Extracting prog: 1h13m24.109520544s
Minimizing prog: 48m33.96227495s
Simplifying prog options: 4m37.670886471s
Extracting C: 2m44.662890266s
Simplifying C: 0s


extracting reproducer from 30 programs
testing a last program of every proc
single: executing 5 programs separately with timeout 30s
testing program (duration=30s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): socket$nl_generic-syz_genetlink_get_family_id$tipc2-socket$inet_udp-bind$inet-sendmsg$TIPC_NL_BEARER_ENABLE-recvfrom$inet
detailed listing:
executing program 0:
r0 = socket$nl_generic(0x10, 0x3, 0x10)
r1 = syz_genetlink_get_family_id$tipc2(&(0x7f0000000000), 0xffffffffffffffff)
r2 = socket$inet_udp(0x2, 0x2, 0x0)
bind$inet(r2, &(0x7f0000000100)={0x2, 0x1f91, @loopback}, 0x10)
sendmsg$TIPC_NL_BEARER_ENABLE(r0, &(0x7f0000000080)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000140)={0x54, r1, 0x1, 0x123, 0x234, {}, [@TIPC_NLA_BEARER={0x40, 0x1, 0x0, 0x1, [@TIPC_NLA_BEARER_NAME={0xd, 0x1, @udp='udp:syz0\x00'}, @TIPC_NLA_BEARER_UDP_OPTS={0x2c, 0x4, {{0x14, 0x1, @in={0x2, 0x1f90, @loopback}}, {0x14, 0x2, @in={0x2, 0x1f91, @loopback}}}}]}]}, 0x54}}, 0x0)
recvfrom$inet(r2, &(0x7f0000000200), 0x100, 0x0, 0x0, 0x0)

program did not crash
testing program (duration=30s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): mkdirat-mount-openat-write-openat-write-openat-write-nanosleep-nanosleep-write-socket$inet-connect$inet-nanosleep-socket$inet-connect$inet-nanosleep
detailed listing:
executing program 0:
mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./nfsd\x00', 0x1ff)
mount(&(0x7f0000000040)=@filename='none\x00', &(0x7f0000000080)='./nfsd\x00', &(0x7f00000000c0)='nfsd\x00', 0x0, 0x0)
r0 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./nfsd/versions\x00', 0x2, 0x0)
write(r0, &(0x7f0000000140)='-2 -3 +4\n\x00', 0x9)
r1 = openat(0xffffffffffffff9c, &(0x7f0000000180)='./nfsd/portlist\x00', 0x2, 0x0)
write(r1, &(0x7f00000001c0)='tcp 20000\n\x00', 0xa)
r2 = openat(0xffffffffffffff9c, &(0x7f0000000200)='./nfsd/threads\x00', 0x2, 0x0)
write(r2, &(0x7f0000000240)='1\n\x00', 0x2) (async)
nanosleep(&(0x7f0000000300)={0x2}, 0x0)
nanosleep(&(0x7f0000000300)={0x2}, 0x0)
write(r2, &(0x7f0000000240)='1\n\x00', 0x2)
r3 = socket$inet(0x2, 0x1, 0x0)
connect$inet(r3, &(0x7f0000000280)={0x2, 0x4e20, @loopback}, 0x10)
nanosleep(&(0x7f0000000300)={0x0, 0x2faf080}, 0x0)
r4 = socket$inet(0x2, 0x1, 0x0)
connect$inet(r4, &(0x7f0000000380)={0x2, 0x4e20, @loopback}, 0x10)
nanosleep(&(0x7f0000000300)={0x0, 0x2faf080}, 0x0)

program did not crash
testing program (duration=30s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): socket$inet_tcp-bind$inet-listen-fsopen-fsconfig$FSCONFIG_SET_STRING-fsconfig$FSCONFIG_SET_STRING-fsconfig$FSCONFIG_SET_STRING-fsconfig$FSCONFIG_SET_STRING-fsconfig$FSCONFIG_CMD_CREATE-accept-read-write-nanosleep
detailed listing:
executing program 0:
r0 = socket$inet_tcp(0x2, 0x1, 0x6)
bind$inet(r0, &(0x7f0000000000)={0x2, 0x801, @loopback}, 0x10)
listen(r0, 0x5)
r1 = fsopen(&(0x7f0000000100)='nfs\x00', 0x0)
fsconfig$FSCONFIG_SET_STRING(r1, 0x1, &(0x7f0000000140)='source\x00', &(0x7f0000000180)='127.0.0.1:/export\x00', 0x0)
fsconfig$FSCONFIG_SET_STRING(r1, 0x1, &(0x7f00000001c0)='addr\x00', &(0x7f0000000200)='127.0.0.1\x00', 0x0)
fsconfig$FSCONFIG_SET_STRING(r1, 0x1, &(0x7f0000000240)='port\x00', &(0x7f0000000280)='2049\x00', 0x0)
fsconfig$FSCONFIG_SET_STRING(r1, 0x1, &(0x7f00000002c0)='vers\x00', &(0x7f0000000300)='4.0\x00', 0x0)
fsconfig$FSCONFIG_CMD_CREATE(r1, 0x6, 0x0, 0x0, 0x0) (async)
r2 = accept(r0, 0x0, 0x0)
read(r2, &(0x7f0000000400)=""/256, 0x100)
write(r2, &(0x7f0000000500)="80000100000000000000000100"/36, 0x24)
nanosleep(&(0x7f0000000600)={0x0, 0x5f5e100}, 0x0)

program did not crash
testing program (duration=30s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): socket$nl_generic-syz_genetlink_get_family_id$ethtool-syz_usb_connect-nanosleep-sendmsg$ETHTOOL_MSG_EEE_SET
detailed listing:
executing program 0:
r0 = socket$nl_generic(0x10, 0x3, 0x10)
r1 = syz_genetlink_get_family_id$ethtool(&(0x7f0000000000), r0)
syz_usb_connect(0x0, 0x39, &(0x7f0000000040)=ANY=[@ANYBLOB="12010002ffffff40950b901700010102030109022700010100a0320904000003ffff0000070581031000080705820200020007050302000200"], 0x0)
nanosleep(&(0x7f0000000200)={0x2}, 0x0)
sendmsg$ETHTOOL_MSG_EEE_SET(r0, &(0x7f0000000080)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000100)={0x34, r1, 0x1, 0x0, 0x0, {}, [@ETHTOOL_A_EEE_HEADER={0xc, 0x1, 0x0, 0x1, [@ETHTOOL_A_HEADER_DEV_INDEX={0x8, 0x1, 0x2}]}, @ETHTOOL_A_EEE_MODES_OURS={0x14, 0x2, 0x0, 0x1, [@ETHTOOL_A_BITSET_BITS={0x10, 0x3, 0x0, 0x1, [{0xc, 0x1, 0x0, 0x1, [@ETHTOOL_A_BITSET_BIT_INDEX={0x8}]}]}]}]}, 0x34}}, 0x0)

program did not crash
testing program (duration=30s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): socket$nl_netfilter-sendmsg$NFNL_MSG_CTHELPER_NEW-socket$inet_tcp-bind$inet-listen-socket$inet_tcp-connect$inet-accept-sendto$inet-sendto$inet-sendto$inet-sendto$inet
detailed listing:
executing program 0:
r0 = socket$nl_netfilter(0x10, 0x3, 0xc)
sendmsg$NFNL_MSG_CTHELPER_NEW(r0, &(0x7f0000000040), 0x0)
r1 = socket$inet_tcp(0x2, 0x1, 0x0)
bind$inet(r1, &(0x7f0000000200)={0x2, 0xbb06, @empty}, 0x10)
listen(r1, 0x5)
r2 = socket$inet_tcp(0x2, 0x1, 0x0)
connect$inet(r2, &(0x7f0000000220)={0x2, 0xbb06, @loopback}, 0x10)
r3 = accept(r1, 0x0, 0x0)
sendto$inet(r2, &(0x7f0000000300)="009c00011a2b3c4d0001000001000000000000010000000100010001", 0x1c, 0x0, 0x0, 0x0)
sendto$inet(r3, &(0x7f0000000400)="009c00011a2b3c4d0002000001000100000000010000000100010001", 0x1c, 0x0, 0x0, 0x0)
sendto$inet(r2, &(0x7f0000000500)="00a800011a2b3c4d0007000012340001000000010000000100010001000100000000", 0x22, 0x0, 0x0, 0x0)
sendto$inet(r3, &(0x7f0000000600)="002000011a2b3c4d00080000567812340100"/32, 0x20, 0x0, 0x0, 0x0)

program did not crash
single: failed to extract reproducer
bisect: bisecting 30 programs with base timeout 30s
testing program (duration=37s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): [6, 3, 38, 2, 14, 12, 2, 8, 14, 4, 3, 5, 10, 4, 5, 4, 12, 4, 5, 5, 13, 20, 10, 14, 17, 5, 7, 7, 13, 6]
detailed listing:
executing program 2:
r0 = syz_open_procfs$namespace(0x0, &(0x7f0000000000)='ns/net\x00')
setns(r0, 0x40000000)
r1 = syz_open_procfs(0x0, &(0x7f0000000100)='net/dev\x00')
read(r1, &(0x7f0000000200), 0x1000)
r2 = socket$inet(0x2, 0x2, 0x0)
ioctl$sock_SIOCETHTOOL(r2, 0x8946, &(0x7f0000000300)={'lo\x00', &(0x7f0000000400)=@ethtool_eeprom={0xb, 0x0, 0x0, 0x10, '\x00'/16}})
executing program 2:
r0 = socket$nl_route(0x10, 0x3, 0x0)
ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000100)={'lo\x00', <r1=>0x0})
sendmsg$nl_route_sched(r0, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000080)={&(0x7f00000000c0)=@newqdisc={0x3c, 0x24, 0x601, 0x1, 0x0, {0x0, 0x0, 0x0, r1, {}, {0xffff, 0xffff}}, [@TCA_INGRESS_BLOCK={0x8, 0x0, 0x1}]}}}, 0x0)
executing program 2:
r0 = socket$nl_route(0x10, 0x3, 0x0)
write(r0, &(0x7f0000000000)="600000001800050601000000000000000a400000fe040001000000001400010020010db800010000000000000000000108000400010000000600150003000000200016800c0001001234567890abcdef05000800010000000500070002000000", 0x60)
write(r0, &(0x7f0000000000)="600000001800050601000000000000000a400000fe040001000000001400010020010db800020000000000000000000108000400010000000600150003000000200016800c0001001234567890abcdef05000800010000000500070002000000", 0x60)
write(r0, &(0x7f0000000000)="600000001800050601000000000000000a400000fe040001000000001400010020010db800030000000000000000000108000400010000000600150003000000200016800c0001001234567890abcdef05000800010000000500070002000000", 0x60)
write(r0, &(0x7f0000000000)="600000001800050601000000000000000a400000fe040001000000001400010020010db800040000000000000000000108000400010000000600150003000000200016800c0001001234567890abcdef05000800010000000500070002000000", 0x60)
write(r0, &(0x7f0000000000)="600000001800050601000000000000000a400000fe040001000000001400010020010db800050000000000000000000108000400010000000600150003000000200016800c0001001234567890abcdef05000800010000000500070002000000", 0x60)
write(r0, &(0x7f0000000000)="600000001800050601000000000000000a400000fe040001000000001400010020010db800060000000000000000000108000400010000000600150003000000200016800c0001001234567890abcdef05000800010000000500070002000000", 0x60)
write(r0, &(0x7f0000000000)="600000001800050601000000000000000a400000fe040001000000001400010020010db800070000000000000000000108000400010000000600150003000000200016800c0001001234567890abcdef05000800010000000500070002000000", 0x60)
write(r0, &(0x7f0000000000)="600000001800050601000000000000000a400000fe040001000000001400010020010db800080000000000000000000108000400010000000600150003000000200016800c0001001234567890abcdef05000800010000000500070002000000", 0x60)
write(r0, &(0x7f0000000000)="600000001800050601000000000000000a400000fe040001000000001400010020010db800090000000000000000000108000400010000000600150003000000200016800c0001001234567890abcdef05000800010000000500070002000000", 0x60)
write(r0, &(0x7f0000000000)="600000001800050601000000000000000a400000fe040001000000001400010020010db8000a0000000000000000000108000400010000000600150003000000200016800c0001001234567890abcdef05000800010000000500070002000000", 0x60)
write(r0, &(0x7f0000000000)="600000001800050601000000000000000a400000fe040001000000001400010020010db8000b0000000000000000000108000400010000000600150003000000200016800c0001001234567890abcdef05000800010000000500070002000000", 0x60)
write(r0, &(0x7f0000000000)="600000001800050601000000000000000a400000fe040001000000001400010020010db8000c0000000000000000000108000400010000000600150003000000200016800c0001001234567890abcdef05000800010000000500070002000000", 0x60)
write(r0, &(0x7f0000000000)="600000001800050601000000000000000a400000fe040001000000001400010020010db8000d0000000000000000000108000400010000000600150003000000200016800c0001001234567890abcdef05000800010000000500070002000000", 0x60)
write(r0, &(0x7f0000000000)="600000001800050601000000000000000a400000fe040001000000001400010020010db8000e0000000000000000000108000400010000000600150003000000200016800c0001001234567890abcdef05000800010000000500070002000000", 0x60)
write(r0, &(0x7f0000000000)="600000001800050601000000000000000a400000fe040001000000001400010020010db8000f0000000000000000000108000400010000000600150003000000200016800c0001001234567890abcdef05000800010000000500070002000000", 0x60)
write(r0, &(0x7f0000000000)="600000001800050601000000000000000a400000fe040001000000001400010020010db800100000000000000000000108000400010000000600150003000000200016800c0001001234567890abcdef05000800010000000500070002000000", 0x60)
write(r0, &(0x7f0000000000)="600000001800050601000000000000000a400000fe040001000000001400010020010db800110000000000000000000108000400010000000600150003000000200016800c0001001234567890abcdef05000800010000000500070002000000", 0x60)
write(r0, &(0x7f0000000000)="600000001800050601000000000000000a400000fe040001000000001400010020010db800120000000000000000000108000400010000000600150003000000200016800c0001001234567890abcdef05000800010000000500070002000000", 0x60)
write(r0, &(0x7f0000000000)="600000001800050601000000000000000a400000fe040001000000001400010020010db800130000000000000000000108000400010000000600150003000000200016800c0001001234567890abcdef05000800010000000500070002000000", 0x60)
write(r0, &(0x7f0000000000)="600000001800050601000000000000000a400000fe040001000000001400010020010db800140000000000000000000108000400010000000600150003000000200016800c0001001234567890abcdef05000800010000000500070002000000", 0x60)
write(r0, &(0x7f0000000000)="600000001800050601000000000000000a400000fe040001000000001400010020010db800150000000000000000000108000400010000000600150003000000200016800c0001001234567890abcdef05000800010000000500070002000000", 0x60)
write(r0, &(0x7f0000000000)="600000001800050601000000000000000a400000fe040001000000001400010020010db800160000000000000000000108000400010000000600150003000000200016800c0001001234567890abcdef05000800010000000500070002000000", 0x60)
write(r0, &(0x7f0000000000)="600000001800050601000000000000000a400000fe040001000000001400010020010db800170000000000000000000108000400010000000600150003000000200016800c0001001234567890abcdef05000800010000000500070002000000", 0x60)
write(r0, &(0x7f0000000000)="600000001800050601000000000000000a400000fe040001000000001400010020010db800180000000000000000000108000400010000000600150003000000200016800c0001001234567890abcdef05000800010000000500070002000000", 0x60)
write(r0, &(0x7f0000000000)="600000001800050601000000000000000a400000fe040001000000001400010020010db800190000000000000000000108000400010000000600150003000000200016800c0001001234567890abcdef05000800010000000500070002000000", 0x60)
write(r0, &(0x7f0000000000)="600000001800050601000000000000000a400000fe040001000000001400010020010db8001a0000000000000000000108000400010000000600150003000000200016800c0001001234567890abcdef05000800010000000500070002000000", 0x60)
write(r0, &(0x7f0000000000)="600000001800050601000000000000000a400000fe040001000000001400010020010db8001b0000000000000000000108000400010000000600150003000000200016800c0001001234567890abcdef05000800010000000500070002000000", 0x60)
write(r0, &(0x7f0000000000)="600000001800050601000000000000000a400000fe040001000000001400010020010db8001c0000000000000000000108000400010000000600150003000000200016800c0001001234567890abcdef05000800010000000500070002000000", 0x60)
write(r0, &(0x7f0000000000)="600000001800050601000000000000000a400000fe040001000000001400010020010db8001d0000000000000000000108000400010000000600150003000000200016800c0001001234567890abcdef05000800010000000500070002000000", 0x60)
write(r0, &(0x7f0000000000)="600000001800050601000000000000000a400000fe040001000000001400010020010db8001e0000000000000000000108000400010000000600150003000000200016800c0001001234567890abcdef05000800010000000500070002000000", 0x60)
write(r0, &(0x7f0000000000)="600000001800050601000000000000000a400000fe040001000000001400010020010db8001f0000000000000000000108000400010000000600150003000000200016800c0001001234567890abcdef05000800010000000500070002000000", 0x60)
write(r0, &(0x7f0000000000)="600000001800050601000000000000000a400000fe040001000000001400010020010db800200000000000000000000108000400010000000600150003000000200016800c0001001234567890abcdef05000800010000000500070002000000", 0x60)
write(r0, &(0x7f0000000000)="600000001800050601000000000000000a400000fe040001000000001400010020010db800210000000000000000000108000400010000000600150003000000200016800c0001001234567890abcdef05000800010000000500070002000000", 0x60)
write(r0, &(0x7f0000000000)="600000001800050601000000000000000a400000fe040001000000001400010020010db800220000000000000000000108000400010000000600150003000000200016800c0001001234567890abcdef05000800010000000500070002000000", 0x60)
write(r0, &(0x7f0000000000)="600000001800050601000000000000000a400000fe040001000000001400010020010db800230000000000000000000108000400010000000600150003000000200016800c0001001234567890abcdef05000800010000000500070002000000", 0x60)
write(r0, &(0x7f0000000200)="1c0000001a00010103000000000000000a00"/28, 0x1c)
recvmsg(r0, &(0x7f0000000100)={0x0, 0x0, &(0x7f0000000200)=[{&(0x7f0000000300)=""/4096, 0x1000}], 0x1}, 0x0)
executing program 2:
r0 = socket$nl_route(0x10, 0x3, 0x0)
sendmsg$nl_route(r0, &(0x7f0000000000)={&(0x7f0000000040), 0x10, &(0x7f0000000100)={&(0x7f0000000200)=@newlink={0x0, 0x10, 0x1, 0x0, 0x0, {0x0, 0x0, 0x0, 0x0, 0x100, 0x100}}}}, 0x0)
executing program 2:
mkdirat(0xffffffffffffff9c, &(0x7f0000000100)='./debug\x00', 0x1ff)
mount(0x0, &(0x7f0000000100)='./debug\x00', &(0x7f0000000140)='debugfs\x00', 0x0, 0x0)
mkdirat(0xffffffffffffff9c, &(0x7f0000000600)='./file0\x00', 0x1ff)
pipe2$9p(&(0x7f0000000000)={<r0=>0x0, <r1=>0x0}, 0x0)
r2 = openat(0xffffffffffffff9c, &(0x7f0000000200)='./debug/failslab/probability\x00', 0x1, 0x0)
write(r2, &(0x7f0000000300)='100\x00', 0x4)
r3 = openat(0xffffffffffffff9c, &(0x7f0000000400)='./debug/failslab/times\x00', 0x1, 0x0)
write(r3, &(0x7f0000000500)='100\x00', 0x4)
syz_clone(0x11, 0x0, 0x0, 0x0, 0x0, 0x0)
mount$9p_fd(0x0, &(0x7f0000000600)='./file0\x00', &(0x7f0000000700), 0x0, &(0x7f0000000800)={'trans=fd,', {'rfdno', 0x3d, r0}, 0x2c, {'wfdno', 0x3d, r1}, 0x2c, {[{@version_9p2000}, {@msize={'msize', 0x3d, 0x1000}}]}})
write$P9_RVERSION(r1, &(0x7f0000000900)={0x13, 0x65, 0xffff, 0x1000, 0x6, '9P2000'}, 0x13)
write$P9_RATTACH(r1, &(0x7f0000000a00)={0x13, 0x69, 0x1}, 0x13)
write$P9_RSTAT(r1, &(0x7f0000000b00)={0x0, 0x77, 0x1}, 0x13)
openat(0xffffffffffffff9c, &(0x7f0000000600)='./file0\x00', 0x0, 0x0)
executing program 2:
r0 = socket$nl_netfilter(0x10, 0x3, 0xc)
sendmsg$NFNL_MSG_CTHELPER_NEW(r0, &(0x7f0000000040), 0x0)
r1 = socket$inet_tcp(0x2, 0x1, 0x0)
bind$inet(r1, &(0x7f0000000200)={0x2, 0xbb06, @empty}, 0x10)
listen(r1, 0x5)
r2 = socket$inet_tcp(0x2, 0x1, 0x0)
connect$inet(r2, &(0x7f0000000220)={0x2, 0xbb06, @loopback}, 0x10)
r3 = accept(r1, 0x0, 0x0)
sendto$inet(r2, &(0x7f0000000300)="009c00011a2b3c4d0001000001000000000000010000000100010001", 0x1c, 0x0, 0x0, 0x0)
sendto$inet(r3, &(0x7f0000000400)="009c00011a2b3c4d0002000001000100000000010000000100010001", 0x1c, 0x0, 0x0, 0x0)
sendto$inet(r2, &(0x7f0000000500)="00a800011a2b3c4d0007000012340001000000010000000100010001000100000000", 0x22, 0x0, 0x0, 0x0)
sendto$inet(r3, &(0x7f0000000600)="002000011a2b3c4d00080000567812340100"/32, 0x20, 0x0, 0x0, 0x0)
executing program 4:
r0 = socket$inet6_udp(0xa, 0x2, 0x11)
setsockopt$IP6T_SO_SET_REPLACE(r0, 0x29, 0x40, &(0x7f0000000000)=@mangle={'mangle\x00', 0x1d, 0x6, 0x660, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x6, &(0x7f00000006c0), {[{{@uncond, 0x0, 0xa8, 0xd0}, @common=@unspec=@NFQUEUE2={0x28, 'NFQUEUE\x00', 0x2, {0x0, 0x5}}}, {{@ipv6={@mcast1, @local, [], [], 'macvtap0\x00', 'ip6tnl0\x00', {}, {}, 0x11}, 0x0, 0xa8, 0xe8}, @inet=@TPROXY1={0x40, 'TPROXY\x00', 0x1, {0x0, 0x0, @ipv4=@broadcast}}}, {{@ipv6={@mcast2, @loopback, [], [], 'veth0_to_team\x00', 'syzkaller0\x00', {}, {}, 0x0, 0x0, 0x0, 0x24}, 0x0, 0x108, 0x130, 0x0, {}, [@common=@unspec=@time={{0x38}, {0x100, 0x8, 0xb34f, 0x57c1, 0xffff, 0x6}}, @common=@inet=@socket1={{0x28}}]}, @common=@unspec=@MARK={0x28}}, {{@uncond, 0x0, 0x108, 0x130, 0x0, {}, [@common=@frag={{0x30}}, @common=@ah={{0x30}, {[0x4d2, 0x4d4], 0x6, 0x2, 0x2}}]}, @inet=@DSCP={0x28}}, {{@uncond, 0x0, 0x138, 0x178, 0x0, {}, [@common=@dst={{0x48}}, @common=@dst={{0x48}}]}, @inet=@TPROXY1={0x40, 'TPROXY\x00', 0x1, {0x0, 0x0, @ipv4=@dev}}}], {{'\x00', 0x0, 0xa8, 0xd0}, {0x28}}}}, 0x6c0)
executing program 4:
r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000240), 0x2, 0x0)
ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000040)={'syzkaller0\x00', 0x1001})
r1 = socket$nl_route(0x10, 0x3, 0x0)
ioctl$sock_SIOCGIFINDEX(r1, 0x8933, &(0x7f0000000100)={'syzkaller0\x00', <r2=>0x0})
ioctl$sock_inet_SIOCSIFFLAGS(r1, 0x8914, &(0x7f0000000100)={'syzkaller0\x00', 0x1})
sendmsg$nl_route_sched(r1, &(0x7f00000000c0)={&(0x7f0000000000), 0x0, &(0x7f0000000140)={&(0x7f0000000180)=@newqdisc={0x30, 0x24, 0x401, 0x0, 0x0, {0x0, 0x0, 0x0, r2, {0x0, 0xffff}, {0xffff, 0xffff}}, [@qdisc_kind_options=@q_ingress={0xc}]}, 0x30}}, 0x0)
sendmsg$nl_route_sched(r1, &(0x7f00000001c0)={&(0x7f0000000000), 0x0, &(0x7f0000000200)={&(0x7f0000000340)=@newtfilter={0x94, 0x2c, 0x401, 0x0, 0x0, {0x0, 0x0, 0x0, r2, {0x1}, {0x300}}, [@filter_kind_options=@f_matchall={{0xd}, {0x60, 0x2, [@TCA_MATCHALL_ACT={0x5c, 0x1, [@m_nat={0x58, 0x1, 0x0, 0x0, {{0x8}, {0x2c, 0x2, 0x0, 0x1, [@TCA_NAT_PARMS={0x28, 0x1, {{}, @private=0xa010101, @private=0xa010102}}]}, {0x7, 0x3, "001122"}, {0xc, 0x4}, {0xc, 0x5}}}]}]}}]}, 0x94}}, 0x0)
write(r0, &(0x7f0000000300)="4500001c00010000400100000a0000010a0000020800f7ff00000000", 0x1c)
executing program 4:
mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./nfsd\x00', 0x1ff)
mount(0x0, &(0x7f0000000000)='./nfsd\x00', &(0x7f0000000100)='nfsd\x00', 0x0, 0x0)
r0 = openat(0xffffffffffffff9c, &(0x7f0000000000)='./nfsd/portlist\x00', 0x1, 0x0)
write(r0, &(0x7f0000000300)='+tcp\n\x00', 0x5)
r1 = openat(0xffffffffffffff9c, &(0x7f0000000000)='./nfsd/threads\x00', 0x1, 0x0)
write(r1, &(0x7f0000000100)='1\n\x00', 0x2)
r2 = socket$inet_tcp(0x2, 0x1, 0x6)
bind$inet(r2, &(0x7f0000000200)={0x2, 0x8008, @loopback}, 0x10)
listen(r2, 0x5)
r3 = socket$inet_tcp(0x2, 0x1, 0x6)
connect$inet(r3, &(0x7f0000000200)={0x2, 0x8008, @loopback}, 0x10)
write(r3, &(0x7f0000000400)="80000028123456780000000000000002000186a300000003000000000000000700"/44, 0x2c)
r4 = socket$nl_generic(0x10, 0x3, 0x10)
sendmsg$nl_generic(r4, &(0x7f0000000600)={0x0, 0x0, &(0x7f0000000700)={&(0x7f0000000800)={0x14, 0x10, 0x1, 0x0, 0x0, {0x1}}, 0x14}}, 0x0)
executing program 4:
r0 = socket$nl_route(0x10, 0x3, 0x0)
sendmsg$nl_route(r0, &(0x7f0000000100)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000010)=@newnexthop={0x24, 0x68, 0x601, 0x0, 0x0, {}, [@NHA_ID={0x8, 0x1, 0x1}, @NHA_BLACKHOLE={0x4}]}, 0x24}}, 0x0)
sendmsg$nl_route(r0, &(0x7f0000000100)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000010)=@newnexthop={0x2c, 0x68, 0x601, 0x0, 0x0, {}, [@NHA_ID={0x8, 0x1, 0x2}, @NHA_GROUP={0xc, 0x2, [{0x1, 0x1}]}]}, 0x2c}}, 0x0)
sendmsg$nl_route(r0, &(0x7f0000000100)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000010)=@getnexthop={0x20, 0x6a, 0x1, 0x0, 0x0, {}, [@NHA_ID={0x8, 0x1, 0x2}]}, 0x20}}, 0x0)
executing program 4:
unshare(0x50000000)
unshare(0x50000000)
nanosleep(&(0x7f0000000000)={0x0, 0x5f5e100}, 0x0)
executing program 4:
r0 = socket$nl_generic(0x10, 0x3, 0x10)
r1 = syz_genetlink_get_family_id$ethtool(&(0x7f0000000000), r0)
syz_usb_connect(0x0, 0x39, &(0x7f0000000040)=ANY=[@ANYBLOB="12010002ffffff40950b901700010102030109022700010100a0320904000003ffff0000070581031000080705820200020007050302000200"], 0x0)
nanosleep(&(0x7f0000000200)={0x2}, 0x0)
sendmsg$ETHTOOL_MSG_EEE_SET(r0, &(0x7f0000000080)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000100)={0x34, r1, 0x1, 0x0, 0x0, {}, [@ETHTOOL_A_EEE_HEADER={0xc, 0x1, 0x0, 0x1, [@ETHTOOL_A_HEADER_DEV_INDEX={0x8, 0x1, 0x2}]}, @ETHTOOL_A_EEE_MODES_OURS={0x14, 0x2, 0x0, 0x1, [@ETHTOOL_A_BITSET_BITS={0x10, 0x3, 0x0, 0x1, [{0xc, 0x1, 0x0, 0x1, [@ETHTOOL_A_BITSET_BIT_INDEX={0x8}]}]}]}]}, 0x34}}, 0x0)
executing program 1:
r0 = socket$inet_tcp(0x2, 0x1, 0x0)
bind$inet(r0, &(0x7f0000000000)={0x2, 0x208, @loopback}, 0x10)
listen(r0, 0x5)
r1 = fsopen(&(0x7f0000000100)='nfs\x00', 0x0)
fsconfig$FSCONFIG_SET_STRING(r1, 0x1, &(0x7f0000000140)='addr\x00', &(0x7f0000000180)='127.0.0.1\x00', 0x0)
fsconfig$FSCONFIG_SET_STRING(r1, 0x1, &(0x7f00000001c0)='source\x00', &(0x7f0000000200)='127.0.0.1:/export\x00', 0x0)
fsconfig$FSCONFIG_SET_STRING(r1, 0x1, &(0x7f0000000240)='vers\x00', &(0x7f0000000280)='3\x00', 0x0)
fsconfig$FSCONFIG_SET_STRING(r1, 0x1, &(0x7f00000002c0)='mountport\x00', &(0x7f0000000300)='2049\x00', 0x0)
fsconfig$FSCONFIG_CMD_CREATE(r1, 0x6, 0x0, 0x0, 0x0) (async)
accept4(r0, &(0x7f0000000400)=@in={0x2, 0x0, @loopback}, &(0x7f0000000500)=0x10, 0x0)
executing program 3:
r0 = userfaultfd(0x1)
mmap(&(0x7f0000800000)=nil, 0x1000, 0x3, 0x32, 0xffffffff, 0x0)
ioctl$UFFDIO_API(r0, 0xc018aa3f, &(0x7f0000000100))
ioctl$UFFDIO_REGISTER(r0, 0xc020aa00, &(0x7f0000000200)={{0xffffffffffffffff, 0x1000}, 0x2})
executing program 3:
r0 = socket$netlink(0x10, 0x3, 0xc)
sendmsg$NFQNL_MSG_CONFIG(r0, &(0x7f0000000100)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000300)={0x28, 0x2, 0x3, 0x0, 0x0, 0x0, {0x2}, [@NFQA_CFG_CMD={0x8, 0x1, {0x1, 0x0, 0x2}}, @NFQA_CFG_PARAMS={0x9, 0x2, {0xffff, 0x2}}]}, 0x28}}, 0x0)
r1 = socket$inet_udp(0x2, 0x2, 0x0)
setsockopt$IPT_SO_SET_REPLACE(r1, 0x0, 0x40, &(0x7f0000000a00)=@filter={'filter\x00', 0xe, 0x4, 0x248, 0xffffffff, 0x0, 0x98, 0x128, 0xffffffff, 0xffffffff, 0x1b8, 0x1b8, 0x1b8, 0xffffffff, 0x4, 0x0, {[{{@uncond, 0x0, 0x70, 0x98}, @common=@unspec=@NFQUEUE3={0x28, 'NFQUEUE\x00', 0x3, {0x0, 0x1}}}, {{@uncond, 0x0, 0x70, 0x90}, @common=@unspec=@STANDARD={0x20, '\x00', 0x0, 0xfffffffe}}, {{@uncond, 0x0, 0x70, 0x90}, @common=@unspec=@STANDARD={0x20, '\x00', 0x0, 0xfffffffe}}], {{'\x00', 0x0, 0x70, 0x90}, {0x20}}}}, 0x0)
sendto$inet(r1, &(0x7f0000000500)="00010203040506070809", 0xa, 0x0, &(0x7f0000000600)={0x2, 0x1234, @loopback}, 0x10)
executing program 3:
r0 = socket$netlink(0x10, 0x3, 0x0)
write(r0, &(0x7f0000000000)="580000001800050401000000000000000a800000fe040002000000001400010020010db800000000000000000000000106001500070000001800160008000100010000000c000b0008000100020000000800040001000000", 0x58)
syz_emit_ethernet(0x6a, &(0x7f0000000200)=ANY=[@ANYBLOB="aaaaaaaaaaaaaaaaaaaa86dd6000000000342b4020010db800000000000000000000000220010db8000000000000000000000001110404010100000020010db800000000000000000000000320010db800000000000000000000000430393039000c0000deadbeef"], 0x0)
nanosleep(&(0x7f0000000300)={0x0, 0x2faf080}, 0x0)
executing program 3:
r0 = socket$inet6_tcp(0xa, 0x1, 0x0)
bind$inet6(r0, &(0x7f0000000000)={0xa, 0x4e22, 0x0, @local, 0x6}, 0x1c)
r1 = socket$inet6_tcp(0xa, 0x1, 0x0)
bind$inet6(r1, &(0x7f0000000000)={0xa, 0x4e23, 0x0, @local, 0x7}, 0x1c)
r2 = socket$inet6_tcp(0xa, 0x1, 0x0)
bind$inet6(r2, &(0x7f0000000000)={0xa, 0x4e24, 0x0, @local, 0x8}, 0x1c)
r3 = socket$inet6_tcp(0xa, 0x1, 0x0)
bind$inet6(r3, &(0x7f0000000000)={0xa, 0x4e25, 0x0, @local, 0x9}, 0x1c)
r4 = socket$inet6_tcp(0xa, 0x1, 0x0)
bind$inet6(r4, &(0x7f0000000000)={0xa, 0x4e26, 0x0, @local, 0xa}, 0x1c)
r5 = socket$inet6_tcp(0xa, 0x1, 0x0)
bind$inet6(r5, &(0x7f0000000000)={0xa, 0x4e27, 0x0, @local, 0xb}, 0x1c)
executing program 0:
r0 = fsopen(&(0x7f0000000000)='nfs\x00', 0x0)
fsconfig$FSCONFIG_SET_STRING(r0, 0x1, &(0x7f0000000040)='addr\x00', &(0x7f0000000080)='127.0.0.1\x00', 0x0)
fsconfig$FSCONFIG_SET_STRING(r0, 0x1, &(0x7f0000000140)='port\x00', &(0x7f0000000180)='0\x00', 0x0)
fsconfig$FSCONFIG_CMD_CREATE(r0, 0x6, 0x0, 0x0, 0x0)
executing program 3:
r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000000), 0x2, 0x0)
ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000100)={'\x00', 0x402})
r1 = socket$inet(0x2, 0x2, 0x0)
ioctl$sock_inet_SIOCSIFFLAGS(r1, 0x8914, &(0x7f0000000300)={'\x00', 0x1})
write$tun(r0, &(0x7f0000000200)={@void, @val={0x1, 0x1, 0x14, 0x10, 0x0, 0xe}, @eth={@broadcast, @broadcast, @void, {@generic={0x8847, "000001ff4500002800004000400600007f0000017f0000010050005000000000000000005002200000000000"}}}}, 0x60)
executing program 0:
r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000000), 0x2, 0x0)
ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000100)={'syz_tun\x00', 0x1001})
r1 = socket$nl_route(0x10, 0x3, 0x0)
sendmsg$nl_route(r1, &(0x7f00000000c0)={&(0x7f0000000000), 0x0, &(0x7f0000000140)={&(0x7f0000000180)=ANY=[@ANYBLOB="300000001800010600000000000000002d0100000000000100000000050001000a0000000c000500010000000c000000300000001800010600000000000000002d0100000000000100000000050001000b0000000c000500010000000c000000300000001800010600000000000000002d0100000000000100000000050001000c0000000c000500010000000c000000300000001800010600000000000000002d0100000000000100000000050001000d0000000c000500010000000c000000"], 0xc0}}, 0x0)
sendmsg$nl_route(r1, &(0x7f0000000240)={&(0x7f0000000000), 0x0, &(0x7f0000000280)={&(0x7f00000002c0)=ANY=[@ANYBLOB="1c0000001a00010301000000000000002d00"/28], 0x1c}}, 0x0)
executing program 3:
r0 = socket$inet_tcp(0x2, 0x1, 0x6)
bind$inet(r0, &(0x7f0000000000)={0x2, 0x801, @loopback}, 0x10)
listen(r0, 0x5)
r1 = fsopen(&(0x7f0000000100)='nfs\x00', 0x0)
fsconfig$FSCONFIG_SET_STRING(r1, 0x1, &(0x7f0000000140)='source\x00', &(0x7f0000000180)='127.0.0.1:/export\x00', 0x0)
fsconfig$FSCONFIG_SET_STRING(r1, 0x1, &(0x7f00000001c0)='addr\x00', &(0x7f0000000200)='127.0.0.1\x00', 0x0)
fsconfig$FSCONFIG_SET_STRING(r1, 0x1, &(0x7f0000000240)='port\x00', &(0x7f0000000280)='2049\x00', 0x0)
fsconfig$FSCONFIG_SET_STRING(r1, 0x1, &(0x7f00000002c0)='vers\x00', &(0x7f0000000300)='4.0\x00', 0x0)
fsconfig$FSCONFIG_CMD_CREATE(r1, 0x6, 0x0, 0x0, 0x0) (async)
r2 = accept(r0, 0x0, 0x0)
read(r2, &(0x7f0000000400)=""/256, 0x100)
write(r2, &(0x7f0000000500)="80000100000000000000000100"/36, 0x24)
nanosleep(&(0x7f0000000600)={0x0, 0x5f5e100}, 0x0)
executing program 0:
mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./nfsd\x00', 0x1ff)
mount(&(0x7f0000000040)=@filename='nfsd\x00', &(0x7f0000000080)='./nfsd\x00', &(0x7f00000000c0)='nfsd\x00', 0x0, 0x0)
r0 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./nfsd/versions\x00', 0x1, 0x0)
write(r0, &(0x7f0000000180)='-2 -3 -4\n\x00', 0x9)
r1 = socket$inet(0x2, 0x1, 0x6)
bind$inet(r1, &(0x7f0000000200)={0x2, 0x0, @empty}, 0x10)
listen(r1, 0x5)
r2 = openat(0xffffffffffffff9c, &(0x7f0000000280)='./nfsd/portlist\x00', 0x1, 0x0)
write(r2, &(0x7f0000000300)='4\n\x00', 0x2)
write(r0, &(0x7f0000000380)='+3 +4\n\x00', 0x6)
r3 = openat(0xffffffffffffff9c, &(0x7f0000000400)='./nfsd/threads\x00', 0x1, 0x0)
write(r3, &(0x7f0000000500)='1\n\x00', 0x2)
mkdirat(0xffffffffffffff9c, &(0x7f0000000600)='./proc\x00', 0x1ff)
mount(&(0x7f0000000040)=@filename='proc\x00', &(0x7f0000000600)='./proc\x00', &(0x7f0000000640)='proc\x00', 0x0, 0x0)
r4 = openat(0xffffffffffffff9c, &(0x7f0000000680)='./proc/net/rpc/auth.rpcsec.context/channel\x00', 0x1, 0x0)
write(r4, &(0x7f0000000700)='\\x01000000 2147483647 0 0 0 krb5 \\x00000000ffffff7f00000000000000001100000000000000000000000000000000000000 root\n\x00', 0x61)
r5 = socket$inet(0x2, 0x1, 0x6)
connect$inet(r5, &(0x7f0000000800)={0x2, 0x0, @empty}, 0x10)
write(r5, &(0x7f0000000900)="123456780000000000000002000186a300000003000000000000000600000018000000010000000200000000000000010000000401000000000000060000001c040400ffffffffff00"/92, 0x54)
nanosleep(&(0x7f0000000a00)={0x0, 0x5f5e100}, 0x0)
executing program 0:
r0 = socket$inet6_tcp(0xa, 0x1, 0x6)
bind$inet6(r0, &(0x7f0000000000)={0xa, 0x4e22, 0x0, @empty}, 0x1c)
listen(r0, 0x10)
r1 = socket$inet6_tcp(0xa, 0x1, 0x6)
bind$inet6(r1, &(0x7f0000000080)={0xa, 0x4e23, 0x0, @empty}, 0x1c)
connect$inet6(r1, &(0x7f0000000040)={0xa, 0x4e22, 0x0, @loopback}, 0x1c)
r2 = accept$inet6(r0, 0x0, 0x0)
write(r1, &(0x7f0000000100)='hello', 0x5)
write(r2, &(0x7f0000000140)='world', 0x5)
syz_emit_ethernet(0x4a, &(0x7f0000000200)={@local, @remote, @void, {@ipv6={0x86dd, @tcp={0x0, 0x6, '\x00', 0x14, 0x6, 0xff, @loopback, @loopback, {[], {{0x4e23, 0x4e22, 0x1, 0x1, 0x0, 0x0, 0x5, 0x18, 0x1000}}}}}}}, 0x0)
executing program 0:
mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./nfsd\x00', 0x1ff)
mount(0x0, &(0x7f0000000000)='./nfsd\x00', &(0x7f0000000100)='nfsd\x00', 0x0, 0x0)
r0 = openat(0xffffffffffffff9c, &(0x7f0000000000)='./nfsd/threads\x00', 0x1, 0x0)
write(r0, &(0x7f0000000100)='1\n\x00', 0x2)
r1 = socket$inet_tcp(0x2, 0x1, 0x6)
bind$inet(r1, &(0x7f0000000200)={0x2, 0x8008, @loopback}, 0x10)
listen(r1, 0x5)
r2 = openat(0xffffffffffffff9c, &(0x7f0000000000)='./nfsd/portlist\x00', 0x1, 0x0)
write(r2, &(0x7f0000000300)='3\n\x00', 0x2)
r3 = socket$inet_tcp(0x2, 0x1, 0x6)
connect$inet(r3, &(0x7f0000000200)={0x2, 0x8008, @loopback}, 0x10)
write(r3, &(0x7f0000000400)="80000028123456780000000000000002000186a300000003000000000000000700"/44, 0x2c)
r4 = socket$nl_generic(0x10, 0x3, 0x10)
sendmsg$nl_generic(r4, &(0x7f0000000600)={0x0, 0x0, &(0x7f0000000700)={&(0x7f0000000800)={0x14, 0x10, 0x1, 0x0, 0x0, {0x1}}, 0x14}}, 0x0)
executing program 0:
mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./nfsd\x00', 0x1ff)
mount(&(0x7f0000000040)=@filename='none\x00', &(0x7f0000000080)='./nfsd\x00', &(0x7f00000000c0)='nfsd\x00', 0x0, 0x0)
r0 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./nfsd/versions\x00', 0x2, 0x0)
write(r0, &(0x7f0000000140)='-2 -3 +4\n\x00', 0x9)
r1 = openat(0xffffffffffffff9c, &(0x7f0000000180)='./nfsd/portlist\x00', 0x2, 0x0)
write(r1, &(0x7f00000001c0)='tcp 20000\n\x00', 0xa)
r2 = openat(0xffffffffffffff9c, &(0x7f0000000200)='./nfsd/threads\x00', 0x2, 0x0)
write(r2, &(0x7f0000000240)='1\n\x00', 0x2) (async)
nanosleep(&(0x7f0000000300)={0x2}, 0x0)
nanosleep(&(0x7f0000000300)={0x2}, 0x0)
write(r2, &(0x7f0000000240)='1\n\x00', 0x2)
r3 = socket$inet(0x2, 0x1, 0x0)
connect$inet(r3, &(0x7f0000000280)={0x2, 0x4e20, @loopback}, 0x10)
nanosleep(&(0x7f0000000300)={0x0, 0x2faf080}, 0x0)
r4 = socket$inet(0x2, 0x1, 0x0)
connect$inet(r4, &(0x7f0000000380)={0x2, 0x4e20, @loopback}, 0x10)
nanosleep(&(0x7f0000000300)={0x0, 0x2faf080}, 0x0)
executing program 1:
r0 = socket$nl_route(0x10, 0x3, 0x0)
sendmsg$nl_route(r0, &(0x7f0000000080)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000100)=@newlink={0x50, 0x10, 0x601, 0x0, 0x0, {}, [@IFLA_IFNAME={0x14, 0x3, 'veth1\x00'}, @IFLA_NUM_TX_QUEUES={0x8, 0x1f, 0x4}, @IFLA_LINKINFO={0x14, 0x12, 0x0, 0x1, @veth={{0x9}, {0x4, 0x2, 0x0, 0x1, @void}}}]}, 0x50}}, 0x0)
r1 = socket$inet(0x2, 0x2, 0x0)
ioctl$sock_SIOCGIFINDEX(r1, 0x8933, &(0x7f0000000400)={'veth1\x00', <r2=>0x0})
sendmsg$nl_route_sched(r0, &(0x7f0000000180)={0x0, 0x0, &(0x7f00000001c0)={&(0x7f0000000200)=@newqdisc={0x34, 0x24, 0x601, 0x0, 0x0, {0x0, 0x0, 0x0, r2}, [@qdisc_kind_options=@q_cake={{0x9}, {0x4}}]}, 0x34}}, 0x0)
executing program 1:
r0 = socket$nl_netfilter(0x10, 0x3, 0xc)
sendmsg$NFULNL_MSG_CONFIG(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000000200)={0x1c, 0x1, 0x4, 0x1, 0x0, 0x0, {0x2}, [@NFULA_CFG_CMD={0x5, 0x1, 0x3}]}, 0x1c}}, 0x0)
sendmsg$NFULNL_MSG_CONFIG(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000000200)={0x1c, 0x1, 0x4, 0x1, 0x0, 0x0, {0x2}, [@NFULA_CFG_CMD={0x5, 0x1, 0x1}]}, 0x1c}}, 0x0)
sendmsg$NFULNL_MSG_CONFIG(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000000200)={0x20, 0x1, 0x4, 0x1, 0x0, 0x0, {0x2}, [@NFULA_CFG_MODE={0xa, 0x2, {0xffff, 0x2}}]}, 0x20}}, 0x0)
sendmsg$NFT_BATCH(r0, &(0x7f0000000300)={0x0, 0x0, &(0x7f0000000400)={&(0x7f0000000500)={{0x14, 0x10, 0x1, 0x0, 0x0, {0x2, 0x0, 0x0}}, [@NFT_MSG_NEWTABLE={0x20, 0x0, 0xa, 0x401, 0x0, 0x0, {0x2}, [@NFTA_TABLE_NAME={0x9, 0x1, 'syz0\x00'}]}, @NFT_MSG_NEWCHAIN={0x40, 0x3, 0xa, 0x401, 0x0, 0x0, {0x2}, [@NFTA_CHAIN_TABLE={0x9, 0x1, 'syz0\x00'}, @NFTA_CHAIN_NAME={0x9, 0x3, 'syz0\x00'}, @NFTA_CHAIN_HOOK={0x14, 0x4, 0x0, 0x1, [@NFTA_HOOK_HOOKNUM={0x8, 0x1, 0x1, 0x0, 0x1}, @NFTA_HOOK_PRIORITY={0x8}]}]}, @NFT_MSG_NEWRULE={0x48, 0x6, 0xa, 0x401, 0x0, 0x0, {0x2}, [@NFTA_RULE_TABLE={0x9, 0x1, 'syz0\x00'}, @NFTA_RULE_CHAIN={0x9, 0x2, 'syz0\x00'}, @NFTA_RULE_EXPRESSIONS={0x1c, 0x4, 0x0, 0x1, [{0x18, 0x1, 0x0, 0x1, @log={{0x8}, @val={0xc, 0x2, 0x0, 0x1, [@NFTA_LOG_GROUP={0x6}]}}}]}]}], {0x14, 0x11, 0x1, 0x0, 0x0, {0x2, 0x0, 0x0}}}, 0xd0}}, 0x0)
r1 = socket$inet_udp(0x2, 0x2, 0x0)
sendto$inet(r1, &(0x7f0000000600)="00112233445566778899", 0xa, 0x0, &(0x7f0000000700)={0x2, 0x1234, @loopback}, 0x10)
executing program 1:
r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0)
ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000100)={'syzkaller0\x00', 0x1})
r1 = socket$inet(0x2, 0x2, 0x0)
ioctl$sock_inet_SIOCSIFFLAGS(r1, 0x8914, &(0x7f0000000200)={'syzkaller0\x00', 0x1})
r2 = socket$nl_route(0x10, 0x3, 0x0)
sendmsg$nl_route_sched(r2, &(0x7f0000000300)={0x0, 0x0, &(0x7f0000000400)={&(0x7f0000000500)=@newqdisc={0x30, 0x24, 0x601, 0x0, 0x0, {0x0, 0x0, 0x0, 0x0, {}, {0xf1, 0xff}}, [@qdisc_kind_options=@q_ingress={0xc}]}, 0x30}}, 0x0)
sendmsg$nl_route_sched(r2, &(0x7f0000000600)={0x0, 0x0, &(0x7f0000000700)={&(0x7f0000000800)=@newtfilter={0x6c, 0x2c, 0x601, 0x0, 0x0, {0x0, 0x0, 0x0, 0x0, {}, {0xf1, 0xff}, {0x0, 0x3}}, [@filter_kind_options=@f_matchall={{0xd}, {0x4}}]}, 0x6c}}, 0x0)
executing program 1:
mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./debug\x00', 0x1ed)
mount(&(0x7f0000000040)=@filename='none\x00', &(0x7f0000000080)='./debug\x00', &(0x7f00000000c0)='debugfs\x00', 0x0, 0x0)
r0 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./debug/failslab/probability\x00', 0x1, 0x0)
r1 = openat(0xffffffffffffff9c, &(0x7f0000000180)='./debug/failslab/times\x00', 0x1, 0x0)
r2 = openat(0xffffffffffffff9c, &(0x7f0000000200)='./debug/fail_page_alloc/probability\x00', 0x1, 0x0)
r3 = openat(0xffffffffffffff9c, &(0x7f0000000280)='./debug/fail_page_alloc/times\x00', 0x1, 0x0)
socket$packet(0x11, 0x3, 0x300)
r4 = socket$inet_udp(0x2, 0x2, 0x0)
write(r1, &(0x7f00000001c0)='1000\x00', 0x4)
write(r3, &(0x7f00000002c0)='1000\x00', 0x4)
write(r0, &(0x7f0000000140)='100\x00', 0x3)
write(r2, &(0x7f0000000240)='100\x00', 0x3)
sendto$inet(r4, &(0x7f0000000300)="11223344", 0x4, 0x0, &(0x7f0000000400)={0x2, 0x1234, @loopback}, 0x10)
executing program 1:
r0 = socket$nl_generic(0x10, 0x3, 0x10)
r1 = syz_genetlink_get_family_id$tipc2(&(0x7f0000000000), 0xffffffffffffffff)
r2 = socket$inet_udp(0x2, 0x2, 0x0)
bind$inet(r2, &(0x7f0000000100)={0x2, 0x1f91, @loopback}, 0x10)
sendmsg$TIPC_NL_BEARER_ENABLE(r0, &(0x7f0000000080)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000140)={0x54, r1, 0x1, 0x123, 0x234, {}, [@TIPC_NLA_BEARER={0x40, 0x1, 0x0, 0x1, [@TIPC_NLA_BEARER_NAME={0xd, 0x1, @udp='udp:syz0\x00'}, @TIPC_NLA_BEARER_UDP_OPTS={0x2c, 0x4, {{0x14, 0x1, @in={0x2, 0x1f90, @loopback}}, {0x14, 0x2, @in={0x2, 0x1f91, @loopback}}}}]}]}, 0x54}}, 0x0)
recvfrom$inet(r2, &(0x7f0000000200), 0x100, 0x0, 0x0, 0x0)

program did not crash
replaying the whole log did not cause a kernel crash
single: executing 5 programs separately with timeout 1m40s
testing program (duration=1m40s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): socket$nl_generic-syz_genetlink_get_family_id$tipc2-socket$inet_udp-bind$inet-sendmsg$TIPC_NL_BEARER_ENABLE-recvfrom$inet
detailed listing:
executing program 0:
r0 = socket$nl_generic(0x10, 0x3, 0x10)
r1 = syz_genetlink_get_family_id$tipc2(&(0x7f0000000000), 0xffffffffffffffff)
r2 = socket$inet_udp(0x2, 0x2, 0x0)
bind$inet(r2, &(0x7f0000000100)={0x2, 0x1f91, @loopback}, 0x10)
sendmsg$TIPC_NL_BEARER_ENABLE(r0, &(0x7f0000000080)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000140)={0x54, r1, 0x1, 0x123, 0x234, {}, [@TIPC_NLA_BEARER={0x40, 0x1, 0x0, 0x1, [@TIPC_NLA_BEARER_NAME={0xd, 0x1, @udp='udp:syz0\x00'}, @TIPC_NLA_BEARER_UDP_OPTS={0x2c, 0x4, {{0x14, 0x1, @in={0x2, 0x1f90, @loopback}}, {0x14, 0x2, @in={0x2, 0x1f91, @loopback}}}}]}]}, 0x54}}, 0x0)
recvfrom$inet(r2, &(0x7f0000000200), 0x100, 0x0, 0x0, 0x0)

program did not crash
testing program (duration=1m40s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): mkdirat-mount-openat-write-openat-write-openat-write-nanosleep-nanosleep-write-socket$inet-connect$inet-nanosleep-socket$inet-connect$inet-nanosleep
detailed listing:
executing program 0:
mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./nfsd\x00', 0x1ff)
mount(&(0x7f0000000040)=@filename='none\x00', &(0x7f0000000080)='./nfsd\x00', &(0x7f00000000c0)='nfsd\x00', 0x0, 0x0)
r0 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./nfsd/versions\x00', 0x2, 0x0)
write(r0, &(0x7f0000000140)='-2 -3 +4\n\x00', 0x9)
r1 = openat(0xffffffffffffff9c, &(0x7f0000000180)='./nfsd/portlist\x00', 0x2, 0x0)
write(r1, &(0x7f00000001c0)='tcp 20000\n\x00', 0xa)
r2 = openat(0xffffffffffffff9c, &(0x7f0000000200)='./nfsd/threads\x00', 0x2, 0x0)
write(r2, &(0x7f0000000240)='1\n\x00', 0x2) (async)
nanosleep(&(0x7f0000000300)={0x2}, 0x0)
nanosleep(&(0x7f0000000300)={0x2}, 0x0)
write(r2, &(0x7f0000000240)='1\n\x00', 0x2)
r3 = socket$inet(0x2, 0x1, 0x0)
connect$inet(r3, &(0x7f0000000280)={0x2, 0x4e20, @loopback}, 0x10)
nanosleep(&(0x7f0000000300)={0x0, 0x2faf080}, 0x0)
r4 = socket$inet(0x2, 0x1, 0x0)
connect$inet(r4, &(0x7f0000000380)={0x2, 0x4e20, @loopback}, 0x10)
nanosleep(&(0x7f0000000300)={0x0, 0x2faf080}, 0x0)

program did not crash
testing program (duration=1m40s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): socket$inet_tcp-bind$inet-listen-fsopen-fsconfig$FSCONFIG_SET_STRING-fsconfig$FSCONFIG_SET_STRING-fsconfig$FSCONFIG_SET_STRING-fsconfig$FSCONFIG_SET_STRING-fsconfig$FSCONFIG_CMD_CREATE-accept-read-write-nanosleep
detailed listing:
executing program 0:
r0 = socket$inet_tcp(0x2, 0x1, 0x6)
bind$inet(r0, &(0x7f0000000000)={0x2, 0x801, @loopback}, 0x10)
listen(r0, 0x5)
r1 = fsopen(&(0x7f0000000100)='nfs\x00', 0x0)
fsconfig$FSCONFIG_SET_STRING(r1, 0x1, &(0x7f0000000140)='source\x00', &(0x7f0000000180)='127.0.0.1:/export\x00', 0x0)
fsconfig$FSCONFIG_SET_STRING(r1, 0x1, &(0x7f00000001c0)='addr\x00', &(0x7f0000000200)='127.0.0.1\x00', 0x0)
fsconfig$FSCONFIG_SET_STRING(r1, 0x1, &(0x7f0000000240)='port\x00', &(0x7f0000000280)='2049\x00', 0x0)
fsconfig$FSCONFIG_SET_STRING(r1, 0x1, &(0x7f00000002c0)='vers\x00', &(0x7f0000000300)='4.0\x00', 0x0)
fsconfig$FSCONFIG_CMD_CREATE(r1, 0x6, 0x0, 0x0, 0x0) (async)
r2 = accept(r0, 0x0, 0x0)
read(r2, &(0x7f0000000400)=""/256, 0x100)
write(r2, &(0x7f0000000500)="80000100000000000000000100"/36, 0x24)
nanosleep(&(0x7f0000000600)={0x0, 0x5f5e100}, 0x0)

program did not crash
testing program (duration=1m40s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): socket$nl_generic-syz_genetlink_get_family_id$ethtool-syz_usb_connect-nanosleep-sendmsg$ETHTOOL_MSG_EEE_SET
detailed listing:
executing program 0:
r0 = socket$nl_generic(0x10, 0x3, 0x10)
r1 = syz_genetlink_get_family_id$ethtool(&(0x7f0000000000), r0)
syz_usb_connect(0x0, 0x39, &(0x7f0000000040)=ANY=[@ANYBLOB="12010002ffffff40950b901700010102030109022700010100a0320904000003ffff0000070581031000080705820200020007050302000200"], 0x0)
nanosleep(&(0x7f0000000200)={0x2}, 0x0)
sendmsg$ETHTOOL_MSG_EEE_SET(r0, &(0x7f0000000080)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000100)={0x34, r1, 0x1, 0x0, 0x0, {}, [@ETHTOOL_A_EEE_HEADER={0xc, 0x1, 0x0, 0x1, [@ETHTOOL_A_HEADER_DEV_INDEX={0x8, 0x1, 0x2}]}, @ETHTOOL_A_EEE_MODES_OURS={0x14, 0x2, 0x0, 0x1, [@ETHTOOL_A_BITSET_BITS={0x10, 0x3, 0x0, 0x1, [{0xc, 0x1, 0x0, 0x1, [@ETHTOOL_A_BITSET_BIT_INDEX={0x8}]}]}]}]}, 0x34}}, 0x0)

program did not crash
testing program (duration=1m40s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): socket$nl_netfilter-sendmsg$NFNL_MSG_CTHELPER_NEW-socket$inet_tcp-bind$inet-listen-socket$inet_tcp-connect$inet-accept-sendto$inet-sendto$inet-sendto$inet-sendto$inet
detailed listing:
executing program 0:
r0 = socket$nl_netfilter(0x10, 0x3, 0xc)
sendmsg$NFNL_MSG_CTHELPER_NEW(r0, &(0x7f0000000040), 0x0)
r1 = socket$inet_tcp(0x2, 0x1, 0x0)
bind$inet(r1, &(0x7f0000000200)={0x2, 0xbb06, @empty}, 0x10)
listen(r1, 0x5)
r2 = socket$inet_tcp(0x2, 0x1, 0x0)
connect$inet(r2, &(0x7f0000000220)={0x2, 0xbb06, @loopback}, 0x10)
r3 = accept(r1, 0x0, 0x0)
sendto$inet(r2, &(0x7f0000000300)="009c00011a2b3c4d0001000001000000000000010000000100010001", 0x1c, 0x0, 0x0, 0x0)
sendto$inet(r3, &(0x7f0000000400)="009c00011a2b3c4d0002000001000100000000010000000100010001", 0x1c, 0x0, 0x0, 0x0)
sendto$inet(r2, &(0x7f0000000500)="00a800011a2b3c4d0007000012340001000000010000000100010001000100000000", 0x22, 0x0, 0x0, 0x0)
sendto$inet(r3, &(0x7f0000000600)="002000011a2b3c4d00080000567812340100"/32, 0x20, 0x0, 0x0, 0x0)

program did not crash
single: failed to extract reproducer
bisect: bisecting 30 programs with base timeout 1m40s
testing program (duration=1m47s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): [6, 3, 38, 2, 14, 12, 2, 8, 14, 4, 3, 5, 10, 4, 5, 4, 12, 4, 5, 5, 13, 20, 10, 14, 17, 5, 7, 7, 13, 6]
detailed listing:
executing program 2:
r0 = syz_open_procfs$namespace(0x0, &(0x7f0000000000)='ns/net\x00')
setns(r0, 0x40000000)
r1 = syz_open_procfs(0x0, &(0x7f0000000100)='net/dev\x00')
read(r1, &(0x7f0000000200), 0x1000)
r2 = socket$inet(0x2, 0x2, 0x0)
ioctl$sock_SIOCETHTOOL(r2, 0x8946, &(0x7f0000000300)={'lo\x00', &(0x7f0000000400)=@ethtool_eeprom={0xb, 0x0, 0x0, 0x10, '\x00'/16}})
executing program 2:
r0 = socket$nl_route(0x10, 0x3, 0x0)
ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000100)={'lo\x00', <r1=>0x0})
sendmsg$nl_route_sched(r0, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000080)={&(0x7f00000000c0)=@newqdisc={0x3c, 0x24, 0x601, 0x1, 0x0, {0x0, 0x0, 0x0, r1, {}, {0xffff, 0xffff}}, [@TCA_INGRESS_BLOCK={0x8, 0x0, 0x1}]}}}, 0x0)
executing program 2:
r0 = socket$nl_route(0x10, 0x3, 0x0)
write(r0, &(0x7f0000000000)="600000001800050601000000000000000a400000fe040001000000001400010020010db800010000000000000000000108000400010000000600150003000000200016800c0001001234567890abcdef05000800010000000500070002000000", 0x60)
write(r0, &(0x7f0000000000)="600000001800050601000000000000000a400000fe040001000000001400010020010db800020000000000000000000108000400010000000600150003000000200016800c0001001234567890abcdef05000800010000000500070002000000", 0x60)
write(r0, &(0x7f0000000000)="600000001800050601000000000000000a400000fe040001000000001400010020010db800030000000000000000000108000400010000000600150003000000200016800c0001001234567890abcdef05000800010000000500070002000000", 0x60)
write(r0, &(0x7f0000000000)="600000001800050601000000000000000a400000fe040001000000001400010020010db800040000000000000000000108000400010000000600150003000000200016800c0001001234567890abcdef05000800010000000500070002000000", 0x60)
write(r0, &(0x7f0000000000)="600000001800050601000000000000000a400000fe040001000000001400010020010db800050000000000000000000108000400010000000600150003000000200016800c0001001234567890abcdef05000800010000000500070002000000", 0x60)
write(r0, &(0x7f0000000000)="600000001800050601000000000000000a400000fe040001000000001400010020010db800060000000000000000000108000400010000000600150003000000200016800c0001001234567890abcdef05000800010000000500070002000000", 0x60)
write(r0, &(0x7f0000000000)="600000001800050601000000000000000a400000fe040001000000001400010020010db800070000000000000000000108000400010000000600150003000000200016800c0001001234567890abcdef05000800010000000500070002000000", 0x60)
write(r0, &(0x7f0000000000)="600000001800050601000000000000000a400000fe040001000000001400010020010db800080000000000000000000108000400010000000600150003000000200016800c0001001234567890abcdef05000800010000000500070002000000", 0x60)
write(r0, &(0x7f0000000000)="600000001800050601000000000000000a400000fe040001000000001400010020010db800090000000000000000000108000400010000000600150003000000200016800c0001001234567890abcdef05000800010000000500070002000000", 0x60)
write(r0, &(0x7f0000000000)="600000001800050601000000000000000a400000fe040001000000001400010020010db8000a0000000000000000000108000400010000000600150003000000200016800c0001001234567890abcdef05000800010000000500070002000000", 0x60)
write(r0, &(0x7f0000000000)="600000001800050601000000000000000a400000fe040001000000001400010020010db8000b0000000000000000000108000400010000000600150003000000200016800c0001001234567890abcdef05000800010000000500070002000000", 0x60)
write(r0, &(0x7f0000000000)="600000001800050601000000000000000a400000fe040001000000001400010020010db8000c0000000000000000000108000400010000000600150003000000200016800c0001001234567890abcdef05000800010000000500070002000000", 0x60)
write(r0, &(0x7f0000000000)="600000001800050601000000000000000a400000fe040001000000001400010020010db8000d0000000000000000000108000400010000000600150003000000200016800c0001001234567890abcdef05000800010000000500070002000000", 0x60)
write(r0, &(0x7f0000000000)="600000001800050601000000000000000a400000fe040001000000001400010020010db8000e0000000000000000000108000400010000000600150003000000200016800c0001001234567890abcdef05000800010000000500070002000000", 0x60)
write(r0, &(0x7f0000000000)="600000001800050601000000000000000a400000fe040001000000001400010020010db8000f0000000000000000000108000400010000000600150003000000200016800c0001001234567890abcdef05000800010000000500070002000000", 0x60)
write(r0, &(0x7f0000000000)="600000001800050601000000000000000a400000fe040001000000001400010020010db800100000000000000000000108000400010000000600150003000000200016800c0001001234567890abcdef05000800010000000500070002000000", 0x60)
write(r0, &(0x7f0000000000)="600000001800050601000000000000000a400000fe040001000000001400010020010db800110000000000000000000108000400010000000600150003000000200016800c0001001234567890abcdef05000800010000000500070002000000", 0x60)
write(r0, &(0x7f0000000000)="600000001800050601000000000000000a400000fe040001000000001400010020010db800120000000000000000000108000400010000000600150003000000200016800c0001001234567890abcdef05000800010000000500070002000000", 0x60)
write(r0, &(0x7f0000000000)="600000001800050601000000000000000a400000fe040001000000001400010020010db800130000000000000000000108000400010000000600150003000000200016800c0001001234567890abcdef05000800010000000500070002000000", 0x60)
write(r0, &(0x7f0000000000)="600000001800050601000000000000000a400000fe040001000000001400010020010db800140000000000000000000108000400010000000600150003000000200016800c0001001234567890abcdef05000800010000000500070002000000", 0x60)
write(r0, &(0x7f0000000000)="600000001800050601000000000000000a400000fe040001000000001400010020010db800150000000000000000000108000400010000000600150003000000200016800c0001001234567890abcdef05000800010000000500070002000000", 0x60)
write(r0, &(0x7f0000000000)="600000001800050601000000000000000a400000fe040001000000001400010020010db800160000000000000000000108000400010000000600150003000000200016800c0001001234567890abcdef05000800010000000500070002000000", 0x60)
write(r0, &(0x7f0000000000)="600000001800050601000000000000000a400000fe040001000000001400010020010db800170000000000000000000108000400010000000600150003000000200016800c0001001234567890abcdef05000800010000000500070002000000", 0x60)
write(r0, &(0x7f0000000000)="600000001800050601000000000000000a400000fe040001000000001400010020010db800180000000000000000000108000400010000000600150003000000200016800c0001001234567890abcdef05000800010000000500070002000000", 0x60)
write(r0, &(0x7f0000000000)="600000001800050601000000000000000a400000fe040001000000001400010020010db800190000000000000000000108000400010000000600150003000000200016800c0001001234567890abcdef05000800010000000500070002000000", 0x60)
write(r0, &(0x7f0000000000)="600000001800050601000000000000000a400000fe040001000000001400010020010db8001a0000000000000000000108000400010000000600150003000000200016800c0001001234567890abcdef05000800010000000500070002000000", 0x60)
write(r0, &(0x7f0000000000)="600000001800050601000000000000000a400000fe040001000000001400010020010db8001b0000000000000000000108000400010000000600150003000000200016800c0001001234567890abcdef05000800010000000500070002000000", 0x60)
write(r0, &(0x7f0000000000)="600000001800050601000000000000000a400000fe040001000000001400010020010db8001c0000000000000000000108000400010000000600150003000000200016800c0001001234567890abcdef05000800010000000500070002000000", 0x60)
write(r0, &(0x7f0000000000)="600000001800050601000000000000000a400000fe040001000000001400010020010db8001d0000000000000000000108000400010000000600150003000000200016800c0001001234567890abcdef05000800010000000500070002000000", 0x60)
write(r0, &(0x7f0000000000)="600000001800050601000000000000000a400000fe040001000000001400010020010db8001e0000000000000000000108000400010000000600150003000000200016800c0001001234567890abcdef05000800010000000500070002000000", 0x60)
write(r0, &(0x7f0000000000)="600000001800050601000000000000000a400000fe040001000000001400010020010db8001f0000000000000000000108000400010000000600150003000000200016800c0001001234567890abcdef05000800010000000500070002000000", 0x60)
write(r0, &(0x7f0000000000)="600000001800050601000000000000000a400000fe040001000000001400010020010db800200000000000000000000108000400010000000600150003000000200016800c0001001234567890abcdef05000800010000000500070002000000", 0x60)
write(r0, &(0x7f0000000000)="600000001800050601000000000000000a400000fe040001000000001400010020010db800210000000000000000000108000400010000000600150003000000200016800c0001001234567890abcdef05000800010000000500070002000000", 0x60)
write(r0, &(0x7f0000000000)="600000001800050601000000000000000a400000fe040001000000001400010020010db800220000000000000000000108000400010000000600150003000000200016800c0001001234567890abcdef05000800010000000500070002000000", 0x60)
write(r0, &(0x7f0000000000)="600000001800050601000000000000000a400000fe040001000000001400010020010db800230000000000000000000108000400010000000600150003000000200016800c0001001234567890abcdef05000800010000000500070002000000", 0x60)
write(r0, &(0x7f0000000200)="1c0000001a00010103000000000000000a00"/28, 0x1c)
recvmsg(r0, &(0x7f0000000100)={0x0, 0x0, &(0x7f0000000200)=[{&(0x7f0000000300)=""/4096, 0x1000}], 0x1}, 0x0)
executing program 2:
r0 = socket$nl_route(0x10, 0x3, 0x0)
sendmsg$nl_route(r0, &(0x7f0000000000)={&(0x7f0000000040), 0x10, &(0x7f0000000100)={&(0x7f0000000200)=@newlink={0x0, 0x10, 0x1, 0x0, 0x0, {0x0, 0x0, 0x0, 0x0, 0x100, 0x100}}}}, 0x0)
executing program 2:
mkdirat(0xffffffffffffff9c, &(0x7f0000000100)='./debug\x00', 0x1ff)
mount(0x0, &(0x7f0000000100)='./debug\x00', &(0x7f0000000140)='debugfs\x00', 0x0, 0x0)
mkdirat(0xffffffffffffff9c, &(0x7f0000000600)='./file0\x00', 0x1ff)
pipe2$9p(&(0x7f0000000000)={<r0=>0x0, <r1=>0x0}, 0x0)
r2 = openat(0xffffffffffffff9c, &(0x7f0000000200)='./debug/failslab/probability\x00', 0x1, 0x0)
write(r2, &(0x7f0000000300)='100\x00', 0x4)
r3 = openat(0xffffffffffffff9c, &(0x7f0000000400)='./debug/failslab/times\x00', 0x1, 0x0)
write(r3, &(0x7f0000000500)='100\x00', 0x4)
syz_clone(0x11, 0x0, 0x0, 0x0, 0x0, 0x0)
mount$9p_fd(0x0, &(0x7f0000000600)='./file0\x00', &(0x7f0000000700), 0x0, &(0x7f0000000800)={'trans=fd,', {'rfdno', 0x3d, r0}, 0x2c, {'wfdno', 0x3d, r1}, 0x2c, {[{@version_9p2000}, {@msize={'msize', 0x3d, 0x1000}}]}})
write$P9_RVERSION(r1, &(0x7f0000000900)={0x13, 0x65, 0xffff, 0x1000, 0x6, '9P2000'}, 0x13)
write$P9_RATTACH(r1, &(0x7f0000000a00)={0x13, 0x69, 0x1}, 0x13)
write$P9_RSTAT(r1, &(0x7f0000000b00)={0x0, 0x77, 0x1}, 0x13)
openat(0xffffffffffffff9c, &(0x7f0000000600)='./file0\x00', 0x0, 0x0)
executing program 2:
r0 = socket$nl_netfilter(0x10, 0x3, 0xc)
sendmsg$NFNL_MSG_CTHELPER_NEW(r0, &(0x7f0000000040), 0x0)
r1 = socket$inet_tcp(0x2, 0x1, 0x0)
bind$inet(r1, &(0x7f0000000200)={0x2, 0xbb06, @empty}, 0x10)
listen(r1, 0x5)
r2 = socket$inet_tcp(0x2, 0x1, 0x0)
connect$inet(r2, &(0x7f0000000220)={0x2, 0xbb06, @loopback}, 0x10)
r3 = accept(r1, 0x0, 0x0)
sendto$inet(r2, &(0x7f0000000300)="009c00011a2b3c4d0001000001000000000000010000000100010001", 0x1c, 0x0, 0x0, 0x0)
sendto$inet(r3, &(0x7f0000000400)="009c00011a2b3c4d0002000001000100000000010000000100010001", 0x1c, 0x0, 0x0, 0x0)
sendto$inet(r2, &(0x7f0000000500)="00a800011a2b3c4d0007000012340001000000010000000100010001000100000000", 0x22, 0x0, 0x0, 0x0)
sendto$inet(r3, &(0x7f0000000600)="002000011a2b3c4d00080000567812340100"/32, 0x20, 0x0, 0x0, 0x0)
executing program 4:
r0 = socket$inet6_udp(0xa, 0x2, 0x11)
setsockopt$IP6T_SO_SET_REPLACE(r0, 0x29, 0x40, &(0x7f0000000000)=@mangle={'mangle\x00', 0x1d, 0x6, 0x660, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x6, &(0x7f00000006c0), {[{{@uncond, 0x0, 0xa8, 0xd0}, @common=@unspec=@NFQUEUE2={0x28, 'NFQUEUE\x00', 0x2, {0x0, 0x5}}}, {{@ipv6={@mcast1, @local, [], [], 'macvtap0\x00', 'ip6tnl0\x00', {}, {}, 0x11}, 0x0, 0xa8, 0xe8}, @inet=@TPROXY1={0x40, 'TPROXY\x00', 0x1, {0x0, 0x0, @ipv4=@broadcast}}}, {{@ipv6={@mcast2, @loopback, [], [], 'veth0_to_team\x00', 'syzkaller0\x00', {}, {}, 0x0, 0x0, 0x0, 0x24}, 0x0, 0x108, 0x130, 0x0, {}, [@common=@unspec=@time={{0x38}, {0x100, 0x8, 0xb34f, 0x57c1, 0xffff, 0x6}}, @common=@inet=@socket1={{0x28}}]}, @common=@unspec=@MARK={0x28}}, {{@uncond, 0x0, 0x108, 0x130, 0x0, {}, [@common=@frag={{0x30}}, @common=@ah={{0x30}, {[0x4d2, 0x4d4], 0x6, 0x2, 0x2}}]}, @inet=@DSCP={0x28}}, {{@uncond, 0x0, 0x138, 0x178, 0x0, {}, [@common=@dst={{0x48}}, @common=@dst={{0x48}}]}, @inet=@TPROXY1={0x40, 'TPROXY\x00', 0x1, {0x0, 0x0, @ipv4=@dev}}}], {{'\x00', 0x0, 0xa8, 0xd0}, {0x28}}}}, 0x6c0)
executing program 4:
r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000240), 0x2, 0x0)
ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000040)={'syzkaller0\x00', 0x1001})
r1 = socket$nl_route(0x10, 0x3, 0x0)
ioctl$sock_SIOCGIFINDEX(r1, 0x8933, &(0x7f0000000100)={'syzkaller0\x00', <r2=>0x0})
ioctl$sock_inet_SIOCSIFFLAGS(r1, 0x8914, &(0x7f0000000100)={'syzkaller0\x00', 0x1})
sendmsg$nl_route_sched(r1, &(0x7f00000000c0)={&(0x7f0000000000), 0x0, &(0x7f0000000140)={&(0x7f0000000180)=@newqdisc={0x30, 0x24, 0x401, 0x0, 0x0, {0x0, 0x0, 0x0, r2, {0x0, 0xffff}, {0xffff, 0xffff}}, [@qdisc_kind_options=@q_ingress={0xc}]}, 0x30}}, 0x0)
sendmsg$nl_route_sched(r1, &(0x7f00000001c0)={&(0x7f0000000000), 0x0, &(0x7f0000000200)={&(0x7f0000000340)=@newtfilter={0x94, 0x2c, 0x401, 0x0, 0x0, {0x0, 0x0, 0x0, r2, {0x1}, {0x300}}, [@filter_kind_options=@f_matchall={{0xd}, {0x60, 0x2, [@TCA_MATCHALL_ACT={0x5c, 0x1, [@m_nat={0x58, 0x1, 0x0, 0x0, {{0x8}, {0x2c, 0x2, 0x0, 0x1, [@TCA_NAT_PARMS={0x28, 0x1, {{}, @private=0xa010101, @private=0xa010102}}]}, {0x7, 0x3, "001122"}, {0xc, 0x4}, {0xc, 0x5}}}]}]}}]}, 0x94}}, 0x0)
write(r0, &(0x7f0000000300)="4500001c00010000400100000a0000010a0000020800f7ff00000000", 0x1c)
executing program 4:
mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./nfsd\x00', 0x1ff)
mount(0x0, &(0x7f0000000000)='./nfsd\x00', &(0x7f0000000100)='nfsd\x00', 0x0, 0x0)
r0 = openat(0xffffffffffffff9c, &(0x7f0000000000)='./nfsd/portlist\x00', 0x1, 0x0)
write(r0, &(0x7f0000000300)='+tcp\n\x00', 0x5)
r1 = openat(0xffffffffffffff9c, &(0x7f0000000000)='./nfsd/threads\x00', 0x1, 0x0)
write(r1, &(0x7f0000000100)='1\n\x00', 0x2)
r2 = socket$inet_tcp(0x2, 0x1, 0x6)
bind$inet(r2, &(0x7f0000000200)={0x2, 0x8008, @loopback}, 0x10)
listen(r2, 0x5)
r3 = socket$inet_tcp(0x2, 0x1, 0x6)
connect$inet(r3, &(0x7f0000000200)={0x2, 0x8008, @loopback}, 0x10)
write(r3, &(0x7f0000000400)="80000028123456780000000000000002000186a300000003000000000000000700"/44, 0x2c)
r4 = socket$nl_generic(0x10, 0x3, 0x10)
sendmsg$nl_generic(r4, &(0x7f0000000600)={0x0, 0x0, &(0x7f0000000700)={&(0x7f0000000800)={0x14, 0x10, 0x1, 0x0, 0x0, {0x1}}, 0x14}}, 0x0)
executing program 4:
r0 = socket$nl_route(0x10, 0x3, 0x0)
sendmsg$nl_route(r0, &(0x7f0000000100)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000010)=@newnexthop={0x24, 0x68, 0x601, 0x0, 0x0, {}, [@NHA_ID={0x8, 0x1, 0x1}, @NHA_BLACKHOLE={0x4}]}, 0x24}}, 0x0)
sendmsg$nl_route(r0, &(0x7f0000000100)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000010)=@newnexthop={0x2c, 0x68, 0x601, 0x0, 0x0, {}, [@NHA_ID={0x8, 0x1, 0x2}, @NHA_GROUP={0xc, 0x2, [{0x1, 0x1}]}]}, 0x2c}}, 0x0)
sendmsg$nl_route(r0, &(0x7f0000000100)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000010)=@getnexthop={0x20, 0x6a, 0x1, 0x0, 0x0, {}, [@NHA_ID={0x8, 0x1, 0x2}]}, 0x20}}, 0x0)
executing program 4:
unshare(0x50000000)
unshare(0x50000000)
nanosleep(&(0x7f0000000000)={0x0, 0x5f5e100}, 0x0)
executing program 4:
r0 = socket$nl_generic(0x10, 0x3, 0x10)
r1 = syz_genetlink_get_family_id$ethtool(&(0x7f0000000000), r0)
syz_usb_connect(0x0, 0x39, &(0x7f0000000040)=ANY=[@ANYBLOB="12010002ffffff40950b901700010102030109022700010100a0320904000003ffff0000070581031000080705820200020007050302000200"], 0x0)
nanosleep(&(0x7f0000000200)={0x2}, 0x0)
sendmsg$ETHTOOL_MSG_EEE_SET(r0, &(0x7f0000000080)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000100)={0x34, r1, 0x1, 0x0, 0x0, {}, [@ETHTOOL_A_EEE_HEADER={0xc, 0x1, 0x0, 0x1, [@ETHTOOL_A_HEADER_DEV_INDEX={0x8, 0x1, 0x2}]}, @ETHTOOL_A_EEE_MODES_OURS={0x14, 0x2, 0x0, 0x1, [@ETHTOOL_A_BITSET_BITS={0x10, 0x3, 0x0, 0x1, [{0xc, 0x1, 0x0, 0x1, [@ETHTOOL_A_BITSET_BIT_INDEX={0x8}]}]}]}]}, 0x34}}, 0x0)
executing program 1:
r0 = socket$inet_tcp(0x2, 0x1, 0x0)
bind$inet(r0, &(0x7f0000000000)={0x2, 0x208, @loopback}, 0x10)
listen(r0, 0x5)
r1 = fsopen(&(0x7f0000000100)='nfs\x00', 0x0)
fsconfig$FSCONFIG_SET_STRING(r1, 0x1, &(0x7f0000000140)='addr\x00', &(0x7f0000000180)='127.0.0.1\x00', 0x0)
fsconfig$FSCONFIG_SET_STRING(r1, 0x1, &(0x7f00000001c0)='source\x00', &(0x7f0000000200)='127.0.0.1:/export\x00', 0x0)
fsconfig$FSCONFIG_SET_STRING(r1, 0x1, &(0x7f0000000240)='vers\x00', &(0x7f0000000280)='3\x00', 0x0)
fsconfig$FSCONFIG_SET_STRING(r1, 0x1, &(0x7f00000002c0)='mountport\x00', &(0x7f0000000300)='2049\x00', 0x0)
fsconfig$FSCONFIG_CMD_CREATE(r1, 0x6, 0x0, 0x0, 0x0) (async)
accept4(r0, &(0x7f0000000400)=@in={0x2, 0x0, @loopback}, &(0x7f0000000500)=0x10, 0x0)
executing program 3:
r0 = userfaultfd(0x1)
mmap(&(0x7f0000800000)=nil, 0x1000, 0x3, 0x32, 0xffffffff, 0x0)
ioctl$UFFDIO_API(r0, 0xc018aa3f, &(0x7f0000000100))
ioctl$UFFDIO_REGISTER(r0, 0xc020aa00, &(0x7f0000000200)={{0xffffffffffffffff, 0x1000}, 0x2})
executing program 3:
r0 = socket$netlink(0x10, 0x3, 0xc)
sendmsg$NFQNL_MSG_CONFIG(r0, &(0x7f0000000100)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000300)={0x28, 0x2, 0x3, 0x0, 0x0, 0x0, {0x2}, [@NFQA_CFG_CMD={0x8, 0x1, {0x1, 0x0, 0x2}}, @NFQA_CFG_PARAMS={0x9, 0x2, {0xffff, 0x2}}]}, 0x28}}, 0x0)
r1 = socket$inet_udp(0x2, 0x2, 0x0)
setsockopt$IPT_SO_SET_REPLACE(r1, 0x0, 0x40, &(0x7f0000000a00)=@filter={'filter\x00', 0xe, 0x4, 0x248, 0xffffffff, 0x0, 0x98, 0x128, 0xffffffff, 0xffffffff, 0x1b8, 0x1b8, 0x1b8, 0xffffffff, 0x4, 0x0, {[{{@uncond, 0x0, 0x70, 0x98}, @common=@unspec=@NFQUEUE3={0x28, 'NFQUEUE\x00', 0x3, {0x0, 0x1}}}, {{@uncond, 0x0, 0x70, 0x90}, @common=@unspec=@STANDARD={0x20, '\x00', 0x0, 0xfffffffe}}, {{@uncond, 0x0, 0x70, 0x90}, @common=@unspec=@STANDARD={0x20, '\x00', 0x0, 0xfffffffe}}], {{'\x00', 0x0, 0x70, 0x90}, {0x20}}}}, 0x0)
sendto$inet(r1, &(0x7f0000000500)="00010203040506070809", 0xa, 0x0, &(0x7f0000000600)={0x2, 0x1234, @loopback}, 0x10)
executing program 3:
r0 = socket$netlink(0x10, 0x3, 0x0)
write(r0, &(0x7f0000000000)="580000001800050401000000000000000a800000fe040002000000001400010020010db800000000000000000000000106001500070000001800160008000100010000000c000b0008000100020000000800040001000000", 0x58)
syz_emit_ethernet(0x6a, &(0x7f0000000200)=ANY=[@ANYBLOB="aaaaaaaaaaaaaaaaaaaa86dd6000000000342b4020010db800000000000000000000000220010db8000000000000000000000001110404010100000020010db800000000000000000000000320010db800000000000000000000000430393039000c0000deadbeef"], 0x0)
nanosleep(&(0x7f0000000300)={0x0, 0x2faf080}, 0x0)
executing program 3:
r0 = socket$inet6_tcp(0xa, 0x1, 0x0)
bind$inet6(r0, &(0x7f0000000000)={0xa, 0x4e22, 0x0, @local, 0x6}, 0x1c)
r1 = socket$inet6_tcp(0xa, 0x1, 0x0)
bind$inet6(r1, &(0x7f0000000000)={0xa, 0x4e23, 0x0, @local, 0x7}, 0x1c)
r2 = socket$inet6_tcp(0xa, 0x1, 0x0)
bind$inet6(r2, &(0x7f0000000000)={0xa, 0x4e24, 0x0, @local, 0x8}, 0x1c)
r3 = socket$inet6_tcp(0xa, 0x1, 0x0)
bind$inet6(r3, &(0x7f0000000000)={0xa, 0x4e25, 0x0, @local, 0x9}, 0x1c)
r4 = socket$inet6_tcp(0xa, 0x1, 0x0)
bind$inet6(r4, &(0x7f0000000000)={0xa, 0x4e26, 0x0, @local, 0xa}, 0x1c)
r5 = socket$inet6_tcp(0xa, 0x1, 0x0)
bind$inet6(r5, &(0x7f0000000000)={0xa, 0x4e27, 0x0, @local, 0xb}, 0x1c)
executing program 0:
r0 = fsopen(&(0x7f0000000000)='nfs\x00', 0x0)
fsconfig$FSCONFIG_SET_STRING(r0, 0x1, &(0x7f0000000040)='addr\x00', &(0x7f0000000080)='127.0.0.1\x00', 0x0)
fsconfig$FSCONFIG_SET_STRING(r0, 0x1, &(0x7f0000000140)='port\x00', &(0x7f0000000180)='0\x00', 0x0)
fsconfig$FSCONFIG_CMD_CREATE(r0, 0x6, 0x0, 0x0, 0x0)
executing program 3:
r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000000), 0x2, 0x0)
ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000100)={'\x00', 0x402})
r1 = socket$inet(0x2, 0x2, 0x0)
ioctl$sock_inet_SIOCSIFFLAGS(r1, 0x8914, &(0x7f0000000300)={'\x00', 0x1})
write$tun(r0, &(0x7f0000000200)={@void, @val={0x1, 0x1, 0x14, 0x10, 0x0, 0xe}, @eth={@broadcast, @broadcast, @void, {@generic={0x8847, "000001ff4500002800004000400600007f0000017f0000010050005000000000000000005002200000000000"}}}}, 0x60)
executing program 0:
r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000000), 0x2, 0x0)
ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000100)={'syz_tun\x00', 0x1001})
r1 = socket$nl_route(0x10, 0x3, 0x0)
sendmsg$nl_route(r1, &(0x7f00000000c0)={&(0x7f0000000000), 0x0, &(0x7f0000000140)={&(0x7f0000000180)=ANY=[@ANYBLOB="300000001800010600000000000000002d0100000000000100000000050001000a0000000c000500010000000c000000300000001800010600000000000000002d0100000000000100000000050001000b0000000c000500010000000c000000300000001800010600000000000000002d0100000000000100000000050001000c0000000c000500010000000c000000300000001800010600000000000000002d0100000000000100000000050001000d0000000c000500010000000c000000"], 0xc0}}, 0x0)
sendmsg$nl_route(r1, &(0x7f0000000240)={&(0x7f0000000000), 0x0, &(0x7f0000000280)={&(0x7f00000002c0)=ANY=[@ANYBLOB="1c0000001a00010301000000000000002d00"/28], 0x1c}}, 0x0)
executing program 3:
r0 = socket$inet_tcp(0x2, 0x1, 0x6)
bind$inet(r0, &(0x7f0000000000)={0x2, 0x801, @loopback}, 0x10)
listen(r0, 0x5)
r1 = fsopen(&(0x7f0000000100)='nfs\x00', 0x0)
fsconfig$FSCONFIG_SET_STRING(r1, 0x1, &(0x7f0000000140)='source\x00', &(0x7f0000000180)='127.0.0.1:/export\x00', 0x0)
fsconfig$FSCONFIG_SET_STRING(r1, 0x1, &(0x7f00000001c0)='addr\x00', &(0x7f0000000200)='127.0.0.1\x00', 0x0)
fsconfig$FSCONFIG_SET_STRING(r1, 0x1, &(0x7f0000000240)='port\x00', &(0x7f0000000280)='2049\x00', 0x0)
fsconfig$FSCONFIG_SET_STRING(r1, 0x1, &(0x7f00000002c0)='vers\x00', &(0x7f0000000300)='4.0\x00', 0x0)
fsconfig$FSCONFIG_CMD_CREATE(r1, 0x6, 0x0, 0x0, 0x0) (async)
r2 = accept(r0, 0x0, 0x0)
read(r2, &(0x7f0000000400)=""/256, 0x100)
write(r2, &(0x7f0000000500)="80000100000000000000000100"/36, 0x24)
nanosleep(&(0x7f0000000600)={0x0, 0x5f5e100}, 0x0)
executing program 0:
mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./nfsd\x00', 0x1ff)
mount(&(0x7f0000000040)=@filename='nfsd\x00', &(0x7f0000000080)='./nfsd\x00', &(0x7f00000000c0)='nfsd\x00', 0x0, 0x0)
r0 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./nfsd/versions\x00', 0x1, 0x0)
write(r0, &(0x7f0000000180)='-2 -3 -4\n\x00', 0x9)
r1 = socket$inet(0x2, 0x1, 0x6)
bind$inet(r1, &(0x7f0000000200)={0x2, 0x0, @empty}, 0x10)
listen(r1, 0x5)
r2 = openat(0xffffffffffffff9c, &(0x7f0000000280)='./nfsd/portlist\x00', 0x1, 0x0)
write(r2, &(0x7f0000000300)='4\n\x00', 0x2)
write(r0, &(0x7f0000000380)='+3 +4\n\x00', 0x6)
r3 = openat(0xffffffffffffff9c, &(0x7f0000000400)='./nfsd/threads\x00', 0x1, 0x0)
write(r3, &(0x7f0000000500)='1\n\x00', 0x2)
mkdirat(0xffffffffffffff9c, &(0x7f0000000600)='./proc\x00', 0x1ff)
mount(&(0x7f0000000040)=@filename='proc\x00', &(0x7f0000000600)='./proc\x00', &(0x7f0000000640)='proc\x00', 0x0, 0x0)
r4 = openat(0xffffffffffffff9c, &(0x7f0000000680)='./proc/net/rpc/auth.rpcsec.context/channel\x00', 0x1, 0x0)
write(r4, &(0x7f0000000700)='\\x01000000 2147483647 0 0 0 krb5 \\x00000000ffffff7f00000000000000001100000000000000000000000000000000000000 root\n\x00', 0x61)
r5 = socket$inet(0x2, 0x1, 0x6)
connect$inet(r5, &(0x7f0000000800)={0x2, 0x0, @empty}, 0x10)
write(r5, &(0x7f0000000900)="123456780000000000000002000186a300000003000000000000000600000018000000010000000200000000000000010000000401000000000000060000001c040400ffffffffff00"/92, 0x54)
nanosleep(&(0x7f0000000a00)={0x0, 0x5f5e100}, 0x0)
executing program 0:
r0 = socket$inet6_tcp(0xa, 0x1, 0x6)
bind$inet6(r0, &(0x7f0000000000)={0xa, 0x4e22, 0x0, @empty}, 0x1c)
listen(r0, 0x10)
r1 = socket$inet6_tcp(0xa, 0x1, 0x6)
bind$inet6(r1, &(0x7f0000000080)={0xa, 0x4e23, 0x0, @empty}, 0x1c)
connect$inet6(r1, &(0x7f0000000040)={0xa, 0x4e22, 0x0, @loopback}, 0x1c)
r2 = accept$inet6(r0, 0x0, 0x0)
write(r1, &(0x7f0000000100)='hello', 0x5)
write(r2, &(0x7f0000000140)='world', 0x5)
syz_emit_ethernet(0x4a, &(0x7f0000000200)={@local, @remote, @void, {@ipv6={0x86dd, @tcp={0x0, 0x6, '\x00', 0x14, 0x6, 0xff, @loopback, @loopback, {[], {{0x4e23, 0x4e22, 0x1, 0x1, 0x0, 0x0, 0x5, 0x18, 0x1000}}}}}}}, 0x0)
executing program 0:
mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./nfsd\x00', 0x1ff)
mount(0x0, &(0x7f0000000000)='./nfsd\x00', &(0x7f0000000100)='nfsd\x00', 0x0, 0x0)
r0 = openat(0xffffffffffffff9c, &(0x7f0000000000)='./nfsd/threads\x00', 0x1, 0x0)
write(r0, &(0x7f0000000100)='1\n\x00', 0x2)
r1 = socket$inet_tcp(0x2, 0x1, 0x6)
bind$inet(r1, &(0x7f0000000200)={0x2, 0x8008, @loopback}, 0x10)
listen(r1, 0x5)
r2 = openat(0xffffffffffffff9c, &(0x7f0000000000)='./nfsd/portlist\x00', 0x1, 0x0)
write(r2, &(0x7f0000000300)='3\n\x00', 0x2)
r3 = socket$inet_tcp(0x2, 0x1, 0x6)
connect$inet(r3, &(0x7f0000000200)={0x2, 0x8008, @loopback}, 0x10)
write(r3, &(0x7f0000000400)="80000028123456780000000000000002000186a300000003000000000000000700"/44, 0x2c)
r4 = socket$nl_generic(0x10, 0x3, 0x10)
sendmsg$nl_generic(r4, &(0x7f0000000600)={0x0, 0x0, &(0x7f0000000700)={&(0x7f0000000800)={0x14, 0x10, 0x1, 0x0, 0x0, {0x1}}, 0x14}}, 0x0)
executing program 0:
mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./nfsd\x00', 0x1ff)
mount(&(0x7f0000000040)=@filename='none\x00', &(0x7f0000000080)='./nfsd\x00', &(0x7f00000000c0)='nfsd\x00', 0x0, 0x0)
r0 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./nfsd/versions\x00', 0x2, 0x0)
write(r0, &(0x7f0000000140)='-2 -3 +4\n\x00', 0x9)
r1 = openat(0xffffffffffffff9c, &(0x7f0000000180)='./nfsd/portlist\x00', 0x2, 0x0)
write(r1, &(0x7f00000001c0)='tcp 20000\n\x00', 0xa)
r2 = openat(0xffffffffffffff9c, &(0x7f0000000200)='./nfsd/threads\x00', 0x2, 0x0)
write(r2, &(0x7f0000000240)='1\n\x00', 0x2) (async)
nanosleep(&(0x7f0000000300)={0x2}, 0x0)
nanosleep(&(0x7f0000000300)={0x2}, 0x0)
write(r2, &(0x7f0000000240)='1\n\x00', 0x2)
r3 = socket$inet(0x2, 0x1, 0x0)
connect$inet(r3, &(0x7f0000000280)={0x2, 0x4e20, @loopback}, 0x10)
nanosleep(&(0x7f0000000300)={0x0, 0x2faf080}, 0x0)
r4 = socket$inet(0x2, 0x1, 0x0)
connect$inet(r4, &(0x7f0000000380)={0x2, 0x4e20, @loopback}, 0x10)
nanosleep(&(0x7f0000000300)={0x0, 0x2faf080}, 0x0)
executing program 1:
r0 = socket$nl_route(0x10, 0x3, 0x0)
sendmsg$nl_route(r0, &(0x7f0000000080)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000100)=@newlink={0x50, 0x10, 0x601, 0x0, 0x0, {}, [@IFLA_IFNAME={0x14, 0x3, 'veth1\x00'}, @IFLA_NUM_TX_QUEUES={0x8, 0x1f, 0x4}, @IFLA_LINKINFO={0x14, 0x12, 0x0, 0x1, @veth={{0x9}, {0x4, 0x2, 0x0, 0x1, @void}}}]}, 0x50}}, 0x0)
r1 = socket$inet(0x2, 0x2, 0x0)
ioctl$sock_SIOCGIFINDEX(r1, 0x8933, &(0x7f0000000400)={'veth1\x00', <r2=>0x0})
sendmsg$nl_route_sched(r0, &(0x7f0000000180)={0x0, 0x0, &(0x7f00000001c0)={&(0x7f0000000200)=@newqdisc={0x34, 0x24, 0x601, 0x0, 0x0, {0x0, 0x0, 0x0, r2}, [@qdisc_kind_options=@q_cake={{0x9}, {0x4}}]}, 0x34}}, 0x0)
executing program 1:
r0 = socket$nl_netfilter(0x10, 0x3, 0xc)
sendmsg$NFULNL_MSG_CONFIG(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000000200)={0x1c, 0x1, 0x4, 0x1, 0x0, 0x0, {0x2}, [@NFULA_CFG_CMD={0x5, 0x1, 0x3}]}, 0x1c}}, 0x0)
sendmsg$NFULNL_MSG_CONFIG(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000000200)={0x1c, 0x1, 0x4, 0x1, 0x0, 0x0, {0x2}, [@NFULA_CFG_CMD={0x5, 0x1, 0x1}]}, 0x1c}}, 0x0)
sendmsg$NFULNL_MSG_CONFIG(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000000200)={0x20, 0x1, 0x4, 0x1, 0x0, 0x0, {0x2}, [@NFULA_CFG_MODE={0xa, 0x2, {0xffff, 0x2}}]}, 0x20}}, 0x0)
sendmsg$NFT_BATCH(r0, &(0x7f0000000300)={0x0, 0x0, &(0x7f0000000400)={&(0x7f0000000500)={{0x14, 0x10, 0x1, 0x0, 0x0, {0x2, 0x0, 0x0}}, [@NFT_MSG_NEWTABLE={0x20, 0x0, 0xa, 0x401, 0x0, 0x0, {0x2}, [@NFTA_TABLE_NAME={0x9, 0x1, 'syz0\x00'}]}, @NFT_MSG_NEWCHAIN={0x40, 0x3, 0xa, 0x401, 0x0, 0x0, {0x2}, [@NFTA_CHAIN_TABLE={0x9, 0x1, 'syz0\x00'}, @NFTA_CHAIN_NAME={0x9, 0x3, 'syz0\x00'}, @NFTA_CHAIN_HOOK={0x14, 0x4, 0x0, 0x1, [@NFTA_HOOK_HOOKNUM={0x8, 0x1, 0x1, 0x0, 0x1}, @NFTA_HOOK_PRIORITY={0x8}]}]}, @NFT_MSG_NEWRULE={0x48, 0x6, 0xa, 0x401, 0x0, 0x0, {0x2}, [@NFTA_RULE_TABLE={0x9, 0x1, 'syz0\x00'}, @NFTA_RULE_CHAIN={0x9, 0x2, 'syz0\x00'}, @NFTA_RULE_EXPRESSIONS={0x1c, 0x4, 0x0, 0x1, [{0x18, 0x1, 0x0, 0x1, @log={{0x8}, @val={0xc, 0x2, 0x0, 0x1, [@NFTA_LOG_GROUP={0x6}]}}}]}]}], {0x14, 0x11, 0x1, 0x0, 0x0, {0x2, 0x0, 0x0}}}, 0xd0}}, 0x0)
r1 = socket$inet_udp(0x2, 0x2, 0x0)
sendto$inet(r1, &(0x7f0000000600)="00112233445566778899", 0xa, 0x0, &(0x7f0000000700)={0x2, 0x1234, @loopback}, 0x10)
executing program 1:
r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0)
ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000100)={'syzkaller0\x00', 0x1})
r1 = socket$inet(0x2, 0x2, 0x0)
ioctl$sock_inet_SIOCSIFFLAGS(r1, 0x8914, &(0x7f0000000200)={'syzkaller0\x00', 0x1})
r2 = socket$nl_route(0x10, 0x3, 0x0)
sendmsg$nl_route_sched(r2, &(0x7f0000000300)={0x0, 0x0, &(0x7f0000000400)={&(0x7f0000000500)=@newqdisc={0x30, 0x24, 0x601, 0x0, 0x0, {0x0, 0x0, 0x0, 0x0, {}, {0xf1, 0xff}}, [@qdisc_kind_options=@q_ingress={0xc}]}, 0x30}}, 0x0)
sendmsg$nl_route_sched(r2, &(0x7f0000000600)={0x0, 0x0, &(0x7f0000000700)={&(0x7f0000000800)=@newtfilter={0x6c, 0x2c, 0x601, 0x0, 0x0, {0x0, 0x0, 0x0, 0x0, {}, {0xf1, 0xff}, {0x0, 0x3}}, [@filter_kind_options=@f_matchall={{0xd}, {0x4}}]}, 0x6c}}, 0x0)
executing program 1:
mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./debug\x00', 0x1ed)
mount(&(0x7f0000000040)=@filename='none\x00', &(0x7f0000000080)='./debug\x00', &(0x7f00000000c0)='debugfs\x00', 0x0, 0x0)
r0 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./debug/failslab/probability\x00', 0x1, 0x0)
r1 = openat(0xffffffffffffff9c, &(0x7f0000000180)='./debug/failslab/times\x00', 0x1, 0x0)
r2 = openat(0xffffffffffffff9c, &(0x7f0000000200)='./debug/fail_page_alloc/probability\x00', 0x1, 0x0)
r3 = openat(0xffffffffffffff9c, &(0x7f0000000280)='./debug/fail_page_alloc/times\x00', 0x1, 0x0)
socket$packet(0x11, 0x3, 0x300)
r4 = socket$inet_udp(0x2, 0x2, 0x0)
write(r1, &(0x7f00000001c0)='1000\x00', 0x4)
write(r3, &(0x7f00000002c0)='1000\x00', 0x4)
write(r0, &(0x7f0000000140)='100\x00', 0x3)
write(r2, &(0x7f0000000240)='100\x00', 0x3)
sendto$inet(r4, &(0x7f0000000300)="11223344", 0x4, 0x0, &(0x7f0000000400)={0x2, 0x1234, @loopback}, 0x10)
executing program 1:
r0 = socket$nl_generic(0x10, 0x3, 0x10)
r1 = syz_genetlink_get_family_id$tipc2(&(0x7f0000000000), 0xffffffffffffffff)
r2 = socket$inet_udp(0x2, 0x2, 0x0)
bind$inet(r2, &(0x7f0000000100)={0x2, 0x1f91, @loopback}, 0x10)
sendmsg$TIPC_NL_BEARER_ENABLE(r0, &(0x7f0000000080)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000140)={0x54, r1, 0x1, 0x123, 0x234, {}, [@TIPC_NLA_BEARER={0x40, 0x1, 0x0, 0x1, [@TIPC_NLA_BEARER_NAME={0xd, 0x1, @udp='udp:syz0\x00'}, @TIPC_NLA_BEARER_UDP_OPTS={0x2c, 0x4, {{0x14, 0x1, @in={0x2, 0x1f90, @loopback}}, {0x14, 0x2, @in={0x2, 0x1f91, @loopback}}}}]}]}, 0x54}}, 0x0)
recvfrom$inet(r2, &(0x7f0000000200), 0x100, 0x0, 0x0, 0x0)

program crashed: kernel BUG in mmap_region
bisect: bisecting 30 programs
bisect: split chunks (needed=false): <30>
bisect: split chunk #0 of len 30 into 3 parts
bisect: testing without sub-chunk 1/3
testing program (duration=1m45s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): [3, 5, 10, 4, 5, 4, 12, 4, 5, 5, 13, 20, 10, 14, 17, 5, 7, 7, 13, 6]
detailed listing:
executing program 4:
unshare(0x50000000)
unshare(0x50000000)
nanosleep(&(0x7f0000000000)={0x0, 0x5f5e100}, 0x0)
executing program 4:
r0 = socket$nl_generic(0x10, 0x3, 0x10)
r1 = syz_genetlink_get_family_id$ethtool(&(0x7f0000000000), r0)
syz_usb_connect(0x0, 0x39, &(0x7f0000000040)=ANY=[@ANYBLOB="12010002ffffff40950b901700010102030109022700010100a0320904000003ffff0000070581031000080705820200020007050302000200"], 0x0)
nanosleep(&(0x7f0000000200)={0x2}, 0x0)
sendmsg$ETHTOOL_MSG_EEE_SET(r0, &(0x7f0000000080)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000100)={0x34, r1, 0x1, 0x0, 0x0, {}, [@ETHTOOL_A_EEE_HEADER={0xc, 0x1, 0x0, 0x1, [@ETHTOOL_A_HEADER_DEV_INDEX={0x8, 0x1, 0x2}]}, @ETHTOOL_A_EEE_MODES_OURS={0x14, 0x2, 0x0, 0x1, [@ETHTOOL_A_BITSET_BITS={0x10, 0x3, 0x0, 0x1, [{0xc, 0x1, 0x0, 0x1, [@ETHTOOL_A_BITSET_BIT_INDEX={0x8}]}]}]}]}, 0x34}}, 0x0)
executing program 1:
r0 = socket$inet_tcp(0x2, 0x1, 0x0)
bind$inet(r0, &(0x7f0000000000)={0x2, 0x208, @loopback}, 0x10)
listen(r0, 0x5)
r1 = fsopen(&(0x7f0000000100)='nfs\x00', 0x0)
fsconfig$FSCONFIG_SET_STRING(r1, 0x1, &(0x7f0000000140)='addr\x00', &(0x7f0000000180)='127.0.0.1\x00', 0x0)
fsconfig$FSCONFIG_SET_STRING(r1, 0x1, &(0x7f00000001c0)='source\x00', &(0x7f0000000200)='127.0.0.1:/export\x00', 0x0)
fsconfig$FSCONFIG_SET_STRING(r1, 0x1, &(0x7f0000000240)='vers\x00', &(0x7f0000000280)='3\x00', 0x0)
fsconfig$FSCONFIG_SET_STRING(r1, 0x1, &(0x7f00000002c0)='mountport\x00', &(0x7f0000000300)='2049\x00', 0x0)
fsconfig$FSCONFIG_CMD_CREATE(r1, 0x6, 0x0, 0x0, 0x0) (async)
accept4(r0, &(0x7f0000000400)=@in={0x2, 0x0, @loopback}, &(0x7f0000000500)=0x10, 0x0)
executing program 3:
r0 = userfaultfd(0x1)
mmap(&(0x7f0000800000)=nil, 0x1000, 0x3, 0x32, 0xffffffff, 0x0)
ioctl$UFFDIO_API(r0, 0xc018aa3f, &(0x7f0000000100))
ioctl$UFFDIO_REGISTER(r0, 0xc020aa00, &(0x7f0000000200)={{0xffffffffffffffff, 0x1000}, 0x2})
executing program 3:
r0 = socket$netlink(0x10, 0x3, 0xc)
sendmsg$NFQNL_MSG_CONFIG(r0, &(0x7f0000000100)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000300)={0x28, 0x2, 0x3, 0x0, 0x0, 0x0, {0x2}, [@NFQA_CFG_CMD={0x8, 0x1, {0x1, 0x0, 0x2}}, @NFQA_CFG_PARAMS={0x9, 0x2, {0xffff, 0x2}}]}, 0x28}}, 0x0)
r1 = socket$inet_udp(0x2, 0x2, 0x0)
setsockopt$IPT_SO_SET_REPLACE(r1, 0x0, 0x40, &(0x7f0000000a00)=@filter={'filter\x00', 0xe, 0x4, 0x248, 0xffffffff, 0x0, 0x98, 0x128, 0xffffffff, 0xffffffff, 0x1b8, 0x1b8, 0x1b8, 0xffffffff, 0x4, 0x0, {[{{@uncond, 0x0, 0x70, 0x98}, @common=@unspec=@NFQUEUE3={0x28, 'NFQUEUE\x00', 0x3, {0x0, 0x1}}}, {{@uncond, 0x0, 0x70, 0x90}, @common=@unspec=@STANDARD={0x20, '\x00', 0x0, 0xfffffffe}}, {{@uncond, 0x0, 0x70, 0x90}, @common=@unspec=@STANDARD={0x20, '\x00', 0x0, 0xfffffffe}}], {{'\x00', 0x0, 0x70, 0x90}, {0x20}}}}, 0x0)
sendto$inet(r1, &(0x7f0000000500)="00010203040506070809", 0xa, 0x0, &(0x7f0000000600)={0x2, 0x1234, @loopback}, 0x10)
executing program 3:
r0 = socket$netlink(0x10, 0x3, 0x0)
write(r0, &(0x7f0000000000)="580000001800050401000000000000000a800000fe040002000000001400010020010db800000000000000000000000106001500070000001800160008000100010000000c000b0008000100020000000800040001000000", 0x58)
syz_emit_ethernet(0x6a, &(0x7f0000000200)=ANY=[@ANYBLOB="aaaaaaaaaaaaaaaaaaaa86dd6000000000342b4020010db800000000000000000000000220010db8000000000000000000000001110404010100000020010db800000000000000000000000320010db800000000000000000000000430393039000c0000deadbeef"], 0x0)
nanosleep(&(0x7f0000000300)={0x0, 0x2faf080}, 0x0)
executing program 3:
r0 = socket$inet6_tcp(0xa, 0x1, 0x0)
bind$inet6(r0, &(0x7f0000000000)={0xa, 0x4e22, 0x0, @local, 0x6}, 0x1c)
r1 = socket$inet6_tcp(0xa, 0x1, 0x0)
bind$inet6(r1, &(0x7f0000000000)={0xa, 0x4e23, 0x0, @local, 0x7}, 0x1c)
r2 = socket$inet6_tcp(0xa, 0x1, 0x0)
bind$inet6(r2, &(0x7f0000000000)={0xa, 0x4e24, 0x0, @local, 0x8}, 0x1c)
r3 = socket$inet6_tcp(0xa, 0x1, 0x0)
bind$inet6(r3, &(0x7f0000000000)={0xa, 0x4e25, 0x0, @local, 0x9}, 0x1c)
r4 = socket$inet6_tcp(0xa, 0x1, 0x0)
bind$inet6(r4, &(0x7f0000000000)={0xa, 0x4e26, 0x0, @local, 0xa}, 0x1c)
r5 = socket$inet6_tcp(0xa, 0x1, 0x0)
bind$inet6(r5, &(0x7f0000000000)={0xa, 0x4e27, 0x0, @local, 0xb}, 0x1c)
executing program 0:
r0 = fsopen(&(0x7f0000000000)='nfs\x00', 0x0)
fsconfig$FSCONFIG_SET_STRING(r0, 0x1, &(0x7f0000000040)='addr\x00', &(0x7f0000000080)='127.0.0.1\x00', 0x0)
fsconfig$FSCONFIG_SET_STRING(r0, 0x1, &(0x7f0000000140)='port\x00', &(0x7f0000000180)='0\x00', 0x0)
fsconfig$FSCONFIG_CMD_CREATE(r0, 0x6, 0x0, 0x0, 0x0)
executing program 3:
r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000000), 0x2, 0x0)
ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000100)={'\x00', 0x402})
r1 = socket$inet(0x2, 0x2, 0x0)
ioctl$sock_inet_SIOCSIFFLAGS(r1, 0x8914, &(0x7f0000000300)={'\x00', 0x1})
write$tun(r0, &(0x7f0000000200)={@void, @val={0x1, 0x1, 0x14, 0x10, 0x0, 0xe}, @eth={@broadcast, @broadcast, @void, {@generic={0x8847, "000001ff4500002800004000400600007f0000017f0000010050005000000000000000005002200000000000"}}}}, 0x60)
executing program 0:
r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000000), 0x2, 0x0)
ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000100)={'syz_tun\x00', 0x1001})
r1 = socket$nl_route(0x10, 0x3, 0x0)
sendmsg$nl_route(r1, &(0x7f00000000c0)={&(0x7f0000000000), 0x0, &(0x7f0000000140)={&(0x7f0000000180)=ANY=[@ANYBLOB="300000001800010600000000000000002d0100000000000100000000050001000a0000000c000500010000000c000000300000001800010600000000000000002d0100000000000100000000050001000b0000000c000500010000000c000000300000001800010600000000000000002d0100000000000100000000050001000c0000000c000500010000000c000000300000001800010600000000000000002d0100000000000100000000050001000d0000000c000500010000000c000000"], 0xc0}}, 0x0)
sendmsg$nl_route(r1, &(0x7f0000000240)={&(0x7f0000000000), 0x0, &(0x7f0000000280)={&(0x7f00000002c0)=ANY=[@ANYBLOB="1c0000001a00010301000000000000002d00"/28], 0x1c}}, 0x0)
executing program 3:
r0 = socket$inet_tcp(0x2, 0x1, 0x6)
bind$inet(r0, &(0x7f0000000000)={0x2, 0x801, @loopback}, 0x10)
listen(r0, 0x5)
r1 = fsopen(&(0x7f0000000100)='nfs\x00', 0x0)
fsconfig$FSCONFIG_SET_STRING(r1, 0x1, &(0x7f0000000140)='source\x00', &(0x7f0000000180)='127.0.0.1:/export\x00', 0x0)
fsconfig$FSCONFIG_SET_STRING(r1, 0x1, &(0x7f00000001c0)='addr\x00', &(0x7f0000000200)='127.0.0.1\x00', 0x0)
fsconfig$FSCONFIG_SET_STRING(r1, 0x1, &(0x7f0000000240)='port\x00', &(0x7f0000000280)='2049\x00', 0x0)
fsconfig$FSCONFIG_SET_STRING(r1, 0x1, &(0x7f00000002c0)='vers\x00', &(0x7f0000000300)='4.0\x00', 0x0)
fsconfig$FSCONFIG_CMD_CREATE(r1, 0x6, 0x0, 0x0, 0x0) (async)
r2 = accept(r0, 0x0, 0x0)
read(r2, &(0x7f0000000400)=""/256, 0x100)
write(r2, &(0x7f0000000500)="80000100000000000000000100"/36, 0x24)
nanosleep(&(0x7f0000000600)={0x0, 0x5f5e100}, 0x0)
executing program 0:
mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./nfsd\x00', 0x1ff)
mount(&(0x7f0000000040)=@filename='nfsd\x00', &(0x7f0000000080)='./nfsd\x00', &(0x7f00000000c0)='nfsd\x00', 0x0, 0x0)
r0 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./nfsd/versions\x00', 0x1, 0x0)
write(r0, &(0x7f0000000180)='-2 -3 -4\n\x00', 0x9)
r1 = socket$inet(0x2, 0x1, 0x6)
bind$inet(r1, &(0x7f0000000200)={0x2, 0x0, @empty}, 0x10)
listen(r1, 0x5)
r2 = openat(0xffffffffffffff9c, &(0x7f0000000280)='./nfsd/portlist\x00', 0x1, 0x0)
write(r2, &(0x7f0000000300)='4\n\x00', 0x2)
write(r0, &(0x7f0000000380)='+3 +4\n\x00', 0x6)
r3 = openat(0xffffffffffffff9c, &(0x7f0000000400)='./nfsd/threads\x00', 0x1, 0x0)
write(r3, &(0x7f0000000500)='1\n\x00', 0x2)
mkdirat(0xffffffffffffff9c, &(0x7f0000000600)='./proc\x00', 0x1ff)
mount(&(0x7f0000000040)=@filename='proc\x00', &(0x7f0000000600)='./proc\x00', &(0x7f0000000640)='proc\x00', 0x0, 0x0)
r4 = openat(0xffffffffffffff9c, &(0x7f0000000680)='./proc/net/rpc/auth.rpcsec.context/channel\x00', 0x1, 0x0)
write(r4, &(0x7f0000000700)='\\x01000000 2147483647 0 0 0 krb5 \\x00000000ffffff7f00000000000000001100000000000000000000000000000000000000 root\n\x00', 0x61)
r5 = socket$inet(0x2, 0x1, 0x6)
connect$inet(r5, &(0x7f0000000800)={0x2, 0x0, @empty}, 0x10)
write(r5, &(0x7f0000000900)="123456780000000000000002000186a300000003000000000000000600000018000000010000000200000000000000010000000401000000000000060000001c040400ffffffffff00"/92, 0x54)
nanosleep(&(0x7f0000000a00)={0x0, 0x5f5e100}, 0x0)
executing program 0:
r0 = socket$inet6_tcp(0xa, 0x1, 0x6)
bind$inet6(r0, &(0x7f0000000000)={0xa, 0x4e22, 0x0, @empty}, 0x1c)
listen(r0, 0x10)
r1 = socket$inet6_tcp(0xa, 0x1, 0x6)
bind$inet6(r1, &(0x7f0000000080)={0xa, 0x4e23, 0x0, @empty}, 0x1c)
connect$inet6(r1, &(0x7f0000000040)={0xa, 0x4e22, 0x0, @loopback}, 0x1c)
r2 = accept$inet6(r0, 0x0, 0x0)
write(r1, &(0x7f0000000100)='hello', 0x5)
write(r2, &(0x7f0000000140)='world', 0x5)
syz_emit_ethernet(0x4a, &(0x7f0000000200)={@local, @remote, @void, {@ipv6={0x86dd, @tcp={0x0, 0x6, '\x00', 0x14, 0x6, 0xff, @loopback, @loopback, {[], {{0x4e23, 0x4e22, 0x1, 0x1, 0x0, 0x0, 0x5, 0x18, 0x1000}}}}}}}, 0x0)
executing program 0:
mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./nfsd\x00', 0x1ff)
mount(0x0, &(0x7f0000000000)='./nfsd\x00', &(0x7f0000000100)='nfsd\x00', 0x0, 0x0)
r0 = openat(0xffffffffffffff9c, &(0x7f0000000000)='./nfsd/threads\x00', 0x1, 0x0)
write(r0, &(0x7f0000000100)='1\n\x00', 0x2)
r1 = socket$inet_tcp(0x2, 0x1, 0x6)
bind$inet(r1, &(0x7f0000000200)={0x2, 0x8008, @loopback}, 0x10)
listen(r1, 0x5)
r2 = openat(0xffffffffffffff9c, &(0x7f0000000000)='./nfsd/portlist\x00', 0x1, 0x0)
write(r2, &(0x7f0000000300)='3\n\x00', 0x2)
r3 = socket$inet_tcp(0x2, 0x1, 0x6)
connect$inet(r3, &(0x7f0000000200)={0x2, 0x8008, @loopback}, 0x10)
write(r3, &(0x7f0000000400)="80000028123456780000000000000002000186a300000003000000000000000700"/44, 0x2c)
r4 = socket$nl_generic(0x10, 0x3, 0x10)
sendmsg$nl_generic(r4, &(0x7f0000000600)={0x0, 0x0, &(0x7f0000000700)={&(0x7f0000000800)={0x14, 0x10, 0x1, 0x0, 0x0, {0x1}}, 0x14}}, 0x0)
executing program 0:
mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./nfsd\x00', 0x1ff)
mount(&(0x7f0000000040)=@filename='none\x00', &(0x7f0000000080)='./nfsd\x00', &(0x7f00000000c0)='nfsd\x00', 0x0, 0x0)
r0 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./nfsd/versions\x00', 0x2, 0x0)
write(r0, &(0x7f0000000140)='-2 -3 +4\n\x00', 0x9)
r1 = openat(0xffffffffffffff9c, &(0x7f0000000180)='./nfsd/portlist\x00', 0x2, 0x0)
write(r1, &(0x7f00000001c0)='tcp 20000\n\x00', 0xa)
r2 = openat(0xffffffffffffff9c, &(0x7f0000000200)='./nfsd/threads\x00', 0x2, 0x0)
write(r2, &(0x7f0000000240)='1\n\x00', 0x2) (async)
nanosleep(&(0x7f0000000300)={0x2}, 0x0)
nanosleep(&(0x7f0000000300)={0x2}, 0x0)
write(r2, &(0x7f0000000240)='1\n\x00', 0x2)
r3 = socket$inet(0x2, 0x1, 0x0)
connect$inet(r3, &(0x7f0000000280)={0x2, 0x4e20, @loopback}, 0x10)
nanosleep(&(0x7f0000000300)={0x0, 0x2faf080}, 0x0)
r4 = socket$inet(0x2, 0x1, 0x0)
connect$inet(r4, &(0x7f0000000380)={0x2, 0x4e20, @loopback}, 0x10)
nanosleep(&(0x7f0000000300)={0x0, 0x2faf080}, 0x0)
executing program 1:
r0 = socket$nl_route(0x10, 0x3, 0x0)
sendmsg$nl_route(r0, &(0x7f0000000080)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000100)=@newlink={0x50, 0x10, 0x601, 0x0, 0x0, {}, [@IFLA_IFNAME={0x14, 0x3, 'veth1\x00'}, @IFLA_NUM_TX_QUEUES={0x8, 0x1f, 0x4}, @IFLA_LINKINFO={0x14, 0x12, 0x0, 0x1, @veth={{0x9}, {0x4, 0x2, 0x0, 0x1, @void}}}]}, 0x50}}, 0x0)
r1 = socket$inet(0x2, 0x2, 0x0)
ioctl$sock_SIOCGIFINDEX(r1, 0x8933, &(0x7f0000000400)={'veth1\x00', <r2=>0x0})
sendmsg$nl_route_sched(r0, &(0x7f0000000180)={0x0, 0x0, &(0x7f00000001c0)={&(0x7f0000000200)=@newqdisc={0x34, 0x24, 0x601, 0x0, 0x0, {0x0, 0x0, 0x0, r2}, [@qdisc_kind_options=@q_cake={{0x9}, {0x4}}]}, 0x34}}, 0x0)
executing program 1:
r0 = socket$nl_netfilter(0x10, 0x3, 0xc)
sendmsg$NFULNL_MSG_CONFIG(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000000200)={0x1c, 0x1, 0x4, 0x1, 0x0, 0x0, {0x2}, [@NFULA_CFG_CMD={0x5, 0x1, 0x3}]}, 0x1c}}, 0x0)
sendmsg$NFULNL_MSG_CONFIG(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000000200)={0x1c, 0x1, 0x4, 0x1, 0x0, 0x0, {0x2}, [@NFULA_CFG_CMD={0x5, 0x1, 0x1}]}, 0x1c}}, 0x0)
sendmsg$NFULNL_MSG_CONFIG(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000000200)={0x20, 0x1, 0x4, 0x1, 0x0, 0x0, {0x2}, [@NFULA_CFG_MODE={0xa, 0x2, {0xffff, 0x2}}]}, 0x20}}, 0x0)
sendmsg$NFT_BATCH(r0, &(0x7f0000000300)={0x0, 0x0, &(0x7f0000000400)={&(0x7f0000000500)={{0x14, 0x10, 0x1, 0x0, 0x0, {0x2, 0x0, 0x0}}, [@NFT_MSG_NEWTABLE={0x20, 0x0, 0xa, 0x401, 0x0, 0x0, {0x2}, [@NFTA_TABLE_NAME={0x9, 0x1, 'syz0\x00'}]}, @NFT_MSG_NEWCHAIN={0x40, 0x3, 0xa, 0x401, 0x0, 0x0, {0x2}, [@NFTA_CHAIN_TABLE={0x9, 0x1, 'syz0\x00'}, @NFTA_CHAIN_NAME={0x9, 0x3, 'syz0\x00'}, @NFTA_CHAIN_HOOK={0x14, 0x4, 0x0, 0x1, [@NFTA_HOOK_HOOKNUM={0x8, 0x1, 0x1, 0x0, 0x1}, @NFTA_HOOK_PRIORITY={0x8}]}]}, @NFT_MSG_NEWRULE={0x48, 0x6, 0xa, 0x401, 0x0, 0x0, {0x2}, [@NFTA_RULE_TABLE={0x9, 0x1, 'syz0\x00'}, @NFTA_RULE_CHAIN={0x9, 0x2, 'syz0\x00'}, @NFTA_RULE_EXPRESSIONS={0x1c, 0x4, 0x0, 0x1, [{0x18, 0x1, 0x0, 0x1, @log={{0x8}, @val={0xc, 0x2, 0x0, 0x1, [@NFTA_LOG_GROUP={0x6}]}}}]}]}], {0x14, 0x11, 0x1, 0x0, 0x0, {0x2, 0x0, 0x0}}}, 0xd0}}, 0x0)
r1 = socket$inet_udp(0x2, 0x2, 0x0)
sendto$inet(r1, &(0x7f0000000600)="00112233445566778899", 0xa, 0x0, &(0x7f0000000700)={0x2, 0x1234, @loopback}, 0x10)
executing program 1:
r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0)
ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000100)={'syzkaller0\x00', 0x1})
r1 = socket$inet(0x2, 0x2, 0x0)
ioctl$sock_inet_SIOCSIFFLAGS(r1, 0x8914, &(0x7f0000000200)={'syzkaller0\x00', 0x1})
r2 = socket$nl_route(0x10, 0x3, 0x0)
sendmsg$nl_route_sched(r2, &(0x7f0000000300)={0x0, 0x0, &(0x7f0000000400)={&(0x7f0000000500)=@newqdisc={0x30, 0x24, 0x601, 0x0, 0x0, {0x0, 0x0, 0x0, 0x0, {}, {0xf1, 0xff}}, [@qdisc_kind_options=@q_ingress={0xc}]}, 0x30}}, 0x0)
sendmsg$nl_route_sched(r2, &(0x7f0000000600)={0x0, 0x0, &(0x7f0000000700)={&(0x7f0000000800)=@newtfilter={0x6c, 0x2c, 0x601, 0x0, 0x0, {0x0, 0x0, 0x0, 0x0, {}, {0xf1, 0xff}, {0x0, 0x3}}, [@filter_kind_options=@f_matchall={{0xd}, {0x4}}]}, 0x6c}}, 0x0)
executing program 1:
mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./debug\x00', 0x1ed)
mount(&(0x7f0000000040)=@filename='none\x00', &(0x7f0000000080)='./debug\x00', &(0x7f00000000c0)='debugfs\x00', 0x0, 0x0)
r0 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./debug/failslab/probability\x00', 0x1, 0x0)
r1 = openat(0xffffffffffffff9c, &(0x7f0000000180)='./debug/failslab/times\x00', 0x1, 0x0)
r2 = openat(0xffffffffffffff9c, &(0x7f0000000200)='./debug/fail_page_alloc/probability\x00', 0x1, 0x0)
r3 = openat(0xffffffffffffff9c, &(0x7f0000000280)='./debug/fail_page_alloc/times\x00', 0x1, 0x0)
socket$packet(0x11, 0x3, 0x300)
r4 = socket$inet_udp(0x2, 0x2, 0x0)
write(r1, &(0x7f00000001c0)='1000\x00', 0x4)
write(r3, &(0x7f00000002c0)='1000\x00', 0x4)
write(r0, &(0x7f0000000140)='100\x00', 0x3)
write(r2, &(0x7f0000000240)='100\x00', 0x3)
sendto$inet(r4, &(0x7f0000000300)="11223344", 0x4, 0x0, &(0x7f0000000400)={0x2, 0x1234, @loopback}, 0x10)
executing program 1:
r0 = socket$nl_generic(0x10, 0x3, 0x10)
r1 = syz_genetlink_get_family_id$tipc2(&(0x7f0000000000), 0xffffffffffffffff)
r2 = socket$inet_udp(0x2, 0x2, 0x0)
bind$inet(r2, &(0x7f0000000100)={0x2, 0x1f91, @loopback}, 0x10)
sendmsg$TIPC_NL_BEARER_ENABLE(r0, &(0x7f0000000080)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000140)={0x54, r1, 0x1, 0x123, 0x234, {}, [@TIPC_NLA_BEARER={0x40, 0x1, 0x0, 0x1, [@TIPC_NLA_BEARER_NAME={0xd, 0x1, @udp='udp:syz0\x00'}, @TIPC_NLA_BEARER_UDP_OPTS={0x2c, 0x4, {{0x14, 0x1, @in={0x2, 0x1f90, @loopback}}, {0x14, 0x2, @in={0x2, 0x1f91, @loopback}}}}]}]}, 0x54}}, 0x0)
recvfrom$inet(r2, &(0x7f0000000200), 0x100, 0x0, 0x0, 0x0)

program did not crash
bisect: testing without sub-chunk 2/3
testing program (duration=1m45s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): [6, 3, 38, 2, 14, 12, 2, 8, 14, 4, 13, 20, 10, 14, 17, 5, 7, 7, 13, 6]
detailed listing:
executing program 2:
r0 = syz_open_procfs$namespace(0x0, &(0x7f0000000000)='ns/net\x00')
setns(r0, 0x40000000)
r1 = syz_open_procfs(0x0, &(0x7f0000000100)='net/dev\x00')
read(r1, &(0x7f0000000200), 0x1000)
r2 = socket$inet(0x2, 0x2, 0x0)
ioctl$sock_SIOCETHTOOL(r2, 0x8946, &(0x7f0000000300)={'lo\x00', &(0x7f0000000400)=@ethtool_eeprom={0xb, 0x0, 0x0, 0x10, '\x00'/16}})
executing program 2:
r0 = socket$nl_route(0x10, 0x3, 0x0)
ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000100)={'lo\x00', <r1=>0x0})
sendmsg$nl_route_sched(r0, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000080)={&(0x7f00000000c0)=@newqdisc={0x3c, 0x24, 0x601, 0x1, 0x0, {0x0, 0x0, 0x0, r1, {}, {0xffff, 0xffff}}, [@TCA_INGRESS_BLOCK={0x8, 0x0, 0x1}]}}}, 0x0)
executing program 2:
r0 = socket$nl_route(0x10, 0x3, 0x0)
write(r0, &(0x7f0000000000)="600000001800050601000000000000000a400000fe040001000000001400010020010db800010000000000000000000108000400010000000600150003000000200016800c0001001234567890abcdef05000800010000000500070002000000", 0x60)
write(r0, &(0x7f0000000000)="600000001800050601000000000000000a400000fe040001000000001400010020010db800020000000000000000000108000400010000000600150003000000200016800c0001001234567890abcdef05000800010000000500070002000000", 0x60)
write(r0, &(0x7f0000000000)="600000001800050601000000000000000a400000fe040001000000001400010020010db800030000000000000000000108000400010000000600150003000000200016800c0001001234567890abcdef05000800010000000500070002000000", 0x60)
write(r0, &(0x7f0000000000)="600000001800050601000000000000000a400000fe040001000000001400010020010db800040000000000000000000108000400010000000600150003000000200016800c0001001234567890abcdef05000800010000000500070002000000", 0x60)
write(r0, &(0x7f0000000000)="600000001800050601000000000000000a400000fe040001000000001400010020010db800050000000000000000000108000400010000000600150003000000200016800c0001001234567890abcdef05000800010000000500070002000000", 0x60)
write(r0, &(0x7f0000000000)="600000001800050601000000000000000a400000fe040001000000001400010020010db800060000000000000000000108000400010000000600150003000000200016800c0001001234567890abcdef05000800010000000500070002000000", 0x60)
write(r0, &(0x7f0000000000)="600000001800050601000000000000000a400000fe040001000000001400010020010db800070000000000000000000108000400010000000600150003000000200016800c0001001234567890abcdef05000800010000000500070002000000", 0x60)
write(r0, &(0x7f0000000000)="600000001800050601000000000000000a400000fe040001000000001400010020010db800080000000000000000000108000400010000000600150003000000200016800c0001001234567890abcdef05000800010000000500070002000000", 0x60)
write(r0, &(0x7f0000000000)="600000001800050601000000000000000a400000fe040001000000001400010020010db800090000000000000000000108000400010000000600150003000000200016800c0001001234567890abcdef05000800010000000500070002000000", 0x60)
write(r0, &(0x7f0000000000)="600000001800050601000000000000000a400000fe040001000000001400010020010db8000a0000000000000000000108000400010000000600150003000000200016800c0001001234567890abcdef05000800010000000500070002000000", 0x60)
write(r0, &(0x7f0000000000)="600000001800050601000000000000000a400000fe040001000000001400010020010db8000b0000000000000000000108000400010000000600150003000000200016800c0001001234567890abcdef05000800010000000500070002000000", 0x60)
write(r0, &(0x7f0000000000)="600000001800050601000000000000000a400000fe040001000000001400010020010db8000c0000000000000000000108000400010000000600150003000000200016800c0001001234567890abcdef05000800010000000500070002000000", 0x60)
write(r0, &(0x7f0000000000)="600000001800050601000000000000000a400000fe040001000000001400010020010db8000d0000000000000000000108000400010000000600150003000000200016800c0001001234567890abcdef05000800010000000500070002000000", 0x60)
write(r0, &(0x7f0000000000)="600000001800050601000000000000000a400000fe040001000000001400010020010db8000e0000000000000000000108000400010000000600150003000000200016800c0001001234567890abcdef05000800010000000500070002000000", 0x60)
write(r0, &(0x7f0000000000)="600000001800050601000000000000000a400000fe040001000000001400010020010db8000f0000000000000000000108000400010000000600150003000000200016800c0001001234567890abcdef05000800010000000500070002000000", 0x60)
write(r0, &(0x7f0000000000)="600000001800050601000000000000000a400000fe040001000000001400010020010db800100000000000000000000108000400010000000600150003000000200016800c0001001234567890abcdef05000800010000000500070002000000", 0x60)
write(r0, &(0x7f0000000000)="600000001800050601000000000000000a400000fe040001000000001400010020010db800110000000000000000000108000400010000000600150003000000200016800c0001001234567890abcdef05000800010000000500070002000000", 0x60)
write(r0, &(0x7f0000000000)="600000001800050601000000000000000a400000fe040001000000001400010020010db800120000000000000000000108000400010000000600150003000000200016800c0001001234567890abcdef05000800010000000500070002000000", 0x60)
write(r0, &(0x7f0000000000)="600000001800050601000000000000000a400000fe040001000000001400010020010db800130000000000000000000108000400010000000600150003000000200016800c0001001234567890abcdef05000800010000000500070002000000", 0x60)
write(r0, &(0x7f0000000000)="600000001800050601000000000000000a400000fe040001000000001400010020010db800140000000000000000000108000400010000000600150003000000200016800c0001001234567890abcdef05000800010000000500070002000000", 0x60)
write(r0, &(0x7f0000000000)="600000001800050601000000000000000a400000fe040001000000001400010020010db800150000000000000000000108000400010000000600150003000000200016800c0001001234567890abcdef05000800010000000500070002000000", 0x60)
write(r0, &(0x7f0000000000)="600000001800050601000000000000000a400000fe040001000000001400010020010db800160000000000000000000108000400010000000600150003000000200016800c0001001234567890abcdef05000800010000000500070002000000", 0x60)
write(r0, &(0x7f0000000000)="600000001800050601000000000000000a400000fe040001000000001400010020010db800170000000000000000000108000400010000000600150003000000200016800c0001001234567890abcdef05000800010000000500070002000000", 0x60)
write(r0, &(0x7f0000000000)="600000001800050601000000000000000a400000fe040001000000001400010020010db800180000000000000000000108000400010000000600150003000000200016800c0001001234567890abcdef05000800010000000500070002000000", 0x60)
write(r0, &(0x7f0000000000)="600000001800050601000000000000000a400000fe040001000000001400010020010db800190000000000000000000108000400010000000600150003000000200016800c0001001234567890abcdef05000800010000000500070002000000", 0x60)
write(r0, &(0x7f0000000000)="600000001800050601000000000000000a400000fe040001000000001400010020010db8001a0000000000000000000108000400010000000600150003000000200016800c0001001234567890abcdef05000800010000000500070002000000", 0x60)
write(r0, &(0x7f0000000000)="600000001800050601000000000000000a400000fe040001000000001400010020010db8001b0000000000000000000108000400010000000600150003000000200016800c0001001234567890abcdef05000800010000000500070002000000", 0x60)
write(r0, &(0x7f0000000000)="600000001800050601000000000000000a400000fe040001000000001400010020010db8001c0000000000000000000108000400010000000600150003000000200016800c0001001234567890abcdef05000800010000000500070002000000", 0x60)
write(r0, &(0x7f0000000000)="600000001800050601000000000000000a400000fe040001000000001400010020010db8001d0000000000000000000108000400010000000600150003000000200016800c0001001234567890abcdef05000800010000000500070002000000", 0x60)
write(r0, &(0x7f0000000000)="600000001800050601000000000000000a400000fe040001000000001400010020010db8001e0000000000000000000108000400010000000600150003000000200016800c0001001234567890abcdef05000800010000000500070002000000", 0x60)
write(r0, &(0x7f0000000000)="600000001800050601000000000000000a400000fe040001000000001400010020010db8001f0000000000000000000108000400010000000600150003000000200016800c0001001234567890abcdef05000800010000000500070002000000", 0x60)
write(r0, &(0x7f0000000000)="600000001800050601000000000000000a400000fe040001000000001400010020010db800200000000000000000000108000400010000000600150003000000200016800c0001001234567890abcdef05000800010000000500070002000000", 0x60)
write(r0, &(0x7f0000000000)="600000001800050601000000000000000a400000fe040001000000001400010020010db800210000000000000000000108000400010000000600150003000000200016800c0001001234567890abcdef05000800010000000500070002000000", 0x60)
write(r0, &(0x7f0000000000)="600000001800050601000000000000000a400000fe040001000000001400010020010db800220000000000000000000108000400010000000600150003000000200016800c0001001234567890abcdef05000800010000000500070002000000", 0x60)
write(r0, &(0x7f0000000000)="600000001800050601000000000000000a400000fe040001000000001400010020010db800230000000000000000000108000400010000000600150003000000200016800c0001001234567890abcdef05000800010000000500070002000000", 0x60)
write(r0, &(0x7f0000000200)="1c0000001a00010103000000000000000a00"/28, 0x1c)
recvmsg(r0, &(0x7f0000000100)={0x0, 0x0, &(0x7f0000000200)=[{&(0x7f0000000300)=""/4096, 0x1000}], 0x1}, 0x0)
executing program 2:
r0 = socket$nl_route(0x10, 0x3, 0x0)
sendmsg$nl_route(r0, &(0x7f0000000000)={&(0x7f0000000040), 0x10, &(0x7f0000000100)={&(0x7f0000000200)=@newlink={0x0, 0x10, 0x1, 0x0, 0x0, {0x0, 0x0, 0x0, 0x0, 0x100, 0x100}}}}, 0x0)
executing program 2:
mkdirat(0xffffffffffffff9c, &(0x7f0000000100)='./debug\x00', 0x1ff)
mount(0x0, &(0x7f0000000100)='./debug\x00', &(0x7f0000000140)='debugfs\x00', 0x0, 0x0)
mkdirat(0xffffffffffffff9c, &(0x7f0000000600)='./file0\x00', 0x1ff)
pipe2$9p(&(0x7f0000000000)={<r0=>0x0, <r1=>0x0}, 0x0)
r2 = openat(0xffffffffffffff9c, &(0x7f0000000200)='./debug/failslab/probability\x00', 0x1, 0x0)
write(r2, &(0x7f0000000300)='100\x00', 0x4)
r3 = openat(0xffffffffffffff9c, &(0x7f0000000400)='./debug/failslab/times\x00', 0x1, 0x0)
write(r3, &(0x7f0000000500)='100\x00', 0x4)
syz_clone(0x11, 0x0, 0x0, 0x0, 0x0, 0x0)
mount$9p_fd(0x0, &(0x7f0000000600)='./file0\x00', &(0x7f0000000700), 0x0, &(0x7f0000000800)={'trans=fd,', {'rfdno', 0x3d, r0}, 0x2c, {'wfdno', 0x3d, r1}, 0x2c, {[{@version_9p2000}, {@msize={'msize', 0x3d, 0x1000}}]}})
write$P9_RVERSION(r1, &(0x7f0000000900)={0x13, 0x65, 0xffff, 0x1000, 0x6, '9P2000'}, 0x13)
write$P9_RATTACH(r1, &(0x7f0000000a00)={0x13, 0x69, 0x1}, 0x13)
write$P9_RSTAT(r1, &(0x7f0000000b00)={0x0, 0x77, 0x1}, 0x13)
openat(0xffffffffffffff9c, &(0x7f0000000600)='./file0\x00', 0x0, 0x0)
executing program 2:
r0 = socket$nl_netfilter(0x10, 0x3, 0xc)
sendmsg$NFNL_MSG_CTHELPER_NEW(r0, &(0x7f0000000040), 0x0)
r1 = socket$inet_tcp(0x2, 0x1, 0x0)
bind$inet(r1, &(0x7f0000000200)={0x2, 0xbb06, @empty}, 0x10)
listen(r1, 0x5)
r2 = socket$inet_tcp(0x2, 0x1, 0x0)
connect$inet(r2, &(0x7f0000000220)={0x2, 0xbb06, @loopback}, 0x10)
r3 = accept(r1, 0x0, 0x0)
sendto$inet(r2, &(0x7f0000000300)="009c00011a2b3c4d0001000001000000000000010000000100010001", 0x1c, 0x0, 0x0, 0x0)
sendto$inet(r3, &(0x7f0000000400)="009c00011a2b3c4d0002000001000100000000010000000100010001", 0x1c, 0x0, 0x0, 0x0)
sendto$inet(r2, &(0x7f0000000500)="00a800011a2b3c4d0007000012340001000000010000000100010001000100000000", 0x22, 0x0, 0x0, 0x0)
sendto$inet(r3, &(0x7f0000000600)="002000011a2b3c4d00080000567812340100"/32, 0x20, 0x0, 0x0, 0x0)
executing program 4:
r0 = socket$inet6_udp(0xa, 0x2, 0x11)
setsockopt$IP6T_SO_SET_REPLACE(r0, 0x29, 0x40, &(0x7f0000000000)=@mangle={'mangle\x00', 0x1d, 0x6, 0x660, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x6, &(0x7f00000006c0), {[{{@uncond, 0x0, 0xa8, 0xd0}, @common=@unspec=@NFQUEUE2={0x28, 'NFQUEUE\x00', 0x2, {0x0, 0x5}}}, {{@ipv6={@mcast1, @local, [], [], 'macvtap0\x00', 'ip6tnl0\x00', {}, {}, 0x11}, 0x0, 0xa8, 0xe8}, @inet=@TPROXY1={0x40, 'TPROXY\x00', 0x1, {0x0, 0x0, @ipv4=@broadcast}}}, {{@ipv6={@mcast2, @loopback, [], [], 'veth0_to_team\x00', 'syzkaller0\x00', {}, {}, 0x0, 0x0, 0x0, 0x24}, 0x0, 0x108, 0x130, 0x0, {}, [@common=@unspec=@time={{0x38}, {0x100, 0x8, 0xb34f, 0x57c1, 0xffff, 0x6}}, @common=@inet=@socket1={{0x28}}]}, @common=@unspec=@MARK={0x28}}, {{@uncond, 0x0, 0x108, 0x130, 0x0, {}, [@common=@frag={{0x30}}, @common=@ah={{0x30}, {[0x4d2, 0x4d4], 0x6, 0x2, 0x2}}]}, @inet=@DSCP={0x28}}, {{@uncond, 0x0, 0x138, 0x178, 0x0, {}, [@common=@dst={{0x48}}, @common=@dst={{0x48}}]}, @inet=@TPROXY1={0x40, 'TPROXY\x00', 0x1, {0x0, 0x0, @ipv4=@dev}}}], {{'\x00', 0x0, 0xa8, 0xd0}, {0x28}}}}, 0x6c0)
executing program 4:
r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000240), 0x2, 0x0)
ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000040)={'syzkaller0\x00', 0x1001})
r1 = socket$nl_route(0x10, 0x3, 0x0)
ioctl$sock_SIOCGIFINDEX(r1, 0x8933, &(0x7f0000000100)={'syzkaller0\x00', <r2=>0x0})
ioctl$sock_inet_SIOCSIFFLAGS(r1, 0x8914, &(0x7f0000000100)={'syzkaller0\x00', 0x1})
sendmsg$nl_route_sched(r1, &(0x7f00000000c0)={&(0x7f0000000000), 0x0, &(0x7f0000000140)={&(0x7f0000000180)=@newqdisc={0x30, 0x24, 0x401, 0x0, 0x0, {0x0, 0x0, 0x0, r2, {0x0, 0xffff}, {0xffff, 0xffff}}, [@qdisc_kind_options=@q_ingress={0xc}]}, 0x30}}, 0x0)
sendmsg$nl_route_sched(r1, &(0x7f00000001c0)={&(0x7f0000000000), 0x0, &(0x7f0000000200)={&(0x7f0000000340)=@newtfilter={0x94, 0x2c, 0x401, 0x0, 0x0, {0x0, 0x0, 0x0, r2, {0x1}, {0x300}}, [@filter_kind_options=@f_matchall={{0xd}, {0x60, 0x2, [@TCA_MATCHALL_ACT={0x5c, 0x1, [@m_nat={0x58, 0x1, 0x0, 0x0, {{0x8}, {0x2c, 0x2, 0x0, 0x1, [@TCA_NAT_PARMS={0x28, 0x1, {{}, @private=0xa010101, @private=0xa010102}}]}, {0x7, 0x3, "001122"}, {0xc, 0x4}, {0xc, 0x5}}}]}]}}]}, 0x94}}, 0x0)
write(r0, &(0x7f0000000300)="4500001c00010000400100000a0000010a0000020800f7ff00000000", 0x1c)
executing program 4:
mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./nfsd\x00', 0x1ff)
mount(0x0, &(0x7f0000000000)='./nfsd\x00', &(0x7f0000000100)='nfsd\x00', 0x0, 0x0)
r0 = openat(0xffffffffffffff9c, &(0x7f0000000000)='./nfsd/portlist\x00', 0x1, 0x0)
write(r0, &(0x7f0000000300)='+tcp\n\x00', 0x5)
r1 = openat(0xffffffffffffff9c, &(0x7f0000000000)='./nfsd/threads\x00', 0x1, 0x0)
write(r1, &(0x7f0000000100)='1\n\x00', 0x2)
r2 = socket$inet_tcp(0x2, 0x1, 0x6)
bind$inet(r2, &(0x7f0000000200)={0x2, 0x8008, @loopback}, 0x10)
listen(r2, 0x5)
r3 = socket$inet_tcp(0x2, 0x1, 0x6)
connect$inet(r3, &(0x7f0000000200)={0x2, 0x8008, @loopback}, 0x10)
write(r3, &(0x7f0000000400)="80000028123456780000000000000002000186a300000003000000000000000700"/44, 0x2c)
r4 = socket$nl_generic(0x10, 0x3, 0x10)
sendmsg$nl_generic(r4, &(0x7f0000000600)={0x0, 0x0, &(0x7f0000000700)={&(0x7f0000000800)={0x14, 0x10, 0x1, 0x0, 0x0, {0x1}}, 0x14}}, 0x0)
executing program 4:
r0 = socket$nl_route(0x10, 0x3, 0x0)
sendmsg$nl_route(r0, &(0x7f0000000100)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000010)=@newnexthop={0x24, 0x68, 0x601, 0x0, 0x0, {}, [@NHA_ID={0x8, 0x1, 0x1}, @NHA_BLACKHOLE={0x4}]}, 0x24}}, 0x0)
sendmsg$nl_route(r0, &(0x7f0000000100)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000010)=@newnexthop={0x2c, 0x68, 0x601, 0x0, 0x0, {}, [@NHA_ID={0x8, 0x1, 0x2}, @NHA_GROUP={0xc, 0x2, [{0x1, 0x1}]}]}, 0x2c}}, 0x0)
sendmsg$nl_route(r0, &(0x7f0000000100)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000010)=@getnexthop={0x20, 0x6a, 0x1, 0x0, 0x0, {}, [@NHA_ID={0x8, 0x1, 0x2}]}, 0x20}}, 0x0)
executing program 3:
r0 = socket$inet_tcp(0x2, 0x1, 0x6)
bind$inet(r0, &(0x7f0000000000)={0x2, 0x801, @loopback}, 0x10)
listen(r0, 0x5)
r1 = fsopen(&(0x7f0000000100)='nfs\x00', 0x0)
fsconfig$FSCONFIG_SET_STRING(r1, 0x1, &(0x7f0000000140)='source\x00', &(0x7f0000000180)='127.0.0.1:/export\x00', 0x0)
fsconfig$FSCONFIG_SET_STRING(r1, 0x1, &(0x7f00000001c0)='addr\x00', &(0x7f0000000200)='127.0.0.1\x00', 0x0)
fsconfig$FSCONFIG_SET_STRING(r1, 0x1, &(0x7f0000000240)='port\x00', &(0x7f0000000280)='2049\x00', 0x0)
fsconfig$FSCONFIG_SET_STRING(r1, 0x1, &(0x7f00000002c0)='vers\x00', &(0x7f0000000300)='4.0\x00', 0x0)
fsconfig$FSCONFIG_CMD_CREATE(r1, 0x6, 0x0, 0x0, 0x0) (async)
r2 = accept(r0, 0x0, 0x0)
read(r2, &(0x7f0000000400)=""/256, 0x100)
write(r2, &(0x7f0000000500)="80000100000000000000000100"/36, 0x24)
nanosleep(&(0x7f0000000600)={0x0, 0x5f5e100}, 0x0)
executing program 0:
mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./nfsd\x00', 0x1ff)
mount(&(0x7f0000000040)=@filename='nfsd\x00', &(0x7f0000000080)='./nfsd\x00', &(0x7f00000000c0)='nfsd\x00', 0x0, 0x0)
r0 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./nfsd/versions\x00', 0x1, 0x0)
write(r0, &(0x7f0000000180)='-2 -3 -4\n\x00', 0x9)
r1 = socket$inet(0x2, 0x1, 0x6)
bind$inet(r1, &(0x7f0000000200)={0x2, 0x0, @empty}, 0x10)
listen(r1, 0x5)
r2 = openat(0xffffffffffffff9c, &(0x7f0000000280)='./nfsd/portlist\x00', 0x1, 0x0)
write(r2, &(0x7f0000000300)='4\n\x00', 0x2)
write(r0, &(0x7f0000000380)='+3 +4\n\x00', 0x6)
r3 = openat(0xffffffffffffff9c, &(0x7f0000000400)='./nfsd/threads\x00', 0x1, 0x0)
write(r3, &(0x7f0000000500)='1\n\x00', 0x2)
mkdirat(0xffffffffffffff9c, &(0x7f0000000600)='./proc\x00', 0x1ff)
mount(&(0x7f0000000040)=@filename='proc\x00', &(0x7f0000000600)='./proc\x00', &(0x7f0000000640)='proc\x00', 0x0, 0x0)
r4 = openat(0xffffffffffffff9c, &(0x7f0000000680)='./proc/net/rpc/auth.rpcsec.context/channel\x00', 0x1, 0x0)
write(r4, &(0x7f0000000700)='\\x01000000 2147483647 0 0 0 krb5 \\x00000000ffffff7f00000000000000001100000000000000000000000000000000000000 root\n\x00', 0x61)
r5 = socket$inet(0x2, 0x1, 0x6)
connect$inet(r5, &(0x7f0000000800)={0x2, 0x0, @empty}, 0x10)
write(r5, &(0x7f0000000900)="123456780000000000000002000186a300000003000000000000000600000018000000010000000200000000000000010000000401000000000000060000001c040400ffffffffff00"/92, 0x54)
nanosleep(&(0x7f0000000a00)={0x0, 0x5f5e100}, 0x0)
executing program 0:
r0 = socket$inet6_tcp(0xa, 0x1, 0x6)
bind$inet6(r0, &(0x7f0000000000)={0xa, 0x4e22, 0x0, @empty}, 0x1c)
listen(r0, 0x10)
r1 = socket$inet6_tcp(0xa, 0x1, 0x6)
bind$inet6(r1, &(0x7f0000000080)={0xa, 0x4e23, 0x0, @empty}, 0x1c)
connect$inet6(r1, &(0x7f0000000040)={0xa, 0x4e22, 0x0, @loopback}, 0x1c)
r2 = accept$inet6(r0, 0x0, 0x0)
write(r1, &(0x7f0000000100)='hello', 0x5)
write(r2, &(0x7f0000000140)='world', 0x5)
syz_emit_ethernet(0x4a, &(0x7f0000000200)={@local, @remote, @void, {@ipv6={0x86dd, @tcp={0x0, 0x6, '\x00', 0x14, 0x6, 0xff, @loopback, @loopback, {[], {{0x4e23, 0x4e22, 0x1, 0x1, 0x0, 0x0, 0x5, 0x18, 0x1000}}}}}}}, 0x0)
executing program 0:
mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./nfsd\x00', 0x1ff)
mount(0x0, &(0x7f0000000000)='./nfsd\x00', &(0x7f0000000100)='nfsd\x00', 0x0, 0x0)
r0 = openat(0xffffffffffffff9c, &(0x7f0000000000)='./nfsd/threads\x00', 0x1, 0x0)
write(r0, &(0x7f0000000100)='1\n\x00', 0x2)
r1 = socket$inet_tcp(0x2, 0x1, 0x6)
bind$inet(r1, &(0x7f0000000200)={0x2, 0x8008, @loopback}, 0x10)
listen(r1, 0x5)
r2 = openat(0xffffffffffffff9c, &(0x7f0000000000)='./nfsd/portlist\x00', 0x1, 0x0)
write(r2, &(0x7f0000000300)='3\n\x00', 0x2)
r3 = socket$inet_tcp(0x2, 0x1, 0x6)
connect$inet(r3, &(0x7f0000000200)={0x2, 0x8008, @loopback}, 0x10)
write(r3, &(0x7f0000000400)="80000028123456780000000000000002000186a300000003000000000000000700"/44, 0x2c)
r4 = socket$nl_generic(0x10, 0x3, 0x10)
sendmsg$nl_generic(r4, &(0x7f0000000600)={0x0, 0x0, &(0x7f0000000700)={&(0x7f0000000800)={0x14, 0x10, 0x1, 0x0, 0x0, {0x1}}, 0x14}}, 0x0)
executing program 0:
mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./nfsd\x00', 0x1ff)
mount(&(0x7f0000000040)=@filename='none\x00', &(0x7f0000000080)='./nfsd\x00', &(0x7f00000000c0)='nfsd\x00', 0x0, 0x0)
r0 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./nfsd/versions\x00', 0x2, 0x0)
write(r0, &(0x7f0000000140)='-2 -3 +4\n\x00', 0x9)
r1 = openat(0xffffffffffffff9c, &(0x7f0000000180)='./nfsd/portlist\x00', 0x2, 0x0)
write(r1, &(0x7f00000001c0)='tcp 20000\n\x00', 0xa)
r2 = openat(0xffffffffffffff9c, &(0x7f0000000200)='./nfsd/threads\x00', 0x2, 0x0)
write(r2, &(0x7f0000000240)='1\n\x00', 0x2) (async)
nanosleep(&(0x7f0000000300)={0x2}, 0x0)
nanosleep(&(0x7f0000000300)={0x2}, 0x0)
write(r2, &(0x7f0000000240)='1\n\x00', 0x2)
r3 = socket$inet(0x2, 0x1, 0x0)
connect$inet(r3, &(0x7f0000000280)={0x2, 0x4e20, @loopback}, 0x10)
nanosleep(&(0x7f0000000300)={0x0, 0x2faf080}, 0x0)
r4 = socket$inet(0x2, 0x1, 0x0)
connect$inet(r4, &(0x7f0000000380)={0x2, 0x4e20, @loopback}, 0x10)
nanosleep(&(0x7f0000000300)={0x0, 0x2faf080}, 0x0)
executing program 1:
r0 = socket$nl_route(0x10, 0x3, 0x0)
sendmsg$nl_route(r0, &(0x7f0000000080)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000100)=@newlink={0x50, 0x10, 0x601, 0x0, 0x0, {}, [@IFLA_IFNAME={0x14, 0x3, 'veth1\x00'}, @IFLA_NUM_TX_QUEUES={0x8, 0x1f, 0x4}, @IFLA_LINKINFO={0x14, 0x12, 0x0, 0x1, @veth={{0x9}, {0x4, 0x2, 0x0, 0x1, @void}}}]}, 0x50}}, 0x0)
r1 = socket$inet(0x2, 0x2, 0x0)
ioctl$sock_SIOCGIFINDEX(r1, 0x8933, &(0x7f0000000400)={'veth1\x00', <r2=>0x0})
sendmsg$nl_route_sched(r0, &(0x7f0000000180)={0x0, 0x0, &(0x7f00000001c0)={&(0x7f0000000200)=@newqdisc={0x34, 0x24, 0x601, 0x0, 0x0, {0x0, 0x0, 0x0, r2}, [@qdisc_kind_options=@q_cake={{0x9}, {0x4}}]}, 0x34}}, 0x0)
executing program 1:
r0 = socket$nl_netfilter(0x10, 0x3, 0xc)
sendmsg$NFULNL_MSG_CONFIG(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000000200)={0x1c, 0x1, 0x4, 0x1, 0x0, 0x0, {0x2}, [@NFULA_CFG_CMD={0x5, 0x1, 0x3}]}, 0x1c}}, 0x0)
sendmsg$NFULNL_MSG_CONFIG(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000000200)={0x1c, 0x1, 0x4, 0x1, 0x0, 0x0, {0x2}, [@NFULA_CFG_CMD={0x5, 0x1, 0x1}]}, 0x1c}}, 0x0)
sendmsg$NFULNL_MSG_CONFIG(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000000200)={0x20, 0x1, 0x4, 0x1, 0x0, 0x0, {0x2}, [@NFULA_CFG_MODE={0xa, 0x2, {0xffff, 0x2}}]}, 0x20}}, 0x0)
sendmsg$NFT_BATCH(r0, &(0x7f0000000300)={0x0, 0x0, &(0x7f0000000400)={&(0x7f0000000500)={{0x14, 0x10, 0x1, 0x0, 0x0, {0x2, 0x0, 0x0}}, [@NFT_MSG_NEWTABLE={0x20, 0x0, 0xa, 0x401, 0x0, 0x0, {0x2}, [@NFTA_TABLE_NAME={0x9, 0x1, 'syz0\x00'}]}, @NFT_MSG_NEWCHAIN={0x40, 0x3, 0xa, 0x401, 0x0, 0x0, {0x2}, [@NFTA_CHAIN_TABLE={0x9, 0x1, 'syz0\x00'}, @NFTA_CHAIN_NAME={0x9, 0x3, 'syz0\x00'}, @NFTA_CHAIN_HOOK={0x14, 0x4, 0x0, 0x1, [@NFTA_HOOK_HOOKNUM={0x8, 0x1, 0x1, 0x0, 0x1}, @NFTA_HOOK_PRIORITY={0x8}]}]}, @NFT_MSG_NEWRULE={0x48, 0x6, 0xa, 0x401, 0x0, 0x0, {0x2}, [@NFTA_RULE_TABLE={0x9, 0x1, 'syz0\x00'}, @NFTA_RULE_CHAIN={0x9, 0x2, 'syz0\x00'}, @NFTA_RULE_EXPRESSIONS={0x1c, 0x4, 0x0, 0x1, [{0x18, 0x1, 0x0, 0x1, @log={{0x8}, @val={0xc, 0x2, 0x0, 0x1, [@NFTA_LOG_GROUP={0x6}]}}}]}]}], {0x14, 0x11, 0x1, 0x0, 0x0, {0x2, 0x0, 0x0}}}, 0xd0}}, 0x0)
r1 = socket$inet_udp(0x2, 0x2, 0x0)
sendto$inet(r1, &(0x7f0000000600)="00112233445566778899", 0xa, 0x0, &(0x7f0000000700)={0x2, 0x1234, @loopback}, 0x10)
executing program 1:
r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0)
ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000100)={'syzkaller0\x00', 0x1})
r1 = socket$inet(0x2, 0x2, 0x0)
ioctl$sock_inet_SIOCSIFFLAGS(r1, 0x8914, &(0x7f0000000200)={'syzkaller0\x00', 0x1})
r2 = socket$nl_route(0x10, 0x3, 0x0)
sendmsg$nl_route_sched(r2, &(0x7f0000000300)={0x0, 0x0, &(0x7f0000000400)={&(0x7f0000000500)=@newqdisc={0x30, 0x24, 0x601, 0x0, 0x0, {0x0, 0x0, 0x0, 0x0, {}, {0xf1, 0xff}}, [@qdisc_kind_options=@q_ingress={0xc}]}, 0x30}}, 0x0)
sendmsg$nl_route_sched(r2, &(0x7f0000000600)={0x0, 0x0, &(0x7f0000000700)={&(0x7f0000000800)=@newtfilter={0x6c, 0x2c, 0x601, 0x0, 0x0, {0x0, 0x0, 0x0, 0x0, {}, {0xf1, 0xff}, {0x0, 0x3}}, [@filter_kind_options=@f_matchall={{0xd}, {0x4}}]}, 0x6c}}, 0x0)
executing program 1:
mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./debug\x00', 0x1ed)
mount(&(0x7f0000000040)=@filename='none\x00', &(0x7f0000000080)='./debug\x00', &(0x7f00000000c0)='debugfs\x00', 0x0, 0x0)
r0 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./debug/failslab/probability\x00', 0x1, 0x0)
r1 = openat(0xffffffffffffff9c, &(0x7f0000000180)='./debug/failslab/times\x00', 0x1, 0x0)
r2 = openat(0xffffffffffffff9c, &(0x7f0000000200)='./debug/fail_page_alloc/probability\x00', 0x1, 0x0)
r3 = openat(0xffffffffffffff9c, &(0x7f0000000280)='./debug/fail_page_alloc/times\x00', 0x1, 0x0)
socket$packet(0x11, 0x3, 0x300)
r4 = socket$inet_udp(0x2, 0x2, 0x0)
write(r1, &(0x7f00000001c0)='1000\x00', 0x4)
write(r3, &(0x7f00000002c0)='1000\x00', 0x4)
write(r0, &(0x7f0000000140)='100\x00', 0x3)
write(r2, &(0x7f0000000240)='100\x00', 0x3)
sendto$inet(r4, &(0x7f0000000300)="11223344", 0x4, 0x0, &(0x7f0000000400)={0x2, 0x1234, @loopback}, 0x10)
executing program 1:
r0 = socket$nl_generic(0x10, 0x3, 0x10)
r1 = syz_genetlink_get_family_id$tipc2(&(0x7f0000000000), 0xffffffffffffffff)
r2 = socket$inet_udp(0x2, 0x2, 0x0)
bind$inet(r2, &(0x7f0000000100)={0x2, 0x1f91, @loopback}, 0x10)
sendmsg$TIPC_NL_BEARER_ENABLE(r0, &(0x7f0000000080)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000140)={0x54, r1, 0x1, 0x123, 0x234, {}, [@TIPC_NLA_BEARER={0x40, 0x1, 0x0, 0x1, [@TIPC_NLA_BEARER_NAME={0xd, 0x1, @udp='udp:syz0\x00'}, @TIPC_NLA_BEARER_UDP_OPTS={0x2c, 0x4, {{0x14, 0x1, @in={0x2, 0x1f90, @loopback}}, {0x14, 0x2, @in={0x2, 0x1f91, @loopback}}}}]}]}, 0x54}}, 0x0)
recvfrom$inet(r2, &(0x7f0000000200), 0x100, 0x0, 0x0, 0x0)

program did not crash
bisect: testing without sub-chunk 3/3
testing program (duration=1m45s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): [6, 3, 38, 2, 14, 12, 2, 8, 14, 4, 3, 5, 10, 4, 5, 4, 12, 4, 5, 5]
detailed listing:
executing program 2:
r0 = syz_open_procfs$namespace(0x0, &(0x7f0000000000)='ns/net\x00')
setns(r0, 0x40000000)
r1 = syz_open_procfs(0x0, &(0x7f0000000100)='net/dev\x00')
read(r1, &(0x7f0000000200), 0x1000)
r2 = socket$inet(0x2, 0x2, 0x0)
ioctl$sock_SIOCETHTOOL(r2, 0x8946, &(0x7f0000000300)={'lo\x00', &(0x7f0000000400)=@ethtool_eeprom={0xb, 0x0, 0x0, 0x10, '\x00'/16}})
executing program 2:
r0 = socket$nl_route(0x10, 0x3, 0x0)
ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000100)={'lo\x00', <r1=>0x0})
sendmsg$nl_route_sched(r0, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000080)={&(0x7f00000000c0)=@newqdisc={0x3c, 0x24, 0x601, 0x1, 0x0, {0x0, 0x0, 0x0, r1, {}, {0xffff, 0xffff}}, [@TCA_INGRESS_BLOCK={0x8, 0x0, 0x1}]}}}, 0x0)
executing program 2:
r0 = socket$nl_route(0x10, 0x3, 0x0)
write(r0, &(0x7f0000000000)="600000001800050601000000000000000a400000fe040001000000001400010020010db800010000000000000000000108000400010000000600150003000000200016800c0001001234567890abcdef05000800010000000500070002000000", 0x60)
write(r0, &(0x7f0000000000)="600000001800050601000000000000000a400000fe040001000000001400010020010db800020000000000000000000108000400010000000600150003000000200016800c0001001234567890abcdef05000800010000000500070002000000", 0x60)
write(r0, &(0x7f0000000000)="600000001800050601000000000000000a400000fe040001000000001400010020010db800030000000000000000000108000400010000000600150003000000200016800c0001001234567890abcdef05000800010000000500070002000000", 0x60)
write(r0, &(0x7f0000000000)="600000001800050601000000000000000a400000fe040001000000001400010020010db800040000000000000000000108000400010000000600150003000000200016800c0001001234567890abcdef05000800010000000500070002000000", 0x60)
write(r0, &(0x7f0000000000)="600000001800050601000000000000000a400000fe040001000000001400010020010db800050000000000000000000108000400010000000600150003000000200016800c0001001234567890abcdef05000800010000000500070002000000", 0x60)
write(r0, &(0x7f0000000000)="600000001800050601000000000000000a400000fe040001000000001400010020010db800060000000000000000000108000400010000000600150003000000200016800c0001001234567890abcdef05000800010000000500070002000000", 0x60)
write(r0, &(0x7f0000000000)="600000001800050601000000000000000a400000fe040001000000001400010020010db800070000000000000000000108000400010000000600150003000000200016800c0001001234567890abcdef05000800010000000500070002000000", 0x60)
write(r0, &(0x7f0000000000)="600000001800050601000000000000000a400000fe040001000000001400010020010db800080000000000000000000108000400010000000600150003000000200016800c0001001234567890abcdef05000800010000000500070002000000", 0x60)
write(r0, &(0x7f0000000000)="600000001800050601000000000000000a400000fe040001000000001400010020010db800090000000000000000000108000400010000000600150003000000200016800c0001001234567890abcdef05000800010000000500070002000000", 0x60)
write(r0, &(0x7f0000000000)="600000001800050601000000000000000a400000fe040001000000001400010020010db8000a0000000000000000000108000400010000000600150003000000200016800c0001001234567890abcdef05000800010000000500070002000000", 0x60)
write(r0, &(0x7f0000000000)="600000001800050601000000000000000a400000fe040001000000001400010020010db8000b0000000000000000000108000400010000000600150003000000200016800c0001001234567890abcdef05000800010000000500070002000000", 0x60)
write(r0, &(0x7f0000000000)="600000001800050601000000000000000a400000fe040001000000001400010020010db8000c0000000000000000000108000400010000000600150003000000200016800c0001001234567890abcdef05000800010000000500070002000000", 0x60)
write(r0, &(0x7f0000000000)="600000001800050601000000000000000a400000fe040001000000001400010020010db8000d0000000000000000000108000400010000000600150003000000200016800c0001001234567890abcdef05000800010000000500070002000000", 0x60)
write(r0, &(0x7f0000000000)="600000001800050601000000000000000a400000fe040001000000001400010020010db8000e0000000000000000000108000400010000000600150003000000200016800c0001001234567890abcdef05000800010000000500070002000000", 0x60)
write(r0, &(0x7f0000000000)="600000001800050601000000000000000a400000fe040001000000001400010020010db8000f0000000000000000000108000400010000000600150003000000200016800c0001001234567890abcdef05000800010000000500070002000000", 0x60)
write(r0, &(0x7f0000000000)="600000001800050601000000000000000a400000fe040001000000001400010020010db800100000000000000000000108000400010000000600150003000000200016800c0001001234567890abcdef05000800010000000500070002000000", 0x60)
write(r0, &(0x7f0000000000)="600000001800050601000000000000000a400000fe040001000000001400010020010db800110000000000000000000108000400010000000600150003000000200016800c0001001234567890abcdef05000800010000000500070002000000", 0x60)
write(r0, &(0x7f0000000000)="600000001800050601000000000000000a400000fe040001000000001400010020010db800120000000000000000000108000400010000000600150003000000200016800c0001001234567890abcdef05000800010000000500070002000000", 0x60)
write(r0, &(0x7f0000000000)="600000001800050601000000000000000a400000fe040001000000001400010020010db800130000000000000000000108000400010000000600150003000000200016800c0001001234567890abcdef05000800010000000500070002000000", 0x60)
write(r0, &(0x7f0000000000)="600000001800050601000000000000000a400000fe040001000000001400010020010db800140000000000000000000108000400010000000600150003000000200016800c0001001234567890abcdef05000800010000000500070002000000", 0x60)
write(r0, &(0x7f0000000000)="600000001800050601000000000000000a400000fe040001000000001400010020010db800150000000000000000000108000400010000000600150003000000200016800c0001001234567890abcdef05000800010000000500070002000000", 0x60)
write(r0, &(0x7f0000000000)="600000001800050601000000000000000a400000fe040001000000001400010020010db800160000000000000000000108000400010000000600150003000000200016800c0001001234567890abcdef05000800010000000500070002000000", 0x60)
write(r0, &(0x7f0000000000)="600000001800050601000000000000000a400000fe040001000000001400010020010db800170000000000000000000108000400010000000600150003000000200016800c0001001234567890abcdef05000800010000000500070002000000", 0x60)
write(r0, &(0x7f0000000000)="600000001800050601000000000000000a400000fe040001000000001400010020010db800180000000000000000000108000400010000000600150003000000200016800c0001001234567890abcdef05000800010000000500070002000000", 0x60)
write(r0, &(0x7f0000000000)="600000001800050601000000000000000a400000fe040001000000001400010020010db800190000000000000000000108000400010000000600150003000000200016800c0001001234567890abcdef05000800010000000500070002000000", 0x60)
write(r0, &(0x7f0000000000)="600000001800050601000000000000000a400000fe040001000000001400010020010db8001a0000000000000000000108000400010000000600150003000000200016800c0001001234567890abcdef05000800010000000500070002000000", 0x60)
write(r0, &(0x7f0000000000)="600000001800050601000000000000000a400000fe040001000000001400010020010db8001b0000000000000000000108000400010000000600150003000000200016800c0001001234567890abcdef05000800010000000500070002000000", 0x60)
write(r0, &(0x7f0000000000)="600000001800050601000000000000000a400000fe040001000000001400010020010db8001c0000000000000000000108000400010000000600150003000000200016800c0001001234567890abcdef05000800010000000500070002000000", 0x60)
write(r0, &(0x7f0000000000)="600000001800050601000000000000000a400000fe040001000000001400010020010db8001d0000000000000000000108000400010000000600150003000000200016800c0001001234567890abcdef05000800010000000500070002000000", 0x60)
write(r0, &(0x7f0000000000)="600000001800050601000000000000000a400000fe040001000000001400010020010db8001e0000000000000000000108000400010000000600150003000000200016800c0001001234567890abcdef05000800010000000500070002000000", 0x60)
write(r0, &(0x7f0000000000)="600000001800050601000000000000000a400000fe040001000000001400010020010db8001f0000000000000000000108000400010000000600150003000000200016800c0001001234567890abcdef05000800010000000500070002000000", 0x60)
write(r0, &(0x7f0000000000)="600000001800050601000000000000000a400000fe040001000000001400010020010db800200000000000000000000108000400010000000600150003000000200016800c0001001234567890abcdef05000800010000000500070002000000", 0x60)
write(r0, &(0x7f0000000000)="600000001800050601000000000000000a400000fe040001000000001400010020010db800210000000000000000000108000400010000000600150003000000200016800c0001001234567890abcdef05000800010000000500070002000000", 0x60)
write(r0, &(0x7f0000000000)="600000001800050601000000000000000a400000fe040001000000001400010020010db800220000000000000000000108000400010000000600150003000000200016800c0001001234567890abcdef05000800010000000500070002000000", 0x60)
write(r0, &(0x7f0000000000)="600000001800050601000000000000000a400000fe040001000000001400010020010db800230000000000000000000108000400010000000600150003000000200016800c0001001234567890abcdef05000800010000000500070002000000", 0x60)
write(r0, &(0x7f0000000200)="1c0000001a00010103000000000000000a00"/28, 0x1c)
recvmsg(r0, &(0x7f0000000100)={0x0, 0x0, &(0x7f0000000200)=[{&(0x7f0000000300)=""/4096, 0x1000}], 0x1}, 0x0)
executing program 2:
r0 = socket$nl_route(0x10, 0x3, 0x0)
sendmsg$nl_route(r0, &(0x7f0000000000)={&(0x7f0000000040), 0x10, &(0x7f0000000100)={&(0x7f0000000200)=@newlink={0x0, 0x10, 0x1, 0x0, 0x0, {0x0, 0x0, 0x0, 0x0, 0x100, 0x100}}}}, 0x0)
executing program 2:
mkdirat(0xffffffffffffff9c, &(0x7f0000000100)='./debug\x00', 0x1ff)
mount(0x0, &(0x7f0000000100)='./debug\x00', &(0x7f0000000140)='debugfs\x00', 0x0, 0x0)
mkdirat(0xffffffffffffff9c, &(0x7f0000000600)='./file0\x00', 0x1ff)
pipe2$9p(&(0x7f0000000000)={<r0=>0x0, <r1=>0x0}, 0x0)
r2 = openat(0xffffffffffffff9c, &(0x7f0000000200)='./debug/failslab/probability\x00', 0x1, 0x0)
write(r2, &(0x7f0000000300)='100\x00', 0x4)
r3 = openat(0xffffffffffffff9c, &(0x7f0000000400)='./debug/failslab/times\x00', 0x1, 0x0)
write(r3, &(0x7f0000000500)='100\x00', 0x4)
syz_clone(0x11, 0x0, 0x0, 0x0, 0x0, 0x0)
mount$9p_fd(0x0, &(0x7f0000000600)='./file0\x00', &(0x7f0000000700), 0x0, &(0x7f0000000800)={'trans=fd,', {'rfdno', 0x3d, r0}, 0x2c, {'wfdno', 0x3d, r1}, 0x2c, {[{@version_9p2000}, {@msize={'msize', 0x3d, 0x1000}}]}})
write$P9_RVERSION(r1, &(0x7f0000000900)={0x13, 0x65, 0xffff, 0x1000, 0x6, '9P2000'}, 0x13)
write$P9_RATTACH(r1, &(0x7f0000000a00)={0x13, 0x69, 0x1}, 0x13)
write$P9_RSTAT(r1, &(0x7f0000000b00)={0x0, 0x77, 0x1}, 0x13)
openat(0xffffffffffffff9c, &(0x7f0000000600)='./file0\x00', 0x0, 0x0)
executing program 2:
r0 = socket$nl_netfilter(0x10, 0x3, 0xc)
sendmsg$NFNL_MSG_CTHELPER_NEW(r0, &(0x7f0000000040), 0x0)
r1 = socket$inet_tcp(0x2, 0x1, 0x0)
bind$inet(r1, &(0x7f0000000200)={0x2, 0xbb06, @empty}, 0x10)
listen(r1, 0x5)
r2 = socket$inet_tcp(0x2, 0x1, 0x0)
connect$inet(r2, &(0x7f0000000220)={0x2, 0xbb06, @loopback}, 0x10)
r3 = accept(r1, 0x0, 0x0)
sendto$inet(r2, &(0x7f0000000300)="009c00011a2b3c4d0001000001000000000000010000000100010001", 0x1c, 0x0, 0x0, 0x0)
sendto$inet(r3, &(0x7f0000000400)="009c00011a2b3c4d0002000001000100000000010000000100010001", 0x1c, 0x0, 0x0, 0x0)
sendto$inet(r2, &(0x7f0000000500)="00a800011a2b3c4d0007000012340001000000010000000100010001000100000000", 0x22, 0x0, 0x0, 0x0)
sendto$inet(r3, &(0x7f0000000600)="002000011a2b3c4d00080000567812340100"/32, 0x20, 0x0, 0x0, 0x0)
executing program 4:
r0 = socket$inet6_udp(0xa, 0x2, 0x11)
setsockopt$IP6T_SO_SET_REPLACE(r0, 0x29, 0x40, &(0x7f0000000000)=@mangle={'mangle\x00', 0x1d, 0x6, 0x660, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x6, &(0x7f00000006c0), {[{{@uncond, 0x0, 0xa8, 0xd0}, @common=@unspec=@NFQUEUE2={0x28, 'NFQUEUE\x00', 0x2, {0x0, 0x5}}}, {{@ipv6={@mcast1, @local, [], [], 'macvtap0\x00', 'ip6tnl0\x00', {}, {}, 0x11}, 0x0, 0xa8, 0xe8}, @inet=@TPROXY1={0x40, 'TPROXY\x00', 0x1, {0x0, 0x0, @ipv4=@broadcast}}}, {{@ipv6={@mcast2, @loopback, [], [], 'veth0_to_team\x00', 'syzkaller0\x00', {}, {}, 0x0, 0x0, 0x0, 0x24}, 0x0, 0x108, 0x130, 0x0, {}, [@common=@unspec=@time={{0x38}, {0x100, 0x8, 0xb34f, 0x57c1, 0xffff, 0x6}}, @common=@inet=@socket1={{0x28}}]}, @common=@unspec=@MARK={0x28}}, {{@uncond, 0x0, 0x108, 0x130, 0x0, {}, [@common=@frag={{0x30}}, @common=@ah={{0x30}, {[0x4d2, 0x4d4], 0x6, 0x2, 0x2}}]}, @inet=@DSCP={0x28}}, {{@uncond, 0x0, 0x138, 0x178, 0x0, {}, [@common=@dst={{0x48}}, @common=@dst={{0x48}}]}, @inet=@TPROXY1={0x40, 'TPROXY\x00', 0x1, {0x0, 0x0, @ipv4=@dev}}}], {{'\x00', 0x0, 0xa8, 0xd0}, {0x28}}}}, 0x6c0)
executing program 4:
r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000240), 0x2, 0x0)
ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000040)={'syzkaller0\x00', 0x1001})
r1 = socket$nl_route(0x10, 0x3, 0x0)
ioctl$sock_SIOCGIFINDEX(r1, 0x8933, &(0x7f0000000100)={'syzkaller0\x00', <r2=>0x0})
ioctl$sock_inet_SIOCSIFFLAGS(r1, 0x8914, &(0x7f0000000100)={'syzkaller0\x00', 0x1})
sendmsg$nl_route_sched(r1, &(0x7f00000000c0)={&(0x7f0000000000), 0x0, &(0x7f0000000140)={&(0x7f0000000180)=@newqdisc={0x30, 0x24, 0x401, 0x0, 0x0, {0x0, 0x0, 0x0, r2, {0x0, 0xffff}, {0xffff, 0xffff}}, [@qdisc_kind_options=@q_ingress={0xc}]}, 0x30}}, 0x0)
sendmsg$nl_route_sched(r1, &(0x7f00000001c0)={&(0x7f0000000000), 0x0, &(0x7f0000000200)={&(0x7f0000000340)=@newtfilter={0x94, 0x2c, 0x401, 0x0, 0x0, {0x0, 0x0, 0x0, r2, {0x1}, {0x300}}, [@filter_kind_options=@f_matchall={{0xd}, {0x60, 0x2, [@TCA_MATCHALL_ACT={0x5c, 0x1, [@m_nat={0x58, 0x1, 0x0, 0x0, {{0x8}, {0x2c, 0x2, 0x0, 0x1, [@TCA_NAT_PARMS={0x28, 0x1, {{}, @private=0xa010101, @private=0xa010102}}]}, {0x7, 0x3, "001122"}, {0xc, 0x4}, {0xc, 0x5}}}]}]}}]}, 0x94}}, 0x0)
write(r0, &(0x7f0000000300)="4500001c00010000400100000a0000010a0000020800f7ff00000000", 0x1c)
executing program 4:
mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./nfsd\x00', 0x1ff)
mount(0x0, &(0x7f0000000000)='./nfsd\x00', &(0x7f0000000100)='nfsd\x00', 0x0, 0x0)
r0 = openat(0xffffffffffffff9c, &(0x7f0000000000)='./nfsd/portlist\x00', 0x1, 0x0)
write(r0, &(0x7f0000000300)='+tcp\n\x00', 0x5)
r1 = openat(0xffffffffffffff9c, &(0x7f0000000000)='./nfsd/threads\x00', 0x1, 0x0)
write(r1, &(0x7f0000000100)='1\n\x00', 0x2)
r2 = socket$inet_tcp(0x2, 0x1, 0x6)
bind$inet(r2, &(0x7f0000000200)={0x2, 0x8008, @loopback}, 0x10)
listen(r2, 0x5)
r3 = socket$inet_tcp(0x2, 0x1, 0x6)
connect$inet(r3, &(0x7f0000000200)={0x2, 0x8008, @loopback}, 0x10)
write(r3, &(0x7f0000000400)="80000028123456780000000000000002000186a300000003000000000000000700"/44, 0x2c)
r4 = socket$nl_generic(0x10, 0x3, 0x10)
sendmsg$nl_generic(r4, &(0x7f0000000600)={0x0, 0x0, &(0x7f0000000700)={&(0x7f0000000800)={0x14, 0x10, 0x1, 0x0, 0x0, {0x1}}, 0x14}}, 0x0)
executing program 4:
r0 = socket$nl_route(0x10, 0x3, 0x0)
sendmsg$nl_route(r0, &(0x7f0000000100)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000010)=@newnexthop={0x24, 0x68, 0x601, 0x0, 0x0, {}, [@NHA_ID={0x8, 0x1, 0x1}, @NHA_BLACKHOLE={0x4}]}, 0x24}}, 0x0)
sendmsg$nl_route(r0, &(0x7f0000000100)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000010)=@newnexthop={0x2c, 0x68, 0x601, 0x0, 0x0, {}, [@NHA_ID={0x8, 0x1, 0x2}, @NHA_GROUP={0xc, 0x2, [{0x1, 0x1}]}]}, 0x2c}}, 0x0)
sendmsg$nl_route(r0, &(0x7f0000000100)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000010)=@getnexthop={0x20, 0x6a, 0x1, 0x0, 0x0, {}, [@NHA_ID={0x8, 0x1, 0x2}]}, 0x20}}, 0x0)
executing program 4:
unshare(0x50000000)
unshare(0x50000000)
nanosleep(&(0x7f0000000000)={0x0, 0x5f5e100}, 0x0)
executing program 4:
r0 = socket$nl_generic(0x10, 0x3, 0x10)
r1 = syz_genetlink_get_family_id$ethtool(&(0x7f0000000000), r0)
syz_usb_connect(0x0, 0x39, &(0x7f0000000040)=ANY=[@ANYBLOB="12010002ffffff40950b901700010102030109022700010100a0320904000003ffff0000070581031000080705820200020007050302000200"], 0x0)
nanosleep(&(0x7f0000000200)={0x2}, 0x0)
sendmsg$ETHTOOL_MSG_EEE_SET(r0, &(0x7f0000000080)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000100)={0x34, r1, 0x1, 0x0, 0x0, {}, [@ETHTOOL_A_EEE_HEADER={0xc, 0x1, 0x0, 0x1, [@ETHTOOL_A_HEADER_DEV_INDEX={0x8, 0x1, 0x2}]}, @ETHTOOL_A_EEE_MODES_OURS={0x14, 0x2, 0x0, 0x1, [@ETHTOOL_A_BITSET_BITS={0x10, 0x3, 0x0, 0x1, [{0xc, 0x1, 0x0, 0x1, [@ETHTOOL_A_BITSET_BIT_INDEX={0x8}]}]}]}]}, 0x34}}, 0x0)
executing program 1:
r0 = socket$inet_tcp(0x2, 0x1, 0x0)
bind$inet(r0, &(0x7f0000000000)={0x2, 0x208, @loopback}, 0x10)
listen(r0, 0x5)
r1 = fsopen(&(0x7f0000000100)='nfs\x00', 0x0)
fsconfig$FSCONFIG_SET_STRING(r1, 0x1, &(0x7f0000000140)='addr\x00', &(0x7f0000000180)='127.0.0.1\x00', 0x0)
fsconfig$FSCONFIG_SET_STRING(r1, 0x1, &(0x7f00000001c0)='source\x00', &(0x7f0000000200)='127.0.0.1:/export\x00', 0x0)
fsconfig$FSCONFIG_SET_STRING(r1, 0x1, &(0x7f0000000240)='vers\x00', &(0x7f0000000280)='3\x00', 0x0)
fsconfig$FSCONFIG_SET_STRING(r1, 0x1, &(0x7f00000002c0)='mountport\x00', &(0x7f0000000300)='2049\x00', 0x0)
fsconfig$FSCONFIG_CMD_CREATE(r1, 0x6, 0x0, 0x0, 0x0) (async)
accept4(r0, &(0x7f0000000400)=@in={0x2, 0x0, @loopback}, &(0x7f0000000500)=0x10, 0x0)
executing program 3:
r0 = userfaultfd(0x1)
mmap(&(0x7f0000800000)=nil, 0x1000, 0x3, 0x32, 0xffffffff, 0x0)
ioctl$UFFDIO_API(r0, 0xc018aa3f, &(0x7f0000000100))
ioctl$UFFDIO_REGISTER(r0, 0xc020aa00, &(0x7f0000000200)={{0xffffffffffffffff, 0x1000}, 0x2})
executing program 3:
r0 = socket$netlink(0x10, 0x3, 0xc)
sendmsg$NFQNL_MSG_CONFIG(r0, &(0x7f0000000100)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000300)={0x28, 0x2, 0x3, 0x0, 0x0, 0x0, {0x2}, [@NFQA_CFG_CMD={0x8, 0x1, {0x1, 0x0, 0x2}}, @NFQA_CFG_PARAMS={0x9, 0x2, {0xffff, 0x2}}]}, 0x28}}, 0x0)
r1 = socket$inet_udp(0x2, 0x2, 0x0)
setsockopt$IPT_SO_SET_REPLACE(r1, 0x0, 0x40, &(0x7f0000000a00)=@filter={'filter\x00', 0xe, 0x4, 0x248, 0xffffffff, 0x0, 0x98, 0x128, 0xffffffff, 0xffffffff, 0x1b8, 0x1b8, 0x1b8, 0xffffffff, 0x4, 0x0, {[{{@uncond, 0x0, 0x70, 0x98}, @common=@unspec=@NFQUEUE3={0x28, 'NFQUEUE\x00', 0x3, {0x0, 0x1}}}, {{@uncond, 0x0, 0x70, 0x90}, @common=@unspec=@STANDARD={0x20, '\x00', 0x0, 0xfffffffe}}, {{@uncond, 0x0, 0x70, 0x90}, @common=@unspec=@STANDARD={0x20, '\x00', 0x0, 0xfffffffe}}], {{'\x00', 0x0, 0x70, 0x90}, {0x20}}}}, 0x0)
sendto$inet(r1, &(0x7f0000000500)="00010203040506070809", 0xa, 0x0, &(0x7f0000000600)={0x2, 0x1234, @loopback}, 0x10)
executing program 3:
r0 = socket$netlink(0x10, 0x3, 0x0)
write(r0, &(0x7f0000000000)="580000001800050401000000000000000a800000fe040002000000001400010020010db800000000000000000000000106001500070000001800160008000100010000000c000b0008000100020000000800040001000000", 0x58)
syz_emit_ethernet(0x6a, &(0x7f0000000200)=ANY=[@ANYBLOB="aaaaaaaaaaaaaaaaaaaa86dd6000000000342b4020010db800000000000000000000000220010db8000000000000000000000001110404010100000020010db800000000000000000000000320010db800000000000000000000000430393039000c0000deadbeef"], 0x0)
nanosleep(&(0x7f0000000300)={0x0, 0x2faf080}, 0x0)
executing program 3:
r0 = socket$inet6_tcp(0xa, 0x1, 0x0)
bind$inet6(r0, &(0x7f0000000000)={0xa, 0x4e22, 0x0, @local, 0x6}, 0x1c)
r1 = socket$inet6_tcp(0xa, 0x1, 0x0)
bind$inet6(r1, &(0x7f0000000000)={0xa, 0x4e23, 0x0, @local, 0x7}, 0x1c)
r2 = socket$inet6_tcp(0xa, 0x1, 0x0)
bind$inet6(r2, &(0x7f0000000000)={0xa, 0x4e24, 0x0, @local, 0x8}, 0x1c)
r3 = socket$inet6_tcp(0xa, 0x1, 0x0)
bind$inet6(r3, &(0x7f0000000000)={0xa, 0x4e25, 0x0, @local, 0x9}, 0x1c)
r4 = socket$inet6_tcp(0xa, 0x1, 0x0)
bind$inet6(r4, &(0x7f0000000000)={0xa, 0x4e26, 0x0, @local, 0xa}, 0x1c)
r5 = socket$inet6_tcp(0xa, 0x1, 0x0)
bind$inet6(r5, &(0x7f0000000000)={0xa, 0x4e27, 0x0, @local, 0xb}, 0x1c)
executing program 0:
r0 = fsopen(&(0x7f0000000000)='nfs\x00', 0x0)
fsconfig$FSCONFIG_SET_STRING(r0, 0x1, &(0x7f0000000040)='addr\x00', &(0x7f0000000080)='127.0.0.1\x00', 0x0)
fsconfig$FSCONFIG_SET_STRING(r0, 0x1, &(0x7f0000000140)='port\x00', &(0x7f0000000180)='0\x00', 0x0)
fsconfig$FSCONFIG_CMD_CREATE(r0, 0x6, 0x0, 0x0, 0x0)
executing program 3:
r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000000), 0x2, 0x0)
ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000100)={'\x00', 0x402})
r1 = socket$inet(0x2, 0x2, 0x0)
ioctl$sock_inet_SIOCSIFFLAGS(r1, 0x8914, &(0x7f0000000300)={'\x00', 0x1})
write$tun(r0, &(0x7f0000000200)={@void, @val={0x1, 0x1, 0x14, 0x10, 0x0, 0xe}, @eth={@broadcast, @broadcast, @void, {@generic={0x8847, "000001ff4500002800004000400600007f0000017f0000010050005000000000000000005002200000000000"}}}}, 0x60)
executing program 0:
r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000000), 0x2, 0x0)
ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000100)={'syz_tun\x00', 0x1001})
r1 = socket$nl_route(0x10, 0x3, 0x0)
sendmsg$nl_route(r1, &(0x7f00000000c0)={&(0x7f0000000000), 0x0, &(0x7f0000000140)={&(0x7f0000000180)=ANY=[@ANYBLOB="300000001800010600000000000000002d0100000000000100000000050001000a0000000c000500010000000c000000300000001800010600000000000000002d0100000000000100000000050001000b0000000c000500010000000c000000300000001800010600000000000000002d0100000000000100000000050001000c0000000c000500010000000c000000300000001800010600000000000000002d0100000000000100000000050001000d0000000c000500010000000c000000"], 0xc0}}, 0x0)
sendmsg$nl_route(r1, &(0x7f0000000240)={&(0x7f0000000000), 0x0, &(0x7f0000000280)={&(0x7f00000002c0)=ANY=[@ANYBLOB="1c0000001a00010301000000000000002d00"/28], 0x1c}}, 0x0)

program crashed: kernel BUG in mmap_region
bisect: the chunk can be dropped
bisect: split chunks (needed=true): <10>, <10>
bisect: split chunk #0 of len 10 into 2 parts
bisect: testing without sub-chunk 1/2
testing program (duration=1m43s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): [12, 2, 8, 14, 4, 3, 5, 10, 4, 5, 4, 12, 4, 5, 5]
detailed listing:
executing program 2:
r0 = socket$nl_netfilter(0x10, 0x3, 0xc)
sendmsg$NFNL_MSG_CTHELPER_NEW(r0, &(0x7f0000000040), 0x0)
r1 = socket$inet_tcp(0x2, 0x1, 0x0)
bind$inet(r1, &(0x7f0000000200)={0x2, 0xbb06, @empty}, 0x10)
listen(r1, 0x5)
r2 = socket$inet_tcp(0x2, 0x1, 0x0)
connect$inet(r2, &(0x7f0000000220)={0x2, 0xbb06, @loopback}, 0x10)
r3 = accept(r1, 0x0, 0x0)
sendto$inet(r2, &(0x7f0000000300)="009c00011a2b3c4d0001000001000000000000010000000100010001", 0x1c, 0x0, 0x0, 0x0)
sendto$inet(r3, &(0x7f0000000400)="009c00011a2b3c4d0002000001000100000000010000000100010001", 0x1c, 0x0, 0x0, 0x0)
sendto$inet(r2, &(0x7f0000000500)="00a800011a2b3c4d0007000012340001000000010000000100010001000100000000", 0x22, 0x0, 0x0, 0x0)
sendto$inet(r3, &(0x7f0000000600)="002000011a2b3c4d00080000567812340100"/32, 0x20, 0x0, 0x0, 0x0)
executing program 4:
r0 = socket$inet6_udp(0xa, 0x2, 0x11)
setsockopt$IP6T_SO_SET_REPLACE(r0, 0x29, 0x40, &(0x7f0000000000)=@mangle={'mangle\x00', 0x1d, 0x6, 0x660, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x6, &(0x7f00000006c0), {[{{@uncond, 0x0, 0xa8, 0xd0}, @common=@unspec=@NFQUEUE2={0x28, 'NFQUEUE\x00', 0x2, {0x0, 0x5}}}, {{@ipv6={@mcast1, @local, [], [], 'macvtap0\x00', 'ip6tnl0\x00', {}, {}, 0x11}, 0x0, 0xa8, 0xe8}, @inet=@TPROXY1={0x40, 'TPROXY\x00', 0x1, {0x0, 0x0, @ipv4=@broadcast}}}, {{@ipv6={@mcast2, @loopback, [], [], 'veth0_to_team\x00', 'syzkaller0\x00', {}, {}, 0x0, 0x0, 0x0, 0x24}, 0x0, 0x108, 0x130, 0x0, {}, [@common=@unspec=@time={{0x38}, {0x100, 0x8, 0xb34f, 0x57c1, 0xffff, 0x6}}, @common=@inet=@socket1={{0x28}}]}, @common=@unspec=@MARK={0x28}}, {{@uncond, 0x0, 0x108, 0x130, 0x0, {}, [@common=@frag={{0x30}}, @common=@ah={{0x30}, {[0x4d2, 0x4d4], 0x6, 0x2, 0x2}}]}, @inet=@DSCP={0x28}}, {{@uncond, 0x0, 0x138, 0x178, 0x0, {}, [@common=@dst={{0x48}}, @common=@dst={{0x48}}]}, @inet=@TPROXY1={0x40, 'TPROXY\x00', 0x1, {0x0, 0x0, @ipv4=@dev}}}], {{'\x00', 0x0, 0xa8, 0xd0}, {0x28}}}}, 0x6c0)
executing program 4:
r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000240), 0x2, 0x0)
ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000040)={'syzkaller0\x00', 0x1001})
r1 = socket$nl_route(0x10, 0x3, 0x0)
ioctl$sock_SIOCGIFINDEX(r1, 0x8933, &(0x7f0000000100)={'syzkaller0\x00', <r2=>0x0})
ioctl$sock_inet_SIOCSIFFLAGS(r1, 0x8914, &(0x7f0000000100)={'syzkaller0\x00', 0x1})
sendmsg$nl_route_sched(r1, &(0x7f00000000c0)={&(0x7f0000000000), 0x0, &(0x7f0000000140)={&(0x7f0000000180)=@newqdisc={0x30, 0x24, 0x401, 0x0, 0x0, {0x0, 0x0, 0x0, r2, {0x0, 0xffff}, {0xffff, 0xffff}}, [@qdisc_kind_options=@q_ingress={0xc}]}, 0x30}}, 0x0)
sendmsg$nl_route_sched(r1, &(0x7f00000001c0)={&(0x7f0000000000), 0x0, &(0x7f0000000200)={&(0x7f0000000340)=@newtfilter={0x94, 0x2c, 0x401, 0x0, 0x0, {0x0, 0x0, 0x0, r2, {0x1}, {0x300}}, [@filter_kind_options=@f_matchall={{0xd}, {0x60, 0x2, [@TCA_MATCHALL_ACT={0x5c, 0x1, [@m_nat={0x58, 0x1, 0x0, 0x0, {{0x8}, {0x2c, 0x2, 0x0, 0x1, [@TCA_NAT_PARMS={0x28, 0x1, {{}, @private=0xa010101, @private=0xa010102}}]}, {0x7, 0x3, "001122"}, {0xc, 0x4}, {0xc, 0x5}}}]}]}}]}, 0x94}}, 0x0)
write(r0, &(0x7f0000000300)="4500001c00010000400100000a0000010a0000020800f7ff00000000", 0x1c)
executing program 4:
mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./nfsd\x00', 0x1ff)
mount(0x0, &(0x7f0000000000)='./nfsd\x00', &(0x7f0000000100)='nfsd\x00', 0x0, 0x0)
r0 = openat(0xffffffffffffff9c, &(0x7f0000000000)='./nfsd/portlist\x00', 0x1, 0x0)
write(r0, &(0x7f0000000300)='+tcp\n\x00', 0x5)
r1 = openat(0xffffffffffffff9c, &(0x7f0000000000)='./nfsd/threads\x00', 0x1, 0x0)
write(r1, &(0x7f0000000100)='1\n\x00', 0x2)
r2 = socket$inet_tcp(0x2, 0x1, 0x6)
bind$inet(r2, &(0x7f0000000200)={0x2, 0x8008, @loopback}, 0x10)
listen(r2, 0x5)
r3 = socket$inet_tcp(0x2, 0x1, 0x6)
connect$inet(r3, &(0x7f0000000200)={0x2, 0x8008, @loopback}, 0x10)
write(r3, &(0x7f0000000400)="80000028123456780000000000000002000186a300000003000000000000000700"/44, 0x2c)
r4 = socket$nl_generic(0x10, 0x3, 0x10)
sendmsg$nl_generic(r4, &(0x7f0000000600)={0x0, 0x0, &(0x7f0000000700)={&(0x7f0000000800)={0x14, 0x10, 0x1, 0x0, 0x0, {0x1}}, 0x14}}, 0x0)
executing program 4:
r0 = socket$nl_route(0x10, 0x3, 0x0)
sendmsg$nl_route(r0, &(0x7f0000000100)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000010)=@newnexthop={0x24, 0x68, 0x601, 0x0, 0x0, {}, [@NHA_ID={0x8, 0x1, 0x1}, @NHA_BLACKHOLE={0x4}]}, 0x24}}, 0x0)
sendmsg$nl_route(r0, &(0x7f0000000100)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000010)=@newnexthop={0x2c, 0x68, 0x601, 0x0, 0x0, {}, [@NHA_ID={0x8, 0x1, 0x2}, @NHA_GROUP={0xc, 0x2, [{0x1, 0x1}]}]}, 0x2c}}, 0x0)
sendmsg$nl_route(r0, &(0x7f0000000100)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000010)=@getnexthop={0x20, 0x6a, 0x1, 0x0, 0x0, {}, [@NHA_ID={0x8, 0x1, 0x2}]}, 0x20}}, 0x0)
executing program 4:
unshare(0x50000000)
unshare(0x50000000)
nanosleep(&(0x7f0000000000)={0x0, 0x5f5e100}, 0x0)
executing program 4:
r0 = socket$nl_generic(0x10, 0x3, 0x10)
r1 = syz_genetlink_get_family_id$ethtool(&(0x7f0000000000), r0)
syz_usb_connect(0x0, 0x39, &(0x7f0000000040)=ANY=[@ANYBLOB="12010002ffffff40950b901700010102030109022700010100a0320904000003ffff0000070581031000080705820200020007050302000200"], 0x0)
nanosleep(&(0x7f0000000200)={0x2}, 0x0)
sendmsg$ETHTOOL_MSG_EEE_SET(r0, &(0x7f0000000080)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000100)={0x34, r1, 0x1, 0x0, 0x0, {}, [@ETHTOOL_A_EEE_HEADER={0xc, 0x1, 0x0, 0x1, [@ETHTOOL_A_HEADER_DEV_INDEX={0x8, 0x1, 0x2}]}, @ETHTOOL_A_EEE_MODES_OURS={0x14, 0x2, 0x0, 0x1, [@ETHTOOL_A_BITSET_BITS={0x10, 0x3, 0x0, 0x1, [{0xc, 0x1, 0x0, 0x1, [@ETHTOOL_A_BITSET_BIT_INDEX={0x8}]}]}]}]}, 0x34}}, 0x0)
executing program 1:
r0 = socket$inet_tcp(0x2, 0x1, 0x0)
bind$inet(r0, &(0x7f0000000000)={0x2, 0x208, @loopback}, 0x10)
listen(r0, 0x5)
r1 = fsopen(&(0x7f0000000100)='nfs\x00', 0x0)
fsconfig$FSCONFIG_SET_STRING(r1, 0x1, &(0x7f0000000140)='addr\x00', &(0x7f0000000180)='127.0.0.1\x00', 0x0)
fsconfig$FSCONFIG_SET_STRING(r1, 0x1, &(0x7f00000001c0)='source\x00', &(0x7f0000000200)='127.0.0.1:/export\x00', 0x0)
fsconfig$FSCONFIG_SET_STRING(r1, 0x1, &(0x7f0000000240)='vers\x00', &(0x7f0000000280)='3\x00', 0x0)
fsconfig$FSCONFIG_SET_STRING(r1, 0x1, &(0x7f00000002c0)='mountport\x00', &(0x7f0000000300)='2049\x00', 0x0)
fsconfig$FSCONFIG_CMD_CREATE(r1, 0x6, 0x0, 0x0, 0x0) (async)
accept4(r0, &(0x7f0000000400)=@in={0x2, 0x0, @loopback}, &(0x7f0000000500)=0x10, 0x0)
executing program 3:
r0 = userfaultfd(0x1)
mmap(&(0x7f0000800000)=nil, 0x1000, 0x3, 0x32, 0xffffffff, 0x0)
ioctl$UFFDIO_API(r0, 0xc018aa3f, &(0x7f0000000100))
ioctl$UFFDIO_REGISTER(r0, 0xc020aa00, &(0x7f0000000200)={{0xffffffffffffffff, 0x1000}, 0x2})
executing program 3:
r0 = socket$netlink(0x10, 0x3, 0xc)
sendmsg$NFQNL_MSG_CONFIG(r0, &(0x7f0000000100)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000300)={0x28, 0x2, 0x3, 0x0, 0x0, 0x0, {0x2}, [@NFQA_CFG_CMD={0x8, 0x1, {0x1, 0x0, 0x2}}, @NFQA_CFG_PARAMS={0x9, 0x2, {0xffff, 0x2}}]}, 0x28}}, 0x0)
r1 = socket$inet_udp(0x2, 0x2, 0x0)
setsockopt$IPT_SO_SET_REPLACE(r1, 0x0, 0x40, &(0x7f0000000a00)=@filter={'filter\x00', 0xe, 0x4, 0x248, 0xffffffff, 0x0, 0x98, 0x128, 0xffffffff, 0xffffffff, 0x1b8, 0x1b8, 0x1b8, 0xffffffff, 0x4, 0x0, {[{{@uncond, 0x0, 0x70, 0x98}, @common=@unspec=@NFQUEUE3={0x28, 'NFQUEUE\x00', 0x3, {0x0, 0x1}}}, {{@uncond, 0x0, 0x70, 0x90}, @common=@unspec=@STANDARD={0x20, '\x00', 0x0, 0xfffffffe}}, {{@uncond, 0x0, 0x70, 0x90}, @common=@unspec=@STANDARD={0x20, '\x00', 0x0, 0xfffffffe}}], {{'\x00', 0x0, 0x70, 0x90}, {0x20}}}}, 0x0)
sendto$inet(r1, &(0x7f0000000500)="00010203040506070809", 0xa, 0x0, &(0x7f0000000600)={0x2, 0x1234, @loopback}, 0x10)
executing program 3:
r0 = socket$netlink(0x10, 0x3, 0x0)
write(r0, &(0x7f0000000000)="580000001800050401000000000000000a800000fe040002000000001400010020010db800000000000000000000000106001500070000001800160008000100010000000c000b0008000100020000000800040001000000", 0x58)
syz_emit_ethernet(0x6a, &(0x7f0000000200)=ANY=[@ANYBLOB="aaaaaaaaaaaaaaaaaaaa86dd6000000000342b4020010db800000000000000000000000220010db8000000000000000000000001110404010100000020010db800000000000000000000000320010db800000000000000000000000430393039000c0000deadbeef"], 0x0)
nanosleep(&(0x7f0000000300)={0x0, 0x2faf080}, 0x0)
executing program 3:
r0 = socket$inet6_tcp(0xa, 0x1, 0x0)
bind$inet6(r0, &(0x7f0000000000)={0xa, 0x4e22, 0x0, @local, 0x6}, 0x1c)
r1 = socket$inet6_tcp(0xa, 0x1, 0x0)
bind$inet6(r1, &(0x7f0000000000)={0xa, 0x4e23, 0x0, @local, 0x7}, 0x1c)
r2 = socket$inet6_tcp(0xa, 0x1, 0x0)
bind$inet6(r2, &(0x7f0000000000)={0xa, 0x4e24, 0x0, @local, 0x8}, 0x1c)
r3 = socket$inet6_tcp(0xa, 0x1, 0x0)
bind$inet6(r3, &(0x7f0000000000)={0xa, 0x4e25, 0x0, @local, 0x9}, 0x1c)
r4 = socket$inet6_tcp(0xa, 0x1, 0x0)
bind$inet6(r4, &(0x7f0000000000)={0xa, 0x4e26, 0x0, @local, 0xa}, 0x1c)
r5 = socket$inet6_tcp(0xa, 0x1, 0x0)
bind$inet6(r5, &(0x7f0000000000)={0xa, 0x4e27, 0x0, @local, 0xb}, 0x1c)
executing program 0:
r0 = fsopen(&(0x7f0000000000)='nfs\x00', 0x0)
fsconfig$FSCONFIG_SET_STRING(r0, 0x1, &(0x7f0000000040)='addr\x00', &(0x7f0000000080)='127.0.0.1\x00', 0x0)
fsconfig$FSCONFIG_SET_STRING(r0, 0x1, &(0x7f0000000140)='port\x00', &(0x7f0000000180)='0\x00', 0x0)
fsconfig$FSCONFIG_CMD_CREATE(r0, 0x6, 0x0, 0x0, 0x0)
executing program 3:
r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000000), 0x2, 0x0)
ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000100)={'\x00', 0x402})
r1 = socket$inet(0x2, 0x2, 0x0)
ioctl$sock_inet_SIOCSIFFLAGS(r1, 0x8914, &(0x7f0000000300)={'\x00', 0x1})
write$tun(r0, &(0x7f0000000200)={@void, @val={0x1, 0x1, 0x14, 0x10, 0x0, 0xe}, @eth={@broadcast, @broadcast, @void, {@generic={0x8847, "000001ff4500002800004000400600007f0000017f0000010050005000000000000000005002200000000000"}}}}, 0x60)
executing program 0:
r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000000), 0x2, 0x0)
ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000100)={'syz_tun\x00', 0x1001})
r1 = socket$nl_route(0x10, 0x3, 0x0)
sendmsg$nl_route(r1, &(0x7f00000000c0)={&(0x7f0000000000), 0x0, &(0x7f0000000140)={&(0x7f0000000180)=ANY=[@ANYBLOB="300000001800010600000000000000002d0100000000000100000000050001000a0000000c000500010000000c000000300000001800010600000000000000002d0100000000000100000000050001000b0000000c000500010000000c000000300000001800010600000000000000002d0100000000000100000000050001000c0000000c000500010000000c000000300000001800010600000000000000002d0100000000000100000000050001000d0000000c000500010000000c000000"], 0xc0}}, 0x0)
sendmsg$nl_route(r1, &(0x7f0000000240)={&(0x7f0000000000), 0x0, &(0x7f0000000280)={&(0x7f00000002c0)=ANY=[@ANYBLOB="1c0000001a00010301000000000000002d00"/28], 0x1c}}, 0x0)

program did not crash
bisect: testing without sub-chunk 2/2
testing program (duration=1m43s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): [6, 3, 38, 2, 14, 3, 5, 10, 4, 5, 4, 12, 4, 5, 5]
detailed listing:
executing program 2:
r0 = syz_open_procfs$namespace(0x0, &(0x7f0000000000)='ns/net\x00')
setns(r0, 0x40000000)
r1 = syz_open_procfs(0x0, &(0x7f0000000100)='net/dev\x00')
read(r1, &(0x7f0000000200), 0x1000)
r2 = socket$inet(0x2, 0x2, 0x0)
ioctl$sock_SIOCETHTOOL(r2, 0x8946, &(0x7f0000000300)={'lo\x00', &(0x7f0000000400)=@ethtool_eeprom={0xb, 0x0, 0x0, 0x10, '\x00'/16}})
executing program 2:
r0 = socket$nl_route(0x10, 0x3, 0x0)
ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000100)={'lo\x00', <r1=>0x0})
sendmsg$nl_route_sched(r0, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000080)={&(0x7f00000000c0)=@newqdisc={0x3c, 0x24, 0x601, 0x1, 0x0, {0x0, 0x0, 0x0, r1, {}, {0xffff, 0xffff}}, [@TCA_INGRESS_BLOCK={0x8, 0x0, 0x1}]}}}, 0x0)
executing program 2:
r0 = socket$nl_route(0x10, 0x3, 0x0)
write(r0, &(0x7f0000000000)="600000001800050601000000000000000a400000fe040001000000001400010020010db800010000000000000000000108000400010000000600150003000000200016800c0001001234567890abcdef05000800010000000500070002000000", 0x60)
write(r0, &(0x7f0000000000)="600000001800050601000000000000000a400000fe040001000000001400010020010db800020000000000000000000108000400010000000600150003000000200016800c0001001234567890abcdef05000800010000000500070002000000", 0x60)
write(r0, &(0x7f0000000000)="600000001800050601000000000000000a400000fe040001000000001400010020010db800030000000000000000000108000400010000000600150003000000200016800c0001001234567890abcdef05000800010000000500070002000000", 0x60)
write(r0, &(0x7f0000000000)="600000001800050601000000000000000a400000fe040001000000001400010020010db800040000000000000000000108000400010000000600150003000000200016800c0001001234567890abcdef05000800010000000500070002000000", 0x60)
write(r0, &(0x7f0000000000)="600000001800050601000000000000000a400000fe040001000000001400010020010db800050000000000000000000108000400010000000600150003000000200016800c0001001234567890abcdef05000800010000000500070002000000", 0x60)
write(r0, &(0x7f0000000000)="600000001800050601000000000000000a400000fe040001000000001400010020010db800060000000000000000000108000400010000000600150003000000200016800c0001001234567890abcdef05000800010000000500070002000000", 0x60)
write(r0, &(0x7f0000000000)="600000001800050601000000000000000a400000fe040001000000001400010020010db800070000000000000000000108000400010000000600150003000000200016800c0001001234567890abcdef05000800010000000500070002000000", 0x60)
write(r0, &(0x7f0000000000)="600000001800050601000000000000000a400000fe040001000000001400010020010db800080000000000000000000108000400010000000600150003000000200016800c0001001234567890abcdef05000800010000000500070002000000", 0x60)
write(r0, &(0x7f0000000000)="600000001800050601000000000000000a400000fe040001000000001400010020010db800090000000000000000000108000400010000000600150003000000200016800c0001001234567890abcdef05000800010000000500070002000000", 0x60)
write(r0, &(0x7f0000000000)="600000001800050601000000000000000a400000fe040001000000001400010020010db8000a0000000000000000000108000400010000000600150003000000200016800c0001001234567890abcdef05000800010000000500070002000000", 0x60)
write(r0, &(0x7f0000000000)="600000001800050601000000000000000a400000fe040001000000001400010020010db8000b0000000000000000000108000400010000000600150003000000200016800c0001001234567890abcdef05000800010000000500070002000000", 0x60)
write(r0, &(0x7f0000000000)="600000001800050601000000000000000a400000fe040001000000001400010020010db8000c0000000000000000000108000400010000000600150003000000200016800c0001001234567890abcdef05000800010000000500070002000000", 0x60)
write(r0, &(0x7f0000000000)="600000001800050601000000000000000a400000fe040001000000001400010020010db8000d0000000000000000000108000400010000000600150003000000200016800c0001001234567890abcdef05000800010000000500070002000000", 0x60)
write(r0, &(0x7f0000000000)="600000001800050601000000000000000a400000fe040001000000001400010020010db8000e0000000000000000000108000400010000000600150003000000200016800c0001001234567890abcdef05000800010000000500070002000000", 0x60)
write(r0, &(0x7f0000000000)="600000001800050601000000000000000a400000fe040001000000001400010020010db8000f0000000000000000000108000400010000000600150003000000200016800c0001001234567890abcdef05000800010000000500070002000000", 0x60)
write(r0, &(0x7f0000000000)="600000001800050601000000000000000a400000fe040001000000001400010020010db800100000000000000000000108000400010000000600150003000000200016800c0001001234567890abcdef05000800010000000500070002000000", 0x60)
write(r0, &(0x7f0000000000)="600000001800050601000000000000000a400000fe040001000000001400010020010db800110000000000000000000108000400010000000600150003000000200016800c0001001234567890abcdef05000800010000000500070002000000", 0x60)
write(r0, &(0x7f0000000000)="600000001800050601000000000000000a400000fe040001000000001400010020010db800120000000000000000000108000400010000000600150003000000200016800c0001001234567890abcdef05000800010000000500070002000000", 0x60)
write(r0, &(0x7f0000000000)="600000001800050601000000000000000a400000fe040001000000001400010020010db800130000000000000000000108000400010000000600150003000000200016800c0001001234567890abcdef05000800010000000500070002000000", 0x60)
write(r0, &(0x7f0000000000)="600000001800050601000000000000000a400000fe040001000000001400010020010db800140000000000000000000108000400010000000600150003000000200016800c0001001234567890abcdef05000800010000000500070002000000", 0x60)
write(r0, &(0x7f0000000000)="600000001800050601000000000000000a400000fe040001000000001400010020010db800150000000000000000000108000400010000000600150003000000200016800c0001001234567890abcdef05000800010000000500070002000000", 0x60)
write(r0, &(0x7f0000000000)="600000001800050601000000000000000a400000fe040001000000001400010020010db800160000000000000000000108000400010000000600150003000000200016800c0001001234567890abcdef05000800010000000500070002000000", 0x60)
write(r0, &(0x7f0000000000)="600000001800050601000000000000000a400000fe040001000000001400010020010db800170000000000000000000108000400010000000600150003000000200016800c0001001234567890abcdef05000800010000000500070002000000", 0x60)
write(r0, &(0x7f0000000000)="600000001800050601000000000000000a400000fe040001000000001400010020010db800180000000000000000000108000400010000000600150003000000200016800c0001001234567890abcdef05000800010000000500070002000000", 0x60)
write(r0, &(0x7f0000000000)="600000001800050601000000000000000a400000fe040001000000001400010020010db800190000000000000000000108000400010000000600150003000000200016800c0001001234567890abcdef05000800010000000500070002000000", 0x60)
write(r0, &(0x7f0000000000)="600000001800050601000000000000000a400000fe040001000000001400010020010db8001a0000000000000000000108000400010000000600150003000000200016800c0001001234567890abcdef05000800010000000500070002000000", 0x60)
write(r0, &(0x7f0000000000)="600000001800050601000000000000000a400000fe040001000000001400010020010db8001b0000000000000000000108000400010000000600150003000000200016800c0001001234567890abcdef05000800010000000500070002000000", 0x60)
write(r0, &(0x7f0000000000)="600000001800050601000000000000000a400000fe040001000000001400010020010db8001c0000000000000000000108000400010000000600150003000000200016800c0001001234567890abcdef05000800010000000500070002000000", 0x60)
write(r0, &(0x7f0000000000)="600000001800050601000000000000000a400000fe040001000000001400010020010db8001d0000000000000000000108000400010000000600150003000000200016800c0001001234567890abcdef05000800010000000500070002000000", 0x60)
write(r0, &(0x7f0000000000)="600000001800050601000000000000000a400000fe040001000000001400010020010db8001e0000000000000000000108000400010000000600150003000000200016800c0001001234567890abcdef05000800010000000500070002000000", 0x60)
write(r0, &(0x7f0000000000)="600000001800050601000000000000000a400000fe040001000000001400010020010db8001f0000000000000000000108000400010000000600150003000000200016800c0001001234567890abcdef05000800010000000500070002000000", 0x60)
write(r0, &(0x7f0000000000)="600000001800050601000000000000000a400000fe040001000000001400010020010db800200000000000000000000108000400010000000600150003000000200016800c0001001234567890abcdef05000800010000000500070002000000", 0x60)
write(r0, &(0x7f0000000000)="600000001800050601000000000000000a400000fe040001000000001400010020010db800210000000000000000000108000400010000000600150003000000200016800c0001001234567890abcdef05000800010000000500070002000000", 0x60)
write(r0, &(0x7f0000000000)="600000001800050601000000000000000a400000fe040001000000001400010020010db800220000000000000000000108000400010000000600150003000000200016800c0001001234567890abcdef05000800010000000500070002000000", 0x60)
write(r0, &(0x7f0000000000)="600000001800050601000000000000000a400000fe040001000000001400010020010db800230000000000000000000108000400010000000600150003000000200016800c0001001234567890abcdef05000800010000000500070002000000", 0x60)
write(r0, &(0x7f0000000200)="1c0000001a00010103000000000000000a00"/28, 0x1c)
recvmsg(r0, &(0x7f0000000100)={0x0, 0x0, &(0x7f0000000200)=[{&(0x7f0000000300)=""/4096, 0x1000}], 0x1}, 0x0)
executing program 2:
r0 = socket$nl_route(0x10, 0x3, 0x0)
sendmsg$nl_route(r0, &(0x7f0000000000)={&(0x7f0000000040), 0x10, &(0x7f0000000100)={&(0x7f0000000200)=@newlink={0x0, 0x10, 0x1, 0x0, 0x0, {0x0, 0x0, 0x0, 0x0, 0x100, 0x100}}}}, 0x0)
executing program 2:
mkdirat(0xffffffffffffff9c, &(0x7f0000000100)='./debug\x00', 0x1ff)
mount(0x0, &(0x7f0000000100)='./debug\x00', &(0x7f0000000140)='debugfs\x00', 0x0, 0x0)
mkdirat(0xffffffffffffff9c, &(0x7f0000000600)='./file0\x00', 0x1ff)
pipe2$9p(&(0x7f0000000000)={<r0=>0x0, <r1=>0x0}, 0x0)
r2 = openat(0xffffffffffffff9c, &(0x7f0000000200)='./debug/failslab/probability\x00', 0x1, 0x0)
write(r2, &(0x7f0000000300)='100\x00', 0x4)
r3 = openat(0xffffffffffffff9c, &(0x7f0000000400)='./debug/failslab/times\x00', 0x1, 0x0)
write(r3, &(0x7f0000000500)='100\x00', 0x4)
syz_clone(0x11, 0x0, 0x0, 0x0, 0x0, 0x0)
mount$9p_fd(0x0, &(0x7f0000000600)='./file0\x00', &(0x7f0000000700), 0x0, &(0x7f0000000800)={'trans=fd,', {'rfdno', 0x3d, r0}, 0x2c, {'wfdno', 0x3d, r1}, 0x2c, {[{@version_9p2000}, {@msize={'msize', 0x3d, 0x1000}}]}})
write$P9_RVERSION(r1, &(0x7f0000000900)={0x13, 0x65, 0xffff, 0x1000, 0x6, '9P2000'}, 0x13)
write$P9_RATTACH(r1, &(0x7f0000000a00)={0x13, 0x69, 0x1}, 0x13)
write$P9_RSTAT(r1, &(0x7f0000000b00)={0x0, 0x77, 0x1}, 0x13)
openat(0xffffffffffffff9c, &(0x7f0000000600)='./file0\x00', 0x0, 0x0)
executing program 4:
unshare(0x50000000)
unshare(0x50000000)
nanosleep(&(0x7f0000000000)={0x0, 0x5f5e100}, 0x0)
executing program 4:
r0 = socket$nl_generic(0x10, 0x3, 0x10)
r1 = syz_genetlink_get_family_id$ethtool(&(0x7f0000000000), r0)
syz_usb_connect(0x0, 0x39, &(0x7f0000000040)=ANY=[@ANYBLOB="12010002ffffff40950b901700010102030109022700010100a0320904000003ffff0000070581031000080705820200020007050302000200"], 0x0)
nanosleep(&(0x7f0000000200)={0x2}, 0x0)
sendmsg$ETHTOOL_MSG_EEE_SET(r0, &(0x7f0000000080)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000100)={0x34, r1, 0x1, 0x0, 0x0, {}, [@ETHTOOL_A_EEE_HEADER={0xc, 0x1, 0x0, 0x1, [@ETHTOOL_A_HEADER_DEV_INDEX={0x8, 0x1, 0x2}]}, @ETHTOOL_A_EEE_MODES_OURS={0x14, 0x2, 0x0, 0x1, [@ETHTOOL_A_BITSET_BITS={0x10, 0x3, 0x0, 0x1, [{0xc, 0x1, 0x0, 0x1, [@ETHTOOL_A_BITSET_BIT_INDEX={0x8}]}]}]}]}, 0x34}}, 0x0)
executing program 1:
r0 = socket$inet_tcp(0x2, 0x1, 0x0)
bind$inet(r0, &(0x7f0000000000)={0x2, 0x208, @loopback}, 0x10)
listen(r0, 0x5)
r1 = fsopen(&(0x7f0000000100)='nfs\x00', 0x0)
fsconfig$FSCONFIG_SET_STRING(r1, 0x1, &(0x7f0000000140)='addr\x00', &(0x7f0000000180)='127.0.0.1\x00', 0x0)
fsconfig$FSCONFIG_SET_STRING(r1, 0x1, &(0x7f00000001c0)='source\x00', &(0x7f0000000200)='127.0.0.1:/export\x00', 0x0)
fsconfig$FSCONFIG_SET_STRING(r1, 0x1, &(0x7f0000000240)='vers\x00', &(0x7f0000000280)='3\x00', 0x0)
fsconfig$FSCONFIG_SET_STRING(r1, 0x1, &(0x7f00000002c0)='mountport\x00', &(0x7f0000000300)='2049\x00', 0x0)
fsconfig$FSCONFIG_CMD_CREATE(r1, 0x6, 0x0, 0x0, 0x0) (async)
accept4(r0, &(0x7f0000000400)=@in={0x2, 0x0, @loopback}, &(0x7f0000000500)=0x10, 0x0)
executing program 3:
r0 = userfaultfd(0x1)
mmap(&(0x7f0000800000)=nil, 0x1000, 0x3, 0x32, 0xffffffff, 0x0)
ioctl$UFFDIO_API(r0, 0xc018aa3f, &(0x7f0000000100))
ioctl$UFFDIO_REGISTER(r0, 0xc020aa00, &(0x7f0000000200)={{0xffffffffffffffff, 0x1000}, 0x2})
executing program 3:
r0 = socket$netlink(0x10, 0x3, 0xc)
sendmsg$NFQNL_MSG_CONFIG(r0, &(0x7f0000000100)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000300)={0x28, 0x2, 0x3, 0x0, 0x0, 0x0, {0x2}, [@NFQA_CFG_CMD={0x8, 0x1, {0x1, 0x0, 0x2}}, @NFQA_CFG_PARAMS={0x9, 0x2, {0xffff, 0x2}}]}, 0x28}}, 0x0)
r1 = socket$inet_udp(0x2, 0x2, 0x0)
setsockopt$IPT_SO_SET_REPLACE(r1, 0x0, 0x40, &(0x7f0000000a00)=@filter={'filter\x00', 0xe, 0x4, 0x248, 0xffffffff, 0x0, 0x98, 0x128, 0xffffffff, 0xffffffff, 0x1b8, 0x1b8, 0x1b8, 0xffffffff, 0x4, 0x0, {[{{@uncond, 0x0, 0x70, 0x98}, @common=@unspec=@NFQUEUE3={0x28, 'NFQUEUE\x00', 0x3, {0x0, 0x1}}}, {{@uncond, 0x0, 0x70, 0x90}, @common=@unspec=@STANDARD={0x20, '\x00', 0x0, 0xfffffffe}}, {{@uncond, 0x0, 0x70, 0x90}, @common=@unspec=@STANDARD={0x20, '\x00', 0x0, 0xfffffffe}}], {{'\x00', 0x0, 0x70, 0x90}, {0x20}}}}, 0x0)
sendto$inet(r1, &(0x7f0000000500)="00010203040506070809", 0xa, 0x0, &(0x7f0000000600)={0x2, 0x1234, @loopback}, 0x10)
executing program 3:
r0 = socket$netlink(0x10, 0x3, 0x0)
write(r0, &(0x7f0000000000)="580000001800050401000000000000000a800000fe040002000000001400010020010db800000000000000000000000106001500070000001800160008000100010000000c000b0008000100020000000800040001000000", 0x58)
syz_emit_ethernet(0x6a, &(0x7f0000000200)=ANY=[@ANYBLOB="aaaaaaaaaaaaaaaaaaaa86dd6000000000342b4020010db800000000000000000000000220010db8000000000000000000000001110404010100000020010db800000000000000000000000320010db800000000000000000000000430393039000c0000deadbeef"], 0x0)
nanosleep(&(0x7f0000000300)={0x0, 0x2faf080}, 0x0)
executing program 3:
r0 = socket$inet6_tcp(0xa, 0x1, 0x0)
bind$inet6(r0, &(0x7f0000000000)={0xa, 0x4e22, 0x0, @local, 0x6}, 0x1c)
r1 = socket$inet6_tcp(0xa, 0x1, 0x0)
bind$inet6(r1, &(0x7f0000000000)={0xa, 0x4e23, 0x0, @local, 0x7}, 0x1c)
r2 = socket$inet6_tcp(0xa, 0x1, 0x0)
bind$inet6(r2, &(0x7f0000000000)={0xa, 0x4e24, 0x0, @local, 0x8}, 0x1c)
r3 = socket$inet6_tcp(0xa, 0x1, 0x0)
bind$inet6(r3, &(0x7f0000000000)={0xa, 0x4e25, 0x0, @local, 0x9}, 0x1c)
r4 = socket$inet6_tcp(0xa, 0x1, 0x0)
bind$inet6(r4, &(0x7f0000000000)={0xa, 0x4e26, 0x0, @local, 0xa}, 0x1c)
r5 = socket$inet6_tcp(0xa, 0x1, 0x0)
bind$inet6(r5, &(0x7f0000000000)={0xa, 0x4e27, 0x0, @local, 0xb}, 0x1c)
executing program 0:
r0 = fsopen(&(0x7f0000000000)='nfs\x00', 0x0)
fsconfig$FSCONFIG_SET_STRING(r0, 0x1, &(0x7f0000000040)='addr\x00', &(0x7f0000000080)='127.0.0.1\x00', 0x0)
fsconfig$FSCONFIG_SET_STRING(r0, 0x1, &(0x7f0000000140)='port\x00', &(0x7f0000000180)='0\x00', 0x0)
fsconfig$FSCONFIG_CMD_CREATE(r0, 0x6, 0x0, 0x0, 0x0)
executing program 3:
r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000000), 0x2, 0x0)
ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000100)={'\x00', 0x402})
r1 = socket$inet(0x2, 0x2, 0x0)
ioctl$sock_inet_SIOCSIFFLAGS(r1, 0x8914, &(0x7f0000000300)={'\x00', 0x1})
write$tun(r0, &(0x7f0000000200)={@void, @val={0x1, 0x1, 0x14, 0x10, 0x0, 0xe}, @eth={@broadcast, @broadcast, @void, {@generic={0x8847, "000001ff4500002800004000400600007f0000017f0000010050005000000000000000005002200000000000"}}}}, 0x60)
executing program 0:
r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000000), 0x2, 0x0)
ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000100)={'syz_tun\x00', 0x1001})
r1 = socket$nl_route(0x10, 0x3, 0x0)
sendmsg$nl_route(r1, &(0x7f00000000c0)={&(0x7f0000000000), 0x0, &(0x7f0000000140)={&(0x7f0000000180)=ANY=[@ANYBLOB="300000001800010600000000000000002d0100000000000100000000050001000a0000000c000500010000000c000000300000001800010600000000000000002d0100000000000100000000050001000b0000000c000500010000000c000000300000001800010600000000000000002d0100000000000100000000050001000c0000000c000500010000000c000000300000001800010600000000000000002d0100000000000100000000050001000d0000000c000500010000000c000000"], 0xc0}}, 0x0)
sendmsg$nl_route(r1, &(0x7f0000000240)={&(0x7f0000000000), 0x0, &(0x7f0000000280)={&(0x7f00000002c0)=ANY=[@ANYBLOB="1c0000001a00010301000000000000002d00"/28], 0x1c}}, 0x0)

program crashed: kernel BUG in mmap_region
bisect: the chunk can be dropped
bisect: split chunk #1 of len 10 into 2 parts
bisect: testing without sub-chunk 1/2
testing program (duration=1m42s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): [6, 3, 38, 2, 14, 4, 12, 4, 5, 5]
detailed listing:
executing program 2:
r0 = syz_open_procfs$namespace(0x0, &(0x7f0000000000)='ns/net\x00')
setns(r0, 0x40000000)
r1 = syz_open_procfs(0x0, &(0x7f0000000100)='net/dev\x00')
read(r1, &(0x7f0000000200), 0x1000)
r2 = socket$inet(0x2, 0x2, 0x0)
ioctl$sock_SIOCETHTOOL(r2, 0x8946, &(0x7f0000000300)={'lo\x00', &(0x7f0000000400)=@ethtool_eeprom={0xb, 0x0, 0x0, 0x10, '\x00'/16}})
executing program 2:
r0 = socket$nl_route(0x10, 0x3, 0x0)
ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000100)={'lo\x00', <r1=>0x0})
sendmsg$nl_route_sched(r0, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000080)={&(0x7f00000000c0)=@newqdisc={0x3c, 0x24, 0x601, 0x1, 0x0, {0x0, 0x0, 0x0, r1, {}, {0xffff, 0xffff}}, [@TCA_INGRESS_BLOCK={0x8, 0x0, 0x1}]}}}, 0x0)
executing program 2:
r0 = socket$nl_route(0x10, 0x3, 0x0)
write(r0, &(0x7f0000000000)="600000001800050601000000000000000a400000fe040001000000001400010020010db800010000000000000000000108000400010000000600150003000000200016800c0001001234567890abcdef05000800010000000500070002000000", 0x60)
write(r0, &(0x7f0000000000)="600000001800050601000000000000000a400000fe040001000000001400010020010db800020000000000000000000108000400010000000600150003000000200016800c0001001234567890abcdef05000800010000000500070002000000", 0x60)
write(r0, &(0x7f0000000000)="600000001800050601000000000000000a400000fe040001000000001400010020010db800030000000000000000000108000400010000000600150003000000200016800c0001001234567890abcdef05000800010000000500070002000000", 0x60)
write(r0, &(0x7f0000000000)="600000001800050601000000000000000a400000fe040001000000001400010020010db800040000000000000000000108000400010000000600150003000000200016800c0001001234567890abcdef05000800010000000500070002000000", 0x60)
write(r0, &(0x7f0000000000)="600000001800050601000000000000000a400000fe040001000000001400010020010db800050000000000000000000108000400010000000600150003000000200016800c0001001234567890abcdef05000800010000000500070002000000", 0x60)
write(r0, &(0x7f0000000000)="600000001800050601000000000000000a400000fe040001000000001400010020010db800060000000000000000000108000400010000000600150003000000200016800c0001001234567890abcdef05000800010000000500070002000000", 0x60)
write(r0, &(0x7f0000000000)="600000001800050601000000000000000a400000fe040001000000001400010020010db800070000000000000000000108000400010000000600150003000000200016800c0001001234567890abcdef05000800010000000500070002000000", 0x60)
write(r0, &(0x7f0000000000)="600000001800050601000000000000000a400000fe040001000000001400010020010db800080000000000000000000108000400010000000600150003000000200016800c0001001234567890abcdef05000800010000000500070002000000", 0x60)
write(r0, &(0x7f0000000000)="600000001800050601000000000000000a400000fe040001000000001400010020010db800090000000000000000000108000400010000000600150003000000200016800c0001001234567890abcdef05000800010000000500070002000000", 0x60)
write(r0, &(0x7f0000000000)="600000001800050601000000000000000a400000fe040001000000001400010020010db8000a0000000000000000000108000400010000000600150003000000200016800c0001001234567890abcdef05000800010000000500070002000000", 0x60)
write(r0, &(0x7f0000000000)="600000001800050601000000000000000a400000fe040001000000001400010020010db8000b0000000000000000000108000400010000000600150003000000200016800c0001001234567890abcdef05000800010000000500070002000000", 0x60)
write(r0, &(0x7f0000000000)="600000001800050601000000000000000a400000fe040001000000001400010020010db8000c0000000000000000000108000400010000000600150003000000200016800c0001001234567890abcdef05000800010000000500070002000000", 0x60)
write(r0, &(0x7f0000000000)="600000001800050601000000000000000a400000fe040001000000001400010020010db8000d0000000000000000000108000400010000000600150003000000200016800c0001001234567890abcdef05000800010000000500070002000000", 0x60)
write(r0, &(0x7f0000000000)="600000001800050601000000000000000a400000fe040001000000001400010020010db8000e0000000000000000000108000400010000000600150003000000200016800c0001001234567890abcdef05000800010000000500070002000000", 0x60)
write(r0, &(0x7f0000000000)="600000001800050601000000000000000a400000fe040001000000001400010020010db8000f0000000000000000000108000400010000000600150003000000200016800c0001001234567890abcdef05000800010000000500070002000000", 0x60)
write(r0, &(0x7f0000000000)="600000001800050601000000000000000a400000fe040001000000001400010020010db800100000000000000000000108000400010000000600150003000000200016800c0001001234567890abcdef05000800010000000500070002000000", 0x60)
write(r0, &(0x7f0000000000)="600000001800050601000000000000000a400000fe040001000000001400010020010db800110000000000000000000108000400010000000600150003000000200016800c0001001234567890abcdef05000800010000000500070002000000", 0x60)
write(r0, &(0x7f0000000000)="600000001800050601000000000000000a400000fe040001000000001400010020010db800120000000000000000000108000400010000000600150003000000200016800c0001001234567890abcdef05000800010000000500070002000000", 0x60)
write(r0, &(0x7f0000000000)="600000001800050601000000000000000a400000fe040001000000001400010020010db800130000000000000000000108000400010000000600150003000000200016800c0001001234567890abcdef05000800010000000500070002000000", 0x60)
write(r0, &(0x7f0000000000)="600000001800050601000000000000000a400000fe040001000000001400010020010db800140000000000000000000108000400010000000600150003000000200016800c0001001234567890abcdef05000800010000000500070002000000", 0x60)
write(r0, &(0x7f0000000000)="600000001800050601000000000000000a400000fe040001000000001400010020010db800150000000000000000000108000400010000000600150003000000200016800c0001001234567890abcdef05000800010000000500070002000000", 0x60)
write(r0, &(0x7f0000000000)="600000001800050601000000000000000a400000fe040001000000001400010020010db800160000000000000000000108000400010000000600150003000000200016800c0001001234567890abcdef05000800010000000500070002000000", 0x60)
write(r0, &(0x7f0000000000)="600000001800050601000000000000000a400000fe040001000000001400010020010db800170000000000000000000108000400010000000600150003000000200016800c0001001234567890abcdef05000800010000000500070002000000", 0x60)
write(r0, &(0x7f0000000000)="600000001800050601000000000000000a400000fe040001000000001400010020010db800180000000000000000000108000400010000000600150003000000200016800c0001001234567890abcdef05000800010000000500070002000000", 0x60)
write(r0, &(0x7f0000000000)="600000001800050601000000000000000a400000fe040001000000001400010020010db800190000000000000000000108000400010000000600150003000000200016800c0001001234567890abcdef05000800010000000500070002000000", 0x60)
write(r0, &(0x7f0000000000)="600000001800050601000000000000000a400000fe040001000000001400010020010db8001a0000000000000000000108000400010000000600150003000000200016800c0001001234567890abcdef05000800010000000500070002000000", 0x60)
write(r0, &(0x7f0000000000)="600000001800050601000000000000000a400000fe040001000000001400010020010db8001b0000000000000000000108000400010000000600150003000000200016800c0001001234567890abcdef05000800010000000500070002000000", 0x60)
write(r0, &(0x7f0000000000)="600000001800050601000000000000000a400000fe040001000000001400010020010db8001c0000000000000000000108000400010000000600150003000000200016800c0001001234567890abcdef05000800010000000500070002000000", 0x60)
write(r0, &(0x7f0000000000)="600000001800050601000000000000000a400000fe040001000000001400010020010db8001d0000000000000000000108000400010000000600150003000000200016800c0001001234567890abcdef05000800010000000500070002000000", 0x60)
write(r0, &(0x7f0000000000)="600000001800050601000000000000000a400000fe040001000000001400010020010db8001e0000000000000000000108000400010000000600150003000000200016800c0001001234567890abcdef05000800010000000500070002000000", 0x60)
write(r0, &(0x7f0000000000)="600000001800050601000000000000000a400000fe040001000000001400010020010db8001f0000000000000000000108000400010000000600150003000000200016800c0001001234567890abcdef05000800010000000500070002000000", 0x60)
write(r0, &(0x7f0000000000)="600000001800050601000000000000000a400000fe040001000000001400010020010db800200000000000000000000108000400010000000600150003000000200016800c0001001234567890abcdef05000800010000000500070002000000", 0x60)
write(r0, &(0x7f0000000000)="600000001800050601000000000000000a400000fe040001000000001400010020010db800210000000000000000000108000400010000000600150003000000200016800c0001001234567890abcdef05000800010000000500070002000000", 0x60)
write(r0, &(0x7f0000000000)="600000001800050601000000000000000a400000fe040001000000001400010020010db800220000000000000000000108000400010000000600150003000000200016800c0001001234567890abcdef05000800010000000500070002000000", 0x60)
write(r0, &(0x7f0000000000)="600000001800050601000000000000000a400000fe040001000000001400010020010db800230000000000000000000108000400010000000600150003000000200016800c0001001234567890abcdef05000800010000000500070002000000", 0x60)
write(r0, &(0x7f0000000200)="1c0000001a00010103000000000000000a00"/28, 0x1c)
recvmsg(r0, &(0x7f0000000100)={0x0, 0x0, &(0x7f0000000200)=[{&(0x7f0000000300)=""/4096, 0x1000}], 0x1}, 0x0)
executing program 2:
r0 = socket$nl_route(0x10, 0x3, 0x0)
sendmsg$nl_route(r0, &(0x7f0000000000)={&(0x7f0000000040), 0x10, &(0x7f0000000100)={&(0x7f0000000200)=@newlink={0x0, 0x10, 0x1, 0x0, 0x0, {0x0, 0x0, 0x0, 0x0, 0x100, 0x100}}}}, 0x0)
executing program 2:
mkdirat(0xffffffffffffff9c, &(0x7f0000000100)='./debug\x00', 0x1ff)
mount(0x0, &(0x7f0000000100)='./debug\x00', &(0x7f0000000140)='debugfs\x00', 0x0, 0x0)
mkdirat(0xffffffffffffff9c, &(0x7f0000000600)='./file0\x00', 0x1ff)
pipe2$9p(&(0x7f0000000000)={<r0=>0x0, <r1=>0x0}, 0x0)
r2 = openat(0xffffffffffffff9c, &(0x7f0000000200)='./debug/failslab/probability\x00', 0x1, 0x0)
write(r2, &(0x7f0000000300)='100\x00', 0x4)
r3 = openat(0xffffffffffffff9c, &(0x7f0000000400)='./debug/failslab/times\x00', 0x1, 0x0)
write(r3, &(0x7f0000000500)='100\x00', 0x4)
syz_clone(0x11, 0x0, 0x0, 0x0, 0x0, 0x0)
mount$9p_fd(0x0, &(0x7f0000000600)='./file0\x00', &(0x7f0000000700), 0x0, &(0x7f0000000800)={'trans=fd,', {'rfdno', 0x3d, r0}, 0x2c, {'wfdno', 0x3d, r1}, 0x2c, {[{@version_9p2000}, {@msize={'msize', 0x3d, 0x1000}}]}})
write$P9_RVERSION(r1, &(0x7f0000000900)={0x13, 0x65, 0xffff, 0x1000, 0x6, '9P2000'}, 0x13)
write$P9_RATTACH(r1, &(0x7f0000000a00)={0x13, 0x69, 0x1}, 0x13)
write$P9_RSTAT(r1, &(0x7f0000000b00)={0x0, 0x77, 0x1}, 0x13)
openat(0xffffffffffffff9c, &(0x7f0000000600)='./file0\x00', 0x0, 0x0)
executing program 3:
r0 = socket$netlink(0x10, 0x3, 0x0)
write(r0, &(0x7f0000000000)="580000001800050401000000000000000a800000fe040002000000001400010020010db800000000000000000000000106001500070000001800160008000100010000000c000b0008000100020000000800040001000000", 0x58)
syz_emit_ethernet(0x6a, &(0x7f0000000200)=ANY=[@ANYBLOB="aaaaaaaaaaaaaaaaaaaa86dd6000000000342b4020010db800000000000000000000000220010db8000000000000000000000001110404010100000020010db800000000000000000000000320010db800000000000000000000000430393039000c0000deadbeef"], 0x0)
nanosleep(&(0x7f0000000300)={0x0, 0x2faf080}, 0x0)
executing program 3:
r0 = socket$inet6_tcp(0xa, 0x1, 0x0)
bind$inet6(r0, &(0x7f0000000000)={0xa, 0x4e22, 0x0, @local, 0x6}, 0x1c)
r1 = socket$inet6_tcp(0xa, 0x1, 0x0)
bind$inet6(r1, &(0x7f0000000000)={0xa, 0x4e23, 0x0, @local, 0x7}, 0x1c)
r2 = socket$inet6_tcp(0xa, 0x1, 0x0)
bind$inet6(r2, &(0x7f0000000000)={0xa, 0x4e24, 0x0, @local, 0x8}, 0x1c)
r3 = socket$inet6_tcp(0xa, 0x1, 0x0)
bind$inet6(r3, &(0x7f0000000000)={0xa, 0x4e25, 0x0, @local, 0x9}, 0x1c)
r4 = socket$inet6_tcp(0xa, 0x1, 0x0)
bind$inet6(r4, &(0x7f0000000000)={0xa, 0x4e26, 0x0, @local, 0xa}, 0x1c)
r5 = socket$inet6_tcp(0xa, 0x1, 0x0)
bind$inet6(r5, &(0x7f0000000000)={0xa, 0x4e27, 0x0, @local, 0xb}, 0x1c)
executing program 0:
r0 = fsopen(&(0x7f0000000000)='nfs\x00', 0x0)
fsconfig$FSCONFIG_SET_STRING(r0, 0x1, &(0x7f0000000040)='addr\x00', &(0x7f0000000080)='127.0.0.1\x00', 0x0)
fsconfig$FSCONFIG_SET_STRING(r0, 0x1, &(0x7f0000000140)='port\x00', &(0x7f0000000180)='0\x00', 0x0)
fsconfig$FSCONFIG_CMD_CREATE(r0, 0x6, 0x0, 0x0, 0x0)
executing program 3:
r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000000), 0x2, 0x0)
ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000100)={'\x00', 0x402})
r1 = socket$inet(0x2, 0x2, 0x0)
ioctl$sock_inet_SIOCSIFFLAGS(r1, 0x8914, &(0x7f0000000300)={'\x00', 0x1})
write$tun(r0, &(0x7f0000000200)={@void, @val={0x1, 0x1, 0x14, 0x10, 0x0, 0xe}, @eth={@broadcast, @broadcast, @void, {@generic={0x8847, "000001ff4500002800004000400600007f0000017f0000010050005000000000000000005002200000000000"}}}}, 0x60)
executing program 0:
r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000000), 0x2, 0x0)
ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000100)={'syz_tun\x00', 0x1001})
r1 = socket$nl_route(0x10, 0x3, 0x0)
sendmsg$nl_route(r1, &(0x7f00000000c0)={&(0x7f0000000000), 0x0, &(0x7f0000000140)={&(0x7f0000000180)=ANY=[@ANYBLOB="300000001800010600000000000000002d0100000000000100000000050001000a0000000c000500010000000c000000300000001800010600000000000000002d0100000000000100000000050001000b0000000c000500010000000c000000300000001800010600000000000000002d0100000000000100000000050001000c0000000c000500010000000c000000300000001800010600000000000000002d0100000000000100000000050001000d0000000c000500010000000c000000"], 0xc0}}, 0x0)
sendmsg$nl_route(r1, &(0x7f0000000240)={&(0x7f0000000000), 0x0, &(0x7f0000000280)={&(0x7f00000002c0)=ANY=[@ANYBLOB="1c0000001a00010301000000000000002d00"/28], 0x1c}}, 0x0)

program crashed: kernel BUG in mmap_region
bisect: the chunk can be dropped
bisect: testing without sub-chunk 2/2
bisect: no need to test this chunk, it's definitely needed
bisect: split chunks (needed=true): <5>, <5>
bisect: split chunk #0 of len 5 into 2 parts
bisect: testing without sub-chunk 1/2
testing program (duration=1m41s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): [2, 14, 4, 12, 4, 5, 5]
detailed listing:
executing program 2:
r0 = socket$nl_route(0x10, 0x3, 0x0)
sendmsg$nl_route(r0, &(0x7f0000000000)={&(0x7f0000000040), 0x10, &(0x7f0000000100)={&(0x7f0000000200)=@newlink={0x0, 0x10, 0x1, 0x0, 0x0, {0x0, 0x0, 0x0, 0x0, 0x100, 0x100}}}}, 0x0)
executing program 2:
mkdirat(0xffffffffffffff9c, &(0x7f0000000100)='./debug\x00', 0x1ff)
mount(0x0, &(0x7f0000000100)='./debug\x00', &(0x7f0000000140)='debugfs\x00', 0x0, 0x0)
mkdirat(0xffffffffffffff9c, &(0x7f0000000600)='./file0\x00', 0x1ff)
pipe2$9p(&(0x7f0000000000)={<r0=>0x0, <r1=>0x0}, 0x0)
r2 = openat(0xffffffffffffff9c, &(0x7f0000000200)='./debug/failslab/probability\x00', 0x1, 0x0)
write(r2, &(0x7f0000000300)='100\x00', 0x4)
r3 = openat(0xffffffffffffff9c, &(0x7f0000000400)='./debug/failslab/times\x00', 0x1, 0x0)
write(r3, &(0x7f0000000500)='100\x00', 0x4)
syz_clone(0x11, 0x0, 0x0, 0x0, 0x0, 0x0)
mount$9p_fd(0x0, &(0x7f0000000600)='./file0\x00', &(0x7f0000000700), 0x0, &(0x7f0000000800)={'trans=fd,', {'rfdno', 0x3d, r0}, 0x2c, {'wfdno', 0x3d, r1}, 0x2c, {[{@version_9p2000}, {@msize={'msize', 0x3d, 0x1000}}]}})
write$P9_RVERSION(r1, &(0x7f0000000900)={0x13, 0x65, 0xffff, 0x1000, 0x6, '9P2000'}, 0x13)
write$P9_RATTACH(r1, &(0x7f0000000a00)={0x13, 0x69, 0x1}, 0x13)
write$P9_RSTAT(r1, &(0x7f0000000b00)={0x0, 0x77, 0x1}, 0x13)
openat(0xffffffffffffff9c, &(0x7f0000000600)='./file0\x00', 0x0, 0x0)
executing program 3:
r0 = socket$netlink(0x10, 0x3, 0x0)
write(r0, &(0x7f0000000000)="580000001800050401000000000000000a800000fe040002000000001400010020010db800000000000000000000000106001500070000001800160008000100010000000c000b0008000100020000000800040001000000", 0x58)
syz_emit_ethernet(0x6a, &(0x7f0000000200)=ANY=[@ANYBLOB="aaaaaaaaaaaaaaaaaaaa86dd6000000000342b4020010db800000000000000000000000220010db8000000000000000000000001110404010100000020010db800000000000000000000000320010db800000000000000000000000430393039000c0000deadbeef"], 0x0)
nanosleep(&(0x7f0000000300)={0x0, 0x2faf080}, 0x0)
executing program 3:
r0 = socket$inet6_tcp(0xa, 0x1, 0x0)
bind$inet6(r0, &(0x7f0000000000)={0xa, 0x4e22, 0x0, @local, 0x6}, 0x1c)
r1 = socket$inet6_tcp(0xa, 0x1, 0x0)
bind$inet6(r1, &(0x7f0000000000)={0xa, 0x4e23, 0x0, @local, 0x7}, 0x1c)
r2 = socket$inet6_tcp(0xa, 0x1, 0x0)
bind$inet6(r2, &(0x7f0000000000)={0xa, 0x4e24, 0x0, @local, 0x8}, 0x1c)
r3 = socket$inet6_tcp(0xa, 0x1, 0x0)
bind$inet6(r3, &(0x7f0000000000)={0xa, 0x4e25, 0x0, @local, 0x9}, 0x1c)
r4 = socket$inet6_tcp(0xa, 0x1, 0x0)
bind$inet6(r4, &(0x7f0000000000)={0xa, 0x4e26, 0x0, @local, 0xa}, 0x1c)
r5 = socket$inet6_tcp(0xa, 0x1, 0x0)
bind$inet6(r5, &(0x7f0000000000)={0xa, 0x4e27, 0x0, @local, 0xb}, 0x1c)
executing program 0:
r0 = fsopen(&(0x7f0000000000)='nfs\x00', 0x0)
fsconfig$FSCONFIG_SET_STRING(r0, 0x1, &(0x7f0000000040)='addr\x00', &(0x7f0000000080)='127.0.0.1\x00', 0x0)
fsconfig$FSCONFIG_SET_STRING(r0, 0x1, &(0x7f0000000140)='port\x00', &(0x7f0000000180)='0\x00', 0x0)
fsconfig$FSCONFIG_CMD_CREATE(r0, 0x6, 0x0, 0x0, 0x0)
executing program 3:
r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000000), 0x2, 0x0)
ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000100)={'\x00', 0x402})
r1 = socket$inet(0x2, 0x2, 0x0)
ioctl$sock_inet_SIOCSIFFLAGS(r1, 0x8914, &(0x7f0000000300)={'\x00', 0x1})
write$tun(r0, &(0x7f0000000200)={@void, @val={0x1, 0x1, 0x14, 0x10, 0x0, 0xe}, @eth={@broadcast, @broadcast, @void, {@generic={0x8847, "000001ff4500002800004000400600007f0000017f0000010050005000000000000000005002200000000000"}}}}, 0x60)
executing program 0:
r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000000), 0x2, 0x0)
ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000100)={'syz_tun\x00', 0x1001})
r1 = socket$nl_route(0x10, 0x3, 0x0)
sendmsg$nl_route(r1, &(0x7f00000000c0)={&(0x7f0000000000), 0x0, &(0x7f0000000140)={&(0x7f0000000180)=ANY=[@ANYBLOB="300000001800010600000000000000002d0100000000000100000000050001000a0000000c000500010000000c000000300000001800010600000000000000002d0100000000000100000000050001000b0000000c000500010000000c000000300000001800010600000000000000002d0100000000000100000000050001000c0000000c000500010000000c000000300000001800010600000000000000002d0100000000000100000000050001000d0000000c000500010000000c000000"], 0xc0}}, 0x0)
sendmsg$nl_route(r1, &(0x7f0000000240)={&(0x7f0000000000), 0x0, &(0x7f0000000280)={&(0x7f00000002c0)=ANY=[@ANYBLOB="1c0000001a00010301000000000000002d00"/28], 0x1c}}, 0x0)

program crashed: kernel BUG in mmap_region
bisect: the chunk can be dropped
bisect: testing without sub-chunk 2/2
bisect: no need to test this chunk, it's definitely needed
bisect: split chunk #1 of len 5 into 2 parts
bisect: testing without sub-chunk 1/2
testing program (duration=1m41s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): [2, 14, 5, 5]
detailed listing:
executing program 2:
r0 = socket$nl_route(0x10, 0x3, 0x0)
sendmsg$nl_route(r0, &(0x7f0000000000)={&(0x7f0000000040), 0x10, &(0x7f0000000100)={&(0x7f0000000200)=@newlink={0x0, 0x10, 0x1, 0x0, 0x0, {0x0, 0x0, 0x0, 0x0, 0x100, 0x100}}}}, 0x0)
executing program 2:
mkdirat(0xffffffffffffff9c, &(0x7f0000000100)='./debug\x00', 0x1ff)
mount(0x0, &(0x7f0000000100)='./debug\x00', &(0x7f0000000140)='debugfs\x00', 0x0, 0x0)
mkdirat(0xffffffffffffff9c, &(0x7f0000000600)='./file0\x00', 0x1ff)
pipe2$9p(&(0x7f0000000000)={<r0=>0x0, <r1=>0x0}, 0x0)
r2 = openat(0xffffffffffffff9c, &(0x7f0000000200)='./debug/failslab/probability\x00', 0x1, 0x0)
write(r2, &(0x7f0000000300)='100\x00', 0x4)
r3 = openat(0xffffffffffffff9c, &(0x7f0000000400)='./debug/failslab/times\x00', 0x1, 0x0)
write(r3, &(0x7f0000000500)='100\x00', 0x4)
syz_clone(0x11, 0x0, 0x0, 0x0, 0x0, 0x0)
mount$9p_fd(0x0, &(0x7f0000000600)='./file0\x00', &(0x7f0000000700), 0x0, &(0x7f0000000800)={'trans=fd,', {'rfdno', 0x3d, r0}, 0x2c, {'wfdno', 0x3d, r1}, 0x2c, {[{@version_9p2000}, {@msize={'msize', 0x3d, 0x1000}}]}})
write$P9_RVERSION(r1, &(0x7f0000000900)={0x13, 0x65, 0xffff, 0x1000, 0x6, '9P2000'}, 0x13)
write$P9_RATTACH(r1, &(0x7f0000000a00)={0x13, 0x69, 0x1}, 0x13)
write$P9_RSTAT(r1, &(0x7f0000000b00)={0x0, 0x77, 0x1}, 0x13)
openat(0xffffffffffffff9c, &(0x7f0000000600)='./file0\x00', 0x0, 0x0)
executing program 3:
r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000000), 0x2, 0x0)
ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000100)={'\x00', 0x402})
r1 = socket$inet(0x2, 0x2, 0x0)
ioctl$sock_inet_SIOCSIFFLAGS(r1, 0x8914, &(0x7f0000000300)={'\x00', 0x1})
write$tun(r0, &(0x7f0000000200)={@void, @val={0x1, 0x1, 0x14, 0x10, 0x0, 0xe}, @eth={@broadcast, @broadcast, @void, {@generic={0x8847, "000001ff4500002800004000400600007f0000017f0000010050005000000000000000005002200000000000"}}}}, 0x60)
executing program 0:
r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000000), 0x2, 0x0)
ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000100)={'syz_tun\x00', 0x1001})
r1 = socket$nl_route(0x10, 0x3, 0x0)
sendmsg$nl_route(r1, &(0x7f00000000c0)={&(0x7f0000000000), 0x0, &(0x7f0000000140)={&(0x7f0000000180)=ANY=[@ANYBLOB="300000001800010600000000000000002d0100000000000100000000050001000a0000000c000500010000000c000000300000001800010600000000000000002d0100000000000100000000050001000b0000000c000500010000000c000000300000001800010600000000000000002d0100000000000100000000050001000c0000000c000500010000000c000000300000001800010600000000000000002d0100000000000100000000050001000d0000000c000500010000000c000000"], 0xc0}}, 0x0)
sendmsg$nl_route(r1, &(0x7f0000000240)={&(0x7f0000000000), 0x0, &(0x7f0000000280)={&(0x7f00000002c0)=ANY=[@ANYBLOB="1c0000001a00010301000000000000002d00"/28], 0x1c}}, 0x0)

program crashed: kernel BUG in mmap_region
bisect: the chunk can be dropped
bisect: testing without sub-chunk 2/2
bisect: no need to test this chunk, it's definitely needed
bisect: split chunks (needed=true): <2>, <2>
bisect: split chunk #0 of len 2 into 2 parts
bisect: testing without sub-chunk 1/2
testing program (duration=1m40s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): [14, 5, 5]
detailed listing:
executing program 2:
mkdirat(0xffffffffffffff9c, &(0x7f0000000100)='./debug\x00', 0x1ff)
mount(0x0, &(0x7f0000000100)='./debug\x00', &(0x7f0000000140)='debugfs\x00', 0x0, 0x0)
mkdirat(0xffffffffffffff9c, &(0x7f0000000600)='./file0\x00', 0x1ff)
pipe2$9p(&(0x7f0000000000)={<r0=>0x0, <r1=>0x0}, 0x0)
r2 = openat(0xffffffffffffff9c, &(0x7f0000000200)='./debug/failslab/probability\x00', 0x1, 0x0)
write(r2, &(0x7f0000000300)='100\x00', 0x4)
r3 = openat(0xffffffffffffff9c, &(0x7f0000000400)='./debug/failslab/times\x00', 0x1, 0x0)
write(r3, &(0x7f0000000500)='100\x00', 0x4)
syz_clone(0x11, 0x0, 0x0, 0x0, 0x0, 0x0)
mount$9p_fd(0x0, &(0x7f0000000600)='./file0\x00', &(0x7f0000000700), 0x0, &(0x7f0000000800)={'trans=fd,', {'rfdno', 0x3d, r0}, 0x2c, {'wfdno', 0x3d, r1}, 0x2c, {[{@version_9p2000}, {@msize={'msize', 0x3d, 0x1000}}]}})
write$P9_RVERSION(r1, &(0x7f0000000900)={0x13, 0x65, 0xffff, 0x1000, 0x6, '9P2000'}, 0x13)
write$P9_RATTACH(r1, &(0x7f0000000a00)={0x13, 0x69, 0x1}, 0x13)
write$P9_RSTAT(r1, &(0x7f0000000b00)={0x0, 0x77, 0x1}, 0x13)
openat(0xffffffffffffff9c, &(0x7f0000000600)='./file0\x00', 0x0, 0x0)
executing program 3:
r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000000), 0x2, 0x0)
ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000100)={'\x00', 0x402})
r1 = socket$inet(0x2, 0x2, 0x0)
ioctl$sock_inet_SIOCSIFFLAGS(r1, 0x8914, &(0x7f0000000300)={'\x00', 0x1})
write$tun(r0, &(0x7f0000000200)={@void, @val={0x1, 0x1, 0x14, 0x10, 0x0, 0xe}, @eth={@broadcast, @broadcast, @void, {@generic={0x8847, "000001ff4500002800004000400600007f0000017f0000010050005000000000000000005002200000000000"}}}}, 0x60)
executing program 0:
r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000000), 0x2, 0x0)
ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000100)={'syz_tun\x00', 0x1001})
r1 = socket$nl_route(0x10, 0x3, 0x0)
sendmsg$nl_route(r1, &(0x7f00000000c0)={&(0x7f0000000000), 0x0, &(0x7f0000000140)={&(0x7f0000000180)=ANY=[@ANYBLOB="300000001800010600000000000000002d0100000000000100000000050001000a0000000c000500010000000c000000300000001800010600000000000000002d0100000000000100000000050001000b0000000c000500010000000c000000300000001800010600000000000000002d0100000000000100000000050001000c0000000c000500010000000c000000300000001800010600000000000000002d0100000000000100000000050001000d0000000c000500010000000c000000"], 0xc0}}, 0x0)
sendmsg$nl_route(r1, &(0x7f0000000240)={&(0x7f0000000000), 0x0, &(0x7f0000000280)={&(0x7f00000002c0)=ANY=[@ANYBLOB="1c0000001a00010301000000000000002d00"/28], 0x1c}}, 0x0)

program crashed: kernel BUG in mmap_region
bisect: the chunk can be dropped
bisect: testing without sub-chunk 2/2
bisect: no need to test this chunk, it's definitely needed
bisect: split chunk #1 of len 2 into 2 parts
bisect: testing without sub-chunk 1/2
testing program (duration=1m40s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): [14, 5]
detailed listing:
executing program 2:
mkdirat(0xffffffffffffff9c, &(0x7f0000000100)='./debug\x00', 0x1ff)
mount(0x0, &(0x7f0000000100)='./debug\x00', &(0x7f0000000140)='debugfs\x00', 0x0, 0x0)
mkdirat(0xffffffffffffff9c, &(0x7f0000000600)='./file0\x00', 0x1ff)
pipe2$9p(&(0x7f0000000000)={<r0=>0x0, <r1=>0x0}, 0x0)
r2 = openat(0xffffffffffffff9c, &(0x7f0000000200)='./debug/failslab/probability\x00', 0x1, 0x0)
write(r2, &(0x7f0000000300)='100\x00', 0x4)
r3 = openat(0xffffffffffffff9c, &(0x7f0000000400)='./debug/failslab/times\x00', 0x1, 0x0)
write(r3, &(0x7f0000000500)='100\x00', 0x4)
syz_clone(0x11, 0x0, 0x0, 0x0, 0x0, 0x0)
mount$9p_fd(0x0, &(0x7f0000000600)='./file0\x00', &(0x7f0000000700), 0x0, &(0x7f0000000800)={'trans=fd,', {'rfdno', 0x3d, r0}, 0x2c, {'wfdno', 0x3d, r1}, 0x2c, {[{@version_9p2000}, {@msize={'msize', 0x3d, 0x1000}}]}})
write$P9_RVERSION(r1, &(0x7f0000000900)={0x13, 0x65, 0xffff, 0x1000, 0x6, '9P2000'}, 0x13)
write$P9_RATTACH(r1, &(0x7f0000000a00)={0x13, 0x69, 0x1}, 0x13)
write$P9_RSTAT(r1, &(0x7f0000000b00)={0x0, 0x77, 0x1}, 0x13)
openat(0xffffffffffffff9c, &(0x7f0000000600)='./file0\x00', 0x0, 0x0)
executing program 0:
r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000000), 0x2, 0x0)
ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000100)={'syz_tun\x00', 0x1001})
r1 = socket$nl_route(0x10, 0x3, 0x0)
sendmsg$nl_route(r1, &(0x7f00000000c0)={&(0x7f0000000000), 0x0, &(0x7f0000000140)={&(0x7f0000000180)=ANY=[@ANYBLOB="300000001800010600000000000000002d0100000000000100000000050001000a0000000c000500010000000c000000300000001800010600000000000000002d0100000000000100000000050001000b0000000c000500010000000c000000300000001800010600000000000000002d0100000000000100000000050001000c0000000c000500010000000c000000300000001800010600000000000000002d0100000000000100000000050001000d0000000c000500010000000c000000"], 0xc0}}, 0x0)
sendmsg$nl_route(r1, &(0x7f0000000240)={&(0x7f0000000000), 0x0, &(0x7f0000000280)={&(0x7f00000002c0)=ANY=[@ANYBLOB="1c0000001a00010301000000000000002d00"/28], 0x1c}}, 0x0)

program crashed: kernel BUG in mmap_region
bisect: the chunk can be dropped
bisect: testing without sub-chunk 2/2
bisect: no need to test this chunk, it's definitely needed
bisect: split chunks (needed=true): <1>, <1>
bisect: split chunk #0 of len 1 into 2 parts
bisect: no way to further split the chunk
bisect: split chunk #1 of len 1 into 2 parts
bisect: no way to further split the chunk
bisect: 2 programs left: 

executing program 2:
mkdirat(0xffffffffffffff9c, &(0x7f0000000100)='./debug\x00', 0x1ff)
mount(0x0, &(0x7f0000000100)='./debug\x00', &(0x7f0000000140)='debugfs\x00', 0x0, 0x0)
mkdirat(0xffffffffffffff9c, &(0x7f0000000600)='./file0\x00', 0x1ff)
pipe2$9p(&(0x7f0000000000)={<r0=>0x0, <r1=>0x0}, 0x0)
r2 = openat(0xffffffffffffff9c, &(0x7f0000000200)='./debug/failslab/probability\x00', 0x1, 0x0)
write(r2, &(0x7f0000000300)='100\x00', 0x4)
r3 = openat(0xffffffffffffff9c, &(0x7f0000000400)='./debug/failslab/times\x00', 0x1, 0x0)
write(r3, &(0x7f0000000500)='100\x00', 0x4)
syz_clone(0x11, 0x0, 0x0, 0x0, 0x0, 0x0)
mount$9p_fd(0x0, &(0x7f0000000600)='./file0\x00', &(0x7f0000000700), 0x0, &(0x7f0000000800)={'trans=fd,', {'rfdno', 0x3d, r0}, 0x2c, {'wfdno', 0x3d, r1}, 0x2c, {[{@version_9p2000}, {@msize={'msize', 0x3d, 0x1000}}]}})
write$P9_RVERSION(r1, &(0x7f0000000900)={0x13, 0x65, 0xffff, 0x1000, 0x6, '9P2000'}, 0x13)
write$P9_RATTACH(r1, &(0x7f0000000a00)={0x13, 0x69, 0x1}, 0x13)
write$P9_RSTAT(r1, &(0x7f0000000b00)={0x0, 0x77, 0x1}, 0x13)
openat(0xffffffffffffff9c, &(0x7f0000000600)='./file0\x00', 0x0, 0x0)
executing program 0:
r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000000), 0x2, 0x0)
ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000100)={'syz_tun\x00', 0x1001})
r1 = socket$nl_route(0x10, 0x3, 0x0)
sendmsg$nl_route(r1, &(0x7f00000000c0)={&(0x7f0000000000), 0x0, &(0x7f0000000140)={&(0x7f0000000180)=ANY=[@ANYBLOB="300000001800010600000000000000002d0100000000000100000000050001000a0000000c000500010000000c000000300000001800010600000000000000002d0100000000000100000000050001000b0000000c000500010000000c000000300000001800010600000000000000002d0100000000000100000000050001000c0000000c000500010000000c000000300000001800010600000000000000002d0100000000000100000000050001000d0000000c000500010000000c000000"], 0xc0}}, 0x0)
sendmsg$nl_route(r1, &(0x7f0000000240)={&(0x7f0000000000), 0x0, &(0x7f0000000280)={&(0x7f00000002c0)=ANY=[@ANYBLOB="1c0000001a00010301000000000000002d00"/28], 0x1c}}, 0x0)


bisect: trying to concatenate
bisect: concatenate 2 entries
minimizing program #0 before concatenation
testing program (duration=2m30s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): [13, 5]
detailed listing:
executing program 0:
mkdirat(0xffffffffffffff9c, &(0x7f0000000100)='./debug\x00', 0x1ff)
mount(0x0, &(0x7f0000000100)='./debug\x00', &(0x7f0000000140)='debugfs\x00', 0x0, 0x0)
mkdirat(0xffffffffffffff9c, &(0x7f0000000600)='./file0\x00', 0x1ff)
pipe2$9p(&(0x7f0000000000)={<r0=>0x0, <r1=>0x0}, 0x0)
r2 = openat(0xffffffffffffff9c, &(0x7f0000000200)='./debug/failslab/probability\x00', 0x1, 0x0)
write(r2, &(0x7f0000000300)='100\x00', 0x4)
r3 = openat(0xffffffffffffff9c, &(0x7f0000000400)='./debug/failslab/times\x00', 0x1, 0x0)
write(r3, &(0x7f0000000500)='100\x00', 0x4)
syz_clone(0x11, 0x0, 0x0, 0x0, 0x0, 0x0)
mount$9p_fd(0x0, &(0x7f0000000600)='./file0\x00', &(0x7f0000000700), 0x0, &(0x7f0000000800)={'trans=fd,', {'rfdno', 0x3d, r0}, 0x2c, {'wfdno', 0x3d, r1}, 0x2c, {[{@version_9p2000}, {@msize={'msize', 0x3d, 0x1000}}]}})
write$P9_RVERSION(r1, &(0x7f0000000900)={0x13, 0x65, 0xffff, 0x1000, 0x6, '9P2000'}, 0x13)
write$P9_RATTACH(r1, &(0x7f0000000a00)={0x13, 0x69, 0x1}, 0x13)
write$P9_RSTAT(r1, &(0x7f0000000b00)={0x0, 0x77, 0x1}, 0x13)
executing program 0:
r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000000), 0x2, 0x0)
ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000100)={'syz_tun\x00', 0x1001})
r1 = socket$nl_route(0x10, 0x3, 0x0)
sendmsg$nl_route(r1, &(0x7f00000000c0)={&(0x7f0000000000), 0x0, &(0x7f0000000140)={&(0x7f0000000180)=ANY=[@ANYBLOB="300000001800010600000000000000002d0100000000000100000000050001000a0000000c000500010000000c000000300000001800010600000000000000002d0100000000000100000000050001000b0000000c000500010000000c000000300000001800010600000000000000002d0100000000000100000000050001000c0000000c000500010000000c000000300000001800010600000000000000002d0100000000000100000000050001000d0000000c000500010000000c000000"], 0xc0}}, 0x0)
sendmsg$nl_route(r1, &(0x7f0000000240)={&(0x7f0000000000), 0x0, &(0x7f0000000280)={&(0x7f00000002c0)=ANY=[@ANYBLOB="1c0000001a00010301000000000000002d00"/28], 0x1c}}, 0x0)

program crashed: kernel BUG in mmap_region
testing program (duration=2m30s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): [12, 5]
detailed listing:
executing program 0:
mkdirat(0xffffffffffffff9c, &(0x7f0000000100)='./debug\x00', 0x1ff)
mount(0x0, &(0x7f0000000100)='./debug\x00', &(0x7f0000000140)='debugfs\x00', 0x0, 0x0)
mkdirat(0xffffffffffffff9c, &(0x7f0000000600)='./file0\x00', 0x1ff)
pipe2$9p(&(0x7f0000000000)={<r0=>0x0, <r1=>0x0}, 0x0)
r2 = openat(0xffffffffffffff9c, &(0x7f0000000200)='./debug/failslab/probability\x00', 0x1, 0x0)
write(r2, &(0x7f0000000300)='100\x00', 0x4)
r3 = openat(0xffffffffffffff9c, &(0x7f0000000400)='./debug/failslab/times\x00', 0x1, 0x0)
write(r3, &(0x7f0000000500)='100\x00', 0x4)
syz_clone(0x11, 0x0, 0x0, 0x0, 0x0, 0x0)
mount$9p_fd(0x0, &(0x7f0000000600)='./file0\x00', &(0x7f0000000700), 0x0, &(0x7f0000000800)={'trans=fd,', {'rfdno', 0x3d, r0}, 0x2c, {'wfdno', 0x3d, r1}, 0x2c, {[{@version_9p2000}, {@msize={'msize', 0x3d, 0x1000}}]}})
write$P9_RVERSION(r1, &(0x7f0000000900)={0x13, 0x65, 0xffff, 0x1000, 0x6, '9P2000'}, 0x13)
write$P9_RATTACH(r1, &(0x7f0000000a00)={0x13, 0x69, 0x1}, 0x13)
executing program 0:
r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000000), 0x2, 0x0)
ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000100)={'syz_tun\x00', 0x1001})
r1 = socket$nl_route(0x10, 0x3, 0x0)
sendmsg$nl_route(r1, &(0x7f00000000c0)={&(0x7f0000000000), 0x0, &(0x7f0000000140)={&(0x7f0000000180)=ANY=[@ANYBLOB="300000001800010600000000000000002d0100000000000100000000050001000a0000000c000500010000000c000000300000001800010600000000000000002d0100000000000100000000050001000b0000000c000500010000000c000000300000001800010600000000000000002d0100000000000100000000050001000c0000000c000500010000000c000000300000001800010600000000000000002d0100000000000100000000050001000d0000000c000500010000000c000000"], 0xc0}}, 0x0)
sendmsg$nl_route(r1, &(0x7f0000000240)={&(0x7f0000000000), 0x0, &(0x7f0000000280)={&(0x7f00000002c0)=ANY=[@ANYBLOB="1c0000001a00010301000000000000002d00"/28], 0x1c}}, 0x0)

program crashed: kernel BUG in mmap_region
testing program (duration=2m30s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): [11, 5]
detailed listing:
executing program 0:
mkdirat(0xffffffffffffff9c, &(0x7f0000000100)='./debug\x00', 0x1ff)
mount(0x0, &(0x7f0000000100)='./debug\x00', &(0x7f0000000140)='debugfs\x00', 0x0, 0x0)
mkdirat(0xffffffffffffff9c, &(0x7f0000000600)='./file0\x00', 0x1ff)
pipe2$9p(&(0x7f0000000000)={<r0=>0x0, <r1=>0x0}, 0x0)
r2 = openat(0xffffffffffffff9c, &(0x7f0000000200)='./debug/failslab/probability\x00', 0x1, 0x0)
write(r2, &(0x7f0000000300)='100\x00', 0x4)
r3 = openat(0xffffffffffffff9c, &(0x7f0000000400)='./debug/failslab/times\x00', 0x1, 0x0)
write(r3, &(0x7f0000000500)='100\x00', 0x4)
syz_clone(0x11, 0x0, 0x0, 0x0, 0x0, 0x0)
mount$9p_fd(0x0, &(0x7f0000000600)='./file0\x00', &(0x7f0000000700), 0x0, &(0x7f0000000800)={'trans=fd,', {'rfdno', 0x3d, r0}, 0x2c, {'wfdno', 0x3d, r1}, 0x2c, {[{@version_9p2000}, {@msize={'msize', 0x3d, 0x1000}}]}})
write$P9_RVERSION(r1, &(0x7f0000000900)={0x13, 0x65, 0xffff, 0x1000, 0x6, '9P2000'}, 0x13)
executing program 0:
r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000000), 0x2, 0x0)
ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000100)={'syz_tun\x00', 0x1001})
r1 = socket$nl_route(0x10, 0x3, 0x0)
sendmsg$nl_route(r1, &(0x7f00000000c0)={&(0x7f0000000000), 0x0, &(0x7f0000000140)={&(0x7f0000000180)=ANY=[@ANYBLOB="300000001800010600000000000000002d0100000000000100000000050001000a0000000c000500010000000c000000300000001800010600000000000000002d0100000000000100000000050001000b0000000c000500010000000c000000300000001800010600000000000000002d0100000000000100000000050001000c0000000c000500010000000c000000300000001800010600000000000000002d0100000000000100000000050001000d0000000c000500010000000c000000"], 0xc0}}, 0x0)
sendmsg$nl_route(r1, &(0x7f0000000240)={&(0x7f0000000000), 0x0, &(0x7f0000000280)={&(0x7f00000002c0)=ANY=[@ANYBLOB="1c0000001a00010301000000000000002d00"/28], 0x1c}}, 0x0)

program crashed: kernel BUG in mmap_region
testing program (duration=2m30s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): [10, 5]
detailed listing:
executing program 0:
mkdirat(0xffffffffffffff9c, &(0x7f0000000100)='./debug\x00', 0x1ff)
mount(0x0, &(0x7f0000000100)='./debug\x00', &(0x7f0000000140)='debugfs\x00', 0x0, 0x0)
mkdirat(0xffffffffffffff9c, &(0x7f0000000600)='./file0\x00', 0x1ff)
pipe2$9p(&(0x7f0000000000)={<r0=>0x0, <r1=>0x0}, 0x0)
r2 = openat(0xffffffffffffff9c, &(0x7f0000000200)='./debug/failslab/probability\x00', 0x1, 0x0)
write(r2, &(0x7f0000000300)='100\x00', 0x4)
r3 = openat(0xffffffffffffff9c, &(0x7f0000000400)='./debug/failslab/times\x00', 0x1, 0x0)
write(r3, &(0x7f0000000500)='100\x00', 0x4)
syz_clone(0x11, 0x0, 0x0, 0x0, 0x0, 0x0)
mount$9p_fd(0x0, &(0x7f0000000600)='./file0\x00', &(0x7f0000000700), 0x0, &(0x7f0000000800)={'trans=fd,', {'rfdno', 0x3d, r0}, 0x2c, {'wfdno', 0x3d, r1}, 0x2c, {[{@version_9p2000}, {@msize={'msize', 0x3d, 0x1000}}]}})
executing program 0:
r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000000), 0x2, 0x0)
ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000100)={'syz_tun\x00', 0x1001})
r1 = socket$nl_route(0x10, 0x3, 0x0)
sendmsg$nl_route(r1, &(0x7f00000000c0)={&(0x7f0000000000), 0x0, &(0x7f0000000140)={&(0x7f0000000180)=ANY=[@ANYBLOB="300000001800010600000000000000002d0100000000000100000000050001000a0000000c000500010000000c000000300000001800010600000000000000002d0100000000000100000000050001000b0000000c000500010000000c000000300000001800010600000000000000002d0100000000000100000000050001000c0000000c000500010000000c000000300000001800010600000000000000002d0100000000000100000000050001000d0000000c000500010000000c000000"], 0xc0}}, 0x0)
sendmsg$nl_route(r1, &(0x7f0000000240)={&(0x7f0000000000), 0x0, &(0x7f0000000280)={&(0x7f00000002c0)=ANY=[@ANYBLOB="1c0000001a00010301000000000000002d00"/28], 0x1c}}, 0x0)

program crashed: kernel BUG in mmap_region
testing program (duration=2m30s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): [9, 5]
detailed listing:
executing program 0:
mkdirat(0xffffffffffffff9c, &(0x7f0000000100)='./debug\x00', 0x1ff)
mount(0x0, &(0x7f0000000100)='./debug\x00', &(0x7f0000000140)='debugfs\x00', 0x0, 0x0)
mkdirat(0xffffffffffffff9c, &(0x7f0000000600)='./file0\x00', 0x1ff)
pipe2$9p(&(0x7f0000000000)={0x0, 0x0}, 0x0)
r0 = openat(0xffffffffffffff9c, &(0x7f0000000200)='./debug/failslab/probability\x00', 0x1, 0x0)
write(r0, &(0x7f0000000300)='100\x00', 0x4)
r1 = openat(0xffffffffffffff9c, &(0x7f0000000400)='./debug/failslab/times\x00', 0x1, 0x0)
write(r1, &(0x7f0000000500)='100\x00', 0x4)
syz_clone(0x11, 0x0, 0x0, 0x0, 0x0, 0x0)
executing program 0:
r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000000), 0x2, 0x0)
ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000100)={'syz_tun\x00', 0x1001})
r1 = socket$nl_route(0x10, 0x3, 0x0)
sendmsg$nl_route(r1, &(0x7f00000000c0)={&(0x7f0000000000), 0x0, &(0x7f0000000140)={&(0x7f0000000180)=ANY=[@ANYBLOB="300000001800010600000000000000002d0100000000000100000000050001000a0000000c000500010000000c000000300000001800010600000000000000002d0100000000000100000000050001000b0000000c000500010000000c000000300000001800010600000000000000002d0100000000000100000000050001000c0000000c000500010000000c000000300000001800010600000000000000002d0100000000000100000000050001000d0000000c000500010000000c000000"], 0xc0}}, 0x0)
sendmsg$nl_route(r1, &(0x7f0000000240)={&(0x7f0000000000), 0x0, &(0x7f0000000280)={&(0x7f00000002c0)=ANY=[@ANYBLOB="1c0000001a00010301000000000000002d00"/28], 0x1c}}, 0x0)

program crashed: kernel BUG in mmap_region
testing program (duration=2m30s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): [8, 5]
detailed listing:
executing program 0:
mkdirat(0xffffffffffffff9c, &(0x7f0000000100)='./debug\x00', 0x1ff)
mount(0x0, &(0x7f0000000100)='./debug\x00', &(0x7f0000000140)='debugfs\x00', 0x0, 0x0)
mkdirat(0xffffffffffffff9c, &(0x7f0000000600)='./file0\x00', 0x1ff)
pipe2$9p(&(0x7f0000000000)={0x0, 0x0}, 0x0)
r0 = openat(0xffffffffffffff9c, &(0x7f0000000200)='./debug/failslab/probability\x00', 0x1, 0x0)
write(r0, &(0x7f0000000300)='100\x00', 0x4)
r1 = openat(0xffffffffffffff9c, &(0x7f0000000400)='./debug/failslab/times\x00', 0x1, 0x0)
write(r1, &(0x7f0000000500)='100\x00', 0x4)
executing program 0:
r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000000), 0x2, 0x0)
ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000100)={'syz_tun\x00', 0x1001})
r1 = socket$nl_route(0x10, 0x3, 0x0)
sendmsg$nl_route(r1, &(0x7f00000000c0)={&(0x7f0000000000), 0x0, &(0x7f0000000140)={&(0x7f0000000180)=ANY=[@ANYBLOB="300000001800010600000000000000002d0100000000000100000000050001000a0000000c000500010000000c000000300000001800010600000000000000002d0100000000000100000000050001000b0000000c000500010000000c000000300000001800010600000000000000002d0100000000000100000000050001000c0000000c000500010000000c000000300000001800010600000000000000002d0100000000000100000000050001000d0000000c000500010000000c000000"], 0xc0}}, 0x0)
sendmsg$nl_route(r1, &(0x7f0000000240)={&(0x7f0000000000), 0x0, &(0x7f0000000280)={&(0x7f00000002c0)=ANY=[@ANYBLOB="1c0000001a00010301000000000000002d00"/28], 0x1c}}, 0x0)

program crashed: kernel BUG in mmap_region
testing program (duration=2m30s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): [7, 5]
detailed listing:
executing program 0:
mkdirat(0xffffffffffffff9c, &(0x7f0000000100)='./debug\x00', 0x1ff)
mount(0x0, &(0x7f0000000100)='./debug\x00', &(0x7f0000000140)='debugfs\x00', 0x0, 0x0)
mkdirat(0xffffffffffffff9c, &(0x7f0000000600)='./file0\x00', 0x1ff)
pipe2$9p(&(0x7f0000000000)={0x0, 0x0}, 0x0)
r0 = openat(0xffffffffffffff9c, &(0x7f0000000200)='./debug/failslab/probability\x00', 0x1, 0x0)
write(r0, &(0x7f0000000300)='100\x00', 0x4)
openat(0xffffffffffffff9c, &(0x7f0000000400)='./debug/failslab/times\x00', 0x1, 0x0)
executing program 0:
r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000000), 0x2, 0x0)
ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000100)={'syz_tun\x00', 0x1001})
r1 = socket$nl_route(0x10, 0x3, 0x0)
sendmsg$nl_route(r1, &(0x7f00000000c0)={&(0x7f0000000000), 0x0, &(0x7f0000000140)={&(0x7f0000000180)=ANY=[@ANYBLOB="300000001800010600000000000000002d0100000000000100000000050001000a0000000c000500010000000c000000300000001800010600000000000000002d0100000000000100000000050001000b0000000c000500010000000c000000300000001800010600000000000000002d0100000000000100000000050001000c0000000c000500010000000c000000300000001800010600000000000000002d0100000000000100000000050001000d0000000c000500010000000c000000"], 0xc0}}, 0x0)
sendmsg$nl_route(r1, &(0x7f0000000240)={&(0x7f0000000000), 0x0, &(0x7f0000000280)={&(0x7f00000002c0)=ANY=[@ANYBLOB="1c0000001a00010301000000000000002d00"/28], 0x1c}}, 0x0)

program did not crash
testing program (duration=2m30s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): [7, 5]
detailed listing:
executing program 0:
mkdirat(0xffffffffffffff9c, &(0x7f0000000100)='./debug\x00', 0x1ff)
mount(0x0, &(0x7f0000000100)='./debug\x00', &(0x7f0000000140)='debugfs\x00', 0x0, 0x0)
mkdirat(0xffffffffffffff9c, &(0x7f0000000600)='./file0\x00', 0x1ff)
pipe2$9p(&(0x7f0000000000)={0x0, 0x0}, 0x0)
r0 = openat(0xffffffffffffff9c, &(0x7f0000000200)='./debug/failslab/probability\x00', 0x1, 0x0)
write(r0, &(0x7f0000000300)='100\x00', 0x4)
write(0xffffffffffffffff, &(0x7f0000000500)='100\x00', 0x4)
executing program 0:
r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000000), 0x2, 0x0)
ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000100)={'syz_tun\x00', 0x1001})
r1 = socket$nl_route(0x10, 0x3, 0x0)
sendmsg$nl_route(r1, &(0x7f00000000c0)={&(0x7f0000000000), 0x0, &(0x7f0000000140)={&(0x7f0000000180)=ANY=[@ANYBLOB="300000001800010600000000000000002d0100000000000100000000050001000a0000000c000500010000000c000000300000001800010600000000000000002d0100000000000100000000050001000b0000000c000500010000000c000000300000001800010600000000000000002d0100000000000100000000050001000c0000000c000500010000000c000000300000001800010600000000000000002d0100000000000100000000050001000d0000000c000500010000000c000000"], 0xc0}}, 0x0)
sendmsg$nl_route(r1, &(0x7f0000000240)={&(0x7f0000000000), 0x0, &(0x7f0000000280)={&(0x7f00000002c0)=ANY=[@ANYBLOB="1c0000001a00010301000000000000002d00"/28], 0x1c}}, 0x0)

program did not crash
testing program (duration=2m30s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): [7, 5]
detailed listing:
executing program 0:
mkdirat(0xffffffffffffff9c, &(0x7f0000000100)='./debug\x00', 0x1ff)
mount(0x0, &(0x7f0000000100)='./debug\x00', &(0x7f0000000140)='debugfs\x00', 0x0, 0x0)
mkdirat(0xffffffffffffff9c, &(0x7f0000000600)='./file0\x00', 0x1ff)
pipe2$9p(&(0x7f0000000000)={0x0, 0x0}, 0x0)
openat(0xffffffffffffff9c, &(0x7f0000000200)='./debug/failslab/probability\x00', 0x1, 0x0)
r0 = openat(0xffffffffffffff9c, &(0x7f0000000400)='./debug/failslab/times\x00', 0x1, 0x0)
write(r0, &(0x7f0000000500)='100\x00', 0x4)
executing program 0:
r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000000), 0x2, 0x0)
ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000100)={'syz_tun\x00', 0x1001})
r1 = socket$nl_route(0x10, 0x3, 0x0)
sendmsg$nl_route(r1, &(0x7f00000000c0)={&(0x7f0000000000), 0x0, &(0x7f0000000140)={&(0x7f0000000180)=ANY=[@ANYBLOB="300000001800010600000000000000002d0100000000000100000000050001000a0000000c000500010000000c000000300000001800010600000000000000002d0100000000000100000000050001000b0000000c000500010000000c000000300000001800010600000000000000002d0100000000000100000000050001000c0000000c000500010000000c000000300000001800010600000000000000002d0100000000000100000000050001000d0000000c000500010000000c000000"], 0xc0}}, 0x0)
sendmsg$nl_route(r1, &(0x7f0000000240)={&(0x7f0000000000), 0x0, &(0x7f0000000280)={&(0x7f00000002c0)=ANY=[@ANYBLOB="1c0000001a00010301000000000000002d00"/28], 0x1c}}, 0x0)

program did not crash
testing program (duration=2m30s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): [7, 5]
detailed listing:
executing program 0:
mkdirat(0xffffffffffffff9c, &(0x7f0000000100)='./debug\x00', 0x1ff)
mount(0x0, &(0x7f0000000100)='./debug\x00', &(0x7f0000000140)='debugfs\x00', 0x0, 0x0)
mkdirat(0xffffffffffffff9c, &(0x7f0000000600)='./file0\x00', 0x1ff)
pipe2$9p(&(0x7f0000000000)={0x0, 0x0}, 0x0)
write(0xffffffffffffffff, &(0x7f0000000300)='100\x00', 0x4)
r0 = openat(0xffffffffffffff9c, &(0x7f0000000400)='./debug/failslab/times\x00', 0x1, 0x0)
write(r0, &(0x7f0000000500)='100\x00', 0x4)
executing program 0:
r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000000), 0x2, 0x0)
ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000100)={'syz_tun\x00', 0x1001})
r1 = socket$nl_route(0x10, 0x3, 0x0)
sendmsg$nl_route(r1, &(0x7f00000000c0)={&(0x7f0000000000), 0x0, &(0x7f0000000140)={&(0x7f0000000180)=ANY=[@ANYBLOB="300000001800010600000000000000002d0100000000000100000000050001000a0000000c000500010000000c000000300000001800010600000000000000002d0100000000000100000000050001000b0000000c000500010000000c000000300000001800010600000000000000002d0100000000000100000000050001000c0000000c000500010000000c000000300000001800010600000000000000002d0100000000000100000000050001000d0000000c000500010000000c000000"], 0xc0}}, 0x0)
sendmsg$nl_route(r1, &(0x7f0000000240)={&(0x7f0000000000), 0x0, &(0x7f0000000280)={&(0x7f00000002c0)=ANY=[@ANYBLOB="1c0000001a00010301000000000000002d00"/28], 0x1c}}, 0x0)

program did not crash
testing program (duration=2m30s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): [7, 5]
detailed listing:
executing program 0:
mkdirat(0xffffffffffffff9c, &(0x7f0000000100)='./debug\x00', 0x1ff)
mount(0x0, &(0x7f0000000100)='./debug\x00', &(0x7f0000000140)='debugfs\x00', 0x0, 0x0)
mkdirat(0xffffffffffffff9c, &(0x7f0000000600)='./file0\x00', 0x1ff)
r0 = openat(0xffffffffffffff9c, &(0x7f0000000200)='./debug/failslab/probability\x00', 0x1, 0x0)
write(r0, &(0x7f0000000300)='100\x00', 0x4)
r1 = openat(0xffffffffffffff9c, &(0x7f0000000400)='./debug/failslab/times\x00', 0x1, 0x0)
write(r1, &(0x7f0000000500)='100\x00', 0x4)
executing program 0:
r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000000), 0x2, 0x0)
ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000100)={'syz_tun\x00', 0x1001})
r1 = socket$nl_route(0x10, 0x3, 0x0)
sendmsg$nl_route(r1, &(0x7f00000000c0)={&(0x7f0000000000), 0x0, &(0x7f0000000140)={&(0x7f0000000180)=ANY=[@ANYBLOB="300000001800010600000000000000002d0100000000000100000000050001000a0000000c000500010000000c000000300000001800010600000000000000002d0100000000000100000000050001000b0000000c000500010000000c000000300000001800010600000000000000002d0100000000000100000000050001000c0000000c000500010000000c000000300000001800010600000000000000002d0100000000000100000000050001000d0000000c000500010000000c000000"], 0xc0}}, 0x0)
sendmsg$nl_route(r1, &(0x7f0000000240)={&(0x7f0000000000), 0x0, &(0x7f0000000280)={&(0x7f00000002c0)=ANY=[@ANYBLOB="1c0000001a00010301000000000000002d00"/28], 0x1c}}, 0x0)

program did not crash
testing program (duration=2m30s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): [7, 5]
detailed listing:
executing program 0:
mkdirat(0xffffffffffffff9c, &(0x7f0000000100)='./debug\x00', 0x1ff)
mount(0x0, &(0x7f0000000100)='./debug\x00', &(0x7f0000000140)='debugfs\x00', 0x0, 0x0)
pipe2$9p(&(0x7f0000000000)={0x0, 0x0}, 0x0)
r0 = openat(0xffffffffffffff9c, &(0x7f0000000200)='./debug/failslab/probability\x00', 0x1, 0x0)
write(r0, &(0x7f0000000300)='100\x00', 0x4)
r1 = openat(0xffffffffffffff9c, &(0x7f0000000400)='./debug/failslab/times\x00', 0x1, 0x0)
write(r1, &(0x7f0000000500)='100\x00', 0x4)
executing program 0:
r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000000), 0x2, 0x0)
ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000100)={'syz_tun\x00', 0x1001})
r1 = socket$nl_route(0x10, 0x3, 0x0)
sendmsg$nl_route(r1, &(0x7f00000000c0)={&(0x7f0000000000), 0x0, &(0x7f0000000140)={&(0x7f0000000180)=ANY=[@ANYBLOB="300000001800010600000000000000002d0100000000000100000000050001000a0000000c000500010000000c000000300000001800010600000000000000002d0100000000000100000000050001000b0000000c000500010000000c000000300000001800010600000000000000002d0100000000000100000000050001000c0000000c000500010000000c000000300000001800010600000000000000002d0100000000000100000000050001000d0000000c000500010000000c000000"], 0xc0}}, 0x0)
sendmsg$nl_route(r1, &(0x7f0000000240)={&(0x7f0000000000), 0x0, &(0x7f0000000280)={&(0x7f00000002c0)=ANY=[@ANYBLOB="1c0000001a00010301000000000000002d00"/28], 0x1c}}, 0x0)

program did not crash
testing program (duration=2m30s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): [7, 5]
detailed listing:
executing program 0:
mkdirat(0xffffffffffffff9c, &(0x7f0000000100)='./debug\x00', 0x1ff)
mkdirat(0xffffffffffffff9c, &(0x7f0000000600)='./file0\x00', 0x1ff)
pipe2$9p(&(0x7f0000000000)={0x0, 0x0}, 0x0)
r0 = openat(0xffffffffffffff9c, &(0x7f0000000200)='./debug/failslab/probability\x00', 0x1, 0x0)
write(r0, &(0x7f0000000300)='100\x00', 0x4)
r1 = openat(0xffffffffffffff9c, &(0x7f0000000400)='./debug/failslab/times\x00', 0x1, 0x0)
write(r1, &(0x7f0000000500)='100\x00', 0x4)
executing program 0:
r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000000), 0x2, 0x0)
ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000100)={'syz_tun\x00', 0x1001})
r1 = socket$nl_route(0x10, 0x3, 0x0)
sendmsg$nl_route(r1, &(0x7f00000000c0)={&(0x7f0000000000), 0x0, &(0x7f0000000140)={&(0x7f0000000180)=ANY=[@ANYBLOB="300000001800010600000000000000002d0100000000000100000000050001000a0000000c000500010000000c000000300000001800010600000000000000002d0100000000000100000000050001000b0000000c000500010000000c000000300000001800010600000000000000002d0100000000000100000000050001000c0000000c000500010000000c000000300000001800010600000000000000002d0100000000000100000000050001000d0000000c000500010000000c000000"], 0xc0}}, 0x0)
sendmsg$nl_route(r1, &(0x7f0000000240)={&(0x7f0000000000), 0x0, &(0x7f0000000280)={&(0x7f00000002c0)=ANY=[@ANYBLOB="1c0000001a00010301000000000000002d00"/28], 0x1c}}, 0x0)

program did not crash
testing program (duration=2m30s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): [7, 5]
detailed listing:
executing program 0:
mount(0x0, &(0x7f0000000100)='./debug\x00', &(0x7f0000000140)='debugfs\x00', 0x0, 0x0)
mkdirat(0xffffffffffffff9c, &(0x7f0000000600)='./file0\x00', 0x1ff)
pipe2$9p(&(0x7f0000000000)={0x0, 0x0}, 0x0)
r0 = openat(0xffffffffffffff9c, &(0x7f0000000200)='./debug/failslab/probability\x00', 0x1, 0x0)
write(r0, &(0x7f0000000300)='100\x00', 0x4)
r1 = openat(0xffffffffffffff9c, &(0x7f0000000400)='./debug/failslab/times\x00', 0x1, 0x0)
write(r1, &(0x7f0000000500)='100\x00', 0x4)
executing program 0:
r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000000), 0x2, 0x0)
ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000100)={'syz_tun\x00', 0x1001})
r1 = socket$nl_route(0x10, 0x3, 0x0)
sendmsg$nl_route(r1, &(0x7f00000000c0)={&(0x7f0000000000), 0x0, &(0x7f0000000140)={&(0x7f0000000180)=ANY=[@ANYBLOB="300000001800010600000000000000002d0100000000000100000000050001000a0000000c000500010000000c000000300000001800010600000000000000002d0100000000000100000000050001000b0000000c000500010000000c000000300000001800010600000000000000002d0100000000000100000000050001000c0000000c000500010000000c000000300000001800010600000000000000002d0100000000000100000000050001000d0000000c000500010000000c000000"], 0xc0}}, 0x0)
sendmsg$nl_route(r1, &(0x7f0000000240)={&(0x7f0000000000), 0x0, &(0x7f0000000280)={&(0x7f00000002c0)=ANY=[@ANYBLOB="1c0000001a00010301000000000000002d00"/28], 0x1c}}, 0x0)

program did not crash
minimized 14 calls -> 8 calls
minimizing program #1 before concatenation
testing program (duration=2m30s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): [8, 4]
detailed listing:
executing program 2:
mkdirat(0xffffffffffffff9c, &(0x7f0000000100)='./debug\x00', 0x1ff)
mount(0x0, &(0x7f0000000100)='./debug\x00', &(0x7f0000000140)='debugfs\x00', 0x0, 0x0)
mkdirat(0xffffffffffffff9c, &(0x7f0000000600)='./file0\x00', 0x1ff)
pipe2$9p(&(0x7f0000000000)={0x0, 0x0}, 0x0)
r0 = openat(0xffffffffffffff9c, &(0x7f0000000200)='./debug/failslab/probability\x00', 0x1, 0x0)
write(r0, &(0x7f0000000300)='100\x00', 0x4)
r1 = openat(0xffffffffffffff9c, &(0x7f0000000400)='./debug/failslab/times\x00', 0x1, 0x0)
write(r1, &(0x7f0000000500)='100\x00', 0x4)
executing program 0:
r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000000), 0x2, 0x0)
ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000100)={'syz_tun\x00', 0x1001})
r1 = socket$nl_route(0x10, 0x3, 0x0)
sendmsg$nl_route(r1, &(0x7f00000000c0)={&(0x7f0000000000), 0x0, &(0x7f0000000140)={&(0x7f0000000180)=ANY=[@ANYBLOB="300000001800010600000000000000002d0100000000000100000000050001000a0000000c000500010000000c000000300000001800010600000000000000002d0100000000000100000000050001000b0000000c000500010000000c000000300000001800010600000000000000002d0100000000000100000000050001000c0000000c000500010000000c000000300000001800010600000000000000002d0100000000000100000000050001000d0000000c000500010000000c000000"], 0xc0}}, 0x0)

program did not crash
testing program (duration=2m30s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): [8, 4]
detailed listing:
executing program 2:
mkdirat(0xffffffffffffff9c, &(0x7f0000000100)='./debug\x00', 0x1ff)
mount(0x0, &(0x7f0000000100)='./debug\x00', &(0x7f0000000140)='debugfs\x00', 0x0, 0x0)
mkdirat(0xffffffffffffff9c, &(0x7f0000000600)='./file0\x00', 0x1ff)
pipe2$9p(&(0x7f0000000000)={0x0, 0x0}, 0x0)
r0 = openat(0xffffffffffffff9c, &(0x7f0000000200)='./debug/failslab/probability\x00', 0x1, 0x0)
write(r0, &(0x7f0000000300)='100\x00', 0x4)
r1 = openat(0xffffffffffffff9c, &(0x7f0000000400)='./debug/failslab/times\x00', 0x1, 0x0)
write(r1, &(0x7f0000000500)='100\x00', 0x4)
executing program 0:
r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000000), 0x2, 0x0)
ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000100)={'syz_tun\x00', 0x1001})
r1 = socket$nl_route(0x10, 0x3, 0x0)
sendmsg$nl_route(r1, &(0x7f0000000240)={&(0x7f0000000000), 0x0, &(0x7f0000000280)={&(0x7f00000002c0)=ANY=[@ANYBLOB="1c0000001a00010301000000000000002d00"/28], 0x1c}}, 0x0)

program crashed: kernel BUG in mmap_region
testing program (duration=2m30s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): [8, 3]
detailed listing:
executing program 2:
mkdirat(0xffffffffffffff9c, &(0x7f0000000100)='./debug\x00', 0x1ff)
mount(0x0, &(0x7f0000000100)='./debug\x00', &(0x7f0000000140)='debugfs\x00', 0x0, 0x0)
mkdirat(0xffffffffffffff9c, &(0x7f0000000600)='./file0\x00', 0x1ff)
pipe2$9p(&(0x7f0000000000)={0x0, 0x0}, 0x0)
r0 = openat(0xffffffffffffff9c, &(0x7f0000000200)='./debug/failslab/probability\x00', 0x1, 0x0)
write(r0, &(0x7f0000000300)='100\x00', 0x4)
r1 = openat(0xffffffffffffff9c, &(0x7f0000000400)='./debug/failslab/times\x00', 0x1, 0x0)
write(r1, &(0x7f0000000500)='100\x00', 0x4)
executing program 0:
r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000000), 0x2, 0x0)
ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000100)={'syz_tun\x00', 0x1001})
sendmsg$nl_route(0xffffffffffffffff, &(0x7f0000000240)={&(0x7f0000000000), 0x0, &(0x7f0000000280)={&(0x7f00000002c0)=ANY=[@ANYBLOB="1c0000001a00010301000000000000002d00"/28], 0x1c}}, 0x0)

program did not crash
testing program (duration=2m30s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): [8, 3]
detailed listing:
executing program 2:
mkdirat(0xffffffffffffff9c, &(0x7f0000000100)='./debug\x00', 0x1ff)
mount(0x0, &(0x7f0000000100)='./debug\x00', &(0x7f0000000140)='debugfs\x00', 0x0, 0x0)
mkdirat(0xffffffffffffff9c, &(0x7f0000000600)='./file0\x00', 0x1ff)
pipe2$9p(&(0x7f0000000000)={0x0, 0x0}, 0x0)
r0 = openat(0xffffffffffffff9c, &(0x7f0000000200)='./debug/failslab/probability\x00', 0x1, 0x0)
write(r0, &(0x7f0000000300)='100\x00', 0x4)
r1 = openat(0xffffffffffffff9c, &(0x7f0000000400)='./debug/failslab/times\x00', 0x1, 0x0)
write(r1, &(0x7f0000000500)='100\x00', 0x4)
executing program 0:
openat$tun(0xffffffffffffff9c, &(0x7f0000000000), 0x2, 0x0)
r0 = socket$nl_route(0x10, 0x3, 0x0)
sendmsg$nl_route(r0, &(0x7f0000000240)={&(0x7f0000000000), 0x0, &(0x7f0000000280)={&(0x7f00000002c0)=ANY=[@ANYBLOB="1c0000001a00010301000000000000002d00"/28], 0x1c}}, 0x0)

program did not crash
testing program (duration=2m30s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): [8, 3]
detailed listing:
executing program 2:
mkdirat(0xffffffffffffff9c, &(0x7f0000000100)='./debug\x00', 0x1ff)
mount(0x0, &(0x7f0000000100)='./debug\x00', &(0x7f0000000140)='debugfs\x00', 0x0, 0x0)
mkdirat(0xffffffffffffff9c, &(0x7f0000000600)='./file0\x00', 0x1ff)
pipe2$9p(&(0x7f0000000000)={0x0, 0x0}, 0x0)
r0 = openat(0xffffffffffffff9c, &(0x7f0000000200)='./debug/failslab/probability\x00', 0x1, 0x0)
write(r0, &(0x7f0000000300)='100\x00', 0x4)
r1 = openat(0xffffffffffffff9c, &(0x7f0000000400)='./debug/failslab/times\x00', 0x1, 0x0)
write(r1, &(0x7f0000000500)='100\x00', 0x4)
executing program 0:
ioctl$TUNSETIFF(0xffffffffffffffff, 0x400454ca, &(0x7f0000000100)={'syz_tun\x00', 0x1001})
r0 = socket$nl_route(0x10, 0x3, 0x0)
sendmsg$nl_route(r0, &(0x7f0000000240)={&(0x7f0000000000), 0x0, &(0x7f0000000280)={&(0x7f00000002c0)=ANY=[@ANYBLOB="1c0000001a00010301000000000000002d00"/28], 0x1c}}, 0x0)

program did not crash
minimized 5 calls -> 4 calls
testing program (duration=2m30s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): mkdirat-mount-mkdirat-pipe2$9p-openat-write-openat-write-openat$tun-ioctl$TUNSETIFF-socket$nl_route-sendmsg$nl_route
detailed listing:
executing program 0:
mkdirat(0xffffffffffffff9c, &(0x7f0000000100)='./debug\x00', 0x1ff)
mount(0x0, &(0x7f0000000100)='./debug\x00', &(0x7f0000000140)='debugfs\x00', 0x0, 0x0)
mkdirat(0xffffffffffffff9c, &(0x7f0000000600)='./file0\x00', 0x1ff)
pipe2$9p(&(0x7f0000000000)={0x0, 0x0}, 0x0)
r0 = openat(0xffffffffffffff9c, &(0x7f0000000200)='./debug/failslab/probability\x00', 0x1, 0x0)
write(r0, &(0x7f0000000300)='100\x00', 0x4)
r1 = openat(0xffffffffffffff9c, &(0x7f0000000400)='./debug/failslab/times\x00', 0x1, 0x0)
write(r1, &(0x7f0000000500)='100\x00', 0x4)
r2 = openat$tun(0xffffffffffffff9c, &(0x7f0000000000), 0x2, 0x0)
ioctl$TUNSETIFF(r2, 0x400454ca, &(0x7f0000000100)={'syz_tun\x00', 0x1001})
r3 = socket$nl_route(0x10, 0x3, 0x0)
sendmsg$nl_route(r3, &(0x7f0000000240)={&(0x7f0000000000), 0x0, &(0x7f0000000280)={&(0x7f00000002c0)=ANY=[@ANYBLOB="1c0000001a00010301000000000000002d00"/28], 0x1c}}, 0x0)

program crashed: kernel BUG in mmap_region
bisect: concatenation succeeded
found reproducer with 12 syscalls
minimizing guilty program
testing program (duration=2m21.583758016s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): mkdirat-mount-mkdirat-pipe2$9p-openat-write-openat-write-openat$tun-ioctl$TUNSETIFF-socket$nl_route
detailed listing:
executing program 0:
mkdirat(0xffffffffffffff9c, &(0x7f0000000100)='./debug\x00', 0x1ff)
mount(0x0, &(0x7f0000000100)='./debug\x00', &(0x7f0000000140)='debugfs\x00', 0x0, 0x0)
mkdirat(0xffffffffffffff9c, &(0x7f0000000600)='./file0\x00', 0x1ff)
pipe2$9p(&(0x7f0000000000)={0x0, 0x0}, 0x0)
r0 = openat(0xffffffffffffff9c, &(0x7f0000000200)='./debug/failslab/probability\x00', 0x1, 0x0)
write(r0, &(0x7f0000000300)='100\x00', 0x4)
r1 = openat(0xffffffffffffff9c, &(0x7f0000000400)='./debug/failslab/times\x00', 0x1, 0x0)
write(r1, &(0x7f0000000500)='100\x00', 0x4)
r2 = openat$tun(0xffffffffffffff9c, &(0x7f0000000000), 0x2, 0x0)
ioctl$TUNSETIFF(r2, 0x400454ca, &(0x7f0000000100)={'syz_tun\x00', 0x1001})
socket$nl_route(0x10, 0x3, 0x0)

program crashed: kernel BUG in mmap_region
testing program (duration=2m21.583758016s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): mkdirat-mount-mkdirat-pipe2$9p-openat-write-openat-write-openat$tun-ioctl$TUNSETIFF
detailed listing:
executing program 0:
mkdirat(0xffffffffffffff9c, &(0x7f0000000100)='./debug\x00', 0x1ff)
mount(0x0, &(0x7f0000000100)='./debug\x00', &(0x7f0000000140)='debugfs\x00', 0x0, 0x0)
mkdirat(0xffffffffffffff9c, &(0x7f0000000600)='./file0\x00', 0x1ff)
pipe2$9p(&(0x7f0000000000)={0x0, 0x0}, 0x0)
r0 = openat(0xffffffffffffff9c, &(0x7f0000000200)='./debug/failslab/probability\x00', 0x1, 0x0)
write(r0, &(0x7f0000000300)='100\x00', 0x4)
r1 = openat(0xffffffffffffff9c, &(0x7f0000000400)='./debug/failslab/times\x00', 0x1, 0x0)
write(r1, &(0x7f0000000500)='100\x00', 0x4)
r2 = openat$tun(0xffffffffffffff9c, &(0x7f0000000000), 0x2, 0x0)
ioctl$TUNSETIFF(r2, 0x400454ca, &(0x7f0000000100)={'syz_tun\x00', 0x1001})

program crashed: kernel BUG in mmap_region
testing program (duration=2m21.583758016s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): mkdirat-mount-mkdirat-pipe2$9p-openat-write-openat-write-openat$tun
detailed listing:
executing program 0:
mkdirat(0xffffffffffffff9c, &(0x7f0000000100)='./debug\x00', 0x1ff)
mount(0x0, &(0x7f0000000100)='./debug\x00', &(0x7f0000000140)='debugfs\x00', 0x0, 0x0)
mkdirat(0xffffffffffffff9c, &(0x7f0000000600)='./file0\x00', 0x1ff)
pipe2$9p(&(0x7f0000000000)={0x0, 0x0}, 0x0)
r0 = openat(0xffffffffffffff9c, &(0x7f0000000200)='./debug/failslab/probability\x00', 0x1, 0x0)
write(r0, &(0x7f0000000300)='100\x00', 0x4)
r1 = openat(0xffffffffffffff9c, &(0x7f0000000400)='./debug/failslab/times\x00', 0x1, 0x0)
write(r1, &(0x7f0000000500)='100\x00', 0x4)
openat$tun(0xffffffffffffff9c, &(0x7f0000000000), 0x2, 0x0)

program did not crash
testing program (duration=2m21.583758016s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): mkdirat-mount-mkdirat-pipe2$9p-openat-write-openat-write-ioctl$TUNSETIFF
detailed listing:
executing program 0:
mkdirat(0xffffffffffffff9c, &(0x7f0000000100)='./debug\x00', 0x1ff)
mount(0x0, &(0x7f0000000100)='./debug\x00', &(0x7f0000000140)='debugfs\x00', 0x0, 0x0)
mkdirat(0xffffffffffffff9c, &(0x7f0000000600)='./file0\x00', 0x1ff)
pipe2$9p(&(0x7f0000000000)={0x0, 0x0}, 0x0)
r0 = openat(0xffffffffffffff9c, &(0x7f0000000200)='./debug/failslab/probability\x00', 0x1, 0x0)
write(r0, &(0x7f0000000300)='100\x00', 0x4)
r1 = openat(0xffffffffffffff9c, &(0x7f0000000400)='./debug/failslab/times\x00', 0x1, 0x0)
write(r1, &(0x7f0000000500)='100\x00', 0x4)
ioctl$TUNSETIFF(0xffffffffffffffff, 0x400454ca, &(0x7f0000000100)={'syz_tun\x00', 0x1001})

program crashed: kernel BUG in mmap_region
testing program (duration=2m21.583758016s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): mkdirat-mount-mkdirat-pipe2$9p-openat-write-openat-ioctl$TUNSETIFF
detailed listing:
executing program 0:
mkdirat(0xffffffffffffff9c, &(0x7f0000000100)='./debug\x00', 0x1ff)
mount(0x0, &(0x7f0000000100)='./debug\x00', &(0x7f0000000140)='debugfs\x00', 0x0, 0x0)
mkdirat(0xffffffffffffff9c, &(0x7f0000000600)='./file0\x00', 0x1ff)
pipe2$9p(&(0x7f0000000000)={0x0, 0x0}, 0x0)
r0 = openat(0xffffffffffffff9c, &(0x7f0000000200)='./debug/failslab/probability\x00', 0x1, 0x0)
write(r0, &(0x7f0000000300)='100\x00', 0x4)
openat(0xffffffffffffff9c, &(0x7f0000000400)='./debug/failslab/times\x00', 0x1, 0x0)
ioctl$TUNSETIFF(0xffffffffffffffff, 0x400454ca, &(0x7f0000000100)={'syz_tun\x00', 0x1001})

program did not crash
testing program (duration=2m21.583758016s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): mkdirat-mount-mkdirat-pipe2$9p-openat-write-write-ioctl$TUNSETIFF
detailed listing:
executing program 0:
mkdirat(0xffffffffffffff9c, &(0x7f0000000100)='./debug\x00', 0x1ff)
mount(0x0, &(0x7f0000000100)='./debug\x00', &(0x7f0000000140)='debugfs\x00', 0x0, 0x0)
mkdirat(0xffffffffffffff9c, &(0x7f0000000600)='./file0\x00', 0x1ff)
pipe2$9p(&(0x7f0000000000)={0x0, 0x0}, 0x0)
r0 = openat(0xffffffffffffff9c, &(0x7f0000000200)='./debug/failslab/probability\x00', 0x1, 0x0)
write(r0, &(0x7f0000000300)='100\x00', 0x4)
write(0xffffffffffffffff, &(0x7f0000000500)='100\x00', 0x4)
ioctl$TUNSETIFF(0xffffffffffffffff, 0x400454ca, &(0x7f0000000100)={'syz_tun\x00', 0x1001})

program did not crash
testing program (duration=2m21.583758016s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): mkdirat-mount-mkdirat-pipe2$9p-openat-openat-write-ioctl$TUNSETIFF
detailed listing:
executing program 0:
mkdirat(0xffffffffffffff9c, &(0x7f0000000100)='./debug\x00', 0x1ff)
mount(0x0, &(0x7f0000000100)='./debug\x00', &(0x7f0000000140)='debugfs\x00', 0x0, 0x0)
mkdirat(0xffffffffffffff9c, &(0x7f0000000600)='./file0\x00', 0x1ff)
pipe2$9p(&(0x7f0000000000)={0x0, 0x0}, 0x0)
openat(0xffffffffffffff9c, &(0x7f0000000200)='./debug/failslab/probability\x00', 0x1, 0x0)
r0 = openat(0xffffffffffffff9c, &(0x7f0000000400)='./debug/failslab/times\x00', 0x1, 0x0)
write(r0, &(0x7f0000000500)='100\x00', 0x4)
ioctl$TUNSETIFF(0xffffffffffffffff, 0x400454ca, &(0x7f0000000100)={'syz_tun\x00', 0x1001})

program did not crash
testing program (duration=2m21.583758016s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): mkdirat-mount-mkdirat-pipe2$9p-write-openat-write-ioctl$TUNSETIFF
detailed listing:
executing program 0:
mkdirat(0xffffffffffffff9c, &(0x7f0000000100)='./debug\x00', 0x1ff)
mount(0x0, &(0x7f0000000100)='./debug\x00', &(0x7f0000000140)='debugfs\x00', 0x0, 0x0)
mkdirat(0xffffffffffffff9c, &(0x7f0000000600)='./file0\x00', 0x1ff)
pipe2$9p(&(0x7f0000000000)={0x0, 0x0}, 0x0)
write(0xffffffffffffffff, &(0x7f0000000300)='100\x00', 0x4)
r0 = openat(0xffffffffffffff9c, &(0x7f0000000400)='./debug/failslab/times\x00', 0x1, 0x0)
write(r0, &(0x7f0000000500)='100\x00', 0x4)
ioctl$TUNSETIFF(0xffffffffffffffff, 0x400454ca, &(0x7f0000000100)={'syz_tun\x00', 0x1001})

program did not crash
testing program (duration=2m21.583758016s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): mkdirat-mount-mkdirat-openat-write-openat-write-ioctl$TUNSETIFF
detailed listing:
executing program 0:
mkdirat(0xffffffffffffff9c, &(0x7f0000000100)='./debug\x00', 0x1ff)
mount(0x0, &(0x7f0000000100)='./debug\x00', &(0x7f0000000140)='debugfs\x00', 0x0, 0x0)
mkdirat(0xffffffffffffff9c, &(0x7f0000000600)='./file0\x00', 0x1ff)
r0 = openat(0xffffffffffffff9c, &(0x7f0000000200)='./debug/failslab/probability\x00', 0x1, 0x0)
write(r0, &(0x7f0000000300)='100\x00', 0x4)
r1 = openat(0xffffffffffffff9c, &(0x7f0000000400)='./debug/failslab/times\x00', 0x1, 0x0)
write(r1, &(0x7f0000000500)='100\x00', 0x4)
ioctl$TUNSETIFF(0xffffffffffffffff, 0x400454ca, &(0x7f0000000100)={'syz_tun\x00', 0x1001})

program crashed: kernel BUG in mmap_region
testing program (duration=2m21.583758016s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): mkdirat-mount-openat-write-openat-write-ioctl$TUNSETIFF
detailed listing:
executing program 0:
mkdirat(0xffffffffffffff9c, &(0x7f0000000100)='./debug\x00', 0x1ff)
mount(0x0, &(0x7f0000000100)='./debug\x00', &(0x7f0000000140)='debugfs\x00', 0x0, 0x0)
r0 = openat(0xffffffffffffff9c, &(0x7f0000000200)='./debug/failslab/probability\x00', 0x1, 0x0)
write(r0, &(0x7f0000000300)='100\x00', 0x4)
r1 = openat(0xffffffffffffff9c, &(0x7f0000000400)='./debug/failslab/times\x00', 0x1, 0x0)
write(r1, &(0x7f0000000500)='100\x00', 0x4)
ioctl$TUNSETIFF(0xffffffffffffffff, 0x400454ca, &(0x7f0000000100)={'syz_tun\x00', 0x1001})

program crashed: kernel BUG in mmap_region
testing program (duration=2m21.583758016s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): mkdirat-openat-write-openat-write-ioctl$TUNSETIFF
detailed listing:
executing program 0:
mkdirat(0xffffffffffffff9c, &(0x7f0000000100)='./debug\x00', 0x1ff)
r0 = openat(0xffffffffffffff9c, &(0x7f0000000200)='./debug/failslab/probability\x00', 0x1, 0x0)
write(r0, &(0x7f0000000300)='100\x00', 0x4)
r1 = openat(0xffffffffffffff9c, &(0x7f0000000400)='./debug/failslab/times\x00', 0x1, 0x0)
write(r1, &(0x7f0000000500)='100\x00', 0x4)
ioctl$TUNSETIFF(0xffffffffffffffff, 0x400454ca, &(0x7f0000000100)={'syz_tun\x00', 0x1001})

program did not crash
testing program (duration=2m21.583758016s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): mount-openat-write-openat-write-ioctl$TUNSETIFF
detailed listing:
executing program 0:
mount(0x0, &(0x7f0000000100)='./debug\x00', &(0x7f0000000140)='debugfs\x00', 0x0, 0x0)
r0 = openat(0xffffffffffffff9c, &(0x7f0000000200)='./debug/failslab/probability\x00', 0x1, 0x0)
write(r0, &(0x7f0000000300)='100\x00', 0x4)
r1 = openat(0xffffffffffffff9c, &(0x7f0000000400)='./debug/failslab/times\x00', 0x1, 0x0)
write(r1, &(0x7f0000000500)='100\x00', 0x4)
ioctl$TUNSETIFF(0xffffffffffffffff, 0x400454ca, &(0x7f0000000100)={'syz_tun\x00', 0x1001})

program did not crash
testing program (duration=2m21.583758016s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): mkdirat-mount-openat-write-openat-write-ioctl$TUNSETIFF
detailed listing:
executing program 0:
mkdirat(0xffffffffffffff9c, 0x0, 0x1ff)
mount(0x0, &(0x7f0000000100)='./debug\x00', &(0x7f0000000140)='debugfs\x00', 0x0, 0x0)
r0 = openat(0xffffffffffffff9c, &(0x7f0000000200)='./debug/failslab/probability\x00', 0x1, 0x0)
write(r0, &(0x7f0000000300)='100\x00', 0x4)
r1 = openat(0xffffffffffffff9c, &(0x7f0000000400)='./debug/failslab/times\x00', 0x1, 0x0)
write(r1, &(0x7f0000000500)='100\x00', 0x4)
ioctl$TUNSETIFF(0xffffffffffffffff, 0x400454ca, &(0x7f0000000100)={'syz_tun\x00', 0x1001})

program did not crash
testing program (duration=2m21.583758016s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): mkdirat-mount-openat-write-openat-write-ioctl$TUNSETIFF
detailed listing:
executing program 0:
mkdirat(0xffffffffffffff9c, &(0x7f0000000100)='./debug\x00', 0x1ff)
mount(0x0, 0x0, &(0x7f0000000140)='debugfs\x00', 0x0, 0x0)
r0 = openat(0xffffffffffffff9c, &(0x7f0000000200)='./debug/failslab/probability\x00', 0x1, 0x0)
write(r0, &(0x7f0000000300)='100\x00', 0x4)
r1 = openat(0xffffffffffffff9c, &(0x7f0000000400)='./debug/failslab/times\x00', 0x1, 0x0)
write(r1, &(0x7f0000000500)='100\x00', 0x4)
ioctl$TUNSETIFF(0xffffffffffffffff, 0x400454ca, &(0x7f0000000100)={'syz_tun\x00', 0x1001})

program did not crash
testing program (duration=2m21.583758016s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): mkdirat-mount-openat-write-openat-write-ioctl$TUNSETIFF
detailed listing:
executing program 0:
mkdirat(0xffffffffffffff9c, &(0x7f0000000100)='./debug\x00', 0x1ff)
mount(0x0, &(0x7f0000000100)='./debug\x00', 0x0, 0x0, 0x0)
r0 = openat(0xffffffffffffff9c, &(0x7f0000000200)='./debug/failslab/probability\x00', 0x1, 0x0)
write(r0, &(0x7f0000000300)='100\x00', 0x4)
r1 = openat(0xffffffffffffff9c, &(0x7f0000000400)='./debug/failslab/times\x00', 0x1, 0x0)
write(r1, &(0x7f0000000500)='100\x00', 0x4)
ioctl$TUNSETIFF(0xffffffffffffffff, 0x400454ca, &(0x7f0000000100)={'syz_tun\x00', 0x1001})

program did not crash
testing program (duration=2m21.583758016s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): mkdirat-mount-openat-write-openat-write-ioctl$TUNSETIFF
detailed listing:
executing program 0:
mkdirat(0xffffffffffffff9c, &(0x7f0000000100)='./debug\x00', 0x1ff)
mount(0x0, &(0x7f0000000100)='./debug\x00', &(0x7f0000000140)='debugfs\x00', 0x0, 0x0)
r0 = openat(0xffffffffffffff9c, 0x0, 0x1, 0x0)
write(r0, &(0x7f0000000300)='100\x00', 0x4)
r1 = openat(0xffffffffffffff9c, &(0x7f0000000400)='./debug/failslab/times\x00', 0x1, 0x0)
write(r1, &(0x7f0000000500)='100\x00', 0x4)
ioctl$TUNSETIFF(0xffffffffffffffff, 0x400454ca, &(0x7f0000000100)={'syz_tun\x00', 0x1001})

program did not crash
testing program (duration=2m21.583758016s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): mkdirat-mount-openat-write-openat-write-ioctl$TUNSETIFF
detailed listing:
executing program 0:
mkdirat(0xffffffffffffff9c, &(0x7f0000000100)='./debug\x00', 0x1ff)
mount(0x0, &(0x7f0000000100)='./debug\x00', &(0x7f0000000140)='debugfs\x00', 0x0, 0x0)
r0 = openat(0xffffffffffffff9c, &(0x7f0000000200)='./debug/failslab/probability\x00', 0x1, 0x0)
write(r0, 0x0, 0x0)
r1 = openat(0xffffffffffffff9c, &(0x7f0000000400)='./debug/failslab/times\x00', 0x1, 0x0)
write(r1, &(0x7f0000000500)='100\x00', 0x4)
ioctl$TUNSETIFF(0xffffffffffffffff, 0x400454ca, &(0x7f0000000100)={'syz_tun\x00', 0x1001})

program did not crash
testing program (duration=2m21.583758016s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): mkdirat-mount-openat-write-openat-write-ioctl$TUNSETIFF
detailed listing:
executing program 0:
mkdirat(0xffffffffffffff9c, &(0x7f0000000100)='./debug\x00', 0x1ff)
mount(0x0, &(0x7f0000000100)='./debug\x00', &(0x7f0000000140)='debugfs\x00', 0x0, 0x0)
r0 = openat(0xffffffffffffff9c, &(0x7f0000000200)='./debug/failslab/probability\x00', 0x1, 0x0)
write(r0, &(0x7f0000000300), 0x0)
r1 = openat(0xffffffffffffff9c, &(0x7f0000000400)='./debug/failslab/times\x00', 0x1, 0x0)
write(r1, &(0x7f0000000500)='100\x00', 0x4)
ioctl$TUNSETIFF(0xffffffffffffffff, 0x400454ca, &(0x7f0000000100)={'syz_tun\x00', 0x1001})

program did not crash
testing program (duration=2m21.583758016s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): mkdirat-mount-openat-write-openat-write-ioctl$TUNSETIFF
detailed listing:
executing program 0:
mkdirat(0xffffffffffffff9c, &(0x7f0000000100)='./debug\x00', 0x1ff)
mount(0x0, &(0x7f0000000100)='./debug\x00', &(0x7f0000000140)='debugfs\x00', 0x0, 0x0)
r0 = openat(0xffffffffffffff9c, &(0x7f0000000200)='./debug/failslab/probability\x00', 0x1, 0x0)
write(r0, &(0x7f0000000300)='100\x00', 0x4)
r1 = openat(0xffffffffffffff9c, 0x0, 0x1, 0x0)
write(r1, &(0x7f0000000500)='100\x00', 0x4)
ioctl$TUNSETIFF(0xffffffffffffffff, 0x400454ca, &(0x7f0000000100)={'syz_tun\x00', 0x1001})

program did not crash
testing program (duration=2m21.583758016s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): mkdirat-mount-openat-write-openat-write-ioctl$TUNSETIFF
detailed listing:
executing program 0:
mkdirat(0xffffffffffffff9c, &(0x7f0000000100)='./debug\x00', 0x1ff)
mount(0x0, &(0x7f0000000100)='./debug\x00', &(0x7f0000000140)='debugfs\x00', 0x0, 0x0)
r0 = openat(0xffffffffffffff9c, &(0x7f0000000200)='./debug/failslab/probability\x00', 0x1, 0x0)
write(r0, &(0x7f0000000300)='100\x00', 0x4)
r1 = openat(0xffffffffffffff9c, &(0x7f0000000400)='./debug/failslab/times\x00', 0x1, 0x0)
write(r1, 0x0, 0x0)
ioctl$TUNSETIFF(0xffffffffffffffff, 0x400454ca, &(0x7f0000000100)={'syz_tun\x00', 0x1001})

program did not crash
testing program (duration=2m21.583758016s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): mkdirat-mount-openat-write-openat-write-ioctl$TUNSETIFF
detailed listing:
executing program 0:
mkdirat(0xffffffffffffff9c, &(0x7f0000000100)='./debug\x00', 0x1ff)
mount(0x0, &(0x7f0000000100)='./debug\x00', &(0x7f0000000140)='debugfs\x00', 0x0, 0x0)
r0 = openat(0xffffffffffffff9c, &(0x7f0000000200)='./debug/failslab/probability\x00', 0x1, 0x0)
write(r0, &(0x7f0000000300)='100\x00', 0x4)
r1 = openat(0xffffffffffffff9c, &(0x7f0000000400)='./debug/failslab/times\x00', 0x1, 0x0)
write(r1, &(0x7f0000000500), 0x0)
ioctl$TUNSETIFF(0xffffffffffffffff, 0x400454ca, &(0x7f0000000100)={'syz_tun\x00', 0x1001})

program did not crash
testing program (duration=2m21.583758016s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): mkdirat-mount-openat-write-openat-write-ioctl$TUNSETIFF
detailed listing:
executing program 0:
mkdirat(0xffffffffffffff9c, &(0x7f0000000100)='./debug\x00', 0x1ff)
mount(0x0, &(0x7f0000000100)='./debug\x00', &(0x7f0000000140)='debugfs\x00', 0x0, 0x0)
r0 = openat(0xffffffffffffff9c, &(0x7f0000000200)='./debug/failslab/probability\x00', 0x1, 0x0)
write(r0, &(0x7f0000000300)='100\x00', 0x4)
r1 = openat(0xffffffffffffff9c, &(0x7f0000000400)='./debug/failslab/times\x00', 0x1, 0x0)
write(r1, &(0x7f0000000500)='100\x00', 0x4)
ioctl$TUNSETIFF(0xffffffffffffffff, 0x400454ca, 0x0)

program crashed: kernel BUG in mmap_region
extracting C reproducer
testing compiled C program (duration=2m21.583758016s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): mkdirat-mount-openat-write-openat-write-ioctl$TUNSETIFF
program did not crash
simplifying guilty program options
testing program (duration=2m21.583758016s, {Threaded:false Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): mkdirat-mount-openat-write-openat-write-ioctl$TUNSETIFF
detailed listing:
executing program 0:
mkdirat(0xffffffffffffff9c, &(0x7f0000000100)='./debug\x00', 0x1ff)
mount(0x0, &(0x7f0000000100)='./debug\x00', &(0x7f0000000140)='debugfs\x00', 0x0, 0x0)
r0 = openat(0xffffffffffffff9c, &(0x7f0000000200)='./debug/failslab/probability\x00', 0x1, 0x0)
write(r0, &(0x7f0000000300)='100\x00', 0x4)
r1 = openat(0xffffffffffffff9c, &(0x7f0000000400)='./debug/failslab/times\x00', 0x1, 0x0)
write(r1, &(0x7f0000000500)='100\x00', 0x4)
ioctl$TUNSETIFF(0xffffffffffffffff, 0x400454ca, 0x0)

program crashed: SYZFAIL: pipe failed
ignore low priority crash: SYZFAIL: pipe failed
testing program (duration=2m21.583758016s, {Threaded:true Repeat:true RepeatTimes:0 Procs:1 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): mkdirat-mount-openat-write-openat-write-ioctl$TUNSETIFF
detailed listing:
executing program 0:
mkdirat(0xffffffffffffff9c, &(0x7f0000000100)='./debug\x00', 0x1ff)
mount(0x0, &(0x7f0000000100)='./debug\x00', &(0x7f0000000140)='debugfs\x00', 0x0, 0x0)
r0 = openat(0xffffffffffffff9c, &(0x7f0000000200)='./debug/failslab/probability\x00', 0x1, 0x0)
write(r0, &(0x7f0000000300)='100\x00', 0x4)
r1 = openat(0xffffffffffffff9c, &(0x7f0000000400)='./debug/failslab/times\x00', 0x1, 0x0)
write(r1, &(0x7f0000000500)='100\x00', 0x4)
ioctl$TUNSETIFF(0xffffffffffffffff, 0x400454ca, 0x0)

program did not crash
testing program (duration=2m21.583758016s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): mkdirat-mount-openat-write-openat-write-ioctl$TUNSETIFF
detailed listing:
executing program 0:
mkdirat(0xffffffffffffff9c, &(0x7f0000000100)='./debug\x00', 0x1ff)
mount(0x0, &(0x7f0000000100)='./debug\x00', &(0x7f0000000140)='debugfs\x00', 0x0, 0x0)
r0 = openat(0xffffffffffffff9c, &(0x7f0000000200)='./debug/failslab/probability\x00', 0x1, 0x0)
write(r0, &(0x7f0000000300)='100\x00', 0x4)
r1 = openat(0xffffffffffffff9c, &(0x7f0000000400)='./debug/failslab/times\x00', 0x1, 0x0)
write(r1, &(0x7f0000000500)='100\x00', 0x4)
ioctl$TUNSETIFF(0xffffffffffffffff, 0x400454ca, 0x0)

program crashed: SYZFAIL: pipe failed
ignore low priority crash: SYZFAIL: pipe failed
validation run: crashed=false
testing program (duration=2m21.583758016s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): mkdirat-mount-openat-write-openat-write-ioctl$TUNSETIFF
detailed listing:
executing program 0:
mkdirat(0xffffffffffffff9c, &(0x7f0000000100)='./debug\x00', 0x1ff)
mount(0x0, &(0x7f0000000100)='./debug\x00', &(0x7f0000000140)='debugfs\x00', 0x0, 0x0)
r0 = openat(0xffffffffffffff9c, &(0x7f0000000200)='./debug/failslab/probability\x00', 0x1, 0x0)
write(r0, &(0x7f0000000300)='100\x00', 0x4)
r1 = openat(0xffffffffffffff9c, &(0x7f0000000400)='./debug/failslab/times\x00', 0x1, 0x0)
write(r1, &(0x7f0000000500)='100\x00', 0x4)
ioctl$TUNSETIFF(0xffffffffffffffff, 0x400454ca, 0x0)

program crashed: kernel BUG in mmap_region
validation run: crashed=true
testing program (duration=2m21.583758016s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): mkdirat-mount-openat-write-openat-write-ioctl$TUNSETIFF
detailed listing:
executing program 0:
mkdirat(0xffffffffffffff9c, &(0x7f0000000100)='./debug\x00', 0x1ff)
mount(0x0, &(0x7f0000000100)='./debug\x00', &(0x7f0000000140)='debugfs\x00', 0x0, 0x0)
r0 = openat(0xffffffffffffff9c, &(0x7f0000000200)='./debug/failslab/probability\x00', 0x1, 0x0)
write(r0, &(0x7f0000000300)='100\x00', 0x4)
r1 = openat(0xffffffffffffff9c, &(0x7f0000000400)='./debug/failslab/times\x00', 0x1, 0x0)
write(r1, &(0x7f0000000500)='100\x00', 0x4)
ioctl$TUNSETIFF(0xffffffffffffffff, 0x400454ca, 0x0)

program did not crash
validation run: crashed=false
testing program (duration=2m21.583758016s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): mkdirat-mount-openat-write-openat-write-ioctl$TUNSETIFF
detailed listing:
executing program 0:
mkdirat(0xffffffffffffff9c, &(0x7f0000000100)='./debug\x00', 0x1ff)
mount(0x0, &(0x7f0000000100)='./debug\x00', &(0x7f0000000140)='debugfs\x00', 0x0, 0x0)
r0 = openat(0xffffffffffffff9c, &(0x7f0000000200)='./debug/failslab/probability\x00', 0x1, 0x0)
write(r0, &(0x7f0000000300)='100\x00', 0x4)
r1 = openat(0xffffffffffffff9c, &(0x7f0000000400)='./debug/failslab/times\x00', 0x1, 0x0)
write(r1, &(0x7f0000000500)='100\x00', 0x4)
ioctl$TUNSETIFF(0xffffffffffffffff, 0x400454ca, 0x0)

program did not crash
validation run: crashed=false
testing program (duration=2m21.583758016s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): mkdirat-mount-openat-write-openat-write-ioctl$TUNSETIFF
detailed listing:
executing program 0:
mkdirat(0xffffffffffffff9c, &(0x7f0000000100)='./debug\x00', 0x1ff)
mount(0x0, &(0x7f0000000100)='./debug\x00', &(0x7f0000000140)='debugfs\x00', 0x0, 0x0)
r0 = openat(0xffffffffffffff9c, &(0x7f0000000200)='./debug/failslab/probability\x00', 0x1, 0x0)
write(r0, &(0x7f0000000300)='100\x00', 0x4)
r1 = openat(0xffffffffffffff9c, &(0x7f0000000400)='./debug/failslab/times\x00', 0x1, 0x0)
write(r1, &(0x7f0000000500)='100\x00', 0x4)
ioctl$TUNSETIFF(0xffffffffffffffff, 0x400454ca, 0x0)

program crashed: kernel BUG in mmap_region
validation run: crashed=true
testing program (duration=2m21.583758016s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): mkdirat-mount-openat-write-openat-write-ioctl$TUNSETIFF
detailed listing:
executing program 0:
mkdirat(0xffffffffffffff9c, &(0x7f0000000100)='./debug\x00', 0x1ff)
mount(0x0, &(0x7f0000000100)='./debug\x00', &(0x7f0000000140)='debugfs\x00', 0x0, 0x0)
r0 = openat(0xffffffffffffff9c, &(0x7f0000000200)='./debug/failslab/probability\x00', 0x1, 0x0)
write(r0, &(0x7f0000000300)='100\x00', 0x4)
r1 = openat(0xffffffffffffff9c, &(0x7f0000000400)='./debug/failslab/times\x00', 0x1, 0x0)
write(r1, &(0x7f0000000500)='100\x00', 0x4)
ioctl$TUNSETIFF(0xffffffffffffffff, 0x400454ca, 0x0)

program crashed: SYZFAIL: pipe failed
ignore low priority crash: SYZFAIL: pipe failed
validation run: crashed=false
testing program (duration=2m21.583758016s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): mkdirat-mount-openat-write-openat-write-ioctl$TUNSETIFF
detailed listing:
executing program 0:
mkdirat(0xffffffffffffff9c, &(0x7f0000000100)='./debug\x00', 0x1ff)
mount(0x0, &(0x7f0000000100)='./debug\x00', &(0x7f0000000140)='debugfs\x00', 0x0, 0x0)
r0 = openat(0xffffffffffffff9c, &(0x7f0000000200)='./debug/failslab/probability\x00', 0x1, 0x0)
write(r0, &(0x7f0000000300)='100\x00', 0x4)
r1 = openat(0xffffffffffffff9c, &(0x7f0000000400)='./debug/failslab/times\x00', 0x1, 0x0)
write(r1, &(0x7f0000000500)='100\x00', 0x4)
ioctl$TUNSETIFF(0xffffffffffffffff, 0x400454ca, 0x0)

program did not crash
validation run: crashed=false
testing program (duration=2m21.583758016s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): mkdirat-mount-openat-write-openat-write-ioctl$TUNSETIFF
detailed listing:
executing program 0:
mkdirat(0xffffffffffffff9c, &(0x7f0000000100)='./debug\x00', 0x1ff)
mount(0x0, &(0x7f0000000100)='./debug\x00', &(0x7f0000000140)='debugfs\x00', 0x0, 0x0)
r0 = openat(0xffffffffffffff9c, &(0x7f0000000200)='./debug/failslab/probability\x00', 0x1, 0x0)
write(r0, &(0x7f0000000300)='100\x00', 0x4)
r1 = openat(0xffffffffffffff9c, &(0x7f0000000400)='./debug/failslab/times\x00', 0x1, 0x0)
write(r1, &(0x7f0000000500)='100\x00', 0x4)
ioctl$TUNSETIFF(0xffffffffffffffff, 0x400454ca, 0x0)

program did not crash
validation run: crashed=false
testing program (duration=2m21.583758016s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): mkdirat-mount-openat-write-openat-write-ioctl$TUNSETIFF
detailed listing:
executing program 0:
mkdirat(0xffffffffffffff9c, &(0x7f0000000100)='./debug\x00', 0x1ff)
mount(0x0, &(0x7f0000000100)='./debug\x00', &(0x7f0000000140)='debugfs\x00', 0x0, 0x0)
r0 = openat(0xffffffffffffff9c, &(0x7f0000000200)='./debug/failslab/probability\x00', 0x1, 0x0)
write(r0, &(0x7f0000000300)='100\x00', 0x4)
r1 = openat(0xffffffffffffff9c, &(0x7f0000000400)='./debug/failslab/times\x00', 0x1, 0x0)
write(r1, &(0x7f0000000500)='100\x00', 0x4)
ioctl$TUNSETIFF(0xffffffffffffffff, 0x400454ca, 0x0)

program did not crash
validation run: crashed=false
testing program (duration=2m21.583758016s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): mkdirat-mount-openat-write-openat-write-ioctl$TUNSETIFF
detailed listing:
executing program 0:
mkdirat(0xffffffffffffff9c, &(0x7f0000000100)='./debug\x00', 0x1ff)
mount(0x0, &(0x7f0000000100)='./debug\x00', &(0x7f0000000140)='debugfs\x00', 0x0, 0x0)
r0 = openat(0xffffffffffffff9c, &(0x7f0000000200)='./debug/failslab/probability\x00', 0x1, 0x0)
write(r0, &(0x7f0000000300)='100\x00', 0x4)
r1 = openat(0xffffffffffffff9c, &(0x7f0000000400)='./debug/failslab/times\x00', 0x1, 0x0)
write(r1, &(0x7f0000000500)='100\x00', 0x4)
ioctl$TUNSETIFF(0xffffffffffffffff, 0x400454ca, 0x0)

program crashed: SYZFAIL: pipe failed
ignore low priority crash: SYZFAIL: pipe failed
validation run: crashed=false
reproducing took 2h32m30.414423954s
repro crashed as (corrupted=false):
Code: 4f 01 00 0f 1f 44 00 00 41 f7 c1 ff 0f 00 00 75 27 55 89 cd 53 48 89 fb 48 85 ff 74 3b 41 89 ea 48 89 df b8 09 00 00 00 0f 05 <48> 3d 00 f0 ff ff 77 6e 5b 5d c3 0f 1f 00 48 c7 c0 e8 ff ff ff 64
RSP: 002b:00007ffdc62d0238 EFLAGS: 00000246 ORIG_RAX: 0000000000000009
RAX: ffffffffffffffda RBX: 0000000000000000 RCX: 00007fc87c39dc02
RDX: 0000000000000000 RSI: 0000000000021000 RDI: 0000000000000000
RBP: 0000000000020022 R08: 00000000ffffffff R09: 0000000000000000
R10: 0000000000020022 R11: 0000000000000246 R12: 00007ffdc62d03a0
R13: ffffffffffffffc0 R14: 0000000000001000 R15: 0000000000000000
 </TASK>
------------[ cut here ]------------
kernel BUG at mm/mmap.c:2854!
invalid opcode: 0000 [#1] PREEMPT SMP KASAN
CPU: 1 PID: 407 Comm: syz.5.19 Not tainted syzkaller #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/16/2026
RIP: 0010:__mmap_region mm/mmap.c:2854 [inline]
RIP: 0010:mmap_region+0x1fe8/0x2130 mm/mmap.c:3030
Code: 50 80 e1 07 80 c1 03 38 c1 0f 8c e1 f9 ff ff 48 8b 7c 24 50 e8 69 46 09 00 e9 d2 f9 ff ff e8 ef ba c3 ff 0f 0b e8 e8 ba c3 ff <0f> 0b 89 d9 80 e1 07 80 c1 03 38 c1 0f 8c 66 e7 ff ff 48 89 df e8
RSP: 0018:ffffc90000a97a40 EFLAGS: 00010293
RAX: ffffffff81adab58 RBX: 00007fc87d20d000 RCX: ffff88810ffe3cc0
RDX: 0000000000000000 RSI: 00007fc87d20cfff RDI: 00007fc87d20d000
RBP: ffffc90000a97c30 R08: ffff88810ffe3cc0 R09: 0000000000000003
R10: 0000000000000003 R11: 0000000000000000 R12: 00007fc87d20cfff
R13: 00007fc87d20d000 R14: dffffc0000000000 R15: 00007fc87d1ec000
FS:  000055555f469500(0000) GS:ffff8881f6f00000(0000) knlGS:0000000000000000
CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 00005555618dc888 CR3: 000000010cd1a000 CR4: 00000000003506a0
DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400
Call Trace:
 <TASK>
 do_mmap+0x858/0xdd0 mm/mmap.c:1491
 vm_mmap_pgoff+0x206/0x3f0 mm/util.c:525
 ksys_mmap_pgoff+0xf6/0x1d0 mm/mmap.c:1537
 __do_sys_mmap arch/x86/kernel/sys_x86_64.c:93 [inline]
 __se_sys_mmap arch/x86/kernel/sys_x86_64.c:86 [inline]
 __x64_sys_mmap+0xfa/0x110 arch/x86/kernel/sys_x86_64.c:86
 x64_sys_call+0x8fd/0x9a0 arch/x86/include/generated/asm/syscalls_64.h:10
 do_syscall_x64 arch/x86/entry/common.c:46 [inline]
 do_syscall_64+0x4c/0xa0 arch/x86/entry/common.c:76
 entry_SYSCALL_64_after_hwframe+0x68/0xd2
RIP: 0033:0x7fc87c39dc02
Code: 4f 01 00 0f 1f 44 00 00 41 f7 c1 ff 0f 00 00 75 27 55 89 cd 53 48 89 fb 48 85 ff 74 3b 41 89 ea 48 89 df b8 09 00 00 00 0f 05 <48> 3d 00 f0 ff ff 77 6e 5b 5d c3 0f 1f 00 48 c7 c0 e8 ff ff ff 64
RSP: 002b:00007ffdc62d0238 EFLAGS: 00000246 ORIG_RAX: 0000000000000009
RAX: ffffffffffffffda RBX: 0000000000000000 RCX: 00007fc87c39dc02
RDX: 0000000000000000 RSI: 0000000000021000 RDI: 0000000000000000
RBP: 0000000000020022 R08: 00000000ffffffff R09: 0000000000000000
R10: 0000000000020022 R11: 0000000000000246 R12: 00007ffdc62d03a0
R13: ffffffffffffffc0 R14: 0000000000001000 R15: 0000000000000000
 </TASK>
Modules linked in:
---[ end trace 0000000000000000 ]---
RIP: 0010:__mmap_region mm/mmap.c:2854 [inline]
RIP: 0010:mmap_region+0x1fe8/0x2130 mm/mmap.c:3030
Code: 50 80 e1 07 80 c1 03 38 c1 0f 8c e1 f9 ff ff 48 8b 7c 24 50 e8 69 46 09 00 e9 d2 f9 ff ff e8 ef ba c3 ff 0f 0b e8 e8 ba c3 ff <0f> 0b 89 d9 80 e1 07 80 c1 03 38 c1 0f 8c 66 e7 ff ff 48 89 df e8
RSP: 0018:ffffc90000a97a40 EFLAGS: 00010293
RAX: ffffffff81adab58 RBX: 00007fc87d20d000 RCX: ffff88810ffe3cc0
RDX: 0000000000000000 RSI: 00007fc87d20cfff RDI: 00007fc87d20d000
RBP: ffffc90000a97c30 R08: ffff88810ffe3cc0 R09: 0000000000000003
R10: 0000000000000003 R11: 0000000000000000 R12: 00007fc87d20cfff
R13: 00007fc87d20d000 R14: dffffc0000000000 R15: 00007fc87d1ec000
FS:  000055555f469500(0000) GS:ffff8881f6f00000(0000) knlGS:0000000000000000
CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 00005555618dc888 CR3: 000000010cd1a000 CR4: 00000000003506a0
DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400
----------------
Code disassembly (best guess):
   0:	4f 01 00             	rex.WRXB add %r8,(%r8)
   3:	0f 1f 44 00 00       	nopl   0x0(%rax,%rax,1)
   8:	41 f7 c1 ff 0f 00 00 	test   $0xfff,%r9d
   f:	75 27                	jne    0x38
  11:	55                   	push   %rbp
  12:	89 cd                	mov    %ecx,%ebp
  14:	53                   	push   %rbx
  15:	48 89 fb             	mov    %rdi,%rbx
  18:	48 85 ff             	test   %rdi,%rdi
  1b:	74 3b                	je     0x58
  1d:	41 89 ea             	mov    %ebp,%r10d
  20:	48 89 df             	mov    %rbx,%rdi
  23:	b8 09 00 00 00       	mov    $0x9,%eax
  28:	0f 05                	syscall
* 2a:	48 3d 00 f0 ff ff    	cmp    $0xfffffffffffff000,%rax <-- trapping instruction
  30:	77 6e                	ja     0xa0
  32:	5b                   	pop    %rbx
  33:	5d                   	pop    %rbp
  34:	c3                   	ret
  35:	0f 1f 00             	nopl   (%rax)
  38:	48 c7 c0 e8 ff ff ff 	mov    $0xffffffffffffffe8,%rax
  3f:	64                   	fs

final repro crashed as (corrupted=false):
Code: 4f 01 00 0f 1f 44 00 00 41 f7 c1 ff 0f 00 00 75 27 55 89 cd 53 48 89 fb 48 85 ff 74 3b 41 89 ea 48 89 df b8 09 00 00 00 0f 05 <48> 3d 00 f0 ff ff 77 6e 5b 5d c3 0f 1f 00 48 c7 c0 e8 ff ff ff 64
RSP: 002b:00007ffdc62d0238 EFLAGS: 00000246 ORIG_RAX: 0000000000000009
RAX: ffffffffffffffda RBX: 0000000000000000 RCX: 00007fc87c39dc02
RDX: 0000000000000000 RSI: 0000000000021000 RDI: 0000000000000000
RBP: 0000000000020022 R08: 00000000ffffffff R09: 0000000000000000
R10: 0000000000020022 R11: 0000000000000246 R12: 00007ffdc62d03a0
R13: ffffffffffffffc0 R14: 0000000000001000 R15: 0000000000000000
 </TASK>
------------[ cut here ]------------
kernel BUG at mm/mmap.c:2854!
invalid opcode: 0000 [#1] PREEMPT SMP KASAN
CPU: 1 PID: 407 Comm: syz.5.19 Not tainted syzkaller #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/16/2026
RIP: 0010:__mmap_region mm/mmap.c:2854 [inline]
RIP: 0010:mmap_region+0x1fe8/0x2130 mm/mmap.c:3030
Code: 50 80 e1 07 80 c1 03 38 c1 0f 8c e1 f9 ff ff 48 8b 7c 24 50 e8 69 46 09 00 e9 d2 f9 ff ff e8 ef ba c3 ff 0f 0b e8 e8 ba c3 ff <0f> 0b 89 d9 80 e1 07 80 c1 03 38 c1 0f 8c 66 e7 ff ff 48 89 df e8
RSP: 0018:ffffc90000a97a40 EFLAGS: 00010293
RAX: ffffffff81adab58 RBX: 00007fc87d20d000 RCX: ffff88810ffe3cc0
RDX: 0000000000000000 RSI: 00007fc87d20cfff RDI: 00007fc87d20d000
RBP: ffffc90000a97c30 R08: ffff88810ffe3cc0 R09: 0000000000000003
R10: 0000000000000003 R11: 0000000000000000 R12: 00007fc87d20cfff
R13: 00007fc87d20d000 R14: dffffc0000000000 R15: 00007fc87d1ec000
FS:  000055555f469500(0000) GS:ffff8881f6f00000(0000) knlGS:0000000000000000
CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 00005555618dc888 CR3: 000000010cd1a000 CR4: 00000000003506a0
DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400
Call Trace:
 <TASK>
 do_mmap+0x858/0xdd0 mm/mmap.c:1491
 vm_mmap_pgoff+0x206/0x3f0 mm/util.c:525
 ksys_mmap_pgoff+0xf6/0x1d0 mm/mmap.c:1537
 __do_sys_mmap arch/x86/kernel/sys_x86_64.c:93 [inline]
 __se_sys_mmap arch/x86/kernel/sys_x86_64.c:86 [inline]
 __x64_sys_mmap+0xfa/0x110 arch/x86/kernel/sys_x86_64.c:86
 x64_sys_call+0x8fd/0x9a0 arch/x86/include/generated/asm/syscalls_64.h:10
 do_syscall_x64 arch/x86/entry/common.c:46 [inline]
 do_syscall_64+0x4c/0xa0 arch/x86/entry/common.c:76
 entry_SYSCALL_64_after_hwframe+0x68/0xd2
RIP: 0033:0x7fc87c39dc02
Code: 4f 01 00 0f 1f 44 00 00 41 f7 c1 ff 0f 00 00 75 27 55 89 cd 53 48 89 fb 48 85 ff 74 3b 41 89 ea 48 89 df b8 09 00 00 00 0f 05 <48> 3d 00 f0 ff ff 77 6e 5b 5d c3 0f 1f 00 48 c7 c0 e8 ff ff ff 64
RSP: 002b:00007ffdc62d0238 EFLAGS: 00000246 ORIG_RAX: 0000000000000009
RAX: ffffffffffffffda RBX: 0000000000000000 RCX: 00007fc87c39dc02
RDX: 0000000000000000 RSI: 0000000000021000 RDI: 0000000000000000
RBP: 0000000000020022 R08: 00000000ffffffff R09: 0000000000000000
R10: 0000000000020022 R11: 0000000000000246 R12: 00007ffdc62d03a0
R13: ffffffffffffffc0 R14: 0000000000001000 R15: 0000000000000000
 </TASK>
Modules linked in:
---[ end trace 0000000000000000 ]---
RIP: 0010:__mmap_region mm/mmap.c:2854 [inline]
RIP: 0010:mmap_region+0x1fe8/0x2130 mm/mmap.c:3030
Code: 50 80 e1 07 80 c1 03 38 c1 0f 8c e1 f9 ff ff 48 8b 7c 24 50 e8 69 46 09 00 e9 d2 f9 ff ff e8 ef ba c3 ff 0f 0b e8 e8 ba c3 ff <0f> 0b 89 d9 80 e1 07 80 c1 03 38 c1 0f 8c 66 e7 ff ff 48 89 df e8
RSP: 0018:ffffc90000a97a40 EFLAGS: 00010293
RAX: ffffffff81adab58 RBX: 00007fc87d20d000 RCX: ffff88810ffe3cc0
RDX: 0000000000000000 RSI: 00007fc87d20cfff RDI: 00007fc87d20d000
RBP: ffffc90000a97c30 R08: ffff88810ffe3cc0 R09: 0000000000000003
R10: 0000000000000003 R11: 0000000000000000 R12: 00007fc87d20cfff
R13: 00007fc87d20d000 R14: dffffc0000000000 R15: 00007fc87d1ec000
FS:  000055555f469500(0000) GS:ffff8881f6f00000(0000) knlGS:0000000000000000
CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 00005555618dc888 CR3: 000000010cd1a000 CR4: 00000000003506a0
DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400
----------------
Code disassembly (best guess):
   0:	4f 01 00             	rex.WRXB add %r8,(%r8)
   3:	0f 1f 44 00 00       	nopl   0x0(%rax,%rax,1)
   8:	41 f7 c1 ff 0f 00 00 	test   $0xfff,%r9d
   f:	75 27                	jne    0x38
  11:	55                   	push   %rbp
  12:	89 cd                	mov    %ecx,%ebp
  14:	53                   	push   %rbx
  15:	48 89 fb             	mov    %rdi,%rbx
  18:	48 85 ff             	test   %rdi,%rdi
  1b:	74 3b                	je     0x58
  1d:	41 89 ea             	mov    %ebp,%r10d
  20:	48 89 df             	mov    %rbx,%rdi
  23:	b8 09 00 00 00       	mov    $0x9,%eax
  28:	0f 05                	syscall
* 2a:	48 3d 00 f0 ff ff    	cmp    $0xfffffffffffff000,%rax <-- trapping instruction
  30:	77 6e                	ja     0xa0
  32:	5b                   	pop    %rbx
  33:	5d                   	pop    %rbp
  34:	c3                   	ret
  35:	0f 1f 00             	nopl   (%rax)
  38:	48 c7 c0 e8 ff ff ff 	mov    $0xffffffffffffffe8,%rax
  3f:	64                   	fs