Extracting prog: 1h52m50.030499776s Minimizing prog: 1h56m20.289949426s Simplifying prog options: 0s Extracting C: 2m42.35368277s Simplifying C: 16m0.482349131s extracting reproducer from 32 programs testing a last program of every proc single: executing 7 programs separately with timeout 30s testing program (duration=30s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): socket$nl_generic-syz_genetlink_get_family_id$nl80211-sendmsg$NL80211_CMD_FRAME detailed listing: executing program 0: r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000240), 0xffffffffffffffff) sendmsg$NL80211_CMD_FRAME(r0, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000fc0)={&(0x7f0000000600)=ANY=[@ANYBLOB='@\x00\x00\x00', @ANYRES16=r1, @ANYBLOB="010000000000000000000200000008000300", @ANYRES32, @ANYBLOB="0c0099"], 0x40}, 0x1, 0x0, 0x0, 0x8000}, 0x0) program did not crash testing program (duration=30s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): socket$nl_generic-openat$kvm-ioctl$KVM_CREATE_VM-ioctl$KVM_CREATE_IRQCHIP-ioctl$KVM_CAP_X86_DISABLE_EXITS-ioctl$KVM_CREATE_VCPU-syz_kvm_setup_cpu$x86-syz_kvm_setup_cpu$x86-userfaultfd-ioctl$UFFDIO_API-ioctl$UFFDIO_REGISTER-ioctl$KVM_RUN-mq_unlink-syz_genetlink_get_family_id$nl80211-sendmsg$NL80211_CMD_FRAME detailed listing: executing program 0: r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000080), 0x0, 0x0) r2 = ioctl$KVM_CREATE_VM(r1, 0xae01, 0x0) ioctl$KVM_CREATE_IRQCHIP(r2, 0xae60) ioctl$KVM_CAP_X86_DISABLE_EXITS(r2, 0x4068aea3, &(0x7f0000000240)={0x8f, 0x0, 0x2}) r3 = ioctl$KVM_CREATE_VCPU(r2, 0xae41, 0x0) syz_kvm_setup_cpu$x86(r2, 0xffffffffffffffff, &(0x7f0000fe8000/0x18000)=nil, &(0x7f00000001c0)=[@text16={0x10, 0x0}], 0x1, 0x4, 0x0, 0x0) syz_kvm_setup_cpu$x86(0xffffffffffffffff, r3, &(0x7f0000c4a000/0x18000)=nil, &(0x7f0000000040)=[@text64={0x40, 0x0}], 0x1, 0x53, 0x0, 0x0) r4 = userfaultfd(0x801) ioctl$UFFDIO_API(r4, 0xc018aa3f, &(0x7f00000020c0)={0xaa, 0xbd}) ioctl$UFFDIO_REGISTER(r4, 0xc020aa00, &(0x7f0000000140)={{&(0x7f0000400000/0xc00000)=nil, 0xc00000}, 0x3}) ioctl$KVM_RUN(r3, 0xae80, 0x0) mq_unlink(&(0x7f0000000340)='/th0\x00') r5 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000000), r0) sendmsg$NL80211_CMD_FRAME(r0, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000fc0)={&(0x7f0000000600)=ANY=[@ANYBLOB='@\x00\x00\x00', @ANYRES16=r5, @ANYBLOB="010000000000000000000200000008000300", @ANYRES32, @ANYBLOB="0c0099"], 0x40}, 0x1, 0x0, 0x0, 0x8000}, 0x0) program did not crash testing program (duration=30s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): mkdirat-mount-chdir-openat$cgroup_ro-quotactl_fd$Q_SETQUOTA-socket-socket$can_raw-setsockopt$CAN_RAW_ERR_FILTER-mkdir-mkdir-syz_emit_ethernet-mkdir-mount$overlay-creat-chdir-chown detailed listing: executing program 0: mkdirat(0xffffffffffffff9c, &(0x7f0000000340)='./file1\x00', 0x0) mount(0x0, &(0x7f0000000200)='./file1\x00', &(0x7f0000000000)='tmpfs\x00', 0x8, &(0x7f0000000300)='usrquota') chdir(&(0x7f00000000c0)='./file1\x00') r0 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000040)='net_prio.prioidx\x00', 0x275a, 0x0) quotactl_fd$Q_SETQUOTA(r0, 0xffffffff80000800, 0x0, &(0x7f0000000f80)={0x8000000000000000, 0x4, 0x100000001, 0x3, 0x24, 0xffffffffffffffff, 0x3, 0x4, 0x100fff}) socket(0x23, 0x2, 0x0) r1 = socket$can_raw(0x1d, 0x3, 0x1) setsockopt$CAN_RAW_ERR_FILTER(r1, 0x65, 0x2, &(0x7f0000000140)=0x9, 0x4) mkdir(&(0x7f0000000400)='./file0\x00', 0x114) mkdir(&(0x7f0000000440)='./file1\x00', 0x0) syz_emit_ethernet(0x6e, &(0x7f0000000300)={@local, @empty, @void, {@ipv6={0x86dd, @icmpv6={0x0, 0x6, '\x00', 0x38, 0x3a, 0xff, @remote, @local, {[], @pkt_toobig={0x2, 0x0, 0x0, 0x500, {0x0, 0x6, '\x00', 0x0, 0x6c, 0x40, @local, @remote, [], "3b00123400000000"}}}}}}}, 0x0) mkdir(&(0x7f0000000300)='./bus\x00', 0x0) mount$overlay(0x0, &(0x7f00000000c0)='./bus\x00', &(0x7f0000000080), 0x0, &(0x7f0000000400)={[{@upperdir={'upperdir', 0x3d, './file1'}}, {@lowerdir={'lowerdir', 0x3d, './file0'}}, {@workdir={'workdir', 0x3d, './bus'}}]}) creat(&(0x7f0000000080)='./file0/file1\x00', 0x90) chdir(&(0x7f0000000000)='./bus\x00') chown(&(0x7f00000001c0)='./file1\x00', 0x0, 0x0) program did not crash testing program (duration=30s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): openat$kvm-socket$inet_udp-ioctl$sock_ipv6_tunnel_SIOCGETPRL-ioctl$KVM_CREATE_VM-ioctl$KVM_SET_USER_MEMORY_REGION-syz_kvm_setup_cpu$x86-ioctl$KVM_CAP_DIRTY_LOG_RING_ACQ_REL-syz_kvm_add_vcpu$x86-ioctl$KVM_RUN-syz_kvm_setup_cpu$x86 detailed listing: executing program 0: r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000300), 0x900, 0x0) r1 = socket$inet_udp(0x2, 0x2, 0x0) ioctl$sock_ipv6_tunnel_SIOCGETPRL(r1, 0x89f4, &(0x7f0000000040)={'sit0\x00', 0x0}) r2 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) ioctl$KVM_SET_USER_MEMORY_REGION(r2, 0x4020ae46, &(0x7f0000000400)={0x0, 0x0, 0x0, 0x20002000, &(0x7f0000000000/0x2000)=nil}) syz_kvm_setup_cpu$x86(0xffffffffffffffff, 0xffffffffffffffff, &(0x7f0000000000/0x18000)=nil, &(0x7f0000000140)=[@text64={0x40, 0x0}], 0x1, 0xe8, 0x0, 0x0) ioctl$KVM_CAP_DIRTY_LOG_RING_ACQ_REL(r2, 0x4068aea3, &(0x7f00000000c0)={0xdf, 0x0, 0x1000}) syz_kvm_add_vcpu$x86(0x0, &(0x7f0000000980)={0x0, &(0x7f0000000440)=[@nested_load_code={0x12e, 0x79, {0x3, "c4a18172d401c744240022000000c744240281e9d8ffc7442406000000000f011c24c7442400a9000000c7442402f0a6d482ff1c24b964090000b80001c0feba000000000f300f320f01c3420f01f83e430f01cbc4a27d2014e966b85f000f00d0"}}], 0x79}) ioctl$KVM_RUN(0xffffffffffffffff, 0xae80, 0x0) syz_kvm_setup_cpu$x86(r2, 0xffffffffffffffff, &(0x7f0000000000/0x18000)=nil, &(0x7f0000000080)=[@text64={0x40, 0x0}], 0x1, 0x10, 0x0, 0x0) program did not crash testing program (duration=30s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): openat$kvm-socket$inet_udp-ioctl$sock_ipv6_tunnel_SIOCGETPRL-ioctl$KVM_CREATE_VM-ioctl$KVM_SET_USER_MEMORY_REGION-syz_kvm_setup_cpu$x86-ioctl$KVM_CAP_DIRTY_LOG_RING_ACQ_REL-syz_kvm_add_vcpu$x86-ioctl$KVM_RUN-syz_kvm_setup_cpu$x86 detailed listing: executing program 0: r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000300), 0x900, 0x0) r1 = socket$inet_udp(0x2, 0x2, 0x0) ioctl$sock_ipv6_tunnel_SIOCGETPRL(r1, 0x89f4, &(0x7f0000000040)={'sit0\x00', 0x0}) r2 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) ioctl$KVM_SET_USER_MEMORY_REGION(r2, 0x4020ae46, &(0x7f0000000400)={0x0, 0x0, 0x0, 0x20002000, &(0x7f0000000000/0x2000)=nil}) syz_kvm_setup_cpu$x86(0xffffffffffffffff, 0xffffffffffffffff, &(0x7f0000000000/0x18000)=nil, &(0x7f0000000140)=[@text64={0x40, 0x0}], 0x1, 0xe8, 0x0, 0x0) ioctl$KVM_CAP_DIRTY_LOG_RING_ACQ_REL(r2, 0x4068aea3, &(0x7f00000000c0)={0xdf, 0x0, 0x1000}) syz_kvm_add_vcpu$x86(0x0, &(0x7f0000000980)={0x0, &(0x7f0000000440)=[@nested_load_code={0x12e, 0x79, {0x3, "c4a18172d401c744240022000000c744240281e9d8ffc7442406000000000f011c24c7442400a9000000c7442402f0a6d482ff1c24b964090000b80001c0feba000000000f300f320f01c3420f01f83e430f01cbc4a27d2014e966b85f000f00d0"}}], 0x79}) ioctl$KVM_RUN(0xffffffffffffffff, 0xae80, 0x0) syz_kvm_setup_cpu$x86(r2, 0xffffffffffffffff, &(0x7f0000000000/0x18000)=nil, &(0x7f0000000080)=[@text64={0x40, 0x0}], 0x1, 0x10, 0x0, 0x0) program did not crash testing program (duration=30s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_genetlink_get_family_id$ipvs-socket$nl_route-sendmsg$nl_route-socket$nl_generic-sendmsg$IPVS_CMD_NEW_SERVICE detailed listing: executing program 0: r0 = syz_genetlink_get_family_id$ipvs(&(0x7f0000000040), 0xffffffffffffffff) r1 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r1, 0x0, 0x0) r2 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$IPVS_CMD_NEW_SERVICE(r2, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000080)={0x4c, r0, 0x1, 0x0, 0x0, {}, [@IPVS_CMD_ATTR_SERVICE={0x38, 0x1, 0x0, 0x1, [@IPVS_SVC_ATTR_AF={0x6, 0x1, 0x2}, @IPVS_SVC_ATTR_FWMARK={0x8, 0x5, 0x3}, @IPVS_SVC_ATTR_FLAGS={0xc, 0x7, {0x30000}}, @IPVS_SVC_ATTR_NETMASK={0x8}, @IPVS_SVC_ATTR_TIMEOUT={0x8, 0x8, 0x200}, @IPVS_SVC_ATTR_PE_NAME={0x8, 0x6}]}]}, 0x4c}}, 0x800c800) program did not crash testing program (duration=30s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_genetlink_get_family_id$ipvs-socket$nl_route-sendmsg$nl_route-socket$nl_generic-sendmsg$IPVS_CMD_NEW_SERVICE detailed listing: executing program 0: r0 = syz_genetlink_get_family_id$ipvs(&(0x7f0000000040), 0xffffffffffffffff) r1 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r1, 0x0, 0x0) r2 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$IPVS_CMD_NEW_SERVICE(r2, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000080)={0x4c, r0, 0x1, 0x0, 0x0, {}, [@IPVS_CMD_ATTR_SERVICE={0x38, 0x1, 0x0, 0x1, [@IPVS_SVC_ATTR_AF={0x6, 0x1, 0x2}, @IPVS_SVC_ATTR_FWMARK={0x8, 0x5, 0x3}, @IPVS_SVC_ATTR_FLAGS={0xc, 0x7, {0x30000}}, @IPVS_SVC_ATTR_NETMASK={0x8}, @IPVS_SVC_ATTR_TIMEOUT={0x8, 0x8, 0x200}, @IPVS_SVC_ATTR_PE_NAME={0x8, 0x6}]}]}, 0x4c}}, 0x800c800) program did not crash single: failed to extract reproducer bisect: bisecting 32 programs with base timeout 30s testing program (duration=38s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): [4, 30, 30, 30, 16, 5, 5, 16, 9, 10, 16, 5, 10, 10, 12, 5, 28, 3, 12, 2, 18, 30, 30, 11, 30, 7, 22, 27, 14, 16, 15, 3] detailed listing: executing program 2: writev(0xffffffffffffffff, &(0x7f00000003c0)=[{&(0x7f0000000180)="390000001300034700bb65e1c3e4ffff01000000010000005600000025000000190004000400000007fd17e5ffff080004", 0x31}], 0x1) r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$ethtool(&(0x7f0000000300), 0xffffffffffffffff) sendmsg$ETHTOOL_MSG_TSINFO_GET(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000180)=ANY=[@ANYBLOB='4\x00\x00\x00', @ANYRES16=r1, @ANYBLOB="010000000000000000001d00000020000180140002006e657464657673696d30000000000000080003"], 0x34}}, 0x44800) (fail_nth: 11) executing program 2: mkdirat(0xffffffffffffff9c, 0x0, 0x1ff) (async) openat$binderfs(0xffffffffffffff9c, &(0x7f0000000300)='./binderfs/binder0\x00', 0x0, 0x0) (async) openat$binderfs(0xffffffffffffff9c, &(0x7f0000000200)='./binderfs/binder0\x00', 0x0, 0x0) (async, rerun: 64) r0 = socket(0x11, 0x2, 0x10001) (rerun: 64) mmap$IORING_OFF_SQ_RING(0x0, 0xc, 0x2000002, 0x401d031, 0xffffffffffffffff, 0x0) (async) mkdirat(0xffffffffffffff9c, &(0x7f0000001500)='./dev\x00', 0x1ff) (async) r1 = syz_open_dev$tty1(0xc, 0x4, 0x1) ioctl$KDSKBENT(r1, 0x4b47, &(0x7f0000000080)={0x0, 0x7d, 0x20f}) mount(0x0, &(0x7f0000001500)='./dev\x00', &(0x7f0000001600)='ceph\x00', 0x800000, 0x0) (async) mkdirat(0xffffffffffffffff, &(0x7f00000002c0)='./dev\x00', 0x17f) socket$nl_generic(0x10, 0x3, 0x10) socket$inet(0x2, 0x2, 0x1) (async) socket$packet(0x11, 0x3, 0x300) socketpair$unix(0x1, 0x2, 0x0, 0x0) (async) mount(&(0x7f00000000c0)=@filename='./dev/sda1\x00', &(0x7f0000000140)='./mnt\x00', &(0x7f0000000100)='ext4\x00', 0x8410, 0x0) (async) mprotect(&(0x7f0000000000/0xf000)=nil, 0xf000, 0x1) r2 = openat$tun(0xffffffffffffff9c, &(0x7f0000000140), 0x0, 0x0) ioctl$TUNSETIFF(r2, 0x40e8662e, 0x0) (async, rerun: 64) r3 = socket$kcm(0x10, 0x2, 0x0) (rerun: 64) sendmsg$kcm(r3, &(0x7f00000003c0)={0x0, 0x0, &(0x7f0000000040)=[{&(0x7f0000000740)="2e00000010008188e6b62aa73f72cc9f0ba1f8481a0000005e140602000000000e000a00100000000a8000001294", 0x2e}], 0x1}, 0x0) (async) r4 = syz_ublk_setup_io_uring(0x1d, &(0x7f0000000040)={0x0, 0x0, 0x0, 0x0, 0x158}, &(0x7f0000000100)=0x0, &(0x7f0000000280)=0x0, &(0x7f0000001540)=0x0) (async) ioctl$sock_FIOGETOWN(0xffffffffffffffff, 0x8903, &(0x7f0000000000)=0x0) syz_ublk_add_dev(r4, r5, r6, r7, &(0x7f0000000140)={0x2e, 0x2, 0x0, 0xffffffffffffffff, 0xc0207504, 0x0, 0x0, 0x0, 0x1, 0x200, 0x0, 0x0, '\x00', {0xffffffff, 0xffff, 0x40, &(0x7f00000000c0)=@new_dev={0x4, 0x15, 0x0, 0x0, 0x1000, 0xffffffff, r8, 0x0, 0x31}}}, &(0x7f00000001c0)) syz_ublk_add_dev(r4, r5, r6, r7, &(0x7f0000000200)={0x2e, 0x0, 0x0, r9, 0xc0207504, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', {0xffffffff, 0xffff, 0x40, &(0x7f0000000440)=@any_dev={0x2, 0xe92, 0x0, 0x0, 0x1000, 0x10000, r8, 0x0, 0x1c8}}}, &(0x7f0000000300)=0x0) (async) syz_usb_control_io$lan78xx(0xffffffffffffffff, 0x0, &(0x7f0000000540)={0x34, 0x0, 0x0, &(0x7f0000000440)={0x0, 0x8, 0x1, 0x6}, 0x0, 0x0, 0x0}) (async) r11 = openat(0xffffffffffffff9c, &(0x7f000000c380)='./file0\x00', 0x20842, 0x63) syz_ublk_setup_queues(r11, r10, &(0x7f0000000340)={0x0, 0x0, 0x10, 0x1, 0x257}, &(0x7f0000000580)=[{0x0, 0x0, 0xffffffffffffffff, {0x0, 0xbb8b, 0x20, 0x1000000, 0x4}}, {0x0, 0x0, 0xffffffffffffffff, {0x0, 0x0, 0x800, 0x0, 0x22a}}, {0x0, 0x0, 0xffffffffffffffff, {0x0, 0x1f6d, 0x8c, 0x1, 0x0, 0x0, r0}}, {0x0, 0x0, 0xffffffffffffffff, {0x0, 0xb4ac, 0x4000, 0x0, 0x9d7c}}], 0x1, &(0x7f00000014c0)={0x2e, 0x0, 0x0, 0xffffffffffffffff, 0xc0107520, 0x0, 0x0, 0x0, 0x0, {}, 0x0, 0x0, '\x00', {0x1, 0x5, 0x0, 0x0}}, 0x0) (async) madvise(&(0x7f0000bdc000/0x4000)=nil, 0x86ac726dff2f4713, 0xa) syz_usb_disconnect(0xffffffffffffffff) syz_open_dev$ndb(&(0x7f0000000280), 0x0, 0x61c7c039d0921a4e) executing program 2: r0 = socket$nl_route(0x10, 0x3, 0x0) r1 = socket(0x10, 0x803, 0x0) sendmsg$nl_route(r1, &(0x7f00000006c0)={0x0, 0x0, &(0x7f0000000680)={0x0, 0x18}}, 0x0) getsockname$packet(r1, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) sendmsg$nl_route(r0, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000000)={&(0x7f00000002c0)=ANY=[@ANYBLOB="5000000010008105e9c51c000000000000000000", @ANYRES32=r2, @ANYRES64=r0], 0x50}, 0x1, 0x0, 0x0, 0x80}, 0x0) sendmsg$nl_route(0xffffffffffffffff, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000700)=@newlink={0x40, 0x10, 0x1, 0x1, 0x25dfdbff, {0x0, 0x0, 0x0, r2, 0x0, 0x8}, [@IFLA_LINKINFO={0x20, 0x12, 0x0, 0x1, @vlan={{0x9}, {0x10, 0x2, 0x0, 0x1, [@IFLA_VLAN_FLAGS={0xc, 0x2, {0x12, 0x1f}}]}}}]}, 0x40}, 0x1, 0x0, 0x0, 0x11}, 0x0) ioctl$sock_inet6_SIOCADDRT(0xffffffffffffffff, 0x890b, &(0x7f0000000380)={@local, @empty, @initdev={0xfe, 0x88, '\x00', 0x1, 0x0}, 0x3, 0x6, 0x5, 0x200, 0x4, 0x100020, r2}) mkdirat(0xffffffffffffff9c, &(0x7f0000000400)='./config\x00', 0x1ed) socket$nl_xfrm(0x10, 0x3, 0x6) mount(0x0, &(0x7f0000000500)='./config\x00', &(0x7f0000000600)='configfs\x00', 0x0, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000700)='./config/usb_gadget/g1\x00', 0x1ed) mkdirat(0xffffffffffffff9c, &(0x7f0000000c00)='./config/usb_gadget/g1/UDC\x00', 0x1c4) bpf$PROG_LOAD(0x5, 0x0, 0x0) socket(0x3d, 0x80000, 0x5) mkdirat(0xffffffffffffff9c, &(0x7f0000000d00)='./config/usb_gadget/g1/functions/uvc.usb0/control/header/h\x00', 0x1ed) r3 = openat$dir(0xffffffffffffff9c, 0x0, 0x400007, 0x2) readlinkat(r3, &(0x7f0000000040)='./config/usb_gadget/g1/configs/c.1/uvc.usb0\x00', 0x0, 0x0) symlinkat(&(0x7f0000000e00)='./config/usb_gadget/g1/functions/uvc.usb0/control/header/h\x00', 0xffffffffffffff9c, &(0x7f0000000f00)='./config/usb_gadget/g1/functions/uvc.usb0/control/class/fs/h\x00') symlinkat(0x0, 0xffffffffffffffff, 0x0) r4 = openat(0xffffffffffffff9c, &(0x7f0000002000)='./config/usb_gadget/g1/UDC\x00', 0x1, 0x0) write(r4, &(0x7f0000002100)='usbip-vudc.0', 0xc) r5 = socket$netlink(0x10, 0x3, 0x0) stat(&(0x7f00000001c0)='./config\x00', &(0x7f0000000200)) r6 = bpf$BPF_BTF_LOAD(0x12, &(0x7f0000000140)={&(0x7f0000000100)={{0xeb9f, 0x1, 0x0, 0x18, 0x0, 0x20, 0x20, 0x4, [@func={0x2, 0x0, 0x0, 0xc, 0x2}, @func_proto={0x0, 0x1, 0x0, 0xd, 0x0, [{}]}]}, {0x0, [0x0, 0x5f]}}, 0x0, 0x3c}, 0x28) bpf$PROG_LOAD_XDP(0x5, &(0x7f00000002c0)={0x6, 0x3, &(0x7f0000000000)=@framed={{0x18, 0x0, 0x0, 0x0, 0x7, 0x0, 0x0, 0x0, 0xc0}}, &(0x7f0000000080)='GPL\x00', 0xf, 0x0, 0x0, 0x40f00, 0x4, '\x00', 0x0, 0x25, r6, 0x8, &(0x7f0000000180)={0x0, 0x1}, 0x1, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0x4}, 0x94) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000040)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$sock_SIOCGIFINDEX(r7, 0x8933, &(0x7f0000000080)={'macsec0\x00', 0x0}) r9 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$inet6_buf(r9, 0x29, 0x20, &(0x7f00000000c0)="0bbb268dd6ffa80800000000000000000000210d0000aaa8fa017242ba9380d4", 0x20) sendmsg$nl_route(r5, &(0x7f00000000c0)={0x0, 0x0, &(0x7f00000002c0)={&(0x7f0000000000)=ANY=[@ANYBLOB="280000001d000100000000010000000007000000", @ANYRES32=r8, @ANYRESDEC=r5], 0x28}, 0x1, 0x0, 0x0, 0x4041}, 0x0) executing program 2: r0 = openat$ublk_ctrl(0xffffffffffffff9c, &(0x7f0000000000), 0x2, 0x0) r1 = syz_ublk_setup_io_uring(0x20, &(0x7f0000000040)={0x0, 0x5}, &(0x7f00000000c0)=0x0, &(0x7f0000000100)=0x0, &(0x7f0000000140)=0x0) r5 = socket$nl_generic(0x10, 0x3, 0x10) r6 = syz_genetlink_get_family_id$tipc(&(0x7f0000000080), r5) sendmsg$TIPC_CMD_ENABLE_BEARER(r5, &(0x7f0000000180)={0x0, 0x0, &(0x7f00000001c0)={&(0x7f0000000200)={0x38, r6, 0x1, 0x0, 0x25dfdbfe, {{}, {}, {0xfffffffffffffe56, 0x17, {0x17, 0x5, @l2={'eth', 0x3a, 'syzkaller0\x00'}}}}}, 0x38}}, 0x20008004) r7 = syz_ublk_add_dev(r1, r2, r3, r4, &(0x7f0000000200)={0x2e, 0x0, 0x0, r0, 0xc0207504, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', {0xffffffff, 0xffff, 0x40, &(0x7f0000000500)=@new_dev={0x1, 0x104, 0x0, 0x0, 0x1000, 0xffffffff, 0x0, 0x0, 0xc4ddfbc9bba2bdbf}}}, &(0x7f0000000300)=0x0) r10 = openat(0xffffffffffffff9c, &(0x7f00000002c0)='./sys/class/rnbd-client/ctl/map_device/file0\x00', 0x121001, 0x17c) write(r10, &(0x7f00000000c0)="736573736e616d653d7331206465766963655f706174683d2f6465762f72616d3020706174683d69703a3132372e302e302e315cdf903f3a85629410457af1eedc1b5b87feb6d6dff9cddbb5ac1cb03e2c", 0x51) r11 = openat$null(0xffffffffffffff9c, &(0x7f0000003040), 0x490540, 0x0) r12 = openat$selinux_enforce(0xffffffffffffff9c, &(0x7f00000030c0), 0x28041, 0x0) r13 = fsopen(&(0x7f00000001c0)='ramfs\x00', 0x0) mkdir(&(0x7f00000020c0)='./file0\x00', 0x1c8) mount$bind(&(0x7f0000000140)='./file0\x00', &(0x7f0000000000)='./file0/../file0\x00', 0x0, 0x315901c, 0x0) chroot(&(0x7f0000001140)='./file0\x00') mount$bind(&(0x7f0000000040)='.\x00', &(0x7f0000000180)='./file0\x00', 0x0, 0x2a05004, 0x0) pivot_root(&(0x7f00000000c0)='./file0\x00', &(0x7f0000000240)='./file0/../file0\x00') fsconfig$FSCONFIG_CMD_CREATE(r13, 0x6, 0x0, 0x0, 0x0) r14 = fsmount(r13, 0x1, 0x4) fchdir(r14) r15 = socket$inet6_tcp(0xa, 0x1, 0x0) r16 = open(&(0x7f00000000c0)='./file0\x00', 0x108843, 0x9a) fcntl$setlease(r16, 0x400, 0x1) openat(0xffffffffffffff9c, &(0x7f0000000000)='./file0\x00', 0x0, 0x0) fcntl$setlease(r16, 0x400, 0x0) getsockopt$inet6_tcp_int(r15, 0x6, 0x6, 0x0, &(0x7f0000000040)) bpf$PROG_LOAD(0x5, &(0x7f0000003140)={0x17, 0x1e, &(0x7f0000000340)=ANY=[@ANYBLOB="18000000090000000000000000020000064e08000100000018210000", @ANYRES32=r5, @ANYBLOB="000000000900000018210000", @ANYRES32=r5, @ANYBLOB="0000000000002c0018240000", @ANYRES32=0x1, @ANYBLOB="000000000700000018120000", @ANYRES32, @ANYBLOB="0000000000000000b7030000000000b70000000000000018110000", @ANYRES32=r10, @ANYBLOB="0000000000000000b70800000e0000007b8af8ff00000000bfa200000000000007020000f8ffffffb703000008000000b7040000000000008500000082000000186000000000000000000000040000001861000010000000000000001b060000186000000800000000000000000000009500000000000000"], &(0x7f0000000440)='syzkaller\x00', 0xff, 0x1000, &(0x7f0000002040)=""/4096, 0x40f00, 0x4, '\x00', 0x0, @cgroup_sysctl, r11, 0x8, &(0x7f0000003080)={0x8, 0x2}, 0x8, 0x10, 0x0, 0x0, 0x0, r12, 0x0, &(0x7f0000003100)=[r14], 0x0, 0x10, 0x65}, 0x94) r17 = syz_open_dev$ublk_chdev(&(0x7f0000002000), r7, 0x2) r18 = openat$iommufd(0xffffffffffffff9c, &(0x7f0000000080), 0x0, 0x0) ioctl$IOMMU_TEST_OP_MD_CHECK_MAP(r18, 0x3ba0, &(0x7f0000000800)={0x48, 0x12, 0x0, 0x0, 0x1004000, 0x0, 0x0}) syz_ublk_setup_queues(r17, r9, &(0x7f0000000540)={0x0, 0xfa81, 0x0, 0x3, 0x28e, 0x0, r1}, &(0x7f0000000880)=[{0x0, 0x0, 0xffffffffffffffff, {0x0, 0xb8c3, 0x1000, 0x2, 0x1af, 0x0, r1}}, {0x0, 0x0, 0xffffffffffffffff, {0x0, 0xddca, 0x2, 0x0, 0x330, 0x0, r1}}, {0x0, 0x0, 0xffffffffffffffff, {0x0, 0x766c, 0x8, 0x0, 0x2db, 0x0, r1}}, {0x0, 0x0, 0xffffffffffffffff, {0x0, 0x5027, 0x4, 0x0, 0x1fe}}], 0x4, &(0x7f0000001f40)={0x2e, 0x0, 0x0, r17, 0xc0107524, 0x0, 0x0, 0x0, 0x1, {0x10}, 0x0, r8, '\x00', {0x2, 0xb55, 0x0, 0x0}}, &(0x7f0000001fc0)) executing program 2: setsockopt$inet_mreqsrc(0xffffffffffffffff, 0x0, 0x27, &(0x7f0000000280)={@multicast2, @local, @remote}, 0xc) r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) r1 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000240), 0x0, 0x0) r2 = ioctl$KVM_CREATE_VM(r1, 0xae01, 0x0) ioctl$SG_IO(0xffffffffffffffff, 0x2285, &(0x7f0000000400)={0x53, 0xfffffffffffffffb, 0x0, 0x8, @buffer={0x0, 0x0, 0x0}, 0x0, 0x0, 0x0, 0x10011, 0xfffbffff, 0x0}) r3 = ioctl$KVM_CREATE_VCPU(r2, 0xae41, 0x0) ioctl$KVM_SET_USER_MEMORY_REGION(r2, 0x4020ae46, &(0x7f0000000180)={0x0, 0x0, 0x0, 0x2000, &(0x7f0000000000/0x2000)=nil}) ioctl$KVM_SET_REGS(r3, 0x4090ae82, &(0x7f0000000000)={[0x35, 0xfff, 0xfffffffffffffffe, 0x40000000000180, 0x2, 0x7, 0xf2, 0xd, 0x7fffffffffffe, 0x7, 0x5, 0xb, 0x7, 0xfffffffffffffff8, 0x9, 0xc], 0x25000, 0x304}) ioctl$KVM_RUN(r3, 0xae80, 0x0) r4 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) r5 = dup(r4) ioctl$KVM_SET_USER_MEMORY_REGION(r4, 0x4020ae46, &(0x7f0000000840)={0x1fe, 0x2, 0x3000, 0x2000, &(0x7f0000003000/0x2000)=nil}) r6 = ioctl$KVM_CREATE_VCPU(r5, 0xae41, 0x0) syz_kvm_setup_cpu$x86(0xffffffffffffffff, r6, &(0x7f0000000000/0x18000)=nil, &(0x7f0000000040)=[@text32={0x20, 0x0}], 0x1, 0x11, 0x0, 0x0) syz_kvm_setup_cpu$x86(r4, 0xffffffffffffffff, &(0x7f0000000000/0x18000)=nil, &(0x7f0000000200)=[@text32={0x20, 0x0}], 0x1, 0x50, 0x0, 0x0) ioctl$KVM_RUN(r6, 0xae80, 0x0) (fail_nth: 7) executing program 2: r0 = syz_genetlink_get_family_id$ipvs(&(0x7f0000000040), 0xffffffffffffffff) r1 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r1, 0x0, 0x0) r2 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$IPVS_CMD_NEW_SERVICE(r2, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000080)={0x4c, r0, 0x1, 0x0, 0x0, {}, [@IPVS_CMD_ATTR_SERVICE={0x38, 0x1, 0x0, 0x1, [@IPVS_SVC_ATTR_AF={0x6, 0x1, 0x2}, @IPVS_SVC_ATTR_FWMARK={0x8, 0x5, 0x3}, @IPVS_SVC_ATTR_FLAGS={0xc, 0x7, {0x30000}}, @IPVS_SVC_ATTR_NETMASK={0x8}, @IPVS_SVC_ATTR_TIMEOUT={0x8, 0x8, 0x200}, @IPVS_SVC_ATTR_PE_NAME={0x8, 0x6}]}]}, 0x4c}}, 0x800c800) executing program 32: r0 = syz_genetlink_get_family_id$ipvs(&(0x7f0000000040), 0xffffffffffffffff) r1 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r1, 0x0, 0x0) r2 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$IPVS_CMD_NEW_SERVICE(r2, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000080)={0x4c, r0, 0x1, 0x0, 0x0, {}, [@IPVS_CMD_ATTR_SERVICE={0x38, 0x1, 0x0, 0x1, [@IPVS_SVC_ATTR_AF={0x6, 0x1, 0x2}, @IPVS_SVC_ATTR_FWMARK={0x8, 0x5, 0x3}, @IPVS_SVC_ATTR_FLAGS={0xc, 0x7, {0x30000}}, @IPVS_SVC_ATTR_NETMASK={0x8}, @IPVS_SVC_ATTR_TIMEOUT={0x8, 0x8, 0x200}, @IPVS_SVC_ATTR_PE_NAME={0x8, 0x6}]}]}, 0x4c}}, 0x800c800) executing program 1: r0 = ioctl$KVM_CREATE_VM(0xffffffffffffffff, 0xae01, 0x0) syz_open_procfs$namespace(0x0, 0x0) ioctl$KVM_CREATE_PIT2(r0, 0x4040ae77, &(0x7f0000000280)={0x9}) r1 = ioctl$KVM_CREATE_VCPU(r0, 0xae41, 0x0) ioctl$KVM_SET_PIT(r0, 0x8048ae66, 0x0) ioctl$KVM_SET_USER_MEMORY_REGION(r0, 0x4020ae46, &(0x7f0000000180)={0x0, 0x0, 0x0, 0x2000, &(0x7f0000000000/0x2000)=nil}) r2 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r2, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000500)={&(0x7f0000000240)=@newlink={0x38, 0x10, 0x439, 0x70bd2c, 0xffffffea, {0x0, 0x0, 0xe403, 0x0, 0x40083, 0x715cb}, [@IFLA_LINKINFO={0x18, 0x12, 0x0, 0x1, @sit={{0x8}, {0xc, 0x2, 0x0, 0x1, [@IFLA_IPTUN_ENCAP_TYPE={0x6, 0xf, 0x3}]}}}]}, 0x38}, 0x1, 0x0, 0x0, 0x80d1}, 0x4084) ioctl$KVM_SET_REGS(r1, 0x4090ae82, &(0x7f00000003c0)={[0x60000000000, 0xd4, 0x0, 0x61, 0x200002000001, 0x0, 0x2004c8, 0x0, 0x0, 0x36ae, 0x4, 0x7fff, 0x3, 0x400000000], 0x80a0000}) bpf$BPF_BTF_LOAD(0x12, &(0x7f0000000300)={&(0x7f0000000380)=ANY=[@ANYBLOB="9feb010018000000000000000c000000"], 0x0, 0x26}, 0x28) ioctl$KVM_RUN(r1, 0xae80, 0x0) r3 = openat(0xffffffffffffff9c, &(0x7f0000000040)='./cgroup.cpu/memory.limit_in_bytes\x00', 0x2, 0x50) write$sysctl(r3, &(0x7f0000000100)='4\x00', 0x2) socket$kcm(0x10, 0x2, 0x0) socket$nl_route(0x10, 0x3, 0x0) write$RDMA_USER_CM_CMD_CREATE_ID(r3, &(0x7f0000000000)={0x0, 0x18, 0xfa00, {0xfeffffff, 0x0, 0x111}}, 0x20) executing program 1: bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000180)={0x11, 0x3, &(0x7f0000000040)=ANY=[], &(0x7f0000000080)='syzkaller\x00', 0x8, 0x0, 0x0, 0x41000}, 0x94) r0 = bpf$MAP_CREATE(0x0, &(0x7f0000000200)=ANY=[@ANYBLOB="2200000004"], 0x48) r1 = bpf$MAP_CREATE(0x0, &(0x7f0000000200)=ANY=[], 0x48) bpf$BPF_MAP_CONST_STR_FREEZE(0x16, &(0x7f0000000040)={r1, 0xffffffffffffffff}, 0x4) bpf$BPF_MAP_FREEZE(0x16, &(0x7f0000000000)=r1, 0x4) r3 = fcntl$dupfd(r2, 0x0, r0) mknod$loop(&(0x7f0000000140)='./file0\x00', 0xfff, 0x1) landlock_create_ruleset(&(0x7f0000000100)={0x100}, 0x6d, 0x0) bpf$MAP_LOOKUP_ELEM(0x1, &(0x7f0000000580)={r3, 0x0, 0x0}, 0x20) executing program 1: r0 = socket$netlink(0x10, 0x3, 0x0) r1 = socket(0x10, 0x803, 0x0) sendmsg$NL80211_CMD_CRIT_PROTOCOL_START(r1, &(0x7f0000000580)={0x0, 0x0, &(0x7f0000000540)={0x0, 0x1c}}, 0x0) getsockname$packet(r1, &(0x7f00000002c0)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f00000004c0)=0x68) sendmsg$nl_route(r0, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000640)=ANY=[@ANYBLOB="3c0000001000850600000000ff6122314a000800", @ANYRES32=r2, @ANYBLOB="f5ff0f00252155b21c0012000c000100626f6e64000000000c0002000800010001"], 0x3c}}, 0x40000) r3 = socket$netlink(0x10, 0x3, 0x0) r4 = socket(0x10, 0x803, 0x4) sendmsg$IPVS_CMD_SET_INFO(r4, &(0x7f0000000b00)={0x0, 0x0, &(0x7f0000000ac0)={0x0, 0x14}}, 0x0) getsockname$packet(r4, &(0x7f0000000340)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x66) sendmsg$nl_route(r3, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000001440)=@newlink={0x50, 0x10, 0xffffff1f, 0x0, 0x80, {0x0, 0x0, 0x0, 0x0, 0x300, 0x17e05}, [@IFLA_MASTER={0x8, 0xa, r5}, @IFLA_LINKINFO={0x28, 0x12, 0x0, 0x1, @veth={{0x9}, {0x18, 0x2, 0x0, 0x1, @val=@VETH_INFO_PEER={0x14, 0x1, {{0x0, 0x0, 0x20, 0x0, 0x4000, 0x640}}}}}}]}, 0x50}, 0x1, 0x0, 0x0, 0x2000c0c1}, 0x0) executing program 1: mkdirat(0xffffffffffffff9c, 0x0, 0x1ff) ioctl$DRM_IOCTL_GET_CLIENT(0xffffffffffffffff, 0xc0286405, &(0x7f0000000080)={0x9, 0x7, {}, {0xee00}, 0x3, 0x8}) syz_fuse_handle_req(0xffffffffffffffff, 0x0, 0x0, &(0x7f00000000c0)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f0000000200)={0x90, 0x0, 0xffffffffffffffff, {0xffffffffffffffff, 0x2, 0x101, 0x0, 0x0, 0x10000000, {0x40, 0xd08, 0x0, 0x100, 0x0, 0x0, 0x7, 0x0, 0x122, 0x6000, 0x10000, r0, 0x0, 0x902, 0x1}}}, 0x0, 0x0, 0x0, 0x0, 0x0}) r1 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000140), 0x0, 0x0) r2 = ioctl$KVM_CREATE_VM(r1, 0xae01, 0x0) mkdir(&(0x7f00000020c0)='./file0\x00', 0x1c8) mount$bind(&(0x7f0000000140)='./file0\x00', &(0x7f0000000000)='./file0/../file0\x00', 0x0, 0x315901c, 0x0) chroot(&(0x7f0000001140)='./file0\x00') mount$bind(&(0x7f0000000040)='.\x00', &(0x7f0000000080)='./file0\x00', 0x0, 0x2a05004, 0x0) pivot_root(&(0x7f00000000c0)='./file0/../file0\x00', &(0x7f0000000100)='./file0\x00') r3 = ioctl$KVM_CREATE_VCPU(r2, 0xae41, 0x0) ioctl$KVM_SET_MSRS(r3, 0xc008ae88, &(0x7f0000000040)={0x10000000000000cf, 0x0, [{0x8d}]}) r4 = syz_open_dev$cec(&(0x7f0000000200), 0xffffffffffffffff, 0x4ae60) ioctl$CEC_TRANSMIT(r4, 0xc0386105, &(0x7f0000000100)={0xfffffffffffffbf7, 0x1, 0x2, 0x0, 0x4, 0x7ffe, "7f2c00", 0xfe, 0x56, 0x1, 0xfa, 0x9, 0x1}) pipe2$9p(&(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}, 0x80) write$P9_RREADLINK(r5, &(0x7f0000000040)={0x10, 0x17, 0xc, {0x7, './file0'}}, 0x10) executing program 1: r0 = socket$inet_udp(0x2, 0x2, 0x0) r1 = openat$tun(0xffffffffffffff9c, &(0x7f0000000100), 0x2, 0x0) ioctl$TUNSETIFF(r1, 0x400454ca, &(0x7f0000000040)={'syzkaller0\x00', 0x4001}) ioctl$sock_inet_SIOCSIFFLAGS(r0, 0x8914, &(0x7f0000000200)={'syzkaller0\x00', 0x1}) write$tun(r1, &(0x7f0000000140)=ANY=[@ANYBLOB="0000080001000000000e140008004500003c000000004084ca2502020202ac140001"], 0x4a) executing program 1: r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000300), 0x900, 0x0) r1 = socket$inet_udp(0x2, 0x2, 0x0) ioctl$sock_ipv6_tunnel_SIOCGETPRL(r1, 0x89f4, &(0x7f0000000040)={'sit0\x00', 0x0}) r2 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) ioctl$KVM_SET_USER_MEMORY_REGION(r2, 0x4020ae46, &(0x7f0000000400)={0x0, 0x0, 0x0, 0x20002000, &(0x7f0000000000/0x2000)=nil}) syz_kvm_setup_cpu$x86(0xffffffffffffffff, 0xffffffffffffffff, &(0x7f0000000000/0x18000)=nil, &(0x7f0000000140)=[@text64={0x40, 0x0}], 0x1, 0xe8, 0x0, 0x0) ioctl$KVM_CAP_DIRTY_LOG_RING_ACQ_REL(r2, 0x4068aea3, &(0x7f00000000c0)={0xdf, 0x0, 0x1000}) syz_kvm_add_vcpu$x86(0x0, &(0x7f0000000980)={0x0, &(0x7f0000000440)=[@nested_load_code={0x12e, 0x79, {0x3, "c4a18172d401c744240022000000c744240281e9d8ffc7442406000000000f011c24c7442400a9000000c7442402f0a6d482ff1c24b964090000b80001c0feba000000000f300f320f01c3420f01f83e430f01cbc4a27d2014e966b85f000f00d0"}}], 0x79}) ioctl$KVM_RUN(0xffffffffffffffff, 0xae80, 0x0) syz_kvm_setup_cpu$x86(r2, 0xffffffffffffffff, &(0x7f0000000000/0x18000)=nil, &(0x7f0000000080)=[@text64={0x40, 0x0}], 0x1, 0x10, 0x0, 0x0) executing program 33: r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000300), 0x900, 0x0) r1 = socket$inet_udp(0x2, 0x2, 0x0) ioctl$sock_ipv6_tunnel_SIOCGETPRL(r1, 0x89f4, &(0x7f0000000040)={'sit0\x00', 0x0}) r2 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) ioctl$KVM_SET_USER_MEMORY_REGION(r2, 0x4020ae46, &(0x7f0000000400)={0x0, 0x0, 0x0, 0x20002000, &(0x7f0000000000/0x2000)=nil}) syz_kvm_setup_cpu$x86(0xffffffffffffffff, 0xffffffffffffffff, &(0x7f0000000000/0x18000)=nil, &(0x7f0000000140)=[@text64={0x40, 0x0}], 0x1, 0xe8, 0x0, 0x0) ioctl$KVM_CAP_DIRTY_LOG_RING_ACQ_REL(r2, 0x4068aea3, &(0x7f00000000c0)={0xdf, 0x0, 0x1000}) syz_kvm_add_vcpu$x86(0x0, &(0x7f0000000980)={0x0, &(0x7f0000000440)=[@nested_load_code={0x12e, 0x79, {0x3, "c4a18172d401c744240022000000c744240281e9d8ffc7442406000000000f011c24c7442400a9000000c7442402f0a6d482ff1c24b964090000b80001c0feba000000000f300f320f01c3420f01f83e430f01cbc4a27d2014e966b85f000f00d0"}}], 0x79}) ioctl$KVM_RUN(0xffffffffffffffff, 0xae80, 0x0) syz_kvm_setup_cpu$x86(r2, 0xffffffffffffffff, &(0x7f0000000000/0x18000)=nil, &(0x7f0000000080)=[@text64={0x40, 0x0}], 0x1, 0x10, 0x0, 0x0) executing program 0: r0 = io_uring_setup(0x2ac3, &(0x7f00000001c0)={0x0, 0x77b6, 0x0, 0x400000, 0xac}) r1 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r1, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000500)={&(0x7f00000002c0)=@newlink={0x3c, 0x10, 0x439, 0x70bd2d, 0x0, {}, [@IFLA_LINKINFO={0x1c, 0x12, 0x0, 0x1, @ipip6={{0xb}, {0xc, 0x2, 0x0, 0x1, [@IFLA_IPTUN_FWMARK={0x8, 0x14, 0x7}]}}}]}, 0x3c}}, 0x0) io_uring_setup(0x650b, 0x0) r2 = syz_open_dev$vim2m(&(0x7f0000000280), 0x4eb36, 0x2) ioctl$vim2m_VIDIOC_REQBUFS(r2, 0xc0145608, &(0x7f00000007c0)={0x1, 0x2, 0x1, 0x0, 0x8}) ioctl$vim2m_VIDIOC_QBUF(r2, 0xc058560f, &(0x7f00000002c0)=@multiplanar_mmap={0x0, 0x2, 0x0, 0xfdfd, 0x0, {}, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, "fafc00"}, 0x0, 0x1, {0x0}}) ioctl$BTRFS_IOC_QUOTA_RESCAN_WAIT(r0, 0x942e, 0x0) r3 = socket$netlink(0x10, 0x3, 0x0) sendmsg$nl_route(r3, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000001140)={&(0x7f0000000140)=@newlink={0x78, 0x10, 0x503, 0x0, 0x2, {0x0, 0x0, 0x0, 0x0, 0x0, 0x1244c}, [@IFLA_LINKINFO={0x58, 0x12, 0x0, 0x1, @vti={{0x8}, {0x4c, 0x2, 0x0, 0x1, [@IFLA_VTI_LOCAL={0x8, 0x4, @private=0xa010101}, @IFLA_VTI_REMOTE={0x8, 0x5, @private=0xa0100fe}, @IFLA_VTI_LOCAL={0x8, 0x4, @rand_addr=0x64010102}, @vti_common_policy=[@IFLA_VTI_FWMARK={0x8, 0x6, 0x2d616b45}, @IFLA_VTI_LINK={0x8}, @IFLA_VTI_IKEY={0x8, 0x2, 0x5}, @IFLA_VTI_FWMARK={0x8, 0x6, 0xe}, @IFLA_VTI_FWMARK={0x8, 0x6, 0x4}, @IFLA_VTI_IKEY={0x8, 0x2, 0x9}]]}}}]}, 0x78}}, 0x0) r4 = openat$procfs(0xffffffffffffff9c, &(0x7f0000000000)='/proc/cgroups\x00', 0x0, 0x0) setsockopt$MRT_DEL_MFC(r4, 0x0, 0xcd, &(0x7f0000000100)={@remote, @local, 0xffffffffffffffff, "497c62504d07e8fcbfc16eccdbef03f9a0fdc7265c6886e9b1b17fe65790058b", 0x200, 0xffff, 0x7ea3, 0xc6}, 0x3c) executing program 3: r0 = socket$unix(0x1, 0x5, 0x0) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000100)={'batadv0\x00', 0x0}) r2 = socket(0x10, 0x3, 0x0) sendmsg$nl_route_sched(r2, &(0x7f0000000200)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000300)=@newqdisc={0x88, 0x24, 0xf0b, 0x70bd26, 0x0, {0x0, 0x0, 0x0, r1, {0x0, 0xffff}, {0xffff, 0xffff}}, [@qdisc_kind_options=@q_mqprio={{0xb}, {0x58, 0x2, {{0x1, [], 0x0, [0x1, 0x2, 0xfffe, 0x0, 0x0, 0x0, 0x0, 0x8, 0x0, 0x5c4, 0x8000, 0x0, 0x0, 0x3dc], [0x0, 0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1000]}}}}]}, 0x88}}, 0x20000000) sendmsg$nl_route_sched(r2, &(0x7f00000012c0)={0x0, 0x0, &(0x7f0000000400)={&(0x7f0000000540)=@newqdisc={0x44, 0x24, 0x4ee4e6a52ff56541, 0x70bd29, 0xfffbffff, {0x0, 0x0, 0x0, r1, {0x0, 0x8}, {0xffff, 0xffff}, {0xc, 0xfff3}}, [@qdisc_kind_options=@q_taprio={{0xb}, {0x14, 0x2, [@TCA_TAPRIO_ATTR_SCHED_ENTRY_LIST={0x10, 0x2, 0x0, 0x1, [{0xc, 0x1, 0x0, 0x1, [@TCA_TAPRIO_SCHED_ENTRY_CMD={0x5, 0x2, 0x66}]}]}]}}]}, 0x44}, 0x1, 0xc000000, 0x0, 0x41}, 0x14) executing program 4: mknodat(0xffffffffffffff9c, &(0x7f0000000100)='./file2\x00', 0x81c0, 0x0) execveat(0xffffffffffffff9c, &(0x7f0000000280)='./file2\x00', 0x0, 0x0, 0x0) mknod$loop(&(0x7f0000000300)='./file0\x00', 0x6000, 0x0) unlink(&(0x7f0000000040)='./file0\x00') mknod$loop(&(0x7f0000000200)='./file0\x00', 0x2000, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./sys\x00', 0x1ff) mount(0x0, &(0x7f00000000c0)='./file1\x00', &(0x7f0000000040)='sysfs\x00', 0x0, 0x0) openat$binderfs(0xffffffffffffff9c, &(0x7f0000000300)='./binderfs/binder0\x00', 0x0, 0x0) openat$binderfs(0xffffffffffffff9c, &(0x7f0000000180)='./binderfs/binder1\x00', 0xc02, 0x0) syz_open_dev$sndpcmc(&(0x7f0000000000), 0x0, 0x0) socket(0x11, 0x2, 0x10001) mmap$IORING_OFF_SQ_RING(0x0, 0xc, 0x2000002, 0x401d031, 0xffffffffffffffff, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000001500)='./dev\x00', 0x1ff) openat(0xffffffffffffff9c, &(0x7f0000000240)='./file0\x00', 0x40042, 0x1) open(&(0x7f00009e1000)='./file0\x00', 0x8060, 0x0) mount(0x0, &(0x7f0000001500)='./dev\x00', &(0x7f0000001600)='devtmpfs\x00', 0x0, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000080)='./mnt\x00', 0x1ff) socket$nl_generic(0x10, 0x3, 0x10) socket$packet(0x11, 0x3, 0x300) socket$packet(0x11, 0x3, 0x300) socketpair$unix(0x1, 0x2, 0x0, 0x0) mount(&(0x7f00000000c0)=@filename='./dev/sda1\x00', &(0x7f0000000140)='./mnt\x00', &(0x7f0000000100)='ext4\x00', 0x8410, 0x0) mprotect(&(0x7f0000000000/0xf000)=nil, 0xf000, 0x1) r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000140), 0x0, 0x0) ioctl$TUNSETIFF(r0, 0x40e8662e, 0x0) r1 = openat(0xffffffffffffff9c, &(0x7f0000000400)='./sys/bus/pci/drivers/net2280/new_id\x00', 0x1, 0x0) write(r1, &(0x7f0000001100)='8086 29c0 ffffffff ffffffff 0 0 1', 0x21) syz_create_resource$binfmt(&(0x7f0000000080)='./sys/bus/pci/drivers/net2280/new_id\x00') executing program 0: r0 = socket$kcm(0x2, 0x3, 0x84) sendmmsg$inet(r0, &(0x7f0000006a80)=[{{&(0x7f0000000000)={0x2, 0x4e22, @dev={0xac, 0x14, 0x14, 0x18}}, 0x10, &(0x7f0000002ac0)=[{&(0x7f0000000080)="f982340819048e40ac0bd4474d", 0xd}], 0x1}}], 0x1, 0x8080) sendmsg$inet(r0, &(0x7f0000000a00)={&(0x7f0000000040)={0x2, 0x4e23, @remote}, 0x10, &(0x7f00000000c0)=[{&(0x7f0000000440)="c10900", 0x3}], 0x1}, 0x6000) executing program 4: syz_emit_ethernet(0x6a, &(0x7f0000000040)={@link_local={0x1, 0x80, 0xc2, 0x0, 0x0, 0x3}, @remote, @void, {@ipv4={0x800, @icmp={{0x5, 0x4, 0x0, 0x1, 0x5c, 0x0, 0x0, 0xfb, 0x1, 0x0, @initdev={0xac, 0x1e, 0x0, 0x0}, @local}, @time_exceeded={0x3, 0x1, 0x0, 0x3, 0x24, 0x0, {0x10, 0x4, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x1, 0x8, @loopback, @rand_addr=0x640100fe, {[@cipso={0x86, 0x29, 0xffffffffffffffff, [{0x0, 0xe, "08c82ce8da6ee06cb8dd9452"}, {0x5, 0x9, "020007651442eb"}, {0x1, 0x2}, {0x2, 0x7, "cf05003179"}, {0x0, 0x3, '\x00'}]}]}}}}}}}, 0x0) socketpair(0x1, 0x1, 0x0, &(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}) r2 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r3 = syz_genetlink_get_family_id$nbd(&(0x7f0000000040), r2) sendmsg$NBD_CMD_CONNECT(r2, &(0x7f0000000400)={0x0, 0x0, &(0x7f0000001a80)={&(0x7f0000000480)={0x5c, r3, 0x1, 0x70bd2c, 0xffe, {}, [@NBD_ATTR_SIZE_BYTES={0xc, 0x2, 0x2}, @NBD_ATTR_SOCKETS={0x28, 0x7, 0x0, 0x1, [{0xc, 0x1, 0x0, 0x1, {0x8, 0x1, r0}}, {0xc, 0x1, 0x0, 0x1, {0x8, 0x1, r0}}, {0xc, 0x1, 0x0, 0x1, {0x8, 0x1, r1}}]}, @NBD_ATTR_SERVER_FLAGS={0xc, 0x5, 0x128}, @NBD_ATTR_BACKEND_IDENTIFIER={0x8, 0xa, 'nbd\x00'}]}, 0x5c}}, 0x20000000) r4 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r5 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r6 = syz_genetlink_get_family_id$netlbl_mgmt(&(0x7f0000002180), r4) sendmsg$NLBL_MGMT_C_REMOVEDEF(r5, &(0x7f0000002240)={0x0, 0x0, &(0x7f0000002200)={&(0x7f00000021c0)={0x14, r6, 0x1, 0x70bd29, 0x25dfdbfd}, 0x14}, 0x1, 0x0, 0x0, 0x4000800}, 0x4000004) sendmsg$NLBL_MGMT_C_ADDDEF(r2, &(0x7f00000001c0)={&(0x7f00000000c0)={0x10, 0x0, 0x0, 0x4000}, 0xc, &(0x7f0000000180)={&(0x7f0000000140)={0x3c, r6, 0x200, 0x70bd2b, 0x25dfdbff, {}, [@NLBL_MGMT_A_DOMAIN={0x9, 0x1, '\xaa\xaa\xaa\xaa\xaa'}, @NLBL_MGMT_A_IPV4MASK={0x8, 0x8, @empty}, @NLBL_MGMT_A_IPV6ADDR={0x14, 0x5, @dev={0xfe, 0x80, '\x00', 0x19}}]}, 0x3c}, 0x1, 0x0, 0x0, 0x48000}, 0x4000000) seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0x0, &(0x7f0000000000)={0x1, &(0x7f0000000100)=[{0x6, 0x0, 0x0, 0x7fff0000}]}) socket(0x1, 0x80402, 0x7) executing program 3: r0 = openat$sysctl(0xffffffffffffff9c, &(0x7f0000000040)='/proc/sys/net/ipv4/tcp_mtu_probing\x00', 0x1, 0x0) pwritev(r0, &(0x7f0000000140), 0x15, 0x9, 0x1) executing program 0: r0 = socket$inet_udp(0x2, 0x2, 0x0) r1 = bpf$BPF_BTF_LOAD(0x12, &(0x7f0000000080)={&(0x7f0000000040)=ANY=[@ANYBLOB="9feb0100180000000000000020000000200000000400000001000000000000010400000020000000010000000000000108"], 0x0, 0x3c}, 0x28) r2 = bpf$MAP_CREATE(0x0, &(0x7f0000000200)=ANY=[@ANYBLOB="1c0000000400000008000000000000000100"/48, @ANYRES32=r1, @ANYBLOB="0100000002"], 0x40) bpf$MAP_LOOKUP_ELEM(0x1, &(0x7f0000000300)={r2, &(0x7f00000000c0)="8fa5", 0x0}, 0x20) setsockopt$IPT_SO_SET_REPLACE(r0, 0x0, 0x40, &(0x7f0000000000)=@raw={'raw\x00', 0x8, 0x3, 0x3c8, 0x0, 0xa, 0x148, 0x0, 0x10, 0x330, 0x2a8, 0x2a8, 0x330, 0x2a8, 0x3, 0x0, {[{{@ip={@rand_addr, @multicast1, 0x0, 0x0, 'bridge0\x00', 'rose0\x00'}, 0x0, 0x70, 0xe0, 0x0, {0x200003ae, 0x7f00}}, @common=@unspec=@NFLOG={0x70, 'NFLOG\x00', 0x0, {0x0, 0x0, 0x0, 0x0, 0x0, "f2f7b90ad2b60c45cb4ea6e7bf902bdc2ff8a9304d9f655c746adc0bdc773506378bc0d27efd6abb05175089830cc46186074d7de46d5af300"}}}, {{@ip={@empty, @local, 0x0, 0x0, 'ip6erspan0\x00', 'veth0_to_team\x00'}, 0x0, 0x1f0, 0x250, 0x0, {}, [@common=@inet=@hashlimit3={{0x158}, {'wg2\x00', {0xffffffffffffffff, 0xff, 0x0, 0x0, 0x0, 0x7fff, 0x200}}}, @inet=@rpfilter={{0x28}}]}, @common=@CLUSTERIP={0x60, 'CLUSTERIP\x00', 0x0, {0x1, @multicast, 0x2, 0x7, [0x0, 0x10, 0x1b, 0x2b, 0x37, 0x2e, 0x2b, 0x18, 0x2b, 0x34, 0xd, 0x0, 0x3d, 0x1, 0x32, 0x37], 0x1, 0x6, 0x1570000000000}}}], {{'\x00', 0xc8, 0x70, 0x98}, {0x28}}}}, 0x428) r3 = openat(0xffffffffffffff9c, &(0x7f0000000040)='./file1\x00', 0x542, 0x0) ioctl$SIOCX25SDTEFACILITIES(r3, 0x89eb, &(0x7f0000000080)={0x81, 0x962, 0x7, 0x7, 0x2, 0xd, 0x3, "4cb8b2a6146ab1a722e031cf656758ee56a018e7", "be634e4a96ef65eb0d23451a8d73bc095839f363"}) pwritev2(r3, &(0x7f00000000c0)=[{&(0x7f0000000300)=')', 0x1}], 0x1, 0x2, 0x0, 0xa1) r4 = syz_open_dev$I2C(&(0x7f0000000000), 0x1, 0x0) ioctl$I2C_PEC(r4, 0x708, 0x40) ioctl$I2C_SMBUS(r4, 0x720, &(0x7f00000002c0)={0x1, 0x7, 0x4, &(0x7f0000000280)={0x5, "1d27f0db2e1f25eff995475188afe0ebe9bab69516a5e88a718dca33021b22b650"}}) r5 = socket$nl_route(0x10, 0x3, 0x0) getsockopt$sock_int(r5, 0x1, 0xb, 0x0, &(0x7f0000000040)) socket$netlink(0x10, 0x3, 0x0) r6 = socket(0x10, 0x803, 0x0) sendmsg$IPVS_CMD_SET_INFO(r6, &(0x7f0000000b00)={0x0, 0x0, &(0x7f0000000ac0)={0x0, 0x14}}, 0x0) r7 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r7, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000240)={&(0x7f0000000180)=ANY=[@ANYBLOB="3c0000001000030400"/20, @ANYRES32=0x0, @ANYBLOB="a4280400000000001400350073797a5f74756e00000000000000000008000a00", @ANYRES32], 0x3c}}, 0x8000) executing program 4: bpf$MAP_CREATE(0x0, &(0x7f0000000000)=ANY=[@ANYBLOB="1400000007"], 0x50) r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000000), 0x40241, 0x0) r1 = socket$pppl2tp(0x18, 0x1, 0x1) r2 = socket$inet6_udp(0xa, 0x2, 0x0) r3 = socket$inet_tcp(0x2, 0x1, 0x0) bind$inet(r3, &(0x7f0000000040)={0x2, 0x4e21, @local}, 0x10) setsockopt$inet_tcp_int(0xffffffffffffffff, 0x6, 0x19, &(0x7f0000000240)=0x6, 0xfffffedf) setsockopt$inet_tcp_TCP_REPAIR_QUEUE(r3, 0x6, 0x14, &(0x7f0000000000)=0x2, 0x4) setsockopt$SO_TIMESTAMPING(r3, 0x1, 0x25, &(0x7f0000000200)=0x437b, 0x4) connect$inet(r3, &(0x7f0000000180)={0x2, 0x4e21, @local}, 0x10) setsockopt$inet_tcp_TCP_REPAIR_OPTIONS(r3, 0x6, 0x16, &(0x7f0000000340)=[@window={0x3, 0x1, 0x8}, @window={0x3, 0x6, 0x7}, @sack_perm, @window={0x3, 0x0, 0x4}, @mss={0x2, 0x4}, @timestamp, @window={0x3, 0x1, 0x10}, @sack_perm], 0x20000000000002a1) sendmsg$inet(r3, &(0x7f0000000300)={0x0, 0x0, &(0x7f0000000140)=[{&(0x7f0000000380)="9ad024c2775e1e2ab8e46a2877fcb21d4bb90500ebb1cfaea615b04f758b1754ce82525f728b072274a6388145b8991b4d0d7e9275d21e257816bb8650d21ba04ac83b4961e7b3a94d", 0x49}], 0x1}, 0x0) setsockopt$inet_tcp_TCP_REPAIR(r3, 0x6, 0x13, &(0x7f00000001c0), 0x4) sendto$inet(r3, &(0x7f00000004c0)='<', 0x381, 0x805, 0x0, 0x0) connect$pppl2tp(r1, &(0x7f0000000080)=@pppol2tpin6={0x18, 0x1, {0x0, r2, 0x6, 0x0, 0x0, 0x0, {0xa, 0x0, 0x0, @local}}}, 0x32) getsockopt$sock_buf(r1, 0x1, 0x1c, 0x0, &(0x7f0000000000)=0x3d) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000200)={'syzkaller1\x00', 0xc201}) r4 = socket$kcm(0x21, 0x2, 0xa) r5 = socket$inet6(0xa, 0x3, 0xff) setsockopt$inet6_int(r5, 0x29, 0x7, &(0x7f0000fcb000)=0xffffffff, 0x4) sendmsg$kcm(r4, &(0x7f0000000080)={&(0x7f0000000000)=@rxrpc=@in6={0x21, 0x1, 0x2, 0x1c, {0xa, 0x0, 0x4, @dev, 0x8000000}}, 0x80, 0x0, 0x0, &(0x7f00000000c0)=[{0x18, 0x110, 0x1, '\x00'}, {0x18, 0x110, 0xc, "aa"}], 0x30}, 0xfc40) r6 = socket$inet6_tcp(0xa, 0x1, 0x0) r7 = dup(r6) ioctl$TIOCSLCKTRMIOS(r7, 0x5457, &(0x7f00000000c0)) ioctl$SIOCSIFHWADDR(r7, 0x8914, &(0x7f0000000040)={'syzkaller1\x00', @link_local={0x1, 0x80, 0xc2, 0x0, 0x0, 0x3}}) write$tun(r0, &(0x7f0000000500)={@val={0x8, 0xc}, @val={0x2, 0x1, 0x4, 0x11, 0x9ca, 0x81}, @ipv4=@icmp={{0x20, 0x4, 0x1, 0x25, 0x94, 0x66, 0x0, 0xa8, 0x1, 0x0, @initdev={0xac, 0x1e, 0x1, 0x0}, @local, {[@ra={0x94, 0x4, 0x1}, @lsrr={0x83, 0x13, 0xa1, [@local, @dev={0xac, 0x14, 0x14, 0x3e}, @local, @multicast1]}, @timestamp_addr={0x44, 0x24, 0x1b, 0x1, 0x9, [{@loopback, 0x7}, {@loopback, 0x200}, {@multicast2}, {@multicast1, 0x4}]}, @cipso={0x86, 0x31, 0x2, [{0x1, 0xb, "b994131c56c477d6f5"}, {0x2, 0x12, "ef0500f6d000"/16}, {0x7, 0x6, "e8c2e380"}, {0x1, 0x8, "1e2d53d7cd98"}]}]}}, @timestamp={0xd, 0x0, 0x0, 0xc000, 0x4, 0x3, 0x401, 0x600}}}, 0xa2) creat(0x0, 0x0) sendto$packet(0xffffffffffffffff, &(0x7f0000000000)='1', 0x1, 0x4000800, 0x0, 0x0) r8 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) bind$bt_hci(r8, &(0x7f0000000040)={0x1f, 0xffff, 0x3}, 0x6) executing program 3: r0 = socket$nl_route(0x10, 0x3, 0x0) r1 = socket(0x10, 0x803, 0x0) sendmsg$nl_route(r1, &(0x7f00000006c0)={0x0, 0x0, &(0x7f0000000680)={0x0, 0x18}}, 0x0) getsockname$packet(r1, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) sendmsg$nl_route(r0, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000000)={&(0x7f00000002c0)=ANY=[@ANYBLOB="5000000010008105e9c51c000000000000000000", @ANYRES32=r2, @ANYBLOB="01000000000000002800128009000100766c616e000000001800028006000100000000000c0002000c0000000d00000008000500", @ANYRES64=r0], 0x50}, 0x1, 0x0, 0x0, 0x80}, 0x0) sendmsg$nl_route(0xffffffffffffffff, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000700)=@newlink={0x20, 0x10, 0x1, 0x1, 0x25dfdbff, {0x0, 0x0, 0x0, r2, 0x0, 0x8}}, 0x20}, 0x1, 0x0, 0x0, 0x11}, 0x0) ioctl$sock_inet6_SIOCADDRT(0xffffffffffffffff, 0x890b, &(0x7f0000000380)={@local, @empty, @initdev={0xfe, 0x88, '\x00', 0x1, 0x0}, 0x3, 0x6, 0x5, 0x200, 0x4, 0x100020, r2}) mkdirat(0xffffffffffffff9c, &(0x7f0000000400)='./config\x00', 0x1ed) socket$nl_xfrm(0x10, 0x3, 0x6) mount(0x0, &(0x7f0000000500)='./config\x00', &(0x7f0000000600)='configfs\x00', 0x0, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000700)='./config/usb_gadget/g1\x00', 0x1ed) mkdirat(0xffffffffffffff9c, &(0x7f0000000c00)='./config/usb_gadget/g1/UDC\x00', 0x1c4) bpf$PROG_LOAD(0x5, 0x0, 0x0) socket(0x3d, 0x80000, 0x5) mkdirat(0xffffffffffffff9c, &(0x7f0000000d00)='./config/usb_gadget/g1/functions/uvc.usb0/control/header/h\x00', 0x1ed) r3 = openat$dir(0xffffffffffffff9c, 0x0, 0x400007, 0x2) readlinkat(r3, &(0x7f0000000040)='./config/usb_gadget/g1/configs/c.1/uvc.usb0\x00', 0x0, 0x0) symlinkat(&(0x7f0000000e00)='./config/usb_gadget/g1/functions/uvc.usb0/control/header/h\x00', 0xffffffffffffff9c, &(0x7f0000000f00)='./config/usb_gadget/g1/functions/uvc.usb0/control/class/fs/h\x00') symlinkat(0x0, 0xffffffffffffffff, 0x0) r4 = openat(0xffffffffffffff9c, &(0x7f0000002000)='./config/usb_gadget/g1/UDC\x00', 0x1, 0x0) write(r4, &(0x7f0000002100)='usbip-vudc.0', 0xc) r5 = socket$netlink(0x10, 0x3, 0x0) stat(&(0x7f00000001c0)='./config\x00', &(0x7f0000000200)) r6 = bpf$BPF_BTF_LOAD(0x12, &(0x7f0000000140)={&(0x7f0000000100)={{0xeb9f, 0x1, 0x0, 0x18, 0x0, 0x20, 0x20, 0x4, [@func={0x2, 0x0, 0x0, 0xc, 0x2}, @func_proto={0x0, 0x1, 0x0, 0xd, 0x0, [{}]}]}, {0x0, [0x0, 0x5f]}}, 0x0, 0x3c}, 0x28) bpf$PROG_LOAD_XDP(0x5, &(0x7f00000002c0)={0x6, 0x3, &(0x7f0000000000)=@framed={{0x18, 0x0, 0x0, 0x0, 0x7, 0x0, 0x0, 0x0, 0xc0}}, &(0x7f0000000080)='GPL\x00', 0xf, 0x0, 0x0, 0x40f00, 0x4, '\x00', 0x0, 0x25, r6, 0x8, &(0x7f0000000180)={0x0, 0x1}, 0x1, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0x4}, 0x94) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000040)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$sock_SIOCGIFINDEX(r7, 0x8933, &(0x7f0000000080)={'macsec0\x00', 0x0}) r9 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$inet6_buf(r9, 0x29, 0x20, &(0x7f00000000c0)="0bbb268dd6ffa80800000000000000000000210d0000aaa8fa017242ba9380d4", 0x20) sendmsg$nl_route(r5, &(0x7f00000000c0)={0x0, 0x0, &(0x7f00000002c0)={&(0x7f0000000000)=ANY=[@ANYBLOB="280000001d000100000000010000000007000000", @ANYRES32=r8, @ANYRESDEC=r5], 0x28}, 0x1, 0x0, 0x0, 0x4041}, 0x0) executing program 0: mkdirat(0xffffffffffffff9c, &(0x7f00000000c0)='./file0\x00', 0x10) mkdirat(0xffffffffffffff9c, &(0x7f00000000c0)='./bus\x00', 0x1c5) mount$overlay(0x0, &(0x7f0000000100)='./file0\x00', &(0x7f0000000040), 0x8, &(0x7f0000000240)={[{@upperdir={'upperdir', 0x3d, './file0'}}, {@workdir={'workdir', 0x3d, './bus'}}, {@lowerdir={'lowerdir', 0x3d, '.'}}]}) socket$xdp(0x2c, 0x3, 0x0) r0 = socket$kcm(0x2c, 0x3, 0x0) close(r0) r1 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPCTNL_MSG_CT_GET(r1, &(0x7f0000000200)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000300)=ANY=[@ANYBLOB="ac0000000001050500000000000000000a0000003c0002802c00018014000300ff01000000000000000000000000000114000400ff0200000000000000000000000000010c00028005000100000000003c0001800c00028005000100000000002c00018014000300ff0200000000000000000000000000811400040000000000000000000001ffffac1e00010800074000000001180006801400040000000000000000000000000000000001"], 0xac}}, 0x0) sendmsg$IPCTNL_MSG_EXP_GET(r1, &(0x7f0000006680)={0x0, 0x0, &(0x7f0000006640)={&(0x7f00000065c0)=ANY=[@ANYBLOB="500000000102010100000000000000000a0000003c0001802c00018014000300ff01000000000000000000000000000114000400000000000000000000000000000000010c0002580500010000000000"], 0x50}, 0x1, 0x0, 0x0, 0x800}, 0x0) chdir(&(0x7f0000000000)='./file0\x00') mknod$loop(&(0x7f0000000000)='./file0aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa\x00', 0x2000, 0x1) executing program 4: setsockopt$inet_mreqsrc(0xffffffffffffffff, 0x0, 0x27, &(0x7f0000000280)={@multicast2, @local, @remote}, 0xc) r0 = socket(0x1, 0x803, 0x0) r1 = socket$nl_route(0x10, 0x3, 0x0) getsockname$packet(r0, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f00000002c0)=0x14) sendmsg$nl_route(r1, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000340)=ANY=[@ANYBLOB="540000001000010400"/20, @ANYRES32=0x0, @ANYBLOB="00000000000000002c0012800e0001006970366772657461700000001800028014000700ff01000000000000000000000000000108000a00", @ANYRES32=r2], 0x54}}, 0x0) setsockopt$inet_IP_XFRM_POLICY(0xffffffffffffffff, 0x0, 0x11, &(0x7f00000005c0)={{{@in6=@local, @in=@broadcast, 0x4e23, 0x6, 0x4e24, 0x0, 0x0, 0x0, 0x80, 0x8, r2, 0xee01}, {0x8, 0x8, 0x791a, 0x69, 0xf07a, 0x7, 0xbf9, 0x2}, {0x0, 0x40, 0x0, 0x3}, 0x4f55945f, 0x6e6bc0, 0x0, 0x1}, {{@in6=@ipv4={'\x00', '\xff\xff', @rand_addr=0x64010100}, 0x4d2, 0xff}, 0xa, @in6=@ipv4={'\x00', '\xff\xff', @local}, 0x3507, 0x0, 0x0, 0x0, 0x9, 0x10001, 0x9bde}}, 0xe8) r3 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) r4 = ioctl$KVM_CREATE_VM(r3, 0xae01, 0x2a) ioctl$KVM_SET_USER_MEMORY_REGION(r4, 0x4020ae46, &(0x7f0000000100)={0x4, 0x1, 0xffff1000, 0x1000, &(0x7f0000012000/0x1000)=nil}) r5 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000240), 0x0, 0x0) r6 = ioctl$KVM_CREATE_VM(r5, 0xae01, 0x0) ioctl$SG_IO(0xffffffffffffffff, 0x2285, &(0x7f0000000400)={0x53, 0xfffffffffffffffb, 0x5, 0x8, @buffer={0x0, 0x0, 0x0}, &(0x7f0000000200)="0004000019", 0x0, 0x0, 0x10011, 0xfffbffff, 0x0}) r7 = ioctl$KVM_CREATE_VCPU(r6, 0xae41, 0x0) ioctl$KVM_SET_USER_MEMORY_REGION(r6, 0x4020ae46, &(0x7f0000000180)={0x0, 0x0, 0x0, 0x2000, &(0x7f0000000000/0x2000)=nil}) ioctl$KVM_SET_REGS(r7, 0x4090ae82, &(0x7f0000000000)={[0x35, 0xfff, 0xfffffffffffffffe, 0x40000000000180, 0x2, 0x7, 0xf2, 0xd, 0x7fffffffffffe, 0x7, 0x5, 0xb, 0x7, 0xfffffffffffffff8, 0x9, 0xc], 0x25000, 0x304}) r8 = syz_ublk_setup_io_uring(0x20, &(0x7f0000000340)={0x0, 0x0, 0x100, 0x2, 0x1e5}, &(0x7f0000000000)=0x0, &(0x7f0000000040)=0x0, &(0x7f0000000980)=0x0) syz_io_uring_submit(r9, r10, r11, &(0x7f00000004c0)=@IORING_OP_RENAMEAT={0x23, 0xe, 0x0, 0xffffffffffffffff, &(0x7f0000000540)='./file0\x00', &(0x7f0000000580)='./file0\x00'}) unshare(0x22060600) syz_ublk_add_dev(r8, r9, r10, r11, &(0x7f00000000c0)={0x2e, 0x9, 0x0, r8, 0xc0207504, 0x0, 0x0, 0x0, 0x0, 0x800, 0x0, 0x0, '\x00', {0xffffffff, 0xffff, 0x40, &(0x7f0000000080)=@any_dev={0x1, 0xe8d, 0x0, 0x0, 0x1000, 0x1}}}, &(0x7f0000000180)) ioctl$KVM_RUN(r7, 0xae80, 0x0) r12 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$nl_generic(r12, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000140)={&(0x7f00000004c0)=ANY=[@ANYBLOB="18000000260001031dbd7002fadbdf25010000000400ae"], 0x18}}, 0x0) recvmmsg(r12, &(0x7f0000000800)=[{{0x0, 0x0, &(0x7f00000009c0)=[{&(0x7f0000000500)=""/140, 0x8c}, {&(0x7f0000000a40)=""/4148, 0xdf0}, {&(0x7f0000000040)=""/184, 0xb8}, {&(0x7f0000003800)=""/4104, 0x1008}, {&(0x7f0000000280)=""/65, 0x41}, {&(0x7f0000000200)=""/36, 0x24}], 0x6}, 0xd}, {{0x0, 0x0, 0x0}, 0x8}, {{0x0, 0x0, 0x0}, 0x38000000}, {{0x0, 0x0, 0x0}}], 0x4, 0x40000102, 0x0) r13 = ioctl$KVM_CREATE_VM(r3, 0xae01, 0x0) r14 = dup(r13) ioctl$KVM_SET_USER_MEMORY_REGION(r13, 0x4020ae46, &(0x7f0000000840)={0x1fe, 0x2, 0x3000, 0x2000, &(0x7f0000003000/0x2000)=nil}) r15 = ioctl$KVM_CREATE_VCPU(r14, 0xae41, 0x2001) syz_kvm_setup_cpu$x86(0xffffffffffffffff, r15, &(0x7f0000000000/0x18000)=nil, &(0x7f0000000040)=[@text32={0x20, 0x0}], 0x1, 0x11, 0x0, 0x0) syz_kvm_setup_cpu$x86(r13, 0xffffffffffffffff, &(0x7f0000000000/0x18000)=nil, &(0x7f0000000200)=[@text32={0x20, 0x0}], 0x1, 0x50, 0x0, 0x0) ioctl$KVM_RUN(r15, 0xae80, 0x0) executing program 3: r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000300), 0x900, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) ioctl$KVM_SET_USER_MEMORY_REGION(r1, 0x4020ae46, &(0x7f0000000400)={0x0, 0x0, 0x0, 0x20002000, &(0x7f0000000000/0x2000)=nil}) r2 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0) syz_kvm_setup_cpu$x86(0xffffffffffffffff, r2, &(0x7f0000000000/0x18000)=nil, &(0x7f0000000140)=[@text64={0x40, 0x0}], 0x1, 0xe8, 0x0, 0x0) sendmsg$kcm(0xffffffffffffffff, &(0x7f0000000000)={0x0, 0x0, 0x0}, 0x0) ioctl$KVM_RUN(r2, 0xae80, 0x0) (fail_nth: 14) executing program 0: sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000280)={&(0x7f0000000600)=@deltfilter={0x24, 0x2d, 0x300, 0x70bd2d, 0x25dfdbfd, {0x0, 0x0, 0x0, 0x0, {0x2, 0x2}, {0x9, 0xe}, {0x8, 0xffe0}}}, 0x24}}, 0x10) r0 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r0, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000240)=ANY=[@ANYBLOB="140000001000010000000000000000000500000a28000000000a030000000000000000000a00000708000240000000020900010073797a31000000002c000000030a010100000000000000000a0000070900010073797a31000000000900030073797a320000000014000000110001"], 0x7c}, 0x1, 0x0, 0x0, 0x4000}, 0x0) sendmsg$NFT_BATCH(r0, &(0x7f0000009b40)={0x0, 0x0, &(0x7f0000009b00)={&(0x7f0000000100)={{0x14, 0x10, 0x1, 0x0, 0x0, {0x5}}, [@NFT_MSG_NEWRULE={0x44, 0x6, 0xa, 0x401, 0x0, 0x0, {0xa, 0x0, 0x7}, [@NFTA_RULE_TABLE={0x9, 0x1, 'syz1\x00'}, @NFTA_RULE_EXPRESSIONS={0x18, 0x4, 0x0, 0x1, [{0x14, 0x1, 0x0, 0x1, @xfrm={{0x9}, @val={0x4}}}]}, @NFTA_RULE_CHAIN={0x9, 0x2, 'syz2\x00'}]}], {0x14, 0x11, 0x1, 0x0, 0x0, {0x1}}}, 0x6c}, 0x1, 0x0, 0x0, 0x204c054}, 0x20040040) r1 = socket$rds(0x15, 0x5, 0x0) bind$rds(r1, &(0x7f0000000840)={0x2, 0x0, @loopback}, 0x10) r2 = ioctl$KVM_CREATE_VM(0xffffffffffffffff, 0xae01, 0x36) ioctl$KVM_CREATE_VCPU(r2, 0xae41, 0x2) r3 = syz_open_dev$sndpcmc(&(0x7f0000000000), 0xb, 0x0) ioctl$SNDRV_PCM_IOCTL_HW_REFINE(r3, 0xc2604110, &(0x7f0000000040)={0x0, [[0x9ef8, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7fffffff], [0x10000, 0x0, 0x0, 0x0, 0x8001], [0x6, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0xffffffff]], '\x00', [{}, {0xfffffffd}, {}, {0x0, 0x0, 0x0, 0x1, 0x1}, {0x5, 0x0, 0x0, 0x1, 0x1}, {0x7fff, 0xfffffffa}, {}, {0x7fffffc, 0x8f96}, {}, {}, {0x0, 0xffffffff}, {0x8000}], '\x00', 0x7fffffff}) sendmsg$rds(r1, &(0x7f0000000740)={&(0x7f0000000040)={0x2, 0x4e23, @local}, 0x10, 0x0, 0x0, &(0x7f0000000100)=[@cswp={0x58, 0x114, 0x7, {{0x5, 0x2}, 0x0, 0x0, 0x5eae, 0x0, 0xd, 0x9, 0x2, 0x9}}], 0x58}, 0x0) sendmsg$nl_route(0xffffffffffffffff, &(0x7f0000000300)={0x0, 0x0, &(0x7f0000000080)={0x0, 0x48}, 0x1, 0x0, 0x0, 0x10}, 0x0) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000100)=@newqdisc={0x44, 0x24, 0x108, 0x0, 0x65dfdbfb, {0x0, 0x0, 0x0, 0x0, {0xffff, 0xffe0}, {0xffff, 0x7ff8}, {0xfff2}}, [@qdisc_kind_options=@q_fq_pie={{0xb}, {0x14, 0x8002, [@TCA_FQ_PIE_BYTEMODE={0x8}, @TCA_FQ_PIE_QUANTUM={0x8, 0x7, 0xffffff22}]}}]}, 0x44}, 0x1, 0x0, 0x0, 0x1}, 0x0) mmap(&(0x7f0000ffc000/0x4000)=nil, 0x4000, 0x8, 0x8010, r1, 0x14c66000) sendmsg$nl_route(0xffffffffffffffff, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000100)=ANY=[@ANYBLOB="500000001000010425bbe5ad600027842cf52300", @ANYRES32=0x0, @ANYBLOB="0000000000008000280012800a00010076786c616e00"], 0x50}}, 0x4008840) r4 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFULNL_MSG_CONFIG(r4, &(0x7f0000000400)={&(0x7f0000000440)={0x10, 0x0, 0x0, 0x400}, 0xc, &(0x7f00000003c0)={&(0x7f0000000340)={0x68, 0x1, 0x4, 0x201, 0x0, 0x0, {0x2}, [@NFULA_CFG_FLAGS={0x6, 0x6, 0x1, 0x0, 0x4}, @NFULA_CFG_NLBUFSIZ={0x8, 0x3, 0x1, 0x0, 0x5}, @NFULA_CFG_MODE={0xa, 0x2, {0x85}}, @NFULA_CFG_QTHRESH={0x8, 0x5, 0x1, 0x0, 0x1e8f352f}, @NFULA_CFG_TIMEOUT={0x8, 0x4, 0x1, 0x0, 0x7ff}, @NFULA_CFG_CMD={0x5, 0x1, 0x1}, @NFULA_CFG_QTHRESH={0x8, 0x5, 0x1, 0x0, 0x1}, @NFULA_CFG_MODE={0xa, 0x2, {0x1}}, @NFULA_CFG_MODE={0xa, 0x2, {0x4}}]}, 0x68}, 0x1, 0x0, 0x0, 0x4040000}, 0x10) mount$tmpfs(0x0, &(0x7f00000000c0)='./file0\x00', &(0x7f00000001c0), 0x10810, &(0x7f0000000200)={[{@usrquota_block_hardlimit={'usrquota_block_hardlimit', 0x3d, [0x25, 0x6d]}}], [{@rootcontext={'rootcontext', 0x3d, 'user_u'}}, {@subj_user={'subj_user', 0x3d, '@!@'}}]}) r5 = syz_io_uring_complete(0x0, 0x0) ioctl$sock_inet6_tcp_SIOCOUTQ(r5, 0x5411, &(0x7f0000000480)) r6 = socket$netlink(0x10, 0x3, 0x0) sendmmsg(r6, &(0x7f00000002c0), 0x40000000000009f, 0x0) executing program 4: r0 = openat$iommufd(0xffffffffffffff9c, &(0x7f0000000180), 0x0, 0x0) ioctl$IOMMU_IOAS_ALLOC(r0, 0x3b81, &(0x7f0000000100)={0xc, 0x0, 0x0}) ioctl$IOMMU_TEST_OP_MOCK_DOMAIN_FLAGS(r0, 0x3ba0, &(0x7f0000000240)={0x48, 0x2, r1, 0x0, 0x0, 0x0, 0x0, 0x1}) ioctl$IOMMU_IOAS_MAP$PAGES(r0, 0x3b85, &(0x7f00000007c0)={0x28, 0x5, r1, 0x0, &(0x7f00002ce000/0x1000)=nil, 0x1000, 0x1020800}) r2 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) keyctl$set_reqkey_keyring(0x5, 0xfffffffe) request_key(&(0x7f0000000480)='cifs.spnego\x00', &(0x7f00000004c0)={'syz', 0x3}, &(0x7f0000000500)='key_or_keyring:', 0x0) ioctl$IOMMU_VFIO_IOAS$GET(r0, 0x3b88, &(0x7f0000000140)={0xc, 0x0}) ioctl$IOMMU_TEST_OP_MOCK_DOMAIN_FLAGS(r0, 0x3ba0, &(0x7f00000001c0)={0x48, 0x2, r3, 0x0, 0x0, 0x0, 0x0, 0x1}) bind$bt_hci(r2, &(0x7f0000000000)={0x1f, 0xffff}, 0x4) setsockopt$packet_fanout_data(0xffffffffffffffff, 0x107, 0x16, &(0x7f0000000100)={0x1, &(0x7f0000000180)=[{0x1, 0x1}]}, 0x10) write$binfmt_misc(r2, &(0x7f0000000100), 0x6) r4 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) bind$bt_hci(r4, &(0x7f0000000080)={0x1f, 0xffffffffffffffff, 0x3}, 0x6) write(r4, &(0x7f0000000000)="2e000000010002", 0x404) r5 = socket$nl_route(0x10, 0x3, 0x0) r6 = inotify_init1(0x800) inotify_add_watch(r6, 0x0, 0xc0000484) r7 = seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0x0, &(0x7f0000000000)={0x1, &(0x7f0000000100)=[{0x6, 0x72, 0x0, 0x7fff0000}]}) close_range(r7, 0xffffffffffffffff, 0x0) ioctl$sock_SIOCETHTOOL(r5, 0x8946, &(0x7f0000000000)={'gretap0\x00', &(0x7f0000000080)=@ethtool_ts_info={0x3a}}) r8 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPSET_CMD_CREATE(r8, &(0x7f0000001780)={0x0, 0x0, &(0x7f0000000600)={&(0x7f0000001840)=ANY=[@ANYBLOB="540000000206010200000000000000000000000105000100070000000900020073797a30000000000c0007800500150001000000050004000000000010000300666173683a69702c6d616300050005000a000000"], 0x54}, 0x1, 0x0, 0x0, 0xc040}, 0x0) bpf$MAP_CREATE(0x0, &(0x7f0000000640)=ANY=[@ANYBLOB="160000000000000004000000ff"], 0x48) r9 = syz_open_procfs(0xffffffffffffffff, &(0x7f00000042c0)='fdinfo/3\x00') read$FUSE(r9, &(0x7f0000000080)={0x2020}, 0x2020) msgctl$MSG_INFO(0x0, 0xc, &(0x7f0000000000)=""/194) executing program 3: ptrace(0x10, 0x0) ptrace$setregs(0xd, 0x0, 0x0, &(0x7f00000003c0)="18607651149d7b10b4024fbbdc08899b8f589df2dbb5d7a8d1b36cfab675cb3976ee8100e2878c9cfa178cac130eb046eda93df39ed4b41924dc225ad4028dd63defb87d698be5c749450b350a789dcfc6b2d6a696b5026d1e52f19274566d1da0f353dd65e330ebf71c5e823f2753c5fd76724828ef31b353e71805205c3dceb44c") ptrace$getregset(0x4205, 0x0, 0x2, 0x0) ptrace$getregset(0x4204, 0x0, 0x2, 0x0) r0 = socket$inet_smc(0x2b, 0x1, 0x0) syz_emit_ethernet(0x1e, &(0x7f0000000480)={@link_local={0x1, 0x80, 0xc2, 0x0, 0x0, 0xe}, @remote, @void, {@can={0xc, {{0x2, 0x1, 0x1, 0x1}, 0x1, 0x7, 0x0, 0x0, "071e000046325f04"}}}}, 0x0) listen(r0, 0x5) ioctl$sock_SIOCOUTQNSD(r0, 0x8905, 0x0) r1 = syz_clone(0x0, 0x0, 0x0, 0x0, 0x0, 0x0) process_vm_writev(r1, &(0x7f0000001c80)=[{&(0x7f0000001bc0)=""/156, 0x9c}], 0x53, &(0x7f0000001d80)=[{&(0x7f0000001cc0)=""/109, 0x20001c34}], 0x1, 0x0) ptrace$ARCH_ENABLE_TAGGED_ADDR(0x1e, r1, 0x5, 0x4002) mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./sys\x00', 0x1ff) mount(0x0, &(0x7f0000000000)='./sys\x00', &(0x7f0000000100)='sysfs\x00', 0x10000, 0x0) openat(0xffffffffffffff9c, &(0x7f0000000280)='./sys/bus/usb/drivers/usbip-host/match_busid\x00', 0x1, 0x0) executing program 0: mkdirat(0xffffffffffffff9c, &(0x7f0000000340)='./file1\x00', 0x0) mount(0x0, &(0x7f0000000200)='./file1\x00', &(0x7f0000000000)='tmpfs\x00', 0x8, &(0x7f0000000300)='usrquota') chdir(&(0x7f00000000c0)='./file1\x00') r0 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000040)='net_prio.prioidx\x00', 0x275a, 0x0) quotactl_fd$Q_SETQUOTA(r0, 0xffffffff80000800, 0x0, &(0x7f0000000f80)={0x8000000000000000, 0x4, 0x100000001, 0x3, 0x24, 0xffffffffffffffff, 0x3, 0x4, 0x100fff}) socket(0x23, 0x2, 0x0) r1 = socket$can_raw(0x1d, 0x3, 0x1) setsockopt$CAN_RAW_ERR_FILTER(r1, 0x65, 0x2, &(0x7f0000000140)=0x9, 0x4) mkdir(&(0x7f0000000400)='./file0\x00', 0x114) mkdir(&(0x7f0000000440)='./file1\x00', 0x0) syz_emit_ethernet(0x6e, &(0x7f0000000300)={@local, @empty, @void, {@ipv6={0x86dd, @icmpv6={0x0, 0x6, '\x00', 0x38, 0x3a, 0xff, @remote, @local, {[], @pkt_toobig={0x2, 0x0, 0x0, 0x500, {0x0, 0x6, '\x00', 0x0, 0x6c, 0x40, @local, @remote, [], "3b00123400000000"}}}}}}}, 0x0) mkdir(&(0x7f0000000300)='./bus\x00', 0x0) mount$overlay(0x0, &(0x7f00000000c0)='./bus\x00', &(0x7f0000000080), 0x0, &(0x7f0000000400)={[{@upperdir={'upperdir', 0x3d, './file1'}}, {@lowerdir={'lowerdir', 0x3d, './file0'}}, {@workdir={'workdir', 0x3d, './bus'}}]}) creat(&(0x7f0000000080)='./file0/file1\x00', 0x90) chdir(&(0x7f0000000000)='./bus\x00') chown(&(0x7f00000001c0)='./file1\x00', 0x0, 0x0) executing program 4: r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000080), 0x0, 0x0) r2 = ioctl$KVM_CREATE_VM(r1, 0xae01, 0x0) ioctl$KVM_CREATE_IRQCHIP(r2, 0xae60) ioctl$KVM_CAP_X86_DISABLE_EXITS(r2, 0x4068aea3, &(0x7f0000000240)={0x8f, 0x0, 0x2}) r3 = ioctl$KVM_CREATE_VCPU(r2, 0xae41, 0x0) syz_kvm_setup_cpu$x86(r2, 0xffffffffffffffff, &(0x7f0000fe8000/0x18000)=nil, &(0x7f00000001c0)=[@text16={0x10, 0x0}], 0x1, 0x4, 0x0, 0x0) syz_kvm_setup_cpu$x86(0xffffffffffffffff, r3, &(0x7f0000c4a000/0x18000)=nil, &(0x7f0000000040)=[@text64={0x40, 0x0}], 0x1, 0x53, 0x0, 0x0) r4 = userfaultfd(0x801) ioctl$UFFDIO_API(r4, 0xc018aa3f, &(0x7f00000020c0)={0xaa, 0xbd}) ioctl$UFFDIO_REGISTER(r4, 0xc020aa00, &(0x7f0000000140)={{&(0x7f0000400000/0xc00000)=nil, 0xc00000}, 0x3}) ioctl$KVM_RUN(r3, 0xae80, 0x0) mq_unlink(&(0x7f0000000340)='/th0\x00') r5 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000000), r0) sendmsg$NL80211_CMD_FRAME(r0, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000fc0)={&(0x7f0000000600)=ANY=[@ANYBLOB='@\x00\x00\x00', @ANYRES16=r5, @ANYBLOB="010000000000000000000200000008000300", @ANYRES32, @ANYBLOB="0c0099"], 0x40}, 0x1, 0x0, 0x0, 0x8000}, 0x0) executing program 3: r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000240), 0xffffffffffffffff) sendmsg$NL80211_CMD_FRAME(r0, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000fc0)={&(0x7f0000000600)=ANY=[@ANYBLOB='@\x00\x00\x00', @ANYRES16=r1, @ANYBLOB="010000000000000000000200000008000300", @ANYRES32, @ANYBLOB="0c0099"], 0x40}, 0x1, 0x0, 0x0, 0x8000}, 0x0) program did not crash replaying the whole log did not cause a kernel crash single: executing 7 programs separately with timeout 1m40s testing program (duration=1m40s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): socket$nl_generic-syz_genetlink_get_family_id$nl80211-sendmsg$NL80211_CMD_FRAME detailed listing: executing program 0: r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000240), 0xffffffffffffffff) sendmsg$NL80211_CMD_FRAME(r0, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000fc0)={&(0x7f0000000600)=ANY=[@ANYBLOB='@\x00\x00\x00', @ANYRES16=r1, @ANYBLOB="010000000000000000000200000008000300", @ANYRES32, @ANYBLOB="0c0099"], 0x40}, 0x1, 0x0, 0x0, 0x8000}, 0x0) program did not crash testing program (duration=1m40s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): socket$nl_generic-openat$kvm-ioctl$KVM_CREATE_VM-ioctl$KVM_CREATE_IRQCHIP-ioctl$KVM_CAP_X86_DISABLE_EXITS-ioctl$KVM_CREATE_VCPU-syz_kvm_setup_cpu$x86-syz_kvm_setup_cpu$x86-userfaultfd-ioctl$UFFDIO_API-ioctl$UFFDIO_REGISTER-ioctl$KVM_RUN-mq_unlink-syz_genetlink_get_family_id$nl80211-sendmsg$NL80211_CMD_FRAME detailed listing: executing program 0: r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000080), 0x0, 0x0) r2 = ioctl$KVM_CREATE_VM(r1, 0xae01, 0x0) ioctl$KVM_CREATE_IRQCHIP(r2, 0xae60) ioctl$KVM_CAP_X86_DISABLE_EXITS(r2, 0x4068aea3, &(0x7f0000000240)={0x8f, 0x0, 0x2}) r3 = ioctl$KVM_CREATE_VCPU(r2, 0xae41, 0x0) syz_kvm_setup_cpu$x86(r2, 0xffffffffffffffff, &(0x7f0000fe8000/0x18000)=nil, &(0x7f00000001c0)=[@text16={0x10, 0x0}], 0x1, 0x4, 0x0, 0x0) syz_kvm_setup_cpu$x86(0xffffffffffffffff, r3, &(0x7f0000c4a000/0x18000)=nil, &(0x7f0000000040)=[@text64={0x40, 0x0}], 0x1, 0x53, 0x0, 0x0) r4 = userfaultfd(0x801) ioctl$UFFDIO_API(r4, 0xc018aa3f, &(0x7f00000020c0)={0xaa, 0xbd}) ioctl$UFFDIO_REGISTER(r4, 0xc020aa00, &(0x7f0000000140)={{&(0x7f0000400000/0xc00000)=nil, 0xc00000}, 0x3}) ioctl$KVM_RUN(r3, 0xae80, 0x0) mq_unlink(&(0x7f0000000340)='/th0\x00') r5 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000000), r0) sendmsg$NL80211_CMD_FRAME(r0, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000fc0)={&(0x7f0000000600)=ANY=[@ANYBLOB='@\x00\x00\x00', @ANYRES16=r5, @ANYBLOB="010000000000000000000200000008000300", @ANYRES32, @ANYBLOB="0c0099"], 0x40}, 0x1, 0x0, 0x0, 0x8000}, 0x0) program did not crash testing program (duration=1m40s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): mkdirat-mount-chdir-openat$cgroup_ro-quotactl_fd$Q_SETQUOTA-socket-socket$can_raw-setsockopt$CAN_RAW_ERR_FILTER-mkdir-mkdir-syz_emit_ethernet-mkdir-mount$overlay-creat-chdir-chown detailed listing: executing program 0: mkdirat(0xffffffffffffff9c, &(0x7f0000000340)='./file1\x00', 0x0) mount(0x0, &(0x7f0000000200)='./file1\x00', &(0x7f0000000000)='tmpfs\x00', 0x8, &(0x7f0000000300)='usrquota') chdir(&(0x7f00000000c0)='./file1\x00') r0 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000040)='net_prio.prioidx\x00', 0x275a, 0x0) quotactl_fd$Q_SETQUOTA(r0, 0xffffffff80000800, 0x0, &(0x7f0000000f80)={0x8000000000000000, 0x4, 0x100000001, 0x3, 0x24, 0xffffffffffffffff, 0x3, 0x4, 0x100fff}) socket(0x23, 0x2, 0x0) r1 = socket$can_raw(0x1d, 0x3, 0x1) setsockopt$CAN_RAW_ERR_FILTER(r1, 0x65, 0x2, &(0x7f0000000140)=0x9, 0x4) mkdir(&(0x7f0000000400)='./file0\x00', 0x114) mkdir(&(0x7f0000000440)='./file1\x00', 0x0) syz_emit_ethernet(0x6e, &(0x7f0000000300)={@local, @empty, @void, {@ipv6={0x86dd, @icmpv6={0x0, 0x6, '\x00', 0x38, 0x3a, 0xff, @remote, @local, {[], @pkt_toobig={0x2, 0x0, 0x0, 0x500, {0x0, 0x6, '\x00', 0x0, 0x6c, 0x40, @local, @remote, [], "3b00123400000000"}}}}}}}, 0x0) mkdir(&(0x7f0000000300)='./bus\x00', 0x0) mount$overlay(0x0, &(0x7f00000000c0)='./bus\x00', &(0x7f0000000080), 0x0, &(0x7f0000000400)={[{@upperdir={'upperdir', 0x3d, './file1'}}, {@lowerdir={'lowerdir', 0x3d, './file0'}}, {@workdir={'workdir', 0x3d, './bus'}}]}) creat(&(0x7f0000000080)='./file0/file1\x00', 0x90) chdir(&(0x7f0000000000)='./bus\x00') chown(&(0x7f00000001c0)='./file1\x00', 0x0, 0x0) program did not crash testing program (duration=1m40s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): openat$kvm-socket$inet_udp-ioctl$sock_ipv6_tunnel_SIOCGETPRL-ioctl$KVM_CREATE_VM-ioctl$KVM_SET_USER_MEMORY_REGION-syz_kvm_setup_cpu$x86-ioctl$KVM_CAP_DIRTY_LOG_RING_ACQ_REL-syz_kvm_add_vcpu$x86-ioctl$KVM_RUN-syz_kvm_setup_cpu$x86 detailed listing: executing program 0: r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000300), 0x900, 0x0) r1 = socket$inet_udp(0x2, 0x2, 0x0) ioctl$sock_ipv6_tunnel_SIOCGETPRL(r1, 0x89f4, &(0x7f0000000040)={'sit0\x00', 0x0}) r2 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) ioctl$KVM_SET_USER_MEMORY_REGION(r2, 0x4020ae46, &(0x7f0000000400)={0x0, 0x0, 0x0, 0x20002000, &(0x7f0000000000/0x2000)=nil}) syz_kvm_setup_cpu$x86(0xffffffffffffffff, 0xffffffffffffffff, &(0x7f0000000000/0x18000)=nil, &(0x7f0000000140)=[@text64={0x40, 0x0}], 0x1, 0xe8, 0x0, 0x0) ioctl$KVM_CAP_DIRTY_LOG_RING_ACQ_REL(r2, 0x4068aea3, &(0x7f00000000c0)={0xdf, 0x0, 0x1000}) syz_kvm_add_vcpu$x86(0x0, &(0x7f0000000980)={0x0, &(0x7f0000000440)=[@nested_load_code={0x12e, 0x79, {0x3, "c4a18172d401c744240022000000c744240281e9d8ffc7442406000000000f011c24c7442400a9000000c7442402f0a6d482ff1c24b964090000b80001c0feba000000000f300f320f01c3420f01f83e430f01cbc4a27d2014e966b85f000f00d0"}}], 0x79}) ioctl$KVM_RUN(0xffffffffffffffff, 0xae80, 0x0) syz_kvm_setup_cpu$x86(r2, 0xffffffffffffffff, &(0x7f0000000000/0x18000)=nil, &(0x7f0000000080)=[@text64={0x40, 0x0}], 0x1, 0x10, 0x0, 0x0) program did not crash testing program (duration=1m40s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): openat$kvm-socket$inet_udp-ioctl$sock_ipv6_tunnel_SIOCGETPRL-ioctl$KVM_CREATE_VM-ioctl$KVM_SET_USER_MEMORY_REGION-syz_kvm_setup_cpu$x86-ioctl$KVM_CAP_DIRTY_LOG_RING_ACQ_REL-syz_kvm_add_vcpu$x86-ioctl$KVM_RUN-syz_kvm_setup_cpu$x86 detailed listing: executing program 0: r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000300), 0x900, 0x0) r1 = socket$inet_udp(0x2, 0x2, 0x0) ioctl$sock_ipv6_tunnel_SIOCGETPRL(r1, 0x89f4, &(0x7f0000000040)={'sit0\x00', 0x0}) r2 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) ioctl$KVM_SET_USER_MEMORY_REGION(r2, 0x4020ae46, &(0x7f0000000400)={0x0, 0x0, 0x0, 0x20002000, &(0x7f0000000000/0x2000)=nil}) syz_kvm_setup_cpu$x86(0xffffffffffffffff, 0xffffffffffffffff, &(0x7f0000000000/0x18000)=nil, &(0x7f0000000140)=[@text64={0x40, 0x0}], 0x1, 0xe8, 0x0, 0x0) ioctl$KVM_CAP_DIRTY_LOG_RING_ACQ_REL(r2, 0x4068aea3, &(0x7f00000000c0)={0xdf, 0x0, 0x1000}) syz_kvm_add_vcpu$x86(0x0, &(0x7f0000000980)={0x0, &(0x7f0000000440)=[@nested_load_code={0x12e, 0x79, {0x3, "c4a18172d401c744240022000000c744240281e9d8ffc7442406000000000f011c24c7442400a9000000c7442402f0a6d482ff1c24b964090000b80001c0feba000000000f300f320f01c3420f01f83e430f01cbc4a27d2014e966b85f000f00d0"}}], 0x79}) ioctl$KVM_RUN(0xffffffffffffffff, 0xae80, 0x0) syz_kvm_setup_cpu$x86(r2, 0xffffffffffffffff, &(0x7f0000000000/0x18000)=nil, &(0x7f0000000080)=[@text64={0x40, 0x0}], 0x1, 0x10, 0x0, 0x0) program did not crash testing program (duration=1m40s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_genetlink_get_family_id$ipvs-socket$nl_route-sendmsg$nl_route-socket$nl_generic-sendmsg$IPVS_CMD_NEW_SERVICE detailed listing: executing program 0: r0 = syz_genetlink_get_family_id$ipvs(&(0x7f0000000040), 0xffffffffffffffff) r1 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r1, 0x0, 0x0) r2 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$IPVS_CMD_NEW_SERVICE(r2, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000080)={0x4c, r0, 0x1, 0x0, 0x0, {}, [@IPVS_CMD_ATTR_SERVICE={0x38, 0x1, 0x0, 0x1, [@IPVS_SVC_ATTR_AF={0x6, 0x1, 0x2}, @IPVS_SVC_ATTR_FWMARK={0x8, 0x5, 0x3}, @IPVS_SVC_ATTR_FLAGS={0xc, 0x7, {0x30000}}, @IPVS_SVC_ATTR_NETMASK={0x8}, @IPVS_SVC_ATTR_TIMEOUT={0x8, 0x8, 0x200}, @IPVS_SVC_ATTR_PE_NAME={0x8, 0x6}]}]}, 0x4c}}, 0x800c800) program did not crash testing program (duration=1m40s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_genetlink_get_family_id$ipvs-socket$nl_route-sendmsg$nl_route-socket$nl_generic-sendmsg$IPVS_CMD_NEW_SERVICE detailed listing: executing program 0: r0 = syz_genetlink_get_family_id$ipvs(&(0x7f0000000040), 0xffffffffffffffff) r1 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r1, 0x0, 0x0) r2 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$IPVS_CMD_NEW_SERVICE(r2, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000080)={0x4c, r0, 0x1, 0x0, 0x0, {}, [@IPVS_CMD_ATTR_SERVICE={0x38, 0x1, 0x0, 0x1, [@IPVS_SVC_ATTR_AF={0x6, 0x1, 0x2}, @IPVS_SVC_ATTR_FWMARK={0x8, 0x5, 0x3}, @IPVS_SVC_ATTR_FLAGS={0xc, 0x7, {0x30000}}, @IPVS_SVC_ATTR_NETMASK={0x8}, @IPVS_SVC_ATTR_TIMEOUT={0x8, 0x8, 0x200}, @IPVS_SVC_ATTR_PE_NAME={0x8, 0x6}]}]}, 0x4c}}, 0x800c800) program did not crash single: failed to extract reproducer bisect: bisecting 32 programs with base timeout 1m40s testing program (duration=1m48s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): [4, 30, 30, 30, 16, 5, 5, 16, 9, 10, 16, 5, 10, 10, 12, 5, 28, 3, 12, 2, 18, 30, 30, 11, 30, 7, 22, 27, 14, 16, 15, 3] detailed listing: executing program 2: writev(0xffffffffffffffff, &(0x7f00000003c0)=[{&(0x7f0000000180)="390000001300034700bb65e1c3e4ffff01000000010000005600000025000000190004000400000007fd17e5ffff080004", 0x31}], 0x1) r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$ethtool(&(0x7f0000000300), 0xffffffffffffffff) sendmsg$ETHTOOL_MSG_TSINFO_GET(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000180)=ANY=[@ANYBLOB='4\x00\x00\x00', @ANYRES16=r1, @ANYBLOB="010000000000000000001d00000020000180140002006e657464657673696d30000000000000080003"], 0x34}}, 0x44800) (fail_nth: 11) executing program 2: mkdirat(0xffffffffffffff9c, 0x0, 0x1ff) (async) openat$binderfs(0xffffffffffffff9c, &(0x7f0000000300)='./binderfs/binder0\x00', 0x0, 0x0) (async) openat$binderfs(0xffffffffffffff9c, &(0x7f0000000200)='./binderfs/binder0\x00', 0x0, 0x0) (async, rerun: 64) r0 = socket(0x11, 0x2, 0x10001) (rerun: 64) mmap$IORING_OFF_SQ_RING(0x0, 0xc, 0x2000002, 0x401d031, 0xffffffffffffffff, 0x0) (async) mkdirat(0xffffffffffffff9c, &(0x7f0000001500)='./dev\x00', 0x1ff) (async) r1 = syz_open_dev$tty1(0xc, 0x4, 0x1) ioctl$KDSKBENT(r1, 0x4b47, &(0x7f0000000080)={0x0, 0x7d, 0x20f}) mount(0x0, &(0x7f0000001500)='./dev\x00', &(0x7f0000001600)='ceph\x00', 0x800000, 0x0) (async) mkdirat(0xffffffffffffffff, &(0x7f00000002c0)='./dev\x00', 0x17f) socket$nl_generic(0x10, 0x3, 0x10) socket$inet(0x2, 0x2, 0x1) (async) socket$packet(0x11, 0x3, 0x300) socketpair$unix(0x1, 0x2, 0x0, 0x0) (async) mount(&(0x7f00000000c0)=@filename='./dev/sda1\x00', &(0x7f0000000140)='./mnt\x00', &(0x7f0000000100)='ext4\x00', 0x8410, 0x0) (async) mprotect(&(0x7f0000000000/0xf000)=nil, 0xf000, 0x1) r2 = openat$tun(0xffffffffffffff9c, &(0x7f0000000140), 0x0, 0x0) ioctl$TUNSETIFF(r2, 0x40e8662e, 0x0) (async, rerun: 64) r3 = socket$kcm(0x10, 0x2, 0x0) (rerun: 64) sendmsg$kcm(r3, &(0x7f00000003c0)={0x0, 0x0, &(0x7f0000000040)=[{&(0x7f0000000740)="2e00000010008188e6b62aa73f72cc9f0ba1f8481a0000005e140602000000000e000a00100000000a8000001294", 0x2e}], 0x1}, 0x0) (async) r4 = syz_ublk_setup_io_uring(0x1d, &(0x7f0000000040)={0x0, 0x0, 0x0, 0x0, 0x158}, &(0x7f0000000100)=0x0, &(0x7f0000000280)=0x0, &(0x7f0000001540)=0x0) (async) ioctl$sock_FIOGETOWN(0xffffffffffffffff, 0x8903, &(0x7f0000000000)=0x0) syz_ublk_add_dev(r4, r5, r6, r7, &(0x7f0000000140)={0x2e, 0x2, 0x0, 0xffffffffffffffff, 0xc0207504, 0x0, 0x0, 0x0, 0x1, 0x200, 0x0, 0x0, '\x00', {0xffffffff, 0xffff, 0x40, &(0x7f00000000c0)=@new_dev={0x4, 0x15, 0x0, 0x0, 0x1000, 0xffffffff, r8, 0x0, 0x31}}}, &(0x7f00000001c0)) syz_ublk_add_dev(r4, r5, r6, r7, &(0x7f0000000200)={0x2e, 0x0, 0x0, r9, 0xc0207504, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', {0xffffffff, 0xffff, 0x40, &(0x7f0000000440)=@any_dev={0x2, 0xe92, 0x0, 0x0, 0x1000, 0x10000, r8, 0x0, 0x1c8}}}, &(0x7f0000000300)=0x0) (async) syz_usb_control_io$lan78xx(0xffffffffffffffff, 0x0, &(0x7f0000000540)={0x34, 0x0, 0x0, &(0x7f0000000440)={0x0, 0x8, 0x1, 0x6}, 0x0, 0x0, 0x0}) (async) r11 = openat(0xffffffffffffff9c, &(0x7f000000c380)='./file0\x00', 0x20842, 0x63) syz_ublk_setup_queues(r11, r10, &(0x7f0000000340)={0x0, 0x0, 0x10, 0x1, 0x257}, &(0x7f0000000580)=[{0x0, 0x0, 0xffffffffffffffff, {0x0, 0xbb8b, 0x20, 0x1000000, 0x4}}, {0x0, 0x0, 0xffffffffffffffff, {0x0, 0x0, 0x800, 0x0, 0x22a}}, {0x0, 0x0, 0xffffffffffffffff, {0x0, 0x1f6d, 0x8c, 0x1, 0x0, 0x0, r0}}, {0x0, 0x0, 0xffffffffffffffff, {0x0, 0xb4ac, 0x4000, 0x0, 0x9d7c}}], 0x1, &(0x7f00000014c0)={0x2e, 0x0, 0x0, 0xffffffffffffffff, 0xc0107520, 0x0, 0x0, 0x0, 0x0, {}, 0x0, 0x0, '\x00', {0x1, 0x5, 0x0, 0x0}}, 0x0) (async) madvise(&(0x7f0000bdc000/0x4000)=nil, 0x86ac726dff2f4713, 0xa) syz_usb_disconnect(0xffffffffffffffff) syz_open_dev$ndb(&(0x7f0000000280), 0x0, 0x61c7c039d0921a4e) executing program 2: r0 = socket$nl_route(0x10, 0x3, 0x0) r1 = socket(0x10, 0x803, 0x0) sendmsg$nl_route(r1, &(0x7f00000006c0)={0x0, 0x0, &(0x7f0000000680)={0x0, 0x18}}, 0x0) getsockname$packet(r1, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) sendmsg$nl_route(r0, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000000)={&(0x7f00000002c0)=ANY=[@ANYBLOB="5000000010008105e9c51c000000000000000000", @ANYRES32=r2, @ANYRES64=r0], 0x50}, 0x1, 0x0, 0x0, 0x80}, 0x0) sendmsg$nl_route(0xffffffffffffffff, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000700)=@newlink={0x40, 0x10, 0x1, 0x1, 0x25dfdbff, {0x0, 0x0, 0x0, r2, 0x0, 0x8}, [@IFLA_LINKINFO={0x20, 0x12, 0x0, 0x1, @vlan={{0x9}, {0x10, 0x2, 0x0, 0x1, [@IFLA_VLAN_FLAGS={0xc, 0x2, {0x12, 0x1f}}]}}}]}, 0x40}, 0x1, 0x0, 0x0, 0x11}, 0x0) ioctl$sock_inet6_SIOCADDRT(0xffffffffffffffff, 0x890b, &(0x7f0000000380)={@local, @empty, @initdev={0xfe, 0x88, '\x00', 0x1, 0x0}, 0x3, 0x6, 0x5, 0x200, 0x4, 0x100020, r2}) mkdirat(0xffffffffffffff9c, &(0x7f0000000400)='./config\x00', 0x1ed) socket$nl_xfrm(0x10, 0x3, 0x6) mount(0x0, &(0x7f0000000500)='./config\x00', &(0x7f0000000600)='configfs\x00', 0x0, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000700)='./config/usb_gadget/g1\x00', 0x1ed) mkdirat(0xffffffffffffff9c, &(0x7f0000000c00)='./config/usb_gadget/g1/UDC\x00', 0x1c4) bpf$PROG_LOAD(0x5, 0x0, 0x0) socket(0x3d, 0x80000, 0x5) mkdirat(0xffffffffffffff9c, &(0x7f0000000d00)='./config/usb_gadget/g1/functions/uvc.usb0/control/header/h\x00', 0x1ed) r3 = openat$dir(0xffffffffffffff9c, 0x0, 0x400007, 0x2) readlinkat(r3, &(0x7f0000000040)='./config/usb_gadget/g1/configs/c.1/uvc.usb0\x00', 0x0, 0x0) symlinkat(&(0x7f0000000e00)='./config/usb_gadget/g1/functions/uvc.usb0/control/header/h\x00', 0xffffffffffffff9c, &(0x7f0000000f00)='./config/usb_gadget/g1/functions/uvc.usb0/control/class/fs/h\x00') symlinkat(0x0, 0xffffffffffffffff, 0x0) r4 = openat(0xffffffffffffff9c, &(0x7f0000002000)='./config/usb_gadget/g1/UDC\x00', 0x1, 0x0) write(r4, &(0x7f0000002100)='usbip-vudc.0', 0xc) r5 = socket$netlink(0x10, 0x3, 0x0) stat(&(0x7f00000001c0)='./config\x00', &(0x7f0000000200)) r6 = bpf$BPF_BTF_LOAD(0x12, &(0x7f0000000140)={&(0x7f0000000100)={{0xeb9f, 0x1, 0x0, 0x18, 0x0, 0x20, 0x20, 0x4, [@func={0x2, 0x0, 0x0, 0xc, 0x2}, @func_proto={0x0, 0x1, 0x0, 0xd, 0x0, [{}]}]}, {0x0, [0x0, 0x5f]}}, 0x0, 0x3c}, 0x28) bpf$PROG_LOAD_XDP(0x5, &(0x7f00000002c0)={0x6, 0x3, &(0x7f0000000000)=@framed={{0x18, 0x0, 0x0, 0x0, 0x7, 0x0, 0x0, 0x0, 0xc0}}, &(0x7f0000000080)='GPL\x00', 0xf, 0x0, 0x0, 0x40f00, 0x4, '\x00', 0x0, 0x25, r6, 0x8, &(0x7f0000000180)={0x0, 0x1}, 0x1, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0x4}, 0x94) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000040)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$sock_SIOCGIFINDEX(r7, 0x8933, &(0x7f0000000080)={'macsec0\x00', 0x0}) r9 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$inet6_buf(r9, 0x29, 0x20, &(0x7f00000000c0)="0bbb268dd6ffa80800000000000000000000210d0000aaa8fa017242ba9380d4", 0x20) sendmsg$nl_route(r5, &(0x7f00000000c0)={0x0, 0x0, &(0x7f00000002c0)={&(0x7f0000000000)=ANY=[@ANYBLOB="280000001d000100000000010000000007000000", @ANYRES32=r8, @ANYRESDEC=r5], 0x28}, 0x1, 0x0, 0x0, 0x4041}, 0x0) executing program 2: r0 = openat$ublk_ctrl(0xffffffffffffff9c, &(0x7f0000000000), 0x2, 0x0) r1 = syz_ublk_setup_io_uring(0x20, &(0x7f0000000040)={0x0, 0x5}, &(0x7f00000000c0)=0x0, &(0x7f0000000100)=0x0, &(0x7f0000000140)=0x0) r5 = socket$nl_generic(0x10, 0x3, 0x10) r6 = syz_genetlink_get_family_id$tipc(&(0x7f0000000080), r5) sendmsg$TIPC_CMD_ENABLE_BEARER(r5, &(0x7f0000000180)={0x0, 0x0, &(0x7f00000001c0)={&(0x7f0000000200)={0x38, r6, 0x1, 0x0, 0x25dfdbfe, {{}, {}, {0xfffffffffffffe56, 0x17, {0x17, 0x5, @l2={'eth', 0x3a, 'syzkaller0\x00'}}}}}, 0x38}}, 0x20008004) r7 = syz_ublk_add_dev(r1, r2, r3, r4, &(0x7f0000000200)={0x2e, 0x0, 0x0, r0, 0xc0207504, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', {0xffffffff, 0xffff, 0x40, &(0x7f0000000500)=@new_dev={0x1, 0x104, 0x0, 0x0, 0x1000, 0xffffffff, 0x0, 0x0, 0xc4ddfbc9bba2bdbf}}}, &(0x7f0000000300)=0x0) r10 = openat(0xffffffffffffff9c, &(0x7f00000002c0)='./sys/class/rnbd-client/ctl/map_device/file0\x00', 0x121001, 0x17c) write(r10, &(0x7f00000000c0)="736573736e616d653d7331206465766963655f706174683d2f6465762f72616d3020706174683d69703a3132372e302e302e315cdf903f3a85629410457af1eedc1b5b87feb6d6dff9cddbb5ac1cb03e2c", 0x51) r11 = openat$null(0xffffffffffffff9c, &(0x7f0000003040), 0x490540, 0x0) r12 = openat$selinux_enforce(0xffffffffffffff9c, &(0x7f00000030c0), 0x28041, 0x0) r13 = fsopen(&(0x7f00000001c0)='ramfs\x00', 0x0) mkdir(&(0x7f00000020c0)='./file0\x00', 0x1c8) mount$bind(&(0x7f0000000140)='./file0\x00', &(0x7f0000000000)='./file0/../file0\x00', 0x0, 0x315901c, 0x0) chroot(&(0x7f0000001140)='./file0\x00') mount$bind(&(0x7f0000000040)='.\x00', &(0x7f0000000180)='./file0\x00', 0x0, 0x2a05004, 0x0) pivot_root(&(0x7f00000000c0)='./file0\x00', &(0x7f0000000240)='./file0/../file0\x00') fsconfig$FSCONFIG_CMD_CREATE(r13, 0x6, 0x0, 0x0, 0x0) r14 = fsmount(r13, 0x1, 0x4) fchdir(r14) r15 = socket$inet6_tcp(0xa, 0x1, 0x0) r16 = open(&(0x7f00000000c0)='./file0\x00', 0x108843, 0x9a) fcntl$setlease(r16, 0x400, 0x1) openat(0xffffffffffffff9c, &(0x7f0000000000)='./file0\x00', 0x0, 0x0) fcntl$setlease(r16, 0x400, 0x0) getsockopt$inet6_tcp_int(r15, 0x6, 0x6, 0x0, &(0x7f0000000040)) bpf$PROG_LOAD(0x5, &(0x7f0000003140)={0x17, 0x1e, &(0x7f0000000340)=ANY=[@ANYBLOB="18000000090000000000000000020000064e08000100000018210000", @ANYRES32=r5, @ANYBLOB="000000000900000018210000", @ANYRES32=r5, @ANYBLOB="0000000000002c0018240000", @ANYRES32=0x1, @ANYBLOB="000000000700000018120000", @ANYRES32, @ANYBLOB="0000000000000000b7030000000000b70000000000000018110000", @ANYRES32=r10, @ANYBLOB="0000000000000000b70800000e0000007b8af8ff00000000bfa200000000000007020000f8ffffffb703000008000000b7040000000000008500000082000000186000000000000000000000040000001861000010000000000000001b060000186000000800000000000000000000009500000000000000"], &(0x7f0000000440)='syzkaller\x00', 0xff, 0x1000, &(0x7f0000002040)=""/4096, 0x40f00, 0x4, '\x00', 0x0, @cgroup_sysctl, r11, 0x8, &(0x7f0000003080)={0x8, 0x2}, 0x8, 0x10, 0x0, 0x0, 0x0, r12, 0x0, &(0x7f0000003100)=[r14], 0x0, 0x10, 0x65}, 0x94) r17 = syz_open_dev$ublk_chdev(&(0x7f0000002000), r7, 0x2) r18 = openat$iommufd(0xffffffffffffff9c, &(0x7f0000000080), 0x0, 0x0) ioctl$IOMMU_TEST_OP_MD_CHECK_MAP(r18, 0x3ba0, &(0x7f0000000800)={0x48, 0x12, 0x0, 0x0, 0x1004000, 0x0, 0x0}) syz_ublk_setup_queues(r17, r9, &(0x7f0000000540)={0x0, 0xfa81, 0x0, 0x3, 0x28e, 0x0, r1}, &(0x7f0000000880)=[{0x0, 0x0, 0xffffffffffffffff, {0x0, 0xb8c3, 0x1000, 0x2, 0x1af, 0x0, r1}}, {0x0, 0x0, 0xffffffffffffffff, {0x0, 0xddca, 0x2, 0x0, 0x330, 0x0, r1}}, {0x0, 0x0, 0xffffffffffffffff, {0x0, 0x766c, 0x8, 0x0, 0x2db, 0x0, r1}}, {0x0, 0x0, 0xffffffffffffffff, {0x0, 0x5027, 0x4, 0x0, 0x1fe}}], 0x4, &(0x7f0000001f40)={0x2e, 0x0, 0x0, r17, 0xc0107524, 0x0, 0x0, 0x0, 0x1, {0x10}, 0x0, r8, '\x00', {0x2, 0xb55, 0x0, 0x0}}, &(0x7f0000001fc0)) executing program 2: setsockopt$inet_mreqsrc(0xffffffffffffffff, 0x0, 0x27, &(0x7f0000000280)={@multicast2, @local, @remote}, 0xc) r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) r1 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000240), 0x0, 0x0) r2 = ioctl$KVM_CREATE_VM(r1, 0xae01, 0x0) ioctl$SG_IO(0xffffffffffffffff, 0x2285, &(0x7f0000000400)={0x53, 0xfffffffffffffffb, 0x0, 0x8, @buffer={0x0, 0x0, 0x0}, 0x0, 0x0, 0x0, 0x10011, 0xfffbffff, 0x0}) r3 = ioctl$KVM_CREATE_VCPU(r2, 0xae41, 0x0) ioctl$KVM_SET_USER_MEMORY_REGION(r2, 0x4020ae46, &(0x7f0000000180)={0x0, 0x0, 0x0, 0x2000, &(0x7f0000000000/0x2000)=nil}) ioctl$KVM_SET_REGS(r3, 0x4090ae82, &(0x7f0000000000)={[0x35, 0xfff, 0xfffffffffffffffe, 0x40000000000180, 0x2, 0x7, 0xf2, 0xd, 0x7fffffffffffe, 0x7, 0x5, 0xb, 0x7, 0xfffffffffffffff8, 0x9, 0xc], 0x25000, 0x304}) ioctl$KVM_RUN(r3, 0xae80, 0x0) r4 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) r5 = dup(r4) ioctl$KVM_SET_USER_MEMORY_REGION(r4, 0x4020ae46, &(0x7f0000000840)={0x1fe, 0x2, 0x3000, 0x2000, &(0x7f0000003000/0x2000)=nil}) r6 = ioctl$KVM_CREATE_VCPU(r5, 0xae41, 0x0) syz_kvm_setup_cpu$x86(0xffffffffffffffff, r6, &(0x7f0000000000/0x18000)=nil, &(0x7f0000000040)=[@text32={0x20, 0x0}], 0x1, 0x11, 0x0, 0x0) syz_kvm_setup_cpu$x86(r4, 0xffffffffffffffff, &(0x7f0000000000/0x18000)=nil, &(0x7f0000000200)=[@text32={0x20, 0x0}], 0x1, 0x50, 0x0, 0x0) ioctl$KVM_RUN(r6, 0xae80, 0x0) (fail_nth: 7) executing program 2: r0 = syz_genetlink_get_family_id$ipvs(&(0x7f0000000040), 0xffffffffffffffff) r1 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r1, 0x0, 0x0) r2 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$IPVS_CMD_NEW_SERVICE(r2, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000080)={0x4c, r0, 0x1, 0x0, 0x0, {}, [@IPVS_CMD_ATTR_SERVICE={0x38, 0x1, 0x0, 0x1, [@IPVS_SVC_ATTR_AF={0x6, 0x1, 0x2}, @IPVS_SVC_ATTR_FWMARK={0x8, 0x5, 0x3}, @IPVS_SVC_ATTR_FLAGS={0xc, 0x7, {0x30000}}, @IPVS_SVC_ATTR_NETMASK={0x8}, @IPVS_SVC_ATTR_TIMEOUT={0x8, 0x8, 0x200}, @IPVS_SVC_ATTR_PE_NAME={0x8, 0x6}]}]}, 0x4c}}, 0x800c800) executing program 32: r0 = syz_genetlink_get_family_id$ipvs(&(0x7f0000000040), 0xffffffffffffffff) r1 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r1, 0x0, 0x0) r2 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$IPVS_CMD_NEW_SERVICE(r2, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000080)={0x4c, r0, 0x1, 0x0, 0x0, {}, [@IPVS_CMD_ATTR_SERVICE={0x38, 0x1, 0x0, 0x1, [@IPVS_SVC_ATTR_AF={0x6, 0x1, 0x2}, @IPVS_SVC_ATTR_FWMARK={0x8, 0x5, 0x3}, @IPVS_SVC_ATTR_FLAGS={0xc, 0x7, {0x30000}}, @IPVS_SVC_ATTR_NETMASK={0x8}, @IPVS_SVC_ATTR_TIMEOUT={0x8, 0x8, 0x200}, @IPVS_SVC_ATTR_PE_NAME={0x8, 0x6}]}]}, 0x4c}}, 0x800c800) executing program 1: r0 = ioctl$KVM_CREATE_VM(0xffffffffffffffff, 0xae01, 0x0) syz_open_procfs$namespace(0x0, 0x0) ioctl$KVM_CREATE_PIT2(r0, 0x4040ae77, &(0x7f0000000280)={0x9}) r1 = ioctl$KVM_CREATE_VCPU(r0, 0xae41, 0x0) ioctl$KVM_SET_PIT(r0, 0x8048ae66, 0x0) ioctl$KVM_SET_USER_MEMORY_REGION(r0, 0x4020ae46, &(0x7f0000000180)={0x0, 0x0, 0x0, 0x2000, &(0x7f0000000000/0x2000)=nil}) r2 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r2, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000500)={&(0x7f0000000240)=@newlink={0x38, 0x10, 0x439, 0x70bd2c, 0xffffffea, {0x0, 0x0, 0xe403, 0x0, 0x40083, 0x715cb}, [@IFLA_LINKINFO={0x18, 0x12, 0x0, 0x1, @sit={{0x8}, {0xc, 0x2, 0x0, 0x1, [@IFLA_IPTUN_ENCAP_TYPE={0x6, 0xf, 0x3}]}}}]}, 0x38}, 0x1, 0x0, 0x0, 0x80d1}, 0x4084) ioctl$KVM_SET_REGS(r1, 0x4090ae82, &(0x7f00000003c0)={[0x60000000000, 0xd4, 0x0, 0x61, 0x200002000001, 0x0, 0x2004c8, 0x0, 0x0, 0x36ae, 0x4, 0x7fff, 0x3, 0x400000000], 0x80a0000}) bpf$BPF_BTF_LOAD(0x12, &(0x7f0000000300)={&(0x7f0000000380)=ANY=[@ANYBLOB="9feb010018000000000000000c000000"], 0x0, 0x26}, 0x28) ioctl$KVM_RUN(r1, 0xae80, 0x0) r3 = openat(0xffffffffffffff9c, &(0x7f0000000040)='./cgroup.cpu/memory.limit_in_bytes\x00', 0x2, 0x50) write$sysctl(r3, &(0x7f0000000100)='4\x00', 0x2) socket$kcm(0x10, 0x2, 0x0) socket$nl_route(0x10, 0x3, 0x0) write$RDMA_USER_CM_CMD_CREATE_ID(r3, &(0x7f0000000000)={0x0, 0x18, 0xfa00, {0xfeffffff, 0x0, 0x111}}, 0x20) executing program 1: bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000180)={0x11, 0x3, &(0x7f0000000040)=ANY=[], &(0x7f0000000080)='syzkaller\x00', 0x8, 0x0, 0x0, 0x41000}, 0x94) r0 = bpf$MAP_CREATE(0x0, &(0x7f0000000200)=ANY=[@ANYBLOB="2200000004"], 0x48) r1 = bpf$MAP_CREATE(0x0, &(0x7f0000000200)=ANY=[], 0x48) bpf$BPF_MAP_CONST_STR_FREEZE(0x16, &(0x7f0000000040)={r1, 0xffffffffffffffff}, 0x4) bpf$BPF_MAP_FREEZE(0x16, &(0x7f0000000000)=r1, 0x4) r3 = fcntl$dupfd(r2, 0x0, r0) mknod$loop(&(0x7f0000000140)='./file0\x00', 0xfff, 0x1) landlock_create_ruleset(&(0x7f0000000100)={0x100}, 0x6d, 0x0) bpf$MAP_LOOKUP_ELEM(0x1, &(0x7f0000000580)={r3, 0x0, 0x0}, 0x20) executing program 1: r0 = socket$netlink(0x10, 0x3, 0x0) r1 = socket(0x10, 0x803, 0x0) sendmsg$NL80211_CMD_CRIT_PROTOCOL_START(r1, &(0x7f0000000580)={0x0, 0x0, &(0x7f0000000540)={0x0, 0x1c}}, 0x0) getsockname$packet(r1, &(0x7f00000002c0)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f00000004c0)=0x68) sendmsg$nl_route(r0, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000640)=ANY=[@ANYBLOB="3c0000001000850600000000ff6122314a000800", @ANYRES32=r2, @ANYBLOB="f5ff0f00252155b21c0012000c000100626f6e64000000000c0002000800010001"], 0x3c}}, 0x40000) r3 = socket$netlink(0x10, 0x3, 0x0) r4 = socket(0x10, 0x803, 0x4) sendmsg$IPVS_CMD_SET_INFO(r4, &(0x7f0000000b00)={0x0, 0x0, &(0x7f0000000ac0)={0x0, 0x14}}, 0x0) getsockname$packet(r4, &(0x7f0000000340)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x66) sendmsg$nl_route(r3, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000001440)=@newlink={0x50, 0x10, 0xffffff1f, 0x0, 0x80, {0x0, 0x0, 0x0, 0x0, 0x300, 0x17e05}, [@IFLA_MASTER={0x8, 0xa, r5}, @IFLA_LINKINFO={0x28, 0x12, 0x0, 0x1, @veth={{0x9}, {0x18, 0x2, 0x0, 0x1, @val=@VETH_INFO_PEER={0x14, 0x1, {{0x0, 0x0, 0x20, 0x0, 0x4000, 0x640}}}}}}]}, 0x50}, 0x1, 0x0, 0x0, 0x2000c0c1}, 0x0) executing program 1: mkdirat(0xffffffffffffff9c, 0x0, 0x1ff) ioctl$DRM_IOCTL_GET_CLIENT(0xffffffffffffffff, 0xc0286405, &(0x7f0000000080)={0x9, 0x7, {}, {0xee00}, 0x3, 0x8}) syz_fuse_handle_req(0xffffffffffffffff, 0x0, 0x0, &(0x7f00000000c0)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f0000000200)={0x90, 0x0, 0xffffffffffffffff, {0xffffffffffffffff, 0x2, 0x101, 0x0, 0x0, 0x10000000, {0x40, 0xd08, 0x0, 0x100, 0x0, 0x0, 0x7, 0x0, 0x122, 0x6000, 0x10000, r0, 0x0, 0x902, 0x1}}}, 0x0, 0x0, 0x0, 0x0, 0x0}) r1 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000140), 0x0, 0x0) r2 = ioctl$KVM_CREATE_VM(r1, 0xae01, 0x0) mkdir(&(0x7f00000020c0)='./file0\x00', 0x1c8) mount$bind(&(0x7f0000000140)='./file0\x00', &(0x7f0000000000)='./file0/../file0\x00', 0x0, 0x315901c, 0x0) chroot(&(0x7f0000001140)='./file0\x00') mount$bind(&(0x7f0000000040)='.\x00', &(0x7f0000000080)='./file0\x00', 0x0, 0x2a05004, 0x0) pivot_root(&(0x7f00000000c0)='./file0/../file0\x00', &(0x7f0000000100)='./file0\x00') r3 = ioctl$KVM_CREATE_VCPU(r2, 0xae41, 0x0) ioctl$KVM_SET_MSRS(r3, 0xc008ae88, &(0x7f0000000040)={0x10000000000000cf, 0x0, [{0x8d}]}) r4 = syz_open_dev$cec(&(0x7f0000000200), 0xffffffffffffffff, 0x4ae60) ioctl$CEC_TRANSMIT(r4, 0xc0386105, &(0x7f0000000100)={0xfffffffffffffbf7, 0x1, 0x2, 0x0, 0x4, 0x7ffe, "7f2c00", 0xfe, 0x56, 0x1, 0xfa, 0x9, 0x1}) pipe2$9p(&(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}, 0x80) write$P9_RREADLINK(r5, &(0x7f0000000040)={0x10, 0x17, 0xc, {0x7, './file0'}}, 0x10) executing program 1: r0 = socket$inet_udp(0x2, 0x2, 0x0) r1 = openat$tun(0xffffffffffffff9c, &(0x7f0000000100), 0x2, 0x0) ioctl$TUNSETIFF(r1, 0x400454ca, &(0x7f0000000040)={'syzkaller0\x00', 0x4001}) ioctl$sock_inet_SIOCSIFFLAGS(r0, 0x8914, &(0x7f0000000200)={'syzkaller0\x00', 0x1}) write$tun(r1, &(0x7f0000000140)=ANY=[@ANYBLOB="0000080001000000000e140008004500003c000000004084ca2502020202ac140001"], 0x4a) executing program 1: r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000300), 0x900, 0x0) r1 = socket$inet_udp(0x2, 0x2, 0x0) ioctl$sock_ipv6_tunnel_SIOCGETPRL(r1, 0x89f4, &(0x7f0000000040)={'sit0\x00', 0x0}) r2 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) ioctl$KVM_SET_USER_MEMORY_REGION(r2, 0x4020ae46, &(0x7f0000000400)={0x0, 0x0, 0x0, 0x20002000, &(0x7f0000000000/0x2000)=nil}) syz_kvm_setup_cpu$x86(0xffffffffffffffff, 0xffffffffffffffff, &(0x7f0000000000/0x18000)=nil, &(0x7f0000000140)=[@text64={0x40, 0x0}], 0x1, 0xe8, 0x0, 0x0) ioctl$KVM_CAP_DIRTY_LOG_RING_ACQ_REL(r2, 0x4068aea3, &(0x7f00000000c0)={0xdf, 0x0, 0x1000}) syz_kvm_add_vcpu$x86(0x0, &(0x7f0000000980)={0x0, &(0x7f0000000440)=[@nested_load_code={0x12e, 0x79, {0x3, "c4a18172d401c744240022000000c744240281e9d8ffc7442406000000000f011c24c7442400a9000000c7442402f0a6d482ff1c24b964090000b80001c0feba000000000f300f320f01c3420f01f83e430f01cbc4a27d2014e966b85f000f00d0"}}], 0x79}) ioctl$KVM_RUN(0xffffffffffffffff, 0xae80, 0x0) syz_kvm_setup_cpu$x86(r2, 0xffffffffffffffff, &(0x7f0000000000/0x18000)=nil, &(0x7f0000000080)=[@text64={0x40, 0x0}], 0x1, 0x10, 0x0, 0x0) executing program 33: r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000300), 0x900, 0x0) r1 = socket$inet_udp(0x2, 0x2, 0x0) ioctl$sock_ipv6_tunnel_SIOCGETPRL(r1, 0x89f4, &(0x7f0000000040)={'sit0\x00', 0x0}) r2 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) ioctl$KVM_SET_USER_MEMORY_REGION(r2, 0x4020ae46, &(0x7f0000000400)={0x0, 0x0, 0x0, 0x20002000, &(0x7f0000000000/0x2000)=nil}) syz_kvm_setup_cpu$x86(0xffffffffffffffff, 0xffffffffffffffff, &(0x7f0000000000/0x18000)=nil, &(0x7f0000000140)=[@text64={0x40, 0x0}], 0x1, 0xe8, 0x0, 0x0) ioctl$KVM_CAP_DIRTY_LOG_RING_ACQ_REL(r2, 0x4068aea3, &(0x7f00000000c0)={0xdf, 0x0, 0x1000}) syz_kvm_add_vcpu$x86(0x0, &(0x7f0000000980)={0x0, &(0x7f0000000440)=[@nested_load_code={0x12e, 0x79, {0x3, "c4a18172d401c744240022000000c744240281e9d8ffc7442406000000000f011c24c7442400a9000000c7442402f0a6d482ff1c24b964090000b80001c0feba000000000f300f320f01c3420f01f83e430f01cbc4a27d2014e966b85f000f00d0"}}], 0x79}) ioctl$KVM_RUN(0xffffffffffffffff, 0xae80, 0x0) syz_kvm_setup_cpu$x86(r2, 0xffffffffffffffff, &(0x7f0000000000/0x18000)=nil, &(0x7f0000000080)=[@text64={0x40, 0x0}], 0x1, 0x10, 0x0, 0x0) executing program 0: r0 = io_uring_setup(0x2ac3, &(0x7f00000001c0)={0x0, 0x77b6, 0x0, 0x400000, 0xac}) r1 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r1, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000500)={&(0x7f00000002c0)=@newlink={0x3c, 0x10, 0x439, 0x70bd2d, 0x0, {}, [@IFLA_LINKINFO={0x1c, 0x12, 0x0, 0x1, @ipip6={{0xb}, {0xc, 0x2, 0x0, 0x1, [@IFLA_IPTUN_FWMARK={0x8, 0x14, 0x7}]}}}]}, 0x3c}}, 0x0) io_uring_setup(0x650b, 0x0) r2 = syz_open_dev$vim2m(&(0x7f0000000280), 0x4eb36, 0x2) ioctl$vim2m_VIDIOC_REQBUFS(r2, 0xc0145608, &(0x7f00000007c0)={0x1, 0x2, 0x1, 0x0, 0x8}) ioctl$vim2m_VIDIOC_QBUF(r2, 0xc058560f, &(0x7f00000002c0)=@multiplanar_mmap={0x0, 0x2, 0x0, 0xfdfd, 0x0, {}, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, "fafc00"}, 0x0, 0x1, {0x0}}) ioctl$BTRFS_IOC_QUOTA_RESCAN_WAIT(r0, 0x942e, 0x0) r3 = socket$netlink(0x10, 0x3, 0x0) sendmsg$nl_route(r3, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000001140)={&(0x7f0000000140)=@newlink={0x78, 0x10, 0x503, 0x0, 0x2, {0x0, 0x0, 0x0, 0x0, 0x0, 0x1244c}, [@IFLA_LINKINFO={0x58, 0x12, 0x0, 0x1, @vti={{0x8}, {0x4c, 0x2, 0x0, 0x1, [@IFLA_VTI_LOCAL={0x8, 0x4, @private=0xa010101}, @IFLA_VTI_REMOTE={0x8, 0x5, @private=0xa0100fe}, @IFLA_VTI_LOCAL={0x8, 0x4, @rand_addr=0x64010102}, @vti_common_policy=[@IFLA_VTI_FWMARK={0x8, 0x6, 0x2d616b45}, @IFLA_VTI_LINK={0x8}, @IFLA_VTI_IKEY={0x8, 0x2, 0x5}, @IFLA_VTI_FWMARK={0x8, 0x6, 0xe}, @IFLA_VTI_FWMARK={0x8, 0x6, 0x4}, @IFLA_VTI_IKEY={0x8, 0x2, 0x9}]]}}}]}, 0x78}}, 0x0) r4 = openat$procfs(0xffffffffffffff9c, &(0x7f0000000000)='/proc/cgroups\x00', 0x0, 0x0) setsockopt$MRT_DEL_MFC(r4, 0x0, 0xcd, &(0x7f0000000100)={@remote, @local, 0xffffffffffffffff, "497c62504d07e8fcbfc16eccdbef03f9a0fdc7265c6886e9b1b17fe65790058b", 0x200, 0xffff, 0x7ea3, 0xc6}, 0x3c) executing program 3: r0 = socket$unix(0x1, 0x5, 0x0) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000100)={'batadv0\x00', 0x0}) r2 = socket(0x10, 0x3, 0x0) sendmsg$nl_route_sched(r2, &(0x7f0000000200)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000300)=@newqdisc={0x88, 0x24, 0xf0b, 0x70bd26, 0x0, {0x0, 0x0, 0x0, r1, {0x0, 0xffff}, {0xffff, 0xffff}}, [@qdisc_kind_options=@q_mqprio={{0xb}, {0x58, 0x2, {{0x1, [], 0x0, [0x1, 0x2, 0xfffe, 0x0, 0x0, 0x0, 0x0, 0x8, 0x0, 0x5c4, 0x8000, 0x0, 0x0, 0x3dc], [0x0, 0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1000]}}}}]}, 0x88}}, 0x20000000) sendmsg$nl_route_sched(r2, &(0x7f00000012c0)={0x0, 0x0, &(0x7f0000000400)={&(0x7f0000000540)=@newqdisc={0x44, 0x24, 0x4ee4e6a52ff56541, 0x70bd29, 0xfffbffff, {0x0, 0x0, 0x0, r1, {0x0, 0x8}, {0xffff, 0xffff}, {0xc, 0xfff3}}, [@qdisc_kind_options=@q_taprio={{0xb}, {0x14, 0x2, [@TCA_TAPRIO_ATTR_SCHED_ENTRY_LIST={0x10, 0x2, 0x0, 0x1, [{0xc, 0x1, 0x0, 0x1, [@TCA_TAPRIO_SCHED_ENTRY_CMD={0x5, 0x2, 0x66}]}]}]}}]}, 0x44}, 0x1, 0xc000000, 0x0, 0x41}, 0x14) executing program 4: mknodat(0xffffffffffffff9c, &(0x7f0000000100)='./file2\x00', 0x81c0, 0x0) execveat(0xffffffffffffff9c, &(0x7f0000000280)='./file2\x00', 0x0, 0x0, 0x0) mknod$loop(&(0x7f0000000300)='./file0\x00', 0x6000, 0x0) unlink(&(0x7f0000000040)='./file0\x00') mknod$loop(&(0x7f0000000200)='./file0\x00', 0x2000, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./sys\x00', 0x1ff) mount(0x0, &(0x7f00000000c0)='./file1\x00', &(0x7f0000000040)='sysfs\x00', 0x0, 0x0) openat$binderfs(0xffffffffffffff9c, &(0x7f0000000300)='./binderfs/binder0\x00', 0x0, 0x0) openat$binderfs(0xffffffffffffff9c, &(0x7f0000000180)='./binderfs/binder1\x00', 0xc02, 0x0) syz_open_dev$sndpcmc(&(0x7f0000000000), 0x0, 0x0) socket(0x11, 0x2, 0x10001) mmap$IORING_OFF_SQ_RING(0x0, 0xc, 0x2000002, 0x401d031, 0xffffffffffffffff, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000001500)='./dev\x00', 0x1ff) openat(0xffffffffffffff9c, &(0x7f0000000240)='./file0\x00', 0x40042, 0x1) open(&(0x7f00009e1000)='./file0\x00', 0x8060, 0x0) mount(0x0, &(0x7f0000001500)='./dev\x00', &(0x7f0000001600)='devtmpfs\x00', 0x0, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000080)='./mnt\x00', 0x1ff) socket$nl_generic(0x10, 0x3, 0x10) socket$packet(0x11, 0x3, 0x300) socket$packet(0x11, 0x3, 0x300) socketpair$unix(0x1, 0x2, 0x0, 0x0) mount(&(0x7f00000000c0)=@filename='./dev/sda1\x00', &(0x7f0000000140)='./mnt\x00', &(0x7f0000000100)='ext4\x00', 0x8410, 0x0) mprotect(&(0x7f0000000000/0xf000)=nil, 0xf000, 0x1) r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000140), 0x0, 0x0) ioctl$TUNSETIFF(r0, 0x40e8662e, 0x0) r1 = openat(0xffffffffffffff9c, &(0x7f0000000400)='./sys/bus/pci/drivers/net2280/new_id\x00', 0x1, 0x0) write(r1, &(0x7f0000001100)='8086 29c0 ffffffff ffffffff 0 0 1', 0x21) syz_create_resource$binfmt(&(0x7f0000000080)='./sys/bus/pci/drivers/net2280/new_id\x00') executing program 0: r0 = socket$kcm(0x2, 0x3, 0x84) sendmmsg$inet(r0, &(0x7f0000006a80)=[{{&(0x7f0000000000)={0x2, 0x4e22, @dev={0xac, 0x14, 0x14, 0x18}}, 0x10, &(0x7f0000002ac0)=[{&(0x7f0000000080)="f982340819048e40ac0bd4474d", 0xd}], 0x1}}], 0x1, 0x8080) sendmsg$inet(r0, &(0x7f0000000a00)={&(0x7f0000000040)={0x2, 0x4e23, @remote}, 0x10, &(0x7f00000000c0)=[{&(0x7f0000000440)="c10900", 0x3}], 0x1}, 0x6000) executing program 4: syz_emit_ethernet(0x6a, &(0x7f0000000040)={@link_local={0x1, 0x80, 0xc2, 0x0, 0x0, 0x3}, @remote, @void, {@ipv4={0x800, @icmp={{0x5, 0x4, 0x0, 0x1, 0x5c, 0x0, 0x0, 0xfb, 0x1, 0x0, @initdev={0xac, 0x1e, 0x0, 0x0}, @local}, @time_exceeded={0x3, 0x1, 0x0, 0x3, 0x24, 0x0, {0x10, 0x4, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x1, 0x8, @loopback, @rand_addr=0x640100fe, {[@cipso={0x86, 0x29, 0xffffffffffffffff, [{0x0, 0xe, "08c82ce8da6ee06cb8dd9452"}, {0x5, 0x9, "020007651442eb"}, {0x1, 0x2}, {0x2, 0x7, "cf05003179"}, {0x0, 0x3, '\x00'}]}]}}}}}}}, 0x0) socketpair(0x1, 0x1, 0x0, &(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}) r2 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r3 = syz_genetlink_get_family_id$nbd(&(0x7f0000000040), r2) sendmsg$NBD_CMD_CONNECT(r2, &(0x7f0000000400)={0x0, 0x0, &(0x7f0000001a80)={&(0x7f0000000480)={0x5c, r3, 0x1, 0x70bd2c, 0xffe, {}, [@NBD_ATTR_SIZE_BYTES={0xc, 0x2, 0x2}, @NBD_ATTR_SOCKETS={0x28, 0x7, 0x0, 0x1, [{0xc, 0x1, 0x0, 0x1, {0x8, 0x1, r0}}, {0xc, 0x1, 0x0, 0x1, {0x8, 0x1, r0}}, {0xc, 0x1, 0x0, 0x1, {0x8, 0x1, r1}}]}, @NBD_ATTR_SERVER_FLAGS={0xc, 0x5, 0x128}, @NBD_ATTR_BACKEND_IDENTIFIER={0x8, 0xa, 'nbd\x00'}]}, 0x5c}}, 0x20000000) r4 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r5 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r6 = syz_genetlink_get_family_id$netlbl_mgmt(&(0x7f0000002180), r4) sendmsg$NLBL_MGMT_C_REMOVEDEF(r5, &(0x7f0000002240)={0x0, 0x0, &(0x7f0000002200)={&(0x7f00000021c0)={0x14, r6, 0x1, 0x70bd29, 0x25dfdbfd}, 0x14}, 0x1, 0x0, 0x0, 0x4000800}, 0x4000004) sendmsg$NLBL_MGMT_C_ADDDEF(r2, &(0x7f00000001c0)={&(0x7f00000000c0)={0x10, 0x0, 0x0, 0x4000}, 0xc, &(0x7f0000000180)={&(0x7f0000000140)={0x3c, r6, 0x200, 0x70bd2b, 0x25dfdbff, {}, [@NLBL_MGMT_A_DOMAIN={0x9, 0x1, '\xaa\xaa\xaa\xaa\xaa'}, @NLBL_MGMT_A_IPV4MASK={0x8, 0x8, @empty}, @NLBL_MGMT_A_IPV6ADDR={0x14, 0x5, @dev={0xfe, 0x80, '\x00', 0x19}}]}, 0x3c}, 0x1, 0x0, 0x0, 0x48000}, 0x4000000) seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0x0, &(0x7f0000000000)={0x1, &(0x7f0000000100)=[{0x6, 0x0, 0x0, 0x7fff0000}]}) socket(0x1, 0x80402, 0x7) executing program 3: r0 = openat$sysctl(0xffffffffffffff9c, &(0x7f0000000040)='/proc/sys/net/ipv4/tcp_mtu_probing\x00', 0x1, 0x0) pwritev(r0, &(0x7f0000000140), 0x15, 0x9, 0x1) executing program 0: r0 = socket$inet_udp(0x2, 0x2, 0x0) r1 = bpf$BPF_BTF_LOAD(0x12, &(0x7f0000000080)={&(0x7f0000000040)=ANY=[@ANYBLOB="9feb0100180000000000000020000000200000000400000001000000000000010400000020000000010000000000000108"], 0x0, 0x3c}, 0x28) r2 = bpf$MAP_CREATE(0x0, &(0x7f0000000200)=ANY=[@ANYBLOB="1c0000000400000008000000000000000100"/48, @ANYRES32=r1, @ANYBLOB="0100000002"], 0x40) bpf$MAP_LOOKUP_ELEM(0x1, &(0x7f0000000300)={r2, &(0x7f00000000c0)="8fa5", 0x0}, 0x20) setsockopt$IPT_SO_SET_REPLACE(r0, 0x0, 0x40, &(0x7f0000000000)=@raw={'raw\x00', 0x8, 0x3, 0x3c8, 0x0, 0xa, 0x148, 0x0, 0x10, 0x330, 0x2a8, 0x2a8, 0x330, 0x2a8, 0x3, 0x0, {[{{@ip={@rand_addr, @multicast1, 0x0, 0x0, 'bridge0\x00', 'rose0\x00'}, 0x0, 0x70, 0xe0, 0x0, {0x200003ae, 0x7f00}}, @common=@unspec=@NFLOG={0x70, 'NFLOG\x00', 0x0, {0x0, 0x0, 0x0, 0x0, 0x0, "f2f7b90ad2b60c45cb4ea6e7bf902bdc2ff8a9304d9f655c746adc0bdc773506378bc0d27efd6abb05175089830cc46186074d7de46d5af300"}}}, {{@ip={@empty, @local, 0x0, 0x0, 'ip6erspan0\x00', 'veth0_to_team\x00'}, 0x0, 0x1f0, 0x250, 0x0, {}, [@common=@inet=@hashlimit3={{0x158}, {'wg2\x00', {0xffffffffffffffff, 0xff, 0x0, 0x0, 0x0, 0x7fff, 0x200}}}, @inet=@rpfilter={{0x28}}]}, @common=@CLUSTERIP={0x60, 'CLUSTERIP\x00', 0x0, {0x1, @multicast, 0x2, 0x7, [0x0, 0x10, 0x1b, 0x2b, 0x37, 0x2e, 0x2b, 0x18, 0x2b, 0x34, 0xd, 0x0, 0x3d, 0x1, 0x32, 0x37], 0x1, 0x6, 0x1570000000000}}}], {{'\x00', 0xc8, 0x70, 0x98}, {0x28}}}}, 0x428) r3 = openat(0xffffffffffffff9c, &(0x7f0000000040)='./file1\x00', 0x542, 0x0) ioctl$SIOCX25SDTEFACILITIES(r3, 0x89eb, &(0x7f0000000080)={0x81, 0x962, 0x7, 0x7, 0x2, 0xd, 0x3, "4cb8b2a6146ab1a722e031cf656758ee56a018e7", "be634e4a96ef65eb0d23451a8d73bc095839f363"}) pwritev2(r3, &(0x7f00000000c0)=[{&(0x7f0000000300)=')', 0x1}], 0x1, 0x2, 0x0, 0xa1) r4 = syz_open_dev$I2C(&(0x7f0000000000), 0x1, 0x0) ioctl$I2C_PEC(r4, 0x708, 0x40) ioctl$I2C_SMBUS(r4, 0x720, &(0x7f00000002c0)={0x1, 0x7, 0x4, &(0x7f0000000280)={0x5, "1d27f0db2e1f25eff995475188afe0ebe9bab69516a5e88a718dca33021b22b650"}}) r5 = socket$nl_route(0x10, 0x3, 0x0) getsockopt$sock_int(r5, 0x1, 0xb, 0x0, &(0x7f0000000040)) socket$netlink(0x10, 0x3, 0x0) r6 = socket(0x10, 0x803, 0x0) sendmsg$IPVS_CMD_SET_INFO(r6, &(0x7f0000000b00)={0x0, 0x0, &(0x7f0000000ac0)={0x0, 0x14}}, 0x0) r7 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r7, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000240)={&(0x7f0000000180)=ANY=[@ANYBLOB="3c0000001000030400"/20, @ANYRES32=0x0, @ANYBLOB="a4280400000000001400350073797a5f74756e00000000000000000008000a00", @ANYRES32], 0x3c}}, 0x8000) executing program 4: bpf$MAP_CREATE(0x0, &(0x7f0000000000)=ANY=[@ANYBLOB="1400000007"], 0x50) r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000000), 0x40241, 0x0) r1 = socket$pppl2tp(0x18, 0x1, 0x1) r2 = socket$inet6_udp(0xa, 0x2, 0x0) r3 = socket$inet_tcp(0x2, 0x1, 0x0) bind$inet(r3, &(0x7f0000000040)={0x2, 0x4e21, @local}, 0x10) setsockopt$inet_tcp_int(0xffffffffffffffff, 0x6, 0x19, &(0x7f0000000240)=0x6, 0xfffffedf) setsockopt$inet_tcp_TCP_REPAIR_QUEUE(r3, 0x6, 0x14, &(0x7f0000000000)=0x2, 0x4) setsockopt$SO_TIMESTAMPING(r3, 0x1, 0x25, &(0x7f0000000200)=0x437b, 0x4) connect$inet(r3, &(0x7f0000000180)={0x2, 0x4e21, @local}, 0x10) setsockopt$inet_tcp_TCP_REPAIR_OPTIONS(r3, 0x6, 0x16, &(0x7f0000000340)=[@window={0x3, 0x1, 0x8}, @window={0x3, 0x6, 0x7}, @sack_perm, @window={0x3, 0x0, 0x4}, @mss={0x2, 0x4}, @timestamp, @window={0x3, 0x1, 0x10}, @sack_perm], 0x20000000000002a1) sendmsg$inet(r3, &(0x7f0000000300)={0x0, 0x0, &(0x7f0000000140)=[{&(0x7f0000000380)="9ad024c2775e1e2ab8e46a2877fcb21d4bb90500ebb1cfaea615b04f758b1754ce82525f728b072274a6388145b8991b4d0d7e9275d21e257816bb8650d21ba04ac83b4961e7b3a94d", 0x49}], 0x1}, 0x0) setsockopt$inet_tcp_TCP_REPAIR(r3, 0x6, 0x13, &(0x7f00000001c0), 0x4) sendto$inet(r3, &(0x7f00000004c0)='<', 0x381, 0x805, 0x0, 0x0) connect$pppl2tp(r1, &(0x7f0000000080)=@pppol2tpin6={0x18, 0x1, {0x0, r2, 0x6, 0x0, 0x0, 0x0, {0xa, 0x0, 0x0, @local}}}, 0x32) getsockopt$sock_buf(r1, 0x1, 0x1c, 0x0, &(0x7f0000000000)=0x3d) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000200)={'syzkaller1\x00', 0xc201}) r4 = socket$kcm(0x21, 0x2, 0xa) r5 = socket$inet6(0xa, 0x3, 0xff) setsockopt$inet6_int(r5, 0x29, 0x7, &(0x7f0000fcb000)=0xffffffff, 0x4) sendmsg$kcm(r4, &(0x7f0000000080)={&(0x7f0000000000)=@rxrpc=@in6={0x21, 0x1, 0x2, 0x1c, {0xa, 0x0, 0x4, @dev, 0x8000000}}, 0x80, 0x0, 0x0, &(0x7f00000000c0)=[{0x18, 0x110, 0x1, '\x00'}, {0x18, 0x110, 0xc, "aa"}], 0x30}, 0xfc40) r6 = socket$inet6_tcp(0xa, 0x1, 0x0) r7 = dup(r6) ioctl$TIOCSLCKTRMIOS(r7, 0x5457, &(0x7f00000000c0)) ioctl$SIOCSIFHWADDR(r7, 0x8914, &(0x7f0000000040)={'syzkaller1\x00', @link_local={0x1, 0x80, 0xc2, 0x0, 0x0, 0x3}}) write$tun(r0, &(0x7f0000000500)={@val={0x8, 0xc}, @val={0x2, 0x1, 0x4, 0x11, 0x9ca, 0x81}, @ipv4=@icmp={{0x20, 0x4, 0x1, 0x25, 0x94, 0x66, 0x0, 0xa8, 0x1, 0x0, @initdev={0xac, 0x1e, 0x1, 0x0}, @local, {[@ra={0x94, 0x4, 0x1}, @lsrr={0x83, 0x13, 0xa1, [@local, @dev={0xac, 0x14, 0x14, 0x3e}, @local, @multicast1]}, @timestamp_addr={0x44, 0x24, 0x1b, 0x1, 0x9, [{@loopback, 0x7}, {@loopback, 0x200}, {@multicast2}, {@multicast1, 0x4}]}, @cipso={0x86, 0x31, 0x2, [{0x1, 0xb, "b994131c56c477d6f5"}, {0x2, 0x12, "ef0500f6d000"/16}, {0x7, 0x6, "e8c2e380"}, {0x1, 0x8, "1e2d53d7cd98"}]}]}}, @timestamp={0xd, 0x0, 0x0, 0xc000, 0x4, 0x3, 0x401, 0x600}}}, 0xa2) creat(0x0, 0x0) sendto$packet(0xffffffffffffffff, &(0x7f0000000000)='1', 0x1, 0x4000800, 0x0, 0x0) r8 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) bind$bt_hci(r8, &(0x7f0000000040)={0x1f, 0xffff, 0x3}, 0x6) executing program 3: r0 = socket$nl_route(0x10, 0x3, 0x0) r1 = socket(0x10, 0x803, 0x0) sendmsg$nl_route(r1, &(0x7f00000006c0)={0x0, 0x0, &(0x7f0000000680)={0x0, 0x18}}, 0x0) getsockname$packet(r1, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) sendmsg$nl_route(r0, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000000)={&(0x7f00000002c0)=ANY=[@ANYBLOB="5000000010008105e9c51c000000000000000000", @ANYRES32=r2, @ANYBLOB="01000000000000002800128009000100766c616e000000001800028006000100000000000c0002000c0000000d00000008000500", @ANYRES64=r0], 0x50}, 0x1, 0x0, 0x0, 0x80}, 0x0) sendmsg$nl_route(0xffffffffffffffff, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000700)=@newlink={0x20, 0x10, 0x1, 0x1, 0x25dfdbff, {0x0, 0x0, 0x0, r2, 0x0, 0x8}}, 0x20}, 0x1, 0x0, 0x0, 0x11}, 0x0) ioctl$sock_inet6_SIOCADDRT(0xffffffffffffffff, 0x890b, &(0x7f0000000380)={@local, @empty, @initdev={0xfe, 0x88, '\x00', 0x1, 0x0}, 0x3, 0x6, 0x5, 0x200, 0x4, 0x100020, r2}) mkdirat(0xffffffffffffff9c, &(0x7f0000000400)='./config\x00', 0x1ed) socket$nl_xfrm(0x10, 0x3, 0x6) mount(0x0, &(0x7f0000000500)='./config\x00', &(0x7f0000000600)='configfs\x00', 0x0, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000700)='./config/usb_gadget/g1\x00', 0x1ed) mkdirat(0xffffffffffffff9c, &(0x7f0000000c00)='./config/usb_gadget/g1/UDC\x00', 0x1c4) bpf$PROG_LOAD(0x5, 0x0, 0x0) socket(0x3d, 0x80000, 0x5) mkdirat(0xffffffffffffff9c, &(0x7f0000000d00)='./config/usb_gadget/g1/functions/uvc.usb0/control/header/h\x00', 0x1ed) r3 = openat$dir(0xffffffffffffff9c, 0x0, 0x400007, 0x2) readlinkat(r3, &(0x7f0000000040)='./config/usb_gadget/g1/configs/c.1/uvc.usb0\x00', 0x0, 0x0) symlinkat(&(0x7f0000000e00)='./config/usb_gadget/g1/functions/uvc.usb0/control/header/h\x00', 0xffffffffffffff9c, &(0x7f0000000f00)='./config/usb_gadget/g1/functions/uvc.usb0/control/class/fs/h\x00') symlinkat(0x0, 0xffffffffffffffff, 0x0) r4 = openat(0xffffffffffffff9c, &(0x7f0000002000)='./config/usb_gadget/g1/UDC\x00', 0x1, 0x0) write(r4, &(0x7f0000002100)='usbip-vudc.0', 0xc) r5 = socket$netlink(0x10, 0x3, 0x0) stat(&(0x7f00000001c0)='./config\x00', &(0x7f0000000200)) r6 = bpf$BPF_BTF_LOAD(0x12, &(0x7f0000000140)={&(0x7f0000000100)={{0xeb9f, 0x1, 0x0, 0x18, 0x0, 0x20, 0x20, 0x4, [@func={0x2, 0x0, 0x0, 0xc, 0x2}, @func_proto={0x0, 0x1, 0x0, 0xd, 0x0, [{}]}]}, {0x0, [0x0, 0x5f]}}, 0x0, 0x3c}, 0x28) bpf$PROG_LOAD_XDP(0x5, &(0x7f00000002c0)={0x6, 0x3, &(0x7f0000000000)=@framed={{0x18, 0x0, 0x0, 0x0, 0x7, 0x0, 0x0, 0x0, 0xc0}}, &(0x7f0000000080)='GPL\x00', 0xf, 0x0, 0x0, 0x40f00, 0x4, '\x00', 0x0, 0x25, r6, 0x8, &(0x7f0000000180)={0x0, 0x1}, 0x1, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0x4}, 0x94) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000040)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$sock_SIOCGIFINDEX(r7, 0x8933, &(0x7f0000000080)={'macsec0\x00', 0x0}) r9 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$inet6_buf(r9, 0x29, 0x20, &(0x7f00000000c0)="0bbb268dd6ffa80800000000000000000000210d0000aaa8fa017242ba9380d4", 0x20) sendmsg$nl_route(r5, &(0x7f00000000c0)={0x0, 0x0, &(0x7f00000002c0)={&(0x7f0000000000)=ANY=[@ANYBLOB="280000001d000100000000010000000007000000", @ANYRES32=r8, @ANYRESDEC=r5], 0x28}, 0x1, 0x0, 0x0, 0x4041}, 0x0) executing program 0: mkdirat(0xffffffffffffff9c, &(0x7f00000000c0)='./file0\x00', 0x10) mkdirat(0xffffffffffffff9c, &(0x7f00000000c0)='./bus\x00', 0x1c5) mount$overlay(0x0, &(0x7f0000000100)='./file0\x00', &(0x7f0000000040), 0x8, &(0x7f0000000240)={[{@upperdir={'upperdir', 0x3d, './file0'}}, {@workdir={'workdir', 0x3d, './bus'}}, {@lowerdir={'lowerdir', 0x3d, '.'}}]}) socket$xdp(0x2c, 0x3, 0x0) r0 = socket$kcm(0x2c, 0x3, 0x0) close(r0) r1 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPCTNL_MSG_CT_GET(r1, &(0x7f0000000200)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000300)=ANY=[@ANYBLOB="ac0000000001050500000000000000000a0000003c0002802c00018014000300ff01000000000000000000000000000114000400ff0200000000000000000000000000010c00028005000100000000003c0001800c00028005000100000000002c00018014000300ff0200000000000000000000000000811400040000000000000000000001ffffac1e00010800074000000001180006801400040000000000000000000000000000000001"], 0xac}}, 0x0) sendmsg$IPCTNL_MSG_EXP_GET(r1, &(0x7f0000006680)={0x0, 0x0, &(0x7f0000006640)={&(0x7f00000065c0)=ANY=[@ANYBLOB="500000000102010100000000000000000a0000003c0001802c00018014000300ff01000000000000000000000000000114000400000000000000000000000000000000010c0002580500010000000000"], 0x50}, 0x1, 0x0, 0x0, 0x800}, 0x0) chdir(&(0x7f0000000000)='./file0\x00') mknod$loop(&(0x7f0000000000)='./file0aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa\x00', 0x2000, 0x1) executing program 4: setsockopt$inet_mreqsrc(0xffffffffffffffff, 0x0, 0x27, &(0x7f0000000280)={@multicast2, @local, @remote}, 0xc) r0 = socket(0x1, 0x803, 0x0) r1 = socket$nl_route(0x10, 0x3, 0x0) getsockname$packet(r0, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f00000002c0)=0x14) sendmsg$nl_route(r1, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000340)=ANY=[@ANYBLOB="540000001000010400"/20, @ANYRES32=0x0, @ANYBLOB="00000000000000002c0012800e0001006970366772657461700000001800028014000700ff01000000000000000000000000000108000a00", @ANYRES32=r2], 0x54}}, 0x0) setsockopt$inet_IP_XFRM_POLICY(0xffffffffffffffff, 0x0, 0x11, &(0x7f00000005c0)={{{@in6=@local, @in=@broadcast, 0x4e23, 0x6, 0x4e24, 0x0, 0x0, 0x0, 0x80, 0x8, r2, 0xee01}, {0x8, 0x8, 0x791a, 0x69, 0xf07a, 0x7, 0xbf9, 0x2}, {0x0, 0x40, 0x0, 0x3}, 0x4f55945f, 0x6e6bc0, 0x0, 0x1}, {{@in6=@ipv4={'\x00', '\xff\xff', @rand_addr=0x64010100}, 0x4d2, 0xff}, 0xa, @in6=@ipv4={'\x00', '\xff\xff', @local}, 0x3507, 0x0, 0x0, 0x0, 0x9, 0x10001, 0x9bde}}, 0xe8) r3 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) r4 = ioctl$KVM_CREATE_VM(r3, 0xae01, 0x2a) ioctl$KVM_SET_USER_MEMORY_REGION(r4, 0x4020ae46, &(0x7f0000000100)={0x4, 0x1, 0xffff1000, 0x1000, &(0x7f0000012000/0x1000)=nil}) r5 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000240), 0x0, 0x0) r6 = ioctl$KVM_CREATE_VM(r5, 0xae01, 0x0) ioctl$SG_IO(0xffffffffffffffff, 0x2285, &(0x7f0000000400)={0x53, 0xfffffffffffffffb, 0x5, 0x8, @buffer={0x0, 0x0, 0x0}, &(0x7f0000000200)="0004000019", 0x0, 0x0, 0x10011, 0xfffbffff, 0x0}) r7 = ioctl$KVM_CREATE_VCPU(r6, 0xae41, 0x0) ioctl$KVM_SET_USER_MEMORY_REGION(r6, 0x4020ae46, &(0x7f0000000180)={0x0, 0x0, 0x0, 0x2000, &(0x7f0000000000/0x2000)=nil}) ioctl$KVM_SET_REGS(r7, 0x4090ae82, &(0x7f0000000000)={[0x35, 0xfff, 0xfffffffffffffffe, 0x40000000000180, 0x2, 0x7, 0xf2, 0xd, 0x7fffffffffffe, 0x7, 0x5, 0xb, 0x7, 0xfffffffffffffff8, 0x9, 0xc], 0x25000, 0x304}) r8 = syz_ublk_setup_io_uring(0x20, &(0x7f0000000340)={0x0, 0x0, 0x100, 0x2, 0x1e5}, &(0x7f0000000000)=0x0, &(0x7f0000000040)=0x0, &(0x7f0000000980)=0x0) syz_io_uring_submit(r9, r10, r11, &(0x7f00000004c0)=@IORING_OP_RENAMEAT={0x23, 0xe, 0x0, 0xffffffffffffffff, &(0x7f0000000540)='./file0\x00', &(0x7f0000000580)='./file0\x00'}) unshare(0x22060600) syz_ublk_add_dev(r8, r9, r10, r11, &(0x7f00000000c0)={0x2e, 0x9, 0x0, r8, 0xc0207504, 0x0, 0x0, 0x0, 0x0, 0x800, 0x0, 0x0, '\x00', {0xffffffff, 0xffff, 0x40, &(0x7f0000000080)=@any_dev={0x1, 0xe8d, 0x0, 0x0, 0x1000, 0x1}}}, &(0x7f0000000180)) ioctl$KVM_RUN(r7, 0xae80, 0x0) r12 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$nl_generic(r12, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000140)={&(0x7f00000004c0)=ANY=[@ANYBLOB="18000000260001031dbd7002fadbdf25010000000400ae"], 0x18}}, 0x0) recvmmsg(r12, &(0x7f0000000800)=[{{0x0, 0x0, &(0x7f00000009c0)=[{&(0x7f0000000500)=""/140, 0x8c}, {&(0x7f0000000a40)=""/4148, 0xdf0}, {&(0x7f0000000040)=""/184, 0xb8}, {&(0x7f0000003800)=""/4104, 0x1008}, {&(0x7f0000000280)=""/65, 0x41}, {&(0x7f0000000200)=""/36, 0x24}], 0x6}, 0xd}, {{0x0, 0x0, 0x0}, 0x8}, {{0x0, 0x0, 0x0}, 0x38000000}, {{0x0, 0x0, 0x0}}], 0x4, 0x40000102, 0x0) r13 = ioctl$KVM_CREATE_VM(r3, 0xae01, 0x0) r14 = dup(r13) ioctl$KVM_SET_USER_MEMORY_REGION(r13, 0x4020ae46, &(0x7f0000000840)={0x1fe, 0x2, 0x3000, 0x2000, &(0x7f0000003000/0x2000)=nil}) r15 = ioctl$KVM_CREATE_VCPU(r14, 0xae41, 0x2001) syz_kvm_setup_cpu$x86(0xffffffffffffffff, r15, &(0x7f0000000000/0x18000)=nil, &(0x7f0000000040)=[@text32={0x20, 0x0}], 0x1, 0x11, 0x0, 0x0) syz_kvm_setup_cpu$x86(r13, 0xffffffffffffffff, &(0x7f0000000000/0x18000)=nil, &(0x7f0000000200)=[@text32={0x20, 0x0}], 0x1, 0x50, 0x0, 0x0) ioctl$KVM_RUN(r15, 0xae80, 0x0) executing program 3: r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000300), 0x900, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) ioctl$KVM_SET_USER_MEMORY_REGION(r1, 0x4020ae46, &(0x7f0000000400)={0x0, 0x0, 0x0, 0x20002000, &(0x7f0000000000/0x2000)=nil}) r2 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0) syz_kvm_setup_cpu$x86(0xffffffffffffffff, r2, &(0x7f0000000000/0x18000)=nil, &(0x7f0000000140)=[@text64={0x40, 0x0}], 0x1, 0xe8, 0x0, 0x0) sendmsg$kcm(0xffffffffffffffff, &(0x7f0000000000)={0x0, 0x0, 0x0}, 0x0) ioctl$KVM_RUN(r2, 0xae80, 0x0) (fail_nth: 14) executing program 0: sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000280)={&(0x7f0000000600)=@deltfilter={0x24, 0x2d, 0x300, 0x70bd2d, 0x25dfdbfd, {0x0, 0x0, 0x0, 0x0, {0x2, 0x2}, {0x9, 0xe}, {0x8, 0xffe0}}}, 0x24}}, 0x10) r0 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r0, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000240)=ANY=[@ANYBLOB="140000001000010000000000000000000500000a28000000000a030000000000000000000a00000708000240000000020900010073797a31000000002c000000030a010100000000000000000a0000070900010073797a31000000000900030073797a320000000014000000110001"], 0x7c}, 0x1, 0x0, 0x0, 0x4000}, 0x0) sendmsg$NFT_BATCH(r0, &(0x7f0000009b40)={0x0, 0x0, &(0x7f0000009b00)={&(0x7f0000000100)={{0x14, 0x10, 0x1, 0x0, 0x0, {0x5}}, [@NFT_MSG_NEWRULE={0x44, 0x6, 0xa, 0x401, 0x0, 0x0, {0xa, 0x0, 0x7}, [@NFTA_RULE_TABLE={0x9, 0x1, 'syz1\x00'}, @NFTA_RULE_EXPRESSIONS={0x18, 0x4, 0x0, 0x1, [{0x14, 0x1, 0x0, 0x1, @xfrm={{0x9}, @val={0x4}}}]}, @NFTA_RULE_CHAIN={0x9, 0x2, 'syz2\x00'}]}], {0x14, 0x11, 0x1, 0x0, 0x0, {0x1}}}, 0x6c}, 0x1, 0x0, 0x0, 0x204c054}, 0x20040040) r1 = socket$rds(0x15, 0x5, 0x0) bind$rds(r1, &(0x7f0000000840)={0x2, 0x0, @loopback}, 0x10) r2 = ioctl$KVM_CREATE_VM(0xffffffffffffffff, 0xae01, 0x36) ioctl$KVM_CREATE_VCPU(r2, 0xae41, 0x2) r3 = syz_open_dev$sndpcmc(&(0x7f0000000000), 0xb, 0x0) ioctl$SNDRV_PCM_IOCTL_HW_REFINE(r3, 0xc2604110, &(0x7f0000000040)={0x0, [[0x9ef8, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7fffffff], [0x10000, 0x0, 0x0, 0x0, 0x8001], [0x6, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0xffffffff]], '\x00', [{}, {0xfffffffd}, {}, {0x0, 0x0, 0x0, 0x1, 0x1}, {0x5, 0x0, 0x0, 0x1, 0x1}, {0x7fff, 0xfffffffa}, {}, {0x7fffffc, 0x8f96}, {}, {}, {0x0, 0xffffffff}, {0x8000}], '\x00', 0x7fffffff}) sendmsg$rds(r1, &(0x7f0000000740)={&(0x7f0000000040)={0x2, 0x4e23, @local}, 0x10, 0x0, 0x0, &(0x7f0000000100)=[@cswp={0x58, 0x114, 0x7, {{0x5, 0x2}, 0x0, 0x0, 0x5eae, 0x0, 0xd, 0x9, 0x2, 0x9}}], 0x58}, 0x0) sendmsg$nl_route(0xffffffffffffffff, &(0x7f0000000300)={0x0, 0x0, &(0x7f0000000080)={0x0, 0x48}, 0x1, 0x0, 0x0, 0x10}, 0x0) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000100)=@newqdisc={0x44, 0x24, 0x108, 0x0, 0x65dfdbfb, {0x0, 0x0, 0x0, 0x0, {0xffff, 0xffe0}, {0xffff, 0x7ff8}, {0xfff2}}, [@qdisc_kind_options=@q_fq_pie={{0xb}, {0x14, 0x8002, [@TCA_FQ_PIE_BYTEMODE={0x8}, @TCA_FQ_PIE_QUANTUM={0x8, 0x7, 0xffffff22}]}}]}, 0x44}, 0x1, 0x0, 0x0, 0x1}, 0x0) mmap(&(0x7f0000ffc000/0x4000)=nil, 0x4000, 0x8, 0x8010, r1, 0x14c66000) sendmsg$nl_route(0xffffffffffffffff, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000100)=ANY=[@ANYBLOB="500000001000010425bbe5ad600027842cf52300", @ANYRES32=0x0, @ANYBLOB="0000000000008000280012800a00010076786c616e00"], 0x50}}, 0x4008840) r4 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFULNL_MSG_CONFIG(r4, &(0x7f0000000400)={&(0x7f0000000440)={0x10, 0x0, 0x0, 0x400}, 0xc, &(0x7f00000003c0)={&(0x7f0000000340)={0x68, 0x1, 0x4, 0x201, 0x0, 0x0, {0x2}, [@NFULA_CFG_FLAGS={0x6, 0x6, 0x1, 0x0, 0x4}, @NFULA_CFG_NLBUFSIZ={0x8, 0x3, 0x1, 0x0, 0x5}, @NFULA_CFG_MODE={0xa, 0x2, {0x85}}, @NFULA_CFG_QTHRESH={0x8, 0x5, 0x1, 0x0, 0x1e8f352f}, @NFULA_CFG_TIMEOUT={0x8, 0x4, 0x1, 0x0, 0x7ff}, @NFULA_CFG_CMD={0x5, 0x1, 0x1}, @NFULA_CFG_QTHRESH={0x8, 0x5, 0x1, 0x0, 0x1}, @NFULA_CFG_MODE={0xa, 0x2, {0x1}}, @NFULA_CFG_MODE={0xa, 0x2, {0x4}}]}, 0x68}, 0x1, 0x0, 0x0, 0x4040000}, 0x10) mount$tmpfs(0x0, &(0x7f00000000c0)='./file0\x00', &(0x7f00000001c0), 0x10810, &(0x7f0000000200)={[{@usrquota_block_hardlimit={'usrquota_block_hardlimit', 0x3d, [0x25, 0x6d]}}], [{@rootcontext={'rootcontext', 0x3d, 'user_u'}}, {@subj_user={'subj_user', 0x3d, '@!@'}}]}) r5 = syz_io_uring_complete(0x0, 0x0) ioctl$sock_inet6_tcp_SIOCOUTQ(r5, 0x5411, &(0x7f0000000480)) r6 = socket$netlink(0x10, 0x3, 0x0) sendmmsg(r6, &(0x7f00000002c0), 0x40000000000009f, 0x0) executing program 4: r0 = openat$iommufd(0xffffffffffffff9c, &(0x7f0000000180), 0x0, 0x0) ioctl$IOMMU_IOAS_ALLOC(r0, 0x3b81, &(0x7f0000000100)={0xc, 0x0, 0x0}) ioctl$IOMMU_TEST_OP_MOCK_DOMAIN_FLAGS(r0, 0x3ba0, &(0x7f0000000240)={0x48, 0x2, r1, 0x0, 0x0, 0x0, 0x0, 0x1}) ioctl$IOMMU_IOAS_MAP$PAGES(r0, 0x3b85, &(0x7f00000007c0)={0x28, 0x5, r1, 0x0, &(0x7f00002ce000/0x1000)=nil, 0x1000, 0x1020800}) r2 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) keyctl$set_reqkey_keyring(0x5, 0xfffffffe) request_key(&(0x7f0000000480)='cifs.spnego\x00', &(0x7f00000004c0)={'syz', 0x3}, &(0x7f0000000500)='key_or_keyring:', 0x0) ioctl$IOMMU_VFIO_IOAS$GET(r0, 0x3b88, &(0x7f0000000140)={0xc, 0x0}) ioctl$IOMMU_TEST_OP_MOCK_DOMAIN_FLAGS(r0, 0x3ba0, &(0x7f00000001c0)={0x48, 0x2, r3, 0x0, 0x0, 0x0, 0x0, 0x1}) bind$bt_hci(r2, &(0x7f0000000000)={0x1f, 0xffff}, 0x4) setsockopt$packet_fanout_data(0xffffffffffffffff, 0x107, 0x16, &(0x7f0000000100)={0x1, &(0x7f0000000180)=[{0x1, 0x1}]}, 0x10) write$binfmt_misc(r2, &(0x7f0000000100), 0x6) r4 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) bind$bt_hci(r4, &(0x7f0000000080)={0x1f, 0xffffffffffffffff, 0x3}, 0x6) write(r4, &(0x7f0000000000)="2e000000010002", 0x404) r5 = socket$nl_route(0x10, 0x3, 0x0) r6 = inotify_init1(0x800) inotify_add_watch(r6, 0x0, 0xc0000484) r7 = seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0x0, &(0x7f0000000000)={0x1, &(0x7f0000000100)=[{0x6, 0x72, 0x0, 0x7fff0000}]}) close_range(r7, 0xffffffffffffffff, 0x0) ioctl$sock_SIOCETHTOOL(r5, 0x8946, &(0x7f0000000000)={'gretap0\x00', &(0x7f0000000080)=@ethtool_ts_info={0x3a}}) r8 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPSET_CMD_CREATE(r8, &(0x7f0000001780)={0x0, 0x0, &(0x7f0000000600)={&(0x7f0000001840)=ANY=[@ANYBLOB="540000000206010200000000000000000000000105000100070000000900020073797a30000000000c0007800500150001000000050004000000000010000300666173683a69702c6d616300050005000a000000"], 0x54}, 0x1, 0x0, 0x0, 0xc040}, 0x0) bpf$MAP_CREATE(0x0, &(0x7f0000000640)=ANY=[@ANYBLOB="160000000000000004000000ff"], 0x48) r9 = syz_open_procfs(0xffffffffffffffff, &(0x7f00000042c0)='fdinfo/3\x00') read$FUSE(r9, &(0x7f0000000080)={0x2020}, 0x2020) msgctl$MSG_INFO(0x0, 0xc, &(0x7f0000000000)=""/194) executing program 3: ptrace(0x10, 0x0) ptrace$setregs(0xd, 0x0, 0x0, &(0x7f00000003c0)="18607651149d7b10b4024fbbdc08899b8f589df2dbb5d7a8d1b36cfab675cb3976ee8100e2878c9cfa178cac130eb046eda93df39ed4b41924dc225ad4028dd63defb87d698be5c749450b350a789dcfc6b2d6a696b5026d1e52f19274566d1da0f353dd65e330ebf71c5e823f2753c5fd76724828ef31b353e71805205c3dceb44c") ptrace$getregset(0x4205, 0x0, 0x2, 0x0) ptrace$getregset(0x4204, 0x0, 0x2, 0x0) r0 = socket$inet_smc(0x2b, 0x1, 0x0) syz_emit_ethernet(0x1e, &(0x7f0000000480)={@link_local={0x1, 0x80, 0xc2, 0x0, 0x0, 0xe}, @remote, @void, {@can={0xc, {{0x2, 0x1, 0x1, 0x1}, 0x1, 0x7, 0x0, 0x0, "071e000046325f04"}}}}, 0x0) listen(r0, 0x5) ioctl$sock_SIOCOUTQNSD(r0, 0x8905, 0x0) r1 = syz_clone(0x0, 0x0, 0x0, 0x0, 0x0, 0x0) process_vm_writev(r1, &(0x7f0000001c80)=[{&(0x7f0000001bc0)=""/156, 0x9c}], 0x53, &(0x7f0000001d80)=[{&(0x7f0000001cc0)=""/109, 0x20001c34}], 0x1, 0x0) ptrace$ARCH_ENABLE_TAGGED_ADDR(0x1e, r1, 0x5, 0x4002) mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./sys\x00', 0x1ff) mount(0x0, &(0x7f0000000000)='./sys\x00', &(0x7f0000000100)='sysfs\x00', 0x10000, 0x0) openat(0xffffffffffffff9c, &(0x7f0000000280)='./sys/bus/usb/drivers/usbip-host/match_busid\x00', 0x1, 0x0) executing program 0: mkdirat(0xffffffffffffff9c, &(0x7f0000000340)='./file1\x00', 0x0) mount(0x0, &(0x7f0000000200)='./file1\x00', &(0x7f0000000000)='tmpfs\x00', 0x8, &(0x7f0000000300)='usrquota') chdir(&(0x7f00000000c0)='./file1\x00') r0 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000040)='net_prio.prioidx\x00', 0x275a, 0x0) quotactl_fd$Q_SETQUOTA(r0, 0xffffffff80000800, 0x0, &(0x7f0000000f80)={0x8000000000000000, 0x4, 0x100000001, 0x3, 0x24, 0xffffffffffffffff, 0x3, 0x4, 0x100fff}) socket(0x23, 0x2, 0x0) r1 = socket$can_raw(0x1d, 0x3, 0x1) setsockopt$CAN_RAW_ERR_FILTER(r1, 0x65, 0x2, &(0x7f0000000140)=0x9, 0x4) mkdir(&(0x7f0000000400)='./file0\x00', 0x114) mkdir(&(0x7f0000000440)='./file1\x00', 0x0) syz_emit_ethernet(0x6e, &(0x7f0000000300)={@local, @empty, @void, {@ipv6={0x86dd, @icmpv6={0x0, 0x6, '\x00', 0x38, 0x3a, 0xff, @remote, @local, {[], @pkt_toobig={0x2, 0x0, 0x0, 0x500, {0x0, 0x6, '\x00', 0x0, 0x6c, 0x40, @local, @remote, [], "3b00123400000000"}}}}}}}, 0x0) mkdir(&(0x7f0000000300)='./bus\x00', 0x0) mount$overlay(0x0, &(0x7f00000000c0)='./bus\x00', &(0x7f0000000080), 0x0, &(0x7f0000000400)={[{@upperdir={'upperdir', 0x3d, './file1'}}, {@lowerdir={'lowerdir', 0x3d, './file0'}}, {@workdir={'workdir', 0x3d, './bus'}}]}) creat(&(0x7f0000000080)='./file0/file1\x00', 0x90) chdir(&(0x7f0000000000)='./bus\x00') chown(&(0x7f00000001c0)='./file1\x00', 0x0, 0x0) executing program 4: r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000080), 0x0, 0x0) r2 = ioctl$KVM_CREATE_VM(r1, 0xae01, 0x0) ioctl$KVM_CREATE_IRQCHIP(r2, 0xae60) ioctl$KVM_CAP_X86_DISABLE_EXITS(r2, 0x4068aea3, &(0x7f0000000240)={0x8f, 0x0, 0x2}) r3 = ioctl$KVM_CREATE_VCPU(r2, 0xae41, 0x0) syz_kvm_setup_cpu$x86(r2, 0xffffffffffffffff, &(0x7f0000fe8000/0x18000)=nil, &(0x7f00000001c0)=[@text16={0x10, 0x0}], 0x1, 0x4, 0x0, 0x0) syz_kvm_setup_cpu$x86(0xffffffffffffffff, r3, &(0x7f0000c4a000/0x18000)=nil, &(0x7f0000000040)=[@text64={0x40, 0x0}], 0x1, 0x53, 0x0, 0x0) r4 = userfaultfd(0x801) ioctl$UFFDIO_API(r4, 0xc018aa3f, &(0x7f00000020c0)={0xaa, 0xbd}) ioctl$UFFDIO_REGISTER(r4, 0xc020aa00, &(0x7f0000000140)={{&(0x7f0000400000/0xc00000)=nil, 0xc00000}, 0x3}) ioctl$KVM_RUN(r3, 0xae80, 0x0) mq_unlink(&(0x7f0000000340)='/th0\x00') r5 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000000), r0) sendmsg$NL80211_CMD_FRAME(r0, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000fc0)={&(0x7f0000000600)=ANY=[@ANYBLOB='@\x00\x00\x00', @ANYRES16=r5, @ANYBLOB="010000000000000000000200000008000300", @ANYRES32, @ANYBLOB="0c0099"], 0x40}, 0x1, 0x0, 0x0, 0x8000}, 0x0) executing program 3: r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000240), 0xffffffffffffffff) sendmsg$NL80211_CMD_FRAME(r0, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000fc0)={&(0x7f0000000600)=ANY=[@ANYBLOB='@\x00\x00\x00', @ANYRES16=r1, @ANYBLOB="010000000000000000000200000008000300", @ANYRES32, @ANYBLOB="0c0099"], 0x40}, 0x1, 0x0, 0x0, 0x8000}, 0x0) program did not crash replaying the whole log did not cause a kernel crash single: executing 7 programs separately with timeout 6m0s testing program (duration=6m0s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): socket$nl_generic-syz_genetlink_get_family_id$nl80211-sendmsg$NL80211_CMD_FRAME detailed listing: executing program 0: r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000240), 0xffffffffffffffff) sendmsg$NL80211_CMD_FRAME(r0, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000fc0)={&(0x7f0000000600)=ANY=[@ANYBLOB='@\x00\x00\x00', @ANYRES16=r1, @ANYBLOB="010000000000000000000200000008000300", @ANYRES32, @ANYBLOB="0c0099"], 0x40}, 0x1, 0x0, 0x0, 0x8000}, 0x0) program did not crash testing program (duration=6m0s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): socket$nl_generic-openat$kvm-ioctl$KVM_CREATE_VM-ioctl$KVM_CREATE_IRQCHIP-ioctl$KVM_CAP_X86_DISABLE_EXITS-ioctl$KVM_CREATE_VCPU-syz_kvm_setup_cpu$x86-syz_kvm_setup_cpu$x86-userfaultfd-ioctl$UFFDIO_API-ioctl$UFFDIO_REGISTER-ioctl$KVM_RUN-mq_unlink-syz_genetlink_get_family_id$nl80211-sendmsg$NL80211_CMD_FRAME detailed listing: executing program 0: r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000080), 0x0, 0x0) r2 = ioctl$KVM_CREATE_VM(r1, 0xae01, 0x0) ioctl$KVM_CREATE_IRQCHIP(r2, 0xae60) ioctl$KVM_CAP_X86_DISABLE_EXITS(r2, 0x4068aea3, &(0x7f0000000240)={0x8f, 0x0, 0x2}) r3 = ioctl$KVM_CREATE_VCPU(r2, 0xae41, 0x0) syz_kvm_setup_cpu$x86(r2, 0xffffffffffffffff, &(0x7f0000fe8000/0x18000)=nil, &(0x7f00000001c0)=[@text16={0x10, 0x0}], 0x1, 0x4, 0x0, 0x0) syz_kvm_setup_cpu$x86(0xffffffffffffffff, r3, &(0x7f0000c4a000/0x18000)=nil, &(0x7f0000000040)=[@text64={0x40, 0x0}], 0x1, 0x53, 0x0, 0x0) r4 = userfaultfd(0x801) ioctl$UFFDIO_API(r4, 0xc018aa3f, &(0x7f00000020c0)={0xaa, 0xbd}) ioctl$UFFDIO_REGISTER(r4, 0xc020aa00, &(0x7f0000000140)={{&(0x7f0000400000/0xc00000)=nil, 0xc00000}, 0x3}) ioctl$KVM_RUN(r3, 0xae80, 0x0) mq_unlink(&(0x7f0000000340)='/th0\x00') r5 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000000), r0) sendmsg$NL80211_CMD_FRAME(r0, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000fc0)={&(0x7f0000000600)=ANY=[@ANYBLOB='@\x00\x00\x00', @ANYRES16=r5, @ANYBLOB="010000000000000000000200000008000300", @ANYRES32, @ANYBLOB="0c0099"], 0x40}, 0x1, 0x0, 0x0, 0x8000}, 0x0) program did not crash testing program (duration=6m0s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): mkdirat-mount-chdir-openat$cgroup_ro-quotactl_fd$Q_SETQUOTA-socket-socket$can_raw-setsockopt$CAN_RAW_ERR_FILTER-mkdir-mkdir-syz_emit_ethernet-mkdir-mount$overlay-creat-chdir-chown detailed listing: executing program 0: mkdirat(0xffffffffffffff9c, &(0x7f0000000340)='./file1\x00', 0x0) mount(0x0, &(0x7f0000000200)='./file1\x00', &(0x7f0000000000)='tmpfs\x00', 0x8, &(0x7f0000000300)='usrquota') chdir(&(0x7f00000000c0)='./file1\x00') r0 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000040)='net_prio.prioidx\x00', 0x275a, 0x0) quotactl_fd$Q_SETQUOTA(r0, 0xffffffff80000800, 0x0, &(0x7f0000000f80)={0x8000000000000000, 0x4, 0x100000001, 0x3, 0x24, 0xffffffffffffffff, 0x3, 0x4, 0x100fff}) socket(0x23, 0x2, 0x0) r1 = socket$can_raw(0x1d, 0x3, 0x1) setsockopt$CAN_RAW_ERR_FILTER(r1, 0x65, 0x2, &(0x7f0000000140)=0x9, 0x4) mkdir(&(0x7f0000000400)='./file0\x00', 0x114) mkdir(&(0x7f0000000440)='./file1\x00', 0x0) syz_emit_ethernet(0x6e, &(0x7f0000000300)={@local, @empty, @void, {@ipv6={0x86dd, @icmpv6={0x0, 0x6, '\x00', 0x38, 0x3a, 0xff, @remote, @local, {[], @pkt_toobig={0x2, 0x0, 0x0, 0x500, {0x0, 0x6, '\x00', 0x0, 0x6c, 0x40, @local, @remote, [], "3b00123400000000"}}}}}}}, 0x0) mkdir(&(0x7f0000000300)='./bus\x00', 0x0) mount$overlay(0x0, &(0x7f00000000c0)='./bus\x00', &(0x7f0000000080), 0x0, &(0x7f0000000400)={[{@upperdir={'upperdir', 0x3d, './file1'}}, {@lowerdir={'lowerdir', 0x3d, './file0'}}, {@workdir={'workdir', 0x3d, './bus'}}]}) creat(&(0x7f0000000080)='./file0/file1\x00', 0x90) chdir(&(0x7f0000000000)='./bus\x00') chown(&(0x7f00000001c0)='./file1\x00', 0x0, 0x0) program did not crash testing program (duration=6m0s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): openat$kvm-socket$inet_udp-ioctl$sock_ipv6_tunnel_SIOCGETPRL-ioctl$KVM_CREATE_VM-ioctl$KVM_SET_USER_MEMORY_REGION-syz_kvm_setup_cpu$x86-ioctl$KVM_CAP_DIRTY_LOG_RING_ACQ_REL-syz_kvm_add_vcpu$x86-ioctl$KVM_RUN-syz_kvm_setup_cpu$x86 detailed listing: executing program 0: r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000300), 0x900, 0x0) r1 = socket$inet_udp(0x2, 0x2, 0x0) ioctl$sock_ipv6_tunnel_SIOCGETPRL(r1, 0x89f4, &(0x7f0000000040)={'sit0\x00', 0x0}) r2 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) ioctl$KVM_SET_USER_MEMORY_REGION(r2, 0x4020ae46, &(0x7f0000000400)={0x0, 0x0, 0x0, 0x20002000, &(0x7f0000000000/0x2000)=nil}) syz_kvm_setup_cpu$x86(0xffffffffffffffff, 0xffffffffffffffff, &(0x7f0000000000/0x18000)=nil, &(0x7f0000000140)=[@text64={0x40, 0x0}], 0x1, 0xe8, 0x0, 0x0) ioctl$KVM_CAP_DIRTY_LOG_RING_ACQ_REL(r2, 0x4068aea3, &(0x7f00000000c0)={0xdf, 0x0, 0x1000}) syz_kvm_add_vcpu$x86(0x0, &(0x7f0000000980)={0x0, &(0x7f0000000440)=[@nested_load_code={0x12e, 0x79, {0x3, "c4a18172d401c744240022000000c744240281e9d8ffc7442406000000000f011c24c7442400a9000000c7442402f0a6d482ff1c24b964090000b80001c0feba000000000f300f320f01c3420f01f83e430f01cbc4a27d2014e966b85f000f00d0"}}], 0x79}) ioctl$KVM_RUN(0xffffffffffffffff, 0xae80, 0x0) syz_kvm_setup_cpu$x86(r2, 0xffffffffffffffff, &(0x7f0000000000/0x18000)=nil, &(0x7f0000000080)=[@text64={0x40, 0x0}], 0x1, 0x10, 0x0, 0x0) program did not crash testing program (duration=6m0s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): openat$kvm-socket$inet_udp-ioctl$sock_ipv6_tunnel_SIOCGETPRL-ioctl$KVM_CREATE_VM-ioctl$KVM_SET_USER_MEMORY_REGION-syz_kvm_setup_cpu$x86-ioctl$KVM_CAP_DIRTY_LOG_RING_ACQ_REL-syz_kvm_add_vcpu$x86-ioctl$KVM_RUN-syz_kvm_setup_cpu$x86 detailed listing: executing program 0: r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000300), 0x900, 0x0) r1 = socket$inet_udp(0x2, 0x2, 0x0) ioctl$sock_ipv6_tunnel_SIOCGETPRL(r1, 0x89f4, &(0x7f0000000040)={'sit0\x00', 0x0}) r2 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) ioctl$KVM_SET_USER_MEMORY_REGION(r2, 0x4020ae46, &(0x7f0000000400)={0x0, 0x0, 0x0, 0x20002000, &(0x7f0000000000/0x2000)=nil}) syz_kvm_setup_cpu$x86(0xffffffffffffffff, 0xffffffffffffffff, &(0x7f0000000000/0x18000)=nil, &(0x7f0000000140)=[@text64={0x40, 0x0}], 0x1, 0xe8, 0x0, 0x0) ioctl$KVM_CAP_DIRTY_LOG_RING_ACQ_REL(r2, 0x4068aea3, &(0x7f00000000c0)={0xdf, 0x0, 0x1000}) syz_kvm_add_vcpu$x86(0x0, &(0x7f0000000980)={0x0, &(0x7f0000000440)=[@nested_load_code={0x12e, 0x79, {0x3, "c4a18172d401c744240022000000c744240281e9d8ffc7442406000000000f011c24c7442400a9000000c7442402f0a6d482ff1c24b964090000b80001c0feba000000000f300f320f01c3420f01f83e430f01cbc4a27d2014e966b85f000f00d0"}}], 0x79}) ioctl$KVM_RUN(0xffffffffffffffff, 0xae80, 0x0) syz_kvm_setup_cpu$x86(r2, 0xffffffffffffffff, &(0x7f0000000000/0x18000)=nil, &(0x7f0000000080)=[@text64={0x40, 0x0}], 0x1, 0x10, 0x0, 0x0) program did not crash testing program (duration=6m0s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_genetlink_get_family_id$ipvs-socket$nl_route-sendmsg$nl_route-socket$nl_generic-sendmsg$IPVS_CMD_NEW_SERVICE detailed listing: executing program 0: r0 = syz_genetlink_get_family_id$ipvs(&(0x7f0000000040), 0xffffffffffffffff) r1 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r1, 0x0, 0x0) r2 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$IPVS_CMD_NEW_SERVICE(r2, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000080)={0x4c, r0, 0x1, 0x0, 0x0, {}, [@IPVS_CMD_ATTR_SERVICE={0x38, 0x1, 0x0, 0x1, [@IPVS_SVC_ATTR_AF={0x6, 0x1, 0x2}, @IPVS_SVC_ATTR_FWMARK={0x8, 0x5, 0x3}, @IPVS_SVC_ATTR_FLAGS={0xc, 0x7, {0x30000}}, @IPVS_SVC_ATTR_NETMASK={0x8}, @IPVS_SVC_ATTR_TIMEOUT={0x8, 0x8, 0x200}, @IPVS_SVC_ATTR_PE_NAME={0x8, 0x6}]}]}, 0x4c}}, 0x800c800) program did not crash testing program (duration=6m0s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_genetlink_get_family_id$ipvs-socket$nl_route-sendmsg$nl_route-socket$nl_generic-sendmsg$IPVS_CMD_NEW_SERVICE detailed listing: executing program 0: r0 = syz_genetlink_get_family_id$ipvs(&(0x7f0000000040), 0xffffffffffffffff) r1 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r1, 0x0, 0x0) r2 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$IPVS_CMD_NEW_SERVICE(r2, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000080)={0x4c, r0, 0x1, 0x0, 0x0, {}, [@IPVS_CMD_ATTR_SERVICE={0x38, 0x1, 0x0, 0x1, [@IPVS_SVC_ATTR_AF={0x6, 0x1, 0x2}, @IPVS_SVC_ATTR_FWMARK={0x8, 0x5, 0x3}, @IPVS_SVC_ATTR_FLAGS={0xc, 0x7, {0x30000}}, @IPVS_SVC_ATTR_NETMASK={0x8}, @IPVS_SVC_ATTR_TIMEOUT={0x8, 0x8, 0x200}, @IPVS_SVC_ATTR_PE_NAME={0x8, 0x6}]}]}, 0x4c}}, 0x800c800) program did not crash single: failed to extract reproducer bisect: bisecting 32 programs with base timeout 6m0s testing program (duration=6m8s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): [4, 30, 30, 30, 16, 5, 5, 16, 9, 10, 16, 5, 10, 10, 12, 5, 28, 3, 12, 2, 18, 30, 30, 11, 30, 7, 22, 27, 14, 16, 15, 3] detailed listing: executing program 2: writev(0xffffffffffffffff, &(0x7f00000003c0)=[{&(0x7f0000000180)="390000001300034700bb65e1c3e4ffff01000000010000005600000025000000190004000400000007fd17e5ffff080004", 0x31}], 0x1) r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$ethtool(&(0x7f0000000300), 0xffffffffffffffff) sendmsg$ETHTOOL_MSG_TSINFO_GET(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000180)=ANY=[@ANYBLOB='4\x00\x00\x00', @ANYRES16=r1, @ANYBLOB="010000000000000000001d00000020000180140002006e657464657673696d30000000000000080003"], 0x34}}, 0x44800) (fail_nth: 11) executing program 2: mkdirat(0xffffffffffffff9c, 0x0, 0x1ff) (async) openat$binderfs(0xffffffffffffff9c, &(0x7f0000000300)='./binderfs/binder0\x00', 0x0, 0x0) (async) openat$binderfs(0xffffffffffffff9c, &(0x7f0000000200)='./binderfs/binder0\x00', 0x0, 0x0) (async, rerun: 64) r0 = socket(0x11, 0x2, 0x10001) (rerun: 64) mmap$IORING_OFF_SQ_RING(0x0, 0xc, 0x2000002, 0x401d031, 0xffffffffffffffff, 0x0) (async) mkdirat(0xffffffffffffff9c, &(0x7f0000001500)='./dev\x00', 0x1ff) (async) r1 = syz_open_dev$tty1(0xc, 0x4, 0x1) ioctl$KDSKBENT(r1, 0x4b47, &(0x7f0000000080)={0x0, 0x7d, 0x20f}) mount(0x0, &(0x7f0000001500)='./dev\x00', &(0x7f0000001600)='ceph\x00', 0x800000, 0x0) (async) mkdirat(0xffffffffffffffff, &(0x7f00000002c0)='./dev\x00', 0x17f) socket$nl_generic(0x10, 0x3, 0x10) socket$inet(0x2, 0x2, 0x1) (async) socket$packet(0x11, 0x3, 0x300) socketpair$unix(0x1, 0x2, 0x0, 0x0) (async) mount(&(0x7f00000000c0)=@filename='./dev/sda1\x00', &(0x7f0000000140)='./mnt\x00', &(0x7f0000000100)='ext4\x00', 0x8410, 0x0) (async) mprotect(&(0x7f0000000000/0xf000)=nil, 0xf000, 0x1) r2 = openat$tun(0xffffffffffffff9c, &(0x7f0000000140), 0x0, 0x0) ioctl$TUNSETIFF(r2, 0x40e8662e, 0x0) (async, rerun: 64) r3 = socket$kcm(0x10, 0x2, 0x0) (rerun: 64) sendmsg$kcm(r3, &(0x7f00000003c0)={0x0, 0x0, &(0x7f0000000040)=[{&(0x7f0000000740)="2e00000010008188e6b62aa73f72cc9f0ba1f8481a0000005e140602000000000e000a00100000000a8000001294", 0x2e}], 0x1}, 0x0) (async) r4 = syz_ublk_setup_io_uring(0x1d, &(0x7f0000000040)={0x0, 0x0, 0x0, 0x0, 0x158}, &(0x7f0000000100)=0x0, &(0x7f0000000280)=0x0, &(0x7f0000001540)=0x0) (async) ioctl$sock_FIOGETOWN(0xffffffffffffffff, 0x8903, &(0x7f0000000000)=0x0) syz_ublk_add_dev(r4, r5, r6, r7, &(0x7f0000000140)={0x2e, 0x2, 0x0, 0xffffffffffffffff, 0xc0207504, 0x0, 0x0, 0x0, 0x1, 0x200, 0x0, 0x0, '\x00', {0xffffffff, 0xffff, 0x40, &(0x7f00000000c0)=@new_dev={0x4, 0x15, 0x0, 0x0, 0x1000, 0xffffffff, r8, 0x0, 0x31}}}, &(0x7f00000001c0)) syz_ublk_add_dev(r4, r5, r6, r7, &(0x7f0000000200)={0x2e, 0x0, 0x0, r9, 0xc0207504, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', {0xffffffff, 0xffff, 0x40, &(0x7f0000000440)=@any_dev={0x2, 0xe92, 0x0, 0x0, 0x1000, 0x10000, r8, 0x0, 0x1c8}}}, &(0x7f0000000300)=0x0) (async) syz_usb_control_io$lan78xx(0xffffffffffffffff, 0x0, &(0x7f0000000540)={0x34, 0x0, 0x0, &(0x7f0000000440)={0x0, 0x8, 0x1, 0x6}, 0x0, 0x0, 0x0}) (async) r11 = openat(0xffffffffffffff9c, &(0x7f000000c380)='./file0\x00', 0x20842, 0x63) syz_ublk_setup_queues(r11, r10, &(0x7f0000000340)={0x0, 0x0, 0x10, 0x1, 0x257}, &(0x7f0000000580)=[{0x0, 0x0, 0xffffffffffffffff, {0x0, 0xbb8b, 0x20, 0x1000000, 0x4}}, {0x0, 0x0, 0xffffffffffffffff, {0x0, 0x0, 0x800, 0x0, 0x22a}}, {0x0, 0x0, 0xffffffffffffffff, {0x0, 0x1f6d, 0x8c, 0x1, 0x0, 0x0, r0}}, {0x0, 0x0, 0xffffffffffffffff, {0x0, 0xb4ac, 0x4000, 0x0, 0x9d7c}}], 0x1, &(0x7f00000014c0)={0x2e, 0x0, 0x0, 0xffffffffffffffff, 0xc0107520, 0x0, 0x0, 0x0, 0x0, {}, 0x0, 0x0, '\x00', {0x1, 0x5, 0x0, 0x0}}, 0x0) (async) madvise(&(0x7f0000bdc000/0x4000)=nil, 0x86ac726dff2f4713, 0xa) syz_usb_disconnect(0xffffffffffffffff) syz_open_dev$ndb(&(0x7f0000000280), 0x0, 0x61c7c039d0921a4e) executing program 2: r0 = socket$nl_route(0x10, 0x3, 0x0) r1 = socket(0x10, 0x803, 0x0) sendmsg$nl_route(r1, &(0x7f00000006c0)={0x0, 0x0, &(0x7f0000000680)={0x0, 0x18}}, 0x0) getsockname$packet(r1, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) sendmsg$nl_route(r0, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000000)={&(0x7f00000002c0)=ANY=[@ANYBLOB="5000000010008105e9c51c000000000000000000", @ANYRES32=r2, @ANYRES64=r0], 0x50}, 0x1, 0x0, 0x0, 0x80}, 0x0) sendmsg$nl_route(0xffffffffffffffff, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000700)=@newlink={0x40, 0x10, 0x1, 0x1, 0x25dfdbff, {0x0, 0x0, 0x0, r2, 0x0, 0x8}, [@IFLA_LINKINFO={0x20, 0x12, 0x0, 0x1, @vlan={{0x9}, {0x10, 0x2, 0x0, 0x1, [@IFLA_VLAN_FLAGS={0xc, 0x2, {0x12, 0x1f}}]}}}]}, 0x40}, 0x1, 0x0, 0x0, 0x11}, 0x0) ioctl$sock_inet6_SIOCADDRT(0xffffffffffffffff, 0x890b, &(0x7f0000000380)={@local, @empty, @initdev={0xfe, 0x88, '\x00', 0x1, 0x0}, 0x3, 0x6, 0x5, 0x200, 0x4, 0x100020, r2}) mkdirat(0xffffffffffffff9c, &(0x7f0000000400)='./config\x00', 0x1ed) socket$nl_xfrm(0x10, 0x3, 0x6) mount(0x0, &(0x7f0000000500)='./config\x00', &(0x7f0000000600)='configfs\x00', 0x0, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000700)='./config/usb_gadget/g1\x00', 0x1ed) mkdirat(0xffffffffffffff9c, &(0x7f0000000c00)='./config/usb_gadget/g1/UDC\x00', 0x1c4) bpf$PROG_LOAD(0x5, 0x0, 0x0) socket(0x3d, 0x80000, 0x5) mkdirat(0xffffffffffffff9c, &(0x7f0000000d00)='./config/usb_gadget/g1/functions/uvc.usb0/control/header/h\x00', 0x1ed) r3 = openat$dir(0xffffffffffffff9c, 0x0, 0x400007, 0x2) readlinkat(r3, &(0x7f0000000040)='./config/usb_gadget/g1/configs/c.1/uvc.usb0\x00', 0x0, 0x0) symlinkat(&(0x7f0000000e00)='./config/usb_gadget/g1/functions/uvc.usb0/control/header/h\x00', 0xffffffffffffff9c, &(0x7f0000000f00)='./config/usb_gadget/g1/functions/uvc.usb0/control/class/fs/h\x00') symlinkat(0x0, 0xffffffffffffffff, 0x0) r4 = openat(0xffffffffffffff9c, &(0x7f0000002000)='./config/usb_gadget/g1/UDC\x00', 0x1, 0x0) write(r4, &(0x7f0000002100)='usbip-vudc.0', 0xc) r5 = socket$netlink(0x10, 0x3, 0x0) stat(&(0x7f00000001c0)='./config\x00', &(0x7f0000000200)) r6 = bpf$BPF_BTF_LOAD(0x12, &(0x7f0000000140)={&(0x7f0000000100)={{0xeb9f, 0x1, 0x0, 0x18, 0x0, 0x20, 0x20, 0x4, [@func={0x2, 0x0, 0x0, 0xc, 0x2}, @func_proto={0x0, 0x1, 0x0, 0xd, 0x0, [{}]}]}, {0x0, [0x0, 0x5f]}}, 0x0, 0x3c}, 0x28) bpf$PROG_LOAD_XDP(0x5, &(0x7f00000002c0)={0x6, 0x3, &(0x7f0000000000)=@framed={{0x18, 0x0, 0x0, 0x0, 0x7, 0x0, 0x0, 0x0, 0xc0}}, &(0x7f0000000080)='GPL\x00', 0xf, 0x0, 0x0, 0x40f00, 0x4, '\x00', 0x0, 0x25, r6, 0x8, &(0x7f0000000180)={0x0, 0x1}, 0x1, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0x4}, 0x94) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000040)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$sock_SIOCGIFINDEX(r7, 0x8933, &(0x7f0000000080)={'macsec0\x00', 0x0}) r9 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$inet6_buf(r9, 0x29, 0x20, &(0x7f00000000c0)="0bbb268dd6ffa80800000000000000000000210d0000aaa8fa017242ba9380d4", 0x20) sendmsg$nl_route(r5, &(0x7f00000000c0)={0x0, 0x0, &(0x7f00000002c0)={&(0x7f0000000000)=ANY=[@ANYBLOB="280000001d000100000000010000000007000000", @ANYRES32=r8, @ANYRESDEC=r5], 0x28}, 0x1, 0x0, 0x0, 0x4041}, 0x0) executing program 2: r0 = openat$ublk_ctrl(0xffffffffffffff9c, &(0x7f0000000000), 0x2, 0x0) r1 = syz_ublk_setup_io_uring(0x20, &(0x7f0000000040)={0x0, 0x5}, &(0x7f00000000c0)=0x0, &(0x7f0000000100)=0x0, &(0x7f0000000140)=0x0) r5 = socket$nl_generic(0x10, 0x3, 0x10) r6 = syz_genetlink_get_family_id$tipc(&(0x7f0000000080), r5) sendmsg$TIPC_CMD_ENABLE_BEARER(r5, &(0x7f0000000180)={0x0, 0x0, &(0x7f00000001c0)={&(0x7f0000000200)={0x38, r6, 0x1, 0x0, 0x25dfdbfe, {{}, {}, {0xfffffffffffffe56, 0x17, {0x17, 0x5, @l2={'eth', 0x3a, 'syzkaller0\x00'}}}}}, 0x38}}, 0x20008004) r7 = syz_ublk_add_dev(r1, r2, r3, r4, &(0x7f0000000200)={0x2e, 0x0, 0x0, r0, 0xc0207504, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', {0xffffffff, 0xffff, 0x40, &(0x7f0000000500)=@new_dev={0x1, 0x104, 0x0, 0x0, 0x1000, 0xffffffff, 0x0, 0x0, 0xc4ddfbc9bba2bdbf}}}, &(0x7f0000000300)=0x0) r10 = openat(0xffffffffffffff9c, &(0x7f00000002c0)='./sys/class/rnbd-client/ctl/map_device/file0\x00', 0x121001, 0x17c) write(r10, &(0x7f00000000c0)="736573736e616d653d7331206465766963655f706174683d2f6465762f72616d3020706174683d69703a3132372e302e302e315cdf903f3a85629410457af1eedc1b5b87feb6d6dff9cddbb5ac1cb03e2c", 0x51) r11 = openat$null(0xffffffffffffff9c, &(0x7f0000003040), 0x490540, 0x0) r12 = openat$selinux_enforce(0xffffffffffffff9c, &(0x7f00000030c0), 0x28041, 0x0) r13 = fsopen(&(0x7f00000001c0)='ramfs\x00', 0x0) mkdir(&(0x7f00000020c0)='./file0\x00', 0x1c8) mount$bind(&(0x7f0000000140)='./file0\x00', &(0x7f0000000000)='./file0/../file0\x00', 0x0, 0x315901c, 0x0) chroot(&(0x7f0000001140)='./file0\x00') mount$bind(&(0x7f0000000040)='.\x00', &(0x7f0000000180)='./file0\x00', 0x0, 0x2a05004, 0x0) pivot_root(&(0x7f00000000c0)='./file0\x00', &(0x7f0000000240)='./file0/../file0\x00') fsconfig$FSCONFIG_CMD_CREATE(r13, 0x6, 0x0, 0x0, 0x0) r14 = fsmount(r13, 0x1, 0x4) fchdir(r14) r15 = socket$inet6_tcp(0xa, 0x1, 0x0) r16 = open(&(0x7f00000000c0)='./file0\x00', 0x108843, 0x9a) fcntl$setlease(r16, 0x400, 0x1) openat(0xffffffffffffff9c, &(0x7f0000000000)='./file0\x00', 0x0, 0x0) fcntl$setlease(r16, 0x400, 0x0) getsockopt$inet6_tcp_int(r15, 0x6, 0x6, 0x0, &(0x7f0000000040)) bpf$PROG_LOAD(0x5, &(0x7f0000003140)={0x17, 0x1e, &(0x7f0000000340)=ANY=[@ANYBLOB="18000000090000000000000000020000064e08000100000018210000", @ANYRES32=r5, @ANYBLOB="000000000900000018210000", @ANYRES32=r5, @ANYBLOB="0000000000002c0018240000", @ANYRES32=0x1, @ANYBLOB="000000000700000018120000", @ANYRES32, @ANYBLOB="0000000000000000b7030000000000b70000000000000018110000", @ANYRES32=r10, @ANYBLOB="0000000000000000b70800000e0000007b8af8ff00000000bfa200000000000007020000f8ffffffb703000008000000b7040000000000008500000082000000186000000000000000000000040000001861000010000000000000001b060000186000000800000000000000000000009500000000000000"], &(0x7f0000000440)='syzkaller\x00', 0xff, 0x1000, &(0x7f0000002040)=""/4096, 0x40f00, 0x4, '\x00', 0x0, @cgroup_sysctl, r11, 0x8, &(0x7f0000003080)={0x8, 0x2}, 0x8, 0x10, 0x0, 0x0, 0x0, r12, 0x0, &(0x7f0000003100)=[r14], 0x0, 0x10, 0x65}, 0x94) r17 = syz_open_dev$ublk_chdev(&(0x7f0000002000), r7, 0x2) r18 = openat$iommufd(0xffffffffffffff9c, &(0x7f0000000080), 0x0, 0x0) ioctl$IOMMU_TEST_OP_MD_CHECK_MAP(r18, 0x3ba0, &(0x7f0000000800)={0x48, 0x12, 0x0, 0x0, 0x1004000, 0x0, 0x0}) syz_ublk_setup_queues(r17, r9, &(0x7f0000000540)={0x0, 0xfa81, 0x0, 0x3, 0x28e, 0x0, r1}, &(0x7f0000000880)=[{0x0, 0x0, 0xffffffffffffffff, {0x0, 0xb8c3, 0x1000, 0x2, 0x1af, 0x0, r1}}, {0x0, 0x0, 0xffffffffffffffff, {0x0, 0xddca, 0x2, 0x0, 0x330, 0x0, r1}}, {0x0, 0x0, 0xffffffffffffffff, {0x0, 0x766c, 0x8, 0x0, 0x2db, 0x0, r1}}, {0x0, 0x0, 0xffffffffffffffff, {0x0, 0x5027, 0x4, 0x0, 0x1fe}}], 0x4, &(0x7f0000001f40)={0x2e, 0x0, 0x0, r17, 0xc0107524, 0x0, 0x0, 0x0, 0x1, {0x10}, 0x0, r8, '\x00', {0x2, 0xb55, 0x0, 0x0}}, &(0x7f0000001fc0)) executing program 2: setsockopt$inet_mreqsrc(0xffffffffffffffff, 0x0, 0x27, &(0x7f0000000280)={@multicast2, @local, @remote}, 0xc) r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) r1 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000240), 0x0, 0x0) r2 = ioctl$KVM_CREATE_VM(r1, 0xae01, 0x0) ioctl$SG_IO(0xffffffffffffffff, 0x2285, &(0x7f0000000400)={0x53, 0xfffffffffffffffb, 0x0, 0x8, @buffer={0x0, 0x0, 0x0}, 0x0, 0x0, 0x0, 0x10011, 0xfffbffff, 0x0}) r3 = ioctl$KVM_CREATE_VCPU(r2, 0xae41, 0x0) ioctl$KVM_SET_USER_MEMORY_REGION(r2, 0x4020ae46, &(0x7f0000000180)={0x0, 0x0, 0x0, 0x2000, &(0x7f0000000000/0x2000)=nil}) ioctl$KVM_SET_REGS(r3, 0x4090ae82, &(0x7f0000000000)={[0x35, 0xfff, 0xfffffffffffffffe, 0x40000000000180, 0x2, 0x7, 0xf2, 0xd, 0x7fffffffffffe, 0x7, 0x5, 0xb, 0x7, 0xfffffffffffffff8, 0x9, 0xc], 0x25000, 0x304}) ioctl$KVM_RUN(r3, 0xae80, 0x0) r4 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) r5 = dup(r4) ioctl$KVM_SET_USER_MEMORY_REGION(r4, 0x4020ae46, &(0x7f0000000840)={0x1fe, 0x2, 0x3000, 0x2000, &(0x7f0000003000/0x2000)=nil}) r6 = ioctl$KVM_CREATE_VCPU(r5, 0xae41, 0x0) syz_kvm_setup_cpu$x86(0xffffffffffffffff, r6, &(0x7f0000000000/0x18000)=nil, &(0x7f0000000040)=[@text32={0x20, 0x0}], 0x1, 0x11, 0x0, 0x0) syz_kvm_setup_cpu$x86(r4, 0xffffffffffffffff, &(0x7f0000000000/0x18000)=nil, &(0x7f0000000200)=[@text32={0x20, 0x0}], 0x1, 0x50, 0x0, 0x0) ioctl$KVM_RUN(r6, 0xae80, 0x0) (fail_nth: 7) executing program 2: r0 = syz_genetlink_get_family_id$ipvs(&(0x7f0000000040), 0xffffffffffffffff) r1 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r1, 0x0, 0x0) r2 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$IPVS_CMD_NEW_SERVICE(r2, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000080)={0x4c, r0, 0x1, 0x0, 0x0, {}, [@IPVS_CMD_ATTR_SERVICE={0x38, 0x1, 0x0, 0x1, [@IPVS_SVC_ATTR_AF={0x6, 0x1, 0x2}, @IPVS_SVC_ATTR_FWMARK={0x8, 0x5, 0x3}, @IPVS_SVC_ATTR_FLAGS={0xc, 0x7, {0x30000}}, @IPVS_SVC_ATTR_NETMASK={0x8}, @IPVS_SVC_ATTR_TIMEOUT={0x8, 0x8, 0x200}, @IPVS_SVC_ATTR_PE_NAME={0x8, 0x6}]}]}, 0x4c}}, 0x800c800) executing program 32: r0 = syz_genetlink_get_family_id$ipvs(&(0x7f0000000040), 0xffffffffffffffff) r1 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r1, 0x0, 0x0) r2 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$IPVS_CMD_NEW_SERVICE(r2, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000080)={0x4c, r0, 0x1, 0x0, 0x0, {}, [@IPVS_CMD_ATTR_SERVICE={0x38, 0x1, 0x0, 0x1, [@IPVS_SVC_ATTR_AF={0x6, 0x1, 0x2}, @IPVS_SVC_ATTR_FWMARK={0x8, 0x5, 0x3}, @IPVS_SVC_ATTR_FLAGS={0xc, 0x7, {0x30000}}, @IPVS_SVC_ATTR_NETMASK={0x8}, @IPVS_SVC_ATTR_TIMEOUT={0x8, 0x8, 0x200}, @IPVS_SVC_ATTR_PE_NAME={0x8, 0x6}]}]}, 0x4c}}, 0x800c800) executing program 1: r0 = ioctl$KVM_CREATE_VM(0xffffffffffffffff, 0xae01, 0x0) syz_open_procfs$namespace(0x0, 0x0) ioctl$KVM_CREATE_PIT2(r0, 0x4040ae77, &(0x7f0000000280)={0x9}) r1 = ioctl$KVM_CREATE_VCPU(r0, 0xae41, 0x0) ioctl$KVM_SET_PIT(r0, 0x8048ae66, 0x0) ioctl$KVM_SET_USER_MEMORY_REGION(r0, 0x4020ae46, &(0x7f0000000180)={0x0, 0x0, 0x0, 0x2000, &(0x7f0000000000/0x2000)=nil}) r2 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r2, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000500)={&(0x7f0000000240)=@newlink={0x38, 0x10, 0x439, 0x70bd2c, 0xffffffea, {0x0, 0x0, 0xe403, 0x0, 0x40083, 0x715cb}, [@IFLA_LINKINFO={0x18, 0x12, 0x0, 0x1, @sit={{0x8}, {0xc, 0x2, 0x0, 0x1, [@IFLA_IPTUN_ENCAP_TYPE={0x6, 0xf, 0x3}]}}}]}, 0x38}, 0x1, 0x0, 0x0, 0x80d1}, 0x4084) ioctl$KVM_SET_REGS(r1, 0x4090ae82, &(0x7f00000003c0)={[0x60000000000, 0xd4, 0x0, 0x61, 0x200002000001, 0x0, 0x2004c8, 0x0, 0x0, 0x36ae, 0x4, 0x7fff, 0x3, 0x400000000], 0x80a0000}) bpf$BPF_BTF_LOAD(0x12, &(0x7f0000000300)={&(0x7f0000000380)=ANY=[@ANYBLOB="9feb010018000000000000000c000000"], 0x0, 0x26}, 0x28) ioctl$KVM_RUN(r1, 0xae80, 0x0) r3 = openat(0xffffffffffffff9c, &(0x7f0000000040)='./cgroup.cpu/memory.limit_in_bytes\x00', 0x2, 0x50) write$sysctl(r3, &(0x7f0000000100)='4\x00', 0x2) socket$kcm(0x10, 0x2, 0x0) socket$nl_route(0x10, 0x3, 0x0) write$RDMA_USER_CM_CMD_CREATE_ID(r3, &(0x7f0000000000)={0x0, 0x18, 0xfa00, {0xfeffffff, 0x0, 0x111}}, 0x20) executing program 1: bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000180)={0x11, 0x3, &(0x7f0000000040)=ANY=[], &(0x7f0000000080)='syzkaller\x00', 0x8, 0x0, 0x0, 0x41000}, 0x94) r0 = bpf$MAP_CREATE(0x0, &(0x7f0000000200)=ANY=[@ANYBLOB="2200000004"], 0x48) r1 = bpf$MAP_CREATE(0x0, &(0x7f0000000200)=ANY=[], 0x48) bpf$BPF_MAP_CONST_STR_FREEZE(0x16, &(0x7f0000000040)={r1, 0xffffffffffffffff}, 0x4) bpf$BPF_MAP_FREEZE(0x16, &(0x7f0000000000)=r1, 0x4) r3 = fcntl$dupfd(r2, 0x0, r0) mknod$loop(&(0x7f0000000140)='./file0\x00', 0xfff, 0x1) landlock_create_ruleset(&(0x7f0000000100)={0x100}, 0x6d, 0x0) bpf$MAP_LOOKUP_ELEM(0x1, &(0x7f0000000580)={r3, 0x0, 0x0}, 0x20) executing program 1: r0 = socket$netlink(0x10, 0x3, 0x0) r1 = socket(0x10, 0x803, 0x0) sendmsg$NL80211_CMD_CRIT_PROTOCOL_START(r1, &(0x7f0000000580)={0x0, 0x0, &(0x7f0000000540)={0x0, 0x1c}}, 0x0) getsockname$packet(r1, &(0x7f00000002c0)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f00000004c0)=0x68) sendmsg$nl_route(r0, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000640)=ANY=[@ANYBLOB="3c0000001000850600000000ff6122314a000800", @ANYRES32=r2, @ANYBLOB="f5ff0f00252155b21c0012000c000100626f6e64000000000c0002000800010001"], 0x3c}}, 0x40000) r3 = socket$netlink(0x10, 0x3, 0x0) r4 = socket(0x10, 0x803, 0x4) sendmsg$IPVS_CMD_SET_INFO(r4, &(0x7f0000000b00)={0x0, 0x0, &(0x7f0000000ac0)={0x0, 0x14}}, 0x0) getsockname$packet(r4, &(0x7f0000000340)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x66) sendmsg$nl_route(r3, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000001440)=@newlink={0x50, 0x10, 0xffffff1f, 0x0, 0x80, {0x0, 0x0, 0x0, 0x0, 0x300, 0x17e05}, [@IFLA_MASTER={0x8, 0xa, r5}, @IFLA_LINKINFO={0x28, 0x12, 0x0, 0x1, @veth={{0x9}, {0x18, 0x2, 0x0, 0x1, @val=@VETH_INFO_PEER={0x14, 0x1, {{0x0, 0x0, 0x20, 0x0, 0x4000, 0x640}}}}}}]}, 0x50}, 0x1, 0x0, 0x0, 0x2000c0c1}, 0x0) executing program 1: mkdirat(0xffffffffffffff9c, 0x0, 0x1ff) ioctl$DRM_IOCTL_GET_CLIENT(0xffffffffffffffff, 0xc0286405, &(0x7f0000000080)={0x9, 0x7, {}, {0xee00}, 0x3, 0x8}) syz_fuse_handle_req(0xffffffffffffffff, 0x0, 0x0, &(0x7f00000000c0)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f0000000200)={0x90, 0x0, 0xffffffffffffffff, {0xffffffffffffffff, 0x2, 0x101, 0x0, 0x0, 0x10000000, {0x40, 0xd08, 0x0, 0x100, 0x0, 0x0, 0x7, 0x0, 0x122, 0x6000, 0x10000, r0, 0x0, 0x902, 0x1}}}, 0x0, 0x0, 0x0, 0x0, 0x0}) r1 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000140), 0x0, 0x0) r2 = ioctl$KVM_CREATE_VM(r1, 0xae01, 0x0) mkdir(&(0x7f00000020c0)='./file0\x00', 0x1c8) mount$bind(&(0x7f0000000140)='./file0\x00', &(0x7f0000000000)='./file0/../file0\x00', 0x0, 0x315901c, 0x0) chroot(&(0x7f0000001140)='./file0\x00') mount$bind(&(0x7f0000000040)='.\x00', &(0x7f0000000080)='./file0\x00', 0x0, 0x2a05004, 0x0) pivot_root(&(0x7f00000000c0)='./file0/../file0\x00', &(0x7f0000000100)='./file0\x00') r3 = ioctl$KVM_CREATE_VCPU(r2, 0xae41, 0x0) ioctl$KVM_SET_MSRS(r3, 0xc008ae88, &(0x7f0000000040)={0x10000000000000cf, 0x0, [{0x8d}]}) r4 = syz_open_dev$cec(&(0x7f0000000200), 0xffffffffffffffff, 0x4ae60) ioctl$CEC_TRANSMIT(r4, 0xc0386105, &(0x7f0000000100)={0xfffffffffffffbf7, 0x1, 0x2, 0x0, 0x4, 0x7ffe, "7f2c00", 0xfe, 0x56, 0x1, 0xfa, 0x9, 0x1}) pipe2$9p(&(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}, 0x80) write$P9_RREADLINK(r5, &(0x7f0000000040)={0x10, 0x17, 0xc, {0x7, './file0'}}, 0x10) executing program 1: r0 = socket$inet_udp(0x2, 0x2, 0x0) r1 = openat$tun(0xffffffffffffff9c, &(0x7f0000000100), 0x2, 0x0) ioctl$TUNSETIFF(r1, 0x400454ca, &(0x7f0000000040)={'syzkaller0\x00', 0x4001}) ioctl$sock_inet_SIOCSIFFLAGS(r0, 0x8914, &(0x7f0000000200)={'syzkaller0\x00', 0x1}) write$tun(r1, &(0x7f0000000140)=ANY=[@ANYBLOB="0000080001000000000e140008004500003c000000004084ca2502020202ac140001"], 0x4a) executing program 1: r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000300), 0x900, 0x0) r1 = socket$inet_udp(0x2, 0x2, 0x0) ioctl$sock_ipv6_tunnel_SIOCGETPRL(r1, 0x89f4, &(0x7f0000000040)={'sit0\x00', 0x0}) r2 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) ioctl$KVM_SET_USER_MEMORY_REGION(r2, 0x4020ae46, &(0x7f0000000400)={0x0, 0x0, 0x0, 0x20002000, &(0x7f0000000000/0x2000)=nil}) syz_kvm_setup_cpu$x86(0xffffffffffffffff, 0xffffffffffffffff, &(0x7f0000000000/0x18000)=nil, &(0x7f0000000140)=[@text64={0x40, 0x0}], 0x1, 0xe8, 0x0, 0x0) ioctl$KVM_CAP_DIRTY_LOG_RING_ACQ_REL(r2, 0x4068aea3, &(0x7f00000000c0)={0xdf, 0x0, 0x1000}) syz_kvm_add_vcpu$x86(0x0, &(0x7f0000000980)={0x0, &(0x7f0000000440)=[@nested_load_code={0x12e, 0x79, {0x3, "c4a18172d401c744240022000000c744240281e9d8ffc7442406000000000f011c24c7442400a9000000c7442402f0a6d482ff1c24b964090000b80001c0feba000000000f300f320f01c3420f01f83e430f01cbc4a27d2014e966b85f000f00d0"}}], 0x79}) ioctl$KVM_RUN(0xffffffffffffffff, 0xae80, 0x0) syz_kvm_setup_cpu$x86(r2, 0xffffffffffffffff, &(0x7f0000000000/0x18000)=nil, &(0x7f0000000080)=[@text64={0x40, 0x0}], 0x1, 0x10, 0x0, 0x0) executing program 33: r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000300), 0x900, 0x0) r1 = socket$inet_udp(0x2, 0x2, 0x0) ioctl$sock_ipv6_tunnel_SIOCGETPRL(r1, 0x89f4, &(0x7f0000000040)={'sit0\x00', 0x0}) r2 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) ioctl$KVM_SET_USER_MEMORY_REGION(r2, 0x4020ae46, &(0x7f0000000400)={0x0, 0x0, 0x0, 0x20002000, &(0x7f0000000000/0x2000)=nil}) syz_kvm_setup_cpu$x86(0xffffffffffffffff, 0xffffffffffffffff, &(0x7f0000000000/0x18000)=nil, &(0x7f0000000140)=[@text64={0x40, 0x0}], 0x1, 0xe8, 0x0, 0x0) ioctl$KVM_CAP_DIRTY_LOG_RING_ACQ_REL(r2, 0x4068aea3, &(0x7f00000000c0)={0xdf, 0x0, 0x1000}) syz_kvm_add_vcpu$x86(0x0, &(0x7f0000000980)={0x0, &(0x7f0000000440)=[@nested_load_code={0x12e, 0x79, {0x3, "c4a18172d401c744240022000000c744240281e9d8ffc7442406000000000f011c24c7442400a9000000c7442402f0a6d482ff1c24b964090000b80001c0feba000000000f300f320f01c3420f01f83e430f01cbc4a27d2014e966b85f000f00d0"}}], 0x79}) ioctl$KVM_RUN(0xffffffffffffffff, 0xae80, 0x0) syz_kvm_setup_cpu$x86(r2, 0xffffffffffffffff, &(0x7f0000000000/0x18000)=nil, &(0x7f0000000080)=[@text64={0x40, 0x0}], 0x1, 0x10, 0x0, 0x0) executing program 0: r0 = io_uring_setup(0x2ac3, &(0x7f00000001c0)={0x0, 0x77b6, 0x0, 0x400000, 0xac}) r1 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r1, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000500)={&(0x7f00000002c0)=@newlink={0x3c, 0x10, 0x439, 0x70bd2d, 0x0, {}, [@IFLA_LINKINFO={0x1c, 0x12, 0x0, 0x1, @ipip6={{0xb}, {0xc, 0x2, 0x0, 0x1, [@IFLA_IPTUN_FWMARK={0x8, 0x14, 0x7}]}}}]}, 0x3c}}, 0x0) io_uring_setup(0x650b, 0x0) r2 = syz_open_dev$vim2m(&(0x7f0000000280), 0x4eb36, 0x2) ioctl$vim2m_VIDIOC_REQBUFS(r2, 0xc0145608, &(0x7f00000007c0)={0x1, 0x2, 0x1, 0x0, 0x8}) ioctl$vim2m_VIDIOC_QBUF(r2, 0xc058560f, &(0x7f00000002c0)=@multiplanar_mmap={0x0, 0x2, 0x0, 0xfdfd, 0x0, {}, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, "fafc00"}, 0x0, 0x1, {0x0}}) ioctl$BTRFS_IOC_QUOTA_RESCAN_WAIT(r0, 0x942e, 0x0) r3 = socket$netlink(0x10, 0x3, 0x0) sendmsg$nl_route(r3, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000001140)={&(0x7f0000000140)=@newlink={0x78, 0x10, 0x503, 0x0, 0x2, {0x0, 0x0, 0x0, 0x0, 0x0, 0x1244c}, [@IFLA_LINKINFO={0x58, 0x12, 0x0, 0x1, @vti={{0x8}, {0x4c, 0x2, 0x0, 0x1, [@IFLA_VTI_LOCAL={0x8, 0x4, @private=0xa010101}, @IFLA_VTI_REMOTE={0x8, 0x5, @private=0xa0100fe}, @IFLA_VTI_LOCAL={0x8, 0x4, @rand_addr=0x64010102}, @vti_common_policy=[@IFLA_VTI_FWMARK={0x8, 0x6, 0x2d616b45}, @IFLA_VTI_LINK={0x8}, @IFLA_VTI_IKEY={0x8, 0x2, 0x5}, @IFLA_VTI_FWMARK={0x8, 0x6, 0xe}, @IFLA_VTI_FWMARK={0x8, 0x6, 0x4}, @IFLA_VTI_IKEY={0x8, 0x2, 0x9}]]}}}]}, 0x78}}, 0x0) r4 = openat$procfs(0xffffffffffffff9c, &(0x7f0000000000)='/proc/cgroups\x00', 0x0, 0x0) setsockopt$MRT_DEL_MFC(r4, 0x0, 0xcd, &(0x7f0000000100)={@remote, @local, 0xffffffffffffffff, "497c62504d07e8fcbfc16eccdbef03f9a0fdc7265c6886e9b1b17fe65790058b", 0x200, 0xffff, 0x7ea3, 0xc6}, 0x3c) executing program 3: r0 = socket$unix(0x1, 0x5, 0x0) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000100)={'batadv0\x00', 0x0}) r2 = socket(0x10, 0x3, 0x0) sendmsg$nl_route_sched(r2, &(0x7f0000000200)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000300)=@newqdisc={0x88, 0x24, 0xf0b, 0x70bd26, 0x0, {0x0, 0x0, 0x0, r1, {0x0, 0xffff}, {0xffff, 0xffff}}, [@qdisc_kind_options=@q_mqprio={{0xb}, {0x58, 0x2, {{0x1, [], 0x0, [0x1, 0x2, 0xfffe, 0x0, 0x0, 0x0, 0x0, 0x8, 0x0, 0x5c4, 0x8000, 0x0, 0x0, 0x3dc], [0x0, 0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1000]}}}}]}, 0x88}}, 0x20000000) sendmsg$nl_route_sched(r2, &(0x7f00000012c0)={0x0, 0x0, &(0x7f0000000400)={&(0x7f0000000540)=@newqdisc={0x44, 0x24, 0x4ee4e6a52ff56541, 0x70bd29, 0xfffbffff, {0x0, 0x0, 0x0, r1, {0x0, 0x8}, {0xffff, 0xffff}, {0xc, 0xfff3}}, [@qdisc_kind_options=@q_taprio={{0xb}, {0x14, 0x2, [@TCA_TAPRIO_ATTR_SCHED_ENTRY_LIST={0x10, 0x2, 0x0, 0x1, [{0xc, 0x1, 0x0, 0x1, [@TCA_TAPRIO_SCHED_ENTRY_CMD={0x5, 0x2, 0x66}]}]}]}}]}, 0x44}, 0x1, 0xc000000, 0x0, 0x41}, 0x14) executing program 4: mknodat(0xffffffffffffff9c, &(0x7f0000000100)='./file2\x00', 0x81c0, 0x0) execveat(0xffffffffffffff9c, &(0x7f0000000280)='./file2\x00', 0x0, 0x0, 0x0) mknod$loop(&(0x7f0000000300)='./file0\x00', 0x6000, 0x0) unlink(&(0x7f0000000040)='./file0\x00') mknod$loop(&(0x7f0000000200)='./file0\x00', 0x2000, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./sys\x00', 0x1ff) mount(0x0, &(0x7f00000000c0)='./file1\x00', &(0x7f0000000040)='sysfs\x00', 0x0, 0x0) openat$binderfs(0xffffffffffffff9c, &(0x7f0000000300)='./binderfs/binder0\x00', 0x0, 0x0) openat$binderfs(0xffffffffffffff9c, &(0x7f0000000180)='./binderfs/binder1\x00', 0xc02, 0x0) syz_open_dev$sndpcmc(&(0x7f0000000000), 0x0, 0x0) socket(0x11, 0x2, 0x10001) mmap$IORING_OFF_SQ_RING(0x0, 0xc, 0x2000002, 0x401d031, 0xffffffffffffffff, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000001500)='./dev\x00', 0x1ff) openat(0xffffffffffffff9c, &(0x7f0000000240)='./file0\x00', 0x40042, 0x1) open(&(0x7f00009e1000)='./file0\x00', 0x8060, 0x0) mount(0x0, &(0x7f0000001500)='./dev\x00', &(0x7f0000001600)='devtmpfs\x00', 0x0, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000080)='./mnt\x00', 0x1ff) socket$nl_generic(0x10, 0x3, 0x10) socket$packet(0x11, 0x3, 0x300) socket$packet(0x11, 0x3, 0x300) socketpair$unix(0x1, 0x2, 0x0, 0x0) mount(&(0x7f00000000c0)=@filename='./dev/sda1\x00', &(0x7f0000000140)='./mnt\x00', &(0x7f0000000100)='ext4\x00', 0x8410, 0x0) mprotect(&(0x7f0000000000/0xf000)=nil, 0xf000, 0x1) r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000140), 0x0, 0x0) ioctl$TUNSETIFF(r0, 0x40e8662e, 0x0) r1 = openat(0xffffffffffffff9c, &(0x7f0000000400)='./sys/bus/pci/drivers/net2280/new_id\x00', 0x1, 0x0) write(r1, &(0x7f0000001100)='8086 29c0 ffffffff ffffffff 0 0 1', 0x21) syz_create_resource$binfmt(&(0x7f0000000080)='./sys/bus/pci/drivers/net2280/new_id\x00') executing program 0: r0 = socket$kcm(0x2, 0x3, 0x84) sendmmsg$inet(r0, &(0x7f0000006a80)=[{{&(0x7f0000000000)={0x2, 0x4e22, @dev={0xac, 0x14, 0x14, 0x18}}, 0x10, &(0x7f0000002ac0)=[{&(0x7f0000000080)="f982340819048e40ac0bd4474d", 0xd}], 0x1}}], 0x1, 0x8080) sendmsg$inet(r0, &(0x7f0000000a00)={&(0x7f0000000040)={0x2, 0x4e23, @remote}, 0x10, &(0x7f00000000c0)=[{&(0x7f0000000440)="c10900", 0x3}], 0x1}, 0x6000) executing program 4: syz_emit_ethernet(0x6a, &(0x7f0000000040)={@link_local={0x1, 0x80, 0xc2, 0x0, 0x0, 0x3}, @remote, @void, {@ipv4={0x800, @icmp={{0x5, 0x4, 0x0, 0x1, 0x5c, 0x0, 0x0, 0xfb, 0x1, 0x0, @initdev={0xac, 0x1e, 0x0, 0x0}, @local}, @time_exceeded={0x3, 0x1, 0x0, 0x3, 0x24, 0x0, {0x10, 0x4, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x1, 0x8, @loopback, @rand_addr=0x640100fe, {[@cipso={0x86, 0x29, 0xffffffffffffffff, [{0x0, 0xe, "08c82ce8da6ee06cb8dd9452"}, {0x5, 0x9, "020007651442eb"}, {0x1, 0x2}, {0x2, 0x7, "cf05003179"}, {0x0, 0x3, '\x00'}]}]}}}}}}}, 0x0) socketpair(0x1, 0x1, 0x0, &(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}) r2 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r3 = syz_genetlink_get_family_id$nbd(&(0x7f0000000040), r2) sendmsg$NBD_CMD_CONNECT(r2, &(0x7f0000000400)={0x0, 0x0, &(0x7f0000001a80)={&(0x7f0000000480)={0x5c, r3, 0x1, 0x70bd2c, 0xffe, {}, [@NBD_ATTR_SIZE_BYTES={0xc, 0x2, 0x2}, @NBD_ATTR_SOCKETS={0x28, 0x7, 0x0, 0x1, [{0xc, 0x1, 0x0, 0x1, {0x8, 0x1, r0}}, {0xc, 0x1, 0x0, 0x1, {0x8, 0x1, r0}}, {0xc, 0x1, 0x0, 0x1, {0x8, 0x1, r1}}]}, @NBD_ATTR_SERVER_FLAGS={0xc, 0x5, 0x128}, @NBD_ATTR_BACKEND_IDENTIFIER={0x8, 0xa, 'nbd\x00'}]}, 0x5c}}, 0x20000000) r4 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r5 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r6 = syz_genetlink_get_family_id$netlbl_mgmt(&(0x7f0000002180), r4) sendmsg$NLBL_MGMT_C_REMOVEDEF(r5, &(0x7f0000002240)={0x0, 0x0, &(0x7f0000002200)={&(0x7f00000021c0)={0x14, r6, 0x1, 0x70bd29, 0x25dfdbfd}, 0x14}, 0x1, 0x0, 0x0, 0x4000800}, 0x4000004) sendmsg$NLBL_MGMT_C_ADDDEF(r2, &(0x7f00000001c0)={&(0x7f00000000c0)={0x10, 0x0, 0x0, 0x4000}, 0xc, &(0x7f0000000180)={&(0x7f0000000140)={0x3c, r6, 0x200, 0x70bd2b, 0x25dfdbff, {}, [@NLBL_MGMT_A_DOMAIN={0x9, 0x1, '\xaa\xaa\xaa\xaa\xaa'}, @NLBL_MGMT_A_IPV4MASK={0x8, 0x8, @empty}, @NLBL_MGMT_A_IPV6ADDR={0x14, 0x5, @dev={0xfe, 0x80, '\x00', 0x19}}]}, 0x3c}, 0x1, 0x0, 0x0, 0x48000}, 0x4000000) seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0x0, &(0x7f0000000000)={0x1, &(0x7f0000000100)=[{0x6, 0x0, 0x0, 0x7fff0000}]}) socket(0x1, 0x80402, 0x7) executing program 3: r0 = openat$sysctl(0xffffffffffffff9c, &(0x7f0000000040)='/proc/sys/net/ipv4/tcp_mtu_probing\x00', 0x1, 0x0) pwritev(r0, &(0x7f0000000140), 0x15, 0x9, 0x1) executing program 0: r0 = socket$inet_udp(0x2, 0x2, 0x0) r1 = bpf$BPF_BTF_LOAD(0x12, &(0x7f0000000080)={&(0x7f0000000040)=ANY=[@ANYBLOB="9feb0100180000000000000020000000200000000400000001000000000000010400000020000000010000000000000108"], 0x0, 0x3c}, 0x28) r2 = bpf$MAP_CREATE(0x0, &(0x7f0000000200)=ANY=[@ANYBLOB="1c0000000400000008000000000000000100"/48, @ANYRES32=r1, @ANYBLOB="0100000002"], 0x40) bpf$MAP_LOOKUP_ELEM(0x1, &(0x7f0000000300)={r2, &(0x7f00000000c0)="8fa5", 0x0}, 0x20) setsockopt$IPT_SO_SET_REPLACE(r0, 0x0, 0x40, &(0x7f0000000000)=@raw={'raw\x00', 0x8, 0x3, 0x3c8, 0x0, 0xa, 0x148, 0x0, 0x10, 0x330, 0x2a8, 0x2a8, 0x330, 0x2a8, 0x3, 0x0, {[{{@ip={@rand_addr, @multicast1, 0x0, 0x0, 'bridge0\x00', 'rose0\x00'}, 0x0, 0x70, 0xe0, 0x0, {0x200003ae, 0x7f00}}, @common=@unspec=@NFLOG={0x70, 'NFLOG\x00', 0x0, {0x0, 0x0, 0x0, 0x0, 0x0, "f2f7b90ad2b60c45cb4ea6e7bf902bdc2ff8a9304d9f655c746adc0bdc773506378bc0d27efd6abb05175089830cc46186074d7de46d5af300"}}}, {{@ip={@empty, @local, 0x0, 0x0, 'ip6erspan0\x00', 'veth0_to_team\x00'}, 0x0, 0x1f0, 0x250, 0x0, {}, [@common=@inet=@hashlimit3={{0x158}, {'wg2\x00', {0xffffffffffffffff, 0xff, 0x0, 0x0, 0x0, 0x7fff, 0x200}}}, @inet=@rpfilter={{0x28}}]}, @common=@CLUSTERIP={0x60, 'CLUSTERIP\x00', 0x0, {0x1, @multicast, 0x2, 0x7, [0x0, 0x10, 0x1b, 0x2b, 0x37, 0x2e, 0x2b, 0x18, 0x2b, 0x34, 0xd, 0x0, 0x3d, 0x1, 0x32, 0x37], 0x1, 0x6, 0x1570000000000}}}], {{'\x00', 0xc8, 0x70, 0x98}, {0x28}}}}, 0x428) r3 = openat(0xffffffffffffff9c, &(0x7f0000000040)='./file1\x00', 0x542, 0x0) ioctl$SIOCX25SDTEFACILITIES(r3, 0x89eb, &(0x7f0000000080)={0x81, 0x962, 0x7, 0x7, 0x2, 0xd, 0x3, "4cb8b2a6146ab1a722e031cf656758ee56a018e7", "be634e4a96ef65eb0d23451a8d73bc095839f363"}) pwritev2(r3, &(0x7f00000000c0)=[{&(0x7f0000000300)=')', 0x1}], 0x1, 0x2, 0x0, 0xa1) r4 = syz_open_dev$I2C(&(0x7f0000000000), 0x1, 0x0) ioctl$I2C_PEC(r4, 0x708, 0x40) ioctl$I2C_SMBUS(r4, 0x720, &(0x7f00000002c0)={0x1, 0x7, 0x4, &(0x7f0000000280)={0x5, "1d27f0db2e1f25eff995475188afe0ebe9bab69516a5e88a718dca33021b22b650"}}) r5 = socket$nl_route(0x10, 0x3, 0x0) getsockopt$sock_int(r5, 0x1, 0xb, 0x0, &(0x7f0000000040)) socket$netlink(0x10, 0x3, 0x0) r6 = socket(0x10, 0x803, 0x0) sendmsg$IPVS_CMD_SET_INFO(r6, &(0x7f0000000b00)={0x0, 0x0, &(0x7f0000000ac0)={0x0, 0x14}}, 0x0) r7 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r7, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000240)={&(0x7f0000000180)=ANY=[@ANYBLOB="3c0000001000030400"/20, @ANYRES32=0x0, @ANYBLOB="a4280400000000001400350073797a5f74756e00000000000000000008000a00", @ANYRES32], 0x3c}}, 0x8000) executing program 4: bpf$MAP_CREATE(0x0, &(0x7f0000000000)=ANY=[@ANYBLOB="1400000007"], 0x50) r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000000), 0x40241, 0x0) r1 = socket$pppl2tp(0x18, 0x1, 0x1) r2 = socket$inet6_udp(0xa, 0x2, 0x0) r3 = socket$inet_tcp(0x2, 0x1, 0x0) bind$inet(r3, &(0x7f0000000040)={0x2, 0x4e21, @local}, 0x10) setsockopt$inet_tcp_int(0xffffffffffffffff, 0x6, 0x19, &(0x7f0000000240)=0x6, 0xfffffedf) setsockopt$inet_tcp_TCP_REPAIR_QUEUE(r3, 0x6, 0x14, &(0x7f0000000000)=0x2, 0x4) setsockopt$SO_TIMESTAMPING(r3, 0x1, 0x25, &(0x7f0000000200)=0x437b, 0x4) connect$inet(r3, &(0x7f0000000180)={0x2, 0x4e21, @local}, 0x10) setsockopt$inet_tcp_TCP_REPAIR_OPTIONS(r3, 0x6, 0x16, &(0x7f0000000340)=[@window={0x3, 0x1, 0x8}, @window={0x3, 0x6, 0x7}, @sack_perm, @window={0x3, 0x0, 0x4}, @mss={0x2, 0x4}, @timestamp, @window={0x3, 0x1, 0x10}, @sack_perm], 0x20000000000002a1) sendmsg$inet(r3, &(0x7f0000000300)={0x0, 0x0, &(0x7f0000000140)=[{&(0x7f0000000380)="9ad024c2775e1e2ab8e46a2877fcb21d4bb90500ebb1cfaea615b04f758b1754ce82525f728b072274a6388145b8991b4d0d7e9275d21e257816bb8650d21ba04ac83b4961e7b3a94d", 0x49}], 0x1}, 0x0) setsockopt$inet_tcp_TCP_REPAIR(r3, 0x6, 0x13, &(0x7f00000001c0), 0x4) sendto$inet(r3, &(0x7f00000004c0)='<', 0x381, 0x805, 0x0, 0x0) connect$pppl2tp(r1, &(0x7f0000000080)=@pppol2tpin6={0x18, 0x1, {0x0, r2, 0x6, 0x0, 0x0, 0x0, {0xa, 0x0, 0x0, @local}}}, 0x32) getsockopt$sock_buf(r1, 0x1, 0x1c, 0x0, &(0x7f0000000000)=0x3d) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000200)={'syzkaller1\x00', 0xc201}) r4 = socket$kcm(0x21, 0x2, 0xa) r5 = socket$inet6(0xa, 0x3, 0xff) setsockopt$inet6_int(r5, 0x29, 0x7, &(0x7f0000fcb000)=0xffffffff, 0x4) sendmsg$kcm(r4, &(0x7f0000000080)={&(0x7f0000000000)=@rxrpc=@in6={0x21, 0x1, 0x2, 0x1c, {0xa, 0x0, 0x4, @dev, 0x8000000}}, 0x80, 0x0, 0x0, &(0x7f00000000c0)=[{0x18, 0x110, 0x1, '\x00'}, {0x18, 0x110, 0xc, "aa"}], 0x30}, 0xfc40) r6 = socket$inet6_tcp(0xa, 0x1, 0x0) r7 = dup(r6) ioctl$TIOCSLCKTRMIOS(r7, 0x5457, &(0x7f00000000c0)) ioctl$SIOCSIFHWADDR(r7, 0x8914, &(0x7f0000000040)={'syzkaller1\x00', @link_local={0x1, 0x80, 0xc2, 0x0, 0x0, 0x3}}) write$tun(r0, &(0x7f0000000500)={@val={0x8, 0xc}, @val={0x2, 0x1, 0x4, 0x11, 0x9ca, 0x81}, @ipv4=@icmp={{0x20, 0x4, 0x1, 0x25, 0x94, 0x66, 0x0, 0xa8, 0x1, 0x0, @initdev={0xac, 0x1e, 0x1, 0x0}, @local, {[@ra={0x94, 0x4, 0x1}, @lsrr={0x83, 0x13, 0xa1, [@local, @dev={0xac, 0x14, 0x14, 0x3e}, @local, @multicast1]}, @timestamp_addr={0x44, 0x24, 0x1b, 0x1, 0x9, [{@loopback, 0x7}, {@loopback, 0x200}, {@multicast2}, {@multicast1, 0x4}]}, @cipso={0x86, 0x31, 0x2, [{0x1, 0xb, "b994131c56c477d6f5"}, {0x2, 0x12, "ef0500f6d000"/16}, {0x7, 0x6, "e8c2e380"}, {0x1, 0x8, "1e2d53d7cd98"}]}]}}, @timestamp={0xd, 0x0, 0x0, 0xc000, 0x4, 0x3, 0x401, 0x600}}}, 0xa2) creat(0x0, 0x0) sendto$packet(0xffffffffffffffff, &(0x7f0000000000)='1', 0x1, 0x4000800, 0x0, 0x0) r8 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) bind$bt_hci(r8, &(0x7f0000000040)={0x1f, 0xffff, 0x3}, 0x6) executing program 3: r0 = socket$nl_route(0x10, 0x3, 0x0) r1 = socket(0x10, 0x803, 0x0) sendmsg$nl_route(r1, &(0x7f00000006c0)={0x0, 0x0, &(0x7f0000000680)={0x0, 0x18}}, 0x0) getsockname$packet(r1, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) sendmsg$nl_route(r0, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000000)={&(0x7f00000002c0)=ANY=[@ANYBLOB="5000000010008105e9c51c000000000000000000", @ANYRES32=r2, @ANYBLOB="01000000000000002800128009000100766c616e000000001800028006000100000000000c0002000c0000000d00000008000500", @ANYRES64=r0], 0x50}, 0x1, 0x0, 0x0, 0x80}, 0x0) sendmsg$nl_route(0xffffffffffffffff, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000700)=@newlink={0x20, 0x10, 0x1, 0x1, 0x25dfdbff, {0x0, 0x0, 0x0, r2, 0x0, 0x8}}, 0x20}, 0x1, 0x0, 0x0, 0x11}, 0x0) ioctl$sock_inet6_SIOCADDRT(0xffffffffffffffff, 0x890b, &(0x7f0000000380)={@local, @empty, @initdev={0xfe, 0x88, '\x00', 0x1, 0x0}, 0x3, 0x6, 0x5, 0x200, 0x4, 0x100020, r2}) mkdirat(0xffffffffffffff9c, &(0x7f0000000400)='./config\x00', 0x1ed) socket$nl_xfrm(0x10, 0x3, 0x6) mount(0x0, &(0x7f0000000500)='./config\x00', &(0x7f0000000600)='configfs\x00', 0x0, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000700)='./config/usb_gadget/g1\x00', 0x1ed) mkdirat(0xffffffffffffff9c, &(0x7f0000000c00)='./config/usb_gadget/g1/UDC\x00', 0x1c4) bpf$PROG_LOAD(0x5, 0x0, 0x0) socket(0x3d, 0x80000, 0x5) mkdirat(0xffffffffffffff9c, &(0x7f0000000d00)='./config/usb_gadget/g1/functions/uvc.usb0/control/header/h\x00', 0x1ed) r3 = openat$dir(0xffffffffffffff9c, 0x0, 0x400007, 0x2) readlinkat(r3, &(0x7f0000000040)='./config/usb_gadget/g1/configs/c.1/uvc.usb0\x00', 0x0, 0x0) symlinkat(&(0x7f0000000e00)='./config/usb_gadget/g1/functions/uvc.usb0/control/header/h\x00', 0xffffffffffffff9c, &(0x7f0000000f00)='./config/usb_gadget/g1/functions/uvc.usb0/control/class/fs/h\x00') symlinkat(0x0, 0xffffffffffffffff, 0x0) r4 = openat(0xffffffffffffff9c, &(0x7f0000002000)='./config/usb_gadget/g1/UDC\x00', 0x1, 0x0) write(r4, &(0x7f0000002100)='usbip-vudc.0', 0xc) r5 = socket$netlink(0x10, 0x3, 0x0) stat(&(0x7f00000001c0)='./config\x00', &(0x7f0000000200)) r6 = bpf$BPF_BTF_LOAD(0x12, &(0x7f0000000140)={&(0x7f0000000100)={{0xeb9f, 0x1, 0x0, 0x18, 0x0, 0x20, 0x20, 0x4, [@func={0x2, 0x0, 0x0, 0xc, 0x2}, @func_proto={0x0, 0x1, 0x0, 0xd, 0x0, [{}]}]}, {0x0, [0x0, 0x5f]}}, 0x0, 0x3c}, 0x28) bpf$PROG_LOAD_XDP(0x5, &(0x7f00000002c0)={0x6, 0x3, &(0x7f0000000000)=@framed={{0x18, 0x0, 0x0, 0x0, 0x7, 0x0, 0x0, 0x0, 0xc0}}, &(0x7f0000000080)='GPL\x00', 0xf, 0x0, 0x0, 0x40f00, 0x4, '\x00', 0x0, 0x25, r6, 0x8, &(0x7f0000000180)={0x0, 0x1}, 0x1, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0x4}, 0x94) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000040)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$sock_SIOCGIFINDEX(r7, 0x8933, &(0x7f0000000080)={'macsec0\x00', 0x0}) r9 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$inet6_buf(r9, 0x29, 0x20, &(0x7f00000000c0)="0bbb268dd6ffa80800000000000000000000210d0000aaa8fa017242ba9380d4", 0x20) sendmsg$nl_route(r5, &(0x7f00000000c0)={0x0, 0x0, &(0x7f00000002c0)={&(0x7f0000000000)=ANY=[@ANYBLOB="280000001d000100000000010000000007000000", @ANYRES32=r8, @ANYRESDEC=r5], 0x28}, 0x1, 0x0, 0x0, 0x4041}, 0x0) executing program 0: mkdirat(0xffffffffffffff9c, &(0x7f00000000c0)='./file0\x00', 0x10) mkdirat(0xffffffffffffff9c, &(0x7f00000000c0)='./bus\x00', 0x1c5) mount$overlay(0x0, &(0x7f0000000100)='./file0\x00', &(0x7f0000000040), 0x8, &(0x7f0000000240)={[{@upperdir={'upperdir', 0x3d, './file0'}}, {@workdir={'workdir', 0x3d, './bus'}}, {@lowerdir={'lowerdir', 0x3d, '.'}}]}) socket$xdp(0x2c, 0x3, 0x0) r0 = socket$kcm(0x2c, 0x3, 0x0) close(r0) r1 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPCTNL_MSG_CT_GET(r1, &(0x7f0000000200)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000300)=ANY=[@ANYBLOB="ac0000000001050500000000000000000a0000003c0002802c00018014000300ff01000000000000000000000000000114000400ff0200000000000000000000000000010c00028005000100000000003c0001800c00028005000100000000002c00018014000300ff0200000000000000000000000000811400040000000000000000000001ffffac1e00010800074000000001180006801400040000000000000000000000000000000001"], 0xac}}, 0x0) sendmsg$IPCTNL_MSG_EXP_GET(r1, &(0x7f0000006680)={0x0, 0x0, &(0x7f0000006640)={&(0x7f00000065c0)=ANY=[@ANYBLOB="500000000102010100000000000000000a0000003c0001802c00018014000300ff01000000000000000000000000000114000400000000000000000000000000000000010c0002580500010000000000"], 0x50}, 0x1, 0x0, 0x0, 0x800}, 0x0) chdir(&(0x7f0000000000)='./file0\x00') mknod$loop(&(0x7f0000000000)='./file0aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa\x00', 0x2000, 0x1) executing program 4: setsockopt$inet_mreqsrc(0xffffffffffffffff, 0x0, 0x27, &(0x7f0000000280)={@multicast2, @local, @remote}, 0xc) r0 = socket(0x1, 0x803, 0x0) r1 = socket$nl_route(0x10, 0x3, 0x0) getsockname$packet(r0, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f00000002c0)=0x14) sendmsg$nl_route(r1, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000340)=ANY=[@ANYBLOB="540000001000010400"/20, @ANYRES32=0x0, @ANYBLOB="00000000000000002c0012800e0001006970366772657461700000001800028014000700ff01000000000000000000000000000108000a00", @ANYRES32=r2], 0x54}}, 0x0) setsockopt$inet_IP_XFRM_POLICY(0xffffffffffffffff, 0x0, 0x11, &(0x7f00000005c0)={{{@in6=@local, @in=@broadcast, 0x4e23, 0x6, 0x4e24, 0x0, 0x0, 0x0, 0x80, 0x8, r2, 0xee01}, {0x8, 0x8, 0x791a, 0x69, 0xf07a, 0x7, 0xbf9, 0x2}, {0x0, 0x40, 0x0, 0x3}, 0x4f55945f, 0x6e6bc0, 0x0, 0x1}, {{@in6=@ipv4={'\x00', '\xff\xff', @rand_addr=0x64010100}, 0x4d2, 0xff}, 0xa, @in6=@ipv4={'\x00', '\xff\xff', @local}, 0x3507, 0x0, 0x0, 0x0, 0x9, 0x10001, 0x9bde}}, 0xe8) r3 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) r4 = ioctl$KVM_CREATE_VM(r3, 0xae01, 0x2a) ioctl$KVM_SET_USER_MEMORY_REGION(r4, 0x4020ae46, &(0x7f0000000100)={0x4, 0x1, 0xffff1000, 0x1000, &(0x7f0000012000/0x1000)=nil}) r5 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000240), 0x0, 0x0) r6 = ioctl$KVM_CREATE_VM(r5, 0xae01, 0x0) ioctl$SG_IO(0xffffffffffffffff, 0x2285, &(0x7f0000000400)={0x53, 0xfffffffffffffffb, 0x5, 0x8, @buffer={0x0, 0x0, 0x0}, &(0x7f0000000200)="0004000019", 0x0, 0x0, 0x10011, 0xfffbffff, 0x0}) r7 = ioctl$KVM_CREATE_VCPU(r6, 0xae41, 0x0) ioctl$KVM_SET_USER_MEMORY_REGION(r6, 0x4020ae46, &(0x7f0000000180)={0x0, 0x0, 0x0, 0x2000, &(0x7f0000000000/0x2000)=nil}) ioctl$KVM_SET_REGS(r7, 0x4090ae82, &(0x7f0000000000)={[0x35, 0xfff, 0xfffffffffffffffe, 0x40000000000180, 0x2, 0x7, 0xf2, 0xd, 0x7fffffffffffe, 0x7, 0x5, 0xb, 0x7, 0xfffffffffffffff8, 0x9, 0xc], 0x25000, 0x304}) r8 = syz_ublk_setup_io_uring(0x20, &(0x7f0000000340)={0x0, 0x0, 0x100, 0x2, 0x1e5}, &(0x7f0000000000)=0x0, &(0x7f0000000040)=0x0, &(0x7f0000000980)=0x0) syz_io_uring_submit(r9, r10, r11, &(0x7f00000004c0)=@IORING_OP_RENAMEAT={0x23, 0xe, 0x0, 0xffffffffffffffff, &(0x7f0000000540)='./file0\x00', &(0x7f0000000580)='./file0\x00'}) unshare(0x22060600) syz_ublk_add_dev(r8, r9, r10, r11, &(0x7f00000000c0)={0x2e, 0x9, 0x0, r8, 0xc0207504, 0x0, 0x0, 0x0, 0x0, 0x800, 0x0, 0x0, '\x00', {0xffffffff, 0xffff, 0x40, &(0x7f0000000080)=@any_dev={0x1, 0xe8d, 0x0, 0x0, 0x1000, 0x1}}}, &(0x7f0000000180)) ioctl$KVM_RUN(r7, 0xae80, 0x0) r12 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$nl_generic(r12, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000140)={&(0x7f00000004c0)=ANY=[@ANYBLOB="18000000260001031dbd7002fadbdf25010000000400ae"], 0x18}}, 0x0) recvmmsg(r12, &(0x7f0000000800)=[{{0x0, 0x0, &(0x7f00000009c0)=[{&(0x7f0000000500)=""/140, 0x8c}, {&(0x7f0000000a40)=""/4148, 0xdf0}, {&(0x7f0000000040)=""/184, 0xb8}, {&(0x7f0000003800)=""/4104, 0x1008}, {&(0x7f0000000280)=""/65, 0x41}, {&(0x7f0000000200)=""/36, 0x24}], 0x6}, 0xd}, {{0x0, 0x0, 0x0}, 0x8}, {{0x0, 0x0, 0x0}, 0x38000000}, {{0x0, 0x0, 0x0}}], 0x4, 0x40000102, 0x0) r13 = ioctl$KVM_CREATE_VM(r3, 0xae01, 0x0) r14 = dup(r13) ioctl$KVM_SET_USER_MEMORY_REGION(r13, 0x4020ae46, &(0x7f0000000840)={0x1fe, 0x2, 0x3000, 0x2000, &(0x7f0000003000/0x2000)=nil}) r15 = ioctl$KVM_CREATE_VCPU(r14, 0xae41, 0x2001) syz_kvm_setup_cpu$x86(0xffffffffffffffff, r15, &(0x7f0000000000/0x18000)=nil, &(0x7f0000000040)=[@text32={0x20, 0x0}], 0x1, 0x11, 0x0, 0x0) syz_kvm_setup_cpu$x86(r13, 0xffffffffffffffff, &(0x7f0000000000/0x18000)=nil, &(0x7f0000000200)=[@text32={0x20, 0x0}], 0x1, 0x50, 0x0, 0x0) ioctl$KVM_RUN(r15, 0xae80, 0x0) executing program 3: r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000300), 0x900, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) ioctl$KVM_SET_USER_MEMORY_REGION(r1, 0x4020ae46, &(0x7f0000000400)={0x0, 0x0, 0x0, 0x20002000, &(0x7f0000000000/0x2000)=nil}) r2 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0) syz_kvm_setup_cpu$x86(0xffffffffffffffff, r2, &(0x7f0000000000/0x18000)=nil, &(0x7f0000000140)=[@text64={0x40, 0x0}], 0x1, 0xe8, 0x0, 0x0) sendmsg$kcm(0xffffffffffffffff, &(0x7f0000000000)={0x0, 0x0, 0x0}, 0x0) ioctl$KVM_RUN(r2, 0xae80, 0x0) (fail_nth: 14) executing program 0: sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000280)={&(0x7f0000000600)=@deltfilter={0x24, 0x2d, 0x300, 0x70bd2d, 0x25dfdbfd, {0x0, 0x0, 0x0, 0x0, {0x2, 0x2}, {0x9, 0xe}, {0x8, 0xffe0}}}, 0x24}}, 0x10) r0 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r0, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000240)=ANY=[@ANYBLOB="140000001000010000000000000000000500000a28000000000a030000000000000000000a00000708000240000000020900010073797a31000000002c000000030a010100000000000000000a0000070900010073797a31000000000900030073797a320000000014000000110001"], 0x7c}, 0x1, 0x0, 0x0, 0x4000}, 0x0) sendmsg$NFT_BATCH(r0, &(0x7f0000009b40)={0x0, 0x0, &(0x7f0000009b00)={&(0x7f0000000100)={{0x14, 0x10, 0x1, 0x0, 0x0, {0x5}}, [@NFT_MSG_NEWRULE={0x44, 0x6, 0xa, 0x401, 0x0, 0x0, {0xa, 0x0, 0x7}, [@NFTA_RULE_TABLE={0x9, 0x1, 'syz1\x00'}, @NFTA_RULE_EXPRESSIONS={0x18, 0x4, 0x0, 0x1, [{0x14, 0x1, 0x0, 0x1, @xfrm={{0x9}, @val={0x4}}}]}, @NFTA_RULE_CHAIN={0x9, 0x2, 'syz2\x00'}]}], {0x14, 0x11, 0x1, 0x0, 0x0, {0x1}}}, 0x6c}, 0x1, 0x0, 0x0, 0x204c054}, 0x20040040) r1 = socket$rds(0x15, 0x5, 0x0) bind$rds(r1, &(0x7f0000000840)={0x2, 0x0, @loopback}, 0x10) r2 = ioctl$KVM_CREATE_VM(0xffffffffffffffff, 0xae01, 0x36) ioctl$KVM_CREATE_VCPU(r2, 0xae41, 0x2) r3 = syz_open_dev$sndpcmc(&(0x7f0000000000), 0xb, 0x0) ioctl$SNDRV_PCM_IOCTL_HW_REFINE(r3, 0xc2604110, &(0x7f0000000040)={0x0, [[0x9ef8, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7fffffff], [0x10000, 0x0, 0x0, 0x0, 0x8001], [0x6, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0xffffffff]], '\x00', [{}, {0xfffffffd}, {}, {0x0, 0x0, 0x0, 0x1, 0x1}, {0x5, 0x0, 0x0, 0x1, 0x1}, {0x7fff, 0xfffffffa}, {}, {0x7fffffc, 0x8f96}, {}, {}, {0x0, 0xffffffff}, {0x8000}], '\x00', 0x7fffffff}) sendmsg$rds(r1, &(0x7f0000000740)={&(0x7f0000000040)={0x2, 0x4e23, @local}, 0x10, 0x0, 0x0, &(0x7f0000000100)=[@cswp={0x58, 0x114, 0x7, {{0x5, 0x2}, 0x0, 0x0, 0x5eae, 0x0, 0xd, 0x9, 0x2, 0x9}}], 0x58}, 0x0) sendmsg$nl_route(0xffffffffffffffff, &(0x7f0000000300)={0x0, 0x0, &(0x7f0000000080)={0x0, 0x48}, 0x1, 0x0, 0x0, 0x10}, 0x0) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000100)=@newqdisc={0x44, 0x24, 0x108, 0x0, 0x65dfdbfb, {0x0, 0x0, 0x0, 0x0, {0xffff, 0xffe0}, {0xffff, 0x7ff8}, {0xfff2}}, [@qdisc_kind_options=@q_fq_pie={{0xb}, {0x14, 0x8002, [@TCA_FQ_PIE_BYTEMODE={0x8}, @TCA_FQ_PIE_QUANTUM={0x8, 0x7, 0xffffff22}]}}]}, 0x44}, 0x1, 0x0, 0x0, 0x1}, 0x0) mmap(&(0x7f0000ffc000/0x4000)=nil, 0x4000, 0x8, 0x8010, r1, 0x14c66000) sendmsg$nl_route(0xffffffffffffffff, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000100)=ANY=[@ANYBLOB="500000001000010425bbe5ad600027842cf52300", @ANYRES32=0x0, @ANYBLOB="0000000000008000280012800a00010076786c616e00"], 0x50}}, 0x4008840) r4 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFULNL_MSG_CONFIG(r4, &(0x7f0000000400)={&(0x7f0000000440)={0x10, 0x0, 0x0, 0x400}, 0xc, &(0x7f00000003c0)={&(0x7f0000000340)={0x68, 0x1, 0x4, 0x201, 0x0, 0x0, {0x2}, [@NFULA_CFG_FLAGS={0x6, 0x6, 0x1, 0x0, 0x4}, @NFULA_CFG_NLBUFSIZ={0x8, 0x3, 0x1, 0x0, 0x5}, @NFULA_CFG_MODE={0xa, 0x2, {0x85}}, @NFULA_CFG_QTHRESH={0x8, 0x5, 0x1, 0x0, 0x1e8f352f}, @NFULA_CFG_TIMEOUT={0x8, 0x4, 0x1, 0x0, 0x7ff}, @NFULA_CFG_CMD={0x5, 0x1, 0x1}, @NFULA_CFG_QTHRESH={0x8, 0x5, 0x1, 0x0, 0x1}, @NFULA_CFG_MODE={0xa, 0x2, {0x1}}, @NFULA_CFG_MODE={0xa, 0x2, {0x4}}]}, 0x68}, 0x1, 0x0, 0x0, 0x4040000}, 0x10) mount$tmpfs(0x0, &(0x7f00000000c0)='./file0\x00', &(0x7f00000001c0), 0x10810, &(0x7f0000000200)={[{@usrquota_block_hardlimit={'usrquota_block_hardlimit', 0x3d, [0x25, 0x6d]}}], [{@rootcontext={'rootcontext', 0x3d, 'user_u'}}, {@subj_user={'subj_user', 0x3d, '@!@'}}]}) r5 = syz_io_uring_complete(0x0, 0x0) ioctl$sock_inet6_tcp_SIOCOUTQ(r5, 0x5411, &(0x7f0000000480)) r6 = socket$netlink(0x10, 0x3, 0x0) sendmmsg(r6, &(0x7f00000002c0), 0x40000000000009f, 0x0) executing program 4: r0 = openat$iommufd(0xffffffffffffff9c, &(0x7f0000000180), 0x0, 0x0) ioctl$IOMMU_IOAS_ALLOC(r0, 0x3b81, &(0x7f0000000100)={0xc, 0x0, 0x0}) ioctl$IOMMU_TEST_OP_MOCK_DOMAIN_FLAGS(r0, 0x3ba0, &(0x7f0000000240)={0x48, 0x2, r1, 0x0, 0x0, 0x0, 0x0, 0x1}) ioctl$IOMMU_IOAS_MAP$PAGES(r0, 0x3b85, &(0x7f00000007c0)={0x28, 0x5, r1, 0x0, &(0x7f00002ce000/0x1000)=nil, 0x1000, 0x1020800}) r2 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) keyctl$set_reqkey_keyring(0x5, 0xfffffffe) request_key(&(0x7f0000000480)='cifs.spnego\x00', &(0x7f00000004c0)={'syz', 0x3}, &(0x7f0000000500)='key_or_keyring:', 0x0) ioctl$IOMMU_VFIO_IOAS$GET(r0, 0x3b88, &(0x7f0000000140)={0xc, 0x0}) ioctl$IOMMU_TEST_OP_MOCK_DOMAIN_FLAGS(r0, 0x3ba0, &(0x7f00000001c0)={0x48, 0x2, r3, 0x0, 0x0, 0x0, 0x0, 0x1}) bind$bt_hci(r2, &(0x7f0000000000)={0x1f, 0xffff}, 0x4) setsockopt$packet_fanout_data(0xffffffffffffffff, 0x107, 0x16, &(0x7f0000000100)={0x1, &(0x7f0000000180)=[{0x1, 0x1}]}, 0x10) write$binfmt_misc(r2, &(0x7f0000000100), 0x6) r4 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) bind$bt_hci(r4, &(0x7f0000000080)={0x1f, 0xffffffffffffffff, 0x3}, 0x6) write(r4, &(0x7f0000000000)="2e000000010002", 0x404) r5 = socket$nl_route(0x10, 0x3, 0x0) r6 = inotify_init1(0x800) inotify_add_watch(r6, 0x0, 0xc0000484) r7 = seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0x0, &(0x7f0000000000)={0x1, &(0x7f0000000100)=[{0x6, 0x72, 0x0, 0x7fff0000}]}) close_range(r7, 0xffffffffffffffff, 0x0) ioctl$sock_SIOCETHTOOL(r5, 0x8946, &(0x7f0000000000)={'gretap0\x00', &(0x7f0000000080)=@ethtool_ts_info={0x3a}}) r8 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPSET_CMD_CREATE(r8, &(0x7f0000001780)={0x0, 0x0, &(0x7f0000000600)={&(0x7f0000001840)=ANY=[@ANYBLOB="540000000206010200000000000000000000000105000100070000000900020073797a30000000000c0007800500150001000000050004000000000010000300666173683a69702c6d616300050005000a000000"], 0x54}, 0x1, 0x0, 0x0, 0xc040}, 0x0) bpf$MAP_CREATE(0x0, &(0x7f0000000640)=ANY=[@ANYBLOB="160000000000000004000000ff"], 0x48) r9 = syz_open_procfs(0xffffffffffffffff, &(0x7f00000042c0)='fdinfo/3\x00') read$FUSE(r9, &(0x7f0000000080)={0x2020}, 0x2020) msgctl$MSG_INFO(0x0, 0xc, &(0x7f0000000000)=""/194) executing program 3: ptrace(0x10, 0x0) ptrace$setregs(0xd, 0x0, 0x0, &(0x7f00000003c0)="18607651149d7b10b4024fbbdc08899b8f589df2dbb5d7a8d1b36cfab675cb3976ee8100e2878c9cfa178cac130eb046eda93df39ed4b41924dc225ad4028dd63defb87d698be5c749450b350a789dcfc6b2d6a696b5026d1e52f19274566d1da0f353dd65e330ebf71c5e823f2753c5fd76724828ef31b353e71805205c3dceb44c") ptrace$getregset(0x4205, 0x0, 0x2, 0x0) ptrace$getregset(0x4204, 0x0, 0x2, 0x0) r0 = socket$inet_smc(0x2b, 0x1, 0x0) syz_emit_ethernet(0x1e, &(0x7f0000000480)={@link_local={0x1, 0x80, 0xc2, 0x0, 0x0, 0xe}, @remote, @void, {@can={0xc, {{0x2, 0x1, 0x1, 0x1}, 0x1, 0x7, 0x0, 0x0, "071e000046325f04"}}}}, 0x0) listen(r0, 0x5) ioctl$sock_SIOCOUTQNSD(r0, 0x8905, 0x0) r1 = syz_clone(0x0, 0x0, 0x0, 0x0, 0x0, 0x0) process_vm_writev(r1, &(0x7f0000001c80)=[{&(0x7f0000001bc0)=""/156, 0x9c}], 0x53, &(0x7f0000001d80)=[{&(0x7f0000001cc0)=""/109, 0x20001c34}], 0x1, 0x0) ptrace$ARCH_ENABLE_TAGGED_ADDR(0x1e, r1, 0x5, 0x4002) mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./sys\x00', 0x1ff) mount(0x0, &(0x7f0000000000)='./sys\x00', &(0x7f0000000100)='sysfs\x00', 0x10000, 0x0) openat(0xffffffffffffff9c, &(0x7f0000000280)='./sys/bus/usb/drivers/usbip-host/match_busid\x00', 0x1, 0x0) executing program 0: mkdirat(0xffffffffffffff9c, &(0x7f0000000340)='./file1\x00', 0x0) mount(0x0, &(0x7f0000000200)='./file1\x00', &(0x7f0000000000)='tmpfs\x00', 0x8, &(0x7f0000000300)='usrquota') chdir(&(0x7f00000000c0)='./file1\x00') r0 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000040)='net_prio.prioidx\x00', 0x275a, 0x0) quotactl_fd$Q_SETQUOTA(r0, 0xffffffff80000800, 0x0, &(0x7f0000000f80)={0x8000000000000000, 0x4, 0x100000001, 0x3, 0x24, 0xffffffffffffffff, 0x3, 0x4, 0x100fff}) socket(0x23, 0x2, 0x0) r1 = socket$can_raw(0x1d, 0x3, 0x1) setsockopt$CAN_RAW_ERR_FILTER(r1, 0x65, 0x2, &(0x7f0000000140)=0x9, 0x4) mkdir(&(0x7f0000000400)='./file0\x00', 0x114) mkdir(&(0x7f0000000440)='./file1\x00', 0x0) syz_emit_ethernet(0x6e, &(0x7f0000000300)={@local, @empty, @void, {@ipv6={0x86dd, @icmpv6={0x0, 0x6, '\x00', 0x38, 0x3a, 0xff, @remote, @local, {[], @pkt_toobig={0x2, 0x0, 0x0, 0x500, {0x0, 0x6, '\x00', 0x0, 0x6c, 0x40, @local, @remote, [], "3b00123400000000"}}}}}}}, 0x0) mkdir(&(0x7f0000000300)='./bus\x00', 0x0) mount$overlay(0x0, &(0x7f00000000c0)='./bus\x00', &(0x7f0000000080), 0x0, &(0x7f0000000400)={[{@upperdir={'upperdir', 0x3d, './file1'}}, {@lowerdir={'lowerdir', 0x3d, './file0'}}, {@workdir={'workdir', 0x3d, './bus'}}]}) creat(&(0x7f0000000080)='./file0/file1\x00', 0x90) chdir(&(0x7f0000000000)='./bus\x00') chown(&(0x7f00000001c0)='./file1\x00', 0x0, 0x0) executing program 4: r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000080), 0x0, 0x0) r2 = ioctl$KVM_CREATE_VM(r1, 0xae01, 0x0) ioctl$KVM_CREATE_IRQCHIP(r2, 0xae60) ioctl$KVM_CAP_X86_DISABLE_EXITS(r2, 0x4068aea3, &(0x7f0000000240)={0x8f, 0x0, 0x2}) r3 = ioctl$KVM_CREATE_VCPU(r2, 0xae41, 0x0) syz_kvm_setup_cpu$x86(r2, 0xffffffffffffffff, &(0x7f0000fe8000/0x18000)=nil, &(0x7f00000001c0)=[@text16={0x10, 0x0}], 0x1, 0x4, 0x0, 0x0) syz_kvm_setup_cpu$x86(0xffffffffffffffff, r3, &(0x7f0000c4a000/0x18000)=nil, &(0x7f0000000040)=[@text64={0x40, 0x0}], 0x1, 0x53, 0x0, 0x0) r4 = userfaultfd(0x801) ioctl$UFFDIO_API(r4, 0xc018aa3f, &(0x7f00000020c0)={0xaa, 0xbd}) ioctl$UFFDIO_REGISTER(r4, 0xc020aa00, &(0x7f0000000140)={{&(0x7f0000400000/0xc00000)=nil, 0xc00000}, 0x3}) ioctl$KVM_RUN(r3, 0xae80, 0x0) mq_unlink(&(0x7f0000000340)='/th0\x00') r5 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000000), r0) sendmsg$NL80211_CMD_FRAME(r0, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000fc0)={&(0x7f0000000600)=ANY=[@ANYBLOB='@\x00\x00\x00', @ANYRES16=r5, @ANYBLOB="010000000000000000000200000008000300", @ANYRES32, @ANYBLOB="0c0099"], 0x40}, 0x1, 0x0, 0x0, 0x8000}, 0x0) executing program 3: r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000240), 0xffffffffffffffff) sendmsg$NL80211_CMD_FRAME(r0, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000fc0)={&(0x7f0000000600)=ANY=[@ANYBLOB='@\x00\x00\x00', @ANYRES16=r1, @ANYBLOB="010000000000000000000200000008000300", @ANYRES32, @ANYBLOB="0c0099"], 0x40}, 0x1, 0x0, 0x0, 0x8000}, 0x0) program crashed: SYZFAIL: initialize_wifi_devices: failed set up IBSS network bisect: bisecting 32 programs bisect: split chunks (needed=false): <32> bisect: split chunk #0 of len 32 into 3 parts bisect: testing without sub-chunk 1/3 testing program (duration=6m5s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): [5, 10, 10, 12, 5, 28, 3, 12, 2, 18, 30, 30, 11, 30, 7, 22, 27, 14, 16, 15, 3] detailed listing: executing program 1: r0 = socket$inet_udp(0x2, 0x2, 0x0) r1 = openat$tun(0xffffffffffffff9c, &(0x7f0000000100), 0x2, 0x0) ioctl$TUNSETIFF(r1, 0x400454ca, &(0x7f0000000040)={'syzkaller0\x00', 0x4001}) ioctl$sock_inet_SIOCSIFFLAGS(r0, 0x8914, &(0x7f0000000200)={'syzkaller0\x00', 0x1}) write$tun(r1, &(0x7f0000000140)=ANY=[@ANYBLOB="0000080001000000000e140008004500003c000000004084ca2502020202ac140001"], 0x4a) executing program 1: r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000300), 0x900, 0x0) r1 = socket$inet_udp(0x2, 0x2, 0x0) ioctl$sock_ipv6_tunnel_SIOCGETPRL(r1, 0x89f4, &(0x7f0000000040)={'sit0\x00', 0x0}) r2 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) ioctl$KVM_SET_USER_MEMORY_REGION(r2, 0x4020ae46, &(0x7f0000000400)={0x0, 0x0, 0x0, 0x20002000, &(0x7f0000000000/0x2000)=nil}) syz_kvm_setup_cpu$x86(0xffffffffffffffff, 0xffffffffffffffff, &(0x7f0000000000/0x18000)=nil, &(0x7f0000000140)=[@text64={0x40, 0x0}], 0x1, 0xe8, 0x0, 0x0) ioctl$KVM_CAP_DIRTY_LOG_RING_ACQ_REL(r2, 0x4068aea3, &(0x7f00000000c0)={0xdf, 0x0, 0x1000}) syz_kvm_add_vcpu$x86(0x0, &(0x7f0000000980)={0x0, &(0x7f0000000440)=[@nested_load_code={0x12e, 0x79, {0x3, "c4a18172d401c744240022000000c744240281e9d8ffc7442406000000000f011c24c7442400a9000000c7442402f0a6d482ff1c24b964090000b80001c0feba000000000f300f320f01c3420f01f83e430f01cbc4a27d2014e966b85f000f00d0"}}], 0x79}) ioctl$KVM_RUN(0xffffffffffffffff, 0xae80, 0x0) syz_kvm_setup_cpu$x86(r2, 0xffffffffffffffff, &(0x7f0000000000/0x18000)=nil, &(0x7f0000000080)=[@text64={0x40, 0x0}], 0x1, 0x10, 0x0, 0x0) executing program 33: r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000300), 0x900, 0x0) r1 = socket$inet_udp(0x2, 0x2, 0x0) ioctl$sock_ipv6_tunnel_SIOCGETPRL(r1, 0x89f4, &(0x7f0000000040)={'sit0\x00', 0x0}) r2 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) ioctl$KVM_SET_USER_MEMORY_REGION(r2, 0x4020ae46, &(0x7f0000000400)={0x0, 0x0, 0x0, 0x20002000, &(0x7f0000000000/0x2000)=nil}) syz_kvm_setup_cpu$x86(0xffffffffffffffff, 0xffffffffffffffff, &(0x7f0000000000/0x18000)=nil, &(0x7f0000000140)=[@text64={0x40, 0x0}], 0x1, 0xe8, 0x0, 0x0) ioctl$KVM_CAP_DIRTY_LOG_RING_ACQ_REL(r2, 0x4068aea3, &(0x7f00000000c0)={0xdf, 0x0, 0x1000}) syz_kvm_add_vcpu$x86(0x0, &(0x7f0000000980)={0x0, &(0x7f0000000440)=[@nested_load_code={0x12e, 0x79, {0x3, "c4a18172d401c744240022000000c744240281e9d8ffc7442406000000000f011c24c7442400a9000000c7442402f0a6d482ff1c24b964090000b80001c0feba000000000f300f320f01c3420f01f83e430f01cbc4a27d2014e966b85f000f00d0"}}], 0x79}) ioctl$KVM_RUN(0xffffffffffffffff, 0xae80, 0x0) syz_kvm_setup_cpu$x86(r2, 0xffffffffffffffff, &(0x7f0000000000/0x18000)=nil, &(0x7f0000000080)=[@text64={0x40, 0x0}], 0x1, 0x10, 0x0, 0x0) executing program 0: r0 = io_uring_setup(0x2ac3, &(0x7f00000001c0)={0x0, 0x77b6, 0x0, 0x400000, 0xac}) r1 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r1, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000500)={&(0x7f00000002c0)=@newlink={0x3c, 0x10, 0x439, 0x70bd2d, 0x0, {}, [@IFLA_LINKINFO={0x1c, 0x12, 0x0, 0x1, @ipip6={{0xb}, {0xc, 0x2, 0x0, 0x1, [@IFLA_IPTUN_FWMARK={0x8, 0x14, 0x7}]}}}]}, 0x3c}}, 0x0) io_uring_setup(0x650b, 0x0) r2 = syz_open_dev$vim2m(&(0x7f0000000280), 0x4eb36, 0x2) ioctl$vim2m_VIDIOC_REQBUFS(r2, 0xc0145608, &(0x7f00000007c0)={0x1, 0x2, 0x1, 0x0, 0x8}) ioctl$vim2m_VIDIOC_QBUF(r2, 0xc058560f, &(0x7f00000002c0)=@multiplanar_mmap={0x0, 0x2, 0x0, 0xfdfd, 0x0, {}, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, "fafc00"}, 0x0, 0x1, {0x0}}) ioctl$BTRFS_IOC_QUOTA_RESCAN_WAIT(r0, 0x942e, 0x0) r3 = socket$netlink(0x10, 0x3, 0x0) sendmsg$nl_route(r3, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000001140)={&(0x7f0000000140)=@newlink={0x78, 0x10, 0x503, 0x0, 0x2, {0x0, 0x0, 0x0, 0x0, 0x0, 0x1244c}, [@IFLA_LINKINFO={0x58, 0x12, 0x0, 0x1, @vti={{0x8}, {0x4c, 0x2, 0x0, 0x1, [@IFLA_VTI_LOCAL={0x8, 0x4, @private=0xa010101}, @IFLA_VTI_REMOTE={0x8, 0x5, @private=0xa0100fe}, @IFLA_VTI_LOCAL={0x8, 0x4, @rand_addr=0x64010102}, @vti_common_policy=[@IFLA_VTI_FWMARK={0x8, 0x6, 0x2d616b45}, @IFLA_VTI_LINK={0x8}, @IFLA_VTI_IKEY={0x8, 0x2, 0x5}, @IFLA_VTI_FWMARK={0x8, 0x6, 0xe}, @IFLA_VTI_FWMARK={0x8, 0x6, 0x4}, @IFLA_VTI_IKEY={0x8, 0x2, 0x9}]]}}}]}, 0x78}}, 0x0) r4 = openat$procfs(0xffffffffffffff9c, &(0x7f0000000000)='/proc/cgroups\x00', 0x0, 0x0) setsockopt$MRT_DEL_MFC(r4, 0x0, 0xcd, &(0x7f0000000100)={@remote, @local, 0xffffffffffffffff, "497c62504d07e8fcbfc16eccdbef03f9a0fdc7265c6886e9b1b17fe65790058b", 0x200, 0xffff, 0x7ea3, 0xc6}, 0x3c) executing program 3: r0 = socket$unix(0x1, 0x5, 0x0) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000100)={'batadv0\x00', 0x0}) r2 = socket(0x10, 0x3, 0x0) sendmsg$nl_route_sched(r2, &(0x7f0000000200)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000300)=@newqdisc={0x88, 0x24, 0xf0b, 0x70bd26, 0x0, {0x0, 0x0, 0x0, r1, {0x0, 0xffff}, {0xffff, 0xffff}}, [@qdisc_kind_options=@q_mqprio={{0xb}, {0x58, 0x2, {{0x1, [], 0x0, [0x1, 0x2, 0xfffe, 0x0, 0x0, 0x0, 0x0, 0x8, 0x0, 0x5c4, 0x8000, 0x0, 0x0, 0x3dc], [0x0, 0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1000]}}}}]}, 0x88}}, 0x20000000) sendmsg$nl_route_sched(r2, &(0x7f00000012c0)={0x0, 0x0, &(0x7f0000000400)={&(0x7f0000000540)=@newqdisc={0x44, 0x24, 0x4ee4e6a52ff56541, 0x70bd29, 0xfffbffff, {0x0, 0x0, 0x0, r1, {0x0, 0x8}, {0xffff, 0xffff}, {0xc, 0xfff3}}, [@qdisc_kind_options=@q_taprio={{0xb}, {0x14, 0x2, [@TCA_TAPRIO_ATTR_SCHED_ENTRY_LIST={0x10, 0x2, 0x0, 0x1, [{0xc, 0x1, 0x0, 0x1, [@TCA_TAPRIO_SCHED_ENTRY_CMD={0x5, 0x2, 0x66}]}]}]}}]}, 0x44}, 0x1, 0xc000000, 0x0, 0x41}, 0x14) executing program 4: mknodat(0xffffffffffffff9c, &(0x7f0000000100)='./file2\x00', 0x81c0, 0x0) execveat(0xffffffffffffff9c, &(0x7f0000000280)='./file2\x00', 0x0, 0x0, 0x0) mknod$loop(&(0x7f0000000300)='./file0\x00', 0x6000, 0x0) unlink(&(0x7f0000000040)='./file0\x00') mknod$loop(&(0x7f0000000200)='./file0\x00', 0x2000, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./sys\x00', 0x1ff) mount(0x0, &(0x7f00000000c0)='./file1\x00', &(0x7f0000000040)='sysfs\x00', 0x0, 0x0) openat$binderfs(0xffffffffffffff9c, &(0x7f0000000300)='./binderfs/binder0\x00', 0x0, 0x0) openat$binderfs(0xffffffffffffff9c, &(0x7f0000000180)='./binderfs/binder1\x00', 0xc02, 0x0) syz_open_dev$sndpcmc(&(0x7f0000000000), 0x0, 0x0) socket(0x11, 0x2, 0x10001) mmap$IORING_OFF_SQ_RING(0x0, 0xc, 0x2000002, 0x401d031, 0xffffffffffffffff, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000001500)='./dev\x00', 0x1ff) openat(0xffffffffffffff9c, &(0x7f0000000240)='./file0\x00', 0x40042, 0x1) open(&(0x7f00009e1000)='./file0\x00', 0x8060, 0x0) mount(0x0, &(0x7f0000001500)='./dev\x00', &(0x7f0000001600)='devtmpfs\x00', 0x0, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000080)='./mnt\x00', 0x1ff) socket$nl_generic(0x10, 0x3, 0x10) socket$packet(0x11, 0x3, 0x300) socket$packet(0x11, 0x3, 0x300) socketpair$unix(0x1, 0x2, 0x0, 0x0) mount(&(0x7f00000000c0)=@filename='./dev/sda1\x00', &(0x7f0000000140)='./mnt\x00', &(0x7f0000000100)='ext4\x00', 0x8410, 0x0) mprotect(&(0x7f0000000000/0xf000)=nil, 0xf000, 0x1) r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000140), 0x0, 0x0) ioctl$TUNSETIFF(r0, 0x40e8662e, 0x0) r1 = openat(0xffffffffffffff9c, &(0x7f0000000400)='./sys/bus/pci/drivers/net2280/new_id\x00', 0x1, 0x0) write(r1, &(0x7f0000001100)='8086 29c0 ffffffff ffffffff 0 0 1', 0x21) syz_create_resource$binfmt(&(0x7f0000000080)='./sys/bus/pci/drivers/net2280/new_id\x00') executing program 0: r0 = socket$kcm(0x2, 0x3, 0x84) sendmmsg$inet(r0, &(0x7f0000006a80)=[{{&(0x7f0000000000)={0x2, 0x4e22, @dev={0xac, 0x14, 0x14, 0x18}}, 0x10, &(0x7f0000002ac0)=[{&(0x7f0000000080)="f982340819048e40ac0bd4474d", 0xd}], 0x1}}], 0x1, 0x8080) sendmsg$inet(r0, &(0x7f0000000a00)={&(0x7f0000000040)={0x2, 0x4e23, @remote}, 0x10, &(0x7f00000000c0)=[{&(0x7f0000000440)="c10900", 0x3}], 0x1}, 0x6000) executing program 4: syz_emit_ethernet(0x6a, &(0x7f0000000040)={@link_local={0x1, 0x80, 0xc2, 0x0, 0x0, 0x3}, @remote, @void, {@ipv4={0x800, @icmp={{0x5, 0x4, 0x0, 0x1, 0x5c, 0x0, 0x0, 0xfb, 0x1, 0x0, @initdev={0xac, 0x1e, 0x0, 0x0}, @local}, @time_exceeded={0x3, 0x1, 0x0, 0x3, 0x24, 0x0, {0x10, 0x4, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x1, 0x8, @loopback, @rand_addr=0x640100fe, {[@cipso={0x86, 0x29, 0xffffffffffffffff, [{0x0, 0xe, "08c82ce8da6ee06cb8dd9452"}, {0x5, 0x9, "020007651442eb"}, {0x1, 0x2}, {0x2, 0x7, "cf05003179"}, {0x0, 0x3, '\x00'}]}]}}}}}}}, 0x0) socketpair(0x1, 0x1, 0x0, &(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}) r2 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r3 = syz_genetlink_get_family_id$nbd(&(0x7f0000000040), r2) sendmsg$NBD_CMD_CONNECT(r2, &(0x7f0000000400)={0x0, 0x0, &(0x7f0000001a80)={&(0x7f0000000480)={0x5c, r3, 0x1, 0x70bd2c, 0xffe, {}, [@NBD_ATTR_SIZE_BYTES={0xc, 0x2, 0x2}, @NBD_ATTR_SOCKETS={0x28, 0x7, 0x0, 0x1, [{0xc, 0x1, 0x0, 0x1, {0x8, 0x1, r0}}, {0xc, 0x1, 0x0, 0x1, {0x8, 0x1, r0}}, {0xc, 0x1, 0x0, 0x1, {0x8, 0x1, r1}}]}, @NBD_ATTR_SERVER_FLAGS={0xc, 0x5, 0x128}, @NBD_ATTR_BACKEND_IDENTIFIER={0x8, 0xa, 'nbd\x00'}]}, 0x5c}}, 0x20000000) r4 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r5 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r6 = syz_genetlink_get_family_id$netlbl_mgmt(&(0x7f0000002180), r4) sendmsg$NLBL_MGMT_C_REMOVEDEF(r5, &(0x7f0000002240)={0x0, 0x0, &(0x7f0000002200)={&(0x7f00000021c0)={0x14, r6, 0x1, 0x70bd29, 0x25dfdbfd}, 0x14}, 0x1, 0x0, 0x0, 0x4000800}, 0x4000004) sendmsg$NLBL_MGMT_C_ADDDEF(r2, &(0x7f00000001c0)={&(0x7f00000000c0)={0x10, 0x0, 0x0, 0x4000}, 0xc, &(0x7f0000000180)={&(0x7f0000000140)={0x3c, r6, 0x200, 0x70bd2b, 0x25dfdbff, {}, [@NLBL_MGMT_A_DOMAIN={0x9, 0x1, '\xaa\xaa\xaa\xaa\xaa'}, @NLBL_MGMT_A_IPV4MASK={0x8, 0x8, @empty}, @NLBL_MGMT_A_IPV6ADDR={0x14, 0x5, @dev={0xfe, 0x80, '\x00', 0x19}}]}, 0x3c}, 0x1, 0x0, 0x0, 0x48000}, 0x4000000) seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0x0, &(0x7f0000000000)={0x1, &(0x7f0000000100)=[{0x6, 0x0, 0x0, 0x7fff0000}]}) socket(0x1, 0x80402, 0x7) executing program 3: r0 = openat$sysctl(0xffffffffffffff9c, &(0x7f0000000040)='/proc/sys/net/ipv4/tcp_mtu_probing\x00', 0x1, 0x0) pwritev(r0, &(0x7f0000000140), 0x15, 0x9, 0x1) executing program 0: r0 = socket$inet_udp(0x2, 0x2, 0x0) r1 = bpf$BPF_BTF_LOAD(0x12, &(0x7f0000000080)={&(0x7f0000000040)=ANY=[@ANYBLOB="9feb0100180000000000000020000000200000000400000001000000000000010400000020000000010000000000000108"], 0x0, 0x3c}, 0x28) r2 = bpf$MAP_CREATE(0x0, &(0x7f0000000200)=ANY=[@ANYBLOB="1c0000000400000008000000000000000100"/48, @ANYRES32=r1, @ANYBLOB="0100000002"], 0x40) bpf$MAP_LOOKUP_ELEM(0x1, &(0x7f0000000300)={r2, &(0x7f00000000c0)="8fa5", 0x0}, 0x20) setsockopt$IPT_SO_SET_REPLACE(r0, 0x0, 0x40, &(0x7f0000000000)=@raw={'raw\x00', 0x8, 0x3, 0x3c8, 0x0, 0xa, 0x148, 0x0, 0x10, 0x330, 0x2a8, 0x2a8, 0x330, 0x2a8, 0x3, 0x0, {[{{@ip={@rand_addr, @multicast1, 0x0, 0x0, 'bridge0\x00', 'rose0\x00'}, 0x0, 0x70, 0xe0, 0x0, {0x200003ae, 0x7f00}}, @common=@unspec=@NFLOG={0x70, 'NFLOG\x00', 0x0, {0x0, 0x0, 0x0, 0x0, 0x0, "f2f7b90ad2b60c45cb4ea6e7bf902bdc2ff8a9304d9f655c746adc0bdc773506378bc0d27efd6abb05175089830cc46186074d7de46d5af300"}}}, {{@ip={@empty, @local, 0x0, 0x0, 'ip6erspan0\x00', 'veth0_to_team\x00'}, 0x0, 0x1f0, 0x250, 0x0, {}, [@common=@inet=@hashlimit3={{0x158}, {'wg2\x00', {0xffffffffffffffff, 0xff, 0x0, 0x0, 0x0, 0x7fff, 0x200}}}, @inet=@rpfilter={{0x28}}]}, @common=@CLUSTERIP={0x60, 'CLUSTERIP\x00', 0x0, {0x1, @multicast, 0x2, 0x7, [0x0, 0x10, 0x1b, 0x2b, 0x37, 0x2e, 0x2b, 0x18, 0x2b, 0x34, 0xd, 0x0, 0x3d, 0x1, 0x32, 0x37], 0x1, 0x6, 0x1570000000000}}}], {{'\x00', 0xc8, 0x70, 0x98}, {0x28}}}}, 0x428) r3 = openat(0xffffffffffffff9c, &(0x7f0000000040)='./file1\x00', 0x542, 0x0) ioctl$SIOCX25SDTEFACILITIES(r3, 0x89eb, &(0x7f0000000080)={0x81, 0x962, 0x7, 0x7, 0x2, 0xd, 0x3, "4cb8b2a6146ab1a722e031cf656758ee56a018e7", "be634e4a96ef65eb0d23451a8d73bc095839f363"}) pwritev2(r3, &(0x7f00000000c0)=[{&(0x7f0000000300)=')', 0x1}], 0x1, 0x2, 0x0, 0xa1) r4 = syz_open_dev$I2C(&(0x7f0000000000), 0x1, 0x0) ioctl$I2C_PEC(r4, 0x708, 0x40) ioctl$I2C_SMBUS(r4, 0x720, &(0x7f00000002c0)={0x1, 0x7, 0x4, &(0x7f0000000280)={0x5, "1d27f0db2e1f25eff995475188afe0ebe9bab69516a5e88a718dca33021b22b650"}}) r5 = socket$nl_route(0x10, 0x3, 0x0) getsockopt$sock_int(r5, 0x1, 0xb, 0x0, &(0x7f0000000040)) socket$netlink(0x10, 0x3, 0x0) r6 = socket(0x10, 0x803, 0x0) sendmsg$IPVS_CMD_SET_INFO(r6, &(0x7f0000000b00)={0x0, 0x0, &(0x7f0000000ac0)={0x0, 0x14}}, 0x0) r7 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r7, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000240)={&(0x7f0000000180)=ANY=[@ANYBLOB="3c0000001000030400"/20, @ANYRES32=0x0, @ANYBLOB="a4280400000000001400350073797a5f74756e00000000000000000008000a00", @ANYRES32], 0x3c}}, 0x8000) executing program 4: bpf$MAP_CREATE(0x0, &(0x7f0000000000)=ANY=[@ANYBLOB="1400000007"], 0x50) r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000000), 0x40241, 0x0) r1 = socket$pppl2tp(0x18, 0x1, 0x1) r2 = socket$inet6_udp(0xa, 0x2, 0x0) r3 = socket$inet_tcp(0x2, 0x1, 0x0) bind$inet(r3, &(0x7f0000000040)={0x2, 0x4e21, @local}, 0x10) setsockopt$inet_tcp_int(0xffffffffffffffff, 0x6, 0x19, &(0x7f0000000240)=0x6, 0xfffffedf) setsockopt$inet_tcp_TCP_REPAIR_QUEUE(r3, 0x6, 0x14, &(0x7f0000000000)=0x2, 0x4) setsockopt$SO_TIMESTAMPING(r3, 0x1, 0x25, &(0x7f0000000200)=0x437b, 0x4) connect$inet(r3, &(0x7f0000000180)={0x2, 0x4e21, @local}, 0x10) setsockopt$inet_tcp_TCP_REPAIR_OPTIONS(r3, 0x6, 0x16, &(0x7f0000000340)=[@window={0x3, 0x1, 0x8}, @window={0x3, 0x6, 0x7}, @sack_perm, @window={0x3, 0x0, 0x4}, @mss={0x2, 0x4}, @timestamp, @window={0x3, 0x1, 0x10}, @sack_perm], 0x20000000000002a1) sendmsg$inet(r3, &(0x7f0000000300)={0x0, 0x0, &(0x7f0000000140)=[{&(0x7f0000000380)="9ad024c2775e1e2ab8e46a2877fcb21d4bb90500ebb1cfaea615b04f758b1754ce82525f728b072274a6388145b8991b4d0d7e9275d21e257816bb8650d21ba04ac83b4961e7b3a94d", 0x49}], 0x1}, 0x0) setsockopt$inet_tcp_TCP_REPAIR(r3, 0x6, 0x13, &(0x7f00000001c0), 0x4) sendto$inet(r3, &(0x7f00000004c0)='<', 0x381, 0x805, 0x0, 0x0) connect$pppl2tp(r1, &(0x7f0000000080)=@pppol2tpin6={0x18, 0x1, {0x0, r2, 0x6, 0x0, 0x0, 0x0, {0xa, 0x0, 0x0, @local}}}, 0x32) getsockopt$sock_buf(r1, 0x1, 0x1c, 0x0, &(0x7f0000000000)=0x3d) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000200)={'syzkaller1\x00', 0xc201}) r4 = socket$kcm(0x21, 0x2, 0xa) r5 = socket$inet6(0xa, 0x3, 0xff) setsockopt$inet6_int(r5, 0x29, 0x7, &(0x7f0000fcb000)=0xffffffff, 0x4) sendmsg$kcm(r4, &(0x7f0000000080)={&(0x7f0000000000)=@rxrpc=@in6={0x21, 0x1, 0x2, 0x1c, {0xa, 0x0, 0x4, @dev, 0x8000000}}, 0x80, 0x0, 0x0, &(0x7f00000000c0)=[{0x18, 0x110, 0x1, '\x00'}, {0x18, 0x110, 0xc, "aa"}], 0x30}, 0xfc40) r6 = socket$inet6_tcp(0xa, 0x1, 0x0) r7 = dup(r6) ioctl$TIOCSLCKTRMIOS(r7, 0x5457, &(0x7f00000000c0)) ioctl$SIOCSIFHWADDR(r7, 0x8914, &(0x7f0000000040)={'syzkaller1\x00', @link_local={0x1, 0x80, 0xc2, 0x0, 0x0, 0x3}}) write$tun(r0, &(0x7f0000000500)={@val={0x8, 0xc}, @val={0x2, 0x1, 0x4, 0x11, 0x9ca, 0x81}, @ipv4=@icmp={{0x20, 0x4, 0x1, 0x25, 0x94, 0x66, 0x0, 0xa8, 0x1, 0x0, @initdev={0xac, 0x1e, 0x1, 0x0}, @local, {[@ra={0x94, 0x4, 0x1}, @lsrr={0x83, 0x13, 0xa1, [@local, @dev={0xac, 0x14, 0x14, 0x3e}, @local, @multicast1]}, @timestamp_addr={0x44, 0x24, 0x1b, 0x1, 0x9, [{@loopback, 0x7}, {@loopback, 0x200}, {@multicast2}, {@multicast1, 0x4}]}, @cipso={0x86, 0x31, 0x2, [{0x1, 0xb, "b994131c56c477d6f5"}, {0x2, 0x12, "ef0500f6d000"/16}, {0x7, 0x6, "e8c2e380"}, {0x1, 0x8, "1e2d53d7cd98"}]}]}}, @timestamp={0xd, 0x0, 0x0, 0xc000, 0x4, 0x3, 0x401, 0x600}}}, 0xa2) creat(0x0, 0x0) sendto$packet(0xffffffffffffffff, &(0x7f0000000000)='1', 0x1, 0x4000800, 0x0, 0x0) r8 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) bind$bt_hci(r8, &(0x7f0000000040)={0x1f, 0xffff, 0x3}, 0x6) executing program 3: r0 = socket$nl_route(0x10, 0x3, 0x0) r1 = socket(0x10, 0x803, 0x0) sendmsg$nl_route(r1, &(0x7f00000006c0)={0x0, 0x0, &(0x7f0000000680)={0x0, 0x18}}, 0x0) getsockname$packet(r1, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) sendmsg$nl_route(r0, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000000)={&(0x7f00000002c0)=ANY=[@ANYBLOB="5000000010008105e9c51c000000000000000000", @ANYRES32=r2, @ANYBLOB="01000000000000002800128009000100766c616e000000001800028006000100000000000c0002000c0000000d00000008000500", @ANYRES64=r0], 0x50}, 0x1, 0x0, 0x0, 0x80}, 0x0) sendmsg$nl_route(0xffffffffffffffff, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000700)=@newlink={0x20, 0x10, 0x1, 0x1, 0x25dfdbff, {0x0, 0x0, 0x0, r2, 0x0, 0x8}}, 0x20}, 0x1, 0x0, 0x0, 0x11}, 0x0) ioctl$sock_inet6_SIOCADDRT(0xffffffffffffffff, 0x890b, &(0x7f0000000380)={@local, @empty, @initdev={0xfe, 0x88, '\x00', 0x1, 0x0}, 0x3, 0x6, 0x5, 0x200, 0x4, 0x100020, r2}) mkdirat(0xffffffffffffff9c, &(0x7f0000000400)='./config\x00', 0x1ed) socket$nl_xfrm(0x10, 0x3, 0x6) mount(0x0, &(0x7f0000000500)='./config\x00', &(0x7f0000000600)='configfs\x00', 0x0, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000700)='./config/usb_gadget/g1\x00', 0x1ed) mkdirat(0xffffffffffffff9c, &(0x7f0000000c00)='./config/usb_gadget/g1/UDC\x00', 0x1c4) bpf$PROG_LOAD(0x5, 0x0, 0x0) socket(0x3d, 0x80000, 0x5) mkdirat(0xffffffffffffff9c, &(0x7f0000000d00)='./config/usb_gadget/g1/functions/uvc.usb0/control/header/h\x00', 0x1ed) r3 = openat$dir(0xffffffffffffff9c, 0x0, 0x400007, 0x2) readlinkat(r3, &(0x7f0000000040)='./config/usb_gadget/g1/configs/c.1/uvc.usb0\x00', 0x0, 0x0) symlinkat(&(0x7f0000000e00)='./config/usb_gadget/g1/functions/uvc.usb0/control/header/h\x00', 0xffffffffffffff9c, &(0x7f0000000f00)='./config/usb_gadget/g1/functions/uvc.usb0/control/class/fs/h\x00') symlinkat(0x0, 0xffffffffffffffff, 0x0) r4 = openat(0xffffffffffffff9c, &(0x7f0000002000)='./config/usb_gadget/g1/UDC\x00', 0x1, 0x0) write(r4, &(0x7f0000002100)='usbip-vudc.0', 0xc) r5 = socket$netlink(0x10, 0x3, 0x0) stat(&(0x7f00000001c0)='./config\x00', &(0x7f0000000200)) r6 = bpf$BPF_BTF_LOAD(0x12, &(0x7f0000000140)={&(0x7f0000000100)={{0xeb9f, 0x1, 0x0, 0x18, 0x0, 0x20, 0x20, 0x4, [@func={0x2, 0x0, 0x0, 0xc, 0x2}, @func_proto={0x0, 0x1, 0x0, 0xd, 0x0, [{}]}]}, {0x0, [0x0, 0x5f]}}, 0x0, 0x3c}, 0x28) bpf$PROG_LOAD_XDP(0x5, &(0x7f00000002c0)={0x6, 0x3, &(0x7f0000000000)=@framed={{0x18, 0x0, 0x0, 0x0, 0x7, 0x0, 0x0, 0x0, 0xc0}}, &(0x7f0000000080)='GPL\x00', 0xf, 0x0, 0x0, 0x40f00, 0x4, '\x00', 0x0, 0x25, r6, 0x8, &(0x7f0000000180)={0x0, 0x1}, 0x1, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0x4}, 0x94) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000040)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$sock_SIOCGIFINDEX(r7, 0x8933, &(0x7f0000000080)={'macsec0\x00', 0x0}) r9 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$inet6_buf(r9, 0x29, 0x20, &(0x7f00000000c0)="0bbb268dd6ffa80800000000000000000000210d0000aaa8fa017242ba9380d4", 0x20) sendmsg$nl_route(r5, &(0x7f00000000c0)={0x0, 0x0, &(0x7f00000002c0)={&(0x7f0000000000)=ANY=[@ANYBLOB="280000001d000100000000010000000007000000", @ANYRES32=r8, @ANYRESDEC=r5], 0x28}, 0x1, 0x0, 0x0, 0x4041}, 0x0) executing program 0: mkdirat(0xffffffffffffff9c, &(0x7f00000000c0)='./file0\x00', 0x10) mkdirat(0xffffffffffffff9c, &(0x7f00000000c0)='./bus\x00', 0x1c5) mount$overlay(0x0, &(0x7f0000000100)='./file0\x00', &(0x7f0000000040), 0x8, &(0x7f0000000240)={[{@upperdir={'upperdir', 0x3d, './file0'}}, {@workdir={'workdir', 0x3d, './bus'}}, {@lowerdir={'lowerdir', 0x3d, '.'}}]}) socket$xdp(0x2c, 0x3, 0x0) r0 = socket$kcm(0x2c, 0x3, 0x0) close(r0) r1 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPCTNL_MSG_CT_GET(r1, &(0x7f0000000200)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000300)=ANY=[@ANYBLOB="ac0000000001050500000000000000000a0000003c0002802c00018014000300ff01000000000000000000000000000114000400ff0200000000000000000000000000010c00028005000100000000003c0001800c00028005000100000000002c00018014000300ff0200000000000000000000000000811400040000000000000000000001ffffac1e00010800074000000001180006801400040000000000000000000000000000000001"], 0xac}}, 0x0) sendmsg$IPCTNL_MSG_EXP_GET(r1, &(0x7f0000006680)={0x0, 0x0, &(0x7f0000006640)={&(0x7f00000065c0)=ANY=[@ANYBLOB="500000000102010100000000000000000a0000003c0001802c00018014000300ff01000000000000000000000000000114000400000000000000000000000000000000010c0002580500010000000000"], 0x50}, 0x1, 0x0, 0x0, 0x800}, 0x0) chdir(&(0x7f0000000000)='./file0\x00') mknod$loop(&(0x7f0000000000)='./file0aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa\x00', 0x2000, 0x1) executing program 4: setsockopt$inet_mreqsrc(0xffffffffffffffff, 0x0, 0x27, &(0x7f0000000280)={@multicast2, @local, @remote}, 0xc) r0 = socket(0x1, 0x803, 0x0) r1 = socket$nl_route(0x10, 0x3, 0x0) getsockname$packet(r0, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f00000002c0)=0x14) sendmsg$nl_route(r1, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000340)=ANY=[@ANYBLOB="540000001000010400"/20, @ANYRES32=0x0, @ANYBLOB="00000000000000002c0012800e0001006970366772657461700000001800028014000700ff01000000000000000000000000000108000a00", @ANYRES32=r2], 0x54}}, 0x0) setsockopt$inet_IP_XFRM_POLICY(0xffffffffffffffff, 0x0, 0x11, &(0x7f00000005c0)={{{@in6=@local, @in=@broadcast, 0x4e23, 0x6, 0x4e24, 0x0, 0x0, 0x0, 0x80, 0x8, r2, 0xee01}, {0x8, 0x8, 0x791a, 0x69, 0xf07a, 0x7, 0xbf9, 0x2}, {0x0, 0x40, 0x0, 0x3}, 0x4f55945f, 0x6e6bc0, 0x0, 0x1}, {{@in6=@ipv4={'\x00', '\xff\xff', @rand_addr=0x64010100}, 0x4d2, 0xff}, 0xa, @in6=@ipv4={'\x00', '\xff\xff', @local}, 0x3507, 0x0, 0x0, 0x0, 0x9, 0x10001, 0x9bde}}, 0xe8) r3 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) r4 = ioctl$KVM_CREATE_VM(r3, 0xae01, 0x2a) ioctl$KVM_SET_USER_MEMORY_REGION(r4, 0x4020ae46, &(0x7f0000000100)={0x4, 0x1, 0xffff1000, 0x1000, &(0x7f0000012000/0x1000)=nil}) r5 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000240), 0x0, 0x0) r6 = ioctl$KVM_CREATE_VM(r5, 0xae01, 0x0) ioctl$SG_IO(0xffffffffffffffff, 0x2285, &(0x7f0000000400)={0x53, 0xfffffffffffffffb, 0x5, 0x8, @buffer={0x0, 0x0, 0x0}, &(0x7f0000000200)="0004000019", 0x0, 0x0, 0x10011, 0xfffbffff, 0x0}) r7 = ioctl$KVM_CREATE_VCPU(r6, 0xae41, 0x0) ioctl$KVM_SET_USER_MEMORY_REGION(r6, 0x4020ae46, &(0x7f0000000180)={0x0, 0x0, 0x0, 0x2000, &(0x7f0000000000/0x2000)=nil}) ioctl$KVM_SET_REGS(r7, 0x4090ae82, &(0x7f0000000000)={[0x35, 0xfff, 0xfffffffffffffffe, 0x40000000000180, 0x2, 0x7, 0xf2, 0xd, 0x7fffffffffffe, 0x7, 0x5, 0xb, 0x7, 0xfffffffffffffff8, 0x9, 0xc], 0x25000, 0x304}) r8 = syz_ublk_setup_io_uring(0x20, &(0x7f0000000340)={0x0, 0x0, 0x100, 0x2, 0x1e5}, &(0x7f0000000000)=0x0, &(0x7f0000000040)=0x0, &(0x7f0000000980)=0x0) syz_io_uring_submit(r9, r10, r11, &(0x7f00000004c0)=@IORING_OP_RENAMEAT={0x23, 0xe, 0x0, 0xffffffffffffffff, &(0x7f0000000540)='./file0\x00', &(0x7f0000000580)='./file0\x00'}) unshare(0x22060600) syz_ublk_add_dev(r8, r9, r10, r11, &(0x7f00000000c0)={0x2e, 0x9, 0x0, r8, 0xc0207504, 0x0, 0x0, 0x0, 0x0, 0x800, 0x0, 0x0, '\x00', {0xffffffff, 0xffff, 0x40, &(0x7f0000000080)=@any_dev={0x1, 0xe8d, 0x0, 0x0, 0x1000, 0x1}}}, &(0x7f0000000180)) ioctl$KVM_RUN(r7, 0xae80, 0x0) r12 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$nl_generic(r12, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000140)={&(0x7f00000004c0)=ANY=[@ANYBLOB="18000000260001031dbd7002fadbdf25010000000400ae"], 0x18}}, 0x0) recvmmsg(r12, &(0x7f0000000800)=[{{0x0, 0x0, &(0x7f00000009c0)=[{&(0x7f0000000500)=""/140, 0x8c}, {&(0x7f0000000a40)=""/4148, 0xdf0}, {&(0x7f0000000040)=""/184, 0xb8}, {&(0x7f0000003800)=""/4104, 0x1008}, {&(0x7f0000000280)=""/65, 0x41}, {&(0x7f0000000200)=""/36, 0x24}], 0x6}, 0xd}, {{0x0, 0x0, 0x0}, 0x8}, {{0x0, 0x0, 0x0}, 0x38000000}, {{0x0, 0x0, 0x0}}], 0x4, 0x40000102, 0x0) r13 = ioctl$KVM_CREATE_VM(r3, 0xae01, 0x0) r14 = dup(r13) ioctl$KVM_SET_USER_MEMORY_REGION(r13, 0x4020ae46, &(0x7f0000000840)={0x1fe, 0x2, 0x3000, 0x2000, &(0x7f0000003000/0x2000)=nil}) r15 = ioctl$KVM_CREATE_VCPU(r14, 0xae41, 0x2001) syz_kvm_setup_cpu$x86(0xffffffffffffffff, r15, &(0x7f0000000000/0x18000)=nil, &(0x7f0000000040)=[@text32={0x20, 0x0}], 0x1, 0x11, 0x0, 0x0) syz_kvm_setup_cpu$x86(r13, 0xffffffffffffffff, &(0x7f0000000000/0x18000)=nil, &(0x7f0000000200)=[@text32={0x20, 0x0}], 0x1, 0x50, 0x0, 0x0) ioctl$KVM_RUN(r15, 0xae80, 0x0) executing program 3: r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000300), 0x900, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) ioctl$KVM_SET_USER_MEMORY_REGION(r1, 0x4020ae46, &(0x7f0000000400)={0x0, 0x0, 0x0, 0x20002000, &(0x7f0000000000/0x2000)=nil}) r2 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0) syz_kvm_setup_cpu$x86(0xffffffffffffffff, r2, &(0x7f0000000000/0x18000)=nil, &(0x7f0000000140)=[@text64={0x40, 0x0}], 0x1, 0xe8, 0x0, 0x0) sendmsg$kcm(0xffffffffffffffff, &(0x7f0000000000)={0x0, 0x0, 0x0}, 0x0) ioctl$KVM_RUN(r2, 0xae80, 0x0) (fail_nth: 14) executing program 0: sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000280)={&(0x7f0000000600)=@deltfilter={0x24, 0x2d, 0x300, 0x70bd2d, 0x25dfdbfd, {0x0, 0x0, 0x0, 0x0, {0x2, 0x2}, {0x9, 0xe}, {0x8, 0xffe0}}}, 0x24}}, 0x10) r0 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r0, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000240)=ANY=[@ANYBLOB="140000001000010000000000000000000500000a28000000000a030000000000000000000a00000708000240000000020900010073797a31000000002c000000030a010100000000000000000a0000070900010073797a31000000000900030073797a320000000014000000110001"], 0x7c}, 0x1, 0x0, 0x0, 0x4000}, 0x0) sendmsg$NFT_BATCH(r0, &(0x7f0000009b40)={0x0, 0x0, &(0x7f0000009b00)={&(0x7f0000000100)={{0x14, 0x10, 0x1, 0x0, 0x0, {0x5}}, [@NFT_MSG_NEWRULE={0x44, 0x6, 0xa, 0x401, 0x0, 0x0, {0xa, 0x0, 0x7}, [@NFTA_RULE_TABLE={0x9, 0x1, 'syz1\x00'}, @NFTA_RULE_EXPRESSIONS={0x18, 0x4, 0x0, 0x1, [{0x14, 0x1, 0x0, 0x1, @xfrm={{0x9}, @val={0x4}}}]}, @NFTA_RULE_CHAIN={0x9, 0x2, 'syz2\x00'}]}], {0x14, 0x11, 0x1, 0x0, 0x0, {0x1}}}, 0x6c}, 0x1, 0x0, 0x0, 0x204c054}, 0x20040040) r1 = socket$rds(0x15, 0x5, 0x0) bind$rds(r1, &(0x7f0000000840)={0x2, 0x0, @loopback}, 0x10) r2 = ioctl$KVM_CREATE_VM(0xffffffffffffffff, 0xae01, 0x36) ioctl$KVM_CREATE_VCPU(r2, 0xae41, 0x2) r3 = syz_open_dev$sndpcmc(&(0x7f0000000000), 0xb, 0x0) ioctl$SNDRV_PCM_IOCTL_HW_REFINE(r3, 0xc2604110, &(0x7f0000000040)={0x0, [[0x9ef8, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7fffffff], [0x10000, 0x0, 0x0, 0x0, 0x8001], [0x6, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0xffffffff]], '\x00', [{}, {0xfffffffd}, {}, {0x0, 0x0, 0x0, 0x1, 0x1}, {0x5, 0x0, 0x0, 0x1, 0x1}, {0x7fff, 0xfffffffa}, {}, {0x7fffffc, 0x8f96}, {}, {}, {0x0, 0xffffffff}, {0x8000}], '\x00', 0x7fffffff}) sendmsg$rds(r1, &(0x7f0000000740)={&(0x7f0000000040)={0x2, 0x4e23, @local}, 0x10, 0x0, 0x0, &(0x7f0000000100)=[@cswp={0x58, 0x114, 0x7, {{0x5, 0x2}, 0x0, 0x0, 0x5eae, 0x0, 0xd, 0x9, 0x2, 0x9}}], 0x58}, 0x0) sendmsg$nl_route(0xffffffffffffffff, &(0x7f0000000300)={0x0, 0x0, &(0x7f0000000080)={0x0, 0x48}, 0x1, 0x0, 0x0, 0x10}, 0x0) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000100)=@newqdisc={0x44, 0x24, 0x108, 0x0, 0x65dfdbfb, {0x0, 0x0, 0x0, 0x0, {0xffff, 0xffe0}, {0xffff, 0x7ff8}, {0xfff2}}, [@qdisc_kind_options=@q_fq_pie={{0xb}, {0x14, 0x8002, [@TCA_FQ_PIE_BYTEMODE={0x8}, @TCA_FQ_PIE_QUANTUM={0x8, 0x7, 0xffffff22}]}}]}, 0x44}, 0x1, 0x0, 0x0, 0x1}, 0x0) mmap(&(0x7f0000ffc000/0x4000)=nil, 0x4000, 0x8, 0x8010, r1, 0x14c66000) sendmsg$nl_route(0xffffffffffffffff, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000100)=ANY=[@ANYBLOB="500000001000010425bbe5ad600027842cf52300", @ANYRES32=0x0, @ANYBLOB="0000000000008000280012800a00010076786c616e00"], 0x50}}, 0x4008840) r4 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFULNL_MSG_CONFIG(r4, &(0x7f0000000400)={&(0x7f0000000440)={0x10, 0x0, 0x0, 0x400}, 0xc, &(0x7f00000003c0)={&(0x7f0000000340)={0x68, 0x1, 0x4, 0x201, 0x0, 0x0, {0x2}, [@NFULA_CFG_FLAGS={0x6, 0x6, 0x1, 0x0, 0x4}, @NFULA_CFG_NLBUFSIZ={0x8, 0x3, 0x1, 0x0, 0x5}, @NFULA_CFG_MODE={0xa, 0x2, {0x85}}, @NFULA_CFG_QTHRESH={0x8, 0x5, 0x1, 0x0, 0x1e8f352f}, @NFULA_CFG_TIMEOUT={0x8, 0x4, 0x1, 0x0, 0x7ff}, @NFULA_CFG_CMD={0x5, 0x1, 0x1}, @NFULA_CFG_QTHRESH={0x8, 0x5, 0x1, 0x0, 0x1}, @NFULA_CFG_MODE={0xa, 0x2, {0x1}}, @NFULA_CFG_MODE={0xa, 0x2, {0x4}}]}, 0x68}, 0x1, 0x0, 0x0, 0x4040000}, 0x10) mount$tmpfs(0x0, &(0x7f00000000c0)='./file0\x00', &(0x7f00000001c0), 0x10810, &(0x7f0000000200)={[{@usrquota_block_hardlimit={'usrquota_block_hardlimit', 0x3d, [0x25, 0x6d]}}], [{@rootcontext={'rootcontext', 0x3d, 'user_u'}}, {@subj_user={'subj_user', 0x3d, '@!@'}}]}) r5 = syz_io_uring_complete(0x0, 0x0) ioctl$sock_inet6_tcp_SIOCOUTQ(r5, 0x5411, &(0x7f0000000480)) r6 = socket$netlink(0x10, 0x3, 0x0) sendmmsg(r6, &(0x7f00000002c0), 0x40000000000009f, 0x0) executing program 4: r0 = openat$iommufd(0xffffffffffffff9c, &(0x7f0000000180), 0x0, 0x0) ioctl$IOMMU_IOAS_ALLOC(r0, 0x3b81, &(0x7f0000000100)={0xc, 0x0, 0x0}) ioctl$IOMMU_TEST_OP_MOCK_DOMAIN_FLAGS(r0, 0x3ba0, &(0x7f0000000240)={0x48, 0x2, r1, 0x0, 0x0, 0x0, 0x0, 0x1}) ioctl$IOMMU_IOAS_MAP$PAGES(r0, 0x3b85, &(0x7f00000007c0)={0x28, 0x5, r1, 0x0, &(0x7f00002ce000/0x1000)=nil, 0x1000, 0x1020800}) r2 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) keyctl$set_reqkey_keyring(0x5, 0xfffffffe) request_key(&(0x7f0000000480)='cifs.spnego\x00', &(0x7f00000004c0)={'syz', 0x3}, &(0x7f0000000500)='key_or_keyring:', 0x0) ioctl$IOMMU_VFIO_IOAS$GET(r0, 0x3b88, &(0x7f0000000140)={0xc, 0x0}) ioctl$IOMMU_TEST_OP_MOCK_DOMAIN_FLAGS(r0, 0x3ba0, &(0x7f00000001c0)={0x48, 0x2, r3, 0x0, 0x0, 0x0, 0x0, 0x1}) bind$bt_hci(r2, &(0x7f0000000000)={0x1f, 0xffff}, 0x4) setsockopt$packet_fanout_data(0xffffffffffffffff, 0x107, 0x16, &(0x7f0000000100)={0x1, &(0x7f0000000180)=[{0x1, 0x1}]}, 0x10) write$binfmt_misc(r2, &(0x7f0000000100), 0x6) r4 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) bind$bt_hci(r4, &(0x7f0000000080)={0x1f, 0xffffffffffffffff, 0x3}, 0x6) write(r4, &(0x7f0000000000)="2e000000010002", 0x404) r5 = socket$nl_route(0x10, 0x3, 0x0) r6 = inotify_init1(0x800) inotify_add_watch(r6, 0x0, 0xc0000484) r7 = seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0x0, &(0x7f0000000000)={0x1, &(0x7f0000000100)=[{0x6, 0x72, 0x0, 0x7fff0000}]}) close_range(r7, 0xffffffffffffffff, 0x0) ioctl$sock_SIOCETHTOOL(r5, 0x8946, &(0x7f0000000000)={'gretap0\x00', &(0x7f0000000080)=@ethtool_ts_info={0x3a}}) r8 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPSET_CMD_CREATE(r8, &(0x7f0000001780)={0x0, 0x0, &(0x7f0000000600)={&(0x7f0000001840)=ANY=[@ANYBLOB="540000000206010200000000000000000000000105000100070000000900020073797a30000000000c0007800500150001000000050004000000000010000300666173683a69702c6d616300050005000a000000"], 0x54}, 0x1, 0x0, 0x0, 0xc040}, 0x0) bpf$MAP_CREATE(0x0, &(0x7f0000000640)=ANY=[@ANYBLOB="160000000000000004000000ff"], 0x48) r9 = syz_open_procfs(0xffffffffffffffff, &(0x7f00000042c0)='fdinfo/3\x00') read$FUSE(r9, &(0x7f0000000080)={0x2020}, 0x2020) msgctl$MSG_INFO(0x0, 0xc, &(0x7f0000000000)=""/194) executing program 3: ptrace(0x10, 0x0) ptrace$setregs(0xd, 0x0, 0x0, &(0x7f00000003c0)="18607651149d7b10b4024fbbdc08899b8f589df2dbb5d7a8d1b36cfab675cb3976ee8100e2878c9cfa178cac130eb046eda93df39ed4b41924dc225ad4028dd63defb87d698be5c749450b350a789dcfc6b2d6a696b5026d1e52f19274566d1da0f353dd65e330ebf71c5e823f2753c5fd76724828ef31b353e71805205c3dceb44c") ptrace$getregset(0x4205, 0x0, 0x2, 0x0) ptrace$getregset(0x4204, 0x0, 0x2, 0x0) r0 = socket$inet_smc(0x2b, 0x1, 0x0) syz_emit_ethernet(0x1e, &(0x7f0000000480)={@link_local={0x1, 0x80, 0xc2, 0x0, 0x0, 0xe}, @remote, @void, {@can={0xc, {{0x2, 0x1, 0x1, 0x1}, 0x1, 0x7, 0x0, 0x0, "071e000046325f04"}}}}, 0x0) listen(r0, 0x5) ioctl$sock_SIOCOUTQNSD(r0, 0x8905, 0x0) r1 = syz_clone(0x0, 0x0, 0x0, 0x0, 0x0, 0x0) process_vm_writev(r1, &(0x7f0000001c80)=[{&(0x7f0000001bc0)=""/156, 0x9c}], 0x53, &(0x7f0000001d80)=[{&(0x7f0000001cc0)=""/109, 0x20001c34}], 0x1, 0x0) ptrace$ARCH_ENABLE_TAGGED_ADDR(0x1e, r1, 0x5, 0x4002) mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./sys\x00', 0x1ff) mount(0x0, &(0x7f0000000000)='./sys\x00', &(0x7f0000000100)='sysfs\x00', 0x10000, 0x0) openat(0xffffffffffffff9c, &(0x7f0000000280)='./sys/bus/usb/drivers/usbip-host/match_busid\x00', 0x1, 0x0) executing program 0: mkdirat(0xffffffffffffff9c, &(0x7f0000000340)='./file1\x00', 0x0) mount(0x0, &(0x7f0000000200)='./file1\x00', &(0x7f0000000000)='tmpfs\x00', 0x8, &(0x7f0000000300)='usrquota') chdir(&(0x7f00000000c0)='./file1\x00') r0 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000040)='net_prio.prioidx\x00', 0x275a, 0x0) quotactl_fd$Q_SETQUOTA(r0, 0xffffffff80000800, 0x0, &(0x7f0000000f80)={0x8000000000000000, 0x4, 0x100000001, 0x3, 0x24, 0xffffffffffffffff, 0x3, 0x4, 0x100fff}) socket(0x23, 0x2, 0x0) r1 = socket$can_raw(0x1d, 0x3, 0x1) setsockopt$CAN_RAW_ERR_FILTER(r1, 0x65, 0x2, &(0x7f0000000140)=0x9, 0x4) mkdir(&(0x7f0000000400)='./file0\x00', 0x114) mkdir(&(0x7f0000000440)='./file1\x00', 0x0) syz_emit_ethernet(0x6e, &(0x7f0000000300)={@local, @empty, @void, {@ipv6={0x86dd, @icmpv6={0x0, 0x6, '\x00', 0x38, 0x3a, 0xff, @remote, @local, {[], @pkt_toobig={0x2, 0x0, 0x0, 0x500, {0x0, 0x6, '\x00', 0x0, 0x6c, 0x40, @local, @remote, [], "3b00123400000000"}}}}}}}, 0x0) mkdir(&(0x7f0000000300)='./bus\x00', 0x0) mount$overlay(0x0, &(0x7f00000000c0)='./bus\x00', &(0x7f0000000080), 0x0, &(0x7f0000000400)={[{@upperdir={'upperdir', 0x3d, './file1'}}, {@lowerdir={'lowerdir', 0x3d, './file0'}}, {@workdir={'workdir', 0x3d, './bus'}}]}) creat(&(0x7f0000000080)='./file0/file1\x00', 0x90) chdir(&(0x7f0000000000)='./bus\x00') chown(&(0x7f00000001c0)='./file1\x00', 0x0, 0x0) executing program 4: r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000080), 0x0, 0x0) r2 = ioctl$KVM_CREATE_VM(r1, 0xae01, 0x0) ioctl$KVM_CREATE_IRQCHIP(r2, 0xae60) ioctl$KVM_CAP_X86_DISABLE_EXITS(r2, 0x4068aea3, &(0x7f0000000240)={0x8f, 0x0, 0x2}) r3 = ioctl$KVM_CREATE_VCPU(r2, 0xae41, 0x0) syz_kvm_setup_cpu$x86(r2, 0xffffffffffffffff, &(0x7f0000fe8000/0x18000)=nil, &(0x7f00000001c0)=[@text16={0x10, 0x0}], 0x1, 0x4, 0x0, 0x0) syz_kvm_setup_cpu$x86(0xffffffffffffffff, r3, &(0x7f0000c4a000/0x18000)=nil, &(0x7f0000000040)=[@text64={0x40, 0x0}], 0x1, 0x53, 0x0, 0x0) r4 = userfaultfd(0x801) ioctl$UFFDIO_API(r4, 0xc018aa3f, &(0x7f00000020c0)={0xaa, 0xbd}) ioctl$UFFDIO_REGISTER(r4, 0xc020aa00, &(0x7f0000000140)={{&(0x7f0000400000/0xc00000)=nil, 0xc00000}, 0x3}) ioctl$KVM_RUN(r3, 0xae80, 0x0) mq_unlink(&(0x7f0000000340)='/th0\x00') r5 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000000), r0) sendmsg$NL80211_CMD_FRAME(r0, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000fc0)={&(0x7f0000000600)=ANY=[@ANYBLOB='@\x00\x00\x00', @ANYRES16=r5, @ANYBLOB="010000000000000000000200000008000300", @ANYRES32, @ANYBLOB="0c0099"], 0x40}, 0x1, 0x0, 0x0, 0x8000}, 0x0) executing program 3: r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000240), 0xffffffffffffffff) sendmsg$NL80211_CMD_FRAME(r0, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000fc0)={&(0x7f0000000600)=ANY=[@ANYBLOB='@\x00\x00\x00', @ANYRES16=r1, @ANYBLOB="010000000000000000000200000008000300", @ANYRES32, @ANYBLOB="0c0099"], 0x40}, 0x1, 0x0, 0x0, 0x8000}, 0x0) program crashed: SYZFAIL: initialize_wifi_devices: failed set up IBSS network bisect: the chunk can be dropped bisect: testing without sub-chunk 2/3 testing program (duration=6m2s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): [30, 11, 30, 7, 22, 27, 14, 16, 15, 3] detailed listing: executing program 3: r0 = socket$nl_route(0x10, 0x3, 0x0) r1 = socket(0x10, 0x803, 0x0) sendmsg$nl_route(r1, &(0x7f00000006c0)={0x0, 0x0, &(0x7f0000000680)={0x0, 0x18}}, 0x0) getsockname$packet(r1, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) sendmsg$nl_route(r0, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000000)={&(0x7f00000002c0)=ANY=[@ANYBLOB="5000000010008105e9c51c000000000000000000", @ANYRES32=r2, @ANYBLOB="01000000000000002800128009000100766c616e000000001800028006000100000000000c0002000c0000000d00000008000500", @ANYRES64=r0], 0x50}, 0x1, 0x0, 0x0, 0x80}, 0x0) sendmsg$nl_route(0xffffffffffffffff, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000700)=@newlink={0x20, 0x10, 0x1, 0x1, 0x25dfdbff, {0x0, 0x0, 0x0, r2, 0x0, 0x8}}, 0x20}, 0x1, 0x0, 0x0, 0x11}, 0x0) ioctl$sock_inet6_SIOCADDRT(0xffffffffffffffff, 0x890b, &(0x7f0000000380)={@local, @empty, @initdev={0xfe, 0x88, '\x00', 0x1, 0x0}, 0x3, 0x6, 0x5, 0x200, 0x4, 0x100020, r2}) mkdirat(0xffffffffffffff9c, &(0x7f0000000400)='./config\x00', 0x1ed) socket$nl_xfrm(0x10, 0x3, 0x6) mount(0x0, &(0x7f0000000500)='./config\x00', &(0x7f0000000600)='configfs\x00', 0x0, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000700)='./config/usb_gadget/g1\x00', 0x1ed) mkdirat(0xffffffffffffff9c, &(0x7f0000000c00)='./config/usb_gadget/g1/UDC\x00', 0x1c4) bpf$PROG_LOAD(0x5, 0x0, 0x0) socket(0x3d, 0x80000, 0x5) mkdirat(0xffffffffffffff9c, &(0x7f0000000d00)='./config/usb_gadget/g1/functions/uvc.usb0/control/header/h\x00', 0x1ed) r3 = openat$dir(0xffffffffffffff9c, 0x0, 0x400007, 0x2) readlinkat(r3, &(0x7f0000000040)='./config/usb_gadget/g1/configs/c.1/uvc.usb0\x00', 0x0, 0x0) symlinkat(&(0x7f0000000e00)='./config/usb_gadget/g1/functions/uvc.usb0/control/header/h\x00', 0xffffffffffffff9c, &(0x7f0000000f00)='./config/usb_gadget/g1/functions/uvc.usb0/control/class/fs/h\x00') symlinkat(0x0, 0xffffffffffffffff, 0x0) r4 = openat(0xffffffffffffff9c, &(0x7f0000002000)='./config/usb_gadget/g1/UDC\x00', 0x1, 0x0) write(r4, &(0x7f0000002100)='usbip-vudc.0', 0xc) r5 = socket$netlink(0x10, 0x3, 0x0) stat(&(0x7f00000001c0)='./config\x00', &(0x7f0000000200)) r6 = bpf$BPF_BTF_LOAD(0x12, &(0x7f0000000140)={&(0x7f0000000100)={{0xeb9f, 0x1, 0x0, 0x18, 0x0, 0x20, 0x20, 0x4, [@func={0x2, 0x0, 0x0, 0xc, 0x2}, @func_proto={0x0, 0x1, 0x0, 0xd, 0x0, [{}]}]}, {0x0, [0x0, 0x5f]}}, 0x0, 0x3c}, 0x28) bpf$PROG_LOAD_XDP(0x5, &(0x7f00000002c0)={0x6, 0x3, &(0x7f0000000000)=@framed={{0x18, 0x0, 0x0, 0x0, 0x7, 0x0, 0x0, 0x0, 0xc0}}, &(0x7f0000000080)='GPL\x00', 0xf, 0x0, 0x0, 0x40f00, 0x4, '\x00', 0x0, 0x25, r6, 0x8, &(0x7f0000000180)={0x0, 0x1}, 0x1, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0x4}, 0x94) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000040)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$sock_SIOCGIFINDEX(r7, 0x8933, &(0x7f0000000080)={'macsec0\x00', 0x0}) r9 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$inet6_buf(r9, 0x29, 0x20, &(0x7f00000000c0)="0bbb268dd6ffa80800000000000000000000210d0000aaa8fa017242ba9380d4", 0x20) sendmsg$nl_route(r5, &(0x7f00000000c0)={0x0, 0x0, &(0x7f00000002c0)={&(0x7f0000000000)=ANY=[@ANYBLOB="280000001d000100000000010000000007000000", @ANYRES32=r8, @ANYRESDEC=r5], 0x28}, 0x1, 0x0, 0x0, 0x4041}, 0x0) executing program 0: mkdirat(0xffffffffffffff9c, &(0x7f00000000c0)='./file0\x00', 0x10) mkdirat(0xffffffffffffff9c, &(0x7f00000000c0)='./bus\x00', 0x1c5) mount$overlay(0x0, &(0x7f0000000100)='./file0\x00', &(0x7f0000000040), 0x8, &(0x7f0000000240)={[{@upperdir={'upperdir', 0x3d, './file0'}}, {@workdir={'workdir', 0x3d, './bus'}}, {@lowerdir={'lowerdir', 0x3d, '.'}}]}) socket$xdp(0x2c, 0x3, 0x0) r0 = socket$kcm(0x2c, 0x3, 0x0) close(r0) r1 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPCTNL_MSG_CT_GET(r1, &(0x7f0000000200)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000300)=ANY=[@ANYBLOB="ac0000000001050500000000000000000a0000003c0002802c00018014000300ff01000000000000000000000000000114000400ff0200000000000000000000000000010c00028005000100000000003c0001800c00028005000100000000002c00018014000300ff0200000000000000000000000000811400040000000000000000000001ffffac1e00010800074000000001180006801400040000000000000000000000000000000001"], 0xac}}, 0x0) sendmsg$IPCTNL_MSG_EXP_GET(r1, &(0x7f0000006680)={0x0, 0x0, &(0x7f0000006640)={&(0x7f00000065c0)=ANY=[@ANYBLOB="500000000102010100000000000000000a0000003c0001802c00018014000300ff01000000000000000000000000000114000400000000000000000000000000000000010c0002580500010000000000"], 0x50}, 0x1, 0x0, 0x0, 0x800}, 0x0) chdir(&(0x7f0000000000)='./file0\x00') mknod$loop(&(0x7f0000000000)='./file0aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa\x00', 0x2000, 0x1) executing program 4: setsockopt$inet_mreqsrc(0xffffffffffffffff, 0x0, 0x27, &(0x7f0000000280)={@multicast2, @local, @remote}, 0xc) r0 = socket(0x1, 0x803, 0x0) r1 = socket$nl_route(0x10, 0x3, 0x0) getsockname$packet(r0, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f00000002c0)=0x14) sendmsg$nl_route(r1, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000340)=ANY=[@ANYBLOB="540000001000010400"/20, @ANYRES32=0x0, @ANYBLOB="00000000000000002c0012800e0001006970366772657461700000001800028014000700ff01000000000000000000000000000108000a00", @ANYRES32=r2], 0x54}}, 0x0) setsockopt$inet_IP_XFRM_POLICY(0xffffffffffffffff, 0x0, 0x11, &(0x7f00000005c0)={{{@in6=@local, @in=@broadcast, 0x4e23, 0x6, 0x4e24, 0x0, 0x0, 0x0, 0x80, 0x8, r2, 0xee01}, {0x8, 0x8, 0x791a, 0x69, 0xf07a, 0x7, 0xbf9, 0x2}, {0x0, 0x40, 0x0, 0x3}, 0x4f55945f, 0x6e6bc0, 0x0, 0x1}, {{@in6=@ipv4={'\x00', '\xff\xff', @rand_addr=0x64010100}, 0x4d2, 0xff}, 0xa, @in6=@ipv4={'\x00', '\xff\xff', @local}, 0x3507, 0x0, 0x0, 0x0, 0x9, 0x10001, 0x9bde}}, 0xe8) r3 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) r4 = ioctl$KVM_CREATE_VM(r3, 0xae01, 0x2a) ioctl$KVM_SET_USER_MEMORY_REGION(r4, 0x4020ae46, &(0x7f0000000100)={0x4, 0x1, 0xffff1000, 0x1000, &(0x7f0000012000/0x1000)=nil}) r5 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000240), 0x0, 0x0) r6 = ioctl$KVM_CREATE_VM(r5, 0xae01, 0x0) ioctl$SG_IO(0xffffffffffffffff, 0x2285, &(0x7f0000000400)={0x53, 0xfffffffffffffffb, 0x5, 0x8, @buffer={0x0, 0x0, 0x0}, &(0x7f0000000200)="0004000019", 0x0, 0x0, 0x10011, 0xfffbffff, 0x0}) r7 = ioctl$KVM_CREATE_VCPU(r6, 0xae41, 0x0) ioctl$KVM_SET_USER_MEMORY_REGION(r6, 0x4020ae46, &(0x7f0000000180)={0x0, 0x0, 0x0, 0x2000, &(0x7f0000000000/0x2000)=nil}) ioctl$KVM_SET_REGS(r7, 0x4090ae82, &(0x7f0000000000)={[0x35, 0xfff, 0xfffffffffffffffe, 0x40000000000180, 0x2, 0x7, 0xf2, 0xd, 0x7fffffffffffe, 0x7, 0x5, 0xb, 0x7, 0xfffffffffffffff8, 0x9, 0xc], 0x25000, 0x304}) r8 = syz_ublk_setup_io_uring(0x20, &(0x7f0000000340)={0x0, 0x0, 0x100, 0x2, 0x1e5}, &(0x7f0000000000)=0x0, &(0x7f0000000040)=0x0, &(0x7f0000000980)=0x0) syz_io_uring_submit(r9, r10, r11, &(0x7f00000004c0)=@IORING_OP_RENAMEAT={0x23, 0xe, 0x0, 0xffffffffffffffff, &(0x7f0000000540)='./file0\x00', &(0x7f0000000580)='./file0\x00'}) unshare(0x22060600) syz_ublk_add_dev(r8, r9, r10, r11, &(0x7f00000000c0)={0x2e, 0x9, 0x0, r8, 0xc0207504, 0x0, 0x0, 0x0, 0x0, 0x800, 0x0, 0x0, '\x00', {0xffffffff, 0xffff, 0x40, &(0x7f0000000080)=@any_dev={0x1, 0xe8d, 0x0, 0x0, 0x1000, 0x1}}}, &(0x7f0000000180)) ioctl$KVM_RUN(r7, 0xae80, 0x0) r12 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$nl_generic(r12, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000140)={&(0x7f00000004c0)=ANY=[@ANYBLOB="18000000260001031dbd7002fadbdf25010000000400ae"], 0x18}}, 0x0) recvmmsg(r12, &(0x7f0000000800)=[{{0x0, 0x0, &(0x7f00000009c0)=[{&(0x7f0000000500)=""/140, 0x8c}, {&(0x7f0000000a40)=""/4148, 0xdf0}, {&(0x7f0000000040)=""/184, 0xb8}, {&(0x7f0000003800)=""/4104, 0x1008}, {&(0x7f0000000280)=""/65, 0x41}, {&(0x7f0000000200)=""/36, 0x24}], 0x6}, 0xd}, {{0x0, 0x0, 0x0}, 0x8}, {{0x0, 0x0, 0x0}, 0x38000000}, {{0x0, 0x0, 0x0}}], 0x4, 0x40000102, 0x0) r13 = ioctl$KVM_CREATE_VM(r3, 0xae01, 0x0) r14 = dup(r13) ioctl$KVM_SET_USER_MEMORY_REGION(r13, 0x4020ae46, &(0x7f0000000840)={0x1fe, 0x2, 0x3000, 0x2000, &(0x7f0000003000/0x2000)=nil}) r15 = ioctl$KVM_CREATE_VCPU(r14, 0xae41, 0x2001) syz_kvm_setup_cpu$x86(0xffffffffffffffff, r15, &(0x7f0000000000/0x18000)=nil, &(0x7f0000000040)=[@text32={0x20, 0x0}], 0x1, 0x11, 0x0, 0x0) syz_kvm_setup_cpu$x86(r13, 0xffffffffffffffff, &(0x7f0000000000/0x18000)=nil, &(0x7f0000000200)=[@text32={0x20, 0x0}], 0x1, 0x50, 0x0, 0x0) ioctl$KVM_RUN(r15, 0xae80, 0x0) executing program 3: r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000300), 0x900, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) ioctl$KVM_SET_USER_MEMORY_REGION(r1, 0x4020ae46, &(0x7f0000000400)={0x0, 0x0, 0x0, 0x20002000, &(0x7f0000000000/0x2000)=nil}) r2 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0) syz_kvm_setup_cpu$x86(0xffffffffffffffff, r2, &(0x7f0000000000/0x18000)=nil, &(0x7f0000000140)=[@text64={0x40, 0x0}], 0x1, 0xe8, 0x0, 0x0) sendmsg$kcm(0xffffffffffffffff, &(0x7f0000000000)={0x0, 0x0, 0x0}, 0x0) ioctl$KVM_RUN(r2, 0xae80, 0x0) (fail_nth: 14) executing program 0: sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000280)={&(0x7f0000000600)=@deltfilter={0x24, 0x2d, 0x300, 0x70bd2d, 0x25dfdbfd, {0x0, 0x0, 0x0, 0x0, {0x2, 0x2}, {0x9, 0xe}, {0x8, 0xffe0}}}, 0x24}}, 0x10) r0 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r0, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000240)=ANY=[@ANYBLOB="140000001000010000000000000000000500000a28000000000a030000000000000000000a00000708000240000000020900010073797a31000000002c000000030a010100000000000000000a0000070900010073797a31000000000900030073797a320000000014000000110001"], 0x7c}, 0x1, 0x0, 0x0, 0x4000}, 0x0) sendmsg$NFT_BATCH(r0, &(0x7f0000009b40)={0x0, 0x0, &(0x7f0000009b00)={&(0x7f0000000100)={{0x14, 0x10, 0x1, 0x0, 0x0, {0x5}}, [@NFT_MSG_NEWRULE={0x44, 0x6, 0xa, 0x401, 0x0, 0x0, {0xa, 0x0, 0x7}, [@NFTA_RULE_TABLE={0x9, 0x1, 'syz1\x00'}, @NFTA_RULE_EXPRESSIONS={0x18, 0x4, 0x0, 0x1, [{0x14, 0x1, 0x0, 0x1, @xfrm={{0x9}, @val={0x4}}}]}, @NFTA_RULE_CHAIN={0x9, 0x2, 'syz2\x00'}]}], {0x14, 0x11, 0x1, 0x0, 0x0, {0x1}}}, 0x6c}, 0x1, 0x0, 0x0, 0x204c054}, 0x20040040) r1 = socket$rds(0x15, 0x5, 0x0) bind$rds(r1, &(0x7f0000000840)={0x2, 0x0, @loopback}, 0x10) r2 = ioctl$KVM_CREATE_VM(0xffffffffffffffff, 0xae01, 0x36) ioctl$KVM_CREATE_VCPU(r2, 0xae41, 0x2) r3 = syz_open_dev$sndpcmc(&(0x7f0000000000), 0xb, 0x0) ioctl$SNDRV_PCM_IOCTL_HW_REFINE(r3, 0xc2604110, &(0x7f0000000040)={0x0, [[0x9ef8, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7fffffff], [0x10000, 0x0, 0x0, 0x0, 0x8001], [0x6, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0xffffffff]], '\x00', [{}, {0xfffffffd}, {}, {0x0, 0x0, 0x0, 0x1, 0x1}, {0x5, 0x0, 0x0, 0x1, 0x1}, {0x7fff, 0xfffffffa}, {}, {0x7fffffc, 0x8f96}, {}, {}, {0x0, 0xffffffff}, {0x8000}], '\x00', 0x7fffffff}) sendmsg$rds(r1, &(0x7f0000000740)={&(0x7f0000000040)={0x2, 0x4e23, @local}, 0x10, 0x0, 0x0, &(0x7f0000000100)=[@cswp={0x58, 0x114, 0x7, {{0x5, 0x2}, 0x0, 0x0, 0x5eae, 0x0, 0xd, 0x9, 0x2, 0x9}}], 0x58}, 0x0) sendmsg$nl_route(0xffffffffffffffff, &(0x7f0000000300)={0x0, 0x0, &(0x7f0000000080)={0x0, 0x48}, 0x1, 0x0, 0x0, 0x10}, 0x0) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000100)=@newqdisc={0x44, 0x24, 0x108, 0x0, 0x65dfdbfb, {0x0, 0x0, 0x0, 0x0, {0xffff, 0xffe0}, {0xffff, 0x7ff8}, {0xfff2}}, [@qdisc_kind_options=@q_fq_pie={{0xb}, {0x14, 0x8002, [@TCA_FQ_PIE_BYTEMODE={0x8}, @TCA_FQ_PIE_QUANTUM={0x8, 0x7, 0xffffff22}]}}]}, 0x44}, 0x1, 0x0, 0x0, 0x1}, 0x0) mmap(&(0x7f0000ffc000/0x4000)=nil, 0x4000, 0x8, 0x8010, r1, 0x14c66000) sendmsg$nl_route(0xffffffffffffffff, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000100)=ANY=[@ANYBLOB="500000001000010425bbe5ad600027842cf52300", @ANYRES32=0x0, @ANYBLOB="0000000000008000280012800a00010076786c616e00"], 0x50}}, 0x4008840) r4 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFULNL_MSG_CONFIG(r4, &(0x7f0000000400)={&(0x7f0000000440)={0x10, 0x0, 0x0, 0x400}, 0xc, &(0x7f00000003c0)={&(0x7f0000000340)={0x68, 0x1, 0x4, 0x201, 0x0, 0x0, {0x2}, [@NFULA_CFG_FLAGS={0x6, 0x6, 0x1, 0x0, 0x4}, @NFULA_CFG_NLBUFSIZ={0x8, 0x3, 0x1, 0x0, 0x5}, @NFULA_CFG_MODE={0xa, 0x2, {0x85}}, @NFULA_CFG_QTHRESH={0x8, 0x5, 0x1, 0x0, 0x1e8f352f}, @NFULA_CFG_TIMEOUT={0x8, 0x4, 0x1, 0x0, 0x7ff}, @NFULA_CFG_CMD={0x5, 0x1, 0x1}, @NFULA_CFG_QTHRESH={0x8, 0x5, 0x1, 0x0, 0x1}, @NFULA_CFG_MODE={0xa, 0x2, {0x1}}, @NFULA_CFG_MODE={0xa, 0x2, {0x4}}]}, 0x68}, 0x1, 0x0, 0x0, 0x4040000}, 0x10) mount$tmpfs(0x0, &(0x7f00000000c0)='./file0\x00', &(0x7f00000001c0), 0x10810, &(0x7f0000000200)={[{@usrquota_block_hardlimit={'usrquota_block_hardlimit', 0x3d, [0x25, 0x6d]}}], [{@rootcontext={'rootcontext', 0x3d, 'user_u'}}, {@subj_user={'subj_user', 0x3d, '@!@'}}]}) r5 = syz_io_uring_complete(0x0, 0x0) ioctl$sock_inet6_tcp_SIOCOUTQ(r5, 0x5411, &(0x7f0000000480)) r6 = socket$netlink(0x10, 0x3, 0x0) sendmmsg(r6, &(0x7f00000002c0), 0x40000000000009f, 0x0) executing program 4: r0 = openat$iommufd(0xffffffffffffff9c, &(0x7f0000000180), 0x0, 0x0) ioctl$IOMMU_IOAS_ALLOC(r0, 0x3b81, &(0x7f0000000100)={0xc, 0x0, 0x0}) ioctl$IOMMU_TEST_OP_MOCK_DOMAIN_FLAGS(r0, 0x3ba0, &(0x7f0000000240)={0x48, 0x2, r1, 0x0, 0x0, 0x0, 0x0, 0x1}) ioctl$IOMMU_IOAS_MAP$PAGES(r0, 0x3b85, &(0x7f00000007c0)={0x28, 0x5, r1, 0x0, &(0x7f00002ce000/0x1000)=nil, 0x1000, 0x1020800}) r2 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) keyctl$set_reqkey_keyring(0x5, 0xfffffffe) request_key(&(0x7f0000000480)='cifs.spnego\x00', &(0x7f00000004c0)={'syz', 0x3}, &(0x7f0000000500)='key_or_keyring:', 0x0) ioctl$IOMMU_VFIO_IOAS$GET(r0, 0x3b88, &(0x7f0000000140)={0xc, 0x0}) ioctl$IOMMU_TEST_OP_MOCK_DOMAIN_FLAGS(r0, 0x3ba0, &(0x7f00000001c0)={0x48, 0x2, r3, 0x0, 0x0, 0x0, 0x0, 0x1}) bind$bt_hci(r2, &(0x7f0000000000)={0x1f, 0xffff}, 0x4) setsockopt$packet_fanout_data(0xffffffffffffffff, 0x107, 0x16, &(0x7f0000000100)={0x1, &(0x7f0000000180)=[{0x1, 0x1}]}, 0x10) write$binfmt_misc(r2, &(0x7f0000000100), 0x6) r4 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) bind$bt_hci(r4, &(0x7f0000000080)={0x1f, 0xffffffffffffffff, 0x3}, 0x6) write(r4, &(0x7f0000000000)="2e000000010002", 0x404) r5 = socket$nl_route(0x10, 0x3, 0x0) r6 = inotify_init1(0x800) inotify_add_watch(r6, 0x0, 0xc0000484) r7 = seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0x0, &(0x7f0000000000)={0x1, &(0x7f0000000100)=[{0x6, 0x72, 0x0, 0x7fff0000}]}) close_range(r7, 0xffffffffffffffff, 0x0) ioctl$sock_SIOCETHTOOL(r5, 0x8946, &(0x7f0000000000)={'gretap0\x00', &(0x7f0000000080)=@ethtool_ts_info={0x3a}}) r8 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPSET_CMD_CREATE(r8, &(0x7f0000001780)={0x0, 0x0, &(0x7f0000000600)={&(0x7f0000001840)=ANY=[@ANYBLOB="540000000206010200000000000000000000000105000100070000000900020073797a30000000000c0007800500150001000000050004000000000010000300666173683a69702c6d616300050005000a000000"], 0x54}, 0x1, 0x0, 0x0, 0xc040}, 0x0) bpf$MAP_CREATE(0x0, &(0x7f0000000640)=ANY=[@ANYBLOB="160000000000000004000000ff"], 0x48) r9 = syz_open_procfs(0xffffffffffffffff, &(0x7f00000042c0)='fdinfo/3\x00') read$FUSE(r9, &(0x7f0000000080)={0x2020}, 0x2020) msgctl$MSG_INFO(0x0, 0xc, &(0x7f0000000000)=""/194) executing program 3: ptrace(0x10, 0x0) ptrace$setregs(0xd, 0x0, 0x0, &(0x7f00000003c0)="18607651149d7b10b4024fbbdc08899b8f589df2dbb5d7a8d1b36cfab675cb3976ee8100e2878c9cfa178cac130eb046eda93df39ed4b41924dc225ad4028dd63defb87d698be5c749450b350a789dcfc6b2d6a696b5026d1e52f19274566d1da0f353dd65e330ebf71c5e823f2753c5fd76724828ef31b353e71805205c3dceb44c") ptrace$getregset(0x4205, 0x0, 0x2, 0x0) ptrace$getregset(0x4204, 0x0, 0x2, 0x0) r0 = socket$inet_smc(0x2b, 0x1, 0x0) syz_emit_ethernet(0x1e, &(0x7f0000000480)={@link_local={0x1, 0x80, 0xc2, 0x0, 0x0, 0xe}, @remote, @void, {@can={0xc, {{0x2, 0x1, 0x1, 0x1}, 0x1, 0x7, 0x0, 0x0, "071e000046325f04"}}}}, 0x0) listen(r0, 0x5) ioctl$sock_SIOCOUTQNSD(r0, 0x8905, 0x0) r1 = syz_clone(0x0, 0x0, 0x0, 0x0, 0x0, 0x0) process_vm_writev(r1, &(0x7f0000001c80)=[{&(0x7f0000001bc0)=""/156, 0x9c}], 0x53, &(0x7f0000001d80)=[{&(0x7f0000001cc0)=""/109, 0x20001c34}], 0x1, 0x0) ptrace$ARCH_ENABLE_TAGGED_ADDR(0x1e, r1, 0x5, 0x4002) mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./sys\x00', 0x1ff) mount(0x0, &(0x7f0000000000)='./sys\x00', &(0x7f0000000100)='sysfs\x00', 0x10000, 0x0) openat(0xffffffffffffff9c, &(0x7f0000000280)='./sys/bus/usb/drivers/usbip-host/match_busid\x00', 0x1, 0x0) executing program 0: mkdirat(0xffffffffffffff9c, &(0x7f0000000340)='./file1\x00', 0x0) mount(0x0, &(0x7f0000000200)='./file1\x00', &(0x7f0000000000)='tmpfs\x00', 0x8, &(0x7f0000000300)='usrquota') chdir(&(0x7f00000000c0)='./file1\x00') r0 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000040)='net_prio.prioidx\x00', 0x275a, 0x0) quotactl_fd$Q_SETQUOTA(r0, 0xffffffff80000800, 0x0, &(0x7f0000000f80)={0x8000000000000000, 0x4, 0x100000001, 0x3, 0x24, 0xffffffffffffffff, 0x3, 0x4, 0x100fff}) socket(0x23, 0x2, 0x0) r1 = socket$can_raw(0x1d, 0x3, 0x1) setsockopt$CAN_RAW_ERR_FILTER(r1, 0x65, 0x2, &(0x7f0000000140)=0x9, 0x4) mkdir(&(0x7f0000000400)='./file0\x00', 0x114) mkdir(&(0x7f0000000440)='./file1\x00', 0x0) syz_emit_ethernet(0x6e, &(0x7f0000000300)={@local, @empty, @void, {@ipv6={0x86dd, @icmpv6={0x0, 0x6, '\x00', 0x38, 0x3a, 0xff, @remote, @local, {[], @pkt_toobig={0x2, 0x0, 0x0, 0x500, {0x0, 0x6, '\x00', 0x0, 0x6c, 0x40, @local, @remote, [], "3b00123400000000"}}}}}}}, 0x0) mkdir(&(0x7f0000000300)='./bus\x00', 0x0) mount$overlay(0x0, &(0x7f00000000c0)='./bus\x00', &(0x7f0000000080), 0x0, &(0x7f0000000400)={[{@upperdir={'upperdir', 0x3d, './file1'}}, {@lowerdir={'lowerdir', 0x3d, './file0'}}, {@workdir={'workdir', 0x3d, './bus'}}]}) creat(&(0x7f0000000080)='./file0/file1\x00', 0x90) chdir(&(0x7f0000000000)='./bus\x00') chown(&(0x7f00000001c0)='./file1\x00', 0x0, 0x0) executing program 4: r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000080), 0x0, 0x0) r2 = ioctl$KVM_CREATE_VM(r1, 0xae01, 0x0) ioctl$KVM_CREATE_IRQCHIP(r2, 0xae60) ioctl$KVM_CAP_X86_DISABLE_EXITS(r2, 0x4068aea3, &(0x7f0000000240)={0x8f, 0x0, 0x2}) r3 = ioctl$KVM_CREATE_VCPU(r2, 0xae41, 0x0) syz_kvm_setup_cpu$x86(r2, 0xffffffffffffffff, &(0x7f0000fe8000/0x18000)=nil, &(0x7f00000001c0)=[@text16={0x10, 0x0}], 0x1, 0x4, 0x0, 0x0) syz_kvm_setup_cpu$x86(0xffffffffffffffff, r3, &(0x7f0000c4a000/0x18000)=nil, &(0x7f0000000040)=[@text64={0x40, 0x0}], 0x1, 0x53, 0x0, 0x0) r4 = userfaultfd(0x801) ioctl$UFFDIO_API(r4, 0xc018aa3f, &(0x7f00000020c0)={0xaa, 0xbd}) ioctl$UFFDIO_REGISTER(r4, 0xc020aa00, &(0x7f0000000140)={{&(0x7f0000400000/0xc00000)=nil, 0xc00000}, 0x3}) ioctl$KVM_RUN(r3, 0xae80, 0x0) mq_unlink(&(0x7f0000000340)='/th0\x00') r5 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000000), r0) sendmsg$NL80211_CMD_FRAME(r0, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000fc0)={&(0x7f0000000600)=ANY=[@ANYBLOB='@\x00\x00\x00', @ANYRES16=r5, @ANYBLOB="010000000000000000000200000008000300", @ANYRES32, @ANYBLOB="0c0099"], 0x40}, 0x1, 0x0, 0x0, 0x8000}, 0x0) executing program 3: r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000240), 0xffffffffffffffff) sendmsg$NL80211_CMD_FRAME(r0, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000fc0)={&(0x7f0000000600)=ANY=[@ANYBLOB='@\x00\x00\x00', @ANYRES16=r1, @ANYBLOB="010000000000000000000200000008000300", @ANYRES32, @ANYBLOB="0c0099"], 0x40}, 0x1, 0x0, 0x0, 0x8000}, 0x0) program did not crash bisect: testing without sub-chunk 3/3 testing program (duration=6m2s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): [5, 10, 10, 12, 5, 28, 3, 12, 2, 18, 30] detailed listing: executing program 1: r0 = socket$inet_udp(0x2, 0x2, 0x0) r1 = openat$tun(0xffffffffffffff9c, &(0x7f0000000100), 0x2, 0x0) ioctl$TUNSETIFF(r1, 0x400454ca, &(0x7f0000000040)={'syzkaller0\x00', 0x4001}) ioctl$sock_inet_SIOCSIFFLAGS(r0, 0x8914, &(0x7f0000000200)={'syzkaller0\x00', 0x1}) write$tun(r1, &(0x7f0000000140)=ANY=[@ANYBLOB="0000080001000000000e140008004500003c000000004084ca2502020202ac140001"], 0x4a) executing program 1: r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000300), 0x900, 0x0) r1 = socket$inet_udp(0x2, 0x2, 0x0) ioctl$sock_ipv6_tunnel_SIOCGETPRL(r1, 0x89f4, &(0x7f0000000040)={'sit0\x00', 0x0}) r2 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) ioctl$KVM_SET_USER_MEMORY_REGION(r2, 0x4020ae46, &(0x7f0000000400)={0x0, 0x0, 0x0, 0x20002000, &(0x7f0000000000/0x2000)=nil}) syz_kvm_setup_cpu$x86(0xffffffffffffffff, 0xffffffffffffffff, &(0x7f0000000000/0x18000)=nil, &(0x7f0000000140)=[@text64={0x40, 0x0}], 0x1, 0xe8, 0x0, 0x0) ioctl$KVM_CAP_DIRTY_LOG_RING_ACQ_REL(r2, 0x4068aea3, &(0x7f00000000c0)={0xdf, 0x0, 0x1000}) syz_kvm_add_vcpu$x86(0x0, &(0x7f0000000980)={0x0, &(0x7f0000000440)=[@nested_load_code={0x12e, 0x79, {0x3, "c4a18172d401c744240022000000c744240281e9d8ffc7442406000000000f011c24c7442400a9000000c7442402f0a6d482ff1c24b964090000b80001c0feba000000000f300f320f01c3420f01f83e430f01cbc4a27d2014e966b85f000f00d0"}}], 0x79}) ioctl$KVM_RUN(0xffffffffffffffff, 0xae80, 0x0) syz_kvm_setup_cpu$x86(r2, 0xffffffffffffffff, &(0x7f0000000000/0x18000)=nil, &(0x7f0000000080)=[@text64={0x40, 0x0}], 0x1, 0x10, 0x0, 0x0) executing program 33: r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000300), 0x900, 0x0) r1 = socket$inet_udp(0x2, 0x2, 0x0) ioctl$sock_ipv6_tunnel_SIOCGETPRL(r1, 0x89f4, &(0x7f0000000040)={'sit0\x00', 0x0}) r2 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) ioctl$KVM_SET_USER_MEMORY_REGION(r2, 0x4020ae46, &(0x7f0000000400)={0x0, 0x0, 0x0, 0x20002000, &(0x7f0000000000/0x2000)=nil}) syz_kvm_setup_cpu$x86(0xffffffffffffffff, 0xffffffffffffffff, &(0x7f0000000000/0x18000)=nil, &(0x7f0000000140)=[@text64={0x40, 0x0}], 0x1, 0xe8, 0x0, 0x0) ioctl$KVM_CAP_DIRTY_LOG_RING_ACQ_REL(r2, 0x4068aea3, &(0x7f00000000c0)={0xdf, 0x0, 0x1000}) syz_kvm_add_vcpu$x86(0x0, &(0x7f0000000980)={0x0, &(0x7f0000000440)=[@nested_load_code={0x12e, 0x79, {0x3, "c4a18172d401c744240022000000c744240281e9d8ffc7442406000000000f011c24c7442400a9000000c7442402f0a6d482ff1c24b964090000b80001c0feba000000000f300f320f01c3420f01f83e430f01cbc4a27d2014e966b85f000f00d0"}}], 0x79}) ioctl$KVM_RUN(0xffffffffffffffff, 0xae80, 0x0) syz_kvm_setup_cpu$x86(r2, 0xffffffffffffffff, &(0x7f0000000000/0x18000)=nil, &(0x7f0000000080)=[@text64={0x40, 0x0}], 0x1, 0x10, 0x0, 0x0) executing program 0: r0 = io_uring_setup(0x2ac3, &(0x7f00000001c0)={0x0, 0x77b6, 0x0, 0x400000, 0xac}) r1 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r1, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000500)={&(0x7f00000002c0)=@newlink={0x3c, 0x10, 0x439, 0x70bd2d, 0x0, {}, [@IFLA_LINKINFO={0x1c, 0x12, 0x0, 0x1, @ipip6={{0xb}, {0xc, 0x2, 0x0, 0x1, [@IFLA_IPTUN_FWMARK={0x8, 0x14, 0x7}]}}}]}, 0x3c}}, 0x0) io_uring_setup(0x650b, 0x0) r2 = syz_open_dev$vim2m(&(0x7f0000000280), 0x4eb36, 0x2) ioctl$vim2m_VIDIOC_REQBUFS(r2, 0xc0145608, &(0x7f00000007c0)={0x1, 0x2, 0x1, 0x0, 0x8}) ioctl$vim2m_VIDIOC_QBUF(r2, 0xc058560f, &(0x7f00000002c0)=@multiplanar_mmap={0x0, 0x2, 0x0, 0xfdfd, 0x0, {}, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, "fafc00"}, 0x0, 0x1, {0x0}}) ioctl$BTRFS_IOC_QUOTA_RESCAN_WAIT(r0, 0x942e, 0x0) r3 = socket$netlink(0x10, 0x3, 0x0) sendmsg$nl_route(r3, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000001140)={&(0x7f0000000140)=@newlink={0x78, 0x10, 0x503, 0x0, 0x2, {0x0, 0x0, 0x0, 0x0, 0x0, 0x1244c}, [@IFLA_LINKINFO={0x58, 0x12, 0x0, 0x1, @vti={{0x8}, {0x4c, 0x2, 0x0, 0x1, [@IFLA_VTI_LOCAL={0x8, 0x4, @private=0xa010101}, @IFLA_VTI_REMOTE={0x8, 0x5, @private=0xa0100fe}, @IFLA_VTI_LOCAL={0x8, 0x4, @rand_addr=0x64010102}, @vti_common_policy=[@IFLA_VTI_FWMARK={0x8, 0x6, 0x2d616b45}, @IFLA_VTI_LINK={0x8}, @IFLA_VTI_IKEY={0x8, 0x2, 0x5}, @IFLA_VTI_FWMARK={0x8, 0x6, 0xe}, @IFLA_VTI_FWMARK={0x8, 0x6, 0x4}, @IFLA_VTI_IKEY={0x8, 0x2, 0x9}]]}}}]}, 0x78}}, 0x0) r4 = openat$procfs(0xffffffffffffff9c, &(0x7f0000000000)='/proc/cgroups\x00', 0x0, 0x0) setsockopt$MRT_DEL_MFC(r4, 0x0, 0xcd, &(0x7f0000000100)={@remote, @local, 0xffffffffffffffff, "497c62504d07e8fcbfc16eccdbef03f9a0fdc7265c6886e9b1b17fe65790058b", 0x200, 0xffff, 0x7ea3, 0xc6}, 0x3c) executing program 3: r0 = socket$unix(0x1, 0x5, 0x0) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000100)={'batadv0\x00', 0x0}) r2 = socket(0x10, 0x3, 0x0) sendmsg$nl_route_sched(r2, &(0x7f0000000200)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000300)=@newqdisc={0x88, 0x24, 0xf0b, 0x70bd26, 0x0, {0x0, 0x0, 0x0, r1, {0x0, 0xffff}, {0xffff, 0xffff}}, [@qdisc_kind_options=@q_mqprio={{0xb}, {0x58, 0x2, {{0x1, [], 0x0, [0x1, 0x2, 0xfffe, 0x0, 0x0, 0x0, 0x0, 0x8, 0x0, 0x5c4, 0x8000, 0x0, 0x0, 0x3dc], [0x0, 0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1000]}}}}]}, 0x88}}, 0x20000000) sendmsg$nl_route_sched(r2, &(0x7f00000012c0)={0x0, 0x0, &(0x7f0000000400)={&(0x7f0000000540)=@newqdisc={0x44, 0x24, 0x4ee4e6a52ff56541, 0x70bd29, 0xfffbffff, {0x0, 0x0, 0x0, r1, {0x0, 0x8}, {0xffff, 0xffff}, {0xc, 0xfff3}}, [@qdisc_kind_options=@q_taprio={{0xb}, {0x14, 0x2, [@TCA_TAPRIO_ATTR_SCHED_ENTRY_LIST={0x10, 0x2, 0x0, 0x1, [{0xc, 0x1, 0x0, 0x1, [@TCA_TAPRIO_SCHED_ENTRY_CMD={0x5, 0x2, 0x66}]}]}]}}]}, 0x44}, 0x1, 0xc000000, 0x0, 0x41}, 0x14) executing program 4: mknodat(0xffffffffffffff9c, &(0x7f0000000100)='./file2\x00', 0x81c0, 0x0) execveat(0xffffffffffffff9c, &(0x7f0000000280)='./file2\x00', 0x0, 0x0, 0x0) mknod$loop(&(0x7f0000000300)='./file0\x00', 0x6000, 0x0) unlink(&(0x7f0000000040)='./file0\x00') mknod$loop(&(0x7f0000000200)='./file0\x00', 0x2000, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./sys\x00', 0x1ff) mount(0x0, &(0x7f00000000c0)='./file1\x00', &(0x7f0000000040)='sysfs\x00', 0x0, 0x0) openat$binderfs(0xffffffffffffff9c, &(0x7f0000000300)='./binderfs/binder0\x00', 0x0, 0x0) openat$binderfs(0xffffffffffffff9c, &(0x7f0000000180)='./binderfs/binder1\x00', 0xc02, 0x0) syz_open_dev$sndpcmc(&(0x7f0000000000), 0x0, 0x0) socket(0x11, 0x2, 0x10001) mmap$IORING_OFF_SQ_RING(0x0, 0xc, 0x2000002, 0x401d031, 0xffffffffffffffff, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000001500)='./dev\x00', 0x1ff) openat(0xffffffffffffff9c, &(0x7f0000000240)='./file0\x00', 0x40042, 0x1) open(&(0x7f00009e1000)='./file0\x00', 0x8060, 0x0) mount(0x0, &(0x7f0000001500)='./dev\x00', &(0x7f0000001600)='devtmpfs\x00', 0x0, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000080)='./mnt\x00', 0x1ff) socket$nl_generic(0x10, 0x3, 0x10) socket$packet(0x11, 0x3, 0x300) socket$packet(0x11, 0x3, 0x300) socketpair$unix(0x1, 0x2, 0x0, 0x0) mount(&(0x7f00000000c0)=@filename='./dev/sda1\x00', &(0x7f0000000140)='./mnt\x00', &(0x7f0000000100)='ext4\x00', 0x8410, 0x0) mprotect(&(0x7f0000000000/0xf000)=nil, 0xf000, 0x1) r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000140), 0x0, 0x0) ioctl$TUNSETIFF(r0, 0x40e8662e, 0x0) r1 = openat(0xffffffffffffff9c, &(0x7f0000000400)='./sys/bus/pci/drivers/net2280/new_id\x00', 0x1, 0x0) write(r1, &(0x7f0000001100)='8086 29c0 ffffffff ffffffff 0 0 1', 0x21) syz_create_resource$binfmt(&(0x7f0000000080)='./sys/bus/pci/drivers/net2280/new_id\x00') executing program 0: r0 = socket$kcm(0x2, 0x3, 0x84) sendmmsg$inet(r0, &(0x7f0000006a80)=[{{&(0x7f0000000000)={0x2, 0x4e22, @dev={0xac, 0x14, 0x14, 0x18}}, 0x10, &(0x7f0000002ac0)=[{&(0x7f0000000080)="f982340819048e40ac0bd4474d", 0xd}], 0x1}}], 0x1, 0x8080) sendmsg$inet(r0, &(0x7f0000000a00)={&(0x7f0000000040)={0x2, 0x4e23, @remote}, 0x10, &(0x7f00000000c0)=[{&(0x7f0000000440)="c10900", 0x3}], 0x1}, 0x6000) executing program 4: syz_emit_ethernet(0x6a, &(0x7f0000000040)={@link_local={0x1, 0x80, 0xc2, 0x0, 0x0, 0x3}, @remote, @void, {@ipv4={0x800, @icmp={{0x5, 0x4, 0x0, 0x1, 0x5c, 0x0, 0x0, 0xfb, 0x1, 0x0, @initdev={0xac, 0x1e, 0x0, 0x0}, @local}, @time_exceeded={0x3, 0x1, 0x0, 0x3, 0x24, 0x0, {0x10, 0x4, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x1, 0x8, @loopback, @rand_addr=0x640100fe, {[@cipso={0x86, 0x29, 0xffffffffffffffff, [{0x0, 0xe, "08c82ce8da6ee06cb8dd9452"}, {0x5, 0x9, "020007651442eb"}, {0x1, 0x2}, {0x2, 0x7, "cf05003179"}, {0x0, 0x3, '\x00'}]}]}}}}}}}, 0x0) socketpair(0x1, 0x1, 0x0, &(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}) r2 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r3 = syz_genetlink_get_family_id$nbd(&(0x7f0000000040), r2) sendmsg$NBD_CMD_CONNECT(r2, &(0x7f0000000400)={0x0, 0x0, &(0x7f0000001a80)={&(0x7f0000000480)={0x5c, r3, 0x1, 0x70bd2c, 0xffe, {}, [@NBD_ATTR_SIZE_BYTES={0xc, 0x2, 0x2}, @NBD_ATTR_SOCKETS={0x28, 0x7, 0x0, 0x1, [{0xc, 0x1, 0x0, 0x1, {0x8, 0x1, r0}}, {0xc, 0x1, 0x0, 0x1, {0x8, 0x1, r0}}, {0xc, 0x1, 0x0, 0x1, {0x8, 0x1, r1}}]}, @NBD_ATTR_SERVER_FLAGS={0xc, 0x5, 0x128}, @NBD_ATTR_BACKEND_IDENTIFIER={0x8, 0xa, 'nbd\x00'}]}, 0x5c}}, 0x20000000) r4 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r5 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r6 = syz_genetlink_get_family_id$netlbl_mgmt(&(0x7f0000002180), r4) sendmsg$NLBL_MGMT_C_REMOVEDEF(r5, &(0x7f0000002240)={0x0, 0x0, &(0x7f0000002200)={&(0x7f00000021c0)={0x14, r6, 0x1, 0x70bd29, 0x25dfdbfd}, 0x14}, 0x1, 0x0, 0x0, 0x4000800}, 0x4000004) sendmsg$NLBL_MGMT_C_ADDDEF(r2, &(0x7f00000001c0)={&(0x7f00000000c0)={0x10, 0x0, 0x0, 0x4000}, 0xc, &(0x7f0000000180)={&(0x7f0000000140)={0x3c, r6, 0x200, 0x70bd2b, 0x25dfdbff, {}, [@NLBL_MGMT_A_DOMAIN={0x9, 0x1, '\xaa\xaa\xaa\xaa\xaa'}, @NLBL_MGMT_A_IPV4MASK={0x8, 0x8, @empty}, @NLBL_MGMT_A_IPV6ADDR={0x14, 0x5, @dev={0xfe, 0x80, '\x00', 0x19}}]}, 0x3c}, 0x1, 0x0, 0x0, 0x48000}, 0x4000000) seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0x0, &(0x7f0000000000)={0x1, &(0x7f0000000100)=[{0x6, 0x0, 0x0, 0x7fff0000}]}) socket(0x1, 0x80402, 0x7) executing program 3: r0 = openat$sysctl(0xffffffffffffff9c, &(0x7f0000000040)='/proc/sys/net/ipv4/tcp_mtu_probing\x00', 0x1, 0x0) pwritev(r0, &(0x7f0000000140), 0x15, 0x9, 0x1) executing program 0: r0 = socket$inet_udp(0x2, 0x2, 0x0) r1 = bpf$BPF_BTF_LOAD(0x12, &(0x7f0000000080)={&(0x7f0000000040)=ANY=[@ANYBLOB="9feb0100180000000000000020000000200000000400000001000000000000010400000020000000010000000000000108"], 0x0, 0x3c}, 0x28) r2 = bpf$MAP_CREATE(0x0, &(0x7f0000000200)=ANY=[@ANYBLOB="1c0000000400000008000000000000000100"/48, @ANYRES32=r1, @ANYBLOB="0100000002"], 0x40) bpf$MAP_LOOKUP_ELEM(0x1, &(0x7f0000000300)={r2, &(0x7f00000000c0)="8fa5", 0x0}, 0x20) setsockopt$IPT_SO_SET_REPLACE(r0, 0x0, 0x40, &(0x7f0000000000)=@raw={'raw\x00', 0x8, 0x3, 0x3c8, 0x0, 0xa, 0x148, 0x0, 0x10, 0x330, 0x2a8, 0x2a8, 0x330, 0x2a8, 0x3, 0x0, {[{{@ip={@rand_addr, @multicast1, 0x0, 0x0, 'bridge0\x00', 'rose0\x00'}, 0x0, 0x70, 0xe0, 0x0, {0x200003ae, 0x7f00}}, @common=@unspec=@NFLOG={0x70, 'NFLOG\x00', 0x0, {0x0, 0x0, 0x0, 0x0, 0x0, "f2f7b90ad2b60c45cb4ea6e7bf902bdc2ff8a9304d9f655c746adc0bdc773506378bc0d27efd6abb05175089830cc46186074d7de46d5af300"}}}, {{@ip={@empty, @local, 0x0, 0x0, 'ip6erspan0\x00', 'veth0_to_team\x00'}, 0x0, 0x1f0, 0x250, 0x0, {}, [@common=@inet=@hashlimit3={{0x158}, {'wg2\x00', {0xffffffffffffffff, 0xff, 0x0, 0x0, 0x0, 0x7fff, 0x200}}}, @inet=@rpfilter={{0x28}}]}, @common=@CLUSTERIP={0x60, 'CLUSTERIP\x00', 0x0, {0x1, @multicast, 0x2, 0x7, [0x0, 0x10, 0x1b, 0x2b, 0x37, 0x2e, 0x2b, 0x18, 0x2b, 0x34, 0xd, 0x0, 0x3d, 0x1, 0x32, 0x37], 0x1, 0x6, 0x1570000000000}}}], {{'\x00', 0xc8, 0x70, 0x98}, {0x28}}}}, 0x428) r3 = openat(0xffffffffffffff9c, &(0x7f0000000040)='./file1\x00', 0x542, 0x0) ioctl$SIOCX25SDTEFACILITIES(r3, 0x89eb, &(0x7f0000000080)={0x81, 0x962, 0x7, 0x7, 0x2, 0xd, 0x3, "4cb8b2a6146ab1a722e031cf656758ee56a018e7", "be634e4a96ef65eb0d23451a8d73bc095839f363"}) pwritev2(r3, &(0x7f00000000c0)=[{&(0x7f0000000300)=')', 0x1}], 0x1, 0x2, 0x0, 0xa1) r4 = syz_open_dev$I2C(&(0x7f0000000000), 0x1, 0x0) ioctl$I2C_PEC(r4, 0x708, 0x40) ioctl$I2C_SMBUS(r4, 0x720, &(0x7f00000002c0)={0x1, 0x7, 0x4, &(0x7f0000000280)={0x5, "1d27f0db2e1f25eff995475188afe0ebe9bab69516a5e88a718dca33021b22b650"}}) r5 = socket$nl_route(0x10, 0x3, 0x0) getsockopt$sock_int(r5, 0x1, 0xb, 0x0, &(0x7f0000000040)) socket$netlink(0x10, 0x3, 0x0) r6 = socket(0x10, 0x803, 0x0) sendmsg$IPVS_CMD_SET_INFO(r6, &(0x7f0000000b00)={0x0, 0x0, &(0x7f0000000ac0)={0x0, 0x14}}, 0x0) r7 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r7, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000240)={&(0x7f0000000180)=ANY=[@ANYBLOB="3c0000001000030400"/20, @ANYRES32=0x0, @ANYBLOB="a4280400000000001400350073797a5f74756e00000000000000000008000a00", @ANYRES32], 0x3c}}, 0x8000) executing program 4: bpf$MAP_CREATE(0x0, &(0x7f0000000000)=ANY=[@ANYBLOB="1400000007"], 0x50) r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000000), 0x40241, 0x0) r1 = socket$pppl2tp(0x18, 0x1, 0x1) r2 = socket$inet6_udp(0xa, 0x2, 0x0) r3 = socket$inet_tcp(0x2, 0x1, 0x0) bind$inet(r3, &(0x7f0000000040)={0x2, 0x4e21, @local}, 0x10) setsockopt$inet_tcp_int(0xffffffffffffffff, 0x6, 0x19, &(0x7f0000000240)=0x6, 0xfffffedf) setsockopt$inet_tcp_TCP_REPAIR_QUEUE(r3, 0x6, 0x14, &(0x7f0000000000)=0x2, 0x4) setsockopt$SO_TIMESTAMPING(r3, 0x1, 0x25, &(0x7f0000000200)=0x437b, 0x4) connect$inet(r3, &(0x7f0000000180)={0x2, 0x4e21, @local}, 0x10) setsockopt$inet_tcp_TCP_REPAIR_OPTIONS(r3, 0x6, 0x16, &(0x7f0000000340)=[@window={0x3, 0x1, 0x8}, @window={0x3, 0x6, 0x7}, @sack_perm, @window={0x3, 0x0, 0x4}, @mss={0x2, 0x4}, @timestamp, @window={0x3, 0x1, 0x10}, @sack_perm], 0x20000000000002a1) sendmsg$inet(r3, &(0x7f0000000300)={0x0, 0x0, &(0x7f0000000140)=[{&(0x7f0000000380)="9ad024c2775e1e2ab8e46a2877fcb21d4bb90500ebb1cfaea615b04f758b1754ce82525f728b072274a6388145b8991b4d0d7e9275d21e257816bb8650d21ba04ac83b4961e7b3a94d", 0x49}], 0x1}, 0x0) setsockopt$inet_tcp_TCP_REPAIR(r3, 0x6, 0x13, &(0x7f00000001c0), 0x4) sendto$inet(r3, &(0x7f00000004c0)='<', 0x381, 0x805, 0x0, 0x0) connect$pppl2tp(r1, &(0x7f0000000080)=@pppol2tpin6={0x18, 0x1, {0x0, r2, 0x6, 0x0, 0x0, 0x0, {0xa, 0x0, 0x0, @local}}}, 0x32) getsockopt$sock_buf(r1, 0x1, 0x1c, 0x0, &(0x7f0000000000)=0x3d) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000200)={'syzkaller1\x00', 0xc201}) r4 = socket$kcm(0x21, 0x2, 0xa) r5 = socket$inet6(0xa, 0x3, 0xff) setsockopt$inet6_int(r5, 0x29, 0x7, &(0x7f0000fcb000)=0xffffffff, 0x4) sendmsg$kcm(r4, &(0x7f0000000080)={&(0x7f0000000000)=@rxrpc=@in6={0x21, 0x1, 0x2, 0x1c, {0xa, 0x0, 0x4, @dev, 0x8000000}}, 0x80, 0x0, 0x0, &(0x7f00000000c0)=[{0x18, 0x110, 0x1, '\x00'}, {0x18, 0x110, 0xc, "aa"}], 0x30}, 0xfc40) r6 = socket$inet6_tcp(0xa, 0x1, 0x0) r7 = dup(r6) ioctl$TIOCSLCKTRMIOS(r7, 0x5457, &(0x7f00000000c0)) ioctl$SIOCSIFHWADDR(r7, 0x8914, &(0x7f0000000040)={'syzkaller1\x00', @link_local={0x1, 0x80, 0xc2, 0x0, 0x0, 0x3}}) write$tun(r0, &(0x7f0000000500)={@val={0x8, 0xc}, @val={0x2, 0x1, 0x4, 0x11, 0x9ca, 0x81}, @ipv4=@icmp={{0x20, 0x4, 0x1, 0x25, 0x94, 0x66, 0x0, 0xa8, 0x1, 0x0, @initdev={0xac, 0x1e, 0x1, 0x0}, @local, {[@ra={0x94, 0x4, 0x1}, @lsrr={0x83, 0x13, 0xa1, [@local, @dev={0xac, 0x14, 0x14, 0x3e}, @local, @multicast1]}, @timestamp_addr={0x44, 0x24, 0x1b, 0x1, 0x9, [{@loopback, 0x7}, {@loopback, 0x200}, {@multicast2}, {@multicast1, 0x4}]}, @cipso={0x86, 0x31, 0x2, [{0x1, 0xb, "b994131c56c477d6f5"}, {0x2, 0x12, "ef0500f6d000"/16}, {0x7, 0x6, "e8c2e380"}, {0x1, 0x8, "1e2d53d7cd98"}]}]}}, @timestamp={0xd, 0x0, 0x0, 0xc000, 0x4, 0x3, 0x401, 0x600}}}, 0xa2) creat(0x0, 0x0) sendto$packet(0xffffffffffffffff, &(0x7f0000000000)='1', 0x1, 0x4000800, 0x0, 0x0) r8 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) bind$bt_hci(r8, &(0x7f0000000040)={0x1f, 0xffff, 0x3}, 0x6) program crashed: SYZFAIL: initialize_wifi_devices: failed set up IBSS network bisect: the chunk can be dropped bisect: split chunks (needed=true): <11> bisect: split chunk #0 of len 11 into 2 parts bisect: testing without sub-chunk 1/2 testing program (duration=6m1s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): [3, 12, 2, 18, 30] detailed listing: executing program 0: r0 = socket$kcm(0x2, 0x3, 0x84) sendmmsg$inet(r0, &(0x7f0000006a80)=[{{&(0x7f0000000000)={0x2, 0x4e22, @dev={0xac, 0x14, 0x14, 0x18}}, 0x10, &(0x7f0000002ac0)=[{&(0x7f0000000080)="f982340819048e40ac0bd4474d", 0xd}], 0x1}}], 0x1, 0x8080) sendmsg$inet(r0, &(0x7f0000000a00)={&(0x7f0000000040)={0x2, 0x4e23, @remote}, 0x10, &(0x7f00000000c0)=[{&(0x7f0000000440)="c10900", 0x3}], 0x1}, 0x6000) executing program 4: syz_emit_ethernet(0x6a, &(0x7f0000000040)={@link_local={0x1, 0x80, 0xc2, 0x0, 0x0, 0x3}, @remote, @void, {@ipv4={0x800, @icmp={{0x5, 0x4, 0x0, 0x1, 0x5c, 0x0, 0x0, 0xfb, 0x1, 0x0, @initdev={0xac, 0x1e, 0x0, 0x0}, @local}, @time_exceeded={0x3, 0x1, 0x0, 0x3, 0x24, 0x0, {0x10, 0x4, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x1, 0x8, @loopback, @rand_addr=0x640100fe, {[@cipso={0x86, 0x29, 0xffffffffffffffff, [{0x0, 0xe, "08c82ce8da6ee06cb8dd9452"}, {0x5, 0x9, "020007651442eb"}, {0x1, 0x2}, {0x2, 0x7, "cf05003179"}, {0x0, 0x3, '\x00'}]}]}}}}}}}, 0x0) socketpair(0x1, 0x1, 0x0, &(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}) r2 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r3 = syz_genetlink_get_family_id$nbd(&(0x7f0000000040), r2) sendmsg$NBD_CMD_CONNECT(r2, &(0x7f0000000400)={0x0, 0x0, &(0x7f0000001a80)={&(0x7f0000000480)={0x5c, r3, 0x1, 0x70bd2c, 0xffe, {}, [@NBD_ATTR_SIZE_BYTES={0xc, 0x2, 0x2}, @NBD_ATTR_SOCKETS={0x28, 0x7, 0x0, 0x1, [{0xc, 0x1, 0x0, 0x1, {0x8, 0x1, r0}}, {0xc, 0x1, 0x0, 0x1, {0x8, 0x1, r0}}, {0xc, 0x1, 0x0, 0x1, {0x8, 0x1, r1}}]}, @NBD_ATTR_SERVER_FLAGS={0xc, 0x5, 0x128}, @NBD_ATTR_BACKEND_IDENTIFIER={0x8, 0xa, 'nbd\x00'}]}, 0x5c}}, 0x20000000) r4 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r5 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r6 = syz_genetlink_get_family_id$netlbl_mgmt(&(0x7f0000002180), r4) sendmsg$NLBL_MGMT_C_REMOVEDEF(r5, &(0x7f0000002240)={0x0, 0x0, &(0x7f0000002200)={&(0x7f00000021c0)={0x14, r6, 0x1, 0x70bd29, 0x25dfdbfd}, 0x14}, 0x1, 0x0, 0x0, 0x4000800}, 0x4000004) sendmsg$NLBL_MGMT_C_ADDDEF(r2, &(0x7f00000001c0)={&(0x7f00000000c0)={0x10, 0x0, 0x0, 0x4000}, 0xc, &(0x7f0000000180)={&(0x7f0000000140)={0x3c, r6, 0x200, 0x70bd2b, 0x25dfdbff, {}, [@NLBL_MGMT_A_DOMAIN={0x9, 0x1, '\xaa\xaa\xaa\xaa\xaa'}, @NLBL_MGMT_A_IPV4MASK={0x8, 0x8, @empty}, @NLBL_MGMT_A_IPV6ADDR={0x14, 0x5, @dev={0xfe, 0x80, '\x00', 0x19}}]}, 0x3c}, 0x1, 0x0, 0x0, 0x48000}, 0x4000000) seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0x0, &(0x7f0000000000)={0x1, &(0x7f0000000100)=[{0x6, 0x0, 0x0, 0x7fff0000}]}) socket(0x1, 0x80402, 0x7) executing program 3: r0 = openat$sysctl(0xffffffffffffff9c, &(0x7f0000000040)='/proc/sys/net/ipv4/tcp_mtu_probing\x00', 0x1, 0x0) pwritev(r0, &(0x7f0000000140), 0x15, 0x9, 0x1) executing program 0: r0 = socket$inet_udp(0x2, 0x2, 0x0) r1 = bpf$BPF_BTF_LOAD(0x12, &(0x7f0000000080)={&(0x7f0000000040)=ANY=[@ANYBLOB="9feb0100180000000000000020000000200000000400000001000000000000010400000020000000010000000000000108"], 0x0, 0x3c}, 0x28) r2 = bpf$MAP_CREATE(0x0, &(0x7f0000000200)=ANY=[@ANYBLOB="1c0000000400000008000000000000000100"/48, @ANYRES32=r1, @ANYBLOB="0100000002"], 0x40) bpf$MAP_LOOKUP_ELEM(0x1, &(0x7f0000000300)={r2, &(0x7f00000000c0)="8fa5", 0x0}, 0x20) setsockopt$IPT_SO_SET_REPLACE(r0, 0x0, 0x40, &(0x7f0000000000)=@raw={'raw\x00', 0x8, 0x3, 0x3c8, 0x0, 0xa, 0x148, 0x0, 0x10, 0x330, 0x2a8, 0x2a8, 0x330, 0x2a8, 0x3, 0x0, {[{{@ip={@rand_addr, @multicast1, 0x0, 0x0, 'bridge0\x00', 'rose0\x00'}, 0x0, 0x70, 0xe0, 0x0, {0x200003ae, 0x7f00}}, @common=@unspec=@NFLOG={0x70, 'NFLOG\x00', 0x0, {0x0, 0x0, 0x0, 0x0, 0x0, "f2f7b90ad2b60c45cb4ea6e7bf902bdc2ff8a9304d9f655c746adc0bdc773506378bc0d27efd6abb05175089830cc46186074d7de46d5af300"}}}, {{@ip={@empty, @local, 0x0, 0x0, 'ip6erspan0\x00', 'veth0_to_team\x00'}, 0x0, 0x1f0, 0x250, 0x0, {}, [@common=@inet=@hashlimit3={{0x158}, {'wg2\x00', {0xffffffffffffffff, 0xff, 0x0, 0x0, 0x0, 0x7fff, 0x200}}}, @inet=@rpfilter={{0x28}}]}, @common=@CLUSTERIP={0x60, 'CLUSTERIP\x00', 0x0, {0x1, @multicast, 0x2, 0x7, [0x0, 0x10, 0x1b, 0x2b, 0x37, 0x2e, 0x2b, 0x18, 0x2b, 0x34, 0xd, 0x0, 0x3d, 0x1, 0x32, 0x37], 0x1, 0x6, 0x1570000000000}}}], {{'\x00', 0xc8, 0x70, 0x98}, {0x28}}}}, 0x428) r3 = openat(0xffffffffffffff9c, &(0x7f0000000040)='./file1\x00', 0x542, 0x0) ioctl$SIOCX25SDTEFACILITIES(r3, 0x89eb, &(0x7f0000000080)={0x81, 0x962, 0x7, 0x7, 0x2, 0xd, 0x3, "4cb8b2a6146ab1a722e031cf656758ee56a018e7", "be634e4a96ef65eb0d23451a8d73bc095839f363"}) pwritev2(r3, &(0x7f00000000c0)=[{&(0x7f0000000300)=')', 0x1}], 0x1, 0x2, 0x0, 0xa1) r4 = syz_open_dev$I2C(&(0x7f0000000000), 0x1, 0x0) ioctl$I2C_PEC(r4, 0x708, 0x40) ioctl$I2C_SMBUS(r4, 0x720, &(0x7f00000002c0)={0x1, 0x7, 0x4, &(0x7f0000000280)={0x5, "1d27f0db2e1f25eff995475188afe0ebe9bab69516a5e88a718dca33021b22b650"}}) r5 = socket$nl_route(0x10, 0x3, 0x0) getsockopt$sock_int(r5, 0x1, 0xb, 0x0, &(0x7f0000000040)) socket$netlink(0x10, 0x3, 0x0) r6 = socket(0x10, 0x803, 0x0) sendmsg$IPVS_CMD_SET_INFO(r6, &(0x7f0000000b00)={0x0, 0x0, &(0x7f0000000ac0)={0x0, 0x14}}, 0x0) r7 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r7, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000240)={&(0x7f0000000180)=ANY=[@ANYBLOB="3c0000001000030400"/20, @ANYRES32=0x0, @ANYBLOB="a4280400000000001400350073797a5f74756e00000000000000000008000a00", @ANYRES32], 0x3c}}, 0x8000) executing program 4: bpf$MAP_CREATE(0x0, &(0x7f0000000000)=ANY=[@ANYBLOB="1400000007"], 0x50) r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000000), 0x40241, 0x0) r1 = socket$pppl2tp(0x18, 0x1, 0x1) r2 = socket$inet6_udp(0xa, 0x2, 0x0) r3 = socket$inet_tcp(0x2, 0x1, 0x0) bind$inet(r3, &(0x7f0000000040)={0x2, 0x4e21, @local}, 0x10) setsockopt$inet_tcp_int(0xffffffffffffffff, 0x6, 0x19, &(0x7f0000000240)=0x6, 0xfffffedf) setsockopt$inet_tcp_TCP_REPAIR_QUEUE(r3, 0x6, 0x14, &(0x7f0000000000)=0x2, 0x4) setsockopt$SO_TIMESTAMPING(r3, 0x1, 0x25, &(0x7f0000000200)=0x437b, 0x4) connect$inet(r3, &(0x7f0000000180)={0x2, 0x4e21, @local}, 0x10) setsockopt$inet_tcp_TCP_REPAIR_OPTIONS(r3, 0x6, 0x16, &(0x7f0000000340)=[@window={0x3, 0x1, 0x8}, @window={0x3, 0x6, 0x7}, @sack_perm, @window={0x3, 0x0, 0x4}, @mss={0x2, 0x4}, @timestamp, @window={0x3, 0x1, 0x10}, @sack_perm], 0x20000000000002a1) sendmsg$inet(r3, &(0x7f0000000300)={0x0, 0x0, &(0x7f0000000140)=[{&(0x7f0000000380)="9ad024c2775e1e2ab8e46a2877fcb21d4bb90500ebb1cfaea615b04f758b1754ce82525f728b072274a6388145b8991b4d0d7e9275d21e257816bb8650d21ba04ac83b4961e7b3a94d", 0x49}], 0x1}, 0x0) setsockopt$inet_tcp_TCP_REPAIR(r3, 0x6, 0x13, &(0x7f00000001c0), 0x4) sendto$inet(r3, &(0x7f00000004c0)='<', 0x381, 0x805, 0x0, 0x0) connect$pppl2tp(r1, &(0x7f0000000080)=@pppol2tpin6={0x18, 0x1, {0x0, r2, 0x6, 0x0, 0x0, 0x0, {0xa, 0x0, 0x0, @local}}}, 0x32) getsockopt$sock_buf(r1, 0x1, 0x1c, 0x0, &(0x7f0000000000)=0x3d) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000200)={'syzkaller1\x00', 0xc201}) r4 = socket$kcm(0x21, 0x2, 0xa) r5 = socket$inet6(0xa, 0x3, 0xff) setsockopt$inet6_int(r5, 0x29, 0x7, &(0x7f0000fcb000)=0xffffffff, 0x4) sendmsg$kcm(r4, &(0x7f0000000080)={&(0x7f0000000000)=@rxrpc=@in6={0x21, 0x1, 0x2, 0x1c, {0xa, 0x0, 0x4, @dev, 0x8000000}}, 0x80, 0x0, 0x0, &(0x7f00000000c0)=[{0x18, 0x110, 0x1, '\x00'}, {0x18, 0x110, 0xc, "aa"}], 0x30}, 0xfc40) r6 = socket$inet6_tcp(0xa, 0x1, 0x0) r7 = dup(r6) ioctl$TIOCSLCKTRMIOS(r7, 0x5457, &(0x7f00000000c0)) ioctl$SIOCSIFHWADDR(r7, 0x8914, &(0x7f0000000040)={'syzkaller1\x00', @link_local={0x1, 0x80, 0xc2, 0x0, 0x0, 0x3}}) write$tun(r0, &(0x7f0000000500)={@val={0x8, 0xc}, @val={0x2, 0x1, 0x4, 0x11, 0x9ca, 0x81}, @ipv4=@icmp={{0x20, 0x4, 0x1, 0x25, 0x94, 0x66, 0x0, 0xa8, 0x1, 0x0, @initdev={0xac, 0x1e, 0x1, 0x0}, @local, {[@ra={0x94, 0x4, 0x1}, @lsrr={0x83, 0x13, 0xa1, [@local, @dev={0xac, 0x14, 0x14, 0x3e}, @local, @multicast1]}, @timestamp_addr={0x44, 0x24, 0x1b, 0x1, 0x9, [{@loopback, 0x7}, {@loopback, 0x200}, {@multicast2}, {@multicast1, 0x4}]}, @cipso={0x86, 0x31, 0x2, [{0x1, 0xb, "b994131c56c477d6f5"}, {0x2, 0x12, "ef0500f6d000"/16}, {0x7, 0x6, "e8c2e380"}, {0x1, 0x8, "1e2d53d7cd98"}]}]}}, @timestamp={0xd, 0x0, 0x0, 0xc000, 0x4, 0x3, 0x401, 0x600}}}, 0xa2) creat(0x0, 0x0) sendto$packet(0xffffffffffffffff, &(0x7f0000000000)='1', 0x1, 0x4000800, 0x0, 0x0) r8 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) bind$bt_hci(r8, &(0x7f0000000040)={0x1f, 0xffff, 0x3}, 0x6) program crashed: SYZFAIL: tun: ioctl(TUNSETIFF) failed bisect: the chunk can be dropped bisect: testing without sub-chunk 2/2 bisect: no need to test this chunk, it's definitely needed bisect: split chunks (needed=true): <5> bisect: split chunk #0 of len 5 into 2 parts bisect: testing without sub-chunk 1/2 testing program (duration=6m0s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): [18, 30] detailed listing: executing program 0: r0 = socket$inet_udp(0x2, 0x2, 0x0) r1 = bpf$BPF_BTF_LOAD(0x12, &(0x7f0000000080)={&(0x7f0000000040)=ANY=[@ANYBLOB="9feb0100180000000000000020000000200000000400000001000000000000010400000020000000010000000000000108"], 0x0, 0x3c}, 0x28) r2 = bpf$MAP_CREATE(0x0, &(0x7f0000000200)=ANY=[@ANYBLOB="1c0000000400000008000000000000000100"/48, @ANYRES32=r1, @ANYBLOB="0100000002"], 0x40) bpf$MAP_LOOKUP_ELEM(0x1, &(0x7f0000000300)={r2, &(0x7f00000000c0)="8fa5", 0x0}, 0x20) setsockopt$IPT_SO_SET_REPLACE(r0, 0x0, 0x40, &(0x7f0000000000)=@raw={'raw\x00', 0x8, 0x3, 0x3c8, 0x0, 0xa, 0x148, 0x0, 0x10, 0x330, 0x2a8, 0x2a8, 0x330, 0x2a8, 0x3, 0x0, {[{{@ip={@rand_addr, @multicast1, 0x0, 0x0, 'bridge0\x00', 'rose0\x00'}, 0x0, 0x70, 0xe0, 0x0, {0x200003ae, 0x7f00}}, @common=@unspec=@NFLOG={0x70, 'NFLOG\x00', 0x0, {0x0, 0x0, 0x0, 0x0, 0x0, "f2f7b90ad2b60c45cb4ea6e7bf902bdc2ff8a9304d9f655c746adc0bdc773506378bc0d27efd6abb05175089830cc46186074d7de46d5af300"}}}, {{@ip={@empty, @local, 0x0, 0x0, 'ip6erspan0\x00', 'veth0_to_team\x00'}, 0x0, 0x1f0, 0x250, 0x0, {}, [@common=@inet=@hashlimit3={{0x158}, {'wg2\x00', {0xffffffffffffffff, 0xff, 0x0, 0x0, 0x0, 0x7fff, 0x200}}}, @inet=@rpfilter={{0x28}}]}, @common=@CLUSTERIP={0x60, 'CLUSTERIP\x00', 0x0, {0x1, @multicast, 0x2, 0x7, [0x0, 0x10, 0x1b, 0x2b, 0x37, 0x2e, 0x2b, 0x18, 0x2b, 0x34, 0xd, 0x0, 0x3d, 0x1, 0x32, 0x37], 0x1, 0x6, 0x1570000000000}}}], {{'\x00', 0xc8, 0x70, 0x98}, {0x28}}}}, 0x428) r3 = openat(0xffffffffffffff9c, &(0x7f0000000040)='./file1\x00', 0x542, 0x0) ioctl$SIOCX25SDTEFACILITIES(r3, 0x89eb, &(0x7f0000000080)={0x81, 0x962, 0x7, 0x7, 0x2, 0xd, 0x3, "4cb8b2a6146ab1a722e031cf656758ee56a018e7", "be634e4a96ef65eb0d23451a8d73bc095839f363"}) pwritev2(r3, &(0x7f00000000c0)=[{&(0x7f0000000300)=')', 0x1}], 0x1, 0x2, 0x0, 0xa1) r4 = syz_open_dev$I2C(&(0x7f0000000000), 0x1, 0x0) ioctl$I2C_PEC(r4, 0x708, 0x40) ioctl$I2C_SMBUS(r4, 0x720, &(0x7f00000002c0)={0x1, 0x7, 0x4, &(0x7f0000000280)={0x5, "1d27f0db2e1f25eff995475188afe0ebe9bab69516a5e88a718dca33021b22b650"}}) r5 = socket$nl_route(0x10, 0x3, 0x0) getsockopt$sock_int(r5, 0x1, 0xb, 0x0, &(0x7f0000000040)) socket$netlink(0x10, 0x3, 0x0) r6 = socket(0x10, 0x803, 0x0) sendmsg$IPVS_CMD_SET_INFO(r6, &(0x7f0000000b00)={0x0, 0x0, &(0x7f0000000ac0)={0x0, 0x14}}, 0x0) r7 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r7, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000240)={&(0x7f0000000180)=ANY=[@ANYBLOB="3c0000001000030400"/20, @ANYRES32=0x0, @ANYBLOB="a4280400000000001400350073797a5f74756e00000000000000000008000a00", @ANYRES32], 0x3c}}, 0x8000) executing program 4: bpf$MAP_CREATE(0x0, &(0x7f0000000000)=ANY=[@ANYBLOB="1400000007"], 0x50) r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000000), 0x40241, 0x0) r1 = socket$pppl2tp(0x18, 0x1, 0x1) r2 = socket$inet6_udp(0xa, 0x2, 0x0) r3 = socket$inet_tcp(0x2, 0x1, 0x0) bind$inet(r3, &(0x7f0000000040)={0x2, 0x4e21, @local}, 0x10) setsockopt$inet_tcp_int(0xffffffffffffffff, 0x6, 0x19, &(0x7f0000000240)=0x6, 0xfffffedf) setsockopt$inet_tcp_TCP_REPAIR_QUEUE(r3, 0x6, 0x14, &(0x7f0000000000)=0x2, 0x4) setsockopt$SO_TIMESTAMPING(r3, 0x1, 0x25, &(0x7f0000000200)=0x437b, 0x4) connect$inet(r3, &(0x7f0000000180)={0x2, 0x4e21, @local}, 0x10) setsockopt$inet_tcp_TCP_REPAIR_OPTIONS(r3, 0x6, 0x16, &(0x7f0000000340)=[@window={0x3, 0x1, 0x8}, @window={0x3, 0x6, 0x7}, @sack_perm, @window={0x3, 0x0, 0x4}, @mss={0x2, 0x4}, @timestamp, @window={0x3, 0x1, 0x10}, @sack_perm], 0x20000000000002a1) sendmsg$inet(r3, &(0x7f0000000300)={0x0, 0x0, &(0x7f0000000140)=[{&(0x7f0000000380)="9ad024c2775e1e2ab8e46a2877fcb21d4bb90500ebb1cfaea615b04f758b1754ce82525f728b072274a6388145b8991b4d0d7e9275d21e257816bb8650d21ba04ac83b4961e7b3a94d", 0x49}], 0x1}, 0x0) setsockopt$inet_tcp_TCP_REPAIR(r3, 0x6, 0x13, &(0x7f00000001c0), 0x4) sendto$inet(r3, &(0x7f00000004c0)='<', 0x381, 0x805, 0x0, 0x0) connect$pppl2tp(r1, &(0x7f0000000080)=@pppol2tpin6={0x18, 0x1, {0x0, r2, 0x6, 0x0, 0x0, 0x0, {0xa, 0x0, 0x0, @local}}}, 0x32) getsockopt$sock_buf(r1, 0x1, 0x1c, 0x0, &(0x7f0000000000)=0x3d) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000200)={'syzkaller1\x00', 0xc201}) r4 = socket$kcm(0x21, 0x2, 0xa) r5 = socket$inet6(0xa, 0x3, 0xff) setsockopt$inet6_int(r5, 0x29, 0x7, &(0x7f0000fcb000)=0xffffffff, 0x4) sendmsg$kcm(r4, &(0x7f0000000080)={&(0x7f0000000000)=@rxrpc=@in6={0x21, 0x1, 0x2, 0x1c, {0xa, 0x0, 0x4, @dev, 0x8000000}}, 0x80, 0x0, 0x0, &(0x7f00000000c0)=[{0x18, 0x110, 0x1, '\x00'}, {0x18, 0x110, 0xc, "aa"}], 0x30}, 0xfc40) r6 = socket$inet6_tcp(0xa, 0x1, 0x0) r7 = dup(r6) ioctl$TIOCSLCKTRMIOS(r7, 0x5457, &(0x7f00000000c0)) ioctl$SIOCSIFHWADDR(r7, 0x8914, &(0x7f0000000040)={'syzkaller1\x00', @link_local={0x1, 0x80, 0xc2, 0x0, 0x0, 0x3}}) write$tun(r0, &(0x7f0000000500)={@val={0x8, 0xc}, @val={0x2, 0x1, 0x4, 0x11, 0x9ca, 0x81}, @ipv4=@icmp={{0x20, 0x4, 0x1, 0x25, 0x94, 0x66, 0x0, 0xa8, 0x1, 0x0, @initdev={0xac, 0x1e, 0x1, 0x0}, @local, {[@ra={0x94, 0x4, 0x1}, @lsrr={0x83, 0x13, 0xa1, [@local, @dev={0xac, 0x14, 0x14, 0x3e}, @local, @multicast1]}, @timestamp_addr={0x44, 0x24, 0x1b, 0x1, 0x9, [{@loopback, 0x7}, {@loopback, 0x200}, {@multicast2}, {@multicast1, 0x4}]}, @cipso={0x86, 0x31, 0x2, [{0x1, 0xb, "b994131c56c477d6f5"}, {0x2, 0x12, "ef0500f6d000"/16}, {0x7, 0x6, "e8c2e380"}, {0x1, 0x8, "1e2d53d7cd98"}]}]}}, @timestamp={0xd, 0x0, 0x0, 0xc000, 0x4, 0x3, 0x401, 0x600}}}, 0xa2) creat(0x0, 0x0) sendto$packet(0xffffffffffffffff, &(0x7f0000000000)='1', 0x1, 0x4000800, 0x0, 0x0) r8 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) bind$bt_hci(r8, &(0x7f0000000040)={0x1f, 0xffff, 0x3}, 0x6) program did not crash bisect: testing without sub-chunk 2/2 testing program (duration=6m0s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): [3, 12, 2] detailed listing: executing program 0: r0 = socket$kcm(0x2, 0x3, 0x84) sendmmsg$inet(r0, &(0x7f0000006a80)=[{{&(0x7f0000000000)={0x2, 0x4e22, @dev={0xac, 0x14, 0x14, 0x18}}, 0x10, &(0x7f0000002ac0)=[{&(0x7f0000000080)="f982340819048e40ac0bd4474d", 0xd}], 0x1}}], 0x1, 0x8080) sendmsg$inet(r0, &(0x7f0000000a00)={&(0x7f0000000040)={0x2, 0x4e23, @remote}, 0x10, &(0x7f00000000c0)=[{&(0x7f0000000440)="c10900", 0x3}], 0x1}, 0x6000) executing program 4: syz_emit_ethernet(0x6a, &(0x7f0000000040)={@link_local={0x1, 0x80, 0xc2, 0x0, 0x0, 0x3}, @remote, @void, {@ipv4={0x800, @icmp={{0x5, 0x4, 0x0, 0x1, 0x5c, 0x0, 0x0, 0xfb, 0x1, 0x0, @initdev={0xac, 0x1e, 0x0, 0x0}, @local}, @time_exceeded={0x3, 0x1, 0x0, 0x3, 0x24, 0x0, {0x10, 0x4, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x1, 0x8, @loopback, @rand_addr=0x640100fe, {[@cipso={0x86, 0x29, 0xffffffffffffffff, [{0x0, 0xe, "08c82ce8da6ee06cb8dd9452"}, {0x5, 0x9, "020007651442eb"}, {0x1, 0x2}, {0x2, 0x7, "cf05003179"}, {0x0, 0x3, '\x00'}]}]}}}}}}}, 0x0) socketpair(0x1, 0x1, 0x0, &(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}) r2 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r3 = syz_genetlink_get_family_id$nbd(&(0x7f0000000040), r2) sendmsg$NBD_CMD_CONNECT(r2, &(0x7f0000000400)={0x0, 0x0, &(0x7f0000001a80)={&(0x7f0000000480)={0x5c, r3, 0x1, 0x70bd2c, 0xffe, {}, [@NBD_ATTR_SIZE_BYTES={0xc, 0x2, 0x2}, @NBD_ATTR_SOCKETS={0x28, 0x7, 0x0, 0x1, [{0xc, 0x1, 0x0, 0x1, {0x8, 0x1, r0}}, {0xc, 0x1, 0x0, 0x1, {0x8, 0x1, r0}}, {0xc, 0x1, 0x0, 0x1, {0x8, 0x1, r1}}]}, @NBD_ATTR_SERVER_FLAGS={0xc, 0x5, 0x128}, @NBD_ATTR_BACKEND_IDENTIFIER={0x8, 0xa, 'nbd\x00'}]}, 0x5c}}, 0x20000000) r4 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r5 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r6 = syz_genetlink_get_family_id$netlbl_mgmt(&(0x7f0000002180), r4) sendmsg$NLBL_MGMT_C_REMOVEDEF(r5, &(0x7f0000002240)={0x0, 0x0, &(0x7f0000002200)={&(0x7f00000021c0)={0x14, r6, 0x1, 0x70bd29, 0x25dfdbfd}, 0x14}, 0x1, 0x0, 0x0, 0x4000800}, 0x4000004) sendmsg$NLBL_MGMT_C_ADDDEF(r2, &(0x7f00000001c0)={&(0x7f00000000c0)={0x10, 0x0, 0x0, 0x4000}, 0xc, &(0x7f0000000180)={&(0x7f0000000140)={0x3c, r6, 0x200, 0x70bd2b, 0x25dfdbff, {}, [@NLBL_MGMT_A_DOMAIN={0x9, 0x1, '\xaa\xaa\xaa\xaa\xaa'}, @NLBL_MGMT_A_IPV4MASK={0x8, 0x8, @empty}, @NLBL_MGMT_A_IPV6ADDR={0x14, 0x5, @dev={0xfe, 0x80, '\x00', 0x19}}]}, 0x3c}, 0x1, 0x0, 0x0, 0x48000}, 0x4000000) seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0x0, &(0x7f0000000000)={0x1, &(0x7f0000000100)=[{0x6, 0x0, 0x0, 0x7fff0000}]}) socket(0x1, 0x80402, 0x7) executing program 3: r0 = openat$sysctl(0xffffffffffffff9c, &(0x7f0000000040)='/proc/sys/net/ipv4/tcp_mtu_probing\x00', 0x1, 0x0) pwritev(r0, &(0x7f0000000140), 0x15, 0x9, 0x1) program crashed: SYZFAIL: initialize_wifi_devices: failed set up IBSS network bisect: the chunk can be dropped bisect: split chunks (needed=true): <3> bisect: split chunk #0 of len 3 into 2 parts bisect: testing without sub-chunk 1/2 testing program (duration=6m0s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): openat$sysctl-pwritev detailed listing: executing program 3: r0 = openat$sysctl(0xffffffffffffff9c, &(0x7f0000000040)='/proc/sys/net/ipv4/tcp_mtu_probing\x00', 0x1, 0x0) pwritev(r0, &(0x7f0000000140), 0x15, 0x9, 0x1) program did not crash bisect: testing without sub-chunk 2/2 testing program (duration=6m0s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): [3, 12] detailed listing: executing program 0: r0 = socket$kcm(0x2, 0x3, 0x84) sendmmsg$inet(r0, &(0x7f0000006a80)=[{{&(0x7f0000000000)={0x2, 0x4e22, @dev={0xac, 0x14, 0x14, 0x18}}, 0x10, &(0x7f0000002ac0)=[{&(0x7f0000000080)="f982340819048e40ac0bd4474d", 0xd}], 0x1}}], 0x1, 0x8080) sendmsg$inet(r0, &(0x7f0000000a00)={&(0x7f0000000040)={0x2, 0x4e23, @remote}, 0x10, &(0x7f00000000c0)=[{&(0x7f0000000440)="c10900", 0x3}], 0x1}, 0x6000) executing program 4: syz_emit_ethernet(0x6a, &(0x7f0000000040)={@link_local={0x1, 0x80, 0xc2, 0x0, 0x0, 0x3}, @remote, @void, {@ipv4={0x800, @icmp={{0x5, 0x4, 0x0, 0x1, 0x5c, 0x0, 0x0, 0xfb, 0x1, 0x0, @initdev={0xac, 0x1e, 0x0, 0x0}, @local}, @time_exceeded={0x3, 0x1, 0x0, 0x3, 0x24, 0x0, {0x10, 0x4, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x1, 0x8, @loopback, @rand_addr=0x640100fe, {[@cipso={0x86, 0x29, 0xffffffffffffffff, [{0x0, 0xe, "08c82ce8da6ee06cb8dd9452"}, {0x5, 0x9, "020007651442eb"}, {0x1, 0x2}, {0x2, 0x7, "cf05003179"}, {0x0, 0x3, '\x00'}]}]}}}}}}}, 0x0) socketpair(0x1, 0x1, 0x0, &(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}) r2 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r3 = syz_genetlink_get_family_id$nbd(&(0x7f0000000040), r2) sendmsg$NBD_CMD_CONNECT(r2, &(0x7f0000000400)={0x0, 0x0, &(0x7f0000001a80)={&(0x7f0000000480)={0x5c, r3, 0x1, 0x70bd2c, 0xffe, {}, [@NBD_ATTR_SIZE_BYTES={0xc, 0x2, 0x2}, @NBD_ATTR_SOCKETS={0x28, 0x7, 0x0, 0x1, [{0xc, 0x1, 0x0, 0x1, {0x8, 0x1, r0}}, {0xc, 0x1, 0x0, 0x1, {0x8, 0x1, r0}}, {0xc, 0x1, 0x0, 0x1, {0x8, 0x1, r1}}]}, @NBD_ATTR_SERVER_FLAGS={0xc, 0x5, 0x128}, @NBD_ATTR_BACKEND_IDENTIFIER={0x8, 0xa, 'nbd\x00'}]}, 0x5c}}, 0x20000000) r4 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r5 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r6 = syz_genetlink_get_family_id$netlbl_mgmt(&(0x7f0000002180), r4) sendmsg$NLBL_MGMT_C_REMOVEDEF(r5, &(0x7f0000002240)={0x0, 0x0, &(0x7f0000002200)={&(0x7f00000021c0)={0x14, r6, 0x1, 0x70bd29, 0x25dfdbfd}, 0x14}, 0x1, 0x0, 0x0, 0x4000800}, 0x4000004) sendmsg$NLBL_MGMT_C_ADDDEF(r2, &(0x7f00000001c0)={&(0x7f00000000c0)={0x10, 0x0, 0x0, 0x4000}, 0xc, &(0x7f0000000180)={&(0x7f0000000140)={0x3c, r6, 0x200, 0x70bd2b, 0x25dfdbff, {}, [@NLBL_MGMT_A_DOMAIN={0x9, 0x1, '\xaa\xaa\xaa\xaa\xaa'}, @NLBL_MGMT_A_IPV4MASK={0x8, 0x8, @empty}, @NLBL_MGMT_A_IPV6ADDR={0x14, 0x5, @dev={0xfe, 0x80, '\x00', 0x19}}]}, 0x3c}, 0x1, 0x0, 0x0, 0x48000}, 0x4000000) seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0x0, &(0x7f0000000000)={0x1, &(0x7f0000000100)=[{0x6, 0x0, 0x0, 0x7fff0000}]}) socket(0x1, 0x80402, 0x7) program crashed: SYZFAIL: initialize_wifi_devices: failed set up IBSS network bisect: the chunk can be dropped bisect: split chunks (needed=true): <2> bisect: split chunk #0 of len 2 into 2 parts bisect: testing without sub-chunk 1/2 testing program (duration=6m0s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_emit_ethernet-socketpair-syz_init_net_socket$nl_generic-syz_genetlink_get_family_id$nbd-sendmsg$NBD_CMD_CONNECT-syz_init_net_socket$nl_generic-syz_init_net_socket$nl_generic-syz_genetlink_get_family_id$netlbl_mgmt-sendmsg$NLBL_MGMT_C_REMOVEDEF-sendmsg$NLBL_MGMT_C_ADDDEF-seccomp$SECCOMP_SET_MODE_FILTER_LISTENER-socket detailed listing: executing program 4: syz_emit_ethernet(0x6a, &(0x7f0000000040)={@link_local={0x1, 0x80, 0xc2, 0x0, 0x0, 0x3}, @remote, @void, {@ipv4={0x800, @icmp={{0x5, 0x4, 0x0, 0x1, 0x5c, 0x0, 0x0, 0xfb, 0x1, 0x0, @initdev={0xac, 0x1e, 0x0, 0x0}, @local}, @time_exceeded={0x3, 0x1, 0x0, 0x3, 0x24, 0x0, {0x10, 0x4, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x1, 0x8, @loopback, @rand_addr=0x640100fe, {[@cipso={0x86, 0x29, 0xffffffffffffffff, [{0x0, 0xe, "08c82ce8da6ee06cb8dd9452"}, {0x5, 0x9, "020007651442eb"}, {0x1, 0x2}, {0x2, 0x7, "cf05003179"}, {0x0, 0x3, '\x00'}]}]}}}}}}}, 0x0) socketpair(0x1, 0x1, 0x0, &(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}) r2 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r3 = syz_genetlink_get_family_id$nbd(&(0x7f0000000040), r2) sendmsg$NBD_CMD_CONNECT(r2, &(0x7f0000000400)={0x0, 0x0, &(0x7f0000001a80)={&(0x7f0000000480)={0x5c, r3, 0x1, 0x70bd2c, 0xffe, {}, [@NBD_ATTR_SIZE_BYTES={0xc, 0x2, 0x2}, @NBD_ATTR_SOCKETS={0x28, 0x7, 0x0, 0x1, [{0xc, 0x1, 0x0, 0x1, {0x8, 0x1, r0}}, {0xc, 0x1, 0x0, 0x1, {0x8, 0x1, r0}}, {0xc, 0x1, 0x0, 0x1, {0x8, 0x1, r1}}]}, @NBD_ATTR_SERVER_FLAGS={0xc, 0x5, 0x128}, @NBD_ATTR_BACKEND_IDENTIFIER={0x8, 0xa, 'nbd\x00'}]}, 0x5c}}, 0x20000000) r4 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r5 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r6 = syz_genetlink_get_family_id$netlbl_mgmt(&(0x7f0000002180), r4) sendmsg$NLBL_MGMT_C_REMOVEDEF(r5, &(0x7f0000002240)={0x0, 0x0, &(0x7f0000002200)={&(0x7f00000021c0)={0x14, r6, 0x1, 0x70bd29, 0x25dfdbfd}, 0x14}, 0x1, 0x0, 0x0, 0x4000800}, 0x4000004) sendmsg$NLBL_MGMT_C_ADDDEF(r2, &(0x7f00000001c0)={&(0x7f00000000c0)={0x10, 0x0, 0x0, 0x4000}, 0xc, &(0x7f0000000180)={&(0x7f0000000140)={0x3c, r6, 0x200, 0x70bd2b, 0x25dfdbff, {}, [@NLBL_MGMT_A_DOMAIN={0x9, 0x1, '\xaa\xaa\xaa\xaa\xaa'}, @NLBL_MGMT_A_IPV4MASK={0x8, 0x8, @empty}, @NLBL_MGMT_A_IPV6ADDR={0x14, 0x5, @dev={0xfe, 0x80, '\x00', 0x19}}]}, 0x3c}, 0x1, 0x0, 0x0, 0x48000}, 0x4000000) seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0x0, &(0x7f0000000000)={0x1, &(0x7f0000000100)=[{0x6, 0x0, 0x0, 0x7fff0000}]}) socket(0x1, 0x80402, 0x7) program crashed: BUG: MAX_LOCKDEP_KEYS too low! bisect: the chunk can be dropped bisect: testing without sub-chunk 2/2 bisect: no need to test this chunk, it's definitely needed bisect: split chunks (needed=true): <1> bisect: split chunk #0 of len 1 into 2 parts bisect: no way to further split the chunk bisect: 1 programs left: executing program 4: syz_emit_ethernet(0x6a, &(0x7f0000000040)={@link_local={0x1, 0x80, 0xc2, 0x0, 0x0, 0x3}, @remote, @void, {@ipv4={0x800, @icmp={{0x5, 0x4, 0x0, 0x1, 0x5c, 0x0, 0x0, 0xfb, 0x1, 0x0, @initdev={0xac, 0x1e, 0x0, 0x0}, @local}, @time_exceeded={0x3, 0x1, 0x0, 0x3, 0x24, 0x0, {0x10, 0x4, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x1, 0x8, @loopback, @rand_addr=0x640100fe, {[@cipso={0x86, 0x29, 0xffffffffffffffff, [{0x0, 0xe, "08c82ce8da6ee06cb8dd9452"}, {0x5, 0x9, "020007651442eb"}, {0x1, 0x2}, {0x2, 0x7, "cf05003179"}, {0x0, 0x3, '\x00'}]}]}}}}}}}, 0x0) socketpair(0x1, 0x1, 0x0, &(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}) r2 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r3 = syz_genetlink_get_family_id$nbd(&(0x7f0000000040), r2) sendmsg$NBD_CMD_CONNECT(r2, &(0x7f0000000400)={0x0, 0x0, &(0x7f0000001a80)={&(0x7f0000000480)={0x5c, r3, 0x1, 0x70bd2c, 0xffe, {}, [@NBD_ATTR_SIZE_BYTES={0xc, 0x2, 0x2}, @NBD_ATTR_SOCKETS={0x28, 0x7, 0x0, 0x1, [{0xc, 0x1, 0x0, 0x1, {0x8, 0x1, r0}}, {0xc, 0x1, 0x0, 0x1, {0x8, 0x1, r0}}, {0xc, 0x1, 0x0, 0x1, {0x8, 0x1, r1}}]}, @NBD_ATTR_SERVER_FLAGS={0xc, 0x5, 0x128}, @NBD_ATTR_BACKEND_IDENTIFIER={0x8, 0xa, 'nbd\x00'}]}, 0x5c}}, 0x20000000) r4 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r5 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r6 = syz_genetlink_get_family_id$netlbl_mgmt(&(0x7f0000002180), r4) sendmsg$NLBL_MGMT_C_REMOVEDEF(r5, &(0x7f0000002240)={0x0, 0x0, &(0x7f0000002200)={&(0x7f00000021c0)={0x14, r6, 0x1, 0x70bd29, 0x25dfdbfd}, 0x14}, 0x1, 0x0, 0x0, 0x4000800}, 0x4000004) sendmsg$NLBL_MGMT_C_ADDDEF(r2, &(0x7f00000001c0)={&(0x7f00000000c0)={0x10, 0x0, 0x0, 0x4000}, 0xc, &(0x7f0000000180)={&(0x7f0000000140)={0x3c, r6, 0x200, 0x70bd2b, 0x25dfdbff, {}, [@NLBL_MGMT_A_DOMAIN={0x9, 0x1, '\xaa\xaa\xaa\xaa\xaa'}, @NLBL_MGMT_A_IPV4MASK={0x8, 0x8, @empty}, @NLBL_MGMT_A_IPV6ADDR={0x14, 0x5, @dev={0xfe, 0x80, '\x00', 0x19}}]}, 0x3c}, 0x1, 0x0, 0x0, 0x48000}, 0x4000000) seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0x0, &(0x7f0000000000)={0x1, &(0x7f0000000100)=[{0x6, 0x0, 0x0, 0x7fff0000}]}) socket(0x1, 0x80402, 0x7) bisect: trying to concatenate bisect: concatenate 1 entries testing program (duration=9m0s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_emit_ethernet-socketpair-syz_init_net_socket$nl_generic-syz_genetlink_get_family_id$nbd-sendmsg$NBD_CMD_CONNECT-syz_init_net_socket$nl_generic-syz_init_net_socket$nl_generic-syz_genetlink_get_family_id$netlbl_mgmt-sendmsg$NLBL_MGMT_C_REMOVEDEF-sendmsg$NLBL_MGMT_C_ADDDEF-seccomp$SECCOMP_SET_MODE_FILTER_LISTENER-socket detailed listing: executing program 0: syz_emit_ethernet(0x6a, &(0x7f0000000040)={@link_local={0x1, 0x80, 0xc2, 0x0, 0x0, 0x3}, @remote, @void, {@ipv4={0x800, @icmp={{0x5, 0x4, 0x0, 0x1, 0x5c, 0x0, 0x0, 0xfb, 0x1, 0x0, @initdev={0xac, 0x1e, 0x0, 0x0}, @local}, @time_exceeded={0x3, 0x1, 0x0, 0x3, 0x24, 0x0, {0x10, 0x4, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x1, 0x8, @loopback, @rand_addr=0x640100fe, {[@cipso={0x86, 0x29, 0xffffffffffffffff, [{0x0, 0xe, "08c82ce8da6ee06cb8dd9452"}, {0x5, 0x9, "020007651442eb"}, {0x1, 0x2}, {0x2, 0x7, "cf05003179"}, {0x0, 0x3, '\x00'}]}]}}}}}}}, 0x0) socketpair(0x1, 0x1, 0x0, &(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}) r2 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r3 = syz_genetlink_get_family_id$nbd(&(0x7f0000000040), r2) sendmsg$NBD_CMD_CONNECT(r2, &(0x7f0000000400)={0x0, 0x0, &(0x7f0000001a80)={&(0x7f0000000480)={0x5c, r3, 0x1, 0x70bd2c, 0xffe, {}, [@NBD_ATTR_SIZE_BYTES={0xc, 0x2, 0x2}, @NBD_ATTR_SOCKETS={0x28, 0x7, 0x0, 0x1, [{0xc, 0x1, 0x0, 0x1, {0x8, 0x1, r0}}, {0xc, 0x1, 0x0, 0x1, {0x8, 0x1, r0}}, {0xc, 0x1, 0x0, 0x1, {0x8, 0x1, r1}}]}, @NBD_ATTR_SERVER_FLAGS={0xc, 0x5, 0x128}, @NBD_ATTR_BACKEND_IDENTIFIER={0x8, 0xa, 'nbd\x00'}]}, 0x5c}}, 0x20000000) r4 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r5 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r6 = syz_genetlink_get_family_id$netlbl_mgmt(&(0x7f0000002180), r4) sendmsg$NLBL_MGMT_C_REMOVEDEF(r5, &(0x7f0000002240)={0x0, 0x0, &(0x7f0000002200)={&(0x7f00000021c0)={0x14, r6, 0x1, 0x70bd29, 0x25dfdbfd}, 0x14}, 0x1, 0x0, 0x0, 0x4000800}, 0x4000004) sendmsg$NLBL_MGMT_C_ADDDEF(r2, &(0x7f00000001c0)={&(0x7f00000000c0)={0x10, 0x0, 0x0, 0x4000}, 0xc, &(0x7f0000000180)={&(0x7f0000000140)={0x3c, r6, 0x200, 0x70bd2b, 0x25dfdbff, {}, [@NLBL_MGMT_A_DOMAIN={0x9, 0x1, '\xaa\xaa\xaa\xaa\xaa'}, @NLBL_MGMT_A_IPV4MASK={0x8, 0x8, @empty}, @NLBL_MGMT_A_IPV6ADDR={0x14, 0x5, @dev={0xfe, 0x80, '\x00', 0x19}}]}, 0x3c}, 0x1, 0x0, 0x0, 0x48000}, 0x4000000) seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0x0, &(0x7f0000000000)={0x1, &(0x7f0000000100)=[{0x6, 0x0, 0x0, 0x7fff0000}]}) socket(0x1, 0x80402, 0x7) program crashed: SYZFAIL: initialize_wifi_devices: failed set up IBSS network bisect: concatenation succeeded found reproducer with 12 syscalls minimizing guilty program testing program (duration=9m0s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_emit_ethernet-socketpair-syz_init_net_socket$nl_generic-syz_genetlink_get_family_id$nbd-sendmsg$NBD_CMD_CONNECT-syz_init_net_socket$nl_generic-syz_init_net_socket$nl_generic-syz_genetlink_get_family_id$netlbl_mgmt-sendmsg$NLBL_MGMT_C_REMOVEDEF-sendmsg$NLBL_MGMT_C_ADDDEF-seccomp$SECCOMP_SET_MODE_FILTER_LISTENER detailed listing: executing program 0: syz_emit_ethernet(0x6a, &(0x7f0000000040)={@link_local={0x1, 0x80, 0xc2, 0x0, 0x0, 0x3}, @remote, @void, {@ipv4={0x800, @icmp={{0x5, 0x4, 0x0, 0x1, 0x5c, 0x0, 0x0, 0xfb, 0x1, 0x0, @initdev={0xac, 0x1e, 0x0, 0x0}, @local}, @time_exceeded={0x3, 0x1, 0x0, 0x3, 0x24, 0x0, {0x10, 0x4, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x1, 0x8, @loopback, @rand_addr=0x640100fe, {[@cipso={0x86, 0x29, 0xffffffffffffffff, [{0x0, 0xe, "08c82ce8da6ee06cb8dd9452"}, {0x5, 0x9, "020007651442eb"}, {0x1, 0x2}, {0x2, 0x7, "cf05003179"}, {0x0, 0x3, '\x00'}]}]}}}}}}}, 0x0) socketpair(0x1, 0x1, 0x0, &(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}) r2 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r3 = syz_genetlink_get_family_id$nbd(&(0x7f0000000040), r2) sendmsg$NBD_CMD_CONNECT(r2, &(0x7f0000000400)={0x0, 0x0, &(0x7f0000001a80)={&(0x7f0000000480)={0x5c, r3, 0x1, 0x70bd2c, 0xffe, {}, [@NBD_ATTR_SIZE_BYTES={0xc, 0x2, 0x2}, @NBD_ATTR_SOCKETS={0x28, 0x7, 0x0, 0x1, [{0xc, 0x1, 0x0, 0x1, {0x8, 0x1, r0}}, {0xc, 0x1, 0x0, 0x1, {0x8, 0x1, r0}}, {0xc, 0x1, 0x0, 0x1, {0x8, 0x1, r1}}]}, @NBD_ATTR_SERVER_FLAGS={0xc, 0x5, 0x128}, @NBD_ATTR_BACKEND_IDENTIFIER={0x8, 0xa, 'nbd\x00'}]}, 0x5c}}, 0x20000000) r4 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r5 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r6 = syz_genetlink_get_family_id$netlbl_mgmt(&(0x7f0000002180), r4) sendmsg$NLBL_MGMT_C_REMOVEDEF(r5, &(0x7f0000002240)={0x0, 0x0, &(0x7f0000002200)={&(0x7f00000021c0)={0x14, r6, 0x1, 0x70bd29, 0x25dfdbfd}, 0x14}, 0x1, 0x0, 0x0, 0x4000800}, 0x4000004) sendmsg$NLBL_MGMT_C_ADDDEF(r2, &(0x7f00000001c0)={&(0x7f00000000c0)={0x10, 0x0, 0x0, 0x4000}, 0xc, &(0x7f0000000180)={&(0x7f0000000140)={0x3c, r6, 0x200, 0x70bd2b, 0x25dfdbff, {}, [@NLBL_MGMT_A_DOMAIN={0x9, 0x1, '\xaa\xaa\xaa\xaa\xaa'}, @NLBL_MGMT_A_IPV4MASK={0x8, 0x8, @empty}, @NLBL_MGMT_A_IPV6ADDR={0x14, 0x5, @dev={0xfe, 0x80, '\x00', 0x19}}]}, 0x3c}, 0x1, 0x0, 0x0, 0x48000}, 0x4000000) seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0x0, &(0x7f0000000000)={0x1, &(0x7f0000000100)=[{0x6, 0x0, 0x0, 0x7fff0000}]}) program crashed: SYZFAIL: initialize_wifi_devices: failed set up IBSS network testing program (duration=9m0s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_emit_ethernet-socketpair-syz_init_net_socket$nl_generic-syz_genetlink_get_family_id$nbd-sendmsg$NBD_CMD_CONNECT-syz_init_net_socket$nl_generic-syz_init_net_socket$nl_generic-syz_genetlink_get_family_id$netlbl_mgmt-sendmsg$NLBL_MGMT_C_REMOVEDEF-sendmsg$NLBL_MGMT_C_ADDDEF detailed listing: executing program 0: syz_emit_ethernet(0x6a, &(0x7f0000000040)={@link_local={0x1, 0x80, 0xc2, 0x0, 0x0, 0x3}, @remote, @void, {@ipv4={0x800, @icmp={{0x5, 0x4, 0x0, 0x1, 0x5c, 0x0, 0x0, 0xfb, 0x1, 0x0, @initdev={0xac, 0x1e, 0x0, 0x0}, @local}, @time_exceeded={0x3, 0x1, 0x0, 0x3, 0x24, 0x0, {0x10, 0x4, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x1, 0x8, @loopback, @rand_addr=0x640100fe, {[@cipso={0x86, 0x29, 0xffffffffffffffff, [{0x0, 0xe, "08c82ce8da6ee06cb8dd9452"}, {0x5, 0x9, "020007651442eb"}, {0x1, 0x2}, {0x2, 0x7, "cf05003179"}, {0x0, 0x3, '\x00'}]}]}}}}}}}, 0x0) socketpair(0x1, 0x1, 0x0, &(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}) r2 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r3 = syz_genetlink_get_family_id$nbd(&(0x7f0000000040), r2) sendmsg$NBD_CMD_CONNECT(r2, &(0x7f0000000400)={0x0, 0x0, &(0x7f0000001a80)={&(0x7f0000000480)={0x5c, r3, 0x1, 0x70bd2c, 0xffe, {}, [@NBD_ATTR_SIZE_BYTES={0xc, 0x2, 0x2}, @NBD_ATTR_SOCKETS={0x28, 0x7, 0x0, 0x1, [{0xc, 0x1, 0x0, 0x1, {0x8, 0x1, r0}}, {0xc, 0x1, 0x0, 0x1, {0x8, 0x1, r0}}, {0xc, 0x1, 0x0, 0x1, {0x8, 0x1, r1}}]}, @NBD_ATTR_SERVER_FLAGS={0xc, 0x5, 0x128}, @NBD_ATTR_BACKEND_IDENTIFIER={0x8, 0xa, 'nbd\x00'}]}, 0x5c}}, 0x20000000) r4 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r5 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r6 = syz_genetlink_get_family_id$netlbl_mgmt(&(0x7f0000002180), r4) sendmsg$NLBL_MGMT_C_REMOVEDEF(r5, &(0x7f0000002240)={0x0, 0x0, &(0x7f0000002200)={&(0x7f00000021c0)={0x14, r6, 0x1, 0x70bd29, 0x25dfdbfd}, 0x14}, 0x1, 0x0, 0x0, 0x4000800}, 0x4000004) sendmsg$NLBL_MGMT_C_ADDDEF(r2, &(0x7f00000001c0)={&(0x7f00000000c0)={0x10, 0x0, 0x0, 0x4000}, 0xc, &(0x7f0000000180)={&(0x7f0000000140)={0x3c, r6, 0x200, 0x70bd2b, 0x25dfdbff, {}, [@NLBL_MGMT_A_DOMAIN={0x9, 0x1, '\xaa\xaa\xaa\xaa\xaa'}, @NLBL_MGMT_A_IPV4MASK={0x8, 0x8, @empty}, @NLBL_MGMT_A_IPV6ADDR={0x14, 0x5, @dev={0xfe, 0x80, '\x00', 0x19}}]}, 0x3c}, 0x1, 0x0, 0x0, 0x48000}, 0x4000000) program crashed: BUG: MAX_LOCKDEP_KEYS too low! testing program (duration=9m0s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_emit_ethernet-socketpair-syz_init_net_socket$nl_generic-syz_genetlink_get_family_id$nbd-sendmsg$NBD_CMD_CONNECT-syz_init_net_socket$nl_generic-syz_init_net_socket$nl_generic-syz_genetlink_get_family_id$netlbl_mgmt-sendmsg$NLBL_MGMT_C_REMOVEDEF detailed listing: executing program 0: syz_emit_ethernet(0x6a, &(0x7f0000000040)={@link_local={0x1, 0x80, 0xc2, 0x0, 0x0, 0x3}, @remote, @void, {@ipv4={0x800, @icmp={{0x5, 0x4, 0x0, 0x1, 0x5c, 0x0, 0x0, 0xfb, 0x1, 0x0, @initdev={0xac, 0x1e, 0x0, 0x0}, @local}, @time_exceeded={0x3, 0x1, 0x0, 0x3, 0x24, 0x0, {0x10, 0x4, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x1, 0x8, @loopback, @rand_addr=0x640100fe, {[@cipso={0x86, 0x29, 0xffffffffffffffff, [{0x0, 0xe, "08c82ce8da6ee06cb8dd9452"}, {0x5, 0x9, "020007651442eb"}, {0x1, 0x2}, {0x2, 0x7, "cf05003179"}, {0x0, 0x3, '\x00'}]}]}}}}}}}, 0x0) socketpair(0x1, 0x1, 0x0, &(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}) r2 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r3 = syz_genetlink_get_family_id$nbd(&(0x7f0000000040), r2) sendmsg$NBD_CMD_CONNECT(r2, &(0x7f0000000400)={0x0, 0x0, &(0x7f0000001a80)={&(0x7f0000000480)={0x5c, r3, 0x1, 0x70bd2c, 0xffe, {}, [@NBD_ATTR_SIZE_BYTES={0xc, 0x2, 0x2}, @NBD_ATTR_SOCKETS={0x28, 0x7, 0x0, 0x1, [{0xc, 0x1, 0x0, 0x1, {0x8, 0x1, r0}}, {0xc, 0x1, 0x0, 0x1, {0x8, 0x1, r0}}, {0xc, 0x1, 0x0, 0x1, {0x8, 0x1, r1}}]}, @NBD_ATTR_SERVER_FLAGS={0xc, 0x5, 0x128}, @NBD_ATTR_BACKEND_IDENTIFIER={0x8, 0xa, 'nbd\x00'}]}, 0x5c}}, 0x20000000) r4 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r5 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r6 = syz_genetlink_get_family_id$netlbl_mgmt(&(0x7f0000002180), r4) sendmsg$NLBL_MGMT_C_REMOVEDEF(r5, &(0x7f0000002240)={0x0, 0x0, &(0x7f0000002200)={&(0x7f00000021c0)={0x14, r6, 0x1, 0x70bd29, 0x25dfdbfd}, 0x14}, 0x1, 0x0, 0x0, 0x4000800}, 0x4000004) program crashed: BUG: MAX_LOCKDEP_KEYS too low! testing program (duration=9m0s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_emit_ethernet-socketpair-syz_init_net_socket$nl_generic-syz_genetlink_get_family_id$nbd-sendmsg$NBD_CMD_CONNECT-syz_init_net_socket$nl_generic-syz_init_net_socket$nl_generic-syz_genetlink_get_family_id$netlbl_mgmt detailed listing: executing program 0: syz_emit_ethernet(0x6a, &(0x7f0000000040)={@link_local={0x1, 0x80, 0xc2, 0x0, 0x0, 0x3}, @remote, @void, {@ipv4={0x800, @icmp={{0x5, 0x4, 0x0, 0x1, 0x5c, 0x0, 0x0, 0xfb, 0x1, 0x0, @initdev={0xac, 0x1e, 0x0, 0x0}, @local}, @time_exceeded={0x3, 0x1, 0x0, 0x3, 0x24, 0x0, {0x10, 0x4, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x1, 0x8, @loopback, @rand_addr=0x640100fe, {[@cipso={0x86, 0x29, 0xffffffffffffffff, [{0x0, 0xe, "08c82ce8da6ee06cb8dd9452"}, {0x5, 0x9, "020007651442eb"}, {0x1, 0x2}, {0x2, 0x7, "cf05003179"}, {0x0, 0x3, '\x00'}]}]}}}}}}}, 0x0) socketpair(0x1, 0x1, 0x0, &(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}) r2 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r3 = syz_genetlink_get_family_id$nbd(&(0x7f0000000040), r2) sendmsg$NBD_CMD_CONNECT(r2, &(0x7f0000000400)={0x0, 0x0, &(0x7f0000001a80)={&(0x7f0000000480)={0x5c, r3, 0x1, 0x70bd2c, 0xffe, {}, [@NBD_ATTR_SIZE_BYTES={0xc, 0x2, 0x2}, @NBD_ATTR_SOCKETS={0x28, 0x7, 0x0, 0x1, [{0xc, 0x1, 0x0, 0x1, {0x8, 0x1, r0}}, {0xc, 0x1, 0x0, 0x1, {0x8, 0x1, r0}}, {0xc, 0x1, 0x0, 0x1, {0x8, 0x1, r1}}]}, @NBD_ATTR_SERVER_FLAGS={0xc, 0x5, 0x128}, @NBD_ATTR_BACKEND_IDENTIFIER={0x8, 0xa, 'nbd\x00'}]}, 0x5c}}, 0x20000000) r4 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) syz_genetlink_get_family_id$netlbl_mgmt(&(0x7f0000002180), r4) program crashed: BUG: MAX_LOCKDEP_KEYS too low! testing program (duration=9m0s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_emit_ethernet-socketpair-syz_init_net_socket$nl_generic-syz_genetlink_get_family_id$nbd-sendmsg$NBD_CMD_CONNECT-syz_init_net_socket$nl_generic-syz_init_net_socket$nl_generic detailed listing: executing program 0: syz_emit_ethernet(0x6a, &(0x7f0000000040)={@link_local={0x1, 0x80, 0xc2, 0x0, 0x0, 0x3}, @remote, @void, {@ipv4={0x800, @icmp={{0x5, 0x4, 0x0, 0x1, 0x5c, 0x0, 0x0, 0xfb, 0x1, 0x0, @initdev={0xac, 0x1e, 0x0, 0x0}, @local}, @time_exceeded={0x3, 0x1, 0x0, 0x3, 0x24, 0x0, {0x10, 0x4, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x1, 0x8, @loopback, @rand_addr=0x640100fe, {[@cipso={0x86, 0x29, 0xffffffffffffffff, [{0x0, 0xe, "08c82ce8da6ee06cb8dd9452"}, {0x5, 0x9, "020007651442eb"}, {0x1, 0x2}, {0x2, 0x7, "cf05003179"}, {0x0, 0x3, '\x00'}]}]}}}}}}}, 0x0) socketpair(0x1, 0x1, 0x0, &(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}) r2 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r3 = syz_genetlink_get_family_id$nbd(&(0x7f0000000040), r2) sendmsg$NBD_CMD_CONNECT(r2, &(0x7f0000000400)={0x0, 0x0, &(0x7f0000001a80)={&(0x7f0000000480)={0x5c, r3, 0x1, 0x70bd2c, 0xffe, {}, [@NBD_ATTR_SIZE_BYTES={0xc, 0x2, 0x2}, @NBD_ATTR_SOCKETS={0x28, 0x7, 0x0, 0x1, [{0xc, 0x1, 0x0, 0x1, {0x8, 0x1, r0}}, {0xc, 0x1, 0x0, 0x1, {0x8, 0x1, r0}}, {0xc, 0x1, 0x0, 0x1, {0x8, 0x1, r1}}]}, @NBD_ATTR_SERVER_FLAGS={0xc, 0x5, 0x128}, @NBD_ATTR_BACKEND_IDENTIFIER={0x8, 0xa, 'nbd\x00'}]}, 0x5c}}, 0x20000000) syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) program crashed: BUG: MAX_LOCKDEP_KEYS too low! testing program (duration=9m0s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_emit_ethernet-socketpair-syz_init_net_socket$nl_generic-syz_genetlink_get_family_id$nbd-sendmsg$NBD_CMD_CONNECT-syz_init_net_socket$nl_generic detailed listing: executing program 0: syz_emit_ethernet(0x6a, &(0x7f0000000040)={@link_local={0x1, 0x80, 0xc2, 0x0, 0x0, 0x3}, @remote, @void, {@ipv4={0x800, @icmp={{0x5, 0x4, 0x0, 0x1, 0x5c, 0x0, 0x0, 0xfb, 0x1, 0x0, @initdev={0xac, 0x1e, 0x0, 0x0}, @local}, @time_exceeded={0x3, 0x1, 0x0, 0x3, 0x24, 0x0, {0x10, 0x4, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x1, 0x8, @loopback, @rand_addr=0x640100fe, {[@cipso={0x86, 0x29, 0xffffffffffffffff, [{0x0, 0xe, "08c82ce8da6ee06cb8dd9452"}, {0x5, 0x9, "020007651442eb"}, {0x1, 0x2}, {0x2, 0x7, "cf05003179"}, {0x0, 0x3, '\x00'}]}]}}}}}}}, 0x0) socketpair(0x1, 0x1, 0x0, &(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}) r2 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r3 = syz_genetlink_get_family_id$nbd(&(0x7f0000000040), r2) sendmsg$NBD_CMD_CONNECT(r2, &(0x7f0000000400)={0x0, 0x0, &(0x7f0000001a80)={&(0x7f0000000480)={0x5c, r3, 0x1, 0x70bd2c, 0xffe, {}, [@NBD_ATTR_SIZE_BYTES={0xc, 0x2, 0x2}, @NBD_ATTR_SOCKETS={0x28, 0x7, 0x0, 0x1, [{0xc, 0x1, 0x0, 0x1, {0x8, 0x1, r0}}, {0xc, 0x1, 0x0, 0x1, {0x8, 0x1, r0}}, {0xc, 0x1, 0x0, 0x1, {0x8, 0x1, r1}}]}, @NBD_ATTR_SERVER_FLAGS={0xc, 0x5, 0x128}, @NBD_ATTR_BACKEND_IDENTIFIER={0x8, 0xa, 'nbd\x00'}]}, 0x5c}}, 0x20000000) syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) program crashed: BUG: MAX_LOCKDEP_KEYS too low! testing program (duration=9m0s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_emit_ethernet-socketpair-syz_init_net_socket$nl_generic-syz_genetlink_get_family_id$nbd-sendmsg$NBD_CMD_CONNECT detailed listing: executing program 0: syz_emit_ethernet(0x6a, &(0x7f0000000040)={@link_local={0x1, 0x80, 0xc2, 0x0, 0x0, 0x3}, @remote, @void, {@ipv4={0x800, @icmp={{0x5, 0x4, 0x0, 0x1, 0x5c, 0x0, 0x0, 0xfb, 0x1, 0x0, @initdev={0xac, 0x1e, 0x0, 0x0}, @local}, @time_exceeded={0x3, 0x1, 0x0, 0x3, 0x24, 0x0, {0x10, 0x4, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x1, 0x8, @loopback, @rand_addr=0x640100fe, {[@cipso={0x86, 0x29, 0xffffffffffffffff, [{0x0, 0xe, "08c82ce8da6ee06cb8dd9452"}, {0x5, 0x9, "020007651442eb"}, {0x1, 0x2}, {0x2, 0x7, "cf05003179"}, {0x0, 0x3, '\x00'}]}]}}}}}}}, 0x0) socketpair(0x1, 0x1, 0x0, &(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}) r2 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r3 = syz_genetlink_get_family_id$nbd(&(0x7f0000000040), r2) sendmsg$NBD_CMD_CONNECT(r2, &(0x7f0000000400)={0x0, 0x0, &(0x7f0000001a80)={&(0x7f0000000480)={0x5c, r3, 0x1, 0x70bd2c, 0xffe, {}, [@NBD_ATTR_SIZE_BYTES={0xc, 0x2, 0x2}, @NBD_ATTR_SOCKETS={0x28, 0x7, 0x0, 0x1, [{0xc, 0x1, 0x0, 0x1, {0x8, 0x1, r0}}, {0xc, 0x1, 0x0, 0x1, {0x8, 0x1, r0}}, {0xc, 0x1, 0x0, 0x1, {0x8, 0x1, r1}}]}, @NBD_ATTR_SERVER_FLAGS={0xc, 0x5, 0x128}, @NBD_ATTR_BACKEND_IDENTIFIER={0x8, 0xa, 'nbd\x00'}]}, 0x5c}}, 0x20000000) program crashed: BUG: MAX_LOCKDEP_KEYS too low! testing program (duration=9m0s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_emit_ethernet-socketpair-syz_init_net_socket$nl_generic-syz_genetlink_get_family_id$nbd detailed listing: executing program 0: syz_emit_ethernet(0x6a, &(0x7f0000000040)={@link_local={0x1, 0x80, 0xc2, 0x0, 0x0, 0x3}, @remote, @void, {@ipv4={0x800, @icmp={{0x5, 0x4, 0x0, 0x1, 0x5c, 0x0, 0x0, 0xfb, 0x1, 0x0, @initdev={0xac, 0x1e, 0x0, 0x0}, @local}, @time_exceeded={0x3, 0x1, 0x0, 0x3, 0x24, 0x0, {0x10, 0x4, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x1, 0x8, @loopback, @rand_addr=0x640100fe, {[@cipso={0x86, 0x29, 0xffffffffffffffff, [{0x0, 0xe, "08c82ce8da6ee06cb8dd9452"}, {0x5, 0x9, "020007651442eb"}, {0x1, 0x2}, {0x2, 0x7, "cf05003179"}, {0x0, 0x3, '\x00'}]}]}}}}}}}, 0x0) socketpair(0x1, 0x1, 0x0, &(0x7f0000000000)) r0 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) syz_genetlink_get_family_id$nbd(&(0x7f0000000040), r0) program did not crash testing program (duration=9m0s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_emit_ethernet-socketpair-syz_init_net_socket$nl_generic-sendmsg$NBD_CMD_CONNECT detailed listing: executing program 0: syz_emit_ethernet(0x6a, &(0x7f0000000040)={@link_local={0x1, 0x80, 0xc2, 0x0, 0x0, 0x3}, @remote, @void, {@ipv4={0x800, @icmp={{0x5, 0x4, 0x0, 0x1, 0x5c, 0x0, 0x0, 0xfb, 0x1, 0x0, @initdev={0xac, 0x1e, 0x0, 0x0}, @local}, @time_exceeded={0x3, 0x1, 0x0, 0x3, 0x24, 0x0, {0x10, 0x4, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x1, 0x8, @loopback, @rand_addr=0x640100fe, {[@cipso={0x86, 0x29, 0xffffffffffffffff, [{0x0, 0xe, "08c82ce8da6ee06cb8dd9452"}, {0x5, 0x9, "020007651442eb"}, {0x1, 0x2}, {0x2, 0x7, "cf05003179"}, {0x0, 0x3, '\x00'}]}]}}}}}}}, 0x0) socketpair(0x1, 0x1, 0x0, &(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}) r2 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) sendmsg$NBD_CMD_CONNECT(r2, &(0x7f0000000400)={0x0, 0x0, &(0x7f0000001a80)={&(0x7f0000000480)={0x5c, 0x0, 0x1, 0x70bd2c, 0xffe, {}, [@NBD_ATTR_SIZE_BYTES={0xc, 0x2, 0x2}, @NBD_ATTR_SOCKETS={0x28, 0x7, 0x0, 0x1, [{0xc, 0x1, 0x0, 0x1, {0x8, 0x1, r0}}, {0xc, 0x1, 0x0, 0x1, {0x8, 0x1, r0}}, {0xc, 0x1, 0x0, 0x1, {0x8, 0x1, r1}}]}, @NBD_ATTR_SERVER_FLAGS={0xc, 0x5, 0x128}, @NBD_ATTR_BACKEND_IDENTIFIER={0x8, 0xa, 'nbd\x00'}]}, 0x5c}}, 0x20000000) program did not crash testing program (duration=9m0s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_emit_ethernet-socketpair-syz_genetlink_get_family_id$nbd-sendmsg$NBD_CMD_CONNECT detailed listing: executing program 0: syz_emit_ethernet(0x6a, &(0x7f0000000040)={@link_local={0x1, 0x80, 0xc2, 0x0, 0x0, 0x3}, @remote, @void, {@ipv4={0x800, @icmp={{0x5, 0x4, 0x0, 0x1, 0x5c, 0x0, 0x0, 0xfb, 0x1, 0x0, @initdev={0xac, 0x1e, 0x0, 0x0}, @local}, @time_exceeded={0x3, 0x1, 0x0, 0x3, 0x24, 0x0, {0x10, 0x4, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x1, 0x8, @loopback, @rand_addr=0x640100fe, {[@cipso={0x86, 0x29, 0xffffffffffffffff, [{0x0, 0xe, "08c82ce8da6ee06cb8dd9452"}, {0x5, 0x9, "020007651442eb"}, {0x1, 0x2}, {0x2, 0x7, "cf05003179"}, {0x0, 0x3, '\x00'}]}]}}}}}}}, 0x0) socketpair(0x1, 0x1, 0x0, &(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}) r2 = syz_genetlink_get_family_id$nbd(&(0x7f0000000040), 0xffffffffffffffff) sendmsg$NBD_CMD_CONNECT(0xffffffffffffffff, &(0x7f0000000400)={0x0, 0x0, &(0x7f0000001a80)={&(0x7f0000000480)={0x5c, r2, 0x1, 0x70bd2c, 0xffe, {}, [@NBD_ATTR_SIZE_BYTES={0xc, 0x2, 0x2}, @NBD_ATTR_SOCKETS={0x28, 0x7, 0x0, 0x1, [{0xc, 0x1, 0x0, 0x1, {0x8, 0x1, r0}}, {0xc, 0x1, 0x0, 0x1, {0x8, 0x1, r0}}, {0xc, 0x1, 0x0, 0x1, {0x8, 0x1, r1}}]}, @NBD_ATTR_SERVER_FLAGS={0xc, 0x5, 0x128}, @NBD_ATTR_BACKEND_IDENTIFIER={0x8, 0xa, 'nbd\x00'}]}, 0x5c}}, 0x20000000) program did not crash testing program (duration=9m0s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_emit_ethernet-syz_init_net_socket$nl_generic-syz_genetlink_get_family_id$nbd-sendmsg$NBD_CMD_CONNECT detailed listing: executing program 0: syz_emit_ethernet(0x6a, &(0x7f0000000040)={@link_local={0x1, 0x80, 0xc2, 0x0, 0x0, 0x3}, @remote, @void, {@ipv4={0x800, @icmp={{0x5, 0x4, 0x0, 0x1, 0x5c, 0x0, 0x0, 0xfb, 0x1, 0x0, @initdev={0xac, 0x1e, 0x0, 0x0}, @local}, @time_exceeded={0x3, 0x1, 0x0, 0x3, 0x24, 0x0, {0x10, 0x4, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x1, 0x8, @loopback, @rand_addr=0x640100fe, {[@cipso={0x86, 0x29, 0xffffffffffffffff, [{0x0, 0xe, "08c82ce8da6ee06cb8dd9452"}, {0x5, 0x9, "020007651442eb"}, {0x1, 0x2}, {0x2, 0x7, "cf05003179"}, {0x0, 0x3, '\x00'}]}]}}}}}}}, 0x0) r0 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$nbd(&(0x7f0000000040), r0) sendmsg$NBD_CMD_CONNECT(r0, &(0x7f0000000400)={0x0, 0x0, &(0x7f0000001a80)={&(0x7f0000000480)={0x5c, r1, 0x1, 0x70bd2c, 0xffe, {}, [@NBD_ATTR_SIZE_BYTES={0xc, 0x2, 0x2}, @NBD_ATTR_SOCKETS={0x28, 0x7, 0x0, 0x1, [{0xc, 0x1, 0x0, 0x1, {0x8}}, {0xc, 0x1, 0x0, 0x1, {0x8}}, {0xc, 0x1, 0x0, 0x1, {0x8}}]}, @NBD_ATTR_SERVER_FLAGS={0xc, 0x5, 0x128}, @NBD_ATTR_BACKEND_IDENTIFIER={0x8, 0xa, 'nbd\x00'}]}, 0x5c}}, 0x20000000) program did not crash testing program (duration=9m0s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): socketpair-syz_init_net_socket$nl_generic-syz_genetlink_get_family_id$nbd-sendmsg$NBD_CMD_CONNECT detailed listing: executing program 0: socketpair(0x1, 0x1, 0x0, &(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}) r2 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r3 = syz_genetlink_get_family_id$nbd(&(0x7f0000000040), r2) sendmsg$NBD_CMD_CONNECT(r2, &(0x7f0000000400)={0x0, 0x0, &(0x7f0000001a80)={&(0x7f0000000480)={0x5c, r3, 0x1, 0x70bd2c, 0xffe, {}, [@NBD_ATTR_SIZE_BYTES={0xc, 0x2, 0x2}, @NBD_ATTR_SOCKETS={0x28, 0x7, 0x0, 0x1, [{0xc, 0x1, 0x0, 0x1, {0x8, 0x1, r0}}, {0xc, 0x1, 0x0, 0x1, {0x8, 0x1, r0}}, {0xc, 0x1, 0x0, 0x1, {0x8, 0x1, r1}}]}, @NBD_ATTR_SERVER_FLAGS={0xc, 0x5, 0x128}, @NBD_ATTR_BACKEND_IDENTIFIER={0x8, 0xa, 'nbd\x00'}]}, 0x5c}}, 0x20000000) program crashed: BUG: MAX_LOCKDEP_KEYS too low! testing program (duration=9m0s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): socketpair-syz_init_net_socket$nl_generic-syz_genetlink_get_family_id$nbd-sendmsg$NBD_CMD_CONNECT detailed listing: executing program 0: socketpair(0x1, 0x1, 0x0, 0x0) r0 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$nbd(&(0x7f0000000040), r0) sendmsg$NBD_CMD_CONNECT(r0, &(0x7f0000000400)={0x0, 0x0, &(0x7f0000001a80)={&(0x7f0000000480)={0x5c, r1, 0x1, 0x70bd2c, 0xffe, {}, [@NBD_ATTR_SIZE_BYTES={0xc, 0x2, 0x2}, @NBD_ATTR_SOCKETS={0x28, 0x7, 0x0, 0x1, [{0xc, 0x1, 0x0, 0x1, {0x8}}, {0xc, 0x1, 0x0, 0x1, {0x8}}, {0xc, 0x1, 0x0, 0x1, {0x8}}]}, @NBD_ATTR_SERVER_FLAGS={0xc, 0x5, 0x128}, @NBD_ATTR_BACKEND_IDENTIFIER={0x8, 0xa, 'nbd\x00'}]}, 0x5c}}, 0x20000000) program did not crash testing program (duration=9m0s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): socketpair-syz_init_net_socket$nl_generic-syz_genetlink_get_family_id$nbd-sendmsg$NBD_CMD_CONNECT detailed listing: executing program 0: socketpair(0x1, 0x1, 0x0, &(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}) r2 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r3 = syz_genetlink_get_family_id$nbd(0x0, r2) sendmsg$NBD_CMD_CONNECT(r2, &(0x7f0000000400)={0x0, 0x0, &(0x7f0000001a80)={&(0x7f0000000480)={0x5c, r3, 0x1, 0x70bd2c, 0xffe, {}, [@NBD_ATTR_SIZE_BYTES={0xc, 0x2, 0x2}, @NBD_ATTR_SOCKETS={0x28, 0x7, 0x0, 0x1, [{0xc, 0x1, 0x0, 0x1, {0x8, 0x1, r0}}, {0xc, 0x1, 0x0, 0x1, {0x8, 0x1, r0}}, {0xc, 0x1, 0x0, 0x1, {0x8, 0x1, r1}}]}, @NBD_ATTR_SERVER_FLAGS={0xc, 0x5, 0x128}, @NBD_ATTR_BACKEND_IDENTIFIER={0x8, 0xa, 'nbd\x00'}]}, 0x5c}}, 0x20000000) program did not crash testing program (duration=9m0s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): socketpair-syz_init_net_socket$nl_generic-syz_genetlink_get_family_id$nbd-sendmsg$NBD_CMD_CONNECT detailed listing: executing program 0: socketpair(0x1, 0x1, 0x0, &(0x7f0000000000)) r0 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) syz_genetlink_get_family_id$nbd(&(0x7f0000000040), r0) sendmsg$NBD_CMD_CONNECT(r0, 0x0, 0x20000000) program did not crash testing program (duration=9m0s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): socketpair-syz_init_net_socket$nl_generic-syz_genetlink_get_family_id$nbd-sendmsg$NBD_CMD_CONNECT detailed listing: executing program 0: socketpair(0x1, 0x1, 0x0, &(0x7f0000000000)) r0 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) syz_genetlink_get_family_id$nbd(&(0x7f0000000040), r0) sendmsg$NBD_CMD_CONNECT(r0, &(0x7f0000000400)={0x0, 0x0, 0x0}, 0x20000000) program did not crash testing program (duration=9m0s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): socketpair-syz_init_net_socket$nl_generic-syz_genetlink_get_family_id$nbd-sendmsg$NBD_CMD_CONNECT detailed listing: executing program 0: socketpair(0x1, 0x1, 0x0, &(0x7f0000000000)) r0 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) syz_genetlink_get_family_id$nbd(&(0x7f0000000040), r0) sendmsg$NBD_CMD_CONNECT(r0, &(0x7f0000000400)={0x0, 0x0, &(0x7f0000001a80)={0x0}}, 0x20000000) program did not crash testing program (duration=9m0s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): socketpair-syz_init_net_socket$nl_generic-syz_genetlink_get_family_id$nbd-sendmsg$NBD_CMD_CONNECT detailed listing: executing program 0: socketpair(0x1, 0x1, 0x0, &(0x7f0000000000)) r0 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$nbd(&(0x7f0000000040), r0) sendmsg$NBD_CMD_CONNECT(r0, &(0x7f0000000400)={0x0, 0x0, &(0x7f0000001a80)={&(0x7f0000000480)={0x14, r1, 0x1, 0x70bd2c, 0xffe}, 0x14}}, 0x20000000) program did not crash testing program (duration=9m0s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): socketpair-syz_init_net_socket$nl_generic-syz_genetlink_get_family_id$nbd-sendmsg$NBD_CMD_CONNECT detailed listing: executing program 0: socketpair(0x1, 0x1, 0x0, &(0x7f0000000000)) r0 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$nbd(&(0x7f0000000040), r0) sendmsg$NBD_CMD_CONNECT(r0, &(0x7f0000000400)={0x0, 0x0, &(0x7f0000001a80)={&(0x7f0000000480)={0x38, r1, 0x1, 0x70bd2c, 0xffe, {}, [@NBD_ATTR_SIZE_BYTES={0xc, 0x2, 0x2}, @NBD_ATTR_SOCKETS={0x4}, @NBD_ATTR_SERVER_FLAGS={0xc, 0x5, 0x128}, @NBD_ATTR_BACKEND_IDENTIFIER={0x8, 0xa, 'nbd\x00'}]}, 0x38}}, 0x20000000) program did not crash extracting C reproducer testing compiled C program (duration=9m0s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): socketpair-syz_init_net_socket$nl_generic-syz_genetlink_get_family_id$nbd-sendmsg$NBD_CMD_CONNECT program crashed: BUG: MAX_LOCKDEP_KEYS too low! simplifying C reproducer testing compiled C program (duration=9m0s, {Threaded:false Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): socketpair-syz_init_net_socket$nl_generic-syz_genetlink_get_family_id$nbd-sendmsg$NBD_CMD_CONNECT program crashed: BUG: MAX_LOCKDEP_KEYS too low! testing compiled C program (duration=9m0s, {Threaded:false Repeat:true RepeatTimes:0 Procs:1 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): socketpair-syz_init_net_socket$nl_generic-syz_genetlink_get_family_id$nbd-sendmsg$NBD_CMD_CONNECT program crashed: no output from test machine a never seen crash title: no output from test machine, ignore testing compiled C program (duration=9m0s, {Threaded:false Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox: SandboxArg:0 Leak:false NetInjection:false NetDevices:false NetReset:false Cgroups:false BinfmtMisc:false CloseFDs:false KCSAN:false DevlinkPCI:false NicVF:false USB:false VhciInjection:false Wifi:false IEEE802154:true Sysctl:true Swap:false UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): socketpair-syz_init_net_socket$nl_generic-syz_genetlink_get_family_id$nbd-sendmsg$NBD_CMD_CONNECT program crashed: BUG: MAX_LOCKDEP_KEYS too low! testing compiled C program (duration=9m0s, {Threaded:false Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox: SandboxArg:0 Leak:false NetInjection:false NetDevices:false NetReset:false Cgroups:false BinfmtMisc:false CloseFDs:false KCSAN:false DevlinkPCI:false NicVF:false USB:false VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:false UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): socketpair-syz_init_net_socket$nl_generic-syz_genetlink_get_family_id$nbd-sendmsg$NBD_CMD_CONNECT program crashed: BUG: MAX_LOCKDEP_KEYS too low! testing compiled C program (duration=9m0s, {Threaded:false Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox: SandboxArg:0 Leak:false NetInjection:false NetDevices:false NetReset:false Cgroups:false BinfmtMisc:false CloseFDs:false KCSAN:false DevlinkPCI:false NicVF:false USB:false VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:false UseTmpDir:false HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): socketpair-syz_init_net_socket$nl_generic-syz_genetlink_get_family_id$nbd-sendmsg$NBD_CMD_CONNECT program crashed: BUG: MAX_LOCKDEP_KEYS too low! testing compiled C program (duration=9m0s, {Threaded:false Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox: SandboxArg:0 Leak:false NetInjection:false NetDevices:false NetReset:false Cgroups:false BinfmtMisc:false CloseFDs:false KCSAN:false DevlinkPCI:false NicVF:false USB:false VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:false UseTmpDir:false HandleSegv:false Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): socketpair-syz_init_net_socket$nl_generic-syz_genetlink_get_family_id$nbd-sendmsg$NBD_CMD_CONNECT program crashed: BUG: MAX_LOCKDEP_KEYS too low! testing compiled C program (duration=9m0s, {Threaded:false Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox: SandboxArg:0 Leak:false NetInjection:false NetDevices:false NetReset:false Cgroups:false BinfmtMisc:false CloseFDs:false KCSAN:false DevlinkPCI:false NicVF:false USB:false VhciInjection:false Wifi:false IEEE802154:false Sysctl:false Swap:false UseTmpDir:false HandleSegv:false Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): socketpair-syz_init_net_socket$nl_generic-syz_genetlink_get_family_id$nbd-sendmsg$NBD_CMD_CONNECT program crashed: BUG: MAX_LOCKDEP_KEYS too low! testing program (duration=9m0s, {Threaded:false Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox: SandboxArg:0 Leak:false NetInjection:false NetDevices:false NetReset:false Cgroups:false BinfmtMisc:false CloseFDs:false KCSAN:false DevlinkPCI:false NicVF:false USB:false VhciInjection:false Wifi:false IEEE802154:false Sysctl:false Swap:false UseTmpDir:false HandleSegv:false Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): socketpair-syz_init_net_socket$nl_generic-syz_genetlink_get_family_id$nbd-sendmsg$NBD_CMD_CONNECT detailed listing: executing program 0: socketpair(0x1, 0x1, 0x0, &(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}) r2 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r3 = syz_genetlink_get_family_id$nbd(&(0x7f0000000040), r2) sendmsg$NBD_CMD_CONNECT(r2, &(0x7f0000000400)={0x0, 0x0, &(0x7f0000001a80)={&(0x7f0000000480)={0x5c, r3, 0x1, 0x70bd2c, 0xffe, {}, [@NBD_ATTR_SIZE_BYTES={0xc, 0x2, 0x2}, @NBD_ATTR_SOCKETS={0x28, 0x7, 0x0, 0x1, [{0xc, 0x1, 0x0, 0x1, {0x8, 0x1, r0}}, {0xc, 0x1, 0x0, 0x1, {0x8, 0x1, r0}}, {0xc, 0x1, 0x0, 0x1, {0x8, 0x1, r1}}]}, @NBD_ATTR_SERVER_FLAGS={0xc, 0x5, 0x128}, @NBD_ATTR_BACKEND_IDENTIFIER={0x8, 0xa, 'nbd\x00'}]}, 0x5c}}, 0x20000000) program crashed: BUG: MAX_LOCKDEP_KEYS too low! validation run: crashed=true testing program (duration=9m0s, {Threaded:false Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox: SandboxArg:0 Leak:false NetInjection:false NetDevices:false NetReset:false Cgroups:false BinfmtMisc:false CloseFDs:false KCSAN:false DevlinkPCI:false NicVF:false USB:false VhciInjection:false Wifi:false IEEE802154:false Sysctl:false Swap:false UseTmpDir:false HandleSegv:false Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): socketpair-syz_init_net_socket$nl_generic-syz_genetlink_get_family_id$nbd-sendmsg$NBD_CMD_CONNECT detailed listing: executing program 0: socketpair(0x1, 0x1, 0x0, &(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}) r2 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r3 = syz_genetlink_get_family_id$nbd(&(0x7f0000000040), r2) sendmsg$NBD_CMD_CONNECT(r2, &(0x7f0000000400)={0x0, 0x0, &(0x7f0000001a80)={&(0x7f0000000480)={0x5c, r3, 0x1, 0x70bd2c, 0xffe, {}, [@NBD_ATTR_SIZE_BYTES={0xc, 0x2, 0x2}, @NBD_ATTR_SOCKETS={0x28, 0x7, 0x0, 0x1, [{0xc, 0x1, 0x0, 0x1, {0x8, 0x1, r0}}, {0xc, 0x1, 0x0, 0x1, {0x8, 0x1, r0}}, {0xc, 0x1, 0x0, 0x1, {0x8, 0x1, r1}}]}, @NBD_ATTR_SERVER_FLAGS={0xc, 0x5, 0x128}, @NBD_ATTR_BACKEND_IDENTIFIER={0x8, 0xa, 'nbd\x00'}]}, 0x5c}}, 0x20000000) program crashed: BUG: MAX_LOCKDEP_KEYS too low! validation run: crashed=true testing program (duration=9m0s, {Threaded:false Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox: SandboxArg:0 Leak:false NetInjection:false NetDevices:false NetReset:false Cgroups:false BinfmtMisc:false CloseFDs:false KCSAN:false DevlinkPCI:false NicVF:false USB:false VhciInjection:false Wifi:false IEEE802154:false Sysctl:false Swap:false UseTmpDir:false HandleSegv:false Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): socketpair-syz_init_net_socket$nl_generic-syz_genetlink_get_family_id$nbd-sendmsg$NBD_CMD_CONNECT detailed listing: executing program 0: socketpair(0x1, 0x1, 0x0, &(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}) r2 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r3 = syz_genetlink_get_family_id$nbd(&(0x7f0000000040), r2) sendmsg$NBD_CMD_CONNECT(r2, &(0x7f0000000400)={0x0, 0x0, &(0x7f0000001a80)={&(0x7f0000000480)={0x5c, r3, 0x1, 0x70bd2c, 0xffe, {}, [@NBD_ATTR_SIZE_BYTES={0xc, 0x2, 0x2}, @NBD_ATTR_SOCKETS={0x28, 0x7, 0x0, 0x1, [{0xc, 0x1, 0x0, 0x1, {0x8, 0x1, r0}}, {0xc, 0x1, 0x0, 0x1, {0x8, 0x1, r0}}, {0xc, 0x1, 0x0, 0x1, {0x8, 0x1, r1}}]}, @NBD_ATTR_SERVER_FLAGS={0xc, 0x5, 0x128}, @NBD_ATTR_BACKEND_IDENTIFIER={0x8, 0xa, 'nbd\x00'}]}, 0x5c}}, 0x20000000) program crashed: BUG: MAX_LOCKDEP_KEYS too low! validation run: crashed=true reproducing took 4h13m38.047316578s repro crashed as (corrupted=false): BUG: MAX_LOCKDEP_KEYS too low! turning off the locking correctness validator. CPU: 3 UID: 0 PID: 15407 Comm: syz.3.1898 Not tainted syzkaller #0 PREEMPT(full) Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 Call Trace: __dump_stack lib/dump_stack.c:94 [inline] dump_stack_lvl+0x100/0x190 lib/dump_stack.c:120 register_lock_class+0x5e6/0x7b0 kernel/locking/lockdep.c:1348 __lock_acquire+0x3e7/0x1ec0 kernel/locking/lockdep.c:5128 lock_acquire kernel/locking/lockdep.c:5908 [inline] lock_acquire+0x1d1/0x380 kernel/locking/lockdep.c:5865 blk_freeze_acquire_lock block/blk.h:766 [inline] blk_freeze_queue_start+0xf9/0x150 block/blk-mq.c:185 blk_mq_freeze_queue_nomemsave+0x15/0x20 block/blk-mq.c:206 blk_mq_freeze_queue include/linux/blk-mq.h:956 [inline] rq_qos_add+0x165/0x460 block/blk-rq-qos.c:341 wbt_init+0x331/0x440 block/blk-wbt.c:981 wbt_init_enable_default+0x89/0x170 block/blk-wbt.c:788 blk_register_queue+0x4a8/0x630 block/blk-sysfs.c:995 __add_disk+0x73f/0xe40 block/genhd.c:524 add_disk_fwnode+0x118/0x480 block/genhd.c:593 add_disk include/linux/blkdev.h:798 [inline] nbd_dev_add+0x779/0xb10 drivers/block/nbd.c:2026 nbd_genl_connect+0x902/0x1760 drivers/block/nbd.c:2223 genl_family_rcv_msg_doit+0x214/0x300 net/netlink/genetlink.c:1114 genl_family_rcv_msg net/netlink/genetlink.c:1194 [inline] genl_rcv_msg+0x560/0x800 net/netlink/genetlink.c:1209 netlink_rcv_skb+0x159/0x420 net/netlink/af_netlink.c:2556 genl_rcv+0x28/0x40 net/netlink/genetlink.c:1218 netlink_unicast_kernel net/netlink/af_netlink.c:1319 [inline] netlink_unicast+0x585/0x850 net/netlink/af_netlink.c:1345 netlink_sendmsg+0x8b0/0xda0 net/netlink/af_netlink.c:1900 sock_sendmsg_nosec net/socket.c:800 [inline] __sock_sendmsg net/socket.c:815 [inline] ____sys_sendmsg+0xa4d/0xbe0 net/socket.c:2713 ___sys_sendmsg+0x190/0x1e0 net/socket.c:2767 __sys_sendmsg+0x160/0x210 net/socket.c:2799 do_syscall_x64 arch/x86/entry/syscall_64.c:61 [inline] do_syscall_64+0x123/0x790 arch/x86/entry/syscall_64.c:84 entry_SYSCALL_64_after_hwframe+0x77/0x7f RIP: 0033:0x7faaaeb9e159 Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 RSP: 002b:00007ffd5368e6e8 EFLAGS: 00000246 ORIG_RAX: 000000000000002e RAX: ffffffffffffffda RBX: 00007faaaee25fa0 RCX: 00007faaaeb9e159 RDX: 0000000020000000 RSI: 0000200000000400 RDI: 0000000000000006 RBP: 00007faaaec35024 R08: 0000000000000000 R09: 0000000000000000 R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 R13: 00007faaaee25fac R14: 00007faaaee25fa0 R15: 00007faaaee25fa0 final repro crashed as (corrupted=false): BUG: MAX_LOCKDEP_KEYS too low! turning off the locking correctness validator. CPU: 3 UID: 0 PID: 15407 Comm: syz.3.1898 Not tainted syzkaller #0 PREEMPT(full) Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 Call Trace: __dump_stack lib/dump_stack.c:94 [inline] dump_stack_lvl+0x100/0x190 lib/dump_stack.c:120 register_lock_class+0x5e6/0x7b0 kernel/locking/lockdep.c:1348 __lock_acquire+0x3e7/0x1ec0 kernel/locking/lockdep.c:5128 lock_acquire kernel/locking/lockdep.c:5908 [inline] lock_acquire+0x1d1/0x380 kernel/locking/lockdep.c:5865 blk_freeze_acquire_lock block/blk.h:766 [inline] blk_freeze_queue_start+0xf9/0x150 block/blk-mq.c:185 blk_mq_freeze_queue_nomemsave+0x15/0x20 block/blk-mq.c:206 blk_mq_freeze_queue include/linux/blk-mq.h:956 [inline] rq_qos_add+0x165/0x460 block/blk-rq-qos.c:341 wbt_init+0x331/0x440 block/blk-wbt.c:981 wbt_init_enable_default+0x89/0x170 block/blk-wbt.c:788 blk_register_queue+0x4a8/0x630 block/blk-sysfs.c:995 __add_disk+0x73f/0xe40 block/genhd.c:524 add_disk_fwnode+0x118/0x480 block/genhd.c:593 add_disk include/linux/blkdev.h:798 [inline] nbd_dev_add+0x779/0xb10 drivers/block/nbd.c:2026 nbd_genl_connect+0x902/0x1760 drivers/block/nbd.c:2223 genl_family_rcv_msg_doit+0x214/0x300 net/netlink/genetlink.c:1114 genl_family_rcv_msg net/netlink/genetlink.c:1194 [inline] genl_rcv_msg+0x560/0x800 net/netlink/genetlink.c:1209 netlink_rcv_skb+0x159/0x420 net/netlink/af_netlink.c:2556 genl_rcv+0x28/0x40 net/netlink/genetlink.c:1218 netlink_unicast_kernel net/netlink/af_netlink.c:1319 [inline] netlink_unicast+0x585/0x850 net/netlink/af_netlink.c:1345 netlink_sendmsg+0x8b0/0xda0 net/netlink/af_netlink.c:1900 sock_sendmsg_nosec net/socket.c:800 [inline] __sock_sendmsg net/socket.c:815 [inline] ____sys_sendmsg+0xa4d/0xbe0 net/socket.c:2713 ___sys_sendmsg+0x190/0x1e0 net/socket.c:2767 __sys_sendmsg+0x160/0x210 net/socket.c:2799 do_syscall_x64 arch/x86/entry/syscall_64.c:61 [inline] do_syscall_64+0x123/0x790 arch/x86/entry/syscall_64.c:84 entry_SYSCALL_64_after_hwframe+0x77/0x7f RIP: 0033:0x7faaaeb9e159 Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 RSP: 002b:00007ffd5368e6e8 EFLAGS: 00000246 ORIG_RAX: 000000000000002e RAX: ffffffffffffffda RBX: 00007faaaee25fa0 RCX: 00007faaaeb9e159 RDX: 0000000020000000 RSI: 0000200000000400 RDI: 0000000000000006 RBP: 00007faaaec35024 R08: 0000000000000000 R09: 0000000000000000 R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 R13: 00007faaaee25fac R14: 00007faaaee25fa0 R15: 00007faaaee25fa0