Extracting prog: 1h15m46.24782933s
Minimizing prog: 31m8.380976769s
Simplifying prog options: 0s
Extracting C: 24.939505723s
Simplifying C: 5m13.2148981s


extracting reproducer from 31 programs
first checking the prog from the crash report
single: executing 1 programs separately with timeout 30s
testing program (duration=30s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_open_dev$dvb_frontend-socket$inet_mptcp-socket-syz_genetlink_get_family_id$tipc-getsockname$packet-sendmsg$nl_route-sendmsg$nl_route-connect$inet-setsockopt$sock_int-ioctl$FE_SET_PROPERTY-syz_open_dev$dvb_frontend-socket$inet_mptcp-socket-syz_genetlink_get_family_id$tipc-getsockname$packet-sendmsg$nl_route-sendmsg$nl_route-connect$inet-setsockopt$sock_int-ioctl$FE_SET_PROPERTY
detailed listing:
executing program 0:
r0 = syz_open_dev$dvb_frontend(&(0x7f0000000080), 0x0, 0x402)
r1 = socket$inet_mptcp(0x2, 0x1, 0x106)
r2 = socket(0x10, 0x803, 0x0)
syz_genetlink_get_family_id$tipc(&(0x7f0000000000), r2)
getsockname$packet(r2, &(0x7f0000000280)={0x11, 0x0, <r3=>0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14)
sendmsg$nl_route(r2, &(0x7f0000000180)={&(0x7f0000000040)={0x10, 0x0, 0x0, 0x400000}, 0xc, &(0x7f0000000140)={&(0x7f0000000100)=@RTM_GETMDB={0x18, 0x56, 0x2, 0x70bd25, 0x25dfdbfe, {0x7, r3}, [""]}, 0x18}}, 0x20000000)
sendmsg$nl_route(r2, &(0x7f0000000240)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000580)=ANY=[@ANYBLOB="4800000010000305ff810000fddbdf2500000000", @ANYRES32=r3, @ANYBLOB="1748000040000200280012800a000100767863616e0000001800028014000100000000", @ANYRES32=r3], 0x48}, 0x1, 0x0, 0x0, 0x40}, 0x0)
connect$inet(r1, &(0x7f0000000000)={0x2, 0x4e22, @empty}, 0x10)
setsockopt$sock_int(r1, 0x1, 0x9, &(0x7f00000003c0)=0x246, 0x4)
ioctl$FE_SET_PROPERTY(r0, 0x40106f52, &(0x7f00000000c0)={0x29, &(0x7f0000000200)=[{0x34, '\x00', @data=0x4}]})
syz_open_dev$dvb_frontend(&(0x7f0000000080), 0x0, 0x402) (async)
socket$inet_mptcp(0x2, 0x1, 0x106) (async)
socket(0x10, 0x803, 0x0) (async)
syz_genetlink_get_family_id$tipc(&(0x7f0000000000), r2) (async)
getsockname$packet(r2, &(0x7f0000000280)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) (async)
sendmsg$nl_route(r2, &(0x7f0000000180)={&(0x7f0000000040)={0x10, 0x0, 0x0, 0x400000}, 0xc, &(0x7f0000000140)={&(0x7f0000000100)=@RTM_GETMDB={0x18, 0x56, 0x2, 0x70bd25, 0x25dfdbfe, {0x7, r3}, [""]}, 0x18}}, 0x20000000) (async)
sendmsg$nl_route(r2, &(0x7f0000000240)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000580)=ANY=[@ANYBLOB="4800000010000305ff810000fddbdf2500000000", @ANYRES32=r3, @ANYBLOB="1748000040000200280012800a000100767863616e0000001800028014000100000000", @ANYRES32=r3], 0x48}, 0x1, 0x0, 0x0, 0x40}, 0x0) (async)
connect$inet(r1, &(0x7f0000000000)={0x2, 0x4e22, @empty}, 0x10) (async)
setsockopt$sock_int(r1, 0x1, 0x9, &(0x7f00000003c0)=0x246, 0x4) (async)
ioctl$FE_SET_PROPERTY(r0, 0x40106f52, &(0x7f00000000c0)={0x29, &(0x7f0000000200)=[{0x34, '\x00', @data=0x4}]}) (async)

program did not crash
single: failed to extract reproducer
bisect: bisecting 31 programs with base timeout 30s
testing program (duration=37s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): [40, 36, 27, 10, 18, 14, 14, 10, 8, 17, 40, 30, 36, 19, 21, 3, 12, 8, 30, 17, 30, 25, 8, 4, 20, 12, 9, 10, 11, 14, 30]
detailed listing:
executing program 0:
ioctl$AUTOFS_DEV_IOCTL_FAIL(0xffffffffffffffff, 0xc0189377, &(0x7f0000000000)={{0x1, 0x1, 0x18, 0xffffffffffffffff, {0x9, 0xb}}, './file0\x00'}) (async)
ioctl$AUTOFS_DEV_IOCTL_FAIL(0xffffffffffffffff, 0xc0189377, &(0x7f0000000000)={{0x1, 0x1, 0x18, <r0=>0xffffffffffffffff, {0x9, 0xb}}, './file0\x00'})
setsockopt$inet_sctp_SCTP_RECVRCVINFO(r0, 0x84, 0x20, &(0x7f0000000040)=0x6ca38e49, 0x4)
ioctl$AUTOFS_DEV_IOCTL_VERSION(r0, 0xc0189371, &(0x7f0000000080)={{0x1, 0x1, 0x18, <r1=>r0}, './file0\x00'})
ioctl$AUTOFS_DEV_IOCTL_CLOSEMOUNT(0xffffffffffffffff, 0xc0189375, &(0x7f00000000c0)={{0x1, 0x1, 0x18, <r2=>r1}, './file0\x00'})
syncfs(r1)
connect$l2tp6(r1, &(0x7f0000000100)={0xa, 0x0, 0x1, @rand_addr=' \x01\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x01', 0x4, 0x4}, 0x20) (async)
connect$l2tp6(r1, &(0x7f0000000100)={0xa, 0x0, 0x1, @rand_addr=' \x01\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x01', 0x4, 0x4}, 0x20)
r3 = socket$igmp6(0xa, 0x3, 0x2)
epoll_ctl$EPOLL_CTL_MOD(r1, 0x3, r3, &(0x7f0000000140)={0x20000000}) (async)
epoll_ctl$EPOLL_CTL_MOD(r1, 0x3, r3, &(0x7f0000000140)={0x20000000})
ioctl$EXT4_IOC_SWAP_BOOT(r0, 0x6611) (async)
ioctl$EXT4_IOC_SWAP_BOOT(r0, 0x6611)
socket$inet6_sctp(0xa, 0x1, 0x84) (async)
r4 = socket$inet6_sctp(0xa, 0x1, 0x84)
r5 = syz_genetlink_get_family_id$batadv(&(0x7f00000001c0), r2)
sendmsg$BATADV_CMD_GET_HARDIF(r2, &(0x7f0000000280)={&(0x7f0000000180)={0x10, 0x0, 0x0, 0x2000000}, 0xc, &(0x7f0000000240)={&(0x7f0000000200)={0x34, r5, 0x8, 0x70bd29, 0x25dfdbfe, {}, [@BATADV_ATTR_ISOLATION_MASK={0x8, 0x2c, 0xf}, @BATADV_ATTR_HOP_PENALTY={0x5, 0x35, 0x7}, @BATADV_ATTR_NETWORK_CODING_ENABLED={0x5, 0x38, 0x1}, @BATADV_ATTR_GW_SEL_CLASS={0x8, 0x34, 0xffff}]}, 0x34}, 0x1, 0x0, 0x0, 0x10}, 0x20000000)
openat$mice(0xffffffffffffff9c, &(0x7f00000002c0), 0xdc200) (async)
r6 = openat$mice(0xffffffffffffff9c, &(0x7f00000002c0), 0xdc200)
getsockopt$inet_sctp6_SCTP_RECVRCVINFO(r4, 0x84, 0x20, &(0x7f0000000300), &(0x7f0000000340)=0x4)
sendmmsg$inet6(r0, &(0x7f0000005380)=[{{&(0x7f0000000380)={0xa, 0x4e24, 0x9, @private1={0xfc, 0x1, '\x00', 0x1}, 0x3}, 0x1c, &(0x7f00000025c0)=[{&(0x7f00000003c0)="f3968f0acc449543a1174ed3c7b2bdd02f36c6f4162d665b99919f65b4c96f405d42386ea52e1472a7684c411db693fc738cc490088885ac3782bc3c51cd670be2fb167e567a866b4b7d9bfdbbfc82cae4462b94e37f5b329f65305326a70957bbf2a9ae677f9906ce2ff5635a54e4dd0d6c4bd0e08906bb096fdd6432476bc69f16f2a9f6b08836eb12f19915240da83a90ca5d46999ffb879be8f7acd8528a206f8f680318a63266d1b4fee5a2d06c86fcb4551d323c570c6f188e8d3801579755602b4cfbe8e80af6e9fa4ae003dc778b931f5fa2ab7aae5f4bbdf00164c22ef6bd77141b8586074ab123f6985b161fe1d92272e6d749bfd4eee3e941d9daa70dee6057aa10db53fa3e57699699ac6b651b59dfe014f09791892b11bc9e2f69048405e398dd78c2f3f36a70294041a058902be62d5f9b03e7a8763a333b3d8ddc97da3d1e729d8cd4680058262075f1b55062d05c37299fc9b423fd3f3a176aaa752a4a488e2fad28e613d313a56b3a29934e5a3052f1146c80db3f05b0a3d8d86f344b69fcbb0a68786401c38ef76db18d8c9581e74e09d22b5c317ce5affd5af42b6065a49f5b3b713f4940ec45117f85bf0cfe86c30d5e2368b548d8b58e6f8057eecafba6bec6f82cdbe9f59ed9ab6eb44993d18418e731266f0a7d9c01b3e13a78b3b05e03c3b2492588fab9720e1da2da67ffe71a31e493bae98381d978bb69a9e078dc734ecabfc1302fb1a426fa57e15b6f19ab859094da57bb9a2c61821d22357747682ce5ef4c5682d1d33a51fbc36d5a690d68eecb055673bf27a0b0013908dde5db185977007b8eb273120b6144cc3cdc5c0bdc25e14f7d140c81c01da6669fd941ee9d7cd5ba0f694e309f8b58b0a328c04c8e9bdd425402ad7398387c6fa2fa5a60ad9e92d301232f9c6977bcd116343ec7a5c93268ce70f3832fe3071bec33cca4d0e759b447caf528eed7abbb9843048c8f97e65297a738ba2ded3ea60554f303c27ebd9926e621d93f60e0f58505169c2a2a7447b094b5cb556565d1c9bc970a80474b7db3b72ccc1027d418af37faecbb5e2277131b28027621ba819a66b8ce2fc9368a550a7d8dcdd99be538844b8bdc57f8c388c60605524653ca447a10947fdb75dd343326bf80e2c0ceaf26a6b3e9d5f1b018b1c791b2661648f461b4be8ce464616d93a000c322e811519dbacafc42b8d95536bf6172620b54a890d69b6345bc7bfbe87927db9ffdbb56376aca19ae3974e9786ed23582243528661cb3b7fec51d84f45b3e9e7f66db0aa6e202d6e7d1cd118fffc777a6952e6fa208a6c7fef052dec02643e6003f3e458cfc81c8cd2694cbb1756b5338203aeb456ceba062ab8bbed2d1cb09881d909819c073df02836d3cffbe900e8bcaddb1906e8f012cee023f1d464358eae74c20d28fc266b2c4312cb01220f7708d79b70b736c2b049e0ebd249baec1831f4145a8c4dc37e5120e3fe379fee4bca3978bf64a44b7b841ed62617275b99cda254e5d6142bbefe6f27a35e607faf996702db2e959fd0f5eec6a8bbfe5338dce16300e93985246cde8e2460b5c6a6c0361eec4ec8489bd73e78afa5cb9b854be7b6e5315672f3d9c7716274afc44fdd57503bf634fba6504bb45bdb3c0cef9ef7e9f35ce0a7fbc5539ddab950b40d88744c1e5bf3b79d763607f84a10b28bb73d20accaee4cca94d6d67ea42e6608c67df18867a99fd9d8835fe1ae214f7abe9c462ac92fa867da5ff8e6c456a0385f7c08af37a6e1271d585916c9c2708cb5de111f05714593394bd7332a176265f06d47fed7760a9c0660cfc22d801f8a32c26bdbb980203115736b6f5dfc99b002a259538ac875af47f39f461bdb95fc5b2299da193756f2b00f282182dc7db1e6ea3e2e567e289066c99aaa602f62ecf1146a8279ea4b71f867107938d3607ee0e697de8dcc26288d023f260d4d93606513be53a4fc8db8181fcae9100af000c1e03f57fe89542a51ad1ab3ce7cade04cb849baa724d25ab161d6d0d4e6627e441e3e053f45aeee41ec3cc7dac582e29ead8e17bafbb7e32b1b9963fe5136d340f1c63e167112a88244856e0121d865e48bd1683519348361271ae6cec18971be0112a7e604af84b9b2af4eaaae4e96a6101676cf65156e33fe614913413ce9efacc8319961e124986737e99758776669e4c617c6e3f2ecf5432be718d2b3a19dd176c29a63864af9d150888c0e851b990c33e56ac8b89dd62bc38b3f1cc452aa264b90b3194a15d2e3f10c95b85b2c26b8f7571a8ce944e389849bdc7fa67bc48c8511b93caa9562e4496a3414fba262f531141c414a8759710076c5eb995d99ddd32307e07811d6ee35e2106b94bda316d6056c1a384289894079243e1c37475f9378403705c849781a82cf382f3f5fb71f273eb46a0bbcd0009d8da17c5318ad89dcdff3879f11a3cb4f3f89e672caf7e707848974fc7003b6fa0dc561b5bd34b7c7ad20bf94df2582f612dbb11869a7f47f989df074e8578d68af5ebbc70ae23e727a76f28ba44bf6ab59c5dce4170059832fe63c85fb7ed5ec080d514dd46b6d2db166cdcb605524ca08685d623dd3fc3ff242db60aaf2c814df2c46e497a1bb6b9c5befd5f62f328d4dafa98a20bb354101f8ac7361ba171b13f82e4b997eb7cecd2518efa5a34bb22bec09d93e20684ea1d97db008ce439766cdd4fe54cc58cbec91f0827ae8b71c425be7f47033a7fc5a6ed328110f1fb8be8e2d8ba7d1352c8384baaf1c1433b098971b1d5ba1d20d629bb8fe3f69f143663fa71025e785acf364ecf71dfbf60deb1101d176d7012ec96dbb9faeec9cdb4a2f9aa8630a4fd580e8b3c6998ac77566bbb5be7e06ef5efc7f8b60f6a5f657ec8549f536a7ad23b5477c4251152f682e32414a6498f9e96e226a2d973dafe50c90a91de5ed3e6ff4328eceda80ece70de06335c9b5d3a236f5ea3ef28b3bf39b81da0b73508be24491d795134a4162c31db2ed04be188ac0a1ca23d4576845ce8a998926f8fcdeb2f32d34eaa993be638b6e98305f867eb2c0021e22d18a6494ef8d97aab4f2f2b2382467916956cfa5fbe96e0a88a1c384a52fc6ae3e63e63916ae821abbc46b059474b61c020ba56109aa44449f385fb96cd99e38a0b000303f02ef99e0c38b4a0d311be278d4256851d20a15670ba1fe3dec36681e62bbf9847eabbf49fa191f418f928dd4cead46eeed3dbf391fbbffc93b3d5fe9f3eba382f30d0e018f3f85f247d4e90138c5801bc499bc45ceebe82f53391251b2ad09aa8569f7fe65d9ecf5c17bc1627cef7ef3036405cce4c2f9792efec2817afabc7fa6207a718d70d2f68ac96485715ecf4c9a43b367d014703506bfeca0a2e0c17ee4cdcf33208301c33d6e6fdb02b21bab6eb089707c1cb4ef8918b3c0859bbbc4c942f39d7d37e5809b7263479b82cce251cb7ba6f4e5458d98cf5a597e25fbfcd0810fc5f44e1f748b15e5e0cbb195d290df4d500cd663a217d660231d1fad8f4543b2fc6e0574c24c7f317452ebfc3a18411ff22f7564b7cd39ea36003af33d5036d66e22e833eeb0672f1f3aa517d178fedf67465477e2799091ad9d7d2b647a951ee4659340aa78475183aa9c72ce904eaee01ee1db3ef0773eda549f05272bea8131f2c240d5166125186f9dce1b7bfc31091d3f47a89560685e3dc71f099b667e45a265bbad3fc88989f6e1a6623e242759d079e05e67817f6add6dd41941c0fb609b855bfc8757c50c18d12302b95966c92c9eb56bf0d49c1fc01f42b4b9549dc7e0705f33ae53a990b7938c2f0a82f8c74fb42ddfcf8dfd9f3b3714a6edc51bf79939771d12bc199bcc3143bed9e53f2840c4ffd9a86f7d5e369a3c2f5bb7c83a3ebfd980e7027ff3e1809b0c177593397b10c586d06f40bbd8e7cb79d1c2f602f4e1ad892f6e933105b626dc9b6abf7821b79d53a56e95830563cbc66393baa3c25be8fca885a29d52fe76d5b8bf2457441ef01a38a0e81183dadb85ae3a3f727b58ff0c5ad2e012ffbcf0e73131518ce3e0f03d0b7e8f87d459223cb73b463b123c70c73b2345270b84a5fc475aaf8e01923ee6ea8fb28d759a74a96f4c25a689566c28334092a8206d7998a2fe16ba4c73b4bf25a9b977a9127ba86cb147cca3199476e7c23718ff3f025628bf11729ae9e98e3270e5248b6413224f7504763812bab89924037efe0a73aeeaa13cec1c197e8dccff5cbc8c8db0388ca9286fab42882d38183a80104235aaefe5383456e39f62a99ac3059f9d45644f1b13107150a150f933b6ec4ea5ca1d455d79eae83a6f365889b81166f1a3076dab20b3c6413c18799b5f5144ab365c95b0f3b78a260e00c308b8cfacf08dcc196bab826cb8e14c997a153afd8014e3c6be3c6ee7d010bc464508f04de2ea511e07af747517dfb0942a9dba3cec3a9b2b96929c8f9a1eea67ccd0e29426f91081664f0511423ca72e3c136d19f86914f81e2c449854956caf721ae737259495832430198c9d58cb105ab21915773df7a4adba650beab239e7402074e01e48adcc9704c3e846972946bc0aec0631d6414676ded4f02871123a088ee0dcc213c57fd601c8717805f5e5820b658daf807981e372450e60be8901d437fa9f52f6eeff7dad28b4b6174db6432b7aa91bbc5fe737d252d4af2060eee6d2f213534cb7e2514503146f4781e262258452baa08cfc9cc37178b62ad477e6e985eb80ca82145dfb226753b6e503430c9a4047fca541bca516a3323fc1bbea25fe22b909e6b6ccc121408569402ad9861ea674cf85bbcd8fd13c027b852f29bd931e08b2ae3ee64a64e87886c7700a6a23d11b0ca1cfb5cd8324116c7548164d9737e57e074f279097ad8760f03f8f850aa4380cd5d6d4b1140a7cda5449afe2867237a3f522fad8dc917cb1ed5d3c672bf9860a9ff86c151656172d71b9093970768adb459d7c1d683b6c50a452dcb0bf5e466ac6c396905e4c36273b9f9f09b4880957fd2ad9b0155e92d7964b38fd2739a1b91fae10f04812ae3449ceab67b6eecc3dfbd4fbbe1a658f57c984f255c0fc970237591f4d612c82fd14714f2ea20202e33d26150c6ec400d362fca276f9c8112bba675c92420606c6507fd6589c2795ac4bc064dd26674493390562d67493ecd64f3420a7b96bbfcbc1c9e2fafd00598c2d20ec814612682ae5107e8b023e4455485f229dc48ae68959d028ca17246ed7261d7b382a4c056df5ef6d513b275cd944c58b867877be43a735488fc2fd9e891aed7659263bda2d7e8ed75a1f72acd2df9bb5876866b06729ba3e1f0b52e2a69bf63771366892be5badcc664368df9fc353b9b0b5bcc0c8f0166db3f7d4f2dbedfaf3a01cfb9501479651b82f2bc5f0fc9ad54ebc0010dccee66baddd35724f85b6b2e4d88ea9c78b05c9877de8b51d8472a3c0be32e69191c213e33293005c821d6ae7ced92288d2a68cb4bc51927c7510a86a0acf7289d53724ad065cbf002b28148556f82d547ca3ab5101a7e3f5938392b7a1c597a5721fd864e9d7e0a4b8a08933cc28b331ae33ef674da7b0d688c9e45df9fc4d4c92dc09f4668308d679964a45052841cb9cacdcb31a6f211418e2c281eb5c7bc719e0155b73f42143800196bcd70dd0fe6e80cb572647cd1444e87d478538a75f5ca84c7a6818255b01b5d61a6fd0ed87d7242461f0165f847651b3ca9557c5180671fb63ae38e6e6eefaf4515e3d2db1088f9b78682fe1d8a2b2ac17aa99c5f94ae778e82a56cfb", 0x1000}, {&(0x7f00000013c0)}, {&(0x7f0000001400)="8c20e3a0b4d87a763400237e1cbc94affbc1b80843f4a0df8c40aab00900c0c1a938ae46e82c33178fdc71018bdb933f4f06e2871a0314cb5a98f975ed0bdc8ada718c51e345bd6b815deae4c185ca7f53c7713280b524fcde5efca8f41bd2d211d513a6475a95180da27fdd7edea505f15c7b2fd529169409aee0c9dd65321fadfa039454303bc87beb33dd6389c5b0bee924b62f578dab00b6cd47dbfe8f92fffb4cc8cb689ff60ca6077b0b9401886c9a2c8417bb8678fd3fa452169c369fd539c7fcb234eb8bc7d7daa3443aaa5466a37580ffe3b866eed85a1e199ee06aac5caf763c3368afb022bbc6a817cc91c80c4f6510f6e75f6b90cb6290bd24384c734882231986ad739af46c96eec18a0afebb8682a58da9a09ec087f630221ddbe17c94cfa82a2ed98876e54b145c8cce3939152227aa83454ebb213c8caa4d8f647f47a29cf5d02a6a62a7cad8ccdd98a75ff20cc019158f79b855120e0eb41ccb77cecaf894b04db7a526e5fffe003c2bf234e47a83c61ed6c3568bfbcc382d7f87e3fa20ee2fbbd000ea507e122a474b4e75df259607b87e9eb526b8f8478606b35e6c40720cea5aee0773551ae80d561c4a4e1a051e005730100e47568dbb877d6a7b8b96018565cb4398f63cfa739f66879bf99d1c182f713f47958c2e711f6e424b3089aa77306686463754a8261efab1ccf472aac3e923d4327587aaa1aff45b1a835b6331afdf53370910afad413dcd49ca9b080223b551ce3debcf628770fecca1a6f3a2e703dcc49f869e6f5b489c4a098bb99c4778252b61f82e68dec133cda8aaa8a0d07ae6e2b73647ad2412f6d6244262cbdca9dae2e8dc58fd7b4814ca86374d15b3f8d511a6be0976d4d4bbc26ad820f0f867ae26a6c1a839eb72da60189213a390d74e321f3a1c3f0f06a2e60eec49c8b546edf62c09ed9bd49c31ba9c901764a2625f3af0384c0ff7383414903c516ae603e22246282cbd20fd64a4e43213c08034afefb44c48ea36b6529391209fb0652fa9a8cb16e9f57734bbb7d7c119074c0dd4c80d454b1896d69d99d9db8a6145784184d5c953a373e6c6196ceb7e50cb642e6934fdf444cd340b16a1fb58a2d502f6ef6da8e6e8753def02355662e0ddc7fa8c78925273d70870e1840894cbfc061c7aa40933fb1fd285cfb2b93cdc580e203cf7f3c03ab844d229b40715396c320ba307ef82baf5a636105cd2b6fcc04940c8a373e656b901cab9582fd7ecd53bee0633c499eaf268a363ed99b1a866ddb3c283338fe1730094010b9bd7615fb114dbdc6cca80be57a93fdcde17b42a5d10c6c20aa195fbc6a8f2d4b120901cf8756e48a4541786c6032da8418a080f0ce9e221476457af54e2df28aa51e983d7c0aabbec7ac87119b07382c1dc70b0507f27bbf55d3543ed13e04ede7997a602338dc154cc52ccf542dd0ce5c6e5504ceb979ebed6aac0bd35e01f8aecd681db7376c0c1b97bc137af97aca381be6e189bec2b681c854ffcd9e89f516f92511c0e8f18a70371e11a53a16b2f80c531824c54cf4d3051f6d09e7a415c7c26ff2d4095c4a2946f2f135e55841738c518bf6914b4b69dc3f8c3f000ab65d4d9b212177eb473d56dc7b7cd6b604bd1bff0b2ff8e8cd233f4338eb3adefa635f9208b0915bab19b6ea2a6ce3dabb33ba8db4594cb112419ee92b52dce813eaaf35e053ff9a21a081cdd10912f2921c7d389f1091b2c521a29eb42886e05c8318270bd338fa3c98050c98ab5fb723b4de1c1d209dfe5d82c89ce1300bf5fcc8991b69e46ac31a99032d174a8af7165421bf9053c23c50d64c48b0109d31a5d50ace8336f32bfca7bf7a825611913324a6d0a30cb27c208abef3213cb41b74c53e7ed17c16602155e94b90ab4b0aab859bb9f25e41cd564bf9a477fb42d7df691c53d7307221d23f0a338bce90b66c0ad488a2d967493b8e661a33a2a0051ddb90ec80fafd7bd9a9f1201e8c525560e45b1a1ad9e901006e7ad7537995273f517cdc50d2da398c0ce52c6b85e66662c828e0841c801087aec54b274cf8244c1eda8dae6e99cbb94de0f95c8c589a0373b6a3c9fcde26c8870c11da7caea5e000e9d0e77f73ddfc53c0d928ea57507b67197602380b6c233aaf3515e8cc096499cad93d5aee64caf58eae17852dd9d7680b4eec76409b7d23e8cf87a677c6191f65f136f7485c81a24eb8a8e2eb214a4655fb8d115907924222b4b8a048ac4641cce44cadb87143dd01c09e3874e0293bc04376d3f7d5b604aa181cceb028f234fffbdd2b2a571a2b68c8f8a5dc01243dce112290aa5e0f4cdb1606d9d099552962e24fea356364c34a89952d2d7a3d39b282763fcdb40da20ee0fdad06477c5a096cdaf3db7381477c9c8c9d80581f4ba48501261fcf0c811c4226533a0c2e35281bb49d68ca39cea1b6711ca549a7d86056744fb9e535957d6d285c970ee7411ee7c541d815642f63779eb132a3530c0fe4f0d05841013ba6f9c453c951c3db0922369393b685ea24d9a1f9b3774d2f178f328a1bf0a659eeba00e46d41b4869dfba2ec00623bfef1b9c8aa9909e29647f501d8aa1d7e243102d12fc337a4526d61dec61b95afa74ecb6018576c51245dda14daac05f40c79f2f0aa2e61a8c2573a37e1a7026ec931c16297c5d68d23f4905faf678b3d566418d985d771d62efc415825bc9705ceb75d6c287b03be0bfa05fef25665fe13c66bc65938923f7ba883fe9cafef19e6ed9f9c48b7b1dd08140bcb2cc131bf7aebf487cf656fc13b9f7bb57357f1fe16c49800c709960702bdcaf51be69458afe8e5692121c31548c4e15171bb838f26c59bf97ab207e3425b29b1ae42d883df06c6f133d871f4cfe860c7cb19e44de668128faaba2c19fcbb8d3eb6a41b654b255c26aa1e0f9617acc5fdcc45d54e87533b46698e60c57b2a67e87102d8e94810dc366740891acc673f6475b6a6714f0d69ed38804eaecdd86fa9ea224ed05eec54b42c11cc062bfd8b34f33f670b72ba81882e7405d9b41143a0787d14364788b967da6deee5e3153b87a80be92d8c0f0d0bb4b721c83c2a8962b12d4ed93883700da4d4b1458af046b3a763aa330fe454943b4961de0fcf2f67f66265f3b40f0a6e5c71b9e6ccf3f126f583db5d2843d49a63d0999d8f5cc20c6fd1573ed92cdb71d1506ebf69f50db53a8f4b6793298e1286ab6efcc7cb3b211f25c9359e17c3490fc22e51fcaf362d8d21c410006b8354818bf7bd9954e986d79a26656a288e75b9a6e8613218701aa780edea06f1a678dbe3b5e7f67e2115a7a17b7acbf47b97dd7875a1d452ffa9b09667084ccfbf8d691aa3851ab1581fccc6b7d21848c1cdb68a5419a7e01f033d90a82905288e4e67a36eeb2dab200540f3d5c0ea3ccb75e560388c77afb42fb0dab9132801516400d440753dd8170431b58a1d6e8ed03cdeec6b8435ae094f8e46dcf62803e388551125d5a35505116fad67b6ad02e50ec2acf2343539f7110f08c13f258561a23422fedddb6d53908e70b121b1311d6a71e5a6c889d0a4e7c8f6e725f6268903ece51e6ab97fe3f00b907d6f2e0eefd74b28eadaa55bc9c7d10e3fa0133da40c00b19f2675f87a52eebed14f0bf4f352c9e15d235d151a6cdec9983d39f239558f4fbdfb2f0d0d8bf13bd98dc2ec6ac79aaf08feace7cf92d13b30923057edf649e55bb80d0e14adfc891a460f03b0e355db0f636d7b792329a104ae3a3ad87c87d2a440d5252ed5b748f5e35e615f286c77398697f398fc5b26326d14257324f44625b3b6df98253299c3f133f437c8b489ff1cdc7d4c9ccad836d91ac86c08bd1d9b295ca547e361cd272bd28cb80faa112741d32e8a0850c6b8ea713e8b0372c876b64588ea7f9e233f18c7eefd4c001318d1e316f4fbac779e3d20be3cc21193ade2e30343561517d01fa966243dd8ae2a996af0339b63b5d37d4382a32b10bd06eaa9d4b3b02a46f1f3af2d9c008dba986c2a672f6fd6ca1bf982d09f5723537eec701f217a3e3608616a05741ab5ee0f17f02cb2480b3ca37cb740fee162f99bd0c9e818deb89a60dea9f390edb868475857433b91cfc0a91aa19268427f5d98a8c8470250cd50166ed6c8a092236043d659453fc6669522fce4f4da2b1c225f3ff4c90930adc690fe619fbd509d69f80a06a68948cba99200c0e381a0d3580f09de348d196382ba4f11ec862293013733197ba8757409e63c5450db1fa3190c44fcf333dafc368793173ca46073bb44fe55f9b89b4a4746572a1952fe20509856ba0a2b26b12684fcbc00eb1bbe7d17e380fc42c1ace20e08138cfe895efe83cdfe70119338cb6c8070388165c812e13c24a0e5c2b8fb76277910cfd0237c8873c97e07bdd097ebcd3aa03b114cca1c08bd2506ea71155bfe97f30960ffd458c897d41ccdd888abc18b97284a0a5dd4413c83aff9ecf84a840c5e0f919f579ebd40c1962a50910fa51f94e52223cc80e5cdd2b3d11a559d4061002e2fe1d16b62e366d131023022f5e94fcc74ca15210c27c45bda6bee68d1465f85f735f91205182b4475d1e5ffa11471d6e78be2cb6c855767b6ca6820f489fa690df537520c5838415fce69fd449da3893786dc9fa43885ff9ef12ea39bb89a6198b6996efbddfe2efb250e487a5b61e207781f6d74d406a6e60ee7ffafb52819a82949967488d8dfb48ec41dd084cb9c98aa764056fc88787259e1a5ddbefb4c042e4ec936b51f1073e5f8143e16665cdff34c5e7b8ace79a4257ec51c8b77624ca4fabd0f1bf07b1bf24134f554cc30d20f2a7db3b8cb7f8073bbf5ef442eb2490711388e15e043da30deebf9a1985e8d4c37b3c91460217ce46c9a9285befc0885a2b900f4ef4ce20712b6f755e52ad41de0f95b8fa5bedc6da5bcda46e8313f7e65f5eae430a31464dcbd12c4e73d4e5f7d41794843cd04367af091437cc44635149b83b387a82506e0d6f7bd2a8c8c7e491dbb41980eb7f4f166e24967ce9569e61c946d31c69d55922d053b65faff02bea375a25736fa94c71f096ddd12c55f87293ba951100a68b937119c4b4aacb9507cbff0314e53ce64f062315feb3fa1b6cb3d5a305364a8e184cd0a536bbfcf733d2f207daa6acb2c4f4e5769647d208ba30875a5e52adaaa6b811d768320c9ccde4e0b6eb2280df049588243458fd092f86c23da5eb84be03c6627d5948a5be84d6d2efbb2fcd5a706650a61788209d4ab7d372c2e0204d039c532b0c038d2a1bb6625fbc9be0763014efa5f462aa866a9813fac639755196738617f324b8d52b7226e843a800caf50b970d488dc95fe3a923aee6e1da54620102628aef812b60a59666768c27a94214807eb4a6e6dd9ac012212c900e817f7503205ec98ba8ae23458c91c328bce636354c16d20f814b3bb90e6cd08d08478238b34b49eb81af3ae831107ea7299adb11bf5494fe41b5cd4e841911ccdcbb99e05ca97721c315af3c349cf54934c8d4d577bfc12592e7f1b1d5f68df6903a6aaa03960dc9c8df0771f2c9be402da5a20a9271eac6a50415716eb2330fc1bd0de141eebf00610e9f4e4ac4cb899f1bdeb6163e9b2c9151f027c3f7fa8f4e9e51ccb67316bde5840364bb0d04370d9ecb54ca50d75239fb0d7669117bc0f3c68661b2b315545162a624caf2ce7435b08bb6723c8395cc5d0cd12a26e6b6ef898f251df61d51449b75f026c6b528a4fd8a5cf123124aacbb70f38a3597fd5319b772d32bf585f57353ba6d0ff36b6a4e23e386", 0x1000}, {&(0x7f0000002400)="ea075c6750bdd710f38e1385a920fccae498e0bff5dfaf383d125bba04f7ae9b343aea7362b361ecb59816adb9881c78901c6ae6ce6f9860e34adf2f5d45ff16828d5b83599e724e6b051b8b3426afec0fca411624449fda6881d0477b2fec063b5c9a9d82f2704ad39ebe66bf3d3d80ce7003198653ee1a5ec7e122e0f5e8da6c15e44254800f59a2ebec84ecd13a93606444f7026aa3ac544283c862fd461e77160c5ec20dbaafdec5b0a2bcfc5c73", 0xb0}, {&(0x7f00000024c0)="c3618c915bc5894fab950ab01e84d825e4c9b5778d78fb12090fbbe14219a230fc8c5af3412755da363ca516ba9cfc6fe7b207e7022c4151b669f5b03c65631ed0af26150d2e67085d6735d67cf08d864d81a6854401ded53ad6aaed2adb5c2d45aaf9bea206ff2520ce37ea5bad8dbc8fa6d7ba039b3e15bd44f379dafbd9d051e9efdb0b2ec9199462606efa13502f8b135f7e19df584d008d27d0a8c4a5d2e7141cc72f34a23a67a1073630384a835082f5d1a821ebb98393c51a6eb57644cbae009a99e4aeaf7dbb533c7e369cbf87329720cad5f8a83dcc58", 0xdb}], 0x5}}, {{0x0, 0x0, &(0x7f0000002800)=[{&(0x7f0000002640)="49ca442176c06443aef7cd7a51151aed8f6034e7beed865f70c60efe7f87fe27814ee75480cf4314a7c30278358f4975959b5218d26b9199550a122d23266fa8943f17a856b22847abe873940acaf4f386ea42df782290aa5363fc3f9f602af4b63ef4a0f8951c064047e93772d988e12be709d4b5c8ba107d8a28df97b25140501bbaf48d9448775a3fba88e82d586b91afad2c95244217eb882ff6237de3565b005f01259b07e1563e26966ccd5b8681ec2e24e63cecc058e6646d660b9c9b06cae868033cd435e3d7baaf210c23a5ec2dbabd4828e4879dd11ac9190a79", 0xdf}, {&(0x7f0000002740)="0ebb7ca5be7b42614fa99fe9a77f0fec4f32fb5c6906d7cccc9ba0838ef7caf80315b5270582cb6e99394b9faab7", 0x2e}, {&(0x7f0000002780)="493c02f58af29b0697bc683a5e8d6ac9b6b70669b64c76026a981c0af197cb228613e78e80512792737b4e159d64b0fa1afaf54b8682", 0x36}, {&(0x7f00000027c0)="11667bf0b8eee20295db9efa813f49d7d902cc5e97333e846241858ef071db124bfe2338af661c", 0x27}], 0x4}}, {{&(0x7f0000002840)={0xa, 0x4e22, 0x5, @empty, 0x3}, 0x1c, &(0x7f0000002ac0)=[{&(0x7f0000002880)="7b7b07b7dd", 0x5}, {&(0x7f00000028c0)="96a403589c59", 0x6}, {&(0x7f0000002900)="b9b35ed2d60307cb61e82da6242b650a2fea3d5d2ca053db04fc9193a389b43c7d829c8e1b962d44a42296d5d6f1f4b38c43204accc63d3e127e220db216dd66b71c638e33bae369f61b72f97fa785a9b050eb35c94dd03aeab2f51c5d2979f0d3965a1b1b184b8fbeca75d2df1dca2c96ee75e4d75b63b5b52d5373323f0c33b4c77e82cdd884a3a3fcc122d3511b0dea2f30368bb46f3b992fd0ba2b78af64ca0a8b31b0d13691a2e2bcd05d2e330380adbd2f86f2c237c1a39d2f1f93792a46c5bbfc0f59c3f91e4cf14eba9bedf3f05cbfcc1afc72e9a0f555fe705a994925a58796", 0xe4}, {&(0x7f0000002a00)="94aff9dd662c9b965cacd0afc59f7ffdb4fab3d0d3c9312775231046ce86e9682fde50ebcc306427acd8409da0b24f259775b44b29e5c48c90ffe62931fe24366fe244437bca16623c1da969a663d15fe85521acbeb46da346f3dd5edb3e5a5b85b56cbddd969a4435d148cb11bbc9de2580e1a3a1efa32568ff0c504a36efe9d71b41f01bb3c9f6d5", 0x89}], 0x4, &(0x7f0000002b00)=[@hoplimit={{0x14, 0x29, 0x34, 0x80000001}}, @rthdrdstopts={{0x30, 0x29, 0x37, {0x0, 0x2, '\x00', [@jumbo={0xc2, 0x4, 0x8001}, @padn={0x1, 0x8, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0]}, @jumbo={0xc2, 0x4, 0xffff}]}}}], 0x48}}, {{&(0x7f0000002b80)={0xa, 0x4e22, 0xde34, @initdev={0xfe, 0x88, '\x00', 0x1, 0x0}, 0x28}, 0x1c, &(0x7f0000002c80)=[{&(0x7f0000002bc0)="896bfeb1c2fa4ba5c0453b19c8ba8d1137696b3223e2985df1464b5bb88410e7f8e6760327527ec68882d202dc9fed6c57690877a33abd70a91cce84181501216fd9a8eaacf91181a9e09a75493a7ce347fbdb97a266dcfe28d11bc407295f8f34a40966f40a7073db251491ab266526273c30c2b0c9ae4c45eb4fbf888946f8a983dd4d9d50903016398632bdae16bebbbfbae81f4dabbaf19145f1ff880e09173a4e7ffee9301ba215c294400eae", 0xaf}], 0x1}}, {{&(0x7f0000002cc0)={0xa, 0x4e23, 0x7, @mcast2, 0x2}, 0x1c, &(0x7f0000003dc0)=[{&(0x7f0000002d00)}, {&(0x7f0000002d40)="e6ec87ca34fab5aae8e785248a19aab50da6b72400ba034c3c2f28f3237ef7839d3a4e8371960ce42951278cc24144e1abf8ed49ddbc35ed3ef513f3ae3aec6a0c4c8ea6352b48b070307d1ca8f1cff60d014477759ee6eb611a2a", 0x5b}, {&(0x7f0000002dc0)="feb44633bb4a0184ed5682b5513df20d9c0b70a798d0186c41aec6ee217b525f27fbd2d17f9e0cac6a59b740089ba3d236edd8ac03da7406dd6721d90e819415e3531bae49cf91fc5750ca3c8dd898fd31a17b649681d579e855504407e374e46f8266ac24451a3afa6eff56d096373a2c717eea87ece62f0c30937a40dbfa74cf4f74da397b61fb573e87d0cdf13b5a0af55ad86d8c59e5ad3c7c6e68a222f9ad3217299eab07a4231dc1b946707e559c1b07a4a1f56e7aee9208c426df7f10ce1773ea3d5269368b4c174eeaf1d249fed9273f29f1a9da961935748816759a5d85d1c7abb73fb3338a70c7351648e78a041be58cd5ce9cf2e468cd7d58b4e0db68fa1b2498c3a57787e09b5a40ca321a4083211fa9a695c20ab4c1a7599820c4779c900b64316f4f1ba6a051cca9f2f7a2aa5b3c7e50cea7b6ff778543b56c8cc4fe10156e0d98e876c5121f59dc4d9af33b1495c0d2b94ed51652bf60db749d1f0dd3ce9ff879b4a5c6fa61d6678df970a4d685cd2fc6330bf0a8366a0b8075a955c6e563848995e92fbc4b5ca0019e2fdfa87f43e25606c7b163f6e182e6806f1b81149d4e0aaf5b89c159b861ab82f32bc0ac7cf8a4f4b34dd8f3cca23c03b2d9c2635bdd8ec8994cfa556bd07f99dc208a248bd26720bc67ba64ac861357ad61ef0c7f9fff2dd283b26011e1636e0a5a656b13bdb40b476d0fe6a25d414270f0a2b0c1cf8447dbcbeef208725e95e80fb2402452c7f1b4b6098f7ebfc2b5b87ad1a59140b37aec5bdb4e699bdc01706f8ad9e920675c8d10ba930007965d03ef390172a9987f17e67c942e3484629ac543878b0cf4834a91f0dce948db01e027f75e9644c010d18b6890b16d777f0dc6a6a3e70b3a287a94e775b4358f88cb41247492799a20ea4cf843d93c426d4d5558a1596962f0b6c23d3edf718355b9dd2878114039a6d0043f3b8edfb487fcd4b202ea17365fffa091a5ce9cd02de8a05006c6b6f213f40a1d6e2a07cfae829c61af4a8aeabe5b138dd550e09fcf0db75906868729a5a78c35ab9f069008b185ce7c66654c3ba940ec55820a8f958533f81072b7e0d1cd01b48065f8f95c4a1591971f3cbd16509ff1cd7218407609d24c05a95bde130903a0fa62c7be9bddf7a4c34e6bd6ccaf61e3f1c303f862d3371b41199c54f1cd5545d0dbe8919a78e97c0ed00f9c7de8e464d5480e10ed5db5e9db4a30847b64e5ec30a71b631c850246a1042c06cac49332c228d232ee1c9dd20ad5565b55ce1be5b41fa72c3132277ea2c56120501f62d23cf846c9066c5d6ac6aff252d8b6c9e1961a2c0c7791ce73e84aca8e0fbd23c39f16027cd395cfa251fb63ccdc25f902670c5b9641d2be251d358deafe039d408779ab7c78034882c434d31fd3ee185ee976517eceafb6369ce8dc8df1560b83162e8587002432996bcb7014a8c46b9aa4b62d8c82c146e0750917ac941ea5f48123a1fbac360d78ec75ad0456634af55d9ef1b21d9694f7d8d7107b9a7bc3674d80751f6bfccc0324624d99a94f62c1f5d2277102bc39a32efecda89b5fdd3be82e1d2a028a1b9a3ddd54567748d6d76c47a7a4f8fc0ff60e2e112238326d746aef69d11c9656a7d7e1b7a6f326a0e19c5d05d4a25ea677bc2b3cb3e96689aee6bbb50430216b28f04b5de037379cf600717da863cbb0e4f5d3a3769c6aa6a5cadff62eed9e882c092c0bda609a26b3750c8d828a9a3b72895d358c47700d6fb69d9ce46183f633b896d0add54afce01ac4bc18c9ce5ceadc2e96c4d6952b563e5bfaa738acd72e48dd21835df6954611f6e30d83d4d635848302cf134956106841875b7523114ca62bfc2ba09e3c141f88f34f7e4997bcc377606c606af020453d3ec1bfd4f09a7d5f00b62327b06f0654117dd1f0ca496989af8942e93bb7440061bcf735b54a16e6df9f759d135da0e0287a75171cb3b97a9a6ba7173aa44985881daecb48149f6a0c252c3cd267d632ad04ae133b1af643b88455540a91a5a05567a7d97ae891587f2d803eac5a8ace4d4f7d1a9d79f900e7dac91c9c713f0f816a0519b58b2f26581fda8156d74ce64312b3efe52a313533d69ff3cce8db473e7c9e286d4648e0b88b5b6256c18e5dc9ce16880198f81ab621cc371c38d9608dc28527382399ce806f7a9f76c2716b6771380620bf79126b304080b9355d1473b7a252772731e84fdff50d4bbd1dc4d7c92e34492e823416fa2f3ddec48eca046b53c7cb5bf09696345a79c9d99797bc0c70750b8d825aecf20c2eaac79e8cdb11a1048a3614da9d574eae84e06e728de47d3d162b532e9273bd1a91958142dcd5b082900929677ff1cef10d97423b37a5b442c220ebb0e5a7a1f0a320e84b5219007b175f7c44dc61d3b8150064cc125724e07da8e65e011b8c5e7a9488a8f950da98b4db574e565f239ff309b9e7b37a66150fc4ba4149915147f5c1c7b6b75fa90a97bd0be9dc26fd3fd46845e11be1db459f29718494a2f2e4113d7d4361faef82b1f2e456fbed59682e1daa5709f18d350c2ef73d441cd9214541a267995410c13329ec84edccca66342f42eb96fd51ddc501846774964f037c025ab9a8384c246701c452e1eb442b1ef9884ae2ce3aafb1a789875b6dc985cf0734913ef4b948a4536aa4dd49e9a275bbbe81995ee6783a0eb917a9b1a1a4bfec21f6ce02078f89bd564f593211fa2fb01d74925a1e473f538089d3e05bbf1253d480fcf67aa4dc4080ec6609ce5260aa74f9c9230acbc481e82cce1f4b0f705a00c689098dda2b938ec6fd76b8a0bc1a75b1226e67f74c6e55f1b9fd775d433c8e41046145af29af2ec66776cd24afccf475ba6673e4248e01c36d327b08d179089a49c3bb552d3082f0b215e09e3e9c0cca93de148cfcabf2cb31c40af5da6d2c2bc10e0a42c13b554f5c1f9d30f89127e57a4d44f6eb645f205b8dbf974e107680673525bf240de23df3cff8a6c40a5f2488bec14ebd5f1c7b73ae226164f85a160c68f673d34a760af6d60c404840729c0276fbd9081d66d6d41ecaa3d7d2cf31383cb15e9f6bf608f69fbeec61dcb0f8bffc3650bd0bf16d4a8970f0bebd7a22e0e522e9a32fea17bd2e592598aaea908d6d6c85315f9b6cdf73377819fe364f0b6b279401d95b86841ccdcfefdecc8dab0646a3057ec12039bb9149353d5c5186d3f1f80075d6d5e388ef84f48577c5e6b8a408d01560136d086670449818468ebbe18a43a1d3dd2540ea910836451bf26da438fd148f830b3f735a33c744051a6e77c96853f9492b5464fdfe9354dfa628241a067b7d9fe0ae6793f2bf48df442358dbb4f74d3b4758cd940094f19262437bc5e8959276dfe5b30ae4414ec11f77417240a1b61769cc17517e0e4f6307999e02a2ca87ba26d0f75282eaa80cf113382e03f4a254a29f85ffd219be662f8a19766024d36b9f46a33beebc9658300b219e52825dd2588eb58fe947075df11a95d3912db7468487b4282ccd3b298547b611d99b0379b6c816ac34d880d0aef1e362a3baf1053825c08dbc10d49a90b396cf615cce1b534ab6c0fa53b2efaca41a304c80ffaab53f4702d7c90674bc605c81495001c71d3c5ac61ab892e1699886a60b2ccda1fd70505aeb09fdce248048cfcb8cda8dfac4e02f75a87867748265c338be45b347a2b1a7398cd45941ecd84eca3542e415add2165fe6340245b8087d6ab5bbba6ec2619e0e092f3a551d98a8f66a86458bc084f1a6f00ce1a033043d1d336de7dc73c1f1bfaa3a117212dc603ef719e4dac301f0e4a9cf235a350923936314fde26236d40f489a269c55493e844262c63a98ec67464ee11e17f259dffe6efed1807af01987435d13c6e78d681e0737ad1d91c8fc699f6a3ea08020be2f4071d897816bee7f0409b90c5f5083cd9ac3e7a5f712216a6c089497c70453db52c918a4c43b747d757592d4ce8ebe603797bdd80e64e0acc25993e229e68ee0e4bde13a54b474c551089d4d912d878067b251bdcb3f3f39b797a8d56a244e4d8dad13498b0d166dd2f9fe3a657b66390e93283b3726a62db152bb12e6f5a8632a49b0ed7b1e16af782dc2be26424b1f3d93e0fb585369d5542421a8f95596bc85ed9284ff1bb7b9eaf5275017fd6c90177d983b4070c084148ae139962ce3dcbc96fa924157f3af2c881447b311bd1ae19f5c56aff7366801dafc69171b32d316b942abeda2d0a9940f009659659a80b486679d97cb6e28d7a765ad65e92f33a6c25d7e14e34ae612ac5b51d8af24b2d19514771c803d083d6a394426d5b0a7a005622d483201de00c5399fb86557d6392421a7595324bb84d366ad6aa120eb177d1b458c3690aee7ecdeda983ac029e45d73a95101e94c4522b68f30f3d042716cea777d58fb500d52275c6c3a85aa1ca8015eff4c08691fc1a6a35595c7e638b948678339fe6f33250f1b6f673ef965f166ec484239cf415a975b44cd4e77ecde90504bb33e73d22348a2f0c821229713e856652e905f31516aaab6db352ad6cac43aede7aa4d596dcccd11e4f6181fa0aca86457b7dae42fcecc4f307b73d69b0d1eb74e0540973b2f1a01c0119c5a5b440230df48c1b676b0339a9683cdee9b62db5f898a1963e819778ac528274c8a9c217f05c7f4b63507915bfb4388c7cf7776aef19085a364078f8d645af20a673ffa1aaf784fbf1fdd2cf99863c6d40ba59c9772da681998994d3bd3c02723c49aad0d88a03019268c5ffb5669019bbcf5f5143f80ed56fe2e16e0b3c16b055911e1899ec26859a1e9ee61bf16d774344cc59973ca7ddfb196743113f5fe7ef69256cb64e6c1c9c7073802fd4723b6462cbaa1bc078ad7dfa72988cc4db52a3e9b5b908becf60a7bf9b3c63f16aed0aa5c74647b9b6359308ccf251c1544bdfe06fb6194155b9f1480b2c2ba482162cf8e28c67b062f08a7edf40f9a4fb806b697667121235964b9e4296f977d978aede0441ee79833b6dec6c83107279a4a86d7a34c200e9ea34521afa46ea2e4be471ddd7872b4f37dca7cbaa3191624272326266de55991609fcd1faabf3870ab4c122d9deb590c5fbfb636919319184c3ca93d68069bb10f7e45fe376b0666ea8142af90586fb2dd7577640f20093b96af3312755147be57904255ec905b6270678759148a7dc32e9341a254b89650fc96dca518be2f4f50465f001652ff0c7c9a3b1e8d5c13ceada8a29f73c2262c812af07dbb8a094dad8e6fd71d590ebf2115b618b38cdcfa4831d865ee4cea3256d1095cc06ce4ba24ffd3e165ec034dfd05658a355f044981ae30ef1901b4ad12c8bbd66a004a48899f0232c25d123c979607e319b094f67dad5bd5f190ba14aa72434572af47ca8521887da36631fd650fc1c58bf66d670c701233949b87c1856aef82352f4d99224b96cbea1e8cecc03542de757325f1cd8fbacfdfbb5c93ccf04f420de5ac10830ff350cd146107b4af1708c7f31fff9a28f6d0c4609253f187a2c1b4584d25e7e407d36053a8d00b0e25e20306d7ea225f1fd0ba468365c9b062a2098cda3ce20bbf3a3ab87e6b5ba2337418f32748e7ea949ad3d67a23d1164749a72d8c2cf43a089df6ddc4c2e8761f04bd3c775f4bdba54f8bdec4141833f63fb776f5359c3220392504235e67a297a3d08beac36cba7405f55beb81448f5c31ef1b21cd1089e732ec61246af43f825d92728a222831c88bfe10123c7b32f1986f06a69f7276602114083e8bbe07e6a8c00e12a1fa11f1ae99", 0x1000}], 0x3, &(0x7f0000003e00)=[@dstopts={{0x80, 0x29, 0x37, {0x2c, 0xc, '\x00', [@calipso={0x7, 0x58, {0x3, 0x14, 0x3, 0xb, [0x3, 0x8, 0x400000000000000, 0xcb, 0xffffffffffffffff, 0x3af, 0x7f, 0x3, 0x6, 0xfffffffffffffffa]}}, @padn={0x1, 0x6, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0]}]}}}, @dontfrag={{0x14, 0x29, 0x3e, 0x8}}], 0x98}}, {{&(0x7f0000003ec0)={0xa, 0x4e21, 0x2489, @mcast2, 0xf}, 0x1c, &(0x7f0000005280)=[{&(0x7f0000003f00)="993afb994250ce53d1cba704e09b7ab4a536c72de8cb05da3c64a414c6d8a217e06aa26b9f18beff195a711c89955605facfef8e3191dfe641347ca08c0bca343923c8ded475f1bb5420f54348af61ffda3b09cbbb8a57f568671b7faee98d02e9ce76", 0x63}, {&(0x7f0000003f80)="f5138da695e4bd3ee79bbf37b19709e5e40dcf3451314aa5254b01efd04adb4e6efe3a955cc863a715a5c936a1cdf3569b9c06a9f461f63f825eead4bbac7c3cd7a28bcfb14ce9fdb64884e8f44342020378776e28ab3bb565948f", 0x5b}, {&(0x7f0000004000)="87aaba2170fd59c3f2a71d72709e8577c77b8a89f213bb4f51de5a963c9e3357ef6d36c527cabc8990994a82036f16862f89c878643805370faa06ec4f65c744bf5d86ed85831f021febe53a731d49eee90f642f5b857bbe0da78e9ab33f5fbefead2c982d2deb47d67a30ef3cc84ea93eff6b67cf246996fe8d9c2df01d2e0f5febd7624c0be5de429698a4701c2f87190f2d7026afc228b760a38948c2259d668f60d1183a7e63c956171a2fdd087e501f38b9d5761db5e97a7a5efb0b1356e694c4a822e8674871021b1a809d21f1830052915da137f36b3332ff6935f115d2e9b2861e4a395192e55ba32bfa5da3df699dfc0d7f0f34a97c70406bad1abdcf411216b5f2a01a43abbb0b3302c097289bb2f9ac2f04406cb3b62f136ab0762561343678ee7fc672ab7fada3b82b562ddd4af3aeb7dd4f3f8ed6a9d7447f562c95c4a00a0890a1eb0f43d376fa17806e26b9d9d4063054704a91fe9e61672112410413dce911ce22367c205df7fb38593c1371eac73c50620be47dba2c2cec532a77e237c4569e29c5eb33657a0dacd9efde8e91fee7c3ded0f932df6cb572d8e763fe3bcdb3a2c3321448c010ef0e696c699d36bd4e443b6b6df784d149a7960f1e52144792a64b3f80752deb9a44e7c67b06dd9e88f4533b37553e497bf56775bba7b252e57fa3cd330c3b7301ac9f2ade1bed3acae73a1fe74472a2ad86fed57d2ba2a264cc72911830781d4423a3b34fe24b0724ebc069f6bcfa044d9be59699ed8e09f768e781597f66b538a4cdc0fd3adf6d507505f50969815f64a892047fd5c25f04c74df5d65b92cc87c159300e3b0f33b3cb5650a3d31dad009e2a29482ad62dca23fc8dbc019d23d92e9c9dcbf726973963ad7cccb8bf914eeaa68f013a3ba650cceaac8de7ecd0b35b761ca3dc1a3dfc654830b23a992cbfcc0a60dc6311b10007aec30b6d4f285a9f823c17be84b78cc04a52ccc88720ceedbb950596cb210424bf6c5ba9c0d27a88a70176ee767ddd9034e76d70925cfbf930bf29c711c27dcb8aece0a7716ed1950494e5e257747a9ce046567bce6011683c00fbf7556b9d943e523a16227b20fea5378e53a1bf584d47edef143b8c732bb8685c71cbb35095eedc83775a1bf6d09b3827f68fc5fd629b1a81c2b558ca0b8d7f461c8518bee25a61993564de03441130008c55d294ad43bd364208ad8a56036b47c42db04ef776125cd7d5dd442839dd22f559db6e36d7b2bcd06c4e9afe8fd1d343e6a65dab0e2c297071ebe77bc8f182b0f218f68f5ac056652b6c27e0f13abcaee4abdee8758c032834b0ad2ef3c439b06a420671513fc2a9ceb64a6de0874ff3a79685aef7c6732ac08259272ace07ef5d0772662fa3ea15d6ecbfcdb31fe4aeb2cd1c07561f1bd2eba008d5e80e4dbbc6f9855b9b841ebf1326e0a97c689321b00b173ecef58f168bbe6e7ad4a59d31b4a3b0d8ffab4abee76b23b70dc389a39a3366a38dc7621dffd5d15bf2346e390f53a7a4d02531c2c0d6115d4657e0da497445a12fce26bc35b7056a356c9a34565000f90241a50bd7116501198e5ba22fb99e063e5cedaf5f4cd02d0a524e92cc529c0f606dcf57db227829bed3cab0fe514356b730312385a4f267be8d0bb3b1361b63a01895aad0d6937a8048c64510f6e04384311ce931b32e80100075cbe298773538196020d5344fd7573bee10de346602fe0d415fcda8e5e70aac7e768ae1f9322bc37f33bb0f6dffb62c094296aed45c13bd8bd6e5894835e956fbffebaf3365370859b4ffab6d1235c5725f6cc700341fa6f16de86ec662e6942618d83dcc62919bbd163759ac2a10da3b6853b8c86f455a550a9062f3cbb984b1002177c49a8afa37f579fbcf011a1bfc80fc8d1f3290b1cda330926b16f22c3a374ec31126e7864af51c461f416a3063f0a0f3e43e4b3c58c787f8100a39a8e1fc628707e6f42e70293bd378899666c319451ce78aece4e42a73d1f31462e6ca5976fbb4df7038f3e77b4faf7fe705a991cb6f1976c4394df989d31aa4aa80d51c17a4a42300bb732496bc0a31eb57c5a37b318fee4895f036fd195d88b5793048ec4c6a3db5bbddadae67a675b8deef641de88c085f5434f01ea38b35f039dcfb5b8c3d2f1d6922b6430c693a70a604e0aaca97a8f13a308e65add960d66f76dca173385173e150c02432dba7e93687ceae5eebc32804c57d999080d7f917ca996fc51ff8122f702bf6502fa6ea9e3264cd3d7f1abaa6cd229582d0b80f68d7c27982e8bab7ae70e1c9103be87e854dea426602e01b779dd5b48bc1f4e60862189350cce4e996fa4033aab01ecec34b7b30c82b95ad574c6ffe0d2e6abd059fd36dedc1b8af1da6a500852f3a6b42c013cdbc9ce4ae97f4299e80bae5ec823a00e2cb691bb86a45250beed53333052304d6b6abe37fee6ad37167ea14833ae991f51840f05b18edcc5976431c5c7f2a2f992fa2216ee7de6352a0cf6503c491a09a394b2d21f4ff05c7b21d0b7eb77fecf23bd0c2603953546a718d793ae572e7782100d0c1515b05c3b484319cc57f54100775375fb5411d68091ae65367ad12afa8911787a837818c07903703025a6047432132b59e0656b43f8519fde69d1d1400a3b722145acdcd0295057d81c7448a7ab60860a81c594f8f72217ca59e26270ec8937bd98ed42f61b6d2ce2270b5d15cbf123f3ea08ba3267569a280c36df3f463b68fe54cc66ace0e4986b9859b608c2051697dc0d7376c9b2166a67a0fd7dfe2846af88d1170bec124154f72daf3c709b5581131cc1e1bf90fdb1402868cde9c9f12ef17a5a6e9f0807a47532faedca22dd54042609e4c8aa50226d9a12b4d0f135a61ce59b30120b66bad555c10b3af10676fee89d8e157c88c53d49691975ed07ed45de91074a379d10088ee18080f4865b287581f203d3aabcd0e6ca17a452af23d62ef850f7fd2c442cccafb3cb1f06cbb985624173d8070dffeb5ed85733f9cd75549631d79f5c002c648e8aba994f253a2c07aa7636c75f45d68b7c3cb2aeab169408c2b365c5704734d8413d1f19840572765b038afea98bce07bf054d241af6a97dbd3cd6008d4e591ab720f1d5c5d08e2483b861eb15e7cff1d4946d700da5e8ae773551aa6b490bc76d9bffefc08ce429d32b2a82d7868062bc0abf34b53516477ce39c7d22790324fb8734af65e5f16b3d454ad851a1ac01c6f94524a7ce543e5cd87f6e8c33aa75dc831bdaa4f8b6cda6de60c38a5ad382879cf677aad94f978ae148acdb058aa4d3c7bdebfe8a7cf51fa8827b3ba917e0659f96b61537ee0ce623c99bad5fca79c449cb311d0a0b4905474829655e36703466ad2e56bc060084223bb38efccf1f0bd48d378ef2bbfbbf097b4db33e93f6ae87b6ae64d586674ffd8ff31f5496e6f2dfa2bdf2bced14aa61189c4041623f5152a5899d0c1e42ef5e73bb244f904249d23097048051ed661ecca46a6f2f9924e2a3131b72bd6e4dd41049f78a20679d451a7801c34ad1a5a94d1bf45dab8cb3f6d3ad88addfda3530481ca9d2d3962ead2eb32ebdff48bec38dc4896948327b26e032f4324cae4c11edb670bb67b4d3cc0fecf0b531db081eeed9c62d31186404c9cb53860fb2a9b92fc5cab80a1ff312f2878ac7ab21571bdf09fd036e489e9dc8dced68e4eb9417b036e06ea405ba986ceaba3b31c2d59083fc0937627f5ab58f615e02a53b6b10bdf2fecb1f41bb357d241d3f59941600aaf0e0d865d894f8ec6a8d6d93c335e6968b4642101487a31e11d6ea67886b13983cc3f61eae8b457ec68421b54e0c978d5cc90cf115fa70597143226e6fc6c76581bb1fae78997dcbfe0c591683c4f57adcc0deedba43be21c85d477a67d4749b6f8fde05aca45fe3b58e95cc0d951b6ecd533925ecb9d31057b2fb142aedc02ef19877ea92ab6bd149a9c83bac7594d40b12d273ff636d0ca6037256d056adfcf39e30ad4c49314c0d92d963b90059b95a12d1f4aeb453e48a4847afd2ddd44bf75c5b1ab61aa257a7bca11f1814f398f172f02859cfc33d2ec2eec41230def011d88c706aff0fbd14b91e799e9b54ff103fa3ad4ef27680245a04c04c19dbd4485dc25d96eeb1ad17fd5cd6d4756ead85f66b8d399042e4daf50a52a37bc861c2346e2285a41e692349b4f74dac34bf459c8e7fd2f846869bd09f7aca8554b0f2ab0f8d258c979ea02d5922f291f27af48e7a3eba5d26b54af0c854d59d30332e0b64d59c41fa6c969de3aeba556477bab416b5087c470de6727bba666eadb7af1ec568873f6f6cad53d13e0379517b534138ba3464dbf2e5ca0bb591cb42394e6a426b98d206802818c0d094b466e7f48dcea84a8163b94dd0ddbb19525d65bda7be5eb89597f16d281821d50325e0f5da3fe1396349657665bbf9cdeb92b8126abb32a380bff621511f8d00341e9560cd304144370eecadd9eaf971ad7a2ec54d70cc1143cc31e3aa69c77a0539a1aef067d240b9d13937df988e2df054689a8964b41bc7592fc233d9e5e6cb2bff4230d863dd1e1109136e8b87dcee3030b87d0f0dda8877b7d49e75cae5db3357afcdca41385af9cbabef86ed48f33ce35bcce442c3a3399142a8849b8acc23bb89602b796d3f601c3380f56c19ddfda13bb0c2c5405dfb1d920837b9c6fdfbfa80bc0feb52f798d0afdfc230f4cadee32662ffa143b220da0f4ee09f7a97362f0a2d57fcaf4703cedd7f8328b5195fc677d2936b4c9a751947e39cdb4034c12ac8e6cdab088ba5efb4684c330f953227896db4c29c9544931f3e91587f62bf9dcaf4deba96009d6609a3b7efd3be311223a17a8c8a85731c7f873d9409cb66c44197321f806528568a3b5a3c955e4120fdfa0b1dfcf30188f5e8eea093118955db8ab1be83df0487e2a107fc16b5bb4dd7deb13362dccb25c231d81a1321dd40706c2a4df04118ac11e96ec1d4b1bf8bb5622b613ffa0811b908b65b62a7a0c2e9c74a2dd3068814964cfb3807532df5efe792a12d8b988355e87843185e8d433dca3095bd96e496ee2172f24f1baefea580493567fa86490e0902b4c2f745c3619091a9fe7a776bcac793c62caada542a6ef2e43ea9b3aa6cb12e4d8e19910a8a8e97abd793a85b9bc39df349edec70498e4f44da77e8533385965fbc51109578b217f92768982a5d1ae43323b19bfe081d50779cac90c58eca845c944aa6359fe249b50dee4eb0ed5d3256f66731147c0fe5faa51866958ea25d2f4fcb3f36fb2deb3481465877eea1d2bc9c25d9abb096bd554f33c535e9023e1820254b2c0b0810057a61c978ffad3b59b79d50928de1383b91bc830c567ba0e8c71e635e7c1d446c2b01334ff15196d45bb7103b4c4e7b55f53c365a586022e20333426026c85b6fcf4e84bbf1e1605521489f45b04cc80b2e354eb92563ec58cd82735ecc7fd1819061b6322884f64bb80fea919055e3554d381bba145f532e82506653c455e850239eb5e72b621d481b8bcacccb4d43d809c2a13a53c37d54f135e87d3c4969a24c73589832f5c69b2a9b4436f868636bab484297694dba6eca59d0a62b5009ffcea07b6e3511f34975e4111e08334d865f730796947a28728bb7820a0b39aafe765b081afddae55cc481e2c8a4bfe077d9c5d967b6800a421f4bc3a4909f515365ec99ced990e211c651477ecd85849a8aed8e48f03d4135152e619229cff0c8a0ca131d37a0b84637183f6158873b415f3c8a2928e00239f5e50cfbc", 0x1000}, {&(0x7f0000005000)="f24f9b4190b506c49a7be711a4ee80bbe4c8a6446fdd9fb83770e991fb1ea9ac85c46d160a29425c11a7d0e28c0e7e1017b98737f4aeee058f358c2c468da73b66bd54ca1f71f976a71a046564b56f715dbcc221bcfa3b525a6a8cef896fbe3017eee599f5bd6b5bc70a0249dfd758ed1acd2bc569135ba9992606ea5d79a0251d612b41d6f0d03e719a4ae0b151e3448a9725ad82f635f716306fe9bac9fdf251a07ce935a327d62606827cb985a8e85666ebe3ba0942a91bdd5176b7abcb917e061e03682aab33e03bb49cbb1f10", 0xcf}, {&(0x7f0000005100)}, {&(0x7f0000005140)="96ded865c6c86d761074a9288d9ae6b962284379c5642eda21fbaa5e1075f91bf84d00801765f3a9f33cbbc87b7a478db0bac9e6fcf80cd9283635c32fa3f9d1b39788c7ef2ea8c226eed762005f363f42923b320c7a116f0fa162c74ef4337ec437cfcdf8ddb7a4605440c12aee874c0e1c33c1013941f12e42078e2923fa51229f19a9dc4107d1ea", 0x89}, {&(0x7f0000005200)="46088240d3ff8e67e35ee8f455f070146cd978ef3482f734ef3fef10ddef71f335304e4eb878172997d01ff0bbaff4f89e1dcc86cc23b96377ff872510d7e67e76f59764a3cab7afd2dc3b9d8e077d8f7cb322256c7977ea858d5541501fcdaf8bef6e1316", 0x65}], 0x7, &(0x7f0000005300)=[@hopopts={{0x38, 0x29, 0x36, {0x33, 0x3, '\x00', [@calipso={0x7, 0x18, {0x3, 0x4, 0x5f, 0x5, [0x5, 0xfffffffffffffe00]}}]}}}, @hoplimit={{0x14, 0x29, 0x34, 0x1}}], 0x50}}], 0x6, 0x20000000)
ioctl$RTC_PIE_OFF(r6, 0x7006)
getsockopt$inet_sctp_SCTP_DEFAULT_PRINFO(r2, 0x84, 0x72, &(0x7f0000005680)={<r7=>0x0, 0xf, 0x30}, &(0x7f00000056c0)=0xc)
getsockopt$inet_sctp6_SCTP_GET_ASSOC_ID_LIST(r0, 0x84, 0x1d, &(0x7f0000005700)={0x2, [0x0, 0x0]}, &(0x7f0000005740)=0xc) (async)
getsockopt$inet_sctp6_SCTP_GET_ASSOC_ID_LIST(r0, 0x84, 0x1d, &(0x7f0000005700)={0x2, [<r8=>0x0, <r9=>0x0]}, &(0x7f0000005740)=0xc)
getsockopt$inet_sctp6_SCTP_PR_SUPPORTED(r1, 0x84, 0x71, &(0x7f0000005780)={<r10=>0x0, 0x9}, &(0x7f00000057c0)=0x8)
sendmsg$inet_sctp(r1, &(0x7f0000005900)={&(0x7f0000005500)=@in6={0xa, 0x4e24, 0x9, @ipv4={'\x00', '\xff\xff', @empty}, 0x9b5}, 0x1c, &(0x7f0000005640)=[{&(0x7f0000005540)}, {&(0x7f0000005580)="1b801b6f97853ae4ee3a1356e48d19269dae6f1c2b6e697fc8ae89489b4051eef23f17156a3389cd80154d31bb9112d0f5a1d2fd35562a6bb4af57e7399591eee6f551a650340c8b775fdf8c36fe50755a069d0175358282e4a23291949f04d2cbfd8eed062b", 0x66}, {&(0x7f0000005600)="fc3cbe084db6c416ac98f716b24d693c3e8042cad467dc643c958135a24198b2919ff62421", 0x25}], 0x3, &(0x7f0000005800)=[@init={0x18, 0x84, 0x0, {0x3, 0x1, 0x1, 0x2d1}}, @sndinfo={0x20, 0x84, 0x2, {0x4, 0x8000, 0x4, 0x4, r7}}, @sndinfo={0x20, 0x84, 0x2, {0xd, 0x200, 0x401, 0x4c, r8}}, @dstaddrv6={0x20, 0x84, 0x8, @rand_addr=' \x01\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x02'}, @sndrcv={0x30, 0x84, 0x1, {0x0, 0x5, 0x8000, 0x0, 0x5ce3, 0x6, 0xffff0000, 0x0, r10}}, @authinfo={0x18, 0x84, 0x6, {0x9}}, @dstaddrv6={0x20, 0x84, 0x8, @private2={0xfc, 0x2, '\x00', 0x1}}], 0xe0, 0xfc5d285255b1fdb7}, 0x40000) (async)
sendmsg$inet_sctp(r1, &(0x7f0000005900)={&(0x7f0000005500)=@in6={0xa, 0x4e24, 0x9, @ipv4={'\x00', '\xff\xff', @empty}, 0x9b5}, 0x1c, &(0x7f0000005640)=[{&(0x7f0000005540)}, {&(0x7f0000005580)="1b801b6f97853ae4ee3a1356e48d19269dae6f1c2b6e697fc8ae89489b4051eef23f17156a3389cd80154d31bb9112d0f5a1d2fd35562a6bb4af57e7399591eee6f551a650340c8b775fdf8c36fe50755a069d0175358282e4a23291949f04d2cbfd8eed062b", 0x66}, {&(0x7f0000005600)="fc3cbe084db6c416ac98f716b24d693c3e8042cad467dc643c958135a24198b2919ff62421", 0x25}], 0x3, &(0x7f0000005800)=[@init={0x18, 0x84, 0x0, {0x3, 0x1, 0x1, 0x2d1}}, @sndinfo={0x20, 0x84, 0x2, {0x4, 0x8000, 0x4, 0x4, r7}}, @sndinfo={0x20, 0x84, 0x2, {0xd, 0x200, 0x401, 0x4c, r8}}, @dstaddrv6={0x20, 0x84, 0x8, @rand_addr=' \x01\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x02'}, @sndrcv={0x30, 0x84, 0x1, {0x0, 0x5, 0x8000, 0x0, 0x5ce3, 0x6, 0xffff0000, 0x0, r10}}, @authinfo={0x18, 0x84, 0x6, {0x9}}, @dstaddrv6={0x20, 0x84, 0x8, @private2={0xfc, 0x2, '\x00', 0x1}}], 0xe0, 0xfc5d285255b1fdb7}, 0x40000)
syz_usb_connect$hid(0x3, 0x36, &(0x7f0000005940)={{0x12, 0x1, 0x201, 0x0, 0x0, 0x0, 0x8, 0x56a, 0x32c, 0x40, 0x1, 0x2, 0x3, 0x1, [{{0x9, 0x2, 0x24, 0x1, 0x1, 0x2, 0x80, 0x8, "", [{{0x9, 0x4, 0x0, 0x3, 0x2, 0x3, 0x1, 0x0, 0xec, {0x9, 0x21, 0xfff7, 0x5, 0x1, {0x22, 0x710}}, {{{0x9, 0x5, 0x81, 0x3, 0x20, 0x58, 0x5, 0x3}}}}}]}}]}}, &(0x7f0000005ac0)={0xa, &(0x7f0000005980)={0xa, 0x6, 0x201, 0x4, 0x7, 0x8, 0xff, 0x1}, 0x58, &(0x7f00000059c0)={0x5, 0xf, 0x58, 0x3, [@generic={0x42, 0x10, 0xb, "0cc0bef2f399b35e8991ae21339705234b21fdf2e7efe253603a8715cf66f02a2450f93bb456c18ff629758f8d2988cf0939650f15d369f7958340e2352b03"}, @ext_cap={0x7, 0x10, 0x2, 0x8, 0x8, 0xe, 0x2}, @ss_cap={0xa, 0x10, 0x3, 0x0, 0x4, 0x9f, 0x58, 0x7f}]}, 0x1, [{0x6c, &(0x7f0000005a40)=@string={0x6c, 0x3, "92d97c99884224f6b0ab8af71146172e7d95fc6500f5f835f4082222b711c82cae7dda2a53bd1102550d2990386ef72801028cd96d392236addcf125dcd003d4a068012542320143a907417c4a1674f64d9697e6198a76bec0584ca898d332808c74e98d8ae19ad6a2cd"}}]})
getsockopt$inet_sctp6_SCTP_PR_SUPPORTED(r0, 0x84, 0x71, &(0x7f0000005b00)={r9, 0x5}, &(0x7f0000005b40)=0x8) (async)
getsockopt$inet_sctp6_SCTP_PR_SUPPORTED(r0, 0x84, 0x71, &(0x7f0000005b00)={r9, 0x5}, &(0x7f0000005b40)=0x8)
openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000005b80)='./cgroup/syz0\x00', 0x200002, 0x0) (async)
openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000005b80)='./cgroup/syz0\x00', 0x200002, 0x0)
getsockopt$SO_BINDTODEVICE(r6, 0x1, 0x19, &(0x7f0000005bc0), 0x10)
sendmmsg$inet6(r2, &(0x7f0000008f80)=[{{&(0x7f0000005c00)={0xa, 0x4e20, 0x4, @local, 0xb97e}, 0x1c, &(0x7f0000005e80)=[{&(0x7f0000005c40)="1c3852d8790c6e7ff22f8d795cf6a22c72c6dbaabcc347f9e22f5ab67ab197fc86b228d6787585d36b0aaf91149fcf65d3d4e036e07f9b1f6bd5bb6d00105195deb45e14ba29e7f5135677601fa2b00958cbe81d7c8c8cb0839a708f0389f0d4e9f23ef1f540f2b747094929fe49c937d3dc14d3d00ca5116244", 0x7a}, {&(0x7f0000005cc0)="d52c0b0ed16a39cd83a5bd78b92b3ce85350b096243d4c500c5a981e4515e2b94119f1c1a15ae4021b0dbd44e68f1b71f3698330d239c5313b01b02ba42857b5251b90d3b382806e9110e5439e20565d52be0fa3a4e8fc0d5114999ed3833ff81a7c2d8bca3c4b27ed5867965e32e32e2b712c92399d28ed851076a0074f93510876c5990eec74", 0x87}, {&(0x7f0000005d80)="b0e11d290cdf690f8f807fd95f9fb225cb912bac1df8d9e6afed31b8cf446f21d18b90508d4d7fd4e21e84a510c55ac8e60df3207ef805caf3b5cd10948da10e9248e164489788df5ace43c373e724207c795439ad8c239a558a415293f2377c59e4fcf6b42951ba7b8b072f39bf7fcfd1711385c4d8427f4db4b3ede97ca876bc22b6cba6c0ba181f6e98c3e07c7eff15b906fbe83e2151ebc89e8a114ee2e6d631a6883ad86aeda4e8d3e8711380b1092244db875065fb8ba6e8e401f1e0b8dcda7e6239590a3345200b227aa970949dbfb0d8438d0b2eaf347f75ebd0aeba15bee1068583a221bea9d6e0b0427583ef4e", 0xf2}], 0x3, &(0x7f0000005ec0)=[@rthdrdstopts={{0x18, 0x29, 0x37, {0x11}}}, @hopopts_2292={{0x150, 0x29, 0x36, {0x2b, 0x26, '\x00', [@generic={0x6}, @pad1, @generic={0x2, 0x49, "0cffc66da27bf6a38888bfa5bd633fc72895e89ade421772ecf5018277c3523fbb6464193171e722779e5bccaeba351871c77c3730bf5cf95da166d23d12fdb41b1fbc03fb92201c3c"}, @generic={0x0, 0xce, "96a32e4f0c1b66ec0e563a305e883eb37166c14e402eb4dea7ae45523bdb21a59a64a7a8532195eacd6917c7e292de24cbb6124ff7d3cdac7d096373136c31671a8bef2ba9b7b0bb079eda936a71a2368bc3c83fd79627c4deb20537f8136b6ddad11a9dcf68babbb40d96f11b21add1e90e861641168a45effe4f2d0d57ebedc097ddbbc5d472ccc6f82b46d85bd4c3c0c69d93e36003bae3cc4f32c8d5ddcb5a9b0a72b4900ef03d0aaa2a259e2c829d0e8583a9016812efdfd43789e5d681a75ebdd5104763f3b0da9c584391"}, @hao={0xc9, 0x10, @remote}]}}}, @tclass={{0x14, 0x29, 0x43, 0x1}}], 0x180}}, {{&(0x7f0000006040)={0xa, 0x4e21, 0x8, @mcast1, 0xf}, 0x1c, &(0x7f0000007480)=[{&(0x7f0000006080)="3e42d03fabd0413f9316b35a3c0a93842e4b847b6c80bbefa520343e5824c66f8ade3c3ed435307e770bbbefd9cc01f13aa46cc4d3c4a402772b5f2ffba09e9f2e9b5e203229776f78a910c4f626bb54956d1e3a974194a229e0ec67a6dff33d2645b5eb0944ae3e1b337867685760dd7e43cadec560845d82d6", 0x7a}, {&(0x7f0000006100)="30461d5167518255a4385d845314d2ec5392a427a585d9da6ac16dfd64e71352d42ce1e8c884635e831aa9de01787fe30e9b2ab4417cb74875ce637e59550cb1651cbf9796189d750fe11ec38605a40166dba841caa3b523e2bb5f7372f63abd190eb28d6c0a90bd4fc45f94b21724986c026264d1bffc8930a50f5d3cb8c9bd9ed75b6a9565d776deb989f7a8d6989df2325d508c2762c0f8949385d9cbdea3490959f1d1c67b1ef4097b946384740681baaf0a682154b0c12a3200eecf0e2e9530650a6c1654e64b63ffcf25e594476d681ad75f5aba1a8fcbdd41b5bb0d791245775891003e56d4c1ea453d8df3353c82228d33611bd7189ae96f79bcb71ad9bd212cbe727fbd6d0fcaafbeb2cbb23394edc5a489e66c230d4f2567e5f2f6b709a5f31e795286577325e111d1187b6d5f1b0c927f351f6522f43d49731ab56fd263698bd7a37c2727d49b766cc17a8b36365d66fed3592a1d780fdfa7b276eb7562be83e12efa13e00a8c80cae1277db0ec6d53407d5c8347efa66d0debe758329ff54731c3b76cfcf44226129594173ae1ce1e2673c7b4e964b31d47021a3b01b8e1fa8d9074afd869ca0fbea2604ba7c72f02182a6fcfcea6d3d8f46bf2c7c3ccc53011a0b64a9b779b19c4c4439c7c07f5b7d62564f64911d13cdaef5db1e7a75da79e058a5bce5ef4f40ff8180c9674c2dc0c6dbf12c3670a7a7be618fcac0d00ca713551079712f42b6996831bcaf8c699834544616f86f60fedae6b50d2c28823c4bb10e49285f8352bdc19b20b9f12125910941bfa9d05cd7877f76fab8560c27d8979cea43d28b5b0db72164d50a7346a9d040084aaaa458305f1c0a8879eaee954789187a2cb24b19305098f9d07435dbc98bc80de6f73941cb5535e99b4f2b79e00762c26f11eecf1f98383e7e072fe7a3985d07a4e9732c3fab1d7d178e6bc9b83a9d2adebb9c14869f6e3438385b0b173300e4cdcc1497cbc6ffd35333a92d57a332e6358ebfd8cd7f429279d852d9ad05c59f9b453e382631af8e69c5a8e4d041e8040baa7d578e18f0f3833850a5ffe1fef5438c0d3b3412266884589582a61c88d58ca8fee8267d2abb675221e21f67b3a9701c339982bb480d564dced6a91a7603eacdca4351bd36ba922e3dedf4adbc2d43bb443a4ee5e2a64301250b0e4560540da93c1aeb37a9138b8c1dd54a114b713b7e46dcab52f37790f19b3280a14cb34685d11353886ae6e2c2895567885e0ac09b016a84b0fae83bb8096e3140ce162ef408c108a156f6b2b3427d604236a6a706439a261cbe7ec73b8167ba161596cf1ba58ad4e31e8353876ba15c5a122e28c926b3834df58a2c665b3abc4543b9acca6a270f96d5b6b8974b7ee59c123d4d066d6e5e50a941f6fcf49e406cd519c1fc6e9789a9efcc605c3cd5602ed82335e02aaf0b3e348f033c1157e0ed688ba63f76234fee9e9958a5eb4c7fa306e6130bffae1492a9f71e786c2d56c92f3d5b1c5887c34a7bb768c3b025261dab9327b86cb01e6037ac851c0e8683b193ab6c94aad5bb185d3ed413d8010c2a8bd0fba5679d9aa5f87920329f72f5c3826ac3e207af1e67f28fe12935ff7897a9bc143550c7c860b493692f1e3a63b0b0bd9e2348c2f5b57aec19514912bff0eaae72f68b8837f369acf2da8bea0a5a86093202040abb8ae1c8e21de561b7c250b04b174c04a6ef7b986e322cb32a64d43ed063e267141c37c60e523214b674532ab0e61c358c45806105d4013b86586e814f3bc58cf6868f175916e49826ad7479f33528ae429717074adc25e51ffd59b6dec204a13e79626cb75e37288af1c22657bac731ea3fb1f1dd01d342efb2893c74c2e4bd2d673523cf714209231c68ba8299547ec972c8e58d01b880670e11b73d951ffad91f63bae4d5b20e6882a6d73769dfdee7d170d19779968e1d85000889fa9d9e0ac5616fcb4214beeaa96d0277078b8a6a566558cda00fdf19eeab9479de88a2750f1b56b1970d02e82fddf468d25d97b8e85bbdfd4e6c47681044e857af1166bfe116e53910bfd60b45cbc18778debf5dbf0272ba8d406612f475a7362c2aaf8d01c66e5af797943b887f94c9e1de67280ef4637e17c07355849a722eb9b714e6d33c43144841718dbd0f058792c5fb99b4f55652da8e9ebe3c443395a8cffd91511a6a8eb67d724f222b7270058587ef34038ec30288e36ddeab7ef0b1e1d6d8bfe67a892870b8df01efd642d231330dc6a92c10c40f9275f8262aa6e130de18a93f2941b9e718af4f31479758441b290d9e66f6f63da2ebd11e5d16bd9d1fcd767ad98772b61621247b23147998a220b4bc8fd8377f7b8809e6c82edf9f4ed4d61dce1c7dd535ecb571c34ce68ea712bcbb9062c02d90b48bdb4a9913a818b006173fc1d54f6871e3f1309dbf4cac0cb85a4727d883a5999db09fb38f27ed27503ee3abe08cc90dbca089ec96e3f30031953f8d69220b44ec360db812b4d41c92fb0dc4c72a706430230d78aa31ef1840803f1da0325bcc13b631078b9d81767b7de764483c36511efc8f4ad1ad76dd0cf988acbb6997e71350fbe6627c999426fa01e105174f57c0f96c651cf77e1c5920ec4e8a53f7113d832f02186f27c99cedf242f56c363fea72296fcf8f73653fa089f567aef715f8f610199c0982849b6a55c52e1eb894be076617ddff874f7f6847eb5ac5a5c8ba60eff5f936b60955d87bf12a40a287e0b46951734e58c19dcbaadfc50e3c43fe6cbf685cd157c67677a07624ce96135b5312b468e29ffa30d7bea968536cfd81fc7b3b2b4d57617e2825993c976e5ef6a037973f1982438ca90c93bbbf96b7a9411a68654969022b8846d68a6c1a2b12e0aee015ba6dbc7850f85c210e8290a9187abc8a00f1d02f35b94fdd763da197d53da9e64aeb3088fe2874b4ae4f2ac6b622bb75813a78936b4470445fa52066b82aedc4c994a8989a7819b1786cd3e24318161c31de41489c3534900bd1b410430ac1c803f8ecbee330dcc1941a62742e07c22fcd10d48faa3f3062e9ee29317b7625af13f8b6982a3d585e018c97402cf81809a4c83735f9f1605c1394a7a880b3c2272c448cb281f94ff0bcc6aabe0b6b4a925166f200b71d64c6edad7b7545f417ac780a6554ed6e96a3c7aa7721b869c04178b016651a6f315f7e748168a500f4c3dd7e0c1dfe005d08a81f7835becf07268dee68515ac57a68e1ac4c296c9e00e70c5c15cdbbfb16f41b1096066d79b2982e6a63d3a812cd9b99806691e9b63a09361dba2a665d91d3830fcb623788ccd1c3623b7f6caa18f17dac0bdb5092c99f78917c1dd2e8bda24f94916664703d9298e637a3a65f3f3431ecacf6ffbbb2580b4a1ec187b9e566fbd7e57a414a965f597a745aa647791907e5295f0368e96f96aa2dce1856faaa0ac1017a3d61d8a248b81fa0aa1b327f9d695d80bc82150f77c1215812388bc45324d22ad782cc215ee5d16ab4c4feac26ecb11cd77b2ada05b696a28abc7503cdf3a661956f90112f0c95dfbaa28cb56c6c587e87c047cfc8c82f8ebcf5b9f6f5472ef2489b0a2b89e6d3e499ef2aadab3ff02c9f1042458f4f8c33fc3a8a789525aab8e8d4fad24ec2d28d6e321fd59a2e7bf91911d2a528189b4b82418b10f88702531d14d18750a78bd25fff9a2941e2066b99ceb7e66406fee47c0055d89825555cf5b90802f88abd0464a97319bc7ab772055485f800555e889bf2804dc6d295c571bc45c359db69448ac7975ba49d7fcab7fb20e14a99f362831afc275832bbef81beee6a9a1f3d9912989b4a4f2b27b9a51b369236e140ba18b3ccbaec715b90a8c2ae46ddb919cd9d56d887a607351535995ac01a3ba4b4ab819682b69960df24999af7fada4630d1cb2f5ef1e72521d7cb1eb419d594c01d02f09e41f3bc8576afc9fc980ffe29701d51dd9bacefafa61ac23660069955ede9efe76445fe0b87e9a293ac8140434150f1782610aae0bcf07162dcb427bfec04d5e77001402452d9535b554e8da5bab3a1098589ffa76401e8aef56cc579e2bd083238ba17b53a90f535d4cc6859a9f6694774d45ec1eaf6a0046f0e4878ff7b9d8e3a527114ebc7ecb452642906ab598e19ce2d647f7babb57bd10405df922cab2a6b6fffa74374ccf4438609601cac1c79d3640e0c724b4e670c063d1081c03aeaded0819c29e2bdcf887e84e70947f7fea789685b4c6b2aa980fc8a918772cdc46f9b71766fcbf8a44a8e965b0c149aae77eff864480e09319228a86e97cc652a2ff3616293b06d576c39763edb4f829e079f8469178baf31bdb9581061fbe1a4f26dc7c732623c112c41714e2adc8616d41562c576b2c3b85a4323daffb664bf6bdc7230504d11907f7283d25278ba3253d87fd7f4aaa91c1384cd3aab64baa640b48c38427e2d7285c9416f690d5ab37238e6b6d57cd6848550f05484347f0e7d2f8d3796e5d8fed7319bb6ab1f4127bcb64b8a26ce7d14dcfdbfab48266a76a0c08071945d2306135ce655df2c45ed0c61cb89660b6b210b426a85606274a49f28b103c58a5e46e1b90a91b9f4e9f755965296f0bfdabe14d6f720d99985bed13d5eda07922e8474ea3115591ede6261df56296190bd333e4df12965f84bf2d123cf8a2326789340dfb1caf72306a45557bd067dca42a448bce39ef2a80a6f0f63202d3bb5c28cfad786f5673a8387bc27830d508d32465cc0f61ccfc15f4cb034e4876f11aace82907405961f1556a6910e5a0b6f012b66143290e54316fc36105de677be97312c11ae3d57fd3246433064324304a49d892f2f2f4948f4bf0960446ea088108305d59441b585aca52f18104a380858b5a30ee187bb8106c128fceaae638a29d2536aa36a6ef93ff0009077f4737cfc2862e8d6c902d76e8ea72426f61a6b313ffd639c147bd9b9f988edfa9bfa758ebd552a320a1d57732449d6bb4e5eed742d124ddda27a67b343ec35bcda75bd0e0f988ac9c332044939c26176a9ae3e94f0b947ae0dc572621f56ef3041d5719d74a97de0339b321de584e6f3e6e92b99cb12dd93fcd6faa6b1f867be7c98666f537985690e78350ee3132dadf2d949317cd4e31c02316a6fd72ca8a92c9568434ce73aff1bd1fb49455a07f3920a68c66d64ec431de077e11e9bba89657216f054ea84221039499234a41af796948f25c0defa6d5a0bcf6fc8d46c35bb2164306ac639a084081a450871a15860874998c82836e1440065b36a99a8d4df490ca64d5720954edf199f70b48cd8ba62a0ff81f1b4483fd65d8ad0b78ddafc72f0efc680edc82048fae8271906258181c36465eee0e0dd195e7f2fda9550e20cdbf2412ad1e925c8e4ee54147ca74127a8b3216c8ed098ff87e1459b9dfaeca5095f903323cd1e704a17014807e305cc23b87f3da41f9a288529738bd77de496b3e9aea219fe7d866cb977ef5741b61ec6fad44daa9ac22d469770c279571f83868c7fbac61c820a7d5d30fafc22cc530dfb941ca8f5f64ee8af9ead071e716c5d0d0f1a487b45b5fad6e081cbe7c52b44a3fb2c7179994abcc15e6c37185823c6d57291d5073d1b6b0c1ffdc8f394dcdc22c30b4a4f36a31d70eba97ffb53df88750edc6ad7c6971761e98af78f4c9de04dc25f055dfd3c115fd2b118bf2bcf174e78a110e38188cb1c9440fbec8b848373f59c153f8db5e590073f29405d99da791764d0789c5e202fa82cc533c46c26ae55abce3c581ef8e4eef48c612ace23c1260a3357d", 0x1000}, {&(0x7f0000007100)="68879b2941557e6394d03df3848e82a339fff42a3dd7b5ad10da96fae2ce1aba9734a3715dcc20ae0fbfc8fbc68d539b0a5ad9c21c7732cc6836f077ddcc6667069e23912f54e287745b758d3d2047c9ca4103b4e084df0829501fcdc81285cde348590edf7acf6282fdcbe3552405cacdf583048703b8a982d70857fe1de59afe47c0a29e1a16543aa65bdd748977b3238b8a6f588fd101919fe0a561131ec62caf3ad1205bc95f5d9eb2f88c83e7835fda4045cf1638e45384681158736de4603edb8bf53aae4d81d631e6aef40e893f10076b71defb4fe3a3f3ca937a7faf", 0xe0}, {&(0x7f0000007200)="799d7973292a14e462478f2118ab94101948cd102640586410d1b61be79997bdd36d3dbbda5b2ea52732e30fb3ece1644bf071647acba3acc0f7143d0415ca614d425a0dfb0cffe8a3cc78b60db8418ab1922a8c45c0bddd5b5755dc39dc51254dd4960364e23123f906d54b7ac1bf7ed25b80eadc8ba698477442c1b7de4abf3311a2bf66fb049219", 0x89}, {&(0x7f00000072c0)="1c05a1bf37584bb86a4da39db3bcbbef9c49c2699f65737266ed5d80b579d3865da625dd329bd683dd4fe70724fd1b5e4bc2d24eb735896f8b435b2f3f094f9e18b0fd2021e7e62c9a5102266653eb31558b7b98bc98836178961a9b02a6044082ca24af61", 0x65}, {&(0x7f0000007340)="05779f27a4b864a5cf891b9f41b83fa0287f9847e734c5518e69791a3eb69601c317f1c161ccb90540b05a0d04e226d1ec4c31ad43e492cc1812ab22b08f5eb1a2656d3cdd3fbf95d8f8fb9f2c0338a9a3d48df6a49b566d3d78085f6726df029f725a067169ae7ab1908494c7f8559572a07ca1a3dd47e32a29241738f9b6d315c58666a1300cb6b4015ce8c027dae37facc99a1dd5f7e5fbb6d275fd0bc650cf4192ff74e88b", 0xa7}, {&(0x7f0000007400)="a9131d0478f9c829169e64411057f9f7228585169740db9cded45e81df3b8dfbcab70c867e5ef739c574454444e5298dc6862e3b149299dc6229f7528e1c81600a0b009cb749ae971de67b8a59b6ff4a0f", 0x51}], 0x7, &(0x7f0000007500)=[@rthdr={{0x88, 0x29, 0x39, {0x1d, 0xe, 0x2, 0xd, 0x0, [@initdev={0xfe, 0x88, '\x00', 0x1, 0x0}, @initdev={0xfe, 0x88, '\x00', 0x0, 0x0}, @mcast1, @rand_addr=' \x01\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x01', @rand_addr=' \x01\x00', @empty, @private1={0xfc, 0x1, '\x00', 0x1}]}}}, @hoplimit_2292={{0x14, 0x29, 0x8, 0xf}}, @dontfrag={{0x14, 0x29, 0x3e, 0x3}}, @hoplimit_2292={{0x14, 0x29, 0x8, 0x1de0000}}, @hopopts_2292={{0xb8, 0x29, 0x36, {0x0, 0x13, '\x00', [@enc_lim={0x4, 0x1, 0x7a}, @padn={0x1, 0x3, [0x0, 0x0, 0x0]}, @generic={0x7, 0x87, "8c47c8578a1e1b054f580181fde199092db357bd4e018bc72646a09edc94087cd5ca048d725af82f7dc1e6f88575b4912f446bad99843fbfa29566a8d9318b55af235989923113fcfbc6181fb75819c25dcf2a36cbed9e99c33edc5ba54890beb9850771f6b91d4a334a1d70591c19fc230cbfd7db33cc5afc4d7a9d138d715aea9ed20ce98706"}, @jumbo, @enc_lim={0x4, 0x1, 0x1}]}}}, @rthdr={{0x38, 0x29, 0x39, {0x2b, 0x4, 0x0, 0x35, 0x0, [@ipv4={'\x00', '\xff\xff', @initdev={0xac, 0x1e, 0x0, 0x0}}, @rand_addr=' \x01\x00']}}}, @hoplimit={{0x14}}, @dstopts_2292={{0xa8, 0x29, 0x4, {0x29, 0x11, '\x00', [@hao={0xc9, 0x10, @loopback}, @ra={0x5, 0x2, 0x4}, @ra={0x5, 0x2, 0x7}, @generic={0x9, 0x46, "f8996b3c7b5ec53221c71a476089303d391709c8e0b3ae38617b93a13e0db7e90af7d34151064f454a924323d3a03a0c4f781dd1f188401f50ac2807248eaf8c4f70aa6fc872"}, @generic={0x6, 0x1f, "75b8890706cc778153a5810366f5c8077748710426104229e49788e32757f6"}, @jumbo={0xc2, 0x4, 0x3ff}, @enc_lim={0x4, 0x1, 0xdb}]}}}, @dontfrag={{0x14, 0x29, 0x3e, 0x9}}], 0x298}}, {{&(0x7f00000077c0)={0xa, 0x4e20, 0x7, @dev={0xfe, 0x80, '\x00', 0x1b}, 0x8}, 0x1c, &(0x7f0000007840)=[{&(0x7f0000007800)="9d47735862556a10ef2fc2a9726007e7e9805b59353ac4ed71f006b339efe2e06d01b397e94a045e22cabc209de3642553b4fdcb363d45dc441d4bacf0", 0x3d}], 0x1, &(0x7f0000007880)=[@hopopts_2292={{0x30, 0x29, 0x36, {0x5e, 0x2, '\x00', [@jumbo={0xc2, 0x4, 0x76a0b8a}, @pad1, @jumbo={0xc2, 0x4, 0x9}, @jumbo={0xc2, 0x4, 0x9}]}}}, @rthdrdstopts={{0x198, 0x29, 0x37, {0x11, 0x2f, '\x00', [@generic={0x8, 0xf2, "e6b6eff1d5151bcb46875e61e96a75b2644605bb97ef1654d75fd36e898f5fe340b0a8d775a8369ecd1854cb69d075eff6503c693c674078e57c8011aa91def0676237abdfdaefe81213aedab98940c0eb08c39e3d446be6692131bf9d0d8a667e4a7e00c27b54673060fc82c68f5ad08cf16b1b3aa1ef01b704469eac996777f195a41d40eeefa976842360e0a1886b8c75249d2b408d96cae7af385c77b3cd63c39905476d1b095a50e8cb1fa21f732d570be547a78b15c2020e6b50422113603dcb21f5dc68c8cbb7a1a21d217f99e65668d003be17f2d927dc85d69bfea2521ee6522ffcc2be0b92a056dd78f81913d0"}, @generic={0x4, 0x5f, "ac2e41b53b6d950da7288041bc612a549ab9aa014fa27760635037a981373eeb87eaaab50a01c7e735e93d368eefd809854467a040aa9fb3959b167e5fee9b458b7c79ca6ba63fa3edcbf3f6b741db23b03c0251c0156be807a830454a176a"}, @enc_lim, @ra={0x5, 0x2, 0x3}, @hao={0xc9, 0x10, @empty}, @enc_lim={0x4, 0x1, 0x7}, @padn={0x1, 0x4, [0x0, 0x0, 0x0, 0x0]}, @ra={0x5, 0x2, 0x8}]}}}, @rthdr={{0x98, 0x29, 0x39, {0x2f, 0x10, 0x0, 0x9, 0x0, [@local, @initdev={0xfe, 0x88, '\x00', 0x1, 0x0}, @loopback, @private1, @private2={0xfc, 0x2, '\x00', 0x1}, @private2={0xfc, 0x2, '\x00', 0x1}, @empty, @mcast2]}}}, @hoplimit_2292={{0x14}}, @hopopts_2292={{0xd8, 0x29, 0x36, {0x2, 0x17, '\x00', [@calipso={0x7, 0x20, {0x2, 0x6, 0x3, 0x1f, [0xffffffffffffffff, 0xc00000000, 0x6]}}, @ra={0x5, 0x2, 0x7}, @calipso={0x7, 0x18, {0x2, 0x4, 0x1, 0x101, [0xffffffffffffffff, 0x8]}}, @generic={0x8, 0x74, "d8d84b2380ffb699711cb2a54221cefc8908ed436ff8149f9f18cccb0cc21443c7758b5d7e037529cdc7eed256adb880479cccaa7c11204349c03bad93a3b4e16b65bfb244feb6f9cf5dfcc1a6427e9b288b91acbfe2fdfcb611172bb2fb22d7f97e4560165df1a6392e3a178635e84fd7deedcc"}, @jumbo={0xc2, 0x4, 0x4}]}}}], 0x350}}, {{&(0x7f0000007c00)={0xa, 0x4e22, 0x7, @initdev={0xfe, 0x88, '\x00', 0x0, 0x0}, 0x2}, 0x1c, &(0x7f0000008f00)=[{&(0x7f0000007c40)="29c408ee3d4c00ce7dd370cac991764183feadb0a4e43d6f0fde21301c2e05c029b8be04c3adf71a", 0x28}, {&(0x7f0000007c80)="a4e973a05b4d4725ac5f917e06ef61172e91f45abaadf75df3d27ca2a2b0efc7ef12abddd98541e3ae931f2123c5eab14775b5d64e17a65ef86302b4910b80cb6c092b1b53658067f997591f80d7394201c505c25fd3b9a25e991e7fe5550c3aafb541bc3a4c65f2197d13cb33a250582a51aea462ed75a8cb9ed376998e6887a4c199273833c7a673a5440e896533a3abe53b84986a57b3e9a61c6a48f2d7147cb7a6b761b9a3125f720fa2ff7d9f01e5dc50ee393bdf6d6ad18c0e6cdca5a569efd42624cc3ac78514328c081fc97a163a3b1579bdc99d9749a127f064af", 0xdf}, {&(0x7f0000007d80)="0d5b8f3d95ac0f976e914ae5e71b480f993249122448c9f7a19a847b5b78398baf6a366ff22cf4384ba58ed8262d5f4a2f88aa0e7ab8edaa1b25d679d0eb0f5228402f5b3afdfe15c50a8dff680b7eaccaed1b9b2d2229adbfc318dbd4d420b02853288ed2eb0a2e022e0c404f6ebc45d51e92ec2174dd3dfb5a80df018498b0e64b42ca32e601c14ddfc536c1fa85aded3f929185d5740f5f", 0x99}, {&(0x7f0000007e40)="0316d5a428127d5c223fa638c2c3ed09a98ae8a072e03473d5521b4c7e90310a64ea3d1c01ee2adb8b26b073ae09adb7ebebb31bcf73836d7cb85626e79a007d80142ab3a33fc18fe997eeb16d58b8e8eec5e9b3af10d3b86fefa9f17af13e4d1d8074e59837d720004739c0d532d3b047adf0bfab24864239b7840815b3f26042d9c1813ed34ad0470d98a1d58e67215f06e6be6fd1054a5f6c4901e27dd4c263e4efaa584713a4b8f9651ee43ef9a7d22df619225069f363293b4a159487606f32d50f220b711a49ddc70deb2ed2f6fd05f04fb5e87de04cd6afb8251caecc20f45830e5306bd912ced36fbc014ae1f62f158d0aa0f9392825b87d63ef90b4feb10d308bc7c5d47433699431821109cc4a8c8a7b762924ba1ba3a8ed54ce6ed4169314bcc645b5daceea756cfe676a4c66b042de60c1e37eeabfcef3945fb9f29ba0f5d809c0e86095356af21a3d51d5ab65d957062c3738b436c12806e72170928683dbe8449b5fe394edff045772f1c865af6a30a22ed3e9ed552a1d25aac4c36496760cde2a55982993aa1430926228b61270780f2a3db1de25af416b0dc7c8f5bbe4939d3f12e4817b8deb9d9e3c791f2bbfd204dc424f420645d5a3a99bdcc70374b18effa072c0a9dc60796f7bb7426e426c1d966313d469a870aa2e6f3691a0baec576f0d410ffa5db3f5d4fa7f3e88b9903fe591ff78ee94927b1acd06823ecd39fc3437263b7e87f1eff8c07c5dd71ea662f2f79ee128574a5ee5deedfbb4dea305fb10c549a5d6fa951ddd915b69324fb36729b80ce5cfecde69efe516968e212bf4ca7fab0dadb8ca20b478488e356b9a45bed5a594b511354168ab4f8eecd5624f77deedf984161091ab5833f9630f5b1aee7a2f137d310ebc5d2ee5679d940c2d54835d9c5ed8d5119678df340afa795ae2abbf102eab92b1a68ddb5a513107f8c12c634c7d682a59d2b07ca5cbb84b0d2fbcd5fb6dcc38ba1eb15fb76397f305247b1018391985ea568b9b7228fbf3c7b6257bd65ccfc1bc483d3981428c3c64a3fbb4aaf80f91093455f50071bf37b7dc5642f178327658b9e92997cfcc35f8dff71d5c2d8d3a4e48c31fa48f372d5f5d727150120e515f2b958b80e38fc1accfbfabcc562a415bebce3db09c5b8452d2bf7d6fc285c6b51235c2419a9d29c535fc27c8e619ced59804722137885a531a83fd0ffd3e6dc9d1c2a9d355fa3f0f792769d617c61b028cf436cb0516f91d6a1a86da4d5285e5a73f6cf0bfa9c436e9d8ef9b11e59c5b220d70c4c85f788a1814525131bd92c8ac366db73ecbe2d9f01715b12b6cfc685c0c6732607e6940adf8ed8b5265899aeb5933578d1053abf0c3a9d5ffc43e29838460c9e805c6c6ee12d03a365fc449aebb22127e06264860e0b826eb8d6124e4fe4fa9f952b67a16812164eb641c58d22a10d9940fff499b5dd2d0dc15d0b3d2d915e96ad4a9774822fe6332d036d62a0fc794561d36ced21d1b4db18c7dcd166e03cded002524bfa428543c0159b0927c6ef89df4cb9293e2badb23b759c03550be7bd1da83bbc4aeebbc5b61349bdb1b433f5b33bc917a55018500ed362d452f99c77ab8ec37ad5a4fc12075acf9f087a8146e0a1209e3b4c05dd4e370627602a89f3f7210eeeef5bdbe88ef4e8b4039a4ffe5f4534209c422ff09fbde4640f5c4a223d911a1af95accbc361ad6414ac9b5308c3cee01e9bf271a163f635f31f539766e82a412520d627060e819c5769ecfe5ef5331a4a4caf2f120b705ac18df02d0cf86008f41ff1e7d17d3e08b1bf59a1db014a78a67ace9ecc16bdef094ed0dc92e01c2e0671583f9d15d0ee64329178815dd9cef2583a377cb7ba8d62c681ef904ae4edf34df3781c7348c60a50ef465a2a65c820744e2163ce0b8d06877de0b8d4aba7e9d6d3320d991012aa5fe88d4806d262b2e20b184995af7c5ffbc0d27788931903eba61493524c62c3d1b07c563c64bcf65927a6eb61d198c82e374470f35de5c9612383e29b9882983844433c683845eb16bda4d856c5e790b25adc873f486ec507d4203e77c5af09e9c91a9d63e98ac8186cc391de6439584a77a06a01e038fba57640c426489d74600f13402b1e131a14bce80da269a4a9c82db55ed67f4b2f9c9de0eda4d41c912f452ef8efd250200ad11d53cee69b1519f2b9204441f8719406210356b1a9493da55dece68b0df2af465804dc3f5473c5fc7a7d4724c8e1c39370964001684984d800f5b69344ceac74de057e972cc55af9e99811a47c4a41d93a858027ddb8176111efb71e4704bba7b048de4de3ecbf485261f27d1b84b0453de9806cda8b279016efad5665361f3957a0112063d0c79f9d7d7c6024611fae63a8441264143726d4393b85f1c7833c463b3b5bced356b4151dbf24fcf3d6d318050cf2a002d3f2b51043d1c2c3c78cd50d74a50bdea2b044d2899a96e418d98c393ed755c0015ee6ab7c0bc4edbc024b233589bea01dff4f8651190d08d7d344d85b2da9dd4ec712a9b1198910529ca7dccbeb141256d26807099081e5ccd5947e0133fa47b06dfa7cee2560936306a884fa8ba5c89cd40c461728b02dc9d74c66857896bd60c35a6fb0626e1490f3a57c079ac3f539b2e5f856bf8764bf93465c448649ec1efcd5eae3894bf618e0a6514370302c88f3f4f10ce624b85dfa44c618cdb2157d38caaf3ac07073bfe8c2f4a30ecea00d162061d49b4ab32a9756cae8d82ab3bf0dfac8e3458198b0411132b3d218eb9117dea9e5e36ec89bb64ae04b4e062dbbe3fc1bef22d6dffeef1caeb588529cc2a5693ea35cd5ae69db202759d668dc8f1f0780364690f00cbfc5ee0ad69f83f845cfd90961d4251040e5e6bcb821f7e4603cb7be960524c67bab9b9d43bd5b382a4e52f220df90e472da1fa17bf4fedb706fcbf094599a52906773e33a8c44be50d7fc5d27210509a3cacecc97ff06d8af1538652b42c5eab1e4eecf29215feb152131eefc920ab271e04a50242cf23b67aad5cba6df9135dce71443df9b62dfd81c192cdcfadffd39e4fc02edba6ed2e6e0da7c1ad9d4feb6ff20056c407711f7b511d303a134062f7f02f50b5753790d0cd7f41969f627099cd461159e85aca8a60b6c5f8fc371eac69259918b2f4da20796c72ce8296f4bfe282d2f3ac6760e45ef990aa687253bd89d1a8f14792cd99417950993f4e8c17b3247bca72f7c2c9d84e05ba8b09e70670a006eebd7aacd7f0a5efa295761577b21428a8c78acf97dfcdbbb8adcf7df81b88d3e46904eee3a9124b5e3a61cb9804fc4ac5a97af2042f96587787173dec9a54a38fb8da3a4fc54072114dd0854c600588b381d0527366652733419992e8a401c79077026febfd34a770ce4a75a4dac36653682c5a36fb4664c8cab67ca5be8473e264bcfda540b3f8c6f5de6a5bede87a8b65642df2cf8022d48a2ab4b1d84989c2aa03a6c66667342173227acac869db80190055f0662967c7d298a6d66e05aab02bc8282938a94b856a8a4183c0a038abe13234294147debe44624b41216f5df44b8fe40be80af0a7e6570e7307cabe93022904d3a69b2dfbcbe8b3e8b630a726f663d76f480c962f358f1b0a21add195a7cee897664eeccc2c40eac37c77048b7475ba9156d1eb29a89cb148d3741dfda0936b72cdeeefa644d813ce1d9262d89e9b7b6a07940f678853039cdd47beabcf3d3727d05b6dc46251eee3b82b879831c7e42dff4fd5797fa9544ca2784dad53f9a7551b1f32908f1578179ef272b6312f2356f6048bfe7de3cce3d3e23d483e59ca7d6b23360927900b0738b7687ae8e065718922345f332549039edaebafb15b65c9d5562054dcaa307f7fdaac9ab3cf8b034d109750eb3057182aac0f60de2949f9cbf668f9853e288143ff7bdf890fa041d112e56bfe3fc23d41782365755afb3519283513e8595f0ea2588033ca92f9c242e821bd6e4c82813ed79a8f81c0fe48161e059256543b743fcac6849a81ff61f3d90d6f631100cd465f6aa0e2e56a198af78c53abfc5a4b2a8c6555907e2cacec2e782ee4c0efd6e2896cd5d0615553b81d4e8a617f59843ce4366c166c0527ddcffdf33a87c990f7d0c44f12f16fc3ebbaf87338fd916fd5765ca6a232dd5077566d7d025aad7d13e9c81c31232342ed5e8c1315abd067388771e61268998fcded4473e9bcdc7b0cc16aea4b4b53cbd6a05575e8c61ded15666b52a22137530e8cd6fe9f425f0b32e62e14c71e068659b1e9621757d615acae8e642ddbce9aadb4cd6ed7ef8a0679be7ad133b7026fc1f3f77f96b2e19a86db3add792c1161ac4d49b846632427688de8993420836ffbaabff4460522e096e997b657a9ea36e161a3601ca7d7fc246876a7c6deab40b9d29751c1ae62222ca443b630c6e142148baf72aaaa6f6215d92f777e9541c3381a2a4407a8a9a61799b05349b7c0ad504e3c84098c797b320e79ee3b0ef36b66ba8c2a44154b3617fc6c48c4dd82c6a5c6d4911ffa3674d3e3740d3a1da5ab3f56fca2451628bb1f76b256a7ac9d2ad6ecb604662948adaef7333113499079db2ba1b6d5c8a084969459acb22f69431bac29d51f3d12b0655303bf5c59764262312d56141769ee0db59c6f33ea64fc8ae5a05755d43bba07d9e6bcbde84939bdd3cdf4fed2f6c2bde22953b1a9388b81f6532a94efc68065728aec28dee5f6b7dca2165276e2a3f21528ac68cf33d07092fb9b34ad2d5d8c964a65dfa193a62d5a5b28ae35291beb90380fb767107c539f4e959193eba39a5009c9012c0c0a6a499f87dc09a901ba961cfa0a785784bb69c788908a29d88da229322447ffe6cb55d092d83500a945f89314603a70f7447429ff4b44e2918582ad4f2e2ee71dbe222a808d7a4561014949047b56ca91d9b775e16334fd0b447c5c92c80d00454825772773bfad7591e56359ad28617e39d92eec3e9f6998656ad37c9e21f3450e042f62c2b0ace836c1f9b5e239b9eda8dfbe2fa0b1947dd7c5c1dd82673d425b16f8c603363b644179b00925577807270257b7b1cb5e038428dc749f15751f2be77c3bf0b2dcdbe6d0c53d1d6021e4838ecb4168a182258a2029efba7f458d826a0512e31ab2c9fc1b0a6831ae3c416afab92318384ba2da56617bb6b9c6d2704b1ed548733e728ed52d72e5228da857a3f1e5faf021119fa33f511a9dd8533f6b6e1d9db37ac0b2156870ec1e7ee1486ec5fd3ab0312511bc9059e31b7b2ad9dbd5ebadad770f35d938de161f610b996da4d52afcdc5b4a20b0c799bd29f2abf40b8d8a1cdb04a504df964a88aa609384a970b3fd3adf841bc39e58a093d828c5f3630189d58194c1b3a85a20e8991be2a54f5d093580dbaacf33c397e4f944a581f345c97ca3f48a1c698a2f92043f011b6eef4be3ea6b74bac342c5c15332d8b92d80525fe497edc59ea3f86880cb55bc8b790363323eea80218683b29425a0e4df58d29f8fdb268f6dca1f7bd06332c15ae72ed4ca93e2d7c8508ae7fa1528efa8061f0b098503aa2314ff3558d8c375a3b51f03a3e519c15641cb293584f9ca545cdd942326b84f98105e6e58f62b0692cabb1107670c8b48127fc49c3ba397643263dc1cb549bc47b0f397ceca1861677f8941116f3f923a0a2219cb4538f570ded40e96f1571acb3ff141e56c737c9c07b3f568a6ce4703de3a7f75c6641771b5b4a670d8172033c8c9a7d85c42b53ea7e42b6b044210d1c7413ea6bb366332b9a26a36ca14bf4a8", 0x1000}, {&(0x7f0000008e40)="ea0ca96f52842d4c120512cd4768a64da39a6389f2e9cc175dfcece57fbb4340b3c51b4f7cce9eab55f7b6a63b0974d6684fab87f4c25fb9a0438a0625b30715b63d3d09590ed5067459cf411d4f751c6e76bf8d4812283163443ec0d2fd8920efc7ce0917354129f22617849489a0e6140450f665691fafa74ba46deb673bfacc4503b3305def32e435097fa0765ebf0c2fb4df9ad8d750d12617", 0x9b}], 0x5}}], 0x4, 0x4000814)
r11 = ioctl$TIOCGPTPEER(r2, 0x5441, 0xb)
ioctl$TIOCSRS485(r11, 0x542f, &(0x7f0000009080)={0xd1, 0xffffffa3, 0x5})
ioctl$BTRFS_IOC_BALANCE_PROGRESS(r11, 0x84009422, &(0x7f00000090c0)={0x0, 0x0, {0x0, @struct, <r12=>0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @struct}, {}, {0x0, @struct, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @struct}})
ioctl$BTRFS_IOC_SCRUB(r0, 0xc400941b, &(0x7f00000094c0)={<r13=>0x0, 0x8, 0x1, 0x1})
ioctl$BTRFS_IOC_BALANCE_V2(r3, 0xc4009420, &(0x7f0000009cc0)={0xa, 0x1, {0x7, @struct={0xf5, 0x4}, r12, 0x3, 0x7fffffffffffffff, 0x8, 0x8, 0x3, 0x406, @usage=0x100000000, 0xfffffff7, 0x401, [0x2, 0x9, 0x7fffffff, 0x3, 0xdf1087a, 0x9]}, {0xce1f, @usage=0x2, r13, 0x80000000, 0x580, 0x9, 0x9, 0x1, 0x46d, @usage, 0x6, 0x973, [0x7fffffffffffffff, 0x8000000000000000, 0x2, 0x5f, 0x7f, 0x3]}, {0x4, @usage, 0x0, 0xfffffffffffffffa, 0x1, 0x0, 0xa12d, 0x3, 0xa3, @struct={0x3732, 0x882}, 0x4, 0x101, [0x1, 0x1ded5572, 0x5, 0xfffffffffffffffc, 0x8, 0x1]}, {0x8000, 0xb17, 0xf11}})
executing program 0:
r0 = ioctl$KVM_CREATE_VM(0xffffffffffffffff, 0xae01, 0x0)
ioctl$KVM_CAP_X86_BUS_LOCK_EXIT(r0, 0x4068aea3, &(0x7f00000001c0)={0xc1, 0x0, 0x1})
ioctl$KVM_CAP_XEN_HVM(0xffffffffffffffff, 0x4068aea3, &(0x7f0000000240)={0x26, 0x0, 0x4})
r1 = dup(r0)
ioctl$KVM_SET_USER_MEMORY_REGION(r0, 0x4020ae46, &(0x7f0000000840)={0x1fe, 0x2, 0x2000, 0x1000, &(0x7f0000003000/0x1000)=nil})
r2 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0)
syz_emit_ethernet(0x7e, &(0x7f00000010c0)={@broadcast, @multicast, @void, {@ipv4={0x800, @icmp={{0x5, 0x4, 0x0, 0x0, 0x70, 0x0, 0x0, 0x0, 0x1, 0x0, @private=0xa010102, @local}, @redirect={0xb, 0x0, 0x0, @broadcast=0x1000000, {0x15, 0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x11, 0x0, @private, @multicast2, {[@timestamp_addr={0x44, 0xc, 0x0, 0x1, 0x0, [{@remote, 0x4e20fffc}]}, @timestamp_addr={0x44, 0x34, 0x0, 0x1, 0x0, [{@rand_addr=0x64010102}, {@remote}, {@private=0xa010101}, {@private}, {@empty}, {@initdev={0xac, 0x1e, 0x0, 0x0}}]}]}}}}}}}, 0x0)
syz_kvm_setup_cpu$x86(r1, r1, &(0x7f0000000000/0x18000)=nil, &(0x7f0000000100)=[@text32={0x20, 0x0}], 0x1, 0xe, 0x0, 0x0)
r3 = socket$kcm(0x10, 0x2, 0x0)
sendmsg$kcm(r3, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000080)=[{&(0x7f0000000300)="2e00000011008108090f9becdb4cb9200a4831371400000069bd6efb2502eaf60d000300020400bf050005001201", 0x2e}], 0x1}, 0x0)
sendmsg$inet6(r1, &(0x7f0000000800)={0x0, 0x0, &(0x7f0000000400)=[{&(0x7f0000000080)="944cf7", 0x3}], 0x1}, 0x20000010)
r4 = openat$sndseq(0xffffffffffffff9c, &(0x7f0000000040), 0x62181)
ioctl$SNDRV_SEQ_IOCTL_CREATE_QUEUE(r4, 0xc08c5332, &(0x7f0000000400)={0x1c, 0x40, 0x0, 'queue0\x00', 0xffbffffc})
r5 = openat$sndseq(0xffffffffffffff9c, &(0x7f00000018c0), 0xa8c01)
write$sndseq(r5, &(0x7f0000000080)=[{0x1e, 0x0, 0x8, 0xfd, @tick=0x8, {}, {}, @result}], 0x1c)
ioctl$SNDRV_SEQ_IOCTL_SET_QUEUE_TEMPO(r5, 0x402c5342, &(0x7f0000000180)={0x0, 0x8, 0x6, {0x7e, 0x7}, 0x10000, 0xe})
syz_kvm_setup_cpu$x86(0xffffffffffffffff, r2, &(0x7f0000000000/0x18000)=nil, &(0x7f0000000040)=[@text64={0x40, 0x0}], 0x1, 0x11, 0x0, 0x0)
ioctl$KVM_RUN(r2, 0xae80, 0x0)
ioctl$KVM_CREATE_VM(0xffffffffffffffff, 0xae01, 0x0) (async)
ioctl$KVM_CAP_X86_BUS_LOCK_EXIT(r0, 0x4068aea3, &(0x7f00000001c0)={0xc1, 0x0, 0x1}) (async)
ioctl$KVM_CAP_XEN_HVM(0xffffffffffffffff, 0x4068aea3, &(0x7f0000000240)={0x26, 0x0, 0x4}) (async)
dup(r0) (async)
ioctl$KVM_SET_USER_MEMORY_REGION(r0, 0x4020ae46, &(0x7f0000000840)={0x1fe, 0x2, 0x2000, 0x1000, &(0x7f0000003000/0x1000)=nil}) (async)
ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0) (async)
syz_emit_ethernet(0x7e, &(0x7f00000010c0)={@broadcast, @multicast, @void, {@ipv4={0x800, @icmp={{0x5, 0x4, 0x0, 0x0, 0x70, 0x0, 0x0, 0x0, 0x1, 0x0, @private=0xa010102, @local}, @redirect={0xb, 0x0, 0x0, @broadcast=0x1000000, {0x15, 0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x11, 0x0, @private, @multicast2, {[@timestamp_addr={0x44, 0xc, 0x0, 0x1, 0x0, [{@remote, 0x4e20fffc}]}, @timestamp_addr={0x44, 0x34, 0x0, 0x1, 0x0, [{@rand_addr=0x64010102}, {@remote}, {@private=0xa010101}, {@private}, {@empty}, {@initdev={0xac, 0x1e, 0x0, 0x0}}]}]}}}}}}}, 0x0) (async)
syz_kvm_setup_cpu$x86(r1, r1, &(0x7f0000000000/0x18000)=nil, &(0x7f0000000100)=[@text32={0x20, 0x0}], 0x1, 0xe, 0x0, 0x0) (async)
socket$kcm(0x10, 0x2, 0x0) (async)
sendmsg$kcm(r3, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000080)=[{&(0x7f0000000300)="2e00000011008108090f9becdb4cb9200a4831371400000069bd6efb2502eaf60d000300020400bf050005001201", 0x2e}], 0x1}, 0x0) (async)
sendmsg$inet6(r1, &(0x7f0000000800)={0x0, 0x0, &(0x7f0000000400)=[{&(0x7f0000000080)="944cf7", 0x3}], 0x1}, 0x20000010) (async)
openat$sndseq(0xffffffffffffff9c, &(0x7f0000000040), 0x62181) (async)
ioctl$SNDRV_SEQ_IOCTL_CREATE_QUEUE(r4, 0xc08c5332, &(0x7f0000000400)={0x1c, 0x40, 0x0, 'queue0\x00', 0xffbffffc}) (async)
openat$sndseq(0xffffffffffffff9c, &(0x7f00000018c0), 0xa8c01) (async)
write$sndseq(r5, &(0x7f0000000080)=[{0x1e, 0x0, 0x8, 0xfd, @tick=0x8, {}, {}, @result}], 0x1c) (async)
ioctl$SNDRV_SEQ_IOCTL_SET_QUEUE_TEMPO(r5, 0x402c5342, &(0x7f0000000180)={0x0, 0x8, 0x6, {0x7e, 0x7}, 0x10000, 0xe}) (async)
syz_kvm_setup_cpu$x86(0xffffffffffffffff, r2, &(0x7f0000000000/0x18000)=nil, &(0x7f0000000040)=[@text64={0x40, 0x0}], 0x1, 0x11, 0x0, 0x0) (async)
ioctl$KVM_RUN(r2, 0xae80, 0x0) (async)
executing program 0:
prctl$PR_SET_MM(0x23, 0x3, &(0x7f0000ffd000/0x3000)=nil)
r0 = openat$ttyS3(0xffffffffffffff9c, &(0x7f00000000c0), 0x40, 0x0)
ioctl$TIOCSETD(r0, 0x5423, &(0x7f0000000040)=0x2)
ioctl$TIOCSETD(r0, 0x5423, &(0x7f0000000080)=0x11)
r1 = openat$tun(0xffffffffffffff9c, &(0x7f0000000240), 0x0, 0x0)
ioctl$TUNSETIFF(r1, 0x400454ca, &(0x7f0000000040)={'syzkaller0\x00', 0x7101})
r2 = socket(0x10, 0x803, 0x0)
ioctl$sock_SIOCGIFINDEX(r2, 0x8933, &(0x7f0000000100)={'syzkaller0\x00', <r3=>0x0})
r4 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0)
r5 = ioctl$KVM_CREATE_VM(r4, 0xae01, 0x0)
r6 = dup(r5)
ioctl$KVM_SET_USER_MEMORY_REGION(r5, 0x4020ae46, &(0x7f0000000840)={0x1fe, 0x2, 0x2000, 0x1000, &(0x7f0000003000/0x1000)=nil})
r7 = ioctl$KVM_CREATE_VCPU(r6, 0xae41, 0x0)
syz_kvm_setup_cpu$x86(r6, r6, &(0x7f0000000000/0x18000)=nil, &(0x7f0000000100)=[@text32={0x20, &(0x7f0000000080)="f20f06c744240004000000c7442402ab5e9cd2c7442406000000000f0114c5fafae219a68a108000000f01112e650f32c4e3b15e650000c4e1bfd00ab9800000c00f3235001000000f300fc77e04", 0x4e}], 0x1, 0x4d, 0x0, 0x0)
syz_kvm_setup_cpu$x86(0xffffffffffffffff, r7, &(0x7f0000000000/0x18000)=nil, &(0x7f0000000040)=[@text64={0x40, 0x0}], 0x1, 0x11, 0x0, 0x0)
ioctl$KVM_RUN(r7, 0xae80, 0x0)
sendmsg$nl_route_sched(r2, &(0x7f00000012c0)={0x0, 0x0, &(0x7f0000000480)={&(0x7f0000000a40)=@newqdisc={0x2c, 0x24, 0x4ee4e6a52ff5653f, 0x70bd2d, 0x25dfdbfc, {0x0, 0x0, 0x0, r3, {0x0, 0x9}, {0xffff, 0xffff}}, [@qdisc_kind_options=@q_drr={0x8}]}, 0x2c}, 0x1, 0x0, 0x0, 0x81}, 0x0)
timer_create(0x0, &(0x7f0000000080)={0x0, 0x11, 0x0, @thr={0x0, 0x0}}, &(0x7f0000000000))
timer_settime(0x0, 0x0, &(0x7f0000000240)={{0x0, 0x8}, {0x0, 0x9}}, 0x0)
r8 = syz_open_dev$cec(&(0x7f0000000000), 0x0, 0x0)
r9 = syz_open_dev$tty1(0xc, 0x4, 0x1)
r10 = dup(r9)
write$UHID_INPUT(r10, &(0x7f0000001040)={0xfc, {"a2e3ad09edfc09f91b44090987f70e06d038e7ff7fc6e5539b0d3d0e8b089b0732306c090890e0879b0a0ac6e70a9b3361959b4b9a240d5b0af3988f7ef319520100ffe8d178708c523c921b1b5b31070d074a0936cd3b78130daa61d8e8040000005802b77f07227227b7ba67e0e78657a6f5c2a874e62a9ccdc0d31a0c9f318c0da1993bd160e233df4a62179c6f30e065cd5b91cd0ae193973735b36d5b1b63dd1c00305d3f46635eb016d5b1dda98e2d749be7bd1df1fb3b231fdcdb5075a9aaa1b469c3090000000000000075271b286329d169934288fd789aa37d6e98b224fd44b65b31334ffc55cc82cd3ac32ecdb08ced6f9081b4dd0d8b38f3cd4498bee800490841bdb114f6b76383709d8f5c55432a909fda039aec54a1236e80f6a8abadea7662496bddbb000000002f17959d1f416e56c71b1931870262f5e8f7109242ca026bfc821e7e7daf2451138e645bb80c617669314e2fbe70de98ec76a9e40dad47f36fd9f7d0d42a4b5f1185ccdcf16ff46295d8a0fa17713c5802630933a9a34af674f3f39fe23491237c08822dec110911e893d0a8c4f677747abc360934b82910ff85bfd995083bba2987a67399eac427d145d546a40b9f6ff14ac488ec130fb3850a27af9544ae15a7e454dea05918b41243513f000000000000000a3621c56cea8d20fa911a0c41db6ebe8cac64f17679141d54b34bbc9963ac4f4bb3309603f1d4ab966203861b5b15a841f2b575a8bd0d78248ebe4d9a80002695104f674c2431dca141fae269cab70e9a66f3c3a9a63e9639e1f59c0ede26c6b5d74b078a5e15c31634e5ae098ce9ee70771aaa18119a867e1088334975e9f73483b6a62fa678ca14ffd9f9db2a7869d85864056526f889af43a6056080572286522449df466c632b3570243f989cce7cd9f465e41e610c20d80421d653a5520000008213b704c7fb082ff27590678ef9f190bae97909507041d860420c5664b27921b14dc1db8892fd32d0ad7bc946813591ad8deff4b05f60cea0da7710ac0000000000008000bea37ce0d0d4aa202f928f28381aab144a5d429a04a6a2b83c7068ae949ed06e288e810bac9c76600025e19c907f8ea2e2010000008271a1f5f8528f227e79c1389dbdfffe492f21579d2c15b8c70cdb1c332d86d87341432750861ec2bc3451edca194b221cfec4603d276bbaa1dfa6d4fb8a48a76eafc9a9a0270e4c10d6ced5a62427264f2377fe763c43470833ac96c45f357cbbaba8f1b1fdcc7cbb61a7cdb9744ed700129aede2be21ccfdc4e9134f8684b3a4f354da9a795e96334e207dff70f1988037b2ed3aaf575c0b88d8f146684078416d59fdee5325928974d12dad99dac44c3f0008047096a44002bebc24202fa9b6578b4779415d4ac01b75d5495c118045651cf41c2fc48b778efa5ea5677747430af4162b987b80c3e001cd34e5c92f76cc4c24eeb8bc4e9ac2aed9e53803ed0ca4ae3a9737d214060005ea6f1783e287b3bee96e3a726eafe2fdfaa78d1f48c13b64df07847754b8400daaa69bf5c8f4350aeae9ca1207e78283cd0b20ceb360c7e658828163e2d25c4aa348561f927e88f63aa70e73a5e69b3df3495903f06572e1e007fa55a2999f596d067312f5779e8dbfdcf3427138f3d444d2639a10477f9bec4b0bbb6e3c04be68981f392203dd0ee3ef478e16dacfc5e3e03cf7ab8e3902f1b0ff034ef655b253ca509383815b1b6fc6522d4e4fdc11a48cf42d48604675fde2b94cf00500a2b30900000000000900000000000000338b8780bdecd436cf0541359bafffa45237f104b96210403b2de9efed496f42355bc7872c827467cfa5c4e72730d56bd068ed211cf847535edecb7b373f78b095b68441a34cb51682a8ae4d24ad0465f3927f889b813076038e79a7962fb385a882e8020f06c4c2ba1dd5cac7c18876da865d258734dd73583df292892448039ef799cf0630becdcce04579b5561dc825ab829827945e020c1f67ee615feb6243378e0610060f02cca4e91b2f001edb3d78fb4b55668dda93aec92a5de203717aa49c2d284acfabe262fccfcbb2b75a2183c46eb65ca8104e1b4da7fbb77ab2fc043aead87c32ab875ee7c2e7b7019c982cd3b43eaeb1a5fb135c0c7dcee8fe6516a328032f88c042891824659e9e94265c803b35ee5f83a2b210520106b8a358b50ab7a1fa89af9c251fe5294b3d1802d5676d95f160ec97b1ad94872cb2044642c37b4a6cc6c04effc1672db7e4b68d787d9a7a508ae54b3cd7369dde50e8c77d95a3d361c040babb171607caac2a3559ad4f75465f49c0d0ae3716db6e00cb11db4a5fade2a57c10238e204a67737c3b42aae501b20f7694a00f16e2d0174035a2c22656dc29880acebdbe8ddbd75c2f998d8ac2dfad2ba3a504767b6b45a45957f24d758ed024b3849c11d412a2a03b4047497022d9c30e23ef4df5c89644f48bb536f7945d59d7bcddff754413d135273ea8e75f22f216c6b9990ae71806f2c00b4025c48b75c0f73cdb9a7b8fa367b50028067e7f16f4dd569d462f4f19eacdb3ed70eeebb4483f8fd777d443e8b40427db6fe29068c0ca3d2414442e8f3a154704b0e51bc664a137b26be719f4f7c9a5678a674dfc95df80b9ce375dd649c8c704e509bd88c8e63d8c7dd67071115c8982ba46af4d6adcc9f68a75b9397b035153faf46366e7205dd8d6f37525c1a0e94610dd94323f6c15d085197149bfd6655548cfd9c52c9711937f79abb1a124f1210465483cd3b2d78378cfb85ed82e7da0f6eb6d279f2ae455925d0f6f1ba571eba281f2a654fb39ddff3b484439ff158e7c5419e037f3e3ad038f2211f1033195563c7f93cd54b9094f226e783271e1e5a2a2c10712eab625d64931cd4ffe6738d97b9b5ef828ee9fb059fc01af0e79c1e14b1d25988c69a399567c1d93768f7971d31488b8658a20878b7c1dd7ba02fc42939dde3d4a3339a65d507dc59c51097b40517705da56e9ebf0afa53282bf86dbb58c548069ff6eb95aade7cc66d7bbef724779ca1f731b3346ff177050373d79ff7b3e7f9bc0c1b4b266a8878b90baaa039d3e3b63979ac3df6e6f4859afd50238c7547a39b60810938044ae185d2ba3e00a4e73676864ae090d81eaee5ee6cf1d0ab378dd4dd891e937c2ea5410e0513005000000000000003911fab964c271550027697b52160687461602f88df165d884b36ec2b6c25a2f33c715687e9d4afb96d6861aca47da73d6f3144345f48843dd014e5c5ad8fe995754bd9cf32fce1e31919c4b2082fb0a30b9deae84bed4b28045634073c9c58c89d9e99c81769177c6d594f88a4facfd4c735a20307c737afa2d60399473296b831dbd933d93994ba3064279b10ea0c5833f41f157ea2302993dbe433b1aa3a3766d5439020484f4113c4c859465c3b415c3432f81db8719539d5bf372aaaea1cc43a6c5cbe59758bfee2916580dac4b008e595f437491d87abed02cefcd9db53d94d02daee67918e5d6787463183b4b87c1050000002f7809959bc048850613d17ca51055f2f416a44fe180d2d50c312cca7cb14a2bdc331f57a9817139a206fc76957227ffff2de20a4b8e3737fbb42913777c06376f799eba367e21f94ca598705f5dcb767d6f0900d6b0f6095e53c4c4234d0c23be434f6ab8f43c0013ee93b83946ee7759e89d7bdd1a32d7b311711b757fe43c06d21a35810d8fe98b27faea8aa12bc8716eefc5c97c45ac33eeec964c5214bc3a9359bdea1cccab94f15e36319cb34ebcacedb82c2ed3de5a8a8f0011e8f74e82d7f96093530e76692839d7961939adfdeeeaff19d11efcafb6d546fef271e89d6cc2389e81ff58cefcce3fbf4625a7e7de40e42e07b34449e15e065cc7340002000000000000f288a4510de03dab19d26285eda89156d50dd385a60333ba5bbf5d77cd7007ad1519ad5470de3dd6d6080cafccf8a97406bb6b68a1f0c4549820a73c880f475f732ae00398e8bd1f4108b7807fb33b72685ec37a2d3f766413a60459516246e5a1d998a2017aef0948a68cf255315ab80dd349e891aef595dc4d470e8ac32a308e15fc37d06aeac289c0523f483e1ff7408c6087f1ab652f2ef91d4f2b01987b0f46da034e5c3f745a7ee8101a3934c54e24b48ec0275e2d0687dc746b0827cbf652f406c6b95f2722e58c05f752ce2126596e1cd7655b904801784c416b22f73d324678e2724f43f1fe687c7e8a60c28b82b6528341b648cdd56fed7cdcbb1575912d5ecd36dea3bca0b7427d8392c6289455e8f8d2ab2242729251ae033a9e02210e62df0546a74b333a1c48f95fd54acb5741259e8c5488efeee327415cc19451432c6f14c27693102a3cd84857cd6586fc5ca9a93eb0145fac0662ff86107f998a8ef7df8aa14046c55b03d3d47f88a8d60f7774a2ee08758897fb411a94b3c2fc5d5f0db42c0456ec015f08e5247d33ae2d35603ff8454c16f8342856935125102bb784ed7148b6ce431b63ee356b0c785f2f47b90e29389f22fc5b59a70efaea2bd40195af4486220d702e30bfc43c10ec23ea6283994a7dde4dcb21fea6b651fb1d62458d0741a12830052fcc460db043afe525629b40d7cee458e4cb5e930ed624806c43a006e39336d07c2b8081c128ad2706f48261f7897484c297a1a6613bc18f5a38d442768af38041efe03d152ef95ff569e76db2391f4509d7f339d92fdb4a89364949da398000000000000000d80a4fe654578376e599aff3565b1d531f30912b9945030b81ea9935fd46edb44a78f615255490a4b621501f2a9e4d24624c4dac9274118c67584f5d374755534d7f68f679c4ff516a9c861a0e7e65868fcb2bf1cb9aea4e05df72279fdb0d2b9e935c5af3cf474bed79dfc248c1f5aea4b8b32c5d295e57079d0fe662a46b7f71cd47744db86c50b704c971d90295c7b2c7439a2d78ccfa79b5fc2bff6bbf840262bf89394b3e0691953264d2700c838fa2c7b3425260f59554e502dcea39cb313b0000000000004ca7c12f45858d6284ca6270d6b2f0e58fded8a7b4a302a97bc641df07720ba2b26bbfcc807ca0abb1a44322269c21c5ec68cb068ea88067d905ea917bb03eefdaebdeabf2d0dce80997c915c8949de992587c2cb5fe36d7d3e5db21b094b8b77940b5f07722e47a08d367e5f84c96ec664b72934b99b3109af65d77e86abd6859cddf4bbae1f0930462df15fddbc48562ea3511a8065ef028cf12f14dcf6ebecd8d884836174faf1aa609e5f1ee1162dfa13bdc1fa7cfaadba85c72e9758f03a755d0be53f8d2a1dfb1c68cc164b0a0780d971a96ea2c4d4ca0398c2235980a9307b3d5bd3b01faffd0a5dbed2881a9700af561ac8c6b00000000000000f96f06817fb903729a7db6ff957697c9ede7885d94ffb0969be0daf60af93109eb1dee72e4363f51af62af6fb2a6df3bec89822a7a0b678058fa3fef86faec216eb6992162f8dcbf719c148cd2f9c55f4901203a9a8a2c3e90f3943dbc10360a1a49700d1dfbf66d69f6fbaf506c8bcce8bb0d872a02238926407a4eddd5d0fc5a752f90000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000002000", 0x1000}}, 0xb6b)
ioctl$CEC_DQEVENT(r8, 0xc0506107, 0x0)
ioctl$CEC_DQEVENT(r8, 0xc0506107, 0x0)
sendmsg$nl_route_sched(r2, &(0x7f0000006040)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000500)=@newtfilter={0x4c, 0x2c, 0xd3f, 0x70bd25, 0x25dfdbfb, {0x0, 0x0, 0xffff, r3, {0x1, 0x4}, {0x0, 0x9}, {0xf, 0xd}}, [@filter_kind_options=@f_flower={{0xb}, {0x1c, 0x2, [@TCA_FLOWER_KEY_ETH_TYPE={0x6, 0x8, 0x8848}, @TCA_FLOWER_KEY_MPLS_OPTS={0x8, 0x63, 0x0, 0x1, @TCA_FLOWER_KEY_MPLS_OPTS_LSE={0x4}}, @TCA_FLOWER_KEY_MPLS_TC={0x5, 0x45, 0x5}]}}]}, 0x4c}, 0x1, 0x0, 0x0, 0x1}, 0x20040054)
ioctl$TIOCVHANGUP(r0, 0x5437, 0x0)
executing program 0:
mkdirat(0xffffffffffffff9c, &(0x7f0000000280)='./file0\x00', 0x0) (async)
r0 = syz_init_net_socket$bt_l2cap(0x1f, 0x3, 0x3)
r1 = dup(r0)
sendmsg$nl_route_sched(r1, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000dc0), 0x6df8}}, 0x0)
setsockopt$IP_VS_SO_SET_ZERO(r1, 0x0, 0x48f, &(0x7f0000000080)={0x33, @remote, 0x4e20, 0x4, 'wlc\x00', 0x4, 0x1000000, 0x63}, 0x2c) (async)
mount$bind(&(0x7f0000000c40)='.\x00', &(0x7f0000000200)='./file0/../file0\x00', 0x0, 0x101090, 0x0)
chroot(&(0x7f0000000300)='./file0/../file0/../file0/../file0\x00') (async)
chdir(&(0x7f0000000000)='./file0\x00') (async)
mount(0x0, &(0x7f0000000d40)='./file0/../file0/../file0\x00', &(0x7f00000002c0)='sysfs\x00', 0x800, 0x0) (async)
pivot_root(&(0x7f0000000040)='./file0/../file0\x00', &(0x7f00000001c0)='./file0/../file0\x00')
executing program 0:
r0 = socket$nl_xfrm(0x10, 0x3, 0x6)
sendmsg$nl_xfrm(r0, &(0x7f0000000180)={0x0, 0x0, &(0x7f00000001c0)={&(0x7f0000000000)=@updpolicy={0xb8, 0x19, 0x1, 0x0, 0x0, {{@in=@multicast1=0xe0000002, @in6=@loopback, 0x0, 0x0, 0x0, 0x0, 0xa, 0x0, 0x0, 0x87}, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffffffffffb}, {0xfffffffffffffffd}}}, 0xb8}}, 0x0)
sendmsg$nl_xfrm(r0, &(0x7f0000000180)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000000)=ANY=[@ANYBLOB="b800000015"], 0xb8}}, 0x0)
r1 = openat$vmci(0xffffffffffffff9c, &(0x7f0000000040), 0x2, 0x0)
ioctl$IOCTL_VMCI_VERSION2(r1, 0x7a7, &(0x7f0000000000)=0x10000)
mmap(&(0x7f0000000000/0xff5000)=nil, 0xff5000, 0x2000009, 0x200000005c832, 0xffffffffffffffff, 0x0)
r2 = socket$nl_route(0x10, 0x3, 0x0)
sendmsg$nl_route(r2, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000100)=ANY=[@ANYBLOB="48000000100001060100000000000000000000000000000000000000000000001000030073797a6b616c6c65723000001800128008000100767266000c00028008000100e8030000"], 0x48}}, 0x0)
r3 = socket$inet6_udp(0xa, 0x2, 0x0)
ioctl$sock_SIOCGIFINDEX(r3, 0x8933, &(0x7f0000000200)={'syzkaller0\x00', <r4=>0x0})
ioctl$sock_SIOCGIFINDEX(r3, 0x8933, &(0x7f0000000300)={'veth0\x00', <r5=>0x0})
sendmsg$nl_route(r2, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000400)={&(0x7f0000000500)=ANY=[@ANYBLOB="28000000130001000200"/20, @ANYRES32=r5, @ANYBLOB='\x00\x00\x00\x00\x00\x00\x00\x00\b\x00\n\x00', @ANYRES32=r4], 0x28}}, 0x0)
sendmsg$nl_route(r2, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000600)={&(0x7f0000000700)=ANY=[@ANYBLOB="20000000130001000300"/20, @ANYRES32=r4, @ANYBLOB="0100000001000000"], 0x20}}, 0x0)
setsockopt$SO_BINDTODEVICE(r3, 0x1, 0x19, &(0x7f0000000780)='veth0\x00', 0x6)
bind$inet6(r3, &(0x7f0000000880)={0xa, 0x5000, 0x0, @local}, 0x1c)
connect$inet6(r3, &(0x7f0000000800)={0xa, 0x5000, 0x0, @remote}, 0x1c)
write(r3, &(0x7f0000000900)="001122334455", 0x6)
ioctl$IOCTL_VMCI_INIT_CONTEXT(r1, 0x7a0, &(0x7f0000000100)={@local})
executing program 0:
r0 = socket$inet_udp(0x2, 0x2, 0x0)
io_setup(0x2, &(0x7f0000000000)=<r1=>0x0)
syz_clone3(&(0x7f0000000300)={0x23800000, &(0x7f0000000040)=<r2=>0xffffffffffffffff, 0x0, 0x0, {0x27}, 0x0, 0x0, 0x0, 0x0}, 0x58)
io_submit(r1, 0x1, &(0x7f0000001300)=[&(0x7f00000000c0)={0x0, 0x0, 0x0, 0x5, 0x6, r2, 0x0}])
r3 = eventfd2(0xa8, 0x800)
r4 = openat$rtc(0xffffffffffffff9c, &(0x7f0000000340), 0x149400, 0x0)
r5 = eventfd2(0x22000000, 0x80001)
io_submit(r1, 0x3, &(0x7f00000004c0)=[&(0x7f0000000240)={0x0, 0x0, 0x0, 0x5, 0x30b6, r0, &(0x7f00000001c0)="065b717f2552c143fe66333c56f76aa5f920f45c50064621ab13712ce4a43b5d561f8347cda30cfe58d8dc69131f1d888bb6a36cef091a70ffdfd131f82f1cc6eb6da3b4f1b46d63ef8cdec73931589827fd017e1c9ff44932869f", 0x5b, 0x7fffffffffffffff, 0x0, 0x1}, &(0x7f0000000300)={0x0, 0x0, 0x0, 0x6, 0x1, r0, &(0x7f0000000280)="195b58025815c7d543af16ecf615ad1a2555a1ed1ed0f6728fdea3b6576c973ab8e2d2cc092be6d01f60e2fb484706229b698a97fe3efcc31ad98a882b442305960c7b4b5fd29d749a39875600b2d2aecb2e98ed5a595a69b79f37f411e531e863ca6e070b7b0bf0e0a6ab1127ae586471c17364c45a801b8341", 0x7a, 0x8, 0x0, 0x0, r3}, &(0x7f0000000480)={0x0, 0x0, 0x0, 0x7, 0x0, r4, &(0x7f0000000380)="02fcfa2343fc9f39accefe86f20fa9d6be30a8046b13ba00f4c15e5403ab9b4d1b40f8a33b45c15c81410abc8ffccd80a186fa48c9bcd27b73e339642c3da71a36f2dd27c8a1a0df9a567c24b84b1b3a28fddfc238c6e7de97a4eed66bc2ae9dbe2ba70d886527a85c2f788a88f252509da55599dc3acb4481c3faf8028ef48a2b5e455b680077554c9dc096d8c092016c61a57e4baefccddcf6aeba8deb606496eada2e25d71c5fc73a57b39be45b112131d8367122d9b8ab15defe864cf347955b910d8630fe653d", 0xc9, 0x0, 0x0, 0x1, r5}])
r6 = openat(0xffffffffffffff9c, &(0x7f0000000c00)='./sys/power/state\x00', 0x1, 0x0)
write(r6, &(0x7f0000000d00)='mem', 0x3)
r7 = syz_open_dev$vim2m(&(0x7f0000000040), 0x7, 0x2)
ioctl$vim2m_VIDIOC_S_FMT(r7, 0xc0d05605, &(0x7f00000000c0)={0x1, @pix={0x5, 0x6, 0x50565559, 0x1, 0x6, 0x46, 0x2, 0x3, 0x1, 0x7, 0x0, 0x7}})
ioctl$TIOCGPTPEER(r6, 0x5441, 0x8)
ioctl$sock_inet_SIOCSIFDSTADDR(r0, 0x8918, &(0x7f0000000080)={'ipvlan0\x00', {0x2, 0x4e20, @dev={0xac, 0x14, 0x14, 0x37}}})
executing program 32:
r0 = socket$inet_udp(0x2, 0x2, 0x0)
io_setup(0x2, &(0x7f0000000000)=<r1=>0x0)
syz_clone3(&(0x7f0000000300)={0x23800000, &(0x7f0000000040)=<r2=>0xffffffffffffffff, 0x0, 0x0, {0x27}, 0x0, 0x0, 0x0, 0x0}, 0x58)
io_submit(r1, 0x1, &(0x7f0000001300)=[&(0x7f00000000c0)={0x0, 0x0, 0x0, 0x5, 0x6, r2, 0x0}])
r3 = eventfd2(0xa8, 0x800)
r4 = openat$rtc(0xffffffffffffff9c, &(0x7f0000000340), 0x149400, 0x0)
r5 = eventfd2(0x22000000, 0x80001)
io_submit(r1, 0x3, &(0x7f00000004c0)=[&(0x7f0000000240)={0x0, 0x0, 0x0, 0x5, 0x30b6, r0, &(0x7f00000001c0)="065b717f2552c143fe66333c56f76aa5f920f45c50064621ab13712ce4a43b5d561f8347cda30cfe58d8dc69131f1d888bb6a36cef091a70ffdfd131f82f1cc6eb6da3b4f1b46d63ef8cdec73931589827fd017e1c9ff44932869f", 0x5b, 0x7fffffffffffffff, 0x0, 0x1}, &(0x7f0000000300)={0x0, 0x0, 0x0, 0x6, 0x1, r0, &(0x7f0000000280)="195b58025815c7d543af16ecf615ad1a2555a1ed1ed0f6728fdea3b6576c973ab8e2d2cc092be6d01f60e2fb484706229b698a97fe3efcc31ad98a882b442305960c7b4b5fd29d749a39875600b2d2aecb2e98ed5a595a69b79f37f411e531e863ca6e070b7b0bf0e0a6ab1127ae586471c17364c45a801b8341", 0x7a, 0x8, 0x0, 0x0, r3}, &(0x7f0000000480)={0x0, 0x0, 0x0, 0x7, 0x0, r4, &(0x7f0000000380)="02fcfa2343fc9f39accefe86f20fa9d6be30a8046b13ba00f4c15e5403ab9b4d1b40f8a33b45c15c81410abc8ffccd80a186fa48c9bcd27b73e339642c3da71a36f2dd27c8a1a0df9a567c24b84b1b3a28fddfc238c6e7de97a4eed66bc2ae9dbe2ba70d886527a85c2f788a88f252509da55599dc3acb4481c3faf8028ef48a2b5e455b680077554c9dc096d8c092016c61a57e4baefccddcf6aeba8deb606496eada2e25d71c5fc73a57b39be45b112131d8367122d9b8ab15defe864cf347955b910d8630fe653d", 0xc9, 0x0, 0x0, 0x1, r5}])
r6 = openat(0xffffffffffffff9c, &(0x7f0000000c00)='./sys/power/state\x00', 0x1, 0x0)
write(r6, &(0x7f0000000d00)='mem', 0x3)
r7 = syz_open_dev$vim2m(&(0x7f0000000040), 0x7, 0x2)
ioctl$vim2m_VIDIOC_S_FMT(r7, 0xc0d05605, &(0x7f00000000c0)={0x1, @pix={0x5, 0x6, 0x50565559, 0x1, 0x6, 0x46, 0x2, 0x3, 0x1, 0x7, 0x0, 0x7}})
ioctl$TIOCGPTPEER(r6, 0x5441, 0x8)
ioctl$sock_inet_SIOCSIFDSTADDR(r0, 0x8918, &(0x7f0000000080)={'ipvlan0\x00', {0x2, 0x4e20, @dev={0xac, 0x14, 0x14, 0x37}}})
executing program 3:
r0 = memfd_create(&(0x7f0000000000)='/dev/sda1\x00', 0x1)
pread64(r0, &(0x7f0000000040)=""/116, 0x74, 0xa2)
prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8}, 0x0)
mkdir(&(0x7f0000000000)='mysys\x00', 0x1ff)
mount(0x0, &(0x7f0000000200)='mysys\x00', &(0x7f0000000300)='sysfs\x00', 0x0, 0x0)
readlink(&(0x7f00000000c0)='mysys/bus/usb/devices/usb1/bNumInterfaces\x00', &(0x7f0000000240)=""/66, 0x42)
r1 = openat(0xffffffffffffff9c, &(0x7f0000000400)='mysys/bus/usb/devices/usb1/bNumInterfaces\x00', 0x0, 0x0)
read(r1, &(0x7f0000000500)=""/16, 0x10)
r2 = socket$nl_route(0x10, 0x3, 0x0)
sendmsg$nl_route(r2, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000100)=@newlink={0x3c, 0x10, 0xffffffffffffffff, 0x70bd25, 0x25dfdbfe, {0x0, 0x0, 0x0, 0x0, 0x1715, 0x4b7bc}, [@IFLA_LINKINFO={0x1c, 0x12, 0x0, 0x1, @bridge={{0xb}, {0xc, 0x2, 0x0, 0x1, [@IFLA_BR_MCAST_ROUTER={0x5, 0x16, 0x1}]}}}]}, 0x3c}, 0x1, 0x0, 0x0, 0x24004844}, 0x0)
executing program 3:
r0 = syz_open_procfs(0x0, &(0x7f0000000240)='net/vlan/vlan0\x00')
preadv(r0, &(0x7f0000000300)=[{&(0x7f0000000000)=""/196, 0xc4}], 0x1, 0xa3, 0x0) (async)
mkdirat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000)='./cgroup.net/syz1\x00', 0x1ff)
r1 = openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000), 0x200002, 0x0)
bpf$BPF_PROG_WITH_BTFID_LOAD(0x5, &(0x7f0000000300)=@bpf_lsm={0xc, 0x4, &(0x7f0000000040)=ANY=[@ANYBLOB="660a0000000000006311770000000000852399d970ecf88f1c98800000000000"], &(0x7f0000000000)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x8}, 0x80) (async, rerun: 64)
r2 = openat$cgroup_int(r1, &(0x7f00000002c0)='blkio.throttle.write_iops_device\x00', 0x2, 0x0) (rerun: 64)
write$cgroup_subtree(r2, &(0x7f00000000c0)=ANY=[], 0x6a) (async)
ioctl$DVB_DEMUX_DMX_GET_PES_PIDS(r0, 0x800a6f2f, &(0x7f0000000100))
executing program 3:
r0 = memfd_create(&(0x7f0000001cc0)='[\v\xdbX\xae[\x1a\xa9\xfd\xfa\xad\xd1md\xc8\x85HX\xa9%\f\x1ae\xe0\x00\x00\x00\x00\xfb\xff\x00\x00\x81\x9eG\xd9,\xe2\xc6a\x9f\xe8\xf1\xb3\x86\xe2+Op\xd0\xa2\x82\x1eb;(\xb5\xe1jS\xd6\x91%||\xa0\x8ez\xadT\xc0sr\x95\xbf3:\x99\x1e\xac`\xc3\xcf\xd3\xae\xd2\a\x11\xa9\xa5^\xff\xf5\x95\xd2q#\x00\x01\x00\x00\xcb\x1e\x80\xd6\xd5%N&\xf8#\x80z8Z\xd2}\xf5\xe4\x9f5\x9b\x01\xf9t\xbb\x1er\x14\xdb\xd3\xcd\xfd\xbdnC\xec', 0x0)
execveat(r0, &(0x7f0000000000)='\x00', 0x0, 0x0, 0x1000) (async)
sendmsg$nl_route(0xffffffffffffffff, &(0x7f0000000200)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000080)=ANY=[@ANYBLOB='8'], 0x38}}, 0x20000000) (async)
r1 = fsopen(&(0x7f0000000180)='proc\x00', 0x1)
fsconfig$FSCONFIG_CMD_CREATE(r1, 0x6, 0x0, 0x0, 0x0) (async)
r2 = fsmount(r1, 0x1, 0x0)
fchdir(r2)
mprotect(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x1)
r3 = socket$inet6_udp(0xa, 0x2, 0x0)
ioctl$sock_ipv6_tunnel_SIOCGETTUNNEL(r3, 0x89f0, &(0x7f0000000100)={'ip6_vti0\x00', &(0x7f0000000080)={'syztnl0\x00', 0x0, 0x29, 0x8, 0x9, 0x8001, 0x10, @loopback, @private1={0xfc, 0x1, '\x00', 0x1}, 0x80, 0x40, 0x5, 0x9}}) (async)
openat(0xffffffffffffff9c, &(0x7f0000000080)='./file1\x00', 0x42, 0x0)
memfd_create(&(0x7f0000000000)='\xfd\x0fm3#/\x00n\xaa\xaa\xe4\x01U\x8b\xc2\f\x03\x19\x9c\x8e\xcb\x90\x00\x00\xaegQ\x0e\x94\\y\x0fU2@\'\x8a\x80\x00$\x12\xfc\xe4.)\x9b\xf2@\xf0\xe0\xdb\x1f\xe6\xb4gc\xe4\xda\xf9\xcd7el\xb7\xe6\b\x00\xd8\x8f\x00\xef\xff\x00vob/~\xc2\x00\b\x00\x00\x00\x00\x00\x00 \xff\xf1\xdem\x9c;%\xb5\"\xe4\xf1x2\x8a\x19p\x04\\\xaa-\x93\xd1\xc4 )\xbfK\xf7E\xf3\x05\xa0\xd0\xe6%\x97\x15\xf0\xab\x86\x90k\x10\xcer\x14\xe0a\xaf\xab\xfe\xd9V\x19\xa5d\x16\x8e]:3\xff\t\xe6\xf7\xb3\xbf\xa3\b[?\xb5\x14t\xd3\x8e\xc0\xe8\xefd\x88\xddz\xa25)\x17\xef\xfb4\xff\xdb\t\x8e\xeb\x1d\\\xf9\x14\xc7\v\xa8\x89\xdb A\xbaBAj\xfe\x18\xc3-+\xd6\xb0K\xee\x1b+\xc7lA\x84\xa6\xfe\x8bU<&\x1a\xe7m\x86\xb7\xa1A\xf9\x02S;C\x99\a.$K\x833\x82\x7f\x1b\'nj\x06\b\xb7\xe8] \x87A[y\xdc\x14\f\xcet\x00\x1f\x0f\xef\xca\xcfz\x7f\an0\xebB\xb8}&\xdd\xc9\xa7\x1dp\t\x92\xceb \x81\xaaq{H\x88\xdf\xf8\x80\\\x1c8\xfe\xc4\xe3\xb0\x90\xcb\x8b1r\x94\x9f\x00\xce\xc8\xc3\x84\xa0\xc9\b\x00uKs\xba\xbbC6\xd6\x13\xb5\xe086EzD\x18\xd5\x16\x88E\xc6\xf0A9\xf1u\xb3\x85\x02\x12\\Sp\xf4\x9a\xe8\x96^\xd9\xa8K\x12\b}\xff\xcb{\xc6\xf6\xb4\x8b\xb6\xa8Y\xf2\x91\xeeR\v#\xb5)\xb0\x99\x9b-p\xe3\x17\x04\xb0\xdc\x0fk\x11\xe1\x9a\a\x16\xb7\x9b\x88\xfa\x1e`\x84$\xfc\xd7\xf5^X\xd8[}\x032\xd0\x84\xdby\x94Vp\xa5\xcd(\xab\xb6\x95sR\xab\xfc\x8c\'\x9c\x16Q\xad\xbc\xb04%\xb7\xe5\x141<\xd9\xad\x9f\x12@!\xfaI\x88\xab\xef\x86\xe9\a>\xdd7\xb7\x8e\x9c0-o\xc9\xec_|\x02\xc8Ru\x95\xa8#U\xd6J\x87\xf6X\xb6{\x11$\x00\xc8\x14\xcb\xd1nK\xd8\xb9\x0e\x9bA\xed\xbcs\x1fS\r\x12O\x83\x15\xcb(\xdb\xb1S\x1f%\x04\x9a\xa0l\xa3}\xe7\xf2<Y\xa1\xdeP\b\xf1kM\x02\x00\x00\x03\x00eA\xb5#>\xa0D-N\xf9\xba!L]h;F[\xe2\x1c<L\xaa\x87A\xcdN#\xfb\xb0\xf2\x1e\x0e#J\xd0hB<\xc0\x82A0)p\xe7&J\x82\x83\x83\xd14\x01\xcf\x1b\xa9\x1d\x1ef\x0f\x86(1\xd6l\xd2\x8f\xb0\xad\t\x15\xdb|\x87\xf1\xc4\xb8\xb2\x9a\xd2A\x80\xbf\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\xd6\x80\x00\x00\x00\x00\x00\x00\x00\x88&}\xd1\x00\x00\x00\xe6\xaf\t\x9f\x96\rN\xc9\x90\xbe\xed\x1ad\x14\xe7\x84\t\'\x8b\x00\xdd\xc9\x0f\x14v\xb6\x04\xf2U\xb4\xf6\xbe\xddT\xcb\x00\x00\x00\x00\x00\x00\xe9\x00\x00\x00\x00\x00\x00o:}\xa7jmH\xedn\x11\xfe\xe2\x0fT\x00\x94\xbc\xc6\x7f\x93eE1xp\xa3\xdc\xd7K9J<\xeb\xd2!\xf4\x19\xbd#\xb8\x83\x858\n\xdc\x12Z\x1a\x12\xfa\xcc\x04\r\xf3\xf4;\v\x15b^\xea\xa2\x04 \xe8\x99\xb3\x97\x9e\r\xb0\x05\xbb(f\xd0\x85\xc5\x15\xae#\x12Q\xacF\xfb\xc8\xbd\xcc#\v\x00\x00\x00\x00\x00\x00\x8f\x9b\x00\x03\xc8}\x11\xbc\x01\x8fi\xf5\x7f\xaf\x11\xfb\x16\x95\xdfc\xc9\x8a/&\x81w\x06]ao\\\x88\xf7\xce\xbd\xb0\xa6J~\x8d\xf1\xe9\x1c\xcfo\xb3\xdc\x04Y\x8e\r\xf5\xa0\xeft\x06G0\xe3D\xd6\xa3L\xedN\x0e\xdc@7\xd8^\xae\xea\x92\xbe\x9c\xf9~c\xc1|\xca\x8d\x93R\xe5\xceU\xa5\x0f\xbf\xd8l\x96`\x05\x00e\x8aR{\x17Y\x15m>\xe26 \x19k&.\x7f\x1d~\xdaI\xd4\x99\a+\xdf]\xbc\xa6\xc3\x0f\x99W\x9c-t\v\xc7J\xfd\x91\x853\xd1j;\x19W\x96V\x8az+\xf9\x82#\xfaC\xa3YN:\xe8\xda\xbc\xb2h\x8f\xe0\xc6d\x96\xccy\xb3\xc2\x98\x1c\xca\xde\"\xaeW\x89\x83\xc2sB\xe7\b\x9b9~}\xc2\xb3\x1d\xcc?\xd1\x89\xef\xca\x00\x00\x00\x00\x00\x00\x00\x00\x00J[\xc4\x04\xc1\xa6\x10\xc2\x9d\x11\t|\xc0\t\xd9(\x80\xe6s\xaa\x88\x8a\xd6\xa2\x01\x10W]Z\x8d\xf7\xd1P\xf9d\x01|\xa3\x03hSq\x95\x8f\xe1J\xd3#/fcCz\xff\x80\xe2M\xa3-r\xf6\x1a\xd74\xdc\xe1\xe4\xc3\x9dU t}\x02\xb7>j0S\xf4\x98\x05\xb9\x15}\xfa\"\xdc\xc2r\xf9\a\xadnD\xb6\x06\xd3\'\x10\x9f|\x17\xd6\x89O\f\x98@\x85\xa5m\x9d\\&\x17o\x11Z=l\xfb\x93\x8exZ\x00\x00\xeaq\xbb\x03&\xb4mi\xc7\xff\xca\xd8\x9f\xae\xa3\x04\xaa\x10\xe7\x98\xe48\x8d', 0x3) (async)
r4 = syz_open_dev$swradio(&(0x7f00000048c0), 0x0, 0x2)
ioctl$VIDIOC_G_FREQUENCY(r4, 0xc02c5638, &(0x7f0000000140)={0x5, 0x4, 0x9}) (async)
r5 = socket$nl_netfilter(0x10, 0x3, 0xc)
sendmsg$NFT_BATCH(r5, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000240)=ANY=[@ANYBLOB="140000001000010000000000000000000500000a28000000000a030000000000000000000a00000708000240000000020900010073797a31000000002c000000030a010100000000000000000a0000070900010073797a31000000000900030073797a3200000000140000001100"], 0x7c}, 0x1, 0x0, 0x0, 0x20004001}, 0x4000018) (async)
sendmsg$NFT_BATCH(r5, &(0x7f0000009b40)={0x0, 0x0, &(0x7f0000009b00)={&(0x7f0000000500)=ANY=[@ANYBLOB="140000001000010000000000000000000500000a70000000090a010400000000000000000a0000040900020073797a310000000008000a40ffffdffc0900010073797a3100000000080005400000000d2c001280280001800a00010071756f7461000000180002800c000140000000000000000408000240000000000800034000000130140000001100010000000000000000000100000a"], 0x98}, 0x1, 0x0, 0x0, 0x4040010}, 0x4000000)
executing program 3:
seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0x0, &(0x7f00000000c0)={0x1, &(0x7f0000000040)=[{0x6, 0x0, 0x0, 0x7fffffff}]}) (async)
r0 = seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0x0, &(0x7f00000000c0)={0x1, &(0x7f0000000040)=[{0x6, 0x0, 0x0, 0x7fffffff}]})
r1 = socket$nl_route(0x10, 0x3, 0x0)
ioctl$sock_SIOCGIFINDEX(r1, 0x8933, &(0x7f0000000340)={'virt_wifi0\x00', <r2=>0x0})
sendmsg$nl_route_sched(r1, &(0x7f0000000b00)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000640)=@delqdisc={0x2dc, 0x26, 0x1, 0x70ad2b, 0x25dfdbfc, {0x0, 0x0, 0x0, r2, {}, {0xffff, 0xffff}, {0xf, 0x3}}, [@qdisc_kind_options=@q_taprio={{0xb}, {0x2c, 0x2, [@TCA_TAPRIO_ATTR_SCHED_CLOCKID={0x8, 0x5, 0x7f}, @TCA_TAPRIO_ATTR_SCHED_BASE_TIME={0xc, 0x3, 0xffff}, @TCA_TAPRIO_ATTR_SCHED_CLOCKID={0x8}, @TCA_TAPRIO_ATTR_SCHED_BASE_TIME={0xc, 0x3, 0x5}]}}, @TCA_STAB={0xa0, 0x8, 0x0, 0x1, [{{0x1c, 0x1, {0x60, 0x7, 0x9, 0x0, 0x0, 0xd, 0xc2, 0x1}}, {0x6, 0x2, [0x3]}}, {{0x1c, 0x1, {0x9, 0x7, 0x1, 0x4, 0x0, 0x7, 0x2, 0x9}}, {0x16, 0x2, [0x0, 0x0, 0xffff, 0xbacf, 0xa, 0x6, 0x8, 0x3ff, 0x7]}}, {{0x1c, 0x1, {0x7f, 0x0, 0xd995, 0x3ff, 0x0, 0x3, 0x3, 0x1}}, {0x6, 0x2, [0x7f]}}, {{0x1c, 0x1, {0x1, 0x10, 0x1, 0x0, 0x0, 0x7}}, {0x4}}]}, @qdisc_kind_options=@q_cake={{0x9}, {0x2c, 0x2, [@TCA_CAKE_DIFFSERV_MODE={0x8}, @TCA_CAKE_RAW={0x8}, @TCA_CAKE_MPU={0x8, 0xe, 0xb9}, @TCA_CAKE_NAT={0x8}, @TCA_CAKE_MEMORY={0x8, 0xa, 0x80000001}]}}, @TCA_STAB={0xc4, 0x8, 0x0, 0x1, [{{0x1c, 0x1, {0x1, 0x0, 0x4, 0x8, 0x2, 0x962a, 0x1486, 0x3}}, {0xa, 0x2, [0x4, 0x9, 0x81]}}, {{0x1c, 0x1, {0x3, 0x6, 0x3, 0x1c00000, 0x0, 0x9ea1, 0x5, 0x1}}, {0x6, 0x2, [0x6]}}, {{0x1c, 0x1, {0x95, 0x1, 0x8, 0x200, 0x0, 0x3fe, 0x400, 0x2}}, {0x8, 0x2, [0x85, 0x4]}}, {{0x1c, 0x1, {0xa0, 0x1, 0x9, 0x5e, 0x1, 0x10001, 0x5, 0x5}}, {0xe, 0x2, [0x4, 0xfdf, 0x1154, 0x10ed, 0x9]}}, {{0x1c, 0x1, {0xc3, 0x5, 0x5, 0xb473, 0x2, 0xfffffff7, 0x1ff, 0x2}}, {0x8, 0x2, [0x81, 0x685c]}}]}, @TCA_RATE={0x6, 0x5, {0x7, 0x1}}, @TCA_STAB={0xd4, 0x8, 0x0, 0x1, [{{0x1c, 0x1, {0x5, 0x66, 0x1ff, 0x4b, 0x1, 0x870, 0xfffffffa, 0x1}}, {0x6, 0x2, [0x9]}}, {{0x1c, 0x1, {0x2, 0x4a, 0x6, 0x6, 0x1, 0xa, 0x4, 0x5}}, {0xe, 0x2, [0x101, 0x7f, 0xf457, 0x7, 0x7]}}, {{0x1c, 0x1, {0x3, 0x10, 0x9, 0x8001, 0x0, 0x6, 0xffff, 0xa}}, {0x18, 0x2, [0x3b4, 0x4, 0x78, 0x2000, 0x67, 0x1, 0x1, 0xc, 0xa, 0x8]}}, {{0x1c, 0x1, {0x1, 0x55, 0x3b0, 0xa, 0x2, 0x0, 0x0, 0x3}}, {0xa, 0x2, [0x0, 0x8, 0x0]}}, {{0x1c, 0x1, {0x0, 0x0, 0x6, 0x925, 0x0, 0x2, 0x3, 0x2}}, {0x8, 0x2, [0x1, 0x9]}}]}, @TCA_INGRESS_BLOCK={0x8, 0xd, 0x1}]}, 0x2dc}, 0x1, 0x0, 0x0, 0x4081}, 0x0) (async)
sendmsg$nl_route_sched(r1, &(0x7f0000000b00)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000640)=@delqdisc={0x2dc, 0x26, 0x1, 0x70ad2b, 0x25dfdbfc, {0x0, 0x0, 0x0, r2, {}, {0xffff, 0xffff}, {0xf, 0x3}}, [@qdisc_kind_options=@q_taprio={{0xb}, {0x2c, 0x2, [@TCA_TAPRIO_ATTR_SCHED_CLOCKID={0x8, 0x5, 0x7f}, @TCA_TAPRIO_ATTR_SCHED_BASE_TIME={0xc, 0x3, 0xffff}, @TCA_TAPRIO_ATTR_SCHED_CLOCKID={0x8}, @TCA_TAPRIO_ATTR_SCHED_BASE_TIME={0xc, 0x3, 0x5}]}}, @TCA_STAB={0xa0, 0x8, 0x0, 0x1, [{{0x1c, 0x1, {0x60, 0x7, 0x9, 0x0, 0x0, 0xd, 0xc2, 0x1}}, {0x6, 0x2, [0x3]}}, {{0x1c, 0x1, {0x9, 0x7, 0x1, 0x4, 0x0, 0x7, 0x2, 0x9}}, {0x16, 0x2, [0x0, 0x0, 0xffff, 0xbacf, 0xa, 0x6, 0x8, 0x3ff, 0x7]}}, {{0x1c, 0x1, {0x7f, 0x0, 0xd995, 0x3ff, 0x0, 0x3, 0x3, 0x1}}, {0x6, 0x2, [0x7f]}}, {{0x1c, 0x1, {0x1, 0x10, 0x1, 0x0, 0x0, 0x7}}, {0x4}}]}, @qdisc_kind_options=@q_cake={{0x9}, {0x2c, 0x2, [@TCA_CAKE_DIFFSERV_MODE={0x8}, @TCA_CAKE_RAW={0x8}, @TCA_CAKE_MPU={0x8, 0xe, 0xb9}, @TCA_CAKE_NAT={0x8}, @TCA_CAKE_MEMORY={0x8, 0xa, 0x80000001}]}}, @TCA_STAB={0xc4, 0x8, 0x0, 0x1, [{{0x1c, 0x1, {0x1, 0x0, 0x4, 0x8, 0x2, 0x962a, 0x1486, 0x3}}, {0xa, 0x2, [0x4, 0x9, 0x81]}}, {{0x1c, 0x1, {0x3, 0x6, 0x3, 0x1c00000, 0x0, 0x9ea1, 0x5, 0x1}}, {0x6, 0x2, [0x6]}}, {{0x1c, 0x1, {0x95, 0x1, 0x8, 0x200, 0x0, 0x3fe, 0x400, 0x2}}, {0x8, 0x2, [0x85, 0x4]}}, {{0x1c, 0x1, {0xa0, 0x1, 0x9, 0x5e, 0x1, 0x10001, 0x5, 0x5}}, {0xe, 0x2, [0x4, 0xfdf, 0x1154, 0x10ed, 0x9]}}, {{0x1c, 0x1, {0xc3, 0x5, 0x5, 0xb473, 0x2, 0xfffffff7, 0x1ff, 0x2}}, {0x8, 0x2, [0x81, 0x685c]}}]}, @TCA_RATE={0x6, 0x5, {0x7, 0x1}}, @TCA_STAB={0xd4, 0x8, 0x0, 0x1, [{{0x1c, 0x1, {0x5, 0x66, 0x1ff, 0x4b, 0x1, 0x870, 0xfffffffa, 0x1}}, {0x6, 0x2, [0x9]}}, {{0x1c, 0x1, {0x2, 0x4a, 0x6, 0x6, 0x1, 0xa, 0x4, 0x5}}, {0xe, 0x2, [0x101, 0x7f, 0xf457, 0x7, 0x7]}}, {{0x1c, 0x1, {0x3, 0x10, 0x9, 0x8001, 0x0, 0x6, 0xffff, 0xa}}, {0x18, 0x2, [0x3b4, 0x4, 0x78, 0x2000, 0x67, 0x1, 0x1, 0xc, 0xa, 0x8]}}, {{0x1c, 0x1, {0x1, 0x55, 0x3b0, 0xa, 0x2, 0x0, 0x0, 0x3}}, {0xa, 0x2, [0x0, 0x8, 0x0]}}, {{0x1c, 0x1, {0x0, 0x0, 0x6, 0x925, 0x0, 0x2, 0x3, 0x2}}, {0x8, 0x2, [0x1, 0x9]}}]}, @TCA_INGRESS_BLOCK={0x8, 0xd, 0x1}]}, 0x2dc}, 0x1, 0x0, 0x0, 0x4081}, 0x0)
close_range(r0, 0xffffffffffffffff, 0x0) (async)
close_range(r0, 0xffffffffffffffff, 0x0)
sendmsg$nl_route_sched(r1, &(0x7f0000000380)={&(0x7f0000000240)={0x10, 0x0, 0x0, 0x2000000}, 0xc, &(0x7f0000000300)={&(0x7f00000002c0)=@delqdisc={0x3c, 0x25, 0x400, 0x70bd29, 0x25dfdbfb, {0x0, 0x0, 0x0, r2, {0xe, 0x6}, {}, {0x2, 0x4}}, [@TCA_RATE={0x6, 0x5, {0x2}}, @TCA_EGRESS_BLOCK={0x8, 0xe, 0x5}, @TCA_INGRESS_BLOCK={0x8, 0xd, 0x7}]}, 0x3c}, 0x1, 0x0, 0x0, 0x42805}, 0x20040002)
socket$inet_udp(0x2, 0x2, 0x0)
r3 = socket$inet6_tcp(0xa, 0x1, 0x0)
bind$inet6(r3, &(0x7f0000000080)={0xa, 0x2, 0x200, @loopback, 0x7}, 0x1c) (async)
bind$inet6(r3, &(0x7f0000000080)={0xa, 0x2, 0x200, @loopback, 0x7}, 0x1c)
sendto$inet6(r3, 0x0, 0x0, 0x24000045, &(0x7f00000001c0)={0xa, 0x2, 0xffff, @loopback, 0x9}, 0x1c)
setsockopt$inet6_tcp_TCP_CONGESTION(r3, 0x6, 0xd, &(0x7f0000000140)='illinois', 0x8)
shutdown(r3, 0x1)
r4 = socket$nl_route(0x10, 0x3, 0x0)
r5 = socket$nl_route(0x10, 0x3, 0x0)
setsockopt$netlink_NETLINK_NO_ENOBUFS(r5, 0x10e, 0xc, &(0x7f0000000040)=0x7f, 0x4) (async)
setsockopt$netlink_NETLINK_NO_ENOBUFS(r5, 0x10e, 0xc, &(0x7f0000000040)=0x7f, 0x4)
r6 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0)
r7 = ioctl$KVM_CREATE_VM(r6, 0xae01, 0x0)
r8 = ioctl$KVM_CREATE_GUEST_MEMFD(r7, 0xc040aed4, &(0x7f00000001c0)={0x1000200001ee0000, 0x3})
mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xa, 0x28011, r8, 0x78d4a000)
get_mempolicy(0x0, 0x0, 0x3, &(0x7f000024c000/0x2000)=nil, 0x2) (async)
get_mempolicy(0x0, 0x0, 0x3, &(0x7f000024c000/0x2000)=nil, 0x2)
syz_init_net_socket$nl_generic(0x10, 0x3, 0x10)
sendmsg$nl_route(r5, &(0x7f0000000100)={0x0, 0x20, &(0x7f00000000c0)={&(0x7f0000000000)=ANY=[@ANYBLOB="240000001a0001000000ff7f0000000080200000", @ANYRES32=0x0, @ANYBLOB='\x00\x00\x00\x00\b\x00', @ANYRES32=r5], 0x24}}, 0x0) (async)
sendmsg$nl_route(r5, &(0x7f0000000100)={0x0, 0x20, &(0x7f00000000c0)={&(0x7f0000000000)=ANY=[@ANYBLOB="240000001a0001000000ff7f0000000080200000", @ANYRES32=0x0, @ANYBLOB='\x00\x00\x00\x00\b\x00', @ANYRES32=r5], 0x24}}, 0x0)
r9 = fsopen(&(0x7f0000000280)='ceph\x00', 0x0)
r10 = socket$inet(0x2, 0x2, 0x0)
bpf$PROG_LOAD(0x5, &(0x7f0000000080)={0x1, 0x5, &(0x7f0000002c00)=ANY=[@ANYBLOB="bf16000000000000b70700000900f0ff4070000000000000500000000000000095000000000000002ba728041598d6fbd30cb599e8c73d24a3aa81d36bb3019c13bd23212fb56fa54f26fb0b71d0e6adfefc41d86bd917487960717142fa9ea4318123741c0a0e168c1886d0d4d94f2f4e345c652ebc1626e3a2a2ad35806150ae0209e62f51ee988e6e0dc8ce974a22a550d6fd70800c86ae3b3e05df3ceb9fc474c2a100c788b277beee1cbf9b0a4def23d410f6296b32a8343881dcc7b1b85f3c3d44aeaccd3641110bec4e90a6341965c39e4b3449abe802f5ab3e89cf6c662ed4048d3b3e22278d00031e5388ee6f867ddd58211d6ececb0cd2b6d357b8580218ce740068725837074e468ee23fd2f73902ebcfcf49822775985bf31b715f5888b2c81f96a810b946855c9fc52ac17cbc97a616811a4c2dc3470009b966abaf41939aeca3e7b00c2e9d5db7a34fe2a29ac88c360a878a2b9ab9440c1961e80477166f3f847e855cdddc941d996d61ea0ce23b37e9d21c849d1e1e53087a3b109012e3a3ecbd219265048bf5c72b7ba2806b73323301b4bc94d0e4afde44867d71049a7c89bc615e215571ac910d80a58b5169576ff9906c34d2342806960b6bcb00000000000000000000000000113ee640b9ed1e04a0bfb125204d30990361bf45ef45277a167cd2c2e6ce9138143aa5ea7ee6f7c6d8b00437e070b004c5aa90766538b4fe45a16f14b270904d36eaa87508ac6d46639b3971ac6a88dc531fcc5ffc6b76b334795d88156336a9a452a9022485bb572dacb7aa25f748bc75918a16d9d5ae21004cd799ac4951beb2c6c9b5baf60081b86cc2e31c49f4ea055fb3639036c95c69b1ae60e685d486dbd1d5e7d0daacd73acfc80b9c9c92"], &(0x7f0000000140)='GPL\x00'}, 0x48) (async)
r11 = bpf$PROG_LOAD(0x5, &(0x7f0000000080)={0x1, 0x5, &(0x7f0000002c00)=ANY=[@ANYBLOB="bf16000000000000b70700000900f0ff4070000000000000500000000000000095000000000000002ba728041598d6fbd30cb599e8c73d24a3aa81d36bb3019c13bd23212fb56fa54f26fb0b71d0e6adfefc41d86bd917487960717142fa9ea4318123741c0a0e168c1886d0d4d94f2f4e345c652ebc1626e3a2a2ad35806150ae0209e62f51ee988e6e0dc8ce974a22a550d6fd70800c86ae3b3e05df3ceb9fc474c2a100c788b277beee1cbf9b0a4def23d410f6296b32a8343881dcc7b1b85f3c3d44aeaccd3641110bec4e90a6341965c39e4b3449abe802f5ab3e89cf6c662ed4048d3b3e22278d00031e5388ee6f867ddd58211d6ececb0cd2b6d357b8580218ce740068725837074e468ee23fd2f73902ebcfcf49822775985bf31b715f5888b2c81f96a810b946855c9fc52ac17cbc97a616811a4c2dc3470009b966abaf41939aeca3e7b00c2e9d5db7a34fe2a29ac88c360a878a2b9ab9440c1961e80477166f3f847e855cdddc941d996d61ea0ce23b37e9d21c849d1e1e53087a3b109012e3a3ecbd219265048bf5c72b7ba2806b73323301b4bc94d0e4afde44867d71049a7c89bc615e215571ac910d80a58b5169576ff9906c34d2342806960b6bcb00000000000000000000000000113ee640b9ed1e04a0bfb125204d30990361bf45ef45277a167cd2c2e6ce9138143aa5ea7ee6f7c6d8b00437e070b004c5aa90766538b4fe45a16f14b270904d36eaa87508ac6d46639b3971ac6a88dc531fcc5ffc6b76b334795d88156336a9a452a9022485bb572dacb7aa25f748bc75918a16d9d5ae21004cd799ac4951beb2c6c9b5baf60081b86cc2e31c49f4ea055fb3639036c95c69b1ae60e685d486dbd1d5e7d0daacd73acfc80b9c9c92"], &(0x7f0000000140)='GPL\x00'}, 0x48)
setsockopt$IPT_SO_SET_REPLACE(r10, 0x0, 0x40, &(0x7f0000000a80)=@raw={'raw\x00', 0x8, 0x3, 0x450, 0x2e8, 0x40000, 0x198, 0x2e8, 0x198, 0x3b8, 0x358, 0x358, 0x3b8, 0x358, 0x3, 0x0, {[{{@ip={@multicast2, @dev={0xac, 0x14, 0x14, 0x16}, 0x0, 0x0, 'vcan0\x00', 'wg1\x00', {}, {}, 0x0, 0x1}, 0x0, 0x2c8, 0x2e8, 0x0, {}, [@common=@unspec=@bpf1={{0x230}, @fd={0x2, 0x0, r11}}, @inet=@rpfilter={{0x28}, {0x9}}]}, @unspec=@TRACE={0x20}}, {{@ip={@remote, @dev, 0x0, 0x0, 'team_slave_1\x00', 'netdevsim0\x00', {}, {}, 0x0, 0x2}, 0x0, 0x70, 0xd0}, @common=@CLUSTERIP={0x60, 'CLUSTERIP\x00', 0x0, {0x0, @empty, 0x3, 0x10, [0x48, 0x37, 0x32, 0x26, 0x2, 0x2d, 0x29, 0x17, 0x23, 0x1c, 0xe, 0x38, 0xb, 0x22, 0x27, 0xd], 0x2, 0x4b, 0x9}}}], {{'\x00', 0x0, 0x70, 0x98}, {0x28, '\x00', 0x4}}}}, 0x4b0) (async)
setsockopt$IPT_SO_SET_REPLACE(r10, 0x0, 0x40, &(0x7f0000000a80)=@raw={'raw\x00', 0x8, 0x3, 0x450, 0x2e8, 0x40000, 0x198, 0x2e8, 0x198, 0x3b8, 0x358, 0x358, 0x3b8, 0x358, 0x3, 0x0, {[{{@ip={@multicast2, @dev={0xac, 0x14, 0x14, 0x16}, 0x0, 0x0, 'vcan0\x00', 'wg1\x00', {}, {}, 0x0, 0x1}, 0x0, 0x2c8, 0x2e8, 0x0, {}, [@common=@unspec=@bpf1={{0x230}, @fd={0x2, 0x0, r11}}, @inet=@rpfilter={{0x28}, {0x9}}]}, @unspec=@TRACE={0x20}}, {{@ip={@remote, @dev, 0x0, 0x0, 'team_slave_1\x00', 'netdevsim0\x00', {}, {}, 0x0, 0x2}, 0x0, 0x70, 0xd0}, @common=@CLUSTERIP={0x60, 'CLUSTERIP\x00', 0x0, {0x0, @empty, 0x3, 0x10, [0x48, 0x37, 0x32, 0x26, 0x2, 0x2d, 0x29, 0x17, 0x23, 0x1c, 0xe, 0x38, 0xb, 0x22, 0x27, 0xd], 0x2, 0x4b, 0x9}}}], {{'\x00', 0x0, 0x70, 0x98}, {0x28, '\x00', 0x4}}}}, 0x4b0)
fsconfig$FSCONFIG_SET_STRING(r9, 0x1, &(0x7f0000000b40)='source', &(0x7f0000000040)='c:::\x00', 0x0)
sendmsg$nl_route(r4, &(0x7f0000000200)={&(0x7f0000000080)={0x10, 0x0, 0x0, 0x10000}, 0xc, &(0x7f00000001c0)={&(0x7f00000003c0)=ANY=[@ANYBLOB="60000000680010002bbd7000fcdbdf250000016c628248000400000006000700030000001400060000000000000000000000ffffe000020400040014000600fe8000000000000000000000000000bb0600030001000000040004000600070016b6b1c3743f50f418c7e7dbbf400f4572129ee24d86ca5ff823d02b29be494923a8aaa4b47d7ef1f3a28fec72c6abbaea5dda008b8a3bb6235999664625c8cfdcaa6615a8f7df4f233cafa3d868e661ad4e3ceb5891fb925df0d2781bae0c773fc9b8b083ba36c4398576350a6845daecae5c72af66c7b7eac1fe54ead22a31399b288ac47d54b2adff1bc71e1cf0b0caca6f91f721e4e5b4884effb45269ebc565ec33f8b8ca63800344014c"], 0x60}}, 0x800)
gettid()
fsconfig$FSCONFIG_CMD_CREATE(r9, 0x6, 0x0, 0x0, 0x0) (async)
fsconfig$FSCONFIG_CMD_CREATE(r9, 0x6, 0x0, 0x0, 0x0)
executing program 3:
socket$nl_netfilter(0x10, 0x3, 0xc)
r0 = socket$inet6_tcp(0xa, 0x1, 0x0)
connect$inet6(r0, 0x0, 0x0)
r1 = gettid()
timer_create(0x0, &(0x7f0000533fa0)={0x0, 0x21, 0x800000000004, @tid=r1}, &(0x7f0000000140))
timer_settime(0x0, 0x0, &(0x7f0000000280)={{0x0, 0x989680}, {0x0, 0x989680}}, 0x0)
mmap$IORING_OFF_SQ_RING(0x110c230000, 0x8000002, 0x2000007, 0x401d031, 0xffffffffffffffff, 0x0)
socketpair$unix(0x1, 0x0, 0x0, 0x0)
openat$ptmx(0xffffffffffffff9c, 0x0, 0x482, 0x0)
r2 = socket(0x1, 0x2, 0x0)
getsockopt$sock_cred(r2, 0x1, 0x11, 0x0, &(0x7f0000cab000))
setsockopt$sock_cred(0xffffffffffffffff, 0x1, 0x11, 0x0, 0x0)
lremovexattr(0x0, 0x0)
setsockopt$inet6_tcp_TCP_REPAIR_QUEUE(r0, 0x6, 0x14, 0x0, 0x0)
mmap(&(0x7f0000000000/0x4000)=nil, 0x4000, 0x1, 0x10012, 0xffffffffffffffff, 0x5deba000)
mmap(&(0x7f0000bfe000/0x400000)=nil, 0x400000, 0x4, 0x40010, r0, 0xd1aa000)
mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x3, 0x8031, 0xffffffffffffffff, 0x0)
r3 = openat$audio(0xffffffffffffff9c, &(0x7f0000000380), 0x149842, 0x0)
write$dsp(r3, &(0x7f00000003c0)="91", 0xffffffb5)
mmap$dsp(&(0x7f0000ffd000/0x2000)=nil, 0x2000, 0x100000b, 0x810, r3, 0x0)
close(r3)
socket$xdp(0x2c, 0x3, 0x0)
r4 = socket$kcm(0xa, 0x2, 0x0)
setsockopt$inet6_tcp_TCP_CONGESTION(r0, 0x6, 0xd, &(0x7f0000000040)='veno', 0x4)
r5 = socket(0x2, 0x80805, 0x0)
r6 = openat$fuse(0xffffffffffffff9c, &(0x7f0000000080), 0x2, 0x0)
read$FUSE(r6, &(0x7f0000000600)={0x2020}, 0x2020)
setsockopt$IP_VS_SO_SET_ADD(r5, 0x0, 0x482, &(0x7f0000000240)={0x84, @dev={0xac, 0x14, 0x14, 0x15}, 0x4e20, 0x3, 'wlc\x00', 0x2, 0x660f537e, 0x3}, 0x2c)
setsockopt$IP_VS_SO_SET_ADDDEST(r5, 0x0, 0x487, &(0x7f0000000440)={{0x84, @multicast2, 0x4e22, 0x3, 'ovf\x00', 0x5, 0xc, 0x6c}, {@private=0xa010101, 0x4e23, 0x10002, 0x1, 0x1}}, 0x44)
sendmsg$sock(r4, &(0x7f0000000400)={&(0x7f0000000580)=@in6={0x2, 0x4e20, 0x0, @dev={0xfe, 0x80, '\x00', 0xfd}}, 0x80, 0x0, 0x0, &(0x7f0000000000)=[@mark={{0x14, 0x1, 0x24, 0x3}}], 0x18}, 0x0)
executing program 3:
r0 = syz_usb_connect(0x0, 0x32, &(0x7f0000000000)=ANY=[@ANYBLOB="1201000200000040a61b01000100000000010902200001010080320904"], 0x0)
r1 = openat$ptp1(0xffffffffffffff9c, &(0x7f0000000c40), 0x149201, 0x0)
ioctl$PTP_ENABLE_PPS(r1, 0x40043d04, 0x1)
r2 = socket$kcm(0x10, 0x2, 0x4)
sendmsg$inet(r2, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)=[{&(0x7f0000000100)="5c00000012006bab9e3fe3d86e6c1d0000147ea60864160af36504b68675f8001d000a00a0e69ee517d34460bc24eab556a705251e6182949a36c23d3b48dfd8cdbf9367b4fa51f60a64c9f4080003680601000008000300ff000000", 0x5c}], 0x1, 0x0, 0x0, 0x1f00c00e}, 0x0)
r3 = syz_usb_connect$uac3(0x3, 0x80, &(0x7f0000000280)=ANY=[], 0x0)
syz_usb_control_io(r0, 0x0, 0x0)
syz_usb_control_io$sierra_net(r0, 0x0, &(0x7f0000000700)={0x1c, &(0x7f0000000280)=ANY=[], 0x0, 0x0})
syz_usb_control_io$uac3(r3, 0x0, 0x0)
syz_usb_control_io$printer(r0, 0x0, &(0x7f00000005c0)={0x34, &(0x7f00000003c0)=ANY=[], 0x0, 0x0, 0x0, 0x0, 0x0})
mkdirat(0xffffffffffffff9c, &(0x7f0000000200)='./file0\x00', 0x0)
r4 = openat(0xffffffffffffff9c, &(0x7f0000000080)='./file0\x00', 0x0, 0xd5)
ioctl$FS_IOC_GETFLAGS(r4, 0x80086601, &(0x7f0000000100))
syz_open_dev$dvb_frontend(&(0x7f0000000100), 0x1, 0x802)
r5 = socket$inet6_sctp(0xa, 0x801, 0x84)
getsockopt$bt_hci(r5, 0x84, 0x81, &(0x7f0000001280)=""/4107, &(0x7f00000000c0)=0x100b)
r6 = socket$rxrpc(0x21, 0x2, 0x2)
setsockopt$RXRPC_MIN_SECURITY_LEVEL(r6, 0x110, 0x4, &(0x7f0000000440)=0x1, 0x4)
syz_usb_connect(0x0, 0x32, &(0x7f0000000000)=ANY=[@ANYBLOB="1201000200000040a61b01000100000000010902200001010080320904"], 0x0) (async)
openat$ptp1(0xffffffffffffff9c, &(0x7f0000000c40), 0x149201, 0x0) (async)
ioctl$PTP_ENABLE_PPS(r1, 0x40043d04, 0x1) (async)
socket$kcm(0x10, 0x2, 0x4) (async)
sendmsg$inet(r2, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)=[{&(0x7f0000000100)="5c00000012006bab9e3fe3d86e6c1d0000147ea60864160af36504b68675f8001d000a00a0e69ee517d34460bc24eab556a705251e6182949a36c23d3b48dfd8cdbf9367b4fa51f60a64c9f4080003680601000008000300ff000000", 0x5c}], 0x1, 0x0, 0x0, 0x1f00c00e}, 0x0) (async)
syz_usb_connect$uac3(0x3, 0x80, &(0x7f0000000280)=ANY=[], 0x0) (async)
syz_usb_control_io(r0, 0x0, 0x0) (async)
syz_usb_control_io$sierra_net(r0, 0x0, &(0x7f0000000700)={0x1c, &(0x7f0000000280)=ANY=[], 0x0, 0x0}) (async)
syz_usb_control_io$uac3(r3, 0x0, 0x0) (async)
syz_usb_control_io$printer(r0, 0x0, &(0x7f00000005c0)={0x34, &(0x7f00000003c0)=ANY=[], 0x0, 0x0, 0x0, 0x0, 0x0}) (async)
mkdirat(0xffffffffffffff9c, &(0x7f0000000200)='./file0\x00', 0x0) (async)
openat(0xffffffffffffff9c, &(0x7f0000000080)='./file0\x00', 0x0, 0xd5) (async)
ioctl$FS_IOC_GETFLAGS(r4, 0x80086601, &(0x7f0000000100)) (async)
syz_open_dev$dvb_frontend(&(0x7f0000000100), 0x1, 0x802) (async)
socket$inet6_sctp(0xa, 0x801, 0x84) (async)
getsockopt$bt_hci(r5, 0x84, 0x81, &(0x7f0000001280)=""/4107, &(0x7f00000000c0)=0x100b) (async)
socket$rxrpc(0x21, 0x2, 0x2) (async)
setsockopt$RXRPC_MIN_SECURITY_LEVEL(r6, 0x110, 0x4, &(0x7f0000000440)=0x1, 0x4) (async)
executing program 2:
r0 = syz_open_dev$dri(&(0x7f0000000040), 0x0, 0x442a02)
ioctl$DRM_IOCTL_GET_MAGIC(r0, 0x80046402, 0x0)
r1 = seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0x0, &(0x7f0000000040)={0x1, &(0x7f0000000000)=[{0x6, 0x0, 0x0, 0x7fff8000}]})
close_range(r1, 0xffffffffffffffff, 0x0)
madvise(&(0x7f0000f19000/0x1000)=nil, 0x1000, 0xa)
openat$cgroup_type(0xffffffffffffffff, &(0x7f0000000140), 0x2, 0x0)
r2 = fcntl$dupfd(r0, 0x0, r1)
r3 = seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0x0, &(0x7f0000000000)={0x1, &(0x7f0000000100)=[{0x6, 0x0, 0xff, 0x7fff0000}]})
r4 = syz_init_net_socket$bt_l2cap(0x1f, 0x1, 0x3)
bind$bt_l2cap(r4, &(0x7f0000000280)={0x1f, 0x0, @none, 0x0, 0x2}, 0xe)
listen(r4, 0x1)
close_range(r3, 0xffffffffffffffff, 0x0)
r5 = syz_kvm_add_vcpu$x86(0x0, &(0x7f0000000700)={0x0, &(0x7f00000002c0)=[@set_irq_handler={0xc8, 0x20, {0x8a, 0x1}}, @uexit={0x0, 0x18, 0x3}, @nested_amd_inject_event={0x180, 0x38, {0x2, 0xc0, 0x2, 0x31ec194800000000, 0x3}}, @enable_nested={0x12c, 0x18}, @set_irq_handler={0xc8, 0x20, {0xb2, 0x1}}, @nested_amd_invlpga={0x17d, 0x20, {0x25001, 0xa8e8}}, @nested_amd_set_intercept={0x181, 0x30, {0x3, 0x800, 0x8, 0x1}}, @wrmsr={0x65, 0x20, {0x2af, 0x2}}, @nested_amd_stgi={0x17e, 0x10}, @code={0xa, 0x88, {"66f3470f09470f4c44810036f3f366470f86074100006467366667653e660f3880336464f661a8c7442400c6000000c7442402ea840000ff2c240f21f4b90a030000b821000000ba000000000f3048b800980000000000000f23c00f21f83501000e000f23f8b9820b0000b8a149ad8fbad55194300f30"}}, @wrmsr={0x65, 0x20, {0x236, 0x8000000000}}, @wrmsr={0x65, 0x20, {0xa61, 0x9}}, @nested_vmresume={0x130, 0x18, 0x2}, @nested_amd_inject_event={0x180, 0x38, {0x3, 0x86, 0x2, 0x4, 0x1}}, @cpuid={0x64, 0x18, {0x6}}, @nested_intel_vmwrite_mask={0x154, 0x38, {0x3, @ro32=0x440e, 0x4, 0x8fc, 0x3ff}}, @code={0xa, 0x57, {"2e0f38026e07b9bf0a00000f326543d877c1640f070f350f01df66b8fa008ed848b864930000000000000f23c80f21f8350c0020000f23f80f009f0b000000b96d0a00000f32"}}, @nested_amd_stgi={0x17e, 0x10}, @enable_nested={0x12c, 0x18}, @nested_load_syzos={0x136, 0x70, {0x0, 0x91b2, [@set_irq_handler={0xc8, 0x20, {0xe6, 0x2}}, @nested_amd_set_intercept={0x181, 0x30, {0x3, 0x8000000000000001, 0x4, 0x1}}]}}, @nested_amd_set_intercept={0x181, 0x30, {0x3, 0xffffffffffffffff, 0xb13b, 0x1}}, @rdmsr={0x66, 0x18, {0x9a4}}, @nested_amd_set_intercept={0x181, 0x30, {0x3, 0x8, 0xe3, 0x1}}, @nested_intel_vmwrite_mask={0x154, 0x38, {0x1, @control16=0x4, 0x9, 0x5, 0x6}}], 0x42f})
ioctl$KVM_GET_XSAVE2(r5, 0x9000aecf, &(0x7f0000ffd000/0x2000)=nil)
epoll_ctl$EPOLL_CTL_DEL(r2, 0x2, r0)
prctl$PR_SET_VMA(0x53564d41, 0x0, &(0x7f0000f19000/0x1000)=nil, 0x1000, &(0x7f0000000000)='/{!+]\x00')
ioctl$AUTOFS_DEV_IOCTL_FAIL(0xffffffffffffffff, 0xc0189377, &(0x7f0000000080)={{0x1, 0x1, 0x18, <r6=>r1, {0x1d, 0x296f5e09}}, './file0\x00'})
ioctl$UFFDIO_REGISTER(r6, 0xc020aa00, &(0x7f00000000c0)={{&(0x7f0000f19000/0x1000)=nil, 0x1000}, 0x2})
ioctl$SNDRV_TIMER_IOCTL_START(r6, 0x54a0)
executing program 2:
symlinkat(&(0x7f0000000080)='.\x00', 0xffffffffffffff9c, &(0x7f0000000200)='./file0\x00')
bpf$PROG_LOAD(0x5, &(0x7f0000000180)={0x10, 0x4, &(0x7f0000000000)=@framed={{}, [@call={0x179, 0x11, 0x100000}]}, &(0x7f00000000c0)='GPL\x00', 0x4, 0x1000, &(0x7f0000000200)=""/4096, 0x0, 0x0, '\x00', 0x0, @sk_msg}, 0x70)
mkdirat(0xffffffffffffff9c, &(0x7f0000000040)='./file1\x00', 0x1)
lremovexattr(&(0x7f0000001200)='./file7\x00', &(0x7f0000001240)=@random={'security.', '\x00'})
mkdirat(0xffffffffffffff9c, &(0x7f00000000c0)='./bus\x00', 0x0)
mount$overlay(0x0, &(0x7f00000000c0)='./bus\x00', &(0x7f0000000080), 0xa14000, &(0x7f0000000140)={[{@upperdir={'upperdir', 0x3d, './file1'}}, {@lowerdir={'lowerdir', 0x3d, './file0'}}, {@workdir={'workdir', 0x3d, './bus'}}]})
chdir(&(0x7f00000003c0)='./bus\x00')
mkdirat(0xffffffffffffff9c, &(0x7f0000000540)='./file7\x00', 0x1c0)
renameat2(0xffffffffffffff9c, &(0x7f0000000780)='./file0\x00', 0xffffffffffffff9c, &(0x7f0000000000)='./file7/file0\x00', 0x0)
r0 = openat(0xffffffffffffff9c, 0x0, 0x0, 0x2)
mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./file0\x00', 0x0)
r1 = socket$can_j1939(0x1d, 0x2, 0x7)
mprotect(&(0x7f0000000000/0x3000)=nil, 0x3000, 0x1)
setsockopt$sock_int(r1, 0x1, 0x6, &(0x7f0000000040)=0x1, 0x4)
r2 = socket$packet(0x11, 0x3, 0x300)
setsockopt$packet_fanout(r2, 0x107, 0x12, &(0x7f0000000000)={0x4, 0x3}, 0x4)
r3 = socket$packet(0x11, 0x3, 0x300)
setsockopt$packet_fanout(r3, 0x107, 0x12, &(0x7f0000000000)={0x4, 0x3}, 0x4)
r4 = bpf$PROG_LOAD_XDP(0x5, &(0x7f0000000480)={0x6, 0x3, &(0x7f0000000680)=ANY=[@ANYBLOB="1800000002000000000000000000000095"], &(0x7f00000002c0)='syzkaller\x00'}, 0x94)
setsockopt$inet_sctp_SCTP_ADD_STREAMS(r0, 0x84, 0x79, &(0x7f0000000100)={0x0, 0xa, 0x3}, 0x8)
bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f0000000600)={r4, 0x5, 0xb68, 0x560b0000, &(0x7f0000000000)="259a53f271a76d2673004c6588a8", 0x0, 0xd01, 0x2a0, 0x0, 0x0, 0x0, 0x0, 0x2}, 0x48)
executing program 2:
socket$nl_generic(0x10, 0x3, 0x10)
r0 = socket$nl_netfilter(0x10, 0x3, 0xc)
sendmsg$netlink(r0, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000100)=[{&(0x7f0000000140)={0x78, 0x16, 0xf15, 0x0, 0x0, "", [@typed={0x65, 0x84, 0x0, 0x0, @binary="b07d534ae6d132c423a882e82785dceed26c7ab8259ea2ef5331ef77a570bf70451f7ecec9bbf1fc5ddfce1b78d95cb5f4cccd4d58c54c1ebf827e129b5f38eb17a81598d3908443d96c8165a324d084f95989b07c6abfe979bfcc096db965e07d"}]}, 0x78}], 0x1}, 0x0)
executing program 2:
r0 = openat$dsp(0xffffffffffffff9c, &(0x7f0000000000), 0x8041, 0x0) (async, rerun: 32)
modify_ldt$read_default(0x2, 0xffffffffffffffff, 0x0) (async, rerun: 32)
r1 = add_key$user(&(0x7f0000000180), &(0x7f00000001c0)={'syz', 0x2}, &(0x7f0000000200)='*', 0x1, 0xfffffffffffffffb) (async)
r2 = add_key$keyring(&(0x7f0000000000), &(0x7f0000000040)={'syz', 0x0}, 0x0, 0x0, 0xffffffffffffffff)
add_key$user(&(0x7f0000000000), &(0x7f0000000080)={'syz', 0x2}, &(0x7f00000000c0)='c', 0x1, r2) (async)
syz_open_dev$sndctrl(&(0x7f0000000240), 0x3, 0x80042)
r3 = add_key$keyring(&(0x7f0000000200), &(0x7f0000000140)={'syz', 0x1}, 0x0, 0x0, 0xffffffffffffffff)
keyctl$KEYCTL_MOVE(0x1e, r1, r2, r3, 0x1) (async, rerun: 32)
write$dsp(r0, &(0x7f00000001c0)="5cba91a4", 0xffffffd9) (rerun: 32)
ioctl$SNDCTL_DSP_SYNC(r0, 0x5001, 0x0) (async, rerun: 64)
syz_clone(0x11, 0x0, 0x0, 0x0, 0x0, 0x0) (async, rerun: 64)
ioctl$SNDCTL_DSP_SPEED(r0, 0xc0045002, &(0x7f0000000100)=0x7)
executing program 2:
r0 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./proc/net/rpc/auth.unix.ip/channel\x00', 0x2, 0x0)
write(r0, &(0x7f0000000000)='nfsd 127.0.0.1 999999999\n', 0x19)
read(r0, &(0x7f0000000100), 0x100)
io_uring_enter(r0, 0x5df5, 0x3deb, 0xc1, &(0x7f0000000040)={[0x6]}, 0x8) (async)
r1 = socket$nl_netfilter(0x10, 0x3, 0xc)
sendmsg$NFT_BATCH(r1, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000600)={{0x14}, [@NFT_MSG_NEWTABLE={0x20, 0x0, 0xa, 0x201, 0x0, 0x0, {0x7}, [@NFTA_TABLE_NAME={0x9, 0x1, 'syz0\x00'}]}, @NFT_MSG_NEWSET={0x54, 0x9, 0xa, 0x401, 0x0, 0x0, {0x7}, [@NFTA_SET_ID={0x8}, @NFTA_SET_NAME={0x9, 0x2, 'syz1\x00'}, @NFTA_SET_TABLE={0x9, 0x1, 'syz0\x00'}, @NFTA_SET_KEY_LEN={0x8, 0x5, 0x1, 0x0, 0x17}, @NFTA_SET_DATA_TYPE={0x8, 0x6, 0x1, 0x0, 0xffffff00}, @NFTA_SET_FLAGS={0x8, 0x3, 0x1, 0x0, 0x38}, @NFTA_SET_GC_INTERVAL={0x8, 0xc, 0x1, 0x0, 0x2}]}], {0x14, 0x10, 0x1, 0x0, 0x0, {0x0, 0x84}}}, 0x9c}}, 0x0) (async)
r2 = socket$nl_generic(0x10, 0x3, 0x10)
sendmsg$nl_generic(r2, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000180)={0x14, 0x3e, 0x301, 0x270bd24, 0x25dfdbfa, {0x1}}, 0x14}}, 0xc004)
executing program 4:
r0 = socket$inet6_icmp(0xa, 0x2, 0x3a)
mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./trace\x00', 0x1ff) (async)
getsockopt$inet6_int(r0, 0x29, 0xc9, &(0x7f0000000040), &(0x7f00000000c0)=0x4) (async)
r1 = syz_genetlink_get_family_id$nbd(&(0x7f0000000280), 0xffffffffffffffff)
r2 = signalfd(r0, &(0x7f00000002c0)={[0x1]}, 0x8) (async)
socketpair$nbd(0x1, 0x1, 0x0, &(0x7f0000000300)={<r3=>0xffffffffffffffff}) (async)
r4 = openat$ipvs(0xffffffffffffff9c, &(0x7f0000000380)='/proc/sys/net/ipv4/vs/amemthresh\x00', 0x2, 0x0)
socketpair$nbd(0x1, 0x1, 0x0, &(0x7f00000003c0)={<r5=>0xffffffffffffffff}) (async)
socketpair$nbd(0x1, 0x1, 0x0, &(0x7f0000000400)={<r6=>0xffffffffffffffff}) (async)
r7 = socket(0x2d, 0x2, 0x0)
connect$netlink(r7, &(0x7f0000000140)=@unspec={0x2d, 0x0, 0xa00}, 0xc) (async)
r8 = socket(0x12, 0x80002, 0x25)
setsockopt$MRT6_FLUSH(r8, 0x29, 0xd0, 0x0, 0x4)
socketpair(0x1, 0x20000000000001, 0x0, &(0x7f0000000100)={0xffffffffffffffff, <r9=>0xffffffffffffffff})
getsockname$packet(r9, &(0x7f0000000100)={0x11, 0x0, <r10=>0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000080)=0xa)
r11 = socket$nl_route(0x10, 0x3, 0x0)
sendmsg$nl_route_sched(r11, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000440)=@newtaction={0x88, 0x30, 0xffff, 0x0, 0x0, {0x0, 0x0, 0x1300}, [{0x74, 0x1, [@m_mirred={0x70, 0x1, 0x0, 0x0, {{0xb}, {0x44, 0x2, 0x0, 0x1, [@TCA_MIRRED_PARMS={0x20, 0x4, {{0xfffff7e8}}}, @TCA_MIRRED_PARMS={0x20, 0x2, {{0x1, 0x0, 0x1, 0x400, 0xfffffff7}, 0x2, r10}}]}, {0x4}, {0xc}, {0xc, 0x8, {0x0, 0x2}}}}]}]}, 0x88}}, 0x0) (async)
r12 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file0\x00', 0x20846, 0x2)
syz_kvm_setup_cpu$x86(r12, r12, &(0x7f0000fe7000/0x18000)=nil, &(0x7f0000000180)=[@text32={0x20, &(0x7f0000000240)="c4e1a9d83d00000000c4c1cf2a79fdb9a80a0000b807000000ba000000000f30c4e11d73d9069ae0235f8d6d000f20c035020000000f22c00f79199a77000000a9002e65f30fbd934230000066bad10466b8060066ef"}], 0x1, 0x60, 0x0, 0x40) (async)
write$P9_RLERRORu(r12, &(0x7f0000000240)=ANY=[], 0x10)
mmap(&(0x7f0000000000/0x400000)=nil, 0x400000, 0x1, 0x10012, r12, 0x0)
socketpair$nbd(0x1, 0x1, 0x0, &(0x7f0000000440)={<r13=>0xffffffffffffffff})
sendmsg$NBD_CMD_STATUS(0xffffffffffffffff, &(0x7f0000000640)={&(0x7f0000000240)={0x10, 0x0, 0x0, 0x80102000}, 0xc, &(0x7f0000000600)={&(0x7f0000000500)={0xfc, r1, 0x100, 0x70bd26, 0x25dfdbfe, {}, [@NBD_ATTR_SERVER_FLAGS={0xc, 0x5, 0x2}, @NBD_ATTR_SOCKETS={0x1c, 0x7, 0x0, 0x1, [{0xc, 0x1, 0x0, 0x1, {0x8, 0x1, r2}}, {0xc, 0x1, 0x0, 0x1, {0x8, 0x1, r3}}]}, @NBD_ATTR_SERVER_FLAGS={0xc, 0x5, 0x5}, @NBD_ATTR_BACKEND_IDENTIFIER={0x9, 0xa, 'befs\x00'}, @NBD_ATTR_SOCKETS={0x70, 0x7, 0x0, 0x1, [{0xc, 0x1, 0x0, 0x1, {0x8}}, {0xc, 0x1, 0x0, 0x1, {0x8, 0x1, r4}}, {0xc, 0x1, 0x0, 0x1, {0x8, 0x1, r5}}, {0xc, 0x1, 0x0, 0x1, {0x8}}, {0xc, 0x1, 0x0, 0x1, {0x8, 0x1, r6}}, {0xc, 0x1, 0x0, 0x1, {0x8, 0x1, r7}}, {0xc, 0x1, 0x0, 0x1, {0x8, 0x1, r8}}, {0xc, 0x1, 0x0, 0x1, {0x8, 0x1, r12}}, {0xc, 0x1, 0x0, 0x1, {0x8, 0x1, r13}}]}, @NBD_ATTR_BACKEND_IDENTIFIER={0x7, 0xa, ',-]'}, @NBD_ATTR_DEAD_CONN_TIMEOUT={0xc, 0x8, 0x78e7}, @NBD_ATTR_BLOCK_SIZE_BYTES={0xc, 0x3, 0x5}, @NBD_ATTR_TIMEOUT={0xc, 0x4, 0x227}, @NBD_ATTR_BLOCK_SIZE_BYTES={0xc, 0x3, 0x400}]}, 0xfc}, 0x1, 0x0, 0x0, 0x8000}, 0x4000151) (async)
mount(0x0, &(0x7f0000000000)='./trace\x00', &(0x7f0000000100)='befs\x00', 0x0, 0x0)
r14 = open$dir(&(0x7f0000000200)='./trace\x00', 0x20000, 0x4c)
r15 = openat(r14, &(0x7f0000000140)='./trace/set_event\x00', 0x2, 0x40) (async)
r16 = syz_open_dev$sg(&(0x7f00000000c0), 0x0, 0x2400)
ioctl$SG_IO(r16, 0x2285, &(0x7f0000000180)={0x53, 0xfffffffffffffffd, 0x6, 0x81, @scatter={0x0, 0x0, 0x0}, &(0x7f0000000700)="1265b914f46e", 0x0, 0x2000000, 0x10022, 0x3, 0x0}) (async)
writev(r15, &(0x7f0000000340)=[{&(0x7f00000004c0)="2019", 0x2}], 0x1) (async)
getsockopt$inet6_int(r0, 0x29, 0x31, 0x0, &(0x7f0000000080))
executing program 2:
mkdirat(0xffffffffffffff9c, &(0x7f0000000100)='./file0\x00', 0x0) (async, rerun: 64)
mount(0x0, &(0x7f00000001c0)='./file0\x00', &(0x7f0000000300)='cgroup2\x00', 0x0, 0x0) (async, rerun: 64)
r0 = openat$tun(0xffffffffffffff9c, &(0x7f00000001c0), 0xa2f01, 0x0)
ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f00000000c0)={'syzkaller1\x00', 0x6bf1c2d5adba8c32})
r1 = socket$inet6(0xa, 0x2, 0x0)
bind$inet6(r1, &(0x7f0000000100)={0xa, 0x4e20, 0x0, @empty}, 0x1c)
setsockopt$inet6_udp_int(r1, 0x11, 0x68, &(0x7f0000000080)=0xa40, 0x4)
r2 = socket$kcm(0x2, 0xa, 0x2)
ioctl$SIOCSIFHWADDR(r2, 0x8914, &(0x7f0000000180)={'syzkaller1\x00', @link_local})
write$tun(r0, &(0x7f0000000300)=ANY=[@ANYBLOB="0a000806000000000400aaaaaaaaaa2986dd6de7136600e91101addb0000000000000000000000000000ff0200000000000000000000000000014f194e20002b90"], 0x65) (async)
mount$overlay(0x0, &(0x7f0000000140)='./file0\x00', &(0x7f0000000180), 0x0, &(0x7f00000000c0)={[{@lowerdir={'lowerdir', 0x3d, './file0'}, 0x3a}], [], 0x2f}) (async)
mount$overlay(0x0, &(0x7f0000000140)='./file0\x00', &(0x7f0000000380), 0x0, &(0x7f00000003c0)={[{@lowerdir={'lowerdir', 0x3d, './file0'}, 0x3a}], [], 0x2f}) (async)
r3 = openat(0xffffffffffffff9c, &(0x7f0000000080)='./file0\x00', 0x0, 0xd5)
write$tcp_mem(r3, &(0x7f0000000200)={0x4, 0x20, 0x1, 0x20, 0x7}, 0x48)
r4 = syz_open_dev$dvb_frontend(&(0x7f0000000080), 0x0, 0x2)
ioctl$FE_GET_PROPERTY(r4, 0x80106f53, &(0x7f0000000040)={0x20, &(0x7f0000001240)=[{0x1f, '\x00', @data=0xc, 0x7}, {0x6, '\x00', @buffer={"f8c042d7a8781c094069bb0ebdee0ef4186c06dcf1c52699f69880b0d7000004", 0x20}, 0x6}]}) (async)
openat$cgroup_ro(r3, &(0x7f0000000040)='cpu.stat\x00', 0x0, 0x0)
executing program 4:
bpf$MAP_UPDATE_BATCH(0x1a, &(0x7f0000000400)={0x0, 0x0, 0x0, 0x0, 0x619}, 0x38)
r0 = accept4$vsock_stream(0xffffffffffffffff, &(0x7f0000000340)={0x28, 0x0, 0x2710, @my=0x0}, 0x10, 0x800)
ioctl$AUTOFS_DEV_IOCTL_TIMEOUT(0xffffffffffffffff, 0xc018937a, &(0x7f0000000380)={{0x1, 0x1, 0x18, r0, {0x7}}, './file0\x00'}) (async)
mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./config\x00', 0x1ff) (async)
mount(0x0, &(0x7f0000000200)='./config\x00', &(0x7f0000000300)='configfs\x00', 0x0, 0x0)
r1 = openat(0xffffffffffffff9c, &(0x7f0000000b00)='./config/usb_gadget/g1/functions/hid.usb0/subclass\x00', 0x1, 0x1ff)
write$UHID_CREATE2(r1, &(0x7f00000018c0)=ANY=[@ANYBLOB="0b00000073797a300000000000000000000000400000000000000040000000000000000000000000000000000000000000be00000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000f3000000000000000073797a3100000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000073797a300000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000030002000000010000000b00000001000000"], 0x118) (async)
r2 = socket$nl_route(0x10, 0x3, 0x0)
sendmsg$nl_route_sched(r2, &(0x7f00000037c0)={0x0, 0x0, &(0x7f0000003780)={&(0x7f00000008c0)=@newtaction={0x88c, 0x30, 0x12f, 0x0, 0x0, {}, [{0x878, 0x1, [@m_police={0x874, 0x1, 0x0, 0x0, {{0xb}, {0x848, 0x2, 0x0, 0x1, [[@TCA_POLICE_TBF={0x3c, 0x1, {0x0, 0x0, 0x0, 0x0, 0xbacf, {0x1, 0x0, 0x0, 0x0, 0x4, 0x6}, {0x1, 0x0, 0x0, 0x0, 0x10, 0x6}}}, @TCA_POLICE_PEAKRATE={0x404, 0x3, [0xffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffd, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8000000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffc, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffd, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7]}, @TCA_POLICE_RATE={0x404, 0x2, [0x3, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x9, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4]}]]}, {0x4}, {0xc, 0xb}, {0xc, 0xa}}}]}]}, 0x88c}}, 0x0) (async, rerun: 64)
creat(&(0x7f00000063c0)='./file0\x00', 0x120) (async, rerun: 64)
r3 = socket$igmp(0x2, 0x3, 0x2)
setsockopt$MRT_INIT(r3, 0x0, 0xc8, &(0x7f0000003d40), 0x4) (async, rerun: 32)
r4 = socket$inet6(0xa, 0x3, 0x88) (rerun: 32)
setsockopt$inet6_IPV6_XFRM_POLICY(r4, 0x29, 0x23, 0x0, 0x0) (async)
setsockopt$MRT_ADD_VIF(r3, 0x0, 0xca, &(0x7f0000003d80)={0x0, 0x0, 0x0, 0x0, @vifc_lcl_addr=@local, @dev}, 0x10)
r5 = socket$inet_icmp_raw(0x2, 0x3, 0x1)
r6 = socket$igmp(0x2, 0x3, 0x2)
setsockopt$inet_mreq(r5, 0x0, 0x23, &(0x7f0000000000)={@multicast1=0xe0000300, @local}, 0x8)
syz_emit_ethernet(0x3e, &(0x7f0000000240)={@local, @broadcast, @void, {@ipv4={0x800, @icmp={{0x5, 0x4, 0x0, 0x0, 0x30, 0x0, 0x0, 0x80, 0x2, 0x0, @empty, @multicast1=0xe0000300}, @dest_unreach={0x3, 0x7, 0x0, 0x0, 0x3, 0xc58, {0x5, 0x4, 0x0, 0x7, 0x0, 0x65, 0xe, 0x4e, 0x24, 0xc, @empty, @dev={0xac, 0x14, 0x14, 0x44}}}}}}}, 0x0) (async)
setsockopt$MRT_ADD_MFC_PROXY(r6, 0x0, 0xd2, &(0x7f0000000200)={@remote, @multicast2=0xe0000300, 0x0, "028a3f6c58b274e6d8451697efe42811ee1df06e9264f7d866b1970548fc3c7b", 0x800b2, 0xfffffff7, 0x4, 0x40000006}, 0x3c) (async)
r7 = syz_open_procfs(0x0, &(0x7f0000002380)='net/ip_mr_cache\x00')
pread64(r7, &(0x7f0000000100)=""/253, 0xfd, 0x1) (async)
rmdir(&(0x7f0000007880)='./file0\x00')
r8 = socket$nl_route(0x10, 0x3, 0x0) (async)
sendmsg$nl_route(0xffffffffffffffff, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000400)=ANY=[@ANYBLOB="4400000010004b0401800000000000007a000000", @ANYRES32=0x0, @ANYBLOB="4800000000000000240012"], 0x44}}, 0x4)
sendmsg$NFT_BATCH(0xffffffffffffffff, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000000)={&(0x7f00000003c0)=ANY=[@ANYBLOB="140000001000040000000000000000000000000a14000000000a050000000000000000000a00fffe38000000090a010300000000000000000700000008000f40000000020900010073797a310000000008000a400000000008000f400000000114"], 0x74}, 0x1, 0x0, 0x0, 0x88000}, 0x20000000) (async, rerun: 32)
r9 = socket$nl_netfilter(0x10, 0x3, 0xc) (rerun: 32)
sendmsg$NFT_MSG_GETSETELEM(r9, &(0x7f0000005e80)={&(0x7f0000000300)={0x10, 0x0, 0x0, 0x2000000}, 0xc, &(0x7f0000005e40)={&(0x7f0000003800)={0x2604, 0xd, 0xa, 0x101, 0x0, 0x0, {0xe0ee282bd21ed176, 0x0, 0x4}, [@NFTA_SET_ELEM_LIST_ELEMENTS={0x5f4, 0x3, 0x0, 0x1, [{0x5f0, 0x0, 0x0, 0x1, [@NFTA_SET_ELEM_FLAGS={0x8, 0x3, 0x1, 0x0, 0x2}, @NFTA_SET_ELEM_OBJREF={0x9, 0x9, 'syz1\x00'}, @NFTA_SET_ELEM_KEY={0x210, 0x1, 0x0, 0x1, [@NFTA_DATA_VERDICT={0x34, 0x2, 0x0, 0x1, [@NFTA_VERDICT_CODE={0x8, 0x1, 0x0, 0x1, 0xfffffffffffffffc}, @NFTA_VERDICT_CODE={0x8, 0x1, 0x0, 0x1, 0xfffffffffffffffc}, @NFTA_VERDICT_CODE={0x8, 0x1, 0x0, 0x1, 0xfffffffffffffffc}, @NFTA_VERDICT_CHAIN_ID={0x8, 0x3, 0x1, 0x0, 0x2}, @NFTA_VERDICT_CODE={0x8, 0x1, 0x0, 0x1, 0xfffffffffffffffc}, @NFTA_VERDICT_CHAIN_ID={0x8, 0x3, 0x1, 0x0, 0x4}]}, @NFTA_DATA_VALUE={0xb2, 0x1, "0b757755151d8377fe5c971dac87406743e23571cb981774ac8c7f8b5b8503a7467e24913e6aed7723794af29b1caddb5cbb45f6e0a680d0efa1c6bcaf34893504b67cf8eebf588926302e6d37a0370f9690e156391d0ca592430fe85a1c605e8945b966fcc2085b5e5e87d19629f0bce3ac48edd8fc89dfae8cec5dbe5c0fa959e3219aa454f90d7d376debc425eaddc054876d8fc2b0b0dfdbed8c04d9f6997af963df30c58036f90a0f2ec2c7"}, @NFTA_DATA_VALUE={0xe1, 0x1, "c5c1132e229fdd2cf71fe9c3c93bdf5417cb02e3447aa45ae51c20cee634db57966c07f3a7909dbbba2800123b2c565d469eeae34c39101badbfc93ab7fb48231b6c2e70e6b7230ac5244906a77ee7efda068c839cc5e819d3ef05a9085260bac012ac2fbb9a341723bfebc4e7719dd5c29ba53c57c5aa64c949d6b5beefce9bf3e1b641026909478f39aba0cf9982e5b2779d81b49b7dfe92e19853bd4e5e5c28cd1b8391a2eaec29194a830c70f28641394fc28f5dc0dad7764f9393cd9ca5d33c14f5615d52b338587186f433ccb6b6f8a108bc729e8aac10957f1a"}, @NFTA_DATA_VALUE={0x3d, 0x1, "316353876b23ab09fe0450b7e760d7d16319ae713ceb62537dc2ecae7625e5cb37438b1cb091e0733b26badd3c4c4ce77f16c5997252915b89"}]}, @NFTA_SET_ELEM_EXPR={0x10, 0x7, 0x0, 0x1, @notrack={{0xc}, @void}}, @NFTA_SET_ELEM_KEY_END={0x120, 0xa, 0x0, 0x1, [@NFTA_DATA_VALUE={0x86, 0x1, "14f67bab38b4316d3ef76f35f5673cf4ad29321e6aff9b45c18652526fce067771ce9ef00eaee655232b0be6a49808f3cd65bb71a52ef62fa2aedaf7b3df073bb1653e2988377fb9c53138d9b274fc5e7576491fe23c30c4f2500d1aa9e73abfdc1f0f4202d6457e14969db59655b970bbc83d95c10f8fa3c835a4747aac4519e029"}, @NFTA_DATA_VALUE={0x91, 0x1, "6641e1bd1f58adfc4f0fe91c5fda1e9512b85fdb0fc0b3376fab50eed0e534ce423929ad5d37c890aa822f4ebe3546993597bfe5a293765f6292c1bf0b5aba9f8ee5a7f0046c7d64a62996cc594cc0ddc37c52ab382e412995cb5db3d9819d56e86ea7b639d52c960c022357cf623ab46cb14b3490dd840ed9796efe7b7751e224fb8fbbce2096375e01838084"}]}, @NFTA_SET_ELEM_OBJREF={0x9, 0x9, 'syz0\x00'}, @NFTA_SET_ELEM_KEY_END={0x58, 0xa, 0x0, 0x1, [@NFTA_DATA_VERDICT={0x54, 0x2, 0x0, 0x1, [@NFTA_VERDICT_CHAIN={0x9, 0x2, 'syz0\x00'}, @NFTA_VERDICT_CODE={0x8}, @NFTA_VERDICT_CODE={0x8, 0x1, 0x0, 0x1, 0xfffffffffffffffd}, @NFTA_VERDICT_CHAIN={0x9, 0x2, 'syz2\x00'}, @NFTA_VERDICT_CHAIN_ID={0x8, 0x3, 0x1, 0x0, 0x3}, @NFTA_VERDICT_CODE={0x8}, @NFTA_VERDICT_CHAIN_ID={0x8, 0x3, 0x1, 0x0, 0x2}, @NFTA_VERDICT_CHAIN_ID={0x8, 0x3, 0x1, 0x0, 0x2}, @NFTA_VERDICT_CHAIN_ID={0x8, 0x3, 0x1, 0x0, 0x1}]}]}, @NFTA_SET_ELEM_DATA={0x1ac, 0x2, 0x0, 0x1, [@NFTA_DATA_VALUE={0xff, 0x1, "8578bb23d85636a4e21084c7b898f629ef648626db00b41440e4555f2e68ff0317a359c49504c1f974b2663690dd85e15352bdc502b6a079f3df277b860368c41fdc25fab97d2c2881c12f568903e894f3e8b3bd1707024c7eebd955dec710816be829532f0dc267046d43a9df54aa602225e74c23a287e77f950b4a089189b5245eafdadee809ab8ccf6864e1547b63948520ca0fe86261e492aa84755533dbe3f093a083b0e5cf3e6ee2d7ad10981518fc85c6ade1c11a6de9d65acc7fcbae7aaf65fb0313eeb0c14d276b810160213f6499434886cfa8c84c15b09672ff8f8a7558bb3de6a546fa59ae83f688b2565184e6b5910571caa4fcf6"}, @NFTA_DATA_VERDICT={0x4c, 0x2, 0x0, 0x1, [@NFTA_VERDICT_CHAIN={0x9, 0x2, 'syz2\x00'}, @NFTA_VERDICT_CHAIN_ID={0x8, 0x3, 0x1, 0x0, 0x4}, @NFTA_VERDICT_CHAIN={0x9, 0x2, 'syz0\x00'}, @NFTA_VERDICT_CODE={0x8, 0x1, 0x0, 0x1, 0xfffffffffffffffb}, @NFTA_VERDICT_CODE={0x8, 0x1, 0x0, 0x1, 0xfffffffffffffffd}, @NFTA_VERDICT_CHAIN={0x9, 0x2, 'syz0\x00'}, @NFTA_VERDICT_CHAIN={0x9, 0x2, 'syz0\x00'}]}, @NFTA_DATA_VALUE={0x59, 0x1, "220a7b0b1956ef96fb822d92fcfc3af785ded5afbbf5b66df99b990579b632de6b744569bd43d0bffa52388c086d94f8d7f730c2e3f25559e34508f23e8a41d74f7e1cab836448623ff20c0a3b31e69b84934ed7d5"}]}, @NFTA_SET_ELEM_USERDATA={0x88, 0x6, 0x1, 0x0, "776a886b38f94b05aefd16ec3b4836189629717a2320efed6523043adacce75d110529d97b9c97baa3b5708deac0502ac7ef42ad1ece476b73b0b4ed7364b38591921015110890af6220eeb3ab55d0411d5121003ea643c36693ba6e8f4b5895eff29be828c77e89fb2e5c2a89f54cfa84eb8fc2c9c08b8c508cc277d12ba067f4b76518"}]}]}, @NFTA_SET_ELEM_LIST_ELEMENTS={0x1ffc, 0x3, 0x0, 0x1, [{0x168, 0x0, 0x0, 0x1, [@NFTA_SET_ELEM_USERDATA={0x56, 0x6, 0x1, 0x0, "7a93a54e3d585ad84c42835d163d2cdc86ec9052668f000f28b75667719eba900d02f802677dbabda1bb83d49118fcddff8322419359f6961e7d35d90b34a119277a410a8858f07b28f18f9470f88b0c71a6"}, @NFTA_SET_ELEM_USERDATA={0x3b, 0x6, 0x1, 0x0, "96974fd6db1177905ee99bd83fc4d35f5df8f7e851240c42b7fdcb0243800feb90887c4ef597b0ecf929a18eb2e6abdf23fcf42f9e2bbe"}, @NFTA_SET_ELEM_OBJREF={0x9, 0x9, 'syz0\x00'}, @NFTA_SET_ELEM_KEY={0xa4, 0x1, 0x0, 0x1, [@NFTA_DATA_VALUE={0x90, 0x1, "1ec791dee8e0419af75fd0af10a79d4e69772a2cb4da9173053a6912d1138d637a9bbba2e170f590b79b514830769a5005b382e4d150c739bcc796517fdff9189fd76b2697a956360cc67142867b13a866adaa30b296e559cf5770f181909c6b07a616d937d36db3f65d5342fcc3d81912e02de0c6a855e4af57ea62c19a3e9afde373d7df9b1348ee425661"}, @NFTA_DATA_VERDICT={0xc, 0x2, 0x0, 0x1, [@NFTA_VERDICT_CODE={0x8, 0x1, 0x0, 0x1, 0xffffffffffffffff}]}, @NFTA_DATA_VERDICT={0x4}]}, @NFTA_SET_ELEM_EXPR={0x10, 0x7, 0x0, 0x1, @match={{0xa}, @void}}, @NFTA_SET_ELEM_EXPR={0x10, 0x7, 0x0, 0x1, @tproxy={{0xb}, @void}}]}, {0x11a8, 0x0, 0x0, 0x1, [@NFTA_SET_ELEM_FLAGS={0x8}, @NFTA_SET_ELEM_DATA={0x1164, 0x2, 0x0, 0x1, [@NFTA_DATA_VALUE={0xb3, 0x1, "ed71e0571c90e74e80965a6c57cf5c97f07cc627d3c8386e6bc49ddc8688a1c367e8c33b006e30cae99ce0eb72b34db7f5cb26cfeea2eb645329113526c43104cd8a0b3b7314423042808c036a0be1f64221e2b84f007c301aaabed0edcc94678bf8ece5d4b5eee61ff3a7a3d69a7f490dc4c280d7a3d4beb6eb3ef7a16338ddf0fe42795208be524c0ba699b13193b14203ea13cc79771e0a950dbdcbd4a406222e7b1db71e6ae7358da1aa08a912"}, @NFTA_DATA_VERDICT={0x28, 0x2, 0x0, 0x1, [@NFTA_VERDICT_CHAIN_ID={0x8, 0x3, 0x1, 0x0, 0x3}, @NFTA_VERDICT_CHAIN={0x9, 0x2, 'syz0\x00'}, @NFTA_VERDICT_CHAIN_ID={0x8, 0x3, 0x1, 0x0, 0x1}, @NFTA_VERDICT_CODE={0x8, 0x1, 0x0, 0x1, 0xfffffffffffffffb}]}, @NFTA_DATA_VERDICT={0x18, 0x2, 0x0, 0x1, [@NFTA_VERDICT_CHAIN={0x9, 0x2, 'syz0\x00'}, @NFTA_VERDICT_CHAIN_ID={0x8, 0x3, 0x1, 0x0, 0x1}]}, @NFTA_DATA_VALUE={0x12, 0x1, "1a190a74c96a27d4fdf7155cbbeb"}, @NFTA_DATA_VALUE={0x1004, 0x1, "dae46bda8d289e6c8783d27d52208b2c70641f89e9b5fe51180e125330280978a42657ea7902c5ba34fb03be7ace9c89dc637bb03a53418d5b136343e127ed57324195db3ee8150c5a55bd5b81daa99b82cbd1fedd0981446063c704d8df9446eefb06fe47325d2bcebc7e5411b5808f9cd2cddf9075d1d95282f9977378acef8079e69d1a8be21fc39e655973690ec6d3573be8ffed446b7749c2d930ffac7a153f815309920fd077d09ce8326a9dca37c0988e6077ed29f3f2391fad8ee7ddbef7f024ebc4cbb0366f6716b46f2908a20ca4e4ac9fa309175b52c8c14f89a4336a8cdda5f0195726093e898858ae6f9f4c29913c1cf2c868da07ebe7342beba2aa31cf2ae2a76d471dac9e5ec3493f96b1c406eed617e1c3e83071884b989bb2a56e19fcdd56e91e6293c4665383118a725e5d595c9637b8ae4491b76a808c1d0c13356d3b36e04ef7de9961d7254cd57d7c57eaaa5f7027803f6c48f2bb00b813b3207f7463ee9b30bf5ef554a5bc19b73375690cd039b2575d41bbf978bc900b0298c92c55bc4c06d0b18c3f9f7cde23654bf0439c184687d06927fd744a39e89a6c2a807947d5832ab81c52e165c915bcb16db450e0be436504732b56829eedae7fad541f90008d71832d715067b562cbafdbd602c35199a84406b3b1a25aaacbf631b8463dbb49ee030ac53a9c71ade1aae73bfdd722fbae45acb6d4cb27bdb711c7cabe9cd112ed45cc10703e0a75cebcde1381c5557dd903288ffa2f4bd1072d9d307b30ad1097d79480d4d275f9650663fc936fa6174e806b2fdcf6034842c858c4712e42e0bc5faac1df4af644e1112c8297f1cb521607e5bdfaff3141570a808917e7f4fafe918cd31f2c65d89d9cd57dc57bfcad84f087ffcd49e371a1ac772ec60435b515d7105783551f0bbb3ceb0ab9b1d0b04ab1d97996d2bd73ffa333064ff66d03e35144d099f7150ae77775acc4daab9c870297b198d060d01303e3cae01f9c3c9877b9f4baf3556ccd3ef47f2d7113f924e5fbd961d1e09bffe53abdf6c661b7f31bae157985fa9693cae37524bd867d221f03b73f50dcf200eb3df60b74a7bfe4e1af49810c8cc04c1889b4f3b18f0b329bd4b3ee2f35fb9ab980aac3b734bc938d7251979c3cefb6b4cd413a938cffd859271e25083c02d60bf67d53ba78e4a1d6d91a9f7b432dd97ee44b8dda0949cba393d6ac81f428140bf3d4f0de0e78f174ca2ffd90b1f54846e1976adad0246b87dd246fd2d2d4f2997a2c66e3de9072ea440a1057bc42cffa090e657fb27a47cc4290e4a1613240287821eb08a9ae49ab89fec66c4f3acbe94e93777677ad6f2c4400d1510bc92a66ebd99a600a6afb7d573d6db28793467c0fb4049276f97e537032b04bfe5704966a4a3c7a78e3abb0249b553ff446e6f028d7d63d4e31211a19235fb26e9402be4a5dbdf941b1363f71e41c096698a36e9f8ed6c9b80cc3570c05cc1ffa3a3ffa6ca844f33f018e5f0c251aa39100aa7590836d1551dc009a4024f3f24707e6e86d147ef5dc7a02e31e62ba96b51eacbe46f45476b627294d8dade5c739fb3ea049a3e75fedf68f97b40414b7f6c3e4f21f7599455ce87b1904c45f4862b923e6775dc817eb67fc0007b1f6e4cb37da55960e9b0dfb2d11de1a2001149ffe0a28bf7b3da75f6fd9f18e21dadae643436dab0f12b65bbfb62f6983fef7ada7454b73657a6b70753ffc00632c362aa86500e4b054970e8e5b827c248750232940bdabd6b839478bd18eabf487d056b994efa124fb0c2ac295852aba6d13b3f3e91af778cd4341328265ebb21a75bd550c786a0f376896c8b4cef009b57cda7a9c87387fad720650837d4cc7f9228cc77934799a1a57ed63e68a386df6fb3f91e6e533874acecc44f8aeb0baaaed89dbd2c95d91d20572fe9a069a5eb29788b609eab45269fb369a08d9970fb972878613c7553c54766a1f91644ba23349b2917d659ce22dce01f075ee6b9c619b38186df127b1f05417c3c0241f2cb933e6a143d0d2eac914f19c04eaf8b99c4442787def734d5646f12a136dc73aa2cf03fa4f37419cee212f4c34805e6714afecf6ed26e3dd404b8fdcfc1c216f35fe0a1c42e02d4b94332881789f8d8d7b4493f22349cc10556bb38e58131e8f96e90397e20c118d2ca4bb746e1e83f127bd4e7edd37ad6eee45f1b15ec766bc04263ee8bcf751057041d392460b0b5ebc3d1020f6ac3b3d11236c84a4f4affd12f77a905ee47eb514923b98140b268eadeb4125820ebc09c59800ee5e12d20f6c18828b991d271b8b13b6a83e0beab66819302c24a9788b1c2108faf215de642eb3acc7807f709a2f9377f97e9e896546c54a5d060ee80af87eab028ab6135f8ea9a21e00db05a5a6cccf1aa6df86dac26f52935f89c426607f3c1be99198de81d63f8119c6925aac433d81c2c871dbf29992e7ed6eacdbe14b09ab663845bdaf766910dc6483abf52bb28bdd04ce18540036e471d8eec9588f61395f92bf8ea11b429d1ae3c409b7b4db8d80e634f96a7c2d47048d1c2344876471a3d7a182e8d56493c9509d28d95fbb30ae5e2a92f22ecfa4e9a0a8a69c7ed02e14c33093aedf6650dea283f47759af3d1250e937cd68b10e8000087ac23f54d01d3fc693a260de2b4079868a4d06ca835349c4ed85296e8e04032c5e8321dc6a762e15a0334293ccb35d2925fd22728c783fdcd886ba7b26fbf9198af21cf75e84b70c8061855630423a9532d9c4c2a3b13b70bd4c188475e85e6cd8aa18cb6920413d39714b255b7d14dc2d22971a45f481a05150095c52496f03e7d11762cee50d6aa525a42a104c8a51d9a9e33b7f99d1d5a759e88fd601031674000cee73affc30874b3aa27ab444c2b7dd4a2b6523574c5cd2e494c08c8d301a4fa9dfeefa4820d7c86d777c7e46290b4573d499f2023eb532d5cb52b9ac2edd73693bb84dcfcd6091fc4b128416ec3ddac4ff48cda150acd742d28a99aab2d85f2be8075131e07f21d000931b928d351f7db3c2eea130ed51f0debc63ede775cf3eb7294ab906c913c4122a8655099da056b42376828cd1dd43628a79ef9a3b486aa71680283cefcf004bd90a79af2d1d2db50c69aa46ba6ba3abd83fff435acbd9b221b5834bddd6cfa41d920f79f7eb61c109750bf7a552a1774905f59ff84f2b920d5ad3e5cf05fdd0dcd2b909327b4811e16d6e73b16b6f02311e3594495854e6c635ad306450fc078fb207a9bc40cf27955336d6f3f79ece0203796b23371a6515f7bb36cd321265ae871fe8dd5e8c2aa1b66c2313705b5564ea2b210b564f1e3ad238bfee2b9be6a7b73d58230926f518bc1be72161c8e0bceb73df44cd3bfe5fdb8d30f2c719dfed6d5eb36a8d3ab869ed862a4afc4e18042138b6d1bc83ef579a902419c2b583a80c0016c1d48b6f6587754cf8f8e368fbcb2ffca51b7085c8e6a6153bb14393402cfce31294f8a8b9676a5f0a58800fccd912f4716d71fdd34c2f3ee81a49ceeb52c5899161965d066b7a70d007445da821bf6efd19c8cc37388aab2be8e56e2aa72e1a9d1ac1b70a4c37ab6b8a8123ccd6eb44fb4f73a695987aeed436c19f456bb3686d0e1bf89701a66b7d7cd471efee1edf54d50c3847d69070473e1cf94c16dfa78ebb525f5a96980d86d78e65ae1d8a07b9f5c05b0faf211249b79a6ba2ef3b05caef92ceb80ca7df19d7ba72e7abcdb15830f899a515eda3335c03429501ae2bbd8ef9a022b627ea02d65bda6c7b9e7902136d29b3b10e5df3b873ca964a4a43fb44911de159d94556ef8d083d553add892b1043bc3554d5def443f5ed12b76cd66a1bb9536a3653ec7d83cd2debded5433d7dfffaeb47ea81db58142a5e674813ef2034ec757d1c8fd8f90532d93a3b58cf19bfa7c071448494196fe3fe2a5c0f54cdeb42b9c45c896e4b70e81941696307c1d8383388267b6cd65b2d468519612805800f40df345a78e29ade44af0e3347c13dad1b4c83414c20f203ff6816cbb59616ae52ce36c2e9b566ff41b6d8f7b94e5fba2e7c671383a76b376826bd820206a1c87e22d27db8bacc89d783845d1ed55804653d0b2f15de4a24ef548af228578decdbebe09ad12a05460f6dd263d7f40e98deedf51c153b09618c637bd78e3e0fe01fd421cd4f0dd8b5c16c569a4a63ccef1919c871f1d534c07aad5ee6af2029ffd81d7636a6d500e161f2fc3a12687a94e09a281a065d703b8c9e49637df5e6ec801592e6d0f35c356314380497de77cf7c9996de455ba11232effb10e33e7e461d0d6a3c67fd153a12fad0777fd996d1e9ce000dcc028c9ce4fc54fe5cb07b3fa293927ffc7ba235403af786d326d9cc3e7ec74ea347cdeca4cd406fcaa4c8a8288c1d8a85aac814c26e652f9481ce4e38fef91fa858df0d2d5c53f2b87059abf1d9e8f294a7734123ac210cf5a99c3a426df7093f57ff373d3ff19378166d5aabd0ba870486ce3942cfa85fff609f647d4b331eb7cb761b26b7fb8eb5374ea530eb73ccab7aea27eb931c7098ea4ebe02321dd968bab0c8f1c636452c191bd896f832a02c63bce08e2c068fde49c53eec7b50d23ae96b018f8caf8a33b38b31bbca9dff76e0c9ebda06a05dd0a7a997fbdd094b5a9b89a780a7107d96b4c0d0a9c2ef866b4e98f74d1078272027fbb49bf2ec5e7f5dea27f27fd13b93392c00083cbb7d919a30777bba3f917b5baa67878c146dd710a6019c884de7a707134f4a5b0da048a979a627df261088894c881a6c10b1a4f48dc63f1e7dbafc7fc488129587686a1940f94f97c05bb491a98c34185554c8f0d4b9c73d0d4a1275b8dc1a76c76febd93643e74c733854b5c489a62e1107a7f68acda1589a5ef5150ff133b40e1dd31dcbb8d2feaeb4dc15f17d2197fff77416b2524da8151f773ab3cce1d5afd6933444874b7624551b851d8115a228477e7687ac34181f2ee76c36a12acd1522fd3f307b6f62f0877f424b691eb1e7b33a8041564f55dd2f9bdf88c96c1cab585833504b13d6415ae062a3dae97233e15ba00e13a5acf628474a27d3d111299334803f4b19efb9e3a30dcd0d9b3057c1db02d6bc15c41dbd8762482a7c1973e46034450916d48de5c51fd78fe9e13953fbeabcab9623f00a4f07d0699684a978aeb92fa0c10f96fc939251ad5713a3546bf7b525f6a3951c0b30d14b1fc79751cf6b2515f4bec4e071eb42f75ae1c56bb7b9c6da1128bc3ddd1c5eed15c3b997b1700b4d3b06882fdfc46347f02dd4b776b32bf81525f1662535c1e357098a949ee857d5fe6fb50bc81374f63ad8deee2d926c82c73d099c6b89dfc951d0292cce4cafca7bdc771e8f86d0b4ed5eebccee745b56326af0a5becee77b54927d922d24a72de96cc6761ae99e8afb8af5131308fb42114a1c6e74fc3a3ad31c125f4418809c40ab3bd5710d88144e22e4637ca082ced8c979ec962e3f89d8392fcea1a4eeb0c3b621ee6530f943088664cd7feadcc5b02652239986f08152d967a5a194e109bb0e4a10314abc6b5c82e329d699e1221f934b2a36c09359ea129134ee9b6e30e036351178b69758d833346f61756dc19d41a56ce8843b8c5368810e153060edba373845c729a5795a25755e8c3f374a6bb9c084aea34c76dd77953ed0b7ac7b90d581a5f8cec1f5fcac5e538473a21f130cb9c78081ef8f6c0248cac863d653cf3b765e52301286f863d8d122581a5122153a6d349e780368fb7cbeeab92c2d54e01fccbbb04b09135489f1a9e0"}, @NFTA_DATA_VALUE={0x42, 0x1, "b0cdb67f5faa608948589047b8359f37f3927d50dcfb6390d6cbc4b5b460d92342a8afb3e16445e2a3ac1bf131c850f82ee2985d3ac0ec6a4fe3fa3d06a1"}, @NFTA_DATA_VERDICT={0x10, 0x2, 0x0, 0x1, [@NFTA_VERDICT_CHAIN={0x9, 0x2, 'syz1\x00'}]}]}, @NFTA_SET_ELEM_EXPRESSIONS={0x38, 0xb, 0x0, 0x1, [{0x10, 0x1, 0x0, 0x1, @limit={{0xa}, @void}}, {0x24, 0x1, 0x0, 0x1, @numgen={{0xb}, @val={0x14, 0x2, 0x0, 0x1, [@NFTA_NG_MODULUS={0x8, 0x2, 0x1, 0x0, 0x81}, @NFTA_NG_DREG={0x8, 0x1, 0x1, 0x0, 0xb}]}}}]}]}, {0x10, 0x0, 0x0, 0x1, [@NFTA_SET_ELEM_OBJREF={0x9, 0x9, 'syz1\x00'}]}, {0x488, 0x0, 0x0, 0x1, [@NFTA_SET_ELEM_EXPRESSIONS={0x140, 0xb, 0x0, 0x1, [{0x1c, 0x1, 0x0, 0x1, @socket={{0xb}, @val={0xc, 0x2, 0x0, 0x1, [@NFTA_SOCKET_LEVEL={0x8, 0x3, 0xd8}]}}}, {0xc, 0x1, 0x0, 0x1, @dup={{0x8}, @void}}, {0x44, 0x1, 0x0, 0x1, @tproxy={{0xb}, @val={0x34, 0x2, 0x0, 0x1, [@NFTA_TPROXY_FAMILY={0x8, 0x1, 0x1, 0x0, 0x2}, @NFTA_TPROXY_REG_ADDR={0x8}, @NFTA_TPROXY_FAMILY={0x8, 0x1, 0x1, 0x0, 0x2}, @NFTA_TPROXY_FAMILY={0x8}, @NFTA_TPROXY_REG_ADDR={0x8, 0x2, 0x1, 0x0, 0x4}, @NFTA_TPROXY_REG_PORT={0x8, 0x3, 0x1, 0x0, 0x12}]}}}, {0xc, 0x1, 0x0, 0x1, @dup={{0x8}, @void}}, {0xc, 0x1, 0x0, 0x1, @cmp={{0x8}, @void}}, {0x10, 0x1, 0x0, 0x1, @lookup={{0xb}, @void}}, {0x34, 0x1, 0x0, 0x1, @tproxy={{0xb}, @val={0x24, 0x2, 0x0, 0x1, [@NFTA_TPROXY_FAMILY={0x8, 0x1, 0x1, 0x0, 0x2}, @NFTA_TPROXY_FAMILY={0x8, 0x1, 0x1, 0x0, 0x2}, @NFTA_TPROXY_REG_ADDR={0x8, 0x2, 0x1, 0x0, 0xa}, @NFTA_TPROXY_FAMILY={0x8, 0x1, 0x1, 0x0, 0xa}]}}}, {0x10, 0x1, 0x0, 0x1, @meta={{0x9}, @void}}, {0x10, 0x1, 0x0, 0x1, @tproxy={{0xb}, @void}}, {0x54, 0x1, 0x0, 0x1, @inner={{0xa}, @val={0x44, 0x2, 0x0, 0x1, [@NFTA_INNER_TYPE={0x8, 0x2, 0x1, 0x0, 0x2c}, @NFTA_INNER_FLAGS={0x8, 0x3, 0x1, 0x0, 0x9}, @NFTA_INNER_EXPR={0x10, 0x5, 0x0, 0x1, @payload={{0xc}, @void}}, @NFTA_INNER_TYPE={0x8, 0x2, 0x1, 0x0, 0x43}, @NFTA_INNER_TYPE={0x8, 0x2, 0x1, 0x0, 0x24}, @NFTA_INNER_FLAGS={0x8, 0x3, 0x1, 0x0, 0x2}, @NFTA_INNER_NUM={0x8}]}}}]}, @NFTA_SET_ELEM_USERDATA={0x63, 0x6, 0x1, 0x0, "efbee12d74bdf9defe8ca52cec15aa593bb51ab4ba9da4b7bcd854376a436d21f215f1035ea32c6a26d88344d5afef4ecbb3f2418330e37cf81fb4d0407d202a784dbf1086c97978110f192ff3be7d0dc3dfc67b84a91e914218d4eb3f13c3"}, @NFTA_SET_ELEM_USERDATA={0x24, 0x6, 0x1, 0x0, "7c20c9811e538ad441b430f3a10861f2f308aa93fa20253bd2595332f9d74a8a"}, @NFTA_SET_ELEM_EXPR={0x20, 0x7, 0x0, 0x1, @byteorder={{0xe}, @val={0xc, 0x2, 0x0, 0x1, [@NFTA_BYTEORDER_LEN={0x8, 0x4, 0x1, 0x0, 0x17}]}}}, @NFTA_SET_ELEM_TIMEOUT={0xc, 0x4, 0x1, 0x0, 0x7fff}, @NFTA_SET_ELEM_EXPRESSIONS={0x114, 0xb, 0x0, 0x1, [{0x20, 0x1, 0x0, 0x1, @cmp={{0x8}, @val={0x14, 0x2, 0x0, 0x1, [@NFTA_CMP_OP={0x8}, @NFTA_CMP_SREG={0x8, 0x1, 0x1, 0x0, 0x8}]}}}, {0xc, 0x1, 0x0, 0x1, @cmp={{0x8}, @void}}, {0xb4, 0x1, 0x0, 0x1, @dynset={{0xb}, @val={0xa4, 0x2, 0x0, 0x1, [@NFTA_DYNSET_SREG_KEY={0x8, 0x4, 0x1, 0x0, 0x11}, @NFTA_DYNSET_EXPRESSIONS={0x74, 0xa, 0x0, 0x1, [{0x10, 0x1, 0x0, 0x1, @socket={{0xb}, @void}}, {0x10, 0x1, 0x0, 0x1, @limit={{0xa}, @void}}, {0x50, 0x1, 0x0, 0x1, @ct={{0x7}, @val={0x44, 0x2, 0x0, 0x1, [@NFTA_CT_DIRECTION={0x5}, @NFTA_CT_DREG={0x8, 0x1, 0x1, 0x0, 0x16}, @NFTA_CT_SREG={0x8, 0x4, 0x1, 0x0, 0x17}, @NFTA_CT_SREG={0x8, 0x4, 0x1, 0x0, 0x9}, @NFTA_CT_KEY={0x8, 0x2, 0x1, 0x0, 0x4}, @NFTA_CT_DREG={0x8, 0x1, 0x1, 0x0, 0x2}, @NFTA_CT_SREG={0x8, 0x4, 0x1, 0x0, 0x9}, @NFTA_CT_DREG={0x8, 0x1, 0x1, 0x0, 0x3}]}}}]}, @NFTA_DYNSET_FLAGS={0x8, 0x9, 0x1, 0x0, 0x2}, @NFTA_DYNSET_TIMEOUT={0xc, 0x6, 0x1, 0x0, 0x4000000000000000}, @NFTA_DYNSET_EXPR={0x10, 0x7, 0x0, 0x1, {{0xb}, @void}}]}}}, {0xc, 0x1, 0x0, 0x1, @rt={{0x7}, @void}}, {0x14, 0x1, 0x0, 0x1, @last={{0x9}, @val={0x4}}}, {0x10, 0x1, 0x0, 0x1, @target={{0xb}, @void}}]}, @NFTA_SET_ELEM_KEY_END={0x174, 0xa, 0x0, 0x1, [@NFTA_DATA_VERDICT={0x14, 0x2, 0x0, 0x1, [@NFTA_VERDICT_CHAIN_ID={0x8, 0x3, 0x1, 0x0, 0x2}, @NFTA_VERDICT_CHAIN_ID={0x8, 0x3, 0x1, 0x0, 0x3}]}, @NFTA_DATA_VERDICT={0x14, 0x2, 0x0, 0x1, [@NFTA_VERDICT_CODE={0x8, 0x1, 0x0, 0x1, 0xfffffffffffffffc}, @NFTA_VERDICT_CHAIN_ID={0x8, 0x3, 0x1, 0x0, 0x2}]}, @NFTA_DATA_VALUE={0x4f, 0x1, "0a4da2c47fba70b45668ef0d48d4237a26bedcc3ba666c5a167bfca9c18220499575854b3ad0b670405aa49382d1e58dfa395d46e35f67b2026e61b77b9c10b2db7c8b439d8dfd9711f411"}, @NFTA_DATA_VERDICT={0x14, 0x2, 0x0, 0x1, [@NFTA_VERDICT_CHAIN_ID={0x8, 0x3, 0x1, 0x0, 0x3}, @NFTA_VERDICT_CODE={0x8, 0x1, 0x0, 0x1, 0xfffffffffffffffe}]}, @NFTA_DATA_VALUE={0xe2, 0x1, "e85ed60d26db001b0aa960a12121a7fe7841b283f14c4bd6b1f8656556c1439906a075a5302a20ba2029aa42dc814cea82e544f9f69b193e18a4e5d1706d29fb38064cccba00d1476215b44c92f1425e48938da64a58b16a0e7ed0291bc4e2dd548ab4d2b318e503a3fe973e001d7afd70c5775e9da1c240e51e9ad1eecdd042c2ad7520837f36ae2b31a0166c191932dcc87c7ce0f4738337a51f151eb89a4ff3241ee45d29bde43e29b76aba434fd243539bf1d612957c139976b6b159467983b1d6a8f6a6c9b4a5d08c810fbd5bed9f979c37dd91872e3a28eca6861f"}]}, @NFTA_SET_ELEM_FLAGS={0x8, 0x3, 0x1, 0x0, 0x2}]}, {0x3b4, 0x0, 0x0, 0x1, [@NFTA_SET_ELEM_EXPRESSIONS={0x114, 0xb, 0x0, 0x1, [{0x1c, 0x1, 0x0, 0x1, @numgen={{0xb}, @val={0xc, 0x2, 0x0, 0x1, [@NFTA_NG_TYPE={0x8}]}}}, {0xc, 0x1, 0x0, 0x1, @fwd={{0x8}, @void}}, {0x44, 0x1, 0x0, 0x1, @masq={{0x9}, @val={0x34, 0x2, 0x0, 0x1, [@NFTA_MASQ_REG_PROTO_MAX={0x8, 0x3, 0x1, 0x0, 0x9}, @NFTA_MASQ_REG_PROTO_MAX={0x8}, @NFTA_MASQ_REG_PROTO_MIN={0x8, 0x2, 0x1, 0x0, 0x12}, @NFTA_MASQ_REG_PROTO_MIN={0x8, 0x2, 0x1, 0x0, 0x2}, @NFTA_MASQ_REG_PROTO_MAX={0x8, 0x3, 0x1, 0x0, 0x2}, @NFTA_MASQ_FLAGS={0x8}]}}}, {0x24, 0x1, 0x0, 0x1, @last={{0x9}, @val={0x14, 0x2, 0x0, 0x1, [@NFTA_LAST_SET={0x8, 0x1, 0x1, 0x0, 0x5}, @NFTA_LAST_SET={0x8, 0x1, 0x1, 0x0, 0x10000}]}}}, {0x24, 0x1, 0x0, 0x1, @objref={{0xb}, @val={0x14, 0x2, 0x0, 0x1, [@NFTA_OBJREF_IMM_TYPE={0x8, 0x1, 0x1, 0x0, 0x6}, @NFTA_OBJREF_SET_SREG={0x8, 0x3, 0x1, 0x0, 0x14}]}}}, {0x4c, 0x1, 0x0, 0x1, @meta={{0x9}, @val={0x3c, 0x2, 0x0, 0x1, [@NFTA_META_SREG={0x8, 0x3, 0x1, 0x0, 0x16}, @NFTA_META_DREG={0x8}, @NFTA_META_KEY={0x8, 0x2, 0x1, 0x0, 0x3}, @NFTA_META_KEY={0x8, 0x2, 0x1, 0x0, 0x3}, @NFTA_META_SREG={0x8, 0x3, 0x1, 0x0, 0x10}, @NFTA_META_KEY={0x8, 0x2, 0x1, 0x0, 0x16}, @NFTA_META_KEY={0x8, 0x2, 0x1, 0x0, 0x7}]}}}, {0x10, 0x1, 0x0, 0x1, @meta={{0x9}, @void}}]}, @NFTA_SET_ELEM_EXPRESSIONS={0x78, 0xb, 0x0, 0x1, [{0x28, 0x1, 0x0, 0x1, @fib={{0x8}, @val={0x1c, 0x2, 0x0, 0x1, [@NFTA_FIB_DREG={0x8, 0x1, 0x1, 0x0, 0x14}, @NFTA_FIB_DREG={0x8, 0x1, 0x1, 0x0, 0xe}, @NFTA_FIB_RESULT={0x8, 0x2, 0x1, 0x0, 0x3}]}}}, {0x4c, 0x1, 0x0, 0x1, @socket={{0xb}, @val={0x3c, 0x2, 0x0, 0x1, [@NFTA_SOCKET_DREG={0x8, 0x2, 0x1, 0x0, 0xd}, @NFTA_SOCKET_KEY={0x8}, @NFTA_SOCKET_LEVEL={0x8, 0x3, 0x5d}, @NFTA_SOCKET_LEVEL={0x8}, @NFTA_SOCKET_KEY={0x8, 0x1, 0x1, 0x0, 0x3}, @NFTA_SOCKET_KEY={0x8, 0x1, 0x1, 0x0, 0x3}, @NFTA_SOCKET_KEY={0x8, 0x1, 0x1, 0x0, 0x1}]}}}]}, @NFTA_SET_ELEM_FLAGS={0x8, 0x3, 0x1, 0x0, 0x1}, @NFTA_SET_ELEM_KEY_END={0x20c, 0xa, 0x0, 0x1, [@NFTA_DATA_VERDICT={0xc, 0x2, 0x0, 0x1, [@NFTA_VERDICT_CODE={0x8, 0x1, 0x0, 0x1, 0xfffffffffffffffc}]}, @NFTA_DATA_VERDICT={0x10, 0x2, 0x0, 0x1, [@NFTA_VERDICT_CHAIN={0x9, 0x2, 'syz1\x00'}]}, @NFTA_DATA_VERDICT={0x48, 0x2, 0x0, 0x1, [@NFTA_VERDICT_CODE={0x8, 0x1, 0x0, 0x1, 0xfffffffffffffffb}, @NFTA_VERDICT_CODE={0x8}, @NFTA_VERDICT_CHAIN={0x9, 0x2, 'syz2\x00'}, @NFTA_VERDICT_CHAIN_ID={0x8, 0x3, 0x1, 0x0, 0x2}, @NFTA_VERDICT_CHAIN_ID={0x8, 0x3, 0x1, 0x0, 0x3}, @NFTA_VERDICT_CODE={0x8, 0x1, 0x0, 0x1, 0xfffffffffffffffd}, @NFTA_VERDICT_CODE={0x8, 0x1, 0x0, 0x1, 0xffffffffffffffff}, @NFTA_VERDICT_CODE={0x8, 0x1, 0x0, 0x1, 0xfffffffffffffffc}]}, @NFTA_DATA_VERDICT={0x28, 0x2, 0x0, 0x1, [@NFTA_VERDICT_CODE={0x8}, @NFTA_VERDICT_CODE={0x8, 0x1, 0x0, 0x1, 0xfffffffffffffffd}, @NFTA_VERDICT_CHAIN_ID={0x8, 0x3, 0x1, 0x0, 0x2}, @NFTA_VERDICT_CHAIN={0x9, 0x2, 'syz1\x00'}]}, @NFTA_DATA_VERDICT={0xc, 0x2, 0x0, 0x1, [@NFTA_VERDICT_CODE={0x8, 0x1, 0x0, 0x1, 0xfffffffffffffffb}]}, @NFTA_DATA_VERDICT={0x10, 0x2, 0x0, 0x1, [@NFTA_VERDICT_CHAIN={0x9, 0x2, 'syz2\x00'}]}, @NFTA_DATA_VERDICT={0x40, 0x2, 0x0, 0x1, [@NFTA_VERDICT_CODE={0x8, 0x1, 0x0, 0x1, 0xffffffffffffffff}, @NFTA_VERDICT_CHAIN={0x9, 0x2, 'syz1\x00'}, @NFTA_VERDICT_CHAIN={0x9, 0x2, 'syz0\x00'}, @NFTA_VERDICT_CHAIN_ID={0x8, 0x3, 0x1, 0x0, 0x9}, @NFTA_VERDICT_CHAIN={0x9, 0x2, 'syz1\x00'}, @NFTA_VERDICT_CODE={0x8, 0x1, 0x0, 0x1, 0xffffffffffffffff}]}, @NFTA_DATA_VALUE={0x31, 0x1, "6b70b56686a0bfffe30e015448682e6c44baa0d57e075c532238767f2c752a1b054a3e78a098fecaa1dad15f97"}, @NFTA_DATA_VALUE={0x3c, 0x1, "fe252fa67ffa0e04aaeb17b14ee610b68b72cdb8371466a8c23465f3f822fd2fbeba197598f8cb8f87efe2cee03e48ecda204a1010ea2225"}, @NFTA_DATA_VALUE={0xad, 0x1, "421037841e23296441795384c0efb19fbf54fbd677f06b05c374dbc64d59b2f1f5c8890163a0fefbb29fc28e6c3079eb6ce7fcfca0aacf1a29e9a32ec667bdbc3df2bf0ebc20d7fd969b198f661bce2691bcc71e0bef6cf3b47cc5966b04c3fa2c52cadab68b1f76c15d42e293cd1986bd31d31d0a3b04bba12c39e7e639996a88d8476133a82692b106867007ec00df13da8a24bdfeb1986a7fb28621cfe02411bec1993f8b06e762"}]}, @NFTA_SET_ELEM_EXPR={0x10, 0x7, 0x0, 0x1, @objref={{0xb}, @void}}]}, {0x50, 0x0, 0x0, 0x1, [@NFTA_SET_ELEM_FLAGS={0x8, 0x3, 0x1, 0x0, 0x2}, @NFTA_SET_ELEM_KEY={0x44, 0x1, 0x0, 0x1, [@NFTA_DATA_VALUE={0x40, 0x1, "9568aa9ccefdffce36a8bcfccfa3fe1d8e8f63b63e5ae8a0358f719a2eb48ed724557e7abe984ba98f8cb3efa08ce60b781582b9a8228bb2fe645eac"}]}]}, {0x44c, 0x0, 0x0, 0x1, [@NFTA_SET_ELEM_FLAGS={0x8, 0x3, 0x1, 0x0, 0x2}, @NFTA_SET_ELEM_USERDATA={0x98, 0x6, 0x1, 0x0, "cc1886c18a44d6c61c1874f5c4b90ba7bac788f38136c2b99c2dd21fa1a3b648ec259a20555dbc0af1646e2c36437800cd430ee84338b438479cd68f7420090e29ddb2766cba4f67417656ad4b0d1a0f696cdec479665d820c6c225d13f725370d7d6db10b1eafc223e6fbc09821248995765294d1f160027495ad1c1e5b634d4718f9194f847c601014624905eb772e9ab760da"}, @NFTA_SET_ELEM_EXPR={0x34, 0x7, 0x0, 0x1, @quota={{0xa}, @val={0x24, 0x2, 0x0, 0x1, [@NFTA_QUOTA_FLAGS={0x8, 0x2, 0x1, 0x0, 0x1}, @NFTA_QUOTA_BYTES={0xc}, @NFTA_QUOTA_BYTES={0xc, 0x1, 0x1, 0x0, 0x3}]}}}, @NFTA_SET_ELEM_EXPR={0x220, 0x7, 0x0, 0x1, @bitwise={{0xc}, @val={0x210, 0x2, 0x0, 0x1, [@NFTA_BITWISE_MASK={0x20c, 0x4, 0x0, 0x1, [@NFTA_DATA_VERDICT={0x1c, 0x2, 0x0, 0x1, [@NFTA_VERDICT_CHAIN_ID={0x8, 0x3, 0x1, 0x0, 0x1}, @NFTA_VERDICT_CODE={0x8, 0x1, 0x0, 0x1, 0xffffffffffffffff}, @NFTA_VERDICT_CODE={0x8, 0x1, 0x0, 0x1, 0xffffffffffffffff}]}, @NFTA_DATA_VALUE={0x87, 0x1, "a39e6adce5e513d3f335dd4e50f5c7ea34e0ee4a8ee44be520f1df139d5f9af8c50a771ff7102d295e17ea339d4147ab3236916d47d7bf5736611af63b08dbd639dfaa589281e1cf73efab1e3e4d27f500de0bc2b69be79ad24213e3977b59579de354b64b07eb4670d634b149d6d12a9b026b256b3e2c4320f3ae10b49e284c9343c8"}, @NFTA_DATA_VALUE={0xf2, 0x1, "7414e7baf59a394dc024bb3bb900b524dd7b9d45e115327fd78058996a4b191eeb31245f14d451cb631d2b8c659c1f0a0163eb20241e812068e1248664eae21ad173120a475a52f47c4b068f2ae204412e557c6be474cf4b17b1d4dcd68db714e7d1fee5b2a782df04617724b6fa720d2b3696fcfa9c5e0c5447a6d3c0bc935ad3555ed8551a52123202201a40cdb40982a7787c04849e0e8a5f68092630f574ada4cfb32945a671da8c30c7199ce027c375964a2350507c39d31e8dec084ab595281e7970c5698a8a53c2b42e60b004ff0b3bf230600bb38cb2d69803c30dea5eef90afb0011be2e2b91ad3647c"}, @NFTA_DATA_VALUE={0x70, 0x1, "105ec5abd2c425c299104ce5c3aaf7fdd93849a2f000d2d8323c3e8932ec15b5fd04827d86755c03d78f8f2944e689c723938b9f3a26e89a10c1f8642b06408ecbf299ca31c19f38f988fa3302279bf99e92d08d3f17a3476c5faa7b3cf6fda88199ef23e6dd4e7a24d7fe22"}]}]}}}, @NFTA_SET_ELEM_TIMEOUT={0xc, 0x4, 0x1, 0x0, 0xff}, @NFTA_SET_ELEM_FLAGS={0x8, 0x3, 0x1, 0x0, 0x2}, @NFTA_SET_ELEM_USERDATA={0xfc, 0x6, 0x1, 0x0, "b5ee9204432388b9577be94a2685df5628ec77189a99633f66617ad8255730d2b55ceb24119ed779b984347ed231fd2868af826d05c96df6886b486c9a3cee853e96db521034e3179eda3aadf46907f46639a7c80254e6e24e5b31ba1a94eba1d640bae4e8e4fec9718cef4aa8c7265901b02a018ddaf8f55e7f1db3bc90fb3d3f0bfd81f047aeffbae600d8b072294c499254ba02af2e34512b62dcf3046189482cf8eb7261d13c287e05207b316ef3f172ef855631cf99dd4f165ff58e9b36572dde653da8eee212db3921ea26135526e57159bf4e1f9023b1f242bbe6af47a218077ad9fbdc9d3ad884d8b65d659f292d7c2f0a57c2ee"}, @NFTA_SET_ELEM_KEY_END={0x44, 0xa, 0x0, 0x1, [@NFTA_DATA_VERDICT={0x20, 0x2, 0x0, 0x1, [@NFTA_VERDICT_CHAIN={0x9, 0x2, 'syz1\x00'}, @NFTA_VERDICT_CODE={0x8, 0x1, 0x0, 0x1, 0xfffffffffffffffe}, @NFTA_VERDICT_CHAIN_ID={0x8, 0x3, 0x1, 0x0, 0x2}]}, @NFTA_DATA_VALUE={0x1f, 0x1, "022b5cb817591ddcc8b9bcd145eea7706fe1a7923278dc2686a978"}]}]}]}]}, 0x2604}, 0x1, 0x0, 0x0, 0x801}, 0x20044085) (async)
sendmsg$nl_route(r8, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000140)={&(0x7f00000003c0)=ANY=[@ANYBLOB="880000001000010400"/20, @ANYRES32=0x0, @ANYBLOB="2b03000000000000600012800b00010067656e65766500005000028005000800000000000400380205000900010000000500"], 0x88}}, 0x0) (async, rerun: 64)
syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) (rerun: 64)
executing program 4:
r0 = socket$nl_netfilter(0x10, 0x3, 0xc)
sendmsg$NFT_BATCH(r0, &(0x7f0000000100)={0x0, 0x0, &(0x7f0000000200)={&(0x7f00000003c0)=ANY=[@ANYBLOB="140000001000010000000000000000000000000a28000000000a0101000000005e1affd5020000000900010073797a300000000008000240000000032c000000030a01030000e6ff00000000020000000900010073797a30000000000900030073797a320000000014000000110001"], 0x7c}}, 0x0)
sendmsg$NFT_BATCH(r0, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000280)=ANY=[@ANYBLOB="140000001000010000070000000000000000000a40000000160a05000000000000000000020000000900010073797a300000000014000380080001400000000008000240000000030900020073797a300000000014000000110001"], 0x68}}, 0x20000800)
r1 = openat$sw_sync(0xffffffffffffff9c, &(0x7f0000000080), 0x0, 0x0)
r2 = openat$sw_sync(0xffffffffffffff9c, &(0x7f0000000380), 0x100, 0x0)
ioctl$SW_SYNC_IOC_CREATE_FENCE(r2, 0xc0285700, &(0x7f0000000040)={0x4, "abacd211119ca94c63377526aeb5ab2c7b9ca5fa07558139ede6dc06270ee042", <r3=>0xffffffffffffffff})
ioctl$SW_SYNC_IOC_CREATE_FENCE(r1, 0xc0285700, &(0x7f0000000100)={0x8, "b546baa5cc590d3033de259c2996817bb959ebab028deda501009bdeffafde25", <r4=>0xffffffffffffffff})
ioctl$SYNC_IOC_MERGE(r3, 0xc0303e03, &(0x7f00000001c0)={"0080bced01eb0100000000000000000700000000000000c900", r4, <r5=>0xffffffffffffffff})
ioctl$SW_SYNC_IOC_INC(r1, 0x40045701, &(0x7f0000000280)=0xfffffffc)
ioctl$SW_SYNC_IOC_INC(r2, 0x40045701, &(0x7f0000000240)=0xffff)
ioctl$SYNC_IOC_FILE_INFO(r5, 0x40103e05, &(0x7f00000003c0)={""/32, 0x0, 0x0, 0x0, 0x0, 0x0})
sendmsg$NFT_BATCH(r0, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000004c80)={{0x14}, [@NFT_MSG_NEWFLOWTABLE={0x48, 0x16, 0xa, 0x801, 0x0, 0x0, {0x2}, [@NFTA_FLOWTABLE_NAME={0x9, 0x2, 'syz0\x00'}, @NFTA_FLOWTABLE_TABLE={0x9, 0x1, 'syz0\x00'}, @NFTA_FLOWTABLE_HOOK={0x1c, 0x3, 0x0, 0x1, [@NFTA_FLOWTABLE_HOOK_DEVS={0x18, 0x3, 0x0, 0x1, [{0x14, 0x1, 'geneve0\x00'}]}]}]}, @NFT_MSG_NEWFLOWTABLE={0x1c, 0x16, 0xa, 0x5, 0x0, 0x0, {0xa, 0x0, 0x8}, [@NFTA_FLOWTABLE_FLAGS={0x8, 0x7, 0x1, 0x0, 0x1}]}, @NFT_MSG_NEWSETELEM={0x3f28, 0xc, 0xa, 0x101, 0x0, 0x0, {0x1, 0x0, 0x5}, [@NFTA_SET_ELEM_LIST_TABLE={0x9, 0x1, 'syz0\x00'}, @NFTA_SET_ELEM_LIST_SET={0x9, 0x2, 'syz2\x00'}, @NFTA_SET_ELEM_LIST_ELEMENTS={0x3ef4, 0x3, 0x0, 0x1, [{0x356c, 0x0, 0x0, 0x1, [@NFTA_SET_ELEM_EXPRESSIONS={0x22c4, 0xb, 0x0, 0x1, [{0x10, 0x1, 0x0, 0x1, @fib={{0x8}, @val={0x4}}}, {0xc, 0x1, 0x0, 0x1, @osf={{0x8}, @void}}, {0x14, 0x1, 0x0, 0x1, @byteorder={{0xe}, @void}}, {0x10, 0x1, 0x0, 0x1, @payload={{0xc}, @void}}, {0x213c, 0x1, 0x0, 0x1, @immediate={{0xe}, @val={0x2128, 0x2, 0x0, 0x1, [@NFTA_IMMEDIATE_DATA={0x2104, 0x2, 0x0, 0x1, [@NFTA_DATA_VALUE={0xc9, 0x1, "70f0f4802ca460d27debee00a8493ed54ce1ddfa554c08d1d9e5b9494605f2681caea4ecb5f5bb9d73cf85d2c4430ae1a3d88da74169c1b9274397d28cac8bf67bf954222069f9880c064b4745191f2c39c15de7d4454bfca6ef0db506756a1552321382aa66246ff0fb0d916d405a38c5b72d023b3434b8541d65eba4535a812c7814fe1242ff3866c279fc6c5a2607cc4b4786ab9267a3c7d83a1a378d9b4313c551a1fd312218eb807c4fcce2d94c887a247d9ad3c3a1975524d8d06c87a96ee45aa4ed"}, @NFTA_DATA_VALUE={0x1004, 0x1, "ca43a73027bff18958f05837b147ff04182787762ac38f8eefcc65a1c864455c3d811a413e32c35e6303f77738c77d2b6f96bcba392a8c1868d10aae545b93bd204c2e6f96c136b82a23a9952694b70389c83d4b9a9ef0ce8b9b51f9dc0e0ed6815f3bdc849a34e9518c3aa949ea1ef5857aae93f677e31a74ea9dbbe9c21c204695415238f38da6743492c61cfe365b4c6b121f4e0bb93880920ed4f35e7dfdec3fa12f84e95756a0d47a005428f7ad27ad7e4a8fbff968ec64a5d71abba93f940429a853e7c497f8d0744256cd55517cbc2a808870bbc853d9aaaea73e4e53a10e72e1a42b0fe9d767c643dda43bdb731f396ab2b702888b5969c5c6b4378f0523a7b0ee2344c41868e0496fd1dad21187666edc582820003b4c3ab5e488d7e75ff6c77c6bed91406e2bbb00d93c62a17f64e2e425b3f36f54363dd472eda8f8a7e9628ed94846f510c65d330153696613433f39505e07a468c18163770e20db9fe2b72061acc34b58ff71d68dba5d98b4b38669eb3592775013a4822319812984dacb3e0fe82d2e857a0425cee12758e34906c329e70dd21895654307ec370396a9e76c30e9b38ecc9be0add918c643f231094c338d430b968f177324adc9726bb860ed674ca1a955255efe5e527bcb40901f234d3ce7b762cafd4f5d189c9795db57b94acda29d9925a654974c035a17798733d63e91933d8c3533d9b2cd48b379723069e404c3c08e2119e4192233587e29dc673743d75a6719b0314bd73e6cad6e3a27a0aecb92a2ef018e1fa30e74fb3ada42bc8e8e729144a780558c2e8358b06b5f49308e4217d7d42997c579642e92d07233ec33ea89cc7f0f3c1eac0d446afe2ad9b7f8fc9f73c8637b274862160c7bb0f09b8fb0f9c8d61beaf8deb2f6f2b82d4a98956ec74c6bff4f8917e63f14f6cb2851ff3933ce5fb88b02738752e0c7f9e212317badbcf9fb0a75ff40e144865cfe744fe0c677eebcaf99257fcfb6a3801cdfd0463fd9029119324421feafd8d082c18b46110e211a7e99110d93c813b1f3b01b4a28e6fb85b86508aab5296272824d34ab6d1904d2943843fb47fe718a2ddf660e3ee05e2b87d97bc7fe09312ad2d0696897a8dcc323ae275c01d111a0fe30134c9dbee60583c79369ec36def5f0f48875404a2d50e1c0b281559f65ea2b94f654b56fe8e25cc8ab67ee0a676de7d58af707de8b0bb99de921151db515374c541434f99e5ae14da5137c20c3264bd9f244375457513a63863e2a93776841300abb6bfaa1137e8b774294da186b21b9edcbac9bbe59a747300048ceed3e111e61c59667d0b321f215b7c68c302601867af2fd1134081ce615e1f801a5322049cd4f519c05a819474ed90538a2d912942fe3eac2fc1b1343b71fed3dbec1feb146064a36dd0242d67c5a1357f2fbbec6c9b1af6ceee7bcbcfbb29121594c25101acf8b1bf21d98d82b74059331ffce3975f626b1040cf5fa453428eb717ecb7b268ec795062e3fefefb77c241e4e87b692dd49ed1cffa21b5d6ec0a580ac988d8dae1b95e279543cd82b098876a37cbfd2838ae9499aafa47c25da1e744c72aa95181921c2a52eedf5674af184ed580ea7bc2ee52be93220ba5281b74763d5166c953339e376f449d7817905d634f7d0a29cff137bf69fac0fcff30039619cb0fc05a280c5561e21ac5e931840202a4508eb9216760cd1ce005a21c5b60adef9831a66c674b03064482cee74b296cdaffac71728b8f0a0f7f944ccbd66ed71a803f72f55c14ca42a29f733e308e712fdea79d4aaee6905b65dce3adb51d40eef42766ea967f95dbbfdddf6177e58c174f0e0477ad7a1b6be57fa2ba8134ede9e7fb5cf28421e3f391b43e300bcf33f57c2379de8af84c850fc828090d512ffa300bbc44472d564abc51298231802facd39fac7206776b297371f2a7a13a382e2ce1064e914d0742b6c7a2e0b49461cdb132cc1f6e5e6535649f6385c92831d6c5a447a14eaafb0c68aa78860ad37575e8bade06189c437a6cb2c21deef01c8ee24570be7f5d7bf4a14fdda5a6e203627a804e32e8c7ff30842c17c482e786d7f5a3de53070585a76e27c7ae4ec01e3d03eba6fbd17af13b6a373c066ddf3c6d76b66c1b93b367b173a8e1ee42987a75f74af92eeaf6993d42b72c520221a0574c381e1a55d105b1b6d245a6b02535b89e24088a2b183df729df6df9c499ea18ec3427c4d22f0e904975c33cd8226e30d826977cc445662f7590981a2c2bba4865d0d6d7aebf15b44ab10da738b94d9c855b027b32c2e91605d5734f2703e13149dc515b93d004edd0c3cb25c79e2dcf7d8f4c169f509cbb95f94669f8a14c1436adac2c72524d5420dc61b56aa1a39b04aa33296138dca0e354a4d090c45c5e50ca743c2dbdd0010d2d4b598816cc19b71af405482a57c3b70ee1b4fa6e0cbcc40c125a6d4ba6ce86f8db300358786143c88221019a37815c96433c148c118506671f352340bf9ea381d78969ad4c369736a793cb0dae28ae72d8f5846c538a36417305844ce8a3f33be8b06414d5f0e60559757b22fdf5b758ee91175e04ddea34806fc53e1e8289f8b6a9132174e9c55db6a353dc3e8e349631a99baf3cee604b1bf3918e9818bee8cec8989d4b88fff32b75ce4f0a7b913e6eb2b479a841b3ec4598fac89ea8f3d546eb34a31b203f4e43fed5bf4bea6d837e5c5aa58805bada81d04873543e7fd42952393ca6c847a07c2714ced75d2c58e56f169aabe3a6b0fe8a46c78389021cd6e650b0612fee0d3c7ab398d75382ffc4fc93c044e8facd5985525f6d0e8b59efa6495c3bcdef801b80a8c2811b5dfa7e9458353f3e059b79c0dbfca6902bc51c4e0f9a01fa3fd46d37d176cb2c4175afb679863c2e8c07f526e146f25f788c187fd787cece0a74746bcd737d6cc01af07b97eaecdb94b458508af0da5c1d7ef73d51359b08b9913061dac67988c9b5ff14785f9eeb9021795a56bb9db22726848432161524396979f6ea3abbdacfdb3ad0ea38f487c10e1d8156c3f0b15dd6e51ed7ea323665bc6670a128bfc87861cf1b851ecc07646713262dd45f956030b0567ec8d6502c52474625be92c9cf07ee557de3750ca91e882ae63a73121e2a001e285427214ea93c214d3fdd996e755bfdfa31e1ab0c3f68d05ab876b8275e159c9ab18fc27846e3e8e5ff1b02f7c1c3d8479570626b8bac9dd2f616b1e7cfafe9460bd033e848b4eb09a8ad89e4d095ad026be852c4a4109ae5b187c8498cdf27dd359fe349801d4d41490ab95e6a3112edd44482da2cded1a7743204559b4b03d4004c309426d569fab28226e250bb1bb972ba917fd8d653b29a551d1a913f68c1c496262247b5345804e44c24f01c08e085905b75ac6efe33c2debf16b89b9ef5b039da8d1a8388a444b9b80a3c780c7cecb81c7af62c3baecfab39b13f0ae23cfa0881552b0a76f25c62842b91da4c05bba746ab4845e8c4bdc751a29dc086e2b97c74ffc4944669e0b604507cdcb487c095db1d843226e9dbe8d17ea56090a1156220f9402e3e8f9692e43b95ba703212c74a9cfa172c6c3a3d8ae71123fd14ee6db812e7b2c15caa53431acd2ec673e1ff86f4d6c30ba29d31af96cbc6e66d639bc65ff12ec423bd151ab81e8962e8122e8ab093157f9cbe4786133e008a6f29a22412e5ad87a4288f9ffec43fa339034e51cc0df7a1669152bdec0e9ecaa5bb6cfa75dd00b7da7dc69692ba47b8eefdf3123e276ea68b5a545cc84d7fe390af53aacfea082c71b12faeca07242379d28bde8ee57b0e898ea0d7270169c93207e571bdab680702184874ffb0538331dbe5a8b2ce756122801e99aaa0161c622aefe0a0153f30138088873ced7ebacfd7413d730d45eb1a6aa203eb359bb4aeb9f70b9773f4e34f99a451334db0e5bf6d1cd6881c664c12df3bf314ebfc39391862e3ace4303ceafef40c82d56691d089eb06d6ab12990bcfcc716d1adb571a9b033e3020f8103b80369014f2c9b1285f1e9805b8d1797caa753c68ddab141477d4a6d1947bfb6ea7c13f57d716582fef9c1dbfcf73708dcaea776faead85af1947269a80e9015a142b378e71bba1269e0e21ae8677e6695246102361e224fe7ee13ca24b64bfef8603b2c709506db7d5322dd7aecbbf90b3b5754a051b0833c6132ff5545f65c11ba59327e21d233bfca9654a840f1aa1573563062f191557c7f217f07802dd7606cc4399b6b906a20286558d0f1372f2f23f9f4fc87c647b09b1ce47f695fa3fc412ac405332089166d67201c3bfa3a2fad355904e2ffdefb7ee71f1928368a875635794ff3801f4e06f1e3bf2cd04eaa250a69a535c595b4cfeeacb6ae18c89c1d41cfe39df6327b07610b27247d1fc1451a54585836ad68a7017e823e751101f8ea0d2134ded26dbc271a0e8c0d8359c32a8508bc42b468da7bf057280d02ad10df5348e6521779e904bfd6d8c9b9e8bb3c20355682914b2646e22cd4a9ba37e6d0e2eacc4da372d0991dfb7cb016e371c16e0c783cf9769f9551375267fe81053b44989a8441b7217df2dfd05b60713c98191c6acb2dea8f71f424b4bd99867fdc81d5de808134aea203f5f1e8e27ca639481199a49a5f5ad464f953b95342290f9a673fbf64706d830b3c3052f88e0ab49bdba2c741086d8941d69cac1bbfb6fc315e3d151c9c560a14076f3b5e8b70f0e07bb0b9a3cd4c10f237b22d08573398d84190e2c309c8a71f811460bf72bc5cf5289fe7e2d2ecc1d94b755977b907594e3066b32c7e350f8244e700a304c12939cce5c870599cf6f55e125abd72998b58dc72da4b531847e5a280b9cafe7526b001fe58fbc7accd06cf57db81bc52bd8b4cd168078235a6a16f446c73618bad5dbd9b0e9521bc3db365bb329b93f7673fe072fb3bf2377b91496f5a43ac287b362f70f576d52a8b25016fe5fca325b48035d77d350ecdaa595ba21a52bee88213a0f72e676f4878c7b941f0e143b7d2a9de177521ee82374f51b44cc58f997eb0eb17c2fcc5a26dd950328c63b2e73c33bcadd6870b9ec23281c846c18f16e75f23f092919cbed5119435469bcb4faa8c4b0b1ad9cb33a5e1e46fe15c2b5127956007d8925e26ad2789e1b85d009d8162294928fe50390cdd1545b08824ef615e302f45afab655529ab7b7287f93a3b792c4d0417764a7fb6222e6104e37c03308ea2078f1b42c5fd94ba4955e74044094df830d30329b8f42b4d779dc7d7a615e4827ed1af83b329e0e5566d6b4c98cf929c6e7b5148d74c3f733e8c5ebe7d6ffb232763156d27d2b9567208538b7cc41d81876e60daea61feca28ceb8df45ead7b768c95b54b0d62e045d52398eca6ce0ed9aa038096674436958d4520526df221b11ecc183d46fa1b8b3cecacbde164a70587a1d43954ca9ab93fd9f4b00599d88dbc0177c92e6e63e62cd416c97bc3da371c73f3fc1cb037d17c3420598bb26efa67a34a0989e349ec223863bec8fd4206c4800e131e957dbd94667b5385c04f08a306cd97ae379c261703f2120bf9b464ce106b5795d98e6dafdf8ea1bb629e6f0d264873db6685036b9377b5545c170661157c3624712f47abb1144366da935da02bfc403036984c530a52025d67c98aefc07bf06f811e0895a2f958565b45b0cc818483d355f9931b026e91659e1d56e7a7c5d52c9537320717d793c7ec2757d4f1b2de1b9b9d94be520766b91bb3fbfebfe01f6201b9a77bedde6ec8808ee83bb5d76bccb2f7604ebcbb94407"}, @NFTA_DATA_VERDICT={0xc, 0x2, 0x0, 0x1, [@NFTA_VERDICT_CHAIN_ID={0x8, 0x3, 0x1, 0x0, 0x4}]}, @NFTA_DATA_VERDICT={0xc, 0x2, 0x0, 0x1, [@NFTA_VERDICT_CODE={0x8, 0x1, 0x0, 0x1, 0xfffffffffffffffd}]}, @NFTA_DATA_VERDICT={0x14, 0x2, 0x0, 0x1, [@NFTA_VERDICT_CODE={0x8, 0x1, 0x0, 0x1, 0xffffffffffffffff}, @NFTA_VERDICT_CODE={0x8, 0x1, 0x0, 0x1, 0xffffffffffffffff}]}, @NFTA_DATA_VALUE={0x1004, 0x1, "5a7b15ae77d39c1195fd6befea53816351bd04ebd8a6971c32eb6ebb811ce43f8c2da4e8f40ada7895cf2e0bfcacc083f086268044af2ed8e9a0dbc60e92df82a64da27766c244c0bb060969222649ad620a5f11b54c9a03c43704eaeb29cb517b5893a65fb6d1342b3bcca119491a0de91f067e5606c1475a625de8b273836883956a0eb2b2b872821398fe5f63c19d142d2a1aa4fce9648abd425be7849cc808b1c2838976f3498079d4210c07307713bcc78b4f1339116e6fb12ad7057108e30b76b57e24776ad40334c3fb3e6d0363a94829402a79816c714b0fce7351044fea740b1e8f0dae47088e0b6761e45d6116683ea3ed99e4183e3f9805f2e653cbaf80305f264e0c43ea762c4ae564c8b160a2f4d092e488d318d1db90a306502d1c9b1a3548ff113a7580bb652dafe1dfd72efd867ce59b8f126214f13a0f8ec55c1ee3bee721f5172861a7ca8baaa3c5abe65d9d5669bef45b9fa89dc0e86d339df6eee5d5b9e203a669ed42c70212b83090f0aa4f4102a004b5af1bdbaa8b4d0b40c61a9d53a34d0fdcba80994d81616eb0213899a28ad60a514f67b09a7ad590836fdc1462fabc4d1f896ddbfe58da4ce82f2cbf51f509457dd88b91cc611c33e29d08e7c236182d75a93bb88fcc377890db6ada303f821d416a2295701e294cbfa20b1699f3fdc9c415634194c281c927f2cd940c5dca74ea48c541adca7ed781f9f9e2ad84e21a345fb3a06aa531b29b09384ea90a6abaa7425bc1ea50946aa4a946ede9e8ac102deeba8c9f6647741ea8a1752f2eb6e3df1777f4d6e60534a3652ea13ace2a51e8509ef2cc304488dc56972af20206d02fddb3beea051fda595d313a68febc604a89fc1f233a2b3889cf957df2eccd7161eb0926078f405c1985fa84c8d6d1ce10b15bdb5f9a11748b847648753c4329d6eb4d601bf3cf04e517e37c595e91e0737375b15dfd8435a138bc76182732c0370bb3392c7ab06df347e6fef37c30d5e69621a59fb68123b239a4ca2f1c987515281dbf201261a287438d224cb3521a1ca1cee433844c5467639ff47b23b14024ab99ff0a9c74444db068c1dd8dd69f95f650f6b8c0874563d10d33f31bf394440c6525a84db0a8681a2db0b87e0e9f7da381c9c54df9dc94e5d4bf6e5559f720fc620b90ef51bb7f3c38af24763645ee46795c5237fd6d724652c785530d69e9ee42844698dfc4b93b7de53636ed7cfc7ac218869b65c2cf29f015c33b178d3bdb2d036f5157c653bf17958e2c614e2dc619b908e6666e5a9f02df2058e933e302ec6b6a25f73057496c973e8c65a5d0a076f704e19eb562836e4d3b4eb9308911345d1e909b7b24870e75591bcd9bae79d2b64be5aa415d9d9727009481e6840172cb30edc1c2e9cdd6f86d7d2b753096c16a40828012c3bfdc30ad23bda4698351695e0914cfc3447801ee3770d0c992879857e4e95c737a70b9b6e6d2537720881c57d5f469e26bb8cf690c48693e80c4f4f1e0c64183d2f45eef3a9c4f09a038f1e7ef9ab87f9ffb6db36c1f1e0d833ef6cd12b978ae4dd1440cefeb218eb3872726d00e7f676c29004b686d42c89d8eac2a784a7bcef18926efa1f094bf583cac681a060a6c1517d9fd6f4c457bf567cd69b7c5756ff43547c3450f4166a4bbefa00d1a0ad388403cae4aa9d28381f4b99baeaed387ee735e99445d9582845e61fd24bbf71293bed64bf7ae04ba8530579849c9244bba040061278d2f87b7a0d9458b42c4c657225ffed2629198e0ddd26642614c475f154b35b1a702607df7dd5d0f86662aa73b358f3e043117df35af66e33eb6087fbb902820f7a8db7cccb4120851dca359796436e7bbb9ea98c628d2d8f8a7a38736e8eb02815d915b40e50653824d8411f441124255b9f1d8846b753343011c1e93769164ac44c9a682489342560729160eaed2e28e8117dea940e7ae157150749f1d1b3ffdb24e2ec236fadb20b296fba141a4fe416e38402101f961f79aef40d5862f56676c42de01f8bdba7345b2a7a35abefa8afe88df000d269e7a8d502650c68fbbb393c0c6063b517b73670e04d4aa9487c1590f459ce5fc62e68a2102a881126284eae0e888a0a9ef101ce3624f932cc376baf6a071a8c0acfa9c63c93743b7e7054693854b47f75d72b996b3f653d89a5777a2d775fbbefcc5e8e998f47684496f8d424b3c533f025f623d17f514acf6bca522ae321799bd4aaf7a3b8079f8b7ce40ba5d64f715949be174797fa3661778b1f453c581678766450d6042a265d0e6bf3c4341e3748a030646952082ad013576d6513fda2d7c9fc98199d0c595a43606a1a0fa0116dc18f8dd0944092963a83b331322b417c01ca4848a5a917c404e4b0f703209f0931a7639eaae89f24e7574ef81d4cf0a7632219283ecaf49a91b18b1100627dd351de1fa7a269c2ffcfd7c304e7231b49cf74159982ac44c851b80b24cf105ff036c52a038dca5f05fa800e047b5f2576f64801019aa13d83c05dc5eb18f12b5dbb6ce25a405e58d61b989c8883ee7f6a530f9a8091290973530d9fc0138721f7af4d77ba76f3f6e334d291373a3d49d0926aa1d4217573c3925435dc28878a2dc8110069d9a7e4c5a486621982fca3976e1e24189c4b4550d1ad82feb302390eeed90ec4896d1e16901fe9e72f2a7c6b3410b86012648a2a5aa10f3a20552e37e594323fafd07ac505d209f68c8cdd90e83bb8013f1300caac13a9773f82908990ea1b579cc6cd4d2f93f2394dca83c33953795cd603fee9f923f1b72c96711607e5b38a132be92d82a33f65b50eed5f3a76d569a9742db2caf4baaf3856d0cd54f8d3dfbdacfc28df453c1d34dea67f79d5c9376be0bfc58cceadee13f73accab41728b373680d623a8dbc5fbfb6b0306807f4756a95a040f4794fcec39062690d3ffd7cb4a617598e401e98e635d5060415da232882a2f21d2d119c134dc4ae250a0d6cd5441bb2f41be3cf6b48249d78e5d93ee0526651a1dbeb6de02727ac30779537dd9c4fac85bcb0a5e6ef2056d6d728e0bf1a1a50f6434adbc532aa25167e227c16d23f5f4bcdbe26ba9e102d2ed47ea474f6be7a91187d035fde6174f0f834ffb75847845cb68d5cf460b06edf1b01f71b313dba913682647751323f3adbccb54f0e41231569905b4df7e4b02afff50966c763c8deccd3f15c66cbedeb84769aa3c0a68468e25fcca89c2d2979d318978c571010d803c4f3dc3e7e816ed74641ffb15971ccbb6bb3b04ae9dfeb479a1463bc12297bec9dc2869decce1262811b129a929ebd25c8c200782d59aa66d72840002c33d9408c109ee6384158a54eb7c919e14af3fd75c78e6abc282e3623b780ad81218f52cd73e12023da6b9d89df236db41fdb69642a54d6cd57a6d881a7c875d27f8681bee9170669142e527f98202d4e687a0ab6eeb0633bd0d033c13ad4520c64a2a890469e5d7a923e35711922c05006e1b3b0adce995442573182f9b40d65625c8ca1bd80854e9efecc6498c8fc9a3eb830a8750c3e04734bc1ddf3fdf2b3ec34090c95ad31753ef34dfaf3101318c0e87d349cbf36754fa96c9868caaf6a67beff5557f6b0363cca2f4de40460290a4ffb98a19b197213b903a5a781ee50ecb0e72e351bc1aa683b24e8ccd2f5943d5c7247eeb15c90933b68fc185dedc641ea67184d2f0c4d7ce6e761b2f8028d20879b14dafb05ddd69dec1b0cc2c571ad35d2deb53a3a34713f56ea96208d10bbae4bb28c2a92518ce16013f475c4aea8992b3728bbb63fda97a454354edfce60bfa51aa41eec0c6e290876a81ac2206b968ca6c93b741261dbdda0967ff00500808678fb8fc2faf3771873516b8912f2e2cc2091d4f54585baec695f9604b9ea1f0d3188ada0db257627ad23b3e34d9182030b6ea7b6641bf26d3ef3c53c51feb9f22fc634be5fa41271f16fe9ce8daad96681947a21ab6647dd6b4fc11233c71e4b5c4ab8a71e1657cc276815411bbb41d26010f2ce59acef86b8f4b5c211665540427c2c0072d568312d4f9436bd730a3064a3547c4a7c18b203a0d804712f234934c0ea5d35c750ff7fee09081265244b8ef01879874bade42d1abe1c373e69a1858fff241a20b9da6b4d5333b68ca74b0e3929166063ee627c258e07626cce61ee37a0e810ea416ecc95367a13a8a14cb5b88a572e651377bf3fc1fb0d13690b533434f89d4097fe952044001194534ef9591cb29c659101f896bf20a8ee5b47f77467a24deb5d3b9332d56884406cddf6498e16b50977f5bfcd51014bc79b39f1bcd2e287344fb3a81346d2a1f4a74939cd23af509dd9838a14303ad56e5d8a134f2dcf640298c9d7205d26749053bf09dccf07451ce2bb64f065b07fd4ebea476d4ef742a46ecd79b6e669af456f61d6f0ada23e662362243d62acf6a6f13fcc23dacacbf3e8b01bcd4f436b302e79a12a702199fff69de3834e33126261bcec290a8a8d404e528baf090e08e82698d6a151aa8c5544a1a73e43e87013feee39bf95baaa9ccceb7bda1355494cd3e6ae1e44ee65f7d2a221c498c39b9a43b626b1bd682dcc512e84820533a943e647c18e6f6869dd978195b5ae54bbbfdf05db24ec6d3e7ec6a4f56d5b6ec94119936fb22ba77ce48fb271e211a4c944e6868115369b85de12ed9dda90726de15342022c30e4446212ef4a27034cd2227a1f45c8901ea2c7b64cd5f69d422cb83b7d1be84472541eee01296e251711939d8447b67dab2cbb448fdf18d3b24202d7f758ee24b3133412adc13ff3386868389e280aae0d4650d814d20e0bef56d00c72d34744853013d15400dce0830a897b8ac359d18f37f1cb1e06f9c56aee5335c2cddff763377dc6074741721a755e28681403a1c380f48671f13b74005b7b4363928e3ce036c24fcf8b53de85846d9608a7997c79b5b5f651902acdab29c0e6d2a73e2b45b4dbb17f49429e3d7112e46bd7c1b3898922b803cfe8e865e1630bee3e043b4dd12de142ca8475beda97a208ca0f9b3b92be535c48a75d254c6b909c3f0c6c64019956d22c5fd59e86d6eca7763725ce25db61a7108e2815e026717479617b2d8434c8aee39517463087ff32f2838a925eb25a8234fed6aa577d7194cdd6cd33b5a3b1045d30191e7ade3bc8b42bd1abe762e8bac00711942c0fb2726c4bb9ffaa1fd463290249e15eb35a20c10116a988c8dca9755d0355145e498567936017ac19ac300e6caa453eda3d7c2f1bd63908a54a3fbd2eab2160e4c0ff59c2a6e02aa357abaf53e86ba74cba10876d5908d41f736a9ddb964ab5b3e7373218ba1579ac52dad5df5edf0d8b7dd2fbb1c8b885022e3d2f5251a72597aaba0d286c3fdfcdc45f4112d15978df5245add4bfe5e99d185c1cdddabf0bae7e51260ffe003264607420e06bf8bf9021b64dfd759a3152c8da5432927fe16c1eae35e5a08eabbd5df75cbfe3e3d5c02b4c9865ceb9ab4ad9be1c3e04e0884a1a6ee51d2a0777ed65cc6546a2a0ee3d04f2a904715312c7904edeeda286ffcd203ef5e50f150efa5233e2c454e4b7a72ef73afc6a5cc7616caa5ac74475999931750805746bc777ca06179b7415e8b2e3903be53f8cd3f0a98b48e11fec4715d2966b53cee96e1a530b7fb066138a9983e80908cfec3102b829b9ba433f3bb3be8e57cbf2891ba67473477d5fa1d4303dab9004a7f10745ca59d39a4a4c33434d4ab2f31400364b09767ea16dc6054e00bfbeaeebec34653fb59bb5132cd4bc43e5d3eab5f6a738"}]}, @NFTA_IMMEDIATE_DREG={0x8, 0x1, 0x1, 0x0, 0xf}, @NFTA_IMMEDIATE_DREG={0x8, 0x1, 0x1, 0x0, 0xa}, @NFTA_IMMEDIATE_DREG={0x8, 0x1, 0x1, 0x0, 0xe}, @NFTA_IMMEDIATE_DREG={0x8, 0x1, 0x1, 0x0, 0xa}]}}}, {0x10, 0x1, 0x0, 0x1, @target={{0xb}, @void}}, {0x10, 0x1, 0x0, 0x1, @notrack={{0xc}, @void}}, {0x20, 0x1, 0x0, 0x1, @nat={{0x8}, @val={0x14, 0x2, 0x0, 0x1, [@NFTA_NAT_REG_PROTO_MIN={0x8, 0x5, 0x1, 0x0, 0x17}, @NFTA_NAT_REG_PROTO_MAX={0x8, 0x6, 0x1, 0x0, 0xf}]}}}, {0xf8, 0x1, 0x0, 0x1, @range={{0xa}, @val={0xe8, 0x2, 0x0, 0x1, [@NFTA_RANGE_OP={0x8, 0x2, 0x1, 0x0, 0x1}, @NFTA_RANGE_SREG={0x8, 0x1, 0x1, 0x0, 0xc}, @NFTA_RANGE_SREG={0x8, 0x1, 0x1, 0x0, 0x12}, @NFTA_RANGE_TO_DATA={0xbc, 0x4, 0x0, 0x1, [@NFTA_DATA_VERDICT={0x6c, 0x2, 0x0, 0x1, [@NFTA_VERDICT_CHAIN={0x9, 0x2, 'syz2\x00'}, @NFTA_VERDICT_CHAIN_ID={0x8, 0x3, 0x1, 0x0, 0x2}, @NFTA_VERDICT_CHAIN={0x9, 0x2, 'syz1\x00'}, @NFTA_VERDICT_CHAIN={0x9, 0x2, 'syz0\x00'}, @NFTA_VERDICT_CHAIN={0x9, 0x2, 'syz0\x00'}, @NFTA_VERDICT_CHAIN={0x9, 0x2, 'syz2\x00'}, @NFTA_VERDICT_CHAIN={0x9, 0x2, 'syz0\x00'}, @NFTA_VERDICT_CHAIN_ID={0x8, 0x3, 0x1, 0x0, 0x2}, @NFTA_VERDICT_CODE={0x8, 0x1, 0x0, 0x1, 0xfffffffffffffffc}, @NFTA_VERDICT_CHAIN_ID={0x8, 0x3, 0x1, 0x0, 0x4}]}, @NFTA_DATA_VERDICT={0xc, 0x2, 0x0, 0x1, [@NFTA_VERDICT_CHAIN_ID={0x8, 0x3, 0x1, 0x0, 0x3}]}, @NFTA_DATA_VERDICT={0x24, 0x2, 0x0, 0x1, [@NFTA_VERDICT_CODE={0x8, 0x1, 0x0, 0x1, 0xfffffffffffffffe}, @NFTA_VERDICT_CHAIN_ID={0x8, 0x3, 0x1, 0x0, 0x1}, @NFTA_VERDICT_CODE={0x8}, @NFTA_VERDICT_CODE={0x8, 0x1, 0x0, 0x1, 0xfffffffffffffffb}]}, @NFTA_DATA_VERDICT={0x1c, 0x2, 0x0, 0x1, [@NFTA_VERDICT_CODE={0x8, 0x1, 0x0, 0x1, 0xffffffffffffffff}, @NFTA_VERDICT_CODE={0x8, 0x1, 0x0, 0x1, 0xfffffffffffffffb}, @NFTA_VERDICT_CODE={0x8, 0x1, 0x0, 0x1, 0xfffffffffffffffe}]}]}, @NFTA_RANGE_SREG={0x8, 0x1, 0x1, 0x0, 0x14}, @NFTA_RANGE_SREG={0x8, 0x1, 0x1, 0x0, 0x11}]}}}, {0xc, 0x1, 0x0, 0x1, @cmp={{0x8}, @void}}]}, @NFTA_SET_ELEM_EXPRESSIONS={0x1140, 0xb, 0x0, 0x1, [{0x10f4, 0x1, 0x0, 0x1, @target={{0xb}, @val={0x10e4, 0x2, 0x0, 0x1, [@NFTA_TARGET_INFO={0xb5, 0x3, "660918f43084f406bc62ff99ca82de86c13dffb64c57d51313904593223c0bf033c3077a0c0566e12c029ca1f296d37f8f6d757a52f74fe9d14ad274ff1db6a43ef11b530bb375d8c57edf882770c07d65892d1ca6808bc6a429c2ceabc54d5981648e168f8c11ee098321ba798fccca522cf289151aa30a7f4744171114d8e93ea5b8026009038ad1fdcd992035785f79be31c72ba51f01656e9a959c3b80e51ddb284ef776c3013eb19f9da499255c3f"}, @NFTA_TARGET_REV={0x8, 0x2, 0x1, 0x0, 0x3}, @NFTA_TARGET_REV={0x8}, @NFTA_TARGET_NAME={0x9, 0x1, 'SNAT\x00'}, @NFTA_TARGET_REV={0x8, 0x2, 0x1, 0x0, 0x2}, @NFTA_TARGET_INFO={0x1004, 0x3, "506d6983be3441a8d0f6b2196df6da8759e5ba9b98a008924a6aa7fbdc822391989db0fb473e602202e67f5c8383efa28f0f695865dca6567818ab257b2269881a54450a376301cf660d3edbff73fefc69c26afe050fe924568035a90132e21d44754808115c25816f07ce600b3a7acc2de646a13fc4f490b09ae5630be2884e998c1c8e9da117bb68741e9c918dae25907e40bb33931b2b9bbd5e1f1d8167076ad698f2262d14b3e5579a528675d0bab444b35022cbe567b979422a392d5b36489e1b2282d0c84daa6403e608d6bf615b4b7d361f82b668e1bc9f4f750b6c165fc3c06f2dde166b134daea61c15dd8a52fdd9ba0f2d4ef564c7488cd25627203e613cd0e2fdab361704cce4835e8cc1d7324330026d8ff07ef631c7cf3dca2ee2cf768fc63e72ab76886b20a022e34407949c38da94f988f284d6635ab2ae764cab49deee486663d4773a33f7610153a3671dfb8256ffeec3f119037651ec0b45abccbc507a0a21feaa6c513f386c5bd4e8e75310eed82407d535896bf8bc523034153721348a902584def553d9e20be09c5af14423857697c1478591c1e0b6d980e59b2ffb6dcd307cbf58b68bcc45c6c0fa0490f4aa0d812e28ee975923510276f501cb605e3dda2cfdffe1d318b14fa9ce43ecf1eac7e03bd312bf0b01e6a1b616a2e25affbf6ba923866c8bd1450ba90795bc7ded784d8a56246e4d27ae3aeea91e0d8a1ced5eef9e83c1cecf3d4d056168f0c80c5dbf677bc1586fd5a05023cf82d7ca0a0536dc9b32d3170d89d2dcb2436f9d0a71d921af389a2d2ba4439c7ea2369d34b59e8df08a0b504dd93f37b98da3c58550e5d646849389f852c10debdb2fc3ffcfe4760a87fa50d846f1ff46645c590c558ba5a548d463c905f884e32f917010db0b8631b90d5a9b4b61998c7a13c88b02a8d1a95917bd61fd5f26a7915445f3ec83d69d47f98fbe4a79437eebab181fc34e6525c08a99a811bb0fc80b60b6751915508e342811265037491835c6c0f00fd8bf9009e16a22b23d6b386be403ad533cffd865a06d309264e2724936fe859a7dcac94108d3933b1ba39c2dc2d131d3d0e8dddd993f08dbf2ed3ecceaf3f2d666a01ad7b01d0417dc6928e338b915b7c1c24d839817d131ecce59ef058e32ebc1d62b103d402d6d4c924cdf2186081ebe88c8cb4d78b77ea21c568dd08492987ce61ac2e133718b3a7c079b8a4efc9d55b2bbc9e2204acf84053ded49bfb47dc6153ed9c4c47ebb16688f0da2cf0482def7c5466ab7a7d19995bdbdc38bf9025fe1ea8c6bbbd1e7f6aa787bc27a2b5f7ae305a0ba191105647c2129e85334b6dd9dda1398e59b03f54500cf65b5391d6ebab765f8f7f57df9a262d9f939db7dee4bdafa2de56356854c803a6a50511693b6b4e3e3c475034e985d7c8f6a7a44158384692780240a124a7ea145a3ccb5163c237fccd5195afc16a82c216ddeb201f9d67437bc900b51e8ee0a2d4931cc0264a0fcabc8ce54c1aaac15d52381f6f295d50d8e9afd72e803713c49044d9e95e55d979c0f8539175428095d0ffe56a815ac37197426f16c4c3b6418ed71f0881a69dc90b070be919be4f86496abbc04d1731339b8c09af2548715b853c4ea5a614811f1d24e5197c8abffaaac41dea48d2f6074965bea6d1837f35af7409790506cf6ddb995111eb0371b4148cb1136c1689829b26bd2134f5850ece723182de724d463712c8d033ba95d29710bc5c214038bc8c2fcee02ddd2f4490914e6042004e754c830c5f012c79402f553f9e83d0fcca044c1d429f529b1c18356fe1bb2cb7df9e5ca9d4d913529b964671a1a3cfcae1974e7d469c52109e39786f403902dff855d0dc8546a1eb4ca1e58098b936e8266cd7a0cc0f91691198276bdf5cafa757abf2c62545a4da73bce9fcb695e26656b2f4aa1dcb382ebda8ee2cf3e85f24676215019dfab1925570ac3d890a3f21af995c84c28ba7f1db17a4d6d7f52540c2b0aeaad694c438da3eb3e86c0857286511f3f9be4e4a8cc85b2ca00666d587dd82b14fe07c3a60877ed90bc7eaa124d294e45cf8d254cc26a3ee520c3f18b4bb87482f0d7503da110a065ea2e6bc1e999e22c42f592484b2c2ef4e9bc885b6d436f939683bf9b957f430c74c7efad70a325af276f698d8a0e2d55cdddeeddcae5b14a25514a1e1105f539339bf5c5636394e9c0e34e619bdff382d6d5d2a1f5a50ef2e177cb9e1b42be14753fdd8a5ae4e9b39215d4a488051b35ecc040765146dbd0c9a41d76a6fb94c78b417a3422f69fca3eacd2fb924a0884b6078cdef23b848946b785e0a358b941e4c815fa2903072ca202ceb5466e88d7c63c319f9de2c8ea89f7d4cf554132704002555fe3a6297dd2b1da898c91f189d36b1e1d0e95d75856ef0ded06dc8408731513a472f1ff1d814a4228bef5e9dd18d7e886a3fe9a0dd76b721eb05915faeaf23705c403790f75445f65f5f5d48bbf4b767db2bbe834c30ba091f3f86e0c9876ece8cf049f5a01afbab3f68dbfdb9dc434e58a293836cdd7a784cfd3d93e8b8f4686077d51845d75a99b0bf8290e671bc0ca29d48f22ecfb8cab8a0ceab845ebd85e6ab7a2fcf5be49bfe82456a4199543c5de2315aea4a5dd69a67e58151d29cf0c179507aff9bfcdcf38295292e33d0cf72d07c03d18cfe2fcb5f6b2229ff2043af7672258f20bd88ec33bdead4574f6157f8711d0810c20838064c7926359aab3056b5dd4aa830e66e9d8b7f0660bfdcadaa3d38cd22cfe81c55b31bcf2329284883ee078350a71f8c895bf5346f908591b934218fd2d63687fc9b9c16ebcc9028039c6e73691ea8fcf2aa7827a3d474331cfee2778c288ec09e0345b4c45befdcfd1fb8318a8b46d17a5c36e7205cf69c1fb199d62c555c32ae31d7c5947d7820fd96f07c4f3246aee0db9fa027d1a913f7cff415caeb34babac5e133cd2dca9640b00d2177f44d8d8b801d475cd4645a1da4b3980b459df3f2b31ca6c0843b36804d33c1d0d336878d4d326f30b079af2c8e02d0043dddfd42e63852ed802705ac2f0802066317ddca97988f87194fae0065a03cfbeaaf3d0815053ec23ff51fa683ba4e656b0a9889b9ab352a3d0fbf9e03b2778c8f9b4627da04332e03f1fc07a6d1139a52890cccddfe7c47f1084bf0cc7272fbaea155181d7a31b5cf3315d22c0e41acbe2a9d708a080fd9f5b67e5482350df0a6140d1029be885cf9d2aea5a4cc1d8524b147efb6a08c76a62cd92a62952732596bb4a9bad378386aa415bc0199ae7a4ed13b814c0365442ce7a80a9e746723611d4c30408a3ec3a82de95b98b7586bb14a84080371d5fb3508e654c3fc4ddb81137d146c49a4a61b6154a40354ce83a684f6cff06ce8ea0edcddda03ba114c592023b52135eb539920e17434c3da3aadfe9d8fe3ccaa0eea32c44e9e4dd7cad11bb8ac761be74d0cfffb182034fc2197e9218262669e930e8de740f17df49c3bf5727e0b1b8dc21b0e791019035e6469731deb40f83803ed86d2781b785e11ba1de877ef07edac9ba08ece165ba330848ae51302f1c18117173b86ef341f13b4e620e9e9a03daa85361d2431dced4ed714a1888f302f3829977cebde71feed6d31170b0b75d3a59eeeb0b721e5f5ce51e5e5009eef4308be0c5d59dd916c74b0d6ddd72d52ff21d444fb447911dd85dc6e1ff6a8782e0337eb3ae83e003370ea81d8974db84621db01f5f61d0586d922628dd94b537a01acb771063dd97113dfd92338a7b60166522fca74da7ff94382f8110f54c15dccfcad28b1785a8ec56f58a963611789d7d98073745bbfc5dc186e9748c9bd78bba1670d9fdbc83041bf8bdbd4af092712ce450e2474c34ec7c2c382bfa06a4c4e4bca2b0712e9178c4266c5f413a3d5c83ae322f1802d8eb12997e870007e8ef6fc39a0e46e53478ddfb192fa1841c3f17636bdcf312d997a2e4d7fea952eca7aaa34c420e6a9696cea2d3c7b8cc25e233a15af13bcf20c416679fde4f977cdc4adeadf8d39a4d1947fa6fe028ad0a5024bd3de89682f4e1aaf5e4757df2d3cf4d852a98d8987028399d97e49a530c527d5e680efa44b95683232718f37da3eec5eb43c589b3437e034d70c48acc38bd4a5c26372afdc53cfe51b6a7f3c0d0a2e5e0a3a68e931a35a60df3851998394f5ead5f8b168c0b6400fe350bce54712ced0bfd54770a99b56ef957303826e63941d060b10e49a4be6c6b64bcc3187f335ffac2f01ee860fa7e7e688a3e59bbdd56f2d3e6fdafd23b58aefe6a9c0cda2cffaff31c14f57f85fdce2445e9bf7bb8bf6e751d1295a74df76f143f560b6d4c27f5d77bf3d35b9d57f90cb7af612f0e5891354ed24350dc2d008187d63b4c63bba1c9dca9c1b13c66f4ef1ecfcd72459652ca8f5d8ecd5562f54b9f1044c51cc19876abdbd8732f300d04830f81cc7b22ae576db5a66c5e9983b620d79c478eecf52c26f51932902a9493d7d050b7fcdcb1f6b6e3e810289c629e7ab27ffcc49d1032c31140c510496c2f287d23b2eee63494eb38ac6c77fb870c5e0c9c796dce125be36c1ac4190d1d88aae752b78fdc0c6b5f24d0772cdb97d6ece570c70004b9e1c38fa65be2bcff9eef38232fe4565ca20f971e7d9929ff8f5dd654358aa8287dea6ba69b2831e344357c15aa58c406e739d81052400ce642b1e0c04a35cf304872d99699c346b42d5e30e97d9a3177d81ec728bfd8c98f2507be542513cafa41a77c64bc15039a60c3c11497d012eed0e1df81adc4d6e47bf025b7bde108306111749207aa517b25ed232c84dd7f2d756abeb56f1514070cadd5fc29771f6ff066d84b3d3b016d4a6eecfc7f7b3047e768f616de49f7ca73e26f4c2d01da8aa9ca50310258230c43c627bccf2182daf8c846052270062de1ad1b50f2007311cc6c83a9d4a515936ba6b119eef7cb372156272571473c34367b278a407c7a1fd1f413684e7a7a4c5b60b81e2d125d2af10bc154e25a3473a692af08c614c4f90331a3b25323a61d85a8f610a4943807b49477760a9c2767ee1289ee419763c25b5f4372c6c13963167bd7c6fa8c062fe156bc7d54052eab71f077af1cdc95f368f70728233e563219636079317c069de03f574fa014c30105fccf9c409780060ae5d65e07aa93fb2a65afa1707d4f7e4e73a61ce0fe1a66bb7bf89179acd356a8693d1a52c70f20bfbb0e050a810954bdc3a929286b3b82f421aa39603a1cf923902aa852443ee7e842b0e191c354a51a07581d87654d6fac530bedd991baf986d4a0b934537e0ab1f12ee8cc15afcb7e8113f0086e29cbb34242f8a8daedf85d16705ab59bdbd00b06ccdf871d2e71d5b5dd2390ebdd19c60ee0b5e2cb228fee024b87652bc6639b23b562f6ad4859e53cdd0f2a4fabb37b9244707d72a794ea20af3b9017b9af12d564407d1ea4cf217f30ba9ea1591050fbeb9fc7fe46e7f270fc17601104cd9aaa14a69472393702ff1584c24d3ee68ff0b89604daa584884be5f377d1f7073682117af4059e683fe3f6299f1391d5ac0a25fad73fad97f0270940df26b247c4eb64752caa24ac756f92fdf21c5735277d0f3418d47c4bfc3a28653e2b059b46b63642097328eddb0312d76c2929bad70efa6ec29af4b6b68e995fc8d8e1725cd08090cb58bf2f63458910cf485a8ab786ed585feb849f3156cd502b09db743a9f3fc273d821d461542d4fa3ad654fb27a52f9e161a8d73c25e7e07bb4f820e0eecbafd765a61b5735076ef76b"}]}}}, {0x3c, 0x1, 0x0, 0x1, @exthdr={{0xb}, @val={0x2c, 0x2, 0x0, 0x1, [@NFTA_EXTHDR_FLAGS={0x8, 0x5, 0x1, 0x0, 0x1}, @NFTA_EXTHDR_OP={0x8, 0x6, 0x1, 0x0, 0x1}, @NFTA_EXTHDR_SREG={0x8}, @NFTA_EXTHDR_FLAGS={0x8}, @NFTA_EXTHDR_SREG={0x8, 0x7, 0x1, 0x0, 0x15}]}}}, {0xc, 0x1, 0x0, 0x1, @fwd={{0x8}, @void}}]}, @NFTA_SET_ELEM_FLAGS={0x8, 0x3, 0x1, 0x0, 0x2}, @NFTA_SET_ELEM_FLAGS={0x8, 0x3, 0x1, 0x0, 0x2}, @NFTA_SET_ELEM_DATA={0x140, 0x2, 0x0, 0x1, [@NFTA_DATA_VALUE={0x75, 0x1, "ba3c6c85c6dba4bb26542f6408651a2797b60f92e2987134614022d41c4f42edeea26fe0da9a469fad188f97abc340b33e8f0454b9bf4ecc9ae8da43016c8c584f5faa91e669ce10baf30df8bd3097f5161afcf351ed86c32ad6d6edb945ad675a62d154e09eee3645f31c8071686c8314"}, @NFTA_DATA_VALUE={0x88, 0x1, "cce82b0d395b28fe73902e588c3ff23d6f40b32e2eaf30502ea23a7d81c89d5106a5fd7e324227c0b8de043d7e6da80b6e794777827b1f4a82ae53134c19482831c412365411b4097f791a4cbca31ebdab2f709e03e7a950c3588d76d9e1853f00bcab8fba3aa872603ff550efd56e9214c350612cb0a13ab140a7fb1adbfddf5295905a"}, @NFTA_DATA_VERDICT={0x3c, 0x2, 0x0, 0x1, [@NFTA_VERDICT_CODE={0x8, 0x1, 0x0, 0x1, 0xfffffffffffffffb}, @NFTA_VERDICT_CODE={0x8, 0x1, 0x0, 0x1, 0xfffffffffffffffb}, @NFTA_VERDICT_CODE={0x8, 0x1, 0x0, 0x1, 0xfffffffffffffffe}, @NFTA_VERDICT_CODE={0x8, 0x1, 0x0, 0x1, 0xfffffffffffffffc}, @NFTA_VERDICT_CHAIN_ID={0x8, 0x3, 0x1, 0x0, 0x4}, @NFTA_VERDICT_CODE={0x8, 0x1, 0x0, 0x1, 0xfffffffffffffffc}, @NFTA_VERDICT_CHAIN_ID={0x8, 0x3, 0x1, 0x0, 0x4}]}]}, @NFTA_SET_ELEM_FLAGS={0x8, 0x3, 0x1, 0x0, 0x3}, @NFTA_SET_ELEM_OBJREF={0x9, 0x9, 'syz2\x00'}]}, {0x324, 0x0, 0x0, 0x1, [@NFTA_SET_ELEM_EXPRESSIONS={0xc8, 0xb, 0x0, 0x1, [{0x18, 0x1, 0x0, 0x1, @cmp={{0x8}, @val={0xc, 0x2, 0x0, 0x1, [@NFTA_CMP_OP={0x8, 0x2, 0x1, 0x0, 0x3}]}}}, {0x10, 0x1, 0x0, 0x1, @match={{0xa}, @void}}, {0x20, 0x1, 0x0, 0x1, @synproxy={{0xd}, @val={0xc, 0x2, 0x0, 0x1, [@NFTA_SYNPROXY_FLAGS={0x8, 0x3, 0x1, 0x0, 0x10}]}}}, {0x10, 0x1, 0x0, 0x1, @counter={{0xc}, @void}}, {0x10, 0x1, 0x0, 0x1, @notrack={{0xc}, @void}}, {0x5c, 0x1, 0x0, 0x1, @redir={{0xa}, @val={0x4c, 0x2, 0x0, 0x1, [@NFTA_REDIR_FLAGS={0x8, 0x3, 0x1, 0x0, 0x4e}, @NFTA_REDIR_REG_PROTO_MAX={0x8, 0x2, 0x1, 0x0, 0x4}, @NFTA_REDIR_REG_PROTO_MAX={0x8, 0x2, 0x1, 0x0, 0x14}, @NFTA_REDIR_REG_PROTO_MAX={0x8}, @NFTA_REDIR_REG_PROTO_MAX={0x8, 0x2, 0x1, 0x0, 0x1}, @NFTA_REDIR_REG_PROTO_MAX={0x8, 0x2, 0x1, 0x0, 0x8}, @NFTA_REDIR_FLAGS={0x8, 0x3, 0x1, 0x0, 0x20}, @NFTA_REDIR_FLAGS={0x8, 0x3, 0x1, 0x0, 0x52}, @NFTA_REDIR_REG_PROTO_MIN={0x8, 0x1, 0x1, 0x0, 0x1}]}}}]}, @NFTA_SET_ELEM_KEY_END={0x24c, 0xa, 0x0, 0x1, [@NFTA_DATA_VALUE={0xfa, 0x1, "5eeb1b0255c912f3156d9415fba271ae7339bbfb20b97d35aa7d7fc869cfebbff30c0c9f9bbc9f5f89731fe11a69ca5ec57e29e2cd45edb5f241b8ad910bbf08047f735f355b52e836fef4fd5a083aa373bc03285505a471719ceae5b380ab64e79efcc0c866a1e16530f77ca3221f57e9c52435e2d80c580325b1d126387f1c7b77b522e0e8fc8d92822d5a0ed5809042b961eadd26b394aa48436fe8d04ac9cc9d9a2bd07cf5e200b3528de6bc3a36d187b3b9f9e2e40dcfb401e1d6425c05564c6f8fae0f93b2bf3e8df302b52702861b75be40dcda18c7e70b1cc1b6b810fdd6446fc1baee1dc18687fe4c977ef893e45023f0b1"}, @NFTA_DATA_VALUE={0xb, 0x1, "b56becc41bad17"}, @NFTA_DATA_VALUE={0x93, 0x1, "d6b98928092e97794d4a60aae3fd1c8a625d49ed58cc2d6f460cb05a09b8e5206b51ea99bcdd9c5d7dc4e30611b8dab0beb90c7f3a37a6d7763fd153467b28d9fe1d3eb16a48b12602e6f8a5951779cbe4f07d7bd8f77e58b27abd0cc02c426a79c8bb1a261ce25d73a973cc05b30910128759cdf4e2389f9f90ce81a5357a9020494816dd46afa60a623d01c90144"}, @NFTA_DATA_VALUE={0xaa, 0x1, "95c8bba4908705272790012a7295fea7385dffe83b3dfe051cd87ffbf2e696ae19ef6cfee66b0bd7563df44fae48d6dda331b0f9e61373298e3cf6dba6aa7233eeddd99efbcdd9b450a9fcbc12ab9e5edd35a9c33726cf067e218a31901bea8bf242aa0d2c946a59e7ee38585f94c87dc24f8a293ed6e05a4d0dbb8d5ced2409690aa1aaae6c10427daf0066af636638a15f83eec79330e34fa4c1a2a23f099f015aee5fc987"}]}, @NFTA_SET_ELEM_OBJREF={0x9, 0x9, 'syz1\x00'}]}, {0xac, 0x0, 0x0, 0x1, [@NFTA_SET_ELEM_USERDATA={0x50, 0x6, 0x1, 0x0, "4a3021038c5d8861a69d41053cc2b7882ce65ff9ec1fed866ab714ae9a768af6d6bfea41328b05e50fef6912452f6b643c7c2ff4a2c29852a7b6c8815e136e5b27bb49ceda53d6e64a2f1a6a"}, @NFTA_SET_ELEM_EXPR={0x58, 0x7, 0x0, 0x1, @fib={{0x8}, @val={0x4c, 0x2, 0x0, 0x1, [@NFTA_FIB_FLAGS={0x8, 0x3, 0x1, 0x0, 0x29}, @NFTA_FIB_DREG={0x8, 0x1, 0x1, 0x0, 0x3}, @NFTA_FIB_DREG={0x8, 0x1, 0x1, 0x0, 0xe}, @NFTA_FIB_FLAGS={0x8, 0x3, 0x1, 0x0, 0x28}, @NFTA_FIB_RESULT={0x8, 0x2, 0x1, 0x0, 0x2}, @NFTA_FIB_DREG={0x8, 0x1, 0x1, 0x0, 0xb}, @NFTA_FIB_FLAGS={0x8, 0x3, 0x1, 0x0, 0x8}, @NFTA_FIB_DREG={0x8, 0x1, 0x1, 0x0, 0x10}, @NFTA_FIB_FLAGS={0x8, 0x3, 0x1, 0x0, 0x30}]}}}]}, {0x574, 0x0, 0x0, 0x1, [@NFTA_SET_ELEM_KEY={0x240, 0x1, 0x0, 0x1, [@NFTA_DATA_VALUE={0x2a, 0x1, "15a90b1ffcfba804a39fe6810976779509b50602b49133c943172f5963a620d58055f91ea965"}, @NFTA_DATA_VERDICT={0x44, 0x2, 0x0, 0x1, [@NFTA_VERDICT_CODE={0x8, 0x1, 0x0, 0x1, 0xfffffffffffffffe}, @NFTA_VERDICT_CHAIN={0x9, 0x2, 'syz2\x00'}, @NFTA_VERDICT_CHAIN={0x9, 0x2, 'syz2\x00'}, @NFTA_VERDICT_CHAIN={0x9, 0x2, 'syz1\x00'}, @NFTA_VERDICT_CHAIN_ID={0x8, 0x3, 0x1, 0x0, 0x1}, @NFTA_VERDICT_CHAIN={0x9, 0x2, 'syz0\x00'}]}, @NFTA_DATA_VALUE={0x29, 0x1, "774f66b7a2393936d62482189cf9b8ece6740c0d4b49815fa24c0bef251669ef48ea5a4497"}, @NFTA_DATA_VALUE={0x92, 0x1, "9e35c85d884d1e00112a48a0eed788e556730298943f3e83ba38f33648783c31012010d00643a9f59df4d5e24c20e9942b958c20dbf4e8a2af1fbff3138f43a80001ec1bf5b1c3c409bb7e01ee71b627e979f73df45e44e9c7a33c2399ebc4056f4ada6bce4de22ef38bf9a08cb801ff07000000000000fc1b55a3fba86f46009a7109648daa90487c78f2b916c8"}, @NFTA_DATA_VERDICT={0x38, 0x2, 0x0, 0x1, [@NFTA_VERDICT_CODE={0x8, 0x1, 0x0, 0x1, 0xffffffffffffffff}, @NFTA_VERDICT_CHAIN_ID={0x8, 0x3, 0x1, 0x0, 0x3}, @NFTA_VERDICT_CHAIN_ID={0x8, 0x3, 0x1, 0x0, 0x1}, @NFTA_VERDICT_CHAIN_ID={0x8, 0x3, 0x1, 0x0, 0x2}, @NFTA_VERDICT_CHAIN={0x9, 0x2, 'syz1\x00'}, @NFTA_VERDICT_CODE={0x8}]}, @NFTA_DATA_VALUE={0x35, 0x1, "8c6893a66f750956a8f79491d04489ebeda6a1455fb46e7891c07aacee36b2c604a0290ba31e91fdb49371ab3e765b16bb"}, @NFTA_DATA_VERDICT={0x60, 0x2, 0x0, 0x1, [@NFTA_VERDICT_CHAIN={0x9, 0x2, 'syz2\x00'}, @NFTA_VERDICT_CHAIN_ID={0x8, 0x3, 0x1, 0x0, 0x3}, @NFTA_VERDICT_CHAIN={0x9, 0x2, 'syz2\x00'}, @NFTA_VERDICT_CHAIN={0x9, 0x2, 'syz1\x00'}, @NFTA_VERDICT_CHAIN={0x9, 0x2, 'syz1\x00'}, @NFTA_VERDICT_CHAIN_ID={0x8, 0x3, 0x1, 0x0, 0x2}, @NFTA_VERDICT_CHAIN={0x9, 0x2, 'syz1\x00'}, @NFTA_VERDICT_CODE={0x8, 0x1, 0x0, 0x1, 0xfffffffffffffffb}, @NFTA_VERDICT_CHAIN_ID={0x8, 0x3, 0x1, 0x0, 0x4}]}, @NFTA_DATA_VERDICT={0x1c, 0x2, 0x0, 0x1, [@NFTA_VERDICT_CODE={0x8, 0x1, 0x0, 0x1, 0xfffffffffffffffc}, @NFTA_VERDICT_CODE={0x8, 0x1, 0x0, 0x1, 0xfffffffffffffffc}, @NFTA_VERDICT_CODE={0x8, 0x1, 0x0, 0x1, 0xfffffffffffffffc}]}, @NFTA_DATA_VERDICT={0x20, 0x2, 0x0, 0x1, [@NFTA_VERDICT_CHAIN={0x9, 0x2, 'syz0\x00'}, @NFTA_VERDICT_CODE={0x8, 0x1, 0x0, 0x1, 0xfffffffffffffffb}, @NFTA_VERDICT_CHAIN_ID={0x8, 0x3, 0x1, 0x0, 0x4}]}]}, @NFTA_SET_ELEM_TIMEOUT={0xc, 0x4, 0x1, 0x0, 0x2}, @NFTA_SET_ELEM_USERDATA={0x9b, 0x6, 0x1, 0x0, "7857f4ecf3d330b9e450df7bf0c390a2563be2bde7c776c046ea5f7fc790d0c88567230f61d9c7562965e508a642254e5252d4c7b6ddb3dd14206eb7a585b1b66a9af3639d8faced5328333032417cd2a5eb9fe06e932426893392dddc93a46f22a37323caa04d094887410d981133ba93a33c724335f864c0f161f1a51f413fa10e4e3898b34b36348bebd3add443233b12248cf441a6"}, @NFTA_SET_ELEM_TIMEOUT={0xc, 0x4, 0x1, 0x0, 0x1}, @NFTA_SET_ELEM_DATA={0x1e8, 0x2, 0x0, 0x1, [@NFTA_DATA_VALUE={0xf4, 0x1, "01272602640d98ff982e49099ccd9470261ea774e757c1c11f17f9d8cfed9386972da4330af7a22736507491f1784b146801323bb03b8e93a069914a3d7ad784a8da0ea89f01fafb55e86e664a044f2de65bdc791b40eebcd8ef929d9d4ce206e0fcafc12f698480664101a413ed04fe795ad22767138502ce261174d5f4303fb272470b6f50ced37abe235cf7f1adf9b10155fb712882360df00271949bca6cf786fb655ad29b36757b743e22d3b5d2bdc22f179bd276ce3020bf428825838f5a63fd108c1b05b29a0af74802baffc62691c8cddd95a55f49cda3d1ec3fc1512db38b107beb48dc40bb7bb507259bc5"}, @NFTA_DATA_VALUE={0x64, 0x1, "1667e992b01c7b35ebd638af37e6b9f9d2950d20aae7867ceca29def5dd9c969adc20a3b4cda075161061b6495028ba2d796eae1a5f8f3ed37b8eb6c5747e7511f3536b73e81518fe1c6dc2d57582dc46a50436a3c8e18cad5ded629e92122f5"}, @NFTA_DATA_VALUE={0x89, 0x1, "dbfb063720da4f700a46257dddbd32373632a4e3b0971e7eb9835ce5ed556e9170537847badde54cf13256286ea1142494b763d01784ecc6edcfabfe55fa941a9ed98f877687d08afa07ea08d962a3f40f036f44ab9f961b4ba6717faecc6f6032f6046eb60da1ab085e6219246c027c2a4f9b43d545c27dd81decce37012d07a9db8256ef"}]}, @NFTA_SET_ELEM_OBJREF={0x9, 0x9, 'syz2\x00'}, @NFTA_SET_ELEM_EXPR={0x10, 0x7, 0x0, 0x1, @hash={{0x9}, @void}}, @NFTA_SET_ELEM_USERDATA={0x75, 0x6, 0x1, 0x0, "6a128f0b5edce90cd432918a0f5a125f6b4114c24d9d41b8b194ceb226c9f6eb25316b72db9c6855ae78bf1e3d49c6c70cc687a8aae31638f82fde91a7386eec76572af4bb94427149dccb759235c0b838fa6284208c2a46bc7726bb3fbad705fc2c4e2ebaf4cc3cc86cb252706b2d56c7"}]}, {0x40, 0x0, 0x0, 0x1, [@NFTA_SET_ELEM_FLAGS={0x8, 0x3, 0x1, 0x0, 0x1}, @NFTA_SET_ELEM_EXPIRATION={0xc, 0x5, 0x1, 0x0, 0x3ff}, @NFTA_SET_ELEM_TIMEOUT={0xc, 0x4, 0x1, 0x0, 0x7}, @NFTA_SET_ELEM_USERDATA={0xf, 0x6, 0x1, 0x0, "3c0bab262c8bc7e8ca00e7"}, @NFTA_SET_ELEM_OBJREF={0x9, 0x9, 'syz1\x00'}]}]}, @NFTA_SET_ELEM_LIST_SET_ID={0x8}]}, @NFT_MSG_NEWRULE={0x2a4, 0x6, 0xa, 0x301, 0x0, 0x0, {0x1, 0x0, 0x1}, [@NFTA_RULE_HANDLE={0xc, 0x3, 0x1, 0x0, 0x4}, @NFTA_RULE_USERDATA={0xe4, 0x7, 0x1, 0x0, "5a5d24f857d533574587e8f9f655c8e4b50d36055136ea2662b37c165137127aba1ad2b208698e4b4882ad62812c0c0acc17bab60e9eb5755c7cce30c8ff384baff99689b1ecef87b4f20e00173ae635f97f65fee08e7779521d4272f08624d2b3ae36032c6d794d4c4e748b0b237ed52265570061686e6ff01eb45b56b59a4af1a4fda2a7e257c763d6f5b7dc7dff0889a37403b4768692ebcad9d99f62f2263acf88ef5b82a4a7689cb27a9591e14a75e438eeeb81440ea044465af1d00961ce8f041b754a123594474e80fbf54963fd483cd92525275032c40b32f067a180"}, @NFTA_RULE_POSITION={0xc, 0x6, 0x1, 0x0, 0x5}, @NFTA_RULE_EXPRESSIONS={0xc0, 0x4, 0x0, 0x1, [{0xc, 0x1, 0x0, 0x1, @dup_ipv4={{0x8}, @void}}, {0x14, 0x1, 0x0, 0x1, @limit={{0xa}, @val={0x4}}}, {0x38, 0x1, 0x0, 0x1, @last={{0x9}, @val={0x28, 0x2, 0x0, 0x1, [@NFTA_LAST_MSECS={0xc, 0x2, 0x1, 0x0, 0x8}, @NFTA_LAST_MSECS={0xc, 0x2, 0x1, 0x0, 0xf}, @NFTA_LAST_MSECS={0xc, 0x2, 0x1, 0x0, 0x6}]}}}, {0x34, 0x1, 0x0, 0x1, @flow_offload={{0x11}, @val={0x1c, 0x2, 0x0, 0x1, [@NFTA_FLOW_TABLE_NAME={0x9, 0x1, 'syz1\x00'}, @NFTA_FLOW_TABLE_NAME={0x9, 0x1, 'syz2\x00'}]}}}, {0x30, 0x1, 0x0, 0x1, @byteorder={{0xe}, @val={0x1c, 0x2, 0x0, 0x1, [@NFTA_BYTEORDER_SIZE={0x8, 0x5, 0x1, 0x0, 0x83}, @NFTA_BYTEORDER_LEN={0x8, 0x4, 0x1, 0x0, 0x41}, @NFTA_BYTEORDER_LEN={0x8, 0x4, 0x1, 0x0, 0x8c}]}}}]}, @NFTA_RULE_CHAIN={0x9, 0x2, 'syz1\x00'}, @NFTA_RULE_EXPRESSIONS={0x30, 0x4, 0x0, 0x1, [{0x10, 0x1, 0x0, 0x1, @xfrm={{0x9}, @void}}, {0x10, 0x1, 0x0, 0x1, @tproxy={{0xb}, @void}}, {0xc, 0x1, 0x0, 0x1, @nat={{0x8}, @void}}]}, @NFTA_RULE_EXPRESSIONS={0x98, 0x4, 0x0, 0x1, [{0x10, 0x1, 0x0, 0x1, @hash={{0x9}, @void}}, {0x30, 0x1, 0x0, 0x1, @osf={{0x8}, @val={0x24, 0x2, 0x0, 0x1, [@NFTA_OSF_FLAGS={0x8}, @NFTA_OSF_TTL={0x5, 0x2, 0x6}, @NFTA_OSF_DREG={0x8, 0x1, 0x1, 0x0, 0xb}, @NFTA_OSF_FLAGS={0x8}]}}}, {0x1c, 0x1, 0x0, 0x1, @tproxy={{0xb}, @val={0xc, 0x2, 0x0, 0x1, [@NFTA_TPROXY_REG_PORT={0x8, 0x3, 0x1, 0x0, 0x11}]}}}, {0x10, 0x1, 0x0, 0x1, @payload={{0xc}, @void}}, {0x18, 0x1, 0x0, 0x1, @dup={{0x8}, @val={0xc, 0x2, 0x0, 0x1, [@NFTA_DUP_SREG_DEV={0x8, 0x2, 0x1, 0x0, 0x10}]}}}, {0x10, 0x1, 0x0, 0x1, @inner={{0xa}, @void}}]}]}], {0x14}}, 0x4258}, 0x1, 0x0, 0x0, 0x1}, 0x24040884)
r6 = socket$nl_netfilter(0x10, 0x3, 0xc)
sendmsg$NFT_BATCH(r6, &(0x7f0000000200)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000940)=ANY=[@ANYBLOB="140000001000010000000000000000000000000a20000000000a01020000000000000000010000000900010073797a30000000006c000000160a01000000000000000100010000000900010073797a30000000000900020073797a3000000001400003800800014000000000080002400000fbff2b0003801400010067656e65766530"], 0x110}, 0x1, 0x0, 0x0, 0x4084}, 0x8000)
ioctl$sock_SIOCSIFVLAN_SET_VLAN_EGRESS_PRIORITY_CMD(0xffffffffffffffff, 0x8983, &(0x7f0000000040)={0x3, 'vlan0\x00', {0x4}, 0x5})
r7 = socket(0x10, 0x3, 0x0)
mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./dev\x00', 0x17a)
mount(0x0, &(0x7f0000000040)='./dev\x00', &(0x7f0000000100)='devtmpfs\x00', 0x0, 0x0)
r8 = openat(0xffffffffffffff9c, &(0x7f00000004c0)='./dev/kmsg\x00', 0x0, 0x24)
lseek(r8, 0x0, 0x2)
ioctl$sock_SIOCSIFVLAN_GET_VLAN_INGRESS_PRIORITY_CMD(r7, 0x8983, &(0x7f0000000040))
syz_emit_ethernet(0x7e, &(0x7f0000000280)={@local, @local, @void, {@ipv6={0x86dd, @icmpv6={0x0, 0x6, "f81fcb", 0x48, 0x3a, 0x0, @private0, @mcast2, {[], @param_prob={0x4, 0x0, 0x0, 0x0, {0x0, 0x6, "4aa1d3", 0x0, 0x0, 0x0, @private1, @ipv4={'\x00', '\xff\xff', @loopback}, [@routing={0x3c}, @srh={0x2f}, @dstopts]}}}}}}}, 0x0)
socket(0x10, 0x6, 0x0)
lseek(r6, 0x9, 0x0)
memfd_secret(0x80000)
executing program 4:
fsopen(&(0x7f0000000040)='msdos\x00', 0x1)
bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f00000001c0)={0x3, 0x6, &(0x7f0000000140)=@framed={{0x18, 0x6}, [@func={0x85, 0x0, 0x1, 0x0, 0x2}, @alu={0x0, 0x0, 0x4}, @exit={0x95, 0x0, 0x7b00}]}, &(0x7f00000000c0)='GPL\x00', 0x6}, 0x80)
r0 = openat$vhost_vsock(0xffffffffffffff9c, &(0x7f0000000000), 0x2, 0x0)
ioctl$VHOST_VDPA_GET_VRING_GROUP(r0, 0xc008af7b, &(0x7f0000000080)={0x2, 0xfffffff0})
fsopen(&(0x7f0000000040)='msdos\x00', 0x1) (async)
bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f00000001c0)={0x3, 0x6, &(0x7f0000000140)=@framed={{0x18, 0x6}, [@func={0x85, 0x0, 0x1, 0x0, 0x2}, @alu={0x0, 0x0, 0x4}, @exit={0x95, 0x0, 0x7b00}]}, &(0x7f00000000c0)='GPL\x00', 0x6}, 0x80) (async)
openat$vhost_vsock(0xffffffffffffff9c, &(0x7f0000000000), 0x2, 0x0) (async)
ioctl$VHOST_VDPA_GET_VRING_GROUP(r0, 0xc008af7b, &(0x7f0000000080)={0x2, 0xfffffff0}) (async)
executing program 4:
r0 = openat$procfs(0xffffffffffffff9c, &(0x7f0000001140)='/proc/tty/ldiscs\x00', 0x0, 0x0) (async)
r1 = bpf$PROG_LOAD(0x5, &(0x7f0000003000)={0x6, 0x18, &(0x7f0000000a40)=ANY=[@ANYBLOB="bf16000000000000b7000000000000007b0af8ff000000007b0af0ff000000007b0ae8ff000000007b0ae0ff000000007b0ad8ff000000007b0ad0ff000000007b0ac8ff000000007b0ac0ff00000000b702000002000000732ac0ff00000000b702000001000000632ac8ff00000000b7020000ac1414bb632ae0ff00000000bf61000000000000bfa200000000000007020000c0ffffffb703000040000000b7040000000000008500000045000000b70000000000000095"], &(0x7f0000004000)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @xdp, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94)
bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f0000002000)={r1, 0x0, 0xe, 0x0, &(0x7f00000003c0)="e02742e86c0d85ff9782764532db", 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x50) (async)
read$watch_queue(r0, &(0x7f0000000140)=""/4096, 0x1000)
executing program 4:
r0 = syz_open_dev$dvb_frontend(&(0x7f0000000080), 0x0, 0x402)
r1 = socket$inet_mptcp(0x2, 0x1, 0x106)
r2 = socket(0x10, 0x803, 0x0)
syz_genetlink_get_family_id$tipc(&(0x7f0000000000), r2)
getsockname$packet(r2, &(0x7f0000000280)={0x11, 0x0, <r3=>0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14)
sendmsg$nl_route(r2, &(0x7f0000000180)={&(0x7f0000000040)={0x10, 0x0, 0x0, 0x400000}, 0xc, &(0x7f0000000140)={&(0x7f0000000100)=@RTM_GETMDB={0x18, 0x56, 0x2, 0x70bd25, 0x25dfdbfe, {0x7, r3}, [""]}, 0x18}}, 0x20000000)
sendmsg$nl_route(r2, &(0x7f0000000240)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000580)=ANY=[@ANYBLOB="4800000010000305ff810000fddbdf2500000000", @ANYRES32=r3, @ANYBLOB="1748000040000200280012800a000100767863616e0000001800028014000100000000", @ANYRES32=r3], 0x48}, 0x1, 0x0, 0x0, 0x40}, 0x0)
connect$inet(r1, &(0x7f0000000000)={0x2, 0x4e22, @empty}, 0x10)
setsockopt$sock_int(r1, 0x1, 0x9, &(0x7f00000003c0)=0x246, 0x4)
ioctl$FE_SET_PROPERTY(r0, 0x40106f52, &(0x7f00000000c0)={0x29, &(0x7f0000000200)=[{0x34, '\x00', @data=0x4}]})
syz_open_dev$dvb_frontend(&(0x7f0000000080), 0x0, 0x402) (async)
socket$inet_mptcp(0x2, 0x1, 0x106) (async)
socket(0x10, 0x803, 0x0) (async)
syz_genetlink_get_family_id$tipc(&(0x7f0000000000), r2) (async)
getsockname$packet(r2, &(0x7f0000000280)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) (async)
sendmsg$nl_route(r2, &(0x7f0000000180)={&(0x7f0000000040)={0x10, 0x0, 0x0, 0x400000}, 0xc, &(0x7f0000000140)={&(0x7f0000000100)=@RTM_GETMDB={0x18, 0x56, 0x2, 0x70bd25, 0x25dfdbfe, {0x7, r3}, [""]}, 0x18}}, 0x20000000) (async)
sendmsg$nl_route(r2, &(0x7f0000000240)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000580)=ANY=[@ANYBLOB="4800000010000305ff810000fddbdf2500000000", @ANYRES32=r3, @ANYBLOB="1748000040000200280012800a000100767863616e0000001800028014000100000000", @ANYRES32=r3], 0x48}, 0x1, 0x0, 0x0, 0x40}, 0x0) (async)
connect$inet(r1, &(0x7f0000000000)={0x2, 0x4e22, @empty}, 0x10) (async)
setsockopt$sock_int(r1, 0x1, 0x9, &(0x7f00000003c0)=0x246, 0x4) (async)
ioctl$FE_SET_PROPERTY(r0, 0x40106f52, &(0x7f00000000c0)={0x29, &(0x7f0000000200)=[{0x34, '\x00', @data=0x4}]}) (async)
executing program 1:
r0 = socket$packet(0x11, 0x2, 0x300)
setsockopt$packet_tx_ring(r0, 0x107, 0x5, &(0x7f00000000c0)=@req3={0x8000, 0x6, 0x8000, 0x6}, 0x1c)
connect$bt_sco(0xffffffffffffffff, 0x0, 0x0)
bpf$BPF_BTF_LOAD(0x12, &(0x7f0000000200)={&(0x7f0000000300)={{0xeb9f, 0x1, 0x0, 0x18, 0x0, 0xc, 0xc, 0x5, [@struct={0x2, 0x0, 0x0, 0x4, 0x0, 0xff}]}, {0x0, [0x30, 0x5f, 0x2e]}}, 0x0, 0x29}, 0x28)
r1 = openat$nvme_fabrics(0xffffffffffffff9c, &(0x7f0000000400), 0x2, 0x0)
write(r1, &(0x7f0000000500)="7472616e73706f72743d72646d612c6e716e3d6e716e2e323031342d30382e6f72672e6e766d657870726573733a4e564d663a757569643a31323334353637382d313233342d313233342d313233342d3132333435363938396162632c686f73745f7472616464723d3132370f302e302e312c7472616464723d3132372e302e302e312c747273766369643d34", 0x8d)
getsockopt$inet_sctp6_SCTP_GET_ASSOC_ID_LIST(r1, 0x84, 0x1d, &(0x7f0000000000)={0x2, [0x0, 0x0]}, &(0x7f0000000040)=0x20)
mmap(&(0x7f0000001000/0x3000)=nil, 0x30000, 0x0, 0x11, r0, 0x0)
r2 = socket$inet6_tcp(0xa, 0x1, 0x0)
setsockopt$SO_BINDTODEVICE(r2, 0x1, 0x19, &(0x7f0000000000)='syz_tun\x00', 0x8)
connect$inet6(r2, &(0x7f0000000100)={0xa, 0x4e20, 0xfffffffe, @initdev={0xfe, 0x88, '\x00', 0x0, 0x0}, 0x3}, 0x1c)
mprotect(&(0x7f0000000000/0xf000)=nil, 0xf000, 0x1)
executing program 1:
r0 = socket$nl_netfilter(0x10, 0x3, 0xc)
sendmsg$NFT_BATCH(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000200)={&(0x7f00000003c0)=ANY=[@ANYBLOB="140000001000010000000000000000000000000a28000000000a0101000000005e1affd5020000000900010073797a300000000008000240000000032c000000030a01030000e6ff00000000020000000900010073797a30000000000900030073797a320000000014000000110001"], 0x7c}}, 0x0)
sendmsg$NFT_BATCH(r0, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000640)=ANY=[@ANYBLOB="14000000100001000000000000b890c1a000000a80000000160a01030000000000000000020000000900020073797a30000000000900010073797a30000000005400038008000240000000000800014000000000400003801400010076657468315f746f5f6272696467650014000100776732000000000000000000000000001400010076657468305f746f5f7465616d00000014000000110001"], 0xa8}, 0x1, 0x0, 0x0, 0x10}, 0x0)
r1 = socket$nl_generic(0x10, 0x3, 0x10)
r2 = socket$nl_generic(0x10, 0x3, 0x10)
r3 = syz_genetlink_get_family_id$tipc(&(0x7f0000000500), r2)
sendmsg$TIPC_CMD_SET_LINK_WINDOW(r2, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000540)={0x30, r3, 0x1, 0x70bd2c, 0x25dfdbff, {{}, {0x0, 0x4107}, {0x14, 0x18, {0x3, @bearer=@udp='udp:syz2\x00'}}}}, 0x30}, 0x1, 0x0, 0x0, 0x40}, 0x8000)
sendmsg$TIPC_CMD_GET_BEARER_NAMES(r1, &(0x7f0000000180)={&(0x7f0000000040)={0x10, 0x0, 0x0, 0x40}, 0xc, &(0x7f0000000140)={&(0x7f0000000100)={0x1c, r3, 0x10, 0x70bd25, 0x25dfdbfe, {}, ["", "", "", "", "", "", "", "", ""]}, 0x1c}}, 0x4000000)
sendmsg$NFT_BATCH(r0, &(0x7f0000000500)={0x0, 0x0, &(0x7f00000004c0)={&(0x7f0000000280)={{0x14, 0x10, 0x1, 0x0, 0x0, {0x5}}, [@NFT_MSG_DELFLOWTABLE={0x14, 0x18, 0xa, 0x5, 0x0, 0x0, {0x2}}], {0x14, 0x11, 0x1, 0x0, 0x0, {0x3}}}, 0x3c}, 0x1, 0x0, 0x0, 0x40000}, 0x20008000)
executing program 1:
r0 = ioctl$KVM_CREATE_VM(0xffffffffffffffff, 0xae01, 0x3b)
r1 = socket$inet_mptcp(0x2, 0x1, 0x106)
setsockopt$inet_tcp_int(r1, 0x6, 0x5, &(0x7f0000001240)=0x7, 0x4)
ioctl$KVM_SET_USER_MEMORY_REGION(r0, 0x4020ae46, &(0x7f0000000000)={0x10002, 0x0, 0xe000, 0x2000, &(0x7f0000246000/0x2000)=nil})
r2 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000840)='memory.events.local\x00', 0x275a, 0x0)
ioctl$XFS_IOC_READLINK_BY_HANDLE(r1, 0xc038586c, &(0x7f0000000180)={r1, &(0x7f0000000080)='&\x00', 0x80400, &(0x7f00000000c0)={@align=0xfffffffffffffffc, {0x8, 0xd7, 0x0, 0x81}}, 0x9, &(0x7f0000000100), &(0x7f0000000140)=0x7b15})
write$binfmt_script(r2, &(0x7f0000000040), 0x208e24b)
mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x2, 0x28011, r2, 0x0)
madvise(&(0x7f0000000000/0x600000)=nil, 0x600003, 0x15)
ftruncate(r2, 0x5)
executing program 1:
prctl$PR_SET_IO_FLUSHER(0x43, 0x1) (async, rerun: 64)
r0 = creat(&(0x7f0000000280)='./file0\x00', 0xecf86c37d53049cc) (rerun: 64)
close(r0) (async)
r1 = socket$inet6(0xa, 0x2, 0x0)
setsockopt$inet6_int(r1, 0x29, 0x12, &(0x7f0000000040), 0x4) (async)
sendto$inet6(r0, 0x0, 0xfffffe28, 0x0, &(0x7f0000000200)={0xa, 0x4e20, 0x0, @mcast1}, 0xfffffffffffffeaf) (async)
execve(&(0x7f0000000000)='./file0\x00', 0x0, 0x0) (async)
ioctl$AUTOFS_DEV_IOCTL_ASKUMOUNT(r0, 0xc018937d, &(0x7f00000000c0)={{0x1, 0x1, 0x18, r1, {0x8}}, './file0\x00'}) (async, rerun: 32)
write$FUSE_NOTIFY_RETRIEVE(r0, &(0x7f0000000080)={0x30, 0x5, 0x0, {0x0, 0x4, 0x8}}, 0x30) (async, rerun: 32)
bind$x25(r0, &(0x7f0000000040), 0x12) (async)
fchdir(r0)
executing program 1:
mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeeb, 0x8031, 0xffffffffffffffff, 0xdabc3000)
r0 = socket$netlink(0x10, 0x3, 0x0)
r1 = socket(0x10, 0x803, 0x0)
sendmsg$IPVS_CMD_SET_INFO(r1, &(0x7f0000000b00)={0x0, 0x0, &(0x7f0000000ac0)={0x0, 0x14}}, 0x0)
getsockname$packet(r1, &(0x7f0000000100)={0x11, 0x0, <r2=>0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14)
sendmsg$nl_route(r0, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000380)=ANY=[@ANYBLOB="3c0000001000850600"/20, @ANYRES32=r2, @ANYBLOB="01000000000000001c0012000c000100626f6e64000000000c0002000800010006"], 0x3c}}, 0x14)
r3 = socket$nl_route(0x10, 0x3, 0x0)
getsockname$packet(r1, &(0x7f0000000100)={0x11, 0x0, <r4=>0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000180)=0x14)
sendmsg$nl_route(r3, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000300)={&(0x7f0000000440)=@newlink={0x4c, 0x10, 0x403, 0x70bd27, 0x0, {0x0, 0x0, 0x0, 0x0, 0x91446}, [@IFLA_LINKINFO={0x24, 0x12, 0x0, 0x1, @vlan={{0x9}, {0x14, 0x2, 0x0, 0x1, [@IFLA_VLAN_ID={0x6, 0x1, 0x1}, @IFLA_VLAN_PROTOCOL={0x6, 0x5, 0x8100}]}}}, @IFLA_LINK={0x8, 0x5, r4}]}, 0x4c}, 0x1, 0x0, 0x0, 0x20000600}, 0x0)
sendmsg$nl_route(r3, &(0x7f0000000240)={0x0, 0x0, &(0x7f00000001c0)={&(0x7f0000000280)=@newlink={0x44, 0x10, 0xffffff1f, 0x70bd26, 0x1, {0x0, 0x0, 0x0, 0x0, 0x8008, 0x4408}, [@IFLA_LINKINFO={0x1c, 0x12, 0x0, 0x1, @geneve={{0xb}, {0xc, 0x2, 0x0, 0x1, [@IFLA_GENEVE_TTL_INHERIT={0x5, 0xc, 0x1}]}}}, @IFLA_MASTER={0x8, 0xa, r2}]}, 0x44}, 0x1, 0x0, 0x0, 0x40000}, 0x84)
r5 = fanotify_init(0x0, 0x800)
r6 = openat$selinux_commit_pending_bools(0xffffffffffffff9c, &(0x7f0000000000), 0x1, 0x0)
fanotify_mark(r5, 0x8, 0x40001001, r6, &(0x7f00000000c0)='./file0\x00')
madvise(&(0x7f00000ec000/0x800000)=nil, 0x800000, 0x19)
executing program 1:
socket$packet(0x11, 0x3, 0x300) (async)
lseek(0xffffffffffffffff, 0x7, 0x3)
r0 = socket$rds(0x15, 0x5, 0x0)
ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000080)={'xfrm0\x00'})
r1 = syz_open_dev$sndctrl(&(0x7f0000000000), 0x0, 0x101700)
r2 = socket$nl_generic(0x10, 0x3, 0x10) (async)
r3 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000180), 0xffffffffffffffff)
sendmsg$NL80211_CMD_SET_QOS_MAP(r2, &(0x7f0000000480)={&(0x7f0000000140)={0x10, 0x0, 0x0, 0x4000}, 0xc, &(0x7f0000000440)={&(0x7f0000000340)=ANY=[@ANYBLOB, @ANYRES16=r3, @ANYBLOB="00022abd7000fbdbdf25680000000c009900050000001f0000001400c7000701320107030604cb7076c73152e2fb1e00c700f302010210030405f2000006010201043501ffffffffffffffaf00002c00c70002060202020009040e04f80301070d060e0204000203040403050200070201079f743c7d0d3b23021200c7000201710106077abc8b1f5529e04f00002800c700070511020c050206b8020703e20506000303030630056504050307034cee9248fc7f461c1e00c700000001029701040139010700030504036603a8b439d47ca78e320000"], 0xdc}}, 0x40000) (async)
ioctl$SNDRV_CTL_IOCTL_PCM_PREFER_SUBDEVICE(r1, 0x40045532, &(0x7f0000000080)) (async)
socket$nl_netfilter(0x10, 0x3, 0xc)
r4 = openat$audio(0xffffffffffffff9c, &(0x7f0000000240), 0x400000000a0a01, 0x0) (async)
r5 = syz_open_dev$sndpcmp(&(0x7f0000000200), 0x0, 0xa2c65)
r6 = socket$inet6_sctp(0xa, 0x5, 0x84) (async)
r7 = syz_open_dev$dvb_demux(&(0x7f0000001e00), 0x0, 0x2000)
ioctl$DVB_DEMUX_DMX_SET_PES_FILTER(r7, 0x40146f2c, &(0x7f00000001c0)={0x2, 0x1, 0x1, 0xe, 0x4}) (async)
ioctl$sock_SIOCGIFINDEX_80211(r0, 0x8933, &(0x7f0000000500)={'wlan1\x00', <r8=>0x0})
sendmsg$NL80211_CMD_CRIT_PROTOCOL_START(r2, &(0x7f0000000640)={&(0x7f00000004c0)={0x10, 0x0, 0x0, 0x10000}, 0xc, &(0x7f0000000600)={&(0x7f0000000700)=ANY=[@ANYBLOB="50000000cce8426b4b79b93f60e86b922a3db8a5ce1c357ca8e45b1d447c41bc1e0d390f8282be5145978050d39d4fc08884cb07f29351dcf9459afd3f22f1b7b0ab0cc8aca1a85bbef06cc464a9eef6d87c4e0879158feb6387ded6446e10eb757d2f68ed014844168202c6f40a155aca1d6f3e69683dd8a4beffffcf49ce130c097e1a36b6842c4871b121485d49c74313ede6b74c5b384256086a4be81061c829e65539194a5b03211a47b48b9ae85b356c2c6d5f52777968a4b445a86cae39a442dc55200393226f8e5a74189378b88fe9fffe1bc54b1aa5f679c8fddc5d33d3d2c2a6af69121e65de830e4a539dcba90c3808ab61e8e7ad0532eb9e26944b0f37ee4cd3ae377423b5402a5ee1c71b5b8b1e723d782074180eaa4472fcb7398f5331cf15", @ANYRES16=r3, @ANYBLOB="000128bd7000fcdbdf256200000008000300", @ANYRES32=r8, @ANYBLOB="0c009900954700006c0000000600b400f31100000600b400b60a00000600b400360000000600b300000000000600b400c3110000"], 0x50}, 0x1, 0x0, 0x0, 0x44001}, 0x140) (async)
close_range(r7, 0xffffffffffffffff, 0x0)
getsockopt$inet_sctp6_SCTP_PEER_ADDR_PARAMS(r6, 0x84, 0x9, &(0x7f0000000240)={0x0, @in={{0x2, 0x4e22, @multicast2}}, 0x0, 0x5, 0x80000000, 0x7, 0x20, 0x7, 0x8}, &(0x7f0000000300)=0x9c)
write$RDMA_USER_CM_CMD_CREATE_ID(r4, &(0x7f0000000040)={0x0, 0x18, 0xfa00, {0x3, 0x0, 0x39, 0x9}}, 0x20)
ioctl$SNDRV_PCM_IOCTL_HW_FREE(r5, 0x4112, 0x0) (async)
ioctl$SNDCTL_DSP_GETOSPACE(r4, 0x8010500c, &(0x7f0000000300))
r9 = socket$nl_generic(0x10, 0x3, 0x10)
sendmsg$nl_generic(r9, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000140)={&(0x7f00000004c0)=ANY=[@ANYBLOB="18000000260001031dbd7002fadbdf25010000000400ae"], 0x18}}, 0x0) (async)
recvmmsg(r9, &(0x7f00000006c0)=[{{0x0, 0x0, &(0x7f0000000640)=[{&(0x7f0000000180)=""/144, 0x90}, {&(0x7f0000000040)=""/218, 0xda}], 0x2}, 0x2}], 0x1, 0x0, 0x0) (async)
sendmsg$inet(0xffffffffffffffff, &(0x7f0000000000)={0x0, 0x0, 0x0, 0x0, &(0x7f0000000100)=ANY=[@ANYBLOB="1c000000000000000000000007000000890b040a0101"], 0x40}, 0xfffe) (async)
r10 = openat$tun(0xffffffffffffff9c, &(0x7f0000000000), 0x48241, 0x0)
ioctl$TUNSETIFF(r10, 0x400454ca, &(0x7f00000000c0)={'syzkaller1\x00', 0x6bf1c2d5adba8c32}) (async)
sendmsg$nl_route(0xffffffffffffffff, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000001140)={&(0x7f0000000100)=ANY=[@ANYRES8, @ANYRES32, @ANYBLOB="0000000000000000400012800c0001"], 0x68}}, 0x0)
socket$igmp6(0xa, 0x3, 0x2)

program crashed: KASAN: slab-use-after-free Read in dvb_device_open
bisect: bisecting 31 programs
bisect: split chunks (needed=false): <30>
bisect: split chunk #0 of len 30 into 3 parts
bisect: testing without sub-chunk 1/3
testing program (duration=35s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): [40, 30, 36, 19, 21, 3, 12, 8, 30, 17, 30, 25, 8, 4, 20, 12, 9, 10, 11, 14, 30]
detailed listing:
executing program 3:
seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0x0, &(0x7f00000000c0)={0x1, &(0x7f0000000040)=[{0x6, 0x0, 0x0, 0x7fffffff}]}) (async)
r0 = seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0x0, &(0x7f00000000c0)={0x1, &(0x7f0000000040)=[{0x6, 0x0, 0x0, 0x7fffffff}]})
r1 = socket$nl_route(0x10, 0x3, 0x0)
ioctl$sock_SIOCGIFINDEX(r1, 0x8933, &(0x7f0000000340)={'virt_wifi0\x00', <r2=>0x0})
sendmsg$nl_route_sched(r1, &(0x7f0000000b00)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000640)=@delqdisc={0x2dc, 0x26, 0x1, 0x70ad2b, 0x25dfdbfc, {0x0, 0x0, 0x0, r2, {}, {0xffff, 0xffff}, {0xf, 0x3}}, [@qdisc_kind_options=@q_taprio={{0xb}, {0x2c, 0x2, [@TCA_TAPRIO_ATTR_SCHED_CLOCKID={0x8, 0x5, 0x7f}, @TCA_TAPRIO_ATTR_SCHED_BASE_TIME={0xc, 0x3, 0xffff}, @TCA_TAPRIO_ATTR_SCHED_CLOCKID={0x8}, @TCA_TAPRIO_ATTR_SCHED_BASE_TIME={0xc, 0x3, 0x5}]}}, @TCA_STAB={0xa0, 0x8, 0x0, 0x1, [{{0x1c, 0x1, {0x60, 0x7, 0x9, 0x0, 0x0, 0xd, 0xc2, 0x1}}, {0x6, 0x2, [0x3]}}, {{0x1c, 0x1, {0x9, 0x7, 0x1, 0x4, 0x0, 0x7, 0x2, 0x9}}, {0x16, 0x2, [0x0, 0x0, 0xffff, 0xbacf, 0xa, 0x6, 0x8, 0x3ff, 0x7]}}, {{0x1c, 0x1, {0x7f, 0x0, 0xd995, 0x3ff, 0x0, 0x3, 0x3, 0x1}}, {0x6, 0x2, [0x7f]}}, {{0x1c, 0x1, {0x1, 0x10, 0x1, 0x0, 0x0, 0x7}}, {0x4}}]}, @qdisc_kind_options=@q_cake={{0x9}, {0x2c, 0x2, [@TCA_CAKE_DIFFSERV_MODE={0x8}, @TCA_CAKE_RAW={0x8}, @TCA_CAKE_MPU={0x8, 0xe, 0xb9}, @TCA_CAKE_NAT={0x8}, @TCA_CAKE_MEMORY={0x8, 0xa, 0x80000001}]}}, @TCA_STAB={0xc4, 0x8, 0x0, 0x1, [{{0x1c, 0x1, {0x1, 0x0, 0x4, 0x8, 0x2, 0x962a, 0x1486, 0x3}}, {0xa, 0x2, [0x4, 0x9, 0x81]}}, {{0x1c, 0x1, {0x3, 0x6, 0x3, 0x1c00000, 0x0, 0x9ea1, 0x5, 0x1}}, {0x6, 0x2, [0x6]}}, {{0x1c, 0x1, {0x95, 0x1, 0x8, 0x200, 0x0, 0x3fe, 0x400, 0x2}}, {0x8, 0x2, [0x85, 0x4]}}, {{0x1c, 0x1, {0xa0, 0x1, 0x9, 0x5e, 0x1, 0x10001, 0x5, 0x5}}, {0xe, 0x2, [0x4, 0xfdf, 0x1154, 0x10ed, 0x9]}}, {{0x1c, 0x1, {0xc3, 0x5, 0x5, 0xb473, 0x2, 0xfffffff7, 0x1ff, 0x2}}, {0x8, 0x2, [0x81, 0x685c]}}]}, @TCA_RATE={0x6, 0x5, {0x7, 0x1}}, @TCA_STAB={0xd4, 0x8, 0x0, 0x1, [{{0x1c, 0x1, {0x5, 0x66, 0x1ff, 0x4b, 0x1, 0x870, 0xfffffffa, 0x1}}, {0x6, 0x2, [0x9]}}, {{0x1c, 0x1, {0x2, 0x4a, 0x6, 0x6, 0x1, 0xa, 0x4, 0x5}}, {0xe, 0x2, [0x101, 0x7f, 0xf457, 0x7, 0x7]}}, {{0x1c, 0x1, {0x3, 0x10, 0x9, 0x8001, 0x0, 0x6, 0xffff, 0xa}}, {0x18, 0x2, [0x3b4, 0x4, 0x78, 0x2000, 0x67, 0x1, 0x1, 0xc, 0xa, 0x8]}}, {{0x1c, 0x1, {0x1, 0x55, 0x3b0, 0xa, 0x2, 0x0, 0x0, 0x3}}, {0xa, 0x2, [0x0, 0x8, 0x0]}}, {{0x1c, 0x1, {0x0, 0x0, 0x6, 0x925, 0x0, 0x2, 0x3, 0x2}}, {0x8, 0x2, [0x1, 0x9]}}]}, @TCA_INGRESS_BLOCK={0x8, 0xd, 0x1}]}, 0x2dc}, 0x1, 0x0, 0x0, 0x4081}, 0x0) (async)
sendmsg$nl_route_sched(r1, &(0x7f0000000b00)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000640)=@delqdisc={0x2dc, 0x26, 0x1, 0x70ad2b, 0x25dfdbfc, {0x0, 0x0, 0x0, r2, {}, {0xffff, 0xffff}, {0xf, 0x3}}, [@qdisc_kind_options=@q_taprio={{0xb}, {0x2c, 0x2, [@TCA_TAPRIO_ATTR_SCHED_CLOCKID={0x8, 0x5, 0x7f}, @TCA_TAPRIO_ATTR_SCHED_BASE_TIME={0xc, 0x3, 0xffff}, @TCA_TAPRIO_ATTR_SCHED_CLOCKID={0x8}, @TCA_TAPRIO_ATTR_SCHED_BASE_TIME={0xc, 0x3, 0x5}]}}, @TCA_STAB={0xa0, 0x8, 0x0, 0x1, [{{0x1c, 0x1, {0x60, 0x7, 0x9, 0x0, 0x0, 0xd, 0xc2, 0x1}}, {0x6, 0x2, [0x3]}}, {{0x1c, 0x1, {0x9, 0x7, 0x1, 0x4, 0x0, 0x7, 0x2, 0x9}}, {0x16, 0x2, [0x0, 0x0, 0xffff, 0xbacf, 0xa, 0x6, 0x8, 0x3ff, 0x7]}}, {{0x1c, 0x1, {0x7f, 0x0, 0xd995, 0x3ff, 0x0, 0x3, 0x3, 0x1}}, {0x6, 0x2, [0x7f]}}, {{0x1c, 0x1, {0x1, 0x10, 0x1, 0x0, 0x0, 0x7}}, {0x4}}]}, @qdisc_kind_options=@q_cake={{0x9}, {0x2c, 0x2, [@TCA_CAKE_DIFFSERV_MODE={0x8}, @TCA_CAKE_RAW={0x8}, @TCA_CAKE_MPU={0x8, 0xe, 0xb9}, @TCA_CAKE_NAT={0x8}, @TCA_CAKE_MEMORY={0x8, 0xa, 0x80000001}]}}, @TCA_STAB={0xc4, 0x8, 0x0, 0x1, [{{0x1c, 0x1, {0x1, 0x0, 0x4, 0x8, 0x2, 0x962a, 0x1486, 0x3}}, {0xa, 0x2, [0x4, 0x9, 0x81]}}, {{0x1c, 0x1, {0x3, 0x6, 0x3, 0x1c00000, 0x0, 0x9ea1, 0x5, 0x1}}, {0x6, 0x2, [0x6]}}, {{0x1c, 0x1, {0x95, 0x1, 0x8, 0x200, 0x0, 0x3fe, 0x400, 0x2}}, {0x8, 0x2, [0x85, 0x4]}}, {{0x1c, 0x1, {0xa0, 0x1, 0x9, 0x5e, 0x1, 0x10001, 0x5, 0x5}}, {0xe, 0x2, [0x4, 0xfdf, 0x1154, 0x10ed, 0x9]}}, {{0x1c, 0x1, {0xc3, 0x5, 0x5, 0xb473, 0x2, 0xfffffff7, 0x1ff, 0x2}}, {0x8, 0x2, [0x81, 0x685c]}}]}, @TCA_RATE={0x6, 0x5, {0x7, 0x1}}, @TCA_STAB={0xd4, 0x8, 0x0, 0x1, [{{0x1c, 0x1, {0x5, 0x66, 0x1ff, 0x4b, 0x1, 0x870, 0xfffffffa, 0x1}}, {0x6, 0x2, [0x9]}}, {{0x1c, 0x1, {0x2, 0x4a, 0x6, 0x6, 0x1, 0xa, 0x4, 0x5}}, {0xe, 0x2, [0x101, 0x7f, 0xf457, 0x7, 0x7]}}, {{0x1c, 0x1, {0x3, 0x10, 0x9, 0x8001, 0x0, 0x6, 0xffff, 0xa}}, {0x18, 0x2, [0x3b4, 0x4, 0x78, 0x2000, 0x67, 0x1, 0x1, 0xc, 0xa, 0x8]}}, {{0x1c, 0x1, {0x1, 0x55, 0x3b0, 0xa, 0x2, 0x0, 0x0, 0x3}}, {0xa, 0x2, [0x0, 0x8, 0x0]}}, {{0x1c, 0x1, {0x0, 0x0, 0x6, 0x925, 0x0, 0x2, 0x3, 0x2}}, {0x8, 0x2, [0x1, 0x9]}}]}, @TCA_INGRESS_BLOCK={0x8, 0xd, 0x1}]}, 0x2dc}, 0x1, 0x0, 0x0, 0x4081}, 0x0)
close_range(r0, 0xffffffffffffffff, 0x0) (async)
close_range(r0, 0xffffffffffffffff, 0x0)
sendmsg$nl_route_sched(r1, &(0x7f0000000380)={&(0x7f0000000240)={0x10, 0x0, 0x0, 0x2000000}, 0xc, &(0x7f0000000300)={&(0x7f00000002c0)=@delqdisc={0x3c, 0x25, 0x400, 0x70bd29, 0x25dfdbfb, {0x0, 0x0, 0x0, r2, {0xe, 0x6}, {}, {0x2, 0x4}}, [@TCA_RATE={0x6, 0x5, {0x2}}, @TCA_EGRESS_BLOCK={0x8, 0xe, 0x5}, @TCA_INGRESS_BLOCK={0x8, 0xd, 0x7}]}, 0x3c}, 0x1, 0x0, 0x0, 0x42805}, 0x20040002)
socket$inet_udp(0x2, 0x2, 0x0)
r3 = socket$inet6_tcp(0xa, 0x1, 0x0)
bind$inet6(r3, &(0x7f0000000080)={0xa, 0x2, 0x200, @loopback, 0x7}, 0x1c) (async)
bind$inet6(r3, &(0x7f0000000080)={0xa, 0x2, 0x200, @loopback, 0x7}, 0x1c)
sendto$inet6(r3, 0x0, 0x0, 0x24000045, &(0x7f00000001c0)={0xa, 0x2, 0xffff, @loopback, 0x9}, 0x1c)
setsockopt$inet6_tcp_TCP_CONGESTION(r3, 0x6, 0xd, &(0x7f0000000140)='illinois', 0x8)
shutdown(r3, 0x1)
r4 = socket$nl_route(0x10, 0x3, 0x0)
r5 = socket$nl_route(0x10, 0x3, 0x0)
setsockopt$netlink_NETLINK_NO_ENOBUFS(r5, 0x10e, 0xc, &(0x7f0000000040)=0x7f, 0x4) (async)
setsockopt$netlink_NETLINK_NO_ENOBUFS(r5, 0x10e, 0xc, &(0x7f0000000040)=0x7f, 0x4)
r6 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0)
r7 = ioctl$KVM_CREATE_VM(r6, 0xae01, 0x0)
r8 = ioctl$KVM_CREATE_GUEST_MEMFD(r7, 0xc040aed4, &(0x7f00000001c0)={0x1000200001ee0000, 0x3})
mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xa, 0x28011, r8, 0x78d4a000)
get_mempolicy(0x0, 0x0, 0x3, &(0x7f000024c000/0x2000)=nil, 0x2) (async)
get_mempolicy(0x0, 0x0, 0x3, &(0x7f000024c000/0x2000)=nil, 0x2)
syz_init_net_socket$nl_generic(0x10, 0x3, 0x10)
sendmsg$nl_route(r5, &(0x7f0000000100)={0x0, 0x20, &(0x7f00000000c0)={&(0x7f0000000000)=ANY=[@ANYBLOB="240000001a0001000000ff7f0000000080200000", @ANYRES32=0x0, @ANYBLOB='\x00\x00\x00\x00\b\x00', @ANYRES32=r5], 0x24}}, 0x0) (async)
sendmsg$nl_route(r5, &(0x7f0000000100)={0x0, 0x20, &(0x7f00000000c0)={&(0x7f0000000000)=ANY=[@ANYBLOB="240000001a0001000000ff7f0000000080200000", @ANYRES32=0x0, @ANYBLOB='\x00\x00\x00\x00\b\x00', @ANYRES32=r5], 0x24}}, 0x0)
r9 = fsopen(&(0x7f0000000280)='ceph\x00', 0x0)
r10 = socket$inet(0x2, 0x2, 0x0)
bpf$PROG_LOAD(0x5, &(0x7f0000000080)={0x1, 0x5, &(0x7f0000002c00)=ANY=[@ANYBLOB="bf16000000000000b70700000900f0ff4070000000000000500000000000000095000000000000002ba728041598d6fbd30cb599e8c73d24a3aa81d36bb3019c13bd23212fb56fa54f26fb0b71d0e6adfefc41d86bd917487960717142fa9ea4318123741c0a0e168c1886d0d4d94f2f4e345c652ebc1626e3a2a2ad35806150ae0209e62f51ee988e6e0dc8ce974a22a550d6fd70800c86ae3b3e05df3ceb9fc474c2a100c788b277beee1cbf9b0a4def23d410f6296b32a8343881dcc7b1b85f3c3d44aeaccd3641110bec4e90a6341965c39e4b3449abe802f5ab3e89cf6c662ed4048d3b3e22278d00031e5388ee6f867ddd58211d6ececb0cd2b6d357b8580218ce740068725837074e468ee23fd2f73902ebcfcf49822775985bf31b715f5888b2c81f96a810b946855c9fc52ac17cbc97a616811a4c2dc3470009b966abaf41939aeca3e7b00c2e9d5db7a34fe2a29ac88c360a878a2b9ab9440c1961e80477166f3f847e855cdddc941d996d61ea0ce23b37e9d21c849d1e1e53087a3b109012e3a3ecbd219265048bf5c72b7ba2806b73323301b4bc94d0e4afde44867d71049a7c89bc615e215571ac910d80a58b5169576ff9906c34d2342806960b6bcb00000000000000000000000000113ee640b9ed1e04a0bfb125204d30990361bf45ef45277a167cd2c2e6ce9138143aa5ea7ee6f7c6d8b00437e070b004c5aa90766538b4fe45a16f14b270904d36eaa87508ac6d46639b3971ac6a88dc531fcc5ffc6b76b334795d88156336a9a452a9022485bb572dacb7aa25f748bc75918a16d9d5ae21004cd799ac4951beb2c6c9b5baf60081b86cc2e31c49f4ea055fb3639036c95c69b1ae60e685d486dbd1d5e7d0daacd73acfc80b9c9c92"], &(0x7f0000000140)='GPL\x00'}, 0x48) (async)
r11 = bpf$PROG_LOAD(0x5, &(0x7f0000000080)={0x1, 0x5, &(0x7f0000002c00)=ANY=[@ANYBLOB="bf16000000000000b70700000900f0ff4070000000000000500000000000000095000000000000002ba728041598d6fbd30cb599e8c73d24a3aa81d36bb3019c13bd23212fb56fa54f26fb0b71d0e6adfefc41d86bd917487960717142fa9ea4318123741c0a0e168c1886d0d4d94f2f4e345c652ebc1626e3a2a2ad35806150ae0209e62f51ee988e6e0dc8ce974a22a550d6fd70800c86ae3b3e05df3ceb9fc474c2a100c788b277beee1cbf9b0a4def23d410f6296b32a8343881dcc7b1b85f3c3d44aeaccd3641110bec4e90a6341965c39e4b3449abe802f5ab3e89cf6c662ed4048d3b3e22278d00031e5388ee6f867ddd58211d6ececb0cd2b6d357b8580218ce740068725837074e468ee23fd2f73902ebcfcf49822775985bf31b715f5888b2c81f96a810b946855c9fc52ac17cbc97a616811a4c2dc3470009b966abaf41939aeca3e7b00c2e9d5db7a34fe2a29ac88c360a878a2b9ab9440c1961e80477166f3f847e855cdddc941d996d61ea0ce23b37e9d21c849d1e1e53087a3b109012e3a3ecbd219265048bf5c72b7ba2806b73323301b4bc94d0e4afde44867d71049a7c89bc615e215571ac910d80a58b5169576ff9906c34d2342806960b6bcb00000000000000000000000000113ee640b9ed1e04a0bfb125204d30990361bf45ef45277a167cd2c2e6ce9138143aa5ea7ee6f7c6d8b00437e070b004c5aa90766538b4fe45a16f14b270904d36eaa87508ac6d46639b3971ac6a88dc531fcc5ffc6b76b334795d88156336a9a452a9022485bb572dacb7aa25f748bc75918a16d9d5ae21004cd799ac4951beb2c6c9b5baf60081b86cc2e31c49f4ea055fb3639036c95c69b1ae60e685d486dbd1d5e7d0daacd73acfc80b9c9c92"], &(0x7f0000000140)='GPL\x00'}, 0x48)
setsockopt$IPT_SO_SET_REPLACE(r10, 0x0, 0x40, &(0x7f0000000a80)=@raw={'raw\x00', 0x8, 0x3, 0x450, 0x2e8, 0x40000, 0x198, 0x2e8, 0x198, 0x3b8, 0x358, 0x358, 0x3b8, 0x358, 0x3, 0x0, {[{{@ip={@multicast2, @dev={0xac, 0x14, 0x14, 0x16}, 0x0, 0x0, 'vcan0\x00', 'wg1\x00', {}, {}, 0x0, 0x1}, 0x0, 0x2c8, 0x2e8, 0x0, {}, [@common=@unspec=@bpf1={{0x230}, @fd={0x2, 0x0, r11}}, @inet=@rpfilter={{0x28}, {0x9}}]}, @unspec=@TRACE={0x20}}, {{@ip={@remote, @dev, 0x0, 0x0, 'team_slave_1\x00', 'netdevsim0\x00', {}, {}, 0x0, 0x2}, 0x0, 0x70, 0xd0}, @common=@CLUSTERIP={0x60, 'CLUSTERIP\x00', 0x0, {0x0, @empty, 0x3, 0x10, [0x48, 0x37, 0x32, 0x26, 0x2, 0x2d, 0x29, 0x17, 0x23, 0x1c, 0xe, 0x38, 0xb, 0x22, 0x27, 0xd], 0x2, 0x4b, 0x9}}}], {{'\x00', 0x0, 0x70, 0x98}, {0x28, '\x00', 0x4}}}}, 0x4b0) (async)
setsockopt$IPT_SO_SET_REPLACE(r10, 0x0, 0x40, &(0x7f0000000a80)=@raw={'raw\x00', 0x8, 0x3, 0x450, 0x2e8, 0x40000, 0x198, 0x2e8, 0x198, 0x3b8, 0x358, 0x358, 0x3b8, 0x358, 0x3, 0x0, {[{{@ip={@multicast2, @dev={0xac, 0x14, 0x14, 0x16}, 0x0, 0x0, 'vcan0\x00', 'wg1\x00', {}, {}, 0x0, 0x1}, 0x0, 0x2c8, 0x2e8, 0x0, {}, [@common=@unspec=@bpf1={{0x230}, @fd={0x2, 0x0, r11}}, @inet=@rpfilter={{0x28}, {0x9}}]}, @unspec=@TRACE={0x20}}, {{@ip={@remote, @dev, 0x0, 0x0, 'team_slave_1\x00', 'netdevsim0\x00', {}, {}, 0x0, 0x2}, 0x0, 0x70, 0xd0}, @common=@CLUSTERIP={0x60, 'CLUSTERIP\x00', 0x0, {0x0, @empty, 0x3, 0x10, [0x48, 0x37, 0x32, 0x26, 0x2, 0x2d, 0x29, 0x17, 0x23, 0x1c, 0xe, 0x38, 0xb, 0x22, 0x27, 0xd], 0x2, 0x4b, 0x9}}}], {{'\x00', 0x0, 0x70, 0x98}, {0x28, '\x00', 0x4}}}}, 0x4b0)
fsconfig$FSCONFIG_SET_STRING(r9, 0x1, &(0x7f0000000b40)='source', &(0x7f0000000040)='c:::\x00', 0x0)
sendmsg$nl_route(r4, &(0x7f0000000200)={&(0x7f0000000080)={0x10, 0x0, 0x0, 0x10000}, 0xc, &(0x7f00000001c0)={&(0x7f00000003c0)=ANY=[@ANYBLOB="60000000680010002bbd7000fcdbdf250000016c628248000400000006000700030000001400060000000000000000000000ffffe000020400040014000600fe8000000000000000000000000000bb0600030001000000040004000600070016b6b1c3743f50f418c7e7dbbf400f4572129ee24d86ca5ff823d02b29be494923a8aaa4b47d7ef1f3a28fec72c6abbaea5dda008b8a3bb6235999664625c8cfdcaa6615a8f7df4f233cafa3d868e661ad4e3ceb5891fb925df0d2781bae0c773fc9b8b083ba36c4398576350a6845daecae5c72af66c7b7eac1fe54ead22a31399b288ac47d54b2adff1bc71e1cf0b0caca6f91f721e4e5b4884effb45269ebc565ec33f8b8ca63800344014c"], 0x60}}, 0x800)
gettid()
fsconfig$FSCONFIG_CMD_CREATE(r9, 0x6, 0x0, 0x0, 0x0) (async)
fsconfig$FSCONFIG_CMD_CREATE(r9, 0x6, 0x0, 0x0, 0x0)
executing program 3:
socket$nl_netfilter(0x10, 0x3, 0xc)
r0 = socket$inet6_tcp(0xa, 0x1, 0x0)
connect$inet6(r0, 0x0, 0x0)
r1 = gettid()
timer_create(0x0, &(0x7f0000533fa0)={0x0, 0x21, 0x800000000004, @tid=r1}, &(0x7f0000000140))
timer_settime(0x0, 0x0, &(0x7f0000000280)={{0x0, 0x989680}, {0x0, 0x989680}}, 0x0)
mmap$IORING_OFF_SQ_RING(0x110c230000, 0x8000002, 0x2000007, 0x401d031, 0xffffffffffffffff, 0x0)
socketpair$unix(0x1, 0x0, 0x0, 0x0)
openat$ptmx(0xffffffffffffff9c, 0x0, 0x482, 0x0)
r2 = socket(0x1, 0x2, 0x0)
getsockopt$sock_cred(r2, 0x1, 0x11, 0x0, &(0x7f0000cab000))
setsockopt$sock_cred(0xffffffffffffffff, 0x1, 0x11, 0x0, 0x0)
lremovexattr(0x0, 0x0)
setsockopt$inet6_tcp_TCP_REPAIR_QUEUE(r0, 0x6, 0x14, 0x0, 0x0)
mmap(&(0x7f0000000000/0x4000)=nil, 0x4000, 0x1, 0x10012, 0xffffffffffffffff, 0x5deba000)
mmap(&(0x7f0000bfe000/0x400000)=nil, 0x400000, 0x4, 0x40010, r0, 0xd1aa000)
mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x3, 0x8031, 0xffffffffffffffff, 0x0)
r3 = openat$audio(0xffffffffffffff9c, &(0x7f0000000380), 0x149842, 0x0)
write$dsp(r3, &(0x7f00000003c0)="91", 0xffffffb5)
mmap$dsp(&(0x7f0000ffd000/0x2000)=nil, 0x2000, 0x100000b, 0x810, r3, 0x0)
close(r3)
socket$xdp(0x2c, 0x3, 0x0)
r4 = socket$kcm(0xa, 0x2, 0x0)
setsockopt$inet6_tcp_TCP_CONGESTION(r0, 0x6, 0xd, &(0x7f0000000040)='veno', 0x4)
r5 = socket(0x2, 0x80805, 0x0)
r6 = openat$fuse(0xffffffffffffff9c, &(0x7f0000000080), 0x2, 0x0)
read$FUSE(r6, &(0x7f0000000600)={0x2020}, 0x2020)
setsockopt$IP_VS_SO_SET_ADD(r5, 0x0, 0x482, &(0x7f0000000240)={0x84, @dev={0xac, 0x14, 0x14, 0x15}, 0x4e20, 0x3, 'wlc\x00', 0x2, 0x660f537e, 0x3}, 0x2c)
setsockopt$IP_VS_SO_SET_ADDDEST(r5, 0x0, 0x487, &(0x7f0000000440)={{0x84, @multicast2, 0x4e22, 0x3, 'ovf\x00', 0x5, 0xc, 0x6c}, {@private=0xa010101, 0x4e23, 0x10002, 0x1, 0x1}}, 0x44)
sendmsg$sock(r4, &(0x7f0000000400)={&(0x7f0000000580)=@in6={0x2, 0x4e20, 0x0, @dev={0xfe, 0x80, '\x00', 0xfd}}, 0x80, 0x0, 0x0, &(0x7f0000000000)=[@mark={{0x14, 0x1, 0x24, 0x3}}], 0x18}, 0x0)
executing program 3:
r0 = syz_usb_connect(0x0, 0x32, &(0x7f0000000000)=ANY=[@ANYBLOB="1201000200000040a61b01000100000000010902200001010080320904"], 0x0)
r1 = openat$ptp1(0xffffffffffffff9c, &(0x7f0000000c40), 0x149201, 0x0)
ioctl$PTP_ENABLE_PPS(r1, 0x40043d04, 0x1)
r2 = socket$kcm(0x10, 0x2, 0x4)
sendmsg$inet(r2, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)=[{&(0x7f0000000100)="5c00000012006bab9e3fe3d86e6c1d0000147ea60864160af36504b68675f8001d000a00a0e69ee517d34460bc24eab556a705251e6182949a36c23d3b48dfd8cdbf9367b4fa51f60a64c9f4080003680601000008000300ff000000", 0x5c}], 0x1, 0x0, 0x0, 0x1f00c00e}, 0x0)
r3 = syz_usb_connect$uac3(0x3, 0x80, &(0x7f0000000280)=ANY=[], 0x0)
syz_usb_control_io(r0, 0x0, 0x0)
syz_usb_control_io$sierra_net(r0, 0x0, &(0x7f0000000700)={0x1c, &(0x7f0000000280)=ANY=[], 0x0, 0x0})
syz_usb_control_io$uac3(r3, 0x0, 0x0)
syz_usb_control_io$printer(r0, 0x0, &(0x7f00000005c0)={0x34, &(0x7f00000003c0)=ANY=[], 0x0, 0x0, 0x0, 0x0, 0x0})
mkdirat(0xffffffffffffff9c, &(0x7f0000000200)='./file0\x00', 0x0)
r4 = openat(0xffffffffffffff9c, &(0x7f0000000080)='./file0\x00', 0x0, 0xd5)
ioctl$FS_IOC_GETFLAGS(r4, 0x80086601, &(0x7f0000000100))
syz_open_dev$dvb_frontend(&(0x7f0000000100), 0x1, 0x802)
r5 = socket$inet6_sctp(0xa, 0x801, 0x84)
getsockopt$bt_hci(r5, 0x84, 0x81, &(0x7f0000001280)=""/4107, &(0x7f00000000c0)=0x100b)
r6 = socket$rxrpc(0x21, 0x2, 0x2)
setsockopt$RXRPC_MIN_SECURITY_LEVEL(r6, 0x110, 0x4, &(0x7f0000000440)=0x1, 0x4)
syz_usb_connect(0x0, 0x32, &(0x7f0000000000)=ANY=[@ANYBLOB="1201000200000040a61b01000100000000010902200001010080320904"], 0x0) (async)
openat$ptp1(0xffffffffffffff9c, &(0x7f0000000c40), 0x149201, 0x0) (async)
ioctl$PTP_ENABLE_PPS(r1, 0x40043d04, 0x1) (async)
socket$kcm(0x10, 0x2, 0x4) (async)
sendmsg$inet(r2, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)=[{&(0x7f0000000100)="5c00000012006bab9e3fe3d86e6c1d0000147ea60864160af36504b68675f8001d000a00a0e69ee517d34460bc24eab556a705251e6182949a36c23d3b48dfd8cdbf9367b4fa51f60a64c9f4080003680601000008000300ff000000", 0x5c}], 0x1, 0x0, 0x0, 0x1f00c00e}, 0x0) (async)
syz_usb_connect$uac3(0x3, 0x80, &(0x7f0000000280)=ANY=[], 0x0) (async)
syz_usb_control_io(r0, 0x0, 0x0) (async)
syz_usb_control_io$sierra_net(r0, 0x0, &(0x7f0000000700)={0x1c, &(0x7f0000000280)=ANY=[], 0x0, 0x0}) (async)
syz_usb_control_io$uac3(r3, 0x0, 0x0) (async)
syz_usb_control_io$printer(r0, 0x0, &(0x7f00000005c0)={0x34, &(0x7f00000003c0)=ANY=[], 0x0, 0x0, 0x0, 0x0, 0x0}) (async)
mkdirat(0xffffffffffffff9c, &(0x7f0000000200)='./file0\x00', 0x0) (async)
openat(0xffffffffffffff9c, &(0x7f0000000080)='./file0\x00', 0x0, 0xd5) (async)
ioctl$FS_IOC_GETFLAGS(r4, 0x80086601, &(0x7f0000000100)) (async)
syz_open_dev$dvb_frontend(&(0x7f0000000100), 0x1, 0x802) (async)
socket$inet6_sctp(0xa, 0x801, 0x84) (async)
getsockopt$bt_hci(r5, 0x84, 0x81, &(0x7f0000001280)=""/4107, &(0x7f00000000c0)=0x100b) (async)
socket$rxrpc(0x21, 0x2, 0x2) (async)
setsockopt$RXRPC_MIN_SECURITY_LEVEL(r6, 0x110, 0x4, &(0x7f0000000440)=0x1, 0x4) (async)
executing program 2:
r0 = syz_open_dev$dri(&(0x7f0000000040), 0x0, 0x442a02)
ioctl$DRM_IOCTL_GET_MAGIC(r0, 0x80046402, 0x0)
r1 = seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0x0, &(0x7f0000000040)={0x1, &(0x7f0000000000)=[{0x6, 0x0, 0x0, 0x7fff8000}]})
close_range(r1, 0xffffffffffffffff, 0x0)
madvise(&(0x7f0000f19000/0x1000)=nil, 0x1000, 0xa)
openat$cgroup_type(0xffffffffffffffff, &(0x7f0000000140), 0x2, 0x0)
r2 = fcntl$dupfd(r0, 0x0, r1)
r3 = seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0x0, &(0x7f0000000000)={0x1, &(0x7f0000000100)=[{0x6, 0x0, 0xff, 0x7fff0000}]})
r4 = syz_init_net_socket$bt_l2cap(0x1f, 0x1, 0x3)
bind$bt_l2cap(r4, &(0x7f0000000280)={0x1f, 0x0, @none, 0x0, 0x2}, 0xe)
listen(r4, 0x1)
close_range(r3, 0xffffffffffffffff, 0x0)
r5 = syz_kvm_add_vcpu$x86(0x0, &(0x7f0000000700)={0x0, &(0x7f00000002c0)=[@set_irq_handler={0xc8, 0x20, {0x8a, 0x1}}, @uexit={0x0, 0x18, 0x3}, @nested_amd_inject_event={0x180, 0x38, {0x2, 0xc0, 0x2, 0x31ec194800000000, 0x3}}, @enable_nested={0x12c, 0x18}, @set_irq_handler={0xc8, 0x20, {0xb2, 0x1}}, @nested_amd_invlpga={0x17d, 0x20, {0x25001, 0xa8e8}}, @nested_amd_set_intercept={0x181, 0x30, {0x3, 0x800, 0x8, 0x1}}, @wrmsr={0x65, 0x20, {0x2af, 0x2}}, @nested_amd_stgi={0x17e, 0x10}, @code={0xa, 0x88, {"66f3470f09470f4c44810036f3f366470f86074100006467366667653e660f3880336464f661a8c7442400c6000000c7442402ea840000ff2c240f21f4b90a030000b821000000ba000000000f3048b800980000000000000f23c00f21f83501000e000f23f8b9820b0000b8a149ad8fbad55194300f30"}}, @wrmsr={0x65, 0x20, {0x236, 0x8000000000}}, @wrmsr={0x65, 0x20, {0xa61, 0x9}}, @nested_vmresume={0x130, 0x18, 0x2}, @nested_amd_inject_event={0x180, 0x38, {0x3, 0x86, 0x2, 0x4, 0x1}}, @cpuid={0x64, 0x18, {0x6}}, @nested_intel_vmwrite_mask={0x154, 0x38, {0x3, @ro32=0x440e, 0x4, 0x8fc, 0x3ff}}, @code={0xa, 0x57, {"2e0f38026e07b9bf0a00000f326543d877c1640f070f350f01df66b8fa008ed848b864930000000000000f23c80f21f8350c0020000f23f80f009f0b000000b96d0a00000f32"}}, @nested_amd_stgi={0x17e, 0x10}, @enable_nested={0x12c, 0x18}, @nested_load_syzos={0x136, 0x70, {0x0, 0x91b2, [@set_irq_handler={0xc8, 0x20, {0xe6, 0x2}}, @nested_amd_set_intercept={0x181, 0x30, {0x3, 0x8000000000000001, 0x4, 0x1}}]}}, @nested_amd_set_intercept={0x181, 0x30, {0x3, 0xffffffffffffffff, 0xb13b, 0x1}}, @rdmsr={0x66, 0x18, {0x9a4}}, @nested_amd_set_intercept={0x181, 0x30, {0x3, 0x8, 0xe3, 0x1}}, @nested_intel_vmwrite_mask={0x154, 0x38, {0x1, @control16=0x4, 0x9, 0x5, 0x6}}], 0x42f})
ioctl$KVM_GET_XSAVE2(r5, 0x9000aecf, &(0x7f0000ffd000/0x2000)=nil)
epoll_ctl$EPOLL_CTL_DEL(r2, 0x2, r0)
prctl$PR_SET_VMA(0x53564d41, 0x0, &(0x7f0000f19000/0x1000)=nil, 0x1000, &(0x7f0000000000)='/{!+]\x00')
ioctl$AUTOFS_DEV_IOCTL_FAIL(0xffffffffffffffff, 0xc0189377, &(0x7f0000000080)={{0x1, 0x1, 0x18, <r6=>r1, {0x1d, 0x296f5e09}}, './file0\x00'})
ioctl$UFFDIO_REGISTER(r6, 0xc020aa00, &(0x7f00000000c0)={{&(0x7f0000f19000/0x1000)=nil, 0x1000}, 0x2})
ioctl$SNDRV_TIMER_IOCTL_START(r6, 0x54a0)
executing program 2:
symlinkat(&(0x7f0000000080)='.\x00', 0xffffffffffffff9c, &(0x7f0000000200)='./file0\x00')
bpf$PROG_LOAD(0x5, &(0x7f0000000180)={0x10, 0x4, &(0x7f0000000000)=@framed={{}, [@call={0x179, 0x11, 0x100000}]}, &(0x7f00000000c0)='GPL\x00', 0x4, 0x1000, &(0x7f0000000200)=""/4096, 0x0, 0x0, '\x00', 0x0, @sk_msg}, 0x70)
mkdirat(0xffffffffffffff9c, &(0x7f0000000040)='./file1\x00', 0x1)
lremovexattr(&(0x7f0000001200)='./file7\x00', &(0x7f0000001240)=@random={'security.', '\x00'})
mkdirat(0xffffffffffffff9c, &(0x7f00000000c0)='./bus\x00', 0x0)
mount$overlay(0x0, &(0x7f00000000c0)='./bus\x00', &(0x7f0000000080), 0xa14000, &(0x7f0000000140)={[{@upperdir={'upperdir', 0x3d, './file1'}}, {@lowerdir={'lowerdir', 0x3d, './file0'}}, {@workdir={'workdir', 0x3d, './bus'}}]})
chdir(&(0x7f00000003c0)='./bus\x00')
mkdirat(0xffffffffffffff9c, &(0x7f0000000540)='./file7\x00', 0x1c0)
renameat2(0xffffffffffffff9c, &(0x7f0000000780)='./file0\x00', 0xffffffffffffff9c, &(0x7f0000000000)='./file7/file0\x00', 0x0)
r0 = openat(0xffffffffffffff9c, 0x0, 0x0, 0x2)
mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./file0\x00', 0x0)
r1 = socket$can_j1939(0x1d, 0x2, 0x7)
mprotect(&(0x7f0000000000/0x3000)=nil, 0x3000, 0x1)
setsockopt$sock_int(r1, 0x1, 0x6, &(0x7f0000000040)=0x1, 0x4)
r2 = socket$packet(0x11, 0x3, 0x300)
setsockopt$packet_fanout(r2, 0x107, 0x12, &(0x7f0000000000)={0x4, 0x3}, 0x4)
r3 = socket$packet(0x11, 0x3, 0x300)
setsockopt$packet_fanout(r3, 0x107, 0x12, &(0x7f0000000000)={0x4, 0x3}, 0x4)
r4 = bpf$PROG_LOAD_XDP(0x5, &(0x7f0000000480)={0x6, 0x3, &(0x7f0000000680)=ANY=[@ANYBLOB="1800000002000000000000000000000095"], &(0x7f00000002c0)='syzkaller\x00'}, 0x94)
setsockopt$inet_sctp_SCTP_ADD_STREAMS(r0, 0x84, 0x79, &(0x7f0000000100)={0x0, 0xa, 0x3}, 0x8)
bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f0000000600)={r4, 0x5, 0xb68, 0x560b0000, &(0x7f0000000000)="259a53f271a76d2673004c6588a8", 0x0, 0xd01, 0x2a0, 0x0, 0x0, 0x0, 0x0, 0x2}, 0x48)
executing program 2:
socket$nl_generic(0x10, 0x3, 0x10)
r0 = socket$nl_netfilter(0x10, 0x3, 0xc)
sendmsg$netlink(r0, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000100)=[{&(0x7f0000000140)={0x78, 0x16, 0xf15, 0x0, 0x0, "", [@typed={0x65, 0x84, 0x0, 0x0, @binary="b07d534ae6d132c423a882e82785dceed26c7ab8259ea2ef5331ef77a570bf70451f7ecec9bbf1fc5ddfce1b78d95cb5f4cccd4d58c54c1ebf827e129b5f38eb17a81598d3908443d96c8165a324d084f95989b07c6abfe979bfcc096db965e07d"}]}, 0x78}], 0x1}, 0x0)
executing program 2:
r0 = openat$dsp(0xffffffffffffff9c, &(0x7f0000000000), 0x8041, 0x0) (async, rerun: 32)
modify_ldt$read_default(0x2, 0xffffffffffffffff, 0x0) (async, rerun: 32)
r1 = add_key$user(&(0x7f0000000180), &(0x7f00000001c0)={'syz', 0x2}, &(0x7f0000000200)='*', 0x1, 0xfffffffffffffffb) (async)
r2 = add_key$keyring(&(0x7f0000000000), &(0x7f0000000040)={'syz', 0x0}, 0x0, 0x0, 0xffffffffffffffff)
add_key$user(&(0x7f0000000000), &(0x7f0000000080)={'syz', 0x2}, &(0x7f00000000c0)='c', 0x1, r2) (async)
syz_open_dev$sndctrl(&(0x7f0000000240), 0x3, 0x80042)
r3 = add_key$keyring(&(0x7f0000000200), &(0x7f0000000140)={'syz', 0x1}, 0x0, 0x0, 0xffffffffffffffff)
keyctl$KEYCTL_MOVE(0x1e, r1, r2, r3, 0x1) (async, rerun: 32)
write$dsp(r0, &(0x7f00000001c0)="5cba91a4", 0xffffffd9) (rerun: 32)
ioctl$SNDCTL_DSP_SYNC(r0, 0x5001, 0x0) (async, rerun: 64)
syz_clone(0x11, 0x0, 0x0, 0x0, 0x0, 0x0) (async, rerun: 64)
ioctl$SNDCTL_DSP_SPEED(r0, 0xc0045002, &(0x7f0000000100)=0x7)
executing program 2:
r0 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./proc/net/rpc/auth.unix.ip/channel\x00', 0x2, 0x0)
write(r0, &(0x7f0000000000)='nfsd 127.0.0.1 999999999\n', 0x19)
read(r0, &(0x7f0000000100), 0x100)
io_uring_enter(r0, 0x5df5, 0x3deb, 0xc1, &(0x7f0000000040)={[0x6]}, 0x8) (async)
r1 = socket$nl_netfilter(0x10, 0x3, 0xc)
sendmsg$NFT_BATCH(r1, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000600)={{0x14}, [@NFT_MSG_NEWTABLE={0x20, 0x0, 0xa, 0x201, 0x0, 0x0, {0x7}, [@NFTA_TABLE_NAME={0x9, 0x1, 'syz0\x00'}]}, @NFT_MSG_NEWSET={0x54, 0x9, 0xa, 0x401, 0x0, 0x0, {0x7}, [@NFTA_SET_ID={0x8}, @NFTA_SET_NAME={0x9, 0x2, 'syz1\x00'}, @NFTA_SET_TABLE={0x9, 0x1, 'syz0\x00'}, @NFTA_SET_KEY_LEN={0x8, 0x5, 0x1, 0x0, 0x17}, @NFTA_SET_DATA_TYPE={0x8, 0x6, 0x1, 0x0, 0xffffff00}, @NFTA_SET_FLAGS={0x8, 0x3, 0x1, 0x0, 0x38}, @NFTA_SET_GC_INTERVAL={0x8, 0xc, 0x1, 0x0, 0x2}]}], {0x14, 0x10, 0x1, 0x0, 0x0, {0x0, 0x84}}}, 0x9c}}, 0x0) (async)
r2 = socket$nl_generic(0x10, 0x3, 0x10)
sendmsg$nl_generic(r2, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000180)={0x14, 0x3e, 0x301, 0x270bd24, 0x25dfdbfa, {0x1}}, 0x14}}, 0xc004)
executing program 4:
r0 = socket$inet6_icmp(0xa, 0x2, 0x3a)
mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./trace\x00', 0x1ff) (async)
getsockopt$inet6_int(r0, 0x29, 0xc9, &(0x7f0000000040), &(0x7f00000000c0)=0x4) (async)
r1 = syz_genetlink_get_family_id$nbd(&(0x7f0000000280), 0xffffffffffffffff)
r2 = signalfd(r0, &(0x7f00000002c0)={[0x1]}, 0x8) (async)
socketpair$nbd(0x1, 0x1, 0x0, &(0x7f0000000300)={<r3=>0xffffffffffffffff}) (async)
r4 = openat$ipvs(0xffffffffffffff9c, &(0x7f0000000380)='/proc/sys/net/ipv4/vs/amemthresh\x00', 0x2, 0x0)
socketpair$nbd(0x1, 0x1, 0x0, &(0x7f00000003c0)={<r5=>0xffffffffffffffff}) (async)
socketpair$nbd(0x1, 0x1, 0x0, &(0x7f0000000400)={<r6=>0xffffffffffffffff}) (async)
r7 = socket(0x2d, 0x2, 0x0)
connect$netlink(r7, &(0x7f0000000140)=@unspec={0x2d, 0x0, 0xa00}, 0xc) (async)
r8 = socket(0x12, 0x80002, 0x25)
setsockopt$MRT6_FLUSH(r8, 0x29, 0xd0, 0x0, 0x4)
socketpair(0x1, 0x20000000000001, 0x0, &(0x7f0000000100)={0xffffffffffffffff, <r9=>0xffffffffffffffff})
getsockname$packet(r9, &(0x7f0000000100)={0x11, 0x0, <r10=>0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000080)=0xa)
r11 = socket$nl_route(0x10, 0x3, 0x0)
sendmsg$nl_route_sched(r11, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000440)=@newtaction={0x88, 0x30, 0xffff, 0x0, 0x0, {0x0, 0x0, 0x1300}, [{0x74, 0x1, [@m_mirred={0x70, 0x1, 0x0, 0x0, {{0xb}, {0x44, 0x2, 0x0, 0x1, [@TCA_MIRRED_PARMS={0x20, 0x4, {{0xfffff7e8}}}, @TCA_MIRRED_PARMS={0x20, 0x2, {{0x1, 0x0, 0x1, 0x400, 0xfffffff7}, 0x2, r10}}]}, {0x4}, {0xc}, {0xc, 0x8, {0x0, 0x2}}}}]}]}, 0x88}}, 0x0) (async)
r12 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file0\x00', 0x20846, 0x2)
syz_kvm_setup_cpu$x86(r12, r12, &(0x7f0000fe7000/0x18000)=nil, &(0x7f0000000180)=[@text32={0x20, &(0x7f0000000240)="c4e1a9d83d00000000c4c1cf2a79fdb9a80a0000b807000000ba000000000f30c4e11d73d9069ae0235f8d6d000f20c035020000000f22c00f79199a77000000a9002e65f30fbd934230000066bad10466b8060066ef"}], 0x1, 0x60, 0x0, 0x40) (async)
write$P9_RLERRORu(r12, &(0x7f0000000240)=ANY=[], 0x10)
mmap(&(0x7f0000000000/0x400000)=nil, 0x400000, 0x1, 0x10012, r12, 0x0)
socketpair$nbd(0x1, 0x1, 0x0, &(0x7f0000000440)={<r13=>0xffffffffffffffff})
sendmsg$NBD_CMD_STATUS(0xffffffffffffffff, &(0x7f0000000640)={&(0x7f0000000240)={0x10, 0x0, 0x0, 0x80102000}, 0xc, &(0x7f0000000600)={&(0x7f0000000500)={0xfc, r1, 0x100, 0x70bd26, 0x25dfdbfe, {}, [@NBD_ATTR_SERVER_FLAGS={0xc, 0x5, 0x2}, @NBD_ATTR_SOCKETS={0x1c, 0x7, 0x0, 0x1, [{0xc, 0x1, 0x0, 0x1, {0x8, 0x1, r2}}, {0xc, 0x1, 0x0, 0x1, {0x8, 0x1, r3}}]}, @NBD_ATTR_SERVER_FLAGS={0xc, 0x5, 0x5}, @NBD_ATTR_BACKEND_IDENTIFIER={0x9, 0xa, 'befs\x00'}, @NBD_ATTR_SOCKETS={0x70, 0x7, 0x0, 0x1, [{0xc, 0x1, 0x0, 0x1, {0x8}}, {0xc, 0x1, 0x0, 0x1, {0x8, 0x1, r4}}, {0xc, 0x1, 0x0, 0x1, {0x8, 0x1, r5}}, {0xc, 0x1, 0x0, 0x1, {0x8}}, {0xc, 0x1, 0x0, 0x1, {0x8, 0x1, r6}}, {0xc, 0x1, 0x0, 0x1, {0x8, 0x1, r7}}, {0xc, 0x1, 0x0, 0x1, {0x8, 0x1, r8}}, {0xc, 0x1, 0x0, 0x1, {0x8, 0x1, r12}}, {0xc, 0x1, 0x0, 0x1, {0x8, 0x1, r13}}]}, @NBD_ATTR_BACKEND_IDENTIFIER={0x7, 0xa, ',-]'}, @NBD_ATTR_DEAD_CONN_TIMEOUT={0xc, 0x8, 0x78e7}, @NBD_ATTR_BLOCK_SIZE_BYTES={0xc, 0x3, 0x5}, @NBD_ATTR_TIMEOUT={0xc, 0x4, 0x227}, @NBD_ATTR_BLOCK_SIZE_BYTES={0xc, 0x3, 0x400}]}, 0xfc}, 0x1, 0x0, 0x0, 0x8000}, 0x4000151) (async)
mount(0x0, &(0x7f0000000000)='./trace\x00', &(0x7f0000000100)='befs\x00', 0x0, 0x0)
r14 = open$dir(&(0x7f0000000200)='./trace\x00', 0x20000, 0x4c)
r15 = openat(r14, &(0x7f0000000140)='./trace/set_event\x00', 0x2, 0x40) (async)
r16 = syz_open_dev$sg(&(0x7f00000000c0), 0x0, 0x2400)
ioctl$SG_IO(r16, 0x2285, &(0x7f0000000180)={0x53, 0xfffffffffffffffd, 0x6, 0x81, @scatter={0x0, 0x0, 0x0}, &(0x7f0000000700)="1265b914f46e", 0x0, 0x2000000, 0x10022, 0x3, 0x0}) (async)
writev(r15, &(0x7f0000000340)=[{&(0x7f00000004c0)="2019", 0x2}], 0x1) (async)
getsockopt$inet6_int(r0, 0x29, 0x31, 0x0, &(0x7f0000000080))
executing program 2:
mkdirat(0xffffffffffffff9c, &(0x7f0000000100)='./file0\x00', 0x0) (async, rerun: 64)
mount(0x0, &(0x7f00000001c0)='./file0\x00', &(0x7f0000000300)='cgroup2\x00', 0x0, 0x0) (async, rerun: 64)
r0 = openat$tun(0xffffffffffffff9c, &(0x7f00000001c0), 0xa2f01, 0x0)
ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f00000000c0)={'syzkaller1\x00', 0x6bf1c2d5adba8c32})
r1 = socket$inet6(0xa, 0x2, 0x0)
bind$inet6(r1, &(0x7f0000000100)={0xa, 0x4e20, 0x0, @empty}, 0x1c)
setsockopt$inet6_udp_int(r1, 0x11, 0x68, &(0x7f0000000080)=0xa40, 0x4)
r2 = socket$kcm(0x2, 0xa, 0x2)
ioctl$SIOCSIFHWADDR(r2, 0x8914, &(0x7f0000000180)={'syzkaller1\x00', @link_local})
write$tun(r0, &(0x7f0000000300)=ANY=[@ANYBLOB="0a000806000000000400aaaaaaaaaa2986dd6de7136600e91101addb0000000000000000000000000000ff0200000000000000000000000000014f194e20002b90"], 0x65) (async)
mount$overlay(0x0, &(0x7f0000000140)='./file0\x00', &(0x7f0000000180), 0x0, &(0x7f00000000c0)={[{@lowerdir={'lowerdir', 0x3d, './file0'}, 0x3a}], [], 0x2f}) (async)
mount$overlay(0x0, &(0x7f0000000140)='./file0\x00', &(0x7f0000000380), 0x0, &(0x7f00000003c0)={[{@lowerdir={'lowerdir', 0x3d, './file0'}, 0x3a}], [], 0x2f}) (async)
r3 = openat(0xffffffffffffff9c, &(0x7f0000000080)='./file0\x00', 0x0, 0xd5)
write$tcp_mem(r3, &(0x7f0000000200)={0x4, 0x20, 0x1, 0x20, 0x7}, 0x48)
r4 = syz_open_dev$dvb_frontend(&(0x7f0000000080), 0x0, 0x2)
ioctl$FE_GET_PROPERTY(r4, 0x80106f53, &(0x7f0000000040)={0x20, &(0x7f0000001240)=[{0x1f, '\x00', @data=0xc, 0x7}, {0x6, '\x00', @buffer={"f8c042d7a8781c094069bb0ebdee0ef4186c06dcf1c52699f69880b0d7000004", 0x20}, 0x6}]}) (async)
openat$cgroup_ro(r3, &(0x7f0000000040)='cpu.stat\x00', 0x0, 0x0)
executing program 4:
bpf$MAP_UPDATE_BATCH(0x1a, &(0x7f0000000400)={0x0, 0x0, 0x0, 0x0, 0x619}, 0x38)
r0 = accept4$vsock_stream(0xffffffffffffffff, &(0x7f0000000340)={0x28, 0x0, 0x2710, @my=0x0}, 0x10, 0x800)
ioctl$AUTOFS_DEV_IOCTL_TIMEOUT(0xffffffffffffffff, 0xc018937a, &(0x7f0000000380)={{0x1, 0x1, 0x18, r0, {0x7}}, './file0\x00'}) (async)
mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./config\x00', 0x1ff) (async)
mount(0x0, &(0x7f0000000200)='./config\x00', &(0x7f0000000300)='configfs\x00', 0x0, 0x0)
r1 = openat(0xffffffffffffff9c, &(0x7f0000000b00)='./config/usb_gadget/g1/functions/hid.usb0/subclass\x00', 0x1, 0x1ff)
write$UHID_CREATE2(r1, &(0x7f00000018c0)=ANY=[@ANYBLOB="0b00000073797a300000000000000000000000400000000000000040000000000000000000000000000000000000000000be00000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000f3000000000000000073797a3100000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000073797a300000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000030002000000010000000b00000001000000"], 0x118) (async)
r2 = socket$nl_route(0x10, 0x3, 0x0)
sendmsg$nl_route_sched(r2, &(0x7f00000037c0)={0x0, 0x0, &(0x7f0000003780)={&(0x7f00000008c0)=@newtaction={0x88c, 0x30, 0x12f, 0x0, 0x0, {}, [{0x878, 0x1, [@m_police={0x874, 0x1, 0x0, 0x0, {{0xb}, {0x848, 0x2, 0x0, 0x1, [[@TCA_POLICE_TBF={0x3c, 0x1, {0x0, 0x0, 0x0, 0x0, 0xbacf, {0x1, 0x0, 0x0, 0x0, 0x4, 0x6}, {0x1, 0x0, 0x0, 0x0, 0x10, 0x6}}}, @TCA_POLICE_PEAKRATE={0x404, 0x3, [0xffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffd, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8000000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffc, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffd, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7]}, @TCA_POLICE_RATE={0x404, 0x2, [0x3, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x9, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4]}]]}, {0x4}, {0xc, 0xb}, {0xc, 0xa}}}]}]}, 0x88c}}, 0x0) (async, rerun: 64)
creat(&(0x7f00000063c0)='./file0\x00', 0x120) (async, rerun: 64)
r3 = socket$igmp(0x2, 0x3, 0x2)
setsockopt$MRT_INIT(r3, 0x0, 0xc8, &(0x7f0000003d40), 0x4) (async, rerun: 32)
r4 = socket$inet6(0xa, 0x3, 0x88) (rerun: 32)
setsockopt$inet6_IPV6_XFRM_POLICY(r4, 0x29, 0x23, 0x0, 0x0) (async)
setsockopt$MRT_ADD_VIF(r3, 0x0, 0xca, &(0x7f0000003d80)={0x0, 0x0, 0x0, 0x0, @vifc_lcl_addr=@local, @dev}, 0x10)
r5 = socket$inet_icmp_raw(0x2, 0x3, 0x1)
r6 = socket$igmp(0x2, 0x3, 0x2)
setsockopt$inet_mreq(r5, 0x0, 0x23, &(0x7f0000000000)={@multicast1=0xe0000300, @local}, 0x8)
syz_emit_ethernet(0x3e, &(0x7f0000000240)={@local, @broadcast, @void, {@ipv4={0x800, @icmp={{0x5, 0x4, 0x0, 0x0, 0x30, 0x0, 0x0, 0x80, 0x2, 0x0, @empty, @multicast1=0xe0000300}, @dest_unreach={0x3, 0x7, 0x0, 0x0, 0x3, 0xc58, {0x5, 0x4, 0x0, 0x7, 0x0, 0x65, 0xe, 0x4e, 0x24, 0xc, @empty, @dev={0xac, 0x14, 0x14, 0x44}}}}}}}, 0x0) (async)
setsockopt$MRT_ADD_MFC_PROXY(r6, 0x0, 0xd2, &(0x7f0000000200)={@remote, @multicast2=0xe0000300, 0x0, "028a3f6c58b274e6d8451697efe42811ee1df06e9264f7d866b1970548fc3c7b", 0x800b2, 0xfffffff7, 0x4, 0x40000006}, 0x3c) (async)
r7 = syz_open_procfs(0x0, &(0x7f0000002380)='net/ip_mr_cache\x00')
pread64(r7, &(0x7f0000000100)=""/253, 0xfd, 0x1) (async)
rmdir(&(0x7f0000007880)='./file0\x00')
r8 = socket$nl_route(0x10, 0x3, 0x0) (async)
sendmsg$nl_route(0xffffffffffffffff, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000400)=ANY=[@ANYBLOB="4400000010004b0401800000000000007a000000", @ANYRES32=0x0, @ANYBLOB="4800000000000000240012"], 0x44}}, 0x4)
sendmsg$NFT_BATCH(0xffffffffffffffff, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000000)={&(0x7f00000003c0)=ANY=[@ANYBLOB="140000001000040000000000000000000000000a14000000000a050000000000000000000a00fffe38000000090a010300000000000000000700000008000f40000000020900010073797a310000000008000a400000000008000f400000000114"], 0x74}, 0x1, 0x0, 0x0, 0x88000}, 0x20000000) (async, rerun: 32)
r9 = socket$nl_netfilter(0x10, 0x3, 0xc) (rerun: 32)
sendmsg$NFT_MSG_GETSETELEM(r9, &(0x7f0000005e80)={&(0x7f0000000300)={0x10, 0x0, 0x0, 0x2000000}, 0xc, &(0x7f0000005e40)={&(0x7f0000003800)={0x2604, 0xd, 0xa, 0x101, 0x0, 0x0, {0xe0ee282bd21ed176, 0x0, 0x4}, [@NFTA_SET_ELEM_LIST_ELEMENTS={0x5f4, 0x3, 0x0, 0x1, [{0x5f0, 0x0, 0x0, 0x1, [@NFTA_SET_ELEM_FLAGS={0x8, 0x3, 0x1, 0x0, 0x2}, @NFTA_SET_ELEM_OBJREF={0x9, 0x9, 'syz1\x00'}, @NFTA_SET_ELEM_KEY={0x210, 0x1, 0x0, 0x1, [@NFTA_DATA_VERDICT={0x34, 0x2, 0x0, 0x1, [@NFTA_VERDICT_CODE={0x8, 0x1, 0x0, 0x1, 0xfffffffffffffffc}, @NFTA_VERDICT_CODE={0x8, 0x1, 0x0, 0x1, 0xfffffffffffffffc}, @NFTA_VERDICT_CODE={0x8, 0x1, 0x0, 0x1, 0xfffffffffffffffc}, @NFTA_VERDICT_CHAIN_ID={0x8, 0x3, 0x1, 0x0, 0x2}, @NFTA_VERDICT_CODE={0x8, 0x1, 0x0, 0x1, 0xfffffffffffffffc}, @NFTA_VERDICT_CHAIN_ID={0x8, 0x3, 0x1, 0x0, 0x4}]}, @NFTA_DATA_VALUE={0xb2, 0x1, "0b757755151d8377fe5c971dac87406743e23571cb981774ac8c7f8b5b8503a7467e24913e6aed7723794af29b1caddb5cbb45f6e0a680d0efa1c6bcaf34893504b67cf8eebf588926302e6d37a0370f9690e156391d0ca592430fe85a1c605e8945b966fcc2085b5e5e87d19629f0bce3ac48edd8fc89dfae8cec5dbe5c0fa959e3219aa454f90d7d376debc425eaddc054876d8fc2b0b0dfdbed8c04d9f6997af963df30c58036f90a0f2ec2c7"}, @NFTA_DATA_VALUE={0xe1, 0x1, "c5c1132e229fdd2cf71fe9c3c93bdf5417cb02e3447aa45ae51c20cee634db57966c07f3a7909dbbba2800123b2c565d469eeae34c39101badbfc93ab7fb48231b6c2e70e6b7230ac5244906a77ee7efda068c839cc5e819d3ef05a9085260bac012ac2fbb9a341723bfebc4e7719dd5c29ba53c57c5aa64c949d6b5beefce9bf3e1b641026909478f39aba0cf9982e5b2779d81b49b7dfe92e19853bd4e5e5c28cd1b8391a2eaec29194a830c70f28641394fc28f5dc0dad7764f9393cd9ca5d33c14f5615d52b338587186f433ccb6b6f8a108bc729e8aac10957f1a"}, @NFTA_DATA_VALUE={0x3d, 0x1, "316353876b23ab09fe0450b7e760d7d16319ae713ceb62537dc2ecae7625e5cb37438b1cb091e0733b26badd3c4c4ce77f16c5997252915b89"}]}, @NFTA_SET_ELEM_EXPR={0x10, 0x7, 0x0, 0x1, @notrack={{0xc}, @void}}, @NFTA_SET_ELEM_KEY_END={0x120, 0xa, 0x0, 0x1, [@NFTA_DATA_VALUE={0x86, 0x1, "14f67bab38b4316d3ef76f35f5673cf4ad29321e6aff9b45c18652526fce067771ce9ef00eaee655232b0be6a49808f3cd65bb71a52ef62fa2aedaf7b3df073bb1653e2988377fb9c53138d9b274fc5e7576491fe23c30c4f2500d1aa9e73abfdc1f0f4202d6457e14969db59655b970bbc83d95c10f8fa3c835a4747aac4519e029"}, @NFTA_DATA_VALUE={0x91, 0x1, "6641e1bd1f58adfc4f0fe91c5fda1e9512b85fdb0fc0b3376fab50eed0e534ce423929ad5d37c890aa822f4ebe3546993597bfe5a293765f6292c1bf0b5aba9f8ee5a7f0046c7d64a62996cc594cc0ddc37c52ab382e412995cb5db3d9819d56e86ea7b639d52c960c022357cf623ab46cb14b3490dd840ed9796efe7b7751e224fb8fbbce2096375e01838084"}]}, @NFTA_SET_ELEM_OBJREF={0x9, 0x9, 'syz0\x00'}, @NFTA_SET_ELEM_KEY_END={0x58, 0xa, 0x0, 0x1, [@NFTA_DATA_VERDICT={0x54, 0x2, 0x0, 0x1, [@NFTA_VERDICT_CHAIN={0x9, 0x2, 'syz0\x00'}, @NFTA_VERDICT_CODE={0x8}, @NFTA_VERDICT_CODE={0x8, 0x1, 0x0, 0x1, 0xfffffffffffffffd}, @NFTA_VERDICT_CHAIN={0x9, 0x2, 'syz2\x00'}, @NFTA_VERDICT_CHAIN_ID={0x8, 0x3, 0x1, 0x0, 0x3}, @NFTA_VERDICT_CODE={0x8}, @NFTA_VERDICT_CHAIN_ID={0x8, 0x3, 0x1, 0x0, 0x2}, @NFTA_VERDICT_CHAIN_ID={0x8, 0x3, 0x1, 0x0, 0x2}, @NFTA_VERDICT_CHAIN_ID={0x8, 0x3, 0x1, 0x0, 0x1}]}]}, @NFTA_SET_ELEM_DATA={0x1ac, 0x2, 0x0, 0x1, [@NFTA_DATA_VALUE={0xff, 0x1, "8578bb23d85636a4e21084c7b898f629ef648626db00b41440e4555f2e68ff0317a359c49504c1f974b2663690dd85e15352bdc502b6a079f3df277b860368c41fdc25fab97d2c2881c12f568903e894f3e8b3bd1707024c7eebd955dec710816be829532f0dc267046d43a9df54aa602225e74c23a287e77f950b4a089189b5245eafdadee809ab8ccf6864e1547b63948520ca0fe86261e492aa84755533dbe3f093a083b0e5cf3e6ee2d7ad10981518fc85c6ade1c11a6de9d65acc7fcbae7aaf65fb0313eeb0c14d276b810160213f6499434886cfa8c84c15b09672ff8f8a7558bb3de6a546fa59ae83f688b2565184e6b5910571caa4fcf6"}, @NFTA_DATA_VERDICT={0x4c, 0x2, 0x0, 0x1, [@NFTA_VERDICT_CHAIN={0x9, 0x2, 'syz2\x00'}, @NFTA_VERDICT_CHAIN_ID={0x8, 0x3, 0x1, 0x0, 0x4}, @NFTA_VERDICT_CHAIN={0x9, 0x2, 'syz0\x00'}, @NFTA_VERDICT_CODE={0x8, 0x1, 0x0, 0x1, 0xfffffffffffffffb}, @NFTA_VERDICT_CODE={0x8, 0x1, 0x0, 0x1, 0xfffffffffffffffd}, @NFTA_VERDICT_CHAIN={0x9, 0x2, 'syz0\x00'}, @NFTA_VERDICT_CHAIN={0x9, 0x2, 'syz0\x00'}]}, @NFTA_DATA_VALUE={0x59, 0x1, "220a7b0b1956ef96fb822d92fcfc3af785ded5afbbf5b66df99b990579b632de6b744569bd43d0bffa52388c086d94f8d7f730c2e3f25559e34508f23e8a41d74f7e1cab836448623ff20c0a3b31e69b84934ed7d5"}]}, @NFTA_SET_ELEM_USERDATA={0x88, 0x6, 0x1, 0x0, "776a886b38f94b05aefd16ec3b4836189629717a2320efed6523043adacce75d110529d97b9c97baa3b5708deac0502ac7ef42ad1ece476b73b0b4ed7364b38591921015110890af6220eeb3ab55d0411d5121003ea643c36693ba6e8f4b5895eff29be828c77e89fb2e5c2a89f54cfa84eb8fc2c9c08b8c508cc277d12ba067f4b76518"}]}]}, @NFTA_SET_ELEM_LIST_ELEMENTS={0x1ffc, 0x3, 0x0, 0x1, [{0x168, 0x0, 0x0, 0x1, [@NFTA_SET_ELEM_USERDATA={0x56, 0x6, 0x1, 0x0, "7a93a54e3d585ad84c42835d163d2cdc86ec9052668f000f28b75667719eba900d02f802677dbabda1bb83d49118fcddff8322419359f6961e7d35d90b34a119277a410a8858f07b28f18f9470f88b0c71a6"}, @NFTA_SET_ELEM_USERDATA={0x3b, 0x6, 0x1, 0x0, "96974fd6db1177905ee99bd83fc4d35f5df8f7e851240c42b7fdcb0243800feb90887c4ef597b0ecf929a18eb2e6abdf23fcf42f9e2bbe"}, @NFTA_SET_ELEM_OBJREF={0x9, 0x9, 'syz0\x00'}, @NFTA_SET_ELEM_KEY={0xa4, 0x1, 0x0, 0x1, [@NFTA_DATA_VALUE={0x90, 0x1, "1ec791dee8e0419af75fd0af10a79d4e69772a2cb4da9173053a6912d1138d637a9bbba2e170f590b79b514830769a5005b382e4d150c739bcc796517fdff9189fd76b2697a956360cc67142867b13a866adaa30b296e559cf5770f181909c6b07a616d937d36db3f65d5342fcc3d81912e02de0c6a855e4af57ea62c19a3e9afde373d7df9b1348ee425661"}, @NFTA_DATA_VERDICT={0xc, 0x2, 0x0, 0x1, [@NFTA_VERDICT_CODE={0x8, 0x1, 0x0, 0x1, 0xffffffffffffffff}]}, @NFTA_DATA_VERDICT={0x4}]}, @NFTA_SET_ELEM_EXPR={0x10, 0x7, 0x0, 0x1, @match={{0xa}, @void}}, @NFTA_SET_ELEM_EXPR={0x10, 0x7, 0x0, 0x1, @tproxy={{0xb}, @void}}]}, {0x11a8, 0x0, 0x0, 0x1, [@NFTA_SET_ELEM_FLAGS={0x8}, @NFTA_SET_ELEM_DATA={0x1164, 0x2, 0x0, 0x1, [@NFTA_DATA_VALUE={0xb3, 0x1, "ed71e0571c90e74e80965a6c57cf5c97f07cc627d3c8386e6bc49ddc8688a1c367e8c33b006e30cae99ce0eb72b34db7f5cb26cfeea2eb645329113526c43104cd8a0b3b7314423042808c036a0be1f64221e2b84f007c301aaabed0edcc94678bf8ece5d4b5eee61ff3a7a3d69a7f490dc4c280d7a3d4beb6eb3ef7a16338ddf0fe42795208be524c0ba699b13193b14203ea13cc79771e0a950dbdcbd4a406222e7b1db71e6ae7358da1aa08a912"}, @NFTA_DATA_VERDICT={0x28, 0x2, 0x0, 0x1, [@NFTA_VERDICT_CHAIN_ID={0x8, 0x3, 0x1, 0x0, 0x3}, @NFTA_VERDICT_CHAIN={0x9, 0x2, 'syz0\x00'}, @NFTA_VERDICT_CHAIN_ID={0x8, 0x3, 0x1, 0x0, 0x1}, @NFTA_VERDICT_CODE={0x8, 0x1, 0x0, 0x1, 0xfffffffffffffffb}]}, @NFTA_DATA_VERDICT={0x18, 0x2, 0x0, 0x1, [@NFTA_VERDICT_CHAIN={0x9, 0x2, 'syz0\x00'}, @NFTA_VERDICT_CHAIN_ID={0x8, 0x3, 0x1, 0x0, 0x1}]}, @NFTA_DATA_VALUE={0x12, 0x1, "1a190a74c96a27d4fdf7155cbbeb"}, @NFTA_DATA_VALUE={0x1004, 0x1, "dae46bda8d289e6c8783d27d52208b2c70641f89e9b5fe51180e125330280978a42657ea7902c5ba34fb03be7ace9c89dc637bb03a53418d5b136343e127ed57324195db3ee8150c5a55bd5b81daa99b82cbd1fedd0981446063c704d8df9446eefb06fe47325d2bcebc7e5411b5808f9cd2cddf9075d1d95282f9977378acef8079e69d1a8be21fc39e655973690ec6d3573be8ffed446b7749c2d930ffac7a153f815309920fd077d09ce8326a9dca37c0988e6077ed29f3f2391fad8ee7ddbef7f024ebc4cbb0366f6716b46f2908a20ca4e4ac9fa309175b52c8c14f89a4336a8cdda5f0195726093e898858ae6f9f4c29913c1cf2c868da07ebe7342beba2aa31cf2ae2a76d471dac9e5ec3493f96b1c406eed617e1c3e83071884b989bb2a56e19fcdd56e91e6293c4665383118a725e5d595c9637b8ae4491b76a808c1d0c13356d3b36e04ef7de9961d7254cd57d7c57eaaa5f7027803f6c48f2bb00b813b3207f7463ee9b30bf5ef554a5bc19b73375690cd039b2575d41bbf978bc900b0298c92c55bc4c06d0b18c3f9f7cde23654bf0439c184687d06927fd744a39e89a6c2a807947d5832ab81c52e165c915bcb16db450e0be436504732b56829eedae7fad541f90008d71832d715067b562cbafdbd602c35199a84406b3b1a25aaacbf631b8463dbb49ee030ac53a9c71ade1aae73bfdd722fbae45acb6d4cb27bdb711c7cabe9cd112ed45cc10703e0a75cebcde1381c5557dd903288ffa2f4bd1072d9d307b30ad1097d79480d4d275f9650663fc936fa6174e806b2fdcf6034842c858c4712e42e0bc5faac1df4af644e1112c8297f1cb521607e5bdfaff3141570a808917e7f4fafe918cd31f2c65d89d9cd57dc57bfcad84f087ffcd49e371a1ac772ec60435b515d7105783551f0bbb3ceb0ab9b1d0b04ab1d97996d2bd73ffa333064ff66d03e35144d099f7150ae77775acc4daab9c870297b198d060d01303e3cae01f9c3c9877b9f4baf3556ccd3ef47f2d7113f924e5fbd961d1e09bffe53abdf6c661b7f31bae157985fa9693cae37524bd867d221f03b73f50dcf200eb3df60b74a7bfe4e1af49810c8cc04c1889b4f3b18f0b329bd4b3ee2f35fb9ab980aac3b734bc938d7251979c3cefb6b4cd413a938cffd859271e25083c02d60bf67d53ba78e4a1d6d91a9f7b432dd97ee44b8dda0949cba393d6ac81f428140bf3d4f0de0e78f174ca2ffd90b1f54846e1976adad0246b87dd246fd2d2d4f2997a2c66e3de9072ea440a1057bc42cffa090e657fb27a47cc4290e4a1613240287821eb08a9ae49ab89fec66c4f3acbe94e93777677ad6f2c4400d1510bc92a66ebd99a600a6afb7d573d6db28793467c0fb4049276f97e537032b04bfe5704966a4a3c7a78e3abb0249b553ff446e6f028d7d63d4e31211a19235fb26e9402be4a5dbdf941b1363f71e41c096698a36e9f8ed6c9b80cc3570c05cc1ffa3a3ffa6ca844f33f018e5f0c251aa39100aa7590836d1551dc009a4024f3f24707e6e86d147ef5dc7a02e31e62ba96b51eacbe46f45476b627294d8dade5c739fb3ea049a3e75fedf68f97b40414b7f6c3e4f21f7599455ce87b1904c45f4862b923e6775dc817eb67fc0007b1f6e4cb37da55960e9b0dfb2d11de1a2001149ffe0a28bf7b3da75f6fd9f18e21dadae643436dab0f12b65bbfb62f6983fef7ada7454b73657a6b70753ffc00632c362aa86500e4b054970e8e5b827c248750232940bdabd6b839478bd18eabf487d056b994efa124fb0c2ac295852aba6d13b3f3e91af778cd4341328265ebb21a75bd550c786a0f376896c8b4cef009b57cda7a9c87387fad720650837d4cc7f9228cc77934799a1a57ed63e68a386df6fb3f91e6e533874acecc44f8aeb0baaaed89dbd2c95d91d20572fe9a069a5eb29788b609eab45269fb369a08d9970fb972878613c7553c54766a1f91644ba23349b2917d659ce22dce01f075ee6b9c619b38186df127b1f05417c3c0241f2cb933e6a143d0d2eac914f19c04eaf8b99c4442787def734d5646f12a136dc73aa2cf03fa4f37419cee212f4c34805e6714afecf6ed26e3dd404b8fdcfc1c216f35fe0a1c42e02d4b94332881789f8d8d7b4493f22349cc10556bb38e58131e8f96e90397e20c118d2ca4bb746e1e83f127bd4e7edd37ad6eee45f1b15ec766bc04263ee8bcf751057041d392460b0b5ebc3d1020f6ac3b3d11236c84a4f4affd12f77a905ee47eb514923b98140b268eadeb4125820ebc09c59800ee5e12d20f6c18828b991d271b8b13b6a83e0beab66819302c24a9788b1c2108faf215de642eb3acc7807f709a2f9377f97e9e896546c54a5d060ee80af87eab028ab6135f8ea9a21e00db05a5a6cccf1aa6df86dac26f52935f89c426607f3c1be99198de81d63f8119c6925aac433d81c2c871dbf29992e7ed6eacdbe14b09ab663845bdaf766910dc6483abf52bb28bdd04ce18540036e471d8eec9588f61395f92bf8ea11b429d1ae3c409b7b4db8d80e634f96a7c2d47048d1c2344876471a3d7a182e8d56493c9509d28d95fbb30ae5e2a92f22ecfa4e9a0a8a69c7ed02e14c33093aedf6650dea283f47759af3d1250e937cd68b10e8000087ac23f54d01d3fc693a260de2b4079868a4d06ca835349c4ed85296e8e04032c5e8321dc6a762e15a0334293ccb35d2925fd22728c783fdcd886ba7b26fbf9198af21cf75e84b70c8061855630423a9532d9c4c2a3b13b70bd4c188475e85e6cd8aa18cb6920413d39714b255b7d14dc2d22971a45f481a05150095c52496f03e7d11762cee50d6aa525a42a104c8a51d9a9e33b7f99d1d5a759e88fd601031674000cee73affc30874b3aa27ab444c2b7dd4a2b6523574c5cd2e494c08c8d301a4fa9dfeefa4820d7c86d777c7e46290b4573d499f2023eb532d5cb52b9ac2edd73693bb84dcfcd6091fc4b128416ec3ddac4ff48cda150acd742d28a99aab2d85f2be8075131e07f21d000931b928d351f7db3c2eea130ed51f0debc63ede775cf3eb7294ab906c913c4122a8655099da056b42376828cd1dd43628a79ef9a3b486aa71680283cefcf004bd90a79af2d1d2db50c69aa46ba6ba3abd83fff435acbd9b221b5834bddd6cfa41d920f79f7eb61c109750bf7a552a1774905f59ff84f2b920d5ad3e5cf05fdd0dcd2b909327b4811e16d6e73b16b6f02311e3594495854e6c635ad306450fc078fb207a9bc40cf27955336d6f3f79ece0203796b23371a6515f7bb36cd321265ae871fe8dd5e8c2aa1b66c2313705b5564ea2b210b564f1e3ad238bfee2b9be6a7b73d58230926f518bc1be72161c8e0bceb73df44cd3bfe5fdb8d30f2c719dfed6d5eb36a8d3ab869ed862a4afc4e18042138b6d1bc83ef579a902419c2b583a80c0016c1d48b6f6587754cf8f8e368fbcb2ffca51b7085c8e6a6153bb14393402cfce31294f8a8b9676a5f0a58800fccd912f4716d71fdd34c2f3ee81a49ceeb52c5899161965d066b7a70d007445da821bf6efd19c8cc37388aab2be8e56e2aa72e1a9d1ac1b70a4c37ab6b8a8123ccd6eb44fb4f73a695987aeed436c19f456bb3686d0e1bf89701a66b7d7cd471efee1edf54d50c3847d69070473e1cf94c16dfa78ebb525f5a96980d86d78e65ae1d8a07b9f5c05b0faf211249b79a6ba2ef3b05caef92ceb80ca7df19d7ba72e7abcdb15830f899a515eda3335c03429501ae2bbd8ef9a022b627ea02d65bda6c7b9e7902136d29b3b10e5df3b873ca964a4a43fb44911de159d94556ef8d083d553add892b1043bc3554d5def443f5ed12b76cd66a1bb9536a3653ec7d83cd2debded5433d7dfffaeb47ea81db58142a5e674813ef2034ec757d1c8fd8f90532d93a3b58cf19bfa7c071448494196fe3fe2a5c0f54cdeb42b9c45c896e4b70e81941696307c1d8383388267b6cd65b2d468519612805800f40df345a78e29ade44af0e3347c13dad1b4c83414c20f203ff6816cbb59616ae52ce36c2e9b566ff41b6d8f7b94e5fba2e7c671383a76b376826bd820206a1c87e22d27db8bacc89d783845d1ed55804653d0b2f15de4a24ef548af228578decdbebe09ad12a05460f6dd263d7f40e98deedf51c153b09618c637bd78e3e0fe01fd421cd4f0dd8b5c16c569a4a63ccef1919c871f1d534c07aad5ee6af2029ffd81d7636a6d500e161f2fc3a12687a94e09a281a065d703b8c9e49637df5e6ec801592e6d0f35c356314380497de77cf7c9996de455ba11232effb10e33e7e461d0d6a3c67fd153a12fad0777fd996d1e9ce000dcc028c9ce4fc54fe5cb07b3fa293927ffc7ba235403af786d326d9cc3e7ec74ea347cdeca4cd406fcaa4c8a8288c1d8a85aac814c26e652f9481ce4e38fef91fa858df0d2d5c53f2b87059abf1d9e8f294a7734123ac210cf5a99c3a426df7093f57ff373d3ff19378166d5aabd0ba870486ce3942cfa85fff609f647d4b331eb7cb761b26b7fb8eb5374ea530eb73ccab7aea27eb931c7098ea4ebe02321dd968bab0c8f1c636452c191bd896f832a02c63bce08e2c068fde49c53eec7b50d23ae96b018f8caf8a33b38b31bbca9dff76e0c9ebda06a05dd0a7a997fbdd094b5a9b89a780a7107d96b4c0d0a9c2ef866b4e98f74d1078272027fbb49bf2ec5e7f5dea27f27fd13b93392c00083cbb7d919a30777bba3f917b5baa67878c146dd710a6019c884de7a707134f4a5b0da048a979a627df261088894c881a6c10b1a4f48dc63f1e7dbafc7fc488129587686a1940f94f97c05bb491a98c34185554c8f0d4b9c73d0d4a1275b8dc1a76c76febd93643e74c733854b5c489a62e1107a7f68acda1589a5ef5150ff133b40e1dd31dcbb8d2feaeb4dc15f17d2197fff77416b2524da8151f773ab3cce1d5afd6933444874b7624551b851d8115a228477e7687ac34181f2ee76c36a12acd1522fd3f307b6f62f0877f424b691eb1e7b33a8041564f55dd2f9bdf88c96c1cab585833504b13d6415ae062a3dae97233e15ba00e13a5acf628474a27d3d111299334803f4b19efb9e3a30dcd0d9b3057c1db02d6bc15c41dbd8762482a7c1973e46034450916d48de5c51fd78fe9e13953fbeabcab9623f00a4f07d0699684a978aeb92fa0c10f96fc939251ad5713a3546bf7b525f6a3951c0b30d14b1fc79751cf6b2515f4bec4e071eb42f75ae1c56bb7b9c6da1128bc3ddd1c5eed15c3b997b1700b4d3b06882fdfc46347f02dd4b776b32bf81525f1662535c1e357098a949ee857d5fe6fb50bc81374f63ad8deee2d926c82c73d099c6b89dfc951d0292cce4cafca7bdc771e8f86d0b4ed5eebccee745b56326af0a5becee77b54927d922d24a72de96cc6761ae99e8afb8af5131308fb42114a1c6e74fc3a3ad31c125f4418809c40ab3bd5710d88144e22e4637ca082ced8c979ec962e3f89d8392fcea1a4eeb0c3b621ee6530f943088664cd7feadcc5b02652239986f08152d967a5a194e109bb0e4a10314abc6b5c82e329d699e1221f934b2a36c09359ea129134ee9b6e30e036351178b69758d833346f61756dc19d41a56ce8843b8c5368810e153060edba373845c729a5795a25755e8c3f374a6bb9c084aea34c76dd77953ed0b7ac7b90d581a5f8cec1f5fcac5e538473a21f130cb9c78081ef8f6c0248cac863d653cf3b765e52301286f863d8d122581a5122153a6d349e780368fb7cbeeab92c2d54e01fccbbb04b09135489f1a9e0"}, @NFTA_DATA_VALUE={0x42, 0x1, "b0cdb67f5faa608948589047b8359f37f3927d50dcfb6390d6cbc4b5b460d92342a8afb3e16445e2a3ac1bf131c850f82ee2985d3ac0ec6a4fe3fa3d06a1"}, @NFTA_DATA_VERDICT={0x10, 0x2, 0x0, 0x1, [@NFTA_VERDICT_CHAIN={0x9, 0x2, 'syz1\x00'}]}]}, @NFTA_SET_ELEM_EXPRESSIONS={0x38, 0xb, 0x0, 0x1, [{0x10, 0x1, 0x0, 0x1, @limit={{0xa}, @void}}, {0x24, 0x1, 0x0, 0x1, @numgen={{0xb}, @val={0x14, 0x2, 0x0, 0x1, [@NFTA_NG_MODULUS={0x8, 0x2, 0x1, 0x0, 0x81}, @NFTA_NG_DREG={0x8, 0x1, 0x1, 0x0, 0xb}]}}}]}]}, {0x10, 0x0, 0x0, 0x1, [@NFTA_SET_ELEM_OBJREF={0x9, 0x9, 'syz1\x00'}]}, {0x488, 0x0, 0x0, 0x1, [@NFTA_SET_ELEM_EXPRESSIONS={0x140, 0xb, 0x0, 0x1, [{0x1c, 0x1, 0x0, 0x1, @socket={{0xb}, @val={0xc, 0x2, 0x0, 0x1, [@NFTA_SOCKET_LEVEL={0x8, 0x3, 0xd8}]}}}, {0xc, 0x1, 0x0, 0x1, @dup={{0x8}, @void}}, {0x44, 0x1, 0x0, 0x1, @tproxy={{0xb}, @val={0x34, 0x2, 0x0, 0x1, [@NFTA_TPROXY_FAMILY={0x8, 0x1, 0x1, 0x0, 0x2}, @NFTA_TPROXY_REG_ADDR={0x8}, @NFTA_TPROXY_FAMILY={0x8, 0x1, 0x1, 0x0, 0x2}, @NFTA_TPROXY_FAMILY={0x8}, @NFTA_TPROXY_REG_ADDR={0x8, 0x2, 0x1, 0x0, 0x4}, @NFTA_TPROXY_REG_PORT={0x8, 0x3, 0x1, 0x0, 0x12}]}}}, {0xc, 0x1, 0x0, 0x1, @dup={{0x8}, @void}}, {0xc, 0x1, 0x0, 0x1, @cmp={{0x8}, @void}}, {0x10, 0x1, 0x0, 0x1, @lookup={{0xb}, @void}}, {0x34, 0x1, 0x0, 0x1, @tproxy={{0xb}, @val={0x24, 0x2, 0x0, 0x1, [@NFTA_TPROXY_FAMILY={0x8, 0x1, 0x1, 0x0, 0x2}, @NFTA_TPROXY_FAMILY={0x8, 0x1, 0x1, 0x0, 0x2}, @NFTA_TPROXY_REG_ADDR={0x8, 0x2, 0x1, 0x0, 0xa}, @NFTA_TPROXY_FAMILY={0x8, 0x1, 0x1, 0x0, 0xa}]}}}, {0x10, 0x1, 0x0, 0x1, @meta={{0x9}, @void}}, {0x10, 0x1, 0x0, 0x1, @tproxy={{0xb}, @void}}, {0x54, 0x1, 0x0, 0x1, @inner={{0xa}, @val={0x44, 0x2, 0x0, 0x1, [@NFTA_INNER_TYPE={0x8, 0x2, 0x1, 0x0, 0x2c}, @NFTA_INNER_FLAGS={0x8, 0x3, 0x1, 0x0, 0x9}, @NFTA_INNER_EXPR={0x10, 0x5, 0x0, 0x1, @payload={{0xc}, @void}}, @NFTA_INNER_TYPE={0x8, 0x2, 0x1, 0x0, 0x43}, @NFTA_INNER_TYPE={0x8, 0x2, 0x1, 0x0, 0x24}, @NFTA_INNER_FLAGS={0x8, 0x3, 0x1, 0x0, 0x2}, @NFTA_INNER_NUM={0x8}]}}}]}, @NFTA_SET_ELEM_USERDATA={0x63, 0x6, 0x1, 0x0, "efbee12d74bdf9defe8ca52cec15aa593bb51ab4ba9da4b7bcd854376a436d21f215f1035ea32c6a26d88344d5afef4ecbb3f2418330e37cf81fb4d0407d202a784dbf1086c97978110f192ff3be7d0dc3dfc67b84a91e914218d4eb3f13c3"}, @NFTA_SET_ELEM_USERDATA={0x24, 0x6, 0x1, 0x0, "7c20c9811e538ad441b430f3a10861f2f308aa93fa20253bd2595332f9d74a8a"}, @NFTA_SET_ELEM_EXPR={0x20, 0x7, 0x0, 0x1, @byteorder={{0xe}, @val={0xc, 0x2, 0x0, 0x1, [@NFTA_BYTEORDER_LEN={0x8, 0x4, 0x1, 0x0, 0x17}]}}}, @NFTA_SET_ELEM_TIMEOUT={0xc, 0x4, 0x1, 0x0, 0x7fff}, @NFTA_SET_ELEM_EXPRESSIONS={0x114, 0xb, 0x0, 0x1, [{0x20, 0x1, 0x0, 0x1, @cmp={{0x8}, @val={0x14, 0x2, 0x0, 0x1, [@NFTA_CMP_OP={0x8}, @NFTA_CMP_SREG={0x8, 0x1, 0x1, 0x0, 0x8}]}}}, {0xc, 0x1, 0x0, 0x1, @cmp={{0x8}, @void}}, {0xb4, 0x1, 0x0, 0x1, @dynset={{0xb}, @val={0xa4, 0x2, 0x0, 0x1, [@NFTA_DYNSET_SREG_KEY={0x8, 0x4, 0x1, 0x0, 0x11}, @NFTA_DYNSET_EXPRESSIONS={0x74, 0xa, 0x0, 0x1, [{0x10, 0x1, 0x0, 0x1, @socket={{0xb}, @void}}, {0x10, 0x1, 0x0, 0x1, @limit={{0xa}, @void}}, {0x50, 0x1, 0x0, 0x1, @ct={{0x7}, @val={0x44, 0x2, 0x0, 0x1, [@NFTA_CT_DIRECTION={0x5}, @NFTA_CT_DREG={0x8, 0x1, 0x1, 0x0, 0x16}, @NFTA_CT_SREG={0x8, 0x4, 0x1, 0x0, 0x17}, @NFTA_CT_SREG={0x8, 0x4, 0x1, 0x0, 0x9}, @NFTA_CT_KEY={0x8, 0x2, 0x1, 0x0, 0x4}, @NFTA_CT_DREG={0x8, 0x1, 0x1, 0x0, 0x2}, @NFTA_CT_SREG={0x8, 0x4, 0x1, 0x0, 0x9}, @NFTA_CT_DREG={0x8, 0x1, 0x1, 0x0, 0x3}]}}}]}, @NFTA_DYNSET_FLAGS={0x8, 0x9, 0x1, 0x0, 0x2}, @NFTA_DYNSET_TIMEOUT={0xc, 0x6, 0x1, 0x0, 0x4000000000000000}, @NFTA_DYNSET_EXPR={0x10, 0x7, 0x0, 0x1, {{0xb}, @void}}]}}}, {0xc, 0x1, 0x0, 0x1, @rt={{0x7}, @void}}, {0x14, 0x1, 0x0, 0x1, @last={{0x9}, @val={0x4}}}, {0x10, 0x1, 0x0, 0x1, @target={{0xb}, @void}}]}, @NFTA_SET_ELEM_KEY_END={0x174, 0xa, 0x0, 0x1, [@NFTA_DATA_VERDICT={0x14, 0x2, 0x0, 0x1, [@NFTA_VERDICT_CHAIN_ID={0x8, 0x3, 0x1, 0x0, 0x2}, @NFTA_VERDICT_CHAIN_ID={0x8, 0x3, 0x1, 0x0, 0x3}]}, @NFTA_DATA_VERDICT={0x14, 0x2, 0x0, 0x1, [@NFTA_VERDICT_CODE={0x8, 0x1, 0x0, 0x1, 0xfffffffffffffffc}, @NFTA_VERDICT_CHAIN_ID={0x8, 0x3, 0x1, 0x0, 0x2}]}, @NFTA_DATA_VALUE={0x4f, 0x1, "0a4da2c47fba70b45668ef0d48d4237a26bedcc3ba666c5a167bfca9c18220499575854b3ad0b670405aa49382d1e58dfa395d46e35f67b2026e61b77b9c10b2db7c8b439d8dfd9711f411"}, @NFTA_DATA_VERDICT={0x14, 0x2, 0x0, 0x1, [@NFTA_VERDICT_CHAIN_ID={0x8, 0x3, 0x1, 0x0, 0x3}, @NFTA_VERDICT_CODE={0x8, 0x1, 0x0, 0x1, 0xfffffffffffffffe}]}, @NFTA_DATA_VALUE={0xe2, 0x1, "e85ed60d26db001b0aa960a12121a7fe7841b283f14c4bd6b1f8656556c1439906a075a5302a20ba2029aa42dc814cea82e544f9f69b193e18a4e5d1706d29fb38064cccba00d1476215b44c92f1425e48938da64a58b16a0e7ed0291bc4e2dd548ab4d2b318e503a3fe973e001d7afd70c5775e9da1c240e51e9ad1eecdd042c2ad7520837f36ae2b31a0166c191932dcc87c7ce0f4738337a51f151eb89a4ff3241ee45d29bde43e29b76aba434fd243539bf1d612957c139976b6b159467983b1d6a8f6a6c9b4a5d08c810fbd5bed9f979c37dd91872e3a28eca6861f"}]}, @NFTA_SET_ELEM_FLAGS={0x8, 0x3, 0x1, 0x0, 0x2}]}, {0x3b4, 0x0, 0x0, 0x1, [@NFTA_SET_ELEM_EXPRESSIONS={0x114, 0xb, 0x0, 0x1, [{0x1c, 0x1, 0x0, 0x1, @numgen={{0xb}, @val={0xc, 0x2, 0x0, 0x1, [@NFTA_NG_TYPE={0x8}]}}}, {0xc, 0x1, 0x0, 0x1, @fwd={{0x8}, @void}}, {0x44, 0x1, 0x0, 0x1, @masq={{0x9}, @val={0x34, 0x2, 0x0, 0x1, [@NFTA_MASQ_REG_PROTO_MAX={0x8, 0x3, 0x1, 0x0, 0x9}, @NFTA_MASQ_REG_PROTO_MAX={0x8}, @NFTA_MASQ_REG_PROTO_MIN={0x8, 0x2, 0x1, 0x0, 0x12}, @NFTA_MASQ_REG_PROTO_MIN={0x8, 0x2, 0x1, 0x0, 0x2}, @NFTA_MASQ_REG_PROTO_MAX={0x8, 0x3, 0x1, 0x0, 0x2}, @NFTA_MASQ_FLAGS={0x8}]}}}, {0x24, 0x1, 0x0, 0x1, @last={{0x9}, @val={0x14, 0x2, 0x0, 0x1, [@NFTA_LAST_SET={0x8, 0x1, 0x1, 0x0, 0x5}, @NFTA_LAST_SET={0x8, 0x1, 0x1, 0x0, 0x10000}]}}}, {0x24, 0x1, 0x0, 0x1, @objref={{0xb}, @val={0x14, 0x2, 0x0, 0x1, [@NFTA_OBJREF_IMM_TYPE={0x8, 0x1, 0x1, 0x0, 0x6}, @NFTA_OBJREF_SET_SREG={0x8, 0x3, 0x1, 0x0, 0x14}]}}}, {0x4c, 0x1, 0x0, 0x1, @meta={{0x9}, @val={0x3c, 0x2, 0x0, 0x1, [@NFTA_META_SREG={0x8, 0x3, 0x1, 0x0, 0x16}, @NFTA_META_DREG={0x8}, @NFTA_META_KEY={0x8, 0x2, 0x1, 0x0, 0x3}, @NFTA_META_KEY={0x8, 0x2, 0x1, 0x0, 0x3}, @NFTA_META_SREG={0x8, 0x3, 0x1, 0x0, 0x10}, @NFTA_META_KEY={0x8, 0x2, 0x1, 0x0, 0x16}, @NFTA_META_KEY={0x8, 0x2, 0x1, 0x0, 0x7}]}}}, {0x10, 0x1, 0x0, 0x1, @meta={{0x9}, @void}}]}, @NFTA_SET_ELEM_EXPRESSIONS={0x78, 0xb, 0x0, 0x1, [{0x28, 0x1, 0x0, 0x1, @fib={{0x8}, @val={0x1c, 0x2, 0x0, 0x1, [@NFTA_FIB_DREG={0x8, 0x1, 0x1, 0x0, 0x14}, @NFTA_FIB_DREG={0x8, 0x1, 0x1, 0x0, 0xe}, @NFTA_FIB_RESULT={0x8, 0x2, 0x1, 0x0, 0x3}]}}}, {0x4c, 0x1, 0x0, 0x1, @socket={{0xb}, @val={0x3c, 0x2, 0x0, 0x1, [@NFTA_SOCKET_DREG={0x8, 0x2, 0x1, 0x0, 0xd}, @NFTA_SOCKET_KEY={0x8}, @NFTA_SOCKET_LEVEL={0x8, 0x3, 0x5d}, @NFTA_SOCKET_LEVEL={0x8}, @NFTA_SOCKET_KEY={0x8, 0x1, 0x1, 0x0, 0x3}, @NFTA_SOCKET_KEY={0x8, 0x1, 0x1, 0x0, 0x3}, @NFTA_SOCKET_KEY={0x8, 0x1, 0x1, 0x0, 0x1}]}}}]}, @NFTA_SET_ELEM_FLAGS={0x8, 0x3, 0x1, 0x0, 0x1}, @NFTA_SET_ELEM_KEY_END={0x20c, 0xa, 0x0, 0x1, [@NFTA_DATA_VERDICT={0xc, 0x2, 0x0, 0x1, [@NFTA_VERDICT_CODE={0x8, 0x1, 0x0, 0x1, 0xfffffffffffffffc}]}, @NFTA_DATA_VERDICT={0x10, 0x2, 0x0, 0x1, [@NFTA_VERDICT_CHAIN={0x9, 0x2, 'syz1\x00'}]}, @NFTA_DATA_VERDICT={0x48, 0x2, 0x0, 0x1, [@NFTA_VERDICT_CODE={0x8, 0x1, 0x0, 0x1, 0xfffffffffffffffb}, @NFTA_VERDICT_CODE={0x8}, @NFTA_VERDICT_CHAIN={0x9, 0x2, 'syz2\x00'}, @NFTA_VERDICT_CHAIN_ID={0x8, 0x3, 0x1, 0x0, 0x2}, @NFTA_VERDICT_CHAIN_ID={0x8, 0x3, 0x1, 0x0, 0x3}, @NFTA_VERDICT_CODE={0x8, 0x1, 0x0, 0x1, 0xfffffffffffffffd}, @NFTA_VERDICT_CODE={0x8, 0x1, 0x0, 0x1, 0xffffffffffffffff}, @NFTA_VERDICT_CODE={0x8, 0x1, 0x0, 0x1, 0xfffffffffffffffc}]}, @NFTA_DATA_VERDICT={0x28, 0x2, 0x0, 0x1, [@NFTA_VERDICT_CODE={0x8}, @NFTA_VERDICT_CODE={0x8, 0x1, 0x0, 0x1, 0xfffffffffffffffd}, @NFTA_VERDICT_CHAIN_ID={0x8, 0x3, 0x1, 0x0, 0x2}, @NFTA_VERDICT_CHAIN={0x9, 0x2, 'syz1\x00'}]}, @NFTA_DATA_VERDICT={0xc, 0x2, 0x0, 0x1, [@NFTA_VERDICT_CODE={0x8, 0x1, 0x0, 0x1, 0xfffffffffffffffb}]}, @NFTA_DATA_VERDICT={0x10, 0x2, 0x0, 0x1, [@NFTA_VERDICT_CHAIN={0x9, 0x2, 'syz2\x00'}]}, @NFTA_DATA_VERDICT={0x40, 0x2, 0x0, 0x1, [@NFTA_VERDICT_CODE={0x8, 0x1, 0x0, 0x1, 0xffffffffffffffff}, @NFTA_VERDICT_CHAIN={0x9, 0x2, 'syz1\x00'}, @NFTA_VERDICT_CHAIN={0x9, 0x2, 'syz0\x00'}, @NFTA_VERDICT_CHAIN_ID={0x8, 0x3, 0x1, 0x0, 0x9}, @NFTA_VERDICT_CHAIN={0x9, 0x2, 'syz1\x00'}, @NFTA_VERDICT_CODE={0x8, 0x1, 0x0, 0x1, 0xffffffffffffffff}]}, @NFTA_DATA_VALUE={0x31, 0x1, "6b70b56686a0bfffe30e015448682e6c44baa0d57e075c532238767f2c752a1b054a3e78a098fecaa1dad15f97"}, @NFTA_DATA_VALUE={0x3c, 0x1, "fe252fa67ffa0e04aaeb17b14ee610b68b72cdb8371466a8c23465f3f822fd2fbeba197598f8cb8f87efe2cee03e48ecda204a1010ea2225"}, @NFTA_DATA_VALUE={0xad, 0x1, "421037841e23296441795384c0efb19fbf54fbd677f06b05c374dbc64d59b2f1f5c8890163a0fefbb29fc28e6c3079eb6ce7fcfca0aacf1a29e9a32ec667bdbc3df2bf0ebc20d7fd969b198f661bce2691bcc71e0bef6cf3b47cc5966b04c3fa2c52cadab68b1f76c15d42e293cd1986bd31d31d0a3b04bba12c39e7e639996a88d8476133a82692b106867007ec00df13da8a24bdfeb1986a7fb28621cfe02411bec1993f8b06e762"}]}, @NFTA_SET_ELEM_EXPR={0x10, 0x7, 0x0, 0x1, @objref={{0xb}, @void}}]}, {0x50, 0x0, 0x0, 0x1, [@NFTA_SET_ELEM_FLAGS={0x8, 0x3, 0x1, 0x0, 0x2}, @NFTA_SET_ELEM_KEY={0x44, 0x1, 0x0, 0x1, [@NFTA_DATA_VALUE={0x40, 0x1, "9568aa9ccefdffce36a8bcfccfa3fe1d8e8f63b63e5ae8a0358f719a2eb48ed724557e7abe984ba98f8cb3efa08ce60b781582b9a8228bb2fe645eac"}]}]}, {0x44c, 0x0, 0x0, 0x1, [@NFTA_SET_ELEM_FLAGS={0x8, 0x3, 0x1, 0x0, 0x2}, @NFTA_SET_ELEM_USERDATA={0x98, 0x6, 0x1, 0x0, "cc1886c18a44d6c61c1874f5c4b90ba7bac788f38136c2b99c2dd21fa1a3b648ec259a20555dbc0af1646e2c36437800cd430ee84338b438479cd68f7420090e29ddb2766cba4f67417656ad4b0d1a0f696cdec479665d820c6c225d13f725370d7d6db10b1eafc223e6fbc09821248995765294d1f160027495ad1c1e5b634d4718f9194f847c601014624905eb772e9ab760da"}, @NFTA_SET_ELEM_EXPR={0x34, 0x7, 0x0, 0x1, @quota={{0xa}, @val={0x24, 0x2, 0x0, 0x1, [@NFTA_QUOTA_FLAGS={0x8, 0x2, 0x1, 0x0, 0x1}, @NFTA_QUOTA_BYTES={0xc}, @NFTA_QUOTA_BYTES={0xc, 0x1, 0x1, 0x0, 0x3}]}}}, @NFTA_SET_ELEM_EXPR={0x220, 0x7, 0x0, 0x1, @bitwise={{0xc}, @val={0x210, 0x2, 0x0, 0x1, [@NFTA_BITWISE_MASK={0x20c, 0x4, 0x0, 0x1, [@NFTA_DATA_VERDICT={0x1c, 0x2, 0x0, 0x1, [@NFTA_VERDICT_CHAIN_ID={0x8, 0x3, 0x1, 0x0, 0x1}, @NFTA_VERDICT_CODE={0x8, 0x1, 0x0, 0x1, 0xffffffffffffffff}, @NFTA_VERDICT_CODE={0x8, 0x1, 0x0, 0x1, 0xffffffffffffffff}]}, @NFTA_DATA_VALUE={0x87, 0x1, "a39e6adce5e513d3f335dd4e50f5c7ea34e0ee4a8ee44be520f1df139d5f9af8c50a771ff7102d295e17ea339d4147ab3236916d47d7bf5736611af63b08dbd639dfaa589281e1cf73efab1e3e4d27f500de0bc2b69be79ad24213e3977b59579de354b64b07eb4670d634b149d6d12a9b026b256b3e2c4320f3ae10b49e284c9343c8"}, @NFTA_DATA_VALUE={0xf2, 0x1, "7414e7baf59a394dc024bb3bb900b524dd7b9d45e115327fd78058996a4b191eeb31245f14d451cb631d2b8c659c1f0a0163eb20241e812068e1248664eae21ad173120a475a52f47c4b068f2ae204412e557c6be474cf4b17b1d4dcd68db714e7d1fee5b2a782df04617724b6fa720d2b3696fcfa9c5e0c5447a6d3c0bc935ad3555ed8551a52123202201a40cdb40982a7787c04849e0e8a5f68092630f574ada4cfb32945a671da8c30c7199ce027c375964a2350507c39d31e8dec084ab595281e7970c5698a8a53c2b42e60b004ff0b3bf230600bb38cb2d69803c30dea5eef90afb0011be2e2b91ad3647c"}, @NFTA_DATA_VALUE={0x70, 0x1, "105ec5abd2c425c299104ce5c3aaf7fdd93849a2f000d2d8323c3e8932ec15b5fd04827d86755c03d78f8f2944e689c723938b9f3a26e89a10c1f8642b06408ecbf299ca31c19f38f988fa3302279bf99e92d08d3f17a3476c5faa7b3cf6fda88199ef23e6dd4e7a24d7fe22"}]}]}}}, @NFTA_SET_ELEM_TIMEOUT={0xc, 0x4, 0x1, 0x0, 0xff}, @NFTA_SET_ELEM_FLAGS={0x8, 0x3, 0x1, 0x0, 0x2}, @NFTA_SET_ELEM_USERDATA={0xfc, 0x6, 0x1, 0x0, "b5ee9204432388b9577be94a2685df5628ec77189a99633f66617ad8255730d2b55ceb24119ed779b984347ed231fd2868af826d05c96df6886b486c9a3cee853e96db521034e3179eda3aadf46907f46639a7c80254e6e24e5b31ba1a94eba1d640bae4e8e4fec9718cef4aa8c7265901b02a018ddaf8f55e7f1db3bc90fb3d3f0bfd81f047aeffbae600d8b072294c499254ba02af2e34512b62dcf3046189482cf8eb7261d13c287e05207b316ef3f172ef855631cf99dd4f165ff58e9b36572dde653da8eee212db3921ea26135526e57159bf4e1f9023b1f242bbe6af47a218077ad9fbdc9d3ad884d8b65d659f292d7c2f0a57c2ee"}, @NFTA_SET_ELEM_KEY_END={0x44, 0xa, 0x0, 0x1, [@NFTA_DATA_VERDICT={0x20, 0x2, 0x0, 0x1, [@NFTA_VERDICT_CHAIN={0x9, 0x2, 'syz1\x00'}, @NFTA_VERDICT_CODE={0x8, 0x1, 0x0, 0x1, 0xfffffffffffffffe}, @NFTA_VERDICT_CHAIN_ID={0x8, 0x3, 0x1, 0x0, 0x2}]}, @NFTA_DATA_VALUE={0x1f, 0x1, "022b5cb817591ddcc8b9bcd145eea7706fe1a7923278dc2686a978"}]}]}]}]}, 0x2604}, 0x1, 0x0, 0x0, 0x801}, 0x20044085) (async)
sendmsg$nl_route(r8, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000140)={&(0x7f00000003c0)=ANY=[@ANYBLOB="880000001000010400"/20, @ANYRES32=0x0, @ANYBLOB="2b03000000000000600012800b00010067656e65766500005000028005000800000000000400380205000900010000000500"], 0x88}}, 0x0) (async, rerun: 64)
syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) (rerun: 64)
executing program 4:
r0 = socket$nl_netfilter(0x10, 0x3, 0xc)
sendmsg$NFT_BATCH(r0, &(0x7f0000000100)={0x0, 0x0, &(0x7f0000000200)={&(0x7f00000003c0)=ANY=[@ANYBLOB="140000001000010000000000000000000000000a28000000000a0101000000005e1affd5020000000900010073797a300000000008000240000000032c000000030a01030000e6ff00000000020000000900010073797a30000000000900030073797a320000000014000000110001"], 0x7c}}, 0x0)
sendmsg$NFT_BATCH(r0, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000280)=ANY=[@ANYBLOB="140000001000010000070000000000000000000a40000000160a05000000000000000000020000000900010073797a300000000014000380080001400000000008000240000000030900020073797a300000000014000000110001"], 0x68}}, 0x20000800)
r1 = openat$sw_sync(0xffffffffffffff9c, &(0x7f0000000080), 0x0, 0x0)
r2 = openat$sw_sync(0xffffffffffffff9c, &(0x7f0000000380), 0x100, 0x0)
ioctl$SW_SYNC_IOC_CREATE_FENCE(r2, 0xc0285700, &(0x7f0000000040)={0x4, "abacd211119ca94c63377526aeb5ab2c7b9ca5fa07558139ede6dc06270ee042", <r3=>0xffffffffffffffff})
ioctl$SW_SYNC_IOC_CREATE_FENCE(r1, 0xc0285700, &(0x7f0000000100)={0x8, "b546baa5cc590d3033de259c2996817bb959ebab028deda501009bdeffafde25", <r4=>0xffffffffffffffff})
ioctl$SYNC_IOC_MERGE(r3, 0xc0303e03, &(0x7f00000001c0)={"0080bced01eb0100000000000000000700000000000000c900", r4, <r5=>0xffffffffffffffff})
ioctl$SW_SYNC_IOC_INC(r1, 0x40045701, &(0x7f0000000280)=0xfffffffc)
ioctl$SW_SYNC_IOC_INC(r2, 0x40045701, &(0x7f0000000240)=0xffff)
ioctl$SYNC_IOC_FILE_INFO(r5, 0x40103e05, &(0x7f00000003c0)={""/32, 0x0, 0x0, 0x0, 0x0, 0x0})
sendmsg$NFT_BATCH(r0, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000004c80)={{0x14}, [@NFT_MSG_NEWFLOWTABLE={0x48, 0x16, 0xa, 0x801, 0x0, 0x0, {0x2}, [@NFTA_FLOWTABLE_NAME={0x9, 0x2, 'syz0\x00'}, @NFTA_FLOWTABLE_TABLE={0x9, 0x1, 'syz0\x00'}, @NFTA_FLOWTABLE_HOOK={0x1c, 0x3, 0x0, 0x1, [@NFTA_FLOWTABLE_HOOK_DEVS={0x18, 0x3, 0x0, 0x1, [{0x14, 0x1, 'geneve0\x00'}]}]}]}, @NFT_MSG_NEWFLOWTABLE={0x1c, 0x16, 0xa, 0x5, 0x0, 0x0, {0xa, 0x0, 0x8}, [@NFTA_FLOWTABLE_FLAGS={0x8, 0x7, 0x1, 0x0, 0x1}]}, @NFT_MSG_NEWSETELEM={0x3f28, 0xc, 0xa, 0x101, 0x0, 0x0, {0x1, 0x0, 0x5}, [@NFTA_SET_ELEM_LIST_TABLE={0x9, 0x1, 'syz0\x00'}, @NFTA_SET_ELEM_LIST_SET={0x9, 0x2, 'syz2\x00'}, @NFTA_SET_ELEM_LIST_ELEMENTS={0x3ef4, 0x3, 0x0, 0x1, [{0x356c, 0x0, 0x0, 0x1, [@NFTA_SET_ELEM_EXPRESSIONS={0x22c4, 0xb, 0x0, 0x1, [{0x10, 0x1, 0x0, 0x1, @fib={{0x8}, @val={0x4}}}, {0xc, 0x1, 0x0, 0x1, @osf={{0x8}, @void}}, {0x14, 0x1, 0x0, 0x1, @byteorder={{0xe}, @void}}, {0x10, 0x1, 0x0, 0x1, @payload={{0xc}, @void}}, {0x213c, 0x1, 0x0, 0x1, @immediate={{0xe}, @val={0x2128, 0x2, 0x0, 0x1, [@NFTA_IMMEDIATE_DATA={0x2104, 0x2, 0x0, 0x1, [@NFTA_DATA_VALUE={0xc9, 0x1, "70f0f4802ca460d27debee00a8493ed54ce1ddfa554c08d1d9e5b9494605f2681caea4ecb5f5bb9d73cf85d2c4430ae1a3d88da74169c1b9274397d28cac8bf67bf954222069f9880c064b4745191f2c39c15de7d4454bfca6ef0db506756a1552321382aa66246ff0fb0d916d405a38c5b72d023b3434b8541d65eba4535a812c7814fe1242ff3866c279fc6c5a2607cc4b4786ab9267a3c7d83a1a378d9b4313c551a1fd312218eb807c4fcce2d94c887a247d9ad3c3a1975524d8d06c87a96ee45aa4ed"}, @NFTA_DATA_VALUE={0x1004, 0x1, "ca43a73027bff18958f05837b147ff04182787762ac38f8eefcc65a1c864455c3d811a413e32c35e6303f77738c77d2b6f96bcba392a8c1868d10aae545b93bd204c2e6f96c136b82a23a9952694b70389c83d4b9a9ef0ce8b9b51f9dc0e0ed6815f3bdc849a34e9518c3aa949ea1ef5857aae93f677e31a74ea9dbbe9c21c204695415238f38da6743492c61cfe365b4c6b121f4e0bb93880920ed4f35e7dfdec3fa12f84e95756a0d47a005428f7ad27ad7e4a8fbff968ec64a5d71abba93f940429a853e7c497f8d0744256cd55517cbc2a808870bbc853d9aaaea73e4e53a10e72e1a42b0fe9d767c643dda43bdb731f396ab2b702888b5969c5c6b4378f0523a7b0ee2344c41868e0496fd1dad21187666edc582820003b4c3ab5e488d7e75ff6c77c6bed91406e2bbb00d93c62a17f64e2e425b3f36f54363dd472eda8f8a7e9628ed94846f510c65d330153696613433f39505e07a468c18163770e20db9fe2b72061acc34b58ff71d68dba5d98b4b38669eb3592775013a4822319812984dacb3e0fe82d2e857a0425cee12758e34906c329e70dd21895654307ec370396a9e76c30e9b38ecc9be0add918c643f231094c338d430b968f177324adc9726bb860ed674ca1a955255efe5e527bcb40901f234d3ce7b762cafd4f5d189c9795db57b94acda29d9925a654974c035a17798733d63e91933d8c3533d9b2cd48b379723069e404c3c08e2119e4192233587e29dc673743d75a6719b0314bd73e6cad6e3a27a0aecb92a2ef018e1fa30e74fb3ada42bc8e8e729144a780558c2e8358b06b5f49308e4217d7d42997c579642e92d07233ec33ea89cc7f0f3c1eac0d446afe2ad9b7f8fc9f73c8637b274862160c7bb0f09b8fb0f9c8d61beaf8deb2f6f2b82d4a98956ec74c6bff4f8917e63f14f6cb2851ff3933ce5fb88b02738752e0c7f9e212317badbcf9fb0a75ff40e144865cfe744fe0c677eebcaf99257fcfb6a3801cdfd0463fd9029119324421feafd8d082c18b46110e211a7e99110d93c813b1f3b01b4a28e6fb85b86508aab5296272824d34ab6d1904d2943843fb47fe718a2ddf660e3ee05e2b87d97bc7fe09312ad2d0696897a8dcc323ae275c01d111a0fe30134c9dbee60583c79369ec36def5f0f48875404a2d50e1c0b281559f65ea2b94f654b56fe8e25cc8ab67ee0a676de7d58af707de8b0bb99de921151db515374c541434f99e5ae14da5137c20c3264bd9f244375457513a63863e2a93776841300abb6bfaa1137e8b774294da186b21b9edcbac9bbe59a747300048ceed3e111e61c59667d0b321f215b7c68c302601867af2fd1134081ce615e1f801a5322049cd4f519c05a819474ed90538a2d912942fe3eac2fc1b1343b71fed3dbec1feb146064a36dd0242d67c5a1357f2fbbec6c9b1af6ceee7bcbcfbb29121594c25101acf8b1bf21d98d82b74059331ffce3975f626b1040cf5fa453428eb717ecb7b268ec795062e3fefefb77c241e4e87b692dd49ed1cffa21b5d6ec0a580ac988d8dae1b95e279543cd82b098876a37cbfd2838ae9499aafa47c25da1e744c72aa95181921c2a52eedf5674af184ed580ea7bc2ee52be93220ba5281b74763d5166c953339e376f449d7817905d634f7d0a29cff137bf69fac0fcff30039619cb0fc05a280c5561e21ac5e931840202a4508eb9216760cd1ce005a21c5b60adef9831a66c674b03064482cee74b296cdaffac71728b8f0a0f7f944ccbd66ed71a803f72f55c14ca42a29f733e308e712fdea79d4aaee6905b65dce3adb51d40eef42766ea967f95dbbfdddf6177e58c174f0e0477ad7a1b6be57fa2ba8134ede9e7fb5cf28421e3f391b43e300bcf33f57c2379de8af84c850fc828090d512ffa300bbc44472d564abc51298231802facd39fac7206776b297371f2a7a13a382e2ce1064e914d0742b6c7a2e0b49461cdb132cc1f6e5e6535649f6385c92831d6c5a447a14eaafb0c68aa78860ad37575e8bade06189c437a6cb2c21deef01c8ee24570be7f5d7bf4a14fdda5a6e203627a804e32e8c7ff30842c17c482e786d7f5a3de53070585a76e27c7ae4ec01e3d03eba6fbd17af13b6a373c066ddf3c6d76b66c1b93b367b173a8e1ee42987a75f74af92eeaf6993d42b72c520221a0574c381e1a55d105b1b6d245a6b02535b89e24088a2b183df729df6df9c499ea18ec3427c4d22f0e904975c33cd8226e30d826977cc445662f7590981a2c2bba4865d0d6d7aebf15b44ab10da738b94d9c855b027b32c2e91605d5734f2703e13149dc515b93d004edd0c3cb25c79e2dcf7d8f4c169f509cbb95f94669f8a14c1436adac2c72524d5420dc61b56aa1a39b04aa33296138dca0e354a4d090c45c5e50ca743c2dbdd0010d2d4b598816cc19b71af405482a57c3b70ee1b4fa6e0cbcc40c125a6d4ba6ce86f8db300358786143c88221019a37815c96433c148c118506671f352340bf9ea381d78969ad4c369736a793cb0dae28ae72d8f5846c538a36417305844ce8a3f33be8b06414d5f0e60559757b22fdf5b758ee91175e04ddea34806fc53e1e8289f8b6a9132174e9c55db6a353dc3e8e349631a99baf3cee604b1bf3918e9818bee8cec8989d4b88fff32b75ce4f0a7b913e6eb2b479a841b3ec4598fac89ea8f3d546eb34a31b203f4e43fed5bf4bea6d837e5c5aa58805bada81d04873543e7fd42952393ca6c847a07c2714ced75d2c58e56f169aabe3a6b0fe8a46c78389021cd6e650b0612fee0d3c7ab398d75382ffc4fc93c044e8facd5985525f6d0e8b59efa6495c3bcdef801b80a8c2811b5dfa7e9458353f3e059b79c0dbfca6902bc51c4e0f9a01fa3fd46d37d176cb2c4175afb679863c2e8c07f526e146f25f788c187fd787cece0a74746bcd737d6cc01af07b97eaecdb94b458508af0da5c1d7ef73d51359b08b9913061dac67988c9b5ff14785f9eeb9021795a56bb9db22726848432161524396979f6ea3abbdacfdb3ad0ea38f487c10e1d8156c3f0b15dd6e51ed7ea323665bc6670a128bfc87861cf1b851ecc07646713262dd45f956030b0567ec8d6502c52474625be92c9cf07ee557de3750ca91e882ae63a73121e2a001e285427214ea93c214d3fdd996e755bfdfa31e1ab0c3f68d05ab876b8275e159c9ab18fc27846e3e8e5ff1b02f7c1c3d8479570626b8bac9dd2f616b1e7cfafe9460bd033e848b4eb09a8ad89e4d095ad026be852c4a4109ae5b187c8498cdf27dd359fe349801d4d41490ab95e6a3112edd44482da2cded1a7743204559b4b03d4004c309426d569fab28226e250bb1bb972ba917fd8d653b29a551d1a913f68c1c496262247b5345804e44c24f01c08e085905b75ac6efe33c2debf16b89b9ef5b039da8d1a8388a444b9b80a3c780c7cecb81c7af62c3baecfab39b13f0ae23cfa0881552b0a76f25c62842b91da4c05bba746ab4845e8c4bdc751a29dc086e2b97c74ffc4944669e0b604507cdcb487c095db1d843226e9dbe8d17ea56090a1156220f9402e3e8f9692e43b95ba703212c74a9cfa172c6c3a3d8ae71123fd14ee6db812e7b2c15caa53431acd2ec673e1ff86f4d6c30ba29d31af96cbc6e66d639bc65ff12ec423bd151ab81e8962e8122e8ab093157f9cbe4786133e008a6f29a22412e5ad87a4288f9ffec43fa339034e51cc0df7a1669152bdec0e9ecaa5bb6cfa75dd00b7da7dc69692ba47b8eefdf3123e276ea68b5a545cc84d7fe390af53aacfea082c71b12faeca07242379d28bde8ee57b0e898ea0d7270169c93207e571bdab680702184874ffb0538331dbe5a8b2ce756122801e99aaa0161c622aefe0a0153f30138088873ced7ebacfd7413d730d45eb1a6aa203eb359bb4aeb9f70b9773f4e34f99a451334db0e5bf6d1cd6881c664c12df3bf314ebfc39391862e3ace4303ceafef40c82d56691d089eb06d6ab12990bcfcc716d1adb571a9b033e3020f8103b80369014f2c9b1285f1e9805b8d1797caa753c68ddab141477d4a6d1947bfb6ea7c13f57d716582fef9c1dbfcf73708dcaea776faead85af1947269a80e9015a142b378e71bba1269e0e21ae8677e6695246102361e224fe7ee13ca24b64bfef8603b2c709506db7d5322dd7aecbbf90b3b5754a051b0833c6132ff5545f65c11ba59327e21d233bfca9654a840f1aa1573563062f191557c7f217f07802dd7606cc4399b6b906a20286558d0f1372f2f23f9f4fc87c647b09b1ce47f695fa3fc412ac405332089166d67201c3bfa3a2fad355904e2ffdefb7ee71f1928368a875635794ff3801f4e06f1e3bf2cd04eaa250a69a535c595b4cfeeacb6ae18c89c1d41cfe39df6327b07610b27247d1fc1451a54585836ad68a7017e823e751101f8ea0d2134ded26dbc271a0e8c0d8359c32a8508bc42b468da7bf057280d02ad10df5348e6521779e904bfd6d8c9b9e8bb3c20355682914b2646e22cd4a9ba37e6d0e2eacc4da372d0991dfb7cb016e371c16e0c783cf9769f9551375267fe81053b44989a8441b7217df2dfd05b60713c98191c6acb2dea8f71f424b4bd99867fdc81d5de808134aea203f5f1e8e27ca639481199a49a5f5ad464f953b95342290f9a673fbf64706d830b3c3052f88e0ab49bdba2c741086d8941d69cac1bbfb6fc315e3d151c9c560a14076f3b5e8b70f0e07bb0b9a3cd4c10f237b22d08573398d84190e2c309c8a71f811460bf72bc5cf5289fe7e2d2ecc1d94b755977b907594e3066b32c7e350f8244e700a304c12939cce5c870599cf6f55e125abd72998b58dc72da4b531847e5a280b9cafe7526b001fe58fbc7accd06cf57db81bc52bd8b4cd168078235a6a16f446c73618bad5dbd9b0e9521bc3db365bb329b93f7673fe072fb3bf2377b91496f5a43ac287b362f70f576d52a8b25016fe5fca325b48035d77d350ecdaa595ba21a52bee88213a0f72e676f4878c7b941f0e143b7d2a9de177521ee82374f51b44cc58f997eb0eb17c2fcc5a26dd950328c63b2e73c33bcadd6870b9ec23281c846c18f16e75f23f092919cbed5119435469bcb4faa8c4b0b1ad9cb33a5e1e46fe15c2b5127956007d8925e26ad2789e1b85d009d8162294928fe50390cdd1545b08824ef615e302f45afab655529ab7b7287f93a3b792c4d0417764a7fb6222e6104e37c03308ea2078f1b42c5fd94ba4955e74044094df830d30329b8f42b4d779dc7d7a615e4827ed1af83b329e0e5566d6b4c98cf929c6e7b5148d74c3f733e8c5ebe7d6ffb232763156d27d2b9567208538b7cc41d81876e60daea61feca28ceb8df45ead7b768c95b54b0d62e045d52398eca6ce0ed9aa038096674436958d4520526df221b11ecc183d46fa1b8b3cecacbde164a70587a1d43954ca9ab93fd9f4b00599d88dbc0177c92e6e63e62cd416c97bc3da371c73f3fc1cb037d17c3420598bb26efa67a34a0989e349ec223863bec8fd4206c4800e131e957dbd94667b5385c04f08a306cd97ae379c261703f2120bf9b464ce106b5795d98e6dafdf8ea1bb629e6f0d264873db6685036b9377b5545c170661157c3624712f47abb1144366da935da02bfc403036984c530a52025d67c98aefc07bf06f811e0895a2f958565b45b0cc818483d355f9931b026e91659e1d56e7a7c5d52c9537320717d793c7ec2757d4f1b2de1b9b9d94be520766b91bb3fbfebfe01f6201b9a77bedde6ec8808ee83bb5d76bccb2f7604ebcbb94407"}, @NFTA_DATA_VERDICT={0xc, 0x2, 0x0, 0x1, [@NFTA_VERDICT_CHAIN_ID={0x8, 0x3, 0x1, 0x0, 0x4}]}, @NFTA_DATA_VERDICT={0xc, 0x2, 0x0, 0x1, [@NFTA_VERDICT_CODE={0x8, 0x1, 0x0, 0x1, 0xfffffffffffffffd}]}, @NFTA_DATA_VERDICT={0x14, 0x2, 0x0, 0x1, [@NFTA_VERDICT_CODE={0x8, 0x1, 0x0, 0x1, 0xffffffffffffffff}, @NFTA_VERDICT_CODE={0x8, 0x1, 0x0, 0x1, 0xffffffffffffffff}]}, @NFTA_DATA_VALUE={0x1004, 0x1, "5a7b15ae77d39c1195fd6befea53816351bd04ebd8a6971c32eb6ebb811ce43f8c2da4e8f40ada7895cf2e0bfcacc083f086268044af2ed8e9a0dbc60e92df82a64da27766c244c0bb060969222649ad620a5f11b54c9a03c43704eaeb29cb517b5893a65fb6d1342b3bcca119491a0de91f067e5606c1475a625de8b273836883956a0eb2b2b872821398fe5f63c19d142d2a1aa4fce9648abd425be7849cc808b1c2838976f3498079d4210c07307713bcc78b4f1339116e6fb12ad7057108e30b76b57e24776ad40334c3fb3e6d0363a94829402a79816c714b0fce7351044fea740b1e8f0dae47088e0b6761e45d6116683ea3ed99e4183e3f9805f2e653cbaf80305f264e0c43ea762c4ae564c8b160a2f4d092e488d318d1db90a306502d1c9b1a3548ff113a7580bb652dafe1dfd72efd867ce59b8f126214f13a0f8ec55c1ee3bee721f5172861a7ca8baaa3c5abe65d9d5669bef45b9fa89dc0e86d339df6eee5d5b9e203a669ed42c70212b83090f0aa4f4102a004b5af1bdbaa8b4d0b40c61a9d53a34d0fdcba80994d81616eb0213899a28ad60a514f67b09a7ad590836fdc1462fabc4d1f896ddbfe58da4ce82f2cbf51f509457dd88b91cc611c33e29d08e7c236182d75a93bb88fcc377890db6ada303f821d416a2295701e294cbfa20b1699f3fdc9c415634194c281c927f2cd940c5dca74ea48c541adca7ed781f9f9e2ad84e21a345fb3a06aa531b29b09384ea90a6abaa7425bc1ea50946aa4a946ede9e8ac102deeba8c9f6647741ea8a1752f2eb6e3df1777f4d6e60534a3652ea13ace2a51e8509ef2cc304488dc56972af20206d02fddb3beea051fda595d313a68febc604a89fc1f233a2b3889cf957df2eccd7161eb0926078f405c1985fa84c8d6d1ce10b15bdb5f9a11748b847648753c4329d6eb4d601bf3cf04e517e37c595e91e0737375b15dfd8435a138bc76182732c0370bb3392c7ab06df347e6fef37c30d5e69621a59fb68123b239a4ca2f1c987515281dbf201261a287438d224cb3521a1ca1cee433844c5467639ff47b23b14024ab99ff0a9c74444db068c1dd8dd69f95f650f6b8c0874563d10d33f31bf394440c6525a84db0a8681a2db0b87e0e9f7da381c9c54df9dc94e5d4bf6e5559f720fc620b90ef51bb7f3c38af24763645ee46795c5237fd6d724652c785530d69e9ee42844698dfc4b93b7de53636ed7cfc7ac218869b65c2cf29f015c33b178d3bdb2d036f5157c653bf17958e2c614e2dc619b908e6666e5a9f02df2058e933e302ec6b6a25f73057496c973e8c65a5d0a076f704e19eb562836e4d3b4eb9308911345d1e909b7b24870e75591bcd9bae79d2b64be5aa415d9d9727009481e6840172cb30edc1c2e9cdd6f86d7d2b753096c16a40828012c3bfdc30ad23bda4698351695e0914cfc3447801ee3770d0c992879857e4e95c737a70b9b6e6d2537720881c57d5f469e26bb8cf690c48693e80c4f4f1e0c64183d2f45eef3a9c4f09a038f1e7ef9ab87f9ffb6db36c1f1e0d833ef6cd12b978ae4dd1440cefeb218eb3872726d00e7f676c29004b686d42c89d8eac2a784a7bcef18926efa1f094bf583cac681a060a6c1517d9fd6f4c457bf567cd69b7c5756ff43547c3450f4166a4bbefa00d1a0ad388403cae4aa9d28381f4b99baeaed387ee735e99445d9582845e61fd24bbf71293bed64bf7ae04ba8530579849c9244bba040061278d2f87b7a0d9458b42c4c657225ffed2629198e0ddd26642614c475f154b35b1a702607df7dd5d0f86662aa73b358f3e043117df35af66e33eb6087fbb902820f7a8db7cccb4120851dca359796436e7bbb9ea98c628d2d8f8a7a38736e8eb02815d915b40e50653824d8411f441124255b9f1d8846b753343011c1e93769164ac44c9a682489342560729160eaed2e28e8117dea940e7ae157150749f1d1b3ffdb24e2ec236fadb20b296fba141a4fe416e38402101f961f79aef40d5862f56676c42de01f8bdba7345b2a7a35abefa8afe88df000d269e7a8d502650c68fbbb393c0c6063b517b73670e04d4aa9487c1590f459ce5fc62e68a2102a881126284eae0e888a0a9ef101ce3624f932cc376baf6a071a8c0acfa9c63c93743b7e7054693854b47f75d72b996b3f653d89a5777a2d775fbbefcc5e8e998f47684496f8d424b3c533f025f623d17f514acf6bca522ae321799bd4aaf7a3b8079f8b7ce40ba5d64f715949be174797fa3661778b1f453c581678766450d6042a265d0e6bf3c4341e3748a030646952082ad013576d6513fda2d7c9fc98199d0c595a43606a1a0fa0116dc18f8dd0944092963a83b331322b417c01ca4848a5a917c404e4b0f703209f0931a7639eaae89f24e7574ef81d4cf0a7632219283ecaf49a91b18b1100627dd351de1fa7a269c2ffcfd7c304e7231b49cf74159982ac44c851b80b24cf105ff036c52a038dca5f05fa800e047b5f2576f64801019aa13d83c05dc5eb18f12b5dbb6ce25a405e58d61b989c8883ee7f6a530f9a8091290973530d9fc0138721f7af4d77ba76f3f6e334d291373a3d49d0926aa1d4217573c3925435dc28878a2dc8110069d9a7e4c5a486621982fca3976e1e24189c4b4550d1ad82feb302390eeed90ec4896d1e16901fe9e72f2a7c6b3410b86012648a2a5aa10f3a20552e37e594323fafd07ac505d209f68c8cdd90e83bb8013f1300caac13a9773f82908990ea1b579cc6cd4d2f93f2394dca83c33953795cd603fee9f923f1b72c96711607e5b38a132be92d82a33f65b50eed5f3a76d569a9742db2caf4baaf3856d0cd54f8d3dfbdacfc28df453c1d34dea67f79d5c9376be0bfc58cceadee13f73accab41728b373680d623a8dbc5fbfb6b0306807f4756a95a040f4794fcec39062690d3ffd7cb4a617598e401e98e635d5060415da232882a2f21d2d119c134dc4ae250a0d6cd5441bb2f41be3cf6b48249d78e5d93ee0526651a1dbeb6de02727ac30779537dd9c4fac85bcb0a5e6ef2056d6d728e0bf1a1a50f6434adbc532aa25167e227c16d23f5f4bcdbe26ba9e102d2ed47ea474f6be7a91187d035fde6174f0f834ffb75847845cb68d5cf460b06edf1b01f71b313dba913682647751323f3adbccb54f0e41231569905b4df7e4b02afff50966c763c8deccd3f15c66cbedeb84769aa3c0a68468e25fcca89c2d2979d318978c571010d803c4f3dc3e7e816ed74641ffb15971ccbb6bb3b04ae9dfeb479a1463bc12297bec9dc2869decce1262811b129a929ebd25c8c200782d59aa66d72840002c33d9408c109ee6384158a54eb7c919e14af3fd75c78e6abc282e3623b780ad81218f52cd73e12023da6b9d89df236db41fdb69642a54d6cd57a6d881a7c875d27f8681bee9170669142e527f98202d4e687a0ab6eeb0633bd0d033c13ad4520c64a2a890469e5d7a923e35711922c05006e1b3b0adce995442573182f9b40d65625c8ca1bd80854e9efecc6498c8fc9a3eb830a8750c3e04734bc1ddf3fdf2b3ec34090c95ad31753ef34dfaf3101318c0e87d349cbf36754fa96c9868caaf6a67beff5557f6b0363cca2f4de40460290a4ffb98a19b197213b903a5a781ee50ecb0e72e351bc1aa683b24e8ccd2f5943d5c7247eeb15c90933b68fc185dedc641ea67184d2f0c4d7ce6e761b2f8028d20879b14dafb05ddd69dec1b0cc2c571ad35d2deb53a3a34713f56ea96208d10bbae4bb28c2a92518ce16013f475c4aea8992b3728bbb63fda97a454354edfce60bfa51aa41eec0c6e290876a81ac2206b968ca6c93b741261dbdda0967ff00500808678fb8fc2faf3771873516b8912f2e2cc2091d4f54585baec695f9604b9ea1f0d3188ada0db257627ad23b3e34d9182030b6ea7b6641bf26d3ef3c53c51feb9f22fc634be5fa41271f16fe9ce8daad96681947a21ab6647dd6b4fc11233c71e4b5c4ab8a71e1657cc276815411bbb41d26010f2ce59acef86b8f4b5c211665540427c2c0072d568312d4f9436bd730a3064a3547c4a7c18b203a0d804712f234934c0ea5d35c750ff7fee09081265244b8ef01879874bade42d1abe1c373e69a1858fff241a20b9da6b4d5333b68ca74b0e3929166063ee627c258e07626cce61ee37a0e810ea416ecc95367a13a8a14cb5b88a572e651377bf3fc1fb0d13690b533434f89d4097fe952044001194534ef9591cb29c659101f896bf20a8ee5b47f77467a24deb5d3b9332d56884406cddf6498e16b50977f5bfcd51014bc79b39f1bcd2e287344fb3a81346d2a1f4a74939cd23af509dd9838a14303ad56e5d8a134f2dcf640298c9d7205d26749053bf09dccf07451ce2bb64f065b07fd4ebea476d4ef742a46ecd79b6e669af456f61d6f0ada23e662362243d62acf6a6f13fcc23dacacbf3e8b01bcd4f436b302e79a12a702199fff69de3834e33126261bcec290a8a8d404e528baf090e08e82698d6a151aa8c5544a1a73e43e87013feee39bf95baaa9ccceb7bda1355494cd3e6ae1e44ee65f7d2a221c498c39b9a43b626b1bd682dcc512e84820533a943e647c18e6f6869dd978195b5ae54bbbfdf05db24ec6d3e7ec6a4f56d5b6ec94119936fb22ba77ce48fb271e211a4c944e6868115369b85de12ed9dda90726de15342022c30e4446212ef4a27034cd2227a1f45c8901ea2c7b64cd5f69d422cb83b7d1be84472541eee01296e251711939d8447b67dab2cbb448fdf18d3b24202d7f758ee24b3133412adc13ff3386868389e280aae0d4650d814d20e0bef56d00c72d34744853013d15400dce0830a897b8ac359d18f37f1cb1e06f9c56aee5335c2cddff763377dc6074741721a755e28681403a1c380f48671f13b74005b7b4363928e3ce036c24fcf8b53de85846d9608a7997c79b5b5f651902acdab29c0e6d2a73e2b45b4dbb17f49429e3d7112e46bd7c1b3898922b803cfe8e865e1630bee3e043b4dd12de142ca8475beda97a208ca0f9b3b92be535c48a75d254c6b909c3f0c6c64019956d22c5fd59e86d6eca7763725ce25db61a7108e2815e026717479617b2d8434c8aee39517463087ff32f2838a925eb25a8234fed6aa577d7194cdd6cd33b5a3b1045d30191e7ade3bc8b42bd1abe762e8bac00711942c0fb2726c4bb9ffaa1fd463290249e15eb35a20c10116a988c8dca9755d0355145e498567936017ac19ac300e6caa453eda3d7c2f1bd63908a54a3fbd2eab2160e4c0ff59c2a6e02aa357abaf53e86ba74cba10876d5908d41f736a9ddb964ab5b3e7373218ba1579ac52dad5df5edf0d8b7dd2fbb1c8b885022e3d2f5251a72597aaba0d286c3fdfcdc45f4112d15978df5245add4bfe5e99d185c1cdddabf0bae7e51260ffe003264607420e06bf8bf9021b64dfd759a3152c8da5432927fe16c1eae35e5a08eabbd5df75cbfe3e3d5c02b4c9865ceb9ab4ad9be1c3e04e0884a1a6ee51d2a0777ed65cc6546a2a0ee3d04f2a904715312c7904edeeda286ffcd203ef5e50f150efa5233e2c454e4b7a72ef73afc6a5cc7616caa5ac74475999931750805746bc777ca06179b7415e8b2e3903be53f8cd3f0a98b48e11fec4715d2966b53cee96e1a530b7fb066138a9983e80908cfec3102b829b9ba433f3bb3be8e57cbf2891ba67473477d5fa1d4303dab9004a7f10745ca59d39a4a4c33434d4ab2f31400364b09767ea16dc6054e00bfbeaeebec34653fb59bb5132cd4bc43e5d3eab5f6a738"}]}, @NFTA_IMMEDIATE_DREG={0x8, 0x1, 0x1, 0x0, 0xf}, @NFTA_IMMEDIATE_DREG={0x8, 0x1, 0x1, 0x0, 0xa}, @NFTA_IMMEDIATE_DREG={0x8, 0x1, 0x1, 0x0, 0xe}, @NFTA_IMMEDIATE_DREG={0x8, 0x1, 0x1, 0x0, 0xa}]}}}, {0x10, 0x1, 0x0, 0x1, @target={{0xb}, @void}}, {0x10, 0x1, 0x0, 0x1, @notrack={{0xc}, @void}}, {0x20, 0x1, 0x0, 0x1, @nat={{0x8}, @val={0x14, 0x2, 0x0, 0x1, [@NFTA_NAT_REG_PROTO_MIN={0x8, 0x5, 0x1, 0x0, 0x17}, @NFTA_NAT_REG_PROTO_MAX={0x8, 0x6, 0x1, 0x0, 0xf}]}}}, {0xf8, 0x1, 0x0, 0x1, @range={{0xa}, @val={0xe8, 0x2, 0x0, 0x1, [@NFTA_RANGE_OP={0x8, 0x2, 0x1, 0x0, 0x1}, @NFTA_RANGE_SREG={0x8, 0x1, 0x1, 0x0, 0xc}, @NFTA_RANGE_SREG={0x8, 0x1, 0x1, 0x0, 0x12}, @NFTA_RANGE_TO_DATA={0xbc, 0x4, 0x0, 0x1, [@NFTA_DATA_VERDICT={0x6c, 0x2, 0x0, 0x1, [@NFTA_VERDICT_CHAIN={0x9, 0x2, 'syz2\x00'}, @NFTA_VERDICT_CHAIN_ID={0x8, 0x3, 0x1, 0x0, 0x2}, @NFTA_VERDICT_CHAIN={0x9, 0x2, 'syz1\x00'}, @NFTA_VERDICT_CHAIN={0x9, 0x2, 'syz0\x00'}, @NFTA_VERDICT_CHAIN={0x9, 0x2, 'syz0\x00'}, @NFTA_VERDICT_CHAIN={0x9, 0x2, 'syz2\x00'}, @NFTA_VERDICT_CHAIN={0x9, 0x2, 'syz0\x00'}, @NFTA_VERDICT_CHAIN_ID={0x8, 0x3, 0x1, 0x0, 0x2}, @NFTA_VERDICT_CODE={0x8, 0x1, 0x0, 0x1, 0xfffffffffffffffc}, @NFTA_VERDICT_CHAIN_ID={0x8, 0x3, 0x1, 0x0, 0x4}]}, @NFTA_DATA_VERDICT={0xc, 0x2, 0x0, 0x1, [@NFTA_VERDICT_CHAIN_ID={0x8, 0x3, 0x1, 0x0, 0x3}]}, @NFTA_DATA_VERDICT={0x24, 0x2, 0x0, 0x1, [@NFTA_VERDICT_CODE={0x8, 0x1, 0x0, 0x1, 0xfffffffffffffffe}, @NFTA_VERDICT_CHAIN_ID={0x8, 0x3, 0x1, 0x0, 0x1}, @NFTA_VERDICT_CODE={0x8}, @NFTA_VERDICT_CODE={0x8, 0x1, 0x0, 0x1, 0xfffffffffffffffb}]}, @NFTA_DATA_VERDICT={0x1c, 0x2, 0x0, 0x1, [@NFTA_VERDICT_CODE={0x8, 0x1, 0x0, 0x1, 0xffffffffffffffff}, @NFTA_VERDICT_CODE={0x8, 0x1, 0x0, 0x1, 0xfffffffffffffffb}, @NFTA_VERDICT_CODE={0x8, 0x1, 0x0, 0x1, 0xfffffffffffffffe}]}]}, @NFTA_RANGE_SREG={0x8, 0x1, 0x1, 0x0, 0x14}, @NFTA_RANGE_SREG={0x8, 0x1, 0x1, 0x0, 0x11}]}}}, {0xc, 0x1, 0x0, 0x1, @cmp={{0x8}, @void}}]}, @NFTA_SET_ELEM_EXPRESSIONS={0x1140, 0xb, 0x0, 0x1, [{0x10f4, 0x1, 0x0, 0x1, @target={{0xb}, @val={0x10e4, 0x2, 0x0, 0x1, [@NFTA_TARGET_INFO={0xb5, 0x3, "660918f43084f406bc62ff99ca82de86c13dffb64c57d51313904593223c0bf033c3077a0c0566e12c029ca1f296d37f8f6d757a52f74fe9d14ad274ff1db6a43ef11b530bb375d8c57edf882770c07d65892d1ca6808bc6a429c2ceabc54d5981648e168f8c11ee098321ba798fccca522cf289151aa30a7f4744171114d8e93ea5b8026009038ad1fdcd992035785f79be31c72ba51f01656e9a959c3b80e51ddb284ef776c3013eb19f9da499255c3f"}, @NFTA_TARGET_REV={0x8, 0x2, 0x1, 0x0, 0x3}, @NFTA_TARGET_REV={0x8}, @NFTA_TARGET_NAME={0x9, 0x1, 'SNAT\x00'}, @NFTA_TARGET_REV={0x8, 0x2, 0x1, 0x0, 0x2}, @NFTA_TARGET_INFO={0x1004, 0x3, "506d6983be3441a8d0f6b2196df6da8759e5ba9b98a008924a6aa7fbdc822391989db0fb473e602202e67f5c8383efa28f0f695865dca6567818ab257b2269881a54450a376301cf660d3edbff73fefc69c26afe050fe924568035a90132e21d44754808115c25816f07ce600b3a7acc2de646a13fc4f490b09ae5630be2884e998c1c8e9da117bb68741e9c918dae25907e40bb33931b2b9bbd5e1f1d8167076ad698f2262d14b3e5579a528675d0bab444b35022cbe567b979422a392d5b36489e1b2282d0c84daa6403e608d6bf615b4b7d361f82b668e1bc9f4f750b6c165fc3c06f2dde166b134daea61c15dd8a52fdd9ba0f2d4ef564c7488cd25627203e613cd0e2fdab361704cce4835e8cc1d7324330026d8ff07ef631c7cf3dca2ee2cf768fc63e72ab76886b20a022e34407949c38da94f988f284d6635ab2ae764cab49deee486663d4773a33f7610153a3671dfb8256ffeec3f119037651ec0b45abccbc507a0a21feaa6c513f386c5bd4e8e75310eed82407d535896bf8bc523034153721348a902584def553d9e20be09c5af14423857697c1478591c1e0b6d980e59b2ffb6dcd307cbf58b68bcc45c6c0fa0490f4aa0d812e28ee975923510276f501cb605e3dda2cfdffe1d318b14fa9ce43ecf1eac7e03bd312bf0b01e6a1b616a2e25affbf6ba923866c8bd1450ba90795bc7ded784d8a56246e4d27ae3aeea91e0d8a1ced5eef9e83c1cecf3d4d056168f0c80c5dbf677bc1586fd5a05023cf82d7ca0a0536dc9b32d3170d89d2dcb2436f9d0a71d921af389a2d2ba4439c7ea2369d34b59e8df08a0b504dd93f37b98da3c58550e5d646849389f852c10debdb2fc3ffcfe4760a87fa50d846f1ff46645c590c558ba5a548d463c905f884e32f917010db0b8631b90d5a9b4b61998c7a13c88b02a8d1a95917bd61fd5f26a7915445f3ec83d69d47f98fbe4a79437eebab181fc34e6525c08a99a811bb0fc80b60b6751915508e342811265037491835c6c0f00fd8bf9009e16a22b23d6b386be403ad533cffd865a06d309264e2724936fe859a7dcac94108d3933b1ba39c2dc2d131d3d0e8dddd993f08dbf2ed3ecceaf3f2d666a01ad7b01d0417dc6928e338b915b7c1c24d839817d131ecce59ef058e32ebc1d62b103d402d6d4c924cdf2186081ebe88c8cb4d78b77ea21c568dd08492987ce61ac2e133718b3a7c079b8a4efc9d55b2bbc9e2204acf84053ded49bfb47dc6153ed9c4c47ebb16688f0da2cf0482def7c5466ab7a7d19995bdbdc38bf9025fe1ea8c6bbbd1e7f6aa787bc27a2b5f7ae305a0ba191105647c2129e85334b6dd9dda1398e59b03f54500cf65b5391d6ebab765f8f7f57df9a262d9f939db7dee4bdafa2de56356854c803a6a50511693b6b4e3e3c475034e985d7c8f6a7a44158384692780240a124a7ea145a3ccb5163c237fccd5195afc16a82c216ddeb201f9d67437bc900b51e8ee0a2d4931cc0264a0fcabc8ce54c1aaac15d52381f6f295d50d8e9afd72e803713c49044d9e95e55d979c0f8539175428095d0ffe56a815ac37197426f16c4c3b6418ed71f0881a69dc90b070be919be4f86496abbc04d1731339b8c09af2548715b853c4ea5a614811f1d24e5197c8abffaaac41dea48d2f6074965bea6d1837f35af7409790506cf6ddb995111eb0371b4148cb1136c1689829b26bd2134f5850ece723182de724d463712c8d033ba95d29710bc5c214038bc8c2fcee02ddd2f4490914e6042004e754c830c5f012c79402f553f9e83d0fcca044c1d429f529b1c18356fe1bb2cb7df9e5ca9d4d913529b964671a1a3cfcae1974e7d469c52109e39786f403902dff855d0dc8546a1eb4ca1e58098b936e8266cd7a0cc0f91691198276bdf5cafa757abf2c62545a4da73bce9fcb695e26656b2f4aa1dcb382ebda8ee2cf3e85f24676215019dfab1925570ac3d890a3f21af995c84c28ba7f1db17a4d6d7f52540c2b0aeaad694c438da3eb3e86c0857286511f3f9be4e4a8cc85b2ca00666d587dd82b14fe07c3a60877ed90bc7eaa124d294e45cf8d254cc26a3ee520c3f18b4bb87482f0d7503da110a065ea2e6bc1e999e22c42f592484b2c2ef4e9bc885b6d436f939683bf9b957f430c74c7efad70a325af276f698d8a0e2d55cdddeeddcae5b14a25514a1e1105f539339bf5c5636394e9c0e34e619bdff382d6d5d2a1f5a50ef2e177cb9e1b42be14753fdd8a5ae4e9b39215d4a488051b35ecc040765146dbd0c9a41d76a6fb94c78b417a3422f69fca3eacd2fb924a0884b6078cdef23b848946b785e0a358b941e4c815fa2903072ca202ceb5466e88d7c63c319f9de2c8ea89f7d4cf554132704002555fe3a6297dd2b1da898c91f189d36b1e1d0e95d75856ef0ded06dc8408731513a472f1ff1d814a4228bef5e9dd18d7e886a3fe9a0dd76b721eb05915faeaf23705c403790f75445f65f5f5d48bbf4b767db2bbe834c30ba091f3f86e0c9876ece8cf049f5a01afbab3f68dbfdb9dc434e58a293836cdd7a784cfd3d93e8b8f4686077d51845d75a99b0bf8290e671bc0ca29d48f22ecfb8cab8a0ceab845ebd85e6ab7a2fcf5be49bfe82456a4199543c5de2315aea4a5dd69a67e58151d29cf0c179507aff9bfcdcf38295292e33d0cf72d07c03d18cfe2fcb5f6b2229ff2043af7672258f20bd88ec33bdead4574f6157f8711d0810c20838064c7926359aab3056b5dd4aa830e66e9d8b7f0660bfdcadaa3d38cd22cfe81c55b31bcf2329284883ee078350a71f8c895bf5346f908591b934218fd2d63687fc9b9c16ebcc9028039c6e73691ea8fcf2aa7827a3d474331cfee2778c288ec09e0345b4c45befdcfd1fb8318a8b46d17a5c36e7205cf69c1fb199d62c555c32ae31d7c5947d7820fd96f07c4f3246aee0db9fa027d1a913f7cff415caeb34babac5e133cd2dca9640b00d2177f44d8d8b801d475cd4645a1da4b3980b459df3f2b31ca6c0843b36804d33c1d0d336878d4d326f30b079af2c8e02d0043dddfd42e63852ed802705ac2f0802066317ddca97988f87194fae0065a03cfbeaaf3d0815053ec23ff51fa683ba4e656b0a9889b9ab352a3d0fbf9e03b2778c8f9b4627da04332e03f1fc07a6d1139a52890cccddfe7c47f1084bf0cc7272fbaea155181d7a31b5cf3315d22c0e41acbe2a9d708a080fd9f5b67e5482350df0a6140d1029be885cf9d2aea5a4cc1d8524b147efb6a08c76a62cd92a62952732596bb4a9bad378386aa415bc0199ae7a4ed13b814c0365442ce7a80a9e746723611d4c30408a3ec3a82de95b98b7586bb14a84080371d5fb3508e654c3fc4ddb81137d146c49a4a61b6154a40354ce83a684f6cff06ce8ea0edcddda03ba114c592023b52135eb539920e17434c3da3aadfe9d8fe3ccaa0eea32c44e9e4dd7cad11bb8ac761be74d0cfffb182034fc2197e9218262669e930e8de740f17df49c3bf5727e0b1b8dc21b0e791019035e6469731deb40f83803ed86d2781b785e11ba1de877ef07edac9ba08ece165ba330848ae51302f1c18117173b86ef341f13b4e620e9e9a03daa85361d2431dced4ed714a1888f302f3829977cebde71feed6d31170b0b75d3a59eeeb0b721e5f5ce51e5e5009eef4308be0c5d59dd916c74b0d6ddd72d52ff21d444fb447911dd85dc6e1ff6a8782e0337eb3ae83e003370ea81d8974db84621db01f5f61d0586d922628dd94b537a01acb771063dd97113dfd92338a7b60166522fca74da7ff94382f8110f54c15dccfcad28b1785a8ec56f58a963611789d7d98073745bbfc5dc186e9748c9bd78bba1670d9fdbc83041bf8bdbd4af092712ce450e2474c34ec7c2c382bfa06a4c4e4bca2b0712e9178c4266c5f413a3d5c83ae322f1802d8eb12997e870007e8ef6fc39a0e46e53478ddfb192fa1841c3f17636bdcf312d997a2e4d7fea952eca7aaa34c420e6a9696cea2d3c7b8cc25e233a15af13bcf20c416679fde4f977cdc4adeadf8d39a4d1947fa6fe028ad0a5024bd3de89682f4e1aaf5e4757df2d3cf4d852a98d8987028399d97e49a530c527d5e680efa44b95683232718f37da3eec5eb43c589b3437e034d70c48acc38bd4a5c26372afdc53cfe51b6a7f3c0d0a2e5e0a3a68e931a35a60df3851998394f5ead5f8b168c0b6400fe350bce54712ced0bfd54770a99b56ef957303826e63941d060b10e49a4be6c6b64bcc3187f335ffac2f01ee860fa7e7e688a3e59bbdd56f2d3e6fdafd23b58aefe6a9c0cda2cffaff31c14f57f85fdce2445e9bf7bb8bf6e751d1295a74df76f143f560b6d4c27f5d77bf3d35b9d57f90cb7af612f0e5891354ed24350dc2d008187d63b4c63bba1c9dca9c1b13c66f4ef1ecfcd72459652ca8f5d8ecd5562f54b9f1044c51cc19876abdbd8732f300d04830f81cc7b22ae576db5a66c5e9983b620d79c478eecf52c26f51932902a9493d7d050b7fcdcb1f6b6e3e810289c629e7ab27ffcc49d1032c31140c510496c2f287d23b2eee63494eb38ac6c77fb870c5e0c9c796dce125be36c1ac4190d1d88aae752b78fdc0c6b5f24d0772cdb97d6ece570c70004b9e1c38fa65be2bcff9eef38232fe4565ca20f971e7d9929ff8f5dd654358aa8287dea6ba69b2831e344357c15aa58c406e739d81052400ce642b1e0c04a35cf304872d99699c346b42d5e30e97d9a3177d81ec728bfd8c98f2507be542513cafa41a77c64bc15039a60c3c11497d012eed0e1df81adc4d6e47bf025b7bde108306111749207aa517b25ed232c84dd7f2d756abeb56f1514070cadd5fc29771f6ff066d84b3d3b016d4a6eecfc7f7b3047e768f616de49f7ca73e26f4c2d01da8aa9ca50310258230c43c627bccf2182daf8c846052270062de1ad1b50f2007311cc6c83a9d4a515936ba6b119eef7cb372156272571473c34367b278a407c7a1fd1f413684e7a7a4c5b60b81e2d125d2af10bc154e25a3473a692af08c614c4f90331a3b25323a61d85a8f610a4943807b49477760a9c2767ee1289ee419763c25b5f4372c6c13963167bd7c6fa8c062fe156bc7d54052eab71f077af1cdc95f368f70728233e563219636079317c069de03f574fa014c30105fccf9c409780060ae5d65e07aa93fb2a65afa1707d4f7e4e73a61ce0fe1a66bb7bf89179acd356a8693d1a52c70f20bfbb0e050a810954bdc3a929286b3b82f421aa39603a1cf923902aa852443ee7e842b0e191c354a51a07581d87654d6fac530bedd991baf986d4a0b934537e0ab1f12ee8cc15afcb7e8113f0086e29cbb34242f8a8daedf85d16705ab59bdbd00b06ccdf871d2e71d5b5dd2390ebdd19c60ee0b5e2cb228fee024b87652bc6639b23b562f6ad4859e53cdd0f2a4fabb37b9244707d72a794ea20af3b9017b9af12d564407d1ea4cf217f30ba9ea1591050fbeb9fc7fe46e7f270fc17601104cd9aaa14a69472393702ff1584c24d3ee68ff0b89604daa584884be5f377d1f7073682117af4059e683fe3f6299f1391d5ac0a25fad73fad97f0270940df26b247c4eb64752caa24ac756f92fdf21c5735277d0f3418d47c4bfc3a28653e2b059b46b63642097328eddb0312d76c2929bad70efa6ec29af4b6b68e995fc8d8e1725cd08090cb58bf2f63458910cf485a8ab786ed585feb849f3156cd502b09db743a9f3fc273d821d461542d4fa3ad654fb27a52f9e161a8d73c25e7e07bb4f820e0eecbafd765a61b5735076ef76b"}]}}}, {0x3c, 0x1, 0x0, 0x1, @exthdr={{0xb}, @val={0x2c, 0x2, 0x0, 0x1, [@NFTA_EXTHDR_FLAGS={0x8, 0x5, 0x1, 0x0, 0x1}, @NFTA_EXTHDR_OP={0x8, 0x6, 0x1, 0x0, 0x1}, @NFTA_EXTHDR_SREG={0x8}, @NFTA_EXTHDR_FLAGS={0x8}, @NFTA_EXTHDR_SREG={0x8, 0x7, 0x1, 0x0, 0x15}]}}}, {0xc, 0x1, 0x0, 0x1, @fwd={{0x8}, @void}}]}, @NFTA_SET_ELEM_FLAGS={0x8, 0x3, 0x1, 0x0, 0x2}, @NFTA_SET_ELEM_FLAGS={0x8, 0x3, 0x1, 0x0, 0x2}, @NFTA_SET_ELEM_DATA={0x140, 0x2, 0x0, 0x1, [@NFTA_DATA_VALUE={0x75, 0x1, "ba3c6c85c6dba4bb26542f6408651a2797b60f92e2987134614022d41c4f42edeea26fe0da9a469fad188f97abc340b33e8f0454b9bf4ecc9ae8da43016c8c584f5faa91e669ce10baf30df8bd3097f5161afcf351ed86c32ad6d6edb945ad675a62d154e09eee3645f31c8071686c8314"}, @NFTA_DATA_VALUE={0x88, 0x1, "cce82b0d395b28fe73902e588c3ff23d6f40b32e2eaf30502ea23a7d81c89d5106a5fd7e324227c0b8de043d7e6da80b6e794777827b1f4a82ae53134c19482831c412365411b4097f791a4cbca31ebdab2f709e03e7a950c3588d76d9e1853f00bcab8fba3aa872603ff550efd56e9214c350612cb0a13ab140a7fb1adbfddf5295905a"}, @NFTA_DATA_VERDICT={0x3c, 0x2, 0x0, 0x1, [@NFTA_VERDICT_CODE={0x8, 0x1, 0x0, 0x1, 0xfffffffffffffffb}, @NFTA_VERDICT_CODE={0x8, 0x1, 0x0, 0x1, 0xfffffffffffffffb}, @NFTA_VERDICT_CODE={0x8, 0x1, 0x0, 0x1, 0xfffffffffffffffe}, @NFTA_VERDICT_CODE={0x8, 0x1, 0x0, 0x1, 0xfffffffffffffffc}, @NFTA_VERDICT_CHAIN_ID={0x8, 0x3, 0x1, 0x0, 0x4}, @NFTA_VERDICT_CODE={0x8, 0x1, 0x0, 0x1, 0xfffffffffffffffc}, @NFTA_VERDICT_CHAIN_ID={0x8, 0x3, 0x1, 0x0, 0x4}]}]}, @NFTA_SET_ELEM_FLAGS={0x8, 0x3, 0x1, 0x0, 0x3}, @NFTA_SET_ELEM_OBJREF={0x9, 0x9, 'syz2\x00'}]}, {0x324, 0x0, 0x0, 0x1, [@NFTA_SET_ELEM_EXPRESSIONS={0xc8, 0xb, 0x0, 0x1, [{0x18, 0x1, 0x0, 0x1, @cmp={{0x8}, @val={0xc, 0x2, 0x0, 0x1, [@NFTA_CMP_OP={0x8, 0x2, 0x1, 0x0, 0x3}]}}}, {0x10, 0x1, 0x0, 0x1, @match={{0xa}, @void}}, {0x20, 0x1, 0x0, 0x1, @synproxy={{0xd}, @val={0xc, 0x2, 0x0, 0x1, [@NFTA_SYNPROXY_FLAGS={0x8, 0x3, 0x1, 0x0, 0x10}]}}}, {0x10, 0x1, 0x0, 0x1, @counter={{0xc}, @void}}, {0x10, 0x1, 0x0, 0x1, @notrack={{0xc}, @void}}, {0x5c, 0x1, 0x0, 0x1, @redir={{0xa}, @val={0x4c, 0x2, 0x0, 0x1, [@NFTA_REDIR_FLAGS={0x8, 0x3, 0x1, 0x0, 0x4e}, @NFTA_REDIR_REG_PROTO_MAX={0x8, 0x2, 0x1, 0x0, 0x4}, @NFTA_REDIR_REG_PROTO_MAX={0x8, 0x2, 0x1, 0x0, 0x14}, @NFTA_REDIR_REG_PROTO_MAX={0x8}, @NFTA_REDIR_REG_PROTO_MAX={0x8, 0x2, 0x1, 0x0, 0x1}, @NFTA_REDIR_REG_PROTO_MAX={0x8, 0x2, 0x1, 0x0, 0x8}, @NFTA_REDIR_FLAGS={0x8, 0x3, 0x1, 0x0, 0x20}, @NFTA_REDIR_FLAGS={0x8, 0x3, 0x1, 0x0, 0x52}, @NFTA_REDIR_REG_PROTO_MIN={0x8, 0x1, 0x1, 0x0, 0x1}]}}}]}, @NFTA_SET_ELEM_KEY_END={0x24c, 0xa, 0x0, 0x1, [@NFTA_DATA_VALUE={0xfa, 0x1, "5eeb1b0255c912f3156d9415fba271ae7339bbfb20b97d35aa7d7fc869cfebbff30c0c9f9bbc9f5f89731fe11a69ca5ec57e29e2cd45edb5f241b8ad910bbf08047f735f355b52e836fef4fd5a083aa373bc03285505a471719ceae5b380ab64e79efcc0c866a1e16530f77ca3221f57e9c52435e2d80c580325b1d126387f1c7b77b522e0e8fc8d92822d5a0ed5809042b961eadd26b394aa48436fe8d04ac9cc9d9a2bd07cf5e200b3528de6bc3a36d187b3b9f9e2e40dcfb401e1d6425c05564c6f8fae0f93b2bf3e8df302b52702861b75be40dcda18c7e70b1cc1b6b810fdd6446fc1baee1dc18687fe4c977ef893e45023f0b1"}, @NFTA_DATA_VALUE={0xb, 0x1, "b56becc41bad17"}, @NFTA_DATA_VALUE={0x93, 0x1, "d6b98928092e97794d4a60aae3fd1c8a625d49ed58cc2d6f460cb05a09b8e5206b51ea99bcdd9c5d7dc4e30611b8dab0beb90c7f3a37a6d7763fd153467b28d9fe1d3eb16a48b12602e6f8a5951779cbe4f07d7bd8f77e58b27abd0cc02c426a79c8bb1a261ce25d73a973cc05b30910128759cdf4e2389f9f90ce81a5357a9020494816dd46afa60a623d01c90144"}, @NFTA_DATA_VALUE={0xaa, 0x1, "95c8bba4908705272790012a7295fea7385dffe83b3dfe051cd87ffbf2e696ae19ef6cfee66b0bd7563df44fae48d6dda331b0f9e61373298e3cf6dba6aa7233eeddd99efbcdd9b450a9fcbc12ab9e5edd35a9c33726cf067e218a31901bea8bf242aa0d2c946a59e7ee38585f94c87dc24f8a293ed6e05a4d0dbb8d5ced2409690aa1aaae6c10427daf0066af636638a15f83eec79330e34fa4c1a2a23f099f015aee5fc987"}]}, @NFTA_SET_ELEM_OBJREF={0x9, 0x9, 'syz1\x00'}]}, {0xac, 0x0, 0x0, 0x1, [@NFTA_SET_ELEM_USERDATA={0x50, 0x6, 0x1, 0x0, "4a3021038c5d8861a69d41053cc2b7882ce65ff9ec1fed866ab714ae9a768af6d6bfea41328b05e50fef6912452f6b643c7c2ff4a2c29852a7b6c8815e136e5b27bb49ceda53d6e64a2f1a6a"}, @NFTA_SET_ELEM_EXPR={0x58, 0x7, 0x0, 0x1, @fib={{0x8}, @val={0x4c, 0x2, 0x0, 0x1, [@NFTA_FIB_FLAGS={0x8, 0x3, 0x1, 0x0, 0x29}, @NFTA_FIB_DREG={0x8, 0x1, 0x1, 0x0, 0x3}, @NFTA_FIB_DREG={0x8, 0x1, 0x1, 0x0, 0xe}, @NFTA_FIB_FLAGS={0x8, 0x3, 0x1, 0x0, 0x28}, @NFTA_FIB_RESULT={0x8, 0x2, 0x1, 0x0, 0x2}, @NFTA_FIB_DREG={0x8, 0x1, 0x1, 0x0, 0xb}, @NFTA_FIB_FLAGS={0x8, 0x3, 0x1, 0x0, 0x8}, @NFTA_FIB_DREG={0x8, 0x1, 0x1, 0x0, 0x10}, @NFTA_FIB_FLAGS={0x8, 0x3, 0x1, 0x0, 0x30}]}}}]}, {0x574, 0x0, 0x0, 0x1, [@NFTA_SET_ELEM_KEY={0x240, 0x1, 0x0, 0x1, [@NFTA_DATA_VALUE={0x2a, 0x1, "15a90b1ffcfba804a39fe6810976779509b50602b49133c943172f5963a620d58055f91ea965"}, @NFTA_DATA_VERDICT={0x44, 0x2, 0x0, 0x1, [@NFTA_VERDICT_CODE={0x8, 0x1, 0x0, 0x1, 0xfffffffffffffffe}, @NFTA_VERDICT_CHAIN={0x9, 0x2, 'syz2\x00'}, @NFTA_VERDICT_CHAIN={0x9, 0x2, 'syz2\x00'}, @NFTA_VERDICT_CHAIN={0x9, 0x2, 'syz1\x00'}, @NFTA_VERDICT_CHAIN_ID={0x8, 0x3, 0x1, 0x0, 0x1}, @NFTA_VERDICT_CHAIN={0x9, 0x2, 'syz0\x00'}]}, @NFTA_DATA_VALUE={0x29, 0x1, "774f66b7a2393936d62482189cf9b8ece6740c0d4b49815fa24c0bef251669ef48ea5a4497"}, @NFTA_DATA_VALUE={0x92, 0x1, "9e35c85d884d1e00112a48a0eed788e556730298943f3e83ba38f33648783c31012010d00643a9f59df4d5e24c20e9942b958c20dbf4e8a2af1fbff3138f43a80001ec1bf5b1c3c409bb7e01ee71b627e979f73df45e44e9c7a33c2399ebc4056f4ada6bce4de22ef38bf9a08cb801ff07000000000000fc1b55a3fba86f46009a7109648daa90487c78f2b916c8"}, @NFTA_DATA_VERDICT={0x38, 0x2, 0x0, 0x1, [@NFTA_VERDICT_CODE={0x8, 0x1, 0x0, 0x1, 0xffffffffffffffff}, @NFTA_VERDICT_CHAIN_ID={0x8, 0x3, 0x1, 0x0, 0x3}, @NFTA_VERDICT_CHAIN_ID={0x8, 0x3, 0x1, 0x0, 0x1}, @NFTA_VERDICT_CHAIN_ID={0x8, 0x3, 0x1, 0x0, 0x2}, @NFTA_VERDICT_CHAIN={0x9, 0x2, 'syz1\x00'}, @NFTA_VERDICT_CODE={0x8}]}, @NFTA_DATA_VALUE={0x35, 0x1, "8c6893a66f750956a8f79491d04489ebeda6a1455fb46e7891c07aacee36b2c604a0290ba31e91fdb49371ab3e765b16bb"}, @NFTA_DATA_VERDICT={0x60, 0x2, 0x0, 0x1, [@NFTA_VERDICT_CHAIN={0x9, 0x2, 'syz2\x00'}, @NFTA_VERDICT_CHAIN_ID={0x8, 0x3, 0x1, 0x0, 0x3}, @NFTA_VERDICT_CHAIN={0x9, 0x2, 'syz2\x00'}, @NFTA_VERDICT_CHAIN={0x9, 0x2, 'syz1\x00'}, @NFTA_VERDICT_CHAIN={0x9, 0x2, 'syz1\x00'}, @NFTA_VERDICT_CHAIN_ID={0x8, 0x3, 0x1, 0x0, 0x2}, @NFTA_VERDICT_CHAIN={0x9, 0x2, 'syz1\x00'}, @NFTA_VERDICT_CODE={0x8, 0x1, 0x0, 0x1, 0xfffffffffffffffb}, @NFTA_VERDICT_CHAIN_ID={0x8, 0x3, 0x1, 0x0, 0x4}]}, @NFTA_DATA_VERDICT={0x1c, 0x2, 0x0, 0x1, [@NFTA_VERDICT_CODE={0x8, 0x1, 0x0, 0x1, 0xfffffffffffffffc}, @NFTA_VERDICT_CODE={0x8, 0x1, 0x0, 0x1, 0xfffffffffffffffc}, @NFTA_VERDICT_CODE={0x8, 0x1, 0x0, 0x1, 0xfffffffffffffffc}]}, @NFTA_DATA_VERDICT={0x20, 0x2, 0x0, 0x1, [@NFTA_VERDICT_CHAIN={0x9, 0x2, 'syz0\x00'}, @NFTA_VERDICT_CODE={0x8, 0x1, 0x0, 0x1, 0xfffffffffffffffb}, @NFTA_VERDICT_CHAIN_ID={0x8, 0x3, 0x1, 0x0, 0x4}]}]}, @NFTA_SET_ELEM_TIMEOUT={0xc, 0x4, 0x1, 0x0, 0x2}, @NFTA_SET_ELEM_USERDATA={0x9b, 0x6, 0x1, 0x0, "7857f4ecf3d330b9e450df7bf0c390a2563be2bde7c776c046ea5f7fc790d0c88567230f61d9c7562965e508a642254e5252d4c7b6ddb3dd14206eb7a585b1b66a9af3639d8faced5328333032417cd2a5eb9fe06e932426893392dddc93a46f22a37323caa04d094887410d981133ba93a33c724335f864c0f161f1a51f413fa10e4e3898b34b36348bebd3add443233b12248cf441a6"}, @NFTA_SET_ELEM_TIMEOUT={0xc, 0x4, 0x1, 0x0, 0x1}, @NFTA_SET_ELEM_DATA={0x1e8, 0x2, 0x0, 0x1, [@NFTA_DATA_VALUE={0xf4, 0x1, "01272602640d98ff982e49099ccd9470261ea774e757c1c11f17f9d8cfed9386972da4330af7a22736507491f1784b146801323bb03b8e93a069914a3d7ad784a8da0ea89f01fafb55e86e664a044f2de65bdc791b40eebcd8ef929d9d4ce206e0fcafc12f698480664101a413ed04fe795ad22767138502ce261174d5f4303fb272470b6f50ced37abe235cf7f1adf9b10155fb712882360df00271949bca6cf786fb655ad29b36757b743e22d3b5d2bdc22f179bd276ce3020bf428825838f5a63fd108c1b05b29a0af74802baffc62691c8cddd95a55f49cda3d1ec3fc1512db38b107beb48dc40bb7bb507259bc5"}, @NFTA_DATA_VALUE={0x64, 0x1, "1667e992b01c7b35ebd638af37e6b9f9d2950d20aae7867ceca29def5dd9c969adc20a3b4cda075161061b6495028ba2d796eae1a5f8f3ed37b8eb6c5747e7511f3536b73e81518fe1c6dc2d57582dc46a50436a3c8e18cad5ded629e92122f5"}, @NFTA_DATA_VALUE={0x89, 0x1, "dbfb063720da4f700a46257dddbd32373632a4e3b0971e7eb9835ce5ed556e9170537847badde54cf13256286ea1142494b763d01784ecc6edcfabfe55fa941a9ed98f877687d08afa07ea08d962a3f40f036f44ab9f961b4ba6717faecc6f6032f6046eb60da1ab085e6219246c027c2a4f9b43d545c27dd81decce37012d07a9db8256ef"}]}, @NFTA_SET_ELEM_OBJREF={0x9, 0x9, 'syz2\x00'}, @NFTA_SET_ELEM_EXPR={0x10, 0x7, 0x0, 0x1, @hash={{0x9}, @void}}, @NFTA_SET_ELEM_USERDATA={0x75, 0x6, 0x1, 0x0, "6a128f0b5edce90cd432918a0f5a125f6b4114c24d9d41b8b194ceb226c9f6eb25316b72db9c6855ae78bf1e3d49c6c70cc687a8aae31638f82fde91a7386eec76572af4bb94427149dccb759235c0b838fa6284208c2a46bc7726bb3fbad705fc2c4e2ebaf4cc3cc86cb252706b2d56c7"}]}, {0x40, 0x0, 0x0, 0x1, [@NFTA_SET_ELEM_FLAGS={0x8, 0x3, 0x1, 0x0, 0x1}, @NFTA_SET_ELEM_EXPIRATION={0xc, 0x5, 0x1, 0x0, 0x3ff}, @NFTA_SET_ELEM_TIMEOUT={0xc, 0x4, 0x1, 0x0, 0x7}, @NFTA_SET_ELEM_USERDATA={0xf, 0x6, 0x1, 0x0, "3c0bab262c8bc7e8ca00e7"}, @NFTA_SET_ELEM_OBJREF={0x9, 0x9, 'syz1\x00'}]}]}, @NFTA_SET_ELEM_LIST_SET_ID={0x8}]}, @NFT_MSG_NEWRULE={0x2a4, 0x6, 0xa, 0x301, 0x0, 0x0, {0x1, 0x0, 0x1}, [@NFTA_RULE_HANDLE={0xc, 0x3, 0x1, 0x0, 0x4}, @NFTA_RULE_USERDATA={0xe4, 0x7, 0x1, 0x0, "5a5d24f857d533574587e8f9f655c8e4b50d36055136ea2662b37c165137127aba1ad2b208698e4b4882ad62812c0c0acc17bab60e9eb5755c7cce30c8ff384baff99689b1ecef87b4f20e00173ae635f97f65fee08e7779521d4272f08624d2b3ae36032c6d794d4c4e748b0b237ed52265570061686e6ff01eb45b56b59a4af1a4fda2a7e257c763d6f5b7dc7dff0889a37403b4768692ebcad9d99f62f2263acf88ef5b82a4a7689cb27a9591e14a75e438eeeb81440ea044465af1d00961ce8f041b754a123594474e80fbf54963fd483cd92525275032c40b32f067a180"}, @NFTA_RULE_POSITION={0xc, 0x6, 0x1, 0x0, 0x5}, @NFTA_RULE_EXPRESSIONS={0xc0, 0x4, 0x0, 0x1, [{0xc, 0x1, 0x0, 0x1, @dup_ipv4={{0x8}, @void}}, {0x14, 0x1, 0x0, 0x1, @limit={{0xa}, @val={0x4}}}, {0x38, 0x1, 0x0, 0x1, @last={{0x9}, @val={0x28, 0x2, 0x0, 0x1, [@NFTA_LAST_MSECS={0xc, 0x2, 0x1, 0x0, 0x8}, @NFTA_LAST_MSECS={0xc, 0x2, 0x1, 0x0, 0xf}, @NFTA_LAST_MSECS={0xc, 0x2, 0x1, 0x0, 0x6}]}}}, {0x34, 0x1, 0x0, 0x1, @flow_offload={{0x11}, @val={0x1c, 0x2, 0x0, 0x1, [@NFTA_FLOW_TABLE_NAME={0x9, 0x1, 'syz1\x00'}, @NFTA_FLOW_TABLE_NAME={0x9, 0x1, 'syz2\x00'}]}}}, {0x30, 0x1, 0x0, 0x1, @byteorder={{0xe}, @val={0x1c, 0x2, 0x0, 0x1, [@NFTA_BYTEORDER_SIZE={0x8, 0x5, 0x1, 0x0, 0x83}, @NFTA_BYTEORDER_LEN={0x8, 0x4, 0x1, 0x0, 0x41}, @NFTA_BYTEORDER_LEN={0x8, 0x4, 0x1, 0x0, 0x8c}]}}}]}, @NFTA_RULE_CHAIN={0x9, 0x2, 'syz1\x00'}, @NFTA_RULE_EXPRESSIONS={0x30, 0x4, 0x0, 0x1, [{0x10, 0x1, 0x0, 0x1, @xfrm={{0x9}, @void}}, {0x10, 0x1, 0x0, 0x1, @tproxy={{0xb}, @void}}, {0xc, 0x1, 0x0, 0x1, @nat={{0x8}, @void}}]}, @NFTA_RULE_EXPRESSIONS={0x98, 0x4, 0x0, 0x1, [{0x10, 0x1, 0x0, 0x1, @hash={{0x9}, @void}}, {0x30, 0x1, 0x0, 0x1, @osf={{0x8}, @val={0x24, 0x2, 0x0, 0x1, [@NFTA_OSF_FLAGS={0x8}, @NFTA_OSF_TTL={0x5, 0x2, 0x6}, @NFTA_OSF_DREG={0x8, 0x1, 0x1, 0x0, 0xb}, @NFTA_OSF_FLAGS={0x8}]}}}, {0x1c, 0x1, 0x0, 0x1, @tproxy={{0xb}, @val={0xc, 0x2, 0x0, 0x1, [@NFTA_TPROXY_REG_PORT={0x8, 0x3, 0x1, 0x0, 0x11}]}}}, {0x10, 0x1, 0x0, 0x1, @payload={{0xc}, @void}}, {0x18, 0x1, 0x0, 0x1, @dup={{0x8}, @val={0xc, 0x2, 0x0, 0x1, [@NFTA_DUP_SREG_DEV={0x8, 0x2, 0x1, 0x0, 0x10}]}}}, {0x10, 0x1, 0x0, 0x1, @inner={{0xa}, @void}}]}]}], {0x14}}, 0x4258}, 0x1, 0x0, 0x0, 0x1}, 0x24040884)
r6 = socket$nl_netfilter(0x10, 0x3, 0xc)
sendmsg$NFT_BATCH(r6, &(0x7f0000000200)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000940)=ANY=[@ANYBLOB="140000001000010000000000000000000000000a20000000000a01020000000000000000010000000900010073797a30000000006c000000160a01000000000000000100010000000900010073797a30000000000900020073797a3000000001400003800800014000000000080002400000fbff2b0003801400010067656e65766530"], 0x110}, 0x1, 0x0, 0x0, 0x4084}, 0x8000)
ioctl$sock_SIOCSIFVLAN_SET_VLAN_EGRESS_PRIORITY_CMD(0xffffffffffffffff, 0x8983, &(0x7f0000000040)={0x3, 'vlan0\x00', {0x4}, 0x5})
r7 = socket(0x10, 0x3, 0x0)
mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./dev\x00', 0x17a)
mount(0x0, &(0x7f0000000040)='./dev\x00', &(0x7f0000000100)='devtmpfs\x00', 0x0, 0x0)
r8 = openat(0xffffffffffffff9c, &(0x7f00000004c0)='./dev/kmsg\x00', 0x0, 0x24)
lseek(r8, 0x0, 0x2)
ioctl$sock_SIOCSIFVLAN_GET_VLAN_INGRESS_PRIORITY_CMD(r7, 0x8983, &(0x7f0000000040))
syz_emit_ethernet(0x7e, &(0x7f0000000280)={@local, @local, @void, {@ipv6={0x86dd, @icmpv6={0x0, 0x6, "f81fcb", 0x48, 0x3a, 0x0, @private0, @mcast2, {[], @param_prob={0x4, 0x0, 0x0, 0x0, {0x0, 0x6, "4aa1d3", 0x0, 0x0, 0x0, @private1, @ipv4={'\x00', '\xff\xff', @loopback}, [@routing={0x3c}, @srh={0x2f}, @dstopts]}}}}}}}, 0x0)
socket(0x10, 0x6, 0x0)
lseek(r6, 0x9, 0x0)
memfd_secret(0x80000)
executing program 4:
fsopen(&(0x7f0000000040)='msdos\x00', 0x1)
bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f00000001c0)={0x3, 0x6, &(0x7f0000000140)=@framed={{0x18, 0x6}, [@func={0x85, 0x0, 0x1, 0x0, 0x2}, @alu={0x0, 0x0, 0x4}, @exit={0x95, 0x0, 0x7b00}]}, &(0x7f00000000c0)='GPL\x00', 0x6}, 0x80)
r0 = openat$vhost_vsock(0xffffffffffffff9c, &(0x7f0000000000), 0x2, 0x0)
ioctl$VHOST_VDPA_GET_VRING_GROUP(r0, 0xc008af7b, &(0x7f0000000080)={0x2, 0xfffffff0})
fsopen(&(0x7f0000000040)='msdos\x00', 0x1) (async)
bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f00000001c0)={0x3, 0x6, &(0x7f0000000140)=@framed={{0x18, 0x6}, [@func={0x85, 0x0, 0x1, 0x0, 0x2}, @alu={0x0, 0x0, 0x4}, @exit={0x95, 0x0, 0x7b00}]}, &(0x7f00000000c0)='GPL\x00', 0x6}, 0x80) (async)
openat$vhost_vsock(0xffffffffffffff9c, &(0x7f0000000000), 0x2, 0x0) (async)
ioctl$VHOST_VDPA_GET_VRING_GROUP(r0, 0xc008af7b, &(0x7f0000000080)={0x2, 0xfffffff0}) (async)
executing program 4:
r0 = openat$procfs(0xffffffffffffff9c, &(0x7f0000001140)='/proc/tty/ldiscs\x00', 0x0, 0x0) (async)
r1 = bpf$PROG_LOAD(0x5, &(0x7f0000003000)={0x6, 0x18, &(0x7f0000000a40)=ANY=[@ANYBLOB="bf16000000000000b7000000000000007b0af8ff000000007b0af0ff000000007b0ae8ff000000007b0ae0ff000000007b0ad8ff000000007b0ad0ff000000007b0ac8ff000000007b0ac0ff00000000b702000002000000732ac0ff00000000b702000001000000632ac8ff00000000b7020000ac1414bb632ae0ff00000000bf61000000000000bfa200000000000007020000c0ffffffb703000040000000b7040000000000008500000045000000b70000000000000095"], &(0x7f0000004000)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @xdp, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94)
bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f0000002000)={r1, 0x0, 0xe, 0x0, &(0x7f00000003c0)="e02742e86c0d85ff9782764532db", 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x50) (async)
read$watch_queue(r0, &(0x7f0000000140)=""/4096, 0x1000)
executing program 4:
r0 = syz_open_dev$dvb_frontend(&(0x7f0000000080), 0x0, 0x402)
r1 = socket$inet_mptcp(0x2, 0x1, 0x106)
r2 = socket(0x10, 0x803, 0x0)
syz_genetlink_get_family_id$tipc(&(0x7f0000000000), r2)
getsockname$packet(r2, &(0x7f0000000280)={0x11, 0x0, <r3=>0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14)
sendmsg$nl_route(r2, &(0x7f0000000180)={&(0x7f0000000040)={0x10, 0x0, 0x0, 0x400000}, 0xc, &(0x7f0000000140)={&(0x7f0000000100)=@RTM_GETMDB={0x18, 0x56, 0x2, 0x70bd25, 0x25dfdbfe, {0x7, r3}, [""]}, 0x18}}, 0x20000000)
sendmsg$nl_route(r2, &(0x7f0000000240)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000580)=ANY=[@ANYBLOB="4800000010000305ff810000fddbdf2500000000", @ANYRES32=r3, @ANYBLOB="1748000040000200280012800a000100767863616e0000001800028014000100000000", @ANYRES32=r3], 0x48}, 0x1, 0x0, 0x0, 0x40}, 0x0)
connect$inet(r1, &(0x7f0000000000)={0x2, 0x4e22, @empty}, 0x10)
setsockopt$sock_int(r1, 0x1, 0x9, &(0x7f00000003c0)=0x246, 0x4)
ioctl$FE_SET_PROPERTY(r0, 0x40106f52, &(0x7f00000000c0)={0x29, &(0x7f0000000200)=[{0x34, '\x00', @data=0x4}]})
syz_open_dev$dvb_frontend(&(0x7f0000000080), 0x0, 0x402) (async)
socket$inet_mptcp(0x2, 0x1, 0x106) (async)
socket(0x10, 0x803, 0x0) (async)
syz_genetlink_get_family_id$tipc(&(0x7f0000000000), r2) (async)
getsockname$packet(r2, &(0x7f0000000280)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) (async)
sendmsg$nl_route(r2, &(0x7f0000000180)={&(0x7f0000000040)={0x10, 0x0, 0x0, 0x400000}, 0xc, &(0x7f0000000140)={&(0x7f0000000100)=@RTM_GETMDB={0x18, 0x56, 0x2, 0x70bd25, 0x25dfdbfe, {0x7, r3}, [""]}, 0x18}}, 0x20000000) (async)
sendmsg$nl_route(r2, &(0x7f0000000240)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000580)=ANY=[@ANYBLOB="4800000010000305ff810000fddbdf2500000000", @ANYRES32=r3, @ANYBLOB="1748000040000200280012800a000100767863616e0000001800028014000100000000", @ANYRES32=r3], 0x48}, 0x1, 0x0, 0x0, 0x40}, 0x0) (async)
connect$inet(r1, &(0x7f0000000000)={0x2, 0x4e22, @empty}, 0x10) (async)
setsockopt$sock_int(r1, 0x1, 0x9, &(0x7f00000003c0)=0x246, 0x4) (async)
ioctl$FE_SET_PROPERTY(r0, 0x40106f52, &(0x7f00000000c0)={0x29, &(0x7f0000000200)=[{0x34, '\x00', @data=0x4}]}) (async)
executing program 1:
r0 = socket$packet(0x11, 0x2, 0x300)
setsockopt$packet_tx_ring(r0, 0x107, 0x5, &(0x7f00000000c0)=@req3={0x8000, 0x6, 0x8000, 0x6}, 0x1c)
connect$bt_sco(0xffffffffffffffff, 0x0, 0x0)
bpf$BPF_BTF_LOAD(0x12, &(0x7f0000000200)={&(0x7f0000000300)={{0xeb9f, 0x1, 0x0, 0x18, 0x0, 0xc, 0xc, 0x5, [@struct={0x2, 0x0, 0x0, 0x4, 0x0, 0xff}]}, {0x0, [0x30, 0x5f, 0x2e]}}, 0x0, 0x29}, 0x28)
r1 = openat$nvme_fabrics(0xffffffffffffff9c, &(0x7f0000000400), 0x2, 0x0)
write(r1, &(0x7f0000000500)="7472616e73706f72743d72646d612c6e716e3d6e716e2e323031342d30382e6f72672e6e766d657870726573733a4e564d663a757569643a31323334353637382d313233342d313233342d313233342d3132333435363938396162632c686f73745f7472616464723d3132370f302e302e312c7472616464723d3132372e302e302e312c747273766369643d34", 0x8d)
getsockopt$inet_sctp6_SCTP_GET_ASSOC_ID_LIST(r1, 0x84, 0x1d, &(0x7f0000000000)={0x2, [0x0, 0x0]}, &(0x7f0000000040)=0x20)
mmap(&(0x7f0000001000/0x3000)=nil, 0x30000, 0x0, 0x11, r0, 0x0)
r2 = socket$inet6_tcp(0xa, 0x1, 0x0)
setsockopt$SO_BINDTODEVICE(r2, 0x1, 0x19, &(0x7f0000000000)='syz_tun\x00', 0x8)
connect$inet6(r2, &(0x7f0000000100)={0xa, 0x4e20, 0xfffffffe, @initdev={0xfe, 0x88, '\x00', 0x0, 0x0}, 0x3}, 0x1c)
mprotect(&(0x7f0000000000/0xf000)=nil, 0xf000, 0x1)
executing program 1:
r0 = socket$nl_netfilter(0x10, 0x3, 0xc)
sendmsg$NFT_BATCH(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000200)={&(0x7f00000003c0)=ANY=[@ANYBLOB="140000001000010000000000000000000000000a28000000000a0101000000005e1affd5020000000900010073797a300000000008000240000000032c000000030a01030000e6ff00000000020000000900010073797a30000000000900030073797a320000000014000000110001"], 0x7c}}, 0x0)
sendmsg$NFT_BATCH(r0, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000640)=ANY=[@ANYBLOB="14000000100001000000000000b890c1a000000a80000000160a01030000000000000000020000000900020073797a30000000000900010073797a30000000005400038008000240000000000800014000000000400003801400010076657468315f746f5f6272696467650014000100776732000000000000000000000000001400010076657468305f746f5f7465616d00000014000000110001"], 0xa8}, 0x1, 0x0, 0x0, 0x10}, 0x0)
r1 = socket$nl_generic(0x10, 0x3, 0x10)
r2 = socket$nl_generic(0x10, 0x3, 0x10)
r3 = syz_genetlink_get_family_id$tipc(&(0x7f0000000500), r2)
sendmsg$TIPC_CMD_SET_LINK_WINDOW(r2, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000540)={0x30, r3, 0x1, 0x70bd2c, 0x25dfdbff, {{}, {0x0, 0x4107}, {0x14, 0x18, {0x3, @bearer=@udp='udp:syz2\x00'}}}}, 0x30}, 0x1, 0x0, 0x0, 0x40}, 0x8000)
sendmsg$TIPC_CMD_GET_BEARER_NAMES(r1, &(0x7f0000000180)={&(0x7f0000000040)={0x10, 0x0, 0x0, 0x40}, 0xc, &(0x7f0000000140)={&(0x7f0000000100)={0x1c, r3, 0x10, 0x70bd25, 0x25dfdbfe, {}, ["", "", "", "", "", "", "", "", ""]}, 0x1c}}, 0x4000000)
sendmsg$NFT_BATCH(r0, &(0x7f0000000500)={0x0, 0x0, &(0x7f00000004c0)={&(0x7f0000000280)={{0x14, 0x10, 0x1, 0x0, 0x0, {0x5}}, [@NFT_MSG_DELFLOWTABLE={0x14, 0x18, 0xa, 0x5, 0x0, 0x0, {0x2}}], {0x14, 0x11, 0x1, 0x0, 0x0, {0x3}}}, 0x3c}, 0x1, 0x0, 0x0, 0x40000}, 0x20008000)
executing program 1:
r0 = ioctl$KVM_CREATE_VM(0xffffffffffffffff, 0xae01, 0x3b)
r1 = socket$inet_mptcp(0x2, 0x1, 0x106)
setsockopt$inet_tcp_int(r1, 0x6, 0x5, &(0x7f0000001240)=0x7, 0x4)
ioctl$KVM_SET_USER_MEMORY_REGION(r0, 0x4020ae46, &(0x7f0000000000)={0x10002, 0x0, 0xe000, 0x2000, &(0x7f0000246000/0x2000)=nil})
r2 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000840)='memory.events.local\x00', 0x275a, 0x0)
ioctl$XFS_IOC_READLINK_BY_HANDLE(r1, 0xc038586c, &(0x7f0000000180)={r1, &(0x7f0000000080)='&\x00', 0x80400, &(0x7f00000000c0)={@align=0xfffffffffffffffc, {0x8, 0xd7, 0x0, 0x81}}, 0x9, &(0x7f0000000100), &(0x7f0000000140)=0x7b15})
write$binfmt_script(r2, &(0x7f0000000040), 0x208e24b)
mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x2, 0x28011, r2, 0x0)
madvise(&(0x7f0000000000/0x600000)=nil, 0x600003, 0x15)
ftruncate(r2, 0x5)
executing program 1:
prctl$PR_SET_IO_FLUSHER(0x43, 0x1) (async, rerun: 64)
r0 = creat(&(0x7f0000000280)='./file0\x00', 0xecf86c37d53049cc) (rerun: 64)
close(r0) (async)
r1 = socket$inet6(0xa, 0x2, 0x0)
setsockopt$inet6_int(r1, 0x29, 0x12, &(0x7f0000000040), 0x4) (async)
sendto$inet6(r0, 0x0, 0xfffffe28, 0x0, &(0x7f0000000200)={0xa, 0x4e20, 0x0, @mcast1}, 0xfffffffffffffeaf) (async)
execve(&(0x7f0000000000)='./file0\x00', 0x0, 0x0) (async)
ioctl$AUTOFS_DEV_IOCTL_ASKUMOUNT(r0, 0xc018937d, &(0x7f00000000c0)={{0x1, 0x1, 0x18, r1, {0x8}}, './file0\x00'}) (async, rerun: 32)
write$FUSE_NOTIFY_RETRIEVE(r0, &(0x7f0000000080)={0x30, 0x5, 0x0, {0x0, 0x4, 0x8}}, 0x30) (async, rerun: 32)
bind$x25(r0, &(0x7f0000000040), 0x12) (async)
fchdir(r0)
executing program 1:
mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeeb, 0x8031, 0xffffffffffffffff, 0xdabc3000)
r0 = socket$netlink(0x10, 0x3, 0x0)
r1 = socket(0x10, 0x803, 0x0)
sendmsg$IPVS_CMD_SET_INFO(r1, &(0x7f0000000b00)={0x0, 0x0, &(0x7f0000000ac0)={0x0, 0x14}}, 0x0)
getsockname$packet(r1, &(0x7f0000000100)={0x11, 0x0, <r2=>0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14)
sendmsg$nl_route(r0, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000380)=ANY=[@ANYBLOB="3c0000001000850600"/20, @ANYRES32=r2, @ANYBLOB="01000000000000001c0012000c000100626f6e64000000000c0002000800010006"], 0x3c}}, 0x14)
r3 = socket$nl_route(0x10, 0x3, 0x0)
getsockname$packet(r1, &(0x7f0000000100)={0x11, 0x0, <r4=>0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000180)=0x14)
sendmsg$nl_route(r3, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000300)={&(0x7f0000000440)=@newlink={0x4c, 0x10, 0x403, 0x70bd27, 0x0, {0x0, 0x0, 0x0, 0x0, 0x91446}, [@IFLA_LINKINFO={0x24, 0x12, 0x0, 0x1, @vlan={{0x9}, {0x14, 0x2, 0x0, 0x1, [@IFLA_VLAN_ID={0x6, 0x1, 0x1}, @IFLA_VLAN_PROTOCOL={0x6, 0x5, 0x8100}]}}}, @IFLA_LINK={0x8, 0x5, r4}]}, 0x4c}, 0x1, 0x0, 0x0, 0x20000600}, 0x0)
sendmsg$nl_route(r3, &(0x7f0000000240)={0x0, 0x0, &(0x7f00000001c0)={&(0x7f0000000280)=@newlink={0x44, 0x10, 0xffffff1f, 0x70bd26, 0x1, {0x0, 0x0, 0x0, 0x0, 0x8008, 0x4408}, [@IFLA_LINKINFO={0x1c, 0x12, 0x0, 0x1, @geneve={{0xb}, {0xc, 0x2, 0x0, 0x1, [@IFLA_GENEVE_TTL_INHERIT={0x5, 0xc, 0x1}]}}}, @IFLA_MASTER={0x8, 0xa, r2}]}, 0x44}, 0x1, 0x0, 0x0, 0x40000}, 0x84)
r5 = fanotify_init(0x0, 0x800)
r6 = openat$selinux_commit_pending_bools(0xffffffffffffff9c, &(0x7f0000000000), 0x1, 0x0)
fanotify_mark(r5, 0x8, 0x40001001, r6, &(0x7f00000000c0)='./file0\x00')
madvise(&(0x7f00000ec000/0x800000)=nil, 0x800000, 0x19)
executing program 1:
socket$packet(0x11, 0x3, 0x300) (async)
lseek(0xffffffffffffffff, 0x7, 0x3)
r0 = socket$rds(0x15, 0x5, 0x0)
ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000080)={'xfrm0\x00'})
r1 = syz_open_dev$sndctrl(&(0x7f0000000000), 0x0, 0x101700)
r2 = socket$nl_generic(0x10, 0x3, 0x10) (async)
r3 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000180), 0xffffffffffffffff)
sendmsg$NL80211_CMD_SET_QOS_MAP(r2, &(0x7f0000000480)={&(0x7f0000000140)={0x10, 0x0, 0x0, 0x4000}, 0xc, &(0x7f0000000440)={&(0x7f0000000340)=ANY=[@ANYBLOB, @ANYRES16=r3, @ANYBLOB="00022abd7000fbdbdf25680000000c009900050000001f0000001400c7000701320107030604cb7076c73152e2fb1e00c700f302010210030405f2000006010201043501ffffffffffffffaf00002c00c70002060202020009040e04f80301070d060e0204000203040403050200070201079f743c7d0d3b23021200c7000201710106077abc8b1f5529e04f00002800c700070511020c050206b8020703e20506000303030630056504050307034cee9248fc7f461c1e00c700000001029701040139010700030504036603a8b439d47ca78e320000"], 0xdc}}, 0x40000) (async)
ioctl$SNDRV_CTL_IOCTL_PCM_PREFER_SUBDEVICE(r1, 0x40045532, &(0x7f0000000080)) (async)
socket$nl_netfilter(0x10, 0x3, 0xc)
r4 = openat$audio(0xffffffffffffff9c, &(0x7f0000000240), 0x400000000a0a01, 0x0) (async)
r5 = syz_open_dev$sndpcmp(&(0x7f0000000200), 0x0, 0xa2c65)
r6 = socket$inet6_sctp(0xa, 0x5, 0x84) (async)
r7 = syz_open_dev$dvb_demux(&(0x7f0000001e00), 0x0, 0x2000)
ioctl$DVB_DEMUX_DMX_SET_PES_FILTER(r7, 0x40146f2c, &(0x7f00000001c0)={0x2, 0x1, 0x1, 0xe, 0x4}) (async)
ioctl$sock_SIOCGIFINDEX_80211(r0, 0x8933, &(0x7f0000000500)={'wlan1\x00', <r8=>0x0})
sendmsg$NL80211_CMD_CRIT_PROTOCOL_START(r2, &(0x7f0000000640)={&(0x7f00000004c0)={0x10, 0x0, 0x0, 0x10000}, 0xc, &(0x7f0000000600)={&(0x7f0000000700)=ANY=[@ANYBLOB="50000000cce8426b4b79b93f60e86b922a3db8a5ce1c357ca8e45b1d447c41bc1e0d390f8282be5145978050d39d4fc08884cb07f29351dcf9459afd3f22f1b7b0ab0cc8aca1a85bbef06cc464a9eef6d87c4e0879158feb6387ded6446e10eb757d2f68ed014844168202c6f40a155aca1d6f3e69683dd8a4beffffcf49ce130c097e1a36b6842c4871b121485d49c74313ede6b74c5b384256086a4be81061c829e65539194a5b03211a47b48b9ae85b356c2c6d5f52777968a4b445a86cae39a442dc55200393226f8e5a74189378b88fe9fffe1bc54b1aa5f679c8fddc5d33d3d2c2a6af69121e65de830e4a539dcba90c3808ab61e8e7ad0532eb9e26944b0f37ee4cd3ae377423b5402a5ee1c71b5b8b1e723d782074180eaa4472fcb7398f5331cf15", @ANYRES16=r3, @ANYBLOB="000128bd7000fcdbdf256200000008000300", @ANYRES32=r8, @ANYBLOB="0c009900954700006c0000000600b400f31100000600b400b60a00000600b400360000000600b300000000000600b400c3110000"], 0x50}, 0x1, 0x0, 0x0, 0x44001}, 0x140) (async)
close_range(r7, 0xffffffffffffffff, 0x0)
getsockopt$inet_sctp6_SCTP_PEER_ADDR_PARAMS(r6, 0x84, 0x9, &(0x7f0000000240)={0x0, @in={{0x2, 0x4e22, @multicast2}}, 0x0, 0x5, 0x80000000, 0x7, 0x20, 0x7, 0x8}, &(0x7f0000000300)=0x9c)
write$RDMA_USER_CM_CMD_CREATE_ID(r4, &(0x7f0000000040)={0x0, 0x18, 0xfa00, {0x3, 0x0, 0x39, 0x9}}, 0x20)
ioctl$SNDRV_PCM_IOCTL_HW_FREE(r5, 0x4112, 0x0) (async)
ioctl$SNDCTL_DSP_GETOSPACE(r4, 0x8010500c, &(0x7f0000000300))
r9 = socket$nl_generic(0x10, 0x3, 0x10)
sendmsg$nl_generic(r9, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000140)={&(0x7f00000004c0)=ANY=[@ANYBLOB="18000000260001031dbd7002fadbdf25010000000400ae"], 0x18}}, 0x0) (async)
recvmmsg(r9, &(0x7f00000006c0)=[{{0x0, 0x0, &(0x7f0000000640)=[{&(0x7f0000000180)=""/144, 0x90}, {&(0x7f0000000040)=""/218, 0xda}], 0x2}, 0x2}], 0x1, 0x0, 0x0) (async)
sendmsg$inet(0xffffffffffffffff, &(0x7f0000000000)={0x0, 0x0, 0x0, 0x0, &(0x7f0000000100)=ANY=[@ANYBLOB="1c000000000000000000000007000000890b040a0101"], 0x40}, 0xfffe) (async)
r10 = openat$tun(0xffffffffffffff9c, &(0x7f0000000000), 0x48241, 0x0)
ioctl$TUNSETIFF(r10, 0x400454ca, &(0x7f00000000c0)={'syzkaller1\x00', 0x6bf1c2d5adba8c32}) (async)
sendmsg$nl_route(0xffffffffffffffff, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000001140)={&(0x7f0000000100)=ANY=[@ANYRES8, @ANYRES32, @ANYBLOB="0000000000000000400012800c0001"], 0x68}}, 0x0)
socket$igmp6(0xa, 0x3, 0x2)

program crashed: KASAN: slab-use-after-free Read in dvb_device_open
bisect: the chunk can be dropped
bisect: testing without sub-chunk 2/3
testing program (duration=32s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): [30, 25, 8, 4, 20, 12, 9, 10, 11, 14, 30]
detailed listing:
executing program 4:
bpf$MAP_UPDATE_BATCH(0x1a, &(0x7f0000000400)={0x0, 0x0, 0x0, 0x0, 0x619}, 0x38)
r0 = accept4$vsock_stream(0xffffffffffffffff, &(0x7f0000000340)={0x28, 0x0, 0x2710, @my=0x0}, 0x10, 0x800)
ioctl$AUTOFS_DEV_IOCTL_TIMEOUT(0xffffffffffffffff, 0xc018937a, &(0x7f0000000380)={{0x1, 0x1, 0x18, r0, {0x7}}, './file0\x00'}) (async)
mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./config\x00', 0x1ff) (async)
mount(0x0, &(0x7f0000000200)='./config\x00', &(0x7f0000000300)='configfs\x00', 0x0, 0x0)
r1 = openat(0xffffffffffffff9c, &(0x7f0000000b00)='./config/usb_gadget/g1/functions/hid.usb0/subclass\x00', 0x1, 0x1ff)
write$UHID_CREATE2(r1, &(0x7f00000018c0)=ANY=[@ANYBLOB="0b00000073797a300000000000000000000000400000000000000040000000000000000000000000000000000000000000be00000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000f3000000000000000073797a3100000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000073797a300000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000030002000000010000000b00000001000000"], 0x118) (async)
r2 = socket$nl_route(0x10, 0x3, 0x0)
sendmsg$nl_route_sched(r2, &(0x7f00000037c0)={0x0, 0x0, &(0x7f0000003780)={&(0x7f00000008c0)=@newtaction={0x88c, 0x30, 0x12f, 0x0, 0x0, {}, [{0x878, 0x1, [@m_police={0x874, 0x1, 0x0, 0x0, {{0xb}, {0x848, 0x2, 0x0, 0x1, [[@TCA_POLICE_TBF={0x3c, 0x1, {0x0, 0x0, 0x0, 0x0, 0xbacf, {0x1, 0x0, 0x0, 0x0, 0x4, 0x6}, {0x1, 0x0, 0x0, 0x0, 0x10, 0x6}}}, @TCA_POLICE_PEAKRATE={0x404, 0x3, [0xffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffd, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8000000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffc, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffd, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7]}, @TCA_POLICE_RATE={0x404, 0x2, [0x3, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x9, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4]}]]}, {0x4}, {0xc, 0xb}, {0xc, 0xa}}}]}]}, 0x88c}}, 0x0) (async, rerun: 64)
creat(&(0x7f00000063c0)='./file0\x00', 0x120) (async, rerun: 64)
r3 = socket$igmp(0x2, 0x3, 0x2)
setsockopt$MRT_INIT(r3, 0x0, 0xc8, &(0x7f0000003d40), 0x4) (async, rerun: 32)
r4 = socket$inet6(0xa, 0x3, 0x88) (rerun: 32)
setsockopt$inet6_IPV6_XFRM_POLICY(r4, 0x29, 0x23, 0x0, 0x0) (async)
setsockopt$MRT_ADD_VIF(r3, 0x0, 0xca, &(0x7f0000003d80)={0x0, 0x0, 0x0, 0x0, @vifc_lcl_addr=@local, @dev}, 0x10)
r5 = socket$inet_icmp_raw(0x2, 0x3, 0x1)
r6 = socket$igmp(0x2, 0x3, 0x2)
setsockopt$inet_mreq(r5, 0x0, 0x23, &(0x7f0000000000)={@multicast1=0xe0000300, @local}, 0x8)
syz_emit_ethernet(0x3e, &(0x7f0000000240)={@local, @broadcast, @void, {@ipv4={0x800, @icmp={{0x5, 0x4, 0x0, 0x0, 0x30, 0x0, 0x0, 0x80, 0x2, 0x0, @empty, @multicast1=0xe0000300}, @dest_unreach={0x3, 0x7, 0x0, 0x0, 0x3, 0xc58, {0x5, 0x4, 0x0, 0x7, 0x0, 0x65, 0xe, 0x4e, 0x24, 0xc, @empty, @dev={0xac, 0x14, 0x14, 0x44}}}}}}}, 0x0) (async)
setsockopt$MRT_ADD_MFC_PROXY(r6, 0x0, 0xd2, &(0x7f0000000200)={@remote, @multicast2=0xe0000300, 0x0, "028a3f6c58b274e6d8451697efe42811ee1df06e9264f7d866b1970548fc3c7b", 0x800b2, 0xfffffff7, 0x4, 0x40000006}, 0x3c) (async)
r7 = syz_open_procfs(0x0, &(0x7f0000002380)='net/ip_mr_cache\x00')
pread64(r7, &(0x7f0000000100)=""/253, 0xfd, 0x1) (async)
rmdir(&(0x7f0000007880)='./file0\x00')
r8 = socket$nl_route(0x10, 0x3, 0x0) (async)
sendmsg$nl_route(0xffffffffffffffff, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000400)=ANY=[@ANYBLOB="4400000010004b0401800000000000007a000000", @ANYRES32=0x0, @ANYBLOB="4800000000000000240012"], 0x44}}, 0x4)
sendmsg$NFT_BATCH(0xffffffffffffffff, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000000)={&(0x7f00000003c0)=ANY=[@ANYBLOB="140000001000040000000000000000000000000a14000000000a050000000000000000000a00fffe38000000090a010300000000000000000700000008000f40000000020900010073797a310000000008000a400000000008000f400000000114"], 0x74}, 0x1, 0x0, 0x0, 0x88000}, 0x20000000) (async, rerun: 32)
r9 = socket$nl_netfilter(0x10, 0x3, 0xc) (rerun: 32)
sendmsg$NFT_MSG_GETSETELEM(r9, &(0x7f0000005e80)={&(0x7f0000000300)={0x10, 0x0, 0x0, 0x2000000}, 0xc, &(0x7f0000005e40)={&(0x7f0000003800)={0x2604, 0xd, 0xa, 0x101, 0x0, 0x0, {0xe0ee282bd21ed176, 0x0, 0x4}, [@NFTA_SET_ELEM_LIST_ELEMENTS={0x5f4, 0x3, 0x0, 0x1, [{0x5f0, 0x0, 0x0, 0x1, [@NFTA_SET_ELEM_FLAGS={0x8, 0x3, 0x1, 0x0, 0x2}, @NFTA_SET_ELEM_OBJREF={0x9, 0x9, 'syz1\x00'}, @NFTA_SET_ELEM_KEY={0x210, 0x1, 0x0, 0x1, [@NFTA_DATA_VERDICT={0x34, 0x2, 0x0, 0x1, [@NFTA_VERDICT_CODE={0x8, 0x1, 0x0, 0x1, 0xfffffffffffffffc}, @NFTA_VERDICT_CODE={0x8, 0x1, 0x0, 0x1, 0xfffffffffffffffc}, @NFTA_VERDICT_CODE={0x8, 0x1, 0x0, 0x1, 0xfffffffffffffffc}, @NFTA_VERDICT_CHAIN_ID={0x8, 0x3, 0x1, 0x0, 0x2}, @NFTA_VERDICT_CODE={0x8, 0x1, 0x0, 0x1, 0xfffffffffffffffc}, @NFTA_VERDICT_CHAIN_ID={0x8, 0x3, 0x1, 0x0, 0x4}]}, @NFTA_DATA_VALUE={0xb2, 0x1, "0b757755151d8377fe5c971dac87406743e23571cb981774ac8c7f8b5b8503a7467e24913e6aed7723794af29b1caddb5cbb45f6e0a680d0efa1c6bcaf34893504b67cf8eebf588926302e6d37a0370f9690e156391d0ca592430fe85a1c605e8945b966fcc2085b5e5e87d19629f0bce3ac48edd8fc89dfae8cec5dbe5c0fa959e3219aa454f90d7d376debc425eaddc054876d8fc2b0b0dfdbed8c04d9f6997af963df30c58036f90a0f2ec2c7"}, @NFTA_DATA_VALUE={0xe1, 0x1, "c5c1132e229fdd2cf71fe9c3c93bdf5417cb02e3447aa45ae51c20cee634db57966c07f3a7909dbbba2800123b2c565d469eeae34c39101badbfc93ab7fb48231b6c2e70e6b7230ac5244906a77ee7efda068c839cc5e819d3ef05a9085260bac012ac2fbb9a341723bfebc4e7719dd5c29ba53c57c5aa64c949d6b5beefce9bf3e1b641026909478f39aba0cf9982e5b2779d81b49b7dfe92e19853bd4e5e5c28cd1b8391a2eaec29194a830c70f28641394fc28f5dc0dad7764f9393cd9ca5d33c14f5615d52b338587186f433ccb6b6f8a108bc729e8aac10957f1a"}, @NFTA_DATA_VALUE={0x3d, 0x1, "316353876b23ab09fe0450b7e760d7d16319ae713ceb62537dc2ecae7625e5cb37438b1cb091e0733b26badd3c4c4ce77f16c5997252915b89"}]}, @NFTA_SET_ELEM_EXPR={0x10, 0x7, 0x0, 0x1, @notrack={{0xc}, @void}}, @NFTA_SET_ELEM_KEY_END={0x120, 0xa, 0x0, 0x1, [@NFTA_DATA_VALUE={0x86, 0x1, "14f67bab38b4316d3ef76f35f5673cf4ad29321e6aff9b45c18652526fce067771ce9ef00eaee655232b0be6a49808f3cd65bb71a52ef62fa2aedaf7b3df073bb1653e2988377fb9c53138d9b274fc5e7576491fe23c30c4f2500d1aa9e73abfdc1f0f4202d6457e14969db59655b970bbc83d95c10f8fa3c835a4747aac4519e029"}, @NFTA_DATA_VALUE={0x91, 0x1, "6641e1bd1f58adfc4f0fe91c5fda1e9512b85fdb0fc0b3376fab50eed0e534ce423929ad5d37c890aa822f4ebe3546993597bfe5a293765f6292c1bf0b5aba9f8ee5a7f0046c7d64a62996cc594cc0ddc37c52ab382e412995cb5db3d9819d56e86ea7b639d52c960c022357cf623ab46cb14b3490dd840ed9796efe7b7751e224fb8fbbce2096375e01838084"}]}, @NFTA_SET_ELEM_OBJREF={0x9, 0x9, 'syz0\x00'}, @NFTA_SET_ELEM_KEY_END={0x58, 0xa, 0x0, 0x1, [@NFTA_DATA_VERDICT={0x54, 0x2, 0x0, 0x1, [@NFTA_VERDICT_CHAIN={0x9, 0x2, 'syz0\x00'}, @NFTA_VERDICT_CODE={0x8}, @NFTA_VERDICT_CODE={0x8, 0x1, 0x0, 0x1, 0xfffffffffffffffd}, @NFTA_VERDICT_CHAIN={0x9, 0x2, 'syz2\x00'}, @NFTA_VERDICT_CHAIN_ID={0x8, 0x3, 0x1, 0x0, 0x3}, @NFTA_VERDICT_CODE={0x8}, @NFTA_VERDICT_CHAIN_ID={0x8, 0x3, 0x1, 0x0, 0x2}, @NFTA_VERDICT_CHAIN_ID={0x8, 0x3, 0x1, 0x0, 0x2}, @NFTA_VERDICT_CHAIN_ID={0x8, 0x3, 0x1, 0x0, 0x1}]}]}, @NFTA_SET_ELEM_DATA={0x1ac, 0x2, 0x0, 0x1, [@NFTA_DATA_VALUE={0xff, 0x1, "8578bb23d85636a4e21084c7b898f629ef648626db00b41440e4555f2e68ff0317a359c49504c1f974b2663690dd85e15352bdc502b6a079f3df277b860368c41fdc25fab97d2c2881c12f568903e894f3e8b3bd1707024c7eebd955dec710816be829532f0dc267046d43a9df54aa602225e74c23a287e77f950b4a089189b5245eafdadee809ab8ccf6864e1547b63948520ca0fe86261e492aa84755533dbe3f093a083b0e5cf3e6ee2d7ad10981518fc85c6ade1c11a6de9d65acc7fcbae7aaf65fb0313eeb0c14d276b810160213f6499434886cfa8c84c15b09672ff8f8a7558bb3de6a546fa59ae83f688b2565184e6b5910571caa4fcf6"}, @NFTA_DATA_VERDICT={0x4c, 0x2, 0x0, 0x1, [@NFTA_VERDICT_CHAIN={0x9, 0x2, 'syz2\x00'}, @NFTA_VERDICT_CHAIN_ID={0x8, 0x3, 0x1, 0x0, 0x4}, @NFTA_VERDICT_CHAIN={0x9, 0x2, 'syz0\x00'}, @NFTA_VERDICT_CODE={0x8, 0x1, 0x0, 0x1, 0xfffffffffffffffb}, @NFTA_VERDICT_CODE={0x8, 0x1, 0x0, 0x1, 0xfffffffffffffffd}, @NFTA_VERDICT_CHAIN={0x9, 0x2, 'syz0\x00'}, @NFTA_VERDICT_CHAIN={0x9, 0x2, 'syz0\x00'}]}, @NFTA_DATA_VALUE={0x59, 0x1, "220a7b0b1956ef96fb822d92fcfc3af785ded5afbbf5b66df99b990579b632de6b744569bd43d0bffa52388c086d94f8d7f730c2e3f25559e34508f23e8a41d74f7e1cab836448623ff20c0a3b31e69b84934ed7d5"}]}, @NFTA_SET_ELEM_USERDATA={0x88, 0x6, 0x1, 0x0, "776a886b38f94b05aefd16ec3b4836189629717a2320efed6523043adacce75d110529d97b9c97baa3b5708deac0502ac7ef42ad1ece476b73b0b4ed7364b38591921015110890af6220eeb3ab55d0411d5121003ea643c36693ba6e8f4b5895eff29be828c77e89fb2e5c2a89f54cfa84eb8fc2c9c08b8c508cc277d12ba067f4b76518"}]}]}, @NFTA_SET_ELEM_LIST_ELEMENTS={0x1ffc, 0x3, 0x0, 0x1, [{0x168, 0x0, 0x0, 0x1, [@NFTA_SET_ELEM_USERDATA={0x56, 0x6, 0x1, 0x0, "7a93a54e3d585ad84c42835d163d2cdc86ec9052668f000f28b75667719eba900d02f802677dbabda1bb83d49118fcddff8322419359f6961e7d35d90b34a119277a410a8858f07b28f18f9470f88b0c71a6"}, @NFTA_SET_ELEM_USERDATA={0x3b, 0x6, 0x1, 0x0, "96974fd6db1177905ee99bd83fc4d35f5df8f7e851240c42b7fdcb0243800feb90887c4ef597b0ecf929a18eb2e6abdf23fcf42f9e2bbe"}, @NFTA_SET_ELEM_OBJREF={0x9, 0x9, 'syz0\x00'}, @NFTA_SET_ELEM_KEY={0xa4, 0x1, 0x0, 0x1, [@NFTA_DATA_VALUE={0x90, 0x1, "1ec791dee8e0419af75fd0af10a79d4e69772a2cb4da9173053a6912d1138d637a9bbba2e170f590b79b514830769a5005b382e4d150c739bcc796517fdff9189fd76b2697a956360cc67142867b13a866adaa30b296e559cf5770f181909c6b07a616d937d36db3f65d5342fcc3d81912e02de0c6a855e4af57ea62c19a3e9afde373d7df9b1348ee425661"}, @NFTA_DATA_VERDICT={0xc, 0x2, 0x0, 0x1, [@NFTA_VERDICT_CODE={0x8, 0x1, 0x0, 0x1, 0xffffffffffffffff}]}, @NFTA_DATA_VERDICT={0x4}]}, @NFTA_SET_ELEM_EXPR={0x10, 0x7, 0x0, 0x1, @match={{0xa}, @void}}, @NFTA_SET_ELEM_EXPR={0x10, 0x7, 0x0, 0x1, @tproxy={{0xb}, @void}}]}, {0x11a8, 0x0, 0x0, 0x1, [@NFTA_SET_ELEM_FLAGS={0x8}, @NFTA_SET_ELEM_DATA={0x1164, 0x2, 0x0, 0x1, [@NFTA_DATA_VALUE={0xb3, 0x1, "ed71e0571c90e74e80965a6c57cf5c97f07cc627d3c8386e6bc49ddc8688a1c367e8c33b006e30cae99ce0eb72b34db7f5cb26cfeea2eb645329113526c43104cd8a0b3b7314423042808c036a0be1f64221e2b84f007c301aaabed0edcc94678bf8ece5d4b5eee61ff3a7a3d69a7f490dc4c280d7a3d4beb6eb3ef7a16338ddf0fe42795208be524c0ba699b13193b14203ea13cc79771e0a950dbdcbd4a406222e7b1db71e6ae7358da1aa08a912"}, @NFTA_DATA_VERDICT={0x28, 0x2, 0x0, 0x1, [@NFTA_VERDICT_CHAIN_ID={0x8, 0x3, 0x1, 0x0, 0x3}, @NFTA_VERDICT_CHAIN={0x9, 0x2, 'syz0\x00'}, @NFTA_VERDICT_CHAIN_ID={0x8, 0x3, 0x1, 0x0, 0x1}, @NFTA_VERDICT_CODE={0x8, 0x1, 0x0, 0x1, 0xfffffffffffffffb}]}, @NFTA_DATA_VERDICT={0x18, 0x2, 0x0, 0x1, [@NFTA_VERDICT_CHAIN={0x9, 0x2, 'syz0\x00'}, @NFTA_VERDICT_CHAIN_ID={0x8, 0x3, 0x1, 0x0, 0x1}]}, @NFTA_DATA_VALUE={0x12, 0x1, "1a190a74c96a27d4fdf7155cbbeb"}, @NFTA_DATA_VALUE={0x1004, 0x1, "dae46bda8d289e6c8783d27d52208b2c70641f89e9b5fe51180e125330280978a42657ea7902c5ba34fb03be7ace9c89dc637bb03a53418d5b136343e127ed57324195db3ee8150c5a55bd5b81daa99b82cbd1fedd0981446063c704d8df9446eefb06fe47325d2bcebc7e5411b5808f9cd2cddf9075d1d95282f9977378acef8079e69d1a8be21fc39e655973690ec6d3573be8ffed446b7749c2d930ffac7a153f815309920fd077d09ce8326a9dca37c0988e6077ed29f3f2391fad8ee7ddbef7f024ebc4cbb0366f6716b46f2908a20ca4e4ac9fa309175b52c8c14f89a4336a8cdda5f0195726093e898858ae6f9f4c29913c1cf2c868da07ebe7342beba2aa31cf2ae2a76d471dac9e5ec3493f96b1c406eed617e1c3e83071884b989bb2a56e19fcdd56e91e6293c4665383118a725e5d595c9637b8ae4491b76a808c1d0c13356d3b36e04ef7de9961d7254cd57d7c57eaaa5f7027803f6c48f2bb00b813b3207f7463ee9b30bf5ef554a5bc19b73375690cd039b2575d41bbf978bc900b0298c92c55bc4c06d0b18c3f9f7cde23654bf0439c184687d06927fd744a39e89a6c2a807947d5832ab81c52e165c915bcb16db450e0be436504732b56829eedae7fad541f90008d71832d715067b562cbafdbd602c35199a84406b3b1a25aaacbf631b8463dbb49ee030ac53a9c71ade1aae73bfdd722fbae45acb6d4cb27bdb711c7cabe9cd112ed45cc10703e0a75cebcde1381c5557dd903288ffa2f4bd1072d9d307b30ad1097d79480d4d275f9650663fc936fa6174e806b2fdcf6034842c858c4712e42e0bc5faac1df4af644e1112c8297f1cb521607e5bdfaff3141570a808917e7f4fafe918cd31f2c65d89d9cd57dc57bfcad84f087ffcd49e371a1ac772ec60435b515d7105783551f0bbb3ceb0ab9b1d0b04ab1d97996d2bd73ffa333064ff66d03e35144d099f7150ae77775acc4daab9c870297b198d060d01303e3cae01f9c3c9877b9f4baf3556ccd3ef47f2d7113f924e5fbd961d1e09bffe53abdf6c661b7f31bae157985fa9693cae37524bd867d221f03b73f50dcf200eb3df60b74a7bfe4e1af49810c8cc04c1889b4f3b18f0b329bd4b3ee2f35fb9ab980aac3b734bc938d7251979c3cefb6b4cd413a938cffd859271e25083c02d60bf67d53ba78e4a1d6d91a9f7b432dd97ee44b8dda0949cba393d6ac81f428140bf3d4f0de0e78f174ca2ffd90b1f54846e1976adad0246b87dd246fd2d2d4f2997a2c66e3de9072ea440a1057bc42cffa090e657fb27a47cc4290e4a1613240287821eb08a9ae49ab89fec66c4f3acbe94e93777677ad6f2c4400d1510bc92a66ebd99a600a6afb7d573d6db28793467c0fb4049276f97e537032b04bfe5704966a4a3c7a78e3abb0249b553ff446e6f028d7d63d4e31211a19235fb26e9402be4a5dbdf941b1363f71e41c096698a36e9f8ed6c9b80cc3570c05cc1ffa3a3ffa6ca844f33f018e5f0c251aa39100aa7590836d1551dc009a4024f3f24707e6e86d147ef5dc7a02e31e62ba96b51eacbe46f45476b627294d8dade5c739fb3ea049a3e75fedf68f97b40414b7f6c3e4f21f7599455ce87b1904c45f4862b923e6775dc817eb67fc0007b1f6e4cb37da55960e9b0dfb2d11de1a2001149ffe0a28bf7b3da75f6fd9f18e21dadae643436dab0f12b65bbfb62f6983fef7ada7454b73657a6b70753ffc00632c362aa86500e4b054970e8e5b827c248750232940bdabd6b839478bd18eabf487d056b994efa124fb0c2ac295852aba6d13b3f3e91af778cd4341328265ebb21a75bd550c786a0f376896c8b4cef009b57cda7a9c87387fad720650837d4cc7f9228cc77934799a1a57ed63e68a386df6fb3f91e6e533874acecc44f8aeb0baaaed89dbd2c95d91d20572fe9a069a5eb29788b609eab45269fb369a08d9970fb972878613c7553c54766a1f91644ba23349b2917d659ce22dce01f075ee6b9c619b38186df127b1f05417c3c0241f2cb933e6a143d0d2eac914f19c04eaf8b99c4442787def734d5646f12a136dc73aa2cf03fa4f37419cee212f4c34805e6714afecf6ed26e3dd404b8fdcfc1c216f35fe0a1c42e02d4b94332881789f8d8d7b4493f22349cc10556bb38e58131e8f96e90397e20c118d2ca4bb746e1e83f127bd4e7edd37ad6eee45f1b15ec766bc04263ee8bcf751057041d392460b0b5ebc3d1020f6ac3b3d11236c84a4f4affd12f77a905ee47eb514923b98140b268eadeb4125820ebc09c59800ee5e12d20f6c18828b991d271b8b13b6a83e0beab66819302c24a9788b1c2108faf215de642eb3acc7807f709a2f9377f97e9e896546c54a5d060ee80af87eab028ab6135f8ea9a21e00db05a5a6cccf1aa6df86dac26f52935f89c426607f3c1be99198de81d63f8119c6925aac433d81c2c871dbf29992e7ed6eacdbe14b09ab663845bdaf766910dc6483abf52bb28bdd04ce18540036e471d8eec9588f61395f92bf8ea11b429d1ae3c409b7b4db8d80e634f96a7c2d47048d1c2344876471a3d7a182e8d56493c9509d28d95fbb30ae5e2a92f22ecfa4e9a0a8a69c7ed02e14c33093aedf6650dea283f47759af3d1250e937cd68b10e8000087ac23f54d01d3fc693a260de2b4079868a4d06ca835349c4ed85296e8e04032c5e8321dc6a762e15a0334293ccb35d2925fd22728c783fdcd886ba7b26fbf9198af21cf75e84b70c8061855630423a9532d9c4c2a3b13b70bd4c188475e85e6cd8aa18cb6920413d39714b255b7d14dc2d22971a45f481a05150095c52496f03e7d11762cee50d6aa525a42a104c8a51d9a9e33b7f99d1d5a759e88fd601031674000cee73affc30874b3aa27ab444c2b7dd4a2b6523574c5cd2e494c08c8d301a4fa9dfeefa4820d7c86d777c7e46290b4573d499f2023eb532d5cb52b9ac2edd73693bb84dcfcd6091fc4b128416ec3ddac4ff48cda150acd742d28a99aab2d85f2be8075131e07f21d000931b928d351f7db3c2eea130ed51f0debc63ede775cf3eb7294ab906c913c4122a8655099da056b42376828cd1dd43628a79ef9a3b486aa71680283cefcf004bd90a79af2d1d2db50c69aa46ba6ba3abd83fff435acbd9b221b5834bddd6cfa41d920f79f7eb61c109750bf7a552a1774905f59ff84f2b920d5ad3e5cf05fdd0dcd2b909327b4811e16d6e73b16b6f02311e3594495854e6c635ad306450fc078fb207a9bc40cf27955336d6f3f79ece0203796b23371a6515f7bb36cd321265ae871fe8dd5e8c2aa1b66c2313705b5564ea2b210b564f1e3ad238bfee2b9be6a7b73d58230926f518bc1be72161c8e0bceb73df44cd3bfe5fdb8d30f2c719dfed6d5eb36a8d3ab869ed862a4afc4e18042138b6d1bc83ef579a902419c2b583a80c0016c1d48b6f6587754cf8f8e368fbcb2ffca51b7085c8e6a6153bb14393402cfce31294f8a8b9676a5f0a58800fccd912f4716d71fdd34c2f3ee81a49ceeb52c5899161965d066b7a70d007445da821bf6efd19c8cc37388aab2be8e56e2aa72e1a9d1ac1b70a4c37ab6b8a8123ccd6eb44fb4f73a695987aeed436c19f456bb3686d0e1bf89701a66b7d7cd471efee1edf54d50c3847d69070473e1cf94c16dfa78ebb525f5a96980d86d78e65ae1d8a07b9f5c05b0faf211249b79a6ba2ef3b05caef92ceb80ca7df19d7ba72e7abcdb15830f899a515eda3335c03429501ae2bbd8ef9a022b627ea02d65bda6c7b9e7902136d29b3b10e5df3b873ca964a4a43fb44911de159d94556ef8d083d553add892b1043bc3554d5def443f5ed12b76cd66a1bb9536a3653ec7d83cd2debded5433d7dfffaeb47ea81db58142a5e674813ef2034ec757d1c8fd8f90532d93a3b58cf19bfa7c071448494196fe3fe2a5c0f54cdeb42b9c45c896e4b70e81941696307c1d8383388267b6cd65b2d468519612805800f40df345a78e29ade44af0e3347c13dad1b4c83414c20f203ff6816cbb59616ae52ce36c2e9b566ff41b6d8f7b94e5fba2e7c671383a76b376826bd820206a1c87e22d27db8bacc89d783845d1ed55804653d0b2f15de4a24ef548af228578decdbebe09ad12a05460f6dd263d7f40e98deedf51c153b09618c637bd78e3e0fe01fd421cd4f0dd8b5c16c569a4a63ccef1919c871f1d534c07aad5ee6af2029ffd81d7636a6d500e161f2fc3a12687a94e09a281a065d703b8c9e49637df5e6ec801592e6d0f35c356314380497de77cf7c9996de455ba11232effb10e33e7e461d0d6a3c67fd153a12fad0777fd996d1e9ce000dcc028c9ce4fc54fe5cb07b3fa293927ffc7ba235403af786d326d9cc3e7ec74ea347cdeca4cd406fcaa4c8a8288c1d8a85aac814c26e652f9481ce4e38fef91fa858df0d2d5c53f2b87059abf1d9e8f294a7734123ac210cf5a99c3a426df7093f57ff373d3ff19378166d5aabd0ba870486ce3942cfa85fff609f647d4b331eb7cb761b26b7fb8eb5374ea530eb73ccab7aea27eb931c7098ea4ebe02321dd968bab0c8f1c636452c191bd896f832a02c63bce08e2c068fde49c53eec7b50d23ae96b018f8caf8a33b38b31bbca9dff76e0c9ebda06a05dd0a7a997fbdd094b5a9b89a780a7107d96b4c0d0a9c2ef866b4e98f74d1078272027fbb49bf2ec5e7f5dea27f27fd13b93392c00083cbb7d919a30777bba3f917b5baa67878c146dd710a6019c884de7a707134f4a5b0da048a979a627df261088894c881a6c10b1a4f48dc63f1e7dbafc7fc488129587686a1940f94f97c05bb491a98c34185554c8f0d4b9c73d0d4a1275b8dc1a76c76febd93643e74c733854b5c489a62e1107a7f68acda1589a5ef5150ff133b40e1dd31dcbb8d2feaeb4dc15f17d2197fff77416b2524da8151f773ab3cce1d5afd6933444874b7624551b851d8115a228477e7687ac34181f2ee76c36a12acd1522fd3f307b6f62f0877f424b691eb1e7b33a8041564f55dd2f9bdf88c96c1cab585833504b13d6415ae062a3dae97233e15ba00e13a5acf628474a27d3d111299334803f4b19efb9e3a30dcd0d9b3057c1db02d6bc15c41dbd8762482a7c1973e46034450916d48de5c51fd78fe9e13953fbeabcab9623f00a4f07d0699684a978aeb92fa0c10f96fc939251ad5713a3546bf7b525f6a3951c0b30d14b1fc79751cf6b2515f4bec4e071eb42f75ae1c56bb7b9c6da1128bc3ddd1c5eed15c3b997b1700b4d3b06882fdfc46347f02dd4b776b32bf81525f1662535c1e357098a949ee857d5fe6fb50bc81374f63ad8deee2d926c82c73d099c6b89dfc951d0292cce4cafca7bdc771e8f86d0b4ed5eebccee745b56326af0a5becee77b54927d922d24a72de96cc6761ae99e8afb8af5131308fb42114a1c6e74fc3a3ad31c125f4418809c40ab3bd5710d88144e22e4637ca082ced8c979ec962e3f89d8392fcea1a4eeb0c3b621ee6530f943088664cd7feadcc5b02652239986f08152d967a5a194e109bb0e4a10314abc6b5c82e329d699e1221f934b2a36c09359ea129134ee9b6e30e036351178b69758d833346f61756dc19d41a56ce8843b8c5368810e153060edba373845c729a5795a25755e8c3f374a6bb9c084aea34c76dd77953ed0b7ac7b90d581a5f8cec1f5fcac5e538473a21f130cb9c78081ef8f6c0248cac863d653cf3b765e52301286f863d8d122581a5122153a6d349e780368fb7cbeeab92c2d54e01fccbbb04b09135489f1a9e0"}, @NFTA_DATA_VALUE={0x42, 0x1, "b0cdb67f5faa608948589047b8359f37f3927d50dcfb6390d6cbc4b5b460d92342a8afb3e16445e2a3ac1bf131c850f82ee2985d3ac0ec6a4fe3fa3d06a1"}, @NFTA_DATA_VERDICT={0x10, 0x2, 0x0, 0x1, [@NFTA_VERDICT_CHAIN={0x9, 0x2, 'syz1\x00'}]}]}, @NFTA_SET_ELEM_EXPRESSIONS={0x38, 0xb, 0x0, 0x1, [{0x10, 0x1, 0x0, 0x1, @limit={{0xa}, @void}}, {0x24, 0x1, 0x0, 0x1, @numgen={{0xb}, @val={0x14, 0x2, 0x0, 0x1, [@NFTA_NG_MODULUS={0x8, 0x2, 0x1, 0x0, 0x81}, @NFTA_NG_DREG={0x8, 0x1, 0x1, 0x0, 0xb}]}}}]}]}, {0x10, 0x0, 0x0, 0x1, [@NFTA_SET_ELEM_OBJREF={0x9, 0x9, 'syz1\x00'}]}, {0x488, 0x0, 0x0, 0x1, [@NFTA_SET_ELEM_EXPRESSIONS={0x140, 0xb, 0x0, 0x1, [{0x1c, 0x1, 0x0, 0x1, @socket={{0xb}, @val={0xc, 0x2, 0x0, 0x1, [@NFTA_SOCKET_LEVEL={0x8, 0x3, 0xd8}]}}}, {0xc, 0x1, 0x0, 0x1, @dup={{0x8}, @void}}, {0x44, 0x1, 0x0, 0x1, @tproxy={{0xb}, @val={0x34, 0x2, 0x0, 0x1, [@NFTA_TPROXY_FAMILY={0x8, 0x1, 0x1, 0x0, 0x2}, @NFTA_TPROXY_REG_ADDR={0x8}, @NFTA_TPROXY_FAMILY={0x8, 0x1, 0x1, 0x0, 0x2}, @NFTA_TPROXY_FAMILY={0x8}, @NFTA_TPROXY_REG_ADDR={0x8, 0x2, 0x1, 0x0, 0x4}, @NFTA_TPROXY_REG_PORT={0x8, 0x3, 0x1, 0x0, 0x12}]}}}, {0xc, 0x1, 0x0, 0x1, @dup={{0x8}, @void}}, {0xc, 0x1, 0x0, 0x1, @cmp={{0x8}, @void}}, {0x10, 0x1, 0x0, 0x1, @lookup={{0xb}, @void}}, {0x34, 0x1, 0x0, 0x1, @tproxy={{0xb}, @val={0x24, 0x2, 0x0, 0x1, [@NFTA_TPROXY_FAMILY={0x8, 0x1, 0x1, 0x0, 0x2}, @NFTA_TPROXY_FAMILY={0x8, 0x1, 0x1, 0x0, 0x2}, @NFTA_TPROXY_REG_ADDR={0x8, 0x2, 0x1, 0x0, 0xa}, @NFTA_TPROXY_FAMILY={0x8, 0x1, 0x1, 0x0, 0xa}]}}}, {0x10, 0x1, 0x0, 0x1, @meta={{0x9}, @void}}, {0x10, 0x1, 0x0, 0x1, @tproxy={{0xb}, @void}}, {0x54, 0x1, 0x0, 0x1, @inner={{0xa}, @val={0x44, 0x2, 0x0, 0x1, [@NFTA_INNER_TYPE={0x8, 0x2, 0x1, 0x0, 0x2c}, @NFTA_INNER_FLAGS={0x8, 0x3, 0x1, 0x0, 0x9}, @NFTA_INNER_EXPR={0x10, 0x5, 0x0, 0x1, @payload={{0xc}, @void}}, @NFTA_INNER_TYPE={0x8, 0x2, 0x1, 0x0, 0x43}, @NFTA_INNER_TYPE={0x8, 0x2, 0x1, 0x0, 0x24}, @NFTA_INNER_FLAGS={0x8, 0x3, 0x1, 0x0, 0x2}, @NFTA_INNER_NUM={0x8}]}}}]}, @NFTA_SET_ELEM_USERDATA={0x63, 0x6, 0x1, 0x0, "efbee12d74bdf9defe8ca52cec15aa593bb51ab4ba9da4b7bcd854376a436d21f215f1035ea32c6a26d88344d5afef4ecbb3f2418330e37cf81fb4d0407d202a784dbf1086c97978110f192ff3be7d0dc3dfc67b84a91e914218d4eb3f13c3"}, @NFTA_SET_ELEM_USERDATA={0x24, 0x6, 0x1, 0x0, "7c20c9811e538ad441b430f3a10861f2f308aa93fa20253bd2595332f9d74a8a"}, @NFTA_SET_ELEM_EXPR={0x20, 0x7, 0x0, 0x1, @byteorder={{0xe}, @val={0xc, 0x2, 0x0, 0x1, [@NFTA_BYTEORDER_LEN={0x8, 0x4, 0x1, 0x0, 0x17}]}}}, @NFTA_SET_ELEM_TIMEOUT={0xc, 0x4, 0x1, 0x0, 0x7fff}, @NFTA_SET_ELEM_EXPRESSIONS={0x114, 0xb, 0x0, 0x1, [{0x20, 0x1, 0x0, 0x1, @cmp={{0x8}, @val={0x14, 0x2, 0x0, 0x1, [@NFTA_CMP_OP={0x8}, @NFTA_CMP_SREG={0x8, 0x1, 0x1, 0x0, 0x8}]}}}, {0xc, 0x1, 0x0, 0x1, @cmp={{0x8}, @void}}, {0xb4, 0x1, 0x0, 0x1, @dynset={{0xb}, @val={0xa4, 0x2, 0x0, 0x1, [@NFTA_DYNSET_SREG_KEY={0x8, 0x4, 0x1, 0x0, 0x11}, @NFTA_DYNSET_EXPRESSIONS={0x74, 0xa, 0x0, 0x1, [{0x10, 0x1, 0x0, 0x1, @socket={{0xb}, @void}}, {0x10, 0x1, 0x0, 0x1, @limit={{0xa}, @void}}, {0x50, 0x1, 0x0, 0x1, @ct={{0x7}, @val={0x44, 0x2, 0x0, 0x1, [@NFTA_CT_DIRECTION={0x5}, @NFTA_CT_DREG={0x8, 0x1, 0x1, 0x0, 0x16}, @NFTA_CT_SREG={0x8, 0x4, 0x1, 0x0, 0x17}, @NFTA_CT_SREG={0x8, 0x4, 0x1, 0x0, 0x9}, @NFTA_CT_KEY={0x8, 0x2, 0x1, 0x0, 0x4}, @NFTA_CT_DREG={0x8, 0x1, 0x1, 0x0, 0x2}, @NFTA_CT_SREG={0x8, 0x4, 0x1, 0x0, 0x9}, @NFTA_CT_DREG={0x8, 0x1, 0x1, 0x0, 0x3}]}}}]}, @NFTA_DYNSET_FLAGS={0x8, 0x9, 0x1, 0x0, 0x2}, @NFTA_DYNSET_TIMEOUT={0xc, 0x6, 0x1, 0x0, 0x4000000000000000}, @NFTA_DYNSET_EXPR={0x10, 0x7, 0x0, 0x1, {{0xb}, @void}}]}}}, {0xc, 0x1, 0x0, 0x1, @rt={{0x7}, @void}}, {0x14, 0x1, 0x0, 0x1, @last={{0x9}, @val={0x4}}}, {0x10, 0x1, 0x0, 0x1, @target={{0xb}, @void}}]}, @NFTA_SET_ELEM_KEY_END={0x174, 0xa, 0x0, 0x1, [@NFTA_DATA_VERDICT={0x14, 0x2, 0x0, 0x1, [@NFTA_VERDICT_CHAIN_ID={0x8, 0x3, 0x1, 0x0, 0x2}, @NFTA_VERDICT_CHAIN_ID={0x8, 0x3, 0x1, 0x0, 0x3}]}, @NFTA_DATA_VERDICT={0x14, 0x2, 0x0, 0x1, [@NFTA_VERDICT_CODE={0x8, 0x1, 0x0, 0x1, 0xfffffffffffffffc}, @NFTA_VERDICT_CHAIN_ID={0x8, 0x3, 0x1, 0x0, 0x2}]}, @NFTA_DATA_VALUE={0x4f, 0x1, "0a4da2c47fba70b45668ef0d48d4237a26bedcc3ba666c5a167bfca9c18220499575854b3ad0b670405aa49382d1e58dfa395d46e35f67b2026e61b77b9c10b2db7c8b439d8dfd9711f411"}, @NFTA_DATA_VERDICT={0x14, 0x2, 0x0, 0x1, [@NFTA_VERDICT_CHAIN_ID={0x8, 0x3, 0x1, 0x0, 0x3}, @NFTA_VERDICT_CODE={0x8, 0x1, 0x0, 0x1, 0xfffffffffffffffe}]}, @NFTA_DATA_VALUE={0xe2, 0x1, "e85ed60d26db001b0aa960a12121a7fe7841b283f14c4bd6b1f8656556c1439906a075a5302a20ba2029aa42dc814cea82e544f9f69b193e18a4e5d1706d29fb38064cccba00d1476215b44c92f1425e48938da64a58b16a0e7ed0291bc4e2dd548ab4d2b318e503a3fe973e001d7afd70c5775e9da1c240e51e9ad1eecdd042c2ad7520837f36ae2b31a0166c191932dcc87c7ce0f4738337a51f151eb89a4ff3241ee45d29bde43e29b76aba434fd243539bf1d612957c139976b6b159467983b1d6a8f6a6c9b4a5d08c810fbd5bed9f979c37dd91872e3a28eca6861f"}]}, @NFTA_SET_ELEM_FLAGS={0x8, 0x3, 0x1, 0x0, 0x2}]}, {0x3b4, 0x0, 0x0, 0x1, [@NFTA_SET_ELEM_EXPRESSIONS={0x114, 0xb, 0x0, 0x1, [{0x1c, 0x1, 0x0, 0x1, @numgen={{0xb}, @val={0xc, 0x2, 0x0, 0x1, [@NFTA_NG_TYPE={0x8}]}}}, {0xc, 0x1, 0x0, 0x1, @fwd={{0x8}, @void}}, {0x44, 0x1, 0x0, 0x1, @masq={{0x9}, @val={0x34, 0x2, 0x0, 0x1, [@NFTA_MASQ_REG_PROTO_MAX={0x8, 0x3, 0x1, 0x0, 0x9}, @NFTA_MASQ_REG_PROTO_MAX={0x8}, @NFTA_MASQ_REG_PROTO_MIN={0x8, 0x2, 0x1, 0x0, 0x12}, @NFTA_MASQ_REG_PROTO_MIN={0x8, 0x2, 0x1, 0x0, 0x2}, @NFTA_MASQ_REG_PROTO_MAX={0x8, 0x3, 0x1, 0x0, 0x2}, @NFTA_MASQ_FLAGS={0x8}]}}}, {0x24, 0x1, 0x0, 0x1, @last={{0x9}, @val={0x14, 0x2, 0x0, 0x1, [@NFTA_LAST_SET={0x8, 0x1, 0x1, 0x0, 0x5}, @NFTA_LAST_SET={0x8, 0x1, 0x1, 0x0, 0x10000}]}}}, {0x24, 0x1, 0x0, 0x1, @objref={{0xb}, @val={0x14, 0x2, 0x0, 0x1, [@NFTA_OBJREF_IMM_TYPE={0x8, 0x1, 0x1, 0x0, 0x6}, @NFTA_OBJREF_SET_SREG={0x8, 0x3, 0x1, 0x0, 0x14}]}}}, {0x4c, 0x1, 0x0, 0x1, @meta={{0x9}, @val={0x3c, 0x2, 0x0, 0x1, [@NFTA_META_SREG={0x8, 0x3, 0x1, 0x0, 0x16}, @NFTA_META_DREG={0x8}, @NFTA_META_KEY={0x8, 0x2, 0x1, 0x0, 0x3}, @NFTA_META_KEY={0x8, 0x2, 0x1, 0x0, 0x3}, @NFTA_META_SREG={0x8, 0x3, 0x1, 0x0, 0x10}, @NFTA_META_KEY={0x8, 0x2, 0x1, 0x0, 0x16}, @NFTA_META_KEY={0x8, 0x2, 0x1, 0x0, 0x7}]}}}, {0x10, 0x1, 0x0, 0x1, @meta={{0x9}, @void}}]}, @NFTA_SET_ELEM_EXPRESSIONS={0x78, 0xb, 0x0, 0x1, [{0x28, 0x1, 0x0, 0x1, @fib={{0x8}, @val={0x1c, 0x2, 0x0, 0x1, [@NFTA_FIB_DREG={0x8, 0x1, 0x1, 0x0, 0x14}, @NFTA_FIB_DREG={0x8, 0x1, 0x1, 0x0, 0xe}, @NFTA_FIB_RESULT={0x8, 0x2, 0x1, 0x0, 0x3}]}}}, {0x4c, 0x1, 0x0, 0x1, @socket={{0xb}, @val={0x3c, 0x2, 0x0, 0x1, [@NFTA_SOCKET_DREG={0x8, 0x2, 0x1, 0x0, 0xd}, @NFTA_SOCKET_KEY={0x8}, @NFTA_SOCKET_LEVEL={0x8, 0x3, 0x5d}, @NFTA_SOCKET_LEVEL={0x8}, @NFTA_SOCKET_KEY={0x8, 0x1, 0x1, 0x0, 0x3}, @NFTA_SOCKET_KEY={0x8, 0x1, 0x1, 0x0, 0x3}, @NFTA_SOCKET_KEY={0x8, 0x1, 0x1, 0x0, 0x1}]}}}]}, @NFTA_SET_ELEM_FLAGS={0x8, 0x3, 0x1, 0x0, 0x1}, @NFTA_SET_ELEM_KEY_END={0x20c, 0xa, 0x0, 0x1, [@NFTA_DATA_VERDICT={0xc, 0x2, 0x0, 0x1, [@NFTA_VERDICT_CODE={0x8, 0x1, 0x0, 0x1, 0xfffffffffffffffc}]}, @NFTA_DATA_VERDICT={0x10, 0x2, 0x0, 0x1, [@NFTA_VERDICT_CHAIN={0x9, 0x2, 'syz1\x00'}]}, @NFTA_DATA_VERDICT={0x48, 0x2, 0x0, 0x1, [@NFTA_VERDICT_CODE={0x8, 0x1, 0x0, 0x1, 0xfffffffffffffffb}, @NFTA_VERDICT_CODE={0x8}, @NFTA_VERDICT_CHAIN={0x9, 0x2, 'syz2\x00'}, @NFTA_VERDICT_CHAIN_ID={0x8, 0x3, 0x1, 0x0, 0x2}, @NFTA_VERDICT_CHAIN_ID={0x8, 0x3, 0x1, 0x0, 0x3}, @NFTA_VERDICT_CODE={0x8, 0x1, 0x0, 0x1, 0xfffffffffffffffd}, @NFTA_VERDICT_CODE={0x8, 0x1, 0x0, 0x1, 0xffffffffffffffff}, @NFTA_VERDICT_CODE={0x8, 0x1, 0x0, 0x1, 0xfffffffffffffffc}]}, @NFTA_DATA_VERDICT={0x28, 0x2, 0x0, 0x1, [@NFTA_VERDICT_CODE={0x8}, @NFTA_VERDICT_CODE={0x8, 0x1, 0x0, 0x1, 0xfffffffffffffffd}, @NFTA_VERDICT_CHAIN_ID={0x8, 0x3, 0x1, 0x0, 0x2}, @NFTA_VERDICT_CHAIN={0x9, 0x2, 'syz1\x00'}]}, @NFTA_DATA_VERDICT={0xc, 0x2, 0x0, 0x1, [@NFTA_VERDICT_CODE={0x8, 0x1, 0x0, 0x1, 0xfffffffffffffffb}]}, @NFTA_DATA_VERDICT={0x10, 0x2, 0x0, 0x1, [@NFTA_VERDICT_CHAIN={0x9, 0x2, 'syz2\x00'}]}, @NFTA_DATA_VERDICT={0x40, 0x2, 0x0, 0x1, [@NFTA_VERDICT_CODE={0x8, 0x1, 0x0, 0x1, 0xffffffffffffffff}, @NFTA_VERDICT_CHAIN={0x9, 0x2, 'syz1\x00'}, @NFTA_VERDICT_CHAIN={0x9, 0x2, 'syz0\x00'}, @NFTA_VERDICT_CHAIN_ID={0x8, 0x3, 0x1, 0x0, 0x9}, @NFTA_VERDICT_CHAIN={0x9, 0x2, 'syz1\x00'}, @NFTA_VERDICT_CODE={0x8, 0x1, 0x0, 0x1, 0xffffffffffffffff}]}, @NFTA_DATA_VALUE={0x31, 0x1, "6b70b56686a0bfffe30e015448682e6c44baa0d57e075c532238767f2c752a1b054a3e78a098fecaa1dad15f97"}, @NFTA_DATA_VALUE={0x3c, 0x1, "fe252fa67ffa0e04aaeb17b14ee610b68b72cdb8371466a8c23465f3f822fd2fbeba197598f8cb8f87efe2cee03e48ecda204a1010ea2225"}, @NFTA_DATA_VALUE={0xad, 0x1, "421037841e23296441795384c0efb19fbf54fbd677f06b05c374dbc64d59b2f1f5c8890163a0fefbb29fc28e6c3079eb6ce7fcfca0aacf1a29e9a32ec667bdbc3df2bf0ebc20d7fd969b198f661bce2691bcc71e0bef6cf3b47cc5966b04c3fa2c52cadab68b1f76c15d42e293cd1986bd31d31d0a3b04bba12c39e7e639996a88d8476133a82692b106867007ec00df13da8a24bdfeb1986a7fb28621cfe02411bec1993f8b06e762"}]}, @NFTA_SET_ELEM_EXPR={0x10, 0x7, 0x0, 0x1, @objref={{0xb}, @void}}]}, {0x50, 0x0, 0x0, 0x1, [@NFTA_SET_ELEM_FLAGS={0x8, 0x3, 0x1, 0x0, 0x2}, @NFTA_SET_ELEM_KEY={0x44, 0x1, 0x0, 0x1, [@NFTA_DATA_VALUE={0x40, 0x1, "9568aa9ccefdffce36a8bcfccfa3fe1d8e8f63b63e5ae8a0358f719a2eb48ed724557e7abe984ba98f8cb3efa08ce60b781582b9a8228bb2fe645eac"}]}]}, {0x44c, 0x0, 0x0, 0x1, [@NFTA_SET_ELEM_FLAGS={0x8, 0x3, 0x1, 0x0, 0x2}, @NFTA_SET_ELEM_USERDATA={0x98, 0x6, 0x1, 0x0, "cc1886c18a44d6c61c1874f5c4b90ba7bac788f38136c2b99c2dd21fa1a3b648ec259a20555dbc0af1646e2c36437800cd430ee84338b438479cd68f7420090e29ddb2766cba4f67417656ad4b0d1a0f696cdec479665d820c6c225d13f725370d7d6db10b1eafc223e6fbc09821248995765294d1f160027495ad1c1e5b634d4718f9194f847c601014624905eb772e9ab760da"}, @NFTA_SET_ELEM_EXPR={0x34, 0x7, 0x0, 0x1, @quota={{0xa}, @val={0x24, 0x2, 0x0, 0x1, [@NFTA_QUOTA_FLAGS={0x8, 0x2, 0x1, 0x0, 0x1}, @NFTA_QUOTA_BYTES={0xc}, @NFTA_QUOTA_BYTES={0xc, 0x1, 0x1, 0x0, 0x3}]}}}, @NFTA_SET_ELEM_EXPR={0x220, 0x7, 0x0, 0x1, @bitwise={{0xc}, @val={0x210, 0x2, 0x0, 0x1, [@NFTA_BITWISE_MASK={0x20c, 0x4, 0x0, 0x1, [@NFTA_DATA_VERDICT={0x1c, 0x2, 0x0, 0x1, [@NFTA_VERDICT_CHAIN_ID={0x8, 0x3, 0x1, 0x0, 0x1}, @NFTA_VERDICT_CODE={0x8, 0x1, 0x0, 0x1, 0xffffffffffffffff}, @NFTA_VERDICT_CODE={0x8, 0x1, 0x0, 0x1, 0xffffffffffffffff}]}, @NFTA_DATA_VALUE={0x87, 0x1, "a39e6adce5e513d3f335dd4e50f5c7ea34e0ee4a8ee44be520f1df139d5f9af8c50a771ff7102d295e17ea339d4147ab3236916d47d7bf5736611af63b08dbd639dfaa589281e1cf73efab1e3e4d27f500de0bc2b69be79ad24213e3977b59579de354b64b07eb4670d634b149d6d12a9b026b256b3e2c4320f3ae10b49e284c9343c8"}, @NFTA_DATA_VALUE={0xf2, 0x1, "7414e7baf59a394dc024bb3bb900b524dd7b9d45e115327fd78058996a4b191eeb31245f14d451cb631d2b8c659c1f0a0163eb20241e812068e1248664eae21ad173120a475a52f47c4b068f2ae204412e557c6be474cf4b17b1d4dcd68db714e7d1fee5b2a782df04617724b6fa720d2b3696fcfa9c5e0c5447a6d3c0bc935ad3555ed8551a52123202201a40cdb40982a7787c04849e0e8a5f68092630f574ada4cfb32945a671da8c30c7199ce027c375964a2350507c39d31e8dec084ab595281e7970c5698a8a53c2b42e60b004ff0b3bf230600bb38cb2d69803c30dea5eef90afb0011be2e2b91ad3647c"}, @NFTA_DATA_VALUE={0x70, 0x1, "105ec5abd2c425c299104ce5c3aaf7fdd93849a2f000d2d8323c3e8932ec15b5fd04827d86755c03d78f8f2944e689c723938b9f3a26e89a10c1f8642b06408ecbf299ca31c19f38f988fa3302279bf99e92d08d3f17a3476c5faa7b3cf6fda88199ef23e6dd4e7a24d7fe22"}]}]}}}, @NFTA_SET_ELEM_TIMEOUT={0xc, 0x4, 0x1, 0x0, 0xff}, @NFTA_SET_ELEM_FLAGS={0x8, 0x3, 0x1, 0x0, 0x2}, @NFTA_SET_ELEM_USERDATA={0xfc, 0x6, 0x1, 0x0, "b5ee9204432388b9577be94a2685df5628ec77189a99633f66617ad8255730d2b55ceb24119ed779b984347ed231fd2868af826d05c96df6886b486c9a3cee853e96db521034e3179eda3aadf46907f46639a7c80254e6e24e5b31ba1a94eba1d640bae4e8e4fec9718cef4aa8c7265901b02a018ddaf8f55e7f1db3bc90fb3d3f0bfd81f047aeffbae600d8b072294c499254ba02af2e34512b62dcf3046189482cf8eb7261d13c287e05207b316ef3f172ef855631cf99dd4f165ff58e9b36572dde653da8eee212db3921ea26135526e57159bf4e1f9023b1f242bbe6af47a218077ad9fbdc9d3ad884d8b65d659f292d7c2f0a57c2ee"}, @NFTA_SET_ELEM_KEY_END={0x44, 0xa, 0x0, 0x1, [@NFTA_DATA_VERDICT={0x20, 0x2, 0x0, 0x1, [@NFTA_VERDICT_CHAIN={0x9, 0x2, 'syz1\x00'}, @NFTA_VERDICT_CODE={0x8, 0x1, 0x0, 0x1, 0xfffffffffffffffe}, @NFTA_VERDICT_CHAIN_ID={0x8, 0x3, 0x1, 0x0, 0x2}]}, @NFTA_DATA_VALUE={0x1f, 0x1, "022b5cb817591ddcc8b9bcd145eea7706fe1a7923278dc2686a978"}]}]}]}]}, 0x2604}, 0x1, 0x0, 0x0, 0x801}, 0x20044085) (async)
sendmsg$nl_route(r8, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000140)={&(0x7f00000003c0)=ANY=[@ANYBLOB="880000001000010400"/20, @ANYRES32=0x0, @ANYBLOB="2b03000000000000600012800b00010067656e65766500005000028005000800000000000400380205000900010000000500"], 0x88}}, 0x0) (async, rerun: 64)
syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) (rerun: 64)
executing program 4:
r0 = socket$nl_netfilter(0x10, 0x3, 0xc)
sendmsg$NFT_BATCH(r0, &(0x7f0000000100)={0x0, 0x0, &(0x7f0000000200)={&(0x7f00000003c0)=ANY=[@ANYBLOB="140000001000010000000000000000000000000a28000000000a0101000000005e1affd5020000000900010073797a300000000008000240000000032c000000030a01030000e6ff00000000020000000900010073797a30000000000900030073797a320000000014000000110001"], 0x7c}}, 0x0)
sendmsg$NFT_BATCH(r0, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000280)=ANY=[@ANYBLOB="140000001000010000070000000000000000000a40000000160a05000000000000000000020000000900010073797a300000000014000380080001400000000008000240000000030900020073797a300000000014000000110001"], 0x68}}, 0x20000800)
r1 = openat$sw_sync(0xffffffffffffff9c, &(0x7f0000000080), 0x0, 0x0)
r2 = openat$sw_sync(0xffffffffffffff9c, &(0x7f0000000380), 0x100, 0x0)
ioctl$SW_SYNC_IOC_CREATE_FENCE(r2, 0xc0285700, &(0x7f0000000040)={0x4, "abacd211119ca94c63377526aeb5ab2c7b9ca5fa07558139ede6dc06270ee042", <r3=>0xffffffffffffffff})
ioctl$SW_SYNC_IOC_CREATE_FENCE(r1, 0xc0285700, &(0x7f0000000100)={0x8, "b546baa5cc590d3033de259c2996817bb959ebab028deda501009bdeffafde25", <r4=>0xffffffffffffffff})
ioctl$SYNC_IOC_MERGE(r3, 0xc0303e03, &(0x7f00000001c0)={"0080bced01eb0100000000000000000700000000000000c900", r4, <r5=>0xffffffffffffffff})
ioctl$SW_SYNC_IOC_INC(r1, 0x40045701, &(0x7f0000000280)=0xfffffffc)
ioctl$SW_SYNC_IOC_INC(r2, 0x40045701, &(0x7f0000000240)=0xffff)
ioctl$SYNC_IOC_FILE_INFO(r5, 0x40103e05, &(0x7f00000003c0)={""/32, 0x0, 0x0, 0x0, 0x0, 0x0})
sendmsg$NFT_BATCH(r0, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000004c80)={{0x14}, [@NFT_MSG_NEWFLOWTABLE={0x48, 0x16, 0xa, 0x801, 0x0, 0x0, {0x2}, [@NFTA_FLOWTABLE_NAME={0x9, 0x2, 'syz0\x00'}, @NFTA_FLOWTABLE_TABLE={0x9, 0x1, 'syz0\x00'}, @NFTA_FLOWTABLE_HOOK={0x1c, 0x3, 0x0, 0x1, [@NFTA_FLOWTABLE_HOOK_DEVS={0x18, 0x3, 0x0, 0x1, [{0x14, 0x1, 'geneve0\x00'}]}]}]}, @NFT_MSG_NEWFLOWTABLE={0x1c, 0x16, 0xa, 0x5, 0x0, 0x0, {0xa, 0x0, 0x8}, [@NFTA_FLOWTABLE_FLAGS={0x8, 0x7, 0x1, 0x0, 0x1}]}, @NFT_MSG_NEWSETELEM={0x3f28, 0xc, 0xa, 0x101, 0x0, 0x0, {0x1, 0x0, 0x5}, [@NFTA_SET_ELEM_LIST_TABLE={0x9, 0x1, 'syz0\x00'}, @NFTA_SET_ELEM_LIST_SET={0x9, 0x2, 'syz2\x00'}, @NFTA_SET_ELEM_LIST_ELEMENTS={0x3ef4, 0x3, 0x0, 0x1, [{0x356c, 0x0, 0x0, 0x1, [@NFTA_SET_ELEM_EXPRESSIONS={0x22c4, 0xb, 0x0, 0x1, [{0x10, 0x1, 0x0, 0x1, @fib={{0x8}, @val={0x4}}}, {0xc, 0x1, 0x0, 0x1, @osf={{0x8}, @void}}, {0x14, 0x1, 0x0, 0x1, @byteorder={{0xe}, @void}}, {0x10, 0x1, 0x0, 0x1, @payload={{0xc}, @void}}, {0x213c, 0x1, 0x0, 0x1, @immediate={{0xe}, @val={0x2128, 0x2, 0x0, 0x1, [@NFTA_IMMEDIATE_DATA={0x2104, 0x2, 0x0, 0x1, [@NFTA_DATA_VALUE={0xc9, 0x1, "70f0f4802ca460d27debee00a8493ed54ce1ddfa554c08d1d9e5b9494605f2681caea4ecb5f5bb9d73cf85d2c4430ae1a3d88da74169c1b9274397d28cac8bf67bf954222069f9880c064b4745191f2c39c15de7d4454bfca6ef0db506756a1552321382aa66246ff0fb0d916d405a38c5b72d023b3434b8541d65eba4535a812c7814fe1242ff3866c279fc6c5a2607cc4b4786ab9267a3c7d83a1a378d9b4313c551a1fd312218eb807c4fcce2d94c887a247d9ad3c3a1975524d8d06c87a96ee45aa4ed"}, @NFTA_DATA_VALUE={0x1004, 0x1, "ca43a73027bff18958f05837b147ff04182787762ac38f8eefcc65a1c864455c3d811a413e32c35e6303f77738c77d2b6f96bcba392a8c1868d10aae545b93bd204c2e6f96c136b82a23a9952694b70389c83d4b9a9ef0ce8b9b51f9dc0e0ed6815f3bdc849a34e9518c3aa949ea1ef5857aae93f677e31a74ea9dbbe9c21c204695415238f38da6743492c61cfe365b4c6b121f4e0bb93880920ed4f35e7dfdec3fa12f84e95756a0d47a005428f7ad27ad7e4a8fbff968ec64a5d71abba93f940429a853e7c497f8d0744256cd55517cbc2a808870bbc853d9aaaea73e4e53a10e72e1a42b0fe9d767c643dda43bdb731f396ab2b702888b5969c5c6b4378f0523a7b0ee2344c41868e0496fd1dad21187666edc582820003b4c3ab5e488d7e75ff6c77c6bed91406e2bbb00d93c62a17f64e2e425b3f36f54363dd472eda8f8a7e9628ed94846f510c65d330153696613433f39505e07a468c18163770e20db9fe2b72061acc34b58ff71d68dba5d98b4b38669eb3592775013a4822319812984dacb3e0fe82d2e857a0425cee12758e34906c329e70dd21895654307ec370396a9e76c30e9b38ecc9be0add918c643f231094c338d430b968f177324adc9726bb860ed674ca1a955255efe5e527bcb40901f234d3ce7b762cafd4f5d189c9795db57b94acda29d9925a654974c035a17798733d63e91933d8c3533d9b2cd48b379723069e404c3c08e2119e4192233587e29dc673743d75a6719b0314bd73e6cad6e3a27a0aecb92a2ef018e1fa30e74fb3ada42bc8e8e729144a780558c2e8358b06b5f49308e4217d7d42997c579642e92d07233ec33ea89cc7f0f3c1eac0d446afe2ad9b7f8fc9f73c8637b274862160c7bb0f09b8fb0f9c8d61beaf8deb2f6f2b82d4a98956ec74c6bff4f8917e63f14f6cb2851ff3933ce5fb88b02738752e0c7f9e212317badbcf9fb0a75ff40e144865cfe744fe0c677eebcaf99257fcfb6a3801cdfd0463fd9029119324421feafd8d082c18b46110e211a7e99110d93c813b1f3b01b4a28e6fb85b86508aab5296272824d34ab6d1904d2943843fb47fe718a2ddf660e3ee05e2b87d97bc7fe09312ad2d0696897a8dcc323ae275c01d111a0fe30134c9dbee60583c79369ec36def5f0f48875404a2d50e1c0b281559f65ea2b94f654b56fe8e25cc8ab67ee0a676de7d58af707de8b0bb99de921151db515374c541434f99e5ae14da5137c20c3264bd9f244375457513a63863e2a93776841300abb6bfaa1137e8b774294da186b21b9edcbac9bbe59a747300048ceed3e111e61c59667d0b321f215b7c68c302601867af2fd1134081ce615e1f801a5322049cd4f519c05a819474ed90538a2d912942fe3eac2fc1b1343b71fed3dbec1feb146064a36dd0242d67c5a1357f2fbbec6c9b1af6ceee7bcbcfbb29121594c25101acf8b1bf21d98d82b74059331ffce3975f626b1040cf5fa453428eb717ecb7b268ec795062e3fefefb77c241e4e87b692dd49ed1cffa21b5d6ec0a580ac988d8dae1b95e279543cd82b098876a37cbfd2838ae9499aafa47c25da1e744c72aa95181921c2a52eedf5674af184ed580ea7bc2ee52be93220ba5281b74763d5166c953339e376f449d7817905d634f7d0a29cff137bf69fac0fcff30039619cb0fc05a280c5561e21ac5e931840202a4508eb9216760cd1ce005a21c5b60adef9831a66c674b03064482cee74b296cdaffac71728b8f0a0f7f944ccbd66ed71a803f72f55c14ca42a29f733e308e712fdea79d4aaee6905b65dce3adb51d40eef42766ea967f95dbbfdddf6177e58c174f0e0477ad7a1b6be57fa2ba8134ede9e7fb5cf28421e3f391b43e300bcf33f57c2379de8af84c850fc828090d512ffa300bbc44472d564abc51298231802facd39fac7206776b297371f2a7a13a382e2ce1064e914d0742b6c7a2e0b49461cdb132cc1f6e5e6535649f6385c92831d6c5a447a14eaafb0c68aa78860ad37575e8bade06189c437a6cb2c21deef01c8ee24570be7f5d7bf4a14fdda5a6e203627a804e32e8c7ff30842c17c482e786d7f5a3de53070585a76e27c7ae4ec01e3d03eba6fbd17af13b6a373c066ddf3c6d76b66c1b93b367b173a8e1ee42987a75f74af92eeaf6993d42b72c520221a0574c381e1a55d105b1b6d245a6b02535b89e24088a2b183df729df6df9c499ea18ec3427c4d22f0e904975c33cd8226e30d826977cc445662f7590981a2c2bba4865d0d6d7aebf15b44ab10da738b94d9c855b027b32c2e91605d5734f2703e13149dc515b93d004edd0c3cb25c79e2dcf7d8f4c169f509cbb95f94669f8a14c1436adac2c72524d5420dc61b56aa1a39b04aa33296138dca0e354a4d090c45c5e50ca743c2dbdd0010d2d4b598816cc19b71af405482a57c3b70ee1b4fa6e0cbcc40c125a6d4ba6ce86f8db300358786143c88221019a37815c96433c148c118506671f352340bf9ea381d78969ad4c369736a793cb0dae28ae72d8f5846c538a36417305844ce8a3f33be8b06414d5f0e60559757b22fdf5b758ee91175e04ddea34806fc53e1e8289f8b6a9132174e9c55db6a353dc3e8e349631a99baf3cee604b1bf3918e9818bee8cec8989d4b88fff32b75ce4f0a7b913e6eb2b479a841b3ec4598fac89ea8f3d546eb34a31b203f4e43fed5bf4bea6d837e5c5aa58805bada81d04873543e7fd42952393ca6c847a07c2714ced75d2c58e56f169aabe3a6b0fe8a46c78389021cd6e650b0612fee0d3c7ab398d75382ffc4fc93c044e8facd5985525f6d0e8b59efa6495c3bcdef801b80a8c2811b5dfa7e9458353f3e059b79c0dbfca6902bc51c4e0f9a01fa3fd46d37d176cb2c4175afb679863c2e8c07f526e146f25f788c187fd787cece0a74746bcd737d6cc01af07b97eaecdb94b458508af0da5c1d7ef73d51359b08b9913061dac67988c9b5ff14785f9eeb9021795a56bb9db22726848432161524396979f6ea3abbdacfdb3ad0ea38f487c10e1d8156c3f0b15dd6e51ed7ea323665bc6670a128bfc87861cf1b851ecc07646713262dd45f956030b0567ec8d6502c52474625be92c9cf07ee557de3750ca91e882ae63a73121e2a001e285427214ea93c214d3fdd996e755bfdfa31e1ab0c3f68d05ab876b8275e159c9ab18fc27846e3e8e5ff1b02f7c1c3d8479570626b8bac9dd2f616b1e7cfafe9460bd033e848b4eb09a8ad89e4d095ad026be852c4a4109ae5b187c8498cdf27dd359fe349801d4d41490ab95e6a3112edd44482da2cded1a7743204559b4b03d4004c309426d569fab28226e250bb1bb972ba917fd8d653b29a551d1a913f68c1c496262247b5345804e44c24f01c08e085905b75ac6efe33c2debf16b89b9ef5b039da8d1a8388a444b9b80a3c780c7cecb81c7af62c3baecfab39b13f0ae23cfa0881552b0a76f25c62842b91da4c05bba746ab4845e8c4bdc751a29dc086e2b97c74ffc4944669e0b604507cdcb487c095db1d843226e9dbe8d17ea56090a1156220f9402e3e8f9692e43b95ba703212c74a9cfa172c6c3a3d8ae71123fd14ee6db812e7b2c15caa53431acd2ec673e1ff86f4d6c30ba29d31af96cbc6e66d639bc65ff12ec423bd151ab81e8962e8122e8ab093157f9cbe4786133e008a6f29a22412e5ad87a4288f9ffec43fa339034e51cc0df7a1669152bdec0e9ecaa5bb6cfa75dd00b7da7dc69692ba47b8eefdf3123e276ea68b5a545cc84d7fe390af53aacfea082c71b12faeca07242379d28bde8ee57b0e898ea0d7270169c93207e571bdab680702184874ffb0538331dbe5a8b2ce756122801e99aaa0161c622aefe0a0153f30138088873ced7ebacfd7413d730d45eb1a6aa203eb359bb4aeb9f70b9773f4e34f99a451334db0e5bf6d1cd6881c664c12df3bf314ebfc39391862e3ace4303ceafef40c82d56691d089eb06d6ab12990bcfcc716d1adb571a9b033e3020f8103b80369014f2c9b1285f1e9805b8d1797caa753c68ddab141477d4a6d1947bfb6ea7c13f57d716582fef9c1dbfcf73708dcaea776faead85af1947269a80e9015a142b378e71bba1269e0e21ae8677e6695246102361e224fe7ee13ca24b64bfef8603b2c709506db7d5322dd7aecbbf90b3b5754a051b0833c6132ff5545f65c11ba59327e21d233bfca9654a840f1aa1573563062f191557c7f217f07802dd7606cc4399b6b906a20286558d0f1372f2f23f9f4fc87c647b09b1ce47f695fa3fc412ac405332089166d67201c3bfa3a2fad355904e2ffdefb7ee71f1928368a875635794ff3801f4e06f1e3bf2cd04eaa250a69a535c595b4cfeeacb6ae18c89c1d41cfe39df6327b07610b27247d1fc1451a54585836ad68a7017e823e751101f8ea0d2134ded26dbc271a0e8c0d8359c32a8508bc42b468da7bf057280d02ad10df5348e6521779e904bfd6d8c9b9e8bb3c20355682914b2646e22cd4a9ba37e6d0e2eacc4da372d0991dfb7cb016e371c16e0c783cf9769f9551375267fe81053b44989a8441b7217df2dfd05b60713c98191c6acb2dea8f71f424b4bd99867fdc81d5de808134aea203f5f1e8e27ca639481199a49a5f5ad464f953b95342290f9a673fbf64706d830b3c3052f88e0ab49bdba2c741086d8941d69cac1bbfb6fc315e3d151c9c560a14076f3b5e8b70f0e07bb0b9a3cd4c10f237b22d08573398d84190e2c309c8a71f811460bf72bc5cf5289fe7e2d2ecc1d94b755977b907594e3066b32c7e350f8244e700a304c12939cce5c870599cf6f55e125abd72998b58dc72da4b531847e5a280b9cafe7526b001fe58fbc7accd06cf57db81bc52bd8b4cd168078235a6a16f446c73618bad5dbd9b0e9521bc3db365bb329b93f7673fe072fb3bf2377b91496f5a43ac287b362f70f576d52a8b25016fe5fca325b48035d77d350ecdaa595ba21a52bee88213a0f72e676f4878c7b941f0e143b7d2a9de177521ee82374f51b44cc58f997eb0eb17c2fcc5a26dd950328c63b2e73c33bcadd6870b9ec23281c846c18f16e75f23f092919cbed5119435469bcb4faa8c4b0b1ad9cb33a5e1e46fe15c2b5127956007d8925e26ad2789e1b85d009d8162294928fe50390cdd1545b08824ef615e302f45afab655529ab7b7287f93a3b792c4d0417764a7fb6222e6104e37c03308ea2078f1b42c5fd94ba4955e74044094df830d30329b8f42b4d779dc7d7a615e4827ed1af83b329e0e5566d6b4c98cf929c6e7b5148d74c3f733e8c5ebe7d6ffb232763156d27d2b9567208538b7cc41d81876e60daea61feca28ceb8df45ead7b768c95b54b0d62e045d52398eca6ce0ed9aa038096674436958d4520526df221b11ecc183d46fa1b8b3cecacbde164a70587a1d43954ca9ab93fd9f4b00599d88dbc0177c92e6e63e62cd416c97bc3da371c73f3fc1cb037d17c3420598bb26efa67a34a0989e349ec223863bec8fd4206c4800e131e957dbd94667b5385c04f08a306cd97ae379c261703f2120bf9b464ce106b5795d98e6dafdf8ea1bb629e6f0d264873db6685036b9377b5545c170661157c3624712f47abb1144366da935da02bfc403036984c530a52025d67c98aefc07bf06f811e0895a2f958565b45b0cc818483d355f9931b026e91659e1d56e7a7c5d52c9537320717d793c7ec2757d4f1b2de1b9b9d94be520766b91bb3fbfebfe01f6201b9a77bedde6ec8808ee83bb5d76bccb2f7604ebcbb94407"}, @NFTA_DATA_VERDICT={0xc, 0x2, 0x0, 0x1, [@NFTA_VERDICT_CHAIN_ID={0x8, 0x3, 0x1, 0x0, 0x4}]}, @NFTA_DATA_VERDICT={0xc, 0x2, 0x0, 0x1, [@NFTA_VERDICT_CODE={0x8, 0x1, 0x0, 0x1, 0xfffffffffffffffd}]}, @NFTA_DATA_VERDICT={0x14, 0x2, 0x0, 0x1, [@NFTA_VERDICT_CODE={0x8, 0x1, 0x0, 0x1, 0xffffffffffffffff}, @NFTA_VERDICT_CODE={0x8, 0x1, 0x0, 0x1, 0xffffffffffffffff}]}, @NFTA_DATA_VALUE={0x1004, 0x1, "5a7b15ae77d39c1195fd6befea53816351bd04ebd8a6971c32eb6ebb811ce43f8c2da4e8f40ada7895cf2e0bfcacc083f086268044af2ed8e9a0dbc60e92df82a64da27766c244c0bb060969222649ad620a5f11b54c9a03c43704eaeb29cb517b5893a65fb6d1342b3bcca119491a0de91f067e5606c1475a625de8b273836883956a0eb2b2b872821398fe5f63c19d142d2a1aa4fce9648abd425be7849cc808b1c2838976f3498079d4210c07307713bcc78b4f1339116e6fb12ad7057108e30b76b57e24776ad40334c3fb3e6d0363a94829402a79816c714b0fce7351044fea740b1e8f0dae47088e0b6761e45d6116683ea3ed99e4183e3f9805f2e653cbaf80305f264e0c43ea762c4ae564c8b160a2f4d092e488d318d1db90a306502d1c9b1a3548ff113a7580bb652dafe1dfd72efd867ce59b8f126214f13a0f8ec55c1ee3bee721f5172861a7ca8baaa3c5abe65d9d5669bef45b9fa89dc0e86d339df6eee5d5b9e203a669ed42c70212b83090f0aa4f4102a004b5af1bdbaa8b4d0b40c61a9d53a34d0fdcba80994d81616eb0213899a28ad60a514f67b09a7ad590836fdc1462fabc4d1f896ddbfe58da4ce82f2cbf51f509457dd88b91cc611c33e29d08e7c236182d75a93bb88fcc377890db6ada303f821d416a2295701e294cbfa20b1699f3fdc9c415634194c281c927f2cd940c5dca74ea48c541adca7ed781f9f9e2ad84e21a345fb3a06aa531b29b09384ea90a6abaa7425bc1ea50946aa4a946ede9e8ac102deeba8c9f6647741ea8a1752f2eb6e3df1777f4d6e60534a3652ea13ace2a51e8509ef2cc304488dc56972af20206d02fddb3beea051fda595d313a68febc604a89fc1f233a2b3889cf957df2eccd7161eb0926078f405c1985fa84c8d6d1ce10b15bdb5f9a11748b847648753c4329d6eb4d601bf3cf04e517e37c595e91e0737375b15dfd8435a138bc76182732c0370bb3392c7ab06df347e6fef37c30d5e69621a59fb68123b239a4ca2f1c987515281dbf201261a287438d224cb3521a1ca1cee433844c5467639ff47b23b14024ab99ff0a9c74444db068c1dd8dd69f95f650f6b8c0874563d10d33f31bf394440c6525a84db0a8681a2db0b87e0e9f7da381c9c54df9dc94e5d4bf6e5559f720fc620b90ef51bb7f3c38af24763645ee46795c5237fd6d724652c785530d69e9ee42844698dfc4b93b7de53636ed7cfc7ac218869b65c2cf29f015c33b178d3bdb2d036f5157c653bf17958e2c614e2dc619b908e6666e5a9f02df2058e933e302ec6b6a25f73057496c973e8c65a5d0a076f704e19eb562836e4d3b4eb9308911345d1e909b7b24870e75591bcd9bae79d2b64be5aa415d9d9727009481e6840172cb30edc1c2e9cdd6f86d7d2b753096c16a40828012c3bfdc30ad23bda4698351695e0914cfc3447801ee3770d0c992879857e4e95c737a70b9b6e6d2537720881c57d5f469e26bb8cf690c48693e80c4f4f1e0c64183d2f45eef3a9c4f09a038f1e7ef9ab87f9ffb6db36c1f1e0d833ef6cd12b978ae4dd1440cefeb218eb3872726d00e7f676c29004b686d42c89d8eac2a784a7bcef18926efa1f094bf583cac681a060a6c1517d9fd6f4c457bf567cd69b7c5756ff43547c3450f4166a4bbefa00d1a0ad388403cae4aa9d28381f4b99baeaed387ee735e99445d9582845e61fd24bbf71293bed64bf7ae04ba8530579849c9244bba040061278d2f87b7a0d9458b42c4c657225ffed2629198e0ddd26642614c475f154b35b1a702607df7dd5d0f86662aa73b358f3e043117df35af66e33eb6087fbb902820f7a8db7cccb4120851dca359796436e7bbb9ea98c628d2d8f8a7a38736e8eb02815d915b40e50653824d8411f441124255b9f1d8846b753343011c1e93769164ac44c9a682489342560729160eaed2e28e8117dea940e7ae157150749f1d1b3ffdb24e2ec236fadb20b296fba141a4fe416e38402101f961f79aef40d5862f56676c42de01f8bdba7345b2a7a35abefa8afe88df000d269e7a8d502650c68fbbb393c0c6063b517b73670e04d4aa9487c1590f459ce5fc62e68a2102a881126284eae0e888a0a9ef101ce3624f932cc376baf6a071a8c0acfa9c63c93743b7e7054693854b47f75d72b996b3f653d89a5777a2d775fbbefcc5e8e998f47684496f8d424b3c533f025f623d17f514acf6bca522ae321799bd4aaf7a3b8079f8b7ce40ba5d64f715949be174797fa3661778b1f453c581678766450d6042a265d0e6bf3c4341e3748a030646952082ad013576d6513fda2d7c9fc98199d0c595a43606a1a0fa0116dc18f8dd0944092963a83b331322b417c01ca4848a5a917c404e4b0f703209f0931a7639eaae89f24e7574ef81d4cf0a7632219283ecaf49a91b18b1100627dd351de1fa7a269c2ffcfd7c304e7231b49cf74159982ac44c851b80b24cf105ff036c52a038dca5f05fa800e047b5f2576f64801019aa13d83c05dc5eb18f12b5dbb6ce25a405e58d61b989c8883ee7f6a530f9a8091290973530d9fc0138721f7af4d77ba76f3f6e334d291373a3d49d0926aa1d4217573c3925435dc28878a2dc8110069d9a7e4c5a486621982fca3976e1e24189c4b4550d1ad82feb302390eeed90ec4896d1e16901fe9e72f2a7c6b3410b86012648a2a5aa10f3a20552e37e594323fafd07ac505d209f68c8cdd90e83bb8013f1300caac13a9773f82908990ea1b579cc6cd4d2f93f2394dca83c33953795cd603fee9f923f1b72c96711607e5b38a132be92d82a33f65b50eed5f3a76d569a9742db2caf4baaf3856d0cd54f8d3dfbdacfc28df453c1d34dea67f79d5c9376be0bfc58cceadee13f73accab41728b373680d623a8dbc5fbfb6b0306807f4756a95a040f4794fcec39062690d3ffd7cb4a617598e401e98e635d5060415da232882a2f21d2d119c134dc4ae250a0d6cd5441bb2f41be3cf6b48249d78e5d93ee0526651a1dbeb6de02727ac30779537dd9c4fac85bcb0a5e6ef2056d6d728e0bf1a1a50f6434adbc532aa25167e227c16d23f5f4bcdbe26ba9e102d2ed47ea474f6be7a91187d035fde6174f0f834ffb75847845cb68d5cf460b06edf1b01f71b313dba913682647751323f3adbccb54f0e41231569905b4df7e4b02afff50966c763c8deccd3f15c66cbedeb84769aa3c0a68468e25fcca89c2d2979d318978c571010d803c4f3dc3e7e816ed74641ffb15971ccbb6bb3b04ae9dfeb479a1463bc12297bec9dc2869decce1262811b129a929ebd25c8c200782d59aa66d72840002c33d9408c109ee6384158a54eb7c919e14af3fd75c78e6abc282e3623b780ad81218f52cd73e12023da6b9d89df236db41fdb69642a54d6cd57a6d881a7c875d27f8681bee9170669142e527f98202d4e687a0ab6eeb0633bd0d033c13ad4520c64a2a890469e5d7a923e35711922c05006e1b3b0adce995442573182f9b40d65625c8ca1bd80854e9efecc6498c8fc9a3eb830a8750c3e04734bc1ddf3fdf2b3ec34090c95ad31753ef34dfaf3101318c0e87d349cbf36754fa96c9868caaf6a67beff5557f6b0363cca2f4de40460290a4ffb98a19b197213b903a5a781ee50ecb0e72e351bc1aa683b24e8ccd2f5943d5c7247eeb15c90933b68fc185dedc641ea67184d2f0c4d7ce6e761b2f8028d20879b14dafb05ddd69dec1b0cc2c571ad35d2deb53a3a34713f56ea96208d10bbae4bb28c2a92518ce16013f475c4aea8992b3728bbb63fda97a454354edfce60bfa51aa41eec0c6e290876a81ac2206b968ca6c93b741261dbdda0967ff00500808678fb8fc2faf3771873516b8912f2e2cc2091d4f54585baec695f9604b9ea1f0d3188ada0db257627ad23b3e34d9182030b6ea7b6641bf26d3ef3c53c51feb9f22fc634be5fa41271f16fe9ce8daad96681947a21ab6647dd6b4fc11233c71e4b5c4ab8a71e1657cc276815411bbb41d26010f2ce59acef86b8f4b5c211665540427c2c0072d568312d4f9436bd730a3064a3547c4a7c18b203a0d804712f234934c0ea5d35c750ff7fee09081265244b8ef01879874bade42d1abe1c373e69a1858fff241a20b9da6b4d5333b68ca74b0e3929166063ee627c258e07626cce61ee37a0e810ea416ecc95367a13a8a14cb5b88a572e651377bf3fc1fb0d13690b533434f89d4097fe952044001194534ef9591cb29c659101f896bf20a8ee5b47f77467a24deb5d3b9332d56884406cddf6498e16b50977f5bfcd51014bc79b39f1bcd2e287344fb3a81346d2a1f4a74939cd23af509dd9838a14303ad56e5d8a134f2dcf640298c9d7205d26749053bf09dccf07451ce2bb64f065b07fd4ebea476d4ef742a46ecd79b6e669af456f61d6f0ada23e662362243d62acf6a6f13fcc23dacacbf3e8b01bcd4f436b302e79a12a702199fff69de3834e33126261bcec290a8a8d404e528baf090e08e82698d6a151aa8c5544a1a73e43e87013feee39bf95baaa9ccceb7bda1355494cd3e6ae1e44ee65f7d2a221c498c39b9a43b626b1bd682dcc512e84820533a943e647c18e6f6869dd978195b5ae54bbbfdf05db24ec6d3e7ec6a4f56d5b6ec94119936fb22ba77ce48fb271e211a4c944e6868115369b85de12ed9dda90726de15342022c30e4446212ef4a27034cd2227a1f45c8901ea2c7b64cd5f69d422cb83b7d1be84472541eee01296e251711939d8447b67dab2cbb448fdf18d3b24202d7f758ee24b3133412adc13ff3386868389e280aae0d4650d814d20e0bef56d00c72d34744853013d15400dce0830a897b8ac359d18f37f1cb1e06f9c56aee5335c2cddff763377dc6074741721a755e28681403a1c380f48671f13b74005b7b4363928e3ce036c24fcf8b53de85846d9608a7997c79b5b5f651902acdab29c0e6d2a73e2b45b4dbb17f49429e3d7112e46bd7c1b3898922b803cfe8e865e1630bee3e043b4dd12de142ca8475beda97a208ca0f9b3b92be535c48a75d254c6b909c3f0c6c64019956d22c5fd59e86d6eca7763725ce25db61a7108e2815e026717479617b2d8434c8aee39517463087ff32f2838a925eb25a8234fed6aa577d7194cdd6cd33b5a3b1045d30191e7ade3bc8b42bd1abe762e8bac00711942c0fb2726c4bb9ffaa1fd463290249e15eb35a20c10116a988c8dca9755d0355145e498567936017ac19ac300e6caa453eda3d7c2f1bd63908a54a3fbd2eab2160e4c0ff59c2a6e02aa357abaf53e86ba74cba10876d5908d41f736a9ddb964ab5b3e7373218ba1579ac52dad5df5edf0d8b7dd2fbb1c8b885022e3d2f5251a72597aaba0d286c3fdfcdc45f4112d15978df5245add4bfe5e99d185c1cdddabf0bae7e51260ffe003264607420e06bf8bf9021b64dfd759a3152c8da5432927fe16c1eae35e5a08eabbd5df75cbfe3e3d5c02b4c9865ceb9ab4ad9be1c3e04e0884a1a6ee51d2a0777ed65cc6546a2a0ee3d04f2a904715312c7904edeeda286ffcd203ef5e50f150efa5233e2c454e4b7a72ef73afc6a5cc7616caa5ac74475999931750805746bc777ca06179b7415e8b2e3903be53f8cd3f0a98b48e11fec4715d2966b53cee96e1a530b7fb066138a9983e80908cfec3102b829b9ba433f3bb3be8e57cbf2891ba67473477d5fa1d4303dab9004a7f10745ca59d39a4a4c33434d4ab2f31400364b09767ea16dc6054e00bfbeaeebec34653fb59bb5132cd4bc43e5d3eab5f6a738"}]}, @NFTA_IMMEDIATE_DREG={0x8, 0x1, 0x1, 0x0, 0xf}, @NFTA_IMMEDIATE_DREG={0x8, 0x1, 0x1, 0x0, 0xa}, @NFTA_IMMEDIATE_DREG={0x8, 0x1, 0x1, 0x0, 0xe}, @NFTA_IMMEDIATE_DREG={0x8, 0x1, 0x1, 0x0, 0xa}]}}}, {0x10, 0x1, 0x0, 0x1, @target={{0xb}, @void}}, {0x10, 0x1, 0x0, 0x1, @notrack={{0xc}, @void}}, {0x20, 0x1, 0x0, 0x1, @nat={{0x8}, @val={0x14, 0x2, 0x0, 0x1, [@NFTA_NAT_REG_PROTO_MIN={0x8, 0x5, 0x1, 0x0, 0x17}, @NFTA_NAT_REG_PROTO_MAX={0x8, 0x6, 0x1, 0x0, 0xf}]}}}, {0xf8, 0x1, 0x0, 0x1, @range={{0xa}, @val={0xe8, 0x2, 0x0, 0x1, [@NFTA_RANGE_OP={0x8, 0x2, 0x1, 0x0, 0x1}, @NFTA_RANGE_SREG={0x8, 0x1, 0x1, 0x0, 0xc}, @NFTA_RANGE_SREG={0x8, 0x1, 0x1, 0x0, 0x12}, @NFTA_RANGE_TO_DATA={0xbc, 0x4, 0x0, 0x1, [@NFTA_DATA_VERDICT={0x6c, 0x2, 0x0, 0x1, [@NFTA_VERDICT_CHAIN={0x9, 0x2, 'syz2\x00'}, @NFTA_VERDICT_CHAIN_ID={0x8, 0x3, 0x1, 0x0, 0x2}, @NFTA_VERDICT_CHAIN={0x9, 0x2, 'syz1\x00'}, @NFTA_VERDICT_CHAIN={0x9, 0x2, 'syz0\x00'}, @NFTA_VERDICT_CHAIN={0x9, 0x2, 'syz0\x00'}, @NFTA_VERDICT_CHAIN={0x9, 0x2, 'syz2\x00'}, @NFTA_VERDICT_CHAIN={0x9, 0x2, 'syz0\x00'}, @NFTA_VERDICT_CHAIN_ID={0x8, 0x3, 0x1, 0x0, 0x2}, @NFTA_VERDICT_CODE={0x8, 0x1, 0x0, 0x1, 0xfffffffffffffffc}, @NFTA_VERDICT_CHAIN_ID={0x8, 0x3, 0x1, 0x0, 0x4}]}, @NFTA_DATA_VERDICT={0xc, 0x2, 0x0, 0x1, [@NFTA_VERDICT_CHAIN_ID={0x8, 0x3, 0x1, 0x0, 0x3}]}, @NFTA_DATA_VERDICT={0x24, 0x2, 0x0, 0x1, [@NFTA_VERDICT_CODE={0x8, 0x1, 0x0, 0x1, 0xfffffffffffffffe}, @NFTA_VERDICT_CHAIN_ID={0x8, 0x3, 0x1, 0x0, 0x1}, @NFTA_VERDICT_CODE={0x8}, @NFTA_VERDICT_CODE={0x8, 0x1, 0x0, 0x1, 0xfffffffffffffffb}]}, @NFTA_DATA_VERDICT={0x1c, 0x2, 0x0, 0x1, [@NFTA_VERDICT_CODE={0x8, 0x1, 0x0, 0x1, 0xffffffffffffffff}, @NFTA_VERDICT_CODE={0x8, 0x1, 0x0, 0x1, 0xfffffffffffffffb}, @NFTA_VERDICT_CODE={0x8, 0x1, 0x0, 0x1, 0xfffffffffffffffe}]}]}, @NFTA_RANGE_SREG={0x8, 0x1, 0x1, 0x0, 0x14}, @NFTA_RANGE_SREG={0x8, 0x1, 0x1, 0x0, 0x11}]}}}, {0xc, 0x1, 0x0, 0x1, @cmp={{0x8}, @void}}]}, @NFTA_SET_ELEM_EXPRESSIONS={0x1140, 0xb, 0x0, 0x1, [{0x10f4, 0x1, 0x0, 0x1, @target={{0xb}, @val={0x10e4, 0x2, 0x0, 0x1, [@NFTA_TARGET_INFO={0xb5, 0x3, "660918f43084f406bc62ff99ca82de86c13dffb64c57d51313904593223c0bf033c3077a0c0566e12c029ca1f296d37f8f6d757a52f74fe9d14ad274ff1db6a43ef11b530bb375d8c57edf882770c07d65892d1ca6808bc6a429c2ceabc54d5981648e168f8c11ee098321ba798fccca522cf289151aa30a7f4744171114d8e93ea5b8026009038ad1fdcd992035785f79be31c72ba51f01656e9a959c3b80e51ddb284ef776c3013eb19f9da499255c3f"}, @NFTA_TARGET_REV={0x8, 0x2, 0x1, 0x0, 0x3}, @NFTA_TARGET_REV={0x8}, @NFTA_TARGET_NAME={0x9, 0x1, 'SNAT\x00'}, @NFTA_TARGET_REV={0x8, 0x2, 0x1, 0x0, 0x2}, @NFTA_TARGET_INFO={0x1004, 0x3, "506d6983be3441a8d0f6b2196df6da8759e5ba9b98a008924a6aa7fbdc822391989db0fb473e602202e67f5c8383efa28f0f695865dca6567818ab257b2269881a54450a376301cf660d3edbff73fefc69c26afe050fe924568035a90132e21d44754808115c25816f07ce600b3a7acc2de646a13fc4f490b09ae5630be2884e998c1c8e9da117bb68741e9c918dae25907e40bb33931b2b9bbd5e1f1d8167076ad698f2262d14b3e5579a528675d0bab444b35022cbe567b979422a392d5b36489e1b2282d0c84daa6403e608d6bf615b4b7d361f82b668e1bc9f4f750b6c165fc3c06f2dde166b134daea61c15dd8a52fdd9ba0f2d4ef564c7488cd25627203e613cd0e2fdab361704cce4835e8cc1d7324330026d8ff07ef631c7cf3dca2ee2cf768fc63e72ab76886b20a022e34407949c38da94f988f284d6635ab2ae764cab49deee486663d4773a33f7610153a3671dfb8256ffeec3f119037651ec0b45abccbc507a0a21feaa6c513f386c5bd4e8e75310eed82407d535896bf8bc523034153721348a902584def553d9e20be09c5af14423857697c1478591c1e0b6d980e59b2ffb6dcd307cbf58b68bcc45c6c0fa0490f4aa0d812e28ee975923510276f501cb605e3dda2cfdffe1d318b14fa9ce43ecf1eac7e03bd312bf0b01e6a1b616a2e25affbf6ba923866c8bd1450ba90795bc7ded784d8a56246e4d27ae3aeea91e0d8a1ced5eef9e83c1cecf3d4d056168f0c80c5dbf677bc1586fd5a05023cf82d7ca0a0536dc9b32d3170d89d2dcb2436f9d0a71d921af389a2d2ba4439c7ea2369d34b59e8df08a0b504dd93f37b98da3c58550e5d646849389f852c10debdb2fc3ffcfe4760a87fa50d846f1ff46645c590c558ba5a548d463c905f884e32f917010db0b8631b90d5a9b4b61998c7a13c88b02a8d1a95917bd61fd5f26a7915445f3ec83d69d47f98fbe4a79437eebab181fc34e6525c08a99a811bb0fc80b60b6751915508e342811265037491835c6c0f00fd8bf9009e16a22b23d6b386be403ad533cffd865a06d309264e2724936fe859a7dcac94108d3933b1ba39c2dc2d131d3d0e8dddd993f08dbf2ed3ecceaf3f2d666a01ad7b01d0417dc6928e338b915b7c1c24d839817d131ecce59ef058e32ebc1d62b103d402d6d4c924cdf2186081ebe88c8cb4d78b77ea21c568dd08492987ce61ac2e133718b3a7c079b8a4efc9d55b2bbc9e2204acf84053ded49bfb47dc6153ed9c4c47ebb16688f0da2cf0482def7c5466ab7a7d19995bdbdc38bf9025fe1ea8c6bbbd1e7f6aa787bc27a2b5f7ae305a0ba191105647c2129e85334b6dd9dda1398e59b03f54500cf65b5391d6ebab765f8f7f57df9a262d9f939db7dee4bdafa2de56356854c803a6a50511693b6b4e3e3c475034e985d7c8f6a7a44158384692780240a124a7ea145a3ccb5163c237fccd5195afc16a82c216ddeb201f9d67437bc900b51e8ee0a2d4931cc0264a0fcabc8ce54c1aaac15d52381f6f295d50d8e9afd72e803713c49044d9e95e55d979c0f8539175428095d0ffe56a815ac37197426f16c4c3b6418ed71f0881a69dc90b070be919be4f86496abbc04d1731339b8c09af2548715b853c4ea5a614811f1d24e5197c8abffaaac41dea48d2f6074965bea6d1837f35af7409790506cf6ddb995111eb0371b4148cb1136c1689829b26bd2134f5850ece723182de724d463712c8d033ba95d29710bc5c214038bc8c2fcee02ddd2f4490914e6042004e754c830c5f012c79402f553f9e83d0fcca044c1d429f529b1c18356fe1bb2cb7df9e5ca9d4d913529b964671a1a3cfcae1974e7d469c52109e39786f403902dff855d0dc8546a1eb4ca1e58098b936e8266cd7a0cc0f91691198276bdf5cafa757abf2c62545a4da73bce9fcb695e26656b2f4aa1dcb382ebda8ee2cf3e85f24676215019dfab1925570ac3d890a3f21af995c84c28ba7f1db17a4d6d7f52540c2b0aeaad694c438da3eb3e86c0857286511f3f9be4e4a8cc85b2ca00666d587dd82b14fe07c3a60877ed90bc7eaa124d294e45cf8d254cc26a3ee520c3f18b4bb87482f0d7503da110a065ea2e6bc1e999e22c42f592484b2c2ef4e9bc885b6d436f939683bf9b957f430c74c7efad70a325af276f698d8a0e2d55cdddeeddcae5b14a25514a1e1105f539339bf5c5636394e9c0e34e619bdff382d6d5d2a1f5a50ef2e177cb9e1b42be14753fdd8a5ae4e9b39215d4a488051b35ecc040765146dbd0c9a41d76a6fb94c78b417a3422f69fca3eacd2fb924a0884b6078cdef23b848946b785e0a358b941e4c815fa2903072ca202ceb5466e88d7c63c319f9de2c8ea89f7d4cf554132704002555fe3a6297dd2b1da898c91f189d36b1e1d0e95d75856ef0ded06dc8408731513a472f1ff1d814a4228bef5e9dd18d7e886a3fe9a0dd76b721eb05915faeaf23705c403790f75445f65f5f5d48bbf4b767db2bbe834c30ba091f3f86e0c9876ece8cf049f5a01afbab3f68dbfdb9dc434e58a293836cdd7a784cfd3d93e8b8f4686077d51845d75a99b0bf8290e671bc0ca29d48f22ecfb8cab8a0ceab845ebd85e6ab7a2fcf5be49bfe82456a4199543c5de2315aea4a5dd69a67e58151d29cf0c179507aff9bfcdcf38295292e33d0cf72d07c03d18cfe2fcb5f6b2229ff2043af7672258f20bd88ec33bdead4574f6157f8711d0810c20838064c7926359aab3056b5dd4aa830e66e9d8b7f0660bfdcadaa3d38cd22cfe81c55b31bcf2329284883ee078350a71f8c895bf5346f908591b934218fd2d63687fc9b9c16ebcc9028039c6e73691ea8fcf2aa7827a3d474331cfee2778c288ec09e0345b4c45befdcfd1fb8318a8b46d17a5c36e7205cf69c1fb199d62c555c32ae31d7c5947d7820fd96f07c4f3246aee0db9fa027d1a913f7cff415caeb34babac5e133cd2dca9640b00d2177f44d8d8b801d475cd4645a1da4b3980b459df3f2b31ca6c0843b36804d33c1d0d336878d4d326f30b079af2c8e02d0043dddfd42e63852ed802705ac2f0802066317ddca97988f87194fae0065a03cfbeaaf3d0815053ec23ff51fa683ba4e656b0a9889b9ab352a3d0fbf9e03b2778c8f9b4627da04332e03f1fc07a6d1139a52890cccddfe7c47f1084bf0cc7272fbaea155181d7a31b5cf3315d22c0e41acbe2a9d708a080fd9f5b67e5482350df0a6140d1029be885cf9d2aea5a4cc1d8524b147efb6a08c76a62cd92a62952732596bb4a9bad378386aa415bc0199ae7a4ed13b814c0365442ce7a80a9e746723611d4c30408a3ec3a82de95b98b7586bb14a84080371d5fb3508e654c3fc4ddb81137d146c49a4a61b6154a40354ce83a684f6cff06ce8ea0edcddda03ba114c592023b52135eb539920e17434c3da3aadfe9d8fe3ccaa0eea32c44e9e4dd7cad11bb8ac761be74d0cfffb182034fc2197e9218262669e930e8de740f17df49c3bf5727e0b1b8dc21b0e791019035e6469731deb40f83803ed86d2781b785e11ba1de877ef07edac9ba08ece165ba330848ae51302f1c18117173b86ef341f13b4e620e9e9a03daa85361d2431dced4ed714a1888f302f3829977cebde71feed6d31170b0b75d3a59eeeb0b721e5f5ce51e5e5009eef4308be0c5d59dd916c74b0d6ddd72d52ff21d444fb447911dd85dc6e1ff6a8782e0337eb3ae83e003370ea81d8974db84621db01f5f61d0586d922628dd94b537a01acb771063dd97113dfd92338a7b60166522fca74da7ff94382f8110f54c15dccfcad28b1785a8ec56f58a963611789d7d98073745bbfc5dc186e9748c9bd78bba1670d9fdbc83041bf8bdbd4af092712ce450e2474c34ec7c2c382bfa06a4c4e4bca2b0712e9178c4266c5f413a3d5c83ae322f1802d8eb12997e870007e8ef6fc39a0e46e53478ddfb192fa1841c3f17636bdcf312d997a2e4d7fea952eca7aaa34c420e6a9696cea2d3c7b8cc25e233a15af13bcf20c416679fde4f977cdc4adeadf8d39a4d1947fa6fe028ad0a5024bd3de89682f4e1aaf5e4757df2d3cf4d852a98d8987028399d97e49a530c527d5e680efa44b95683232718f37da3eec5eb43c589b3437e034d70c48acc38bd4a5c26372afdc53cfe51b6a7f3c0d0a2e5e0a3a68e931a35a60df3851998394f5ead5f8b168c0b6400fe350bce54712ced0bfd54770a99b56ef957303826e63941d060b10e49a4be6c6b64bcc3187f335ffac2f01ee860fa7e7e688a3e59bbdd56f2d3e6fdafd23b58aefe6a9c0cda2cffaff31c14f57f85fdce2445e9bf7bb8bf6e751d1295a74df76f143f560b6d4c27f5d77bf3d35b9d57f90cb7af612f0e5891354ed24350dc2d008187d63b4c63bba1c9dca9c1b13c66f4ef1ecfcd72459652ca8f5d8ecd5562f54b9f1044c51cc19876abdbd8732f300d04830f81cc7b22ae576db5a66c5e9983b620d79c478eecf52c26f51932902a9493d7d050b7fcdcb1f6b6e3e810289c629e7ab27ffcc49d1032c31140c510496c2f287d23b2eee63494eb38ac6c77fb870c5e0c9c796dce125be36c1ac4190d1d88aae752b78fdc0c6b5f24d0772cdb97d6ece570c70004b9e1c38fa65be2bcff9eef38232fe4565ca20f971e7d9929ff8f5dd654358aa8287dea6ba69b2831e344357c15aa58c406e739d81052400ce642b1e0c04a35cf304872d99699c346b42d5e30e97d9a3177d81ec728bfd8c98f2507be542513cafa41a77c64bc15039a60c3c11497d012eed0e1df81adc4d6e47bf025b7bde108306111749207aa517b25ed232c84dd7f2d756abeb56f1514070cadd5fc29771f6ff066d84b3d3b016d4a6eecfc7f7b3047e768f616de49f7ca73e26f4c2d01da8aa9ca50310258230c43c627bccf2182daf8c846052270062de1ad1b50f2007311cc6c83a9d4a515936ba6b119eef7cb372156272571473c34367b278a407c7a1fd1f413684e7a7a4c5b60b81e2d125d2af10bc154e25a3473a692af08c614c4f90331a3b25323a61d85a8f610a4943807b49477760a9c2767ee1289ee419763c25b5f4372c6c13963167bd7c6fa8c062fe156bc7d54052eab71f077af1cdc95f368f70728233e563219636079317c069de03f574fa014c30105fccf9c409780060ae5d65e07aa93fb2a65afa1707d4f7e4e73a61ce0fe1a66bb7bf89179acd356a8693d1a52c70f20bfbb0e050a810954bdc3a929286b3b82f421aa39603a1cf923902aa852443ee7e842b0e191c354a51a07581d87654d6fac530bedd991baf986d4a0b934537e0ab1f12ee8cc15afcb7e8113f0086e29cbb34242f8a8daedf85d16705ab59bdbd00b06ccdf871d2e71d5b5dd2390ebdd19c60ee0b5e2cb228fee024b87652bc6639b23b562f6ad4859e53cdd0f2a4fabb37b9244707d72a794ea20af3b9017b9af12d564407d1ea4cf217f30ba9ea1591050fbeb9fc7fe46e7f270fc17601104cd9aaa14a69472393702ff1584c24d3ee68ff0b89604daa584884be5f377d1f7073682117af4059e683fe3f6299f1391d5ac0a25fad73fad97f0270940df26b247c4eb64752caa24ac756f92fdf21c5735277d0f3418d47c4bfc3a28653e2b059b46b63642097328eddb0312d76c2929bad70efa6ec29af4b6b68e995fc8d8e1725cd08090cb58bf2f63458910cf485a8ab786ed585feb849f3156cd502b09db743a9f3fc273d821d461542d4fa3ad654fb27a52f9e161a8d73c25e7e07bb4f820e0eecbafd765a61b5735076ef76b"}]}}}, {0x3c, 0x1, 0x0, 0x1, @exthdr={{0xb}, @val={0x2c, 0x2, 0x0, 0x1, [@NFTA_EXTHDR_FLAGS={0x8, 0x5, 0x1, 0x0, 0x1}, @NFTA_EXTHDR_OP={0x8, 0x6, 0x1, 0x0, 0x1}, @NFTA_EXTHDR_SREG={0x8}, @NFTA_EXTHDR_FLAGS={0x8}, @NFTA_EXTHDR_SREG={0x8, 0x7, 0x1, 0x0, 0x15}]}}}, {0xc, 0x1, 0x0, 0x1, @fwd={{0x8}, @void}}]}, @NFTA_SET_ELEM_FLAGS={0x8, 0x3, 0x1, 0x0, 0x2}, @NFTA_SET_ELEM_FLAGS={0x8, 0x3, 0x1, 0x0, 0x2}, @NFTA_SET_ELEM_DATA={0x140, 0x2, 0x0, 0x1, [@NFTA_DATA_VALUE={0x75, 0x1, "ba3c6c85c6dba4bb26542f6408651a2797b60f92e2987134614022d41c4f42edeea26fe0da9a469fad188f97abc340b33e8f0454b9bf4ecc9ae8da43016c8c584f5faa91e669ce10baf30df8bd3097f5161afcf351ed86c32ad6d6edb945ad675a62d154e09eee3645f31c8071686c8314"}, @NFTA_DATA_VALUE={0x88, 0x1, "cce82b0d395b28fe73902e588c3ff23d6f40b32e2eaf30502ea23a7d81c89d5106a5fd7e324227c0b8de043d7e6da80b6e794777827b1f4a82ae53134c19482831c412365411b4097f791a4cbca31ebdab2f709e03e7a950c3588d76d9e1853f00bcab8fba3aa872603ff550efd56e9214c350612cb0a13ab140a7fb1adbfddf5295905a"}, @NFTA_DATA_VERDICT={0x3c, 0x2, 0x0, 0x1, [@NFTA_VERDICT_CODE={0x8, 0x1, 0x0, 0x1, 0xfffffffffffffffb}, @NFTA_VERDICT_CODE={0x8, 0x1, 0x0, 0x1, 0xfffffffffffffffb}, @NFTA_VERDICT_CODE={0x8, 0x1, 0x0, 0x1, 0xfffffffffffffffe}, @NFTA_VERDICT_CODE={0x8, 0x1, 0x0, 0x1, 0xfffffffffffffffc}, @NFTA_VERDICT_CHAIN_ID={0x8, 0x3, 0x1, 0x0, 0x4}, @NFTA_VERDICT_CODE={0x8, 0x1, 0x0, 0x1, 0xfffffffffffffffc}, @NFTA_VERDICT_CHAIN_ID={0x8, 0x3, 0x1, 0x0, 0x4}]}]}, @NFTA_SET_ELEM_FLAGS={0x8, 0x3, 0x1, 0x0, 0x3}, @NFTA_SET_ELEM_OBJREF={0x9, 0x9, 'syz2\x00'}]}, {0x324, 0x0, 0x0, 0x1, [@NFTA_SET_ELEM_EXPRESSIONS={0xc8, 0xb, 0x0, 0x1, [{0x18, 0x1, 0x0, 0x1, @cmp={{0x8}, @val={0xc, 0x2, 0x0, 0x1, [@NFTA_CMP_OP={0x8, 0x2, 0x1, 0x0, 0x3}]}}}, {0x10, 0x1, 0x0, 0x1, @match={{0xa}, @void}}, {0x20, 0x1, 0x0, 0x1, @synproxy={{0xd}, @val={0xc, 0x2, 0x0, 0x1, [@NFTA_SYNPROXY_FLAGS={0x8, 0x3, 0x1, 0x0, 0x10}]}}}, {0x10, 0x1, 0x0, 0x1, @counter={{0xc}, @void}}, {0x10, 0x1, 0x0, 0x1, @notrack={{0xc}, @void}}, {0x5c, 0x1, 0x0, 0x1, @redir={{0xa}, @val={0x4c, 0x2, 0x0, 0x1, [@NFTA_REDIR_FLAGS={0x8, 0x3, 0x1, 0x0, 0x4e}, @NFTA_REDIR_REG_PROTO_MAX={0x8, 0x2, 0x1, 0x0, 0x4}, @NFTA_REDIR_REG_PROTO_MAX={0x8, 0x2, 0x1, 0x0, 0x14}, @NFTA_REDIR_REG_PROTO_MAX={0x8}, @NFTA_REDIR_REG_PROTO_MAX={0x8, 0x2, 0x1, 0x0, 0x1}, @NFTA_REDIR_REG_PROTO_MAX={0x8, 0x2, 0x1, 0x0, 0x8}, @NFTA_REDIR_FLAGS={0x8, 0x3, 0x1, 0x0, 0x20}, @NFTA_REDIR_FLAGS={0x8, 0x3, 0x1, 0x0, 0x52}, @NFTA_REDIR_REG_PROTO_MIN={0x8, 0x1, 0x1, 0x0, 0x1}]}}}]}, @NFTA_SET_ELEM_KEY_END={0x24c, 0xa, 0x0, 0x1, [@NFTA_DATA_VALUE={0xfa, 0x1, "5eeb1b0255c912f3156d9415fba271ae7339bbfb20b97d35aa7d7fc869cfebbff30c0c9f9bbc9f5f89731fe11a69ca5ec57e29e2cd45edb5f241b8ad910bbf08047f735f355b52e836fef4fd5a083aa373bc03285505a471719ceae5b380ab64e79efcc0c866a1e16530f77ca3221f57e9c52435e2d80c580325b1d126387f1c7b77b522e0e8fc8d92822d5a0ed5809042b961eadd26b394aa48436fe8d04ac9cc9d9a2bd07cf5e200b3528de6bc3a36d187b3b9f9e2e40dcfb401e1d6425c05564c6f8fae0f93b2bf3e8df302b52702861b75be40dcda18c7e70b1cc1b6b810fdd6446fc1baee1dc18687fe4c977ef893e45023f0b1"}, @NFTA_DATA_VALUE={0xb, 0x1, "b56becc41bad17"}, @NFTA_DATA_VALUE={0x93, 0x1, "d6b98928092e97794d4a60aae3fd1c8a625d49ed58cc2d6f460cb05a09b8e5206b51ea99bcdd9c5d7dc4e30611b8dab0beb90c7f3a37a6d7763fd153467b28d9fe1d3eb16a48b12602e6f8a5951779cbe4f07d7bd8f77e58b27abd0cc02c426a79c8bb1a261ce25d73a973cc05b30910128759cdf4e2389f9f90ce81a5357a9020494816dd46afa60a623d01c90144"}, @NFTA_DATA_VALUE={0xaa, 0x1, "95c8bba4908705272790012a7295fea7385dffe83b3dfe051cd87ffbf2e696ae19ef6cfee66b0bd7563df44fae48d6dda331b0f9e61373298e3cf6dba6aa7233eeddd99efbcdd9b450a9fcbc12ab9e5edd35a9c33726cf067e218a31901bea8bf242aa0d2c946a59e7ee38585f94c87dc24f8a293ed6e05a4d0dbb8d5ced2409690aa1aaae6c10427daf0066af636638a15f83eec79330e34fa4c1a2a23f099f015aee5fc987"}]}, @NFTA_SET_ELEM_OBJREF={0x9, 0x9, 'syz1\x00'}]}, {0xac, 0x0, 0x0, 0x1, [@NFTA_SET_ELEM_USERDATA={0x50, 0x6, 0x1, 0x0, "4a3021038c5d8861a69d41053cc2b7882ce65ff9ec1fed866ab714ae9a768af6d6bfea41328b05e50fef6912452f6b643c7c2ff4a2c29852a7b6c8815e136e5b27bb49ceda53d6e64a2f1a6a"}, @NFTA_SET_ELEM_EXPR={0x58, 0x7, 0x0, 0x1, @fib={{0x8}, @val={0x4c, 0x2, 0x0, 0x1, [@NFTA_FIB_FLAGS={0x8, 0x3, 0x1, 0x0, 0x29}, @NFTA_FIB_DREG={0x8, 0x1, 0x1, 0x0, 0x3}, @NFTA_FIB_DREG={0x8, 0x1, 0x1, 0x0, 0xe}, @NFTA_FIB_FLAGS={0x8, 0x3, 0x1, 0x0, 0x28}, @NFTA_FIB_RESULT={0x8, 0x2, 0x1, 0x0, 0x2}, @NFTA_FIB_DREG={0x8, 0x1, 0x1, 0x0, 0xb}, @NFTA_FIB_FLAGS={0x8, 0x3, 0x1, 0x0, 0x8}, @NFTA_FIB_DREG={0x8, 0x1, 0x1, 0x0, 0x10}, @NFTA_FIB_FLAGS={0x8, 0x3, 0x1, 0x0, 0x30}]}}}]}, {0x574, 0x0, 0x0, 0x1, [@NFTA_SET_ELEM_KEY={0x240, 0x1, 0x0, 0x1, [@NFTA_DATA_VALUE={0x2a, 0x1, "15a90b1ffcfba804a39fe6810976779509b50602b49133c943172f5963a620d58055f91ea965"}, @NFTA_DATA_VERDICT={0x44, 0x2, 0x0, 0x1, [@NFTA_VERDICT_CODE={0x8, 0x1, 0x0, 0x1, 0xfffffffffffffffe}, @NFTA_VERDICT_CHAIN={0x9, 0x2, 'syz2\x00'}, @NFTA_VERDICT_CHAIN={0x9, 0x2, 'syz2\x00'}, @NFTA_VERDICT_CHAIN={0x9, 0x2, 'syz1\x00'}, @NFTA_VERDICT_CHAIN_ID={0x8, 0x3, 0x1, 0x0, 0x1}, @NFTA_VERDICT_CHAIN={0x9, 0x2, 'syz0\x00'}]}, @NFTA_DATA_VALUE={0x29, 0x1, "774f66b7a2393936d62482189cf9b8ece6740c0d4b49815fa24c0bef251669ef48ea5a4497"}, @NFTA_DATA_VALUE={0x92, 0x1, "9e35c85d884d1e00112a48a0eed788e556730298943f3e83ba38f33648783c31012010d00643a9f59df4d5e24c20e9942b958c20dbf4e8a2af1fbff3138f43a80001ec1bf5b1c3c409bb7e01ee71b627e979f73df45e44e9c7a33c2399ebc4056f4ada6bce4de22ef38bf9a08cb801ff07000000000000fc1b55a3fba86f46009a7109648daa90487c78f2b916c8"}, @NFTA_DATA_VERDICT={0x38, 0x2, 0x0, 0x1, [@NFTA_VERDICT_CODE={0x8, 0x1, 0x0, 0x1, 0xffffffffffffffff}, @NFTA_VERDICT_CHAIN_ID={0x8, 0x3, 0x1, 0x0, 0x3}, @NFTA_VERDICT_CHAIN_ID={0x8, 0x3, 0x1, 0x0, 0x1}, @NFTA_VERDICT_CHAIN_ID={0x8, 0x3, 0x1, 0x0, 0x2}, @NFTA_VERDICT_CHAIN={0x9, 0x2, 'syz1\x00'}, @NFTA_VERDICT_CODE={0x8}]}, @NFTA_DATA_VALUE={0x35, 0x1, "8c6893a66f750956a8f79491d04489ebeda6a1455fb46e7891c07aacee36b2c604a0290ba31e91fdb49371ab3e765b16bb"}, @NFTA_DATA_VERDICT={0x60, 0x2, 0x0, 0x1, [@NFTA_VERDICT_CHAIN={0x9, 0x2, 'syz2\x00'}, @NFTA_VERDICT_CHAIN_ID={0x8, 0x3, 0x1, 0x0, 0x3}, @NFTA_VERDICT_CHAIN={0x9, 0x2, 'syz2\x00'}, @NFTA_VERDICT_CHAIN={0x9, 0x2, 'syz1\x00'}, @NFTA_VERDICT_CHAIN={0x9, 0x2, 'syz1\x00'}, @NFTA_VERDICT_CHAIN_ID={0x8, 0x3, 0x1, 0x0, 0x2}, @NFTA_VERDICT_CHAIN={0x9, 0x2, 'syz1\x00'}, @NFTA_VERDICT_CODE={0x8, 0x1, 0x0, 0x1, 0xfffffffffffffffb}, @NFTA_VERDICT_CHAIN_ID={0x8, 0x3, 0x1, 0x0, 0x4}]}, @NFTA_DATA_VERDICT={0x1c, 0x2, 0x0, 0x1, [@NFTA_VERDICT_CODE={0x8, 0x1, 0x0, 0x1, 0xfffffffffffffffc}, @NFTA_VERDICT_CODE={0x8, 0x1, 0x0, 0x1, 0xfffffffffffffffc}, @NFTA_VERDICT_CODE={0x8, 0x1, 0x0, 0x1, 0xfffffffffffffffc}]}, @NFTA_DATA_VERDICT={0x20, 0x2, 0x0, 0x1, [@NFTA_VERDICT_CHAIN={0x9, 0x2, 'syz0\x00'}, @NFTA_VERDICT_CODE={0x8, 0x1, 0x0, 0x1, 0xfffffffffffffffb}, @NFTA_VERDICT_CHAIN_ID={0x8, 0x3, 0x1, 0x0, 0x4}]}]}, @NFTA_SET_ELEM_TIMEOUT={0xc, 0x4, 0x1, 0x0, 0x2}, @NFTA_SET_ELEM_USERDATA={0x9b, 0x6, 0x1, 0x0, "7857f4ecf3d330b9e450df7bf0c390a2563be2bde7c776c046ea5f7fc790d0c88567230f61d9c7562965e508a642254e5252d4c7b6ddb3dd14206eb7a585b1b66a9af3639d8faced5328333032417cd2a5eb9fe06e932426893392dddc93a46f22a37323caa04d094887410d981133ba93a33c724335f864c0f161f1a51f413fa10e4e3898b34b36348bebd3add443233b12248cf441a6"}, @NFTA_SET_ELEM_TIMEOUT={0xc, 0x4, 0x1, 0x0, 0x1}, @NFTA_SET_ELEM_DATA={0x1e8, 0x2, 0x0, 0x1, [@NFTA_DATA_VALUE={0xf4, 0x1, "01272602640d98ff982e49099ccd9470261ea774e757c1c11f17f9d8cfed9386972da4330af7a22736507491f1784b146801323bb03b8e93a069914a3d7ad784a8da0ea89f01fafb55e86e664a044f2de65bdc791b40eebcd8ef929d9d4ce206e0fcafc12f698480664101a413ed04fe795ad22767138502ce261174d5f4303fb272470b6f50ced37abe235cf7f1adf9b10155fb712882360df00271949bca6cf786fb655ad29b36757b743e22d3b5d2bdc22f179bd276ce3020bf428825838f5a63fd108c1b05b29a0af74802baffc62691c8cddd95a55f49cda3d1ec3fc1512db38b107beb48dc40bb7bb507259bc5"}, @NFTA_DATA_VALUE={0x64, 0x1, "1667e992b01c7b35ebd638af37e6b9f9d2950d20aae7867ceca29def5dd9c969adc20a3b4cda075161061b6495028ba2d796eae1a5f8f3ed37b8eb6c5747e7511f3536b73e81518fe1c6dc2d57582dc46a50436a3c8e18cad5ded629e92122f5"}, @NFTA_DATA_VALUE={0x89, 0x1, "dbfb063720da4f700a46257dddbd32373632a4e3b0971e7eb9835ce5ed556e9170537847badde54cf13256286ea1142494b763d01784ecc6edcfabfe55fa941a9ed98f877687d08afa07ea08d962a3f40f036f44ab9f961b4ba6717faecc6f6032f6046eb60da1ab085e6219246c027c2a4f9b43d545c27dd81decce37012d07a9db8256ef"}]}, @NFTA_SET_ELEM_OBJREF={0x9, 0x9, 'syz2\x00'}, @NFTA_SET_ELEM_EXPR={0x10, 0x7, 0x0, 0x1, @hash={{0x9}, @void}}, @NFTA_SET_ELEM_USERDATA={0x75, 0x6, 0x1, 0x0, "6a128f0b5edce90cd432918a0f5a125f6b4114c24d9d41b8b194ceb226c9f6eb25316b72db9c6855ae78bf1e3d49c6c70cc687a8aae31638f82fde91a7386eec76572af4bb94427149dccb759235c0b838fa6284208c2a46bc7726bb3fbad705fc2c4e2ebaf4cc3cc86cb252706b2d56c7"}]}, {0x40, 0x0, 0x0, 0x1, [@NFTA_SET_ELEM_FLAGS={0x8, 0x3, 0x1, 0x0, 0x1}, @NFTA_SET_ELEM_EXPIRATION={0xc, 0x5, 0x1, 0x0, 0x3ff}, @NFTA_SET_ELEM_TIMEOUT={0xc, 0x4, 0x1, 0x0, 0x7}, @NFTA_SET_ELEM_USERDATA={0xf, 0x6, 0x1, 0x0, "3c0bab262c8bc7e8ca00e7"}, @NFTA_SET_ELEM_OBJREF={0x9, 0x9, 'syz1\x00'}]}]}, @NFTA_SET_ELEM_LIST_SET_ID={0x8}]}, @NFT_MSG_NEWRULE={0x2a4, 0x6, 0xa, 0x301, 0x0, 0x0, {0x1, 0x0, 0x1}, [@NFTA_RULE_HANDLE={0xc, 0x3, 0x1, 0x0, 0x4}, @NFTA_RULE_USERDATA={0xe4, 0x7, 0x1, 0x0, "5a5d24f857d533574587e8f9f655c8e4b50d36055136ea2662b37c165137127aba1ad2b208698e4b4882ad62812c0c0acc17bab60e9eb5755c7cce30c8ff384baff99689b1ecef87b4f20e00173ae635f97f65fee08e7779521d4272f08624d2b3ae36032c6d794d4c4e748b0b237ed52265570061686e6ff01eb45b56b59a4af1a4fda2a7e257c763d6f5b7dc7dff0889a37403b4768692ebcad9d99f62f2263acf88ef5b82a4a7689cb27a9591e14a75e438eeeb81440ea044465af1d00961ce8f041b754a123594474e80fbf54963fd483cd92525275032c40b32f067a180"}, @NFTA_RULE_POSITION={0xc, 0x6, 0x1, 0x0, 0x5}, @NFTA_RULE_EXPRESSIONS={0xc0, 0x4, 0x0, 0x1, [{0xc, 0x1, 0x0, 0x1, @dup_ipv4={{0x8}, @void}}, {0x14, 0x1, 0x0, 0x1, @limit={{0xa}, @val={0x4}}}, {0x38, 0x1, 0x0, 0x1, @last={{0x9}, @val={0x28, 0x2, 0x0, 0x1, [@NFTA_LAST_MSECS={0xc, 0x2, 0x1, 0x0, 0x8}, @NFTA_LAST_MSECS={0xc, 0x2, 0x1, 0x0, 0xf}, @NFTA_LAST_MSECS={0xc, 0x2, 0x1, 0x0, 0x6}]}}}, {0x34, 0x1, 0x0, 0x1, @flow_offload={{0x11}, @val={0x1c, 0x2, 0x0, 0x1, [@NFTA_FLOW_TABLE_NAME={0x9, 0x1, 'syz1\x00'}, @NFTA_FLOW_TABLE_NAME={0x9, 0x1, 'syz2\x00'}]}}}, {0x30, 0x1, 0x0, 0x1, @byteorder={{0xe}, @val={0x1c, 0x2, 0x0, 0x1, [@NFTA_BYTEORDER_SIZE={0x8, 0x5, 0x1, 0x0, 0x83}, @NFTA_BYTEORDER_LEN={0x8, 0x4, 0x1, 0x0, 0x41}, @NFTA_BYTEORDER_LEN={0x8, 0x4, 0x1, 0x0, 0x8c}]}}}]}, @NFTA_RULE_CHAIN={0x9, 0x2, 'syz1\x00'}, @NFTA_RULE_EXPRESSIONS={0x30, 0x4, 0x0, 0x1, [{0x10, 0x1, 0x0, 0x1, @xfrm={{0x9}, @void}}, {0x10, 0x1, 0x0, 0x1, @tproxy={{0xb}, @void}}, {0xc, 0x1, 0x0, 0x1, @nat={{0x8}, @void}}]}, @NFTA_RULE_EXPRESSIONS={0x98, 0x4, 0x0, 0x1, [{0x10, 0x1, 0x0, 0x1, @hash={{0x9}, @void}}, {0x30, 0x1, 0x0, 0x1, @osf={{0x8}, @val={0x24, 0x2, 0x0, 0x1, [@NFTA_OSF_FLAGS={0x8}, @NFTA_OSF_TTL={0x5, 0x2, 0x6}, @NFTA_OSF_DREG={0x8, 0x1, 0x1, 0x0, 0xb}, @NFTA_OSF_FLAGS={0x8}]}}}, {0x1c, 0x1, 0x0, 0x1, @tproxy={{0xb}, @val={0xc, 0x2, 0x0, 0x1, [@NFTA_TPROXY_REG_PORT={0x8, 0x3, 0x1, 0x0, 0x11}]}}}, {0x10, 0x1, 0x0, 0x1, @payload={{0xc}, @void}}, {0x18, 0x1, 0x0, 0x1, @dup={{0x8}, @val={0xc, 0x2, 0x0, 0x1, [@NFTA_DUP_SREG_DEV={0x8, 0x2, 0x1, 0x0, 0x10}]}}}, {0x10, 0x1, 0x0, 0x1, @inner={{0xa}, @void}}]}]}], {0x14}}, 0x4258}, 0x1, 0x0, 0x0, 0x1}, 0x24040884)
r6 = socket$nl_netfilter(0x10, 0x3, 0xc)
sendmsg$NFT_BATCH(r6, &(0x7f0000000200)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000940)=ANY=[@ANYBLOB="140000001000010000000000000000000000000a20000000000a01020000000000000000010000000900010073797a30000000006c000000160a01000000000000000100010000000900010073797a30000000000900020073797a3000000001400003800800014000000000080002400000fbff2b0003801400010067656e65766530"], 0x110}, 0x1, 0x0, 0x0, 0x4084}, 0x8000)
ioctl$sock_SIOCSIFVLAN_SET_VLAN_EGRESS_PRIORITY_CMD(0xffffffffffffffff, 0x8983, &(0x7f0000000040)={0x3, 'vlan0\x00', {0x4}, 0x5})
r7 = socket(0x10, 0x3, 0x0)
mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./dev\x00', 0x17a)
mount(0x0, &(0x7f0000000040)='./dev\x00', &(0x7f0000000100)='devtmpfs\x00', 0x0, 0x0)
r8 = openat(0xffffffffffffff9c, &(0x7f00000004c0)='./dev/kmsg\x00', 0x0, 0x24)
lseek(r8, 0x0, 0x2)
ioctl$sock_SIOCSIFVLAN_GET_VLAN_INGRESS_PRIORITY_CMD(r7, 0x8983, &(0x7f0000000040))
syz_emit_ethernet(0x7e, &(0x7f0000000280)={@local, @local, @void, {@ipv6={0x86dd, @icmpv6={0x0, 0x6, "f81fcb", 0x48, 0x3a, 0x0, @private0, @mcast2, {[], @param_prob={0x4, 0x0, 0x0, 0x0, {0x0, 0x6, "4aa1d3", 0x0, 0x0, 0x0, @private1, @ipv4={'\x00', '\xff\xff', @loopback}, [@routing={0x3c}, @srh={0x2f}, @dstopts]}}}}}}}, 0x0)
socket(0x10, 0x6, 0x0)
lseek(r6, 0x9, 0x0)
memfd_secret(0x80000)
executing program 4:
fsopen(&(0x7f0000000040)='msdos\x00', 0x1)
bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f00000001c0)={0x3, 0x6, &(0x7f0000000140)=@framed={{0x18, 0x6}, [@func={0x85, 0x0, 0x1, 0x0, 0x2}, @alu={0x0, 0x0, 0x4}, @exit={0x95, 0x0, 0x7b00}]}, &(0x7f00000000c0)='GPL\x00', 0x6}, 0x80)
r0 = openat$vhost_vsock(0xffffffffffffff9c, &(0x7f0000000000), 0x2, 0x0)
ioctl$VHOST_VDPA_GET_VRING_GROUP(r0, 0xc008af7b, &(0x7f0000000080)={0x2, 0xfffffff0})
fsopen(&(0x7f0000000040)='msdos\x00', 0x1) (async)
bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f00000001c0)={0x3, 0x6, &(0x7f0000000140)=@framed={{0x18, 0x6}, [@func={0x85, 0x0, 0x1, 0x0, 0x2}, @alu={0x0, 0x0, 0x4}, @exit={0x95, 0x0, 0x7b00}]}, &(0x7f00000000c0)='GPL\x00', 0x6}, 0x80) (async)
openat$vhost_vsock(0xffffffffffffff9c, &(0x7f0000000000), 0x2, 0x0) (async)
ioctl$VHOST_VDPA_GET_VRING_GROUP(r0, 0xc008af7b, &(0x7f0000000080)={0x2, 0xfffffff0}) (async)
executing program 4:
r0 = openat$procfs(0xffffffffffffff9c, &(0x7f0000001140)='/proc/tty/ldiscs\x00', 0x0, 0x0) (async)
r1 = bpf$PROG_LOAD(0x5, &(0x7f0000003000)={0x6, 0x18, &(0x7f0000000a40)=ANY=[@ANYBLOB="bf16000000000000b7000000000000007b0af8ff000000007b0af0ff000000007b0ae8ff000000007b0ae0ff000000007b0ad8ff000000007b0ad0ff000000007b0ac8ff000000007b0ac0ff00000000b702000002000000732ac0ff00000000b702000001000000632ac8ff00000000b7020000ac1414bb632ae0ff00000000bf61000000000000bfa200000000000007020000c0ffffffb703000040000000b7040000000000008500000045000000b70000000000000095"], &(0x7f0000004000)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @xdp, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94)
bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f0000002000)={r1, 0x0, 0xe, 0x0, &(0x7f00000003c0)="e02742e86c0d85ff9782764532db", 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x50) (async)
read$watch_queue(r0, &(0x7f0000000140)=""/4096, 0x1000)
executing program 4:
r0 = syz_open_dev$dvb_frontend(&(0x7f0000000080), 0x0, 0x402)
r1 = socket$inet_mptcp(0x2, 0x1, 0x106)
r2 = socket(0x10, 0x803, 0x0)
syz_genetlink_get_family_id$tipc(&(0x7f0000000000), r2)
getsockname$packet(r2, &(0x7f0000000280)={0x11, 0x0, <r3=>0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14)
sendmsg$nl_route(r2, &(0x7f0000000180)={&(0x7f0000000040)={0x10, 0x0, 0x0, 0x400000}, 0xc, &(0x7f0000000140)={&(0x7f0000000100)=@RTM_GETMDB={0x18, 0x56, 0x2, 0x70bd25, 0x25dfdbfe, {0x7, r3}, [""]}, 0x18}}, 0x20000000)
sendmsg$nl_route(r2, &(0x7f0000000240)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000580)=ANY=[@ANYBLOB="4800000010000305ff810000fddbdf2500000000", @ANYRES32=r3, @ANYBLOB="1748000040000200280012800a000100767863616e0000001800028014000100000000", @ANYRES32=r3], 0x48}, 0x1, 0x0, 0x0, 0x40}, 0x0)
connect$inet(r1, &(0x7f0000000000)={0x2, 0x4e22, @empty}, 0x10)
setsockopt$sock_int(r1, 0x1, 0x9, &(0x7f00000003c0)=0x246, 0x4)
ioctl$FE_SET_PROPERTY(r0, 0x40106f52, &(0x7f00000000c0)={0x29, &(0x7f0000000200)=[{0x34, '\x00', @data=0x4}]})
syz_open_dev$dvb_frontend(&(0x7f0000000080), 0x0, 0x402) (async)
socket$inet_mptcp(0x2, 0x1, 0x106) (async)
socket(0x10, 0x803, 0x0) (async)
syz_genetlink_get_family_id$tipc(&(0x7f0000000000), r2) (async)
getsockname$packet(r2, &(0x7f0000000280)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) (async)
sendmsg$nl_route(r2, &(0x7f0000000180)={&(0x7f0000000040)={0x10, 0x0, 0x0, 0x400000}, 0xc, &(0x7f0000000140)={&(0x7f0000000100)=@RTM_GETMDB={0x18, 0x56, 0x2, 0x70bd25, 0x25dfdbfe, {0x7, r3}, [""]}, 0x18}}, 0x20000000) (async)
sendmsg$nl_route(r2, &(0x7f0000000240)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000580)=ANY=[@ANYBLOB="4800000010000305ff810000fddbdf2500000000", @ANYRES32=r3, @ANYBLOB="1748000040000200280012800a000100767863616e0000001800028014000100000000", @ANYRES32=r3], 0x48}, 0x1, 0x0, 0x0, 0x40}, 0x0) (async)
connect$inet(r1, &(0x7f0000000000)={0x2, 0x4e22, @empty}, 0x10) (async)
setsockopt$sock_int(r1, 0x1, 0x9, &(0x7f00000003c0)=0x246, 0x4) (async)
ioctl$FE_SET_PROPERTY(r0, 0x40106f52, &(0x7f00000000c0)={0x29, &(0x7f0000000200)=[{0x34, '\x00', @data=0x4}]}) (async)
executing program 1:
r0 = socket$packet(0x11, 0x2, 0x300)
setsockopt$packet_tx_ring(r0, 0x107, 0x5, &(0x7f00000000c0)=@req3={0x8000, 0x6, 0x8000, 0x6}, 0x1c)
connect$bt_sco(0xffffffffffffffff, 0x0, 0x0)
bpf$BPF_BTF_LOAD(0x12, &(0x7f0000000200)={&(0x7f0000000300)={{0xeb9f, 0x1, 0x0, 0x18, 0x0, 0xc, 0xc, 0x5, [@struct={0x2, 0x0, 0x0, 0x4, 0x0, 0xff}]}, {0x0, [0x30, 0x5f, 0x2e]}}, 0x0, 0x29}, 0x28)
r1 = openat$nvme_fabrics(0xffffffffffffff9c, &(0x7f0000000400), 0x2, 0x0)
write(r1, &(0x7f0000000500)="7472616e73706f72743d72646d612c6e716e3d6e716e2e323031342d30382e6f72672e6e766d657870726573733a4e564d663a757569643a31323334353637382d313233342d313233342d313233342d3132333435363938396162632c686f73745f7472616464723d3132370f302e302e312c7472616464723d3132372e302e302e312c747273766369643d34", 0x8d)
getsockopt$inet_sctp6_SCTP_GET_ASSOC_ID_LIST(r1, 0x84, 0x1d, &(0x7f0000000000)={0x2, [0x0, 0x0]}, &(0x7f0000000040)=0x20)
mmap(&(0x7f0000001000/0x3000)=nil, 0x30000, 0x0, 0x11, r0, 0x0)
r2 = socket$inet6_tcp(0xa, 0x1, 0x0)
setsockopt$SO_BINDTODEVICE(r2, 0x1, 0x19, &(0x7f0000000000)='syz_tun\x00', 0x8)
connect$inet6(r2, &(0x7f0000000100)={0xa, 0x4e20, 0xfffffffe, @initdev={0xfe, 0x88, '\x00', 0x0, 0x0}, 0x3}, 0x1c)
mprotect(&(0x7f0000000000/0xf000)=nil, 0xf000, 0x1)
executing program 1:
r0 = socket$nl_netfilter(0x10, 0x3, 0xc)
sendmsg$NFT_BATCH(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000200)={&(0x7f00000003c0)=ANY=[@ANYBLOB="140000001000010000000000000000000000000a28000000000a0101000000005e1affd5020000000900010073797a300000000008000240000000032c000000030a01030000e6ff00000000020000000900010073797a30000000000900030073797a320000000014000000110001"], 0x7c}}, 0x0)
sendmsg$NFT_BATCH(r0, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000640)=ANY=[@ANYBLOB="14000000100001000000000000b890c1a000000a80000000160a01030000000000000000020000000900020073797a30000000000900010073797a30000000005400038008000240000000000800014000000000400003801400010076657468315f746f5f6272696467650014000100776732000000000000000000000000001400010076657468305f746f5f7465616d00000014000000110001"], 0xa8}, 0x1, 0x0, 0x0, 0x10}, 0x0)
r1 = socket$nl_generic(0x10, 0x3, 0x10)
r2 = socket$nl_generic(0x10, 0x3, 0x10)
r3 = syz_genetlink_get_family_id$tipc(&(0x7f0000000500), r2)
sendmsg$TIPC_CMD_SET_LINK_WINDOW(r2, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000540)={0x30, r3, 0x1, 0x70bd2c, 0x25dfdbff, {{}, {0x0, 0x4107}, {0x14, 0x18, {0x3, @bearer=@udp='udp:syz2\x00'}}}}, 0x30}, 0x1, 0x0, 0x0, 0x40}, 0x8000)
sendmsg$TIPC_CMD_GET_BEARER_NAMES(r1, &(0x7f0000000180)={&(0x7f0000000040)={0x10, 0x0, 0x0, 0x40}, 0xc, &(0x7f0000000140)={&(0x7f0000000100)={0x1c, r3, 0x10, 0x70bd25, 0x25dfdbfe, {}, ["", "", "", "", "", "", "", "", ""]}, 0x1c}}, 0x4000000)
sendmsg$NFT_BATCH(r0, &(0x7f0000000500)={0x0, 0x0, &(0x7f00000004c0)={&(0x7f0000000280)={{0x14, 0x10, 0x1, 0x0, 0x0, {0x5}}, [@NFT_MSG_DELFLOWTABLE={0x14, 0x18, 0xa, 0x5, 0x0, 0x0, {0x2}}], {0x14, 0x11, 0x1, 0x0, 0x0, {0x3}}}, 0x3c}, 0x1, 0x0, 0x0, 0x40000}, 0x20008000)
executing program 1:
r0 = ioctl$KVM_CREATE_VM(0xffffffffffffffff, 0xae01, 0x3b)
r1 = socket$inet_mptcp(0x2, 0x1, 0x106)
setsockopt$inet_tcp_int(r1, 0x6, 0x5, &(0x7f0000001240)=0x7, 0x4)
ioctl$KVM_SET_USER_MEMORY_REGION(r0, 0x4020ae46, &(0x7f0000000000)={0x10002, 0x0, 0xe000, 0x2000, &(0x7f0000246000/0x2000)=nil})
r2 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000840)='memory.events.local\x00', 0x275a, 0x0)
ioctl$XFS_IOC_READLINK_BY_HANDLE(r1, 0xc038586c, &(0x7f0000000180)={r1, &(0x7f0000000080)='&\x00', 0x80400, &(0x7f00000000c0)={@align=0xfffffffffffffffc, {0x8, 0xd7, 0x0, 0x81}}, 0x9, &(0x7f0000000100), &(0x7f0000000140)=0x7b15})
write$binfmt_script(r2, &(0x7f0000000040), 0x208e24b)
mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x2, 0x28011, r2, 0x0)
madvise(&(0x7f0000000000/0x600000)=nil, 0x600003, 0x15)
ftruncate(r2, 0x5)
executing program 1:
prctl$PR_SET_IO_FLUSHER(0x43, 0x1) (async, rerun: 64)
r0 = creat(&(0x7f0000000280)='./file0\x00', 0xecf86c37d53049cc) (rerun: 64)
close(r0) (async)
r1 = socket$inet6(0xa, 0x2, 0x0)
setsockopt$inet6_int(r1, 0x29, 0x12, &(0x7f0000000040), 0x4) (async)
sendto$inet6(r0, 0x0, 0xfffffe28, 0x0, &(0x7f0000000200)={0xa, 0x4e20, 0x0, @mcast1}, 0xfffffffffffffeaf) (async)
execve(&(0x7f0000000000)='./file0\x00', 0x0, 0x0) (async)
ioctl$AUTOFS_DEV_IOCTL_ASKUMOUNT(r0, 0xc018937d, &(0x7f00000000c0)={{0x1, 0x1, 0x18, r1, {0x8}}, './file0\x00'}) (async, rerun: 32)
write$FUSE_NOTIFY_RETRIEVE(r0, &(0x7f0000000080)={0x30, 0x5, 0x0, {0x0, 0x4, 0x8}}, 0x30) (async, rerun: 32)
bind$x25(r0, &(0x7f0000000040), 0x12) (async)
fchdir(r0)
executing program 1:
mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeeb, 0x8031, 0xffffffffffffffff, 0xdabc3000)
r0 = socket$netlink(0x10, 0x3, 0x0)
r1 = socket(0x10, 0x803, 0x0)
sendmsg$IPVS_CMD_SET_INFO(r1, &(0x7f0000000b00)={0x0, 0x0, &(0x7f0000000ac0)={0x0, 0x14}}, 0x0)
getsockname$packet(r1, &(0x7f0000000100)={0x11, 0x0, <r2=>0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14)
sendmsg$nl_route(r0, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000380)=ANY=[@ANYBLOB="3c0000001000850600"/20, @ANYRES32=r2, @ANYBLOB="01000000000000001c0012000c000100626f6e64000000000c0002000800010006"], 0x3c}}, 0x14)
r3 = socket$nl_route(0x10, 0x3, 0x0)
getsockname$packet(r1, &(0x7f0000000100)={0x11, 0x0, <r4=>0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000180)=0x14)
sendmsg$nl_route(r3, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000300)={&(0x7f0000000440)=@newlink={0x4c, 0x10, 0x403, 0x70bd27, 0x0, {0x0, 0x0, 0x0, 0x0, 0x91446}, [@IFLA_LINKINFO={0x24, 0x12, 0x0, 0x1, @vlan={{0x9}, {0x14, 0x2, 0x0, 0x1, [@IFLA_VLAN_ID={0x6, 0x1, 0x1}, @IFLA_VLAN_PROTOCOL={0x6, 0x5, 0x8100}]}}}, @IFLA_LINK={0x8, 0x5, r4}]}, 0x4c}, 0x1, 0x0, 0x0, 0x20000600}, 0x0)
sendmsg$nl_route(r3, &(0x7f0000000240)={0x0, 0x0, &(0x7f00000001c0)={&(0x7f0000000280)=@newlink={0x44, 0x10, 0xffffff1f, 0x70bd26, 0x1, {0x0, 0x0, 0x0, 0x0, 0x8008, 0x4408}, [@IFLA_LINKINFO={0x1c, 0x12, 0x0, 0x1, @geneve={{0xb}, {0xc, 0x2, 0x0, 0x1, [@IFLA_GENEVE_TTL_INHERIT={0x5, 0xc, 0x1}]}}}, @IFLA_MASTER={0x8, 0xa, r2}]}, 0x44}, 0x1, 0x0, 0x0, 0x40000}, 0x84)
r5 = fanotify_init(0x0, 0x800)
r6 = openat$selinux_commit_pending_bools(0xffffffffffffff9c, &(0x7f0000000000), 0x1, 0x0)
fanotify_mark(r5, 0x8, 0x40001001, r6, &(0x7f00000000c0)='./file0\x00')
madvise(&(0x7f00000ec000/0x800000)=nil, 0x800000, 0x19)
executing program 1:
socket$packet(0x11, 0x3, 0x300) (async)
lseek(0xffffffffffffffff, 0x7, 0x3)
r0 = socket$rds(0x15, 0x5, 0x0)
ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000080)={'xfrm0\x00'})
r1 = syz_open_dev$sndctrl(&(0x7f0000000000), 0x0, 0x101700)
r2 = socket$nl_generic(0x10, 0x3, 0x10) (async)
r3 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000180), 0xffffffffffffffff)
sendmsg$NL80211_CMD_SET_QOS_MAP(r2, &(0x7f0000000480)={&(0x7f0000000140)={0x10, 0x0, 0x0, 0x4000}, 0xc, &(0x7f0000000440)={&(0x7f0000000340)=ANY=[@ANYBLOB, @ANYRES16=r3, @ANYBLOB="00022abd7000fbdbdf25680000000c009900050000001f0000001400c7000701320107030604cb7076c73152e2fb1e00c700f302010210030405f2000006010201043501ffffffffffffffaf00002c00c70002060202020009040e04f80301070d060e0204000203040403050200070201079f743c7d0d3b23021200c7000201710106077abc8b1f5529e04f00002800c700070511020c050206b8020703e20506000303030630056504050307034cee9248fc7f461c1e00c700000001029701040139010700030504036603a8b439d47ca78e320000"], 0xdc}}, 0x40000) (async)
ioctl$SNDRV_CTL_IOCTL_PCM_PREFER_SUBDEVICE(r1, 0x40045532, &(0x7f0000000080)) (async)
socket$nl_netfilter(0x10, 0x3, 0xc)
r4 = openat$audio(0xffffffffffffff9c, &(0x7f0000000240), 0x400000000a0a01, 0x0) (async)
r5 = syz_open_dev$sndpcmp(&(0x7f0000000200), 0x0, 0xa2c65)
r6 = socket$inet6_sctp(0xa, 0x5, 0x84) (async)
r7 = syz_open_dev$dvb_demux(&(0x7f0000001e00), 0x0, 0x2000)
ioctl$DVB_DEMUX_DMX_SET_PES_FILTER(r7, 0x40146f2c, &(0x7f00000001c0)={0x2, 0x1, 0x1, 0xe, 0x4}) (async)
ioctl$sock_SIOCGIFINDEX_80211(r0, 0x8933, &(0x7f0000000500)={'wlan1\x00', <r8=>0x0})
sendmsg$NL80211_CMD_CRIT_PROTOCOL_START(r2, &(0x7f0000000640)={&(0x7f00000004c0)={0x10, 0x0, 0x0, 0x10000}, 0xc, &(0x7f0000000600)={&(0x7f0000000700)=ANY=[@ANYBLOB="50000000cce8426b4b79b93f60e86b922a3db8a5ce1c357ca8e45b1d447c41bc1e0d390f8282be5145978050d39d4fc08884cb07f29351dcf9459afd3f22f1b7b0ab0cc8aca1a85bbef06cc464a9eef6d87c4e0879158feb6387ded6446e10eb757d2f68ed014844168202c6f40a155aca1d6f3e69683dd8a4beffffcf49ce130c097e1a36b6842c4871b121485d49c74313ede6b74c5b384256086a4be81061c829e65539194a5b03211a47b48b9ae85b356c2c6d5f52777968a4b445a86cae39a442dc55200393226f8e5a74189378b88fe9fffe1bc54b1aa5f679c8fddc5d33d3d2c2a6af69121e65de830e4a539dcba90c3808ab61e8e7ad0532eb9e26944b0f37ee4cd3ae377423b5402a5ee1c71b5b8b1e723d782074180eaa4472fcb7398f5331cf15", @ANYRES16=r3, @ANYBLOB="000128bd7000fcdbdf256200000008000300", @ANYRES32=r8, @ANYBLOB="0c009900954700006c0000000600b400f31100000600b400b60a00000600b400360000000600b300000000000600b400c3110000"], 0x50}, 0x1, 0x0, 0x0, 0x44001}, 0x140) (async)
close_range(r7, 0xffffffffffffffff, 0x0)
getsockopt$inet_sctp6_SCTP_PEER_ADDR_PARAMS(r6, 0x84, 0x9, &(0x7f0000000240)={0x0, @in={{0x2, 0x4e22, @multicast2}}, 0x0, 0x5, 0x80000000, 0x7, 0x20, 0x7, 0x8}, &(0x7f0000000300)=0x9c)
write$RDMA_USER_CM_CMD_CREATE_ID(r4, &(0x7f0000000040)={0x0, 0x18, 0xfa00, {0x3, 0x0, 0x39, 0x9}}, 0x20)
ioctl$SNDRV_PCM_IOCTL_HW_FREE(r5, 0x4112, 0x0) (async)
ioctl$SNDCTL_DSP_GETOSPACE(r4, 0x8010500c, &(0x7f0000000300))
r9 = socket$nl_generic(0x10, 0x3, 0x10)
sendmsg$nl_generic(r9, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000140)={&(0x7f00000004c0)=ANY=[@ANYBLOB="18000000260001031dbd7002fadbdf25010000000400ae"], 0x18}}, 0x0) (async)
recvmmsg(r9, &(0x7f00000006c0)=[{{0x0, 0x0, &(0x7f0000000640)=[{&(0x7f0000000180)=""/144, 0x90}, {&(0x7f0000000040)=""/218, 0xda}], 0x2}, 0x2}], 0x1, 0x0, 0x0) (async)
sendmsg$inet(0xffffffffffffffff, &(0x7f0000000000)={0x0, 0x0, 0x0, 0x0, &(0x7f0000000100)=ANY=[@ANYBLOB="1c000000000000000000000007000000890b040a0101"], 0x40}, 0xfffe) (async)
r10 = openat$tun(0xffffffffffffff9c, &(0x7f0000000000), 0x48241, 0x0)
ioctl$TUNSETIFF(r10, 0x400454ca, &(0x7f00000000c0)={'syzkaller1\x00', 0x6bf1c2d5adba8c32}) (async)
sendmsg$nl_route(0xffffffffffffffff, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000001140)={&(0x7f0000000100)=ANY=[@ANYRES8, @ANYRES32, @ANYBLOB="0000000000000000400012800c0001"], 0x68}}, 0x0)
socket$igmp6(0xa, 0x3, 0x2)

program did not crash
bisect: testing without sub-chunk 3/3
testing program (duration=32s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): [40, 30, 36, 19, 21, 3, 12, 8, 30, 17, 20]
detailed listing:
executing program 3:
seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0x0, &(0x7f00000000c0)={0x1, &(0x7f0000000040)=[{0x6, 0x0, 0x0, 0x7fffffff}]}) (async)
r0 = seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0x0, &(0x7f00000000c0)={0x1, &(0x7f0000000040)=[{0x6, 0x0, 0x0, 0x7fffffff}]})
r1 = socket$nl_route(0x10, 0x3, 0x0)
ioctl$sock_SIOCGIFINDEX(r1, 0x8933, &(0x7f0000000340)={'virt_wifi0\x00', <r2=>0x0})
sendmsg$nl_route_sched(r1, &(0x7f0000000b00)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000640)=@delqdisc={0x2dc, 0x26, 0x1, 0x70ad2b, 0x25dfdbfc, {0x0, 0x0, 0x0, r2, {}, {0xffff, 0xffff}, {0xf, 0x3}}, [@qdisc_kind_options=@q_taprio={{0xb}, {0x2c, 0x2, [@TCA_TAPRIO_ATTR_SCHED_CLOCKID={0x8, 0x5, 0x7f}, @TCA_TAPRIO_ATTR_SCHED_BASE_TIME={0xc, 0x3, 0xffff}, @TCA_TAPRIO_ATTR_SCHED_CLOCKID={0x8}, @TCA_TAPRIO_ATTR_SCHED_BASE_TIME={0xc, 0x3, 0x5}]}}, @TCA_STAB={0xa0, 0x8, 0x0, 0x1, [{{0x1c, 0x1, {0x60, 0x7, 0x9, 0x0, 0x0, 0xd, 0xc2, 0x1}}, {0x6, 0x2, [0x3]}}, {{0x1c, 0x1, {0x9, 0x7, 0x1, 0x4, 0x0, 0x7, 0x2, 0x9}}, {0x16, 0x2, [0x0, 0x0, 0xffff, 0xbacf, 0xa, 0x6, 0x8, 0x3ff, 0x7]}}, {{0x1c, 0x1, {0x7f, 0x0, 0xd995, 0x3ff, 0x0, 0x3, 0x3, 0x1}}, {0x6, 0x2, [0x7f]}}, {{0x1c, 0x1, {0x1, 0x10, 0x1, 0x0, 0x0, 0x7}}, {0x4}}]}, @qdisc_kind_options=@q_cake={{0x9}, {0x2c, 0x2, [@TCA_CAKE_DIFFSERV_MODE={0x8}, @TCA_CAKE_RAW={0x8}, @TCA_CAKE_MPU={0x8, 0xe, 0xb9}, @TCA_CAKE_NAT={0x8}, @TCA_CAKE_MEMORY={0x8, 0xa, 0x80000001}]}}, @TCA_STAB={0xc4, 0x8, 0x0, 0x1, [{{0x1c, 0x1, {0x1, 0x0, 0x4, 0x8, 0x2, 0x962a, 0x1486, 0x3}}, {0xa, 0x2, [0x4, 0x9, 0x81]}}, {{0x1c, 0x1, {0x3, 0x6, 0x3, 0x1c00000, 0x0, 0x9ea1, 0x5, 0x1}}, {0x6, 0x2, [0x6]}}, {{0x1c, 0x1, {0x95, 0x1, 0x8, 0x200, 0x0, 0x3fe, 0x400, 0x2}}, {0x8, 0x2, [0x85, 0x4]}}, {{0x1c, 0x1, {0xa0, 0x1, 0x9, 0x5e, 0x1, 0x10001, 0x5, 0x5}}, {0xe, 0x2, [0x4, 0xfdf, 0x1154, 0x10ed, 0x9]}}, {{0x1c, 0x1, {0xc3, 0x5, 0x5, 0xb473, 0x2, 0xfffffff7, 0x1ff, 0x2}}, {0x8, 0x2, [0x81, 0x685c]}}]}, @TCA_RATE={0x6, 0x5, {0x7, 0x1}}, @TCA_STAB={0xd4, 0x8, 0x0, 0x1, [{{0x1c, 0x1, {0x5, 0x66, 0x1ff, 0x4b, 0x1, 0x870, 0xfffffffa, 0x1}}, {0x6, 0x2, [0x9]}}, {{0x1c, 0x1, {0x2, 0x4a, 0x6, 0x6, 0x1, 0xa, 0x4, 0x5}}, {0xe, 0x2, [0x101, 0x7f, 0xf457, 0x7, 0x7]}}, {{0x1c, 0x1, {0x3, 0x10, 0x9, 0x8001, 0x0, 0x6, 0xffff, 0xa}}, {0x18, 0x2, [0x3b4, 0x4, 0x78, 0x2000, 0x67, 0x1, 0x1, 0xc, 0xa, 0x8]}}, {{0x1c, 0x1, {0x1, 0x55, 0x3b0, 0xa, 0x2, 0x0, 0x0, 0x3}}, {0xa, 0x2, [0x0, 0x8, 0x0]}}, {{0x1c, 0x1, {0x0, 0x0, 0x6, 0x925, 0x0, 0x2, 0x3, 0x2}}, {0x8, 0x2, [0x1, 0x9]}}]}, @TCA_INGRESS_BLOCK={0x8, 0xd, 0x1}]}, 0x2dc}, 0x1, 0x0, 0x0, 0x4081}, 0x0) (async)
sendmsg$nl_route_sched(r1, &(0x7f0000000b00)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000640)=@delqdisc={0x2dc, 0x26, 0x1, 0x70ad2b, 0x25dfdbfc, {0x0, 0x0, 0x0, r2, {}, {0xffff, 0xffff}, {0xf, 0x3}}, [@qdisc_kind_options=@q_taprio={{0xb}, {0x2c, 0x2, [@TCA_TAPRIO_ATTR_SCHED_CLOCKID={0x8, 0x5, 0x7f}, @TCA_TAPRIO_ATTR_SCHED_BASE_TIME={0xc, 0x3, 0xffff}, @TCA_TAPRIO_ATTR_SCHED_CLOCKID={0x8}, @TCA_TAPRIO_ATTR_SCHED_BASE_TIME={0xc, 0x3, 0x5}]}}, @TCA_STAB={0xa0, 0x8, 0x0, 0x1, [{{0x1c, 0x1, {0x60, 0x7, 0x9, 0x0, 0x0, 0xd, 0xc2, 0x1}}, {0x6, 0x2, [0x3]}}, {{0x1c, 0x1, {0x9, 0x7, 0x1, 0x4, 0x0, 0x7, 0x2, 0x9}}, {0x16, 0x2, [0x0, 0x0, 0xffff, 0xbacf, 0xa, 0x6, 0x8, 0x3ff, 0x7]}}, {{0x1c, 0x1, {0x7f, 0x0, 0xd995, 0x3ff, 0x0, 0x3, 0x3, 0x1}}, {0x6, 0x2, [0x7f]}}, {{0x1c, 0x1, {0x1, 0x10, 0x1, 0x0, 0x0, 0x7}}, {0x4}}]}, @qdisc_kind_options=@q_cake={{0x9}, {0x2c, 0x2, [@TCA_CAKE_DIFFSERV_MODE={0x8}, @TCA_CAKE_RAW={0x8}, @TCA_CAKE_MPU={0x8, 0xe, 0xb9}, @TCA_CAKE_NAT={0x8}, @TCA_CAKE_MEMORY={0x8, 0xa, 0x80000001}]}}, @TCA_STAB={0xc4, 0x8, 0x0, 0x1, [{{0x1c, 0x1, {0x1, 0x0, 0x4, 0x8, 0x2, 0x962a, 0x1486, 0x3}}, {0xa, 0x2, [0x4, 0x9, 0x81]}}, {{0x1c, 0x1, {0x3, 0x6, 0x3, 0x1c00000, 0x0, 0x9ea1, 0x5, 0x1}}, {0x6, 0x2, [0x6]}}, {{0x1c, 0x1, {0x95, 0x1, 0x8, 0x200, 0x0, 0x3fe, 0x400, 0x2}}, {0x8, 0x2, [0x85, 0x4]}}, {{0x1c, 0x1, {0xa0, 0x1, 0x9, 0x5e, 0x1, 0x10001, 0x5, 0x5}}, {0xe, 0x2, [0x4, 0xfdf, 0x1154, 0x10ed, 0x9]}}, {{0x1c, 0x1, {0xc3, 0x5, 0x5, 0xb473, 0x2, 0xfffffff7, 0x1ff, 0x2}}, {0x8, 0x2, [0x81, 0x685c]}}]}, @TCA_RATE={0x6, 0x5, {0x7, 0x1}}, @TCA_STAB={0xd4, 0x8, 0x0, 0x1, [{{0x1c, 0x1, {0x5, 0x66, 0x1ff, 0x4b, 0x1, 0x870, 0xfffffffa, 0x1}}, {0x6, 0x2, [0x9]}}, {{0x1c, 0x1, {0x2, 0x4a, 0x6, 0x6, 0x1, 0xa, 0x4, 0x5}}, {0xe, 0x2, [0x101, 0x7f, 0xf457, 0x7, 0x7]}}, {{0x1c, 0x1, {0x3, 0x10, 0x9, 0x8001, 0x0, 0x6, 0xffff, 0xa}}, {0x18, 0x2, [0x3b4, 0x4, 0x78, 0x2000, 0x67, 0x1, 0x1, 0xc, 0xa, 0x8]}}, {{0x1c, 0x1, {0x1, 0x55, 0x3b0, 0xa, 0x2, 0x0, 0x0, 0x3}}, {0xa, 0x2, [0x0, 0x8, 0x0]}}, {{0x1c, 0x1, {0x0, 0x0, 0x6, 0x925, 0x0, 0x2, 0x3, 0x2}}, {0x8, 0x2, [0x1, 0x9]}}]}, @TCA_INGRESS_BLOCK={0x8, 0xd, 0x1}]}, 0x2dc}, 0x1, 0x0, 0x0, 0x4081}, 0x0)
close_range(r0, 0xffffffffffffffff, 0x0) (async)
close_range(r0, 0xffffffffffffffff, 0x0)
sendmsg$nl_route_sched(r1, &(0x7f0000000380)={&(0x7f0000000240)={0x10, 0x0, 0x0, 0x2000000}, 0xc, &(0x7f0000000300)={&(0x7f00000002c0)=@delqdisc={0x3c, 0x25, 0x400, 0x70bd29, 0x25dfdbfb, {0x0, 0x0, 0x0, r2, {0xe, 0x6}, {}, {0x2, 0x4}}, [@TCA_RATE={0x6, 0x5, {0x2}}, @TCA_EGRESS_BLOCK={0x8, 0xe, 0x5}, @TCA_INGRESS_BLOCK={0x8, 0xd, 0x7}]}, 0x3c}, 0x1, 0x0, 0x0, 0x42805}, 0x20040002)
socket$inet_udp(0x2, 0x2, 0x0)
r3 = socket$inet6_tcp(0xa, 0x1, 0x0)
bind$inet6(r3, &(0x7f0000000080)={0xa, 0x2, 0x200, @loopback, 0x7}, 0x1c) (async)
bind$inet6(r3, &(0x7f0000000080)={0xa, 0x2, 0x200, @loopback, 0x7}, 0x1c)
sendto$inet6(r3, 0x0, 0x0, 0x24000045, &(0x7f00000001c0)={0xa, 0x2, 0xffff, @loopback, 0x9}, 0x1c)
setsockopt$inet6_tcp_TCP_CONGESTION(r3, 0x6, 0xd, &(0x7f0000000140)='illinois', 0x8)
shutdown(r3, 0x1)
r4 = socket$nl_route(0x10, 0x3, 0x0)
r5 = socket$nl_route(0x10, 0x3, 0x0)
setsockopt$netlink_NETLINK_NO_ENOBUFS(r5, 0x10e, 0xc, &(0x7f0000000040)=0x7f, 0x4) (async)
setsockopt$netlink_NETLINK_NO_ENOBUFS(r5, 0x10e, 0xc, &(0x7f0000000040)=0x7f, 0x4)
r6 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0)
r7 = ioctl$KVM_CREATE_VM(r6, 0xae01, 0x0)
r8 = ioctl$KVM_CREATE_GUEST_MEMFD(r7, 0xc040aed4, &(0x7f00000001c0)={0x1000200001ee0000, 0x3})
mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xa, 0x28011, r8, 0x78d4a000)
get_mempolicy(0x0, 0x0, 0x3, &(0x7f000024c000/0x2000)=nil, 0x2) (async)
get_mempolicy(0x0, 0x0, 0x3, &(0x7f000024c000/0x2000)=nil, 0x2)
syz_init_net_socket$nl_generic(0x10, 0x3, 0x10)
sendmsg$nl_route(r5, &(0x7f0000000100)={0x0, 0x20, &(0x7f00000000c0)={&(0x7f0000000000)=ANY=[@ANYBLOB="240000001a0001000000ff7f0000000080200000", @ANYRES32=0x0, @ANYBLOB='\x00\x00\x00\x00\b\x00', @ANYRES32=r5], 0x24}}, 0x0) (async)
sendmsg$nl_route(r5, &(0x7f0000000100)={0x0, 0x20, &(0x7f00000000c0)={&(0x7f0000000000)=ANY=[@ANYBLOB="240000001a0001000000ff7f0000000080200000", @ANYRES32=0x0, @ANYBLOB='\x00\x00\x00\x00\b\x00', @ANYRES32=r5], 0x24}}, 0x0)
r9 = fsopen(&(0x7f0000000280)='ceph\x00', 0x0)
r10 = socket$inet(0x2, 0x2, 0x0)
bpf$PROG_LOAD(0x5, &(0x7f0000000080)={0x1, 0x5, &(0x7f0000002c00)=ANY=[@ANYBLOB="bf16000000000000b70700000900f0ff4070000000000000500000000000000095000000000000002ba728041598d6fbd30cb599e8c73d24a3aa81d36bb3019c13bd23212fb56fa54f26fb0b71d0e6adfefc41d86bd917487960717142fa9ea4318123741c0a0e168c1886d0d4d94f2f4e345c652ebc1626e3a2a2ad35806150ae0209e62f51ee988e6e0dc8ce974a22a550d6fd70800c86ae3b3e05df3ceb9fc474c2a100c788b277beee1cbf9b0a4def23d410f6296b32a8343881dcc7b1b85f3c3d44aeaccd3641110bec4e90a6341965c39e4b3449abe802f5ab3e89cf6c662ed4048d3b3e22278d00031e5388ee6f867ddd58211d6ececb0cd2b6d357b8580218ce740068725837074e468ee23fd2f73902ebcfcf49822775985bf31b715f5888b2c81f96a810b946855c9fc52ac17cbc97a616811a4c2dc3470009b966abaf41939aeca3e7b00c2e9d5db7a34fe2a29ac88c360a878a2b9ab9440c1961e80477166f3f847e855cdddc941d996d61ea0ce23b37e9d21c849d1e1e53087a3b109012e3a3ecbd219265048bf5c72b7ba2806b73323301b4bc94d0e4afde44867d71049a7c89bc615e215571ac910d80a58b5169576ff9906c34d2342806960b6bcb00000000000000000000000000113ee640b9ed1e04a0bfb125204d30990361bf45ef45277a167cd2c2e6ce9138143aa5ea7ee6f7c6d8b00437e070b004c5aa90766538b4fe45a16f14b270904d36eaa87508ac6d46639b3971ac6a88dc531fcc5ffc6b76b334795d88156336a9a452a9022485bb572dacb7aa25f748bc75918a16d9d5ae21004cd799ac4951beb2c6c9b5baf60081b86cc2e31c49f4ea055fb3639036c95c69b1ae60e685d486dbd1d5e7d0daacd73acfc80b9c9c92"], &(0x7f0000000140)='GPL\x00'}, 0x48) (async)
r11 = bpf$PROG_LOAD(0x5, &(0x7f0000000080)={0x1, 0x5, &(0x7f0000002c00)=ANY=[@ANYBLOB="bf16000000000000b70700000900f0ff4070000000000000500000000000000095000000000000002ba728041598d6fbd30cb599e8c73d24a3aa81d36bb3019c13bd23212fb56fa54f26fb0b71d0e6adfefc41d86bd917487960717142fa9ea4318123741c0a0e168c1886d0d4d94f2f4e345c652ebc1626e3a2a2ad35806150ae0209e62f51ee988e6e0dc8ce974a22a550d6fd70800c86ae3b3e05df3ceb9fc474c2a100c788b277beee1cbf9b0a4def23d410f6296b32a8343881dcc7b1b85f3c3d44aeaccd3641110bec4e90a6341965c39e4b3449abe802f5ab3e89cf6c662ed4048d3b3e22278d00031e5388ee6f867ddd58211d6ececb0cd2b6d357b8580218ce740068725837074e468ee23fd2f73902ebcfcf49822775985bf31b715f5888b2c81f96a810b946855c9fc52ac17cbc97a616811a4c2dc3470009b966abaf41939aeca3e7b00c2e9d5db7a34fe2a29ac88c360a878a2b9ab9440c1961e80477166f3f847e855cdddc941d996d61ea0ce23b37e9d21c849d1e1e53087a3b109012e3a3ecbd219265048bf5c72b7ba2806b73323301b4bc94d0e4afde44867d71049a7c89bc615e215571ac910d80a58b5169576ff9906c34d2342806960b6bcb00000000000000000000000000113ee640b9ed1e04a0bfb125204d30990361bf45ef45277a167cd2c2e6ce9138143aa5ea7ee6f7c6d8b00437e070b004c5aa90766538b4fe45a16f14b270904d36eaa87508ac6d46639b3971ac6a88dc531fcc5ffc6b76b334795d88156336a9a452a9022485bb572dacb7aa25f748bc75918a16d9d5ae21004cd799ac4951beb2c6c9b5baf60081b86cc2e31c49f4ea055fb3639036c95c69b1ae60e685d486dbd1d5e7d0daacd73acfc80b9c9c92"], &(0x7f0000000140)='GPL\x00'}, 0x48)
setsockopt$IPT_SO_SET_REPLACE(r10, 0x0, 0x40, &(0x7f0000000a80)=@raw={'raw\x00', 0x8, 0x3, 0x450, 0x2e8, 0x40000, 0x198, 0x2e8, 0x198, 0x3b8, 0x358, 0x358, 0x3b8, 0x358, 0x3, 0x0, {[{{@ip={@multicast2, @dev={0xac, 0x14, 0x14, 0x16}, 0x0, 0x0, 'vcan0\x00', 'wg1\x00', {}, {}, 0x0, 0x1}, 0x0, 0x2c8, 0x2e8, 0x0, {}, [@common=@unspec=@bpf1={{0x230}, @fd={0x2, 0x0, r11}}, @inet=@rpfilter={{0x28}, {0x9}}]}, @unspec=@TRACE={0x20}}, {{@ip={@remote, @dev, 0x0, 0x0, 'team_slave_1\x00', 'netdevsim0\x00', {}, {}, 0x0, 0x2}, 0x0, 0x70, 0xd0}, @common=@CLUSTERIP={0x60, 'CLUSTERIP\x00', 0x0, {0x0, @empty, 0x3, 0x10, [0x48, 0x37, 0x32, 0x26, 0x2, 0x2d, 0x29, 0x17, 0x23, 0x1c, 0xe, 0x38, 0xb, 0x22, 0x27, 0xd], 0x2, 0x4b, 0x9}}}], {{'\x00', 0x0, 0x70, 0x98}, {0x28, '\x00', 0x4}}}}, 0x4b0) (async)
setsockopt$IPT_SO_SET_REPLACE(r10, 0x0, 0x40, &(0x7f0000000a80)=@raw={'raw\x00', 0x8, 0x3, 0x450, 0x2e8, 0x40000, 0x198, 0x2e8, 0x198, 0x3b8, 0x358, 0x358, 0x3b8, 0x358, 0x3, 0x0, {[{{@ip={@multicast2, @dev={0xac, 0x14, 0x14, 0x16}, 0x0, 0x0, 'vcan0\x00', 'wg1\x00', {}, {}, 0x0, 0x1}, 0x0, 0x2c8, 0x2e8, 0x0, {}, [@common=@unspec=@bpf1={{0x230}, @fd={0x2, 0x0, r11}}, @inet=@rpfilter={{0x28}, {0x9}}]}, @unspec=@TRACE={0x20}}, {{@ip={@remote, @dev, 0x0, 0x0, 'team_slave_1\x00', 'netdevsim0\x00', {}, {}, 0x0, 0x2}, 0x0, 0x70, 0xd0}, @common=@CLUSTERIP={0x60, 'CLUSTERIP\x00', 0x0, {0x0, @empty, 0x3, 0x10, [0x48, 0x37, 0x32, 0x26, 0x2, 0x2d, 0x29, 0x17, 0x23, 0x1c, 0xe, 0x38, 0xb, 0x22, 0x27, 0xd], 0x2, 0x4b, 0x9}}}], {{'\x00', 0x0, 0x70, 0x98}, {0x28, '\x00', 0x4}}}}, 0x4b0)
fsconfig$FSCONFIG_SET_STRING(r9, 0x1, &(0x7f0000000b40)='source', &(0x7f0000000040)='c:::\x00', 0x0)
sendmsg$nl_route(r4, &(0x7f0000000200)={&(0x7f0000000080)={0x10, 0x0, 0x0, 0x10000}, 0xc, &(0x7f00000001c0)={&(0x7f00000003c0)=ANY=[@ANYBLOB="60000000680010002bbd7000fcdbdf250000016c628248000400000006000700030000001400060000000000000000000000ffffe000020400040014000600fe8000000000000000000000000000bb0600030001000000040004000600070016b6b1c3743f50f418c7e7dbbf400f4572129ee24d86ca5ff823d02b29be494923a8aaa4b47d7ef1f3a28fec72c6abbaea5dda008b8a3bb6235999664625c8cfdcaa6615a8f7df4f233cafa3d868e661ad4e3ceb5891fb925df0d2781bae0c773fc9b8b083ba36c4398576350a6845daecae5c72af66c7b7eac1fe54ead22a31399b288ac47d54b2adff1bc71e1cf0b0caca6f91f721e4e5b4884effb45269ebc565ec33f8b8ca63800344014c"], 0x60}}, 0x800)
gettid()
fsconfig$FSCONFIG_CMD_CREATE(r9, 0x6, 0x0, 0x0, 0x0) (async)
fsconfig$FSCONFIG_CMD_CREATE(r9, 0x6, 0x0, 0x0, 0x0)
executing program 3:
socket$nl_netfilter(0x10, 0x3, 0xc)
r0 = socket$inet6_tcp(0xa, 0x1, 0x0)
connect$inet6(r0, 0x0, 0x0)
r1 = gettid()
timer_create(0x0, &(0x7f0000533fa0)={0x0, 0x21, 0x800000000004, @tid=r1}, &(0x7f0000000140))
timer_settime(0x0, 0x0, &(0x7f0000000280)={{0x0, 0x989680}, {0x0, 0x989680}}, 0x0)
mmap$IORING_OFF_SQ_RING(0x110c230000, 0x8000002, 0x2000007, 0x401d031, 0xffffffffffffffff, 0x0)
socketpair$unix(0x1, 0x0, 0x0, 0x0)
openat$ptmx(0xffffffffffffff9c, 0x0, 0x482, 0x0)
r2 = socket(0x1, 0x2, 0x0)
getsockopt$sock_cred(r2, 0x1, 0x11, 0x0, &(0x7f0000cab000))
setsockopt$sock_cred(0xffffffffffffffff, 0x1, 0x11, 0x0, 0x0)
lremovexattr(0x0, 0x0)
setsockopt$inet6_tcp_TCP_REPAIR_QUEUE(r0, 0x6, 0x14, 0x0, 0x0)
mmap(&(0x7f0000000000/0x4000)=nil, 0x4000, 0x1, 0x10012, 0xffffffffffffffff, 0x5deba000)
mmap(&(0x7f0000bfe000/0x400000)=nil, 0x400000, 0x4, 0x40010, r0, 0xd1aa000)
mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x3, 0x8031, 0xffffffffffffffff, 0x0)
r3 = openat$audio(0xffffffffffffff9c, &(0x7f0000000380), 0x149842, 0x0)
write$dsp(r3, &(0x7f00000003c0)="91", 0xffffffb5)
mmap$dsp(&(0x7f0000ffd000/0x2000)=nil, 0x2000, 0x100000b, 0x810, r3, 0x0)
close(r3)
socket$xdp(0x2c, 0x3, 0x0)
r4 = socket$kcm(0xa, 0x2, 0x0)
setsockopt$inet6_tcp_TCP_CONGESTION(r0, 0x6, 0xd, &(0x7f0000000040)='veno', 0x4)
r5 = socket(0x2, 0x80805, 0x0)
r6 = openat$fuse(0xffffffffffffff9c, &(0x7f0000000080), 0x2, 0x0)
read$FUSE(r6, &(0x7f0000000600)={0x2020}, 0x2020)
setsockopt$IP_VS_SO_SET_ADD(r5, 0x0, 0x482, &(0x7f0000000240)={0x84, @dev={0xac, 0x14, 0x14, 0x15}, 0x4e20, 0x3, 'wlc\x00', 0x2, 0x660f537e, 0x3}, 0x2c)
setsockopt$IP_VS_SO_SET_ADDDEST(r5, 0x0, 0x487, &(0x7f0000000440)={{0x84, @multicast2, 0x4e22, 0x3, 'ovf\x00', 0x5, 0xc, 0x6c}, {@private=0xa010101, 0x4e23, 0x10002, 0x1, 0x1}}, 0x44)
sendmsg$sock(r4, &(0x7f0000000400)={&(0x7f0000000580)=@in6={0x2, 0x4e20, 0x0, @dev={0xfe, 0x80, '\x00', 0xfd}}, 0x80, 0x0, 0x0, &(0x7f0000000000)=[@mark={{0x14, 0x1, 0x24, 0x3}}], 0x18}, 0x0)
executing program 3:
r0 = syz_usb_connect(0x0, 0x32, &(0x7f0000000000)=ANY=[@ANYBLOB="1201000200000040a61b01000100000000010902200001010080320904"], 0x0)
r1 = openat$ptp1(0xffffffffffffff9c, &(0x7f0000000c40), 0x149201, 0x0)
ioctl$PTP_ENABLE_PPS(r1, 0x40043d04, 0x1)
r2 = socket$kcm(0x10, 0x2, 0x4)
sendmsg$inet(r2, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)=[{&(0x7f0000000100)="5c00000012006bab9e3fe3d86e6c1d0000147ea60864160af36504b68675f8001d000a00a0e69ee517d34460bc24eab556a705251e6182949a36c23d3b48dfd8cdbf9367b4fa51f60a64c9f4080003680601000008000300ff000000", 0x5c}], 0x1, 0x0, 0x0, 0x1f00c00e}, 0x0)
r3 = syz_usb_connect$uac3(0x3, 0x80, &(0x7f0000000280)=ANY=[], 0x0)
syz_usb_control_io(r0, 0x0, 0x0)
syz_usb_control_io$sierra_net(r0, 0x0, &(0x7f0000000700)={0x1c, &(0x7f0000000280)=ANY=[], 0x0, 0x0})
syz_usb_control_io$uac3(r3, 0x0, 0x0)
syz_usb_control_io$printer(r0, 0x0, &(0x7f00000005c0)={0x34, &(0x7f00000003c0)=ANY=[], 0x0, 0x0, 0x0, 0x0, 0x0})
mkdirat(0xffffffffffffff9c, &(0x7f0000000200)='./file0\x00', 0x0)
r4 = openat(0xffffffffffffff9c, &(0x7f0000000080)='./file0\x00', 0x0, 0xd5)
ioctl$FS_IOC_GETFLAGS(r4, 0x80086601, &(0x7f0000000100))
syz_open_dev$dvb_frontend(&(0x7f0000000100), 0x1, 0x802)
r5 = socket$inet6_sctp(0xa, 0x801, 0x84)
getsockopt$bt_hci(r5, 0x84, 0x81, &(0x7f0000001280)=""/4107, &(0x7f00000000c0)=0x100b)
r6 = socket$rxrpc(0x21, 0x2, 0x2)
setsockopt$RXRPC_MIN_SECURITY_LEVEL(r6, 0x110, 0x4, &(0x7f0000000440)=0x1, 0x4)
syz_usb_connect(0x0, 0x32, &(0x7f0000000000)=ANY=[@ANYBLOB="1201000200000040a61b01000100000000010902200001010080320904"], 0x0) (async)
openat$ptp1(0xffffffffffffff9c, &(0x7f0000000c40), 0x149201, 0x0) (async)
ioctl$PTP_ENABLE_PPS(r1, 0x40043d04, 0x1) (async)
socket$kcm(0x10, 0x2, 0x4) (async)
sendmsg$inet(r2, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)=[{&(0x7f0000000100)="5c00000012006bab9e3fe3d86e6c1d0000147ea60864160af36504b68675f8001d000a00a0e69ee517d34460bc24eab556a705251e6182949a36c23d3b48dfd8cdbf9367b4fa51f60a64c9f4080003680601000008000300ff000000", 0x5c}], 0x1, 0x0, 0x0, 0x1f00c00e}, 0x0) (async)
syz_usb_connect$uac3(0x3, 0x80, &(0x7f0000000280)=ANY=[], 0x0) (async)
syz_usb_control_io(r0, 0x0, 0x0) (async)
syz_usb_control_io$sierra_net(r0, 0x0, &(0x7f0000000700)={0x1c, &(0x7f0000000280)=ANY=[], 0x0, 0x0}) (async)
syz_usb_control_io$uac3(r3, 0x0, 0x0) (async)
syz_usb_control_io$printer(r0, 0x0, &(0x7f00000005c0)={0x34, &(0x7f00000003c0)=ANY=[], 0x0, 0x0, 0x0, 0x0, 0x0}) (async)
mkdirat(0xffffffffffffff9c, &(0x7f0000000200)='./file0\x00', 0x0) (async)
openat(0xffffffffffffff9c, &(0x7f0000000080)='./file0\x00', 0x0, 0xd5) (async)
ioctl$FS_IOC_GETFLAGS(r4, 0x80086601, &(0x7f0000000100)) (async)
syz_open_dev$dvb_frontend(&(0x7f0000000100), 0x1, 0x802) (async)
socket$inet6_sctp(0xa, 0x801, 0x84) (async)
getsockopt$bt_hci(r5, 0x84, 0x81, &(0x7f0000001280)=""/4107, &(0x7f00000000c0)=0x100b) (async)
socket$rxrpc(0x21, 0x2, 0x2) (async)
setsockopt$RXRPC_MIN_SECURITY_LEVEL(r6, 0x110, 0x4, &(0x7f0000000440)=0x1, 0x4) (async)
executing program 2:
r0 = syz_open_dev$dri(&(0x7f0000000040), 0x0, 0x442a02)
ioctl$DRM_IOCTL_GET_MAGIC(r0, 0x80046402, 0x0)
r1 = seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0x0, &(0x7f0000000040)={0x1, &(0x7f0000000000)=[{0x6, 0x0, 0x0, 0x7fff8000}]})
close_range(r1, 0xffffffffffffffff, 0x0)
madvise(&(0x7f0000f19000/0x1000)=nil, 0x1000, 0xa)
openat$cgroup_type(0xffffffffffffffff, &(0x7f0000000140), 0x2, 0x0)
r2 = fcntl$dupfd(r0, 0x0, r1)
r3 = seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0x0, &(0x7f0000000000)={0x1, &(0x7f0000000100)=[{0x6, 0x0, 0xff, 0x7fff0000}]})
r4 = syz_init_net_socket$bt_l2cap(0x1f, 0x1, 0x3)
bind$bt_l2cap(r4, &(0x7f0000000280)={0x1f, 0x0, @none, 0x0, 0x2}, 0xe)
listen(r4, 0x1)
close_range(r3, 0xffffffffffffffff, 0x0)
r5 = syz_kvm_add_vcpu$x86(0x0, &(0x7f0000000700)={0x0, &(0x7f00000002c0)=[@set_irq_handler={0xc8, 0x20, {0x8a, 0x1}}, @uexit={0x0, 0x18, 0x3}, @nested_amd_inject_event={0x180, 0x38, {0x2, 0xc0, 0x2, 0x31ec194800000000, 0x3}}, @enable_nested={0x12c, 0x18}, @set_irq_handler={0xc8, 0x20, {0xb2, 0x1}}, @nested_amd_invlpga={0x17d, 0x20, {0x25001, 0xa8e8}}, @nested_amd_set_intercept={0x181, 0x30, {0x3, 0x800, 0x8, 0x1}}, @wrmsr={0x65, 0x20, {0x2af, 0x2}}, @nested_amd_stgi={0x17e, 0x10}, @code={0xa, 0x88, {"66f3470f09470f4c44810036f3f366470f86074100006467366667653e660f3880336464f661a8c7442400c6000000c7442402ea840000ff2c240f21f4b90a030000b821000000ba000000000f3048b800980000000000000f23c00f21f83501000e000f23f8b9820b0000b8a149ad8fbad55194300f30"}}, @wrmsr={0x65, 0x20, {0x236, 0x8000000000}}, @wrmsr={0x65, 0x20, {0xa61, 0x9}}, @nested_vmresume={0x130, 0x18, 0x2}, @nested_amd_inject_event={0x180, 0x38, {0x3, 0x86, 0x2, 0x4, 0x1}}, @cpuid={0x64, 0x18, {0x6}}, @nested_intel_vmwrite_mask={0x154, 0x38, {0x3, @ro32=0x440e, 0x4, 0x8fc, 0x3ff}}, @code={0xa, 0x57, {"2e0f38026e07b9bf0a00000f326543d877c1640f070f350f01df66b8fa008ed848b864930000000000000f23c80f21f8350c0020000f23f80f009f0b000000b96d0a00000f32"}}, @nested_amd_stgi={0x17e, 0x10}, @enable_nested={0x12c, 0x18}, @nested_load_syzos={0x136, 0x70, {0x0, 0x91b2, [@set_irq_handler={0xc8, 0x20, {0xe6, 0x2}}, @nested_amd_set_intercept={0x181, 0x30, {0x3, 0x8000000000000001, 0x4, 0x1}}]}}, @nested_amd_set_intercept={0x181, 0x30, {0x3, 0xffffffffffffffff, 0xb13b, 0x1}}, @rdmsr={0x66, 0x18, {0x9a4}}, @nested_amd_set_intercept={0x181, 0x30, {0x3, 0x8, 0xe3, 0x1}}, @nested_intel_vmwrite_mask={0x154, 0x38, {0x1, @control16=0x4, 0x9, 0x5, 0x6}}], 0x42f})
ioctl$KVM_GET_XSAVE2(r5, 0x9000aecf, &(0x7f0000ffd000/0x2000)=nil)
epoll_ctl$EPOLL_CTL_DEL(r2, 0x2, r0)
prctl$PR_SET_VMA(0x53564d41, 0x0, &(0x7f0000f19000/0x1000)=nil, 0x1000, &(0x7f0000000000)='/{!+]\x00')
ioctl$AUTOFS_DEV_IOCTL_FAIL(0xffffffffffffffff, 0xc0189377, &(0x7f0000000080)={{0x1, 0x1, 0x18, <r6=>r1, {0x1d, 0x296f5e09}}, './file0\x00'})
ioctl$UFFDIO_REGISTER(r6, 0xc020aa00, &(0x7f00000000c0)={{&(0x7f0000f19000/0x1000)=nil, 0x1000}, 0x2})
ioctl$SNDRV_TIMER_IOCTL_START(r6, 0x54a0)
executing program 2:
symlinkat(&(0x7f0000000080)='.\x00', 0xffffffffffffff9c, &(0x7f0000000200)='./file0\x00')
bpf$PROG_LOAD(0x5, &(0x7f0000000180)={0x10, 0x4, &(0x7f0000000000)=@framed={{}, [@call={0x179, 0x11, 0x100000}]}, &(0x7f00000000c0)='GPL\x00', 0x4, 0x1000, &(0x7f0000000200)=""/4096, 0x0, 0x0, '\x00', 0x0, @sk_msg}, 0x70)
mkdirat(0xffffffffffffff9c, &(0x7f0000000040)='./file1\x00', 0x1)
lremovexattr(&(0x7f0000001200)='./file7\x00', &(0x7f0000001240)=@random={'security.', '\x00'})
mkdirat(0xffffffffffffff9c, &(0x7f00000000c0)='./bus\x00', 0x0)
mount$overlay(0x0, &(0x7f00000000c0)='./bus\x00', &(0x7f0000000080), 0xa14000, &(0x7f0000000140)={[{@upperdir={'upperdir', 0x3d, './file1'}}, {@lowerdir={'lowerdir', 0x3d, './file0'}}, {@workdir={'workdir', 0x3d, './bus'}}]})
chdir(&(0x7f00000003c0)='./bus\x00')
mkdirat(0xffffffffffffff9c, &(0x7f0000000540)='./file7\x00', 0x1c0)
renameat2(0xffffffffffffff9c, &(0x7f0000000780)='./file0\x00', 0xffffffffffffff9c, &(0x7f0000000000)='./file7/file0\x00', 0x0)
r0 = openat(0xffffffffffffff9c, 0x0, 0x0, 0x2)
mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./file0\x00', 0x0)
r1 = socket$can_j1939(0x1d, 0x2, 0x7)
mprotect(&(0x7f0000000000/0x3000)=nil, 0x3000, 0x1)
setsockopt$sock_int(r1, 0x1, 0x6, &(0x7f0000000040)=0x1, 0x4)
r2 = socket$packet(0x11, 0x3, 0x300)
setsockopt$packet_fanout(r2, 0x107, 0x12, &(0x7f0000000000)={0x4, 0x3}, 0x4)
r3 = socket$packet(0x11, 0x3, 0x300)
setsockopt$packet_fanout(r3, 0x107, 0x12, &(0x7f0000000000)={0x4, 0x3}, 0x4)
r4 = bpf$PROG_LOAD_XDP(0x5, &(0x7f0000000480)={0x6, 0x3, &(0x7f0000000680)=ANY=[@ANYBLOB="1800000002000000000000000000000095"], &(0x7f00000002c0)='syzkaller\x00'}, 0x94)
setsockopt$inet_sctp_SCTP_ADD_STREAMS(r0, 0x84, 0x79, &(0x7f0000000100)={0x0, 0xa, 0x3}, 0x8)
bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f0000000600)={r4, 0x5, 0xb68, 0x560b0000, &(0x7f0000000000)="259a53f271a76d2673004c6588a8", 0x0, 0xd01, 0x2a0, 0x0, 0x0, 0x0, 0x0, 0x2}, 0x48)
executing program 2:
socket$nl_generic(0x10, 0x3, 0x10)
r0 = socket$nl_netfilter(0x10, 0x3, 0xc)
sendmsg$netlink(r0, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000100)=[{&(0x7f0000000140)={0x78, 0x16, 0xf15, 0x0, 0x0, "", [@typed={0x65, 0x84, 0x0, 0x0, @binary="b07d534ae6d132c423a882e82785dceed26c7ab8259ea2ef5331ef77a570bf70451f7ecec9bbf1fc5ddfce1b78d95cb5f4cccd4d58c54c1ebf827e129b5f38eb17a81598d3908443d96c8165a324d084f95989b07c6abfe979bfcc096db965e07d"}]}, 0x78}], 0x1}, 0x0)
executing program 2:
r0 = openat$dsp(0xffffffffffffff9c, &(0x7f0000000000), 0x8041, 0x0) (async, rerun: 32)
modify_ldt$read_default(0x2, 0xffffffffffffffff, 0x0) (async, rerun: 32)
r1 = add_key$user(&(0x7f0000000180), &(0x7f00000001c0)={'syz', 0x2}, &(0x7f0000000200)='*', 0x1, 0xfffffffffffffffb) (async)
r2 = add_key$keyring(&(0x7f0000000000), &(0x7f0000000040)={'syz', 0x0}, 0x0, 0x0, 0xffffffffffffffff)
add_key$user(&(0x7f0000000000), &(0x7f0000000080)={'syz', 0x2}, &(0x7f00000000c0)='c', 0x1, r2) (async)
syz_open_dev$sndctrl(&(0x7f0000000240), 0x3, 0x80042)
r3 = add_key$keyring(&(0x7f0000000200), &(0x7f0000000140)={'syz', 0x1}, 0x0, 0x0, 0xffffffffffffffff)
keyctl$KEYCTL_MOVE(0x1e, r1, r2, r3, 0x1) (async, rerun: 32)
write$dsp(r0, &(0x7f00000001c0)="5cba91a4", 0xffffffd9) (rerun: 32)
ioctl$SNDCTL_DSP_SYNC(r0, 0x5001, 0x0) (async, rerun: 64)
syz_clone(0x11, 0x0, 0x0, 0x0, 0x0, 0x0) (async, rerun: 64)
ioctl$SNDCTL_DSP_SPEED(r0, 0xc0045002, &(0x7f0000000100)=0x7)
executing program 2:
r0 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./proc/net/rpc/auth.unix.ip/channel\x00', 0x2, 0x0)
write(r0, &(0x7f0000000000)='nfsd 127.0.0.1 999999999\n', 0x19)
read(r0, &(0x7f0000000100), 0x100)
io_uring_enter(r0, 0x5df5, 0x3deb, 0xc1, &(0x7f0000000040)={[0x6]}, 0x8) (async)
r1 = socket$nl_netfilter(0x10, 0x3, 0xc)
sendmsg$NFT_BATCH(r1, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000600)={{0x14}, [@NFT_MSG_NEWTABLE={0x20, 0x0, 0xa, 0x201, 0x0, 0x0, {0x7}, [@NFTA_TABLE_NAME={0x9, 0x1, 'syz0\x00'}]}, @NFT_MSG_NEWSET={0x54, 0x9, 0xa, 0x401, 0x0, 0x0, {0x7}, [@NFTA_SET_ID={0x8}, @NFTA_SET_NAME={0x9, 0x2, 'syz1\x00'}, @NFTA_SET_TABLE={0x9, 0x1, 'syz0\x00'}, @NFTA_SET_KEY_LEN={0x8, 0x5, 0x1, 0x0, 0x17}, @NFTA_SET_DATA_TYPE={0x8, 0x6, 0x1, 0x0, 0xffffff00}, @NFTA_SET_FLAGS={0x8, 0x3, 0x1, 0x0, 0x38}, @NFTA_SET_GC_INTERVAL={0x8, 0xc, 0x1, 0x0, 0x2}]}], {0x14, 0x10, 0x1, 0x0, 0x0, {0x0, 0x84}}}, 0x9c}}, 0x0) (async)
r2 = socket$nl_generic(0x10, 0x3, 0x10)
sendmsg$nl_generic(r2, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000180)={0x14, 0x3e, 0x301, 0x270bd24, 0x25dfdbfa, {0x1}}, 0x14}}, 0xc004)
executing program 4:
r0 = socket$inet6_icmp(0xa, 0x2, 0x3a)
mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./trace\x00', 0x1ff) (async)
getsockopt$inet6_int(r0, 0x29, 0xc9, &(0x7f0000000040), &(0x7f00000000c0)=0x4) (async)
r1 = syz_genetlink_get_family_id$nbd(&(0x7f0000000280), 0xffffffffffffffff)
r2 = signalfd(r0, &(0x7f00000002c0)={[0x1]}, 0x8) (async)
socketpair$nbd(0x1, 0x1, 0x0, &(0x7f0000000300)={<r3=>0xffffffffffffffff}) (async)
r4 = openat$ipvs(0xffffffffffffff9c, &(0x7f0000000380)='/proc/sys/net/ipv4/vs/amemthresh\x00', 0x2, 0x0)
socketpair$nbd(0x1, 0x1, 0x0, &(0x7f00000003c0)={<r5=>0xffffffffffffffff}) (async)
socketpair$nbd(0x1, 0x1, 0x0, &(0x7f0000000400)={<r6=>0xffffffffffffffff}) (async)
r7 = socket(0x2d, 0x2, 0x0)
connect$netlink(r7, &(0x7f0000000140)=@unspec={0x2d, 0x0, 0xa00}, 0xc) (async)
r8 = socket(0x12, 0x80002, 0x25)
setsockopt$MRT6_FLUSH(r8, 0x29, 0xd0, 0x0, 0x4)
socketpair(0x1, 0x20000000000001, 0x0, &(0x7f0000000100)={0xffffffffffffffff, <r9=>0xffffffffffffffff})
getsockname$packet(r9, &(0x7f0000000100)={0x11, 0x0, <r10=>0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000080)=0xa)
r11 = socket$nl_route(0x10, 0x3, 0x0)
sendmsg$nl_route_sched(r11, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000440)=@newtaction={0x88, 0x30, 0xffff, 0x0, 0x0, {0x0, 0x0, 0x1300}, [{0x74, 0x1, [@m_mirred={0x70, 0x1, 0x0, 0x0, {{0xb}, {0x44, 0x2, 0x0, 0x1, [@TCA_MIRRED_PARMS={0x20, 0x4, {{0xfffff7e8}}}, @TCA_MIRRED_PARMS={0x20, 0x2, {{0x1, 0x0, 0x1, 0x400, 0xfffffff7}, 0x2, r10}}]}, {0x4}, {0xc}, {0xc, 0x8, {0x0, 0x2}}}}]}]}, 0x88}}, 0x0) (async)
r12 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file0\x00', 0x20846, 0x2)
syz_kvm_setup_cpu$x86(r12, r12, &(0x7f0000fe7000/0x18000)=nil, &(0x7f0000000180)=[@text32={0x20, &(0x7f0000000240)="c4e1a9d83d00000000c4c1cf2a79fdb9a80a0000b807000000ba000000000f30c4e11d73d9069ae0235f8d6d000f20c035020000000f22c00f79199a77000000a9002e65f30fbd934230000066bad10466b8060066ef"}], 0x1, 0x60, 0x0, 0x40) (async)
write$P9_RLERRORu(r12, &(0x7f0000000240)=ANY=[], 0x10)
mmap(&(0x7f0000000000/0x400000)=nil, 0x400000, 0x1, 0x10012, r12, 0x0)
socketpair$nbd(0x1, 0x1, 0x0, &(0x7f0000000440)={<r13=>0xffffffffffffffff})
sendmsg$NBD_CMD_STATUS(0xffffffffffffffff, &(0x7f0000000640)={&(0x7f0000000240)={0x10, 0x0, 0x0, 0x80102000}, 0xc, &(0x7f0000000600)={&(0x7f0000000500)={0xfc, r1, 0x100, 0x70bd26, 0x25dfdbfe, {}, [@NBD_ATTR_SERVER_FLAGS={0xc, 0x5, 0x2}, @NBD_ATTR_SOCKETS={0x1c, 0x7, 0x0, 0x1, [{0xc, 0x1, 0x0, 0x1, {0x8, 0x1, r2}}, {0xc, 0x1, 0x0, 0x1, {0x8, 0x1, r3}}]}, @NBD_ATTR_SERVER_FLAGS={0xc, 0x5, 0x5}, @NBD_ATTR_BACKEND_IDENTIFIER={0x9, 0xa, 'befs\x00'}, @NBD_ATTR_SOCKETS={0x70, 0x7, 0x0, 0x1, [{0xc, 0x1, 0x0, 0x1, {0x8}}, {0xc, 0x1, 0x0, 0x1, {0x8, 0x1, r4}}, {0xc, 0x1, 0x0, 0x1, {0x8, 0x1, r5}}, {0xc, 0x1, 0x0, 0x1, {0x8}}, {0xc, 0x1, 0x0, 0x1, {0x8, 0x1, r6}}, {0xc, 0x1, 0x0, 0x1, {0x8, 0x1, r7}}, {0xc, 0x1, 0x0, 0x1, {0x8, 0x1, r8}}, {0xc, 0x1, 0x0, 0x1, {0x8, 0x1, r12}}, {0xc, 0x1, 0x0, 0x1, {0x8, 0x1, r13}}]}, @NBD_ATTR_BACKEND_IDENTIFIER={0x7, 0xa, ',-]'}, @NBD_ATTR_DEAD_CONN_TIMEOUT={0xc, 0x8, 0x78e7}, @NBD_ATTR_BLOCK_SIZE_BYTES={0xc, 0x3, 0x5}, @NBD_ATTR_TIMEOUT={0xc, 0x4, 0x227}, @NBD_ATTR_BLOCK_SIZE_BYTES={0xc, 0x3, 0x400}]}, 0xfc}, 0x1, 0x0, 0x0, 0x8000}, 0x4000151) (async)
mount(0x0, &(0x7f0000000000)='./trace\x00', &(0x7f0000000100)='befs\x00', 0x0, 0x0)
r14 = open$dir(&(0x7f0000000200)='./trace\x00', 0x20000, 0x4c)
r15 = openat(r14, &(0x7f0000000140)='./trace/set_event\x00', 0x2, 0x40) (async)
r16 = syz_open_dev$sg(&(0x7f00000000c0), 0x0, 0x2400)
ioctl$SG_IO(r16, 0x2285, &(0x7f0000000180)={0x53, 0xfffffffffffffffd, 0x6, 0x81, @scatter={0x0, 0x0, 0x0}, &(0x7f0000000700)="1265b914f46e", 0x0, 0x2000000, 0x10022, 0x3, 0x0}) (async)
writev(r15, &(0x7f0000000340)=[{&(0x7f00000004c0)="2019", 0x2}], 0x1) (async)
getsockopt$inet6_int(r0, 0x29, 0x31, 0x0, &(0x7f0000000080))
executing program 2:
mkdirat(0xffffffffffffff9c, &(0x7f0000000100)='./file0\x00', 0x0) (async, rerun: 64)
mount(0x0, &(0x7f00000001c0)='./file0\x00', &(0x7f0000000300)='cgroup2\x00', 0x0, 0x0) (async, rerun: 64)
r0 = openat$tun(0xffffffffffffff9c, &(0x7f00000001c0), 0xa2f01, 0x0)
ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f00000000c0)={'syzkaller1\x00', 0x6bf1c2d5adba8c32})
r1 = socket$inet6(0xa, 0x2, 0x0)
bind$inet6(r1, &(0x7f0000000100)={0xa, 0x4e20, 0x0, @empty}, 0x1c)
setsockopt$inet6_udp_int(r1, 0x11, 0x68, &(0x7f0000000080)=0xa40, 0x4)
r2 = socket$kcm(0x2, 0xa, 0x2)
ioctl$SIOCSIFHWADDR(r2, 0x8914, &(0x7f0000000180)={'syzkaller1\x00', @link_local})
write$tun(r0, &(0x7f0000000300)=ANY=[@ANYBLOB="0a000806000000000400aaaaaaaaaa2986dd6de7136600e91101addb0000000000000000000000000000ff0200000000000000000000000000014f194e20002b90"], 0x65) (async)
mount$overlay(0x0, &(0x7f0000000140)='./file0\x00', &(0x7f0000000180), 0x0, &(0x7f00000000c0)={[{@lowerdir={'lowerdir', 0x3d, './file0'}, 0x3a}], [], 0x2f}) (async)
mount$overlay(0x0, &(0x7f0000000140)='./file0\x00', &(0x7f0000000380), 0x0, &(0x7f00000003c0)={[{@lowerdir={'lowerdir', 0x3d, './file0'}, 0x3a}], [], 0x2f}) (async)
r3 = openat(0xffffffffffffff9c, &(0x7f0000000080)='./file0\x00', 0x0, 0xd5)
write$tcp_mem(r3, &(0x7f0000000200)={0x4, 0x20, 0x1, 0x20, 0x7}, 0x48)
r4 = syz_open_dev$dvb_frontend(&(0x7f0000000080), 0x0, 0x2)
ioctl$FE_GET_PROPERTY(r4, 0x80106f53, &(0x7f0000000040)={0x20, &(0x7f0000001240)=[{0x1f, '\x00', @data=0xc, 0x7}, {0x6, '\x00', @buffer={"f8c042d7a8781c094069bb0ebdee0ef4186c06dcf1c52699f69880b0d7000004", 0x20}, 0x6}]}) (async)
openat$cgroup_ro(r3, &(0x7f0000000040)='cpu.stat\x00', 0x0, 0x0)
executing program 4:
r0 = syz_open_dev$dvb_frontend(&(0x7f0000000080), 0x0, 0x402)
r1 = socket$inet_mptcp(0x2, 0x1, 0x106)
r2 = socket(0x10, 0x803, 0x0)
syz_genetlink_get_family_id$tipc(&(0x7f0000000000), r2)
getsockname$packet(r2, &(0x7f0000000280)={0x11, 0x0, <r3=>0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14)
sendmsg$nl_route(r2, &(0x7f0000000180)={&(0x7f0000000040)={0x10, 0x0, 0x0, 0x400000}, 0xc, &(0x7f0000000140)={&(0x7f0000000100)=@RTM_GETMDB={0x18, 0x56, 0x2, 0x70bd25, 0x25dfdbfe, {0x7, r3}, [""]}, 0x18}}, 0x20000000)
sendmsg$nl_route(r2, &(0x7f0000000240)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000580)=ANY=[@ANYBLOB="4800000010000305ff810000fddbdf2500000000", @ANYRES32=r3, @ANYBLOB="1748000040000200280012800a000100767863616e0000001800028014000100000000", @ANYRES32=r3], 0x48}, 0x1, 0x0, 0x0, 0x40}, 0x0)
connect$inet(r1, &(0x7f0000000000)={0x2, 0x4e22, @empty}, 0x10)
setsockopt$sock_int(r1, 0x1, 0x9, &(0x7f00000003c0)=0x246, 0x4)
ioctl$FE_SET_PROPERTY(r0, 0x40106f52, &(0x7f00000000c0)={0x29, &(0x7f0000000200)=[{0x34, '\x00', @data=0x4}]})
syz_open_dev$dvb_frontend(&(0x7f0000000080), 0x0, 0x402) (async)
socket$inet_mptcp(0x2, 0x1, 0x106) (async)
socket(0x10, 0x803, 0x0) (async)
syz_genetlink_get_family_id$tipc(&(0x7f0000000000), r2) (async)
getsockname$packet(r2, &(0x7f0000000280)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) (async)
sendmsg$nl_route(r2, &(0x7f0000000180)={&(0x7f0000000040)={0x10, 0x0, 0x0, 0x400000}, 0xc, &(0x7f0000000140)={&(0x7f0000000100)=@RTM_GETMDB={0x18, 0x56, 0x2, 0x70bd25, 0x25dfdbfe, {0x7, r3}, [""]}, 0x18}}, 0x20000000) (async)
sendmsg$nl_route(r2, &(0x7f0000000240)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000580)=ANY=[@ANYBLOB="4800000010000305ff810000fddbdf2500000000", @ANYRES32=r3, @ANYBLOB="1748000040000200280012800a000100767863616e0000001800028014000100000000", @ANYRES32=r3], 0x48}, 0x1, 0x0, 0x0, 0x40}, 0x0) (async)
connect$inet(r1, &(0x7f0000000000)={0x2, 0x4e22, @empty}, 0x10) (async)
setsockopt$sock_int(r1, 0x1, 0x9, &(0x7f00000003c0)=0x246, 0x4) (async)
ioctl$FE_SET_PROPERTY(r0, 0x40106f52, &(0x7f00000000c0)={0x29, &(0x7f0000000200)=[{0x34, '\x00', @data=0x4}]}) (async)

program crashed: KASAN: slab-use-after-free Read in dvb_device_open
bisect: the chunk can be dropped
bisect: split chunks (needed=true): <10>
bisect: split chunk #0 of len 10 into 2 parts
bisect: testing without sub-chunk 1/2
testing program (duration=31s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): [3, 12, 8, 30, 17, 20]
detailed listing:
executing program 2:
socket$nl_generic(0x10, 0x3, 0x10)
r0 = socket$nl_netfilter(0x10, 0x3, 0xc)
sendmsg$netlink(r0, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000100)=[{&(0x7f0000000140)={0x78, 0x16, 0xf15, 0x0, 0x0, "", [@typed={0x65, 0x84, 0x0, 0x0, @binary="b07d534ae6d132c423a882e82785dceed26c7ab8259ea2ef5331ef77a570bf70451f7ecec9bbf1fc5ddfce1b78d95cb5f4cccd4d58c54c1ebf827e129b5f38eb17a81598d3908443d96c8165a324d084f95989b07c6abfe979bfcc096db965e07d"}]}, 0x78}], 0x1}, 0x0)
executing program 2:
r0 = openat$dsp(0xffffffffffffff9c, &(0x7f0000000000), 0x8041, 0x0) (async, rerun: 32)
modify_ldt$read_default(0x2, 0xffffffffffffffff, 0x0) (async, rerun: 32)
r1 = add_key$user(&(0x7f0000000180), &(0x7f00000001c0)={'syz', 0x2}, &(0x7f0000000200)='*', 0x1, 0xfffffffffffffffb) (async)
r2 = add_key$keyring(&(0x7f0000000000), &(0x7f0000000040)={'syz', 0x0}, 0x0, 0x0, 0xffffffffffffffff)
add_key$user(&(0x7f0000000000), &(0x7f0000000080)={'syz', 0x2}, &(0x7f00000000c0)='c', 0x1, r2) (async)
syz_open_dev$sndctrl(&(0x7f0000000240), 0x3, 0x80042)
r3 = add_key$keyring(&(0x7f0000000200), &(0x7f0000000140)={'syz', 0x1}, 0x0, 0x0, 0xffffffffffffffff)
keyctl$KEYCTL_MOVE(0x1e, r1, r2, r3, 0x1) (async, rerun: 32)
write$dsp(r0, &(0x7f00000001c0)="5cba91a4", 0xffffffd9) (rerun: 32)
ioctl$SNDCTL_DSP_SYNC(r0, 0x5001, 0x0) (async, rerun: 64)
syz_clone(0x11, 0x0, 0x0, 0x0, 0x0, 0x0) (async, rerun: 64)
ioctl$SNDCTL_DSP_SPEED(r0, 0xc0045002, &(0x7f0000000100)=0x7)
executing program 2:
r0 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./proc/net/rpc/auth.unix.ip/channel\x00', 0x2, 0x0)
write(r0, &(0x7f0000000000)='nfsd 127.0.0.1 999999999\n', 0x19)
read(r0, &(0x7f0000000100), 0x100)
io_uring_enter(r0, 0x5df5, 0x3deb, 0xc1, &(0x7f0000000040)={[0x6]}, 0x8) (async)
r1 = socket$nl_netfilter(0x10, 0x3, 0xc)
sendmsg$NFT_BATCH(r1, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000600)={{0x14}, [@NFT_MSG_NEWTABLE={0x20, 0x0, 0xa, 0x201, 0x0, 0x0, {0x7}, [@NFTA_TABLE_NAME={0x9, 0x1, 'syz0\x00'}]}, @NFT_MSG_NEWSET={0x54, 0x9, 0xa, 0x401, 0x0, 0x0, {0x7}, [@NFTA_SET_ID={0x8}, @NFTA_SET_NAME={0x9, 0x2, 'syz1\x00'}, @NFTA_SET_TABLE={0x9, 0x1, 'syz0\x00'}, @NFTA_SET_KEY_LEN={0x8, 0x5, 0x1, 0x0, 0x17}, @NFTA_SET_DATA_TYPE={0x8, 0x6, 0x1, 0x0, 0xffffff00}, @NFTA_SET_FLAGS={0x8, 0x3, 0x1, 0x0, 0x38}, @NFTA_SET_GC_INTERVAL={0x8, 0xc, 0x1, 0x0, 0x2}]}], {0x14, 0x10, 0x1, 0x0, 0x0, {0x0, 0x84}}}, 0x9c}}, 0x0) (async)
r2 = socket$nl_generic(0x10, 0x3, 0x10)
sendmsg$nl_generic(r2, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000180)={0x14, 0x3e, 0x301, 0x270bd24, 0x25dfdbfa, {0x1}}, 0x14}}, 0xc004)
executing program 4:
r0 = socket$inet6_icmp(0xa, 0x2, 0x3a)
mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./trace\x00', 0x1ff) (async)
getsockopt$inet6_int(r0, 0x29, 0xc9, &(0x7f0000000040), &(0x7f00000000c0)=0x4) (async)
r1 = syz_genetlink_get_family_id$nbd(&(0x7f0000000280), 0xffffffffffffffff)
r2 = signalfd(r0, &(0x7f00000002c0)={[0x1]}, 0x8) (async)
socketpair$nbd(0x1, 0x1, 0x0, &(0x7f0000000300)={<r3=>0xffffffffffffffff}) (async)
r4 = openat$ipvs(0xffffffffffffff9c, &(0x7f0000000380)='/proc/sys/net/ipv4/vs/amemthresh\x00', 0x2, 0x0)
socketpair$nbd(0x1, 0x1, 0x0, &(0x7f00000003c0)={<r5=>0xffffffffffffffff}) (async)
socketpair$nbd(0x1, 0x1, 0x0, &(0x7f0000000400)={<r6=>0xffffffffffffffff}) (async)
r7 = socket(0x2d, 0x2, 0x0)
connect$netlink(r7, &(0x7f0000000140)=@unspec={0x2d, 0x0, 0xa00}, 0xc) (async)
r8 = socket(0x12, 0x80002, 0x25)
setsockopt$MRT6_FLUSH(r8, 0x29, 0xd0, 0x0, 0x4)
socketpair(0x1, 0x20000000000001, 0x0, &(0x7f0000000100)={0xffffffffffffffff, <r9=>0xffffffffffffffff})
getsockname$packet(r9, &(0x7f0000000100)={0x11, 0x0, <r10=>0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000080)=0xa)
r11 = socket$nl_route(0x10, 0x3, 0x0)
sendmsg$nl_route_sched(r11, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000440)=@newtaction={0x88, 0x30, 0xffff, 0x0, 0x0, {0x0, 0x0, 0x1300}, [{0x74, 0x1, [@m_mirred={0x70, 0x1, 0x0, 0x0, {{0xb}, {0x44, 0x2, 0x0, 0x1, [@TCA_MIRRED_PARMS={0x20, 0x4, {{0xfffff7e8}}}, @TCA_MIRRED_PARMS={0x20, 0x2, {{0x1, 0x0, 0x1, 0x400, 0xfffffff7}, 0x2, r10}}]}, {0x4}, {0xc}, {0xc, 0x8, {0x0, 0x2}}}}]}]}, 0x88}}, 0x0) (async)
r12 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file0\x00', 0x20846, 0x2)
syz_kvm_setup_cpu$x86(r12, r12, &(0x7f0000fe7000/0x18000)=nil, &(0x7f0000000180)=[@text32={0x20, &(0x7f0000000240)="c4e1a9d83d00000000c4c1cf2a79fdb9a80a0000b807000000ba000000000f30c4e11d73d9069ae0235f8d6d000f20c035020000000f22c00f79199a77000000a9002e65f30fbd934230000066bad10466b8060066ef"}], 0x1, 0x60, 0x0, 0x40) (async)
write$P9_RLERRORu(r12, &(0x7f0000000240)=ANY=[], 0x10)
mmap(&(0x7f0000000000/0x400000)=nil, 0x400000, 0x1, 0x10012, r12, 0x0)
socketpair$nbd(0x1, 0x1, 0x0, &(0x7f0000000440)={<r13=>0xffffffffffffffff})
sendmsg$NBD_CMD_STATUS(0xffffffffffffffff, &(0x7f0000000640)={&(0x7f0000000240)={0x10, 0x0, 0x0, 0x80102000}, 0xc, &(0x7f0000000600)={&(0x7f0000000500)={0xfc, r1, 0x100, 0x70bd26, 0x25dfdbfe, {}, [@NBD_ATTR_SERVER_FLAGS={0xc, 0x5, 0x2}, @NBD_ATTR_SOCKETS={0x1c, 0x7, 0x0, 0x1, [{0xc, 0x1, 0x0, 0x1, {0x8, 0x1, r2}}, {0xc, 0x1, 0x0, 0x1, {0x8, 0x1, r3}}]}, @NBD_ATTR_SERVER_FLAGS={0xc, 0x5, 0x5}, @NBD_ATTR_BACKEND_IDENTIFIER={0x9, 0xa, 'befs\x00'}, @NBD_ATTR_SOCKETS={0x70, 0x7, 0x0, 0x1, [{0xc, 0x1, 0x0, 0x1, {0x8}}, {0xc, 0x1, 0x0, 0x1, {0x8, 0x1, r4}}, {0xc, 0x1, 0x0, 0x1, {0x8, 0x1, r5}}, {0xc, 0x1, 0x0, 0x1, {0x8}}, {0xc, 0x1, 0x0, 0x1, {0x8, 0x1, r6}}, {0xc, 0x1, 0x0, 0x1, {0x8, 0x1, r7}}, {0xc, 0x1, 0x0, 0x1, {0x8, 0x1, r8}}, {0xc, 0x1, 0x0, 0x1, {0x8, 0x1, r12}}, {0xc, 0x1, 0x0, 0x1, {0x8, 0x1, r13}}]}, @NBD_ATTR_BACKEND_IDENTIFIER={0x7, 0xa, ',-]'}, @NBD_ATTR_DEAD_CONN_TIMEOUT={0xc, 0x8, 0x78e7}, @NBD_ATTR_BLOCK_SIZE_BYTES={0xc, 0x3, 0x5}, @NBD_ATTR_TIMEOUT={0xc, 0x4, 0x227}, @NBD_ATTR_BLOCK_SIZE_BYTES={0xc, 0x3, 0x400}]}, 0xfc}, 0x1, 0x0, 0x0, 0x8000}, 0x4000151) (async)
mount(0x0, &(0x7f0000000000)='./trace\x00', &(0x7f0000000100)='befs\x00', 0x0, 0x0)
r14 = open$dir(&(0x7f0000000200)='./trace\x00', 0x20000, 0x4c)
r15 = openat(r14, &(0x7f0000000140)='./trace/set_event\x00', 0x2, 0x40) (async)
r16 = syz_open_dev$sg(&(0x7f00000000c0), 0x0, 0x2400)
ioctl$SG_IO(r16, 0x2285, &(0x7f0000000180)={0x53, 0xfffffffffffffffd, 0x6, 0x81, @scatter={0x0, 0x0, 0x0}, &(0x7f0000000700)="1265b914f46e", 0x0, 0x2000000, 0x10022, 0x3, 0x0}) (async)
writev(r15, &(0x7f0000000340)=[{&(0x7f00000004c0)="2019", 0x2}], 0x1) (async)
getsockopt$inet6_int(r0, 0x29, 0x31, 0x0, &(0x7f0000000080))
executing program 2:
mkdirat(0xffffffffffffff9c, &(0x7f0000000100)='./file0\x00', 0x0) (async, rerun: 64)
mount(0x0, &(0x7f00000001c0)='./file0\x00', &(0x7f0000000300)='cgroup2\x00', 0x0, 0x0) (async, rerun: 64)
r0 = openat$tun(0xffffffffffffff9c, &(0x7f00000001c0), 0xa2f01, 0x0)
ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f00000000c0)={'syzkaller1\x00', 0x6bf1c2d5adba8c32})
r1 = socket$inet6(0xa, 0x2, 0x0)
bind$inet6(r1, &(0x7f0000000100)={0xa, 0x4e20, 0x0, @empty}, 0x1c)
setsockopt$inet6_udp_int(r1, 0x11, 0x68, &(0x7f0000000080)=0xa40, 0x4)
r2 = socket$kcm(0x2, 0xa, 0x2)
ioctl$SIOCSIFHWADDR(r2, 0x8914, &(0x7f0000000180)={'syzkaller1\x00', @link_local})
write$tun(r0, &(0x7f0000000300)=ANY=[@ANYBLOB="0a000806000000000400aaaaaaaaaa2986dd6de7136600e91101addb0000000000000000000000000000ff0200000000000000000000000000014f194e20002b90"], 0x65) (async)
mount$overlay(0x0, &(0x7f0000000140)='./file0\x00', &(0x7f0000000180), 0x0, &(0x7f00000000c0)={[{@lowerdir={'lowerdir', 0x3d, './file0'}, 0x3a}], [], 0x2f}) (async)
mount$overlay(0x0, &(0x7f0000000140)='./file0\x00', &(0x7f0000000380), 0x0, &(0x7f00000003c0)={[{@lowerdir={'lowerdir', 0x3d, './file0'}, 0x3a}], [], 0x2f}) (async)
r3 = openat(0xffffffffffffff9c, &(0x7f0000000080)='./file0\x00', 0x0, 0xd5)
write$tcp_mem(r3, &(0x7f0000000200)={0x4, 0x20, 0x1, 0x20, 0x7}, 0x48)
r4 = syz_open_dev$dvb_frontend(&(0x7f0000000080), 0x0, 0x2)
ioctl$FE_GET_PROPERTY(r4, 0x80106f53, &(0x7f0000000040)={0x20, &(0x7f0000001240)=[{0x1f, '\x00', @data=0xc, 0x7}, {0x6, '\x00', @buffer={"f8c042d7a8781c094069bb0ebdee0ef4186c06dcf1c52699f69880b0d7000004", 0x20}, 0x6}]}) (async)
openat$cgroup_ro(r3, &(0x7f0000000040)='cpu.stat\x00', 0x0, 0x0)
executing program 4:
r0 = syz_open_dev$dvb_frontend(&(0x7f0000000080), 0x0, 0x402)
r1 = socket$inet_mptcp(0x2, 0x1, 0x106)
r2 = socket(0x10, 0x803, 0x0)
syz_genetlink_get_family_id$tipc(&(0x7f0000000000), r2)
getsockname$packet(r2, &(0x7f0000000280)={0x11, 0x0, <r3=>0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14)
sendmsg$nl_route(r2, &(0x7f0000000180)={&(0x7f0000000040)={0x10, 0x0, 0x0, 0x400000}, 0xc, &(0x7f0000000140)={&(0x7f0000000100)=@RTM_GETMDB={0x18, 0x56, 0x2, 0x70bd25, 0x25dfdbfe, {0x7, r3}, [""]}, 0x18}}, 0x20000000)
sendmsg$nl_route(r2, &(0x7f0000000240)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000580)=ANY=[@ANYBLOB="4800000010000305ff810000fddbdf2500000000", @ANYRES32=r3, @ANYBLOB="1748000040000200280012800a000100767863616e0000001800028014000100000000", @ANYRES32=r3], 0x48}, 0x1, 0x0, 0x0, 0x40}, 0x0)
connect$inet(r1, &(0x7f0000000000)={0x2, 0x4e22, @empty}, 0x10)
setsockopt$sock_int(r1, 0x1, 0x9, &(0x7f00000003c0)=0x246, 0x4)
ioctl$FE_SET_PROPERTY(r0, 0x40106f52, &(0x7f00000000c0)={0x29, &(0x7f0000000200)=[{0x34, '\x00', @data=0x4}]})
syz_open_dev$dvb_frontend(&(0x7f0000000080), 0x0, 0x402) (async)
socket$inet_mptcp(0x2, 0x1, 0x106) (async)
socket(0x10, 0x803, 0x0) (async)
syz_genetlink_get_family_id$tipc(&(0x7f0000000000), r2) (async)
getsockname$packet(r2, &(0x7f0000000280)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) (async)
sendmsg$nl_route(r2, &(0x7f0000000180)={&(0x7f0000000040)={0x10, 0x0, 0x0, 0x400000}, 0xc, &(0x7f0000000140)={&(0x7f0000000100)=@RTM_GETMDB={0x18, 0x56, 0x2, 0x70bd25, 0x25dfdbfe, {0x7, r3}, [""]}, 0x18}}, 0x20000000) (async)
sendmsg$nl_route(r2, &(0x7f0000000240)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000580)=ANY=[@ANYBLOB="4800000010000305ff810000fddbdf2500000000", @ANYRES32=r3, @ANYBLOB="1748000040000200280012800a000100767863616e0000001800028014000100000000", @ANYRES32=r3], 0x48}, 0x1, 0x0, 0x0, 0x40}, 0x0) (async)
connect$inet(r1, &(0x7f0000000000)={0x2, 0x4e22, @empty}, 0x10) (async)
setsockopt$sock_int(r1, 0x1, 0x9, &(0x7f00000003c0)=0x246, 0x4) (async)
ioctl$FE_SET_PROPERTY(r0, 0x40106f52, &(0x7f00000000c0)={0x29, &(0x7f0000000200)=[{0x34, '\x00', @data=0x4}]}) (async)

program did not crash
bisect: testing without sub-chunk 2/2
testing program (duration=31s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): [40, 30, 36, 19, 21, 20]
detailed listing:
executing program 3:
seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0x0, &(0x7f00000000c0)={0x1, &(0x7f0000000040)=[{0x6, 0x0, 0x0, 0x7fffffff}]}) (async)
r0 = seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0x0, &(0x7f00000000c0)={0x1, &(0x7f0000000040)=[{0x6, 0x0, 0x0, 0x7fffffff}]})
r1 = socket$nl_route(0x10, 0x3, 0x0)
ioctl$sock_SIOCGIFINDEX(r1, 0x8933, &(0x7f0000000340)={'virt_wifi0\x00', <r2=>0x0})
sendmsg$nl_route_sched(r1, &(0x7f0000000b00)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000640)=@delqdisc={0x2dc, 0x26, 0x1, 0x70ad2b, 0x25dfdbfc, {0x0, 0x0, 0x0, r2, {}, {0xffff, 0xffff}, {0xf, 0x3}}, [@qdisc_kind_options=@q_taprio={{0xb}, {0x2c, 0x2, [@TCA_TAPRIO_ATTR_SCHED_CLOCKID={0x8, 0x5, 0x7f}, @TCA_TAPRIO_ATTR_SCHED_BASE_TIME={0xc, 0x3, 0xffff}, @TCA_TAPRIO_ATTR_SCHED_CLOCKID={0x8}, @TCA_TAPRIO_ATTR_SCHED_BASE_TIME={0xc, 0x3, 0x5}]}}, @TCA_STAB={0xa0, 0x8, 0x0, 0x1, [{{0x1c, 0x1, {0x60, 0x7, 0x9, 0x0, 0x0, 0xd, 0xc2, 0x1}}, {0x6, 0x2, [0x3]}}, {{0x1c, 0x1, {0x9, 0x7, 0x1, 0x4, 0x0, 0x7, 0x2, 0x9}}, {0x16, 0x2, [0x0, 0x0, 0xffff, 0xbacf, 0xa, 0x6, 0x8, 0x3ff, 0x7]}}, {{0x1c, 0x1, {0x7f, 0x0, 0xd995, 0x3ff, 0x0, 0x3, 0x3, 0x1}}, {0x6, 0x2, [0x7f]}}, {{0x1c, 0x1, {0x1, 0x10, 0x1, 0x0, 0x0, 0x7}}, {0x4}}]}, @qdisc_kind_options=@q_cake={{0x9}, {0x2c, 0x2, [@TCA_CAKE_DIFFSERV_MODE={0x8}, @TCA_CAKE_RAW={0x8}, @TCA_CAKE_MPU={0x8, 0xe, 0xb9}, @TCA_CAKE_NAT={0x8}, @TCA_CAKE_MEMORY={0x8, 0xa, 0x80000001}]}}, @TCA_STAB={0xc4, 0x8, 0x0, 0x1, [{{0x1c, 0x1, {0x1, 0x0, 0x4, 0x8, 0x2, 0x962a, 0x1486, 0x3}}, {0xa, 0x2, [0x4, 0x9, 0x81]}}, {{0x1c, 0x1, {0x3, 0x6, 0x3, 0x1c00000, 0x0, 0x9ea1, 0x5, 0x1}}, {0x6, 0x2, [0x6]}}, {{0x1c, 0x1, {0x95, 0x1, 0x8, 0x200, 0x0, 0x3fe, 0x400, 0x2}}, {0x8, 0x2, [0x85, 0x4]}}, {{0x1c, 0x1, {0xa0, 0x1, 0x9, 0x5e, 0x1, 0x10001, 0x5, 0x5}}, {0xe, 0x2, [0x4, 0xfdf, 0x1154, 0x10ed, 0x9]}}, {{0x1c, 0x1, {0xc3, 0x5, 0x5, 0xb473, 0x2, 0xfffffff7, 0x1ff, 0x2}}, {0x8, 0x2, [0x81, 0x685c]}}]}, @TCA_RATE={0x6, 0x5, {0x7, 0x1}}, @TCA_STAB={0xd4, 0x8, 0x0, 0x1, [{{0x1c, 0x1, {0x5, 0x66, 0x1ff, 0x4b, 0x1, 0x870, 0xfffffffa, 0x1}}, {0x6, 0x2, [0x9]}}, {{0x1c, 0x1, {0x2, 0x4a, 0x6, 0x6, 0x1, 0xa, 0x4, 0x5}}, {0xe, 0x2, [0x101, 0x7f, 0xf457, 0x7, 0x7]}}, {{0x1c, 0x1, {0x3, 0x10, 0x9, 0x8001, 0x0, 0x6, 0xffff, 0xa}}, {0x18, 0x2, [0x3b4, 0x4, 0x78, 0x2000, 0x67, 0x1, 0x1, 0xc, 0xa, 0x8]}}, {{0x1c, 0x1, {0x1, 0x55, 0x3b0, 0xa, 0x2, 0x0, 0x0, 0x3}}, {0xa, 0x2, [0x0, 0x8, 0x0]}}, {{0x1c, 0x1, {0x0, 0x0, 0x6, 0x925, 0x0, 0x2, 0x3, 0x2}}, {0x8, 0x2, [0x1, 0x9]}}]}, @TCA_INGRESS_BLOCK={0x8, 0xd, 0x1}]}, 0x2dc}, 0x1, 0x0, 0x0, 0x4081}, 0x0) (async)
sendmsg$nl_route_sched(r1, &(0x7f0000000b00)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000640)=@delqdisc={0x2dc, 0x26, 0x1, 0x70ad2b, 0x25dfdbfc, {0x0, 0x0, 0x0, r2, {}, {0xffff, 0xffff}, {0xf, 0x3}}, [@qdisc_kind_options=@q_taprio={{0xb}, {0x2c, 0x2, [@TCA_TAPRIO_ATTR_SCHED_CLOCKID={0x8, 0x5, 0x7f}, @TCA_TAPRIO_ATTR_SCHED_BASE_TIME={0xc, 0x3, 0xffff}, @TCA_TAPRIO_ATTR_SCHED_CLOCKID={0x8}, @TCA_TAPRIO_ATTR_SCHED_BASE_TIME={0xc, 0x3, 0x5}]}}, @TCA_STAB={0xa0, 0x8, 0x0, 0x1, [{{0x1c, 0x1, {0x60, 0x7, 0x9, 0x0, 0x0, 0xd, 0xc2, 0x1}}, {0x6, 0x2, [0x3]}}, {{0x1c, 0x1, {0x9, 0x7, 0x1, 0x4, 0x0, 0x7, 0x2, 0x9}}, {0x16, 0x2, [0x0, 0x0, 0xffff, 0xbacf, 0xa, 0x6, 0x8, 0x3ff, 0x7]}}, {{0x1c, 0x1, {0x7f, 0x0, 0xd995, 0x3ff, 0x0, 0x3, 0x3, 0x1}}, {0x6, 0x2, [0x7f]}}, {{0x1c, 0x1, {0x1, 0x10, 0x1, 0x0, 0x0, 0x7}}, {0x4}}]}, @qdisc_kind_options=@q_cake={{0x9}, {0x2c, 0x2, [@TCA_CAKE_DIFFSERV_MODE={0x8}, @TCA_CAKE_RAW={0x8}, @TCA_CAKE_MPU={0x8, 0xe, 0xb9}, @TCA_CAKE_NAT={0x8}, @TCA_CAKE_MEMORY={0x8, 0xa, 0x80000001}]}}, @TCA_STAB={0xc4, 0x8, 0x0, 0x1, [{{0x1c, 0x1, {0x1, 0x0, 0x4, 0x8, 0x2, 0x962a, 0x1486, 0x3}}, {0xa, 0x2, [0x4, 0x9, 0x81]}}, {{0x1c, 0x1, {0x3, 0x6, 0x3, 0x1c00000, 0x0, 0x9ea1, 0x5, 0x1}}, {0x6, 0x2, [0x6]}}, {{0x1c, 0x1, {0x95, 0x1, 0x8, 0x200, 0x0, 0x3fe, 0x400, 0x2}}, {0x8, 0x2, [0x85, 0x4]}}, {{0x1c, 0x1, {0xa0, 0x1, 0x9, 0x5e, 0x1, 0x10001, 0x5, 0x5}}, {0xe, 0x2, [0x4, 0xfdf, 0x1154, 0x10ed, 0x9]}}, {{0x1c, 0x1, {0xc3, 0x5, 0x5, 0xb473, 0x2, 0xfffffff7, 0x1ff, 0x2}}, {0x8, 0x2, [0x81, 0x685c]}}]}, @TCA_RATE={0x6, 0x5, {0x7, 0x1}}, @TCA_STAB={0xd4, 0x8, 0x0, 0x1, [{{0x1c, 0x1, {0x5, 0x66, 0x1ff, 0x4b, 0x1, 0x870, 0xfffffffa, 0x1}}, {0x6, 0x2, [0x9]}}, {{0x1c, 0x1, {0x2, 0x4a, 0x6, 0x6, 0x1, 0xa, 0x4, 0x5}}, {0xe, 0x2, [0x101, 0x7f, 0xf457, 0x7, 0x7]}}, {{0x1c, 0x1, {0x3, 0x10, 0x9, 0x8001, 0x0, 0x6, 0xffff, 0xa}}, {0x18, 0x2, [0x3b4, 0x4, 0x78, 0x2000, 0x67, 0x1, 0x1, 0xc, 0xa, 0x8]}}, {{0x1c, 0x1, {0x1, 0x55, 0x3b0, 0xa, 0x2, 0x0, 0x0, 0x3}}, {0xa, 0x2, [0x0, 0x8, 0x0]}}, {{0x1c, 0x1, {0x0, 0x0, 0x6, 0x925, 0x0, 0x2, 0x3, 0x2}}, {0x8, 0x2, [0x1, 0x9]}}]}, @TCA_INGRESS_BLOCK={0x8, 0xd, 0x1}]}, 0x2dc}, 0x1, 0x0, 0x0, 0x4081}, 0x0)
close_range(r0, 0xffffffffffffffff, 0x0) (async)
close_range(r0, 0xffffffffffffffff, 0x0)
sendmsg$nl_route_sched(r1, &(0x7f0000000380)={&(0x7f0000000240)={0x10, 0x0, 0x0, 0x2000000}, 0xc, &(0x7f0000000300)={&(0x7f00000002c0)=@delqdisc={0x3c, 0x25, 0x400, 0x70bd29, 0x25dfdbfb, {0x0, 0x0, 0x0, r2, {0xe, 0x6}, {}, {0x2, 0x4}}, [@TCA_RATE={0x6, 0x5, {0x2}}, @TCA_EGRESS_BLOCK={0x8, 0xe, 0x5}, @TCA_INGRESS_BLOCK={0x8, 0xd, 0x7}]}, 0x3c}, 0x1, 0x0, 0x0, 0x42805}, 0x20040002)
socket$inet_udp(0x2, 0x2, 0x0)
r3 = socket$inet6_tcp(0xa, 0x1, 0x0)
bind$inet6(r3, &(0x7f0000000080)={0xa, 0x2, 0x200, @loopback, 0x7}, 0x1c) (async)
bind$inet6(r3, &(0x7f0000000080)={0xa, 0x2, 0x200, @loopback, 0x7}, 0x1c)
sendto$inet6(r3, 0x0, 0x0, 0x24000045, &(0x7f00000001c0)={0xa, 0x2, 0xffff, @loopback, 0x9}, 0x1c)
setsockopt$inet6_tcp_TCP_CONGESTION(r3, 0x6, 0xd, &(0x7f0000000140)='illinois', 0x8)
shutdown(r3, 0x1)
r4 = socket$nl_route(0x10, 0x3, 0x0)
r5 = socket$nl_route(0x10, 0x3, 0x0)
setsockopt$netlink_NETLINK_NO_ENOBUFS(r5, 0x10e, 0xc, &(0x7f0000000040)=0x7f, 0x4) (async)
setsockopt$netlink_NETLINK_NO_ENOBUFS(r5, 0x10e, 0xc, &(0x7f0000000040)=0x7f, 0x4)
r6 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0)
r7 = ioctl$KVM_CREATE_VM(r6, 0xae01, 0x0)
r8 = ioctl$KVM_CREATE_GUEST_MEMFD(r7, 0xc040aed4, &(0x7f00000001c0)={0x1000200001ee0000, 0x3})
mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xa, 0x28011, r8, 0x78d4a000)
get_mempolicy(0x0, 0x0, 0x3, &(0x7f000024c000/0x2000)=nil, 0x2) (async)
get_mempolicy(0x0, 0x0, 0x3, &(0x7f000024c000/0x2000)=nil, 0x2)
syz_init_net_socket$nl_generic(0x10, 0x3, 0x10)
sendmsg$nl_route(r5, &(0x7f0000000100)={0x0, 0x20, &(0x7f00000000c0)={&(0x7f0000000000)=ANY=[@ANYBLOB="240000001a0001000000ff7f0000000080200000", @ANYRES32=0x0, @ANYBLOB='\x00\x00\x00\x00\b\x00', @ANYRES32=r5], 0x24}}, 0x0) (async)
sendmsg$nl_route(r5, &(0x7f0000000100)={0x0, 0x20, &(0x7f00000000c0)={&(0x7f0000000000)=ANY=[@ANYBLOB="240000001a0001000000ff7f0000000080200000", @ANYRES32=0x0, @ANYBLOB='\x00\x00\x00\x00\b\x00', @ANYRES32=r5], 0x24}}, 0x0)
r9 = fsopen(&(0x7f0000000280)='ceph\x00', 0x0)
r10 = socket$inet(0x2, 0x2, 0x0)
bpf$PROG_LOAD(0x5, &(0x7f0000000080)={0x1, 0x5, &(0x7f0000002c00)=ANY=[@ANYBLOB="bf16000000000000b70700000900f0ff4070000000000000500000000000000095000000000000002ba728041598d6fbd30cb599e8c73d24a3aa81d36bb3019c13bd23212fb56fa54f26fb0b71d0e6adfefc41d86bd917487960717142fa9ea4318123741c0a0e168c1886d0d4d94f2f4e345c652ebc1626e3a2a2ad35806150ae0209e62f51ee988e6e0dc8ce974a22a550d6fd70800c86ae3b3e05df3ceb9fc474c2a100c788b277beee1cbf9b0a4def23d410f6296b32a8343881dcc7b1b85f3c3d44aeaccd3641110bec4e90a6341965c39e4b3449abe802f5ab3e89cf6c662ed4048d3b3e22278d00031e5388ee6f867ddd58211d6ececb0cd2b6d357b8580218ce740068725837074e468ee23fd2f73902ebcfcf49822775985bf31b715f5888b2c81f96a810b946855c9fc52ac17cbc97a616811a4c2dc3470009b966abaf41939aeca3e7b00c2e9d5db7a34fe2a29ac88c360a878a2b9ab9440c1961e80477166f3f847e855cdddc941d996d61ea0ce23b37e9d21c849d1e1e53087a3b109012e3a3ecbd219265048bf5c72b7ba2806b73323301b4bc94d0e4afde44867d71049a7c89bc615e215571ac910d80a58b5169576ff9906c34d2342806960b6bcb00000000000000000000000000113ee640b9ed1e04a0bfb125204d30990361bf45ef45277a167cd2c2e6ce9138143aa5ea7ee6f7c6d8b00437e070b004c5aa90766538b4fe45a16f14b270904d36eaa87508ac6d46639b3971ac6a88dc531fcc5ffc6b76b334795d88156336a9a452a9022485bb572dacb7aa25f748bc75918a16d9d5ae21004cd799ac4951beb2c6c9b5baf60081b86cc2e31c49f4ea055fb3639036c95c69b1ae60e685d486dbd1d5e7d0daacd73acfc80b9c9c92"], &(0x7f0000000140)='GPL\x00'}, 0x48) (async)
r11 = bpf$PROG_LOAD(0x5, &(0x7f0000000080)={0x1, 0x5, &(0x7f0000002c00)=ANY=[@ANYBLOB="bf16000000000000b70700000900f0ff4070000000000000500000000000000095000000000000002ba728041598d6fbd30cb599e8c73d24a3aa81d36bb3019c13bd23212fb56fa54f26fb0b71d0e6adfefc41d86bd917487960717142fa9ea4318123741c0a0e168c1886d0d4d94f2f4e345c652ebc1626e3a2a2ad35806150ae0209e62f51ee988e6e0dc8ce974a22a550d6fd70800c86ae3b3e05df3ceb9fc474c2a100c788b277beee1cbf9b0a4def23d410f6296b32a8343881dcc7b1b85f3c3d44aeaccd3641110bec4e90a6341965c39e4b3449abe802f5ab3e89cf6c662ed4048d3b3e22278d00031e5388ee6f867ddd58211d6ececb0cd2b6d357b8580218ce740068725837074e468ee23fd2f73902ebcfcf49822775985bf31b715f5888b2c81f96a810b946855c9fc52ac17cbc97a616811a4c2dc3470009b966abaf41939aeca3e7b00c2e9d5db7a34fe2a29ac88c360a878a2b9ab9440c1961e80477166f3f847e855cdddc941d996d61ea0ce23b37e9d21c849d1e1e53087a3b109012e3a3ecbd219265048bf5c72b7ba2806b73323301b4bc94d0e4afde44867d71049a7c89bc615e215571ac910d80a58b5169576ff9906c34d2342806960b6bcb00000000000000000000000000113ee640b9ed1e04a0bfb125204d30990361bf45ef45277a167cd2c2e6ce9138143aa5ea7ee6f7c6d8b00437e070b004c5aa90766538b4fe45a16f14b270904d36eaa87508ac6d46639b3971ac6a88dc531fcc5ffc6b76b334795d88156336a9a452a9022485bb572dacb7aa25f748bc75918a16d9d5ae21004cd799ac4951beb2c6c9b5baf60081b86cc2e31c49f4ea055fb3639036c95c69b1ae60e685d486dbd1d5e7d0daacd73acfc80b9c9c92"], &(0x7f0000000140)='GPL\x00'}, 0x48)
setsockopt$IPT_SO_SET_REPLACE(r10, 0x0, 0x40, &(0x7f0000000a80)=@raw={'raw\x00', 0x8, 0x3, 0x450, 0x2e8, 0x40000, 0x198, 0x2e8, 0x198, 0x3b8, 0x358, 0x358, 0x3b8, 0x358, 0x3, 0x0, {[{{@ip={@multicast2, @dev={0xac, 0x14, 0x14, 0x16}, 0x0, 0x0, 'vcan0\x00', 'wg1\x00', {}, {}, 0x0, 0x1}, 0x0, 0x2c8, 0x2e8, 0x0, {}, [@common=@unspec=@bpf1={{0x230}, @fd={0x2, 0x0, r11}}, @inet=@rpfilter={{0x28}, {0x9}}]}, @unspec=@TRACE={0x20}}, {{@ip={@remote, @dev, 0x0, 0x0, 'team_slave_1\x00', 'netdevsim0\x00', {}, {}, 0x0, 0x2}, 0x0, 0x70, 0xd0}, @common=@CLUSTERIP={0x60, 'CLUSTERIP\x00', 0x0, {0x0, @empty, 0x3, 0x10, [0x48, 0x37, 0x32, 0x26, 0x2, 0x2d, 0x29, 0x17, 0x23, 0x1c, 0xe, 0x38, 0xb, 0x22, 0x27, 0xd], 0x2, 0x4b, 0x9}}}], {{'\x00', 0x0, 0x70, 0x98}, {0x28, '\x00', 0x4}}}}, 0x4b0) (async)
setsockopt$IPT_SO_SET_REPLACE(r10, 0x0, 0x40, &(0x7f0000000a80)=@raw={'raw\x00', 0x8, 0x3, 0x450, 0x2e8, 0x40000, 0x198, 0x2e8, 0x198, 0x3b8, 0x358, 0x358, 0x3b8, 0x358, 0x3, 0x0, {[{{@ip={@multicast2, @dev={0xac, 0x14, 0x14, 0x16}, 0x0, 0x0, 'vcan0\x00', 'wg1\x00', {}, {}, 0x0, 0x1}, 0x0, 0x2c8, 0x2e8, 0x0, {}, [@common=@unspec=@bpf1={{0x230}, @fd={0x2, 0x0, r11}}, @inet=@rpfilter={{0x28}, {0x9}}]}, @unspec=@TRACE={0x20}}, {{@ip={@remote, @dev, 0x0, 0x0, 'team_slave_1\x00', 'netdevsim0\x00', {}, {}, 0x0, 0x2}, 0x0, 0x70, 0xd0}, @common=@CLUSTERIP={0x60, 'CLUSTERIP\x00', 0x0, {0x0, @empty, 0x3, 0x10, [0x48, 0x37, 0x32, 0x26, 0x2, 0x2d, 0x29, 0x17, 0x23, 0x1c, 0xe, 0x38, 0xb, 0x22, 0x27, 0xd], 0x2, 0x4b, 0x9}}}], {{'\x00', 0x0, 0x70, 0x98}, {0x28, '\x00', 0x4}}}}, 0x4b0)
fsconfig$FSCONFIG_SET_STRING(r9, 0x1, &(0x7f0000000b40)='source', &(0x7f0000000040)='c:::\x00', 0x0)
sendmsg$nl_route(r4, &(0x7f0000000200)={&(0x7f0000000080)={0x10, 0x0, 0x0, 0x10000}, 0xc, &(0x7f00000001c0)={&(0x7f00000003c0)=ANY=[@ANYBLOB="60000000680010002bbd7000fcdbdf250000016c628248000400000006000700030000001400060000000000000000000000ffffe000020400040014000600fe8000000000000000000000000000bb0600030001000000040004000600070016b6b1c3743f50f418c7e7dbbf400f4572129ee24d86ca5ff823d02b29be494923a8aaa4b47d7ef1f3a28fec72c6abbaea5dda008b8a3bb6235999664625c8cfdcaa6615a8f7df4f233cafa3d868e661ad4e3ceb5891fb925df0d2781bae0c773fc9b8b083ba36c4398576350a6845daecae5c72af66c7b7eac1fe54ead22a31399b288ac47d54b2adff1bc71e1cf0b0caca6f91f721e4e5b4884effb45269ebc565ec33f8b8ca63800344014c"], 0x60}}, 0x800)
gettid()
fsconfig$FSCONFIG_CMD_CREATE(r9, 0x6, 0x0, 0x0, 0x0) (async)
fsconfig$FSCONFIG_CMD_CREATE(r9, 0x6, 0x0, 0x0, 0x0)
executing program 3:
socket$nl_netfilter(0x10, 0x3, 0xc)
r0 = socket$inet6_tcp(0xa, 0x1, 0x0)
connect$inet6(r0, 0x0, 0x0)
r1 = gettid()
timer_create(0x0, &(0x7f0000533fa0)={0x0, 0x21, 0x800000000004, @tid=r1}, &(0x7f0000000140))
timer_settime(0x0, 0x0, &(0x7f0000000280)={{0x0, 0x989680}, {0x0, 0x989680}}, 0x0)
mmap$IORING_OFF_SQ_RING(0x110c230000, 0x8000002, 0x2000007, 0x401d031, 0xffffffffffffffff, 0x0)
socketpair$unix(0x1, 0x0, 0x0, 0x0)
openat$ptmx(0xffffffffffffff9c, 0x0, 0x482, 0x0)
r2 = socket(0x1, 0x2, 0x0)
getsockopt$sock_cred(r2, 0x1, 0x11, 0x0, &(0x7f0000cab000))
setsockopt$sock_cred(0xffffffffffffffff, 0x1, 0x11, 0x0, 0x0)
lremovexattr(0x0, 0x0)
setsockopt$inet6_tcp_TCP_REPAIR_QUEUE(r0, 0x6, 0x14, 0x0, 0x0)
mmap(&(0x7f0000000000/0x4000)=nil, 0x4000, 0x1, 0x10012, 0xffffffffffffffff, 0x5deba000)
mmap(&(0x7f0000bfe000/0x400000)=nil, 0x400000, 0x4, 0x40010, r0, 0xd1aa000)
mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x3, 0x8031, 0xffffffffffffffff, 0x0)
r3 = openat$audio(0xffffffffffffff9c, &(0x7f0000000380), 0x149842, 0x0)
write$dsp(r3, &(0x7f00000003c0)="91", 0xffffffb5)
mmap$dsp(&(0x7f0000ffd000/0x2000)=nil, 0x2000, 0x100000b, 0x810, r3, 0x0)
close(r3)
socket$xdp(0x2c, 0x3, 0x0)
r4 = socket$kcm(0xa, 0x2, 0x0)
setsockopt$inet6_tcp_TCP_CONGESTION(r0, 0x6, 0xd, &(0x7f0000000040)='veno', 0x4)
r5 = socket(0x2, 0x80805, 0x0)
r6 = openat$fuse(0xffffffffffffff9c, &(0x7f0000000080), 0x2, 0x0)
read$FUSE(r6, &(0x7f0000000600)={0x2020}, 0x2020)
setsockopt$IP_VS_SO_SET_ADD(r5, 0x0, 0x482, &(0x7f0000000240)={0x84, @dev={0xac, 0x14, 0x14, 0x15}, 0x4e20, 0x3, 'wlc\x00', 0x2, 0x660f537e, 0x3}, 0x2c)
setsockopt$IP_VS_SO_SET_ADDDEST(r5, 0x0, 0x487, &(0x7f0000000440)={{0x84, @multicast2, 0x4e22, 0x3, 'ovf\x00', 0x5, 0xc, 0x6c}, {@private=0xa010101, 0x4e23, 0x10002, 0x1, 0x1}}, 0x44)
sendmsg$sock(r4, &(0x7f0000000400)={&(0x7f0000000580)=@in6={0x2, 0x4e20, 0x0, @dev={0xfe, 0x80, '\x00', 0xfd}}, 0x80, 0x0, 0x0, &(0x7f0000000000)=[@mark={{0x14, 0x1, 0x24, 0x3}}], 0x18}, 0x0)
executing program 3:
r0 = syz_usb_connect(0x0, 0x32, &(0x7f0000000000)=ANY=[@ANYBLOB="1201000200000040a61b01000100000000010902200001010080320904"], 0x0)
r1 = openat$ptp1(0xffffffffffffff9c, &(0x7f0000000c40), 0x149201, 0x0)
ioctl$PTP_ENABLE_PPS(r1, 0x40043d04, 0x1)
r2 = socket$kcm(0x10, 0x2, 0x4)
sendmsg$inet(r2, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)=[{&(0x7f0000000100)="5c00000012006bab9e3fe3d86e6c1d0000147ea60864160af36504b68675f8001d000a00a0e69ee517d34460bc24eab556a705251e6182949a36c23d3b48dfd8cdbf9367b4fa51f60a64c9f4080003680601000008000300ff000000", 0x5c}], 0x1, 0x0, 0x0, 0x1f00c00e}, 0x0)
r3 = syz_usb_connect$uac3(0x3, 0x80, &(0x7f0000000280)=ANY=[], 0x0)
syz_usb_control_io(r0, 0x0, 0x0)
syz_usb_control_io$sierra_net(r0, 0x0, &(0x7f0000000700)={0x1c, &(0x7f0000000280)=ANY=[], 0x0, 0x0})
syz_usb_control_io$uac3(r3, 0x0, 0x0)
syz_usb_control_io$printer(r0, 0x0, &(0x7f00000005c0)={0x34, &(0x7f00000003c0)=ANY=[], 0x0, 0x0, 0x0, 0x0, 0x0})
mkdirat(0xffffffffffffff9c, &(0x7f0000000200)='./file0\x00', 0x0)
r4 = openat(0xffffffffffffff9c, &(0x7f0000000080)='./file0\x00', 0x0, 0xd5)
ioctl$FS_IOC_GETFLAGS(r4, 0x80086601, &(0x7f0000000100))
syz_open_dev$dvb_frontend(&(0x7f0000000100), 0x1, 0x802)
r5 = socket$inet6_sctp(0xa, 0x801, 0x84)
getsockopt$bt_hci(r5, 0x84, 0x81, &(0x7f0000001280)=""/4107, &(0x7f00000000c0)=0x100b)
r6 = socket$rxrpc(0x21, 0x2, 0x2)
setsockopt$RXRPC_MIN_SECURITY_LEVEL(r6, 0x110, 0x4, &(0x7f0000000440)=0x1, 0x4)
syz_usb_connect(0x0, 0x32, &(0x7f0000000000)=ANY=[@ANYBLOB="1201000200000040a61b01000100000000010902200001010080320904"], 0x0) (async)
openat$ptp1(0xffffffffffffff9c, &(0x7f0000000c40), 0x149201, 0x0) (async)
ioctl$PTP_ENABLE_PPS(r1, 0x40043d04, 0x1) (async)
socket$kcm(0x10, 0x2, 0x4) (async)
sendmsg$inet(r2, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)=[{&(0x7f0000000100)="5c00000012006bab9e3fe3d86e6c1d0000147ea60864160af36504b68675f8001d000a00a0e69ee517d34460bc24eab556a705251e6182949a36c23d3b48dfd8cdbf9367b4fa51f60a64c9f4080003680601000008000300ff000000", 0x5c}], 0x1, 0x0, 0x0, 0x1f00c00e}, 0x0) (async)
syz_usb_connect$uac3(0x3, 0x80, &(0x7f0000000280)=ANY=[], 0x0) (async)
syz_usb_control_io(r0, 0x0, 0x0) (async)
syz_usb_control_io$sierra_net(r0, 0x0, &(0x7f0000000700)={0x1c, &(0x7f0000000280)=ANY=[], 0x0, 0x0}) (async)
syz_usb_control_io$uac3(r3, 0x0, 0x0) (async)
syz_usb_control_io$printer(r0, 0x0, &(0x7f00000005c0)={0x34, &(0x7f00000003c0)=ANY=[], 0x0, 0x0, 0x0, 0x0, 0x0}) (async)
mkdirat(0xffffffffffffff9c, &(0x7f0000000200)='./file0\x00', 0x0) (async)
openat(0xffffffffffffff9c, &(0x7f0000000080)='./file0\x00', 0x0, 0xd5) (async)
ioctl$FS_IOC_GETFLAGS(r4, 0x80086601, &(0x7f0000000100)) (async)
syz_open_dev$dvb_frontend(&(0x7f0000000100), 0x1, 0x802) (async)
socket$inet6_sctp(0xa, 0x801, 0x84) (async)
getsockopt$bt_hci(r5, 0x84, 0x81, &(0x7f0000001280)=""/4107, &(0x7f00000000c0)=0x100b) (async)
socket$rxrpc(0x21, 0x2, 0x2) (async)
setsockopt$RXRPC_MIN_SECURITY_LEVEL(r6, 0x110, 0x4, &(0x7f0000000440)=0x1, 0x4) (async)
executing program 2:
r0 = syz_open_dev$dri(&(0x7f0000000040), 0x0, 0x442a02)
ioctl$DRM_IOCTL_GET_MAGIC(r0, 0x80046402, 0x0)
r1 = seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0x0, &(0x7f0000000040)={0x1, &(0x7f0000000000)=[{0x6, 0x0, 0x0, 0x7fff8000}]})
close_range(r1, 0xffffffffffffffff, 0x0)
madvise(&(0x7f0000f19000/0x1000)=nil, 0x1000, 0xa)
openat$cgroup_type(0xffffffffffffffff, &(0x7f0000000140), 0x2, 0x0)
r2 = fcntl$dupfd(r0, 0x0, r1)
r3 = seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0x0, &(0x7f0000000000)={0x1, &(0x7f0000000100)=[{0x6, 0x0, 0xff, 0x7fff0000}]})
r4 = syz_init_net_socket$bt_l2cap(0x1f, 0x1, 0x3)
bind$bt_l2cap(r4, &(0x7f0000000280)={0x1f, 0x0, @none, 0x0, 0x2}, 0xe)
listen(r4, 0x1)
close_range(r3, 0xffffffffffffffff, 0x0)
r5 = syz_kvm_add_vcpu$x86(0x0, &(0x7f0000000700)={0x0, &(0x7f00000002c0)=[@set_irq_handler={0xc8, 0x20, {0x8a, 0x1}}, @uexit={0x0, 0x18, 0x3}, @nested_amd_inject_event={0x180, 0x38, {0x2, 0xc0, 0x2, 0x31ec194800000000, 0x3}}, @enable_nested={0x12c, 0x18}, @set_irq_handler={0xc8, 0x20, {0xb2, 0x1}}, @nested_amd_invlpga={0x17d, 0x20, {0x25001, 0xa8e8}}, @nested_amd_set_intercept={0x181, 0x30, {0x3, 0x800, 0x8, 0x1}}, @wrmsr={0x65, 0x20, {0x2af, 0x2}}, @nested_amd_stgi={0x17e, 0x10}, @code={0xa, 0x88, {"66f3470f09470f4c44810036f3f366470f86074100006467366667653e660f3880336464f661a8c7442400c6000000c7442402ea840000ff2c240f21f4b90a030000b821000000ba000000000f3048b800980000000000000f23c00f21f83501000e000f23f8b9820b0000b8a149ad8fbad55194300f30"}}, @wrmsr={0x65, 0x20, {0x236, 0x8000000000}}, @wrmsr={0x65, 0x20, {0xa61, 0x9}}, @nested_vmresume={0x130, 0x18, 0x2}, @nested_amd_inject_event={0x180, 0x38, {0x3, 0x86, 0x2, 0x4, 0x1}}, @cpuid={0x64, 0x18, {0x6}}, @nested_intel_vmwrite_mask={0x154, 0x38, {0x3, @ro32=0x440e, 0x4, 0x8fc, 0x3ff}}, @code={0xa, 0x57, {"2e0f38026e07b9bf0a00000f326543d877c1640f070f350f01df66b8fa008ed848b864930000000000000f23c80f21f8350c0020000f23f80f009f0b000000b96d0a00000f32"}}, @nested_amd_stgi={0x17e, 0x10}, @enable_nested={0x12c, 0x18}, @nested_load_syzos={0x136, 0x70, {0x0, 0x91b2, [@set_irq_handler={0xc8, 0x20, {0xe6, 0x2}}, @nested_amd_set_intercept={0x181, 0x30, {0x3, 0x8000000000000001, 0x4, 0x1}}]}}, @nested_amd_set_intercept={0x181, 0x30, {0x3, 0xffffffffffffffff, 0xb13b, 0x1}}, @rdmsr={0x66, 0x18, {0x9a4}}, @nested_amd_set_intercept={0x181, 0x30, {0x3, 0x8, 0xe3, 0x1}}, @nested_intel_vmwrite_mask={0x154, 0x38, {0x1, @control16=0x4, 0x9, 0x5, 0x6}}], 0x42f})
ioctl$KVM_GET_XSAVE2(r5, 0x9000aecf, &(0x7f0000ffd000/0x2000)=nil)
epoll_ctl$EPOLL_CTL_DEL(r2, 0x2, r0)
prctl$PR_SET_VMA(0x53564d41, 0x0, &(0x7f0000f19000/0x1000)=nil, 0x1000, &(0x7f0000000000)='/{!+]\x00')
ioctl$AUTOFS_DEV_IOCTL_FAIL(0xffffffffffffffff, 0xc0189377, &(0x7f0000000080)={{0x1, 0x1, 0x18, <r6=>r1, {0x1d, 0x296f5e09}}, './file0\x00'})
ioctl$UFFDIO_REGISTER(r6, 0xc020aa00, &(0x7f00000000c0)={{&(0x7f0000f19000/0x1000)=nil, 0x1000}, 0x2})
ioctl$SNDRV_TIMER_IOCTL_START(r6, 0x54a0)
executing program 2:
symlinkat(&(0x7f0000000080)='.\x00', 0xffffffffffffff9c, &(0x7f0000000200)='./file0\x00')
bpf$PROG_LOAD(0x5, &(0x7f0000000180)={0x10, 0x4, &(0x7f0000000000)=@framed={{}, [@call={0x179, 0x11, 0x100000}]}, &(0x7f00000000c0)='GPL\x00', 0x4, 0x1000, &(0x7f0000000200)=""/4096, 0x0, 0x0, '\x00', 0x0, @sk_msg}, 0x70)
mkdirat(0xffffffffffffff9c, &(0x7f0000000040)='./file1\x00', 0x1)
lremovexattr(&(0x7f0000001200)='./file7\x00', &(0x7f0000001240)=@random={'security.', '\x00'})
mkdirat(0xffffffffffffff9c, &(0x7f00000000c0)='./bus\x00', 0x0)
mount$overlay(0x0, &(0x7f00000000c0)='./bus\x00', &(0x7f0000000080), 0xa14000, &(0x7f0000000140)={[{@upperdir={'upperdir', 0x3d, './file1'}}, {@lowerdir={'lowerdir', 0x3d, './file0'}}, {@workdir={'workdir', 0x3d, './bus'}}]})
chdir(&(0x7f00000003c0)='./bus\x00')
mkdirat(0xffffffffffffff9c, &(0x7f0000000540)='./file7\x00', 0x1c0)
renameat2(0xffffffffffffff9c, &(0x7f0000000780)='./file0\x00', 0xffffffffffffff9c, &(0x7f0000000000)='./file7/file0\x00', 0x0)
r0 = openat(0xffffffffffffff9c, 0x0, 0x0, 0x2)
mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./file0\x00', 0x0)
r1 = socket$can_j1939(0x1d, 0x2, 0x7)
mprotect(&(0x7f0000000000/0x3000)=nil, 0x3000, 0x1)
setsockopt$sock_int(r1, 0x1, 0x6, &(0x7f0000000040)=0x1, 0x4)
r2 = socket$packet(0x11, 0x3, 0x300)
setsockopt$packet_fanout(r2, 0x107, 0x12, &(0x7f0000000000)={0x4, 0x3}, 0x4)
r3 = socket$packet(0x11, 0x3, 0x300)
setsockopt$packet_fanout(r3, 0x107, 0x12, &(0x7f0000000000)={0x4, 0x3}, 0x4)
r4 = bpf$PROG_LOAD_XDP(0x5, &(0x7f0000000480)={0x6, 0x3, &(0x7f0000000680)=ANY=[@ANYBLOB="1800000002000000000000000000000095"], &(0x7f00000002c0)='syzkaller\x00'}, 0x94)
setsockopt$inet_sctp_SCTP_ADD_STREAMS(r0, 0x84, 0x79, &(0x7f0000000100)={0x0, 0xa, 0x3}, 0x8)
bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f0000000600)={r4, 0x5, 0xb68, 0x560b0000, &(0x7f0000000000)="259a53f271a76d2673004c6588a8", 0x0, 0xd01, 0x2a0, 0x0, 0x0, 0x0, 0x0, 0x2}, 0x48)
executing program 4:
r0 = syz_open_dev$dvb_frontend(&(0x7f0000000080), 0x0, 0x402)
r1 = socket$inet_mptcp(0x2, 0x1, 0x106)
r2 = socket(0x10, 0x803, 0x0)
syz_genetlink_get_family_id$tipc(&(0x7f0000000000), r2)
getsockname$packet(r2, &(0x7f0000000280)={0x11, 0x0, <r3=>0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14)
sendmsg$nl_route(r2, &(0x7f0000000180)={&(0x7f0000000040)={0x10, 0x0, 0x0, 0x400000}, 0xc, &(0x7f0000000140)={&(0x7f0000000100)=@RTM_GETMDB={0x18, 0x56, 0x2, 0x70bd25, 0x25dfdbfe, {0x7, r3}, [""]}, 0x18}}, 0x20000000)
sendmsg$nl_route(r2, &(0x7f0000000240)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000580)=ANY=[@ANYBLOB="4800000010000305ff810000fddbdf2500000000", @ANYRES32=r3, @ANYBLOB="1748000040000200280012800a000100767863616e0000001800028014000100000000", @ANYRES32=r3], 0x48}, 0x1, 0x0, 0x0, 0x40}, 0x0)
connect$inet(r1, &(0x7f0000000000)={0x2, 0x4e22, @empty}, 0x10)
setsockopt$sock_int(r1, 0x1, 0x9, &(0x7f00000003c0)=0x246, 0x4)
ioctl$FE_SET_PROPERTY(r0, 0x40106f52, &(0x7f00000000c0)={0x29, &(0x7f0000000200)=[{0x34, '\x00', @data=0x4}]})
syz_open_dev$dvb_frontend(&(0x7f0000000080), 0x0, 0x402) (async)
socket$inet_mptcp(0x2, 0x1, 0x106) (async)
socket(0x10, 0x803, 0x0) (async)
syz_genetlink_get_family_id$tipc(&(0x7f0000000000), r2) (async)
getsockname$packet(r2, &(0x7f0000000280)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) (async)
sendmsg$nl_route(r2, &(0x7f0000000180)={&(0x7f0000000040)={0x10, 0x0, 0x0, 0x400000}, 0xc, &(0x7f0000000140)={&(0x7f0000000100)=@RTM_GETMDB={0x18, 0x56, 0x2, 0x70bd25, 0x25dfdbfe, {0x7, r3}, [""]}, 0x18}}, 0x20000000) (async)
sendmsg$nl_route(r2, &(0x7f0000000240)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000580)=ANY=[@ANYBLOB="4800000010000305ff810000fddbdf2500000000", @ANYRES32=r3, @ANYBLOB="1748000040000200280012800a000100767863616e0000001800028014000100000000", @ANYRES32=r3], 0x48}, 0x1, 0x0, 0x0, 0x40}, 0x0) (async)
connect$inet(r1, &(0x7f0000000000)={0x2, 0x4e22, @empty}, 0x10) (async)
setsockopt$sock_int(r1, 0x1, 0x9, &(0x7f00000003c0)=0x246, 0x4) (async)
ioctl$FE_SET_PROPERTY(r0, 0x40106f52, &(0x7f00000000c0)={0x29, &(0x7f0000000200)=[{0x34, '\x00', @data=0x4}]}) (async)

program crashed: KASAN: slab-use-after-free Read in dvb_device_open
bisect: the chunk can be dropped
bisect: split chunks (needed=true): <5>
bisect: split chunk #0 of len 5 into 2 parts
bisect: testing without sub-chunk 1/2
testing program (duration=30s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): [19, 21, 20]
detailed listing:
executing program 2:
r0 = syz_open_dev$dri(&(0x7f0000000040), 0x0, 0x442a02)
ioctl$DRM_IOCTL_GET_MAGIC(r0, 0x80046402, 0x0)
r1 = seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0x0, &(0x7f0000000040)={0x1, &(0x7f0000000000)=[{0x6, 0x0, 0x0, 0x7fff8000}]})
close_range(r1, 0xffffffffffffffff, 0x0)
madvise(&(0x7f0000f19000/0x1000)=nil, 0x1000, 0xa)
openat$cgroup_type(0xffffffffffffffff, &(0x7f0000000140), 0x2, 0x0)
r2 = fcntl$dupfd(r0, 0x0, r1)
r3 = seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0x0, &(0x7f0000000000)={0x1, &(0x7f0000000100)=[{0x6, 

<<cut 211141 bytes out>>

"]}, 0x18}}, 0x20000000)
sendmsg$nl_route(r2, &(0x7f0000000240)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000580)=ANY=[@ANYBLOB="4800000010000305ff810000fddbdf2500000000", @ANYRES32=r3, @ANYBLOB="1748000040000200280012800a000100767863616e0000001800028014000100000000", @ANYRES32=r3], 0x48}, 0x1, 0x0, 0x0, 0x40}, 0x0)
connect$inet(r1, &(0x7f0000000000)={0x2, 0x4e22, @empty}, 0x10)
setsockopt$sock_int(r1, 0x1, 0x9, &(0x7f00000003c0)=0x246, 0x4)
ioctl$FE_SET_PROPERTY(r0, 0x40106f52, &(0x7f00000000c0)={0x29, &(0x7f0000000200)=[{0x34, '\x00', @data=0x4}]})
syz_open_dev$dvb_frontend(&(0x7f0000000080), 0x0, 0x402) (async)
socket$inet_mptcp(0x2, 0x1, 0x106) (async)
socket(0x10, 0x803, 0x0) (async)
syz_genetlink_get_family_id$tipc(&(0x7f0000000000), r2) (async)
getsockname$packet(r2, &(0x7f0000000280)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) (async)
sendmsg$nl_route(r2, &(0x7f0000000180)={&(0x7f0000000040)={0x10, 0x0, 0x0, 0x400000}, 0xc, &(0x7f0000000140)={&(0x7f0000000100)=@RTM_GETMDB={0x18, 0x56, 0x2, 0x70bd25, 0x25dfdbfe, {0x7, r3}, [""]}, 0x18}}, 0x20000000) (async)
sendmsg$nl_route(r2, &(0x7f0000000240)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000580)=ANY=[@ANYBLOB="4800000010000305ff810000fddbdf2500000000", @ANYRES32=r3, @ANYBLOB="1748000040000200280012800a000100767863616e0000001800028014000100000000", @ANYRES32=r3], 0x48}, 0x1, 0x0, 0x0, 0x40}, 0x0) (async)
connect$inet(r1, &(0x7f0000000000)={0x2, 0x4e22, @empty}, 0x10) (async)
setsockopt$sock_int(r1, 0x1, 0x9, &(0x7f00000003c0)=0x246, 0x4) (async)
ioctl$FE_SET_PROPERTY(r0, 0x40106f52, &(0x7f00000000c0)={0x29, &(0x7f0000000200)=[{0x34, '\x00', @data=0x4}]}) (async)

program did not crash
testing program (duration=45s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): [23, 36, 20]
detailed listing:
executing program 0:
socket$nl_netfilter(0x10, 0x3, 0xc)
r0 = socket$inet6_tcp(0xa, 0x1, 0x0)
connect$inet6(r0, 0x0, 0x0)
r1 = gettid()
timer_create(0x0, &(0x7f0000533fa0)={0x0, 0x21, 0x800000000004, @tid=r1}, &(0x7f0000000140))
timer_settime(0x0, 0x0, &(0x7f0000000280)={{0x0, 0x989680}, {0x0, 0x989680}}, 0x0)
mmap$IORING_OFF_SQ_RING(0x110c230000, 0x8000002, 0x2000007, 0x401d031, 0xffffffffffffffff, 0x0)
socketpair$unix(0x1, 0x0, 0x0, 0x0)
openat$ptmx(0xffffffffffffff9c, 0x0, 0x482, 0x0)
getsockopt$sock_cred(0xffffffffffffffff, 0x1, 0x11, 0x0, &(0x7f0000cab000))
setsockopt$sock_cred(0xffffffffffffffff, 0x1, 0x11, 0x0, 0x0)
setsockopt$inet6_tcp_TCP_REPAIR_QUEUE(r0, 0x6, 0x14, 0x0, 0x0)
mmap(&(0x7f0000000000/0x4000)=nil, 0x4000, 0x1, 0x10012, 0xffffffffffffffff, 0x5deba000)
mmap(&(0x7f0000bfe000/0x400000)=nil, 0x400000, 0x4, 0x40010, r0, 0xd1aa000)
mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x3, 0x8031, 0xffffffffffffffff, 0x0)
mmap$dsp(&(0x7f0000ffd000/0x2000)=nil, 0x2000, 0x100000b, 0x810, 0xffffffffffffffff, 0x0)
socket$xdp(0x2c, 0x3, 0x0)
r2 = socket$kcm(0xa, 0x2, 0x0)
r3 = socket(0x2, 0x80805, 0x0)
r4 = openat$fuse(0xffffffffffffff9c, &(0x7f0000000080), 0x2, 0x0)
read$FUSE(r4, &(0x7f0000000600)={0x2020}, 0x2020)
setsockopt$IP_VS_SO_SET_ADD(r3, 0x0, 0x482, &(0x7f0000000240)={0x84, @dev={0xac, 0x14, 0x14, 0x15}, 0x4e20, 0x3, 'wlc\x00', 0x2, 0x660f537e, 0x3}, 0x2c)
sendmsg$sock(r2, &(0x7f0000000400)={&(0x7f0000000580)=@in6={0x2, 0x4e20, 0x0, @dev={0xfe, 0x80, '\x00', 0xfd}}, 0x80, 0x0, 0x0, &(0x7f0000000000)=[@mark={{0x14, 0x1, 0x24, 0x3}}], 0x18}, 0x0)
executing program 3:
r0 = syz_usb_connect(0x0, 0x32, &(0x7f0000000000)=ANY=[@ANYBLOB="1201000200000040a61b01000100000000010902200001010080320904"], 0x0)
r1 = openat$ptp1(0xffffffffffffff9c, &(0x7f0000000c40), 0x149201, 0x0)
ioctl$PTP_ENABLE_PPS(r1, 0x40043d04, 0x1)
r2 = socket$kcm(0x10, 0x2, 0x4)
sendmsg$inet(r2, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)=[{&(0x7f0000000100)="5c00000012006bab9e3fe3d86e6c1d0000147ea60864160af36504b68675f8001d000a00a0e69ee517d34460bc24eab556a705251e6182949a36c23d3b48dfd8cdbf9367b4fa51f60a64c9f4080003680601000008000300ff000000", 0x5c}], 0x1, 0x0, 0x0, 0x1f00c00e}, 0x0)
r3 = syz_usb_connect$uac3(0x3, 0x80, &(0x7f0000000280)=ANY=[], 0x0)
syz_usb_control_io(r0, 0x0, 0x0)
syz_usb_control_io$sierra_net(r0, 0x0, &(0x7f0000000700)={0x1c, &(0x7f0000000280)=ANY=[], 0x0, 0x0})
syz_usb_control_io$uac3(r3, 0x0, 0x0)
syz_usb_control_io$printer(r0, 0x0, &(0x7f00000005c0)={0x34, &(0x7f00000003c0)=ANY=[], 0x0, 0x0, 0x0, 0x0, 0x0})
mkdirat(0xffffffffffffff9c, &(0x7f0000000200)='./file0\x00', 0x0)
r4 = openat(0xffffffffffffff9c, &(0x7f0000000080)='./file0\x00', 0x0, 0xd5)
ioctl$FS_IOC_GETFLAGS(r4, 0x80086601, &(0x7f0000000100))
syz_open_dev$dvb_frontend(&(0x7f0000000100), 0x1, 0x802)
r5 = socket$inet6_sctp(0xa, 0x801, 0x84)
getsockopt$bt_hci(r5, 0x84, 0x81, &(0x7f0000001280)=""/4107, &(0x7f00000000c0)=0x100b)
r6 = socket$rxrpc(0x21, 0x2, 0x2)
setsockopt$RXRPC_MIN_SECURITY_LEVEL(r6, 0x110, 0x4, &(0x7f0000000440)=0x1, 0x4)
syz_usb_connect(0x0, 0x32, &(0x7f0000000000)=ANY=[@ANYBLOB="1201000200000040a61b01000100000000010902200001010080320904"], 0x0) (async)
openat$ptp1(0xffffffffffffff9c, &(0x7f0000000c40), 0x149201, 0x0) (async)
ioctl$PTP_ENABLE_PPS(r1, 0x40043d04, 0x1) (async)
socket$kcm(0x10, 0x2, 0x4) (async)
sendmsg$inet(r2, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)=[{&(0x7f0000000100)="5c00000012006bab9e3fe3d86e6c1d0000147ea60864160af36504b68675f8001d000a00a0e69ee517d34460bc24eab556a705251e6182949a36c23d3b48dfd8cdbf9367b4fa51f60a64c9f4080003680601000008000300ff000000", 0x5c}], 0x1, 0x0, 0x0, 0x1f00c00e}, 0x0) (async)
syz_usb_connect$uac3(0x3, 0x80, &(0x7f0000000280)=ANY=[], 0x0) (async)
syz_usb_control_io(r0, 0x0, 0x0) (async)
syz_usb_control_io$sierra_net(r0, 0x0, &(0x7f0000000700)={0x1c, &(0x7f0000000280)=ANY=[], 0x0, 0x0}) (async)
syz_usb_control_io$uac3(r3, 0x0, 0x0) (async)
syz_usb_control_io$printer(r0, 0x0, &(0x7f00000005c0)={0x34, &(0x7f00000003c0)=ANY=[], 0x0, 0x0, 0x0, 0x0, 0x0}) (async)
mkdirat(0xffffffffffffff9c, &(0x7f0000000200)='./file0\x00', 0x0) (async)
openat(0xffffffffffffff9c, &(0x7f0000000080)='./file0\x00', 0x0, 0xd5) (async)
ioctl$FS_IOC_GETFLAGS(r4, 0x80086601, &(0x7f0000000100)) (async)
syz_open_dev$dvb_frontend(&(0x7f0000000100), 0x1, 0x802) (async)
socket$inet6_sctp(0xa, 0x801, 0x84) (async)
getsockopt$bt_hci(r5, 0x84, 0x81, &(0x7f0000001280)=""/4107, &(0x7f00000000c0)=0x100b) (async)
socket$rxrpc(0x21, 0x2, 0x2) (async)
setsockopt$RXRPC_MIN_SECURITY_LEVEL(r6, 0x110, 0x4, &(0x7f0000000440)=0x1, 0x4) (async)
executing program 4:
r0 = syz_open_dev$dvb_frontend(&(0x7f0000000080), 0x0, 0x402)
r1 = socket$inet_mptcp(0x2, 0x1, 0x106)
r2 = socket(0x10, 0x803, 0x0)
syz_genetlink_get_family_id$tipc(&(0x7f0000000000), r2)
getsockname$packet(r2, &(0x7f0000000280)={0x11, 0x0, <r3=>0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14)
sendmsg$nl_route(r2, &(0x7f0000000180)={&(0x7f0000000040)={0x10, 0x0, 0x0, 0x400000}, 0xc, &(0x7f0000000140)={&(0x7f0000000100)=@RTM_GETMDB={0x18, 0x56, 0x2, 0x70bd25, 0x25dfdbfe, {0x7, r3}, [""]}, 0x18}}, 0x20000000)
sendmsg$nl_route(r2, &(0x7f0000000240)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000580)=ANY=[@ANYBLOB="4800000010000305ff810000fddbdf2500000000", @ANYRES32=r3, @ANYBLOB="1748000040000200280012800a000100767863616e0000001800028014000100000000", @ANYRES32=r3], 0x48}, 0x1, 0x0, 0x0, 0x40}, 0x0)
connect$inet(r1, &(0x7f0000000000)={0x2, 0x4e22, @empty}, 0x10)
setsockopt$sock_int(r1, 0x1, 0x9, &(0x7f00000003c0)=0x246, 0x4)
ioctl$FE_SET_PROPERTY(r0, 0x40106f52, &(0x7f00000000c0)={0x29, &(0x7f0000000200)=[{0x34, '\x00', @data=0x4}]})
syz_open_dev$dvb_frontend(&(0x7f0000000080), 0x0, 0x402) (async)
socket$inet_mptcp(0x2, 0x1, 0x106) (async)
socket(0x10, 0x803, 0x0) (async)
syz_genetlink_get_family_id$tipc(&(0x7f0000000000), r2) (async)
getsockname$packet(r2, &(0x7f0000000280)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) (async)
sendmsg$nl_route(r2, &(0x7f0000000180)={&(0x7f0000000040)={0x10, 0x0, 0x0, 0x400000}, 0xc, &(0x7f0000000140)={&(0x7f0000000100)=@RTM_GETMDB={0x18, 0x56, 0x2, 0x70bd25, 0x25dfdbfe, {0x7, r3}, [""]}, 0x18}}, 0x20000000) (async)
sendmsg$nl_route(r2, &(0x7f0000000240)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000580)=ANY=[@ANYBLOB="4800000010000305ff810000fddbdf2500000000", @ANYRES32=r3, @ANYBLOB="1748000040000200280012800a000100767863616e0000001800028014000100000000", @ANYRES32=r3], 0x48}, 0x1, 0x0, 0x0, 0x40}, 0x0) (async)
connect$inet(r1, &(0x7f0000000000)={0x2, 0x4e22, @empty}, 0x10) (async)
setsockopt$sock_int(r1, 0x1, 0x9, &(0x7f00000003c0)=0x246, 0x4) (async)
ioctl$FE_SET_PROPERTY(r0, 0x40106f52, &(0x7f00000000c0)={0x29, &(0x7f0000000200)=[{0x34, '\x00', @data=0x4}]}) (async)

program crashed: KASAN: slab-use-after-free Read in dvb_device_open
testing program (duration=45s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): [22, 36, 20]
detailed listing:
executing program 0:
socket$nl_netfilter(0x10, 0x3, 0xc)
r0 = socket$inet6_tcp(0xa, 0x1, 0x0)
connect$inet6(r0, 0x0, 0x0)
r1 = gettid()
timer_create(0x0, &(0x7f0000533fa0)={0x0, 0x21, 0x800000000004, @tid=r1}, &(0x7f0000000140))
timer_settime(0x0, 0x0, &(0x7f0000000280)={{0x0, 0x989680}, {0x0, 0x989680}}, 0x0)
mmap$IORING_OFF_SQ_RING(0x110c230000, 0x8000002, 0x2000007, 0x401d031, 0xffffffffffffffff, 0x0)
socketpair$unix(0x1, 0x0, 0x0, 0x0)
getsockopt$sock_cred(0xffffffffffffffff, 0x1, 0x11, 0x0, &(0x7f0000cab000))
setsockopt$sock_cred(0xffffffffffffffff, 0x1, 0x11, 0x0, 0x0)
setsockopt$inet6_tcp_TCP_REPAIR_QUEUE(r0, 0x6, 0x14, 0x0, 0x0)
mmap(&(0x7f0000000000/0x4000)=nil, 0x4000, 0x1, 0x10012, 0xffffffffffffffff, 0x5deba000)
mmap(&(0x7f0000bfe000/0x400000)=nil, 0x400000, 0x4, 0x40010, r0, 0xd1aa000)
mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x3, 0x8031, 0xffffffffffffffff, 0x0)
mmap$dsp(&(0x7f0000ffd000/0x2000)=nil, 0x2000, 0x100000b, 0x810, 0xffffffffffffffff, 0x0)
socket$xdp(0x2c, 0x3, 0x0)
r2 = socket$kcm(0xa, 0x2, 0x0)
r3 = socket(0x2, 0x80805, 0x0)
r4 = openat$fuse(0xffffffffffffff9c, &(0x7f0000000080), 0x2, 0x0)
read$FUSE(r4, &(0x7f0000000600)={0x2020}, 0x2020)
setsockopt$IP_VS_SO_SET_ADD(r3, 0x0, 0x482, &(0x7f0000000240)={0x84, @dev={0xac, 0x14, 0x14, 0x15}, 0x4e20, 0x3, 'wlc\x00', 0x2, 0x660f537e, 0x3}, 0x2c)
sendmsg$sock(r2, &(0x7f0000000400)={&(0x7f0000000580)=@in6={0x2, 0x4e20, 0x0, @dev={0xfe, 0x80, '\x00', 0xfd}}, 0x80, 0x0, 0x0, &(0x7f0000000000)=[@mark={{0x14, 0x1, 0x24, 0x3}}], 0x18}, 0x0)
executing program 3:
r0 = syz_usb_connect(0x0, 0x32, &(0x7f0000000000)=ANY=[@ANYBLOB="1201000200000040a61b01000100000000010902200001010080320904"], 0x0)
r1 = openat$ptp1(0xffffffffffffff9c, &(0x7f0000000c40), 0x149201, 0x0)
ioctl$PTP_ENABLE_PPS(r1, 0x40043d04, 0x1)
r2 = socket$kcm(0x10, 0x2, 0x4)
sendmsg$inet(r2, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)=[{&(0x7f0000000100)="5c00000012006bab9e3fe3d86e6c1d0000147ea60864160af36504b68675f8001d000a00a0e69ee517d34460bc24eab556a705251e6182949a36c23d3b48dfd8cdbf9367b4fa51f60a64c9f4080003680601000008000300ff000000", 0x5c}], 0x1, 0x0, 0x0, 0x1f00c00e}, 0x0)
r3 = syz_usb_connect$uac3(0x3, 0x80, &(0x7f0000000280)=ANY=[], 0x0)
syz_usb_control_io(r0, 0x0, 0x0)
syz_usb_control_io$sierra_net(r0, 0x0, &(0x7f0000000700)={0x1c, &(0x7f0000000280)=ANY=[], 0x0, 0x0})
syz_usb_control_io$uac3(r3, 0x0, 0x0)
syz_usb_control_io$printer(r0, 0x0, &(0x7f00000005c0)={0x34, &(0x7f00000003c0)=ANY=[], 0x0, 0x0, 0x0, 0x0, 0x0})
mkdirat(0xffffffffffffff9c, &(0x7f0000000200)='./file0\x00', 0x0)
r4 = openat(0xffffffffffffff9c, &(0x7f0000000080)='./file0\x00', 0x0, 0xd5)
ioctl$FS_IOC_GETFLAGS(r4, 0x80086601, &(0x7f0000000100))
syz_open_dev$dvb_frontend(&(0x7f0000000100), 0x1, 0x802)
r5 = socket$inet6_sctp(0xa, 0x801, 0x84)
getsockopt$bt_hci(r5, 0x84, 0x81, &(0x7f0000001280)=""/4107, &(0x7f00000000c0)=0x100b)
r6 = socket$rxrpc(0x21, 0x2, 0x2)
setsockopt$RXRPC_MIN_SECURITY_LEVEL(r6, 0x110, 0x4, &(0x7f0000000440)=0x1, 0x4)
syz_usb_connect(0x0, 0x32, &(0x7f0000000000)=ANY=[@ANYBLOB="1201000200000040a61b01000100000000010902200001010080320904"], 0x0) (async)
openat$ptp1(0xffffffffffffff9c, &(0x7f0000000c40), 0x149201, 0x0) (async)
ioctl$PTP_ENABLE_PPS(r1, 0x40043d04, 0x1) (async)
socket$kcm(0x10, 0x2, 0x4) (async)
sendmsg$inet(r2, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)=[{&(0x7f0000000100)="5c00000012006bab9e3fe3d86e6c1d0000147ea60864160af36504b68675f8001d000a00a0e69ee517d34460bc24eab556a705251e6182949a36c23d3b48dfd8cdbf9367b4fa51f60a64c9f4080003680601000008000300ff000000", 0x5c}], 0x1, 0x0, 0x0, 0x1f00c00e}, 0x0) (async)
syz_usb_connect$uac3(0x3, 0x80, &(0x7f0000000280)=ANY=[], 0x0) (async)
syz_usb_control_io(r0, 0x0, 0x0) (async)
syz_usb_control_io$sierra_net(r0, 0x0, &(0x7f0000000700)={0x1c, &(0x7f0000000280)=ANY=[], 0x0, 0x0}) (async)
syz_usb_control_io$uac3(r3, 0x0, 0x0) (async)
syz_usb_control_io$printer(r0, 0x0, &(0x7f00000005c0)={0x34, &(0x7f00000003c0)=ANY=[], 0x0, 0x0, 0x0, 0x0, 0x0}) (async)
mkdirat(0xffffffffffffff9c, &(0x7f0000000200)='./file0\x00', 0x0) (async)
openat(0xffffffffffffff9c, &(0x7f0000000080)='./file0\x00', 0x0, 0xd5) (async)
ioctl$FS_IOC_GETFLAGS(r4, 0x80086601, &(0x7f0000000100)) (async)
syz_open_dev$dvb_frontend(&(0x7f0000000100), 0x1, 0x802) (async)
socket$inet6_sctp(0xa, 0x801, 0x84) (async)
getsockopt$bt_hci(r5, 0x84, 0x81, &(0x7f0000001280)=""/4107, &(0x7f00000000c0)=0x100b) (async)
socket$rxrpc(0x21, 0x2, 0x2) (async)
setsockopt$RXRPC_MIN_SECURITY_LEVEL(r6, 0x110, 0x4, &(0x7f0000000440)=0x1, 0x4) (async)
executing program 4:
r0 = syz_open_dev$dvb_frontend(&(0x7f0000000080), 0x0, 0x402)
r1 = socket$inet_mptcp(0x2, 0x1, 0x106)
r2 = socket(0x10, 0x803, 0x0)
syz_genetlink_get_family_id$tipc(&(0x7f0000000000), r2)
getsockname$packet(r2, &(0x7f0000000280)={0x11, 0x0, <r3=>0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14)
sendmsg$nl_route(r2, &(0x7f0000000180)={&(0x7f0000000040)={0x10, 0x0, 0x0, 0x400000}, 0xc, &(0x7f0000000140)={&(0x7f0000000100)=@RTM_GETMDB={0x18, 0x56, 0x2, 0x70bd25, 0x25dfdbfe, {0x7, r3}, [""]}, 0x18}}, 0x20000000)
sendmsg$nl_route(r2, &(0x7f0000000240)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000580)=ANY=[@ANYBLOB="4800000010000305ff810000fddbdf2500000000", @ANYRES32=r3, @ANYBLOB="1748000040000200280012800a000100767863616e0000001800028014000100000000", @ANYRES32=r3], 0x48}, 0x1, 0x0, 0x0, 0x40}, 0x0)
connect$inet(r1, &(0x7f0000000000)={0x2, 0x4e22, @empty}, 0x10)
setsockopt$sock_int(r1, 0x1, 0x9, &(0x7f00000003c0)=0x246, 0x4)
ioctl$FE_SET_PROPERTY(r0, 0x40106f52, &(0x7f00000000c0)={0x29, &(0x7f0000000200)=[{0x34, '\x00', @data=0x4}]})
syz_open_dev$dvb_frontend(&(0x7f0000000080), 0x0, 0x402) (async)
socket$inet_mptcp(0x2, 0x1, 0x106) (async)
socket(0x10, 0x803, 0x0) (async)
syz_genetlink_get_family_id$tipc(&(0x7f0000000000), r2) (async)
getsockname$packet(r2, &(0x7f0000000280)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) (async)
sendmsg$nl_route(r2, &(0x7f0000000180)={&(0x7f0000000040)={0x10, 0x0, 0x0, 0x400000}, 0xc, &(0x7f0000000140)={&(0x7f0000000100)=@RTM_GETMDB={0x18, 0x56, 0x2, 0x70bd25, 0x25dfdbfe, {0x7, r3}, [""]}, 0x18}}, 0x20000000) (async)
sendmsg$nl_route(r2, &(0x7f0000000240)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000580)=ANY=[@ANYBLOB="4800000010000305ff810000fddbdf2500000000", @ANYRES32=r3, @ANYBLOB="1748000040000200280012800a000100767863616e0000001800028014000100000000", @ANYRES32=r3], 0x48}, 0x1, 0x0, 0x0, 0x40}, 0x0) (async)
connect$inet(r1, &(0x7f0000000000)={0x2, 0x4e22, @empty}, 0x10) (async)
setsockopt$sock_int(r1, 0x1, 0x9, &(0x7f00000003c0)=0x246, 0x4) (async)
ioctl$FE_SET_PROPERTY(r0, 0x40106f52, &(0x7f00000000c0)={0x29, &(0x7f0000000200)=[{0x34, '\x00', @data=0x4}]}) (async)

program crashed: KASAN: slab-use-after-free Read in dvb_device_open
testing program (duration=45s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): [21, 36, 20]
detailed listing:
executing program 0:
socket$nl_netfilter(0x10, 0x3, 0xc)
r0 = socket$inet6_tcp(0xa, 0x1, 0x0)
connect$inet6(r0, 0x0, 0x0)
r1 = gettid()
timer_create(0x0, &(0x7f0000533fa0)={0x0, 0x21, 0x800000000004, @tid=r1}, &(0x7f0000000140))
timer_settime(0x0, 0x0, &(0x7f0000000280)={{0x0, 0x989680}, {0x0, 0x989680}}, 0x0)
mmap$IORING_OFF_SQ_RING(0x110c230000, 0x8000002, 0x2000007, 0x401d031, 0xffffffffffffffff, 0x0)
getsockopt$sock_cred(0xffffffffffffffff, 0x1, 0x11, 0x0, &(0x7f0000cab000))
setsockopt$sock_cred(0xffffffffffffffff, 0x1, 0x11, 0x0, 0x0)
setsockopt$inet6_tcp_TCP_REPAIR_QUEUE(r0, 0x6, 0x14, 0x0, 0x0)
mmap(&(0x7f0000000000/0x4000)=nil, 0x4000, 0x1, 0x10012, 0xffffffffffffffff, 0x5deba000)
mmap(&(0x7f0000bfe000/0x400000)=nil, 0x400000, 0x4, 0x40010, r0, 0xd1aa000)
mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x3, 0x8031, 0xffffffffffffffff, 0x0)
mmap$dsp(&(0x7f0000ffd000/0x2000)=nil, 0x2000, 0x100000b, 0x810, 0xffffffffffffffff, 0x0)
socket$xdp(0x2c, 0x3, 0x0)
r2 = socket$kcm(0xa, 0x2, 0x0)
r3 = socket(0x2, 0x80805, 0x0)
r4 = openat$fuse(0xffffffffffffff9c, &(0x7f0000000080), 0x2, 0x0)
read$FUSE(r4, &(0x7f0000000600)={0x2020}, 0x2020)
setsockopt$IP_VS_SO_SET_ADD(r3, 0x0, 0x482, &(0x7f0000000240)={0x84, @dev={0xac, 0x14, 0x14, 0x15}, 0x4e20, 0x3, 'wlc\x00', 0x2, 0x660f537e, 0x3}, 0x2c)
sendmsg$sock(r2, &(0x7f0000000400)={&(0x7f0000000580)=@in6={0x2, 0x4e20, 0x0, @dev={0xfe, 0x80, '\x00', 0xfd}}, 0x80, 0x0, 0x0, &(0x7f0000000000)=[@mark={{0x14, 0x1, 0x24, 0x3}}], 0x18}, 0x0)
executing program 3:
r0 = syz_usb_connect(0x0, 0x32, &(0x7f0000000000)=ANY=[@ANYBLOB="1201000200000040a61b01000100000000010902200001010080320904"], 0x0)
r1 = openat$ptp1(0xffffffffffffff9c, &(0x7f0000000c40), 0x149201, 0x0)
ioctl$PTP_ENABLE_PPS(r1, 0x40043d04, 0x1)
r2 = socket$kcm(0x10, 0x2, 0x4)
sendmsg$inet(r2, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)=[{&(0x7f0000000100)="5c00000012006bab9e3fe3d86e6c1d0000147ea60864160af36504b68675f8001d000a00a0e69ee517d34460bc24eab556a705251e6182949a36c23d3b48dfd8cdbf9367b4fa51f60a64c9f4080003680601000008000300ff000000", 0x5c}], 0x1, 0x0, 0x0, 0x1f00c00e}, 0x0)
r3 = syz_usb_connect$uac3(0x3, 0x80, &(0x7f0000000280)=ANY=[], 0x0)
syz_usb_control_io(r0, 0x0, 0x0)
syz_usb_control_io$sierra_net(r0, 0x0, &(0x7f0000000700)={0x1c, &(0x7f0000000280)=ANY=[], 0x0, 0x0})
syz_usb_control_io$uac3(r3, 0x0, 0x0)
syz_usb_control_io$printer(r0, 0x0, &(0x7f00000005c0)={0x34, &(0x7f00000003c0)=ANY=[], 0x0, 0x0, 0x0, 0x0, 0x0})
mkdirat(0xffffffffffffff9c, &(0x7f0000000200)='./file0\x00', 0x0)
r4 = openat(0xffffffffffffff9c, &(0x7f0000000080)='./file0\x00', 0x0, 0xd5)
ioctl$FS_IOC_GETFLAGS(r4, 0x80086601, &(0x7f0000000100))
syz_open_dev$dvb_frontend(&(0x7f0000000100), 0x1, 0x802)
r5 = socket$inet6_sctp(0xa, 0x801, 0x84)
getsockopt$bt_hci(r5, 0x84, 0x81, &(0x7f0000001280)=""/4107, &(0x7f00000000c0)=0x100b)
r6 = socket$rxrpc(0x21, 0x2, 0x2)
setsockopt$RXRPC_MIN_SECURITY_LEVEL(r6, 0x110, 0x4, &(0x7f0000000440)=0x1, 0x4)
syz_usb_connect(0x0, 0x32, &(0x7f0000000000)=ANY=[@ANYBLOB="1201000200000040a61b01000100000000010902200001010080320904"], 0x0) (async)
openat$ptp1(0xffffffffffffff9c, &(0x7f0000000c40), 0x149201, 0x0) (async)
ioctl$PTP_ENABLE_PPS(r1, 0x40043d04, 0x1) (async)
socket$kcm(0x10, 0x2, 0x4) (async)
sendmsg$inet(r2, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)=[{&(0x7f0000000100)="5c00000012006bab9e3fe3d86e6c1d0000147ea60864160af36504b68675f8001d000a00a0e69ee517d34460bc24eab556a705251e6182949a36c23d3b48dfd8cdbf9367b4fa51f60a64c9f4080003680601000008000300ff000000", 0x5c}], 0x1, 0x0, 0x0, 0x1f00c00e}, 0x0) (async)
syz_usb_connect$uac3(0x3, 0x80, &(0x7f0000000280)=ANY=[], 0x0) (async)
syz_usb_control_io(r0, 0x0, 0x0) (async)
syz_usb_control_io$sierra_net(r0, 0x0, &(0x7f0000000700)={0x1c, &(0x7f0000000280)=ANY=[], 0x0, 0x0}) (async)
syz_usb_control_io$uac3(r3, 0x0, 0x0) (async)
syz_usb_control_io$printer(r0, 0x0, &(0x7f00000005c0)={0x34, &(0x7f00000003c0)=ANY=[], 0x0, 0x0, 0x0, 0x0, 0x0}) (async)
mkdirat(0xffffffffffffff9c, &(0x7f0000000200)='./file0\x00', 0x0) (async)
openat(0xffffffffffffff9c, &(0x7f0000000080)='./file0\x00', 0x0, 0xd5) (async)
ioctl$FS_IOC_GETFLAGS(r4, 0x80086601, &(0x7f0000000100)) (async)
syz_open_dev$dvb_frontend(&(0x7f0000000100), 0x1, 0x802) (async)
socket$inet6_sctp(0xa, 0x801, 0x84) (async)
getsockopt$bt_hci(r5, 0x84, 0x81, &(0x7f0000001280)=""/4107, &(0x7f00000000c0)=0x100b) (async)
socket$rxrpc(0x21, 0x2, 0x2) (async)
setsockopt$RXRPC_MIN_SECURITY_LEVEL(r6, 0x110, 0x4, &(0x7f0000000440)=0x1, 0x4) (async)
executing program 4:
r0 = syz_open_dev$dvb_frontend(&(0x7f0000000080), 0x0, 0x402)
r1 = socket$inet_mptcp(0x2, 0x1, 0x106)
r2 = socket(0x10, 0x803, 0x0)
syz_genetlink_get_family_id$tipc(&(0x7f0000000000), r2)
getsockname$packet(r2, &(0x7f0000000280)={0x11, 0x0, <r3=>0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14)
sendmsg$nl_route(r2, &(0x7f0000000180)={&(0x7f0000000040)={0x10, 0x0, 0x0, 0x400000}, 0xc, &(0x7f0000000140)={&(0x7f0000000100)=@RTM_GETMDB={0x18, 0x56, 0x2, 0x70bd25, 0x25dfdbfe, {0x7, r3}, [""]}, 0x18}}, 0x20000000)
sendmsg$nl_route(r2, &(0x7f0000000240)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000580)=ANY=[@ANYBLOB="4800000010000305ff810000fddbdf2500000000", @ANYRES32=r3, @ANYBLOB="1748000040000200280012800a000100767863616e0000001800028014000100000000", @ANYRES32=r3], 0x48}, 0x1, 0x0, 0x0, 0x40}, 0x0)
connect$inet(r1, &(0x7f0000000000)={0x2, 0x4e22, @empty}, 0x10)
setsockopt$sock_int(r1, 0x1, 0x9, &(0x7f00000003c0)=0x246, 0x4)
ioctl$FE_SET_PROPERTY(r0, 0x40106f52, &(0x7f00000000c0)={0x29, &(0x7f0000000200)=[{0x34, '\x00', @data=0x4}]})
syz_open_dev$dvb_frontend(&(0x7f0000000080), 0x0, 0x402) (async)
socket$inet_mptcp(0x2, 0x1, 0x106) (async)
socket(0x10, 0x803, 0x0) (async)
syz_genetlink_get_family_id$tipc(&(0x7f0000000000), r2) (async)
getsockname$packet(r2, &(0x7f0000000280)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) (async)
sendmsg$nl_route(r2, &(0x7f0000000180)={&(0x7f0000000040)={0x10, 0x0, 0x0, 0x400000}, 0xc, &(0x7f0000000140)={&(0x7f0000000100)=@RTM_GETMDB={0x18, 0x56, 0x2, 0x70bd25, 0x25dfdbfe, {0x7, r3}, [""]}, 0x18}}, 0x20000000) (async)
sendmsg$nl_route(r2, &(0x7f0000000240)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000580)=ANY=[@ANYBLOB="4800000010000305ff810000fddbdf2500000000", @ANYRES32=r3, @ANYBLOB="1748000040000200280012800a000100767863616e0000001800028014000100000000", @ANYRES32=r3], 0x48}, 0x1, 0x0, 0x0, 0x40}, 0x0) (async)
connect$inet(r1, &(0x7f0000000000)={0x2, 0x4e22, @empty}, 0x10) (async)
setsockopt$sock_int(r1, 0x1, 0x9, &(0x7f00000003c0)=0x246, 0x4) (async)
ioctl$FE_SET_PROPERTY(r0, 0x40106f52, &(0x7f00000000c0)={0x29, &(0x7f0000000200)=[{0x34, '\x00', @data=0x4}]}) (async)

program did not crash
testing program (duration=45s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): [21, 36, 20]
detailed listing:
executing program 0:
socket$nl_netfilter(0x10, 0x3, 0xc)
r0 = socket$inet6_tcp(0xa, 0x1, 0x0)
connect$inet6(r0, 0x0, 0x0)
r1 = gettid()
timer_create(0x0, &(0x7f0000533fa0)={0x0, 0x21, 0x800000000004, @tid=r1}, &(0x7f0000000140))
timer_settime(0x0, 0x0, &(0x7f0000000280)={{0x0, 0x989680}, {0x0, 0x989680}}, 0x0)
socketpair$unix(0x1, 0x0, 0x0, 0x0)
getsockopt$sock_cred(0xffffffffffffffff, 0x1, 0x11, 0x0, &(0x7f0000cab000))
setsockopt$sock_cred(0xffffffffffffffff, 0x1, 0x11, 0x0, 0x0)
setsockopt$inet6_tcp_TCP_REPAIR_QUEUE(r0, 0x6, 0x14, 0x0, 0x0)
mmap(&(0x7f0000000000/0x4000)=nil, 0x4000, 0x1, 0x10012, 0xffffffffffffffff, 0x5deba000)
mmap(&(0x7f0000bfe000/0x400000)=nil, 0x400000, 0x4, 0x40010, r0, 0xd1aa000)
mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x3, 0x8031, 0xffffffffffffffff, 0x0)
mmap$dsp(&(0x7f0000ffd000/0x2000)=nil, 0x2000, 0x100000b, 0x810, 0xffffffffffffffff, 0x0)
socket$xdp(0x2c, 0x3, 0x0)
r2 = socket$kcm(0xa, 0x2, 0x0)
r3 = socket(0x2, 0x80805, 0x0)
r4 = openat$fuse(0xffffffffffffff9c, &(0x7f0000000080), 0x2, 0x0)
read$FUSE(r4, &(0x7f0000000600)={0x2020}, 0x2020)
setsockopt$IP_VS_SO_SET_ADD(r3, 0x0, 0x482, &(0x7f0000000240)={0x84, @dev={0xac, 0x14, 0x14, 0x15}, 0x4e20, 0x3, 'wlc\x00', 0x2, 0x660f537e, 0x3}, 0x2c)
sendmsg$sock(r2, &(0x7f0000000400)={&(0x7f0000000580)=@in6={0x2, 0x4e20, 0x0, @dev={0xfe, 0x80, '\x00', 0xfd}}, 0x80, 0x0, 0x0, &(0x7f0000000000)=[@mark={{0x14, 0x1, 0x24, 0x3}}], 0x18}, 0x0)
executing program 3:
r0 = syz_usb_connect(0x0, 0x32, &(0x7f0000000000)=ANY=[@ANYBLOB="1201000200000040a61b01000100000000010902200001010080320904"], 0x0)
r1 = openat$ptp1(0xffffffffffffff9c, &(0x7f0000000c40), 0x149201, 0x0)
ioctl$PTP_ENABLE_PPS(r1, 0x40043d04, 0x1)
r2 = socket$kcm(0x10, 0x2, 0x4)
sendmsg$inet(r2, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)=[{&(0x7f0000000100)="5c00000012006bab9e3fe3d86e6c1d0000147ea60864160af36504b68675f8001d000a00a0e69ee517d34460bc24eab556a705251e6182949a36c23d3b48dfd8cdbf9367b4fa51f60a64c9f4080003680601000008000300ff000000", 0x5c}], 0x1, 0x0, 0x0, 0x1f00c00e}, 0x0)
r3 = syz_usb_connect$uac3(0x3, 0x80, &(0x7f0000000280)=ANY=[], 0x0)
syz_usb_control_io(r0, 0x0, 0x0)
syz_usb_control_io$sierra_net(r0, 0x0, &(0x7f0000000700)={0x1c, &(0x7f0000000280)=ANY=[], 0x0, 0x0})
syz_usb_control_io$uac3(r3, 0x0, 0x0)
syz_usb_control_io$printer(r0, 0x0, &(0x7f00000005c0)={0x34, &(0x7f00000003c0)=ANY=[], 0x0, 0x0, 0x0, 0x0, 0x0})
mkdirat(0xffffffffffffff9c, &(0x7f0000000200)='./file0\x00', 0x0)
r4 = openat(0xffffffffffffff9c, &(0x7f0000000080)='./file0\x00', 0x0, 0xd5)
ioctl$FS_IOC_GETFLAGS(r4, 0x80086601, &(0x7f0000000100))
syz_open_dev$dvb_frontend(&(0x7f0000000100), 0x1, 0x802)
r5 = socket$inet6_sctp(0xa, 0x801, 0x84)
getsockopt$bt_hci(r5, 0x84, 0x81, &(0x7f0000001280)=""/4107, &(0x7f00000000c0)=0x100b)
r6 = socket$rxrpc(0x21, 0x2, 0x2)
setsockopt$RXRPC_MIN_SECURITY_LEVEL(r6, 0x110, 0x4, &(0x7f0000000440)=0x1, 0x4)
syz_usb_connect(0x0, 0x32, &(0x7f0000000000)=ANY=[@ANYBLOB="1201000200000040a61b01000100000000010902200001010080320904"], 0x0) (async)
openat$ptp1(0xffffffffffffff9c, &(0x7f0000000c40), 0x149201, 0x0) (async)
ioctl$PTP_ENABLE_PPS(r1, 0x40043d04, 0x1) (async)
socket$kcm(0x10, 0x2, 0x4) (async)
sendmsg$inet(r2, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)=[{&(0x7f0000000100)="5c00000012006bab9e3fe3d86e6c1d0000147ea60864160af36504b68675f8001d000a00a0e69ee517d34460bc24eab556a705251e6182949a36c23d3b48dfd8cdbf9367b4fa51f60a64c9f4080003680601000008000300ff000000", 0x5c}], 0x1, 0x0, 0x0, 0x1f00c00e}, 0x0) (async)
syz_usb_connect$uac3(0x3, 0x80, &(0x7f0000000280)=ANY=[], 0x0) (async)
syz_usb_control_io(r0, 0x0, 0x0) (async)
syz_usb_control_io$sierra_net(r0, 0x0, &(0x7f0000000700)={0x1c, &(0x7f0000000280)=ANY=[], 0x0, 0x0}) (async)
syz_usb_control_io$uac3(r3, 0x0, 0x0) (async)
syz_usb_control_io$printer(r0, 0x0, &(0x7f00000005c0)={0x34, &(0x7f00000003c0)=ANY=[], 0x0, 0x0, 0x0, 0x0, 0x0}) (async)
mkdirat(0xffffffffffffff9c, &(0x7f0000000200)='./file0\x00', 0x0) (async)
openat(0xffffffffffffff9c, &(0x7f0000000080)='./file0\x00', 0x0, 0xd5) (async)
ioctl$FS_IOC_GETFLAGS(r4, 0x80086601, &(0x7f0000000100)) (async)
syz_open_dev$dvb_frontend(&(0x7f0000000100), 0x1, 0x802) (async)
socket$inet6_sctp(0xa, 0x801, 0x84) (async)
getsockopt$bt_hci(r5, 0x84, 0x81, &(0x7f0000001280)=""/4107, &(0x7f00000000c0)=0x100b) (async)
socket$rxrpc(0x21, 0x2, 0x2) (async)
setsockopt$RXRPC_MIN_SECURITY_LEVEL(r6, 0x110, 0x4, &(0x7f0000000440)=0x1, 0x4) (async)
executing program 4:
r0 = syz_open_dev$dvb_frontend(&(0x7f0000000080), 0x0, 0x402)
r1 = socket$inet_mptcp(0x2, 0x1, 0x106)
r2 = socket(0x10, 0x803, 0x0)
syz_genetlink_get_family_id$tipc(&(0x7f0000000000), r2)
getsockname$packet(r2, &(0x7f0000000280)={0x11, 0x0, <r3=>0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14)
sendmsg$nl_route(r2, &(0x7f0000000180)={&(0x7f0000000040)={0x10, 0x0, 0x0, 0x400000}, 0xc, &(0x7f0000000140)={&(0x7f0000000100)=@RTM_GETMDB={0x18, 0x56, 0x2, 0x70bd25, 0x25dfdbfe, {0x7, r3}, [""]}, 0x18}}, 0x20000000)
sendmsg$nl_route(r2, &(0x7f0000000240)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000580)=ANY=[@ANYBLOB="4800000010000305ff810000fddbdf2500000000", @ANYRES32=r3, @ANYBLOB="1748000040000200280012800a000100767863616e0000001800028014000100000000", @ANYRES32=r3], 0x48}, 0x1, 0x0, 0x0, 0x40}, 0x0)
connect$inet(r1, &(0x7f0000000000)={0x2, 0x4e22, @empty}, 0x10)
setsockopt$sock_int(r1, 0x1, 0x9, &(0x7f00000003c0)=0x246, 0x4)
ioctl$FE_SET_PROPERTY(r0, 0x40106f52, &(0x7f00000000c0)={0x29, &(0x7f0000000200)=[{0x34, '\x00', @data=0x4}]})
syz_open_dev$dvb_frontend(&(0x7f0000000080), 0x0, 0x402) (async)
socket$inet_mptcp(0x2, 0x1, 0x106) (async)
socket(0x10, 0x803, 0x0) (async)
syz_genetlink_get_family_id$tipc(&(0x7f0000000000), r2) (async)
getsockname$packet(r2, &(0x7f0000000280)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) (async)
sendmsg$nl_route(r2, &(0x7f0000000180)={&(0x7f0000000040)={0x10, 0x0, 0x0, 0x400000}, 0xc, &(0x7f0000000140)={&(0x7f0000000100)=@RTM_GETMDB={0x18, 0x56, 0x2, 0x70bd25, 0x25dfdbfe, {0x7, r3}, [""]}, 0x18}}, 0x20000000) (async)
sendmsg$nl_route(r2, &(0x7f0000000240)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000580)=ANY=[@ANYBLOB="4800000010000305ff810000fddbdf2500000000", @ANYRES32=r3, @ANYBLOB="1748000040000200280012800a000100767863616e0000001800028014000100000000", @ANYRES32=r3], 0x48}, 0x1, 0x0, 0x0, 0x40}, 0x0) (async)
connect$inet(r1, &(0x7f0000000000)={0x2, 0x4e22, @empty}, 0x10) (async)
setsockopt$sock_int(r1, 0x1, 0x9, &(0x7f00000003c0)=0x246, 0x4) (async)
ioctl$FE_SET_PROPERTY(r0, 0x40106f52, &(0x7f00000000c0)={0x29, &(0x7f0000000200)=[{0x34, '\x00', @data=0x4}]}) (async)

program crashed: KASAN: slab-use-after-free Read in dvb_device_open
testing program (duration=45s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): [20, 36, 20]
detailed listing:
executing program 0:
socket$nl_netfilter(0x10, 0x3, 0xc)
r0 = socket$inet6_tcp(0xa, 0x1, 0x0)
connect$inet6(r0, 0x0, 0x0)
r1 = gettid()
timer_create(0x0, &(0x7f0000533fa0)={0x0, 0x21, 0x800000000004, @tid=r1}, &(0x7f0000000140))
socketpair$unix(0x1, 0x0, 0x0, 0x0)
getsockopt$sock_cred(0xffffffffffffffff, 0x1, 0x11, 0x0, &(0x7f0000cab000))
setsockopt$sock_cred(0xffffffffffffffff, 0x1, 0x11, 0x0, 0x0)
setsockopt$inet6_tcp_TCP_REPAIR_QUEUE(r0, 0x6, 0x14, 0x0, 0x0)
mmap(&(0x7f0000000000/0x4000)=nil, 0x4000, 0x1, 0x10012, 0xffffffffffffffff, 0x5deba000)
mmap(&(0x7f0000bfe000/0x400000)=nil, 0x400000, 0x4, 0x40010, r0, 0xd1aa000)
mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x3, 0x8031, 0xffffffffffffffff, 0x0)
mmap$dsp(&(0x7f0000ffd000/0x2000)=nil, 0x2000, 0x100000b, 0x810, 0xffffffffffffffff, 0x0)
socket$xdp(0x2c, 0x3, 0x0)
r2 = socket$kcm(0xa, 0x2, 0x0)
r3 = socket(0x2, 0x80805, 0x0)
r4 = openat$fuse(0xffffffffffffff9c, &(0x7f0000000080), 0x2, 0x0)
read$FUSE(r4, &(0x7f0000000600)={0x2020}, 0x2020)
setsockopt$IP_VS_SO_SET_ADD(r3, 0x0, 0x482, &(0x7f0000000240)={0x84, @dev={0xac, 0x14, 0x14, 0x15}, 0x4e20, 0x3, 'wlc\x00', 0x2, 0x660f537e, 0x3}, 0x2c)
sendmsg$sock(r2, &(0x7f0000000400)={&(0x7f0000000580)=@in6={0x2, 0x4e20, 0x0, @dev={0xfe, 0x80, '\x00', 0xfd}}, 0x80, 0x0, 0x0, &(0x7f0000000000)=[@mark={{0x14, 0x1, 0x24, 0x3}}], 0x18}, 0x0)
executing program 3:
r0 = syz_usb_connect(0x0, 0x32, &(0x7f0000000000)=ANY=[@ANYBLOB="1201000200000040a61b01000100000000010902200001010080320904"], 0x0)
r1 = openat$ptp1(0xffffffffffffff9c, &(0x7f0000000c40), 0x149201, 0x0)
ioctl$PTP_ENABLE_PPS(r1, 0x40043d04, 0x1)
r2 = socket$kcm(0x10, 0x2, 0x4)
sendmsg$inet(r2, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)=[{&(0x7f0000000100)="5c00000012006bab9e3fe3d86e6c1d0000147ea60864160af36504b68675f8001d000a00a0e69ee517d34460bc24eab556a705251e6182949a36c23d3b48dfd8cdbf9367b4fa51f60a64c9f4080003680601000008000300ff000000", 0x5c}], 0x1, 0x0, 0x0, 0x1f00c00e}, 0x0)
r3 = syz_usb_connect$uac3(0x3, 0x80, &(0x7f0000000280)=ANY=[], 0x0)
syz_usb_control_io(r0, 0x0, 0x0)
syz_usb_control_io$sierra_net(r0, 0x0, &(0x7f0000000700)={0x1c, &(0x7f0000000280)=ANY=[], 0x0, 0x0})
syz_usb_control_io$uac3(r3, 0x0, 0x0)
syz_usb_control_io$printer(r0, 0x0, &(0x7f00000005c0)={0x34, &(0x7f00000003c0)=ANY=[], 0x0, 0x0, 0x0, 0x0, 0x0})
mkdirat(0xffffffffffffff9c, &(0x7f0000000200)='./file0\x00', 0x0)
r4 = openat(0xffffffffffffff9c, &(0x7f0000000080)='./file0\x00', 0x0, 0xd5)
ioctl$FS_IOC_GETFLAGS(r4, 0x80086601, &(0x7f0000000100))
syz_open_dev$dvb_frontend(&(0x7f0000000100), 0x1, 0x802)
r5 = socket$inet6_sctp(0xa, 0x801, 0x84)
getsockopt$bt_hci(r5, 0x84, 0x81, &(0x7f0000001280)=""/4107, &(0x7f00000000c0)=0x100b)
r6 = socket$rxrpc(0x21, 0x2, 0x2)
setsockopt$RXRPC_MIN_SECURITY_LEVEL(r6, 0x110, 0x4, &(0x7f0000000440)=0x1, 0x4)
syz_usb_connect(0x0, 0x32, &(0x7f0000000000)=ANY=[@ANYBLOB="1201000200000040a61b01000100000000010902200001010080320904"], 0x0) (async)
openat$ptp1(0xffffffffffffff9c, &(0x7f0000000c40), 0x149201, 0x0) (async)
ioctl$PTP_ENABLE_PPS(r1, 0x40043d04, 0x1) (async)
socket$kcm(0x10, 0x2, 0x4) (async)
sendmsg$inet(r2, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)=[{&(0x7f0000000100)="5c00000012006bab9e3fe3d86e6c1d0000147ea60864160af36504b68675f8001d000a00a0e69ee517d34460bc24eab556a705251e6182949a36c23d3b48dfd8cdbf9367b4fa51f60a64c9f4080003680601000008000300ff000000", 0x5c}], 0x1, 0x0, 0x0, 0x1f00c00e}, 0x0) (async)
syz_usb_connect$uac3(0x3, 0x80, &(0x7f0000000280)=ANY=[], 0x0) (async)
syz_usb_control_io(r0, 0x0, 0x0) (async)
syz_usb_control_io$sierra_net(r0, 0x0, &(0x7f0000000700)={0x1c, &(0x7f0000000280)=ANY=[], 0x0, 0x0}) (async)
syz_usb_control_io$uac3(r3, 0x0, 0x0) (async)
syz_usb_control_io$printer(r0, 0x0, &(0x7f00000005c0)={0x34, &(0x7f00000003c0)=ANY=[], 0x0, 0x0, 0x0, 0x0, 0x0}) (async)
mkdirat(0xffffffffffffff9c, &(0x7f0000000200)='./file0\x00', 0x0) (async)
openat(0xffffffffffffff9c, &(0x7f0000000080)='./file0\x00', 0x0, 0xd5) (async)
ioctl$FS_IOC_GETFLAGS(r4, 0x80086601, &(0x7f0000000100)) (async)
syz_open_dev$dvb_frontend(&(0x7f0000000100), 0x1, 0x802) (async)
socket$inet6_sctp(0xa, 0x801, 0x84) (async)
getsockopt$bt_hci(r5, 0x84, 0x81, &(0x7f0000001280)=""/4107, &(0x7f00000000c0)=0x100b) (async)
socket$rxrpc(0x21, 0x2, 0x2) (async)
setsockopt$RXRPC_MIN_SECURITY_LEVEL(r6, 0x110, 0x4, &(0x7f0000000440)=0x1, 0x4) (async)
executing program 4:
r0 = syz_open_dev$dvb_frontend(&(0x7f0000000080), 0x0, 0x402)
r1 = socket$inet_mptcp(0x2, 0x1, 0x106)
r2 = socket(0x10, 0x803, 0x0)
syz_genetlink_get_family_id$tipc(&(0x7f0000000000), r2)
getsockname$packet(r2, &(0x7f0000000280)={0x11, 0x0, <r3=>0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14)
sendmsg$nl_route(r2, &(0x7f0000000180)={&(0x7f0000000040)={0x10, 0x0, 0x0, 0x400000}, 0xc, &(0x7f0000000140)={&(0x7f0000000100)=@RTM_GETMDB={0x18, 0x56, 0x2, 0x70bd25, 0x25dfdbfe, {0x7, r3}, [""]}, 0x18}}, 0x20000000)
sendmsg$nl_route(r2, &(0x7f0000000240)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000580)=ANY=[@ANYBLOB="4800000010000305ff810000fddbdf2500000000", @ANYRES32=r3, @ANYBLOB="1748000040000200280012800a000100767863616e0000001800028014000100000000", @ANYRES32=r3], 0x48}, 0x1, 0x0, 0x0, 0x40}, 0x0)
connect$inet(r1, &(0x7f0000000000)={0x2, 0x4e22, @empty}, 0x10)
setsockopt$sock_int(r1, 0x1, 0x9, &(0x7f00000003c0)=0x246, 0x4)
ioctl$FE_SET_PROPERTY(r0, 0x40106f52, &(0x7f00000000c0)={0x29, &(0x7f0000000200)=[{0x34, '\x00', @data=0x4}]})
syz_open_dev$dvb_frontend(&(0x7f0000000080), 0x0, 0x402) (async)
socket$inet_mptcp(0x2, 0x1, 0x106) (async)
socket(0x10, 0x803, 0x0) (async)
syz_genetlink_get_family_id$tipc(&(0x7f0000000000), r2) (async)
getsockname$packet(r2, &(0x7f0000000280)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) (async)
sendmsg$nl_route(r2, &(0x7f0000000180)={&(0x7f0000000040)={0x10, 0x0, 0x0, 0x400000}, 0xc, &(0x7f0000000140)={&(0x7f0000000100)=@RTM_GETMDB={0x18, 0x56, 0x2, 0x70bd25, 0x25dfdbfe, {0x7, r3}, [""]}, 0x18}}, 0x20000000) (async)
sendmsg$nl_route(r2, &(0x7f0000000240)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000580)=ANY=[@ANYBLOB="4800000010000305ff810000fddbdf2500000000", @ANYRES32=r3, @ANYBLOB="1748000040000200280012800a000100767863616e0000001800028014000100000000", @ANYRES32=r3], 0x48}, 0x1, 0x0, 0x0, 0x40}, 0x0) (async)
connect$inet(r1, &(0x7f0000000000)={0x2, 0x4e22, @empty}, 0x10) (async)
setsockopt$sock_int(r1, 0x1, 0x9, &(0x7f00000003c0)=0x246, 0x4) (async)
ioctl$FE_SET_PROPERTY(r0, 0x40106f52, &(0x7f00000000c0)={0x29, &(0x7f0000000200)=[{0x34, '\x00', @data=0x4}]}) (async)

program did not crash
testing program (duration=45s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): [20, 36, 20]
detailed listing:
executing program 0:
socket$nl_netfilter(0x10, 0x3, 0xc)
r0 = socket$inet6_tcp(0xa, 0x1, 0x0)
connect$inet6(r0, 0x0, 0x0)
gettid()
timer_settime(0x0, 0x0, &(0x7f0000000280)={{0x0, 0x989680}, {0x0, 0x989680}}, 0x0)
socketpair$unix(0x1, 0x0, 0x0, 0x0)
getsockopt$sock_cred(0xffffffffffffffff, 0x1, 0x11, 0x0, &(0x7f0000cab000))
setsockopt$sock_cred(0xffffffffffffffff, 0x1, 0x11, 0x0, 0x0)
setsockopt$inet6_tcp_TCP_REPAIR_QUEUE(r0, 0x6, 0x14, 0x0, 0x0)
mmap(&(0x7f0000000000/0x4000)=nil, 0x4000, 0x1, 0x10012, 0xffffffffffffffff, 0x5deba000)
mmap(&(0x7f0000bfe000/0x400000)=nil, 0x400000, 0x4, 0x40010, r0, 0xd1aa000)
mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x3, 0x8031, 0xffffffffffffffff, 0x0)
mmap$dsp(&(0x7f0000ffd000/0x2000)=nil, 0x2000, 0x100000b, 0x810, 0xffffffffffffffff, 0x0)
socket$xdp(0x2c, 0x3, 0x0)
r1 = socket$kcm(0xa, 0x2, 0x0)
r2 = socket(0x2, 0x80805, 0x0)
r3 = openat$fuse(0xffffffffffffff9c, &(0x7f0000000080), 0x2, 0x0)
read$FUSE(r3, &(0x7f0000000600)={0x2020}, 0x2020)
setsockopt$IP_VS_SO_SET_ADD(r2, 0x0, 0x482, &(0x7f0000000240)={0x84, @dev={0xac, 0x14, 0x14, 0x15}, 0x4e20, 0x3, 'wlc\x00', 0x2, 0x660f537e, 0x3}, 0x2c)
sendmsg$sock(r1, &(0x7f0000000400)={&(0x7f0000000580)=@in6={0x2, 0x4e20, 0x0, @dev={0xfe, 0x80, '\x00', 0xfd}}, 0x80, 0x0, 0x0, &(0x7f0000000000)=[@mark={{0x14, 0x1, 0x24, 0x3}}], 0x18}, 0x0)
executing program 3:
r0 = syz_usb_connect(0x0, 0x32, &(0x7f0000000000)=ANY=[@ANYBLOB="1201000200000040a61b01000100000000010902200001010080320904"], 0x0)
r1 = openat$ptp1(0xffffffffffffff9c, &(0x7f0000000c40), 0x149201, 0x0)
ioctl$PTP_ENABLE_PPS(r1, 0x40043d04, 0x1)
r2 = socket$kcm(0x10, 0x2, 0x4)
sendmsg$inet(r2, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)=[{&(0x7f0000000100)="5c00000012006bab9e3fe3d86e6c1d0000147ea60864160af36504b68675f8001d000a00a0e69ee517d34460bc24eab556a705251e6182949a36c23d3b48dfd8cdbf9367b4fa51f60a64c9f4080003680601000008000300ff000000", 0x5c}], 0x1, 0x0, 0x0, 0x1f00c00e}, 0x0)
r3 = syz_usb_connect$uac3(0x3, 0x80, &(0x7f0000000280)=ANY=[], 0x0)
syz_usb_control_io(r0, 0x0, 0x0)
syz_usb_control_io$sierra_net(r0, 0x0, &(0x7f0000000700)={0x1c, &(0x7f0000000280)=ANY=[], 0x0, 0x0})
syz_usb_control_io$uac3(r3, 0x0, 0x0)
syz_usb_control_io$printer(r0, 0x0, &(0x7f00000005c0)={0x34, &(0x7f00000003c0)=ANY=[], 0x0, 0x0, 0x0, 0x0, 0x0})
mkdirat(0xffffffffffffff9c, &(0x7f0000000200)='./file0\x00', 0x0)
r4 = openat(0xffffffffffffff9c, &(0x7f0000000080)='./file0\x00', 0x0, 0xd5)
ioctl$FS_IOC_GETFLAGS(r4, 0x80086601, &(0x7f0000000100))
syz_open_dev$dvb_frontend(&(0x7f0000000100), 0x1, 0x802)
r5 = socket$inet6_sctp(0xa, 0x801, 0x84)
getsockopt$bt_hci(r5, 0x84, 0x81, &(0x7f0000001280)=""/4107, &(0x7f00000000c0)=0x100b)
r6 = socket$rxrpc(0x21, 0x2, 0x2)
setsockopt$RXRPC_MIN_SECURITY_LEVEL(r6, 0x110, 0x4, &(0x7f0000000440)=0x1, 0x4)
syz_usb_connect(0x0, 0x32, &(0x7f0000000000)=ANY=[@ANYBLOB="1201000200000040a61b01000100000000010902200001010080320904"], 0x0) (async)
openat$ptp1(0xffffffffffffff9c, &(0x7f0000000c40), 0x149201, 0x0) (async)
ioctl$PTP_ENABLE_PPS(r1, 0x40043d04, 0x1) (async)
socket$kcm(0x10, 0x2, 0x4) (async)
sendmsg$inet(r2, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)=[{&(0x7f0000000100)="5c00000012006bab9e3fe3d86e6c1d0000147ea60864160af36504b68675f8001d000a00a0e69ee517d34460bc24eab556a705251e6182949a36c23d3b48dfd8cdbf9367b4fa51f60a64c9f4080003680601000008000300ff000000", 0x5c}], 0x1, 0x0, 0x0, 0x1f00c00e}, 0x0) (async)
syz_usb_connect$uac3(0x3, 0x80, &(0x7f0000000280)=ANY=[], 0x0) (async)
syz_usb_control_io(r0, 0x0, 0x0) (async)
syz_usb_control_io$sierra_net(r0, 0x0, &(0x7f0000000700)={0x1c, &(0x7f0000000280)=ANY=[], 0x0, 0x0}) (async)
syz_usb_control_io$uac3(r3, 0x0, 0x0) (async)
syz_usb_control_io$printer(r0, 0x0, &(0x7f00000005c0)={0x34, &(0x7f00000003c0)=ANY=[], 0x0, 0x0, 0x0, 0x0, 0x0}) (async)
mkdirat(0xffffffffffffff9c, &(0x7f0000000200)='./file0\x00', 0x0) (async)
openat(0xffffffffffffff9c, &(0x7f0000000080)='./file0\x00', 0x0, 0xd5) (async)
ioctl$FS_IOC_GETFLAGS(r4, 0x80086601, &(0x7f0000000100)) (async)
syz_open_dev$dvb_frontend(&(0x7f0000000100), 0x1, 0x802) (async)
socket$inet6_sctp(0xa, 0x801, 0x84) (async)
getsockopt$bt_hci(r5, 0x84, 0x81, &(0x7f0000001280)=""/4107, &(0x7f00000000c0)=0x100b) (async)
socket$rxrpc(0x21, 0x2, 0x2) (async)
setsockopt$RXRPC_MIN_SECURITY_LEVEL(r6, 0x110, 0x4, &(0x7f0000000440)=0x1, 0x4) (async)
executing program 4:
r0 = syz_open_dev$dvb_frontend(&(0x7f0000000080), 0x0, 0x402)
r1 = socket$inet_mptcp(0x2, 0x1, 0x106)
r2 = socket(0x10, 0x803, 0x0)
syz_genetlink_get_family_id$tipc(&(0x7f0000000000), r2)
getsockname$packet(r2, &(0x7f0000000280)={0x11, 0x0, <r3=>0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14)
sendmsg$nl_route(r2, &(0x7f0000000180)={&(0x7f0000000040)={0x10, 0x0, 0x0, 0x400000}, 0xc, &(0x7f0000000140)={&(0x7f0000000100)=@RTM_GETMDB={0x18, 0x56, 0x2, 0x70bd25, 0x25dfdbfe, {0x7, r3}, [""]}, 0x18}}, 0x20000000)
sendmsg$nl_route(r2, &(0x7f0000000240)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000580)=ANY=[@ANYBLOB="4800000010000305ff810000fddbdf2500000000", @ANYRES32=r3, @ANYBLOB="1748000040000200280012800a000100767863616e0000001800028014000100000000", @ANYRES32=r3], 0x48}, 0x1, 0x0, 0x0, 0x40}, 0x0)
connect$inet(r1, &(0x7f0000000000)={0x2, 0x4e22, @empty}, 0x10)
setsockopt$sock_int(r1, 0x1, 0x9, &(0x7f00000003c0)=0x246, 0x4)
ioctl$FE_SET_PROPERTY(r0, 0x40106f52, &(0x7f00000000c0)={0x29, &(0x7f0000000200)=[{0x34, '\x00', @data=0x4}]})
syz_open_dev$dvb_frontend(&(0x7f0000000080), 0x0, 0x402) (async)
socket$inet_mptcp(0x2, 0x1, 0x106) (async)
socket(0x10, 0x803, 0x0) (async)
syz_genetlink_get_family_id$tipc(&(0x7f0000000000), r2) (async)
getsockname$packet(r2, &(0x7f0000000280)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) (async)
sendmsg$nl_route(r2, &(0x7f0000000180)={&(0x7f0000000040)={0x10, 0x0, 0x0, 0x400000}, 0xc, &(0x7f0000000140)={&(0x7f0000000100)=@RTM_GETMDB={0x18, 0x56, 0x2, 0x70bd25, 0x25dfdbfe, {0x7, r3}, [""]}, 0x18}}, 0x20000000) (async)
sendmsg$nl_route(r2, &(0x7f0000000240)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000580)=ANY=[@ANYBLOB="4800000010000305ff810000fddbdf2500000000", @ANYRES32=r3, @ANYBLOB="1748000040000200280012800a000100767863616e0000001800028014000100000000", @ANYRES32=r3], 0x48}, 0x1, 0x0, 0x0, 0x40}, 0x0) (async)
connect$inet(r1, &(0x7f0000000000)={0x2, 0x4e22, @empty}, 0x10) (async)
setsockopt$sock_int(r1, 0x1, 0x9, &(0x7f00000003c0)=0x246, 0x4) (async)
ioctl$FE_SET_PROPERTY(r0, 0x40106f52, &(0x7f00000000c0)={0x29, &(0x7f0000000200)=[{0x34, '\x00', @data=0x4}]}) (async)

program crashed: KASAN: slab-use-after-free Read in dvb_device_open
testing program (duration=45s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): [19, 36, 20]
detailed listing:
executing program 0:
socket$nl_netfilter(0x10, 0x3, 0xc)
r0 = socket$inet6_tcp(0xa, 0x1, 0x0)
connect$inet6(r0, 0x0, 0x0)
timer_settime(0x0, 0x0, &(0x7f0000000280)={{0x0, 0x989680}, {0x0, 0x989680}}, 0x0)
socketpair$unix(0x1, 0x0, 0x0, 0x0)
getsockopt$sock_cred(0xffffffffffffffff, 0x1, 0x11, 0x0, &(0x7f0000cab000))
setsockopt$sock_cred(0xffffffffffffffff, 0x1, 0x11, 0x0, 0x0)
setsockopt$inet6_tcp_TCP_REPAIR_QUEUE(r0, 0x6, 0x14, 0x0, 0x0)
mmap(&(0x7f0000000000/0x4000)=nil, 0x4000, 0x1, 0x10012, 0xffffffffffffffff, 0x5deba000)
mmap(&(0x7f0000bfe000/0x400000)=nil, 0x400000, 0x4, 0x40010, r0, 0xd1aa000)
mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x3, 0x8031, 0xffffffffffffffff, 0x0)
mmap$dsp(&(0x7f0000ffd000/0x2000)=nil, 0x2000, 0x100000b, 0x810, 0xffffffffffffffff, 0x0)
socket$xdp(0x2c, 0x3, 0x0)
r1 = socket$kcm(0xa, 0x2, 0x0)
r2 = socket(0x2, 0x80805, 0x0)
r3 = openat$fuse(0xffffffffffffff9c, &(0x7f0000000080), 0x2, 0x0)
read$FUSE(r3, &(0x7f0000000600)={0x2020}, 0x2020)
setsockopt$IP_VS_SO_SET_ADD(r2, 0x0, 0x482, &(0x7f0000000240)={0x84, @dev={0xac, 0x14, 0x14, 0x15}, 0x4e20, 0x3, 'wlc\x00', 0x2, 0x660f537e, 0x3}, 0x2c)
sendmsg$sock(r1, &(0x7f0000000400)={&(0x7f0000000580)=@in6={0x2, 0x4e20, 0x0, @dev={0xfe, 0x80, '\x00', 0xfd}}, 0x80, 0x0, 0x0, &(0x7f0000000000)=[@mark={{0x14, 0x1, 0x24, 0x3}}], 0x18}, 0x0)
executing program 3:
r0 = syz_usb_connect(0x0, 0x32, &(0x7f0000000000)=ANY=[@ANYBLOB="1201000200000040a61b01000100000000010902200001010080320904"], 0x0)
r1 = openat$ptp1(0xffffffffffffff9c, &(0x7f0000000c40), 0x149201, 0x0)
ioctl$PTP_ENABLE_PPS(r1, 0x40043d04, 0x1)
r2 = socket$kcm(0x10, 0x2, 0x4)
sendmsg$inet(r2, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)=[{&(0x7f0000000100)="5c00000012006bab9e3fe3d86e6c1d0000147ea60864160af36504b68675f8001d000a00a0e69ee517d34460bc24eab556a705251e6182949a36c23d3b48dfd8cdbf9367b4fa51f60a64c9f4080003680601000008000300ff000000", 0x5c}], 0x1, 0x0, 0x0, 0x1f00c00e}, 0x0)
r3 = syz_usb_connect$uac3(0x3, 0x80, &(0x7f0000000280)=ANY=[], 0x0)
syz_usb_control_io(r0, 0x0, 0x0)
syz_usb_control_io$sierra_net(r0, 0x0, &(0x7f0000000700)={0x1c, &(0x7f0000000280)=ANY=[], 0x0, 0x0})
syz_usb_control_io$uac3(r3, 0x0, 0x0)
syz_usb_control_io$printer(r0, 0x0, &(0x7f00000005c0)={0x34, &(0x7f00000003c0)=ANY=[], 0x0, 0x0, 0x0, 0x0, 0x0})
mkdirat(0xffffffffffffff9c, &(0x7f0000000200)='./file0\x00', 0x0)
r4 = openat(0xffffffffffffff9c, &(0x7f0000000080)='./file0\x00', 0x0, 0xd5)
ioctl$FS_IOC_GETFLAGS(r4, 0x80086601, &(0x7f0000000100))
syz_open_dev$dvb_frontend(&(0x7f0000000100), 0x1, 0x802)
r5 = socket$inet6_sctp(0xa, 0x801, 0x84)
getsockopt$bt_hci(r5, 0x84, 0x81, &(0x7f0000001280)=""/4107, &(0x7f00000000c0)=0x100b)
r6 = socket$rxrpc(0x21, 0x2, 0x2)
setsockopt$RXRPC_MIN_SECURITY_LEVEL(r6, 0x110, 0x4, &(0x7f0000000440)=0x1, 0x4)
syz_usb_connect(0x0, 0x32, &(0x7f0000000000)=ANY=[@ANYBLOB="1201000200000040a61b01000100000000010902200001010080320904"], 0x0) (async)
openat$ptp1(0xffffffffffffff9c, &(0x7f0000000c40), 0x149201, 0x0) (async)
ioctl$PTP_ENABLE_PPS(r1, 0x40043d04, 0x1) (async)
socket$kcm(0x10, 0x2, 0x4) (async)
sendmsg$inet(r2, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)=[{&(0x7f0000000100)="5c00000012006bab9e3fe3d86e6c1d0000147ea60864160af36504b68675f8001d000a00a0e69ee517d34460bc24eab556a705251e6182949a36c23d3b48dfd8cdbf9367b4fa51f60a64c9f4080003680601000008000300ff000000", 0x5c}], 0x1, 0x0, 0x0, 0x1f00c00e}, 0x0) (async)
syz_usb_connect$uac3(0x3, 0x80, &(0x7f0000000280)=ANY=[], 0x0) (async)
syz_usb_control_io(r0, 0x0, 0x0) (async)
syz_usb_control_io$sierra_net(r0, 0x0, &(0x7f0000000700)={0x1c, &(0x7f0000000280)=ANY=[], 0x0, 0x0}) (async)
syz_usb_control_io$uac3(r3, 0x0, 0x0) (async)
syz_usb_control_io$printer(r0, 0x0, &(0x7f00000005c0)={0x34, &(0x7f00000003c0)=ANY=[], 0x0, 0x0, 0x0, 0x0, 0x0}) (async)
mkdirat(0xffffffffffffff9c, &(0x7f0000000200)='./file0\x00', 0x0) (async)
openat(0xffffffffffffff9c, &(0x7f0000000080)='./file0\x00', 0x0, 0xd5) (async)
ioctl$FS_IOC_GETFLAGS(r4, 0x80086601, &(0x7f0000000100)) (async)
syz_open_dev$dvb_frontend(&(0x7f0000000100), 0x1, 0x802) (async)
socket$inet6_sctp(0xa, 0x801, 0x84) (async)
getsockopt$bt_hci(r5, 0x84, 0x81, &(0x7f0000001280)=""/4107, &(0x7f00000000c0)=0x100b) (async)
socket$rxrpc(0x21, 0x2, 0x2) (async)
setsockopt$RXRPC_MIN_SECURITY_LEVEL(r6, 0x110, 0x4, &(0x7f0000000440)=0x1, 0x4) (async)
executing program 4:
r0 = syz_open_dev$dvb_frontend(&(0x7f0000000080), 0x0, 0x402)
r1 = socket$inet_mptcp(0x2, 0x1, 0x106)
r2 = socket(0x10, 0x803, 0x0)
syz_genetlink_get_family_id$tipc(&(0x7f0000000000), r2)
getsockname$packet(r2, &(0x7f0000000280)={0x11, 0x0, <r3=>0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14)
sendmsg$nl_route(r2, &(0x7f0000000180)={&(0x7f0000000040)={0x10, 0x0, 0x0, 0x400000}, 0xc, &(0x7f0000000140)={&(0x7f0000000100)=@RTM_GETMDB={0x18, 0x56, 0x2, 0x70bd25, 0x25dfdbfe, {0x7, r3}, [""]}, 0x18}}, 0x20000000)
sendmsg$nl_route(r2, &(0x7f0000000240)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000580)=ANY=[@ANYBLOB="4800000010000305ff810000fddbdf2500000000", @ANYRES32=r3, @ANYBLOB="1748000040000200280012800a000100767863616e0000001800028014000100000000", @ANYRES32=r3], 0x48}, 0x1, 0x0, 0x0, 0x40}, 0x0)
connect$inet(r1, &(0x7f0000000000)={0x2, 0x4e22, @empty}, 0x10)
setsockopt$sock_int(r1, 0x1, 0x9, &(0x7f00000003c0)=0x246, 0x4)
ioctl$FE_SET_PROPERTY(r0, 0x40106f52, &(0x7f00000000c0)={0x29, &(0x7f0000000200)=[{0x34, '\x00', @data=0x4}]})
syz_open_dev$dvb_frontend(&(0x7f0000000080), 0x0, 0x402) (async)
socket$inet_mptcp(0x2, 0x1, 0x106) (async)
socket(0x10, 0x803, 0x0) (async)
syz_genetlink_get_family_id$tipc(&(0x7f0000000000), r2) (async)
getsockname$packet(r2, &(0x7f0000000280)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) (async)
sendmsg$nl_route(r2, &(0x7f0000000180)={&(0x7f0000000040)={0x10, 0x0, 0x0, 0x400000}, 0xc, &(0x7f0000000140)={&(0x7f0000000100)=@RTM_GETMDB={0x18, 0x56, 0x2, 0x70bd25, 0x25dfdbfe, {0x7, r3}, [""]}, 0x18}}, 0x20000000) (async)
sendmsg$nl_route(r2, &(0x7f0000000240)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000580)=ANY=[@ANYBLOB="4800000010000305ff810000fddbdf2500000000", @ANYRES32=r3, @ANYBLOB="1748000040000200280012800a000100767863616e0000001800028014000100000000", @ANYRES32=r3], 0x48}, 0x1, 0x0, 0x0, 0x40}, 0x0) (async)
connect$inet(r1, &(0x7f0000000000)={0x2, 0x4e22, @empty}, 0x10) (async)
setsockopt$sock_int(r1, 0x1, 0x9, &(0x7f00000003c0)=0x246, 0x4) (async)
ioctl$FE_SET_PROPERTY(r0, 0x40106f52, &(0x7f00000000c0)={0x29, &(0x7f0000000200)=[{0x34, '\x00', @data=0x4}]}) (async)

program did not crash
testing program (duration=45s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): [19, 36, 20]
detailed listing:
executing program 0:
socket$nl_netfilter(0x10, 0x3, 0xc)
r0 = socket$inet6_tcp(0xa, 0x1, 0x0)
gettid()
timer_settime(0x0, 0x0, &(0x7f0000000280)={{0x0, 0x989680}, {0x0, 0x989680}}, 0x0)
socketpair$unix(0x1, 0x0, 0x0, 0x0)
getsockopt$sock_cred(0xffffffffffffffff, 0x1, 0x11, 0x0, &(0x7f0000cab000))
setsockopt$sock_cred(0xffffffffffffffff, 0x1, 0x11, 0x0, 0x0)
setsockopt$inet6_tcp_TCP_REPAIR_QUEUE(r0, 0x6, 0x14, 0x0, 0x0)
mmap(&(0x7f0000000000/0x4000)=nil, 0x4000, 0x1, 0x10012, 0xffffffffffffffff, 0x5deba000)
mmap(&(0x7f0000bfe000/0x400000)=nil, 0x400000, 0x4, 0x40010, r0, 0xd1aa000)
mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x3, 0x8031, 0xffffffffffffffff, 0x0)
mmap$dsp(&(0x7f0000ffd000/0x2000)=nil, 0x2000, 0x100000b, 0x810, 0xffffffffffffffff, 0x0)
socket$xdp(0x2c, 0x3, 0x0)
r1 = socket$kcm(0xa, 0x2, 0x0)
r2 = socket(0x2, 0x80805, 0x0)
r3 = openat$fuse(0xffffffffffffff9c, &(0x7f0000000080), 0x2, 0x0)
read$FUSE(r3, &(0x7f0000000600)={0x2020}, 0x2020)
setsockopt$IP_VS_SO_SET_ADD(r2, 0x0, 0x482, &(0x7f0000000240)={0x84, @dev={0xac, 0x14, 0x14, 0x15}, 0x4e20, 0x3, 'wlc\x00', 0x2, 0x660f537e, 0x3}, 0x2c)
sendmsg$sock(r1, &(0x7f0000000400)={&(0x7f0000000580)=@in6={0x2, 0x4e20, 0x0, @dev={0xfe, 0x80, '\x00', 0xfd}}, 0x80, 0x0, 0x0, &(0x7f0000000000)=[@mark={{0x14, 0x1, 0x24, 0x3}}], 0x18}, 0x0)
executing program 3:
r0 = syz_usb_connect(0x0, 0x32, &(0x7f0000000000)=ANY=[@ANYBLOB="1201000200000040a61b01000100000000010902200001010080320904"], 0x0)
r1 = openat$ptp1(0xffffffffffffff9c, &(0x7f0000000c40), 0x149201, 0x0)
ioctl$PTP_ENABLE_PPS(r1, 0x40043d04, 0x1)
r2 = socket$kcm(0x10, 0x2, 0x4)
sendmsg$inet(r2, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)=[{&(0x7f0000000100)="5c00000012006bab9e3fe3d86e6c1d0000147ea60864160af36504b68675f8001d000a00a0e69ee517d34460bc24eab556a705251e6182949a36c23d3b48dfd8cdbf9367b4fa51f60a64c9f4080003680601000008000300ff000000", 0x5c}], 0x1, 0x0, 0x0, 0x1f00c00e}, 0x0)
r3 = syz_usb_connect$uac3(0x3, 0x80, &(0x7f0000000280)=ANY=[], 0x0)
syz_usb_control_io(r0, 0x0, 0x0)
syz_usb_control_io$sierra_net(r0, 0x0, &(0x7f0000000700)={0x1c, &(0x7f0000000280)=ANY=[], 0x0, 0x0})
syz_usb_control_io$uac3(r3, 0x0, 0x0)
syz_usb_control_io$printer(r0, 0x0, &(0x7f00000005c0)={0x34, &(0x7f00000003c0)=ANY=[], 0x0, 0x0, 0x0, 0x0, 0x0})
mkdirat(0xffffffffffffff9c, &(0x7f0000000200)='./file0\x00', 0x0)
r4 = openat(0xffffffffffffff9c, &(0x7f0000000080)='./file0\x00', 0x0, 0xd5)
ioctl$FS_IOC_GETFLAGS(r4, 0x80086601, &(0x7f0000000100))
syz_open_dev$dvb_frontend(&(0x7f0000000100), 0x1, 0x802)
r5 = socket$inet6_sctp(0xa, 0x801, 0x84)
getsockopt$bt_hci(r5, 0x84, 0x81, &(0x7f0000001280)=""/4107, &(0x7f00000000c0)=0x100b)
r6 = socket$rxrpc(0x21, 0x2, 0x2)
setsockopt$RXRPC_MIN_SECURITY_LEVEL(r6, 0x110, 0x4, &(0x7f0000000440)=0x1, 0x4)
syz_usb_connect(0x0, 0x32, &(0x7f0000000000)=ANY=[@ANYBLOB="1201000200000040a61b01000100000000010902200001010080320904"], 0x0) (async)
openat$ptp1(0xffffffffffffff9c, &(0x7f0000000c40), 0x149201, 0x0) (async)
ioctl$PTP_ENABLE_PPS(r1, 0x40043d04, 0x1) (async)
socket$kcm(0x10, 0x2, 0x4) (async)
sendmsg$inet(r2, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)=[{&(0x7f0000000100)="5c00000012006bab9e3fe3d86e6c1d0000147ea60864160af36504b68675f8001d000a00a0e69ee517d34460bc24eab556a705251e6182949a36c23d3b48dfd8cdbf9367b4fa51f60a64c9f4080003680601000008000300ff000000", 0x5c}], 0x1, 0x0, 0x0, 0x1f00c00e}, 0x0) (async)
syz_usb_connect$uac3(0x3, 0x80, &(0x7f0000000280)=ANY=[], 0x0) (async)
syz_usb_control_io(r0, 0x0, 0x0) (async)
syz_usb_control_io$sierra_net(r0, 0x0, &(0x7f0000000700)={0x1c, &(0x7f0000000280)=ANY=[], 0x0, 0x0}) (async)
syz_usb_control_io$uac3(r3, 0x0, 0x0) (async)
syz_usb_control_io$printer(r0, 0x0, &(0x7f00000005c0)={0x34, &(0x7f00000003c0)=ANY=[], 0x0, 0x0, 0x0, 0x0, 0x0}) (async)
mkdirat(0xffffffffffffff9c, &(0x7f0000000200)='./file0\x00', 0x0) (async)
openat(0xffffffffffffff9c, &(0x7f0000000080)='./file0\x00', 0x0, 0xd5) (async)
ioctl$FS_IOC_GETFLAGS(r4, 0x80086601, &(0x7f0000000100)) (async)
syz_open_dev$dvb_frontend(&(0x7f0000000100), 0x1, 0x802) (async)
socket$inet6_sctp(0xa, 0x801, 0x84) (async)
getsockopt$bt_hci(r5, 0x84, 0x81, &(0x7f0000001280)=""/4107, &(0x7f00000000c0)=0x100b) (async)
socket$rxrpc(0x21, 0x2, 0x2) (async)
setsockopt$RXRPC_MIN_SECURITY_LEVEL(r6, 0x110, 0x4, &(0x7f0000000440)=0x1, 0x4) (async)
executing program 4:
r0 = syz_open_dev$dvb_frontend(&(0x7f0000000080), 0x0, 0x402)
r1 = socket$inet_mptcp(0x2, 0x1, 0x106)
r2 = socket(0x10, 0x803, 0x0)
syz_genetlink_get_family_id$tipc(&(0x7f0000000000), r2)
getsockname$packet(r2, &(0x7f0000000280)={0x11, 0x0, <r3=>0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14)
sendmsg$nl_route(r2, &(0x7f0000000180)={&(0x7f0000000040)={0x10, 0x0, 0x0, 0x400000}, 0xc, &(0x7f0000000140)={&(0x7f0000000100)=@RTM_GETMDB={0x18, 0x56, 0x2, 0x70bd25, 0x25dfdbfe, {0x7, r3}, [""]}, 0x18}}, 0x20000000)
sendmsg$nl_route(r2, &(0x7f0000000240)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000580)=ANY=[@ANYBLOB="4800000010000305ff810000fddbdf2500000000", @ANYRES32=r3, @ANYBLOB="1748000040000200280012800a000100767863616e0000001800028014000100000000", @ANYRES32=r3], 0x48}, 0x1, 0x0, 0x0, 0x40}, 0x0)
connect$inet(r1, &(0x7f0000000000)={0x2, 0x4e22, @empty}, 0x10)
setsockopt$sock_int(r1, 0x1, 0x9, &(0x7f00000003c0)=0x246, 0x4)
ioctl$FE_SET_PROPERTY(r0, 0x40106f52, &(0x7f00000000c0)={0x29, &(0x7f0000000200)=[{0x34, '\x00', @data=0x4}]})
syz_open_dev$dvb_frontend(&(0x7f0000000080), 0x0, 0x402) (async)
socket$inet_mptcp(0x2, 0x1, 0x106) (async)
socket(0x10, 0x803, 0x0) (async)
syz_genetlink_get_family_id$tipc(&(0x7f0000000000), r2) (async)
getsockname$packet(r2, &(0x7f0000000280)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) (async)
sendmsg$nl_route(r2, &(0x7f0000000180)={&(0x7f0000000040)={0x10, 0x0, 0x0, 0x400000}, 0xc, &(0x7f0000000140)={&(0x7f0000000100)=@RTM_GETMDB={0x18, 0x56, 0x2, 0x70bd25, 0x25dfdbfe, {0x7, r3}, [""]}, 0x18}}, 0x20000000) (async)
sendmsg$nl_route(r2, &(0x7f0000000240)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000580)=ANY=[@ANYBLOB="4800000010000305ff810000fddbdf2500000000", @ANYRES32=r3, @ANYBLOB="1748000040000200280012800a000100767863616e0000001800028014000100000000", @ANYRES32=r3], 0x48}, 0x1, 0x0, 0x0, 0x40}, 0x0) (async)
connect$inet(r1, &(0x7f0000000000)={0x2, 0x4e22, @empty}, 0x10) (async)
setsockopt$sock_int(r1, 0x1, 0x9, &(0x7f00000003c0)=0x246, 0x4) (async)
ioctl$FE_SET_PROPERTY(r0, 0x40106f52, &(0x7f00000000c0)={0x29, &(0x7f0000000200)=[{0x34, '\x00', @data=0x4}]}) (async)

program did not crash
testing program (duration=45s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): [19, 36, 20]
detailed listing:
executing program 0:
socket$nl_netfilter(0x10, 0x3, 0xc)
connect$inet6(0xffffffffffffffff, 0x0, 0x0)
gettid()
timer_settime(0x0, 0x0, &(0x7f0000000280)={{0x0, 0x989680}, {0x0, 0x989680}}, 0x0)
socketpair$unix(0x1, 0x0, 0x0, 0x0)
getsockopt$sock_cred(0xffffffffffffffff, 0x1, 0x11, 0x0, &(0x7f0000cab000))
setsockopt$sock_cred(0xffffffffffffffff, 0x1, 0x11, 0x0, 0x0)
setsockopt$inet6_tcp_TCP_REPAIR_QUEUE(0xffffffffffffffff, 0x6, 0x14, 0x0, 0x0)
mmap(&(0x7f0000000000/0x4000)=nil, 0x4000, 0x1, 0x10012, 0xffffffffffffffff, 0x5deba000)
mmap(&(0x7f0000bfe000/0x400000)=nil, 0x400000, 0x4, 0x40010, 0xffffffffffffffff, 0xd1aa000)
mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x3, 0x8031, 0xffffffffffffffff, 0x0)
mmap$dsp(&(0x7f0000ffd000/0x2000)=nil, 0x2000, 0x100000b, 0x810, 0xffffffffffffffff, 0x0)
socket$xdp(0x2c, 0x3, 0x0)
r0 = socket$kcm(0xa, 0x2, 0x0)
r1 = socket(0x2, 0x80805, 0x0)
r2 = openat$fuse(0xffffffffffffff9c, &(0x7f0000000080), 0x2, 0x0)
read$FUSE(r2, &(0x7f0000000600)={0x2020}, 0x2020)
setsockopt$IP_VS_SO_SET_ADD(r1, 0x0, 0x482, &(0x7f0000000240)={0x84, @dev={0xac, 0x14, 0x14, 0x15}, 0x4e20, 0x3, 'wlc\x00', 0x2, 0x660f537e, 0x3}, 0x2c)
sendmsg$sock(r0, &(0x7f0000000400)={&(0x7f0000000580)=@in6={0x2, 0x4e20, 0x0, @dev={0xfe, 0x80, '\x00', 0xfd}}, 0x80, 0x0, 0x0, &(0x7f0000000000)=[@mark={{0x14, 0x1, 0x24, 0x3}}], 0x18}, 0x0)
executing program 3:
r0 = syz_usb_connect(0x0, 0x32, &(0x7f0000000000)=ANY=[@ANYBLOB="1201000200000040a61b01000100000000010902200001010080320904"], 0x0)
r1 = openat$ptp1(0xffffffffffffff9c, &(0x7f0000000c40), 0x149201, 0x0)
ioctl$PTP_ENABLE_PPS(r1, 0x40043d04, 0x1)
r2 = socket$kcm(0x10, 0x2, 0x4)
sendmsg$inet(r2, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)=[{&(0x7f0000000100)="5c00000012006bab9e3fe3d86e6c1d0000147ea60864160af36504b68675f8001d000a00a0e69ee517d34460bc24eab556a705251e6182949a36c23d3b48dfd8cdbf9367b4fa51f60a64c9f4080003680601000008000300ff000000", 0x5c}], 0x1, 0x0, 0x0, 0x1f00c00e}, 0x0)
r3 = syz_usb_connect$uac3(0x3, 0x80, &(0x7f0000000280)=ANY=[], 0x0)
syz_usb_control_io(r0, 0x0, 0x0)
syz_usb_control_io$sierra_net(r0, 0x0, &(0x7f0000000700)={0x1c, &(0x7f0000000280)=ANY=[], 0x0, 0x0})
syz_usb_control_io$uac3(r3, 0x0, 0x0)
syz_usb_control_io$printer(r0, 0x0, &(0x7f00000005c0)={0x34, &(0x7f00000003c0)=ANY=[], 0x0, 0x0, 0x0, 0x0, 0x0})
mkdirat(0xffffffffffffff9c, &(0x7f0000000200)='./file0\x00', 0x0)
r4 = openat(0xffffffffffffff9c, &(0x7f0000000080)='./file0\x00', 0x0, 0xd5)
ioctl$FS_IOC_GETFLAGS(r4, 0x80086601, &(0x7f0000000100))
syz_open_dev$dvb_frontend(&(0x7f0000000100), 0x1, 0x802)
r5 = socket$inet6_sctp(0xa, 0x801, 0x84)
getsockopt$bt_hci(r5, 0x84, 0x81, &(0x7f0000001280)=""/4107, &(0x7f00000000c0)=0x100b)
r6 = socket$rxrpc(0x21, 0x2, 0x2)
setsockopt$RXRPC_MIN_SECURITY_LEVEL(r6, 0x110, 0x4, &(0x7f0000000440)=0x1, 0x4)
syz_usb_connect(0x0, 0x32, &(0x7f0000000000)=ANY=[@ANYBLOB="1201000200000040a61b01000100000000010902200001010080320904"], 0x0) (async)
openat$ptp1(0xffffffffffffff9c, &(0x7f0000000c40), 0x149201, 0x0) (async)
ioctl$PTP_ENABLE_PPS(r1, 0x40043d04, 0x1) (async)
socket$kcm(0x10, 0x2, 0x4) (async)
sendmsg$inet(r2, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)=[{&(0x7f0000000100)="5c00000012006bab9e3fe3d86e6c1d0000147ea60864160af36504b68675f8001d000a00a0e69ee517d34460bc24eab556a705251e6182949a36c23d3b48dfd8cdbf9367b4fa51f60a64c9f4080003680601000008000300ff000000", 0x5c}], 0x1, 0x0, 0x0, 0x1f00c00e}, 0x0) (async)
syz_usb_connect$uac3(0x3, 0x80, &(0x7f0000000280)=ANY=[], 0x0) (async)
syz_usb_control_io(r0, 0x0, 0x0) (async)
syz_usb_control_io$sierra_net(r0, 0x0, &(0x7f0000000700)={0x1c, &(0x7f0000000280)=ANY=[], 0x0, 0x0}) (async)
syz_usb_control_io$uac3(r3, 0x0, 0x0) (async)
syz_usb_control_io$printer(r0, 0x0, &(0x7f00000005c0)={0x34, &(0x7f00000003c0)=ANY=[], 0x0, 0x0, 0x0, 0x0, 0x0}) (async)
mkdirat(0xffffffffffffff9c, &(0x7f0000000200)='./file0\x00', 0x0) (async)
openat(0xffffffffffffff9c, &(0x7f0000000080)='./file0\x00', 0x0, 0xd5) (async)
ioctl$FS_IOC_GETFLAGS(r4, 0x80086601, &(0x7f0000000100)) (async)
syz_open_dev$dvb_frontend(&(0x7f0000000100), 0x1, 0x802) (async)
socket$inet6_sctp(0xa, 0x801, 0x84) (async)
getsockopt$bt_hci(r5, 0x84, 0x81, &(0x7f0000001280)=""/4107, &(0x7f00000000c0)=0x100b) (async)
socket$rxrpc(0x21, 0x2, 0x2) (async)
setsockopt$RXRPC_MIN_SECURITY_LEVEL(r6, 0x110, 0x4, &(0x7f0000000440)=0x1, 0x4) (async)
executing program 4:
r0 = syz_open_dev$dvb_frontend(&(0x7f0000000080), 0x0, 0x402)
r1 = socket$inet_mptcp(0x2, 0x1, 0x106)
r2 = socket(0x10, 0x803, 0x0)
syz_genetlink_get_family_id$tipc(&(0x7f0000000000), r2)
getsockname$packet(r2, &(0x7f0000000280)={0x11, 0x0, <r3=>0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14)
sendmsg$nl_route(r2, &(0x7f0000000180)={&(0x7f0000000040)={0x10, 0x0, 0x0, 0x400000}, 0xc, &(0x7f0000000140)={&(0x7f0000000100)=@RTM_GETMDB={0x18, 0x56, 0x2, 0x70bd25, 0x25dfdbfe, {0x7, r3}, [""]}, 0x18}}, 0x20000000)
sendmsg$nl_route(r2, &(0x7f0000000240)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000580)=ANY=[@ANYBLOB="4800000010000305ff810000fddbdf2500000000", @ANYRES32=r3, @ANYBLOB="1748000040000200280012800a000100767863616e0000001800028014000100000000", @ANYRES32=r3], 0x48}, 0x1, 0x0, 0x0, 0x40}, 0x0)
connect$inet(r1, &(0x7f0000000000)={0x2, 0x4e22, @empty}, 0x10)
setsockopt$sock_int(r1, 0x1, 0x9, &(0x7f00000003c0)=0x246, 0x4)
ioctl$FE_SET_PROPERTY(r0, 0x40106f52, &(0x7f00000000c0)={0x29, &(0x7f0000000200)=[{0x34, '\x00', @data=0x4}]})
syz_open_dev$dvb_frontend(&(0x7f0000000080), 0x0, 0x402) (async)
socket$inet_mptcp(0x2, 0x1, 0x106) (async)
socket(0x10, 0x803, 0x0) (async)
syz_genetlink_get_family_id$tipc(&(0x7f0000000000), r2) (async)
getsockname$packet(r2, &(0x7f0000000280)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) (async)
sendmsg$nl_route(r2, &(0x7f0000000180)={&(0x7f0000000040)={0x10, 0x0, 0x0, 0x400000}, 0xc, &(0x7f0000000140)={&(0x7f0000000100)=@RTM_GETMDB={0x18, 0x56, 0x2, 0x70bd25, 0x25dfdbfe, {0x7, r3}, [""]}, 0x18}}, 0x20000000) (async)
sendmsg$nl_route(r2, &(0x7f0000000240)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000580)=ANY=[@ANYBLOB="4800000010000305ff810000fddbdf2500000000", @ANYRES32=r3, @ANYBLOB="1748000040000200280012800a000100767863616e0000001800028014000100000000", @ANYRES32=r3], 0x48}, 0x1, 0x0, 0x0, 0x40}, 0x0) (async)
connect$inet(r1, &(0x7f0000000000)={0x2, 0x4e22, @empty}, 0x10) (async)
setsockopt$sock_int(r1, 0x1, 0x9, &(0x7f00000003c0)=0x246, 0x4) (async)
ioctl$FE_SET_PROPERTY(r0, 0x40106f52, &(0x7f00000000c0)={0x29, &(0x7f0000000200)=[{0x34, '\x00', @data=0x4}]}) (async)

program did not crash
testing program (duration=45s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): [19, 36, 20]
detailed listing:
executing program 0:
r0 = socket$inet6_tcp(0xa, 0x1, 0x0)
connect$inet6(r0, 0x0, 0x0)
gettid()
timer_settime(0x0, 0x0, &(0x7f0000000280)={{0x0, 0x989680}, {0x0, 0x989680}}, 0x0)
socketpair$unix(0x1, 0x0, 0x0, 0x0)
getsockopt$sock_cred(0xffffffffffffffff, 0x1, 0x11, 0x0, &(0x7f0000cab000))
setsockopt$sock_cred(0xffffffffffffffff, 0x1, 0x11, 0x0, 0x0)
setsockopt$inet6_tcp_TCP_REPAIR_QUEUE(r0, 0x6, 0x14, 0x0, 0x0)
mmap(&(0x7f0000000000/0x4000)=nil, 0x4000, 0x1, 0x10012, 0xffffffffffffffff, 0x5deba000)
mmap(&(0x7f0000bfe000/0x400000)=nil, 0x400000, 0x4, 0x40010, r0, 0xd1aa000)
mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x3, 0x8031, 0xffffffffffffffff, 0x0)
mmap$dsp(&(0x7f0000ffd000/0x2000)=nil, 0x2000, 0x100000b, 0x810, 0xffffffffffffffff, 0x0)
socket$xdp(0x2c, 0x3, 0x0)
r1 = socket$kcm(0xa, 0x2, 0x0)
r2 = socket(0x2, 0x80805, 0x0)
r3 = openat$fuse(0xffffffffffffff9c, &(0x7f0000000080), 0x2, 0x0)
read$FUSE(r3, &(0x7f0000000600)={0x2020}, 0x2020)
setsockopt$IP_VS_SO_SET_ADD(r2, 0x0, 0x482, &(0x7f0000000240)={0x84, @dev={0xac, 0x14, 0x14, 0x15}, 0x4e20, 0x3, 'wlc\x00', 0x2, 0x660f537e, 0x3}, 0x2c)
sendmsg$sock(r1, &(0x7f0000000400)={&(0x7f0000000580)=@in6={0x2, 0x4e20, 0x0, @dev={0xfe, 0x80, '\x00', 0xfd}}, 0x80, 0x0, 0x0, &(0x7f0000000000)=[@mark={{0x14, 0x1, 0x24, 0x3}}], 0x18}, 0x0)
executing program 3:
r0 = syz_usb_connect(0x0, 0x32, &(0x7f0000000000)=ANY=[@ANYBLOB="1201000200000040a61b01000100000000010902200001010080320904"], 0x0)
r1 = openat$ptp1(0xffffffffffffff9c, &(0x7f0000000c40), 0x149201, 0x0)
ioctl$PTP_ENABLE_PPS(r1, 0x40043d04, 0x1)
r2 = socket$kcm(0x10, 0x2, 0x4)
sendmsg$inet(r2, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)=[{&(0x7f0000000100)="5c00000012006bab9e3fe3d86e6c1d0000147ea60864160af36504b68675f8001d000a00a0e69ee517d34460bc24eab556a705251e6182949a36c23d3b48dfd8cdbf9367b4fa51f60a64c9f4080003680601000008000300ff000000", 0x5c}], 0x1, 0x0, 0x0, 0x1f00c00e}, 0x0)
r3 = syz_usb_connect$uac3(0x3, 0x80, &(0x7f0000000280)=ANY=[], 0x0)
syz_usb_control_io(r0, 0x0, 0x0)
syz_usb_control_io$sierra_net(r0, 0x0, &(0x7f0000000700)={0x1c, &(0x7f0000000280)=ANY=[], 0x0, 0x0})
syz_usb_control_io$uac3(r3, 0x0, 0x0)
syz_usb_control_io$printer(r0, 0x0, &(0x7f00000005c0)={0x34, &(0x7f00000003c0)=ANY=[], 0x0, 0x0, 0x0, 0x0, 0x0})
mkdirat(0xffffffffffffff9c, &(0x7f0000000200)='./file0\x00', 0x0)
r4 = openat(0xffffffffffffff9c, &(0x7f0000000080)='./file0\x00', 0x0, 0xd5)
ioctl$FS_IOC_GETFLAGS(r4, 0x80086601, &(0x7f0000000100))
syz_open_dev$dvb_frontend(&(0x7f0000000100), 0x1, 0x802)
r5 = socket$inet6_sctp(0xa, 0x801, 0x84)
getsockopt$bt_hci(r5, 0x84, 0x81, &(0x7f0000001280)=""/4107, &(0x7f00000000c0)=0x100b)
r6 = socket$rxrpc(0x21, 0x2, 0x2)
setsockopt$RXRPC_MIN_SECURITY_LEVEL(r6, 0x110, 0x4, &(0x7f0000000440)=0x1, 0x4)
syz_usb_connect(0x0, 0x32, &(0x7f0000000000)=ANY=[@ANYBLOB="1201000200000040a61b01000100000000010902200001010080320904"], 0x0) (async)
openat$ptp1(0xffffffffffffff9c, &(0x7f0000000c40), 0x149201, 0x0) (async)
ioctl$PTP_ENABLE_PPS(r1, 0x40043d04, 0x1) (async)
socket$kcm(0x10, 0x2, 0x4) (async)
sendmsg$inet(r2, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)=[{&(0x7f0000000100)="5c00000012006bab9e3fe3d86e6c1d0000147ea60864160af36504b68675f8001d000a00a0e69ee517d34460bc24eab556a705251e6182949a36c23d3b48dfd8cdbf9367b4fa51f60a64c9f4080003680601000008000300ff000000", 0x5c}], 0x1, 0x0, 0x0, 0x1f00c00e}, 0x0) (async)
syz_usb_connect$uac3(0x3, 0x80, &(0x7f0000000280)=ANY=[], 0x0) (async)
syz_usb_control_io(r0, 0x0, 0x0) (async)
syz_usb_control_io$sierra_net(r0, 0x0, &(0x7f0000000700)={0x1c, &(0x7f0000000280)=ANY=[], 0x0, 0x0}) (async)
syz_usb_control_io$uac3(r3, 0x0, 0x0) (async)
syz_usb_control_io$printer(r0, 0x0, &(0x7f00000005c0)={0x34, &(0x7f00000003c0)=ANY=[], 0x0, 0x0, 0x0, 0x0, 0x0}) (async)
mkdirat(0xffffffffffffff9c, &(0x7f0000000200)='./file0\x00', 0x0) (async)
openat(0xffffffffffffff9c, &(0x7f0000000080)='./file0\x00', 0x0, 0xd5) (async)
ioctl$FS_IOC_GETFLAGS(r4, 0x80086601, &(0x7f0000000100)) (async)
syz_open_dev$dvb_frontend(&(0x7f0000000100), 0x1, 0x802) (async)
socket$inet6_sctp(0xa, 0x801, 0x84) (async)
getsockopt$bt_hci(r5, 0x84, 0x81, &(0x7f0000001280)=""/4107, &(0x7f00000000c0)=0x100b) (async)
socket$rxrpc(0x21, 0x2, 0x2) (async)
setsockopt$RXRPC_MIN_SECURITY_LEVEL(r6, 0x110, 0x4, &(0x7f0000000440)=0x1, 0x4) (async)
executing program 4:
r0 = syz_open_dev$dvb_frontend(&(0x7f0000000080), 0x0, 0x402)
r1 = socket$inet_mptcp(0x2, 0x1, 0x106)
r2 = socket(0x10, 0x803, 0x0)
syz_genetlink_get_family_id$tipc(&(0x7f0000000000), r2)
getsockname$packet(r2, &(0x7f0000000280)={0x11, 0x0, <r3=>0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14)
sendmsg$nl_route(r2, &(0x7f0000000180)={&(0x7f0000000040)={0x10, 0x0, 0x0, 0x400000}, 0xc, &(0x7f0000000140)={&(0x7f0000000100)=@RTM_GETMDB={0x18, 0x56, 0x2, 0x70bd25, 0x25dfdbfe, {0x7, r3}, [""]}, 0x18}}, 0x20000000)
sendmsg$nl_route(r2, &(0x7f0000000240)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000580)=ANY=[@ANYBLOB="4800000010000305ff810000fddbdf2500000000", @ANYRES32=r3, @ANYBLOB="1748000040000200280012800a000100767863616e0000001800028014000100000000", @ANYRES32=r3], 0x48}, 0x1, 0x0, 0x0, 0x40}, 0x0)
connect$inet(r1, &(0x7f0000000000)={0x2, 0x4e22, @empty}, 0x10)
setsockopt$sock_int(r1, 0x1, 0x9, &(0x7f00000003c0)=0x246, 0x4)
ioctl$FE_SET_PROPERTY(r0, 0x40106f52, &(0x7f00000000c0)={0x29, &(0x7f0000000200)=[{0x34, '\x00', @data=0x4}]})
syz_open_dev$dvb_frontend(&(0x7f0000000080), 0x0, 0x402) (async)
socket$inet_mptcp(0x2, 0x1, 0x106) (async)
socket(0x10, 0x803, 0x0) (async)
syz_genetlink_get_family_id$tipc(&(0x7f0000000000), r2) (async)
getsockname$packet(r2, &(0x7f0000000280)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) (async)
sendmsg$nl_route(r2, &(0x7f0000000180)={&(0x7f0000000040)={0x10, 0x0, 0x0, 0x400000}, 0xc, &(0x7f0000000140)={&(0x7f0000000100)=@RTM_GETMDB={0x18, 0x56, 0x2, 0x70bd25, 0x25dfdbfe, {0x7, r3}, [""]}, 0x18}}, 0x20000000) (async)
sendmsg$nl_route(r2, &(0x7f0000000240)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000580)=ANY=[@ANYBLOB="4800000010000305ff810000fddbdf2500000000", @ANYRES32=r3, @ANYBLOB="1748000040000200280012800a000100767863616e0000001800028014000100000000", @ANYRES32=r3], 0x48}, 0x1, 0x0, 0x0, 0x40}, 0x0) (async)
connect$inet(r1, &(0x7f0000000000)={0x2, 0x4e22, @empty}, 0x10) (async)
setsockopt$sock_int(r1, 0x1, 0x9, &(0x7f00000003c0)=0x246, 0x4) (async)
ioctl$FE_SET_PROPERTY(r0, 0x40106f52, &(0x7f00000000c0)={0x29, &(0x7f0000000200)=[{0x34, '\x00', @data=0x4}]}) (async)

program crashed: KASAN: slab-use-after-free Read in dvb_device_open
minimized 30 calls -> 19 calls
minimizing program #1 before concatenation
testing program (duration=45s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): [19, 35, 20]
detailed listing:
executing program 3:
r0 = socket$inet6_tcp(0xa, 0x1, 0x0)
connect$inet6(r0, 0x0, 0x0)
gettid()
timer_settime(0x0, 0x0, &(0x7f0000000280)={{0x0, 0x989680}, {0x0, 0x989680}}, 0x0)
socketpair$unix(0x1, 0x0, 0x0, 0x0)
getsockopt$sock_cred(0xffffffffffffffff, 0x1, 0x11, 0x0, &(0x7f0000cab000))
setsockopt$sock_cred(0xffffffffffffffff, 0x1, 0x11, 0x0, 0x0)
setsockopt$inet6_tcp_TCP_REPAIR_QUEUE(r0, 0x6, 0x14, 0x0, 0x0)
mmap(&(0x7f0000000000/0x4000)=nil, 0x4000, 0x1, 0x10012, 0xffffffffffffffff, 0x5deba000)
mmap(&(0x7f0000bfe000/0x400000)=nil, 0x400000, 0x4, 0x40010, r0, 0xd1aa000)
mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x3, 0x8031, 0xffffffffffffffff, 0x0)
mmap$dsp(&(0x7f0000ffd000/0x2000)=nil, 0x2000, 0x100000b, 0x810, 0xffffffffffffffff, 0x0)
socket$xdp(0x2c, 0x3, 0x0)
r1 = socket$kcm(0xa, 0x2, 0x0)
r2 = socket(0x2, 0x80805, 0x0)
r3 = openat$fuse(0xffffffffffffff9c, &(0x7f0000000080), 0x2, 0x0)
read$FUSE(r3, &(0x7f0000000600)={0x2020}, 0x2020)
setsockopt$IP_VS_SO_SET_ADD(r2, 0x0, 0x482, &(0x7f0000000240)={0x84, @dev={0xac, 0x14, 0x14, 0x15}, 0x4e20, 0x3, 'wlc\x00', 0x2, 0x660f537e, 0x3}, 0x2c)
sendmsg$sock(r1, &(0x7f0000000400)={&(0x7f0000000580)=@in6={0x2, 0x4e20, 0x0, @dev={0xfe, 0x80, '\x00', 0xfd}}, 0x80, 0x0, 0x0, &(0x7f0000000000)=[@mark={{0x14, 0x1, 0x24, 0x3}}], 0x18}, 0x0)
executing program 0:
r0 = syz_usb_connect(0x0, 0x32, &(0x7f0000000000)=ANY=[@ANYBLOB="1201000200000040a61b01000100000000010902200001010080320904"], 0x0)
r1 = openat$ptp1(0xffffffffffffff9c, &(0x7f0000000c40), 0x149201, 0x0)
ioctl$PTP_ENABLE_PPS(r1, 0x40043d04, 0x1)
r2 = socket$kcm(0x10, 0x2, 0x4)
sendmsg$inet(r2, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)=[{&(0x7f0000000100)="5c00000012006bab9e3fe3d86e6c1d0000147ea60864160af36504b68675f8001d000a00a0e69ee517d34460bc24eab556a705251e6182949a36c23d3b48dfd8cdbf9367b4fa51f60a64c9f4080003680601000008000300ff000000", 0x5c}], 0x1, 0x0, 0x0, 0x1f00c00e}, 0x0)
r3 = syz_usb_connect$uac3(0x3, 0x80, &(0x7f0000000280)=ANY=[], 0x0)
syz_usb_control_io(r0, 0x0, 0x0)
syz_usb_control_io$sierra_net(r0, 0x0, &(0x7f0000000700)={0x1c, &(0x7f0000000280)=ANY=[], 0x0, 0x0})
syz_usb_control_io$uac3(r3, 0x0, 0x0)
syz_usb_control_io$printer(r0, 0x0, &(0x7f00000005c0)={0x34, &(0x7f00000003c0)=ANY=[], 0x0, 0x0, 0x0, 0x0, 0x0})
mkdirat(0xffffffffffffff9c, &(0x7f0000000200)='./file0\x00', 0x0)
r4 = openat(0xffffffffffffff9c, &(0x7f0000000080)='./file0\x00', 0x0, 0xd5)
ioctl$FS_IOC_GETFLAGS(r4, 0x80086601, &(0x7f0000000100))
syz_open_dev$dvb_frontend(&(0x7f0000000100), 0x1, 0x802)
r5 = socket$inet6_sctp(0xa, 0x801, 0x84)
getsockopt$bt_hci(r5, 0x84, 0x81, &(0x7f0000001280)=""/4107, &(0x7f00000000c0)=0x100b)
r6 = socket$rxrpc(0x21, 0x2, 0x2)
setsockopt$RXRPC_MIN_SECURITY_LEVEL(r6, 0x110, 0x4, &(0x7f0000000440)=0x1, 0x4)
syz_usb_connect(0x0, 0x32, &(0x7f0000000000)=ANY=[@ANYBLOB="1201000200000040a61b01000100000000010902200001010080320904"], 0x0) (async)
openat$ptp1(0xffffffffffffff9c, &(0x7f0000000c40), 0x149201, 0x0) (async)
ioctl$PTP_ENABLE_PPS(r1, 0x40043d04, 0x1) (async)
socket$kcm(0x10, 0x2, 0x4) (async)
sendmsg$inet(r2, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)=[{&(0x7f0000000100)="5c00000012006bab9e3fe3d86e6c1d0000147ea60864160af36504b68675f8001d000a00a0e69ee517d34460bc24eab556a705251e6182949a36c23d3b48dfd8cdbf9367b4fa51f60a64c9f4080003680601000008000300ff000000", 0x5c}], 0x1, 0x0, 0x0, 0x1f00c00e}, 0x0) (async)
syz_usb_connect$uac3(0x3, 0x80, &(0x7f0000000280)=ANY=[], 0x0) (async)
syz_usb_control_io(r0, 0x0, 0x0) (async)
syz_usb_control_io$sierra_net(r0, 0x0, &(0x7f0000000700)={0x1c, &(0x7f0000000280)=ANY=[], 0x0, 0x0}) (async)
syz_usb_control_io$uac3(r3, 0x0, 0x0) (async)
syz_usb_control_io$printer(r0, 0x0, &(0x7f00000005c0)={0x34, &(0x7f00000003c0)=ANY=[], 0x0, 0x0, 0x0, 0x0, 0x0}) (async)
mkdirat(0xffffffffffffff9c, &(0x7f0000000200)='./file0\x00', 0x0) (async)
openat(0xffffffffffffff9c, &(0x7f0000000080)='./file0\x00', 0x0, 0xd5) (async)
ioctl$FS_IOC_GETFLAGS(r4, 0x80086601, &(0x7f0000000100)) (async)
syz_open_dev$dvb_frontend(&(0x7f0000000100), 0x1, 0x802) (async)
socket$inet6_sctp(0xa, 0x801, 0x84) (async)
getsockopt$bt_hci(r5, 0x84, 0x81, &(0x7f0000001280)=""/4107, &(0x7f00000000c0)=0x100b) (async)
socket$rxrpc(0x21, 0x2, 0x2) (async)
executing program 4:
r0 = syz_open_dev$dvb_frontend(&(0x7f0000000080), 0x0, 0x402)
r1 = socket$inet_mptcp(0x2, 0x1, 0x106)
r2 = socket(0x10, 0x803, 0x0)
syz_genetlink_get_family_id$tipc(&(0x7f0000000000), r2)
getsockname$packet(r2, &(0x7f0000000280)={0x11, 0x0, <r3=>0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14)
sendmsg$nl_route(r2, &(0x7f0000000180)={&(0x7f0000000040)={0x10, 0x0, 0x0, 0x400000}, 0xc, &(0x7f0000000140)={&(0x7f0000000100)=@RTM_GETMDB={0x18, 0x56, 0x2, 0x70bd25, 0x25dfdbfe, {0x7, r3}, [""]}, 0x18}}, 0x20000000)
sendmsg$nl_route(r2, &(0x7f0000000240)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000580)=ANY=[@ANYBLOB="4800000010000305ff810000fddbdf2500000000", @ANYRES32=r3, @ANYBLOB="1748000040000200280012800a000100767863616e0000001800028014000100000000", @ANYRES32=r3], 0x48}, 0x1, 0x0, 0x0, 0x40}, 0x0)
connect$inet(r1, &(0x7f0000000000)={0x2, 0x4e22, @empty}, 0x10)
setsockopt$sock_int(r1, 0x1, 0x9, &(0x7f00000003c0)=0x246, 0x4)
ioctl$FE_SET_PROPERTY(r0, 0x40106f52, &(0x7f00000000c0)={0x29, &(0x7f0000000200)=[{0x34, '\x00', @data=0x4}]})
syz_open_dev$dvb_frontend(&(0x7f0000000080), 0x0, 0x402) (async)
socket$inet_mptcp(0x2, 0x1, 0x106) (async)
socket(0x10, 0x803, 0x0) (async)
syz_genetlink_get_family_id$tipc(&(0x7f0000000000), r2) (async)
getsockname$packet(r2, &(0x7f0000000280)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) (async)
sendmsg$nl_route(r2, &(0x7f0000000180)={&(0x7f0000000040)={0x10, 0x0, 0x0, 0x400000}, 0xc, &(0x7f0000000140)={&(0x7f0000000100)=@RTM_GETMDB={0x18, 0x56, 0x2, 0x70bd25, 0x25dfdbfe, {0x7, r3}, [""]}, 0x18}}, 0x20000000) (async)
sendmsg$nl_route(r2, &(0x7f0000000240)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000580)=ANY=[@ANYBLOB="4800000010000305ff810000fddbdf2500000000", @ANYRES32=r3, @ANYBLOB="1748000040000200280012800a000100767863616e0000001800028014000100000000", @ANYRES32=r3], 0x48}, 0x1, 0x0, 0x0, 0x40}, 0x0) (async)
connect$inet(r1, &(0x7f0000000000)={0x2, 0x4e22, @empty}, 0x10) (async)
setsockopt$sock_int(r1, 0x1, 0x9, &(0x7f00000003c0)=0x246, 0x4) (async)
ioctl$FE_SET_PROPERTY(r0, 0x40106f52, &(0x7f00000000c0)={0x29, &(0x7f0000000200)=[{0x34, '\x00', @data=0x4}]}) (async)

program crashed: KASAN: slab-use-after-free Read in dvb_device_open
testing program (duration=45s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): [19, 34, 20]
detailed listing:
executing program 3:
r0 = socket$inet6_tcp(0xa, 0x1, 0x0)
connect$inet6(r0, 0x0, 0x0)
gettid()
timer_settime(0x0, 0x0, &(0x7f0000000280)={{0x0, 0x989680}, {0x0, 0x989680}}, 0x0)
socketpair$unix(0x1, 0x0, 0x0, 0x0)
getsockopt$sock_cred(0xffffffffffffffff, 0x1, 0x11, 0x0, &(0x7f0000cab000))
setsockopt$sock_cred(0xffffffffffffffff, 0x1, 0x11, 0x0, 0x0)
setsockopt$inet6_tcp_TCP_REPAIR_QUEUE(r0, 0x6, 0x14, 0x0, 0x0)
mmap(&(0x7f0000000000/0x4000)=nil, 0x4000, 0x1, 0x10012, 0xffffffffffffffff, 0x5deba000)
mmap(&(0x7f0000bfe000/0x400000)=nil, 0x400000, 0x4, 0x40010, r0, 0xd1aa000)
mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x3, 0x8031, 0xffffffffffffffff, 0x0)
mmap$dsp(&(0x7f0000ffd000/0x2000)=nil, 0x2000, 0x100000b, 0x810, 0xffffffffffffffff, 0x0)
socket$xdp(0x2c, 0x3, 0x0)
r1 = socket$kcm(0xa, 0x2, 0x0)
r2 = socket(0x2, 0x80805, 0x0)
r3 = openat$fuse(0xffffffffffffff9c, &(0x7f0000000080), 0x2, 0x0)
read$FUSE(r3, &(0x7f0000000600)={0x2020}, 0x2020)
setsockopt$IP_VS_SO_SET_ADD(r2, 0x0, 0x482, &(0x7f0000000240)={0x84, @dev={0xac, 0x14, 0x14, 0x15}, 0x4e20, 0x3, 'wlc\x00', 0x2, 0x660f537e, 0x3}, 0x2c)
sendmsg$sock(r1, &(0x7f0000000400)={&(0x7f0000000580)=@in6={0x2, 0x4e20, 0x0, @dev={0xfe, 0x80, '\x00', 0xfd}}, 0x80, 0x0, 0x0, &(0x7f0000000000)=[@mark={{0x14, 0x1, 0x24, 0x3}}], 0x18}, 0x0)
executing program 0:
r0 = syz_usb_connect(0x0, 0x32, &(0x7f0000000000)=ANY=[@ANYBLOB="1201000200000040a61b01000100000000010902200001010080320904"], 0x0)
r1 = openat$ptp1(0xffffffffffffff9c, &(0x7f0000000c40), 0x149201, 0x0)
ioctl$PTP_ENABLE_PPS(r1, 0x40043d04, 0x1)
r2 = socket$kcm(0x10, 0x2, 0x4)
sendmsg$inet(r2, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)=[{&(0x7f0000000100)="5c00000012006bab9e3fe3d86e6c1d0000147ea60864160af36504b68675f8001d000a00a0e69ee517d34460bc24eab556a705251e6182949a36c23d3b48dfd8cdbf9367b4fa51f60a64c9f4080003680601000008000300ff000000", 0x5c}], 0x1, 0x0, 0x0, 0x1f00c00e}, 0x0)
r3 = syz_usb_connect$uac3(0x3, 0x80, &(0x7f0000000280)=ANY=[], 0x0)
syz_usb_control_io(r0, 0x0, 0x0)
syz_usb_control_io$sierra_net(r0, 0x0, &(0x7f0000000700)={0x1c, &(0x7f0000000280)=ANY=[], 0x0, 0x0})
syz_usb_control_io$uac3(r3, 0x0, 0x0)
syz_usb_control_io$printer(r0, 0x0, &(0x7f00000005c0)={0x34, &(0x7f00000003c0)=ANY=[], 0x0, 0x0, 0x0, 0x0, 0x0})
mkdirat(0xffffffffffffff9c, &(0x7f0000000200)='./file0\x00', 0x0)
r4 = openat(0xffffffffffffff9c, &(0x7f0000000080)='./file0\x00', 0x0, 0xd5)
ioctl$FS_IOC_GETFLAGS(r4, 0x80086601, &(0x7f0000000100))
syz_open_dev$dvb_frontend(&(0x7f0000000100), 0x1, 0x802)
r5 = socket$inet6_sctp(0xa, 0x801, 0x84)
getsockopt$bt_hci(r5, 0x84, 0x81, &(0x7f0000001280)=""/4107, &(0x7f00000000c0)=0x100b)
r6 = socket$rxrpc(0x21, 0x2, 0x2)
setsockopt$RXRPC_MIN_SECURITY_LEVEL(r6, 0x110, 0x4, &(0x7f0000000440)=0x1, 0x4)
syz_usb_connect(0x0, 0x32, &(0x7f0000000000)=ANY=[@ANYBLOB="1201000200000040a61b01000100000000010902200001010080320904"], 0x0) (async)
openat$ptp1(0xffffffffffffff9c, &(0x7f0000000c40), 0x149201, 0x0) (async)
ioctl$PTP_ENABLE_PPS(r1, 0x40043d04, 0x1) (async)
socket$kcm(0x10, 0x2, 0x4) (async)
sendmsg$inet(r2, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)=[{&(0x7f0000000100)="5c00000012006bab9e3fe3d86e6c1d0000147ea60864160af36504b68675f8001d000a00a0e69ee517d34460bc24eab556a705251e6182949a36c23d3b48dfd8cdbf9367b4fa51f60a64c9f4080003680601000008000300ff000000", 0x5c}], 0x1, 0x0, 0x0, 0x1f00c00e}, 0x0) (async)
syz_usb_connect$uac3(0x3, 0x80, &(0x7f0000000280)=ANY=[], 0x0) (async)
syz_usb_control_io(r0, 0x0, 0x0) (async)
syz_usb_control_io$sierra_net(r0, 0x0, &(0x7f0000000700)={0x1c, &(0x7f0000000280)=ANY=[], 0x0, 0x0}) (async)
syz_usb_control_io$uac3(r3, 0x0, 0x0) (async)
syz_usb_control_io$printer(r0, 0x0, &(0x7f00000005c0)={0x34, &(0x7f00000003c0)=ANY=[], 0x0, 0x0, 0x0, 0x0, 0x0}) (async)
mkdirat(0xffffffffffffff9c, &(0x7f0000000200)='./file0\x00', 0x0) (async)
openat(0xffffffffffffff9c, &(0x7f0000000080)='./file0\x00', 0x0, 0xd5) (async)
ioctl$FS_IOC_GETFLAGS(r4, 0x80086601, &(0x7f0000000100)) (async)
syz_open_dev$dvb_frontend(&(0x7f0000000100), 0x1, 0x802) (async)
socket$inet6_sctp(0xa, 0x801, 0x84) (async)
getsockopt$bt_hci(r5, 0x84, 0x81, &(0x7f0000001280)=""/4107, &(0x7f00000000c0)=0x100b) (async)
executing program 4:
r0 = syz_open_dev$dvb_frontend(&(0x7f0000000080), 0x0, 0x402)
r1 = socket$inet_mptcp(0x2, 0x1, 0x106)
r2 = socket(0x10, 0x803, 0x0)
syz_genetlink_get_family_id$tipc(&(0x7f0000000000), r2)
getsockname$packet(r2, &(0x7f0000000280)={0x11, 0x0, <r3=>0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14)
sendmsg$nl_route(r2, &(0x7f0000000180)={&(0x7f0000000040)={0x10, 0x0, 0x0, 0x400000}, 0xc, &(0x7f0000000140)={&(0x7f0000000100)=@RTM_GETMDB={0x18, 0x56, 0x2, 0x70bd25, 0x25dfdbfe, {0x7, r3}, [""]}, 0x18}}, 0x20000000)
sendmsg$nl_route(r2, &(0x7f0000000240)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000580)=ANY=[@ANYBLOB="4800000010000305ff810000fddbdf2500000000", @ANYRES32=r3, @ANYBLOB="1748000040000200280012800a000100767863616e0000001800028014000100000000", @ANYRES32=r3], 0x48}, 0x1, 0x0, 0x0, 0x40}, 0x0)
connect$inet(r1, &(0x7f0000000000)={0x2, 0x4e22, @empty}, 0x10)
setsockopt$sock_int(r1, 0x1, 0x9, &(0x7f00000003c0)=0x246, 0x4)
ioctl$FE_SET_PROPERTY(r0, 0x40106f52, &(0x7f00000000c0)={0x29, &(0x7f0000000200)=[{0x34, '\x00', @data=0x4}]})
syz_open_dev$dvb_frontend(&(0x7f0000000080), 0x0, 0x402) (async)
socket$inet_mptcp(0x2, 0x1, 0x106) (async)
socket(0x10, 0x803, 0x0) (async)
syz_genetlink_get_family_id$tipc(&(0x7f0000000000), r2) (async)
getsockname$packet(r2, &(0x7f0000000280)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) (async)
sendmsg$nl_route(r2, &(0x7f0000000180)={&(0x7f0000000040)={0x10, 0x0, 0x0, 0x400000}, 0xc, &(0x7f0000000140)={&(0x7f0000000100)=@RTM_GETMDB={0x18, 0x56, 0x2, 0x70bd25, 0x25dfdbfe, {0x7, r3}, [""]}, 0x18}}, 0x20000000) (async)
sendmsg$nl_route(r2, &(0x7f0000000240)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000580)=ANY=[@ANYBLOB="4800000010000305ff810000fddbdf2500000000", @ANYRES32=r3, @ANYBLOB="1748000040000200280012800a000100767863616e0000001800028014000100000000", @ANYRES32=r3], 0x48}, 0x1, 0x0, 0x0, 0x40}, 0x0) (async)
connect$inet(r1, &(0x7f0000000000)={0x2, 0x4e22, @empty}, 0x10) (async)
setsockopt$sock_int(r1, 0x1, 0x9, &(0x7f00000003c0)=0x246, 0x4) (async)
ioctl$FE_SET_PROPERTY(r0, 0x40106f52, &(0x7f00000000c0)={0x29, &(0x7f0000000200)=[{0x34, '\x00', @data=0x4}]}) (async)

program crashed: KASAN: slab-use-after-free Read in dvb_device_open
testing program (duration=45s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): [19, 33, 20]
detailed listing:
executing program 3:
r0 = socket$inet6_tcp(0xa, 0x1, 0x0)
connect$inet6(r0, 0x0, 0x0)
gettid()
timer_settime(0x0, 0x0, &(0x7f0000000280)={{0x0, 0x989680}, {0x0, 0x989680}}, 0x0)
socketpair$unix(0x1, 0x0, 0x0, 0x0)
getsockopt$sock_cred(0xffffffffffffffff, 0x1, 0x11, 0x0, &(0x7f0000cab000))
setsockopt$sock_cred(0xffffffffffffffff, 0x1, 0x11, 0x0, 0x0)
setsockopt$inet6_tcp_TCP_REPAIR_QUEUE(r0, 0x6, 0x14, 0x0, 0x0)
mmap(&(0x7f0000000000/0x4000)=nil, 0x4000, 0x1, 0x10012, 0xffffffffffffffff, 0x5deba000)
mmap(&(0x7f0000bfe000/0x400000)=nil, 0x400000, 0x4, 0x40010, r0, 0xd1aa000)
mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x3, 0x8031, 0xffffffffffffffff, 0x0)
mmap$dsp(&(0x7f0000ffd000/0x2000)=nil, 0x2000, 0x100000b, 0x810, 0xffffffffffffffff, 0x0)
socket$xdp(0x2c, 0x3, 0x0)
r1 = socket$kcm(0xa, 0x2, 0x0)
r2 = socket(0x2, 0x80805, 0x0)
r3 = openat$fuse(0xffffffffffffff9c, &(0x7f0000000080), 0x2, 0x0)
read$FUSE(r3, &(0x7f0000000600)={0x2020}, 0x2020)
setsockopt$IP_VS_SO_SET_ADD(r2, 0x0, 0x482, &(0x7f0000000240)={0x84, @dev={0xac, 0x14, 0x14, 0x15}, 0x4e20, 0x3, 'wlc\x00', 0x2, 0x660f537e, 0x3}, 0x2c)
sendmsg$sock(r1, &(0x7f0000000400)={&(0x7f0000000580)=@in6={0x2, 0x4e20, 0x0, @dev={0xfe, 0x80, '\x00', 0xfd}}, 0x80, 0x0, 0x0, &(0x7f0000000000)=[@mark={{0x14, 0x1, 0x24, 0x3}}], 0x18}, 0x0)
executing program 0:
r0 = syz_usb_connect(0x0, 0x32, &(0x7f0000000000)=ANY=[@ANYBLOB="1201000200000040a61b01000100000000010902200001010080320904"], 0x0)
r1 = openat$ptp1(0xffffffffffffff9c, &(0x7f0000000c40), 0x149201, 0x0)
ioctl$PTP_ENABLE_PPS(r1, 0x40043d04, 0x1)
r2 = socket$kcm(0x10, 0x2, 0x4)
sendmsg$inet(r2, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)=[{&(0x7f0000000100)="5c00000012006bab9e3fe3d86e6c1d0000147ea60864160af36504b68675f8001d000a00a0e69ee517d34460bc24eab556a705251e6182949a36c23d3b48dfd8cdbf9367b4fa51f60a64c9f4080003680601000008000300ff000000", 0x5c}], 0x1, 0x0, 0x0, 0x1f00c00e}, 0x0)
r3 = syz_usb_connect$uac3(0x3, 0x80, &(0x7f0000000280)=ANY=[], 0x0)
syz_usb_control_io(r0, 0x0, 0x0)
syz_usb_control_io$sierra_net(r0, 0x0, &(0x7f0000000700)={0x1c, &(0x7f0000000280)=ANY=[], 0x0, 0x0})
syz_usb_control_io$uac3(r3, 0x0, 0x0)
syz_usb_control_io$printer(r0, 0x0, &(0x7f00000005c0)={0x34, &(0x7f00000003c0)=ANY=[], 0x0, 0x0, 0x0, 0x0, 0x0})
mkdirat(0xffffffffffffff9c, &(0x7f0000000200)='./file0\x00', 0x0)
r4 = openat(0xffffffffffffff9c, &(0x7f0000000080)='./file0\x00', 0x0, 0xd5)
ioctl$FS_IOC_GETFLAGS(r4, 0x80086601, &(0x7f0000000100))
syz_open_dev$dvb_frontend(&(0x7f0000000100), 0x1, 0x802)
r5 = socket$inet6_sctp(0xa, 0x801, 0x84)
getsockopt$bt_hci(r5, 0x84, 0x81, &(0x7f0000001280)=""/4107, &(0x7f00000000c0)=0x100b)
r6 = socket$rxrpc(0x21, 0x2, 0x2)
setsockopt$RXRPC_MIN_SECURITY_LEVEL(r6, 0x110, 0x4, &(0x7f0000000440)=0x1, 0x4)
syz_usb_connect(0x0, 0x32, &(0x7f0000000000)=ANY=[@ANYBLOB="1201000200000040a61b01000100000000010902200001010080320904"], 0x0) (async)
openat$ptp1(0xffffffffffffff9c, &(0x7f0000000c40), 0x149201, 0x0) (async)
ioctl$PTP_ENABLE_PPS(r1, 0x40043d04, 0x1) (async)
socket$kcm(0x10, 0x2, 0x4) (async)
sendmsg$inet(r2, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)=[{&(0x7f0000000100)="5c00000012006bab9e3fe3d86e6c1d0000147ea60864160af36504b68675f8001d000a00a0e69ee517d34460bc24eab556a705251e6182949a36c23d3b48dfd8cdbf9367b4fa51f60a64c9f4080003680601000008000300ff000000", 0x5c}], 0x1, 0x0, 0x0, 0x1f00c00e}, 0x0) (async)
syz_usb_connect$uac3(0x3, 0x80, &(0x7f0000000280)=ANY=[], 0x0) (async)
syz_usb_control_io(r0, 0x0, 0x0) (async)
syz_usb_control_io$sierra_net(r0, 0x0, &(0x7f0000000700)={0x1c, &(0x7f0000000280)=ANY=[], 0x0, 0x0}) (async)
syz_usb_control_io$uac3(r3, 0x0, 0x0) (async)
syz_usb_control_io$printer(r0, 0x0, &(0x7f00000005c0)={0x34, &(0x7f00000003c0)=ANY=[], 0x0, 0x0, 0x0, 0x0, 0x0}) (async)
mkdirat(0xffffffffffffff9c, &(0x7f0000000200)='./file0\x00', 0x0) (async)
openat(0xffffffffffffff9c, &(0x7f0000000080)='./file0\x00', 0x0, 0xd5) (async)
ioctl$FS_IOC_GETFLAGS(r4, 0x80086601, &(0x7f0000000100)) (async)
syz_open_dev$dvb_frontend(&(0x7f0000000100), 0x1, 0x802) (async)
socket$inet6_sctp(0xa, 0x801, 0x84) (async)
executing program 4:
r0 = syz_open_dev$dvb_frontend(&(0x7f0000000080), 0x0, 0x402)
r1 = socket$inet_mptcp(0x2, 0x1, 0x106)
r2 = socket(0x10, 0x803, 0x0)
syz_genetlink_get_family_id$tipc(&(0x7f0000000000), r2)
getsockname$packet(r2, &(0x7f0000000280)={0x11, 0x0, <r3=>0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14)
sendmsg$nl_route(r2, &(0x7f0000000180)={&(0x7f0000000040)={0x10, 0x0, 0x0, 0x400000}, 0xc, &(0x7f0000000140)={&(0x7f0000000100)=@RTM_GETMDB={0x18, 0x56, 0x2, 0x70bd25, 0x25dfdbfe, {0x7, r3}, [""]}, 0x18}}, 0x20000000)
sendmsg$nl_route(r2, &(0x7f0000000240)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000580)=ANY=[@ANYBLOB="4800000010000305ff810000fddbdf2500000000", @ANYRES32=r3, @ANYBLOB="1748000040000200280012800a000100767863616e0000001800028014000100000000", @ANYRES32=r3], 0x48}, 0x1, 0x0, 0x0, 0x40}, 0x0)
connect$inet(r1, &(0x7f0000000000)={0x2, 0x4e22, @empty}, 0x10)
setsockopt$sock_int(r1, 0x1, 0x9, &(0x7f00000003c0)=0x246, 0x4)
ioctl$FE_SET_PROPERTY(r0, 0x40106f52, &(0x7f00000000c0)={0x29, &(0x7f0000000200)=[{0x34, '\x00', @data=0x4}]})
syz_open_dev$dvb_frontend(&(0x7f0000000080), 0x0, 0x402) (async)
socket$inet_mptcp(0x2, 0x1, 0x106) (async)
socket(0x10, 0x803, 0x0) (async)
syz_genetlink_get_family_id$tipc(&(0x7f0000000000), r2) (async)
getsockname$packet(r2, &(0x7f0000000280)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) (async)
sendmsg$nl_route(r2, &(0x7f0000000180)={&(0x7f0000000040)={0x10, 0x0, 0x0, 0x400000}, 0xc, &(0x7f0000000140)={&(0x7f0000000100)=@RTM_GETMDB={0x18, 0x56, 0x2, 0x70bd25, 0x25dfdbfe, {0x7, r3}, [""]}, 0x18}}, 0x20000000) (async)
sendmsg$nl_route(r2, &(0x7f0000000240)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000580)=ANY=[@ANYBLOB="4800000010000305ff810000fddbdf2500000000", @ANYRES32=r3, @ANYBLOB="1748000040000200280012800a000100767863616e0000001800028014000100000000", @ANYRES32=r3], 0x48}, 0x1, 0x0, 0x0, 0x40}, 0x0) (async)
connect$inet(r1, &(0x7f0000000000)={0x2, 0x4e22, @empty}, 0x10) (async)
setsockopt$sock_int(r1, 0x1, 0x9, &(0x7f00000003c0)=0x246, 0x4) (async)
ioctl$FE_SET_PROPERTY(r0, 0x40106f52, &(0x7f00000000c0)={0x29, &(0x7f0000000200)=[{0x34, '\x00', @data=0x4}]}) (async)

program did not crash
testing program (duration=45s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): [19, 33, 20]
detailed listing:
executing program 3:
r0 = socket$inet6_tcp(0xa, 0x1, 0x0)
connect$inet6(r0, 0x0, 0x0)
gettid()
timer_settime(0x0, 0x0, &(0x7f0000000280)={{0x0, 0x989680}, {0x0, 0x989680}}, 0x0)
socketpair$unix(0x1, 0x0, 0x0, 0x0)
getsockopt$sock_cred(0xffffffffffffffff, 0x1, 0x11, 0x0, &(0x7f0000cab000))
setsockopt$sock_cred(0xffffffffffffffff, 0x1, 0x11, 0x0, 0x0)
setsockopt$inet6_tcp_TCP_REPAIR_QUEUE(r0, 0x6, 0x14, 0x0, 0x0)
mmap(&(0x7f0000000000/0x4000)=nil, 0x4000, 0x1, 0x10012, 0xffffffffffffffff, 0x5deba000)
mmap(&(0x7f0000bfe000/0x400000)=nil, 0x400000, 0x4, 0x40010, r0, 0xd1aa000)
mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x3, 0x8031, 0xffffffffffffffff, 0x0)
mmap$dsp(&(0x7f0000ffd000/0x2000)=nil, 0x2000, 0x100000b, 0x810, 0xffffffffffffffff, 0x0)
socket$xdp(0x2c, 0x3, 0x0)
r1 = socket$kcm(0xa, 0x2, 0x0)
r2 = socket(0x2, 0x80805, 0x0)
r3 = openat$fuse(0xffffffffffffff9c, &(0x7f0000000080), 0x2, 0x0)
read$FUSE(r3, &(0x7f0000000600)={0x2020}, 0x2020)
setsockopt$IP_VS_SO_SET_ADD(r2, 0x0, 0x482, &(0x7f0000000240)={0x84, @dev={0xac, 0x14, 0x14, 0x15}, 0x4e20, 0x3, 'wlc\x00', 0x2, 0x660f537e, 0x3}, 0x2c)
sendmsg$sock(r1, &(0x7f0000000400)={&(0x7f0000000580)=@in6={0x2, 0x4e20, 0x0, @dev={0xfe, 0x80, '\x00', 0xfd}}, 0x80, 0x0, 0x0, &(0x7f0000000000)=[@mark={{0x14, 0x1, 0x24, 0x3}}], 0x18}, 0x0)
executing program 0:
r0 = syz_usb_connect(0x0, 0x32, &(0x7f0000000000)=ANY=[@ANYBLOB="1201000200000040a61b01000100000000010902200001010080320904"], 0x0)
r1 = openat$ptp1(0xffffffffffffff9c, &(0x7f0000000c40), 0x149201, 0x0)
ioctl$PTP_ENABLE_PPS(r1, 0x40043d04, 0x1)
r2 = socket$kcm(0x10, 0x2, 0x4)
sendmsg$inet(r2, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)=[{&(0x7f0000000100)="5c00000012006bab9e3fe3d86e6c1d0000147ea60864160af36504b68675f8001d000a00a0e69ee517d34460bc24eab556a705251e6182949a36c23d3b48dfd8cdbf9367b4fa51f60a64c9f4080003680601000008000300ff000000", 0x5c}], 0x1, 0x0, 0x0, 0x1f00c00e}, 0x0)
r3 = syz_usb_connect$uac3(0x3, 0x80, &(0x7f0000000280)=ANY=[], 0x0)
syz_usb_control_io(r0, 0x0, 0x0)
syz_usb_control_io$sierra_net(r0, 0x0, &(0x7f0000000700)={0x1c, &(0x7f0000000280)=ANY=[], 0x0, 0x0})
syz_usb_control_io$uac3(r3, 0x0, 0x0)
syz_usb_control_io$printer(r0, 0x0, &(0x7f00000005c0)={0x34, &(0x7f00000003c0)=ANY=[], 0x0, 0x0, 0x0, 0x0, 0x0})
mkdirat(0xffffffffffffff9c, &(0x7f0000000200)='./file0\x00', 0x0)
r4 = openat(0xffffffffffffff9c, &(0x7f0000000080)='./file0\x00', 0x0, 0xd5)
ioctl$FS_IOC_GETFLAGS(r4, 0x80086601, &(0x7f0000000100))
syz_open_dev$dvb_frontend(&(0x7f0000000100), 0x1, 0x802)
r5 = socket$inet6_sctp(0xa, 0x801, 0x84)
getsockopt$bt_hci(r5, 0x84, 0x81, &(0x7f0000001280)=""/4107, &(0x7f00000000c0)=0x100b)
r6 = socket$rxrpc(0x21, 0x2, 0x2)
setsockopt$RXRPC_MIN_SECURITY_LEVEL(r6, 0x110, 0x4, &(0x7f0000000440)=0x1, 0x4)
syz_usb_connect(0x0, 0x32, &(0x7f0000000000)=ANY=[@ANYBLOB="1201000200000040a61b01000100000000010902200001010080320904"], 0x0) (async)
openat$ptp1(0xffffffffffffff9c, &(0x7f0000000c40), 0x149201, 0x0) (async)
ioctl$PTP_ENABLE_PPS(r1, 0x40043d04, 0x1) (async)
socket$kcm(0x10, 0x2, 0x4) (async)
sendmsg$inet(r2, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)=[{&(0x7f0000000100)="5c00000012006bab9e3fe3d86e6c1d0000147ea60864160af36504b68675f8001d000a00a0e69ee517d34460bc24eab556a705251e6182949a36c23d3b48dfd8cdbf9367b4fa51f60a64c9f4080003680601000008000300ff000000", 0x5c}], 0x1, 0x0, 0x0, 0x1f00c00e}, 0x0) (async)
syz_usb_connect$uac3(0x3, 0x80, &(0x7f0000000280)=ANY=[], 0x0) (async)
syz_usb_control_io(r0, 0x0, 0x0) (async)
syz_usb_control_io$sierra_net(r0, 0x0, &(0x7f0000000700)={0x1c, &(0x7f0000000280)=ANY=[], 0x0, 0x0}) (async)
syz_usb_control_io$uac3(r3, 0x0, 0x0) (async)
syz_usb_control_io$printer(r0, 0x0, &(0x7f00000005c0)={0x34, &(0x7f00000003c0)=ANY=[], 0x0, 0x0, 0x0, 0x0, 0x0}) (async)
mkdirat(0xffffffffffffff9c, &(0x7f0000000200)='./file0\x00', 0x0) (async)
openat(0xffffffffffffff9c, &(0x7f0000000080)='./file0\x00', 0x0, 0xd5) (async)
ioctl$FS_IOC_GETFLAGS(r4, 0x80086601, &(0x7f0000000100)) (async)
syz_open_dev$dvb_frontend(&(0x7f0000000100), 0x1, 0x802) (async)
getsockopt$bt_hci(r5, 0x84, 0x81, &(0x7f0000001280)=""/4107, &(0x7f00000000c0)=0x100b) (async)
executing program 4:
r0 = syz_open_dev$dvb_frontend(&(0x7f0000000080), 0x0, 0x402)
r1 = socket$inet_mptcp(0x2, 0x1, 0x106)
r2 = socket(0x10, 0x803, 0x0)
syz_genetlink_get_family_id$tipc(&(0x7f0000000000), r2)
getsockname$packet(r2, &(0x7f0000000280)={0x11, 0x0, <r3=>0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14)
sendmsg$nl_route(r2, &(0x7f0000000180)={&(0x7f0000000040)={0x10, 0x0, 0x0, 0x400000}, 0xc, &(0x7f0000000140)={&(0x7f0000000100)=@RTM_GETMDB={0x18, 0x56, 0x2, 0x70bd25, 0x25dfdbfe, {0x7, r3}, [""]}, 0x18}}, 0x20000000)
sendmsg$nl_route(r2, &(0x7f0000000240)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000580)=ANY=[@ANYBLOB="4800000010000305ff810000fddbdf2500000000", @ANYRES32=r3, @ANYBLOB="1748000040000200280012800a000100767863616e0000001800028014000100000000", @ANYRES32=r3], 0x48}, 0x1, 0x0, 0x0, 0x40}, 0x0)
connect$inet(r1, &(0x7f0000000000)={0x2, 0x4e22, @empty}, 0x10)
setsockopt$sock_int(r1, 0x1, 0x9, &(0x7f00000003c0)=0x246, 0x4)
ioctl$FE_SET_PROPERTY(r0, 0x40106f52, &(0x7f00000000c0)={0x29, &(0x7f0000000200)=[{0x34, '\x00', @data=0x4}]})
syz_open_dev$dvb_frontend(&(0x7f0000000080), 0x0, 0x402) (async)
socket$inet_mptcp(0x2, 0x1, 0x106) (async)
socket(0x10, 0x803, 0x0) (async)
syz_genetlink_get_family_id$tipc(&(0x7f0000000000), r2) (async)
getsockname$packet(r2, &(0x7f0000000280)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) (async)
sendmsg$nl_route(r2, &(0x7f0000000180)={&(0x7f0000000040)={0x10, 0x0, 0x0, 0x400000}, 0xc, &(0x7f0000000140)={&(0x7f0000000100)=@RTM_GETMDB={0x18, 0x56, 0x2, 0x70bd25, 0x25dfdbfe, {0x7, r3}, [""]}, 0x18}}, 0x20000000) (async)
sendmsg$nl_route(r2, &(0x7f0000000240)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000580)=ANY=[@ANYBLOB="4800000010000305ff810000fddbdf2500000000", @ANYRES32=r3, @ANYBLOB="1748000040000200280012800a000100767863616e0000001800028014000100000000", @ANYRES32=r3], 0x48}, 0x1, 0x0, 0x0, 0x40}, 0x0) (async)
connect$inet(r1, &(0x7f0000000000)={0x2, 0x4e22, @empty}, 0x10) (async)
setsockopt$sock_int(r1, 0x1, 0x9, &(0x7f00000003c0)=0x246, 0x4) (async)
ioctl$FE_SET_PROPERTY(r0, 0x40106f52, &(0x7f00000000c0)={0x29, &(0x7f0000000200)=[{0x34, '\x00', @data=0x4}]}) (async)

program crashed: KASAN: slab-use-after-free Read in dvb_device_open
testing program (duration=45s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): [19, 32, 20]
detailed listing:
executing program 3:
r0 = socket$inet6_tcp(0xa, 0x1, 0x0)
connect$inet6(r0, 0x0, 0x0)
gettid()
timer_settime(0x0, 0x0, &(0x7f0000000280)={{0x0, 0x989680}, {0x0, 0x989680}}, 0x0)
socketpair$unix(0x1, 0x0, 0x0, 0x0)
getsockopt$sock_cred(0xffffffffffffffff, 0x1, 0x11, 0x0, &(0x7f0000cab000))
setsockopt$sock_cred(0xffffffffffffffff, 0x1, 0x11, 0x0, 0x0)
setsockopt$inet6_tcp_TCP_REPAIR_QUEUE(r0, 0x6, 0x14, 0x0, 0x0)
mmap(&(0x7f0000000000/0x4000)=nil, 0x4000, 0x1, 0x10012, 0xffffffffffffffff, 0x5deba000)
mmap(&(0x7f0000bfe000/0x400000)=nil, 0x400000, 0x4, 0x40010, r0, 0xd1aa000)
mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x3, 0x8031, 0xffffffffffffffff, 0x0)
mmap$dsp(&(0x7f0000ffd000/0x2000)=nil, 0x2000, 0x100000b, 0x810, 0xffffffffffffffff, 0x0)
socket$xdp(0x2c, 0x3, 0x0)
r1 = socket$kcm(0xa, 0x2, 0x0)
r2 = socket(0x2, 0x80805, 0x0)
r3 = openat$fuse(0xffffffffffffff9c, &(0x7f0000000080), 0x2, 0x0)
read$FUSE(r3, &(0x7f0000000600)={0x2020}, 0x2020)
setsockopt$IP_VS_SO_SET_ADD(r2, 0x0, 0x482, &(0x7f0000000240)={0x84, @dev={0xac, 0x14, 0x14, 0x15}, 0x4e20, 0x3, 'wlc\x00', 0x2, 0x660f537e, 0x3}, 0x2c)
sendmsg$sock(r1, &(0x7f0000000400)={&(0x7f0000000580)=@in6={0x2, 0x4e20, 0x0, @dev={0xfe, 0x80, '\x00', 0xfd}}, 0x80, 0x0, 0x0, &(0x7f0000000000)=[@mark={{0x14, 0x1, 0x24, 0x3}}], 0x18}, 0x0)
executing program 0:
r0 = syz_usb_connect(0x0, 0x32, &(0x7f0000000000)=ANY=[@ANYBLOB="1201000200000040a61b01000100000000010902200001010080320904"], 0x0)
r1 = openat$ptp1(0xffffffffffffff9c, &(0x7f0000000c40), 0x149201, 0x0)
ioctl$PTP_ENABLE_PPS(r1, 0x40043d04, 0x1)
r2 = socket$kcm(0x10, 0x2, 0x4)
sendmsg$inet(r2, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)=[{&(0x7f0000000100)="5c00000012006bab9e3fe3d86e6c1d0000147ea60864160af36504b68675f8001d000a00a0e69ee517d34460bc24eab556a705251e6182949a36c23d3b48dfd8cdbf9367b4fa51f60a64c9f4080003680601000008000300ff000000", 0x5c}], 0x1, 0x0, 0x0, 0x1f00c00e}, 0x0)
r3 = syz_usb_connect$uac3(0x3, 0x80, &(0x7f0000000280)=ANY=[], 0x0)
syz_usb_control_io(r0, 0x0, 0x0)
syz_usb_control_io$sierra_net(r0, 0x0, &(0x7f0000000700)={0x1c, &(0x7f0000000280)=ANY=[], 0x0, 0x0})
syz_usb_control_io$uac3(r3, 0x0, 0x0)
syz_usb_control_io$printer(r0, 0x0, &(0x7f00000005c0)={0x34, &(0x7f00000003c0)=ANY=[], 0x0, 0x0, 0x0, 0x0, 0x0})
mkdirat(0xffffffffffffff9c, &(0x7f0000000200)='./file0\x00', 0x0)
r4 = openat(0xffffffffffffff9c, &(0x7f0000000080)='./file0\x00', 0x0, 0xd5)
ioctl$FS_IOC_GETFLAGS(r4, 0x80086601, &(0x7f0000000100))
syz_open_dev$dvb_frontend(&(0x7f0000000100), 0x1, 0x802)
r5 = socket$inet6_sctp(0xa, 0x801, 0x84)
getsockopt$bt_hci(r5, 0x84, 0x81, &(0x7f0000001280)=""/4107, &(0x7f00000000c0)=0x100b)
r6 = socket$rxrpc(0x21, 0x2, 0x2)
setsockopt$RXRPC_MIN_SECURITY_LEVEL(r6, 0x110, 0x4, &(0x7f0000000440)=0x1, 0x4)
syz_usb_connect(0x0, 0x32, &(0x7f0000000000)=ANY=[@ANYBLOB="1201000200000040a61b01000100000000010902200001010080320904"], 0x0) (async)
openat$ptp1(0xffffffffffffff9c, &(0x7f0000000c40), 0x149201, 0x0) (async)
ioctl$PTP_ENABLE_PPS(r1, 0x40043d04, 0x1) (async)
socket$kcm(0x10, 0x2, 0x4) (async)
sendmsg$inet(r2, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)=[{&(0x7f0000000100)="5c00000012006bab9e3fe3d86e6c1d0000147ea60864160af36504b68675f8001d000a00a0e69ee517d34460bc24eab556a705251e6182949a36c23d3b48dfd8cdbf9367b4fa51f60a64c9f4080003680601000008000300ff000000", 0x5c}], 0x1, 0x0, 0x0, 0x1f00c00e}, 0x0) (async)
syz_usb_connect$uac3(0x3, 0x80, &(0x7f0000000280)=ANY=[], 0x0) (async)
syz_usb_control_io(r0, 0x0, 0x0) (async)
syz_usb_control_io$sierra_net(r0, 0x0, &(0x7f0000000700)={0x1c, &(0x7f0000000280)=ANY=[], 0x0, 0x0}) (async)
syz_usb_control_io$uac3(r3, 0x0, 0x0) (async)
syz_usb_control_io$printer(r0, 0x0, &(0x7f00000005c0)={0x34, &(0x7f00000003c0)=ANY=[], 0x0, 0x0, 0x0, 0x0, 0x0}) (async)
mkdirat(0xffffffffffffff9c, &(0x7f0000000200)='./file0\x00', 0x0) (async)
openat(0xffffffffffffff9c, &(0x7f0000000080)='./file0\x00', 0x0, 0xd5) (async)
ioctl$FS_IOC_GETFLAGS(r4, 0x80086601, &(0x7f0000000100)) (async)
getsockopt$bt_hci(r5, 0x84, 0x81, &(0x7f0000001280)=""/4107, &(0x7f00000000c0)=0x100b) (async)
executing program 4:
r0 = syz_open_dev$dvb_frontend(&(0x7f0000000080), 0x0, 0x402)
r1 = socket$inet_mptcp(0x2, 0x1, 0x106)
r2 = socket(0x10, 0x803, 0x0)
syz_genetlink_get_family_id$tipc(&(0x7f0000000000), r2)
getsockname$packet(r2, &(0x7f0000000280)={0x11, 0x0, <r3=>0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14)
sendmsg$nl_route(r2, &(0x7f0000000180)={&(0x7f0000000040)={0x10, 0x0, 0x0, 0x400000}, 0xc, &(0x7f0000000140)={&(0x7f0000000100)=@RTM_GETMDB={0x18, 0x56, 0x2, 0x70bd25, 0x25dfdbfe, {0x7, r3}, [""]}, 0x18}}, 0x20000000)
sendmsg$nl_route(r2, &(0x7f0000000240)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000580)=ANY=[@ANYBLOB="4800000010000305ff810000fddbdf2500000000", @ANYRES32=r3, @ANYBLOB="1748000040000200280012800a000100767863616e0000001800028014000100000000", @ANYRES32=r3], 0x48}, 0x1, 0x0, 0x0, 0x40}, 0x0)
connect$inet(r1, &(0x7f0000000000)={0x2, 0x4e22, @empty}, 0x10)
setsockopt$sock_int(r1, 0x1, 0x9, &(0x7f00000003c0)=0x246, 0x4)
ioctl$FE_SET_PROPERTY(r0, 0x40106f52, &(0x7f00000000c0)={0x29, &(0x7f0000000200)=[{0x34, '\x00', @data=0x4}]})
syz_open_dev$dvb_frontend(&(0x7f0000000080), 0x0, 0x402) (async)
socket$inet_mptcp(0x2, 0x1, 0x106) (async)
socket(0x10, 0x803, 0x0) (async)
syz_genetlink_get_family_id$tipc(&(0x7f0000000000), r2) (async)
getsockname$packet(r2, &(0x7f0000000280)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) (async)
sendmsg$nl_route(r2, &(0x7f0000000180)={&(0x7f0000000040)={0x10, 0x0, 0x0, 0x400000}, 0xc, &(0x7f0000000140)={&(0x7f0000000100)=@RTM_GETMDB={0x18, 0x56, 0x2, 0x70bd25, 0x25dfdbfe, {0x7, r3}, [""]}, 0x18}}, 0x20000000) (async)
sendmsg$nl_route(r2, &(0x7f0000000240)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000580)=ANY=[@ANYBLOB="4800000010000305ff810000fddbdf2500000000", @ANYRES32=r3, @ANYBLOB="1748000040000200280012800a000100767863616e0000001800028014000100000000", @ANYRES32=r3], 0x48}, 0x1, 0x0, 0x0, 0x40}, 0x0) (async)
connect$inet(r1, &(0x7f0000000000)={0x2, 0x4e22, @empty}, 0x10) (async)
setsockopt$sock_int(r1, 0x1, 0x9, &(0x7f00000003c0)=0x246, 0x4) (async)
ioctl$FE_SET_PROPERTY(r0, 0x40106f52, &(0x7f00000000c0)={0x29, &(0x7f0000000200)=[{0x34, '\x00', @data=0x4}]}) (async)

program did not crash
testing program (duration=45s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): [19, 32, 20]
detailed listing:
executing program 3:
r0 = socket$inet6_tcp(0xa, 0x1, 0x0)
connect$inet6(r0, 0x0, 0x0)
gettid()
timer_settime(0x0, 0x0, &(0x7f0000000280)={{0x0, 0x989680}, {0x0, 0x989680}}, 0x0)
socketpair$unix(0x1, 0x0, 0x0, 0x0)
getsockopt$sock_cred(0xffffffffffffffff, 0x1, 0x11, 0x0, &(0x7f0000cab000))
setsockopt$sock_cred(0xffffffffffffffff, 0x1, 0x11, 0x0, 0x0)
setsockopt$inet6_tcp_TCP_REPAIR_QUEUE(r0, 0x6, 0x14, 0x0, 0x0)
mmap(&(0x7f0000000000/0x4000)=nil, 0x4000, 0x1, 0x10012, 0xffffffffffffffff, 0x5deba000)
mmap(&(0x7f0000bfe000/0x400000)=nil, 0x400000, 0x4, 0x40010, r0, 0xd1aa000)
mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x3, 0x8031, 0xffffffffffffffff, 0x0)
mmap$dsp(&(0x7f0000ffd000/0x2000)=nil, 0x2000, 0x100000b, 0x810, 0xffffffffffffffff, 0x0)
socket$xdp(0x2c, 0x3, 0x0)
r1 = socket$kcm(0xa, 0x2, 0x0)
r2 = socket(0x2, 0x80805, 0x0)
r3 = openat$fuse(0xffffffffffffff9c, &(0x7f0000000080), 0x2, 0x0)
read$FUSE(r3, &(0x7f0000000600)={0x2020}, 0x2020)
setsockopt$IP_VS_SO_SET_ADD(r2, 0x0, 0x482, &(0x7f0000000240)={0x84, @dev={0xac, 0x14, 0x14, 0x15}, 0x4e20, 0x3, 'wlc\x00', 0x2, 0x660f537e, 0x3}, 0x2c)
sendmsg$sock(r1, &(0x7f0000000400)={&(0x7f0000000580)=@in6={0x2, 0x4e20, 0x0, @dev={0xfe, 0x80, '\x00', 0xfd}}, 0x80, 0x0, 0x0, &(0x7f0000000000)=[@mark={{0x14, 0x1, 0x24, 0x3}}], 0x18}, 0x0)
executing program 0:
r0 = syz_usb_connect(0x0, 0x32, &(0x7f0000000000)=ANY=[@ANYBLOB="1201000200000040a61b01000100000000010902200001010080320904"], 0x0)
r1 = openat$ptp1(0xffffffffffffff9c, &(0x7f0000000c40), 0x149201, 0x0)
ioctl$PTP_ENABLE_PPS(r1, 0x40043d04, 0x1)
r2 = socket$kcm(0x10, 0x2, 0x4)
sendmsg$inet(r2, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)=[{&(0x7f0000000100)="5c00000012006bab9e3fe3d86e6c1d0000147ea60864160af36504b68675f8001d000a00a0e69ee517d34460bc24eab556a705251e6182949a36c23d3b48dfd8cdbf9367b4fa51f60a64c9f4080003680601000008000300ff000000", 0x5c}], 0x1, 0x0, 0x0, 0x1f00c00e}, 0x0)
r3 = syz_usb_connect$uac3(0x3, 0x80, &(0x7f0000000280)=ANY=[], 0x0)
syz_usb_control_io(r0, 0x0, 0x0)
syz_usb_control_io$sierra_net(r0, 0x0, &(0x7f0000000700)={0x1c, &(0x7f0000000280)=ANY=[], 0x0, 0x0})
syz_usb_control_io$uac3(r3, 0x0, 0x0)
syz_usb_control_io$printer(r0, 0x0, &(0x7f00000005c0)={0x34, &(0x7f00000003c0)=ANY=[], 0x0, 0x0, 0x0, 0x0, 0x0})
mkdirat(0xffffffffffffff9c, &(0x7f0000000200)='./file0\x00', 0x0)
r4 = openat(0xffffffffffffff9c, &(0x7f0000000080)='./file0\x00', 0x0, 0xd5)
ioctl$FS_IOC_GETFLAGS(r4, 0x80086601, &(0x7f0000000100))
syz_open_dev$dvb_frontend(&(0x7f0000000100), 0x1, 0x802)
r5 = socket$inet6_sctp(0xa, 0x801, 0x84)
getsockopt$bt_hci(r5, 0x84, 0x81, &(0x7f0000001280)=""/4107, &(0x7f00000000c0)=0x100b)
r6 = socket$rxrpc(0x21, 0x2, 0x2)
setsockopt$RXRPC_MIN_SECURITY_LEVEL(r6, 0x110, 0x4, &(0x7f0000000440)=0x1, 0x4)
syz_usb_connect(0x0, 0x32, &(0x7f0000000000)=ANY=[@ANYBLOB="1201000200000040a61b01000100000000010902200001010080320904"], 0x0) (async)
openat$ptp1(0xffffffffffffff9c, &(0x7f0000000c40), 0x149201, 0x0) (async)
ioctl$PTP_ENABLE_PPS(r1, 0x40043d04, 0x1) (async)
socket$kcm(0x10, 0x2, 0x4) (async)
sendmsg$inet(r2, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)=[{&(0x7f0000000100)="5c00000012006bab9e3fe3d86e6c1d0000147ea60864160af36504b68675f8001d000a00a0e69ee517d34460bc24eab556a705251e6182949a36c23d3b48dfd8cdbf9367b4fa51f60a64c9f4080003680601000008000300ff000000", 0x5c}], 0x1, 0x0, 0x0, 0x1f00c00e}, 0x0) (async)
syz_usb_connect$uac3(0x3, 0x80, &(0x7f0000000280)=ANY=[], 0x0) (async)
syz_usb_control_io(r0, 0x0, 0x0) (async)
syz_usb_control_io$sierra_net(r0, 0x0, &(0x7f0000000700)={0x1c, &(0x7f0000000280)=ANY=[], 0x0, 0x0}) (async)
syz_usb_control_io$uac3(r3, 0x0, 0x0) (async)
syz_usb_control_io$printer(r0, 0x0, &(0x7f00000005c0)={0x34, &(0x7f00000003c0)=ANY=[], 0x0, 0x0, 0x0, 0x0, 0x0}) (async)
mkdirat(0xffffffffffffff9c, &(0x7f0000000200)='./file0\x00', 0x0) (async)
openat(0xffffffffffffff9c, &(0x7f0000000080)='./file0\x00', 0x0, 0xd5) (async)
syz_open_dev$dvb_frontend(&(0x7f0000000100), 0x1, 0x802) (async)
getsockopt$bt_hci(r5, 0x84, 0x81, &(0x7f0000001280)=""/4107, &(0x7f00000000c0)=0x100b) (async)
executing program 4:
r0 = syz_open_dev$dvb_frontend(&(0x7f0000000080), 0x0, 0x402)
r1 = socket$inet_mptcp(0x2, 0x1, 0x106)
r2 = socket(0x10, 0x803, 0x0)
syz_genetlink_get_family_id$tipc(&(0x7f0000000000), r2)
getsockname$packet(r2, &(0x7f0000000280)={0x11, 0x0, <r3=>0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14)
sendmsg$nl_route(r2, &(0x7f0000000180)={&(0x7f0000000040)={0x10, 0x0, 0x0, 0x400000}, 0xc, &(0x7f0000000140)={&(0x7f0000000100)=@RTM_GETMDB={0x18, 0x56, 0x2, 0x70bd25, 0x25dfdbfe, {0x7, r3}, [""]}, 0x18}}, 0x20000000)
sendmsg$nl_route(r2, &(0x7f0000000240)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000580)=ANY=[@ANYBLOB="4800000010000305ff810000fddbdf2500000000", @ANYRES32=r3, @ANYBLOB="1748000040000200280012800a000100767863616e0000001800028014000100000000", @ANYRES32=r3], 0x48}, 0x1, 0x0, 0x0, 0x40}, 0x0)
connect$inet(r1, &(0x7f0000000000)={0x2, 0x4e22, @empty}, 0x10)
setsockopt$sock_int(r1, 0x1, 0x9, &(0x7f00000003c0)=0x246, 0x4)
ioctl$FE_SET_PROPERTY(r0, 0x40106f52, &(0x7f00000000c0)={0x29, &(0x7f0000000200)=[{0x34, '\x00', @data=0x4}]})
syz_open_dev$dvb_frontend(&(0x7f0000000080), 0x0, 0x402) (async)
socket$inet_mptcp(0x2, 0x1, 0x106) (async)
socket(0x10, 0x803, 0x0) (async)
syz_genetlink_get_family_id$tipc(&(0x7f0000000000), r2) (async)
getsockname$packet(r2, &(0x7f0000000280)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) (async)
sendmsg$nl_route(r2, &(0x7f0000000180)={&(0x7f0000000040)={0x10, 0x0, 0x0, 0x400000}, 0xc, &(0x7f0000000140)={&(0x7f0000000100)=@RTM_GETMDB={0x18, 0x56, 0x2, 0x70bd25, 0x25dfdbfe, {0x7, r3}, [""]}, 0x18}}, 0x20000000) (async)
sendmsg$nl_route(r2, &(0x7f0000000240)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000580)=ANY=[@ANYBLOB="4800000010000305ff810000fddbdf2500000000", @ANYRES32=r3, @ANYBLOB="1748000040000200280012800a000100767863616e0000001800028014000100000000", @ANYRES32=r3], 0x48}, 0x1, 0x0, 0x0, 0x40}, 0x0) (async)
connect$inet(r1, &(0x7f0000000000)={0x2, 0x4e22, @empty}, 0x10) (async)
setsockopt$sock_int(r1, 0x1, 0x9, &(0x7f00000003c0)=0x246, 0x4) (async)
ioctl$FE_SET_PROPERTY(r0, 0x40106f52, &(0x7f00000000c0)={0x29, &(0x7f0000000200)=[{0x34, '\x00', @data=0x4}]}) (async)

program crashed: KASAN: slab-use-after-free Read in dvb_device_open
testing program (duration=45s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): [19, 31, 20]
detailed listing:
executing program 3:
r0 = socket$inet6_tcp(0xa, 0x1, 0x0)
connect$inet6(r0, 0x0, 0x0)
gettid()
timer_settime(0x0, 0x0, &(0x7f0000000280)={{0x0, 0x989680}, {0x0, 0x989680}}, 0x0)
socketpair$unix(0x1, 0x0, 0x0, 0x0)
getsockopt$sock_cred(0xffffffffffffffff, 0x1, 0x11, 0x0, &(0x7f0000cab000))
setsockopt$sock_cred(0xffffffffffffffff, 0x1, 0x11, 0x0, 0x0)
setsockopt$inet6_tcp_TCP_REPAIR_QUEUE(r0, 0x6, 0x14, 0x0, 0x0)
mmap(&(0x7f0000000000/0x4000)=nil, 0x4000, 0x1, 0x10012, 0xffffffffffffffff, 0x5deba000)
mmap(&(0x7f0000bfe000/0x400000)=nil, 0x400000, 0x4, 0x40010, r0, 0xd1aa000)
mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x3, 0x8031, 0xffffffffffffffff, 0x0)
mmap$dsp(&(0x7f0000ffd000/0x2000)=nil, 0x2000, 0x100000b, 0x810, 0xffffffffffffffff, 0x0)
socket$xdp(0x2c, 0x3, 0x0)
r1 = socket$kcm(0xa, 0x2, 0x0)
r2 = socket(0x2, 0x80805, 0x0)
r3 = openat$fuse(0xffffffffffffff9c, &(0x7f0000000080), 0x2, 0x0)
read$FUSE(r3, &(0x7f0000000600)={0x2020}, 0x2020)
setsockopt$IP_VS_SO_SET_ADD(r2, 0x0, 0x482, &(0x7f0000000240)={0x84, @dev={0xac, 0x14, 0x14, 0x15}, 0x4e20, 0x3, 'wlc\x00', 0x2, 0x660f537e, 0x3}, 0x2c)
sendmsg$sock(r1, &(0x7f0000000400)={&(0x7f0000000580)=@in6={0x2, 0x4e20, 0x0, @dev={0xfe, 0x80, '\x00', 0xfd}}, 0x80, 0x0, 0x0, &(0x7f0000000000)=[@mark={{0x14, 0x1, 0x24, 0x3}}], 0x18}, 0x0)
executing program 0:
r0 = syz_usb_connect(0x0, 0x32, &(0x7f0000000000)=ANY=[@ANYBLOB="1201000200000040a61b01000100000000010902200001010080320904"], 0x0)
r1 = openat$ptp1(0xffffffffffffff9c, &(0x7f0000000c40), 0x149201, 0x0)
ioctl$PTP_ENABLE_PPS(r1, 0x40043d04, 0x1)
r2 = socket$kcm(0x10, 0x2, 0x4)
sendmsg$inet(r2, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)=[{&(0x7f0000000100)="5c00000012006bab9e3fe3d86e6c1d0000147ea60864160af36504b68675f8001d000a00a0e69ee517d34460bc24eab556a705251e6182949a36c23d3b48dfd8cdbf9367b4fa51f60a64c9f4080003680601000008000300ff000000", 0x5c}], 0x1, 0x0, 0x0, 0x1f00c00e}, 0x0)
r3 = syz_usb_connect$uac3(0x3, 0x80, &(0x7f0000000280)=ANY=[], 0x0)
syz_usb_control_io(r0, 0x0, 0x0)
syz_usb_control_io$sierra_net(r0, 0x0, &(0x7f0000000700)={0x1c, &(0x7f0000000280)=ANY=[], 0x0, 0x0})
syz_usb_control_io$uac3(r3, 0x0, 0x0)
syz_usb_control_io$printer(r0, 0x0, &(0x7f00000005c0)={0x34, &(0x7f00000003c0)=ANY=[], 0x0, 0x0, 0x0, 0x0, 0x0})
mkdirat(0xffffffffffffff9c, &(0x7f0000000200)='./file0\x00', 0x0)
r4 = openat(0xffffffffffffff9c, &(0x7f0000000080)='./file0\x00', 0x0, 0xd5)
ioctl$FS_IOC_GETFLAGS(r4, 0x80086601, &(0x7f0000000100))
syz_open_dev$dvb_frontend(&(0x7f0000000100), 0x1, 0x802)
r5 = socket$inet6_sctp(0xa, 0x801, 0x84)
getsockopt$bt_hci(r5, 0x84, 0x81, &(0x7f0000001280)=""/4107, &(0x7f00000000c0)=0x100b)
r6 = socket$rxrpc(0x21, 0x2, 0x2)
setsockopt$RXRPC_MIN_SECURITY_LEVEL(r6, 0x110, 0x4, &(0x7f0000000440)=0x1, 0x4)
syz_usb_connect(0x0, 0x32, &(0x7f0000000000)=ANY=[@ANYBLOB="1201000200000040a61b01000100000000010902200001010080320904"], 0x0) (async)
openat$ptp1(0xffffffffffffff9c, &(0x7f0000000c40), 0x149201, 0x0) (async)
ioctl$PTP_ENABLE_PPS(r1, 0x40043d04, 0x1) (async)
socket$kcm(0x10, 0x2, 0x4) (async)
sendmsg$inet(r2, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)=[{&(0x7f0000000100)="5c00000012006bab9e3fe3d86e6c1d0000147ea60864160af36504b68675f8001d000a00a0e69ee517d34460bc24eab556a705251e6182949a36c23d3b48dfd8cdbf9367b4fa51f60a64c9f4080003680601000008000300ff000000", 0x5c}], 0x1, 0x0, 0x0, 0x1f00c00e}, 0x0) (async)
syz_usb_connect$uac3(0x3, 0x80, &(0x7f0000000280)=ANY=[], 0x0) (async)
syz_usb_control_io(r0, 0x0, 0x0) (async)
syz_usb_control_io$sierra_net(r0, 0x0, &(0x7f0000000700)={0x1c, &(0x7f0000000280)=ANY=[], 0x0, 0x0}) (async)
syz_usb_control_io$uac3(r3, 0x0, 0x0) (async)
syz_usb_control_io$printer(r0, 0x0, &(0x7f00000005c0)={0x34, &(0x7f00000003c0)=ANY=[], 0x0, 0x0, 0x0, 0x0, 0x0}) (async)
mkdirat(0xffffffffffffff9c, &(0x7f0000000200)='./file0\x00', 0x0) (async)
syz_open_dev$dvb_frontend(&(0x7f0000000100), 0x1, 0x802) (async)
getsockopt$bt_hci(r5, 0x84, 0x81, &(0x7f0000001280)=""/4107, &(0x7f00000000c0)=0x100b) (async)
executing program 4:
r0 = syz_open_dev$dvb_frontend(&(0x7f0000000080), 0x0, 0x402)
r1 = socket$inet_mptcp(0x2, 0x1, 0x106)
r2 = socket(0x10, 0x803, 0x0)
syz_genetlink_get_family_id$tipc(&(0x7f0000000000), r2)
getsockname$packet(r2, &(0x7f0000000280)={0x11, 0x0, <r3=>0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14)
sendmsg$nl_route(r2, &(0x7f0000000180)={&(0x7f0000000040)={0x10, 0x0, 0x0, 0x400000}, 0xc, &(0x7f0000000140)={&(0x7f0000000100)=@RTM_GETMDB={0x18, 0x56, 0x2, 0x70bd25, 0x25dfdbfe, {0x7, r3}, [""]}, 0x18}}, 0x20000000)
sendmsg$nl_route(r2, &(0x7f0000000240)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000580)=ANY=[@ANYBLOB="4800000010000305ff810000fddbdf2500000000", @ANYRES32=r3, @ANYBLOB="1748000040000200280012800a000100767863616e0000001800028014000100000000", @ANYRES32=r3], 0x48}, 0x1, 0x0, 0x0, 0x40}, 0x0)
connect$inet(r1, &(0x7f0000000000)={0x2, 0x4e22, @empty}, 0x10)
setsockopt$sock_int(r1, 0x1, 0x9, &(0x7f00000003c0)=0x246, 0x4)
ioctl$FE_SET_PROPERTY(r0, 0x40106f52, &(0x7f00000000c0)={0x29, &(0x7f0000000200)=[{0x34, '\x00', @data=0x4}]})
syz_open_dev$dvb_frontend(&(0x7f0000000080), 0x0, 0x402) (async)
socket$inet_mptcp(0x2, 0x1, 0x106) (async)
socket(0x10, 0x803, 0x0) (async)
syz_genetlink_get_family_id$tipc(&(0x7f0000000000), r2) (async)
getsockname$packet(r2, &(0x7f0000000280)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) (async)
sendmsg$nl_route(r2, &(0x7f0000000180)={&(0x7f0000000040)={0x10, 0x0, 0x0, 0x400000}, 0xc, &(0x7f0000000140)={&(0x7f0000000100)=@RTM_GETMDB={0x18, 0x56, 0x2, 0x70bd25, 0x25dfdbfe, {0x7, r3}, [""]}, 0x18}}, 0x20000000) (async)
sendmsg$nl_route(r2, &(0x7f0000000240)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000580)=ANY=[@ANYBLOB="4800000010000305ff810000fddbdf2500000000", @ANYRES32=r3, @ANYBLOB="1748000040000200280012800a000100767863616e0000001800028014000100000000", @ANYRES32=r3], 0x48}, 0x1, 0x0, 0x0, 0x40}, 0x0) (async)
connect$inet(r1, &(0x7f0000000000)={0x2, 0x4e22, @empty}, 0x10) (async)
setsockopt$sock_int(r1, 0x1, 0x9, &(0x7f00000003c0)=0x246, 0x4) (async)
ioctl$FE_SET_PROPERTY(r0, 0x40106f52, &(0x7f00000000c0)={0x29, &(0x7f0000000200)=[{0x34, '\x00', @data=0x4}]}) (async)

program crashed: KASAN: slab-use-after-free Read in dvb_device_open
testing program (duration=45s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): [19, 30, 20]
detailed listing:
executing program 3:
r0 = socket$inet6_tcp(0xa, 0x1, 0x0)
connect$inet6(r0, 0x0, 0x0)
gettid()
timer_settime(0x0, 0x0, &(0x7f0000000280)={{0x0, 0x989680}, {0x0, 0x989680}}, 0x0)
socketpair$unix(0x1, 0x0, 0x0, 0x0)
getsockopt$sock_cred(0xffffffffffffffff, 0x1, 0x11, 0x0, &(0x7f0000cab000))
setsockopt$sock_cred(0xffffffffffffffff, 0x1, 0x11, 0x0, 0x0)
setsockopt$inet6_tcp_TCP_REPAIR_QUEUE(r0, 0x6, 0x14, 0x0, 0x0)
mmap(&(0x7f0000000000/0x4000)=nil, 0x4000, 0x1, 0x10012, 0xffffffffffffffff, 0x5deba000)
mmap(&(0x7f0000bfe000/0x400000)=nil, 0x400000, 0x4, 0x40010, r0, 0xd1aa000)
mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x3, 0x8031, 0xffffffffffffffff, 0x0)
mmap$dsp(&(0x7f0000ffd000/0x2000)=nil, 0x2000, 0x100000b, 0x810, 0xffffffffffffffff, 0x0)
socket$xdp(0x2c, 0x3, 0x0)
r1 = socket$kcm(0xa, 0x2, 0x0)
r2 = socket(0x2, 0x80805, 0x0)
r3 = openat$fuse(0xffffffffffffff9c, &(0x7f0000000080), 0x2, 0x0)
read$FUSE(r3, &(0x7f0000000600)={0x2020}, 0x2020)
setsockopt$IP_VS_SO_SET_ADD(r2, 0x0, 0x482, &(0x7f0000000240)={0x84, @dev={0xac, 0x14, 0x14, 0x15}, 0x4e20, 0x3, 'wlc\x00', 0x2, 0x660f537e, 0x3}, 0x2c)
sendmsg$sock(r1, &(0x7f0000000400)={&(0x7f0000000580)=@in6={0x2, 0x4e20, 0x0, @dev={0xfe, 0x80, '\x00', 0xfd}}, 0x80, 0x0, 0x0, &(0x7f0000000000)=[@mark={{0x14, 0x1, 0x24, 0x3}}], 0x18}, 0x0)
executing program 0:
r0 = syz_usb_connect(0x0, 0x32, &(0x7f0000000000)=ANY=[@ANYBLOB="1201000200000040a61b01000100000000010902200001010080320904"], 0x0)
r1 = openat$ptp1(0xffffffffffffff9c, &(0x7f0000000c40), 0x149201, 0x0)
ioctl$PTP_ENABLE_PPS(r1, 0x40043d04, 0x1)
r2 = socket$kcm(0x10, 0x2, 0x4)
sendmsg$inet(r2, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)=[{&(0x7f0000000100)="5c00000012006bab9e3fe3d86e6c1d0000147ea60864160af36504b68675f8001d000a00a0e69ee517d34460bc24eab556a705251e6182949a36c23d3b48dfd8cdbf9367b4fa51f60a64c9f4080003680601000008000300ff000000", 0x5c}], 0x1, 0x0, 0x0, 0x1f00c00e}, 0x0)
r3 = syz_usb_connect$uac3(0x3, 0x80, &(0x7f0000000280)=ANY=[], 0x0)
syz_usb_control_io(r0, 0x0, 0x0)
syz_usb_control_io$sierra_net(r0, 0x0, &(0x7f0000000700)={0x1c, &(0x7f0000000280)=ANY=[], 0x0, 0x0})
syz_usb_control_io$uac3(r3, 0x0, 0x0)
syz_usb_control_io$printer(r0, 0x0, &(0x7f00000005c0)={0x34, &(0x7f00000003c0)=ANY=[], 0x0, 0x0, 0x0, 0x0, 0x0})
mkdirat(0xffffffffffffff9c, &(0x7f0000000200)='./file0\x00', 0x0)
r4 = openat(0xffffffffffffff9c, &(0x7f0000000080)='./file0\x00', 0x0, 0xd5)
ioctl$FS_IOC_GETFLAGS(r4, 0x80086601, &(0x7f0000000100))
syz_open_dev$dvb_frontend(&(0x7f0000000100), 0x1, 0x802)
r5 = socket$inet6_sctp(0xa, 0x801, 0x84)
getsockopt$bt_hci(r5, 0x84, 0x81, &(0x7f0000001280)=""/4107, &(0x7f00000000c0)=0x100b)
r6 = socket$rxrpc(0x21, 0x2, 0x2)
setsockopt$RXRPC_MIN_SECURITY_LEVEL(r6, 0x110, 0x4, &(0x7f0000000440)=0x1, 0x4)
syz_usb_connect(0x0, 0x32, &(0x7f0000000000)=ANY=[@ANYBLOB="1201000200000040a61b01000100000000010902200001010080320904"], 0x0) (async)
openat$ptp1(0xffffffffffffff9c, &(0x7f0000000c40), 0x149201, 0x0) (async)
ioctl$PTP_ENABLE_PPS(r1, 0x40043d04, 0x1) (async)
socket$kcm(0x10, 0x2, 0x4) (async)
sendmsg$inet(r2, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)=[{&(0x7f0000000100)="5c00000012006bab9e3fe3d86e6c1d0000147ea60864160af36504b68675f8001d000a00a0e69ee517d34460bc24eab556a705251e6182949a36c23d3b48dfd8cdbf9367b4fa51f60a64c9f4080003680601000008000300ff000000", 0x5c}], 0x1, 0x0, 0x0, 0x1f00c00e}, 0x0) (async)
syz_usb_connect$uac3(0x3, 0x80, &(0x7f0000000280)=ANY=[], 0x0) (async)
syz_usb_control_io(r0, 0x0, 0x0) (async)
syz_usb_control_io$sierra_net(r0, 0x0, &(0x7f0000000700)={0x1c, &(0x7f0000000280)=ANY=[], 0x0, 0x0}) (async)
syz_usb_control_io$uac3(r3, 0x0, 0x0) (async)
syz_usb_control_io$printer(r0, 0x0, &(0x7f00000005c0)={0x34, &(0x7f00000003c0)=ANY=[], 0x0, 0x0, 0x0, 0x0, 0x0}) (async)
syz_open_dev$dvb_frontend(&(0x7f0000000100), 0x1, 0x802) (async)
getsockopt$bt_hci(r5, 0x84, 0x81, &(0x7f0000001280)=""/4107, &(0x7f00000000c0)=0x100b) (async)
executing program 4:
r0 = syz_open_dev$dvb_frontend(&(0x7f0000000080), 0x0, 0x402)
r1 = socket$inet_mptcp(0x2, 0x1, 0x106)
r2 = socket(0x10, 0x803, 0x0)
syz_genetlink_get_family_id$tipc(&(0x7f0000000000), r2)
getsockname$packet(r2, &(0x7f0000000280)={0x11, 0x0, <r3=>0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14)
sendmsg$nl_route(r2, &(0x7f0000000180)={&(0x7f0000000040)={0x10, 0x0, 0x0, 0x400000}, 0xc, &(0x7f0000000140)={&(0x7f0000000100)=@RTM_GETMDB={0x18, 0x56, 0x2, 0x70bd25, 0x25dfdbfe, {0x7, r3}, [""]}, 0x18}}, 0x20000000)
sendmsg$nl_route(r2, &(0x7f0000000240)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000580)=ANY=[@ANYBLOB="4800000010000305ff810000fddbdf2500000000", @ANYRES32=r3, @ANYBLOB="1748000040000200280012800a000100767863616e0000001800028014000100000000", @ANYRES32=r3], 0x48}, 0x1, 0x0, 0x0, 0x40}, 0x0)
connect$inet(r1, &(0x7f0000000000)={0x2, 0x4e22, @empty}, 0x10)
setsockopt$sock_int(r1, 0x1, 0x9, &(0x7f00000003c0)=0x246, 0x4)
ioctl$FE_SET_PROPERTY(r0, 0x40106f52, &(0x7f00000000c0)={0x29, &(0x7f0000000200)=[{0x34, '\x00', @data=0x4}]})
syz_open_dev$dvb_frontend(&(0x7f0000000080), 0x0, 0x402) (async)
socket$inet_mptcp(0x2, 0x1, 0x106) (async)
socket(0x10, 0x803, 0x0) (async)
syz_genetlink_get_family_id$tipc(&(0x7f0000000000), r2) (async)
getsockname$packet(r2, &(0x7f0000000280)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) (async)
sendmsg$nl_route(r2, &(0x7f0000000180)={&(0x7f0000000040)={0x10, 0x0, 0x0, 0x400000}, 0xc, &(0x7f0000000140)={&(0x7f0000000100)=@RTM_GETMDB={0x18, 0x56, 0x2, 0x70bd25, 0x25dfdbfe, {0x7, r3}, [""]}, 0x18}}, 0x20000000) (async)
sendmsg$nl_route(r2, &(0x7f0000000240)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000580)=ANY=[@ANYBLOB="4800000010000305ff810000fddbdf2500000000", @ANYRES32=r3, @ANYBLOB="1748000040000200280012800a000100767863616e0000001800028014000100000000", @ANYRES32=r3], 0x48}, 0x1, 0x0, 0x0, 0x40}, 0x0) (async)
connect$inet(r1, &(0x7f0000000000)={0x2, 0x4e22, @empty}, 0x10) (async)
setsockopt$sock_int(r1, 0x1, 0x9, &(0x7f00000003c0)=0x246, 0x4) (async)
ioctl$FE_SET_PROPERTY(r0, 0x40106f52, &(0x7f00000000c0)={0x29, &(0x7f0000000200)=[{0x34, '\x00', @data=0x4}]}) (async)

program crashed: KASAN: slab-use-after-free Read in dvb_device_open
testing program (duration=45s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): [19, 29, 20]
detailed listing:
executing program 3:
r0 = socket$inet6_tcp(0xa, 0x1, 0x0)
connect$inet6(r0, 0x0, 0x0)
gettid()
timer_settime(0x0, 0x0, &(0x7f0000000280)={{0x0, 0x989680}, {0x0, 0x989680}}, 0x0)
socketpair$unix(0x1, 0x0, 0x0, 0x0)
getsockopt$sock_cred(0xffffffffffffffff, 0x1, 0x11, 0x0, &(0x7f0000cab000))
setsockopt$sock_cred(0xffffffffffffffff, 0x1, 0x11, 0x0, 0x0)
setsockopt$inet6_tcp_TCP_REPAIR_QUEUE(r0, 0x6, 0x14, 0x0, 0x0)
mmap(&(0x7f0000000000/0x4000)=nil, 0x4000, 0x1, 0x10012, 0xffffffffffffffff, 0x5deba000)
mmap(&(0x7f0000bfe000/0x400000)=nil, 0x400000, 0x4, 0x40010, r0, 0xd1aa000)
mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x3, 0x8031, 0xffffffffffffffff, 0x0)
mmap$dsp(&(0x7f0000ffd000/0x2000)=nil, 0x2000, 0x100000b, 0x810, 0xffffffffffffffff, 0x0)
socket$xdp(0x2c, 0x3, 0x0)
r1 = socket$kcm(0xa, 0x2, 0x0)
r2 = socket(0x2, 0x80805, 0x0)
r3 = openat$fuse(0xffffffffffffff9c, &(0x7f0000000080), 0x2, 0x0)
read$FUSE(r3, &(0x7f0000000600)={0x2020}, 0x2020)
setsockopt$IP_VS_SO_SET_ADD(r2, 0x0, 0x482, &(0x7f0000000240)={0x84, @dev={0xac, 0x14, 0x14, 0x15}, 0x4e20, 0x3, 'wlc\x00', 0x2, 0x660f537e, 0x3}, 0x2c)
sendmsg$sock(r1, &(0x7f0000000400)={&(0x7f0000000580)=@in6={0x2, 0x4e20, 0x0, @dev={0xfe, 0x80, '\x00', 0xfd}}, 0x80, 0x0, 0x0, &(0x7f0000000000)=[@mark={{0x14, 0x1, 0x24, 0x3}}], 0x18}, 0x0)
executing program 0:
r0 = syz_usb_connect(0x0, 0x32, &(0x7f0000000000)=ANY=[@ANYBLOB="1201000200000040a61b01000100000000010902200001010080320904"], 0x0)
r1 = openat$ptp1(0xffffffffffffff9c, &(0x7f0000000c40), 0x149201, 0x0)
ioctl$PTP_ENABLE_PPS(r1, 0x40043d04, 0x1)
r2 = socket$kcm(0x10, 0x2, 0x4)
sendmsg$inet(r2, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)=[{&(0x7f0000000100)="5c00000012006bab9e3fe3d86e6c1d0000147ea60864160af36504b68675f8001d000a00a0e69ee517d34460bc24eab556a705251e6182949a36c23d3b48dfd8cdbf9367b4fa51f60a64c9f4080003680601000008000300ff000000", 0x5c}], 0x1, 0x0, 0x0, 0x1f00c00e}, 0x0)
r3 = syz_usb_connect$uac3(0x3, 0x80, &(0x7f0000000280)=ANY=[], 0x0)
syz_usb_control_io(r0, 0x0, 0x0)
syz_usb_control_io$sierra_net(r0, 0x0, &(0x7f0000000700)={0x1c, &(0x7f0000000280)=ANY=[], 0x0, 0x0})
syz_usb_control_io$uac3(r3, 0x0, 0x0)
syz_usb_control_io$printer(r0, 0x0, &(0x7f00000005c0)={0x34, &(0x7f00000003c0)=ANY=[], 0x0, 0x0, 0x0, 0x0, 0x0})
mkdirat(0xffffffffffffff9c, &(0x7f0000000200)='./file0\x00', 0x0)
r4 = openat(0xffffffffffffff9c, &(0x7f0000000080)='./file0\x00', 0x0, 0xd5)
ioctl$FS_IOC_GETFLAGS(r4, 0x80086601, &(0x7f0000000100))
syz_open_dev$dvb_frontend(&(0x7f0000000100), 0x1, 0x802)
r5 = socket$inet6_sctp(0xa, 0x801, 0x84)
getsockopt$bt_hci(r5, 0x84, 0x81, &(0x7f0000001280)=""/4107, &(0x7f00000000c0)=0x100b)
r6 = socket$rxrpc(0x21, 0x2, 0x2)
setsockopt$RXRPC_MIN_SECURITY_LEVEL(r6, 0x110, 0x4, &(0x7f0000000440)=0x1, 0x4)
syz_usb_connect(0x0, 0x32, &(0x7f0000000000)=ANY=[@ANYBLOB="1201000200000040a61b01000100000000010902200001010080320904"], 0x0) (async)
openat$ptp1(0xffffffffffffff9c, &(0x7f0000000c40), 0x149201, 0x0) (async)
ioctl$PTP_ENABLE_PPS(r1, 0x40043d04, 0x1) (async)
socket$kcm(0x10, 0x2, 0x4) (async)
sendmsg$inet(r2, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)=[{&(0x7f0000000100)="5c00000012006bab9e3fe3d86e6c1d0000147ea60864160af36504b68675f8001d000a00a0e69ee517d34460bc24eab556a705251e6182949a36c23d3b48dfd8cdbf9367b4fa51f60a64c9f4080003680601000008000300ff000000", 0x5c}], 0x1, 0x0, 0x0, 0x1f00c00e}, 0x0) (async)
syz_usb_connect$uac3(0x3, 0x80, &(0x7f0000000280)=ANY=[], 0x0) (async)
syz_usb_control_io(r0, 0x0, 0x0) (async)
syz_usb_control_io$sierra_net(r0, 0x0, &(0x7f0000000700)={0x1c, &(0x7f0000000280)=ANY=[], 0x0, 0x0}) (async)
syz_usb_control_io$uac3(r3, 0x0, 0x0) (async)
syz_open_dev$dvb_frontend(&(0x7f0000000100), 0x1, 0x802) (async)
getsockopt$bt_hci(r5, 0x84, 0x81, &(0x7f0000001280)=""/4107, &(0x7f00000000c0)=0x100b) (async)
executing program 4:
r0 = syz_open_dev$dvb_frontend(&(0x7f0000000080), 0x0, 0x402)
r1 = socket$inet_mptcp(0x2, 0x1, 0x106)
r2 = socket(0x10, 0x803, 0x0)
syz_genetlink_get_family_id$tipc(&(0x7f0000000000), r2)
getsockname$packet(r2, &(0x7f0000000280)={0x11, 0x0, <r3=>0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14)
sendmsg$nl_route(r2, &(0x7f0000000180)={&(0x7f0000000040)={0x10, 0x0, 0x0, 0x400000}, 0xc, &(0x7f0000000140)={&(0x7f0000000100)=@RTM_GETMDB={0x18, 0x56, 0x2, 0x70bd25, 0x25dfdbfe, {0x7, r3}, [""]}, 0x18}}, 0x20000000)
sendmsg$nl_route(r2, &(0x7f0000000240)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000580)=ANY=[@ANYBLOB="4800000010000305ff810000fddbdf2500000000", @ANYRES32=r3, @ANYBLOB="1748000040000200280012800a000100767863616e0000001800028014000100000000", @ANYRES32=r3], 0x48}, 0x1, 0x0, 0x0, 0x40}, 0x0)
connect$inet(r1, &(0x7f0000000000)={0x2, 0x4e22, @empty}, 0x10)
setsockopt$sock_int(r1, 0x1, 0x9, &(0x7f00000003c0)=0x246, 0x4)
ioctl$FE_SET_PROPERTY(r0, 0x40106f52, &(0x7f00000000c0)={0x29, &(0x7f0000000200)=[{0x34, '\x00', @data=0x4}]})
syz_open_dev$dvb_frontend(&(0x7f0000000080), 0x0, 0x402) (async)
socket$inet_mptcp(0x2, 0x1, 0x106) (async)
socket(0x10, 0x803, 0x0) (async)
syz_genetlink_get_family_id$tipc(&(0x7f0000000000), r2) (async)
getsockname$packet(r2, &(0x7f0000000280)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) (async)
sendmsg$nl_route(r2, &(0x7f0000000180)={&(0x7f0000000040)={0x10, 0x0, 0x0, 0x400000}, 0xc, &(0x7f0000000140)={&(0x7f0000000100)=@RTM_GETMDB={0x18, 0x56, 0x2, 0x70bd25, 0x25dfdbfe, {0x7, r3}, [""]}, 0x18}}, 0x20000000) (async)
sendmsg$nl_route(r2, &(0x7f0000000240)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000580)=ANY=[@ANYBLOB="4800000010000305ff810000fddbdf2500000000", @ANYRES32=r3, @ANYBLOB="1748000040000200280012800a000100767863616e0000001800028014000100000000", @ANYRES32=r3], 0x48}, 0x1, 0x0, 0x0, 0x40}, 0x0) (async)
connect$inet(r1, &(0x7f0000000000)={0x2, 0x4e22, @empty}, 0x10) (async)
setsockopt$sock_int(r1, 0x1, 0x9, &(0x7f00000003c0)=0x246, 0x4) (async)
ioctl$FE_SET_PROPERTY(r0, 0x40106f52, &(0x7f00000000c0)={0x29, &(0x7f0000000200)=[{0x34, '\x00', @data=0x4}]}) (async)

program crashed: KASAN: slab-use-after-free Read in dvb_device_open
testing program (duration=45s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): [19, 28, 20]
detailed listing:
executing program 3:
r0 = socket$inet6_tcp(0xa, 0x1, 0x0)
connect$inet6(r0, 0x0, 0x0)
gettid()
timer_settime(0x0, 0x0, &(0x7f0000000280)={{0x0, 0x989680}, {0x0, 0x989680}}, 0x0)
socketpair$unix(0x1, 0x0, 0x0, 0x0)
getsockopt$sock_cred(0xffffffffffffffff, 0x1, 0x11, 0x0, &(0x7f0000cab000))
setsockopt$sock_cred(0xffffffffffffffff, 0x1, 0x11, 0x0, 0x0)
setsockopt$inet6_tcp_TCP_REPAIR_QUEUE(r0, 0x6, 0x14, 0x0, 0x0)
mmap(&(0x7f0000000000/0x4000)=nil, 0x4000, 0x1, 0x10012, 0xffffffffffffffff, 0x5deba000)
mmap(&(0x7f0000bfe000/0x400000)=nil, 0x400000, 0x4, 0x40010, r0, 0xd1aa000)
mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x3, 0x8031, 0xffffffffffffffff, 0x0)
mmap$dsp(&(0x7f0000ffd000/0x2000)=nil, 0x2000, 0x100000b, 0x810, 0xffffffffffffffff, 0x0)
socket$xdp(0x2c, 0x3, 0x0)
r1 = socket$kcm(0xa, 0x2, 0x0)
r2 = socket(0x2, 0x80805, 0x0)
r3 = openat$fuse(0xffffffffffffff9c, &(0x7f0000000080), 0x2, 0x0)
read$FUSE(r3, &(0x7f0000000600)={0x2020}, 0x2020)
setsockopt$IP_VS_SO_SET_ADD(r2, 0x0, 0x482, &(0x7f0000000240)={0x84, @dev={0xac, 0x14, 0x14, 0x15}, 0x4e20, 0x3, 'wlc\x00', 0x2, 0x660f537e, 0x3}, 0x2c)
sendmsg$sock(r1, &(0x7f0000000400)={&(0x7f0000000580)=@in6={0x2, 0x4e20, 0x0, @dev={0xfe, 0x80, '\x00', 0xfd}}, 0x80, 0x0, 0x0, &(0x7f0000000000)=[@mark={{0x14, 0x1, 0x24, 0x3}}], 0x18}, 0x0)
executing program 0:
r0 = syz_usb_connect(0x0, 0x32, &(0x7f0000000000)=ANY=[@ANYBLOB="1201000200000040a61b01000100000000010902200001010080320904"], 0x0)
r1 = openat$ptp1(0xffffffffffffff9c, &(0x7f0000000c40), 0x149201, 0x0)
ioctl$PTP_ENABLE_PPS(r1, 0x40043d04, 0x1)
r2 = socket$kcm(0x10, 0x2, 0x4)
sendmsg$inet(r2, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)=[{&(0x7f0000000100)="5c00000012006bab9e3fe3d86e6c1d0000147ea60864160af36504b68675f8001d000a00a0e69ee517d34460bc24eab556a705251e6182949a36c23d3b48dfd8cdbf9367b4fa51f60a64c9f4080003680601000008000300ff000000", 0x5c}], 0x1, 0x0, 0x0, 0x1f00c00e}, 0x0)
r3 = syz_usb_connect$uac3(0x3, 0x80, &(0x7f0000000280)=ANY=[], 0x0)
syz_usb_control_io(r0, 0x0, 0x0)
syz_usb_control_io$sierra_net(r0, 0x0, &(0x7f0000000700)={0x1c, &(0x7f0000000280)=ANY=[], 0x0, 0x0})
syz_usb_control_io$uac3(r3, 0x0, 0x0)
syz_usb_control_io$printer(r0, 0x0, &(0x7f00000005c0)={0x34, &(0x7f00000003c0)=ANY=[], 0x0, 0x0, 0x0, 0x0, 0x0})
mkdirat(0xffffffffffffff9c, &(0x7f0000000200)='./file0\x00', 0x0)
r4 = openat(0xffffffffffffff9c, &(0x7f0000000080)='./file0\x00', 0x0, 0xd5)
ioctl$FS_IOC_GETFLAGS(r4, 0x80086601, &(0x7f0000000100))
syz_open_dev$dvb_frontend(&(0x7f0000000100), 0x1, 0x802)
r5 = socket$inet6_sctp(0xa, 0x801, 0x84)
getsockopt$bt_hci(r5, 0x84, 0x81, &(0x7f0000001280)=""/4107, &(0x7f00000000c0)=0x100b)
r6 = socket$rxrpc(0x21, 0x2, 0x2)
setsockopt$RXRPC_MIN_SECURITY_LEVEL(r6, 0x110, 0x4, &(0x7f0000000440)=0x1, 0x4)
syz_usb_connect(0x0, 0x32, &(0x7f0000000000)=ANY=[@ANYBLOB="1201000200000040a61b01000100000000010902200001010080320904"], 0x0) (async)
openat$ptp1(0xffffffffffffff9c, &(0x7f0000000c40), 0x149201, 0x0) (async)
ioctl$PTP_ENABLE_PPS(r1, 0x40043d04, 0x1) (async)
socket$kcm(0x10, 0x2, 0x4) (async)
sendmsg$inet(r2, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)=[{&(0x7f0000000100)="5c00000012006bab9e3fe3d86e6c1d0000147ea60864160af36504b68675f8001d000a00a0e69ee517d34460bc24eab556a705251e6182949a36c23d3b48dfd8cdbf9367b4fa51f60a64c9f4080003680601000008000300ff000000", 0x5c}], 0x1, 0x0, 0x0, 0x1f00c00e}, 0x0) (async)
syz_usb_connect$uac3(0x3, 0x80, &(0x7f0000000280)=ANY=[], 0x0) (async)
syz_usb_control_io(r0, 0x0, 0x0) (async)
syz_usb_control_io$sierra_net(r0, 0x0, &(0x7f0000000700)={0x1c, &(0x7f0000000280)=ANY=[], 0x0, 0x0}) (async)
syz_open_dev$dvb_frontend(&(0x7f0000000100), 0x1, 0x802) (async)
getsockopt$bt_hci(r5, 0x84, 0x81, &(0x7f0000001280)=""/4107, &(0x7f00000000c0)=0x100b) (async)
executing program 4:
r0 = syz_open_dev$dvb_frontend(&(0x7f0000000080), 0x0, 0x402)
r1 = socket$inet_mptcp(0x2, 0x1, 0x106)
r2 = socket(0x10, 0x803, 0x0)
syz_genetlink_get_family_id$tipc(&(0x7f0000000000), r2)
getsockname$packet(r2, &(0x7f0000000280)={0x11, 0x0, <r3=>0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14)
sendmsg$nl_route(r2, &(0x7f0000000180)={&(0x7f0000000040)={0x10, 0x0, 0x0, 0x400000}, 0xc, &(0x7f0000000140)={&(0x7f0000000100)=@RTM_GETMDB={0x18, 0x56, 0x2, 0x70bd25, 0x25dfdbfe, {0x7, r3}, [""]}, 0x18}}, 0x20000000)
sendmsg$nl_route(r2, &(0x7f0000000240)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000580)=ANY=[@ANYBLOB="4800000010000305ff810000fddbdf2500000000", @ANYRES32=r3, @ANYBLOB="1748000040000200280012800a000100767863616e0000001800028014000100000000", @ANYRES32=r3], 0x48}, 0x1, 0x0, 0x0, 0x40}, 0x0)
connect$inet(r1, &(0x7f0000000000)={0x2, 0x4e22, @empty}, 0x10)
setsockopt$sock_int(r1, 0x1, 0x9, &(0x7f00000003c0)=0x246, 0x4)
ioctl$FE_SET_PROPERTY(r0, 0x40106f52, &(0x7f00000000c0)={0x29, &(0x7f0000000200)=[{0x34, '\x00', @data=0x4}]})
syz_open_dev$dvb_frontend(&(0x7f0000000080), 0x0, 0x402) (async)
socket$inet_mptcp(0x2, 0x1, 0x106) (async)
socket(0x10, 0x803, 0x0) (async)
syz_genetlink_get_family_id$tipc(&(0x7f0000000000), r2) (async)
getsockname$packet(r2, &(0x7f0000000280)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) (async)
sendmsg$nl_route(r2, &(0x7f0000000180)={&(0x7f0000000040)={0x10, 0x0, 0x0, 0x400000}, 0xc, &(0x7f0000000140)={&(0x7f0000000100)=@RTM_GETMDB={0x18, 0x56, 0x2, 0x70bd25, 0x25dfdbfe, {0x7, r3}, [""]}, 0x18}}, 0x20000000) (async)
sendmsg$nl_route(r2, &(0x7f0000000240)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000580)=ANY=[@ANYBLOB="4800000010000305ff810000fddbdf2500000000", @ANYRES32=r3, @ANYBLOB="1748000040000200280012800a000100767863616e0000001800028014000100000000", @ANYRES32=r3], 0x48}, 0x1, 0x0, 0x0, 0x40}, 0x0) (async)
connect$inet(r1, &(0x7f0000000000)={0x2, 0x4e22, @empty}, 0x10) (async)
setsockopt$sock_int(r1, 0x1, 0x9, &(0x7f00000003c0)=0x246, 0x4) (async)
ioctl$FE_SET_PROPERTY(r0, 0x40106f52, &(0x7f00000000c0)={0x29, &(0x7f0000000200)=[{0x34, '\x00', @data=0x4}]}) (async)

program did not crash
testing program (duration=45s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): [19, 28, 20]
detailed listing:
executing program 3:
r0 = socket$inet6_tcp(0xa, 0x1, 0x0)
connect$inet6(r0, 0x0, 0x0)
gettid()
timer_settime(0x0, 0x0, &(0x7f0000000280)={{0x0, 0x989680}, {0x0, 0x989680}}, 0x0)
socketpair$unix(0x1, 0x0, 0x0, 0x0)
getsockopt$sock_cred(0xffffffffffffffff, 0x1, 0x11, 0x0, &(0x7f0000cab000))
setsockopt$sock_cred(0xffffffffffffffff, 0x1, 0x11, 0x0, 0x0)
setsockopt$inet6_tcp_TCP_REPAIR_QUEUE(r0, 0x6, 0x14, 0x0, 0x0)
mmap(&(0x7f0000000000/0x4000)=nil, 0x4000, 0x1, 0x10012, 0xffffffffffffffff, 0x5deba000)
mmap(&(0x7f0000bfe000/0x400000)=nil, 0x400000, 0x4, 0x40010, r0, 0xd1aa000)
mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x3, 0x8031, 0xffffffffffffffff, 0x0)
mmap$dsp(&(0x7f0000ffd000/0x2000)=nil, 0x2000, 0x100000b, 0x810, 0xffffffffffffffff, 0x0)
socket$xdp(0x2c, 0x3, 0x0)
r1 = socket$kcm(0xa, 0x2, 0x0)
r2 = socket(0x2, 0x80805, 0x0)
r3 = openat$fuse(0xffffffffffffff9c, &(0x7f0000000080), 0x2, 0x0)
read$FUSE(r3, &(0x7f0000000600)={0x2020}, 0x2020)
setsockopt$IP_VS_SO_SET_ADD(r2, 0x0, 0x482, &(0x7f0000000240)={0x84, @dev={0xac, 0x14, 0x14, 0x15}, 0x4e20, 0x3, 'wlc\x00', 0x2, 0x660f537e, 0x3}, 0x2c)
sendmsg$sock(r1, &(0x7f0000000400)={&(0x7f0000000580)=@in6={0x2, 0x4e20, 0x0, @dev={0xfe, 0x80, '\x00', 0xfd}}, 0x80, 0x0, 0x0, &(0x7f0000000000)=[@mark={{0x14, 0x1, 0x24, 0x3}}], 0x18}, 0x0)
executing program 0:
r0 = syz_usb_connect(0x0, 0x32, &(0x7f0000000000)=ANY=[@ANYBLOB="1201000200000040a61b01000100000000010902200001010080320904"], 0x0)
r1 = openat$ptp1(0xffffffffffffff9c, &(0x7f0000000c40), 0x149201, 0x0)
ioctl$PTP_ENABLE_PPS(r1, 0x40043d04, 0x1)
r2 = socket$kcm(0x10, 0x2, 0x4)
sendmsg$inet(r2, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)=[{&(0x7f0000000100)="5c00000012006bab9e3fe3d86e6c1d0000147ea60864160af36504b68675f8001d000a00a0e69ee517d34460bc24eab556a705251e6182949a36c23d3b48dfd8cdbf9367b4fa51f60a64c9f4080003680601000008000300ff000000", 0x5c}], 0x1, 0x0, 0x0, 0x1f00c00e}, 0x0)
r3 = syz_usb_connect$uac3(0x3, 0x80, &(0x7f0000000280)=ANY=[], 0x0)
syz_usb_control_io(r0, 0x0, 0x0)
syz_usb_control_io$sierra_net(r0, 0x0, &(0x7f0000000700)={0x1c, &(0x7f0000000280)=ANY=[], 0x0, 0x0})
syz_usb_control_io$uac3(r3, 0x0, 0x0)
syz_usb_control_io$printer(r0, 0x0, &(0x7f00000005c0)={0x34, &(0x7f00000003c0)=ANY=[], 0x0, 0x0, 0x0, 0x0, 0x0})
mkdirat(0xffffffffffffff9c, &(0x7f0000000200)='./file0\x00', 0x0)
r4 = openat(0xffffffffffffff9c, &(0x7f0000000080)='./file0\x00', 0x0, 0xd5)
ioctl$FS_IOC_GETFLAGS(r4, 0x80086601, &(0x7f0000000100))
syz_open_dev$dvb_frontend(&(0x7f0000000100), 0x1, 0x802)
r5 = socket$inet6_sctp(0xa, 0x801, 0x84)
getsockopt$bt_hci(r5, 0x84, 0x81, &(0x7f0000001280)=""/4107, &(0x7f00000000c0)=0x100b)
r6 = socket$rxrpc(0x21, 0x2, 0x2)
setsockopt$RXRPC_MIN_SECURITY_LEVEL(r6, 0x110, 0x4, &(0x7f0000000440)=0x1, 0x4)
syz_usb_connect(0x0, 0x32, &(0x7f0000000000)=ANY=[@ANYBLOB="1201000200000040a61b01000100000000010902200001010080320904"], 0x0) (async)
openat$ptp1(0xffffffffffffff9c, &(0x7f0000000c40), 0x149201, 0x0) (async)
ioctl$PTP_ENABLE_PPS(r1, 0x40043d04, 0x1) (async)
socket$kcm(0x10, 0x2, 0x4) (async)
sendmsg$inet(r2, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)=[{&(0x7f0000000100)="5c00000012006bab9e3fe3d86e6c1d0000147ea60864160af36504b68675f8001d000a00a0e69ee517d34460bc24eab556a705251e6182949a36c23d3b48dfd8cdbf9367b4fa51f60a64c9f4080003680601000008000300ff000000", 0x5c}], 0x1, 0x0, 0x0, 0x1f00c00e}, 0x0) (async)
syz_usb_connect$uac3(0x3, 0x80, &(0x7f0000000280)=ANY=[], 0x0) (async)
syz_usb_control_io(r0, 0x0, 0x0) (async)
syz_usb_control_io$uac3(r3, 0x0, 0x0) (async)
syz_open_dev$dvb_frontend(&(0x7f0000000100), 0x1, 0x802) (async)
getsockopt$bt_hci(r5, 0x84, 0x81, &(0x7f0000001280)=""/4107, &(0x7f00000000c0)=0x100b) (async)
executing program 4:
r0 = syz_open_dev$dvb_frontend(&(0x7f0000000080), 0x0, 0x402)
r1 = socket$inet_mptcp(0x2, 0x1, 0x106)
r2 = socket(0x10, 0x803, 0x0)
syz_genetlink_get_family_id$tipc(&(0x7f0000000000), r2)
getsockname$packet(r2, &(0x7f0000000280)={0x11, 0x0, <r3=>0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14)
sendmsg$nl_route(r2, &(0x7f0000000180)={&(0x7f0000000040)={0x10, 0x0, 0x0, 0x400000}, 0xc, &(0x7f0000000140)={&(0x7f0000000100)=@RTM_GETMDB={0x18, 0x56, 0x2, 0x70bd25, 0x25dfdbfe, {0x7, r3}, [""]}, 0x18}}, 0x20000000)
sendmsg$nl_route(r2, &(0x7f0000000240)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000580)=ANY=[@ANYBLOB="4800000010000305ff810000fddbdf2500000000", @ANYRES32=r3, @ANYBLOB="1748000040000200280012800a000100767863616e0000001800028014000100000000", @ANYRES32=r3], 0x48}, 0x1, 0x0, 0x0, 0x40}, 0x0)
connect$inet(r1, &(0x7f0000000000)={0x2, 0x4e22, @empty}, 0x10)
setsockopt$sock_int(r1, 0x1, 0x9, &(0x7f00000003c0)=0x246, 0x4)
ioctl$FE_SET_PROPERTY(r0, 0x40106f52, &(0x7f00000000c0)={0x29, &(0x7f0000000200)=[{0x34, '\x00', @data=0x4}]})
syz_open_dev$dvb_frontend(&(0x7f0000000080), 0x0, 0x402) (async)
socket$inet_mptcp(0x2, 0x1, 0x106) (async)
socket(0x10, 0x803, 0x0) (async)
syz_genetlink_get_family_id$tipc(&(0x7f0000000000), r2) (async)
getsockname$packet(r2, &(0x7f0000000280)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) (async)
sendmsg$nl_route(r2, &(0x7f0000000180)={&(0x7f0000000040)={0x10, 0x0, 0x0, 0x400000}, 0xc, &(0x7f0000000140)={&(0x7f0000000100)=@RTM_GETMDB={0x18, 0x56, 0x2, 0x70bd25, 0x25dfdbfe, {0x7, r3}, [""]}, 0x18}}, 0x20000000) (async)
sendmsg$nl_route(r2, &(0x7f0000000240)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000580)=ANY=[@ANYBLOB="4800000010000305ff810000fddbdf2500000000", @ANYRES32=r3, @ANYBLOB="1748000040000200280012800a000100767863616e0000001800028014000100000000", @ANYRES32=r3], 0x48}, 0x1, 0x0, 0x0, 0x40}, 0x0) (async)
connect$inet(r1, &(0x7f0000000000)={0x2, 0x4e22, @empty}, 0x10) (async)
setsockopt$sock_int(r1, 0x1, 0x9, &(0x7f00000003c0)=0x246, 0x4) (async)
ioctl$FE_SET_PROPERTY(r0, 0x40106f52, &(0x7f00000000c0)={0x29, &(0x7f0000000200)=[{0x34, '\x00', @data=0x4}]}) (async)

program crashed: KASAN: slab-use-after-free Read in dvb_device_open
testing program (duration=45s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): [19, 27, 20]
detailed listing:
executing program 3:
r0 = socket$inet6_tcp(0xa, 0x1, 0x0)
connect$inet6(r0, 0x0, 0x0)
gettid()
timer_settime(0x0, 0x0, &(0x7f0000000280)={{0x0, 0x989680}, {0x0, 0x989680}}, 0x0)
socketpair$unix(0x1, 0x0, 0x0, 0x0)
getsockopt$sock_cred(0xffffffffffffffff, 0x1, 0x11, 0x0, &(0x7f0000cab000))
setsockopt$sock_cred(0xffffffffffffffff, 0x1, 0x11, 0x0, 0x0)
setsockopt$inet6_tcp_TCP_REPAIR_QUEUE(r0, 0x6, 0x14, 0x0, 0x0)
mmap(&(0x7f0000000000/0x4000)=nil, 0x4000, 0x1, 0x10012, 0xffffffffffffffff, 0x5deba000)
mmap(&(0x7f0000bfe000/0x400000)=nil, 0x400000, 0x4, 0x40010, r0, 0xd1aa000)
mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x3, 0x8031, 0xffffffffffffffff, 0x0)
mmap$dsp(&(0x7f0000ffd000/0x2000)=nil, 0x2000, 0x100000b, 0x810, 0xffffffffffffffff, 0x0)
socket$xdp(0x2c, 0x3, 0x0)
r1 = socket$kcm(0xa, 0x2, 0x0)
r2 = socket(0x2, 0x80805, 0x0)
r3 = openat$fuse(0xffffffffffffff9c, &(0x7f0000000080), 0x2, 0x0)
read$FUSE(r3, &(0x7f0000000600)={0x2020}, 0x2020)
setsockopt$IP_VS_SO_SET_ADD(r2, 0x0, 0x482, &(0x7f0000000240)={0x84, @dev={0xac, 0x14, 0x14, 0x15}, 0x4e20, 0x3, 'wlc\x00', 0x2, 0x660f537e, 0x3}, 0x2c)
sendmsg$sock(r1, &(0x7f0000000400)={&(0x7f0000000580)=@in6={0x2, 0x4e20, 0x0, @dev={0xfe, 0x80, '\x00', 0xfd}}, 0x80, 0x0, 0x0, &(0x7f0000000000)=[@mark={{0x14, 0x1, 0x24, 0x3}}], 0x18}, 0x0)
executing program 0:
r0 = syz_usb_connect(0x0, 0x32, &(0x7f0000000000)=ANY=[@ANYBLOB="1201000200000040a61b01000100000000010902200001010080320904"], 0x0)
r1 = openat$ptp1(0xffffffffffffff9c, &(0x7f0000000c40), 0x149201, 0x0)
ioctl$PTP_ENABLE_PPS(r1, 0x40043d04, 0x1)
r2 = socket$kcm(0x10, 0x2, 0x4)
sendmsg$inet(r2, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)=[{&(0x7f0000000100)="5c00000012006bab9e3fe3d86e6c1d0000147ea60864160af36504b68675f8001d000a00a0e69ee517d34460bc24eab556a705251e6182949a36c23d3b48dfd8cdbf9367b4fa51f60a64c9f4080003680601000008000300ff000000", 0x5c}], 0x1, 0x0, 0x0, 0x1f00c00e}, 0x0)
r3 = syz_usb_connect$uac3(0x3, 0x80, &(0x7f0000000280)=ANY=[], 0x0)
syz_usb_control_io(r0, 0x0, 0x0)
syz_usb_control_io$sierra_net(r0, 0x0, &(0x7f0000000700)={0x1c, &(0x7f0000000280)=ANY=[], 0x0, 0x0})
syz_usb_control_io$uac3(r3, 0x0, 0x0)
syz_usb_control_io$printer(r0, 0x0, &(0x7f00000005c0)={0x34, &(0x7f00000003c0)=ANY=[], 0x0, 0x0, 0x0, 0x0, 0x0})
mkdirat(0xffffffffffffff9c, &(0x7f0000000200)='./file0\x00', 0x0)
r4 = openat(0xffffffffffffff9c, &(0x7f0000000080)='./file0\x00', 0x0, 0xd5)
ioctl$FS_IOC_GETFLAGS(r4, 0x80086601, &(0x7f0000000100))
syz_open_dev$dvb_frontend(&(0x7f0000000100), 0x1, 0x802)
r5 = socket$inet6_sctp(0xa, 0x801, 0x84)
getsockopt$bt_hci(r5, 0x84, 0x81, &(0x7f0000001280)=""/4107, &(0x7f00000000c0)=0x100b)
r6 = socket$rxrpc(0x21, 0x2, 0x2)
setsockopt$RXRPC_MIN_SECURITY_LEVEL(r6, 0x110, 0x4, &(0x7f0000000440)=0x1, 0x4)
syz_usb_connect(0x0, 0x32, &(0x7f0000000000)=ANY=[@ANYBLOB="1201000200000040a61b01000100000000010902200001010080320904"], 0x0) (async)
openat$ptp1(0xffffffffffffff9c, &(0x7f0000000c40), 0x149201, 0x0) (async)
ioctl$PTP_ENABLE_PPS(r1, 0x40043d04, 0x1) (async)
socket$kcm(0x10, 0x2, 0x4) (async)
sendmsg$inet(r2, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)=[{&(0x7f0000000100)="5c00000012006bab9e3fe3d86e6c1d0000147ea60864160af36504b68675f8001d000a00a0e69ee517d34460bc24eab556a705251e6182949a36c23d3b48dfd8cdbf9367b4fa51f60a64c9f4080003680601000008000300ff000000", 0x5c}], 0x1, 0x0, 0x0, 0x1f00c00e}, 0x0) (async)
syz_usb_connect$uac3(0x3, 0x80, &(0x7f0000000280)=ANY=[], 0x0) (async)
syz_usb_control_io$uac3(r3, 0x0, 0x0) (async)
syz_open_dev$dvb_frontend(&(0x7f0000000100), 0x1, 0x802) (async)
getsockopt$bt_hci(r5, 0x84, 0x81, &(0x7f0000001280)=""/4107, &(0x7f00000000c0)=0x100b) (async)
executing program 4:
r0 = syz_open_dev$dvb_frontend(&(0x7f0000000080), 0x0, 0x402)
r1 = socket$inet_mptcp(0x2, 0x1, 0x106)
r2 = socket(0x10, 0x803, 0x0)
syz_genetlink_get_family_id$tipc(&(0x7f0000000000), r2)
getsockname$packet(r2, &(0x7f0000000280)={0x11, 0x0, <r3=>0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14)
sendmsg$nl_route(r2, &(0x7f0000000180)={&(0x7f0000000040)={0x10, 0x0, 0x0, 0x400000}, 0xc, &(0x7f0000000140)={&(0x7f0000000100)=@RTM_GETMDB={0x18, 0x56, 0x2, 0x70bd25, 0x25dfdbfe, {0x7, r3}, [""]}, 0x18}}, 0x20000000)
sendmsg$nl_route(r2, &(0x7f0000000240)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000580)=ANY=[@ANYBLOB="4800000010000305ff810000fddbdf2500000000", @ANYRES32=r3, @ANYBLOB="1748000040000200280012800a000100767863616e0000001800028014000100000000", @ANYRES32=r3], 0x48}, 0x1, 0x0, 0x0, 0x40}, 0x0)
connect$inet(r1, &(0x7f0000000000)={0x2, 0x4e22, @empty}, 0x10)
setsockopt$sock_int(r1, 0x1, 0x9, &(0x7f00000003c0)=0x246, 0x4)
ioctl$FE_SET_PROPERTY(r0, 0x40106f52, &(0x7f00000000c0)={0x29, &(0x7f0000000200)=[{0x34, '\x00', @data=0x4}]})
syz_open_dev$dvb_frontend(&(0x7f0000000080), 0x0, 0x402) (async)
socket$inet_mptcp(0x2, 0x1, 0x106) (async)
socket(0x10, 0x803, 0x0) (async)
syz_genetlink_get_family_id$tipc(&(0x7f0000000000), r2) (async)
getsockname$packet(r2, &(0x7f0000000280)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) (async)
sendmsg$nl_route(r2, &(0x7f0000000180)={&(0x7f0000000040)={0x10, 0x0, 0x0, 0x400000}, 0xc, &(0x7f0000000140)={&(0x7f0000000100)=@RTM_GETMDB={0x18, 0x56, 0x2, 0x70bd25, 0x25dfdbfe, {0x7, r3}, [""]}, 0x18}}, 0x20000000) (async)
sendmsg$nl_route(r2, &(0x7f0000000240)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000580)=ANY=[@ANYBLOB="4800000010000305ff810000fddbdf2500000000", @ANYRES32=r3, @ANYBLOB="1748000040000200280012800a000100767863616e0000001800028014000100000000", @ANYRES32=r3], 0x48}, 0x1, 0x0, 0x0, 0x40}, 0x0) (async)
connect$inet(r1, &(0x7f0000000000)={0x2, 0x4e22, @empty}, 0x10) (async)
setsockopt$sock_int(r1, 0x1, 0x9, &(0x7f00000003c0)=0x246, 0x4) (async)
ioctl$FE_SET_PROPERTY(r0, 0x40106f52, &(0x7f00000000c0)={0x29, &(0x7f0000000200)=[{0x34, '\x00', @data=0x4}]}) (async)

program crashed: KASAN: slab-use-after-free Read in dvb_device_open
testing program (duration=45s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): [19, 26, 20]
detailed listing:
executing program 3:
r0 = socket$inet6_tcp(0xa, 0x1, 0x0)
connect$inet6(r0, 0x0, 0x0)
gettid()
timer_settime(0x0, 0x0, &(0x7f0000000280)={{0x0, 0x989680}, {0x0, 0x989680}}, 0x0)
socketpair$unix(0x1, 0x0, 0x0, 0x0)
getsockopt$sock_cred(0xffffffffffffffff, 0x1, 0x11, 0x0, &(0x7f0000cab000))
setsockopt$sock_cred(0xffffffffffffffff, 0x1, 0x11, 0x0, 0x0)
setsockopt$inet6_tcp_TCP_REPAIR_QUEUE(r0, 0x6, 0x14, 0x0, 0x0)
mmap(&(0x7f0000000000/0x4000)=nil, 0x4000, 0x1, 0x10012, 0xffffffffffffffff, 0x5deba000)
mmap(&(0x7f0000bfe000/0x400000)=nil, 0x400000, 0x4, 0x40010, r0, 0xd1aa000)
mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x3, 0x8031, 0xffffffffffffffff, 0x0)
mmap$dsp(&(0x7f0000ffd000/0x2000)=nil, 0x2000, 0x100000b, 0x810, 0xffffffffffffffff, 0x0)
socket$xdp(0x2c, 0x3, 0x0)
r1 = socket$kcm(0xa, 0x2, 0x0)
r2 = socket(0x2, 0x80805, 0x0)
r3 = openat$fuse(0xffffffffffffff9c, &(0x7f0000000080), 0x2, 0x0)
read$FUSE(r3, &(0x7f0000000600)={0x2020}, 0x2020)
setsockopt$IP_VS_SO_SET_ADD(r2, 0x0, 0x482, &(0x7f0000000240)={0x84, @dev={0xac, 0x14, 0x14, 0x15}, 0x4e20, 0x3, 'wlc\x00', 0x2, 0x660f537e, 0x3}, 0x2c)
sendmsg$sock(r1, &(0x7f0000000400)={&(0x7f0000000580)=@in6={0x2, 0x4e20, 0x0, @dev={0xfe, 0x80, '\x00', 0xfd}}, 0x80, 0x0, 0x0, &(0x7f0000000000)=[@mark={{0x14, 0x1, 0x24, 0x3}}], 0x18}, 0x0)
executing program 0:
r0 = syz_usb_connect(0x0, 0x32, &(0x7f0000000000)=ANY=[@ANYBLOB="1201000200000040a61b01000100000000010902200001010080320904"], 0x0)
r1 = openat$ptp1(0xffffffffffffff9c, &(0x7f0000000c40), 0x149201, 0x0)
ioctl$PTP_ENABLE_PPS(r1, 0x40043d04, 0x1)
r2 = socket$kcm(0x10, 0x2, 0x4)
sendmsg$inet(r2, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)=[{&(0x7f0000000100)="5c00000012006bab9e3fe3d86e6c1d0000147ea60864160af36504b68675f8001d000a00a0e69ee517d34460bc24eab556a705251e6182949a36c23d3b48dfd8cdbf9367b4fa51f60a64c9f4080003680601000008000300ff000000", 0x5c}], 0x1, 0x0, 0x0, 0x1f00c00e}, 0x0)
r3 = syz_usb_connect$uac3(0x3, 0x80, &(0x7f0000000280)=ANY=[], 0x0)
syz_usb_control_io(r0, 0x0, 0x0)
syz_usb_control_io$sierra_net(r0, 0x0, &(0x7f0000000700)={0x1c, &(0x7f0000000280)=ANY=[], 0x0, 0x0})
syz_usb_control_io$uac3(r3, 0x0, 0x0)
syz_usb_control_io$printer(r0, 0x0, &(0x7f00000005c0)={0x34, &(0x7f00000003c0)=ANY=[], 0x0, 0x0, 0x0, 0x0, 0x0})
mkdirat(0xffffffffffffff9c, &(0x7f0000000200)='./file0\x00', 0x0)
r4 = openat(0xffffffffffffff9c, &(0x7f0000000080)='./file0\x00', 0x0, 0xd5)
ioctl$FS_IOC_GETFLAGS(r4, 0x80086601, &(0x7f0000000100))
syz_open_dev$dvb_frontend(&(0x7f0000000100), 0x1, 0x802)
r5 = socket$inet6_sctp(0xa, 0x801, 0x84)
getsockopt$bt_hci(r5, 0x84, 0x81, &(0x7f0000001280)=""/4107, &(0x7f00000000c0)=0x100b)
r6 = socket$rxrpc(0x21, 0x2, 0x2)
setsockopt$RXRPC_MIN_SECURITY_LEVEL(r6, 0x110, 0x4, &(0x7f0000000440)=0x1, 0x4)
syz_usb_connect(0x0, 0x32, &(0x7f0000000000)=ANY=[@ANYBLOB="1201000200000040a61b01000100000000010902200001010080320904"], 0x0) (async)
openat$ptp1(0xffffffffffffff9c, &(0x7f0000000c40), 0x149201, 0x0) (async)
ioctl$PTP_ENABLE_PPS(r1, 0x40043d04, 0x1) (async)
socket$kcm(0x10, 0x2, 0x4) (async)
sendmsg$inet(r2, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)=[{&(0x7f0000000100)="5c00000012006bab9e3fe3d86e6c1d0000147ea60864160af36504b68675f8001d000a00a0e69ee517d34460bc24eab556a705251e6182949a36c23d3b48dfd8cdbf9367b4fa51f60a64c9f4080003680601000008000300ff000000", 0x5c}], 0x1, 0x0, 0x0, 0x1f00c00e}, 0x0) (async)
syz_usb_control_io$uac3(r3, 0x0, 0x0) (async)
syz_open_dev$dvb_frontend(&(0x7f0000000100), 0x1, 0x802) (async)
getsockopt$bt_hci(r5, 0x84, 0x81, &(0x7f0000001280)=""/4107, &(0x7f00000000c0)=0x100b) (async)
executing program 4:
r0 = syz_open_dev$dvb_frontend(&(0x7f0000000080), 0x0, 0x402)
r1 = socket$inet_mptcp(0x2, 0x1, 0x106)
r2 = socket(0x10, 0x803, 0x0)
syz_genetlink_get_family_id$tipc(&(0x7f0000000000), r2)
getsockname$packet(r2, &(0x7f0000000280)={0x11, 0x0, <r3=>0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14)
sendmsg$nl_route(r2, &(0x7f0000000180)={&(0x7f0000000040)={0x10, 0x0, 0x0, 0x400000}, 0xc, &(0x7f0000000140)={&(0x7f0000000100)=@RTM_GETMDB={0x18, 0x56, 0x2, 0x70bd25, 0x25dfdbfe, {0x7, r3}, [""]}, 0x18}}, 0x20000000)
sendmsg$nl_route(r2, &(0x7f0000000240)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000580)=ANY=[@ANYBLOB="4800000010000305ff810000fddbdf2500000000", @ANYRES32=r3, @ANYBLOB="1748000040000200280012800a000100767863616e0000001800028014000100000000", @ANYRES32=r3], 0x48}, 0x1, 0x0, 0x0, 0x40}, 0x0)
connect$inet(r1, &(0x7f0000000000)={0x2, 0x4e22, @empty}, 0x10)
setsockopt$sock_int(r1, 0x1, 0x9, &(0x7f00000003c0)=0x246, 0x4)
ioctl$FE_SET_PROPERTY(r0, 0x40106f52, &(0x7f00000000c0)={0x29, &(0x7f0000000200)=[{0x34, '\x00', @data=0x4}]})
syz_open_dev$dvb_frontend(&(0x7f0000000080), 0x0, 0x402) (async)
socket$inet_mptcp(0x2, 0x1, 0x106) (async)
socket(0x10, 0x803, 0x0) (async)
syz_genetlink_get_family_id$tipc(&(0x7f0000000000), r2) (async)
getsockname$packet(r2, &(0x7f0000000280)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) (async)
sendmsg$nl_route(r2, &(0x7f0000000180)={&(0x7f0000000040)={0x10, 0x0, 0x0, 0x400000}, 0xc, &(0x7f0000000140)={&(0x7f0000000100)=@RTM_GETMDB={0x18, 0x56, 0x2, 0x70bd25, 0x25dfdbfe, {0x7, r3}, [""]}, 0x18}}, 0x20000000) (async)
sendmsg$nl_route(r2, &(0x7f0000000240)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000580)=ANY=[@ANYBLOB="4800000010000305ff810000fddbdf2500000000", @ANYRES32=r3, @ANYBLOB="1748000040000200280012800a000100767863616e0000001800028014000100000000", @ANYRES32=r3], 0x48}, 0x1, 0x0, 0x0, 0x40}, 0x0) (async)
connect$inet(r1, &(0x7f0000000000)={0x2, 0x4e22, @empty}, 0x10) (async)
setsockopt$sock_int(r1, 0x1, 0x9, &(0x7f00000003c0)=0x246, 0x4) (async)
ioctl$FE_SET_PROPERTY(r0, 0x40106f52, &(0x7f00000000c0)={0x29, &(0x7f0000000200)=[{0x34, '\x00', @data=0x4}]}) (async)

program did not crash
testing program (duration=45s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): [19, 26, 20]
detailed listing:
executing program 3:
r0 = socket$inet6_tcp(0xa, 0x1, 0x0)
connect$inet6(r0, 0x0, 0x0)
gettid()
timer_settime(0x0, 0x0, &(0x7f0000000280)={{0x0, 0x989680}, {0x0, 0x989680}}, 0x0)
socketpair$unix(0x1, 0x0, 0x0, 0x0)
getsockopt$sock_cred(0xffffffffffffffff, 0x1, 0x11, 0x0, &(0x7f0000cab000))
setsockopt$sock_cred(0xffffffffffffffff, 0x1, 0x11, 0x0, 0x0)
setsockopt$inet6_tcp_TCP_REPAIR_QUEUE(r0, 0x6, 0x14, 0x0, 0x0)
mmap(&(0x7f0000000000/0x4000)=nil, 0x4000, 0x1, 0x10012, 0xffffffffffffffff, 0x5deba000)
mmap(&(0x7f0000bfe000/0x400000)=nil, 0x400000, 0x4, 0x40010, r0, 0xd1aa000)
mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x3, 0x8031, 0xffffffffffffffff, 0x0)
mmap$dsp(&(0x7f0000ffd000/0x2000)=nil, 0x2000, 0x100000b, 0x810, 0xffffffffffffffff, 0x0)
socket$xdp(0x2c, 0x3, 0x0)
r1 = socket$kcm(0xa, 0x2, 0x0)
r2 = socket(0x2, 0x80805, 0x0)
r3 = openat$fuse(0xffffffffffffff9c, &(0x7f0000000080), 0x2, 0x0)
read$FUSE(r3, &(0x7f0000000600)={0x2020}, 0x2020)
setsockopt$IP_VS_SO_SET_ADD(r2, 0x0, 0x482, &(0x7f0000000240)={0x84, @dev={0xac, 0x14, 0x14, 0x15}, 0x4e20, 0x3, 'wlc\x00', 0x2, 0x660f537e, 0x3}, 0x2c)
sendmsg$sock(r1, &(0x7f0000000400)={&(0x7f0000000580)=@in6={0x2, 0x4e20, 0x0, @dev={0xfe, 0x80, '\x00', 0xfd}}, 0x80, 0x0, 0x0, &(0x7f0000000000)=[@mark={{0x14, 0x1, 0x24, 0x3}}], 0x18}, 0x0)
executing program 0:
r0 = syz_usb_connect(0x0, 0x32, &(0x7f0000000000)=ANY=[@ANYBLOB="1201000200000040a61b01000100000000010902200001010080320904"], 0x0)
r1 = openat$ptp1(0xffffffffffffff9c, &(0x7f0000000c40), 0x149201, 0x0)
ioctl$PTP_ENABLE_PPS(r1, 0x40043d04, 0x1)
r2 = socket$kcm(0x10, 0x2, 0x4)
sendmsg$inet(r2, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)=[{&(0x7f0000000100)="5c00000012006bab9e3fe3d86e6c1d0000147ea60864160af36504b68675f8001d000a00a0e69ee517d34460bc24eab556a705251e6182949a36c23d3b48dfd8cdbf9367b4fa51f60a64c9f4080003680601000008000300ff000000", 0x5c}], 0x1, 0x0, 0x0, 0x1f00c00e}, 0x0)
r3 = syz_usb_connect$uac3(0x3, 0x80, &(0x7f0000000280)=ANY=[], 0x0)
syz_usb_control_io(r0, 0x0, 0x0)
syz_usb_control_io$sierra_net(r0, 0x0, &(0x7f0000000700)={0x1c, &(0x7f0000000280)=ANY=[], 0x0, 0x0})
syz_usb_control_io$uac3(r3, 0x0, 0x0)
syz_usb_control_io$printer(r0, 0x0, &(0x7f00000005c0)={0x34, &(0x7f00000003c0)=ANY=[], 0x0, 0x0, 0x0, 0x0, 0x0})
mkdirat(0xffffffffffffff9c, &(0x7f0000000200)='./file0\x00', 0x0)
r4 = openat(0xffffffffffffff9c, &(0x7f0000000080)='./file0\x00', 0x0, 0xd5)
ioctl$FS_IOC_GETFLAGS(r4, 0x80086601, &(0x7f0000000100))
syz_open_dev$dvb_frontend(&(0x7f0000000100), 0x1, 0x802)
r5 = socket$inet6_sctp(0xa, 0x801, 0x84)
getsockopt$bt_hci(r5, 0x84, 0x81, &(0x7f0000001280)=""/4107, &(0x7f00000000c0)=0x100b)
r6 = socket$rxrpc(0x21, 0x2, 0x2)
setsockopt$RXRPC_MIN_SECURITY_LEVEL(r6, 0x110, 0x4, &(0x7f0000000440)=0x1, 0x4)
syz_usb_connect(0x0, 0x32, &(0x7f0000000000)=ANY=[@ANYBLOB="1201000200000040a61b01000100000000010902200001010080320904"], 0x0) (async)
openat$ptp1(0xffffffffffffff9c, &(0x7f0000000c40), 0x149201, 0x0) (async)
ioctl$PTP_ENABLE_PPS(r1, 0x40043d04, 0x1) (async)
socket$kcm(0x10, 0x2, 0x4) (async)
syz_usb_connect$uac3(0x3, 0x80, &(0x7f0000000280)=ANY=[], 0x0) (async)
syz_usb_control_io$uac3(r3, 0x0, 0x0) (async)
syz_open_dev$dvb_frontend(&(0x7f0000000100), 0x1, 0x802) (async)
getsockopt$bt_hci(r5, 0x84, 0x81, &(0x7f0000001280)=""/4107, &(0x7f00000000c0)=0x100b) (async)
executing program 4:
r0 = syz_open_dev$dvb_frontend(&(0x7f0000000080), 0x0, 0x402)
r1 = socket$inet_mptcp(0x2, 0x1, 0x106)
r2 = socket(0x10, 0x803, 0x0)
syz_genetlink_get_family_id$tipc(&(0x7f0000000000), r2)
getsockname$packet(r2, &(0x7f0000000280)={0x11, 0x0, <r3=>0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14)
sendmsg$nl_route(r2, &(0x7f0000000180)={&(0x7f0000000040)={0x10, 0x0, 0x0, 0x400000}, 0xc, &(0x7f0000000140)={&(0x7f0000000100)=@RTM_GETMDB={0x18, 0x56, 0x2, 0x70bd25, 0x25dfdbfe, {0x7, r3}, [""]}, 0x18}}, 0x20000000)
sendmsg$nl_route(r2, &(0x7f0000000240)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000580)=ANY=[@ANYBLOB="4800000010000305ff810000fddbdf2500000000", @ANYRES32=r3, @ANYBLOB="1748000040000200280012800a000100767863616e0000001800028014000100000000", @ANYRES32=r3], 0x48}, 0x1, 0x0, 0x0, 0x40}, 0x0)
connect$inet(r1, &(0x7f0000000000)={0x2, 0x4e22, @empty}, 0x10)
setsockopt$sock_int(r1, 0x1, 0x9, &(0x7f00000003c0)=0x246, 0x4)
ioctl$FE_SET_PROPERTY(r0, 0x40106f52, &(0x7f00000000c0)={0x29, &(0x7f0000000200)=[{0x34, '\x00', @data=0x4}]})
syz_open_dev$dvb_frontend(&(0x7f0000000080), 0x0, 0x402) (async)
socket$inet_mptcp(0x2, 0x1, 0x106) (async)
socket(0x10, 0x803, 0x0) (async)
syz_genetlink_get_family_id$tipc(&(0x7f0000000000), r2) (async)
getsockname$packet(r2, &(0x7f0000000280)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) (async)
sendmsg$nl_route(r2, &(0x7f0000000180)={&(0x7f0000000040)={0x10, 0x0, 0x0, 0x400000}, 0xc, &(0x7f0000000140)={&(0x7f0000000100)=@RTM_GETMDB={0x18, 0x56, 0x2, 0x70bd25, 0x25dfdbfe, {0x7, r3}, [""]}, 0x18}}, 0x20000000) (async)
sendmsg$nl_route(r2, &(0x7f0000000240)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000580)=ANY=[@ANYBLOB="4800000010000305ff810000fddbdf2500000000", @ANYRES32=r3, @ANYBLOB="1748000040000200280012800a000100767863616e0000001800028014000100000000", @ANYRES32=r3], 0x48}, 0x1, 0x0, 0x0, 0x40}, 0x0) (async)
connect$inet(r1, &(0x7f0000000000)={0x2, 0x4e22, @empty}, 0x10) (async)
setsockopt$sock_int(r1, 0x1, 0x9, &(0x7f00000003c0)=0x246, 0x4) (async)
ioctl$FE_SET_PROPERTY(r0, 0x40106f52, &(0x7f00000000c0)={0x29, &(0x7f0000000200)=[{0x34, '\x00', @data=0x4}]}) (async)

program did not crash
testing program (duration=45s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): [19, 26, 20]
detailed listing:
executing program 3:
r0 = socket$inet6_tcp(0xa, 0x1, 0x0)
connect$inet6(r0, 0x0, 0x0)
gettid()
timer_settime(0x0, 0x0, &(0x7f0000000280)={{0x0, 0x989680}, {0x0, 0x989680}}, 0x0)
socketpair$unix(0x1, 0x0, 0x0, 0x0)
getsockopt$sock_cred(0xffffffffffffffff, 0x1, 0x11, 0x0, &(0x7f0000cab000))
setsockopt$sock_cred(0xffffffffffffffff, 0x1, 0x11, 0x0, 0x0)
setsockopt$inet6_tcp_TCP_REPAIR_QUEUE(r0, 0x6, 0x14, 0x0, 0x0)
mmap(&(0x7f0000000000/0x4000)=nil, 0x4000, 0x1, 0x10012, 0xffffffffffffffff, 0x5deba000)
mmap(&(0x7f0000bfe000/0x400000)=nil, 0x400000, 0x4, 0x40010, r0, 0xd1aa000)
mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x3, 0x8031, 0xffffffffffffffff, 0x0)
mmap$dsp(&(0x7f0000ffd000/0x2000)=nil, 0x2000, 0x100000b, 0x810, 0xffffffffffffffff, 0x0)
socket$xdp(0x2c, 0x3, 0x0)
r1 = socket$kcm(0xa, 0x2, 0x0)
r2 = socket(0x2, 0x80805, 0x0)
r3 = openat$fuse(0xffffffffffffff9c, &(0x7f0000000080), 0x2, 0x0)
read$FUSE(r3, &(0x7f0000000600)={0x2020}, 0x2020)
setsockopt$IP_VS_SO_SET_ADD(r2, 0x0, 0x482, &(0x7f0000000240)={0x84, @dev={0xac, 0x14, 0x14, 0x15}, 0x4e20, 0x3, 'wlc\x00', 0x2, 0x660f537e, 0x3}, 0x2c)
sendmsg$sock(r1, &(0x7f0000000400)={&(0x7f0000000580)=@in6={0x2, 0x4e20, 0x0, @dev={0xfe, 0x80, '\x00', 0xfd}}, 0x80, 0x0, 0x0, &(0x7f0000000000)=[@mark={{0x14, 0x1, 0x24, 0x3}}], 0x18}, 0x0)
executing program 0:
r0 = syz_usb_connect(0x0, 0x32, &(0x7f0000000000)=ANY=[@ANYBLOB="1201000200000040a61b01000100000000010902200001010080320904"], 0x0)
r1 = openat$ptp1(0xffffffffffffff9c, &(0x7f0000000c40), 0x149201, 0x0)
ioctl$PTP_ENABLE_PPS(r1, 0x40043d04, 0x1)
r2 = socket$kcm(0x10, 0x2, 0x4)
sendmsg$inet(r2, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)=[{&(0x7f0000000100)="5c00000012006bab9e3fe3d86e6c1d0000147ea60864160af36504b68675f8001d000a00a0e69ee517d34460bc24eab556a705251e6182949a36c23d3b48dfd8cdbf9367b4fa51f60a64c9f4080003680601000008000300ff000000", 0x5c}], 0x1, 0x0, 0x0, 0x1f00c00e}, 0x0)
r3 = syz_usb_connect$uac3(0x3, 0x80, &(0x7f0000000280)=ANY=[], 0x0)
syz_usb_control_io(r0, 0x0, 0x0)
syz_usb_control_io$sierra_net(r0, 0x0, &(0x7f0000000700)={0x1c, &(0x7f0000000280)=ANY=[], 0x0, 0x0})
syz_usb_control_io$uac3(r3, 0x0, 0x0)
syz_usb_control_io$printer(r0, 0x0, &(0x7f00000005c0)={0x34, &(0x7f00000003c0)=ANY=[], 0x0, 0x0, 0x0, 0x0, 0x0})
mkdirat(0xffffffffffffff9c, &(0x7f0000000200)='./file0\x00', 0x0)
r4 = openat(0xffffffffffffff9c, &(0x7f0000000080)='./file0\x00', 0x0, 0xd5)
ioctl$FS_IOC_GETFLAGS(r4, 0x80086601, &(0x7f0000000100))
syz_open_dev$dvb_frontend(&(0x7f0000000100), 0x1, 0x802)
r5 = socket$inet6_sctp(0xa, 0x801, 0x84)
getsockopt$bt_hci(r5, 0x84, 0x81, &(0x7f0000001280)=""/4107, &(0x7f00000000c0)=0x100b)
r6 = socket$rxrpc(0x21, 0x2, 0x2)
setsockopt$RXRPC_MIN_SECURITY_LEVEL(r6, 0x110, 0x4, &(0x7f0000000440)=0x1, 0x4)
syz_usb_connect(0x0, 0x32, &(0x7f0000000000)=ANY=[@ANYBLOB="1201000200000040a61b01000100000000010902200001010080320904"], 0x0) (async)
openat$ptp1(0xffffffffffffff9c, &(0x7f0000000c40), 0x149201, 0x0) (async)
ioctl$PTP_ENABLE_PPS(r1, 0x40043d04, 0x1) (async)
sendmsg$inet(r2, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)=[{&(0x7f0000000100)="5c00000012006bab9e3fe3d86e6c1d0000147ea60864160af36504b68675f8001d000a00a0e69ee517d34460bc24eab556a705251e6182949a36c23d3b48dfd8cdbf9367b4fa51f60a64c9f4080003680601000008000300ff000000", 0x5c}], 0x1, 0x0, 0x0, 0x1f00c00e}, 0x0) (async)
syz_usb_connect$uac3(0x3, 0x80, &(0x7f0000000280)=ANY=[], 0x0) (async)
syz_usb_control_io$uac3(r3, 0x0, 0x0) (async)
syz_open_dev$dvb_frontend(&(0x7f0000000100), 0x1, 0x802) (async)
getsockopt$bt_hci(r5, 0x84, 0x81, &(0x7f0000001280)=""/4107, &(0x7f00000000c0)=0x100b) (async)
executing program 4:
r0 = syz_open_dev$dvb_frontend(&(0x7f0000000080), 0x0, 0x402)
r1 = socket$inet_mptcp(0x2, 0x1, 0x106)
r2 = socket(0x10, 0x803, 0x0)
syz_genetlink_get_family_id$tipc(&(0x7f0000000000), r2)
getsockname$packet(r2, &(0x7f0000000280)={0x11, 0x0, <r3=>0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14)
sendmsg$nl_route(r2, &(0x7f0000000180)={&(0x7f0000000040)={0x10, 0x0, 0x0, 0x400000}, 0xc, &(0x7f0000000140)={&(0x7f0000000100)=@RTM_GETMDB={0x18, 0x56, 0x2, 0x70bd25, 0x25dfdbfe, {0x7, r3}, [""]}, 0x18}}, 0x20000000)
sendmsg$nl_route(r2, &(0x7f0000000240)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000580)=ANY=[@ANYBLOB="4800000010000305ff810000fddbdf2500000000", @ANYRES32=r3, @ANYBLOB="1748000040000200280012800a000100767863616e0000001800028014000100000000", @ANYRES32=r3], 0x48}, 0x1, 0x0, 0x0, 0x40}, 0x0)
connect$inet(r1, &(0x7f0000000000)={0x2, 0x4e22, @empty}, 0x10)
setsockopt$sock_int(r1, 0x1, 0x9, &(0x7f00000003c0)=0x246, 0x4)
ioctl$FE_SET_PROPERTY(r0, 0x40106f52, &(0x7f00000000c0)={0x29, &(0x7f0000000200)=[{0x34, '\x00', @data=0x4}]})
syz_open_dev$dvb_frontend(&(0x7f0000000080), 0x0, 0x402) (async)
socket$inet_mptcp(0x2, 0x1, 0x106) (async)
socket(0x10, 0x803, 0x0) (async)
syz_genetlink_get_family_id$tipc(&(0x7f0000000000), r2) (async)
getsockname$packet(r2, &(0x7f0000000280)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) (async)
sendmsg$nl_route(r2, &(0x7f0000000180)={&(0x7f0000000040)={0x10, 0x0, 0x0, 0x400000}, 0xc, &(0x7f0000000140)={&(0x7f0000000100)=@RTM_GETMDB={0x18, 0x56, 0x2, 0x70bd25, 0x25dfdbfe, {0x7, r3}, [""]}, 0x18}}, 0x20000000) (async)
sendmsg$nl_route(r2, &(0x7f0000000240)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000580)=ANY=[@ANYBLOB="4800000010000305ff810000fddbdf2500000000", @ANYRES32=r3, @ANYBLOB="1748000040000200280012800a000100767863616e0000001800028014000100000000", @ANYRES32=r3], 0x48}, 0x1, 0x0, 0x0, 0x40}, 0x0) (async)
connect$inet(r1, &(0x7f0000000000)={0x2, 0x4e22, @empty}, 0x10) (async)
setsockopt$sock_int(r1, 0x1, 0x9, &(0x7f00000003c0)=0x246, 0x4) (async)
ioctl$FE_SET_PROPERTY(r0, 0x40106f52, &(0x7f00000000c0)={0x29, &(0x7f0000000200)=[{0x34, '\x00', @data=0x4}]}) (async)

program crashed: KASAN: slab-use-after-free Read in dvb_device_open
testing program (duration=45s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): [19, 25, 20]
detailed listing:
executing program 3:
r0 = socket$inet6_tcp(0xa, 0x1, 0x0)
connect$inet6(r0, 0x0, 0x0)
gettid()
timer_settime(0x0, 0x0, &(0x7f0000000280)={{0x0, 0x989680}, {0x0, 0x989680}}, 0x0)
socketpair$unix(0x1, 0x0, 0x0, 0x0)
getsockopt$sock_cred(0xffffffffffffffff, 0x1, 0x11, 0x0, &(0x7f0000cab000))
setsockopt$sock_cred(0xffffffffffffffff, 0x1, 0x11, 0x0, 0x0)
setsockopt$inet6_tcp_TCP_REPAIR_QUEUE(r0, 0x6, 0x14, 0x0, 0x0)
mmap(&(0x7f0000000000/0x4000)=nil, 0x4000, 0x1, 0x10012, 0xffffffffffffffff, 0x5deba000)
mmap(&(0x7f0000bfe000/0x400000)=nil, 0x400000, 0x4, 0x40010, r0, 0xd1aa000)
mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x3, 0x8031, 0xffffffffffffffff, 0x0)
mmap$dsp(&(0x7f0000ffd000/0x2000)=nil, 0x2000, 0x100000b, 0x810, 0xffffffffffffffff, 0x0)
socket$xdp(0x2c, 0x3, 0x0)
r1 = socket$kcm(0xa, 0x2, 0x0)
r2 = socket(0x2, 0x80805, 0x0)
r3 = openat$fuse(0xffffffffffffff9c, &(0x7f0000000080), 0x2, 0x0)
read$FUSE(r3, &(0x7f0000000600)={0x2020}, 0x2020)
setsockopt$IP_VS_SO_SET_ADD(r2, 0x0, 0x482, &(0x7f0000000240)={0x84, @dev={0xac, 0x14, 0x14, 0x15}, 0x4e20, 0x3, 'wlc\x00', 0x2, 0x660f537e, 0x3}, 0x2c)
sendmsg$sock(r1, &(0x7f0000000400)={&(0x7f0000000580)=@in6={0x2, 0x4e20, 0x0, @dev={0xfe, 0x80, '\x00', 0xfd}}, 0x80, 0x0, 0x0, &(0x7f0000000000)=[@mark={{0x14, 0x1, 0x24, 0x3}}], 0x18}, 0x0)
executing program 0:
r0 = syz_usb_connect(0x0, 0x32, &(0x7f0000000000)=ANY=[@ANYBLOB="1201000200000040a61b01000100000000010902200001010080320904"], 0x0)
r1 = openat$ptp1(0xffffffffffffff9c, &(0x7f0000000c40), 0x149201, 0x0)
ioctl$PTP_ENABLE_PPS(r1, 0x40043d04, 0x1)
r2 = socket$kcm(0x10, 0x2, 0x4)
sendmsg$inet(r2, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)=[{&(0x7f0000000100)="5c00000012006bab9e3fe3d86e6c1d0000147ea60864160af36504b68675f8001d000a00a0e69ee517d34460bc24eab556a705251e6182949a36c23d3b48dfd8cdbf9367b4fa51f60a64c9f4080003680601000008000300ff000000", 0x5c}], 0x1, 0x0, 0x0, 0x1f00c00e}, 0x0)
r3 = syz_usb_connect$uac3(0x3, 0x80, &(0x7f0000000280)=ANY=[], 0x0)
syz_usb_control_io(r0, 0x0, 0x0)
syz_usb_control_io$sierra_net(r0, 0x0, &(0x7f0000000700)={0x1c, &(0x7f0000000280)=ANY=[], 0x0, 0x0})
syz_usb_control_io$uac3(r3, 0x0, 0x0)
syz_usb_control_io$printer(r0, 0x0, &(0x7f00000005c0)={0x34, &(0x7f00000003c0)=ANY=[], 0x0, 0x0, 0x0, 0x0, 0x0})
mkdirat(0xffffffffffffff9c, &(0x7f0000000200)='./file0\x00', 0x0)
r4 = openat(0xffffffffffffff9c, &(0x7f0000000080)='./file0\x00', 0x0, 0xd5)
ioctl$FS_IOC_GETFLAGS(r4, 0x80086601, &(0x7f0000000100))
syz_open_dev$dvb_frontend(&(0x7f0000000100), 0x1, 0x802)
r5 = socket$inet6_sctp(0xa, 0x801, 0x84)
getsockopt$bt_hci(r5, 0x84, 0x81, &(0x7f0000001280)=""/4107, &(0x7f00000000c0)=0x100b)
r6 = socket$rxrpc(0x21, 0x2, 0x2)
setsockopt$RXRPC_MIN_SECURITY_LEVEL(r6, 0x110, 0x4, &(0x7f0000000440)=0x1, 0x4)
syz_usb_connect(0x0, 0x32, &(0x7f0000000000)=ANY=[@ANYBLOB="1201000200000040a61b01000100000000010902200001010080320904"], 0x0) (async)
openat$ptp1(0xffffffffffffff9c, &(0x7f0000000c40), 0x149201, 0x0) (async)
sendmsg$inet(r2, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)=[{&(0x7f0000000100)="5c00000012006bab9e3fe3d86e6c1d0000147ea60864160af36504b68675f8001d000a00a0e69ee517d34460bc24eab556a705251e6182949a36c23d3b48dfd8cdbf9367b4fa51f60a64c9f4080003680601000008000300ff000000", 0x5c}], 0x1, 0x0, 0x0, 0x1f00c00e}, 0x0) (async)
syz_usb_connect$uac3(0x3, 0x80, &(0x7f0000000280)=ANY=[], 0x0) (async)
syz_usb_control_io$uac3(r3, 0x0, 0x0) (async)
syz_open_dev$dvb_frontend(&(0x7f0000000100), 0x1, 0x802) (async)
getsockopt$bt_hci(r5, 0x84, 0x81, &(0x7f0000001280)=""/4107, &(0x7f00000000c0)=0x100b) (async)
executing program 4:
r0 = syz_open_dev$dvb_frontend(&(0x7f0000000080), 0x0, 0x402)
r1 = socket$inet_mptcp(0x2, 0x1, 0x106)
r2 = socket(0x10, 0x803, 0x0)
syz_genetlink_get_family_id$tipc(&(0x7f0000000000), r2)
getsockname$packet(r2, &(0x7f0000000280)={0x11, 0x0, <r3=>0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14)
sendmsg$nl_route(r2, &(0x7f0000000180)={&(0x7f0000000040)={0x10, 0x0, 0x0, 0x400000}, 0xc, &(0x7f0000000140)={&(0x7f0000000100)=@RTM_GETMDB={0x18, 0x56, 0x2, 0x70bd25, 0x25dfdbfe, {0x7, r3}, [""]}, 0x18}}, 0x20000000)
sendmsg$nl_route(r2, &(0x7f0000000240)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000580)=ANY=[@ANYBLOB="4800000010000305ff810000fddbdf2500000000", @ANYRES32=r3, @ANYBLOB="1748000040000200280012800a000100767863616e0000001800028014000100000000", @ANYRES32=r3], 0x48}, 0x1, 0x0, 0x0, 0x40}, 0x0)
connect$inet(r1, &(0x7f0000000000)={0x2, 0x4e22, @empty}, 0x10)
setsockopt$sock_int(r1, 0x1, 0x9, &(0x7f00000003c0)=0x246, 0x4)
ioctl$FE_SET_PROPERTY(r0, 0x40106f52, &(0x7f00000000c0)={0x29, &(0x7f0000000200)=[{0x34, '\x00', @data=0x4}]})
syz_open_dev$dvb_frontend(&(0x7f0000000080), 0x0, 0x402) (async)
socket$inet_mptcp(0x2, 0x1, 0x106) (async)
socket(0x10, 0x803, 0x0) (async)
syz_genetlink_get_family_id$tipc(&(0x7f0000000000), r2) (async)
getsockname$packet(r2, &(0x7f0000000280)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) (async)
sendmsg$nl_route(r2, &(0x7f0000000180)={&(0x7f0000000040)={0x10, 0x0, 0x0, 0x400000}, 0xc, &(0x7f0000000140)={&(0x7f0000000100)=@RTM_GETMDB={0x18, 0x56, 0x2, 0x70bd25, 0x25dfdbfe, {0x7, r3}, [""]}, 0x18}}, 0x20000000) (async)
sendmsg$nl_route(r2, &(0x7f0000000240)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000580)=ANY=[@ANYBLOB="4800000010000305ff810000fddbdf2500000000", @ANYRES32=r3, @ANYBLOB="1748000040000200280012800a000100767863616e0000001800028014000100000000", @ANYRES32=r3], 0x48}, 0x1, 0x0, 0x0, 0x40}, 0x0) (async)
connect$inet(r1, &(0x7f0000000000)={0x2, 0x4e22, @empty}, 0x10) (async)
setsockopt$sock_int(r1, 0x1, 0x9, &(0x7f00000003c0)=0x246, 0x4) (async)
ioctl$FE_SET_PROPERTY(r0, 0x40106f52, &(0x7f00000000c0)={0x29, &(0x7f0000000200)=[{0x34, '\x00', @data=0x4}]}) (async)

program crashed: KASAN: slab-use-after-free Read in dvb_device_open
testing program (duration=45s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): [19, 24, 20]
detailed listing:
executing program 3:
r0 = socket$inet6_tcp(0xa, 0x1, 0x0)
connect$inet6(r0, 0x0, 0x0)
gettid()
timer_settime(0x0, 0x0, &(0x7f0000000280)={{0x0, 0x989680}, {0x0, 0x989680}}, 0x0)
socketpair$unix(0x1, 0x0, 0x0, 0x0)
getsockopt$sock_cred(0xffffffffffffffff, 0x1, 0x11, 0x0, &(0x7f0000cab000))
setsockopt$sock_cred(0xffffffffffffffff, 0x1, 0x11, 0x0, 0x0)
setsockopt$inet6_tcp_TCP_REPAIR_QUEUE(r0, 0x6, 0x14, 0x0, 0x0)
mmap(&(0x7f0000000000/0x4000)=nil, 0x4000, 0x1, 0x10012, 0xffffffffffffffff, 0x5deba000)
mmap(&(0x7f0000bfe000/0x400000)=nil, 0x400000, 0x4, 0x40010, r0, 0xd1aa000)
mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x3, 0x8031, 0xffffffffffffffff, 0x0)
mmap$dsp(&(0x7f0000ffd000/0x2000)=nil, 0x2000, 0x100000b, 0x810, 0xffffffffffffffff, 0x0)
socket$xdp(0x2c, 0x3, 0x0)
r1 = socket$kcm(0xa, 0x2, 0x0)
r2 = socket(0x2, 0x80805, 0x0)
r3 = openat$fuse(0xffffffffffffff9c, &(0x7f0000000080), 0x2, 0x0)
read$FUSE(r3, &(0x7f0000000600)={0x2020}, 0x2020)
setsockopt$IP_VS_SO_SET_ADD(r2, 0x0, 0x482, &(0x7f0000000240)={0x84, @dev={0xac, 0x14, 0x14, 0x15}, 0x4e20, 0x3, 'wlc\x00', 0x2, 0x660f537e, 0x3}, 0x2c)
sendmsg$sock(r1, &(0x7f0000000400)={&(0x7f0000000580)=@in6={0x2, 0x4e20, 0x0, @dev={0xfe, 0x80, '\x00', 0xfd}}, 0x80, 0x0, 0x0, &(0x7f0000000000)=[@mark={{0x14, 0x1, 0x24, 0x3}}], 0x18}, 0x0)
executing program 0:
r0 = syz_usb_connect(0x0, 0x32, &(0x7f0000000000)=ANY=[@ANYBLOB="1201000200000040a61b01000100000000010902200001010080320904"], 0x0)
r1 = openat$ptp1(0xffffffffffffff9c, &(0x7f0000000c40), 0x149201, 0x0)
ioctl$PTP_ENABLE_PPS(r1, 0x40043d04, 0x1)
r2 = socket$kcm(0x10, 0x2, 0x4)
sendmsg$inet(r2, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)=[{&(0x7f0000000100)="5c00000012006bab9e3fe3d86e6c1d0000147ea60864160af36504b68675f8001d000a00a0e69ee517d34460bc24eab556a705251e6182949a36c23d3b48dfd8cdbf9367b4fa51f60a64c9f4080003680601000008000300ff000000", 0x5c}], 0x1, 0x0, 0x0, 0x1f00c00e}, 0x0)
r3 = syz_usb_connect$uac3(0x3, 0x80, &(0x7f0000000280)=ANY=[], 0x0)
syz_usb_control_io(r0, 0x0, 0x0)
syz_usb_control_io$sierra_net(r0, 0x0, &(0x7f0000000700)={0x1c, &(0x7f0000000280)=ANY=[], 0x0, 0x0})
syz_usb_control_io$uac3(r3, 0x0, 0x0)
syz_usb_control_io$printer(r0, 0x0, &(0x7f00000005c0)={0x34, &(0x7f00000003c0)=ANY=[], 0x0, 0x0, 0x0, 0x0, 0x0})
mkdirat(0xffffffffffffff9c, &(0x7f0000000200)='./file0\x00', 0x0)
r4 = openat(0xffffffffffffff9c, &(0x7f0000000080)='./file0\x00', 0x0, 0xd5)
ioctl$FS_IOC_GETFLAGS(r4, 0x80086601, &(0x7f0000000100))
syz_open_dev$dvb_frontend(&(0x7f0000000100), 0x1, 0x802)
r5 = socket$inet6_sctp(0xa, 0x801, 0x84)
getsockopt$bt_hci(r5, 0x84, 0x81, &(0x7f0000001280)=""/4107, &(0x7f00000000c0)=0x100b)
r6 = socket$rxrpc(0x21, 0x2, 0x2)
setsockopt$RXRPC_MIN_SECURITY_LEVEL(r6, 0x110, 0x4, &(0x7f0000000440)=0x1, 0x4)
syz_usb_connect(0x0, 0x32, &(0x7f0000000000)=ANY=[@ANYBLOB="1201000200000040a61b01000100000000010902200001010080320904"], 0x0) (async)
sendmsg$inet(r2, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)=[{&(0x7f0000000100)="5c00000012006bab9e3fe3d86e6c1d0000147ea60864160af36504b68675f8001d000a00a0e69ee517d34460bc24eab556a705251e6182949a36c23d3b48dfd8cdbf9367b4fa51f60a64c9f4080003680601000008000300ff000000", 0x5c}], 0x1, 0x0, 0x0, 0x1f00c00e}, 0x0) (async)
syz_usb_connect$uac3(0x3, 0x80, &(0x7f0000000280)=ANY=[], 0x0) (async)
syz_usb_control_io$uac3(r3, 0x0, 0x0) (async)
syz_open_dev$dvb_frontend(&(0x7f0000000100), 0x1, 0x802) (async)
getsockopt$bt_hci(r5, 0x84, 0x81, &(0x7f0000001280)=""/4107, &(0x7f00000000c0)=0x100b) (async)
executing program 4:
r0 = syz_open_dev$dvb_frontend(&(0x7f0000000080), 0x0, 0x402)
r1 = socket$inet_mptcp(0x2, 0x1, 0x106)
r2 = socket(0x10, 0x803, 0x0)
syz_genetlink_get_family_id$tipc(&(0x7f0000000000), r2)
getsockname$packet(r2, &(0x7f0000000280)={0x11, 0x0, <r3=>0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14)
sendmsg$nl_route(r2, &(0x7f0000000180)={&(0x7f0000000040)={0x10, 0x0, 0x0, 0x400000}, 0xc, &(0x7f0000000140)={&(0x7f0000000100)=@RTM_GETMDB={0x18, 0x56, 0x2, 0x70bd25, 0x25dfdbfe, {0x7, r3}, [""]}, 0x18}}, 0x20000000)
sendmsg$nl_route(r2, &(0x7f0000000240)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000580)=ANY=[@ANYBLOB="4800000010000305ff810000fddbdf2500000000", @ANYRES32=r3, @ANYBLOB="1748000040000200280012800a000100767863616e0000001800028014000100000000", @ANYRES32=r3], 0x48}, 0x1, 0x0, 0x0, 0x40}, 0x0)
connect$inet(r1, &(0x7f0000000000)={0x2, 0x4e22, @empty}, 0x10)
setsockopt$sock_int(r1, 0x1, 0x9, &(0x7f00000003c0)=0x246, 0x4)
ioctl$FE_SET_PROPERTY(r0, 0x40106f52, &(0x7f00000000c0)={0x29, &(0x7f0000000200)=[{0x34, '\x00', @data=0x4}]})
syz_open_dev$dvb_frontend(&(0x7f0000000080), 0x0, 0x402) (async)
socket$inet_mptcp(0x2, 0x1, 0x106) (async)
socket(0x10, 0x803, 0x0) (async)
syz_genetlink_get_family_id$tipc(&(0x7f0000000000), r2) (async)
getsockname$packet(r2, &(0x7f0000000280)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) (async)
sendmsg$nl_route(r2, &(0x7f0000000180)={&(0x7f0000000040)={0x10, 0x0, 0x0, 0x400000}, 0xc, &(0x7f0000000140)={&(0x7f0000000100)=@RTM_GETMDB={0x18, 0x56, 0x2, 0x70bd25, 0x25dfdbfe, {0x7, r3}, [""]}, 0x18}}, 0x20000000) (async)
sendmsg$nl_route(r2, &(0x7f0000000240)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000580)=ANY=[@ANYBLOB="4800000010000305ff810000fddbdf2500000000", @ANYRES32=r3, @ANYBLOB="1748000040000200280012800a000100767863616e0000001800028014000100000000", @ANYRES32=r3], 0x48}, 0x1, 0x0, 0x0, 0x40}, 0x0) (async)
connect$inet(r1, &(0x7f0000000000)={0x2, 0x4e22, @empty}, 0x10) (async)
setsockopt$sock_int(r1, 0x1, 0x9, &(0x7f00000003c0)=0x246, 0x4) (async)
ioctl$FE_SET_PROPERTY(r0, 0x40106f52, &(0x7f00000000c0)={0x29, &(0x7f0000000200)=[{0x34, '\x00', @data=0x4}]}) (async)

program crashed: KASAN: slab-use-after-free Read in dvb_device_open
testing program (duration=45s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): [19, 23, 20]
detailed listing:
executing program 3:
r0 = socket$inet6_tcp(0xa, 0x1, 0x0)
connect$inet6(r0, 0x0, 0x0)
gettid()
timer_settime(0x0, 0x0, &(0x7f0000000280)={{0x0, 0x989680}, {0x0, 0x989680}}, 0x0)
socketpair$unix(0x1, 0x0, 0x0, 0x0)
getsockopt$sock_cred(0xffffffffffffffff, 0x1, 0x11, 0x0, &(0x7f0000cab000))
setsockopt$sock_cred(0xffffffffffffffff, 0x1, 0x11, 0x0, 0x0)
setsockopt$inet6_tcp_TCP_REPAIR_QUEUE(r0, 0x6, 0x14, 0x0, 0x0)
mmap(&(0x7f0000000000/0x4000)=nil, 0x4000, 0x1, 0x10012, 0xffffffffffffffff, 0x5deba000)
mmap(&(0x7f0000bfe000/0x400000)=nil, 0x400000, 0x4, 0x40010, r0, 0xd1aa000)
mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x3, 0x8031, 0xffffffffffffffff, 0x0)
mmap$dsp(&(0x7f0000ffd000/0x2000)=nil, 0x2000, 0x100000b, 0x810, 0xffffffffffffffff, 0x0)
socket$xdp(0x2c, 0x3, 0x0)
r1 = socket$kcm(0xa, 0x2, 0x0)
r2 = socket(0x2, 0x80805, 0x0)
r3 = openat$fuse(0xffffffffffffff9c, &(0x7f0000000080), 0x2, 0x0)
read$FUSE(r3, &(0x7f0000000600)={0x2020}, 0x2020)
setsockopt$IP_VS_SO_SET_ADD(r2, 0x0, 0x482, &(0x7f0000000240)={0x84, @dev={0xac, 0x14, 0x14, 0x15}, 0x4e20, 0x3, 'wlc\x00', 0x2, 0x660f537e, 0x3}, 0x2c)
sendmsg$sock(r1, &(0x7f0000000400)={&(0x7f0000000580)=@in6={0x2, 0x4e20, 0x0, @dev={0xfe, 0x80, '\x00', 0xfd}}, 0x80, 0x0, 0x0, &(0x7f0000000000)=[@mark={{0x14, 0x1, 0x24, 0x3}}], 0x18}, 0x0)
executing program 0:
r0 = syz_usb_connect(0x0, 0x32, &(0x7f0000000000)=ANY=[@ANYBLOB="1201000200000040a61b01000100000000010902200001010080320904"], 0x0)
r1 = openat$ptp1(0xffffffffffffff9c, &(0x7f0000000c40), 0x149201, 0x0)
ioctl$PTP_ENABLE_PPS(r1, 0x40043d04, 0x1)
r2 = socket$kcm(0x10, 0x2, 0x4)
sendmsg$inet(r2, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)=[{&(0x7f0000000100)="5c00000012006bab9e3fe3d86e6c1d0000147ea60864160af36504b68675f8001d000a00a0e69ee517d34460bc24eab556a705251e6182949a36c23d3b48dfd8cdbf9367b4fa51f60a64c9f4080003680601000008000300ff000000", 0x5c}], 0x1, 0x0, 0x0, 0x1f00c00e}, 0x0)
r3 = syz_usb_connect$uac3(0x3, 0x80, &(0x7f0000000280)=ANY=[], 0x0)
syz_usb_control_io(r0, 0x0, 0x0)
syz_usb_control_io$sierra_net(r0, 0x0, &(0x7f0000000700)={0x1c, &(0x7f0000000280)=ANY=[], 0x0, 0x0})
syz_usb_control_io$uac3(r3, 0x0, 0x0)
syz_usb_control_io$printer(r0, 0x0, &(0x7f00000005c0)={0x34, &(0x7f00000003c0)=ANY=[], 0x0, 0x0, 0x0, 0x0, 0x0})
mkdirat(0xffffffffffffff9c, &(0x7f0000000200)='./file0\x00', 0x0)
r4 = openat(0xffffffffffffff9c, &(0x7f0000000080)='./file0\x00', 0x0, 0xd5)
ioctl$FS_IOC_GETFLAGS(r4, 0x80086601, &(0x7f0000000100))
syz_open_dev$dvb_frontend(&(0x7f0000000100), 0x1, 0x802)
r5 = socket$inet6_sctp(0xa, 0x801, 0x84)
getsockopt$bt_hci(r5, 0x84, 0x81, &(0x7f0000001280)=""/4107, &(0x7f00000000c0)=0x100b)
r6 = socket$rxrpc(0x21, 0x2, 0x2)
setsockopt$RXRPC_MIN_SECURITY_LEVEL(r6, 0x110, 0x4, &(0x7f0000000440)=0x1, 0x4)
sendmsg$inet(r2, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)=[{&(0x7f0000000100)="5c00000012006bab9e3fe3d86e6c1d0000147ea60864160af36504b68675f8001d000a00a0e69ee517d34460bc24eab556a705251e6182949a36c23d3b48dfd8cdbf9367b4fa51f60a64c9f4080003680601000008000300ff000000", 0x5c}], 0x1, 0x0, 0x0, 0x1f00c00e}, 0x0) (async)
syz_usb_connect$uac3(0x3, 0x80, &(0x7f0000000280)=ANY=[], 0x0) (async)
syz_usb_control_io$uac3(r3, 0x0, 0x0) (async)
syz_open_dev$dvb_frontend(&(0x7f0000000100), 0x1, 0x802) (async)
getsockopt$bt_hci(r5, 0x84, 0x81, &(0x7f0000001280)=""/4107, &(0x7f00000000c0)=0x100b) (async)
executing program 4:
r0 = syz_open_dev$dvb_frontend(&(0x7f0000000080), 0x0, 0x402)
r1 = socket$inet_mptcp(0x2, 0x1, 0x106)
r2 = socket(0x10, 0x803, 0x0)
syz_genetlink_get_family_id$tipc(&(0x7f0000000000), r2)
getsockname$packet(r2, &(0x7f0000000280)={0x11, 0x0, <r3=>0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14)
sendmsg$nl_route(r2, &(0x7f0000000180)={&(0x7f0000000040)={0x10, 0x0, 0x0, 0x400000}, 0xc, &(0x7f0000000140)={&(0x7f0000000100)=@RTM_GETMDB={0x18, 0x56, 0x2, 0x70bd25, 0x25dfdbfe, {0x7, r3}, [""]}, 0x18}}, 0x20000000)
sendmsg$nl_route(r2, &(0x7f0000000240)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000580)=ANY=[@ANYBLOB="4800000010000305ff810000fddbdf2500000000", @ANYRES32=r3, @ANYBLOB="1748000040000200280012800a000100767863616e0000001800028014000100000000", @ANYRES32=r3], 0x48}, 0x1, 0x0, 0x0, 0x40}, 0x0)
connect$inet(r1, &(0x7f0000000000)={0x2, 0x4e22, @empty}, 0x10)
setsockopt$sock_int(r1, 0x1, 0x9, &(0x7f00000003c0)=0x246, 0x4)
ioctl$FE_SET_PROPERTY(r0, 0x40106f52, &(0x7f00000000c0)={0x29, &(0x7f0000000200)=[{0x34, '\x00', @data=0x4}]})
syz_open_dev$dvb_frontend(&(0x7f0000000080), 0x0, 0x402) (async)
socket$inet_mptcp(0x2, 0x1, 0x106) (async)
socket(0x10, 0x803, 0x0) (async)
syz_genetlink_get_family_id$tipc(&(0x7f0000000000), r2) (async)
getsockname$packet(r2, &(0x7f0000000280)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) (async)
sendmsg$nl_route(r2, &(0x7f0000000180)={&(0x7f0000000040)={0x10, 0x0, 0x0, 0x400000}, 0xc, &(0x7f0000000140)={&(0x7f0000000100)=@RTM_GETMDB={0x18, 0x56, 0x2, 0x70bd25, 0x25dfdbfe, {0x7, r3}, [""]}, 0x18}}, 0x20000000) (async)
sendmsg$nl_route(r2, &(0x7f0000000240)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000580)=ANY=[@ANYBLOB="4800000010000305ff810000fddbdf2500000000", @ANYRES32=r3, @ANYBLOB="1748000040000200280012800a000100767863616e0000001800028014000100000000", @ANYRES32=r3], 0x48}, 0x1, 0x0, 0x0, 0x40}, 0x0) (async)
connect$inet(r1, &(0x7f0000000000)={0x2, 0x4e22, @empty}, 0x10) (async)
setsockopt$sock_int(r1, 0x1, 0x9, &(0x7f00000003c0)=0x246, 0x4) (async)
ioctl$FE_SET_PROPERTY(r0, 0x40106f52, &(0x7f00000000c0)={0x29, &(0x7f0000000200)=[{0x34, '\x00', @data=0x4}]}) (async)

program crashed: KASAN: slab-use-after-free Read in dvb_device_open
testing program (duration=45s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): [19, 22, 20]
detailed listing:
executing program 3:
r0 = socket$inet6_tcp(0xa, 0x1, 0x0)
connect$inet6(r0, 0x0, 0x0)
gettid()
timer_settime(0x0, 0x0, &(0x7f0000000280)={{0x0, 0x989680}, {0x0, 0x989680}}, 0x0)
socketpair$unix(0x1, 0x0, 0x0, 0x0)
getsockopt$sock_cred(0xffffffffffffffff, 0x1, 0x11, 0x0, &(0x7f0000cab000))
setsockopt$sock_cred(0xffffffffffffffff, 0x1, 0x11, 0x0, 0x0)
setsockopt$inet6_tcp_TCP_REPAIR_QUEUE(r0, 0x6, 0x14, 0x0, 0x0)
mmap(&(0x7f0000000000/0x4000)=nil, 0x4000, 0x1, 0x10012, 0xffffffffffffffff, 0x5deba000)
mmap(&(0x7f0000bfe000/0x400000)=nil, 0x400000, 0x4, 0x40010, r0, 0xd1aa000)
mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x3, 0x8031, 0xffffffffffffffff, 0x0)
mmap$dsp(&(0x7f0000ffd000/0x2000)=nil, 0x2000, 0x100000b, 0x810, 0xffffffffffffffff, 0x0)
socket$xdp(0x2c, 0x3, 0x0)
r1 = socket$kcm(0xa, 0x2, 0x0)
r2 = socket(0x2, 0x80805, 0x0)
r3 = openat$fuse(0xffffffffffffff9c, &(0x7f0000000080), 0x2, 0x0)
read$FUSE(r3, &(0x7f0000000600)={0x2020}, 0x2020)
setsockopt$IP_VS_SO_SET_ADD(r2, 0x0, 0x482, &(0x7f0000000240)={0x84, @dev={0xac, 0x14, 0x14, 0x15}, 0x4e20, 0x3, 'wlc\x00', 0x2, 0x660f537e, 0x3}, 0x2c)
sendmsg$sock(r1, &(0x7f0000000400)={&(0x7f0000000580)=@in6={0x2, 0x4e20, 0x0, @dev={0xfe, 0x80, '\x00', 0xfd}}, 0x80, 0x0, 0x0, &(0x7f0000000000)=[@mark={{0x14, 0x1, 0x24, 0x3}}], 0x18}, 0x0)
executing program 0:
r0 = syz_usb_connect(0x0, 0x32, &(0x7f0000000000)=ANY=[@ANYBLOB="1201000200000040a61b01000100000000010902200001010080320904"], 0x0)
r1 = openat$ptp1(0xffffffffffffff9c, &(0x7f0000000c40), 0x149201, 0x0)
ioctl$PTP_ENABLE_PPS(r1, 0x40043d04, 0x1)
r2 = socket$kcm(0x10, 0x2, 0x4)
sendmsg$inet(r2, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)=[{&(0x7f0000000100)="5c00000012006bab9e3fe3d86e6c1d0000147ea60864160af36504b68675f8001d000a00a0e69ee517d34460bc24eab556a705251e6182949a36c23d3b48dfd8cdbf9367b4fa51f60a64c9f4080003680601000008000300ff000000", 0x5c}], 0x1, 0x0, 0x0, 0x1f00c00e}, 0x0)
r3 = syz_usb_connect$uac3(0x3, 0x80, &(0x7f0000000280)=ANY=[], 0x0)
syz_usb_control_io(r0, 0x0, 0x0)
syz_usb_control_io$sierra_net(r0, 0x0, &(0x7f0000000700)={0x1c, &(0x7f0000000280)=ANY=[], 0x0, 0x0})
syz_usb_control_io$uac3(r3, 0x0, 0x0)
syz_usb_control_io$printer(r0, 0x0, &(0x7f00000005c0)={0x34, &(0x7f00000003c0)=ANY=[], 0x0, 0x0, 0x0, 0x0, 0x0})
mkdirat(0xffffffffffffff9c, &(0x7f0000000200)='./file0\x00', 0x0)
r4 = openat(0xffffffffffffff9c, &(0x7f0000000080)='./file0\x00', 0x0, 0xd5)
ioctl$FS_IOC_GETFLAGS(r4, 0x80086601, &(0x7f0000000100))
syz_open_dev$dvb_frontend(&(0x7f0000000100), 0x1, 0x802)
r5 = socket$inet6_sctp(0xa, 0x801, 0x84)
getsockopt$bt_hci(r5, 0x84, 0x81, &(0x7f0000001280)=""/4107, &(0x7f00000000c0)=0x100b)
socket$rxrpc(0x21, 0x2, 0x2)
sendmsg$inet(r2, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)=[{&(0x7f0000000100)="5c00000012006bab9e3fe3d86e6c1d0000147ea60864160af36504b68675f8001d000a00a0e69ee517d34460bc24eab556a705251e6182949a36c23d3b48dfd8cdbf9367b4fa51f60a64c9f4080003680601000008000300ff000000", 0x5c}], 0x1, 0x0, 0x0, 0x1f00c00e}, 0x0) (async)
syz_usb_connect$uac3(0x3, 0x80, &(0x7f0000000280)=ANY=[], 0x0) (async)
syz_usb_control_io$uac3(r3, 0x0, 0x0) (async)
syz_open_dev$dvb_frontend(&(0x7f0000000100), 0x1, 0x802) (async)
getsockopt$bt_hci(r5, 0x84, 0x81, &(0x7f0000001280)=""/4107, &(0x7f00000000c0)=0x100b) (async)
executing program 4:
r0 = syz_open_dev$dvb_frontend(&(0x7f0000000080), 0x0, 0x402)
r1 = socket$inet_mptcp(0x2, 0x1, 0x106)
r2 = socket(0x10, 0x803, 0x0)
syz_genetlink_get_family_id$tipc(&(0x7f0000000000), r2)
getsockname$packet(r2, &(0x7f0000000280)={0x11, 0x0, <r3=>0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14)
sendmsg$nl_route(r2, &(0x7f0000000180)={&(0x7f0000000040)={0x10, 0x0, 0x0, 0x400000}, 0xc, &(0x7f0000000140)={&(0x7f0000000100)=@RTM_GETMDB={0x18, 0x56, 0x2, 0x70bd25, 0x25dfdbfe, {0x7, r3}, [""]}, 0x18}}, 0x20000000)
sendmsg$nl_route(r2, &(0x7f0000000240)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000580)=ANY=[@ANYBLOB="4800000010000305ff810000fddbdf2500000000", @ANYRES32=r3, @ANYBLOB="1748000040000200280012800a000100767863616e0000001800028014000100000000", @ANYRES32=r3], 0x48}, 0x1, 0x0, 0x0, 0x40}, 0x0)
connect$inet(r1, &(0x7f0000000000)={0x2, 0x4e22, @empty}, 0x10)
setsockopt$sock_int(r1, 0x1, 0x9, &(0x7f00000003c0)=0x246, 0x4)
ioctl$FE_SET_PROPERTY(r0, 0x40106f52, &(0x7f00000000c0)={0x29, &(0x7f0000000200)=[{0x34, '\x00', @data=0x4}]})
syz_open_dev$dvb_frontend(&(0x7f0000000080), 0x0, 0x402) (async)
socket$inet_mptcp(0x2, 0x1, 0x106) (async)
socket(0x10, 0x803, 0x0) (async)
syz_genetlink_get_family_id$tipc(&(0x7f0000000000), r2) (async)
getsockname$packet(r2, &(0x7f0000000280)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) (async)
sendmsg$nl_route(r2, &(0x7f0000000180)={&(0x7f0000000040)={0x10, 0x0, 0x0, 0x400000}, 0xc, &(0x7f0000000140)={&(0x7f0000000100)=@RTM_GETMDB={0x18, 0x56, 0x2, 0x70bd25, 0x25dfdbfe, {0x7, r3}, [""]}, 0x18}}, 0x20000000) (async)
sendmsg$nl_route(r2, &(0x7f0000000240)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000580)=ANY=[@ANYBLOB="4800000010000305ff810000fddbdf2500000000", @ANYRES32=r3, @ANYBLOB="1748000040000200280012800a000100767863616e0000001800028014000100000000", @ANYRES32=r3], 0x48}, 0x1, 0x0, 0x0, 0x40}, 0x0) (async)
connect$inet(r1, &(0x7f0000000000)={0x2, 0x4e22, @empty}, 0x10) (async)
setsockopt$sock_int(r1, 0x1, 0x9, &(0x7f00000003c0)=0x246, 0x4) (async)
ioctl$FE_SET_PROPERTY(r0, 0x40106f52, &(0x7f00000000c0)={0x29, &(0x7f0000000200)=[{0x34, '\x00', @data=0x4}]}) (async)

program crashed: KASAN: slab-use-after-free Read in dvb_device_open
testing program (duration=45s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): [19, 21, 20]
detailed listing:
executing program 3:
r0 = socket$inet6_tcp(0xa, 0x1, 0x0)
connect$inet6(r0, 0x0, 0x0)
gettid()
timer_settime(0x0, 0x0, &(0x7f0000000280)={{0x0, 0x989680}, {0x0, 0x989680}}, 0x0)
socketpair$unix(0x1, 0x0, 0x0, 0x0)
getsockopt$sock_cred(0xffffffffffffffff, 0x1, 0x11, 0x0, &(0x7f0000cab000))
setsockopt$sock_cred(0xffffffffffffffff, 0x1, 0x11, 0x0, 0x0)
setsockopt$inet6_tcp_TCP_REPAIR_QUEUE(r0, 0x6, 0x14, 0x0, 0x0)
mmap(&(0x7f0000000000/0x4000)=nil, 0x4000, 0x1, 0x10012, 0xffffffffffffffff, 0x5deba000)
mmap(&(0x7f0000bfe000/0x400000)=nil, 0x400000, 0x4, 0x40010, r0, 0xd1aa000)
mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x3, 0x8031, 0xffffffffffffffff, 0x0)
mmap$dsp(&(0x7f0000ffd000/0x2000)=nil, 0x2000, 0x100000b, 0x810, 0xffffffffffffffff, 0x0)
socket$xdp(0x2c, 0x3, 0x0)
r1 = socket$kcm(0xa, 0x2, 0x0)
r2 = socket(0x2, 0x80805, 0x0)
r3 = openat$fuse(0xffffffffffffff9c, &(0x7f0000000080), 0x2, 0x0)
read$FUSE(r3, &(0x7f0000000600)={0x2020}, 0x2020)
setsockopt$IP_VS_SO_SET_ADD(r2, 0x0, 0x482, &(0x7f0000000240)={0x84, @dev={0xac, 0x14, 0x14, 0x15}, 0x4e20, 0x3, 'wlc\x00', 0x2, 0x660f537e, 0x3}, 0x2c)
sendmsg$sock(r1, &(0x7f0000000400)={&(0x7f0000000580)=@in6={0x2, 0x4e20, 0x0, @dev={0xfe, 0x80, '\x00', 0xfd}}, 0x80, 0x0, 0x0, &(0x7f0000000000)=[@mark={{0x14, 0x1, 0x24, 0x3}}], 0x18}, 0x0)
executing program 0:
r0 = syz_usb_connect(0x0, 0x32, &(0x7f0000000000)=ANY=[@ANYBLOB="1201000200000040a61b01000100000000010902200001010080320904"], 0x0)
r1 = openat$ptp1(0xffffffffffffff9c, &(0x7f0000000c40), 0x149201, 0x0)
ioctl$PTP_ENABLE_PPS(r1, 0x40043d04, 0x1)
r2 = socket$kcm(0x10, 0x2, 0x4)
sendmsg$inet(r2, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)=[{&(0x7f0000000100)="5c00000012006bab9e3fe3d86e6c1d0000147ea60864160af36504b68675f8001d000a00a0e69ee517d34460bc24eab556a705251e6182949a36c23d3b48dfd8cdbf9367b4fa51f60a64c9f4080003680601000008000300ff000000", 0x5c}], 0x1, 0x0, 0x0, 0x1f00c00e}, 0x0)
r3 = syz_usb_connect$uac3(0x3, 0x80, &(0x7f0000000280)=ANY=[], 0x0)
syz_usb_control_io(r0, 0x0, 0x0)
syz_usb_control_io$sierra_net(r0, 0x0, &(0x7f0000000700)={0x1c, &(0x7f0000000280)=ANY=[], 0x0, 0x0})
syz_usb_control_io$uac3(r3, 0x0, 0x0)
syz_usb_control_io$printer(r0, 0x0, &(0x7f00000005c0)={0x34, &(0x7f00000003c0)=ANY=[], 0x0, 0x0, 0x0, 0x0, 0x0})
mkdirat(0xffffffffffffff9c, &(0x7f0000000200)='./file0\x00', 0x0)
r4 = openat(0xffffffffffffff9c, &(0x7f0000000080)='./file0\x00', 0x0, 0xd5)
ioctl$FS_IOC_GETFLAGS(r4, 0x80086601, &(0x7f0000000100))
syz_open_dev$dvb_frontend(&(0x7f0000000100), 0x1, 0x802)
r5 = socket$inet6_sctp(0xa, 0x801, 0x84)
getsockopt$bt_hci(r5, 0x84, 0x81, &(0x7f0000001280)=""/4107, &(0x7f00000000c0)=0x100b)
sendmsg$inet(r2, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)=[{&(0x7f0000000100)="5c00000012006bab9e3fe3d86e6c1d0000147ea60864160af36504b68675f8001d000a00a0e69ee517d34460bc24eab556a705251e6182949a36c23d3b48dfd8cdbf9367b4fa51f60a64c9f4080003680601000008000300ff000000", 0x5c}], 0x1, 0x0, 0x0, 0x1f00c00e}, 0x0) (async)
syz_usb_connect$uac3(0x3, 0x80, &(0x7f0000000280)=ANY=[], 0x0) (async)
syz_usb_control_io$uac3(r3, 0x0, 0x0) (async)
syz_open_dev$dvb_frontend(&(0x7f0000000100), 0x1, 0x802) (async)
getsockopt$bt_hci(r5, 0x84, 0x81, &(0x7f0000001280)=""/4107, &(0x7f00000000c0)=0x100b) (async)
executing program 4:
r0 = syz_open_dev$dvb_frontend(&(0x7f0000000080), 0x0, 0x402)
r1 = socket$inet_mptcp(0x2, 0x1, 0x106)
r2 = socket(0x10, 0x803, 0x0)
syz_genetlink_get_family_id$tipc(&(0x7f0000000000), r2)
getsockname$packet(r2, &(0x7f0000000280)={0x11, 0x0, <r3=>0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14)
sendmsg$nl_route(r2, &(0x7f0000000180)={&(0x7f0000000040)={0x10, 0x0, 0x0, 0x400000}, 0xc, &(0x7f0000000140)={&(0x7f0000000100)=@RTM_GETMDB={0x18, 0x56, 0x2, 0x70bd25, 0x25dfdbfe, {0x7, r3}, [""]}, 0x18}}, 0x20000000)
sendmsg$nl_route(r2, &(0x7f0000000240)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000580)=ANY=[@ANYBLOB="4800000010000305ff810000fddbdf2500000000", @ANYRES32=r3, @ANYBLOB="1748000040000200280012800a000100767863616e0000001800028014000100000000", @ANYRES32=r3], 0x48}, 0x1, 0x0, 0x0, 0x40}, 0x0)
connect$inet(r1, &(0x7f0000000000)={0x2, 0x4e22, @empty}, 0x10)
setsockopt$sock_int(r1, 0x1, 0x9, &(0x7f00000003c0)=0x246, 0x4)
ioctl$FE_SET_PROPERTY(r0, 0x40106f52, &(0x7f00000000c0)={0x29, &(0x7f0000000200)=[{0x34, '\x00', @data=0x4}]})
syz_open_dev$dvb_frontend(&(0x7f0000000080), 0x0, 0x402) (async)
socket$inet_mptcp(0x2, 0x1, 0x106) (async)
socket(0x10, 0x803, 0x0) (async)
syz_genetlink_get_family_id$tipc(&(0x7f0000000000), r2) (async)
getsockname$packet(r2, &(0x7f0000000280)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) (async)
sendmsg$nl_route(r2, &(0x7f0000000180)={&(0x7f0000000040)={0x10, 0x0, 0x0, 0x400000}, 0xc, &(0x7f0000000140)={&(0x7f0000000100)=@RTM_GETMDB={0x18, 0x56, 0x2, 0x70bd25, 0x25dfdbfe, {0x7, r3}, [""]}, 0x18}}, 0x20000000) (async)
sendmsg$nl_route(r2, &(0x7f0000000240)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000580)=ANY=[@ANYBLOB="4800000010000305ff810000fddbdf2500000000", @ANYRES32=r3, @ANYBLOB="1748000040000200280012800a000100767863616e0000001800028014000100000000", @ANYRES32=r3], 0x48}, 0x1, 0x0, 0x0, 0x40}, 0x0) (async)
connect$inet(r1, &(0x7f0000000000)={0x2, 0x4e22, @empty}, 0x10) (async)
setsockopt$sock_int(r1, 0x1, 0x9, &(0x7f00000003c0)=0x246, 0x4) (async)
ioctl$FE_SET_PROPERTY(r0, 0x40106f52, &(0x7f00000000c0)={0x29, &(0x7f0000000200)=[{0x34, '\x00', @data=0x4}]}) (async)

program crashed: KASAN: slab-use-after-free Read in dvb_device_open
testing program (duration=45s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): [19, 20, 20]
detailed listing:
executing program 3:
r0 = socket$inet6_tcp(0xa, 0x1, 0x0)
connect$inet6(r0, 0x0, 0x0)
gettid()
timer_settime(0x0, 0x0, &(0x7f0000000280)={{0x0, 0x989680}, {0x0, 0x989680}}, 0x0)
socketpair$unix(0x1, 0x0, 0x0, 0x0)
getsockopt$sock_cred(0xffffffffffffffff, 0x1, 0x11, 0x0, &(0x7f0000cab000))
setsockopt$sock_cred(0xffffffffffffffff, 0x1, 0x11, 0x0, 0x0)
setsockopt$inet6_tcp_TCP_REPAIR_QUEUE(r0, 0x6, 0x14, 0x0, 0x0)
mmap(&(0x7f0000000000/0x4000)=nil, 0x4000, 0x1, 0x10012, 0xffffffffffffffff, 0x5deba000)
mmap(&(0x7f0000bfe000/0x400000)=nil, 0x400000, 0x4, 0x40010, r0, 0xd1aa000)
mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x3, 0x8031, 0xffffffffffffffff, 0x0)
mmap$dsp(&(0x7f0000ffd000/0x2000)=nil, 0x2000, 0x100000b, 0x810, 0xffffffffffffffff, 0x0)
socket$xdp(0x2c, 0x3, 0x0)
r1 = socket$kcm(0xa, 0x2, 0x0)
r2 = socket(0x2, 0x80805, 0x0)
r3 = openat$fuse(0xffffffffffffff9c, &(0x7f0000000080), 0x2, 0x0)
read$FUSE(r3, &(0x7f0000000600)={0x2020}, 0x2020)
setsockopt$IP_VS_SO_SET_ADD(r2, 0x0, 0x482, &(0x7f0000000240)={0x84, @dev={0xac, 0x14, 0x14, 0x15}, 0x4e20, 0x3, 'wlc\x00', 0x2, 0x660f537e, 0x3}, 0x2c)
sendmsg$sock(r1, &(0x7f0000000400)={&(0x7f0000000580)=@in6={0x2, 0x4e20, 0x0, @dev={0xfe, 0x80, '\x00', 0xfd}}, 0x80, 0x0, 0x0, &(0x7f0000000000)=[@mark={{0x14, 0x1, 0x24, 0x3}}], 0x18}, 0x0)
executing program 0:
r0 = syz_usb_connect(0x0, 0x32, &(0x7f0000000000)=ANY=[@ANYBLOB="1201000200000040a61b01000100000000010902200001010080320904"], 0x0)
r1 = openat$ptp1(0xffffffffffffff9c, &(0x7f0000000c40), 0x149201, 0x0)
ioctl$PTP_ENABLE_PPS(r1, 0x40043d04, 0x1)
r2 = socket$kcm(0x10, 0x2, 0x4)
sendmsg$inet(r2, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)=[{&(0x7f0000000100)="5c00000012006bab9e3fe3d86e6c1d0000147ea60864160af36504b68675f8001d000a00a0e69ee517d34460bc24eab556a705251e6182949a36c23d3b48dfd8cdbf9367b4fa51f60a64c9f4080003680601000008000300ff000000", 0x5c}], 0x1, 0x0, 0x0, 0x1f00c00e}, 0x0)
r3 = syz_usb_connect$uac3(0x3, 0x80, &(0x7f0000000280)=ANY=[], 0x0)
syz_usb_control_io(r0, 0x0, 0x0)
syz_usb_control_io$sierra_net(r0, 0x0, &(0x7f0000000700)={0x1c, &(0x7f0000000280)=ANY=[], 0x0, 0x0})
syz_usb_control_io$uac3(r3, 0x0, 0x0)
syz_usb_control_io$printer(r0, 0x0, &(0x7f00000005c0)={0x34, &(0x7f00000003c0)=ANY=[], 0x0, 0x0, 0x0, 0x0, 0x0})
mkdirat(0xffffffffffffff9c, &(0x7f0000000200)='./file0\x00', 0x0)
r4 = openat(0xffffffffffffff9c, &(0x7f0000000080)='./file0\x00', 0x0, 0xd5)
ioctl$FS_IOC_GETFLAGS(r4, 0x80086601, &(0x7f0000000100))
syz_open_dev$dvb_frontend(&(0x7f0000000100), 0x1, 0x802)
r5 = socket$inet6_sctp(0xa, 0x801, 0x84)
sendmsg$inet(r2, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)=[{&(0x7f0000000100)="5c00000012006bab9e3fe3d86e6c1d0000147ea60864160af36504b68675f8001d000a00a0e69ee517d34460bc24eab556a705251e6182949a36c23d3b48dfd8cdbf9367b4fa51f60a64c9f4080003680601000008000300ff000000", 0x5c}], 0x1, 0x0, 0x0, 0x1f00c00e}, 0x0) (async)
syz_usb_connect$uac3(0x3, 0x80, &(0x7f0000000280)=ANY=[], 0x0) (async)
syz_usb_control_io$uac3(r3, 0x0, 0x0) (async)
syz_open_dev$dvb_frontend(&(0x7f0000000100), 0x1, 0x802) (async)
getsockopt$bt_hci(r5, 0x84, 0x81, &(0x7f0000001280)=""/4107, &(0x7f00000000c0)=0x100b) (async)
executing program 4:
r0 = syz_open_dev$dvb_frontend(&(0x7f0000000080), 0x0, 0x402)
r1 = socket$inet_mptcp(0x2, 0x1, 0x106)
r2 = socket(0x10, 0x803, 0x0)
syz_genetlink_get_family_id$tipc(&(0x7f0000000000), r2)
getsockname$packet(r2, &(0x7f0000000280)={0x11, 0x0, <r3=>0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14)
sendmsg$nl_route(r2, &(0x7f0000000180)={&(0x7f0000000040)={0x10, 0x0, 0x0, 0x400000}, 0xc, &(0x7f0000000140)={&(0x7f0000000100)=@RTM_GETMDB={0x18, 0x56, 0x2, 0x70bd25, 0x25dfdbfe, {0x7, r3}, [""]}, 0x18}}, 0x20000000)
sendmsg$nl_route(r2, &(0x7f0000000240)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000580)=ANY=[@ANYBLOB="4800000010000305ff810000fddbdf2500000000", @ANYRES32=r3, @ANYBLOB="1748000040000200280012800a000100767863616e0000001800028014000100000000", @ANYRES32=r3], 0x48}, 0x1, 0x0, 0x0, 0x40}, 0x0)
connect$inet(r1, &(0x7f0000000000)={0x2, 0x4e22, @empty}, 0x10)
setsockopt$sock_int(r1, 0x1, 0x9, &(0x7f00000003c0)=0x246, 0x4)
ioctl$FE_SET_PROPERTY(r0, 0x40106f52, &(0x7f00000000c0)={0x29, &(0x7f0000000200)=[{0x34, '\x00', @data=0x4}]})
syz_open_dev$dvb_frontend(&(0x7f0000000080), 0x0, 0x402) (async)
socket$inet_mptcp(0x2, 0x1, 0x106) (async)
socket(0x10, 0x803, 0x0) (async)
syz_genetlink_get_family_id$tipc(&(0x7f0000000000), r2) (async)
getsockname$packet(r2, &(0x7f0000000280)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) (async)
sendmsg$nl_route(r2, &(0x7f0000000180)={&(0x7f0000000040)={0x10, 0x0, 0x0, 0x400000}, 0xc, &(0x7f0000000140)={&(0x7f0000000100)=@RTM_GETMDB={0x18, 0x56, 0x2, 0x70bd25, 0x25dfdbfe, {0x7, r3}, [""]}, 0x18}}, 0x20000000) (async)
sendmsg$nl_route(r2, &(0x7f0000000240)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000580)=ANY=[@ANYBLOB="4800000010000305ff810000fddbdf2500000000", @ANYRES32=r3, @ANYBLOB="1748000040000200280012800a000100767863616e0000001800028014000100000000", @ANYRES32=r3], 0x48}, 0x1, 0x0, 0x0, 0x40}, 0x0) (async)
connect$inet(r1, &(0x7f0000000000)={0x2, 0x4e22, @empty}, 0x10) (async)
setsockopt$sock_int(r1, 0x1, 0x9, &(0x7f00000003c0)=0x246, 0x4) (async)
ioctl$FE_SET_PROPERTY(r0, 0x40106f52, &(0x7f00000000c0)={0x29, &(0x7f0000000200)=[{0x34, '\x00', @data=0x4}]}) (async)

program crashed: KASAN: slab-use-after-free Read in dvb_device_open
testing program (duration=45s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): [19, 19, 20]
detailed listing:
executing program 3:
r0 = socket$inet6_tcp(0xa, 0x1, 0x0)
connect$inet6(r0, 0x0, 0x0)
gettid()
timer_settime(0x0, 0x0, &(0x7f0000000280)={{0x0, 0x989680}, {0x0, 0x989680}}, 0x0)
socketpair$unix(0x1, 0x0, 0x0, 0x0)
getsockopt$sock_cred(0xffffffffffffffff, 0x1, 0x11, 0x0, &(0x7f0000cab000))
setsockopt$sock_cred(0xffffffffffffffff, 0x1, 0x11, 0x0, 0x0)
setsockopt$inet6_tcp_TCP_REPAIR_QUEUE(r0, 0x6, 0x14, 0x0, 0x0)
mmap(&(0x7f0000000000/0x4000)=nil, 0x4000, 0x1, 0x10012, 0xffffffffffffffff, 0x5deba000)
mmap(&(0x7f0000bfe000/0x400000)=nil, 0x400000, 0x4, 0x40010, r0, 0xd1aa000)
mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x3, 0x8031, 0xffffffffffffffff, 0x0)
mmap$dsp(&(0x7f0000ffd000/0x2000)=nil, 0x2000, 0x100000b, 0x810, 0xffffffffffffffff, 0x0)
socket$xdp(0x2c, 0x3, 0x0)
r1 = socket$kcm(0xa, 0x2, 0x0)
r2 = socket(0x2, 0x80805, 0x0)
r3 = openat$fuse(0xffffffffffffff9c, &(0x7f0000000080), 0x2, 0x0)
read$FUSE(r3, &(0x7f0000000600)={0x2020}, 0x2020)
setsockopt$IP_VS_SO_SET_ADD(r2, 0x0, 0x482, &(0x7f0000000240)={0x84, @dev={0xac, 0x14, 0x14, 0x15}, 0x4e20, 0x3, 'wlc\x00', 0x2, 0x660f537e, 0x3}, 0x2c)
sendmsg$sock(r1, &(0x7f0000000400)={&(0x7f0000000580)=@in6={0x2, 0x4e20, 0x0, @dev={0xfe, 0x80, '\x00', 0xfd}}, 0x80, 0x0, 0x0, &(0x7f0000000000)=[@mark={{0x14, 0x1, 0x24, 0x3}}], 0x18}, 0x0)
executing program 0:
r0 = syz_usb_connect(0x0, 0x32, &(0x7f0000000000)=ANY=[@ANYBLOB="1201000200000040a61b01000100000000010902200001010080320904"], 0x0)
r1 = openat$ptp1(0xffffffffffffff9c, &(0x7f0000000c40), 0x149201, 0x0)
ioctl$PTP_ENABLE_PPS(r1, 0x40043d04, 0x1)
r2 = socket$kcm(0x10, 0x2, 0x4)
sendmsg$inet(r2, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)=[{&(0x7f0000000100)="5c00000012006bab9e3fe3d86e6c1d0000147ea60864160af36504b68675f8001d000a00a0e69ee517d34460bc24eab556a705251e6182949a36c23d3b48dfd8cdbf9367b4fa51f60a64c9f4080003680601000008000300ff000000", 0x5c}], 0x1, 0x0, 0x0, 0x1f00c00e}, 0x0)
r3 = syz_usb_connect$uac3(0x3, 0x80, &(0x7f0000000280)=ANY=[], 0x0)
syz_usb_control_io(r0, 0x0, 0x0)
syz_usb_control_io$sierra_net(r0, 0x0, &(0x7f0000000700)={0x1c, &(0x7f0000000280)=ANY=[], 0x0, 0x0})
syz_usb_control_io$uac3(r3, 0x0, 0x0)
syz_usb_control_io$printer(r0, 0x0, &(0x7f00000005c0)={0x34, &(0x7f00000003c0)=ANY=[], 0x0, 0x0, 0x0, 0x0, 0x0})
mkdirat(0xffffffffffffff9c, &(0x7f0000000200)='./file0\x00', 0x0)
r4 = openat(0xffffffffffffff9c, &(0x7f0000000080)='./file0\x00', 0x0, 0xd5)
ioctl$FS_IOC_GETFLAGS(r4, 0x80086601, &(0x7f0000000100))
syz_open_dev$dvb_frontend(&(0x7f0000000100), 0x1, 0x802)
sendmsg$inet(r2, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)=[{&(0x7f0000000100)="5c00000012006bab9e3fe3d86e6c1d0000147ea60864160af36504b68675f8001d000a00a0e69ee517d34460bc24eab556a705251e6182949a36c23d3b48dfd8cdbf9367b4fa51f60a64c9f4080003680601000008000300ff000000", 0x5c}], 0x1, 0x0, 0x0, 0x1f00c00e}, 0x0) (async)
syz_usb_connect$uac3(0x3, 0x80, &(0x7f0000000280)=ANY=[], 0x0) (async)
syz_usb_control_io$uac3(r3, 0x0, 0x0) (async)
syz_open_dev$dvb_frontend(&(0x7f0000000100), 0x1, 0x802) (async)
getsockopt$bt_hci(0xffffffffffffffff, 0x84, 0x81, &(0x7f0000001280)=""/4107, &(0x7f00000000c0)=0x100b) (async)
executing program 4:
r0 = syz_open_dev$dvb_frontend(&(0x7f0000000080), 0x0, 0x402)
r1 = socket$inet_mptcp(0x2, 0x1, 0x106)
r2 = socket(0x10, 0x803, 0x0)
syz_genetlink_get_family_id$tipc(&(0x7f0000000000), r2)
getsockname$packet(r2, &(0x7f0000000280)={0x11, 0x0, <r3=>0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14)
sendmsg$nl_route(r2, &(0x7f0000000180)={&(0x7f0000000040)={0x10, 0x0, 0x0, 0x400000}, 0xc, &(0x7f0000000140)={&(0x7f0000000100)=@RTM_GETMDB={0x18, 0x56, 0x2, 0x70bd25, 0x25dfdbfe, {0x7, r3}, [""]}, 0x18}}, 0x20000000)
sendmsg$nl_route(r2, &(0x7f0000000240)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000580)=ANY=[@ANYBLOB="4800000010000305ff810000fddbdf2500000000", @ANYRES32=r3, @ANYBLOB="1748000040000200280012800a000100767863616e0000001800028014000100000000", @ANYRES32=r3], 0x48}, 0x1, 0x0, 0x0, 0x40}, 0x0)
connect$inet(r1, &(0x7f0000000000)={0x2, 0x4e22, @empty}, 0x10)
setsockopt$sock_int(r1, 0x1, 0x9, &(0x7f00000003c0)=0x246, 0x4)
ioctl$FE_SET_PROPERTY(r0, 0x40106f52, &(0x7f00000000c0)={0x29, &(0x7f0000000200)=[{0x34, '\x00', @data=0x4}]})
syz_open_dev$dvb_frontend(&(0x7f0000000080), 0x0, 0x402) (async)
socket$inet_mptcp(0x2, 0x1, 0x106) (async)
socket(0x10, 0x803, 0x0) (async)
syz_genetlink_get_family_id$tipc(&(0x7f0000000000), r2) (async)
getsockname$packet(r2, &(0x7f0000000280)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) (async)
sendmsg$nl_route(r2, &(0x7f0000000180)={&(0x7f0000000040)={0x10, 0x0, 0x0, 0x400000}, 0xc, &(0x7f0000000140)={&(0x7f0000000100)=@RTM_GETMDB={0x18, 0x56, 0x2, 0x70bd25, 0x25dfdbfe, {0x7, r3}, [""]}, 0x18}}, 0x20000000) (async)
sendmsg$nl_route(r2, &(0x7f0000000240)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000580)=ANY=[@ANYBLOB="4800000010000305ff810000fddbdf2500000000", @ANYRES32=r3, @ANYBLOB="1748000040000200280012800a000100767863616e0000001800028014000100000000", @ANYRES32=r3], 0x48}, 0x1, 0x0, 0x0, 0x40}, 0x0) (async)
connect$inet(r1, &(0x7f0000000000)={0x2, 0x4e22, @empty}, 0x10) (async)
setsockopt$sock_int(r1, 0x1, 0x9, &(0x7f00000003c0)=0x246, 0x4) (async)
ioctl$FE_SET_PROPERTY(r0, 0x40106f52, &(0x7f00000000c0)={0x29, &(0x7f0000000200)=[{0x34, '\x00', @data=0x4}]}) (async)

program crashed: KASAN: slab-use-after-free Read in dvb_device_open
testing program (duration=45s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): [19, 18, 20]
detailed listing:
executing program 3:
r0 = socket$inet6_tcp(0xa, 0x1, 0x0)
connect$inet6(r0, 0x0, 0x0)
gettid()
timer_settime(0x0, 0x0, &(0x7f0000000280)={{0x0, 0x989680}, {0x0, 0x989680}}, 0x0)
socketpair$unix(0x1, 0x0, 0x0, 0x0)
getsockopt$sock_cred(0xffffffffffffffff, 0x1, 0x11, 0x0, &(0x7f0000cab000))
setsockopt$sock_cred(0xffffffffffffffff, 0x1, 0x11, 0x0, 0x0)
setsockopt$inet6_tcp_TCP_REPAIR_QUEUE(r0, 0x6, 0x14, 0x0, 0x0)
mmap(&(0x7f0000000000/0x4000)=nil, 0x4000, 0x1, 0x10012, 0xffffffffffffffff, 0x5deba000)
mmap(&(0x7f0000bfe000/0x400000)=nil, 0x400000, 0x4, 0x40010, r0, 0xd1aa000)
mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x3, 0x8031, 0xffffffffffffffff, 0x0)
mmap$dsp(&(0x7f0000ffd000/0x2000)=nil, 0x2000, 0x100000b, 0x810, 0xffffffffffffffff, 0x0)
socket$xdp(0x2c, 0x3, 0x0)
r1 = socket$kcm(0xa, 0x2, 0x0)
r2 = socket(0x2, 0x80805, 0x0)
r3 = openat$fuse(0xffffffffffffff9c, &(0x7f0000000080), 0x2, 0x0)
read$FUSE(r3, &(0x7f0000000600)={0x2020}, 0x2020)
setsockopt$IP_VS_SO_SET_ADD(r2, 0x0, 0x482, &(0x7f0000000240)={0x84, @dev={0xac, 0x14, 0x14, 0x15}, 0x4e20, 0x3, 'wlc\x00', 0x2, 0x660f537e, 0x3}, 0x2c)
sendmsg$sock(r1, &(0x7f0000000400)={&(0x7f0000000580)=@in6={0x2, 0x4e20, 0x0, @dev={0xfe, 0x80, '\x00', 0xfd}}, 0x80, 0x0, 0x0, &(0x7f0000000000)=[@mark={{0x14, 0x1, 0x24, 0x3}}], 0x18}, 0x0)
executing program 0:
r0 = syz_usb_connect(0x0, 0x32, &(0x7f0000000000)=ANY=[@ANYBLOB="1201000200000040a61b01000100000000010902200001010080320904"], 0x0)
r1 = openat$ptp1(0xffffffffffffff9c, &(0x7f0000000c40), 0x149201, 0x0)
ioctl$PTP_ENABLE_PPS(r1, 0x40043d04, 0x1)
r2 = socket$kcm(0x10, 0x2, 0x4)
sendmsg$inet(r2, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)=[{&(0x7f0000000100)="5c00000012006bab9e3fe3d86e6c1d0000147ea60864160af36504b68675f8001d000a00a0e69ee517d34460bc24eab556a705251e6182949a36c23d3b48dfd8cdbf9367b4fa51f60a64c9f4080003680601000008000300ff000000", 0x5c}], 0x1, 0x0, 0x0, 0x1f00c00e}, 0x0)
r3 = syz_usb_connect$uac3(0x3, 0x80, &(0x7f0000000280)=ANY=[], 0x0)
syz_usb_control_io(r0, 0x0, 0x0)
syz_usb_control_io$sierra_net(r0, 0x0, &(0x7f0000000700)={0x1c, &(0x7f0000000280)=ANY=[], 0x0, 0x0})
syz_usb_control_io$uac3(r3, 0x0, 0x0)
syz_usb_control_io$printer(r0, 0x0, &(0x7f00000005c0)={0x34, &(0x7f00000003c0)=ANY=[], 0x0, 0x0, 0x0, 0x0, 0x0})
mkdirat(0xffffffffffffff9c, &(0x7f0000000200)='./file0\x00', 0x0)
r4 = openat(0xffffffffffffff9c, &(0x7f0000000080)='./file0\x00', 0x0, 0xd5)
ioctl$FS_IOC_GETFLAGS(r4, 0x80086601, &(0x7f0000000100))
sendmsg$inet(r2, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)=[{&(0x7f0000000100)="5c00000012006bab9e3fe3d86e6c1d0000147ea60864160af36504b68675f8001d000a00a0e69ee517d34460bc24eab556a705251e6182949a36c23d3b48dfd8cdbf9367b4fa51f60a64c9f4080003680601000008000300ff000000", 0x5c}], 0x1, 0x0, 0x0, 0x1f00c00e}, 0x0) (async)
syz_usb_connect$uac3(0x3, 0x80, &(0x7f0000000280)=ANY=[], 0x0) (async)
syz_usb_control_io$uac3(r3, 0x0, 0x0) (async)
syz_open_dev$dvb_frontend(&(0x7f0000000100), 0x1, 0x802) (async)
getsockopt$bt_hci(0xffffffffffffffff, 0x84, 0x81, &(0x7f0000001280)=""/4107, &(0x7f00000000c0)=0x100b) (async)
executing program 4:
r0 = syz_open_dev$dvb_frontend(&(0x7f0000000080), 0x0, 0x402)
r1 = socket$inet_mptcp(0x2, 0x1, 0x106)
r2 = socket(0x10, 0x803, 0x0)
syz_genetlink_get_family_id$tipc(&(0x7f0000000000), r2)
getsockname$packet(r2, &(0x7f0000000280)={0x11, 0x0, <r3=>0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14)
sendmsg$nl_route(r2, &(0x7f0000000180)={&(0x7f0000000040)={0x10, 0x0, 0x0, 0x400000}, 0xc, &(0x7f0000000140)={&(0x7f0000000100)=@RTM_GETMDB={0x18, 0x56, 0x2, 0x70bd25, 0x25dfdbfe, {0x7, r3}, [""]}, 0x18}}, 0x20000000)
sendmsg$nl_route(r2, &(0x7f0000000240)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000580)=ANY=[@ANYBLOB="4800000010000305ff810000fddbdf2500000000", @ANYRES32=r3, @ANYBLOB="1748000040000200280012800a000100767863616e0000001800028014000100000000", @ANYRES32=r3], 0x48}, 0x1, 0x0, 0x0, 0x40}, 0x0)
connect$inet(r1, &(0x7f0000000000)={0x2, 0x4e22, @empty}, 0x10)
setsockopt$sock_int(r1, 0x1, 0x9, &(0x7f00000003c0)=0x246, 0x4)
ioctl$FE_SET_PROPERTY(r0, 0x40106f52, &(0x7f00000000c0)={0x29, &(0x7f0000000200)=[{0x34, '\x00', @data=0x4}]})
syz_open_dev$dvb_frontend(&(0x7f0000000080), 0x0, 0x402) (async)
socket$inet_mptcp(0x2, 0x1, 0x106) (async)
socket(0x10, 0x803, 0x0) (async)
syz_genetlink_get_family_id$tipc(&(0x7f0000000000), r2) (async)
getsockname$packet(r2, &(0x7f0000000280)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) (async)
sendmsg$nl_route(r2, &(0x7f0000000180)={&(0x7f0000000040)={0x10, 0x0, 0x0, 0x400000}, 0xc, &(0x7f0000000140)={&(0x7f0000000100)=@RTM_GETMDB={0x18, 0x56, 0x2, 0x70bd25, 0x25dfdbfe, {0x7, r3}, [""]}, 0x18}}, 0x20000000) (async)
sendmsg$nl_route(r2, &(0x7f0000000240)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000580)=ANY=[@ANYBLOB="4800000010000305ff810000fddbdf2500000000", @ANYRES32=r3, @ANYBLOB="1748000040000200280012800a000100767863616e0000001800028014000100000000", @ANYRES32=r3], 0x48}, 0x1, 0x0, 0x0, 0x40}, 0x0) (async)
connect$inet(r1, &(0x7f0000000000)={0x2, 0x4e22, @empty}, 0x10) (async)
setsockopt$sock_int(r1, 0x1, 0x9, &(0x7f00000003c0)=0x246, 0x4) (async)
ioctl$FE_SET_PROPERTY(r0, 0x40106f52, &(0x7f00000000c0)={0x29, &(0x7f0000000200)=[{0x34, '\x00', @data=0x4}]}) (async)

program crashed: KASAN: slab-use-after-free Read in dvb_device_open
testing program (duration=45s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): [19, 17, 20]
detailed listing:
executing program 3:
r0 = socket$inet6_tcp(0xa, 0x1, 0x0)
connect$inet6(r0, 0x0, 0x0)
gettid()
timer_settime(0x0, 0x0, &(0x7f0000000280)={{0x0, 0x989680}, {0x0, 0x989680}}, 0x0)
socketpair$unix(0x1, 0x0, 0x0, 0x0)
getsockopt$sock_cred(0xffffffffffffffff, 0x1, 0x11, 0x0, &(0x7f0000cab000))
setsockopt$sock_cred(0xffffffffffffffff, 0x1, 0x11, 0x0, 0x0)
setsockopt$inet6_tcp_TCP_REPAIR_QUEUE(r0, 0x6, 0x14, 0x0, 0x0)
mmap(&(0x7f0000000000/0x4000)=nil, 0x4000, 0x1, 0x10012, 0xffffffffffffffff, 0x5deba000)
mmap(&(0x7f0000bfe000/0x400000)=nil, 0x400000, 0x4, 0x40010, r0, 0xd1aa000)
mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x3, 0x8031, 0xffffffffffffffff, 0x0)
mmap$dsp(&(0x7f0000ffd000/0x2000)=nil, 0x2000, 0x100000b, 0x810, 0xffffffffffffffff, 0x0)
socket$xdp(0x2c, 0x3, 0x0)
r1 = socket$kcm(0xa, 0x2, 0x0)
r2 = socket(0x2, 0x80805, 0x0)
r3 = openat$fuse(0xffffffffffffff9c, &(0x7f0000000080), 0x2, 0x0)
read$FUSE(r3, &(0x7f0000000600)={0x2020}, 0x2020)
setsockopt$IP_VS_SO_SET_ADD(r2, 0x0, 0x482, &(0x7f0000000240)={0x84, @dev={0xac, 0x14, 0x14, 0x15}, 0x4e20, 0x3, 'wlc\x00', 0x2, 0x660f537e, 0x3}, 0x2c)
sendmsg$sock(r1, &(0x7f0000000400)={&(0x7f0000000580)=@in6={0x2, 0x4e20, 0x0, @dev={0xfe, 0x80, '\x00', 0xfd}}, 0x80, 0x0, 0x0, &(0x7f0000000000)=[@mark={{0x14, 0x1, 0x24, 0x3}}], 0x18}, 0x0)
executing program 0:
r0 = syz_usb_connect(0x0, 0x32, &(0x7f0000000000)=ANY=[@ANYBLOB="1201000200000040a61b01000100000000010902200001010080320904"], 0x0)
r1 = openat$ptp1(0xffffffffffffff9c, &(0x7f0000000c40), 0x149201, 0x0)
ioctl$PTP_ENABLE_PPS(r1, 0x40043d04, 0x1)
r2 = socket$kcm(0x10, 0x2, 0x4)
sendmsg$inet(r2, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)=[{&(0x7f0000000100)="5c00000012006bab9e3fe3d86e6c1d0000147ea60864160af36504b68675f8001d000a00a0e69ee517d34460bc24eab556a705251e6182949a36c23d3b48dfd8cdbf9367b4fa51f60a64c9f4080003680601000008000300ff000000", 0x5c}], 0x1, 0x0, 0x0, 0x1f00c00e}, 0x0)
r3 = syz_usb_connect$uac3(0x3, 0x80, &(0x7f0000000280)=ANY=[], 0x0)
syz_usb_control_io(r0, 0x0, 0x0)
syz_usb_control_io$sierra_net(r0, 0x0, &(0x7f0000000700)={0x1c, &(0x7f0000000280)=ANY=[], 0x0, 0x0})
syz_usb_control_io$uac3(r3, 0x0, 0x0)
syz_usb_control_io$printer(r0, 0x0, &(0x7f00000005c0)={0x34, &(0x7f00000003c0)=ANY=[], 0x0, 0x0, 0x0, 0x0, 0x0})
mkdirat(0xffffffffffffff9c, &(0x7f0000000200)='./file0\x00', 0x0)
openat(0xffffffffffffff9c, &(0x7f0000000080)='./file0\x00', 0x0, 0xd5)
sendmsg$inet(r2, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)=[{&(0x7f0000000100)="5c00000012006bab9e3fe3d86e6c1d0000147ea60864160af36504b68675f8001d000a00a0e69ee517d34460bc24eab556a705251e6182949a36c23d3b48dfd8cdbf9367b4fa51f60a64c9f4080003680601000008000300ff000000", 0x5c}], 0x1, 0x0, 0x0, 0x1f00c00e}, 0x0) (async)
syz_usb_connect$uac3(0x3, 0x80, &(0x7f0000000280)=ANY=[], 0x0) (async)
syz_usb_control_io$uac3(r3, 0x0, 0x0) (async)
syz_open_dev$dvb_frontend(&(0x7f0000000100), 0x1, 0x802) (async)
getsockopt$bt_hci(0xffffffffffffffff, 0x84, 0x81, &(0x7f0000001280)=""/4107, &(0x7f00000000c0)=0x100b) (async)
executing program 4:
r0 = syz_open_dev$dvb_frontend(&(0x7f0000000080), 0x0, 0x402)
r1 = socket$inet_mptcp(0x2, 0x1, 0x106)
r2 = socket(0x10, 0x803, 0x0)
syz_genetlink_get_family_id$tipc(&(0x7f0000000000), r2)
getsockname$packet(r2, &(0x7f0000000280)={0x11, 0x0, <r3=>0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14)
sendmsg$nl_route(r2, &(0x7f0000000180)={&(0x7f0000000040)={0x10, 0x0, 0x0, 0x400000}, 0xc, &(0x7f0000000140)={&(0x7f0000000100)=@RTM_GETMDB={0x18, 0x56, 0x2, 0x70bd25, 0x25dfdbfe, {0x7, r3}, [""]}, 0x18}}, 0x20000000)
sendmsg$nl_route(r2, &(0x7f0000000240)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000580)=ANY=[@ANYBLOB="4800000010000305ff810000fddbdf2500000000", @ANYRES32=r3, @ANYBLOB="1748000040000200280012800a000100767863616e0000001800028014000100000000", @ANYRES32=r3], 0x48}, 0x1, 0x0, 0x0, 0x40}, 0x0)
connect$inet(r1, &(0x7f0000000000)={0x2, 0x4e22, @empty}, 0x10)
setsockopt$sock_int(r1, 0x1, 0x9, &(0x7f00000003c0)=0x246, 0x4)
ioctl$FE_SET_PROPERTY(r0, 0x40106f52, &(0x7f00000000c0)={0x29, &(0x7f0000000200)=[{0x34, '\x00', @data=0x4}]})
syz_open_dev$dvb_frontend(&(0x7f0000000080), 0x0, 0x402) (async)
socket$inet_mptcp(0x2, 0x1, 0x106) (async)
socket(0x10, 0x803, 0x0) (async)
syz_genetlink_get_family_id$tipc(&(0x7f0000000000), r2) (async)
getsockname$packet(r2, &(0x7f0000000280)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) (async)
sendmsg$nl_route(r2, &(0x7f0000000180)={&(0x7f0000000040)={0x10, 0x0, 0x0, 0x400000}, 0xc, &(0x7f0000000140)={&(0x7f0000000100)=@RTM_GETMDB={0x18, 0x56, 0x2, 0x70bd25, 0x25dfdbfe, {0x7, r3}, [""]}, 0x18}}, 0x20000000) (async)
sendmsg$nl_route(r2, &(0x7f0000000240)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000580)=ANY=[@ANYBLOB="4800000010000305ff810000fddbdf2500000000", @ANYRES32=r3, @ANYBLOB="1748000040000200280012800a000100767863616e0000001800028014000100000000", @ANYRES32=r3], 0x48}, 0x1, 0x0, 0x0, 0x40}, 0x0) (async)
connect$inet(r1, &(0x7f0000000000)={0x2, 0x4e22, @empty}, 0x10) (async)
setsockopt$sock_int(r1, 0x1, 0x9, &(0x7f00000003c0)=0x246, 0x4) (async)
ioctl$FE_SET_PROPERTY(r0, 0x40106f52, &(0x7f00000000c0)={0x29, &(0x7f0000000200)=[{0x34, '\x00', @data=0x4}]}) (async)

program crashed: KASAN: slab-use-after-free Read in dvb_device_open
testing program (duration=45s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): [19, 16, 20]
detailed listing:
executing program 3:
r0 = socket$inet6_tcp(0xa, 0x1, 0x0)
connect$inet6(r0, 0x0, 0x0)
gettid()
timer_settime(0x0, 0x0, &(0x7f0000000280)={{0x0, 0x989680}, {0x0, 0x989680}}, 0x0)
socketpair$unix(0x1, 0x0, 0x0, 0x0)
getsockopt$sock_cred(0xffffffffffffffff, 0x1, 0x11, 0x0, &(0x7f0000cab000))
setsockopt$sock_cred(0xffffffffffffffff, 0x1, 0x11, 0x0, 0x0)
setsockopt$inet6_tcp_TCP_REPAIR_QUEUE(r0, 0x6, 0x14, 0x0, 0x0)
mmap(&(0x7f0000000000/0x4000)=nil, 0x4000, 0x1, 0x10012, 0xffffffffffffffff, 0x5deba000)
mmap(&(0x7f0000bfe000/0x400000)=nil, 0x400000, 0x4, 0x40010, r0, 0xd1aa000)
mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x3, 0x8031, 0xffffffffffffffff, 0x0)
mmap$dsp(&(0x7f0000ffd000/0x2000)=nil, 0x2000, 0x100000b, 0x810, 0xffffffffffffffff, 0x0)
socket$xdp(0x2c, 0x3, 0x0)
r1 = socket$kcm(0xa, 0x2, 0x0)
r2 = socket(0x2, 0x80805, 0x0)
r3 = openat$fuse(0xffffffffffffff9c, &(0x7f0000000080), 0x2, 0x0)
read$FUSE(r3, &(0x7f0000000600)={0x2020}, 0x2020)
setsockopt$IP_VS_SO_SET_ADD(r2, 0x0, 0x482, &(0x7f0000000240)={0x84, @dev={0xac, 0x14, 0x14, 0x15}, 0x4e20, 0x3, 'wlc\x00', 0x2, 0x660f537e, 0x3}, 0x2c)
sendmsg$sock(r1, &(0x7f0000000400)={&(0x7f0000000580)=@in6={0x2, 0x4e20, 0x0, @dev={0xfe, 0x80, '\x00', 0xfd}}, 0x80, 0x0, 0x0, &(0x7f0000000000)=[@mark={{0x14, 0x1, 0x24, 0x3}}], 0x18}, 0x0)
executing program 0:
r0 = syz_usb_connect(0x0, 0x32, &(0x7f0000000000)=ANY=[@ANYBLOB="1201000200000040a61b01000100000000010902200001010080320904"], 0x0)
r1 = openat$ptp1(0xffffffffffffff9c, &(0x7f0000000c40), 0x149201, 0x0)
ioctl$PTP_ENABLE_PPS(r1, 0x40043d04, 0x1)
r2 = socket$kcm(0x10, 0x2, 0x4)
sendmsg$inet(r2, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)=[{&(0x7f0000000100)="5c00000012006bab9e3fe3d86e6c1d0000147ea60864160af36504b68675f8001d000a00a0e69ee517d34460bc24eab556a705251e6182949a36c23d3b48dfd8cdbf9367b4fa51f60a64c9f4080003680601000008000300ff000000", 0x5c}], 0x1, 0x0, 0x0, 0x1f00c00e}, 0x0)
r3 = syz_usb_connect$uac3(0x3, 0x80, &(0x7f0000000280)=ANY=[], 0x0)
syz_usb_control_io(r0, 0x0, 0x0)
syz_usb_control_io$sierra_net(r0, 0x0, &(0x7f0000000700)={0x1c, &(0x7f0000000280)=ANY=[], 0x0, 0x0})
syz_usb_control_io$uac3(r3, 0x0, 0x0)
syz_usb_control_io$printer(r0, 0x0, &(0x7f00000005c0)={0x34, &(0x7f00000003c0)=ANY=[], 0x0, 0x0, 0x0, 0x0, 0x0})
mkdirat(0xffffffffffffff9c, &(0x7f0000000200)='./file0\x00', 0x0)
sendmsg$inet(r2, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)=[{&(0x7f0000000100)="5c00000012006bab9e3fe3d86e6c1d0000147ea60864160af36504b68675f8001d000a00a0e69ee517d34460bc24eab556a705251e6182949a36c23d3b48dfd8cdbf9367b4fa51f60a64c9f4080003680601000008000300ff000000", 0x5c}], 0x1, 0x0, 0x0, 0x1f00c00e}, 0x0) (async)
syz_usb_connect$uac3(0x3, 0x80, &(0x7f0000000280)=ANY=[], 0x0) (async)
syz_usb_control_io$uac3(r3, 0x0, 0x0) (async)
syz_open_dev$dvb_frontend(&(0x7f0000000100), 0x1, 0x802) (async)
getsockopt$bt_hci(0xffffffffffffffff, 0x84, 0x81, &(0x7f0000001280)=""/4107, &(0x7f00000000c0)=0x100b) (async)
executing program 4:
r0 = syz_open_dev$dvb_frontend(&(0x7f0000000080), 0x0, 0x402)
r1 = socket$inet_mptcp(0x2, 0x1, 0x106)
r2 = socket(0x10, 0x803, 0x0)
syz_genetlink_get_family_id$tipc(&(0x7f0000000000), r2)
getsockname$packet(r2, &(0x7f0000000280)={0x11, 0x0, <r3=>0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14)
sendmsg$nl_route(r2, &(0x7f0000000180)={&(0x7f0000000040)={0x10, 0x0, 0x0, 0x400000}, 0xc, &(0x7f0000000140)={&(0x7f0000000100)=@RTM_GETMDB={0x18, 0x56, 0x2, 0x70bd25, 0x25dfdbfe, {0x7, r3}, [""]}, 0x18}}, 0x20000000)
sendmsg$nl_route(r2, &(0x7f0000000240)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000580)=ANY=[@ANYBLOB="4800000010000305ff810000fddbdf2500000000", @ANYRES32=r3, @ANYBLOB="1748000040000200280012800a000100767863616e0000001800028014000100000000", @ANYRES32=r3], 0x48}, 0x1, 0x0, 0x0, 0x40}, 0x0)
connect$inet(r1, &(0x7f0000000000)={0x2, 0x4e22, @empty}, 0x10)
setsockopt$sock_int(r1, 0x1, 0x9, &(0x7f00000003c0)=0x246, 0x4)
ioctl$FE_SET_PROPERTY(r0, 0x40106f52, &(0x7f00000000c0)={0x29, &(0x7f0000000200)=[{0x34, '\x00', @data=0x4}]})
syz_open_dev$dvb_frontend(&(0x7f0000000080), 0x0, 0x402) (async)
socket$inet_mptcp(0x2, 0x1, 0x106) (async)
socket(0x10, 0x803, 0x0) (async)
syz_genetlink_get_family_id$tipc(&(0x7f0000000000), r2) (async)
getsockname$packet(r2, &(0x7f0000000280)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) (async)
sendmsg$nl_route(r2, &(0x7f0000000180)={&(0x7f0000000040)={0x10, 0x0, 0x0, 0x400000}, 0xc, &(0x7f0000000140)={&(0x7f0000000100)=@RTM_GETMDB={0x18, 0x56, 0x2, 0x70bd25, 0x25dfdbfe, {0x7, r3}, [""]}, 0x18}}, 0x20000000) (async)
sendmsg$nl_route(r2, &(0x7f0000000240)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000580)=ANY=[@ANYBLOB="4800000010000305ff810000fddbdf2500000000", @ANYRES32=r3, @ANYBLOB="1748000040000200280012800a000100767863616e0000001800028014000100000000", @ANYRES32=r3], 0x48}, 0x1, 0x0, 0x0, 0x40}, 0x0) (async)
connect$inet(r1, &(0x7f0000000000)={0x2, 0x4e22, @empty}, 0x10) (async)
setsockopt$sock_int(r1, 0x1, 0x9, &(0x7f00000003c0)=0x246, 0x4) (async)
ioctl$FE_SET_PROPERTY(r0, 0x40106f52, &(0x7f00000000c0)={0x29, &(0x7f0000000200)=[{0x34, '\x00', @data=0x4}]}) (async)

program crashed: KASAN: slab-use-after-free Read in dvb_device_open
testing program (duration=45s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): [19, 15, 20]
detailed listing:
executing program 3:
r0 = socket$inet6_tcp(0xa, 0x1, 0x0)
connect$inet6(r0, 0x0, 0x0)
gettid()
timer_settime(0x0, 0x0, &(0x7f0000000280)={{0x0, 0x989680}, {0x0, 0x989680}}, 0x0)
socketpair$unix(0x1, 0x0, 0x0, 0x0)
getsockopt$sock_cred(0xffffffffffffffff, 0x1, 0x11, 0x0, &(0x7f0000cab000))
setsockopt$sock_cred(0xffffffffffffffff, 0x1, 0x11, 0x0, 0x0)
setsockopt$inet6_tcp_TCP_REPAIR_QUEUE(r0, 0x6, 0x14, 0x0, 0x0)
mmap(&(0x7f0000000000/0x4000)=nil, 0x4000, 0x1, 0x10012, 0xffffffffffffffff, 0x5deba000)
mmap(&(0x7f0000bfe000/0x400000)=nil, 0x400000, 0x4, 0x40010, r0, 0xd1aa000)
mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x3, 0x8031, 0xffffffffffffffff, 0x0)
mmap$dsp(&(0x7f0000ffd000/0x2000)=nil, 0x2000, 0x100000b, 0x810, 0xffffffffffffffff, 0x0)
socket$xdp(0x2c, 0x3, 0x0)
r1 = socket$kcm(0xa, 0x2, 0x0)
r2 = socket(0x2, 0x80805, 0x0)
r3 = openat$fuse(0xffffffffffffff9c, &(0x7f0000000080), 0x2, 0x0)
read$FUSE(r3, &(0x7f0000000600)={0x2020}, 0x2020)
setsockopt$IP_VS_SO_SET_ADD(r2, 0x0, 0x482, &(0x7f0000000240)={0x84, @dev={0xac, 0x14, 0x14, 0x15}, 0x4e20, 0x3, 'wlc\x00', 0x2, 0x660f537e, 0x3}, 0x2c)
sendmsg$sock(r1, &(0x7f0000000400)={&(0x7f0000000580)=@in6={0x2, 0x4e20, 0x0, @dev={0xfe, 0x80, '\x00', 0xfd}}, 0x80, 0x0, 0x0, &(0x7f0000000000)=[@mark={{0x14, 0x1, 0x24, 0x3}}], 0x18}, 0x0)
executing program 0:
r0 = syz_usb_connect(0x0, 0x32, &(0x7f0000000000)=ANY=[@ANYBLOB="1201000200000040a61b01000100000000010902200001010080320904"], 0x0)
r1 = openat$ptp1(0xffffffffffffff9c, &(0x7f0000000c40), 0x149201, 0x0)
ioctl$PTP_ENABLE_PPS(r1, 0x40043d04, 0x1)
r2 = socket$kcm(0x10, 0x2, 0x4)
sendmsg$inet(r2, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)=[{&(0x7f0000000100)="5c00000012006bab9e3fe3d86e6c1d0000147ea60864160af36504b68675f8001d000a00a0e69ee517d34460bc24eab556a705251e6182949a36c23d3b48dfd8cdbf9367b4fa51f60a64c9f4080003680601000008000300ff000000", 0x5c}], 0x1, 0x0, 0x0, 0x1f00c00e}, 0x0)
r3 = syz_usb_connect$uac3(0x3, 0x80, &(0x7f0000000280)=ANY=[], 0x0)
syz_usb_control_io(r0, 0x0, 0x0)
syz_usb_control_io$sierra_net(r0, 0x0, &(0x7f0000000700)={0x1c, &(0x7f0000000280)=ANY=[], 0x0, 0x0})
syz_usb_control_io$uac3(r3, 0x0, 0x0)
syz_usb_control_io$printer(r0, 0x0, &(0x7f00000005c0)={0x34, &(0x7f00000003c0)=ANY=[], 0x0, 0x0, 0x0, 0x0, 0x0})
sendmsg$inet(r2, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)=[{&(0x7f0000000100)="5c00000012006bab9e3fe3d86e6c1d0000147ea60864160af36504b68675f8001d000a00a0e69ee517d34460bc24eab556a705251e6182949a36c23d3b48dfd8cdbf9367b4fa51f60a64c9f4080003680601000008000300ff000000", 0x5c}], 0x1, 0x0, 0x0, 0x1f00c00e}, 0x0) (async)
syz_usb_connect$uac3(0x3, 0x80, &(0x7f0000000280)=ANY=[], 0x0) (async)
syz_usb_control_io$uac3(r3, 0x0, 0x0) (async)
syz_open_dev$dvb_frontend(&(0x7f0000000100), 0x1, 0x802) (async)
getsockopt$bt_hci(0xffffffffffffffff, 0x84, 0x81, &(0x7f0000001280)=""/4107, &(0x7f00000000c0)=0x100b) (async)
executing program 4:
r0 = syz_open_dev$dvb_frontend(&(0x7f0000000080), 0x0, 0x402)
r1 = socket$inet_mptcp(0x2, 0x1, 0x106)
r2 = socket(0x10, 0x803, 0x0)
syz_genetlink_get_family_id$tipc(&(0x7f0000000000), r2)
getsockname$packet(r2, &(0x7f0000000280)={0x11, 0x0, <r3=>0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14)
sendmsg$nl_route(r2, &(0x7f0000000180)={&(0x7f0000000040)={0x10, 0x0, 0x0, 0x400000}, 0xc, &(0x7f0000000140)={&(0x7f0000000100)=@RTM_GETMDB={0x18, 0x56, 0x2, 0x70bd25, 0x25dfdbfe, {0x7, r3}, [""]}, 0x18}}, 0x20000000)
sendmsg$nl_route(r2, &(0x7f0000000240)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000580)=ANY=[@ANYBLOB="4800000010000305ff810000fddbdf2500000000", @ANYRES32=r3, @ANYBLOB="1748000040000200280012800a000100767863616e0000001800028014000100000000", @ANYRES32=r3], 0x48}, 0x1, 0x0, 0x0, 0x40}, 0x0)
connect$inet(r1, &(0x7f0000000000)={0x2, 0x4e22, @empty}, 0x10)
setsockopt$sock_int(r1, 0x1, 0x9, &(0x7f00000003c0)=0x246, 0x4)
ioctl$FE_SET_PROPERTY(r0, 0x40106f52, &(0x7f00000000c0)={0x29, &(0x7f0000000200)=[{0x34, '\x00', @data=0x4}]})
syz_open_dev$dvb_frontend(&(0x7f0000000080), 0x0, 0x402) (async)
socket$inet_mptcp(0x2, 0x1, 0x106) (async)
socket(0x10, 0x803, 0x0) (async)
syz_genetlink_get_family_id$tipc(&(0x7f0000000000), r2) (async)
getsockname$packet(r2, &(0x7f0000000280)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) (async)
sendmsg$nl_route(r2, &(0x7f0000000180)={&(0x7f0000000040)={0x10, 0x0, 0x0, 0x400000}, 0xc, &(0x7f0000000140)={&(0x7f0000000100)=@RTM_GETMDB={0x18, 0x56, 0x2, 0x70bd25, 0x25dfdbfe, {0x7, r3}, [""]}, 0x18}}, 0x20000000) (async)
sendmsg$nl_route(r2, &(0x7f0000000240)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000580)=ANY=[@ANYBLOB="4800000010000305ff810000fddbdf2500000000", @ANYRES32=r3, @ANYBLOB="1748000040000200280012800a000100767863616e0000001800028014000100000000", @ANYRES32=r3], 0x48}, 0x1, 0x0, 0x0, 0x40}, 0x0) (async)
connect$inet(r1, &(0x7f0000000000)={0x2, 0x4e22, @empty}, 0x10) (async)
setsockopt$sock_int(r1, 0x1, 0x9, &(0x7f00000003c0)=0x246, 0x4) (async)
ioctl$FE_SET_PROPERTY(r0, 0x40106f52, &(0x7f00000000c0)={0x29, &(0x7f0000000200)=[{0x34, '\x00', @data=0x4}]}) (async)

program did not crash
testing program (duration=45s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): [19, 15, 20]
detailed listing:
executing program 3:
r0 = socket$inet6_tcp(0xa, 0x1, 0x0)
connect$inet6(r0, 0x0, 0x0)
gettid()
timer_settime(0x0, 0x0, &(0x7f0000000280)={{0x0, 0x989680}, {0x0, 0x989680}}, 0x0)
socketpair$unix(0x1, 0x0, 0x0, 0x0)
getsockopt$sock_cred(0xffffffffffffffff, 0x1, 0x11, 0x0, &(0x7f0000cab000))
setsockopt$sock_cred(0xffffffffffffffff, 0x1, 0x11, 0x0, 0x0)
setsockopt$inet6_tcp_TCP_REPAIR_QUEUE(r0, 0x6, 0x14, 0x0, 0x0)
mmap(&(0x7f0000000000/0x4000)=nil, 0x4000, 0x1, 0x10012, 0xffffffffffffffff, 0x5deba000)
mmap(&(0x7f0000bfe000/0x400000)=nil, 0x400000, 0x4, 0x40010, r0, 0xd1aa000)
mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x3, 0x8031, 0xffffffffffffffff, 0x0)
mmap$dsp(&(0x7f0000ffd000/0x2000)=nil, 0x2000, 0x100000b, 0x810, 0xffffffffffffffff, 0x0)
socket$xdp(0x2c, 0x3, 0x0)
r1 = socket$kcm(0xa, 0x2, 0x0)
r2 = socket(0x2, 0x80805, 0x0)
r3 = openat$fuse(0xffffffffffffff9c, &(0x7f0000000080), 0x2, 0x0)
read$FUSE(r3, &(0x7f0000000600)={0x2020}, 0x2020)
setsockopt$IP_VS_SO_SET_ADD(r2, 0x0, 0x482, &(0x7f0000000240)={0x84, @dev={0xac, 0x14, 0x14, 0x15}, 0x4e20, 0x3, 'wlc\x00', 0x2, 0x660f537e, 0x3}, 0x2c)
sendmsg$sock(r1, &(0x7f0000000400)={&(0x7f0000000580)=@in6={0x2, 0x4e20, 0x0, @dev={0xfe, 0x80, '\x00', 0xfd}}, 0x80, 0x0, 0x0, &(0x7f0000000000)=[@mark={{0x14, 0x1, 0x24, 0x3}}], 0x18}, 0x0)
executing program 0:
r0 = syz_usb_connect(0x0, 0x32, &(0x7f0000000000)=ANY=[@ANYBLOB="1201000200000040a61b01000100000000010902200001010080320904"], 0x0)
r1 = openat$ptp1(0xffffffffffffff9c, &(0x7f0000000c40), 0x149201, 0x0)
ioctl$PTP_ENABLE_PPS(r1, 0x40043d04, 0x1)
r2 = socket$kcm(0x10, 0x2, 0x4)
sendmsg$inet(r2, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)=[{&(0x7f0000000100)="5c00000012006bab9e3fe3d86e6c1d0000147ea60864160af36504b68675f8001d000a00a0e69ee517d34460bc24eab556a705251e6182949a36c23d3b48dfd8cdbf9367b4fa51f60a64c9f4080003680601000008000300ff000000", 0x5c}], 0x1, 0x0, 0x0, 0x1f00c00e}, 0x0)
r3 = syz_usb_connect$uac3(0x3, 0x80, &(0x7f0000000280)=ANY=[], 0x0)
syz_usb_control_io(r0, 0x0, 0x0)
syz_usb_control_io$sierra_net(r0, 0x0, &(0x7f0000000700)={0x1c, &(0x7f0000000280)=ANY=[], 0x0, 0x0})
syz_usb_control_io$uac3(r3, 0x0, 0x0)
mkdirat(0xffffffffffffff9c, &(0x7f0000000200)='./file0\x00', 0x0)
sendmsg$inet(r2, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)=[{&(0x7f0000000100)="5c00000012006bab9e3fe3d86e6c1d0000147ea60864160af36504b68675f8001d000a00a0e69ee517d34460bc24eab556a705251e6182949a36c23d3b48dfd8cdbf9367b4fa51f60a64c9f4080003680601000008000300ff000000", 0x5c}], 0x1, 0x0, 0x0, 0x1f00c00e}, 0x0) (async)
syz_usb_connect$uac3(0x3, 0x80, &(0x7f0000000280)=ANY=[], 0x0) (async)
syz_usb_control_io$uac3(r3, 0x0, 0x0) (async)
syz_open_dev$dvb_frontend(&(0x7f0000000100), 0x1, 0x802) (async)
getsockopt$bt_hci(0xffffffffffffffff, 0x84, 0x81, &(0x7f0000001280)=""/4107, &(0x7f00000000c0)=0x100b) (async)
executing program 4:
r0 = syz_open_dev$dvb_frontend(&(0x7f0000000080), 0x0, 0x402)
r1 = socket$inet_mptcp(0x2, 0x1, 0x106)
r2 = socket(0x10, 0x803, 0x0)
syz_genetlink_get_family_id$tipc(&(0x7f0000000000), r2)
getsockname$packet(r2, &(0x7f0000000280)={0x11, 0x0, <r3=>0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14)
sendmsg$nl_route(r2, &(0x7f0000000180)={&(0x7f0000000040)={0x10, 0x0, 0x0, 0x400000}, 0xc, &(0x7f0000000140)={&(0x7f0000000100)=@RTM_GETMDB={0x18, 0x56, 0x2, 0x70bd25, 0x25dfdbfe, {0x7, r3}, [""]}, 0x18}}, 0x20000000)
sendmsg$nl_route(r2, &(0x7f0000000240)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000580)=ANY=[@ANYBLOB="4800000010000305ff810000fddbdf2500000000", @ANYRES32=r3, @ANYBLOB="1748000040000200280012800a000100767863616e0000001800028014000100000000", @ANYRES32=r3], 0x48}, 0x1, 0x0, 0x0, 0x40}, 0x0)
connect$inet(r1, &(0x7f0000000000)={0x2, 0x4e22, @empty}, 0x10)
setsockopt$sock_int(r1, 0x1, 0x9, &(0x7f00000003c0)=0x246, 0x4)
ioctl$FE_SET_PROPERTY(r0, 0x40106f52, &(0x7f00000000c0)={0x29, &(0x7f0000000200)=[{0x34, '\x00', @data=0x4}]})
syz_open_dev$dvb_frontend(&(0x7f0000000080), 0x0, 0x402) (async)
socket$inet_mptcp(0x2, 0x1, 0x106) (async)
socket(0x10, 0x803, 0x0) (async)
syz_genetlink_get_family_id$tipc(&(0x7f0000000000), r2) (async)
getsockname$packet(r2, &(0x7f0000000280)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) (async)
sendmsg$nl_route(r2, &(0x7f0000000180)={&(0x7f0000000040)={0x10, 0x0, 0x0, 0x400000}, 0xc, &(0x7f0000000140)={&(0x7f0000000100)=@RTM_GETMDB={0x18, 0x56, 0x2, 0x70bd25, 0x25dfdbfe, {0x7, r3}, [""]}, 0x18}}, 0x20000000) (async)
sendmsg$nl_route(r2, &(0x7f0000000240)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000580)=ANY=[@ANYBLOB="4800000010000305ff810000fddbdf2500000000", @ANYRES32=r3, @ANYBLOB="1748000040000200280012800a000100767863616e0000001800028014000100000000", @ANYRES32=r3], 0x48}, 0x1, 0x0, 0x0, 0x40}, 0x0) (async)
connect$inet(r1, &(0x7f0000000000)={0x2, 0x4e22, @empty}, 0x10) (async)
setsockopt$sock_int(r1, 0x1, 0x9, &(0x7f00000003c0)=0x246, 0x4) (async)
ioctl$FE_SET_PROPERTY(r0, 0x40106f52, &(0x7f00000000c0)={0x29, &(0x7f0000000200)=[{0x34, '\x00', @data=0x4}]}) (async)

program did not crash
testing program (duration=45s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): [19, 15, 20]
detailed listing:
executing program 3:
r0 = socket$inet6_tcp(0xa, 0x1, 0x0)
connect$inet6(r0, 0x0, 0x0)
gettid()
timer_settime(0x0, 0x0, &(0x7f0000000280)={{0x0, 0x989680}, {0x0, 0x989680}}, 0x0)
socketpair$unix(0x1, 0x0, 0x0, 0x0)
getsockopt$sock_cred(0xffffffffffffffff, 0x1, 0x11, 0x0, &(0x7f0000cab000))
setsockopt$sock_cred(0xffffffffffffffff, 0x1, 0x11, 0x0, 0x0)
setsockopt$inet6_tcp_TCP_REPAIR_QUEUE(r0, 0x6, 0x14, 0x0, 0x0)
mmap(&(0x7f0000000000/0x4000)=nil, 0x4000, 0x1, 0x10012, 0xffffffffffffffff, 0x5deba000)
mmap(&(0x7f0000bfe000/0x400000)=nil, 0x400000, 0x4, 0x40010, r0, 0xd1aa000)
mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x3, 0x8031, 0xffffffffffffffff, 0x0)
mmap$dsp(&(0x7f0000ffd000/0x2000)=nil, 0x2000, 0x100000b, 0x810, 0xffffffffffffffff, 0x0)
socket$xdp(0x2c, 0x3, 0x0)
r1 = socket$kcm(0xa, 0x2, 0x0)
r2 = socket(0x2, 0x80805, 0x0)
r3 = openat$fuse(0xffffffffffffff9c, &(0x7f0000000080), 0x2, 0x0)
read$FUSE(r3, &(0x7f0000000600)={0x2020}, 0x2020)
setsockopt$IP_VS_SO_SET_ADD(r2, 0x0, 0x482, &(0x7f0000000240)={0x84, @dev={0xac, 0x14, 0x14, 0x15}, 0x4e20, 0x3, 'wlc\x00', 0x2, 0x660f537e, 0x3}, 0x2c)
sendmsg$sock(r1, &(0x7f0000000400)={&(0x7f0000000580)=@in6={0x2, 0x4e20, 0x0, @dev={0xfe, 0x80, '\x00', 0xfd}}, 0x80, 0x0, 0x0, &(0x7f0000000000)=[@mark={{0x14, 0x1, 0x24, 0x3}}], 0x18}, 0x0)
executing program 0:
r0 = syz_usb_connect(0x0, 0x32, &(0x7f0000000000)=ANY=[@ANYBLOB="1201000200000040a61b01000100000000010902200001010080320904"], 0x0)
r1 = openat$ptp1(0xffffffffffffff9c, &(0x7f0000000c40), 0x149201, 0x0)
ioctl$PTP_ENABLE_PPS(r1, 0x40043d04, 0x1)
r2 = socket$kcm(0x10, 0x2, 0x4)
sendmsg$inet(r2, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)=[{&(0x7f0000000100)="5c00000012006bab9e3fe3d86e6c1d0000147ea60864160af36504b68675f8001d000a00a0e69ee517d34460bc24eab556a705251e6182949a36c23d3b48dfd8cdbf9367b4fa51f60a64c9f4080003680601000008000300ff000000", 0x5c}], 0x1, 0x0, 0x0, 0x1f00c00e}, 0x0)
r3 = syz_usb_connect$uac3(0x3, 0x80, &(0x7f0000000280)=ANY=[], 0x0)
syz_usb_control_io(r0, 0x0, 0x0)
syz_usb_control_io$sierra_net(r0, 0x0, &(0x7f0000000700)={0x1c, &(0x7f0000000280)=ANY=[], 0x0, 0x0})
syz_usb_control_io$printer(r0, 0x0, &(0x7f00000005c0)={0x34, &(0x7f00000003c0)=ANY=[], 0x0, 0x0, 0x0, 0x0, 0x0})
mkdirat(0xffffffffffffff9c, &(0x7f0000000200)='./file0\x00', 0x0)
sendmsg$inet(r2, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)=[{&(0x7f0000000100)="5c00000012006bab9e3fe3d86e6c1d0000147ea60864160af36504b68675f8001d000a00a0e69ee517d34460bc24eab556a705251e6182949a36c23d3b48dfd8cdbf9367b4fa51f60a64c9f4080003680601000008000300ff000000", 0x5c}], 0x1, 0x0, 0x0, 0x1f00c00e}, 0x0) (async)
syz_usb_connect$uac3(0x3, 0x80, &(0x7f0000000280)=ANY=[], 0x0) (async)
syz_usb_control_io$uac3(r3, 0x0, 0x0) (async)
syz_open_dev$dvb_frontend(&(0x7f0000000100), 0x1, 0x802) (async)
getsockopt$bt_hci(0xffffffffffffffff, 0x84, 0x81, &(0x7f0000001280)=""/4107, &(0x7f00000000c0)=0x100b) (async)
executing program 4:
r0 = syz_open_dev$dvb_frontend(&(0x7f0000000080), 0x0, 0x402)
r1 = socket$inet_mptcp(0x2, 0x1, 0x106)
r2 = socket(0x10, 0x803, 0x0)
syz_genetlink_get_family_id$tipc(&(0x7f0000000000), r2)
getsockname$packet(r2, &(0x7f0000000280)={0x11, 0x0, <r3=>0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14)
sendmsg$nl_route(r2, &(0x7f0000000180)={&(0x7f0000000040)={0x10, 0x0, 0x0, 0x400000}, 0xc, &(0x7f0000000140)={&(0x7f0000000100)=@RTM_GETMDB={0x18, 0x56, 0x2, 0x70bd25, 0x25dfdbfe, {0x7, r3}, [""]}, 0x18}}, 0x20000000)
sendmsg$nl_route(r2, &(0x7f0000000240)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000580)=ANY=[@ANYBLOB="4800000010000305ff810000fddbdf2500000000", @ANYRES32=r3, @ANYBLOB="1748000040000200280012800a000100767863616e0000001800028014000100000000", @ANYRES32=r3], 0x48}, 0x1, 0x0, 0x0, 0x40}, 0x0)
connect$inet(r1, &(0x7f0000000000)={0x2, 0x4e22, @empty}, 0x10)
setsockopt$sock_int(r1, 0x1, 0x9, &(0x7f00000003c0)=0x246, 0x4)
ioctl$FE_SET_PROPERTY(r0, 0x40106f52, &(0x7f00000000c0)={0x29, &(0x7f0000000200)=[{0x34, '\x00', @data=0x4}]})
syz_open_dev$dvb_frontend(&(0x7f0000000080), 0x0, 0x402) (async)
socket$inet_mptcp(0x2, 0x1, 0x106) (async)
socket(0x10, 0x803, 0x0) (async)
syz_genetlink_get_family_id$tipc(&(0x7f0000000000), r2) (async)
getsockname$packet(r2, &(0x7f0000000280)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) (async)
sendmsg$nl_route(r2, &(0x7f0000000180)={&(0x7f0000000040)={0x10, 0x0, 0x0, 0x400000}, 0xc, &(0x7f0000000140)={&(0x7f0000000100)=@RTM_GETMDB={0x18, 0x56, 0x2, 0x70bd25, 0x25dfdbfe, {0x7, r3}, [""]}, 0x18}}, 0x20000000) (async)
sendmsg$nl_route(r2, &(0x7f0000000240)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000580)=ANY=[@ANYBLOB="4800000010000305ff810000fddbdf2500000000", @ANYRES32=r3, @ANYBLOB="1748000040000200280012800a000100767863616e0000001800028014000100000000", @ANYRES32=r3], 0x48}, 0x1, 0x0, 0x0, 0x40}, 0x0) (async)
connect$inet(r1, &(0x7f0000000000)={0x2, 0x4e22, @empty}, 0x10) (async)
setsockopt$sock_int(r1, 0x1, 0x9, &(0x7f00000003c0)=0x246, 0x4) (async)
ioctl$FE_SET_PROPERTY(r0, 0x40106f52, &(0x7f00000000c0)={0x29, &(0x7f0000000200)=[{0x34, '\x00', @data=0x4}]}) (async)

program crashed: KASAN: slab-use-after-free Read in dvb_device_open
testing program (duration=45s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): [19, 14, 20]
detailed listing:
executing program 3:
r0 = socket$inet6_tcp(0xa, 0x1, 0x0)
connect$inet6(r0, 0x0, 0x0)
gettid()
timer_settime(0x0, 0x0, &(0x7f0000000280)={{0x0, 0x989680}, {0x0, 0x989680}}, 0x0)
socketpair$unix(0x1, 0x0, 0x0, 0x0)
getsockopt$sock_cred(0xffffffffffffffff, 0x1, 0x11, 0x0, &(0x7f0000cab000))
setsockopt$sock_cred(0xffffffffffffffff, 0x1, 0x11, 0x0, 0x0)
setsockopt$inet6_tcp_TCP_REPAIR_QUEUE(r0, 0x6, 0x14, 0x0, 0x0)
mmap(&(0x7f0000000000/0x4000)=nil, 0x4000, 0x1, 0x10012, 0xffffffffffffffff, 0x5deba000)
mmap(&(0x7f0000bfe000/0x400000)=nil, 0x400000, 0x4, 0x40010, r0, 0xd1aa000)
mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x3, 0x8031, 0xffffffffffffffff, 0x0)
mmap$dsp(&(0x7f0000ffd000/0x2000)=nil, 0x2000, 0x100000b, 0x810, 0xffffffffffffffff, 0x0)
socket$xdp(0x2c, 0x3, 0x0)
r1 = socket$kcm(0xa, 0x2, 0x0)
r2 = socket(0x2, 0x80805, 0x0)
r3 = openat$fuse(0xffffffffffffff9c, &(0x7f0000000080), 0x2, 0x0)
read$FUSE(r3, &(0x7f0000000600)={0x2020}, 0x2020)
setsockopt$IP_VS_SO_SET_ADD(r2, 0x0, 0x482, &(0x7f0000000240)={0x84, @dev={0xac, 0x14, 0x14, 0x15}, 0x4e20, 0x3, 'wlc\x00', 0x2, 0x660f537e, 0x3}, 0x2c)
sendmsg$sock(r1, &(0x7f0000000400)={&(0x7f0000000580)=@in6={0x2, 0x4e20, 0x0, @dev={0xfe, 0x80, '\x00', 0xfd}}, 0x80, 0x0, 0x0, &(0x7f0000000000)=[@mark={{0x14, 0x1, 0x24, 0x3}}], 0x18}, 0x0)
executing program 0:
r0 = syz_usb_connect(0x0, 0x32, &(0x7f0000000000)=ANY=[@ANYBLOB="1201000200000040a61b01000100000000010902200001010080320904"], 0x0)
r1 = openat$ptp1(0xffffffffffffff9c, &(0x7f0000000c40), 0x149201, 0x0)
ioctl$PTP_ENABLE_PPS(r1, 0x40043d04, 0x1)
r2 = socket$kcm(0x10, 0x2, 0x4)
sendmsg$inet(r2, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)=[{&(0x7f0000000100)="5c00000012006bab9e3fe3d86e6c1d0000147ea60864160af36504b68675f8001d000a00a0e69ee517d34460bc24eab556a705251e6182949a36c23d3b48dfd8cdbf9367b4fa51f60a64c9f4080003680601000008000300ff000000", 0x5c}], 0x1, 0x0, 0x0, 0x1f00c00e}, 0x0)
r3 = syz_usb_connect$uac3(0x3, 0x80, &(0x7f0000000280)=ANY=[], 0x0)
syz_usb_control_io(r0, 0x0, 0x0)
syz_usb_control_io$printer(r0, 0x0, &(0x7f00000005c0)={0x34, &(0x7f00000003c0)=ANY=[], 0x0, 0x0, 0x0, 0x0, 0x0})
mkdirat(0xffffffffffffff9c, &(0x7f0000000200)='./file0\x00', 0x0)
sendmsg$inet(r2, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)=[{&(0x7f0000000100)="5c00000012006bab9e3fe3d86e6c1d0000147ea60864160af36504b68675f8001d000a00a0e69ee517d34460bc24eab556a705251e6182949a36c23d3b48dfd8cdbf9367b4fa51f60a64c9f4080003680601000008000300ff000000", 0x5c}], 0x1, 0x0, 0x0, 0x1f00c00e}, 0x0) (async)
syz_usb_connect$uac3(0x3, 0x80, &(0x7f0000000280)=ANY=[], 0x0) (async)
syz_usb_control_io$uac3(r3, 0x0, 0x0) (async)
syz_open_dev$dvb_frontend(&(0x7f0000000100), 0x1, 0x802) (async)
getsockopt$bt_hci(0xffffffffffffffff, 0x84, 0x81, &(0x7f0000001280)=""/4107, &(0x7f00000000c0)=0x100b) (async)
executing program 4:
r0 = syz_open_dev$dvb_frontend(&(0x7f0000000080), 0x0, 0x402)
r1 = socket$inet_mptcp(0x2, 0x1, 0x106)
r2 = socket(0x10, 0x803, 0x0)
syz_genetlink_get_family_id$tipc(&(0x7f0000000000), r2)
getsockname$packet(r2, &(0x7f0000000280)={0x11, 0x0, <r3=>0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14)
sendmsg$nl_route(r2, &(0x7f0000000180)={&(0x7f0000000040)={0x10, 0x0, 0x0, 0x400000}, 0xc, &(0x7f0000000140)={&(0x7f0000000100)=@RTM_GETMDB={0x18, 0x56, 0x2, 0x70bd25, 0x25dfdbfe, {0x7, r3}, [""]}, 0x18}}, 0x20000000)
sendmsg$nl_route(r2, &(0x7f0000000240)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000580)=ANY=[@ANYBLOB="4800000010000305ff810000fddbdf2500000000", @ANYRES32=r3, @ANYBLOB="1748000040000200280012800a000100767863616e0000001800028014000100000000", @ANYRES32=r3], 0x48}, 0x1, 0x0, 0x0, 0x40}, 0x0)
connect$inet(r1, &(0x7f0000000000)={0x2, 0x4e22, @empty}, 0x10)
setsockopt$sock_int(r1, 0x1, 0x9, &(0x7f00000003c0)=0x246, 0x4)
ioctl$FE_SET_PROPERTY(r0, 0x40106f52, &(0x7f00000000c0)={0x29, &(0x7f0000000200)=[{0x34, '\x00', @data=0x4}]})
syz_open_dev$dvb_frontend(&(0x7f0000000080), 0x0, 0x402) (async)
socket$inet_mptcp(0x2, 0x1, 0x106) (async)
socket(0x10, 0x803, 0x0) (async)
syz_genetlink_get_family_id$tipc(&(0x7f0000000000), r2) (async)
getsockname$packet(r2, &(0x7f0000000280)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) (async)
sendmsg$nl_route(r2, &(0x7f0000000180)={&(0x7f0000000040)={0x10, 0x0, 0x0, 0x400000}, 0xc, &(0x7f0000000140)={&(0x7f0000000100)=@RTM_GETMDB={0x18, 0x56, 0x2, 0x70bd25, 0x25dfdbfe, {0x7, r3}, [""]}, 0x18}}, 0x20000000) (async)
sendmsg$nl_route(r2, &(0x7f0000000240)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000580)=ANY=[@ANYBLOB="4800000010000305ff810000fddbdf2500000000", @ANYRES32=r3, @ANYBLOB="1748000040000200280012800a000100767863616e0000001800028014000100000000", @ANYRES32=r3], 0x48}, 0x1, 0x0, 0x0, 0x40}, 0x0) (async)
connect$inet(r1, &(0x7f0000000000)={0x2, 0x4e22, @empty}, 0x10) (async)
setsockopt$sock_int(r1, 0x1, 0x9, &(0x7f00000003c0)=0x246, 0x4) (async)
ioctl$FE_SET_PROPERTY(r0, 0x40106f52, &(0x7f00000000c0)={0x29, &(0x7f0000000200)=[{0x34, '\x00', @data=0x4}]}) (async)

program crashed: KASAN: slab-use-after-free Read in dvb_device_open
testing program (duration=45s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): [19, 13, 20]
detailed listing:
executing program 3:
r0 = socket$inet6_tcp(0xa, 0x1, 0x0)
connect$inet6(r0, 0x0, 0x0)
gettid()
timer_settime(0x0, 0x0, &(0x7f0000000280)={{0x0, 0x989680}, {0x0, 0x989680}}, 0x0)
socketpair$unix(0x1, 0x0, 0x0, 0x0)
getsockopt$sock_cred(0xffffffffffffffff, 0x1, 0x11, 0x0, &(0x7f0000cab000))
setsockopt$sock_cred(0xffffffffffffffff, 0x1, 0x11, 0x0, 0x0)
setsockopt$inet6_tcp_TCP_REPAIR_QUEUE(r0, 0x6, 0x14, 0x0, 0x0)
mmap(&(0x7f0000000000/0x4000)=nil, 0x4000, 0x1, 0x10012, 0xffffffffffffffff, 0x5deba000)
mmap(&(0x7f0000bfe000/0x400000)=nil, 0x400000, 0x4, 0x40010, r0, 0xd1aa000)
mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x3, 0x8031, 0xffffffffffffffff, 0x0)
mmap$dsp(&(0x7f0000ffd000/0x2000)=nil, 0x2000, 0x100000b, 0x810, 0xffffffffffffffff, 0x0)
socket$xdp(0x2c, 0x3, 0x0)
r1 = socket$kcm(0xa, 0x2, 0x0)
r2 = socket(0x2, 0x80805, 0x0)
r3 = openat$fuse(0xffffffffffffff9c, &(0x7f0000000080), 0x2, 0x0)
read$FUSE(r3, &(0x7f0000000600)={0x2020}, 0x2020)
setsockopt$IP_VS_SO_SET_ADD(r2, 0x0, 0x482, &(0x7f0000000240)={0x84, @dev={0xac, 0x14, 0x14, 0x15}, 0x4e20, 0x3, 'wlc\x00', 0x2, 0x660f537e, 0x3}, 0x2c)
sendmsg$sock(r1, &(0x7f0000000400)={&(0x7f0000000580)=@in6={0x2, 0x4e20, 0x0, @dev={0xfe, 0x80, '\x00', 0xfd}}, 0x80, 0x0, 0x0, &(0x7f0000000000)=[@mark={{0x14, 0x1, 0x24, 0x3}}], 0x18}, 0x0)
executing program 0:
r0 = syz_usb_connect(0x0, 0x32, &(0x7f0000000000)=ANY=[@ANYBLOB="1201000200000040a61b01000100000000010902200001010080320904"], 0x0)
r1 = openat$ptp1(0xffffffffffffff9c, &(0x7f0000000c40), 0x149201, 0x0)
ioctl$PTP_ENABLE_PPS(r1, 0x40043d04, 0x1)
r2 = socket$kcm(0x10, 0x2, 0x4)
sendmsg$inet(r2, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)=[{&(0x7f0000000100)="5c00000012006bab9e3fe3d86e6c1d0000147ea60864160af36504b68675f8001d000a00a0e69ee517d34460bc24eab556a705251e6182949a36c23d3b48dfd8cdbf9367b4fa51f60a64c9f4080003680601000008000300ff000000", 0x5c}], 0x1, 0x0, 0x0, 0x1f00c00e}, 0x0)
r3 = syz_usb_connect$uac3(0x3, 0x80, &(0x7f0000000280)=ANY=[], 0x0)
syz_usb_control_io$printer(r0, 0x0, &(0x7f00000005c0)={0x34, &(0x7f00000003c0)=ANY=[], 0x0, 0x0, 0x0, 0x0, 0x0})
mkdirat(0xffffffffffffff9c, &(0x7f0000000200)='./file0\x00', 0x0)
sendmsg$inet(r2, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)=[{&(0x7f0000000100)="5c00000012006bab9e3fe3d86e6c1d0000147ea60864160af36504b68675f8001d000a00a0e69ee517d34460bc24eab556a705251e6182949a36c23d3b48dfd8cdbf9367b4fa51f60a64c9f4080003680601000008000300ff000000", 0x5c}], 0x1, 0x0, 0x0, 0x1f00c00e}, 0x0) (async)
syz_usb_connect$uac3(0x3, 0x80, &(0x7f0000000280)=ANY=[], 0x0) (async)
syz_usb_control_io$uac3(r3, 0x0, 0x0) (async)
syz_open_dev$dvb_frontend(&(0x7f0000000100), 0x1, 0x802) (async)
getsockopt$bt_hci(0xffffffffffffffff, 0x84, 0x81, &(0x7f0000001280)=""/4107, &(0x7f00000000c0)=0x100b) (async)
executing program 4:
r0 = syz_open_dev$dvb_frontend(&(0x7f0000000080), 0x0, 0x402)
r1 = socket$inet_mptcp(0x2, 0x1, 0x106)
r2 = socket(0x10, 0x803, 0x0)
syz_genetlink_get_family_id$tipc(&(0x7f0000000000), r2)
getsockname$packet(r2, &(0x7f0000000280)={0x11, 0x0, <r3=>0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14)
sendmsg$nl_route(r2, &(0x7f0000000180)={&(0x7f0000000040)={0x10, 0x0, 0x0, 0x400000}, 0xc, &(0x7f0000000140)={&(0x7f0000000100)=@RTM_GETMDB={0x18, 0x56, 0x2, 0x70bd25, 0x25dfdbfe, {0x7, r3}, [""]}, 0x18}}, 0x20000000)
sendmsg$nl_route(r2, &(0x7f0000000240)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000580)=ANY=[@ANYBLOB="4800000010000305ff810000fddbdf2500000000", @ANYRES32=r3, @ANYBLOB="1748000040000200280012800a000100767863616e0000001800028014000100000000", @ANYRES32=r3], 0x48}, 0x1, 0x0, 0x0, 0x40}, 0x0)
connect$inet(r1, &(0x7f0000000000)={0x2, 0x4e22, @empty}, 0x10)
setsockopt$sock_int(r1, 0x1, 0x9, &(0x7f00000003c0)=0x246, 0x4)
ioctl$FE_SET_PROPERTY(r0, 0x40106f52, &(0x7f00000000c0)={0x29, &(0x7f0000000200)=[{0x34, '\x00', @data=0x4}]})
syz_open_dev$dvb_frontend(&(0x7f0000000080), 0x0, 0x402) (async)
socket$inet_mptcp(0x2, 0x1, 0x106) (async)
socket(0x10, 0x803, 0x0) (async)
syz_genetlink_get_family_id$tipc(&(0x7f0000000000), r2) (async)
getsockname$packet(r2, &(0x7f0000000280)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) (async)
sendmsg$nl_route(r2, &(0x7f0000000180)={&(0x7f0000000040)={0x10, 0x0, 0x0, 0x400000}, 0xc, &(0x7f0000000140)={&(0x7f0000000100)=@RTM_GETMDB={0x18, 0x56, 0x2, 0x70bd25, 0x25dfdbfe, {0x7, r3}, [""]}, 0x18}}, 0x20000000) (async)
sendmsg$nl_route(r2, &(0x7f0000000240)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000580)=ANY=[@ANYBLOB="4800000010000305ff810000fddbdf2500000000", @ANYRES32=r3, @ANYBLOB="1748000040000200280012800a000100767863616e0000001800028014000100000000", @ANYRES32=r3], 0x48}, 0x1, 0x0, 0x0, 0x40}, 0x0) (async)
connect$inet(r1, &(0x7f0000000000)={0x2, 0x4e22, @empty}, 0x10) (async)
setsockopt$sock_int(r1, 0x1, 0x9, &(0x7f00000003c0)=0x246, 0x4) (async)
ioctl$FE_SET_PROPERTY(r0, 0x40106f52, &(0x7f00000000c0)={0x29, &(0x7f0000000200)=[{0x34, '\x00', @data=0x4}]}) (async)

program crashed: KASAN: slab-use-after-free Read in dvb_device_open
testing program (duration=45s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): [19, 12, 20]
detailed listing:
executing program 3:
r0 = socket$inet6_tcp(0xa, 0x1, 0x0)
connect$inet6(r0, 0x0, 0x0)
gettid()
timer_settime(0x0, 0x0, &(0x7f0000000280)={{0x0, 0x989680}, {0x0, 0x989680}}, 0x0)
socketpair$unix(0x1, 0x0, 0x0, 0x0)
getsockopt$sock_cred(0xffffffffffffffff, 0x1, 0x11, 0x0, &(0x7f0000cab000))
setsockopt$sock_cred(0xffffffffffffffff, 0x1, 0x11, 0x0, 0x0)
setsockopt$inet6_tcp_TCP_REPAIR_QUEUE(r0, 0x6, 0x14, 0x0, 0x0)
mmap(&(0x7f0000000000/0x4000)=nil, 0x4000, 0x1, 0x10012, 0xffffffffffffffff, 0x5deba000)
mmap(&(0x7f0000bfe000/0x400000)=nil, 0x400000, 0x4, 0x40010, r0, 0xd1aa000)
mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x3, 0x8031, 0xffffffffffffffff, 0x0)
mmap$dsp(&(0x7f0000ffd000/0x2000)=nil, 0x2000, 0x100000b, 0x810, 0xffffffffffffffff, 0x0)
socket$xdp(0x2c, 0x3, 0x0)
r1 = socket$kcm(0xa, 0x2, 0x0)
r2 = socket(0x2, 0x80805, 0x0)
r3 = openat$fuse(0xffffffffffffff9c, &(0x7f0000000080), 0x2, 0x0)
read$FUSE(r3, &(0x7f0000000600)={0x2020}, 0x2020)
setsockopt$IP_VS_SO_SET_ADD(r2, 0x0, 0x482, &(0x7f0000000240)={0x84, @dev={0xac, 0x14, 0x14, 0x15}, 0x4e20, 0x3, 'wlc\x00', 0x2, 0x660f537e, 0x3}, 0x2c)
sendmsg$sock(r1, &(0x7f0000000400)={&(0x7f0000000580)=@in6={0x2, 0x4e20, 0x0, @dev={0xfe, 0x80, '\x00', 0xfd}}, 0x80, 0x0, 0x0, &(0x7f0000000000)=[@mark={{0x14, 0x1, 0x24, 0x3}}], 0x18}, 0x0)
executing program 0:
r0 = syz_usb_connect(0x0, 0x32, &(0x7f0000000000)=ANY=[@ANYBLOB="1201000200000040a61b01000100000000010902200001010080320904"], 0x0)
r1 = openat$ptp1(0xffffffffffffff9c, &(0x7f0000000c40), 0x149201, 0x0)
ioctl$PTP_ENABLE_PPS(r1, 0x40043d04, 0x1)
r2 = socket$kcm(0x10, 0x2, 0x4)
sendmsg$inet(r2, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)=[{&(0x7f0000000100)="5c00000012006bab9e3fe3d86e6c1d0000147ea60864160af36504b68675f8001d000a00a0e69ee517d34460bc24eab556a705251e6182949a36c23d3b48dfd8cdbf9367b4fa51f60a64c9f4080003680601000008000300ff000000", 0x5c}], 0x1, 0x0, 0x0, 0x1f00c00e}, 0x0)
syz_usb_control_io$printer(r0, 0x0, &(0x7f00000005c0)={0x34, &(0x7f00000003c0)=ANY=[], 0x0, 0x0, 0x0, 0x0, 0x0})
mkdirat(0xffffffffffffff9c, &(0x7f0000000200)='./file0\x00', 0x0)
sendmsg$inet(r2, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)=[{&(0x7f0000000100)="5c00000012006bab9e3fe3d86e6c1d0000147ea60864160af36504b68675f8001d000a00a0e69ee517d34460bc24eab556a705251e6182949a36c23d3b48dfd8cdbf9367b4fa51f60a64c9f4080003680601000008000300ff000000", 0x5c}], 0x1, 0x0, 0x0, 0x1f00c00e}, 0x0) (async)
syz_usb_connect$uac3(0x3, 0x80, &(0x7f0000000280)=ANY=[], 0x0) (async)
syz_usb_control_io$uac3(0xffffffffffffffff, 0x0, 0x0) (async)
syz_open_dev$dvb_frontend(&(0x7f0000000100), 0x1, 0x802) (async)
getsockopt$bt_hci(0xffffffffffffffff, 0x84, 0x81, &(0x7f0000001280)=""/4107, &(0x7f00000000c0)=0x100b) (async)
executing program 4:
r0 = syz_open_dev$dvb_frontend(&(0x7f0000000080), 0x0, 0x402)
r1 = socket$inet_mptcp(0x2, 0x1, 0x106)
r2 = socket(0x10, 0x803, 0x0)
syz_genetlink_get_family_id$tipc(&(0x7f0000000000), r2)
getsockname$packet(r2, &(0x7f0000000280)={0x11, 0x0, <r3=>0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14)
sendmsg$nl_route(r2, &(0x7f0000000180)={&(0x7f0000000040)={0x10, 0x0, 0x0, 0x400000}, 0xc, &(0x7f0000000140)={&(0x7f0000000100)=@RTM_GETMDB={0x18, 0x56, 0x2, 0x70bd25, 0x25dfdbfe, {0x7, r3}, [""]}, 0x18}}, 0x20000000)
sendmsg$nl_route(r2, &(0x7f0000000240)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000580)=ANY=[@ANYBLOB="4800000010000305ff810000fddbdf2500000000", @ANYRES32=r3, @ANYBLOB="1748000040000200280012800a000100767863616e0000001800028014000100000000", @ANYRES32=r3], 0x48}, 0x1, 0x0, 0x0, 0x40}, 0x0)
connect$inet(r1, &(0x7f0000000000)={0x2, 0x4e22, @empty}, 0x10)
setsockopt$sock_int(r1, 0x1, 0x9, &(0x7f00000003c0)=0x246, 0x4)
ioctl$FE_SET_PROPERTY(r0, 0x40106f52, &(0x7f00000000c0)={0x29, &(0x7f0000000200)=[{0x34, '\x00', @data=0x4}]})
syz_open_dev$dvb_frontend(&(0x7f0000000080), 0x0, 0x402) (async)
socket$inet_mptcp(0x2, 0x1, 0x106) (async)
socket(0x10, 0x803, 0x0) (async)
syz_genetlink_get_family_id$tipc(&(0x7f0000000000), r2) (async)
getsockname$packet(r2, &(0x7f0000000280)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) (async)
sendmsg$nl_route(r2, &(0x7f0000000180)={&(0x7f0000000040)={0x10, 0x0, 0x0, 0x400000}, 0xc, &(0x7f0000000140)={&(0x7f0000000100)=@RTM_GETMDB={0x18, 0x56, 0x2, 0x70bd25, 0x25dfdbfe, {0x7, r3}, [""]}, 0x18}}, 0x20000000) (async)
sendmsg$nl_route(r2, &(0x7f0000000240)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000580)=ANY=[@ANYBLOB="4800000010000305ff810000fddbdf2500000000", @ANYRES32=r3, @ANYBLOB="1748000040000200280012800a000100767863616e0000001800028014000100000000", @ANYRES32=r3], 0x48}, 0x1, 0x0, 0x0, 0x40}, 0x0) (async)
connect$inet(r1, &(0x7f0000000000)={0x2, 0x4e22, @empty}, 0x10) (async)
setsockopt$sock_int(r1, 0x1, 0x9, &(0x7f00000003c0)=0x246, 0x4) (async)
ioctl$FE_SET_PROPERTY(r0, 0x40106f52, &(0x7f00000000c0)={0x29, &(0x7f0000000200)=[{0x34, '\x00', @data=0x4}]}) (async)

program did not crash
testing program (duration=45s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): [19, 12, 20]
detailed listing:
executing program 3:
r0 = socket$inet6_tcp(0xa, 0x1, 0x0)
connect$inet6(r0, 0x0, 0x0)
gettid()
timer_settime(0x0, 0x0, &(0x7f0000000280)={{0x0, 0x989680}, {0x0, 0x989680}}, 0x0)
socketpair$unix(0x1, 0x0, 0x0, 0x0)
getsockopt$sock_cred(0xffffffffffffffff, 0x1, 0x11, 0x0, &(0x7f0000cab000))
setsockopt$sock_cred(0xffffffffffffffff, 0x1, 0x11, 0x0, 0x0)
setsockopt$inet6_tcp_TCP_REPAIR_QUEUE(r0, 0x6, 0x14, 0x0, 0x0)
mmap(&(0x7f0000000000/0x4000)=nil, 0x4000, 0x1, 0x10012, 0xffffffffffffffff, 0x5deba000)
mmap(&(0x7f0000bfe000/0x400000)=nil, 0x400000, 0x4, 0x40010, r0, 0xd1aa000)
mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x3, 0x8031, 0xffffffffffffffff, 0x0)
mmap$dsp(&(0x7f0000ffd000/0x2000)=nil, 0x2000, 0x100000b, 0x810, 0xffffffffffffffff, 0x0)
socket$xdp(0x2c, 0x3, 0x0)
r1 = socket$kcm(0xa, 0x2, 0x0)
r2 = socket(0x2, 0x80805, 0x0)
r3 = openat$fuse(0xffffffffffffff9c, &(0x7f0000000080), 0x2, 0x0)
read$FUSE(r3, &(0x7f0000000600)={0x2020}, 0x2020)
setsockopt$IP_VS_SO_SET_ADD(r2, 0x0, 0x482, &(0x7f0000000240)={0x84, @dev={0xac, 0x14, 0x14, 0x15}, 0x4e20, 0x3, 'wlc\x00', 0x2, 0x660f537e, 0x3}, 0x2c)
sendmsg$sock(r1, &(0x7f0000000400)={&(0x7f0000000580)=@in6={0x2, 0x4e20, 0x0, @dev={0xfe, 0x80, '\x00', 0xfd}}, 0x80, 0x0, 0x0, &(0x7f0000000000)=[@mark={{0x14, 0x1, 0x24, 0x3}}], 0x18}, 0x0)
executing program 0:
r0 = syz_usb_connect(0x0, 0x32, &(0x7f0000000000)=ANY=[@ANYBLOB="1201000200000040a61b01000100000000010902200001010080320904"], 0x0)
r1 = openat$ptp1(0xffffffffffffff9c, &(0x7f0000000c40), 0x149201, 0x0)
ioctl$PTP_ENABLE_PPS(r1, 0x40043d04, 0x1)
r2 = socket$kcm(0x10, 0x2, 0x4)
r3 = syz_usb_connect$uac3(0x3, 0x80, &(0x7f0000000280)=ANY=[], 0x0)
syz_usb_control_io$printer(r0, 0x0, &(0x7f00000005c0)={0x34, &(0x7f00000003c0)=ANY=[], 0x0, 0x0, 0x0, 0x0, 0x0})
mkdirat(0xffffffffffffff9c, &(0x7f0000000200)='./file0\x00', 0x0)
sendmsg$inet(r2, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)=[{&(0x7f0000000100)="5c00000012006bab9e3fe3d86e6c1d0000147ea60864160af36504b68675f8001d000a00a0e69ee517d34460bc24eab556a705251e6182949a36c23d3b48dfd8cdbf9367b4fa51f60a64c9f4080003680601000008000300ff000000", 0x5c}], 0x1, 0x0, 0x0, 0x1f00c00e}, 0x0) (async)
syz_usb_connect$uac3(0x3, 0x80, &(0x7f0000000280)=ANY=[], 0x0) (async)
syz_usb_control_io$uac3(r3, 0x0, 0x0) (async)
syz_open_dev$dvb_frontend(&(0x7f0000000100), 0x1, 0x802) (async)
getsockopt$bt_hci(0xffffffffffffffff, 0x84, 0x81, &(0x7f0000001280)=""/4107, &(0x7f00000000c0)=0x100b) (async)
executing program 4:
r0 = syz_open_dev$dvb_frontend(&(0x7f0000000080), 0x0, 0x402)
r1 = socket$inet_mptcp(0x2, 0x1, 0x106)
r2 = socket(0x10, 0x803, 0x0)
syz_genetlink_get_family_id$tipc(&(0x7f0000000000), r2)
getsockname$packet(r2, &(0x7f0000000280)={0x11, 0x0, <r3=>0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14)
sendmsg$nl_route(r2, &(0x7f0000000180)={&(0x7f0000000040)={0x10, 0x0, 0x0, 0x400000}, 0xc, &(0x7f0000000140)={&(0x7f0000000100)=@RTM_GETMDB={0x18, 0x56, 0x2, 0x70bd25, 0x25dfdbfe, {0x7, r3}, [""]}, 0x18}}, 0x20000000)
sendmsg$nl_route(r2, &(0x7f0000000240)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000580)=ANY=[@ANYBLOB="4800000010000305ff810000fddbdf2500000000", @ANYRES32=r3, @ANYBLOB="1748000040000200280012800a000100767863616e0000001800028014000100000000", @ANYRES32=r3], 0x48}, 0x1, 0x0, 0x0, 0x40}, 0x0)
connect$inet(r1, &(0x7f0000000000)={0x2, 0x4e22, @empty}, 0x10)
setsockopt$sock_int(r1, 0x1, 0x9, &(0x7f00000003c0)=0x246, 0x4)
ioctl$FE_SET_PROPERTY(r0, 0x40106f52, &(0x7f00000000c0)={0x29, &(0x7f0000000200)=[{0x34, '\x00', @data=0x4}]})
syz_open_dev$dvb_frontend(&(0x7f0000000080), 0x0, 0x402) (async)
socket$inet_mptcp(0x2, 0x1, 0x106) (async)
socket(0x10, 0x803, 0x0) (async)
syz_genetlink_get_family_id$tipc(&(0x7f0000000000), r2) (async)
getsockname$packet(r2, &(0x7f0000000280)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) (async)
sendmsg$nl_route(r2, &(0x7f0000000180)={&(0x7f0000000040)={0x10, 0x0, 0x0, 0x400000}, 0xc, &(0x7f0000000140)={&(0x7f0000000100)=@RTM_GETMDB={0x18, 0x56, 0x2, 0x70bd25, 0x25dfdbfe, {0x7, r3}, [""]}, 0x18}}, 0x20000000) (async)
sendmsg$nl_route(r2, &(0x7f0000000240)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000580)=ANY=[@ANYBLOB="4800000010000305ff810000fddbdf2500000000", @ANYRES32=r3, @ANYBLOB="1748000040000200280012800a000100767863616e0000001800028014000100000000", @ANYRES32=r3], 0x48}, 0x1, 0x0, 0x0, 0x40}, 0x0) (async)
connect$inet(r1, &(0x7f0000000000)={0x2, 0x4e22, @empty}, 0x10) (async)
setsockopt$sock_int(r1, 0x1, 0x9, &(0x7f00000003c0)=0x246, 0x4) (async)
ioctl$FE_SET_PROPERTY(r0, 0x40106f52, &(0x7f00000000c0)={0x29, &(0x7f0000000200)=[{0x34, '\x00', @data=0x4}]}) (async)

program did not crash
testing program (duration=45s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): [19, 12, 20]
detailed listing:
executing program 3:
r0 = socket$inet6_tcp(0xa, 0x1, 0x0)
connect$inet6(r0, 0x0, 0x0)
gettid()
timer_settime(0x0, 0x0, &(0x7f0000000280)={{0x0, 0x989680}, {0x0, 0x989680}}, 0x0)
socketpair$unix(0x1, 0x0, 0x0, 0x0)
getsockopt$sock_cred(0xffffffffffffffff, 0x1, 0x11, 0x0, &(0x7f0000cab000))
setsockopt$sock_cred(0xffffffffffffffff, 0x1, 0x11, 0x0, 0x0)
setsockopt$inet6_tcp_TCP_REPAIR_QUEUE(r0, 0x6, 0x14, 0x0, 0x0)
mmap(&(0x7f0000000000/0x4000)=nil, 0x4000, 0x1, 0x10012, 0xffffffffffffffff, 0x5deba000)
mmap(&(0x7f0000bfe000/0x400000)=nil, 0x400000, 0x4, 0x40010, r0, 0xd1aa000)
mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x3, 0x8031, 0xffffffffffffffff, 0x0)
mmap$dsp(&(0x7f0000ffd000/0x2000)=nil, 0x2000, 0x100000b, 0x810, 0xffffffffffffffff, 0x0)
socket$xdp(0x2c, 0x3, 0x0)
r1 = socket$kcm(0xa, 0x2, 0x0)
r2 = socket(0x2, 0x80805, 0x0)
r3 = openat$fuse(0xffffffffffffff9c, &(0x7f0000000080), 0x2, 0x0)
read$FUSE(r3, &(0x7f0000000600)={0x2020}, 0x2020)
setsockopt$IP_VS_SO_SET_ADD(r2, 0x0, 0x482, &(0x7f0000000240)={0x84, @dev={0xac, 0x14, 0x14, 0x15}, 0x4e20, 0x3, 'wlc\x00', 0x2, 0x660f537e, 0x3}, 0x2c)
sendmsg$sock(r1, &(0x7f0000000400)={&(0x7f0000000580)=@in6={0x2, 0x4e20, 0x0, @dev={0xfe, 0x80, '\x00', 0xfd}}, 0x80, 0x0, 0x0, &(0x7f0000000000)=[@mark={{0x14, 0x1, 0x24, 0x3}}], 0x18}, 0x0)
executing program 0:
r0 = syz_usb_connect(0x0, 0x32, &(0x7f0000000000)=ANY=[@ANYBLOB="1201000200000040a61b01000100000000010902200001010080320904"], 0x0)
r1 = openat$ptp1(0xffffffffffffff9c, &(0x7f0000000c40), 0x149201, 0x0)
ioctl$PTP_ENABLE_PPS(r1, 0x40043d04, 0x1)
sendmsg$inet(0xffffffffffffffff, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)=[{&(0x7f0000000100)="5c00000012006bab9e3fe3d86e6c1d0000147ea60864160af36504b68675f8001d000a00a0e69ee517d34460bc24eab556a705251e6182949a36c23d3b48dfd8cdbf9367b4fa51f60a64c9f4080003680601000008000300ff000000", 0x5c}], 0x1, 0x0, 0x0, 0x1f00c00e}, 0x0)
r2 = syz_usb_connect$uac3(0x3, 0x80, &(0x7f0000000280)=ANY=[], 0x0)
syz_usb_control_io$printer(r0, 0x0, &(0x7f00000005c0)={0x34, &(0x7f00000003c0)=ANY=[], 0x0, 0x0, 0x0, 0x0, 0x0})
mkdirat(0xffffffffffffff9c, &(0x7f0000000200)='./file0\x00', 0x0)
sendmsg$inet(0xffffffffffffffff, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)=[{&(0x7f0000000100)="5c00000012006bab9e3fe3d86e6c1d0000147ea60864160af36504b68675f8001d000a00a0e69ee517d34460bc24eab556a705251e6182949a36c23d3b48dfd8cdbf9367b4fa51f60a64c9f4080003680601000008000300ff000000", 0x5c}], 0x1, 0x0, 0x0, 0x1f00c00e}, 0x0) (async)
syz_usb_connect$uac3(0x3, 0x80, &(0x7f0000000280)=ANY=[], 0x0) (async)
syz_usb_control_io$uac3(r2, 0x0, 0x0) (async)
syz_open_dev$dvb_frontend(&(0x7f0000000100), 0x1, 0x802) (async)
getsockopt$bt_hci(0xffffffffffffffff, 0x84, 0x81, &(0x7f0000001280)=""/4107, &(0x7f00000000c0)=0x100b) (async)
executing program 4:
r0 = syz_open_dev$dvb_frontend(&(0x7f0000000080), 0x0, 0x402)
r1 = socket$inet_mptcp(0x2, 0x1, 0x106)
r2 = socket(0x10, 0x803, 0x0)
syz_genetlink_get_family_id$tipc(&(0x7f0000000000), r2)
getsockname$packet(r2, &(0x7f0000000280)={0x11, 0x0, <r3=>0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14)
sendmsg$nl_route(r2, &(0x7f0000000180)={&(0x7f0000000040)={0x10, 0x0, 0x0, 0x400000}, 0xc, &(0x7f0000000140)={&(0x7f0000000100)=@RTM_GETMDB={0x18, 0x56, 0x2, 0x70bd25, 0x25dfdbfe, {0x7, r3}, [""]}, 0x18}}, 0x20000000)
sendmsg$nl_route(r2, &(0x7f0000000240)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000580)=ANY=[@ANYBLOB="4800000010000305ff810000fddbdf2500000000", @ANYRES32=r3, @ANYBLOB="1748000040000200280012800a000100767863616e0000001800028014000100000000", @ANYRES32=r3], 0x48}, 0x1, 0x0, 0x0, 0x40}, 0x0)
connect$inet(r1, &(0x7f0000000000)={0x2, 0x4e22, @empty}, 0x10)
setsockopt$sock_int(r1, 0x1, 0x9, &(0x7f00000003c0)=0x246, 0x4)
ioctl$FE_SET_PROPERTY(r0, 0x40106f52, &(0x7f00000000c0)={0x29, &(0x7f0000000200)=[{0x34, '\x00', @data=0x4}]})
syz_open_dev$dvb_frontend(&(0x7f0000000080), 0x0, 0x402) (async)
socket$inet_mptcp(0x2, 0x1, 0x106) (async)
socket(0x10, 0x803, 0x0) (async)
syz_genetlink_get_family_id$tipc(&(0x7f0000000000), r2) (async)
getsockname$packet(r2, &(0x7f0000000280)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) (async)
sendmsg$nl_route(r2, &(0x7f0000000180)={&(0x7f0000000040)={0x10, 0x0, 0x0, 0x400000}, 0xc, &(0x7f0000000140)={&(0x7f0000000100)=@RTM_GETMDB={0x18, 0x56, 0x2, 0x70bd25, 0x25dfdbfe, {0x7, r3}, [""]}, 0x18}}, 0x20000000) (async)
sendmsg$nl_route(r2, &(0x7f0000000240)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000580)=ANY=[@ANYBLOB="4800000010000305ff810000fddbdf2500000000", @ANYRES32=r3, @ANYBLOB="1748000040000200280012800a000100767863616e0000001800028014000100000000", @ANYRES32=r3], 0x48}, 0x1, 0x0, 0x0, 0x40}, 0x0) (async)
connect$inet(r1, &(0x7f0000000000)={0x2, 0x4e22, @empty}, 0x10) (async)
setsockopt$sock_int(r1, 0x1, 0x9, &(0x7f00000003c0)=0x246, 0x4) (async)
ioctl$FE_SET_PROPERTY(r0, 0x40106f52, &(0x7f00000000c0)={0x29, &(0x7f0000000200)=[{0x34, '\x00', @data=0x4}]}) (async)

program crashed: KASAN: slab-use-after-free Read in dvb_device_open
testing program (duration=45s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): [19, 11, 20]
detailed listing:
executing program 3:
r0 = socket$inet6_tcp(0xa, 0x1, 0x0)
connect$inet6(r0, 0x0, 0x0)
gettid()
timer_settime(0x0, 0x0, &(0x7f0000000280)={{0x0, 0x989680}, {0x0, 0x989680}}, 0x0)
socketpair$unix(0x1, 0x0, 0x0, 0x0)
getsockopt$sock_cred(0xffffffffffffffff, 0x1, 0x11, 0x0, &(0x7f0000cab000))
setsockopt$sock_cred(0xffffffffffffffff, 0x1, 0x11, 0x0, 0x0)
setsockopt$inet6_tcp_TCP_REPAIR_QUEUE(r0, 0x6, 0x14, 0x0, 0x0)
mmap(&(0x7f0000000000/0x4000)=nil, 0x4000, 0x1, 0x10012, 0xffffffffffffffff, 0x5deba000)
mmap(&(0x7f0000bfe000/0x400000)=nil, 0x400000, 0x4, 0x40010, r0, 0xd1aa000)
mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x3, 0x8031, 0xffffffffffffffff, 0x0)
mmap$dsp(&(0x7f0000ffd000/0x2000)=nil, 0x2000, 0x100000b, 0x810, 0xffffffffffffffff, 0x0)
socket$xdp(0x2c, 0x3, 0x0)
r1 = socket$kcm(0xa, 0x2, 0x0)
r2 = socket(0x2, 0x80805, 0x0)
r3 = openat$fuse(0xffffffffffffff9c, &(0x7f0000000080), 0x2, 0x0)
read$FUSE(r3, &(0x7f0000000600)={0x2020}, 0x2020)
setsockopt$IP_VS_SO_SET_ADD(r2, 0x0, 0x482, &(0x7f0000000240)={0x84, @dev={0xac, 0x14, 0x14, 0x15}, 0x4e20, 0x3, 'wlc\x00', 0x2, 0x660f537e, 0x3}, 0x2c)
sendmsg$sock(r1, &(0x7f0000000400)={&(0x7f0000000580)=@in6={0x2, 0x4e20, 0x0, @dev={0xfe, 0x80, '\x00', 0xfd}}, 0x80, 0x0, 0x0, &(0x7f0000000000)=[@mark={{0x14, 0x1, 0x24, 0x3}}], 0x18}, 0x0)
executing program 0:
r0 = syz_usb_connect(0x0, 0x32, &(0x7f0000000000)=ANY=[@ANYBLOB="1201000200000040a61b01000100000000010902200001010080320904"], 0x0)
openat$ptp1(0xffffffffffffff9c, &(0x7f0000000c40), 0x149201, 0x0)
sendmsg$inet(0xffffffffffffffff, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)=[{&(0x7f0000000100)="5c00000012006bab9e3fe3d86e6c1d0000147ea60864160af36504b68675f8001d000a00a0e69ee517d34460bc24eab556a705251e6182949a36c23d3b48dfd8cdbf9367b4fa51f60a64c9f4080003680601000008000300ff000000", 0x5c}], 0x1, 0x0, 0x0, 0x1f00c00e}, 0x0)
r1 = syz_usb_connect$uac3(0x3, 0x80, &(0x7f0000000280)=ANY=[], 0x0)
syz_usb_control_io$printer(r0, 0x0, &(0x7f00000005c0)={0x34, &(0x7f00000003c0)=ANY=[], 0x0, 0x0, 0x0, 0x0, 0x0})
mkdirat(0xffffffffffffff9c, &(0x7f0000000200)='./file0\x00', 0x0)
sendmsg$inet(0xffffffffffffffff, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)=[{&(0x7f0000000100)="5c00000012006bab9e3fe3d86e6c1d0000147ea60864160af36504b68675f8001d000a00a0e69ee517d34460bc24eab556a705251e6182949a36c23d3b48dfd8cdbf9367b4fa51f60a64c9f4080003680601000008000300ff000000", 0x5c}], 0x1, 0x0, 0x0, 0x1f00c00e}, 0x0) (async)
syz_usb_connect$uac3(0x3, 0x80, &(0x7f0000000280)=ANY=[], 0x0) (async)
syz_usb_control_io$uac3(r1, 0x0, 0x0) (async)
syz_open_dev$dvb_frontend(&(0x7f0000000100), 0x1, 0x802) (async)
getsockopt$bt_hci(0xffffffffffffffff, 0x84, 0x81, &(0x7f0000001280)=""/4107, &(0x7f00000000c0)=0x100b) (async)
executing program 4:
r0 = syz_open_dev$dvb_frontend(&(0x7f0000000080), 0x0, 0x402)
r1 = socket$inet_mptcp(0x2, 0x1, 0x106)
r2 = socket(0x10, 0x803, 0x0)
syz_genetlink_get_family_id$tipc(&(0x7f0000000000), r2)
getsockname$packet(r2, &(0x7f0000000280)={0x11, 0x0, <r3=>0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14)
sendmsg$nl_route(r2, &(0x7f0000000180)={&(0x7f0000000040)={0x10, 0x0, 0x0, 0x400000}, 0xc, &(0x7f0000000140)={&(0x7f0000000100)=@RTM_GETMDB={0x18, 0x56, 0x2, 0x70bd25, 0x25dfdbfe, {0x7, r3}, [""]}, 0x18}}, 0x20000000)
sendmsg$nl_route(r2, &(0x7f0000000240)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000580)=ANY=[@ANYBLOB="4800000010000305ff810000fddbdf2500000000", @ANYRES32=r3, @ANYBLOB="1748000040000200280012800a000100767863616e0000001800028014000100000000", @ANYRES32=r3], 0x48}, 0x1, 0x0, 0x0, 0x40}, 0x0)
connect$inet(r1, &(0x7f0000000000)={0x2, 0x4e22, @empty}, 0x10)
setsockopt$sock_int(r1, 0x1, 0x9, &(0x7f00000003c0)=0x246, 0x4)
ioctl$FE_SET_PROPERTY(r0, 0x40106f52, &(0x7f00000000c0)={0x29, &(0x7f0000000200)=[{0x34, '\x00', @data=0x4}]})
syz_open_dev$dvb_frontend(&(0x7f0000000080), 0x0, 0x402) (async)
socket$inet_mptcp(0x2, 0x1, 0x106) (async)
socket(0x10, 0x803, 0x0) (async)
syz_genetlink_get_family_id$tipc(&(0x7f0000000000), r2) (async)
getsockname$packet(r2, &(0x7f0000000280)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) (async)
sendmsg$nl_route(r2, &(0x7f0000000180)={&(0x7f0000000040)={0x10, 0x0, 0x0, 0x400000}, 0xc, &(0x7f0000000140)={&(0x7f0000000100)=@RTM_GETMDB={0x18, 0x56, 0x2, 0x70bd25, 0x25dfdbfe, {0x7, r3}, [""]}, 0x18}}, 0x20000000) (async)
sendmsg$nl_route(r2, &(0x7f0000000240)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000580)=ANY=[@ANYBLOB="4800000010000305ff810000fddbdf2500000000", @ANYRES32=r3, @ANYBLOB="1748000040000200280012800a000100767863616e0000001800028014000100000000", @ANYRES32=r3], 0x48}, 0x1, 0x0, 0x0, 0x40}, 0x0) (async)
connect$inet(r1, &(0x7f0000000000)={0x2, 0x4e22, @empty}, 0x10) (async)
setsockopt$sock_int(r1, 0x1, 0x9, &(0x7f00000003c0)=0x246, 0x4) (async)
ioctl$FE_SET_PROPERTY(r0, 0x40106f52, &(0x7f00000000c0)={0x29, &(0x7f0000000200)=[{0x34, '\x00', @data=0x4}]}) (async)

program crashed: KASAN: slab-use-after-free Read in dvb_device_open
testing program (duration=45s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): [19, 10, 20]
detailed listing:
executing program 3:
r0 = socket$inet6_tcp(0xa, 0x1, 0x0)
connect$inet6(r0, 0x0, 0x0)
gettid()
timer_settime(0x0, 0x0, &(0x7f0000000280)={{0x0, 0x989680}, {0x0, 0x989680}}, 0x0)
socketpair$unix(0x1, 0x0, 0x0, 0x0)
getsockopt$sock_cred(0xffffffffffffffff, 0x1, 0x11, 0x0, &(0x7f0000cab000))
setsockopt$sock_cred(0xffffffffffffffff, 0x1, 0x11, 0x0, 0x0)
setsockopt$inet6_tcp_TCP_REPAIR_QUEUE(r0, 0x6, 0x14, 0x0, 0x0)
mmap(&(0x7f0000000000/0x4000)=nil, 0x4000, 0x1, 0x10012, 0xffffffffffffffff, 0x5deba000)
mmap(&(0x7f0000bfe000/0x400000)=nil, 0x400000, 0x4, 0x40010, r0, 0xd1aa000)
mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x3, 0x8031, 0xffffffffffffffff, 0x0)
mmap$dsp(&(0x7f0000ffd000/0x2000)=nil, 0x2000, 0x100000b, 0x810, 0xffffffffffffffff, 0x0)
socket$xdp(0x2c, 0x3, 0x0)
r1 = socket$kcm(0xa, 0x2, 0x0)
r2 = socket(0x2, 0x80805, 0x0)
r3 = openat$fuse(0xffffffffffffff9c, &(0x7f0000000080), 0x2, 0x0)
read$FUSE(r3, &(0x7f0000000600)={0x2020}, 0x2020)
setsockopt$IP_VS_SO_SET_ADD(r2, 0x0, 0x482, &(0x7f0000000240)={0x84, @dev={0xac, 0x14, 0x14, 0x15}, 0x4e20, 0x3, 'wlc\x00', 0x2, 0x660f537e, 0x3}, 0x2c)
sendmsg$sock(r1, &(0x7f0000000400)={&(0x7f0000000580)=@in6={0x2, 0x4e20, 0x0, @dev={0xfe, 0x80, '\x00', 0xfd}}, 0x80, 0x0, 0x0, &(0x7f0000000000)=[@mark={{0x14, 0x1, 0x24, 0x3}}], 0x18}, 0x0)
executing program 0:
r0 = syz_usb_connect(0x0, 0x32, &(0x7f0000000000)=ANY=[@ANYBLOB="1201000200000040a61b01000100000000010902200001010080320904"], 0x0)
sendmsg$inet(0xffffffffffffffff, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)=[{&(0x7f0000000100)="5c00000012006bab9e3fe3d86e6c1d0000147ea60864160af36504b68675f8001d000a00a0e69ee517d34460bc24eab556a705251e6182949a36c23d3b48dfd8cdbf9367b4fa51f60a64c9f4080003680601000008000300ff000000", 0x5c}], 0x1, 0x0, 0x0, 0x1f00c00e}, 0x0)
r1 = syz_usb_connect$uac3(0x3, 0x80, &(0x7f0000000280)=ANY=[], 0x0)
syz_usb_control_io$printer(r0, 0x0, &(0x7f00000005c0)={0x34, &(0x7f00000003c0)=ANY=[], 0x0, 0x0, 0x0, 0x0, 0x0})
mkdirat(0xffffffffffffff9c, &(0x7f0000000200)='./file0\x00', 0x0)
sendmsg$inet(0xffffffffffffffff, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)=[{&(0x7f0000000100)="5c00000012006bab9e3fe3d86e6c1d0000147ea60864160af36504b68675f8001d000a00a0e69ee517d34460bc24eab556a705251e6182949a36c23d3b48dfd8cdbf9367b4fa51f60a64c9f4080003680601000008000300ff000000", 0x5c}], 0x1, 0x0, 0x0, 0x1f00c00e}, 0x0) (async)
syz_usb_connect$uac3(0x3, 0x80, &(0x7f0000000280)=ANY=[], 0x0) (async)
syz_usb_control_io$uac3(r1, 0x0, 0x0) (async)
syz_open_dev$dvb_frontend(&(0x7f0000000100), 0x1, 0x802) (async)
getsockopt$bt_hci(0xffffffffffffffff, 0x84, 0x81, &(0x7f0000001280)=""/4107, &(0x7f00000000c0)=0x100b) (async)
executing program 4:
r0 = syz_open_dev$dvb_frontend(&(0x7f0000000080), 0x0, 0x402)
r1 = socket$inet_mptcp(0x2, 0x1, 0x106)
r2 = socket(0x10, 0x803, 0x0)
syz_genetlink_get_family_id$tipc(&(0x7f0000000000), r2)
getsockname$packet(r2, &(0x7f0000000280)={0x11, 0x0, <r3=>0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14)
sendmsg$nl_route(r2, &(0x7f0000000180)={&(0x7f0000000040)={0x10, 0x0, 0x0, 0x400000}, 0xc, &(0x7f0000000140)={&(0x7f0000000100)=@RTM_GETMDB={0x18, 0x56, 0x2, 0x70bd25, 0x25dfdbfe, {0x7, r3}, [""]}, 0x18}}, 0x20000000)
sendmsg$nl_route(r2, &(0x7f0000000240)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000580)=ANY=[@ANYBLOB="4800000010000305ff810000fddbdf2500000000", @ANYRES32=r3, @ANYBLOB="1748000040000200280012800a000100767863616e0000001800028014000100000000", @ANYRES32=r3], 0x48}, 0x1, 0x0, 0x0, 0x40}, 0x0)
connect$inet(r1, &(0x7f0000000000)={0x2, 0x4e22, @empty}, 0x10)
setsockopt$sock_int(r1, 0x1, 0x9, &(0x7f00000003c0)=0x246, 0x4)
ioctl$FE_SET_PROPERTY(r0, 0x40106f52, &(0x7f00000000c0)={0x29, &(0x7f0000000200)=[{0x34, '\x00', @data=0x4}]})
syz_open_dev$dvb_frontend(&(0x7f0000000080), 0x0, 0x402) (async)
socket$inet_mptcp(0x2, 0x1, 0x106) (async)
socket(0x10, 0x803, 0x0) (async)
syz_genetlink_get_family_id$tipc(&(0x7f0000000000), r2) (async)
getsockname$packet(r2, &(0x7f0000000280)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) (async)
sendmsg$nl_route(r2, &(0x7f0000000180)={&(0x7f0000000040)={0x10, 0x0, 0x0, 0x400000}, 0xc, &(0x7f0000000140)={&(0x7f0000000100)=@RTM_GETMDB={0x18, 0x56, 0x2, 0x70bd25, 0x25dfdbfe, {0x7, r3}, [""]}, 0x18}}, 0x20000000) (async)
sendmsg$nl_route(r2, &(0x7f0000000240)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000580)=ANY=[@ANYBLOB="4800000010000305ff810000fddbdf2500000000", @ANYRES32=r3, @ANYBLOB="1748000040000200280012800a000100767863616e0000001800028014000100000000", @ANYRES32=r3], 0x48}, 0x1, 0x0, 0x0, 0x40}, 0x0) (async)
connect$inet(r1, &(0x7f0000000000)={0x2, 0x4e22, @empty}, 0x10) (async)
setsockopt$sock_int(r1, 0x1, 0x9, &(0x7f00000003c0)=0x246, 0x4) (async)
ioctl$FE_SET_PROPERTY(r0, 0x40106f52, &(0x7f00000000c0)={0x29, &(0x7f0000000200)=[{0x34, '\x00', @data=0x4}]}) (async)

program crashed: KASAN: slab-use-after-free Read in dvb_device_open
testing program (duration=45s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): [19, 9, 20]
detailed listing:
executing program 3:
r0 = socket$inet6_tcp(0xa, 0x1, 0x0)
connect$inet6(r0, 0x0, 0x0)
gettid()
timer_settime(0x0, 0x0, &(0x7f0000000280)={{0x0, 0x989680}, {0x0, 0x989680}}, 0x0)
socketpair$unix(0x1, 0x0, 0x0, 0x0)
getsockopt$sock_cred(0xffffffffffffffff, 0x1, 0x11, 0x0, &(0x7f0000cab000))
setsockopt$sock_cred(0xffffffffffffffff, 0x1, 0x11, 0x0, 0x0)
setsockopt$inet6_tcp_TCP_REPAIR_QUEUE(r0, 0x6, 0x14, 0x0, 0x0)
mmap(&(0x7f0000000000/0x4000)=nil, 0x4000, 0x1, 0x10012, 0xffffffffffffffff, 0x5deba000)
mmap(&(0x7f0000bfe000/0x400000)=nil, 0x400000, 0x4, 0x40010, r0, 0xd1aa000)
mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x3, 0x8031, 0xffffffffffffffff, 0x0)
mmap$dsp(&(0x7f0000ffd000/0x2000)=nil, 0x2000, 0x100000b, 0x810, 0xffffffffffffffff, 0x0)
socket$xdp(0x2c, 0x3, 0x0)
r1 = socket$kcm(0xa, 0x2, 0x0)
r2 = socket(0x2, 0x80805, 0x0)
r3 = openat$fuse(0xffffffffffffff9c, &(0x7f0000000080), 0x2, 0x0)
read$FUSE(r3, &(0x7f0000000600)={0x2020}, 0x2020)
setsockopt$IP_VS_SO_SET_ADD(r2, 0x0, 0x482, &(0x7f0000000240)={0x84, @dev={0xac, 0x14, 0x14, 0x15}, 0x4e20, 0x3, 'wlc\x00', 0x2, 0x660f537e, 0x3}, 0x2c)
sendmsg$sock(r1, &(0x7f0000000400)={&(0x7f0000000580)=@in6={0x2, 0x4e20, 0x0, @dev={0xfe, 0x80, '\x00', 0xfd}}, 0x80, 0x0, 0x0, &(0x7f0000000000)=[@mark={{0x14, 0x1, 0x24, 0x3}}], 0x18}, 0x0)
executing program 0:
sendmsg$inet(0xffffffffffffffff, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)=[{&(0x7f0000000100)="5c00000012006bab9e3fe3d86e6c1d0000147ea60864160af36504b68675f8001d000a00a0e69ee517d34460bc24eab556a705251e6182949a36c23d3b48dfd8cdbf9367b4fa51f60a64c9f4080003680601000008000300ff000000", 0x5c}], 0x1, 0x0, 0x0, 0x1f00c00e}, 0x0)
r0 = syz_usb_connect$uac3(0x3, 0x80, &(0x7f0000000280)=ANY=[], 0x0)
syz_usb_control_io$printer(0xffffffffffffffff, 0x0, &(0x7f00000005c0)={0x34, &(0x7f00000003c0)=ANY=[], 0x0, 0x0, 0x0, 0x0, 0x0})
mkdirat(0xffffffffffffff9c, &(0x7f0000000200)='./file0\x00', 0x0)
sendmsg$inet(0xffffffffffffffff, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)=[{&(0x7f0000000100)="5c00000012006bab9e3fe3d86e6c1d0000147ea60864160af36504b68675f8001d000a00a0e69ee517d34460bc24eab556a705251e6182949a36c23d3b48dfd8cdbf9367b4fa51f60a64c9f4080003680601000008000300ff000000", 0x5c}], 0x1, 0x0, 0x0, 0x1f00c00e}, 0x0) (async)
syz_usb_connect$uac3(0x3, 0x80, &(0x7f0000000280)=ANY=[], 0x0) (async)
syz_usb_control_io$uac3(r0, 0x0, 0x0) (async)
syz_open_dev$dvb_frontend(&(0x7f0000000100), 0x1, 0x802) (async)
getsockopt$bt_hci(0xffffffffffffffff, 0x84, 0x81, &(0x7f0000001280)=""/4107, &(0x7f00000000c0)=0x100b) (async)
executing program 4:
r0 = syz_open_dev$dvb_frontend(&(0x7f0000000080), 0x0, 0x402)
r1 = socket$inet_mptcp(0x2, 0x1, 0x106)
r2 = socket(0x10, 0x803, 0x0)
syz_genetlink_get_family_id$tipc(&(0x7f0000000000), r2)
getsockname$packet(r2, &(0x7f0000000280)={0x11, 0x0, <r3=>0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14)
sendmsg$nl_route(r2, &(0x7f0000000180)={&(0x7f0000000040)={0x10, 0x0, 0x0, 0x400000}, 0xc, &(0x7f0000000140)={&(0x7f0000000100)=@RTM_GETMDB={0x18, 0x56, 0x2, 0x70bd25, 0x25dfdbfe, {0x7, r3}, [""]}, 0x18}}, 0x20000000)
sendmsg$nl_route(r2, &(0x7f0000000240)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000580)=ANY=[@ANYBLOB="4800000010000305ff810000fddbdf2500000000", @ANYRES32=r3, @ANYBLOB="1748000040000200280012800a000100767863616e0000001800028014000100000000", @ANYRES32=r3], 0x48}, 0x1, 0x0, 0x0, 0x40}, 0x0)
connect$inet(r1, &(0x7f0000000000)={0x2, 0x4e22, @empty}, 0x10)
setsockopt$sock_int(r1, 0x1, 0x9, &(0x7f00000003c0)=0x246, 0x4)
ioctl$FE_SET_PROPERTY(r0, 0x40106f52, &(0x7f00000000c0)={0x29, &(0x7f0000000200)=[{0x34, '\x00', @data=0x4}]})
syz_open_dev$dvb_frontend(&(0x7f0000000080), 0x0, 0x402) (async)
socket$inet_mptcp(0x2, 0x1, 0x106) (async)
socket(0x10, 0x803, 0x0) (async)
syz_genetlink_get_family_id$tipc(&(0x7f0000000000), r2) (async)
getsockname$packet(r2, &(0x7f0000000280)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) (async)
sendmsg$nl_route(r2, &(0x7f0000000180)={&(0x7f0000000040)={0x10, 0x0, 0x0, 0x400000}, 0xc, &(0x7f0000000140)={&(0x7f0000000100)=@RTM_GETMDB={0x18, 0x56, 0x2, 0x70bd25, 0x25dfdbfe, {0x7, r3}, [""]}, 0x18}}, 0x20000000) (async)
sendmsg$nl_route(r2, &(0x7f0000000240)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000580)=ANY=[@ANYBLOB="4800000010000305ff810000fddbdf2500000000", @ANYRES32=r3, @ANYBLOB="1748000040000200280012800a000100767863616e0000001800028014000100000000", @ANYRES32=r3], 0x48}, 0x1, 0x0, 0x0, 0x40}, 0x0) (async)
connect$inet(r1, &(0x7f0000000000)={0x2, 0x4e22, @empty}, 0x10) (async)
setsockopt$sock_int(r1, 0x1, 0x9, &(0x7f00000003c0)=0x246, 0x4) (async)
ioctl$FE_SET_PROPERTY(r0, 0x40106f52, &(0x7f00000000c0)={0x29, &(0x7f0000000200)=[{0x34, '\x00', @data=0x4}]}) (async)

program did not crash
minimized 36 calls -> 10 calls
minimizing program #2 before concatenation
testing program (duration=45s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): [19, 10, 19]
detailed listing:
executing program 3:
r0 = socket$inet6_tcp(0xa, 0x1, 0x0)
connect$inet6(r0, 0x0, 0x0)
gettid()
timer_settime(0x0, 0x0, &(0x7f0000000280)={{0x0, 0x989680}, {0x0, 0x989680}}, 0x0)
socketpair$unix(0x1, 0x0, 0x0, 0x0)
getsockopt$sock_cred(0xffffffffffffffff, 0x1, 0x11, 0x0, &(0x7f0000cab000))
setsockopt$sock_cred(0xffffffffffffffff, 0x1, 0x11, 0x0, 0x0)
setsockopt$inet6_tcp_TCP_REPAIR_QUEUE(r0, 0x6, 0x14, 0x0, 0x0)
mmap(&(0x7f0000000000/0x4000)=nil, 0x4000, 0x1, 0x10012, 0xffffffffffffffff, 0x5deba000)
mmap(&(0x7f0000bfe000/0x400000)=nil, 0x400000, 0x4, 0x40010, r0, 0xd1aa000)
mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x3, 0x8031, 0xffffffffffffffff, 0x0)
mmap$dsp(&(0x7f0000ffd000/0x2000)=nil, 0x2000, 0x100000b, 0x810, 0xffffffffffffffff, 0x0)
socket$xdp(0x2c, 0x3, 0x0)
r1 = socket$kcm(0xa, 0x2, 0x0)
r2 = socket(0x2, 0x80805, 0x0)
r3 = openat$fuse(0xffffffffffffff9c, &(0x7f0000000080), 0x2, 0x0)
read$FUSE(r3, &(0x7f0000000600)={0x2020}, 0x2020)
setsockopt$IP_VS_SO_SET_ADD(r2, 0x0, 0x482, &(0x7f0000000240)={0x84, @dev={0xac, 0x14, 0x14, 0x15}, 0x4e20, 0x3, 'wlc\x00', 0x2, 0x660f537e, 0x3}, 0x2c)
sendmsg$sock(r1, &(0x7f0000000400)={&(0x7f0000000580)=@in6={0x2, 0x4e20, 0x0, @dev={0xfe, 0x80, '\x00', 0xfd}}, 0x80, 0x0, 0x0, &(0x7f0000000000)=[@mark={{0x14, 0x1, 0x24, 0x3}}], 0x18}, 0x0)
executing program 3:
r0 = syz_usb_connect(0x0, 0x32, &(0x7f0000000000)=ANY=[@ANYBLOB="1201000200000040a61b01000100000000010902200001010080320904"], 0x0)
sendmsg$inet(0xffffffffffffffff, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)=[{&(0x7f0000000100)="5c00000012006bab9e3fe3d86e6c1d0000147ea60864160af36504b68675f8001d000a00a0e69ee517d34460bc24eab556a705251e6182949a36c23d3b48dfd8cdbf9367b4fa51f60a64c9f4080003680601000008000300ff000000", 0x5c}], 0x1, 0x0, 0x0, 0x1f00c00e}, 0x0)
r1 = syz_usb_connect$uac3(0x3, 0x80, &(0x7f0000000280)=ANY=[], 0x0)
syz_usb_control_io$printer(r0, 0x0, &(0x7f00000005c0)={0x34, &(0x7f00000003c0)=ANY=[], 0x0, 0x0, 0x0, 0x0, 0x0})
mkdirat(0xffffffffffffff9c, &(0x7f0000000200)='./file0\x00', 0x0)
sendmsg$inet(0xffffffffffffffff, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)=[{&(0x7f0000000100)="5c00000012006bab9e3fe3d86e6c1d0000147ea60864160af36504b68675f8001d000a00a0e69ee517d34460bc24eab556a705251e6182949a36c23d3b48dfd8cdbf9367b4fa51f60a64c9f4080003680601000008000300ff000000", 0x5c}], 0x1, 0x0, 0x0, 0x1f00c00e}, 0x0) (async)
syz_usb_connect$uac3(0x3, 0x80, &(0x7f0000000280)=ANY=[], 0x0) (async)
syz_usb_control_io$uac3(r1, 0x0, 0x0) (async)
syz_open_dev$dvb_frontend(&(0x7f0000000100), 0x1, 0x802) (async)
getsockopt$bt_hci(0xffffffffffffffff, 0x84, 0x81, &(0x7f0000001280)=""/4107, &(0x7f00000000c0)=0x100b) (async)
executing program 0:
r0 = syz_open_dev$dvb_frontend(&(0x7f0000000080), 0x0, 0x402)
r1 = socket$inet_mptcp(0x2, 0x1, 0x106)
r2 = socket(0x10, 0x803, 0x0)
syz_genetlink_get_family_id$tipc(&(0x7f0000000000), r2)
getsockname$packet(r2, &(0x7f0000000280)={0x11, 0x0, <r3=>0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14)
sendmsg$nl_route(r2, &(0x7f0000000180)={&(0x7f0000000040)={0x10, 0x0, 0x0, 0x400000}, 0xc, &(0x7f0000000140)={&(0x7f0000000100)=@RTM_GETMDB={0x18, 0x56, 0x2, 0x70bd25, 0x25dfdbfe, {0x7, r3}, [""]}, 0x18}}, 0x20000000)
sendmsg$nl_route(r2, &(0x7f0000000240)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000580)=ANY=[@ANYBLOB="4800000010000305ff810000fddbdf2500000000", @ANYRES32=r3, @ANYBLOB="1748000040000200280012800a000100767863616e0000001800028014000100000000", @ANYRES32=r3], 0x48}, 0x1, 0x0, 0x0, 0x40}, 0x0)
connect$inet(r1, &(0x7f0000000000)={0x2, 0x4e22, @empty}, 0x10)
setsockopt$sock_int(r1, 0x1, 0x9, &(0x7f00000003c0)=0x246, 0x4)
ioctl$FE_SET_PROPERTY(r0, 0x40106f52, &(0x7f00000000c0)={0x29, &(0x7f0000000200)=[{0x34, '\x00', @data=0x4}]})
syz_open_dev$dvb_frontend(&(0x7f0000000080), 0x0, 0x402) (async)
socket$inet_mptcp(0x2, 0x1, 0x106) (async)
socket(0x10, 0x803, 0x0) (async)
syz_genetlink_get_family_id$tipc(&(0x7f0000000000), r2) (async)
getsockname$packet(r2, &(0x7f0000000280)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) (async)
sendmsg$nl_route(r2, &(0x7f0000000180)={&(0x7f0000000040)={0x10, 0x0, 0x0, 0x400000}, 0xc, &(0x7f0000000140)={&(0x7f0000000100)=@RTM_GETMDB={0x18, 0x56, 0x2, 0x70bd25, 0x25dfdbfe, {0x7, r3}, [""]}, 0x18}}, 0x20000000) (async)
sendmsg$nl_route(r2, &(0x7f0000000240)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000580)=ANY=[@ANYBLOB="4800000010000305ff810000fddbdf2500000000", @ANYRES32=r3, @ANYBLOB="1748000040000200280012800a000100767863616e0000001800028014000100000000", @ANYRES32=r3], 0x48}, 0x1, 0x0, 0x0, 0x40}, 0x0) (async)
connect$inet(r1, &(0x7f0000000000)={0x2, 0x4e22, @empty}, 0x10) (async)
setsockopt$sock_int(r1, 0x1, 0x9, &(0x7f00000003c0)=0x246, 0x4) (async)

program crashed: KASAN: slab-use-after-free Read in dvb_device_open
testing program (duration=45s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): [19, 10, 18]
detailed listing:
executing program 3:
r0 = socket$inet6_tcp(0xa, 0x1, 0x0)
connect$inet6(r0, 0x0, 0x0)
gettid()
timer_settime(0x0, 0x0, &(0x7f0000000280)={{0x0, 0x989680}, {0x0, 0x989680}}, 0x0)
socketpair$unix(0x1, 0x0, 0x0, 0x0)
getsockopt$sock_cred(0xffffffffffffffff, 0x1, 0x11, 0x0, &(0x7f0000cab000))
setsockopt$sock_cred(0xffffffffffffffff, 0x1, 0x11, 0x0, 0x0)
setsockopt$inet6_tcp_TCP_REPAIR_QUEUE(r0, 0x6, 0x14, 0x0, 0x0)
mmap(&(0x7f0000000000/0x4000)=nil, 0x4000, 0x1, 0x10012, 0xffffffffffffffff, 0x5deba000)
mmap(&(0x7f0000bfe000/0x400000)=nil, 0x400000, 0x4, 0x40010, r0, 0xd1aa000)
mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x3, 0x8031, 0xffffffffffffffff, 0x0)
mmap$dsp(&(0x7f0000ffd000/0x2000)=nil, 0x2000, 0x100000b, 0x810, 0xffffffffffffffff, 0x0)
socket$xdp(0x2c, 0x3, 0x0)
r1 = socket$kcm(0xa, 0x2, 0x0)
r2 = socket(0x2, 0x80805, 0x0)
r3 = openat$fuse(0xffffffffffffff9c, &(0x7f0000000080), 0x2, 0x0)
read$FUSE(r3, &(0x7f0000000600)={0x2020}, 0x2020)
setsockopt$IP_VS_SO_SET_ADD(r2, 0x0, 0x482, &(0x7f0000000240)={0x84, @dev={0xac, 0x14, 0x14, 0x15}, 0x4e20, 0x3, 'wlc\x00', 0x2, 0x660f537e, 0x3}, 0x2c)
sendmsg$sock(r1, &(0x7f0000000400)={&(0x7f0000000580)=@in6={0x2, 0x4e20, 0x0, @dev={0xfe, 0x80, '\x00', 0xfd}}, 0x80, 0x0, 0x0, &(0x7f0000000000)=[@mark={{0x14, 0x1, 0x24, 0x3}}], 0x18}, 0x0)
executing program 3:
r0 = syz_usb_connect(0x0, 0x32, &(0x7f0000000000)=ANY=[@ANYBLOB="1201000200000040a61b01000100000000010902200001010080320904"], 0x0)
sendmsg$inet(0xffffffffffffffff, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)=[{&(0x7f0000000100)="5c00000012006bab9e3fe3d86e6c1d0000147ea60864160af36504b68675f8001d000a00a0e69ee517d34460bc24eab556a705251e6182949a36c23d3b48dfd8cdbf9367b4fa51f60a64c9f4080003680601000008000300ff000000", 0x5c}], 0x1, 0x0, 0x0, 0x1f00c00e}, 0x0)
r1 = syz_usb_connect$uac3(0x3, 0x80, &(0x7f0000000280)=ANY=[], 0x0)
syz_usb_control_io$printer(r0, 0x0, &(0x7f00000005c0)={0x34, &(0x7f00000003c0)=ANY=[], 0x0, 0x0, 0x0, 0x0, 0x0})
mkdirat(0xffffffffffffff9c, &(0x7f0000000200)='./file0\x00', 0x0)
sendmsg$inet(0xffffffffffffffff, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)=[{&(0x7f0000000100)="5c00000012006bab9e3fe3d86e6c1d0000147ea60864160af36504b68675f8001d000a00a0e69ee517d34460bc24eab556a705251e6182949a36c23d3b48dfd8cdbf9367b4fa51f60a64c9f4080003680601000008000300ff000000", 0x5c}], 0x1, 0x0, 0x0, 0x1f00c00e}, 0x0) (async)
syz_usb_connect$uac3(0x3, 0x80, &(0x7f0000000280)=ANY=[], 0x0) (async)
syz_usb_control_io$uac3(r1, 0x0, 0x0) (async)
syz_open_dev$dvb_frontend(&(0x7f0000000100), 0x1, 0x802) (async)
getsockopt$bt_hci(0xffffffffffffffff, 0x84, 0x81, &(0x7f0000001280)=""/4107, &(0x7f00000000c0)=0x100b) (async)
executing program 0:
r0 = syz_open_dev$dvb_frontend(&(0x7f0000000080), 0x0, 0x402)
r1 = socket$inet_mptcp(0x2, 0x1, 0x106)
r2 = socket(0x10, 0x803, 0x0)
syz_genetlink_get_family_id$tipc(&(0x7f0000000000), r2)
getsockname$packet(r2, &(0x7f0000000280)={0x11, 0x0, <r3=>0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14)
sendmsg$nl_route(r2, &(0x7f0000000180)={&(0x7f0000000040)={0x10, 0x0, 0x0, 0x400000}, 0xc, &(0x7f0000000140)={&(0x7f0000000100)=@RTM_GETMDB={0x18, 0x56, 0x2, 0x70bd25, 0x25dfdbfe, {0x7, r3}, [""]}, 0x18}}, 0x20000000)
sendmsg$nl_route(r2, &(0x7f0000000240)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000580)=ANY=[@ANYBLOB="4800000010000305ff810000fddbdf2500000000", @ANYRES32=r3, @ANYBLOB="1748000040000200280012800a000100767863616e0000001800028014000100000000", @ANYRES32=r3], 0x48}, 0x1, 0x0, 0x0, 0x40}, 0x0)
connect$inet(r1, &(0x7f0000000000)={0x2, 0x4e22, @empty}, 0x10)
setsockopt$sock_int(r1, 0x1, 0x9, &(0x7f00000003c0)=0x246, 0x4)
ioctl$FE_SET_PROPERTY(r0, 0x40106f52, &(0x7f00000000c0)={0x29, &(0x7f0000000200)=[{0x34, '\x00', @data=0x4}]})
syz_open_dev$dvb_frontend(&(0x7f0000000080), 0x0, 0x402) (async)
socket$inet_mptcp(0x2, 0x1, 0x106) (async)
socket(0x10, 0x803, 0x0) (async)
syz_genetlink_get_family_id$tipc(&(0x7f0000000000), r2) (async)
getsockname$packet(r2, &(0x7f0000000280)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) (async)
sendmsg$nl_route(r2, &(0x7f0000000180)={&(0x7f0000000040)={0x10, 0x0, 0x0, 0x400000}, 0xc, &(0x7f0000000140)={&(0x7f0000000100)=@RTM_GETMDB={0x18, 0x56, 0x2, 0x70bd25, 0x25dfdbfe, {0x7, r3}, [""]}, 0x18}}, 0x20000000) (async)
sendmsg$nl_route(r2, &(0x7f0000000240)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000580)=ANY=[@ANYBLOB="4800000010000305ff810000fddbdf2500000000", @ANYRES32=r3, @ANYBLOB="1748000040000200280012800a000100767863616e0000001800028014000100000000", @ANYRES32=r3], 0x48}, 0x1, 0x0, 0x0, 0x40}, 0x0) (async)
connect$inet(r1, &(0x7f0000000000)={0x2, 0x4e22, @empty}, 0x10) (async)

program crashed: KASAN: slab-use-after-free Write in dvb_device_put
testing program (duration=45s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): [19, 10, 17]
detailed listing:
executing program 3:
r0 = socket$inet6_tcp(0xa, 0x1, 0x0)
connect$inet6(r0, 0x0, 0x0)
gettid()
timer_settime(0x0, 0x0, &(0x7f0000000280)={{0x0, 0x989680}, {0x0, 0x989680}}, 0x0)
socketpair$unix(0x1, 0x0, 0x0, 0x0)
getsockopt$sock_cred(0xffffffffffffffff, 0x1, 0x11, 0x0, &(0x7f0000cab000))
setsockopt$sock_cred(0xffffffffffffffff, 0x1, 0x11, 0x0, 0x0)
setsockopt$inet6_tcp_TCP_REPAIR_QUEUE(r0, 0x6, 0x14, 0x0, 0x0)
mmap(&(0x7f0000000000/0x4000)=nil, 0x4000, 0x1, 0x10012, 0xffffffffffffffff, 0x5deba000)
mmap(&(0x7f0000bfe000/0x400000)=nil, 0x400000, 0x4, 0x40010, r0, 0xd1aa000)
mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x3, 0x8031, 0xffffffffffffffff, 0x0)
mmap$dsp(&(0x7f0000ffd000/0x2000)=nil, 0x2000, 0x100000b, 0x810, 0xffffffffffffffff, 0x0)
socket$xdp(0x2c, 0x3, 0x0)
r1 = socket$kcm(0xa, 0x2, 0x0)
r2 = socket(0x2, 0x80805, 0x0)
r3 = openat$fuse(0xffffffffffffff9c, &(0x7f0000000080), 0x2, 0x0)
read$FUSE(r3, &(0x7f0000000600)={0x2020}, 0x2020)
setsockopt$IP_VS_SO_SET_ADD(r2, 0x0, 0x482, &(0x7f0000000240)={0x84, @dev={0xac, 0x14, 0x14, 0x15}, 0x4e20, 0x3, 'wlc\x00', 0x2, 0x660f537e, 0x3}, 0x2c)
sendmsg$sock(r1, &(0x7f0000000400)={&(0x7f0000000580)=@in6={0x2, 0x4e20, 0x0, @dev={0xfe, 0x80, '\x00', 0xfd}}, 0x80, 0x0, 0x0, &(0x7f0000000000)=[@mark={{0x14, 0x1, 0x24, 0x3}}], 0x18}, 0x0)
executing program 3:
r0 = syz_usb_connect(0x0, 0x32, &(0x7f0000000000)=ANY=[@ANYBLOB="1201000200000040a61b01000100000000010902200001010080320904"], 0x0)
sendmsg$inet(0xffffffffffffffff, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)=[{&(0x7f0000000100)="5c00000012006bab9e3fe3d86e6c1d0000147ea60864160af36504b68675f8001d000a00a0e69ee517d34460bc24eab556a705251e6182949a36c23d3b48dfd8cdbf9367b4fa51f60a64c9f4080003680601000008000300ff000000", 0x5c}], 0x1, 0x0, 0x0, 0x1f00c00e}, 0x0)
r1 = syz_usb_connect$uac3(0x3, 0x80, &(0x7f0000000280)=ANY=[], 0x0)
syz_usb_control_io$printer(r0, 0x0, &(0x7f00000005c0)={0x34, &(0x7f00000003c0)=ANY=[], 0x0, 0x0, 0x0, 0x0, 0x0})
mkdirat(0xffffffffffffff9c, &(0x7f0000000200)='./file0\x00', 0x0)
sendmsg$inet(0xffffffffffffffff, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)=[{&(0x7f0000000100)="5c00000012006bab9e3fe3d86e6c1d0000147ea60864160af36504b68675f8001d000a00a0e69ee517d34460bc24eab556a705251e6182949a36c23d3b48dfd8cdbf9367b4fa51f60a64c9f4080003680601000008000300ff000000", 0x5c}], 0x1, 0x0, 0x0, 0x1f00c00e}, 0x0) (async)
syz_usb_connect$uac3(0x3, 0x80, &(0x7f0000000280)=ANY=[], 0x0) (async)
syz_usb_control_io$uac3(r1, 0x0, 0x0) (async)
syz_open_dev$dvb_frontend(&(0x7f0000000100), 0x1, 0x802) (async)
getsockopt$bt_hci(0xffffffffffffffff, 0x84, 0x81, &(0x7f0000001280)=""/4107, &(0x7f00000000c0)=0x100b) (async)
executing program 0:
r0 = syz_open_dev$dvb_frontend(&(0x7f0000000080), 0x0, 0x402)
r1 = socket$inet_mptcp(0x2, 0x1, 0x106)
r2 = socket(0x10, 0x803, 0x0)
syz_genetlink_get_family_id$tipc(&(0x7f0000000000), r2)
getsockname$packet(r2, &(0x7f0000000280)={0x11, 0x0, <r3=>0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14)
sendmsg$nl_route(r2, &(0x7f0000000180)={&(0x7f0000000040)={0x10, 0x0, 0x0, 0x400000}, 0xc, &(0x7f0000000140)={&(0x7f0000000100)=@RTM_GETMDB={0x18, 0x56, 0x2, 0x70bd25, 0x25dfdbfe, {0x7, r3}, [""]}, 0x18}}, 0x20000000)
sendmsg$nl_route(r2, &(0x7f0000000240)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000580)=ANY=[@ANYBLOB="4800000010000305ff810000fddbdf2500000000", @ANYRES32=r3, @ANYBLOB="1748000040000200280012800a000100767863616e0000001800028014000100000000", @ANYRES32=r3], 0x48}, 0x1, 0x0, 0x0, 0x40}, 0x0)
connect$inet(r1, &(0x7f0000000000)={0x2, 0x4e22, @empty}, 0x10)
setsockopt$sock_int(r1, 0x1, 0x9, &(0x7f00000003c0)=0x246, 0x4)
ioctl$FE_SET_PROPERTY(r0, 0x40106f52, &(0x7f00000000c0)={0x29, &(0x7f0000000200)=[{0x34, '\x00', @data=0x4}]})
syz_open_dev$dvb_frontend(&(0x7f0000000080), 0x0, 0x402) (async)
socket$inet_mptcp(0x2, 0x1, 0x106) (async)
socket(0x10, 0x803, 0x0) (async)
syz_genetlink_get_family_id$tipc(&(0x7f0000000000), r2) (async)
getsockname$packet(r2, &(0x7f0000000280)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) (async)
sendmsg$nl_route(r2, &(0x7f0000000180)={&(0x7f0000000040)={0x10, 0x0, 0x0, 0x400000}, 0xc, &(0x7f0000000140)={&(0x7f0000000100)=@RTM_GETMDB={0x18, 0x56, 0x2, 0x70bd25, 0x25dfdbfe, {0x7, r3}, [""]}, 0x18}}, 0x20000000) (async)
sendmsg$nl_route(r2, &(0x7f0000000240)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000580)=ANY=[@ANYBLOB="4800000010000305ff810000fddbdf2500000000", @ANYRES32=r3, @ANYBLOB="1748000040000200280012800a000100767863616e0000001800028014000100000000", @ANYRES32=r3], 0x48}, 0x1, 0x0, 0x0, 0x40}, 0x0) (async)

program crashed: KASAN: slab-use-after-free Read in dvb_device_open
testing program (duration=45s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): [19, 10, 16]
detailed listing:
executing program 3:
r0 = socket$inet6_tcp(0xa, 0x1, 0x0)
connect$inet6(r0, 0x0, 0x0)
gettid()
timer_settime(0x0, 0x0, &(0x7f0000000280)={{0x0, 0x989680}, {0x0, 0x989680}}, 0x0)
socketpair$unix(0x1, 0x0, 0x0, 0x0)
getsockopt$sock_cred(0xffffffffffffffff, 0x1, 0x11, 0x0, &(0x7f0000cab000))
setsockopt$sock_cred(0xffffffffffffffff, 0x1, 0x11, 0x0, 0x0)
setsockopt$inet6_tcp_TCP_REPAIR_QUEUE(r0, 0x6, 0x14, 0x0, 0x0)
mmap(&(0x7f0000000000/0x4000)=nil, 0x4000, 0x1, 0x10012, 0xffffffffffffffff, 0x5deba000)
mmap(&(0x7f0000bfe000/0x400000)=nil, 0x400000, 0x4, 0x40010, r0, 0xd1aa000)
mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x3, 0x8031, 0xffffffffffffffff, 0x0)
mmap$dsp(&(0x7f0000ffd000/0x2000)=nil, 0x2000, 0x100000b, 0x810, 0xffffffffffffffff, 0x0)
socket$xdp(0x2c, 0x3, 0x0)
r1 = socket$kcm(0xa, 0x2, 0x0)
r2 = socket(0x2, 0x80805, 0x0)
r3 = openat$fuse(0xffffffffffffff9c, &(0x7f0000000080), 0x2, 0x0)
read$FUSE(r3, &(0x7f0000000600)={0x2020}, 0x2020)
setsockopt$IP_VS_SO_SET_ADD(r2, 0x0, 0x482, &(0x7f0000000240)={0x84, @dev={0xac, 0x14, 0x14, 0x15}, 0x4e20, 0x3, 'wlc\x00', 0x2, 0x660f537e, 0x3}, 0x2c)
sendmsg$sock(r1, &(0x7f0000000400)={&(0x7f0000000580)=@in6={0x2, 0x4e20, 0x0, @dev={0xfe, 0x80, '\x00', 0xfd}}, 0x80, 0x0, 0x0, &(0x7f0000000000)=[@mark={{0x14, 0x1, 0x24, 0x3}}], 0x18}, 0x0)
executing program 3:
r0 = syz_usb_connect(0x0, 0x32, &(0x7f0000000000)=ANY=[@ANYBLOB="1201000200000040a61b01000100000000010902200001010080320904"], 0x0)
sendmsg$inet(0xffffffffffffffff, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)=[{&(0x7f0000000100)="5c00000012006bab9e3fe3d86e6c1d0000147ea60864160af36504b68675f8001d000a00a0e69ee517d34460bc24eab556a705251e6182949a36c23d3b48dfd8cdbf9367b4fa51f60a64c9f4080003680601000008000300ff000000", 0x5c}], 0x1, 0x0, 0x0, 0x1f00c00e}, 0x0)
r1 = syz_usb_connect$uac3(0x3, 0x80, &(0x7f0000000280)=ANY=[], 0x0)
syz_usb_control_io$printer(r0, 0x0, &(0x7f00000005c0)={0x34, &(0x7f00000003c0)=ANY=[], 0x0, 0x0, 0x0, 0x0, 0x0})
mkdirat(0xffffffffffffff9c, &(0x7f0000000200)='./file0\x00', 0x0)
sendmsg$inet(0xffffffffffffffff, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)=[{&(0x7f0000000100)="5c00000012006bab9e3fe3d86e6c1d0000147ea60864160af36504b68675f8001d000a00a0e69ee517d34460bc24eab556a705251e6182949a36c23d3b48dfd8cdbf9367b4fa51f60a64c9f4080003680601000008000300ff000000", 0x5c}], 0x1, 0x0, 0x0, 0x1f00c00e}, 0x0) (async)
syz_usb_connect$uac3(0x3, 0x80, &(0x7f0000000280)=ANY=[], 0x0) (async)
syz_usb_control_io$uac3(r1, 0x0, 0x0) (async)
syz_open_dev$dvb_frontend(&(0x7f0000000100), 0x1, 0x802) (async)
getsockopt$bt_hci(0xffffffffffffffff, 0x84, 0x81, &(0x7f0000001280)=""/4107, &(0x7f00000000c0)=0x100b) (async)
executing program 0:
r0 = syz_open_dev$dvb_frontend(&(0x7f0000000080), 0x0, 0x402)
r1 = socket$inet_mptcp(0x2, 0x1, 0x106)
r2 = socket(0x10, 0x803, 0x0)
syz_genetlink_get_family_id$tipc(&(0x7f0000000000), r2)
getsockname$packet(r2, &(0x7f0000000280)={0x11, 0x0, <r3=>0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14)
sendmsg$nl_route(r2, &(0x7f0000000180)={&(0x7f0000000040)={0x10, 0x0, 0x0, 0x400000}, 0xc, &(0x7f0000000140)={&(0x7f0000000100)=@RTM_GETMDB={0x18, 0x56, 0x2, 0x70bd25, 0x25dfdbfe, {0x7, r3}, [""]}, 0x18}}, 0x20000000)
sendmsg$nl_route(r2, &(0x7f0000000240)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000580)=ANY=[@ANYBLOB="4800000010000305ff810000fddbdf2500000000", @ANYRES32=r3, @ANYBLOB="1748000040000200280012800a000100767863616e0000001800028014000100000000", @ANYRES32=r3], 0x48}, 0x1, 0x0, 0x0, 0x40}, 0x0)
connect$inet(r1, &(0x7f0000000000)={0x2, 0x4e22, @empty}, 0x10)
setsockopt$sock_int(r1, 0x1, 0x9, &(0x7f00000003c0)=0x246, 0x4)
ioctl$FE_SET_PROPERTY(r0, 0x40106f52, &(0x7f00000000c0)={0x29, &(0x7f0000000200)=[{0x34, '\x00', @data=0x4}]})
syz_open_dev$dvb_frontend(&(0x7f0000000080), 0x0, 0x402) (async)
socket$inet_mptcp(0x2, 0x1, 0x106) (async)
socket(0x10, 0x803, 0x0) (async)
syz_genetlink_get_family_id$tipc(&(0x7f0000000000), r2) (async)
getsockname$packet(r2, &(0x7f0000000280)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) (async)
sendmsg$nl_route(r2, &(0x7f0000000180)={&(0x7f0000000040)={0x10, 0x0, 0x0, 0x400000}, 0xc, &(0x7f0000000140)={&(0x7f0000000100)=@RTM_GETMDB={0x18, 0x56, 0x2, 0x70bd25, 0x25dfdbfe, {0x7, r3}, [""]}, 0x18}}, 0x20000000) (async)

program did not crash
testing program (duration=45s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): [19, 10, 16]
detailed listing:
executing program 3:
r0 = socket$inet6_tcp(0xa, 0x1, 0x0)
connect$inet6(r0, 0x0, 0x0)
gettid()
timer_settime(0x0, 0x0, &(0x7f0000000280)={{0x0, 0x989680}, {0x0, 0x989680}}, 0x0)
socketpair$unix(0x1, 0x0, 0x0, 0x0)
getsockopt$sock_cred(0xffffffffffffffff, 0x1, 0x11, 0x0, &(0x7f0000cab000))
setsockopt$sock_cred(0xffffffffffffffff, 0x1, 0x11, 0x0, 0x0)
setsockopt$inet6_tcp_TCP_REPAIR_QUEUE(r0, 0x6, 0x14, 0x0, 0x0)
mmap(&(0x7f0000000000/0x4000)=nil, 0x4000, 0x1, 0x10012, 0xffffffffffffffff, 0x5deba000)
mmap(&(0x7f0000bfe000/0x400000)=nil, 0x400000, 0x4, 0x40010, r0, 0xd1aa000)
mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x3, 0x8031, 0xffffffffffffffff, 0x0)
mmap$dsp(&(0x7f0000ffd000/0x2000)=nil, 0x2000, 0x100000b, 0x810, 0xffffffffffffffff, 0x0)
socket$xdp(0x2c, 0x3, 0x0)
r1 = socket$kcm(0xa, 0x2, 0x0)
r2 = socket(0x2, 0x80805, 0x0)
r3 = openat$fuse(0xffffffffffffff9c, &(0x7f0000000080), 0x2, 0x0)
read$FUSE(r3, &(0x7f0000000600)={0x2020}, 0x2020)
setsockopt$IP_VS_SO_SET_ADD(r2, 0x0, 0x482, &(0x7f0000000240)={0x84, @dev={0xac, 0x14, 0x14, 0x15}, 0x4e20, 0x3, 'wlc\x00', 0x2, 0x660f537e, 0x3}, 0x2c)
sendmsg$sock(r1, &(0x7f0000000400)={&(0x7f0000000580)=@in6={0x2, 0x4e20, 0x0, @dev={0xfe, 0x80, '\x00', 0xfd}}, 0x80, 0x0, 0x0, &(0x7f0000000000)=[@mark={{0x14, 0x1, 0x24, 0x3}}], 0x18}, 0x0)
executing program 3:
r0 = syz_usb_connect(0x0, 0x32, &(0x7f0000000000)=ANY=[@ANYBLOB="1201000200000040a61b01000100000000010902200001010080320904"], 0x0)
sendmsg$inet(0xffffffffffffffff, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)=[{&(0x7f0000000100)="5c00000012006bab9e3fe3d86e6c1d0000147ea60864160af36504b68675f8001d000a00a0e69ee517d34460bc24eab556a705251e6182949a36c23d3b48dfd8cdbf9367b4fa51f60a64c9f4080003680601000008000300ff000000", 0x5c}], 0x1, 0x0, 0x0, 0x1f00c00e}, 0x0)
r1 = syz_usb_connect$uac3(0x3, 0x80, &(0x7f0000000280)=ANY=[], 0x0)
syz_usb_control_io$printer(r0, 0x0, &(0x7f00000005c0)={0x34, &(0x7f00000003c0)=ANY=[], 0x0, 0x0, 0x0, 0x0, 0x0})
mkdirat(0xffffffffffffff9c, &(0x7f0000000200)='./file0\x00', 0x0)
sendmsg$inet(0xffffffffffffffff, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)=[{&(0x7f0000000100)="5c00000012006bab9e3fe3d86e6c1d0000147ea60864160af36504b68675f8001d000a00a0e69ee517d34460bc24eab556a705251e6182949a36c23d3b48dfd8cdbf9367b4fa51f60a64c9f4080003680601000008000300ff000000", 0x5c}], 0x1, 0x0, 0x0, 0x1f00c00e}, 0x0) (async)
syz_usb_connect$uac3(0x3, 0x80, &(0x7f0000000280)=ANY=[], 0x0) (async)
syz_usb_control_io$uac3(r1, 0x0, 0x0) (async)
syz_open_dev$dvb_frontend(&(0x7f0000000100), 0x1, 0x802) (async)
getsockopt$bt_hci(0xffffffffffffffff, 0x84, 0x81, &(0x7f0000001280)=""/4107, &(0x7f00000000c0)=0x100b) (async)
executing program 0:
r0 = syz_open_dev$dvb_frontend(&(0x7f0000000080), 0x0, 0x402)
r1 = socket$inet_mptcp(0x2, 0x1, 0x106)
r2 = socket(0x10, 0x803, 0x0)
syz_genetlink_get_family_id$tipc(&(0x7f0000000000), r2)
getsockname$packet(r2, &(0x7f0000000280)={0x11, 0x0, <r3=>0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14)
sendmsg$nl_route(r2, &(0x7f0000000180)={&(0x7f0000000040)={0x10, 0x0, 0x0, 0x400000}, 0xc, &(0x7f0000000140)={&(0x7f0000000100)=@RTM_GETMDB={0x18, 0x56, 0x2, 0x70bd25, 0x25dfdbfe, {0x7, r3}, [""]}, 0x18}}, 0x20000000)
sendmsg$nl_route(r2, &(0x7f0000000240)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000580)=ANY=[@ANYBLOB="4800000010000305ff810000fddbdf2500000000", @ANYRES32=r3, @ANYBLOB="1748000040000200280012800a000100767863616e0000001800028014000100000000", @ANYRES32=r3], 0x48}, 0x1, 0x0, 0x0, 0x40}, 0x0)
connect$inet(r1, &(0x7f0000000000)={0x2, 0x4e22, @empty}, 0x10)
setsockopt$sock_int(r1, 0x1, 0x9, &(0x7f00000003c0)=0x246, 0x4)
ioctl$FE_SET_PROPERTY(r0, 0x40106f52, &(0x7f00000000c0)={0x29, &(0x7f0000000200)=[{0x34, '\x00', @data=0x4}]})
syz_open_dev$dvb_frontend(&(0x7f0000000080), 0x0, 0x402) (async)
socket$inet_mptcp(0x2, 0x1, 0x106) (async)
socket(0x10, 0x803, 0x0) (async)
syz_genetlink_get_family_id$tipc(&(0x7f0000000000), r2) (async)
getsockname$packet(r2, &(0x7f0000000280)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) (async)
sendmsg$nl_route(r2, &(0x7f0000000240)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000580)=ANY=[@ANYBLOB="4800000010000305ff810000fddbdf2500000000", @ANYRES32=r3, @ANYBLOB="1748000040000200280012800a000100767863616e0000001800028014000100000000", @ANYRES32=r3], 0x48}, 0x1, 0x0, 0x0, 0x40}, 0x0) (async)

program crashed: KASAN: slab-use-after-free Read in dvb_device_open
testing program (duration=45s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): [19, 10, 15]
detailed listing:
executing program 3:
r0 = socket$inet6_tcp(0xa, 0x1, 0x0)
connect$inet6(r0, 0x0, 0x0)
gettid()
timer_settime(0x0, 0x0, &(0x7f0000000280)={{0x0, 0x989680}, {0x0, 0x989680}}, 0x0)
socketpair$unix(0x1, 0x0, 0x0, 0x0)
getsockopt$sock_cred(0xffffffffffffffff, 0x1, 0x11, 0x0, &(0x7f0000cab000))
setsockopt$sock_cred(0xffffffffffffffff, 0x1, 0x11, 0x0, 0x0)
setsockopt$inet6_tcp_TCP_REPAIR_QUEUE(r0, 0x6, 0x14, 0x0, 0x0)
mmap(&(0x7f0000000000/0x4000)=nil, 0x4000, 0x1, 0x10012, 0xffffffffffffffff, 0x5deba000)
mmap(&(0x7f0000bfe000/0x400000)=nil, 0x400000, 0x4, 0x40010, r0, 0xd1aa000)
mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x3, 0x8031, 0xffffffffffffffff, 0x0)
mmap$dsp(&(0x7f0000ffd000/0x2000)=nil, 0x2000, 0x100000b, 0x810, 0xffffffffffffffff, 0x0)
socket$xdp(0x2c, 0x3, 0x0)
r1 = socket$kcm(0xa, 0x2, 0x0)
r2 = socket(0x2, 0x80805, 0x0)
r3 = openat$fuse(0xffffffffffffff9c, &(0x7f0000000080), 0x2, 0x0)
read$FUSE(r3, &(0x7f0000000600)={0x2020}, 0x2020)
setsockopt$IP_VS_SO_SET_ADD(r2, 0x0, 0x482, &(0x7f0000000240)={0x84, @dev={0xac, 0x14, 0x14, 0x15}, 0x4e20, 0x3, 'wlc\x00', 0x2, 0x660f537e, 0x3}, 0x2c)
sendmsg$sock(r1, &(0x7f0000000400)={&(0x7f0000000580)=@in6={0x2, 0x4e20, 0x0, @dev={0xfe, 0x80, '\x00', 0xfd}}, 0x80, 0x0, 0x0, &(0x7f0000000000)=[@mark={{0x14, 0x1, 0x24, 0x3}}], 0x18}, 0x0)
executing program 3:
r0 = syz_usb_connect(0x0, 0x32, &(0x7f0000000000)=ANY=[@ANYBLOB="1201000200000040a61b01000100000000010902200001010080320904"], 0x0)
sendmsg$inet(0xffffffffffffffff, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)=[{&(0x7f0000000100)="5c00000012006bab9e3fe3d86e6c1d0000147ea60864160af36504b68675f8001d000a00a0e69ee517d34460bc24eab556a705251e6182949a36c23d3b48dfd8cdbf9367b4fa51f60a64c9f4080003680601000008000300ff000000", 0x5c}], 0x1, 0x0, 0x0, 0x1f00c00e}, 0x0)
r1 = syz_usb_connect$uac3(0x3, 0x80, &(0x7f0000000280)=ANY=[], 0x0)
syz_usb_control_io$printer(r0, 0x0, &(0x7f00000005c0)={0x34, &(0x7f00000003c0)=ANY=[], 0x0, 0x0, 0x0, 0x0, 0x0})
mkdirat(0xffffffffffffff9c, &(0x7f0000000200)='./file0\x00', 0x0)
sendmsg$inet(0xffffffffffffffff, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)=[{&(0x7f0000000100)="5c00000012006bab9e3fe3d86e6c1d0000147ea60864160af36504b68675f8001d000a00a0e69ee517d34460bc24eab556a705251e6182949a36c23d3b48dfd8cdbf9367b4fa51f60a64c9f4080003680601000008000300ff000000", 0x5c}], 0x1, 0x0, 0x0, 0x1f00c00e}, 0x0) (async)
syz_usb_connect$uac3(0x3, 0x80, &(0x7f0000000280)=ANY=[], 0x0) (async)
syz_usb_control_io$uac3(r1, 0x0, 0x0) (async)
syz_open_dev$dvb_frontend(&(0x7f0000000100), 0x1, 0x802) (async)
getsockopt$bt_hci(0xffffffffffffffff, 0x84, 0x81, &(0x7f0000001280)=""/4107, &(0x7f00000000c0)=0x100b) (async)
executing program 0:
r0 = syz_open_dev$dvb_frontend(&(0x7f0000000080), 0x0, 0x402)
r1 = socket$inet_mptcp(0x2, 0x1, 0x106)
r2 = socket(0x10, 0x803, 0x0)
syz_genetlink_get_family_id$tipc(&(0x7f0000000000), r2)
getsockname$packet(r2, &(0x7f0000000280)={0x11, 0x0, <r3=>0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14)
sendmsg$nl_route(r2, &(0x7f0000000180)={&(0x7f0000000040)={0x10, 0x0, 0x0, 0x400000}, 0xc, &(0x7f0000000140)={&(0x7f0000000100)=@RTM_GETMDB={0x18, 0x56, 0x2, 0x70bd25, 0x25dfdbfe, {0x7, r3}, [""]}, 0x18}}, 0x20000000)
sendmsg$nl_route(r2, &(0x7f0000000240)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000580)=ANY=[@ANYBLOB="4800000010000305ff810000fddbdf2500000000", @ANYRES32=r3, @ANYBLOB="1748000040000200280012800a000100767863616e0000001800028014000100000000", @ANYRES32=r3], 0x48}, 0x1, 0x0, 0x0, 0x40}, 0x0)
connect$inet(r1, &(0x7f0000000000)={0x2, 0x4e22, @empty}, 0x10)
setsockopt$sock_int(r1, 0x1, 0x9, &(0x7f00000003c0)=0x246, 0x4)
ioctl$FE_SET_PROPERTY(r0, 0x40106f52, &(0x7f00000000c0)={0x29, &(0x7f0000000200)=[{0x34, '\x00', @data=0x4}]})
syz_open_dev$dvb_frontend(&(0x7f0000000080), 0x0, 0x402) (async)
socket$inet_mptcp(0x2, 0x1, 0x106) (async)
socket(0x10, 0x803, 0x0) (async)
syz_genetlink_get_family_id$tipc(&(0x7f0000000000), r2) (async)
sendmsg$nl_route(r2, &(0x7f0000000240)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000580)=ANY=[@ANYBLOB="4800000010000305ff810000fddbdf2500000000", @ANYRES32=r3, @ANYBLOB="1748000040000200280012800a000100767863616e0000001800028014000100000000", @ANYRES32=r3], 0x48}, 0x1, 0x0, 0x0, 0x40}, 0x0) (async)

program did not crash
testing program (duration=45s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): [19, 10, 15]
detailed listing:
executing program 3:
r0 = socket$inet6_tcp(0xa, 0x1, 0x0)
connect$inet6(r0, 0x0, 0x0)
gettid()
timer_settime(0x0, 0x0, &(0x7f0000000280)={{0x0, 0x989680}, {0x0, 0x989680}}, 0x0)
socketpair$unix(0x1, 0x0, 0x0, 0x0)
getsockopt$sock_cred(0xffffffffffffffff, 0x1, 0x11, 0x0, &(0x7f0000cab000))
setsockopt$sock_cred(0xffffffffffffffff, 0x1, 0x11, 0x0, 0x0)
setsockopt$inet6_tcp_TCP_REPAIR_QUEUE(r0, 0x6, 0x14, 0x0, 0x0)
mmap(&(0x7f0000000000/0x4000)=nil, 0x4000, 0x1, 0x10012, 0xffffffffffffffff, 0x5deba000)
mmap(&(0x7f0000bfe000/0x400000)=nil, 0x400000, 0x4, 0x40010, r0, 0xd1aa000)
mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x3, 0x8031, 0xffffffffffffffff, 0x0)
mmap$dsp(&(0x7f0000ffd000/0x2000)=nil, 0x2000, 0x100000b, 0x810, 0xffffffffffffffff, 0x0)
socket$xdp(0x2c, 0x3, 0x0)
r1 = socket$kcm(0xa, 0x2, 0x0)
r2 = socket(0x2, 0x80805, 0x0)
r3 = openat$fuse(0xffffffffffffff9c, &(0x7f0000000080), 0x2, 0x0)
read$FUSE(r3, &(0x7f0000000600)={0x2020}, 0x2020)
setsockopt$IP_VS_SO_SET_ADD(r2, 0x0, 0x482, &(0x7f0000000240)={0x84, @dev={0xac, 0x14, 0x14, 0x15}, 0x4e20, 0x3, 'wlc\x00', 0x2, 0x660f537e, 0x3}, 0x2c)
sendmsg$sock(r1, &(0x7f0000000400)={&(0x7f0000000580)=@in6={0x2, 0x4e20, 0x0, @dev={0xfe, 0x80, '\x00', 0xfd}}, 0x80, 0x0, 0x0, &(0x7f0000000000)=[@mark={{0x14, 0x1, 0x24, 0x3}}], 0x18}, 0x0)
executing program 3:
r0 = syz_usb_connect(0x0, 0x32, &(0x7f0000000000)=ANY=[@ANYBLOB="1201000200000040a61b01000100000000010902200001010080320904"], 0x0)
sendmsg$inet(0xffffffffffffffff, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)=[{&(0x7f0000000100)="5c00000012006bab9e3fe3d86e6c1d0000147ea60864160af36504b68675f8001d000a00a0e69ee517d34460bc24eab556a705251e6182949a36c23d3b48dfd8cdbf9367b4fa51f60a64c9f4080003680601000008000300ff000000", 0x5c}], 0x1, 0x0, 0x0, 0x1f00c00e}, 0x0)
r1 = syz_usb_connect$uac3(0x3, 0x80, &(0x7f0000000280)=ANY=[], 0x0)
syz_usb_control_io$printer(r0, 0x0, &(0x7f00000005c0)={0x34, &(0x7f00000003c0)=ANY=[], 0x0, 0x0, 0x0, 0x0, 0x0})
mkdirat(0xffffffffffffff9c, &(0x7f0000000200)='./file0\x00', 0x0)
sendmsg$inet(0xffffffffffffffff, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)=[{&(0x7f0000000100)="5c00000012006bab9e3fe3d86e6c1d0000147ea60864160af36504b68675f8001d000a00a0e69ee517d34460bc24eab556a705251e6182949a36c23d3b48dfd8cdbf9367b4fa51f60a64c9f4080003680601000008000300ff000000", 0x5c}], 0x1, 0x0, 0x0, 0x1f00c00e}, 0x0) (async)
syz_usb_connect$uac3(0x3, 0x80, &(0x7f0000000280)=ANY=[], 0x0) (async)
syz_usb_control_io$uac3(r1, 0x0, 0x0) (async)
syz_open_dev$dvb_frontend(&(0x7f0000000100), 0x1, 0x802) (async)
getsockopt$bt_hci(0xffffffffffffffff, 0x84, 0x81, &(0x7f0000001280)=""/4107, &(0x7f00000000c0)=0x100b) (async)
executing program 0:
r0 = syz_open_dev$dvb_frontend(&(0x7f0000000080), 0x0, 0x402)
r1 = socket$inet_mptcp(0x2, 0x1, 0x106)
r2 = socket(0x10, 0x803, 0x0)
syz_genetlink_get_family_id$tipc(&(0x7f0000000000), r2)
getsockname$packet(r2, &(0x7f0000000280)={0x11, 0x0, <r3=>0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14)
sendmsg$nl_route(r2, &(0x7f0000000180)={&(0x7f0000000040)={0x10, 0x0, 0x0, 0x400000}, 0xc, &(0x7f0000000140)={&(0x7f0000000100)=@RTM_GETMDB={0x18, 0x56, 0x2, 0x70bd25, 0x25dfdbfe, {0x7, r3}, [""]}, 0x18}}, 0x20000000)
sendmsg$nl_route(r2, &(0x7f0000000240)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000580)=ANY=[@ANYBLOB="4800000010000305ff810000fddbdf2500000000", @ANYRES32=r3, @ANYBLOB="1748000040000200280012800a000100767863616e0000001800028014000100000000", @ANYRES32=r3], 0x48}, 0x1, 0x0, 0x0, 0x40}, 0x0)
connect$inet(r1, &(0x7f0000000000)={0x2, 0x4e22, @empty}, 0x10)
setsockopt$sock_int(r1, 0x1, 0x9, &(0x7f00000003c0)=0x246, 0x4)
ioctl$FE_SET_PROPERTY(r0, 0x40106f52, &(0x7f00000000c0)={0x29, &(0x7f0000000200)=[{0x34, '\x00', @data=0x4}]})
syz_open_dev$dvb_frontend(&(0x7f0000000080), 0x0, 0x402) (async)
socket$inet_mptcp(0x2, 0x1, 0x106) (async)
socket(0x10, 0x803, 0x0) (async)
getsockname$packet(r2, &(0x7f0000000280)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) (async)
sendmsg$nl_route(r2, &(0x7f0000000240)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000580)=ANY=[@ANYBLOB="4800000010000305ff810000fddbdf2500000000", @ANYRES32=r3, @ANYBLOB="1748000040000200280012800a000100767863616e0000001800028014000100000000", @ANYRES32=r3], 0x48}, 0x1, 0x0, 0x0, 0x40}, 0x0) (async)

program crashed: KASAN: slab-use-after-free Read in dvb_device_open
testing program (duration=45s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): [19, 10, 14]
detailed listing:
executing program 3:
r0 = socket$inet6_tcp(0xa, 0x1, 0x0)
connect$inet6(r0, 0x0, 0x0)
gettid()
timer_settime(0x0, 0x0, &(0x7f0000000280)={{0x0, 0x989680}, {0x0, 0x989680}}, 0x0)
socketpair$unix(0x1, 0x0, 0x0, 0x0)
getsockopt$sock_cred(0xffffffffffffffff, 0x1, 0x11, 0x0, &(0x7f0000cab000))
setsockopt$sock_cred(0xffffffffffffffff, 0x1, 0x11, 0x0, 0x0)
setsockopt$inet6_tcp_TCP_REPAIR_QUEUE(r0, 0x6, 0x14, 0x0, 0x0)
mmap(&(0x7f0000000000/0x4000)=nil, 0x4000, 0x1, 0x10012, 0xffffffffffffffff, 0x5deba000)
mmap(&(0x7f0000bfe000/0x400000)=nil, 0x400000, 0x4, 0x40010, r0, 0xd1aa000)
mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x3, 0x8031, 0xffffffffffffffff, 0x0)
mmap$dsp(&(0x7f0000ffd000/0x2000)=nil, 0x2000, 0x100000b, 0x810, 0xffffffffffffffff, 0x0)
socket$xdp(0x2c, 0x3, 0x0)
r1 = socket$kcm(0xa, 0x2, 0x0)
r2 = socket(0x2, 0x80805, 0x0)
r3 = openat$fuse(0xffffffffffffff9c, &(0x7f0000000080), 0x2, 0x0)
read$FUSE(r3, &(0x7f0000000600)={0x2020}, 0x2020)
setsockopt$IP_VS_SO_SET_ADD(r2, 0x0, 0x482, &(0x7f0000000240)={0x84, @dev={0xac, 0x14, 0x14, 0x15}, 0x4e20, 0x3, 'wlc\x00', 0x2, 0x660f537e, 0x3}, 0x2c)
sendmsg$sock(r1, &(0x7f0000000400)={&(0x7f0000000580)=@in6={0x2, 0x4e20, 0x0, @dev={0xfe, 0x80, '\x00', 0xfd}}, 0x80, 0x0, 0x0, &(0x7f0000000000)=[@mark={{0x14, 0x1, 0x24, 0x3}}], 0x18}, 0x0)
executing program 3:
r0 = syz_usb_connect(0x0, 0x32, &(0x7f0000000000)=ANY=[@ANYBLOB="1201000200000040a61b01000100000000010902200001010080320904"], 0x0)
sendmsg$inet(0xffffffffffffffff, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)=[{&(0x7f0000000100)="5c00000012006bab9e3fe3d86e6c1d0000147ea60864160af36504b68675f8001d000a00a0e69ee517d34460bc24eab556a705251e6182949a36c23d3b48dfd8cdbf9367b4fa51f60a64c9f4080003680601000008000300ff000000", 0x5c}], 0x1, 0x0, 0x0, 0x1f00c00e}, 0x0)
r1 = syz_usb_connect$uac3(0x3, 0x80, &(0x7f0000000280)=ANY=[], 0x0)
syz_usb_control_io$printer(r0, 0x0, &(0x7f00000005c0)={0x34, &(0x7f00000003c0)=ANY=[], 0x0, 0x0, 0x0, 0x0, 0x0})
mkdirat(0xffffffffffffff9c, &(0x7f0000000200)='./file0\x00', 0x0)
sendmsg$inet(0xffffffffffffffff, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)=[{&(0x7f0000000100)="5c00000012006bab9e3fe3d86e6c1d0000147ea60864160af36504b68675f8001d000a00a0e69ee517d34460bc24eab556a705251e6182949a36c23d3b48dfd8cdbf9367b4fa51f60a64c9f4080003680601000008000300ff000000", 0x5c}], 0x1, 0x0, 0x0, 0x1f00c00e}, 0x0) (async)
syz_usb_connect$uac3(0x3, 0x80, &(0x7f0000000280)=ANY=[], 0x0) (async)
syz_usb_control_io$uac3(r1, 0x0, 0x0) (async)
syz_open_dev$dvb_frontend(&(0x7f0000000100), 0x1, 0x802) (async)
getsockopt$bt_hci(0xffffffffffffffff, 0x84, 0x81, &(0x7f0000001280)=""/4107, &(0x7f00000000c0)=0x100b) (async)
executing program 0:
r0 = syz_open_dev$dvb_frontend(&(0x7f0000000080), 0x0, 0x402)
r1 = socket$inet_mptcp(0x2, 0x1, 0x106)
r2 = socket(0x10, 0x803, 0x0)
syz_genetlink_get_family_id$tipc(&(0x7f0000000000), r2)
getsockname$packet(r2, &(0x7f0000000280)={0x11, 0x0, <r3=>0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14)
sendmsg$nl_route(r2, &(0x7f0000000180)={&(0x7f0000000040)={0x10, 0x0, 0x0, 0x400000}, 0xc, &(0x7f0000000140)={&(0x7f0000000100)=@RTM_GETMDB={0x18, 0x56, 0x2, 0x70bd25, 0x25dfdbfe, {0x7, r3}, [""]}, 0x18}}, 0x20000000)
sendmsg$nl_route(r2, &(0x7f0000000240)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000580)=ANY=[@ANYBLOB="4800000010000305ff810000fddbdf2500000000", @ANYRES32=r3, @ANYBLOB="1748000040000200280012800a000100767863616e0000001800028014000100000000", @ANYRES32=r3], 0x48}, 0x1, 0x0, 0x0, 0x40}, 0x0)
connect$inet(r1, &(0x7f0000000000)={0x2, 0x4e22, @empty}, 0x10)
setsockopt$sock_int(r1, 0x1, 0x9, &(0x7f00000003c0)=0x246, 0x4)
ioctl$FE_SET_PROPERTY(r0, 0x40106f52, &(0x7f00000000c0)={0x29, &(0x7f0000000200)=[{0x34, '\x00', @data=0x4}]})
syz_open_dev$dvb_frontend(&(0x7f0000000080), 0x0, 0x402) (async)
socket$inet_mptcp(0x2, 0x1, 0x106) (async)
getsockname$packet(r2, &(0x7f0000000280)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) (async)
sendmsg$nl_route(r2, &(0x7f0000000240)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000580)=ANY=[@ANYBLOB="4800000010000305ff810000fddbdf2500000000", @ANYRES32=r3, @ANYBLOB="1748000040000200280012800a000100767863616e0000001800028014000100000000", @ANYRES32=r3], 0x48}, 0x1, 0x0, 0x0, 0x40}, 0x0) (async)

program crashed: KASAN: slab-use-after-free Read in dvb_device_open
testing program (duration=45s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): [19, 10, 13]
detailed listing:
executing program 3:
r0 = socket$inet6_tcp(0xa, 0x1, 0x0)
connect$inet6(r0, 0x0, 0x0)
gettid()
timer_settime(0x0, 0x0, &(0x7f0000000280)={{0x0, 0x989680}, {0x0, 0x989680}}, 0x0)
socketpair$unix(0x1, 0x0, 0x0, 0x0)
getsockopt$sock_cred(0xffffffffffffffff, 0x1, 0x11, 0x0, &(0x7f0000cab000))
setsockopt$sock_cred(0xffffffffffffffff, 0x1, 0x11, 0x0, 0x0)
setsockopt$inet6_tcp_TCP_REPAIR_QUEUE(r0, 0x6, 0x14, 0x0, 0x0)
mmap(&(0x7f0000000000/0x4000)=nil, 0x4000, 0x1, 0x10012, 0xffffffffffffffff, 0x5deba000)
mmap(&(0x7f0000bfe000/0x400000)=nil, 0x400000, 0x4, 0x40010, r0, 0xd1aa000)
mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x3, 0x8031, 0xffffffffffffffff, 0x0)
mmap$dsp(&(0x7f0000ffd000/0x2000)=nil, 0x2000, 0x100000b, 0x810, 0xffffffffffffffff, 0x0)
socket$xdp(0x2c, 0x3, 0x0)
r1 = socket$kcm(0xa, 0x2, 0x0)
r2 = socket(0x2, 0x80805, 0x0)
r3 = openat$fuse(0xffffffffffffff9c, &(0x7f0000000080), 0x2, 0x0)
read$FUSE(r3, &(0x7f0000000600)={0x2020}, 0x2020)
setsockopt$IP_VS_SO_SET_ADD(r2, 0x0, 0x482, &(0x7f0000000240)={0x84, @dev={0xac, 0x14, 0x14, 0x15}, 0x4e20, 0x3, 'wlc\x00', 0x2, 0x660f537e, 0x3}, 0x2c)
sendmsg$sock(r1, &(0x7f0000000400)={&(0x7f0000000580)=@in6={0x2, 0x4e20, 0x0, @dev={0xfe, 0x80, '\x00', 0xfd}}, 0x80, 0x0, 0x0, &(0x7f0000000000)=[@mark={{0x14, 0x1, 0x24, 0x3}}], 0x18}, 0x0)
executing program 3:
r0 = syz_usb_connect(0x0, 0x32, &(0x7f0000000000)=ANY=[@ANYBLOB="1201000200000040a61b01000100000000010902200001010080320904"], 0x0)
sendmsg$inet(0xffffffffffffffff, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)=[{&(0x7f0000000100)="5c00000012006bab9e3fe3d86e6c1d0000147ea60864160af36504b68675f8001d000a00a0e69ee517d34460bc24eab556a705251e6182949a36c23d3b48dfd8cdbf9367b4fa51f60a64c9f4080003680601000008000300ff000000", 0x5c}], 0x1, 0x0, 0x0, 0x1f00c00e}, 0x0)
r1 = syz_usb_connect$uac3(0x3, 0x80, &(0x7f0000000280)=ANY=[], 0x0)
syz_usb_control_io$printer(r0, 0x0, &(0x7f00000005c0)={0x34, &(0x7f00000003c0)=ANY=[], 0x0, 0x0, 0x0, 0x0, 0x0})
mkdirat(0xffffffffffffff9c, &(0x7f0000000200)='./file0\x00', 0x0)
sendmsg$inet(0xffffffffffffffff, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)=[{&(0x7f0000000100)="5c00000012006bab9e3fe3d86e6c1d0000147ea60864160af36504b68675f8001d000a00a0e69ee517d34460bc24eab556a705251e6182949a36c23d3b48dfd8cdbf9367b4fa51f60a64c9f4080003680601000008000300ff000000", 0x5c}], 0x1, 0x0, 0x0, 0x1f00c00e}, 0x0) (async)
syz_usb_connect$uac3(0x3, 0x80, &(0x7f0000000280)=ANY=[], 0x0) (async)
syz_usb_control_io$uac3(r1, 0x0, 0x0) (async)
syz_open_dev$dvb_frontend(&(0x7f0000000100), 0x1, 0x802) (async)
getsockopt$bt_hci(0xffffffffffffffff, 0x84, 0x81, &(0x7f0000001280)=""/4107, &(0x7f00000000c0)=0x100b) (async)
executing program 0:
r0 = syz_open_dev$dvb_frontend(&(0x7f0000000080), 0x0, 0x402)
r1 = socket$inet_mptcp(0x2, 0x1, 0x106)
r2 = socket(0x10, 0x803, 0x0)
syz_genetlink_get_family_id$tipc(&(0x7f0000000000), r2)
getsockname$packet(r2, &(0x7f0000000280)={0x11, 0x0, <r3=>0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14)
sendmsg$nl_route(r2, &(0x7f0000000180)={&(0x7f0000000040)={0x10, 0x0, 0x0, 0x400000}, 0xc, &(0x7f0000000140)={&(0x7f0000000100)=@RTM_GETMDB={0x18, 0x56, 0x2, 0x70bd25, 0x25dfdbfe, {0x7, r3}, [""]}, 0x18}}, 0x20000000)
sendmsg$nl_route(r2, &(0x7f0000000240)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000580)=ANY=[@ANYBLOB="4800000010000305ff810000fddbdf2500000000", @ANYRES32=r3, @ANYBLOB="1748000040000200280012800a000100767863616e0000001800028014000100000000", @ANYRES32=r3], 0x48}, 0x1, 0x0, 0x0, 0x40}, 0x0)
connect$inet(r1, &(0x7f0000000000)={0x2, 0x4e22, @empty}, 0x10)
setsockopt$sock_int(r1, 0x1, 0x9, &(0x7f00000003c0)=0x246, 0x4)
ioctl$FE_SET_PROPERTY(r0, 0x40106f52, &(0x7f00000000c0)={0x29, &(0x7f0000000200)=[{0x34, '\x00', @data=0x4}]})
syz_open_dev$dvb_frontend(&(0x7f0000000080), 0x0, 0x402) (async)
getsockname$packet(r2, &(0x7f0000000280)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) (async)
sendmsg$nl_route(r2, &(0x7f0000000240)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000580)=ANY=[@ANYBLOB="4800000010000305ff810000fddbdf2500000000", @ANYRES32=r3, @ANYBLOB="1748000040000200280012800a000100767863616e0000001800028014000100000000", @ANYRES32=r3], 0x48}, 0x1, 0x0, 0x0, 0x40}, 0x0) (async)

program crashed: KASAN: slab-use-after-free Read in dvb_device_open
testing program (duration=45s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): [19, 10, 12]
detailed listing:
executing program 3:
r0 = socket$inet6_tcp(0xa, 0x1, 0x0)
connect$inet6(r0, 0x0, 0x0)
gettid()
timer_settime(0x0, 0x0, &(0x7f0000000280)={{0x0, 0x989680}, {0x0, 0x989680}}, 0x0)
socketpair$unix(0x1, 0x0, 0x0, 0x0)
getsockopt$sock_cred(0xffffffffffffffff, 0x1, 0x11, 0x0, &(0x7f0000cab000))
setsockopt$sock_cred(0xffffffffffffffff, 0x1, 0x11, 0x0, 0x0)
setsockopt$inet6_tcp_TCP_REPAIR_QUEUE(r0, 0x6, 0x14, 0x0, 0x0)
mmap(&(0x7f0000000000/0x4000)=nil, 0x4000, 0x1, 0x10012, 0xffffffffffffffff, 0x5deba000)
mmap(&(0x7f0000bfe000/0x400000)=nil, 0x400000, 0x4, 0x40010, r0, 0xd1aa000)
mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x3, 0x8031, 0xffffffffffffffff, 0x0)
mmap$dsp(&(0x7f0000ffd000/0x2000)=nil, 0x2000, 0x100000b, 0x810, 0xffffffffffffffff, 0x0)
socket$xdp(0x2c, 0x3, 0x0)
r1 = socket$kcm(0xa, 0x2, 0x0)
r2 = socket(0x2, 0x80805, 0x0)
r3 = openat$fuse(0xffffffffffffff9c, &(0x7f0000000080), 0x2, 0x0)
read$FUSE(r3, &(0x7f0000000600)={0x2020}, 0x2020)
setsockopt$IP_VS_SO_SET_ADD(r2, 0x0, 0x482, &(0x7f0000000240)={0x84, @dev={0xac, 0x14, 0x14, 0x15}, 0x4e20, 0x3, 'wlc\x00', 0x2, 0x660f537e, 0x3}, 0x2c)
sendmsg$sock(r1, &(0x7f0000000400)={&(0x7f0000000580)=@in6={0x2, 0x4e20, 0x0, @dev={0xfe, 0x80, '\x00', 0xfd}}, 0x80, 0x0, 0x0, &(0x7f0000000000)=[@mark={{0x14, 0x1, 0x24, 0x3}}], 0x18}, 0x0)
executing program 3:
r0 = syz_usb_connect(0x0, 0x32, &(0x7f0000000000)=ANY=[@ANYBLOB="1201000200000040a61b01000100000000010902200001010080320904"], 0x0)
sendmsg$inet(0xffffffffffffffff, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)=[{&(0x7f0000000100)="5c00000012006bab9e3fe3d86e6c1d0000147ea60864160af36504b68675f8001d000a00a0e69ee517d34460bc24eab556a705251e6182949a36c23d3b48dfd8cdbf9367b4fa51f60a64c9f4080003680601000008000300ff000000", 0x5c}], 0x1, 0x0, 0x0, 0x1f00c00e}, 0x0)
r1 = syz_usb_connect$uac3(0x3, 0x80, &(0x7f0000000280)=ANY=[], 0x0)
syz_usb_control_io$printer(r0, 0x0, &(0x7f00000005c0)={0x34, &(0x7f00000003c0)=ANY=[], 0x0, 0x0, 0x0, 0x0, 0x0})
mkdirat(0xffffffffffffff9c, &(0x7f0000000200)='./file0\x00', 0x0)
sendmsg$inet(0xffffffffffffffff, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)=[{&(0x7f0000000100)="5c00000012006bab9e3fe3d86e6c1d0000147ea60864160af36504b68675f8001d000a00a0e69ee517d34460bc24eab556a705251e6182949a36c23d3b48dfd8cdbf9367b4fa51f60a64c9f4080003680601000008000300ff000000", 0x5c}], 0x1, 0x0, 0x0, 0x1f00c00e}, 0x0) (async)
syz_usb_connect$uac3(0x3, 0x80, &(0x7f0000000280)=ANY=[], 0x0) (async)
syz_usb_control_io$uac3(r1, 0x0, 0x0) (async)
syz_open_dev$dvb_frontend(&(0x7f0000000100), 0x1, 0x802) (async)
getsockopt$bt_hci(0xffffffffffffffff, 0x84, 0x81, &(0x7f0000001280)=""/4107, &(0x7f00000000c0)=0x100b) (async)
executing program 0:
r0 = syz_open_dev$dvb_frontend(&(0x7f0000000080), 0x0, 0x402)
r1 = socket$inet_mptcp(0x2, 0x1, 0x106)
r2 = socket(0x10, 0x803, 0x0)
syz_genetlink_get_family_id$tipc(&(0x7f0000000000), r2)
getsockname$packet(r2, &(0x7f0000000280)={0x11, 0x0, <r3=>0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14)
sendmsg$nl_route(r2, &(0x7f0000000180)={&(0x7f0000000040)={0x10, 0x0, 0x0, 0x400000}, 0xc, &(0x7f0000000140)={&(0x7f0000000100)=@RTM_GETMDB={0x18, 0x56, 0x2, 0x70bd25, 0x25dfdbfe, {0x7, r3}, [""]}, 0x18}}, 0x20000000)
sendmsg$nl_route(r2, &(0x7f0000000240)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000580)=ANY=[@ANYBLOB="4800000010000305ff810000fddbdf2500000000", @ANYRES32=r3, @ANYBLOB="1748000040000200280012800a000100767863616e0000001800028014000100000000", @ANYRES32=r3], 0x48}, 0x1, 0x0, 0x0, 0x40}, 0x0)
connect$inet(r1, &(0x7f0000000000)={0x2, 0x4e22, @empty}, 0x10)
setsockopt$sock_int(r1, 0x1, 0x9, &(0x7f00000003c0)=0x246, 0x4)
ioctl$FE_SET_PROPERTY(r0, 0x40106f52, &(0x7f00000000c0)={0x29, &(0x7f0000000200)=[{0x34, '\x00', @data=0x4}]})
getsockname$packet(r2, &(0x7f0000000280)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) (async)
sendmsg$nl_route(r2, &(0x7f0000000240)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000580)=ANY=[@ANYBLOB="4800000010000305ff810000fddbdf2500000000", @ANYRES32=r3, @ANYBLOB="1748000040000200280012800a000100767863616e0000001800028014000100000000", @ANYRES32=r3], 0x48}, 0x1, 0x0, 0x0, 0x40}, 0x0) (async)

program crashed: KASAN: slab-use-after-free Read in dvb_device_open
testing program (duration=45s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): [19, 10, 11]
detailed listing:
executing program 3:
r0 = socket$inet6_tcp(0xa, 0x1, 0x0)
connect$inet6(r0, 0x0, 0x0)
gettid()
timer_settime(0x0, 0x0, &(0x7f0000000280)={{0x0, 0x989680}, {0x0, 0x989680}}, 0x0)
socketpair$unix(0x1, 0x0, 0x0, 0x0)
getsockopt$sock_cred(0xffffffffffffffff, 0x1, 0x11, 0x0, &(0x7f0000cab000))
setsockopt$sock_cred(0xffffffffffffffff, 0x1, 0x11, 0x0, 0x0)
setsockopt$inet6_tcp_TCP_REPAIR_QUEUE(r0, 0x6, 0x14, 0x0, 0x0)
mmap(&(0x7f0000000000/0x4000)=nil, 0x4000, 0x1, 0x10012, 0xffffffffffffffff, 0x5deba000)
mmap(&(0x7f0000bfe000/0x400000)=nil, 0x400000, 0x4, 0x40010, r0, 0xd1aa000)
mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x3, 0x8031, 0xffffffffffffffff, 0x0)
mmap$dsp(&(0x7f0000ffd000/0x2000)=nil, 0x2000, 0x100000b, 0x810, 0xffffffffffffffff, 0x0)
socket$xdp(0x2c, 0x3, 0x0)
r1 = socket$kcm(0xa, 0x2, 0x0)
r2 = socket(0x2, 0x80805, 0x0)
r3 = openat$fuse(0xffffffffffffff9c, &(0x7f0000000080), 0x2, 0x0)
read$FUSE(r3, &(0x7f0000000600)={0x2020}, 0x2020)
setsockopt$IP_VS_SO_SET_ADD(r2, 0x0, 0x482, &(0x7f0000000240)={0x84, @dev={0xac, 0x14, 0x14, 0x15}, 0x4e20, 0x3, 'wlc\x00', 0x2, 0x660f537e, 0x3}, 0x2c)
sendmsg$sock(r1, &(0x7f0000000400)={&(0x7f0000000580)=@in6={0x2, 0x4e20, 0x0, @dev={0xfe, 0x80, '\x00', 0xfd}}, 0x80, 0x0, 0x0, &(0x7f0000000000)=[@mark={{0x14, 0x1, 0x24, 0x3}}], 0x18}, 0x0)
executing program 3:
r0 = syz_usb_connect(0x0, 0x32, &(0x7f0000000000)=ANY=[@ANYBLOB="1201000200000040a61b01000100000000010902200001010080320904"], 0x0)
sendmsg$inet(0xffffffffffffffff, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)=[{&(0x7f0000000100)="5c00000012006bab9e3fe3d86e6c1d0000147ea60864160af36504b68675f8001d000a00a0e69ee517d34460bc24eab556a705251e6182949a36c23d3b48dfd8cdbf9367b4fa51f60a64c9f4080003680601000008000300ff000000", 0x5c}], 0x1, 0x0, 0x0, 0x1f00c00e}, 0x0)
r1 = syz_usb_connect$uac3(0x3, 0x80, &(0x7f0000000280)=ANY=[], 0x0)
syz_usb_control_io$printer(r0, 0x0, &(0x7f00000005c0)={0x34, &(0x7f00000003c0)=ANY=[], 0x0, 0x0, 0x0, 0x0, 0x0})
mkdirat(0xffffffffffffff9c, &(0x7f0000000200)='./file0\x00', 0x0)
sendmsg$inet(0xffffffffffffffff, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)=[{&(0x7f0000000100)="5c00000012006bab9e3fe3d86e6c1d0000147ea60864160af36504b68675f8001d000a00a0e69ee517d34460bc24eab556a705251e6182949a36c23d3b48dfd8cdbf9367b4fa51f60a64c9f4080003680601000008000300ff000000", 0x5c}], 0x1, 0x0, 0x0, 0x1f00c00e}, 0x0) (async)
syz_usb_connect$uac3(0x3, 0x80, &(0x7f0000000280)=ANY=[], 0x0) (async)
syz_usb_control_io$uac3(r1, 0x0, 0x0) (async)
syz_open_dev$dvb_frontend(&(0x7f0000000100), 0x1, 0x802) (async)
getsockopt$bt_hci(0xffffffffffffffff, 0x84, 0x81, &(0x7f0000001280)=""/4107, &(0x7f00000000c0)=0x100b) (async)
executing program 0:
syz_open_dev$dvb_frontend(&(0x7f0000000080), 0x0, 0x402)
r0 = socket$inet_mptcp(0x2, 0x1, 0x106)
r1 = socket(0x10, 0x803, 0x0)
syz_genetlink_get_family_id$tipc(&(0x7f0000000000), r1)
getsockname$packet(r1, &(0x7f0000000280)={0x11, 0x0, <r2=>0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14)
sendmsg$nl_route(r1, &(0x7f0000000180)={&(0x7f0000000040)={0x10, 0x0, 0x0, 0x400000}, 0xc, &(0x7f0000000140)={&(0x7f0000000100)=@RTM_GETMDB={0x18, 0x56, 0x2, 0x70bd25, 0x25dfdbfe, {0x7, r2}, [""]}, 0x18}}, 0x20000000)
sendmsg$nl_route(r1, &(0x7f0000000240)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000580)=ANY=[@ANYBLOB="4800000010000305ff810000fddbdf2500000000", @ANYRES32=r2, @ANYBLOB="1748000040000200280012800a000100767863616e0000001800028014000100000000", @ANYRES32=r2], 0x48}, 0x1, 0x0, 0x0, 0x40}, 0x0)
connect$inet(r0, &(0x7f0000000000)={0x2, 0x4e22, @empty}, 0x10)
setsockopt$sock_int(r0, 0x1, 0x9, &(0x7f00000003c0)=0x246, 0x4)
getsockname$packet(r1, &(0x7f0000000280)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) (async)
sendmsg$nl_route(r1, &(0x7f0000000240)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000580)=ANY=[@ANYBLOB="4800000010000305ff810000fddbdf2500000000", @ANYRES32=r2, @ANYBLOB="1748000040000200280012800a000100767863616e0000001800028014000100000000", @ANYRES32=r2], 0x48}, 0x1, 0x0, 0x0, 0x40}, 0x0) (async)

program crashed: KASAN: slab-use-after-free Read in dvb_device_open
testing program (duration=45s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): [19, 10, 10]
detailed listing:
executing program 3:
r0 = socket$inet6_tcp(0xa, 0x1, 0x0)
connect$inet6(r0, 0x0, 0x0)
gettid()
timer_settime(0x0, 0x0, &(0x7f0000000280)={{0x0, 0x989680}, {0x0, 0x989680}}, 0x0)
socketpair$unix(0x1, 0x0, 0x0, 0x0)
getsockopt$sock_cred(0xffffffffffffffff, 0x1, 0x11, 0x0, &(0x7f0000cab000))
setsockopt$sock_cred(0xffffffffffffffff, 0x1, 0x11, 0x0, 0x0)
setsockopt$inet6_tcp_TCP_REPAIR_QUEUE(r0, 0x6, 0x14, 0x0, 0x0)
mmap(&(0x7f0000000000/0x4000)=nil, 0x4000, 0x1, 0x10012, 0xffffffffffffffff, 0x5deba000)
mmap(&(0x7f0000bfe000/0x400000)=nil, 0x400000, 0x4, 0x40010, r0, 0xd1aa000)
mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x3, 0x8031, 0xffffffffffffffff, 0x0)
mmap$dsp(&(0x7f0000ffd000/0x2000)=nil, 0x2000, 0x100000b, 0x810, 0xffffffffffffffff, 0x0)
socket$xdp(0x2c, 0x3, 0x0)
r1 = socket$kcm(0xa, 0x2, 0x0)
r2 = socket(0x2, 0x80805, 0x0)
r3 = openat$fuse(0xffffffffffffff9c, &(0x7f0000000080), 0x2, 0x0)
read$FUSE(r3, &(0x7f0000000600)={0x2020}, 0x2020)
setsockopt$IP_VS_SO_SET_ADD(r2, 0x0, 0x482, &(0x7f0000000240)={0x84, @dev={0xac, 0x14, 0x14, 0x15}, 0x4e20, 0x3, 'wlc\x00', 0x2, 0x660f537e, 0x3}, 0x2c)
sendmsg$sock(r1, &(0x7f0000000400)={&(0x7f0000000580)=@in6={0x2, 0x4e20, 0x0, @dev={0xfe, 0x80, '\x00', 0xfd}}, 0x80, 0x0, 0x0, &(0x7f0000000000)=[@mark={{0x14, 0x1, 0x24, 0x3}}], 0x18}, 0x0)
executing program 3:
r0 = syz_usb_connect(0x0, 0x32, &(0x7f0000000000)=ANY=[@ANYBLOB="1201000200000040a61b01000100000000010902200001010080320904"], 0x0)
sendmsg$inet(0xffffffffffffffff, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)=[{&(0x7f0000000100)="5c00000012006bab9e3fe3d86e6c1d0000147ea60864160af36504b68675f8001d000a00a0e69ee517d34460bc24eab556a705251e6182949a36c23d3b48dfd8cdbf9367b4fa51f60a64c9f4080003680601000008000300ff000000", 0x5c}], 0x1, 0x0, 0x0, 0x1f00c00e}, 0x0)
r1 = syz_usb_connect$uac3(0x3, 0x80, &(0x7f0000000280)=ANY=[], 0x0)
syz_usb_control_io$printer(r0, 0x0, &(0x7f00000005c0)={0x34, &(0x7f00000003c0)=ANY=[], 0x0, 0x0, 0x0, 0x0, 0x0})
mkdirat(0xffffffffffffff9c, &(0x7f0000000200)='./file0\x00', 0x0)
sendmsg$inet(0xffffffffffffffff, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)=[{&(0x7f0000000100)="5c00000012006bab9e3fe3d86e6c1d0000147ea60864160af36504b68675f8001d000a00a0e69ee517d34460bc24eab556a705251e6182949a36c23d3b48dfd8cdbf9367b4fa51f60a64c9f4080003680601000008000300ff000000", 0x5c}], 0x1, 0x0, 0x0, 0x1f00c00e}, 0x0) (async)
syz_usb_connect$uac3(0x3, 0x80, &(0x7f0000000280)=ANY=[], 0x0) (async)
syz_usb_control_io$uac3(r1, 0x0, 0x0) (async)
syz_open_dev$dvb_frontend(&(0x7f0000000100), 0x1, 0x802) (async)
getsockopt$bt_hci(0xffffffffffffffff, 0x84, 0x81, &(0x7f0000001280)=""/4107, &(0x7f00000000c0)=0x100b) (async)
executing program 0:
syz_open_dev$dvb_frontend(&(0x7f0000000080), 0x0, 0x402)
r0 = socket$inet_mptcp(0x2, 0x1, 0x106)
r1 = socket(0x10, 0x803, 0x0)
syz_genetlink_get_family_id$tipc(&(0x7f0000000000), r1)
getsockname$packet(r1, &(0x7f0000000280)={0x11, 0x0, <r2=>0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14)
sendmsg$nl_route(r1, &(0x7f0000000180)={&(0x7f0000000040)={0x10, 0x0, 0x0, 0x400000}, 0xc, &(0x7f0000000140)={&(0x7f0000000100)=@RTM_GETMDB={0x18, 0x56, 0x2, 0x70bd25, 0x25dfdbfe, {0x7, r2}, [""]}, 0x18}}, 0x20000000)
sendmsg$nl_route(r1, &(0x7f0000000240)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000580)=ANY=[@ANYBLOB="4800000010000305ff810000fddbdf2500000000", @ANYRES32=r2, @ANYBLOB="1748000040000200280012800a000100767863616e0000001800028014000100000000", @ANYRES32=r2], 0x48}, 0x1, 0x0, 0x0, 0x40}, 0x0)
connect$inet(r0, &(0x7f0000000000)={0x2, 0x4e22, @empty}, 0x10)
getsockname$packet(r1, &(0x7f0000000280)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) (async)
sendmsg$nl_route(r1, &(0x7f0000000240)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000580)=ANY=[@ANYBLOB="4800000010000305ff810000fddbdf2500000000", @ANYRES32=r2, @ANYBLOB="1748000040000200280012800a000100767863616e0000001800028014000100000000", @ANYRES32=r2], 0x48}, 0x1, 0x0, 0x0, 0x40}, 0x0) (async)

program crashed: KASAN: slab-use-after-free Read in dvb_device_open
testing program (duration=45s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): [19, 10, 9]
detailed listing:
executing program 3:
r0 = socket$inet6_tcp(0xa, 0x1, 0x0)
connect$inet6(r0, 0x0, 0x0)
gettid()
timer_settime(0x0, 0x0, &(0x7f0000000280)={{0x0, 0x989680}, {0x0, 0x989680}}, 0x0)
socketpair$unix(0x1, 0x0, 0x0, 0x0)
getsockopt$sock_cred(0xffffffffffffffff, 0x1, 0x11, 0x0, &(0x7f0000cab000))
setsockopt$sock_cred(0xffffffffffffffff, 0x1, 0x11, 0x0, 0x0)
setsockopt$inet6_tcp_TCP_REPAIR_QUEUE(r0, 0x6, 0x14, 0x0, 0x0)
mmap(&(0x7f0000000000/0x4000)=nil, 0x4000, 0x1, 0x10012, 0xffffffffffffffff, 0x5deba000)
mmap(&(0x7f0000bfe000/0x400000)=nil, 0x400000, 0x4, 0x40010, r0, 0xd1aa000)
mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x3, 0x8031, 0xffffffffffffffff, 0x0)
mmap$dsp(&(0x7f0000ffd000/0x2000)=nil, 0x2000, 0x100000b, 0x810, 0xffffffffffffffff, 0x0)
socket$xdp(0x2c, 0x3, 0x0)
r1 = socket$kcm(0xa, 0x2, 0x0)
r2 = socket(0x2, 0x80805, 0x0)
r3 = openat$fuse(0xffffffffffffff9c, &(0x7f0000000080), 0x2, 0x0)
read$FUSE(r3, &(0x7f0000000600)={0x2020}, 0x2020)
setsockopt$IP_VS_SO_SET_ADD(r2, 0x0, 0x482, &(0x7f0000000240)={0x84, @dev={0xac, 0x14, 0x14, 0x15}, 0x4e20, 0x3, 'wlc\x00', 0x2, 0x660f537e, 0x3}, 0x2c)
sendmsg$sock(r1, &(0x7f0000000400)={&(0x7f0000000580)=@in6={0x2, 0x4e20, 0x0, @dev={0xfe, 0x80, '\x00', 0xfd}}, 0x80, 0x0, 0x0, &(0x7f0000000000)=[@mark={{0x14, 0x1, 0x24, 0x3}}], 0x18}, 0x0)
executing program 3:
r0 = syz_usb_connect(0x0, 0x32, &(0x7f0000000000)=ANY=[@ANYBLOB="1201000200000040a61b01000100000000010902200001010080320904"], 0x0)
sendmsg$inet(0xffffffffffffffff, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)=[{&(0x7f0000000100)="5c00000012006bab9e3fe3d86e6c1d0000147ea60864160af36504b68675f8001d000a00a0e69ee517d34460bc24eab556a705251e6182949a36c23d3b48dfd8cdbf9367b4fa51f60a64c9f4080003680601000008000300ff000000", 0x5c}], 0x1, 0x0, 0x0, 0x1f00c00e}, 0x0)
r1 = syz_usb_connect$uac3(0x3, 0x80, &(0x7f0000000280)=ANY=[], 0x0)
syz_usb_control_io$printer(r0, 0x0, &(0x7f00000005c0)={0x34, &(0x7f00000003c0)=ANY=[], 0x0, 0x0, 0x0, 0x0, 0x0})
mkdirat(0xffffffffffffff9c, &(0x7f0000000200)='./file0\x00', 0x0)
sendmsg$inet(0xffffffffffffffff, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)=[{&(0x7f0000000100)="5c00000012006bab9e3fe3d86e6c1d0000147ea60864160af36504b68675f8001d000a00a0e69ee517d34460bc24eab556a705251e6182949a36c23d3b48dfd8cdbf9367b4fa51f60a64c9f4080003680601000008000300ff000000", 0x5c}], 0x1, 0x0, 0x0, 0x1f00c00e}, 0x0) (async)
syz_usb_connect$uac3(0x3, 0x80, &(0x7f0000000280)=ANY=[], 0x0) (async)
syz_usb_control_io$uac3(r1, 0x0, 0x0) (async)
syz_open_dev$dvb_frontend(&(0x7f0000000100), 0x1, 0x802) (async)
getsockopt$bt_hci(0xffffffffffffffff, 0x84, 0x81, &(0x7f0000001280)=""/4107, &(0x7f00000000c0)=0x100b) (async)
executing program 0:
syz_open_dev$dvb_frontend(&(0x7f0000000080), 0x0, 0x402)
socket$inet_mptcp(0x2, 0x1, 0x106)
r0 = socket(0x10, 0x803, 0x0)
syz_genetlink_get_family_id$tipc(&(0x7f0000000000), r0)
getsockname$packet(r0, &(0x7f0000000280)={0x11, 0x0, <r1=>0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14)
sendmsg$nl_route(r0, &(0x7f0000000180)={&(0x7f0000000040)={0x10, 0x0, 0x0, 0x400000}, 0xc, &(0x7f0000000140)={&(0x7f0000000100)=@RTM_GETMDB={0x18, 0x56, 0x2, 0x70bd25, 0x25dfdbfe, {0x7, r1}, [""]}, 0x18}}, 0x20000000)
sendmsg$nl_route(r0, &(0x7f0000000240)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000580)=ANY=[@ANYBLOB="4800000010000305ff810000fddbdf2500000000", @ANYRES32=r1, @ANYBLOB="1748000040000200280012800a000100767863616e0000001800028014000100000000", @ANYRES32=r1], 0x48}, 0x1, 0x0, 0x0, 0x40}, 0x0)
getsockname$packet(r0, &(0x7f0000000280)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) (async)
sendmsg$nl_route(r0, &(0x7f0000000240)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000580)=ANY=[@ANYBLOB="4800000010000305ff810000fddbdf2500000000", @ANYRES32=r1, @ANYBLOB="1748000040000200280012800a000100767863616e0000001800028014000100000000", @ANYRES32=r1], 0x48}, 0x1, 0x0, 0x0, 0x40}, 0x0) (async)

program did not crash
testing program (duration=45s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): [19, 10, 9]
detailed listing:
executing program 3:
r0 = socket$inet6_tcp(0xa, 0x1, 0x0)
connect$inet6(r0, 0x0, 0x0)
gettid()
timer_settime(0x0, 0x0, &(0x7f0000000280)={{0x0, 0x989680}, {0x0, 0x989680}}, 0x0)
socketpair$unix(0x1, 0x0, 0x0, 0x0)
getsockopt$sock_cred(0xffffffffffffffff, 0x1, 0x11, 0x0, &(0x7f0000cab000))
setsockopt$sock_cred(0xffffffffffffffff, 0x1, 0x11, 0x0, 0x0)
setsockopt$inet6_tcp_TCP_REPAIR_QUEUE(r0, 0x6, 0x14, 0x0, 0x0)
mmap(&(0x7f0000000000/0x4000)=nil, 0x4000, 0x1, 0x10012, 0xffffffffffffffff, 0x5deba000)
mmap(&(0x7f0000bfe000/0x400000)=nil, 0x400000, 0x4, 0x40010, r0, 0xd1aa000)
mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x3, 0x8031, 0xffffffffffffffff, 0x0)
mmap$dsp(&(0x7f0000ffd000/0x2000)=nil, 0x2000, 0x100000b, 0x810, 0xffffffffffffffff, 0x0)
socket$xdp(0x2c, 0x3, 0x0)
r1 = socket$kcm(0xa, 0x2, 0x0)
r2 = socket(0x2, 0x80805, 0x0)
r3 = openat$fuse(0xffffffffffffff9c, &(0x7f0000000080), 0x2, 0x0)
read$FUSE(r3, &(0x7f0000000600)={0x2020}, 0x2020)
setsockopt$IP_VS_SO_SET_ADD(r2, 0x0, 0x482, &(0x7f0000000240)={0x84, @dev={0xac, 0x14, 0x14, 0x15}, 0x4e20, 0x3, 'wlc\x00', 0x2, 0x660f537e, 0x3}, 0x2c)
sendmsg$sock(r1, &(0x7f0000000400)={&(0x7f0000000580)=@in6={0x2, 0x4e20, 0x0, @dev={0xfe, 0x80, '\x00', 0xfd}}, 0x80, 0x0, 0x0, &(0x7f0000000000)=[@mark={{0x14, 0x1, 0x24, 0x3}}], 0x18}, 0x0)
executing program 3:
r0 = syz_usb_connect(0x0, 0x32, &(0x7f0000000000)=ANY=[@ANYBLOB="1201000200000040a61b01000100000000010902200001010080320904"], 0x0)
sendmsg$inet(0xffffffffffffffff, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)=[{&(0x7f0000000100)="5c00000012006bab9e3fe3d86e6c1d0000147ea60864160af36504b68675f8001d000a00a0e69ee517d34460bc24eab556a705251e6182949a36c23d3b48dfd8cdbf9367b4fa51f60a64c9f4080003680601000008000300ff000000", 0x5c}], 0x1, 0x0, 0x0, 0x1f00c00e}, 0x0)
r1 = syz_usb_connect$uac3(0x3, 0x80, &(0x7f0000000280)=ANY=[], 0x0)
syz_usb_control_io$printer(r0, 0x0, &(0x7f00000005c0)={0x34, &(0x7f00000003c0)=ANY=[], 0x0, 0x0, 0x0, 0x0, 0x0})
mkdirat(0xffffffffffffff9c, &(0x7f0000000200)='./file0\x00', 0x0)
sendmsg$inet(0xffffffffffffffff, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)=[{&(0x7f0000000100)="5c00000012006bab9e3fe3d86e6c1d0000147ea60864160af36504b68675f8001d000a00a0e69ee517d34460bc24eab556a705251e6182949a36c23d3b48dfd8cdbf9367b4fa51f60a64c9f4080003680601000008000300ff000000", 0x5c}], 0x1, 0x0, 0x0, 0x1f00c00e}, 0x0) (async)
syz_usb_connect$uac3(0x3, 0x80, &(0x7f0000000280)=ANY=[], 0x0) (async)
syz_usb_control_io$uac3(r1, 0x0, 0x0) (async)
syz_open_dev$dvb_frontend(&(0x7f0000000100), 0x1, 0x802) (async)
getsockopt$bt_hci(0xffffffffffffffff, 0x84, 0x81, &(0x7f0000001280)=""/4107, &(0x7f00000000c0)=0x100b) (async)
executing program 0:
syz_open_dev$dvb_frontend(&(0x7f0000000080), 0x0, 0x402)
r0 = socket$inet_mptcp(0x2, 0x1, 0x106)
r1 = socket(0x10, 0x803, 0x0)
syz_genetlink_get_family_id$tipc(&(0x7f0000000000), r1)
getsockname$packet(r1, &(0x7f0000000280)={0x11, 0x0, <r2=>0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14)
sendmsg$nl_route(r1, &(0x7f0000000180)={&(0x7f0000000040)={0x10, 0x0, 0x0, 0x400000}, 0xc, &(0x7f0000000140)={&(0x7f0000000100)=@RTM_GETMDB={0x18, 0x56, 0x2, 0x70bd25, 0x25dfdbfe, {0x7, r2}, [""]}, 0x18}}, 0x20000000)
connect$inet(r0, &(0x7f0000000000)={0x2, 0x4e22, @empty}, 0x10)
getsockname$packet(r1, &(0x7f0000000280)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) (async)
sendmsg$nl_route(r1, &(0x7f0000000240)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000580)=ANY=[@ANYBLOB="4800000010000305ff810000fddbdf2500000000", @ANYRES32=r2, @ANYBLOB="1748000040000200280012800a000100767863616e0000001800028014000100000000", @ANYRES32=r2], 0x48}, 0x1, 0x0, 0x0, 0x40}, 0x0) (async)

program did not crash
testing program (duration=45s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): [19, 10, 9]
detailed listing:
executing program 3:
r0 = socket$inet6_tcp(0xa, 0x1, 0x0)
connect$inet6(r0, 0x0, 0x0)
gettid()
timer_settime(0x0, 0x0, &(0x7f0000000280)={{0x0, 0x989680}, {0x0, 0x989680}}, 0x0)
socketpair$unix(0x1, 0x0, 0x0, 0x0)
getsockopt$sock_cred(0xffffffffffffffff, 0x1, 0x11, 0x0, &(0x7f0000cab000))
setsockopt$sock_cred(0xffffffffffffffff, 0x1, 0x11, 0x0, 0x0)
setsockopt$inet6_tcp_TCP_REPAIR_QUEUE(r0, 0x6, 0x14, 0x0, 0x0)
mmap(&(0x7f0000000000/0x4000)=nil, 0x4000, 0x1, 0x10012, 0xffffffffffffffff, 0x5deba000)
mmap(&(0x7f0000bfe000/0x400000)=nil, 0x400000, 0x4, 0x40010, r0, 0xd1aa000)
mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x3, 0x8031, 0xffffffffffffffff, 0x0)
mmap$dsp(&(0x7f0000ffd000/0x2000)=nil, 0x2000, 0x100000b, 0x810, 0xffffffffffffffff, 0x0)
socket$xdp(0x2c, 0x3, 0x0)
r1 = socket$kcm(0xa, 0x2, 0x0)
r2 = socket(0x2, 0x80805, 0x0)
r3 = openat$fuse(0xffffffffffffff9c, &(0x7f0000000080), 0x2, 0x0)
read$FUSE(r3, &(0x7f0000000600)={0x2020}, 0x2020)
setsockopt$IP_VS_SO_SET_ADD(r2, 0x0, 0x482, &(0x7f0000000240)={0x84, @dev={0xac, 0x14, 0x14, 0x15}, 0x4e20, 0x3, 'wlc\x00', 0x2, 0x660f537e, 0x3}, 0x2c)
sendmsg$sock(r1, &(0x7f0000000400)={&(0x7f0000000580)=@in6={0x2, 0x4e20, 0x0, @dev={0xfe, 0x80, '\x00', 0xfd}}, 0x80, 0x0, 0x0, &(0x7f0000000000)=[@mark={{0x14, 0x1, 0x24, 0x3}}], 0x18}, 0x0)
executing program 3:
r0 = syz_usb_connect(0x0, 0x32, &(0x7f0000000000)=ANY=[@ANYBLOB="1201000200000040a61b01000100000000010902200001010080320904"], 0x0)
sendmsg$inet(0xffffffffffffffff, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)=[{&(0x7f0000000100)="5c00000012006bab9e3fe3d86e6c1d0000147ea60864160af36504b68675f8001d000a00a0e69ee517d34460bc24eab556a705251e6182949a36c23d3b48dfd8cdbf9367b4fa51f60a64c9f4080003680601000008000300ff000000", 0x5c}], 0x1, 0x0, 0x0, 0x1f00c00e}, 0x0)
r1 = syz_usb_connect$uac3(0x3, 0x80, &(0x7f0000000280)=ANY=[], 0x0)
syz_usb_control_io$printer(r0, 0x0, &(0x7f00000005c0)={0x34, &(0x7f00000003c0)=ANY=[], 0x0, 0x0, 0x0, 0x0, 0x0})
mkdirat(0xffffffffffffff9c, &(0x7f0000000200)='./file0\x00', 0x0)
sendmsg$inet(0xffffffffffffffff, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)=[{&(0x7f0000000100)="5c00000012006bab9e3fe3d86e6c1d0000147ea60864160af36504b68675f8001d000a00a0e69ee517d34460bc24eab556a705251e6182949a36c23d3b48dfd8cdbf9367b4fa51f60a64c9f4080003680601000008000300ff000000", 0x5c}], 0x1, 0x0, 0x0, 0x1f00c00e}, 0x0) (async)
syz_usb_connect$uac3(0x3, 0x80, &(0x7f0000000280)=ANY=[], 0x0) (async)
syz_usb_control_io$uac3(r1, 0x0, 0x0) (async)
syz_open_dev$dvb_frontend(&(0x7f0000000100), 0x1, 0x802) (async)
getsockopt$bt_hci(0xffffffffffffffff, 0x84, 0x81, &(0x7f0000001280)=""/4107, &(0x7f00000000c0)=0x100b) (async)
executing program 0:
syz_open_dev$dvb_frontend(&(0x7f0000000080), 0x0, 0x402)
r0 = socket$inet_mptcp(0x2, 0x1, 0x106)
r1 = socket(0x10, 0x803, 0x0)
syz_genetlink_get_family_id$tipc(&(0x7f0000000000), r1)
getsockname$packet(r1, &(0x7f0000000280)={0x11, 0x0, <r2=>0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14)
sendmsg$nl_route(r1, &(0x7f0000000240)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000580)=ANY=[@ANYBLOB="4800000010000305ff810000fddbdf2500000000", @ANYRES32=r2, @ANYBLOB="1748000040000200280012800a000100767863616e0000001800028014000100000000", @ANYRES32=r2], 0x48}, 0x1, 0x0, 0x0, 0x40}, 0x0)
connect$inet(r0, &(0x7f0000000000)={0x2, 0x4e22, @empty}, 0x10)
getsockname$packet(r1, &(0x7f0000000280)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) (async)
sendmsg$nl_route(r1, &(0x7f0000000240)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000580)=ANY=[@ANYBLOB="4800000010000305ff810000fddbdf2500000000", @ANYRES32=r2, @ANYBLOB="1748000040000200280012800a000100767863616e0000001800028014000100000000", @ANYRES32=r2], 0x48}, 0x1, 0x0, 0x0, 0x40}, 0x0) (async)

program crashed: KASAN: slab-use-after-free Read in dvb_device_open
testing program (duration=45s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): [19, 10, 8]
detailed listing:
executing program 3:
r0 = socket$inet6_tcp(0xa, 0x1, 0x0)
connect$inet6(r0, 0x0, 0x0)
gettid()
timer_settime(0x0, 0x0, &(0x7f0000000280)={{0x0, 0x989680}, {0x0, 0x989680}}, 0x0)
socketpair$unix(0x1, 0x0, 0x0, 0x0)
getsockopt$sock_cred(0xffffffffffffffff, 0x1, 0x11, 0x0, &(0x7f0000cab000))
setsockopt$sock_cred(0xffffffffffffffff, 0x1, 0x11, 0x0, 0x0)
setsockopt$inet6_tcp_TCP_REPAIR_QUEUE(r0, 0x6, 0x14, 0x0, 0x0)
mmap(&(0x7f0000000000/0x4000)=nil, 0x4000, 0x1, 0x10012, 0xffffffffffffffff, 0x5deba000)
mmap(&(0x7f0000bfe000/0x400000)=nil, 0x400000, 0x4, 0x40010, r0, 0xd1aa000)
mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x3, 0x8031, 0xffffffffffffffff, 0x0)
mmap$dsp(&(0x7f0000ffd000/0x2000)=nil, 0x2000, 0x100000b, 0x810, 0xffffffffffffffff, 0x0)
socket$xdp(0x2c, 0x3, 0x0)
r1 = socket$kcm(0xa, 0x2, 0x0)
r2 = socket(0x2, 0x80805, 0x0)
r3 = openat$fuse(0xffffffffffffff9c, &(0x7f0000000080), 0x2, 0x0)
read$FUSE(r3, &(0x7f0000000600)={0x2020}, 0x2020)
setsockopt$IP_VS_SO_SET_ADD(r2, 0x0, 0x482, &(0x7f0000000240)={0x84, @dev={0xac, 0x14, 0x14, 0x15}, 0x4e20, 0x3, 'wlc\x00', 0x2, 0x660f537e, 0x3}, 0x2c)
sendmsg$sock(r1, &(0x7f0000000400)={&(0x7f0000000580)=@in6={0x2, 0x4e20, 0x0, @dev={0xfe, 0x80, '\x00', 0xfd}}, 0x80, 0x0, 0x0, &(0x7f0000000000)=[@mark={{0x14, 0x1, 0x24, 0x3}}], 0x18}, 0x0)
executing program 3:
r0 = syz_usb_connect(0x0, 0x32, &(0x7f0000000000)=ANY=[@ANYBLOB="1201000200000040a61b01000100000000010902200001010080320904"], 0x0)
sendmsg$inet(0xffffffffffffffff, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)=[{&(0x7f0000000100)="5c00000012006bab9e3fe3d86e6c1d0000147ea60864160af36504b68675f8001d000a00a0e69ee517d34460bc24eab556a705251e6182949a36c23d3b48dfd8cdbf9367b4fa51f60a64c9f4080003680601000008000300ff000000", 0x5c}], 0x1, 0x0, 0x0, 0x1f00c00e}, 0x0)
r1 = syz_usb_connect$uac3(0x3, 0x80, &(0x7f0000000280)=ANY=[], 0x0)
syz_usb_control_io$printer(r0, 0x0, &(0x7f00000005c0)={0x34, &(0x7f00000003c0)=ANY=[], 0x0, 0x0, 0x0, 0x0, 0x0})
mkdirat(0xffffffffffffff9c, &(0x7f0000000200)='./file0\x00', 0x0)
sendmsg$inet(0xffffffffffffffff, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)=[{&(0x7f0000000100)="5c00000012006bab9e3fe3d86e6c1d0000147ea60864160af36504b68675f8001d000a00a0e69ee517d34460bc24eab556a705251e6182949a36c23d3b48dfd8cdbf9367b4fa51f60a64c9f4080003680601000008000300ff000000", 0x5c}], 0x1, 0x0, 0x0, 0x1f00c00e}, 0x0) (async)
syz_usb_connect$uac3(0x3, 0x80, &(0x7f0000000280)=ANY=[], 0x0) (async)
syz_usb_control_io$uac3(r1, 0x0, 0x0) (async)
syz_open_dev$dvb_frontend(&(0x7f0000000100), 0x1, 0x802) (async)
getsockopt$bt_hci(0xffffffffffffffff, 0x84, 0x81, &(0x7f0000001280)=""/4107, &(0x7f00000000c0)=0x100b) (async)
executing program 0:
syz_open_dev$dvb_frontend(&(0x7f0000000080), 0x0, 0x402)
r0 = socket$inet_mptcp(0x2, 0x1, 0x106)
r1 = socket(0x10, 0x803, 0x0)
syz_genetlink_get_family_id$tipc(&(0x7f0000000000), r1)
sendmsg$nl_route(r1, &(0x7f0000000240)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000580)=ANY=[@ANYBLOB="4800000010000305ff810000fddbdf2500000000", @ANYRES32, @ANYBLOB="1748000040000200280012800a000100767863616e0000001800028014000100000000", @ANYRES32], 0x48}, 0x1, 0x0, 0x0, 0x40}, 0x0)
connect$inet(r0, &(0x7f0000000000)={0x2, 0x4e22, @empty}, 0x10)
getsockname$packet(r1, &(0x7f0000000280)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) (async)
sendmsg$nl_route(r1, &(0x7f0000000240)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000580)=ANY=[@ANYBLOB="4800000010000305ff810000fddbdf2500000000", @ANYRES32, @ANYBLOB="1748000040000200280012800a000100767863616e0000001800028014000100000000", @ANYRES32], 0x48}, 0x1, 0x0, 0x0, 0x40}, 0x0) (async)

program did not crash
testing program (duration=45s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): [19, 10, 8]
detailed listing:
executing program 3:
r0 = socket$inet6_tcp(0xa, 0x1, 0x0)
connect$inet6(r0, 0x0, 0x0)
gettid()
timer_settime(0x0, 0x0, &(0x7f0000000280)={{0x0, 0x989680}, {0x0, 0x989680}}, 0x0)
socketpair$unix(0x1, 0x0, 0x0, 0x0)
getsockopt$sock_cred(0xffffffffffffffff, 0x1, 0x11, 0x0, &(0x7f0000cab000))
setsockopt$sock_cred(0xffffffffffffffff, 0x1, 0x11, 0x0, 0x0)
setsockopt$inet6_tcp_TCP_REPAIR_QUEUE(r0, 0x6, 0x14, 0x0, 0x0)
mmap(&(0x7f0000000000/0x4000)=nil, 0x4000, 0x1, 0x10012, 0xffffffffffffffff, 0x5deba000)
mmap(&(0x7f0000bfe000/0x400000)=nil, 0x400000, 0x4, 0x40010, r0, 0xd1aa000)
mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x3, 0x8031, 0xffffffffffffffff, 0x0)
mmap$dsp(&(0x7f0000ffd000/0x2000)=nil, 0x2000, 0x100000b, 0x810, 0xffffffffffffffff, 0x0)
socket$xdp(0x2c, 0x3, 0x0)
r1 = socket$kcm(0xa, 0x2, 0x0)
r2 = socket(0x2, 0x80805, 0x0)
r3 = openat$fuse(0xffffffffffffff9c, &(0x7f0000000080), 0x2, 0x0)
read$FUSE(r3, &(0x7f0000000600)={0x2020}, 0x2020)
setsockopt$IP_VS_SO_SET_ADD(r2, 0x0, 0x482, &(0x7f0000000240)={0x84, @dev={0xac, 0x14, 0x14, 0x15}, 0x4e20, 0x3, 'wlc\x00', 0x2, 0x660f537e, 0x3}, 0x2c)
sendmsg$sock(r1, &(0x7f0000000400)={&(0x7f0000000580)=@in6={0x2, 0x4e20, 0x0, @dev={0xfe, 0x80, '\x00', 0xfd}}, 0x80, 0x0, 0x0, &(0x7f0000000000)=[@mark={{0x14, 0x1, 0x24, 0x3}}], 0x18}, 0x0)
executing program 3:
r0 = syz_usb_connect(0x0, 0x32, &(0x7f0000000000)=ANY=[@ANYBLOB="1201000200000040a61b01000100000000010902200001010080320904"], 0x0)
sendmsg$inet(0xffffffffffffffff, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)=[{&(0x7f0000000100)="5c00000012006bab9e3fe3d86e6c1d0000147ea60864160af36504b68675f8001d000a00a0e69ee517d34460bc24eab556a705251e6182949a36c23d3b48dfd8cdbf9367b4fa51f60a64c9f4080003680601000008000300ff000000", 0x5c}], 0x1, 0x0, 0x0, 0x1f00c00e}, 0x0)
r1 = syz_usb_connect$uac3(0x3, 0x80, &(0x7f0000000280)=ANY=[], 0x0)
syz_usb_control_io$printer(r0, 0x0, &(0x7f00000005c0)={0x34, &(0x7f00000003c0)=ANY=[], 0x0, 0x0, 0x0, 0x0, 0x0})
mkdirat(0xffffffffffffff9c, &(0x7f0000000200)='./file0\x00', 0x0)
sendmsg$inet(0xffffffffffffffff, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)=[{&(0x7f0000000100)="5c00000012006bab9e3fe3d86e6c1d0000147ea60864160af36504b68675f8001d000a00a0e69ee517d34460bc24eab556a705251e6182949a36c23d3b48dfd8cdbf9367b4fa51f60a64c9f4080003680601000008000300ff000000", 0x5c}], 0x1, 0x0, 0x0, 0x1f00c00e}, 0x0) (async)
syz_usb_connect$uac3(0x3, 0x80, &(0x7f0000000280)=ANY=[], 0x0) (async)
syz_usb_control_io$uac3(r1, 0x0, 0x0) (async)
syz_open_dev$dvb_frontend(&(0x7f0000000100), 0x1, 0x802) (async)
getsockopt$bt_hci(0xffffffffffffffff, 0x84, 0x81, &(0x7f0000001280)=""/4107, &(0x7f00000000c0)=0x100b) (async)
executing program 0:
syz_open_dev$dvb_frontend(&(0x7f0000000080), 0x0, 0x402)
r0 = socket$inet_mptcp(0x2, 0x1, 0x106)
r1 = socket(0x10, 0x803, 0x0)
getsockname$packet(r1, &(0x7f0000000280)={0x11, 0x0, <r2=>0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14)
sendmsg$nl_route(r1, &(0x7f0000000240)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000580)=ANY=[@ANYBLOB="4800000010000305ff810000fddbdf2500000000", @ANYRES32=r2, @ANYBLOB="1748000040000200280012800a000100767863616e0000001800028014000100000000", @ANYRES32=r2], 0x48}, 0x1, 0x0, 0x0, 0x40}, 0x0)
connect$inet(r0, &(0x7f0000000000)={0x2, 0x4e22, @empty}, 0x10)
getsockname$packet(r1, &(0x7f0000000280)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) (async)
sendmsg$nl_route(r1, &(0x7f0000000240)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000580)=ANY=[@ANYBLOB="4800000010000305ff810000fddbdf2500000000", @ANYRES32=r2, @ANYBLOB="1748000040000200280012800a000100767863616e0000001800028014000100000000", @ANYRES32=r2], 0x48}, 0x1, 0x0, 0x0, 0x40}, 0x0) (async)

program crashed: KASAN: slab-use-after-free Read in dvb_device_open
testing program (duration=45s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): [19, 10, 7]
detailed listing:
executing program 3:
r0 = socket$inet6_tcp(0xa, 0x1, 0x0)
connect$inet6(r0, 0x0, 0x0)
gettid()
timer_settime(0x0, 0x0, &(0x7f0000000280)={{0x0, 0x989680}, {0x0, 0x989680}}, 0x0)
socketpair$unix(0x1, 0x0, 0x0, 0x0)
getsockopt$sock_cred(0xffffffffffffffff, 0x1, 0x11, 0x0, &(0x7f0000cab000))
setsockopt$sock_cred(0xffffffffffffffff, 0x1, 0x11, 0x0, 0x0)
setsockopt$inet6_tcp_TCP_REPAIR_QUEUE(r0, 0x6, 0x14, 0x0, 0x0)
mmap(&(0x7f0000000000/0x4000)=nil, 0x4000, 0x1, 0x10012, 0xffffffffffffffff, 0x5deba000)
mmap(&(0x7f0000bfe000/0x400000)=nil, 0x400000, 0x4, 0x40010, r0, 0xd1aa000)
mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x3, 0x8031, 0xffffffffffffffff, 0x0)
mmap$dsp(&(0x7f0000ffd000/0x2000)=nil, 0x2000, 0x100000b, 0x810, 0xffffffffffffffff, 0x0)
socket$xdp(0x2c, 0x3, 0x0)
r1 = socket$kcm(0xa, 0x2, 0x0)
r2 = socket(0x2, 0x80805, 0x0)
r3 = openat$fuse(0xffffffffffffff9c, &(0x7f0000000080), 0x2, 0x0)
read$FUSE(r3, &(0x7f0000000600)={0x2020}, 0x2020)
setsockopt$IP_VS_SO_SET_ADD(r2, 0x0, 0x482, &(0x7f0000000240)={0x84, @dev={0xac, 0x14, 0x14, 0x15}, 0x4e20, 0x3, 'wlc\x00', 0x2, 0x660f537e, 0x3}, 0x2c)
sendmsg$sock(r1, &(0x7f0000000400)={&(0x7f0000000580)=@in6={0x2, 0x4e20, 0x0, @dev={0xfe, 0x80, '\x00', 0xfd}}, 0x80, 0x0, 0x0, &(0x7f0000000000)=[@mark={{0x14, 0x1, 0x24, 0x3}}], 0x18}, 0x0)
executing program 3:
r0 = syz_usb_connect(0x0, 0x32, &(0x7f0000000000)=ANY=[@ANYBLOB="1201000200000040a61b01000100000000010902200001010080320904"], 0x0)
sendmsg$inet(0xffffffffffffffff, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)=[{&(0x7f0000000100)="5c00000012006bab9e3fe3d86e6c1d0000147ea60864160af36504b68675f8001d000a00a0e69ee517d34460bc24eab556a705251e6182949a36c23d3b48dfd8cdbf9367b4fa51f60a64c9f4080003680601000008000300ff000000", 0x5c}], 0x1, 0x0, 0x0, 0x1f00c00e}, 0x0)
r1 = syz_usb_connect$uac3(0x3, 0x80, &(0x7f0000000280)=ANY=[], 0x0)
syz_usb_control_io$printer(r0, 0x0, &(0x7f00000005c0)={0x34, &(0x7f00000003c0)=ANY=[], 0x0, 0x0, 0x0, 0x0, 0x0})
mkdirat(0xffffffffffffff9c, &(0x7f0000000200)='./file0\x00', 0x0)
sendmsg$inet(0xffffffffffffffff, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)=[{&(0x7f0000000100)="5c00000012006bab9e3fe3d86e6c1d0000147ea60864160af36504b68675f8001d000a00a0e69ee517d34460bc24eab556a705251e6182949a36c23d3b48dfd8cdbf9367b4fa51f60a64c9f4080003680601000008000300ff000000", 0x5c}], 0x1, 0x0, 0x0, 0x1f00c00e}, 0x0) (async)
syz_usb_connect$uac3(0x3, 0x80, &(0x7f0000000280)=ANY=[], 0x0) (async)
syz_usb_control_io$uac3(r1, 0x0, 0x0) (async)
syz_open_dev$dvb_frontend(&(0x7f0000000100), 0x1, 0x802) (async)
getsockopt$bt_hci(0xffffffffffffffff, 0x84, 0x81, &(0x7f0000001280)=""/4107, &(0x7f00000000c0)=0x100b) (async)
executing program 0:
syz_open_dev$dvb_frontend(&(0x7f0000000080), 0x0, 0x402)
r0 = socket$inet_mptcp(0x2, 0x1, 0x106)
getsockname$packet(0xffffffffffffffff, &(0x7f0000000280)={0x11, 0x0, <r1=>0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14)
sendmsg$nl_route(0xffffffffffffffff, &(0x7f0000000240)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000580)=ANY=[@ANYBLOB="4800000010000305ff810000fddbdf2500000000", @ANYRES32=r1, @ANYBLOB="1748000040000200280012800a000100767863616e0000001800028014000100000000", @ANYRES32=r1], 0x48}, 0x1, 0x0, 0x0, 0x40}, 0x0)
connect$inet(r0, &(0x7f0000000000)={0x2, 0x4e22, @empty}, 0x10)
getsockname$packet(0xffffffffffffffff, &(0x7f0000000280)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) (async)
sendmsg$nl_route(0xffffffffffffffff, &(0x7f0000000240)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000580)=ANY=[@ANYBLOB="4800000010000305ff810000fddbdf2500000000", @ANYRES32=r1, @ANYBLOB="1748000040000200280012800a000100767863616e0000001800028014000100000000", @ANYRES32=r1], 0x48}, 0x1, 0x0, 0x0, 0x40}, 0x0) (async)

program did not crash
testing program (duration=45s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): [19, 10, 7]
detailed listing:
executing program 3:
r0 = socket$inet6_tcp(0xa, 0x1, 0x0)
connect$inet6(r0, 0x0, 0x0)
gettid()
timer_settime(0x0, 0x0, &(0x7f0000000280)={{0x0, 0x989680}, {0x0, 0x989680}}, 0x0)
socketpair$unix(0x1, 0x0, 0x0, 0x0)
getsockopt$sock_cred(0xffffffffffffffff, 0x1, 0x11, 0x0, &(0x7f0000cab000))
setsockopt$sock_cred(0xffffffffffffffff, 0x1, 0x11, 0x0, 0x0)
setsockopt$inet6_tcp_TCP_REPAIR_QUEUE(r0, 0x6, 0x14, 0x0, 0x0)
mmap(&(0x7f0000000000/0x4000)=nil, 0x4000, 0x1, 0x10012, 0xffffffffffffffff, 0x5deba000)
mmap(&(0x7f0000bfe000/0x400000)=nil, 0x400000, 0x4, 0x40010, r0, 0xd1aa000)
mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x3, 0x8031, 0xffffffffffffffff, 0x0)
mmap$dsp(&(0x7f0000ffd000/0x2000)=nil, 0x2000, 0x100000b, 0x810, 0xffffffffffffffff, 0x0)
socket$xdp(0x2c, 0x3, 0x0)
r1 = socket$kcm(0xa, 0x2, 0x0)
r2 = socket(0x2, 0x80805, 0x0)
r3 = openat$fuse(0xffffffffffffff9c, &(0x7f0000000080), 0x2, 0x0)
read$FUSE(r3, &(0x7f0000000600)={0x2020}, 0x2020)
setsockopt$IP_VS_SO_SET_ADD(r2, 0x0, 0x482, &(0x7f0000000240)={0x84, @dev={0xac, 0x14, 0x14, 0x15}, 0x4e20, 0x3, 'wlc\x00', 0x2, 0x660f537e, 0x3}, 0x2c)
sendmsg$sock(r1, &(0x7f0000000400)={&(0x7f0000000580)=@in6={0x2, 0x4e20, 0x0, @dev={0xfe, 0x80, '\x00', 0xfd}}, 0x80, 0x0, 0x0, &(0x7f0000000000)=[@mark={{0x14, 0x1, 0x24, 0x3}}], 0x18}, 0x0)
executing program 3:
r0 = syz_usb_connect(0x0, 0x32, &(0x7f0000000000)=ANY=[@ANYBLOB="1201000200000040a61b01000100000000010902200001010080320904"], 0x0)
sendmsg$inet(0xffffffffffffffff, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)=[{&(0x7f0000000100)="5c00000012006bab9e3fe3d86e6c1d0000147ea60864160af36504b68675f8001d000a00a0e69ee517d34460bc24eab556a705251e6182949a36c23d3b48dfd8cdbf9367b4fa51f60a64c9f4080003680601000008000300ff000000", 0x5c}], 0x1, 0x0, 0x0, 0x1f00c00e}, 0x0)
r1 = syz_usb_connect$uac3(0x3, 0x80, &(0x7f0000000280)=ANY=[], 0x0)
syz_usb_control_io$printer(r0, 0x0, &(0x7f00000005c0)={0x34, &(0x7f00000003c0)=ANY=[], 0x0, 0x0, 0x0, 0x0, 0x0})
mkdirat(0xffffffffffffff9c, &(0x7f0000000200)='./file0\x00', 0x0)
sendmsg$inet(0xffffffffffffffff, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)=[{&(0x7f0000000100)="5c00000012006bab9e3fe3d86e6c1d0000147ea60864160af36504b68675f8001d000a00a0e69ee517d34460bc24eab556a705251e6182949a36c23d3b48dfd8cdbf9367b4fa51f60a64c9f4080003680601000008000300ff000000", 0x5c}], 0x1, 0x0, 0x0, 0x1f00c00e}, 0x0) (async)
syz_usb_connect$uac3(0x3, 0x80, &(0x7f0000000280)=ANY=[], 0x0) (async)
syz_usb_control_io$uac3(r1, 0x0, 0x0) (async)
syz_open_dev$dvb_frontend(&(0x7f0000000100), 0x1, 0x802) (async)
getsockopt$bt_hci(0xffffffffffffffff, 0x84, 0x81, &(0x7f0000001280)=""/4107, &(0x7f00000000c0)=0x100b) (async)
executing program 0:
syz_open_dev$dvb_frontend(&(0x7f0000000080), 0x0, 0x402)
r0 = socket(0x10, 0x803, 0x0)
getsockname$packet(r0, &(0x7f0000000280)={0x11, 0x0, <r1=>0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14)
sendmsg$nl_route(r0, &(0x7f0000000240)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000580)=ANY=[@ANYBLOB="4800000010000305ff810000fddbdf2500000000", @ANYRES32=r1, @ANYBLOB="1748000040000200280012800a000100767863616e0000001800028014000100000000", @ANYRES32=r1], 0x48}, 0x1, 0x0, 0x0, 0x40}, 0x0)
connect$inet(0xffffffffffffffff, &(0x7f0000000000)={0x2, 0x4e22, @empty}, 0x10)
getsockname$packet(r0, &(0x7f0000000280)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) (async)
sendmsg$nl_route(r0, &(0x7f0000000240)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000580)=ANY=[@ANYBLOB="4800000010000305ff810000fddbdf2500000000", @ANYRES32=r1, @ANYBLOB="1748000040000200280012800a000100767863616e0000001800028014000100000000", @ANYRES32=r1], 0x48}, 0x1, 0x0, 0x0, 0x40}, 0x0) (async)

program did not crash
testing program (duration=45s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): [19, 10, 7]
detailed listing:
executing program 3:
r0 = socket$inet6_tcp(0xa, 0x1, 0x0)
connect$inet6(r0, 0x0, 0x0)
gettid()
timer_settime(0x0, 0x0, &(0x7f0000000280)={{0x0, 0x989680}, {0x0, 0x989680}}, 0x0)
socketpair$unix(0x1, 0x0, 0x0, 0x0)
getsockopt$sock_cred(0xffffffffffffffff, 0x1, 0x11, 0x0, &(0x7f0000cab000))
setsockopt$sock_cred(0xffffffffffffffff, 0x1, 0x11, 0x0, 0x0)
setsockopt$inet6_tcp_TCP_REPAIR_QUEUE(r0, 0x6, 0x14, 0x0, 0x0)
mmap(&(0x7f0000000000/0x4000)=nil, 0x4000, 0x1, 0x10012, 0xffffffffffffffff, 0x5deba000)
mmap(&(0x7f0000bfe000/0x400000)=nil, 0x400000, 0x4, 0x40010, r0, 0xd1aa000)
mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x3, 0x8031, 0xffffffffffffffff, 0x0)
mmap$dsp(&(0x7f0000ffd000/0x2000)=nil, 0x2000, 0x100000b, 0x810, 0xffffffffffffffff, 0x0)
socket$xdp(0x2c, 0x3, 0x0)
r1 = socket$kcm(0xa, 0x2, 0x0)
r2 = socket(0x2, 0x80805, 0x0)
r3 = openat$fuse(0xffffffffffffff9c, &(0x7f0000000080), 0x2, 0x0)
read$FUSE(r3, &(0x7f0000000600)={0x2020}, 0x2020)
setsockopt$IP_VS_SO_SET_ADD(r2, 0x0, 0x482, &(0x7f0000000240)={0x84, @dev={0xac, 0x14, 0x14, 0x15}, 0x4e20, 0x3, 'wlc\x00', 0x2, 0x660f537e, 0x3}, 0x2c)
sendmsg$sock(r1, &(0x7f0000000400)={&(0x7f0000000580)=@in6={0x2, 0x4e20, 0x0, @dev={0xfe, 0x80, '\x00', 0xfd}}, 0x80, 0x0, 0x0, &(0x7f0000000000)=[@mark={{0x14, 0x1, 0x24, 0x3}}], 0x18}, 0x0)
executing program 3:
r0 = syz_usb_connect(0x0, 0x32, &(0x7f0000000000)=ANY=[@ANYBLOB="1201000200000040a61b01000100000000010902200001010080320904"], 0x0)
sendmsg$inet(0xffffffffffffffff, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)=[{&(0x7f0000000100)="5c00000012006bab9e3fe3d86e6c1d0000147ea60864160af36504b68675f8001d000a00a0e69ee517d34460bc24eab556a705251e6182949a36c23d3b48dfd8cdbf9367b4fa51f60a64c9f4080003680601000008000300ff000000", 0x5c}], 0x1, 0x0, 0x0, 0x1f00c00e}, 0x0)
r1 = syz_usb_connect$uac3(0x3, 0x80, &(0x7f0000000280)=ANY=[], 0x0)
syz_usb_control_io$printer(r0, 0x0, &(0x7f00000005c0)={0x34, &(0x7f00000003c0)=ANY=[], 0x0, 0x0, 0x0, 0x0, 0x0})
mkdirat(0xffffffffffffff9c, &(0x7f0000000200)='./file0\x00', 0x0)
sendmsg$inet(0xffffffffffffffff, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)=[{&(0x7f0000000100)="5c00000012006bab9e3fe3d86e6c1d0000147ea60864160af36504b68675f8001d000a00a0e69ee517d34460bc24eab556a705251e6182949a36c23d3b48dfd8cdbf9367b4fa51f60a64c9f4080003680601000008000300ff000000", 0x5c}], 0x1, 0x0, 0x0, 0x1f00c00e}, 0x0) (async)
syz_usb_connect$uac3(0x3, 0x80, &(0x7f0000000280)=ANY=[], 0x0) (async)
syz_usb_control_io$uac3(r1, 0x0, 0x0) (async)
syz_open_dev$dvb_frontend(&(0x7f0000000100), 0x1, 0x802) (async)
getsockopt$bt_hci(0xffffffffffffffff, 0x84, 0x81, &(0x7f0000001280)=""/4107, &(0x7f00000000c0)=0x100b) (async)
executing program 0:
r0 = socket$inet_mptcp(0x2, 0x1, 0x106)
r1 = socket(0x10, 0x803, 0x0)
getsockname$packet(r1, &(0x7f0000000280)={0x11, 0x0, <r2=>0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14)
sendmsg$nl_route(r1, &(0x7f0000000240)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000580)=ANY=[@ANYBLOB="4800000010000305ff810000fddbdf2500000000", @ANYRES32=r2, @ANYBLOB="1748000040000200280012800a000100767863616e0000001800028014000100000000", @ANYRES32=r2], 0x48}, 0x1, 0x0, 0x0, 0x40}, 0x0)
connect$inet(r0, &(0x7f0000000000)={0x2, 0x4e22, @empty}, 0x10)
getsockname$packet(r1, &(0x7f0000000280)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) (async)
sendmsg$nl_route(r1, &(0x7f0000000240)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000580)=ANY=[@ANYBLOB="4800000010000305ff810000fddbdf2500000000", @ANYRES32=r2, @ANYBLOB="1748000040000200280012800a000100767863616e0000001800028014000100000000", @ANYRES32=r2], 0x48}, 0x1, 0x0, 0x0, 0x40}, 0x0) (async)

program did not crash
minimized 20 calls -> 8 calls
testing program (duration=45s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): socket$inet6_tcp-connect$inet6-gettid-timer_settime-socketpair$unix-getsockopt$sock_cred-setsockopt$sock_cred-setsockopt$inet6_tcp_TCP_REPAIR_QUEUE-mmap-mmap-mmap-mmap$dsp-socket$xdp-socket$kcm-socket-openat$fuse-read$FUSE-setsockopt$IP_VS_SO_SET_ADD-sendmsg$sock-syz_usb_connect-sendmsg$inet-syz_usb_connect$uac3-syz_usb_control_io$printer-mkdirat-sendmsg$inet-syz_usb_connect$uac3-syz_usb_control_io$uac3-syz_open_dev$dvb_frontend-getsockopt$bt_hci-syz_open_dev$dvb_frontend-socket$inet_mptcp-socket-getsockname$packet-sendmsg$nl_route-connect$inet-getsockname$packet-sendmsg$nl_route
detailed listing:
executing program 0:
r0 = socket$inet6_tcp(0xa, 0x1, 0x0)
connect$inet6(r0, 0x0, 0x0)
gettid()
timer_settime(0x0, 0x0, &(0x7f0000000280)={{0x0, 0x989680}, {0x0, 0x989680}}, 0x0)
socketpair$unix(0x1, 0x0, 0x0, 0x0)
getsockopt$sock_cred(0xffffffffffffffff, 0x1, 0x11, 0x0, &(0x7f0000cab000))
setsockopt$sock_cred(0xffffffffffffffff, 0x1, 0x11, 0x0, 0x0)
setsockopt$inet6_tcp_TCP_REPAIR_QUEUE(r0, 0x6, 0x14, 0x0, 0x0)
mmap(&(0x7f0000000000/0x4000)=nil, 0x4000, 0x1, 0x10012, 0xffffffffffffffff, 0x5deba000)
mmap(&(0x7f0000bfe000/0x400000)=nil, 0x400000, 0x4, 0x40010, r0, 0xd1aa000)
mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x3, 0x8031, 0xffffffffffffffff, 0x0)
mmap$dsp(&(0x7f0000ffd000/0x2000)=nil, 0x2000, 0x100000b, 0x810, 0xffffffffffffffff, 0x0)
socket$xdp(0x2c, 0x3, 0x0)
r1 = socket$kcm(0xa, 0x2, 0x0)
r2 = socket(0x2, 0x80805, 0x0)
r3 = openat$fuse(0xffffffffffffff9c, &(0x7f0000000080), 0x2, 0x0)
read$FUSE(r3, &(0x7f0000000600)={0x2020}, 0x2020)
setsockopt$IP_VS_SO_SET_ADD(r2, 0x0, 0x482, &(0x7f0000000240)={0x84, @dev={0xac, 0x14, 0x14, 0x15}, 0x4e20, 0x3, 'wlc\x00', 0x2, 0x660f537e, 0x3}, 0x2c)
sendmsg$sock(r1, &(0x7f0000000400)={&(0x7f0000000580)=@in6={0x2, 0x4e20, 0x0, @dev={0xfe, 0x80, '\x00', 0xfd}}, 0x80, 0x0, 0x0, &(0x7f0000000000)=[@mark={{0x14, 0x1, 0x24, 0x3}}], 0x18}, 0x0)
r4 = syz_usb_connect(0x0, 0x32, &(0x7f0000000000)=ANY=[@ANYBLOB="1201000200000040a61b01000100000000010902200001010080320904"], 0x0)
sendmsg$inet(0xffffffffffffffff, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)=[{&(0x7f0000000100)="5c00000012006bab9e3fe3d86e6c1d0000147ea60864160af36504b68675f8001d000a00a0e69ee517d34460bc24eab556a705251e6182949a36c23d3b48dfd8cdbf9367b4fa51f60a64c9f4080003680601000008000300ff000000", 0x5c}], 0x1, 0x0, 0x0, 0x1f00c00e}, 0x0)
r5 = syz_usb_connect$uac3(0x3, 0x80, &(0x7f0000000280)=ANY=[], 0x0)
syz_usb_control_io$printer(r4, 0x0, &(0x7f00000005c0)={0x34, &(0x7f00000003c0)=ANY=[], 0x0, 0x0, 0x0, 0x0, 0x0})
mkdirat(0xffffffffffffff9c, &(0x7f0000000200)='./file0\x00', 0x0)
sendmsg$inet(0xffffffffffffffff, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)=[{&(0x7f0000000100)="5c00000012006bab9e3fe3d86e6c1d0000147ea60864160af36504b68675f8001d000a00a0e69ee517d34460bc24eab556a705251e6182949a36c23d3b48dfd8cdbf9367b4fa51f60a64c9f4080003680601000008000300ff000000", 0x5c}], 0x1, 0x0, 0x0, 0x1f00c00e}, 0x0) (async)
syz_usb_connect$uac3(0x3, 0x80, &(0x7f0000000280)=ANY=[], 0x0) (async)
syz_usb_control_io$uac3(r5, 0x0, 0x0) (async)
syz_open_dev$dvb_frontend(&(0x7f0000000100), 0x1, 0x802) (async)
getsockopt$bt_hci(0xffffffffffffffff, 0x84, 0x81, &(0x7f0000001280)=""/4107, &(0x7f00000000c0)=0x100b) (async)
syz_open_dev$dvb_frontend(&(0x7f0000000080), 0x0, 0x402)
r6 = socket$inet_mptcp(0x2, 0x1, 0x106)
r7 = socket(0x10, 0x803, 0x0)
getsockname$packet(r7, &(0x7f0000000280)={0x11, 0x0, <r8=>0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14)
sendmsg$nl_route(r7, &(0x7f0000000240)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000580)=ANY=[@ANYBLOB="4800000010000305ff810000fddbdf2500000000", @ANYRES32=r8, @ANYBLOB="1748000040000200280012800a000100767863616e0000001800028014000100000000", @ANYRES32=r8], 0x48}, 0x1, 0x0, 0x0, 0x40}, 0x0)
connect$inet(r6, &(0x7f0000000000)={0x2, 0x4e22, @empty}, 0x10)
getsockname$packet(r7, &(0x7f0000000280)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) (async)
sendmsg$nl_route(r7, &(0x7f0000000240)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000580)=ANY=[@ANYBLOB="4800000010000305ff810000fddbdf2500000000", @ANYRES32=r8, @ANYBLOB="1748000040000200280012800a000100767863616e0000001800028014000100000000", @ANYRES32=r8], 0x48}, 0x1, 0x0, 0x0, 0x40}, 0x0) (async)

program crashed: KASAN: slab-use-after-free Read in dvb_device_open
bisect: concatenation succeeded
found reproducer with 37 syscalls
minimizing guilty program
testing program (duration=45s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): socket$inet6_tcp-connect$inet6-gettid-timer_settime-socketpair$unix-getsockopt$sock_cred-setsockopt$sock_cred-setsockopt$inet6_tcp_TCP_REPAIR_QUEUE-mmap-mmap-mmap-mmap$dsp-socket$xdp-socket$kcm-socket-openat$fuse-read$FUSE-setsockopt$IP_VS_SO_SET_ADD-sendmsg$sock-syz_usb_connect-sendmsg$inet-syz_usb_connect$uac3-syz_usb_control_io$printer-mkdirat-sendmsg$inet-syz_usb_connect$uac3-syz_usb_control_io$uac3-syz_open_dev$dvb_frontend-getsockopt$bt_hci-syz_open_dev$dvb_frontend-socket$inet_mptcp-socket-getsockname$packet-sendmsg$nl_route-connect$inet-getsockname$packet
detailed listing:
executing program 0:
r0 = socket$inet6_tcp(0xa, 0x1, 0x0)
connect$inet6(r0, 0x0, 0x0)
gettid()
timer_settime(0x0, 0x0, &(0x7f0000000280)={{0x0, 0x989680}, {0x0, 0x989680}}, 0x0)
socketpair$unix(0x1, 0x0, 0x0, 0x0)
getsockopt$sock_cred(0xffffffffffffffff, 0x1, 0x11, 0x0, &(0x7f0000cab000))
setsockopt$sock_cred(0xffffffffffffffff, 0x1, 0x11, 0x0, 0x0)
setsockopt$inet6_tcp_TCP_REPAIR_QUEUE(r0, 0x6, 0x14, 0x0, 0x0)
mmap(&(0x7f0000000000/0x4000)=nil, 0x4000, 0x1, 0x10012, 0xffffffffffffffff, 0x5deba000)
mmap(&(0x7f0000bfe000/0x400000)=nil, 0x400000, 0x4, 0x40010, r0, 0xd1aa000)
mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x3, 0x8031, 0xffffffffffffffff, 0x0)
mmap$dsp(&(0x7f0000ffd000/0x2000)=nil, 0x2000, 0x100000b, 0x810, 0xffffffffffffffff, 0x0)
socket$xdp(0x2c, 0x3, 0x0)
r1 = socket$kcm(0xa, 0x2, 0x0)
r2 = socket(0x2, 0x80805, 0x0)
r3 = openat$fuse(0xffffffffffffff9c, &(0x7f0000000080), 0x2, 0x0)
read$FUSE(r3, &(0x7f0000000600)={0x2020}, 0x2020)
setsockopt$IP_VS_SO_SET_ADD(r2, 0x0, 0x482, &(0x7f0000000240)={0x84, @dev={0xac, 0x14, 0x14, 0x15}, 0x4e20, 0x3, 'wlc\x00', 0x2, 0x660f537e, 0x3}, 0x2c)
sendmsg$sock(r1, &(0x7f0000000400)={&(0x7f0000000580)=@in6={0x2, 0x4e20, 0x0, @dev={0xfe, 0x80, '\x00', 0xfd}}, 0x80, 0x0, 0x0, &(0x7f0000000000)=[@mark={{0x14, 0x1, 0x24, 0x3}}], 0x18}, 0x0)
r4 = syz_usb_connect(0x0, 0x32, &(0x7f0000000000)=ANY=[@ANYBLOB="1201000200000040a61b01000100000000010902200001010080320904"], 0x0)
sendmsg$inet(0xffffffffffffffff, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)=[{&(0x7f0000000100)="5c00000012006bab9e3fe3d86e6c1d0000147ea60864160af36504b68675f8001d000a00a0e69ee517d34460bc24eab556a705251e6182949a36c23d3b48dfd8cdbf9367b4fa51f60a64c9f4080003680601000008000300ff000000", 0x5c}], 0x1, 0x0, 0x0, 0x1f00c00e}, 0x0)
r5 = syz_usb_connect$uac3(0x3, 0x80, &(0x7f0000000280)=ANY=[], 0x0)
syz_usb_control_io$printer(r4, 0x0, &(0x7f00000005c0)={0x34, &(0x7f00000003c0)=ANY=[], 0x0, 0x0, 0x0, 0x0, 0x0})
mkdirat(0xffffffffffffff9c, &(0x7f0000000200)='./file0\x00', 0x0)
sendmsg$inet(0xffffffffffffffff, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)=[{&(0x7f0000000100)="5c00000012006bab9e3fe3d86e6c1d0000147ea60864160af36504b68675f8001d000a00a0e69ee517d34460bc24eab556a705251e6182949a36c23d3b48dfd8cdbf9367b4fa51f60a64c9f4080003680601000008000300ff000000", 0x5c}], 0x1, 0x0, 0x0, 0x1f00c00e}, 0x0) (async)
syz_usb_connect$uac3(0x3, 0x80, &(0x7f0000000280)=ANY=[], 0x0) (async)
syz_usb_control_io$uac3(r5, 0x0, 0x0) (async)
syz_open_dev$dvb_frontend(&(0x7f0000000100), 0x1, 0x802) (async)
getsockopt$bt_hci(0xffffffffffffffff, 0x84, 0x81, &(0x7f0000001280)=""/4107, &(0x7f00000000c0)=0x100b) (async)
syz_open_dev$dvb_frontend(&(0x7f0000000080), 0x0, 0x402)
r6 = socket$inet_mptcp(0x2, 0x1, 0x106)
r7 = socket(0x10, 0x803, 0x0)
getsockname$packet(r7, &(0x7f0000000280)={0x11, 0x0, <r8=>0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14)
sendmsg$nl_route(r7, &(0x7f0000000240)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000580)=ANY=[@ANYBLOB="4800000010000305ff810000fddbdf2500000000", @ANYRES32=r8, @ANYBLOB="1748000040000200280012800a000100767863616e0000001800028014000100000000", @ANYRES32=r8], 0x48}, 0x1, 0x0, 0x0, 0x40}, 0x0)
connect$inet(r6, &(0x7f0000000000)={0x2, 0x4e22, @empty}, 0x10)
getsockname$packet(r7, &(0x7f0000000280)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) (async)

program crashed: KASAN: slab-use-after-free Read in dvb_device_open
testing program (duration=45s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): socket$inet6_tcp-connect$inet6-gettid-timer_settime-socketpair$unix-getsockopt$sock_cred-setsockopt$sock_cred-setsockopt$inet6_tcp_TCP_REPAIR_QUEUE-mmap-mmap-mmap-mmap$dsp-socket$xdp-socket$kcm-socket-openat$fuse-read$FUSE-setsockopt$IP_VS_SO_SET_ADD-sendmsg$sock-syz_usb_connect-sendmsg$inet-syz_usb_connect$uac3-syz_usb_control_io$printer-mkdirat-sendmsg$inet-syz_usb_connect$uac3-syz_usb_control_io$uac3-syz_open_dev$dvb_frontend-getsockopt$bt_hci-syz_open_dev$dvb_frontend-socket$inet_mptcp-socket-getsockname$packet-sendmsg$nl_route-connect$inet
detailed listing:
executing program 0:
r0 = socket$inet6_tcp(0xa, 0x1, 0x0)
connect$inet6(r0, 0x0, 0x0)
gettid()
timer_settime(0x0, 0x0, &(0x7f0000000280)={{0x0, 0x989680}, {0x0, 0x989680}}, 0x0)
socketpair$unix(0x1, 0x0, 0x0, 0x0)
getsockopt$sock_cred(0xffffffffffffffff, 0x1, 0x11, 0x0, &(0x7f0000cab000))
setsockopt$sock_cred(0xffffffffffffffff, 0x1, 0x11, 0x0, 0x0)
setsockopt$inet6_tcp_TCP_REPAIR_QUEUE(r0, 0x6, 0x14, 0x0, 0x0)
mmap(&(0x7f0000000000/0x4000)=nil, 0x4000, 0x1, 0x10012, 0xffffffffffffffff, 0x5deba000)
mmap(&(0x7f0000bfe000/0x400000)=nil, 0x400000, 0x4, 0x40010, r0, 0xd1aa000)
mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x3, 0x8031, 0xffffffffffffffff, 0x0)
mmap$dsp(&(0x7f0000ffd000/0x2000)=nil, 0x2000, 0x100000b, 0x810, 0xffffffffffffffff, 0x0)
socket$xdp(0x2c, 0x3, 0x0)
r1 = socket$kcm(0xa, 0x2, 0x0)
r2 = socket(0x2, 0x80805, 0x0)
r3 = openat$fuse(0xffffffffffffff9c, &(0x7f0000000080), 0x2, 0x0)
read$FUSE(r3, &(0x7f0000000600)={0x2020}, 0x2020)
setsockopt$IP_VS_SO_SET_ADD(r2, 0x0, 0x482, &(0x7f0000000240)={0x84, @dev={0xac, 0x14, 0x14, 0x15}, 0x4e20, 0x3, 'wlc\x00', 0x2, 0x660f537e, 0x3}, 0x2c)
sendmsg$sock(r1, &(0x7f0000000400)={&(0x7f0000000580)=@in6={0x2, 0x4e20, 0x0, @dev={0xfe, 0x80, '\x00', 0xfd}}, 0x80, 0x0, 0x0, &(0x7f0000000000)=[@mark={{0x14, 0x1, 0x24, 0x3}}], 0x18}, 0x0)
r4 = syz_usb_connect(0x0, 0x32, &(0x7f0000000000)=ANY=[@ANYBLOB="1201000200000040a61b01000100000000010902200001010080320904"], 0x0)
sendmsg$inet(0xffffffffffffffff, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)=[{&(0x7f0000000100)="5c00000012006bab9e3fe3d86e6c1d0000147ea60864160af36504b68675f8001d000a00a0e69ee517d34460bc24eab556a705251e6182949a36c23d3b48dfd8cdbf9367b4fa51f60a64c9f4080003680601000008000300ff000000", 0x5c}], 0x1, 0x0, 0x0, 0x1f00c00e}, 0x0)
r5 = syz_usb_connect$uac3(0x3, 0x80, &(0x7f0000000280)=ANY=[], 0x0)
syz_usb_control_io$printer(r4, 0x0, &(0x7f00000005c0)={0x34, &(0x7f00000003c0)=ANY=[], 0x0, 0x0, 0x0, 0x0, 0x0})
mkdirat(0xffffffffffffff9c, &(0x7f0000000200)='./file0\x00', 0x0)
sendmsg$inet(0xffffffffffffffff, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)=[{&(0x7f0000000100)="5c00000012006bab9e3fe3d86e6c1d0000147ea60864160af36504b68675f8001d000a00a0e69ee517d34460bc24eab556a705251e6182949a36c23d3b48dfd8cdbf9367b4fa51f60a64c9f4080003680601000008000300ff000000", 0x5c}], 0x1, 0x0, 0x0, 0x1f00c00e}, 0x0) (async)
syz_usb_connect$uac3(0x3, 0x80, &(0x7f0000000280)=ANY=[], 0x0) (async)
syz_usb_control_io$uac3(r5, 0x0, 0x0) (async)
syz_open_dev$dvb_frontend(&(0x7f0000000100), 0x1, 0x802) (async)
getsockopt$bt_hci(0xffffffffffffffff, 0x84, 0x81, &(0x7f0000001280)=""/4107, &(0x7f00000000c0)=0x100b) (async)
syz_open_dev$dvb_frontend(&(0x7f0000000080), 0x0, 0x402)
r6 = socket$inet_mptcp(0x2, 0x1, 0x106)
r7 = socket(0x10, 0x803, 0x0)
getsockname$packet(r7, &(0x7f0000000280)={0x11, 0x0, <r8=>0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14)
sendmsg$nl_route(r7, &(0x7f0000000240)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000580)=ANY=[@ANYBLOB="4800000010000305ff810000fddbdf2500000000", @ANYRES32=r8, @ANYBLOB="1748000040000200280012800a000100767863616e0000001800028014000100000000", @ANYRES32=r8], 0x48}, 0x1, 0x0, 0x0, 0x40}, 0x0)
connect$inet(r6, &(0x7f0000000000)={0x2, 0x4e22, @empty}, 0x10)

program crashed: KASAN: slab-use-after-free Read in dvb_device_open
testing program (duration=45s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): socket$inet6_tcp-connect$inet6-gettid-timer_settime-socketpair$unix-getsockopt$sock_cred-setsockopt$sock_cred-setsockopt$inet6_tcp_TCP_REPAIR_QUEUE-mmap-mmap-mmap-mmap$dsp-socket$xdp-socket$kcm-socket-openat$fuse-read$FUSE-setsockopt$IP_VS_SO_SET_ADD-sendmsg$sock-syz_usb_connect-sendmsg$inet-syz_usb_connect$uac3-syz_usb_control_io$printer-mkdirat-sendmsg$inet-syz_usb_connect$uac3-syz_usb_control_io$uac3-syz_open_dev$dvb_frontend-getsockopt$bt_hci-syz_open_dev$dvb_frontend-socket$inet_mptcp-socket-getsockname$packet-sendmsg$nl_route
detailed listing:
executing program 0:
r0 = socket$inet6_tcp(0xa, 0x1, 0x0)
connect$inet6(r0, 0x0, 0x0)
gettid()
timer_settime(0x0, 0x0, &(0x7f0000000280)={{0x0, 0x989680}, {0x0, 0x989680}}, 0x0)
socketpair$unix(0x1, 0x0, 0x0, 0x0)
getsockopt$sock_cred(0xffffffffffffffff, 0x1, 0x11, 0x0, &(0x7f0000cab000))
setsockopt$sock_cred(0xffffffffffffffff, 0x1, 0x11, 0x0, 0x0)
setsockopt$inet6_tcp_TCP_REPAIR_QUEUE(r0, 0x6, 0x14, 0x0, 0x0)
mmap(&(0x7f0000000000/0x4000)=nil, 0x4000, 0x1, 0x10012, 0xffffffffffffffff, 0x5deba000)
mmap(&(0x7f0000bfe000/0x400000)=nil, 0x400000, 0x4, 0x40010, r0, 0xd1aa000)
mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x3, 0x8031, 0xffffffffffffffff, 0x0)
mmap$dsp(&(0x7f0000ffd000/0x2000)=nil, 0x2000, 0x100000b, 0x810, 0xffffffffffffffff, 0x0)
socket$xdp(0x2c, 0x3, 0x0)
r1 = socket$kcm(0xa, 0x2, 0x0)
r2 = socket(0x2, 0x80805, 0x0)
r3 = openat$fuse(0xffffffffffffff9c, &(0x7f0000000080), 0x2, 0x0)
read$FUSE(r3, &(0x7f0000000600)={0x2020}, 0x2020)
setsockopt$IP_VS_SO_SET_ADD(r2, 0x0, 0x482, &(0x7f0000000240)={0x84, @dev={0xac, 0x14, 0x14, 0x15}, 0x4e20, 0x3, 'wlc\x00', 0x2, 0x660f537e, 0x3}, 0x2c)
sendmsg$sock(r1, &(0x7f0000000400)={&(0x7f0000000580)=@in6={0x2, 0x4e20, 0x0, @dev={0xfe, 0x80, '\x00', 0xfd}}, 0x80, 0x0, 0x0, &(0x7f0000000000)=[@mark={{0x14, 0x1, 0x24, 0x3}}], 0x18}, 0x0)
r4 = syz_usb_connect(0x0, 0x32, &(0x7f0000000000)=ANY=[@ANYBLOB="1201000200000040a61b01000100000000010902200001010080320904"], 0x0)
sendmsg$inet(0xffffffffffffffff, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)=[{&(0x7f0000000100)="5c00000012006bab9e3fe3d86e6c1d0000147ea60864160af36504b68675f8001d000a00a0e69ee517d34460bc24eab556a705251e6182949a36c23d3b48dfd8cdbf9367b4fa51f60a64c9f4080003680601000008000300ff000000", 0x5c}], 0x1, 0x0, 0x0, 0x1f00c00e}, 0x0)
r5 = syz_usb_connect$uac3(0x3, 0x80, &(0x7f0000000280)=ANY=[], 0x0)
syz_usb_control_io$printer(r4, 0x0, &(0x7f00000005c0)={0x34, &(0x7f00000003c0)=ANY=[], 0x0, 0x0, 0x0, 0x0, 0x0})
mkdirat(0xffffffffffffff9c, &(0x7f0000000200)='./file0\x00', 0x0)
sendmsg$inet(0xffffffffffffffff, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)=[{&(0x7f0000000100)="5c00000012006bab9e3fe3d86e6c1d0000147ea60864160af36504b68675f8001d000a00a0e69ee517d34460bc24eab556a705251e6182949a36c23d3b48dfd8cdbf9367b4fa51f60a64c9f4080003680601000008000300ff000000", 0x5c}], 0x1, 0x0, 0x0, 0x1f00c00e}, 0x0) (async)
syz_usb_connect$uac3(0x3, 0x80, &(0x7f0000000280)=ANY=[], 0x0) (async)
syz_usb_control_io$uac3(r5, 0x0, 0x0) (async)
syz_open_dev$dvb_frontend(&(0x7f0000000100), 0x1, 0x802) (async)
getsockopt$bt_hci(0xffffffffffffffff, 0x84, 0x81, &(0x7f0000001280)=""/4107, &(0x7f00000000c0)=0x100b) (async)
syz_open_dev$dvb_frontend(&(0x7f0000000080), 0x0, 0x402)
socket$inet_mptcp(0x2, 0x1, 0x106)
r6 = socket(0x10, 0x803, 0x0)
getsockname$packet(r6, &(0x7f0000000280)={0x11, 0x0, <r7=>0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14)
sendmsg$nl_route(r6, &(0x7f0000000240)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000580)=ANY=[@ANYBLOB="4800000010000305ff810000fddbdf2500000000", @ANYRES32=r7, @ANYBLOB="1748000040000200280012800a000100767863616e0000001800028014000100000000", @ANYRES32=r7], 0x48}, 0x1, 0x0, 0x0, 0x40}, 0x0)

program crashed: KASAN: slab-use-after-free Read in dvb_device_open
testing program (duration=45s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): socket$inet6_tcp-connect$inet6-gettid-timer_settime-socketpair$unix-getsockopt$sock_cred-setsockopt$sock_cred-setsockopt$inet6_tcp_TCP_REPAIR_QUEUE-mmap-mmap-mmap-mmap$dsp-socket$xdp-socket$kcm-socket-openat$fuse-read$FUSE-setsockopt$IP_VS_SO_SET_ADD-sendmsg$sock-syz_usb_connect-sendmsg$inet-syz_usb_connect$uac3-syz_usb_control_io$printer-mkdirat-sendmsg$inet-syz_usb_connect$uac3-syz_usb_control_io$uac3-syz_open_dev$dvb_frontend-getsockopt$bt_hci-syz_open_dev$dvb_frontend-socket$inet_mptcp-socket-getsockname$packet
detailed listing:
executing program 0:
r0 = socket$inet6_tcp(0xa, 0x1, 0x0)
connect$inet6(r0, 0x0, 0x0)
gettid()
timer_settime(0x0, 0x0, &(0x7f0000000280)={{0x0, 0x989680}, {0x0, 0x989680}}, 0x0)
socketpair$unix(0x1, 0x0, 0x0, 0x0)
getsockopt$sock_cred(0xffffffffffffffff, 0x1, 0x11, 0x0, &(0x7f0000cab000))
setsockopt$sock_cred(0xffffffffffffffff, 0x1, 0x11, 0x0, 0x0)
setsockopt$inet6_tcp_TCP_REPAIR_QUEUE(r0, 0x6, 0x14, 0x0, 0x0)
mmap(&(0x7f0000000000/0x4000)=nil, 0x4000, 0x1, 0x10012, 0xffffffffffffffff, 0x5deba000)
mmap(&(0x7f0000bfe000/0x400000)=nil, 0x400000, 0x4, 0x40010, r0, 0xd1aa000)
mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x3, 0x8031, 0xffffffffffffffff, 0x0)
mmap$dsp(&(0x7f0000ffd000/0x2000)=nil, 0x2000, 0x100000b, 0x810, 0xffffffffffffffff, 0x0)
socket$xdp(0x2c, 0x3, 0x0)
r1 = socket$kcm(0xa, 0x2, 0x0)
r2 = socket(0x2, 0x80805, 0x0)
r3 = openat$fuse(0xffffffffffffff9c, &(0x7f0000000080), 0x2, 0x0)
read$FUSE(r3, &(0x7f0000000600)={0x2020}, 0x2020)
setsockopt$IP_VS_SO_SET_ADD(r2, 0x0, 0x482, &(0x7f0000000240)={0x84, @dev={0xac, 0x14, 0x14, 0x15}, 0x4e20, 0x3, 'wlc\x00', 0x2, 0x660f537e, 0x3}, 0x2c)
sendmsg$sock(r1, &(0x7f0000000400)={&(0x7f0000000580)=@in6={0x2, 0x4e20, 0x0, @dev={0xfe, 0x80, '\x00', 0xfd}}, 0x80, 0x0, 0x0, &(0x7f0000000000)=[@mark={{0x14, 0x1, 0x24, 0x3}}], 0x18}, 0x0)
r4 = syz_usb_connect(0x0, 0x32, &(0x7f0000000000)=ANY=[@ANYBLOB="1201000200000040a61b01000100000000010902200001010080320904"], 0x0)
sendmsg$inet(0xffffffffffffffff, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)=[{&(0x7f0000000100)="5c00000012006bab9e3fe3d86e6c1d0000147ea60864160af36504b68675f8001d000a00a0e69ee517d34460bc24eab556a705251e6182949a36c23d3b48dfd8cdbf9367b4fa51f60a64c9f4080003680601000008000300ff000000", 0x5c}], 0x1, 0x0, 0x0, 0x1f00c00e}, 0x0)
r5 = syz_usb_connect$uac3(0x3, 0x80, &(0x7f0000000280)=ANY=[], 0x0)
syz_usb_control_io$printer(r4, 0x0, &(0x7f00000005c0)={0x34, &(0x7f00000003c0)=ANY=[], 0x0, 0x0, 0x0, 0x0, 0x0})
mkdirat(0xffffffffffffff9c, &(0x7f0000000200)='./file0\x00', 0x0)
sendmsg$inet(0xffffffffffffffff, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)=[{&(0x7f0000000100)="5c00000012006bab9e3fe3d86e6c1d0000147ea60864160af36504b68675f8001d000a00a0e69ee517d34460bc24eab556a705251e6182949a36c23d3b48dfd8cdbf9367b4fa51f60a64c9f4080003680601000008000300ff000000", 0x5c}], 0x1, 0x0, 0x0, 0x1f00c00e}, 0x0) (async)
syz_usb_connect$uac3(0x3, 0x80, &(0x7f0000000280)=ANY=[], 0x0) (async)
syz_usb_control_io$uac3(r5, 0x0, 0x0) (async)
syz_open_dev$dvb_frontend(&(0x7f0000000100), 0x1, 0x802) (async)
getsockopt$bt_hci(0xffffffffffffffff, 0x84, 0x81, &(0x7f0000001280)=""/4107, &(0x7f00000000c0)=0x100b) (async)
syz_open_dev$dvb_frontend(&(0x7f0000000080), 0x0, 0x402)
socket$inet_mptcp(0x2, 0x1, 0x106)
r6 = socket(0x10, 0x803, 0x0)
getsockname$packet(r6, &(0x7f0000000280)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14)

program crashed: KASAN: slab-use-after-free Read in dvb_device_open
testing program (duration=45s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): socket$inet6_tcp-connect$inet6-gettid-timer_settime-socketpair$unix-getsockopt$sock_cred-setsockopt$sock_cred-setsockopt$inet6_tcp_TCP_REPAIR_QUEUE-mmap-mmap-mmap-mmap$dsp-socket$xdp-socket$kcm-socket-openat$fuse-read$FUSE-setsockopt$IP_VS_SO_SET_ADD-sendmsg$sock-syz_usb_connect-sendmsg$inet-syz_usb_connect$uac3-syz_usb_control_io$printer-mkdirat-sendmsg$inet-syz_usb_connect$uac3-syz_usb_control_io$uac3-syz_open_dev$dvb_frontend-getsockopt$bt_hci-syz_open_dev$dvb_frontend-socket$inet_mptcp-socket
detailed listing:
executing program 0:
r0 = socket$inet6_tcp(0xa, 0x1, 0x0)
connect$inet6(r0, 0x0, 0x0)
gettid()
timer_settime(0x0, 0x0, &(0x7f0000000280)={{0x0, 0x989680}, {0x0, 0x989680}}, 0x0)
socketpair$unix(0x1, 0x0, 0x0, 0x0)
getsockopt$sock_cred(0xffffffffffffffff, 0x1, 0x11, 0x0, &(0x7f0000cab000))
setsockopt$sock_cred(0xffffffffffffffff, 0x1, 0x11, 0x0, 0x0)
setsockopt$inet6_tcp_TCP_REPAIR_QUEUE(r0, 0x6, 0x14, 0x0, 0x0)
mmap(&(0x7f0000000000/0x4000)=nil, 0x4000, 0x1, 0x10012, 0xffffffffffffffff, 0x5deba000)
mmap(&(0x7f0000bfe000/0x400000)=nil, 0x400000, 0x4, 0x40010, r0, 0xd1aa000)
mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x3, 0x8031, 0xffffffffffffffff, 0x0)
mmap$dsp(&(0x7f0000ffd000/0x2000)=nil, 0x2000, 0x100000b, 0x810, 0xffffffffffffffff, 0x0)
socket$xdp(0x2c, 0x3, 0x0)
r1 = socket$kcm(0xa, 0x2, 0x0)
r2 = socket(0x2, 0x80805, 0x0)
r3 = openat$fuse(0xffffffffffffff9c, &(0x7f0000000080), 0x2, 0x0)
read$FUSE(r3, &(0x7f0000000600)={0x2020}, 0x2020)
setsockopt$IP_VS_SO_SET_ADD(r2, 0x0, 0x482, &(0x7f0000000240)={0x84, @dev={0xac, 0x14, 0x14, 0x15}, 0x4e20, 0x3, 'wlc\x00', 0x2, 0x660f537e, 0x3}, 0x2c)
sendmsg$sock(r1, &(0x7f0000000400)={&(0x7f0000000580)=@in6={0x2, 0x4e20, 0x0, @dev={0xfe, 0x80, '\x00', 0xfd}}, 0x80, 0x0, 0x0, &(0x7f0000000000)=[@mark={{0x14, 0x1, 0x24, 0x3}}], 0x18}, 0x0)
r4 = syz_usb_connect(0x0, 0x32, &(0x7f0000000000)=ANY=[@ANYBLOB="1201000200000040a61b01000100000000010902200001010080320904"], 0x0)
sendmsg$inet(0xffffffffffffffff, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)=[{&(0x7f0000000100)="5c00000012006bab9e3fe3d86e6c1d0000147ea60864160af36504b68675f8001d000a00a0e69ee517d34460bc24eab556a705251e6182949a36c23d3b48dfd8cdbf9367b4fa51f60a64c9f4080003680601000008000300ff000000", 0x5c}], 0x1, 0x0, 0x0, 0x1f00c00e}, 0x0)
r5 = syz_usb_connect$uac3(0x3, 0x80, &(0x7f0000000280)=ANY=[], 0x0)
syz_usb_control_io$printer(r4, 0x0, &(0x7f00000005c0)={0x34, &(0x7f00000003c0)=ANY=[], 0x0, 0x0, 0x0, 0x0, 0x0})
mkdirat(0xffffffffffffff9c, &(0x7f0000000200)='./file0\x00', 0x0)
sendmsg$inet(0xffffffffffffffff, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)=[{&(0x7f0000000100)="5c00000012006bab9e3fe3d86e6c1d0000147ea60864160af36504b68675f8001d000a00a0e69ee517d34460bc24eab556a705251e6182949a36c23d3b48dfd8cdbf9367b4fa51f60a64c9f4080003680601000008000300ff000000", 0x5c}], 0x1, 0x0, 0x0, 0x1f00c00e}, 0x0) (async)
syz_usb_connect$uac3(0x3, 0x80, &(0x7f0000000280)=ANY=[], 0x0) (async)
syz_usb_control_io$uac3(r5, 0x0, 0x0) (async)
syz_open_dev$dvb_frontend(&(0x7f0000000100), 0x1, 0x802) (async)
getsockopt$bt_hci(0xffffffffffffffff, 0x84, 0x81, &(0x7f0000001280)=""/4107, &(0x7f00000000c0)=0x100b) (async)
syz_open_dev$dvb_frontend(&(0x7f0000000080), 0x0, 0x402)
socket$inet_mptcp(0x2, 0x1, 0x106)
socket(0x10, 0x803, 0x0)

program crashed: KASAN: slab-use-after-free Read in dvb_device_open
testing program (duration=45s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): socket$inet6_tcp-connect$inet6-gettid-timer_settime-socketpair$unix-getsockopt$sock_cred-setsockopt$sock_cred-setsockopt$inet6_tcp_TCP_REPAIR_QUEUE-mmap-mmap-mmap-mmap$dsp-socket$xdp-socket$kcm-socket-openat$fuse-read$FUSE-setsockopt$IP_VS_SO_SET_ADD-sendmsg$sock-syz_usb_connect-sendmsg$inet-syz_usb_connect$uac3-syz_usb_control_io$printer-mkdirat-sendmsg$inet-syz_usb_connect$uac3-syz_usb_control_io$uac3-syz_open_dev$dvb_frontend-getsockopt$bt_hci-syz_open_dev$dvb_frontend-socket$inet_mptcp
detailed listing:
executing program 0:
r0 = socket$inet6_tcp(0xa, 0x1, 0x0)
connect$inet6(r0, 0x0, 0x0)
gettid()
timer_settime(0x0, 0x0, &(0x7f0000000280)={{0x0, 0x989680}, {0x0, 0x989680}}, 0x0)
socketpair$unix(0x1, 0x0, 0x0, 0x0)
getsockopt$sock_cred(0xffffffffffffffff, 0x1, 0x11, 0x0, &(0x7f0000cab000))
setsockopt$sock_cred(0xffffffffffffffff, 0x1, 0x11, 0x0, 0x0)
setsockopt$inet6_tcp_TCP_REPAIR_QUEUE(r0, 0x6, 0x14, 0x0, 0x0)
mmap(&(0x7f0000000000/0x4000)=nil, 0x4000, 0x1, 0x10012, 0xffffffffffffffff, 0x5deba000)
mmap(&(0x7f0000bfe000/0x400000)=nil, 0x400000, 0x4, 0x40010, r0, 0xd1aa000)
mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x3, 0x8031, 0xffffffffffffffff, 0x0)
mmap$dsp(&(0x7f0000ffd000/0x2000)=nil, 0x2000, 0x100000b, 0x810, 0xffffffffffffffff, 0x0)
socket$xdp(0x2c, 0x3, 0x0)
r1 = socket$kcm(0xa, 0x2, 0x0)
r2 = socket(0x2, 0x80805, 0x0)
r3 = openat$fuse(0xffffffffffffff9c, &(0x7f0000000080), 0x2, 0x0)
read$FUSE(r3, &(0x7f0000000600)={0x2020}, 0x2020)
setsockopt$IP_VS_SO_SET_ADD(r2, 0x0, 0x482, &(0x7f0000000240)={0x84, @dev={0xac, 0x14, 0x14, 0x15}, 0x4e20, 0x3, 'wlc\x00', 0x2, 0x660f537e, 0x3}, 0x2c)
sendmsg$sock(r1, &(0x7f0000000400)={&(0x7f0000000580)=@in6={0x2, 0x4e20, 0x0, @dev={0xfe, 0x80, '\x00', 0xfd}}, 0x80, 0x0, 0x0, &(0x7f0000000000)=[@mark={{0x14, 0x1, 0x24, 0x3}}], 0x18}, 0x0)
r4 = syz_usb_connect(0x0, 0x32, &(0x7f0000000000)=ANY=[@ANYBLOB="1201000200000040a61b01000100000000010902200001010080320904"], 0x0)
sendmsg$inet(0xffffffffffffffff, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)=[{&(0x7f0000000100)="5c00000012006bab9e3fe3d86e6c1d0000147ea60864160af36504b68675f8001d000a00a0e69ee517d34460bc24eab556a705251e6182949a36c23d3b48dfd8cdbf9367b4fa51f60a64c9f4080003680601000008000300ff000000", 0x5c}], 0x1, 0x0, 0x0, 0x1f00c00e}, 0x0)
r5 = syz_usb_connect$uac3(0x3, 0x80, &(0x7f0000000280)=ANY=[], 0x0)
syz_usb_control_io$printer(r4, 0x0, &(0x7f00000005c0)={0x34, &(0x7f00000003c0)=ANY=[], 0x0, 0x0, 0x0, 0x0, 0x0})
mkdirat(0xffffffffffffff9c, &(0x7f0000000200)='./file0\x00', 0x0)
sendmsg$inet(0xffffffffffffffff, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)=[{&(0x7f0000000100)="5c00000012006bab9e3fe3d86e6c1d0000147ea60864160af36504b68675f8001d000a00a0e69ee517d34460bc24eab556a705251e6182949a36c23d3b48dfd8cdbf9367b4fa51f60a64c9f4080003680601000008000300ff000000", 0x5c}], 0x1, 0x0, 0x0, 0x1f00c00e}, 0x0) (async)
syz_usb_connect$uac3(0x3, 0x80, &(0x7f0000000280)=ANY=[], 0x0) (async)
syz_usb_control_io$uac3(r5, 0x0, 0x0) (async)
syz_open_dev$dvb_frontend(&(0x7f0000000100), 0x1, 0x802) (async)
getsockopt$bt_hci(0xffffffffffffffff, 0x84, 0x81, &(0x7f0000001280)=""/4107, &(0x7f00000000c0)=0x100b) (async)
syz_open_dev$dvb_frontend(&(0x7f0000000080), 0x0, 0x402)
socket$inet_mptcp(0x2, 0x1, 0x106)

program crashed: KASAN: slab-use-after-free Read in dvb_device_open
testing program (duration=45s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): socket$inet6_tcp-connect$inet6-gettid-timer_settime-socketpair$unix-getsockopt$sock_cred-setsockopt$sock_cred-setsockopt$inet6_tcp_TCP_REPAIR_QUEUE-mmap-mmap-mmap-mmap$dsp-socket$xdp-socket$kcm-socket-openat$fuse-read$FUSE-setsockopt$IP_VS_SO_SET_ADD-sendmsg$sock-syz_usb_connect-sendmsg$inet-syz_usb_connect$uac3-syz_usb_control_io$printer-mkdirat-sendmsg$inet-syz_usb_connect$uac3-syz_usb_control_io$uac3-syz_open_dev$dvb_frontend-getsockopt$bt_hci-syz_open_dev$dvb_frontend
detailed listing:
executing program 0:
r0 = socket$inet6_tcp(0xa, 0x1, 0x0)
connect$inet6(r0, 0x0, 0x0)
gettid()
timer_settime(0x0, 0x0, &(0x7f0000000280)={{0x0, 0x989680}, {0x0, 0x989680}}, 0x0)
socketpair$unix(0x1, 0x0, 0x0, 0x0)
getsockopt$sock_cred(0xffffffffffffffff, 0x1, 0x11, 0x0, &(0x7f0000cab000))
setsockopt$sock_cred(0xffffffffffffffff, 0x1, 0x11, 0x0, 0x0)
setsockopt$inet6_tcp_TCP_REPAIR_QUEUE(r0, 0x6, 0x14, 0x0, 0x0)
mmap(&(0x7f0000000000/0x4000)=nil, 0x4000, 0x1, 0x10012, 0xffffffffffffffff, 0x5deba000)
mmap(&(0x7f0000bfe000/0x400000)=nil, 0x400000, 0x4, 0x40010, r0, 0xd1aa000)
mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x3, 0x8031, 0xffffffffffffffff, 0x0)
mmap$dsp(&(0x7f0000ffd000/0x2000)=nil, 0x2000, 0x100000b, 0x810, 0xffffffffffffffff, 0x0)
socket$xdp(0x2c, 0x3, 0x0)
r1 = socket$kcm(0xa, 0x2, 0x0)
r2 = socket(0x2, 0x80805, 0x0)
r3 = openat$fuse(0xffffffffffffff9c, &(0x7f0000000080), 0x2, 0x0)
read$FUSE(r3, &(0x7f0000000600)={0x2020}, 0x2020)
setsockopt$IP_VS_SO_SET_ADD(r2, 0x0, 0x482, &(0x7f0000000240)={0x84, @dev={0xac, 0x14, 0x14, 0x15}, 0x4e20, 0x3, 'wlc\x00', 0x2, 0x660f537e, 0x3}, 0x2c)
sendmsg$sock(r1, &(0x7f0000000400)={&(0x7f0000000580)=@in6={0x2, 0x4e20, 0x0, @dev={0xfe, 0x80, '\x00', 0xfd}}, 0x80, 0x0, 0x0, &(0x7f0000000000)=[@mark={{0x14, 0x1, 0x24, 0x3}}], 0x18}, 0x0)
r4 = syz_usb_connect(0x0, 0x32, &(0x7f0000000000)=ANY=[@ANYBLOB="1201000200000040a61b01000100000000010902200001010080320904"], 0x0)
sendmsg$inet(0xffffffffffffffff, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)=[{&(0x7f0000000100)="5c00000012006bab9e3fe3d86e6c1d0000147ea60864160af36504b68675f8001d000a00a0e69ee517d34460bc24eab556a705251e6182949a36c23d3b48dfd8cdbf9367b4fa51f60a64c9f4080003680601000008000300ff000000", 0x5c}], 0x1, 0x0, 0x0, 0x1f00c00e}, 0x0)
r5 = syz_usb_connect$uac3(0x3, 0x80, &(0x7f0000000280)=ANY=[], 0x0)
syz_usb_control_io$printer(r4, 0x0, &(0x7f00000005c0)={0x34, &(0x7f00000003c0)=ANY=[], 0x0, 0x0, 0x0, 0x0, 0x0})
mkdirat(0xffffffffffffff9c, &(0x7f0000000200)='./file0\x00', 0x0)
sendmsg$inet(0xffffffffffffffff, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)=[{&(0x7f0000000100)="5c00000012006bab9e3fe3d86e6c1d0000147ea60864160af36504b68675f8001d000a00a0e69ee517d34460bc24eab556a705251e6182949a36c23d3b48dfd8cdbf9367b4fa51f60a64c9f4080003680601000008000300ff000000", 0x5c}], 0x1, 0x0, 0x0, 0x1f00c00e}, 0x0) (async)
syz_usb_connect$uac3(0x3, 0x80, &(0x7f0000000280)=ANY=[], 0x0) (async)
syz_usb_control_io$uac3(r5, 0x0, 0x0) (async)
syz_open_dev$dvb_frontend(&(0x7f0000000100), 0x1, 0x802) (async)
getsockopt$bt_hci(0xffffffffffffffff, 0x84, 0x81, &(0x7f0000001280)=""/4107, &(0x7f00000000c0)=0x100b) (async)
syz_open_dev$dvb_frontend(&(0x7f0000000080), 0x0, 0x402)

program crashed: KASAN: slab-use-after-free Read in dvb_device_open
testing program (duration=45s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): socket$inet6_tcp-connect$inet6-gettid-timer_settime-socketpair$unix-getsockopt$sock_cred-setsockopt$sock_cred-setsockopt$inet6_tcp_TCP_REPAIR_QUEUE-mmap-mmap-mmap-mmap$dsp-socket$xdp-socket$kcm-socket-openat$fuse-read$FUSE-setsockopt$IP_VS_SO_SET_ADD-sendmsg$sock-syz_usb_connect-sendmsg$inet-syz_usb_connect$uac3-syz_usb_control_io$printer-mkdirat-sendmsg$inet-syz_usb_connect$uac3-syz_usb_control_io$uac3-syz_open_dev$dvb_frontend-getsockopt$bt_hci
detailed listing:
executing program 0:
r0 = socket$inet6_tcp(0xa, 0x1, 0x0)
connect$inet6(r0, 0x0, 0x0)
gettid()
timer_settime(0x0, 0x0, &(0x7f0000000280)={{0x0, 0x989680}, {0x0, 0x989680}}, 0x0)
socketpair$unix(0x1, 0x0, 0x0, 0x0)
getsockopt$sock_cred(0xffffffffffffffff, 0x1, 0x11, 0x0, &(0x7f0000cab000))
setsockopt$sock_cred(0xffffffffffffffff, 0x1, 0x11, 0x0, 0x0)
setsockopt$inet6_tcp_TCP_REPAIR_QUEUE(r0, 0x6, 0x14, 0x0, 0x0)
mmap(&(0x7f0000000000/0x4000)=nil, 0x4000, 0x1, 0x10012, 0xffffffffffffffff, 0x5deba000)
mmap(&(0x7f0000bfe000/0x400000)=nil, 0x400000, 0x4, 0x40010, r0, 0xd1aa000)
mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x3, 0x8031, 0xffffffffffffffff, 0x0)
mmap$dsp(&(0x7f0000ffd000/0x2000)=nil, 0x2000, 0x100000b, 0x810, 0xffffffffffffffff, 0x0)
socket$xdp(0x2c, 0x3, 0x0)
r1 = socket$kcm(0xa, 0x2, 0x0)
r2 = socket(0x2, 0x80805, 0x0)
r3 = openat$fuse(0xffffffffffffff9c, &(0x7f0000000080), 0x2, 0x0)
read$FUSE(r3, &(0x7f0000000600)={0x2020}, 0x2020)
setsockopt$IP_VS_SO_SET_ADD(r2, 0x0, 0x482, &(0x7f0000000240)={0x84, @dev={0xac, 0x14, 0x14, 0x15}, 0x4e20, 0x3, 'wlc\x00', 0x2, 0x660f537e, 0x3}, 0x2c)
sendmsg$sock(r1, &(0x7f0000000400)={&(0x7f0000000580)=@in6={0x2, 0x4e20, 0x0, @dev={0xfe, 0x80, '\x00', 0xfd}}, 0x80, 0x0, 0x0, &(0x7f0000000000)=[@mark={{0x14, 0x1, 0x24, 0x3}}], 0x18}, 0x0)
r4 = syz_usb_connect(0x0, 0x32, &(0x7f0000000000)=ANY=[@ANYBLOB="1201000200000040a61b01000100000000010902200001010080320904"], 0x0)
sendmsg$inet(0xffffffffffffffff, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)=[{&(0x7f0000000100)="5c00000012006bab9e3fe3d86e6c1d0000147ea60864160af36504b68675f8001d000a00a0e69ee517d34460bc24eab556a705251e6182949a36c23d3b48dfd8cdbf9367b4fa51f60a64c9f4080003680601000008000300ff000000", 0x5c}], 0x1, 0x0, 0x0, 0x1f00c00e}, 0x0)
r5 = syz_usb_connect$uac3(0x3, 0x80, &(0x7f0000000280)=ANY=[], 0x0)
syz_usb_control_io$printer(r4, 0x0, &(0x7f00000005c0)={0x34, &(0x7f00000003c0)=ANY=[], 0x0, 0x0, 0x0, 0x0, 0x0})
mkdirat(0xffffffffffffff9c, &(0x7f0000000200)='./file0\x00', 0x0)
sendmsg$inet(0xffffffffffffffff, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)=[{&(0x7f0000000100)="5c00000012006bab9e3fe3d86e6c1d0000147ea60864160af36504b68675f8001d000a00a0e69ee517d34460bc24eab556a705251e6182949a36c23d3b48dfd8cdbf9367b4fa51f60a64c9f4080003680601000008000300ff000000", 0x5c}], 0x1, 0x0, 0x0, 0x1f00c00e}, 0x0) (async)
syz_usb_connect$uac3(0x3, 0x80, &(0x7f0000000280)=ANY=[], 0x0) (async)
syz_usb_control_io$uac3(r5, 0x0, 0x0) (async)
syz_open_dev$dvb_frontend(&(0x7f0000000100), 0x1, 0x802) (async)
getsockopt$bt_hci(0xffffffffffffffff, 0x84, 0x81, &(0x7f0000001280)=""/4107, &(0x7f00000000c0)=0x100b) (async)

program did not crash
testing program (duration=45s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): socket$inet6_tcp-connect$inet6-gettid-timer_settime-socketpair$unix-getsockopt$sock_cred-setsockopt$sock_cred-setsockopt$inet6_tcp_TCP_REPAIR_QUEUE-mmap-mmap-mmap-mmap$dsp-socket$xdp-socket$kcm-socket-openat$fuse-read$FUSE-setsockopt$IP_VS_SO_SET_ADD-sendmsg$sock-syz_usb_connect-sendmsg$inet-syz_usb_connect$uac3-syz_usb_control_io$printer-mkdirat-sendmsg$inet-syz_usb_connect$uac3-syz_usb_control_io$uac3-syz_open_dev$dvb_frontend-syz_open_dev$dvb_frontend
detailed listing:
executing program 0:
r0 = socket$inet6_tcp(0xa, 0x1, 0x0)
connect$inet6(r0, 0x0, 0x0)
gettid()
timer_settime(0x0, 0x0, &(0x7f0000000280)={{0x0, 0x989680}, {0x0, 0x989680}}, 0x0)
socketpair$unix(0x1, 0x0, 0x0, 0x0)
getsockopt$sock_cred(0xffffffffffffffff, 0x1, 0x11, 0x0, &(0x7f0000cab000))
setsockopt$sock_cred(0xffffffffffffffff, 0x1, 0x11, 0x0, 0x0)
setsockopt$inet6_tcp_TCP_REPAIR_QUEUE(r0, 0x6, 0x14, 0x0, 0x0)
mmap(&(0x7f0000000000/0x4000)=nil, 0x4000, 0x1, 0x10012, 0xffffffffffffffff, 0x5deba000)
mmap(&(0x7f0000bfe000/0x400000)=nil, 0x400000, 0x4, 0x40010, r0, 0xd1aa000)
mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x3, 0x8031, 0xffffffffffffffff, 0x0)
mmap$dsp(&(0x7f0000ffd000/0x2000)=nil, 0x2000, 0x100000b, 0x810, 0xffffffffffffffff, 0x0)
socket$xdp(0x2c, 0x3, 0x0)
r1 = socket$kcm(0xa, 0x2, 0x0)
r2 = socket(0x2, 0x80805, 0x0)
r3 = openat$fuse(0xffffffffffffff9c, &(0x7f0000000080), 0x2, 0x0)
read$FUSE(r3, &(0x7f0000000600)={0x2020}, 0x2020)
setsockopt$IP_VS_SO_SET_ADD(r2, 0x0, 0x482, &(0x7f0000000240)={0x84, @dev={0xac, 0x14, 0x14, 0x15}, 0x4e20, 0x3, 'wlc\x00', 0x2, 0x660f537e, 0x3}, 0x2c)
sendmsg$sock(r1, &(0x7f0000000400)={&(0x7f0000000580)=@in6={0x2, 0x4e20, 0x0, @dev={0xfe, 0x80, '\x00', 0xfd}}, 0x80, 0x0, 0x0, &(0x7f0000000000)=[@mark={{0x14, 0x1, 0x24, 0x3}}], 0x18}, 0x0)
r4 = syz_usb_connect(0x0, 0x32, &(0x7f0000000000)=ANY=[@ANYBLOB="1201000200000040a61b01000100000000010902200001010080320904"], 0x0)
sendmsg$inet(0xffffffffffffffff, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)=[{&(0x7f0000000100)="5c00000012006bab9e3fe3d86e6c1d0000147ea60864160af36504b68675f8001d000a00a0e69ee517d34460bc24eab556a705251e6182949a36c23d3b48dfd8cdbf9367b4fa51f60a64c9f4080003680601000008000300ff000000", 0x5c}], 0x1, 0x0, 0x0, 0x1f00c00e}, 0x0)
r5 = syz_usb_connect$uac3(0x3, 0x80, &(0x7f0000000280)=ANY=[], 0x0)
syz_usb_control_io$printer(r4, 0x0, &(0x7f00000005c0)={0x34, &(0x7f00000003c0)=ANY=[], 0x0, 0x0, 0x0, 0x0, 0x0})
mkdirat(0xffffffffffffff9c, &(0x7f0000000200)='./file0\x00', 0x0)
sendmsg$inet(0xffffffffffffffff, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)=[{&(0x7f0000000100)="5c00000012006bab9e3fe3d86e6c1d0000147ea60864160af36504b68675f8001d000a00a0e69ee517d34460bc24eab556a705251e6182949a36c23d3b48dfd8cdbf9367b4fa51f60a64c9f4080003680601000008000300ff000000", 0x5c}], 0x1, 0x0, 0x0, 0x1f00c00e}, 0x0) (async)
syz_usb_connect$uac3(0x3, 0x80, &(0x7f0000000280)=ANY=[], 0x0) (async)
syz_usb_control_io$uac3(r5, 0x0, 0x0) (async)
syz_open_dev$dvb_frontend(&(0x7f0000000100), 0x1, 0x802) (async)
syz_open_dev$dvb_frontend(&(0x7f0000000080), 0x0, 0x402)

program crashed: KASAN: slab-use-after-free Read in dvb_device_open
testing program (duration=45s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): socket$inet6_tcp-connect$inet6-gettid-timer_settime-socketpair$unix-getsockopt$sock_cred-setsockopt$sock_cred-setsockopt$inet6_tcp_TCP_REPAIR_QUEUE-mmap-mmap-mmap-mmap$dsp-socket$xdp-socket$kcm-socket-openat$fuse-read$FUSE-setsockopt$IP_VS_SO_SET_ADD-sendmsg$sock-syz_usb_connect-sendmsg$inet-syz_usb_connect$uac3-syz_usb_control_io$printer-mkdirat-sendmsg$inet-syz_usb_connect$uac3-syz_usb_control_io$uac3-syz_open_dev$dvb_frontend
detailed listing:
executing program 0:
r0 = socket$inet6_tcp(0xa, 0x1, 0x0)
connect$inet6(r0, 0x0, 0x0)
gettid()
timer_settime(0x0, 0x0, &(0x7f0000000280)={{0x0, 0x989680}, {0x0, 0x989680}}, 0x0)
socketpair$unix(0x1, 0x0, 0x0, 0x0)
getsockopt$sock_cred(0xffffffffffffffff, 0x1, 0x11, 0x0, &(0x7f0000cab000))
setsockopt$sock_cred(0xffffffffffffffff, 0x1, 0x11, 0x0, 0x0)
setsockopt$inet6_tcp_TCP_REPAIR_QUEUE(r0, 0x6, 0x14, 0x0, 0x0)
mmap(&(0x7f0000000000/0x4000)=nil, 0x4000, 0x1, 0x10012, 0xffffffffffffffff, 0x5deba000)
mmap(&(0x7f0000bfe000/0x400000)=nil, 0x400000, 0x4, 0x40010, r0, 0xd1aa000)
mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x3, 0x8031, 0xffffffffffffffff, 0x0)
mmap$dsp(&(0x7f0000ffd000/0x2000)=nil, 0x2000, 0x100000b, 0x810, 0xffffffffffffffff, 0x0)
socket$xdp(0x2c, 0x3, 0x0)
r1 = socket$kcm(0xa, 0x2, 0x0)
r2 = socket(0x2, 0x80805, 0x0)
r3 = openat$fuse(0xffffffffffffff9c, &(0x7f0000000080), 0x2, 0x0)
read$FUSE(r3, &(0x7f0000000600)={0x2020}, 0x2020)
setsockopt$IP_VS_SO_SET_ADD(r2, 0x0, 0x482, &(0x7f0000000240)={0x84, @dev={0xac, 0x14, 0x14, 0x15}, 0x4e20, 0x3, 'wlc\x00', 0x2, 0x660f537e, 0x3}, 0x2c)
sendmsg$sock(r1, &(0x7f0000000400)={&(0x7f0000000580)=@in6={0x2, 0x4e20, 0x0, @dev={0xfe, 0x80, '\x00', 0xfd}}, 0x80, 0x0, 0x0, &(0x7f0000000000)=[@mark={{0x14, 0x1, 0x24, 0x3}}], 0x18}, 0x0)
r4 = syz_usb_connect(0x0, 0x32, &(0x7f0000000000)=ANY=[@ANYBLOB="1201000200000040a61b01000100000000010902200001010080320904"], 0x0)
sendmsg$inet(0xffffffffffffffff, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)=[{&(0x7f0000000100)="5c00000012006bab9e3fe3d86e6c1d0000147ea60864160af36504b68675f8001d000a00a0e69ee517d34460bc24eab556a705251e6182949a36c23d3b48dfd8cdbf9367b4fa51f60a64c9f4080003680601000008000300ff000000", 0x5c}], 0x1, 0x0, 0x0, 0x1f00c00e}, 0x0)
r5 = syz_usb_connect$uac3(0x3, 0x80, &(0x7f0000000280)=ANY=[], 0x0)
syz_usb_control_io$printer(r4, 0x0, &(0x7f00000005c0)={0x34, &(0x7f00000003c0)=ANY=[], 0x0, 0x0, 0x0, 0x0, 0x0})
mkdirat(0xffffffffffffff9c, &(0x7f0000000200)='./file0\x00', 0x0)
sendmsg$inet(0xffffffffffffffff, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)=[{&(0x7f0000000100)="5c00000012006bab9e3fe3d86e6c1d0000147ea60864160af36504b68675f8001d000a00a0e69ee517d34460bc24eab556a705251e6182949a36c23d3b48dfd8cdbf9367b4fa51f60a64c9f4080003680601000008000300ff000000", 0x5c}], 0x1, 0x0, 0x0, 0x1f00c00e}, 0x0) (async)
syz_usb_connect$uac3(0x3, 0x80, &(0x7f0000000280)=ANY=[], 0x0) (async)
syz_usb_control_io$uac3(r5, 0x0, 0x0) (async)
syz_open_dev$dvb_frontend(&(0x7f0000000080), 0x0, 0x402)

program did not crash
testing program (duration=45s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): socket$inet6_tcp-connect$inet6-gettid-timer_settime-socketpair$unix-getsockopt$sock_cred-setsockopt$sock_cred-setsockopt$inet6_tcp_TCP_REPAIR_QUEUE-mmap-mmap-mmap-mmap$dsp-socket$xdp-socket$kcm-socket-openat$fuse-read$FUSE-setsockopt$IP_VS_SO_SET_ADD-sendmsg$sock-syz_usb_connect-sendmsg$inet-syz_usb_connect$uac3-syz_usb_control_io$printer-mkdirat-sendmsg$inet-syz_usb_connect$uac3-syz_open_dev$dvb_frontend-syz_open_dev$dvb_frontend
detailed listing:
executing program 0:
r0 = socket$inet6_tcp(0xa, 0x1, 0x0)
connect$inet6(r0, 0x0, 0x0)
gettid()
timer_settime(0x0, 0x0, &(0x7f0000000280)={{0x0, 0x989680}, {0x0, 0x989680}}, 0x0)
socketpair$unix(0x1, 0x0, 0x0, 0x0)
getsockopt$sock_cred(0xffffffffffffffff, 0x1, 0x11, 0x0, &(0x7f0000cab000))
setsockopt$sock_cred(0xffffffffffffffff, 0x1, 0x11, 0x0, 0x0)
setsockopt$inet6_tcp_TCP_REPAIR_QUEUE(r0, 0x6, 0x14, 0x0, 0x0)
mmap(&(0x7f0000000000/0x4000)=nil, 0x4000, 0x1, 0x10012, 0xffffffffffffffff, 0x5deba000)
mmap(&(0x7f0000bfe000/0x400000)=nil, 0x400000, 0x4, 0x40010, r0, 0xd1aa000)
mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x3, 0x8031, 0xffffffffffffffff, 0x0)
mmap$dsp(&(0x7f0000ffd000/0x2000)=nil, 0x2000, 0x100000b, 0x810, 0xffffffffffffffff, 0x0)
socket$xdp(0x2c, 0x3, 0x0)
r1 = socket$kcm(0xa, 0x2, 0x0)
r2 = socket(0x2, 0x80805, 0x0)
r3 = openat$fuse(0xffffffffffffff9c, &(0x7f0000000080), 0x2, 0x0)
read$FUSE(r3, &(0x7f0000000600)={0x2020}, 0x2020)
setsockopt$IP_VS_SO_SET_ADD(r2, 0x0, 0x482, &(0x7f0000000240)={0x84, @dev={0xac, 0x14, 0x14, 0x15}, 0x4e20, 0x3, 'wlc\x00', 0x2, 0x660f537e, 0x3}, 0x2c)
sendmsg$sock(r1, &(0x7f0000000400)={&(0x7f0000000580)=@in6={0x2, 0x4e20, 0x0, @dev={0xfe, 0x80, '\x00', 0xfd}}, 0x80, 0x0, 0x0, &(0x7f0000000000)=[@mark={{0x14, 0x1, 0x24, 0x3}}], 0x18}, 0x0)
r4 = syz_usb_connect(0x0, 0x32, &(0x7f0000000000)=ANY=[@ANYBLOB="1201000200000040a61b01000100000000010902200001010080320904"], 0x0)
sendmsg$inet(0xffffffffffffffff, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)=[{&(0x7f0000000100)="5c00000012006bab9e3fe3d86e6c1d0000147ea60864160af36504b68675f8001d000a00a0e69ee517d34460bc24eab556a705251e6182949a36c23d3b48dfd8cdbf9367b4fa51f60a64c9f4080003680601000008000300ff000000", 0x5c}], 0x1, 0x0, 0x0, 0x1f00c00e}, 0x0)
syz_usb_connect$uac3(0x3, 0x80, &(0x7f0000000280)=ANY=[], 0x0)
syz_usb_control_io$printer(r4, 0x0, &(0x7f00000005c0)={0x34, &(0x7f00000003c0)=ANY=[], 0x0, 0x0, 0x0, 0x0, 0x0})
mkdirat(0xffffffffffffff9c, &(0x7f0000000200)='./file0\x00', 0x0)
sendmsg$inet(0xffffffffffffffff, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)=[{&(0x7f0000000100)="5c00000012006bab9e3fe3d86e6c1d0000147ea60864160af36504b68675f8001d000a00a0e69ee517d34460bc24eab556a705251e6182949a36c23d3b48dfd8cdbf9367b4fa51f60a64c9f4080003680601000008000300ff000000", 0x5c}], 0x1, 0x0, 0x0, 0x1f00c00e}, 0x0) (async)
syz_usb_connect$uac3(0x3, 0x80, &(0x7f0000000280)=ANY=[], 0x0) (async)
syz_open_dev$dvb_frontend(&(0x7f0000000100), 0x1, 0x802) (async)
syz_open_dev$dvb_frontend(&(0x7f0000000080), 0x0, 0x402)

program crashed: KASAN: slab-use-after-free Read in dvb_device_open
testing program (duration=45s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): socket$inet6_tcp-connect$inet6-gettid-timer_settime-socketpair$unix-getsockopt$sock_cred-setsockopt$sock_cred-setsockopt$inet6_tcp_TCP_REPAIR_QUEUE-mmap-mmap-mmap-mmap$dsp-socket$xdp-socket$kcm-socket-openat$fuse-read$FUSE-setsockopt$IP_VS_SO_SET_ADD-sendmsg$sock-syz_usb_connect-sendmsg$inet-syz_usb_connect$uac3-syz_usb_control_io$printer-mkdirat-sendmsg$inet-syz_open_dev$dvb_frontend-syz_open_dev$dvb_frontend
detailed listing:
executing program 0:
r0 = socket$inet6_tcp(0xa, 0x1, 0x0)
connect$inet6(r0, 0x0, 0x0)
gettid()
timer_settime(0x0, 0x0, &(0x7f0000000280)={{0x0, 0x989680}, {0x0, 0x989680}}, 0x0)
socketpair$unix(0x1, 0x0, 0x0, 0x0)
getsockopt$sock_cred(0xffffffffffffffff, 0x1, 0x11, 0x0, &(0x7f0000cab000))
setsockopt$sock_cred(0xffffffffffffffff, 0x1, 0x11, 0x0, 0x0)
setsockopt$inet6_tcp_TCP_REPAIR_QUEUE(r0, 0x6, 0x14, 0x0, 0x0)
mmap(&(0x7f0000000000/0x4000)=nil, 0x4000, 0x1, 0x10012, 0xffffffffffffffff, 0x5deba000)
mmap(&(0x7f0000bfe000/0x400000)=nil, 0x400000, 0x4, 0x40010, r0, 0xd1aa000)
mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x3, 0x8031, 0xffffffffffffffff, 0x0)
mmap$dsp(&(0x7f0000ffd000/0x2000)=nil, 0x2000, 0x100000b, 0x810, 0xffffffffffffffff, 0x0)
socket$xdp(0x2c, 0x3, 0x0)
r1 = socket$kcm(0xa, 0x2, 0x0)
r2 = socket(0x2, 0x80805, 0x0)
r3 = openat$fuse(0xffffffffffffff9c, &(0x7f0000000080), 0x2, 0x0)
read$FUSE(r3, &(0x7f0000000600)={0x2020}, 0x2020)
setsockopt$IP_VS_SO_SET_ADD(r2, 0x0, 0x482, &(0x7f0000000240)={0x84, @dev={0xac, 0x14, 0x14, 0x15}, 0x4e20, 0x3, 'wlc\x00', 0x2, 0x660f537e, 0x3}, 0x2c)
sendmsg$sock(r1, &(0x7f0000000400)={&(0x7f0000000580)=@in6={0x2, 0x4e20, 0x0, @dev={0xfe, 0x80, '\x00', 0xfd}}, 0x80, 0x0, 0x0, &(0x7f0000000000)=[@mark={{0x14, 0x1, 0x24, 0x3}}], 0x18}, 0x0)
r4 = syz_usb_connect(0x0, 0x32, &(0x7f0000000000)=ANY=[@ANYBLOB="1201000200000040a61b01000100000000010902200001010080320904"], 0x0)
sendmsg$inet(0xffffffffffffffff, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)=[{&(0x7f0000000100)="5c00000012006bab9e3fe3d86e6c1d0000147ea60864160af36504b68675f8001d000a00a0e69ee517d34460bc24eab556a705251e6182949a36c23d3b48dfd8cdbf9367b4fa51f60a64c9f4080003680601000008000300ff000000", 0x5c}], 0x1, 0x0, 0x0, 0x1f00c00e}, 0x0)
syz_usb_connect$uac3(0x3, 0x80, &(0x7f0000000280)=ANY=[], 0x0)
syz_usb_control_io$printer(r4, 0x0, &(0x7f00000005c0)={0x34, &(0x7f00000003c0)=ANY=[], 0x0, 0x0, 0x0, 0x0, 0x0})
mkdirat(0xffffffffffffff9c, &(0x7f0000000200)='./file0\x00', 0x0)
sendmsg$inet(0xffffffffffffffff, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)=[{&(0x7f0000000100)="5c00000012006bab9e3fe3d86e6c1d0000147ea60864160af36504b68675f8001d000a00a0e69ee517d34460bc24eab556a705251e6182949a36c23d3b48dfd8cdbf9367b4fa51f60a64c9f4080003680601000008000300ff000000", 0x5c}], 0x1, 0x0, 0x0, 0x1f00c00e}, 0x0) (async)
syz_open_dev$dvb_frontend(&(0x7f0000000100), 0x1, 0x802) (async)
syz_open_dev$dvb_frontend(&(0x7f0000000080), 0x0, 0x402)

program crashed: KASAN: slab-use-after-free Read in dvb_device_open
testing program (duration=45s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): socket$inet6_tcp-connect$inet6-gettid-timer_settime-socketpair$unix-getsockopt$sock_cred-setsockopt$sock_cred-setsockopt$inet6_tcp_TCP_REPAIR_QUEUE-mmap-mmap-mmap-mmap$dsp-socket$xdp-socket$kcm-socket-openat$fuse-read$FUSE-setsockopt$IP_VS_SO_SET_ADD-sendmsg$sock-syz_usb_connect-sendmsg$inet-syz_usb_connect$uac3-syz_usb_control_io$printer-mkdirat-syz_open_dev$dvb_frontend-syz_open_dev$dvb_frontend
detailed listing:
executing program 0:
r0 = socket$inet6_tcp(0xa, 0x1, 0x0)
connect$inet6(r0, 0x0, 0x0)
gettid()
timer_settime(0x0, 0x0, &(0x7f0000000280)={{0x0, 0x989680}, {0x0, 0x989680}}, 0x0)
socketpair$unix(0x1, 0x0, 0x0, 0x0)
getsockopt$sock_cred(0xffffffffffffffff, 0x1, 0x11, 0x0, &(0x7f0000cab000))
setsockopt$sock_cred(0xffffffffffffffff, 0x1, 0x11, 0x0, 0x0)
setsockopt$inet6_tcp_TCP_REPAIR_QUEUE(r0, 0x6, 0x14, 0x0, 0x0)
mmap(&(0x7f0000000000/0x4000)=nil, 0x4000, 0x1, 0x10012, 0xffffffffffffffff, 0x5deba000)
mmap(&(0x7f0000bfe000/0x400000)=nil, 0x400000, 0x4, 0x40010, r0, 0xd1aa000)
mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x3, 0x8031, 0xffffffffffffffff, 0x0)
mmap$dsp(&(0x7f0000ffd000/0x2000)=nil, 0x2000, 0x100000b, 0x810, 0xffffffffffffffff, 0x0)
socket$xdp(0x2c, 0x3, 0x0)
r1 = socket$kcm(0xa, 0x2, 0x0)
r2 = socket(0x2, 0x80805, 0x0)
r3 = openat$fuse(0xffffffffffffff9c, &(0x7f0000000080), 0x2, 0x0)
read$FUSE(r3, &(0x7f0000000600)={0x2020}, 0x2020)
setsockopt$IP_VS_SO_SET_ADD(r2, 0x0, 0x482, &(0x7f0000000240)={0x84, @dev={0xac, 0x14, 0x14, 0x15}, 0x4e20, 0x3, 'wlc\x00', 0x2, 0x660f537e, 0x3}, 0x2c)
sendmsg$sock(r1, &(0x7f0000000400)={&(0x7f0000000580)=@in6={0x2, 0x4e20, 0x0, @dev={0xfe, 0x80, '\x00', 0xfd}}, 0x80, 0x0, 0x0, &(0x7f0000000000)=[@mark={{0x14, 0x1, 0x24, 0x3}}], 0x18}, 0x0)
r4 = syz_usb_connect(0x0, 0x32, &(0x7f0000000000)=ANY=[@ANYBLOB="1201000200000040a61b01000100000000010902200001010080320904"], 0x0)
sendmsg$inet(0xffffffffffffffff, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)=[{&(0x7f0000000100)="5c00000012006bab9e3fe3d86e6c1d0000147ea60864160af36504b68675f8001d000a00a0e69ee517d34460bc24eab556a705251e6182949a36c23d3b48dfd8cdbf9367b4fa51f60a64c9f4080003680601000008000300ff000000", 0x5c}], 0x1, 0x0, 0x0, 0x1f00c00e}, 0x0)
syz_usb_connect$uac3(0x3, 0x80, &(0x7f0000000280)=ANY=[], 0x0)
syz_usb_control_io$printer(r4, 0x0, &(0x7f00000005c0)={0x34, &(0x7f00000003c0)=ANY=[], 0x0, 0x0, 0x0, 0x0, 0x0})
mkdirat(0xffffffffffffff9c, &(0x7f0000000200)='./file0\x00', 0x0)
syz_open_dev$dvb_frontend(&(0x7f0000000100), 0x1, 0x802) (async)
syz_open_dev$dvb_frontend(&(0x7f0000000080), 0x0, 0x402)

program crashed: KASAN: slab-use-after-free Read in dvb_device_open
testing program (duration=45s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): socket$inet6_tcp-connect$inet6-gettid-timer_settime-socketpair$unix-getsockopt$sock_cred-setsockopt$sock_cred-setsockopt$inet6_tcp_TCP_REPAIR_QUEUE-mmap-mmap-mmap-mmap$dsp-socket$xdp-socket$kcm-socket-openat$fuse-read$FUSE-setsockopt$IP_VS_SO_SET_ADD-sendmsg$sock-syz_usb_connect-sendmsg$inet-syz_usb_connect$uac3-syz_usb_control_io$printer-syz_open_dev$dvb_frontend-syz_open_dev$dvb_frontend
detailed listing:
executing program 0:
r0 = socket$inet6_tcp(0xa, 0x1, 0x0)
connect$inet6(r0, 0x0, 0x0)
gettid()
timer_settime(0x0, 0x0, &(0x7f0000000280)={{0x0, 0x989680}, {0x0, 0x989680}}, 0x0)
socketpair$unix(0x1, 0x0, 0x0, 0x0)
getsockopt$sock_cred(0xffffffffffffffff, 0x1, 0x11, 0x0, &(0x7f0000cab000))
setsockopt$sock_cred(0xffffffffffffffff, 0x1, 0x11, 0x0, 0x0)
setsockopt$inet6_tcp_TCP_REPAIR_QUEUE(r0, 0x6, 0x14, 0x0, 0x0)
mmap(&(0x7f0000000000/0x4000)=nil, 0x4000, 0x1, 0x10012, 0xffffffffffffffff, 0x5deba000)
mmap(&(0x7f0000bfe000/0x400000)=nil, 0x400000, 0x4, 0x40010, r0, 0xd1aa000)
mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x3, 0x8031, 0xffffffffffffffff, 0x0)
mmap$dsp(&(0x7f0000ffd000/0x2000)=nil, 0x2000, 0x100000b, 0x810, 0xffffffffffffffff, 0x0)
socket$xdp(0x2c, 0x3, 0x0)
r1 = socket$kcm(0xa, 0x2, 0x0)
r2 = socket(0x2, 0x80805, 0x0)
r3 = openat$fuse(0xffffffffffffff9c, &(0x7f0000000080), 0x2, 0x0)
read$FUSE(r3, &(0x7f0000000600)={0x2020}, 0x2020)
setsockopt$IP_VS_SO_SET_ADD(r2, 0x0, 0x482, &(0x7f0000000240)={0x84, @dev={0xac, 0x14, 0x14, 0x15}, 0x4e20, 0x3, 'wlc\x00', 0x2, 0x660f537e, 0x3}, 0x2c)
sendmsg$sock(r1, &(0x7f0000000400)={&(0x7f0000000580)=@in6={0x2, 0x4e20, 0x0, @dev={0xfe, 0x80, '\x00', 0xfd}}, 0x80, 0x0, 0x0, &(0x7f0000000000)=[@mark={{0x14, 0x1, 0x24, 0x3}}], 0x18}, 0x0)
r4 = syz_usb_connect(0x0, 0x32, &(0x7f0000000000)=ANY=[@ANYBLOB="1201000200000040a61b01000100000000010902200001010080320904"], 0x0)
sendmsg$inet(0xffffffffffffffff, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)=[{&(0x7f0000000100)="5c00000012006bab9e3fe3d86e6c1d0000147ea60864160af36504b68675f8001d000a00a0e69ee517d34460bc24eab556a705251e6182949a36c23d3b48dfd8cdbf9367b4fa51f60a64c9f4080003680601000008000300ff000000", 0x5c}], 0x1, 0x0, 0x0, 0x1f00c00e}, 0x0)
syz_usb_connect$uac3(0x3, 0x80, &(0x7f0000000280)=ANY=[], 0x0)
syz_usb_control_io$printer(r4, 0x0, &(0x7f00000005c0)={0x34, &(0x7f00000003c0)=ANY=[], 0x0, 0x0, 0x0, 0x0, 0x0})
syz_open_dev$dvb_frontend(&(0x7f0000000100), 0x1, 0x802) (async)
syz_open_dev$dvb_frontend(&(0x7f0000000080), 0x0, 0x402)

program crashed: KASAN: slab-use-after-free Read in dvb_device_open
testing program (duration=45s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): socket$inet6_tcp-connect$inet6-gettid-timer_settime-socketpair$unix-getsockopt$sock_cred-setsockopt$sock_cred-setsockopt$inet6_tcp_TCP_REPAIR_QUEUE-mmap-mmap-mmap-mmap$dsp-socket$xdp-socket$kcm-socket-openat$fuse-read$FUSE-setsockopt$IP_VS_SO_SET_ADD-sendmsg$sock-syz_usb_connect-sendmsg$inet-syz_usb_connect$uac3-syz_open_dev$dvb_frontend-syz_open_dev$dvb_frontend
detailed listing:
executing program 0:
r0 = socket$inet6_tcp(0xa, 0x1, 0x0)
connect$inet6(r0, 0x0, 0x0)
gettid()
timer_settime(0x0, 0x0, &(0x7f0000000280)={{0x0, 0x989680}, {0x0, 0x989680}}, 0x0)
socketpair$unix(0x1, 0x0, 0x0, 0x0)
getsockopt$sock_cred(0xffffffffffffffff, 0x1, 0x11, 0x0, &(0x7f0000cab000))
setsockopt$sock_cred(0xffffffffffffffff, 0x1, 0x11, 0x0, 0x0)
setsockopt$inet6_tcp_TCP_REPAIR_QUEUE(r0, 0x6, 0x14, 0x0, 0x0)
mmap(&(0x7f0000000000/0x4000)=nil, 0x4000, 0x1, 0x10012, 0xffffffffffffffff, 0x5deba000)
mmap(&(0x7f0000bfe000/0x400000)=nil, 0x400000, 0x4, 0x40010, r0, 0xd1aa000)
mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x3, 0x8031, 0xffffffffffffffff, 0x0)
mmap$dsp(&(0x7f0000ffd000/0x2000)=nil, 0x2000, 0x100000b, 0x810, 0xffffffffffffffff, 0x0)
socket$xdp(0x2c, 0x3, 0x0)
r1 = socket$kcm(0xa, 0x2, 0x0)
r2 = socket(0x2, 0x80805, 0x0)
r3 = openat$fuse(0xffffffffffffff9c, &(0x7f0000000080), 0x2, 0x0)
read$FUSE(r3, &(0x7f0000000600)={0x2020}, 0x2020)
setsockopt$IP_VS_SO_SET_ADD(r2, 0x0, 0x482, &(0x7f0000000240)={0x84, @dev={0xac, 0x14, 0x14, 0x15}, 0x4e20, 0x3, 'wlc\x00', 0x2, 0x660f537e, 0x3}, 0x2c)
sendmsg$sock(r1, &(0x7f0000000400)={&(0x7f0000000580)=@in6={0x2, 0x4e20, 0x0, @dev={0xfe, 0x80, '\x00', 0xfd}}, 0x80, 0x0, 0x0, &(0x7f0000000000)=[@mark={{0x14, 0x1, 0x24, 0x3}}], 0x18}, 0x0)
syz_usb_connect(0x0, 0x32, &(0x7f0000000000)=ANY=[@ANYBLOB="1201000200000040a61b01000100000000010902200001010080320904"], 0x0)
sendmsg$inet(0xffffffffffffffff, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)=[{&(0x7f0000000100)="5c00000012006bab9e3fe3d86e6c1d0000147ea60864160af36504b68675f8001d000a00a0e69ee517d34460bc24eab556a705251e6182949a36c23d3b48dfd8cdbf9367b4fa51f60a64c9f4080003680601000008000300ff000000", 0x5c}], 0x1, 0x0, 0x0, 0x1f00c00e}, 0x0)
syz_usb_connect$uac3(0x3, 0x80, &(0x7f0000000280)=ANY=[], 0x0)
syz_open_dev$dvb_frontend(&(0x7f0000000100), 0x1, 0x802) (async)
syz_open_dev$dvb_frontend(&(0x7f0000000080), 0x0, 0x402)

program crashed: KASAN: slab-use-after-free Read in dvb_device_open
testing program (duration=45s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): socket$inet6_tcp-connect$inet6-gettid-timer_settime-socketpair$unix-getsockopt$sock_cred-setsockopt$sock_cred-setsockopt$inet6_tcp_TCP_REPAIR_QUEUE-mmap-mmap-mmap-mmap$dsp-socket$xdp-socket$kcm-socket-openat$fuse-read$FUSE-setsockopt$IP_VS_SO_SET_ADD-sendmsg$sock-syz_usb_connect-sendmsg$inet-syz_open_dev$dvb_frontend-syz_open_dev$dvb_frontend
detailed listing:
executing program 0:
r0 = socket$inet6_tcp(0xa, 0x1, 0x0)
connect$inet6(r0, 0x0, 0x0)
gettid()
timer_settime(0x0, 0x0, &(0x7f0000000280)={{0x0, 0x989680}, {0x0, 0x989680}}, 0x0)
socketpair$unix(0x1, 0x0, 0x0, 0x0)
getsockopt$sock_cred(0xffffffffffffffff, 0x1, 0x11, 0x0, &(0x7f0000cab000))
setsockopt$sock_cred(0xffffffffffffffff, 0x1, 0x11, 0x0, 0x0)
setsockopt$inet6_tcp_TCP_REPAIR_QUEUE(r0, 0x6, 0x14, 0x0, 0x0)
mmap(&(0x7f0000000000/0x4000)=nil, 0x4000, 0x1, 0x10012, 0xffffffffffffffff, 0x5deba000)
mmap(&(0x7f0000bfe000/0x400000)=nil, 0x400000, 0x4, 0x40010, r0, 0xd1aa000)
mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x3, 0x8031, 0xffffffffffffffff, 0x0)
mmap$dsp(&(0x7f0000ffd000/0x2000)=nil, 0x2000, 0x100000b, 0x810, 0xffffffffffffffff, 0x0)
socket$xdp(0x2c, 0x3, 0x0)
r1 = socket$kcm(0xa, 0x2, 0x0)
r2 = socket(0x2, 0x80805, 0x0)
r3 = openat$fuse(0xffffffffffffff9c, &(0x7f0000000080), 0x2, 0x0)
read$FUSE(r3, &(0x7f0000000600)={0x2020}, 0x2020)
setsockopt$IP_VS_SO_SET_ADD(r2, 0x0, 0x482, &(0x7f0000000240)={0x84, @dev={0xac, 0x14, 0x14, 0x15}, 0x4e20, 0x3, 'wlc\x00', 0x2, 0x660f537e, 0x3}, 0x2c)
sendmsg$sock(r1, &(0x7f0000000400)={&(0x7f0000000580)=@in6={0x2, 0x4e20, 0x0, @dev={0xfe, 0x80, '\x00', 0xfd}}, 0x80, 0x0, 0x0, &(0x7f0000000000)=[@mark={{0x14, 0x1, 0x24, 0x3}}], 0x18}, 0x0)
syz_usb_connect(0x0, 0x32, &(0x7f0000000000)=ANY=[@ANYBLOB="1201000200000040a61b01000100000000010902200001010080320904"], 0x0)
sendmsg$inet(0xffffffffffffffff, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)=[{&(0x7f0000000100)="5c00000012006bab9e3fe3d86e6c1d0000147ea60864160af36504b68675f8001d000a00a0e69ee517d34460bc24eab556a705251e6182949a36c23d3b48dfd8cdbf9367b4fa51f60a64c9f4080003680601000008000300ff000000", 0x5c}], 0x1, 0x0, 0x0, 0x1f00c00e}, 0x0)
syz_open_dev$dvb_frontend(&(0x7f0000000100), 0x1, 0x802) (async)
syz_open_dev$dvb_frontend(&(0x7f0000000080), 0x0, 0x402)

program crashed: KASAN: slab-use-after-free Read in dvb_device_open
testing program (duration=45s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): socket$inet6_tcp-connect$inet6-gettid-timer_settime-socketpair$unix-getsockopt$sock_cred-setsockopt$sock_cred-setsockopt$inet6_tcp_TCP_REPAIR_QUEUE-mmap-mmap-mmap-mmap$dsp-socket$xdp-socket$kcm-socket-openat$fuse-read$FUSE-setsockopt$IP_VS_SO_SET_ADD-sendmsg$sock-syz_usb_connect-syz_open_dev$dvb_frontend-syz_open_dev$dvb_frontend
detailed listing:
executing program 0:
r0 = socket$inet6_tcp(0xa, 0x1, 0x0)
connect$inet6(r0, 0x0, 0x0)
gettid()
timer_settime(0x0, 0x0, &(0x7f0000000280)={{0x0, 0x989680}, {0x0, 0x989680}}, 0x0)
socketpair$unix(0x1, 0x0, 0x0, 0x0)
getsockopt$sock_cred(0xffffffffffffffff, 0x1, 0x11, 0x0, &(0x7f0000cab000))
setsockopt$sock_cred(0xffffffffffffffff, 0x1, 0x11, 0x0, 0x0)
setsockopt$inet6_tcp_TCP_REPAIR_QUEUE(r0, 0x6, 0x14, 0x0, 0x0)
mmap(&(0x7f0000000000/0x4000)=nil, 0x4000, 0x1, 0x10012, 0xffffffffffffffff, 0x5deba000)
mmap(&(0x7f0000bfe000/0x400000)=nil, 0x400000, 0x4, 0x40010, r0, 0xd1aa000)
mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x3, 0x8031, 0xffffffffffffffff, 0x0)
mmap$dsp(&(0x7f0000ffd000/0x2000)=nil, 0x2000, 0x100000b, 0x810, 0xffffffffffffffff, 0x0)
socket$xdp(0x2c, 0x3, 0x0)
r1 = socket$kcm(0xa, 0x2, 0x0)
r2 = socket(0x2, 0x80805, 0x0)
r3 = openat$fuse(0xffffffffffffff9c, &(0x7f0000000080), 0x2, 0x0)
read$FUSE(r3, &(0x7f0000000600)={0x2020}, 0x2020)
setsockopt$IP_VS_SO_SET_ADD(r2, 0x0, 0x482, &(0x7f0000000240)={0x84, @dev={0xac, 0x14, 0x14, 0x15}, 0x4e20, 0x3, 'wlc\x00', 0x2, 0x660f537e, 0x3}, 0x2c)
sendmsg$sock(r1, &(0x7f0000000400)={&(0x7f0000000580)=@in6={0x2, 0x4e20, 0x0, @dev={0xfe, 0x80, '\x00', 0xfd}}, 0x80, 0x0, 0x0, &(0x7f0000000000)=[@mark={{0x14, 0x1, 0x24, 0x3}}], 0x18}, 0x0)
syz_usb_connect(0x0, 0x32, &(0x7f0000000000)=ANY=[@ANYBLOB="1201000200000040a61b01000100000000010902200001010080320904"], 0x0)
syz_open_dev$dvb_frontend(&(0x7f0000000100), 0x1, 0x802) (async)
syz_open_dev$dvb_frontend(&(0x7f0000000080), 0x0, 0x402)

program crashed: KASAN: slab-use-after-free Read in dvb_device_open
testing program (duration=45s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): socket$inet6_tcp-connect$inet6-gettid-timer_settime-socketpair$unix-getsockopt$sock_cred-setsockopt$sock_cred-setsockopt$inet6_tcp_TCP_REPAIR_QUEUE-mmap-mmap-mmap-mmap$dsp-socket$xdp-socket$kcm-socket-openat$fuse-read$FUSE-setsockopt$IP_VS_SO_SET_ADD-sendmsg$sock-syz_open_dev$dvb_frontend-syz_open_dev$dvb_frontend
detailed listing:
executing program 0:
r0 = socket$inet6_tcp(0xa, 0x1, 0x0)
connect$inet6(r0, 0x0, 0x0)
gettid()
timer_settime(0x0, 0x0, &(0x7f0000000280)={{0x0, 0x989680}, {0x0, 0x989680}}, 0x0)
socketpair$unix(0x1, 0x0, 0x0, 0x0)
getsockopt$sock_cred(0xffffffffffffffff, 0x1, 0x11, 0x0, &(0x7f0000cab000))
setsockopt$sock_cred(0xffffffffffffffff, 0x1, 0x11, 0x0, 0x0)
setsockopt$inet6_tcp_TCP_REPAIR_QUEUE(r0, 0x6, 0x14, 0x0, 0x0)
mmap(&(0x7f0000000000/0x4000)=nil, 0x4000, 0x1, 0x10012, 0xffffffffffffffff, 0x5deba000)
mmap(&(0x7f0000bfe000/0x400000)=nil, 0x400000, 0x4, 0x40010, r0, 0xd1aa000)
mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x3, 0x8031, 0xffffffffffffffff, 0x0)
mmap$dsp(&(0x7f0000ffd000/0x2000)=nil, 0x2000, 0x100000b, 0x810, 0xffffffffffffffff, 0x0)
socket$xdp(0x2c, 0x3, 0x0)
r1 = socket$kcm(0xa, 0x2, 0x0)
r2 = socket(0x2, 0x80805, 0x0)
r3 = openat$fuse(0xffffffffffffff9c, &(0x7f0000000080), 0x2, 0x0)
read$FUSE(r3, &(0x7f0000000600)={0x2020}, 0x2020)
setsockopt$IP_VS_SO_SET_ADD(r2, 0x0, 0x482, &(0x7f0000000240)={0x84, @dev={0xac, 0x14, 0x14, 0x15}, 0x4e20, 0x3, 'wlc\x00', 0x2, 0x660f537e, 0x3}, 0x2c)
sendmsg$sock(r1, &(0x7f0000000400)={&(0x7f0000000580)=@in6={0x2, 0x4e20, 0x0, @dev={0xfe, 0x80, '\x00', 0xfd}}, 0x80, 0x0, 0x0, &(0x7f0000000000)=[@mark={{0x14, 0x1, 0x24, 0x3}}], 0x18}, 0x0)
syz_open_dev$dvb_frontend(&(0x7f0000000100), 0x1, 0x802) (async)
syz_open_dev$dvb_frontend(&(0x7f0000000080), 0x0, 0x402)

program did not crash
testing program (duration=45s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): socket$inet6_tcp-connect$inet6-gettid-timer_settime-socketpair$unix-getsockopt$sock_cred-setsockopt$sock_cred-setsockopt$inet6_tcp_TCP_REPAIR_QUEUE-mmap-mmap-mmap-mmap$dsp-socket$xdp-socket$kcm-socket-openat$fuse-read$FUSE-setsockopt$IP_VS_SO_SET_ADD-syz_usb_connect-syz_open_dev$dvb_frontend-syz_open_dev$dvb_frontend
detailed listing:
executing program 0:
r0 = socket$inet6_tcp(0xa, 0x1, 0x0)
connect$inet6(r0, 0x0, 0x0)
gettid()
timer_settime(0x0, 0x0, &(0x7f0000000280)={{0x0, 0x989680}, {0x0, 0x989680}}, 0x0)
socketpair$unix(0x1, 0x0, 0x0, 0x0)
getsockopt$sock_cred(0xffffffffffffffff, 0x1, 0x11, 0x0, &(0x7f0000cab000))
setsockopt$sock_cred(0xffffffffffffffff, 0x1, 0x11, 0x0, 0x0)
setsockopt$inet6_tcp_TCP_REPAIR_QUEUE(r0, 0x6, 0x14, 0x0, 0x0)
mmap(&(0x7f0000000000/0x4000)=nil, 0x4000, 0x1, 0x10012, 0xffffffffffffffff, 0x5deba000)
mmap(&(0x7f0000bfe000/0x400000)=nil, 0x400000, 0x4, 0x40010, r0, 0xd1aa000)
mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x3, 0x8031, 0xffffffffffffffff, 0x0)
mmap$dsp(&(0x7f0000ffd000/0x2000)=nil, 0x2000, 0x100000b, 0x810, 0xffffffffffffffff, 0x0)
socket$xdp(0x2c, 0x3, 0x0)
socket$kcm(0xa, 0x2, 0x0)
r1 = socket(0x2, 0x80805, 0x0)
r2 = openat$fuse(0xffffffffffffff9c, &(0x7f0000000080), 0x2, 0x0)
read$FUSE(r2, &(0x7f0000000600)={0x2020}, 0x2020)
setsockopt$IP_VS_SO_SET_ADD(r1, 0x0, 0x482, &(0x7f0000000240)={0x84, @dev={0xac, 0x14, 0x14, 0x15}, 0x4e20, 0x3, 'wlc\x00', 0x2, 0x660f537e, 0x3}, 0x2c)
syz_usb_connect(0x0, 0x32, &(0x7f0000000000)=ANY=[@ANYBLOB="1201000200000040a61b01000100000000010902200001010080320904"], 0x0)
syz_open_dev$dvb_frontend(&(0x7f0000000100), 0x1, 0x802) (async)
syz_open_dev$dvb_frontend(&(0x7f0000000080), 0x0, 0x402)

program crashed: KASAN: slab-use-after-free Read in dvb_device_open
testing program (duration=45s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): socket$inet6_tcp-connect$inet6-gettid-timer_settime-socketpair$unix-getsockopt$sock_cred-setsockopt$sock_cred-setsockopt$inet6_tcp_TCP_REPAIR_QUEUE-mmap-mmap-mmap-mmap$dsp-socket$xdp-socket$kcm-socket-openat$fuse-read$FUSE-syz_usb_connect-syz_open_dev$dvb_frontend-syz_open_dev$dvb_frontend
detailed listing:
executing program 0:
r0 = socket$inet6_tcp(0xa, 0x1, 0x0)
connect$inet6(r0, 0x0, 0x0)
gettid()
timer_settime(0x0, 0x0, &(0x7f0000000280)={{0x0, 0x989680}, {0x0, 0x989680}}, 0x0)
socketpair$unix(0x1, 0x0, 0x0, 0x0)
getsockopt$sock_cred(0xffffffffffffffff, 0x1, 0x11, 0x0, &(0x7f0000cab000))
setsockopt$sock_cred(0xffffffffffffffff, 0x1, 0x11, 0x0, 0x0)
setsockopt$inet6_tcp_TCP_REPAIR_QUEUE(r0, 0x6, 0x14, 0x0, 0x0)
mmap(&(0x7f0000000000/0x4000)=nil, 0x4000, 0x1, 0x10012, 0xffffffffffffffff, 0x5deba000)
mmap(&(0x7f0000bfe000/0x400000)=nil, 0x400000, 0x4, 0x40010, r0, 0xd1aa000)
mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x3, 0x8031, 0xffffffffffffffff, 0x0)
mmap$dsp(&(0x7f0000ffd000/0x2000)=nil, 0x2000, 0x100000b, 0x810, 0xffffffffffffffff, 0x0)
socket$xdp(0x2c, 0x3, 0x0)
socket$kcm(0xa, 0x2, 0x0)
socket(0x2, 0x80805, 0x0)
r1 = openat$fuse(0xffffffffffffff9c, &(0x7f0000000080), 0x2, 0x0)
read$FUSE(r1, &(0x7f0000000600)={0x2020}, 0x2020)
syz_usb_connect(0x0, 0x32, &(0x7f0000000000)=ANY=[@ANYBLOB="1201000200000040a61b01000100000000010902200001010080320904"], 0x0)
syz_open_dev$dvb_frontend(&(0x7f0000000100), 0x1, 0x802) (async)
syz_open_dev$dvb_frontend(&(0x7f0000000080), 0x0, 0x402)

program crashed: KASAN: slab-use-after-free Read in dvb_device_open
testing program (duration=45s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): socket$inet6_tcp-connect$inet6-gettid-timer_settime-socketpair$unix-getsockopt$sock_cred-setsockopt$sock_cred-setsockopt$inet6_tcp_TCP_REPAIR_QUEUE-mmap-mmap-mmap-mmap$dsp-socket$xdp-socket$kcm-socket-openat$fuse-syz_usb_connect-syz_open_dev$dvb_frontend-syz_open_dev$dvb_frontend
detailed listing:
executing program 0:
r0 = socket$inet6_tcp(0xa, 0x1, 0x0)
connect$inet6(r0, 0x0, 0x0)
gettid()
timer_settime(0x0, 0x0, &(0x7f0000000280)={{0x0, 0x989680}, {0x0, 0x989680}}, 0x0)
socketpair$unix(0x1, 0x0, 0x0, 0x0)
getsockopt$sock_cred(0xffffffffffffffff, 0x1, 0x11, 0x0, &(0x7f0000cab000))
setsockopt$sock_cred(0xffffffffffffffff, 0x1, 0x11, 0x0, 0x0)
setsockopt$inet6_tcp_TCP_REPAIR_QUEUE(r0, 0x6, 0x14, 0x0, 0x0)
mmap(&(0x7f0000000000/0x4000)=nil, 0x4000, 0x1, 0x10012, 0xffffffffffffffff, 0x5deba000)
mmap(&(0x7f0000bfe000/0x400000)=nil, 0x400000, 0x4, 0x40010, r0, 0xd1aa000)
mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x3, 0x8031, 0xffffffffffffffff, 0x0)
mmap$dsp(&(0x7f0000ffd000/0x2000)=nil, 0x2000, 0x100000b, 0x810, 0xffffffffffffffff, 0x0)
socket$xdp(0x2c, 0x3, 0x0)
socket$kcm(0xa, 0x2, 0x0)
socket(0x2, 0x80805, 0x0)
openat$fuse(0xffffffffffffff9c, &(0x7f0000000080), 0x2, 0x0)
syz_usb_connect(0x0, 0x32, &(0x7f0000000000)=ANY=[@ANYBLOB="1201000200000040a61b01000100000000010902200001010080320904"], 0x0)
syz_open_dev$dvb_frontend(&(0x7f0000000100), 0x1, 0x802) (async)
syz_open_dev$dvb_frontend(&(0x7f0000000080), 0x0, 0x402)

program crashed: KASAN: slab-use-after-free Read in dvb_device_open
testing program (duration=45s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): socket$inet6_tcp-connect$inet6-gettid-timer_settime-socketpair$unix-getsockopt$sock_cred-setsockopt$sock_cred-setsockopt$inet6_tcp_TCP_REPAIR_QUEUE-mmap-mmap-mmap-mmap$dsp-socket$xdp-socket$kcm-socket-syz_usb_connect-syz_open_dev$dvb_frontend-syz_open_dev$dvb_frontend
detailed listing:
executing program 0:
r0 = socket$inet6_tcp(0xa, 0x1, 0x0)
connect$inet6(r0, 0x0, 0x0)
gettid()
timer_settime(0x0, 0x0, &(0x7f0000000280)={{0x0, 0x989680}, {0x0, 0x989680}}, 0x0)
socketpair$unix(0x1, 0x0, 0x0, 0x0)
getsockopt$sock_cred(0xffffffffffffffff, 0x1, 0x11, 0x0, &(0x7f0000cab000))
setsockopt$sock_cred(0xffffffffffffffff, 0x1, 0x11, 0x0, 0x0)
setsockopt$inet6_tcp_TCP_REPAIR_QUEUE(r0, 0x6, 0x14, 0x0, 0x0)
mmap(&(0x7f0000000000/0x4000)=nil, 0x4000, 0x1, 0x10012, 0xffffffffffffffff, 0x5deba000)
mmap(&(0x7f0000bfe000/0x400000)=nil, 0x400000, 0x4, 0x40010, r0, 0xd1aa000)
mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x3, 0x8031, 0xffffffffffffffff, 0x0)
mmap$dsp(&(0x7f0000ffd000/0x2000)=nil, 0x2000, 0x100000b, 0x810, 0xffffffffffffffff, 0x0)
socket$xdp(0x2c, 0x3, 0x0)
socket$kcm(0xa, 0x2, 0x0)
socket(0x2, 0x80805, 0x0)
syz_usb_connect(0x0, 0x32, &(0x7f0000000000)=ANY=[@ANYBLOB="1201000200000040a61b01000100000000010902200001010080320904"], 0x0)
syz_open_dev$dvb_frontend(&(0x7f0000000100), 0x1, 0x802) (async)
syz_open_dev$dvb_frontend(&(0x7f0000000080), 0x0, 0x402)

program crashed: lost connection to test machine
ignore low priority crash: lost connection to test machine
testing program (duration=45s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): socket$inet6_tcp-connect$inet6-gettid-timer_settime-socketpair$unix-getsockopt$sock_cred-setsockopt$sock_cred-setsockopt$inet6_tcp_TCP_REPAIR_QUEUE-mmap-mmap-mmap-mmap$dsp-socket$xdp-socket$kcm-openat$fuse-syz_usb_connect-syz_open_dev$dvb_frontend-syz_open_dev$dvb_frontend
detailed listing:
executing program 0:
r0 = socket$inet6_tcp(0xa, 0x1, 0x0)
connect$inet6(r0, 0x0, 0x0)
gettid()
timer_settime(0x0, 0x0, &(0x7f0000000280)={{0x0, 0x989680}, {0x0, 0x989680}}, 0x0)
socketpair$unix(0x1, 0x0, 0x0, 0x0)
getsockopt$sock_cred(0xffffffffffffffff, 0x1, 0x11, 0x0, &(0x7f0000cab000))
setsockopt$sock_cred(0xffffffffffffffff, 0x1, 0x11, 0x0, 0x0)
setsockopt$inet6_tcp_TCP_REPAIR_QUEUE(r0, 0x6, 0x14, 0x0, 0x0)
mmap(&(0x7f0000000000/0x4000)=nil, 0x4000, 0x1, 0x10012, 0xffffffffffffffff, 0x5deba000)
mmap(&(0x7f0000bfe000/0x400000)=nil, 0x400000, 0x4, 0x40010, r0, 0xd1aa000)
mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x3, 0x8031, 0xffffffffffffffff, 0x0)
mmap$dsp(&(0x7f0000ffd000/0x2000)=nil, 0x2000, 0x100000b, 0x810, 0xffffffffffffffff, 0x0)
socket$xdp(0x2c, 0x3, 0x0)
socket$kcm(0xa, 0x2, 0x0)
openat$fuse(0xffffffffffffff9c, &(0x7f0000000080), 0x2, 0x0)
syz_usb_connect(0x0, 0x32, &(0x7f0000000000)=ANY=[@ANYBLOB="1201000200000040a61b01000100000000010902200001010080320904"], 0x0)
syz_open_dev$dvb_frontend(&(0x7f0000000100), 0x1, 0x802) (async)
syz_open_dev$dvb_frontend(&(0x7f0000000080), 0x0, 0x402)

program crashed: KASAN: slab-use-after-free Read in dvb_device_open
testing program (duration=45s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): socket$inet6_tcp-connect$inet6-gettid-timer_settime-socketpair$unix-getsockopt$sock_cred-setsockopt$sock_cred-setsockopt$inet6_tcp_TCP_REPAIR_QUEUE-mmap-mmap-mmap-mmap$dsp-socket$xdp-openat$fuse-syz_usb_connect-syz_open_dev$dvb_frontend-syz_open_dev$dvb_frontend
detailed listing:
executing program 0:
r0 = socket$inet6_tcp(0xa, 0x1, 0x0)
connect$inet6(r0, 0x0, 0x0)
gettid()
timer_settime(0x0, 0x0, &(0x7f0000000280)={{0x0, 0x989680}, {0x0, 0x989680}}, 0x0)
socketpair$unix(0x1, 0x0, 0x0, 0x0)
getsockopt$sock_cred(0xffffffffffffffff, 0x1, 0x11, 0x0, &(0x7f0000cab000))
setsockopt$sock_cred(0xffffffffffffffff, 0x1, 0x11, 0x0, 0x0)
setsockopt$inet6_tcp_TCP_REPAIR_QUEUE(r0, 0x6, 0x14, 0x0, 0x0)
mmap(&(0x7f0000000000/0x4000)=nil, 0x4000, 0x1, 0x10012, 0xffffffffffffffff, 0x5deba000)
mmap(&(0x7f0000bfe000/0x400000)=nil, 0x400000, 0x4, 0x40010, r0, 0xd1aa000)
mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x3, 0x8031, 0xffffffffffffffff, 0x0)
mmap$dsp(&(0x7f0000ffd000/0x2000)=nil, 0x2000, 0x100000b, 0x810, 0xffffffffffffffff, 0x0)
socket$xdp(0x2c, 0x3, 0x0)
openat$fuse(0xffffffffffffff9c, &(0x7f0000000080), 0x2, 0x0)
syz_usb_connect(0x0, 0x32, &(0x7f0000000000)=ANY=[@ANYBLOB="1201000200000040a61b01000100000000010902200001010080320904"], 0x0)
syz_open_dev$dvb_frontend(&(0x7f0000000100), 0x1, 0x802) (async)
syz_open_dev$dvb_frontend(&(0x7f0000000080), 0x0, 0x402)

program crashed: KASAN: slab-use-after-free Read in dvb_device_open
testing program (duration=45s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): socket$inet6_tcp-connect$inet6-gettid-timer_settime-socketpair$unix-getsockopt$sock_cred-setsockopt$sock_cred-setsockopt$inet6_tcp_TCP_REPAIR_QUEUE-mmap-mmap-mmap-mmap$dsp-openat$fuse-syz_usb_connect-syz_open_dev$dvb_frontend-syz_open_dev$dvb_frontend
detailed listing:
executing program 0:
r0 = socket$inet6_tcp(0xa, 0x1, 0x0)
connect$inet6(r0, 0x0, 0x0)
gettid()
timer_settime(0x0, 0x0, &(0x7f0000000280)={{0x0, 0x989680}, {0x0, 0x989680}}, 0x0)
socketpair$unix(0x1, 0x0, 0x0, 0x0)
getsockopt$sock_cred(0xffffffffffffffff, 0x1, 0x11, 0x0, &(0x7f0000cab000))
setsockopt$sock_cred(0xffffffffffffffff, 0x1, 0x11, 0x0, 0x0)
setsockopt$inet6_tcp_TCP_REPAIR_QUEUE(r0, 0x6, 0x14, 0x0, 0x0)
mmap(&(0x7f0000000000/0x4000)=nil, 0x4000, 0x1, 0x10012, 0xffffffffffffffff, 0x5deba000)
mmap(&(0x7f0000bfe000/0x400000)=nil, 0x400000, 0x4, 0x40010, r0, 0xd1aa000)
mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x3, 0x8031, 0xffffffffffffffff, 0x0)
mmap$dsp(&(0x7f0000ffd000/0x2000)=nil, 0x2000, 0x100000b, 0x810, 0xffffffffffffffff, 0x0)
openat$fuse(0xffffffffffffff9c, &(0x7f0000000080), 0x2, 0x0)
syz_usb_connect(0x0, 0x32, &(0x7f0000000000)=ANY=[@ANYBLOB="1201000200000040a61b01000100000000010902200001010080320904"], 0x0)
syz_open_dev$dvb_frontend(&(0x7f0000000100), 0x1, 0x802) (async)
syz_open_dev$dvb_frontend(&(0x7f0000000080), 0x0, 0x402)

program crashed: KASAN: slab-use-after-free Read in dvb_device_open
testing program (duration=45s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): socket$inet6_tcp-connect$inet6-gettid-timer_settime-socketpair$unix-getsockopt$sock_cred-setsockopt$sock_cred-setsockopt$inet6_tcp_TCP_REPAIR_QUEUE-mmap-mmap-mmap-openat$fuse-syz_usb_connect-syz_open_dev$dvb_frontend-syz_open_dev$dvb_frontend
detailed listing:
executing program 0:
r0 = socket$inet6_tcp(0xa, 0x1, 0x0)
connect$inet6(r0, 0x0, 0x0)
gettid()
timer_settime(0x0, 0x0, &(0x7f0000000280)={{0x0, 0x989680}, {0x0, 0x989680}}, 0x0)
socketpair$unix(0x1, 0x0, 0x0, 0x0)
getsockopt$sock_cred(0xffffffffffffffff, 0x1, 0x11, 0x0, &(0x7f0000cab000))
setsockopt$sock_cred(0xffffffffffffffff, 0x1, 0x11, 0x0, 0x0)
setsockopt$inet6_tcp_TCP_REPAIR_QUEUE(r0, 0x6, 0x14, 0x0, 0x0)
mmap(&(0x7f0000000000/0x4000)=nil, 0x4000, 0x1, 0x10012, 0xffffffffffffffff, 0x5deba000)
mmap(&(0x7f0000bfe000/0x400000)=nil, 0x400000, 0x4, 0x40010, r0, 0xd1aa000)
mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x3, 0x8031, 0xffffffffffffffff, 0x0)
openat$fuse(0xffffffffffffff9c, &(0x7f0000000080), 0x2, 0x0)
syz_usb_connect(0x0, 0x32, &(0x7f0000000000)=ANY=[@ANYBLOB="1201000200000040a61b01000100000000010902200001010080320904"], 0x0)
syz_open_dev$dvb_frontend(&(0x7f0000000100), 0x1, 0x802) (async)
syz_open_dev$dvb_frontend(&(0x7f0000000080), 0x0, 0x402)

program crashed: KASAN: slab-use-after-free Read in dvb_device_open
testing program (duration=45s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): socket$inet6_tcp-connect$inet6-gettid-timer_settime-socketpair$unix-getsockopt$sock_cred-setsockopt$sock_cred-setsockopt$inet6_tcp_TCP_REPAIR_QUEUE-mmap-mmap-openat$fuse-syz_usb_connect-syz_open_dev$dvb_frontend-syz_open_dev$dvb_frontend
detailed listing:
executing program 0:
r0 = socket$inet6_tcp(0xa, 0x1, 0x0)
connect$inet6(r0, 0x0, 0x0)
gettid()
timer_settime(0x0, 0x0, &(0x7f0000000280)={{0x0, 0x989680}, {0x0, 0x989680}}, 0x0)
socketpair$unix(0x1, 0x0, 0x0, 0x0)
getsockopt$sock_cred(0xffffffffffffffff, 0x1, 0x11, 0x0, &(0x7f0000cab000))
setsockopt$sock_cred(0xffffffffffffffff, 0x1, 0x11, 0x0, 0x0)
setsockopt$inet6_tcp_TCP_REPAIR_QUEUE(r0, 0x6, 0x14, 0x0, 0x0)
mmap(&(0x7f0000000000/0x4000)=nil, 0x4000, 0x1, 0x10012, 0xffffffffffffffff, 0x5deba000)
mmap(&(0x7f0000bfe000/0x400000)=nil, 0x400000, 0x4, 0x40010, r0, 0xd1aa000)
openat$fuse(0xffffffffffffff9c, &(0x7f0000000080), 0x2, 0x0)
syz_usb_connect(0x0, 0x32, &(0x7f0000000000)=ANY=[@ANYBLOB="1201000200000040a61b01000100000000010902200001010080320904"], 0x0)
syz_open_dev$dvb_frontend(&(0x7f0000000100), 0x1, 0x802) (async)
syz_open_dev$dvb_frontend(&(0x7f0000000080), 0x0, 0x402)

program crashed: KASAN: slab-use-after-free Read in dvb_device_open
testing program (duration=45s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): socket$inet6_tcp-connect$inet6-gettid-timer_settime-socketpair$unix-getsockopt$sock_cred-setsockopt$sock_cred-setsockopt$inet6_tcp_TCP_REPAIR_QUEUE-mmap-openat$fuse-syz_usb_connect-syz_open_dev$dvb_frontend-syz_open_dev$dvb_frontend
detailed listing:
executing program 0:
r0 = socket$inet6_tcp(0xa, 0x1, 0x0)
connect$inet6(r0, 0x0, 0x0)
gettid()
timer_settime(0x0, 0x0, &(0x7f0000000280)={{0x0, 0x989680}, {0x0, 0x989680}}, 0x0)
socketpair$unix(0x1, 0x0, 0x0, 0x0)
getsockopt$sock_cred(0xffffffffffffffff, 0x1, 0x11, 0x0, &(0x7f0000cab000))
setsockopt$sock_cred(0xffffffffffffffff, 0x1, 0x11, 0x0, 0x0)
setsockopt$inet6_tcp_TCP_REPAIR_QUEUE(r0, 0x6, 0x14, 0x0, 0x0)
mmap(&(0x7f0000000000/0x4000)=nil, 0x4000, 0x1, 0x10012, 0xffffffffffffffff, 0x5deba000)
openat$fuse(0xffffffffffffff9c, &(0x7f0000000080), 0x2, 0x0)
syz_usb_connect(0x0, 0x32, &(0x7f0000000000)=ANY=[@ANYBLOB="1201000200000040a61b01000100000000010902200001010080320904"], 0x0)
syz_open_dev$dvb_frontend(&(0x7f0000000100), 0x1, 0x802) (async)
syz_open_dev$dvb_frontend(&(0x7f0000000080), 0x0, 0x402)

program crashed: KASAN: slab-use-after-free Read in dvb_device_open
testing program (duration=45s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): socket$inet6_tcp-connect$inet6-gettid-timer_settime-socketpair$unix-getsockopt$sock_cred-setsockopt$sock_cred-setsockopt$inet6_tcp_TCP_REPAIR_QUEUE-openat$fuse-syz_usb_connect-syz_open_dev$dvb_frontend-syz_open_dev$dvb_frontend
detailed listing:
executing program 0:
r0 = socket$inet6_tcp(0xa, 0x1, 0x0)
connect$inet6(r0, 0x0, 0x0)
gettid()
timer_settime(0x0, 0x0, &(0x7f0000000280)={{0x0, 0x989680}, {0x0, 0x989680}}, 0x0)
socketpair$unix(0x1, 0x0, 0x0, 0x0)
getsockopt$sock_cred(0xffffffffffffffff, 0x1, 0x11, 0x0, &(0x7f0000cab000))
setsockopt$sock_cred(0xffffffffffffffff, 0x1, 0x11, 0x0, 0x0)
setsockopt$inet6_tcp_TCP_REPAIR_QUEUE(r0, 0x6, 0x14, 0x0, 0x0)
openat$fuse(0xffffffffffffff9c, &(0x7f0000000080), 0x2, 0x0)
syz_usb_connect(0x0, 0x32, &(0x7f0000000000)=ANY=[@ANYBLOB="1201000200000040a61b01000100000000010902200001010080320904"], 0x0)
syz_open_dev$dvb_frontend(&(0x7f0000000100), 0x1, 0x802) (async)
syz_open_dev$dvb_frontend(&(0x7f0000000080), 0x0, 0x402)

program crashed: KASAN: slab-use-after-free Read in dvb_device_open
testing program (duration=45s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): socket$inet6_tcp-connect$inet6-gettid-timer_settime-socketpair$unix-getsockopt$sock_cred-setsockopt$sock_cred-openat$fuse-syz_usb_connect-syz_open_dev$dvb_frontend-syz_open_dev$dvb_frontend
detailed listing:
executing program 0:
r0 = socket$inet6_tcp(0xa, 0x1, 0x0)
connect$inet6(r0, 0x0, 0x0)
gettid()
timer_settime(0x0, 0x0, &(0x7f0000000280)={{0x0, 0x989680}, {0x0, 0x989680}}, 0x0)
socketpair$unix(0x1, 0x0, 0x0, 0x0)
getsockopt$sock_cred(0xffffffffffffffff, 0x1, 0x11, 0x0, &(0x7f0000cab000))
setsockopt$sock_cred(0xffffffffffffffff, 0x1, 0x11, 0x0, 0x0)
openat$fuse(0xffffffffffffff9c, &(0x7f0000000080), 0x2, 0x0)
syz_usb_connect(0x0, 0x32, &(0x7f0000000000)=ANY=[@ANYBLOB="1201000200000040a61b01000100000000010902200001010080320904"], 0x0)
syz_open_dev$dvb_frontend(&(0x7f0000000100), 0x1, 0x802) (async)
syz_open_dev$dvb_frontend(&(0x7f0000000080), 0x0, 0x402)

program crashed: KASAN: slab-use-after-free Read in dvb_device_open
testing program (duration=45s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): socket$inet6_tcp-connect$inet6-gettid-timer_settime-socketpair$unix-getsockopt$sock_cred-openat$fuse-syz_usb_connect-syz_open_dev$dvb_frontend-syz_open_dev$dvb_frontend
detailed listing:
executing program 0:
r0 = socket$inet6_tcp(0xa, 0x1, 0x0)
connect$inet6(r0, 0x0, 0x0)
gettid()
timer_settime(0x0, 0x0, &(0x7f0000000280)={{0x0, 0x989680}, {0x0, 0x989680}}, 0x0)
socketpair$unix(0x1, 0x0, 0x0, 0x0)
getsockopt$sock_cred(0xffffffffffffffff, 0x1, 0x11, 0x0, &(0x7f0000cab000))
openat$fuse(0xffffffffffffff9c, &(0x7f0000000080), 0x2, 0x0)
syz_usb_connect(0x0, 0x32, &(0x7f0000000000)=ANY=[@ANYBLOB="1201000200000040a61b01000100000000010902200001010080320904"], 0x0)
syz_open_dev$dvb_frontend(&(0x7f0000000100), 0x1, 0x802) (async)
syz_open_dev$dvb_frontend(&(0x7f0000000080), 0x0, 0x402)

program crashed: KASAN: slab-use-after-free Read in dvb_device_open
testing program (duration=45s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): socket$inet6_tcp-connect$inet6-gettid-timer_settime-socketpair$unix-openat$fuse-syz_usb_connect-syz_open_dev$dvb_frontend-syz_open_dev$dvb_frontend
detailed listing:
executing program 0:
r0 = socket$inet6_tcp(0xa, 0x1, 0x0)
connect$inet6(r0, 0x0, 0x0)
gettid()
timer_settime(0x0, 0x0, &(0x7f0000000280)={{0x0, 0x989680}, {0x0, 0x989680}}, 0x0)
socketpair$unix(0x1, 0x0, 0x0, 0x0)
openat$fuse(0xffffffffffffff9c, &(0x7f0000000080), 0x2, 0x0)
syz_usb_connect(0x0, 0x32, &(0x7f0000000000)=ANY=[@ANYBLOB="1201000200000040a61b01000100000000010902200001010080320904"], 0x0)
syz_open_dev$dvb_frontend(&(0x7f0000000100), 0x1, 0x802) (async)
syz_open_dev$dvb_frontend(&(0x7f0000000080), 0x0, 0x402)

program crashed: KASAN: slab-use-after-free Read in dvb_device_open
testing program (duration=45s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): socket$inet6_tcp-connect$inet6-gettid-timer_settime-openat$fuse-syz_usb_connect-syz_open_dev$dvb_frontend-syz_open_dev$dvb_frontend
detailed listing:
executing program 0:
r0 = socket$inet6_tcp(0xa, 0x1, 0x0)
connect$inet6(r0, 0x0, 0x0)
gettid()
timer_settime(0x0, 0x0, &(0x7f0000000280)={{0x0, 0x989680}, {0x0, 0x989680}}, 0x0)
openat$fuse(0xffffffffffffff9c, &(0x7f0000000080), 0x2, 0x0)
syz_usb_connect(0x0, 0x32, &(0x7f0000000000)=ANY=[@ANYBLOB="1201000200000040a61b01000100000000010902200001010080320904"], 0x0)
syz_open_dev$dvb_frontend(&(0x7f0000000100), 0x1, 0x802) (async)
syz_open_dev$dvb_frontend(&(0x7f0000000080), 0x0, 0x402)

program crashed: KASAN: slab-use-after-free Read in dvb_device_open
testing program (duration=45s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): socket$inet6_tcp-connect$inet6-gettid-openat$fuse-syz_usb_connect-syz_open_dev$dvb_frontend-syz_open_dev$dvb_frontend
detailed listing:
executing program 0:
r0 = socket$inet6_tcp(0xa, 0x1, 0x0)
connect$inet6(r0, 0x0, 0x0)
gettid()
openat$fuse(0xffffffffffffff9c, &(0x7f0000000080), 0x2, 0x0)
syz_usb_connect(0x0, 0x32, &(0x7f0000000000)=ANY=[@ANYBLOB="1201000200000040a61b01000100000000010902200001010080320904"], 0x0)
syz_open_dev$dvb_frontend(&(0x7f0000000100), 0x1, 0x802) (async)
syz_open_dev$dvb_frontend(&(0x7f0000000080), 0x0, 0x402)

program crashed: KASAN: slab-use-after-free Read in dvb_device_open
testing program (duration=45s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): socket$inet6_tcp-connect$inet6-openat$fuse-syz_usb_connect-syz_open_dev$dvb_frontend-syz_open_dev$dvb_frontend
detailed listing:
executing program 0:
r0 = socket$inet6_tcp(0xa, 0x1, 0x0)
connect$inet6(r0, 0x0, 0x0)
openat$fuse(0xffffffffffffff9c, &(0x7f0000000080), 0x2, 0x0)
syz_usb_connect(0x0, 0x32, &(0x7f0000000000)=ANY=[@ANYBLOB="1201000200000040a61b01000100000000010902200001010080320904"], 0x0)
syz_open_dev$dvb_frontend(&(0x7f0000000100), 0x1, 0x802) (async)
syz_open_dev$dvb_frontend(&(0x7f0000000080), 0x0, 0x402)

program crashed: KASAN: slab-use-after-free Read in dvb_device_open
testing program (duration=45s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): socket$inet6_tcp-openat$fuse-syz_usb_connect-syz_open_dev$dvb_frontend-syz_open_dev$dvb_frontend
detailed listing:
executing program 0:
socket$inet6_tcp(0xa, 0x1, 0x0)
openat$fuse(0xffffffffffffff9c, &(0x7f0000000080), 0x2, 0x0)
syz_usb_connect(0x0, 0x32, &(0x7f0000000000)=ANY=[@ANYBLOB="1201000200000040a61b01000100000000010902200001010080320904"], 0x0)
syz_open_dev$dvb_frontend(&(0x7f0000000100), 0x1, 0x802) (async)
syz_open_dev$dvb_frontend(&(0x7f0000000080), 0x0, 0x402)

program crashed: KASAN: slab-use-after-free Read in dvb_device_open
testing program (duration=45s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): openat$fuse-syz_usb_connect-syz_open_dev$dvb_frontend-syz_open_dev$dvb_frontend
detailed listing:
executing program 0:
openat$fuse(0xffffffffffffff9c, &(0x7f0000000080), 0x2, 0x0)
syz_usb_connect(0x0, 0x32, &(0x7f0000000000)=ANY=[@ANYBLOB="1201000200000040a61b01000100000000010902200001010080320904"], 0x0)
syz_open_dev$dvb_frontend(&(0x7f0000000100), 0x1, 0x802) (async)
syz_open_dev$dvb_frontend(&(0x7f0000000080), 0x0, 0x402)

program crashed: KASAN: slab-use-after-free Read in dvb_device_open
testing program (duration=45s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): openat$fuse-syz_usb_connect-syz_open_dev$dvb_frontend-syz_open_dev$dvb_frontend
detailed listing:
executing program 0:
openat$fuse(0xffffffffffffff9c, &(0x7f0000000080), 0x2, 0x0)
syz_usb_connect(0x0, 0x32, &(0x7f0000000000)=ANY=[@ANYBLOB="1201000200000040a61b01000100000000010902200001010080320904"], 0x0)
syz_open_dev$dvb_frontend(&(0x7f0000000100), 0x1, 0x802)
syz_open_dev$dvb_frontend(&(0x7f0000000080), 0x0, 0x402)

program crashed: KASAN: slab-use-after-free Read in dvb_device_open
testing program (duration=45s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): openat$fuse-syz_usb_connect-syz_open_dev$dvb_frontend-syz_open_dev$dvb_frontend
detailed listing:
executing program 0:
openat$fuse(0xffffffffffffff9c, 0x0, 0x2, 0x0)
syz_usb_connect(0x0, 0x32, &(0x7f0000000000)=ANY=[@ANYBLOB="1201000200000040a61b01000100000000010902200001010080320904"], 0x0)
syz_open_dev$dvb_frontend(&(0x7f0000000100), 0x1, 0x802)
syz_open_dev$dvb_frontend(&(0x7f0000000080), 0x0, 0x402)

program crashed: KASAN: slab-use-after-free Read in dvb_device_open
testing program (duration=45s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): openat$fuse-syz_usb_connect-syz_open_dev$dvb_frontend-syz_open_dev$dvb_frontend
detailed listing:
executing program 0:
openat$fuse(0xffffffffffffff9c, 0x0, 0x2, 0x0)
syz_usb_connect(0x0, 0x32, 0x0, 0x0)
syz_open_dev$dvb_frontend(&(0x7f0000000100), 0x1, 0x802)
syz_open_dev$dvb_frontend(&(0x7f0000000080), 0x0, 0x402)

program did not crash
testing program (duration=45s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): openat$fuse-syz_usb_connect-syz_open_dev$dvb_frontend-syz_open_dev$dvb_frontend
detailed listing:
executing program 0:
openat$fuse(0xffffffffffffff9c, 0x0, 0x2, 0x0)
syz_usb_connect(0x0, 0x32, &(0x7f0000000000)=ANY=[@ANYBLOB], 0x0)
syz_open_dev$dvb_frontend(&(0x7f0000000100), 0x1, 0x802)
syz_open_dev$dvb_frontend(&(0x7f0000000080), 0x0, 0x402)

program did not crash
testing program (duration=45s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): openat$fuse-syz_usb_connect-syz_open_dev$dvb_frontend-syz_open_dev$dvb_frontend
detailed listing:
executing program 0:
openat$fuse(0xffffffffffffff9c, 0x0, 0x2, 0x0)
syz_usb_connect(0x0, 0x32, &(0x7f0000000000)=ANY=[@ANYBLOB="1201000200000040a61b01000100000000010902200001010080320904"], 0x0)
syz_open_dev$dvb_frontend(0x0, 0x1, 0x802)
syz_open_dev$dvb_frontend(&(0x7f0000000080), 0x0, 0x402)

program did not crash
testing program (duration=45s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): openat$fuse-syz_usb_connect-syz_open_dev$dvb_frontend-syz_open_dev$dvb_frontend
detailed listing:
executing program 0:
openat$fuse(0xffffffffffffff9c, 0x0, 0x2, 0x0)
syz_usb_connect(0x0, 0x32, &(0x7f0000000000)=ANY=[@ANYBLOB="1201000200000040a61b01000100000000010902200001010080320904"], 0x0)
syz_open_dev$dvb_frontend(&(0x7f0000000100), 0x1, 0x802)
syz_open_dev$dvb_frontend(0x0, 0x0, 0x402)

program did not crash
extracting C reproducer
testing compiled C program (duration=45s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): openat$fuse-syz_usb_connect-syz_open_dev$dvb_frontend-syz_open_dev$dvb_frontend
program crashed: KASAN: slab-use-after-free Read in dvb_device_open
simplifying C reproducer
testing compiled C program (duration=45s, {Threaded:false Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): openat$fuse-syz_usb_connect-syz_open_dev$dvb_frontend-syz_open_dev$dvb_frontend
program did not crash
testing compiled C program (duration=45s, {Threaded:true Repeat:false RepeatTimes:0 Procs:1 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:false Cgroups:false BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): openat$fuse-syz_usb_connect-syz_open_dev$dvb_frontend-syz_open_dev$dvb_frontend
program did not crash
testing compiled C program (duration=45s, {Threaded:true Repeat:true RepeatTimes:0 Procs:1 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): openat$fuse-syz_usb_connect-syz_open_dev$dvb_frontend-syz_open_dev$dvb_frontend
program crashed: KASAN: slab-use-after-free Read in dvb_device_open
testing compiled C program (duration=45s, {Threaded:true Repeat:true RepeatTimes:0 Procs:1 Slowdown:1 Sandbox: SandboxArg:0 Leak:false NetInjection:false NetDevices:false NetReset:false Cgroups:false BinfmtMisc:false CloseFDs:false KCSAN:false DevlinkPCI:false NicVF:false USB:false VhciInjection:false Wifi:false IEEE802154:true Sysctl:true Swap:false UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): openat$fuse-syz_usb_connect-syz_open_dev$dvb_frontend-syz_open_dev$dvb_frontend
program crashed: KASAN: slab-use-after-free Read in dvb_device_open
testing compiled C program (duration=45s, {Threaded:true Repeat:true RepeatTimes:0 Procs:1 Slowdown:1 Sandbox: SandboxArg:0 Leak:false NetInjection:false NetDevices:false NetReset:false Cgroups:false BinfmtMisc:false CloseFDs:false KCSAN:false DevlinkPCI:false NicVF:false USB:false VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:false UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): openat$fuse-syz_usb_connect-syz_open_dev$dvb_frontend-syz_open_dev$dvb_frontend
program crashed: KASAN: slab-use-after-free Read in dvb_device_open
testing compiled C program (duration=45s, {Threaded:true Repeat:true RepeatTimes:0 Procs:1 Slowdown:1 Sandbox: SandboxArg:0 Leak:false NetInjection:false NetDevices:false NetReset:false Cgroups:false BinfmtMisc:false CloseFDs:false KCSAN:false DevlinkPCI:false NicVF:false USB:false VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:false UseTmpDir:false HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): openat$fuse-syz_usb_connect-syz_open_dev$dvb_frontend-syz_open_dev$dvb_frontend
program crashed: KASAN: slab-use-after-free Read in dvb_device_open
testing compiled C program (duration=45s, {Threaded:true Repeat:true RepeatTimes:0 Procs:1 Slowdown:1 Sandbox: SandboxArg:0 Leak:false NetInjection:false NetDevices:false NetReset:false Cgroups:false BinfmtMisc:false CloseFDs:false KCSAN:false DevlinkPCI:false NicVF:false USB:false VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:false UseTmpDir:false HandleSegv:false Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): openat$fuse-syz_usb_connect-syz_open_dev$dvb_frontend-syz_open_dev$dvb_frontend
program crashed: KASAN: slab-use-after-free Read in dvb_device_open
testing compiled C program (duration=45s, {Threaded:true Repeat:true RepeatTimes:0 Procs:1 Slowdown:1 Sandbox: SandboxArg:0 Leak:false NetInjection:false NetDevices:false NetReset:false Cgroups:false BinfmtMisc:false CloseFDs:false KCSAN:false DevlinkPCI:false NicVF:false USB:false VhciInjection:false Wifi:false IEEE802154:false Sysctl:false Swap:false UseTmpDir:false HandleSegv:false Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): openat$fuse-syz_usb_connect-syz_open_dev$dvb_frontend-syz_open_dev$dvb_frontend
program crashed: KASAN: slab-use-after-free Read in dvb_device_open
testing program (duration=45s, {Threaded:true Repeat:true RepeatTimes:0 Procs:1 Slowdown:1 Sandbox: SandboxArg:0 Leak:false NetInjection:false NetDevices:false NetReset:false Cgroups:false BinfmtMisc:false CloseFDs:false KCSAN:false DevlinkPCI:false NicVF:false USB:false VhciInjection:false Wifi:false IEEE802154:false Sysctl:false Swap:false UseTmpDir:false HandleSegv:false Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): openat$fuse-syz_usb_connect-syz_open_dev$dvb_frontend-syz_open_dev$dvb_frontend
detailed listing:
executing program 0:
openat$fuse(0xffffffffffffff9c, 0x0, 0x2, 0x0)
syz_usb_connect(0x0, 0x32, &(0x7f0000000000)=ANY=[@ANYBLOB="1201000200000040a61b01000100000000010902200001010080320904"], 0x0)
syz_open_dev$dvb_frontend(&(0x7f0000000100), 0x1, 0x802)
syz_open_dev$dvb_frontend(&(0x7f0000000080), 0x0, 0x402)

program crashed: KASAN: slab-use-after-free Read in dvb_device_open
validation run: crashed=true
testing program (duration=45s, {Threaded:true Repeat:true RepeatTimes:0 Procs:1 Slowdown:1 Sandbox: SandboxArg:0 Leak:false NetInjection:false NetDevices:false NetReset:false Cgroups:false BinfmtMisc:false CloseFDs:false KCSAN:false DevlinkPCI:false NicVF:false USB:false VhciInjection:false Wifi:false IEEE802154:false Sysctl:false Swap:false UseTmpDir:false HandleSegv:false Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): openat$fuse-syz_usb_connect-syz_open_dev$dvb_frontend-syz_open_dev$dvb_frontend
detailed listing:
executing program 0:
openat$fuse(0xffffffffffffff9c, 0x0, 0x2, 0x0)
syz_usb_connect(0x0, 0x32, &(0x7f0000000000)=ANY=[@ANYBLOB="1201000200000040a61b01000100000000010902200001010080320904"], 0x0)
syz_open_dev$dvb_frontend(&(0x7f0000000100), 0x1, 0x802)
syz_open_dev$dvb_frontend(&(0x7f0000000080), 0x0, 0x402)

program crashed: KASAN: slab-use-after-free Read in dvb_device_open
validation run: crashed=true
testing program (duration=45s, {Threaded:true Repeat:true RepeatTimes:0 Procs:1 Slowdown:1 Sandbox: SandboxArg:0 Leak:false NetInjection:false NetDevices:false NetReset:false Cgroups:false BinfmtMisc:false CloseFDs:false KCSAN:false DevlinkPCI:false NicVF:false USB:false VhciInjection:false Wifi:false IEEE802154:false Sysctl:false Swap:false UseTmpDir:false HandleSegv:false Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): openat$fuse-syz_usb_connect-syz_open_dev$dvb_frontend-syz_open_dev$dvb_frontend
detailed listing:
executing program 0:
openat$fuse(0xffffffffffffff9c, 0x0, 0x2, 0x0)
syz_usb_connect(0x0, 0x32, &(0x7f0000000000)=ANY=[@ANYBLOB="1201000200000040a61b01000100000000010902200001010080320904"], 0x0)
syz_open_dev$dvb_frontend(&(0x7f0000000100), 0x1, 0x802)
syz_open_dev$dvb_frontend(&(0x7f0000000080), 0x0, 0x402)

program crashed: KASAN: slab-use-after-free Read in dvb_device_open
validation run: crashed=true
reproducing took 1h55m0.953284978s
repro crashed as (corrupted=false):
==================================================================
BUG: KASAN: slab-use-after-free in dvb_device_open+0x33f/0x3b0 drivers/media/dvb-core/dvbdev.c:99
Read of size 8 at addr ffff88802dfdbc18 by task syz.0.19/5930

CPU: 3 UID: 0 PID: 5930 Comm: syz.0.19 Not tainted syzkaller #0 PREEMPT(full) 
Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014
Call Trace:
 <TASK>
 __dump_stack lib/dump_stack.c:94 [inline]
 dump_stack_lvl+0x100/0x190 lib/dump_stack.c:120
 print_address_description mm/kasan/report.c:378 [inline]
 print_report+0x13d/0x4b0 mm/kasan/report.c:482
 kasan_report+0xdf/0x1c0 mm/kasan/report.c:595
 dvb_device_open+0x33f/0x3b0 drivers/media/dvb-core/dvbdev.c:99
 chrdev_open+0x234/0x6a0 fs/char_dev.c:411
 do_dentry_open+0x6ab/0x14d0 fs/open.c:996
 vfs_open+0x82/0x3f0 fs/open.c:1101
 do_open fs/namei.c:4837 [inline]
 path_openat+0x19fa/0x2440 fs/namei.c:5000
 do_file_open+0x20e/0x430 fs/namei.c:5029
 do_sys_openat2+0x10f/0x1e0 fs/open.c:1417
 do_sys_open fs/open.c:1423 [inline]
 __do_sys_openat fs/open.c:1439 [inline]
 __se_sys_openat fs/open.c:1434 [inline]
 __x64_sys_openat+0x12d/0x210 fs/open.c:1434
 do_syscall_x64 arch/x86/entry/syscall_64.c:61 [inline]
 do_syscall_64+0x123/0x790 arch/x86/entry/syscall_64.c:84
 entry_SYSCALL_64_after_hwframe+0x77/0x7f
RIP: 0033:0x7fee3a75e98e
Code: 08 0f 85 a5 a8 ff ff 49 89 fb 48 89 f0 48 89 d7 48 89 ce 4c 89 c2 4d 89 ca 4c 8b 44 24 08 4c 8b 4c 24 10 4c 89 5c 24 08 0f 05 <c3> 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 80 00 00 00 00 48 83 ec 08
RSP: 002b:00007fee3b6d5b28 EFLAGS: 00000246 ORIG_RAX: 0000000000000101
RAX: ffffffffffffffda RBX: 00007fee3b6d66c0 RCX: 00007fee3a75e98e
RDX: 0000000000000402 RSI: 00007fee3b6d5c00 RDI: ffffffffffffff9c
RBP: 00007fee3b6d5c00 R08: 0000000000000000 R09: 0000000000000000
R10: 0000000000000000 R11: 0000000000000246 R12: cccccccccccccccd
R13: 00007fee3aa26128 R14: 00007fee3aa26090 R15: 00007fff697041e8
 </TASK>

Allocated by task 1:
 kasan_save_stack+0x30/0x50 mm/kasan/common.c:57
 kasan_save_track+0x14/0x30 mm/kasan/common.c:78
 poison_kmalloc_redzone mm/kasan/common.c:398 [inline]
 __kasan_kmalloc+0xaa/0xb0 mm/kasan/common.c:415
 kasan_kmalloc include/linux/kasan.h:263 [inline]
 __kmalloc_cache_noprof+0x2f8/0x6d0 mm/slub.c:5563
 _kmalloc_noprof include/linux/slab.h:991 [inline]
 _kzalloc_noprof include/linux/slab.h:1312 [inline]
 dvb_register_device+0x1d6/0x1e20 drivers/media/dvb-core/dvbdev.c:472
 dvb_register_frontend+0x552/0x820 drivers/media/dvb-core/dvb_frontend.c:3074
 vidtv_bridge_dvb_init drivers/media/test-drivers/vidtv/vidtv_bridge.c:438 [inline]
 vidtv_bridge_probe+0x44b/0xa30 drivers/media/test-drivers/vidtv/vidtv_bridge.c:510
 platform_probe+0x106/0x1d0 drivers/base/platform.c:1507
 call_driver_probe drivers/base/dd.c:628 [inline]
 really_probe+0x241/0xa60 drivers/base/dd.c:706
 __driver_probe_device+0x210/0x460 drivers/base/dd.c:868
 driver_probe_device+0x4a/0x140 drivers/base/dd.c:898
 __driver_attach+0x21f/0x5b0 drivers/base/dd.c:1292
 bus_for_each_dev+0x13e/0x1d0 drivers/base/bus.c:383
 bus_add_driver+0x305/0x5b0 drivers/base/bus.c:763
 driver_register+0x1e2/0x360 drivers/base/driver.c:174
 vidtv_bridge_init+0x52/0x80 drivers/media/test-drivers/vidtv/vidtv_bridge.c:602
 do_one_initcall+0x11c/0x6f0 init/main.c:1357
 do_initcall_level init/main.c:1419 [inline]
 do_initcalls init/main.c:1435 [inline]
 do_basic_setup init/main.c:1455 [inline]
 kernel_init_freeable+0x6ea/0x7b0 init/main.c:1670
 kernel_init+0x21/0x1e0 init/main.c:1560
 ret_from_fork+0x730/0xd60 arch/x86/kernel/process.c:158
 ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:245

Freed by task 5923:
 kasan_save_stack+0x30/0x50 mm/kasan/common.c:57
 kasan_save_track+0x14/0x30 mm/kasan/common.c:78
 kasan_save_free_info+0x3b/0x70 mm/kasan/generic.c:584
 poison_slab_object mm/kasan/common.c:253 [inline]
 __kasan_slab_free+0x5f/0x80 mm/kasan/common.c:285
 kasan_slab_free include/linux/kasan.h:235 [inline]
 slab_free_hook mm/slub.c:2748 [inline]
 slab_free mm/slub.c:6499 [inline]
 kfree+0x22b/0x6d0 mm/slub.c:6792
 dvb_free_device drivers/media/dvb-core/dvbdev.c:616 [inline]
 kref_put include/linux/kref.h:65 [inline]
 dvb_device_put.part.0+0x57/0x90 drivers/media/dvb-core/dvbdev.c:629
 dvb_device_put drivers/media/dvb-core/dvbdev.c:628 [inline]
 dvb_device_open+0x2ba/0x3b0 drivers/media/dvb-core/dvbdev.c:113
 chrdev_open+0x234/0x6a0 fs/char_dev.c:411
 do_dentry_open+0x6ab/0x14d0 fs/open.c:996
 vfs_open+0x82/0x3f0 fs/open.c:1101
 do_open fs/namei.c:4837 [inline]
 path_openat+0x19fa/0x2440 fs/namei.c:5000
 do_file_open+0x20e/0x430 fs/namei.c:5029
 do_sys_openat2+0x10f/0x1e0 fs/open.c:1417
 do_sys_open fs/open.c:1423 [inline]
 __do_sys_openat fs/open.c:1439 [inline]
 __se_sys_openat fs/open.c:1434 [inline]
 __x64_sys_openat+0x12d/0x210 fs/open.c:1434
 do_syscall_x64 arch/x86/entry/syscall_64.c:61 [inline]
 do_syscall_64+0x123/0x790 arch/x86/entry/syscall_64.c:84
 entry_SYSCALL_64_after_hwframe+0x77/0x7f

The buggy address belongs to the object at ffff88802dfdbc00
 which belongs to the cache kmalloc-256 of size 256
The buggy address is located 24 bytes inside of
 freed 256-byte region [ffff88802dfdbc00, ffff88802dfdbd00)

The buggy address belongs to the physical page:
page: refcount:0 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x2dfda
head: order:1 mapcount:0 entire_mapcount:0 nr_pages_mapped:0 pincount:0
flags: 0xfff00000000040(head|node=0|zone=1|lastcpupid=0x7ff)
page_type: f5(slab)
raw: 00fff00000000040 ffff88801c042b40 dead000000000100 dead000000000122
raw: 0000000000000000 0000000000100010 00000000f5000000 0000000000000000
head: 00fff00000000040 ffff88801c042b40 dead000000000100 dead000000000122
head: 0000000000000000 0000000000100010 00000000f5000000 0000000000000000
head: 00fff00000000001 ffffffffffffff81 00000000ffffffff 00000000ffffffff
head: ffffffffffffffff 0000000000000000 00000000ffffffff 0000000000000002
page dumped because: kasan: bad access detected
page_owner tracks the page as allocated
page last allocated via order 1, migratetype Unmovable, gfp_mask 0xd20c0(__GFP_IO|__GFP_FS|__GFP_NOWARN|__GFP_NORETRY|__GFP_COMP|__GFP_NOMEMALLOC), pid 1, tgid 1 (swapper/0), ts 8855455502
 set_page_owner include/linux/page_owner.h:33 [inline]
 post_alloc_hook+0xfd/0x120 mm/page_alloc.c:1871
 prep_new_page mm/page_alloc.c:1879 [inline]
 get_page_from_freelist+0x110d/0x35d0 mm/page_alloc.c:3943
 __alloc_frozen_pages_noprof+0x2eb/0x3300 mm/page_alloc.c:5436
 alloc_slab_page mm/slub.c:3347 [inline]
 allocate_slab mm/slub.c:3462 [inline]
 new_slab+0xa9/0x6e0 mm/slub.c:3513
 refill_objects+0xe3/0x410 mm/slub.c:7410
 refill_sheaf mm/slub.c:2885 [inline]
 __pcs_replace_empty_main+0x35e/0x650 mm/slub.c:4774
 alloc_from_pcs mm/slub.c:4850 [inline]
 slab_alloc_node mm/slub.c:4984 [inline]
 __kmalloc_cache_noprof+0x4f4/0x6d0 mm/slub.c:5559
 _kmalloc_noprof include/linux/slab.h:991 [inline]
 _kzalloc_noprof include/linux/slab.h:1312 [inline]
 bus_add_driver+0x92/0x5b0 drivers/base/bus.c:747
 driver_register+0x1e2/0x360 drivers/base/driver.c:174
 usb_register_driver drivers/usb/core/driver.c:1082 [inline]
 usb_register_driver+0x21c/0x3e0 drivers/usb/core/driver.c:1064
 do_one_initcall+0x11c/0x6f0 init/main.c:1357
 do_initcall_level init/main.c:1419 [inline]
 do_initcalls init/main.c:1435 [inline]
 do_basic_setup init/main.c:1455 [inline]
 kernel_init_freeable+0x6ea/0x7b0 init/main.c:1670
 kernel_init+0x21/0x1e0 init/main.c:1560
 ret_from_fork+0x730/0xd60 arch/x86/kernel/process.c:158
 ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:245
page_owner free stack trace missing

Memory state around the buggy address:
 ffff88802dfdbb00: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc
 ffff88802dfdbb80: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc
>ffff88802dfdbc00: fa fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
                            ^
 ffff88802dfdbc80: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
 ffff88802dfdbd00: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc
==================================================================

final repro crashed as (corrupted=false):
==================================================================
BUG: KASAN: slab-use-after-free in dvb_device_open+0x33f/0x3b0 drivers/media/dvb-core/dvbdev.c:99
Read of size 8 at addr ffff88802dfdbc18 by task syz.0.19/5930

CPU: 3 UID: 0 PID: 5930 Comm: syz.0.19 Not tainted syzkaller #0 PREEMPT(full) 
Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014
Call Trace:
 <TASK>
 __dump_stack lib/dump_stack.c:94 [inline]
 dump_stack_lvl+0x100/0x190 lib/dump_stack.c:120
 print_address_description mm/kasan/report.c:378 [inline]
 print_report+0x13d/0x4b0 mm/kasan/report.c:482
 kasan_report+0xdf/0x1c0 mm/kasan/report.c:595
 dvb_device_open+0x33f/0x3b0 drivers/media/dvb-core/dvbdev.c:99
 chrdev_open+0x234/0x6a0 fs/char_dev.c:411
 do_dentry_open+0x6ab/0x14d0 fs/open.c:996
 vfs_open+0x82/0x3f0 fs/open.c:1101
 do_open fs/namei.c:4837 [inline]
 path_openat+0x19fa/0x2440 fs/namei.c:5000
 do_file_open+0x20e/0x430 fs/namei.c:5029
 do_sys_openat2+0x10f/0x1e0 fs/open.c:1417
 do_sys_open fs/open.c:1423 [inline]
 __do_sys_openat fs/open.c:1439 [inline]
 __se_sys_openat fs/open.c:1434 [inline]
 __x64_sys_openat+0x12d/0x210 fs/open.c:1434
 do_syscall_x64 arch/x86/entry/syscall_64.c:61 [inline]
 do_syscall_64+0x123/0x790 arch/x86/entry/syscall_64.c:84
 entry_SYSCALL_64_after_hwframe+0x77/0x7f
RIP: 0033:0x7fee3a75e98e
Code: 08 0f 85 a5 a8 ff ff 49 89 fb 48 89 f0 48 89 d7 48 89 ce 4c 89 c2 4d 89 ca 4c 8b 44 24 08 4c 8b 4c 24 10 4c 89 5c 24 08 0f 05 <c3> 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 80 00 00 00 00 48 83 ec 08
RSP: 002b:00007fee3b6d5b28 EFLAGS: 00000246 ORIG_RAX: 0000000000000101
RAX: ffffffffffffffda RBX: 00007fee3b6d66c0 RCX: 00007fee3a75e98e
RDX: 0000000000000402 RSI: 00007fee3b6d5c00 RDI: ffffffffffffff9c
RBP: 00007fee3b6d5c00 R08: 0000000000000000 R09: 0000000000000000
R10: 0000000000000000 R11: 0000000000000246 R12: cccccccccccccccd
R13: 00007fee3aa26128 R14: 00007fee3aa26090 R15: 00007fff697041e8
 </TASK>

Allocated by task 1:
 kasan_save_stack+0x30/0x50 mm/kasan/common.c:57
 kasan_save_track+0x14/0x30 mm/kasan/common.c:78
 poison_kmalloc_redzone mm/kasan/common.c:398 [inline]
 __kasan_kmalloc+0xaa/0xb0 mm/kasan/common.c:415
 kasan_kmalloc include/linux/kasan.h:263 [inline]
 __kmalloc_cache_noprof+0x2f8/0x6d0 mm/slub.c:5563
 _kmalloc_noprof include/linux/slab.h:991 [inline]
 _kzalloc_noprof include/linux/slab.h:1312 [inline]
 dvb_register_device+0x1d6/0x1e20 drivers/media/dvb-core/dvbdev.c:472
 dvb_register_frontend+0x552/0x820 drivers/media/dvb-core/dvb_frontend.c:3074
 vidtv_bridge_dvb_init drivers/media/test-drivers/vidtv/vidtv_bridge.c:438 [inline]
 vidtv_bridge_probe+0x44b/0xa30 drivers/media/test-drivers/vidtv/vidtv_bridge.c:510
 platform_probe+0x106/0x1d0 drivers/base/platform.c:1507
 call_driver_probe drivers/base/dd.c:628 [inline]
 really_probe+0x241/0xa60 drivers/base/dd.c:706
 __driver_probe_device+0x210/0x460 drivers/base/dd.c:868
 driver_probe_device+0x4a/0x140 drivers/base/dd.c:898
 __driver_attach+0x21f/0x5b0 drivers/base/dd.c:1292
 bus_for_each_dev+0x13e/0x1d0 drivers/base/bus.c:383
 bus_add_driver+0x305/0x5b0 drivers/base/bus.c:763
 driver_register+0x1e2/0x360 drivers/base/driver.c:174
 vidtv_bridge_init+0x52/0x80 drivers/media/test-drivers/vidtv/vidtv_bridge.c:602
 do_one_initcall+0x11c/0x6f0 init/main.c:1357
 do_initcall_level init/main.c:1419 [inline]
 do_initcalls init/main.c:1435 [inline]
 do_basic_setup init/main.c:1455 [inline]
 kernel_init_freeable+0x6ea/0x7b0 init/main.c:1670
 kernel_init+0x21/0x1e0 init/main.c:1560
 ret_from_fork+0x730/0xd60 arch/x86/kernel/process.c:158
 ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:245

Freed by task 5923:
 kasan_save_stack+0x30/0x50 mm/kasan/common.c:57
 kasan_save_track+0x14/0x30 mm/kasan/common.c:78
 kasan_save_free_info+0x3b/0x70 mm/kasan/generic.c:584
 poison_slab_object mm/kasan/common.c:253 [inline]
 __kasan_slab_free+0x5f/0x80 mm/kasan/common.c:285
 kasan_slab_free include/linux/kasan.h:235 [inline]
 slab_free_hook mm/slub.c:2748 [inline]
 slab_free mm/slub.c:6499 [inline]
 kfree+0x22b/0x6d0 mm/slub.c:6792
 dvb_free_device drivers/media/dvb-core/dvbdev.c:616 [inline]
 kref_put include/linux/kref.h:65 [inline]
 dvb_device_put.part.0+0x57/0x90 drivers/media/dvb-core/dvbdev.c:629
 dvb_device_put drivers/media/dvb-core/dvbdev.c:628 [inline]
 dvb_device_open+0x2ba/0x3b0 drivers/media/dvb-core/dvbdev.c:113
 chrdev_open+0x234/0x6a0 fs/char_dev.c:411
 do_dentry_open+0x6ab/0x14d0 fs/open.c:996
 vfs_open+0x82/0x3f0 fs/open.c:1101
 do_open fs/namei.c:4837 [inline]
 path_openat+0x19fa/0x2440 fs/namei.c:5000
 do_file_open+0x20e/0x430 fs/namei.c:5029
 do_sys_openat2+0x10f/0x1e0 fs/open.c:1417
 do_sys_open fs/open.c:1423 [inline]
 __do_sys_openat fs/open.c:1439 [inline]
 __se_sys_openat fs/open.c:1434 [inline]
 __x64_sys_openat+0x12d/0x210 fs/open.c:1434
 do_syscall_x64 arch/x86/entry/syscall_64.c:61 [inline]
 do_syscall_64+0x123/0x790 arch/x86/entry/syscall_64.c:84
 entry_SYSCALL_64_after_hwframe+0x77/0x7f

The buggy address belongs to the object at ffff88802dfdbc00
 which belongs to the cache kmalloc-256 of size 256
The buggy address is located 24 bytes inside of
 freed 256-byte region [ffff88802dfdbc00, ffff88802dfdbd00)

The buggy address belongs to the physical page:
page: refcount:0 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x2dfda
head: order:1 mapcount:0 entire_mapcount:0 nr_pages_mapped:0 pincount:0
flags: 0xfff00000000040(head|node=0|zone=1|lastcpupid=0x7ff)
page_type: f5(slab)
raw: 00fff00000000040 ffff88801c042b40 dead000000000100 dead000000000122
raw: 0000000000000000 0000000000100010 00000000f5000000 0000000000000000
head: 00fff00000000040 ffff88801c042b40 dead000000000100 dead000000000122
head: 0000000000000000 0000000000100010 00000000f5000000 0000000000000000
head: 00fff00000000001 ffffffffffffff81 00000000ffffffff 00000000ffffffff
head: ffffffffffffffff 0000000000000000 00000000ffffffff 0000000000000002
page dumped because: kasan: bad access detected
page_owner tracks the page as allocated
page last allocated via order 1, migratetype Unmovable, gfp_mask 0xd20c0(__GFP_IO|__GFP_FS|__GFP_NOWARN|__GFP_NORETRY|__GFP_COMP|__GFP_NOMEMALLOC), pid 1, tgid 1 (swapper/0), ts 8855455502
 set_page_owner include/linux/page_owner.h:33 [inline]
 post_alloc_hook+0xfd/0x120 mm/page_alloc.c:1871
 prep_new_page mm/page_alloc.c:1879 [inline]
 get_page_from_freelist+0x110d/0x35d0 mm/page_alloc.c:3943
 __alloc_frozen_pages_noprof+0x2eb/0x3300 mm/page_alloc.c:5436
 alloc_slab_page mm/slub.c:3347 [inline]
 allocate_slab mm/slub.c:3462 [inline]
 new_slab+0xa9/0x6e0 mm/slub.c:3513
 refill_objects+0xe3/0x410 mm/slub.c:7410
 refill_sheaf mm/slub.c:2885 [inline]
 __pcs_replace_empty_main+0x35e/0x650 mm/slub.c:4774
 alloc_from_pcs mm/slub.c:4850 [inline]
 slab_alloc_node mm/slub.c:4984 [inline]
 __kmalloc_cache_noprof+0x4f4/0x6d0 mm/slub.c:5559
 _kmalloc_noprof include/linux/slab.h:991 [inline]
 _kzalloc_noprof include/linux/slab.h:1312 [inline]
 bus_add_driver+0x92/0x5b0 drivers/base/bus.c:747
 driver_register+0x1e2/0x360 drivers/base/driver.c:174
 usb_register_driver drivers/usb/core/driver.c:1082 [inline]
 usb_register_driver+0x21c/0x3e0 drivers/usb/core/driver.c:1064
 do_one_initcall+0x11c/0x6f0 init/main.c:1357
 do_initcall_level init/main.c:1419 [inline]
 do_initcalls init/main.c:1435 [inline]
 do_basic_setup init/main.c:1455 [inline]
 kernel_init_freeable+0x6ea/0x7b0 init/main.c:1670
 kernel_init+0x21/0x1e0 init/main.c:1560
 ret_from_fork+0x730/0xd60 arch/x86/kernel/process.c:158
 ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:245
page_owner free stack trace missing

Memory state around the buggy address:
 ffff88802dfdbb00: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc
 ffff88802dfdbb80: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc
>ffff88802dfdbc00: fa fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
                            ^
 ffff88802dfdbc80: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
 ffff88802dfdbd00: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc
==================================================================