2, 0x4}, @NL80211_ATTR_STA_PLINK_ACTION={0x5}]}, 0x170}, 0x1, 0x0, 0x0, 0x10}, 0x10) r9 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$NL80211_CMD_TRIGGER_SCAN(r9, &(0x7f0000002180)={&(0x7f0000002040)={0x10, 0x0, 0x0, 0x4000}, 0xc, &(0x7f0000002140)={&(0x7f0000002080)={0x90, r7, 0x100, 0x70bd2d, 0x25dfdbfd, {{}, {@void, @val={0xc, 0x99, {0x769e3930, 0x3a}}}}, [@NL80211_ATTR_SCAN_SSIDS={0x28, 0x2d, 0x0, 0x1, [{0xa, 0x0, @default_ibss_ssid}, {0xa, 0x0, @default_ap_ssid}, {0xa, 0x0, @default_ibss_ssid}]}, @NL80211_ATTR_SCHED_SCAN_DELAY={0x8, 0xdc, 0x3}, @NL80211_ATTR_SCAN_FREQUENCIES={0x24, 0x2c, 0x0, 0x1, [{0x8, 0x0, 0x8}, {0x8, 0x0, 0x7fffffff}, {0x8, 0x0, 0x401}, {0x8, 0x0, 0x80000000}]}, @NL80211_ATTR_SCHED_SCAN_RELATIVE_RSSI={0x5, 0xf6, 0x9}, @NL80211_ATTR_MEASUREMENT_DURATION_MANDATORY={0x4}, @NL80211_ATTR_MEASUREMENT_DURATION={0x6, 0xeb, 0x2}, @NL80211_ATTR_SCHED_SCAN_INTERVAL={0x8, 0x77, 0x10001}]}, 0x90}, 0x1, 0x0, 0x0, 0x8000}, 0x4001) executing program 33: r0 = openat$vhost_vsock(0xffffffffffffff9c, &(0x7f0000000000), 0x2, 0x0) ioctl$VHOST_SET_VRING_CALL(r0, 0x4008af21, &(0x7f0000000040)={0x1}) (async) fdatasync(r0) setsockopt$inet6_tcp_TCP_FASTOPEN_KEY(0xffffffffffffffff, 0x6, 0x21, &(0x7f0000000080)="efeb92f1053fbfa7c72c5c9985b4e48e", 0x10) r1 = openat$cgroup_freezer_state(0xffffffffffffffff, &(0x7f00000000c0), 0x2, 0x0) ioctl$BTRFS_IOC_SEND(r0, 0x40489426, &(0x7f0000000140)={{r1}, 0x1, &(0x7f0000000100)=[0x1], 0xfffffffffffffffc, 0xf}) (async) ioctl$VHOST_SET_OWNER(r0, 0xaf01, 0x0) ioctl$FIGETBSZ(r0, 0x2, &(0x7f00000001c0)) (async) r2 = syz_open_dev$tty20(0xc, 0x4, 0x1) ioctl$VT_WAITACTIVE(r2, 0x5607) (async) ioctl$BTRFS_IOC_SUBVOL_CREATE_V2(r2, 0x50009418, &(0x7f0000000280)={{r2}, 0x0, 0x0, @inherit={0x60, &(0x7f0000000200)={0x1, 0x3, 0x10, 0x0, {0x31, 0x100000000, 0xb542, 0x2, 0xffffffffffff0001}, [0x8da8, 0x2, 0x4]}}, @subvolid=0x7}) r3 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) (async) write$RDMA_USER_CM_CMD_CREATE_ID(0xffffffffffffffff, &(0x7f00000012c0)={0x0, 0x18, 0xfa00, {0x4, &(0x7f0000001280), 0x13f, 0x3}}, 0x20) (async) r4 = eventfd2(0x4, 0x800) ioctl$VHOST_NET_SET_BACKEND(0xffffffffffffffff, 0x4008af30, &(0x7f0000001300)={0x3, r4}) ioctl$OCFS2_IOC_RESVSP(r3, 0x40305828, &(0x7f0000001340)={0x1, 0x0, 0x9e0, 0x1, 0xc, 0x1000}) (async) ioctl$XFS_IOC_PATH_TO_HANDLE(r0, 0xc0385869, &(0x7f0000001480)={r3, &(0x7f0000001380)='^%:^+-)\x00', 0x81, &(0x7f00000013c0)={@_ha_fsid={[0x400]}, {0x9, 0x6, 0x0, 0x100000001}}, 0x2, &(0x7f0000001400), &(0x7f0000001440)=0x1}) bind$802154_raw(r5, &(0x7f00000014c0)={0x24, @short={0x2, 0xffff, 0xaaa1}}, 0x14) ioctl$HDIO_GETGEO(r2, 0x301, &(0x7f0000001500)) ioctl$SG_BLKTRACESTART(r5, 0x1274, 0x0) (async) sendmsg$RDMA_NLDEV_CMD_NEWLINK(r5, &(0x7f0000001640)={&(0x7f0000001540)={0x10, 0x0, 0x0, 0x20}, 0xc, &(0x7f0000001600)={&(0x7f0000001580)={0x60, 0x1403, 0x2, 0x70bd25, 0x25dfdbff, "", [{{0x9, 0x2, 'syz0\x00'}, {0x8, 0x41, 'rxe\x00'}, {0x14, 0x33, 'vlan0\x00'}}, {{0x9, 0x2, 'syz2\x00'}, {0x8, 0x41, 'rxe\x00'}, {0x14, 0x33, 'vlan1\x00'}}]}, 0x60}, 0x1, 0x0, 0x0, 0x804}, 0x0) syz_usb_connect$hid(0x6, 0x3f, &(0x7f0000001680)={{0x12, 0x1, 0x201, 0x0, 0x0, 0x0, 0x8, 0x28bd, 0x78, 0x40, 0x1, 0x2, 0x3, 0x1, [{{0x9, 0x2, 0x2d, 0x1, 0x1, 0x82, 0x80, 0x7, "", [{{0x9, 0x4, 0x0, 0xff, 0x2, 0x3, 0x1, 0x1, 0xb6, {0x9, 0x21, 0x5, 0x25, 0x1, {0x22, 0x1c0}}, {{{0x9, 0x5, 0x81, 0x3, 0x200, 0x7f, 0xe, 0x5}}, [{{0x9, 0x5, 0x2, 0x3, 0x20, 0x7f, 0x2a, 0x9}}]}}}]}}]}}, &(0x7f0000001b80)={0xa, &(0x7f00000016c0)={0xa, 0x6, 0x201, 0xff, 0x7, 0x4, 0xd7, 0x54}, 0xaa, &(0x7f0000001700)={0x5, 0xf, 0xaa, 0x6, [@ss_cap={0xa, 0x10, 0x3, 0x2, 0x8, 0x1, 0x5, 0x2}, @generic={0x6e, 0x10, 0x2, "169b7d64f515fcd937925232042e5ed1797408164afc4d6262b196decb682996da78be8ef93d6d4fa1922053d5bf88135a6183d42cc0bce5aebb8752dbe389ad874cbc99a01843098695f3c6909d0da65f7823f9974e9e5944c325e5979360c3197cc26b0e69d1665d14c3"}, @wireless={0xb, 0x10, 0x1, 0x4, 0x10, 0x78, 0x9, 0x0, 0x2}, @ss_container_id={0x14, 0x10, 0x4, 0x7, "eab4d29998765348b33d70e7155dacf7"}, @wireless={0xb, 0x10, 0x1, 0x2, 0x0, 0x4, 0x5, 0x8, 0x8}, @ptm_cap={0x3}]}, 0xa, [{0xf, &(0x7f00000017c0)=@string={0xf, 0x3, "64f982b1475c11107a57dec541"}}, {0x4, &(0x7f0000001800)=@lang_id={0x4, 0x3, 0x180c}}, {0x86, &(0x7f0000001840)=@string={0x86, 0x3, "ec80f05c6d5d3539025786eb2ed2befe3f565018ebe44d461c62b6b478b81c346b324841dce0b37ef3733aba54d6a66df7df77602d045d96f356433ceca9c8ec8eeabb531fef053a09f84e1d9e686626440a2e6cce6dc2be0299ea0a925ee5ef5d80468bdb27da48811b82737887a2db2c8303922f203fad7a3ebe616a7aa252bcfb7bf9"}}, {0x4, &(0x7f0000001900)=@lang_id={0x4, 0x3, 0xf4ff}}, {0x4, &(0x7f0000001940)=@lang_id={0x4, 0x3, 0x406}}, {0x63, &(0x7f0000001980)=@string={0x63, 0x3, "cb513e4356ef0246954b528d2561331efeacaabf9d620e2233525acc7b144771d1725d5271aa5d5ba871d16e17b9a2f19aad62117eaf6a40ea9a2ecad2b9a093d868751afcb36926d42e4d4564ec1a7609be3a8bcc5c598de214f8a0eb0df4d7b5"}}, {0x4c, &(0x7f0000001a00)=@string={0x4c, 0x3, "11a2badf13eca09def275048fafe698bb25a2edb0de068a8d0d726d2ffb5a72d1070068aa93b900cdb085149360ec0c9acc9a8e5e4c05dbb76afdc75d6f7e891884cf31405074d7f831e"}}, {0xe, &(0x7f0000001a80)=@string={0xe, 0x3, "f63dc66d0abc5db1dc0ab9f5"}}, {0x66, &(0x7f0000001ac0)=@string={0x66, 0x3, "d2072b40cdd05fca95476d9f42021694fad871e05acc29babe15c8c22b30e0b876f3502a7e7f1d109ea9ca9ea3a38f3b9898fdcdd456eb594c7312089d959c3bc68e706a0ae9c0f2112b7d8ae03880c43ea3d9b69e274dae748e7f8281d7805947bcdeba"}}, {0x4, &(0x7f0000001b40)=@lang_id={0x4, 0x3, 0x41c}}]}) (async) ioctl$KDDISABIO(r5, 0x4b37) (async) ioctl$AUTOFS_DEV_IOCTL_PROTOSUBVER(r5, 0xc0189373, &(0x7f0000001c40)={{0x1, 0x1, 0x18, r2, {0x3}}, './file0\x00'}) write(r3, &(0x7f0000001c80)="4e5661016ad3de10f0caa8e1b915b8c0c264ae22ff6b9bee96736c92016c1a3ddc67c1963afccd97020105a3e2197dc87d067dced5c630ef6b02ac3d8dd616f9c2755325d318601b390edeedfbc382bd67e96b77c9dad0799ad8e55d048e5ce613c1490111232f4c12f185c52df73c4d0d4968ee2e91b8b15ce3a5c52a80242078b67a94b3bca5b8ca0cb3f4a64b8d156b979fc947b59f6a9a0d4c99be215ef77d3da3066191fae6cb284261ea5bbf113f793c784d1296e3b9da2ff596af14182dc07fee3b8c79228b569c89c8131f6ed8899c68c8039d59f4d2ce5fbae729394234e20e6b084abccc1e2e86435833dd05c25f89b45e945e8cdcdddb216848", 0xff) (async) r7 = syz_genetlink_get_family_id$nl80211(&(0x7f0000001dc0), r5) (async) ioctl$sock_SIOCGIFINDEX_80211(r6, 0x8933, &(0x7f0000001e00)={'wlan0\x00', 0x0}) sendmsg$NL80211_CMD_DEL_STATION(r5, &(0x7f0000002000)={&(0x7f0000001d80)={0x10, 0x0, 0x0, 0x80000}, 0xc, &(0x7f0000001fc0)={&(0x7f0000001e40)={0x170, r7, 0x800, 0x70bd26, 0x25dfdbff, {{}, {@val={0x8, 0x3, r8}, @val={0xc, 0x99, {0x401, 0x5}}}}, [@NL80211_ATTR_STA_EXT_CAPABILITY={0x101, 0xac, "7c8a3c93c470f02ef9d53b1191fc108dbafe6d2060d20e5fe51ee46f3bede438e6c2cde92f6f661030fc8007c3cbc17c6e6594b598d966a8498b1a7314a03e9d30f2e600609ec56fdd7a9caafff35cd6f02491954d1d470d9b1cf86fcbd978834bb6c10670c3670edeae752d1e303ea30e1c63c87de4953dda2dee525e93f8e355cfe823f9de3a0439d8ebff80b10f988655651cfb5b99438d2a78d568264afacf251b4d47e50a293a51dbb5d2eb875feeb22bee65b0b572daa9c0ecd68f83aac988dbf0b8a17235968fd6f1c52d7ebe91f830e3b716c67ca833e137c015f3ac9887b247fb1f960a1eb422207ab9c77491fc1fcd6fe15dd18959753ae9"}, @NL80211_ATTR_STA_TX_POWER={0x6}, @NL80211_ATTR_STA_TX_POWER_SETTING={0x5, 0x113, 0x1}, @NL80211_ATTR_OPMODE_NOTIF={0x5, 0xc2, 0x6}, @NL80211_ATTR_STA_AID={0x6, 0x10, 0x193}, @NL80211_ATTR_STA_WME={0xc, 0x81, [@NL80211_STA_WME_UAPSD_QUEUES={0x5}]}, @NL80211_ATTR_MGMT_SUBTYPE={0x5, 0x29, 0xa}, @NL80211_ATTR_OPMODE_NOTIF={0x5, 0xc2, 0x4}, @NL80211_ATTR_STA_PLINK_ACTION={0x5}]}, 0x170}, 0x1, 0x0, 0x0, 0x10}, 0x10) r9 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$NL80211_CMD_TRIGGER_SCAN(r9, &(0x7f0000002180)={&(0x7f0000002040)={0x10, 0x0, 0x0, 0x4000}, 0xc, &(0x7f0000002140)={&(0x7f0000002080)={0x90, r7, 0x100, 0x70bd2d, 0x25dfdbfd, {{}, {@void, @val={0xc, 0x99, {0x769e3930, 0x3a}}}}, [@NL80211_ATTR_SCAN_SSIDS={0x28, 0x2d, 0x0, 0x1, [{0xa, 0x0, @default_ibss_ssid}, {0xa, 0x0, @default_ap_ssid}, {0xa, 0x0, @default_ibss_ssid}]}, @NL80211_ATTR_SCHED_SCAN_DELAY={0x8, 0xdc, 0x3}, @NL80211_ATTR_SCAN_FREQUENCIES={0x24, 0x2c, 0x0, 0x1, [{0x8, 0x0, 0x8}, {0x8, 0x0, 0x7fffffff}, {0x8, 0x0, 0x401}, {0x8, 0x0, 0x80000000}]}, @NL80211_ATTR_SCHED_SCAN_RELATIVE_RSSI={0x5, 0xf6, 0x9}, @NL80211_ATTR_MEASUREMENT_DURATION_MANDATORY={0x4}, @NL80211_ATTR_MEASUREMENT_DURATION={0x6, 0xeb, 0x2}, @NL80211_ATTR_SCHED_SCAN_INTERVAL={0x8, 0x77, 0x10001}]}, 0x90}, 0x1, 0x0, 0x0, 0x8000}, 0x4001) executing program 1: r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000000040)=@newlink={0x38, 0x10, 0x439, 0x3, 0x0, {0x0, 0x0, 0x0, 0x0, 0x9801, 0x1303}, [@IFLA_LINKINFO={0x18, 0x12, 0x0, 0x1, @sit={{0x8}, {0xc, 0x2, 0x0, 0x1, [@IFLA_IPTUN_FLAGS={0x6, 0x8, 0x40}]}}}]}, 0x38}, 0x1, 0x0, 0x0, 0x1}, 0x4000000) ioctl$XFS_IOC_START_COMMIT(0xffffffffffffffff, 0x80585882, &(0x7f0000000280)={0xffffffffffffffff}) r2 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000040)='memory.events\x00', 0x275a, 0x0) write$tun(r2, &(0x7f0000000340)=ANY=[], 0x141) mmap(&(0x7f0000000000/0x4000)=nil, 0x4000, 0x1, 0x10012, r2, 0x0) ioctl$SECCOMP_IOCTL_NOTIF_RECV(r2, 0xc0502100, &(0x7f00000003c0)={0x0}) ioctl$SECCOMP_IOCTL_NOTIF_ID_VALID(r1, 0x40082102, &(0x7f0000000380)=r3) r4 = bpf$MAP_CREATE(0x0, &(0x7f0000000640)=@base={0x17, 0x0, 0x1, 0xff, 0x0, 0x1}, 0x48) r5 = bpf$MAP_CREATE(0x0, &(0x7f0000000040)=@base={0xd, 0x4, 0x4, 0x9, 0x0, r4}, 0x50) bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x11, 0xc, &(0x7f0000000180)=ANY=[@ANYBLOB="1800000000000100000000000000fe0018110000", @ANYRES32=r5, @ANYBLOB="0000000000000000b708000000000e007b8af8ff00000000bfa200000000000007020000f8ffffffb703000008000000b704000000000020850000000100000095"], &(0x7f0000000240)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x90) executing program 1: r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000180), 0x2002, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) r2 = syz_open_dev$I2C(&(0x7f0000000040), 0x1, 0x402) mkdirat(0xffffffffffffff9c, &(0x7f0000000080)='./dev\x00', 0x1ff) mount(0x0, &(0x7f00000000c0)='./dev\x00', &(0x7f00000003c0)='devtmpfs\x00', 0x0, 0x0) r3 = openat(0xffffffffffffff9c, &(0x7f0000000400)='./dev/mapper/control\x00', 0x2, 0x0) ioctl(r3, 0xc178fd02, &(0x7f0000000100)="0400000032000000000000003801") pwrite64(r2, 0x0, 0x39, 0x26c) r4 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0) syz_kvm_setup_cpu$x86(r1, r4, &(0x7f0000fe5000/0x18000)=nil, &(0x7f0000000140)=[@text64={0x40, 0x0}], 0x1, 0x7c, 0x0, 0x0) r5 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000000), 0x80800, 0x0) r6 = ioctl$KVM_CREATE_VM(r5, 0xae01, 0xffffffffffffffff) r7 = ioctl$KVM_CREATE_VCPU(r6, 0xae41, 0x0) syz_kvm_setup_cpu$x86(r1, r7, &(0x7f0000fe6000/0x18000)=nil, &(0x7f0000000200)=[@textreal={0x8, &(0x7f00000001c0)="0f01390ff2f63e0fa10f01c966b80adcc8890000ba000000000f300f79d80f236f0f01c966b9024d564b0f32350280660f38dfec", 0x34}], 0x1, 0x21, 0x0, 0x0) ioctl$KVM_RUN(r7, 0xae80, 0x0) ioctl$KVM_SET_VCPU_EVENTS(r7, 0x4040aea0, &(0x7f0000000080)=@arm64={0x5, 0x9, 0x4d, '\x00', 0xfffffffffffffffe}) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeea, 0x8031, 0xffffffffffffffff, 0x28f43000) madvise(&(0x7f0000000000/0x600000)=nil, 0x600003, 0x19) mlock2(&(0x7f000000e000/0x1000)=nil, 0x1000, 0x0) mlock(&(0x7f0000000000/0x800000)=nil, 0x800000) syz_clone(0xa0000, &(0x7f0000000180), 0x0, &(0x7f0000000280), 0x0, 0x0) madvise(&(0x7f0000000000/0x600000)=nil, 0x600003, 0x19) ioctl$KVM_RUN(r7, 0xae80, 0x0) ioctl$KVM_SET_NESTED_STATE(r7, 0x4080aebf, &(0x7f0000000580)=@svm={0x100, 0x1, 0x1080, {0xe000}, {"a349917fc78302bc9638bfb9f5765bb1d19f9ca20846136a1245392909e3619ad5c5ce5919824b0e65ba661823abb2008dfa8ae56ff107b703f95dd5ed7a49f650c51eb4efc9ad7044c8ae479c1828d41e71cc8b1877bbd3555c10bda5c20e0bc99641995e1594b919617c3e1466e77fcb90ddd499e1ebe8ecbe86d304d019a47d742e942070bfcc6012914ac521ddcc3b1a691a0a07816c6d19d7eecb1db1acddfd57e0a10e033cd18107f5f9c6f4a1c98526428e7bd5b48fdad233786865ef779baa040bd5c796d0d0b545d96fb3422b0fa8bc1cf000a75d1726fb0f861e06f22549563031d32dc3869469834231b45260d37eda2dc32858f193c9d1e9d2a9e1f4384a0d436c1222c8236708eaa7c6371265651c940f460c823e7636a6e9634e4722bf74223b19120988dc166a733e3c15aa75ad79adba03431b0d8a52e9536534d5173477497f53f91c9a44a1f1f41f4b0319d970ec5bccb61b7f1c909b6cf8a6750660abaab85839d19a8fd30749b9b59d7a0a9d8c7ff45bc85d9c49a1b3dc5d900440407d1a420cefc9215bb6960380b4564fbc063988492bcf91610ee756e97e6c632d5e1060b738c66f247cccda332217f8c39c54e48f30af47e9edda42185ecee7ef0e800cca5b8b9f77cdb9611d1d24dedc3cab47bb29186bd6b3cccc6d460a5029cfb355f633972a913c6d049ccee1965a21888f6dfef19cb0b9cc30f95c01b68a26040edeebc721ec067d3acb2495124118f83bb0dabc01853bb3e27a7211f0af6c2e1663dc7b98b31acc737ce7d4447559c206d12f92548957a9eadf94f302bada7355c31339982f8e055def1aee5d67e66525144c9765c761943db0cacb9cdc2c83938c7011f677416c0b95487d4c7415bdfd9263da7ef16ddd0e880eb6fd55acf23a5b73eb084f4a2fae6642fff547f881149fe2dc436a52075b2234a41ffc2d4a023791c8e8b9352c58227596e31e01b46c7174de887e3045631ccc802d8c7db6b560cd44162f68b86a20edf8b0d3d7fb3f929d605cb81c4a2d8fb13e959da89cbdd906ef3a49a2efe736885112d1963dcc2de4feb5db3d1a6a5b7d70ef9996f20a9762f8b890528352563ceb7d8c3fb6dee111632f86db7e19e4d02f6ad9d7e9c8f0f6b42bb5c866c28b378e01f156ca453d5feb01b7b90df1bdd3170517a31d489b3bb2d4863da90abe5d6e21c5e23264e98de4236ad870f996392831ca79082e487b55810d8e99a7a316e660ac223806d202a7b7dfdb90b42d54bca0888d28c6856e7944f12fa9f2b9febc2fab10af355668fe3df2a3b063847d77763fc64b7b313a277e355f71525f3b0e140c57f9011eb7ad5983252ed2ce28d6418ed659ed3d0b04b190c7eafb0097d61eba0c72117dbe6a8eb8e24516fb242d392eed19082e5cbfbc124f1fcbe1e500fa9cd631e5e9a997514830f8d865a2eb7f70e2f6f505f3532331a7184d8c7375348bee7a813a46aae1a56b949cb12423da8b0c4b803a6cb0dbfd3f3d9b3709ae0ca6851fa5f209618bde8195d4099687b8d1a4acc079d5897d3e25bea9bf9e6971269f328a478dd7638e526da367bf14f847c9f01050b1aed129e8123c1d2b4b694ac2b4b809047ddbbcc0701319b40795cdda399ce24d9b5ad2ab4f0d9b029932fa4a94faf617c3039b9b1a8987ad0076091f66734990012dccf7009f7e72dbde5ca4eb60c7c8a0eedfca9d221c2bd8ea408feb86712fad259bf031c31b4b754a574cd4ec511889f51f6ed5730ab6952ccaad47cd8569c7b9d9e791ab58fa1a7431af01b9ea0aa02a0e19ab41008505fd28e7d96977b291518775891b4efc860981254e6769e37cd153770a34190da002b141a4db4f7e5dd94a5ed5b489a9d5f7b2874bde1e9ac969f8486ccc4d759f4bb54343f9abe143ab2dce69cb5c5ba8594e0e71d9a4778a64bb588f1926308d030819aac9ec3f4568b611a5c3df533da038fda8d221b4e135ada802f70c4d952541338aa5afbd3032a42382fb4ba8b6f9ec972077fbce4f5214df9d0ce0b208b1d617933035a8ec494045a5d8e6f5cec6583c844f012eb36c053cf097d8a6a3a55765d234dc1d4aad7d79714038038b850d7895be8819e78d012ba45e18d8ebfdd88013595acb5c7a25c9608f71c6e6413c7ae29e3683a6b95c894b1529d071593b7d2a32f41288d5897f6c0b7d0f9a115521e8f720240c1476b5485743243e15e0db138c736e950d983e730bccf02b5a0f2353229ab90d15bc8f74d0d9b7e203e5cc8f793add56dbb917134eb24e6f3b22e6292ca242328cdc25a6cf6e48da193b450377cdf79abc0cd3a61c8c9c6419f2839be4109721ebd34bad56e8022ec9ac837ee33fd28fde75ea443900ba5a3caa60d87dae10480fb439f78c92d361879d9857994d844c8d77d2895cab49242e5108a1dbbd0d0c7a9caee80c98fbee158f494cd401afffdd5518780ec22410ed680c1edb3959f8076ded8d8af44099585f4715780b2373ba3950383f61b10be5486d7a09711ecef8154052e73c723cef60a2ed2c2e37b073b05d28c98704aecefd27def2fb940068a026a1883656f9daa041a75a27cd4aa705a87863a3b96f9562b4c764a4fc64b57b6eb17dc1611cf50757f1d88b6173e6fc4d3acdcbf32c14b3e7857a84db0765f5655914d4b74b9823fb4fa0df3393b9016540f5cbf5525b3e8aad6d5b49c9ee331708bf292d9f155b965eea636d716b49a80037ffbdfae050f8619c7d083c8826e1b691aea0060f7fee5a845ef1bc76dd1e0553e73a2cb0960f72fc11d7e907e507ecb08c394d2c48fbd28e1b0375c28c4171c760d59c2612381c6e88e2e5ac85570f845c58495121f3b1cd996a8c9c2bf0e9d833aa3985ef80be10465a768899d65d19f26962e1fcdc9db0b25e680e3ebb1839dd0a39952be4f2ef5ae2a4b6afa1f4016f2baa0634d05cba0f46417de11167da8cc1db075335ff30730f5b4bd3a906903b8eb74715750e222f01778a7edcfd2343a7a2596feaf6285c321acf6f4863649d3d4c6892dd1a798c0cb091e46170d6236ec8a0b90cf370c4eb480a6f4abd8419090a3237521620dcf057612ca723d4af5488af39aeb9f8a470832dfabd79d9efe2c1dface0719b7ad4e3f6a03a3068df1edb28f6a81afcc7917d989c84ed739cc15467f599863ff4ac94f6db8c23794cf1523fafe3dfe3253cee480d3a985aca8e9e49aa911b5b4118c05a96ca900f3fb695f4b2fa705fdee27941d6227c7bab9432d71e471a0b9493e8ee5b233208631698b4ea9eb75abdbed905bc26c8b034cc20c9df78b8f49e59c0f9ce28b0b7258019121252ac9513074daf6b6e9c5b1b251a3b4e68ae0b54e7c9949c0ce968424674ffb4907e8040fdf98dcad0c43a96809702fc5d1725600ca5ca2d9811ea694b0c4a9070d0150d8d7450b886eaa62d1d4969e161661b3d0f934db2e7ae603d889f6ce7feb6bb1c41a6d2cfde24e436cc4990062b87445a1756807b358a45cc1cf774c6315bf5768239d95bf94e05202bb6ff244649fa305a4b7ffedd79b868ee1d92f2a307e189bd9ac80ee44b4da6ec07aed60ece435196a737f10d729818c56eef410b2e99637da0e73c4d5b3faf45c514e20c7fcf519a59565fdb7663b6d844c8e690442be37e9acef647d3bf42b042e0afbc2cd35e328065462eee2886d0f33301fbe641d684064650ddac0c106ed23b06c4204600a0a4799f5547cf0655ab0abc0d79f466cb70636af925dbd1a52871dc524031dea80c3748e20aa144cf15c3e6ee4c710704c2556c229981161352401bec2ae05c4f0b56621f61766809249d9fe192da2a995a66f7b978e9eff5d0b5e2f620e6bc94cb24aecd02688cd825b97afc53e37774e7c6c8de99278319848952e0abe70227141e3acbd07274e8cc700b18b60ee67965bac9bb6192c1732055e508c3e3d2e11fc76f31b9fba12e9b405c8f0772b3d4c4a2f56ae6627ad9a41acfb3a7a86e477340226cb53b5e8b6ebbbdfd094661cf33f5db4c4e12250a3f3a626cd038d87874765a1ac120b094f0f2c48e9f520f4c7a8ea0df88b9b625199dc41d56275997de9d10e1edecc2a56384357624ff2879e17a9b1cd1f263392cc951d6190d884ebacb869d0288f16959120f94adfeefb8aec95e11933e6e6598f53b9fe2ebcbc7fd917d1cd9be012f266492c7823ee8aafe77c5fe7b7d9b824473064dece6c1f32df773e021ba3063f48545617761e4b62195f5720798e824db21179222b3f01c3f145edac902738f6415fa22f6b9757778cca52472fd8fbe52aed27133f41d79c618a2771c9f1b60e008539bc4e02578b3efa69315efc7ebbea26ce4d3618a0a553fd87fb0b37e724d6b4c2ba91d2ba820ce3a7172d566148b920106f83aa1ac4e31d25404b700439d32dd694e5af67340825aa567670cb742c60093d1f1e9b7836b9b1377a07e25145ba8f2b6b9a5fa7e1aea6b219d3287b94691b546759a82d04055128087caa801135a9602fd8b221cb013595d4539344a08ce3c670b31701ef5f74d391a0f61989af022e0b96fd10e4d6e2a28e92dd36a2c29b30d82de8c239ecc0ccd82d2468c00807f4252b2315797f198bbf35f58d5d1d78692560af0ee6a78ff144c68fee7c210640329b7b372ab37f85bdf16c5cf7f012503520980cddaeb079adb06b35bf18f644b5d8d78e0bed21a610b94eb15c2ff74828074f09c61bca8fca2c8eda5399fc0c84bd571d01d1e71a734cd03fca04cf712ab453fc65a9a0ae3e6be328596aab714deb3076718ec34e7c62a2198823ba04d203b153ab0b313a10996a8f89f56070685c5ad5a79d68275f27a233fe40e4f9b2401183ba087a0a77f29a04377439afba744cd77ab8ca424a5920ae263802bceda75009976cbd4790ed92a260e976e8e7757abfebed48006f03f29fe5cb7464a3a504d6e1e2f5c16ea8e9158a0a34db236fbc007bebb9dff31bbff10ded7998dcaa06cfddd34f421ad5cb86be4658484810eb8b94c7b0c3e82b100f32362f34fcff1b544efc810b75d0f3c2a62478463ebfd07f793d96784365e4b26623f7b4b0d51ba6f539ef4d5926f89705b2376d56637958591d4c441e4c6a30fbccbc173b86714862ff8e7741bc33218f6c342b18722be0c6c7f0d0872a411e05808deac3257791f0a9008d402260a2aec1eff817298ef04e144c90369f5554a65842968908f1aed32f98736f464c88e8b0fb76dc6cd21e77511f9760e94b433447e3cd59c5493fe4aff915b25e92f3cc0cdce85c54db683f31c333c86c61cf027a2695f772fdb179ad14b2184155384a74f6d00ef35cf68598a50f9497248d7ea55e9c34cb8cc005dd03b25c9d9bd126a74d99719edbd1d103692395be2a7c13a20cc90b5f22cadb199b4264de44a9ae44542adbfa0ff03b319f0fae431796954155507427820a6c49fa6e9567dea4ca7e181cefe3fa85260ec5ae735eb445a48e1b5ccdf5625fffe91e911a9e3ad662021cfea2b6bdac0bd2853c78ae193b11a1bc695ba08f099f77319e90f26000370bd533c39aa3838f225f21469ee3ccd2960a080f5623551c18a406ccb569a8fea254c753d0260380ba4a0bb03f86068da832262b306947c8280f5e03541194addfc931a88a3bbaceb7ee757864781b277601befc1da88663607bd3cd22fbebc462ea8ee25248955ee1d473d9ba8543893f6ea9201087170eff931cf22e9b5c01b855090071930778d02f5e1b7d4bb21929543b30c198633e8e5b0a0128509b558a9af43e861f0eb8132a0a5"}}) ioctl$KVM_RUN(r4, 0xae80, 0x0) r8 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) r9 = ioctl$KVM_CREATE_VM(r8, 0xae01, 0x1) ioctl$KVM_SET_MEMORY_ATTRIBUTES(r1, 0x4020aed2, &(0x7f0000000200)={0xeeef0000, 0x1002000}) r10 = ioctl$KVM_CREATE_VCPU(r9, 0xae41, 0x0) ioctl$KVM_PRE_FAULT_MEMORY(r10, 0xc040aed5, &(0x7f0000000040)={0x10000, 0x1f000}) executing program 1: r0 = socket$nl_route(0x10, 0x3, 0x0) setsockopt$netlink_NETLINK_RX_RING(r0, 0x10e, 0x6, &(0x7f0000000040)={0xc9f3, 0x8, 0x0, 0x8}, 0x10) (async) sendmsg$nl_route(r0, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000000)=@newlink={0x40, 0x10, 0x403, 0x0, 0x25dfdbff, {0x0, 0x0, 0x74, 0x0, 0x0, 0x5b2f3}, [@IFLA_LINKINFO={0x20, 0x12, 0x0, 0x1, @bridge={{0xb}, {0x10, 0x2, 0x0, 0x1, [@IFLA_BR_MCAST_STARTUP_QUERY_INTVL={0xc, 0x23, 0x2}]}}}]}, 0x40}, 0x1, 0x0, 0x0, 0x800}, 0x2000c014) executing program 1: socket$nl_route(0x10, 0x3, 0x0) (async) r0 = socket$nl_route(0x10, 0x3, 0x0) r1 = openat$audio(0xffffffffffffff9c, &(0x7f0000000000), 0x10002, 0x0) ioctl$SNDCTL_DSP_GETISPACE(r1, 0x8010500d, &(0x7f0000000040)) ioctl$KVM_CAP_HYPERV_VP_INDEX(0xffffffffffffffff, 0x4068aea3, &(0x7f0000000080)) stat(&(0x7f0000001740)='./file0\x00', &(0x7f0000001780)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) getsockopt$sock_cred(r0, 0x1, 0x11, &(0x7f0000001800)={0x0, 0x0, 0x0}, &(0x7f0000001840)=0xc) ioctl$SECCOMP_IOCTL_NOTIF_RECV(0xffffffffffffffff, 0xc0502100, &(0x7f0000001880)={0x0, 0x0}) ioctl$DRM_IOCTL_GET_CLIENT(0xffffffffffffffff, 0xc0286405, &(0x7f0000001900)={0x8, 0x10, {0xffffffffffffffff}, {0xee01}, 0x4, 0x80000001}) (async) ioctl$DRM_IOCTL_GET_CLIENT(0xffffffffffffffff, 0xc0286405, &(0x7f0000001900)={0x8, 0x10, {0xffffffffffffffff}, {0xee01}, 0x4, 0x80000001}) read$FUSE(0xffffffffffffffff, &(0x7f0000001940)={0x2020, 0x0, 0x0, 0x0, 0x0}, 0x2020) sendmmsg$unix(0xffffffffffffffff, &(0x7f0000003a40)=[{{&(0x7f0000000100)=@file={0x0, './file0\x00'}, 0x6e, &(0x7f0000001400)=[{&(0x7f0000000180)="3a9de706c6b2502c2dfa7fdf503181cc4118349d16e941f1243859b21de6b64465c92047e9e5395f016cc1e801779cacb3ff4e267f763d5a83e3bf1906d65bc44ddd5cc65c5d7b4ce42375380f16fdc76183fac0d96b30aaebcf7dab9c5e0b5ad4e554", 0x63}, {&(0x7f0000000200)="5c2353c0cc61fc022b09535713b22b87a34d5cb3d34b2629cf361714d48666f183e5c4a3a7a91a96d7d1", 0x2a}, {&(0x7f0000000240)="374cb43ff74840450baac4fee32db7009d732f8f3786066b35127ddb3e590c61a4b9b3215617ac9d40", 0x29}, {&(0x7f0000000280)="85e300c44aedb8f8b84174ff610be37d5e1dd632676d8c383ef9a5d2e75f6d0ff8ff3f89d552c27e1c609e34891f09c1b7577551555573f8c3b29b9b2ef7a5ad2dd45642f26e7732e1c230de3140d463dd70788df23cc31aa05d4df5354f1bd9975c298ea37aed90f54505091651ccb4022afcb4be577ee13d5675033247e698184c5b65811664f6228e67fb7fbe077e4ab93385f6d2cb21152e7f8fe6d85042a9d2657c6359a60870aa3a38005c3ac0d513fd79f306a4c80b10a01e296f898b2f5ea3ceb97d5193328e90d3dc741e5f98f740a263ea4547eb3f8bcf8f53", 0xde}, {&(0x7f0000000380)="594ce80edb1b9729bf2c80283f3cd80c91239e4a10fdf6a5494dfec12a7450ef9b86237618a93d540c6e36895c2772ad5756154c1f7ea6176e0a064e1492c2a49df73370d897c97cd597628cf34f7537db8d95ab9a5b731fb238ced33c3339f1a33acc", 0x63}, {&(0x7f0000000400)="a814711f2748f2511de3bddb80ca8d886d3445e912413ce9e367328ba3b8703005b0222bbb108b280c24288edb3b5667eaeec74d40a6f6fe57cdf1fddb424ae92c9da201b8ed148df4db00d83785fcfbb46a54fc431aa1a66ab8e8a0394ca922f74f10ad5ee0185a1c83c10703934d9a982ca804ed55e6137e259f344562d83f04c977d1881fa00c363e2eacca4e2fbbab17164da9dab2cfe2ad765307fec165922b0fb5c3dfa5503851e6530cc17a0cc583f93dd71c874b97acf2e614d4746d21496515aefbc3567da446ae394ffdbbf69a07e0b95db22b5d8ac12bdc7c3ea3646aba16b321e5eb64ef78c72e7f24188e12bd1aa20c51f232a2efdb2b08da2a92f9261e6de050187292fe04df85ce5650c0c00e5fb9e4d1d700e381266e828541afa9454a1e25ba48003d65f31045a86fff56f5121b7e9a210c63b1632efdd5844b8cfcd660b0b7b5af43425231b543acde383e2faf93c2bac93243cba6fc2fdd779a332d84ee0484db317693760fc3c3559c06e3adfbf1f279ad50aa7d80dd90dd32b21a3e219a15a92153f39de1b97d5a3f7b04d0063924829a942ee0b226dd397f11cc67e1301a9ce0fb4adacae37bc0aa9e9b9c2fe7f90bb663b66568837c6fbd313d34574720abaa6bd91a783c7831e9833f1e844e85dc471568b6a090ee852adbbc2e7b12c455ca638fc6c1858fa4f589a50792d54ebd3b60d60a9bbc424e3e3e43e14929ffc4c68e253c06d0cfdc4625df9855a1070d19227af72f0baa5c2ef698bce1577e2e57f9ce46ed289db0b9b0935eb1e75fe6f771d6cba80e254496b982066bf3d2fc99f95dfe8971f536835ad01393e9a958ea105d872b5e571dfd60872201b0a577a5b20d582e6a632260ad756a6dd16cb767d42f03a61574e58158166fd508151a07898b01e46bcb582a7358103c796807a6fd963d860d571f5bf768195dfb15255bd2192adc67913236c22c6e0e4ce9033d1a48f4fcc1328b6e087eb3f64b6bbb12b9f6040000b02574ab872347d66cc0dfefceb25a7c06f00372a3df2aba8db488126397724ca704d2d3b56ffd5ec03aa9d262512c54b19e59b9684a57cb26351147215016603f3b8b165bca2ce1d6f1aada629aa9271934f2f521a2eed3454ebc527178b326a5b23de8534be73ee1405a34750ce9519357c66dd1784a15d6d7ad25f1fae43621e25f39c5d3f99e96c1d8c50237281c6b1c54f03b212b057ca75dc9962bde7b1e172c5d1a6bf3d8b189f9cb2190de70190d67abcb9b25b6d2aa1d5ae574ab1514cbda9474940af71479cc6bb789d769b6585401d309c8f129ac4af92e4c8133eb905e8ba7fcdb17c4476826781659b9de2c6664461a7292271b79d09157b7bf17cf9151b67aa4e8c4190cbd3777e190dde2d78eeaa8be5d7f8e13d38db06bd7d7456b0842a9194e3d2748b7f216be4f8626159e3b969f18fba136f4ac2c34a7145c3df456983151d7dd98c8ad89d493d0fd6dc84ab2114d8c805c84f5dbd7225903b83113a5f174af8d6324091208a1abcf8df916cf5eac94aca4eafb379279f589e16b74644d99d31238832f8cb626855f21a21a0efcf8625d50fe020807f8f8b241338990c2321295c9d8c1c53688d74d0ec519fbc372060882c8110eb87b20d3bdfb0a7c82849cc91bf3258d83d15aab845c9bdf88dcf4ae73296a40fbcc9f39b2251466f2714a13bda88159aad851e9f1e5ada8ac818f69fa757fa681bddb3fd9dbceb4ecde4a8ff0a9d3386d2ca59827a8c08c83ba03cca298bf1ce2ade80856309f26222764268ba91013bdc3f7323cd4219fa42f7399f962e1cf7d5082bce9420c49e3891c38bc7ee8a9ee67338265bca84ce39d0dea978fccae8a84b844a8f4ec91887d0d6c702b364f58dd125d755b113e607e29389fc7bc7b5eb0a57da34368142e1fe73d7f073b278b43174e424ab6cc2f74cee45959d446ecf66210757c6c47efd3e90d38b299ab30212deba762d677630881cfe73b5075ebdc3b15366210013aa5b2613df8d5fb5f4bd3e6418f745491595c49ef0ced0ac4a4b4bae44a30947d1e9ecd747560935c66e9f32aed46406c6f18a8dc53d35fd4c8f07d470b51a0805e0a89351c055d179acb43eaa576f46abe8867e9d51d7f4e82f8802d9b3cca839734cf385921968598053d0a293967184bd4af20baf59146a95355bee3d0fdb76977dcbf71793b885c7ce8202f5c7fdc0ba595094dd6a0690536c5d41b364c34a8b619a8ce07ae3e686790d3929dabef080b213ffddba1262f237d65b8052a8d9ea572ef92dd7bcbe4d7bb1cded9082d2ac01d312c3370cfa0a0554398e2e71d075167ac07e3a8dabdf3cfd9c02e7e957c5346912d8e70cd8925e51cbb08c7ec1296e5f3f04d591696abc90e4d326faece51574b382f677455d4b452b5f3c1ee646b94cd1f98a4304a04d55cff582c8ddf7beecc767d688b55182a27b37d09727e05e2809e180ae8ac16fe436107141286678d51462abed9376e893ef521f9780688a45a0f63a150a82d7cddc87ac5a77845a7f9a29a1c6324d2b7621e902cd9635e9157a113a06a9793453a6b8b7d7e46d271523f18faf9649c55c4efe3495e269a953edc8543cd0f9e5e6d94a8b907377558b167eae95b2770bdc173b9bfd3542e97cb501199651e625f518757aa5900379fd5d1615bcb4da0c0fd2927bd9249627d9c19d522d702220511ebe5c5842af1e8f779b56d2d92019bc3c652b6fba3e9c472c87ce64edfe79b412df96946154a36acb06cab0abc134e0c7762608e950bd15e865fbbab8ca417fe08822336bc49c5eea265859a925a7951c947480076edb4a16521ae8ab840bf8dfd2be111f44eed1dd11303e624c14c61546241b9c5e8a48526428a0aad1eaf18b24ab353d55077b148192846056212c70d5df8e34645b91c5a36f7824c18fda5a85efc9cf10b3be52b01e8685b15da518c0b0cdb88cf078e589c2f95c4a786fb3be44d08e78d836b5c5bd3c5c58fccfaaa5f2c513b07adb1d3fd6f8261657be7fbdad20ba7034f51c0e25743b973204322850f13d1ddf7104e0ceab74736c1ef5aa804c837df6bca73ba3f280ec7f62148381a6e3a4399b7fe27f4d69423d52e607141be07c529c14d6aa316715d4c5346588608eb8739c88a2b3790e1782f2de6808f8a4fb33cfd92f72e5b4be1e7b0e0f09f2a8724f5cdd14b3f428e62343a7f47ddc553bd7fe12fd6ef38af9e5d7a96c517f3a8d942dd6a2b2a9a91edd09993c311100b1c33dcb58eb6dfdf6170640c743818bf691e9749ed4a724adabf11203aead85f3411309ac2c14c9b763fb023b2d17ba1d48cd9fd35ea957e59583b58a01e924215214eb8167667034de67c1c355d53908be893cffeac7cf3426c94746f06a497e300504cef60935519c8997728b33569395bf165604defd6feae8bcf9f0355e5432f362949064e539dfbb1d3a4062a63cd1e4850b6874ec76d348bc9024052e393f500a1e8831c4652e548e8204495ed9f907ad3e7cfc278d1afd4abf0b2873f8a5c0b2ae5f68430a1755955a312d9edcc5056d2b4cf317e51f3d396a675ca1b701b6e833f78d2442925fa8c364380af182f475e1624cf1f4adf8a74ff0b2c3ede85f24a1635e6ade0fa48fbf451a61bdc7ab93c703a4284f66079e62faaf5618457c0fccf87ddcdc42c8959683a61c513d67652494d7a8d5a043ddc04c4c6c98ef15eed011b0f56cabbad9e9a5ae37be79b489042212385b26699c6d08832a3083c30acf744b1df05097af26d534ce951005a874372adac52be70f874c4a541a51e86f34dc9a805b14f3a97db7b8c25edd187d359decaf5da98369520acedb8e6387aa3247c4cdd9367dfeaf5537c599144c8fe106ae482c239e023ba2bec993cf0505d2a2a88359915d159ba048364379bab18149d3ebbf291d001596c4ab85996c31011ddddf875723c0bb014b00eb427199677150df61958866ccdf54b45d9da7db1022c962d6c9e26e2fa07f7b478a7101e81a6165edd0ee0c88b7fa15a58d90cb06acc86246ba74069865932195752290c3c11153f01feacd1362e8e1f45f5064d4181fd18ead59a02f3f76c9f0b6c5c89179badfc27644e70afaa65ffaec350d747220085f517720dffe9479bc29f861df6698e8c9e1729b4dc45b281fb819a1d49900d24eb03e123caef6579cd7f1cbcdde248025eeda8dbb56ebea2473c899e4ac0e218dc57b56bf2743c79a179077850a0708e4a28dc4ef19aeb5f5ae291b85fa4bffd4a5cb108d7f09426f52e56b1aa1a0186e425e4715d10e9c6936dc5f41e63f1dbb6a464740884d017d6a1e77a9860a54a2d003c3e4b02f84303b5c80119945c5fdb6241a6b063e3ebd653ad6580c4a567dc414917958247821083d1f61405d7b8d4366384db646c6daaafacc17f9b4ad7183f3de7de5175a234c6d569850f563f65fb8ae215b7dea64f8c541d7211a048f8754a9a0e20364a25feb672befd498ef7705f42c256c6427a6800c0118aa6f7e56efea1b8f44bccf3829c55a5d33652b8287192ee3e0bc65872d3e36bc31d682828dfe5e790b8f36b2c6c1ed7ec3913bd0b8c423598e9a53d90cdccc06d45947e751e86f4241845b5d126ffbd027f7697c41a49a13e843c5fb469d42a0c5012bcbb5425cd7d313a447b21a37b521fb2d61fbcc0ece936d7971b411ed3e959cc74ec398520f63cb74f51450bf6e43d38b20ceb3292c75b8a88cbb4d96cfe161e99bc85fbd19dfc1fdc27b0d88f09fa3e7cae9a041b18e67f1dbb9be69353c1ca49a438bcf1251cc6046ec0be9f5d94bf4a544beefc8e5f2ac94e5c4d7f92067098eb6758d760fdb780cc3d5749083e0de61e5845a205d4aef1351c3719d55c279cd838eac263b11f1b87196b8c97ae129f26d884fbea0da21f1c8fd967bb12385064f9a7c07d5e50bc5ebf156568dc083ec32bd3dd5330c460c8b583b985e961770b7b3ced9b9897698d6714efc0f33bacf1831d6f3cc0dae43cef1c684b8e1e8dc178f78e54c07fbefad2b26438303c159dde1f1432f6ffb96138fe86c3547da07efb722eaa8b7e1321ba8bdeb50235242a582cf95d6fdd3057ca95ab667387608e5bddcc7d27b56c1984137e2cfc607a4ac55cec66c3f14d32d85af2918fdf63611ff81405de7aede3b0ba49852f776eae184040c13cf367ebe8581e44a8c1c0869296f0f5d163df925076e1dcf2e2d2d99218bcba4cd30a2d32be1bef701b4e3036edc7ea87e532c32b313df08d305dff5d134e2fd05ccfc8499907d76ec751dd0eb6d5708d4269f48614e8befb7833db470e5e9e23addc117b322606b0d47d895d39f3139d55c2163a74810313e1d1d74e3e92b3dd12ff694e789f96b8d8aaaa923b12ba09b35d809295f09f9e4747fe536736991b18f191de3e7682a15965f583c5b0cd26622b267f0febbfd611882cc0310b1850c90ee1ed7af9244a81aa42b04c5112a225af575687972bdc0b4b7bd7fd1b50ba866ad6edae20cf3eb81bcf6f92d91ea1086d6fd653ad114466ff20210be14bdc76962e0183a4a252a363a73339367d788c45acf6de3d5b7d5aceacb9255e4b7f5a2f946cbc74f7fb8b9e57d564b6b9da28fabb05c1c7162dedc9e9345105ae69a5a1cda9bf84febad7d496bc4e396bf5d4ca8f86e8f69b96b91b9ccb0a45359b5691c54105a6ef2e94639b341f6f5b55a4791a68c53a651396f3d6ce003fc8c28f8adf4e544add2aafb90ac111a244d3f99919d4db0f4ea857ff822e8e26205d28d0ec59fa5103d7ef", 0x1000}], 0x6, &(0x7f0000001480)=[@rights={{0x20, 0x1, 0x1, [0xffffffffffffffff, r0, r1, r1]}}], 0x20, 0x4000}}, {{&(0x7f00000014c0)=@file={0x1, './file0\x00'}, 0x6e, &(0x7f0000001700)=[{&(0x7f0000001540)="cca3b0b95775f6dd3aec5ff6722e5f208911ec87619f74bfd3264a6accc4726551dbd079813d8851e7510b5456faef84c4d01d5a69a66d5c17028fe4e4fa9250b56dc9f09750bae039a6d876cdbcd32d97a65ba9e30f42a245b0e3dde82a8985a38601ec73b3a7eae9705876d563b3c2cb79aa285ad216f85357f5914fe8e14956e42856885188f344b3752886edd6fc10755f5dbfb2e8a42d9f5d5740ae33bbff17987be9e13c22e199d1006ef6", 0xae}, {&(0x7f0000001600)="bb2e60d2acd984b4ab8162c72ac395eac6aef452b5108b44d80e87af161d104072a0a2c1e2b2dbb27e15fa340d3904ffb362c61c560042b84d7b0bcaf24f04b30841c5e8f3e3ce49562708697acabc75b635549c65562b3ca8b6f2256c43fb62a9b5b023a5ed9573f3c509a0056972da92c54908f435645e716d9169202ba8fe6cf4c20a5f7bffd389aa7149dabfa051eb334981e8b6591ced141810a52b9d690537d8d185cab304832783b87e09254039cb0a013a97d9cd22bc2f59bf27a5d65e0d6cc36061c8ba2829744645f68de06c8118973026c30a97", 0xd9}], 0x2, &(0x7f0000003980)=[@cred={{0x1c, 0x1, 0x2, {0xffffffffffffffff, r2, r5}}}, @rights={{0x1c, 0x1, 0x1, [r0, r1, r0]}}, @cred={{0x1c, 0x1, 0x2, {r6, r7, r9}}}, @rights={{0x18, 0x1, 0x1, [r0, r1]}}, @rights={{0x24, 0x1, 0x1, [r0, r1, r1, r0, r0]}}], 0xa0, 0x40841c0}}], 0x2, 0x8010) quotactl_fd$Q_GETQUOTA(r1, 0xffffffff80000701, r2, &(0x7f0000003ac0)) r10 = openat$audio1(0xffffffffffffff9c, &(0x7f0000003b40), 0x8000, 0x0) ioctl$SNDCTL_DSP_GETOSPACE(r10, 0x8010500c, &(0x7f0000003b80)) syz_genetlink_get_family_id$tipc(&(0x7f0000003c00), 0xffffffffffffffff) (async) r11 = syz_genetlink_get_family_id$tipc(&(0x7f0000003c00), 0xffffffffffffffff) sendmsg$TIPC_CMD_SET_NODE_ADDR(0xffffffffffffffff, &(0x7f0000003cc0)={&(0x7f0000003bc0)={0x10, 0x0, 0x0, 0x80000}, 0xc, &(0x7f0000003c80)={&(0x7f0000003c40)={0x24, r11, 0x1, 0x70bd2d, 0x25dfdbfc, {{}, {}, {0x8, 0x11, 0xe98}}, ["", "", ""]}, 0x24}, 0x1, 0x0, 0x0, 0x20040000}, 0x2) seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0xc, &(0x7f0000003d40)={0x5, &(0x7f0000003d00)=[{0x1, 0x3, 0x9, 0x4}, {0x1, 0x2, 0x9, 0x3}, {0x9c66, 0xb, 0x2d, 0x7ca}, {0xe0, 0x2, 0xbc}, {0x3, 0x3, 0xd, 0x5}]}) (async) seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0xc, &(0x7f0000003d40)={0x5, &(0x7f0000003d00)=[{0x1, 0x3, 0x9, 0x4}, {0x1, 0x2, 0x9, 0x3}, {0x9c66, 0xb, 0x2d, 0x7ca}, {0xe0, 0x2, 0xbc}, {0x3, 0x3, 0xd, 0x5}]}) r12 = openat$fuse(0xffffffffffffff9c, &(0x7f0000003d80), 0x2, 0x0) write$FUSE_ATTR(r12, &(0x7f0000003dc0)={0x78, 0x0, r8, {0x3, 0x8, 0x0, {0x0, 0x8000000000000000, 0x0, 0xfffffffffffffffd, 0xd, 0x4, 0x1ff, 0x5, 0xff, 0x2000, 0x7, r4, r3, 0x13, 0x9}}}, 0x78) (async) write$FUSE_ATTR(r12, &(0x7f0000003dc0)={0x78, 0x0, r8, {0x3, 0x8, 0x0, {0x0, 0x8000000000000000, 0x0, 0xfffffffffffffffd, 0xd, 0x4, 0x1ff, 0x5, 0xff, 0x2000, 0x7, r4, r3, 0x13, 0x9}}}, 0x78) socket$igmp(0x2, 0x3, 0x2) (async) r13 = socket$igmp(0x2, 0x3, 0x2) ioctl$SIOCGETSGCNT_IN6(r13, 0x89e1, &(0x7f0000003e40)={@private0={0xfc, 0x0, '\x00', 0x1}, @mcast1}) (async) ioctl$SIOCGETSGCNT_IN6(r13, 0x89e1, &(0x7f0000003e40)={@private0={0xfc, 0x0, '\x00', 0x1}, @mcast1}) r14 = socket$pppoe(0x18, 0x1, 0x0) ioctl$PPPOEIOCDFWD(r14, 0xb101, 0x0) syz_open_dev$midi(&(0x7f0000003e80), 0x9, 0x10800) (async) r15 = syz_open_dev$midi(&(0x7f0000003e80), 0x9, 0x10800) ppoll(&(0x7f0000003ec0)=[{r15, 0x202}, {r12, 0x200}], 0x2, &(0x7f0000003f00)={0x0, 0x989680}, &(0x7f0000003f40)={[0x5]}, 0x8) syz_open_dev$vbi(&(0x7f0000003f80), 0x1, 0x2) (async) r16 = syz_open_dev$vbi(&(0x7f0000003f80), 0x1, 0x2) ioctl$BTRFS_IOC_SUBVOL_SYNC_WAIT(r16, 0x40109441, &(0x7f0000003fc0)={0x80, 0x1, 0x7ff}) r17 = openat$ttynull(0xffffffffffffff9c, &(0x7f0000004000), 0x0, 0x0) ioctl$KDSKBMODE(r17, 0x4b45, &(0x7f0000004040)=0xf3c) (async) ioctl$KDSKBMODE(r17, 0x4b45, &(0x7f0000004040)=0xf3c) ioctl$NILFS_IOCTL_CLEAN_SEGMENTS(r16, 0x40786e88, &(0x7f0000004300)={{&(0x7f0000004080)=[{0x1, 0x1, 0x6, {0x6, 0x5}, 0xb766, 0x8, 0x7}], 0x1, 0x40, 0x5, 0xe7a1}, {&(0x7f00000040c0)=[{0x9, 0x8000000000000000}, {0x4, 0x6}, {0x7fffffff, 0xf0e3}, {0x4, 0x5800000000000}, {0x5, 0x3}, {0x6, 0x9}, {0x7fffffff, 0x2}, {0x5, 0x35d5}, {0x81, 0x158}, {0x7fffffff, 0x8}], 0xa, 0x10, 0xe, 0x49b9}, {&(0x7f0000004180)=[0xf, 0x80, 0x0, 0x81, 0x0, 0x4, 0x16, 0x5, 0x7], 0x9, 0x8, 0x6, 0x1}, {&(0x7f0000004200)=[{0xe26, 0x4, 0x6, 0x5, 0x7}, {0x5, 0x8001, 0x3, 0x2, 0x3}, {0xea73, 0x1, 0x6, 0xda2, 0x8c4}, {0x3, 0x5, 0x3, 0x1, 0x8}], 0x4, 0x28, 0xc, 0xe2}, {&(0x7f00000042c0)=[0x4, 0x2, 0x663e, 0xff23, 0x1, 0xffffffffffffffff, 0xffff], 0x7, 0x8, 0x9, 0x2}}) sendmsg$TIPC_CMD_GET_NETID(0xffffffffffffffff, &(0x7f0000004480)={&(0x7f0000004380)={0x10, 0x0, 0x0, 0x1000}, 0xc, &(0x7f0000004440)={&(0x7f0000004400)={0x1c, 0x0, 0x300, 0x70bd29, 0x25dfdbfb, {}, [""]}, 0x1c}, 0x1, 0x0, 0x0, 0x20040050}, 0x440c0) executing program 34: socket$nl_route(0x10, 0x3, 0x0) (async) r0 = socket$nl_route(0x10, 0x3, 0x0) r1 = openat$audio(0xffffffffffffff9c, &(0x7f0000000000), 0x10002, 0x0) ioctl$SNDCTL_DSP_GETISPACE(r1, 0x8010500d, &(0x7f0000000040)) ioctl$KVM_CAP_HYPERV_VP_INDEX(0xffffffffffffffff, 0x4068aea3, &(0x7f0000000080)) stat(&(0x7f0000001740)='./file0\x00', &(0x7f0000001780)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) getsockopt$sock_cred(r0, 0x1, 0x11, &(0x7f0000001800)={0x0, 0x0, 0x0}, &(0x7f0000001840)=0xc) ioctl$SECCOMP_IOCTL_NOTIF_RECV(0xffffffffffffffff, 0xc0502100, &(0x7f0000001880)={0x0, 0x0}) ioctl$DRM_IOCTL_GET_CLIENT(0xffffffffffffffff, 0xc0286405, &(0x7f0000001900)={0x8, 0x10, {0xffffffffffffffff}, {0xee01}, 0x4, 0x80000001}) (async) ioctl$DRM_IOCTL_GET_CLIENT(0xffffffffffffffff, 0xc0286405, &(0x7f0000001900)={0x8, 0x10, {0xffffffffffffffff}, {0xee01}, 0x4, 0x80000001}) read$FUSE(0xffffffffffffffff, &(0x7f0000001940)={0x2020, 0x0, 0x0, 0x0, 0x0}, 0x2020) sendmmsg$unix(0xffffffffffffffff, &(0x7f0000003a40)=[{{&(0x7f0000000100)=@file={0x0, './file0\x00'}, 0x6e, &(0x7f0000001400)=[{&(0x7f0000000180)="3a9de706c6b2502c2dfa7fdf503181cc4118349d16e941f1243859b21de6b64465c92047e9e5395f016cc1e801779cacb3ff4e267f763d5a83e3bf1906d65bc44ddd5cc65c5d7b4ce42375380f16fdc76183fac0d96b30aaebcf7dab9c5e0b5ad4e554", 0x63}, {&(0x7f0000000200)="5c2353c0cc61fc022b09535713b22b87a34d5cb3d34b2629cf361714d48666f183e5c4a3a7a91a96d7d1", 0x2a}, {&(0x7f0000000240)="374cb43ff74840450baac4fee32db7009d732f8f3786066b35127ddb3e590c61a4b9b3215617ac9d40", 0x29}, {&(0x7f0000000280)="85e300c44aedb8f8b84174ff610be37d5e1dd632676d8c383ef9a5d2e75f6d0ff8ff3f89d552c27e1c609e34891f09c1b7577551555573f8c3b29b9b2ef7a5ad2dd45642f26e7732e1c230de3140d463dd70788df23cc31aa05d4df5354f1bd9975c298ea37aed90f54505091651ccb4022afcb4be577ee13d5675033247e698184c5b65811664f6228e67fb7fbe077e4ab93385f6d2cb21152e7f8fe6d85042a9d2657c6359a60870aa3a38005c3ac0d513fd79f306a4c80b10a01e296f898b2f5ea3ceb97d5193328e90d3dc741e5f98f740a263ea4547eb3f8bcf8f53", 0xde}, {&(0x7f0000000380)="594ce80edb1b9729bf2c80283f3cd80c91239e4a10fdf6a5494dfec12a7450ef9b86237618a93d540c6e36895c2772ad5756154c1f7ea6176e0a064e1492c2a49df73370d897c97cd597628cf34f7537db8d95ab9a5b731fb238ced33c3339f1a33acc", 0x63}, {&(0x7f0000000400)="a814711f2748f2511de3bddb80ca8d886d3445e912413ce9e367328ba3b8703005b0222bbb108b280c24288edb3b5667eaeec74d40a6f6fe57cdf1fddb424ae92c9da201b8ed148df4db00d83785fcfbb46a54fc431aa1a66ab8e8a0394ca922f74f10ad5ee0185a1c83c10703934d9a982ca804ed55e6137e259f344562d83f04c977d1881fa00c363e2eacca4e2fbbab17164da9dab2cfe2ad765307fec165922b0fb5c3dfa5503851e6530cc17a0cc583f93dd71c874b97acf2e614d4746d21496515aefbc3567da446ae394ffdbbf69a07e0b95db22b5d8ac12bdc7c3ea3646aba16b321e5eb64ef78c72e7f24188e12bd1aa20c51f232a2efdb2b08da2a92f9261e6de050187292fe04df85ce5650c0c00e5fb9e4d1d700e381266e828541afa9454a1e25ba48003d65f31045a86fff56f5121b7e9a210c63b1632efdd5844b8cfcd660b0b7b5af43425231b543acde383e2faf93c2bac93243cba6fc2fdd779a332d84ee0484db317693760fc3c3559c06e3adfbf1f279ad50aa7d80dd90dd32b21a3e219a15a92153f39de1b97d5a3f7b04d0063924829a942ee0b226dd397f11cc67e1301a9ce0fb4adacae37bc0aa9e9b9c2fe7f90bb663b66568837c6fbd313d34574720abaa6bd91a783c7831e9833f1e844e85dc471568b6a090ee852adbbc2e7b12c455ca638fc6c1858fa4f589a50792d54ebd3b60d60a9bbc424e3e3e43e14929ffc4c68e253c06d0cfdc4625df9855a1070d19227af72f0baa5c2ef698bce1577e2e57f9ce46ed289db0b9b0935eb1e75fe6f771d6cba80e254496b982066bf3d2fc99f95dfe8971f536835ad01393e9a958ea105d872b5e571dfd60872201b0a577a5b20d582e6a632260ad756a6dd16cb767d42f03a61574e58158166fd508151a07898b01e46bcb582a7358103c796807a6fd963d860d571f5bf768195dfb15255bd2192adc67913236c22c6e0e4ce9033d1a48f4fcc1328b6e087eb3f64b6bbb12b9f6040000b02574ab872347d66cc0dfefceb25a7c06f00372a3df2aba8db488126397724ca704d2d3b56ffd5ec03aa9d262512c54b19e59b9684a57cb26351147215016603f3b8b165bca2ce1d6f1aada629aa9271934f2f521a2eed3454ebc527178b326a5b23de8534be73ee1405a34750ce9519357c66dd1784a15d6d7ad25f1fae43621e25f39c5d3f99e96c1d8c50237281c6b1c54f03b212b057ca75dc9962bde7b1e172c5d1a6bf3d8b189f9cb2190de70190d67abcb9b25b6d2aa1d5ae574ab1514cbda9474940af71479cc6bb789d769b6585401d309c8f129ac4af92e4c8133eb905e8ba7fcdb17c4476826781659b9de2c6664461a7292271b79d09157b7bf17cf9151b67aa4e8c4190cbd3777e190dde2d78eeaa8be5d7f8e13d38db06bd7d7456b0842a9194e3d2748b7f216be4f8626159e3b969f18fba136f4ac2c34a7145c3df456983151d7dd98c8ad89d493d0fd6dc84ab2114d8c805c84f5dbd7225903b83113a5f174af8d6324091208a1abcf8df916cf5eac94aca4eafb379279f589e16b74644d99d31238832f8cb626855f21a21a0efcf8625d50fe020807f8f8b241338990c2321295c9d8c1c53688d74d0ec519fbc372060882c8110eb87b20d3bdfb0a7c82849cc91bf3258d83d15aab845c9bdf88dcf4ae73296a40fbcc9f39b2251466f2714a13bda88159aad851e9f1e5ada8ac818f69fa757fa681bddb3fd9dbceb4ecde4a8ff0a9d3386d2ca59827a8c08c83ba03cca298bf1ce2ade80856309f26222764268ba91013bdc3f7323cd4219fa42f7399f962e1cf7d5082bce9420c49e3891c38bc7ee8a9ee67338265bca84ce39d0dea978fccae8a84b844a8f4ec91887d0d6c702b364f58dd125d755b113e607e29389fc7bc7b5eb0a57da34368142e1fe73d7f073b278b43174e424ab6cc2f74cee45959d446ecf66210757c6c47efd3e90d38b299ab30212deba762d677630881cfe73b5075ebdc3b15366210013aa5b2613df8d5fb5f4bd3e6418f745491595c49ef0ced0ac4a4b4bae44a30947d1e9ecd747560935c66e9f32aed46406c6f18a8dc53d35fd4c8f07d470b51a0805e0a89351c055d179acb43eaa576f46abe8867e9d51d7f4e82f8802d9b3cca839734cf385921968598053d0a293967184bd4af20baf59146a95355bee3d0fdb76977dcbf71793b885c7ce8202f5c7fdc0ba595094dd6a0690536c5d41b364c34a8b619a8ce07ae3e686790d3929dabef080b213ffddba1262f237d65b8052a8d9ea572ef92dd7bcbe4d7bb1cded9082d2ac01d312c3370cfa0a0554398e2e71d075167ac07e3a8dabdf3cfd9c02e7e957c5346912d8e70cd8925e51cbb08c7ec1296e5f3f04d591696abc90e4d326faece51574b382f677455d4b452b5f3c1ee646b94cd1f98a4304a04d55cff582c8ddf7beecc767d688b55182a27b37d09727e05e2809e180ae8ac16fe436107141286678d51462abed9376e893ef521f9780688a45a0f63a150a82d7cddc87ac5a77845a7f9a29a1c6324d2b7621e902cd9635e9157a113a06a9793453a6b8b7d7e46d271523f18faf9649c55c4efe3495e269a953edc8543cd0f9e5e6d94a8b907377558b167eae95b2770bdc173b9bfd3542e97cb501199651e625f518757aa5900379fd5d1615bcb4da0c0fd2927bd9249627d9c19d522d702220511ebe5c5842af1e8f779b56d2d92019bc3c652b6fba3e9c472c87ce64edfe79b412df96946154a36acb06cab0abc134e0c7762608e950bd15e865fbbab8ca417fe08822336bc49c5eea265859a925a7951c947480076edb4a16521ae8ab840bf8dfd2be111f44eed1dd11303e624c14c61546241b9c5e8a48526428a0aad1eaf18b24ab353d55077b148192846056212c70d5df8e34645b91c5a36f7824c18fda5a85efc9cf10b3be52b01e8685b15da518c0b0cdb88cf078e589c2f95c4a786fb3be44d08e78d836b5c5bd3c5c58fccfaaa5f2c513b07adb1d3fd6f8261657be7fbdad20ba7034f51c0e25743b973204322850f13d1ddf7104e0ceab74736c1ef5aa804c837df6bca73ba3f280ec7f62148381a6e3a4399b7fe27f4d69423d52e607141be07c529c14d6aa316715d4c5346588608eb8739c88a2b3790e1782f2de6808f8a4fb33cfd92f72e5b4be1e7b0e0f09f2a8724f5cdd14b3f428e62343a7f47ddc553bd7fe12fd6ef38af9e5d7a96c517f3a8d942dd6a2b2a9a91edd09993c311100b1c33dcb58eb6dfdf6170640c743818bf691e9749ed4a724adabf11203aead85f3411309ac2c14c9b763fb023b2d17ba1d48cd9fd35ea957e59583b58a01e924215214eb8167667034de67c1c355d53908be893cffeac7cf3426c94746f06a497e300504cef60935519c8997728b33569395bf165604defd6feae8bcf9f0355e5432f362949064e539dfbb1d3a4062a63cd1e4850b6874ec76d348bc9024052e393f500a1e8831c4652e548e8204495ed9f907ad3e7cfc278d1afd4abf0b2873f8a5c0b2ae5f68430a1755955a312d9edcc5056d2b4cf317e51f3d396a675ca1b701b6e833f78d2442925fa8c364380af182f475e1624cf1f4adf8a74ff0b2c3ede85f24a1635e6ade0fa48fbf451a61bdc7ab93c703a4284f66079e62faaf5618457c0fccf87ddcdc42c8959683a61c513d67652494d7a8d5a043ddc04c4c6c98ef15eed011b0f56cabbad9e9a5ae37be79b489042212385b26699c6d08832a3083c30acf744b1df05097af26d534ce951005a874372adac52be70f874c4a541a51e86f34dc9a805b14f3a97db7b8c25edd187d359decaf5da98369520acedb8e6387aa3247c4cdd9367dfeaf5537c599144c8fe106ae482c239e023ba2bec993cf0505d2a2a88359915d159ba048364379bab18149d3ebbf291d001596c4ab85996c31011ddddf875723c0bb014b00eb427199677150df61958866ccdf54b45d9da7db1022c962d6c9e26e2fa07f7b478a7101e81a6165edd0ee0c88b7fa15a58d90cb06acc86246ba74069865932195752290c3c11153f01feacd1362e8e1f45f5064d4181fd18ead59a02f3f76c9f0b6c5c89179badfc27644e70afaa65ffaec350d747220085f517720dffe9479bc29f861df6698e8c9e1729b4dc45b281fb819a1d49900d24eb03e123caef6579cd7f1cbcdde248025eeda8dbb56ebea2473c899e4ac0e218dc57b56bf2743c79a179077850a0708e4a28dc4ef19aeb5f5ae291b85fa4bffd4a5cb108d7f09426f52e56b1aa1a0186e425e4715d10e9c6936dc5f41e63f1dbb6a464740884d017d6a1e77a9860a54a2d003c3e4b02f84303b5c80119945c5fdb6241a6b063e3ebd653ad6580c4a567dc414917958247821083d1f61405d7b8d4366384db646c6daaafacc17f9b4ad7183f3de7de5175a234c6d569850f563f65fb8ae215b7dea64f8c541d7211a048f8754a9a0e20364a25feb672befd498ef7705f42c256c6427a6800c0118aa6f7e56efea1b8f44bccf3829c55a5d33652b8287192ee3e0bc65872d3e36bc31d682828dfe5e790b8f36b2c6c1ed7ec3913bd0b8c423598e9a53d90cdccc06d45947e751e86f4241845b5d126ffbd027f7697c41a49a13e843c5fb469d42a0c5012bcbb5425cd7d313a447b21a37b521fb2d61fbcc0ece936d7971b411ed3e959cc74ec398520f63cb74f51450bf6e43d38b20ceb3292c75b8a88cbb4d96cfe161e99bc85fbd19dfc1fdc27b0d88f09fa3e7cae9a041b18e67f1dbb9be69353c1ca49a438bcf1251cc6046ec0be9f5d94bf4a544beefc8e5f2ac94e5c4d7f92067098eb6758d760fdb780cc3d5749083e0de61e5845a205d4aef1351c3719d55c279cd838eac263b11f1b87196b8c97ae129f26d884fbea0da21f1c8fd967bb12385064f9a7c07d5e50bc5ebf156568dc083ec32bd3dd5330c460c8b583b985e961770b7b3ced9b9897698d6714efc0f33bacf1831d6f3cc0dae43cef1c684b8e1e8dc178f78e54c07fbefad2b26438303c159dde1f1432f6ffb96138fe86c3547da07efb722eaa8b7e1321ba8bdeb50235242a582cf95d6fdd3057ca95ab667387608e5bddcc7d27b56c1984137e2cfc607a4ac55cec66c3f14d32d85af2918fdf63611ff81405de7aede3b0ba49852f776eae184040c13cf367ebe8581e44a8c1c0869296f0f5d163df925076e1dcf2e2d2d99218bcba4cd30a2d32be1bef701b4e3036edc7ea87e532c32b313df08d305dff5d134e2fd05ccfc8499907d76ec751dd0eb6d5708d4269f48614e8befb7833db470e5e9e23addc117b322606b0d47d895d39f3139d55c2163a74810313e1d1d74e3e92b3dd12ff694e789f96b8d8aaaa923b12ba09b35d809295f09f9e4747fe536736991b18f191de3e7682a15965f583c5b0cd26622b267f0febbfd611882cc0310b1850c90ee1ed7af9244a81aa42b04c5112a225af575687972bdc0b4b7bd7fd1b50ba866ad6edae20cf3eb81bcf6f92d91ea1086d6fd653ad114466ff20210be14bdc76962e0183a4a252a363a73339367d788c45acf6de3d5b7d5aceacb9255e4b7f5a2f946cbc74f7fb8b9e57d564b6b9da28fabb05c1c7162dedc9e9345105ae69a5a1cda9bf84febad7d496bc4e396bf5d4ca8f86e8f69b96b91b9ccb0a45359b5691c54105a6ef2e94639b341f6f5b55a4791a68c53a651396f3d6ce003fc8c28f8adf4e544add2aafb90ac111a244d3f99919d4db0f4ea857ff822e8e26205d28d0ec59fa5103d7ef", 0x1000}], 0x6, &(0x7f0000001480)=[@rights={{0x20, 0x1, 0x1, [0xffffffffffffffff, r0, r1, r1]}}], 0x20, 0x4000}}, {{&(0x7f00000014c0)=@file={0x1, './file0\x00'}, 0x6e, &(0x7f0000001700)=[{&(0x7f0000001540)="cca3b0b95775f6dd3aec5ff6722e5f208911ec87619f74bfd3264a6accc4726551dbd079813d8851e7510b5456faef84c4d01d5a69a66d5c17028fe4e4fa9250b56dc9f09750bae039a6d876cdbcd32d97a65ba9e30f42a245b0e3dde82a8985a38601ec73b3a7eae9705876d563b3c2cb79aa285ad216f85357f5914fe8e14956e42856885188f344b3752886edd6fc10755f5dbfb2e8a42d9f5d5740ae33bbff17987be9e13c22e199d1006ef6", 0xae}, {&(0x7f0000001600)="bb2e60d2acd984b4ab8162c72ac395eac6aef452b5108b44d80e87af161d104072a0a2c1e2b2dbb27e15fa340d3904ffb362c61c560042b84d7b0bcaf24f04b30841c5e8f3e3ce49562708697acabc75b635549c65562b3ca8b6f2256c43fb62a9b5b023a5ed9573f3c509a0056972da92c54908f435645e716d9169202ba8fe6cf4c20a5f7bffd389aa7149dabfa051eb334981e8b6591ced141810a52b9d690537d8d185cab304832783b87e09254039cb0a013a97d9cd22bc2f59bf27a5d65e0d6cc36061c8ba2829744645f68de06c8118973026c30a97", 0xd9}], 0x2, &(0x7f0000003980)=[@cred={{0x1c, 0x1, 0x2, {0xffffffffffffffff, r2, r5}}}, @rights={{0x1c, 0x1, 0x1, [r0, r1, r0]}}, @cred={{0x1c, 0x1, 0x2, {r6, r7, r9}}}, @rights={{0x18, 0x1, 0x1, [r0, r1]}}, @rights={{0x24, 0x1, 0x1, [r0, r1, r1, r0, r0]}}], 0xa0, 0x40841c0}}], 0x2, 0x8010) quotactl_fd$Q_GETQUOTA(r1, 0xffffffff80000701, r2, &(0x7f0000003ac0)) r10 = openat$audio1(0xffffffffffffff9c, &(0x7f0000003b40), 0x8000, 0x0) ioctl$SNDCTL_DSP_GETOSPACE(r10, 0x8010500c, &(0x7f0000003b80)) syz_genetlink_get_family_id$tipc(&(0x7f0000003c00), 0xffffffffffffffff) (async) r11 = syz_genetlink_get_family_id$tipc(&(0x7f0000003c00), 0xffffffffffffffff) sendmsg$TIPC_CMD_SET_NODE_ADDR(0xffffffffffffffff, &(0x7f0000003cc0)={&(0x7f0000003bc0)={0x10, 0x0, 0x0, 0x80000}, 0xc, &(0x7f0000003c80)={&(0x7f0000003c40)={0x24, r11, 0x1, 0x70bd2d, 0x25dfdbfc, {{}, {}, {0x8, 0x11, 0xe98}}, ["", "", ""]}, 0x24}, 0x1, 0x0, 0x0, 0x20040000}, 0x2) seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0xc, &(0x7f0000003d40)={0x5, &(0x7f0000003d00)=[{0x1, 0x3, 0x9, 0x4}, {0x1, 0x2, 0x9, 0x3}, {0x9c66, 0xb, 0x2d, 0x7ca}, {0xe0, 0x2, 0xbc}, {0x3, 0x3, 0xd, 0x5}]}) (async) seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0xc, &(0x7f0000003d40)={0x5, &(0x7f0000003d00)=[{0x1, 0x3, 0x9, 0x4}, {0x1, 0x2, 0x9, 0x3}, {0x9c66, 0xb, 0x2d, 0x7ca}, {0xe0, 0x2, 0xbc}, {0x3, 0x3, 0xd, 0x5}]}) r12 = openat$fuse(0xffffffffffffff9c, &(0x7f0000003d80), 0x2, 0x0) write$FUSE_ATTR(r12, &(0x7f0000003dc0)={0x78, 0x0, r8, {0x3, 0x8, 0x0, {0x0, 0x8000000000000000, 0x0, 0xfffffffffffffffd, 0xd, 0x4, 0x1ff, 0x5, 0xff, 0x2000, 0x7, r4, r3, 0x13, 0x9}}}, 0x78) (async) write$FUSE_ATTR(r12, &(0x7f0000003dc0)={0x78, 0x0, r8, {0x3, 0x8, 0x0, {0x0, 0x8000000000000000, 0x0, 0xfffffffffffffffd, 0xd, 0x4, 0x1ff, 0x5, 0xff, 0x2000, 0x7, r4, r3, 0x13, 0x9}}}, 0x78) socket$igmp(0x2, 0x3, 0x2) (async) r13 = socket$igmp(0x2, 0x3, 0x2) ioctl$SIOCGETSGCNT_IN6(r13, 0x89e1, &(0x7f0000003e40)={@private0={0xfc, 0x0, '\x00', 0x1}, @mcast1}) (async) ioctl$SIOCGETSGCNT_IN6(r13, 0x89e1, &(0x7f0000003e40)={@private0={0xfc, 0x0, '\x00', 0x1}, @mcast1}) r14 = socket$pppoe(0x18, 0x1, 0x0) ioctl$PPPOEIOCDFWD(r14, 0xb101, 0x0) syz_open_dev$midi(&(0x7f0000003e80), 0x9, 0x10800) (async) r15 = syz_open_dev$midi(&(0x7f0000003e80), 0x9, 0x10800) ppoll(&(0x7f0000003ec0)=[{r15, 0x202}, {r12, 0x200}], 0x2, &(0x7f0000003f00)={0x0, 0x989680}, &(0x7f0000003f40)={[0x5]}, 0x8) syz_open_dev$vbi(&(0x7f0000003f80), 0x1, 0x2) (async) r16 = syz_open_dev$vbi(&(0x7f0000003f80), 0x1, 0x2) ioctl$BTRFS_IOC_SUBVOL_SYNC_WAIT(r16, 0x40109441, &(0x7f0000003fc0)={0x80, 0x1, 0x7ff}) r17 = openat$ttynull(0xffffffffffffff9c, &(0x7f0000004000), 0x0, 0x0) ioctl$KDSKBMODE(r17, 0x4b45, &(0x7f0000004040)=0xf3c) (async) ioctl$KDSKBMODE(r17, 0x4b45, &(0x7f0000004040)=0xf3c) ioctl$NILFS_IOCTL_CLEAN_SEGMENTS(r16, 0x40786e88, &(0x7f0000004300)={{&(0x7f0000004080)=[{0x1, 0x1, 0x6, {0x6, 0x5}, 0xb766, 0x8, 0x7}], 0x1, 0x40, 0x5, 0xe7a1}, {&(0x7f00000040c0)=[{0x9, 0x8000000000000000}, {0x4, 0x6}, {0x7fffffff, 0xf0e3}, {0x4, 0x5800000000000}, {0x5, 0x3}, {0x6, 0x9}, {0x7fffffff, 0x2}, {0x5, 0x35d5}, {0x81, 0x158}, {0x7fffffff, 0x8}], 0xa, 0x10, 0xe, 0x49b9}, {&(0x7f0000004180)=[0xf, 0x80, 0x0, 0x81, 0x0, 0x4, 0x16, 0x5, 0x7], 0x9, 0x8, 0x6, 0x1}, {&(0x7f0000004200)=[{0xe26, 0x4, 0x6, 0x5, 0x7}, {0x5, 0x8001, 0x3, 0x2, 0x3}, {0xea73, 0x1, 0x6, 0xda2, 0x8c4}, {0x3, 0x5, 0x3, 0x1, 0x8}], 0x4, 0x28, 0xc, 0xe2}, {&(0x7f00000042c0)=[0x4, 0x2, 0x663e, 0xff23, 0x1, 0xffffffffffffffff, 0xffff], 0x7, 0x8, 0x9, 0x2}}) sendmsg$TIPC_CMD_GET_NETID(0xffffffffffffffff, &(0x7f0000004480)={&(0x7f0000004380)={0x10, 0x0, 0x0, 0x1000}, 0xc, &(0x7f0000004440)={&(0x7f0000004400)={0x1c, 0x0, 0x300, 0x70bd29, 0x25dfdbfb, {}, [""]}, 0x1c}, 0x1, 0x0, 0x0, 0x20040050}, 0x440c0) executing program 5: r0 = openat$snapshot(0xffffffffffffff9c, &(0x7f0000000000), 0x1, 0x0) r1 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000240)={0x11, 0x3, &(0x7f0000000680)=ANY=[@ANYBLOB="1800000000000000000000000000000095000000000000002815c180535a968d12134e46a3dae86a81de0f844b7eb2d9321a86340276b944ce530f2d50c95069fdfa8457ccd291"], &(0x7f00000001c0)='GPL\x00'}, 0x80) socket$nl_generic(0x10, 0x3, 0x10) bpf$BPF_GET_PROG_INFO(0xf, &(0x7f0000000580)={r1, 0xe0, &(0x7f0000000480)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, ""/16, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x88, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8, 0x0, 0x0}}, 0x10) bpf$MAP_CREATE(0x0, &(0x7f0000000700)=ANY=[@ANYBLOB="190000000400000004000000bc4c8c5300000000", @ANYRES32, @ANYBLOB="0000000000000000000000000000000000000000f49af77cb626fe4585e1241c1f40b5bf38f9a73d984bca4ab1131fae1fe0dfafb2fc19486462c08510d28033607882c0e2453c8ba4e4f4f3061238e1b086d6241720f399c6530abbfcf782c34438f46f80a316bf9bf1d7988133eedf18079fa2cb4e8da044147eb351ddbb9604d9a0bf3a70d72b3766487a3e143c479c653dc94de756d608ed473a64d35304f1204e110fbe2afc9448e2783f84c1c7b42304a5fc342a746f0ed0732c34c9d2d4ac2de00408dc462ddd2dcd41685d6cf55af2ae8f002dddf13fbe2b943822c009a5ca6d06b22d52e7c97c05074f12aa1a1431b7e3a384af38e52b03fe5ca88095ab2c6733d5b4e8954d6415d9a6ccd980ac87b37f18b632cee80c02bccd58bf347fb7ccd717c9aaace450711f3fa78b9b05ee62d0a3", @ANYRES32=0x0, @ANYRES32, @ANYBLOB='\x00'/28], 0x48) r3 = socket$nl_generic(0x10, 0x3, 0x10) r4 = syz_genetlink_get_family_id$fou(&(0x7f0000000b80), 0xffffffffffffffff) sendmsg$FOU_CMD_ADD(r3, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000640)={&(0x7f0000000340)={0x24, r4, 0x1, 0x70bd28, 0x25dfdbfc, {}, [@FOU_ATTR_PEER_V4={0x8, 0x8, @empty}, @FOU_ATTR_PEER_PORT={0x6, 0xa, 0x4e25}]}, 0x24}, 0x1, 0x0, 0x0, 0x60044831}, 0x40080) r5 = bpf$BPF_PROG_GET_FD_BY_ID(0xd, &(0x7f00000000c0)={r2}, 0x4) r6 = openat$mixer(0xffffffffffffff9c, &(0x7f0000000700), 0x101180, 0x0) r7 = socket$nl_rdma(0x10, 0x3, 0x14) pipe(&(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}) pipe(&(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) splice(r7, 0x0, r10, 0x0, 0x400000008000f28, 0x0) splice(r9, 0x0, r8, 0x0, 0x110, 0xe) sendmsg$RDMA_NLDEV_CMD_NEWLINK(r7, &(0x7f0000000340)={0x0, 0x0, &(0x7f0000000080)={&(0x7f00000003c0)=ANY=[@ANYBLOB="00010000031401"], 0x100}, 0x1, 0x0, 0x0, 0x4040030}, 0x0) ioctl$SOUND_MIXER_WRITE_VOLUME(r6, 0xc0040d07, &(0x7f0000000040)=0x121) bpf$BPF_GET_PROG_INFO(0xf, &(0x7f0000001440)={r5, 0x77, &(0x7f0000000440)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2d, 0x0, ""/16, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x0, 0x7, 0x0, 0x0, 0x0, 0xaa, 0x8, 0x0, 0x0}}, 0x10) bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x3, 0x3, &(0x7f0000000040)=ANY=[], &(0x7f0000000200)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', r11, @sched_cls=0x37, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) r12 = syz_open_dev$sg(&(0x7f0000001600), 0x0, 0x40042) write$binfmt_aout(r12, &(0x7f0000000480)=ANY=[@ANYBLOB="0000000000000000000000800080000014000091ff0f00004500f5ff06ff00010100fc5e15f4c3d3fbd80dad00000a"], 0x125) bpf$PROG_LOAD(0x5, &(0x7f00000017c0)={0x1, 0xe, &(0x7f0000001880)=ANY=[@ANYBLOB="b70000000100000bbfa30000000000000703000000feffff720af0fff8ffffff71a4f0ff00000000ae04020000000000be400300000000006504030001ed00007b130000000000004d44000000000000630a04fe0000000071330000000000009f030000000000009500000000000000023bc065b7a379d17cf9333379fc05000000912435f1a864a710aad58db6a693002e7f3be361917adef6ee1c8a2a4f8ef1e50bec919bc461e91a7168c5181554d1b583c587e436fe275daf51efd601b6bf01c8e8b1b526375ec5dd6fcd82e4fee5bef7af9a0200000000000000e3ff3128e599b0eaebbdbd732c9cc00eec363e4a8f645679c294392cf538b07ce2646cb7798b3e6440c2fbdb00a3e35208b0bb1d2cd871c5548930be3835f2554b4a28610643a98d9ec21ead2ed51b104d4d91af25b84550a7925c3109b151b8b9f75d80000000eda88c658d42ecbf28bf7076c15b463bebc72f526d8e4a9e231d512381e7a78afcb913466aae7f6df70252e79166d858fc152b659da074e1320060d0b11008e59a5923906f88b53987ad1714e72ba7a5b74f0c33d39000d06a59ff61622cfd9aa58fe8d485ae2c0cc65c2a36aaec2477584b6a89adaf17b0a6041bde4cc3ed54d27f777e92b87496e6649cf728d236619074d6ebdf098bc908c423d228a40f9411fe7226a40409d6e37c4f46756d31cb46761bade70063e5291569b33d21dae356e1c51f03fb8a63e089679216da18de0ae564162a27afea62d84f3a10746443d64364f56e24e6d21053d901204a1deeed41556175cbd4041b7d301bcb72652d950ad31928b0b093778b68e2e9853c02d0f5ad94b081fcd507acb4b9c65fee9d5a17f48a7382f98928d5e9b94ff9ae49cee383dc5049076b98fb6853ab39a21514da60d2ae20cfb91d6a49964757cff538f9ce2bdb1ab062cd54e67011d355d84ce97bb0c6b4a595bcf50ab32d710b651f898ba749e40bc6980fe78683ac5c0c31030699ddd71063b59261b2e1aab1675b34a220488c126aeef5f510a8f1aded94a129e4aec6f8c3a13596c2ea3e2e04cfdce669e51731b2875353193f82ade69d0540059fe6c7fe7c00fb7502c7596566d674e425da5e87e59602a9f6590521d31d3804b3e0a1053abd47b64a1b304502dda787343ce3c95300000000010000003baae244e7bf37548c7f1a4cad2422ee965a38f7defbd2960242b104e20dc2d9b0c35608d402ccdd9069bd50b994fda7a9de44022af46667cf25c5d3038816106dec28eaeb88343261a48a18f562ae00003ea96d10f172c0374d6eed82641687f3b3a70bfeff59d54d1f92ecc4e95dd2d18383117c03987d198899b212c55318294270a1ad10d30fef7c24b78b29d83238273f4fc87afce829ba0f85da6d888f18ea40ab959f6074ab2a4009b9e5f07ab513cdc6c0e57fb1c1ca571380d7b4ead8eaf68b0c5dda0467d35a3807000000b702396df7e0cbe02b6e4114f244a9bf93f04beb72f0861f7580e69db384ac7eeedcf2ba1a9508f9d6aba582a896a9f1ffa968eacea75caf822a7a63ba34015ea5aacb1188883ad2a3b1832371fe5bc621426d1ea1e717d29135753208165b9cdbae037f315c7d951680f6f2f9a6a8346962a350845ffa0d829e4f79adc287906943408e6df3adbfd03aac93df8866fb010aec0e92bed1fe39af169d2a466f0db6f3d9436a7d55fc30511d00000000c95265b2bd83d64a532869d7012c1b45f6ada1ee7baa5b6a686b50f09b7f778af083e055f6138a757ebd0ed91114a6b244f9acf41ac4d73a008364e0602a594817031fc2ff2c32a1989e00f52f8785fe0721719b3d654026c6ea08b83b123145ab5703dad844ceb201ddeb6dc5f6a9037d2283c42efc54fa84323a3c3e6e4fd2e016820f78b796a825b3dad9ce7b37507e0b83c3ecd01549bca6a016b3e18a00c748894dc3bfe5efda8b0a477d6a6562fdee45eb16e276dee992094ba9830f6c164179e7d532d86060bea930118d3cae1b8f916b9671b7000000000040f4bee5ad2dea2d14e195265504c05bba38b095e1679f96ddef65ba5de9c8cfb6465ae4165c0689a314a6eb6b36aa705b957edef3035e14b879d4e7dc00624708042e00bf9a7f7ae5f308744770759558e4fcb99c0dc957521ef255362bf2f3966f3754e81fb9bdef22c19f5a49147b85343f9f36bcda9f64b7a5c5b2f5452f5b1de02e6f15c5640bf89d4a74d51dc233dee628c1dfbb5566b98478c174b34eb234481547e484c6af101396b6977dd668b401391c1dc54f2edccf1cabe6be9868d383eb937efdfd9ade018106f544f04fc07ad525497f65fbad3cf145396acf3b0d38e6b46e28d86880fd6f62c373000000000000000000005d194c27cd4d8f6727f59c71dc84311c0f1fb6c87081c7be9355288610c32c2d8c18bf2027212182903687f48262aea54c5f8a315c9aa4a5af1aa2c4007d1baae38c270012b7eb9411ae451204dba30f8321b07a18db97c3e0cf6a15170e515b1cc463a67a5b2b23ec5662ccfa898b8d5075647bdfb390cde56efb8fd42df12c5c8f66bdc58449ec2b38bf12f5f0a49dcbcf4e6f11c47d23fa34793a0000a1cbb1e06e9a8d2449451d7a05ec0a0d3c9716f505ddeba488c60ebf44cac05c2739694359c925148137376dd3f1330ed0e9211f73ee279cc0b5c298422395ce438f48a39ff569375e609f9e904aacc3d8011326d5e4d654c74501cf16bbf72d3984f9b4ef000000003a8a3d49fc837001e4622e58e3a4ef6b55a8dd0680d951cdb6e54ed92a9a6a0e5e494b7b7b0ef4b4bafc5d964551b2a22bfd12b0761ef07a103e51e84917ee44f860b9785e264343f6a80e9318edecf73df6940856cd56c56eb3831445833c701044aaa49439a44a624267580b3c0980d7f87437bf498f6e1915450400000000000000564a02552c0a5fedbcf4da0db6ed03b9dbc224ee76d20aaf1ac74bcb7eb6f202209e64cc4d130dcf6ab3df8ae4911deb4bb5c7df97fc348d151e834be73915f854272f69d88123f666448b6a8e73322b04fffea9cc05e4129debf311c73b4d1a244b1e5b9943028745a0b6477686740ab877315e35624d791e6f71adb1acd3e22cf472ff7e048b16c11c84da9a3b16b92665912132a4dba680052919c20e191311d8092a09f3c609823fed1bd651ce1c34de105790ba2ca3afa26647f66efbf97b109e7226c74e32beb14ff3fd6918e255fc9b42f86b0188cf885afcc9bb77a7fc3ca7ec1015af494add960f8a11422ca005f24006867cd156e0350022943e301b2c07f4d37d07b05ac2fa1f1d5a0d6eb7e992b076bd77509c26034d2a740d578476410b413591884136259693effaf27e7bcfb58efa92625fb9bd68ecca42047f6e7d24b0446ea16a310073c163d1c6aa3ba1fe76b4e88d5f98cc05c6d033e2c28b4990892230d6b4e5c083a601a25145eb22f4f77313117f8147810d95c64fb78b0a000000000000000000000000e92ba8b066e4bd82bb6003d5da8791d838bcd6eefb13000000000000000000000000000000b652ff6fbad82da75114742bc6a27cba894ef490531be709a3a3c81b267dfafa55e6f855200b4e7518682c30f40808cd5bb8f00beb63b4989cc01d8e75a182337b9f9e08430ccec9bda0134d07a9f54b60033182f5d2bb61fd130d65e68bf148d26470060c707a8cf750ca954ee63c78cd975c7f565783383f02edcb7ce4a9ed0c511d18fe32352276d72eefe0d566f97ccae16b3492f60b96574aac4f1862fb6e4932c181dbf8c68ca16b765de9edba0bf5bfb9c4950d19c0bc31db02f374ce62141160436639d4b6cb0033a47ffdc54d55f1136743b1b26946f200000000000000007590ab8f29c7accd9d11786c4ca1271cd2293b572f14a3dfcaa3467f2783fc09e3eee3fa4b82b7b6ce904e05fa797a2f7ff63e4f874bd870821f6460904e05d7a3f8295a9a5fba1e3587b9d9e878c86ba9b66c4491fcff607d9cbf156f3fc0fb8c827d4e6cac493a3e2746bd5f0f8bc024352200a4250785cdca4fe3c546972d0a56e3905d1e72c33d64f6591fe25f312f47e7ec6b4640f1f6dc4efee4b8d3cfbfcbf77bfd52f0a99adc7d359233cfea0a11f5dcb87603885f08d633e842644988d2f45a1824361b5df707f726fad22d53727b4396b3d05df34933262fdb09f19837fdc2af1c721b17d54076e25ab625ae0a4c9cd900"/3002], &(0x7f00000001c0)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x8, &(0x7f0000000000), 0x0, 0x10, &(0x7f0000000080), 0xfffffffffffffdbb}, 0x48) r13 = socket$nl_xfrm(0x10, 0x3, 0x6) r14 = openat(0xffffffffffffff9c, &(0x7f0000000000)='./file1\x00', 0x2040, 0x0) fcntl$getflags(r14, 0x401) clock_gettime(0x0, &(0x7f0000000880)={0x0, 0x0}) mq_timedsend(r14, &(0x7f0000000600)="53afc0576f834b3d3da0c09a9bad1b934897811508589f1b9b6009cc6a4f5d0030ba6900735377684f84acf6d32e24691d8bf92c121660f3beae191ac79d02fe465af4c10bb3c29a8452253481dfdfddea5b46665ba224156d1c1486fdf0963ebe6032a21563b7297f138e1bd1535180b7a91cac8e06826f9f26aa74847773", 0x7f, 0x6, &(0x7f00000008c0)={r15, r16+60000000}) sendmsg$nl_xfrm(r13, &(0x7f00000005c0)={0x0, 0x0, &(0x7f0000000580)={&(0x7f0000000240)=@migrate={0x27c, 0x21, 0x1, 0x0, 0x1, {{@in, @in6=@remote}}, [@migrate={0x219, 0x11, [{@in=@multicast1, @in=@local, @in=@local, @in=@broadcast, 0x3c, 0x4, 0x0, 0x3505, 0xa, 0x2}, {@in=@empty, @in=@initdev={0xac, 0x1e, 0x0, 0x0}, @in=@multicast2, @in6=@empty, 0x6c, 0x1, 0x0, 0x3506, 0x2, 0x2}, {@in=@empty, @in=@private=0xa010100, @in6=@remote, @in6=@mcast2, 0x33, 0x2, 0x0, 0x0, 0xa, 0xa}, {@in=@local, @in6=@local, @in6=@empty, @in6=@private2, 0xff, 0x3, 0x0, 0x3503, 0x8, 0x2}, {@in=@broadcast, @in6=@ipv4={'\x00', '\xff\xff', @multicast2}, @in=@private, @in=@dev, 0x0, 0x1, 0x0, 0x3506, 0x2, 0xf}, {@in6=@mcast2, @in=@broadcast, @in6=@private2, @in6=@remote}]}, @policy_type={0xa}, @replay_esn_val={0x40, 0x17, {0x9, 0x70bd29, 0x70bd2d, 0x70bd27, 0x70bd28, 0x7f, [0x0, 0x7, 0x7, 0x5, 0x80, 0x0, 0x5, 0xfffffff7, 0x6]}}, @proto={0x5, 0x19, 0x6c}, @mark={0xc, 0x15, {0x35075d, 0x3}}]}, 0x27c}}, 0x0) ioctl$SNAPSHOT_PREF_IMAGE_SIZE(r0, 0x3312, 0x80) gettid() executing program 5: r0 = socket$kcm(0x10, 0x2, 0x0) sendmsg$kcm(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000300)=[{&(0x7f0000000040)="2e00000010008108040f80ecdb4cb92e0a480e000f000000e8bd6efb250314000e000100240248ff050005001200", 0x2e}], 0x1}, 0x40880) bpf$PROG_LOAD_XDP(0x5, &(0x7f0000000240)={0x6, 0x5, &(0x7f0000000080)=ANY=[@ANYBLOB="180000000000000000000000000000002e0000000000000085100100fbff14fe0e11096014ff3a997c6942932ebca456de6d6918dc1fffa9dd55962bb08de1"], &(0x7f0000000040)='syzkaller\x00', 0x0, 0x0, 0x0, 0x0, 0x9}, 0x94) socket$kcm(0x10, 0x2, 0x0) (async) sendmsg$kcm(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000300)=[{&(0x7f0000000040)="2e00000010008108040f80ecdb4cb92e0a480e000f000000e8bd6efb250314000e000100240248ff050005001200", 0x2e}], 0x1}, 0x40880) (async) bpf$PROG_LOAD_XDP(0x5, &(0x7f0000000240)={0x6, 0x5, &(0x7f0000000080)=ANY=[@ANYBLOB="180000000000000000000000000000002e0000000000000085100100fbff14fe0e11096014ff3a997c6942932ebca456de6d6918dc1fffa9dd55962bb08de1"], &(0x7f0000000040)='syzkaller\x00', 0x0, 0x0, 0x0, 0x0, 0x9}, 0x94) (async) executing program 5: prctl$PR_SET_MM_MAP(0x23, 0xe, &(0x7f0000000080)={&(0x7f0000ff0000/0x1000)=nil, &(0x7f0000ffd000/0x3000)=nil, &(0x7f0000ba3000/0x4000)=nil, &(0x7f0000ffc000/0x4000)=nil, &(0x7f0000ff8000/0x4000)=nil, &(0x7f0000fff000/0x1000)=nil, &(0x7f0000ffb000/0x3000)=nil, &(0x7f0000a18000/0x2000)=nil, &(0x7f0000e1d000/0x1000)=nil, &(0x7f0000ffa000/0x1000)=nil, &(0x7f0000ff8000/0x2000)=nil, 0x0}, 0x68) sendmsg$NFT_BATCH(0xffffffffffffffff, &(0x7f0000000080)={0x0, 0x0, 0x0}, 0x4004045) r0 = io_uring_setup(0x1b7e, &(0x7f0000000040)={0x0, 0x970, 0x1f480, 0x0, 0x399}) openat$fb0(0xffffffffffffff9c, &(0x7f0000000140), 0x4000, 0x0) syz_clone(0x11, 0x0, 0x0, 0x0, 0x0, 0x0) r1 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000400)={0x32, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xa}, 0x94) ioctl$BTRFS_IOC_GET_DEV_STATS(0xffffffffffffffff, 0xc4089434, &(0x7f0000000780)={0x0, 0x1, 0x0, [0x806f, 0x0, 0x2d5, 0x9793, 0x6], [0x9d8, 0x5, 0x1, 0x6, 0x8002, 0x0, 0x5, 0x2, 0xf86, 0x802, 0x9, 0x200000100, 0x3, 0xfffffffffffffff4, 0x4a, 0x5, 0x100, 0xd, 0xdd, 0x5, 0x1, 0x2a9, 0x2, 0xc3c, 0x3, 0x8, 0x100000000, 0x2, 0xa51, 0x8, 0x401, 0x800000000000003, 0x7, 0xfffffffffffffffa, 0x81, 0x100, 0x5, 0x931, 0x4, 0x3, 0x8001, 0x9, 0x7, 0x1, 0x8, 0x5, 0x6aa, 0x102, 0x1, 0x83, 0x538a, 0x9, 0xfffffffffffffffb, 0x4, 0xfffffffffffffffe, 0x4, 0x805, 0x8, 0x8000, 0x8000000000000000, 0x4, 0xfffffffffffffffc, 0x14, 0x5bc, 0x1, 0x7ffffffb, 0x4, 0x8000, 0x2, 0x7, 0x6, 0x9, 0x82c, 0x7ff, 0xe000000000000, 0xe4, 0xf, 0x0, 0x8, 0x22, 0xfffffffffffffff9, 0x7, 0x1, 0x8000000000000000, 0x2000000009, 0x7, 0x0, 0x6, 0x6, 0xb, 0x100000002, 0x4, 0x4, 0xb, 0x7, 0xa, 0x8, 0x5, 0x16d, 0x6, 0x68d, 0xffffffffffff43b0, 0x8, 0x50000000000000, 0xe, 0x0, 0x0, 0x4000, 0x4, 0x7, 0x406, 0x3, 0x6, 0x2, 0x0, 0x3, 0x40, 0x7fffffff, 0x7, 0xe, 0x3]}) r2 = openat$tun(0xffffffffffffff9c, &(0x7f0000000080), 0x80, 0x0) close(r2) r3 = openat$ppp(0xffffffffffffff9c, &(0x7f0000000080), 0x0, 0x0) ioctl$TUNSETOFFLOAD(r3, 0xc004743e, 0x110e22fff6) ioctl$TUNATTACHFILTER(0xffffffffffffffff, 0x401054d5, &(0x7f0000000180)={0x2, &(0x7f0000000040)=[{0x40, 0x1, 0x0, 0xfffffc00}, {0x6, 0x0, 0x0, 0x2000000}]}) ioctl$TUNGETVNETLE(r2, 0x40107446, &(0x7f0000000180)) bpf$ENABLE_STATS(0x20, 0x0, 0x0) r4 = openat$ppp(0xffffffffffffff9c, &(0x7f0000000080), 0x1, 0x0) r5 = socket$can_raw(0x1d, 0x3, 0x1) setsockopt$CAN_RAW_ERR_FILTER(r5, 0x65, 0x7, &(0x7f0000000200)=0xd, 0x4) ioctl$ifreq_SIOCGIFINDEX_vcan(r5, 0x8933, &(0x7f0000000280)={'vxcan0\x00', 0x0}) sendmsg$can_raw(r5, &(0x7f00000004c0)={&(0x7f0000000140)={0x1d, r6}, 0x10, &(0x7f0000000080)={&(0x7f0000000000)=@can={{0x0, 0x0, 0x0, 0x1}, 0xfe, 0x1, 0x4, 0x0, "36e932c486d275cc"}, 0x80c}, 0x1, 0x0, 0x0, 0x84844}, 0x0) ioctl$TUNSETOFFLOAD(r4, 0x4004743d, 0x110e22fff6) write$cgroup_type(r4, &(0x7f0000000280), 0x9) ioctl$sock_SIOCGIFINDEX_80211(0xffffffffffffffff, 0x8933, &(0x7f0000000000)={'wlan1\x00'}) r7 = openat$vimc2(0xffffffffffffff9c, &(0x7f0000000100), 0x2, 0x0) io_uring_register$IORING_REGISTER_FILES(r0, 0x2, &(0x7f0000000140)=[r1, r0, r0, r0, r3, r4, r3, r4, r7, r3], 0xa) syz_open_dev$char_usb(0xc, 0xb4, 0x1) r8 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000240), 0xffffffffffffffff) sendmsg$NL80211_CMD_GET_WIPHY(r1, &(0x7f00000003c0)={&(0x7f00000001c0)={0x10, 0x0, 0x0, 0x42764e17fb2b46bf}, 0xc, &(0x7f0000000380)={&(0x7f0000000340)=ANY=[@ANYBLOB="14000000", @ANYRES16=r8, @ANYBLOB="000100"/14], 0x14}, 0x1, 0x0, 0x0, 0x4000040}, 0x40801) io_uring_enter(r0, 0x8ae, 0x6933, 0x17, 0x0, 0xeffd) r9 = bpf$MAP_CREATE(0x0, &(0x7f00000002c0)=ANY=[@ANYBLOB="1b00000000000000000000000080000000000000", @ANYRES32, @ANYBLOB='\x00'/20, @ANYRES32=0x0, @ANYRES32, @ANYBLOB='\x00'/28], 0x50) bpf$PROG_LOAD(0x5, &(0x7f0000001540)={0x6, 0xc, &(0x7f0000001480)=@framed={{0x18, 0x0, 0x0, 0x0, 0xfffffffe, 0x0, 0x0, 0x0, 0x9}, [@ringbuf_output={{0x18, 0x1, 0x1, 0x0, r9}, {}, {}, {0x4}, {0x6, 0x0, 0xa}, {}, {}, {0x85, 0x0, 0x0, 0x83}}]}, &(0x7f0000000080)='syzkaller\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @xdp=0x25, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) executing program 5: r0 = socket$nl_xfrm(0x10, 0x3, 0x6) r1 = openat(0xffffffffffffff9c, &(0x7f0000000040)='./file2\x00', 0x18f442, 0x15) pwrite64(r1, &(0x7f0000000000)="ff", 0x58200, 0x2200) r2 = ioctl$KVM_GET_STATS_FD_cpu(r1, 0xaece) mkdirat(0xffffffffffffff9c, &(0x7f0000000100)='./file0\x00', 0x1c1) mount$9p_virtio(&(0x7f00000001c0), &(0x7f0000000480)='./file0\x00', &(0x7f00000004c0), 0x0, &(0x7f0000000c00)=ANY=[@ANYBLOB="56c78e3c733d76697274696f2c6e6f657874656e642c6163638173733d616e792c63616368653d667363616368652c76657273696f6e3d3970323030302e75"]) chdir(&(0x7f0000000080)='./file0\x00') unlink(&(0x7f00000002c0)='./file0\x00') mknodat$loop(0xffffffffffffff9c, &(0x7f0000000000)='./file0\x00', 0xffffffffffffc000, 0x1) ioctl$KVM_CREATE_VCPU(r2, 0xae41, 0x1) r3 = socket$can_j1939(0x1d, 0x2, 0x7) ioctl$ifreq_SIOCGIFINDEX_vcan(r3, 0x8933, &(0x7f00000004c0)={'vcan0\x00', 0x0}) ioctl$AUTOFS_IOC_PROTOVER(r2, 0x80049363, &(0x7f0000000380)) bind$can_j1939(r3, &(0x7f00000000c0)={0x1d, r4, 0x0, {0x1, 0x0, 0x4}, 0x1}, 0x18) r5 = socket$nl_generic(0x10, 0x3, 0x10) r6 = syz_genetlink_get_family_id$ethtool(&(0x7f0000000040), 0xffffffffffffffff) getpeername(r3, &(0x7f00000003c0)=@pppol2tpin6={0x18, 0x1, {0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, {0xa, 0x0, 0x0, @local}}}, &(0x7f0000000440)=0x80) mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./proc\x00', 0x1ff) mount(0x0, &(0x7f0000000000)='./proc\x00', &(0x7f0000000000)='proc\x00', 0x0, 0x0) r7 = openat(0xffffffffffffff9c, &(0x7f00000000a0)='./proc/net/afs/rootcell\x00', 0x2, 0x4) write(r7, &(0x7f00000000c0)='s', 0x1) sendmsg$ETHTOOL_MSG_TSINFO_GET(r5, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000080)={0x2c, r6, 0x6a98047402e98331, 0x0, 0x0, {}, [@HEADER={0x18, 0x1, 0x0, 0x1, [@ETHTOOL_A_HEADER_DEV_NAME={0x14, 0x2, 'geneve1\x00'}]}]}, 0x2c}}, 0x4000000) r8 = accept$packet(r2, &(0x7f00000001c0)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @random}, &(0x7f0000000280)=0x14) getsockopt$IP_VS_SO_GET_DAEMON(r8, 0x0, 0x487, &(0x7f0000000300), &(0x7f0000000340)=0x30) connect$can_j1939(r3, &(0x7f0000000640)={0x1d, r4, 0x0, {0x0, 0x0, 0x3}, 0x1}, 0x28) writev(r3, &(0x7f0000000280), 0x0) sendmsg$nl_xfrm(r0, &(0x7f0000000180)={0x0, 0x0, &(0x7f00000002c0)={&(0x7f0000000000)=ANY=[@ANYBLOB="50010000100001002b7acea236aee725fbd0a066809122bc700000000004fe80000000001443000013fb0000000000000007000000080003f7040a0060000000000000000000", @ANYRES32=0x0, @ANYRES32=0x0, @ANYBLOB="00000000000000000000ffffe00000010000000032000000e0000002000000000000000000000000feffffffffffffff0400000000000000030000000000000000000000000000000000000000000000fcffffffffffffff0000000000000000890000000000000003000000000000000408400000000000090000000000000092020000000000000000b01c000000000000000026bd700000000000020004006c00000000000000600002006362632874776f666973682900000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000c000000072f01afe02000000366a6a849a73904500240062227c0219"], 0x150}, 0x1, 0x0, 0x0, 0x8000}, 0x4050) executing program 5: r0 = socket$nl_xfrm(0x10, 0x3, 0x6) mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./sys\x00', 0x1ff) r1 = socket$nl_generic(0x10, 0x3, 0x10) r2 = socket$nl_generic(0x10, 0x3, 0x10) signalfd4(r2, &(0x7f0000000080)={[0x100000001]}, 0x8, 0x800) ioctl$ifreq_SIOCGIFINDEX_batadv_mesh(r0, 0x8933, &(0x7f00000003c0)) r3 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000480), 0xffffffffffffffff) ioctl$sock_SIOCGIFINDEX_80211(r2, 0x8933, &(0x7f0000000100)={'wlan1\x00', 0x0}) sendmsg$NL80211_CMD_FRAME(r2, &(0x7f0000001380)={0x0, 0x0, &(0x7f0000001340)={&(0x7f0000000000)=ANY=[@ANYBLOB="f4060000", @ANYRES16=r3, @ANYBLOB="01000000000000e14f003b00000008000300", @ANYRES32=r4, @ANYBLOB="d506330080000000ffffffffffff080211000001"], 0x6f4}}, 0x0) ioctl$sock_SIOCGIFINDEX_80211(r0, 0x8933, &(0x7f0000000080)={'wlan0\x00', 0x0}) sendmsg$NL80211_CMD_DEL_PMK(r1, &(0x7f0000000340)={&(0x7f0000000040)={0x10, 0x0, 0x0, 0x8000}, 0xc, &(0x7f0000000300)={&(0x7f00000002c0)={0x40, r3, 0x100, 0x70bd26, 0x25dfdbfd, {{}, {@val={0x8, 0x3, r5}, @void}}, [@NL80211_ATTR_MAC={0xa, 0x6, @broadcast}, @NL80211_ATTR_MAC={0xa, 0x6, @device_b}, @NL80211_ATTR_MAC={0xa, 0x6, @broadcast}]}, 0x40}, 0x1, 0x0, 0x0, 0x20000000}, 0x40000) mount(0x0, &(0x7f0000000180)='./sys\x00', &(0x7f00000000c0)='sysfs\x00', 0x0, 0x0) r6 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./sys/kernel/mm/lru_gen/enabled\x00', 0x100141, 0xa) syz_genetlink_get_family_id$nl80211(0x0, 0xffffffffffffffff) syz_genetlink_get_family_id$l2tp(&(0x7f0000000380), 0xffffffffffffffff) mkdirat(0xffffffffffffff9c, &(0x7f00000021c0)='./file0\x00', 0x3a) mount$tmpfs(0x0, &(0x7f0000002040)='./file0\x00', &(0x7f0000002200), 0x1000000, &(0x7f0000000000)={[{@noswap}]}) mount$tmpfs(0x0, &(0x7f00000000c0)='./file0\x00', 0x0, 0x2b00ad, &(0x7f00000004c0)={[{@noswap}]}) r7 = getpid() r8 = syz_pidfd_open(r7, 0x0) open_by_handle_at(r8, &(0x7f0000000180)=ANY=[], 0x20a081) write(r6, &(0x7f0000000140)='n', 0x1) sendmsg$nl_xfrm(r0, &(0x7f0000000180)={0x0, 0x0, &(0x7f00000001c0)={&(0x7f0000000200)=@updpolicy={0xb8, 0x15, 0x1, 0x0, 0x0, {{@in=@multicast1=0xe0000002, @in6=@empty, 0x0, 0x0, 0x0, 0x0, 0xa}, {0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0xffffffff}, {}, 0x0, 0x6e6bb5}}, 0xb8}, 0x1, 0x0, 0x0, 0x810}, 0x0) executing program 5: syz_fuse_handle_req(0xffffffffffffffff, &(0x7f0000000000)="d2c113c29ca1f0329c09333c4e57bb838cfea716579dab7d1cbdce058b04b86cd2573f5a46ec9ad1bb3c276903ebcad8758f3bdb0ea994c5ea01d7771c5b21040018c812e3b3d2c92d14193a28633e7a06c3239d8e97c69f11a821f535082d74ee0c1925c46bfba566d8c9647889a9dde67089b24871471415a695730085f81a0b7c8dc2eae85ccd015b85d7d1fecd2528f2a8369ee0315327ba0d506a583c716ea4fa23575566c8cf1a2a844691717179b82f10998b7d540188e57e864820665ab70db2d483c4fdcb115ea6bbd4a888f9d383f6fea063635b69686590f540c638a77fe8e8cb266cf72667e61871faf1d1810c749c30c5a7b61609d81114f7aa0355967a7513f659d021338ddb687b0f7372386170902b612c56f58dc73a1ccecb389ccd39f926ee91220a5c053dc277919ed4e32b63da14781cb46227a71388f2aeb37e8971d4a554824bb05f7e6861a916c94204feae48f115680a40b7b2da6ec3af295979016cb78ee53d347a2a8de81c26d0468db8b59df449513e109f26ccdff64403180deba17211813b69ef3f0c42f498a6f3d05a4e7f47f99a8b9ff6bb375fcd1cf444a794a7c2a274f2786c8c220b1f80f2d0c1f311960b37357e31198a44f1e25aaa320f6daad7a42c0367de29a2d0d5567098dfc4ac2b0393a7accfaed79afeec5c9d526503e8fbbd3d1f6365c698775999e5109bada3ec51a9d4b884631086bcfa4fe99135a7c482d9e3d2cbd0a58a42f8cd737a812c21185d909bab234d412bd450da975be70eac2a8db479f7030ff5f41817cd798d59a2db9d8d829765459531044ba3bfa6fc89d046c75e707133e5211fd05d20f63d4f493b23bcd966e3f4314a512451b761fb3b3ed815da07c604f71d2a86937142ede6fce427766dbde15f74f2c45d4c3c08e815b507bb05ee97ddf7ed79ea2ddd5c6ef057d455d84c79bdfd6e68ba6f5cd806a6b9dfd5ed65e394554fb59df7aba2676779a547cf8a7c97379abc760e94e01264a2a23c8c63296ec0d9a4e0aa5c9c470fe46beb8db8322372f3649b7d2ad0b8d09e77e4757a2f40835860b56d41382fabc35d891deedd2168ff3b20f3345ec3238ce795fd9b0311fbd7cf10bbefe4e9349bdf7ea5294f3fc3ded1203c01c9a057641ea122eea48e30b942fdebdc4e7263353361dfcf3562eb3f7eb491fe5394ac1e9af734950b3de71b557bd1baf334d39c5dd9e6842a3ef24004eafc5eb85fbdad5c1e49f60f565da146b119f27ec9077774e21300edf2883f34e299ae0465779ab80ba2d097f5d791a72785f35090dbc369864476c33d3279382a49ac45be1706211659d6fac1ae12d772fa270eb3746a69082e67664f4be335f2d172d52f5083a0768e5d4332352be40eb41e3406de4498e740a470141032ea251c144cdb5352d8049281898c72f13a5d3509c9c77308fe45016abfd7d42b1a022a60b9a5bbcece7c0a10bf9f157995465729b38fdcadd0d977574636206982a6b4e8f24bc75e3eb054fb9ae81e878afd24cfa9756f053bb89f0e4a42e195bd2af8a91a6dd5c9fbccd938681a7387ed22a0e3a8284d3182aa7ef1905a267850fc405494d7079f6d0364287cf7b16dc2310b15bc49fb68d1a96075cb5f30f4fc2ec0c51d0b7e806e78f108f4060a55b8c23b3c89a2f2fa321d5138019c417a504d230ec496583933daba2998e20d8f9a2e6798f681e1d4df88fa4e084513d3648ed4f6624d8b894470cf325e837ad177a634bf58d21378fa0d3370bcb724fa88314bbd0749bbe6ff9dd5d7826701891c180278833c3327a8b1500c3e86fbdaacaaba0e0f708052ddecaae4fe142689c812aeccc7211f61159e0787a8f639d1f0a4db373c17317fea5d3ca1c6060fc44a2d02502f0230334acb69861f0cdb82220827f5887a14e7eab133ce4ecd9a414b2a6b31d8c631325319bbb65ad01aaea7e157fea6cbb434c67f4582028c32f5890ceb243dc972e61e122cb36840d5838dff32d4b613ae1909f3970404fb1973f1e80b0e388141b2e24d47276be045880a4ac18fd136c08cf266b35c75e9b796f6210817439833b613195fe4688b22127a978d20f8b32e3df3297e09a565e659857d8052bf69c5006c5870bd25e6c3aeb411553924d06ccb849cdeca659448cb220d259b4ee20d256d44149814b5e13ab365c448369a43553e01874acded99d24da7d1c9c283dae95b0b5311344af85c7c9a8483fb18a5bfd7a4fb4bbade211edfa4c30f3d1b5bc9672a02adb5d638faea66424e2c82540937dc4cf21392fe16e05811f1bcfb83132deb1cf2a522f9b543758b25d6949400af5d2a7a566f4ab0f5fe0b0a8e8379850e3ed78cb823f5b59b3df4de700427b197720ec69b86c76080b2cfdc4a2619e9d2a901e247e591d79dea91257c0d4a3c7ebb86af42de6833aaaa2d69b71e684236705744b79c62079236759def4a37a0b97742dcdc1af8e54385ad496af31cffe7539e4a69d65ae28845439e5e3eea34785e6065c32f3c7b71ef4edfdb16ca9ee9d5d4e066a60f9919461ce932a61c4100276dad7a22447c681bfebac9186f23dd38509090e0c0fd60219d33174d0d1f5a2b3eb194ae1c7003b159dd560e909fcd0b14b803ded8a94f2a61ca59f9015a673c018515b7605512ecdec58b60aafcba88e88b790e6dabc09a6721613d4e60ffd8d01b07ccacc1c7f2415347f5f5aab1b7e5d27090403a55d0364721bf0363e34bdf9d92c8e83fe39e8d23e0a038717c00f82dd27709ea69a7a857575f0e039b067750b0e226dd01091b6aecae409d563a72e0805c8c101401a9d4356c532ec27cf25ad0ea92eb137e5bb367623155b3e62baa1cb29d86e4765a635d180d26f37f58a24683494cca93547b1f9ff0cc81c085cc4509b746c5327f1f169ca3bd059d324ac91e3c05bb225e5f81655d2f5b5f0cd6389d35be14f63cf76ef856634c5c42f5f6763a457be1745d9ddc4e7a77cbe86398585dd18159eb7dadc2da143cabd5794c4caafab774c5b0ad661f6f9e7bd5163af6f214bbd6351560cfb5e9fe42d3b67912e0bb52926429a43c27aa6c52e904660029285c4b763d6becb5cd4e9a029fb092ae20df18e073627d896a8de5f89474cbc2d2a525edbaa635a9704ec9f30bc0d18dea437a986553da723befb7f91d73a9976a528d2ff2ff80aef0fb80b4c84fca0d810e1f0c3857aef2616c9908aa7dc6a02e28085ccbb88e13c8c8c1acc631e4121e39b453a5897602dfcff5629f88d75ae7375cb9d08969dc6e870870c7aaad3c62f1f39c363d7edfda2d5ce1e9e62b25cf3b31bf4da9b90616a79d3be8f031837844c13fa6ea8af83db6eaa6abcb5158c38abe7fd39b8710c7d8d830ac93d5d3cec1d038c7947861c4ea118b3c205be5c441d35ef856c9a81f970c2850397e735a2fb991fe2dd0f293224ed263963a1041dcefc67b77b25b82d6ab047eb282702ddab528cc4bfb8c82d86352057e893bfd4b41e3396d64d7f1a78f6a0d4cd420d4bf84eb791a513163f837556c1a2e7c4e84ab9bfaa3a23a7114bfd301ea1f6b5e5c94e076e8f42a4da7e05224589005625245672ef85a11d6ac4b379b72660583ccb62b3d6cf00090c9c0ef7f3e3bce7bc6e10baa0498799de647451281afb45cf053c7a57eca0732a8f9e9f02437be51649bc7d1a391aca1561fb6b2d47817394e97e426afda0fb9fdd248579b8eb768ef9e249dbef8b0ebbd0e8dec2f149e2356df3a9f728b5392875ea476b54a1c990040ef4e63373566611c5b555b5d60a0e69f32e05db3f9047ea3e261ee6e3d87516bb0fff783333eef6444c8d9d17f8b23514d6358c62cd34dbf0e9dd60f54f286c533d68f2610c82eaedd9e512884f37211f190a08cd3766c7ca6a5043ee9dbabf5994c48d03a2fa5ccedce7ffbe9cee1e9d54036ca4ca7c4fdc339011448c7aad3d14b639dc179e7a97f03b606b0e47a32b8c9ab82c59fbba5e0ab663538aba9ba71d27216614f59bdccb050cc2512f65f465e8476d36855df64b8bb181907e91f45c6262dba02b35dc238bb32b9cc7070d31f7f95f2193b5fca347874a64041ab629cb5c3a3d77ba999793badacf01c4244ae13c0d77fe01fae16c489fcd58010afc3084ffadb9bf7264f23f1ad0e8d9d762dcc431163c343054181812c9cd1a6ecdc9964caa0a2ba8cd29271e6824891129b89efc1ea2996100f1932940a49a324e8eb688d05ac7d6ba273aade15c2be8cc74ef1eafad9b9ebfdfa36edc5c6d109485a48ac6a8395ccdf23779919953cf3c61c3a635c7e782f84098f3cc6bea7644cf3924c2352c97c76bc7141227dd29f1d47ef209adc3aaefd8cf204fb265e6b262e83736c2f26b22d80870af83095338c23a47a5a86af2ae7decd1aaabd925ae900bfe8e82728e14fd82677769bc9962dbb507a61e206821ac9c0940b12d79ecb7a916b9f6573fa3d9a7ef773f66de8cf8db6536d986a29d7b50a2973d228ec48468c5ebec6253130c578e5ec2848b62e8e1082a3d584e84b86e24211a9546e1abf79e568827af5d9ba98ba7b33b5cd9cb7a81dc873ea11276049d9d6206d2ed0933ada7ef9b6823f24b756ebea834297743ffb146350f320ec9044df55b20df0ff84584c16350f465b5ad7d364f9b166fb534c2a0e65f6bb4d61feeb84463ceb4a4f7853c0c2410955881a60170b0bbc131f6699e2616752851063c7e8b0a82e4357b84e48bad8002610e5770c17ee0cb301f9dfe8d5cbb66c6962b5edcae17b5c5dd42026737ea9e2c79bfb9392d290b44d66ade6eb62e26321ee214a6d15facb7cca610b6209392179a50f3dcba1494d3f302745461f6172d329a12d68405be5ee05ad2a641a7aa3da1d1fd3198671bf1af5b39e2bdeed49df80cf0c6e0edc5c4812350097bda47d3fafb3827d73eeb0b29320c74dae0104000000000000835f5a7f98710c644dd50d3af618651b41916bbabb9ea7cc46c8208dd7fb99474be66e1a970c899f17129a9ed17ccce0d93411e71b8f1c7790c787f7a97a50d54acbc6f4eee49a38882c34e3477c97e1c6da0b39a1e9d0d25a3cea9364033bf4f625a02412174d03dafd642526867578f71f2e52920833b8d23713d5ac48165f49545f6c7c75b5b4ef2e0682f8f2e191fdb6c0ba529856f887391f8d5aa3f7dfc5230170b97662611e53a4436bf4e98a5ceaeb16a79bb95f960b2675cb6da9f1cfcdc1ab604ef7749fe87ccb5a3660f463ff5f488b5c544cf847be84dab22d038730a7021cdc7f7ab714c1561c98a39cc92cd6aaf53c82b28665114ac18b2149ee7f1b52f894c28a49eb45d4cf6a0e65df39b3c717039ae41958fe810c1e05ad62ceef2980e0cfd891bfae0db61fb1c8d65b6812ef1bf5d426f955ab4826eae69f531979699685f5312882032a5f47ed8cf2e98e67d9e6c299d2060a04b4aa677500b48a33586b10f71293d57de846d2683621b588630a6ef06a41437bd99366787b787a68c71779132d0ee73aa5f97d5b9ca18a7ae26b7002512df1073e2eccdb4d2f137a15d9604e10547fa465aeb4f2e5899b531adeb5e72fb76c2c1c9d18ceb4a23a5f6174ba86a7119d82e35cb5a5d1c6a093351aaee0094b32b92417dc50c1d3806fffdafd2ec0e3ba176d84bdb7d59755e9083e61ded802e2a089ae9d6746f738b55845bcd4ff0a21888c2c6b972db043973fb323fd1c15e70137aa6a4bce3f60f27c1d1488f3751e5425a5776c7cc3a3c8acbfbd2171407e1a242e8e241e6e9e1287d8995265a8092ec59ad99652e63a41b744f34392017f29c1b1ca4ce7728200743d4497a70cfd2369d0ecf9e0ba6f28da25b2d918a06ad1173091b8d750b8c2120321818a0912bf47b96c9a8962930a843ea8419b24b8618b7b43482291906e151bf39d3634756d9e1ff5a6e787d1fc4be7349c38a3b882e059a5da930a9cb2a01eb8b24b54def200009538fc063542921947f1997dbee59842a50a043d431649ea0adde68c43259ab51592107b2618c5f761364d4d3d5d0f4d4ae1b94650cb4b695db5831c6dd789140b87525d9ed46fb8dce8fa75d68f317dfc3858d810928fb3530b7ae8701d622b0e69ab16cbbd46c8165c467850d081292da8147fe07f472776d1e2c75c17bdc0f8bafbc964da953a5efe64af69944f0f8858b2a4dece04428ede8967d0e93827910400af8a859b59579d9628191b291732bae90a3b50f8b2b7728725568a83e006ed21e940d4b7e7291ad6365138aa2d59c0b303cc298f7a70d0c39e4f17a878083631b1f96a65d7b4c5a4403929180694f55b71ba29685bdf472f0e21a1c8b3c2dbfc4892ffbc0f0f23f38ed0b785080c11b0766ffc5a0c2c750080b764df159e42ac8eb82681baec5b0ad7948153679162c223f63bf22545718accf2a30bc4402f6b54996baa00508c6def488975a2e2bf2a8dbcff49293e83f998f8baebe722cdfef96c46ac3d945d56ada194353f7cd03d2b86cb9844f7d63f008fbe553fe0023f6968e8bea9054ed3c567e5c55b283fb2337fbd20510e5e098537f5c1baa6b509f63b1e812840aaf470690894a2725f4460a106a3b0e14b12b47c3fc1a083ae7e8cd2e710b5d428b2063f7bb91105255cc0fcc8ac51398ec3df6416d283c4aba6ed44846e82be02d242c710c973c5f0a9b3b16da8a96f5cd2a164a3fa040075b0cb99944f1b34f7e79ae039d15a6c992cb40aa423de90992c064e1771f2a396734480f43b024dc799b8e242df235dc0d33cfdce41755722907f4533a1480d78e99320412326c27e15434fd3fdb19ed33a07063a8a62b39ce14be2ea1e0adadec65fcf4f19901bd801b87e90fc91f1270b420fb530b71b7aea9ad23c4a4ad28d4b63444bc2fa7b44247d5e9f0ca0209a489035b4521b5e886a419df1f9d0e27b9c5007ee75fd3909d4e0156973bdf2ff8d1a88cad1d534ba93648ecb34a30b1e760f1ee8cfb90c27c36385fd68ee48982e5f0c190e8786bf2eb5dd386d3f1600efc19a92020b509d3e2c74b4265bdc765085bc49c6fc61476aa22cff375a78c59f33394cc6ff460584ebbd8dba2cbfe97feb1c9147068dbc1d3e25631ad8478d826d88c28b2cf967d07d3ff845cbb25699406d106eabd31066e9cf8abbe7598f71cca663a6f63bfb63caa95d3a363e69e9a3bc889d026df28c37e41786bf8c9a1ccc06c3499986a72bb10367f32b1b8a55365c2a5b46061b58b81c5da69ad39db6c468906f1c1225527f1b26a3dbad94b1419f3671086b061117206a634cd08beee1fcdfb4a3a7cc78b3cb1293dc900d0859505018b38033a1cc9a0051960200000000000000328b6834f9c30bb1734949fcdab62cc6904b285322da3d49f188019648cac314d65a7c57f4e25864f17e346e7ebbe411695a237622356ecc10e66c8ba33e7106a756b8d3abc1a1aababc26413adcfda74a59b9002a7e2e3edb3e7551d32c461c2e40c25cb9de751ffda44d7f353513c5bbbc473594127c09775844dec5dc922caea5532dfa98fe80d80243233a4f0c15520d9dc76da3623aabef3582380ca4d2f9558d6c71b672f259b94f26710aa1d933b3ad79c8755a96c18fcfd62a972ca80ea0d33afbfc80045ba7dab492aa06c73ea3a598b2bc6eb1549627d183c25c3486814960eb1e1b02200a92f51b8642683f88185a9ee91c6dbb576dd8a869e1338b81ec205d979242bd963308af90ec23e01d253a70440edd3ebfac8e489db0a70bb5c887f22e7a5de33918374a9ae5229d419b1948eeb23bdf8dce3c5df3b81d1a3e3b38e095f261cb9e00f5567413a5c13abb469fdf64adc830cc442a099609cf0ebd3ffe936d77d6099d816be2b4cdd31e4fdf5af5904120ec65e81138416462f9e9bbe9ba6d5980c7de01288bd9f4741848802c32f3774678367c70014e531ad7f95b5527d022232ada51148012328f1693b2d08b8eba80dc26d8e9fc369b410331ed720e410ded5bd03ce69942ffb97489a2c5b6e4da93cc73811738a141c3a16d4ff6edf2ad1b3d3ae45a21c5ca2613b92e7871dea89d3cd699b86520c80f6a391cc2911538f8108dc90203b0e74ee43a087e033265e0745a9c991facff49339c40601420bb72ef014bc4b9a51cad1dcde9f1567b4ae9d11b1416ff3d8dee15f4672bdbca4348e7e71f8d75a73851bc0ad539312b7d52c498602a5eda4630296fb40aaa90d8f6122da7fb56d02755f861df193bdc5effd8a0e54c2ef78a284f7543c2b25a81bf545be3a3f549aabe86700bf058877e3fec53813f9992814a2cebf341cedcad346dba70596da899add4d723d98366ab60997cae7e5b9d417252734d9145ab8c5ece5b5b0efdc2f2578838c500ee17b866323a951979c6f1a50da2833bc437bcddd6efaed0244df44e6069daf359289d9c50c073f0fef4be1fb3802be5ea643761ed6347a35a3f537cbde402911c28d7c7c7e6b8612facbe87221f3505ff078d0dbb28ec469fe6eba2efcb4efdcfc5745299c0850e21ee2c9ef77db8070d589c547cc7379b58677d16077093514849869ab5bf8f896fa933ba3edc676dcb73e91386cc48f01782ba635564e0f91988cf98a3a17544abfedcdc1d80540e9499bf98180feb80325194cbc369be3275ed390f8e91b8d75b1364e9fabe50a1e3b9531c3fe1aaf6523e54bb05738bd3a67ca5de01b2e479ef7678a86b13d6b747fb3cb5fe1be8913228705fc232ce422186cb79c3b66c944f6124eb414322806d47978044336221f26d3a09ed8dceb52e3c7e3413535faf1f7868cb47bbbf02b36650b673a4e51387c64d44daf58057adaa5610d22a15329804cd51a42f663311c4e5ece9d99b5a813c4025e8e0a98c0f3ec13cf07de0b18d7e1ba7d3eb143f5825f62ae5b5f6d92b167f9dbb2177e84f23322566814296277fc2933956f818f5475b6aa031545e6e2265679d16cbedff96c4f419d5fabe99ee652feac8acf9a90771ab8ade8291b42d25ebbdc03faac02b9599fdb83621f6ae1e2e7f946520f3cff881cd600c17b4a00c08d0996f7d2bb97d35647f72b80ba8ad3b4a16cb71094b2d1193a5fa1456e4671788bc51c0d506f4809ca34620d4a75a62ddfa20ab5c4d347a08eb8784d4c572fcb473b766f5e1ce9d92db70ebee83accd58b8253da36b9542686edce545261f309144a3d64900f796620003b36ee3d44a06cc4d088f73aa45288b90476d2e1e461795d473d59500aa23a6b7724a2f0d6473dc2f0af6ea311a648e193072016e199b920bc8c0830ae18f1c17e33d73badadc0f9d34cd52b54f4d3d480a7ddfe0f140f8de1a382a4c5a722d3e0f875b69054d88b8bab94e9394ba8d28937f1ffd871d1666a377620e7f032633fe58ebc87e533bd6461b537cdde38352ece085378dd7b24fa3fd5a3dc3f5b77492e4fc91238a8bfcc4e20bb396bd3317155981ec593926f2e9f15e5ac1aa533e122441649a681d88142a93386a6ed6b2d5b18d7fb57541e31a69acee17345b08c6667ebbc53a082fbcd980b4751937ba729dd2fd9b43d06091517922dd3ea524db002db7525902a465081843191d2d7ac76adb7724ac2bb88e4cb2f3188dbf0cd47acf5011b4519ec100a44b2ee6a1dacac5aade2cdcdca777c6b5edf596b05691d247f671491f68bf2e04007e8674309ea98ab794d05c664ade246288796270e10f4a308420a62bf0df1d1636330e88bf4cc78051e5f715c8f97b8a83119b3fb5129ac6d0733256bec96d8cf435fa005e14d88884a0ca24266a4e78e25e2519796ba31971e4d0cb44ea58c5ddf54a15e3b449642e395679fc5ba600cc6bb7f2b004bfb0d621e51f9cf16309e4a02ce4f23f4a2d225aa8c84840bf2d3522a5f7a983cfbbfe4adb62d6ea622ebb784072bc6673878c5eaa865a7657b619f48cf0c51a4b0d47b20f426adc7f8ab68238b97abf68443f0eaac3796bfd99e0bc644e4f6fc43e551eccd615db802dfb031444e09aedcb04846bb894a2cf42dd0a578dc94d727736e502194ae25bf8556373969cb7f27788b6edf5b2bf25a79c7f89289f827ed4be611d65f6bd89698b130aaadd0f2d914819f41a0185dfc73adcea80d2ee592bf32d15010cb32a95ef112bccb2b780b461637ffa1641d34e1b114cdd3dd1ceb365933efef1781f9ec620a73097594c945969c2ea036e36b2380b33599c3e1d4eb2b7f210324aee3bba5a944b71cf0246ceed878897fe00e30d0bd32b3dde08c8805e30efe39cbc9d11b97491d82fbb5d93b1997e5f3128252472ecd256b9f79611175b6f686629ee744d0ba2494607a4476ea5f934c936403509c14bddbc2403ad5d97bfed0da36707b66f39ffdcee7ab39602e740c1ca9761570cdbab5f56b2060db428921457445b15c4c92b9c4b0ebb0746936bc3053836fa884e97c96e44d18a5a52feca033ec4caf950927bf9a281ea1aacb2a8b1a1f74b20de25ad5f3e459ab8b61ba5d00eaedcb6b5467dcd8608cfd48cc8c1a01f2c9f68bc9ef9adf2fd81cb3e28277c52d58f42ea87c8896383c2fa88dd15dba7172990893fe28ad1b50095b2ca20856de64693f3a663be6e34a9ccbb09add5724c5599495d0c95d2b900444651048bf418070b324016678d694b82565931159ffc37d3eefd7b482c41637cdd69b8f7051b6e88cf87a01d26d0689057ca0f66f65a2c3fbca608f7dec52d8e41ea98d21be162eeb38b27e9465d5525e0ffac3bd989adae19bdcf98edc48ff9d9d2a2f0850fa2cac8421ee6e211b1930f9fe9cb7138e8058ae476aa93c0ca49b170eb4ebbbb6fb4020d000eae537b4dd4bdfc63e3fb281848c057b900c14dc12f8833d5ada50c8f0178137964c3b1524c59eae7ae19066a8003b9f4036b0be91f6f24baf6839f360473907135a8eb777dfe4dcf18d15fb8e16d069c48c5a128f046667f66bb22d36e986c73d2ebaa1a9638a9e8c049d0c766e2008fb19c4aabd96e3443c48377214b01dec0f73538fa5a882553a60664e549030fc9cc21a74a73cf79cfdbbfa3676a474910a295044d804b9f6a30104fc8250da4efcfddc379c3a1b84a2050ee78b18ba84ec5cb4db62540ea7be026b48d2b9294f06aa48e44087dbc494d92fe3e8648792c2b9f5d0d580afac814f8fc74208239b5f8fa6c20fc75c9d73fbe448a4fd1eb1af10165c37e7aa72c83c47dbb92bf3203bc0bea3b3ae261636b9a6b621725aed16de5c33502f152ca3704b1e83a60cfc5807177d9e561b12f43c3ded0951c4ec7af0ab29f55e3745df0f10bedcdcee2d443c0023d7547018c94e2cbb04a5c67a81d33df4dda99f80777b1db00f91bf8abb96ca360353c08b8979d00860ee3af86988171d6739a0f546f64ec34c045afd1be790176228204782836484f6d118d734c8e1b302788aa20e704502da74cd11bc5a22bb717a1d10d5176a4426e88cc132479aa7e8370772b9776ea38d5bd217b08c50f94072acbdf93e732e6ce41f92159b626e59e39925b458465ec3b0191a56d8e1c3a76110200e38380ccfcc1a05f85608bc3ea0bdbbf326bfe003158c8c9e01e90a7b1164cc20de5b23146baa978611100", 0x2000, 0x0) r0 = syz_usb_connect(0x0, 0x3f, &(0x7f00000000c0)=ANY=[@ANYBLOB="11010000733336088dee1adb23610000000109022d0001100000000904000003fe03010009cd8d1f00020000000905050200000000100905"], 0x0) syz_usb_control_io(r0, 0x0, &(0x7f0000000300)={0x44, &(0x7f0000000100)=ANY=[], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) (async) r1 = syz_open_dev$char_usb(0xc, 0xb4, 0x0) ioctl$FS_IOC_GETVERSION(r1, 0x40015b19, &(0x7f0000000040)) (async) r2 = bpf$MAP_CREATE_CONST_STR(0x0, &(0x7f0000001280), 0x50) bpf$BPF_MAP_CONST_STR_FREEZE(0x16, &(0x7f00000000c0)={r2}, 0x4) (async) bpf$PROG_LOAD_XDP(0x5, &(0x7f0000000dc0)={0x6, 0x6, &(0x7f0000000640)=@framed={{0x18, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3}, [@map_fd={0x18, 0x0, 0x2, 0x0, r2}, @ldst={0x1, 0x0, 0x4}]}, &(0x7f0000000000)='syzkaller\x00', 0x6}, 0x94) executing program 35: syz_fuse_handle_req(0xffffffffffffffff, &(0x7f0000000000)="d2c113c29ca1f0329c09333c4e57bb838cfea716579dab7d1cbdce058b04b86cd2573f5a46ec9ad1bb3c276903ebcad8758f3bdb0ea994c5ea01d7771c5b21040018c812e3b3d2c92d14193a28633e7a06c3239d8e97c69f11a821f535082d74ee0c1925c46bfba566d8c9647889a9dde67089b24871471415a695730085f81a0b7c8dc2eae85ccd015b85d7d1fecd2528f2a8369ee0315327ba0d506a583c716ea4fa23575566c8cf1a2a844691717179b82f10998b7d540188e57e864820665ab70db2d483c4fdcb115ea6bbd4a888f9d383f6fea063635b69686590f540c638a77fe8e8cb266cf72667e61871faf1d1810c749c30c5a7b61609d81114f7aa0355967a7513f659d021338ddb687b0f7372386170902b612c56f58dc73a1ccecb389ccd39f926ee91220a5c053dc277919ed4e32b63da14781cb46227a71388f2aeb37e8971d4a554824bb05f7e6861a916c94204feae48f115680a40b7b2da6ec3af295979016cb78ee53d347a2a8de81c26d0468db8b59df449513e109f26ccdff64403180deba17211813b69ef3f0c42f498a6f3d05a4e7f47f99a8b9ff6bb375fcd1cf444a794a7c2a274f2786c8c220b1f80f2d0c1f311960b37357e31198a44f1e25aaa320f6daad7a42c0367de29a2d0d5567098dfc4ac2b0393a7accfaed79afeec5c9d526503e8fbbd3d1f6365c698775999e5109bada3ec51a9d4b884631086bcfa4fe99135a7c482d9e3d2cbd0a58a42f8cd737a812c21185d909bab234d412bd450da975be70eac2a8db479f7030ff5f41817cd798d59a2db9d8d829765459531044ba3bfa6fc89d046c75e707133e5211fd05d20f63d4f493b23bcd966e3f4314a512451b761fb3b3ed815da07c604f71d2a86937142ede6fce427766dbde15f74f2c45d4c3c08e815b507bb05ee97ddf7ed79ea2ddd5c6ef057d455d84c79bdfd6e68ba6f5cd806a6b9dfd5ed65e394554fb59df7aba2676779a547cf8a7c97379abc760e94e01264a2a23c8c63296ec0d9a4e0aa5c9c470fe46beb8db8322372f3649b7d2ad0b8d09e77e4757a2f40835860b56d41382fabc35d891deedd2168ff3b20f3345ec3238ce795fd9b0311fbd7cf10bbefe4e9349bdf7ea5294f3fc3ded1203c01c9a057641ea122eea48e30b942fdebdc4e7263353361dfcf3562eb3f7eb491fe5394ac1e9af734950b3de71b557bd1baf334d39c5dd9e6842a3ef24004eafc5eb85fbdad5c1e49f60f565da146b119f27ec9077774e21300edf2883f34e299ae0465779ab80ba2d097f5d791a72785f35090dbc369864476c33d3279382a49ac45be1706211659d6fac1ae12d772fa270eb3746a69082e67664f4be335f2d172d52f5083a0768e5d4332352be40eb41e3406de4498e740a470141032ea251c144cdb5352d8049281898c72f13a5d3509c9c77308fe45016abfd7d42b1a022a60b9a5bbcece7c0a10bf9f157995465729b38fdcadd0d977574636206982a6b4e8f24bc75e3eb054fb9ae81e878afd24cfa9756f053bb89f0e4a42e195bd2af8a91a6dd5c9fbccd938681a7387ed22a0e3a8284d3182aa7ef1905a267850fc405494d7079f6d0364287cf7b16dc2310b15bc49fb68d1a96075cb5f30f4fc2ec0c51d0b7e806e78f108f4060a55b8c23b3c89a2f2fa321d5138019c417a504d230ec496583933daba2998e20d8f9a2e6798f681e1d4df88fa4e084513d3648ed4f6624d8b894470cf325e837ad177a634bf58d21378fa0d3370bcb724fa88314bbd0749bbe6ff9dd5d7826701891c180278833c3327a8b1500c3e86fbdaacaaba0e0f708052ddecaae4fe142689c812aeccc7211f61159e0787a8f639d1f0a4db373c17317fea5d3ca1c6060fc44a2d02502f0230334acb69861f0cdb82220827f5887a14e7eab133ce4ecd9a414b2a6b31d8c631325319bbb65ad01aaea7e157fea6cbb434c67f4582028c32f5890ceb243dc972e61e122cb36840d5838dff32d4b613ae1909f3970404fb1973f1e80b0e388141b2e24d47276be045880a4ac18fd136c08cf266b35c75e9b796f6210817439833b613195fe4688b22127a978d20f8b32e3df3297e09a565e659857d8052bf69c5006c5870bd25e6c3aeb411553924d06ccb849cdeca659448cb220d259b4ee20d256d44149814b5e13ab365c448369a43553e01874acded99d24da7d1c9c283dae95b0b5311344af85c7c9a8483fb18a5bfd7a4fb4bbade211edfa4c30f3d1b5bc9672a02adb5d638faea66424e2c82540937dc4cf21392fe16e05811f1bcfb83132deb1cf2a522f9b543758b25d6949400af5d2a7a566f4ab0f5fe0b0a8e8379850e3ed78cb823f5b59b3df4de700427b197720ec69b86c76080b2cfdc4a2619e9d2a901e247e591d79dea91257c0d4a3c7ebb86af42de6833aaaa2d69b71e684236705744b79c62079236759def4a37a0b97742dcdc1af8e54385ad496af31cffe7539e4a69d65ae28845439e5e3eea34785e6065c32f3c7b71ef4edfdb16ca9ee9d5d4e066a60f9919461ce932a61c4100276dad7a22447c681bfebac9186f23dd38509090e0c0fd60219d33174d0d1f5a2b3eb194ae1c7003b159dd560e909fcd0b14b803ded8a94f2a61ca59f9015a673c018515b7605512ecdec58b60aafcba88e88b790e6dabc09a6721613d4e60ffd8d01b07ccacc1c7f2415347f5f5aab1b7e5d27090403a55d0364721bf0363e34bdf9d92c8e83fe39e8d23e0a038717c00f82dd27709ea69a7a857575f0e039b067750b0e226dd01091b6aecae409d563a72e0805c8c101401a9d4356c532ec27cf25ad0ea92eb137e5bb367623155b3e62baa1cb29d86e4765a635d180d26f37f58a24683494cca93547b1f9ff0cc81c085cc4509b746c5327f1f169ca3bd059d324ac91e3c05bb225e5f81655d2f5b5f0cd6389d35be14f63cf76ef856634c5c42f5f6763a457be1745d9ddc4e7a77cbe86398585dd18159eb7dadc2da143cabd5794c4caafab774c5b0ad661f6f9e7bd5163af6f214bbd6351560cfb5e9fe42d3b67912e0bb52926429a43c27aa6c52e904660029285c4b763d6becb5cd4e9a029fb092ae20df18e073627d896a8de5f89474cbc2d2a525edbaa635a9704ec9f30bc0d18dea437a986553da723befb7f91d73a9976a528d2ff2ff80aef0fb80b4c84fca0d810e1f0c3857aef2616c9908aa7dc6a02e28085ccbb88e13c8c8c1acc631e4121e39b453a5897602dfcff5629f88d75ae7375cb9d08969dc6e870870c7aaad3c62f1f39c363d7edfda2d5ce1e9e62b25cf3b31bf4da9b90616a79d3be8f031837844c13fa6ea8af83db6eaa6abcb5158c38abe7fd39b8710c7d8d830ac93d5d3cec1d038c7947861c4ea118b3c205be5c441d35ef856c9a81f970c2850397e735a2fb991fe2dd0f293224ed263963a1041dcefc67b77b25b82d6ab047eb282702ddab528cc4bfb8c82d86352057e893bfd4b41e3396d64d7f1a78f6a0d4cd420d4bf84eb791a513163f837556c1a2e7c4e84ab9bfaa3a23a7114bfd301ea1f6b5e5c94e076e8f42a4da7e05224589005625245672ef85a11d6ac4b379b72660583ccb62b3d6cf00090c9c0ef7f3e3bce7bc6e10baa0498799de647451281afb45cf053c7a57eca0732a8f9e9f02437be51649bc7d1a391aca1561fb6b2d47817394e97e426afda0fb9fdd248579b8eb768ef9e249dbef8b0ebbd0e8dec2f149e2356df3a9f728b5392875ea476b54a1c990040ef4e63373566611c5b555b5d60a0e69f32e05db3f9047ea3e261ee6e3d87516bb0fff783333eef6444c8d9d17f8b23514d6358c62cd34dbf0e9dd60f54f286c533d68f2610c82eaedd9e512884f37211f190a08cd3766c7ca6a5043ee9dbabf5994c48d03a2fa5ccedce7ffbe9cee1e9d54036ca4ca7c4fdc339011448c7aad3d14b639dc179e7a97f03b606b0e47a32b8c9ab82c59fbba5e0ab663538aba9ba71d27216614f59bdccb050cc2512f65f465e8476d36855df64b8bb181907e91f45c6262dba02b35dc238bb32b9cc7070d31f7f95f2193b5fca347874a64041ab629cb5c3a3d77ba999793badacf01c4244ae13c0d77fe01fae16c489fcd58010afc3084ffadb9bf7264f23f1ad0e8d9d762dcc431163c343054181812c9cd1a6ecdc9964caa0a2ba8cd29271e6824891129b89efc1ea2996100f1932940a49a324e8eb688d05ac7d6ba273aade15c2be8cc74ef1eafad9b9ebfdfa36edc5c6d109485a48ac6a8395ccdf23779919953cf3c61c3a635c7e782f84098f3cc6bea7644cf3924c2352c97c76bc7141227dd29f1d47ef209adc3aaefd8cf204fb265e6b262e83736c2f26b22d80870af83095338c23a47a5a86af2ae7decd1aaabd925ae900bfe8e82728e14fd82677769bc9962dbb507a61e206821ac9c0940b12d79ecb7a916b9f6573fa3d9a7ef773f66de8cf8db6536d986a29d7b50a2973d228ec48468c5ebec6253130c578e5ec2848b62e8e1082a3d584e84b86e24211a9546e1abf79e568827af5d9ba98ba7b33b5cd9cb7a81dc873ea11276049d9d6206d2ed0933ada7ef9b6823f24b756ebea834297743ffb146350f320ec9044df55b20df0ff84584c16350f465b5ad7d364f9b166fb534c2a0e65f6bb4d61feeb84463ceb4a4f7853c0c2410955881a60170b0bbc131f6699e2616752851063c7e8b0a82e4357b84e48bad8002610e5770c17ee0cb301f9dfe8d5cbb66c6962b5edcae17b5c5dd42026737ea9e2c79bfb9392d290b44d66ade6eb62e26321ee214a6d15facb7cca610b6209392179a50f3dcba1494d3f302745461f6172d329a12d68405be5ee05ad2a641a7aa3da1d1fd3198671bf1af5b39e2bdeed49df80cf0c6e0edc5c4812350097bda47d3fafb3827d73eeb0b29320c74dae0104000000000000835f5a7f98710c644dd50d3af618651b41916bbabb9ea7cc46c8208dd7fb99474be66e1a970c899f17129a9ed17ccce0d93411e71b8f1c7790c787f7a97a50d54acbc6f4eee49a38882c34e3477c97e1c6da0b39a1e9d0d25a3cea9364033bf4f625a02412174d03dafd642526867578f71f2e52920833b8d23713d5ac48165f49545f6c7c75b5b4ef2e0682f8f2e191fdb6c0ba529856f887391f8d5aa3f7dfc5230170b97662611e53a4436bf4e98a5ceaeb16a79bb95f960b2675cb6da9f1cfcdc1ab604ef7749fe87ccb5a3660f463ff5f488b5c544cf847be84dab22d038730a7021cdc7f7ab714c1561c98a39cc92cd6aaf53c82b28665114ac18b2149ee7f1b52f894c28a49eb45d4cf6a0e65df39b3c717039ae41958fe810c1e05ad62ceef2980e0cfd891bfae0db61fb1c8d65b6812ef1bf5d426f955ab4826eae69f531979699685f5312882032a5f47ed8cf2e98e67d9e6c299d2060a04b4aa677500b48a33586b10f71293d57de846d2683621b588630a6ef06a41437bd99366787b787a68c71779132d0ee73aa5f97d5b9ca18a7ae26b7002512df1073e2eccdb4d2f137a15d9604e10547fa465aeb4f2e5899b531adeb5e72fb76c2c1c9d18ceb4a23a5f6174ba86a7119d82e35cb5a5d1c6a093351aaee0094b32b92417dc50c1d3806fffdafd2ec0e3ba176d84bdb7d59755e9083e61ded802e2a089ae9d6746f738b55845bcd4ff0a21888c2c6b972db043973fb323fd1c15e70137aa6a4bce3f60f27c1d1488f3751e5425a5776c7cc3a3c8acbfbd2171407e1a242e8e241e6e9e1287d8995265a8092ec59ad99652e63a41b744f34392017f29c1b1ca4ce7728200743d4497a70cfd2369d0ecf9e0ba6f28da25b2d918a06ad1173091b8d750b8c2120321818a0912bf47b96c9a8962930a843ea8419b24b8618b7b43482291906e151bf39d3634756d9e1ff5a6e787d1fc4be7349c38a3b882e059a5da930a9cb2a01eb8b24b54def200009538fc063542921947f1997dbee59842a50a043d431649ea0adde68c43259ab51592107b2618c5f761364d4d3d5d0f4d4ae1b94650cb4b695db5831c6dd789140b87525d9ed46fb8dce8fa75d68f317dfc3858d810928fb3530b7ae8701d622b0e69ab16cbbd46c8165c467850d081292da8147fe07f472776d1e2c75c17bdc0f8bafbc964da953a5efe64af69944f0f8858b2a4dece04428ede8967d0e93827910400af8a859b59579d9628191b291732bae90a3b50f8b2b7728725568a83e006ed21e940d4b7e7291ad6365138aa2d59c0b303cc298f7a70d0c39e4f17a878083631b1f96a65d7b4c5a4403929180694f55b71ba29685bdf472f0e21a1c8b3c2dbfc4892ffbc0f0f23f38ed0b785080c11b0766ffc5a0c2c750080b764df159e42ac8eb82681baec5b0ad7948153679162c223f63bf22545718accf2a30bc4402f6b54996baa00508c6def488975a2e2bf2a8dbcff49293e83f998f8baebe722cdfef96c46ac3d945d56ada194353f7cd03d2b86cb9844f7d63f008fbe553fe0023f6968e8bea9054ed3c567e5c55b283fb2337fbd20510e5e098537f5c1baa6b509f63b1e812840aaf470690894a2725f4460a106a3b0e14b12b47c3fc1a083ae7e8cd2e710b5d428b2063f7bb91105255cc0fcc8ac51398ec3df6416d283c4aba6ed44846e82be02d242c710c973c5f0a9b3b16da8a96f5cd2a164a3fa040075b0cb99944f1b34f7e79ae039d15a6c992cb40aa423de90992c064e1771f2a396734480f43b024dc799b8e242df235dc0d33cfdce41755722907f4533a1480d78e99320412326c27e15434fd3fdb19ed33a07063a8a62b39ce14be2ea1e0adadec65fcf4f19901bd801b87e90fc91f1270b420fb530b71b7aea9ad23c4a4ad28d4b63444bc2fa7b44247d5e9f0ca0209a489035b4521b5e886a419df1f9d0e27b9c5007ee75fd3909d4e0156973bdf2ff8d1a88cad1d534ba93648ecb34a30b1e760f1ee8cfb90c27c36385fd68ee48982e5f0c190e8786bf2eb5dd386d3f1600efc19a92020b509d3e2c74b4265bdc765085bc49c6fc61476aa22cff375a78c59f33394cc6ff460584ebbd8dba2cbfe97feb1c9147068dbc1d3e25631ad8478d826d88c28b2cf967d07d3ff845cbb25699406d106eabd31066e9cf8abbe7598f71cca663a6f63bfb63caa95d3a363e69e9a3bc889d026df28c37e41786bf8c9a1ccc06c3499986a72bb10367f32b1b8a55365c2a5b46061b58b81c5da69ad39db6c468906f1c1225527f1b26a3dbad94b1419f3671086b061117206a634cd08beee1fcdfb4a3a7cc78b3cb1293dc900d0859505018b38033a1cc9a0051960200000000000000328b6834f9c30bb1734949fcdab62cc6904b285322da3d49f188019648cac314d65a7c57f4e25864f17e346e7ebbe411695a237622356ecc10e66c8ba33e7106a756b8d3abc1a1aababc26413adcfda74a59b9002a7e2e3edb3e7551d32c461c2e40c25cb9de751ffda44d7f353513c5bbbc473594127c09775844dec5dc922caea5532dfa98fe80d80243233a4f0c15520d9dc76da3623aabef3582380ca4d2f9558d6c71b672f259b94f26710aa1d933b3ad79c8755a96c18fcfd62a972ca80ea0d33afbfc80045ba7dab492aa06c73ea3a598b2bc6eb1549627d183c25c3486814960eb1e1b02200a92f51b8642683f88185a9ee91c6dbb576dd8a869e1338b81ec205d979242bd963308af90ec23e01d253a70440edd3ebfac8e489db0a70bb5c887f22e7a5de33918374a9ae5229d419b1948eeb23bdf8dce3c5df3b81d1a3e3b38e095f261cb9e00f5567413a5c13abb469fdf64adc830cc442a099609cf0ebd3ffe936d77d6099d816be2b4cdd31e4fdf5af5904120ec65e81138416462f9e9bbe9ba6d5980c7de01288bd9f4741848802c32f3774678367c70014e531ad7f95b5527d022232ada51148012328f1693b2d08b8eba80dc26d8e9fc369b410331ed720e410ded5bd03ce69942ffb97489a2c5b6e4da93cc73811738a141c3a16d4ff6edf2ad1b3d3ae45a21c5ca2613b92e7871dea89d3cd699b86520c80f6a391cc2911538f8108dc90203b0e74ee43a087e033265e0745a9c991facff49339c40601420bb72ef014bc4b9a51cad1dcde9f1567b4ae9d11b1416ff3d8dee15f4672bdbca4348e7e71f8d75a73851bc0ad539312b7d52c498602a5eda4630296fb40aaa90d8f6122da7fb56d02755f861df193bdc5effd8a0e54c2ef78a284f7543c2b25a81bf545be3a3f549aabe86700bf058877e3fec53813f9992814a2cebf341cedcad346dba70596da899add4d723d98366ab60997cae7e5b9d417252734d9145ab8c5ece5b5b0efdc2f2578838c500ee17b866323a951979c6f1a50da2833bc437bcddd6efaed0244df44e6069daf359289d9c50c073f0fef4be1fb3802be5ea643761ed6347a35a3f537cbde402911c28d7c7c7e6b8612facbe87221f3505ff078d0dbb28ec469fe6eba2efcb4efdcfc5745299c0850e21ee2c9ef77db8070d589c547cc7379b58677d16077093514849869ab5bf8f896fa933ba3edc676dcb73e91386cc48f01782ba635564e0f91988cf98a3a17544abfedcdc1d80540e9499bf98180feb80325194cbc369be3275ed390f8e91b8d75b1364e9fabe50a1e3b9531c3fe1aaf6523e54bb05738bd3a67ca5de01b2e479ef7678a86b13d6b747fb3cb5fe1be8913228705fc232ce422186cb79c3b66c944f6124eb414322806d47978044336221f26d3a09ed8dceb52e3c7e3413535faf1f7868cb47bbbf02b36650b673a4e51387c64d44daf58057adaa5610d22a15329804cd51a42f663311c4e5ece9d99b5a813c4025e8e0a98c0f3ec13cf07de0b18d7e1ba7d3eb143f5825f62ae5b5f6d92b167f9dbb2177e84f23322566814296277fc2933956f818f5475b6aa031545e6e2265679d16cbedff96c4f419d5fabe99ee652feac8acf9a90771ab8ade8291b42d25ebbdc03faac02b9599fdb83621f6ae1e2e7f946520f3cff881cd600c17b4a00c08d0996f7d2bb97d35647f72b80ba8ad3b4a16cb71094b2d1193a5fa1456e4671788bc51c0d506f4809ca34620d4a75a62ddfa20ab5c4d347a08eb8784d4c572fcb473b766f5e1ce9d92db70ebee83accd58b8253da36b9542686edce545261f309144a3d64900f796620003b36ee3d44a06cc4d088f73aa45288b90476d2e1e461795d473d59500aa23a6b7724a2f0d6473dc2f0af6ea311a648e193072016e199b920bc8c0830ae18f1c17e33d73badadc0f9d34cd52b54f4d3d480a7ddfe0f140f8de1a382a4c5a722d3e0f875b69054d88b8bab94e9394ba8d28937f1ffd871d1666a377620e7f032633fe58ebc87e533bd6461b537cdde38352ece085378dd7b24fa3fd5a3dc3f5b77492e4fc91238a8bfcc4e20bb396bd3317155981ec593926f2e9f15e5ac1aa533e122441649a681d88142a93386a6ed6b2d5b18d7fb57541e31a69acee17345b08c6667ebbc53a082fbcd980b4751937ba729dd2fd9b43d06091517922dd3ea524db002db7525902a465081843191d2d7ac76adb7724ac2bb88e4cb2f3188dbf0cd47acf5011b4519ec100a44b2ee6a1dacac5aade2cdcdca777c6b5edf596b05691d247f671491f68bf2e04007e8674309ea98ab794d05c664ade246288796270e10f4a308420a62bf0df1d1636330e88bf4cc78051e5f715c8f97b8a83119b3fb5129ac6d0733256bec96d8cf435fa005e14d88884a0ca24266a4e78e25e2519796ba31971e4d0cb44ea58c5ddf54a15e3b449642e395679fc5ba600cc6bb7f2b004bfb0d621e51f9cf16309e4a02ce4f23f4a2d225aa8c84840bf2d3522a5f7a983cfbbfe4adb62d6ea622ebb784072bc6673878c5eaa865a7657b619f48cf0c51a4b0d47b20f426adc7f8ab68238b97abf68443f0eaac3796bfd99e0bc644e4f6fc43e551eccd615db802dfb031444e09aedcb04846bb894a2cf42dd0a578dc94d727736e502194ae25bf8556373969cb7f27788b6edf5b2bf25a79c7f89289f827ed4be611d65f6bd89698b130aaadd0f2d914819f41a0185dfc73adcea80d2ee592bf32d15010cb32a95ef112bccb2b780b461637ffa1641d34e1b114cdd3dd1ceb365933efef1781f9ec620a73097594c945969c2ea036e36b2380b33599c3e1d4eb2b7f210324aee3bba5a944b71cf0246ceed878897fe00e30d0bd32b3dde08c8805e30efe39cbc9d11b97491d82fbb5d93b1997e5f3128252472ecd256b9f79611175b6f686629ee744d0ba2494607a4476ea5f934c936403509c14bddbc2403ad5d97bfed0da36707b66f39ffdcee7ab39602e740c1ca9761570cdbab5f56b2060db428921457445b15c4c92b9c4b0ebb0746936bc3053836fa884e97c96e44d18a5a52feca033ec4caf950927bf9a281ea1aacb2a8b1a1f74b20de25ad5f3e459ab8b61ba5d00eaedcb6b5467dcd8608cfd48cc8c1a01f2c9f68bc9ef9adf2fd81cb3e28277c52d58f42ea87c8896383c2fa88dd15dba7172990893fe28ad1b50095b2ca20856de64693f3a663be6e34a9ccbb09add5724c5599495d0c95d2b900444651048bf418070b324016678d694b82565931159ffc37d3eefd7b482c41637cdd69b8f7051b6e88cf87a01d26d0689057ca0f66f65a2c3fbca608f7dec52d8e41ea98d21be162eeb38b27e9465d5525e0ffac3bd989adae19bdcf98edc48ff9d9d2a2f0850fa2cac8421ee6e211b1930f9fe9cb7138e8058ae476aa93c0ca49b170eb4ebbbb6fb4020d000eae537b4dd4bdfc63e3fb281848c057b900c14dc12f8833d5ada50c8f0178137964c3b1524c59eae7ae19066a8003b9f4036b0be91f6f24baf6839f360473907135a8eb777dfe4dcf18d15fb8e16d069c48c5a128f046667f66bb22d36e986c73d2ebaa1a9638a9e8c049d0c766e2008fb19c4aabd96e3443c48377214b01dec0f73538fa5a882553a60664e549030fc9cc21a74a73cf79cfdbbfa3676a474910a295044d804b9f6a30104fc8250da4efcfddc379c3a1b84a2050ee78b18ba84ec5cb4db62540ea7be026b48d2b9294f06aa48e44087dbc494d92fe3e8648792c2b9f5d0d580afac814f8fc74208239b5f8fa6c20fc75c9d73fbe448a4fd1eb1af10165c37e7aa72c83c47dbb92bf3203bc0bea3b3ae261636b9a6b621725aed16de5c33502f152ca3704b1e83a60cfc5807177d9e561b12f43c3ded0951c4ec7af0ab29f55e3745df0f10bedcdcee2d443c0023d7547018c94e2cbb04a5c67a81d33df4dda99f80777b1db00f91bf8abb96ca360353c08b8979d00860ee3af86988171d6739a0f546f64ec34c045afd1be790176228204782836484f6d118d734c8e1b302788aa20e704502da74cd11bc5a22bb717a1d10d5176a4426e88cc132479aa7e8370772b9776ea38d5bd217b08c50f94072acbdf93e732e6ce41f92159b626e59e39925b458465ec3b0191a56d8e1c3a76110200e38380ccfcc1a05f85608bc3ea0bdbbf326bfe003158c8c9e01e90a7b1164cc20de5b23146baa978611100", 0x2000, 0x0) r0 = syz_usb_connect(0x0, 0x3f, &(0x7f00000000c0)=ANY=[@ANYBLOB="11010000733336088dee1adb23610000000109022d0001100000000904000003fe03010009cd8d1f00020000000905050200000000100905"], 0x0) syz_usb_control_io(r0, 0x0, &(0x7f0000000300)={0x44, &(0x7f0000000100)=ANY=[], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) (async) r1 = syz_open_dev$char_usb(0xc, 0xb4, 0x0) ioctl$FS_IOC_GETVERSION(r1, 0x40015b19, &(0x7f0000000040)) (async) r2 = bpf$MAP_CREATE_CONST_STR(0x0, &(0x7f0000001280), 0x50) bpf$BPF_MAP_CONST_STR_FREEZE(0x16, &(0x7f00000000c0)={r2}, 0x4) (async) bpf$PROG_LOAD_XDP(0x5, &(0x7f0000000dc0)={0x6, 0x6, &(0x7f0000000640)=@framed={{0x18, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3}, [@map_fd={0x18, 0x0, 0x2, 0x0, r2}, @ldst={0x1, 0x0, 0x4}]}, &(0x7f0000000000)='syzkaller\x00', 0x6}, 0x94) executing program 2: openat$vnet(0xffffffffffffff9c, &(0x7f00000000c0), 0x2, 0x0) r0 = openat$userfaultfd(0xffffffffffffff9c, &(0x7f0000000040), 0x0, 0x0) r1 = ioctl$USERFAULTFD_IOC_NEW(r0, 0xaa00) ioctl$KVM_SET_MSRS(0xffffffffffffffff, 0x4008ae89, &(0x7f0000000380)={0x1, 0x0, [{0x40000075, 0x0, 0x1001}]}) r2 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000180), 0x0, 0x0) r3 = ioctl$KVM_CREATE_VM(r2, 0xae01, 0x0) r4 = ioctl$KVM_CREATE_VCPU(r3, 0xae41, 0x2) ioctl$KVM_GET_MSRS_cpu(r4, 0xc008ae88, &(0x7f0000000340)={0x10000000000000e6, 0x0, [{0x40000091, 0x0, 0x3}]}) ioctl$UFFDIO_API(r1, 0xc018aa3f, &(0x7f0000000240)) ioctl$UFFDIO_REGISTER(r1, 0xc020aa00, &(0x7f0000001080)={{&(0x7f0000ffc000/0x4000)=nil, 0x4000}, 0x3}) mlock2(&(0x7f0000ffc000/0x4000)=nil, 0x4000, 0x0) r5 = syz_open_procfs(0x0, &(0x7f00000000c0)='fd/3\x00') mount$9p_fd(0x0, &(0x7f00000001c0)='.\x00', &(0x7f0000000180), 0x0, &(0x7f0000000000)=ANY=[@ANYBLOB='trans=fd,rf', @ANYRESHEX=r5, @ANYBLOB]) executing program 2: r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000240), 0x0, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000040)={'syzkaller0\x00', 0x7101}) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000000)={0x0}, 0x1, 0x0, 0x0, 0x20044040}, 0x44040) r1 = socket$netlink(0x10, 0x3, 0x0) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f0000000300)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000100)=@newtaction={0x70, 0x30, 0x871a15abc695f30d, 0x5, 0x25dfdbfc, {}, [{0x5c, 0x1, [@m_sample={0x58, 0x1, 0x0, 0x0, {{0xb}, {0x2c, 0x2, 0x0, 0x1, [@TCA_SAMPLE_RATE={0x8, 0x3, 0x2}, @TCA_SAMPLE_PARMS={0x18, 0x2, {0x10000, 0x6e34, 0x4, 0x10, 0xffffffa6}}, @TCA_SAMPLE_PSAMPLE_GROUP={0x8}]}, {0x4}, {0xc}, {0xc, 0x8, {0x0, 0x3}}}}]}]}, 0x70}, 0x1, 0x0, 0x0, 0x4004045}, 0x80) sendmmsg(r1, &(0x7f00000002c0), 0x40000000000009f, 0x0) r2 = socket$unix(0x1, 0x1, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000140)='./bus\x00', 0x11d) mkdirat(0xffffffffffffff9c, &(0x7f0000000040)='./file0\x00', 0x1a2) capset(&(0x7f0000000080)={0x20080522}, &(0x7f00000000c0)={0x200004, 0x200004, 0x3}) mount$overlay(0x0, &(0x7f0000000000)='./file0\x00', &(0x7f0000000b80), 0x0, &(0x7f0000000180)={[{@workdir={'workdir', 0x3d, './bus'}}, {@lowerdir={'lowerdir', 0x3d, '.'}}, {@upperdir={'upperdir', 0x3d, './file0'}}]}) r3 = socket$kcm(0x11, 0x3, 0x0) r4 = openat$tun(0xffffffffffffff9c, &(0x7f0000000400), 0x0, 0x0) close(r4) r5 = socket$nl_route(0x10, 0x3, 0x0) r6 = socket$unix(0x1, 0x1, 0x0) ioctl$KVM_GET_VCPU_MMAP_SIZE(0xffffffffffffffff, 0xae04) ioctl$sock_SIOCGIFINDEX(r6, 0x8933, &(0x7f0000000100)={'syzkaller0\x00', 0x0}) sendmsg$nl_route_sched(r5, &(0x7f00000012c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000140)=@newqdisc={0x44, 0x24, 0x4ee4e6a52ff56541, 0x70bd2a, 0xffffffff, {0x0, 0x0, 0x0, r7, {0x0, 0xfff1}, {0xffff, 0xffff}}, [@qdisc_kind_options=@q_hfsc={{0x9}, {0x14, 0x2, @TCA_HFSC_FSC={0x10, 0x2, {0x4d, 0xfffffffb, 0x7fffffff}}}}]}, 0x44}, 0x1, 0x0, 0x0, 0x28000000}, 0x20040084) r8 = syz_open_dev$vim2m(&(0x7f00000 <> get/dummy_udc\x00', 0x2, 0x0) bpf$MAP_UPDATE_ELEM_TAIL_CALL(0x2, &(0x7f0000000380)={{}, &(0x7f0000000300), &(0x7f0000000340)=r0}, 0x20) mprotect(&(0x7f0000362000/0x2000)=nil, 0x2000, 0x1) write(r0, &(0x7f0000000200)="000000000902190001010080320904000001ff000000070581024000000902190001010080320904000001ff00000007058102000200120100020000004034127856000100000001", 0x48) r1 = openat(0xffffffffffffff9c, &(0x7f0000000000)='./gadget/ep1in-bulk\x00', 0x2, 0x24) write(r1, &(0x7f00000005c0)="010000000705810240000007058102000200", 0x12) r2 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r2, 0x8933, &(0x7f0000000040)={'bridge0\x00', 0x0}) sendmsg$nl_route(r2, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000440)=ANY=[@ANYBLOB="580000001000ffff27bd7000fadbdf2500000000", @ANYRES32=0x0, @ANYBLOB="15010000000000003000128009000100766c616e00000000200002800600050088a8000006000100010000000c000200130000001000000008000500", @ANYRES32=r3], 0x58}, 0x1, 0x0, 0x0, 0x880}, 0x8048802) madvise(&(0x7f0000bdc000/0x4000)=nil, 0x86ac726dff2f4713, 0xa) r4 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) getsockopt$bt_hci(r4, 0x0, 0x3, &(0x7f00000000c0)=""/151, &(0x7f0000000180)=0x97) r5 = syz_open_procfs(0xffffffffffffffff, &(0x7f0000000000)='attr/fscreate\x00') write$P9_RRENAME(r5, 0x0, 0x0) r6 = syz_open_dev$dvb_dvr(&(0x7f0000000280), 0x7, 0x111400) ioctl$DVB_DVR_DMX_EXPBUF(r6, 0xc00c6f3e, &(0x7f0000000040)={0x200, 0x80000, r5}) socket$inet_sctp(0x2, 0x5, 0x84) r7 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000000)='hugetlb.2MB.rsvd.usage_in_bytes\x00', 0x275a, 0x0) mmap(&(0x7f0000215000/0x1000)=nil, 0x1000, 0x0, 0x6011, r7, 0x0) mmap(&(0x7f0000ffa000/0x3000)=nil, 0x3000, 0x200000c, 0x11, r7, 0xaa0f4000) mmap(&(0x7f0000362000/0x4000)=nil, 0x4000, 0x0, 0x12, r7, 0xfffff000) setsockopt$inet_sctp_SCTP_SOCKOPT_BINDX_ADD(r7, 0x84, 0x64, &(0x7f0000000080)=[@in={0x2, 0x4e22, @local}], 0x10) r8 = syz_clone(0x21000200, 0x0, 0x0, 0x0, 0x0, 0x0) rt_tgsigqueueinfo(r8, r8, 0x8, 0x0) r9 = syz_pidfd_open(r8, 0x0) setns(r9, 0x24020000) syz_clone(0xa3802080, 0x0, 0x0, 0x0, 0x0, 0x0) signalfd(r7, &(0x7f00000000c0)={[0xea]}, 0x8) executing program 8: r0 = socket(0x10, 0x3, 0x0) sendmsg$nl_route(0xffffffffffffffff, &(0x7f0000000300)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000100)=ANY=[@ANYBLOB="4800e80010000d0428bd7000fcdbff2500008000", @ANYRES32=r0, @ANYBLOB="1000000000000000280012800b00010062726964676500001800028005001900840000000c001e"], 0x48}}, 0x4084) sendmsg$nl_route(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000080)={&(0x7f00000001c0)=ANY=[@ANYBLOB="500000001000010425bbe5ad600027842cf52300", @ANYRES32=0x0, @ANYRESDEC=0x0, @ANYRES64=r0, @ANYRES16=r0], 0x50}, 0x1, 0x0, 0x0, 0x13d33d22c8a65c15}, 0x4008840) getsockopt$inet_sctp6_SCTP_NODELAY(r0, 0x84, 0x3, &(0x7f0000000280), &(0x7f00000002c0)=0x4) mkdirat(0xffffffffffffff9c, &(0x7f0000000040)='./mnt\x00', 0x1ff) mount$nfs(&(0x7f0000000080)=':27.0.0.1:/export\x00', &(0x7f00000000c0)='./mnt\x00', &(0x7f0000000180), 0x20800, &(0x7f0000000140)=ANY=[@ANYRES16=r0]) r1 = socket$inet6_icmp_raw(0xa, 0x3, 0x3a) bind$inet6(r1, &(0x7f00000001c0)={0xa, 0x4e20, 0xfffffffb, @empty, 0x2}, 0x1c) sendmmsg(r0, &(0x7f0000000000), 0x4000000000001f2, 0x0) r2 = socket$inet6_sctp(0xa, 0x1, 0x84) r3 = dup(r2) setsockopt$inet_sctp6_SCTP_SOCKOPT_BINDX_ADD(r3, 0x84, 0x64, &(0x7f0000000040)=[@in6={0xa, 0x4e24, 0x6, @loopback, 0x3}], 0x1c) getsockopt$inet_sctp_SCTP_GET_ASSOC_STATS(r3, 0x84, 0x70, &(0x7f0000000680)={0x0, @in6={{0xa, 0x4e22, 0x1, @ipv4={'\x00', '\xff\xff', @multicast1}, 0x8}}, [0xfffffffffffffffa, 0x3, 0x7, 0x3, 0x4, 0x3, 0xc, 0x8, 0x3, 0x5, 0x7, 0x100000000, 0x6, 0x2, 0x6]}, &(0x7f00000007c0)=0x100) r4 = socket$packet(0x11, 0x2, 0x300) r5 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r5, 0x8933, &(0x7f0000000040)={'ip6gretap0\x00', 0x0}) sendto$packet(r4, 0x0, 0x0, 0x0, &(0x7f0000000400)={0x11, 0x88a8, r6, 0x1, 0x0, 0x6, @local}, 0x14) r7 = openat$selinux_checkreqprot(0xffffffffffffff9c, &(0x7f0000000200), 0xa00, 0x0) io_uring_register$IORING_REGISTER_FILES(r3, 0x2, &(0x7f0000000240)=[r0, r0, r7, r0, r0, r0, r0], 0x7) executing program 4: r0 = syz_open_dev$dri(&(0x7f0000000000), 0x0, 0x0) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r0, 0xc02064b2, &(0x7f0000000040)={0x1, 0xd00, 0x6}) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r0, 0xc02064b2, &(0x7f0000000100)={0x1, 0x3, 0x9}) ioctl$DRM_IOCTL_PANTHOR_VM_CREATE(r0, 0xc0106441, &(0x7f0000000080)={0x0, 0x0, 0xffffffffffffffff}) socket$kcm(0xa, 0x2, 0x0) socket$nl_route(0x10, 0x3, 0x0) r1 = socket(0x10, 0x3, 0x0) getsockname$packet(r1, &(0x7f00000002c0)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000100)=0x14) sendmsg$nl_route(0xffffffffffffffff, &(0x7f0000000040)={0x0, 0x0, 0x0}, 0x0) sendmsg$IPSET_CMD_ADD(0xffffffffffffffff, 0x0, 0x0) sendmsg$IPSET_CMD_TEST(0xffffffffffffffff, &(0x7f0000000280)={0x0, 0x0, &(0x7f00000002c0)={&(0x7f0000000300)={0x48, 0xb, 0x6, 0x1, 0x0, 0x0, {0x2}, [@IPSET_ATTR_SETNAME={0x9, 0x2, 'syz1\x00'}, @IPSET_ATTR_DATA={0x28, 0x7, 0x0, 0x1, [@IPSET_ATTR_IP={0xc, 0x1, 0x0, 0x1, @IPSET_ATTR_IPADDR_IPV4={0x8, 0x1, 0x1, 0x0, @local}}, @IPSET_ATTR_PORT={0x6, 0x4, 0x1, 0x0, 0x5000}, @IPSET_ATTR_MARK={0x8, 0xa, 0x1, 0x0, 0xc}, @IPSET_ATTR_CIDR2={0x5, 0x15, 0x18}]}]}, 0x48}}, 0x0) socket$inet6_udp(0xa, 0x2, 0x0) socket(0x10, 0x803, 0x0) socket(0x10, 0x3, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./config\x00', 0x1ff) mount(0x0, &(0x7f0000000000)='./config\x00', &(0x7f0000000080)='configfs\x00', 0x0, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000140)='./config/usb_gadget/g1\x00', 0xbf) mkdirat(0xffffffffffffff9c, &(0x7f00000001c0)='./config/usb_gadget/g1/functions/uvc.0\x00', 0x1ff) mkdirat(0xffffffffffffff9c, &(0x7f0000000280)='./config/usb_gadget/g1/functions/uvc.0/streaming/mjpeg/m1\x00', 0x1ff) r2 = openat(0xffffffffffffff9c, &(0x7f00000002c0)='./config/usb_gadget/g1/functions/uvc.0/streaming/mjpeg/m1/bmaControls\x00', 0x2, 0x0) write(r2, &(0x7f0000000640)='12', 0x2) write$P9_RVERSION(r2, &(0x7f0000000180)={0x13, 0x65, 0xffff, 0x1017, 0xffffffffffffff96, '9P2000.L'}, 0x13) syz_usb_connect$midi(0x0, 0x4f, &(0x7f0000000280)=ANY=[], 0x0) r3 = socket$nl_route(0x10, 0x3, 0x0) ioctl$ifreq_SIOCGIFINDEX_vcan(r3, 0x8933, &(0x7f0000000040)={'vxcan0\x00'}) getuid() r4 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPSET_CMD_CREATE(r4, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000200)=ANY=[@ANYBLOB="600000000206010800000000000000000000000005000400000000000900020073797a31000000001400078008001240000000000500140008000000050005000a000000050001000600000011000300686173683a69702c706f7274"], 0x60}}, 0x24000800) r5 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPSET_CMD_ADD(r5, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000240)={&(0x7f0000000c80)=ANY=[@ANYBLOB="5c000000090601080000000000000000070000000900020073797a31000000000500010007000000340007801800018014000240fe8000000000000000000000000000bb060004400e1f00cd050007008800000006000540"], 0x5c}, 0x1, 0x0, 0x0, 0x10000042}, 0x90) program crashed: KASAN: slab-use-after-free Read in ep_open testing program (duration=2m31.5s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): [1, 30, 19, 30] detailed listing: executing program 0: socket$nl_netfilter(0x10, 0x3, 0xc) executing program 3: mkdirat(0xffffffffffffff9c, &(0x7f0000000100)='./gadget\x00', 0x1ff) mount(0x0, &(0x7f0000000140)='./gadget\x00', &(0x7f0000000180)='gadgetfs\x00', 0x0, 0x0) r0 = openat(0xffffffffffffff9c, &(0x7f00000001c0)='./gadget/dummy_udc\x00', 0x2, 0x0) bpf$MAP_UPDATE_ELEM_TAIL_CALL(0x2, &(0x7f0000000380)={{}, &(0x7f0000000300), &(0x7f0000000340)=r0}, 0x20) mprotect(&(0x7f0000362000/0x2000)=nil, 0x2000, 0x1) write(r0, &(0x7f0000000200)="000000000902190001010080320904000001ff000000070581024000000902190001010080320904000001ff00000007058102000200120100020000004034127856000100000001", 0x48) r1 = openat(0xffffffffffffff9c, &(0x7f0000000000)='./gadget/ep1in-bulk\x00', 0x2, 0x24) write(r1, &(0x7f00000005c0)="010000000705810240000007058102000200", 0x12) r2 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r2, 0x8933, &(0x7f0000000040)={'bridge0\x00', 0x0}) sendmsg$nl_route(r2, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000440)=ANY=[@ANYBLOB="580000001000ffff27bd7000fadbdf2500000000", @ANYRES32=0x0, @ANYBLOB="15010000000000003000128009000100766c616e00000000200002800600050088a8000006000100010000000c000200130000001000000008000500", @ANYRES32=r3], 0x58}, 0x1, 0x0, 0x0, 0x880}, 0x8048802) madvise(&(0x7f0000bdc000/0x4000)=nil, 0x86ac726dff2f4713, 0xa) r4 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) getsockopt$bt_hci(r4, 0x0, 0x3, &(0x7f00000000c0)=""/151, &(0x7f0000000180)=0x97) r5 = syz_open_procfs(0xffffffffffffffff, &(0x7f0000000000)='attr/fscreate\x00') write$P9_RRENAME(r5, 0x0, 0x0) r6 = syz_open_dev$dvb_dvr(&(0x7f0000000280), 0x7, 0x111400) ioctl$DVB_DVR_DMX_EXPBUF(r6, 0xc00c6f3e, &(0x7f0000000040)={0x200, 0x80000, r5}) socket$inet_sctp(0x2, 0x5, 0x84) r7 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000000)='hugetlb.2MB.rsvd.usage_in_bytes\x00', 0x275a, 0x0) mmap(&(0x7f0000215000/0x1000)=nil, 0x1000, 0x0, 0x6011, r7, 0x0) mmap(&(0x7f0000ffa000/0x3000)=nil, 0x3000, 0x200000c, 0x11, r7, 0xaa0f4000) mmap(&(0x7f0000362000/0x4000)=nil, 0x4000, 0x0, 0x12, r7, 0xfffff000) setsockopt$inet_sctp_SCTP_SOCKOPT_BINDX_ADD(r7, 0x84, 0x64, &(0x7f0000000080)=[@in={0x2, 0x4e22, @local}], 0x10) r8 = syz_clone(0x21000200, 0x0, 0x0, 0x0, 0x0, 0x0) rt_tgsigqueueinfo(r8, r8, 0x8, 0x0) r9 = syz_pidfd_open(r8, 0x0) setns(r9, 0x24020000) syz_clone(0xa3802080, 0x0, 0x0, 0x0, 0x0, 0x0) signalfd(r7, &(0x7f00000000c0)={[0xea]}, 0x8) executing program 8: r0 = socket(0x10, 0x3, 0x0) sendmsg$nl_route(0xffffffffffffffff, &(0x7f0000000300)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000100)=ANY=[@ANYBLOB="4800e80010000d0428bd7000fcdbff2500008000", @ANYRES32=r0, @ANYBLOB="1000000000000000280012800b00010062726964676500001800028005001900840000000c001e"], 0x48}}, 0x4084) sendmsg$nl_route(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000080)={&(0x7f00000001c0)=ANY=[@ANYBLOB="500000001000010425bbe5ad600027842cf52300", @ANYRES32=0x0, @ANYRESDEC=0x0, @ANYRES64=r0, @ANYRES16=r0], 0x50}, 0x1, 0x0, 0x0, 0x13d33d22c8a65c15}, 0x4008840) getsockopt$inet_sctp6_SCTP_NODELAY(r0, 0x84, 0x3, &(0x7f0000000280), &(0x7f00000002c0)=0x4) mkdirat(0xffffffffffffff9c, &(0x7f0000000040)='./mnt\x00', 0x1ff) mount$nfs(&(0x7f0000000080)=':27.0.0.1:/export\x00', &(0x7f00000000c0)='./mnt\x00', &(0x7f0000000180), 0x20800, &(0x7f0000000140)=ANY=[@ANYRES16=r0]) r1 = socket$inet6_icmp_raw(0xa, 0x3, 0x3a) bind$inet6(r1, &(0x7f00000001c0)={0xa, 0x4e20, 0xfffffffb, @empty, 0x2}, 0x1c) sendmmsg(r0, &(0x7f0000000000), 0x4000000000001f2, 0x0) r2 = socket$inet6_sctp(0xa, 0x1, 0x84) r3 = dup(r2) setsockopt$inet_sctp6_SCTP_SOCKOPT_BINDX_ADD(r3, 0x84, 0x64, &(0x7f0000000040)=[@in6={0xa, 0x4e24, 0x6, @loopback, 0x3}], 0x1c) getsockopt$inet_sctp_SCTP_GET_ASSOC_STATS(r3, 0x84, 0x70, &(0x7f0000000680)={0x0, @in6={{0xa, 0x4e22, 0x1, @ipv4={'\x00', '\xff\xff', @multicast1}, 0x8}}, [0xfffffffffffffffa, 0x3, 0x7, 0x3, 0x4, 0x3, 0xc, 0x8, 0x3, 0x5, 0x7, 0x100000000, 0x6, 0x2, 0x6]}, &(0x7f00000007c0)=0x100) r4 = socket$packet(0x11, 0x2, 0x300) r5 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r5, 0x8933, &(0x7f0000000040)={'ip6gretap0\x00', 0x0}) sendto$packet(r4, 0x0, 0x0, 0x0, &(0x7f0000000400)={0x11, 0x88a8, r6, 0x1, 0x0, 0x6, @local}, 0x14) r7 = openat$selinux_checkreqprot(0xffffffffffffff9c, &(0x7f0000000200), 0xa00, 0x0) io_uring_register$IORING_REGISTER_FILES(r3, 0x2, &(0x7f0000000240)=[r0, r0, r7, r0, r0, r0, r0], 0x7) executing program 4: r0 = syz_open_dev$dri(&(0x7f0000000000), 0x0, 0x0) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r0, 0xc02064b2, &(0x7f0000000040)={0x1, 0xd00, 0x6}) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r0, 0xc02064b2, &(0x7f0000000100)={0x1, 0x3, 0x9}) ioctl$DRM_IOCTL_PANTHOR_VM_CREATE(r0, 0xc0106441, &(0x7f0000000080)={0x0, 0x0, 0xffffffffffffffff}) socket$kcm(0xa, 0x2, 0x0) socket$nl_route(0x10, 0x3, 0x0) r1 = socket(0x10, 0x3, 0x0) getsockname$packet(r1, &(0x7f00000002c0)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000100)=0x14) sendmsg$nl_route(0xffffffffffffffff, &(0x7f0000000040)={0x0, 0x0, 0x0}, 0x0) sendmsg$IPSET_CMD_ADD(0xffffffffffffffff, 0x0, 0x0) sendmsg$IPSET_CMD_TEST(0xffffffffffffffff, &(0x7f0000000280)={0x0, 0x0, &(0x7f00000002c0)={&(0x7f0000000300)={0x48, 0xb, 0x6, 0x1, 0x0, 0x0, {0x2}, [@IPSET_ATTR_SETNAME={0x9, 0x2, 'syz1\x00'}, @IPSET_ATTR_DATA={0x28, 0x7, 0x0, 0x1, [@IPSET_ATTR_IP={0xc, 0x1, 0x0, 0x1, @IPSET_ATTR_IPADDR_IPV4={0x8, 0x1, 0x1, 0x0, @local}}, @IPSET_ATTR_PORT={0x6, 0x4, 0x1, 0x0, 0x5000}, @IPSET_ATTR_MARK={0x8, 0xa, 0x1, 0x0, 0xc}, @IPSET_ATTR_CIDR2={0x5, 0x15, 0x18}]}]}, 0x48}}, 0x0) socket$inet6_udp(0xa, 0x2, 0x0) socket(0x10, 0x803, 0x0) socket(0x10, 0x3, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./config\x00', 0x1ff) mount(0x0, &(0x7f0000000000)='./config\x00', &(0x7f0000000080)='configfs\x00', 0x0, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000140)='./config/usb_gadget/g1\x00', 0xbf) mkdirat(0xffffffffffffff9c, &(0x7f00000001c0)='./config/usb_gadget/g1/functions/uvc.0\x00', 0x1ff) mkdirat(0xffffffffffffff9c, &(0x7f0000000280)='./config/usb_gadget/g1/functions/uvc.0/streaming/mjpeg/m1\x00', 0x1ff) r2 = openat(0xffffffffffffff9c, &(0x7f00000002c0)='./config/usb_gadget/g1/functions/uvc.0/streaming/mjpeg/m1/bmaControls\x00', 0x2, 0x0) write(r2, &(0x7f0000000640)='12', 0x2) write$P9_RVERSION(r2, &(0x7f0000000180)={0x13, 0x65, 0xffff, 0x1017, 0xffffffffffffff96, '9P2000.L'}, 0x13) syz_usb_connect$midi(0x0, 0x4f, &(0x7f0000000280)=ANY=[], 0x0) r3 = socket$nl_route(0x10, 0x3, 0x0) ioctl$ifreq_SIOCGIFINDEX_vcan(r3, 0x8933, &(0x7f0000000040)={'vxcan0\x00'}) getuid() r4 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPSET_CMD_CREATE(r4, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000200)=ANY=[@ANYBLOB="600000000206010800000000000000000000000005000400000000000900020073797a31000000001400078008001240000000000500140008000000050005000a000000050001000600000011000300686173683a69702c706f7274"], 0x60}}, 0x24000800) r5 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPSET_CMD_ADD(r5, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000240)={&(0x7f0000000c80)=ANY=[@ANYBLOB="5c000000090601080000000000000000070000000900020073797a31000000000500010007000000340007801800018014000240fe8000000000000000000000000000bb060004400e1f00cd050007008800000006000540"], 0x5c}, 0x1, 0x0, 0x0, 0x10000042}, 0x90) program crashed: KASAN: slab-use-after-free Read in ep_open testing program (duration=2m31.5s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): [0, 30, 19, 30] detailed listing: executing program 0: executing program 3: mkdirat(0xffffffffffffff9c, &(0x7f0000000100)='./gadget\x00', 0x1ff) mount(0x0, &(0x7f0000000140)='./gadget\x00', &(0x7f0000000180)='gadgetfs\x00', 0x0, 0x0) r0 = openat(0xffffffffffffff9c, &(0x7f00000001c0)='./gadget/dummy_udc\x00', 0x2, 0x0) bpf$MAP_UPDATE_ELEM_TAIL_CALL(0x2, &(0x7f0000000380)={{}, &(0x7f0000000300), &(0x7f0000000340)=r0}, 0x20) mprotect(&(0x7f0000362000/0x2000)=nil, 0x2000, 0x1) write(r0, &(0x7f0000000200)="000000000902190001010080320904000001ff000000070581024000000902190001010080320904000001ff00000007058102000200120100020000004034127856000100000001", 0x48) r1 = openat(0xffffffffffffff9c, &(0x7f0000000000)='./gadget/ep1in-bulk\x00', 0x2, 0x24) write(r1, &(0x7f00000005c0)="010000000705810240000007058102000200", 0x12) r2 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r2, 0x8933, &(0x7f0000000040)={'bridge0\x00', 0x0}) sendmsg$nl_route(r2, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000440)=ANY=[@ANYBLOB="580000001000ffff27bd7000fadbdf2500000000", @ANYRES32=0x0, @ANYBLOB="15010000000000003000128009000100766c616e00000000200002800600050088a8000006000100010000000c000200130000001000000008000500", @ANYRES32=r3], 0x58}, 0x1, 0x0, 0x0, 0x880}, 0x8048802) madvise(&(0x7f0000bdc000/0x4000)=nil, 0x86ac726dff2f4713, 0xa) r4 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) getsockopt$bt_hci(r4, 0x0, 0x3, &(0x7f00000000c0)=""/151, &(0x7f0000000180)=0x97) r5 = syz_open_procfs(0xffffffffffffffff, &(0x7f0000000000)='attr/fscreate\x00') write$P9_RRENAME(r5, 0x0, 0x0) r6 = syz_open_dev$dvb_dvr(&(0x7f0000000280), 0x7, 0x111400) ioctl$DVB_DVR_DMX_EXPBUF(r6, 0xc00c6f3e, &(0x7f0000000040)={0x200, 0x80000, r5}) socket$inet_sctp(0x2, 0x5, 0x84) r7 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000000)='hugetlb.2MB.rsvd.usage_in_bytes\x00', 0x275a, 0x0) mmap(&(0x7f0000215000/0x1000)=nil, 0x1000, 0x0, 0x6011, r7, 0x0) mmap(&(0x7f0000ffa000/0x3000)=nil, 0x3000, 0x200000c, 0x11, r7, 0xaa0f4000) mmap(&(0x7f0000362000/0x4000)=nil, 0x4000, 0x0, 0x12, r7, 0xfffff000) setsockopt$inet_sctp_SCTP_SOCKOPT_BINDX_ADD(r7, 0x84, 0x64, &(0x7f0000000080)=[@in={0x2, 0x4e22, @local}], 0x10) r8 = syz_clone(0x21000200, 0x0, 0x0, 0x0, 0x0, 0x0) rt_tgsigqueueinfo(r8, r8, 0x8, 0x0) r9 = syz_pidfd_open(r8, 0x0) setns(r9, 0x24020000) syz_clone(0xa3802080, 0x0, 0x0, 0x0, 0x0, 0x0) signalfd(r7, &(0x7f00000000c0)={[0xea]}, 0x8) executing program 8: r0 = socket(0x10, 0x3, 0x0) sendmsg$nl_route(0xffffffffffffffff, &(0x7f0000000300)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000100)=ANY=[@ANYBLOB="4800e80010000d0428bd7000fcdbff2500008000", @ANYRES32=r0, @ANYBLOB="1000000000000000280012800b00010062726964676500001800028005001900840000000c001e"], 0x48}}, 0x4084) sendmsg$nl_route(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000080)={&(0x7f00000001c0)=ANY=[@ANYBLOB="500000001000010425bbe5ad600027842cf52300", @ANYRES32=0x0, @ANYRESDEC=0x0, @ANYRES64=r0, @ANYRES16=r0], 0x50}, 0x1, 0x0, 0x0, 0x13d33d22c8a65c15}, 0x4008840) getsockopt$inet_sctp6_SCTP_NODELAY(r0, 0x84, 0x3, &(0x7f0000000280), &(0x7f00000002c0)=0x4) mkdirat(0xffffffffffffff9c, &(0x7f0000000040)='./mnt\x00', 0x1ff) mount$nfs(&(0x7f0000000080)=':27.0.0.1:/export\x00', &(0x7f00000000c0)='./mnt\x00', &(0x7f0000000180), 0x20800, &(0x7f0000000140)=ANY=[@ANYRES16=r0]) r1 = socket$inet6_icmp_raw(0xa, 0x3, 0x3a) bind$inet6(r1, &(0x7f00000001c0)={0xa, 0x4e20, 0xfffffffb, @empty, 0x2}, 0x1c) sendmmsg(r0, &(0x7f0000000000), 0x4000000000001f2, 0x0) r2 = socket$inet6_sctp(0xa, 0x1, 0x84) r3 = dup(r2) setsockopt$inet_sctp6_SCTP_SOCKOPT_BINDX_ADD(r3, 0x84, 0x64, &(0x7f0000000040)=[@in6={0xa, 0x4e24, 0x6, @loopback, 0x3}], 0x1c) getsockopt$inet_sctp_SCTP_GET_ASSOC_STATS(r3, 0x84, 0x70, &(0x7f0000000680)={0x0, @in6={{0xa, 0x4e22, 0x1, @ipv4={'\x00', '\xff\xff', @multicast1}, 0x8}}, [0xfffffffffffffffa, 0x3, 0x7, 0x3, 0x4, 0x3, 0xc, 0x8, 0x3, 0x5, 0x7, 0x100000000, 0x6, 0x2, 0x6]}, &(0x7f00000007c0)=0x100) r4 = socket$packet(0x11, 0x2, 0x300) r5 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r5, 0x8933, &(0x7f0000000040)={'ip6gretap0\x00', 0x0}) sendto$packet(r4, 0x0, 0x0, 0x0, &(0x7f0000000400)={0x11, 0x88a8, r6, 0x1, 0x0, 0x6, @local}, 0x14) r7 = openat$selinux_checkreqprot(0xffffffffffffff9c, &(0x7f0000000200), 0xa00, 0x0) io_uring_register$IORING_REGISTER_FILES(r3, 0x2, &(0x7f0000000240)=[r0, r0, r7, r0, r0, r0, r0], 0x7) executing program 4: r0 = syz_open_dev$dri(&(0x7f0000000000), 0x0, 0x0) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r0, 0xc02064b2, &(0x7f0000000040)={0x1, 0xd00, 0x6}) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r0, 0xc02064b2, &(0x7f0000000100)={0x1, 0x3, 0x9}) ioctl$DRM_IOCTL_PANTHOR_VM_CREATE(r0, 0xc0106441, &(0x7f0000000080)={0x0, 0x0, 0xffffffffffffffff}) socket$kcm(0xa, 0x2, 0x0) socket$nl_route(0x10, 0x3, 0x0) r1 = socket(0x10, 0x3, 0x0) getsockname$packet(r1, &(0x7f00000002c0)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000100)=0x14) sendmsg$nl_route(0xffffffffffffffff, &(0x7f0000000040)={0x0, 0x0, 0x0}, 0x0) sendmsg$IPSET_CMD_ADD(0xffffffffffffffff, 0x0, 0x0) sendmsg$IPSET_CMD_TEST(0xffffffffffffffff, &(0x7f0000000280)={0x0, 0x0, &(0x7f00000002c0)={&(0x7f0000000300)={0x48, 0xb, 0x6, 0x1, 0x0, 0x0, {0x2}, [@IPSET_ATTR_SETNAME={0x9, 0x2, 'syz1\x00'}, @IPSET_ATTR_DATA={0x28, 0x7, 0x0, 0x1, [@IPSET_ATTR_IP={0xc, 0x1, 0x0, 0x1, @IPSET_ATTR_IPADDR_IPV4={0x8, 0x1, 0x1, 0x0, @local}}, @IPSET_ATTR_PORT={0x6, 0x4, 0x1, 0x0, 0x5000}, @IPSET_ATTR_MARK={0x8, 0xa, 0x1, 0x0, 0xc}, @IPSET_ATTR_CIDR2={0x5, 0x15, 0x18}]}]}, 0x48}}, 0x0) socket$inet6_udp(0xa, 0x2, 0x0) socket(0x10, 0x803, 0x0) socket(0x10, 0x3, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./config\x00', 0x1ff) mount(0x0, &(0x7f0000000000)='./config\x00', &(0x7f0000000080)='configfs\x00', 0x0, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000140)='./config/usb_gadget/g1\x00', 0xbf) mkdirat(0xffffffffffffff9c, &(0x7f00000001c0)='./config/usb_gadget/g1/functions/uvc.0\x00', 0x1ff) mkdirat(0xffffffffffffff9c, &(0x7f0000000280)='./config/usb_gadget/g1/functions/uvc.0/streaming/mjpeg/m1\x00', 0x1ff) r2 = openat(0xffffffffffffff9c, &(0x7f00000002c0)='./config/usb_gadget/g1/functions/uvc.0/streaming/mjpeg/m1/bmaControls\x00', 0x2, 0x0) write(r2, &(0x7f0000000640)='12', 0x2) write$P9_RVERSION(r2, &(0x7f0000000180)={0x13, 0x65, 0xffff, 0x1017, 0xffffffffffffff96, '9P2000.L'}, 0x13) syz_usb_connect$midi(0x0, 0x4f, &(0x7f0000000280)=ANY=[], 0x0) r3 = socket$nl_route(0x10, 0x3, 0x0) ioctl$ifreq_SIOCGIFINDEX_vcan(r3, 0x8933, &(0x7f0000000040)={'vxcan0\x00'}) getuid() r4 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPSET_CMD_CREATE(r4, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000200)=ANY=[@ANYBLOB="600000000206010800000000000000000000000005000400000000000900020073797a31000000001400078008001240000000000500140008000000050005000a000000050001000600000011000300686173683a69702c706f7274"], 0x60}}, 0x24000800) r5 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPSET_CMD_ADD(r5, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000240)={&(0x7f0000000c80)=ANY=[@ANYBLOB="5c000000090601080000000000000000070000000900020073797a31000000000500010007000000340007801800018014000240fe8000000000000000000000000000bb060004400e1f00cd050007008800000006000540"], 0x5c}, 0x1, 0x0, 0x0, 0x10000042}, 0x90) program crashed: KASAN: slab-use-after-free Read in ep_open minimized 4 calls -> 0 calls minimizing program #1 before concatenation testing program (duration=2m31.5s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): [0, 29, 19, 30] detailed listing: executing program 3: executing program 0: mkdirat(0xffffffffffffff9c, &(0x7f0000000100)='./gadget\x00', 0x1ff) mount(0x0, &(0x7f0000000140)='./gadget\x00', &(0x7f0000000180)='gadgetfs\x00', 0x0, 0x0) r0 = openat(0xffffffffffffff9c, &(0x7f00000001c0)='./gadget/dummy_udc\x00', 0x2, 0x0) bpf$MAP_UPDATE_ELEM_TAIL_CALL(0x2, &(0x7f0000000380)={{}, &(0x7f0000000300), &(0x7f0000000340)=r0}, 0x20) mprotect(&(0x7f0000362000/0x2000)=nil, 0x2000, 0x1) write(r0, &(0x7f0000000200)="000000000902190001010080320904000001ff000000070581024000000902190001010080320904000001ff00000007058102000200120100020000004034127856000100000001", 0x48) r1 = openat(0xffffffffffffff9c, &(0x7f0000000000)='./gadget/ep1in-bulk\x00', 0x2, 0x24) write(r1, &(0x7f00000005c0)="010000000705810240000007058102000200", 0x12) r2 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r2, 0x8933, &(0x7f0000000040)={'bridge0\x00', 0x0}) sendmsg$nl_route(r2, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000440)=ANY=[@ANYBLOB="580000001000ffff27bd7000fadbdf2500000000", @ANYRES32=0x0, @ANYBLOB="15010000000000003000128009000100766c616e00000000200002800600050088a8000006000100010000000c000200130000001000000008000500", @ANYRES32=r3], 0x58}, 0x1, 0x0, 0x0, 0x880}, 0x8048802) madvise(&(0x7f0000bdc000/0x4000)=nil, 0x86ac726dff2f4713, 0xa) r4 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) getsockopt$bt_hci(r4, 0x0, 0x3, &(0x7f00000000c0)=""/151, &(0x7f0000000180)=0x97) r5 = syz_open_procfs(0xffffffffffffffff, &(0x7f0000000000)='attr/fscreate\x00') write$P9_RRENAME(r5, 0x0, 0x0) r6 = syz_open_dev$dvb_dvr(&(0x7f0000000280), 0x7, 0x111400) ioctl$DVB_DVR_DMX_EXPBUF(r6, 0xc00c6f3e, &(0x7f0000000040)={0x200, 0x80000, r5}) socket$inet_sctp(0x2, 0x5, 0x84) r7 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000000)='hugetlb.2MB.rsvd.usage_in_bytes\x00', 0x275a, 0x0) mmap(&(0x7f0000215000/0x1000)=nil, 0x1000, 0x0, 0x6011, r7, 0x0) mmap(&(0x7f0000ffa000/0x3000)=nil, 0x3000, 0x200000c, 0x11, r7, 0xaa0f4000) mmap(&(0x7f0000362000/0x4000)=nil, 0x4000, 0x0, 0x12, r7, 0xfffff000) setsockopt$inet_sctp_SCTP_SOCKOPT_BINDX_ADD(r7, 0x84, 0x64, &(0x7f0000000080)=[@in={0x2, 0x4e22, @local}], 0x10) r8 = syz_clone(0x21000200, 0x0, 0x0, 0x0, 0x0, 0x0) rt_tgsigqueueinfo(r8, r8, 0x8, 0x0) r9 = syz_pidfd_open(r8, 0x0) setns(r9, 0x24020000) syz_clone(0xa3802080, 0x0, 0x0, 0x0, 0x0, 0x0) executing program 8: r0 = socket(0x10, 0x3, 0x0) sendmsg$nl_route(0xffffffffffffffff, &(0x7f0000000300)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000100)=ANY=[@ANYBLOB="4800e80010000d0428bd7000fcdbff2500008000", @ANYRES32=r0, @ANYBLOB="1000000000000000280012800b00010062726964676500001800028005001900840000000c001e"], 0x48}}, 0x4084) sendmsg$nl_route(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000080)={&(0x7f00000001c0)=ANY=[@ANYBLOB="500000001000010425bbe5ad600027842cf52300", @ANYRES32=0x0, @ANYRESDEC=0x0, @ANYRES64=r0, @ANYRES16=r0], 0x50}, 0x1, 0x0, 0x0, 0x13d33d22c8a65c15}, 0x4008840) getsockopt$inet_sctp6_SCTP_NODELAY(r0, 0x84, 0x3, &(0x7f0000000280), &(0x7f00000002c0)=0x4) mkdirat(0xffffffffffffff9c, &(0x7f0000000040)='./mnt\x00', 0x1ff) mount$nfs(&(0x7f0000000080)=':27.0.0.1:/export\x00', &(0x7f00000000c0)='./mnt\x00', &(0x7f0000000180), 0x20800, &(0x7f0000000140)=ANY=[@ANYRES16=r0]) r1 = socket$inet6_icmp_raw(0xa, 0x3, 0x3a) bind$inet6(r1, &(0x7f00000001c0)={0xa, 0x4e20, 0xfffffffb, @empty, 0x2}, 0x1c) sendmmsg(r0, &(0x7f0000000000), 0x4000000000001f2, 0x0) r2 = socket$inet6_sctp(0xa, 0x1, 0x84) r3 = dup(r2) setsockopt$inet_sctp6_SCTP_SOCKOPT_BINDX_ADD(r3, 0x84, 0x64, &(0x7f0000000040)=[@in6={0xa, 0x4e24, 0x6, @loopback, 0x3}], 0x1c) getsockopt$inet_sctp_SCTP_GET_ASSOC_STATS(r3, 0x84, 0x70, &(0x7f0000000680)={0x0, @in6={{0xa, 0x4e22, 0x1, @ipv4={'\x00', '\xff\xff', @multicast1}, 0x8}}, [0xfffffffffffffffa, 0x3, 0x7, 0x3, 0x4, 0x3, 0xc, 0x8, 0x3, 0x5, 0x7, 0x100000000, 0x6, 0x2, 0x6]}, &(0x7f00000007c0)=0x100) r4 = socket$packet(0x11, 0x2, 0x300) r5 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r5, 0x8933, &(0x7f0000000040)={'ip6gretap0\x00', 0x0}) sendto$packet(r4, 0x0, 0x0, 0x0, &(0x7f0000000400)={0x11, 0x88a8, r6, 0x1, 0x0, 0x6, @local}, 0x14) r7 = openat$selinux_checkreqprot(0xffffffffffffff9c, &(0x7f0000000200), 0xa00, 0x0) io_uring_register$IORING_REGISTER_FILES(r3, 0x2, &(0x7f0000000240)=[r0, r0, r7, r0, r0, r0, r0], 0x7) executing program 4: r0 = syz_open_dev$dri(&(0x7f0000000000), 0x0, 0x0) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r0, 0xc02064b2, &(0x7f0000000040)={0x1, 0xd00, 0x6}) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r0, 0xc02064b2, &(0x7f0000000100)={0x1, 0x3, 0x9}) ioctl$DRM_IOCTL_PANTHOR_VM_CREATE(r0, 0xc0106441, &(0x7f0000000080)={0x0, 0x0, 0xffffffffffffffff}) socket$kcm(0xa, 0x2, 0x0) socket$nl_route(0x10, 0x3, 0x0) r1 = socket(0x10, 0x3, 0x0) getsockname$packet(r1, &(0x7f00000002c0)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000100)=0x14) sendmsg$nl_route(0xffffffffffffffff, &(0x7f0000000040)={0x0, 0x0, 0x0}, 0x0) sendmsg$IPSET_CMD_ADD(0xffffffffffffffff, 0x0, 0x0) sendmsg$IPSET_CMD_TEST(0xffffffffffffffff, &(0x7f0000000280)={0x0, 0x0, &(0x7f00000002c0)={&(0x7f0000000300)={0x48, 0xb, 0x6, 0x1, 0x0, 0x0, {0x2}, [@IPSET_ATTR_SETNAME={0x9, 0x2, 'syz1\x00'}, @IPSET_ATTR_DATA={0x28, 0x7, 0x0, 0x1, [@IPSET_ATTR_IP={0xc, 0x1, 0x0, 0x1, @IPSET_ATTR_IPADDR_IPV4={0x8, 0x1, 0x1, 0x0, @local}}, @IPSET_ATTR_PORT={0x6, 0x4, 0x1, 0x0, 0x5000}, @IPSET_ATTR_MARK={0x8, 0xa, 0x1, 0x0, 0xc}, @IPSET_ATTR_CIDR2={0x5, 0x15, 0x18}]}]}, 0x48}}, 0x0) socket$inet6_udp(0xa, 0x2, 0x0) socket(0x10, 0x803, 0x0) socket(0x10, 0x3, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./config\x00', 0x1ff) mount(0x0, &(0x7f0000000000)='./config\x00', &(0x7f0000000080)='configfs\x00', 0x0, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000140)='./config/usb_gadget/g1\x00', 0xbf) mkdirat(0xffffffffffffff9c, &(0x7f00000001c0)='./config/usb_gadget/g1/functions/uvc.0\x00', 0x1ff) mkdirat(0xffffffffffffff9c, &(0x7f0000000280)='./config/usb_gadget/g1/functions/uvc.0/streaming/mjpeg/m1\x00', 0x1ff) r2 = openat(0xffffffffffffff9c, &(0x7f00000002c0)='./config/usb_gadget/g1/functions/uvc.0/streaming/mjpeg/m1/bmaControls\x00', 0x2, 0x0) write(r2, &(0x7f0000000640)='12', 0x2) write$P9_RVERSION(r2, &(0x7f0000000180)={0x13, 0x65, 0xffff, 0x1017, 0xffffffffffffff96, '9P2000.L'}, 0x13) syz_usb_connect$midi(0x0, 0x4f, &(0x7f0000000280)=ANY=[], 0x0) r3 = socket$nl_route(0x10, 0x3, 0x0) ioctl$ifreq_SIOCGIFINDEX_vcan(r3, 0x8933, &(0x7f0000000040)={'vxcan0\x00'}) getuid() r4 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPSET_CMD_CREATE(r4, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000200)=ANY=[@ANYBLOB="600000000206010800000000000000000000000005000400000000000900020073797a31000000001400078008001240000000000500140008000000050005000a000000050001000600000011000300686173683a69702c706f7274"], 0x60}}, 0x24000800) r5 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPSET_CMD_ADD(r5, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000240)={&(0x7f0000000c80)=ANY=[@ANYBLOB="5c000000090601080000000000000000070000000900020073797a31000000000500010007000000340007801800018014000240fe8000000000000000000000000000bb060004400e1f00cd050007008800000006000540"], 0x5c}, 0x1, 0x0, 0x0, 0x10000042}, 0x90) program crashed: KASAN: slab-use-after-free Read in ep_open testing program (duration=2m31.5s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): [0, 28, 19, 30] detailed listing: executing program 3: executing program 0: mkdirat(0xffffffffffffff9c, &(0x7f0000000100)='./gadget\x00', 0x1ff) mount(0x0, &(0x7f0000000140)='./gadget\x00', &(0x7f0000000180)='gadgetfs\x00', 0x0, 0x0) r0 = openat(0xffffffffffffff9c, &(0x7f00000001c0)='./gadget/dummy_udc\x00', 0x2, 0x0) bpf$MAP_UPDATE_ELEM_TAIL_CALL(0x2, &(0x7f0000000380)={{}, &(0x7f0000000300), &(0x7f0000000340)=r0}, 0x20) mprotect(&(0x7f0000362000/0x2000)=nil, 0x2000, 0x1) write(r0, &(0x7f0000000200)="000000000902190001010080320904000001ff000000070581024000000902190001010080320904000001ff00000007058102000200120100020000004034127856000100000001", 0x48) r1 = openat(0xffffffffffffff9c, &(0x7f0000000000)='./gadget/ep1in-bulk\x00', 0x2, 0x24) write(r1, &(0x7f00000005c0)="010000000705810240000007058102000200", 0x12) r2 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r2, 0x8933, &(0x7f0000000040)={'bridge0\x00', 0x0}) sendmsg$nl_route(r2, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000440)=ANY=[@ANYBLOB="580000001000ffff27bd7000fadbdf2500000000", @ANYRES32=0x0, @ANYBLOB="15010000000000003000128009000100766c616e00000000200002800600050088a8000006000100010000000c000200130000001000000008000500", @ANYRES32=r3], 0x58}, 0x1, 0x0, 0x0, 0x880}, 0x8048802) madvise(&(0x7f0000bdc000/0x4000)=nil, 0x86ac726dff2f4713, 0xa) r4 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) getsockopt$bt_hci(r4, 0x0, 0x3, &(0x7f00000000c0)=""/151, &(0x7f0000000180)=0x97) r5 = syz_open_procfs(0xffffffffffffffff, &(0x7f0000000000)='attr/fscreate\x00') write$P9_RRENAME(r5, 0x0, 0x0) r6 = syz_open_dev$dvb_dvr(&(0x7f0000000280), 0x7, 0x111400) ioctl$DVB_DVR_DMX_EXPBUF(r6, 0xc00c6f3e, &(0x7f0000000040)={0x200, 0x80000, r5}) socket$inet_sctp(0x2, 0x5, 0x84) r7 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000000)='hugetlb.2MB.rsvd.usage_in_bytes\x00', 0x275a, 0x0) mmap(&(0x7f0000215000/0x1000)=nil, 0x1000, 0x0, 0x6011, r7, 0x0) mmap(&(0x7f0000ffa000/0x3000)=nil, 0x3000, 0x200000c, 0x11, r7, 0xaa0f4000) mmap(&(0x7f0000362000/0x4000)=nil, 0x4000, 0x0, 0x12, r7, 0xfffff000) setsockopt$inet_sctp_SCTP_SOCKOPT_BINDX_ADD(r7, 0x84, 0x64, &(0x7f0000000080)=[@in={0x2, 0x4e22, @local}], 0x10) r8 = syz_clone(0x21000200, 0x0, 0x0, 0x0, 0x0, 0x0) rt_tgsigqueueinfo(r8, r8, 0x8, 0x0) r9 = syz_pidfd_open(r8, 0x0) setns(r9, 0x24020000) executing program 8: r0 = socket(0x10, 0x3, 0x0) sendmsg$nl_route(0xffffffffffffffff, &(0x7f0000000300)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000100)=ANY=[@ANYBLOB="4800e80010000d0428bd7000fcdbff2500008000", @ANYRES32=r0, @ANYBLOB="1000000000000000280012800b00010062726964676500001800028005001900840000000c001e"], 0x48}}, 0x4084) sendmsg$nl_route(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000080)={&(0x7f00000001c0)=ANY=[@ANYBLOB="500000001000010425bbe5ad600027842cf52300", @ANYRES32=0x0, @ANYRESDEC=0x0, @ANYRES64=r0, @ANYRES16=r0], 0x50}, 0x1, 0x0, 0x0, 0x13d33d22c8a65c15}, 0x4008840) getsockopt$inet_sctp6_SCTP_NODELAY(r0, 0x84, 0x3, &(0x7f0000000280), &(0x7f00000002c0)=0x4) mkdirat(0xffffffffffffff9c, &(0x7f0000000040)='./mnt\x00', 0x1ff) mount$nfs(&(0x7f0000000080)=':27.0.0.1:/export\x00', &(0x7f00000000c0)='./mnt\x00', &(0x7f0000000180), 0x20800, &(0x7f0000000140)=ANY=[@ANYRES16=r0]) r1 = socket$inet6_icmp_raw(0xa, 0x3, 0x3a) bind$inet6(r1, &(0x7f00000001c0)={0xa, 0x4e20, 0xfffffffb, @empty, 0x2}, 0x1c) sendmmsg(r0, &(0x7f0000000000), 0x4000000000001f2, 0x0) r2 = socket$inet6_sctp(0xa, 0x1, 0x84) r3 = dup(r2) setsockopt$inet_sctp6_SCTP_SOCKOPT_BINDX_ADD(r3, 0x84, 0x64, &(0x7f0000000040)=[@in6={0xa, 0x4e24, 0x6, @loopback, 0x3}], 0x1c) getsockopt$inet_sctp_SCTP_GET_ASSOC_STATS(r3, 0x84, 0x70, &(0x7f0000000680)={0x0, @in6={{0xa, 0x4e22, 0x1, @ipv4={'\x00', '\xff\xff', @multicast1}, 0x8}}, [0xfffffffffffffffa, 0x3, 0x7, 0x3, 0x4, 0x3, 0xc, 0x8, 0x3, 0x5, 0x7, 0x100000000, 0x6, 0x2, 0x6]}, &(0x7f00000007c0)=0x100) r4 = socket$packet(0x11, 0x2, 0x300) r5 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r5, 0x8933, &(0x7f0000000040)={'ip6gretap0\x00', 0x0}) sendto$packet(r4, 0x0, 0x0, 0x0, &(0x7f0000000400)={0x11, 0x88a8, r6, 0x1, 0x0, 0x6, @local}, 0x14) r7 = openat$selinux_checkreqprot(0xffffffffffffff9c, &(0x7f0000000200), 0xa00, 0x0) io_uring_register$IORING_REGISTER_FILES(r3, 0x2, &(0x7f0000000240)=[r0, r0, r7, r0, r0, r0, r0], 0x7) executing program 4: r0 = syz_open_dev$dri(&(0x7f0000000000), 0x0, 0x0) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r0, 0xc02064b2, &(0x7f0000000040)={0x1, 0xd00, 0x6}) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r0, 0xc02064b2, &(0x7f0000000100)={0x1, 0x3, 0x9}) ioctl$DRM_IOCTL_PANTHOR_VM_CREATE(r0, 0xc0106441, &(0x7f0000000080)={0x0, 0x0, 0xffffffffffffffff}) socket$kcm(0xa, 0x2, 0x0) socket$nl_route(0x10, 0x3, 0x0) r1 = socket(0x10, 0x3, 0x0) getsockname$packet(r1, &(0x7f00000002c0)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000100)=0x14) sendmsg$nl_route(0xffffffffffffffff, &(0x7f0000000040)={0x0, 0x0, 0x0}, 0x0) sendmsg$IPSET_CMD_ADD(0xffffffffffffffff, 0x0, 0x0) sendmsg$IPSET_CMD_TEST(0xffffffffffffffff, &(0x7f0000000280)={0x0, 0x0, &(0x7f00000002c0)={&(0x7f0000000300)={0x48, 0xb, 0x6, 0x1, 0x0, 0x0, {0x2}, [@IPSET_ATTR_SETNAME={0x9, 0x2, 'syz1\x00'}, @IPSET_ATTR_DATA={0x28, 0x7, 0x0, 0x1, [@IPSET_ATTR_IP={0xc, 0x1, 0x0, 0x1, @IPSET_ATTR_IPADDR_IPV4={0x8, 0x1, 0x1, 0x0, @local}}, @IPSET_ATTR_PORT={0x6, 0x4, 0x1, 0x0, 0x5000}, @IPSET_ATTR_MARK={0x8, 0xa, 0x1, 0x0, 0xc}, @IPSET_ATTR_CIDR2={0x5, 0x15, 0x18}]}]}, 0x48}}, 0x0) socket$inet6_udp(0xa, 0x2, 0x0) socket(0x10, 0x803, 0x0) socket(0x10, 0x3, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./config\x00', 0x1ff) mount(0x0, &(0x7f0000000000)='./config\x00', &(0x7f0000000080)='configfs\x00', 0x0, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000140)='./config/usb_gadget/g1\x00', 0xbf) mkdirat(0xffffffffffffff9c, &(0x7f00000001c0)='./config/usb_gadget/g1/functions/uvc.0\x00', 0x1ff) mkdirat(0xffffffffffffff9c, &(0x7f0000000280)='./config/usb_gadget/g1/functions/uvc.0/streaming/mjpeg/m1\x00', 0x1ff) r2 = openat(0xffffffffffffff9c, &(0x7f00000002c0)='./config/usb_gadget/g1/functions/uvc.0/streaming/mjpeg/m1/bmaControls\x00', 0x2, 0x0) write(r2, &(0x7f0000000640)='12', 0x2) write$P9_RVERSION(r2, &(0x7f0000000180)={0x13, 0x65, 0xffff, 0x1017, 0xffffffffffffff96, '9P2000.L'}, 0x13) syz_usb_connect$midi(0x0, 0x4f, &(0x7f0000000280)=ANY=[], 0x0) r3 = socket$nl_route(0x10, 0x3, 0x0) ioctl$ifreq_SIOCGIFINDEX_vcan(r3, 0x8933, &(0x7f0000000040)={'vxcan0\x00'}) getuid() r4 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPSET_CMD_CREATE(r4, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000200)=ANY=[@ANYBLOB="600000000206010800000000000000000000000005000400000000000900020073797a31000000001400078008001240000000000500140008000000050005000a000000050001000600000011000300686173683a69702c706f7274"], 0x60}}, 0x24000800) r5 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPSET_CMD_ADD(r5, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000240)={&(0x7f0000000c80)=ANY=[@ANYBLOB="5c000000090601080000000000000000070000000900020073797a31000000000500010007000000340007801800018014000240fe8000000000000000000000000000bb060004400e1f00cd050007008800000006000540"], 0x5c}, 0x1, 0x0, 0x0, 0x10000042}, 0x90) program crashed: KASAN: slab-use-after-free Read in ep_open testing program (duration=2m31.5s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): [0, 27, 19, 30] detailed listing: executing program 3: executing program 0: mkdirat(0xffffffffffffff9c, &(0x7f0000000100)='./gadget\x00', 0x1ff) mount(0x0, &(0x7f0000000140)='./gadget\x00', &(0x7f0000000180)='gadgetfs\x00', 0x0, 0x0) r0 = openat(0xffffffffffffff9c, &(0x7f00000001c0)='./gadget/dummy_udc\x00', 0x2, 0x0) bpf$MAP_UPDATE_ELEM_TAIL_CALL(0x2, &(0x7f0000000380)={{}, &(0x7f0000000300), &(0x7f0000000340)=r0}, 0x20) mprotect(&(0x7f0000362000/0x2000)=nil, 0x2000, 0x1) write(r0, &(0x7f0000000200)="000000000902190001010080320904000001ff000000070581024000000902190001010080320904000001ff00000007058102000200120100020000004034127856000100000001", 0x48) r1 = openat(0xffffffffffffff9c, &(0x7f0000000000)='./gadget/ep1in-bulk\x00', 0x2, 0x24) write(r1, &(0x7f00000005c0)="010000000705810240000007058102000200", 0x12) r2 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r2, 0x8933, &(0x7f0000000040)={'bridge0\x00', 0x0}) sendmsg$nl_route(r2, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000440)=ANY=[@ANYBLOB="580000001000ffff27bd7000fadbdf2500000000", @ANYRES32=0x0, @ANYBLOB="15010000000000003000128009000100766c616e00000000200002800600050088a8000006000100010000000c000200130000001000000008000500", @ANYRES32=r3], 0x58}, 0x1, 0x0, 0x0, 0x880}, 0x8048802) madvise(&(0x7f0000bdc000/0x4000)=nil, 0x86ac726dff2f4713, 0xa) r4 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) getsockopt$bt_hci(r4, 0x0, 0x3, &(0x7f00000000c0)=""/151, &(0x7f0000000180)=0x97) r5 = syz_open_procfs(0xffffffffffffffff, &(0x7f0000000000)='attr/fscreate\x00') write$P9_RRENAME(r5, 0x0, 0x0) r6 = syz_open_dev$dvb_dvr(&(0x7f0000000280), 0x7, 0x111400) ioctl$DVB_DVR_DMX_EXPBUF(r6, 0xc00c6f3e, &(0x7f0000000040)={0x200, 0x80000, r5}) socket$inet_sctp(0x2, 0x5, 0x84) r7 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000000)='hugetlb.2MB.rsvd.usage_in_bytes\x00', 0x275a, 0x0) mmap(&(0x7f0000215000/0x1000)=nil, 0x1000, 0x0, 0x6011, r7, 0x0) mmap(&(0x7f0000ffa000/0x3000)=nil, 0x3000, 0x200000c, 0x11, r7, 0xaa0f4000) mmap(&(0x7f0000362000/0x4000)=nil, 0x4000, 0x0, 0x12, r7, 0xfffff000) setsockopt$inet_sctp_SCTP_SOCKOPT_BINDX_ADD(r7, 0x84, 0x64, &(0x7f0000000080)=[@in={0x2, 0x4e22, @local}], 0x10) r8 = syz_clone(0x21000200, 0x0, 0x0, 0x0, 0x0, 0x0) rt_tgsigqueueinfo(r8, r8, 0x8, 0x0) syz_pidfd_open(r8, 0x0) executing program 8: r0 = socket(0x10, 0x3, 0x0) sendmsg$nl_route(0xffffffffffffffff, &(0x7f0000000300)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000100)=ANY=[@ANYBLOB="4800e80010000d0428bd7000fcdbff2500008000", @ANYRES32=r0, @ANYBLOB="1000000000000000280012800b00010062726964676500001800028005001900840000000c001e"], 0x48}}, 0x4084) sendmsg$nl_route(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000080)={&(0x7f00000001c0)=ANY=[@ANYBLOB="500000001000010425bbe5ad600027842cf52300", @ANYRES32=0x0, @ANYRESDEC=0x0, @ANYRES64=r0, @ANYRES16=r0], 0x50}, 0x1, 0x0, 0x0, 0x13d33d22c8a65c15}, 0x4008840) getsockopt$inet_sctp6_SCTP_NODELAY(r0, 0x84, 0x3, &(0x7f0000000280), &(0x7f00000002c0)=0x4) mkdirat(0xffffffffffffff9c, &(0x7f0000000040)='./mnt\x00', 0x1ff) mount$nfs(&(0x7f0000000080)=':27.0.0.1:/export\x00', &(0x7f00000000c0)='./mnt\x00', &(0x7f0000000180), 0x20800, &(0x7f0000000140)=ANY=[@ANYRES16=r0]) r1 = socket$inet6_icmp_raw(0xa, 0x3, 0x3a) bind$inet6(r1, &(0x7f00000001c0)={0xa, 0x4e20, 0xfffffffb, @empty, 0x2}, 0x1c) sendmmsg(r0, &(0x7f0000000000), 0x4000000000001f2, 0x0) r2 = socket$inet6_sctp(0xa, 0x1, 0x84) r3 = dup(r2) setsockopt$inet_sctp6_SCTP_SOCKOPT_BINDX_ADD(r3, 0x84, 0x64, &(0x7f0000000040)=[@in6={0xa, 0x4e24, 0x6, @loopback, 0x3}], 0x1c) getsockopt$inet_sctp_SCTP_GET_ASSOC_STATS(r3, 0x84, 0x70, &(0x7f0000000680)={0x0, @in6={{0xa, 0x4e22, 0x1, @ipv4={'\x00', '\xff\xff', @multicast1}, 0x8}}, [0xfffffffffffffffa, 0x3, 0x7, 0x3, 0x4, 0x3, 0xc, 0x8, 0x3, 0x5, 0x7, 0x100000000, 0x6, 0x2, 0x6]}, &(0x7f00000007c0)=0x100) r4 = socket$packet(0x11, 0x2, 0x300) r5 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r5, 0x8933, &(0x7f0000000040)={'ip6gretap0\x00', 0x0}) sendto$packet(r4, 0x0, 0x0, 0x0, &(0x7f0000000400)={0x11, 0x88a8, r6, 0x1, 0x0, 0x6, @local}, 0x14) r7 = openat$selinux_checkreqprot(0xffffffffffffff9c, &(0x7f0000000200), 0xa00, 0x0) io_uring_register$IORING_REGISTER_FILES(r3, 0x2, &(0x7f0000000240)=[r0, r0, r7, r0, r0, r0, r0], 0x7) executing program 4: r0 = syz_open_dev$dri(&(0x7f0000000000), 0x0, 0x0) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r0, 0xc02064b2, &(0x7f0000000040)={0x1, 0xd00, 0x6}) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r0, 0xc02064b2, &(0x7f0000000100)={0x1, 0x3, 0x9}) ioctl$DRM_IOCTL_PANTHOR_VM_CREATE(r0, 0xc0106441, &(0x7f0000000080)={0x0, 0x0, 0xffffffffffffffff}) socket$kcm(0xa, 0x2, 0x0) socket$nl_route(0x10, 0x3, 0x0) r1 = socket(0x10, 0x3, 0x0) getsockname$packet(r1, &(0x7f00000002c0)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000100)=0x14) sendmsg$nl_route(0xffffffffffffffff, &(0x7f0000000040)={0x0, 0x0, 0x0}, 0x0) sendmsg$IPSET_CMD_ADD(0xffffffffffffffff, 0x0, 0x0) sendmsg$IPSET_CMD_TEST(0xffffffffffffffff, &(0x7f0000000280)={0x0, 0x0, &(0x7f00000002c0)={&(0x7f0000000300)={0x48, 0xb, 0x6, 0x1, 0x0, 0x0, {0x2}, [@IPSET_ATTR_SETNAME={0x9, 0x2, 'syz1\x00'}, @IPSET_ATTR_DATA={0x28, 0x7, 0x0, 0x1, [@IPSET_ATTR_IP={0xc, 0x1, 0x0, 0x1, @IPSET_ATTR_IPADDR_IPV4={0x8, 0x1, 0x1, 0x0, @local}}, @IPSET_ATTR_PORT={0x6, 0x4, 0x1, 0x0, 0x5000}, @IPSET_ATTR_MARK={0x8, 0xa, 0x1, 0x0, 0xc}, @IPSET_ATTR_CIDR2={0x5, 0x15, 0x18}]}]}, 0x48}}, 0x0) socket$inet6_udp(0xa, 0x2, 0x0) socket(0x10, 0x803, 0x0) socket(0x10, 0x3, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./config\x00', 0x1ff) mount(0x0, &(0x7f0000000000)='./config\x00', &(0x7f0000000080)='configfs\x00', 0x0, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000140)='./config/usb_gadget/g1\x00', 0xbf) mkdirat(0xffffffffffffff9c, &(0x7f00000001c0)='./config/usb_gadget/g1/functions/uvc.0\x00', 0x1ff) mkdirat(0xffffffffffffff9c, &(0x7f0000000280)='./config/usb_gadget/g1/functions/uvc.0/streaming/mjpeg/m1\x00', 0x1ff) r2 = openat(0xffffffffffffff9c, &(0x7f00000002c0)='./config/usb_gadget/g1/functions/uvc.0/streaming/mjpeg/m1/bmaControls\x00', 0x2, 0x0) write(r2, &(0x7f0000000640)='12', 0x2) write$P9_RVERSION(r2, &(0x7f0000000180)={0x13, 0x65, 0xffff, 0x1017, 0xffffffffffffff96, '9P2000.L'}, 0x13) syz_usb_connect$midi(0x0, 0x4f, &(0x7f0000000280)=ANY=[], 0x0) r3 = socket$nl_route(0x10, 0x3, 0x0) ioctl$ifreq_SIOCGIFINDEX_vcan(r3, 0x8933, &(0x7f0000000040)={'vxcan0\x00'}) getuid() r4 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPSET_CMD_CREATE(r4, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000200)=ANY=[@ANYBLOB="600000000206010800000000000000000000000005000400000000000900020073797a31000000001400078008001240000000000500140008000000050005000a000000050001000600000011000300686173683a69702c706f7274"], 0x60}}, 0x24000800) r5 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPSET_CMD_ADD(r5, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000240)={&(0x7f0000000c80)=ANY=[@ANYBLOB="5c000000090601080000000000000000070000000900020073797a31000000000500010007000000340007801800018014000240fe8000000000000000000000000000bb060004400e1f00cd050007008800000006000540"], 0x5c}, 0x1, 0x0, 0x0, 0x10000042}, 0x90) program crashed: KASAN: slab-use-after-free Read in ep_open testing program (duration=2m31.5s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): [0, 26, 19, 30] detailed listing: executing program 3: executing program 0: mkdirat(0xffffffffffffff9c, &(0x7f0000000100)='./gadget\x00', 0x1ff) mount(0x0, &(0x7f0000000140)='./gadget\x00', &(0x7f0000000180)='gadgetfs\x00', 0x0, 0x0) r0 = openat(0xffffffffffffff9c, &(0x7f00000001c0)='./gadget/dummy_udc\x00', 0x2, 0x0) bpf$MAP_UPDATE_ELEM_TAIL_CALL(0x2, &(0x7f0000000380)={{}, &(0x7f0000000300), &(0x7f0000000340)=r0}, 0x20) mprotect(&(0x7f0000362000/0x2000)=nil, 0x2000, 0x1) write(r0, &(0x7f0000000200)="000000000902190001010080320904000001ff000000070581024000000902190001010080320904000001ff00000007058102000200120100020000004034127856000100000001", 0x48) r1 = openat(0xffffffffffffff9c, &(0x7f0000000000)='./gadget/ep1in-bulk\x00', 0x2, 0x24) write(r1, &(0x7f00000005c0)="010000000705810240000007058102000200", 0x12) r2 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r2, 0x8933, &(0x7f0000000040)={'bridge0\x00', 0x0}) sendmsg$nl_route(r2, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000440)=ANY=[@ANYBLOB="580000001000ffff27bd7000fadbdf2500000000", @ANYRES32=0x0, @ANYBLOB="15010000000000003000128009000100766c616e00000000200002800600050088a8000006000100010000000c000200130000001000000008000500", @ANYRES32=r3], 0x58}, 0x1, 0x0, 0x0, 0x880}, 0x8048802) madvise(&(0x7f0000bdc000/0x4000)=nil, 0x86ac726dff2f4713, 0xa) r4 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) getsockopt$bt_hci(r4, 0x0, 0x3, &(0x7f00000000c0)=""/151, &(0x7f0000000180)=0x97) r5 = syz_open_procfs(0xffffffffffffffff, &(0x7f0000000000)='attr/fscreate\x00') write$P9_RRENAME(r5, 0x0, 0x0) r6 = syz_open_dev$dvb_dvr(&(0x7f0000000280), 0x7, 0x111400) ioctl$DVB_DVR_DMX_EXPBUF(r6, 0xc00c6f3e, &(0x7f0000000040)={0x200, 0x80000, r5}) socket$inet_sctp(0x2, 0x5, 0x84) r7 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000000)='hugetlb.2MB.rsvd.usage_in_bytes\x00', 0x275a, 0x0) mmap(&(0x7f0000215000/0x1000)=nil, 0x1000, 0x0, 0x6011, r7, 0x0) mmap(&(0x7f0000ffa000/0x3000)=nil, 0x3000, 0x200000c, 0x11, r7, 0xaa0f4000) mmap(&(0x7f0000362000/0x4000)=nil, 0x4000, 0x0, 0x12, r7, 0xfffff000) setsockopt$inet_sctp_SCTP_SOCKOPT_BINDX_ADD(r7, 0x84, 0x64, &(0x7f0000000080)=[@in={0x2, 0x4e22, @local}], 0x10) r8 = syz_clone(0x21000200, 0x0, 0x0, 0x0, 0x0, 0x0) rt_tgsigqueueinfo(r8, r8, 0x8, 0x0) executing program 8: r0 = socket(0x10, 0x3, 0x0) sendmsg$nl_route(0xffffffffffffffff, &(0x7f0000000300)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000100)=ANY=[@ANYBLOB="4800e80010000d0428bd7000fcdbff2500008000", @ANYRES32=r0, @ANYBLOB="1000000000000000280012800b00010062726964676500001800028005001900840000000c001e"], 0x48}}, 0x4084) sendmsg$nl_route(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000080)={&(0x7f00000001c0)=ANY=[@ANYBLOB="500000001000010425bbe5ad600027842cf52300", @ANYRES32=0x0, @ANYRESDEC=0x0, @ANYRES64=r0, @ANYRES16=r0], 0x50}, 0x1, 0x0, 0x0, 0x13d33d22c8a65c15}, 0x4008840) getsockopt$inet_sctp6_SCTP_NODELAY(r0, 0x84, 0x3, &(0x7f0000000280), &(0x7f00000002c0)=0x4) mkdirat(0xffffffffffffff9c, &(0x7f0000000040)='./mnt\x00', 0x1ff) mount$nfs(&(0x7f0000000080)=':27.0.0.1:/export\x00', &(0x7f00000000c0)='./mnt\x00', &(0x7f0000000180), 0x20800, &(0x7f0000000140)=ANY=[@ANYRES16=r0]) r1 = socket$inet6_icmp_raw(0xa, 0x3, 0x3a) bind$inet6(r1, &(0x7f00000001c0)={0xa, 0x4e20, 0xfffffffb, @empty, 0x2}, 0x1c) sendmmsg(r0, &(0x7f0000000000), 0x4000000000001f2, 0x0) r2 = socket$inet6_sctp(0xa, 0x1, 0x84) r3 = dup(r2) setsockopt$inet_sctp6_SCTP_SOCKOPT_BINDX_ADD(r3, 0x84, 0x64, &(0x7f0000000040)=[@in6={0xa, 0x4e24, 0x6, @loopback, 0x3}], 0x1c) getsockopt$inet_sctp_SCTP_GET_ASSOC_STATS(r3, 0x84, 0x70, &(0x7f0000000680)={0x0, @in6={{0xa, 0x4e22, 0x1, @ipv4={'\x00', '\xff\xff', @multicast1}, 0x8}}, [0xfffffffffffffffa, 0x3, 0x7, 0x3, 0x4, 0x3, 0xc, 0x8, 0x3, 0x5, 0x7, 0x100000000, 0x6, 0x2, 0x6]}, &(0x7f00000007c0)=0x100) r4 = socket$packet(0x11, 0x2, 0x300) r5 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r5, 0x8933, &(0x7f0000000040)={'ip6gretap0\x00', 0x0}) sendto$packet(r4, 0x0, 0x0, 0x0, &(0x7f0000000400)={0x11, 0x88a8, r6, 0x1, 0x0, 0x6, @local}, 0x14) r7 = openat$selinux_checkreqprot(0xffffffffffffff9c, &(0x7f0000000200), 0xa00, 0x0) io_uring_register$IORING_REGISTER_FILES(r3, 0x2, &(0x7f0000000240)=[r0, r0, r7, r0, r0, r0, r0], 0x7) executing program 4: r0 = syz_open_dev$dri(&(0x7f0000000000), 0x0, 0x0) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r0, 0xc02064b2, &(0x7f0000000040)={0x1, 0xd00, 0x6}) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r0, 0xc02064b2, &(0x7f0000000100)={0x1, 0x3, 0x9}) ioctl$DRM_IOCTL_PANTHOR_VM_CREATE(r0, 0xc0106441, &(0x7f0000000080)={0x0, 0x0, 0xffffffffffffffff}) socket$kcm(0xa, 0x2, 0x0) socket$nl_route(0x10, 0x3, 0x0) r1 = socket(0x10, 0x3, 0x0) getsockname$packet(r1, &(0x7f00000002c0)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000100)=0x14) sendmsg$nl_route(0xffffffffffffffff, &(0x7f0000000040)={0x0, 0x0, 0x0}, 0x0) sendmsg$IPSET_CMD_ADD(0xffffffffffffffff, 0x0, 0x0) sendmsg$IPSET_CMD_TEST(0xffffffffffffffff, &(0x7f0000000280)={0x0, 0x0, &(0x7f00000002c0)={&(0x7f0000000300)={0x48, 0xb, 0x6, 0x1, 0x0, 0x0, {0x2}, [@IPSET_ATTR_SETNAME={0x9, 0x2, 'syz1\x00'}, @IPSET_ATTR_DATA={0x28, 0x7, 0x0, 0x1, [@IPSET_ATTR_IP={0xc, 0x1, 0x0, 0x1, @IPSET_ATTR_IPADDR_IPV4={0x8, 0x1, 0x1, 0x0, @local}}, @IPSET_ATTR_PORT={0x6, 0x4, 0x1, 0x0, 0x5000}, @IPSET_ATTR_MARK={0x8, 0xa, 0x1, 0x0, 0xc}, @IPSET_ATTR_CIDR2={0x5, 0x15, 0x18}]}]}, 0x48}}, 0x0) socket$inet6_udp(0xa, 0x2, 0x0) socket(0x10, 0x803, 0x0) socket(0x10, 0x3, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./config\x00', 0x1ff) mount(0x0, &(0x7f0000000000)='./config\x00', &(0x7f0000000080)='configfs\x00', 0x0, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000140)='./config/usb_gadget/g1\x00', 0xbf) mkdirat(0xffffffffffffff9c, &(0x7f00000001c0)='./config/usb_gadget/g1/functions/uvc.0\x00', 0x1ff) mkdirat(0xffffffffffffff9c, &(0x7f0000000280)='./config/usb_gadget/g1/functions/uvc.0/streaming/mjpeg/m1\x00', 0x1ff) r2 = openat(0xffffffffffffff9c, &(0x7f00000002c0)='./config/usb_gadget/g1/functions/uvc.0/streaming/mjpeg/m1/bmaControls\x00', 0x2, 0x0) write(r2, &(0x7f0000000640)='12', 0x2) write$P9_RVERSION(r2, &(0x7f0000000180)={0x13, 0x65, 0xffff, 0x1017, 0xffffffffffffff96, '9P2000.L'}, 0x13) syz_usb_connect$midi(0x0, 0x4f, &(0x7f0000000280)=ANY=[], 0x0) r3 = socket$nl_route(0x10, 0x3, 0x0) ioctl$ifreq_SIOCGIFINDEX_vcan(r3, 0x8933, &(0x7f0000000040)={'vxcan0\x00'}) getuid() r4 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPSET_CMD_CREATE(r4, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000200)=ANY=[@ANYBLOB="600000000206010800000000000000000000000005000400000000000900020073797a31000000001400078008001240000000000500140008000000050005000a000000050001000600000011000300686173683a69702c706f7274"], 0x60}}, 0x24000800) r5 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPSET_CMD_ADD(r5, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000240)={&(0x7f0000000c80)=ANY=[@ANYBLOB="5c000000090601080000000000000000070000000900020073797a31000000000500010007000000340007801800018014000240fe8000000000000000000000000000bb060004400e1f00cd050007008800000006000540"], 0x5c}, 0x1, 0x0, 0x0, 0x10000042}, 0x90) program crashed: KASAN: slab-use-after-free Read in ep_open testing program (duration=2m31.5s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): [0, 25, 19, 30] detailed listing: executing program 3: executing program 0: mkdirat(0xffffffffffffff9c, &(0x7f0000000100)='./gadget\x00', 0x1ff) mount(0x0, &(0x7f0000000140)='./gadget\x00', &(0x7f0000000180)='gadgetfs\x00', 0x0, 0x0) r0 = openat(0xffffffffffffff9c, &(0x7f00000001c0)='./gadget/dummy_udc\x00', 0x2, 0x0) bpf$MAP_UPDATE_ELEM_TAIL_CALL(0x2, &(0x7f0000000380)={{}, &(0x7f0000000300), &(0x7f0000000340)=r0}, 0x20) mprotect(&(0x7f0000362000/0x2000)=nil, 0x2000, 0x1) write(r0, &(0x7f0000000200)="000000000902190001010080320904000001ff000000070581024000000902190001010080320904000001ff00000007058102000200120100020000004034127856000100000001", 0x48) r1 = openat(0xffffffffffffff9c, &(0x7f0000000000)='./gadget/ep1in-bulk\x00', 0x2, 0x24) write(r1, &(0x7f00000005c0)="010000000705810240000007058102000200", 0x12) r2 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r2, 0x8933, &(0x7f0000000040)={'bridge0\x00', 0x0}) sendmsg$nl_route(r2, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000440)=ANY=[@ANYBLOB="580000001000ffff27bd7000fadbdf2500000000", @ANYRES32=0x0, @ANYBLOB="15010000000000003000128009000100766c616e00000000200002800600050088a8000006000100010000000c000200130000001000000008000500", @ANYRES32=r3], 0x58}, 0x1, 0x0, 0x0, 0x880}, 0x8048802) madvise(&(0x7f0000bdc000/0x4000)=nil, 0x86ac726dff2f4713, 0xa) r4 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) getsockopt$bt_hci(r4, 0x0, 0x3, &(0x7f00000000c0)=""/151, &(0x7f0000000180)=0x97) r5 = syz_open_procfs(0xffffffffffffffff, &(0x7f0000000000)='attr/fscreate\x00') write$P9_RRENAME(r5, 0x0, 0x0) r6 = syz_open_dev$dvb_dvr(&(0x7f0000000280), 0x7, 0x111400) ioctl$DVB_DVR_DMX_EXPBUF(r6, 0xc00c6f3e, &(0x7f0000000040)={0x200, 0x80000, r5}) socket$inet_sctp(0x2, 0x5, 0x84) r7 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000000)='hugetlb.2MB.rsvd.usage_in_bytes\x00', 0x275a, 0x0) mmap(&(0x7f0000215000/0x1000)=nil, 0x1000, 0x0, 0x6011, r7, 0x0) mmap(&(0x7f0000ffa000/0x3000)=nil, 0x3000, 0x200000c, 0x11, r7, 0xaa0f4000) mmap(&(0x7f0000362000/0x4000)=nil, 0x4000, 0x0, 0x12, r7, 0xfffff000) setsockopt$inet_sctp_SCTP_SOCKOPT_BINDX_ADD(r7, 0x84, 0x64, &(0x7f0000000080)=[@in={0x2, 0x4e22, @local}], 0x10) syz_clone(0x21000200, 0x0, 0x0, 0x0, 0x0, 0x0) executing program 8: r0 = socket(0x10, 0x3, 0x0) sendmsg$nl_route(0xffffffffffffffff, &(0x7f0000000300)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000100)=ANY=[@ANYBLOB="4800e80010000d0428bd7000fcdbff2500008000", @ANYRES32=r0, @ANYBLOB="1000000000000000280012800b00010062726964676500001800028005001900840000000c001e"], 0x48}}, 0x4084) sendmsg$nl_route(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000080)={&(0x7f00000001c0)=ANY=[@ANYBLOB="500000001000010425bbe5ad600027842cf52300", @ANYRES32=0x0, @ANYRESDEC=0x0, @ANYRES64=r0, @ANYRES16=r0], 0x50}, 0x1, 0x0, 0x0, 0x13d33d22c8a65c15}, 0x4008840) getsockopt$inet_sctp6_SCTP_NODELAY(r0, 0x84, 0x3, &(0x7f0000000280), &(0x7f00000002c0)=0x4) mkdirat(0xffffffffffffff9c, &(0x7f0000000040)='./mnt\x00', 0x1ff) mount$nfs(&(0x7f0000000080)=':27.0.0.1:/export\x00', &(0x7f00000000c0)='./mnt\x00', &(0x7f0000000180), 0x20800, &(0x7f0000000140)=ANY=[@ANYRES16=r0]) r1 = socket$inet6_icmp_raw(0xa, 0x3, 0x3a) bind$inet6(r1, &(0x7f00000001c0)={0xa, 0x4e20, 0xfffffffb, @empty, 0x2}, 0x1c) sendmmsg(r0, &(0x7f0000000000), 0x4000000000001f2, 0x0) r2 = socket$inet6_sctp(0xa, 0x1, 0x84) r3 = dup(r2) setsockopt$inet_sctp6_SCTP_SOCKOPT_BINDX_ADD(r3, 0x84, 0x64, &(0x7f0000000040)=[@in6={0xa, 0x4e24, 0x6, @loopback, 0x3}], 0x1c) getsockopt$inet_sctp_SCTP_GET_ASSOC_STATS(r3, 0x84, 0x70, &(0x7f0000000680)={0x0, @in6={{0xa, 0x4e22, 0x1, @ipv4={'\x00', '\xff\xff', @multicast1}, 0x8}}, [0xfffffffffffffffa, 0x3, 0x7, 0x3, 0x4, 0x3, 0xc, 0x8, 0x3, 0x5, 0x7, 0x100000000, 0x6, 0x2, 0x6]}, &(0x7f00000007c0)=0x100) r4 = socket$packet(0x11, 0x2, 0x300) r5 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r5, 0x8933, &(0x7f0000000040)={'ip6gretap0\x00', 0x0}) sendto$packet(r4, 0x0, 0x0, 0x0, &(0x7f0000000400)={0x11, 0x88a8, r6, 0x1, 0x0, 0x6, @local}, 0x14) r7 = openat$selinux_checkreqprot(0xffffffffffffff9c, &(0x7f0000000200), 0xa00, 0x0) io_uring_register$IORING_REGISTER_FILES(r3, 0x2, &(0x7f0000000240)=[r0, r0, r7, r0, r0, r0, r0], 0x7) executing program 4: r0 = syz_open_dev$dri(&(0x7f0000000000), 0x0, 0x0) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r0, 0xc02064b2, &(0x7f0000000040)={0x1, 0xd00, 0x6}) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r0, 0xc02064b2, &(0x7f0000000100)={0x1, 0x3, 0x9}) ioctl$DRM_IOCTL_PANTHOR_VM_CREATE(r0, 0xc0106441, &(0x7f0000000080)={0x0, 0x0, 0xffffffffffffffff}) socket$kcm(0xa, 0x2, 0x0) socket$nl_route(0x10, 0x3, 0x0) r1 = socket(0x10, 0x3, 0x0) getsockname$packet(r1, &(0x7f00000002c0)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000100)=0x14) sendmsg$nl_route(0xffffffffffffffff, &(0x7f0000000040)={0x0, 0x0, 0x0}, 0x0) sendmsg$IPSET_CMD_ADD(0xffffffffffffffff, 0x0, 0x0) sendmsg$IPSET_CMD_TEST(0xffffffffffffffff, &(0x7f0000000280)={0x0, 0x0, &(0x7f00000002c0)={&(0x7f0000000300)={0x48, 0xb, 0x6, 0x1, 0x0, 0x0, {0x2}, [@IPSET_ATTR_SETNAME={0x9, 0x2, 'syz1\x00'}, @IPSET_ATTR_DATA={0x28, 0x7, 0x0, 0x1, [@IPSET_ATTR_IP={0xc, 0x1, 0x0, 0x1, @IPSET_ATTR_IPADDR_IPV4={0x8, 0x1, 0x1, 0x0, @local}}, @IPSET_ATTR_PORT={0x6, 0x4, 0x1, 0x0, 0x5000}, @IPSET_ATTR_MARK={0x8, 0xa, 0x1, 0x0, 0xc}, @IPSET_ATTR_CIDR2={0x5, 0x15, 0x18}]}]}, 0x48}}, 0x0) socket$inet6_udp(0xa, 0x2, 0x0) socket(0x10, 0x803, 0x0) socket(0x10, 0x3, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./config\x00', 0x1ff) mount(0x0, &(0x7f0000000000)='./config\x00', &(0x7f0000000080)='configfs\x00', 0x0, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000140)='./config/usb_gadget/g1\x00', 0xbf) mkdirat(0xffffffffffffff9c, &(0x7f00000001c0)='./config/usb_gadget/g1/functions/uvc.0\x00', 0x1ff) mkdirat(0xffffffffffffff9c, &(0x7f0000000280)='./config/usb_gadget/g1/functions/uvc.0/streaming/mjpeg/m1\x00', 0x1ff) r2 = openat(0xffffffffffffff9c, &(0x7f00000002c0)='./config/usb_gadget/g1/functions/uvc.0/streaming/mjpeg/m1/bmaControls\x00', 0x2, 0x0) write(r2, &(0x7f0000000640)='12', 0x2) write$P9_RVERSION(r2, &(0x7f0000000180)={0x13, 0x65, 0xffff, 0x1017, 0xffffffffffffff96, '9P2000.L'}, 0x13) syz_usb_connect$midi(0x0, 0x4f, &(0x7f0000000280)=ANY=[], 0x0) r3 = socket$nl_route(0x10, 0x3, 0x0) ioctl$ifreq_SIOCGIFINDEX_vcan(r3, 0x8933, &(0x7f0000000040)={'vxcan0\x00'}) getuid() r4 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPSET_CMD_CREATE(r4, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000200)=ANY=[@ANYBLOB="600000000206010800000000000000000000000005000400000000000900020073797a31000000001400078008001240000000000500140008000000050005000a000000050001000600000011000300686173683a69702c706f7274"], 0x60}}, 0x24000800) r5 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPSET_CMD_ADD(r5, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000240)={&(0x7f0000000c80)=ANY=[@ANYBLOB="5c000000090601080000000000000000070000000900020073797a31000000000500010007000000340007801800018014000240fe8000000000000000000000000000bb060004400e1f00cd050007008800000006000540"], 0x5c}, 0x1, 0x0, 0x0, 0x10000042}, 0x90) program did not crash testing program (duration=2m31.5s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): [0, 25, 19, 30] detailed listing: executing program 3: executing program 0: mkdirat(0xffffffffffffff9c, &(0x7f0000000100)='./gadget\x00', 0x1ff) mount(0x0, &(0x7f0000000140)='./gadget\x00', &(0x7f0000000180)='gadgetfs\x00', 0x0, 0x0) r0 = openat(0xffffffffffffff9c, &(0x7f00000001c0)='./gadget/dummy_udc\x00', 0x2, 0x0) bpf$MAP_UPDATE_ELEM_TAIL_CALL(0x2, &(0x7f0000000380)={{}, &(0x7f0000000300), &(0x7f0000000340)=r0}, 0x20) mprotect(&(0x7f0000362000/0x2000)=nil, 0x2000, 0x1) write(r0, &(0x7f0000000200)="000000000902190001010080320904000001ff000000070581024000000902190001010080320904000001ff00000007058102000200120100020000004034127856000100000001", 0x48) r1 = openat(0xffffffffffffff9c, &(0x7f0000000000)='./gadget/ep1in-bulk\x00', 0x2, 0x24) write(r1, &(0x7f00000005c0)="010000000705810240000007058102000200", 0x12) r2 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r2, 0x8933, &(0x7f0000000040)={'bridge0\x00', 0x0}) sendmsg$nl_route(r2, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000440)=ANY=[@ANYBLOB="580000001000ffff27bd7000fadbdf2500000000", @ANYRES32=0x0, @ANYBLOB="15010000000000003000128009000100766c616e00000000200002800600050088a8000006000100010000000c000200130000001000000008000500", @ANYRES32=r3], 0x58}, 0x1, 0x0, 0x0, 0x880}, 0x8048802) madvise(&(0x7f0000bdc000/0x4000)=nil, 0x86ac726dff2f4713, 0xa) r4 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) getsockopt$bt_hci(r4, 0x0, 0x3, &(0x7f00000000c0)=""/151, &(0x7f0000000180)=0x97) r5 = syz_open_procfs(0xffffffffffffffff, &(0x7f0000000000)='attr/fscreate\x00') write$P9_RRENAME(r5, 0x0, 0x0) r6 = syz_open_dev$dvb_dvr(&(0x7f0000000280), 0x7, 0x111400) ioctl$DVB_DVR_DMX_EXPBUF(r6, 0xc00c6f3e, &(0x7f0000000040)={0x200, 0x80000, r5}) socket$inet_sctp(0x2, 0x5, 0x84) r7 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000000)='hugetlb.2MB.rsvd.usage_in_bytes\x00', 0x275a, 0x0) mmap(&(0x7f0000215000/0x1000)=nil, 0x1000, 0x0, 0x6011, r7, 0x0) mmap(&(0x7f0000ffa000/0x3000)=nil, 0x3000, 0x200000c, 0x11, r7, 0xaa0f4000) mmap(&(0x7f0000362000/0x4000)=nil, 0x4000, 0x0, 0x12, r7, 0xfffff000) setsockopt$inet_sctp_SCTP_SOCKOPT_BINDX_ADD(r7, 0x84, 0x64, &(0x7f0000000080)=[@in={0x2, 0x4e22, @local}], 0x10) rt_tgsigqueueinfo(0x0, 0x0, 0x8, 0x0) executing program 8: r0 = socket(0x10, 0x3, 0x0) sendmsg$nl_route(0xffffffffffffffff, &(0x7f0000000300)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000100)=ANY=[@ANYBLOB="4800e80010000d0428bd7000fcdbff2500008000", @ANYRES32=r0, @ANYBLOB="1000000000000000280012800b00010062726964676500001800028005001900840000000c001e"], 0x48}}, 0x4084) sendmsg$nl_route(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000080)={&(0x7f00000001c0)=ANY=[@ANYBLOB="500000001000010425bbe5ad600027842cf52300", @ANYRES32=0x0, @ANYRESDEC=0x0, @ANYRES64=r0, @ANYRES16=r0], 0x50}, 0x1, 0x0, 0x0, 0x13d33d22c8a65c15}, 0x4008840) getsockopt$inet_sctp6_SCTP_NODELAY(r0, 0x84, 0x3, &(0x7f0000000280), &(0x7f00000002c0)=0x4) mkdirat(0xffffffffffffff9c, &(0x7f0000000040)='./mnt\x00', 0x1ff) mount$nfs(&(0x7f0000000080)=':27.0.0.1:/export\x00', &(0x7f00000000c0)='./mnt\x00', &(0x7f0000000180), 0x20800, &(0x7f0000000140)=ANY=[@ANYRES16=r0]) r1 = socket$inet6_icmp_raw(0xa, 0x3, 0x3a) bind$inet6(r1, &(0x7f00000001c0)={0xa, 0x4e20, 0xfffffffb, @empty, 0x2}, 0x1c) sendmmsg(r0, &(0x7f0000000000), 0x4000000000001f2, 0x0) r2 = socket$inet6_sctp(0xa, 0x1, 0x84) r3 = dup(r2) setsockopt$inet_sctp6_SCTP_SOCKOPT_BINDX_ADD(r3, 0x84, 0x64, &(0x7f0000000040)=[@in6={0xa, 0x4e24, 0x6, @loopback, 0x3}], 0x1c) getsockopt$inet_sctp_SCTP_GET_ASSOC_STATS(r3, 0x84, 0x70, &(0x7f0000000680)={0x0, @in6={{0xa, 0x4e22, 0x1, @ipv4={'\x00', '\xff\xff', @multicast1}, 0x8}}, [0xfffffffffffffffa, 0x3, 0x7, 0x3, 0x4, 0x3, 0xc, 0x8, 0x3, 0x5, 0x7, 0x100000000, 0x6, 0x2, 0x6]}, &(0x7f00000007c0)=0x100) r4 = socket$packet(0x11, 0x2, 0x300) r5 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r5, 0x8933, &(0x7f0000000040)={'ip6gretap0\x00', 0x0}) sendto$packet(r4, 0x0, 0x0, 0x0, &(0x7f0000000400)={0x11, 0x88a8, r6, 0x1, 0x0, 0x6, @local}, 0x14) r7 = openat$selinux_checkreqprot(0xffffffffffffff9c, &(0x7f0000000200), 0xa00, 0x0) io_uring_register$IORING_REGISTER_FILES(r3, 0x2, &(0x7f0000000240)=[r0, r0, r7, r0, r0, r0, r0], 0x7) executing program 4: r0 = syz_open_dev$dri(&(0x7f0000000000), 0x0, 0x0) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r0, 0xc02064b2, &(0x7f0000000040)={0x1, 0xd00, 0x6}) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r0, 0xc02064b2, &(0x7f0000000100)={0x1, 0x3, 0x9}) ioctl$DRM_IOCTL_PANTHOR_VM_CREATE(r0, 0xc0106441, &(0x7f0000000080)={0x0, 0x0, 0xffffffffffffffff}) socket$kcm(0xa, 0x2, 0x0) socket$nl_route(0x10, 0x3, 0x0) r1 = socket(0x10, 0x3, 0x0) getsockname$packet(r1, &(0x7f00000002c0)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000100)=0x14) sendmsg$nl_route(0xffffffffffffffff, &(0x7f0000000040)={0x0, 0x0, 0x0}, 0x0) sendmsg$IPSET_CMD_ADD(0xffffffffffffffff, 0x0, 0x0) sendmsg$IPSET_CMD_TEST(0xffffffffffffffff, &(0x7f0000000280)={0x0, 0x0, &(0x7f00000002c0)={&(0x7f0000000300)={0x48, 0xb, 0x6, 0x1, 0x0, 0x0, {0x2}, [@IPSET_ATTR_SETNAME={0x9, 0x2, 'syz1\x00'}, @IPSET_ATTR_DATA={0x28, 0x7, 0x0, 0x1, [@IPSET_ATTR_IP={0xc, 0x1, 0x0, 0x1, @IPSET_ATTR_IPADDR_IPV4={0x8, 0x1, 0x1, 0x0, @local}}, @IPSET_ATTR_PORT={0x6, 0x4, 0x1, 0x0, 0x5000}, @IPSET_ATTR_MARK={0x8, 0xa, 0x1, 0x0, 0xc}, @IPSET_ATTR_CIDR2={0x5, 0x15, 0x18}]}]}, 0x48}}, 0x0) socket$inet6_udp(0xa, 0x2, 0x0) socket(0x10, 0x803, 0x0) socket(0x10, 0x3, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./config\x00', 0x1ff) mount(0x0, &(0x7f0000000000)='./config\x00', &(0x7f0000000080)='configfs\x00', 0x0, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000140)='./config/usb_gadget/g1\x00', 0xbf) mkdirat(0xffffffffffffff9c, &(0x7f00000001c0)='./config/usb_gadget/g1/functions/uvc.0\x00', 0x1ff) mkdirat(0xffffffffffffff9c, &(0x7f0000000280)='./config/usb_gadget/g1/functions/uvc.0/streaming/mjpeg/m1\x00', 0x1ff) r2 = openat(0xffffffffffffff9c, &(0x7f00000002c0)='./config/usb_gadget/g1/functions/uvc.0/streaming/mjpeg/m1/bmaControls\x00', 0x2, 0x0) write(r2, &(0x7f0000000640)='12', 0x2) write$P9_RVERSION(r2, &(0x7f0000000180)={0x13, 0x65, 0xffff, 0x1017, 0xffffffffffffff96, '9P2000.L'}, 0x13) syz_usb_connect$midi(0x0, 0x4f, &(0x7f0000000280)=ANY=[], 0x0) r3 = socket$nl_route(0x10, 0x3, 0x0) ioctl$ifreq_SIOCGIFINDEX_vcan(r3, 0x8933, &(0x7f0000000040)={'vxcan0\x00'}) getuid() r4 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPSET_CMD_CREATE(r4, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000200)=ANY=[@ANYBLOB="600000000206010800000000000000000000000005000400000000000900020073797a31000000001400078008001240000000000500140008000000050005000a000000050001000600000011000300686173683a69702c706f7274"], 0x60}}, 0x24000800) r5 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPSET_CMD_ADD(r5, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000240)={&(0x7f0000000c80)=ANY=[@ANYBLOB="5c000000090601080000000000000000070000000900020073797a31000000000500010007000000340007801800018014000240fe8000000000000000000000000000bb060004400e1f00cd050007008800000006000540"], 0x5c}, 0x1, 0x0, 0x0, 0x10000042}, 0x90) program did not crash testing program (duration=2m31.5s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): [0, 25, 19, 30] detailed listing: executing program 3: executing program 0: mkdirat(0xffffffffffffff9c, &(0x7f0000000100)='./gadget\x00', 0x1ff) mount(0x0, &(0x7f0000000140)='./gadget\x00', &(0x7f0000000180)='gadgetfs\x00', 0x0, 0x0) r0 = openat(0xffffffffffffff9c, &(0x7f00000001c0)='./gadget/dummy_udc\x00', 0x2, 0x0) bpf$MAP_UPDATE_ELEM_TAIL_CALL(0x2, &(0x7f0000000380)={{}, &(0x7f0000000300), &(0x7f0000000340)=r0}, 0x20) mprotect(&(0x7f0000362000/0x2000)=nil, 0x2000, 0x1) write(r0, &(0x7f0000000200)="000000000902190001010080320904000001ff000000070581024000000902190001010080320904000001ff00000007058102000200120100020000004034127856000100000001", 0x48) r1 = openat(0xffffffffffffff9c, &(0x7f0000000000)='./gadget/ep1in-bulk\x00', 0x2, 0x24) write(r1, &(0x7f00000005c0)="010000000705810240000007058102000200", 0x12) r2 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r2, 0x8933, &(0x7f0000000040)={'bridge0\x00', 0x0}) sendmsg$nl_route(r2, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000440)=ANY=[@ANYBLOB="580000001000ffff27bd7000fadbdf2500000000", @ANYRES32=0x0, @ANYBLOB="15010000000000003000128009000100766c616e00000000200002800600050088a8000006000100010000000c000200130000001000000008000500", @ANYRES32=r3], 0x58}, 0x1, 0x0, 0x0, 0x880}, 0x8048802) madvise(&(0x7f0000bdc000/0x4000)=nil, 0x86ac726dff2f4713, 0xa) r4 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) getsockopt$bt_hci(r4, 0x0, 0x3, &(0x7f00000000c0)=""/151, &(0x7f0000000180)=0x97) r5 = syz_open_procfs(0xffffffffffffffff, &(0x7f0000000000)='attr/fscreate\x00') write$P9_RRENAME(r5, 0x0, 0x0) r6 = syz_open_dev$dvb_dvr(&(0x7f0000000280), 0x7, 0x111400) ioctl$DVB_DVR_DMX_EXPBUF(r6, 0xc00c6f3e, &(0x7f0000000040)={0x200, 0x80000, r5}) socket$inet_sctp(0x2, 0x5, 0x84) r7 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000000)='hugetlb.2MB.rsvd.usage_in_bytes\x00', 0x275a, 0x0) mmap(&(0x7f0000215000/0x1000)=nil, 0x1000, 0x0, 0x6011, r7, 0x0) mmap(&(0x7f0000ffa000/0x3000)=nil, 0x3000, 0x200000c, 0x11, r7, 0xaa0f4000) mmap(&(0x7f0000362000/0x4000)=nil, 0x4000, 0x0, 0x12, r7, 0xfffff000) r8 = syz_clone(0x21000200, 0x0, 0x0, 0x0, 0x0, 0x0) rt_tgsigqueueinfo(r8, r8, 0x8, 0x0) executing program 8: r0 = socket(0x10, 0x3, 0x0) sendmsg$nl_route(0xffffffffffffffff, &(0x7f0000000300)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000100)=ANY=[@ANYBLOB="4800e80010000d0428bd7000fcdbff2500008000", @ANYRES32=r0, @ANYBLOB="1000000000000000280012800b00010062726964676500001800028005001900840000000c001e"], 0x48}}, 0x4084) sendmsg$nl_route(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000080)={&(0x7f00000001c0)=ANY=[@ANYBLOB="500000001000010425bbe5ad600027842cf52300", @ANYRES32=0x0, @ANYRESDEC=0x0, @ANYRES64=r0, @ANYRES16=r0], 0x50}, 0x1, 0x0, 0x0, 0x13d33d22c8a65c15}, 0x4008840) getsockopt$inet_sctp6_SCTP_NODELAY(r0, 0x84, 0x3, &(0x7f0000000280), &(0x7f00000002c0)=0x4) mkdirat(0xffffffffffffff9c, &(0x7f0000000040)='./mnt\x00', 0x1ff) mount$nfs(&(0x7f0000000080)=':27.0.0.1:/export\x00', &(0x7f00000000c0)='./mnt\x00', &(0x7f0000000180), 0x20800, &(0x7f0000000140)=ANY=[@ANYRES16=r0]) r1 = socket$inet6_icmp_raw(0xa, 0x3, 0x3a) bind$inet6(r1, &(0x7f00000001c0)={0xa, 0x4e20, 0xfffffffb, @empty, 0x2}, 0x1c) sendmmsg(r0, &(0x7f0000000000), 0x4000000000001f2, 0x0) r2 = socket$inet6_sctp(0xa, 0x1, 0x84) r3 = dup(r2) setsockopt$inet_sctp6_SCTP_SOCKOPT_BINDX_ADD(r3, 0x84, 0x64, &(0x7f0000000040)=[@in6={0xa, 0x4e24, 0x6, @loopback, 0x3}], 0x1c) getsockopt$inet_sctp_SCTP_GET_ASSOC_STATS(r3, 0x84, 0x70, &(0x7f0000000680)={0x0, @in6={{0xa, 0x4e22, 0x1, @ipv4={'\x00', '\xff\xff', @multicast1}, 0x8}}, [0xfffffffffffffffa, 0x3, 0x7, 0x3, 0x4, 0x3, 0xc, 0x8, 0x3, 0x5, 0x7, 0x100000000, 0x6, 0x2, 0x6]}, &(0x7f00000007c0)=0x100) r4 = socket$packet(0x11, 0x2, 0x300) r5 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r5, 0x8933, &(0x7f0000000040)={'ip6gretap0\x00', 0x0}) sendto$packet(r4, 0x0, 0x0, 0x0, &(0x7f0000000400)={0x11, 0x88a8, r6, 0x1, 0x0, 0x6, @local}, 0x14) r7 = openat$selinux_checkreqprot(0xffffffffffffff9c, &(0x7f0000000200), 0xa00, 0x0) io_uring_register$IORING_REGISTER_FILES(r3, 0x2, &(0x7f0000000240)=[r0, r0, r7, r0, r0, r0, r0], 0x7) executing program 4: r0 = syz_open_dev$dri(&(0x7f0000000000), 0x0, 0x0) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r0, 0xc02064b2, &(0x7f0000000040)={0x1, 0xd00, 0x6}) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r0, 0xc02064b2, &(0x7f0000000100)={0x1, 0x3, 0x9}) ioctl$DRM_IOCTL_PANTHOR_VM_CREATE(r0, 0xc0106441, &(0x7f0000000080)={0x0, 0x0, 0xffffffffffffffff}) socket$kcm(0xa, 0x2, 0x0) socket$nl_route(0x10, 0x3, 0x0) r1 = socket(0x10, 0x3, 0x0) getsockname$packet(r1, &(0x7f00000002c0)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000100)=0x14) sendmsg$nl_route(0xffffffffffffffff, &(0x7f0000000040)={0x0, 0x0, 0x0}, 0x0) sendmsg$IPSET_CMD_ADD(0xffffffffffffffff, 0x0, 0x0) sendmsg$IPSET_CMD_TEST(0xffffffffffffffff, &(0x7f0000000280)={0x0, 0x0, &(0x7f00000002c0)={&(0x7f0000000300)={0x48, 0xb, 0x6, 0x1, 0x0, 0x0, {0x2}, [@IPSET_ATTR_SETNAME={0x9, 0x2, 'syz1\x00'}, @IPSET_ATTR_DATA={0x28, 0x7, 0x0, 0x1, [@IPSET_ATTR_IP={0xc, 0x1, 0x0, 0x1, @IPSET_ATTR_IPADDR_IPV4={0x8, 0x1, 0x1, 0x0, @local}}, @IPSET_ATTR_PORT={0x6, 0x4, 0x1, 0x0, 0x5000}, @IPSET_ATTR_MARK={0x8, 0xa, 0x1, 0x0, 0xc}, @IPSET_ATTR_CIDR2={0x5, 0x15, 0x18}]}]}, 0x48}}, 0x0) socket$inet6_udp(0xa, 0x2, 0x0) socket(0x10, 0x803, 0x0) socket(0x10, 0x3, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./config\x00', 0x1ff) mount(0x0, &(0x7f0000000000)='./config\x00', &(0x7f0000000080)='configfs\x00', 0x0, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000140)='./config/usb_gadget/g1\x00', 0xbf) mkdirat(0xffffffffffffff9c, &(0x7f00000001c0)='./config/usb_gadget/g1/functions/uvc.0\x00', 0x1ff) mkdirat(0xffffffffffffff9c, &(0x7f0000000280)='./config/usb_gadget/g1/functions/uvc.0/streaming/mjpeg/m1\x00', 0x1ff) r2 = openat(0xffffffffffffff9c, &(0x7f00000002c0)='./config/usb_gadget/g1/functions/uvc.0/streaming/mjpeg/m1/bmaControls\x00', 0x2, 0x0) write(r2, &(0x7f0000000640)='12', 0x2) write$P9_RVERSION(r2, &(0x7f0000000180)={0x13, 0x65, 0xffff, 0x1017, 0xffffffffffffff96, '9P2000.L'}, 0x13) syz_usb_connect$midi(0x0, 0x4f, &(0x7f0000000280)=ANY=[], 0x0) r3 = socket$nl_route(0x10, 0x3, 0x0) ioctl$ifreq_SIOCGIFINDEX_vcan(r3, 0x8933, &(0x7f0000000040)={'vxcan0\x00'}) getuid() r4 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPSET_CMD_CREATE(r4, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000200)=ANY=[@ANYBLOB="600000000206010800000000000000000000000005000400000000000900020073797a31000000001400078008001240000000000500140008000000050005000a000000050001000600000011000300686173683a69702c706f7274"], 0x60}}, 0x24000800) r5 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPSET_CMD_ADD(r5, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000240)={&(0x7f0000000c80)=ANY=[@ANYBLOB="5c000000090601080000000000000000070000000900020073797a31000000000500010007000000340007801800018014000240fe8000000000000000000000000000bb060004400e1f00cd050007008800000006000540"], 0x5c}, 0x1, 0x0, 0x0, 0x10000042}, 0x90) program crashed: KASAN: slab-use-after-free Read in ep_open testing program (duration=2m31.5s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): [0, 24, 19, 30] detailed listing: executing program 3: executing program 0: mkdirat(0xffffffffffffff9c, &(0x7f0000000100)='./gadget\x00', 0x1ff) mount(0x0, &(0x7f0000000140)='./gadget\x00', &(0x7f0000000180)='gadgetfs\x00', 0x0, 0x0) r0 = openat(0xffffffffffffff9c, &(0x7f00000001c0)='./gadget/dummy_udc\x00', 0x2, 0x0) bpf$MAP_UPDATE_ELEM_TAIL_CALL(0x2, &(0x7f0000000380)={{}, &(0x7f0000000300), &(0x7f0000000340)=r0}, 0x20) mprotect(&(0x7f0000362000/0x2000)=nil, 0x2000, 0x1) write(r0, &(0x7f0000000200)="000000000902190001010080320904000001ff000000070581024000000902190001010080320904000001ff00000007058102000200120100020000004034127856000100000001", 0x48) r1 = openat(0xffffffffffffff9c, &(0x7f0000000000)='./gadget/ep1in-bulk\x00', 0x2, 0x24) write(r1, &(0x7f00000005c0)="010000000705810240000007058102000200", 0x12) r2 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r2, 0x8933, &(0x7f0000000040)={'bridge0\x00', 0x0}) sendmsg$nl_route(r2, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000440)=ANY=[@ANYBLOB="580000001000ffff27bd7000fadbdf2500000000", @ANYRES32=0x0, @ANYBLOB="15010000000000003000128009000100766c616e00000000200002800600050088a8000006000100010000000c000200130000001000000008000500", @ANYRES32=r3], 0x58}, 0x1, 0x0, 0x0, 0x880}, 0x8048802) madvise(&(0x7f0000bdc000/0x4000)=nil, 0x86ac726dff2f4713, 0xa) r4 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) getsockopt$bt_hci(r4, 0x0, 0x3, &(0x7f00000000c0)=""/151, &(0x7f0000000180)=0x97) r5 = syz_open_procfs(0xffffffffffffffff, &(0x7f0000000000)='attr/fscreate\x00') write$P9_RRENAME(r5, 0x0, 0x0) r6 = syz_open_dev$dvb_dvr(&(0x7f0000000280), 0x7, 0x111400) ioctl$DVB_DVR_DMX_EXPBUF(r6, 0xc00c6f3e, &(0x7f0000000040)={0x200, 0x80000, r5}) socket$inet_sctp(0x2, 0x5, 0x84) r7 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000000)='hugetlb.2MB.rsvd.usage_in_bytes\x00', 0x275a, 0x0) mmap(&(0x7f0000215000/0x1000)=nil, 0x1000, 0x0, 0x6011, r7, 0x0) mmap(&(0x7f0000ffa000/0x3000)=nil, 0x3000, 0x200000c, 0x11, r7, 0xaa0f4000) r8 = syz_clone(0x21000200, 0x0, 0x0, 0x0, 0x0, 0x0) rt_tgsigqueueinfo(r8, r8, 0x8, 0x0) executing program 8: r0 = socket(0x10, 0x3, 0x0) sendmsg$nl_route(0xffffffffffffffff, &(0x7f0000000300)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000100)=ANY=[@ANYBLOB="4800e80010000d0428bd7000fcdbff2500008000", @ANYRES32=r0, @ANYBLOB="1000000000000000280012800b00010062726964676500001800028005001900840000000c001e"], 0x48}}, 0x4084) sendmsg$nl_route(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000080)={&(0x7f00000001c0)=ANY=[@ANYBLOB="500000001000010425bbe5ad600027842cf52300", @ANYRES32=0x0, @ANYRESDEC=0x0, @ANYRES64=r0, @ANYRES16=r0], 0x50}, 0x1, 0x0, 0x0, 0x13d33d22c8a65c15}, 0x4008840) getsockopt$inet_sctp6_SCTP_NODELAY(r0, 0x84, 0x3, &(0x7f0000000280), &(0x7f00000002c0)=0x4) mkdirat(0xffffffffffffff9c, &(0x7f0000000040)='./mnt\x00', 0x1ff) mount$nfs(&(0x7f0000000080)=':27.0.0.1:/export\x00', &(0x7f00000000c0)='./mnt\x00', &(0x7f0000000180), 0x20800, &(0x7f0000000140)=ANY=[@ANYRES16=r0]) r1 = socket$inet6_icmp_raw(0xa, 0x3, 0x3a) bind$inet6(r1, &(0x7f00000001c0)={0xa, 0x4e20, 0xfffffffb, @empty, 0x2}, 0x1c) sendmmsg(r0, &(0x7f0000000000), 0x4000000000001f2, 0x0) r2 = socket$inet6_sctp(0xa, 0x1, 0x84) r3 = dup(r2) setsockopt$inet_sctp6_SCTP_SOCKOPT_BINDX_ADD(r3, 0x84, 0x64, &(0x7f0000000040)=[@in6={0xa, 0x4e24, 0x6, @loopback, 0x3}], 0x1c) getsockopt$inet_sctp_SCTP_GET_ASSOC_STATS(r3, 0x84, 0x70, &(0x7f0000000680)={0x0, @in6={{0xa, 0x4e22, 0x1, @ipv4={'\x00', '\xff\xff', @multicast1}, 0x8}}, [0xfffffffffffffffa, 0x3, 0x7, 0x3, 0x4, 0x3, 0xc, 0x8, 0x3, 0x5, 0x7, 0x100000000, 0x6, 0x2, 0x6]}, &(0x7f00000007c0)=0x100) r4 = socket$packet(0x11, 0x2, 0x300) r5 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r5, 0x8933, &(0x7f0000000040)={'ip6gretap0\x00', 0x0}) sendto$packet(r4, 0x0, 0x0, 0x0, &(0x7f0000000400)={0x11, 0x88a8, r6, 0x1, 0x0, 0x6, @local}, 0x14) r7 = openat$selinux_checkreqprot(0xffffffffffffff9c, &(0x7f0000000200), 0xa00, 0x0) io_uring_register$IORING_REGISTER_FILES(r3, 0x2, &(0x7f0000000240)=[r0, r0, r7, r0, r0, r0, r0], 0x7) executing program 4: r0 = syz_open_dev$dri(&(0x7f0000000000), 0x0, 0x0) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r0, 0xc02064b2, &(0x7f0000000040)={0x1, 0xd00, 0x6}) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r0, 0xc02064b2, &(0x7f0000000100)={0x1, 0x3, 0x9}) ioctl$DRM_IOCTL_PANTHOR_VM_CREATE(r0, 0xc0106441, &(0x7f0000000080)={0x0, 0x0, 0xffffffffffffffff}) socket$kcm(0xa, 0x2, 0x0) socket$nl_route(0x10, 0x3, 0x0) r1 = socket(0x10, 0x3, 0x0) getsockname$packet(r1, &(0x7f00000002c0)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000100)=0x14) sendmsg$nl_route(0xffffffffffffffff, &(0x7f0000000040)={0x0, 0x0, 0x0}, 0x0) sendmsg$IPSET_CMD_ADD(0xffffffffffffffff, 0x0, 0x0) sendmsg$IPSET_CMD_TEST(0xffffffffffffffff, &(0x7f0000000280)={0x0, 0x0, &(0x7f00000002c0)={&(0x7f0000000300)={0x48, 0xb, 0x6, 0x1, 0x0, 0x0, {0x2}, [@IPSET_ATTR_SETNAME={0x9, 0x2, 'syz1\x00'}, @IPSET_ATTR_DATA={0x28, 0x7, 0x0, 0x1, [@IPSET_ATTR_IP={0xc, 0x1, 0x0, 0x1, @IPSET_ATTR_IPADDR_IPV4={0x8, 0x1, 0x1, 0x0, @local}}, @IPSET_ATTR_PORT={0x6, 0x4, 0x1, 0x0, 0x5000}, @IPSET_ATTR_MARK={0x8, 0xa, 0x1, 0x0, 0xc}, @IPSET_ATTR_CIDR2={0x5, 0x15, 0x18}]}]}, 0x48}}, 0x0) socket$inet6_udp(0xa, 0x2, 0x0) socket(0x10, 0x803, 0x0) socket(0x10, 0x3, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./config\x00', 0x1ff) mount(0x0, &(0x7f0000000000)='./config\x00', &(0x7f0000000080)='configfs\x00', 0x0, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000140)='./config/usb_gadget/g1\x00', 0xbf) mkdirat(0xffffffffffffff9c, &(0x7f00000001c0)='./config/usb_gadget/g1/functions/uvc.0\x00', 0x1ff) mkdirat(0xffffffffffffff9c, &(0x7f0000000280)='./config/usb_gadget/g1/functions/uvc.0/streaming/mjpeg/m1\x00', 0x1ff) r2 = openat(0xffffffffffffff9c, &(0x7f00000002c0)='./config/usb_gadget/g1/functions/uvc.0/streaming/mjpeg/m1/bmaControls\x00', 0x2, 0x0) write(r2, &(0x7f0000000640)='12', 0x2) write$P9_RVERSION(r2, &(0x7f0000000180)={0x13, 0x65, 0xffff, 0x1017, 0xffffffffffffff96, '9P2000.L'}, 0x13) syz_usb_connect$midi(0x0, 0x4f, &(0x7f0000000280)=ANY=[], 0x0) r3 = socket$nl_route(0x10, 0x3, 0x0) ioctl$ifreq_SIOCGIFINDEX_vcan(r3, 0x8933, &(0x7f0000000040)={'vxcan0\x00'}) getuid() r4 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPSET_CMD_CREATE(r4, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000200)=ANY=[@ANYBLOB="600000000206010800000000000000000000000005000400000000000900020073797a31000000001400078008001240000000000500140008000000050005000a000000050001000600000011000300686173683a69702c706f7274"], 0x60}}, 0x24000800) r5 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPSET_CMD_ADD(r5, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000240)={&(0x7f0000000c80)=ANY=[@ANYBLOB="5c000000090601080000000000000000070000000900020073797a31000000000500010007000000340007801800018014000240fe8000000000000000000000000000bb060004400e1f00cd050007008800000006000540"], 0x5c}, 0x1, 0x0, 0x0, 0x10000042}, 0x90) program did not crash testing program (duration=2m31.5s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): [0, 24, 19, 30] detailed listing: executing program 3: executing program 0: mkdirat(0xffffffffffffff9c, &(0x7f0000000100)='./gadget\x00', 0x1ff) mount(0x0, &(0x7f0000000140)='./gadget\x00', &(0x7f0000000180)='gadgetfs\x00', 0x0, 0x0) r0 = openat(0xffffffffffffff9c, &(0x7f00000001c0)='./gadget/dummy_udc\x00', 0x2, 0x0) bpf$MAP_UPDATE_ELEM_TAIL_CALL(0x2, &(0x7f0000000380)={{}, &(0x7f0000000300), &(0x7f0000000340)=r0}, 0x20) mprotect(&(0x7f0000362000/0x2000)=nil, 0x2000, 0x1) write(r0, &(0x7f0000000200)="000000000902190001010080320904000001ff000000070581024000000902190001010080320904000001ff00000007058102000200120100020000004034127856000100000001", 0x48) r1 = openat(0xffffffffffffff9c, &(0x7f0000000000)='./gadget/ep1in-bulk\x00', 0x2, 0x24) write(r1, &(0x7f00000005c0)="010000000705810240000007058102000200", 0x12) r2 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r2, 0x8933, &(0x7f0000000040)={'bridge0\x00', 0x0}) sendmsg$nl_route(r2, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000440)=ANY=[@ANYBLOB="580000001000ffff27bd7000fadbdf2500000000", @ANYRES32=0x0, @ANYBLOB="15010000000000003000128009000100766c616e00000000200002800600050088a8000006000100010000000c000200130000001000000008000500", @ANYRES32=r3], 0x58}, 0x1, 0x0, 0x0, 0x880}, 0x8048802) madvise(&(0x7f0000bdc000/0x4000)=nil, 0x86ac726dff2f4713, 0xa) r4 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) getsockopt$bt_hci(r4, 0x0, 0x3, &(0x7f00000000c0)=""/151, &(0x7f0000000180)=0x97) r5 = syz_open_procfs(0xffffffffffffffff, &(0x7f0000000000)='attr/fscreate\x00') write$P9_RRENAME(r5, 0x0, 0x0) r6 = syz_open_dev$dvb_dvr(&(0x7f0000000280), 0x7, 0x111400) ioctl$DVB_DVR_DMX_EXPBUF(r6, 0xc00c6f3e, &(0x7f0000000040)={0x200, 0x80000, r5}) socket$inet_sctp(0x2, 0x5, 0x84) r7 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000000)='hugetlb.2MB.rsvd.usage_in_bytes\x00', 0x275a, 0x0) mmap(&(0x7f0000215000/0x1000)=nil, 0x1000, 0x0, 0x6011, r7, 0x0) mmap(&(0x7f0000362000/0x4000)=nil, 0x4000, 0x0, 0x12, r7, 0xfffff000) r8 = syz_clone(0x21000200, 0x0, 0x0, 0x0, 0x0, 0x0) rt_tgsigqueueinfo(r8, r8, 0x8, 0x0) executing program 8: r0 = socket(0x10, 0x3, 0x0) sendmsg$nl_route(0xffffffffffffffff, &(0x7f0000000300)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000100)=ANY=[@ANYBLOB="4800e80010000d0428bd7000fcdbff2500008000", @ANYRES32=r0, @ANYBLOB="1000000000000000280012800b00010062726964676500001800028005001900840000000c001e"], 0x48}}, 0x4084) sendmsg$nl_route(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000080)={&(0x7f00000001c0)=ANY=[@ANYBLOB="500000001000010425bbe5ad600027842cf52300", @ANYRES32=0x0, @ANYRESDEC=0x0, @ANYRES64=r0, @ANYRES16=r0], 0x50}, 0x1, 0x0, 0x0, 0x13d33d22c8a65c15}, 0x4008840) getsockopt$inet_sctp6_SCTP_NODELAY(r0, 0x84, 0x3, &(0x7f0000000280), &(0x7f00000002c0)=0x4) mkdirat(0xffffffffffffff9c, &(0x7f0000000040)='./mnt\x00', 0x1ff) mount$nfs(&(0x7f0000000080)=':27.0.0.1:/export\x00', &(0x7f00000000c0)='./mnt\x00', &(0x7f0000000180), 0x20800, &(0x7f0000000140)=ANY=[@ANYRES16=r0]) r1 = socket$inet6_icmp_raw(0xa, 0x3, 0x3a) bind$inet6(r1, &(0x7f00000001c0)={0xa, 0x4e20, 0xfffffffb, @empty, 0x2}, 0x1c) sendmmsg(r0, &(0x7f0000000000), 0x4000000000001f2, 0x0) r2 = socket$inet6_sctp(0xa, 0x1, 0x84) r3 = dup(r2) setsockopt$inet_sctp6_SCTP_SOCKOPT_BINDX_ADD(r3, 0x84, 0x64, &(0x7f0000000040)=[@in6={0xa, 0x4e24, 0x6, @loopback, 0x3}], 0x1c) getsockopt$inet_sctp_SCTP_GET_ASSOC_STATS(r3, 0x84, 0x70, &(0x7f0000000680)={0x0, @in6={{0xa, 0x4e22, 0x1, @ipv4={'\x00', '\xff\xff', @multicast1}, 0x8}}, [0xfffffffffffffffa, 0x3, 0x7, 0x3, 0x4, 0x3, 0xc, 0x8, 0x3, 0x5, 0x7, 0x100000000, 0x6, 0x2, 0x6]}, &(0x7f00000007c0)=0x100) r4 = socket$packet(0x11, 0x2, 0x300) r5 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r5, 0x8933, &(0x7f0000000040)={'ip6gretap0\x00', 0x0}) sendto$packet(r4, 0x0, 0x0, 0x0, &(0x7f0000000400)={0x11, 0x88a8, r6, 0x1, 0x0, 0x6, @local}, 0x14) r7 = openat$selinux_checkreqprot(0xffffffffffffff9c, &(0x7f0000000200), 0xa00, 0x0) io_uring_register$IORING_REGISTER_FILES(r3, 0x2, &(0x7f0000000240)=[r0, r0, r7, r0, r0, r0, r0], 0x7) executing program 4: r0 = syz_open_dev$dri(&(0x7f0000000000), 0x0, 0x0) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r0, 0xc02064b2, &(0x7f0000000040)={0x1, 0xd00, 0x6}) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r0, 0xc02064b2, &(0x7f0000000100)={0x1, 0x3, 0x9}) ioctl$DRM_IOCTL_PANTHOR_VM_CREATE(r0, 0xc0106441, &(0x7f0000000080)={0x0, 0x0, 0xffffffffffffffff}) socket$kcm(0xa, 0x2, 0x0) socket$nl_route(0x10, 0x3, 0x0) r1 = socket(0x10, 0x3, 0x0) getsockname$packet(r1, &(0x7f00000002c0)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000100)=0x14) sendmsg$nl_route(0xffffffffffffffff, &(0x7f0000000040)={0x0, 0x0, 0x0}, 0x0) sendmsg$IPSET_CMD_ADD(0xffffffffffffffff, 0x0, 0x0) sendmsg$IPSET_CMD_TEST(0xffffffffffffffff, &(0x7f0000000280)={0x0, 0x0, &(0x7f00000002c0)={&(0x7f0000000300)={0x48, 0xb, 0x6, 0x1, 0x0, 0x0, {0x2}, [@IPSET_ATTR_SETNAME={0x9, 0x2, 'syz1\x00'}, @IPSET_ATTR_DATA={0x28, 0x7, 0x0, 0x1, [@IPSET_ATTR_IP={0xc, 0x1, 0x0, 0x1, @IPSET_ATTR_IPADDR_IPV4={0x8, 0x1, 0x1, 0x0, @local}}, @IPSET_ATTR_PORT={0x6, 0x4, 0x1, 0x0, 0x5000}, @IPSET_ATTR_MARK={0x8, 0xa, 0x1, 0x0, 0xc}, @IPSET_ATTR_CIDR2={0x5, 0x15, 0x18}]}]}, 0x48}}, 0x0) socket$inet6_udp(0xa, 0x2, 0x0) socket(0x10, 0x803, 0x0) socket(0x10, 0x3, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./config\x00', 0x1ff) mount(0x0, &(0x7f0000000000)='./config\x00', &(0x7f0000000080)='configfs\x00', 0x0, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000140)='./config/usb_gadget/g1\x00', 0xbf) mkdirat(0xffffffffffffff9c, &(0x7f00000001c0)='./config/usb_gadget/g1/functions/uvc.0\x00', 0x1ff) mkdirat(0xffffffffffffff9c, &(0x7f0000000280)='./config/usb_gadget/g1/functions/uvc.0/streaming/mjpeg/m1\x00', 0x1ff) r2 = openat(0xffffffffffffff9c, &(0x7f00000002c0)='./config/usb_gadget/g1/functions/uvc.0/streaming/mjpeg/m1/bmaControls\x00', 0x2, 0x0) write(r2, &(0x7f0000000640)='12', 0x2) write$P9_RVERSION(r2, &(0x7f0000000180)={0x13, 0x65, 0xffff, 0x1017, 0xffffffffffffff96, '9P2000.L'}, 0x13) syz_usb_connect$midi(0x0, 0x4f, &(0x7f0000000280)=ANY=[], 0x0) r3 = socket$nl_route(0x10, 0x3, 0x0) ioctl$ifreq_SIOCGIFINDEX_vcan(r3, 0x8933, &(0x7f0000000040)={'vxcan0\x00'}) getuid() r4 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPSET_CMD_CREATE(r4, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000200)=ANY=[@ANYBLOB="600000000206010800000000000000000000000005000400000000000900020073797a31000000001400078008001240000000000500140008000000050005000a000000050001000600000011000300686173683a69702c706f7274"], 0x60}}, 0x24000800) r5 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPSET_CMD_ADD(r5, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000240)={&(0x7f0000000c80)=ANY=[@ANYBLOB="5c000000090601080000000000000000070000000900020073797a31000000000500010007000000340007801800018014000240fe8000000000000000000000000000bb060004400e1f00cd050007008800000006000540"], 0x5c}, 0x1, 0x0, 0x0, 0x10000042}, 0x90) program crashed: KASAN: slab-use-after-free Read in ep_open testing program (duration=2m31.5s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): [0, 23, 19, 30] detailed listing: executing program 3: executing program 0: mkdirat(0xffffffffffffff9c, &(0x7f0000000100)='./gadget\x00', 0x1ff) mount(0x0, &(0x7f0000000140)='./gadget\x00', &(0x7f0000000180)='gadgetfs\x00', 0x0, 0x0) r0 = openat(0xffffffffffffff9c, &(0x7f00000001c0)='./gadget/dummy_udc\x00', 0x2, 0x0) bpf$MAP_UPDATE_ELEM_TAIL_CALL(0x2, &(0x7f0000000380)={{}, &(0x7f0000000300), &(0x7f0000000340)=r0}, 0x20) mprotect(&(0x7f0000362000/0x2000)=nil, 0x2000, 0x1) write(r0, &(0x7f0000000200)="000000000902190001010080320904000001ff000000070581024000000902190001010080320904000001ff00000007058102000200120100020000004034127856000100000001", 0x48) r1 = openat(0xffffffffffffff9c, &(0x7f0000000000)='./gadget/ep1in-bulk\x00', 0x2, 0x24) write(r1, &(0x7f00000005c0)="010000000705810240000007058102000200", 0x12) r2 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r2, 0x8933, &(0x7f0000000040)={'bridge0\x00', 0x0}) sendmsg$nl_route(r2, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000440)=ANY=[@ANYBLOB="580000001000ffff27bd7000fadbdf2500000000", @ANYRES32=0x0, @ANYBLOB="15010000000000003000128009000100766c616e00000000200002800600050088a8000006000100010000000c000200130000001000000008000500", @ANYRES32=r3], 0x58}, 0x1, 0x0, 0x0, 0x880}, 0x8048802) madvise(&(0x7f0000bdc000/0x4000)=nil, 0x86ac726dff2f4713, 0xa) r4 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) getsockopt$bt_hci(r4, 0x0, 0x3, &(0x7f00000000c0)=""/151, &(0x7f0000000180)=0x97) r5 = syz_open_procfs(0xffffffffffffffff, &(0x7f0000000000)='attr/fscreate\x00') write$P9_RRENAME(r5, 0x0, 0x0) r6 = syz_open_dev$dvb_dvr(&(0x7f0000000280), 0x7, 0x111400) ioctl$DVB_DVR_DMX_EXPBUF(r6, 0xc00c6f3e, &(0x7f0000000040)={0x200, 0x80000, r5}) socket$inet_sctp(0x2, 0x5, 0x84) r7 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000000)='hugetlb.2MB.rsvd.usage_in_bytes\x00', 0x275a, 0x0) mmap(&(0x7f0000362000/0x4000)=nil, 0x4000, 0x0, 0x12, r7, 0xfffff000) r8 = syz_clone(0x21000200, 0x0, 0x0, 0x0, 0x0, 0x0) rt_tgsigqueueinfo(r8, r8, 0x8, 0x0) executing program 8: r0 = socket(0x10, 0x3, 0x0) sendmsg$nl_route(0xffffffffffffffff, &(0x7f0000000300)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000100)=ANY=[@ANYBLOB="4800e80010000d0428bd7000fcdbff2500008000", @ANYRES32=r0, @ANYBLOB="1000000000000000280012800b00010062726964676500001800028005001900840000000c001e"], 0x48}}, 0x4084) sendmsg$nl_route(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000080)={&(0x7f00000001c0)=ANY=[@ANYBLOB="500000001000010425bbe5ad600027842cf52300", @ANYRES32=0x0, @ANYRESDEC=0x0, @ANYRES64=r0, @ANYRES16=r0], 0x50}, 0x1, 0x0, 0x0, 0x13d33d22c8a65c15}, 0x4008840) getsockopt$inet_sctp6_SCTP_NODELAY(r0, 0x84, 0x3, &(0x7f0000000280), &(0x7f00000002c0)=0x4) mkdirat(0xffffffffffffff9c, &(0x7f0000000040)='./mnt\x00', 0x1ff) mount$nfs(&(0x7f0000000080)=':27.0.0.1:/export\x00', &(0x7f00000000c0)='./mnt\x00', &(0x7f0000000180), 0x20800, &(0x7f0000000140)=ANY=[@ANYRES16=r0]) r1 = socket$inet6_icmp_raw(0xa, 0x3, 0x3a) bind$inet6(r1, &(0x7f00000001c0)={0xa, 0x4e20, 0xfffffffb, @empty, 0x2}, 0x1c) sendmmsg(r0, &(0x7f0000000000), 0x4000000000001f2, 0x0) r2 = socket$inet6_sctp(0xa, 0x1, 0x84) r3 = dup(r2) setsockopt$inet_sctp6_SCTP_SOCKOPT_BINDX_ADD(r3, 0x84, 0x64, &(0x7f0000000040)=[@in6={0xa, 0x4e24, 0x6, @loopback, 0x3}], 0x1c) getsockopt$inet_sctp_SCTP_GET_ASSOC_STATS(r3, 0x84, 0x70, &(0x7f0000000680)={0x0, @in6={{0xa, 0x4e22, 0x1, @ipv4={'\x00', '\xff\xff', @multicast1}, 0x8}}, [0xfffffffffffffffa, 0x3, 0x7, 0x3, 0x4, 0x3, 0xc, 0x8, 0x3, 0x5, 0x7, 0x100000000, 0x6, 0x2, 0x6]}, &(0x7f00000007c0)=0x100) r4 = socket$packet(0x11, 0x2, 0x300) r5 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r5, 0x8933, &(0x7f0000000040)={'ip6gretap0\x00', 0x0}) sendto$packet(r4, 0x0, 0x0, 0x0, &(0x7f0000000400)={0x11, 0x88a8, r6, 0x1, 0x0, 0x6, @local}, 0x14) r7 = openat$selinux_checkreqprot(0xffffffffffffff9c, &(0x7f0000000200), 0xa00, 0x0) io_uring_register$IORING_REGISTER_FILES(r3, 0x2, &(0x7f0000000240)=[r0, r0, r7, r0, r0, r0, r0], 0x7) executing program 4: r0 = syz_open_dev$dri(&(0x7f0000000000), 0x0, 0x0) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r0, 0xc02064b2, &(0x7f0000000040)={0x1, 0xd00, 0x6}) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r0, 0xc02064b2, &(0x7f0000000100)={0x1, 0x3, 0x9}) ioctl$DRM_IOCTL_PANTHOR_VM_CREATE(r0, 0xc0106441, &(0x7f0000000080)={0x0, 0x0, 0xffffffffffffffff}) socket$kcm(0xa, 0x2, 0x0) socket$nl_route(0x10, 0x3, 0x0) r1 = socket(0x10, 0x3, 0x0) getsockname$packet(r1, &(0x7f00000002c0)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000100)=0x14) sendmsg$nl_route(0xffffffffffffffff, &(0x7f0000000040)={0x0, 0x0, 0x0}, 0x0) sendmsg$IPSET_CMD_ADD(0xffffffffffffffff, 0x0, 0x0) sendmsg$IPSET_CMD_TEST(0xffffffffffffffff, &(0x7f0000000280)={0x0, 0x0, &(0x7f00000002c0)={&(0x7f0000000300)={0x48, 0xb, 0x6, 0x1, 0x0, 0x0, {0x2}, [@IPSET_ATTR_SETNAME={0x9, 0x2, 'syz1\x00'}, @IPSET_ATTR_DATA={0x28, 0x7, 0x0, 0x1, [@IPSET_ATTR_IP={0xc, 0x1, 0x0, 0x1, @IPSET_ATTR_IPADDR_IPV4={0x8, 0x1, 0x1, 0x0, @local}}, @IPSET_ATTR_PORT={0x6, 0x4, 0x1, 0x0, 0x5000}, @IPSET_ATTR_MARK={0x8, 0xa, 0x1, 0x0, 0xc}, @IPSET_ATTR_CIDR2={0x5, 0x15, 0x18}]}]}, 0x48}}, 0x0) socket$inet6_udp(0xa, 0x2, 0x0) socket(0x10, 0x803, 0x0) socket(0x10, 0x3, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./config\x00', 0x1ff) mount(0x0, &(0x7f0000000000)='./config\x00', &(0x7f0000000080)='configfs\x00', 0x0, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000140)='./config/usb_gadget/g1\x00', 0xbf) mkdirat(0xffffffffffffff9c, &(0x7f00000001c0)='./config/usb_gadget/g1/functions/uvc.0\x00', 0x1ff) mkdirat(0xffffffffffffff9c, &(0x7f0000000280)='./config/usb_gadget/g1/functions/uvc.0/streaming/mjpeg/m1\x00', 0x1ff) r2 = openat(0xffffffffffffff9c, &(0x7f00000002c0)='./config/usb_gadget/g1/functions/uvc.0/streaming/mjpeg/m1/bmaControls\x00', 0x2, 0x0) write(r2, &(0x7f0000000640)='12', 0x2) write$P9_RVERSION(r2, &(0x7f0000000180)={0x13, 0x65, 0xffff, 0x1017, 0xffffffffffffff96, '9P2000.L'}, 0x13) syz_usb_connect$midi(0x0, 0x4f, &(0x7f0000000280)=ANY=[], 0x0) r3 = socket$nl_route(0x10, 0x3, 0x0) ioctl$ifreq_SIOCGIFINDEX_vcan(r3, 0x8933, &(0x7f0000000040)={'vxcan0\x00'}) getuid() r4 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPSET_CMD_CREATE(r4, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000200)=ANY=[@ANYBLOB="600000000206010800000000000000000000000005000400000000000900020073797a31000000001400078008001240000000000500140008000000050005000a000000050001000600000011000300686173683a69702c706f7274"], 0x60}}, 0x24000800) r5 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPSET_CMD_ADD(r5, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000240)={&(0x7f0000000c80)=ANY=[@ANYBLOB="5c000000090601080000000000000000070000000900020073797a31000000000500010007000000340007801800018014000240fe8000000000000000000000000000bb060004400e1f00cd050007008800000006000540"], 0x5c}, 0x1, 0x0, 0x0, 0x10000042}, 0x90) program crashed: KASAN: slab-use-after-free Read in ep_open testing program (duration=2m31.5s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): [0, 22, 19, 30] detailed listing: executing program 3: executing program 0: mkdirat(0xffffffffffffff9c, &(0x7f0000000100)='./gadget\x00', 0x1ff) mount(0x0, &(0x7f0000000140)='./gadget\x00', &(0x7f0000000180)='gadgetfs\x00', 0x0, 0x0) r0 = openat(0xffffffffffffff9c, &(0x7f00000001c0)='./gadget/dummy_udc\x00', 0x2, 0x0) bpf$MAP_UPDATE_ELEM_TAIL_CALL(0x2, &(0x7f0000000380)={{}, &(0x7f0000000300), &(0x7f0000000340)=r0}, 0x20) mprotect(&(0x7f0000362000/0x2000)=nil, 0x2000, 0x1) write(r0, &(0x7f0000000200)="000000000902190001010080320904000001ff000000070581024000000902190001010080320904000001ff00000007058102000200120100020000004034127856000100000001", 0x48) r1 = openat(0xffffffffffffff9c, &(0x7f0000000000)='./gadget/ep1in-bulk\x00', 0x2, 0x24) write(r1, &(0x7f00000005c0)="010000000705810240000007058102000200", 0x12) r2 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r2, 0x8933, &(0x7f0000000040)={'bridge0\x00', 0x0}) sendmsg$nl_route(r2, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000440)=ANY=[@ANYBLOB="580000001000ffff27bd7000fadbdf2500000000", @ANYRES32=0x0, @ANYBLOB="15010000000000003000128009000100766c616e00000000200002800600050088a8000006000100010000000c000200130000001000000008000500", @ANYRES32=r3], 0x58}, 0x1, 0x0, 0x0, 0x880}, 0x8048802) madvise(&(0x7f0000bdc000/0x4000)=nil, 0x86ac726dff2f4713, 0xa) r4 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) getsockopt$bt_hci(r4, 0x0, 0x3, &(0x7f00000000c0)=""/151, &(0x7f0000000180)=0x97) r5 = syz_open_procfs(0xffffffffffffffff, &(0x7f0000000000)='attr/fscreate\x00') write$P9_RRENAME(r5, 0x0, 0x0) r6 = syz_open_dev$dvb_dvr(&(0x7f0000000280), 0x7, 0x111400) ioctl$DVB_DVR_DMX_EXPBUF(r6, 0xc00c6f3e, &(0x7f0000000040)={0x200, 0x80000, r5}) socket$inet_sctp(0x2, 0x5, 0x84) mmap(&(0x7f0000362000/0x4000)=nil, 0x4000, 0x0, 0x12, 0xffffffffffffffff, 0xfffff000) r7 = syz_clone(0x21000200, 0x0, 0x0, 0x0, 0x0, 0x0) rt_tgsigqueueinfo(r7, r7, 0x8, 0x0) executing program 8: r0 = socket(0x10, 0x3, 0x0) sendmsg$nl_route(0xffffffffffffffff, &(0x7f0000000300)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000100)=ANY=[@ANYBLOB="4800e80010000d0428bd7000fcdbff2500008000", @ANYRES32=r0, @ANYBLOB="1000000000000000280012800b00010062726964676500001800028005001900840000000c001e"], 0x48}}, 0x4084) sendmsg$nl_route(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000080)={&(0x7f00000001c0)=ANY=[@ANYBLOB="500000001000010425bbe5ad600027842cf52300", @ANYRES32=0x0, @ANYRESDEC=0x0, @ANYRES64=r0, @ANYRES16=r0], 0x50}, 0x1, 0x0, 0x0, 0x13d33d22c8a65c15}, 0x4008840) getsockopt$inet_sctp6_SCTP_NODELAY(r0, 0x84, 0x3, &(0x7f0000000280), &(0x7f00000002c0)=0x4) mkdirat(0xffffffffffffff9c, &(0x7f0000000040)='./mnt\x00', 0x1ff) mount$nfs(&(0x7f0000000080)=':27.0.0.1:/export\x00', &(0x7f00000000c0)='./mnt\x00', &(0x7f0000000180), 0x20800, &(0x7f0000000140)=ANY=[@ANYRES16=r0]) r1 = socket$inet6_icmp_raw(0xa, 0x3, 0x3a) bind$inet6(r1, &(0x7f00000001c0)={0xa, 0x4e20, 0xfffffffb, @empty, 0x2}, 0x1c) sendmmsg(r0, &(0x7f0000000000), 0x4000000000001f2, 0x0) r2 = socket$inet6_sctp(0xa, 0x1, 0x84) r3 = dup(r2) setsockopt$inet_sctp6_SCTP_SOCKOPT_BINDX_ADD(r3, 0x84, 0x64, &(0x7f0000000040)=[@in6={0xa, 0x4e24, 0x6, @loopback, 0x3}], 0x1c) getsockopt$inet_sctp_SCTP_GET_ASSOC_STATS(r3, 0x84, 0x70, &(0x7f0000000680)={0x0, @in6={{0xa, 0x4e22, 0x1, @ipv4={'\x00', '\xff\xff', @multicast1}, 0x8}}, [0xfffffffffffffffa, 0x3, 0x7, 0x3, 0x4, 0x3, 0xc, 0x8, 0x3, 0x5, 0x7, 0x100000000, 0x6, 0x2, 0x6]}, &(0x7f00000007c0)=0x100) r4 = socket$packet(0x11, 0x2, 0x300) r5 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r5, 0x8933, &(0x7f0000000040)={'ip6gretap0\x00', 0x0}) sendto$packet(r4, 0x0, 0x0, 0x0, &(0x7f0000000400)={0x11, 0x88a8, r6, 0x1, 0x0, 0x6, @local}, 0x14) r7 = openat$selinux_checkreqprot(0xffffffffffffff9c, &(0x7f0000000200), 0xa00, 0x0) io_uring_register$IORING_REGISTER_FILES(r3, 0x2, &(0x7f0000000240)=[r0, r0, r7, r0, r0, r0, r0], 0x7) executing program 4: r0 = syz_open_dev$dri(&(0x7f0000000000), 0x0, 0x0) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r0, 0xc02064b2, &(0x7f0000000040)={0x1, 0xd00, 0x6}) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r0, 0xc02064b2, &(0x7f0000000100)={0x1, 0x3, 0x9}) ioctl$DRM_IOCTL_PANTHOR_VM_CREATE(r0, 0xc0106441, &(0x7f0000000080)={0x0, 0x0, 0xffffffffffffffff}) socket$kcm(0xa, 0x2, 0x0) socket$nl_route(0x10, 0x3, 0x0) r1 = socket(0x10, 0x3, 0x0) getsockname$packet(r1, &(0x7f00000002c0)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000100)=0x14) sendmsg$nl_route(0xffffffffffffffff, &(0x7f0000000040)={0x0, 0x0, 0x0}, 0x0) sendmsg$IPSET_CMD_ADD(0xffffffffffffffff, 0x0, 0x0) sendmsg$IPSET_CMD_TEST(0xffffffffffffffff, &(0x7f0000000280)={0x0, 0x0, &(0x7f00000002c0)={&(0x7f0000000300)={0x48, 0xb, 0x6, 0x1, 0x0, 0x0, {0x2}, [@IPSET_ATTR_SETNAME={0x9, 0x2, 'syz1\x00'}, @IPSET_ATTR_DATA={0x28, 0x7, 0x0, 0x1, [@IPSET_ATTR_IP={0xc, 0x1, 0x0, 0x1, @IPSET_ATTR_IPADDR_IPV4={0x8, 0x1, 0x1, 0x0, @local}}, @IPSET_ATTR_PORT={0x6, 0x4, 0x1, 0x0, 0x5000}, @IPSET_ATTR_MARK={0x8, 0xa, 0x1, 0x0, 0xc}, @IPSET_ATTR_CIDR2={0x5, 0x15, 0x18}]}]}, 0x48}}, 0x0) socket$inet6_udp(0xa, 0x2, 0x0) socket(0x10, 0x803, 0x0) socket(0x10, 0x3, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./config\x00', 0x1ff) mount(0x0, &(0x7f0000000000)='./config\x00', &(0x7f0000000080)='configfs\x00', 0x0, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000140)='./config/usb_gadget/g1\x00', 0xbf) mkdirat(0xffffffffffffff9c, &(0x7f00000001c0)='./config/usb_gadget/g1/functions/uvc.0\x00', 0x1ff) mkdirat(0xffffffffffffff9c, &(0x7f0000000280)='./config/usb_gadget/g1/functions/uvc.0/streaming/mjpeg/m1\x00', 0x1ff) r2 = openat(0xffffffffffffff9c, &(0x7f00000002c0)='./config/usb_gadget/g1/functions/uvc.0/streaming/mjpeg/m1/bmaControls\x00', 0x2, 0x0) write(r2, &(0x7f0000000640)='12', 0x2) write$P9_RVERSION(r2, &(0x7f0000000180)={0x13, 0x65, 0xffff, 0x1017, 0xffffffffffffff96, '9P2000.L'}, 0x13) syz_usb_connect$midi(0x0, 0x4f, &(0x7f0000000280)=ANY=[], 0x0) r3 = socket$nl_route(0x10, 0x3, 0x0) ioctl$ifreq_SIOCGIFINDEX_vcan(r3, 0x8933, &(0x7f0000000040)={'vxcan0\x00'}) getuid() r4 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPSET_CMD_CREATE(r4, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000200)=ANY=[@ANYBLOB="600000000206010800000000000000000000000005000400000000000900020073797a31000000001400078008001240000000000500140008000000050005000a000000050001000600000011000300686173683a69702c706f7274"], 0x60}}, 0x24000800) r5 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPSET_CMD_ADD(r5, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000240)={&(0x7f0000000c80)=ANY=[@ANYBLOB="5c000000090601080000000000000000070000000900020073797a31000000000500010007000000340007801800018014000240fe8000000000000000000000000000bb060004400e1f00cd050007008800000006000540"], 0x5c}, 0x1, 0x0, 0x0, 0x10000042}, 0x90) program crashed: KASAN: slab-use-after-free Read in ep_open testing program (duration=2m31.5s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): [0, 21, 19, 30] detailed listing: executing program 3: executing program 0: mkdirat(0xffffffffffffff9c, &(0x7f0000000100)='./gadget\x00', 0x1ff) mount(0x0, &(0x7f0000000140)='./gadget\x00', &(0x7f0000000180)='gadgetfs\x00', 0x0, 0x0) r0 = openat(0xffffffffffffff9c, &(0x7f00000001c0)='./gadget/dummy_udc\x00', 0x2, 0x0) bpf$MAP_UPDATE_ELEM_TAIL_CALL(0x2, &(0x7f0000000380)={{}, &(0x7f0000000300), &(0x7f0000000340)=r0}, 0x20) mprotect(&(0x7f0000362000/0x2000)=nil, 0x2000, 0x1) write(r0, &(0x7f0000000200)="000000000902190001010080320904000001ff000000070581024000000902190001010080320904000001ff00000007058102000200120100020000004034127856000100000001", 0x48) r1 = openat(0xffffffffffffff9c, &(0x7f0000000000)='./gadget/ep1in-bulk\x00', 0x2, 0x24) write(r1, &(0x7f00000005c0)="010000000705810240000007058102000200", 0x12) r2 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r2, 0x8933, &(0x7f0000000040)={'bridge0\x00', 0x0}) sendmsg$nl_route(r2, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000440)=ANY=[@ANYBLOB="580000001000ffff27bd7000fadbdf2500000000", @ANYRES32=0x0, @ANYBLOB="15010000000000003000128009000100766c616e00000000200002800600050088a8000006000100010000000c000200130000001000000008000500", @ANYRES32=r3], 0x58}, 0x1, 0x0, 0x0, 0x880}, 0x8048802) madvise(&(0x7f0000bdc000/0x4000)=nil, 0x86ac726dff2f4713, 0xa) r4 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) getsockopt$bt_hci(r4, 0x0, 0x3, &(0x7f00000000c0)=""/151, &(0x7f0000000180)=0x97) r5 = syz_open_procfs(0xffffffffffffffff, &(0x7f0000000000)='attr/fscreate\x00') write$P9_RRENAME(r5, 0x0, 0x0) r6 = syz_open_dev$dvb_dvr(&(0x7f0000000280), 0x7, 0x111400) ioctl$DVB_DVR_DMX_EXPBUF(r6, 0xc00c6f3e, &(0x7f0000000040)={0x200, 0x80000, r5}) mmap(&(0x7f0000362000/0x4000)=nil, 0x4000, 0x0, 0x12, 0xffffffffffffffff, 0xfffff000) r7 = syz_clone(0x21000200, 0x0, 0x0, 0x0, 0x0, 0x0) rt_tgsigqueueinfo(r7, r7, 0x8, 0x0) executing program 8: r0 = socket(0x10, 0x3, 0x0) sendmsg$nl_route(0xffffffffffffffff, &(0x7f0000000300)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000100)=ANY=[@ANYBLOB="4800e80010000d0428bd7000fcdbff2500008000", @ANYRES32=r0, @ANYBLOB="1000000000000000280012800b00010062726964676500001800028005001900840000000c001e"], 0x48}}, 0x4084) sendmsg$nl_route(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000080)={&(0x7f00000001c0)=ANY=[@ANYBLOB="500000001000010425bbe5ad600027842cf52300", @ANYRES32=0x0, @ANYRESDEC=0x0, @ANYRES64=r0, @ANYRES16=r0], 0x50}, 0x1, 0x0, 0x0, 0x13d33d22c8a65c15}, 0x4008840) getsockopt$inet_sctp6_SCTP_NODELAY(r0, 0x84, 0x3, &(0x7f0000000280), &(0x7f00000002c0)=0x4) mkdirat(0xffffffffffffff9c, &(0x7f0000000040)='./mnt\x00', 0x1ff) mount$nfs(&(0x7f0000000080)=':27.0.0.1:/export\x00', &(0x7f00000000c0)='./mnt\x00', &(0x7f0000000180), 0x20800, &(0x7f0000000140)=ANY=[@ANYRES16=r0]) r1 = socket$inet6_icmp_raw(0xa, 0x3, 0x3a) bind$inet6(r1, &(0x7f00000001c0)={0xa, 0x4e20, 0xfffffffb, @empty, 0x2}, 0x1c) sendmmsg(r0, &(0x7f0000000000), 0x4000000000001f2, 0x0) r2 = socket$inet6_sctp(0xa, 0x1, 0x84) r3 = dup(r2) setsockopt$inet_sctp6_SCTP_SOCKOPT_BINDX_ADD(r3, 0x84, 0x64, &(0x7f0000000040)=[@in6={0xa, 0x4e24, 0x6, @loopback, 0x3}], 0x1c) getsockopt$inet_sctp_SCTP_GET_ASSOC_STATS(r3, 0x84, 0x70, &(0x7f0000000680)={0x0, @in6={{0xa, 0x4e22, 0x1, @ipv4={'\x00', '\xff\xff', @multicast1}, 0x8}}, [0xfffffffffffffffa, 0x3, 0x7, 0x3, 0x4, 0x3, 0xc, 0x8, 0x3, 0x5, 0x7, 0x100000000, 0x6, 0x2, 0x6]}, &(0x7f00000007c0)=0x100) r4 = socket$packet(0x11, 0x2, 0x300) r5 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r5, 0x8933, &(0x7f0000000040)={'ip6gretap0\x00', 0x0}) sendto$packet(r4, 0x0, 0x0, 0x0, &(0x7f0000000400)={0x11, 0x88a8, r6, 0x1, 0x0, 0x6, @local}, 0x14) r7 = openat$selinux_checkreqprot(0xffffffffffffff9c, &(0x7f0000000200), 0xa00, 0x0) io_uring_register$IORING_REGISTER_FILES(r3, 0x2, &(0x7f0000000240)=[r0, r0, r7, r0, r0, r0, r0], 0x7) executing program 4: r0 = syz_open_dev$dri(&(0x7f0000000000), 0x0, 0x0) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r0, 0xc02064b2, &(0x7f0000000040)={0x1, 0xd00, 0x6}) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r0, 0xc02064b2, &(0x7f0000000100)={0x1, 0x3, 0x9}) ioctl$DRM_IOCTL_PANTHOR_VM_CREATE(r0, 0xc0106441, &(0x7f0000000080)={0x0, 0x0, 0xffffffffffffffff}) socket$kcm(0xa, 0x2, 0x0) socket$nl_route(0x10, 0x3, 0x0) r1 = socket(0x10, 0x3, 0x0) getsockname$packet(r1, &(0x7f00000002c0)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000100)=0x14) sendmsg$nl_route(0xffffffffffffffff, &(0x7f0000000040)={0x0, 0x0, 0x0}, 0x0) sendmsg$IPSET_CMD_ADD(0xffffffffffffffff, 0x0, 0x0) sendmsg$IPSET_CMD_TEST(0xffffffffffffffff, &(0x7f0000000280)={0x0, 0x0, &(0x7f00000002c0)={&(0x7f0000000300)={0x48, 0xb, 0x6, 0x1, 0x0, 0x0, {0x2}, [@IPSET_ATTR_SETNAME={0x9, 0x2, 'syz1\x00'}, @IPSET_ATTR_DATA={0x28, 0x7, 0x0, 0x1, [@IPSET_ATTR_IP={0xc, 0x1, 0x0, 0x1, @IPSET_ATTR_IPADDR_IPV4={0x8, 0x1, 0x1, 0x0, @local}}, @IPSET_ATTR_PORT={0x6, 0x4, 0x1, 0x0, 0x5000}, @IPSET_ATTR_MARK={0x8, 0xa, 0x1, 0x0, 0xc}, @IPSET_ATTR_CIDR2={0x5, 0x15, 0x18}]}]}, 0x48}}, 0x0) socket$inet6_udp(0xa, 0x2, 0x0) socket(0x10, 0x803, 0x0) socket(0x10, 0x3, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./config\x00', 0x1ff) mount(0x0, &(0x7f0000000000)='./config\x00', &(0x7f0000000080)='configfs\x00', 0x0, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000140)='./config/usb_gadget/g1\x00', 0xbf) mkdirat(0xffffffffffffff9c, &(0x7f00000001c0)='./config/usb_gadget/g1/functions/uvc.0\x00', 0x1ff) mkdirat(0xffffffffffffff9c, &(0x7f0000000280)='./config/usb_gadget/g1/functions/uvc.0/streaming/mjpeg/m1\x00', 0x1ff) r2 = openat(0xffffffffffffff9c, &(0x7f00000002c0)='./config/usb_gadget/g1/functions/uvc.0/streaming/mjpeg/m1/bmaControls\x00', 0x2, 0x0) write(r2, &(0x7f0000000640)='12', 0x2) write$P9_RVERSION(r2, &(0x7f0000000180)={0x13, 0x65, 0xffff, 0x1017, 0xffffffffffffff96, '9P2000.L'}, 0x13) syz_usb_connect$midi(0x0, 0x4f, &(0x7f0000000280)=ANY=[], 0x0) r3 = socket$nl_route(0x10, 0x3, 0x0) ioctl$ifreq_SIOCGIFINDEX_vcan(r3, 0x8933, &(0x7f0000000040)={'vxcan0\x00'}) getuid() r4 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPSET_CMD_CREATE(r4, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000200)=ANY=[@ANYBLOB="600000000206010800000000000000000000000005000400000000000900020073797a31000000001400078008001240000000000500140008000000050005000a000000050001000600000011000300686173683a69702c706f7274"], 0x60}}, 0x24000800) r5 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPSET_CMD_ADD(r5, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000240)={&(0x7f0000000c80)=ANY=[@ANYBLOB="5c000000090601080000000000000000070000000900020073797a31000000000500010007000000340007801800018014000240fe8000000000000000000000000000bb060004400e1f00cd050007008800000006000540"], 0x5c}, 0x1, 0x0, 0x0, 0x10000042}, 0x90) program crashed: KASAN: slab-use-after-free Read in ep_open testing program (duration=2m31.5s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): [0, 20, 19, 30] detailed listing: executing program 3: executing program 0: mkdirat(0xffffffffffffff9c, &(0x7f0000000100)='./gadget\x00', 0x1ff) mount(0x0, &(0x7f0000000140)='./gadget\x00', &(0x7f0000000180)='gadgetfs\x00', 0x0, 0x0) r0 = openat(0xffffffffffffff9c, &(0x7f00000001c0)='./gadget/dummy_udc\x00', 0x2, 0x0) bpf$MAP_UPDATE_ELEM_TAIL_CALL(0x2, &(0x7f0000000380)={{}, &(0x7f0000000300), &(0x7f0000000340)=r0}, 0x20) mprotect(&(0x7f0000362000/0x2000)=nil, 0x2000, 0x1) write(r0, &(0x7f0000000200)="000000000902190001010080320904000001ff000000070581024000000902190001010080320904000001ff00000007058102000200120100020000004034127856000100000001", 0x48) r1 = openat(0xffffffffffffff9c, &(0x7f0000000000)='./gadget/ep1in-bulk\x00', 0x2, 0x24) write(r1, &(0x7f00000005c0)="010000000705810240000007058102000200", 0x12) r2 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r2, 0x8933, &(0x7f0000000040)={'bridge0\x00', 0x0}) sendmsg$nl_route(r2, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000440)=ANY=[@ANYBLOB="580000001000ffff27bd7000fadbdf2500000000", @ANYRES32=0x0, @ANYBLOB="15010000000000003000128009000100766c616e00000000200002800600050088a8000006000100010000000c000200130000001000000008000500", @ANYRES32=r3], 0x58}, 0x1, 0x0, 0x0, 0x880}, 0x8048802) madvise(&(0x7f0000bdc000/0x4000)=nil, 0x86ac726dff2f4713, 0xa) r4 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) getsockopt$bt_hci(r4, 0x0, 0x3, &(0x7f00000000c0)=""/151, &(0x7f0000000180)=0x97) r5 = syz_open_procfs(0xffffffffffffffff, &(0x7f0000000000)='attr/fscreate\x00') write$P9_RRENAME(r5, 0x0, 0x0) syz_open_dev$dvb_dvr(&(0x7f0000000280), 0x7, 0x111400) mmap(&(0x7f0000362000/0x4000)=nil, 0x4000, 0x0, 0x12, 0xffffffffffffffff, 0xfffff000) r6 = syz_clone(0x21000200, 0x0, 0x0, 0x0, 0x0, 0x0) rt_tgsigqueueinfo(r6, r6, 0x8, 0x0) executing program 8: r0 = socket(0x10, 0x3, 0x0) sendmsg$nl_route(0xffffffffffffffff, &(0x7f0000000300)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000100)=ANY=[@ANYBLOB="4800e80010000d0428bd7000fcdbff2500008000", @ANYRES32=r0, @ANYBLOB="1000000000000000280012800b00010062726964676500001800028005001900840000000c001e"], 0x48}}, 0x4084) sendmsg$nl_route(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000080)={&(0x7f00000001c0)=ANY=[@ANYBLOB="500000001000010425bbe5ad600027842cf52300", @ANYRES32=0x0, @ANYRESDEC=0x0, @ANYRES64=r0, @ANYRES16=r0], 0x50}, 0x1, 0x0, 0x0, 0x13d33d22c8a65c15}, 0x4008840) getsockopt$inet_sctp6_SCTP_NODELAY(r0, 0x84, 0x3, &(0x7f0000000280), &(0x7f00000002c0)=0x4) mkdirat(0xffffffffffffff9c, &(0x7f0000000040)='./mnt\x00', 0x1ff) mount$nfs(&(0x7f0000000080)=':27.0.0.1:/export\x00', &(0x7f00000000c0)='./mnt\x00', &(0x7f0000000180), 0x20800, &(0x7f0000000140)=ANY=[@ANYRES16=r0]) r1 = socket$inet6_icmp_raw(0xa, 0x3, 0x3a) bind$inet6(r1, &(0x7f00000001c0)={0xa, 0x4e20, 0xfffffffb, @empty, 0x2}, 0x1c) sendmmsg(r0, &(0x7f0000000000), 0x4000000000001f2, 0x0) r2 = socket$inet6_sctp(0xa, 0x1, 0x84) r3 = dup(r2) setsockopt$inet_sctp6_SCTP_SOCKOPT_BINDX_ADD(r3, 0x84, 0x64, &(0x7f0000000040)=[@in6={0xa, 0x4e24, 0x6, @loopback, 0x3}], 0x1c) getsockopt$inet_sctp_SCTP_GET_ASSOC_STATS(r3, 0x84, 0x70, &(0x7f0000000680)={0x0, @in6={{0xa, 0x4e22, 0x1, @ipv4={'\x00', '\xff\xff', @multicast1}, 0x8}}, [0xfffffffffffffffa, 0x3, 0x7, 0x3, 0x4, 0x3, 0xc, 0x8, 0x3, 0x5, 0x7, 0x100000000, 0x6, 0x2, 0x6]}, &(0x7f00000007c0)=0x100) r4 = socket$packet(0x11, 0x2, 0x300) r5 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r5, 0x8933, &(0x7f0000000040)={'ip6gretap0\x00', 0x0}) sendto$packet(r4, 0x0, 0x0, 0x0, &(0x7f0000000400)={0x11, 0x88a8, r6, 0x1, 0x0, 0x6, @local}, 0x14) r7 = openat$selinux_checkreqprot(0xffffffffffffff9c, &(0x7f0000000200), 0xa00, 0x0) io_uring_register$IORING_REGISTER_FILES(r3, 0x2, &(0x7f0000000240)=[r0, r0, r7, r0, r0, r0, r0], 0x7) executing program 4: r0 = syz_open_dev$dri(&(0x7f0000000000), 0x0, 0x0) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r0, 0xc02064b2, &(0x7f0000000040)={0x1, 0xd00, 0x6}) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r0, 0xc02064b2, &(0x7f0000000100)={0x1, 0x3, 0x9}) ioctl$DRM_IOCTL_PANTHOR_VM_CREATE(r0, 0xc0106441, &(0x7f0000000080)={0x0, 0x0, 0xffffffffffffffff}) socket$kcm(0xa, 0x2, 0x0) socket$nl_route(0x10, 0x3, 0x0) r1 = socket(0x10, 0x3, 0x0) getsockname$packet(r1, &(0x7f00000002c0)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000100)=0x14) sendmsg$nl_route(0xffffffffffffffff, &(0x7f0000000040)={0x0, 0x0, 0x0}, 0x0) sendmsg$IPSET_CMD_ADD(0xffffffffffffffff, 0x0, 0x0) sendmsg$IPSET_CMD_TEST(0xffffffffffffffff, &(0x7f0000000280)={0x0, 0x0, &(0x7f00000002c0)={&(0x7f0000000300)={0x48, 0xb, 0x6, 0x1, 0x0, 0x0, {0x2}, [@IPSET_ATTR_SETNAME={0x9, 0x2, 'syz1\x00'}, @IPSET_ATTR_DATA={0x28, 0x7, 0x0, 0x1, [@IPSET_ATTR_IP={0xc, 0x1, 0x0, 0x1, @IPSET_ATTR_IPADDR_IPV4={0x8, 0x1, 0x1, 0x0, @local}}, @IPSET_ATTR_PORT={0x6, 0x4, 0x1, 0x0, 0x5000}, @IPSET_ATTR_MARK={0x8, 0xa, 0x1, 0x0, 0xc}, @IPSET_ATTR_CIDR2={0x5, 0x15, 0x18}]}]}, 0x48}}, 0x0) socket$inet6_udp(0xa, 0x2, 0x0) socket(0x10, 0x803, 0x0) socket(0x10, 0x3, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./config\x00', 0x1ff) mount(0x0, &(0x7f0000000000)='./config\x00', &(0x7f0000000080)='configfs\x00', 0x0, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000140)='./config/usb_gadget/g1\x00', 0xbf) mkdirat(0xffffffffffffff9c, &(0x7f00000001c0)='./config/usb_gadget/g1/functions/uvc.0\x00', 0x1ff) mkdirat(0xffffffffffffff9c, &(0x7f0000000280)='./config/usb_gadget/g1/functions/uvc.0/streaming/mjpeg/m1\x00', 0x1ff) r2 = openat(0xffffffffffffff9c, &(0x7f00000002c0)='./config/usb_gadget/g1/functions/uvc.0/streaming/mjpeg/m1/bmaControls\x00', 0x2, 0x0) write(r2, &(0x7f0000000640)='12', 0x2) write$P9_RVERSION(r2, &(0x7f0000000180)={0x13, 0x65, 0xffff, 0x1017, 0xffffffffffffff96, '9P2000.L'}, 0x13) syz_usb_connect$midi(0x0, 0x4f, &(0x7f0000000280)=ANY=[], 0x0) r3 = socket$nl_route(0x10, 0x3, 0x0) ioctl$ifreq_SIOCGIFINDEX_vcan(r3, 0x8933, &(0x7f0000000040)={'vxcan0\x00'}) getuid() r4 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPSET_CMD_CREATE(r4, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000200)=ANY=[@ANYBLOB="600000000206010800000000000000000000000005000400000000000900020073797a31000000001400078008001240000000000500140008000000050005000a000000050001000600000011000300686173683a69702c706f7274"], 0x60}}, 0x24000800) r5 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPSET_CMD_ADD(r5, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000240)={&(0x7f0000000c80)=ANY=[@ANYBLOB="5c000000090601080000000000000000070000000900020073797a31000000000500010007000000340007801800018014000240fe8000000000000000000000000000bb060004400e1f00cd050007008800000006000540"], 0x5c}, 0x1, 0x0, 0x0, 0x10000042}, 0x90) program crashed: KASAN: slab-use-after-free Read in ep_open testing program (duration=2m31.5s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): [0, 19, 19, 30] detailed listing: executing program 3: executing program 0: mkdirat(0xffffffffffffff9c, &(0x7f0000000100)='./gadget\x00', 0x1ff) mount(0x0, &(0x7f0000000140)='./gadget\x00', &(0x7f0000000180)='gadgetfs\x00', 0x0, 0x0) r0 = openat(0xffffffffffffff9c, &(0x7f00000001c0)='./gadget/dummy_udc\x00', 0x2, 0x0) bpf$MAP_UPDATE_ELEM_TAIL_CALL(0x2, &(0x7f0000000380)={{}, &(0x7f0000000300), &(0x7f0000000340)=r0}, 0x20) mprotect(&(0x7f0000362000/0x2000)=nil, 0x2000, 0x1) write(r0, &(0x7f0000000200)="000000000902190001010080320904000001ff000000070581024000000902190001010080320904000001ff00000007058102000200120100020000004034127856000100000001", 0x48) r1 = openat(0xffffffffffffff9c, &(0x7f0000000000)='./gadget/ep1in-bulk\x00', 0x2, 0x24) write(r1, &(0x7f00000005c0)="010000000705810240000007058102000200", 0x12) r2 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r2, 0x8933, &(0x7f0000000040)={'bridge0\x00', 0x0}) sendmsg$nl_route(r2, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000440)=ANY=[@ANYBLOB="580000001000ffff27bd7000fadbdf2500000000", @ANYRES32=0x0, @ANYBLOB="15010000000000003000128009000100766c616e00000000200002800600050088a8000006000100010000000c000200130000001000000008000500", @ANYRES32=r3], 0x58}, 0x1, 0x0, 0x0, 0x880}, 0x8048802) madvise(&(0x7f0000bdc000/0x4000)=nil, 0x86ac726dff2f4713, 0xa) r4 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) getsockopt$bt_hci(r4, 0x0, 0x3, &(0x7f00000000c0)=""/151, &(0x7f0000000180)=0x97) r5 = syz_open_procfs(0xffffffffffffffff, &(0x7f0000000000)='attr/fscreate\x00') write$P9_RRENAME(r5, 0x0, 0x0) mmap(&(0x7f0000362000/0x4000)=nil, 0x4000, 0x0, 0x12, 0xffffffffffffffff, 0xfffff000) r6 = syz_clone(0x21000200, 0x0, 0x0, 0x0, 0x0, 0x0) rt_tgsigqueueinfo(r6, r6, 0x8, 0x0) executing program 8: r0 = socket(0x10, 0x3, 0x0) sendmsg$nl_route(0xffffffffffffffff, &(0x7f0000000300)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000100)=ANY=[@ANYBLOB="4800e80010000d0428bd7000fcdbff2500008000", @ANYRES32=r0, @ANYBLOB="1000000000000000280012800b00010062726964676500001800028005001900840000000c001e"], 0x48}}, 0x4084) sendmsg$nl_route(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000080)={&(0x7f00000001c0)=ANY=[@ANYBLOB="500000001000010425bbe5ad600027842cf52300", @ANYRES32=0x0, @ANYRESDEC=0x0, @ANYRES64=r0, @ANYRES16=r0], 0x50}, 0x1, 0x0, 0x0, 0x13d33d22c8a65c15}, 0x4008840) getsockopt$inet_sctp6_SCTP_NODELAY(r0, 0x84, 0x3, &(0x7f0000000280), &(0x7f00000002c0)=0x4) mkdirat(0xffffffffffffff9c, &(0x7f0000000040)='./mnt\x00', 0x1ff) mount$nfs(&(0x7f0000000080)=':27.0.0.1:/export\x00', &(0x7f00000000c0)='./mnt\x00', &(0x7f0000000180), 0x20800, &(0x7f0000000140)=ANY=[@ANYRES16=r0]) r1 = socket$inet6_icmp_raw(0xa, 0x3, 0x3a) bind$inet6(r1, &(0x7f00000001c0)={0xa, 0x4e20, 0xfffffffb, @empty, 0x2}, 0x1c) sendmmsg(r0, &(0x7f0000000000), 0x4000000000001f2, 0x0) r2 = socket$inet6_sctp(0xa, 0x1, 0x84) r3 = dup(r2) setsockopt$inet_sctp6_SCTP_SOCKOPT_BINDX_ADD(r3, 0x84, 0x64, &(0x7f0000000040)=[@in6={0xa, 0x4e24, 0x6, @loopback, 0x3}], 0x1c) getsockopt$inet_sctp_SCTP_GET_ASSOC_STATS(r3, 0x84, 0x70, &(0x7f0000000680)={0x0, @in6={{0xa, 0x4e22, 0x1, @ipv4={'\x00', '\xff\xff', @multicast1}, 0x8}}, [0xfffffffffffffffa, 0x3, 0x7, 0x3, 0x4, 0x3, 0xc, 0x8, 0x3, 0x5, 0x7, 0x100000000, 0x6, 0x2, 0x6]}, &(0x7f00000007c0)=0x100) r4 = socket$packet(0x11, 0x2, 0x300) r5 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r5, 0x8933, &(0x7f0000000040)={'ip6gretap0\x00', 0x0}) sendto$packet(r4, 0x0, 0x0, 0x0, &(0x7f0000000400)={0x11, 0x88a8, r6, 0x1, 0x0, 0x6, @local}, 0x14) r7 = openat$selinux_checkreqprot(0xffffffffffffff9c, &(0x7f0000000200), 0xa00, 0x0) io_uring_register$IORING_REGISTER_FILES(r3, 0x2, &(0x7f0000000240)=[r0, r0, r7, r0, r0, r0, r0], 0x7) executing program 4: r0 = syz_open_dev$dri(&(0x7f0000000000), 0x0, 0x0) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r0, 0xc02064b2, &(0x7f0000000040)={0x1, 0xd00, 0x6}) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r0, 0xc02064b2, &(0x7f0000000100)={0x1, 0x3, 0x9}) ioctl$DRM_IOCTL_PANTHOR_VM_CREATE(r0, 0xc0106441, &(0x7f0000000080)={0x0, 0x0, 0xffffffffffffffff}) socket$kcm(0xa, 0x2, 0x0) socket$nl_route(0x10, 0x3, 0x0) r1 = socket(0x10, 0x3, 0x0) getsockname$packet(r1, &(0x7f00000002c0)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000100)=0x14) sendmsg$nl_route(0xffffffffffffffff, &(0x7f0000000040)={0x0, 0x0, 0x0}, 0x0) sendmsg$IPSET_CMD_ADD(0xffffffffffffffff, 0x0, 0x0) sendmsg$IPSET_CMD_TEST(0xffffffffffffffff, &(0x7f0000000280)={0x0, 0x0, &(0x7f00000002c0)={&(0x7f0000000300)={0x48, 0xb, 0x6, 0x1, 0x0, 0x0, {0x2}, [@IPSET_ATTR_SETNAME={0x9, 0x2, 'syz1\x00'}, @IPSET_ATTR_DATA={0x28, 0x7, 0x0, 0x1, [@IPSET_ATTR_IP={0xc, 0x1, 0x0, 0x1, @IPSET_ATTR_IPADDR_IPV4={0x8, 0x1, 0x1, 0x0, @local}}, @IPSET_ATTR_PORT={0x6, 0x4, 0x1, 0x0, 0x5000}, @IPSET_ATTR_MARK={0x8, 0xa, 0x1, 0x0, 0xc}, @IPSET_ATTR_CIDR2={0x5, 0x15, 0x18}]}]}, 0x48}}, 0x0) socket$inet6_udp(0xa, 0x2, 0x0) socket(0x10, 0x803, 0x0) socket(0x10, 0x3, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./config\x00', 0x1ff) mount(0x0, &(0x7f0000000000)='./config\x00', &(0x7f0000000080)='configfs\x00', 0x0, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000140)='./config/usb_gadget/g1\x00', 0xbf) mkdirat(0xffffffffffffff9c, &(0x7f00000001c0)='./config/usb_gadget/g1/functions/uvc.0\x00', 0x1ff) mkdirat(0xffffffffffffff9c, &(0x7f0000000280)='./config/usb_gadget/g1/functions/uvc.0/streaming/mjpeg/m1\x00', 0x1ff) r2 = openat(0xffffffffffffff9c, &(0x7f00000002c0)='./config/usb_gadget/g1/functions/uvc.0/streaming/mjpeg/m1/bmaControls\x00', 0x2, 0x0) write(r2, &(0x7f0000000640)='12', 0x2) write$P9_RVERSION(r2, &(0x7f0000000180)={0x13, 0x65, 0xffff, 0x1017, 0xffffffffffffff96, '9P2000.L'}, 0x13) syz_usb_connect$midi(0x0, 0x4f, &(0x7f0000000280)=ANY=[], 0x0) r3 = socket$nl_route(0x10, 0x3, 0x0) ioctl$ifreq_SIOCGIFINDEX_vcan(r3, 0x8933, &(0x7f0000000040)={'vxcan0\x00'}) getuid() r4 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPSET_CMD_CREATE(r4, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000200)=ANY=[@ANYBLOB="600000000206010800000000000000000000000005000400000000000900020073797a31000000001400078008001240000000000500140008000000050005000a000000050001000600000011000300686173683a69702c706f7274"], 0x60}}, 0x24000800) r5 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPSET_CMD_ADD(r5, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000240)={&(0x7f0000000c80)=ANY=[@ANYBLOB="5c000000090601080000000000000000070000000900020073797a31000000000500010007000000340007801800018014000240fe8000000000000000000000000000bb060004400e1f00cd050007008800000006000540"], 0x5c}, 0x1, 0x0, 0x0, 0x10000042}, 0x90) program crashed: KASAN: slab-use-after-free Read in ep_open testing program (duration=2m31.5s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): [0, 18, 19, 30] detailed listing: executing program 3: executing program 0: mkdirat(0xffffffffffffff9c, &(0x7f0000000100)='./gadget\x00', 0x1ff) mount(0x0, &(0x7f0000000140)='./gadget\x00', &(0x7f0000000180)='gadgetfs\x00', 0x0, 0x0) r0 = openat(0xffffffffffffff9c, &(0x7f00000001c0)='./gadget/dummy_udc\x00', 0x2, 0x0) bpf$MAP_UPDATE_ELEM_TAIL_CALL(0x2, &(0x7f0000000380)={{}, &(0x7f0000000300), &(0x7f0000000340)=r0}, 0x20) mprotect(&(0x7f0000362000/0x2000)=nil, 0x2000, 0x1) write(r0, &(0x7f0000000200)="000000000902190001010080320904000001ff000000070581024000000902190001010080320904000001ff00000007058102000200120100020000004034127856000100000001", 0x48) r1 = openat(0xffffffffffffff9c, &(0x7f0000000000)='./gadget/ep1in-bulk\x00', 0x2, 0x24) write(r1, &(0x7f00000005c0)="010000000705810240000007058102000200", 0x12) r2 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r2, 0x8933, &(0x7f0000000040)={'bridge0\x00', 0x0}) sendmsg$nl_route(r2, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000440)=ANY=[@ANYBLOB="580000001000ffff27bd7000fadbdf2500000000", @ANYRES32=0x0, @ANYBLOB="15010000000000003000128009000100766c616e00000000200002800600050088a8000006000100010000000c000200130000001000000008000500", @ANYRES32=r3], 0x58}, 0x1, 0x0, 0x0, 0x880}, 0x8048802) madvise(&(0x7f0000bdc000/0x4000)=nil, 0x86ac726dff2f4713, 0xa) r4 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) getsockopt$bt_hci(r4, 0x0, 0x3, &(0x7f00000000c0)=""/151, &(0x7f0000000180)=0x97) syz_open_procfs(0xffffffffffffffff, &(0x7f0000000000)='attr/fscreate\x00') mmap(&(0x7f0000362000/0x4000)=nil, 0x4000, 0x0, 0x12, 0xffffffffffffffff, 0xfffff000) r5 = syz_clone(0x21000200, 0x0, 0x0, 0x0, 0x0, 0x0) rt_tgsigqueueinfo(r5, r5, 0x8, 0x0) executing program 8: r0 = socket(0x10, 0x3, 0x0) sendmsg$nl_route(0xffffffffffffffff, &(0x7f0000000300)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000100)=ANY=[@ANYBLOB="4800e80010000d0428bd7000fcdbff2500008000", @ANYRES32=r0, @ANYBLOB="1000000000000000280012800b00010062726964676500001800028005001900840000000c001e"], 0x48}}, 0x4084) sendmsg$nl_route(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000080)={&(0x7f00000001c0)=ANY=[@ANYBLOB="500000001000010425bbe5ad600027842cf52300", @ANYRES32=0x0, @ANYRESDEC=0x0, @ANYRES64=r0, @ANYRES16=r0], 0x50}, 0x1, 0x0, 0x0, 0x13d33d22c8a65c15}, 0x4008840) getsockopt$inet_sctp6_SCTP_NODELAY(r0, 0x84, 0x3, &(0x7f0000000280), &(0x7f00000002c0)=0x4) mkdirat(0xffffffffffffff9c, &(0x7f0000000040)='./mnt\x00', 0x1ff) mount$nfs(&(0x7f0000000080)=':27.0.0.1:/export\x00', &(0x7f00000000c0)='./mnt\x00', &(0x7f0000000180), 0x20800, &(0x7f0000000140)=ANY=[@ANYRES16=r0]) r1 = socket$inet6_icmp_raw(0xa, 0x3, 0x3a) bind$inet6(r1, &(0x7f00000001c0)={0xa, 0x4e20, 0xfffffffb, @empty, 0x2}, 0x1c) sendmmsg(r0, &(0x7f0000000000), 0x4000000000001f2, 0x0) r2 = socket$inet6_sctp(0xa, 0x1, 0x84) r3 = dup(r2) setsockopt$inet_sctp6_SCTP_SOCKOPT_BINDX_ADD(r3, 0x84, 0x64, &(0x7f0000000040)=[@in6={0xa, 0x4e24, 0x6, @loopback, 0x3}], 0x1c) getsockopt$inet_sctp_SCTP_GET_ASSOC_STATS(r3, 0x84, 0x70, &(0x7f0000000680)={0x0, @in6={{0xa, 0x4e22, 0x1, @ipv4={'\x00', '\xff\xff', @multicast1}, 0x8}}, [0xfffffffffffffffa, 0x3, 0x7, 0x3, 0x4, 0x3, 0xc, 0x8, 0x3, 0x5, 0x7, 0x100000000, 0x6, 0x2, 0x6]}, &(0x7f00000007c0)=0x100) r4 = socket$packet(0x11, 0x2, 0x300) r5 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r5, 0x8933, &(0x7f0000000040)={'ip6gretap0\x00', 0x0}) sendto$packet(r4, 0x0, 0x0, 0x0, &(0x7f0000000400)={0x11, 0x88a8, r6, 0x1, 0x0, 0x6, @local}, 0x14) r7 = openat$selinux_checkreqprot(0xffffffffffffff9c, &(0x7f0000000200), 0xa00, 0x0) io_uring_register$IORING_REGISTER_FILES(r3, 0x2, &(0x7f0000000240)=[r0, r0, r7, r0, r0, r0, r0], 0x7) executing program 4: r0 = syz_open_dev$dri(&(0x7f0000000000), 0x0, 0x0) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r0, 0xc02064b2, &(0x7f0000000040)={0x1, 0xd00, 0x6}) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r0, 0xc02064b2, &(0x7f0000000100)={0x1, 0x3, 0x9}) ioctl$DRM_IOCTL_PANTHOR_VM_CREATE(r0, 0xc0106441, &(0x7f0000000080)={0x0, 0x0, 0xffffffffffffffff}) socket$kcm(0xa, 0x2, 0x0) socket$nl_route(0x10, 0x3, 0x0) r1 = socket(0x10, 0x3, 0x0) getsockname$packet(r1, &(0x7f00000002c0)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000100)=0x14) sendmsg$nl_route(0xffffffffffffffff, &(0x7f0000000040)={0x0, 0x0, 0x0}, 0x0) sendmsg$IPSET_CMD_ADD(0xffffffffffffffff, 0x0, 0x0) sendmsg$IPSET_CMD_TEST(0xffffffffffffffff, &(0x7f0000000280)={0x0, 0x0, &(0x7f00000002c0)={&(0x7f0000000300)={0x48, 0xb, 0x6, 0x1, 0x0, 0x0, {0x2}, [@IPSET_ATTR_SETNAME={0x9, 0x2, 'syz1\x00'}, @IPSET_ATTR_DATA={0x28, 0x7, 0x0, 0x1, [@IPSET_ATTR_IP={0xc, 0x1, 0x0, 0x1, @IPSET_ATTR_IPADDR_IPV4={0x8, 0x1, 0x1, 0x0, @local}}, @IPSET_ATTR_PORT={0x6, 0x4, 0x1, 0x0, 0x5000}, @IPSET_ATTR_MARK={0x8, 0xa, 0x1, 0x0, 0xc}, @IPSET_ATTR_CIDR2={0x5, 0x15, 0x18}]}]}, 0x48}}, 0x0) socket$inet6_udp(0xa, 0x2, 0x0) socket(0x10, 0x803, 0x0) socket(0x10, 0x3, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./config\x00', 0x1ff) mount(0x0, &(0x7f0000000000)='./config\x00', &(0x7f0000000080)='configfs\x00', 0x0, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000140)='./config/usb_gadget/g1\x00', 0xbf) mkdirat(0xffffffffffffff9c, &(0x7f00000001c0)='./config/usb_gadget/g1/functions/uvc.0\x00', 0x1ff) mkdirat(0xffffffffffffff9c, &(0x7f0000000280)='./config/usb_gadget/g1/functions/uvc.0/streaming/mjpeg/m1\x00', 0x1ff) r2 = openat(0xffffffffffffff9c, &(0x7f00000002c0)='./config/usb_gadget/g1/functions/uvc.0/streaming/mjpeg/m1/bmaControls\x00', 0x2, 0x0) write(r2, &(0x7f0000000640)='12', 0x2) write$P9_RVERSION(r2, &(0x7f0000000180)={0x13, 0x65, 0xffff, 0x1017, 0xffffffffffffff96, '9P2000.L'}, 0x13) syz_usb_connect$midi(0x0, 0x4f, &(0x7f0000000280)=ANY=[], 0x0) r3 = socket$nl_route(0x10, 0x3, 0x0) ioctl$ifreq_SIOCGIFINDEX_vcan(r3, 0x8933, &(0x7f0000000040)={'vxcan0\x00'}) getuid() r4 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPSET_CMD_CREATE(r4, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000200)=ANY=[@ANYBLOB="600000000206010800000000000000000000000005000400000000000900020073797a31000000001400078008001240000000000500140008000000050005000a000000050001000600000011000300686173683a69702c706f7274"], 0x60}}, 0x24000800) r5 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPSET_CMD_ADD(r5, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000240)={&(0x7f0000000c80)=ANY=[@ANYBLOB="5c000000090601080000000000000000070000000900020073797a31000000000500010007000000340007801800018014000240fe8000000000000000000000000000bb060004400e1f00cd050007008800000006000540"], 0x5c}, 0x1, 0x0, 0x0, 0x10000042}, 0x90) program did not crash testing program (duration=2m31.5s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): [0, 18, 19, 30] detailed listing: executing program 3: executing program 0: mkdirat(0xffffffffffffff9c, &(0x7f0000000100)='./gadget\x00', 0x1ff) mount(0x0, &(0x7f0000000140)='./gadget\x00', &(0x7f0000000180)='gadgetfs\x00', 0x0, 0x0) r0 = openat(0xffffffffffffff9c, &(0x7f00000001c0)='./gadget/dummy_udc\x00', 0x2, 0x0) bpf$MAP_UPDATE_ELEM_TAIL_CALL(0x2, &(0x7f0000000380)={{}, &(0x7f0000000300), &(0x7f0000000340)=r0}, 0x20) mprotect(&(0x7f0000362000/0x2000)=nil, 0x2000, 0x1) write(r0, &(0x7f0000000200)="000000000902190001010080320904000001ff000000070581024000000902190001010080320904000001ff00000007058102000200120100020000004034127856000100000001", 0x48) r1 = openat(0xffffffffffffff9c, &(0x7f0000000000)='./gadget/ep1in-bulk\x00', 0x2, 0x24) write(r1, &(0x7f00000005c0)="010000000705810240000007058102000200", 0x12) r2 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r2, 0x8933, &(0x7f0000000040)={'bridge0\x00', 0x0}) sendmsg$nl_route(r2, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000440)=ANY=[@ANYBLOB="580000001000ffff27bd7000fadbdf2500000000", @ANYRES32=0x0, @ANYBLOB="15010000000000003000128009000100766c616e00000000200002800600050088a8000006000100010000000c000200130000001000000008000500", @ANYRES32=r3], 0x58}, 0x1, 0x0, 0x0, 0x880}, 0x8048802) madvise(&(0x7f0000bdc000/0x4000)=nil, 0x86ac726dff2f4713, 0xa) r4 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) getsockopt$bt_hci(r4, 0x0, 0x3, &(0x7f00000000c0)=""/151, &(0x7f0000000180)=0x97) write$P9_RRENAME(0xffffffffffffffff, 0x0, 0x0) mmap(&(0x7f0000362000/0x4000)=nil, 0x4000, 0x0, 0x12, 0xffffffffffffffff, 0xfffff000) r5 = syz_clone(0x21000200, 0x0, 0x0, 0x0, 0x0, 0x0) rt_tgsigqueueinfo(r5, r5, 0x8, 0x0) executing program 8: r0 = socket(0x10, 0x3, 0x0) sendmsg$nl_route(0xffffffffffffffff, &(0x7f0000000300)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000100)=ANY=[@ANYBLOB="4800e80010000d0428bd7000fcdbff2500008000", @ANYRES32=r0, @ANYBLOB="1000000000000000280012800b00010062726964676500001800028005001900840000000c001e"], 0x48}}, 0x4084) sendmsg$nl_route(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000080)={&(0x7f00000001c0)=ANY=[@ANYBLOB="500000001000010425bbe5ad600027842cf52300", @ANYRES32=0x0, @ANYRESDEC=0x0, @ANYRES64=r0, @ANYRES16=r0], 0x50}, 0x1, 0x0, 0x0, 0x13d33d22c8a65c15}, 0x4008840) getsockopt$inet_sctp6_SCTP_NODELAY(r0, 0x84, 0x3, &(0x7f0000000280), &(0x7f00000002c0)=0x4) mkdirat(0xffffffffffffff9c, &(0x7f0000000040)='./mnt\x00', 0x1ff) mount$nfs(&(0x7f0000000080)=':27.0.0.1:/export\x00', &(0x7f00000000c0)='./mnt\x00', &(0x7f0000000180), 0x20800, &(0x7f0000000140)=ANY=[@ANYRES16=r0]) r1 = socket$inet6_icmp_raw(0xa, 0x3, 0x3a) bind$inet6(r1, &(0x7f00000001c0)={0xa, 0x4e20, 0xfffffffb, @empty, 0x2}, 0x1c) sendmmsg(r0, &(0x7f0000000000), 0x4000000000001f2, 0x0) r2 = socket$inet6_sctp(0xa, 0x1, 0x84) r3 = dup(r2) setsockopt$inet_sctp6_SCTP_SOCKOPT_BINDX_ADD(r3, 0x84, 0x64, &(0x7f0000000040)=[@in6={0xa, 0x4e24, 0x6, @loopback, 0x3}], 0x1c) getsockopt$inet_sctp_SCTP_GET_ASSOC_STATS(r3, 0x84, 0x70, &(0x7f0000000680)={0x0, @in6={{0xa, 0x4e22, 0x1, @ipv4={'\x00', '\xff\xff', @multicast1}, 0x8}}, [0xfffffffffffffffa, 0x3, 0x7, 0x3, 0x4, 0x3, 0xc, 0x8, 0x3, 0x5, 0x7, 0x100000000, 0x6, 0x2, 0x6]}, &(0x7f00000007c0)=0x100) r4 = socket$packet(0x11, 0x2, 0x300) r5 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r5, 0x8933, &(0x7f0000000040)={'ip6gretap0\x00', 0x0}) sendto$packet(r4, 0x0, 0x0, 0x0, &(0x7f0000000400)={0x11, 0x88a8, r6, 0x1, 0x0, 0x6, @local}, 0x14) r7 = openat$selinux_checkreqprot(0xffffffffffffff9c, &(0x7f0000000200), 0xa00, 0x0) io_uring_register$IORING_REGISTER_FILES(r3, 0x2, &(0x7f0000000240)=[r0, r0, r7, r0, r0, r0, r0], 0x7) executing program 4: r0 = syz_open_dev$dri(&(0x7f0000000000), 0x0, 0x0) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r0, 0xc02064b2, &(0x7f0000000040)={0x1, 0xd00, 0x6}) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r0, 0xc02064b2, &(0x7f0000000100)={0x1, 0x3, 0x9}) ioctl$DRM_IOCTL_PANTHOR_VM_CREATE(r0, 0xc0106441, &(0x7f0000000080)={0x0, 0x0, 0xffffffffffffffff}) socket$kcm(0xa, 0x2, 0x0) socket$nl_route(0x10, 0x3, 0x0) r1 = socket(0x10, 0x3, 0x0) getsockname$packet(r1, &(0x7f00000002c0)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000100)=0x14) sendmsg$nl_route(0xffffffffffffffff, &(0x7f0000000040)={0x0, 0x0, 0x0}, 0x0) sendmsg$IPSET_CMD_ADD(0xffffffffffffffff, 0x0, 0x0) sendmsg$IPSET_CMD_TEST(0xffffffffffffffff, &(0x7f0000000280)={0x0, 0x0, &(0x7f00000002c0)={&(0x7f0000000300)={0x48, 0xb, 0x6, 0x1, 0x0, 0x0, {0x2}, [@IPSET_ATTR_SETNAME={0x9, 0x2, 'syz1\x00'}, @IPSET_ATTR_DATA={0x28, 0x7, 0x0, 0x1, [@IPSET_ATTR_IP={0xc, 0x1, 0x0, 0x1, @IPSET_ATTR_IPADDR_IPV4={0x8, 0x1, 0x1, 0x0, @local}}, @IPSET_ATTR_PORT={0x6, 0x4, 0x1, 0x0, 0x5000}, @IPSET_ATTR_MARK={0x8, 0xa, 0x1, 0x0, 0xc}, @IPSET_ATTR_CIDR2={0x5, 0x15, 0x18}]}]}, 0x48}}, 0x0) socket$inet6_udp(0xa, 0x2, 0x0) socket(0x10, 0x803, 0x0) socket(0x10, 0x3, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./config\x00', 0x1ff) mount(0x0, &(0x7f0000000000)='./config\x00', &(0x7f0000000080)='configfs\x00', 0x0, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000140)='./config/usb_gadget/g1\x00', 0xbf) mkdirat(0xffffffffffffff9c, &(0x7f00000001c0)='./config/usb_gadget/g1/functions/uvc.0\x00', 0x1ff) mkdirat(0xffffffffffffff9c, &(0x7f0000000280)='./config/usb_gadget/g1/functions/uvc.0/streaming/mjpeg/m1\x00', 0x1ff) r2 = openat(0xffffffffffffff9c, &(0x7f00000002c0)='./config/usb_gadget/g1/functions/uvc.0/streaming/mjpeg/m1/bmaControls\x00', 0x2, 0x0) write(r2, &(0x7f0000000640)='12', 0x2) write$P9_RVERSION(r2, &(0x7f0000000180)={0x13, 0x65, 0xffff, 0x1017, 0xffffffffffffff96, '9P2000.L'}, 0x13) syz_usb_connect$midi(0x0, 0x4f, &(0x7f0000000280)=ANY=[], 0x0) r3 = socket$nl_route(0x10, 0x3, 0x0) ioctl$ifreq_SIOCGIFINDEX_vcan(r3, 0x8933, &(0x7f0000000040)={'vxcan0\x00'}) getuid() r4 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPSET_CMD_CREATE(r4, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000200)=ANY=[@ANYBLOB="600000000206010800000000000000000000000005000400000000000900020073797a31000000001400078008001240000000000500140008000000050005000a000000050001000600000011000300686173683a69702c706f7274"], 0x60}}, 0x24000800) r5 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPSET_CMD_ADD(r5, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000240)={&(0x7f0000000c80)=ANY=[@ANYBLOB="5c000000090601080000000000000000070000000900020073797a31000000000500010007000000340007801800018014000240fe8000000000000000000000000000bb060004400e1f00cd050007008800000006000540"], 0x5c}, 0x1, 0x0, 0x0, 0x10000042}, 0x90) program crashed: KASAN: slab-use-after-free Read in ep_open testing program (duration=2m31.5s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): [0, 17, 19, 30] detailed listing: executing program 3: executing program 0: mkdirat(0xffffffffffffff9c, &(0x7f0000000100)='./gadget\x00', 0x1ff) mount(0x0, &(0x7f0000000140)='./gadget\x00', &(0x7f0000000180)='gadgetfs\x00', 0x0, 0x0) r0 = openat(0xffffffffffffff9c, &(0x7f00000001c0)='./gadget/dummy_udc\x00', 0x2, 0x0) bpf$MAP_UPDATE_ELEM_TAIL_CALL(0x2, &(0x7f0000000380)={{}, &(0x7f0000000300), &(0x7f0000000340)=r0}, 0x20) mprotect(&(0x7f0000362000/0x2000)=nil, 0x2000, 0x1) write(r0, &(0x7f0000000200)="000000000902190001010080320904000001ff000000070581024000000902190001010080320904000001ff00000007058102000200120100020000004034127856000100000001", 0x48) r1 = openat(0xffffffffffffff9c, &(0x7f0000000000)='./gadget/ep1in-bulk\x00', 0x2, 0x24) write(r1, &(0x7f00000005c0)="010000000705810240000007058102000200", 0x12) r2 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r2, 0x8933, &(0x7f0000000040)={'bridge0\x00', 0x0}) sendmsg$nl_route(r2, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000440)=ANY=[@ANYBLOB="580000001000ffff27bd7000fadbdf2500000000", @ANYRES32=0x0, @ANYBLOB="15010000000000003000128009000100766c616e00000000200002800600050088a8000006000100010000000c000200130000001000000008000500", @ANYRES32=r3], 0x58}, 0x1, 0x0, 0x0, 0x880}, 0x8048802) madvise(&(0x7f0000bdc000/0x4000)=nil, 0x86ac726dff2f4713, 0xa) syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) write$P9_RRENAME(0xffffffffffffffff, 0x0, 0x0) mmap(&(0x7f0000362000/0x4000)=nil, 0x4000, 0x0, 0x12, 0xffffffffffffffff, 0xfffff000) r4 = syz_clone(0x21000200, 0x0, 0x0, 0x0, 0x0, 0x0) rt_tgsigqueueinfo(r4, r4, 0x8, 0x0) executing program 8: r0 = socket(0x10, 0x3, 0x0) sendmsg$nl_route(0xffffffffffffffff, &(0x7f0000000300)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000100)=ANY=[@ANYBLOB="4800e80010000d0428bd7000fcdbff2500008000", @ANYRES32=r0, @ANYBLOB="1000000000000000280012800b00010062726964676500001800028005001900840000000c001e"], 0x48}}, 0x4084) sendmsg$nl_route(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000080)={&(0x7f00000001c0)=ANY=[@ANYBLOB="500000001000010425bbe5ad600027842cf52300", @ANYRES32=0x0, @ANYRESDEC=0x0, @ANYRES64=r0, @ANYRES16=r0], 0x50}, 0x1, 0x0, 0x0, 0x13d33d22c8a65c15}, 0x4008840) getsockopt$inet_sctp6_SCTP_NODELAY(r0, 0x84, 0x3, &(0x7f0000000280), &(0x7f00000002c0)=0x4) mkdirat(0xffffffffffffff9c, &(0x7f0000000040)='./mnt\x00', 0x1ff) mount$nfs(&(0x7f0000000080)=':27.0.0.1:/export\x00', &(0x7f00000000c0)='./mnt\x00', &(0x7f0000000180), 0x20800, &(0x7f0000000140)=ANY=[@ANYRES16=r0]) r1 = socket$inet6_icmp_raw(0xa, 0x3, 0x3a) bind$inet6(r1, &(0x7f00000001c0)={0xa, 0x4e20, 0xfffffffb, @empty, 0x2}, 0x1c) sendmmsg(r0, &(0x7f0000000000), 0x4000000000001f2, 0x0) r2 = socket$inet6_sctp(0xa, 0x1, 0x84) r3 = dup(r2) setsockopt$inet_sctp6_SCTP_SOCKOPT_BINDX_ADD(r3, 0x84, 0x64, &(0x7f0000000040)=[@in6={0xa, 0x4e24, 0x6, @loopback, 0x3}], 0x1c) getsockopt$inet_sctp_SCTP_GET_ASSOC_STATS(r3, 0x84, 0x70, &(0x7f0000000680)={0x0, @in6={{0xa, 0x4e22, 0x1, @ipv4={'\x00', '\xff\xff', @multicast1}, 0x8}}, [0xfffffffffffffffa, 0x3, 0x7, 0x3, 0x4, 0x3, 0xc, 0x8, 0x3, 0x5, 0x7, 0x100000000, 0x6, 0x2, 0x6]}, &(0x7f00000007c0)=0x100) r4 = socket$packet(0x11, 0x2, 0x300) r5 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r5, 0x8933, &(0x7f0000000040)={'ip6gretap0\x00', 0x0}) sendto$packet(r4, 0x0, 0x0, 0x0, &(0x7f0000000400)={0x11, 0x88a8, r6, 0x1, 0x0, 0x6, @local}, 0x14) r7 = openat$selinux_checkreqprot(0xffffffffffffff9c, &(0x7f0000000200), 0xa00, 0x0) io_uring_register$IORING_REGISTER_FILES(r3, 0x2, &(0x7f0000000240)=[r0, r0, r7, r0, r0, r0, r0], 0x7) executing program 4: r0 = syz_open_dev$dri(&(0x7f0000000000), 0x0, 0x0) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r0, 0xc02064b2, &(0x7f0000000040)={0x1, 0xd00, 0x6}) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r0, 0xc02064b2, &(0x7f0000000100)={0x1, 0x3, 0x9}) ioctl$DRM_IOCTL_PANTHOR_VM_CREATE(r0, 0xc0106441, &(0x7f0000000080)={0x0, 0x0, 0xffffffffffffffff}) socket$kcm(0xa, 0x2, 0x0) socket$nl_route(0x10, 0x3, 0x0) r1 = socket(0x10, 0x3, 0x0) getsockname$packet(r1, &(0x7f00000002c0)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000100)=0x14) sendmsg$nl_route(0xffffffffffffffff, &(0x7f0000000040)={0x0, 0x0, 0x0}, 0x0) sendmsg$IPSET_CMD_ADD(0xffffffffffffffff, 0x0, 0x0) sendmsg$IPSET_CMD_TEST(0xffffffffffffffff, &(0x7f0000000280)={0x0, 0x0, &(0x7f00000002c0)={&(0x7f0000000300)={0x48, 0xb, 0x6, 0x1, 0x0, 0x0, {0x2}, [@IPSET_ATTR_SETNAME={0x9, 0x2, 'syz1\x00'}, @IPSET_ATTR_DATA={0x28, 0x7, 0x0, 0x1, [@IPSET_ATTR_IP={0xc, 0x1, 0x0, 0x1, @IPSET_ATTR_IPADDR_IPV4={0x8, 0x1, 0x1, 0x0, @local}}, @IPSET_ATTR_PORT={0x6, 0x4, 0x1, 0x0, 0x5000}, @IPSET_ATTR_MARK={0x8, 0xa, 0x1, 0x0, 0xc}, @IPSET_ATTR_CIDR2={0x5, 0x15, 0x18}]}]}, 0x48}}, 0x0) socket$inet6_udp(0xa, 0x2, 0x0) socket(0x10, 0x803, 0x0) socket(0x10, 0x3, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./config\x00', 0x1ff) mount(0x0, &(0x7f0000000000)='./config\x00', &(0x7f0000000080)='configfs\x00', 0x0, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000140)='./config/usb_gadget/g1\x00', 0xbf) mkdirat(0xffffffffffffff9c, &(0x7f00000001c0)='./config/usb_gadget/g1/functions/uvc.0\x00', 0x1ff) mkdirat(0xffffffffffffff9c, &(0x7f0000000280)='./config/usb_gadget/g1/functions/uvc.0/streaming/mjpeg/m1\x00', 0x1ff) r2 = openat(0xffffffffffffff9c, &(0x7f00000002c0)='./config/usb_gadget/g1/functions/uvc.0/streaming/mjpeg/m1/bmaControls\x00', 0x2, 0x0) write(r2, &(0x7f0000000640)='12', 0x2) write$P9_RVERSION(r2, &(0x7f0000000180)={0x13, 0x65, 0xffff, 0x1017, 0xffffffffffffff96, '9P2000.L'}, 0x13) syz_usb_connect$midi(0x0, 0x4f, &(0x7f0000000280)=ANY=[], 0x0) r3 = socket$nl_route(0x10, 0x3, 0x0) ioctl$ifreq_SIOCGIFINDEX_vcan(r3, 0x8933, &(0x7f0000000040)={'vxcan0\x00'}) getuid() r4 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPSET_CMD_CREATE(r4, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000200)=ANY=[@ANYBLOB="600000000206010800000000000000000000000005000400000000000900020073797a31000000001400078008001240000000000500140008000000050005000a000000050001000600000011000300686173683a69702c706f7274"], 0x60}}, 0x24000800) r5 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPSET_CMD_ADD(r5, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000240)={&(0x7f0000000c80)=ANY=[@ANYBLOB="5c000000090601080000000000000000070000000900020073797a31000000000500010007000000340007801800018014000240fe8000000000000000000000000000bb060004400e1f00cd050007008800000006000540"], 0x5c}, 0x1, 0x0, 0x0, 0x10000042}, 0x90) program crashed: KASAN: slab-use-after-free Read in ep_open testing program (duration=2m31.5s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): [0, 16, 19, 30] detailed listing: executing program 3: executing program 0: mkdirat(0xffffffffffffff9c, &(0x7f0000000100)='./gadget\x00', 0x1ff) mount(0x0, &(0x7f0000000140)='./gadget\x00', &(0x7f0000000180)='gadgetfs\x00', 0x0, 0x0) r0 = openat(0xffffffffffffff9c, &(0x7f00000001c0)='./gadget/dummy_udc\x00', 0x2, 0x0) bpf$MAP_UPDATE_ELEM_TAIL_CALL(0x2, &(0x7f0000000380)={{}, &(0x7f0000000300), &(0x7f0000000340)=r0}, 0x20) mprotect(&(0x7f0000362000/0x2000)=nil, 0x2000, 0x1) write(r0, &(0x7f0000000200)="000000000902190001010080320904000001ff000000070581024000000902190001010080320904000001ff00000007058102000200120100020000004034127856000100000001", 0x48) r1 = openat(0xffffffffffffff9c, &(0x7f0000000000)='./gadget/ep1in-bulk\x00', 0x2, 0x24) write(r1, &(0x7f00000005c0)="010000000705810240000007058102000200", 0x12) r2 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r2, 0x8933, &(0x7f0000000040)={'bridge0\x00', 0x0}) sendmsg$nl_route(r2, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000440)=ANY=[@ANYBLOB="580000001000ffff27bd7000fadbdf2500000000", @ANYRES32=0x0, @ANYBLOB="15010000000000003000128009000100766c616e00000000200002800600050088a8000006000100010000000c000200130000001000000008000500", @ANYRES32=r3], 0x58}, 0x1, 0x0, 0x0, 0x880}, 0x8048802) madvise(&(0x7f0000bdc000/0x4000)=nil, 0x86ac726dff2f4713, 0xa) write$P9_RRENAME(0xffffffffffffffff, 0x0, 0x0) mmap(&(0x7f0000362000/0x4000)=nil, 0x4000, 0x0, 0x12, 0xffffffffffffffff, 0xfffff000) r4 = syz_clone(0x21000200, 0x0, 0x0, 0x0, 0x0, 0x0) rt_tgsigqueueinfo(r4, r4, 0x8, 0x0) executing program 8: r0 = socket(0x10, 0x3, 0x0) sendmsg$nl_route(0xffffffffffffffff, &(0x7f0000000300)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000100)=ANY=[@ANYBLOB="4800e80010000d0428bd7000fcdbff2500008000", @ANYRES32=r0, @ANYBLOB="1000000000000000280012800b00010062726964676500001800028005001900840000000c001e"], 0x48}}, 0x4084) sendmsg$nl_route(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000080)={&(0x7f00000001c0)=ANY=[@ANYBLOB="500000001000010425bbe5ad600027842cf52300", @ANYRES32=0x0, @ANYRESDEC=0x0, @ANYRES64=r0, @ANYRES16=r0], 0x50}, 0x1, 0x0, 0x0, 0x13d33d22c8a65c15}, 0x4008840) getsockopt$inet_sctp6_SCTP_NODELAY(r0, 0x84, 0x3, &(0x7f0000000280), &(0x7f00000002c0)=0x4) mkdirat(0xffffffffffffff9c, &(0x7f0000000040)='./mnt\x00', 0x1ff) mount$nfs(&(0x7f0000000080)=':27.0.0.1:/export\x00', &(0x7f00000000c0)='./mnt\x00', &(0x7f0000000180), 0x20800, &(0x7f0000000140)=ANY=[@ANYRES16=r0]) r1 = socket$inet6_icmp_raw(0xa, 0x3, 0x3a) bind$inet6(r1, &(0x7f00000001c0)={0xa, 0x4e20, 0xfffffffb, @empty, 0x2}, 0x1c) sendmmsg(r0, &(0x7f0000000000), 0x4000000000001f2, 0x0) r2 = socket$inet6_sctp(0xa, 0x1, 0x84) r3 = dup(r2) setsockopt$inet_sctp6_SCTP_SOCKOPT_BINDX_ADD(r3, 0x84, 0x64, &(0x7f0000000040)=[@in6={0xa, 0x4e24, 0x6, @loopback, 0x3}], 0x1c) getsockopt$inet_sctp_SCTP_GET_ASSOC_STATS(r3, 0x84, 0x70, &(0x7f0000000680)={0x0, @in6={{0xa, 0x4e22, 0x1, @ipv4={'\x00', '\xff\xff', @multicast1}, 0x8}}, [0xfffffffffffffffa, 0x3, 0x7, 0x3, 0x4, 0x3, 0xc, 0x8, 0x3, 0x5, 0x7, 0x100000000, 0x6, 0x2, 0x6]}, &(0x7f00000007c0)=0x100) r4 = socket$packet(0x11, 0x2, 0x300) r5 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r5, 0x8933, &(0x7f0000000040)={'ip6gretap0\x00', 0x0}) sendto$packet(r4, 0x0, 0x0, 0x0, &(0x7f0000000400)={0x11, 0x88a8, r6, 0x1, 0x0, 0x6, @local}, 0x14) r7 = openat$selinux_checkreqprot(0xffffffffffffff9c, &(0x7f0000000200), 0xa00, 0x0) io_uring_register$IORING_REGISTER_FILES(r3, 0x2, &(0x7f0000000240)=[r0, r0, r7, r0, r0, r0, r0], 0x7) executing program 4: r0 = syz_open_dev$dri(&(0x7f0000000000), 0x0, 0x0) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r0, 0xc02064b2, &(0x7f0000000040)={0x1, 0xd00, 0x6}) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r0, 0xc02064b2, &(0x7f0000000100)={0x1, 0x3, 0x9}) ioctl$DRM_IOCTL_PANTHOR_VM_CREATE(r0, 0xc0106441, &(0x7f0000000080)={0x0, 0x0, 0xffffffffffffffff}) socket$kcm(0xa, 0x2, 0x0) socket$nl_route(0x10, 0x3, 0x0) r1 = socket(0x10, 0x3, 0x0) getsockname$packet(r1, &(0x7f00000002c0)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000100)=0x14) sendmsg$nl_route(0xffffffffffffffff, &(0x7f0000000040)={0x0, 0x0, 0x0}, 0x0) sendmsg$IPSET_CMD_ADD(0xffffffffffffffff, 0x0, 0x0) sendmsg$IPSET_CMD_TEST(0xffffffffffffffff, &(0x7f0000000280)={0x0, 0x0, &(0x7f00000002c0)={&(0x7f0000000300)={0x48, 0xb, 0x6, 0x1, 0x0, 0x0, {0x2}, [@IPSET_ATTR_SETNAME={0x9, 0x2, 'syz1\x00'}, @IPSET_ATTR_DATA={0x28, 0x7, 0x0, 0x1, [@IPSET_ATTR_IP={0xc, 0x1, 0x0, 0x1, @IPSET_ATTR_IPADDR_IPV4={0x8, 0x1, 0x1, 0x0, @local}}, @IPSET_ATTR_PORT={0x6, 0x4, 0x1, 0x0, 0x5000}, @IPSET_ATTR_MARK={0x8, 0xa, 0x1, 0x0, 0xc}, @IPSET_ATTR_CIDR2={0x5, 0x15, 0x18}]}]}, 0x48}}, 0x0) socket$inet6_udp(0xa, 0x2, 0x0) socket(0x10, 0x803, 0x0) socket(0x10, 0x3, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./config\x00', 0x1ff) mount(0x0, &(0x7f0000000000)='./config\x00', &(0x7f0000000080)='configfs\x00', 0x0, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000140)='./config/usb_gadget/g1\x00', 0xbf) mkdirat(0xffffffffffffff9c, &(0x7f00000001c0)='./config/usb_gadget/g1/functions/uvc.0\x00', 0x1ff) mkdirat(0xffffffffffffff9c, &(0x7f0000000280)='./config/usb_gadget/g1/functions/uvc.0/streaming/mjpeg/m1\x00', 0x1ff) r2 = openat(0xffffffffffffff9c, &(0x7f00000002c0)='./config/usb_gadget/g1/functions/uvc.0/streaming/mjpeg/m1/bmaControls\x00', 0x2, 0x0) write(r2, &(0x7f0000000640)='12', 0x2) write$P9_RVERSION(r2, &(0x7f0000000180)={0x13, 0x65, 0xffff, 0x1017, 0xffffffffffffff96, '9P2000.L'}, 0x13) syz_usb_connect$midi(0x0, 0x4f, &(0x7f0000000280)=ANY=[], 0x0) r3 = socket$nl_route(0x10, 0x3, 0x0) ioctl$ifreq_SIOCGIFINDEX_vcan(r3, 0x8933, &(0x7f0000000040)={'vxcan0\x00'}) getuid() r4 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPSET_CMD_CREATE(r4, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000200)=ANY=[@ANYBLOB="600000000206010800000000000000000000000005000400000000000900020073797a31000000001400078008001240000000000500140008000000050005000a000000050001000600000011000300686173683a69702c706f7274"], 0x60}}, 0x24000800) r5 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPSET_CMD_ADD(r5, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000240)={&(0x7f0000000c80)=ANY=[@ANYBLOB="5c000000090601080000000000000000070000000900020073797a31000000000500010007000000340007801800018014000240fe8000000000000000000000000000bb060004400e1f00cd050007008800000006000540"], 0x5c}, 0x1, 0x0, 0x0, 0x10000042}, 0x90) program crashed: KASAN: slab-use-after-free Read in ep_open testing program (duration=2m31.5s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): [0, 15, 19, 30] detailed listing: executing program 3: executing program 0: mkdirat(0xffffffffffffff9c, &(0x7f0000000100)='./gadget\x00', 0x1ff) mount(0x0, &(0x7f0000000140)='./gadget\x00', &(0x7f0000000180)='gadgetfs\x00', 0x0, 0x0) r0 = openat(0xffffffffffffff9c, &(0x7f00000001c0)='./gadget/dummy_udc\x00', 0x2, 0x0) bpf$MAP_UPDATE_ELEM_TAIL_CALL(0x2, &(0x7f0000000380)={{}, &(0x7f0000000300), &(0x7f0000000340)=r0}, 0x20) mprotect(&(0x7f0000362000/0x2000)=nil, 0x2000, 0x1) write(r0, &(0x7f0000000200)="000000000902190001010080320904000001ff000000070581024000000902190001010080320904000001ff00000007058102000200120100020000004034127856000100000001", 0x48) r1 = openat(0xffffffffffffff9c, &(0x7f0000000000)='./gadget/ep1in-bulk\x00', 0x2, 0x24) write(r1, &(0x7f00000005c0)="010000000705810240000007058102000200", 0x12) r2 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r2, 0x8933, &(0x7f0000000040)={'bridge0\x00', 0x0}) sendmsg$nl_route(r2, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000440)=ANY=[@ANYBLOB="580000001000ffff27bd7000fadbdf2500000000", @ANYRES32=0x0, @ANYBLOB="15010000000000003000128009000100766c616e00000000200002800600050088a8000006000100010000000c000200130000001000000008000500", @ANYRES32=r3], 0x58}, 0x1, 0x0, 0x0, 0x880}, 0x8048802) write$P9_RRENAME(0xffffffffffffffff, 0x0, 0x0) mmap(&(0x7f0000362000/0x4000)=nil, 0x4000, 0x0, 0x12, 0xffffffffffffffff, 0xfffff000) r4 = syz_clone(0x21000200, 0x0, 0x0, 0x0, 0x0, 0x0) rt_tgsigqueueinfo(r4, r4, 0x8, 0x0) executing program 8: r0 = socket(0x10, 0x3, 0x0) sendmsg$nl_route(0xffffffffffffffff, &(0x7f0000000300)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000100)=ANY=[@ANYBLOB="4800e80010000d0428bd7000fcdbff2500008000", @ANYRES32=r0, @ANYBLOB="1000000000000000280012800b00010062726964676500001800028005001900840000000c001e"], 0x48}}, 0x4084) sendmsg$nl_route(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000080)={&(0x7f00000001c0)=ANY=[@ANYBLOB="500000001000010425bbe5ad600027842cf52300", @ANYRES32=0x0, @ANYRESDEC=0x0, @ANYRES64=r0, @ANYRES16=r0], 0x50}, 0x1, 0x0, 0x0, 0x13d33d22c8a65c15}, 0x4008840) getsockopt$inet_sctp6_SCTP_NODELAY(r0, 0x84, 0x3, &(0x7f0000000280), &(0x7f00000002c0)=0x4) mkdirat(0xffffffffffffff9c, &(0x7f0000000040)='./mnt\x00', 0x1ff) mount$nfs(&(0x7f0000000080)=':27.0.0.1:/export\x00', &(0x7f00000000c0)='./mnt\x00', &(0x7f0000000180), 0x20800, &(0x7f0000000140)=ANY=[@ANYRES16=r0]) r1 = socket$inet6_icmp_raw(0xa, 0x3, 0x3a) bind$inet6(r1, &(0x7f00000001c0)={0xa, 0x4e20, 0xfffffffb, @empty, 0x2}, 0x1c) sendmmsg(r0, &(0x7f0000000000), 0x4000000000001f2, 0x0) r2 = socket$inet6_sctp(0xa, 0x1, 0x84) r3 = dup(r2) setsockopt$inet_sctp6_SCTP_SOCKOPT_BINDX_ADD(r3, 0x84, 0x64, &(0x7f0000000040)=[@in6={0xa, 0x4e24, 0x6, @loopback, 0x3}], 0x1c) getsockopt$inet_sctp_SCTP_GET_ASSOC_STATS(r3, 0x84, 0x70, &(0x7f0000000680)={0x0, @in6={{0xa, 0x4e22, 0x1, @ipv4={'\x00', '\xff\xff', @multicast1}, 0x8}}, [0xfffffffffffffffa, 0x3, 0x7, 0x3, 0x4, 0x3, 0xc, 0x8, 0x3, 0x5, 0x7, 0x100000000, 0x6, 0x2, 0x6]}, &(0x7f00000007c0)=0x100) r4 = socket$packet(0x11, 0x2, 0x300) r5 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r5, 0x8933, &(0x7f0000000040)={'ip6gretap0\x00', 0x0}) sendto$packet(r4, 0x0, 0x0, 0x0, &(0x7f0000000400)={0x11, 0x88a8, r6, 0x1, 0x0, 0x6, @local}, 0x14) r7 = openat$selinux_checkreqprot(0xffffffffffffff9c, &(0x7f0000000200), 0xa00, 0x0) io_uring_register$IORING_REGISTER_FILES(r3, 0x2, &(0x7f0000000240)=[r0, r0, r7, r0, r0, r0, r0], 0x7) executing program 4: r0 = syz_open_dev$dri(&(0x7f0000000000), 0x0, 0x0) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r0, 0xc02064b2, &(0x7f0000000040)={0x1, 0xd00, 0x6}) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r0, 0xc02064b2, &(0x7f0000000100)={0x1, 0x3, 0x9}) ioctl$DRM_IOCTL_PANTHOR_VM_CREATE(r0, 0xc0106441, &(0x7f0000000080)={0x0, 0x0, 0xffffffffffffffff}) socket$kcm(0xa, 0x2, 0x0) socket$nl_route(0x10, 0x3, 0x0) r1 = socket(0x10, 0x3, 0x0) getsockname$packet(r1, &(0x7f00000002c0)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000100)=0x14) sendmsg$nl_route(0xffffffffffffffff, &(0x7f0000000040)={0x0, 0x0, 0x0}, 0x0) sendmsg$IPSET_CMD_ADD(0xffffffffffffffff, 0x0, 0x0) sendmsg$IPSET_CMD_TEST(0xffffffffffffffff, &(0x7f0000000280)={0x0, 0x0, &(0x7f00000002c0)={&(0x7f0000000300)={0x48, 0xb, 0x6, 0x1, 0x0, 0x0, {0x2}, [@IPSET_ATTR_SETNAME={0x9, 0x2, 'syz1\x00'}, @IPSET_ATTR_DATA={0x28, 0x7, 0x0, 0x1, [@IPSET_ATTR_IP={0xc, 0x1, 0x0, 0x1, @IPSET_ATTR_IPADDR_IPV4={0x8, 0x1, 0x1, 0x0, @local}}, @IPSET_ATTR_PORT={0x6, 0x4, 0x1, 0x0, 0x5000}, @IPSET_ATTR_MARK={0x8, 0xa, 0x1, 0x0, 0xc}, @IPSET_ATTR_CIDR2={0x5, 0x15, 0x18}]}]}, 0x48}}, 0x0) socket$inet6_udp(0xa, 0x2, 0x0) socket(0x10, 0x803, 0x0) socket(0x10, 0x3, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./config\x00', 0x1ff) mount(0x0, &(0x7f0000000000)='./config\x00', &(0x7f0000000080)='configfs\x00', 0x0, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000140)='./config/usb_gadget/g1\x00', 0xbf) mkdirat(0xffffffffffffff9c, &(0x7f00000001c0)='./config/usb_gadget/g1/functions/uvc.0\x00', 0x1ff) mkdirat(0xffffffffffffff9c, &(0x7f0000000280)='./config/usb_gadget/g1/functions/uvc.0/streaming/mjpeg/m1\x00', 0x1ff) r2 = openat(0xffffffffffffff9c, &(0x7f00000002c0)='./config/usb_gadget/g1/functions/uvc.0/streaming/mjpeg/m1/bmaControls\x00', 0x2, 0x0) write(r2, &(0x7f0000000640)='12', 0x2) write$P9_RVERSION(r2, &(0x7f0000000180)={0x13, 0x65, 0xffff, 0x1017, 0xffffffffffffff96, '9P2000.L'}, 0x13) syz_usb_connect$midi(0x0, 0x4f, &(0x7f0000000280)=ANY=[], 0x0) r3 = socket$nl_route(0x10, 0x3, 0x0) ioctl$ifreq_SIOCGIFINDEX_vcan(r3, 0x8933, &(0x7f0000000040)={'vxcan0\x00'}) getuid() r4 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPSET_CMD_CREATE(r4, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000200)=ANY=[@ANYBLOB="600000000206010800000000000000000000000005000400000000000900020073797a31000000001400078008001240000000000500140008000000050005000a000000050001000600000011000300686173683a69702c706f7274"], 0x60}}, 0x24000800) r5 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPSET_CMD_ADD(r5, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000240)={&(0x7f0000000c80)=ANY=[@ANYBLOB="5c000000090601080000000000000000070000000900020073797a31000000000500010007000000340007801800018014000240fe8000000000000000000000000000bb060004400e1f00cd050007008800000006000540"], 0x5c}, 0x1, 0x0, 0x0, 0x10000042}, 0x90) program crashed: KASAN: slab-use-after-free Read in ep_open testing program (duration=2m31.5s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): [0, 14, 19, 30] detailed listing: executing program 3: executing program 0: mkdirat(0xffffffffffffff9c, &(0x7f0000000100)='./gadget\x00', 0x1ff) mount(0x0, &(0x7f0000000140)='./gadget\x00', &(0x7f0000000180)='gadgetfs\x00', 0x0, 0x0) r0 = openat(0xffffffffffffff9c, &(0x7f00000001c0)='./gadget/dummy_udc\x00', 0x2, 0x0) bpf$MAP_UPDATE_ELEM_TAIL_CALL(0x2, &(0x7f0000000380)={{}, &(0x7f0000000300), &(0x7f0000000340)=r0}, 0x20) mprotect(&(0x7f0000362000/0x2000)=nil, 0x2000, 0x1) write(r0, &(0x7f0000000200)="000000000902190001010080320904000001ff000000070581024000000902190001010080320904000001ff00000007058102000200120100020000004034127856000100000001", 0x48) r1 = openat(0xffffffffffffff9c, &(0x7f0000000000)='./gadget/ep1in-bulk\x00', 0x2, 0x24) write(r1, &(0x7f00000005c0)="010000000705810240000007058102000200", 0x12) r2 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r2, 0x8933, &(0x7f0000000040)={'bridge0\x00'}) write$P9_RRENAME(0xffffffffffffffff, 0x0, 0x0) mmap(&(0x7f0000362000/0x4000)=nil, 0x4000, 0x0, 0x12, 0xffffffffffffffff, 0xfffff000) r3 = syz_clone(0x21000200, 0x0, 0x0, 0x0, 0x0, 0x0) rt_tgsigqueueinfo(r3, r3, 0x8, 0x0) executing program 8: r0 = socket(0x10, 0x3, 0x0) sendmsg$nl_route(0xffffffffffffffff, &(0x7f0000000300)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000100)=ANY=[@ANYBLOB="4800e80010000d0428bd7000fcdbff2500008000", @ANYRES32=r0, @ANYBLOB="1000000000000000280012800b00010062726964676500001800028005001900840000000c001e"], 0x48}}, 0x4084) sendmsg$nl_route(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000080)={&(0x7f00000001c0)=ANY=[@ANYBLOB="500000001000010425bbe5ad600027842cf52300", @ANYRES32=0x0, @ANYRESDEC=0x0, @ANYRES64=r0, @ANYRES16=r0], 0x50}, 0x1, 0x0, 0x0, 0x13d33d22c8a65c15}, 0x4008840) getsockopt$inet_sctp6_SCTP_NODELAY(r0, 0x84, 0x3, &(0x7f0000000280), &(0x7f00000002c0)=0x4) mkdirat(0xffffffffffffff9c, &(0x7f0000000040)='./mnt\x00', 0x1ff) mount$nfs(&(0x7f0000000080)=':27.0.0.1:/export\x00', &(0x7f00000000c0)='./mnt\x00', &(0x7f0000000180), 0x20800, &(0x7f0000000140)=ANY=[@ANYRES16=r0]) r1 = socket$inet6_icmp_raw(0xa, 0x3, 0x3a) bind$inet6(r1, &(0x7f00000001c0)={0xa, 0x4e20, 0xfffffffb, @empty, 0x2}, 0x1c) sendmmsg(r0, &(0x7f0000000000), 0x4000000000001f2, 0x0) r2 = socket$inet6_sctp(0xa, 0x1, 0x84) r3 = dup(r2) setsockopt$inet_sctp6_SCTP_SOCKOPT_BINDX_ADD(r3, 0x84, 0x64, &(0x7f0000000040)=[@in6={0xa, 0x4e24, 0x6, @loopback, 0x3}], 0x1c) getsockopt$inet_sctp_SCTP_GET_ASSOC_STATS(r3, 0x84, 0x70, &(0x7f0000000680)={0x0, @in6={{0xa, 0x4e22, 0x1, @ipv4={'\x00', '\xff\xff', @multicast1}, 0x8}}, [0xfffffffffffffffa, 0x3, 0x7, 0x3, 0x4, 0x3, 0xc, 0x8, 0x3, 0x5, 0x7, 0x100000000, 0x6, 0x2, 0x6]}, &(0x7f00000007c0)=0x100) r4 = socket$packet(0x11, 0x2, 0x300) r5 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r5, 0x8933, &(0x7f0000000040)={'ip6gretap0\x00', 0x0}) sendto$packet(r4, 0x0, 0x0, 0x0, &(0x7f0000000400)={0x11, 0x88a8, r6, 0x1, 0x0, 0x6, @local}, 0x14) r7 = openat$selinux_checkreqprot(0xffffffffffffff9c, &(0x7f0000000200), 0xa00, 0x0) io_uring_register$IORING_REGISTER_FILES(r3, 0x2, &(0x7f0000000240)=[r0, r0, r7, r0, r0, r0, r0], 0x7) executing program 4: r0 = syz_open_dev$dri(&(0x7f0000000000), 0x0, 0x0) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r0, 0xc02064b2, &(0x7f0000000040)={0x1, 0xd00, 0x6}) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r0, 0xc02064b2, &(0x7f0000000100)={0x1, 0x3, 0x9}) ioctl$DRM_IOCTL_PANTHOR_VM_CREATE(r0, 0xc0106441, &(0x7f0000000080)={0x0, 0x0, 0xffffffffffffffff}) socket$kcm(0xa, 0x2, 0x0) socket$nl_route(0x10, 0x3, 0x0) r1 = socket(0x10, 0x3, 0x0) getsockname$packet(r1, &(0x7f00000002c0)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000100)=0x14) sendmsg$nl_route(0xffffffffffffffff, &(0x7f0000000040)={0x0, 0x0, 0x0}, 0x0) sendmsg$IPSET_CMD_ADD(0xffffffffffffffff, 0x0, 0x0) sendmsg$IPSET_CMD_TEST(0xffffffffffffffff, &(0x7f0000000280)={0x0, 0x0, &(0x7f00000002c0)={&(0x7f0000000300)={0x48, 0xb, 0x6, 0x1, 0x0, 0x0, {0x2}, [@IPSET_ATTR_SETNAME={0x9, 0x2, 'syz1\x00'}, @IPSET_ATTR_DATA={0x28, 0x7, 0x0, 0x1, [@IPSET_ATTR_IP={0xc, 0x1, 0x0, 0x1, @IPSET_ATTR_IPADDR_IPV4={0x8, 0x1, 0x1, 0x0, @local}}, @IPSET_ATTR_PORT={0x6, 0x4, 0x1, 0x0, 0x5000}, @IPSET_ATTR_MARK={0x8, 0xa, 0x1, 0x0, 0xc}, @IPSET_ATTR_CIDR2={0x5, 0x15, 0x18}]}]}, 0x48}}, 0x0) socket$inet6_udp(0xa, 0x2, 0x0) socket(0x10, 0x803, 0x0) socket(0x10, 0x3, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./config\x00', 0x1ff) mount(0x0, &(0x7f0000000000)='./config\x00', &(0x7f0000000080)='configfs\x00', 0x0, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000140)='./config/usb_gadget/g1\x00', 0xbf) mkdirat(0xffffffffffffff9c, &(0x7f00000001c0)='./config/usb_gadget/g1/functions/uvc.0\x00', 0x1ff) mkdirat(0xffffffffffffff9c, &(0x7f0000000280)='./config/usb_gadget/g1/functions/uvc.0/streaming/mjpeg/m1\x00', 0x1ff) r2 = openat(0xffffffffffffff9c, &(0x7f00000002c0)='./config/usb_gadget/g1/functions/uvc.0/streaming/mjpeg/m1/bmaControls\x00', 0x2, 0x0) write(r2, &(0x7f0000000640)='12', 0x2) write$P9_RVERSION(r2, &(0x7f0000000180)={0x13, 0x65, 0xffff, 0x1017, 0xffffffffffffff96, '9P2000.L'}, 0x13) syz_usb_connect$midi(0x0, 0x4f, &(0x7f0000000280)=ANY=[], 0x0) r3 = socket$nl_route(0x10, 0x3, 0x0) ioctl$ifreq_SIOCGIFINDEX_vcan(r3, 0x8933, &(0x7f0000000040)={'vxcan0\x00'}) getuid() r4 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPSET_CMD_CREATE(r4, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000200)=ANY=[@ANYBLOB="600000000206010800000000000000000000000005000400000000000900020073797a31000000001400078008001240000000000500140008000000050005000a000000050001000600000011000300686173683a69702c706f7274"], 0x60}}, 0x24000800) r5 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPSET_CMD_ADD(r5, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000240)={&(0x7f0000000c80)=ANY=[@ANYBLOB="5c000000090601080000000000000000070000000900020073797a31000000000500010007000000340007801800018014000240fe8000000000000000000000000000bb060004400e1f00cd050007008800000006000540"], 0x5c}, 0x1, 0x0, 0x0, 0x10000042}, 0x90) program crashed: KASAN: slab-use-after-free Read in ep_open testing program (duration=2m31.5s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): [0, 13, 19, 30] detailed listing: executing program 3: executing program 0: mkdirat(0xffffffffffffff9c, &(0x7f0000000100)='./gadget\x00', 0x1ff) mount(0x0, &(0x7f0000000140)='./gadget\x00', &(0x7f0000000180)='gadgetfs\x00', 0x0, 0x0) r0 = openat(0xffffffffffffff9c, &(0x7f00000001c0)='./gadget/dummy_udc\x00', 0x2, 0x0) bpf$MAP_UPDATE_ELEM_TAIL_CALL(0x2, &(0x7f0000000380)={{}, &(0x7f0000000300), &(0x7f0000000340)=r0}, 0x20) mprotect(&(0x7f0000362000/0x2000)=nil, 0x2000, 0x1) write(r0, &(0x7f0000000200)="000000000902190001010080320904000001ff000000070581024000000902190001010080320904000001ff00000007058102000200120100020000004034127856000100000001", 0x48) r1 = openat(0xffffffffffffff9c, &(0x7f0000000000)='./gadget/ep1in-bulk\x00', 0x2, 0x24) write(r1, &(0x7f00000005c0)="010000000705810240000007058102000200", 0x12) socket$nl_route(0x10, 0x3, 0x0) write$P9_RRENAME(0xffffffffffffffff, 0x0, 0x0) mmap(&(0x7f0000362000/0x4000)=nil, 0x4000, 0x0, 0x12, 0xffffffffffffffff, 0xfffff000) r2 = syz_clone(0x21000200, 0x0, 0x0, 0x0, 0x0, 0x0) rt_tgsigqueueinfo(r2, r2, 0x8, 0x0) executing program 8: r0 = socket(0x10, 0x3, 0x0) sendmsg$nl_route(0xffffffffffffffff, &(0x7f0000000300)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000100)=ANY=[@ANYBLOB="4800e80010000d0428bd7000fcdbff2500008000", @ANYRES32=r0, @ANYBLOB="1000000000000000280012800b00010062726964676500001800028005001900840000000c001e"], 0x48}}, 0x4084) sendmsg$nl_route(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000080)={&(0x7f00000001c0)=ANY=[@ANYBLOB="500000001000010425bbe5ad600027842cf52300", @ANYRES32=0x0, @ANYRESDEC=0x0, @ANYRES64=r0, @ANYRES16=r0], 0x50}, 0x1, 0x0, 0x0, 0x13d33d22c8a65c15}, 0x4008840) getsockopt$inet_sctp6_SCTP_NODELAY(r0, 0x84, 0x3, &(0x7f0000000280), &(0x7f00000002c0)=0x4) mkdirat(0xffffffffffffff9c, &(0x7f0000000040)='./mnt\x00', 0x1ff) mount$nfs(&(0x7f0000000080)=':27.0.0.1:/export\x00', &(0x7f00000000c0)='./mnt\x00', &(0x7f0000000180), 0x20800, &(0x7f0000000140)=ANY=[@ANYRES16=r0]) r1 = socket$inet6_icmp_raw(0xa, 0x3, 0x3a) bind$inet6(r1, &(0x7f00000001c0)={0xa, 0x4e20, 0xfffffffb, @empty, 0x2}, 0x1c) sendmmsg(r0, &(0x7f0000000000), 0x4000000000001f2, 0x0) r2 = socket$inet6_sctp(0xa, 0x1, 0x84) r3 = dup(r2) setsockopt$inet_sctp6_SCTP_SOCKOPT_BINDX_ADD(r3, 0x84, 0x64, &(0x7f0000000040)=[@in6={0xa, 0x4e24, 0x6, @loopback, 0x3}], 0x1c) getsockopt$inet_sctp_SCTP_GET_ASSOC_STATS(r3, 0x84, 0x70, &(0x7f0000000680)={0x0, @in6={{0xa, 0x4e22, 0x1, @ipv4={'\x00', '\xff\xff', @multicast1}, 0x8}}, [0xfffffffffffffffa, 0x3, 0x7, 0x3, 0x4, 0x3, 0xc, 0x8, 0x3, 0x5, 0x7, 0x100000000, 0x6, 0x2, 0x6]}, &(0x7f00000007c0)=0x100) r4 = socket$packet(0x11, 0x2, 0x300) r5 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r5, 0x8933, &(0x7f0000000040)={'ip6gretap0\x00', 0x0}) sendto$packet(r4, 0x0, 0x0, 0x0, &(0x7f0000000400)={0x11, 0x88a8, r6, 0x1, 0x0, 0x6, @local}, 0x14) r7 = openat$selinux_checkreqprot(0xffffffffffffff9c, &(0x7f0000000200), 0xa00, 0x0) io_uring_register$IORING_REGISTER_FILES(r3, 0x2, &(0x7f0000000240)=[r0, r0, r7, r0, r0, r0, r0], 0x7) executing program 4: r0 = syz_open_dev$dri(&(0x7f0000000000), 0x0, 0x0) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r0, 0xc02064b2, &(0x7f0000000040)={0x1, 0xd00, 0x6}) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r0, 0xc02064b2, &(0x7f0000000100)={0x1, 0x3, 0x9}) ioctl$DRM_IOCTL_PANTHOR_VM_CREATE(r0, 0xc0106441, &(0x7f0000000080)={0x0, 0x0, 0xffffffffffffffff}) socket$kcm(0xa, 0x2, 0x0) socket$nl_route(0x10, 0x3, 0x0) r1 = socket(0x10, 0x3, 0x0) getsockname$packet(r1, &(0x7f00000002c0)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000100)=0x14) sendmsg$nl_route(0xffffffffffffffff, &(0x7f0000000040)={0x0, 0x0, 0x0}, 0x0) sendmsg$IPSET_CMD_ADD(0xffffffffffffffff, 0x0, 0x0) sendmsg$IPSET_CMD_TEST(0xffffffffffffffff, &(0x7f0000000280)={0x0, 0x0, &(0x7f00000002c0)={&(0x7f0000000300)={0x48, 0xb, 0x6, 0x1, 0x0, 0x0, {0x2}, [@IPSET_ATTR_SETNAME={0x9, 0x2, 'syz1\x00'}, @IPSET_ATTR_DATA={0x28, 0x7, 0x0, 0x1, [@IPSET_ATTR_IP={0xc, 0x1, 0x0, 0x1, @IPSET_ATTR_IPADDR_IPV4={0x8, 0x1, 0x1, 0x0, @local}}, @IPSET_ATTR_PORT={0x6, 0x4, 0x1, 0x0, 0x5000}, @IPSET_ATTR_MARK={0x8, 0xa, 0x1, 0x0, 0xc}, @IPSET_ATTR_CIDR2={0x5, 0x15, 0x18}]}]}, 0x48}}, 0x0) socket$inet6_udp(0xa, 0x2, 0x0) socket(0x10, 0x803, 0x0) socket(0x10, 0x3, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./config\x00', 0x1ff) mount(0x0, &(0x7f0000000000)='./config\x00', &(0x7f0000000080)='configfs\x00', 0x0, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000140)='./config/usb_gadget/g1\x00', 0xbf) mkdirat(0xffffffffffffff9c, &(0x7f00000001c0)='./config/usb_gadget/g1/functions/uvc.0\x00', 0x1ff) mkdirat(0xffffffffffffff9c, &(0x7f0000000280)='./config/usb_gadget/g1/functions/uvc.0/streaming/mjpeg/m1\x00', 0x1ff) r2 = openat(0xffffffffffffff9c, &(0x7f00000002c0)='./config/usb_gadget/g1/functions/uvc.0/streaming/mjpeg/m1/bmaControls\x00', 0x2, 0x0) write(r2, &(0x7f0000000640)='12', 0x2) write$P9_RVERSION(r2, &(0x7f0000000180)={0x13, 0x65, 0xffff, 0x1017, 0xffffffffffffff96, '9P2000.L'}, 0x13) syz_usb_connect$midi(0x0, 0x4f, &(0x7f0000000280)=ANY=[], 0x0) r3 = socket$nl_route(0x10, 0x3, 0x0) ioctl$ifreq_SIOCGIFINDEX_vcan(r3, 0x8933, &(0x7f0000000040)={'vxcan0\x00'}) getuid() r4 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPSET_CMD_CREATE(r4, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000200)=ANY=[@ANYBLOB="600000000206010800000000000000000000000005000400000000000900020073797a31000000001400078008001240000000000500140008000000050005000a000000050001000600000011000300686173683a69702c706f7274"], 0x60}}, 0x24000800) r5 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPSET_CMD_ADD(r5, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000240)={&(0x7f0000000c80)=ANY=[@ANYBLOB="5c000000090601080000000000000000070000000900020073797a31000000000500010007000000340007801800018014000240fe8000000000000000000000000000bb060004400e1f00cd050007008800000006000540"], 0x5c}, 0x1, 0x0, 0x0, 0x10000042}, 0x90) program did not crash testing program (duration=2m31.5s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): [0, 13, 19, 30] detailed listing: executing program 3: executing program 0: mkdirat(0xffffffffffffff9c, &(0x7f0000000100)='./gadget\x00', 0x1ff) mount(0x0, &(0x7f0000000140)='./gadget\x00', &(0x7f0000000180)='gadgetfs\x00', 0x0, 0x0) r0 = openat(0xffffffffffffff9c, &(0x7f00000001c0)='./gadget/dummy_udc\x00', 0x2, 0x0) bpf$MAP_UPDATE_ELEM_TAIL_CALL(0x2, &(0x7f0000000380)={{}, &(0x7f0000000300), &(0x7f0000000340)=r0}, 0x20) mprotect(&(0x7f0000362000/0x2000)=nil, 0x2000, 0x1) write(r0, &(0x7f0000000200)="000000000902190001010080320904000001ff000000070581024000000902190001010080320904000001ff00000007058102000200120100020000004034127856000100000001", 0x48) r1 = openat(0xffffffffffffff9c, &(0x7f0000000000)='./gadget/ep1in-bulk\x00', 0x2, 0x24) write(r1, &(0x7f00000005c0)="010000000705810240000007058102000200", 0x12) ioctl$sock_SIOCGIFINDEX(0xffffffffffffffff, 0x8933, &(0x7f0000000040)={'bridge0\x00'}) write$P9_RRENAME(0xffffffffffffffff, 0x0, 0x0) mmap(&(0x7f0000362000/0x4000)=nil, 0x4000, 0x0, 0x12, 0xffffffffffffffff, 0xfffff000) r2 = syz_clone(0x21000200, 0x0, 0x0, 0x0, 0x0, 0x0) rt_tgsigqueueinfo(r2, r2, 0x8, 0x0) executing program 8: r0 = socket(0x10, 0x3, 0x0) sendmsg$nl_route(0xffffffffffffffff, &(0x7f0000000300)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000100)=ANY=[@ANYBLOB="4800e80010000d0428bd7000fcdbff2500008000", @ANYRES32=r0, @ANYBLOB="1000000000000000280012800b00010062726964676500001800028005001900840000000c001e"], 0x48}}, 0x4084) sendmsg$nl_route(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000080)={&(0x7f00000001c0)=ANY=[@ANYBLOB="500000001000010425bbe5ad600027842cf52300", @ANYRES32=0x0, @ANYRESDEC=0x0, @ANYRES64=r0, @ANYRES16=r0], 0x50}, 0x1, 0x0, 0x0, 0x13d33d22c8a65c15}, 0x4008840) getsockopt$inet_sctp6_SCTP_NODELAY(r0, 0x84, 0x3, &(0x7f0000000280), &(0x7f00000002c0)=0x4) mkdirat(0xffffffffffffff9c, &(0x7f0000000040)='./mnt\x00', 0x1ff) mount$nfs(&(0x7f0000000080)=':27.0.0.1:/export\x00', &(0x7f00000000c0)='./mnt\x00', &(0x7f0000000180), 0x20800, &(0x7f0000000140)=ANY=[@ANYRES16=r0]) r1 = socket$inet6_icmp_raw(0xa, 0x3, 0x3a) bind$inet6(r1, &(0x7f00000001c0)={0xa, 0x4e20, 0xfffffffb, @empty, 0x2}, 0x1c) sendmmsg(r0, &(0x7f0000000000), 0x4000000000001f2, 0x0) r2 = socket$inet6_sctp(0xa, 0x1, 0x84) r3 = dup(r2) setsockopt$inet_sctp6_SCTP_SOCKOPT_BINDX_ADD(r3, 0x84, 0x64, &(0x7f0000000040)=[@in6={0xa, 0x4e24, 0x6, @loopback, 0x3}], 0x1c) getsockopt$inet_sctp_SCTP_GET_ASSOC_STATS(r3, 0x84, 0x70, &(0x7f0000000680)={0x0, @in6={{0xa, 0x4e22, 0x1, @ipv4={'\x00', '\xff\xff', @multicast1}, 0x8}}, [0xfffffffffffffffa, 0x3, 0x7, 0x3, 0x4, 0x3, 0xc, 0x8, 0x3, 0x5, 0x7, 0x100000000, 0x6, 0x2, 0x6]}, &(0x7f00000007c0)=0x100) r4 = socket$packet(0x11, 0x2, 0x300) r5 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r5, 0x8933, &(0x7f0000000040)={'ip6gretap0\x00', 0x0}) sendto$packet(r4, 0x0, 0x0, 0x0, &(0x7f0000000400)={0x11, 0x88a8, r6, 0x1, 0x0, 0x6, @local}, 0x14) r7 = openat$selinux_checkreqprot(0xffffffffffffff9c, &(0x7f0000000200), 0xa00, 0x0) io_uring_register$IORING_REGISTER_FILES(r3, 0x2, &(0x7f0000000240)=[r0, r0, r7, r0, r0, r0, r0], 0x7) executing program 4: r0 = syz_open_dev$dri(&(0x7f0000000000), 0x0, 0x0) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r0, 0xc02064b2, &(0x7f0000000040)={0x1, 0xd00, 0x6}) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r0, 0xc02064b2, &(0x7f0000000100)={0x1, 0x3, 0x9}) ioctl$DRM_IOCTL_PANTHOR_VM_CREATE(r0, 0xc0106441, &(0x7f0000000080)={0x0, 0x0, 0xffffffffffffffff}) socket$kcm(0xa, 0x2, 0x0) socket$nl_route(0x10, 0x3, 0x0) r1 = socket(0x10, 0x3, 0x0) getsockname$packet(r1, &(0x7f00000002c0)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000100)=0x14) sendmsg$nl_route(0xffffffffffffffff, &(0x7f0000000040)={0x0, 0x0, 0x0}, 0x0) sendmsg$IPSET_CMD_ADD(0xffffffffffffffff, 0x0, 0x0) sendmsg$IPSET_CMD_TEST(0xffffffffffffffff, &(0x7f0000000280)={0x0, 0x0, &(0x7f00000002c0)={&(0x7f0000000300)={0x48, 0xb, 0x6, 0x1, 0x0, 0x0, {0x2}, [@IPSET_ATTR_SETNAME={0x9, 0x2, 'syz1\x00'}, @IPSET_ATTR_DATA={0x28, 0x7, 0x0, 0x1, [@IPSET_ATTR_IP={0xc, 0x1, 0x0, 0x1, @IPSET_ATTR_IPADDR_IPV4={0x8, 0x1, 0x1, 0x0, @local}}, @IPSET_ATTR_PORT={0x6, 0x4, 0x1, 0x0, 0x5000}, @IPSET_ATTR_MARK={0x8, 0xa, 0x1, 0x0, 0xc}, @IPSET_ATTR_CIDR2={0x5, 0x15, 0x18}]}]}, 0x48}}, 0x0) socket$inet6_udp(0xa, 0x2, 0x0) socket(0x10, 0x803, 0x0) socket(0x10, 0x3, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./config\x00', 0x1ff) mount(0x0, &(0x7f0000000000)='./config\x00', &(0x7f0000000080)='configfs\x00', 0x0, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000140)='./config/usb_gadget/g1\x00', 0xbf) mkdirat(0xffffffffffffff9c, &(0x7f00000001c0)='./config/usb_gadget/g1/functions/uvc.0\x00', 0x1ff) mkdirat(0xffffffffffffff9c, &(0x7f0000000280)='./config/usb_gadget/g1/functions/uvc.0/streaming/mjpeg/m1\x00', 0x1ff) r2 = openat(0xffffffffffffff9c, &(0x7f00000002c0)='./config/usb_gadget/g1/functions/uvc.0/streaming/mjpeg/m1/bmaControls\x00', 0x2, 0x0) write(r2, &(0x7f0000000640)='12', 0x2) write$P9_RVERSION(r2, &(0x7f0000000180)={0x13, 0x65, 0xffff, 0x1017, 0xffffffffffffff96, '9P2000.L'}, 0x13) syz_usb_connect$midi(0x0, 0x4f, &(0x7f0000000280)=ANY=[], 0x0) r3 = socket$nl_route(0x10, 0x3, 0x0) ioctl$ifreq_SIOCGIFINDEX_vcan(r3, 0x8933, &(0x7f0000000040)={'vxcan0\x00'}) getuid() r4 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPSET_CMD_CREATE(r4, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000200)=ANY=[@ANYBLOB="600000000206010800000000000000000000000005000400000000000900020073797a31000000001400078008001240000000000500140008000000050005000a000000050001000600000011000300686173683a69702c706f7274"], 0x60}}, 0x24000800) r5 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPSET_CMD_ADD(r5, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000240)={&(0x7f0000000c80)=ANY=[@ANYBLOB="5c000000090601080000000000000000070000000900020073797a31000000000500010007000000340007801800018014000240fe8000000000000000000000000000bb060004400e1f00cd050007008800000006000540"], 0x5c}, 0x1, 0x0, 0x0, 0x10000042}, 0x90) program crashed: KASAN: slab-use-after-free Read in ep_open testing program (duration=2m31.5s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): [0, 12, 19, 30] detailed listing: executing program 3: executing program 0: mkdirat(0xffffffffffffff9c, &(0x7f0000000100)='./gadget\x00', 0x1ff) mount(0x0, &(0x7f0000000140)='./gadget\x00', &(0x7f0000000180)='gadgetfs\x00', 0x0, 0x0) r0 = openat(0xffffffffffffff9c, &(0x7f00000001c0)='./gadget/dummy_udc\x00', 0x2, 0x0) bpf$MAP_UPDATE_ELEM_TAIL_CALL(0x2, &(0x7f0000000380)={{}, &(0x7f0000000300), &(0x7f0000000340)=r0}, 0x20) mprotect(&(0x7f0000362000/0x2000)=nil, 0x2000, 0x1) write(r0, &(0x7f0000000200)="000000000902190001010080320904000001ff000000070581024000000902190001010080320904000001ff00000007058102000200120100020000004034127856000100000001", 0x48) openat(0xffffffffffffff9c, &(0x7f0000000000)='./gadget/ep1in-bulk\x00', 0x2, 0x24) ioctl$sock_SIOCGIFINDEX(0xffffffffffffffff, 0x8933, &(0x7f0000000040)={'bridge0\x00'}) write$P9_RRENAME(0xffffffffffffffff, 0x0, 0x0) mmap(&(0x7f0000362000/0x4000)=nil, 0x4000, 0x0, 0x12, 0xffffffffffffffff, 0xfffff000) r1 = syz_clone(0x21000200, 0x0, 0x0, 0x0, 0x0, 0x0) rt_tgsigqueueinfo(r1, r1, 0x8, 0x0) executing program 8: r0 = socket(0x10, 0x3, 0x0) sendmsg$nl_route(0xffffffffffffffff, &(0x7f0000000300)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000100)=ANY=[@ANYBLOB="4800e80010000d0428bd7000fcdbff2500008000", @ANYRES32=r0, @ANYBLOB="1000000000000000280012800b00010062726964676500001800028005001900840000000c001e"], 0x48}}, 0x4084) sendmsg$nl_route(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000080)={&(0x7f00000001c0)=ANY=[@ANYBLOB="500000001000010425bbe5ad600027842cf52300", @ANYRES32=0x0, @ANYRESDEC=0x0, @ANYRES64=r0, @ANYRES16=r0], 0x50}, 0x1, 0x0, 0x0, 0x13d33d22c8a65c15}, 0x4008840) getsockopt$inet_sctp6_SCTP_NODELAY(r0, 0x84, 0x3, &(0x7f0000000280), &(0x7f00000002c0)=0x4) mkdirat(0xffffffffffffff9c, &(0x7f0000000040)='./mnt\x00', 0x1ff) mount$nfs(&(0x7f0000000080)=':27.0.0.1:/export\x00', &(0x7f00000000c0)='./mnt\x00', &(0x7f0000000180), 0x20800, &(0x7f0000000140)=ANY=[@ANYRES16=r0]) r1 = socket$inet6_icmp_raw(0xa, 0x3, 0x3a) bind$inet6(r1, &(0x7f00000001c0)={0xa, 0x4e20, 0xfffffffb, @empty, 0x2}, 0x1c) sendmmsg(r0, &(0x7f0000000000), 0x4000000000001f2, 0x0) r2 = socket$inet6_sctp(0xa, 0x1, 0x84) r3 = dup(r2) setsockopt$inet_sctp6_SCTP_SOCKOPT_BINDX_ADD(r3, 0x84, 0x64, &(0x7f0000000040)=[@in6={0xa, 0x4e24, 0x6, @loopback, 0x3}], 0x1c) getsockopt$inet_sctp_SCTP_GET_ASSOC_STATS(r3, 0x84, 0x70, &(0x7f0000000680)={0x0, @in6={{0xa, 0x4e22, 0x1, @ipv4={'\x00', '\xff\xff', @multicast1}, 0x8}}, [0xfffffffffffffffa, 0x3, 0x7, 0x3, 0x4, 0x3, 0xc, 0x8, 0x3, 0x5, 0x7, 0x100000000, 0x6, 0x2, 0x6]}, &(0x7f00000007c0)=0x100) r4 = socket$packet(0x11, 0x2, 0x300) r5 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r5, 0x8933, &(0x7f0000000040)={'ip6gretap0\x00', 0x0}) sendto$packet(r4, 0x0, 0x0, 0x0, &(0x7f0000000400)={0x11, 0x88a8, r6, 0x1, 0x0, 0x6, @local}, 0x14) r7 = openat$selinux_checkreqprot(0xffffffffffffff9c, &(0x7f0000000200), 0xa00, 0x0) io_uring_register$IORING_REGISTER_FILES(r3, 0x2, &(0x7f0000000240)=[r0, r0, r7, r0, r0, r0, r0], 0x7) executing program 4: r0 = syz_open_dev$dri(&(0x7f0000000000), 0x0, 0x0) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r0, 0xc02064b2, &(0x7f0000000040)={0x1, 0xd00, 0x6}) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r0, 0xc02064b2, &(0x7f0000000100)={0x1, 0x3, 0x9}) ioctl$DRM_IOCTL_PANTHOR_VM_CREATE(r0, 0xc0106441, &(0x7f0000000080)={0x0, 0x0, 0xffffffffffffffff}) socket$kcm(0xa, 0x2, 0x0) socket$nl_route(0x10, 0x3, 0x0) r1 = socket(0x10, 0x3, 0x0) getsockname$packet(r1, &(0x7f00000002c0)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000100)=0x14) sendmsg$nl_route(0xffffffffffffffff, &(0x7f0000000040)={0x0, 0x0, 0x0}, 0x0) sendmsg$IPSET_CMD_ADD(0xffffffffffffffff, 0x0, 0x0) sendmsg$IPSET_CMD_TEST(0xffffffffffffffff, &(0x7f0000000280)={0x0, 0x0, &(0x7f00000002c0)={&(0x7f0000000300)={0x48, 0xb, 0x6, 0x1, 0x0, 0x0, {0x2}, [@IPSET_ATTR_SETNAME={0x9, 0x2, 'syz1\x00'}, @IPSET_ATTR_DATA={0x28, 0x7, 0x0, 0x1, [@IPSET_ATTR_IP={0xc, 0x1, 0x0, 0x1, @IPSET_ATTR_IPADDR_IPV4={0x8, 0x1, 0x1, 0x0, @local}}, @IPSET_ATTR_PORT={0x6, 0x4, 0x1, 0x0, 0x5000}, @IPSET_ATTR_MARK={0x8, 0xa, 0x1, 0x0, 0xc}, @IPSET_ATTR_CIDR2={0x5, 0x15, 0x18}]}]}, 0x48}}, 0x0) socket$inet6_udp(0xa, 0x2, 0x0) socket(0x10, 0x803, 0x0) socket(0x10, 0x3, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./config\x00', 0x1ff) mount(0x0, &(0x7f0000000000)='./config\x00', &(0x7f0000000080)='configfs\x00', 0x0, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000140)='./config/usb_gadget/g1\x00', 0xbf) mkdirat(0xffffffffffffff9c, &(0x7f00000001c0)='./config/usb_gadget/g1/functions/uvc.0\x00', 0x1ff) mkdirat(0xffffffffffffff9c, &(0x7f0000000280)='./config/usb_gadget/g1/functions/uvc.0/streaming/mjpeg/m1\x00', 0x1ff) r2 = openat(0xffffffffffffff9c, &(0x7f00000002c0)='./config/usb_gadget/g1/functions/uvc.0/streaming/mjpeg/m1/bmaControls\x00', 0x2, 0x0) write(r2, &(0x7f0000000640)='12', 0x2) write$P9_RVERSION(r2, &(0x7f0000000180)={0x13, 0x65, 0xffff, 0x1017, 0xffffffffffffff96, '9P2000.L'}, 0x13) syz_usb_connect$midi(0x0, 0x4f, &(0x7f0000000280)=ANY=[], 0x0) r3 = socket$nl_route(0x10, 0x3, 0x0) ioctl$ifreq_SIOCGIFINDEX_vcan(r3, 0x8933, &(0x7f0000000040)={'vxcan0\x00'}) getuid() r4 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPSET_CMD_CREATE(r4, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000200)=ANY=[@ANYBLOB="600000000206010800000000000000000000000005000400000000000900020073797a31000000001400078008001240000000000500140008000000050005000a000000050001000600000011000300686173683a69702c706f7274"], 0x60}}, 0x24000800) r5 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPSET_CMD_ADD(r5, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000240)={&(0x7f0000000c80)=ANY=[@ANYBLOB="5c000000090601080000000000000000070000000900020073797a31000000000500010007000000340007801800018014000240fe8000000000000000000000000000bb060004400e1f00cd050007008800000006000540"], 0x5c}, 0x1, 0x0, 0x0, 0x10000042}, 0x90) program did not crash testing program (duration=2m31.5s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): [0, 12, 19, 30] detailed listing: executing program 3: executing program 0: mkdirat(0xffffffffffffff9c, &(0x7f0000000100)='./gadget\x00', 0x1ff) mount(0x0, &(0x7f0000000140)='./gadget\x00', &(0x7f0000000180)='gadgetfs\x00', 0x0, 0x0) r0 = openat(0xffffffffffffff9c, &(0x7f00000001c0)='./gadget/dummy_udc\x00', 0x2, 0x0) bpf$MAP_UPDATE_ELEM_TAIL_CALL(0x2, &(0x7f0000000380)={{}, &(0x7f0000000300), &(0x7f0000000340)=r0}, 0x20) mprotect(&(0x7f0000362000/0x2000)=nil, 0x2000, 0x1) write(r0, &(0x7f0000000200)="000000000902190001010080320904000001ff000000070581024000000902190001010080320904000001ff00000007058102000200120100020000004034127856000100000001", 0x48) write(0xffffffffffffffff, &(0x7f00000005c0)="010000000705810240000007058102000200", 0x12) ioctl$sock_SIOCGIFINDEX(0xffffffffffffffff, 0x8933, &(0x7f0000000040)={'bridge0\x00'}) write$P9_RRENAME(0xffffffffffffffff, 0x0, 0x0) mmap(&(0x7f0000362000/0x4000)=nil, 0x4000, 0x0, 0x12, 0xffffffffffffffff, 0xfffff000) r1 = syz_clone(0x21000200, 0x0, 0x0, 0x0, 0x0, 0x0) rt_tgsigqueueinfo(r1, r1, 0x8, 0x0) executing program 8: r0 = socket(0x10, 0x3, 0x0) sendmsg$nl_route(0xffffffffffffffff, &(0x7f0000000300)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000100)=ANY=[@ANYBLOB="4800e80010000d0428bd7000fcdbff2500008000", @ANYRES32=r0, @ANYBLOB="1000000000000000280012800b00010062726964676500001800028005001900840000000c001e"], 0x48}}, 0x4084) sendmsg$nl_route(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000080)={&(0x7f00000001c0)=ANY=[@ANYBLOB="500000001000010425bbe5ad600027842cf52300", @ANYRES32=0x0, @ANYRESDEC=0x0, @ANYRES64=r0, @ANYRES16=r0], 0x50}, 0x1, 0x0, 0x0, 0x13d33d22c8a65c15}, 0x4008840) getsockopt$inet_sctp6_SCTP_NODELAY(r0, 0x84, 0x3, &(0x7f0000000280), &(0x7f00000002c0)=0x4) mkdirat(0xffffffffffffff9c, &(0x7f0000000040)='./mnt\x00', 0x1ff) mount$nfs(&(0x7f0000000080)=':27.0.0.1:/export\x00', &(0x7f00000000c0)='./mnt\x00', &(0x7f0000000180), 0x20800, &(0x7f0000000140)=ANY=[@ANYRES16=r0]) r1 = socket$inet6_icmp_raw(0xa, 0x3, 0x3a) bind$inet6(r1, &(0x7f00000001c0)={0xa, 0x4e20, 0xfffffffb, @empty, 0x2}, 0x1c) sendmmsg(r0, &(0x7f0000000000), 0x4000000000001f2, 0x0) r2 = socket$inet6_sctp(0xa, 0x1, 0x84) r3 = dup(r2) setsockopt$inet_sctp6_SCTP_SOCKOPT_BINDX_ADD(r3, 0x84, 0x64, &(0x7f0000000040)=[@in6={0xa, 0x4e24, 0x6, @loopback, 0x3}], 0x1c) getsockopt$inet_sctp_SCTP_GET_ASSOC_STATS(r3, 0x84, 0x70, &(0x7f0000000680)={0x0, @in6={{0xa, 0x4e22, 0x1, @ipv4={'\x00', '\xff\xff', @multicast1}, 0x8}}, [0xfffffffffffffffa, 0x3, 0x7, 0x3, 0x4, 0x3, 0xc, 0x8, 0x3, 0x5, 0x7, 0x100000000, 0x6, 0x2, 0x6]}, &(0x7f00000007c0)=0x100) r4 = socket$packet(0x11, 0x2, 0x300) r5 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r5, 0x8933, &(0x7f0000000040)={'ip6gretap0\x00', 0x0}) sendto$packet(r4, 0x0, 0x0, 0x0, &(0x7f0000000400)={0x11, 0x88a8, r6, 0x1, 0x0, 0x6, @local}, 0x14) r7 = openat$selinux_checkreqprot(0xffffffffffffff9c, &(0x7f0000000200), 0xa00, 0x0) io_uring_register$IORING_REGISTER_FILES(r3, 0x2, &(0x7f0000000240)=[r0, r0, r7, r0, r0, r0, r0], 0x7) executing program 4: r0 = syz_open_dev$dri(&(0x7f0000000000), 0x0, 0x0) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r0, 0xc02064b2, &(0x7f0000000040)={0x1, 0xd00, 0x6}) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r0, 0xc02064b2, &(0x7f0000000100)={0x1, 0x3, 0x9}) ioctl$DRM_IOCTL_PANTHOR_VM_CREATE(r0, 0xc0106441, &(0x7f0000000080)={0x0, 0x0, 0xffffffffffffffff}) socket$kcm(0xa, 0x2, 0x0) socket$nl_route(0x10, 0x3, 0x0) r1 = socket(0x10, 0x3, 0x0) getsockname$packet(r1, &(0x7f00000002c0)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000100)=0x14) sendmsg$nl_route(0xffffffffffffffff, &(0x7f0000000040)={0x0, 0x0, 0x0}, 0x0) sendmsg$IPSET_CMD_ADD(0xffffffffffffffff, 0x0, 0x0) sendmsg$IPSET_CMD_TEST(0xffffffffffffffff, &(0x7f0000000280)={0x0, 0x0, &(0x7f00000002c0)={&(0x7f0000000300)={0x48, 0xb, 0x6, 0x1, 0x0, 0x0, {0x2}, [@IPSET_ATTR_SETNAME={0x9, 0x2, 'syz1\x00'}, @IPSET_ATTR_DATA={0x28, 0x7, 0x0, 0x1, [@IPSET_ATTR_IP={0xc, 0x1, 0x0, 0x1, @IPSET_ATTR_IPADDR_IPV4={0x8, 0x1, 0x1, 0x0, @local}}, @IPSET_ATTR_PORT={0x6, 0x4, 0x1, 0x0, 0x5000}, @IPSET_ATTR_MARK={0x8, 0xa, 0x1, 0x0, 0xc}, @IPSET_ATTR_CIDR2={0x5, 0x15, 0x18}]}]}, 0x48}}, 0x0) socket$inet6_udp(0xa, 0x2, 0x0) socket(0x10, 0x803, 0x0) socket(0x10, 0x3, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./config\x00', 0x1ff) mount(0x0, &(0x7f0000000000)='./config\x00', &(0x7f0000000080)='configfs\x00', 0x0, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000140)='./config/usb_gadget/g1\x00', 0xbf) mkdirat(0xffffffffffffff9c, &(0x7f00000001c0)='./config/usb_gadget/g1/functions/uvc.0\x00', 0x1ff) mkdirat(0xffffffffffffff9c, &(0x7f0000000280)='./config/usb_gadget/g1/functions/uvc.0/streaming/mjpeg/m1\x00', 0x1ff) r2 = openat(0xffffffffffffff9c, &(0x7f00000002c0)='./config/usb_gadget/g1/functions/uvc.0/streaming/mjpeg/m1/bmaControls\x00', 0x2, 0x0) write(r2, &(0x7f0000000640)='12', 0x2) write$P9_RVERSION(r2, &(0x7f0000000180)={0x13, 0x65, 0xffff, 0x1017, 0xffffffffffffff96, '9P2000.L'}, 0x13) syz_usb_connect$midi(0x0, 0x4f, &(0x7f0000000280)=ANY=[], 0x0) r3 = socket$nl_route(0x10, 0x3, 0x0) ioctl$ifreq_SIOCGIFINDEX_vcan(r3, 0x8933, &(0x7f0000000040)={'vxcan0\x00'}) getuid() r4 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPSET_CMD_CREATE(r4, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000200)=ANY=[@ANYBLOB="600000000206010800000000000000000000000005000400000000000900020073797a31000000001400078008001240000000000500140008000000050005000a000000050001000600000011000300686173683a69702c706f7274"], 0x60}}, 0x24000800) r5 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPSET_CMD_ADD(r5, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000240)={&(0x7f0000000c80)=ANY=[@ANYBLOB="5c000000090601080000000000000000070000000900020073797a31000000000500010007000000340007801800018014000240fe8000000000000000000000000000bb060004400e1f00cd050007008800000006000540"], 0x5c}, 0x1, 0x0, 0x0, 0x10000042}, 0x90) program crashed: KASAN: slab-use-after-free Read in ep_open testing program (duration=2m31.5s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): [0, 11, 19, 30] detailed listing: executing program 3: executing program 0: mkdirat(0xffffffffffffff9c, &(0x7f0000000100)='./gadget\x00', 0x1ff) mount(0x0, &(0x7f0000000140)='./gadget\x00', &(0x7f0000000180)='gadgetfs\x00', 0x0, 0x0) r0 = openat(0xffffffffffffff9c, &(0x7f00000001c0)='./gadget/dummy_udc\x00', 0x2, 0x0) bpf$MAP_UPDATE_ELEM_TAIL_CALL(0x2, &(0x7f0000000380)={{}, &(0x7f0000000300), &(0x7f0000000340)=r0}, 0x20) mprotect(&(0x7f0000362000/0x2000)=nil, 0x2000, 0x1) write(0xffffffffffffffff, &(0x7f00000005c0)="010000000705810240000007058102000200", 0x12) ioctl$sock_SIOCGIFINDEX(0xffffffffffffffff, 0x8933, &(0x7f0000000040)={'bridge0\x00'}) write$P9_RRENAME(0xffffffffffffffff, 0x0, 0x0) mmap(&(0x7f0000362000/0x4000)=nil, 0x4000, 0x0, 0x12, 0xffffffffffffffff, 0xfffff000) r1 = syz_clone(0x21000200, 0x0, 0x0, 0x0, 0x0, 0x0) rt_tgsigqueueinfo(r1, r1, 0x8, 0x0) executing program 8: r0 = socket(0x10, 0x3, 0x0) sendmsg$nl_route(0xffffffffffffffff, &(0x7f0000000300)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000100)=ANY=[@ANYBLOB="4800e80010000d0428bd7000fcdbff2500008000", @ANYRES32=r0, @ANYBLOB="1000000000000000280012800b00010062726964676500001800028005001900840000000c001e"], 0x48}}, 0x4084) sendmsg$nl_route(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000080)={&(0x7f00000001c0)=ANY=[@ANYBLOB="500000001000010425bbe5ad600027842cf52300", @ANYRES32=0x0, @ANYRESDEC=0x0, @ANYRES64=r0, @ANYRES16=r0], 0x50}, 0x1, 0x0, 0x0, 0x13d33d22c8a65c15}, 0x4008840) getsockopt$inet_sctp6_SCTP_NODELAY(r0, 0x84, 0x3, &(0x7f0000000280), &(0x7f00000002c0)=0x4) mkdirat(0xffffffffffffff9c, &(0x7f0000000040)='./mnt\x00', 0x1ff) mount$nfs(&(0x7f0000000080)=':27.0.0.1:/export\x00', &(0x7f00000000c0)='./mnt\x00', &(0x7f0000000180), 0x20800, &(0x7f0000000140)=ANY=[@ANYRES16=r0]) r1 = socket$inet6_icmp_raw(0xa, 0x3, 0x3a) bind$inet6(r1, &(0x7f00000001c0)={0xa, 0x4e20, 0xfffffffb, @empty, 0x2}, 0x1c) sendmmsg(r0, &(0x7f0000000000), 0x4000000000001f2, 0x0) r2 = socket$inet6_sctp(0xa, 0x1, 0x84) r3 = dup(r2) setsockopt$inet_sctp6_SCTP_SOCKOPT_BINDX_ADD(r3, 0x84, 0x64, &(0x7f0000000040)=[@in6={0xa, 0x4e24, 0x6, @loopback, 0x3}], 0x1c) getsockopt$inet_sctp_SCTP_GET_ASSOC_STATS(r3, 0x84, 0x70, &(0x7f0000000680)={0x0, @in6={{0xa, 0x4e22, 0x1, @ipv4={'\x00', '\xff\xff', @multicast1}, 0x8}}, [0xfffffffffffffffa, 0x3, 0x7, 0x3, 0x4, 0x3, 0xc, 0x8, 0x3, 0x5, 0x7, 0x100000000, 0x6, 0x2, 0x6]}, &(0x7f00000007c0)=0x100) r4 = socket$packet(0x11, 0x2, 0x300) r5 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r5, 0x8933, &(0x7f0000000040)={'ip6gretap0\x00', 0x0}) sendto$packet(r4, 0x0, 0x0, 0x0, &(0x7f0000000400)={0x11, 0x88a8, r6, 0x1, 0x0, 0x6, @local}, 0x14) r7 = openat$selinux_checkreqprot(0xffffffffffffff9c, &(0x7f0000000200), 0xa00, 0x0) io_uring_register$IORING_REGISTER_FILES(r3, 0x2, &(0x7f0000000240)=[r0, r0, r7, r0, r0, r0, r0], 0x7) executing program 4: r0 = syz_open_dev$dri(&(0x7f0000000000), 0x0, 0x0) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r0, 0xc02064b2, &(0x7f0000000040)={0x1, 0xd00, 0x6}) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r0, 0xc02064b2, &(0x7f0000000100)={0x1, 0x3, 0x9}) ioctl$DRM_IOCTL_PANTHOR_VM_CREATE(r0, 0xc0106441, &(0x7f0000000080)={0x0, 0x0, 0xffffffffffffffff}) socket$kcm(0xa, 0x2, 0x0) socket$nl_route(0x10, 0x3, 0x0) r1 = socket(0x10, 0x3, 0x0) getsockname$packet(r1, &(0x7f00000002c0)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000100)=0x14) sendmsg$nl_route(0xffffffffffffffff, &(0x7f0000000040)={0x0, 0x0, 0x0}, 0x0) sendmsg$IPSET_CMD_ADD(0xffffffffffffffff, 0x0, 0x0) sendmsg$IPSET_CMD_TEST(0xffffffffffffffff, &(0x7f0000000280)={0x0, 0x0, &(0x7f00000002c0)={&(0x7f0000000300)={0x48, 0xb, 0x6, 0x1, 0x0, 0x0, {0x2}, [@IPSET_ATTR_SETNAME={0x9, 0x2, 'syz1\x00'}, @IPSET_ATTR_DATA={0x28, 0x7, 0x0, 0x1, [@IPSET_ATTR_IP={0xc, 0x1, 0x0, 0x1, @IPSET_ATTR_IPADDR_IPV4={0x8, 0x1, 0x1, 0x0, @local}}, @IPSET_ATTR_PORT={0x6, 0x4, 0x1, 0x0, 0x5000}, @IPSET_ATTR_MARK={0x8, 0xa, 0x1, 0x0, 0xc}, @IPSET_ATTR_CIDR2={0x5, 0x15, 0x18}]}]}, 0x48}}, 0x0) socket$inet6_udp(0xa, 0x2, 0x0) socket(0x10, 0x803, 0x0) socket(0x10, 0x3, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./config\x00', 0x1ff) mount(0x0, &(0x7f0000000000)='./config\x00', &(0x7f0000000080)='configfs\x00', 0x0, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000140)='./config/usb_gadget/g1\x00', 0xbf) mkdirat(0xffffffffffffff9c, &(0x7f00000001c0)='./config/usb_gadget/g1/functions/uvc.0\x00', 0x1ff) mkdirat(0xffffffffffffff9c, &(0x7f0000000280)='./config/usb_gadget/g1/functions/uvc.0/streaming/mjpeg/m1\x00', 0x1ff) r2 = openat(0xffffffffffffff9c, &(0x7f00000002c0)='./config/usb_gadget/g1/functions/uvc.0/streaming/mjpeg/m1/bmaControls\x00', 0x2, 0x0) write(r2, &(0x7f0000000640)='12', 0x2) write$P9_RVERSION(r2, &(0x7f0000000180)={0x13, 0x65, 0xffff, 0x1017, 0xffffffffffffff96, '9P2000.L'}, 0x13) syz_usb_connect$midi(0x0, 0x4f, &(0x7f0000000280)=ANY=[], 0x0) r3 = socket$nl_route(0x10, 0x3, 0x0) ioctl$ifreq_SIOCGIFINDEX_vcan(r3, 0x8933, &(0x7f0000000040)={'vxcan0\x00'}) getuid() r4 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPSET_CMD_CREATE(r4, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000200)=ANY=[@ANYBLOB="600000000206010800000000000000000000000005000400000000000900020073797a31000000001400078008001240000000000500140008000000050005000a000000050001000600000011000300686173683a69702c706f7274"], 0x60}}, 0x24000800) r5 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPSET_CMD_ADD(r5, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000240)={&(0x7f0000000c80)=ANY=[@ANYBLOB="5c000000090601080000000000000000070000000900020073797a31000000000500010007000000340007801800018014000240fe8000000000000000000000000000bb060004400e1f00cd050007008800000006000540"], 0x5c}, 0x1, 0x0, 0x0, 0x10000042}, 0x90) program did not crash testing program (duration=2m31.5s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): [0, 11, 19, 30] detailed listing: executing program 3: executing program 0: mkdirat(0xffffffffffffff9c, &(0x7f0000000100)='./gadget\x00', 0x1ff) mount(0x0, &(0x7f0000000140)='./gadget\x00', &(0x7f0000000180)='gadgetfs\x00', 0x0, 0x0) r0 = openat(0xffffffffffffff9c, &(0x7f00000001c0)='./gadget/dummy_udc\x00', 0x2, 0x0) bpf$MAP_UPDATE_ELEM_TAIL_CALL(0x2, &(0x7f0000000380)={{}, &(0x7f0000000300), &(0x7f0000000340)=r0}, 0x20) write(r0, &(0x7f0000000200)="000000000902190001010080320904000001ff000000070581024000000902190001010080320904000001ff00000007058102000200120100020000004034127856000100000001", 0x48) write(0xffffffffffffffff, &(0x7f00000005c0)="010000000705810240000007058102000200", 0x12) ioctl$sock_SIOCGIFINDEX(0xffffffffffffffff, 0x8933, &(0x7f0000000040)={'bridge0\x00'}) write$P9_RRENAME(0xffffffffffffffff, 0x0, 0x0) mmap(&(0x7f0000362000/0x4000)=nil, 0x4000, 0x0, 0x12, 0xffffffffffffffff, 0xfffff000) r1 = syz_clone(0x21000200, 0x0, 0x0, 0x0, 0x0, 0x0) rt_tgsigqueueinfo(r1, r1, 0x8, 0x0) executing program 8: r0 = socket(0x10, 0x3, 0x0) sendmsg$nl_route(0xffffffffffffffff, &(0x7f0000000300)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000100)=ANY=[@ANYBLOB="4800e80010000d0428bd7000fcdbff2500008000", @ANYRES32=r0, @ANYBLOB="1000000000000000280012800b00010062726964676500001800028005001900840000000c001e"], 0x48}}, 0x4084) sendmsg$nl_route(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000080)={&(0x7f00000001c0)=ANY=[@ANYBLOB="500000001000010425bbe5ad600027842cf52300", @ANYRES32=0x0, @ANYRESDEC=0x0, @ANYRES64=r0, @ANYRES16=r0], 0x50}, 0x1, 0x0, 0x0, 0x13d33d22c8a65c15}, 0x4008840) getsockopt$inet_sctp6_SCTP_NODELAY(r0, 0x84, 0x3, &(0x7f0000000280), &(0x7f00000002c0)=0x4) mkdirat(0xffffffffffffff9c, &(0x7f0000000040)='./mnt\x00', 0x1ff) mount$nfs(&(0x7f0000000080)=':27.0.0.1:/export\x00', &(0x7f00000000c0)='./mnt\x00', &(0x7f0000000180), 0x20800, &(0x7f0000000140)=ANY=[@ANYRES16=r0]) r1 = socket$inet6_icmp_raw(0xa, 0x3, 0x3a) bind$inet6(r1, &(0x7f00000001c0)={0xa, 0x4e20, 0xfffffffb, @empty, 0x2}, 0x1c) sendmmsg(r0, &(0x7f0000000000), 0x4000000000001f2, 0x0) r2 = socket$inet6_sctp(0xa, 0x1, 0x84) r3 = dup(r2) setsockopt$inet_sctp6_SCTP_SOCKOPT_BINDX_ADD(r3, 0x84, 0x64, &(0x7f0000000040)=[@in6={0xa, 0x4e24, 0x6, @loopback, 0x3}], 0x1c) getsockopt$inet_sctp_SCTP_GET_ASSOC_STATS(r3, 0x84, 0x70, &(0x7f0000000680)={0x0, @in6={{0xa, 0x4e22, 0x1, @ipv4={'\x00', '\xff\xff', @multicast1}, 0x8}}, [0xfffffffffffffffa, 0x3, 0x7, 0x3, 0x4, 0x3, 0xc, 0x8, 0x3, 0x5, 0x7, 0x100000000, 0x6, 0x2, 0x6]}, &(0x7f00000007c0)=0x100) r4 = socket$packet(0x11, 0x2, 0x300) r5 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r5, 0x8933, &(0x7f0000000040)={'ip6gretap0\x00', 0x0}) sendto$packet(r4, 0x0, 0x0, 0x0, &(0x7f0000000400)={0x11, 0x88a8, r6, 0x1, 0x0, 0x6, @local}, 0x14) r7 = openat$selinux_checkreqprot(0xffffffffffffff9c, &(0x7f0000000200), 0xa00, 0x0) io_uring_register$IORING_REGISTER_FILES(r3, 0x2, &(0x7f0000000240)=[r0, r0, r7, r0, r0, r0, r0], 0x7) executing program 4: r0 = syz_open_dev$dri(&(0x7f0000000000), 0x0, 0x0) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r0, 0xc02064b2, &(0x7f0000000040)={0x1, 0xd00, 0x6}) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r0, 0xc02064b2, &(0x7f0000000100)={0x1, 0x3, 0x9}) ioctl$DRM_IOCTL_PANTHOR_VM_CREATE(r0, 0xc0106441, &(0x7f0000000080)={0x0, 0x0, 0xffffffffffffffff}) socket$kcm(0xa, 0x2, 0x0) socket$nl_route(0x10, 0x3, 0x0) r1 = socket(0x10, 0x3, 0x0) getsockname$packet(r1, &(0x7f00000002c0)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000100)=0x14) sendmsg$nl_route(0xffffffffffffffff, &(0x7f0000000040)={0x0, 0x0, 0x0}, 0x0) sendmsg$IPSET_CMD_ADD(0xffffffffffffffff, 0x0, 0x0) sendmsg$IPSET_CMD_TEST(0xffffffffffffffff, &(0x7f0000000280)={0x0, 0x0, &(0x7f00000002c0)={&(0x7f0000000300)={0x48, 0xb, 0x6, 0x1, 0x0, 0x0, {0x2}, [@IPSET_ATTR_SETNAME={0x9, 0x2, 'syz1\x00'}, @IPSET_ATTR_DATA={0x28, 0x7, 0x0, 0x1, [@IPSET_ATTR_IP={0xc, 0x1, 0x0, 0x1, @IPSET_ATTR_IPADDR_IPV4={0x8, 0x1, 0x1, 0x0, @local}}, @IPSET_ATTR_PORT={0x6, 0x4, 0x1, 0x0, 0x5000}, @IPSET_ATTR_MARK={0x8, 0xa, 0x1, 0x0, 0xc}, @IPSET_ATTR_CIDR2={0x5, 0x15, 0x18}]}]}, 0x48}}, 0x0) socket$inet6_udp(0xa, 0x2, 0x0) socket(0x10, 0x803, 0x0) socket(0x10, 0x3, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./config\x00', 0x1ff) mount(0x0, &(0x7f0000000000)='./config\x00', &(0x7f0000000080)='configfs\x00', 0x0, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000140)='./config/usb_gadget/g1\x00', 0xbf) mkdirat(0xffffffffffffff9c, &(0x7f00000001c0)='./config/usb_gadget/g1/functions/uvc.0\x00', 0x1ff) mkdirat(0xffffffffffffff9c, &(0x7f0000000280)='./config/usb_gadget/g1/functions/uvc.0/streaming/mjpeg/m1\x00', 0x1ff) r2 = openat(0xffffffffffffff9c, &(0x7f00000002c0)='./config/usb_gadget/g1/functions/uvc.0/streaming/mjpeg/m1/bmaControls\x00', 0x2, 0x0) write(r2, &(0x7f0000000640)='12', 0x2) write$P9_RVERSION(r2, &(0x7f0000000180)={0x13, 0x65, 0xffff, 0x1017, 0xffffffffffffff96, '9P2000.L'}, 0x13) syz_usb_connect$midi(0x0, 0x4f, &(0x7f0000000280)=ANY=[], 0x0) r3 = socket$nl_route(0x10, 0x3, 0x0) ioctl$ifreq_SIOCGIFINDEX_vcan(r3, 0x8933, &(0x7f0000000040)={'vxcan0\x00'}) getuid() r4 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPSET_CMD_CREATE(r4, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000200)=ANY=[@ANYBLOB="600000000206010800000000000000000000000005000400000000000900020073797a31000000001400078008001240000000000500140008000000050005000a000000050001000600000011000300686173683a69702c706f7274"], 0x60}}, 0x24000800) r5 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPSET_CMD_ADD(r5, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000240)={&(0x7f0000000c80)=ANY=[@ANYBLOB="5c000000090601080000000000000000070000000900020073797a31000000000500010007000000340007801800018014000240fe8000000000000000000000000000bb060004400e1f00cd050007008800000006000540"], 0x5c}, 0x1, 0x0, 0x0, 0x10000042}, 0x90) program did not crash testing program (duration=2m31.5s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): [0, 11, 19, 30] detailed listing: executing program 3: executing program 0: mkdirat(0xffffffffffffff9c, &(0x7f0000000100)='./gadget\x00', 0x1ff) mount(0x0, &(0x7f0000000140)='./gadget\x00', &(0x7f0000000180)='gadgetfs\x00', 0x0, 0x0) r0 = openat(0xffffffffffffff9c, &(0x7f00000001c0)='./gadget/dummy_udc\x00', 0x2, 0x0) mprotect(&(0x7f0000362000/0x2000)=nil, 0x2000, 0x1) write(r0, &(0x7f0000000200)="000000000902190001010080320904000001ff000000070581024000000902190001010080320904000001ff00000007058102000200120100020000004034127856000100000001", 0x48) write(0xffffffffffffffff, &(0x7f00000005c0)="010000000705810240000007058102000200", 0x12) ioctl$sock_SIOCGIFINDEX(0xffffffffffffffff, 0x8933, &(0x7f0000000040)={'bridge0\x00'}) write$P9_RRENAME(0xffffffffffffffff, 0x0, 0x0) mmap(&(0x7f0000362000/0x4000)=nil, 0x4000, 0x0, 0x12, 0xffffffffffffffff, 0xfffff000) r1 = syz_clone(0x21000200, 0x0, 0x0, 0x0, 0x0, 0x0) rt_tgsigqueueinfo(r1, r1, 0x8, 0x0) executing program 8: r0 = socket(0x10, 0x3, 0x0) sendmsg$nl_route(0xffffffffffffffff, &(0x7f0000000300)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000100)=ANY=[@ANYBLOB="4800e80010000d0428bd7000fcdbff2500008000", @ANYRES32=r0, @ANYBLOB="1000000000000000280012800b00010062726964676500001800028005001900840000000c001e"], 0x48}}, 0x4084) sendmsg$nl_route(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000080)={&(0x7f00000001c0)=ANY=[@ANYBLOB="500000001000010425bbe5ad600027842cf52300", @ANYRES32=0x0, @ANYRESDEC=0x0, @ANYRES64=r0, @ANYRES16=r0], 0x50}, 0x1, 0x0, 0x0, 0x13d33d22c8a65c15}, 0x4008840) getsockopt$inet_sctp6_SCTP_NODELAY(r0, 0x84, 0x3, &(0x7f0000000280), &(0x7f00000002c0)=0x4) mkdirat(0xffffffffffffff9c, &(0x7f0000000040)='./mnt\x00', 0x1ff) mount$nfs(&(0x7f0000000080)=':27.0.0.1:/export\x00', &(0x7f00000000c0)='./mnt\x00', &(0x7f0000000180), 0x20800, &(0x7f0000000140)=ANY=[@ANYRES16=r0]) r1 = socket$inet6_icmp_raw(0xa, 0x3, 0x3a) bind$inet6(r1, &(0x7f00000001c0)={0xa, 0x4e20, 0xfffffffb, @empty, 0x2}, 0x1c) sendmmsg(r0, &(0x7f0000000000), 0x4000000000001f2, 0x0) r2 = socket$inet6_sctp(0xa, 0x1, 0x84) r3 = dup(r2) setsockopt$inet_sctp6_SCTP_SOCKOPT_BINDX_ADD(r3, 0x84, 0x64, &(0x7f0000000040)=[@in6={0xa, 0x4e24, 0x6, @loopback, 0x3}], 0x1c) getsockopt$inet_sctp_SCTP_GET_ASSOC_STATS(r3, 0x84, 0x70, &(0x7f0000000680)={0x0, @in6={{0xa, 0x4e22, 0x1, @ipv4={'\x00', '\xff\xff', @multicast1}, 0x8}}, [0xfffffffffffffffa, 0x3, 0x7, 0x3, 0x4, 0x3, 0xc, 0x8, 0x3, 0x5, 0x7, 0x100000000, 0x6, 0x2, 0x6]}, &(0x7f00000007c0)=0x100) r4 = socket$packet(0x11, 0x2, 0x300) r5 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r5, 0x8933, &(0x7f0000000040)={'ip6gretap0\x00', 0x0}) sendto$packet(r4, 0x0, 0x0, 0x0, &(0x7f0000000400)={0x11, 0x88a8, r6, 0x1, 0x0, 0x6, @local}, 0x14) r7 = openat$selinux_checkreqprot(0xffffffffffffff9c, &(0x7f0000000200), 0xa00, 0x0) io_uring_register$IORING_REGISTER_FILES(r3, 0x2, &(0x7f0000000240)=[r0, r0, r7, r0, r0, r0, r0], 0x7) executing program 4: r0 = syz_open_dev$dri(&(0x7f0000000000), 0x0, 0x0) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r0, 0xc02064b2, &(0x7f0000000040)={0x1, 0xd00, 0x6}) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r0, 0xc02064b2, &(0x7f0000000100)={0x1, 0x3, 0x9}) ioctl$DRM_IOCTL_PANTHOR_VM_CREATE(r0, 0xc0106441, &(0x7f0000000080)={0x0, 0x0, 0xffffffffffffffff}) socket$kcm(0xa, 0x2, 0x0) socket$nl_route(0x10, 0x3, 0x0) r1 = socket(0x10, 0x3, 0x0) getsockname$packet(r1, &(0x7f00000002c0)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000100)=0x14) sendmsg$nl_route(0xffffffffffffffff, &(0x7f0000000040)={0x0, 0x0, 0x0}, 0x0) sendmsg$IPSET_CMD_ADD(0xffffffffffffffff, 0x0, 0x0) sendmsg$IPSET_CMD_TEST(0xffffffffffffffff, &(0x7f0000000280)={0x0, 0x0, &(0x7f00000002c0)={&(0x7f0000000300)={0x48, 0xb, 0x6, 0x1, 0x0, 0x0, {0x2}, [@IPSET_ATTR_SETNAME={0x9, 0x2, 'syz1\x00'}, @IPSET_ATTR_DATA={0x28, 0x7, 0x0, 0x1, [@IPSET_ATTR_IP={0xc, 0x1, 0x0, 0x1, @IPSET_ATTR_IPADDR_IPV4={0x8, 0x1, 0x1, 0x0, @local}}, @IPSET_ATTR_PORT={0x6, 0x4, 0x1, 0x0, 0x5000}, @IPSET_ATTR_MARK={0x8, 0xa, 0x1, 0x0, 0xc}, @IPSET_ATTR_CIDR2={0x5, 0x15, 0x18}]}]}, 0x48}}, 0x0) socket$inet6_udp(0xa, 0x2, 0x0) socket(0x10, 0x803, 0x0) socket(0x10, 0x3, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./config\x00', 0x1ff) mount(0x0, &(0x7f0000000000)='./config\x00', &(0x7f0000000080)='configfs\x00', 0x0, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000140)='./config/usb_gadget/g1\x00', 0xbf) mkdirat(0xffffffffffffff9c, &(0x7f00000001c0)='./config/usb_gadget/g1/functions/uvc.0\x00', 0x1ff) mkdirat(0xffffffffffffff9c, &(0x7f0000000280)='./config/usb_gadget/g1/functions/uvc.0/streaming/mjpeg/m1\x00', 0x1ff) r2 = openat(0xffffffffffffff9c, &(0x7f00000002c0)='./config/usb_gadget/g1/functions/uvc.0/streaming/mjpeg/m1/bmaControls\x00', 0x2, 0x0) write(r2, &(0x7f0000000640)='12', 0x2) write$P9_RVERSION(r2, &(0x7f0000000180)={0x13, 0x65, 0xffff, 0x1017, 0xffffffffffffff96, '9P2000.L'}, 0x13) syz_usb_connect$midi(0x0, 0x4f, &(0x7f0000000280)=ANY=[], 0x0) r3 = socket$nl_route(0x10, 0x3, 0x0) ioctl$ifreq_SIOCGIFINDEX_vcan(r3, 0x8933, &(0x7f0000000040)={'vxcan0\x00'}) getuid() r4 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPSET_CMD_CREATE(r4, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000200)=ANY=[@ANYBLOB="600000000206010800000000000000000000000005000400000000000900020073797a31000000001400078008001240000000000500140008000000050005000a000000050001000600000011000300686173683a69702c706f7274"], 0x60}}, 0x24000800) r5 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPSET_CMD_ADD(r5, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000240)={&(0x7f0000000c80)=ANY=[@ANYBLOB="5c000000090601080000000000000000070000000900020073797a31000000000500010007000000340007801800018014000240fe8000000000000000000000000000bb060004400e1f00cd050007008800000006000540"], 0x5c}, 0x1, 0x0, 0x0, 0x10000042}, 0x90) program crashed: KASAN: slab-use-after-free Read in ep_open testing program (duration=2m31.5s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): [0, 10, 19, 30] detailed listing: executing program 3: executing program 0: mkdirat(0xffffffffffffff9c, &(0x7f0000000100)='./gadget\x00', 0x1ff) mount(0x0, &(0x7f0000000140)='./gadget\x00', &(0x7f0000000180)='gadgetfs\x00', 0x0, 0x0) mprotect(&(0x7f0000362000/0x2000)=nil, 0x2000, 0x1) write(0xffffffffffffffff, &(0x7f0000000200)="000000000902190001010080320904000001ff000000070581024000000902190001010080320904000001ff00000007058102000200120100020000004034127856000100000001", 0x48) write(0xffffffffffffffff, &(0x7f00000005c0)="010000000705810240000007058102000200", 0x12) ioctl$sock_SIOCGIFINDEX(0xffffffffffffffff, 0x8933, &(0x7f0000000040)={'bridge0\x00'}) write$P9_RRENAME(0xffffffffffffffff, 0x0, 0x0) mmap(&(0x7f0000362000/0x4000)=nil, 0x4000, 0x0, 0x12, 0xffffffffffffffff, 0xfffff000) r0 = syz_clone(0x21000200, 0x0, 0x0, 0x0, 0x0, 0x0) rt_tgsigqueueinfo(r0, r0, 0x8, 0x0) executing program 8: r0 = socket(0x10, 0x3, 0x0) sendmsg$nl_route(0xffffffffffffffff, &(0x7f0000000300)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000100)=ANY=[@ANYBLOB="4800e80010000d0428bd7000fcdbff2500008000", @ANYRES32=r0, @ANYBLOB="1000000000000000280012800b00010062726964676500001800028005001900840000000c001e"], 0x48}}, 0x4084) sendmsg$nl_route(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000080)={&(0x7f00000001c0)=ANY=[@ANYBLOB="500000001000010425bbe5ad600027842cf52300", @ANYRES32=0x0, @ANYRESDEC=0x0, @ANYRES64=r0, @ANYRES16=r0], 0x50}, 0x1, 0x0, 0x0, 0x13d33d22c8a65c15}, 0x4008840) getsockopt$inet_sctp6_SCTP_NODELAY(r0, 0x84, 0x3, &(0x7f0000000280), &(0x7f00000002c0)=0x4) mkdirat(0xffffffffffffff9c, &(0x7f0000000040)='./mnt\x00', 0x1ff) mount$nfs(&(0x7f0000000080)=':27.0.0.1:/export\x00', &(0x7f00000000c0)='./mnt\x00', &(0x7f0000000180), 0x20800, &(0x7f0000000140)=ANY=[@ANYRES16=r0]) r1 = socket$inet6_icmp_raw(0xa, 0x3, 0x3a) bind$inet6(r1, &(0x7f00000001c0)={0xa, 0x4e20, 0xfffffffb, @empty, 0x2}, 0x1c) sendmmsg(r0, &(0x7f0000000000), 0x4000000000001f2, 0x0) r2 = socket$inet6_sctp(0xa, 0x1, 0x84) r3 = dup(r2) setsockopt$inet_sctp6_SCTP_SOCKOPT_BINDX_ADD(r3, 0x84, 0x64, &(0x7f0000000040)=[@in6={0xa, 0x4e24, 0x6, @loopback, 0x3}], 0x1c) getsockopt$inet_sctp_SCTP_GET_ASSOC_STATS(r3, 0x84, 0x70, &(0x7f0000000680)={0x0, @in6={{0xa, 0x4e22, 0x1, @ipv4={'\x00', '\xff\xff', @multicast1}, 0x8}}, [0xfffffffffffffffa, 0x3, 0x7, 0x3, 0x4, 0x3, 0xc, 0x8, 0x3, 0x5, 0x7, 0x100000000, 0x6, 0x2, 0x6]}, &(0x7f00000007c0)=0x100) r4 = socket$packet(0x11, 0x2, 0x300) r5 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r5, 0x8933, &(0x7f0000000040)={'ip6gretap0\x00', 0x0}) sendto$packet(r4, 0x0, 0x0, 0x0, &(0x7f0000000400)={0x11, 0x88a8, r6, 0x1, 0x0, 0x6, @local}, 0x14) r7 = openat$selinux_checkreqprot(0xffffffffffffff9c, &(0x7f0000000200), 0xa00, 0x0) io_uring_register$IORING_REGISTER_FILES(r3, 0x2, &(0x7f0000000240)=[r0, r0, r7, r0, r0, r0, r0], 0x7) executing program 4: r0 = syz_open_dev$dri(&(0x7f0000000000), 0x0, 0x0) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r0, 0xc02064b2, &(0x7f0000000040)={0x1, 0xd00, 0x6}) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r0, 0xc02064b2, &(0x7f0000000100)={0x1, 0x3, 0x9}) ioctl$DRM_IOCTL_PANTHOR_VM_CREATE(r0, 0xc0106441, &(0x7f0000000080)={0x0, 0x0, 0xffffffffffffffff}) socket$kcm(0xa, 0x2, 0x0) socket$nl_route(0x10, 0x3, 0x0) r1 = socket(0x10, 0x3, 0x0) getsockname$packet(r1, &(0x7f00000002c0)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000100)=0x14) sendmsg$nl_route(0xffffffffffffffff, &(0x7f0000000040)={0x0, 0x0, 0x0}, 0x0) sendmsg$IPSET_CMD_ADD(0xffffffffffffffff, 0x0, 0x0) sendmsg$IPSET_CMD_TEST(0xffffffffffffffff, &(0x7f0000000280)={0x0, 0x0, &(0x7f00000002c0)={&(0x7f0000000300)={0x48, 0xb, 0x6, 0x1, 0x0, 0x0, {0x2}, [@IPSET_ATTR_SETNAME={0x9, 0x2, 'syz1\x00'}, @IPSET_ATTR_DATA={0x28, 0x7, 0x0, 0x1, [@IPSET_ATTR_IP={0xc, 0x1, 0x0, 0x1, @IPSET_ATTR_IPADDR_IPV4={0x8, 0x1, 0x1, 0x0, @local}}, @IPSET_ATTR_PORT={0x6, 0x4, 0x1, 0x0, 0x5000}, @IPSET_ATTR_MARK={0x8, 0xa, 0x1, 0x0, 0xc}, @IPSET_ATTR_CIDR2={0x5, 0x15, 0x18}]}]}, 0x48}}, 0x0) socket$inet6_udp(0xa, 0x2, 0x0) socket(0x10, 0x803, 0x0) socket(0x10, 0x3, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./config\x00', 0x1ff) mount(0x0, &(0x7f0000000000)='./config\x00', &(0x7f0000000080)='configfs\x00', 0x0, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000140)='./config/usb_gadget/g1\x00', 0xbf) mkdirat(0xffffffffffffff9c, &(0x7f00000001c0)='./config/usb_gadget/g1/functions/uvc.0\x00', 0x1ff) mkdirat(0xffffffffffffff9c, &(0x7f0000000280)='./config/usb_gadget/g1/functions/uvc.0/streaming/mjpeg/m1\x00', 0x1ff) r2 = openat(0xffffffffffffff9c, &(0x7f00000002c0)='./config/usb_gadget/g1/functions/uvc.0/streaming/mjpeg/m1/bmaControls\x00', 0x2, 0x0) write(r2, &(0x7f0000000640)='12', 0x2) write$P9_RVERSION(r2, &(0x7f0000000180)={0x13, 0x65, 0xffff, 0x1017, 0xffffffffffffff96, '9P2000.L'}, 0x13) syz_usb_connect$midi(0x0, 0x4f, &(0x7f0000000280)=ANY=[], 0x0) r3 = socket$nl_route(0x10, 0x3, 0x0) ioctl$ifreq_SIOCGIFINDEX_vcan(r3, 0x8933, &(0x7f0000000040)={'vxcan0\x00'}) getuid() r4 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPSET_CMD_CREATE(r4, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000200)=ANY=[@ANYBLOB="600000000206010800000000000000000000000005000400000000000900020073797a31000000001400078008001240000000000500140008000000050005000a000000050001000600000011000300686173683a69702c706f7274"], 0x60}}, 0x24000800) r5 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPSET_CMD_ADD(r5, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000240)={&(0x7f0000000c80)=ANY=[@ANYBLOB="5c000000090601080000000000000000070000000900020073797a31000000000500010007000000340007801800018014000240fe8000000000000000000000000000bb060004400e1f00cd050007008800000006000540"], 0x5c}, 0x1, 0x0, 0x0, 0x10000042}, 0x90) program did not crash testing program (duration=2m31.5s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): [0, 10, 19, 30] detailed listing: executing program 3: executing program 0: mkdirat(0xffffffffffffff9c, &(0x7f0000000100)='./gadget\x00', 0x1ff) r0 = openat(0xffffffffffffff9c, &(0x7f00000001c0)='./gadget/dummy_udc\x00', 0x2, 0x0) mprotect(&(0x7f0000362000/0x2000)=nil, 0x2000, 0x1) write(r0, &(0x7f0000000200)="000000000902190001010080320904000001ff000000070581024000000902190001010080320904000001ff00000007058102000200120100020000004034127856000100000001", 0x48) write(0xffffffffffffffff, &(0x7f00000005c0)="010000000705810240000007058102000200", 0x12) ioctl$sock_SIOCGIFINDEX(0xffffffffffffffff, 0x8933, &(0x7f0000000040)={'bridge0\x00'}) write$P9_RRENAME(0xffffffffffffffff, 0x0, 0x0) mmap(&(0x7f0000362000/0x4000)=nil, 0x4000, 0x0, 0x12, 0xffffffffffffffff, 0xfffff000) r1 = syz_clone(0x21000200, 0x0, 0x0, 0x0, 0x0, 0x0) rt_tgsigqueueinfo(r1, r1, 0x8, 0x0) executing program 8: r0 = socket(0x10, 0x3, 0x0) sendmsg$nl_route(0xffffffffffffffff, &(0x7f0000000300)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000100)=ANY=[@ANYBLOB="4800e80010000d0428bd7000fcdbff2500008000", @ANYRES32=r0, @ANYBLOB="1000000000000000280012800b00010062726964676500001800028005001900840000000c001e"], 0x48}}, 0x4084) sendmsg$nl_route(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000080)={&(0x7f00000001c0)=ANY=[@ANYBLOB="500000001000010425bbe5ad600027842cf52300", @ANYRES32=0x0, @ANYRESDEC=0x0, @ANYRES64=r0, @ANYRES16=r0], 0x50}, 0x1, 0x0, 0x0, 0x13d33d22c8a65c15}, 0x4008840) getsockopt$inet_sctp6_SCTP_NODELAY(r0, 0x84, 0x3, &(0x7f0000000280), &(0x7f00000002c0)=0x4) mkdirat(0xffffffffffffff9c, &(0x7f0000000040)='./mnt\x00', 0x1ff) mount$nfs(&(0x7f0000000080)=':27.0.0.1:/export\x00', &(0x7f00000000c0)='./mnt\x00', &(0x7f0000000180), 0x20800, &(0x7f0000000140)=ANY=[@ANYRES16=r0]) r1 = socket$inet6_icmp_raw(0xa, 0x3, 0x3a) bind$inet6(r1, &(0x7f00000001c0)={0xa, 0x4e20, 0xfffffffb, @empty, 0x2}, 0x1c) sendmmsg(r0, &(0x7f0000000000), 0x4000000000001f2, 0x0) r2 = socket$inet6_sctp(0xa, 0x1, 0x84) r3 = dup(r2) setsockopt$inet_sctp6_SCTP_SOCKOPT_BINDX_ADD(r3, 0x84, 0x64, &(0x7f0000000040)=[@in6={0xa, 0x4e24, 0x6, @loopback, 0x3}], 0x1c) getsockopt$inet_sctp_SCTP_GET_ASSOC_STATS(r3, 0x84, 0x70, &(0x7f0000000680)={0x0, @in6={{0xa, 0x4e22, 0x1, @ipv4={'\x00', '\xff\xff', @multicast1}, 0x8}}, [0xfffffffffffffffa, 0x3, 0x7, 0x3, 0x4, 0x3, 0xc, 0x8, 0x3, 0x5, 0x7, 0x100000000, 0x6, 0x2, 0x6]}, &(0x7f00000007c0)=0x100) r4 = socket$packet(0x11, 0x2, 0x300) r5 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r5, 0x8933, &(0x7f0000000040)={'ip6gretap0\x00', 0x0}) sendto$packet(r4, 0x0, 0x0, 0x0, &(0x7f0000000400)={0x11, 0x88a8, r6, 0x1, 0x0, 0x6, @local}, 0x14) r7 = openat$selinux_checkreqprot(0xffffffffffffff9c, &(0x7f0000000200), 0xa00, 0x0) io_uring_register$IORING_REGISTER_FILES(r3, 0x2, &(0x7f0000000240)=[r0, r0, r7, r0, r0, r0, r0], 0x7) executing program 4: r0 = syz_open_dev$dri(&(0x7f0000000000), 0x0, 0x0) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r0, 0xc02064b2, &(0x7f0000000040)={0x1, 0xd00, 0x6}) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r0, 0xc02064b2, &(0x7f0000000100)={0x1, 0x3, 0x9}) ioctl$DRM_IOCTL_PANTHOR_VM_CREATE(r0, 0xc0106441, &(0x7f0000000080)={0x0, 0x0, 0xffffffffffffffff}) socket$kcm(0xa, 0x2, 0x0) socket$nl_route(0x10, 0x3, 0x0) r1 = socket(0x10, 0x3, 0x0) getsockname$packet(r1, &(0x7f00000002c0)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000100)=0x14) sendmsg$nl_route(0xffffffffffffffff, &(0x7f0000000040)={0x0, 0x0, 0x0}, 0x0) sendmsg$IPSET_CMD_ADD(0xffffffffffffffff, 0x0, 0x0) sendmsg$IPSET_CMD_TEST(0xffffffffffffffff, &(0x7f0000000280)={0x0, 0x0, &(0x7f00000002c0)={&(0x7f0000000300)={0x48, 0xb, 0x6, 0x1, 0x0, 0x0, {0x2}, [@IPSET_ATTR_SETNAME={0x9, 0x2, 'syz1\x00'}, @IPSET_ATTR_DATA={0x28, 0x7, 0x0, 0x1, [@IPSET_ATTR_IP={0xc, 0x1, 0x0, 0x1, @IPSET_ATTR_IPADDR_IPV4={0x8, 0x1, 0x1, 0x0, @local}}, @IPSET_ATTR_PORT={0x6, 0x4, 0x1, 0x0, 0x5000}, @IPSET_ATTR_MARK={0x8, 0xa, 0x1, 0x0, 0xc}, @IPSET_ATTR_CIDR2={0x5, 0x15, 0x18}]}]}, 0x48}}, 0x0) socket$inet6_udp(0xa, 0x2, 0x0) socket(0x10, 0x803, 0x0) socket(0x10, 0x3, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./config\x00', 0x1ff) mount(0x0, &(0x7f0000000000)='./config\x00', &(0x7f0000000080)='configfs\x00', 0x0, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000140)='./config/usb_gadget/g1\x00', 0xbf) mkdirat(0xffffffffffffff9c, &(0x7f00000001c0)='./config/usb_gadget/g1/functions/uvc.0\x00', 0x1ff) mkdirat(0xffffffffffffff9c, &(0x7f0000000280)='./config/usb_gadget/g1/functions/uvc.0/streaming/mjpeg/m1\x00', 0x1ff) r2 = openat(0xffffffffffffff9c, &(0x7f00000002c0)='./config/usb_gadget/g1/functions/uvc.0/streaming/mjpeg/m1/bmaControls\x00', 0x2, 0x0) write(r2, &(0x7f0000000640)='12', 0x2) write$P9_RVERSION(r2, &(0x7f0000000180)={0x13, 0x65, 0xffff, 0x1017, 0xffffffffffffff96, '9P2000.L'}, 0x13) syz_usb_connect$midi(0x0, 0x4f, &(0x7f0000000280)=ANY=[], 0x0) r3 = socket$nl_route(0x10, 0x3, 0x0) ioctl$ifreq_SIOCGIFINDEX_vcan(r3, 0x8933, &(0x7f0000000040)={'vxcan0\x00'}) getuid() r4 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPSET_CMD_CREATE(r4, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000200)=ANY=[@ANYBLOB="600000000206010800000000000000000000000005000400000000000900020073797a31000000001400078008001240000000000500140008000000050005000a000000050001000600000011000300686173683a69702c706f7274"], 0x60}}, 0x24000800) r5 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPSET_CMD_ADD(r5, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000240)={&(0x7f0000000c80)=ANY=[@ANYBLOB="5c000000090601080000000000000000070000000900020073797a31000000000500010007000000340007801800018014000240fe8000000000000000000000000000bb060004400e1f00cd050007008800000006000540"], 0x5c}, 0x1, 0x0, 0x0, 0x10000042}, 0x90) program did not crash testing program (duration=2m31.5s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): [0, 10, 19, 30] detailed listing: executing program 3: executing program 0: mount(0x0, &(0x7f0000000140)='./gadget\x00', &(0x7f0000000180)='gadgetfs\x00', 0x0, 0x0) r0 = openat(0xffffffffffffff9c, &(0x7f00000001c0)='./gadget/dummy_udc\x00', 0x2, 0x0) mprotect(&(0x7f0000362000/0x2000)=nil, 0x2000, 0x1) write(r0, &(0x7f0000000200)="000000000902190001010080320904000001ff000000070581024000000902190001010080320904000001ff00000007058102000200120100020000004034127856000100000001", 0x48) write(0xffffffffffffffff, &(0x7f00000005c0)="010000000705810240000007058102000200", 0x12) ioctl$sock_SIOCGIFINDEX(0xffffffffffffffff, 0x8933, &(0x7f0000000040)={'bridge0\x00'}) write$P9_RRENAME(0xffffffffffffffff, 0x0, 0x0) mmap(&(0x7f0000362000/0x4000)=nil, 0x4000, 0x0, 0x12, 0xffffffffffffffff, 0xfffff000) r1 = syz_clone(0x21000200, 0x0, 0x0, 0x0, 0x0, 0x0) rt_tgsigqueueinfo(r1, r1, 0x8, 0x0) executing program 8: r0 = socket(0x10, 0x3, 0x0) sendmsg$nl_route(0xffffffffffffffff, &(0x7f0000000300)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000100)=ANY=[@ANYBLOB="4800e80010000d0428bd7000fcdbff2500008000", @ANYRES32=r0, @ANYBLOB="1000000000000000280012800b00010062726964676500001800028005001900840000000c001e"], 0x48}}, 0x4084) sendmsg$nl_route(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000080)={&(0x7f00000001c0)=ANY=[@ANYBLOB="500000001000010425bbe5ad600027842cf52300", @ANYRES32=0x0, @ANYRESDEC=0x0, @ANYRES64=r0, @ANYRES16=r0], 0x50}, 0x1, 0x0, 0x0, 0x13d33d22c8a65c15}, 0x4008840) getsockopt$inet_sctp6_SCTP_NODELAY(r0, 0x84, 0x3, &(0x7f0000000280), &(0x7f00000002c0)=0x4) mkdirat(0xffffffffffffff9c, &(0x7f0000000040)='./mnt\x00', 0x1ff) mount$nfs(&(0x7f0000000080)=':27.0.0.1:/export\x00', &(0x7f00000000c0)='./mnt\x00', &(0x7f0000000180), 0x20800, &(0x7f0000000140)=ANY=[@ANYRES16=r0]) r1 = socket$inet6_icmp_raw(0xa, 0x3, 0x3a) bind$inet6(r1, &(0x7f00000001c0)={0xa, 0x4e20, 0xfffffffb, @empty, 0x2}, 0x1c) sendmmsg(r0, &(0x7f0000000000), 0x4000000000001f2, 0x0) r2 = socket$inet6_sctp(0xa, 0x1, 0x84) r3 = dup(r2) setsockopt$inet_sctp6_SCTP_SOCKOPT_BINDX_ADD(r3, 0x84, 0x64, &(0x7f0000000040)=[@in6={0xa, 0x4e24, 0x6, @loopback, 0x3}], 0x1c) getsockopt$inet_sctp_SCTP_GET_ASSOC_STATS(r3, 0x84, 0x70, &(0x7f0000000680)={0x0, @in6={{0xa, 0x4e22, 0x1, @ipv4={'\x00', '\xff\xff', @multicast1}, 0x8}}, [0xfffffffffffffffa, 0x3, 0x7, 0x3, 0x4, 0x3, 0xc, 0x8, 0x3, 0x5, 0x7, 0x100000000, 0x6, 0x2, 0x6]}, &(0x7f00000007c0)=0x100) r4 = socket$packet(0x11, 0x2, 0x300) r5 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r5, 0x8933, &(0x7f0000000040)={'ip6gretap0\x00', 0x0}) sendto$packet(r4, 0x0, 0x0, 0x0, &(0x7f0000000400)={0x11, 0x88a8, r6, 0x1, 0x0, 0x6, @local}, 0x14) r7 = openat$selinux_checkreqprot(0xffffffffffffff9c, &(0x7f0000000200), 0xa00, 0x0) io_uring_register$IORING_REGISTER_FILES(r3, 0x2, &(0x7f0000000240)=[r0, r0, r7, r0, r0, r0, r0], 0x7) executing program 4: r0 = syz_open_dev$dri(&(0x7f0000000000), 0x0, 0x0) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r0, 0xc02064b2, &(0x7f0000000040)={0x1, 0xd00, 0x6}) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r0, 0xc02064b2, &(0x7f0000000100)={0x1, 0x3, 0x9}) ioctl$DRM_IOCTL_PANTHOR_VM_CREATE(r0, 0xc0106441, &(0x7f0000000080)={0x0, 0x0, 0xffffffffffffffff}) socket$kcm(0xa, 0x2, 0x0) socket$nl_route(0x10, 0x3, 0x0) r1 = socket(0x10, 0x3, 0x0) getsockname$packet(r1, &(0x7f00000002c0)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000100)=0x14) sendmsg$nl_route(0xffffffffffffffff, &(0x7f0000000040)={0x0, 0x0, 0x0}, 0x0) sendmsg$IPSET_CMD_ADD(0xffffffffffffffff, 0x0, 0x0) sendmsg$IPSET_CMD_TEST(0xffffffffffffffff, &(0x7f0000000280)={0x0, 0x0, &(0x7f00000002c0)={&(0x7f0000000300)={0x48, 0xb, 0x6, 0x1, 0x0, 0x0, {0x2}, [@IPSET_ATTR_SETNAME={0x9, 0x2, 'syz1\x00'}, @IPSET_ATTR_DATA={0x28, 0x7, 0x0, 0x1, [@IPSET_ATTR_IP={0xc, 0x1, 0x0, 0x1, @IPSET_ATTR_IPADDR_IPV4={0x8, 0x1, 0x1, 0x0, @local}}, @IPSET_ATTR_PORT={0x6, 0x4, 0x1, 0x0, 0x5000}, @IPSET_ATTR_MARK={0x8, 0xa, 0x1, 0x0, 0xc}, @IPSET_ATTR_CIDR2={0x5, 0x15, 0x18}]}]}, 0x48}}, 0x0) socket$inet6_udp(0xa, 0x2, 0x0) socket(0x10, 0x803, 0x0) socket(0x10, 0x3, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./config\x00', 0x1ff) mount(0x0, &(0x7f0000000000)='./config\x00', &(0x7f0000000080)='configfs\x00', 0x0, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000140)='./config/usb_gadget/g1\x00', 0xbf) mkdirat(0xffffffffffffff9c, &(0x7f00000001c0)='./config/usb_gadget/g1/functions/uvc.0\x00', 0x1ff) mkdirat(0xffffffffffffff9c, &(0x7f0000000280)='./config/usb_gadget/g1/functions/uvc.0/streaming/mjpeg/m1\x00', 0x1ff) r2 = openat(0xffffffffffffff9c, &(0x7f00000002c0)='./config/usb_gadget/g1/functions/uvc.0/streaming/mjpeg/m1/bmaControls\x00', 0x2, 0x0) write(r2, &(0x7f0000000640)='12', 0x2) write$P9_RVERSION(r2, &(0x7f0000000180)={0x13, 0x65, 0xffff, 0x1017, 0xffffffffffffff96, '9P2000.L'}, 0x13) syz_usb_connect$midi(0x0, 0x4f, &(0x7f0000000280)=ANY=[], 0x0) r3 = socket$nl_route(0x10, 0x3, 0x0) ioctl$ifreq_SIOCGIFINDEX_vcan(r3, 0x8933, &(0x7f0000000040)={'vxcan0\x00'}) getuid() r4 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPSET_CMD_CREATE(r4, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000200)=ANY=[@ANYBLOB="600000000206010800000000000000000000000005000400000000000900020073797a31000000001400078008001240000000000500140008000000050005000a000000050001000600000011000300686173683a69702c706f7274"], 0x60}}, 0x24000800) r5 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPSET_CMD_ADD(r5, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000240)={&(0x7f0000000c80)=ANY=[@ANYBLOB="5c000000090601080000000000000000070000000900020073797a31000000000500010007000000340007801800018014000240fe8000000000000000000000000000bb060004400e1f00cd050007008800000006000540"], 0x5c}, 0x1, 0x0, 0x0, 0x10000042}, 0x90) program did not crash minimized 30 calls -> 11 calls minimizing program #2 before concatenation testing program (duration=2m31.5s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): [0, 11, 18, 30] detailed listing: executing program 3: executing program 3: mkdirat(0xffffffffffffff9c, &(0x7f0000000100)='./gadget\x00', 0x1ff) mount(0x0, &(0x7f0000000140)='./gadget\x00', &(0x7f0000000180)='gadgetfs\x00', 0x0, 0x0) r0 = openat(0xffffffffffffff9c, &(0x7f00000001c0)='./gadget/dummy_udc\x00', 0x2, 0x0) mprotect(&(0x7f0000362000/0x2000)=nil, 0x2000, 0x1) write(r0, &(0x7f0000000200)="000000000902190001010080320904000001ff000000070581024000000902190001010080320904000001ff00000007058102000200120100020000004034127856000100000001", 0x48) write(0xffffffffffffffff, &(0x7f00000005c0)="010000000705810240000007058102000200", 0x12) ioctl$sock_SIOCGIFINDEX(0xffffffffffffffff, 0x8933, &(0x7f0000000040)={'bridge0\x00'}) write$P9_RRENAME(0xffffffffffffffff, 0x0, 0x0) mmap(&(0x7f0000362000/0x4000)=nil, 0x4000, 0x0, 0x12, 0xffffffffffffffff, 0xfffff000) r1 = syz_clone(0x21000200, 0x0, 0x0, 0x0, 0x0, 0x0) rt_tgsigqueueinfo(r1, r1, 0x8, 0x0) executing program 0: r0 = socket(0x10, 0x3, 0x0) sendmsg$nl_route(0xffffffffffffffff, &(0x7f0000000300)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000100)=ANY=[@ANYBLOB="4800e80010000d0428bd7000fcdbff2500008000", @ANYRES32=r0, @ANYBLOB="1000000000000000280012800b00010062726964676500001800028005001900840000000c001e"], 0x48}}, 0x4084) sendmsg$nl_route(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000080)={&(0x7f00000001c0)=ANY=[@ANYBLOB="500000001000010425bbe5ad600027842cf52300", @ANYRES32=0x0, @ANYRESDEC=0x0, @ANYRES64=r0, @ANYRES16=r0], 0x50}, 0x1, 0x0, 0x0, 0x13d33d22c8a65c15}, 0x4008840) getsockopt$inet_sctp6_SCTP_NODELAY(r0, 0x84, 0x3, &(0x7f0000000280), &(0x7f00000002c0)=0x4) mkdirat(0xffffffffffffff9c, &(0x7f0000000040)='./mnt\x00', 0x1ff) mount$nfs(&(0x7f0000000080)=':27.0.0.1:/export\x00', &(0x7f00000000c0)='./mnt\x00', &(0x7f0000000180), 0x20800, &(0x7f0000000140)=ANY=[@ANYRES16=r0]) r1 = socket$inet6_icmp_raw(0xa, 0x3, 0x3a) bind$inet6(r1, &(0x7f00000001c0)={0xa, 0x4e20, 0xfffffffb, @empty, 0x2}, 0x1c) sendmmsg(r0, &(0x7f0000000000), 0x4000000000001f2, 0x0) r2 = socket$inet6_sctp(0xa, 0x1, 0x84) r3 = dup(r2) setsockopt$inet_sctp6_SCTP_SOCKOPT_BINDX_ADD(r3, 0x84, 0x64, &(0x7f0000000040)=[@in6={0xa, 0x4e24, 0x6, @loopback, 0x3}], 0x1c) getsockopt$inet_sctp_SCTP_GET_ASSOC_STATS(r3, 0x84, 0x70, &(0x7f0000000680)={0x0, @in6={{0xa, 0x4e22, 0x1, @ipv4={'\x00', '\xff\xff', @multicast1}, 0x8}}, [0xfffffffffffffffa, 0x3, 0x7, 0x3, 0x4, 0x3, 0xc, 0x8, 0x3, 0x5, 0x7, 0x100000000, 0x6, 0x2, 0x6]}, &(0x7f00000007c0)=0x100) r4 = socket$packet(0x11, 0x2, 0x300) r5 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r5, 0x8933, &(0x7f0000000040)={'ip6gretap0\x00', 0x0}) sendto$packet(r4, 0x0, 0x0, 0x0, &(0x7f0000000400)={0x11, 0x88a8, r6, 0x1, 0x0, 0x6, @local}, 0x14) openat$selinux_checkreqprot(0xffffffffffffff9c, &(0x7f0000000200), 0xa00, 0x0) executing program 4: r0 = syz_open_dev$dri(&(0x7f0000000000), 0x0, 0x0) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r0, 0xc02064b2, &(0x7f0000000040)={0x1, 0xd00, 0x6}) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r0, 0xc02064b2, &(0x7f0000000100)={0x1, 0x3, 0x9}) ioctl$DRM_IOCTL_PANTHOR_VM_CREATE(r0, 0xc0106441, &(0x7f0000000080)={0x0, 0x0, 0xffffffffffffffff}) socket$kcm(0xa, 0x2, 0x0) socket$nl_route(0x10, 0x3, 0x0) r1 = socket(0x10, 0x3, 0x0) getsockname$packet(r1, &(0x7f00000002c0)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000100)=0x14) sendmsg$nl_route(0xffffffffffffffff, &(0x7f0000000040)={0x0, 0x0, 0x0}, 0x0) sendmsg$IPSET_CMD_ADD(0xffffffffffffffff, 0x0, 0x0) sendmsg$IPSET_CMD_TEST(0xffffffffffffffff, &(0x7f0000000280)={0x0, 0x0, &(0x7f00000002c0)={&(0x7f0000000300)={0x48, 0xb, 0x6, 0x1, 0x0, 0x0, {0x2}, [@IPSET_ATTR_SETNAME={0x9, 0x2, 'syz1\x00'}, @IPSET_ATTR_DATA={0x28, 0x7, 0x0, 0x1, [@IPSET_ATTR_IP={0xc, 0x1, 0x0, 0x1, @IPSET_ATTR_IPADDR_IPV4={0x8, 0x1, 0x1, 0x0, @local}}, @IPSET_ATTR_PORT={0x6, 0x4, 0x1, 0x0, 0x5000}, @IPSET_ATTR_MARK={0x8, 0xa, 0x1, 0x0, 0xc}, @IPSET_ATTR_CIDR2={0x5, 0x15, 0x18}]}]}, 0x48}}, 0x0) socket$inet6_udp(0xa, 0x2, 0x0) socket(0x10, 0x803, 0x0) socket(0x10, 0x3, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./config\x00', 0x1ff) mount(0x0, &(0x7f0000000000)='./config\x00', &(0x7f0000000080)='configfs\x00', 0x0, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000140)='./config/usb_gadget/g1\x00', 0xbf) mkdirat(0xffffffffffffff9c, &(0x7f00000001c0)='./config/usb_gadget/g1/functions/uvc.0\x00', 0x1ff) mkdirat(0xffffffffffffff9c, &(0x7f0000000280)='./config/usb_gadget/g1/functions/uvc.0/streaming/mjpeg/m1\x00', 0x1ff) r2 = openat(0xffffffffffffff9c, &(0x7f00000002c0)='./config/usb_gadget/g1/functions/uvc.0/streaming/mjpeg/m1/bmaControls\x00', 0x2, 0x0) write(r2, &(0x7f0000000640)='12', 0x2) write$P9_RVERSION(r2, &(0x7f0000000180)={0x13, 0x65, 0xffff, 0x1017, 0xffffffffffffff96, '9P2000.L'}, 0x13) syz_usb_connect$midi(0x0, 0x4f, &(0x7f0000000280)=ANY=[], 0x0) r3 = socket$nl_route(0x10, 0x3, 0x0) ioctl$ifreq_SIOCGIFINDEX_vcan(r3, 0x8933, &(0x7f0000000040)={'vxcan0\x00'}) getuid() r4 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPSET_CMD_CREATE(r4, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000200)=ANY=[@ANYBLOB="600000000206010800000000000000000000000005000400000000000900020073797a31000000001400078008001240000000000500140008000000050005000a000000050001000600000011000300686173683a69702c706f7274"], 0x60}}, 0x24000800) r5 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPSET_CMD_ADD(r5, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000240)={&(0x7f0000000c80)=ANY=[@ANYBLOB="5c000000090601080000000000000000070000000900020073797a31000000000500010007000000340007801800018014000240fe8000000000000000000000000000bb060004400e1f00cd050007008800000006000540"], 0x5c}, 0x1, 0x0, 0x0, 0x10000042}, 0x90) program crashed: KASAN: slab-use-after-free Read in ep_open testing program (duration=2m31.5s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): [0, 11, 17, 30] detailed listing: executing program 3: executing program 3: mkdirat(0xffffffffffffff9c, &(0x7f0000000100)='./gadget\x00', 0x1ff) mount(0x0, &(0x7f0000000140)='./gadget\x00', &(0x7f0000000180)='gadgetfs\x00', 0x0, 0x0) r0 = openat(0xffffffffffffff9c, &(0x7f00000001c0)='./gadget/dummy_udc\x00', 0x2, 0x0) mprotect(&(0x7f0000362000/0x2000)=nil, 0x2000, 0x1) write(r0, &(0x7f0000000200)="000000000902190001010080320904000001ff000000070581024000000902190001010080320904000001ff00000007058102000200120100020000004034127856000100000001", 0x48) write(0xffffffffffffffff, &(0x7f00000005c0)="010000000705810240000007058102000200", 0x12) ioctl$sock_SIOCGIFINDEX(0xffffffffffffffff, 0x8933, &(0x7f0000000040)={'bridge0\x00'}) write$P9_RRENAME(0xffffffffffffffff, 0x0, 0x0) mmap(&(0x7f0000362000/0x4000)=nil, 0x4000, 0x0, 0x12, 0xffffffffffffffff, 0xfffff000) r1 = syz_clone(0x21000200, 0x0, 0x0, 0x0, 0x0, 0x0) rt_tgsigqueueinfo(r1, r1, 0x8, 0x0) executing program 0: r0 = socket(0x10, 0x3, 0x0) sendmsg$nl_route(0xffffffffffffffff, &(0x7f0000000300)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000100)=ANY=[@ANYBLOB="4800e80010000d0428bd7000fcdbff2500008000", @ANYRES32=r0, @ANYBLOB="1000000000000000280012800b00010062726964676500001800028005001900840000000c001e"], 0x48}}, 0x4084) sendmsg$nl_route(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000080)={&(0x7f00000001c0)=ANY=[@ANYBLOB="500000001000010425bbe5ad600027842cf52300", @ANYRES32=0x0, @ANYRESDEC=0x0, @ANYRES64=r0, @ANYRES16=r0], 0x50}, 0x1, 0x0, 0x0, 0x13d33d22c8a65c15}, 0x4008840) getsockopt$inet_sctp6_SCTP_NODELAY(r0, 0x84, 0x3, &(0x7f0000000280), &(0x7f00000002c0)=0x4) mkdirat(0xffffffffffffff9c, &(0x7f0000000040)='./mnt\x00', 0x1ff) mount$nfs(&(0x7f0000000080)=':27.0.0.1:/export\x00', &(0x7f00000000c0)='./mnt\x00', &(0x7f0000000180), 0x20800, &(0x7f0000000140)=ANY=[@ANYRES16=r0]) r1 = socket$inet6_icmp_raw(0xa, 0x3, 0x3a) bind$inet6(r1, &(0x7f00000001c0)={0xa, 0x4e20, 0xfffffffb, @empty, 0x2}, 0x1c) sendmmsg(r0, &(0x7f0000000000), 0x4000000000001f2, 0x0) r2 = socket$inet6_sctp(0xa, 0x1, 0x84) r3 = dup(r2) setsockopt$inet_sctp6_SCTP_SOCKOPT_BINDX_ADD(r3, 0x84, 0x64, &(0x7f0000000040)=[@in6={0xa, 0x4e24, 0x6, @loopback, 0x3}], 0x1c) getsockopt$inet_sctp_SCTP_GET_ASSOC_STATS(r3, 0x84, 0x70, &(0x7f0000000680)={0x0, @in6={{0xa, 0x4e22, 0x1, @ipv4={'\x00', '\xff\xff', @multicast1}, 0x8}}, [0xfffffffffffffffa, 0x3, 0x7, 0x3, 0x4, 0x3, 0xc, 0x8, 0x3, 0x5, 0x7, 0x100000000, 0x6, 0x2, 0x6]}, &(0x7f00000007c0)=0x100) r4 = socket$packet(0x11, 0x2, 0x300) r5 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r5, 0x8933, &(0x7f0000000040)={'ip6gretap0\x00', 0x0}) sendto$packet(r4, 0x0, 0x0, 0x0, &(0x7f0000000400)={0x11, 0x88a8, r6, 0x1, 0x0, 0x6, @local}, 0x14) executing program 4: r0 = syz_open_dev$dri(&(0x7f0000000000), 0x0, 0x0) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r0, 0xc02064b2, &(0x7f0000000040)={0x1, 0xd00, 0x6}) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r0, 0xc02064b2, &(0x7f0000000100)={0x1, 0x3, 0x9}) ioctl$DRM_IOCTL_PANTHOR_VM_CREATE(r0, 0xc0106441, &(0x7f0000000080)={0x0, 0x0, 0xffffffffffffffff}) socket$kcm(0xa, 0x2, 0x0) socket$nl_route(0x10, 0x3, 0x0) r1 = socket(0x10, 0x3, 0x0) getsockname$packet(r1, &(0x7f00000002c0)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000100)=0x14) sendmsg$nl_route(0xffffffffffffffff, &(0x7f0000000040)={0x0, 0x0, 0x0}, 0x0) sendmsg$IPSET_CMD_ADD(0xffffffffffffffff, 0x0, 0x0) sendmsg$IPSET_CMD_TEST(0xffffffffffffffff, &(0x7f0000000280)={0x0, 0x0, &(0x7f00000002c0)={&(0x7f0000000300)={0x48, 0xb, 0x6, 0x1, 0x0, 0x0, {0x2}, [@IPSET_ATTR_SETNAME={0x9, 0x2, 'syz1\x00'}, @IPSET_ATTR_DATA={0x28, 0x7, 0x0, 0x1, [@IPSET_ATTR_IP={0xc, 0x1, 0x0, 0x1, @IPSET_ATTR_IPADDR_IPV4={0x8, 0x1, 0x1, 0x0, @local}}, @IPSET_ATTR_PORT={0x6, 0x4, 0x1, 0x0, 0x5000}, @IPSET_ATTR_MARK={0x8, 0xa, 0x1, 0x0, 0xc}, @IPSET_ATTR_CIDR2={0x5, 0x15, 0x18}]}]}, 0x48}}, 0x0) socket$inet6_udp(0xa, 0x2, 0x0) socket(0x10, 0x803, 0x0) socket(0x10, 0x3, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./config\x00', 0x1ff) mount(0x0, &(0x7f0000000000)='./config\x00', &(0x7f0000000080)='configfs\x00', 0x0, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000140)='./config/usb_gadget/g1\x00', 0xbf) mkdirat(0xffffffffffffff9c, &(0x7f00000001c0)='./config/usb_gadget/g1/functions/uvc.0\x00', 0x1ff) mkdirat(0xffffffffffffff9c, &(0x7f0000000280)='./config/usb_gadget/g1/functions/uvc.0/streaming/mjpeg/m1\x00', 0x1ff) r2 = openat(0xffffffffffffff9c, &(0x7f00000002c0)='./config/usb_gadget/g1/functions/uvc.0/streaming/mjpeg/m1/bmaControls\x00', 0x2, 0x0) write(r2, &(0x7f0000000640)='12', 0x2) write$P9_RVERSION(r2, &(0x7f0000000180)={0x13, 0x65, 0xffff, 0x1017, 0xffffffffffffff96, '9P2000.L'}, 0x13) syz_usb_connect$midi(0x0, 0x4f, &(0x7f0000000280)=ANY=[], 0x0) r3 = socket$nl_route(0x10, 0x3, 0x0) ioctl$ifreq_SIOCGIFINDEX_vcan(r3, 0x8933, &(0x7f0000000040)={'vxcan0\x00'}) getuid() r4 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPSET_CMD_CREATE(r4, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000200)=ANY=[@ANYBLOB="600000000206010800000000000000000000000005000400000000000900020073797a31000000001400078008001240000000000500140008000000050005000a000000050001000600000011000300686173683a69702c706f7274"], 0x60}}, 0x24000800) r5 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPSET_CMD_ADD(r5, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000240)={&(0x7f0000000c80)=ANY=[@ANYBLOB="5c000000090601080000000000000000070000000900020073797a31000000000500010007000000340007801800018014000240fe8000000000000000000000000000bb060004400e1f00cd050007008800000006000540"], 0x5c}, 0x1, 0x0, 0x0, 0x10000042}, 0x90) program crashed: KASAN: slab-use-after-free Read in ep_open testing program (duration=2m31.5s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): [0, 11, 16, 30] detailed listing: executing program 3: executing program 3: mkdirat(0xffffffffffffff9c, &(0x7f0000000100)='./gadget\x00', 0x1ff) mount(0x0, &(0x7f0000000140)='./gadget\x00', &(0x7f0000000180)='gadgetfs\x00', 0x0, 0x0) r0 = openat(0xffffffffffffff9c, &(0x7f00000001c0)='./gadget/dummy_udc\x00', 0x2, 0x0) mprotect(&(0x7f0000362000/0x2000)=nil, 0x2000, 0x1) write(r0, &(0x7f0000000200)="000000000902190001010080320904000001ff000000070581024000000902190001010080320904000001ff00000007058102000200120100020000004034127856000100000001", 0x48) write(0xffffffffffffffff, &(0x7f00000005c0)="010000000705810240000007058102000200", 0x12) ioctl$sock_SIOCGIFINDEX(0xffffffffffffffff, 0x8933, &(0x7f0000000040)={'bridge0\x00'}) write$P9_RRENAME(0xffffffffffffffff, 0x0, 0x0) mmap(&(0x7f0000362000/0x4000)=nil, 0x4000, 0x0, 0x12, 0xffffffffffffffff, 0xfffff000) r1 = syz_clone(0x21000200, 0x0, 0x0, 0x0, 0x0, 0x0) rt_tgsigqueueinfo(r1, r1, 0x8, 0x0) executing program 0: r0 = socket(0x10, 0x3, 0x0) sendmsg$nl_route(0xffffffffffffffff, &(0x7f0000000300)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000100)=ANY=[@ANYBLOB="4800e80010000d0428bd7000fcdbff2500008000", @ANYRES32=r0, @ANYBLOB="1000000000000000280012800b00010062726964676500001800028005001900840000000c001e"], 0x48}}, 0x4084) sendmsg$nl_route(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000080)={&(0x7f00000001c0)=ANY=[@ANYBLOB="500000001000010425bbe5ad600027842cf52300", @ANYRES32=0x0, @ANYRESDEC=0x0, @ANYRES64=r0, @ANYRES16=r0], 0x50}, 0x1, 0x0, 0x0, 0x13d33d22c8a65c15}, 0x4008840) getsockopt$inet_sctp6_SCTP_NODELAY(r0, 0x84, 0x3, &(0x7f0000000280), &(0x7f00000002c0)=0x4) mkdirat(0xffffffffffffff9c, &(0x7f0000000040)='./mnt\x00', 0x1ff) mount$nfs(&(0x7f0000000080)=':27.0.0.1:/export\x00', &(0x7f00000000c0)='./mnt\x00', &(0x7f0000000180), 0x20800, &(0x7f0000000140)=ANY=[@ANYRES16=r0]) r1 = socket$inet6_icmp_raw(0xa, 0x3, 0x3a) bind$inet6(r1, &(0x7f00000001c0)={0xa, 0x4e20, 0xfffffffb, @empty, 0x2}, 0x1c) sendmmsg(r0, &(0x7f0000000000), 0x4000000000001f2, 0x0) r2 = socket$inet6_sctp(0xa, 0x1, 0x84) r3 = dup(r2) setsockopt$inet_sctp6_SCTP_SOCKOPT_BINDX_ADD(r3, 0x84, 0x64, &(0x7f0000000040)=[@in6={0xa, 0x4e24, 0x6, @loopback, 0x3}], 0x1c) getsockopt$inet_sctp_SCTP_GET_ASSOC_STATS(r3, 0x84, 0x70, &(0x7f0000000680)={0x0, @in6={{0xa, 0x4e22, 0x1, @ipv4={'\x00', '\xff\xff', @multicast1}, 0x8}}, [0xfffffffffffffffa, 0x3, 0x7, 0x3, 0x4, 0x3, 0xc, 0x8, 0x3, 0x5, 0x7, 0x100000000, 0x6, 0x2, 0x6]}, &(0x7f00000007c0)=0x100) socket$packet(0x11, 0x2, 0x300) r4 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r4, 0x8933, &(0x7f0000000040)={'ip6gretap0\x00'}) executing program 4: r0 = syz_open_dev$dri(&(0x7f0000000000), 0x0, 0x0) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r0, 0xc02064b2, &(0x7f0000000040)={0x1, 0xd00, 0x6}) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r0, 0xc02064b2, &(0x7f0000000100)={0x1, 0x3, 0x9}) ioctl$DRM_IOCTL_PANTHOR_VM_CREATE(r0, 0xc0106441, &(0x7f0000000080)={0x0, 0x0, 0xffffffffffffffff}) socket$kcm(0xa, 0x2, 0x0) socket$nl_route(0x10, 0x3, 0x0) r1 = socket(0x10, 0x3, 0x0) getsockname$packet(r1, &(0x7f00000002c0)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000100)=0x14) sendmsg$nl_route(0xffffffffffffffff, &(0x7f0000000040)={0x0, 0x0, 0x0}, 0x0) sendmsg$IPSET_CMD_ADD(0xffffffffffffffff, 0x0, 0x0) sendmsg$IPSET_CMD_TEST(0xffffffffffffffff, &(0x7f0000000280)={0x0, 0x0, &(0x7f00000002c0)={&(0x7f0000000300)={0x48, 0xb, 0x6, 0x1, 0x0, 0x0, {0x2}, [@IPSET_ATTR_SETNAME={0x9, 0x2, 'syz1\x00'}, @IPSET_ATTR_DATA={0x28, 0x7, 0x0, 0x1, [@IPSET_ATTR_IP={0xc, 0x1, 0x0, 0x1, @IPSET_ATTR_IPADDR_IPV4={0x8, 0x1, 0x1, 0x0, @local}}, @IPSET_ATTR_PORT={0x6, 0x4, 0x1, 0x0, 0x5000}, @IPSET_ATTR_MARK={0x8, 0xa, 0x1, 0x0, 0xc}, @IPSET_ATTR_CIDR2={0x5, 0x15, 0x18}]}]}, 0x48}}, 0x0) socket$inet6_udp(0xa, 0x2, 0x0) socket(0x10, 0x803, 0x0) socket(0x10, 0x3, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./config\x00', 0x1ff) mount(0x0, &(0x7f0000000000)='./config\x00', &(0x7f0000000080)='configfs\x00', 0x0, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000140)='./config/usb_gadget/g1\x00', 0xbf) mkdirat(0xffffffffffffff9c, &(0x7f00000001c0)='./config/usb_gadget/g1/functions/uvc.0\x00', 0x1ff) mkdirat(0xffffffffffffff9c, &(0x7f0000000280)='./config/usb_gadget/g1/functions/uvc.0/streaming/mjpeg/m1\x00', 0x1ff) r2 = openat(0xffffffffffffff9c, &(0x7f00000002c0)='./config/usb_gadget/g1/functions/uvc.0/streaming/mjpeg/m1/bmaControls\x00', 0x2, 0x0) write(r2, &(0x7f0000000640)='12', 0x2) write$P9_RVERSION(r2, &(0x7f0000000180)={0x13, 0x65, 0xffff, 0x1017, 0xffffffffffffff96, '9P2000.L'}, 0x13) syz_usb_connect$midi(0x0, 0x4f, &(0x7f0000000280)=ANY=[], 0x0) r3 = socket$nl_route(0x10, 0x3, 0x0) ioctl$ifreq_SIOCGIFINDEX_vcan(r3, 0x8933, &(0x7f0000000040)={'vxcan0\x00'}) getuid() r4 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPSET_CMD_CREATE(r4, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000200)=ANY=[@ANYBLOB="600000000206010800000000000000000000000005000400000000000900020073797a31000000001400078008001240000000000500140008000000050005000a000000050001000600000011000300686173683a69702c706f7274"], 0x60}}, 0x24000800) r5 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPSET_CMD_ADD(r5, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000240)={&(0x7f0000000c80)=ANY=[@ANYBLOB="5c000000090601080000000000000000070000000900020073797a31000000000500010007000000340007801800018014000240fe8000000000000000000000000000bb060004400e1f00cd050007008800000006000540"], 0x5c}, 0x1, 0x0, 0x0, 0x10000042}, 0x90) program did not crash testing program (duration=2m31.5s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): [0, 11, 16, 30] detailed listing: executing program 3: executing program 3: mkdirat(0xffffffffffffff9c, &(0x7f0000000100)='./gadget\x00', 0x1ff) mount(0x0, &(0x7f0000000140)='./gadget\x00', &(0x7f0000000180)='gadgetfs\x00', 0x0, 0x0) r0 = openat(0xffffffffffffff9c, &(0x7f00000001c0)='./gadget/dummy_udc\x00', 0x2, 0x0) mprotect(&(0x7f0000362000/0x2000)=nil, 0x2000, 0x1) write(r0, &(0x7f0000000200)="000000000902190001010080320904000001ff000000070581024000000902190001010080320904000001ff00000007058102000200120100020000004034127856000100000001", 0x48) write(0xffffffffffffffff, &(0x7f00000005c0)="010000000705810240000007058102000200", 0x12) ioctl$sock_SIOCGIFINDEX(0xffffffffffffffff, 0x8933, &(0x7f0000000040)={'bridge0\x00'}) write$P9_RRENAME(0xffffffffffffffff, 0x0, 0x0) mmap(&(0x7f0000362000/0x4000)=nil, 0x4000, 0x0, 0x12, 0xffffffffffffffff, 0xfffff000) r1 = syz_clone(0x21000200, 0x0, 0x0, 0x0, 0x0, 0x0) rt_tgsigqueueinfo(r1, r1, 0x8, 0x0) executing program 0: r0 = socket(0x10, 0x3, 0x0) sendmsg$nl_route(0xffffffffffffffff, &(0x7f0000000300)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000100)=ANY=[@ANYBLOB="4800e80010000d0428bd7000fcdbff2500008000", @ANYRES32=r0, @ANYBLOB="1000000000000000280012800b00010062726964676500001800028005001900840000000c001e"], 0x48}}, 0x4084) sendmsg$nl_route(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000080)={&(0x7f00000001c0)=ANY=[@ANYBLOB="500000001000010425bbe5ad600027842cf52300", @ANYRES32=0x0, @ANYRESDEC=0x0, @ANYRES64=r0, @ANYRES16=r0], 0x50}, 0x1, 0x0, 0x0, 0x13d33d22c8a65c15}, 0x4008840) getsockopt$inet_sctp6_SCTP_NODELAY(r0, 0x84, 0x3, &(0x7f0000000280), &(0x7f00000002c0)=0x4) mkdirat(0xffffffffffffff9c, &(0x7f0000000040)='./mnt\x00', 0x1ff) mount$nfs(&(0x7f0000000080)=':27.0.0.1:/export\x00', &(0x7f00000000c0)='./mnt\x00', &(0x7f0000000180), 0x20800, &(0x7f0000000140)=ANY=[@ANYRES16=r0]) r1 = socket$inet6_icmp_raw(0xa, 0x3, 0x3a) bind$inet6(r1, &(0x7f00000001c0)={0xa, 0x4e20, 0xfffffffb, @empty, 0x2}, 0x1c) sendmmsg(r0, &(0x7f0000000000), 0x4000000000001f2, 0x0) r2 = socket$inet6_sctp(0xa, 0x1, 0x84) r3 = dup(r2) setsockopt$inet_sctp6_SCTP_SOCKOPT_BINDX_ADD(r3, 0x84, 0x64, &(0x7f0000000040)=[@in6={0xa, 0x4e24, 0x6, @loopback, 0x3}], 0x1c) getsockopt$inet_sctp_SCTP_GET_ASSOC_STATS(r3, 0x84, 0x70, &(0x7f0000000680)={0x0, @in6={{0xa, 0x4e22, 0x1, @ipv4={'\x00', '\xff\xff', @multicast1}, 0x8}}, [0xfffffffffffffffa, 0x3, 0x7, 0x3, 0x4, 0x3, 0xc, 0x8, 0x3, 0x5, 0x7, 0x100000000, 0x6, 0x2, 0x6]}, &(0x7f00000007c0)=0x100) r4 = socket$packet(0x11, 0x2, 0x300) socket$nl_route(0x10, 0x3, 0x0) sendto$packet(r4, 0x0, 0x0, 0x0, &(0x7f0000000400)={0x11, 0x88a8, 0x0, 0x1, 0x0, 0x6, @local}, 0x14) executing program 4: r0 = syz_open_dev$dri(&(0x7f0000000000), 0x0, 0x0) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r0, 0xc02064b2, &(0x7f0000000040)={0x1, 0xd00, 0x6}) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r0, 0xc02064b2, &(0x7f0000000100)={0x1, 0x3, 0x9}) ioctl$DRM_IOCTL_PANTHOR_VM_CREATE(r0, 0xc0106441, &(0x7f0000000080)={0x0, 0x0, 0xffffffffffffffff}) socket$kcm(0xa, 0x2, 0x0) socket$nl_route(0x10, 0x3, 0x0) r1 = socket(0x10, 0x3, 0x0) getsockname$packet(r1, &(0x7f00000002c0)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000100)=0x14) sendmsg$nl_route(0xffffffffffffffff, &(0x7f0000000040)={0x0, 0x0, 0x0}, 0x0) sendmsg$IPSET_CMD_ADD(0xffffffffffffffff, 0x0, 0x0) sendmsg$IPSET_CMD_TEST(0xffffffffffffffff, &(0x7f0000000280)={0x0, 0x0, &(0x7f00000002c0)={&(0x7f0000000300)={0x48, 0xb, 0x6, 0x1, 0x0, 0x0, {0x2}, [@IPSET_ATTR_SETNAME={0x9, 0x2, 'syz1\x00'}, @IPSET_ATTR_DATA={0x28, 0x7, 0x0, 0x1, [@IPSET_ATTR_IP={0xc, 0x1, 0x0, 0x1, @IPSET_ATTR_IPADDR_IPV4={0x8, 0x1, 0x1, 0x0, @local}}, @IPSET_ATTR_PORT={0x6, 0x4, 0x1, 0x0, 0x5000}, @IPSET_ATTR_MARK={0x8, 0xa, 0x1, 0x0, 0xc}, @IPSET_ATTR_CIDR2={0x5, 0x15, 0x18}]}]}, 0x48}}, 0x0) socket$inet6_udp(0xa, 0x2, 0x0) socket(0x10, 0x803, 0x0) socket(0x10, 0x3, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./config\x00', 0x1ff) mount(0x0, &(0x7f0000000000)='./config\x00', &(0x7f0000000080)='configfs\x00', 0x0, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000140)='./config/usb_gadget/g1\x00', 0xbf) mkdirat(0xffffffffffffff9c, &(0x7f00000001c0)='./config/usb_gadget/g1/functions/uvc.0\x00', 0x1ff) mkdirat(0xffffffffffffff9c, &(0x7f0000000280)='./config/usb_gadget/g1/functions/uvc.0/streaming/mjpeg/m1\x00', 0x1ff) r2 = openat(0xffffffffffffff9c, &(0x7f00000002c0)='./config/usb_gadget/g1/functions/uvc.0/streaming/mjpeg/m1/bmaControls\x00', 0x2, 0x0) write(r2, &(0x7f0000000640)='12', 0x2) write$P9_RVERSION(r2, &(0x7f0000000180)={0x13, 0x65, 0xffff, 0x1017, 0xffffffffffffff96, '9P2000.L'}, 0x13) syz_usb_connect$midi(0x0, 0x4f, &(0x7f0000000280)=ANY=[], 0x0) r3 = socket$nl_route(0x10, 0x3, 0x0) ioctl$ifreq_SIOCGIFINDEX_vcan(r3, 0x8933, &(0x7f0000000040)={'vxcan0\x00'}) getuid() r4 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPSET_CMD_CREATE(r4, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000200)=ANY=[@ANYBLOB="600000000206010800000000000000000000000005000400000000000900020073797a31000000001400078008001240000000000500140008000000050005000a000000050001000600000011000300686173683a69702c706f7274"], 0x60}}, 0x24000800) r5 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPSET_CMD_ADD(r5, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000240)={&(0x7f0000000c80)=ANY=[@ANYBLOB="5c000000090601080000000000000000070000000900020073797a31000000000500010007000000340007801800018014000240fe8000000000000000000000000000bb060004400e1f00cd050007008800000006000540"], 0x5c}, 0x1, 0x0, 0x0, 0x10000042}, 0x90) program crashed: KASAN: slab-use-after-free Read in ep_open testing program (duration=2m31.5s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): [0, 11, 15, 30] detailed listing: executing program 3: executing program 3: mkdirat(0xffffffffffffff9c, &(0x7f0000000100)='./gadget\x00', 0x1ff) mount(0x0, &(0x7f0000000140)='./gadget\x00', &(0x7f0000000180)='gadgetfs\x00', 0x0, 0x0) r0 = openat(0xffffffffffffff9c, &(0x7f00000001c0)='./gadget/dummy_udc\x00', 0x2, 0x0) mprotect(&(0x7f0000362000/0x2000)=nil, 0x2000, 0x1) write(r0, &(0x7f0000000200)="000000000902190001010080320904000001ff000000070581024000000902190001010080320904000001ff00000007058102000200120100020000004034127856000100000001", 0x48) write(0xffffffffffffffff, &(0x7f00000005c0)="010000000705810240000007058102000200", 0x12) ioctl$sock_SIOCGIFINDEX(0xffffffffffffffff, 0x8933, &(0x7f0000000040)={'bridge0\x00'}) write$P9_RRENAME(0xffffffffffffffff, 0x0, 0x0) mmap(&(0x7f0000362000/0x4000)=nil, 0x4000, 0x0, 0x12, 0xffffffffffffffff, 0xfffff000) r1 = syz_clone(0x21000200, 0x0, 0x0, 0x0, 0x0, 0x0) rt_tgsigqueueinfo(r1, r1, 0x8, 0x0) executing program 0: r0 = socket(0x10, 0x3, 0x0) sendmsg$nl_route(0xffffffffffffffff, &(0x7f0000000300)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000100)=ANY=[@ANYBLOB="4800e80010000d0428bd7000fcdbff2500008000", @ANYRES32=r0, @ANYBLOB="1000000000000000280012800b00010062726964676500001800028005001900840000000c001e"], 0x48}}, 0x4084) sendmsg$nl_route(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000080)={&(0x7f00000001c0)=ANY=[@ANYBLOB="500000001000010425bbe5ad600027842cf52300", @ANYRES32=0x0, @ANYRESDEC=0x0, @ANYRES64=r0, @ANYRES16=r0], 0x50}, 0x1, 0x0, 0x0, 0x13d33d22c8a65c15}, 0x4008840) getsockopt$inet_sctp6_SCTP_NODELAY(r0, 0x84, 0x3, &(0x7f0000000280), &(0x7f00000002c0)=0x4) mkdirat(0xffffffffffffff9c, &(0x7f0000000040)='./mnt\x00', 0x1ff) mount$nfs(&(0x7f0000000080)=':27.0.0.1:/export\x00', &(0x7f00000000c0)='./mnt\x00', &(0x7f0000000180), 0x20800, &(0x7f0000000140)=ANY=[@ANYRES16=r0]) r1 = socket$inet6_icmp_raw(0xa, 0x3, 0x3a) bind$inet6(r1, &(0x7f00000001c0)={0xa, 0x4e20, 0xfffffffb, @empty, 0x2}, 0x1c) sendmmsg(r0, &(0x7f0000000000), 0x4000000000001f2, 0x0) r2 = socket$inet6_sctp(0xa, 0x1, 0x84) r3 = dup(r2) setsockopt$inet_sctp6_SCTP_SOCKOPT_BINDX_ADD(r3, 0x84, 0x64, &(0x7f0000000040)=[@in6={0xa, 0x4e24, 0x6, @loopback, 0x3}], 0x1c) getsockopt$inet_sctp_SCTP_GET_ASSOC_STATS(r3, 0x84, 0x70, &(0x7f0000000680)={0x0, @in6={{0xa, 0x4e22, 0x1, @ipv4={'\x00', '\xff\xff', @multicast1}, 0x8}}, [0xfffffffffffffffa, 0x3, 0x7, 0x3, 0x4, 0x3, 0xc, 0x8, 0x3, 0x5, 0x7, 0x100000000, 0x6, 0x2, 0x6]}, &(0x7f00000007c0)=0x100) r4 = socket$packet(0x11, 0x2, 0x300) sendto$packet(r4, 0x0, 0x0, 0x0, &(0x7f0000000400)={0x11, 0x88a8, 0x0, 0x1, 0x0, 0x6, @local}, 0x14) executing program 4: r0 = syz_open_dev$dri(&(0x7f0000000000), 0x0, 0x0) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r0, 0xc02064b2, &(0x7f0000000040)={0x1, 0xd00, 0x6}) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r0, 0xc02064b2, &(0x7f0000000100)={0x1, 0x3, 0x9}) ioctl$DRM_IOCTL_PANTHOR_VM_CREATE(r0, 0xc0106441, &(0x7f0000000080)={0x0, 0x0, 0xffffffffffffffff}) socket$kcm(0xa, 0x2, 0x0) socket$nl_route(0x10, 0x3, 0x0) r1 = socket(0x10, 0x3, 0x0) getsockname$packet(r1, &(0x7f00000002c0)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000100)=0x14) sendmsg$nl_route(0xffffffffffffffff, &(0x7f0000000040)={0x0, 0x0, 0x0}, 0x0) sendmsg$IPSET_CMD_ADD(0xffffffffffffffff, 0x0, 0x0) sendmsg$IPSET_CMD_TEST(0xffffffffffffffff, &(0x7f0000000280)={0x0, 0x0, &(0x7f00000002c0)={&(0x7f0000000300)={0x48, 0xb, 0x6, 0x1, 0x0, 0x0, {0x2}, [@IPSET_ATTR_SETNAME={0x9, 0x2, 'syz1\x00'}, @IPSET_ATTR_DATA={0x28, 0x7, 0x0, 0x1, [@IPSET_ATTR_IP={0xc, 0x1, 0x0, 0x1, @IPSET_ATTR_IPADDR_IPV4={0x8, 0x1, 0x1, 0x0, @local}}, @IPSET_ATTR_PORT={0x6, 0x4, 0x1, 0x0, 0x5000}, @IPSET_ATTR_MARK={0x8, 0xa, 0x1, 0x0, 0xc}, @IPSET_ATTR_CIDR2={0x5, 0x15, 0x18}]}]}, 0x48}}, 0x0) socket$inet6_udp(0xa, 0x2, 0x0) socket(0x10, 0x803, 0x0) socket(0x10, 0x3, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./config\x00', 0x1ff) mount(0x0, &(0x7f0000000000)='./config\x00', &(0x7f0000000080)='configfs\x00', 0x0, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000140)='./config/usb_gadget/g1\x00', 0xbf) mkdirat(0xffffffffffffff9c, &(0x7f00000001c0)='./config/usb_gadget/g1/functions/uvc.0\x00', 0x1ff) mkdirat(0xffffffffffffff9c, &(0x7f0000000280)='./config/usb_gadget/g1/functions/uvc.0/streaming/mjpeg/m1\x00', 0x1ff) r2 = openat(0xffffffffffffff9c, &(0x7f00000002c0)='./config/usb_gadget/g1/functions/uvc.0/streaming/mjpeg/m1/bmaControls\x00', 0x2, 0x0) write(r2, &(0x7f0000000640)='12', 0x2) write$P9_RVERSION(r2, &(0x7f0000000180)={0x13, 0x65, 0xffff, 0x1017, 0xffffffffffffff96, '9P2000.L'}, 0x13) syz_usb_connect$midi(0x0, 0x4f, &(0x7f0000000280)=ANY=[], 0x0) r3 = socket$nl_route(0x10, 0x3, 0x0) ioctl$ifreq_SIOCGIFINDEX_vcan(r3, 0x8933, &(0x7f0000000040)={'vxcan0\x00'}) getuid() r4 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPSET_CMD_CREATE(r4, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000200)=ANY=[@ANYBLOB="600000000206010800000000000000000000000005000400000000000900020073797a31000000001400078008001240000000000500140008000000050005000a000000050001000600000011000300686173683a69702c706f7274"], 0x60}}, 0x24000800) r5 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPSET_CMD_ADD(r5, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000240)={&(0x7f0000000c80)=ANY=[@ANYBLOB="5c000000090601080000000000000000070000000900020073797a31000000000500010007000000340007801800018014000240fe8000000000000000000000000000bb060004400e1f00cd050007008800000006000540"], 0x5c}, 0x1, 0x0, 0x0, 0x10000042}, 0x90) program crashed: KASAN: slab-use-after-free Read in ep_open testing program (duration=2m31.5s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): [0, 11, 14, 30] detailed listing: executing program 3: executing program 3: mkdirat(0xffffffffffffff9c, &(0x7f0000000100)='./gadget\x00', 0x1ff) mount(0x0, &(0x7f0000000140)='./gadget\x00', &(0x7f0000000180)='gadgetfs\x00', 0x0, 0x0) r0 = openat(0xffffffffffffff9c, &(0x7f00000001c0)='./gadget/dummy_udc\x00', 0x2, 0x0) mprotect(&(0x7f0000362000/0x2000)=nil, 0x2000, 0x1) write(r0, &(0x7f0000000200)="000000000902190001010080320904000001ff000000070581024000000902190001010080320904000001ff00000007058102000200120100020000004034127856000100000001", 0x48) write(0xffffffffffffffff, &(0x7f00000005c0)="010000000705810240000007058102000200", 0x12) ioctl$sock_SIOCGIFINDEX(0xffffffffffffffff, 0x8933, &(0x7f0000000040)={'bridge0\x00'}) write$P9_RRENAME(0xffffffffffffffff, 0x0, 0x0) mmap(&(0x7f0000362000/0x4000)=nil, 0x4000, 0x0, 0x12, 0xffffffffffffffff, 0xfffff000) r1 = syz_clone(0x21000200, 0x0, 0x0, 0x0, 0x0, 0x0) rt_tgsigqueueinfo(r1, r1, 0x8, 0x0) executing program 0: r0 = socket(0x10, 0x3, 0x0) sendmsg$nl_route(0xffffffffffffffff, &(0x7f0000000300)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000100)=ANY=[@ANYBLOB="4800e80010000d0428bd7000fcdbff2500008000", @ANYRES32=r0, @ANYBLOB="1000000000000000280012800b00010062726964676500001800028005001900840000000c001e"], 0x48}}, 0x4084) sendmsg$nl_route(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000080)={&(0x7f00000001c0)=ANY=[@ANYBLOB="500000001000010425bbe5ad600027842cf52300", @ANYRES32=0x0, @ANYRESDEC=0x0, @ANYRES64=r0, @ANYRES16=r0], 0x50}, 0x1, 0x0, 0x0, 0x13d33d22c8a65c15}, 0x4008840) getsockopt$inet_sctp6_SCTP_NODELAY(r0, 0x84, 0x3, &(0x7f0000000280), &(0x7f00000002c0)=0x4) mkdirat(0xffffffffffffff9c, &(0x7f0000000040)='./mnt\x00', 0x1ff) mount$nfs(&(0x7f0000000080)=':27.0.0.1:/export\x00', &(0x7f00000000c0)='./mnt\x00', &(0x7f0000000180), 0x20800, &(0x7f0000000140)=ANY=[@ANYRES16=r0]) r1 = socket$inet6_icmp_raw(0xa, 0x3, 0x3a) bind$inet6(r1, &(0x7f00000001c0)={0xa, 0x4e20, 0xfffffffb, @empty, 0x2}, 0x1c) sendmmsg(r0, &(0x7f0000000000), 0x4000000000001f2, 0x0) r2 = socket$inet6_sctp(0xa, 0x1, 0x84) r3 = dup(r2) setsockopt$inet_sctp6_SCTP_SOCKOPT_BINDX_ADD(r3, 0x84, 0x64, &(0x7f0000000040)=[@in6={0xa, 0x4e24, 0x6, @loopback, 0x3}], 0x1c) getsockopt$inet_sctp_SCTP_GET_ASSOC_STATS(r3, 0x84, 0x70, &(0x7f0000000680)={0x0, @in6={{0xa, 0x4e22, 0x1, @ipv4={'\x00', '\xff\xff', @multicast1}, 0x8}}, [0xfffffffffffffffa, 0x3, 0x7, 0x3, 0x4, 0x3, 0xc, 0x8, 0x3, 0x5, 0x7, 0x100000000, 0x6, 0x2, 0x6]}, &(0x7f00000007c0)=0x100) sendto$packet(0xffffffffffffffff, 0x0, 0x0, 0x0, &(0x7f0000000400)={0x11, 0x88a8, 0x0, 0x1, 0x0, 0x6, @local}, 0x14) executing program 4: r0 = syz_open_dev$dri(&(0x7f0000000000), 0x0, 0x0) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r0, 0xc02064b2, &(0x7f0000000040)={0x1, 0xd00, 0x6}) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r0, 0xc02064b2, &(0x7f0000000100)={0x1, 0x3, 0x9}) ioctl$DRM_IOCTL_PANTHOR_VM_CREATE(r0, 0xc0106441, &(0x7f0000000080)={0x0, 0x0, 0xffffffffffffffff}) socket$kcm(0xa, 0x2, 0x0) socket$nl_route(0x10, 0x3, 0x0) r1 = socket(0x10, 0x3, 0x0) getsockname$packet(r1, &(0x7f00000002c0)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000100)=0x14) sendmsg$nl_route(0xffffffffffffffff, &(0x7f0000000040)={0x0, 0x0, 0x0}, 0x0) sendmsg$IPSET_CMD_ADD(0xffffffffffffffff, 0x0, 0x0) sendmsg$IPSET_CMD_TEST(0xffffffffffffffff, &(0x7f0000000280)={0x0, 0x0, &(0x7f00000002c0)={&(0x7f0000000300)={0x48, 0xb, 0x6, 0x1, 0x0, 0x0, {0x2}, [@IPSET_ATTR_SETNAME={0x9, 0x2, 'syz1\x00'}, @IPSET_ATTR_DATA={0x28, 0x7, 0x0, 0x1, [@IPSET_ATTR_IP={0xc, 0x1, 0x0, 0x1, @IPSET_ATTR_IPADDR_IPV4={0x8, 0x1, 0x1, 0x0, @local}}, @IPSET_ATTR_PORT={0x6, 0x4, 0x1, 0x0, 0x5000}, @IPSET_ATTR_MARK={0x8, 0xa, 0x1, 0x0, 0xc}, @IPSET_ATTR_CIDR2={0x5, 0x15, 0x18}]}]}, 0x48}}, 0x0) socket$inet6_udp(0xa, 0x2, 0x0) socket(0x10, 0x803, 0x0) socket(0x10, 0x3, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./config\x00', 0x1ff) mount(0x0, &(0x7f0000000000)='./config\x00', &(0x7f0000000080)='configfs\x00', 0x0, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000140)='./config/usb_gadget/g1\x00', 0xbf) mkdirat(0xffffffffffffff9c, &(0x7f00000001c0)='./config/usb_gadget/g1/functions/uvc.0\x00', 0x1ff) mkdirat(0xffffffffffffff9c, &(0x7f0000000280)='./config/usb_gadget/g1/functions/uvc.0/streaming/mjpeg/m1\x00', 0x1ff) r2 = openat(0xffffffffffffff9c, &(0x7f00000002c0)='./config/usb_gadget/g1/functions/uvc.0/streaming/mjpeg/m1/bmaControls\x00', 0x2, 0x0) write(r2, &(0x7f0000000640)='12', 0x2) write$P9_RVERSION(r2, &(0x7f0000000180)={0x13, 0x65, 0xffff, 0x1017, 0xffffffffffffff96, '9P2000.L'}, 0x13) syz_usb_connect$midi(0x0, 0x4f, &(0x7f0000000280)=ANY=[], 0x0) r3 = socket$nl_route(0x10, 0x3, 0x0) ioctl$ifreq_SIOCGIFINDEX_vcan(r3, 0x8933, &(0x7f0000000040)={'vxcan0\x00'}) getuid() r4 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPSET_CMD_CREATE(r4, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000200)=ANY=[@ANYBLOB="600000000206010800000000000000000000000005000400000000000900020073797a31000000001400078008001240000000000500140008000000050005000a000000050001000600000011000300686173683a69702c706f7274"], 0x60}}, 0x24000800) r5 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPSET_CMD_ADD(r5, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000240)={&(0x7f0000000c80)=ANY=[@ANYBLOB="5c000000090601080000000000000000070000000900020073797a31000000000500010007000000340007801800018014000240fe8000000000000000000000000000bb060004400e1f00cd050007008800000006000540"], 0x5c}, 0x1, 0x0, 0x0, 0x10000042}, 0x90) program did not crash testing program (duration=2m31.5s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): [0, 11, 14, 30] detailed listing: executing program 3: executing program 3: mkdirat(0xffffffffffffff9c, &(0x7f0000000100)='./gadget\x00', 0x1ff) mount(0x0, &(0x7f0000000140)='./gadget\x00', &(0x7f0000000180)='gadgetfs\x00', 0x0, 0x0) r0 = openat(0xffffffffffffff9c, &(0x7f00000001c0)='./gadget/dummy_udc\x00', 0x2, 0x0) mprotect(&(0x7f0000362000/0x2000)=nil, 0x2000, 0x1) write(r0, &(0x7f0000000200)="000000000902190001010080320904000001ff000000070581024000000902190001010080320904000001ff00000007058102000200120100020000004034127856000100000001", 0x48) write(0xffffffffffffffff, &(0x7f00000005c0)="010000000705810240000007058102000200", 0x12) ioctl$sock_SIOCGIFINDEX(0xffffffffffffffff, 0x8933, &(0x7f0000000040)={'bridge0\x00'}) write$P9_RRENAME(0xffffffffffffffff, 0x0, 0x0) mmap(&(0x7f0000362000/0x4000)=nil, 0x4000, 0x0, 0x12, 0xffffffffffffffff, 0xfffff000) r1 = syz_clone(0x21000200, 0x0, 0x0, 0x0, 0x0, 0x0) rt_tgsigqueueinfo(r1, r1, 0x8, 0x0) executing program 0: r0 = socket(0x10, 0x3, 0x0) sendmsg$nl_route(0xffffffffffffffff, &(0x7f0000000300)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000100)=ANY=[@ANYBLOB="4800e80010000d0428bd7000fcdbff2500008000", @ANYRES32=r0, @ANYBLOB="1000000000000000280012800b00010062726964676500001800028005001900840000000c001e"], 0x48}}, 0x4084) sendmsg$nl_route(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000080)={&(0x7f00000001c0)=ANY=[@ANYBLOB="500000001000010425bbe5ad600027842cf52300", @ANYRES32=0x0, @ANYRESDEC=0x0, @ANYRES64=r0, @ANYRES16=r0], 0x50}, 0x1, 0x0, 0x0, 0x13d33d22c8a65c15}, 0x4008840) getsockopt$inet_sctp6_SCTP_NODELAY(r0, 0x84, 0x3, &(0x7f0000000280), &(0x7f00000002c0)=0x4) mkdirat(0xffffffffffffff9c, &(0x7f0000000040)='./mnt\x00', 0x1ff) mount$nfs(&(0x7f0000000080)=':27.0.0.1:/export\x00', &(0x7f00000000c0)='./mnt\x00', &(0x7f0000000180), 0x20800, &(0x7f0000000140)=ANY=[@ANYRES16=r0]) r1 = socket$inet6_icmp_raw(0xa, 0x3, 0x3a) bind$inet6(r1, &(0x7f00000001c0)={0xa, 0x4e20, 0xfffffffb, @empty, 0x2}, 0x1c) sendmmsg(r0, &(0x7f0000000000), 0x4000000000001f2, 0x0) r2 = socket$inet6_sctp(0xa, 0x1, 0x84) r3 = dup(r2) setsockopt$inet_sctp6_SCTP_SOCKOPT_BINDX_ADD(r3, 0x84, 0x64, &(0x7f0000000040)=[@in6={0xa, 0x4e24, 0x6, @loopback, 0x3}], 0x1c) r4 = socket$packet(0x11, 0x2, 0x300) sendto$packet(r4, 0x0, 0x0, 0x0, &(0x7f0000000400)={0x11, 0x88a8, 0x0, 0x1, 0x0, 0x6, @local}, 0x14) executing program 4: r0 = syz_open_dev$dri(&(0x7f0000000000), 0x0, 0x0) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r0, 0xc02064b2, &(0x7f0000000040)={0x1, 0xd00, 0x6}) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r0, 0xc02064b2, &(0x7f0000000100)={0x1, 0x3, 0x9}) ioctl$DRM_IOCTL_PANTHOR_VM_CREATE(r0, 0xc0106441, &(0x7f0000000080)={0x0, 0x0, 0xffffffffffffffff}) socket$kcm(0xa, 0x2, 0x0) socket$nl_route(0x10, 0x3, 0x0) r1 = socket(0x10, 0x3, 0x0) getsockname$packet(r1, &(0x7f00000002c0)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000100)=0x14) sendmsg$nl_route(0xffffffffffffffff, &(0x7f0000000040)={0x0, 0x0, 0x0}, 0x0) sendmsg$IPSET_CMD_ADD(0xffffffffffffffff, 0x0, 0x0) sendmsg$IPSET_CMD_TEST(0xffffffffffffffff, &(0x7f0000000280)={0x0, 0x0, &(0x7f00000002c0)={&(0x7f0000000300)={0x48, 0xb, 0x6, 0x1, 0x0, 0x0, {0x2}, [@IPSET_ATTR_SETNAME={0x9, 0x2, 'syz1\x00'}, @IPSET_ATTR_DATA={0x28, 0x7, 0x0, 0x1, [@IPSET_ATTR_IP={0xc, 0x1, 0x0, 0x1, @IPSET_ATTR_IPADDR_IPV4={0x8, 0x1, 0x1, 0x0, @local}}, @IPSET_ATTR_PORT={0x6, 0x4, 0x1, 0x0, 0x5000}, @IPSET_ATTR_MARK={0x8, 0xa, 0x1, 0x0, 0xc}, @IPSET_ATTR_CIDR2={0x5, 0x15, 0x18}]}]}, 0x48}}, 0x0) socket$inet6_udp(0xa, 0x2, 0x0) socket(0x10, 0x803, 0x0) socket(0x10, 0x3, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./config\x00', 0x1ff) mount(0x0, &(0x7f0000000000)='./config\x00', &(0x7f0000000080)='configfs\x00', 0x0, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000140)='./config/usb_gadget/g1\x00', 0xbf) mkdirat(0xffffffffffffff9c, &(0x7f00000001c0)='./config/usb_gadget/g1/functions/uvc.0\x00', 0x1ff) mkdirat(0xffffffffffffff9c, &(0x7f0000000280)='./config/usb_gadget/g1/functions/uvc.0/streaming/mjpeg/m1\x00', 0x1ff) r2 = openat(0xffffffffffffff9c, &(0x7f00000002c0)='./config/usb_gadget/g1/functions/uvc.0/streaming/mjpeg/m1/bmaControls\x00', 0x2, 0x0) write(r2, &(0x7f0000000640)='12', 0x2) write$P9_RVERSION(r2, &(0x7f0000000180)={0x13, 0x65, 0xffff, 0x1017, 0xffffffffffffff96, '9P2000.L'}, 0x13) syz_usb_connect$midi(0x0, 0x4f, &(0x7f0000000280)=ANY=[], 0x0) r3 = socket$nl_route(0x10, 0x3, 0x0) ioctl$ifreq_SIOCGIFINDEX_vcan(r3, 0x8933, &(0x7f0000000040)={'vxcan0\x00'}) getuid() r4 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPSET_CMD_CREATE(r4, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000200)=ANY=[@ANYBLOB="600000000206010800000000000000000000000005000400000000000900020073797a31000000001400078008001240000000000500140008000000050005000a000000050001000600000011000300686173683a69702c706f7274"], 0x60}}, 0x24000800) r5 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPSET_CMD_ADD(r5, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000240)={&(0x7f0000000c80)=ANY=[@ANYBLOB="5c000000090601080000000000000000070000000900020073797a31000000000500010007000000340007801800018014000240fe8000000000000000000000000000bb060004400e1f00cd050007008800000006000540"], 0x5c}, 0x1, 0x0, 0x0, 0x10000042}, 0x90) program crashed: KASAN: slab-use-after-free Read in ep_open testing program (duration=2m31.5s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): [0, 11, 13, 30] detailed listing: executing program 3: executing program 3: mkdirat(0xffffffffffffff9c, &(0x7f0000000100)='./gadget\x00', 0x1ff) mount(0x0, &(0x7f0000000140)='./gadget\x00', &(0x7f0000000180)='gadgetfs\x00', 0x0, 0x0) r0 = openat(0xffffffffffffff9c, &(0x7f00000001c0)='./gadget/dummy_udc\x00', 0x2, 0x0) mprotect(&(0x7f0000362000/0x2000)=nil, 0x2000, 0x1) write(r0, &(0x7f0000000200)="000000000902190001010080320904000001ff000000070581024000000902190001010080320904000001ff00000007058102000200120100020000004034127856000100000001", 0x48) write(0xffffffffffffffff, &(0x7f00000005c0)="010000000705810240000007058102000200", 0x12) ioctl$sock_SIOCGIFINDEX(0xffffffffffffffff, 0x8933, &(0x7f0000000040)={'bridge0\x00'}) write$P9_RRENAME(0xffffffffffffffff, 0x0, 0x0) mmap(&(0x7f0000362000/0x4000)=nil, 0x4000, 0x0, 0x12, 0xffffffffffffffff, 0xfffff000) r1 = syz_clone(0x21000200, 0x0, 0x0, 0x0, 0x0, 0x0) rt_tgsigqueueinfo(r1, r1, 0x8, 0x0) executing program 0: r0 = socket(0x10, 0x3, 0x0) sendmsg$nl_route(0xffffffffffffffff, &(0x7f0000000300)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000100)=ANY=[@ANYBLOB="4800e80010000d0428bd7000fcdbff2500008000", @ANYRES32=r0, @ANYBLOB="1000000000000000280012800b00010062726964676500001800028005001900840000000c001e"], 0x48}}, 0x4084) sendmsg$nl_route(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000080)={&(0x7f00000001c0)=ANY=[@ANYBLOB="500000001000010425bbe5ad600027842cf52300", @ANYRES32=0x0, @ANYRESDEC=0x0, @ANYRES64=r0, @ANYRES16=r0], 0x50}, 0x1, 0x0, 0x0, 0x13d33d22c8a65c15}, 0x4008840) getsockopt$inet_sctp6_SCTP_NODELAY(r0, 0x84, 0x3, &(0x7f0000000280), &(0x7f00000002c0)=0x4) mkdirat(0xffffffffffffff9c, &(0x7f0000000040)='./mnt\x00', 0x1ff) mount$nfs(&(0x7f0000000080)=':27.0.0.1:/export\x00', &(0x7f00000000c0)='./mnt\x00', &(0x7f0000000180), 0x20800, &(0x7f0000000140)=ANY=[@ANYRES16=r0]) r1 = socket$inet6_icmp_raw(0xa, 0x3, 0x3a) bind$inet6(r1, &(0x7f00000001c0)={0xa, 0x4e20, 0xfffffffb, @empty, 0x2}, 0x1c) sendmmsg(r0, &(0x7f0000000000), 0x4000000000001f2, 0x0) r2 = socket$inet6_sctp(0xa, 0x1, 0x84) dup(r2) r3 = socket$packet(0x11, 0x2, 0x300) sendto$packet(r3, 0x0, 0x0, 0x0, &(0x7f0000000400)={0x11, 0x88a8, 0x0, 0x1, 0x0, 0x6, @local}, 0x14) executing program 4: r0 = syz_open_dev$dri(&(0x7f0000000000), 0x0, 0x0) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r0, 0xc02064b2, &(0x7f0000000040)={0x1, 0xd00, 0x6}) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r0, 0xc02064b2, &(0x7f0000000100)={0x1, 0x3, 0x9}) ioctl$DRM_IOCTL_PANTHOR_VM_CREATE(r0, 0xc0106441, &(0x7f0000000080)={0x0, 0x0, 0xffffffffffffffff}) socket$kcm(0xa, 0x2, 0x0) socket$nl_route(0x10, 0x3, 0x0) r1 = socket(0x10, 0x3, 0x0) getsockname$packet(r1, &(0x7f00000002c0)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000100)=0x14) sendmsg$nl_route(0xffffffffffffffff, &(0x7f0000000040)={0x0, 0x0, 0x0}, 0x0) sendmsg$IPSET_CMD_ADD(0xffffffffffffffff, 0x0, 0x0) sendmsg$IPSET_CMD_TEST(0xffffffffffffffff, &(0x7f0000000280)={0x0, 0x0, &(0x7f00000002c0)={&(0x7f0000000300)={0x48, 0xb, 0x6, 0x1, 0x0, 0x0, {0x2}, [@IPSET_ATTR_SETNAME={0x9, 0x2, 'syz1\x00'}, @IPSET_ATTR_DATA={0x28, 0x7, 0x0, 0x1, [@IPSET_ATTR_IP={0xc, 0x1, 0x0, 0x1, @IPSET_ATTR_IPADDR_IPV4={0x8, 0x1, 0x1, 0x0, @local}}, @IPSET_ATTR_PORT={0x6, 0x4, 0x1, 0x0, 0x5000}, @IPSET_ATTR_MARK={0x8, 0xa, 0x1, 0x0, 0xc}, @IPSET_ATTR_CIDR2={0x5, 0x15, 0x18}]}]}, 0x48}}, 0x0) socket$inet6_udp(0xa, 0x2, 0x0) socket(0x10, 0x803, 0x0) socket(0x10, 0x3, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./config\x00', 0x1ff) mount(0x0, &(0x7f0000000000)='./config\x00', &(0x7f0000000080)='configfs\x00', 0x0, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000140)='./config/usb_gadget/g1\x00', 0xbf) mkdirat(0xffffffffffffff9c, &(0x7f00000001c0)='./config/usb_gadget/g1/functions/uvc.0\x00', 0x1ff) mkdirat(0xffffffffffffff9c, &(0x7f0000000280)='./config/usb_gadget/g1/functions/uvc.0/streaming/mjpeg/m1\x00', 0x1ff) r2 = openat(0xffffffffffffff9c, &(0x7f00000002c0)='./config/usb_gadget/g1/functions/uvc.0/streaming/mjpeg/m1/bmaControls\x00', 0x2, 0x0) write(r2, &(0x7f0000000640)='12', 0x2) write$P9_RVERSION(r2, &(0x7f0000000180)={0x13, 0x65, 0xffff, 0x1017, 0xffffffffffffff96, '9P2000.L'}, 0x13) syz_usb_connect$midi(0x0, 0x4f, &(0x7f0000000280)=ANY=[], 0x0) r3 = socket$nl_route(0x10, 0x3, 0x0) ioctl$ifreq_SIOCGIFINDEX_vcan(r3, 0x8933, &(0x7f0000000040)={'vxcan0\x00'}) getuid() r4 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPSET_CMD_CREATE(r4, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000200)=ANY=[@ANYBLOB="600000000206010800000000000000000000000005000400000000000900020073797a31000000001400078008001240000000000500140008000000050005000a000000050001000600000011000300686173683a69702c706f7274"], 0x60}}, 0x24000800) r5 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPSET_CMD_ADD(r5, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000240)={&(0x7f0000000c80)=ANY=[@ANYBLOB="5c000000090601080000000000000000070000000900020073797a31000000000500010007000000340007801800018014000240fe8000000000000000000000000000bb060004400e1f00cd050007008800000006000540"], 0x5c}, 0x1, 0x0, 0x0, 0x10000042}, 0x90) program crashed: KASAN: slab-use-after-free Read in ep_open testing program (duration=2m31.5s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): [0, 11, 12, 30] detailed listing: executing program 3: executing program 3: mkdirat(0xffffffffffffff9c, &(0x7f0000000100)='./gadget\x00', 0x1ff) mount(0x0, &(0x7f0000000140)='./gadget\x00', &(0x7f0000000180)='gadgetfs\x00', 0x0, 0x0) r0 = openat(0xffffffffffffff9c, &(0x7f00000001c0)='./gadget/dummy_udc\x00', 0x2, 0x0) mprotect(&(0x7f0000362000/0x2000)=nil, 0x2000, 0x1) write(r0, &(0x7f0000000200)="000000000902190001010080320904000001ff000000070581024000000902190001010080320904000001ff00000007058102000200120100020000004034127856000100000001", 0x48) write(0xffffffffffffffff, &(0x7f00000005c0)="010000000705810240000007058102000200", 0x12) ioctl$sock_SIOCGIFINDEX(0xffffffffffffffff, 0x8933, &(0x7f0000000040)={'bridge0\x00'}) write$P9_RRENAME(0xffffffffffffffff, 0x0, 0x0) mmap(&(0x7f0000362000/0x4000)=nil, 0x4000, 0x0, 0x12, 0xffffffffffffffff, 0xfffff000) r1 = syz_clone(0x21000200, 0x0, 0x0, 0x0, 0x0, 0x0) rt_tgsigqueueinfo(r1, r1, 0x8, 0x0) executing program 0: r0 = socket(0x10, 0x3, 0x0) sendmsg$nl_route(0xffffffffffffffff, &(0x7f0000000300)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000100)=ANY=[@ANYBLOB="4800e80010000d0428bd7000fcdbff2500008000", @ANYRES32=r0, @ANYBLOB="1000000000000000280012800b00010062726964676500001800028005001900840000000c001e"], 0x48}}, 0x4084) sendmsg$nl_route(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000080)={&(0x7f00000001c0)=ANY=[@ANYBLOB="500000001000010425bbe5ad600027842cf52300", @ANYRES32=0x0, @ANYRESDEC=0x0, @ANYRES64=r0, @ANYRES16=r0], 0x50}, 0x1, 0x0, 0x0, 0x13d33d22c8a65c15}, 0x4008840) getsockopt$inet_sctp6_SCTP_NODELAY(r0, 0x84, 0x3, &(0x7f0000000280), &(0x7f00000002c0)=0x4) mkdirat(0xffffffffffffff9c, &(0x7f0000000040)='./mnt\x00', 0x1ff) mount$nfs(&(0x7f0000000080)=':27.0.0.1:/export\x00', &(0x7f00000000c0)='./mnt\x00', &(0x7f0000000180), 0x20800, &(0x7f0000000140)=ANY=[@ANYRES16=r0]) r1 = socket$inet6_icmp_raw(0xa, 0x3, 0x3a) bind$inet6(r1, &(0x7f00000001c0)={0xa, 0x4e20, 0xfffffffb, @empty, 0x2}, 0x1c) sendmmsg(r0, &(0x7f0000000000), 0x4000000000001f2, 0x0) socket$inet6_sctp(0xa, 0x1, 0x84) r2 = socket$packet(0x11, 0x2, 0x300) sendto$packet(r2, 0x0, 0x0, 0x0, &(0x7f0000000400)={0x11, 0x88a8, 0x0, 0x1, 0x0, 0x6, @local}, 0x14) executing program 4: r0 = syz_open_dev$dri(&(0x7f0000000000), 0x0, 0x0) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r0, 0xc02064b2, &(0x7f0000000040)={0x1, 0xd00, 0x6}) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r0, 0xc02064b2, &(0x7f0000000100)={0x1, 0x3, 0x9}) ioctl$DRM_IOCTL_PANTHOR_VM_CREATE(r0, 0xc0106441, &(0x7f0000000080)={0x0, 0x0, 0xffffffffffffffff}) socket$kcm(0xa, 0x2, 0x0) socket$nl_route(0x10, 0x3, 0x0) r1 = socket(0x10, 0x3, 0x0) getsockname$packet(r1, &(0x7f00000002c0)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000100)=0x14) sendmsg$nl_route(0xffffffffffffffff, &(0x7f0000000040)={0x0, 0x0, 0x0}, 0x0) sendmsg$IPSET_CMD_ADD(0xffffffffffffffff, 0x0, 0x0) sendmsg$IPSET_CMD_TEST(0xffffffffffffffff, &(0x7f0000000280)={0x0, 0x0, &(0x7f00000002c0)={&(0x7f0000000300)={0x48, 0xb, 0x6, 0x1, 0x0, 0x0, {0x2}, [@IPSET_ATTR_SETNAME={0x9, 0x2, 'syz1\x00'}, @IPSET_ATTR_DATA={0x28, 0x7, 0x0, 0x1, [@IPSET_ATTR_IP={0xc, 0x1, 0x0, 0x1, @IPSET_ATTR_IPADDR_IPV4={0x8, 0x1, 0x1, 0x0, @local}}, @IPSET_ATTR_PORT={0x6, 0x4, 0x1, 0x0, 0x5000}, @IPSET_ATTR_MARK={0x8, 0xa, 0x1, 0x0, 0xc}, @IPSET_ATTR_CIDR2={0x5, 0x15, 0x18}]}]}, 0x48}}, 0x0) socket$inet6_udp(0xa, 0x2, 0x0) socket(0x10, 0x803, 0x0) socket(0x10, 0x3, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./config\x00', 0x1ff) mount(0x0, &(0x7f0000000000)='./config\x00', &(0x7f0000000080)='configfs\x00', 0x0, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000140)='./config/usb_gadget/g1\x00', 0xbf) mkdirat(0xffffffffffffff9c, &(0x7f00000001c0)='./config/usb_gadget/g1/functions/uvc.0\x00', 0x1ff) mkdirat(0xffffffffffffff9c, &(0x7f0000000280)='./config/usb_gadget/g1/functions/uvc.0/streaming/mjpeg/m1\x00', 0x1ff) r2 = openat(0xffffffffffffff9c, &(0x7f00000002c0)='./config/usb_gadget/g1/functions/uvc.0/streaming/mjpeg/m1/bmaControls\x00', 0x2, 0x0) write(r2, &(0x7f0000000640)='12', 0x2) write$P9_RVERSION(r2, &(0x7f0000000180)={0x13, 0x65, 0xffff, 0x1017, 0xffffffffffffff96, '9P2000.L'}, 0x13) syz_usb_connect$midi(0x0, 0x4f, &(0x7f0000000280)=ANY=[], 0x0) r3 = socket$nl_route(0x10, 0x3, 0x0) ioctl$ifreq_SIOCGIFINDEX_vcan(r3, 0x8933, &(0x7f0000000040)={'vxcan0\x00'}) getuid() r4 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPSET_CMD_CREATE(r4, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000200)=ANY=[@ANYBLOB="600000000206010800000000000000000000000005000400000000000900020073797a31000000001400078008001240000000000500140008000000050005000a000000050001000600000011000300686173683a69702c706f7274"], 0x60}}, 0x24000800) r5 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPSET_CMD_ADD(r5, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000240)={&(0x7f0000000c80)=ANY=[@ANYBLOB="5c000000090601080000000000000000070000000900020073797a31000000000500010007000000340007801800018014000240fe8000000000000000000000000000bb060004400e1f00cd050007008800000006000540"], 0x5c}, 0x1, 0x0, 0x0, 0x10000042}, 0x90) program crashed: KASAN: slab-use-after-free Read in ep_open testing program (duration=2m31.5s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): [0, 11, 11, 30] detailed listing: executing program 3: executing program 3: mkdirat(0xffffffffffffff9c, &(0x7f0000000100)='./gadget\x00', 0x1ff) mount(0x0, &(0x7f0000000140)='./gadget\x00', &(0x7f0000000180)='gadgetfs\x00', 0x0, 0x0) r0 = openat(0xffffffffffffff9c, &(0x7f00000001c0)='./gadget/dummy_udc\x00', 0x2, 0x0) mprotect(&(0x7f0000362000/0x2000)=nil, 0x2000, 0x1) write(r0, &(0x7f0000000200)="000000000902190001010080320904000001ff000000070581024000000902190001010080320904000001ff00000007058102000200120100020000004034127856000100000001", 0x48) write(0xffffffffffffffff, &(0x7f00000005c0)="010000000705810240000007058102000200", 0x12) ioctl$sock_SIOCGIFINDEX(0xffffffffffffffff, 0x8933, &(0x7f0000000040)={'bridge0\x00'}) write$P9_RRENAME(0xffffffffffffffff, 0x0, 0x0) mmap(&(0x7f0000362000/0x4000)=nil, 0x4000, 0x0, 0x12, 0xffffffffffffffff, 0xfffff000) r1 = syz_clone(0x21000200, 0x0, 0x0, 0x0, 0x0, 0x0) rt_tgsigqueueinfo(r1, r1, 0x8, 0x0) executing program 0: r0 = socket(0x10, 0x3, 0x0) sendmsg$nl_route(0xffffffffffffffff, &(0x7f0000000300)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000100)=ANY=[@ANYBLOB="4800e80010000d0428bd7000fcdbff2500008000", @ANYRES32=r0, @ANYBLOB="1000000000000000280012800b00010062726964676500001800028005001900840000000c001e"], 0x48}}, 0x4084) sendmsg$nl_route(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000080)={&(0x7f00000001c0)=ANY=[@ANYBLOB="500000001000010425bbe5ad600027842cf52300", @ANYRES32=0x0, @ANYRESDEC=0x0, @ANYRES64=r0, @ANYRES16=r0], 0x50}, 0x1, 0x0, 0x0, 0x13d33d22c8a65c15}, 0x4008840) getsockopt$inet_sctp6_SCTP_NODELAY(r0, 0x84, 0x3, &(0x7f0000000280), &(0x7f00000002c0)=0x4) mkdirat(0xffffffffffffff9c, &(0x7f0000000040)='./mnt\x00', 0x1ff) mount$nfs(&(0x7f0000000080)=':27.0.0.1:/export\x00', &(0x7f00000000c0)='./mnt\x00', &(0x7f0000000180), 0x20800, &(0x7f0000000140)=ANY=[@ANYRES16=r0]) r1 = socket$inet6_icmp_raw(0xa, 0x3, 0x3a) bind$inet6(r1, &(0x7f00000001c0)={0xa, 0x4e20, 0xfffffffb, @empty, 0x2}, 0x1c) sendmmsg(r0, &(0x7f0000000000), 0x4000000000001f2, 0x0) r2 = socket$packet(0x11, 0x2, 0x300) sendto$packet(r2, 0x0, 0x0, 0x0, &(0x7f0000000400)={0x11, 0x88a8, 0x0, 0x1, 0x0, 0x6, @local}, 0x14) executing program 4: r0 = syz_open_dev$dri(&(0x7f0000000000), 0x0, 0x0) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r0, 0xc02064b2, &(0x7f0000000040)={0x1, 0xd00, 0x6}) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r0, 0xc02064b2, &(0x7f0000000100)={0x1, 0x3, 0x9}) ioctl$DRM_IOCTL_PANTHOR_VM_CREATE(r0, 0xc0106441, &(0x7f0000000080)={0x0, 0x0, 0xffffffffffffffff}) socket$kcm(0xa, 0x2, 0x0) socket$nl_route(0x10, 0x3, 0x0) r1 = socket(0x10, 0x3, 0x0) getsockname$packet(r1, &(0x7f00000002c0)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000100)=0x14) sendmsg$nl_route(0xffffffffffffffff, &(0x7f0000000040)={0x0, 0x0, 0x0}, 0x0) sendmsg$IPSET_CMD_ADD(0xffffffffffffffff, 0x0, 0x0) sendmsg$IPSET_CMD_TEST(0xffffffffffffffff, &(0x7f0000000280)={0x0, 0x0, &(0x7f00000002c0)={&(0x7f0000000300)={0x48, 0xb, 0x6, 0x1, 0x0, 0x0, {0x2}, [@IPSET_ATTR_SETNAME={0x9, 0x2, 'syz1\x00'}, @IPSET_ATTR_DATA={0x28, 0x7, 0x0, 0x1, [@IPSET_ATTR_IP={0xc, 0x1, 0x0, 0x1, @IPSET_ATTR_IPADDR_IPV4={0x8, 0x1, 0x1, 0x0, @local}}, @IPSET_ATTR_PORT={0x6, 0x4, 0x1, 0x0, 0x5000}, @IPSET_ATTR_MARK={0x8, 0xa, 0x1, 0x0, 0xc}, @IPSET_ATTR_CIDR2={0x5, 0x15, 0x18}]}]}, 0x48}}, 0x0) socket$inet6_udp(0xa, 0x2, 0x0) socket(0x10, 0x803, 0x0) socket(0x10, 0x3, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./config\x00', 0x1ff) mount(0x0, &(0x7f0000000000)='./config\x00', &(0x7f0000000080)='configfs\x00', 0x0, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000140)='./config/usb_gadget/g1\x00', 0xbf) mkdirat(0xffffffffffffff9c, &(0x7f00000001c0)='./config/usb_gadget/g1/functions/uvc.0\x00', 0x1ff) mkdirat(0xffffffffffffff9c, &(0x7f0000000280)='./config/usb_gadget/g1/functions/uvc.0/streaming/mjpeg/m1\x00', 0x1ff) r2 = openat(0xffffffffffffff9c, &(0x7f00000002c0)='./config/usb_gadget/g1/functions/uvc.0/streaming/mjpeg/m1/bmaControls\x00', 0x2, 0x0) write(r2, &(0x7f0000000640)='12', 0x2) write$P9_RVERSION(r2, &(0x7f0000000180)={0x13, 0x65, 0xffff, 0x1017, 0xffffffffffffff96, '9P2000.L'}, 0x13) syz_usb_connect$midi(0x0, 0x4f, &(0x7f0000000280)=ANY=[], 0x0) r3 = socket$nl_route(0x10, 0x3, 0x0) ioctl$ifreq_SIOCGIFINDEX_vcan(r3, 0x8933, &(0x7f0000000040)={'vxcan0\x00'}) getuid() r4 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPSET_CMD_CREATE(r4, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000200)=ANY=[@ANYBLOB="600000000206010800000000000000000000000005000400000000000900020073797a31000000001400078008001240000000000500140008000000050005000a000000050001000600000011000300686173683a69702c706f7274"], 0x60}}, 0x24000800) r5 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPSET_CMD_ADD(r5, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000240)={&(0x7f0000000c80)=ANY=[@ANYBLOB="5c000000090601080000000000000000070000000900020073797a31000000000500010007000000340007801800018014000240fe8000000000000000000000000000bb060004400e1f00cd050007008800000006000540"], 0x5c}, 0x1, 0x0, 0x0, 0x10000042}, 0x90) program crashed: KASAN: slab-use-after-free Read in ep_open testing program (duration=2m31.5s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): [0, 11, 10, 30] detailed listing: executing program 3: executing program 3: mkdirat(0xffffffffffffff9c, &(0x7f0000000100)='./gadget\x00', 0x1ff) mount(0x0, &(0x7f0000000140)='./gadget\x00', &(0x7f0000000180)='gadgetfs\x00', 0x0, 0x0) r0 = openat(0xffffffffffffff9c, &(0x7f00000001c0)='./gadget/dummy_udc\x00', 0x2, 0x0) mprotect(&(0x7f0000362000/0x2000)=nil, 0x2000, 0x1) write(r0, &(0x7f0000000200)="000000000902190001010080320904000001ff000000070581024000000902190001010080320904000001ff00000007058102000200120100020000004034127856000100000001", 0x48) write(0xffffffffffffffff, &(0x7f00000005c0)="010000000705810240000007058102000200", 0x12) ioctl$sock_SIOCGIFINDEX(0xffffffffffffffff, 0x8933, &(0x7f0000000040)={'bridge0\x00'}) write$P9_RRENAME(0xffffffffffffffff, 0x0, 0x0) mmap(&(0x7f0000362000/0x4000)=nil, 0x4000, 0x0, 0x12, 0xffffffffffffffff, 0xfffff000) r1 = syz_clone(0x21000200, 0x0, 0x0, 0x0, 0x0, 0x0) rt_tgsigqueueinfo(r1, r1, 0x8, 0x0) executing program 0: r0 = socket(0x10, 0x3, 0x0) sendmsg$nl_route(0xffffffffffffffff, &(0x7f0000000300)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000100)=ANY=[@ANYBLOB="4800e80010000d0428bd7000fcdbff2500008000", @ANYRES32=r0, @ANYBLOB="1000000000000000280012800b00010062726964676500001800028005001900840000000c001e"], 0x48}}, 0x4084) sendmsg$nl_route(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000080)={&(0x7f00000001c0)=ANY=[@ANYBLOB="500000001000010425bbe5ad600027842cf52300", @ANYRES32=0x0, @ANYRESDEC=0x0, @ANYRES64=r0, @ANYRES16=r0], 0x50}, 0x1, 0x0, 0x0, 0x13d33d22c8a65c15}, 0x4008840) getsockopt$inet_sctp6_SCTP_NODELAY(r0, 0x84, 0x3, &(0x7f0000000280), &(0x7f00000002c0)=0x4) mkdirat(0xffffffffffffff9c, &(0x7f0000000040)='./mnt\x00', 0x1ff) mount$nfs(&(0x7f0000000080)=':27.0.0.1:/export\x00', &(0x7f00000000c0)='./mnt\x00', &(0x7f0000000180), 0x20800, &(0x7f0000000140)=ANY=[@ANYRES16=r0]) r1 = socket$inet6_icmp_raw(0xa, 0x3, 0x3a) bind$inet6(r1, &(0x7f00000001c0)={0xa, 0x4e20, 0xfffffffb, @empty, 0x2}, 0x1c) r2 = socket$packet(0x11, 0x2, 0x300) sendto$packet(r2, 0x0, 0x0, 0x0, &(0x7f0000000400)={0x11, 0x88a8, 0x0, 0x1, 0x0, 0x6, @local}, 0x14) executing program 4: r0 = syz_open_dev$dri(&(0x7f0000000000), 0x0, 0x0) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r0, 0xc02064b2, &(0x7f0000000040)={0x1, 0xd00, 0x6}) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r0, 0xc02064b2, &(0x7f0000000100)={0x1, 0x3, 0x9}) ioctl$DRM_IOCTL_PANTHOR_VM_CREATE(r0, 0xc0106441, &(0x7f0000000080)={0x0, 0x0, 0xffffffffffffffff}) socket$kcm(0xa, 0x2, 0x0) socket$nl_route(0x10, 0x3, 0x0) r1 = socket(0x10, 0x3, 0x0) getsockname$packet(r1, &(0x7f00000002c0)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000100)=0x14) sendmsg$nl_route(0xffffffffffffffff, &(0x7f0000000040)={0x0, 0x0, 0x0}, 0x0) sendmsg$IPSET_CMD_ADD(0xffffffffffffffff, 0x0, 0x0) sendmsg$IPSET_CMD_TEST(0xffffffffffffffff, &(0x7f0000000280)={0x0, 0x0, &(0x7f00000002c0)={&(0x7f0000000300)={0x48, 0xb, 0x6, 0x1, 0x0, 0x0, {0x2}, [@IPSET_ATTR_SETNAME={0x9, 0x2, 'syz1\x00'}, @IPSET_ATTR_DATA={0x28, 0x7, 0x0, 0x1, [@IPSET_ATTR_IP={0xc, 0x1, 0x0, 0x1, @IPSET_ATTR_IPADDR_IPV4={0x8, 0x1, 0x1, 0x0, @local}}, @IPSET_ATTR_PORT={0x6, 0x4, 0x1, 0x0, 0x5000}, @IPSET_ATTR_MARK={0x8, 0xa, 0x1, 0x0, 0xc}, @IPSET_ATTR_CIDR2={0x5, 0x15, 0x18}]}]}, 0x48}}, 0x0) socket$inet6_udp(0xa, 0x2, 0x0) socket(0x10, 0x803, 0x0) socket(0x10, 0x3, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./config\x00', 0x1ff) mount(0x0, &(0x7f0000000000)='./config\x00', &(0x7f0000000080)='configfs\x00', 0x0, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000140)='./config/usb_gadget/g1\x00', 0xbf) mkdirat(0xffffffffffffff9c, &(0x7f00000001c0)='./config/usb_gadget/g1/functions/uvc.0\x00', 0x1ff) mkdirat(0xffffffffffffff9c, &(0x7f0000000280)='./config/usb_gadget/g1/functions/uvc.0/streaming/mjpeg/m1\x00', 0x1ff) r2 = openat(0xffffffffffffff9c, &(0x7f00000002c0)='./config/usb_gadget/g1/functions/uvc.0/streaming/mjpeg/m1/bmaControls\x00', 0x2, 0x0) write(r2, &(0x7f0000000640)='12', 0x2) write$P9_RVERSION(r2, &(0x7f0000000180)={0x13, 0x65, 0xffff, 0x1017, 0xffffffffffffff96, '9P2000.L'}, 0x13) syz_usb_connect$midi(0x0, 0x4f, &(0x7f0000000280)=ANY=[], 0x0) r3 = socket$nl_route(0x10, 0x3, 0x0) ioctl$ifreq_SIOCGIFINDEX_vcan(r3, 0x8933, &(0x7f0000000040)={'vxcan0\x00'}) getuid() r4 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPSET_CMD_CREATE(r4, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000200)=ANY=[@ANYBLOB="600000000206010800000000000000000000000005000400000000000900020073797a31000000001400078008001240000000000500140008000000050005000a000000050001000600000011000300686173683a69702c706f7274"], 0x60}}, 0x24000800) r5 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPSET_CMD_ADD(r5, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000240)={&(0x7f0000000c80)=ANY=[@ANYBLOB="5c000000090601080000000000000000070000000900020073797a31000000000500010007000000340007801800018014000240fe8000000000000000000000000000bb060004400e1f00cd050007008800000006000540"], 0x5c}, 0x1, 0x0, 0x0, 0x10000042}, 0x90) program crashed: KASAN: slab-use-after-free Read in ep_open testing program (duration=2m31.5s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): [0, 11, 9, 30] detailed listing: executing program 3: executing program 3: mkdirat(0xffffffffffffff9c, &(0x7f0000000100)='./gadget\x00', 0x1ff) mount(0x0, &(0x7f0000000140)='./gadget\x00', &(0x7f0000000180)='gadgetfs\x00', 0x0, 0x0) r0 = openat(0xffffffffffffff9c, &(0x7f00000001c0)='./gadget/dummy_udc\x00', 0x2, 0x0) mprotect(&(0x7f0000362000/0x2000)=nil, 0x2000, 0x1) write(r0, &(0x7f0000000200)="000000000902190001010080320904000001ff000000070581024000000902190001010080320904000001ff00000007058102000200120100020000004034127856000100000001", 0x48) write(0xffffffffffffffff, &(0x7f00000005c0)="010000000705810240000007058102000200", 0x12) ioctl$sock_SIOCGIFINDEX(0xffffffffffffffff, 0x8933, &(0x7f0000000040)={'bridge0\x00'}) write$P9_RRENAME(0xffffffffffffffff, 0x0, 0x0) mmap(&(0x7f0000362000/0x4000)=nil, 0x4000, 0x0, 0x12, 0xffffffffffffffff, 0xfffff000) r1 = syz_clone(0x21000200, 0x0, 0x0, 0x0, 0x0, 0x0) rt_tgsigqueueinfo(r1, r1, 0x8, 0x0) executing program 0: r0 = socket(0x10, 0x3, 0x0) sendmsg$nl_route(0xffffffffffffffff, &(0x7f0000000300)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000100)=ANY=[@ANYBLOB="4800e80010000d0428bd7000fcdbff2500008000", @ANYRES32=r0, @ANYBLOB="1000000000000000280012800b00010062726964676500001800028005001900840000000c001e"], 0x48}}, 0x4084) sendmsg$nl_route(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000080)={&(0x7f00000001c0)=ANY=[@ANYBLOB="500000001000010425bbe5ad600027842cf52300", @ANYRES32=0x0, @ANYRESDEC=0x0, @ANYRES64=r0, @ANYRES16=r0], 0x50}, 0x1, 0x0, 0x0, 0x13d33d22c8a65c15}, 0x4008840) getsockopt$inet_sctp6_SCTP_NODELAY(r0, 0x84, 0x3, &(0x7f0000000280), &(0x7f00000002c0)=0x4) mkdirat(0xffffffffffffff9c, &(0x7f0000000040)='./mnt\x00', 0x1ff) mount$nfs(&(0x7f0000000080)=':27.0.0.1:/export\x00', &(0x7f00000000c0)='./mnt\x00', &(0x7f0000000180), 0x20800, &(0x7f0000000140)=ANY=[@ANYRES16=r0]) socket$inet6_icmp_raw(0xa, 0x3, 0x3a) r1 = socket$packet(0x11, 0x2, 0x300) sendto$packet(r1, 0x0, 0x0, 0x0, &(0x7f0000000400)={0x11, 0x88a8, 0x0, 0x1, 0x0, 0x6, @local}, 0x14) executing program 4: r0 = syz_open_dev$dri(&(0x7f0000000000), 0x0, 0x0) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r0, 0xc02064b2, &(0x7f0000000040)={0x1, 0xd00, 0x6}) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r0, 0xc02064b2, &(0x7f0000000100)={0x1, 0x3, 0x9}) ioctl$DRM_IOCTL_PANTHOR_VM_CREATE(r0, 0xc0106441, &(0x7f0000000080)={0x0, 0x0, 0xffffffffffffffff}) socket$kcm(0xa, 0x2, 0x0) socket$nl_route(0x10, 0x3, 0x0) r1 = socket(0x10, 0x3, 0x0) getsockname$packet(r1, &(0x7f00000002c0)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000100)=0x14) sendmsg$nl_route(0xffffffffffffffff, &(0x7f0000000040)={0x0, 0x0, 0x0}, 0x0) sendmsg$IPSET_CMD_ADD(0xffffffffffffffff, 0x0, 0x0) sendmsg$IPSET_CMD_TEST(0xffffffffffffffff, &(0x7f0000000280)={0x0, 0x0, &(0x7f00000002c0)={&(0x7f0000000300)={0x48, 0xb, 0x6, 0x1, 0x0, 0x0, {0x2}, [@IPSET_ATTR_SETNAME={0x9, 0x2, 'syz1\x00'}, @IPSET_ATTR_DATA={0x28, 0x7, 0x0, 0x1, [@IPSET_ATTR_IP={0xc, 0x1, 0x0, 0x1, @IPSET_ATTR_IPADDR_IPV4={0x8, 0x1, 0x1, 0x0, @local}}, @IPSET_ATTR_PORT={0x6, 0x4, 0x1, 0x0, 0x5000}, @IPSET_ATTR_MARK={0x8, 0xa, 0x1, 0x0, 0xc}, @IPSET_ATTR_CIDR2={0x5, 0x15, 0x18}]}]}, 0x48}}, 0x0) socket$inet6_udp(0xa, 0x2, 0x0) socket(0x10, 0x803, 0x0) socket(0x10, 0x3, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./config\x00', 0x1ff) mount(0x0, &(0x7f0000000000)='./config\x00', &(0x7f0000000080)='configfs\x00', 0x0, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000140)='./config/usb_gadget/g1\x00', 0xbf) mkdirat(0xffffffffffffff9c, &(0x7f00000001c0)='./config/usb_gadget/g1/functions/uvc.0\x00', 0x1ff) mkdirat(0xffffffffffffff9c, &(0x7f0000000280)='./config/usb_gadget/g1/functions/uvc.0/streaming/mjpeg/m1\x00', 0x1ff) r2 = openat(0xffffffffffffff9c, &(0x7f00000002c0)='./config/usb_gadget/g1/functions/uvc.0/streaming/mjpeg/m1/bmaControls\x00', 0x2, 0x0) write(r2, &(0x7f0000000640)='12', 0x2) write$P9_RVERSION(r2, &(0x7f0000000180)={0x13, 0x65, 0xffff, 0x1017, 0xffffffffffffff96, '9P2000.L'}, 0x13) syz_usb_connect$midi(0x0, 0x4f, &(0x7f0000000280)=ANY=[], 0x0) r3 = socket$nl_route(0x10, 0x3, 0x0) ioctl$ifreq_SIOCGIFINDEX_vcan(r3, 0x8933, &(0x7f0000000040)={'vxcan0\x00'}) getuid() r4 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPSET_CMD_CREATE(r4, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000200)=ANY=[@ANYBLOB="600000000206010800000000000000000000000005000400000000000900020073797a31000000001400078008001240000000000500140008000000050005000a000000050001000600000011000300686173683a69702c706f7274"], 0x60}}, 0x24000800) r5 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPSET_CMD_ADD(r5, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000240)={&(0x7f0000000c80)=ANY=[@ANYBLOB="5c000000090601080000000000000000070000000900020073797a31000000000500010007000000340007801800018014000240fe8000000000000000000000000000bb060004400e1f00cd050007008800000006000540"], 0x5c}, 0x1, 0x0, 0x0, 0x10000042}, 0x90) program did not crash testing program (duration=2m31.5s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): [0, 11, 9, 30] detailed listing: executing program 3: executing program 3: mkdirat(0xffffffffffffff9c, &(0x7f0000000100)='./gadget\x00', 0x1ff) mount(0x0, &(0x7f0000000140)='./gadget\x00', &(0x7f0000000180)='gadgetfs\x00', 0x0, 0x0) r0 = openat(0xffffffffffffff9c, &(0x7f00000001c0)='./gadget/dummy_udc\x00', 0x2, 0x0) mprotect(&(0x7f0000362000/0x2000)=nil, 0x2000, 0x1) write(r0, &(0x7f0000000200)="000000000902190001010080320904000001ff000000070581024000000902190001010080320904000001ff00000007058102000200120100020000004034127856000100000001", 0x48) write(0xffffffffffffffff, &(0x7f00000005c0)="010000000705810240000007058102000200", 0x12) ioctl$sock_SIOCGIFINDEX(0xffffffffffffffff, 0x8933, &(0x7f0000000040)={'bridge0\x00'}) write$P9_RRENAME(0xffffffffffffffff, 0x0, 0x0) mmap(&(0x7f0000362000/0x4000)=nil, 0x4000, 0x0, 0x12, 0xffffffffffffffff, 0xfffff000) r1 = syz_clone(0x21000200, 0x0, 0x0, 0x0, 0x0, 0x0) rt_tgsigqueueinfo(r1, r1, 0x8, 0x0) executing program 0: r0 = socket(0x10, 0x3, 0x0) sendmsg$nl_route(0xffffffffffffffff, &(0x7f0000000300)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000100)=ANY=[@ANYBLOB="4800e80010000d0428bd7000fcdbff2500008000", @ANYRES32=r0, @ANYBLOB="1000000000000000280012800b00010062726964676500001800028005001900840000000c001e"], 0x48}}, 0x4084) sendmsg$nl_route(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000080)={&(0x7f00000001c0)=ANY=[@ANYBLOB="500000001000010425bbe5ad600027842cf52300", @ANYRES32=0x0, @ANYRESDEC=0x0, @ANYRES64=r0, @ANYRES16=r0], 0x50}, 0x1, 0x0, 0x0, 0x13d33d22c8a65c15}, 0x4008840) getsockopt$inet_sctp6_SCTP_NODELAY(r0, 0x84, 0x3, &(0x7f0000000280), &(0x7f00000002c0)=0x4) mkdirat(0xffffffffffffff9c, &(0x7f0000000040)='./mnt\x00', 0x1ff) mount$nfs(&(0x7f0000000080)=':27.0.0.1:/export\x00', &(0x7f00000000c0)='./mnt\x00', &(0x7f0000000180), 0x20800, &(0x7f0000000140)=ANY=[@ANYRES16=r0]) bind$inet6(0xffffffffffffffff, &(0x7f00000001c0)={0xa, 0x4e20, 0xfffffffb, @empty, 0x2}, 0x1c) r1 = socket$packet(0x11, 0x2, 0x300) sendto$packet(r1, 0x0, 0x0, 0x0, &(0x7f0000000400)={0x11, 0x88a8, 0x0, 0x1, 0x0, 0x6, @local}, 0x14) executing program 4: r0 = syz_open_dev$dri(&(0x7f0000000000), 0x0, 0x0) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r0, 0xc02064b2, &(0x7f0000000040)={0x1, 0xd00, 0x6}) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r0, 0xc02064b2, &(0x7f0000000100)={0x1, 0x3, 0x9}) ioctl$DRM_IOCTL_PANTHOR_VM_CREATE(r0, 0xc0106441, &(0x7f0000000080)={0x0, 0x0, 0xffffffffffffffff}) socket$kcm(0xa, 0x2, 0x0) socket$nl_route(0x10, 0x3, 0x0) r1 = socket(0x10, 0x3, 0x0) getsockname$packet(r1, &(0x7f00000002c0)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000100)=0x14) sendmsg$nl_route(0xffffffffffffffff, &(0x7f0000000040)={0x0, 0x0, 0x0}, 0x0) sendmsg$IPSET_CMD_ADD(0xffffffffffffffff, 0x0, 0x0) sendmsg$IPSET_CMD_TEST(0xffffffffffffffff, &(0x7f0000000280)={0x0, 0x0, &(0x7f00000002c0)={&(0x7f0000000300)={0x48, 0xb, 0x6, 0x1, 0x0, 0x0, {0x2}, [@IPSET_ATTR_SETNAME={0x9, 0x2, 'syz1\x00'}, @IPSET_ATTR_DATA={0x28, 0x7, 0x0, 0x1, [@IPSET_ATTR_IP={0xc, 0x1, 0x0, 0x1, @IPSET_ATTR_IPADDR_IPV4={0x8, 0x1, 0x1, 0x0, @local}}, @IPSET_ATTR_PORT={0x6, 0x4, 0x1, 0x0, 0x5000}, @IPSET_ATTR_MARK={0x8, 0xa, 0x1, 0x0, 0xc}, @IPSET_ATTR_CIDR2={0x5, 0x15, 0x18}]}]}, 0x48}}, 0x0) socket$inet6_udp(0xa, 0x2, 0x0) socket(0x10, 0x803, 0x0) socket(0x10, 0x3, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./config\x00', 0x1ff) mount(0x0, &(0x7f0000000000)='./config\x00', &(0x7f0000000080)='configfs\x00', 0x0, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000140)='./config/usb_gadget/g1\x00', 0xbf) mkdirat(0xffffffffffffff9c, &(0x7f00000001c0)='./config/usb_gadget/g1/functions/uvc.0\x00', 0x1ff) mkdirat(0xffffffffffffff9c, &(0x7f0000000280)='./config/usb_gadget/g1/functions/uvc.0/streaming/mjpeg/m1\x00', 0x1ff) r2 = openat(0xffffffffffffff9c, &(0x7f00000002c0)='./config/usb_gadget/g1/functions/uvc.0/streaming/mjpeg/m1/bmaControls\x00', 0x2, 0x0) write(r2, &(0x7f0000000640)='12', 0x2) write$P9_RVERSION(r2, &(0x7f0000000180)={0x13, 0x65, 0xffff, 0x1017, 0xffffffffffffff96, '9P2000.L'}, 0x13) syz_usb_connect$midi(0x0, 0x4f, &(0x7f0000000280)=ANY=[], 0x0) r3 = socket$nl_route(0x10, 0x3, 0x0) ioctl$ifreq_SIOCGIFINDEX_vcan(r3, 0x8933, &(0x7f0000000040)={'vxcan0\x00'}) getuid() r4 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPSET_CMD_CREATE(r4, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000200)=ANY=[@ANYBLOB="600000000206010800000000000000000000000005000400000000000900020073797a31000000001400078008001240000000000500140008000000050005000a000000050001000600000011000300686173683a69702c706f7274"], 0x60}}, 0x24000800) r5 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPSET_CMD_ADD(r5, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000240)={&(0x7f0000000c80)=ANY=[@ANYBLOB="5c000000090601080000000000000000070000000900020073797a31000000000500010007000000340007801800018014000240fe8000000000000000000000000000bb060004400e1f00cd050007008800000006000540"], 0x5c}, 0x1, 0x0, 0x0, 0x10000042}, 0x90) program crashed: KASAN: slab-use-after-free Read in ep_open testing program (duration=2m31.5s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): [0, 11, 8, 30] detailed listing: executing program 3: executing program 3: mkdirat(0xffffffffffffff9c, &(0x7f0000000100)='./gadget\x00', 0x1ff) mount(0x0, &(0x7f0000000140)='./gadget\x00', &(0x7f0000000180)='gadgetfs\x00', 0x0, 0x0) r0 = openat(0xffffffffffffff9c, &(0x7f00000001c0)='./gadget/dummy_udc\x00', 0x2, 0x0) mprotect(&(0x7f0000362000/0x2000)=nil, 0x2000, 0x1) write(r0, &(0x7f0000000200)="000000000902190001010080320904000001ff000000070581024000000902190001010080320904000001ff00000007058102000200120100020000004034127856000100000001", 0x48) write(0xffffffffffffffff, &(0x7f00000005c0)="010000000705810240000007058102000200", 0x12) ioctl$sock_SIOCGIFINDEX(0xffffffffffffffff, 0x8933, &(0x7f0000000040)={'bridge0\x00'}) write$P9_RRENAME(0xffffffffffffffff, 0x0, 0x0) mmap(&(0x7f0000362000/0x4000)=nil, 0x4000, 0x0, 0x12, 0xffffffffffffffff, 0xfffff000) r1 = syz_clone(0x21000200, 0x0, 0x0, 0x0, 0x0, 0x0) rt_tgsigqueueinfo(r1, r1, 0x8, 0x0) executing program 0: r0 = socket(0x10, 0x3, 0x0) sendmsg$nl_route(0xffffffffffffffff, &(0x7f0000000300)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000100)=ANY=[@ANYBLOB="4800e80010000d0428bd7000fcdbff2500008000", @ANYRES32=r0, @ANYBLOB="1000000000000000280012800b00010062726964676500001800028005001900840000000c001e"], 0x48}}, 0x4084) sendmsg$nl_route(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000080)={&(0x7f00000001c0)=ANY=[@ANYBLOB="500000001000010425bbe5ad600027842cf52300", @ANYRES32=0x0, @ANYRESDEC=0x0, @ANYRES64=r0, @ANYRES16=r0], 0x50}, 0x1, 0x0, 0x0, 0x13d33d22c8a65c15}, 0x4008840) getsockopt$inet_sctp6_SCTP_NODELAY(r0, 0x84, 0x3, &(0x7f0000000280), &(0x7f00000002c0)=0x4) mkdirat(0xffffffffffffff9c, &(0x7f0000000040)='./mnt\x00', 0x1ff) bind$inet6(0xffffffffffffffff, &(0x7f00000001c0)={0xa, 0x4e20, 0xfffffffb, @empty, 0x2}, 0x1c) r1 = socket$packet(0x11, 0x2, 0x300) sendto$packet(r1, 0x0, 0x0, 0x0, &(0x7f0000000400)={0x11, 0x88a8, 0x0, 0x1, 0x0, 0x6, @local}, 0x14) executing program 4: r0 = syz_open_dev$dri(&(0x7f0000000000), 0x0, 0x0) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r0, 0xc02064b2, &(0x7f0000000040)={0x1, 0xd00, 0x6}) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r0, 0xc02064b2, &(0x7f0000000100)={0x1, 0x3, 0x9}) ioctl$DRM_IOCTL_PANTHOR_VM_CREATE(r0, 0xc0106441, &(0x7f0000000080)={0x0, 0x0, 0xffffffffffffffff}) socket$kcm(0xa, 0x2, 0x0) socket$nl_route(0x10, 0x3, 0x0) r1 = socket(0x10, 0x3, 0x0) getsockname$packet(r1, &(0x7f00000002c0)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000100)=0x14) sendmsg$nl_route(0xffffffffffffffff, &(0x7f0000000040)={0x0, 0x0, 0x0}, 0x0) sendmsg$IPSET_CMD_ADD(0xffffffffffffffff, 0x0, 0x0) sendmsg$IPSET_CMD_TEST(0xffffffffffffffff, &(0x7f0000000280)={0x0, 0x0, &(0x7f00000002c0)={&(0x7f0000000300)={0x48, 0xb, 0x6, 0x1, 0x0, 0x0, {0x2}, [@IPSET_ATTR_SETNAME={0x9, 0x2, 'syz1\x00'}, @IPSET_ATTR_DATA={0x28, 0x7, 0x0, 0x1, [@IPSET_ATTR_IP={0xc, 0x1, 0x0, 0x1, @IPSET_ATTR_IPADDR_IPV4={0x8, 0x1, 0x1, 0x0, @local}}, @IPSET_ATTR_PORT={0x6, 0x4, 0x1, 0x0, 0x5000}, @IPSET_ATTR_MARK={0x8, 0xa, 0x1, 0x0, 0xc}, @IPSET_ATTR_CIDR2={0x5, 0x15, 0x18}]}]}, 0x48}}, 0x0) socket$inet6_udp(0xa, 0x2, 0x0) socket(0x10, 0x803, 0x0) socket(0x10, 0x3, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./config\x00', 0x1ff) mount(0x0, &(0x7f0000000000)='./config\x00', &(0x7f0000000080)='configfs\x00', 0x0, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000140)='./config/usb_gadget/g1\x00', 0xbf) mkdirat(0xffffffffffffff9c, &(0x7f00000001c0)='./config/usb_gadget/g1/functions/uvc.0\x00', 0x1ff) mkdirat(0xffffffffffffff9c, &(0x7f0000000280)='./config/usb_gadget/g1/functions/uvc.0/streaming/mjpeg/m1\x00', 0x1ff) r2 = openat(0xffffffffffffff9c, &(0x7f00000002c0)='./config/usb_gadget/g1/functions/uvc.0/streaming/mjpeg/m1/bmaControls\x00', 0x2, 0x0) write(r2, &(0x7f0000000640)='12', 0x2) write$P9_RVERSION(r2, &(0x7f0000000180)={0x13, 0x65, 0xffff, 0x1017, 0xffffffffffffff96, '9P2000.L'}, 0x13) syz_usb_connect$midi(0x0, 0x4f, &(0x7f0000000280)=ANY=[], 0x0) r3 = socket$nl_route(0x10, 0x3, 0x0) ioctl$ifreq_SIOCGIFINDEX_vcan(r3, 0x8933, &(0x7f0000000040)={'vxcan0\x00'}) getuid() r4 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPSET_CMD_CREATE(r4, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000200)=ANY=[@ANYBLOB="600000000206010800000000000000000000000005000400000000000900020073797a31000000001400078008001240000000000500140008000000050005000a000000050001000600000011000300686173683a69702c706f7274"], 0x60}}, 0x24000800) r5 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPSET_CMD_ADD(r5, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000240)={&(0x7f0000000c80)=ANY=[@ANYBLOB="5c000000090601080000000000000000070000000900020073797a31000000000500010007000000340007801800018014000240fe8000000000000000000000000000bb060004400e1f00cd050007008800000006000540"], 0x5c}, 0x1, 0x0, 0x0, 0x10000042}, 0x90) program crashed: KASAN: slab-use-after-free Read in ep_open testing program (duration=2m31.5s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): [0, 11, 7, 30] detailed listing: executing program 3: executing program 3: mkdirat(0xffffffffffffff9c, &(0x7f0000000100)='./gadget\x00', 0x1ff) mount(0x0, &(0x7f0000000140)='./gadget\x00', &(0x7f0000000180)='gadgetfs\x00', 0x0, 0x0) r0 = openat(0xffffffffffffff9c, &(0x7f00000001c0)='./gadget/dummy_udc\x00', 0x2, 0x0) mprotect(&(0x7f0000362000/0x2000)=nil, 0x2000, 0x1) write(r0, &(0x7f0000000200)="000000000902190001010080320904000001ff000000070581024000000902190001010080320904000001ff00000007058102000200120100020000004034127856000100000001", 0x48) write(0xffffffffffffffff, &(0x7f00000005c0)="010000000705810240000007058102000200", 0x12) ioctl$sock_SIOCGIFINDEX(0xffffffffffffffff, 0x8933, &(0x7f0000000040)={'bridge0\x00'}) write$P9_RRENAME(0xffffffffffffffff, 0x0, 0x0) mmap(&(0x7f0000362000/0x4000)=nil, 0x4000, 0x0, 0x12, 0xffffffffffffffff, 0xfffff000) r1 = syz_clone(0x21000200, 0x0, 0x0, 0x0, 0x0, 0x0) rt_tgsigqueueinfo(r1, r1, 0x8, 0x0) executing program 0: r0 = socket(0x10, 0x3, 0x0) sendmsg$nl_route(0xffffffffffffffff, &(0x7f0000000300)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000100)=ANY=[@ANYBLOB="4800e80010000d0428bd7000fcdbff2500008000", @ANYRES32=r0, @ANYBLOB="1000000000000000280012800b00010062726964676500001800028005001900840000000c001e"], 0x48}}, 0x4084) sendmsg$nl_route(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000080)={&(0x7f00000001c0)=ANY=[@ANYBLOB="500000001000010425bbe5ad600027842cf52300", @ANYRES32=0x0, @ANYRESDEC=0x0, @ANYRES64=r0, @ANYRES16=r0], 0x50}, 0x1, 0x0, 0x0, 0x13d33d22c8a65c15}, 0x4008840) getsockopt$inet_sctp6_SCTP_NODELAY(r0, 0x84, 0x3, &(0x7f0000000280), &(0x7f00000002c0)=0x4) bind$inet6(0xffffffffffffffff, &(0x7f00000001c0)={0xa, 0x4e20, 0xfffffffb, @empty, 0x2}, 0x1c) r1 = socket$packet(0x11, 0x2, 0x300) sendto$packet(r1, 0x0, 0x0, 0x0, &(0x7f0000000400)={0x11, 0x88a8, 0x0, 0x1, 0x0, 0x6, @local}, 0x14) executing program 4: r0 = syz_open_dev$dri(&(0x7f0000000000), 0x0, 0x0) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r0, 0xc02064b2, &(0x7f0000000040)={0x1, 0xd00, 0x6}) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r0, 0xc02064b2, &(0x7f0000000100)={0x1, 0x3, 0x9}) ioctl$DRM_IOCTL_PANTHOR_VM_CREATE(r0, 0xc0106441, &(0x7f0000000080)={0x0, 0x0, 0xffffffffffffffff}) socket$kcm(0xa, 0x2, 0x0) socket$nl_route(0x10, 0x3, 0x0) r1 = socket(0x10, 0x3, 0x0) getsockname$packet(r1, &(0x7f00000002c0)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000100)=0x14) sendmsg$nl_route(0xffffffffffffffff, &(0x7f0000000040)={0x0, 0x0, 0x0}, 0x0) sendmsg$IPSET_CMD_ADD(0xffffffffffffffff, 0x0, 0x0) sendmsg$IPSET_CMD_TEST(0xffffffffffffffff, &(0x7f0000000280)={0x0, 0x0, &(0x7f00000002c0)={&(0x7f0000000300)={0x48, 0xb, 0x6, 0x1, 0x0, 0x0, {0x2}, [@IPSET_ATTR_SETNAME={0x9, 0x2, 'syz1\x00'}, @IPSET_ATTR_DATA={0x28, 0x7, 0x0, 0x1, [@IPSET_ATTR_IP={0xc, 0x1, 0x0, 0x1, @IPSET_ATTR_IPADDR_IPV4={0x8, 0x1, 0x1, 0x0, @local}}, @IPSET_ATTR_PORT={0x6, 0x4, 0x1, 0x0, 0x5000}, @IPSET_ATTR_MARK={0x8, 0xa, 0x1, 0x0, 0xc}, @IPSET_ATTR_CIDR2={0x5, 0x15, 0x18}]}]}, 0x48}}, 0x0) socket$inet6_udp(0xa, 0x2, 0x0) socket(0x10, 0x803, 0x0) socket(0x10, 0x3, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./config\x00', 0x1ff) mount(0x0, &(0x7f0000000000)='./config\x00', &(0x7f0000000080)='configfs\x00', 0x0, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000140)='./config/usb_gadget/g1\x00', 0xbf) mkdirat(0xffffffffffffff9c, &(0x7f00000001c0)='./config/usb_gadget/g1/functions/uvc.0\x00', 0x1ff) mkdirat(0xffffffffffffff9c, &(0x7f0000000280)='./config/usb_gadget/g1/functions/uvc.0/streaming/mjpeg/m1\x00', 0x1ff) r2 = openat(0xffffffffffffff9c, &(0x7f00000002c0)='./config/usb_gadget/g1/functions/uvc.0/streaming/mjpeg/m1/bmaControls\x00', 0x2, 0x0) write(r2, &(0x7f0000000640)='12', 0x2) write$P9_RVERSION(r2, &(0x7f0000000180)={0x13, 0x65, 0xffff, 0x1017, 0xffffffffffffff96, '9P2000.L'}, 0x13) syz_usb_connect$midi(0x0, 0x4f, &(0x7f0000000280)=ANY=[], 0x0) r3 = socket$nl_route(0x10, 0x3, 0x0) ioctl$ifreq_SIOCGIFINDEX_vcan(r3, 0x8933, &(0x7f0000000040)={'vxcan0\x00'}) getuid() r4 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPSET_CMD_CREATE(r4, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000200)=ANY=[@ANYBLOB="600000000206010800000000000000000000000005000400000000000900020073797a31000000001400078008001240000000000500140008000000050005000a000000050001000600000011000300686173683a69702c706f7274"], 0x60}}, 0x24000800) r5 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPSET_CMD_ADD(r5, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000240)={&(0x7f0000000c80)=ANY=[@ANYBLOB="5c000000090601080000000000000000070000000900020073797a31000000000500010007000000340007801800018014000240fe8000000000000000000000000000bb060004400e1f00cd050007008800000006000540"], 0x5c}, 0x1, 0x0, 0x0, 0x10000042}, 0x90) program did not crash testing program (duration=2m31.5s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): [0, 11, 7, 30] detailed listing: executing program 3: executing program 3: mkdirat(0xffffffffffffff9c, &(0x7f0000000100)='./gadget\x00', 0x1ff) mount(0x0, &(0x7f0000000140)='./gadget\x00', &(0x7f0000000180)='gadgetfs\x00', 0x0, 0x0) r0 = openat(0xffffffffffffff9c, &(0x7f00000001c0)='./gadget/dummy_udc\x00', 0x2, 0x0) mprotect(&(0x7f0000362000/0x2000)=nil, 0x2000, 0x1) write(r0, &(0x7f0000000200)="000000000902190001010080320904000001ff000000070581024000000902190001010080320904000001ff00000007058102000200120100020000004034127856000100000001", 0x48) write(0xffffffffffffffff, &(0x7f00000005c0)="010000000705810240000007058102000200", 0x12) ioctl$sock_SIOCGIFINDEX(0xffffffffffffffff, 0x8933, &(0x7f0000000040)={'bridge0\x00'}) write$P9_RRENAME(0xffffffffffffffff, 0x0, 0x0) mmap(&(0x7f0000362000/0x4000)=nil, 0x4000, 0x0, 0x12, 0xffffffffffffffff, 0xfffff000) r1 = syz_clone(0x21000200, 0x0, 0x0, 0x0, 0x0, 0x0) rt_tgsigqueueinfo(r1, r1, 0x8, 0x0) executing program 0: r0 = socket(0x10, 0x3, 0x0) sendmsg$nl_route(0xffffffffffffffff, &(0x7f0000000300)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000100)=ANY=[@ANYBLOB="4800e80010000d0428bd7000fcdbff2500008000", @ANYRES32=r0, @ANYBLOB="1000000000000000280012800b00010062726964676500001800028005001900840000000c001e"], 0x48}}, 0x4084) sendmsg$nl_route(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000080)={&(0x7f00000001c0)=ANY=[@ANYBLOB="500000001000010425bbe5ad600027842cf52300", @ANYRES32=0x0, @ANYRESDEC=0x0, @ANYRES64=r0, @ANYRES16=r0], 0x50}, 0x1, 0x0, 0x0, 0x13d33d22c8a65c15}, 0x4008840) mkdirat(0xffffffffffffff9c, &(0x7f0000000040)='./mnt\x00', 0x1ff) bind$inet6(0xffffffffffffffff, &(0x7f00000001c0)={0xa, 0x4e20, 0xfffffffb, @empty, 0x2}, 0x1c) r1 = socket$packet(0x11, 0x2, 0x300) sendto$packet(r1, 0x0, 0x0, 0x0, &(0x7f0000000400)={0x11, 0x88a8, 0x0, 0x1, 0x0, 0x6, @local}, 0x14) executing program 4: r0 = syz_open_dev$dri(&(0x7f0000000000), 0x0, 0x0) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r0, 0xc02064b2, &(0x7f0000000040)={0x1, 0xd00, 0x6}) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r0, 0xc02064b2, &(0x7f0000000100)={0x1, 0x3, 0x9}) ioctl$DRM_IOCTL_PANTHOR_VM_CREATE(r0, 0xc0106441, &(0x7f0000000080)={0x0, 0x0, 0xffffffffffffffff}) socket$kcm(0xa, 0x2, 0x0) socket$nl_route(0x10, 0x3, 0x0) r1 = socket(0x10, 0x3, 0x0) getsockname$packet(r1, &(0x7f00000002c0)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000100)=0x14) sendmsg$nl_route(0xffffffffffffffff, &(0x7f0000000040)={0x0, 0x0, 0x0}, 0x0) sendmsg$IPSET_CMD_ADD(0xffffffffffffffff, 0x0, 0x0) sendmsg$IPSET_CMD_TEST(0xffffffffffffffff, &(0x7f0000000280)={0x0, 0x0, &(0x7f00000002c0)={&(0x7f0000000300)={0x48, 0xb, 0x6, 0x1, 0x0, 0x0, {0x2}, [@IPSET_ATTR_SETNAME={0x9, 0x2, 'syz1\x00'}, @IPSET_ATTR_DATA={0x28, 0x7, 0x0, 0x1, [@IPSET_ATTR_IP={0xc, 0x1, 0x0, 0x1, @IPSET_ATTR_IPADDR_IPV4={0x8, 0x1, 0x1, 0x0, @local}}, @IPSET_ATTR_PORT={0x6, 0x4, 0x1, 0x0, 0x5000}, @IPSET_ATTR_MARK={0x8, 0xa, 0x1, 0x0, 0xc}, @IPSET_ATTR_CIDR2={0x5, 0x15, 0x18}]}]}, 0x48}}, 0x0) socket$inet6_udp(0xa, 0x2, 0x0) socket(0x10, 0x803, 0x0) socket(0x10, 0x3, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./config\x00', 0x1ff) mount(0x0, &(0x7f0000000000)='./config\x00', &(0x7f0000000080)='configfs\x00', 0x0, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000140)='./config/usb_gadget/g1\x00', 0xbf) mkdirat(0xffffffffffffff9c, &(0x7f00000001c0)='./config/usb_gadget/g1/functions/uvc.0\x00', 0x1ff) mkdirat(0xffffffffffffff9c, &(0x7f0000000280)='./config/usb_gadget/g1/functions/uvc.0/streaming/mjpeg/m1\x00', 0x1ff) r2 = openat(0xffffffffffffff9c, &(0x7f00000002c0)='./config/usb_gadget/g1/functions/uvc.0/streaming/mjpeg/m1/bmaControls\x00', 0x2, 0x0) write(r2, &(0x7f0000000640)='12', 0x2) write$P9_RVERSION(r2, &(0x7f0000000180)={0x13, 0x65, 0xffff, 0x1017, 0xffffffffffffff96, '9P2000.L'}, 0x13) syz_usb_connect$midi(0x0, 0x4f, &(0x7f0000000280)=ANY=[], 0x0) r3 = socket$nl_route(0x10, 0x3, 0x0) ioctl$ifreq_SIOCGIFINDEX_vcan(r3, 0x8933, &(0x7f0000000040)={'vxcan0\x00'}) getuid() r4 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPSET_CMD_CREATE(r4, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000200)=ANY=[@ANYBLOB="600000000206010800000000000000000000000005000400000000000900020073797a31000000001400078008001240000000000500140008000000050005000a000000050001000600000011000300686173683a69702c706f7274"], 0x60}}, 0x24000800) r5 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPSET_CMD_ADD(r5, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000240)={&(0x7f0000000c80)=ANY=[@ANYBLOB="5c000000090601080000000000000000070000000900020073797a31000000000500010007000000340007801800018014000240fe8000000000000000000000000000bb060004400e1f00cd050007008800000006000540"], 0x5c}, 0x1, 0x0, 0x0, 0x10000042}, 0x90) program crashed: KASAN: slab-use-after-free Read in ep_open testing program (duration=2m31.5s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): [0, 11, 6, 30] detailed listing: executing program 3: executing program 3: mkdirat(0xffffffffffffff9c, &(0x7f0000000100)='./gadget\x00', 0x1ff) mount(0x0, &(0x7f0000000140)='./gadget\x00', &(0x7f0000000180)='gadgetfs\x00', 0x0, 0x0) r0 = openat(0xffffffffffffff9c, &(0x7f00000001c0)='./gadget/dummy_udc\x00', 0x2, 0x0) mprotect(&(0x7f0000362000/0x2000)=nil, 0x2000, 0x1) write(r0, &(0x7f0000000200)="000000000902190001010080320904000001ff000000070581024000000902190001010080320904000001ff00000007058102000200120100020000004034127856000100000001", 0x48) write(0xffffffffffffffff, &(0x7f00000005c0)="010000000705810240000007058102000200", 0x12) ioctl$sock_SIOCGIFINDEX(0xffffffffffffffff, 0x8933, &(0x7f0000000040)={'bridge0\x00'}) write$P9_RRENAME(0xffffffffffffffff, 0x0, 0x0) mmap(&(0x7f0000362000/0x4000)=nil, 0x4000, 0x0, 0x12, 0xffffffffffffffff, 0xfffff000) r1 = syz_clone(0x21000200, 0x0, 0x0, 0x0, 0x0, 0x0) rt_tgsigqueueinfo(r1, r1, 0x8, 0x0) executing program 0: r0 = socket(0x10, 0x3, 0x0) sendmsg$nl_route(0xffffffffffffffff, &(0x7f0000000300)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000100)=ANY=[@ANYBLOB="4800e80010000d0428bd7000fcdbff2500008000", @ANYRES32=r0, @ANYBLOB="1000000000000000280012800b00010062726964676500001800028005001900840000000c001e"], 0x48}}, 0x4084) mkdirat(0xffffffffffffff9c, &(0x7f0000000040)='./mnt\x00', 0x1ff) bind$inet6(0xffffffffffffffff, &(0x7f00000001c0)={0xa, 0x4e20, 0xfffffffb, @empty, 0x2}, 0x1c) r1 = socket$packet(0x11, 0x2, 0x300) sendto$packet(r1, 0x0, 0x0, 0x0, &(0x7f0000000400)={0x11, 0x88a8, 0x0, 0x1, 0x0, 0x6, @local}, 0x14) executing program 4: r0 = syz_open_dev$dri(&(0x7f0000000000), 0x0, 0x0) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r0, 0xc02064b2, &(0x7f0000000040)={0x1, 0xd00, 0x6}) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r0, 0xc02064b2, &(0x7f0000000100)={0x1, 0x3, 0x9}) ioctl$DRM_IOCTL_PANTHOR_VM_CREATE(r0, 0xc0106441, &(0x7f0000000080)={0x0, 0x0, 0xffffffffffffffff}) socket$kcm(0xa, 0x2, 0x0) socket$nl_route(0x10, 0x3, 0x0) r1 = socket(0x10, 0x3, 0x0) getsockname$packet(r1, &(0x7f00000002c0)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000100)=0x14) sendmsg$nl_route(0xffffffffffffffff, &(0x7f0000000040)={0x0, 0x0, 0x0}, 0x0) sendmsg$IPSET_CMD_ADD(0xffffffffffffffff, 0x0, 0x0) sendmsg$IPSET_CMD_TEST(0xffffffffffffffff, &(0x7f0000000280)={0x0, 0x0, &(0x7f00000002c0)={&(0x7f0000000300)={0x48, 0xb, 0x6, 0x1, 0x0, 0x0, {0x2}, [@IPSET_ATTR_SETNAME={0x9, 0x2, 'syz1\x00'}, @IPSET_ATTR_DATA={0x28, 0x7, 0x0, 0x1, [@IPSET_ATTR_IP={0xc, 0x1, 0x0, 0x1, @IPSET_ATTR_IPADDR_IPV4={0x8, 0x1, 0x1, 0x0, @local}}, @IPSET_ATTR_PORT={0x6, 0x4, 0x1, 0x0, 0x5000}, @IPSET_ATTR_MARK={0x8, 0xa, 0x1, 0x0, 0xc}, @IPSET_ATTR_CIDR2={0x5, 0x15, 0x18}]}]}, 0x48}}, 0x0) socket$inet6_udp(0xa, 0x2, 0x0) socket(0x10, 0x803, 0x0) socket(0x10, 0x3, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./config\x00', 0x1ff) mount(0x0, &(0x7f0000000000)='./config\x00', &(0x7f0000000080)='configfs\x00', 0x0, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000140)='./config/usb_gadget/g1\x00', 0xbf) mkdirat(0xffffffffffffff9c, &(0x7f00000001c0)='./config/usb_gadget/g1/functions/uvc.0\x00', 0x1ff) mkdirat(0xffffffffffffff9c, &(0x7f0000000280)='./config/usb_gadget/g1/functions/uvc.0/streaming/mjpeg/m1\x00', 0x1ff) r2 = openat(0xffffffffffffff9c, &(0x7f00000002c0)='./config/usb_gadget/g1/functions/uvc.0/streaming/mjpeg/m1/bmaControls\x00', 0x2, 0x0) write(r2, &(0x7f0000000640)='12', 0x2) write$P9_RVERSION(r2, &(0x7f0000000180)={0x13, 0x65, 0xffff, 0x1017, 0xffffffffffffff96, '9P2000.L'}, 0x13) syz_usb_connect$midi(0x0, 0x4f, &(0x7f0000000280)=ANY=[], 0x0) r3 = socket$nl_route(0x10, 0x3, 0x0) ioctl$ifreq_SIOCGIFINDEX_vcan(r3, 0x8933, &(0x7f0000000040)={'vxcan0\x00'}) getuid() r4 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPSET_CMD_CREATE(r4, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000200)=ANY=[@ANYBLOB="600000000206010800000000000000000000000005000400000000000900020073797a31000000001400078008001240000000000500140008000000050005000a000000050001000600000011000300686173683a69702c706f7274"], 0x60}}, 0x24000800) r5 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPSET_CMD_ADD(r5, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000240)={&(0x7f0000000c80)=ANY=[@ANYBLOB="5c000000090601080000000000000000070000000900020073797a31000000000500010007000000340007801800018014000240fe8000000000000000000000000000bb060004400e1f00cd050007008800000006000540"], 0x5c}, 0x1, 0x0, 0x0, 0x10000042}, 0x90) program crashed: KASAN: slab-use-after-free Read in ep_open testing program (duration=2m31.5s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): [0, 11, 5, 30] detailed listing: executing program 3: executing program 3: mkdirat(0xffffffffffffff9c, &(0x7f0000000100)='./gadget\x00', 0x1ff) mount(0x0, &(0x7f0000000140)='./gadget\x00', &(0x7f0000000180)='gadgetfs\x00', 0x0, 0x0) r0 = openat(0xffffffffffffff9c, &(0x7f00000001c0)='./gadget/dummy_udc\x00', 0x2, 0x0) mprotect(&(0x7f0000362000/0x2000)=nil, 0x2000, 0x1) write(r0, &(0x7f0000000200)="000000000902190001010080320904000001ff000000070581024000000902190001010080320904000001ff00000007058102000200120100020000004034127856000100000001", 0x48) write(0xffffffffffffffff, &(0x7f00000005c0)="010000000705810240000007058102000200", 0x12) ioctl$sock_SIOCGIFINDEX(0xffffffffffffffff, 0x8933, &(0x7f0000000040)={'bridge0\x00'}) write$P9_RRENAME(0xffffffffffffffff, 0x0, 0x0) mmap(&(0x7f0000362000/0x4000)=nil, 0x4000, 0x0, 0x12, 0xffffffffffffffff, 0xfffff000) r1 = syz_clone(0x21000200, 0x0, 0x0, 0x0, 0x0, 0x0) rt_tgsigqueueinfo(r1, r1, 0x8, 0x0) executing program 0: socket(0x10, 0x3, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000040)='./mnt\x00', 0x1ff) bind$inet6(0xffffffffffffffff, &(0x7f00000001c0)={0xa, 0x4e20, 0xfffffffb, @empty, 0x2}, 0x1c) r0 = socket$packet(0x11, 0x2, 0x300) sendto$packet(r0, 0x0, 0x0, 0x0, &(0x7f0000000400)={0x11, 0x88a8, 0x0, 0x1, 0x0, 0x6, @local}, 0x14) executing program 4: r0 = syz_open_dev$dri(&(0x7f0000000000), 0x0, 0x0) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r0, 0xc02064b2, &(0x7f0000000040)={0x1, 0xd00, 0x6}) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r0, 0xc02064b2, &(0x7f0000000100)={0x1, 0x3, 0x9}) ioctl$DRM_IOCTL_PANTHOR_VM_CREATE(r0, 0xc0106441, &(0x7f0000000080)={0x0, 0x0, 0xffffffffffffffff}) socket$kcm(0xa, 0x2, 0x0) socket$nl_route(0x10, 0x3, 0x0) r1 = socket(0x10, 0x3, 0x0) getsockname$packet(r1, &(0x7f00000002c0)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000100)=0x14) sendmsg$nl_route(0xffffffffffffffff, &(0x7f0000000040)={0x0, 0x0, 0x0}, 0x0) sendmsg$IPSET_CMD_ADD(0xffffffffffffffff, 0x0, 0x0) sendmsg$IPSET_CMD_TEST(0xffffffffffffffff, &(0x7f0000000280)={0x0, 0x0, &(0x7f00000002c0)={&(0x7f0000000300)={0x48, 0xb, 0x6, 0x1, 0x0, 0x0, {0x2}, [@IPSET_ATTR_SETNAME={0x9, 0x2, 'syz1\x00'}, @IPSET_ATTR_DATA={0x28, 0x7, 0x0, 0x1, [@IPSET_ATTR_IP={0xc, 0x1, 0x0, 0x1, @IPSET_ATTR_IPADDR_IPV4={0x8, 0x1, 0x1, 0x0, @local}}, @IPSET_ATTR_PORT={0x6, 0x4, 0x1, 0x0, 0x5000}, @IPSET_ATTR_MARK={0x8, 0xa, 0x1, 0x0, 0xc}, @IPSET_ATTR_CIDR2={0x5, 0x15, 0x18}]}]}, 0x48}}, 0x0) socket$inet6_udp(0xa, 0x2, 0x0) socket(0x10, 0x803, 0x0) socket(0x10, 0x3, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./config\x00', 0x1ff) mount(0x0, &(0x7f0000000000)='./config\x00', &(0x7f0000000080)='configfs\x00', 0x0, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000140)='./config/usb_gadget/g1\x00', 0xbf) mkdirat(0xffffffffffffff9c, &(0x7f00000001c0)='./config/usb_gadget/g1/functions/uvc.0\x00', 0x1ff) mkdirat(0xffffffffffffff9c, &(0x7f0000000280)='./config/usb_gadget/g1/functions/uvc.0/streaming/mjpeg/m1\x00', 0x1ff) r2 = openat(0xffffffffffffff9c, &(0x7f00000002c0)='./config/usb_gadget/g1/functions/uvc.0/streaming/mjpeg/m1/bmaControls\x00', 0x2, 0x0) write(r2, &(0x7f0000000640)='12', 0x2) write$P9_RVERSION(r2, &(0x7f0000000180)={0x13, 0x65, 0xffff, 0x1017, 0xffffffffffffff96, '9P2000.L'}, 0x13) syz_usb_connect$midi(0x0, 0x4f, &(0x7f0000000280)=ANY=[], 0x0) r3 = socket$nl_route(0x10, 0x3, 0x0) ioctl$ifreq_SIOCGIFINDEX_vcan(r3, 0x8933, &(0x7f0000000040)={'vxcan0\x00'}) getuid() r4 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPSET_CMD_CREATE(r4, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000200)=ANY=[@ANYBLOB="600000000206010800000000000000000000000005000400000000000900020073797a31000000001400078008001240000000000500140008000000050005000a000000050001000600000011000300686173683a69702c706f7274"], 0x60}}, 0x24000800) r5 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPSET_CMD_ADD(r5, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000240)={&(0x7f0000000c80)=ANY=[@ANYBLOB="5c000000090601080000000000000000070000000900020073797a31000000000500010007000000340007801800018014000240fe8000000000000000000000000000bb060004400e1f00cd050007008800000006000540"], 0x5c}, 0x1, 0x0, 0x0, 0x10000042}, 0x90) program crashed: KASAN: slab-use-after-free Read in ep_open testing program (duration=2m31.5s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): [0, 11, 4, 30] detailed listing: executing program 3: executing program 3: mkdirat(0xffffffffffffff9c, &(0x7f0000000100)='./gadget\x00', 0x1ff) mount(0x0, &(0x7f0000000140)='./gadget\x00', &(0x7f0000000180)='gadgetfs\x00', 0x0, 0x0) r0 = openat(0xffffffffffffff9c, &(0x7f00000001c0)='./gadget/dummy_udc\x00', 0x2, 0x0) mprotect(&(0x7f0000362000/0x2000)=nil, 0x2000, 0x1) write(r0, &(0x7f0000000200)="000000000902190001010080320904000001ff000000070581024000000902190001010080320904000001ff00000007058102000200120100020000004034127856000100000001", 0x48) write(0xffffffffffffffff, &(0x7f00000005c0)="010000000705810240000007058102000200", 0x12) ioctl$sock_SIOCGIFINDEX(0xffffffffffffffff, 0x8933, &(0x7f0000000040)={'bridge0\x00'}) write$P9_RRENAME(0xffffffffffffffff, 0x0, 0x0) mmap(&(0x7f0000362000/0x4000)=nil, 0x4000, 0x0, 0x12, 0xffffffffffffffff, 0xfffff000) r1 = syz_clone(0x21000200, 0x0, 0x0, 0x0, 0x0, 0x0) rt_tgsigqueueinfo(r1, r1, 0x8, 0x0) executing program 0: mkdirat(0xffffffffffffff9c, &(0x7f0000000040)='./mnt\x00', 0x1ff) bind$inet6(0xffffffffffffffff, &(0x7f00000001c0)={0xa, 0x4e20, 0xfffffffb, @empty, 0x2}, 0x1c) r0 = socket$packet(0x11, 0x2, 0x300) sendto$packet(r0, 0x0, 0x0, 0x0, &(0x7f0000000400)={0x11, 0x88a8, 0x0, 0x1, 0x0, 0x6, @local}, 0x14) executing program 4: r0 = syz_open_dev$dri(&(0x7f0000000000), 0x0, 0x0) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r0, 0xc02064b2, &(0x7f0000000040)={0x1, 0xd00, 0x6}) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r0, 0xc02064b2, &(0x7f0000000100)={0x1, 0x3, 0x9}) ioctl$DRM_IOCTL_PANTHOR_VM_CREATE(r0, 0xc0106441, &(0x7f0000000080)={0x0, 0x0, 0xffffffffffffffff}) socket$kcm(0xa, 0x2, 0x0) socket$nl_route(0x10, 0x3, 0x0) r1 = socket(0x10, 0x3, 0x0) getsockname$packet(r1, &(0x7f00000002c0)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000100)=0x14) sendmsg$nl_route(0xffffffffffffffff, &(0x7f0000000040)={0x0, 0x0, 0x0}, 0x0) sendmsg$IPSET_CMD_ADD(0xffffffffffffffff, 0x0, 0x0) sendmsg$IPSET_CMD_TEST(0xffffffffffffffff, &(0x7f0000000280)={0x0, 0x0, &(0x7f00000002c0)={&(0x7f0000000300)={0x48, 0xb, 0x6, 0x1, 0x0, 0x0, {0x2}, [@IPSET_ATTR_SETNAME={0x9, 0x2, 'syz1\x00'}, @IPSET_ATTR_DATA={0x28, 0x7, 0x0, 0x1, [@IPSET_ATTR_IP={0xc, 0x1, 0x0, 0x1, @IPSET_ATTR_IPADDR_IPV4={0x8, 0x1, 0x1, 0x0, @local}}, @IPSET_ATTR_PORT={0x6, 0x4, 0x1, 0x0, 0x5000}, @IPSET_ATTR_MARK={0x8, 0xa, 0x1, 0x0, 0xc}, @IPSET_ATTR_CIDR2={0x5, 0x15, 0x18}]}]}, 0x48}}, 0x0) socket$inet6_udp(0xa, 0x2, 0x0) socket(0x10, 0x803, 0x0) socket(0x10, 0x3, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./config\x00', 0x1ff) mount(0x0, &(0x7f0000000000)='./config\x00', &(0x7f0000000080)='configfs\x00', 0x0, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000140)='./config/usb_gadget/g1\x00', 0xbf) mkdirat(0xffffffffffffff9c, &(0x7f00000001c0)='./config/usb_gadget/g1/functions/uvc.0\x00', 0x1ff) mkdirat(0xffffffffffffff9c, &(0x7f0000000280)='./config/usb_gadget/g1/functions/uvc.0/streaming/mjpeg/m1\x00', 0x1ff) r2 = openat(0xffffffffffffff9c, &(0x7f00000002c0)='./config/usb_gadget/g1/functions/uvc.0/streaming/mjpeg/m1/bmaControls\x00', 0x2, 0x0) write(r2, &(0x7f0000000640)='12', 0x2) write$P9_RVERSION(r2, &(0x7f0000000180)={0x13, 0x65, 0xffff, 0x1017, 0xffffffffffffff96, '9P2000.L'}, 0x13) syz_usb_connect$midi(0x0, 0x4f, &(0x7f0000000280)=ANY=[], 0x0) r3 = socket$nl_route(0x10, 0x3, 0x0) ioctl$ifreq_SIOCGIFINDEX_vcan(r3, 0x8933, &(0x7f0000000040)={'vxcan0\x00'}) getuid() r4 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPSET_CMD_CREATE(r4, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000200)=ANY=[@ANYBLOB="600000000206010800000000000000000000000005000400000000000900020073797a31000000001400078008001240000000000500140008000000050005000a000000050001000600000011000300686173683a69702c706f7274"], 0x60}}, 0x24000800) r5 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPSET_CMD_ADD(r5, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000240)={&(0x7f0000000c80)=ANY=[@ANYBLOB="5c000000090601080000000000000000070000000900020073797a31000000000500010007000000340007801800018014000240fe8000000000000000000000000000bb060004400e1f00cd050007008800000006000540"], 0x5c}, 0x1, 0x0, 0x0, 0x10000042}, 0x90) program crashed: KASAN: slab-use-after-free Read in ep_open minimized 19 calls -> 4 calls minimizing program #3 before concatenation testing program (duration=2m31.5s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): [0, 11, 4, 29] detailed listing: executing program 3: executing program 3: mkdirat(0xffffffffffffff9c, &(0x7f0000000100)='./gadget\x00', 0x1ff) mount(0x0, &(0x7f0000000140)='./gadget\x00', &(0x7f0000000180)='gadgetfs\x00', 0x0, 0x0) r0 = openat(0xffffffffffffff9c, &(0x7f00000001c0)='./gadget/dummy_udc\x00', 0x2, 0x0) mprotect(&(0x7f0000362000/0x2000)=nil, 0x2000, 0x1) write(r0, &(0x7f0000000200)="000000000902190001010080320904000001ff000000070581024000000902190001010080320904000001ff00000007058102000200120100020000004034127856000100000001", 0x48) write(0xffffffffffffffff, &(0x7f00000005c0)="010000000705810240000007058102000200", 0x12) ioctl$sock_SIOCGIFINDEX(0xffffffffffffffff, 0x8933, &(0x7f0000000040)={'bridge0\x00'}) write$P9_RRENAME(0xffffffffffffffff, 0x0, 0x0) mmap(&(0x7f0000362000/0x4000)=nil, 0x4000, 0x0, 0x12, 0xffffffffffffffff, 0xfffff000) r1 = syz_clone(0x21000200, 0x0, 0x0, 0x0, 0x0, 0x0) rt_tgsigqueueinfo(r1, r1, 0x8, 0x0) executing program 8: mkdirat(0xffffffffffffff9c, &(0x7f0000000040)='./mnt\x00', 0x1ff) bind$inet6(0xffffffffffffffff, &(0x7f00000001c0)={0xa, 0x4e20, 0xfffffffb, @empty, 0x2}, 0x1c) r0 = socket$packet(0x11, 0x2, 0x300) sendto$packet(r0, 0x0, 0x0, 0x0, &(0x7f0000000400)={0x11, 0x88a8, 0x0, 0x1, 0x0, 0x6, @local}, 0x14) executing program 0: r0 = syz_open_dev$dri(&(0x7f0000000000), 0x0, 0x0) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r0, 0xc02064b2, &(0x7f0000000040)={0x1, 0xd00, 0x6}) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r0, 0xc02064b2, &(0x7f0000000100)={0x1, 0x3, 0x9}) ioctl$DRM_IOCTL_PANTHOR_VM_CREATE(r0, 0xc0106441, &(0x7f0000000080)={0x0, 0x0, 0xffffffffffffffff}) socket$kcm(0xa, 0x2, 0x0) socket$nl_route(0x10, 0x3, 0x0) r1 = socket(0x10, 0x3, 0x0) getsockname$packet(r1, &(0x7f00000002c0)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000100)=0x14) sendmsg$nl_route(0xffffffffffffffff, &(0x7f0000000040)={0x0, 0x0, 0x0}, 0x0) sendmsg$IPSET_CMD_ADD(0xffffffffffffffff, 0x0, 0x0) sendmsg$IPSET_CMD_TEST(0xffffffffffffffff, &(0x7f0000000280)={0x0, 0x0, &(0x7f00000002c0)={&(0x7f0000000300)={0x48, 0xb, 0x6, 0x1, 0x0, 0x0, {0x2}, [@IPSET_ATTR_SETNAME={0x9, 0x2, 'syz1\x00'}, @IPSET_ATTR_DATA={0x28, 0x7, 0x0, 0x1, [@IPSET_ATTR_IP={0xc, 0x1, 0x0, 0x1, @IPSET_ATTR_IPADDR_IPV4={0x8, 0x1, 0x1, 0x0, @local}}, @IPSET_ATTR_PORT={0x6, 0x4, 0x1, 0x0, 0x5000}, @IPSET_ATTR_MARK={0x8, 0xa, 0x1, 0x0, 0xc}, @IPSET_ATTR_CIDR2={0x5, 0x15, 0x18}]}]}, 0x48}}, 0x0) socket$inet6_udp(0xa, 0x2, 0x0) socket(0x10, 0x803, 0x0) socket(0x10, 0x3, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./config\x00', 0x1ff) mount(0x0, &(0x7f0000000000)='./config\x00', &(0x7f0000000080)='configfs\x00', 0x0, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000140)='./config/usb_gadget/g1\x00', 0xbf) mkdirat(0xffffffffffffff9c, &(0x7f00000001c0)='./config/usb_gadget/g1/functions/uvc.0\x00', 0x1ff) mkdirat(0xffffffffffffff9c, &(0x7f0000000280)='./config/usb_gadget/g1/functions/uvc.0/streaming/mjpeg/m1\x00', 0x1ff) r2 = openat(0xffffffffffffff9c, &(0x7f00000002c0)='./config/usb_gadget/g1/functions/uvc.0/streaming/mjpeg/m1/bmaControls\x00', 0x2, 0x0) write(r2, &(0x7f0000000640)='12', 0x2) write$P9_RVERSION(r2, &(0x7f0000000180)={0x13, 0x65, 0xffff, 0x1017, 0xffffffffffffff96, '9P2000.L'}, 0x13) syz_usb_connect$midi(0x0, 0x4f, &(0x7f0000000280)=ANY=[], 0x0) r3 = socket$nl_route(0x10, 0x3, 0x0) ioctl$ifreq_SIOCGIFINDEX_vcan(r3, 0x8933, &(0x7f0000000040)={'vxcan0\x00'}) getuid() r4 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPSET_CMD_CREATE(r4, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000200)=ANY=[@ANYBLOB="600000000206010800000000000000000000000005000400000000000900020073797a31000000001400078008001240000000000500140008000000050005000a000000050001000600000011000300686173683a69702c706f7274"], 0x60}}, 0x24000800) socket$nl_netfilter(0x10, 0x3, 0xc) program crashed: KASAN: slab-use-after-free Read in ep_open testing program (duration=2m31.5s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): [0, 11, 4, 28] detailed listing: executing program 3: executing program 3: mkdirat(0xffffffffffffff9c, &(0x7f0000000100)='./gadget\x00', 0x1ff) mount(0x0, &(0x7f0000000140)='./gadget\x00', &(0x7f0000000180)='gadgetfs\x00', 0x0, 0x0) r0 = openat(0xffffffffffffff9c, &(0x7f00000001c0)='./gadget/dummy_udc\x00', 0x2, 0x0) mprotect(&(0x7f0000362000/0x2000)=nil, 0x2000, 0x1) write(r0, &(0x7f0000000200)="000000000902190001010080320904000001ff000000070581024000000902190001010080320904000001ff00000007058102000200120100020000004034127856000100000001", 0x48) write(0xffffffffffffffff, &(0x7f00000005c0)="010000000705810240000007058102000200", 0x12) ioctl$sock_SIOCGIFINDEX(0xffffffffffffffff, 0x8933, &(0x7f0000000040)={'bridge0\x00'}) write$P9_RRENAME(0xffffffffffffffff, 0x0, 0x0) mmap(&(0x7f0000362000/0x4000)=nil, 0x4000, 0x0, 0x12, 0xffffffffffffffff, 0xfffff000) r1 = syz_clone(0x21000200, 0x0, 0x0, 0x0, 0x0, 0x0) rt_tgsigqueueinfo(r1, r1, 0x8, 0x0) executing program 8: mkdirat(0xffffffffffffff9c, &(0x7f0000000040)='./mnt\x00', 0x1ff) bind$inet6(0xffffffffffffffff, &(0x7f00000001c0)={0xa, 0x4e20, 0xfffffffb, @empty, 0x2}, 0x1c) r0 = socket$packet(0x11, 0x2, 0x300) sendto$packet(r0, 0x0, 0x0, 0x0, &(0x7f0000000400)={0x11, 0x88a8, 0x0, 0x1, 0x0, 0x6, @local}, 0x14) executing program 0: r0 = syz_open_dev$dri(&(0x7f0000000000), 0x0, 0x0) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r0, 0xc02064b2, &(0x7f0000000040)={0x1, 0xd00, 0x6}) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r0, 0xc02064b2, &(0x7f0000000100)={0x1, 0x3, 0x9}) ioctl$DRM_IOCTL_PANTHOR_VM_CREATE(r0, 0xc0106441, &(0x7f0000000080)={0x0, 0x0, 0xffffffffffffffff}) socket$kcm(0xa, 0x2, 0x0) socket$nl_route(0x10, 0x3, 0x0) r1 = socket(0x10, 0x3, 0x0) getsockname$packet(r1, &(0x7f00000002c0)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000100)=0x14) sendmsg$nl_route(0xffffffffffffffff, &(0x7f0000000040)={0x0, 0x0, 0x0}, 0x0) sendmsg$IPSET_CMD_ADD(0xffffffffffffffff, 0x0, 0x0) sendmsg$IPSET_CMD_TEST(0xffffffffffffffff, &(0x7f0000000280)={0x0, 0x0, &(0x7f00000002c0)={&(0x7f0000000300)={0x48, 0xb, 0x6, 0x1, 0x0, 0x0, {0x2}, [@IPSET_ATTR_SETNAME={0x9, 0x2, 'syz1\x00'}, @IPSET_ATTR_DATA={0x28, 0x7, 0x0, 0x1, [@IPSET_ATTR_IP={0xc, 0x1, 0x0, 0x1, @IPSET_ATTR_IPADDR_IPV4={0x8, 0x1, 0x1, 0x0, @local}}, @IPSET_ATTR_PORT={0x6, 0x4, 0x1, 0x0, 0x5000}, @IPSET_ATTR_MARK={0x8, 0xa, 0x1, 0x0, 0xc}, @IPSET_ATTR_CIDR2={0x5, 0x15, 0x18}]}]}, 0x48}}, 0x0) socket$inet6_udp(0xa, 0x2, 0x0) socket(0x10, 0x803, 0x0) socket(0x10, 0x3, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./config\x00', 0x1ff) mount(0x0, &(0x7f0000000000)='./config\x00', &(0x7f0000000080)='configfs\x00', 0x0, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000140)='./config/usb_gadget/g1\x00', 0xbf) mkdirat(0xffffffffffffff9c, &(0x7f00000001c0)='./config/usb_gadget/g1/functions/uvc.0\x00', 0x1ff) mkdirat(0xffffffffffffff9c, &(0x7f0000000280)='./config/usb_gadget/g1/functions/uvc.0/streaming/mjpeg/m1\x00', 0x1ff) r2 = openat(0xffffffffffffff9c, &(0x7f00000002c0)='./config/usb_gadget/g1/functions/uvc.0/streaming/mjpeg/m1/bmaControls\x00', 0x2, 0x0) write(r2, &(0x7f0000000640)='12', 0x2) write$P9_RVERSION(r2, &(0x7f0000000180)={0x13, 0x65, 0xffff, 0x1017, 0xffffffffffffff96, '9P2000.L'}, 0x13) syz_usb_connect$midi(0x0, 0x4f, &(0x7f0000000280)=ANY=[], 0x0) r3 = socket$nl_route(0x10, 0x3, 0x0) ioctl$ifreq_SIOCGIFINDEX_vcan(r3, 0x8933, &(0x7f0000000040)={'vxcan0\x00'}) getuid() r4 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPSET_CMD_CREATE(r4, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000200)=ANY=[@ANYBLOB="600000000206010800000000000000000000000005000400000000000900020073797a31000000001400078008001240000000000500140008000000050005000a000000050001000600000011000300686173683a69702c706f7274"], 0x60}}, 0x24000800) program crashed: KASAN: slab-use-after-free Read in ep_open testing program (duration=2m31.5s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): [0, 11, 4, 27] detailed listing: executing program 3: executing program 3: mkdirat(0xffffffffffffff9c, &(0x7f0000000100)='./gadget\x00', 0x1ff) mount(0x0, &(0x7f0000000140)='./gadget\x00', &(0x7f0000000180)='gadgetfs\x00', 0x0, 0x0) r0 = openat(0xffffffffffffff9c, &(0x7f00000001c0)='./gadget/dummy_udc\x00', 0x2, 0x0) mprotect(&(0x7f0000362000/0x2000)=nil, 0x2000, 0x1) write(r0, &(0x7f0000000200)="000000000902190001010080320904000001ff000000070581024000000902190001010080320904000001ff00000007058102000200120100020000004034127856000100000001", 0x48) write(0xffffffffffffffff, &(0x7f00000005c0)="010000000705810240000007058102000200", 0x12) ioctl$sock_SIOCGIFINDEX(0xffffffffffffffff, 0x8933, &(0x7f0000000040)={'bridge0\x00'}) write$P9_RRENAME(0xffffffffffffffff, 0x0, 0x0) mmap(&(0x7f0000362000/0x4000)=nil, 0x4000, 0x0, 0x12, 0xffffffffffffffff, 0xfffff000) r1 = syz_clone(0x21000200, 0x0, 0x0, 0x0, 0x0, 0x0) rt_tgsigqueueinfo(r1, r1, 0x8, 0x0) executing program 8: mkdirat(0xffffffffffffff9c, &(0x7f0000000040)='./mnt\x00', 0x1ff) bind$inet6(0xffffffffffffffff, &(0x7f00000001c0)={0xa, 0x4e20, 0xfffffffb, @empty, 0x2}, 0x1c) r0 = socket$packet(0x11, 0x2, 0x300) sendto$packet(r0, 0x0, 0x0, 0x0, &(0x7f0000000400)={0x11, 0x88a8, 0x0, 0x1, 0x0, 0x6, @local}, 0x14) executing program 0: r0 = syz_open_dev$dri(&(0x7f0000000000), 0x0, 0x0) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r0, 0xc02064b2, &(0x7f0000000040)={0x1, 0xd00, 0x6}) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r0, 0xc02064b2, &(0x7f0000000100)={0x1, 0x3, 0x9}) ioctl$DRM_IOCTL_PANTHOR_VM_CREATE(r0, 0xc0106441, &(0x7f0000000080)={0x0, 0x0, 0xffffffffffffffff}) socket$kcm(0xa, 0x2, 0x0) socket$nl_route(0x10, 0x3, 0x0) r1 = socket(0x10, 0x3, 0x0) getsockname$packet(r1, &(0x7f00000002c0)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000100)=0x14) sendmsg$nl_route(0xffffffffffffffff, &(0x7f0000000040)={0x0, 0x0, 0x0}, 0x0) sendmsg$IPSET_CMD_ADD(0xffffffffffffffff, 0x0, 0x0) sendmsg$IPSET_CMD_TEST(0xffffffffffffffff, &(0x7f0000000280)={0x0, 0x0, &(0x7f00000002c0)={&(0x7f0000000300)={0x48, 0xb, 0x6, 0x1, 0x0, 0x0, {0x2}, [@IPSET_ATTR_SETNAME={0x9, 0x2, 'syz1\x00'}, @IPSET_ATTR_DATA={0x28, 0x7, 0x0, 0x1, [@IPSET_ATTR_IP={0xc, 0x1, 0x0, 0x1, @IPSET_ATTR_IPADDR_IPV4={0x8, 0x1, 0x1, 0x0, @local}}, @IPSET_ATTR_PORT={0x6, 0x4, 0x1, 0x0, 0x5000}, @IPSET_ATTR_MARK={0x8, 0xa, 0x1, 0x0, 0xc}, @IPSET_ATTR_CIDR2={0x5, 0x15, 0x18}]}]}, 0x48}}, 0x0) socket$inet6_udp(0xa, 0x2, 0x0) socket(0x10, 0x803, 0x0) socket(0x10, 0x3, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./config\x00', 0x1ff) mount(0x0, &(0x7f0000000000)='./config\x00', &(0x7f0000000080)='configfs\x00', 0x0, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000140)='./config/usb_gadget/g1\x00', 0xbf) mkdirat(0xffffffffffffff9c, &(0x7f00000001c0)='./config/usb_gadget/g1/functions/uvc.0\x00', 0x1ff) mkdirat(0xffffffffffffff9c, &(0x7f0000000280)='./config/usb_gadget/g1/functions/uvc.0/streaming/mjpeg/m1\x00', 0x1ff) r2 = openat(0xffffffffffffff9c, &(0x7f00000002c0)='./config/usb_gadget/g1/functions/uvc.0/streaming/mjpeg/m1/bmaControls\x00', 0x2, 0x0) write(r2, &(0x7f0000000640)='12', 0x2) write$P9_RVERSION(r2, &(0x7f0000000180)={0x13, 0x65, 0xffff, 0x1017, 0xffffffffffffff96, '9P2000.L'}, 0x13) syz_usb_connect$midi(0x0, 0x4f, &(0x7f0000000280)=ANY=[], 0x0) r3 = socket$nl_route(0x10, 0x3, 0x0) ioctl$ifreq_SIOCGIFINDEX_vcan(r3, 0x8933, &(0x7f0000000040)={'vxcan0\x00'}) getuid() socket$nl_netfilter(0x10, 0x3, 0xc) program did not crash testing program (duration=2m31.5s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): [0, 11, 4, 27] detailed listing: executing program 3: executing program 3: mkdirat(0xffffffffffffff9c, &(0x7f0000000100)='./gadget\x00', 0x1ff) mount(0x0, &(0x7f0000000140)='./gadget\x00', &(0x7f0000000180)='gadgetfs\x00', 0x0, 0x0) r0 = openat(0xffffffffffffff9c, &(0x7f00000001c0)='./gadget/dummy_udc\x00', 0x2, 0x0) mprotect(&(0x7f0000362000/0x2000)=nil, 0x2000, 0x1) write(r0, &(0x7f0000000200)="000000000902190001010080320904000001ff000000070581024000000902190001010080320904000001ff00000007058102000200120100020000004034127856000100000001", 0x48) write(0xffffffffffffffff, &(0x7f00000005c0)="010000000705810240000007058102000200", 0x12) ioctl$sock_SIOCGIFINDEX(0xffffffffffffffff, 0x8933, &(0x7f0000000040)={'bridge0\x00'}) write$P9_RRENAME(0xffffffffffffffff, 0x0, 0x0) mmap(&(0x7f0000362000/0x4000)=nil, 0x4000, 0x0, 0x12, 0xffffffffffffffff, 0xfffff000) r1 = syz_clone(0x21000200, 0x0, 0x0, 0x0, 0x0, 0x0) rt_tgsigqueueinfo(r1, r1, 0x8, 0x0) executing program 8: mkdirat(0xffffffffffffff9c, &(0x7f0000000040)='./mnt\x00', 0x1ff) bind$inet6(0xffffffffffffffff, &(0x7f00000001c0)={0xa, 0x4e20, 0xfffffffb, @empty, 0x2}, 0x1c) r0 = socket$packet(0x11, 0x2, 0x300) sendto$packet(r0, 0x0, 0x0, 0x0, &(0x7f0000000400)={0x11, 0x88a8, 0x0, 0x1, 0x0, 0x6, @local}, 0x14) executing program 0: r0 = syz_open_dev$dri(&(0x7f0000000000), 0x0, 0x0) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r0, 0xc02064b2, &(0x7f0000000040)={0x1, 0xd00, 0x6}) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r0, 0xc02064b2, &(0x7f0000000100)={0x1, 0x3, 0x9}) ioctl$DRM_IOCTL_PANTHOR_VM_CREATE(r0, 0xc0106441, &(0x7f0000000080)={0x0, 0x0, 0xffffffffffffffff}) socket$kcm(0xa, 0x2, 0x0) socket$nl_route(0x10, 0x3, 0x0) r1 = socket(0x10, 0x3, 0x0) getsockname$packet(r1, &(0x7f00000002c0)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000100)=0x14) sendmsg$nl_route(0xffffffffffffffff, &(0x7f0000000040)={0x0, 0x0, 0x0}, 0x0) sendmsg$IPSET_CMD_ADD(0xffffffffffffffff, 0x0, 0x0) sendmsg$IPSET_CMD_TEST(0xffffffffffffffff, &(0x7f0000000280)={0x0, 0x0, &(0x7f00000002c0)={&(0x7f0000000300)={0x48, 0xb, 0x6, 0x1, 0x0, 0x0, {0x2}, [@IPSET_ATTR_SETNAME={0x9, 0x2, 'syz1\x00'}, @IPSET_ATTR_DATA={0x28, 0x7, 0x0, 0x1, [@IPSET_ATTR_IP={0xc, 0x1, 0x0, 0x1, @IPSET_ATTR_IPADDR_IPV4={0x8, 0x1, 0x1, 0x0, @local}}, @IPSET_ATTR_PORT={0x6, 0x4, 0x1, 0x0, 0x5000}, @IPSET_ATTR_MARK={0x8, 0xa, 0x1, 0x0, 0xc}, @IPSET_ATTR_CIDR2={0x5, 0x15, 0x18}]}]}, 0x48}}, 0x0) socket$inet6_udp(0xa, 0x2, 0x0) socket(0x10, 0x803, 0x0) socket(0x10, 0x3, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./config\x00', 0x1ff) mount(0x0, &(0x7f0000000000)='./config\x00', &(0x7f0000000080)='configfs\x00', 0x0, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000140)='./config/usb_gadget/g1\x00', 0xbf) mkdirat(0xffffffffffffff9c, &(0x7f00000001c0)='./config/usb_gadget/g1/functions/uvc.0\x00', 0x1ff) mkdirat(0xffffffffffffff9c, &(0x7f0000000280)='./config/usb_gadget/g1/functions/uvc.0/streaming/mjpeg/m1\x00', 0x1ff) r2 = openat(0xffffffffffffff9c, &(0x7f00000002c0)='./config/usb_gadget/g1/functions/uvc.0/streaming/mjpeg/m1/bmaControls\x00', 0x2, 0x0) write(r2, &(0x7f0000000640)='12', 0x2) write$P9_RVERSION(r2, &(0x7f0000000180)={0x13, 0x65, 0xffff, 0x1017, 0xffffffffffffff96, '9P2000.L'}, 0x13) syz_usb_connect$midi(0x0, 0x4f, &(0x7f0000000280)=ANY=[], 0x0) r3 = socket$nl_route(0x10, 0x3, 0x0) ioctl$ifreq_SIOCGIFINDEX_vcan(r3, 0x8933, &(0x7f0000000040)={'vxcan0\x00'}) getuid() sendmsg$IPSET_CMD_CREATE(0xffffffffffffffff, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000200)=ANY=[@ANYBLOB="600000000206010800000000000000000000000005000400000000000900020073797a31000000001400078008001240000000000500140008000000050005000a000000050001000600000011000300686173683a69702c706f7274"], 0x60}}, 0x24000800) program crashed: KASAN: slab-use-after-free Read in ep_open testing program (duration=2m31.5s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): [0, 11, 4, 26] detailed listing: executing program 3: executing program 3: mkdirat(0xffffffffffffff9c, &(0x7f0000000100)='./gadget\x00', 0x1ff) mount(0x0, &(0x7f0000000140)='./gadget\x00', &(0x7f0000000180)='gadgetfs\x00', 0x0, 0x0) r0 = openat(0xffffffffffffff9c, &(0x7f00000001c0)='./gadget/dummy_udc\x00', 0x2, 0x0) mprotect(&(0x7f0000362000/0x2000)=nil, 0x2000, 0x1) write(r0, &(0x7f0000000200)="000000000902190001010080320904000001ff000000070581024000000902190001010080320904000001ff00000007058102000200120100020000004034127856000100000001", 0x48) write(0xffffffffffffffff, &(0x7f00000005c0)="010000000705810240000007058102000200", 0x12) ioctl$sock_SIOCGIFINDEX(0xffffffffffffffff, 0x8933, &(0x7f0000000040)={'bridge0\x00'}) write$P9_RRENAME(0xffffffffffffffff, 0x0, 0x0) mmap(&(0x7f0000362000/0x4000)=nil, 0x4000, 0x0, 0x12, 0xffffffffffffffff, 0xfffff000) r1 = syz_clone(0x21000200, 0x0, 0x0, 0x0, 0x0, 0x0) rt_tgsigqueueinfo(r1, r1, 0x8, 0x0) executing program 8: mkdirat(0xffffffffffffff9c, &(0x7f0000000040)='./mnt\x00', 0x1ff) bind$inet6(0xffffffffffffffff, &(0x7f00000001c0)={0xa, 0x4e20, 0xfffffffb, @empty, 0x2}, 0x1c) r0 = socket$packet(0x11, 0x2, 0x300) sendto$packet(r0, 0x0, 0x0, 0x0, &(0x7f0000000400)={0x11, 0x88a8, 0x0, 0x1, 0x0, 0x6, @local}, 0x14) executing program 0: r0 = syz_open_dev$dri(&(0x7f0000000000), 0x0, 0x0) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r0, 0xc02064b2, &(0x7f0000000040)={0x1, 0xd00, 0x6}) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r0, 0xc02064b2, &(0x7f0000000100)={0x1, 0x3, 0x9}) ioctl$DRM_IOCTL_PANTHOR_VM_CREATE(r0, 0xc0106441, &(0x7f0000000080)={0x0, 0x0, 0xffffffffffffffff}) socket$kcm(0xa, 0x2, 0x0) socket$nl_route(0x10, 0x3, 0x0) r1 = socket(0x10, 0x3, 0x0) getsockname$packet(r1, &(0x7f00000002c0)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000100)=0x14) sendmsg$nl_route(0xffffffffffffffff, &(0x7f0000000040)={0x0, 0x0, 0x0}, 0x0) sendmsg$IPSET_CMD_ADD(0xffffffffffffffff, 0x0, 0x0) sendmsg$IPSET_CMD_TEST(0xffffffffffffffff, &(0x7f0000000280)={0x0, 0x0, &(0x7f00000002c0)={&(0x7f0000000300)={0x48, 0xb, 0x6, 0x1, 0x0, 0x0, {0x2}, [@IPSET_ATTR_SETNAME={0x9, 0x2, 'syz1\x00'}, @IPSET_ATTR_DATA={0x28, 0x7, 0x0, 0x1, [@IPSET_ATTR_IP={0xc, 0x1, 0x0, 0x1, @IPSET_ATTR_IPADDR_IPV4={0x8, 0x1, 0x1, 0x0, @local}}, @IPSET_ATTR_PORT={0x6, 0x4, 0x1, 0x0, 0x5000}, @IPSET_ATTR_MARK={0x8, 0xa, 0x1, 0x0, 0xc}, @IPSET_ATTR_CIDR2={0x5, 0x15, 0x18}]}]}, 0x48}}, 0x0) socket$inet6_udp(0xa, 0x2, 0x0) socket(0x10, 0x803, 0x0) socket(0x10, 0x3, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./config\x00', 0x1ff) mount(0x0, &(0x7f0000000000)='./config\x00', &(0x7f0000000080)='configfs\x00', 0x0, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000140)='./config/usb_gadget/g1\x00', 0xbf) mkdirat(0xffffffffffffff9c, &(0x7f00000001c0)='./config/usb_gadget/g1/functions/uvc.0\x00', 0x1ff) mkdirat(0xffffffffffffff9c, &(0x7f0000000280)='./config/usb_gadget/g1/functions/uvc.0/streaming/mjpeg/m1\x00', 0x1ff) r2 = openat(0xffffffffffffff9c, &(0x7f00000002c0)='./config/usb_gadget/g1/functions/uvc.0/streaming/mjpeg/m1/bmaControls\x00', 0x2, 0x0) write(r2, &(0x7f0000000640)='12', 0x2) write$P9_RVERSION(r2, &(0x7f0000000180)={0x13, 0x65, 0xffff, 0x1017, 0xffffffffffffff96, '9P2000.L'}, 0x13) syz_usb_connect$midi(0x0, 0x4f, &(0x7f0000000280)=ANY=[], 0x0) r3 = socket$nl_route(0x10, 0x3, 0x0) ioctl$ifreq_SIOCGIFINDEX_vcan(r3, 0x8933, &(0x7f0000000040)={'vxcan0\x00'}) sendmsg$IPSET_CMD_CREATE(0xffffffffffffffff, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000200)=ANY=[@ANYBLOB="600000000206010800000000000000000000000005000400000000000900020073797a31000000001400078008001240000000000500140008000000050005000a000000050001000600000011000300686173683a69702c706f7274"], 0x60}}, 0x24000800) program crashed: KASAN: slab-use-after-free Read in ep_open testing program (duration=2m31.5s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): [0, 11, 4, 25] detailed listing: executing program 3: executing program 3: mkdirat(0xffffffffffffff9c, &(0x7f0000000100)='./gadget\x00', 0x1ff) mount(0x0, &(0x7f0000000140)='./gadget\x00', &(0x7f0000000180)='gadgetfs\x00', 0x0, 0x0) r0 = openat(0xffffffffffffff9c, &(0x7f00000001c0)='./gadget/dummy_udc\x00', 0x2, 0x0) mprotect(&(0x7f0000362000/0x2000)=nil, 0x2000, 0x1) write(r0, &(0x7f0000000200)="000000000902190001010080320904000001ff000000070581024000000902190001010080320904000001ff00000007058102000200120100020000004034127856000100000001", 0x48) write(0xffffffffffffffff, &(0x7f00000005c0)="010000000705810240000007058102000200", 0x12) ioctl$sock_SIOCGIFINDEX(0xffffffffffffffff, 0x8933, &(0x7f0000000040)={'bridge0\x00'}) write$P9_RRENAME(0xffffffffffffffff, 0x0, 0x0) mmap(&(0x7f0000362000/0x4000)=nil, 0x4000, 0x0, 0x12, 0xffffffffffffffff, 0xfffff000) r1 = syz_clone(0x21000200, 0x0, 0x0, 0x0, 0x0, 0x0) rt_tgsigqueueinfo(r1, r1, 0x8, 0x0) executing program 8: mkdirat(0xffffffffffffff9c, &(0x7f0000000040)='./mnt\x00', 0x1ff) bind$inet6(0xffffffffffffffff, &(0x7f00000001c0)={0xa, 0x4e20, 0xfffffffb, @empty, 0x2}, 0x1c) r0 = socket$packet(0x11, 0x2, 0x300) sendto$packet(r0, 0x0, 0x0, 0x0, &(0x7f0000000400)={0x11, 0x88a8, 0x0, 0x1, 0x0, 0x6, @local}, 0x14) executing program 0: r0 = syz_open_dev$dri(&(0x7f0000000000), 0x0, 0x0) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r0, 0xc02064b2, &(0x7f0000000040)={0x1, 0xd00, 0x6}) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r0, 0xc02064b2, &(0x7f0000000100)={0x1, 0x3, 0x9}) ioctl$DRM_IOCTL_PANTHOR_VM_CREATE(r0, 0xc0106441, &(0x7f0000000080)={0x0, 0x0, 0xffffffffffffffff}) socket$kcm(0xa, 0x2, 0x0) socket$nl_route(0x10, 0x3, 0x0) r1 = socket(0x10, 0x3, 0x0) getsockname$packet(r1, &(0x7f00000002c0)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000100)=0x14) sendmsg$nl_route(0xffffffffffffffff, &(0x7f0000000040)={0x0, 0x0, 0x0}, 0x0) sendmsg$IPSET_CMD_ADD(0xffffffffffffffff, 0x0, 0x0) sendmsg$IPSET_CMD_TEST(0xffffffffffffffff, &(0x7f0000000280)={0x0, 0x0, &(0x7f00000002c0)={&(0x7f0000000300)={0x48, 0xb, 0x6, 0x1, 0x0, 0x0, {0x2}, [@IPSET_ATTR_SETNAME={0x9, 0x2, 'syz1\x00'}, @IPSET_ATTR_DATA={0x28, 0x7, 0x0, 0x1, [@IPSET_ATTR_IP={0xc, 0x1, 0x0, 0x1, @IPSET_ATTR_IPADDR_IPV4={0x8, 0x1, 0x1, 0x0, @local}}, @IPSET_ATTR_PORT={0x6, 0x4, 0x1, 0x0, 0x5000}, @IPSET_ATTR_MARK={0x8, 0xa, 0x1, 0x0, 0xc}, @IPSET_ATTR_CIDR2={0x5, 0x15, 0x18}]}]}, 0x48}}, 0x0) socket$inet6_udp(0xa, 0x2, 0x0) socket(0x10, 0x803, 0x0) socket(0x10, 0x3, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./config\x00', 0x1ff) mount(0x0, &(0x7f0000000000)='./config\x00', &(0x7f0000000080)='configfs\x00', 0x0, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000140)='./config/usb_gadget/g1\x00', 0xbf) mkdirat(0xffffffffffffff9c, &(0x7f00000001c0)='./config/usb_gadget/g1/functions/uvc.0\x00', 0x1ff) mkdirat(0xffffffffffffff9c, &(0x7f0000000280)='./config/usb_gadget/g1/functions/uvc.0/streaming/mjpeg/m1\x00', 0x1ff) r2 = openat(0xffffffffffffff9c, &(0x7f00000002c0)='./config/usb_gadget/g1/functions/uvc.0/streaming/mjpeg/m1/bmaControls\x00', 0x2, 0x0) write(r2, &(0x7f0000000640)='12', 0x2) write$P9_RVERSION(r2, &(0x7f0000000180)={0x13, 0x65, 0xffff, 0x1017, 0xffffffffffffff96, '9P2000.L'}, 0x13) syz_usb_connect$midi(0x0, 0x4f, &(0x7f0000000280)=ANY=[], 0x0) socket$nl_route(0x10, 0x3, 0x0) sendmsg$IPSET_CMD_CREATE(0xffffffffffffffff, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000200)=ANY=[@ANYBLOB="600000000206010800000000000000000000000005000400000000000900020073797a31000000001400078008001240000000000500140008000000050005000a000000050001000600000011000300686173683a69702c706f7274"], 0x60}}, 0x24000800) program crashed: KASAN: slab-use-after-free Read in ep_open testing program (duration=2m31.5s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): [0, 11, 4, 24] detailed listing: executing program 3: executing program 3: mkdirat(0xffffffffffffff9c, &(0x7f0000000100)='./gadget\x00', 0x1ff) mount(0x0, &(0x7f0000000140)='./gadget\x00', &(0x7f0000000180)='gadgetfs\x00', 0x0, 0x0) r0 = openat(0xffffffffffffff9c, &(0x7f00000001c0)='./gadget/dummy_udc\x00', 0x2, 0x0) mprotect(&(0x7f0000362000/0x2000)=nil, 0x2000, 0x1) write(r0, &(0x7f0000000200)="000000000902190001010080320904000001ff000000070581024000000902190001010080320904000001ff00000007058102000200120100020000004034127856000100000001", 0x48) write(0xffffffffffffffff, &(0x7f00000005c0)="010000000705810240000007058102000200", 0x12) ioctl$sock_SIOCGIFINDEX(0xffffffffffffffff, 0x8933, &(0x7f0000000040)={'bridge0\x00'}) write$P9_RRENAME(0xffffffffffffffff, 0x0, 0x0) mmap(&(0x7f0000362000/0x4000)=nil, 0x4000, 0x0, 0x12, 0xffffffffffffffff, 0xfffff000) r1 = syz_clone(0x21000200, 0x0, 0x0, 0x0, 0x0, 0x0) rt_tgsigqueueinfo(r1, r1, 0x8, 0x0) executing program 8: mkdirat(0xffffffffffffff9c, &(0x7f0000000040)='./mnt\x00', 0x1ff) bind$inet6(0xffffffffffffffff, &(0x7f00000001c0)={0xa, 0x4e20, 0xfffffffb, @empty, 0x2}, 0x1c) r0 = socket$packet(0x11, 0x2, 0x300) sendto$packet(r0, 0x0, 0x0, 0x0, &(0x7f0000000400)={0x11, 0x88a8, 0x0, 0x1, 0x0, 0x6, @local}, 0x14) executing program 0: r0 = syz_open_dev$dri(&(0x7f0000000000), 0x0, 0x0) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r0, 0xc02064b2, &(0x7f0000000040)={0x1, 0xd00, 0x6}) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r0, 0xc02064b2, &(0x7f0000000100)={0x1, 0x3, 0x9}) ioctl$DRM_IOCTL_PANTHOR_VM_CREATE(r0, 0xc0106441, &(0x7f0000000080)={0x0, 0x0, 0xffffffffffffffff}) socket$kcm(0xa, 0x2, 0x0) socket$nl_route(0x10, 0x3, 0x0) r1 = socket(0x10, 0x3, 0x0) getsockname$packet(r1, &(0x7f00000002c0)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000100)=0x14) sendmsg$nl_route(0xffffffffffffffff, &(0x7f0000000040)={0x0, 0x0, 0x0}, 0x0) sendmsg$IPSET_CMD_ADD(0xffffffffffffffff, 0x0, 0x0) sendmsg$IPSET_CMD_TEST(0xffffffffffffffff, &(0x7f0000000280)={0x0, 0x0, &(0x7f00000002c0)={&(0x7f0000000300)={0x48, 0xb, 0x6, 0x1, 0x0, 0x0, {0x2}, [@IPSET_ATTR_SETNAME={0x9, 0x2, 'syz1\x00'}, @IPSET_ATTR_DATA={0x28, 0x7, 0x0, 0x1, [@IPSET_ATTR_IP={0xc, 0x1, 0x0, 0x1, @IPSET_ATTR_IPADDR_IPV4={0x8, 0x1, 0x1, 0x0, @local}}, @IPSET_ATTR_PORT={0x6, 0x4, 0x1, 0x0, 0x5000}, @IPSET_ATTR_MARK={0x8, 0xa, 0x1, 0x0, 0xc}, @IPSET_ATTR_CIDR2={0x5, 0x15, 0x18}]}]}, 0x48}}, 0x0) socket$inet6_udp(0xa, 0x2, 0x0) socket(0x10, 0x803, 0x0) socket(0x10, 0x3, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./config\x00', 0x1ff) mount(0x0, &(0x7f0000000000)='./config\x00', &(0x7f0000000080)='configfs\x00', 0x0, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000140)='./config/usb_gadget/g1\x00', 0xbf) mkdirat(0xffffffffffffff9c, &(0x7f00000001c0)='./config/usb_gadget/g1/functions/uvc.0\x00', 0x1ff) mkdirat(0xffffffffffffff9c, &(0x7f0000000280)='./config/usb_gadget/g1/functions/uvc.0/streaming/mjpeg/m1\x00', 0x1ff) r2 = openat(0xffffffffffffff9c, &(0x7f00000002c0)='./config/usb_gadget/g1/functions/uvc.0/streaming/mjpeg/m1/bmaControls\x00', 0x2, 0x0) write(r2, &(0x7f0000000640)='12', 0x2) write$P9_RVERSION(r2, &(0x7f0000000180)={0x13, 0x65, 0xffff, 0x1017, 0xffffffffffffff96, '9P2000.L'}, 0x13) syz_usb_connect$midi(0x0, 0x4f, &(0x7f0000000280)=ANY=[], 0x0) sendmsg$IPSET_CMD_CREATE(0xffffffffffffffff, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000200)=ANY=[@ANYBLOB="600000000206010800000000000000000000000005000400000000000900020073797a31000000001400078008001240000000000500140008000000050005000a000000050001000600000011000300686173683a69702c706f7274"], 0x60}}, 0x24000800) program crashed: KASAN: slab-use-after-free Read in ep_open testing program (duration=2m31.5s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): [0, 11, 4, 23] detailed listing: executing program 3: executing program 3: mkdirat(0xffffffffffffff9c, &(0x7f0000000100)='./gadget\x00', 0x1ff) mount(0x0, &(0x7f0000000140)='./gadget\x00', &(0x7f0000000180)='gadgetfs\x00', 0x0, 0x0) r0 = openat(0xffffffffffffff9c, &(0x7f00000001c0)='./gadget/dummy_udc\x00', 0x2, 0x0) mprotect(&(0x7f0000362000/0x2000)=nil, 0x2000, 0x1) write(r0, &(0x7f0000000200)="000000000902190001010080320904000001ff000000070581024000000902190001010080320904000001ff00000007058102000200120100020000004034127856000100000001", 0x48) write(0xffffffffffffffff, &(0x7f00000005c0)="010000000705810240000007058102000200", 0x12) ioctl$sock_SIOCGIFINDEX(0xffffffffffffffff, 0x8933, &(0x7f0000000040)={'bridge0\x00'}) write$P9_RRENAME(0xffffffffffffffff, 0x0, 0x0) mmap(&(0x7f0000362000/0x4000)=nil, 0x4000, 0x0, 0x12, 0xffffffffffffffff, 0xfffff000) r1 = syz_clone(0x21000200, 0x0, 0x0, 0x0, 0x0, 0x0) rt_tgsigqueueinfo(r1, r1, 0x8, 0x0) executing program 8: mkdirat(0xffffffffffffff9c, &(0x7f0000000040)='./mnt\x00', 0x1ff) bind$inet6(0xffffffffffffffff, &(0x7f00000001c0)={0xa, 0x4e20, 0xfffffffb, @empty, 0x2}, 0x1c) r0 = socket$packet(0x11, 0x2, 0x300) sendto$packet(r0, 0x0, 0x0, 0x0, &(0x7f0000000400)={0x11, 0x88a8, 0x0, 0x1, 0x0, 0x6, @local}, 0x14) executing program 0: r0 = syz_open_dev$dri(&(0x7f0000000000), 0x0, 0x0) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r0, 0xc02064b2, &(0x7f0000000040)={0x1, 0xd00, 0x6}) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r0, 0xc02064b2, &(0x7f0000000100)={0x1, 0x3, 0x9}) ioctl$DRM_IOCTL_PANTHOR_VM_CREATE(r0, 0xc0106441, &(0x7f0000000080)={0x0, 0x0, 0xffffffffffffffff}) socket$kcm(0xa, 0x2, 0x0) socket$nl_route(0x10, 0x3, 0x0) r1 = socket(0x10, 0x3, 0x0) getsockname$packet(r1, &(0x7f00000002c0)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000100)=0x14) sendmsg$nl_route(0xffffffffffffffff, &(0x7f0000000040)={0x0, 0x0, 0x0}, 0x0) sendmsg$IPSET_CMD_ADD(0xffffffffffffffff, 0x0, 0x0) sendmsg$IPSET_CMD_TEST(0xffffffffffffffff, &(0x7f0000000280)={0x0, 0x0, &(0x7f00000002c0)={&(0x7f0000000300)={0x48, 0xb, 0x6, 0x1, 0x0, 0x0, {0x2}, [@IPSET_ATTR_SETNAME={0x9, 0x2, 'syz1\x00'}, @IPSET_ATTR_DATA={0x28, 0x7, 0x0, 0x1, [@IPSET_ATTR_IP={0xc, 0x1, 0x0, 0x1, @IPSET_ATTR_IPADDR_IPV4={0x8, 0x1, 0x1, 0x0, @local}}, @IPSET_ATTR_PORT={0x6, 0x4, 0x1, 0x0, 0x5000}, @IPSET_ATTR_MARK={0x8, 0xa, 0x1, 0x0, 0xc}, @IPSET_ATTR_CIDR2={0x5, 0x15, 0x18}]}]}, 0x48}}, 0x0) socket$inet6_udp(0xa, 0x2, 0x0) socket(0x10, 0x803, 0x0) socket(0x10, 0x3, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./config\x00', 0x1ff) mount(0x0, &(0x7f0000000000)='./config\x00', &(0x7f0000000080)='configfs\x00', 0x0, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000140)='./config/usb_gadget/g1\x00', 0xbf) mkdirat(0xffffffffffffff9c, &(0x7f00000001c0)='./config/usb_gadget/g1/functions/uvc.0\x00', 0x1ff) mkdirat(0xffffffffffffff9c, &(0x7f0000000280)='./config/usb_gadget/g1/functions/uvc.0/streaming/mjpeg/m1\x00', 0x1ff) r2 = openat(0xffffffffffffff9c, &(0x7f00000002c0)='./config/usb_gadget/g1/functions/uvc.0/streaming/mjpeg/m1/bmaControls\x00', 0x2, 0x0) write(r2, &(0x7f0000000640)='12', 0x2) write$P9_RVERSION(r2, &(0x7f0000000180)={0x13, 0x65, 0xffff, 0x1017, 0xffffffffffffff96, '9P2000.L'}, 0x13) sendmsg$IPSET_CMD_CREATE(0xffffffffffffffff, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000200)=ANY=[@ANYBLOB="600000000206010800000000000000000000000005000400000000000900020073797a31000000001400078008001240000000000500140008000000050005000a000000050001000600000011000300686173683a69702c706f7274"], 0x60}}, 0x24000800) program crashed: KASAN: slab-use-after-free Read in ep_open testing program (duration=2m31.5s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): [0, 11, 4, 22] detailed listing: executing program 3: executing program 3: mkdirat(0xffffffffffffff9c, &(0x7f0000000100)='./gadget\x00', 0x1ff) mount(0x0, &(0x7f0000000140)='./gadget\x00', &(0x7f0000000180)='gadgetfs\x00', 0x0, 0x0) r0 = openat(0xffffffffffffff9c, &(0x7f00000001c0)='./gadget/dummy_udc\x00', 0x2, 0x0) mprotect(&(0x7f0000362000/0x2000)=nil, 0x2000, 0x1) write(r0, &(0x7f0000000200)="000000000902190001010080320904000001ff000000070581024000000902190001010080320904000001ff00000007058102000200120100020000004034127856000100000001", 0x48) write(0xffffffffffffffff, &(0x7f00000005c0)="010000000705810240000007058102000200", 0x12) ioctl$sock_SIOCGIFINDEX(0xffffffffffffffff, 0x8933, &(0x7f0000000040)={'bridge0\x00'}) write$P9_RRENAME(0xffffffffffffffff, 0x0, 0x0) mmap(&(0x7f0000362000/0x4000)=nil, 0x4000, 0x0, 0x12, 0xffffffffffffffff, 0xfffff000) r1 = syz_clone(0x21000200, 0x0, 0x0, 0x0, 0x0, 0x0) rt_tgsigqueueinfo(r1, r1, 0x8, 0x0) executing program 8: mkdirat(0xffffffffffffff9c, &(0x7f0000000040)='./mnt\x00', 0x1ff) bind$inet6(0xffffffffffffffff, &(0x7f00000001c0)={0xa, 0x4e20, 0xfffffffb, @empty, 0x2}, 0x1c) r0 = socket$packet(0x11, 0x2, 0x300) sendto$packet(r0, 0x0, 0x0, 0x0, &(0x7f0000000400)={0x11, 0x88a8, 0x0, 0x1, 0x0, 0x6, @local}, 0x14) executing program 0: r0 = syz_open_dev$dri(&(0x7f0000000000), 0x0, 0x0) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r0, 0xc02064b2, &(0x7f0000000040)={0x1, 0xd00, 0x6}) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r0, 0xc02064b2, &(0x7f0000000100)={0x1, 0x3, 0x9}) ioctl$DRM_IOCTL_PANTHOR_VM_CREATE(r0, 0xc0106441, &(0x7f0000000080)={0x0, 0x0, 0xffffffffffffffff}) socket$kcm(0xa, 0x2, 0x0) socket$nl_route(0x10, 0x3, 0x0) r1 = socket(0x10, 0x3, 0x0) getsockname$packet(r1, &(0x7f00000002c0)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000100)=0x14) sendmsg$nl_route(0xffffffffffffffff, &(0x7f0000000040)={0x0, 0x0, 0x0}, 0x0) sendmsg$IPSET_CMD_ADD(0xffffffffffffffff, 0x0, 0x0) sendmsg$IPSET_CMD_TEST(0xffffffffffffffff, &(0x7f0000000280)={0x0, 0x0, &(0x7f00000002c0)={&(0x7f0000000300)={0x48, 0xb, 0x6, 0x1, 0x0, 0x0, {0x2}, [@IPSET_ATTR_SETNAME={0x9, 0x2, 'syz1\x00'}, @IPSET_ATTR_DATA={0x28, 0x7, 0x0, 0x1, [@IPSET_ATTR_IP={0xc, 0x1, 0x0, 0x1, @IPSET_ATTR_IPADDR_IPV4={0x8, 0x1, 0x1, 0x0, @local}}, @IPSET_ATTR_PORT={0x6, 0x4, 0x1, 0x0, 0x5000}, @IPSET_ATTR_MARK={0x8, 0xa, 0x1, 0x0, 0xc}, @IPSET_ATTR_CIDR2={0x5, 0x15, 0x18}]}]}, 0x48}}, 0x0) socket$inet6_udp(0xa, 0x2, 0x0) socket(0x10, 0x803, 0x0) socket(0x10, 0x3, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./config\x00', 0x1ff) mount(0x0, &(0x7f0000000000)='./config\x00', &(0x7f0000000080)='configfs\x00', 0x0, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000140)='./config/usb_gadget/g1\x00', 0xbf) mkdirat(0xffffffffffffff9c, &(0x7f00000001c0)='./config/usb_gadget/g1/functions/uvc.0\x00', 0x1ff) mkdirat(0xffffffffffffff9c, &(0x7f0000000280)='./config/usb_gadget/g1/functions/uvc.0/streaming/mjpeg/m1\x00', 0x1ff) r2 = openat(0xffffffffffffff9c, &(0x7f00000002c0)='./config/usb_gadget/g1/functions/uvc.0/streaming/mjpeg/m1/bmaControls\x00', 0x2, 0x0) write(r2, &(0x7f0000000640)='12', 0x2) sendmsg$IPSET_CMD_CREATE(0xffffffffffffffff, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000200)=ANY=[@ANYBLOB="600000000206010800000000000000000000000005000400000000000900020073797a31000000001400078008001240000000000500140008000000050005000a000000050001000600000011000300686173683a69702c706f7274"], 0x60}}, 0x24000800) program crashed: KASAN: slab-use-after-free Read in ep_open testing program (duration=2m31.5s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): [0, 11, 4, 21] detailed listing: executing program 3: executing program 3: mkdirat(0xffffffffffffff9c, &(0x7f0000000100)='./gadget\x00', 0x1ff) mount(0x0, &(0x7f0000000140)='./gadget\x00', &(0x7f0000000180)='gadgetfs\x00', 0x0, 0x0) r0 = openat(0xffffffffffffff9c, &(0x7f00000001c0)='./gadget/dummy_udc\x00', 0x2, 0x0) mprotect(&(0x7f0000362000/0x2000)=nil, 0x2000, 0x1) write(r0, &(0x7f0000000200)="000000000902190001010080320904000001ff000000070581024000000902190001010080320904000001ff00000007058102000200120100020000004034127856000100000001", 0x48) write(0xffffffffffffffff, &(0x7f00000005c0)="010000000705810240000007058102000200", 0x12) ioctl$sock_SIOCGIFINDEX(0xffffffffffffffff, 0x8933, &(0x7f0000000040)={'bridge0\x00'}) write$P9_RRENAME(0xffffffffffffffff, 0x0, 0x0) mmap(&(0x7f0000362000/0x4000)=nil, 0x4000, 0x0, 0x12, 0xffffffffffffffff, 0xfffff000) r1 = syz_clone(0x21000200, 0x0, 0x0, 0x0, 0x0, 0x0) rt_tgsigqueueinfo(r1, r1, 0x8, 0x0) executing program 8: mkdirat(0xffffffffffffff9c, &(0x7f0000000040)='./mnt\x00', 0x1ff) bind$inet6(0xffffffffffffffff, &(0x7f00000001c0)={0xa, 0x4e20, 0xfffffffb, @empty, 0x2}, 0x1c) r0 = socket$packet(0x11, 0x2, 0x300) sendto$packet(r0, 0x0, 0x0, 0x0, &(0x7f0000000400)={0x11, 0x88a8, 0x0, 0x1, 0x0, 0x6, @local}, 0x14) executing program 0: r0 = syz_open_dev$dri(&(0x7f0000000000), 0x0, 0x0) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r0, 0xc02064b2, &(0x7f0000000040)={0x1, 0xd00, 0x6}) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r0, 0xc02064b2, &(0x7f0000000100)={0x1, 0x3, 0x9}) ioctl$DRM_IOCTL_PANTHOR_VM_CREATE(r0, 0xc0106441, &(0x7f0000000080)={0x0, 0x0, 0xffffffffffffffff}) socket$kcm(0xa, 0x2, 0x0) socket$nl_route(0x10, 0x3, 0x0) r1 = socket(0x10, 0x3, 0x0) getsockname$packet(r1, &(0x7f00000002c0)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000100)=0x14) sendmsg$nl_route(0xffffffffffffffff, &(0x7f0000000040)={0x0, 0x0, 0x0}, 0x0) sendmsg$IPSET_CMD_ADD(0xffffffffffffffff, 0x0, 0x0) sendmsg$IPSET_CMD_TEST(0xffffffffffffffff, &(0x7f0000000280)={0x0, 0x0, &(0x7f00000002c0)={&(0x7f0000000300)={0x48, 0xb, 0x6, 0x1, 0x0, 0x0, {0x2}, [@IPSET_ATTR_SETNAME={0x9, 0x2, 'syz1\x00'}, @IPSET_ATTR_DATA={0x28, 0x7, 0x0, 0x1, [@IPSET_ATTR_IP={0xc, 0x1, 0x0, 0x1, @IPSET_ATTR_IPADDR_IPV4={0x8, 0x1, 0x1, 0x0, @local}}, @IPSET_ATTR_PORT={0x6, 0x4, 0x1, 0x0, 0x5000}, @IPSET_ATTR_MARK={0x8, 0xa, 0x1, 0x0, 0xc}, @IPSET_ATTR_CIDR2={0x5, 0x15, 0x18}]}]}, 0x48}}, 0x0) socket$inet6_udp(0xa, 0x2, 0x0) socket(0x10, 0x803, 0x0) socket(0x10, 0x3, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./config\x00', 0x1ff) mount(0x0, &(0x7f0000000000)='./config\x00', &(0x7f0000000080)='configfs\x00', 0x0, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000140)='./config/usb_gadget/g1\x00', 0xbf) mkdirat(0xffffffffffffff9c, &(0x7f00000001c0)='./config/usb_gadget/g1/functions/uvc.0\x00', 0x1ff) mkdirat(0xffffffffffffff9c, &(0x7f0000000280)='./config/usb_gadget/g1/functions/uvc.0/streaming/mjpeg/m1\x00', 0x1ff) openat(0xffffffffffffff9c, &(0x7f00000002c0)='./config/usb_gadget/g1/functions/uvc.0/streaming/mjpeg/m1/bmaControls\x00', 0x2, 0x0) sendmsg$IPSET_CMD_CREATE(0xffffffffffffffff, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000200)=ANY=[@ANYBLOB="600000000206010800000000000000000000000005000400000000000900020073797a31000000001400078008001240000000000500140008000000050005000a000000050001000600000011000300686173683a69702c706f7274"], 0x60}}, 0x24000800) program crashed: KASAN: slab-use-after-free Read in ep_open testing program (duration=2m31.5s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): [0, 11, 4, 20] detailed listing: executing program 3: executing program 3: mkdirat(0xffffffffffffff9c, &(0x7f0000000100)='./gadget\x00', 0x1ff) mount(0x0, &(0x7f0000000140)='./gadget\x00', &(0x7f0000000180)='gadgetfs\x00', 0x0, 0x0) r0 = openat(0xffffffffffffff9c, &(0x7f00000001c0)='./gadget/dummy_udc\x00', 0x2, 0x0) mprotect(&(0x7f0000362000/0x2000)=nil, 0x2000, 0x1) write(r0, &(0x7f0000000200)="000000000902190001010080320904000001ff000000070581024000000902190001010080320904000001ff00000007058102000200120100020000004034127856000100000001", 0x48) write(0xffffffffffffffff, &(0x7f00000005c0)="010000000705810240000007058102000200", 0x12) ioctl$sock_SIOCGIFINDEX(0xffffffffffffffff, 0x8933, &(0x7f0000000040)={'bridge0\x00'}) write$P9_RRENAME(0xffffffffffffffff, 0x0, 0x0) mmap(&(0x7f0000362000/0x4000)=nil, 0x4000, 0x0, 0x12, 0xffffffffffffffff, 0xfffff000) r1 = syz_clone(0x21000200, 0x0, 0x0, 0x0, 0x0, 0x0) rt_tgsigqueueinfo(r1, r1, 0x8, 0x0) executing program 8: mkdirat(0xffffffffffffff9c, &(0x7f0000000040)='./mnt\x00', 0x1ff) bind$inet6(0xffffffffffffffff, &(0x7f00000001c0)={0xa, 0x4e20, 0xfffffffb, @empty, 0x2}, 0x1c) r0 = socket$packet(0x11, 0x2, 0x300) sendto$packet(r0, 0x0, 0x0, 0x0, &(0x7f0000000400)={0x11, 0x88a8, 0x0, 0x1, 0x0, 0x6, @local}, 0x14) executing program 0: r0 = syz_open_dev$dri(&(0x7f0000000000), 0x0, 0x0) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r0, 0xc02064b2, &(0x7f0000000040)={0x1, 0xd00, 0x6}) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r0, 0xc02064b2, &(0x7f0000000100)={0x1, 0x3, 0x9}) ioctl$DRM_IOCTL_PANTHOR_VM_CREATE(r0, 0xc0106441, &(0x7f0000000080)={0x0, 0x0, 0xffffffffffffffff}) socket$kcm(0xa, 0x2, 0x0) socket$nl_route(0x10, 0x3, 0x0) r1 = socket(0x10, 0x3, 0x0) getsockname$packet(r1, &(0x7f00000002c0)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000100)=0x14) sendmsg$nl_route(0xffffffffffffffff, &(0x7f0000000040)={0x0, 0x0, 0x0}, 0x0) sendmsg$IPSET_CMD_ADD(0xffffffffffffffff, 0x0, 0x0) sendmsg$IPSET_CMD_TEST(0xffffffffffffffff, &(0x7f0000000280)={0x0, 0x0, &(0x7f00000002c0)={&(0x7f0000000300)={0x48, 0xb, 0x6, 0x1, 0x0, 0x0, {0x2}, [@IPSET_ATTR_SETNAME={0x9, 0x2, 'syz1\x00'}, @IPSET_ATTR_DATA={0x28, 0x7, 0x0, 0x1, [@IPSET_ATTR_IP={0xc, 0x1, 0x0, 0x1, @IPSET_ATTR_IPADDR_IPV4={0x8, 0x1, 0x1, 0x0, @local}}, @IPSET_ATTR_PORT={0x6, 0x4, 0x1, 0x0, 0x5000}, @IPSET_ATTR_MARK={0x8, 0xa, 0x1, 0x0, 0xc}, @IPSET_ATTR_CIDR2={0x5, 0x15, 0x18}]}]}, 0x48}}, 0x0) socket$inet6_udp(0xa, 0x2, 0x0) socket(0x10, 0x803, 0x0) socket(0x10, 0x3, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./config\x00', 0x1ff) mount(0x0, &(0x7f0000000000)='./config\x00', &(0x7f0000000080)='configfs\x00', 0x0, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000140)='./config/usb_gadget/g1\x00', 0xbf) mkdirat(0xffffffffffffff9c, &(0x7f00000001c0)='./config/usb_gadget/g1/functions/uvc.0\x00', 0x1ff) mkdirat(0xffffffffffffff9c, &(0x7f0000000280)='./config/usb_gadget/g1/functions/uvc.0/streaming/mjpeg/m1\x00', 0x1ff) sendmsg$IPSET_CMD_CREATE(0xffffffffffffffff, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000200)=ANY=[@ANYBLOB="600000000206010800000000000000000000000005000400000000000900020073797a31000000001400078008001240000000000500140008000000050005000a000000050001000600000011000300686173683a69702c706f7274"], 0x60}}, 0x24000800) program crashed: KASAN: slab-use-after-free Read in ep_open testing program (duration=2m31.5s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): [0, 11, 4, 19] detailed listing: executing program 3: executing program 3: mkdirat(0xffffffffffffff9c, &(0x7f0000000100)='./gadget\x00', 0x1ff) mount(0x0, &(0x7f0000000140)='./gadget\x00', &(0x7f0000000180)='gadgetfs\x00', 0x0, 0x0) r0 = openat(0xffffffffffffff9c, &(0x7f00000001c0)='./gadget/dummy_udc\x00', 0x2, 0x0) mprotect(&(0x7f0000362000/0x2000)=nil, 0x2000, 0x1) write(r0, &(0x7f0000000200)="000000000902190001010080320904000001ff000000070581024000000902190001010080320904000001ff00000007058102000200120100020000004034127856000100000001", 0x48) write(0xffffffffffffffff, &(0x7f00000005c0)="010000000705810240000007058102000200", 0x12) ioctl$sock_SIOCGIFINDEX(0xffffffffffffffff, 0x8933, &(0x7f0000000040)={'bridge0\x00'}) write$P9_RRENAME(0xffffffffffffffff, 0x0, 0x0) mmap(&(0x7f0000362000/0x4000)=nil, 0x4000, 0x0, 0x12, 0xffffffffffffffff, 0xfffff000) r1 = syz_clone(0x21000200, 0x0, 0x0, 0x0, 0x0, 0x0) rt_tgsigqueueinfo(r1, r1, 0x8, 0x0) executing program 8: mkdirat(0xffffffffffffff9c, &(0x7f0000000040)='./mnt\x00', 0x1ff) bind$inet6(0xffffffffffffffff, &(0x7f00000001c0)={0xa, 0x4e20, 0xfffffffb, @empty, 0x2}, 0x1c) r0 = socket$packet(0x11, 0x2, 0x300) sendto$packet(r0, 0x0, 0x0, 0x0, &(0x7f0000000400)={0x11, 0x88a8, 0x0, 0x1, 0x0, 0x6, @local}, 0x14) executing program 0: r0 = syz_open_dev$dri(&(0x7f0000000000), 0x0, 0x0) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r0, 0xc02064b2, &(0x7f0000000040)={0x1, 0xd00, 0x6}) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r0, 0xc02064b2, &(0x7f0000000100)={0x1, 0x3, 0x9}) ioctl$DRM_IOCTL_PANTHOR_VM_CREATE(r0, 0xc0106441, &(0x7f0000000080)={0x0, 0x0, 0xffffffffffffffff}) socket$kcm(0xa, 0x2, 0x0) socket$nl_route(0x10, 0x3, 0x0) r1 = socket(0x10, 0x3, 0x0) getsockname$packet(r1, &(0x7f00000002c0)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000100)=0x14) sendmsg$nl_route(0xffffffffffffffff, &(0x7f0000000040)={0x0, 0x0, 0x0}, 0x0) sendmsg$IPSET_CMD_ADD(0xffffffffffffffff, 0x0, 0x0) sendmsg$IPSET_CMD_TEST(0xffffffffffffffff, &(0x7f0000000280)={0x0, 0x0, &(0x7f00000002c0)={&(0x7f0000000300)={0x48, 0xb, 0x6, 0x1, 0x0, 0x0, {0x2}, [@IPSET_ATTR_SETNAME={0x9, 0x2, 'syz1\x00'}, @IPSET_ATTR_DATA={0x28, 0x7, 0x0, 0x1, [@IPSET_ATTR_IP={0xc, 0x1, 0x0, 0x1, @IPSET_ATTR_IPADDR_IPV4={0x8, 0x1, 0x1, 0x0, @local}}, @IPSET_ATTR_PORT={0x6, 0x4, 0x1, 0x0, 0x5000}, @IPSET_ATTR_MARK={0x8, 0xa, 0x1, 0x0, 0xc}, @IPSET_ATTR_CIDR2={0x5, 0x15, 0x18}]}]}, 0x48}}, 0x0) socket$inet6_udp(0xa, 0x2, 0x0) socket(0x10, 0x803, 0x0) socket(0x10, 0x3, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./config\x00', 0x1ff) mount(0x0, &(0x7f0000000000)='./config\x00', &(0x7f0000000080)='configfs\x00', 0x0, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000140)='./config/usb_gadget/g1\x00', 0xbf) mkdirat(0xffffffffffffff9c, &(0x7f00000001c0)='./config/usb_gadget/g1/functions/uvc.0\x00', 0x1ff) sendmsg$IPSET_CMD_CREATE(0xffffffffffffffff, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000200)=ANY=[@ANYBLOB="600000000206010800000000000000000000000005000400000000000900020073797a31000000001400078008001240000000000500140008000000050005000a000000050001000600000011000300686173683a69702c706f7274"], 0x60}}, 0x24000800) program crashed: KASAN: slab-use-after-free Read in ep_open testing program (duration=2m31.5s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): [0, 11, 4, 18] detailed listing: executing program 3: executing program 3: mkdirat(0xffffffffffffff9c, &(0x7f0000000100)='./gadget\x00', 0x1ff) mount(0x0, &(0x7f0000000140)='./gadget\x00', &(0x7f0000000180)='gadgetfs\x00', 0x0, 0x0) r0 = openat(0xffffffffffffff9c, &(0x7f00000001c0)='./gadget/dummy_udc\x00', 0x2, 0x0) mprotect(&(0x7f0000362000/0x2000)=nil, 0x2000, 0x1) write(r0, &(0x7f0000000200)="000000000902190001010080320904000001ff000000070581024000000902190001010080320904000001ff00000007058102000200120100020000004034127856000100000001", 0x48) write(0xffffffffffffffff, &(0x7f00000005c0)="010000000705810240000007058102000200", 0x12) ioctl$sock_SIOCGIFINDEX(0xffffffffffffffff, 0x8933, &(0x7f0000000040)={'bridge0\x00'}) write$P9_RRENAME(0xffffffffffffffff, 0x0, 0x0) mmap(&(0x7f0000362000/0x4000)=nil, 0x4000, 0x0, 0x12, 0xffffffffffffffff, 0xfffff000) r1 = syz_clone(0x21000200, 0x0, 0x0, 0x0, 0x0, 0x0) rt_tgsigqueueinfo(r1, r1, 0x8, 0x0) executing program 8: mkdirat(0xffffffffffffff9c, &(0x7f0000000040)='./mnt\x00', 0x1ff) bind$inet6(0xffffffffffffffff, &(0x7f00000001c0)={0xa, 0x4e20, 0xfffffffb, @empty, 0x2}, 0x1c) r0 = socket$packet(0x11, 0x2, 0x300) sendto$packet(r0, 0x0, 0x0, 0x0, &(0x7f0000000400)={0x11, 0x88a8, 0x0, 0x1, 0x0, 0x6, @local}, 0x14) executing program 0: r0 = syz_open_dev$dri(&(0x7f0000000000), 0x0, 0x0) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r0, 0xc02064b2, &(0x7f0000000040)={0x1, 0xd00, 0x6}) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r0, 0xc02064b2, &(0x7f0000000100)={0x1, 0x3, 0x9}) ioctl$DRM_IOCTL_PANTHOR_VM_CREATE(r0, 0xc0106441, &(0x7f0000000080)={0x0, 0x0, 0xffffffffffffffff}) socket$kcm(0xa, 0x2, 0x0) socket$nl_route(0x10, 0x3, 0x0) r1 = socket(0x10, 0x3, 0x0) getsockname$packet(r1, &(0x7f00000002c0)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000100)=0x14) sendmsg$nl_route(0xffffffffffffffff, &(0x7f0000000040)={0x0, 0x0, 0x0}, 0x0) sendmsg$IPSET_CMD_ADD(0xffffffffffffffff, 0x0, 0x0) sendmsg$IPSET_CMD_TEST(0xffffffffffffffff, &(0x7f0000000280)={0x0, 0x0, &(0x7f00000002c0)={&(0x7f0000000300)={0x48, 0xb, 0x6, 0x1, 0x0, 0x0, {0x2}, [@IPSET_ATTR_SETNAME={0x9, 0x2, 'syz1\x00'}, @IPSET_ATTR_DATA={0x28, 0x7, 0x0, 0x1, [@IPSET_ATTR_IP={0xc, 0x1, 0x0, 0x1, @IPSET_ATTR_IPADDR_IPV4={0x8, 0x1, 0x1, 0x0, @local}}, @IPSET_ATTR_PORT={0x6, 0x4, 0x1, 0x0, 0x5000}, @IPSET_ATTR_MARK={0x8, 0xa, 0x1, 0x0, 0xc}, @IPSET_ATTR_CIDR2={0x5, 0x15, 0x18}]}]}, 0x48}}, 0x0) socket$inet6_udp(0xa, 0x2, 0x0) socket(0x10, 0x803, 0x0) socket(0x10, 0x3, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./config\x00', 0x1ff) mount(0x0, &(0x7f0000000000)='./config\x00', &(0x7f0000000080)='configfs\x00', 0x0, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000140)='./config/usb_gadget/g1\x00', 0xbf) sendmsg$IPSET_CMD_CREATE(0xffffffffffffffff, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000200)=ANY=[@ANYBLOB="600000000206010800000000000000000000000005000400000000000900020073797a31000000001400078008001240000000000500140008000000050005000a000000050001000600000011000300686173683a69702c706f7274"], 0x60}}, 0x24000800) program crashed: KASAN: slab-use-after-free Read in ep_open testing program (duration=2m31.5s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): [0, 11, 4, 17] detailed listing: executing program 3: executing program 3: mkdirat(0xffffffffffffff9c, &(0x7f0000000100)='./gadget\x00', 0x1ff) mount(0x0, &(0x7f0000000140)='./gadget\x00', &(0x7f0000000180)='gadgetfs\x00', 0x0, 0x0) r0 = openat(0xffffffffffffff9c, &(0x7f00000001c0)='./gadget/dummy_udc\x00', 0x2, 0x0) mprotect(&(0x7f0000362000/0x2000)=nil, 0x2000, 0x1) write(r0, &(0x7f0000000200)="000000000902190001010080320904000001ff000000070581024000000902190001010080320904000001ff00000007058102000200120100020000004034127856000100000001", 0x48) write(0xffffffffffffffff, &(0x7f00000005c0)="010000000705810240000007058102000200", 0x12) ioctl$sock_SIOCGIFINDEX(0xffffffffffffffff, 0x8933, &(0x7f0000000040)={'bridge0\x00'}) write$P9_RRENAME(0xffffffffffffffff, 0x0, 0x0) mmap(&(0x7f0000362000/0x4000)=nil, 0x4000, 0x0, 0x12, 0xffffffffffffffff, 0xfffff000) r1 = syz_clone(0x21000200, 0x0, 0x0, 0x0, 0x0, 0x0) rt_tgsigqueueinfo(r1, r1, 0x8, 0x0) executing program 8: mkdirat(0xffffffffffffff9c, &(0x7f0000000040)='./mnt\x00', 0x1ff) bind$inet6(0xffffffffffffffff, &(0x7f00000001c0)={0xa, 0x4e20, 0xfffffffb, @empty, 0x2}, 0x1c) r0 = socket$packet(0x11, 0x2, 0x300) sendto$packet(r0, 0x0, 0x0, 0x0, &(0x7f0000000400)={0x11, 0x88a8, 0x0, 0x1, 0x0, 0x6, @local}, 0x14) executing program 0: r0 = syz_open_dev$dri(&(0x7f0000000000), 0x0, 0x0) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r0, 0xc02064b2, &(0x7f0000000040)={0x1, 0xd00, 0x6}) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r0, 0xc02064b2, &(0x7f0000000100)={0x1, 0x3, 0x9}) ioctl$DRM_IOCTL_PANTHOR_VM_CREATE(r0, 0xc0106441, &(0x7f0000000080)={0x0, 0x0, 0xffffffffffffffff}) socket$kcm(0xa, 0x2, 0x0) socket$nl_route(0x10, 0x3, 0x0) r1 = socket(0x10, 0x3, 0x0) getsockname$packet(r1, &(0x7f00000002c0)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000100)=0x14) sendmsg$nl_route(0xffffffffffffffff, &(0x7f0000000040)={0x0, 0x0, 0x0}, 0x0) sendmsg$IPSET_CMD_ADD(0xffffffffffffffff, 0x0, 0x0) sendmsg$IPSET_CMD_TEST(0xffffffffffffffff, &(0x7f0000000280)={0x0, 0x0, &(0x7f00000002c0)={&(0x7f0000000300)={0x48, 0xb, 0x6, 0x1, 0x0, 0x0, {0x2}, [@IPSET_ATTR_SETNAME={0x9, 0x2, 'syz1\x00'}, @IPSET_ATTR_DATA={0x28, 0x7, 0x0, 0x1, [@IPSET_ATTR_IP={0xc, 0x1, 0x0, 0x1, @IPSET_ATTR_IPADDR_IPV4={0x8, 0x1, 0x1, 0x0, @local}}, @IPSET_ATTR_PORT={0x6, 0x4, 0x1, 0x0, 0x5000}, @IPSET_ATTR_MARK={0x8, 0xa, 0x1, 0x0, 0xc}, @IPSET_ATTR_CIDR2={0x5, 0x15, 0x18}]}]}, 0x48}}, 0x0) socket$inet6_udp(0xa, 0x2, 0x0) socket(0x10, 0x803, 0x0) socket(0x10, 0x3, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./config\x00', 0x1ff) mount(0x0, &(0x7f0000000000)='./config\x00', &(0x7f0000000080)='configfs\x00', 0x0, 0x0) sendmsg$IPSET_CMD_CREATE(0xffffffffffffffff, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000200)=ANY=[@ANYBLOB="600000000206010800000000000000000000000005000400000000000900020073797a31000000001400078008001240000000000500140008000000050005000a000000050001000600000011000300686173683a69702c706f7274"], 0x60}}, 0x24000800) program crashed: KASAN: slab-use-after-free Read in ep_open testing program (duration=2m31.5s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): [0, 11, 4, 16] detailed listing: executing program 3: executing program 3: mkdirat(0xffffffffffffff9c, &(0x7f0000000100)='./gadget\x00', 0x1ff) mount(0x0, &(0x7f0000000140)='./gadget\x00', &(0x7f0000000180)='gadgetfs\x00', 0x0, 0x0) r0 = openat(0xffffffffffffff9c, &(0x7f00000001c0)='./gadget/dummy_udc\x00', 0x2, 0x0) mprotect(&(0x7f0000362000/0x2000)=nil, 0x2000, 0x1) write(r0, &(0x7f0000000200)="000000000902190001010080320904000001ff000000070581024000000902190001010080320904000001ff00000007058102000200120100020000004034127856000100000001", 0x48) write(0xffffffffffffffff, &(0x7f00000005c0)="010000000705810240000007058102000200", 0x12) ioctl$sock_SIOCGIFINDEX(0xffffffffffffffff, 0x8933, &(0x7f0000000040)={'bridge0\x00'}) write$P9_RRENAME(0xffffffffffffffff, 0x0, 0x0) mmap(&(0x7f0000362000/0x4000)=nil, 0x4000, 0x0, 0x12, 0xffffffffffffffff, 0xfffff000) r1 = syz_clone(0x21000200, 0x0, 0x0, 0x0, 0x0, 0x0) rt_tgsigqueueinfo(r1, r1, 0x8, 0x0) executing program 8: mkdirat(0xffffffffffffff9c, &(0x7f0000000040)='./mnt\x00', 0x1ff) bind$inet6(0xffffffffffffffff, &(0x7f00000001c0)={0xa, 0x4e20, 0xfffffffb, @empty, 0x2}, 0x1c) r0 = socket$packet(0x11, 0x2, 0x300) sendto$packet(r0, 0x0, 0x0, 0x0, &(0x7f0000000400)={0x11, 0x88a8, 0x0, 0x1, 0x0, 0x6, @local}, 0x14) executing program 0: r0 = syz_open_dev$dri(&(0x7f0000000000), 0x0, 0x0) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r0, 0xc02064b2, &(0x7f0000000040)={0x1, 0xd00, 0x6}) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r0, 0xc02064b2, &(0x7f0000000100)={0x1, 0x3, 0x9}) ioctl$DRM_IOCTL_PANTHOR_VM_CREATE(r0, 0xc0106441, &(0x7f0000000080)={0x0, 0x0, 0xffffffffffffffff}) socket$kcm(0xa, 0x2, 0x0) socket$nl_route(0x10, 0x3, 0x0) r1 = socket(0x10, 0x3, 0x0) getsockname$packet(r1, &(0x7f00000002c0)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000100)=0x14) sendmsg$nl_route(0xffffffffffffffff, &(0x7f0000000040)={0x0, 0x0, 0x0}, 0x0) sendmsg$IPSET_CMD_ADD(0xffffffffffffffff, 0x0, 0x0) sendmsg$IPSET_CMD_TEST(0xffffffffffffffff, &(0x7f0000000280)={0x0, 0x0, &(0x7f00000002c0)={&(0x7f0000000300)={0x48, 0xb, 0x6, 0x1, 0x0, 0x0, {0x2}, [@IPSET_ATTR_SETNAME={0x9, 0x2, 'syz1\x00'}, @IPSET_ATTR_DATA={0x28, 0x7, 0x0, 0x1, [@IPSET_ATTR_IP={0xc, 0x1, 0x0, 0x1, @IPSET_ATTR_IPADDR_IPV4={0x8, 0x1, 0x1, 0x0, @local}}, @IPSET_ATTR_PORT={0x6, 0x4, 0x1, 0x0, 0x5000}, @IPSET_ATTR_MARK={0x8, 0xa, 0x1, 0x0, 0xc}, @IPSET_ATTR_CIDR2={0x5, 0x15, 0x18}]}]}, 0x48}}, 0x0) socket$inet6_udp(0xa, 0x2, 0x0) socket(0x10, 0x803, 0x0) socket(0x10, 0x3, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./config\x00', 0x1ff) sendmsg$IPSET_CMD_CREATE(0xffffffffffffffff, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000200)=ANY=[@ANYBLOB="600000000206010800000000000000000000000005000400000000000900020073797a31000000001400078008001240000000000500140008000000050005000a000000050001000600000011000300686173683a69702c706f7274"], 0x60}}, 0x24000800) program crashed: KASAN: slab-use-after-free Read in ep_open testing program (duration=2m31.5s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): [0, 11, 4, 15] detailed listing: executing program 3: executing program 3: mkdirat(0xffffffffffffff9c, &(0x7f0000000100)='./gadget\x00', 0x1ff) mount(0x0, &(0x7f0000000140)='./gadget\x00', &(0x7f0000000180)='gadgetfs\x00', 0x0, 0x0) r0 = openat(0xffffffffffffff9c, &(0x7f00000001c0)='./gadget/dummy_udc\x00', 0x2, 0x0) mprotect(&(0x7f0000362000/0x2000)=nil, 0x2000, 0x1) write(r0, &(0x7f0000000200)="000000000902190001010080320904000001ff000000070581024000000902190001010080320904000001ff00000007058102000200120100020000004034127856000100000001", 0x48) write(0xffffffffffffffff, &(0x7f00000005c0)="010000000705810240000007058102000200", 0x12) ioctl$sock_SIOCGIFINDEX(0xffffffffffffffff, 0x8933, &(0x7f0000000040)={'bridge0\x00'}) write$P9_RRENAME(0xffffffffffffffff, 0x0, 0x0) mmap(&(0x7f0000362000/0x4000)=nil, 0x4000, 0x0, 0x12, 0xffffffffffffffff, 0xfffff000) r1 = syz_clone(0x21000200, 0x0, 0x0, 0x0, 0x0, 0x0) rt_tgsigqueueinfo(r1, r1, 0x8, 0x0) executing program 8: mkdirat(0xffffffffffffff9c, &(0x7f0000000040)='./mnt\x00', 0x1ff) bind$inet6(0xffffffffffffffff, &(0x7f00000001c0)={0xa, 0x4e20, 0xfffffffb, @empty, 0x2}, 0x1c) r0 = socket$packet(0x11, 0x2, 0x300) sendto$packet(r0, 0x0, 0x0, 0x0, &(0x7f0000000400)={0x11, 0x88a8, 0x0, 0x1, 0x0, 0x6, @local}, 0x14) executing program 0: r0 = syz_open_dev$dri(&(0x7f0000000000), 0x0, 0x0) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r0, 0xc02064b2, &(0x7f0000000040)={0x1, 0xd00, 0x6}) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r0, 0xc02064b2, &(0x7f0000000100)={0x1, 0x3, 0x9}) ioctl$DRM_IOCTL_PANTHOR_VM_CREATE(r0, 0xc0106441, &(0x7f0000000080)={0x0, 0x0, 0xffffffffffffffff}) socket$kcm(0xa, 0x2, 0x0) socket$nl_route(0x10, 0x3, 0x0) r1 = socket(0x10, 0x3, 0x0) getsockname$packet(r1, &(0x7f00000002c0)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000100)=0x14) sendmsg$nl_route(0xffffffffffffffff, &(0x7f0000000040)={0x0, 0x0, 0x0}, 0x0) sendmsg$IPSET_CMD_ADD(0xffffffffffffffff, 0x0, 0x0) sendmsg$IPSET_CMD_TEST(0xffffffffffffffff, &(0x7f0000000280)={0x0, 0x0, &(0x7f00000002c0)={&(0x7f0000000300)={0x48, 0xb, 0x6, 0x1, 0x0, 0x0, {0x2}, [@IPSET_ATTR_SETNAME={0x9, 0x2, 'syz1\x00'}, @IPSET_ATTR_DATA={0x28, 0x7, 0x0, 0x1, [@IPSET_ATTR_IP={0xc, 0x1, 0x0, 0x1, @IPSET_ATTR_IPADDR_IPV4={0x8, 0x1, 0x1, 0x0, @local}}, @IPSET_ATTR_PORT={0x6, 0x4, 0x1, 0x0, 0x5000}, @IPSET_ATTR_MARK={0x8, 0xa, 0x1, 0x0, 0xc}, @IPSET_ATTR_CIDR2={0x5, 0x15, 0x18}]}]}, 0x48}}, 0x0) socket$inet6_udp(0xa, 0x2, 0x0) socket(0x10, 0x803, 0x0) socket(0x10, 0x3, 0x0) sendmsg$IPSET_CMD_CREATE(0xffffffffffffffff, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000200)=ANY=[@ANYBLOB="600000000206010800000000000000000000000005000400000000000900020073797a31000000001400078008001240000000000500140008000000050005000a000000050001000600000011000300686173683a69702c706f7274"], 0x60}}, 0x24000800) program crashed: KASAN: slab-use-after-free Read in ep_open testing program (duration=2m31.5s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): [0, 11, 4, 14] detailed listing: executing program 3: executing program 3: mkdirat(0xffffffffffffff9c, &(0x7f0000000100)='./gadget\x00', 0x1ff) mount(0x0, &(0x7f0000000140)='./gadget\x00', &(0x7f0000000180)='gadgetfs\x00', 0x0, 0x0) r0 = openat(0xffffffffffffff9c, &(0x7f00000001c0)='./gadget/dummy_udc\x00', 0x2, 0x0) mprotect(&(0x7f0000362000/0x2000)=nil, 0x2000, 0x1) write(r0, &(0x7f0000000200)="000000000902190001010080320904000001ff000000070581024000000902190001010080320904000001ff00000007058102000200120100020000004034127856000100000001", 0x48) write(0xffffffffffffffff, &(0x7f00000005c0)="010000000705810240000007058102000200", 0x12) ioctl$sock_SIOCGIFINDEX(0xffffffffffffffff, 0x8933, &(0x7f0000000040)={'bridge0\x00'}) write$P9_RRENAME(0xffffffffffffffff, 0x0, 0x0) mmap(&(0x7f0000362000/0x4000)=nil, 0x4000, 0x0, 0x12, 0xffffffffffffffff, 0xfffff000) r1 = syz_clone(0x21000200, 0x0, 0x0, 0x0, 0x0, 0x0) rt_tgsigqueueinfo(r1, r1, 0x8, 0x0) executing program 8: mkdirat(0xffffffffffffff9c, &(0x7f0000000040)='./mnt\x00', 0x1ff) bind$inet6(0xffffffffffffffff, &(0x7f00000001c0)={0xa, 0x4e20, 0xfffffffb, @empty, 0x2}, 0x1c) r0 = socket$packet(0x11, 0x2, 0x300) sendto$packet(r0, 0x0, 0x0, 0x0, &(0x7f0000000400)={0x11, 0x88a8, 0x0, 0x1, 0x0, 0x6, @local}, 0x14) executing program 0: r0 = syz_open_dev$dri(&(0x7f0000000000), 0x0, 0x0) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r0, 0xc02064b2, &(0x7f0000000040)={0x1, 0xd00, 0x6}) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r0, 0xc02064b2, &(0x7f0000000100)={0x1, 0x3, 0x9}) ioctl$DRM_IOCTL_PANTHOR_VM_CREATE(r0, 0xc0106441, &(0x7f0000000080)={0x0, 0x0, 0xffffffffffffffff}) socket$kcm(0xa, 0x2, 0x0) socket$nl_route(0x10, 0x3, 0x0) r1 = socket(0x10, 0x3, 0x0) getsockname$packet(r1, &(0x7f00000002c0)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000100)=0x14) sendmsg$nl_route(0xffffffffffffffff, &(0x7f0000000040)={0x0, 0x0, 0x0}, 0x0) sendmsg$IPSET_CMD_ADD(0xffffffffffffffff, 0x0, 0x0) sendmsg$IPSET_CMD_TEST(0xffffffffffffffff, &(0x7f0000000280)={0x0, 0x0, &(0x7f00000002c0)={&(0x7f0000000300)={0x48, 0xb, 0x6, 0x1, 0x0, 0x0, {0x2}, [@IPSET_ATTR_SETNAME={0x9, 0x2, 'syz1\x00'}, @IPSET_ATTR_DATA={0x28, 0x7, 0x0, 0x1, [@IPSET_ATTR_IP={0xc, 0x1, 0x0, 0x1, @IPSET_ATTR_IPADDR_IPV4={0x8, 0x1, 0x1, 0x0, @local}}, @IPSET_ATTR_PORT={0x6, 0x4, 0x1, 0x0, 0x5000}, @IPSET_ATTR_MARK={0x8, 0xa, 0x1, 0x0, 0xc}, @IPSET_ATTR_CIDR2={0x5, 0x15, 0x18}]}]}, 0x48}}, 0x0) socket$inet6_udp(0xa, 0x2, 0x0) socket(0x10, 0x803, 0x0) sendmsg$IPSET_CMD_CREATE(0xffffffffffffffff, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000200)=ANY=[@ANYBLOB="600000000206010800000000000000000000000005000400000000000900020073797a31000000001400078008001240000000000500140008000000050005000a000000050001000600000011000300686173683a69702c706f7274"], 0x60}}, 0x24000800) program crashed: KASAN: slab-use-after-free Read in ep_open testing program (duration=2m31.5s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): [0, 11, 4, 13] detailed listing: executing program 3: executing program 3: mkdirat(0xffffffffffffff9c, &(0x7f0000000100)='./gadget\x00', 0x1ff) mount(0x0, &(0x7f0000000140)='./gadget\x00', &(0x7f0000000180)='gadgetfs\x00', 0x0, 0x0) r0 = openat(0xffffffffffffff9c, &(0x7f00000001c0)='./gadget/dummy_udc\x00', 0x2, 0x0) mprotect(&(0x7f0000362000/0x2000)=nil, 0x2000, 0x1) write(r0, &(0x7f0000000200)="000000000902190001010080320904000001ff000000070581024000000902190001010080320904000001ff00000007058102000200120100020000004034127856000100000001", 0x48) write(0xffffffffffffffff, &(0x7f00000005c0)="010000000705810240000007058102000200", 0x12) ioctl$sock_SIOCGIFINDEX(0xffffffffffffffff, 0x8933, &(0x7f0000000040)={'bridge0\x00'}) write$P9_RRENAME(0xffffffffffffffff, 0x0, 0x0) mmap(&(0x7f0000362000/0x4000)=nil, 0x4000, 0x0, 0x12, 0xffffffffffffffff, 0xfffff000) r1 = syz_clone(0x21000200, 0x0, 0x0, 0x0, 0x0, 0x0) rt_tgsigqueueinfo(r1, r1, 0x8, 0x0) executing program 8: mkdirat(0xffffffffffffff9c, &(0x7f0000000040)='./mnt\x00', 0x1ff) bind$inet6(0xffffffffffffffff, &(0x7f00000001c0)={0xa, 0x4e20, 0xfffffffb, @empty, 0x2}, 0x1c) r0 = socket$packet(0x11, 0x2, 0x300) sendto$packet(r0, 0x0, 0x0, 0x0, &(0x7f0000000400)={0x11, 0x88a8, 0x0, 0x1, 0x0, 0x6, @local}, 0x14) executing program 0: r0 = syz_open_dev$dri(&(0x7f0000000000), 0x0, 0x0) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r0, 0xc02064b2, &(0x7f0000000040)={0x1, 0xd00, 0x6}) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r0, 0xc02064b2, &(0x7f0000000100)={0x1, 0x3, 0x9}) ioctl$DRM_IOCTL_PANTHOR_VM_CREATE(r0, 0xc0106441, &(0x7f0000000080)={0x0, 0x0, 0xffffffffffffffff}) socket$kcm(0xa, 0x2, 0x0) socket$nl_route(0x10, 0x3, 0x0) r1 = socket(0x10, 0x3, 0x0) getsockname$packet(r1, &(0x7f00000002c0)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000100)=0x14) sendmsg$nl_route(0xffffffffffffffff, &(0x7f0000000040)={0x0, 0x0, 0x0}, 0x0) sendmsg$IPSET_CMD_ADD(0xffffffffffffffff, 0x0, 0x0) sendmsg$IPSET_CMD_TEST(0xffffffffffffffff, &(0x7f0000000280)={0x0, 0x0, &(0x7f00000002c0)={&(0x7f0000000300)={0x48, 0xb, 0x6, 0x1, 0x0, 0x0, {0x2}, [@IPSET_ATTR_SETNAME={0x9, 0x2, 'syz1\x00'}, @IPSET_ATTR_DATA={0x28, 0x7, 0x0, 0x1, [@IPSET_ATTR_IP={0xc, 0x1, 0x0, 0x1, @IPSET_ATTR_IPADDR_IPV4={0x8, 0x1, 0x1, 0x0, @local}}, @IPSET_ATTR_PORT={0x6, 0x4, 0x1, 0x0, 0x5000}, @IPSET_ATTR_MARK={0x8, 0xa, 0x1, 0x0, 0xc}, @IPSET_ATTR_CIDR2={0x5, 0x15, 0x18}]}]}, 0x48}}, 0x0) socket$inet6_udp(0xa, 0x2, 0x0) sendmsg$IPSET_CMD_CREATE(0xffffffffffffffff, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000200)=ANY=[@ANYBLOB="600000000206010800000000000000000000000005000400000000000900020073797a31000000001400078008001240000000000500140008000000050005000a000000050001000600000011000300686173683a69702c706f7274"], 0x60}}, 0x24000800) program crashed: KASAN: slab-use-after-free Read in ep_open testing program (duration=2m31.5s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): [0, 11, 4, 12] detailed listing: executing program 3: executing program 3: mkdirat(0xffffffffffffff9c, &(0x7f0000000100)='./gadget\x00', 0x1ff) mount(0x0, &(0x7f0000000140)='./gadget\x00', &(0x7f0000000180)='gadgetfs\x00', 0x0, 0x0) r0 = openat(0xffffffffffffff9c, &(0x7f00000001c0)='./gadget/dummy_udc\x00', 0x2, 0x0) mprotect(&(0x7f0000362000/0x2000)=nil, 0x2000, 0x1) write(r0, &(0x7f0000000200)="000000000902190001010080320904000001ff000000070581024000000902190001010080320904000001ff00000007058102000200120100020000004034127856000100000001", 0x48) write(0xffffffffffffffff, &(0x7f00000005c0)="010000000705810240000007058102000200", 0x12) ioctl$sock_SIOCGIFINDEX(0xffffffffffffffff, 0x8933, &(0x7f0000000040)={'bridge0\x00'}) write$P9_RRENAME(0xffffffffffffffff, 0x0, 0x0) mmap(&(0x7f0000362000/0x4000)=nil, 0x4000, 0x0, 0x12, 0xffffffffffffffff, 0xfffff000) r1 = syz_clone(0x21000200, 0x0, 0x0, 0x0, 0x0, 0x0) rt_tgsigqueueinfo(r1, r1, 0x8, 0x0) executing program 8: mkdirat(0xffffffffffffff9c, &(0x7f0000000040)='./mnt\x00', 0x1ff) bind$inet6(0xffffffffffffffff, &(0x7f00000001c0)={0xa, 0x4e20, 0xfffffffb, @empty, 0x2}, 0x1c) r0 = socket$packet(0x11, 0x2, 0x300) sendto$packet(r0, 0x0, 0x0, 0x0, &(0x7f0000000400)={0x11, 0x88a8, 0x0, 0x1, 0x0, 0x6, @local}, 0x14) executing program 0: r0 = syz_open_dev$dri(&(0x7f0000000000), 0x0, 0x0) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r0, 0xc02064b2, &(0x7f0000000040)={0x1, 0xd00, 0x6}) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r0, 0xc02064b2, &(0x7f0000000100)={0x1, 0x3, 0x9}) ioctl$DRM_IOCTL_PANTHOR_VM_CREATE(r0, 0xc0106441, &(0x7f0000000080)={0x0, 0x0, 0xffffffffffffffff}) socket$kcm(0xa, 0x2, 0x0) socket$nl_route(0x10, 0x3, 0x0) r1 = socket(0x10, 0x3, 0x0) getsockname$packet(r1, &(0x7f00000002c0)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000100)=0x14) sendmsg$nl_route(0xffffffffffffffff, &(0x7f0000000040)={0x0, 0x0, 0x0}, 0x0) sendmsg$IPSET_CMD_ADD(0xffffffffffffffff, 0x0, 0x0) sendmsg$IPSET_CMD_TEST(0xffffffffffffffff, &(0x7f0000000280)={0x0, 0x0, &(0x7f00000002c0)={&(0x7f0000000300)={0x48, 0xb, 0x6, 0x1, 0x0, 0x0, {0x2}, [@IPSET_ATTR_SETNAME={0x9, 0x2, 'syz1\x00'}, @IPSET_ATTR_DATA={0x28, 0x7, 0x0, 0x1, [@IPSET_ATTR_IP={0xc, 0x1, 0x0, 0x1, @IPSET_ATTR_IPADDR_IPV4={0x8, 0x1, 0x1, 0x0, @local}}, @IPSET_ATTR_PORT={0x6, 0x4, 0x1, 0x0, 0x5000}, @IPSET_ATTR_MARK={0x8, 0xa, 0x1, 0x0, 0xc}, @IPSET_ATTR_CIDR2={0x5, 0x15, 0x18}]}]}, 0x48}}, 0x0) sendmsg$IPSET_CMD_CREATE(0xffffffffffffffff, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000200)=ANY=[@ANYBLOB="600000000206010800000000000000000000000005000400000000000900020073797a31000000001400078008001240000000000500140008000000050005000a000000050001000600000011000300686173683a69702c706f7274"], 0x60}}, 0x24000800) program crashed: KASAN: slab-use-after-free Read in ep_open testing program (duration=2m31.5s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): [0, 11, 4, 11] detailed listing: executing program 3: executing program 3: mkdirat(0xffffffffffffff9c, &(0x7f0000000100)='./gadget\x00', 0x1ff) mount(0x0, &(0x7f0000000140)='./gadget\x00', &(0x7f0000000180)='gadgetfs\x00', 0x0, 0x0) r0 = openat(0xffffffffffffff9c, &(0x7f00000001c0)='./gadget/dummy_udc\x00', 0x2, 0x0) mprotect(&(0x7f0000362000/0x2000)=nil, 0x2000, 0x1) write(r0, &(0x7f0000000200)="000000000902190001010080320904000001ff000000070581024000000902190001010080320904000001ff00000007058102000200120100020000004034127856000100000001", 0x48) write(0xffffffffffffffff, &(0x7f00000005c0)="010000000705810240000007058102000200", 0x12) ioctl$sock_SIOCGIFINDEX(0xffffffffffffffff, 0x8933, &(0x7f0000000040)={'bridge0\x00'}) write$P9_RRENAME(0xffffffffffffffff, 0x0, 0x0) mmap(&(0x7f0000362000/0x4000)=nil, 0x4000, 0x0, 0x12, 0xffffffffffffffff, 0xfffff000) r1 = syz_clone(0x21000200, 0x0, 0x0, 0x0, 0x0, 0x0) rt_tgsigqueueinfo(r1, r1, 0x8, 0x0) executing program 8: mkdirat(0xffffffffffffff9c, &(0x7f0000000040)='./mnt\x00', 0x1ff) bind$inet6(0xffffffffffffffff, &(0x7f00000001c0)={0xa, 0x4e20, 0xfffffffb, @empty, 0x2}, 0x1c) r0 = socket$packet(0x11, 0x2, 0x300) sendto$packet(r0, 0x0, 0x0, 0x0, &(0x7f0000000400)={0x11, 0x88a8, 0x0, 0x1, 0x0, 0x6, @local}, 0x14) executing program 0: r0 = syz_open_dev$dri(&(0x7f0000000000), 0x0, 0x0) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r0, 0xc02064b2, &(0x7f0000000040)={0x1, 0xd00, 0x6}) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r0, 0xc02064b2, &(0x7f0000000100)={0x1, 0x3, 0x9}) ioctl$DRM_IOCTL_PANTHOR_VM_CREATE(r0, 0xc0106441, &(0x7f0000000080)={0x0, 0x0, 0xffffffffffffffff}) socket$kcm(0xa, 0x2, 0x0) socket$nl_route(0x10, 0x3, 0x0) r1 = socket(0x10, 0x3, 0x0) getsockname$packet(r1, &(0x7f00000002c0)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000100)=0x14) sendmsg$nl_route(0xffffffffffffffff, &(0x7f0000000040)={0x0, 0x0, 0x0}, 0x0) sendmsg$IPSET_CMD_ADD(0xffffffffffffffff, 0x0, 0x0) sendmsg$IPSET_CMD_CREATE(0xffffffffffffffff, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000200)=ANY=[@ANYBLOB="600000000206010800000000000000000000000005000400000000000900020073797a31000000001400078008001240000000000500140008000000050005000a000000050001000600000011000300686173683a69702c706f7274"], 0x60}}, 0x24000800) program crashed: KASAN: slab-use-after-free Read in ep_open testing program (duration=2m31.5s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): [0, 11, 4, 10] detailed listing: executing program 3: executing program 3: mkdirat(0xffffffffffffff9c, &(0x7f0000000100)='./gadget\x00', 0x1ff) mount(0x0, &(0x7f0000000140)='./gadget\x00', &(0x7f0000000180)='gadgetfs\x00', 0x0, 0x0) r0 = openat(0xffffffffffffff9c, &(0x7f00000001c0)='./gadget/dummy_udc\x00', 0x2, 0x0) mprotect(&(0x7f0000362000/0x2000)=nil, 0x2000, 0x1) write(r0, &(0x7f0000000200)="000000000902190001010080320904000001ff000000070581024000000902190001010080320904000001ff00000007058102000200120100020000004034127856000100000001", 0x48) write(0xffffffffffffffff, &(0x7f00000005c0)="010000000705810240000007058102000200", 0x12) ioctl$sock_SIOCGIFINDEX(0xffffffffffffffff, 0x8933, &(0x7f0000000040)={'bridge0\x00'}) write$P9_RRENAME(0xffffffffffffffff, 0x0, 0x0) mmap(&(0x7f0000362000/0x4000)=nil, 0x4000, 0x0, 0x12, 0xffffffffffffffff, 0xfffff000) r1 = syz_clone(0x21000200, 0x0, 0x0, 0x0, 0x0, 0x0) rt_tgsigqueueinfo(r1, r1, 0x8, 0x0) executing program 8: mkdirat(0xffffffffffffff9c, &(0x7f0000000040)='./mnt\x00', 0x1ff) bind$inet6(0xffffffffffffffff, &(0x7f00000001c0)={0xa, 0x4e20, 0xfffffffb, @empty, 0x2}, 0x1c) r0 = socket$packet(0x11, 0x2, 0x300) sendto$packet(r0, 0x0, 0x0, 0x0, &(0x7f0000000400)={0x11, 0x88a8, 0x0, 0x1, 0x0, 0x6, @local}, 0x14) executing program 0: r0 = syz_open_dev$dri(&(0x7f0000000000), 0x0, 0x0) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r0, 0xc02064b2, &(0x7f0000000040)={0x1, 0xd00, 0x6}) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r0, 0xc02064b2, &(0x7f0000000100)={0x1, 0x3, 0x9}) ioctl$DRM_IOCTL_PANTHOR_VM_CREATE(r0, 0xc0106441, &(0x7f0000000080)={0x0, 0x0, 0xffffffffffffffff}) socket$kcm(0xa, 0x2, 0x0) socket$nl_route(0x10, 0x3, 0x0) r1 = socket(0x10, 0x3, 0x0) getsockname$packet(r1, &(0x7f00000002c0)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000100)=0x14) sendmsg$nl_route(0xffffffffffffffff, &(0x7f0000000040)={0x0, 0x0, 0x0}, 0x0) sendmsg$IPSET_CMD_CREATE(0xffffffffffffffff, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000200)=ANY=[@ANYBLOB="600000000206010800000000000000000000000005000400000000000900020073797a31000000001400078008001240000000000500140008000000050005000a000000050001000600000011000300686173683a69702c706f7274"], 0x60}}, 0x24000800) program crashed: KASAN: slab-use-after-free Read in ep_open testing program (duration=2m31.5s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): [0, 11, 4, 9] detailed listing: executing program 3: executing program 3: mkdirat(0xffffffffffffff9c, &(0x7f0000000100)='./gadget\x00', 0x1ff) mount(0x0, &(0x7f0000000140)='./gadget\x00', &(0x7f0000000180)='gadgetfs\x00', 0x0, 0x0) r0 = openat(0xffffffffffffff9c, &(0x7f00000001c0)='./gadget/dummy_udc\x00', 0x2, 0x0) mprotect(&(0x7f0000362000/0x2000)=nil, 0x2000, 0x1) write(r0, &(0x7f0000000200)="000000000902190001010080320904000001ff000000070581024000000902190001010080320904000001ff00000007058102000200120100020000004034127856000100000001", 0x48) write(0xffffffffffffffff, &(0x7f00000005c0)="010000000705810240000007058102000200", 0x12) ioctl$sock_SIOCGIFINDEX(0xffffffffffffffff, 0x8933, &(0x7f0000000040)={'bridge0\x00'}) write$P9_RRENAME(0xffffffffffffffff, 0x0, 0x0) mmap(&(0x7f0000362000/0x4000)=nil, 0x4000, 0x0, 0x12, 0xffffffffffffffff, 0xfffff000) r1 = syz_clone(0x21000200, 0x0, 0x0, 0x0, 0x0, 0x0) rt_tgsigqueueinfo(r1, r1, 0x8, 0x0) executing program 8: mkdirat(0xffffffffffffff9c, &(0x7f0000000040)='./mnt\x00', 0x1ff) bind$inet6(0xffffffffffffffff, &(0x7f00000001c0)={0xa, 0x4e20, 0xfffffffb, @empty, 0x2}, 0x1c) r0 = socket$packet(0x11, 0x2, 0x300) sendto$packet(r0, 0x0, 0x0, 0x0, &(0x7f0000000400)={0x11, 0x88a8, 0x0, 0x1, 0x0, 0x6, @local}, 0x14) executing program 0: r0 = syz_open_dev$dri(&(0x7f0000000000), 0x0, 0x0) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r0, 0xc02064b2, &(0x7f0000000040)={0x1, 0xd00, 0x6}) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r0, 0xc02064b2, &(0x7f0000000100)={0x1, 0x3, 0x9}) ioctl$DRM_IOCTL_PANTHOR_VM_CREATE(r0, 0xc0106441, &(0x7f0000000080)={0x0, 0x0, 0xffffffffffffffff}) socket$kcm(0xa, 0x2, 0x0) socket$nl_route(0x10, 0x3, 0x0) r1 = socket(0x10, 0x3, 0x0) getsockname$packet(r1, &(0x7f00000002c0)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000100)=0x14) sendmsg$IPSET_CMD_CREATE(0xffffffffffffffff, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000200)=ANY=[@ANYBLOB="600000000206010800000000000000000000000005000400000000000900020073797a31000000001400078008001240000000000500140008000000050005000a000000050001000600000011000300686173683a69702c706f7274"], 0x60}}, 0x24000800) program crashed: KASAN: slab-use-after-free Read in ep_open testing program (duration=2m31.5s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): [0, 11, 4, 8] detailed listing: executing program 3: executing program 3: mkdirat(0xffffffffffffff9c, &(0x7f0000000100)='./gadget\x00', 0x1ff) mount(0x0, &(0x7f0000000140)='./gadget\x00', &(0x7f0000000180)='gadgetfs\x00', 0x0, 0x0) r0 = openat(0xffffffffffffff9c, &(0x7f00000001c0)='./gadget/dummy_udc\x00', 0x2, 0x0) mprotect(&(0x7f0000362000/0x2000)=nil, 0x2000, 0x1) write(r0, &(0x7f0000000200)="000000000902190001010080320904000001ff000000070581024000000902190001010080320904000001ff00000007058102000200120100020000004034127856000100000001", 0x48) write(0xffffffffffffffff, &(0x7f00000005c0)="010000000705810240000007058102000200", 0x12) ioctl$sock_SIOCGIFINDEX(0xffffffffffffffff, 0x8933, &(0x7f0000000040)={'bridge0\x00'}) write$P9_RRENAME(0xffffffffffffffff, 0x0, 0x0) mmap(&(0x7f0000362000/0x4000)=nil, 0x4000, 0x0, 0x12, 0xffffffffffffffff, 0xfffff000) r1 = syz_clone(0x21000200, 0x0, 0x0, 0x0, 0x0, 0x0) rt_tgsigqueueinfo(r1, r1, 0x8, 0x0) executing program 8: mkdirat(0xffffffffffffff9c, &(0x7f0000000040)='./mnt\x00', 0x1ff) bind$inet6(0xffffffffffffffff, &(0x7f00000001c0)={0xa, 0x4e20, 0xfffffffb, @empty, 0x2}, 0x1c) r0 = socket$packet(0x11, 0x2, 0x300) sendto$packet(r0, 0x0, 0x0, 0x0, &(0x7f0000000400)={0x11, 0x88a8, 0x0, 0x1, 0x0, 0x6, @local}, 0x14) executing program 0: r0 = syz_open_dev$dri(&(0x7f0000000000), 0x0, 0x0) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r0, 0xc02064b2, &(0x7f0000000040)={0x1, 0xd00, 0x6}) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r0, 0xc02064b2, &(0x7f0000000100)={0x1, 0x3, 0x9}) ioctl$DRM_IOCTL_PANTHOR_VM_CREATE(r0, 0xc0106441, &(0x7f0000000080)={0x0, 0x0, 0xffffffffffffffff}) socket$kcm(0xa, 0x2, 0x0) socket$nl_route(0x10, 0x3, 0x0) socket(0x10, 0x3, 0x0) sendmsg$IPSET_CMD_CREATE(0xffffffffffffffff, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000200)=ANY=[@ANYBLOB="600000000206010800000000000000000000000005000400000000000900020073797a31000000001400078008001240000000000500140008000000050005000a000000050001000600000011000300686173683a69702c706f7274"], 0x60}}, 0x24000800) program crashed: KASAN: slab-use-after-free Read in ep_open testing program (duration=2m31.5s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): [0, 11, 4, 7] detailed listing: executing program 3: executing program 3: mkdirat(0xffffffffffffff9c, &(0x7f0000000100)='./gadget\x00', 0x1ff) mount(0x0, &(0x7f0000000140)='./gadget\x00', &(0x7f0000000180)='gadgetfs\x00', 0x0, 0x0) r0 = openat(0xffffffffffffff9c, &(0x7f00000001c0)='./gadget/dummy_udc\x00', 0x2, 0x0) mprotect(&(0x7f0000362000/0x2000)=nil, 0x2000, 0x1) write(r0, &(0x7f0000000200)="000000000902190001010080320904000001ff000000070581024000000902190001010080320904000001ff00000007058102000200120100020000004034127856000100000001", 0x48) write(0xffffffffffffffff, &(0x7f00000005c0)="010000000705810240000007058102000200", 0x12) ioctl$sock_SIOCGIFINDEX(0xffffffffffffffff, 0x8933, &(0x7f0000000040)={'bridge0\x00'}) write$P9_RRENAME(0xffffffffffffffff, 0x0, 0x0) mmap(&(0x7f0000362000/0x4000)=nil, 0x4000, 0x0, 0x12, 0xffffffffffffffff, 0xfffff000) r1 = syz_clone(0x21000200, 0x0, 0x0, 0x0, 0x0, 0x0) rt_tgsigqueueinfo(r1, r1, 0x8, 0x0) executing program 8: mkdirat(0xffffffffffffff9c, &(0x7f0000000040)='./mnt\x00', 0x1ff) bind$inet6(0xffffffffffffffff, &(0x7f00000001c0)={0xa, 0x4e20, 0xfffffffb, @empty, 0x2}, 0x1c) r0 = socket$packet(0x11, 0x2, 0x300) sendto$packet(r0, 0x0, 0x0, 0x0, &(0x7f0000000400)={0x11, 0x88a8, 0x0, 0x1, 0x0, 0x6, @local}, 0x14) executing program 0: r0 = syz_open_dev$dri(&(0x7f0000000000), 0x0, 0x0) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r0, 0xc02064b2, &(0x7f0000000040)={0x1, 0xd00, 0x6}) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r0, 0xc02064b2, &(0x7f0000000100)={0x1, 0x3, 0x9}) ioctl$DRM_IOCTL_PANTHOR_VM_CREATE(r0, 0xc0106441, &(0x7f0000000080)={0x0, 0x0, 0xffffffffffffffff}) socket$kcm(0xa, 0x2, 0x0) socket$nl_route(0x10, 0x3, 0x0) sendmsg$IPSET_CMD_CREATE(0xffffffffffffffff, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000200)=ANY=[@ANYBLOB="600000000206010800000000000000000000000005000400000000000900020073797a31000000001400078008001240000000000500140008000000050005000a000000050001000600000011000300686173683a69702c706f7274"], 0x60}}, 0x24000800) program crashed: KASAN: slab-use-after-free Read in ep_open testing program (duration=2m31.5s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): [0, 11, 4, 6] detailed listing: executing program 3: executing program 3: mkdirat(0xffffffffffffff9c, &(0x7f0000000100)='./gadget\x00', 0x1ff) mount(0x0, &(0x7f0000000140)='./gadget\x00', &(0x7f0000000180)='gadgetfs\x00', 0x0, 0x0) r0 = openat(0xffffffffffffff9c, &(0x7f00000001c0)='./gadget/dummy_udc\x00', 0x2, 0x0) mprotect(&(0x7f0000362000/0x2000)=nil, 0x2000, 0x1) write(r0, &(0x7f0000000200)="000000000902190001010080320904000001ff000000070581024000000902190001010080320904000001ff00000007058102000200120100020000004034127856000100000001", 0x48) write(0xffffffffffffffff, &(0x7f00000005c0)="010000000705810240000007058102000200", 0x12) ioctl$sock_SIOCGIFINDEX(0xffffffffffffffff, 0x8933, &(0x7f0000000040)={'bridge0\x00'}) write$P9_RRENAME(0xffffffffffffffff, 0x0, 0x0) mmap(&(0x7f0000362000/0x4000)=nil, 0x4000, 0x0, 0x12, 0xffffffffffffffff, 0xfffff000) r1 = syz_clone(0x21000200, 0x0, 0x0, 0x0, 0x0, 0x0) rt_tgsigqueueinfo(r1, r1, 0x8, 0x0) executing program 8: mkdirat(0xffffffffffffff9c, &(0x7f0000000040)='./mnt\x00', 0x1ff) bind$inet6(0xffffffffffffffff, &(0x7f00000001c0)={0xa, 0x4e20, 0xfffffffb, @empty, 0x2}, 0x1c) r0 = socket$packet(0x11, 0x2, 0x300) sendto$packet(r0, 0x0, 0x0, 0x0, &(0x7f0000000400)={0x11, 0x88a8, 0x0, 0x1, 0x0, 0x6, @local}, 0x14) executing program 0: r0 = syz_open_dev$dri(&(0x7f0000000000), 0x0, 0x0) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r0, 0xc02064b2, &(0x7f0000000040)={0x1, 0xd00, 0x6}) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r0, 0xc02064b2, &(0x7f0000000100)={0x1, 0x3, 0x9}) ioctl$DRM_IOCTL_PANTHOR_VM_CREATE(r0, 0xc0106441, &(0x7f0000000080)={0x0, 0x0, 0xffffffffffffffff}) socket$kcm(0xa, 0x2, 0x0) sendmsg$IPSET_CMD_CREATE(0xffffffffffffffff, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000200)=ANY=[@ANYBLOB="600000000206010800000000000000000000000005000400000000000900020073797a31000000001400078008001240000000000500140008000000050005000a000000050001000600000011000300686173683a69702c706f7274"], 0x60}}, 0x24000800) program crashed: KASAN: slab-use-after-free Read in ep_open testing program (duration=2m31.5s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): [0, 11, 4, 5] detailed listing: executing program 3: executing program 3: mkdirat(0xffffffffffffff9c, &(0x7f0000000100)='./gadget\x00', 0x1ff) mount(0x0, &(0x7f0000000140)='./gadget\x00', &(0x7f0000000180)='gadgetfs\x00', 0x0, 0x0) r0 = openat(0xffffffffffffff9c, &(0x7f00000001c0)='./gadget/dummy_udc\x00', 0x2, 0x0) mprotect(&(0x7f0000362000/0x2000)=nil, 0x2000, 0x1) write(r0, &(0x7f0000000200)="000000000902190001010080320904000001ff000000070581024000000902190001010080320904000001ff00000007058102000200120100020000004034127856000100000001", 0x48) write(0xffffffffffffffff, &(0x7f00000005c0)="010000000705810240000007058102000200", 0x12) ioctl$sock_SIOCGIFINDEX(0xffffffffffffffff, 0x8933, &(0x7f0000000040)={'bridge0\x00'}) write$P9_RRENAME(0xffffffffffffffff, 0x0, 0x0) mmap(&(0x7f0000362000/0x4000)=nil, 0x4000, 0x0, 0x12, 0xffffffffffffffff, 0xfffff000) r1 = syz_clone(0x21000200, 0x0, 0x0, 0x0, 0x0, 0x0) rt_tgsigqueueinfo(r1, r1, 0x8, 0x0) executing program 8: mkdirat(0xffffffffffffff9c, &(0x7f0000000040)='./mnt\x00', 0x1ff) bind$inet6(0xffffffffffffffff, &(0x7f00000001c0)={0xa, 0x4e20, 0xfffffffb, @empty, 0x2}, 0x1c) r0 = socket$packet(0x11, 0x2, 0x300) sendto$packet(r0, 0x0, 0x0, 0x0, &(0x7f0000000400)={0x11, 0x88a8, 0x0, 0x1, 0x0, 0x6, @local}, 0x14) executing program 0: r0 = syz_open_dev$dri(&(0x7f0000000000), 0x0, 0x0) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r0, 0xc02064b2, &(0x7f0000000040)={0x1, 0xd00, 0x6}) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r0, 0xc02064b2, &(0x7f0000000100)={0x1, 0x3, 0x9}) ioctl$DRM_IOCTL_PANTHOR_VM_CREATE(r0, 0xc0106441, &(0x7f0000000080)={0x0, 0x0, 0xffffffffffffffff}) sendmsg$IPSET_CMD_CREATE(0xffffffffffffffff, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000200)=ANY=[@ANYBLOB="600000000206010800000000000000000000000005000400000000000900020073797a31000000001400078008001240000000000500140008000000050005000a000000050001000600000011000300686173683a69702c706f7274"], 0x60}}, 0x24000800) program crashed: KASAN: slab-use-after-free Read in ep_open testing program (duration=2m31.5s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): [0, 11, 4, 4] detailed listing: executing program 3: executing program 3: mkdirat(0xffffffffffffff9c, &(0x7f0000000100)='./gadget\x00', 0x1ff) mount(0x0, &(0x7f0000000140)='./gadget\x00', &(0x7f0000000180)='gadgetfs\x00', 0x0, 0x0) r0 = openat(0xffffffffffffff9c, &(0x7f00000001c0)='./gadget/dummy_udc\x00', 0x2, 0x0) mprotect(&(0x7f0000362000/0x2000)=nil, 0x2000, 0x1) write(r0, &(0x7f0000000200)="000000000902190001010080320904000001ff000000070581024000000902190001010080320904000001ff00000007058102000200120100020000004034127856000100000001", 0x48) write(0xffffffffffffffff, &(0x7f00000005c0)="010000000705810240000007058102000200", 0x12) ioctl$sock_SIOCGIFINDEX(0xffffffffffffffff, 0x8933, &(0x7f0000000040)={'bridge0\x00'}) write$P9_RRENAME(0xffffffffffffffff, 0x0, 0x0) mmap(&(0x7f0000362000/0x4000)=nil, 0x4000, 0x0, 0x12, 0xffffffffffffffff, 0xfffff000) r1 = syz_clone(0x21000200, 0x0, 0x0, 0x0, 0x0, 0x0) rt_tgsigqueueinfo(r1, r1, 0x8, 0x0) executing program 8: mkdirat(0xffffffffffffff9c, &(0x7f0000000040)='./mnt\x00', 0x1ff) bind$inet6(0xffffffffffffffff, &(0x7f00000001c0)={0xa, 0x4e20, 0xfffffffb, @empty, 0x2}, 0x1c) r0 = socket$packet(0x11, 0x2, 0x300) sendto$packet(r0, 0x0, 0x0, 0x0, &(0x7f0000000400)={0x11, 0x88a8, 0x0, 0x1, 0x0, 0x6, @local}, 0x14) executing program 0: r0 = syz_open_dev$dri(&(0x7f0000000000), 0x0, 0x0) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r0, 0xc02064b2, &(0x7f0000000040)={0x1, 0xd00, 0x6}) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r0, 0xc02064b2, &(0x7f0000000100)={0x1, 0x3, 0x9}) sendmsg$IPSET_CMD_CREATE(0xffffffffffffffff, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000200)=ANY=[@ANYBLOB="600000000206010800000000000000000000000005000400000000000900020073797a31000000001400078008001240000000000500140008000000050005000a000000050001000600000011000300686173683a69702c706f7274"], 0x60}}, 0x24000800) program crashed: KASAN: slab-use-after-free Read in ep_open testing program (duration=2m31.5s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): [0, 11, 4, 3] detailed listing: executing program 3: executing program 3: mkdirat(0xffffffffffffff9c, &(0x7f0000000100)='./gadget\x00', 0x1ff) mount(0x0, &(0x7f0000000140)='./gadget\x00', &(0x7f0000000180)='gadgetfs\x00', 0x0, 0x0) r0 = openat(0xffffffffffffff9c, &(0x7f00000001c0)='./gadget/dummy_udc\x00', 0x2, 0x0) mprotect(&(0x7f0000362000/0x2000)=nil, 0x2000, 0x1) write(r0, &(0x7f0000000200)="000000000902190001010080320904000001ff000000070581024000000902190001010080320904000001ff00000007058102000200120100020000004034127856000100000001", 0x48) write(0xffffffffffffffff, &(0x7f00000005c0)="010000000705810240000007058102000200", 0x12) ioctl$sock_SIOCGIFINDEX(0xffffffffffffffff, 0x8933, &(0x7f0000000040)={'bridge0\x00'}) write$P9_RRENAME(0xffffffffffffffff, 0x0, 0x0) mmap(&(0x7f0000362000/0x4000)=nil, 0x4000, 0x0, 0x12, 0xffffffffffffffff, 0xfffff000) r1 = syz_clone(0x21000200, 0x0, 0x0, 0x0, 0x0, 0x0) rt_tgsigqueueinfo(r1, r1, 0x8, 0x0) executing program 8: mkdirat(0xffffffffffffff9c, &(0x7f0000000040)='./mnt\x00', 0x1ff) bind$inet6(0xffffffffffffffff, &(0x7f00000001c0)={0xa, 0x4e20, 0xfffffffb, @empty, 0x2}, 0x1c) r0 = socket$packet(0x11, 0x2, 0x300) sendto$packet(r0, 0x0, 0x0, 0x0, &(0x7f0000000400)={0x11, 0x88a8, 0x0, 0x1, 0x0, 0x6, @local}, 0x14) executing program 0: r0 = syz_open_dev$dri(&(0x7f0000000000), 0x0, 0x0) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r0, 0xc02064b2, &(0x7f0000000040)={0x1, 0xd00, 0x6}) sendmsg$IPSET_CMD_CREATE(0xffffffffffffffff, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000200)=ANY=[@ANYBLOB="600000000206010800000000000000000000000005000400000000000900020073797a31000000001400078008001240000000000500140008000000050005000a000000050001000600000011000300686173683a69702c706f7274"], 0x60}}, 0x24000800) program crashed: KASAN: slab-use-after-free Read in ep_open testing program (duration=2m31.5s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): [0, 11, 4, 2] detailed listing: executing program 3: executing program 3: mkdirat(0xffffffffffffff9c, &(0x7f0000000100)='./gadget\x00', 0x1ff) mount(0x0, &(0x7f0000000140)='./gadget\x00', &(0x7f0000000180)='gadgetfs\x00', 0x0, 0x0) r0 = openat(0xffffffffffffff9c, &(0x7f00000001c0)='./gadget/dummy_udc\x00', 0x2, 0x0) mprotect(&(0x7f0000362000/0x2000)=nil, 0x2000, 0x1) write(r0, &(0x7f0000000200)="000000000902190001010080320904000001ff000000070581024000000902190001010080320904000001ff00000007058102000200120100020000004034127856000100000001", 0x48) write(0xffffffffffffffff, &(0x7f00000005c0)="010000000705810240000007058102000200", 0x12) ioctl$sock_SIOCGIFINDEX(0xffffffffffffffff, 0x8933, &(0x7f0000000040)={'bridge0\x00'}) write$P9_RRENAME(0xffffffffffffffff, 0x0, 0x0) mmap(&(0x7f0000362000/0x4000)=nil, 0x4000, 0x0, 0x12, 0xffffffffffffffff, 0xfffff000) r1 = syz_clone(0x21000200, 0x0, 0x0, 0x0, 0x0, 0x0) rt_tgsigqueueinfo(r1, r1, 0x8, 0x0) executing program 8: mkdirat(0xffffffffffffff9c, &(0x7f0000000040)='./mnt\x00', 0x1ff) bind$inet6(0xffffffffffffffff, &(0x7f00000001c0)={0xa, 0x4e20, 0xfffffffb, @empty, 0x2}, 0x1c) r0 = socket$packet(0x11, 0x2, 0x300) sendto$packet(r0, 0x0, 0x0, 0x0, &(0x7f0000000400)={0x11, 0x88a8, 0x0, 0x1, 0x0, 0x6, @local}, 0x14) executing program 0: syz_open_dev$dri(&(0x7f0000000000), 0x0, 0x0) sendmsg$IPSET_CMD_CREATE(0xffffffffffffffff, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000200)=ANY=[@ANYBLOB="600000000206010800000000000000000000000005000400000000000900020073797a31000000001400078008001240000000000500140008000000050005000a000000050001000600000011000300686173683a69702c706f7274"], 0x60}}, 0x24000800) program crashed: KASAN: slab-use-after-free Read in ep_open testing program (duration=2m31.5s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): [0, 11, 4, 1] detailed listing: executing program 3: executing program 3: mkdirat(0xffffffffffffff9c, &(0x7f0000000100)='./gadget\x00', 0x1ff) mount(0x0, &(0x7f0000000140)='./gadget\x00', &(0x7f0000000180)='gadgetfs\x00', 0x0, 0x0) r0 = openat(0xffffffffffffff9c, &(0x7f00000001c0)='./gadget/dummy_udc\x00', 0x2, 0x0) mprotect(&(0x7f0000362000/0x2000)=nil, 0x2000, 0x1) write(r0, &(0x7f0000000200)="000000000902190001010080320904000001ff000000070581024000000902190001010080320904000001ff00000007058102000200120100020000004034127856000100000001", 0x48) write(0xffffffffffffffff, &(0x7f00000005c0)="010000000705810240000007058102000200", 0x12) ioctl$sock_SIOCGIFINDEX(0xffffffffffffffff, 0x8933, &(0x7f0000000040)={'bridge0\x00'}) write$P9_RRENAME(0xffffffffffffffff, 0x0, 0x0) mmap(&(0x7f0000362000/0x4000)=nil, 0x4000, 0x0, 0x12, 0xffffffffffffffff, 0xfffff000) r1 = syz_clone(0x21000200, 0x0, 0x0, 0x0, 0x0, 0x0) rt_tgsigqueueinfo(r1, r1, 0x8, 0x0) executing program 8: mkdirat(0xffffffffffffff9c, &(0x7f0000000040)='./mnt\x00', 0x1ff) bind$inet6(0xffffffffffffffff, &(0x7f00000001c0)={0xa, 0x4e20, 0xfffffffb, @empty, 0x2}, 0x1c) r0 = socket$packet(0x11, 0x2, 0x300) sendto$packet(r0, 0x0, 0x0, 0x0, &(0x7f0000000400)={0x11, 0x88a8, 0x0, 0x1, 0x0, 0x6, @local}, 0x14) executing program 0: sendmsg$IPSET_CMD_CREATE(0xffffffffffffffff, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000200)=ANY=[@ANYBLOB="600000000206010800000000000000000000000005000400000000000900020073797a31000000001400078008001240000000000500140008000000050005000a000000050001000600000011000300686173683a69702c706f7274"], 0x60}}, 0x24000800) program crashed: KASAN: slab-use-after-free Read in ep_open minimized 30 calls -> 1 calls testing program (duration=2m31.5s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): mkdirat-mount-openat-mprotect-write-write-ioctl$sock_SIOCGIFINDEX-write$P9_RRENAME-mmap-syz_clone-rt_tgsigqueueinfo-mkdirat-bind$inet6-socket$packet-sendto$packet-sendmsg$IPSET_CMD_CREATE detailed listing: executing program 0: mkdirat(0xffffffffffffff9c, &(0x7f0000000100)='./gadget\x00', 0x1ff) mount(0x0, &(0x7f0000000140)='./gadget\x00', &(0x7f0000000180)='gadgetfs\x00', 0x0, 0x0) r0 = openat(0xffffffffffffff9c, &(0x7f00000001c0)='./gadget/dummy_udc\x00', 0x2, 0x0) mprotect(&(0x7f0000362000/0x2000)=nil, 0x2000, 0x1) write(r0, &(0x7f0000000200)="000000000902190001010080320904000001ff000000070581024000000902190001010080320904000001ff00000007058102000200120100020000004034127856000100000001", 0x48) write(0xffffffffffffffff, &(0x7f00000005c0)="010000000705810240000007058102000200", 0x12) ioctl$sock_SIOCGIFINDEX(0xffffffffffffffff, 0x8933, &(0x7f0000000040)={'bridge0\x00'}) write$P9_RRENAME(0xffffffffffffffff, 0x0, 0x0) mmap(&(0x7f0000362000/0x4000)=nil, 0x4000, 0x0, 0x12, 0xffffffffffffffff, 0xfffff000) r1 = syz_clone(0x21000200, 0x0, 0x0, 0x0, 0x0, 0x0) rt_tgsigqueueinfo(r1, r1, 0x8, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000040)='./mnt\x00', 0x1ff) bind$inet6(0xffffffffffffffff, &(0x7f00000001c0)={0xa, 0x4e20, 0xfffffffb, @empty, 0x2}, 0x1c) r2 = socket$packet(0x11, 0x2, 0x300) sendto$packet(r2, 0x0, 0x0, 0x0, &(0x7f0000000400)={0x11, 0x88a8, 0x0, 0x1, 0x0, 0x6, @local}, 0x14) sendmsg$IPSET_CMD_CREATE(0xffffffffffffffff, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000200)=ANY=[@ANYBLOB="600000000206010800000000000000000000000005000400000000000900020073797a31000000001400078008001240000000000500140008000000050005000a000000050001000600000011000300686173683a69702c706f7274"], 0x60}}, 0x24000800) program crashed: KASAN: slab-use-after-free Read in ep_open bisect: concatenation succeeded found reproducer with 16 syscalls minimizing guilty program testing program (duration=59.979085774s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): mkdirat-mount-openat-mprotect-write-write-ioctl$sock_SIOCGIFINDEX-write$P9_RRENAME-mmap-syz_clone-rt_tgsigqueueinfo-mkdirat-bind$inet6-socket$packet-sendto$packet detailed listing: executing program 0: mkdirat(0xffffffffffffff9c, &(0x7f0000000100)='./gadget\x00', 0x1ff) mount(0x0, &(0x7f0000000140)='./gadget\x00', &(0x7f0000000180)='gadgetfs\x00', 0x0, 0x0) r0 = openat(0xffffffffffffff9c, &(0x7f00000001c0)='./gadget/dummy_udc\x00', 0x2, 0x0) mprotect(&(0x7f0000362000/0x2000)=nil, 0x2000, 0x1) write(r0, &(0x7f0000000200)="000000000902190001010080320904000001ff000000070581024000000902190001010080320904000001ff00000007058102000200120100020000004034127856000100000001", 0x48) write(0xffffffffffffffff, &(0x7f00000005c0)="010000000705810240000007058102000200", 0x12) ioctl$sock_SIOCGIFINDEX(0xffffffffffffffff, 0x8933, &(0x7f0000000040)={'bridge0\x00'}) write$P9_RRENAME(0xffffffffffffffff, 0x0, 0x0) mmap(&(0x7f0000362000/0x4000)=nil, 0x4000, 0x0, 0x12, 0xffffffffffffffff, 0xfffff000) r1 = syz_clone(0x21000200, 0x0, 0x0, 0x0, 0x0, 0x0) rt_tgsigqueueinfo(r1, r1, 0x8, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000040)='./mnt\x00', 0x1ff) bind$inet6(0xffffffffffffffff, &(0x7f00000001c0)={0xa, 0x4e20, 0xfffffffb, @empty, 0x2}, 0x1c) r2 = socket$packet(0x11, 0x2, 0x300) sendto$packet(r2, 0x0, 0x0, 0x0, &(0x7f0000000400)={0x11, 0x88a8, 0x0, 0x1, 0x0, 0x6, @local}, 0x14) program did not crash testing program (duration=59.979085774s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): mkdirat-mount-openat-mprotect-write-write-ioctl$sock_SIOCGIFINDEX-write$P9_RRENAME-mmap-syz_clone-rt_tgsigqueueinfo-mkdirat-bind$inet6-socket$packet-sendmsg$IPSET_CMD_CREATE detailed listing: executing program 0: mkdirat(0xffffffffffffff9c, &(0x7f0000000100)='./gadget\x00', 0x1ff) mount(0x0, &(0x7f0000000140)='./gadget\x00', &(0x7f0000000180)='gadgetfs\x00', 0x0, 0x0) r0 = openat(0xffffffffffffff9c, &(0x7f00000001c0)='./gadget/dummy_udc\x00', 0x2, 0x0) mprotect(&(0x7f0000362000/0x2000)=nil, 0x2000, 0x1) write(r0, &(0x7f0000000200)="000000000902190001010080320904000001ff000000070581024000000902190001010080320904000001ff00000007058102000200120100020000004034127856000100000001", 0x48) write(0xffffffffffffffff, &(0x7f00000005c0)="010000000705810240000007058102000200", 0x12) ioctl$sock_SIOCGIFINDEX(0xffffffffffffffff, 0x8933, &(0x7f0000000040)={'bridge0\x00'}) write$P9_RRENAME(0xffffffffffffffff, 0x0, 0x0) mmap(&(0x7f0000362000/0x4000)=nil, 0x4000, 0x0, 0x12, 0xffffffffffffffff, 0xfffff000) r1 = syz_clone(0x21000200, 0x0, 0x0, 0x0, 0x0, 0x0) rt_tgsigqueueinfo(r1, r1, 0x8, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000040)='./mnt\x00', 0x1ff) bind$inet6(0xffffffffffffffff, &(0x7f00000001c0)={0xa, 0x4e20, 0xfffffffb, @empty, 0x2}, 0x1c) socket$packet(0x11, 0x2, 0x300) sendmsg$IPSET_CMD_CREATE(0xffffffffffffffff, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000200)=ANY=[@ANYBLOB="600000000206010800000000000000000000000005000400000000000900020073797a31000000001400078008001240000000000500140008000000050005000a000000050001000600000011000300686173683a69702c706f7274"], 0x60}}, 0x24000800) program crashed: KASAN: slab-use-after-free Read in ep_open testing program (duration=59.979085774s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): mkdirat-mount-openat-mprotect-write-write-ioctl$sock_SIOCGIFINDEX-write$P9_RRENAME-mmap-syz_clone-rt_tgsigqueueinfo-mkdirat-bind$inet6-sendmsg$IPSET_CMD_CREATE detailed listing: executing program 0: mkdirat(0xffffffffffffff9c, &(0x7f0000000100)='./gadget\x00', 0x1ff) mount(0x0, &(0x7f0000000140)='./gadget\x00', &(0x7f0000000180)='gadgetfs\x00', 0x0, 0x0) r0 = openat(0xffffffffffffff9c, &(0x7f00000001c0)='./gadget/dummy_udc\x00', 0x2, 0x0) mprotect(&(0x7f0000362000/0x2000)=nil, 0x2000, 0x1) write(r0, &(0x7f0000000200)="000000000902190001010080320904000001ff000000070581024000000902190001010080320904000001ff00000007058102000200120100020000004034127856000100000001", 0x48) write(0xffffffffffffffff, &(0x7f00000005c0)="010000000705810240000007058102000200", 0x12) ioctl$sock_SIOCGIFINDEX(0xffffffffffffffff, 0x8933, &(0x7f0000000040)={'bridge0\x00'}) write$P9_RRENAME(0xffffffffffffffff, 0x0, 0x0) mmap(&(0x7f0000362000/0x4000)=nil, 0x4000, 0x0, 0x12, 0xffffffffffffffff, 0xfffff000) r1 = syz_clone(0x21000200, 0x0, 0x0, 0x0, 0x0, 0x0) rt_tgsigqueueinfo(r1, r1, 0x8, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000040)='./mnt\x00', 0x1ff) bind$inet6(0xffffffffffffffff, &(0x7f00000001c0)={0xa, 0x4e20, 0xfffffffb, @empty, 0x2}, 0x1c) sendmsg$IPSET_CMD_CREATE(0xffffffffffffffff, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000200)=ANY=[@ANYBLOB="600000000206010800000000000000000000000005000400000000000900020073797a31000000001400078008001240000000000500140008000000050005000a000000050001000600000011000300686173683a69702c706f7274"], 0x60}}, 0x24000800) program did not crash program crashed: KASAN: slab-use-after-free Read in ep_open testing program (duration=59.979085774s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): mkdirat-mount-openat-mprotect-write-write-ioctl$sock_SIOCGIFINDEX-write$P9_RRENAME-mmap-syz_clone-rt_tgsigqueueinfo-mkdirat-sendmsg$IPSET_CMD_CREATE detailed listing: executing program 0: mkdirat(0xffffffffffffff9c, &(0x7f0000000100)='./gadget\x00', 0x1ff) mount(0x0, &(0x7f0000000140)='./gadget\x00', &(0x7f0000000180)='gadgetfs\x00', 0x0, 0x0) r0 = openat(0xffffffffffffff9c, &(0x7f00000001c0)='./gadget/dummy_udc\x00', 0x2, 0x0) mprotect(&(0x7f0000362000/0x2000)=nil, 0x2000, 0x1) write(r0, &(0x7f0000000200)="000000000902190001010080320904000001ff000000070581024000000902190001010080320904000001ff00000007058102000200120100020000004034127856000100000001", 0x48) write(0xffffffffffffffff, &(0x7f00000005c0)="010000000705810240000007058102000200", 0x12) ioctl$sock_SIOCGIFINDEX(0xffffffffffffffff, 0x8933, &(0x7f0000000040)={'bridge0\x00'}) write$P9_RRENAME(0xffffffffffffffff, 0x0, 0x0) mmap(&(0x7f0000362000/0x4000)=nil, 0x4000, 0x0, 0x12, 0xffffffffffffffff, 0xfffff000) r1 = syz_clone(0x21000200, 0x0, 0x0, 0x0, 0x0, 0x0) rt_tgsigqueueinfo(r1, r1, 0x8, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000040)='./mnt\x00', 0x1ff) sendmsg$IPSET_CMD_CREATE(0xffffffffffffffff, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000200)=ANY=[@ANYBLOB="600000000206010800000000000000000000000005000400000000000900020073797a31000000001400078008001240000000000500140008000000050005000a000000050001000600000011000300686173683a69702c706f7274"], 0x60}}, 0x24000800) program crashed: KASAN: slab-use-after-free Read in ep_open testing program (duration=59.979085774s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): mkdirat-mount-openat-mprotect-write-write-ioctl$sock_SIOCGIFINDEX-write$P9_RRENAME-mmap-syz_clone-rt_tgsigqueueinfo-sendmsg$IPSET_CMD_CREATE detailed listing: executing program 0: mkdirat(0xffffffffffffff9c, &(0x7f0000000100)='./gadget\x00', 0x1ff) mount(0x0, &(0x7f0000000140)='./gadget\x00', &(0x7f0000000180)='gadgetfs\x00', 0x0, 0x0) r0 = openat(0xffffffffffffff9c, &(0x7f00000001c0)='./gadget/dummy_udc\x00', 0x2, 0x0) mprotect(&(0x7f0000362000/0x2000)=nil, 0x2000, 0x1) write(r0, &(0x7f0000000200)="000000000902190001010080320904000001ff000000070581024000000902190001010080320904000001ff00000007058102000200120100020000004034127856000100000001", 0x48) write(0xffffffffffffffff, &(0x7f00000005c0)="010000000705810240000007058102000200", 0x12) ioctl$sock_SIOCGIFINDEX(0xffffffffffffffff, 0x8933, &(0x7f0000000040)={'bridge0\x00'}) write$P9_RRENAME(0xffffffffffffffff, 0x0, 0x0) mmap(&(0x7f0000362000/0x4000)=nil, 0x4000, 0x0, 0x12, 0xffffffffffffffff, 0xfffff000) r1 = syz_clone(0x21000200, 0x0, 0x0, 0x0, 0x0, 0x0) rt_tgsigqueueinfo(r1, r1, 0x8, 0x0) sendmsg$IPSET_CMD_CREATE(0xffffffffffffffff, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000200)=ANY=[@ANYBLOB="600000000206010800000000000000000000000005000400000000000900020073797a31000000001400078008001240000000000500140008000000050005000a000000050001000600000011000300686173683a69702c706f7274"], 0x60}}, 0x24000800) program did not crash testing program (duration=59.979085774s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): mkdirat-mount-openat-mprotect-write-write-ioctl$sock_SIOCGIFINDEX-write$P9_RRENAME-mmap-syz_clone-mkdirat-sendmsg$IPSET_CMD_CREATE detailed listing: executing program 0: mkdirat(0xffffffffffffff9c, &(0x7f0000000100)='./gadget\x00', 0x1ff) mount(0x0, &(0x7f0000000140)='./gadget\x00', &(0x7f0000000180)='gadgetfs\x00', 0x0, 0x0) r0 = openat(0xffffffffffffff9c, &(0x7f00000001c0)='./gadget/dummy_udc\x00', 0x2, 0x0) mprotect(&(0x7f0000362000/0x2000)=nil, 0x2000, 0x1) write(r0, &(0x7f0000000200)="000000000902190001010080320904000001ff000000070581024000000902190001010080320904000001ff00000007058102000200120100020000004034127856000100000001", 0x48) write(0xffffffffffffffff, &(0x7f00000005c0)="010000000705810240000007058102000200", 0x12) ioctl$sock_SIOCGIFINDEX(0xffffffffffffffff, 0x8933, &(0x7f0000000040)={'bridge0\x00'}) write$P9_RRENAME(0xffffffffffffffff, 0x0, 0x0) mmap(&(0x7f0000362000/0x4000)=nil, 0x4000, 0x0, 0x12, 0xffffffffffffffff, 0xfffff000) syz_clone(0x21000200, 0x0, 0x0, 0x0, 0x0, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000040)='./mnt\x00', 0x1ff) sendmsg$IPSET_CMD_CREATE(0xffffffffffffffff, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000200)=ANY=[@ANYBLOB="600000000206010800000000000000000000000005000400000000000900020073797a31000000001400078008001240000000000500140008000000050005000a000000050001000600000011000300686173683a69702c706f7274"], 0x60}}, 0x24000800) program crashed: KASAN: slab-use-after-free Read in ep_open testing program (duration=59.979085774s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): mkdirat-mount-openat-mprotect-write-write-ioctl$sock_SIOCGIFINDEX-write$P9_RRENAME-mmap-mkdirat-sendmsg$IPSET_CMD_CREATE detailed listing: executing program 0: mkdirat(0xffffffffffffff9c, &(0x7f0000000100)='./gadget\x00', 0x1ff) mount(0x0, &(0x7f0000000140)='./gadget\x00', &(0x7f0000000180)='gadgetfs\x00', 0x0, 0x0) r0 = openat(0xffffffffffffff9c, &(0x7f00000001c0)='./gadget/dummy_udc\x00', 0x2, 0x0) mprotect(&(0x7f0000362000/0x2000)=nil, 0x2000, 0x1) write(r0, &(0x7f0000000200)="000000000902190001010080320904000001ff000000070581024000000902190001010080320904000001ff00000007058102000200120100020000004034127856000100000001", 0x48) write(0xffffffffffffffff, &(0x7f00000005c0)="010000000705810240000007058102000200", 0x12) ioctl$sock_SIOCGIFINDEX(0xffffffffffffffff, 0x8933, &(0x7f0000000040)={'bridge0\x00'}) write$P9_RRENAME(0xffffffffffffffff, 0x0, 0x0) mmap(&(0x7f0000362000/0x4000)=nil, 0x4000, 0x0, 0x12, 0xffffffffffffffff, 0xfffff000) mkdirat(0xffffffffffffff9c, &(0x7f0000000040)='./mnt\x00', 0x1ff) sendmsg$IPSET_CMD_CREATE(0xffffffffffffffff, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000200)=ANY=[@ANYBLOB="600000000206010800000000000000000000000005000400000000000900020073797a31000000001400078008001240000000000500140008000000050005000a000000050001000600000011000300686173683a69702c706f7274"], 0x60}}, 0x24000800) program did not crash testing program (duration=59.979085774s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): mkdirat-mount-openat-mprotect-write-write-ioctl$sock_SIOCGIFINDEX-write$P9_RRENAME-syz_clone-mkdirat-sendmsg$IPSET_CMD_CREATE detailed listing: executing program 0: mkdirat(0xffffffffffffff9c, &(0x7f0000000100)='./gadget\x00', 0x1ff) mount(0x0, &(0x7f0000000140)='./gadget\x00', &(0x7f0000000180)='gadgetfs\x00', 0x0, 0x0) r0 = openat(0xffffffffffffff9c, &(0x7f00000001c0)='./gadget/dummy_udc\x00', 0x2, 0x0) mprotect(&(0x7f0000362000/0x2000)=nil, 0x2000, 0x1) write(r0, &(0x7f0000000200)="000000000902190001010080320904000001ff000000070581024000000902190001010080320904000001ff00000007058102000200120100020000004034127856000100000001", 0x48) write(0xffffffffffffffff, &(0x7f00000005c0)="010000000705810240000007058102000200", 0x12) ioctl$sock_SIOCGIFINDEX(0xffffffffffffffff, 0x8933, &(0x7f0000000040)={'bridge0\x00'}) write$P9_RRENAME(0xffffffffffffffff, 0x0, 0x0) syz_clone(0x21000200, 0x0, 0x0, 0x0, 0x0, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000040)='./mnt\x00', 0x1ff) sendmsg$IPSET_CMD_CREATE(0xffffffffffffffff, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000200)=ANY=[@ANYBLOB="600000000206010800000000000000000000000005000400000000000900020073797a31000000001400078008001240000000000500140008000000050005000a000000050001000600000011000300686173683a69702c706f7274"], 0x60}}, 0x24000800) program crashed: KASAN: slab-use-after-free Read in ep_open testing program (duration=59.979085774s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): mkdirat-mount-openat-mprotect-write-write-ioctl$sock_SIOCGIFINDEX-syz_clone-mkdirat-sendmsg$IPSET_CMD_CREATE detailed listing: executing program 0: mkdirat(0xffffffffffffff9c, &(0x7f0000000100)='./gadget\x00', 0x1ff) mount(0x0, &(0x7f0000000140)='./gadget\x00', &(0x7f0000000180)='gadgetfs\x00', 0x0, 0x0) r0 = openat(0xffffffffffffff9c, &(0x7f00000001c0)='./gadget/dummy_udc\x00', 0x2, 0x0) mprotect(&(0x7f0000362000/0x2000)=nil, 0x2000, 0x1) write(r0, &(0x7f0000000200)="000000000902190001010080320904000001ff000000070581024000000902190001010080320904000001ff00000007058102000200120100020000004034127856000100000001", 0x48) write(0xffffffffffffffff, &(0x7f00000005c0)="010000000705810240000007058102000200", 0x12) ioctl$sock_SIOCGIFINDEX(0xffffffffffffffff, 0x8933, &(0x7f0000000040)={'bridge0\x00'}) syz_clone(0x21000200, 0x0, 0x0, 0x0, 0x0, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000040)='./mnt\x00', 0x1ff) sendmsg$IPSET_CMD_CREATE(0xffffffffffffffff, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000200)=ANY=[@ANYBLOB="600000000206010800000000000000000000000005000400000000000900020073797a31000000001400078008001240000000000500140008000000050005000a000000050001000600000011000300686173683a69702c706f7274"], 0x60}}, 0x24000800) program crashed: KASAN: slab-use-after-free Read in ep_open testing program (duration=59.979085774s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): mkdirat-mount-openat-mprotect-write-write-syz_clone-mkdirat-sendmsg$IPSET_CMD_CREATE detailed listing: executing program 0: mkdirat(0xffffffffffffff9c, &(0x7f0000000100)='./gadget\x00', 0x1ff) mount(0x0, &(0x7f0000000140)='./gadget\x00', &(0x7f0000000180)='gadgetfs\x00', 0x0, 0x0) r0 = openat(0xffffffffffffff9c, &(0x7f00000001c0)='./gadget/dummy_udc\x00', 0x2, 0x0) mprotect(&(0x7f0000362000/0x2000)=nil, 0x2000, 0x1) write(r0, &(0x7f0000000200)="000000000902190001010080320904000001ff000000070581024000000902190001010080320904000001ff00000007058102000200120100020000004034127856000100000001", 0x48) write(0xffffffffffffffff, &(0x7f00000005c0)="010000000705810240000007058102000200", 0x12) syz_clone(0x21000200, 0x0, 0x0, 0x0, 0x0, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000040)='./mnt\x00', 0x1ff) sendmsg$IPSET_CMD_CREATE(0xffffffffffffffff, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000200)=ANY=[@ANYBLOB="600000000206010800000000000000000000000005000400000000000900020073797a31000000001400078008001240000000000500140008000000050005000a000000050001000600000011000300686173683a69702c706f7274"], 0x60}}, 0x24000800) program crashed: KASAN: slab-use-after-free Read in ep_open testing program (duration=59.979085774s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): mkdirat-mount-openat-mprotect-write-syz_clone-mkdirat-sendmsg$IPSET_CMD_CREATE detailed listing: executing program 0: mkdirat(0xffffffffffffff9c, &(0x7f0000000100)='./gadget\x00', 0x1ff) mount(0x0, &(0x7f0000000140)='./gadget\x00', &(0x7f0000000180)='gadgetfs\x00', 0x0, 0x0) r0 = openat(0xffffffffffffff9c, &(0x7f00000001c0)='./gadget/dummy_udc\x00', 0x2, 0x0) mprotect(&(0x7f0000362000/0x2000)=nil, 0x2000, 0x1) write(r0, &(0x7f0000000200)="000000000902190001010080320904000001ff000000070581024000000902190001010080320904000001ff00000007058102000200120100020000004034127856000100000001", 0x48) syz_clone(0x21000200, 0x0, 0x0, 0x0, 0x0, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000040)='./mnt\x00', 0x1ff) sendmsg$IPSET_CMD_CREATE(0xffffffffffffffff, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000200)=ANY=[@ANYBLOB="600000000206010800000000000000000000000005000400000000000900020073797a31000000001400078008001240000000000500140008000000050005000a000000050001000600000011000300686173683a69702c706f7274"], 0x60}}, 0x24000800) program crashed: KASAN: slab-use-after-free Read in ep_open testing program (duration=59.979085774s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): mkdirat-mount-openat-mprotect-syz_clone-mkdirat-sendmsg$IPSET_CMD_CREATE detailed listing: executing program 0: mkdirat(0xffffffffffffff9c, &(0x7f0000000100)='./gadget\x00', 0x1ff) mount(0x0, &(0x7f0000000140)='./gadget\x00', &(0x7f0000000180)='gadgetfs\x00', 0x0, 0x0) openat(0xffffffffffffff9c, &(0x7f00000001c0)='./gadget/dummy_udc\x00', 0x2, 0x0) mprotect(&(0x7f0000362000/0x2000)=nil, 0x2000, 0x1) syz_clone(0x21000200, 0x0, 0x0, 0x0, 0x0, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000040)='./mnt\x00', 0x1ff) sendmsg$IPSET_CMD_CREATE(0xffffffffffffffff, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000200)=ANY=[@ANYBLOB="600000000206010800000000000000000000000005000400000000000900020073797a31000000001400078008001240000000000500140008000000050005000a000000050001000600000011000300686173683a69702c706f7274"], 0x60}}, 0x24000800) program did not crash testing program (duration=59.979085774s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): mkdirat-mount-openat-write-syz_clone-mkdirat-sendmsg$IPSET_CMD_CREATE detailed listing: executing program 0: mkdirat(0xffffffffffffff9c, &(0x7f0000000100)='./gadget\x00', 0x1ff) mount(0x0, &(0x7f0000000140)='./gadget\x00', &(0x7f0000000180)='gadgetfs\x00', 0x0, 0x0) r0 = openat(0xffffffffffffff9c, &(0x7f00000001c0)='./gadget/dummy_udc\x00', 0x2, 0x0) write(r0, &(0x7f0000000200)="000000000902190001010080320904000001ff000000070581024000000902190001010080320904000001ff00000007058102000200120100020000004034127856000100000001", 0x48) syz_clone(0x21000200, 0x0, 0x0, 0x0, 0x0, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000040)='./mnt\x00', 0x1ff) sendmsg$IPSET_CMD_CREATE(0xffffffffffffffff, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000200)=ANY=[@ANYBLOB="600000000206010800000000000000000000000005000400000000000900020073797a31000000001400078008001240000000000500140008000000050005000a000000050001000600000011000300686173683a69702c706f7274"], 0x60}}, 0x24000800) program did not crash testing program (duration=59.979085774s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): mkdirat-mount-mprotect-write-syz_clone-mkdirat-sendmsg$IPSET_CMD_CREATE detailed listing: executing program 0: mkdirat(0xffffffffffffff9c, &(0x7f0000000100)='./gadget\x00', 0x1ff) mount(0x0, &(0x7f0000000140)='./gadget\x00', &(0x7f0000000180)='gadgetfs\x00', 0x0, 0x0) mprotect(&(0x7f0000362000/0x2000)=nil, 0x2000, 0x1) write(0xffffffffffffffff, &(0x7f0000000200)="000000000902190001010080320904000001ff000000070581024000000902190001010080320904000001ff00000007058102000200120100020000004034127856000100000001", 0x48) syz_clone(0x21000200, 0x0, 0x0, 0x0, 0x0, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000040)='./mnt\x00', 0x1ff) sendmsg$IPSET_CMD_CREATE(0xffffffffffffffff, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000200)=ANY=[@ANYBLOB="600000000206010800000000000000000000000005000400000000000900020073797a31000000001400078008001240000000000500140008000000050005000a000000050001000600000011000300686173683a69702c706f7274"], 0x60}}, 0x24000800) program did not crash testing program (duration=59.979085774s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): mkdirat-openat-mprotect-write-syz_clone-mkdirat-sendmsg$IPSET_CMD_CREATE detailed listing: executing program 0: mkdirat(0xffffffffffffff9c, &(0x7f0000000100)='./gadget\x00', 0x1ff) r0 = openat(0xffffffffffffff9c, &(0x7f00000001c0)='./gadget/dummy_udc\x00', 0x2, 0x0) mprotect(&(0x7f0000362000/0x2000)=nil, 0x2000, 0x1) write(r0, &(0x7f0000000200)="000000000902190001010080320904000001ff000000070581024000000902190001010080320904000001ff00000007058102000200120100020000004034127856000100000001", 0x48) syz_clone(0x21000200, 0x0, 0x0, 0x0, 0x0, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000040)='./mnt\x00', 0x1ff) sendmsg$IPSET_CMD_CREATE(0xffffffffffffffff, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000200)=ANY=[@ANYBLOB="600000000206010800000000000000000000000005000400000000000900020073797a31000000001400078008001240000000000500140008000000050005000a000000050001000600000011000300686173683a69702c706f7274"], 0x60}}, 0x24000800) program did not crash testing program (duration=59.979085774s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): mount-openat-mprotect-write-syz_clone-mkdirat-sendmsg$IPSET_CMD_CREATE detailed listing: executing program 0: mount(0x0, &(0x7f0000000140)='./gadget\x00', &(0x7f0000000180)='gadgetfs\x00', 0x0, 0x0) r0 = openat(0xffffffffffffff9c, &(0x7f00000001c0)='./gadget/dummy_udc\x00', 0x2, 0x0) mprotect(&(0x7f0000362000/0x2000)=nil, 0x2000, 0x1) write(r0, &(0x7f0000000200)="000000000902190001010080320904000001ff000000070581024000000902190001010080320904000001ff00000007058102000200120100020000004034127856000100000001", 0x48) syz_clone(0x21000200, 0x0, 0x0, 0x0, 0x0, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000040)='./mnt\x00', 0x1ff) sendmsg$IPSET_CMD_CREATE(0xffffffffffffffff, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000200)=ANY=[@ANYBLOB="600000000206010800000000000000000000000005000400000000000900020073797a31000000001400078008001240000000000500140008000000050005000a000000050001000600000011000300686173683a69702c706f7274"], 0x60}}, 0x24000800) program did not crash testing program (duration=59.979085774s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): mkdirat-mount-openat-mprotect-write-syz_clone-mkdirat-sendmsg$IPSET_CMD_CREATE detailed listing: executing program 0: mkdirat(0xffffffffffffff9c, 0x0, 0x1ff) mount(0x0, &(0x7f0000000140)='./gadget\x00', &(0x7f0000000180)='gadgetfs\x00', 0x0, 0x0) r0 = openat(0xffffffffffffff9c, &(0x7f00000001c0)='./gadget/dummy_udc\x00', 0x2, 0x0) mprotect(&(0x7f0000362000/0x2000)=nil, 0x2000, 0x1) write(r0, &(0x7f0000000200)="000000000902190001010080320904000001ff000000070581024000000902190001010080320904000001ff00000007058102000200120100020000004034127856000100000001", 0x48) syz_clone(0x21000200, 0x0, 0x0, 0x0, 0x0, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000040)='./mnt\x00', 0x1ff) sendmsg$IPSET_CMD_CREATE(0xffffffffffffffff, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000200)=ANY=[@ANYBLOB="600000000206010800000000000000000000000005000400000000000900020073797a31000000001400078008001240000000000500140008000000050005000a000000050001000600000011000300686173683a69702c706f7274"], 0x60}}, 0x24000800) program did not crash testing program (duration=59.979085774s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): mkdirat-mount-openat-mprotect-write-syz_clone-mkdirat-sendmsg$IPSET_CMD_CREATE detailed listing: executing program 0: mkdirat(0xffffffffffffff9c, &(0x7f0000000100)='./gadget\x00', 0x1ff) mount(0x0, 0x0, &(0x7f0000000180)='gadgetfs\x00', 0x0, 0x0) r0 = openat(0xffffffffffffff9c, &(0x7f00000001c0)='./gadget/dummy_udc\x00', 0x2, 0x0) mprotect(&(0x7f0000362000/0x2000)=nil, 0x2000, 0x1) write(r0, &(0x7f0000000200)="000000000902190001010080320904000001ff000000070581024000000902190001010080320904000001ff00000007058102000200120100020000004034127856000100000001", 0x48) syz_clone(0x21000200, 0x0, 0x0, 0x0, 0x0, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000040)='./mnt\x00', 0x1ff) sendmsg$IPSET_CMD_CREATE(0xffffffffffffffff, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000200)=ANY=[@ANYBLOB="600000000206010800000000000000000000000005000400000000000900020073797a31000000001400078008001240000000000500140008000000050005000a000000050001000600000011000300686173683a69702c706f7274"], 0x60}}, 0x24000800) program did not crash testing program (duration=59.979085774s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): mkdirat-mount-openat-mprotect-write-syz_clone-mkdirat-sendmsg$IPSET_CMD_CREATE detailed listing: executing program 0: mkdirat(0xffffffffffffff9c, &(0x7f0000000100)='./gadget\x00', 0x1ff) mount(0x0, &(0x7f0000000140)='./gadget\x00', 0x0, 0x0, 0x0) r0 = openat(0xffffffffffffff9c, &(0x7f00000001c0)='./gadget/dummy_udc\x00', 0x2, 0x0) mprotect(&(0x7f0000362000/0x2000)=nil, 0x2000, 0x1) write(r0, &(0x7f0000000200)="000000000902190001010080320904000001ff000000070581024000000902190001010080320904000001ff00000007058102000200120100020000004034127856000100000001", 0x48) syz_clone(0x21000200, 0x0, 0x0, 0x0, 0x0, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000040)='./mnt\x00', 0x1ff) sendmsg$IPSET_CMD_CREATE(0xffffffffffffffff, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000200)=ANY=[@ANYBLOB="600000000206010800000000000000000000000005000400000000000900020073797a31000000001400078008001240000000000500140008000000050005000a000000050001000600000011000300686173683a69702c706f7274"], 0x60}}, 0x24000800) program did not crash testing program (duration=59.979085774s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): mkdirat-mount-openat-mprotect-write-syz_clone-mkdirat-sendmsg$IPSET_CMD_CREATE detailed listing: executing program 0: mkdirat(0xffffffffffffff9c, &(0x7f0000000100)='./gadget\x00', 0x1ff) mount(0x0, &(0x7f0000000140)='./gadget\x00', &(0x7f0000000180)='gadgetfs\x00', 0x0, 0x0) r0 = openat(0xffffffffffffff9c, 0x0, 0x2, 0x0) mprotect(&(0x7f0000362000/0x2000)=nil, 0x2000, 0x1) write(r0, &(0x7f0000000200)="000000000902190001010080320904000001ff000000070581024000000902190001010080320904000001ff00000007058102000200120100020000004034127856000100000001", 0x48) syz_clone(0x21000200, 0x0, 0x0, 0x0, 0x0, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000040)='./mnt\x00', 0x1ff) sendmsg$IPSET_CMD_CREATE(0xffffffffffffffff, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000200)=ANY=[@ANYBLOB="600000000206010800000000000000000000000005000400000000000900020073797a31000000001400078008001240000000000500140008000000050005000a000000050001000600000011000300686173683a69702c706f7274"], 0x60}}, 0x24000800) program did not crash testing program (duration=59.979085774s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): mkdirat-mount-openat-mprotect-write-syz_clone-mkdirat-sendmsg$IPSET_CMD_CREATE detailed listing: executing program 0: mkdirat(0xffffffffffffff9c, &(0x7f0000000100)='./gadget\x00', 0x1ff) mount(0x0, &(0x7f0000000140)='./gadget\x00', &(0x7f0000000180)='gadgetfs\x00', 0x0, 0x0) r0 = openat(0xffffffffffffff9c, &(0x7f00000001c0)='./gadget/dummy_udc\x00', 0x2, 0x0) mprotect(&(0x7f0000362000/0x2000)=nil, 0x2000, 0x1) write(r0, 0x0, 0x0) syz_clone(0x21000200, 0x0, 0x0, 0x0, 0x0, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000040)='./mnt\x00', 0x1ff) sendmsg$IPSET_CMD_CREATE(0xffffffffffffffff, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000200)=ANY=[@ANYBLOB="600000000206010800000000000000000000000005000400000000000900020073797a31000000001400078008001240000000000500140008000000050005000a000000050001000600000011000300686173683a69702c706f7274"], 0x60}}, 0x24000800) program did not crash testing program (duration=59.979085774s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): mkdirat-mount-openat-mprotect-write-syz_clone-mkdirat-sendmsg$IPSET_CMD_CREATE detailed listing: executing program 0: mkdirat(0xffffffffffffff9c, &(0x7f0000000100)='./gadget\x00', 0x1ff) mount(0x0, &(0x7f0000000140)='./gadget\x00', &(0x7f0000000180)='gadgetfs\x00', 0x0, 0x0) r0 = openat(0xffffffffffffff9c, &(0x7f00000001c0)='./gadget/dummy_udc\x00', 0x2, 0x0) mprotect(&(0x7f0000362000/0x2000)=nil, 0x2000, 0x1) write(r0, &(0x7f0000000200), 0x0) syz_clone(0x21000200, 0x0, 0x0, 0x0, 0x0, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000040)='./mnt\x00', 0x1ff) sendmsg$IPSET_CMD_CREATE(0xffffffffffffffff, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000200)=ANY=[@ANYBLOB="600000000206010800000000000000000000000005000400000000000900020073797a31000000001400078008001240000000000500140008000000050005000a000000050001000600000011000300686173683a69702c706f7274"], 0x60}}, 0x24000800) program did not crash testing program (duration=59.979085774s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): mkdirat-mount-openat-mprotect-write-syz_clone-mkdirat-sendmsg$IPSET_CMD_CREATE detailed listing: executing program 0: mkdirat(0xffffffffffffff9c, &(0x7f0000000100)='./gadget\x00', 0x1ff) mount(0x0, &(0x7f0000000140)='./gadget\x00', &(0x7f0000000180)='gadgetfs\x00', 0x0, 0x0) r0 = openat(0xffffffffffffff9c, &(0x7f00000001c0)='./gadget/dummy_udc\x00', 0x2, 0x0) mprotect(&(0x7f0000362000/0x2000)=nil, 0x2000, 0x1) write(r0, &(0x7f0000000200)="000000000902190001010080320904000001ff000000070581024000000902190001010080320904000001ff00000007058102000200120100020000004034127856000100000001", 0x48) syz_clone(0x21000200, 0x0, 0x0, 0x0, 0x0, 0x0) mkdirat(0xffffffffffffff9c, 0x0, 0x1ff) sendmsg$IPSET_CMD_CREATE(0xffffffffffffffff, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000200)=ANY=[@ANYBLOB="600000000206010800000000000000000000000005000400000000000900020073797a31000000001400078008001240000000000500140008000000050005000a000000050001000600000011000300686173683a69702c706f7274"], 0x60}}, 0x24000800) program did not crash testing program (duration=59.979085774s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): mkdirat-mount-openat-mprotect-write-syz_clone-mkdirat-sendmsg$IPSET_CMD_CREATE detailed listing: executing program 0: mkdirat(0xffffffffffffff9c, &(0x7f0000000100)='./gadget\x00', 0x1ff) mount(0x0, &(0x7f0000000140)='./gadget\x00', &(0x7f0000000180)='gadgetfs\x00', 0x0, 0x0) r0 = openat(0xffffffffffffff9c, &(0x7f00000001c0)='./gadget/dummy_udc\x00', 0x2, 0x0) mprotect(&(0x7f0000362000/0x2000)=nil, 0x2000, 0x1) write(r0, &(0x7f0000000200)="000000000902190001010080320904000001ff000000070581024000000902190001010080320904000001ff00000007058102000200120100020000004034127856000100000001", 0x48) syz_clone(0x21000200, 0x0, 0x0, 0x0, 0x0, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000040)='./mnt\x00', 0x1ff) sendmsg$IPSET_CMD_CREATE(0xffffffffffffffff, 0x0, 0x24000800) program crashed: KASAN: slab-use-after-free Read in ep_open extracting C reproducer testing compiled C program (duration=59.979085774s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): mkdirat-mount-openat-mprotect-write-syz_clone-mkdirat-sendmsg$IPSET_CMD_CREATE program did not crash simplifying guilty program options testing program (duration=59.979085774s, {Threaded:false Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): mkdirat-mount-openat-mprotect-write-syz_clone-mkdirat-sendmsg$IPSET_CMD_CREATE detailed listing: executing program 0: mkdirat(0xffffffffffffff9c, &(0x7f0000000100)='./gadget\x00', 0x1ff) mount(0x0, &(0x7f0000000140)='./gadget\x00', &(0x7f0000000180)='gadgetfs\x00', 0x0, 0x0) r0 = openat(0xffffffffffffff9c, &(0x7f00000001c0)='./gadget/dummy_udc\x00', 0x2, 0x0) mprotect(&(0x7f0000362000/0x2000)=nil, 0x2000, 0x1) write(r0, &(0x7f0000000200)="000000000902190001010080320904000001ff000000070581024000000902190001010080320904000001ff00000007058102000200120100020000004034127856000100000001", 0x48) syz_clone(0x21000200, 0x0, 0x0, 0x0, 0x0, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000040)='./mnt\x00', 0x1ff) sendmsg$IPSET_CMD_CREATE(0xffffffffffffffff, 0x0, 0x24000800) program did not crash testing program (duration=59.979085774s, {Threaded:true Repeat:false RepeatTimes:0 Procs:1 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:false Cgroups:false BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): mkdirat-mount-openat-mprotect-write-syz_clone-mkdirat-sendmsg$IPSET_CMD_CREATE detailed listing: executing program 0: mkdirat(0xffffffffffffff9c, &(0x7f0000000100)='./gadget\x00', 0x1ff) mount(0x0, &(0x7f0000000140)='./gadget\x00', &(0x7f0000000180)='gadgetfs\x00', 0x0, 0x0) r0 = openat(0xffffffffffffff9c, &(0x7f00000001c0)='./gadget/dummy_udc\x00', 0x2, 0x0) mprotect(&(0x7f0000362000/0x2000)=nil, 0x2000, 0x1) write(r0, &(0x7f0000000200)="000000000902190001010080320904000001ff000000070581024000000902190001010080320904000001ff00000007058102000200120100020000004034127856000100000001", 0x48) syz_clone(0x21000200, 0x0, 0x0, 0x0, 0x0, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000040)='./mnt\x00', 0x1ff) sendmsg$IPSET_CMD_CREATE(0xffffffffffffffff, 0x0, 0x24000800) program did not crash testing program (duration=59.979085774s, {Threaded:true Repeat:true RepeatTimes:0 Procs:1 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): mkdirat-mount-openat-mprotect-write-syz_clone-mkdirat-sendmsg$IPSET_CMD_CREATE detailed listing: executing program 0: mkdirat(0xffffffffffffff9c, &(0x7f0000000100)='./gadget\x00', 0x1ff) mount(0x0, &(0x7f0000000140)='./gadget\x00', &(0x7f0000000180)='gadgetfs\x00', 0x0, 0x0) r0 = openat(0xffffffffffffff9c, &(0x7f00000001c0)='./gadget/dummy_udc\x00', 0x2, 0x0) mprotect(&(0x7f0000362000/0x2000)=nil, 0x2000, 0x1) write(r0, &(0x7f0000000200)="000000000902190001010080320904000001ff000000070581024000000902190001010080320904000001ff00000007058102000200120100020000004034127856000100000001", 0x48) syz_clone(0x21000200, 0x0, 0x0, 0x0, 0x0, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000040)='./mnt\x00', 0x1ff) sendmsg$IPSET_CMD_CREATE(0xffffffffffffffff, 0x0, 0x24000800) program did not crash testing program (duration=59.979085774s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): mkdirat-mount-openat-mprotect-write-syz_clone-mkdirat-sendmsg$IPSET_CMD_CREATE detailed listing: executing program 0: mkdirat(0xffffffffffffff9c, &(0x7f0000000100)='./gadget\x00', 0x1ff) mount(0x0, &(0x7f0000000140)='./gadget\x00', &(0x7f0000000180)='gadgetfs\x00', 0x0, 0x0) r0 = openat(0xffffffffffffff9c, &(0x7f00000001c0)='./gadget/dummy_udc\x00', 0x2, 0x0) mprotect(&(0x7f0000362000/0x2000)=nil, 0x2000, 0x1) write(r0, &(0x7f0000000200)="000000000902190001010080320904000001ff000000070581024000000902190001010080320904000001ff00000007058102000200120100020000004034127856000100000001", 0x48) syz_clone(0x21000200, 0x0, 0x0, 0x0, 0x0, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000040)='./mnt\x00', 0x1ff) sendmsg$IPSET_CMD_CREATE(0xffffffffffffffff, 0x0, 0x24000800) program did not crash validation run: crashed=false testing program (duration=59.979085774s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): mkdirat-mount-openat-mprotect-write-syz_clone-mkdirat-sendmsg$IPSET_CMD_CREATE detailed listing: executing program 0: mkdirat(0xffffffffffffff9c, &(0x7f0000000100)='./gadget\x00', 0x1ff) mount(0x0, &(0x7f0000000140)='./gadget\x00', &(0x7f0000000180)='gadgetfs\x00', 0x0, 0x0) r0 = openat(0xffffffffffffff9c, &(0x7f00000001c0)='./gadget/dummy_udc\x00', 0x2, 0x0) mprotect(&(0x7f0000362000/0x2000)=nil, 0x2000, 0x1) write(r0, &(0x7f0000000200)="000000000902190001010080320904000001ff000000070581024000000902190001010080320904000001ff00000007058102000200120100020000004034127856000100000001", 0x48) syz_clone(0x21000200, 0x0, 0x0, 0x0, 0x0, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000040)='./mnt\x00', 0x1ff) sendmsg$IPSET_CMD_CREATE(0xffffffffffffffff, 0x0, 0x24000800) program did not crash validation run: crashed=false testing program (duration=59.979085774s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): mkdirat-mount-openat-mprotect-write-syz_clone-mkdirat-sendmsg$IPSET_CMD_CREATE detailed listing: executing program 0: mkdirat(0xffffffffffffff9c, &(0x7f0000000100)='./gadget\x00', 0x1ff) mount(0x0, &(0x7f0000000140)='./gadget\x00', &(0x7f0000000180)='gadgetfs\x00', 0x0, 0x0) r0 = openat(0xffffffffffffff9c, &(0x7f00000001c0)='./gadget/dummy_udc\x00', 0x2, 0x0) mprotect(&(0x7f0000362000/0x2000)=nil, 0x2000, 0x1) write(r0, &(0x7f0000000200)="000000000902190001010080320904000001ff000000070581024000000902190001010080320904000001ff00000007058102000200120100020000004034127856000100000001", 0x48) syz_clone(0x21000200, 0x0, 0x0, 0x0, 0x0, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000040)='./mnt\x00', 0x1ff) sendmsg$IPSET_CMD_CREATE(0xffffffffffffffff, 0x0, 0x24000800) program crashed: KASAN: slab-use-after-free Read in ep_open validation run: crashed=true testing program (duration=59.979085774s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): mkdirat-mount-openat-mprotect-write-syz_clone-mkdirat-sendmsg$IPSET_CMD_CREATE detailed listing: executing program 0: mkdirat(0xffffffffffffff9c, &(0x7f0000000100)='./gadget\x00', 0x1ff) mount(0x0, &(0x7f0000000140)='./gadget\x00', &(0x7f0000000180)='gadgetfs\x00', 0x0, 0x0) r0 = openat(0xffffffffffffff9c, &(0x7f00000001c0)='./gadget/dummy_udc\x00', 0x2, 0x0) mprotect(&(0x7f0000362000/0x2000)=nil, 0x2000, 0x1) write(r0, &(0x7f0000000200)="000000000902190001010080320904000001ff000000070581024000000902190001010080320904000001ff00000007058102000200120100020000004034127856000100000001", 0x48) syz_clone(0x21000200, 0x0, 0x0, 0x0, 0x0, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000040)='./mnt\x00', 0x1ff) sendmsg$IPSET_CMD_CREATE(0xffffffffffffffff, 0x0, 0x24000800) program crashed: KASAN: slab-use-after-free Read in ep_open validation run: crashed=true testing program (duration=59.979085774s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): mkdirat-mount-openat-mprotect-write-syz_clone-mkdirat-sendmsg$IPSET_CMD_CREATE detailed listing: executing program 0: mkdirat(0xffffffffffffff9c, &(0x7f0000000100)='./gadget\x00', 0x1ff) mount(0x0, &(0x7f0000000140)='./gadget\x00', &(0x7f0000000180)='gadgetfs\x00', 0x0, 0x0) r0 = openat(0xffffffffffffff9c, &(0x7f00000001c0)='./gadget/dummy_udc\x00', 0x2, 0x0) mprotect(&(0x7f0000362000/0x2000)=nil, 0x2000, 0x1) write(r0, &(0x7f0000000200)="000000000902190001010080320904000001ff000000070581024000000902190001010080320904000001ff00000007058102000200120100020000004034127856000100000001", 0x48) syz_clone(0x21000200, 0x0, 0x0, 0x0, 0x0, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000040)='./mnt\x00', 0x1ff) sendmsg$IPSET_CMD_CREATE(0xffffffffffffffff, 0x0, 0x24000800) program did not crash validation run: crashed=false testing program (duration=59.979085774s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): mkdirat-mount-openat-mprotect-write-syz_clone-mkdirat-sendmsg$IPSET_CMD_CREATE detailed listing: executing program 0: mkdirat(0xffffffffffffff9c, &(0x7f0000000100)='./gadget\x00', 0x1ff) mount(0x0, &(0x7f0000000140)='./gadget\x00', &(0x7f0000000180)='gadgetfs\x00', 0x0, 0x0) r0 = openat(0xffffffffffffff9c, &(0x7f00000001c0)='./gadget/dummy_udc\x00', 0x2, 0x0) mprotect(&(0x7f0000362000/0x2000)=nil, 0x2000, 0x1) write(r0, &(0x7f0000000200)="000000000902190001010080320904000001ff000000070581024000000902190001010080320904000001ff00000007058102000200120100020000004034127856000100000001", 0x48) syz_clone(0x21000200, 0x0, 0x0, 0x0, 0x0, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000040)='./mnt\x00', 0x1ff) sendmsg$IPSET_CMD_CREATE(0xffffffffffffffff, 0x0, 0x24000800) program crashed: KASAN: slab-use-after-free Read in ep_open validation run: crashed=true reproducing took 3h28m56.105214897s repro crashed as (corrupted=false): ================================================================== BUG: KASAN: slab-use-after-free in __mutex_lock_common kernel/locking/mutex.c:625 [inline] BUG: KASAN: slab-use-after-free in __mutex_lock+0x15c5/0x1bd0 kernel/locking/mutex.c:821 Read of size 8 at addr ffff88805759f058 by task syz-executor/7827 CPU: 1 UID: 0 PID: 7827 Comm: syz-executor Not tainted syzkaller #0 PREEMPT(full) Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 Call Trace: __dump_stack lib/dump_stack.c:94 [inline] dump_stack_lvl+0x100/0x190 lib/dump_stack.c:120 print_address_description mm/kasan/report.c:378 [inline] print_report+0x13d/0x4b0 mm/kasan/report.c:482 kasan_report+0xdf/0x1c0 mm/kasan/report.c:595 __mutex_lock_common kernel/locking/mutex.c:625 [inline] __mutex_lock+0x15c5/0x1bd0 kernel/locking/mutex.c:821 ep_open+0x4c/0x2c0 drivers/usb/gadget/legacy/inode.c:832 do_dentry_open+0x6ab/0x14d0 fs/open.c:996 vfs_open+0x82/0x3f0 fs/open.c:1101 do_open fs/namei.c:4837 [inline] path_openat+0x19fa/0x2440 fs/namei.c:5000 do_file_open+0x20e/0x430 fs/namei.c:5029 do_sys_openat2+0x10f/0x1e0 fs/open.c:1417 do_sys_open fs/open.c:1423 [inline] __do_sys_openat fs/open.c:1439 [inline] __se_sys_openat fs/open.c:1434 [inline] __x64_sys_openat+0x12d/0x210 fs/open.c:1434 do_syscall_x64 arch/x86/entry/syscall_64.c:61 [inline] do_syscall_64+0x123/0x790 arch/x86/entry/syscall_64.c:84 entry_SYSCALL_64_after_hwframe+0x77/0x7f RIP: 0033:0x7f6a40d5e98e Code: 08 0f 85 a5 a8 ff ff 49 89 fb 48 89 f0 48 89 d7 48 89 ce 4c 89 c2 4d 89 ca 4c 8b 44 24 08 4c 8b 4c 24 10 4c 89 5c 24 08 0f 05 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 80 00 00 00 00 48 83 ec 08 RSP: 002b:00007ffe40832f78 EFLAGS: 00000246 ORIG_RAX: 0000000000000101 RAX: ffffffffffffffda RBX: 00005555947d5500 RCX: 00007f6a40d5e98e RDX: 0000000000000000 RSI: 00007ffe408330e0 RDI: ffffffffffffff9c RBP: 00007ffe408330e0 R08: 0000000000000000 R09: 0000000000000000 R10: 0000000000000000 R11: 0000000000000246 R12: 00007ffe408341d0 R13: 00007f6a40e34474 R14: 00005555947d54e8 R15: 0000000000000006 Allocated by task 8029: kasan_save_stack+0x30/0x50 mm/kasan/common.c:57 kasan_save_track+0x14/0x30 mm/kasan/common.c:78 poison_kmalloc_redzone mm/kasan/common.c:398 [inline] __kasan_kmalloc+0xaa/0xb0 mm/kasan/common.c:415 kasan_kmalloc include/linux/kasan.h:263 [inline] __kmalloc_cache_noprof+0x2f8/0x6d0 mm/slub.c:5563 _kmalloc_noprof include/linux/slab.h:991 [inline] _kzalloc_noprof include/linux/slab.h:1312 [inline] activate_ep_files drivers/usb/gadget/legacy/inode.c:1610 [inline] gadgetfs_bind+0x582/0x890 drivers/usb/gadget/legacy/inode.c:1701 gadget_bind_driver+0x28c/0xbf0 drivers/usb/gadget/udc/core.c:1662 call_driver_probe drivers/base/dd.c:628 [inline] really_probe+0x241/0xa60 drivers/base/dd.c:706 __driver_probe_device+0x210/0x460 drivers/base/dd.c:868 driver_probe_device+0x4a/0x140 drivers/base/dd.c:898 __driver_attach+0x21f/0x5b0 drivers/base/dd.c:1292 bus_for_each_dev+0x13e/0x1d0 drivers/base/bus.c:383 bus_add_driver+0x305/0x5b0 drivers/base/bus.c:763 driver_register+0x1e2/0x360 drivers/base/driver.c:174 usb_gadget_register_driver_owner+0x132/0x210 drivers/usb/gadget/udc/core.c:1752 dev_config+0xdce/0x1610 drivers/usb/gadget/legacy/inode.c:1892 vfs_write+0x2aa/0x1050 fs/read_write.c:685 ksys_write+0x12a/0x250 fs/read_write.c:739 do_syscall_x64 arch/x86/entry/syscall_64.c:61 [inline] do_syscall_64+0x123/0x790 arch/x86/entry/syscall_64.c:84 entry_SYSCALL_64_after_hwframe+0x77/0x7f Freed by task 8033: kasan_save_stack+0x30/0x50 mm/kasan/common.c:57 kasan_save_track+0x14/0x30 mm/kasan/common.c:78 kasan_save_free_info+0x3b/0x70 mm/kasan/generic.c:584 poison_slab_object mm/kasan/common.c:253 [inline] __kasan_slab_free+0x5f/0x80 mm/kasan/common.c:285 kasan_slab_free include/linux/kasan.h:235 [inline] slab_free_hook mm/slub.c:2748 [inline] slab_free mm/slub.c:6499 [inline] kfree+0x22b/0x6d0 mm/slub.c:6792 put_ep drivers/usb/gadget/legacy/inode.c:225 [inline] put_ep+0x117/0x150 drivers/usb/gadget/legacy/inode.c:217 destroy_ep_files+0x163/0x420 drivers/usb/gadget/legacy/inode.c:1591 gadgetfs_unbind+0x139/0x260 drivers/usb/gadget/legacy/inode.c:1664 gadget_unbind_driver+0x20c/0x4f0 drivers/usb/gadget/udc/core.c:1724 device_remove+0xcb/0x180 drivers/base/dd.c:616 __device_release_driver drivers/base/dd.c:1349 [inline] device_release_driver_internal+0x44e/0x620 drivers/base/dd.c:1372 driver_detach+0xd8/0x1b0 drivers/base/dd.c:1435 bus_remove_driver+0x13b/0x2e0 drivers/base/bus.c:832 driver_unregister+0x76/0xb0 drivers/base/driver.c:202 usb_gadget_unregister_driver+0x49/0x70 drivers/usb/gadget/udc/core.c:1784 dev_release+0x132/0x1b0 drivers/usb/gadget/legacy/inode.c:1207 __fput+0x3ff/0xb50 fs/file_table.c:512 task_work_run+0x150/0x240 kernel/task_work.c:233 exit_task_work include/linux/task_work.h:40 [inline] do_exit+0x951/0x2ae0 kernel/exit.c:1008 __do_sys_exit kernel/exit.c:1118 [inline] __se_sys_exit kernel/exit.c:1116 [inline] __x64_sys_exit+0x42/0x50 kernel/exit.c:1116 x64_sys_call+0x156c/0x1570 arch/x86/include/generated/asm/syscalls_64.h:61 do_syscall_x64 arch/x86/entry/syscall_64.c:61 [inline] do_syscall_64+0x123/0x790 arch/x86/entry/syscall_64.c:84 entry_SYSCALL_64_after_hwframe+0x77/0x7f The buggy address belongs to the object at ffff88805759f000 which belongs to the cache kmalloc-512 of size 512 The buggy address is located 88 bytes inside of freed 512-byte region [ffff88805759f000, ffff88805759f200) The buggy address belongs to the physical page: page: refcount:0 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x5759c head: order:2 mapcount:0 entire_mapcount:0 nr_pages_mapped:0 pincount:0 flags: 0xfff00000000040(head|node=0|zone=1|lastcpupid=0x7ff) page_type: f5(slab) raw: 00fff00000000040 ffff88801c042c80 dead000000000100 dead000000000122 raw: 0000000000000000 0000000000100010 00000000f5000000 0000000000000000 head: 00fff00000000040 ffff88801c042c80 dead000000000100 dead000000000122 head: 0000000000000000 0000000000100010 00000000f5000000 0000000000000000 head: 00fff00000000002 ffffffffffffff01 00000000ffffffff 00000000ffffffff head: ffffffffffffffff 0000000000000000 00000000ffffffff 0000000000000004 page dumped because: kasan: bad access detected page_owner tracks the page as allocated page last allocated via order 2, migratetype Unmovable, gfp_mask 0xd20c0(__GFP_IO|__GFP_FS|__GFP_NOWARN|__GFP_NORETRY|__GFP_COMP|__GFP_NOMEMALLOC), pid 7294, tgid 7294 (dhcpcd-run-hook), ts 70505449465 set_page_owner include/linux/page_owner.h:33 [inline] post_alloc_hook+0xfd/0x120 mm/page_alloc.c:1871 prep_new_page mm/page_alloc.c:1879 [inline] get_page_from_freelist+0x110d/0x35d0 mm/page_alloc.c:3943 __alloc_frozen_pages_noprof+0x2eb/0x3300 mm/page_alloc.c:5436 alloc_slab_page mm/slub.c:3347 [inline] allocate_slab mm/slub.c:3462 [inline] new_slab+0xa9/0x6e0 mm/slub.c:3513 refill_objects+0xe3/0x410 mm/slub.c:7410 refill_sheaf mm/slub.c:2885 [inline] __pcs_replace_empty_main+0x35e/0x650 mm/slub.c:4774 alloc_from_pcs mm/slub.c:4850 [inline] slab_alloc_node mm/slub.c:4984 [inline] __do_kmalloc_node mm/slub.c:5413 [inline] __kmalloc_flags_noprof+0x6a9/0x8e0 mm/slub.c:5602 _kmalloc_flags_noprof mm/slab.h:55 [inline] alloc_slab_obj_exts+0x6a/0x170 mm/slub.c:2186 account_slab mm/slub.c:3419 [inline] allocate_slab mm/slub.c:3498 [inline] new_slab+0x4ac/0x6e0 mm/slub.c:3513 refill_objects+0xe3/0x410 mm/slub.c:7410 refill_sheaf mm/slub.c:2885 [inline] __pcs_replace_empty_main+0x35e/0x650 mm/slub.c:4774 alloc_from_pcs mm/slub.c:4850 [inline] slab_alloc_node mm/slub.c:4984 [inline] kmem_cache_alloc_noprof+0x4c4/0x6a0 mm/slub.c:5010 anon_vma_chain_alloc mm/rmap.c:142 [inline] anon_vma_fork+0x19a/0x6a0 mm/rmap.c:394 dup_mmap+0x10e6/0x2370 mm/mmap.c:1781 dup_mm kernel/fork.c:1543 [inline] copy_mm kernel/fork.c:1595 [inline] copy_process+0x4811/0x8370 kernel/fork.c:2307 kernel_clone+0x176/0x9d0 kernel/fork.c:2766 page last free pid 6000 tgid 6000 ts 68341075314 stack trace: reset_page_owner include/linux/page_owner.h:26 [inline] __free_pages_prepare mm/page_alloc.c:1418 [inline] __free_frozen_pages+0x79f/0x10f0 mm/page_alloc.c:2962 qlink_free mm/kasan/quarantine.c:163 [inline] qlist_free_all+0x47/0xf0 mm/kasan/quarantine.c:179 kasan_quarantine_reduce+0x1a0/0x1f0 mm/kasan/quarantine.c:286 __kasan_slab_alloc+0x69/0x90 mm/kasan/common.c:350 kasan_slab_alloc include/linux/kasan.h:253 [inline] slab_post_alloc_hook mm/slub.c:4683 [inline] slab_alloc_node mm/slub.c:4996 [inline] __do_kmalloc_node mm/slub.c:5413 [inline] __kvmalloc_node_noprof+0x2f6/0x9b0 mm/slub.c:7005 vmemdup_user+0x2a/0xe0 mm/util.c:247 setxattr_copy fs/xattr.c:645 [inline] setxattr_copy fs/xattr.c:630 [inline] path_setxattrat+0x29e/0x3b0 fs/xattr.c:722 __do_sys_lsetxattr fs/xattr.c:775 [inline] __se_sys_lsetxattr fs/xattr.c:771 [inline] __x64_sys_lsetxattr+0xc9/0x140 fs/xattr.c:771 do_syscall_x64 arch/x86/entry/syscall_64.c:61 [inline] do_syscall_64+0x123/0x790 arch/x86/entry/syscall_64.c:84 entry_SYSCALL_64_after_hwframe+0x77/0x7f Memory state around the buggy address: ffff88805759ef00: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc ffff88805759ef80: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc >ffff88805759f000: fa fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb ^ ffff88805759f080: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb ffff88805759f100: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb ================================================================== final repro crashed as (corrupted=false): ================================================================== BUG: KASAN: slab-use-after-free in __mutex_lock_common kernel/locking/mutex.c:625 [inline] BUG: KASAN: slab-use-after-free in __mutex_lock+0x15c5/0x1bd0 kernel/locking/mutex.c:821 Read of size 8 at addr ffff88805759f058 by task syz-executor/7827 CPU: 1 UID: 0 PID: 7827 Comm: syz-executor Not tainted syzkaller #0 PREEMPT(full) Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 Call Trace: __dump_stack lib/dump_stack.c:94 [inline] dump_stack_lvl+0x100/0x190 lib/dump_stack.c:120 print_address_description mm/kasan/report.c:378 [inline] print_report+0x13d/0x4b0 mm/kasan/report.c:482 kasan_report+0xdf/0x1c0 mm/kasan/report.c:595 __mutex_lock_common kernel/locking/mutex.c:625 [inline] __mutex_lock+0x15c5/0x1bd0 kernel/locking/mutex.c:821 ep_open+0x4c/0x2c0 drivers/usb/gadget/legacy/inode.c:832 do_dentry_open+0x6ab/0x14d0 fs/open.c:996 vfs_open+0x82/0x3f0 fs/open.c:1101 do_open fs/namei.c:4837 [inline] path_openat+0x19fa/0x2440 fs/namei.c:5000 do_file_open+0x20e/0x430 fs/namei.c:5029 do_sys_openat2+0x10f/0x1e0 fs/open.c:1417 do_sys_open fs/open.c:1423 [inline] __do_sys_openat fs/open.c:1439 [inline] __se_sys_openat fs/open.c:1434 [inline] __x64_sys_openat+0x12d/0x210 fs/open.c:1434 do_syscall_x64 arch/x86/entry/syscall_64.c:61 [inline] do_syscall_64+0x123/0x790 arch/x86/entry/syscall_64.c:84 entry_SYSCALL_64_after_hwframe+0x77/0x7f RIP: 0033:0x7f6a40d5e98e Code: 08 0f 85 a5 a8 ff ff 49 89 fb 48 89 f0 48 89 d7 48 89 ce 4c 89 c2 4d 89 ca 4c 8b 44 24 08 4c 8b 4c 24 10 4c 89 5c 24 08 0f 05 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 80 00 00 00 00 48 83 ec 08 RSP: 002b:00007ffe40832f78 EFLAGS: 00000246 ORIG_RAX: 0000000000000101 RAX: ffffffffffffffda RBX: 00005555947d5500 RCX: 00007f6a40d5e98e RDX: 0000000000000000 RSI: 00007ffe408330e0 RDI: ffffffffffffff9c RBP: 00007ffe408330e0 R08: 0000000000000000 R09: 0000000000000000 R10: 0000000000000000 R11: 0000000000000246 R12: 00007ffe408341d0 R13: 00007f6a40e34474 R14: 00005555947d54e8 R15: 0000000000000006 Allocated by task 8029: kasan_save_stack+0x30/0x50 mm/kasan/common.c:57 kasan_save_track+0x14/0x30 mm/kasan/common.c:78 poison_kmalloc_redzone mm/kasan/common.c:398 [inline] __kasan_kmalloc+0xaa/0xb0 mm/kasan/common.c:415 kasan_kmalloc include/linux/kasan.h:263 [inline] __kmalloc_cache_noprof+0x2f8/0x6d0 mm/slub.c:5563 _kmalloc_noprof include/linux/slab.h:991 [inline] _kzalloc_noprof include/linux/slab.h:1312 [inline] activate_ep_files drivers/usb/gadget/legacy/inode.c:1610 [inline] gadgetfs_bind+0x582/0x890 drivers/usb/gadget/legacy/inode.c:1701 gadget_bind_driver+0x28c/0xbf0 drivers/usb/gadget/udc/core.c:1662 call_driver_probe drivers/base/dd.c:628 [inline] really_probe+0x241/0xa60 drivers/base/dd.c:706 __driver_probe_device+0x210/0x460 drivers/base/dd.c:868 driver_probe_device+0x4a/0x140 drivers/base/dd.c:898 __driver_attach+0x21f/0x5b0 drivers/base/dd.c:1292 bus_for_each_dev+0x13e/0x1d0 drivers/base/bus.c:383 bus_add_driver+0x305/0x5b0 drivers/base/bus.c:763 driver_register+0x1e2/0x360 drivers/base/driver.c:174 usb_gadget_register_driver_owner+0x132/0x210 drivers/usb/gadget/udc/core.c:1752 dev_config+0xdce/0x1610 drivers/usb/gadget/legacy/inode.c:1892 vfs_write+0x2aa/0x1050 fs/read_write.c:685 ksys_write+0x12a/0x250 fs/read_write.c:739 do_syscall_x64 arch/x86/entry/syscall_64.c:61 [inline] do_syscall_64+0x123/0x790 arch/x86/entry/syscall_64.c:84 entry_SYSCALL_64_after_hwframe+0x77/0x7f Freed by task 8033: kasan_save_stack+0x30/0x50 mm/kasan/common.c:57 kasan_save_track+0x14/0x30 mm/kasan/common.c:78 kasan_save_free_info+0x3b/0x70 mm/kasan/generic.c:584 poison_slab_object mm/kasan/common.c:253 [inline] __kasan_slab_free+0x5f/0x80 mm/kasan/common.c:285 kasan_slab_free include/linux/kasan.h:235 [inline] slab_free_hook mm/slub.c:2748 [inline] slab_free mm/slub.c:6499 [inline] kfree+0x22b/0x6d0 mm/slub.c:6792 put_ep drivers/usb/gadget/legacy/inode.c:225 [inline] put_ep+0x117/0x150 drivers/usb/gadget/legacy/inode.c:217 destroy_ep_files+0x163/0x420 drivers/usb/gadget/legacy/inode.c:1591 gadgetfs_unbind+0x139/0x260 drivers/usb/gadget/legacy/inode.c:1664 gadget_unbind_driver+0x20c/0x4f0 drivers/usb/gadget/udc/core.c:1724 device_remove+0xcb/0x180 drivers/base/dd.c:616 __device_release_driver drivers/base/dd.c:1349 [inline] device_release_driver_internal+0x44e/0x620 drivers/base/dd.c:1372 driver_detach+0xd8/0x1b0 drivers/base/dd.c:1435 bus_remove_driver+0x13b/0x2e0 drivers/base/bus.c:832 driver_unregister+0x76/0xb0 drivers/base/driver.c:202 usb_gadget_unregister_driver+0x49/0x70 drivers/usb/gadget/udc/core.c:1784 dev_release+0x132/0x1b0 drivers/usb/gadget/legacy/inode.c:1207 __fput+0x3ff/0xb50 fs/file_table.c:512 task_work_run+0x150/0x240 kernel/task_work.c:233 exit_task_work include/linux/task_work.h:40 [inline] do_exit+0x951/0x2ae0 kernel/exit.c:1008 __do_sys_exit kernel/exit.c:1118 [inline] __se_sys_exit kernel/exit.c:1116 [inline] __x64_sys_exit+0x42/0x50 kernel/exit.c:1116 x64_sys_call+0x156c/0x1570 arch/x86/include/generated/asm/syscalls_64.h:61 do_syscall_x64 arch/x86/entry/syscall_64.c:61 [inline] do_syscall_64+0x123/0x790 arch/x86/entry/syscall_64.c:84 entry_SYSCALL_64_after_hwframe+0x77/0x7f The buggy address belongs to the object at ffff88805759f000 which belongs to the cache kmalloc-512 of size 512 The buggy address is located 88 bytes inside of freed 512-byte region [ffff88805759f000, ffff88805759f200) The buggy address belongs to the physical page: page: refcount:0 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x5759c head: order:2 mapcount:0 entire_mapcount:0 nr_pages_mapped:0 pincount:0 flags: 0xfff00000000040(head|node=0|zone=1|lastcpupid=0x7ff) page_type: f5(slab) raw: 00fff00000000040 ffff88801c042c80 dead000000000100 dead000000000122 raw: 0000000000000000 0000000000100010 00000000f5000000 0000000000000000 head: 00fff00000000040 ffff88801c042c80 dead000000000100 dead000000000122 head: 0000000000000000 0000000000100010 00000000f5000000 0000000000000000 head: 00fff00000000002 ffffffffffffff01 00000000ffffffff 00000000ffffffff head: ffffffffffffffff 0000000000000000 00000000ffffffff 0000000000000004 page dumped because: kasan: bad access detected page_owner tracks the page as allocated page last allocated via order 2, migratetype Unmovable, gfp_mask 0xd20c0(__GFP_IO|__GFP_FS|__GFP_NOWARN|__GFP_NORETRY|__GFP_COMP|__GFP_NOMEMALLOC), pid 7294, tgid 7294 (dhcpcd-run-hook), ts 70505449465 set_page_owner include/linux/page_owner.h:33 [inline] post_alloc_hook+0xfd/0x120 mm/page_alloc.c:1871 prep_new_page mm/page_alloc.c:1879 [inline] get_page_from_freelist+0x110d/0x35d0 mm/page_alloc.c:3943 __alloc_frozen_pages_noprof+0x2eb/0x3300 mm/page_alloc.c:5436 alloc_slab_page mm/slub.c:3347 [inline] allocate_slab mm/slub.c:3462 [inline] new_slab+0xa9/0x6e0 mm/slub.c:3513 refill_objects+0xe3/0x410 mm/slub.c:7410 refill_sheaf mm/slub.c:2885 [inline] __pcs_replace_empty_main+0x35e/0x650 mm/slub.c:4774 alloc_from_pcs mm/slub.c:4850 [inline] slab_alloc_node mm/slub.c:4984 [inline] __do_kmalloc_node mm/slub.c:5413 [inline] __kmalloc_flags_noprof+0x6a9/0x8e0 mm/slub.c:5602 _kmalloc_flags_noprof mm/slab.h:55 [inline] alloc_slab_obj_exts+0x6a/0x170 mm/slub.c:2186 account_slab mm/slub.c:3419 [inline] allocate_slab mm/slub.c:3498 [inline] new_slab+0x4ac/0x6e0 mm/slub.c:3513 refill_objects+0xe3/0x410 mm/slub.c:7410 refill_sheaf mm/slub.c:2885 [inline] __pcs_replace_empty_main+0x35e/0x650 mm/slub.c:4774 alloc_from_pcs mm/slub.c:4850 [inline] slab_alloc_node mm/slub.c:4984 [inline] kmem_cache_alloc_noprof+0x4c4/0x6a0 mm/slub.c:5010 anon_vma_chain_alloc mm/rmap.c:142 [inline] anon_vma_fork+0x19a/0x6a0 mm/rmap.c:394 dup_mmap+0x10e6/0x2370 mm/mmap.c:1781 dup_mm kernel/fork.c:1543 [inline] copy_mm kernel/fork.c:1595 [inline] copy_process+0x4811/0x8370 kernel/fork.c:2307 kernel_clone+0x176/0x9d0 kernel/fork.c:2766 page last free pid 6000 tgid 6000 ts 68341075314 stack trace: reset_page_owner include/linux/page_owner.h:26 [inline] __free_pages_prepare mm/page_alloc.c:1418 [inline] __free_frozen_pages+0x79f/0x10f0 mm/page_alloc.c:2962 qlink_free mm/kasan/quarantine.c:163 [inline] qlist_free_all+0x47/0xf0 mm/kasan/quarantine.c:179 kasan_quarantine_reduce+0x1a0/0x1f0 mm/kasan/quarantine.c:286 __kasan_slab_alloc+0x69/0x90 mm/kasan/common.c:350 kasan_slab_alloc include/linux/kasan.h:253 [inline] slab_post_alloc_hook mm/slub.c:4683 [inline] slab_alloc_node mm/slub.c:4996 [inline] __do_kmalloc_node mm/slub.c:5413 [inline] __kvmalloc_node_noprof+0x2f6/0x9b0 mm/slub.c:7005 vmemdup_user+0x2a/0xe0 mm/util.c:247 setxattr_copy fs/xattr.c:645 [inline] setxattr_copy fs/xattr.c:630 [inline] path_setxattrat+0x29e/0x3b0 fs/xattr.c:722 __do_sys_lsetxattr fs/xattr.c:775 [inline] __se_sys_lsetxattr fs/xattr.c:771 [inline] __x64_sys_lsetxattr+0xc9/0x140 fs/xattr.c:771 do_syscall_x64 arch/x86/entry/syscall_64.c:61 [inline] do_syscall_64+0x123/0x790 arch/x86/entry/syscall_64.c:84 entry_SYSCALL_64_after_hwframe+0x77/0x7f Memory state around the buggy address: ffff88805759ef00: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc ffff88805759ef80: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc >ffff88805759f000: fa fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb ^ ffff88805759f080: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb ffff88805759f100: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb ==================================================================