Extracting prog: 16m53.812314334s Minimizing prog: 19m52.316125136s Simplifying prog options: 0s Extracting C: 29.571852953s Simplifying C: 11m36.005162805s extracting reproducer from 38 programs testing a last program of every proc single: executing 8 programs separately with timeout 30s testing program (duration=30s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): socket$nl_audit-epoll_create-fsetxattr$system_posix_acl-sendmsg$AUDIT_TTY_SET-openat$binderfs-openat$binderfs-dup3-ioctl$BINDER_WRITE_READ-socket$pppl2tp-ioctl$SIOCGIFMTU detailed listing: executing program 0: r0 = socket$nl_audit(0x10, 0x3, 0x9) r1 = epoll_create(0x2e) fsetxattr$system_posix_acl(r1, &(0x7f00000002c0)='system.posix_acl_access\x00', 0x0, 0x0, 0x2) sendmsg$AUDIT_TTY_SET(r0, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000480)={&(0x7f0000000440)={0x18, 0x3f9, 0x201, 0x70bd29, 0x25dfdbff, {0x1, 0x201}}, 0x18}, 0x1, 0x0, 0x0, 0x8000}, 0x44004) r2 = openat$binderfs(0xffffffffffffff9c, &(0x7f00000000c0)='./binderfs/binder0\x00', 0x0, 0x0) r3 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000200)='./binderfs/binder0\x00', 0x2, 0x0) r4 = dup3(r3, r2, 0x80000) ioctl$BINDER_WRITE_READ(r4, 0xc0306201, &(0x7f0000000640)={0x8, 0x0, &(0x7f0000000000)=[@decrefs={0x40086315}], 0x0, 0x0, 0x0}) r5 = socket$pppl2tp(0x18, 0x1, 0x1) ioctl$SIOCGIFMTU(r5, 0x8921, &(0x7f0000000000)={'netpci0\x00'}) program did not crash testing program (duration=30s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): socket$netlink-sendmsg$netlink detailed listing: executing program 0: r0 = socket$netlink(0x10, 0x3, 0x0) sendmsg$netlink(r0, &(0x7f0000000480)={0x0, 0x0, &(0x7f0000000000)=[{&(0x7f0000000040)=ANY=[@ANYBLOB="1c0000405e0001010000000000230000080041008e9d10283e"], 0x1c}], 0x1}, 0x0) program did not crash testing program (duration=30s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): socket$packet-setsockopt$packet_int-mount-socket$key-timer_settime-openat$pfkey-read$FUSE-madvise-mlock-openat-syz_usb_connect$uac2-socketpair$nbd-ioctl$SIOCSIFHWADDR-socket$inet-write detailed listing: executing program 0: r0 = socket$packet(0x11, 0x3, 0x300) setsockopt$packet_int(r0, 0x107, 0xa, &(0x7f00000000c0)=0x2, 0x4) mount(0x0, 0x0, 0x0, 0x0, 0x0) socket$key(0xf, 0x3, 0x2) timer_settime(0x0, 0x1, 0x0, 0x0) r1 = openat$pfkey(0xffffffffffffff9c, &(0x7f0000003340), 0x40040, 0x0) read$FUSE(r1, &(0x7f0000005500)={0x2020}, 0x2020) madvise(&(0x7f0000000000/0x800000)=nil, 0x800000, 0xe) mlock(&(0x7f0000000000/0x800000)=nil, 0x800000) r2 = openat(0xffffffffffffff9c, &(0x7f0000000280)='./cgroup.cpu/memory.force_empty\x00', 0x2, 0x0) syz_usb_connect$uac2(0x3, 0x8c, &(0x7f0000000000)={{0x12, 0x1, 0x300, 0x0, 0x0, 0x0, 0x40, 0x1235, 0x8201, 0x40, 0x1, 0x2, 0x3, 0x1, [{{0x9, 0x2, 0x7a, 0x3, 0x1, 0x0, 0xf0, 0x3, {0x8, 0xb, 0x0, 0x2, 0x1, 0x9, 0x20, 0x6}, {{{0x9, 0x4, 0x0, 0x0, 0x0, 0x1, 0x1, 0x20, 0x0, {{0x9, 0x24, 0x1, 0x2, 0x6, 0x1a, 0x3}, [@processing_unit={0x11, 0x24, 0x8, 0x3, 0x6, [0x0, 0x0, 0x0, 0x2, 0x3, 0x0]}]}}, {}, {0x9, 0x4, 0x1, 0x1, 0x1, 0x1, 0x2, 0x20, 0x0, {}, {{0x9, 0x5, 0x1, 0x9, 0x20, 0x8, 0x5, 0x0, {0x8, 0x25, 0x1, 0x1, 0x6, 0x4, 0x4}}}}, {}, {0x9, 0x4, 0x2, 0x1, 0x1, 0x1, 0x2, 0x20, 0x0, {}, {{0x9, 0x5, 0x82, 0x9, 0x3ff, 0x3, 0xe6, 0x40, {0x8, 0x25, 0x1, 0x3, 0x3, 0xfe, 0x5}}}}}}}}]}}, &(0x7f0000000200)={0x0, 0x0, 0x0, 0x0}) socketpair$nbd(0x1, 0x1, 0x0, &(0x7f0000000040)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$SIOCSIFHWADDR(r3, 0x8924, &(0x7f0000000000)={'macsec0\x00', @random="0100"}) socket$inet(0x2, 0x2, 0x0) write(r2, &(0x7f00000002c0)='0', 0x1) program did not crash testing program (duration=30s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_open_procfs-timer_create-mprotect-timer_settime-mmap-madvise-syz_usb_control_io$uac1-timer_create-timer_settime-timer_create-timer_settime-unshare detailed listing: executing program 0: syz_open_procfs(0x0, 0x0) timer_create(0x0, &(0x7f00000000c0)={0x0, 0x21, 0x2, @thr={0x0, 0x0}}, &(0x7f0000000340)=0x0) mprotect(&(0x7f0000000000/0xf000)=nil, 0xf000, 0x1) timer_settime(r0, 0x1, &(0x7f0000000040)={{}, {0x0, 0x989680}}, 0x0) mmap(&(0x7f0000000000/0x200000)=nil, 0x200000, 0x300000b, 0x204031, 0xffffffffffffffff, 0xec776000) madvise(&(0x7f0000c00000/0x400000)=nil, 0x400000, 0xe) syz_usb_control_io$uac1(0xffffffffffffffff, 0x0, 0x0) timer_create(0x2, &(0x7f00000000c0)={0x0, 0x12}, &(0x7f00000001c0)=0x0) timer_settime(r1, 0x0, &(0x7f0000000280)={{0x0, 0x3938700}, {0x0, 0x989680}}, 0x0) timer_create(0x7, &(0x7f0000000180)={0x0, 0x13, 0x0, @thr={0x0, 0x0}}, &(0x7f0000000240)=0x0) timer_settime(r2, 0x0, &(0x7f0000000340)={{0x0, 0x989680}, {0x0, 0x989680}}, 0x0) unshare(0x44040200) program did not crash testing program (duration=30s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): socket$nl_sock_diag-pipe2$9p-mkdirat-mount$9p_fd-epoll_create1-epoll_create1-epoll_ctl$EPOLL_CTL_ADD-epoll_ctl$EPOLL_CTL_MOD-munmap-sendmsg$DCCPDIAG_GETSOCK-getpid-openat$binderfs-ioctl$BINDER_WRITE_READ detailed listing: executing program 0: r0 = socket$nl_sock_diag(0x10, 0x3, 0x4) pipe2$9p(&(0x7f0000000240)={0xffffffffffffffff, 0xffffffffffffffff}, 0x4000) mkdirat(0xffffffffffffff9c, &(0x7f0000000040)='./file0\x00', 0x1c0) mount$9p_fd(0x0, &(0x7f0000000000)='./file0\x00', &(0x7f00000001c0), 0x2004000, &(0x7f00000000c0)={'trans=fd,', {'rfdno', 0x3d, r1}, 0x2c, {'wfdno', 0x3d, r2}, 0x2c, {[{@cache_readahead}], [], 0x6b}}) r3 = epoll_create1(0x0) r4 = epoll_create1(0x0) epoll_ctl$EPOLL_CTL_ADD(r4, 0x1, r3, &(0x7f0000000000)={0x20000002}) epoll_ctl$EPOLL_CTL_MOD(r4, 0x3, r3, &(0x7f0000000400)={0xa0000000}) munmap(&(0x7f0000ffc000/0x2000)=nil, 0x2000) sendmsg$DCCPDIAG_GETSOCK(r0, &(0x7f0000003d40)={0x0, 0x0, &(0x7f0000003d00)={&(0x7f0000003bc0)=ANY=[@ANYBLOB="54000000130003042cbd7000ffdbdf2518da05064e214e22e38a000005000000000000020600000082210000f4ffffffff0300008f120000", @ANYRES32=0x0, @ANYBLOB="ffffffff7f000002090000f2000200000400010004000100"], 0x54}, 0x1, 0x0, 0x0, 0x4000}, 0x40000) getpid() r5 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000200)='./binderfs/binder0\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(r5, 0xc0306201, &(0x7f00000003c0)={0x4c, 0x0, &(0x7f0000000040)=[@transaction_sg={0x400c6314, {0x0, 0x0, 0x0, 0x0, 0x20, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x1000}], 0x0, 0x0, 0x0}) program did not crash testing program (duration=30s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): socket$nl_sock_diag-pipe2$9p-mkdirat-mount$9p_fd-epoll_create1-epoll_create1-epoll_ctl$EPOLL_CTL_ADD-epoll_ctl$EPOLL_CTL_MOD-munmap-sendmsg$DCCPDIAG_GETSOCK-getpid-openat$binderfs-ioctl$BINDER_WRITE_READ detailed listing: executing program 0: r0 = socket$nl_sock_diag(0x10, 0x3, 0x4) pipe2$9p(&(0x7f0000000240)={0xffffffffffffffff, 0xffffffffffffffff}, 0x4000) mkdirat(0xffffffffffffff9c, &(0x7f0000000040)='./file0\x00', 0x1c0) mount$9p_fd(0x0, &(0x7f0000000000)='./file0\x00', &(0x7f00000001c0), 0x2004000, &(0x7f00000000c0)={'trans=fd,', {'rfdno', 0x3d, r1}, 0x2c, {'wfdno', 0x3d, r2}, 0x2c, {[{@cache_readahead}], [], 0x6b}}) r3 = epoll_create1(0x0) r4 = epoll_create1(0x0) epoll_ctl$EPOLL_CTL_ADD(r4, 0x1, r3, &(0x7f0000000000)={0x20000002}) epoll_ctl$EPOLL_CTL_MOD(r4, 0x3, r3, &(0x7f0000000400)={0xa0000000}) munmap(&(0x7f0000ffc000/0x2000)=nil, 0x2000) sendmsg$DCCPDIAG_GETSOCK(r0, &(0x7f0000003d40)={0x0, 0x0, &(0x7f0000003d00)={&(0x7f0000003bc0)=ANY=[@ANYBLOB="54000000130003042cbd7000ffdbdf2518da05064e214e22e38a000005000000000000020600000082210000f4ffffffff0300008f120000", @ANYRES32=0x0, @ANYBLOB="ffffffff7f000002090000f2000200000400010004000100"], 0x54}, 0x1, 0x0, 0x0, 0x4000}, 0x40000) getpid() r5 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000200)='./binderfs/binder0\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(r5, 0xc0306201, &(0x7f00000003c0)={0x4c, 0x0, &(0x7f0000000040)=[@transaction_sg={0x400c6314, {0x0, 0x0, 0x0, 0x0, 0x20, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x1000}], 0x0, 0x0, 0x0}) program did not crash testing program (duration=30s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): add_key$keyring-add_key$keyring-add_key$fscrypt_v1-add_key$fscrypt_v1-add_key$fscrypt_v1-add_key$fscrypt_v1-add_key$fscrypt_v1-add_key$fscrypt_v1-add_key$fscrypt_v1-add_key$fscrypt_v1-add_key$fscrypt_v1-add_key$fscrypt_v1-add_key$keyring-add_key$fscrypt_v1-add_key$fscrypt_v1-add_key$keyring-add_key$keyring-add_key$fscrypt_v1-add_key$fscrypt_v1-keyctl$unlink detailed listing: executing program 0: r0 = add_key$keyring(&(0x7f0000000000), &(0x7f0000000040)={'syz', 0x2}, 0x0, 0x0, 0xfffffffffffffffe) r1 = add_key$keyring(&(0x7f0000000680), &(0x7f0000000000)={'syz', 0x1}, 0x0, 0x0, 0xffffffffffffffff) add_key$fscrypt_v1(&(0x7f0000000540), &(0x7f0000000180)={'fscrypt:', @auto=[0x61, 0x62, 0x35, 0x39, 0x30, 0x64, 0x37, 0x66, 0x32, 0x61, 0x30, 0x37, 0x30, 0x64, 0x0, 0x65]}, &(0x7f0000000100)={0x0, "00112233445566778899aabbccddeeff00112233445567778999aabbccddeeff00112233445566778899aabbccddeeff00112233445566778899aabbccddeeff", 0x1d}, 0x48, r1) add_key$fscrypt_v1(&(0x7f00000009c0), &(0x7f0000000a00)={'fscrypt:', @auto=[0x31, 0xe, 0x63, 0x38, 0x31, 0x38, 0x61, 0x64, 0x63, 0x30, 0x65, 0x30, 0x36, 0x31, 0x32, 0x36]}, &(0x7f0000000a40)={0x0, "2628ef6169ce0c23300aad3bd8276bfa5a76274e6d287faf262c30f0f01f01afdf7dd0c90abeed83d9b7ae21c1731df54db18c7f4736fb3ba12abb31f88487a5", 0x29}, 0x48, r1) add_key$fscrypt_v1(&(0x7f0000000080), &(0x7f00000001c0)={'fscrypt:', @auto=[0x33, 0x30, 0x30, 0x30, 0x30, 0x30, 0x30, 0x36, 0x30, 0x30, 0x30, 0x30, 0x30, 0x30, 0x30, 0x33]}, &(0x7f0000000100)={0x0, "00112233445566778899aabbccddeeff0011223344556677880502d2b9ddff7f00112233445566778899aabbccd3ceff001122aabbccddeeff00", 0x26}, 0x48, r1) add_key$fscrypt_v1(&(0x7f0000000080), &(0x7f0000000200)={'fscrypt:', @auto=[0x30, 0x30, 0x30, 0x30, 0x30, 0x30, 0x30, 0x30, 0x30, 0x30, 0x30, 0x30, 0x30, 0x30, 0x30, 0x34]}, &(0x7f0000000100)={0x0, "00112233445566778899aabbccddeeff00112233445566778899aabbccddeeff00112233445566778899aabbccddeeff00112233445566778899aabbccddeeff", 0x40}, 0x48, r1) add_key$fscrypt_v1(&(0x7f0000000080), &(0x7f0000000240)={'fscrypt:', @auto=[0x30, 0x30, 0x30, 0x65, 0x30, 0x30, 0x30, 0x30, 0x30, 0x30, 0x35, 0x30, 0x0, 0x30, 0x30, 0x35]}, &(0x7f0000000100)={0x0, "00112233445566778899aabbccddeeff00112233445566778899aabbccddeeff00112233445566778899aabbccddeeff00112233445566778899aabbccddeeff", 0x40}, 0x48, r1) add_key$fscrypt_v1(&(0x7f0000000440), &(0x7f0000000280)={'fscrypt:', @auto=[0x30, 0x30, 0x30, 0x30, 0x30, 0x30, 0x30, 0x30, 0x30, 0x30, 0x30, 0x62, 0x30, 0x30, 0x30, 0x36]}, &(0x7f0000000100)={0x0, "00112233445566778899aabbccddeeff00112233445566778899aabbccddeeff00112233445566778899aabbccddeeff00112233445566778899aabbccddeeff", 0x15}, 0x48, r1) add_key$fscrypt_v1(&(0x7f0000000080), &(0x7f00000002c0)={'fscrypt:', @auto=[0x30, 0x30, 0x30, 0x30, 0x30, 0x30, 0x30, 0x30, 0x30, 0x37, 0x30, 0x30, 0x30, 0x30, 0x30, 0x37]}, &(0x7f0000000100)={0x0, "00112233445566778899aabbccddeeff00112233445566778899aabbccddeeff00112233445566778899aabbccddeeff00112233445566778899aabbccddeeff", 0x40}, 0x48, r1) add_key$fscrypt_v1(&(0x7f0000000080), &(0x7f0000000300)={'fscrypt:', @auto=[0x30, 0x39, 0x64, 0x30, 0x30, 0x62, 0x30, 0x38, 0x30, 0x30, 0x39, 0x30, 0x30, 0x30, 0x51, 0x33]}, &(0x7f0000000100)={0x0, "00112233445566778899aabbccddeeff00112233445566778899aabbccddeeff00112233445566778899aabbccddeeff00112233445566778899aa91ccddeeff", 0x40}, 0x48, r1) add_key$fscrypt_v1(0x0, &(0x7f0000000340)={'fscrypt:', @auto=[0x6, 0x63, 0x66, 0x30, 0x30, 0x63, 0x31, 0x33, 0x0, 0x30, 0x38, 0x35, 0x35, 0x35, 0x62, 0x32]}, &(0x7f0000000100)={0x0, "00112233445566778899aabbccddeeff00112233445566778899aabbccddeeff00112233445566778899aabbccddeeff00112233445566778899aabbccddeeff", 0x40}, 0x48, r1) add_key$fscrypt_v1(&(0x7f0000000080), &(0x7f0000000380)={'fscrypt:', @desc3}, &(0x7f0000000100)={0x0, "00112233445566778899aabbccddeeff00112233445566778899aabbccddeeff00112233445566778899aabbccddeeff00112233445566778899aabbccddeeff", 0x40}, 0x48, r1) add_key$keyring(&(0x7f0000000700), &(0x7f0000000740)={'syz', 0x0}, 0x0, 0x0, r1) add_key$fscrypt_v1(&(0x7f0000000080), &(0x7f00000003c0)={'fscrypt:', @auto=[0x30, 0x30, 0x30, 0x30, 0x30, 0x30, 0x30, 0x30, 0x30, 0x39, 0x30, 0x30, 0x33, 0x30, 0x30, 0x62]}, &(0x7f0000000100)={0x0, "00112233445566778899aabbccddeeff00112233445566778899aabbccddeeff00112233445566778899aabbccddeeff00112233445566778899aabbccddeeff", 0x40}, 0x48, r1) add_key$fscrypt_v1(&(0x7f00000000c0), &(0x7f0000000600)={'fscrypt:', @desc2}, &(0x7f0000000780)={0x0, "42b6f79eb265b5824e857af864c58803d13c052f671a2ae1f76bf1da5cc727376ed546011b61539773c15f7e54ddbb21d67e1662214422745234909a6d75d284", 0x36}, 0x48, r1) add_key$keyring(&(0x7f0000000640), &(0x7f00000006c0)={'syz', 0x2}, 0x0, 0x0, r1) add_key$keyring(&(0x7f0000000940), &(0x7f0000000480)={'syz', 0x3}, 0x0, 0x0, r1) add_key$fscrypt_v1(&(0x7f0000000080), &(0x7f00000004c0)={'fscrypt:', @auto=[0x66, 0x37, 0x30, 0x39, 0x36, 0x38, 0x37, 0x65, 0x39, 0x37, 0x33, 0x65, 0x63, 0x38, 0x32, 0x65]}, &(0x7f0000000100)={0x0, "00112233445566778899aabbccddeeff00112233445566778899aabbccddeeff00112233445566778899aabbccddeeff00112233445566778899aabbccddeeff", 0x23}, 0x48, r1) add_key$fscrypt_v1(&(0x7f0000000800), &(0x7f0000000500)={'fscrypt:', @auto=[0x30, 0x65, 0x66, 0x30, 0x30, 0x61, 0x38, 0x30, 0x30, 0x34, 0x30, 0x30, 0x30, 0x30, 0x31, 0x30]}, &(0x7f0000000100)={0x0, "00112233445566778899aabbccddeeff99aabbccddeeff00112233445566778899aabbccddeeff00112233445566778899aabbccddeeff00", 0x40}, 0x48, r1) keyctl$unlink(0x9, r0, r1) program did not crash testing program (duration=30s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): add_key$keyring-add_key$keyring-add_key$fscrypt_v1-add_key$fscrypt_v1-add_key$fscrypt_v1-add_key$fscrypt_v1-add_key$fscrypt_v1-add_key$fscrypt_v1-add_key$fscrypt_v1-add_key$fscrypt_v1-add_key$fscrypt_v1-add_key$fscrypt_v1-add_key$keyring-add_key$fscrypt_v1-add_key$fscrypt_v1-add_key$keyring-add_key$keyring-add_key$fscrypt_v1-add_key$fscrypt_v1-keyctl$unlink detailed listing: executing program 0: r0 = add_key$keyring(&(0x7f0000000000), &(0x7f0000000040)={'syz', 0x2}, 0x0, 0x0, 0xfffffffffffffffe) r1 = add_key$keyring(&(0x7f0000000680), &(0x7f0000000000)={'syz', 0x1}, 0x0, 0x0, 0xffffffffffffffff) add_key$fscrypt_v1(&(0x7f0000000540), &(0x7f0000000180)={'fscrypt:', @auto=[0x61, 0x62, 0x35, 0x39, 0x30, 0x64, 0x37, 0x66, 0x32, 0x61, 0x30, 0x37, 0x30, 0x64, 0x0, 0x65]}, &(0x7f0000000100)={0x0, "00112233445566778899aabbccddeeff00112233445567778999aabbccddeeff00112233445566778899aabbccddeeff00112233445566778899aabbccddeeff", 0x1d}, 0x48, r1) add_key$fscrypt_v1(&(0x7f00000009c0), &(0x7f0000000a00)={'fscrypt:', @auto=[0x31, 0xe, 0x63, 0x38, 0x31, 0x38, 0x61, 0x64, 0x63, 0x30, 0x65, 0x30, 0x36, 0x31, 0x32, 0x36]}, &(0x7f0000000a40)={0x0, "2628ef6169ce0c23300aad3bd8276bfa5a76274e6d287faf262c30f0f01f01afdf7dd0c90abeed83d9b7ae21c1731df54db18c7f4736fb3ba12abb31f88487a5", 0x29}, 0x48, r1) add_key$fscrypt_v1(&(0x7f0000000080), &(0x7f00000001c0)={'fscrypt:', @auto=[0x33, 0x30, 0x30, 0x30, 0x30, 0x30, 0x30, 0x36, 0x30, 0x30, 0x30, 0x30, 0x30, 0x30, 0x30, 0x33]}, &(0x7f0000000100)={0x0, "00112233445566778899aabbccddeeff0011223344556677880502d2b9ddff7f00112233445566778899aabbccd3ceff001122aabbccddeeff00", 0x26}, 0x48, r1) add_key$fscrypt_v1(&(0x7f0000000080), &(0x7f0000000200)={'fscrypt:', @auto=[0x30, 0x30, 0x30, 0x30, 0x30, 0x30, 0x30, 0x30, 0x30, 0x30, 0x30, 0x30, 0x30, 0x30, 0x30, 0x34]}, &(0x7f0000000100)={0x0, "00112233445566778899aabbccddeeff00112233445566778899aabbccddeeff00112233445566778899aabbccddeeff00112233445566778899aabbccddeeff", 0x40}, 0x48, r1) add_key$fscrypt_v1(&(0x7f0000000080), &(0x7f0000000240)={'fscrypt:', @auto=[0x30, 0x30, 0x30, 0x65, 0x30, 0x30, 0x30, 0x30, 0x30, 0x30, 0x35, 0x30, 0x0, 0x30, 0x30, 0x35]}, &(0x7f0000000100)={0x0, "00112233445566778899aabbccddeeff00112233445566778899aabbccddeeff00112233445566778899aabbccddeeff00112233445566778899aabbccddeeff", 0x40}, 0x48, r1) add_key$fscrypt_v1(&(0x7f0000000440), &(0x7f0000000280)={'fscrypt:', @auto=[0x30, 0x30, 0x30, 0x30, 0x30, 0x30, 0x30, 0x30, 0x30, 0x30, 0x30, 0x62, 0x30, 0x30, 0x30, 0x36]}, &(0x7f0000000100)={0x0, "00112233445566778899aabbccddeeff00112233445566778899aabbccddeeff00112233445566778899aabbccddeeff00112233445566778899aabbccddeeff", 0x15}, 0x48, r1) add_key$fscrypt_v1(&(0x7f0000000080), &(0x7f00000002c0)={'fscrypt:', @auto=[0x30, 0x30, 0x30, 0x30, 0x30, 0x30, 0x30, 0x30, 0x30, 0x37, 0x30, 0x30, 0x30, 0x30, 0x30, 0x37]}, &(0x7f0000000100)={0x0, "00112233445566778899aabbccddeeff00112233445566778899aabbccddeeff00112233445566778899aabbccddeeff00112233445566778899aabbccddeeff", 0x40}, 0x48, r1) add_key$fscrypt_v1(&(0x7f0000000080), &(0x7f0000000300)={'fscrypt:', @auto=[0x30, 0x39, 0x64, 0x30, 0x30, 0x62, 0x30, 0x38, 0x30, 0x30, 0x39, 0x30, 0x30, 0x30, 0x51, 0x33]}, &(0x7f0000000100)={0x0, "00112233445566778899aabbccddeeff00112233445566778899aabbccddeeff00112233445566778899aabbccddeeff00112233445566778899aa91ccddeeff", 0x40}, 0x48, r1) add_key$fscrypt_v1(0x0, &(0x7f0000000340)={'fscrypt:', @auto=[0x6, 0x63, 0x66, 0x30, 0x30, 0x63, 0x31, 0x33, 0x0, 0x30, 0x38, 0x35, 0x35, 0x35, 0x62, 0x32]}, &(0x7f0000000100)={0x0, "00112233445566778899aabbccddeeff00112233445566778899aabbccddeeff00112233445566778899aabbccddeeff00112233445566778899aabbccddeeff", 0x40}, 0x48, r1) add_key$fscrypt_v1(&(0x7f0000000080), &(0x7f0000000380)={'fscrypt:', @desc3}, &(0x7f0000000100)={0x0, "00112233445566778899aabbccddeeff00112233445566778899aabbccddeeff00112233445566778899aabbccddeeff00112233445566778899aabbccddeeff", 0x40}, 0x48, r1) add_key$keyring(&(0x7f0000000700), &(0x7f0000000740)={'syz', 0x0}, 0x0, 0x0, r1) add_key$fscrypt_v1(&(0x7f0000000080), &(0x7f00000003c0)={'fscrypt:', @auto=[0x30, 0x30, 0x30, 0x30, 0x30, 0x30, 0x30, 0x30, 0x30, 0x39, 0x30, 0x30, 0x33, 0x30, 0x30, 0x62]}, &(0x7f0000000100)={0x0, "00112233445566778899aabbccddeeff00112233445566778899aabbccddeeff00112233445566778899aabbccddeeff00112233445566778899aabbccddeeff", 0x40}, 0x48, r1) add_key$fscrypt_v1(&(0x7f00000000c0), &(0x7f0000000600)={'fscrypt:', @desc2}, &(0x7f0000000780)={0x0, "42b6f79eb265b5824e857af864c58803d13c052f671a2ae1f76bf1da5cc727376ed546011b61539773c15f7e54ddbb21d67e1662214422745234909a6d75d284", 0x36}, 0x48, r1) add_key$keyring(&(0x7f0000000640), &(0x7f00000006c0)={'syz', 0x2}, 0x0, 0x0, r1) add_key$keyring(&(0x7f0000000940), &(0x7f0000000480)={'syz', 0x3}, 0x0, 0x0, r1) add_key$fscrypt_v1(&(0x7f0000000080), &(0x7f00000004c0)={'fscrypt:', @auto=[0x66, 0x37, 0x30, 0x39, 0x36, 0x38, 0x37, 0x65, 0x39, 0x37, 0x33, 0x65, 0x63, 0x38, 0x32, 0x65]}, &(0x7f0000000100)={0x0, "00112233445566778899aabbccddeeff00112233445566778899aabbccddeeff00112233445566778899aabbccddeeff00112233445566778899aabbccddeeff", 0x23}, 0x48, r1) add_key$fscrypt_v1(&(0x7f0000000800), &(0x7f0000000500)={'fscrypt:', @auto=[0x30, 0x65, 0x66, 0x30, 0x30, 0x61, 0x38, 0x30, 0x30, 0x34, 0x30, 0x30, 0x30, 0x30, 0x31, 0x30]}, &(0x7f0000000100)={0x0, "00112233445566778899aabbccddeeff99aabbccddeeff00112233445566778899aabbccddeeff00112233445566778899aabbccddeeff00", 0x40}, 0x48, r1) keyctl$unlink(0x9, r0, r1) program did not crash single: failed to extract reproducer bisect: bisecting 38 programs with base timeout 30s testing program (duration=39s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): [10, 10, 15, 20, 10, 20, 20, 6, 40, 12, 12, 2, 13, 13, 13, 6, 2, 15, 8, 3, 17, 6, 12, 19, 6, 10, 15, 2, 9, 9, 2, 6, 6, 2, 12, 15, 2, 10] detailed listing: executing program 0: mkdirat(0xffffffffffffff9c, &(0x7f0000000040)='./file0\x00', 0x1c8) r0 = openat$fuse(0xffffffffffffff9c, &(0x7f00000004c0), 0x2, 0x0) mount$fuse(0x0, &(0x7f00000000c0)='./file0\x00', &(0x7f0000000800), 0x0, &(0x7f00000003c0)=ANY=[@ANYBLOB='fd=', @ANYRESHEX=r0, @ANYBLOB=',rootmode=00000000000000000040000,user_id=', @ANYRESDEC=0x0, @ANYBLOB=',group_id=', @ANYRESDEC=0x0]) read$FUSE(r0, &(0x7f0000006380)={0x2020, 0x0, 0x0, 0x0}, 0x2020) syz_fuse_handle_req(r0, &(0x7f00000083c0)="4e5350994ebf71ce3049a58c5d050078bf16b0757a4c27b455e2a547739587dd3380b5df8f40a0696c5bd6cdb672cffe4d870c5c90ca92095b9ebf3e92fe31d8cd74275d857d34a74f7eecc7fac15e2f148d4e9d47bb45b858bbf078999970d180f28d7b2cefd92635d45a563d9229c9fd770efdc0848e52fa5efd9ada5c94a1ba94b4b7c7507f8b0819bb20910f9f50a83a010abbe126dd9f6a7b84eab6b0d5ce78d2ade77a5f7e4e997df1d03ffab4b4c945d803e4457909013127a98769c938c237f37263bc509a42bc56ff2dbf80e847e2c407009eef94f18e1e59069d62298fdbadae007ffbdf403c5049a4530ac0abecceb5608da02754c9a575af52c0b7e41226e2d642a814861c4310c935bcbae413516dde2132652b39c7aa0218a6ce65dabb4494965209ce879ba7e7e59039db5c1d36d6a7f86d72dd59954fd6f46124a2506b245a0db11aa89d2feb312a6596ea2fecaa7b6021f37a255f628da7ff6b6c36b514d3b6be34e505f9dac6acfb888198004699fb350ac93431533554658c4957df36703591438d6488bc03dd8290a75ebb367a481a50e79a46b04d005649cabd79e5c6326c066bc2b6fc5febb87ef66d832ef31a16c2a450a0b990fb549a5d810c928d1a81fa1dc795db2607ac7d46cb5716b68acdeb00987e429fe6a394632c83b43336e7b51d9cfdb50e83d8c6ba1784d9f74c16b476e048e65e7ac0af683b347d7377ac1795422e00e5bd8da9b313af83abb3348861116de7a99959169b7dff9f7d9b7a6d107f2e76670a6214a419bf8298f80eb570fa29264ba57a383c5ec5836ce33104ecaf1aec76e311280a1d2c8bd7abff3a5a242e6a637f7db63038ef5d78aca9c680d72b60da4dbeb0e1e683ddc82898647c589a81b8f92db06711d8a0af05560cd77fa7005283db71e8da21713fccd450822062b994d152aaed2cdcf0dec9c60617e15ba4df628da4e71279bf9d1eee5c7f055c27cddfdd45f9225d5d5529ef7119e2e3c9838e7362971e069be487797e949b24297de19c61340d1cd7a2bfa3880b91a71e934720a59e1e0ea992d2a1633a0852ad8addfcab73a291e35745e694a6471f429b124305886c1f79f67c78de3f3ec998c91e7fc59d26766cd446f6f0de603f2c6892e13cdaa37d9e8e118d098b6986ccd991993ec152193e7d77394b05b99e7d310c506707f1be52249438fba9615f6dad2ec7244fedf36e34ec311b7d6bee64271d6491079e161190ded7e28e2ada4307a9b2986c267b1a30d2f720ff23408011f1d589ce9ee77f981c7833656ccf7df5b3a87ec253ff7c7ef1e67ceeb10c93e3fa683cdadad65850ffbc402b7744e94cdecef9db9d264c755c53d36278df23d4c9685fdefa69f7588a33b8a64b35191ee81abcb9765577d175cb06e31c582807ff7243bfef44961fbc0f8a235242f51ee991ea621803d4dcfed90d26f004b299425bf219f6d185fe6e088ae44601b03defada18794feac93787696a5d419f09f769bc590f43d2df6a131f6895da2de120c2644685e57b1d476c6aba5881e954fb2575356452b118b942cb02b4ea0fcf8f1bbb9a23b6e32c9d0accd3dd861452a3ad77b38fe709e216974932deb5397fd8033ff0e073d93ac0b4be762bca0424d69bd57b22ba914133f87671a29498b268c2911e793215463ca2164e38059456107dcb29beedfd6277e2b41a11d1c6f1361b19875c9384f04f9c53c1856d71f360a8fafe05f7aef750ec0cf2bfcfa971c017ad071b69a18fdaf970b384d4c889cfa5a0397dbe89543a5c6302645d6edf959aa60709ce0225fe6c3266c7ef62157ac8e78fddcd8a1f2ca5b58128218d19276885515775326aeeee0226cc810843eb05144bf8e2fe3340cf60b32cafd96d23cd7d0d3adcbdfec9a2a3d88307c362633b1c5637608ea8476d900b3f836a9734b5ecaf5e82983577128d3f74b903b0e3bf64326c1b564ae42aeeb0c07702b63a9ff74a2af6b45e5185a53f36c17bc29dfbc0ea28ca5cca43a15d751e9887ad3e6a87faacb6a278c4c8a8d21b9a77b9776f33102a6e645e99cc5cbc543ed0674282c2b9f8e5d14c2599aa9ac8f81438c77f2b9368bdac82edcdc5366f39adec9e9a3fbd55b79abc16d2ebff26b7d0c88f18b486e5836333575e3fc7808cb423b44781c57965767862922b4ff32d9bae76296843a46f430211c27ef9db168430026a5691623284dfd459dbdd1f1a6ec9bfad666507e6eacb1e2a7866da2e12e6d596d0bbb150500590013d9288af20596447f97bf1744eb9cfb244d8fca269b1fb71e14de664be4e95d83fff1b8abcfebcf3e78c1c66d28f260fb0c19f9fbcd2abbdd7dd7246e49dc25d954bf25f810a2ff6f9069dfdc62e7170fe3b0964b2ac95024256dfa3e7a426be5bb5f707fd82c2b3afec5d5dcf5bbb8fcb6dbc1b59f6c5330966c70d8b016956903a4278817414ba3652a102d7e7e37ecc79400267fc3bf7601c0731f87d479c33f100735e748874155267f708cea49d549e93cf7a398b20373dc90ad9afd56d9c77cd24e2c4a18f7130b366c7fe5b26bc4d11ca1ed1b98fa0b4d7396f82ae6593f4575d19f4d8fd586c991129e5cbe15c8bacc89c3ee15ca471dea966b5c48ede0d3ba2a7e28c75c04e6a4aa49a61f4e391ffe78eb5e40a5ef349f3aa4d15f2291cc86ec7e47ae301bf0b6083dae44b695820a893d46732553ef15ed1c16d28268d52a7e3a7e7c009d0c0708a356d3310c1ebcbcca4d7acf433e34bfc9fc115498142dcc725e7a16879c75e4c2f01c6c98b39619f3248bf530e6ee593467e38cf4026cfdc4db6296565722d587f3c580750b1453ecc141c0461495551297d88ae034acbd4f5e80ce198e6640c4c1e9501529988109cef006eb2090a6fcd974d7f60290b78f1a8ce3051ac2d69636c3219f0a6ad8c254764396a1684b2fd9805b1853525f2e640e513197283cc4d4073ac033e0539a88f08aabe1423cd40b8a7e073437d812b57a5d39a0531dcbe13f4466e89efc66c2a1e4b39a3e0b3073c9d44e6cf9b85f4df5c4e03628d05bc0f94ec04234c9eca4ed17463f190406834b02888728f625371cda75d15ec19efebd59f00ab659eb94eb88bcb2110862a369ad599610c1530fcc118f5b82205bc5215fe3623ac8ec297d8ff4eee75ace20731c5d505e6605c26203b7f754164c9463f0a6eefe3a2880b8e06e7bc66bb2adcc1a3f9b0325f5ec31d12a25f1f73c2aa6bb3a7680d786a082a63b13cce1822fa6a4b085a871ae3409eecbc1fd8661b5d52bb2b8b72f23e24a225075f272ed2ba0c6c5c693811a0ef8db6da7cfe7c966c647f0187ad223eedb1012a5b7af103e98464ac768c79b21ca45b12a52cf261de0d367442cda71c4b8ee39c94ded1b22ba06c13836cb467ebab4efea07bdf1e3de8da56a0ee6d4f848011253cc21fac10700003513d3167b7a73e0d752b861c49814bc5410ebe53a0264f76068c91ee6ec9e2daa343482b2f0f06e605c5aaf81f2a3cd570efc2094b4bc452f9526f1bbe7b22b694fb8109a5a987fabf6250912d6099e67da9cac79e8b6f2cce4702d1f17cbc5d06c38b8a48155ec758369c185ded839fb58cd736fbb74105fe5baf44e7e3ed06843f23601b60a43b1f88fd29e9b3f58479f9b95392a39d5ba1a31ee4441ca2d1fb57c0a8678a07a724b7a65b2ab16d1da197f435bce3ef003fce27fa2f0a67c9dd6c930a4bcf59e79e57b010000006fe34972958c28b56642d14ea89bf4d7d6f7fcbcf4fda8bd08fc9fe424de4359112b11f81fbdc1505658363697713ff6e1f8ca3c4be34a79993a9091f6017cda6c7489ae5c07062555231427c3eb42a049f42d22a060983b044a7d34ab5d2b5386cca79af72396a48aad6b8dcd7855410fc6106e4a165994f26efff1e7ea0aa8f560333b5dfdb2a0d899b0fda955155f90c75effd3c9535d88508e836feb7807d57b2a57cca42d3d08fe7de60d2a33376f49bdacdd3f814bd0927f417f15ad62a10b302f1cb390aaf82b0bc6af46bbf990b6ada45ef83ce13029d167c65134e7b82b59ddfdc367e61c40defd2732ccebb1d4000f6c742df964e1fb390c255d2b1dfc745c6ab34af8096b5b67aa179e3f341854f7a69f7bf47664c832037ec7a78f8e27209e3f20f833fb6e8c0fc4a40920a5ad2b0618982ff72540009d5db82f0f5bcaed2a27f35d1e50eaa0cf8e48c7a2d43c25d0264db750a7f33b44a4bfaae576cf9ee7594ed204513899566564ed8bbc97ed18b1d8868f926a5c70ac06fbac1eade46792186be7bf8ffa3301239edd093449b7d77192782b5111c14169d2b4a1b3443ad62e4abdf11aac6a5b89a5b20ab0ad0abd949b9d64582c67ffce018e7e46de4091fcc77a65b971fc67c8d9cbf0c341ca764b1056ee5014d9865059616a525a1d46ae2fad159afe86dd1df9b8246411827e19535ca0aa9f83050b06e70aa2737f27e93d584a9cef878a642e9361efaa5d20bd8da901fa2e064656f686d3b3ea31d1d850ae9196b7764548f5c6450a32a717e09b6b7e75d43fbbda76e43a24f186d5578933f408bfa28e0435cde525fb91e71d92d704cc5a9b5e3db7aaec46d2b1f8dcb3f921f69bd7397c96a1e132c39c8f1656cea4365c779abf76199cb5b6aada022edec5c901cdafa2e7f3765af9c8b20cb1a6785085fcb0dc901367b89051bdfdc6b68c5215fd04e2b3c7e1c454a4d21132953b25c50995af0f7159a5a8d0a1621f4808f126a5bd40ddc79fed90f49925ee367a57a05c070fbe39fe2c213e7c1724a907ecfa69efe6e021c06a262471a4377f3c9809e9fee4f375e27c31b6afbb2151da86b7cab63c7b4fa4b77fb30172b9d0d78b1c0535ec0639c4910b5eeecbb5b8b5c8aa74c140e7ad347812e36db3097a7ff85c09ab2c0020202307f50efefcdb497b9c060ca68c4be54a9165b4cebc6b2e2e14e5ffb9213142418faedcdf26fd326b7672399e71cfffe3ed712ced5317c254f9199ee10c24c802d102bd8749513d3145201ca4e01bc7c8bbcf430afa541ec5665f86dfb143be648521bb0f2b029018201444787f644f8c88b79e754e6ea9c797babdaec72a9680abadf3a41684cdd57c2b6e833acc0846be5aa927f1b1b36562d2acb9ecfb758455230d050daec6748ba280a5edc86d48e3f8af0f8f4ffb18ae3cd3c19a82d504a4fd52bb62289ae8026572a497fe268f87ef4b4b5886aa07eeb698b7cbf99683f710afc9ed1f8a488883ce0eb8f7fd055b82a9fe21a409caa231c41ba151008e9658919c611e157d7f3926a5e4248532a6860e615b9c86e9fea212128d96ed58c9b84ef22706071eb69f492e4d8321ed9faf6c6a8928f86172bdc930244583ea15be497d9ce4ae79cb3e6293a8512ffaa9e8e358f3c7c7117001fb92891a40b84f9126cc3def5cde67f463bbac9668b9f56c3e4ee72fceebb47e52fc226bab213d8193516e7064459fd1365350a95c5a1c3ac44a73bbba2a4c17ebe49dd781bff1995cd706b77bb533117594ad63566f4c0730beab85ff4c713b7f10b95480fe99a0f676c51ca11116b21e87887b462aa9770e85509e4e60f198148115f0a3ce6028516a946178d1acacf7767f6be7277891369eff67762aa58f928d48b7231e44d899cea8289003349117a53d61bc27b207fdc91c9db61e677d1e1a1bc6a1b6e8564130b335233db4b5de8d62324e6d0ccb2b08c2ff922324eb8c506711142d4b8d7a21223ef0a3d534fdb0de58be95cd827152f71bdd0a82766b62b4c87536f0b7e7df343c4263187da887de6e65d11d0360e2376c1d71c367ae85edeed8f767d24c644b1a9b455ded1dc3cc224f99936a6ee66931c45e5e3db2427719ab2d5cd9c20d9bb0ec004b69bccb00649f3d8e34a3572c257de114b9f027d76bc7db9007175cc03b9e2061b6b3fe7409e009b5371544e56fe438cbd361e5b11efbf2d79d1c250a1e73ca8c601c4f4d1e3761290950421c48c7daa45965e472f5ef3c4b8597444dc5dc01cd25358055b5000617f3e7291da3413e3f0853b1271366612405c35ff1b785b984d921b518425628a533a29ab65d3c11f44c6daa86f8b6457ebb9419274c481aa6f3fa4547641670aff58b9cc62c0993d49a509f02dee755ee5f1fd2710c995c43a91c4f873afa1bbdff19427cba2641052a8f361ecbc72e8a6cf587e83f8bd3110c95fb080edc77a6d43cd58c447b0e02261e4109500c6458dce70acb17aa8f9dc1d15b94a61354164031b5d563c25d0246fc45e6401cefceb501e1468903e5d677759dbe3f24bd48ce55ff8b8f26529fb3b2d669202a1e8a498984b449b4830a0126b18f0e78182c9ce78fe0c448c0e27845b926cfde28fa85e156fa98fefaeb19ed1247c9643b447b4342c94c114d3c4c35eed4d5b49aa70e6aad45bfb557f15e8fdb2d6e3d10d8338a13fe3f187751985b37a5bb10b750f79e36fc2e2ee9bdecc3ed156e202ed7b45a94809d77edaa398042fc6a825a4848c334c557303d24eb3f8e01be06995ceb283c70272b00da61c3381628f0e372fe2fcc779ff7daf7e4b7f2686c39d3fab674b8867b62b0bf9d5cfd0c1d3b270521f55f147de75142ffd7fc9ac7e5dae7ca2fdf26a9222d060823852409dd040cfd1f66f218c6dbdaaacddab34b123af22f97384d64fac64d84fd638c96378c8f9532a11927d48440bc777ff8b8b9be88f930f3b579a713c0bc449dca3a3bd5f2efa98240ccc594299e44451dc60c6c5c9edd0d7b777912b3dc40c57e0ea5f4425cd7047e686c7304f04ba9f7b5de6ad2bd524f1d29f8802a524441fa286015adf4589431710aa4d76de8a956dc1d39c0a13abb7fc309d24222d036e204ab6bb46ef8a7595d9e4512e0b9d5f8fd719a4e3072e1d806967045789c67a1681f2a9f1f4b19f4f5e1afdafc17db7a6d5196161499e62ab4b0ec27648f3eeb1fb2b78f8ecf9b05cf9509a3b9e2a361238deb1c91bdbc8b1d11bbeb939fd9da811cd439069da0ecc00665d72357aac01f259a0325409b201859cc0569e0eba67a7a9ca7e8b78078d9370bd3e37f0571680ede60cb6bbfe69435d6ab5efd80cf051d119a7004fc0b600844d49218d844de8f521524a47ee50229c7da25e42a8639b5db225e7f23967f5d4f8a297aff04a3cbedc2985b6393a5ba0b26b6c7b4ca22d369b35b410799d1ad02825104d34f73408db1948438597931ed1c1c260e78340517bfa2f734537dbdf5ec303518ff4640efe7f7b1c2f46babdb9247ce8eabad9718a8b9ddb7a18d5e87ced554c9d6de78f85d293349590c6c32483534bc968b24a28eb54b9515589d6dd8eb51a5ad0b4d896ce92250397cbc404323fcdf0ee47ed634e0c58213bc5b35a72b21a098e11b79c061430dc817c1e0c79a5b6ed3b002979933f1b83a17f250b1bd5c4958df4d75531ca03efbda89f6a92fe08c23ad9014ff562a7f3dcde578d6825b9847b5df04dbca4f2aa52d8e0f4cf8183ce121e39b50358a9796acde0372a8ff97769874a80ab997cd889145aad4888c06963c2f5b82f53a748a6729fbc79d35c06d84e05c62e44ff78040e56ebfc6efcf0d8b49337d5a17c4041f0d5a8b616244d585a162b69db073accd9071d12df5b326a43b834bbffc2f2a60deafcbddf1c6438a1769d6fb09fbe1990e89da12164ef237f326edb5be64bb64b143a030de8a99b3c5e543c871cb581e2be090a92134aa587701f864907cadd7c1ce20fcf8f5dc7f7ecd06a6c19d89a92ca0ad4393c208b80bba990c7a3702a9c79bddde75d5db244719ac32191b6ceb041ab541fb47680a97dc0422b8a50d91e32cb08cd341b0b099aca5bd12b69d4f89d10b755b351a6489180b786a3bebac926532a4a2d85b07bce6c090d1aaaff079e36d5394a612f1351b90c13a0fa6bf9d188d548dfe6fa51a9026edb52009c03ed45ac51d05c58a957bcc67e05a588985ba00d79f33ae9cdd5f5721d9fdc72ee6e880708be87e8a60c3c035c146f2091d1b9a4c2cfa56f292fe1ba62290d4e56c05669291bbe917f3cac51802a2cc8e9c90dadfe666c233c5a5bb71ee17deec51ce60c73f57bf9ecb84873afcc44815131810c6c1217bea485ef9aa2785e859b25315ef8aa3a274982786e45d622ae831fb76010d69a181b069e4cc55d4436edb10d1119b0c6000c6d5cff7c72f740a59dc0507e7a952b69403c62673f122c9d1264fac6ce2262e86cd8d6a402672f88530fc2d16f31736dd497a4e853253ac8d5aff8d1376895e9f5519b2490cc2a2412ba0c99cec855f668837310035e92fb646486de1b0acffb91ae7516df3eeef381456b55e65baa58e71461c928687e699d2b21814805591382e95e1b970aaa53259917f070281f2336b7d570249d838b3f1a32753c336864e15f4561badf8fee034a29c52ff3fca7456ae140f83e3b2fd5b57c9aef3f20c664200d235f236ec47dd2fc20b14dc6000812237aea992d987e5460679e8c5b76d931ef6d951e6c7087e3106b6ce2db9de6f228fdf3ffc38710c0e8d5000a195a79d1fa2301038f5b27c40b09c34c025e5099d40c2204ea0eae985263c9101cab88d6857a320c9e497f22348a24861a5fb8d734e08cad09f9933748ff01eab22f17756f58688dc1b486a397563ee9ad0784b8833cdb5f7c6bcf76d9c1105f71c3c6aabefd70dc6cd5c66d31caf916145ac5ed7fa070b4277c0448ab1eb78c943be9aeab0587d321a4bcb7754f070881178f8be668b686124899fac252519f4b60ec42db766a908755040463125c26850177402a977246d36d23afac0a11889d54640bd8f6f670d686cfd33f6fc5d90cf6cbd63d9d0fd201dd4c74dbbab899f3c23c0b7e37ea0b2aff421327200d0da58b5893a4186ae3652cc6e11c2c2a0e52184a3872532acce98c94cebf4f31333663a620f0dba0ffd89c3124380075bd28caa6d449a050b3661b8fbaf4747b77c4928b1378fdc8c7a7b38ade1aeec44bdfacc8271d0b132b2029b0f3582f9919f5c8cd543abc9caf6b82b197cd482c3ef61a64743506342bf50a3c1ff544563bb8b2002911ee1fad698f4ac133ffed5bfe81239c918207a03c7a8bd71a0a502aea78d38e970e3ab2abf754b598acb79cf276792aa08724d0ba24f2a694912ab795b3f45f52dec50d9bfbc99ae27e1d2c2216afec6709d6513a64b29ef58255bbe18478c5d4f15f74ea63a1e15487752eec8fd019f1d4a7aa25277664754bd2d7cd3a7a018b92c56d965a1974885363757286da9e055ef7fac17876f0a64c1026a597733b897a9155ecbf420159ae8e5209aa83a3544fff1fb4566f2d54f95e3bbd30dcca5f24397e4bd47ff01292f0d6fe9dd47a810e0c25382fa69b4987d1afd9b69ef125110ad6b240eaa9c85829a2646f9ab7874bc02bfa8346cc9190943e9d46b44880670b1e2aa3a29e83be5472d7418885a353faade6e8b18f4b588607bbb758588d1e2f11a9dfa1c4d61be50249f1ee32e6ff8c0c7722aaec1bc79654a4772efc578bd6a14c79abcc77a4e09c8b6c6ea35cd3ab31e35268fb55db843176f8042f8ce7be0ddd4ead6dbdad0ef9e7cb2323db5cc48119a72b27306b8ff6366c0bc682a85ab9e2cf2238b6d6eb2e38a97d5577e6334cb2aa6e7c86e489e876f9d7053577a5cb57f52812fab7c4bd7b19a34c228ffb67dcac9281612f778b58c580c140542200fd00cb3ad81d93420df93c5af2493f646d8de797102fa0a65247317882fbf171520f00b2c7638623b823ff11444fdde453570f99f9099b60061a908b83383ba8b82bb78edd074dccf9342afdf8d11a6129ba6ea7030f3629056264f1736c2b926171b6dc7e1fa455a473de656390495f3b6ad2f9f46f35eacb075628ff739ef78f28ba683448068c7f18fb63f28ba7dbbb78999100dde0a94e8b8570817c7114c13e139ceb333782b29a84a5b19497fa785915c7680dd7f972cb59ba22161f60886e5cb3c3e808726cbf96bc4da78914eee565c6d9d18e70d22cf8c0244cf3cf488c3550eaa400bc0f26d64e0f1bc8d0301a841d954073a641f3ef883d81f4d5db8e9df708e64e640b38df7295f7fe573863653086bae5507c880ab7fdb7a6c5ce77027ffa7395233d3ce536d77ae6c2e9c8ffb6fee78a3bcb3b5f888bd595caa3a5586948776b950a89cde4db8247ffff27491c882b430afdd60e7a22324f6635a9aa7139f3e624c6d9ece60f7f8153b2080cf0544fbf8e1c436503766e670b902604ab521e11aa5a65cedd64cfaf898ac5f55c08c87693c323517bcb0d99c28f5e072d4f6540c7ead70138d47c1a67fd72bd6ef5613af33a0af311c3d0a631ca2a2dfbe35d1021eb610e40b9be128683235a788b5a4cacf99babee382458d59e8aa1dd7bba7e09dd30c055a3df8ed721a1778b2c6ed587a403566325cd19962edd7831caa44a6b716517bad502130e7cf6a5ce5288dc84c0170f622ae0b1e1166a9c2c0771d91df9f9dd82ae210469602ce38964746c1c1d04321aae7d464eb801dbea7ec39505457e778208774d72673626c998b002c46a9b4b1e390d9344f0ca62212a1b6d41043a2100b35196bce42d40caa0ea9a486bf8526fd1f0f0d362c2cac463ea7377a20b54b9435442ca529fc00da4fd7e27c4eaf14215a06857b54254c26346956fd7fe215a5ce57ec38cedf50a3c759e563a4fd87494f00e7bd9b44f3b7e99c6ef67187056a21d2fe1ac9d24125b1947eb293189fdc448b591af4d9b8eb091d6bbb5e50fae79d000044e282bb2ab6c63cc9562b151c214e45015354e62be63e1881238b907f7bdb791ff44a4e03fa29dbd26db2f49d0f4729b7cd9ba69a65b0b493466d35d09b3f590c67c31660d95e2ab4af2c9f1df91f04ce5a57dde2d75206b42e3423126774d76593c2f713ae279d7092506b513fd5d18f0f52d3fafd7141dfd4a0de1063754dba865faf8dc0f6be9d90ef21ec86a275533f6ad4b4e360dc775413f29eab8b3daac6279b9abfe163ea2f183e09ed91ef67fbb090875109288a182cfdcc46d90678efe5edceda6518335e678438cac4bb47d376f3f0e12aa55301735d7f42653c073d6a4a37b2e17d332dc1be6b50918c007b14886307cc39250e81efecd63d24067a49994572725a9df1760caac13a28f5255556b27ec245e93969b85cdec7cd1c2d2a433d3f9572b93054a7ce8adff81bc1d30884d5fc4791e251bd907e37af5bec74235c3e2f804e4e0450b715289942b7859ad207bafcfec1b586dc15e7911fe6d20aa3d02fcd47e9956780e300d7c53c17dfa15754deb4c20efebc7270bda0fa6b37fc88c6be4250cac38c1b8186b364482026ab52d65d3a691903fccc39772277011bfaa421adba76bed9731077bec885ce88d40f36bbd2a839c67dc4b862c968491b877d4fd13fc90f8da57a29121e12f78e85af765cd66e72ba513593fe1cdf20019985b065d828707d8e509c6834eab188deea5c9ee97955f4b07d37b6fc7beed73be94887d423a349f35bb8782bc670ceaec870d97f061bda02ae73f6d575f81e0b6326eae6c1b3085cc584686120e12dd9ad8ce44036bec8a189f9", 0x2000, &(0x7f0000000340)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f0000000600)={0x90, 0x0, 0x3fffffffffffe, {0x0, 0x200000000, 0x1, 0x4, 0x6, 0x0, {0x0, 0x10001, 0x200000000000, 0xd, 0x0, 0x100, 0x10000, 0x2, 0x80000000, 0x0, 0xd, r2, 0x0, 0x7, 0xa0}}}, 0x0, 0x0, 0x0, 0x0, 0x0}) write$FUSE_INIT(r0, &(0x7f0000004300)={0x50, 0x0, r1, {0x7, 0x26, 0x8, 0xfffffffff323ca46, 0x0, 0xfffc, 0x6, 0x5d3186cc, 0x0, 0x0, 0x1, 0x10001}}, 0x50) creat(&(0x7f00000001c0)='./file0/file0\x00', 0x108) read$FUSE(r0, &(0x7f0000002100)={0x2020, 0x0, 0x0, 0x0}, 0x2020) write$FUSE_INTERRUPT(r0, &(0x7f0000000040)={0x10, 0xffffffffffffffda, r3}, 0x10) syz_fuse_handle_req(r0, &(0x7f0000004380)="c798d69005c7269656773a2f54c74371b3ed25f242dec636941b527503ca984a48ed7ad2b745b10803b9826083b712ddbcb40843ddf5e9406116e37c7cbae3e884f9823a22509ac2fed9dd6d9a9e96bdaeae177454fb1c591d726d0e09186c45c1a5d382d9e107a823f19b8f449ef7c5b50bbf0c974dedae2f2155fbafaa439b9e262bd9c404097cf8ed518464eef030b766924db35df887e3d4b06eba0d41bd081fb8ebc208f752286ce553e0e4eeadfe77c512da04d718c14211c76609ee919e68deb3f7dd925037b2649ca232606b4befa4b80fe1dee15582a3038eaf9f80a94c290da2aeedf9cd9f84aef2768a48f42f58df27ebb521a6fe41367d257167771fc6c825225f7fce8ac00c2e513cb52b18d7916a3d801f0efcbd7ca0c607b0f4cf0620d4dae10a1862c417cf755e83c3b7483df6f74114e32a2c003500d55308a1d8e67992a2e8f355e41370f9ecbb84cd217c40ead9bbd580eb80506f7b8915c99be2a4a377805fcb24531827948db68cfcd6115ce2d737d861fbe1bb1bc73daea3c47fbc7a67787e9902325d1b05755b6f904866fe49cb1da8270e009c5bca02857ae3e59bc44328952acc68cf23a0a4d3979ceb46e5ff9016c5a1c35c969d33e904efa7747be758e2831a5a76719012038174818a2f0727e83ae728c2149749a53576a3a24298eea7d3246105d8f51bb7b3e203b756f37927ddc18d14bb3017cd23b4bf32a70863ffa8f8589811972cb41d99c78af869b17d212f6c67bbd99b124389a7699b75d1ce9bd777a290bba974cad745f6f26a02b891f3f587b8418bd3215192b94a313b0dcc5058fd9ef30df0b45059979eadb13f7d7b91cdb4545b5d2744668030320faf404794e02f763abbdec06bda0b9cb241281eb071dd7a315fb31cc365e591b938e5b3f498d77c46f180ba69fddb7e5bfb16bd15459ffef89591e0e329fc22a88b43c5a5be4b09e177d976ff3eb937b0379e4338ae90c87427ac78a4936ad69a205b63988911a25d408051dd55a39d3c53912d5ef51597bbebc8857dfd821c59ac4c28d8587a7b2a9658936f2a8617495d61e1661e0df8ae067abcd956e0c3d9cd08c1b03a1332f52aa8278cd7f3ea192b65b2e6ea377976dfacfb2c18c2abcd4d1f5390d7b2ab7d5321256789bf1d18d45c4b77f84cdde4b71679c53ec392efb0ab087e3d7ce79a6bfb0c06b3604872728af2c2bf74bdbad616d6afd966296dbd6dceb746f9cc2bedc864c4858e2def8c4f064e44d5fe7c5a8fb8a176f36e61c9119d7c333594c26f55ab5dd84910beba6de58847a078552c6a135d51f031636e6c10a9d1ca6d1f74d57cb99efe7c0e29dbb2402ed314a5c31b7ded809d845b044fc6d7c6641dc54a38095b7bca42379602167e60c6bf4522bf3dcb44cd22363f85ee48636b70064b342f83c6c8a0c580ba4dc534227d00a47a3d2e336eaeac7329cab089bfb2cb45a36503be5570d99e6fcc1e46d8461bfa1a509c07be4ccc9c45bf29577a4a7df7532d855c1fe99308354716a46ffc51b3cac5c7aa22aec4ebf9be5150ed6794989919311c323dbacc72381c396e94b5bd20ba3eaebcc4471b6ae38bd457a071d770dd61a84317a68fedda35722094df6f7670ce5ffb60fb8b64c7a9deff7e724732d5af94e0f527f2bd06253575c168e4c0e864a70a851d8b0ac5e2263bae69097cc4aafcfea170e0e9fddd5e2525cb46b83cfdead10e2c4e70709370a40dcf83848757f91c50c68322ff38b540967c7966fc6f410c847b1d49f6ae56dc0cb1c5dd293aa7c3291d4dfc9b33e8616306982c175880e9712c08455f0b103d04f4d91b797ce86b1fe64bb66278415233d978be47f96d94f0913501075530e835869c4bf8a53fa4fb9f5dcaa3b43eef3636457dd12a08797895e0300da091209993a94639ef4dc16b0b26cd5fdd5e489c6e0f54737011e00b0bc28e2373306b64bf5ee5ac923298d5efadcd51cdc34dcd801dd29cf523531165c5e27eb1e71e9ee70194defa8d7d143558d6dbbff5bbe33589c0f8147227d0a6d2fb3b44a11d0f2c63f0c69cc5f07df7a77dcd8557e4f6847fe02c9e10256c5fdeaea044d62b511393ab7dc18c17c19b7c54bfb4686e21685f3c25fd4a677d19d7209e336d490305d124c3d5b851cb3ee902d13e4fcf31381bd93a7b2bd926988a5da66dfd5581d7db14e6b657fdf79a08ba868ede24e3c8105708fa1a6dc62335118e28dd5e177d128119c3c4b0cc86934b80671bf02e5746da173c7361db3b254b130620aff5826a750198f3a93ef8502df541c30e203e0de7746d5efc6edf35f17ee89c1013e112745732c582baa97a8ead6a4b76875edaae81b4517e6472346cf6a9480dcac5d34b58f9140ce6199a0df92321e46f51b2c65b881c3b42002f16272bad5d507ccfa3f11546b0e19d190b1874b236d2cd4d1e2e7458893798628b08a1dcf756cdf45d41d4e128cbfb4db8e313646a0ac089047addbded124dff44fe9eb4e7e1689b34ebbade408e70d6de45d4a82fb1e7c6b9896bdf3d6e5649aee5f879fd383bb5e083367acd4a0681873b04922320c7901711d0886629450b784df632ecf4674c97ae01166a334a45354a446973db90e40ef05bd0482ce9d08af9d74428a1f4357015bf009c7f2838c07ffb6883b58dae82cd818164d5463eaf38057fc703fa5986645dd87de2b9969769bf3ad0ea8ba0596dc5c6b613efab82e4dd5380fd23aad254c1584d1ec23cd82135987f431042a57660728da2c649a8ad8a43ba771997ebb6a94a884768cd8ef3867449cc5fd0421303f552bca42b3c7e48e016f531b2fab1610c2d78e465b359cbefa97773a091536427f28d91decb6acb3202520b5468fe075ad1226a23db03f45a971d6b2894485ee2aee6616c1222e7f1b75b15d78c554e5b5c3516d317343cdc6f82b81be27e945ce62c28b522cc1130e336b4730ed99ee74901a69aca2cb665535553a37294f96894840a6be468b78d6d79adb4a8e4a9ac9b8615eca1c849a67560bdcd6feb409826350986de2e7c51e95b91a29539257e78ffdd01c43d172a6390135161807eca9fa118cb25c0461e524dfc0dba1d3176933da73a2ce9ffcd81d844fdc20fc8223489430e4fde41e48d01ae85443d6909b085f2f43fea719963f984010c5914a5b9677c5a4b779097882bded42875d985affc3733d9a6c9bf6775d0e034ae03df71a0ad515c5da1d9ba6f4bbff88a68710e0b279fd7ee8bafa15305d1aff11a439dd151804b07b051aa14ed0e1aa98f0fc34bff6c8486d41ec484a9330601aed893f597a2dcb81034323d77155cb660bc27e27ae19836307c3aa3bfb9edec978bfa9601ea9968e09e46bcf0888f2c7239f6055ae8b1b910e63f553f663d13c3e71bf2d0c4d19a4247dfb1169d51a6650de22db691c1e3c09f72b1eba9b465c18ba8be0a554fbb70041ecbdcab006397e9fde9e74d156929bafae2320bfe15ed7aa27c0d3134032e276f760db413820f65a15dc1048d4b47c59a1bb03053c6bfcedef7c3a22d456a389c5e520a656931928872fe14c30ab2608113cb3841ee3b8f999fa8b917b6fa4abd8b1fa234f50750fd33dc857391f5211ccbb2f13559fcf513d555d04d62314626baeaf188593ba28b059ee074d27cfa1d0ae430221d9fe2cb68773cebcd67eb13f537a3e4670edc51775a4bfba8a8baaca6de0969c0de5349b8c1454b636933cf45f828b7f54668ae64badded8dc278bcb1e485d1ed0f212058716d0b98aac842542cccbc8c6e201c32c5e7f80e77b2ca97ccf81ce5024c3a0be3d95dd213a4d62624fa83524d0a8c4e58d4820520c459726e4e40f9cc2c6d0855ccb6cdf79734a797daefa7c18901b768aefa7da9a3882c447d9f531b369aabe39f320a9d30202bbd4569784438cdbcf988e0446fcdc8afb0b48be333d033a13d24d40a2904ae7e2186557364cfcc41d9d4a317847c220189e2b1fc183cda40412c64b5758322ca50f62f9e62ad7b06c994babefb953faabbf64a9cfff40a0760e958056a0425fbdf0da5fba34fde039b50e3b58cce60e4d66c52e7477f7cfec9b7a89d816229f866d693d131ed5e71589833d7130a87d417a819d239e43900e506e59ede6d8ca9c0ff2f61fdd26c20c4f6f4e0b76e4cec8733cd6b640115b4d4a2a00842a9f041ad29af7da22a2fb4ec7b108e4f4e4896df12e61ade47a18d38f13d62a466804afbfe7bb333c331c8f10685c6b436ec740ed4edb38fdd7bd17c3a493dc588559fc995240561fe64503ca483f2aa0fe10cd571ab2a03edf6d811484350498e98a55bb01822cc30ba1aee538dfec523e7e089209b43ed074bd9730dd7d13ff3f230b59c64c161ba999b45cf78ab7a109fd3fba4bcee6c41a53fa8f7da24f697f492b521607b2e8767091b23f40b65ec18f13421fbe18b3dee86bcb306ddff4a5980860b615a3845b359833d489ebe9d2ddbe99b2f90c645c2b441a5fb651e39c571c59f015575c4ead8e15ad96198fc7871d9e21dce43c83be35cb0c45bcbcb64848f6c9adc47b5797000cf4a48c3ee50ce4a16ea8ed0ece3f0fa38df79c21f9440be97082d838cac5c6b267effdb601865cfccec8ad4541ba335fc9f2f8ef78a1940cb605bd4ab0f41b87448c0ef8f202198e67b26529b09472a9a7796978036060658c4f835903b4fad934e6315a20007f39baae44e3a390fe6a4208595f9cb7eba78c85dcceebeb4886d8b8175c81f36ad55ef7ff7fb657c3b77d915db9b3b5c18641d01263afd9ec7883b4af2bf47a4474005934c6228a52df02e1e10136a3977899460b0587ec75b60ca8b59224be36238077a961286f585e8f3be21e0687ed1183a923e414b8c49fc63f6fa5de38168103c004a80cc4ac1395f4465bef7577f7fdec01d22cbd6343f65502a2caf3bf0e254e25bc3b44328a96cccaaece6b6a5dee81b7c2f5d3b892d10f28449f4abe8d7694111bc8c916250c45d6d6709d865fe2ee95d4174df9a29dc569edbe3124c0e36c55de960e3e4597d8a6ae0d1ce4a48631d518150f6c23b28c6e5df161519ed73a240d61e7341eaf6f2ca95ecfc056f4fdea780022a166c6bd4bb816ed953a82b573b48c03aefd2aa500aca67e9ccd15a517d5c4ca120be6a8324bda710cec48f21ee1c120fe70ad885d88b64a2545f63d2c4077d17f8bbeef342f7f4f45913cd8267fc32f1d53331097f4c53017fc7fa69342faecbc4fd936dcec1b463228e07a6d4e481f38323215a8deff098a2c88c6b88b189e76db644c4307daf2b787b606afd0ca988893b1d659a84ad3646523c8c270f1c388070472a6ad7c7d052d46fae613fe39fe084932e2c4ababa4bea2cde06fb956eec3cb15d59e5d9e3bb82cd71b29825d18f5e84a821035f727ee7ea7d7bd65a60b32fa14079baae1ce534d7330934714a2fa2b4eae67920d4ad211af62fec328999c0ead152e2fbbcc8f2fa2332c2243727b59cfacb469aafa4b404ff034a8a79af37929ae02bec00cf47f8aded87a3773c985501045ac4ae6993bdc4b1296cbfa3366eee27d992583eff44b20cfd1764bc194084ed0d76af6c2171997126b1bb5f61b4a7d19f8300566f47f26599ace9429e126f090a1dcdc83f8f2de1d283487cbf6d131ad59338d9a85cd9cdb157b6d89cd554d89bb727b50cdb10c27cd304e854c67787e667106e4eccd39fad04a220732f690bd25699e88c67adf0accb2c9c447a8e8c0fcb23ca87ea775ed24557a74b80171c513c58629942eb937e6f5911f5afaed5d03f5055d3c946412f1a82091ffb4b2c607153facd5053626770fa783f953833da2408ac16632bb3bc7e95d95e1d57395cba60bbf6db5864a7a2bf61040c3ad5af59e7bdda7961e9632e6ed22cc2fc7ab1f9374832654a2e3d7d66b2645f3ae11a70dd9bdc36fd9bcf9dada99928388414d598c88dddeb320e282dd027eefc055be6c9579878ade23261a08d0ab2bf7239884fd2b1c0c44eb23bcda7ac22362cb01bec9157607e4af3e16a535544469e7f78e8983c7a20e04bc84f72c78f174ccd8f103b828f430cf56ea9371a5d46c4dae7e6d769b700034d78c9a0b3e1fe2abf367828f0333b9271a04f50bd9e087d7ca86eec56f37228e8bab30dec10b194cb7db4d3c20340f73c07f9942f5a4a33820685a3925ff0555e679af3514a6623f430c3286a7cb2924507517e0b6dc182ee9470f3d9f56927482a6ad18bbb773c133f76e289688ef18a78321de5ac2d3e3522d7cea858f43844c4e19d736c3cb729cdde6c1f666f7ea088ac09674f45b301ef1dffb5d265eace59376d946b7b1b7fd19e8ac3b10fad574650e36c22ba43a00a8b7e5b987bf76cab10d81fa492ea5e395896ca5ead4cf22a7765fdae2691f15f84804e1b12a8b6b285a0c2436c1f31d8b7e7dcee861ef8af8569b34b7d24c37cfc32ad1c0169beb0cd0aecc22fe547db3d551e5b1d9aaf36bb67b223ea08488dfeb8b81d140d15ba1c0fbed1b8dd10b58116492fc123809f924fe241e94d4bf333c1afd3c6bccb41ef4d5aa6e2309a9275d36f65ff9e5a00870e22ba56397a8d195090186d5e5e72a395f99af9d04e125ef8dd50543b6c9fd1b652a2d7c8796ca20f2574fc0c60e38a27cd9481fe7d8577aa97ee992452c7ce0199bf999c297cc7acbd72c8d6ef9b01eb9ea0831fd80a9b3363e18621686333958aeca5d8d6e08c95661b16b74f16a754efa7f7699c87c865f7bc81df25da7d3d9a1c1f43e495818bfc158debc958dcdcc4388f4101cefa61b64cb6e245635c1fc9fac781f4caa044c5c8219447267fad57af51d90b8dd394ab5aff33cb5e3ed7bdac34696e96adef16e3a9cfd57dde678ae94f9b23351e5519366807ef7f0e715404703756f94ebe916a100ceccf1159dffa8eb6dc5c2fb550f2e0bc2a74790aaba06bbd188069de8b70684c1624a03bef20e5166ff3b60983cbaadffeadc3603301177679bdffb4eb50793cf520adbec60337a3462d406413656b39135977b98117c704050328090a8844f78bedba1f4bffe38dcceda532286f040edd40190d595f2372b348fd7429cc09ce4bd335be510129b8174cc216fdf40ca03082348c001de62c8b745670beecf5c6a30778f1aad6d44810c301a1f26b932d747661442c0aeb90301eceb0341c36853b7cd1f18b45154652935463f5d57678da970aebcf11f3f2e3960b2f2c26526bdedc365e7b4f9792a2c62d784dc42f9bf94de3dc16b07a41faa8b56d712bde1fba7520d0b4c023a10f0de12aac178808bb7139c4a45c1e5132d98eddd2515c9e6df87f65ccda86b29855d6883aa80b1883d18c535eda292da36eab6e2798d9bf991bbd8132ecdf282bfbd448e4ac74f9dc887090ffaf50839779eeef38da22377b03a7d260644862967ad6986e0a269ff713fbdddaa1385d1be63d354a95cd638181d513a7523071851240dbc57e08756d1d8a876129caa224b95ce88afa016d83baa90121821b64b2021fed5f5711478d710811b14373fdc5d86fbe14ba4183c87662ffe4af29c49acc523192ba3d9fe86e125bdd301deb27df28bb7f0c8cc68f81ebf992c67a8f79acfc03ecae0678465c1ad17a9b937b2824522a8ddbb0f9f4d629a814a5f17c10f5096cba280d24831794eaca7b41186bb052a6f3cdacd02e3a1e9074f6352ade066e3938d18428fdabcf3c110144f4494645ed6be478e1956239163cae764c62c2c3c5a48f9fc93fa78c1185a224352179b965b2f4b860c9ede14f8a8e662ddfc72f3fe218964dabf40e5273cb2160e200596109d7573dc3984febfebfb7a751d1efc101f474cc1044e10915bec8a92f84c72b2b3ebafd961bdc508b98cd11cf641e6f4ef63414c6fa742b18e9862167db0c2a76a44e9d344791531095d13fea6a0a982d19c91fc3e283bb5f0722dd0d98417bfe9b8889731e2d635d06e83438e9f526b08bacbc48c30eec1778f30604cf1dbaf0e174a97fbf4ec4a84fe3a33f2ac644952108256f551a55b20036229adea63d88f1ad49a154091f2fe0c293abc014487b694686683826eea268e819c1e9359a608a3d630433094b8ca893e6bb77bf93b19a80722e783e4fc7b7ef71f5183034f183af5a3e5f7840d1a944344302a4657c3bfd73d202b286aca9df98076ea402913fb703452b59da2df97ebab6b988940a14efda0f50ebadc627ed5a15fd3f1659dab30ee7cec614f6f4e6f3a503ccabd89f38978606abdb00dc1c648abe54564a702daf186ecdd48f614b1d9c3d737a349d4346b02f246bf549f3ed2527a0552efb7c4aa099f52b0d8f79a7ef4d7306fa0611f6a7fda68f8c28a80dee94d27f20b1f82f77f1c5306f33dca60823bd7c120129021b88d000081b4ca97cafe9daffd7a5d09bd255fe05dbc4d0eeed1038f8c59096b8b3b0e6504ccce973d47c9354082fd6085332b9b41df762c6bdec2249660384c01e0584e61f24bc0b0ea14d6e62947448582052f5b934ff67ff84ea5dffa73272d34943bc13c2afe495a99733280b2baef193277de2d3bd9f75a7ddd41667b4af15686bdb71eec800fba7f47882f5853d4966285c3c74501dd9c2e4a6f9a3f2b674df4cb61a2a086d5e687ea090000184675536696709fb2cbafe376fe1bed9a326c040a0b0c12e1df69f7c528bdb07dfff1b232bacf144bf15e9a149a3c88d8f82a20ae9d639a82bb6799e45b404a712834e31285a3978720d04207655c6bf2aeb1cde19f6544481154d3420619e5d49acdbe195da5b3614874717f3c9f668b21e8eb40628b9d16930690ed3804f04b4e5170dec388104d368fa2c1f00c4779a17404a31a823fb32e378dc03be1082430ee3add3cac363e6d153366f768704ca63add2522bdbcfde0d3c0cdb0a4849867bf279237ea76e70f9dd240179af7364d4df358f65fb95a7d50f086711796ce8b860f4146f58a93fc08e598ff8f423fd7b992ee04bae69684d0eb4675553e2522eb5b1f6fa4e6e0b12c4e5ba9d04d30437ee02df49ff1069d1bc8f7626e50405fd01ee3a1f6a77e8a68aaa914166eb57caade14a19070641ff2c427bfdb1af5b559698ffd0c9deacf862513e7d4c8aadbd5f4f0d44bfc437c6644e91a404de2df7c0ac3f6513f081f58f81d164a74f8d6e18d02a88c8815eb4dc76126f139702a8499c447fcfa81fdc366314e477f6015a74a43695467099a5e81bdd18303c695f47af7d0e4e2c1fef5f8ade2cc02c0a130eebc820743f12cfac520d144722d62062b3ae16fccabcee4535d26ca001fd366242c5f0681a42ed8c312d3150b8c7978d945287c7c15394f7596f6a96398bed3d4714382b64b8e00efcbb236d3d7b1ece8ee7144b1568ed376bb30f87c6b59c7171c4b8aa3303b4a9f70ec5c9b2c5975f6be4b3079f8511ae91a6dedb94196d68dd6028e76b728f9a022c86c7a334bef30a1ebe6924e004e4d33b1ff068243aa14db329d9373c157602e23f7fd1f203f4c9b6173feb7e36fdd3304f7ea704ee38615c009431e62172e20dac6c864fa991447d1bcd879647552619dbfca31aa4b333727d28fb5f987b7c18188c897a508b9cfe6f0eb87d9dc55f70a3d75a27863e61a5d252d0416c2380eb7c8a0ad9e6f5a3c6235688c75ae79f1b047dfa4164d468db67e865fb25fd19b6227054e614444f7b47f53b823d19ac31f1a9ead007e1bf3d7683f9a4cb71fb1780edd9486e9a1112d79c12360b177d72422737a029f120bac3e42a22a5fa1275fc590e42a81595f06c271b2ce0d9ab71be392e87a4ccefd1df48ae74951916a21f4ac34d7a627c4db8d2262b00e82afb21a9c41fceecd456cc28d271eeb84c288f024296d9eb98470198e44900fa30a0e6138308e005d312b627a8bc3bc674fa155483a506dd7280c7787cd771cb03247497c351fc8adc5d84220e87c289d124ca8b57f9b03db2043c5bd5f3c2eabaf964a33a47d99f99e0bd34457fe1ec570374820552e8327dc7b9c3d4c5d1eef5e593cb1879f1b71f2c8ea4b53ca4d0f90f2f9c7fa28b0118e8ab100742328911fe2d1972af5bb97ae4c2b78ee16b58f7c4612d124918b75fce8ca2a2e904564f27d8acf8ed565a63318617aee2e25d2592b965fe5703dd9f37b68ea01868dacc7f16fd5644a4ebdb8658866a08b91206dcc17600c515391f7698a19b426cef89813959d6b08bc276b5791d8a0739fda44e685f25e3ed5cd3e9a1e190bfa85a6b5bb055b7df084ab050f2349b98f3f809f66999d81a684ce9871955adba6bcc6c52d5aa6ef00de33d9a6732eb0c7274f889eb18cc824507a89ac7a902126b95c5f01432af929bfef0dcdd7398ea6ac5cdfa7835953e3ba355b020a9b37c7db41ca6811c87f48a498f7e5beaaaf638b3fca2511a1ac10b36343bf9163bfd91cae9d50bd3b62455be739611a670a0bdaea12a8ab793c23bf8b8eaf27b342ca7cac89b9cbc559888795d32215ce30f0d8542ccb2e385dee2fa2087880ede09c981792a0fb4a6632c6bb907201b89c6158191efef6ae46b88f367227b9409a7216544f785ab4608a7d57695fa924667b36707096e12a1444b9cd44d518b53951fb76fe7759f004fd40e1697cdcb0435babbd068b5bf9760f49d3b1c780d607c719e69c73097217de6571dc9cfc8ca43d3816f8c9d98f7e9538a30f66c8e5eecf49d6f1a33b0379a6f195d74c2991af1cab7be54f357c9887d3346f274c2bd98e59b65b40dfb3e76430fb50bd8c965ee42f1af32fb05c18dd2fcc956f7d7c21bc23bd7703a156b174be794b95d089dfe8762efb46063cc676208c3aff1e69a338b77a806cdc5ff6d62d4d9751e38fa1618fece3d1da20e3dcb054117f5f622b4fe026bd698ca5c77960227ae2b3d4a83d9c390a9c68e56316445546418275ebb50277fbe08621a3f2503d729d90a7575ff182aa62598f55ec007a302379d7c4bbe038edfb567fff89faece5a64006d35f34549294c74f7032c7446cd256ee46c10873ae6650b033c4bd02394a2e215198e777b2b3e315d36b606ceb66b6b0a36325d02a9e6734982abc93faa13f79598e999ebd879599325f74302ff565359c34c36136faaaa36d1d32e8438270f5ab091ee91ce4ee516a6c22d96cf618683d1bbae4484dc69f6cf710f963089e2e3348fbac5c3880698b11ef4825b62601a09944c5303e70ff6676552e4a02389d004f85871203b62033a10b785f91ed1b477cb35a54f5aa49798865a849c019fec5a68fba5bcf0b38b67aecb3d21c4673adc4ec2989c7c7cb2acf0d7db650b89c81b69f1520a769b255538ddedcaa50e361c3fc8b3c7627b317dd81e39c45f1bad89d000cf41c33b46e2f3bf355668430936b76d6f58ddf3d7236fe67b67e9ae35faeda1762a514a778c2fb3f29f28ac89377fd36f01d7853a050b2d9bc849b1d3be9d3a6671bb88b8941f7f169135678db550598060787aa867340edacfcb5a89147e1c9ec82e420b2b6f0e4afc45878ccc4ffbb5c2666f63fdfee0f766972bc957522b3be21dd3524959a20603bee8ced8d1ffd5f973c0a107ca7c6945f57d52e5c152a0465bb097749bab455963e022b59f", 0x2000, &(0x7f000000b1c0)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f000000a740)={0x90, 0x0, 0x3, {0x2, 0x1, 0x8000000000000001, 0x7, 0x9, 0x1, {0x0, 0x7, 0x7, 0xffffffffffffffff, 0x8, 0x8, 0x6, 0xdd, 0x200, 0x8000, 0x6, r4, 0x0, 0x4, 0x6}}}, 0x0, 0x0, 0x0, 0x0, 0x0}) executing program 0: r0 = socket$inet6(0xa, 0x2, 0x0) bind$inet6(r0, &(0x7f0000f5dfe4)={0xa, 0x4e20, 0x1, @empty, 0x8}, 0x1c) sendto$inet6(r0, 0x0, 0x0, 0x2409c8c1, &(0x7f0000000240)={0xa, 0x4e20, 0x6, @mcast1}, 0x1c) writev(r0, &(0x7f0000000580)=[{&(0x7f0000000c80)='x', 0x1}], 0x1) r1 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000040), 0x8d40, 0x0) ioctl$TIOCPKT(r1, 0x5420, &(0x7f0000000180)=0x7) ioctl$TCSETS(r1, 0x40045431, &(0x7f0000000100)={0x0, 0x8, 0x0, 0x3, 0x7, "00fa9a7d8200010000001495595915303d6000"}) r2 = syz_open_pts(r1, 0x0) pselect6(0x40, &(0x7f0000000280)={0x0, 0xf, 0x1000, 0x0, 0x801, 0x100}, 0x0, &(0x7f0000000300)={0x1f, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x1, 0x3}, 0x0, 0x0) ioctl$TIOCSETD(r2, 0x5423, &(0x7f0000000000)=0x2) executing program 0: socket$nl_generic(0x10, 0x3, 0x10) socket$inet(0x2, 0x2, 0x1) socket$nl_netfilter(0x10, 0x3, 0xc) socket$nl_xfrm(0x10, 0x3, 0x6) socket(0x10, 0x803, 0x0) mmap$IORING_OFF_SQ_RING(0x0, 0x8000002, 0x2000007, 0x401d031, 0xffffffffffffffff, 0x0) sendmsg$inet(0xffffffffffffffff, &(0x7f0000001b00)={0x0, 0x0, 0x0, 0x0, &(0x7f0000001d80)=ANY=[@ANYBLOB="28010000000000000100000001"], 0x128}, 0x4004000) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}) sendmsg$inet(r1, &(0x7f0000001b00)={0x0, 0x0, 0x0, 0x0, &(0x7f0000001d80)=ANY=[], 0x128}, 0x0) recvmsg$unix(r0, &(0x7f0000000000)={0x0, 0x0, 0x0, 0x0, &(0x7f00000006c0)=[@cred={{0x1c}}, @rights={{0x34, 0x1, 0x1, [0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff]}}, @rights={{0x10}}, @rights={{0x10}}, @rights={{0x10}}, @rights={{0x10}}], 0x98}, 0x80) pipe2(0x0, 0x0) syz_ublk_add_dev(0xffffffffffffffff, 0x0, 0x0, 0x0, &(0x7f0000000200)={0x2e, 0x0, 0x0, 0xffffffffffffffff, 0xc0207504, 0x0, 0x0, 0x0, 0x0, 0x7, 0x0, 0x0, '\x00', {0xffffffff, 0xffff, 0x40, &(0x7f00000001c0)=@any_dev={0x4, 0x3f7, 0x0, 0x0, 0x1000, 0xe, 0x0, 0x0, 0x10}}}, &(0x7f0000000300)=0x0) r5 = socket$inet6_tcp(0xa, 0x1, 0x0) r6 = dup(r5) syz_ublk_setup_queues(r6, r4, &(0x7f0000000040)={0x0, 0xc1, 0x10, 0xfffffffd, 0x7f}, &(0x7f0000000a80)=[{0x0, 0x0, 0xffffffffffffffff, {0x0, 0x3, 0x42, 0x3, 0x91, 0x0, r2}}, {0x0, 0x0, 0xffffffffffffffff, {0x0, 0xc81d, 0x2, 0x1, 0x3aa}}, {0x0, 0x0, 0xffffffffffffffff, {0x0, 0x93ea, 0x2000, 0x4003bfff, 0x2b9, 0x0, r3}}, {0x0, 0x0, 0xffffffffffffffff, {0x0, 0x626d, 0x800, 0x1, 0x26d}}], 0x1, 0x0, 0x0) executing program 0: r0 = add_key$keyring(&(0x7f0000000000), &(0x7f0000000040)={'syz', 0x2}, 0x0, 0x0, 0xfffffffffffffffe) r1 = add_key$keyring(&(0x7f0000000680), &(0x7f0000000000)={'syz', 0x1}, 0x0, 0x0, 0xffffffffffffffff) add_key$fscrypt_v1(&(0x7f0000000540), &(0x7f0000000180)={'fscrypt:', @auto=[0x61, 0x62, 0x35, 0x39, 0x30, 0x64, 0x37, 0x66, 0x32, 0x61, 0x30, 0x37, 0x30, 0x64, 0x0, 0x65]}, &(0x7f0000000100)={0x0, "00112233445566778899aabbccddeeff00112233445567778999aabbccddeeff00112233445566778899aabbccddeeff00112233445566778899aabbccddeeff", 0x1d}, 0x48, r1) add_key$fscrypt_v1(&(0x7f00000009c0), &(0x7f0000000a00)={'fscrypt:', @auto=[0x31, 0xe, 0x63, 0x38, 0x31, 0x38, 0x61, 0x64, 0x63, 0x30, 0x65, 0x30, 0x36, 0x31, 0x32, 0x36]}, &(0x7f0000000a40)={0x0, "2628ef6169ce0c23300aad3bd8276bfa5a76274e6d287faf262c30f0f01f01afdf7dd0c90abeed83d9b7ae21c1731df54db18c7f4736fb3ba12abb31f88487a5", 0x29}, 0x48, r1) add_key$fscrypt_v1(&(0x7f0000000080), &(0x7f00000001c0)={'fscrypt:', @auto=[0x33, 0x30, 0x30, 0x30, 0x30, 0x30, 0x30, 0x36, 0x30, 0x30, 0x30, 0x30, 0x30, 0x30, 0x30, 0x33]}, &(0x7f0000000100)={0x0, "00112233445566778899aabbccddeeff0011223344556677880502d2b9ddff7f00112233445566778899aabbccd3ceff001122aabbccddeeff00", 0x26}, 0x48, r1) add_key$fscrypt_v1(&(0x7f0000000080), &(0x7f0000000200)={'fscrypt:', @auto=[0x30, 0x30, 0x30, 0x30, 0x30, 0x30, 0x30, 0x30, 0x30, 0x30, 0x30, 0x30, 0x30, 0x30, 0x30, 0x34]}, &(0x7f0000000100)={0x0, "00112233445566778899aabbccddeeff00112233445566778899aabbccddeeff00112233445566778899aabbccddeeff00112233445566778899aabbccddeeff", 0x40}, 0x48, r1) add_key$fscrypt_v1(&(0x7f0000000080), &(0x7f0000000240)={'fscrypt:', @auto=[0x30, 0x30, 0x30, 0x65, 0x30, 0x30, 0x30, 0x30, 0x30, 0x30, 0x35, 0x30, 0x0, 0x30, 0x30, 0x35]}, &(0x7f0000000100)={0x0, "00112233445566778899aabbccddeeff00112233445566778899aabbccddeeff00112233445566778899aabbccddeeff00112233445566778899aabbccddeeff", 0x40}, 0x48, r1) add_key$fscrypt_v1(&(0x7f0000000440), &(0x7f0000000280)={'fscrypt:', @auto=[0x30, 0x30, 0x30, 0x30, 0x30, 0x30, 0x30, 0x30, 0x30, 0x30, 0x30, 0x62, 0x30, 0x30, 0x30, 0x36]}, &(0x7f0000000100)={0x0, "00112233445566778899aabbccddeeff00112233445566778899aabbccddeeff00112233445566778899aabbccddeeff00112233445566778899aabbccddeeff", 0x15}, 0x48, r1) add_key$fscrypt_v1(&(0x7f0000000080), &(0x7f00000002c0)={'fscrypt:', @auto=[0x30, 0x30, 0x30, 0x30, 0x30, 0x30, 0x30, 0x30, 0x30, 0x37, 0x30, 0x30, 0x30, 0x30, 0x30, 0x37]}, &(0x7f0000000100)={0x0, "00112233445566778899aabbccddeeff00112233445566778899aabbccddeeff00112233445566778899aabbccddeeff00112233445566778899aabbccddeeff", 0x40}, 0x48, r1) add_key$fscrypt_v1(&(0x7f0000000080), &(0x7f0000000300)={'fscrypt:', @auto=[0x30, 0x39, 0x64, 0x30, 0x30, 0x62, 0x30, 0x38, 0x30, 0x30, 0x39, 0x30, 0x30, 0x30, 0x51, 0x33]}, 0x0, 0x0, r1) add_key$fscrypt_v1(&(0x7f0000000080), &(0x7f0000000340)={'fscrypt:', @auto=[0x6, 0x63, 0x66, 0x30, 0x30, 0x63, 0x31, 0x33, 0x0, 0x30, 0x38, 0x35, 0x35, 0x35, 0x62, 0x32]}, &(0x7f0000000100)={0x0, "00112233445566778899aabbccddeeff00112233445566778899aabbccddeeff00112233445566778899aabbccddeeff00112233445566778899aabbccddeeff", 0x40}, 0x48, r1) add_key$fscrypt_v1(&(0x7f0000000080), &(0x7f0000000380)={'fscrypt:', @desc3}, &(0x7f0000000100)={0x0, "00112233445566778899aabbccddeeff00112233445566778899aabbccddeeff00112233445566778899aabbccddeeff00112233445566778899aabbccddeeff", 0x40}, 0x48, r1) add_key$keyring(&(0x7f0000000700), &(0x7f0000000740)={'syz', 0x0}, 0x0, 0x0, r1) add_key$fscrypt_v1(&(0x7f0000000080), &(0x7f00000003c0)={'fscrypt:', @auto=[0x30, 0x30, 0x30, 0x30, 0x30, 0x30, 0x30, 0x30, 0x30, 0x39, 0x30, 0x30, 0x33, 0x30, 0x30, 0x62]}, &(0x7f0000000100)={0x0, "00112233445566778899aabbccddeeff00112233445566778899aabbccddeeff00112233445566778899aabbccddeeff00112233445566778899aabbccddeeff", 0x40}, 0x48, r1) add_key$fscrypt_v1(&(0x7f00000000c0), &(0x7f0000000600)={'fscrypt:', @desc2}, &(0x7f0000000780)={0x0, "42b6f79eb265b5824e857af864c58803d13c052f671a2ae1f76bf1da5cc727376ed546011b61539773c15f7e54ddbb21d67e1662214422745234909a6d75d284", 0x36}, 0x48, r1) add_key$keyring(&(0x7f0000000640), &(0x7f00000006c0)={'syz', 0x2}, 0x0, 0x0, r1) add_key$keyring(&(0x7f0000000940), &(0x7f0000000480)={'syz', 0x3}, 0x0, 0x0, r1) add_key$fscrypt_v1(&(0x7f0000000080), &(0x7f00000004c0)={'fscrypt:', @auto=[0x66, 0x37, 0x30, 0x39, 0x36, 0x38, 0x37, 0x65, 0x39, 0x37, 0x33, 0x65, 0x63, 0x38, 0x32, 0x65]}, &(0x7f0000000100)={0x0, "00112233445566778899aabbccddeeff00112233445566778899aabbccddeeff00112233445566778899aabbccddeeff00112233445566778899aabbccddeeff", 0x23}, 0x48, r1) add_key$fscrypt_v1(&(0x7f0000000800), &(0x7f0000000500)={'fscrypt:', @auto=[0x30, 0x65, 0x66, 0x30, 0x30, 0x61, 0x38, 0x30, 0x30, 0x34, 0x30, 0x30, 0x30, 0x30, 0x31, 0x30]}, &(0x7f0000000100)={0x0, "00112233445566778899aabbccddeeff99aabbccddeeff00112233445566778899aabbccddeeff00112233445566778899aabbccddeeff00", 0x40}, 0x48, r1) keyctl$unlink(0x9, r0, r1) executing program 0: r0 = syz_usb_connect$printer(0x0, 0x36, &(0x7f0000000000)=ANY=[@ANYBLOB="1201000000030020f003176c400000000001090224725100000000090400001207010300090501020000000000090582020002"], 0x0) syz_usb_disconnect(r0) r1 = syz_usb_connect(0x0, 0x24, &(0x7f0000000040)=ANY=[], 0x0) syz_usb_control_io$hid(r1, 0x0, 0x0) syz_usb_disconnect(0xffffffffffffffff) r2 = syz_open_dev$char_usb(0xc, 0xb4, 0x0) read$char_usb(r2, 0x0, 0x0) syz_usb_disconnect(r1) syz_usb_connect$hid(0x6, 0x0, 0x0, 0x0) syz_usb_connect(0x3, 0x24, &(0x7f0000001680)={{0x12, 0x1, 0x300, 0xe2, 0x24, 0x2c, 0x8, 0x41e, 0x401d, 0x295c, 0x1, 0x2, 0x3, 0x1, [{{0x9, 0x2, 0x12, 0x1, 0x7, 0x7, 0x0, 0x9, "", [{{0x9, 0x4, 0xab, 0x3, 0x0, 0x96, 0xe2, 0x4d}}]}}]}}, &(0x7f0000002040)={0x0, 0x0, 0x0, 0x0, 0x59}) executing program 0: r0 = add_key$keyring(&(0x7f0000000000), &(0x7f0000000040)={'syz', 0x2}, 0x0, 0x0, 0xfffffffffffffffe) r1 = add_key$keyring(&(0x7f0000000680), &(0x7f0000000000)={'syz', 0x1}, 0x0, 0x0, 0xffffffffffffffff) add_key$fscrypt_v1(&(0x7f0000000540), &(0x7f0000000180)={'fscrypt:', @auto=[0x61, 0x62, 0x35, 0x39, 0x30, 0x64, 0x37, 0x66, 0x32, 0x61, 0x30, 0x37, 0x30, 0x64, 0x0, 0x65]}, &(0x7f0000000100)={0x0, "00112233445566778899aabbccddeeff00112233445567778999aabbccddeeff00112233445566778899aabbccddeeff00112233445566778899aabbccddeeff", 0x1d}, 0x48, r1) add_key$fscrypt_v1(&(0x7f00000009c0), &(0x7f0000000a00)={'fscrypt:', @auto=[0x31, 0xe, 0x63, 0x38, 0x31, 0x38, 0x61, 0x64, 0x63, 0x30, 0x65, 0x30, 0x36, 0x31, 0x32, 0x36]}, &(0x7f0000000a40)={0x0, "2628ef6169ce0c23300aad3bd8276bfa5a76274e6d287faf262c30f0f01f01afdf7dd0c90abeed83d9b7ae21c1731df54db18c7f4736fb3ba12abb31f88487a5", 0x29}, 0x48, r1) add_key$fscrypt_v1(&(0x7f0000000080), &(0x7f00000001c0)={'fscrypt:', @auto=[0x33, 0x30, 0x30, 0x30, 0x30, 0x30, 0x30, 0x36, 0x30, 0x30, 0x30, 0x30, 0x30, 0x30, 0x30, 0x33]}, &(0x7f0000000100)={0x0, "00112233445566778899aabbccddeeff0011223344556677880502d2b9ddff7f00112233445566778899aabbccd3ceff001122aabbccddeeff00", 0x26}, 0x48, r1) add_key$fscrypt_v1(&(0x7f0000000080), &(0x7f0000000200)={'fscrypt:', @auto=[0x30, 0x30, 0x30, 0x30, 0x30, 0x30, 0x30, 0x30, 0x30, 0x30, 0x30, 0x30, 0x30, 0x30, 0x30, 0x34]}, &(0x7f0000000100)={0x0, "00112233445566778899aabbccddeeff00112233445566778899aabbccddeeff00112233445566778899aabbccddeeff00112233445566778899aabbccddeeff", 0x40}, 0x48, r1) add_key$fscrypt_v1(&(0x7f0000000080), &(0x7f0000000240)={'fscrypt:', @auto=[0x30, 0x30, 0x30, 0x65, 0x30, 0x30, 0x30, 0x30, 0x30, 0x30, 0x35, 0x30, 0x0, 0x30, 0x30, 0x35]}, &(0x7f0000000100)={0x0, "00112233445566778899aabbccddeeff00112233445566778899aabbccddeeff00112233445566778899aabbccddeeff00112233445566778899aabbccddeeff", 0x40}, 0x48, r1) add_key$fscrypt_v1(&(0x7f0000000440), &(0x7f0000000280)={'fscrypt:', @auto=[0x30, 0x30, 0x30, 0x30, 0x30, 0x30, 0x30, 0x30, 0x30, 0x30, 0x30, 0x62, 0x30, 0x30, 0x30, 0x36]}, &(0x7f0000000100)={0x0, "00112233445566778899aabbccddeeff00112233445566778899aabbccddeeff00112233445566778899aabbccddeeff00112233445566778899aabbccddeeff", 0x15}, 0x48, r1) add_key$fscrypt_v1(&(0x7f0000000080), &(0x7f00000002c0)={'fscrypt:', @auto=[0x30, 0x30, 0x30, 0x30, 0x30, 0x30, 0x30, 0x30, 0x30, 0x37, 0x30, 0x30, 0x30, 0x30, 0x30, 0x37]}, &(0x7f0000000100)={0x0, "00112233445566778899aabbccddeeff00112233445566778899aabbccddeeff00112233445566778899aabbccddeeff00112233445566778899aabbccddeeff", 0x40}, 0x48, r1) add_key$fscrypt_v1(&(0x7f0000000080), &(0x7f0000000300)={'fscrypt:', @auto=[0x30, 0x39, 0x64, 0x30, 0x30, 0x62, 0x30, 0x38, 0x30, 0x30, 0x39, 0x30, 0x30, 0x30, 0x51, 0x33]}, &(0x7f0000000100)={0x0, "00112233445566778899aabbccddeeff00112233445566778899aabbccddeeff00112233445566778899aabbccddeeff00112233445566778899aa91ccddeeff", 0x40}, 0x48, r1) add_key$fscrypt_v1(0x0, &(0x7f0000000340)={'fscrypt:', @auto=[0x6, 0x63, 0x66, 0x30, 0x30, 0x63, 0x31, 0x33, 0x0, 0x30, 0x38, 0x35, 0x35, 0x35, 0x62, 0x32]}, &(0x7f0000000100)={0x0, "00112233445566778899aabbccddeeff00112233445566778899aabbccddeeff00112233445566778899aabbccddeeff00112233445566778899aabbccddeeff", 0x40}, 0x48, r1) add_key$fscrypt_v1(&(0x7f0000000080), &(0x7f0000000380)={'fscrypt:', @desc3}, &(0x7f0000000100)={0x0, "00112233445566778899aabbccddeeff00112233445566778899aabbccddeeff00112233445566778899aabbccddeeff00112233445566778899aabbccddeeff", 0x40}, 0x48, r1) add_key$keyring(&(0x7f0000000700), &(0x7f0000000740)={'syz', 0x0}, 0x0, 0x0, r1) add_key$fscrypt_v1(&(0x7f0000000080), &(0x7f00000003c0)={'fscrypt:', @auto=[0x30, 0x30, 0x30, 0x30, 0x30, 0x30, 0x30, 0x30, 0x30, 0x39, 0x30, 0x30, 0x33, 0x30, 0x30, 0x62]}, &(0x7f0000000100)={0x0, "00112233445566778899aabbccddeeff00112233445566778899aabbccddeeff00112233445566778899aabbccddeeff00112233445566778899aabbccddeeff", 0x40}, 0x48, r1) add_key$fscrypt_v1(&(0x7f00000000c0), &(0x7f0000000600)={'fscrypt:', @desc2}, &(0x7f0000000780)={0x0, "42b6f79eb265b5824e857af864c58803d13c052f671a2ae1f76bf1da5cc727376ed546011b61539773c15f7e54ddbb21d67e1662214422745234909a6d75d284", 0x36}, 0x48, r1) add_key$keyring(&(0x7f0000000640), &(0x7f00000006c0)={'syz', 0x2}, 0x0, 0x0, r1) add_key$keyring(&(0x7f0000000940), &(0x7f0000000480)={'syz', 0x3}, 0x0, 0x0, r1) add_key$fscrypt_v1(&(0x7f0000000080), &(0x7f00000004c0)={'fscrypt:', @auto=[0x66, 0x37, 0x30, 0x39, 0x36, 0x38, 0x37, 0x65, 0x39, 0x37, 0x33, 0x65, 0x63, 0x38, 0x32, 0x65]}, &(0x7f0000000100)={0x0, "00112233445566778899aabbccddeeff00112233445566778899aabbccddeeff00112233445566778899aabbccddeeff00112233445566778899aabbccddeeff", 0x23}, 0x48, r1) add_key$fscrypt_v1(&(0x7f0000000800), &(0x7f0000000500)={'fscrypt:', @auto=[0x30, 0x65, 0x66, 0x30, 0x30, 0x61, 0x38, 0x30, 0x30, 0x34, 0x30, 0x30, 0x30, 0x30, 0x31, 0x30]}, &(0x7f0000000100)={0x0, "00112233445566778899aabbccddeeff99aabbccddeeff00112233445566778899aabbccddeeff00112233445566778899aabbccddeeff00", 0x40}, 0x48, r1) keyctl$unlink(0x9, r0, r1) executing program 32: r0 = add_key$keyring(&(0x7f0000000000), &(0x7f0000000040)={'syz', 0x2}, 0x0, 0x0, 0xfffffffffffffffe) r1 = add_key$keyring(&(0x7f0000000680), &(0x7f0000000000)={'syz', 0x1}, 0x0, 0x0, 0xffffffffffffffff) add_key$fscrypt_v1(&(0x7f0000000540), &(0x7f0000000180)={'fscrypt:', @auto=[0x61, 0x62, 0x35, 0x39, 0x30, 0x64, 0x37, 0x66, 0x32, 0x61, 0x30, 0x37, 0x30, 0x64, 0x0, 0x65]}, &(0x7f0000000100)={0x0, "00112233445566778899aabbccddeeff00112233445567778999aabbccddeeff00112233445566778899aabbccddeeff00112233445566778899aabbccddeeff", 0x1d}, 0x48, r1) add_key$fscrypt_v1(&(0x7f00000009c0), &(0x7f0000000a00)={'fscrypt:', @auto=[0x31, 0xe, 0x63, 0x38, 0x31, 0x38, 0x61, 0x64, 0x63, 0x30, 0x65, 0x30, 0x36, 0x31, 0x32, 0x36]}, &(0x7f0000000a40)={0x0, "2628ef6169ce0c23300aad3bd8276bfa5a76274e6d287faf262c30f0f01f01afdf7dd0c90abeed83d9b7ae21c1731df54db18c7f4736fb3ba12abb31f88487a5", 0x29}, 0x48, r1) add_key$fscrypt_v1(&(0x7f0000000080), &(0x7f00000001c0)={'fscrypt:', @auto=[0x33, 0x30, 0x30, 0x30, 0x30, 0x30, 0x30, 0x36, 0x30, 0x30, 0x30, 0x30, 0x30, 0x30, 0x30, 0x33]}, &(0x7f0000000100)={0x0, "00112233445566778899aabbccddeeff0011223344556677880502d2b9ddff7f00112233445566778899aabbccd3ceff001122aabbccddeeff00", 0x26}, 0x48, r1) add_key$fscrypt_v1(&(0x7f0000000080), &(0x7f0000000200)={'fscrypt:', @auto=[0x30, 0x30, 0x30, 0x30, 0x30, 0x30, 0x30, 0x30, 0x30, 0x30, 0x30, 0x30, 0x30, 0x30, 0x30, 0x34]}, &(0x7f0000000100)={0x0, "00112233445566778899aabbccddeeff00112233445566778899aabbccddeeff00112233445566778899aabbccddeeff00112233445566778899aabbccddeeff", 0x40}, 0x48, r1) add_key$fscrypt_v1(&(0x7f0000000080), &(0x7f0000000240)={'fscrypt:', @auto=[0x30, 0x30, 0x30, 0x65, 0x30, 0x30, 0x30, 0x30, 0x30, 0x30, 0x35, 0x30, 0x0, 0x30, 0x30, 0x35]}, &(0x7f0000000100)={0x0, "00112233445566778899aabbccddeeff00112233445566778899aabbccddeeff00112233445566778899aabbccddeeff00112233445566778899aabbccddeeff", 0x40}, 0x48, r1) add_key$fscrypt_v1(&(0x7f0000000440), &(0x7f0000000280)={'fscrypt:', @auto=[0x30, 0x30, 0x30, 0x30, 0x30, 0x30, 0x30, 0x30, 0x30, 0x30, 0x30, 0x62, 0x30, 0x30, 0x30, 0x36]}, &(0x7f0000000100)={0x0, "00112233445566778899aabbccddeeff00112233445566778899aabbccddeeff00112233445566778899aabbccddeeff00112233445566778899aabbccddeeff", 0x15}, 0x48, r1) add_key$fscrypt_v1(&(0x7f0000000080), &(0x7f00000002c0)={'fscrypt:', @auto=[0x30, 0x30, 0x30, 0x30, 0x30, 0x30, 0x30, 0x30, 0x30, 0x37, 0x30, 0x30, 0x30, 0x30, 0x30, 0x37]}, &(0x7f0000000100)={0x0, "00112233445566778899aabbccddeeff00112233445566778899aabbccddeeff00112233445566778899aabbccddeeff00112233445566778899aabbccddeeff", 0x40}, 0x48, r1) add_key$fscrypt_v1(&(0x7f0000000080), &(0x7f0000000300)={'fscrypt:', @auto=[0x30, 0x39, 0x64, 0x30, 0x30, 0x62, 0x30, 0x38, 0x30, 0x30, 0x39, 0x30, 0x30, 0x30, 0x51, 0x33]}, &(0x7f0000000100)={0x0, "00112233445566778899aabbccddeeff00112233445566778899aabbccddeeff00112233445566778899aabbccddeeff00112233445566778899aa91ccddeeff", 0x40}, 0x48, r1) add_key$fscrypt_v1(0x0, &(0x7f0000000340)={'fscrypt:', @auto=[0x6, 0x63, 0x66, 0x30, 0x30, 0x63, 0x31, 0x33, 0x0, 0x30, 0x38, 0x35, 0x35, 0x35, 0x62, 0x32]}, &(0x7f0000000100)={0x0, "00112233445566778899aabbccddeeff00112233445566778899aabbccddeeff00112233445566778899aabbccddeeff00112233445566778899aabbccddeeff", 0x40}, 0x48, r1) add_key$fscrypt_v1(&(0x7f0000000080), &(0x7f0000000380)={'fscrypt:', @desc3}, &(0x7f0000000100)={0x0, "00112233445566778899aabbccddeeff00112233445566778899aabbccddeeff00112233445566778899aabbccddeeff00112233445566778899aabbccddeeff", 0x40}, 0x48, r1) add_key$keyring(&(0x7f0000000700), &(0x7f0000000740)={'syz', 0x0}, 0x0, 0x0, r1) add_key$fscrypt_v1(&(0x7f0000000080), &(0x7f00000003c0)={'fscrypt:', @auto=[0x30, 0x30, 0x30, 0x30, 0x30, 0x30, 0x30, 0x30, 0x30, 0x39, 0x30, 0x30, 0x33, 0x30, 0x30, 0x62]}, &(0x7f0000000100)={0x0, "00112233445566778899aabbccddeeff00112233445566778899aabbccddeeff00112233445566778899aabbccddeeff00112233445566778899aabbccddeeff", 0x40}, 0x48, r1) add_key$fscrypt_v1(&(0x7f00000000c0), &(0x7f0000000600)={'fscrypt:', @desc2}, &(0x7f0000000780)={0x0, "42b6f79eb265b5824e857af864c58803d13c052f671a2ae1f76bf1da5cc727376ed546011b61539773c15f7e54ddbb21d67e1662214422745234909a6d75d284", 0x36}, 0x48, r1) add_key$keyring(&(0x7f0000000640), &(0x7f00000006c0)={'syz', 0x2}, 0x0, 0x0, r1) add_key$keyring(&(0x7f0000000940), &(0x7f0000000480)={'syz', 0x3}, 0x0, 0x0, r1) add_key$fscrypt_v1(&(0x7f0000000080), &(0x7f00000004c0)={'fscrypt:', @auto=[0x66, 0x37, 0x30, 0x39, 0x36, 0x38, 0x37, 0x65, 0x39, 0x37, 0x33, 0x65, 0x63, 0x38, 0x32, 0x65]}, &(0x7f0000000100)={0x0, "00112233445566778899aabbccddeeff00112233445566778899aabbccddeeff00112233445566778899aabbccddeeff00112233445566778899aabbccddeeff", 0x23}, 0x48, r1) add_key$fscrypt_v1(&(0x7f0000000800), &(0x7f0000000500)={'fscrypt:', @auto=[0x30, 0x65, 0x66, 0x30, 0x30, 0x61, 0x38, 0x30, 0x30, 0x34, 0x30, 0x30, 0x30, 0x30, 0x31, 0x30]}, &(0x7f0000000100)={0x0, "00112233445566778899aabbccddeeff99aabbccddeeff00112233445566778899aabbccddeeff00112233445566778899aabbccddeeff00", 0x40}, 0x48, r1) keyctl$unlink(0x9, r0, r1) executing program 2: mmap$IORING_OFF_SQ_RING(0x0, 0xc00000, 0x4000002, 0x14032, 0xffffffffffffffff, 0x0) syz_ublk_add_dev(0xffffffffffffffff, 0x0, 0x0, 0x0, &(0x7f0000000200)={0x2e, 0x0, 0x0, 0xffffffffffffffff, 0xc0207504, 0x0, 0x0, 0x0, 0x0, 0x4, 0x0, 0x0, '\x00', {0xffffffff, 0xffff, 0x40, &(0x7f0000000440)=@new_dev={0x4, 0x3c9, 0x0, 0x0, 0x1000, 0xffffffff, 0x0, 0x0, 0x40}}}, &(0x7f0000000300)=0x0) r1 = socket$inet6_tcp(0xa, 0x1, 0x0) r2 = dup(r1) syz_ublk_setup_queues(r2, r0, &(0x7f0000000180)={0x0, 0x1e99, 0x0, 0x7ffffffe, 0x257, 0x0, r2}, 0x0, 0x1, &(0x7f0000000340)={0x2e, 0x44, 0x0, 0xffffffffffffffff, 0xc0107520, 0x0, 0x0, 0x4000000, 0x0, {}, 0x0, 0x0, '\x00', {0xfff9, 0xa46, 0x0, 0x0}}, 0x0) ioctl$KVM_TDX_INIT_VM(0xffffffffffffffff, 0xc008aeba, &(0x7f0000000440)={0x1, 0x0, &(0x7f0000000200)=ANY=[@ANYBLOB="2000000000000000000000000000000007000000000000008f00000000800000060000000000000005000000000000003107000000000000020000000000000040000000000000000200000000000000724c000000000000020000000000000008000000000000000400000000000000060000000000000004000000000000000100000000000000ffffff7fffffffff4f000000000000006b000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000400000000000000010000008e2500000400000003000000020000005d5c0000070000000000000000000000000000000000004094040000070000001f0000000300000009000000a20000000000000000000000000000000d0000000000000001000000ffff000027"]}) executing program 2: socket$nl_generic(0x10, 0x3, 0x10) (async) r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000040), 0xffffffffffffffff) sendmsg$NL80211_CMD_CRIT_PROTOCOL_START(r0, &(0x7f0000000140)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x400}, 0xc, &(0x7f0000000100)={&(0x7f0000000080)={0x54, r1, 0x300, 0x70bd2a, 0x25dfdbfc, {{}, {@void, @void}}, [@NL80211_ATTR_CRIT_PROT_ID={0x6, 0xb3, 0x1}, @NL80211_ATTR_CRIT_PROT_ID={0x6}, @NL80211_ATTR_CRIT_PROT_ID={0x6, 0xb3, 0x2}, @NL80211_ATTR_CRIT_PROT_ID={0x6, 0xb3, 0x3}, @NL80211_ATTR_MAX_CRIT_PROT_DURATION={0x6, 0xb4, 0xc87}, @NL80211_ATTR_MAX_CRIT_PROT_DURATION={0x6, 0xb4, 0x132a}, @NL80211_ATTR_CRIT_PROT_ID={0x6}, @NL80211_ATTR_CRIT_PROT_ID={0x6, 0xb3, 0x1}]}, 0x54}}, 0x80) sendmsg$NL80211_CMD_STOP_NAN(r0, &(0x7f0000000240)={&(0x7f0000000180)={0x10, 0x0, 0x0, 0x8000000}, 0xc, &(0x7f0000000200)={&(0x7f00000001c0)={0x14, r1, 0x200, 0x0, 0x25dfdbff, {{}, {@void, @void}}, ["", "", ""]}, 0x14}, 0x1, 0x0, 0x0, 0x20000800}, 0x10004800) r2 = socket$nl_generic(0x10, 0x3, 0x10) syz_genetlink_get_family_id$ethtool(&(0x7f0000000280), r2) (async) syz_genetlink_get_family_id$ethtool(&(0x7f0000000280), r2) ioctl$sock_SIOCGIFINDEX_80211(r0, 0x8933, &(0x7f0000000300)={'wlan1\x00'}) (async) ioctl$sock_SIOCGIFINDEX_80211(r0, 0x8933, &(0x7f0000000300)={'wlan1\x00', 0x0}) sendmsg$NL80211_CMD_START_AP(r0, &(0x7f0000000400)={&(0x7f00000002c0)={0x10, 0x0, 0x0, 0x100000}, 0xc, &(0x7f00000003c0)={&(0x7f0000000340)={0x48, r1, 0x200, 0x70bd2a, 0x25dfdbfc, {{}, {@val={0x8, 0x3, r3}, @void}}, [@NL80211_ATTR_PBSS={0x4}, @NL80211_ATTR_SSID={0xa, 0x34, @default_ap_ssid}, @NL80211_ATTR_EXTERNAL_AUTH_SUPPORT={0x4}, @crypto_settings=[@NL80211_ATTR_CONTROL_PORT={0x4}, @NL80211_ATTR_CONTROL_PORT_NO_PREAUTH={0x4}], @NL80211_ATTR_PBSS={0x4}, @acl_policy=[@NL80211_ATTR_ACL_POLICY={0x8}], @NL80211_ATTR_PBSS={0x4}]}, 0x48}, 0x1, 0x0, 0x0, 0x44000}, 0x4000880) (async) sendmsg$NL80211_CMD_START_AP(r0, &(0x7f0000000400)={&(0x7f00000002c0)={0x10, 0x0, 0x0, 0x100000}, 0xc, &(0x7f00000003c0)={&(0x7f0000000340)={0x48, r1, 0x200, 0x70bd2a, 0x25dfdbfc, {{}, {@val={0x8, 0x3, r3}, @void}}, [@NL80211_ATTR_PBSS={0x4}, @NL80211_ATTR_SSID={0xa, 0x34, @default_ap_ssid}, @NL80211_ATTR_EXTERNAL_AUTH_SUPPORT={0x4}, @crypto_settings=[@NL80211_ATTR_CONTROL_PORT={0x4}, @NL80211_ATTR_CONTROL_PORT_NO_PREAUTH={0x4}], @NL80211_ATTR_PBSS={0x4}, @acl_policy=[@NL80211_ATTR_ACL_POLICY={0x8}], @NL80211_ATTR_PBSS={0x4}]}, 0x48}, 0x1, 0x0, 0x0, 0x44000}, 0x4000880) ioctl$XFS_IOC_PATH_TO_FSHANDLE(r2, 0xc0385868, &(0x7f0000000540)={r0, &(0x7f0000000440)='\x02\x02\x02\x02\x02\x02', 0x20000, &(0x7f0000000480)={@_ha_fsid={[0x8, 0x1129]}, {0x4, 0xfff, 0x7, 0x2}}, 0x1, &(0x7f00000004c0)={@_ha_fsid}, &(0x7f0000000500)=0xffff}) setsockopt$netlink_NETLINK_DROP_MEMBERSHIP(r4, 0x10e, 0x2, &(0x7f0000000580)=0x1f, 0x4) sendmsg$NL80211_CMD_STOP_SCHED_SCAN(r4, &(0x7f00000006c0)={&(0x7f00000005c0)={0x10, 0x0, 0x0, 0x8}, 0xc, &(0x7f0000000680)={&(0x7f0000000600)={0x4c, r1, 0x2, 0x70bd26, 0x25dfdbfb, {{}, {@val={0x8, 0x3, r3}, @val={0xc, 0x99, {0x6bdfdaee, 0x19}}}}, [@NL80211_ATTR_COOKIE={0xc, 0x58, 0x49}, @NL80211_ATTR_COOKIE={0xc, 0x58, 0x6}, @NL80211_ATTR_COOKIE={0xc, 0x58, 0x47}]}, 0x4c}, 0x1, 0x0, 0x0, 0x60008045}, 0x24004844) r5 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000740), r2) sendmsg$NL80211_CMD_STOP_SCHED_SCAN(r2, &(0x7f0000000800)={&(0x7f0000000700)={0x10, 0x0, 0x0, 0x80000}, 0xc, &(0x7f00000007c0)={&(0x7f0000000780)={0x20, r5, 0x401, 0x70bd27, 0x25dfdbfe, {{}, {@void, @void}}, [@NL80211_ATTR_COOKIE={0xc, 0x58, 0x71}]}, 0x20}, 0x1, 0x0, 0x0, 0x4044895}, 0x40000d0) r6 = syz_genetlink_get_family_id$fou(&(0x7f0000000880), r0) sendmsg$FOU_CMD_DEL(r0, &(0x7f0000000940)={&(0x7f0000000840)={0x10, 0x0, 0x0, 0x10000}, 0xc, &(0x7f0000000900)={&(0x7f00000008c0)={0x3c, r6, 0x100, 0x70bd26, 0x25dfdbfc, {}, [@FOU_ATTR_PEER_V6={0x14, 0x9, @ipv4={'\x00', '\xff\xff', @private=0xa010100}}, @FOU_ATTR_PEER_V6={0x14, 0x9, @remote}]}, 0x3c}}, 0x20004801) ioctl$BTRFS_IOC_INO_LOOKUP_USER(r2, 0xd000943e, &(0x7f0000000980)={0x0, 0x0, "242c2eaea6181c2692b5d103374875349720ca7dafd2976cfbf169ecbb7a2692e0afe405e8222c06cea4a4b33152722c0307b7798ac4e704545668610d9bd8596560721e6fddcd6c1bfa1bd71931f0fa0c1d45f9ccb463fbb0b4dc9a82a2c8ad76ab800426f06d1183701ae9e16b96933ebbc3d345a0a1030375cb2dc0a4cbb3adae5ca112ab81a9fbab7f52d79cfeb12899aa268c92a315fef719c66407e13b16878d2fde23447082b24688bb0416365a72a224535b8ac1f4e747f03dba5872c3ece8a866aa2fdf442d6ce34c0b88b426f4e154975edee1efd4e1278f905471dc94c0ab2648bc1f721c07f779d8c45f2055baa951a16f0c4a63836ba9f4299c", "93b6b20d13e43b784fd612258008a03cdb0ad34f56ad731c11b7becf7d8e63ed51863744634e3105557d2f78fa321a43651d28b858239ad6f6935297183f10579a2243d5e2dc048913599c421a449e7481c46b24e6f8c126645c04e0443455629930ef9edbad16735f19654e81ce63e25eaa72652a404d8daca7b420fe14b6a39b02deb0ea212fc11135105228f302a6e15d59abebc9211b8f5eb652d95408f46c871e9d7e9478081fcf96e7eb3a7a4601344b893bd548226980ad21ae8f14216b5d0a2edbbafb5abf07c6b419bb9ff3b77333b6ec8eea5118a106d6b46a1b3eeac88f4dd9056b2143747dd028eeb67576b10ec036b238557007e6af31db777b7298d8f81d744d9c1d59c67f67fb1b766f347cae4b5f0c53665ac537918121a41bce4ae09b51fb6282cb7bc853e3c57fd13063a7b19605a2b663f410a9476d48168fc7cf837f6e07cef47c43b0e631036bbd7225cf4b58f53dfc62cc6647724c1b9ae092b69ccac55eacd1397765ffd3126bc75c99cc16032eda3ff72f31b368cb81d67834cee500bffe19e02306cb2f2d5feae205408991cead0d6ab889662016be2ac5c7e6e4f835c14fb05ef79a02c021ea1a4e3271138ac297445e97ba7f6cf2a25c0dacf03103d416405f6953e7660bff0d325086281b63d37962c818410562f5dcb1970e3c29b49fb7fe4e1542cb7d6ba44bd11f31854b56b9e6b07be5549af67e43e8f8c111751e1d0aa37e9ccfce229aec04bc3edad8b2384254e3c3dd1a645cf379cbf09f71e2795e8562763b79ac2bd0703222f11220eda5e7a470a51aed8219cd9efd1c8f275330ff01169ab8ffd419e703d9b1c21e182704dfc4ba1eca85090bc3a7cc5021e2d507834e57efea37402ab8dc7c1c7b4ec8da5250594ab02baacbd26c805e52392949741886f3392f9ccea4db931196321f335e66527035cdbf09c99cea6bf028ae56fee8e581e211be880d495539a294e4b45a3432b0bfc5c765a6d02cef111912c179192adf58cc9d5b399cd8b7f41554160ceeea45bce92e6211975e2cb6fc6d646ef99e5f0ee0a6d3b39e9bdf06790c074281c9e91be939c4d93f011c3341f360f67d1aa02332548b0a6141be97ccac1ec5e9fad9fdfd55e75f7c46a08ccbf4e1479a3711d151eaddcae392a64897e479c44d3ecbc686303b9176966fe249db5b5d1b22b3db233452230e04023e592fa77b74af73b01d496784203377418514437b4ff936cc16e5165e29029187b364f6ab9f1ca1cf85883b8c3ba8f7e4ce328d5a2481bcf161c2b06d88d0756efc8196928aa84ec2bdae0ad673d0105546185137c923c496041917ff07994c38566f21a31982c61499ad894e6bf526731afae3876da0f90c5992dd68d5ab6be6404ac629459a00588c9b825bf89bf298181c20453a4dd527c12ab8f3e0456b976e85d38584b8c925d5c78bcce960ea906471a70903a2b3036a1baad76301996091d8aee06370bcfc31de45bd0e3658fef735ff052cf5f9e62f4edb107be01919ef940c224dfd2ced83e9f91af498315d46e5f9bb8fcaa96f1258506d17c1ed28c9f95741b1b518321e0c2d133584221f48fdad444b43d10e9c2205a65ef9e5b083daf70659695e93c08fb107fe9be40be638c66ce618c9cc9ff6bb5e7e4ec8e58ab6d6fdff3e6e3f0b2f60ad8a18f8c89ffc83ad2c42a722dca4b1e38736ee297d4bf815f1e7ed4a9f10dcbecb58bb2f0d5ef370fb086cfd55c36665ca8871753bf44c34e1b75024b724644ae933fda51089bfdeb039d430f45a405def0a3124b74c7a8798ab83a2e7cbf454de4c359345c583bb6a069adae45ed4d42122027f7518cbdb3bb46279cacfc17b045313b2735252c70a43c889998c17e195c62b6d530d42edf071b2e3159260736ea7961587530205c1ac0b0c94569c97b5d49fab694d287a8578e692a9d6318f6e33f42e1c2af0d55b51d84a86a9178f55f31befcc67c2973e2440cf64848181ecfe86b0a46521923d6a3aaf7e9d5a9599a4e37cef60fc13abb1df50fdda8831f4ed3111c0e613f11fb21992745d536eb28c5651f84777f75ca0f2c46b4428d217fe78743dc0c6470f28b4042fb66e06c15ddf6e940409928c9dd7f2869150a10dc26d40a8c84e71b59ea8b2e66792ed1a5fa2fa26a71b4a87fefb91dffe30b32dff60773d088443aa5c4187bbfecafcee2b848c0367699d3e301b34886dac40ca48961c7959a0387b35c0bb0ba8389626703a53fc397c97620b9b54251be7107c885e438974527c3bc599740dcd8541b8da3e059b5ad987bd8ad2e1d31f2285f7a064041d10572b1d397c50ae53ae959107938507cb0a5445184e0929cb6625c5adf21225cb6cee8c370b701e3f95fc6206187545b1886f906a57bd9877b74f2dcb022a61e91c8cde5421f2a84d479ff2e116fa0b1827c5a638e4389ea27188f3d4ac9f4ea58bc23b2eae8fe671eb86cbfcaffc4e35c71fb16dbb7493e0bd6da2a668c6a75a71efab566a77e941efcef0d6a7f7f67ec64eb023ddb3e247151c05122841f6aa54488c2f21d83591e2b7ea1c29ddc3351e752b98a6e09798bd9654a95b91eaf7d764a5ab2e70f8eed276c83bbdd111c68d81f0cc5a78df70f222ca24154addbc182cd0363b90af6679d71aaead159004fbeb27be67803f0222638dee6e84cb1e16438d5864b640a8f444a8f920d91de8ec92df80b2462070cfb3e8a4b907d75a9214970da2e89540adfcecf11b461f67b95d603e1a21027eb304a4f81c9fc947b74a1c9b76ec14350f6d23cc766b778964a105c4e7cbc8d9ddb5d3e7103324fcee83177f836be2b531c67c0ec37806113cc9e77bfd121468f3d78451ad536170c8058aec1c3a12ee75561185225826a46e1ca18ba667517172e4bc21e868dd0970e600cab6521036b6c7a95c6420886da2b1e97ff38d1d5d63f9b66290679e8a7d2d9edf9cd697069f7ef33418ef95f38964017d9db4024890e039357b65996037421f987f41e0715e0d816d1f3cf1f8069f2bccc71a8ee019a7d77a25eb1e1447a5476846237e0afe108e117a71ec34bc5474a98dec23ece8be8c3e169932bd2168c8a03bbeef5807f52322f8b64053f2f51f3361c8047d502a854a35a5ba72e4f422f9b228ee87c06cdee2feb8f9a2ce75d4ee7d4a0c37ba060e87d0937ccfb581da8115961f776f6ebd666c18fe2e50339b6589ac3749dbf7746f20e8447300c900f2ec1c52aa6555de9dc7f205eadf586fe1a9b4b1ca3da22113af834142304d71c37d4eb5991165c6d31bf38004ce171fe50254f582bfa99c55fcb2c61430dddf980fdafe08e42ff6655ede9c65aa2e9a5a5430b6547341245cfabf4a06e335ba6bf487f5f11780b6e02d71e460aee766fd4c6288f58e641fa9ae15e6464193ce4da5fdac719803c30058e8213c8a733eee49debc3ba053bae9a36469c39861ffa21985dbf663b0f94a10275fbf3f113522181b2fe27bd21a396dd5725880c22b5ac3112e7e546bd83360c5a9b55d0cb38a7af22a11eb4d5a4d67c9d70fe65ccd39a4bdf2007c63002e60ee7c696194028dc83507ee2a5713766e44729142e7413e4e1fede546c8e88fb53f50fdd161071b13ee9a05ae094efb3c9039bc34fbf4e6cebee9c037606f987f270da6e43512598e4628924fe44cd7073ff06f88e596a251e40a26483cb75fce03c402dd1759ddaa2443f2e06981a3b9c04e656b341ab794671f2bab85c746b52064b82385c060d346f967d5d3a19f480a7b5546afb21c505d983ebc37c183ca378388f72a12c2dac25b0f6b4e665367f6739e6a2853dbc4e1e55cba9487d3d83858f2289adf9d561cce6cd69ce675b0aa8897025faab564f98d8deffd3f39755ece78f8ac8ff37552f148252ce6fe1e7fdaf15ba575f9aef9fd2921795ed4bf53fd93645a055b26c8a9dbbe08a216c793ab9ed12a353d4cb78d0ee44e7a0b2dae986486621aa306529c3e10cc121d3470b135f2f35bba4302765b728dec4cb33633083109e97130daf6a4c745e7402cfcf6c228bfb727efaebd97010c4bb8ef056e40a2244b204f892ee61ebcabd7481377c5ccde0a45f9fdcea848be064996beaa2ebdda16c46b46315ccecd9876caf763940694493daf89df0acd9ca7bd92c90f496c6595b47145df58e7588dbd36904bb366d7c2229dd9ca3f3f61b4c432045c1dcc0582a70c7b35599ddef08192223f3b28e205d4244c0de5ec8d7d13e7950a367f695df617ecee1bf20ea6ee4f5ca50f0bc7f934f021c3894ce92c3ee740bb64649a93bfd86a359e7cdc630238281796f564fd1fe001be0d8bb853b23e2753ebb0074c4e587c9a09e0fe87e7e0a0071827b2bddeb435d1f1aae8ff73e3de250f41a57ed5ad6d1361a8ccdb53168a461964ff428e2f23da7208c773482ea96558572a4d7f5cf69ce8ef1483b9fc6297b128e462993f3d6f74ae074c611799104826d4f91e3494037db296ba42d9cf7adf29b2c0e482550768bc3e65189ed79d47ca18edd883d81b2eef1973aefd8339972f0308e7997c6c27949eb85bc0fb9329cbbfb56d46e0cbaaa9c1056d848169c751e6bc170e2ba6e1de6424a6a2f6db63c0e843d91a1db4e3b98e2cc61e62ea50e63186ad54b02aab52b3927026d2e59c3a1e89d4f74c312fd8b23c93355ade268cb77558a0bdc6ef3203af3b3a901a3f31d401543baf6e95aa722e045cc6bf564a5abcb047e60a89062038fd45ae18ffc5b7a53230a57df61e90e71ef2bdcf81b4b69f2cceaa9735db07a09aa7141daa74695a6856d9fe997babde3bdbda4737828c679937ea058037691fb06894c61d13438769ecdc7c7f40c12581d1c9ce033b818e3c20aaef750b9fe36d780cd8ace81223f1be78faceaea47f92149499c506813fdd8641701d3b3ad262b46bc3dbbb7b235871c7628ae43f76016e38c05f07d604ae6b15891469af0a9b2c2faf27a267aa285d3f8775ae77dbee9d068be1f70a26f362fa28817f614cbf902dac57b67ce6f8f333081204df70c90172864b74fd4127adc28c71918c766f989177aa2b0f5f81d3d51664cd2385425e7acc432237a926a048945a222886159967fd3ebfa851d39d3601fc98ac0e875aebbe24c7beec9654f42fc9df4acfce5eae21341b48757897034813113e09d9c2beab120e72883b6a15e68a52ce5d1c632ec6f73ecfdac016d1f3e57fbe5000506fadeecfd0213b9ebdce26684035085ff7d810a9ba573baa330b9841e6f3faf7be263dab2ba1521499ea039522edae3b7aedf0ef53019cd4222a5f31bef4cec44b1debbf1e156395e03c119231a08d9b7f80e73300f439436f933caa23f2e46ba70ed8d9624b2d7e64a844b4138f79c63a4d55fae5e2a9cc7e29179af20f4942c9c4dc5abe63"}) (async) ioctl$BTRFS_IOC_INO_LOOKUP_USER(r2, 0xd000943e, &(0x7f0000000980)={0x0, 0x0, "242c2eaea6181c2692b5d103374875349720ca7dafd2976cfbf169ecbb7a2692e0afe405e8222c06cea4a4b33152722c0307b7798ac4e704545668610d9bd8596560721e6fddcd6c1bfa1bd71931f0fa0c1d45f9ccb463fbb0b4dc9a82a2c8ad76ab800426f06d1183701ae9e16b96933ebbc3d345a0a1030375cb2dc0a4cbb3adae5ca112ab81a9fbab7f52d79cfeb12899aa268c92a315fef719c66407e13b16878d2fde23447082b24688bb0416365a72a224535b8ac1f4e747f03dba5872c3ece8a866aa2fdf442d6ce34c0b88b426f4e154975edee1efd4e1278f905471dc94c0ab2648bc1f721c07f779d8c45f2055baa951a16f0c4a63836ba9f4299c", "93b6b20d13e43b784fd612258008a03cdb0ad34f56ad731c11b7becf7d8e63ed51863744634e3105557d2f78fa321a43651d28b858239ad6f6935297183f10579a2243d5e2dc048913599c421a449e7481c46b24e6f8c126645c04e0443455629930ef9edbad16735f19654e81ce63e25eaa72652a404d8daca7b420fe14b6a39b02deb0ea212fc11135105228f302a6e15d59abebc9211b8f5eb652d95408f46c871e9d7e9478081fcf96e7eb3a7a4601344b893bd548226980ad21ae8f14216b5d0a2edbbafb5abf07c6b419bb9ff3b77333b6ec8eea5118a106d6b46a1b3eeac88f4dd9056b2143747dd028eeb67576b10ec036b238557007e6af31db777b7298d8f81d744d9c1d59c67f67fb1b766f347cae4b5f0c53665ac537918121a41bce4ae09b51fb6282cb7bc853e3c57fd13063a7b19605a2b663f410a9476d48168fc7cf837f6e07cef47c43b0e631036bbd7225cf4b58f53dfc62cc6647724c1b9ae092b69ccac55eacd1397765ffd3126bc75c99cc16032eda3ff72f31b368cb81d67834cee500bffe19e02306cb2f2d5feae205408991cead0d6ab889662016be2ac5c7e6e4f835c14fb05ef79a02c021ea1a4e3271138ac297445e97ba7f6cf2a25c0dacf03103d416405f6953e7660bff0d325086281b63d37962c818410562f5dcb1970e3c29b49fb7fe4e1542cb7d6ba44bd11f31854b56b9e6b07be5549af67e43e8f8c111751e1d0aa37e9ccfce229aec04bc3edad8b2384254e3c3dd1a645cf379cbf09f71e2795e8562763b79ac2bd0703222f11220eda5e7a470a51aed8219cd9efd1c8f275330ff01169ab8ffd419e703d9b1c21e182704dfc4ba1eca85090bc3a7cc5021e2d507834e57efea37402ab8dc7c1c7b4ec8da5250594ab02baacbd26c805e52392949741886f3392f9ccea4db931196321f335e66527035cdbf09c99cea6bf028ae56fee8e581e211be880d495539a294e4b45a3432b0bfc5c765a6d02cef111912c179192adf58cc9d5b399cd8b7f41554160ceeea45bce92e6211975e2cb6fc6d646ef99e5f0ee0a6d3b39e9bdf06790c074281c9e91be939c4d93f011c3341f360f67d1aa02332548b0a6141be97ccac1ec5e9fad9fdfd55e75f7c46a08ccbf4e1479a3711d151eaddcae392a64897e479c44d3ecbc686303b9176966fe249db5b5d1b22b3db233452230e04023e592fa77b74af73b01d496784203377418514437b4ff936cc16e5165e29029187b364f6ab9f1ca1cf85883b8c3ba8f7e4ce328d5a2481bcf161c2b06d88d0756efc8196928aa84ec2bdae0ad673d0105546185137c923c496041917ff07994c38566f21a31982c61499ad894e6bf526731afae3876da0f90c5992dd68d5ab6be6404ac629459a00588c9b825bf89bf298181c20453a4dd527c12ab8f3e0456b976e85d38584b8c925d5c78bcce960ea906471a70903a2b3036a1baad76301996091d8aee06370bcfc31de45bd0e3658fef735ff052cf5f9e62f4edb107be01919ef940c224dfd2ced83e9f91af498315d46e5f9bb8fcaa96f1258506d17c1ed28c9f95741b1b518321e0c2d133584221f48fdad444b43d10e9c2205a65ef9e5b083daf70659695e93c08fb107fe9be40be638c66ce618c9cc9ff6bb5e7e4ec8e58ab6d6fdff3e6e3f0b2f60ad8a18f8c89ffc83ad2c42a722dca4b1e38736ee297d4bf815f1e7ed4a9f10dcbecb58bb2f0d5ef370fb086cfd55c36665ca8871753bf44c34e1b75024b724644ae933fda51089bfdeb039d430f45a405def0a3124b74c7a8798ab83a2e7cbf454de4c359345c583bb6a069adae45ed4d42122027f7518cbdb3bb46279cacfc17b045313b2735252c70a43c889998c17e195c62b6d530d42edf071b2e3159260736ea7961587530205c1ac0b0c94569c97b5d49fab694d287a8578e692a9d6318f6e33f42e1c2af0d55b51d84a86a9178f55f31befcc67c2973e2440cf64848181ecfe86b0a46521923d6a3aaf7e9d5a9599a4e37cef60fc13abb1df50fdda8831f4ed3111c0e613f11fb21992745d536eb28c5651f84777f75ca0f2c46b4428d217fe78743dc0c6470f28b4042fb66e06c15ddf6e940409928c9dd7f2869150a10dc26d40a8c84e71b59ea8b2e66792ed1a5fa2fa26a71b4a87fefb91dffe30b32dff60773d088443aa5c4187bbfecafcee2b848c0367699d3e301b34886dac40ca48961c7959a0387b35c0bb0ba8389626703a53fc397c97620b9b54251be7107c885e438974527c3bc599740dcd8541b8da3e059b5ad987bd8ad2e1d31f2285f7a064041d10572b1d397c50ae53ae959107938507cb0a5445184e0929cb6625c5adf21225cb6cee8c370b701e3f95fc6206187545b1886f906a57bd9877b74f2dcb022a61e91c8cde5421f2a84d479ff2e116fa0b1827c5a638e4389ea27188f3d4ac9f4ea58bc23b2eae8fe671eb86cbfcaffc4e35c71fb16dbb7493e0bd6da2a668c6a75a71efab566a77e941efcef0d6a7f7f67ec64eb023ddb3e247151c05122841f6aa54488c2f21d83591e2b7ea1c29ddc3351e752b98a6e09798bd9654a95b91eaf7d764a5ab2e70f8eed276c83bbdd111c68d81f0cc5a78df70f222ca24154addbc182cd0363b90af6679d71aaead159004fbeb27be67803f0222638dee6e84cb1e16438d5864b640a8f444a8f920d91de8ec92df80b2462070cfb3e8a4b907d75a9214970da2e89540adfcecf11b461f67b95d603e1a21027eb304a4f81c9fc947b74a1c9b76ec14350f6d23cc766b778964a105c4e7cbc8d9ddb5d3e7103324fcee83177f836be2b531c67c0ec37806113cc9e77bfd121468f3d78451ad536170c8058aec1c3a12ee75561185225826a46e1ca18ba667517172e4bc21e868dd0970e600cab6521036b6c7a95c6420886da2b1e97ff38d1d5d63f9b66290679e8a7d2d9edf9cd697069f7ef33418ef95f38964017d9db4024890e039357b65996037421f987f41e0715e0d816d1f3cf1f8069f2bccc71a8ee019a7d77a25eb1e1447a5476846237e0afe108e117a71ec34bc5474a98dec23ece8be8c3e169932bd2168c8a03bbeef5807f52322f8b64053f2f51f3361c8047d502a854a35a5ba72e4f422f9b228ee87c06cdee2feb8f9a2ce75d4ee7d4a0c37ba060e87d0937ccfb581da8115961f776f6ebd666c18fe2e50339b6589ac3749dbf7746f20e8447300c900f2ec1c52aa6555de9dc7f205eadf586fe1a9b4b1ca3da22113af834142304d71c37d4eb5991165c6d31bf38004ce171fe50254f582bfa99c55fcb2c61430dddf980fdafe08e42ff6655ede9c65aa2e9a5a5430b6547341245cfabf4a06e335ba6bf487f5f11780b6e02d71e460aee766fd4c6288f58e641fa9ae15e6464193ce4da5fdac719803c30058e8213c8a733eee49debc3ba053bae9a36469c39861ffa21985dbf663b0f94a10275fbf3f113522181b2fe27bd21a396dd5725880c22b5ac3112e7e546bd83360c5a9b55d0cb38a7af22a11eb4d5a4d67c9d70fe65ccd39a4bdf2007c63002e60ee7c696194028dc83507ee2a5713766e44729142e7413e4e1fede546c8e88fb53f50fdd161071b13ee9a05ae094efb3c9039bc34fbf4e6cebee9c037606f987f270da6e43512598e4628924fe44cd7073ff06f88e596a251e40a26483cb75fce03c402dd1759ddaa2443f2e06981a3b9c04e656b341ab794671f2bab85c746b52064b82385c060d346f967d5d3a19f480a7b5546afb21c505d983ebc37c183ca378388f72a12c2dac25b0f6b4e665367f6739e6a2853dbc4e1e55cba9487d3d83858f2289adf9d561cce6cd69ce675b0aa8897025faab564f98d8deffd3f39755ece78f8ac8ff37552f148252ce6fe1e7fdaf15ba575f9aef9fd2921795ed4bf53fd93645a055b26c8a9dbbe08a216c793ab9ed12a353d4cb78d0ee44e7a0b2dae986486621aa306529c3e10cc121d3470b135f2f35bba4302765b728dec4cb33633083109e97130daf6a4c745e7402cfcf6c228bfb727efaebd97010c4bb8ef056e40a2244b204f892ee61ebcabd7481377c5ccde0a45f9fdcea848be064996beaa2ebdda16c46b46315ccecd9876caf763940694493daf89df0acd9ca7bd92c90f496c6595b47145df58e7588dbd36904bb366d7c2229dd9ca3f3f61b4c432045c1dcc0582a70c7b35599ddef08192223f3b28e205d4244c0de5ec8d7d13e7950a367f695df617ecee1bf20ea6ee4f5ca50f0bc7f934f021c3894ce92c3ee740bb64649a93bfd86a359e7cdc630238281796f564fd1fe001be0d8bb853b23e2753ebb0074c4e587c9a09e0fe87e7e0a0071827b2bddeb435d1f1aae8ff73e3de250f41a57ed5ad6d1361a8ccdb53168a461964ff428e2f23da7208c773482ea96558572a4d7f5cf69ce8ef1483b9fc6297b128e462993f3d6f74ae074c611799104826d4f91e3494037db296ba42d9cf7adf29b2c0e482550768bc3e65189ed79d47ca18edd883d81b2eef1973aefd8339972f0308e7997c6c27949eb85bc0fb9329cbbfb56d46e0cbaaa9c1056d848169c751e6bc170e2ba6e1de6424a6a2f6db63c0e843d91a1db4e3b98e2cc61e62ea50e63186ad54b02aab52b3927026d2e59c3a1e89d4f74c312fd8b23c93355ade268cb77558a0bdc6ef3203af3b3a901a3f31d401543baf6e95aa722e045cc6bf564a5abcb047e60a89062038fd45ae18ffc5b7a53230a57df61e90e71ef2bdcf81b4b69f2cceaa9735db07a09aa7141daa74695a6856d9fe997babde3bdbda4737828c679937ea058037691fb06894c61d13438769ecdc7c7f40c12581d1c9ce033b818e3c20aaef750b9fe36d780cd8ace81223f1be78faceaea47f92149499c506813fdd8641701d3b3ad262b46bc3dbbb7b235871c7628ae43f76016e38c05f07d604ae6b15891469af0a9b2c2faf27a267aa285d3f8775ae77dbee9d068be1f70a26f362fa28817f614cbf902dac57b67ce6f8f333081204df70c90172864b74fd4127adc28c71918c766f989177aa2b0f5f81d3d51664cd2385425e7acc432237a926a048945a222886159967fd3ebfa851d39d3601fc98ac0e875aebbe24c7beec9654f42fc9df4acfce5eae21341b48757897034813113e09d9c2beab120e72883b6a15e68a52ce5d1c632ec6f73ecfdac016d1f3e57fbe5000506fadeecfd0213b9ebdce26684035085ff7d810a9ba573baa330b9841e6f3faf7be263dab2ba1521499ea039522edae3b7aedf0ef53019cd4222a5f31bef4cec44b1debbf1e156395e03c119231a08d9b7f80e73300f439436f933caa23f2e46ba70ed8d9624b2d7e64a844b4138f79c63a4d55fae5e2a9cc7e29179af20f4942c9c4dc5abe63"}) ioctl$BTRFS_IOC_INO_LOOKUP(r2, 0xd0009412, &(0x7f0000001980)={r7}) setsockopt$bt_l2cap_L2CAP_LM(r4, 0x6, 0x3, &(0x7f0000002980)=0x40, 0x4) (async) setsockopt$bt_l2cap_L2CAP_LM(r4, 0x6, 0x3, &(0x7f0000002980)=0x40, 0x4) dup(0xffffffffffffffff) (async) r8 = dup(0xffffffffffffffff) r9 = syz_genetlink_get_family_id$tipc(&(0x7f0000002a00), r8) sendmsg$TIPC_CMD_GET_BEARER_NAMES(r4, &(0x7f0000002ac0)={&(0x7f00000029c0)={0x10, 0x0, 0x0, 0x4}, 0xc, &(0x7f0000002a80)={&(0x7f0000002a40)={0x1c, r9, 0x20, 0x70bd28, 0x25dfdbfb, {}, [""]}, 0x1c}, 0x1, 0x0, 0x0, 0x20044070}, 0x40044) (async) sendmsg$TIPC_CMD_GET_BEARER_NAMES(r4, &(0x7f0000002ac0)={&(0x7f00000029c0)={0x10, 0x0, 0x0, 0x4}, 0xc, &(0x7f0000002a80)={&(0x7f0000002a40)={0x1c, r9, 0x20, 0x70bd28, 0x25dfdbfb, {}, [""]}, 0x1c}, 0x1, 0x0, 0x0, 0x20044070}, 0x40044) r10 = syz_genetlink_get_family_id$mptcp(&(0x7f0000002b40), r2) sendmsg$MPTCP_PM_CMD_SET_LIMITS(r4, &(0x7f0000002cc0)={&(0x7f0000002b00)={0x10, 0x0, 0x0, 0x4000}, 0xc, &(0x7f0000002c80)={&(0x7f0000002b80)={0xd4, r10, 0x200, 0x70bd26, 0x25dfdbfc, {}, [@MPTCP_PM_ATTR_ADDR={0x48, 0x1, 0x0, 0x1, [@MPTCP_PM_ADDR_ATTR_FAMILY={0x6, 0x1, 0x2}, @MPTCP_PM_ADDR_ATTR_FAMILY={0x6, 0x1, 0x2}, @MPTCP_PM_ADDR_ATTR_ADDR6={0x14, 0x4, @remote}, @MPTCP_PM_ADDR_ATTR_ADDR4={0x8, 0x3, @initdev={0xac, 0x1e, 0x1, 0x0}}, @MPTCP_PM_ADDR_ATTR_ADDR4={0x8, 0x3, @loopback}, @MPTCP_PM_ADDR_ATTR_FAMILY={0x6, 0x1, 0x2}, @MPTCP_PM_ADDR_ATTR_FAMILY={0x6, 0x1, 0xa}]}, @MPTCP_PM_ATTR_SUBFLOWS={0x8, 0x3, 0x7}, @MPTCP_PM_ATTR_ADDR={0x60, 0x1, 0x0, 0x1, [@MPTCP_PM_ADDR_ATTR_FLAGS={0x8, 0x6, 0x38}, @MPTCP_PM_ADDR_ATTR_ADDR6={0x14, 0x4, @mcast2}, @MPTCP_PM_ADDR_ATTR_ID={0x5, 0x2, 0x4}, @MPTCP_PM_ADDR_ATTR_FAMILY={0x6, 0x1, 0xa}, @MPTCP_PM_ADDR_ATTR_ADDR6={0x14, 0x4, @rand_addr=' \x01\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x02'}, @MPTCP_PM_ADDR_ATTR_ADDR6={0x14, 0x4, @remote}, @MPTCP_PM_ADDR_ATTR_ADDR4={0x8, 0x3, @multicast1}]}, @MPTCP_PM_ATTR_TOKEN={0x8, 0x4, 0x9}, @MPTCP_PM_ATTR_LOC_ID={0x5, 0x5, 0x2}]}, 0xd4}, 0x1, 0x0, 0x0, 0x4}, 0x24000000) accept(r2, 0x0, &(0x7f0000002d00)) (async) r11 = accept(r2, 0x0, &(0x7f0000002d00)) sendmsg$FOU_CMD_GET(r11, &(0x7f0000002e00)={&(0x7f0000002d40)={0x10, 0x0, 0x0, 0x2000000}, 0xc, &(0x7f0000002dc0)={&(0x7f0000002d80)={0x24, r6, 0x401, 0x70bd25, 0x25dfdbfd, {}, [@FOU_ATTR_IPPROTO={0x5, 0x3, 0x2c}, @FOU_ATTR_PEER_V4={0x8, 0x8, @empty}]}, 0x24}, 0x1, 0x0, 0x0, 0x2040000}, 0x40) sendmsg$NL80211_CMD_SET_REKEY_OFFLOAD(r2, &(0x7f00000032c0)={&(0x7f0000002e40)={0x10, 0x0, 0x0, 0x10}, 0xc, &(0x7f0000003280)={&(0x7f0000002e80)={0x3c4, r5, 0x100, 0x70bd2d, 0x25dfdbff, {{}, {@void, @val={0xc, 0x99, {0x0, 0x1c}}}}, [@NL80211_ATTR_REKEY_DATA={0xa8, 0x7a, 0x0, 0x1, [@NL80211_REKEY_DATA_KCK={0x1c, 0x2, @kck_ext="83709ebe7f504896ff352dc3d7b2a933298ca27051b8b342"}, @NL80211_REKEY_DATA_REPLAY_CTR={0xc, 0x3, "13a42b4c8dee7c78"}, @NL80211_REKEY_DATA_KEK={0x14, 0x1, @kek="a3428cb367c43d139dc44c8624547abb"}, @NL80211_REKEY_DATA_KEK={0x24, 0x1, @kek_ext="d9c4d28a0f4951e639fdcb1ec44998550966d288c375eedf691762b0158a46fa"}, @NL80211_REKEY_DATA_REPLAY_CTR={0xc, 0x3, "db1ca96b3c9fee25"}, @NL80211_REKEY_DATA_AKM={0x8}, @NL80211_REKEY_DATA_AKM={0x8, 0x4, 0x70a}, @NL80211_REKEY_DATA_KCK={0x1c, 0x2, @kck_ext="002a3c831ead05a2644374faef171b2f8642e1bc41745ce6"}, @NL80211_REKEY_DATA_REPLAY_CTR={0xc, 0x3, "69969e93b22805b6"}]}, @NL80211_ATTR_REKEY_DATA={0x58, 0x7a, 0x0, 0x1, [@NL80211_REKEY_DATA_AKM={0x8, 0x4, 0x2}, @NL80211_REKEY_DATA_KCK={0x14, 0x2, @kck="641e93a39fa5780320ac266e20be1501"}, @NL80211_REKEY_DATA_AKM={0x8, 0x4, 0x200}, @NL80211_REKEY_DATA_AKM={0x8, 0x4, 0x9}, @NL80211_REKEY_DATA_REPLAY_CTR={0xc, 0x3, "ffb2860d071dae62"}, @NL80211_REKEY_DATA_KCK={0x1c, 0x2, @kck_ext="517ee1e6618d4cd6ddf4823556ee1757b444982088937305"}]}, @NL80211_ATTR_REKEY_DATA={0x34, 0x7a, 0x0, 0x1, [@NL80211_REKEY_DATA_KCK={0x1c, 0x2, @kck_ext="47e98a697fb3181ca1eb99b2f86b67f5de08af3194cef302"}, @NL80211_REKEY_DATA_KCK={0x14, 0x2, @kck="91e47c532a27f931cb47242ac95821de"}]}, @NL80211_ATTR_REKEY_DATA={0x78, 0x7a, 0x0, 0x1, [@NL80211_REKEY_DATA_KEK={0x14, 0x1, @kek="041b5ed71eab553c8b20e7e1ab569b39"}, @NL80211_REKEY_DATA_REPLAY_CTR={0xc, 0x3, "4078ad5c4076a9a0"}, @NL80211_REKEY_DATA_KEK={0x14, 0x1, @kek="9b73e75346c1196fb8ded1673f591cda"}, @NL80211_REKEY_DATA_KCK={0x1c, 0x2, @kck_ext="b95ee7742908317535d9056fa676917e36da0f127e2dfb14"}, @NL80211_REKEY_DATA_KEK={0x24, 0x1, @kek_ext="47b5928e185b2b36cd9a96b9ddbfac245e991cd92f50977d705470b01eb00570"}]}, @NL80211_ATTR_REKEY_DATA={0x3c, 0x7a, 0x0, 0x1, [@NL80211_REKEY_DATA_KEK={0x24, 0x1, @kek_ext="d91d95e6c87a1b1a5154784e156d2a632053f14f1a299e83e52839b900be2957"}, @NL80211_REKEY_DATA_KEK={0x14, 0x1, @kek="5a701d180e92084853b5c395f14ea470"}]}, @NL80211_ATTR_REKEY_DATA={0x5c, 0x7a, 0x0, 0x1, [@NL80211_REKEY_DATA_KCK={0x14, 0x2, @kck="80dddf80e4628a1d815295a349151a86"}, @NL80211_REKEY_DATA_AKM={0x8, 0x4, 0x7}, @NL80211_REKEY_DATA_REPLAY_CTR={0xc, 0x3, "0588fb6b01833bd3"}, @NL80211_REKEY_DATA_KCK={0x1c, 0x2, @kck_ext="7b0155074ec2a33dcb9732ab762dbf6580be2e03036a3843"}, @NL80211_REKEY_DATA_KEK={0x14, 0x1, @kek="fad7e2872a90afcc7d8b4a218cfdcdf4"}]}, @NL80211_ATTR_REKEY_DATA={0x7c, 0x7a, 0x0, 0x1, [@NL80211_REKEY_DATA_KCK={0x14, 0x2, @kck="4b28b80ac50b650b77e123b2493ad38b"}, @NL80211_REKEY_DATA_KEK={0x14, 0x1, @kek="b946007cd3b006f79c06d22db62cbce9"}, @NL80211_REKEY_DATA_REPLAY_CTR={0xc, 0x3, "d693944b748c4b32"}, @NL80211_REKEY_DATA_KCK={0x1c, 0x2, @kck_ext="aaa96c9e1dbd814ef52a742d707fac333d5e0b13938fa229"}, @NL80211_REKEY_DATA_REPLAY_CTR={0xc, 0x3, "f97f4d7a7bcaf12d"}, @NL80211_REKEY_DATA_KCK={0x1c, 0x2, @kck_ext="dd8b250a76cb950095ae2201d823648e9524d70fdd86879a"}]}, @NL80211_ATTR_REKEY_DATA={0xc, 0x7a, 0x0, 0x1, [@NL80211_REKEY_DATA_AKM={0x8, 0x4, 0xa}]}, @NL80211_ATTR_REKEY_DATA={0x2c, 0x7a, 0x0, 0x1, [@NL80211_REKEY_DATA_REPLAY_CTR={0xc, 0x3, "68a8196babac8946"}, @NL80211_REKEY_DATA_KEK={0x14, 0x1, @kek="fc9c288d726dd25aa14c7e4310400f97"}, @NL80211_REKEY_DATA_AKM={0x8, 0x4, 0x9e42}]}, @NL80211_ATTR_REKEY_DATA={0xac, 0x7a, 0x0, 0x1, [@NL80211_REKEY_DATA_KCK={0x1c, 0x2, @kck_ext="bef9083e17051b2cf9119206188d6ce9ec5cd6a4fcea0b8b"}, @NL80211_REKEY_DATA_REPLAY_CTR={0xc, 0x3, "247dbf80babd7c2a"}, @NL80211_REKEY_DATA_KEK={0x24, 0x1, @kek_ext="cc2c3eda2f083c431481dae8872b98f78ac5142b294130e2fb7d4006156f37e1"}, @NL80211_REKEY_DATA_AKM={0x8}, @NL80211_REKEY_DATA_KCK={0x14, 0x2, @kck="aa12b047a98e917652ce4c2197d08fcf"}, @NL80211_REKEY_DATA_KEK={0x24, 0x1, @kek_ext="624b7085fddb6acf43675edd3820e8ed176afa07b9ab5a5d2bb2f8ea1eb18afe"}, @NL80211_REKEY_DATA_KCK={0x1c, 0x2, @kck_ext="1fa1a3367b0c9de36dbf0959ae5bc0e5f09c6fdc424d4149"}]}]}, 0x3c4}}, 0x40400d1) r12 = openat$selinux_avc_cache_stats(0xffffffffffffff9c, &(0x7f0000003300), 0x0, 0x0) close_range(r12, r11, 0x2) ioctl$SNAPSHOT_PLATFORM_SUPPORT(r12, 0x330f, 0x5) ioctl$HIDIOCAPPLICATION(r12, 0x4802, 0x6) (async) ioctl$HIDIOCAPPLICATION(r12, 0x4802, 0x6) executing program 2: r0 = syz_ublk_setup_io_uring(0x1d, &(0x7f0000000040)={0x0, 0x72f, 0x100, 0x8, 0x3b5}, &(0x7f0000000100)=0x0, &(0x7f0000000280)=0x0, &(0x7f00000004c0)=0x0) syz_ublk_add_dev(r0, r1, r2, r3, &(0x7f0000000200)={0x2e, 0x0, 0x0, 0xffffffffffffffff, 0xc0207504, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', {0xffffffff, 0xffff, 0x40, &(0x7f0000000440)=@new_dev={0x4, 0x3c9, 0x0, 0x0, 0x1000, 0xffffffff, 0x0, 0x0, 0x40}}}, &(0x7f0000000300)=0x0) syz_usb_control_io$lan78xx(0xffffffffffffffff, 0x0, &(0x7f0000000540)={0x34, 0x0, 0x0, &(0x7f0000000440)={0x0, 0x8, 0x1, 0x6}, 0x0, 0x0, 0x0}) r5 = openat(0xffffffffffffff9c, &(0x7f000000c380)='./file0\x00', 0x20842, 0x63) syz_ublk_setup_queues(r5, r4, &(0x7f0000000340)={0x0, 0x0, 0x10, 0x1, 0x257}, &(0x7f0000000580)=[{0x0, 0x0, 0xffffffffffffffff, {0x0, 0x880000, 0x20, 0x1000000, 0x4}}, {0x0, 0x0, 0xffffffffffffffff, {0x0, 0x0, 0x800, 0x0, 0x22a}}, {0x0, 0x0, 0xffffffffffffffff, {0x0, 0x1f6d, 0x8c, 0x1}}, {0x0, 0x0, 0xffffffffffffffff, {0x0, 0xb4ac, 0x20, 0x8, 0x9d7c}}], 0x1, &(0x7f00000014c0)={0x2e, 0x0, 0x0, 0xffffffffffffffff, 0xc0107520, 0x0, 0x0, 0x0, 0x0, {}, 0x0, 0x0, '\x00', {0x1, 0x5, 0x0, 0x0}}, 0x0) creat(&(0x7f0000001440)='./file0\x00', 0x0) r6 = inotify_init() inotify_add_watch(r6, &(0x7f0000000000)='.\x00', 0x400017e) setxattr$incfs_metadata(&(0x7f0000000340)='./file0\x00', &(0x7f0000000180), 0x0, 0x0, 0x0) madvise(&(0x7f0000bdc000/0x4000)=nil, 0x86ac726dff2f4713, 0xa) syz_usb_disconnect(0xffffffffffffffff) syz_clone(0x9000, 0x0, 0x43, 0x0, 0x0, 0x0) executing program 2: r0 = socket$inet6(0xa, 0x2, 0x0) ioctl$sock_inet6_SIOCSIFDSTADDR(r0, 0x80108907, 0x0) r1 = syz_ublk_setup_io_uring(0x20, &(0x7f0000000340)={0x0, 0x0, 0x1000, 0x40002, 0x1e5}, &(0x7f0000000000)=0x0, &(0x7f0000000040)=0x0, &(0x7f0000000140)=0x0) syslog(0xa, 0x0, 0x0) syz_ublk_add_dev(0xffffffffffffffff, r2, r3, r4, &(0x7f0000000180)={0x2e, 0x0, 0x0, 0xffffffffffffffff, 0xc0207504, 0x0, 0x0, 0x0, 0x0, 0x9, 0x0, 0x0, '\x00', {0xffffffff, 0xffff, 0x40, &(0x7f00000000c0)=@new_dev={0x3, 0xf14, 0x0, 0x0, 0x1000, 0xffffffff, 0x0, 0x0, 0x124}}}, &(0x7f0000000280)=0x0) sendto$packet(0xffffffffffffffff, &(0x7f00000000c0)="37031c00", 0x4, 0x4000800, 0x0, 0x47) r7 = socket(0x2, 0x3, 0xff) setsockopt$sock_int(r7, 0x1, 0x29, &(0x7f0000000000)=0x97b, 0x4) setsockopt$SO_TIMESTAMPING(r7, 0x1, 0x25, &(0x7f0000000700)=0xcce, 0x4) connect$inet(r7, &(0x7f00000000c0)={0x2, 0x0, @remote}, 0x10) sendmsg$inet(r7, &(0x7f0000000880)={&(0x7f0000000100)={0x2, 0x4e20, @multicast2}, 0x10, &(0x7f00000007c0)=[{&(0x7f0000000140)="25daecdbdce723b7b21e8d5c32e71c33b09147ca", 0x14}], 0x1, &(0x7f0000000840)=[@ip_tos_int={{0x14, 0x0, 0x1, 0x5}}, @ip_tos_u8={{0x11, 0x0, 0x1, 0x57}}], 0x30}, 0x40) syz_ublk_setup_queues(r1, r6, &(0x7f0000000200)={0x0, 0x1463, 0x10700, 0x0, 0xb2}, &(0x7f0000000500)=[{0x0, 0x0, 0xffffffffffffffff, {0x0, 0x4485, 0x10002, 0x401, 0x9, 0x0, r1}}, {0x0, 0x0, 0xffffffffffffffff, {0x0, 0x7682, 0x8000, 0x0, 0x200000a, 0x0, r1}}, {0x0, 0x0, 0xffffffffffffffff, {0x0, 0x1, 0x2000, 0x3, 0x902c4, 0x0, r1}}, {0x0, 0x0, 0xffffffffffffffff, {0x0, 0xdf2c, 0x20, 0x2, 0x114, 0x0, r1}}], 0x4, &(0x7f0000001540)={0x2e, 0x6, 0x1f, 0xffffffffffffffff, 0xc0107520, 0x0, 0x0, 0x0, 0x72ccfb459c83c565, {0x6}, 0x0, r5, '\x00', {0x3, 0x48b, 0x0, 0x0}}, 0x0) executing program 2: r0 = socket$netlink(0x10, 0x3, 0x0) writev(r0, &(0x7f00000000c0)=[{&(0x7f0000000080)="290000001e00190f00143fffffffda060200ea0000e80001dd0008040d000400000000000000000500", 0x29}], 0x1) executing program 2: r0 = socket$nl_sock_diag(0x10, 0x3, 0x4) pipe2$9p(&(0x7f0000000240)={0xffffffffffffffff, 0xffffffffffffffff}, 0x4000) mkdirat(0xffffffffffffff9c, &(0x7f0000000040)='./file0\x00', 0x1c0) mount$9p_fd(0x0, &(0x7f0000000000)='./file0\x00', &(0x7f00000001c0), 0x2004000, &(0x7f00000000c0)={'trans=fd,', {'rfdno', 0x3d, r1}, 0x2c, {'wfdno', 0x3d, r2}, 0x2c, {[{@cache_readahead}], [], 0x6b}}) r3 = epoll_create1(0x0) r4 = epoll_create1(0x0) epoll_ctl$EPOLL_CTL_ADD(r4, 0x1, r3, &(0x7f0000000000)={0x20000002}) epoll_ctl$EPOLL_CTL_MOD(r4, 0x3, r3, &(0x7f0000000400)={0xa0000000}) munmap(&(0x7f0000ffc000/0x2000)=nil, 0x2000) sendmsg$DCCPDIAG_GETSOCK(r0, &(0x7f0000003d40)={0x0, 0x0, &(0x7f0000003d00)={&(0x7f0000003bc0)=ANY=[@ANYBLOB="54000000130003042cbd7000ffdbdf2518da05064e214e22e38a000005000000000000020600000082210000f4ffffffff0300008f120000", @ANYRES32=0x0, @ANYBLOB="ffffffff7f000002090000f2000200000400010004000100"], 0x54}, 0x1, 0x0, 0x0, 0x4000}, 0x40000) getpid() r5 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000200)='./binderfs/binder0\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(r5, 0xc0306201, &(0x7f00000003c0)={0x4c, 0x0, &(0x7f0000000040)=[@transaction_sg={0x400c6314, {0x0, 0x0, 0x0, 0x0, 0x20, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x1000}], 0x0, 0x0, 0x0}) executing program 33: r0 = socket$nl_sock_diag(0x10, 0x3, 0x4) pipe2$9p(&(0x7f0000000240)={0xffffffffffffffff, 0xffffffffffffffff}, 0x4000) mkdirat(0xffffffffffffff9c, &(0x7f0000000040)='./file0\x00', 0x1c0) mount$9p_fd(0x0, &(0x7f0000000000)='./file0\x00', &(0x7f00000001c0), 0x2004000, &(0x7f00000000c0)={'trans=fd,', {'rfdno', 0x3d, r1}, 0x2c, {'wfdno', 0x3d, r2}, 0x2c, {[{@cache_readahead}], [], 0x6b}}) r3 = epoll_create1(0x0) r4 = epoll_create1(0x0) epoll_ctl$EPOLL_CTL_ADD(r4, 0x1, r3, &(0x7f0000000000)={0x20000002}) epoll_ctl$EPOLL_CTL_MOD(r4, 0x3, r3, &(0x7f0000000400)={0xa0000000}) munmap(&(0x7f0000ffc000/0x2000)=nil, 0x2000) sendmsg$DCCPDIAG_GETSOCK(r0, &(0x7f0000003d40)={0x0, 0x0, &(0x7f0000003d00)={&(0x7f0000003bc0)=ANY=[@ANYBLOB="54000000130003042cbd7000ffdbdf2518da05064e214e22e38a000005000000000000020600000082210000f4ffffffff0300008f120000", @ANYRES32=0x0, @ANYBLOB="ffffffff7f000002090000f2000200000400010004000100"], 0x54}, 0x1, 0x0, 0x0, 0x4000}, 0x40000) getpid() r5 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000200)='./binderfs/binder0\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(r5, 0xc0306201, &(0x7f00000003c0)={0x4c, 0x0, &(0x7f0000000040)=[@transaction_sg={0x400c6314, {0x0, 0x0, 0x0, 0x0, 0x20, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x1000}], 0x0, 0x0, 0x0}) executing program 5: socket$nl_generic(0x10, 0x3, 0x10) socket$inet(0x2, 0x2, 0x1) socket$nl_netfilter(0x10, 0x3, 0xc) socket$nl_xfrm(0x10, 0x3, 0x6) mmap$IORING_OFF_SQ_RING(0x0, 0x8000002, 0x2000007, 0x401d031, 0xffffffffffffffff, 0x0) sendmsg$inet(0xffffffffffffffff, &(0x7f0000001b00)={0x0, 0x0, 0x0, 0x0, &(0x7f0000001d80)=ANY=[@ANYBLOB="28010000000000000100000001"], 0x128}, 0x4004000) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}) sendmsg$inet(r1, &(0x7f0000001b00)={0x0, 0x0, 0x0, 0x0, &(0x7f0000001d80)=ANY=[], 0x128}, 0x0) recvmsg$unix(r0, &(0x7f0000000000)={0x0, 0x0, 0x0, 0x0, &(0x7f00000006c0)=[@cred={{0x1c}}, @rights={{0x34, 0x1, 0x1, [0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff]}}, @rights={{0x10}}, @rights={{0x2c, 0x1, 0x1, [0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff]}}, @rights={{0x10}}], 0xa8}, 0x80) pipe2(0x0, 0x0) r4 = socket$inet6_tcp(0xa, 0x1, 0x0) r5 = dup(r4) syz_ublk_setup_queues(r5, 0x0, &(0x7f0000000040)={0x0, 0xc1, 0x10, 0xfffffffd, 0x7f}, &(0x7f0000000a80)=[{0x0, 0x0, 0xffffffffffffffff, {0x0, 0x3, 0x42, 0x3, 0x91, 0x0, r2}}, {0x0, 0x0, 0xffffffffffffffff, {0x0, 0xc81d, 0x2, 0x1, 0x3aa}}, {0x0, 0x0, 0xffffffffffffffff, {0x0, 0x93ea, 0x2000, 0x4003bfff, 0x2b9, 0x0, r3}}, {0x0, 0x0, 0xffffffffffffffff, {0x0, 0x626d, 0x800, 0x1, 0x26d}}], 0x1, 0x0, 0x0) executing program 5: mmap$IORING_OFF_SQ_RING(0x0, 0xc00000, 0x4000002, 0x14032, 0xffffffffffffffff, 0x0) syz_ublk_add_dev(0xffffffffffffffff, 0x0, 0x0, 0x0, &(0x7f0000000200)={0x2e, 0x0, 0x0, 0xffffffffffffffff, 0xc0207504, 0x0, 0x0, 0x0, 0x0, 0x4, 0x0, 0x0, '\x00', {0xffffffff, 0xffff, 0x40, &(0x7f0000000440)=@new_dev={0x4, 0x3c9, 0x0, 0x0, 0x1000, 0xffffffff, 0x0, 0x0, 0x40}}}, &(0x7f0000000300)=0x0) r1 = socket$inet6_tcp(0xa, 0x1, 0x0) r2 = dup(r1) syz_ublk_setup_queues(r2, r0, &(0x7f0000000180)={0x0, 0x1e99, 0x0, 0x7ffffffe, 0x257, 0x0, r2}, 0x0, 0x1, &(0x7f0000000340)={0x2e, 0x44, 0x0, 0xffffffffffffffff, 0xc0107520, 0x0, 0x0, 0x0, 0x21, {}, 0x0, 0x0, '\x00', {0xfff9, 0xa46, 0x0, 0x0}}, 0x0) ioctl$KVM_TDX_INIT_VM(0xffffffffffffffff, 0xc008aeba, &(0x7f0000000440)={0x1, 0x0, &(0x7f0000000200)=ANY=[@ANYBLOB="2000000000000000000000000000000007000000000000008f00000000800000060000000000000005000000000000003107000000000000020000000000000040000000000000000200000000000000724c000000000000020000000000000008000000000000000400000000000000060000000000000004000000000000000100000000000000ffffff7fffffffff4f000000000000006b000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000400000000000000010000008e2500000400000003000000020000005d5c0000070000000000000000000000000000000000004094040000070000001f0000000300000009000000a20000000000000000000000000000000d0000000000000001000000ffff000027"]}) executing program 5: r0 = socket$netlink(0x10, 0x3, 0x9) sendmsg$BATADV_CMD_GET_MESH(r0, &(0x7f00000002c0)={0x0, 0xea03, &(0x7f0000000240)={&(0x7f0000000200)={0x14, 0x0, 0x100, 0x70bd2c, 0x25dfdbfd}, 0x14}}, 0x80) executing program 5: r0 = socket$packet(0x11, 0x3, 0x300) setsockopt$packet_int(r0, 0x107, 0xa, &(0x7f00000000c0)=0x2, 0x4) mount(0x0, 0x0, 0x0, 0x0, 0x0) socket$key(0xf, 0x3, 0x2) timer_settime(0x0, 0x1, 0x0, 0x0) r1 = openat$pfkey(0xffffffffffffff9c, &(0x7f0000003340), 0x40040, 0x0) read$FUSE(r1, &(0x7f0000005500)={0x2020}, 0x2020) madvise(&(0x7f0000000000/0x800000)=nil, 0x800000, 0xe) mlock(&(0x7f0000000000/0x800000)=nil, 0x800000) r2 = openat(0xffffffffffffff9c, &(0x7f0000000280)='./cgroup.cpu/memory.force_empty\x00', 0x2, 0x0) syz_usb_connect$uac2(0x3, 0x8c, &(0x7f0000000000)={{0x12, 0x1, 0x300, 0x0, 0x0, 0x0, 0x40, 0x1235, 0x8201, 0x40, 0x1, 0x2, 0x3, 0x1, [{{0x9, 0x2, 0x7a, 0x3, 0x1, 0x0, 0xf0, 0x3, {0x8, 0xb, 0x0, 0x2, 0x1, 0x9, 0x20, 0x6}, {{{0x9, 0x4, 0x0, 0x0, 0x0, 0x1, 0x1, 0x20, 0x0, {{0x9, 0x24, 0x1, 0x2, 0x6, 0x1a, 0x3}, [@processing_unit={0x11, 0x24, 0x8, 0x3, 0x6, [0x0, 0x0, 0x0, 0x2, 0x3, 0x0]}]}}, {}, {0x9, 0x4, 0x1, 0x1, 0x1, 0x1, 0x2, 0x20, 0x0, {}, {{0x9, 0x5, 0x1, 0x9, 0x20, 0x8, 0x5, 0x0, {0x8, 0x25, 0x1, 0x1, 0x6, 0x4, 0x4}}}}, {}, {0x9, 0x4, 0x2, 0x1, 0x1, 0x1, 0x2, 0x20, 0x0, {}, {{0x9, 0x5, 0x82, 0x9, 0x3ff, 0x3, 0xe6, 0x40, {0x8, 0x25, 0x1, 0x3, 0x3, 0xfe, 0x5}}}}}}}}]}}, &(0x7f0000000200)={0x0, 0x0, 0x0, 0x0}) socketpair$nbd(0x1, 0x1, 0x0, &(0x7f0000000040)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$SIOCSIFHWADDR(r3, 0x8924, &(0x7f0000000000)={'macsec0\x00', @random="0100"}) socket$inet(0x2, 0x2, 0x0) write(r2, &(0x7f00000002c0)='0', 0x1) executing program 4: r0 = socket$netlink(0x10, 0x3, 0x0) bind$bt_hci(0xffffffffffffffff, &(0x7f0000000100)={0x1f, 0xffff}, 0x6) r1 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000000), 0x200, 0x0) r2 = socket$inet_tcp(0x2, 0x1, 0x0) getsockopt$sock_int(r2, 0x1, 0x26, 0x0, &(0x7f0000000040)) ioctl$TIOCSETD(r1, 0x5423, &(0x7f00000000c0)=0xf) ioctl$TCFLSH(r1, 0x400455c8, 0x0) sendmsg$netlink(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000080)=[{&(0x7f0000000140)=ANY=[@ANYRES8=r2, @ANYRES32=0x0, @ANYRESDEC=0x0, @ANYRES32, @ANYBLOB="0a001b"], 0x2c}], 0x1}, 0x0) executing program 4: r0 = socket(0x10, 0x803, 0x0) sendto(r0, &(0x7f0000000140)="120000001200e7ef007b00000000000000a1", 0x12, 0x0, 0x0, 0x0) recvmmsg(r0, &(0x7f0000006a40)=[{{0x0, 0x0, &(0x7f0000000900)=[{&(0x7f0000001440)=""/4112, 0x1010}, {&(0x7f0000000080)=""/90, 0x5a}, {&(0x7f0000000480)=""/42, 0x2a}, {&(0x7f0000000340)=""/88, 0x58}, {&(0x7f0000002480)=""/4102, 0x1006}, {&(0x7f0000000040)=""/10, 0xa}], 0x6, 0x0, 0x0, 0x1010}}, {{0x0, 0x0, 0x0}, 0x7ffffff}, {{0x0, 0x0, 0x0}, 0x1}, {{0x0, 0x0, 0x0}, 0x8}], 0x4, 0x12140, 0x0) executing program 4: ioctl$sock_inet_SIOCSIFDSTADDR(0xffffffffffffffff, 0x8918, &(0x7f0000000000)={'wlan0\x00', {0x2, 0x4e23, @multicast1}}) mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./file0\x00', 0x0) mkdir(&(0x7f00000000c0)='./bus\x00', 0x0) mount$incfs(&(0x7f00000007c0)='.\x00', &(0x7f0000000800)='./bus\x00', &(0x7f0000000840), 0x1804002, 0x0) chdir(&(0x7f00000003c0)='./bus\x00') mount$overlay(0x0, &(0x7f0000000100)='./file0\x00', &(0x7f0000000b80), 0x8, &(0x7f0000000240)={[{@upperdir={'upperdir', 0x3d, './file0'}}, {@workdir={'workdir', 0x3d, './bus'}}, {@lowerdir={'lowerdir', 0x3d, '.'}}]}) r0 = socket$inet6(0xa, 0x2, 0x0) madvise(&(0x7f0000000000/0x800000)=nil, 0x800000, 0xe) setsockopt$inet_int(0xffffffffffffffff, 0x0, 0x17, &(0x7f0000000180)=0xfffffffc, 0x4) syz_clone(0x20b84311, 0x0, 0x0, 0x0, 0x0, 0x0) syz_clone(0x11, 0x0, 0x0, 0x0, 0x0, 0x0) setsockopt$sock_int(r0, 0x1, 0xf, &(0x7f0000000240)=0x9, 0x4) bind$inet6(r0, &(0x7f0000000040)={0xa, 0xe22}, 0x1c) setsockopt$sock_int(r0, 0x1, 0x31, &(0x7f0000001600), 0x4) r1 = socket$netlink(0x10, 0x3, 0x8000000004) writev(r1, &(0x7f0000000000)=[{&(0x7f00000003c0)="580000001500add427323b472545b4560a117fffffff81000e220e227f000008925aa80013007b00090080007f000001e809000000ff0000ffffc7100003ffffffffffffffffffffffe7ee000000deff0000000200000000", 0x58}], 0x1) add_key(&(0x7f0000000080)='id_resolver\x00', 0x0, &(0x7f0000000400)="308201d43082017ba00302010202142eea648d7f17e62e9e5869c887c68e1bd0f86fde300a06082a8648ce3d040302303a3138303606035504030c2f436572746966696361746520766572696669636174696f6e2045434453412073656c662d74657374696e67206b65793020170d3234303431333232313632365a180f32313234303332303232313632365a303a3138303606035504030c2f43657274696669630000000000000008666963617428a2e0861e1ae90d412073656c662d74657374696e67206b65793059301306072a8648ce3d020106082a8648ce3d0301070300000000e56b51affc19412c88926b775771039ee2fe6e6a714ec7299f90e177189fc2e70a82d08ae181a9717c5a73fb25b95b1e248c739ff838f848b4ad1619c022c6a35d305b301d0603551d0e041604142900bcea1deb7bc8479a84a23d758efdfdd2b2d3301f0603551d230418301683142900bcea1deb7bc8479a84a23d758efdfdd2b2d3300c0603551d130101ff04023000300b0603551d0f040403020780300a06082a8648ce3d040302034700304402201ad7ac07c89738f489437ec7666ea5007c121db409760c996b8c265de9705cb4022073b7c77a5adb670a964219cf4f674f356aee2925f24fc810149d79691c7ad75d", 0x1d8, 0xfffffffffffffffd) executing program 5: mmap$IORING_OFF_SQ_RING(0x0, 0xc00000, 0x4000002, 0x14032, 0xffffffffffffffff, 0x0) syz_ublk_add_dev(0xffffffffffffffff, 0x0, 0x0, 0x0, &(0x7f0000000200)={0x2e, 0x0, 0x0, 0xffffffffffffffff, 0xc0207504, 0x0, 0x0, 0x0, 0x0, 0x4, 0x0, 0x0, '\x00', {0xffffffff, 0xffff, 0x40, &(0x7f0000000440)=@new_dev={0x4, 0x3c9, 0x0, 0x0, 0x1000, 0xffffffff, 0x0, 0x0, 0x40}}}, &(0x7f0000000300)=0x0) r1 = socket$inet6_tcp(0xa, 0x1, 0x0) r2 = dup(r1) syz_ublk_setup_queues(r2, r0, &(0x7f0000000180)={0x0, 0x1e99, 0x0, 0x7ffffffe, 0x257, 0x0, r2}, 0x0, 0x1, &(0x7f0000000340)={0x2e, 0x44, 0x0, 0xffffffffffffffff, 0xc0107520, 0x0, 0x0, 0x0, 0x500, {}, 0x0, 0x0, '\x00', {0xfff9, 0xa46, 0x0, 0x0}}, 0x0) ioctl$KVM_TDX_INIT_VM(0xffffffffffffffff, 0xc008aeba, &(0x7f0000000440)={0x1, 0x0, &(0x7f0000000200)=ANY=[@ANYBLOB="2000000000000000000000000000000007000000000000008f00000000800000060000000000000005000000000000003107000000000000020000000000000040000000000000000200000000000000724c000000000000020000000000000008000000000000000400000000000000060000000000000004000000000000000100000000000000ffffff7fffffffff4f000000000000006b000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000400000000000000010000008e2500000400000003000000020000005d5c0000070000000000000000000000000000000000004094040000070000001f0000000300000009000000a20000000000000000000000000000000d0000000000000001000000ffff000027"]}) executing program 5: syz_open_procfs(0x0, 0x0) timer_create(0x0, &(0x7f00000000c0)={0x0, 0x21, 0x2, @thr={0x0, 0x0}}, &(0x7f0000000340)=0x0) mprotect(&(0x7f0000000000/0xf000)=nil, 0xf000, 0x1) timer_settime(r0, 0x1, &(0x7f0000000040)={{}, {0x0, 0x989680}}, 0x0) mmap(&(0x7f0000000000/0x200000)=nil, 0x200000, 0x300000b, 0x204031, 0xffffffffffffffff, 0xec776000) madvise(&(0x7f0000c00000/0x400000)=nil, 0x400000, 0xe) syz_usb_control_io$uac1(0xffffffffffffffff, 0x0, 0x0) timer_create(0x2, &(0x7f00000000c0)={0x0, 0x12}, &(0x7f00000001c0)=0x0) timer_settime(r1, 0x0, &(0x7f0000000280)={{0x0, 0x3938700}, {0x0, 0x989680}}, 0x0) timer_create(0x7, &(0x7f0000000180)={0x0, 0x13, 0x0, @thr={0x0, 0x0}}, &(0x7f0000000240)=0x0) timer_settime(r2, 0x0, &(0x7f0000000340)={{0x0, 0x989680}, {0x0, 0x989680}}, 0x0) unshare(0x44040200) executing program 4: ioctl$KVM_XEN_HVM_CONFIG(0xffffffffffffffff, 0x4038ae7a, &(0x7f0000000100)={0x0, 0x642, &(0x7f0000000240)="235913100000004a3525c373b8be3e8d2672540e4fff5fe7", 0x0, 0x18}) r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000200), 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) ioctl$FS_IOC_GETFSLABEL(r0, 0x81009431, &(0x7f0000000000)) r2 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0) syz_usb_connect(0x3, 0x3f, &(0x7f00000002c0)=ANY=[@ANYBLOB="120100025eba07400a11301160c40102030109022d0001067f40010904f0440303b1db02090506040000ea01f409050703a8a2d4fc675d283744976fdf3c69b3d3ff0306050209050d100004ff7f00"], 0x0) ioctl$KVM_SET_USER_MEMORY_REGION(r1, 0x4020ae46, &(0x7f0000000180)={0x0, 0x0, 0x0, 0x2000, &(0x7f0000000000/0x2000)=nil}) io_setup(0x2, &(0x7f0000000000)=0x0) r4 = eventfd(0x3) write(r2, &(0x7f0000000280)="95039e414daf789aa6e411d1f3f765d8640623af5bd6e5a61a7ac0f952601b700c72a02fe4f8950fdd0e59d0ad4388bcde221e560443bc2bcd005b5677", 0x3d) io_submit(r3, 0x1, &(0x7f0000000040)=[&(0x7f0000000240)={0x0, 0x0, 0x0, 0x1, 0xc2, r4, 0x0, 0x0, 0xffffffffffffff30, 0x0, 0x0, r4}]) ioctl$KVM_SET_REGS(r2, 0x4090ae82, &(0x7f00000003c0)={[0x60000000004, 0x1000000000, 0x5, 0x41, 0x2000000, 0x0, 0x2004cc, 0x0, 0xa1b, 0x8, 0x5, 0x0, 0x3, 0x2], 0x10000, 0x202}) ioctl$KVM_RUN(r2, 0xae80, 0x0) ioctl$KVM_RUN(r2, 0xae80, 0x0) ioctl$AUTOFS_IOC_PROTOSUBVER(r0, 0x80049367, &(0x7f0000000340)) r5 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x1) syz_kvm_setup_cpu$x86(r1, r5, &(0x7f0000000000/0x18000)=nil, &(0x7f0000000500)=[@text16={0x10, &(0x7f0000000480)="660f38221dba200066b80700000066efbaf80c66b8367e948f66efbafc0cedd0930000660f38822a0f22c636f2abf30f090faf5f0866b8001000000f23c00f21f86635030006000f23f8", 0x4a}], 0x1, 0x0, &(0x7f0000000540), 0x0) ioctl$KVM_SET_SREGS(r2, 0x4138ae84, &(0x7f0000000100)={{0xfec00000, 0x80a0000, 0x0, 0xcb, 0x23, 0x10, 0x3, 0x7, 0x0, 0x8, 0x9}, {0x8080000, 0x10000, 0xc, 0x0, 0x2, 0x0, 0xfd, 0x0, 0x7, 0xff}, {0xb000, 0x8080000, 0x3, 0x3, 0x27, 0xc4, 0x0, 0x0, 0x8, 0x3, 0x40, 0x3}, {0xeeef0000, 0x33331000, 0xd, 0x9, 0x1, 0x9, 0x9, 0x7, 0x8, 0xf, 0x4}, {0x80a0000, 0xeeee8000, 0xb, 0x0, 0x0, 0x6, 0x0, 0x0, 0x0, 0x42, 0x6}, {0xb000, 0x58000, 0x9, 0x3, 0x2, 0x1, 0x2, 0x80, 0x0, 0xff, 0x6}, {0xeeee8000, 0xeeee0000, 0x3, 0x4, 0x3, 0x0, 0xa1, 0x20, 0x2, 0x0, 0x4}, {0x70000, 0x50000, 0xc, 0x7, 0x0, 0x6, 0x8, 0x40, 0x26, 0x0, 0x0, 0x2}, {0x80a0000, 0x8cc}, {0xdddd1000}, 0xddf8ffd3, 0x0, 0x0, 0x110, 0x11, 0xf801, 0x3000, [0x80000006, 0x0, 0x10000, 0xb]}) ioctl$KVM_RUN(r2, 0xae80, 0x0) executing program 1: r0 = socket$netlink(0x10, 0x3, 0x0) bind$bt_hci(0xffffffffffffffff, &(0x7f0000000100)={0x1f, 0xffff}, 0x6) r1 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000000), 0x200, 0x0) ioctl$TIOCSETD(r1, 0x5423, &(0x7f00000000c0)=0xf) ioctl$TCFLSH(r1, 0x400455c8, 0x0) sendmsg$netlink(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000001d40)=[{&(0x7f0000000100)=ANY=[@ANYBLOB="2000000010008100000000000080000000000000", @ANYRES32=0x0, @ANYBLOB="0a043cbf", @ANYRES32, @ANYBLOB="0a001b"], 0x2c}], 0x1}, 0x0) executing program 1: r0 = socket$inet6(0xa, 0x2, 0x0) ioctl$sock_ipv6_tunnel_SIOCDELTUNNEL(r0, 0x891e, &(0x7f0000000a40)={'syztnl1\x00', 0x0}) accept4$tipc(0xffffffffffffffff, &(0x7f0000000000), &(0x7f0000000080)=0x10, 0x0) r1 = accept$inet6(r0, &(0x7f00000000c0)={0xa, 0x0, 0x0, @private2}, &(0x7f0000000100)=0x1c) getsockname(r1, 0x0, &(0x7f0000000040)=0x2b) socket$inet6(0xa, 0x2, 0x0) (async) ioctl$sock_ipv6_tunnel_SIOCDELTUNNEL(r0, 0x891e, &(0x7f0000000a40)={'syztnl1\x00', 0x0}) (async) accept4$tipc(0xffffffffffffffff, &(0x7f0000000000), &(0x7f0000000080)=0x10, 0x0) (async) accept$inet6(r0, &(0x7f00000000c0)={0xa, 0x0, 0x0, @private2}, &(0x7f0000000100)=0x1c) (async) getsockname(r1, 0x0, &(0x7f0000000040)=0x2b) (async) executing program 1: r0 = socket$packet(0x11, 0x3, 0x300) setsockopt$packet_int(r0, 0x107, 0xa, &(0x7f00000000c0)=0x2, 0x4) mount(0x0, 0x0, 0x0, 0x0, 0x0) socket$key(0xf, 0x3, 0x2) timer_settime(0x0, 0x1, 0x0, 0x0) r1 = openat$pfkey(0xffffffffffffff9c, &(0x7f0000003340), 0x40040, 0x0) read$FUSE(r1, &(0x7f0000005500)={0x2020}, 0x2020) madvise(&(0x7f0000000000/0x800000)=nil, 0x800000, 0xe) mlock(&(0x7f0000000000/0x800000)=nil, 0x800000) r2 = openat(0xffffffffffffff9c, &(0x7f0000000280)='./cgroup.cpu/memory.force_empty\x00', 0x2, 0x0) syz_usb_connect$uac2(0x3, 0x8c, &(0x7f0000000000)={{0x12, 0x1, 0x300, 0x0, 0x0, 0x0, 0x40, 0x1235, 0x8201, 0x40, 0x1, 0x2, 0x3, 0x1, [{{0x9, 0x2, 0x7a, 0x3, 0x1, 0x0, 0xf0, 0x3, {0x8, 0xb, 0x0, 0x2, 0x1, 0x9, 0x20, 0x6}, {{{0x9, 0x4, 0x0, 0x0, 0x0, 0x1, 0x1, 0x20, 0x0, {{0x9, 0x24, 0x1, 0x2, 0x6, 0x1a, 0x3}, [@processing_unit={0x11, 0x24, 0x8, 0x3, 0x6, [0x0, 0x0, 0x0, 0x2, 0x3, 0x0]}]}}, {}, {0x9, 0x4, 0x1, 0x1, 0x1, 0x1, 0x2, 0x20, 0x0, {}, {{0x9, 0x5, 0x1, 0x9, 0x20, 0x8, 0x5, 0x0, {0x8, 0x25, 0x1, 0x1, 0x6, 0x4, 0x4}}}}, {}, {0x9, 0x4, 0x2, 0x1, 0x1, 0x1, 0x2, 0x20, 0x0, {}, {{0x9, 0x5, 0x82, 0x9, 0x3ff, 0x3, 0xe6, 0x40, {0x8, 0x25, 0x1, 0x3, 0x3, 0xfe, 0x5}}}}}}}}]}}, &(0x7f0000000200)={0x0, 0x0, 0x0, 0x0}) socketpair$nbd(0x1, 0x1, 0x0, &(0x7f0000000040)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$SIOCSIFHWADDR(r3, 0x8924, &(0x7f0000000000)={'macsec0\x00', @random="0100"}) socket$inet(0x2, 0x2, 0x0) write(r2, &(0x7f00000002c0)='0', 0x1) executing program 1: r0 = socket$netlink(0x10, 0x3, 0x9) sendmsg$BATADV_CMD_GET_MESH(r0, &(0x7f00000002c0)={0x0, 0xec03, &(0x7f0000000240)={&(0x7f0000000200)={0x14, 0x0, 0x100, 0x70bd2c, 0x25dfdbfd}, 0x14}}, 0x80) executing program 4: r0 = syz_ublk_setup_io_uring(0x1d, &(0x7f0000000040)={0x0, 0x72f, 0x100, 0x8, 0x3b5}, &(0x7f0000000100)=0x0, &(0x7f0000000280)=0x0, &(0x7f00000004c0)=0x0) syz_ublk_add_dev(r0, r1, r2, r3, &(0x7f0000000200)={0x2e, 0x0, 0x0, 0xffffffffffffffff, 0xc0207504, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', {0xffffffff, 0xffff, 0x40, &(0x7f0000000440)=@new_dev={0x4, 0x3c9, 0x0, 0x0, 0x1000, 0xffffffff, 0x0, 0x0, 0x40}}}, &(0x7f0000000300)) syz_usb_control_io$lan78xx(0xffffffffffffffff, 0x0, &(0x7f0000000540)={0x34, 0x0, 0x0, &(0x7f0000000440)={0x0, 0x8, 0x1, 0x6}, 0x0, 0x0, 0x0}) openat(0xffffffffffffff9c, &(0x7f000000c380)='./file0\x00', 0x20842, 0x63) setxattr$incfs_metadata(&(0x7f0000000340)='./file0\x00', &(0x7f0000000180), 0x0, 0x0, 0x0) removexattr(&(0x7f0000000040)='./file0\x00', &(0x7f0000000080)=@known='user.incfs.metadata\x00') madvise(&(0x7f0000bdc000/0x4000)=nil, 0x86ac726dff2f4713, 0xa) syz_usb_disconnect(0xffffffffffffffff) syz_clone(0x9000, 0x0, 0x43, 0x0, 0x0, 0x0) executing program 1: mount_setattr(0xffffffffffffffff, 0x0, 0x8100, &(0x7f0000000300)={0x8, 0xf4, 0x40020}, 0x20) r0 = syz_usb_connect(0x0, 0x3a, &(0x7f0000000000)=ANY=[@ANYBLOB="12010002020000402505a1a400010102030109022800010100c0320904000001020900000524001001052406000105240100000705810310"], 0x0) open_tree(0xffffffffffffff9c, &(0x7f0000000640)='\x00', 0x89901) move_mount(0xffffffffffffff9c, &(0x7f00000004c0)='./file0\x00', 0xffffffffffffff9c, &(0x7f0000000480)='./file0\x00', 0x274) syz_usb_ep_write(r0, 0x81, 0x0, 0x0) r1 = socket$inet_udp(0x2, 0x2, 0x0) setsockopt$ARPT_SO_SET_REPLACE(r1, 0x0, 0x60, &(0x7f0000000040)={'filter\x00', 0x10, 0x4, 0x3c8, 0x110, 0x0, 0x0, 0x2e0, 0x2e0, 0x2e0, 0x4, 0x0, {[{{@arp={@private, @rand_addr, 0x0, 0x0, 0x0, 0x0, {}, {}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 'veth1_virt_wifi\x00', 'veth1_to_bridge\x00'}, 0xc0, 0x110}, @mangle={0x50, 'mangle\x00', 0x4, {@empty, @mac=@dev, @dev, @broadcast}}}, {{@uncond, 0xc0, 0xe8}, @unspec=@STANDARD={0x28, '\x00', 0x0, 0xfffffffb}}, {{@arp={@empty, @empty, 0x0, 0x0, 0x0, 0x0, {@mac}, {}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 'dvmrp0\x00', 'tunl0\x00'}, 0xc0, 0xe8}, @unspec=@MARK={0x28}}], {{'\x00', 0xc0, 0xe8}, {0x28}}}}, 0x418) syz_usb_disconnect(r0) ioctl$EVIOCRMFF(0xffffffffffffffff, 0x40044581, &(0x7f0000000040)=0x3) executing program 3: r0 = socket(0x1000000000000010, 0x80802, 0x0) sendmsg(r0, &(0x7f0000000200)={0x0, 0x0, &(0x7f0000000040)=[{&(0x7f0000000140)="55000a0018007fd500fe01b2a4a280930a06000000a843089100fe801100080008000c00080000002d000f009b2c136ef75afb83de448daa72540d8102d2c55327c43ab82286ef1fdd20642383656d4d2449155037", 0x55}], 0x1}, 0x0) executing program 3: mmap$IORING_OFF_SQ_RING(0x0, 0xc00000, 0x4000002, 0x14032, 0xffffffffffffffff, 0x0) syz_ublk_add_dev(0xffffffffffffffff, 0x0, 0x0, 0x0, &(0x7f0000000200)={0x2e, 0x0, 0x0, 0xffffffffffffffff, 0xc0207504, 0x0, 0x0, 0x0, 0x0, 0x4, 0x0, 0x0, '\x00', {0xffffffff, 0xffff, 0x40, &(0x7f0000000440)=@new_dev={0x4, 0x3c9, 0x0, 0x0, 0x1000, 0xffffffff, 0x0, 0x0, 0x40}}}, &(0x7f0000000300)=0x0) r1 = socket$inet6_tcp(0xa, 0x1, 0x0) r2 = dup(r1) syz_ublk_setup_queues(r2, r0, &(0x7f0000000180)={0x0, 0x1e99, 0x0, 0x7ffffffe, 0x257, 0x0, r2}, 0x0, 0x1, &(0x7f0000000340)={0x2e, 0x44, 0x0, 0xffffffffffffffff, 0xc0107520, 0x0, 0x0, 0x0, 0x700, {}, 0x0, 0x0, '\x00', {0xfff9, 0xa46, 0x0, 0x0}}, 0x0) ioctl$KVM_TDX_INIT_VM(0xffffffffffffffff, 0xc008aeba, &(0x7f0000000440)={0x1, 0x0, &(0x7f0000000200)=ANY=[@ANYBLOB="2000000000000000000000000000000007000000000000008f00000000800000060000000000000005000000000000003107000000000000020000000000000040000000000000000200000000000000724c000000000000020000000000000008000000000000000400000000000000060000000000000004000000000000000100000000000000ffffff7fffffffff4f000000000000006b000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000400000000000000010000008e2500000400000003000000020000005d5c0000070000000000000000000000000000000000004094040000070000001f0000000300000009000000a20000000000000000000000000000000d0000000000000001000000ffff000027"]}) executing program 3: r0 = socket$netlink(0x10, 0x3, 0x0) bind$bt_hci(0xffffffffffffffff, &(0x7f0000000100)={0x1f, 0xffff}, 0x6) r1 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000000), 0x200, 0x0) ioctl$TIOCSETD(r1, 0x5423, &(0x7f00000000c0)=0xf) ioctl$TCFLSH(r1, 0x400455c8, 0x0) sendmsg$netlink(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000001d40)=[{&(0x7f0000000100)=ANY=[@ANYBLOB="2c60000010008100000000000080000000000000", @ANYRES32=0x0, @ANYBLOB="0a043cbf", @ANYRES32, @ANYBLOB="0a001b"], 0x2c}], 0x1}, 0x0) executing program 3: r0 = socket$inet6_udplite(0xa, 0x2, 0x88) setsockopt$inet6_opts(r0, 0x29, 0x40, &(0x7f00000001c0)=ANY=[@ANYBLOB="000a000000000fd60730000000000a0000000000000000000000000000000000000000000000000000000d00000000000008100000ef60fc4bd8ecc4e3200000000006004dee00000000000032acaace3269d47147"], 0xd0060) executing program 3: r0 = openat$rtc(0xffffffffffffff9c, &(0x7f0000000000), 0x8000, 0x0) ioctl$NILFS_IOCTL_DELETE_CHECKPOINT(r0, 0x80287010, 0x0) (async) r1 = openat$ttynull(0xffffffffffffff9c, &(0x7f0000000000), 0x80840, 0x0) ioctl$FIONREAD(r1, 0x541b, &(0x7f0000000040)) r2 = socket(0x10, 0x4, 0x4) setsockopt$netlink_NETLINK_TX_RING(r2, 0x10e, 0xc, &(0x7f0000000040)={0x802}, 0x10) (async) sendmsg$nl_generic(r2, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f00000005c0)=ANY=[@ANYBLOB="640100004a00010200000000000000000a"], 0x164}}, 0x0) (async) ioctl$sock_SIOCOUTQ(r2, 0x5411, &(0x7f0000000140)) (async) mkdirat(0xffffffffffffff9c, &(0x7f0000000040)='./file0\x00', 0x1c0) rename(&(0x7f00000001c0)='./file0\x00', &(0x7f00000002c0)='./file0/file0\x00') r3 = socket$inet_icmp_raw(0x2, 0x3, 0x1) setsockopt$inet_buf(r3, 0x0, 0x9, &(0x7f0000000040)="75c72cd7db776c5e26919066b40e1d6b464f8497333258ee8caa9eb1bfae8ff81494e455aa7df3e0cb44abc7014bbf67443b7bf785068d2f7b6e7ab9091937216e45bb25de98727204f6388e4ebd3fce8dbc039c93388566241c008ee2def897a32f1f33cf99b114598d4895860ecd01b2d24b05996cd3df1691d078570ea159c06aad69d722c3520a04abe6cbddbb5784d827c2d60551bffaaa668c70e998b12adb0f204bbce0575007f20b12809beb0fa2fb73372ac7c67cf42ab9a04d4f39161c45e8d6005197b946055c9898b1a5383eb9d786531b45fb1b11f8d087167e8557e7", 0xe3) executing program 3: r0 = socket$packet(0x11, 0x3, 0x300) setsockopt$packet_int(r0, 0x107, 0xa, &(0x7f00000000c0)=0x2, 0x4) mount(0x0, 0x0, 0x0, 0x0, 0x0) socket$key(0xf, 0x3, 0x2) timer_settime(0x0, 0x1, 0x0, 0x0) r1 = openat$pfkey(0xffffffffffffff9c, &(0x7f0000003340), 0x40040, 0x0) read$FUSE(r1, &(0x7f0000005500)={0x2020}, 0x2020) madvise(&(0x7f0000000000/0x800000)=nil, 0x800000, 0xe) mlock(&(0x7f0000000000/0x800000)=nil, 0x800000) r2 = openat(0xffffffffffffff9c, &(0x7f0000000280)='./cgroup.cpu/memory.force_empty\x00', 0x2, 0x0) syz_usb_connect$uac2(0x3, 0x8c, &(0x7f0000000000)={{0x12, 0x1, 0x300, 0x0, 0x0, 0x0, 0x40, 0x1235, 0x8201, 0x40, 0x1, 0x2, 0x3, 0x1, [{{0x9, 0x2, 0x7a, 0x3, 0x1, 0x0, 0xf0, 0x3, {0x8, 0xb, 0x0, 0x2, 0x1, 0x9, 0x20, 0x6}, {{{0x9, 0x4, 0x0, 0x0, 0x0, 0x1, 0x1, 0x20, 0x0, {{0x9, 0x24, 0x1, 0x2, 0x6, 0x1a, 0x3}, [@processing_unit={0x11, 0x24, 0x8, 0x3, 0x6, [0x0, 0x0, 0x0, 0x2, 0x3, 0x0]}]}}, {}, {0x9, 0x4, 0x1, 0x1, 0x1, 0x1, 0x2, 0x20, 0x0, {}, {{0x9, 0x5, 0x1, 0x9, 0x20, 0x8, 0x5, 0x0, {0x8, 0x25, 0x1, 0x1, 0x6, 0x4, 0x4}}}}, {}, {0x9, 0x4, 0x2, 0x1, 0x1, 0x1, 0x2, 0x20, 0x0, {}, {{0x9, 0x5, 0x82, 0x9, 0x3ff, 0x3, 0xe6, 0x40, {0x8, 0x25, 0x1, 0x3, 0x3, 0xfe, 0x5}}}}}}}}]}}, &(0x7f0000000200)={0x0, 0x0, 0x0, 0x0}) socketpair$nbd(0x1, 0x1, 0x0, &(0x7f0000000040)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$SIOCSIFHWADDR(r3, 0x8924, &(0x7f0000000000)={'macsec0\x00', @random="0100"}) socket$inet(0x2, 0x2, 0x0) write(r2, &(0x7f00000002c0)='0', 0x1) executing program 4: r0 = socket$netlink(0x10, 0x3, 0x0) sendmsg$netlink(r0, &(0x7f0000000480)={0x0, 0x0, &(0x7f0000000000)=[{&(0x7f0000000040)=ANY=[@ANYBLOB="1c0000405e0001010000000000230000080041008e9d10283e"], 0x1c}], 0x1}, 0x0) executing program 1: r0 = socket$nl_audit(0x10, 0x3, 0x9) r1 = epoll_create(0x2e) fsetxattr$system_posix_acl(r1, &(0x7f00000002c0)='system.posix_acl_access\x00', 0x0, 0x0, 0x2) sendmsg$AUDIT_TTY_SET(r0, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000480)={&(0x7f0000000440)={0x18, 0x3f9, 0x201, 0x70bd29, 0x25dfdbff, {0x1, 0x201}}, 0x18}, 0x1, 0x0, 0x0, 0x8000}, 0x44004) r2 = openat$binderfs(0xffffffffffffff9c, &(0x7f00000000c0)='./binderfs/binder0\x00', 0x0, 0x0) r3 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000200)='./binderfs/binder0\x00', 0x2, 0x0) r4 = dup3(r3, r2, 0x80000) ioctl$BINDER_WRITE_READ(r4, 0xc0306201, &(0x7f0000000640)={0x8, 0x0, &(0x7f0000000000)=[@decrefs={0x40086315}], 0x0, 0x0, 0x0}) r5 = socket$pppl2tp(0x18, 0x1, 0x1) ioctl$SIOCGIFMTU(r5, 0x8921, &(0x7f0000000000)={'netpci0\x00'}) program crashed: WARNING in shmem_rmdir bisect: bisecting 38 programs bisect: split chunks (needed=false): <38> bisect: split chunk #0 of len 38 into 3 parts bisect: testing without sub-chunk 1/3 testing program (duration=36s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): [13, 13, 6, 2, 15, 8, 3, 17, 6, 12, 19, 6, 10, 15, 2, 9, 9, 2, 6, 6, 2, 12, 15, 2, 10] detailed listing: executing program 33: r0 = socket$nl_sock_diag(0x10, 0x3, 0x4) pipe2$9p(&(0x7f0000000240)={0xffffffffffffffff, 0xffffffffffffffff}, 0x4000) mkdirat(0xffffffffffffff9c, &(0x7f0000000040)='./file0\x00', 0x1c0) mount$9p_fd(0x0, &(0x7f0000000000)='./file0\x00', &(0x7f00000001c0), 0x2004000, &(0x7f00000000c0)={'trans=fd,', {'rfdno', 0x3d, r1}, 0x2c, {'wfdno', 0x3d, r2}, 0x2c, {[{@cache_readahead}], [], 0x6b}}) r3 = epoll_create1(0x0) r4 = epoll_create1(0x0) epoll_ctl$EPOLL_CTL_ADD(r4, 0x1, r3, &(0x7f0000000000)={0x20000002}) epoll_ctl$EPOLL_CTL_MOD(r4, 0x3, r3, &(0x7f0000000400)={0xa0000000}) munmap(&(0x7f0000ffc000/0x2000)=nil, 0x2000) sendmsg$DCCPDIAG_GETSOCK(r0, &(0x7f0000003d40)={0x0, 0x0, &(0x7f0000003d00)={&(0x7f0000003bc0)=ANY=[@ANYBLOB="54000000130003042cbd7000ffdbdf2518da05064e214e22e38a000005000000000000020600000082210000f4ffffffff0300008f120000", @ANYRES32=0x0, @ANYBLOB="ffffffff7f000002090000f2000200000400010004000100"], 0x54}, 0x1, 0x0, 0x0, 0x4000}, 0x40000) getpid() r5 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000200)='./binderfs/binder0\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(r5, 0xc0306201, &(0x7f00000003c0)={0x4c, 0x0, &(0x7f0000000040)=[@transaction_sg={0x400c6314, {0x0, 0x0, 0x0, 0x0, 0x20, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x1000}], 0x0, 0x0, 0x0}) executing program 5: socket$nl_generic(0x10, 0x3, 0x10) socket$inet(0x2, 0x2, 0x1) socket$nl_netfilter(0x10, 0x3, 0xc) socket$nl_xfrm(0x10, 0x3, 0x6) mmap$IORING_OFF_SQ_RING(0x0, 0x8000002, 0x2000007, 0x401d031, 0xffffffffffffffff, 0x0) sendmsg$inet(0xffffffffffffffff, &(0x7f0000001b00)={0x0, 0x0, 0x0, 0x0, &(0x7f0000001d80)=ANY=[@ANYBLOB="28010000000000000100000001"], 0x128}, 0x4004000) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}) sendmsg$inet(r1, &(0x7f0000001b00)={0x0, 0x0, 0x0, 0x0, &(0x7f0000001d80)=ANY=[], 0x128}, 0x0) recvmsg$unix(r0, &(0x7f0000000000)={0x0, 0x0, 0x0, 0x0, &(0x7f00000006c0)=[@cred={{0x1c}}, @rights={{0x34, 0x1, 0x1, [0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff]}}, @rights={{0x10}}, @rights={{0x2c, 0x1, 0x1, [0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff]}}, @rights={{0x10}}], 0xa8}, 0x80) pipe2(0x0, 0x0) r4 = socket$inet6_tcp(0xa, 0x1, 0x0) r5 = dup(r4) syz_ublk_setup_queues(r5, 0x0, &(0x7f0000000040)={0x0, 0xc1, 0x10, 0xfffffffd, 0x7f}, &(0x7f0000000a80)=[{0x0, 0x0, 0xffffffffffffffff, {0x0, 0x3, 0x42, 0x3, 0x91, 0x0, r2}}, {0x0, 0x0, 0xffffffffffffffff, {0x0, 0xc81d, 0x2, 0x1, 0x3aa}}, {0x0, 0x0, 0xffffffffffffffff, {0x0, 0x93ea, 0x2000, 0x4003bfff, 0x2b9, 0x0, r3}}, {0x0, 0x0, 0xffffffffffffffff, {0x0, 0x626d, 0x800, 0x1, 0x26d}}], 0x1, 0x0, 0x0) executing program 5: mmap$IORING_OFF_SQ_RING(0x0, 0xc00000, 0x4000002, 0x14032, 0xffffffffffffffff, 0x0) syz_ublk_add_dev(0xffffffffffffffff, 0x0, 0x0, 0x0, &(0x7f0000000200)={0x2e, 0x0, 0x0, 0xffffffffffffffff, 0xc0207504, 0x0, 0x0, 0x0, 0x0, 0x4, 0x0, 0x0, '\x00', {0xffffffff, 0xffff, 0x40, &(0x7f0000000440)=@new_dev={0x4, 0x3c9, 0x0, 0x0, 0x1000, 0xffffffff, 0x0, 0x0, 0x40}}}, &(0x7f0000000300)=0x0) r1 = socket$inet6_tcp(0xa, 0x1, 0x0) r2 = dup(r1) syz_ublk_setup_queues(r2, r0, &(0x7f0000000180)={0x0, 0x1e99, 0x0, 0x7ffffffe, 0x257, 0x0, r2}, 0x0, 0x1, &(0x7f0000000340)={0x2e, 0x44, 0x0, 0xffffffffffffffff, 0xc0107520, 0x0, 0x0, 0x0, 0x21, {}, 0x0, 0x0, '\x00', {0xfff9, 0xa46, 0x0, 0x0}}, 0x0) ioctl$KVM_TDX_INIT_VM(0xffffffffffffffff, 0xc008aeba, &(0x7f0000000440)={0x1, 0x0, &(0x7f0000000200)=ANY=[@ANYBLOB="2000000000000000000000000000000007000000000000008f00000000800000060000000000000005000000000000003107000000000000020000000000000040000000000000000200000000000000724c000000000000020000000000000008000000000000000400000000000000060000000000000004000000000000000100000000000000ffffff7fffffffff4f000000000000006b000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000400000000000000010000008e2500000400000003000000020000005d5c0000070000000000000000000000000000000000004094040000070000001f0000000300000009000000a20000000000000000000000000000000d0000000000000001000000ffff000027"]}) executing program 5: r0 = socket$netlink(0x10, 0x3, 0x9) sendmsg$BATADV_CMD_GET_MESH(r0, &(0x7f00000002c0)={0x0, 0xea03, &(0x7f0000000240)={&(0x7f0000000200)={0x14, 0x0, 0x100, 0x70bd2c, 0x25dfdbfd}, 0x14}}, 0x80) executing program 5: r0 = socket$packet(0x11, 0x3, 0x300) setsockopt$packet_int(r0, 0x107, 0xa, &(0x7f00000000c0)=0x2, 0x4) mount(0x0, 0x0, 0x0, 0x0, 0x0) socket$key(0xf, 0x3, 0x2) timer_settime(0x0, 0x1, 0x0, 0x0) r1 = openat$pfkey(0xffffffffffffff9c, &(0x7f0000003340), 0x40040, 0x0) read$FUSE(r1, &(0x7f0000005500)={0x2020}, 0x2020) madvise(&(0x7f0000000000/0x800000)=nil, 0x800000, 0xe) mlock(&(0x7f0000000000/0x800000)=nil, 0x800000) r2 = openat(0xffffffffffffff9c, &(0x7f0000000280)='./cgroup.cpu/memory.force_empty\x00', 0x2, 0x0) syz_usb_connect$uac2(0x3, 0x8c, &(0x7f0000000000)={{0x12, 0x1, 0x300, 0x0, 0x0, 0x0, 0x40, 0x1235, 0x8201, 0x40, 0x1, 0x2, 0x3, 0x1, [{{0x9, 0x2, 0x7a, 0x3, 0x1, 0x0, 0xf0, 0x3, {0x8, 0xb, 0x0, 0x2, 0x1, 0x9, 0x20, 0x6}, {{{0x9, 0x4, 0x0, 0x0, 0x0, 0x1, 0x1, 0x20, 0x0, {{0x9, 0x24, 0x1, 0x2, 0x6, 0x1a, 0x3}, [@processing_unit={0x11, 0x24, 0x8, 0x3, 0x6, [0x0, 0x0, 0x0, 0x2, 0x3, 0x0]}]}}, {}, {0x9, 0x4, 0x1, 0x1, 0x1, 0x1, 0x2, 0x20, 0x0, {}, {{0x9, 0x5, 0x1, 0x9, 0x20, 0x8, 0x5, 0x0, {0x8, 0x25, 0x1, 0x1, 0x6, 0x4, 0x4}}}}, {}, {0x9, 0x4, 0x2, 0x1, 0x1, 0x1, 0x2, 0x20, 0x0, {}, {{0x9, 0x5, 0x82, 0x9, 0x3ff, 0x3, 0xe6, 0x40, {0x8, 0x25, 0x1, 0x3, 0x3, 0xfe, 0x5}}}}}}}}]}}, &(0x7f0000000200)={0x0, 0x0, 0x0, 0x0}) socketpair$nbd(0x1, 0x1, 0x0, &(0x7f0000000040)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$SIOCSIFHWADDR(r3, 0x8924, &(0x7f0000000000)={'macsec0\x00', @random="0100"}) socket$inet(0x2, 0x2, 0x0) write(r2, &(0x7f00000002c0)='0', 0x1) executing program 4: r0 = socket$netlink(0x10, 0x3, 0x0) bind$bt_hci(0xffffffffffffffff, &(0x7f0000000100)={0x1f, 0xffff}, 0x6) r1 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000000), 0x200, 0x0) r2 = socket$inet_tcp(0x2, 0x1, 0x0) getsockopt$sock_int(r2, 0x1, 0x26, 0x0, &(0x7f0000000040)) ioctl$TIOCSETD(r1, 0x5423, &(0x7f00000000c0)=0xf) ioctl$TCFLSH(r1, 0x400455c8, 0x0) sendmsg$netlink(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000080)=[{&(0x7f0000000140)=ANY=[@ANYRES8=r2, @ANYRES32=0x0, @ANYRESDEC=0x0, @ANYRES32, @ANYBLOB="0a001b"], 0x2c}], 0x1}, 0x0) executing program 4: r0 = socket(0x10, 0x803, 0x0) sendto(r0, &(0x7f0000000140)="120000001200e7ef007b00000000000000a1", 0x12, 0x0, 0x0, 0x0) recvmmsg(r0, &(0x7f0000006a40)=[{{0x0, 0x0, &(0x7f0000000900)=[{&(0x7f0000001440)=""/4112, 0x1010}, {&(0x7f0000000080)=""/90, 0x5a}, {&(0x7f0000000480)=""/42, 0x2a}, {&(0x7f0000000340)=""/88, 0x58}, {&(0x7f0000002480)=""/4102, 0x1006}, {&(0x7f0000000040)=""/10, 0xa}], 0x6, 0x0, 0x0, 0x1010}}, {{0x0, 0x0, 0x0}, 0x7ffffff}, {{0x0, 0x0, 0x0}, 0x1}, {{0x0, 0x0, 0x0}, 0x8}], 0x4, 0x12140, 0x0) executing program 4: ioctl$sock_inet_SIOCSIFDSTADDR(0xffffffffffffffff, 0x8918, &(0x7f0000000000)={'wlan0\x00', {0x2, 0x4e23, @multicast1}}) mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./file0\x00', 0x0) mkdir(&(0x7f00000000c0)='./bus\x00', 0x0) mount$incfs(&(0x7f00000007c0)='.\x00', &(0x7f0000000800)='./bus\x00', &(0x7f0000000840), 0x1804002, 0x0) chdir(&(0x7f00000003c0)='./bus\x00') mount$overlay(0x0, &(0x7f0000000100)='./file0\x00', &(0x7f0000000b80), 0x8, &(0x7f0000000240)={[{@upperdir={'upperdir', 0x3d, './file0'}}, {@workdir={'workdir', 0x3d, './bus'}}, {@lowerdir={'lowerdir', 0x3d, '.'}}]}) r0 = socket$inet6(0xa, 0x2, 0x0) madvise(&(0x7f0000000000/0x800000)=nil, 0x800000, 0xe) setsockopt$inet_int(0xffffffffffffffff, 0x0, 0x17, &(0x7f0000000180)=0xfffffffc, 0x4) syz_clone(0x20b84311, 0x0, 0x0, 0x0, 0x0, 0x0) syz_clone(0x11, 0x0, 0x0, 0x0, 0x0, 0x0) setsockopt$sock_int(r0, 0x1, 0xf, &(0x7f0000000240)=0x9, 0x4) bind$inet6(r0, &(0x7f0000000040)={0xa, 0xe22}, 0x1c) setsockopt$sock_int(r0, 0x1, 0x31, &(0x7f0000001600), 0x4) r1 = socket$netlink(0x10, 0x3, 0x8000000004) writev(r1, &(0x7f0000000000)=[{&(0x7f00000003c0)="580000001500add427323b472545b4560a117fffffff81000e220e227f000008925aa80013007b00090080007f000001e809000000ff0000ffffc7100003ffffffffffffffffffffffe7ee000000deff0000000200000000", 0x58}], 0x1) add_key(&(0x7f0000000080)='id_resolver\x00', 0x0, &(0x7f0000000400)="308201d43082017ba00302010202142eea648d7f17e62e9e5869c887c68e1bd0f86fde300a06082a8648ce3d040302303a3138303606035504030c2f436572746966696361746520766572696669636174696f6e2045434453412073656c662d74657374696e67206b65793020170d3234303431333232313632365a180f32313234303332303232313632365a303a3138303606035504030c2f43657274696669630000000000000008666963617428a2e0861e1ae90d412073656c662d74657374696e67206b65793059301306072a8648ce3d020106082a8648ce3d0301070300000000e56b51affc19412c88926b775771039ee2fe6e6a714ec7299f90e177189fc2e70a82d08ae181a9717c5a73fb25b95b1e248c739ff838f848b4ad1619c022c6a35d305b301d0603551d0e041604142900bcea1deb7bc8479a84a23d758efdfdd2b2d3301f0603551d230418301683142900bcea1deb7bc8479a84a23d758efdfdd2b2d3300c0603551d130101ff04023000300b0603551d0f040403020780300a06082a8648ce3d040302034700304402201ad7ac07c89738f489437ec7666ea5007c121db409760c996b8c265de9705cb4022073b7c77a5adb670a964219cf4f674f356aee2925f24fc810149d79691c7ad75d", 0x1d8, 0xfffffffffffffffd) executing program 5: mmap$IORING_OFF_SQ_RING(0x0, 0xc00000, 0x4000002, 0x14032, 0xffffffffffffffff, 0x0) syz_ublk_add_dev(0xffffffffffffffff, 0x0, 0x0, 0x0, &(0x7f0000000200)={0x2e, 0x0, 0x0, 0xffffffffffffffff, 0xc0207504, 0x0, 0x0, 0x0, 0x0, 0x4, 0x0, 0x0, '\x00', {0xffffffff, 0xffff, 0x40, &(0x7f0000000440)=@new_dev={0x4, 0x3c9, 0x0, 0x0, 0x1000, 0xffffffff, 0x0, 0x0, 0x40}}}, &(0x7f0000000300)=0x0) r1 = socket$inet6_tcp(0xa, 0x1, 0x0) r2 = dup(r1) syz_ublk_setup_queues(r2, r0, &(0x7f0000000180)={0x0, 0x1e99, 0x0, 0x7ffffffe, 0x257, 0x0, r2}, 0x0, 0x1, &(0x7f0000000340)={0x2e, 0x44, 0x0, 0xffffffffffffffff, 0xc0107520, 0x0, 0x0, 0x0, 0x500, {}, 0x0, 0x0, '\x00', {0xfff9, 0xa46, 0x0, 0x0}}, 0x0) ioctl$KVM_TDX_INIT_VM(0xffffffffffffffff, 0xc008aeba, &(0x7f0000000440)={0x1, 0x0, &(0x7f0000000200)=ANY=[@ANYBLOB="2000000000000000000000000000000007000000000000008f00000000800000060000000000000005000000000000003107000000000000020000000000000040000000000000000200000000000000724c000000000000020000000000000008000000000000000400000000000000060000000000000004000000000000000100000000000000ffffff7fffffffff4f000000000000006b000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000400000000000000010000008e2500000400000003000000020000005d5c0000070000000000000000000000000000000000004094040000070000001f0000000300000009000000a20000000000000000000000000000000d0000000000000001000000ffff000027"]}) executing program 5: syz_open_procfs(0x0, 0x0) timer_create(0x0, &(0x7f00000000c0)={0x0, 0x21, 0x2, @thr={0x0, 0x0}}, &(0x7f0000000340)=0x0) mprotect(&(0x7f0000000000/0xf000)=nil, 0xf000, 0x1) timer_settime(r0, 0x1, &(0x7f0000000040)={{}, {0x0, 0x989680}}, 0x0) mmap(&(0x7f0000000000/0x200000)=nil, 0x200000, 0x300000b, 0x204031, 0xffffffffffffffff, 0xec776000) madvise(&(0x7f0000c00000/0x400000)=nil, 0x400000, 0xe) syz_usb_control_io$uac1(0xffffffffffffffff, 0x0, 0x0) timer_create(0x2, &(0x7f00000000c0)={0x0, 0x12}, &(0x7f00000001c0)=0x0) timer_settime(r1, 0x0, &(0x7f0000000280)={{0x0, 0x3938700}, {0x0, 0x989680}}, 0x0) timer_create(0x7, &(0x7f0000000180)={0x0, 0x13, 0x0, @thr={0x0, 0x0}}, &(0x7f0000000240)=0x0) timer_settime(r2, 0x0, &(0x7f0000000340)={{0x0, 0x989680}, {0x0, 0x989680}}, 0x0) unshare(0x44040200) executing program 4: ioctl$KVM_XEN_HVM_CONFIG(0xffffffffffffffff, 0x4038ae7a, &(0x7f0000000100)={0x0, 0x642, &(0x7f0000000240)="235913100000004a3525c373b8be3e8d2672540e4fff5fe7", 0x0, 0x18}) r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000200), 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) ioctl$FS_IOC_GETFSLABEL(r0, 0x81009431, &(0x7f0000000000)) r2 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0) syz_usb_connect(0x3, 0x3f, &(0x7f00000002c0)=ANY=[@ANYBLOB="120100025eba07400a11301160c40102030109022d0001067f40010904f0440303b1db02090506040000ea01f409050703a8a2d4fc675d283744976fdf3c69b3d3ff0306050209050d100004ff7f00"], 0x0) ioctl$KVM_SET_USER_MEMORY_REGION(r1, 0x4020ae46, &(0x7f0000000180)={0x0, 0x0, 0x0, 0x2000, &(0x7f0000000000/0x2000)=nil}) io_setup(0x2, &(0x7f0000000000)=0x0) r4 = eventfd(0x3) write(r2, &(0x7f0000000280)="95039e414daf789aa6e411d1f3f765d8640623af5bd6e5a61a7ac0f952601b700c72a02fe4f8950fdd0e59d0ad4388bcde221e560443bc2bcd005b5677", 0x3d) io_submit(r3, 0x1, &(0x7f0000000040)=[&(0x7f0000000240)={0x0, 0x0, 0x0, 0x1, 0xc2, r4, 0x0, 0x0, 0xffffffffffffff30, 0x0, 0x0, r4}]) ioctl$KVM_SET_REGS(r2, 0x4090ae82, &(0x7f00000003c0)={[0x60000000004, 0x1000000000, 0x5, 0x41, 0x2000000, 0x0, 0x2004cc, 0x0, 0xa1b, 0x8, 0x5, 0x0, 0x3, 0x2], 0x10000, 0x202}) ioctl$KVM_RUN(r2, 0xae80, 0x0) ioctl$KVM_RUN(r2, 0xae80, 0x0) ioctl$AUTOFS_IOC_PROTOSUBVER(r0, 0x80049367, &(0x7f0000000340)) r5 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x1) syz_kvm_setup_cpu$x86(r1, r5, &(0x7f0000000000/0x18000)=nil, &(0x7f0000000500)=[@text16={0x10, &(0x7f0000000480)="660f38221dba200066b80700000066efbaf80c66b8367e948f66efbafc0cedd0930000660f38822a0f22c636f2abf30f090faf5f0866b8001000000f23c00f21f86635030006000f23f8", 0x4a}], 0x1, 0x0, &(0x7f0000000540), 0x0) ioctl$KVM_SET_SREGS(r2, 0x4138ae84, &(0x7f0000000100)={{0xfec00000, 0x80a0000, 0x0, 0xcb, 0x23, 0x10, 0x3, 0x7, 0x0, 0x8, 0x9}, {0x8080000, 0x10000, 0xc, 0x0, 0x2, 0x0, 0xfd, 0x0, 0x7, 0xff}, {0xb000, 0x8080000, 0x3, 0x3, 0x27, 0xc4, 0x0, 0x0, 0x8, 0x3, 0x40, 0x3}, {0xeeef0000, 0x33331000, 0xd, 0x9, 0x1, 0x9, 0x9, 0x7, 0x8, 0xf, 0x4}, {0x80a0000, 0xeeee8000, 0xb, 0x0, 0x0, 0x6, 0x0, 0x0, 0x0, 0x42, 0x6}, {0xb000, 0x58000, 0x9, 0x3, 0x2, 0x1, 0x2, 0x80, 0x0, 0xff, 0x6}, {0xeeee8000, 0xeeee0000, 0x3, 0x4, 0x3, 0x0, 0xa1, 0x20, 0x2, 0x0, 0x4}, {0x70000, 0x50000, 0xc, 0x7, 0x0, 0x6, 0x8, 0x40, 0x26, 0x0, 0x0, 0x2}, {0x80a0000, 0x8cc}, {0xdddd1000}, 0xddf8ffd3, 0x0, 0x0, 0x110, 0x11, 0xf801, 0x3000, [0x80000006, 0x0, 0x10000, 0xb]}) ioctl$KVM_RUN(r2, 0xae80, 0x0) executing program 1: r0 = socket$netlink(0x10, 0x3, 0x0) bind$bt_hci(0xffffffffffffffff, &(0x7f0000000100)={0x1f, 0xffff}, 0x6) r1 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000000), 0x200, 0x0) ioctl$TIOCSETD(r1, 0x5423, &(0x7f00000000c0)=0xf) ioctl$TCFLSH(r1, 0x400455c8, 0x0) sendmsg$netlink(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000001d40)=[{&(0x7f0000000100)=ANY=[@ANYBLOB="2000000010008100000000000080000000000000", @ANYRES32=0x0, @ANYBLOB="0a043cbf", @ANYRES32, @ANYBLOB="0a001b"], 0x2c}], 0x1}, 0x0) executing program 1: r0 = socket$inet6(0xa, 0x2, 0x0) ioctl$sock_ipv6_tunnel_SIOCDELTUNNEL(r0, 0x891e, &(0x7f0000000a40)={'syztnl1\x00', 0x0}) accept4$tipc(0xffffffffffffffff, &(0x7f0000000000), &(0x7f0000000080)=0x10, 0x0) r1 = accept$inet6(r0, &(0x7f00000000c0)={0xa, 0x0, 0x0, @private2}, &(0x7f0000000100)=0x1c) getsockname(r1, 0x0, &(0x7f0000000040)=0x2b) socket$inet6(0xa, 0x2, 0x0) (async) ioctl$sock_ipv6_tunnel_SIOCDELTUNNEL(r0, 0x891e, &(0x7f0000000a40)={'syztnl1\x00', 0x0}) (async) accept4$tipc(0xffffffffffffffff, &(0x7f0000000000), &(0x7f0000000080)=0x10, 0x0) (async) accept$inet6(r0, &(0x7f00000000c0)={0xa, 0x0, 0x0, @private2}, &(0x7f0000000100)=0x1c) (async) getsockname(r1, 0x0, &(0x7f0000000040)=0x2b) (async) executing program 1: r0 = socket$packet(0x11, 0x3, 0x300) setsockopt$packet_int(r0, 0x107, 0xa, &(0x7f00000000c0)=0x2, 0x4) mount(0x0, 0x0, 0x0, 0x0, 0x0) socket$key(0xf, 0x3, 0x2) timer_settime(0x0, 0x1, 0x0, 0x0) r1 = openat$pfkey(0xffffffffffffff9c, &(0x7f0000003340), 0x40040, 0x0) read$FUSE(r1, &(0x7f0000005500)={0x2020}, 0x2020) madvise(&(0x7f0000000000/0x800000)=nil, 0x800000, 0xe) mlock(&(0x7f0000000000/0x800000)=nil, 0x800000) r2 = openat(0xffffffffffffff9c, &(0x7f0000000280)='./cgroup.cpu/memory.force_empty\x00', 0x2, 0x0) syz_usb_connect$uac2(0x3, 0x8c, &(0x7f0000000000)={{0x12, 0x1, 0x300, 0x0, 0x0, 0x0, 0x40, 0x1235, 0x8201, 0x40, 0x1, 0x2, 0x3, 0x1, [{{0x9, 0x2, 0x7a, 0x3, 0x1, 0x0, 0xf0, 0x3, {0x8, 0xb, 0x0, 0x2, 0x1, 0x9, 0x20, 0x6}, {{{0x9, 0x4, 0x0, 0x0, 0x0, 0x1, 0x1, 0x20, 0x0, {{0x9, 0x24, 0x1, 0x2, 0x6, 0x1a, 0x3}, [@processing_unit={0x11, 0x24, 0x8, 0x3, 0x6, [0x0, 0x0, 0x0, 0x2, 0x3, 0x0]}]}}, {}, {0x9, 0x4, 0x1, 0x1, 0x1, 0x1, 0x2, 0x20, 0x0, {}, {{0x9, 0x5, 0x1, 0x9, 0x20, 0x8, 0x5, 0x0, {0x8, 0x25, 0x1, 0x1, 0x6, 0x4, 0x4}}}}, {}, {0x9, 0x4, 0x2, 0x1, 0x1, 0x1, 0x2, 0x20, 0x0, {}, {{0x9, 0x5, 0x82, 0x9, 0x3ff, 0x3, 0xe6, 0x40, {0x8, 0x25, 0x1, 0x3, 0x3, 0xfe, 0x5}}}}}}}}]}}, &(0x7f0000000200)={0x0, 0x0, 0x0, 0x0}) socketpair$nbd(0x1, 0x1, 0x0, &(0x7f0000000040)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$SIOCSIFHWADDR(r3, 0x8924, &(0x7f0000000000)={'macsec0\x00', @random="0100"}) socket$inet(0x2, 0x2, 0x0) write(r2, &(0x7f00000002c0)='0', 0x1) executing program 1: r0 = socket$netlink(0x10, 0x3, 0x9) sendmsg$BATADV_CMD_GET_MESH(r0, &(0x7f00000002c0)={0x0, 0xec03, &(0x7f0000000240)={&(0x7f0000000200)={0x14, 0x0, 0x100, 0x70bd2c, 0x25dfdbfd}, 0x14}}, 0x80) executing program 4: r0 = syz_ublk_setup_io_uring(0x1d, &(0x7f0000000040)={0x0, 0x72f, 0x100, 0x8, 0x3b5}, &(0x7f0000000100)=0x0, &(0x7f0000000280)=0x0, &(0x7f00000004c0)=0x0) syz_ublk_add_dev(r0, r1, r2, r3, &(0x7f0000000200)={0x2e, 0x0, 0x0, 0xffffffffffffffff, 0xc0207504, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', {0xffffffff, 0xffff, 0x40, &(0x7f0000000440)=@new_dev={0x4, 0x3c9, 0x0, 0x0, 0x1000, 0xffffffff, 0x0, 0x0, 0x40}}}, &(0x7f0000000300)) syz_usb_control_io$lan78xx(0xffffffffffffffff, 0x0, &(0x7f0000000540)={0x34, 0x0, 0x0, &(0x7f0000000440)={0x0, 0x8, 0x1, 0x6}, 0x0, 0x0, 0x0}) openat(0xffffffffffffff9c, &(0x7f000000c380)='./file0\x00', 0x20842, 0x63) setxattr$incfs_metadata(&(0x7f0000000340)='./file0\x00', &(0x7f0000000180), 0x0, 0x0, 0x0) removexattr(&(0x7f0000000040)='./file0\x00', &(0x7f0000000080)=@known='user.incfs.metadata\x00') madvise(&(0x7f0000bdc000/0x4000)=nil, 0x86ac726dff2f4713, 0xa) syz_usb_disconnect(0xffffffffffffffff) syz_clone(0x9000, 0x0, 0x43, 0x0, 0x0, 0x0) executing program 1: mount_setattr(0xffffffffffffffff, 0x0, 0x8100, &(0x7f0000000300)={0x8, 0xf4, 0x40020}, 0x20) r0 = syz_usb_connect(0x0, 0x3a, &(0x7f0000000000)=ANY=[@ANYBLOB="12010002020000402505a1a400010102030109022800010100c0320904000001020900000524001001052406000105240100000705810310"], 0x0) open_tree(0xffffffffffffff9c, &(0x7f0000000640)='\x00', 0x89901) move_mount(0xffffffffffffff9c, &(0x7f00000004c0)='./file0\x00', 0xffffffffffffff9c, &(0x7f0000000480)='./file0\x00', 0x274) syz_usb_ep_write(r0, 0x81, 0x0, 0x0) r1 = socket$inet_udp(0x2, 0x2, 0x0) setsockopt$ARPT_SO_SET_REPLACE(r1, 0x0, 0x60, &(0x7f0000000040)={'filter\x00', 0x10, 0x4, 0x3c8, 0x110, 0x0, 0x0, 0x2e0, 0x2e0, 0x2e0, 0x4, 0x0, {[{{@arp={@private, @rand_addr, 0x0, 0x0, 0x0, 0x0, {}, {}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 'veth1_virt_wifi\x00', 'veth1_to_bridge\x00'}, 0xc0, 0x110}, @mangle={0x50, 'mangle\x00', 0x4, {@empty, @mac=@dev, @dev, @broadcast}}}, {{@uncond, 0xc0, 0xe8}, @unspec=@STANDARD={0x28, '\x00', 0x0, 0xfffffffb}}, {{@arp={@empty, @empty, 0x0, 0x0, 0x0, 0x0, {@mac}, {}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 'dvmrp0\x00', 'tunl0\x00'}, 0xc0, 0xe8}, @unspec=@MARK={0x28}}], {{'\x00', 0xc0, 0xe8}, {0x28}}}}, 0x418) syz_usb_disconnect(r0) ioctl$EVIOCRMFF(0xffffffffffffffff, 0x40044581, &(0x7f0000000040)=0x3) executing program 3: r0 = socket(0x1000000000000010, 0x80802, 0x0) sendmsg(r0, &(0x7f0000000200)={0x0, 0x0, &(0x7f0000000040)=[{&(0x7f0000000140)="55000a0018007fd500fe01b2a4a280930a06000000a843089100fe801100080008000c00080000002d000f009b2c136ef75afb83de448daa72540d8102d2c55327c43ab82286ef1fdd20642383656d4d2449155037", 0x55}], 0x1}, 0x0) executing program 3: mmap$IORING_OFF_SQ_RING(0x0, 0xc00000, 0x4000002, 0x14032, 0xffffffffffffffff, 0x0) syz_ublk_add_dev(0xffffffffffffffff, 0x0, 0x0, 0x0, &(0x7f0000000200)={0x2e, 0x0, 0x0, 0xffffffffffffffff, 0xc0207504, 0x0, 0x0, 0x0, 0x0, 0x4, 0x0, 0x0, '\x00', {0xffffffff, 0xffff, 0x40, &(0x7f0000000440)=@new_dev={0x4, 0x3c9, 0x0, 0x0, 0x1000, 0xffffffff, 0x0, 0x0, 0x40}}}, &(0x7f0000000300)=0x0) r1 = socket$inet6_tcp(0xa, 0x1, 0x0) r2 = dup(r1) syz_ublk_setup_queues(r2, r0, &(0x7f0000000180)={0x0, 0x1e99, 0x0, 0x7ffffffe, 0x257, 0x0, r2}, 0x0, 0x1, &(0x7f0000000340)={0x2e, 0x44, 0x0, 0xffffffffffffffff, 0xc0107520, 0x0, 0x0, 0x0, 0x700, {}, 0x0, 0x0, '\x00', {0xfff9, 0xa46, 0x0, 0x0}}, 0x0) ioctl$KVM_TDX_INIT_VM(0xffffffffffffffff, 0xc008aeba, &(0x7f0000000440)={0x1, 0x0, &(0x7f0000000200)=ANY=[@ANYBLOB="2000000000000000000000000000000007000000000000008f00000000800000060000000000000005000000000000003107000000000000020000000000000040000000000000000200000000000000724c000000000000020000000000000008000000000000000400000000000000060000000000000004000000000000000100000000000000ffffff7fffffffff4f000000000000006b000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000400000000000000010000008e2500000400000003000000020000005d5c0000070000000000000000000000000000000000004094040000070000001f0000000300000009000000a20000000000000000000000000000000d0000000000000001000000ffff000027"]}) executing program 3: r0 = socket$netlink(0x10, 0x3, 0x0) bind$bt_hci(0xffffffffffffffff, &(0x7f0000000100)={0x1f, 0xffff}, 0x6) r1 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000000), 0x200, 0x0) ioctl$TIOCSETD(r1, 0x5423, &(0x7f00000000c0)=0xf) ioctl$TCFLSH(r1, 0x400455c8, 0x0) sendmsg$netlink(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000001d40)=[{&(0x7f0000000100)=ANY=[@ANYBLOB="2c60000010008100000000000080000000000000", @ANYRES32=0x0, @ANYBLOB="0a043cbf", @ANYRES32, @ANYBLOB="0a001b"], 0x2c}], 0x1}, 0x0) executing program 3: r0 = socket$inet6_udplite(0xa, 0x2, 0x88) setsockopt$inet6_opts(r0, 0x29, 0x40, &(0x7f00000001c0)=ANY=[@ANYBLOB="000a000000000fd60730000000000a0000000000000000000000000000000000000000000000000000000d00000000000008100000ef60fc4bd8ecc4e3200000000006004dee00000000000032acaace3269d47147"], 0xd0060) executing program 3: r0 = openat$rtc(0xffffffffffffff9c, &(0x7f0000000000), 0x8000, 0x0) ioctl$NILFS_IOCTL_DELETE_CHECKPOINT(r0, 0x80287010, 0x0) (async) r1 = openat$ttynull(0xffffffffffffff9c, &(0x7f0000000000), 0x80840, 0x0) ioctl$FIONREAD(r1, 0x541b, &(0x7f0000000040)) r2 = socket(0x10, 0x4, 0x4) setsockopt$netlink_NETLINK_TX_RING(r2, 0x10e, 0xc, &(0x7f0000000040)={0x802}, 0x10) (async) sendmsg$nl_generic(r2, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f00000005c0)=ANY=[@ANYBLOB="640100004a00010200000000000000000a"], 0x164}}, 0x0) (async) ioctl$sock_SIOCOUTQ(r2, 0x5411, &(0x7f0000000140)) (async) mkdirat(0xffffffffffffff9c, &(0x7f0000000040)='./file0\x00', 0x1c0) rename(&(0x7f00000001c0)='./file0\x00', &(0x7f00000002c0)='./file0/file0\x00') r3 = socket$inet_icmp_raw(0x2, 0x3, 0x1) setsockopt$inet_buf(r3, 0x0, 0x9, &(0x7f0000000040)="75c72cd7db776c5e26919066b40e1d6b464f8497333258ee8caa9eb1bfae8ff81494e455aa7df3e0cb44abc7014bbf67443b7bf785068d2f7b6e7ab9091937216e45bb25de98727204f6388e4ebd3fce8dbc039c93388566241c008ee2def897a32f1f33cf99b114598d4895860ecd01b2d24b05996cd3df1691d078570ea159c06aad69d722c3520a04abe6cbddbb5784d827c2d60551bffaaa668c70e998b12adb0f204bbce0575007f20b12809beb0fa2fb73372ac7c67cf42ab9a04d4f39161c45e8d6005197b946055c9898b1a5383eb9d786531b45fb1b11f8d087167e8557e7", 0xe3) executing program 3: r0 = socket$packet(0x11, 0x3, 0x300) setsockopt$packet_int(r0, 0x107, 0xa, &(0x7f00000000c0)=0x2, 0x4) mount(0x0, 0x0, 0x0, 0x0, 0x0) socket$key(0xf, 0x3, 0x2) timer_settime(0x0, 0x1, 0x0, 0x0) r1 = openat$pfkey(0xffffffffffffff9c, &(0x7f0000003340), 0x40040, 0x0) read$FUSE(r1, &(0x7f0000005500)={0x2020}, 0x2020) madvise(&(0x7f0000000000/0x800000)=nil, 0x800000, 0xe) mlock(&(0x7f0000000000/0x800000)=nil, 0x800000) r2 = openat(0xffffffffffffff9c, &(0x7f0000000280)='./cgroup.cpu/memory.force_empty\x00', 0x2, 0x0) syz_usb_connect$uac2(0x3, 0x8c, &(0x7f0000000000)={{0x12, 0x1, 0x300, 0x0, 0x0, 0x0, 0x40, 0x1235, 0x8201, 0x40, 0x1, 0x2, 0x3, 0x1, [{{0x9, 0x2, 0x7a, 0x3, 0x1, 0x0, 0xf0, 0x3, {0x8, 0xb, 0x0, 0x2, 0x1, 0x9, 0x20, 0x6}, {{{0x9, 0x4, 0x0, 0x0, 0x0, 0x1, 0x1, 0x20, 0x0, {{0x9, 0x24, 0x1, 0x2, 0x6, 0x1a, 0x3}, [@processing_unit={0x11, 0x24, 0x8, 0x3, 0x6, [0x0, 0x0, 0x0, 0x2, 0x3, 0x0]}]}}, {}, {0x9, 0x4, 0x1, 0x1, 0x1, 0x1, 0x2, 0x20, 0x0, {}, {{0x9, 0x5, 0x1, 0x9, 0x20, 0x8, 0x5, 0x0, {0x8, 0x25, 0x1, 0x1, 0x6, 0x4, 0x4}}}}, {}, {0x9, 0x4, 0x2, 0x1, 0x1, 0x1, 0x2, 0x20, 0x0, {}, {{0x9, 0x5, 0x82, 0x9, 0x3ff, 0x3, 0xe6, 0x40, {0x8, 0x25, 0x1, 0x3, 0x3, 0xfe, 0x5}}}}}}}}]}}, &(0x7f0000000200)={0x0, 0x0, 0x0, 0x0}) socketpair$nbd(0x1, 0x1, 0x0, &(0x7f0000000040)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$SIOCSIFHWADDR(r3, 0x8924, &(0x7f0000000000)={'macsec0\x00', @random="0100"}) socket$inet(0x2, 0x2, 0x0) write(r2, &(0x7f00000002c0)='0', 0x1) executing program 4: r0 = socket$netlink(0x10, 0x3, 0x0) sendmsg$netlink(r0, &(0x7f0000000480)={0x0, 0x0, &(0x7f0000000000)=[{&(0x7f0000000040)=ANY=[@ANYBLOB="1c0000405e0001010000000000230000080041008e9d10283e"], 0x1c}], 0x1}, 0x0) executing program 1: r0 = socket$nl_audit(0x10, 0x3, 0x9) r1 = epoll_create(0x2e) fsetxattr$system_posix_acl(r1, &(0x7f00000002c0)='system.posix_acl_access\x00', 0x0, 0x0, 0x2) sendmsg$AUDIT_TTY_SET(r0, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000480)={&(0x7f0000000440)={0x18, 0x3f9, 0x201, 0x70bd29, 0x25dfdbff, {0x1, 0x201}}, 0x18}, 0x1, 0x0, 0x0, 0x8000}, 0x44004) r2 = openat$binderfs(0xffffffffffffff9c, &(0x7f00000000c0)='./binderfs/binder0\x00', 0x0, 0x0) r3 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000200)='./binderfs/binder0\x00', 0x2, 0x0) r4 = dup3(r3, r2, 0x80000) ioctl$BINDER_WRITE_READ(r4, 0xc0306201, &(0x7f0000000640)={0x8, 0x0, &(0x7f0000000000)=[@decrefs={0x40086315}], 0x0, 0x0, 0x0}) r5 = socket$pppl2tp(0x18, 0x1, 0x1) ioctl$SIOCGIFMTU(r5, 0x8921, &(0x7f0000000000)={'netpci0\x00'}) program crashed: WARNING in shmem_rmdir bisect: the chunk can be dropped bisect: testing without sub-chunk 2/3 testing program (duration=33s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): [15, 2, 9, 9, 2, 6, 6, 2, 12, 15, 2, 10] detailed listing: executing program 1: r0 = socket$packet(0x11, 0x3, 0x300) setsockopt$packet_int(r0, 0x107, 0xa, &(0x7f00000000c0)=0x2, 0x4) mount(0x0, 0x0, 0x0, 0x0, 0x0) socket$key(0xf, 0x3, 0x2) timer_settime(0x0, 0x1, 0x0, 0x0) r1 = openat$pfkey(0xffffffffffffff9c, &(0x7f0000003340), 0x40040, 0x0) read$FUSE(r1, &(0x7f0000005500)={0x2020}, 0x2020) madvise(&(0x7f0000000000/0x800000)=nil, 0x800000, 0xe) mlock(&(0x7f0000000000/0x800000)=nil, 0x800000) r2 = openat(0xffffffffffffff9c, &(0x7f0000000280)='./cgroup.cpu/memory.force_empty\x00', 0x2, 0x0) syz_usb_connect$uac2(0x3, 0x8c, &(0x7f0000000000)={{0x12, 0x1, 0x300, 0x0, 0x0, 0x0, 0x40, 0x1235, 0x8201, 0x40, 0x1, 0x2, 0x3, 0x1, [{{0x9, 0x2, 0x7a, 0x3, 0x1, 0x0, 0xf0, 0x3, {0x8, 0xb, 0x0, 0x2, 0x1, 0x9, 0x20, 0x6}, {{{0x9, 0x4, 0x0, 0x0, 0x0, 0x1, 0x1, 0x20, 0x0, {{0x9, 0x24, 0x1, 0x2, 0x6, 0x1a, 0x3}, [@processing_unit={0x11, 0x24, 0x8, 0x3, 0x6, [0x0, 0x0, 0x0, 0x2, 0x3, 0x0]}]}}, {}, {0x9, 0x4, 0x1, 0x1, 0x1, 0x1, 0x2, 0x20, 0x0, {}, {{0x9, 0x5, 0x1, 0x9, 0x20, 0x8, 0x5, 0x0, {0x8, 0x25, 0x1, 0x1, 0x6, 0x4, 0x4}}}}, {}, {0x9, 0x4, 0x2, 0x1, 0x1, 0x1, 0x2, 0x20, 0x0, {}, {{0x9, 0x5, 0x82, 0x9, 0x3ff, 0x3, 0xe6, 0x40, {0x8, 0x25, 0x1, 0x3, 0x3, 0xfe, 0x5}}}}}}}}]}}, &(0x7f0000000200)={0x0, 0x0, 0x0, 0x0}) socketpair$nbd(0x1, 0x1, 0x0, &(0x7f0000000040)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$SIOCSIFHWADDR(r3, 0x8924, &(0x7f0000000000)={'macsec0\x00', @random="0100"}) socket$inet(0x2, 0x2, 0x0) write(r2, &(0x7f00000002c0)='0', 0x1) executing program 1: r0 = socket$netlink(0x10, 0x3, 0x9) sendmsg$BATADV_CMD_GET_MESH(r0, &(0x7f00000002c0)={0x0, 0xec03, &(0x7f0000000240)={&(0x7f0000000200)={0x14, 0x0, 0x100, 0x70bd2c, 0x25dfdbfd}, 0x14}}, 0x80) executing program 4: r0 = syz_ublk_setup_io_uring(0x1d, &(0x7f0000000040)={0x0, 0x72f, 0x100, 0x8, 0x3b5}, &(0x7f0000000100)=0x0, &(0x7f0000000280)=0x0, &(0x7f00000004c0)=0x0) syz_ublk_add_dev(r0, r1, r2, r3, &(0x7f0000000200)={0x2e, 0x0, 0x0, 0xffffffffffffffff, 0xc0207504, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', {0xffffffff, 0xffff, 0x40, &(0x7f0000000440)=@new_dev={0x4, 0x3c9, 0x0, 0x0, 0x1000, 0xffffffff, 0x0, 0x0, 0x40}}}, &(0x7f0000000300)) syz_usb_control_io$lan78xx(0xffffffffffffffff, 0x0, &(0x7f0000000540)={0x34, 0x0, 0x0, &(0x7f0000000440)={0x0, 0x8, 0x1, 0x6}, 0x0, 0x0, 0x0}) openat(0xffffffffffffff9c, &(0x7f000000c380)='./file0\x00', 0x20842, 0x63) setxattr$incfs_metadata(&(0x7f0000000340)='./file0\x00', &(0x7f0000000180), 0x0, 0x0, 0x0) removexattr(&(0x7f0000000040)='./file0\x00', &(0x7f0000000080)=@known='user.incfs.metadata\x00') madvise(&(0x7f0000bdc000/0x4000)=nil, 0x86ac726dff2f4713, 0xa) syz_usb_disconnect(0xffffffffffffffff) syz_clone(0x9000, 0x0, 0x43, 0x0, 0x0, 0x0) executing program 1: mount_setattr(0xffffffffffffffff, 0x0, 0x8100, &(0x7f0000000300)={0x8, 0xf4, 0x40020}, 0x20) r0 = syz_usb_connect(0x0, 0x3a, &(0x7f0000000000)=ANY=[@ANYBLOB="12010002020000402505a1a400010102030109022800010100c0320904000001020900000524001001052406000105240100000705810310"], 0x0) open_tree(0xffffffffffffff9c, &(0x7f0000000640)='\x00', 0x89901) move_mount(0xffffffffffffff9c, &(0x7f00000004c0)='./file0\x00', 0xffffffffffffff9c, &(0x7f0000000480)='./file0\x00', 0x274) syz_usb_ep_write(r0, 0x81, 0x0, 0x0) r1 = socket$inet_udp(0x2, 0x2, 0x0) setsockopt$ARPT_SO_SET_REPLACE(r1, 0x0, 0x60, &(0x7f0000000040)={'filter\x00', 0x10, 0x4, 0x3c8, 0x110, 0x0, 0x0, 0x2e0, 0x2e0, 0x2e0, 0x4, 0x0, {[{{@arp={@private, @rand_addr, 0x0, 0x0, 0x0, 0x0, {}, {}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 'veth1_virt_wifi\x00', 'veth1_to_bridge\x00'}, 0xc0, 0x110}, @mangle={0x50, 'mangle\x00', 0x4, {@empty, @mac=@dev, @dev, @broadcast}}}, {{@uncond, 0xc0, 0xe8}, @unspec=@STANDARD={0x28, '\x00', 0x0, 0xfffffffb}}, {{@arp={@empty, @empty, 0x0, 0x0, 0x0, 0x0, {@mac}, {}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 'dvmrp0\x00', 'tunl0\x00'}, 0xc0, 0xe8}, @unspec=@MARK={0x28}}], {{'\x00', 0xc0, 0xe8}, {0x28}}}}, 0x418) syz_usb_disconnect(r0) ioctl$EVIOCRMFF(0xffffffffffffffff, 0x40044581, &(0x7f0000000040)=0x3) executing program 3: r0 = socket(0x1000000000000010, 0x80802, 0x0) sendmsg(r0, &(0x7f0000000200)={0x0, 0x0, &(0x7f0000000040)=[{&(0x7f0000000140)="55000a0018007fd500fe01b2a4a280930a06000000a843089100fe801100080008000c00080000002d000f009b2c136ef75afb83de448daa72540d8102d2c55327c43ab82286ef1fdd20642383656d4d2449155037", 0x55}], 0x1}, 0x0) executing program 3: mmap$IORING_OFF_SQ_RING(0x0, 0xc00000, 0x4000002, 0x14032, 0xffffffffffffffff, 0x0) syz_ublk_add_dev(0xffffffffffffffff, 0x0, 0x0, 0x0, &(0x7f0000000200)={0x2e, 0x0, 0x0, 0xffffffffffffffff, 0xc0207504, 0x0, 0x0, 0x0, 0x0, 0x4, 0x0, 0x0, '\x00', {0xffffffff, 0xffff, 0x40, &(0x7f0000000440)=@new_dev={0x4, 0x3c9, 0x0, 0x0, 0x1000, 0xffffffff, 0x0, 0x0, 0x40}}}, &(0x7f0000000300)=0x0) r1 = socket$inet6_tcp(0xa, 0x1, 0x0) r2 = dup(r1) syz_ublk_setup_queues(r2, r0, &(0x7f0000000180)={0x0, 0x1e99, 0x0, 0x7ffffffe, 0x257, 0x0, r2}, 0x0, 0x1, &(0x7f0000000340)={0x2e, 0x44, 0x0, 0xffffffffffffffff, 0xc0107520, 0x0, 0x0, 0x0, 0x700, {}, 0x0, 0x0, '\x00', {0xfff9, 0xa46, 0x0, 0x0}}, 0x0) ioctl$KVM_TDX_INIT_VM(0xffffffffffffffff, 0xc008aeba, &(0x7f0000000440)={0x1, 0x0, &(0x7f0000000200)=ANY=[@ANYBLOB="2000000000000000000000000000000007000000000000008f00000000800000060000000000000005000000000000003107000000000000020000000000000040000000000000000200000000000000724c000000000000020000000000000008000000000000000400000000000000060000000000000004000000000000000100000000000000ffffff7fffffffff4f000000000000006b000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000400000000000000010000008e2500000400000003000000020000005d5c0000070000000000000000000000000000000000004094040000070000001f0000000300000009000000a20000000000000000000000000000000d0000000000000001000000ffff000027"]}) executing program 3: r0 = socket$netlink(0x10, 0x3, 0x0) bind$bt_hci(0xffffffffffffffff, &(0x7f0000000100)={0x1f, 0xffff}, 0x6) r1 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000000), 0x200, 0x0) ioctl$TIOCSETD(r1, 0x5423, &(0x7f00000000c0)=0xf) ioctl$TCFLSH(r1, 0x400455c8, 0x0) sendmsg$netlink(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000001d40)=[{&(0x7f0000000100)=ANY=[@ANYBLOB="2c60000010008100000000000080000000000000", @ANYRES32=0x0, @ANYBLOB="0a043cbf", @ANYRES32, @ANYBLOB="0a001b"], 0x2c}], 0x1}, 0x0) executing program 3: r0 = socket$inet6_udplite(0xa, 0x2, 0x88) setsockopt$inet6_opts(r0, 0x29, 0x40, &(0x7f00000001c0)=ANY=[@ANYBLOB="000a000000000fd60730000000000a0000000000000000000000000000000000000000000000000000000d00000000000008100000ef60fc4bd8ecc4e3200000000006004dee00000000000032acaace3269d47147"], 0xd0060) executing program 3: r0 = openat$rtc(0xffffffffffffff9c, &(0x7f0000000000), 0x8000, 0x0) ioctl$NILFS_IOCTL_DELETE_CHECKPOINT(r0, 0x80287010, 0x0) (async) r1 = openat$ttynull(0xffffffffffffff9c, &(0x7f0000000000), 0x80840, 0x0) ioctl$FIONREAD(r1, 0x541b, &(0x7f0000000040)) r2 = socket(0x10, 0x4, 0x4) setsockopt$netlink_NETLINK_TX_RING(r2, 0x10e, 0xc, &(0x7f0000000040)={0x802}, 0x10) (async) sendmsg$nl_generic(r2, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f00000005c0)=ANY=[@ANYBLOB="640100004a00010200000000000000000a"], 0x164}}, 0x0) (async) ioctl$sock_SIOCOUTQ(r2, 0x5411, &(0x7f0000000140)) (async) mkdirat(0xffffffffffffff9c, &(0x7f0000000040)='./file0\x00', 0x1c0) rename(&(0x7f00000001c0)='./file0\x00', &(0x7f00000002c0)='./file0/file0\x00') r3 = socket$inet_icmp_raw(0x2, 0x3, 0x1) setsockopt$inet_buf(r3, 0x0, 0x9, &(0x7f0000000040)="75c72cd7db776c5e26919066b40e1d6b464f8497333258ee8caa9eb1bfae8ff81494e455aa7df3e0cb44abc7014bbf67443b7bf785068d2f7b6e7ab9091937216e45bb25de98727204f6388e4ebd3fce8dbc039c93388566241c008ee2def897a32f1f33cf99b114598d4895860ecd01b2d24b05996cd3df1691d078570ea159c06aad69d722c3520a04abe6cbddbb5784d827c2d60551bffaaa668c70e998b12adb0f204bbce0575007f20b12809beb0fa2fb73372ac7c67cf42ab9a04d4f39161c45e8d6005197b946055c9898b1a5383eb9d786531b45fb1b11f8d087167e8557e7", 0xe3) executing program 3: r0 = socket$packet(0x11, 0x3, 0x300) setsockopt$packet_int(r0, 0x107, 0xa, &(0x7f00000000c0)=0x2, 0x4) mount(0x0, 0x0, 0x0, 0x0, 0x0) socket$key(0xf, 0x3, 0x2) timer_settime(0x0, 0x1, 0x0, 0x0) r1 = openat$pfkey(0xffffffffffffff9c, &(0x7f0000003340), 0x40040, 0x0) read$FUSE(r1, &(0x7f0000005500)={0x2020}, 0x2020) madvise(&(0x7f0000000000/0x800000)=nil, 0x800000, 0xe) mlock(&(0x7f0000000000/0x800000)=nil, 0x800000) r2 = openat(0xffffffffffffff9c, &(0x7f0000000280)='./cgroup.cpu/memory.force_empty\x00', 0x2, 0x0) syz_usb_connect$uac2(0x3, 0x8c, &(0x7f0000000000)={{0x12, 0x1, 0x300, 0x0, 0x0, 0x0, 0x40, 0x1235, 0x8201, 0x40, 0x1, 0x2, 0x3, 0x1, [{{0x9, 0x2, 0x7a, 0x3, 0x1, 0x0, 0xf0, 0x3, {0x8, 0xb, 0x0, 0x2, 0x1, 0x9, 0x20, 0x6}, {{{0x9, 0x4, 0x0, 0x0, 0x0, 0x1, 0x1, 0x20, 0x0, {{0x9, 0x24, 0x1, 0x2, 0x6, 0x1a, 0x3}, [@processing_unit={0x11, 0x24, 0x8, 0x3, 0x6, [0x0, 0x0, 0x0, 0x2, 0x3, 0x0]}]}}, {}, {0x9, 0x4, 0x1, 0x1, 0x1, 0x1, 0x2, 0x20, 0x0, {}, {{0x9, 0x5, 0x1, 0x9, 0x20, 0x8, 0x5, 0x0, {0x8, 0x25, 0x1, 0x1, 0x6, 0x4, 0x4}}}}, {}, {0x9, 0x4, 0x2, 0x1, 0x1, 0x1, 0x2, 0x20, 0x0, {}, {{0x9, 0x5, 0x82, 0x9, 0x3ff, 0x3, 0xe6, 0x40, {0x8, 0x25, 0x1, 0x3, 0x3, 0xfe, 0x5}}}}}}}}]}}, &(0x7f0000000200)={0x0, 0x0, 0x0, 0x0}) socketpair$nbd(0x1, 0x1, 0x0, &(0x7f0000000040)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$SIOCSIFHWADDR(r3, 0x8924, &(0x7f0000000000)={'macsec0\x00', @random="0100"}) socket$inet(0x2, 0x2, 0x0) write(r2, &(0x7f00000002c0)='0', 0x1) executing program 4: r0 = socket$netlink(0x10, 0x3, 0x0) sendmsg$netlink(r0, &(0x7f0000000480)={0x0, 0x0, &(0x7f0000000000)=[{&(0x7f0000000040)=ANY=[@ANYBLOB="1c0000405e0001010000000000230000080041008e9d10283e"], 0x1c}], 0x1}, 0x0) executing program 1: r0 = socket$nl_audit(0x10, 0x3, 0x9) r1 = epoll_create(0x2e) fsetxattr$system_posix_acl(r1, &(0x7f00000002c0)='system.posix_acl_access\x00', 0x0, 0x0, 0x2) sendmsg$AUDIT_TTY_SET(r0, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000480)={&(0x7f0000000440)={0x18, 0x3f9, 0x201, 0x70bd29, 0x25dfdbff, {0x1, 0x201}}, 0x18}, 0x1, 0x0, 0x0, 0x8000}, 0x44004) r2 = openat$binderfs(0xffffffffffffff9c, &(0x7f00000000c0)='./binderfs/binder0\x00', 0x0, 0x0) r3 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000200)='./binderfs/binder0\x00', 0x2, 0x0) r4 = dup3(r3, r2, 0x80000) ioctl$BINDER_WRITE_READ(r4, 0xc0306201, &(0x7f0000000640)={0x8, 0x0, &(0x7f0000000000)=[@decrefs={0x40086315}], 0x0, 0x0, 0x0}) r5 = socket$pppl2tp(0x18, 0x1, 0x1) ioctl$SIOCGIFMTU(r5, 0x8921, &(0x7f0000000000)={'netpci0\x00'}) program did not crash bisect: testing without sub-chunk 3/3 testing program (duration=33s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): [13, 13, 6, 2, 15, 8, 3, 17, 6, 12, 19, 6, 10] detailed listing: executing program 33: r0 = socket$nl_sock_diag(0x10, 0x3, 0x4) pipe2$9p(&(0x7f0000000240)={0xffffffffffffffff, 0xffffffffffffffff}, 0x4000) mkdirat(0xffffffffffffff9c, &(0x7f0000000040)='./file0\x00', 0x1c0) mount$9p_fd(0x0, &(0x7f0000000000)='./file0\x00', &(0x7f00000001c0), 0x2004000, &(0x7f00000000c0)={'trans=fd,', {'rfdno', 0x3d, r1}, 0x2c, {'wfdno', 0x3d, r2}, 0x2c, {[{@cache_readahead}], [], 0x6b}}) r3 = epoll_create1(0x0) r4 = epoll_create1(0x0) epoll_ctl$EPOLL_CTL_ADD(r4, 0x1, r3, &(0x7f0000000000)={0x20000002}) epoll_ctl$EPOLL_CTL_MOD(r4, 0x3, r3, &(0x7f0000000400)={0xa0000000}) munmap(&(0x7f0000ffc000/0x2000)=nil, 0x2000) sendmsg$DCCPDIAG_GETSOCK(r0, &(0x7f0000003d40)={0x0, 0x0, &(0x7f0000003d00)={&(0x7f0000003bc0)=ANY=[@ANYBLOB="54000000130003042cbd7000ffdbdf2518da05064e214e22e38a000005000000000000020600000082210000f4ffffffff0300008f120000", @ANYRES32=0x0, @ANYBLOB="ffffffff7f000002090000f2000200000400010004000100"], 0x54}, 0x1, 0x0, 0x0, 0x4000}, 0x40000) getpid() r5 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000200)='./binderfs/binder0\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(r5, 0xc0306201, &(0x7f00000003c0)={0x4c, 0x0, &(0x7f0000000040)=[@transaction_sg={0x400c6314, {0x0, 0x0, 0x0, 0x0, 0x20, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x1000}], 0x0, 0x0, 0x0}) executing program 5: socket$nl_generic(0x10, 0x3, 0x10) socket$inet(0x2, 0x2, 0x1) socket$nl_netfilter(0x10, 0x3, 0xc) socket$nl_xfrm(0x10, 0x3, 0x6) mmap$IORING_OFF_SQ_RING(0x0, 0x8000002, 0x2000007, 0x401d031, 0xffffffffffffffff, 0x0) sendmsg$inet(0xffffffffffffffff, &(0x7f0000001b00)={0x0, 0x0, 0x0, 0x0, &(0x7f0000001d80)=ANY=[@ANYBLOB="28010000000000000100000001"], 0x128}, 0x4004000) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}) sendmsg$inet(r1, &(0x7f0000001b00)={0x0, 0x0, 0x0, 0x0, &(0x7f0000001d80)=ANY=[], 0x128}, 0x0) recvmsg$unix(r0, &(0x7f0000000000)={0x0, 0x0, 0x0, 0x0, &(0x7f00000006c0)=[@cred={{0x1c}}, @rights={{0x34, 0x1, 0x1, [0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff]}}, @rights={{0x10}}, @rights={{0x2c, 0x1, 0x1, [0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff]}}, @rights={{0x10}}], 0xa8}, 0x80) pipe2(0x0, 0x0) r4 = socket$inet6_tcp(0xa, 0x1, 0x0) r5 = dup(r4) syz_ublk_setup_queues(r5, 0x0, &(0x7f0000000040)={0x0, 0xc1, 0x10, 0xfffffffd, 0x7f}, &(0x7f0000000a80)=[{0x0, 0x0, 0xffffffffffffffff, {0x0, 0x3, 0x42, 0x3, 0x91, 0x0, r2}}, {0x0, 0x0, 0xffffffffffffffff, {0x0, 0xc81d, 0x2, 0x1, 0x3aa}}, {0x0, 0x0, 0xffffffffffffffff, {0x0, 0x93ea, 0x2000, 0x4003bfff, 0x2b9, 0x0, r3}}, {0x0, 0x0, 0xffffffffffffffff, {0x0, 0x626d, 0x800, 0x1, 0x26d}}], 0x1, 0x0, 0x0) executing program 5: mmap$IORING_OFF_SQ_RING(0x0, 0xc00000, 0x4000002, 0x14032, 0xffffffffffffffff, 0x0) syz_ublk_add_dev(0xffffffffffffffff, 0x0, 0x0, 0x0, &(0x7f0000000200)={0x2e, 0x0, 0x0, 0xffffffffffffffff, 0xc0207504, 0x0, 0x0, 0x0, 0x0, 0x4, 0x0, 0x0, '\x00', {0xffffffff, 0xffff, 0x40, &(0x7f0000000440)=@new_dev={0x4, 0x3c9, 0x0, 0x0, 0x1000, 0xffffffff, 0x0, 0x0, 0x40}}}, &(0x7f0000000300)=0x0) r1 = socket$inet6_tcp(0xa, 0x1, 0x0) r2 = dup(r1) syz_ublk_setup_queues(r2, r0, &(0x7f0000000180)={0x0, 0x1e99, 0x0, 0x7ffffffe, 0x257, 0x0, r2}, 0x0, 0x1, &(0x7f0000000340)={0x2e, 0x44, 0x0, 0xffffffffffffffff, 0xc0107520, 0x0, 0x0, 0x0, 0x21, {}, 0x0, 0x0, '\x00', {0xfff9, 0xa46, 0x0, 0x0}}, 0x0) ioctl$KVM_TDX_INIT_VM(0xffffffffffffffff, 0xc008aeba, &(0x7f0000000440)={0x1, 0x0, &(0x7f0000000200)=ANY=[@ANYBLOB="2000000000000000000000000000000007000000000000008f00000000800000060000000000000005000000000000003107000000000000020000000000000040000000000000000200000000000000724c000000000000020000000000000008000000000000000400000000000000060000000000000004000000000000000100000000000000ffffff7fffffffff4f000000000000006b000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000400000000000000010000008e2500000400000003000000020000005d5c0000070000000000000000000000000000000000004094040000070000001f0000000300000009000000a20000000000000000000000000000000d0000000000000001000000ffff000027"]}) executing program 5: r0 = socket$netlink(0x10, 0x3, 0x9) sendmsg$BATADV_CMD_GET_MESH(r0, &(0x7f00000002c0)={0x0, 0xea03, &(0x7f0000000240)={&(0x7f0000000200)={0x14, 0x0, 0x100, 0x70bd2c, 0x25dfdbfd}, 0x14}}, 0x80) executing program 5: r0 = socket$packet(0x11, 0x3, 0x300) setsockopt$packet_int(r0, 0x107, 0xa, &(0x7f00000000c0)=0x2, 0x4) mount(0x0, 0x0, 0x0, 0x0, 0x0) socket$key(0xf, 0x3, 0x2) timer_settime(0x0, 0x1, 0x0, 0x0) r1 = openat$pfkey(0xffffffffffffff9c, &(0x7f0000003340), 0x40040, 0x0) read$FUSE(r1, &(0x7f0000005500)={0x2020}, 0x2020) madvise(&(0x7f0000000000/0x800000)=nil, 0x800000, 0xe) mlock(&(0x7f0000000000/0x800000)=nil, 0x800000) r2 = openat(0xffffffffffffff9c, &(0x7f0000000280)='./cgroup.cpu/memory.force_empty\x00', 0x2, 0x0) syz_usb_connect$uac2(0x3, 0x8c, &(0x7f0000000000)={{0x12, 0x1, 0x300, 0x0, 0x0, 0x0, 0x40, 0x1235, 0x8201, 0x40, 0x1, 0x2, 0x3, 0x1, [{{0x9, 0x2, 0x7a, 0x3, 0x1, 0x0, 0xf0, 0x3, {0x8, 0xb, 0x0, 0x2, 0x1, 0x9, 0x20, 0x6}, {{{0x9, 0x4, 0x0, 0x0, 0x0, 0x1, 0x1, 0x20, 0x0, {{0x9, 0x24, 0x1, 0x2, 0x6, 0x1a, 0x3}, [@processing_unit={0x11, 0x24, 0x8, 0x3, 0x6, [0x0, 0x0, 0x0, 0x2, 0x3, 0x0]}]}}, {}, {0x9, 0x4, 0x1, 0x1, 0x1, 0x1, 0x2, 0x20, 0x0, {}, {{0x9, 0x5, 0x1, 0x9, 0x20, 0x8, 0x5, 0x0, {0x8, 0x25, 0x1, 0x1, 0x6, 0x4, 0x4}}}}, {}, {0x9, 0x4, 0x2, 0x1, 0x1, 0x1, 0x2, 0x20, 0x0, {}, {{0x9, 0x5, 0x82, 0x9, 0x3ff, 0x3, 0xe6, 0x40, {0x8, 0x25, 0x1, 0x3, 0x3, 0xfe, 0x5}}}}}}}}]}}, &(0x7f0000000200)={0x0, 0x0, 0x0, 0x0}) socketpair$nbd(0x1, 0x1, 0x0, &(0x7f0000000040)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$SIOCSIFHWADDR(r3, 0x8924, &(0x7f0000000000)={'macsec0\x00', @random="0100"}) socket$inet(0x2, 0x2, 0x0) write(r2, &(0x7f00000002c0)='0', 0x1) executing program 4: r0 = socket$netlink(0x10, 0x3, 0x0) bind$bt_hci(0xffffffffffffffff, &(0x7f0000000100)={0x1f, 0xffff}, 0x6) r1 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000000), 0x200, 0x0) r2 = socket$inet_tcp(0x2, 0x1, 0x0) getsockopt$sock_int(r2, 0x1, 0x26, 0x0, &(0x7f0000000040)) ioctl$TIOCSETD(r1, 0x5423, &(0x7f00000000c0)=0xf) ioctl$TCFLSH(r1, 0x400455c8, 0x0) sendmsg$netlink(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000080)=[{&(0x7f0000000140)=ANY=[@ANYRES8=r2, @ANYRES32=0x0, @ANYRESDEC=0x0, @ANYRES32, @ANYBLOB="0a001b"], 0x2c}], 0x1}, 0x0) executing program 4: r0 = socket(0x10, 0x803, 0x0) sendto(r0, &(0x7f0000000140)="120000001200e7ef007b00000000000000a1", 0x12, 0x0, 0x0, 0x0) recvmmsg(r0, &(0x7f0000006a40)=[{{0x0, 0x0, &(0x7f0000000900)=[{&(0x7f0000001440)=""/4112, 0x1010}, {&(0x7f0000000080)=""/90, 0x5a}, {&(0x7f0000000480)=""/42, 0x2a}, {&(0x7f0000000340)=""/88, 0x58}, {&(0x7f0000002480)=""/4102, 0x1006}, {&(0x7f0000000040)=""/10, 0xa}], 0x6, 0x0, 0x0, 0x1010}}, {{0x0, 0x0, 0x0}, 0x7ffffff}, {{0x0, 0x0, 0x0}, 0x1}, {{0x0, 0x0, 0x0}, 0x8}], 0x4, 0x12140, 0x0) executing program 4: ioctl$sock_inet_SIOCSIFDSTADDR(0xffffffffffffffff, 0x8918, &(0x7f0000000000)={'wlan0\x00', {0x2, 0x4e23, @multicast1}}) mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./file0\x00', 0x0) mkdir(&(0x7f00000000c0)='./bus\x00', 0x0) mount$incfs(&(0x7f00000007c0)='.\x00', &(0x7f0000000800)='./bus\x00', &(0x7f0000000840), 0x1804002, 0x0) chdir(&(0x7f00000003c0)='./bus\x00') mount$overlay(0x0, &(0x7f0000000100)='./file0\x00', &(0x7f0000000b80), 0x8, &(0x7f0000000240)={[{@upperdir={'upperdir', 0x3d, './file0'}}, {@workdir={'workdir', 0x3d, './bus'}}, {@lowerdir={'lowerdir', 0x3d, '.'}}]}) r0 = socket$inet6(0xa, 0x2, 0x0) madvise(&(0x7f0000000000/0x800000)=nil, 0x800000, 0xe) setsockopt$inet_int(0xffffffffffffffff, 0x0, 0x17, &(0x7f0000000180)=0xfffffffc, 0x4) syz_clone(0x20b84311, 0x0, 0x0, 0x0, 0x0, 0x0) syz_clone(0x11, 0x0, 0x0, 0x0, 0x0, 0x0) setsockopt$sock_int(r0, 0x1, 0xf, &(0x7f0000000240)=0x9, 0x4) bind$inet6(r0, &(0x7f0000000040)={0xa, 0xe22}, 0x1c) setsockopt$sock_int(r0, 0x1, 0x31, &(0x7f0000001600), 0x4) r1 = socket$netlink(0x10, 0x3, 0x8000000004) writev(r1, &(0x7f0000000000)=[{&(0x7f00000003c0)="580000001500add427323b472545b4560a117fffffff81000e220e227f000008925aa80013007b00090080007f000001e809000000ff0000ffffc7100003ffffffffffffffffffffffe7ee000000deff0000000200000000", 0x58}], 0x1) add_key(&(0x7f0000000080)='id_resolver\x00', 0x0, &(0x7f0000000400)="308201d43082017ba00302010202142eea648d7f17e62e9e5869c887c68e1bd0f86fde300a06082a8648ce3d040302303a3138303606035504030c2f436572746966696361746520766572696669636174696f6e2045434453412073656c662d74657374696e67206b65793020170d3234303431333232313632365a180f32313234303332303232313632365a303a3138303606035504030c2f43657274696669630000000000000008666963617428a2e0861e1ae90d412073656c662d74657374696e67206b65793059301306072a8648ce3d020106082a8648ce3d0301070300000000e56b51affc19412c88926b775771039ee2fe6e6a714ec7299f90e177189fc2e70a82d08ae181a9717c5a73fb25b95b1e248c739ff838f848b4ad1619c022c6a35d305b301d0603551d0e041604142900bcea1deb7bc8479a84a23d758efdfdd2b2d3301f0603551d230418301683142900bcea1deb7bc8479a84a23d758efdfdd2b2d3300c0603551d130101ff04023000300b0603551d0f040403020780300a06082a8648ce3d040302034700304402201ad7ac07c89738f489437ec7666ea5007c121db409760c996b8c265de9705cb4022073b7c77a5adb670a964219cf4f674f356aee2925f24fc810149d79691c7ad75d", 0x1d8, 0xfffffffffffffffd) executing program 5: mmap$IORING_OFF_SQ_RING(0x0, 0xc00000, 0x4000002, 0x14032, 0xffffffffffffffff, 0x0) syz_ublk_add_dev(0xffffffffffffffff, 0x0, 0x0, 0x0, &(0x7f0000000200)={0x2e, 0x0, 0x0, 0xffffffffffffffff, 0xc0207504, 0x0, 0x0, 0x0, 0x0, 0x4, 0x0, 0x0, '\x00', {0xffffffff, 0xffff, 0x40, &(0x7f0000000440)=@new_dev={0x4, 0x3c9, 0x0, 0x0, 0x1000, 0xffffffff, 0x0, 0x0, 0x40}}}, &(0x7f0000000300)=0x0) r1 = socket$inet6_tcp(0xa, 0x1, 0x0) r2 = dup(r1) syz_ublk_setup_queues(r2, r0, &(0x7f0000000180)={0x0, 0x1e99, 0x0, 0x7ffffffe, 0x257, 0x0, r2}, 0x0, 0x1, &(0x7f0000000340)={0x2e, 0x44, 0x0, 0xffffffffffffffff, 0xc0107520, 0x0, 0x0, 0x0, 0x500, {}, 0x0, 0x0, '\x00', {0xfff9, 0xa46, 0x0, 0x0}}, 0x0) ioctl$KVM_TDX_INIT_VM(0xffffffffffffffff, 0xc008aeba, &(0x7f0000000440)={0x1, 0x0, &(0x7f0000000200)=ANY=[@ANYBLOB="2000000000000000000000000000000007000000000000008f00000000800000060000000000000005000000000000003107000000000000020000000000000040000000000000000200000000000000724c000000000000020000000000000008000000000000000400000000000000060000000000000004000000000000000100000000000000ffffff7fffffffff4f000000000000006b000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000400000000000000010000008e2500000400000003000000020000005d5c0000070000000000000000000000000000000000004094040000070000001f0000000300000009000000a20000000000000000000000000000000d0000000000000001000000ffff000027"]}) executing program 5: syz_open_procfs(0x0, 0x0) timer_create(0x0, &(0x7f00000000c0)={0x0, 0x21, 0x2, @thr={0x0, 0x0}}, &(0x7f0000000340)=0x0) mprotect(&(0x7f0000000000/0xf000)=nil, 0xf000, 0x1) timer_settime(r0, 0x1, &(0x7f0000000040)={{}, {0x0, 0x989680}}, 0x0) mmap(&(0x7f0000000000/0x200000)=nil, 0x200000, 0x300000b, 0x204031, 0xffffffffffffffff, 0xec776000) madvise(&(0x7f0000c00000/0x400000)=nil, 0x400000, 0xe) syz_usb_control_io$uac1(0xffffffffffffffff, 0x0, 0x0) timer_create(0x2, &(0x7f00000000c0)={0x0, 0x12}, &(0x7f00000001c0)=0x0) timer_settime(r1, 0x0, &(0x7f0000000280)={{0x0, 0x3938700}, {0x0, 0x989680}}, 0x0) timer_create(0x7, &(0x7f0000000180)={0x0, 0x13, 0x0, @thr={0x0, 0x0}}, &(0x7f0000000240)=0x0) timer_settime(r2, 0x0, &(0x7f0000000340)={{0x0, 0x989680}, {0x0, 0x989680}}, 0x0) unshare(0x44040200) executing program 4: ioctl$KVM_XEN_HVM_CONFIG(0xffffffffffffffff, 0x4038ae7a, &(0x7f0000000100)={0x0, 0x642, &(0x7f0000000240)="235913100000004a3525c373b8be3e8d2672540e4fff5fe7", 0x0, 0x18}) r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000200), 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) ioctl$FS_IOC_GETFSLABEL(r0, 0x81009431, &(0x7f0000000000)) r2 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0) syz_usb_connect(0x3, 0x3f, &(0x7f00000002c0)=ANY=[@ANYBLOB="120100025eba07400a11301160c40102030109022d0001067f40010904f0440303b1db02090506040000ea01f409050703a8a2d4fc675d283744976fdf3c69b3d3ff0306050209050d100004ff7f00"], 0x0) ioctl$KVM_SET_USER_MEMORY_REGION(r1, 0x4020ae46, &(0x7f0000000180)={0x0, 0x0, 0x0, 0x2000, &(0x7f0000000000/0x2000)=nil}) io_setup(0x2, &(0x7f0000000000)=0x0) r4 = eventfd(0x3) write(r2, &(0x7f0000000280)="95039e414daf789aa6e411d1f3f765d8640623af5bd6e5a61a7ac0f952601b700c72a02fe4f8950fdd0e59d0ad4388bcde221e560443bc2bcd005b5677", 0x3d) io_submit(r3, 0x1, &(0x7f0000000040)=[&(0x7f0000000240)={0x0, 0x0, 0x0, 0x1, 0xc2, r4, 0x0, 0x0, 0xffffffffffffff30, 0x0, 0x0, r4}]) ioctl$KVM_SET_REGS(r2, 0x4090ae82, &(0x7f00000003c0)={[0x60000000004, 0x1000000000, 0x5, 0x41, 0x2000000, 0x0, 0x2004cc, 0x0, 0xa1b, 0x8, 0x5, 0x0, 0x3, 0x2], 0x10000, 0x202}) ioctl$KVM_RUN(r2, 0xae80, 0x0) ioctl$KVM_RUN(r2, 0xae80, 0x0) ioctl$AUTOFS_IOC_PROTOSUBVER(r0, 0x80049367, &(0x7f0000000340)) r5 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x1) syz_kvm_setup_cpu$x86(r1, r5, &(0x7f0000000000/0x18000)=nil, &(0x7f0000000500)=[@text16={0x10, &(0x7f0000000480)="660f38221dba200066b80700000066efbaf80c66b8367e948f66efbafc0cedd0930000660f38822a0f22c636f2abf30f090faf5f0866b8001000000f23c00f21f86635030006000f23f8", 0x4a}], 0x1, 0x0, &(0x7f0000000540), 0x0) ioctl$KVM_SET_SREGS(r2, 0x4138ae84, &(0x7f0000000100)={{0xfec00000, 0x80a0000, 0x0, 0xcb, 0x23, 0x10, 0x3, 0x7, 0x0, 0x8, 0x9}, {0x8080000, 0x10000, 0xc, 0x0, 0x2, 0x0, 0xfd, 0x0, 0x7, 0xff}, {0xb000, 0x8080000, 0x3, 0x3, 0x27, 0xc4, 0x0, 0x0, 0x8, 0x3, 0x40, 0x3}, {0xeeef0000, 0x33331000, 0xd, 0x9, 0x1, 0x9, 0x9, 0x7, 0x8, 0xf, 0x4}, {0x80a0000, 0xeeee8000, 0xb, 0x0, 0x0, 0x6, 0x0, 0x0, 0x0, 0x42, 0x6}, {0xb000, 0x58000, 0x9, 0x3, 0x2, 0x1, 0x2, 0x80, 0x0, 0xff, 0x6}, {0xeeee8000, 0xeeee0000, 0x3, 0x4, 0x3, 0x0, 0xa1, 0x20, 0x2, 0x0, 0x4}, {0x70000, 0x50000, 0xc, 0x7, 0x0, 0x6, 0x8, 0x40, 0x26, 0x0, 0x0, 0x2}, {0x80a0000, 0x8cc}, {0xdddd1000}, 0xddf8ffd3, 0x0, 0x0, 0x110, 0x11, 0xf801, 0x3000, [0x80000006, 0x0, 0x10000, 0xb]}) ioctl$KVM_RUN(r2, 0xae80, 0x0) executing program 1: r0 = socket$netlink(0x10, 0x3, 0x0) bind$bt_hci(0xffffffffffffffff, &(0x7f0000000100)={0x1f, 0xffff}, 0x6) r1 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000000), 0x200, 0x0) ioctl$TIOCSETD(r1, 0x5423, &(0x7f00000000c0)=0xf) ioctl$TCFLSH(r1, 0x400455c8, 0x0) sendmsg$netlink(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000001d40)=[{&(0x7f0000000100)=ANY=[@ANYBLOB="2000000010008100000000000080000000000000", @ANYRES32=0x0, @ANYBLOB="0a043cbf", @ANYRES32, @ANYBLOB="0a001b"], 0x2c}], 0x1}, 0x0) executing program 1: r0 = socket$inet6(0xa, 0x2, 0x0) ioctl$sock_ipv6_tunnel_SIOCDELTUNNEL(r0, 0x891e, &(0x7f0000000a40)={'syztnl1\x00', 0x0}) accept4$tipc(0xffffffffffffffff, &(0x7f0000000000), &(0x7f0000000080)=0x10, 0x0) r1 = accept$inet6(r0, &(0x7f00000000c0)={0xa, 0x0, 0x0, @private2}, &(0x7f0000000100)=0x1c) getsockname(r1, 0x0, &(0x7f0000000040)=0x2b) socket$inet6(0xa, 0x2, 0x0) (async) ioctl$sock_ipv6_tunnel_SIOCDELTUNNEL(r0, 0x891e, &(0x7f0000000a40)={'syztnl1\x00', 0x0}) (async) accept4$tipc(0xffffffffffffffff, &(0x7f0000000000), &(0x7f0000000080)=0x10, 0x0) (async) accept$inet6(r0, &(0x7f00000000c0)={0xa, 0x0, 0x0, @private2}, &(0x7f0000000100)=0x1c) (async) getsockname(r1, 0x0, &(0x7f0000000040)=0x2b) (async) program crashed: WARNING in shmem_rmdir bisect: the chunk can be dropped bisect: split chunks (needed=true): <13> bisect: split chunk #0 of len 13 into 2 parts bisect: testing without sub-chunk 1/2 testing program (duration=31s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): [17, 6, 12, 19, 6, 10] detailed listing: executing program 4: ioctl$sock_inet_SIOCSIFDSTADDR(0xffffffffffffffff, 0x8918, &(0x7f0000000000)={'wlan0\x00', {0x2, 0x4e23, @multicast1}}) mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./file0\x00', 0x0) mkdir(&(0x7f00000000c0)='./bus\x00', 0x0) mount$incfs(&(0x7f00000007c0)='.\x00', &(0x7f0000000800)='./bus\x00', &(0x7f0000000840), 0x1804002, 0x0) chdir(&(0x7f00000003c0)='./bus\x00') mount$overlay(0x0, &(0x7f0000000100)='./file0\x00', &(0x7f0000000b80), 0x8, &(0x7f0000000240)={[{@upperdir={'upperdir', 0x3d, './file0'}}, {@workdir={'workdir', 0x3d, './bus'}}, {@lowerdir={'lowerdir', 0x3d, '.'}}]}) r0 = socket$inet6(0xa, 0x2, 0x0) madvise(&(0x7f0000000000/0x800000)=nil, 0x800000, 0xe) setsockopt$inet_int(0xffffffffffffffff, 0x0, 0x17, &(0x7f0000000180)=0xfffffffc, 0x4) syz_clone(0x20b84311, 0x0, 0x0, 0x0, 0x0, 0x0) syz_clone(0x11, 0x0, 0x0, 0x0, 0x0, 0x0) setsockopt$sock_int(r0, 0x1, 0xf, &(0x7f0000000240)=0x9, 0x4) bind$inet6(r0, &(0x7f0000000040)={0xa, 0xe22}, 0x1c) setsockopt$sock_int(r0, 0x1, 0x31, &(0x7f0000001600), 0x4) r1 = socket$netlink(0x10, 0x3, 0x8000000004) writev(r1, &(0x7f0000000000)=[{&(0x7f00000003c0)="580000001500add427323b472545b4560a117fffffff81000e220e227f000008925aa80013007b00090080007f000001e809000000ff0000ffffc7100003ffffffffffffffffffffffe7ee000000deff0000000200000000", 0x58}], 0x1) add_key(&(0x7f0000000080)='id_resolver\x00', 0x0, &(0x7f0000000400)="308201d43082017ba00302010202142eea648d7f17e62e9e5869c887c68e1bd0f86fde300a06082a8648ce3d040302303a3138303606035504030c2f436572746966696361746520766572696669636174696f6e2045434453412073656c662d74657374696e67206b65793020170d3234303431333232313632365a180f32313234303332303232313632365a303a3138303606035504030c2f43657274696669630000000000000008666963617428a2e0861e1ae90d412073656c662d74657374696e67206b65793059301306072a8648ce3d020106082a8648ce3d0301070300000000e56b51affc19412c88926b775771039ee2fe6e6a714ec7299f90e177189fc2e70a82d08ae181a9717c5a73fb25b95b1e248c739ff838f848b4ad1619c022c6a35d305b301d0603551d0e041604142900bcea1deb7bc8479a84a23d758efdfdd2b2d3301f0603551d230418301683142900bcea1deb7bc8479a84a23d758efdfdd2b2d3300c0603551d130101ff04023000300b0603551d0f040403020780300a06082a8648ce3d040302034700304402201ad7ac07c89738f489437ec7666ea5007c121db409760c996b8c265de9705cb4022073b7c77a5adb670a964219cf4f674f356aee2925f24fc810149d79691c7ad75d", 0x1d8, 0xfffffffffffffffd) executing program 5: mmap$IORING_OFF_SQ_RING(0x0, 0xc00000, 0x4000002, 0x14032, 0xffffffffffffffff, 0x0) syz_ublk_add_dev(0xffffffffffffffff, 0x0, 0x0, 0x0, &(0x7f0000000200)={0x2e, 0x0, 0x0, 0xffffffffffffffff, 0xc0207504, 0x0, 0x0, 0x0, 0x0, 0x4, 0x0, 0x0, '\x00', {0xffffffff, 0xffff, 0x40, &(0x7f0000000440)=@new_dev={0x4, 0x3c9, 0x0, 0x0, 0x1000, 0xffffffff, 0x0, 0x0, 0x40}}}, &(0x7f0000000300)=0x0) r1 = socket$inet6_tcp(0xa, 0x1, 0x0) r2 = dup(r1) syz_ublk_setup_queues(r2, r0, &(0x7f0000000180)={0x0, 0x1e99, 0x0, 0x7ffffffe, 0x257, 0x0, r2}, 0x0, 0x1, &(0x7f0000000340)={0x2e, 0x44, 0x0, 0xffffffffffffffff, 0xc0107520, 0x0, 0x0, 0x0, 0x500, {}, 0x0, 0x0, '\x00', {0xfff9, 0xa46, 0x0, 0x0}}, 0x0) ioctl$KVM_TDX_INIT_VM(0xffffffffffffffff, 0xc008aeba, &(0x7f0000000440)={0x1, 0x0, &(0x7f0000000200)=ANY=[@ANYBLOB="2000000000000000000000000000000007000000000000008f00000000800000060000000000000005000000000000003107000000000000020000000000000040000000000000000200000000000000724c000000000000020000000000000008000000000000000400000000000000060000000000000004000000000000000100000000000000ffffff7fffffffff4f000000000000006b000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000400000000000000010000008e2500000400000003000000020000005d5c0000070000000000000000000000000000000000004094040000070000001f0000000300000009000000a20000000000000000000000000000000d0000000000000001000000ffff000027"]}) executing program 5: syz_open_procfs(0x0, 0x0) timer_create(0x0, &(0x7f00000000c0)={0x0, 0x21, 0x2, @thr={0x0, 0x0}}, &(0x7f0000000340)=0x0) mprotect(&(0x7f0000000000/0xf000)=nil, 0xf000, 0x1) timer_settime(r0, 0x1, &(0x7f0000000040)={{}, {0x0, 0x989680}}, 0x0) mmap(&(0x7f0000000000/0x200000)=nil, 0x200000, 0x300000b, 0x204031, 0xffffffffffffffff, 0xec776000) madvise(&(0x7f0000c00000/0x400000)=nil, 0x400000, 0xe) syz_usb_control_io$uac1(0xffffffffffffffff, 0x0, 0x0) timer_create(0x2, &(0x7f00000000c0)={0x0, 0x12}, &(0x7f00000001c0)=0x0) timer_settime(r1, 0x0, &(0x7f0000000280)={{0x0, 0x3938700}, {0x0, 0x989680}}, 0x0) timer_create(0x7, &(0x7f0000000180)={0x0, 0x13, 0x0, @thr={0x0, 0x0}}, &(0x7f0000000240)=0x0) timer_settime(r2, 0x0, &(0x7f0000000340)={{0x0, 0x989680}, {0x0, 0x989680}}, 0x0) unshare(0x44040200) executing program 4: ioctl$KVM_XEN_HVM_CONFIG(0xffffffffffffffff, 0x4038ae7a, &(0x7f0000000100)={0x0, 0x642, &(0x7f0000000240)="235913100000004a3525c373b8be3e8d2672540e4fff5fe7", 0x0, 0x18}) r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000200), 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) ioctl$FS_IOC_GETFSLABEL(r0, 0x81009431, &(0x7f0000000000)) r2 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0) syz_usb_connect(0x3, 0x3f, &(0x7f00000002c0)=ANY=[@ANYBLOB="120100025eba07400a11301160c40102030109022d0001067f40010904f0440303b1db02090506040000ea01f409050703a8a2d4fc675d283744976fdf3c69b3d3ff0306050209050d100004ff7f00"], 0x0) ioctl$KVM_SET_USER_MEMORY_REGION(r1, 0x4020ae46, &(0x7f0000000180)={0x0, 0x0, 0x0, 0x2000, &(0x7f0000000000/0x2000)=nil}) io_setup(0x2, &(0x7f0000000000)=0x0) r4 = eventfd(0x3) write(r2, &(0x7f0000000280)="95039e414daf789aa6e411d1f3f765d8640623af5bd6e5a61a7ac0f952601b700c72a02fe4f8950fdd0e59d0ad4388bcde221e560443bc2bcd005b5677", 0x3d) io_submit(r3, 0x1, &(0x7f0000000040)=[&(0x7f0000000240)={0x0, 0x0, 0x0, 0x1, 0xc2, r4, 0x0, 0x0, 0xffffffffffffff30, 0x0, 0x0, r4}]) ioctl$KVM_SET_REGS(r2, 0x4090ae82, &(0x7f00000003c0)={[0x60000000004, 0x1000000000, 0x5, 0x41, 0x2000000, 0x0, 0x2004cc, 0x0, 0xa1b, 0x8, 0x5, 0x0, 0x3, 0x2], 0x10000, 0x202}) ioctl$KVM_RUN(r2, 0xae80, 0x0) ioctl$KVM_RUN(r2, 0xae80, 0x0) ioctl$AUTOFS_IOC_PROTOSUBVER(r0, 0x80049367, &(0x7f0000000340)) r5 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x1) syz_kvm_setup_cpu$x86(r1, r5, &(0x7f0000000000/0x18000)=nil, &(0x7f0000000500)=[@text16={0x10, &(0x7f0000000480)="660f38221dba200066b80700000066efbaf80c66b8367e948f66efbafc0cedd0930000660f38822a0f22c636f2abf30f090faf5f0866b8001000000f23c00f21f86635030006000f23f8", 0x4a}], 0x1, 0x0, &(0x7f0000000540), 0x0) ioctl$KVM_SET_SREGS(r2, 0x4138ae84, &(0x7f0000000100)={{0xfec00000, 0x80a0000, 0x0, 0xcb, 0x23, 0x10, 0x3, 0x7, 0x0, 0x8, 0x9}, {0x8080000, 0x10000, 0xc, 0x0, 0x2, 0x0, 0xfd, 0x0, 0x7, 0xff}, {0xb000, 0x8080000, 0x3, 0x3, 0x27, 0xc4, 0x0, 0x0, 0x8, 0x3, 0x40, 0x3}, {0xeeef0000, 0x33331000, 0xd, 0x9, 0x1, 0x9, 0x9, 0x7, 0x8, 0xf, 0x4}, {0x80a0000, 0xeeee8000, 0xb, 0x0, 0x0, 0x6, 0x0, 0x0, 0x0, 0x42, 0x6}, {0xb000, 0x58000, 0x9, 0x3, 0x2, 0x1, 0x2, 0x80, 0x0, 0xff, 0x6}, {0xeeee8000, 0xeeee0000, 0x3, 0x4, 0x3, 0x0, 0xa1, 0x20, 0x2, 0x0, 0x4}, {0x70000, 0x50000, 0xc, 0x7, 0x0, 0x6, 0x8, 0x40, 0x26, 0x0, 0x0, 0x2}, {0x80a0000, 0x8cc}, {0xdddd1000}, 0xddf8ffd3, 0x0, 0x0, 0x110, 0x11, 0xf801, 0x3000, [0x80000006, 0x0, 0x10000, 0xb]}) ioctl$KVM_RUN(r2, 0xae80, 0x0) executing program 1: r0 = socket$netlink(0x10, 0x3, 0x0) bind$bt_hci(0xffffffffffffffff, &(0x7f0000000100)={0x1f, 0xffff}, 0x6) r1 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000000), 0x200, 0x0) ioctl$TIOCSETD(r1, 0x5423, &(0x7f00000000c0)=0xf) ioctl$TCFLSH(r1, 0x400455c8, 0x0) sendmsg$netlink(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000001d40)=[{&(0x7f0000000100)=ANY=[@ANYBLOB="2000000010008100000000000080000000000000", @ANYRES32=0x0, @ANYBLOB="0a043cbf", @ANYRES32, @ANYBLOB="0a001b"], 0x2c}], 0x1}, 0x0) executing program 1: r0 = socket$inet6(0xa, 0x2, 0x0) ioctl$sock_ipv6_tunnel_SIOCDELTUNNEL(r0, 0x891e, &(0x7f0000000a40)={'syztnl1\x00', 0x0}) accept4$tipc(0xffffffffffffffff, &(0x7f0000000000), &(0x7f0000000080)=0x10, 0x0) r1 = accept$inet6(r0, &(0x7f00000000c0)={0xa, 0x0, 0x0, @private2}, &(0x7f0000000100)=0x1c) getsockname(r1, 0x0, &(0x7f0000000040)=0x2b) socket$inet6(0xa, 0x2, 0x0) (async) ioctl$sock_ipv6_tunnel_SIOCDELTUNNEL(r0, 0x891e, &(0x7f0000000a40)={'syztnl1\x00', 0x0}) (async) accept4$tipc(0xffffffffffffffff, &(0x7f0000000000), &(0x7f0000000080)=0x10, 0x0) (async) accept$inet6(r0, &(0x7f00000000c0)={0xa, 0x0, 0x0, @private2}, &(0x7f0000000100)=0x1c) (async) getsockname(r1, 0x0, &(0x7f0000000040)=0x2b) (async) program crashed: WARNING in shmem_rmdir bisect: the chunk can be dropped bisect: testing without sub-chunk 2/2 bisect: no need to test this chunk, it's definitely needed bisect: split chunks (needed=true): <6> bisect: split chunk #0 of len 6 into 2 parts bisect: testing without sub-chunk 1/2 testing program (duration=30s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): [19, 6, 10] detailed listing: executing program 4: ioctl$KVM_XEN_HVM_CONFIG(0xffffffffffffffff, 0x4038ae7a, &(0x7f0000000100)={0x0, 0x642, &(0x7f0000000240)="235913100000004a3525c373b8be3e8d2672540e4fff5fe7", 0x0, 0x18}) r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000200), 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) ioctl$FS_IOC_GETFSLABEL(r0, 0x81009431, &(0x7f0000000000)) r2 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0) syz_usb_connect(0x3, 0x3f, &(0x7f00000002c0)=ANY=[@ANYBLOB="120100025eba07400a11301160c40102030109022d0001067f40010904f0440303b1db02090506040000ea01f409050703a8a2d4fc675d283744976fdf3c69b3d3ff0306050209050d100004ff7f00"], 0x0) ioctl$KVM_SET_USER_MEMORY_REGION(r1, 0x4020ae46, &(0x7f0000000180)={0x0, 0x0, 0x0, 0x2000, &(0x7f0000000000/0x2000)=nil}) io_setup(0x2, &(0x7f0000000000)=0x0) r4 = eventfd(0x3) write(r2, &(0x7f0000000280)="95039e414daf789aa6e411d1f3f765d8640623af5bd6e5a61a7ac0f952601b700c72a02fe4f8950fdd0e59d0ad4388bcde221e560443bc2bcd005b5677", 0x3d) io_submit(r3, 0x1, &(0x7f0000000040)=[&(0x7f0000000240)={0x0, 0x0, 0x0, 0x1, 0xc2, r4, 0x0, 0x0, 0xffffffffffffff30, 0x0, 0x0, r4}]) ioctl$KVM_SET_REGS(r2, 0x4090ae82, &(0x7f00000003c0)={[0x60000000004, 0x1000000000, 0x5, 0x41, 0x2000000, 0x0, 0x2004cc, 0x0, 0xa1b, 0x8, 0x5, 0x0, 0x3, 0x2], 0x10000, 0x202}) ioctl$KVM_RUN(r2, 0xae80, 0x0) ioctl$KVM_RUN(r2, 0xae80, 0x0) ioctl$AUTOFS_IOC_PROTOSUBVER(r0, 0x80049367, &(0x7f0000000340)) r5 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x1) syz_kvm_setup_cpu$x86(r1, r5, &(0x7f0000000000/0x18000)=nil, &(0x7f0000000500)=[@text16={0x10, &(0x7f0000000480)="660f38221dba200066b80700000066efbaf80c66b8367e948f66efbafc0cedd0930000660f38822a0f22c636f2abf30f090faf5f0866b8001000000f23c00f21f86635030006000f23f8", 0x4a}], 0x1, 0x0, &(0x7f0000000540), 0x0) ioctl$KVM_SET_SREGS(r2, 0x4138ae84, &(0x7f0000000100)={{0xfec00000, 0x80a0000, 0x0, 0xcb, 0x23, 0x10, 0x3, 0x7, 0x0, 0x8, 0x9}, {0x8080000, 0x10000, 0xc, 0x0, 0x2, 0x0, 0xfd, 0x0, 0x7, 0xff}, {0xb000, 0x8080000, 0x3, 0x3, 0x27, 0xc4, 0x0, 0x0, 0x8, 0x3, 0x40, 0x3}, {0xeeef0000, 0x33331000, 0xd, 0x9, 0x1, 0x9, 0x9, 0x7, 0x8, 0xf, 0x4}, {0x80a0000, 0xeeee8000, 0xb, 0x0, 0x0, 0x6, 0x0, 0x0, 0x0, 0x42, 0x6}, {0xb000, 0x58000, 0x9, 0x3, 0x2, 0x1, 0x2, 0x80, 0x0, 0xff, 0x6}, {0xeeee8000, 0xeeee0000, 0x3, 0x4, 0x3, 0x0, 0xa1, 0x20, 0x2, 0x0, 0x4}, {0x70000, 0x50000, 0xc, 0x7, 0x0, 0x6, 0x8, 0x40, 0x26, 0x0, 0x0, 0x2}, {0x80a0000, 0x8cc}, {0xdddd1000}, 0xddf8ffd3, 0x0, 0x0, 0x110, 0x11, 0xf801, 0x3000, [0x80000006, 0x0, 0x10000, 0xb]}) ioctl$KVM_RUN(r2, 0xae80, 0x0) executing program 1: r0 = socket$netlink(0x10, 0x3, 0x0) bind$bt_hci(0xffffffffffffffff, &(0x7f0000000100)={0x1f, 0xffff}, 0x6) r1 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000000), 0x200, 0x0) ioctl$TIOCSETD(r1, 0x5423, &(0x7f00000000c0)=0xf) ioctl$TCFLSH(r1, 0x400455c8, 0x0) sendmsg$netlink(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000001d40)=[{&(0x7f0000000100)=ANY=[@ANYBLOB="2000000010008100000000000080000000000000", @ANYRES32=0x0, @ANYBLOB="0a043cbf", @ANYRES32, @ANYBLOB="0a001b"], 0x2c}], 0x1}, 0x0) executing program 1: r0 = socket$inet6(0xa, 0x2, 0x0) ioctl$sock_ipv6_tunnel_SIOCDELTUNNEL(r0, 0x891e, &(0x7f0000000a40)={'syztnl1\x00', 0x0}) accept4$tipc(0xffffffffffffffff, &(0x7f0000000000), &(0x7f0000000080)=0x10, 0x0) r1 = accept$inet6(r0, &(0x7f00000000c0)={0xa, 0x0, 0x0, @private2}, &(0x7f0000000100)=0x1c) getsockname(r1, 0x0, &(0x7f0000000040)=0x2b) socket$inet6(0xa, 0x2, 0x0) (async) ioctl$sock_ipv6_tunnel_SIOCDELTUNNEL(r0, 0x891e, &(0x7f0000000a40)={'syztnl1\x00', 0x0}) (async) accept4$tipc(0xffffffffffffffff, &(0x7f0000000000), &(0x7f0000000080)=0x10, 0x0) (async) accept$inet6(r0, &(0x7f00000000c0)={0xa, 0x0, 0x0, @private2}, &(0x7f0000000100)=0x1c) (async) getsockname(r1, 0x0, &(0x7f0000000040)=0x2b) (async) program did not crash bisect: testing without sub-chunk 2/2 testing program (duration=30s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): [17, 6, 12] detailed listing: executing program 4: ioctl$sock_inet_SIOCSIFDSTADDR(0xffffffffffffffff, 0x8918, &(0x7f0000000000)={'wlan0\x00', {0x2, 0x4e23, @multicast1}}) mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./file0\x00', 0x0) mkdir(&(0x7f00000000c0)='./bus\x00', 0x0) mount$incfs(&(0x7f00000007c0)='.\x00', &(0x7f0000000800)='./bus\x00', &(0x7f0000000840), 0x1804002, 0x0) chdir(&(0x7f00000003c0)='./bus\x00') mount$overlay(0x0, &(0x7f0000000100)='./file0\x00', &(0x7f0000000b80), 0x8, &(0x7f0000000240)={[{@upperdir={'upperdir', 0x3d, './file0'}}, {@workdir={'workdir', 0x3d, './bus'}}, {@lowerdir={'lowerdir', 0x3d, '.'}}]}) r0 = socket$inet6(0xa, 0x2, 0x0) madvise(&(0x7f0000000000/0x800000)=nil, 0x800000, 0xe) setsockopt$inet_int(0xffffffffffffffff, 0x0, 0x17, &(0x7f0000000180)=0xfffffffc, 0x4) syz_clone(0x20b84311, 0x0, 0x0, 0x0, 0x0, 0x0) syz_clone(0x11, 0x0, 0x0, 0x0, 0x0, 0x0) setsockopt$sock_int(r0, 0x1, 0xf, &(0x7f0000000240)=0x9, 0x4) bind$inet6(r0, &(0x7f0000000040)={0xa, 0xe22}, 0x1c) setsockopt$sock_int(r0, 0x1, 0x31, &(0x7f0000001600), 0x4) r1 = socket$netlink(0x10, 0x3, 0x8000000004) writev(r1, &(0x7f0000000000)=[{&(0x7f00000003c0)="580000001500add427323b472545b4560a117fffffff81000e220e227f000008925aa80013007b00090080007f000001e809000000ff0000ffffc7100003ffffffffffffffffffffffe7ee000000deff0000000200000000", 0x58}], 0x1) add_key(&(0x7f0000000080)='id_resolver\x00', 0x0, &(0x7f0000000400)="308201d43082017ba00302010202142eea648d7f17e62e9e5869c887c68e1bd0f86fde300a06082a8648ce3d040302303a3138303606035504030c2f436572746966696361746520766572696669636174696f6e2045434453412073656c662d74657374696e67206b65793020170d3234303431333232313632365a180f32313234303332303232313632365a303a3138303606035504030c2f43657274696669630000000000000008666963617428a2e0861e1ae90d412073656c662d74657374696e67206b65793059301306072a8648ce3d020106082a8648ce3d0301070300000000e56b51affc19412c88926b775771039ee2fe6e6a714ec7299f90e177189fc2e70a82d08ae181a9717c5a73fb25b95b1e248c739ff838f848b4ad1619c022c6a35d305b301d0603551d0e041604142900bcea1deb7bc8479a84a23d758efdfdd2b2d3301f0603551d230418301683142900bcea1deb7bc8479a84a23d758efdfdd2b2d3300c0603551d130101ff04023000300b0603551d0f040403020780300a06082a8648ce3d040302034700304402201ad7ac07c89738f489437ec7666ea5007c121db409760c996b8c265de9705cb4022073b7c77a5adb670a964219cf4f674f356aee2925f24fc810149d79691c7ad75d", 0x1d8, 0xfffffffffffffffd) executing program 5: mmap$IORING_OFF_SQ_RING(0x0, 0xc00000, 0x4000002, 0x14032, 0xffffffffffffffff, 0x0) syz_ublk_add_dev(0xffffffffffffffff, 0x0, 0x0, 0x0, &(0x7f0000000200)={0x2e, 0x0, 0x0, 0xffffffffffffffff, 0xc0207504, 0x0, 0x0, 0x0, 0x0, 0x4, 0x0, 0x0, '\x00', {0xffffffff, 0xffff, 0x40, &(0x7f0000000440)=@new_dev={0x4, 0x3c9, 0x0, 0x0, 0x1000, 0xffffffff, 0x0, 0x0, 0x40}}}, &(0x7f0000000300)=0x0) r1 = socket$inet6_tcp(0xa, 0x1, 0x0) r2 = dup(r1) syz_ublk_setup_queues(r2, r0, &(0x7f0000000180)={0x0, 0x1e99, 0x0, 0x7ffffffe, 0x257, 0x0, r2}, 0x0, 0x1, &(0x7f0000000340)={0x2e, 0x44, 0x0, 0xffffffffffffffff, 0xc0107520, 0x0, 0x0, 0x0, 0x500, {}, 0x0, 0x0, '\x00', {0xfff9, 0xa46, 0x0, 0x0}}, 0x0) ioctl$KVM_TDX_INIT_VM(0xffffffffffffffff, 0xc008aeba, &(0x7f0000000440)={0x1, 0x0, &(0x7f0000000200)=ANY=[@ANYBLOB="2000000000000000000000000000000007000000000000008f00000000800000060000000000000005000000000000003107000000000000020000000000000040000000000000000200000000000000724c000000000000020000000000000008000000000000000400000000000000060000000000000004000000000000000100000000000000ffffff7fffffffff4f000000000000006b000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000400000000000000010000008e2500000400000003000000020000005d5c0000070000000000000000000000000000000000004094040000070000001f0000000300000009000000a20000000000000000000000000000000d0000000000000001000000ffff000027"]}) executing program 5: syz_open_procfs(0x0, 0x0) timer_create(0x0, &(0x7f00000000c0)={0x0, 0x21, 0x2, @thr={0x0, 0x0}}, &(0x7f0000000340)=0x0) mprotect(&(0x7f0000000000/0xf000)=nil, 0xf000, 0x1) timer_settime(r0, 0x1, &(0x7f0000000040)={{}, {0x0, 0x989680}}, 0x0) mmap(&(0x7f0000000000/0x200000)=nil, 0x200000, 0x300000b, 0x204031, 0xffffffffffffffff, 0xec776000) madvise(&(0x7f0000c00000/0x400000)=nil, 0x400000, 0xe) syz_usb_control_io$uac1(0xffffffffffffffff, 0x0, 0x0) timer_create(0x2, &(0x7f00000000c0)={0x0, 0x12}, &(0x7f00000001c0)=0x0) timer_settime(r1, 0x0, &(0x7f0000000280)={{0x0, 0x3938700}, {0x0, 0x989680}}, 0x0) timer_create(0x7, &(0x7f0000000180)={0x0, 0x13, 0x0, @thr={0x0, 0x0}}, &(0x7f0000000240)=0x0) timer_settime(r2, 0x0, &(0x7f0000000340)={{0x0, 0x989680}, {0x0, 0x989680}}, 0x0) unshare(0x44040200) program crashed: WARNING in shmem_rmdir bisect: the chunk can be dropped bisect: split chunks (needed=true): <3> bisect: split chunk #0 of len 3 into 2 parts bisect: testing without sub-chunk 1/2 testing program (duration=30s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_open_procfs-timer_create-mprotect-timer_settime-mmap-madvise-syz_usb_control_io$uac1-timer_create-timer_settime-timer_create-timer_settime-unshare detailed listing: executing program 5: syz_open_procfs(0x0, 0x0) timer_create(0x0, &(0x7f00000000c0)={0x0, 0x21, 0x2, @thr={0x0, 0x0}}, &(0x7f0000000340)=0x0) mprotect(&(0x7f0000000000/0xf000)=nil, 0xf000, 0x1) timer_settime(r0, 0x1, &(0x7f0000000040)={{}, {0x0, 0x989680}}, 0x0) mmap(&(0x7f0000000000/0x200000)=nil, 0x200000, 0x300000b, 0x204031, 0xffffffffffffffff, 0xec776000) madvise(&(0x7f0000c00000/0x400000)=nil, 0x400000, 0xe) syz_usb_control_io$uac1(0xffffffffffffffff, 0x0, 0x0) timer_create(0x2, &(0x7f00000000c0)={0x0, 0x12}, &(0x7f00000001c0)=0x0) timer_settime(r1, 0x0, &(0x7f0000000280)={{0x0, 0x3938700}, {0x0, 0x989680}}, 0x0) timer_create(0x7, &(0x7f0000000180)={0x0, 0x13, 0x0, @thr={0x0, 0x0}}, &(0x7f0000000240)=0x0) timer_settime(r2, 0x0, &(0x7f0000000340)={{0x0, 0x989680}, {0x0, 0x989680}}, 0x0) unshare(0x44040200) program did not crash bisect: testing without sub-chunk 2/2 testing program (duration=30s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): [17, 6] detailed listing: executing program 4: ioctl$sock_inet_SIOCSIFDSTADDR(0xffffffffffffffff, 0x8918, &(0x7f0000000000)={'wlan0\x00', {0x2, 0x4e23, @multicast1}}) mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./file0\x00', 0x0) mkdir(&(0x7f00000000c0)='./bus\x00', 0x0) mount$incfs(&(0x7f00000007c0)='.\x00', &(0x7f0000000800)='./bus\x00', &(0x7f0000000840), 0x1804002, 0x0) chdir(&(0x7f00000003c0)='./bus\x00') mount$overlay(0x0, &(0x7f0000000100)='./file0\x00', &(0x7f0000000b80), 0x8, &(0x7f0000000240)={[{@upperdir={'upperdir', 0x3d, './file0'}}, {@workdir={'workdir', 0x3d, './bus'}}, {@lowerdir={'lowerdir', 0x3d, '.'}}]}) r0 = socket$inet6(0xa, 0x2, 0x0) madvise(&(0x7f0000000000/0x800000)=nil, 0x800000, 0xe) setsockopt$inet_int(0xffffffffffffffff, 0x0, 0x17, &(0x7f0000000180)=0xfffffffc, 0x4) syz_clone(0x20b84311, 0x0, 0x0, 0x0, 0x0, 0x0) syz_clone(0x11, 0x0, 0x0, 0x0, 0x0, 0x0) setsockopt$sock_int(r0, 0x1, 0xf, &(0x7f0000000240)=0x9, 0x4) bind$inet6(r0, &(0x7f0000000040)={0xa, 0xe22}, 0x1c) setsockopt$sock_int(r0, 0x1, 0x31, &(0x7f0000001600), 0x4) r1 = socket$netlink(0x10, 0x3, 0x8000000004) writev(r1, &(0x7f0000000000)=[{&(0x7f00000003c0)="580000001500add427323b472545b4560a117fffffff81000e220e227f000008925aa80013007b00090080007f000001e809000000ff0000ffffc7100003ffffffffffffffffffffffe7ee000000deff0000000200000000", 0x58}], 0x1) add_key(&(0x7f0000000080)='id_resolver\x00', 0x0, &(0x7f0000000400)="308201d43082017ba00302010202142eea648d7f17e62e9e5869c887c68e1bd0f86fde300a06082a8648ce3d040302303a3138303606035504030c2f436572746966696361746520766572696669636174696f6e2045434453412073656c662d74657374696e67206b65793020170d3234303431333232313632365a180f32313234303332303232313632365a303a3138303606035504030c2f43657274696669630000000000000008666963617428a2e0861e1ae90d412073656c662d74657374696e67206b65793059301306072a8648ce3d020106082a8648ce3d0301070300000000e56b51affc19412c88926b775771039ee2fe6e6a714ec7299f90e177189fc2e70a82d08ae181a9717c5a73fb25b95b1e248c739ff838f848b4ad1619c022c6a35d305b301d0603551d0e041604142900bcea1deb7bc8479a84a23d758efdfdd2b2d3301f0603551d230418301683142900bcea1deb7bc8479a84a23d758efdfdd2b2d3300c0603551d130101ff04023000300b0603551d0f040403020780300a06082a8648ce3d040302034700304402201ad7ac07c89738f489437ec7666ea5007c121db409760c996b8c265de9705cb4022073b7c77a5adb670a964219cf4f674f356aee2925f24fc810149d79691c7ad75d", 0x1d8, 0xfffffffffffffffd) executing program 5: mmap$IORING_OFF_SQ_RING(0x0, 0xc00000, 0x4000002, 0x14032, 0xffffffffffffffff, 0x0) syz_ublk_add_dev(0xffffffffffffffff, 0x0, 0x0, 0x0, &(0x7f0000000200)={0x2e, 0x0, 0x0, 0xffffffffffffffff, 0xc0207504, 0x0, 0x0, 0x0, 0x0, 0x4, 0x0, 0x0, '\x00', {0xffffffff, 0xffff, 0x40, &(0x7f0000000440)=@new_dev={0x4, 0x3c9, 0x0, 0x0, 0x1000, 0xffffffff, 0x0, 0x0, 0x40}}}, &(0x7f0000000300)=0x0) r1 = socket$inet6_tcp(0xa, 0x1, 0x0) r2 = dup(r1) syz_ublk_setup_queues(r2, r0, &(0x7f0000000180)={0x0, 0x1e99, 0x0, 0x7ffffffe, 0x257, 0x0, r2}, 0x0, 0x1, &(0x7f0000000340)={0x2e, 0x44, 0x0, 0xffffffffffffffff, 0xc0107520, 0x0, 0x0, 0x0, 0x500, {}, 0x0, 0x0, '\x00', {0xfff9, 0xa46, 0x0, 0x0}}, 0x0) ioctl$KVM_TDX_INIT_VM(0xffffffffffffffff, 0xc008aeba, &(0x7f0000000440)={0x1, 0x0, &(0x7f0000000200)=ANY=[@ANYBLOB="2000000000000000000000000000000007000000000000008f00000000800000060000000000000005000000000000003107000000000000020000000000000040000000000000000200000000000000724c000000000000020000000000000008000000000000000400000000000000060000000000000004000000000000000100000000000000ffffff7fffffffff4f000000000000006b000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000400000000000000010000008e2500000400000003000000020000005d5c0000070000000000000000000000000000000000004094040000070000001f0000000300000009000000a20000000000000000000000000000000d0000000000000001000000ffff000027"]}) program crashed: WARNING in shmem_rmdir bisect: the chunk can be dropped bisect: split chunks (needed=true): <2> bisect: split chunk #0 of len 2 into 2 parts bisect: testing without sub-chunk 1/2 testing program (duration=30s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): mmap$IORING_OFF_SQ_RING-syz_ublk_add_dev-socket$inet6_tcp-dup-syz_ublk_setup_queues-ioctl$KVM_TDX_INIT_VM detailed listing: executing program 5: mmap$IORING_OFF_SQ_RING(0x0, 0xc00000, 0x4000002, 0x14032, 0xffffffffffffffff, 0x0) syz_ublk_add_dev(0xffffffffffffffff, 0x0, 0x0, 0x0, &(0x7f0000000200)={0x2e, 0x0, 0x0, 0xffffffffffffffff, 0xc0207504, 0x0, 0x0, 0x0, 0x0, 0x4, 0x0, 0x0, '\x00', {0xffffffff, 0xffff, 0x40, &(0x7f0000000440)=@new_dev={0x4, 0x3c9, 0x0, 0x0, 0x1000, 0xffffffff, 0x0, 0x0, 0x40}}}, &(0x7f0000000300)=0x0) r1 = socket$inet6_tcp(0xa, 0x1, 0x0) r2 = dup(r1) syz_ublk_setup_queues(r2, r0, &(0x7f0000000180)={0x0, 0x1e99, 0x0, 0x7ffffffe, 0x257, 0x0, r2}, 0x0, 0x1, &(0x7f0000000340)={0x2e, 0x44, 0x0, 0xffffffffffffffff, 0xc0107520, 0x0, 0x0, 0x0, 0x500, {}, 0x0, 0x0, '\x00', {0xfff9, 0xa46, 0x0, 0x0}}, 0x0) ioctl$KVM_TDX_INIT_VM(0xffffffffffffffff, 0xc008aeba, &(0x7f0000000440)={0x1, 0x0, &(0x7f0000000200)=ANY=[@ANYBLOB="2000000000000000000000000000000007000000000000008f00000000800000060000000000000005000000000000003107000000000000020000000000000040000000000000000200000000000000724c000000000000020000000000000008000000000000000400000000000000060000000000000004000000000000000100000000000000ffffff7fffffffff4f000000000000006b000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000400000000000000010000008e2500000400000003000000020000005d5c0000070000000000000000000000000000000000004094040000070000001f0000000300000009000000a20000000000000000000000000000000d0000000000000001000000ffff000027"]}) program did not crash bisect: testing without sub-chunk 2/2 testing program (duration=30s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): ioctl$sock_inet_SIOCSIFDSTADDR-mkdirat-mkdir-mount$incfs-chdir-mount$overlay-socket$inet6-madvise-setsockopt$inet_int-syz_clone-syz_clone-setsockopt$sock_int-bind$inet6-setsockopt$sock_int-socket$netlink-writev-add_key detailed listing: executing program 4: ioctl$sock_inet_SIOCSIFDSTADDR(0xffffffffffffffff, 0x8918, &(0x7f0000000000)={'wlan0\x00', {0x2, 0x4e23, @multicast1}}) mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./file0\x00', 0x0) mkdir(&(0x7f00000000c0)='./bus\x00', 0x0) mount$incfs(&(0x7f00000007c0)='.\x00', &(0x7f0000000800)='./bus\x00', &(0x7f0000000840), 0x1804002, 0x0) chdir(&(0x7f00000003c0)='./bus\x00') mount$overlay(0x0, &(0x7f0000000100)='./file0\x00', &(0x7f0000000b80), 0x8, &(0x7f0000000240)={[{@upperdir={'upperdir', 0x3d, './file0'}}, {@workdir={'workdir', 0x3d, './bus'}}, {@lowerdir={'lowerdir', 0x3d, '.'}}]}) r0 = socket$inet6(0xa, 0x2, 0x0) madvise(&(0x7f0000000000/0x800000)=nil, 0x800000, 0xe) setsockopt$inet_int(0xffffffffffffffff, 0x0, 0x17, &(0x7f0000000180)=0xfffffffc, 0x4) syz_clone(0x20b84311, 0x0, 0x0, 0x0, 0x0, 0x0) syz_clone(0x11, 0x0, 0x0, 0x0, 0x0, 0x0) setsockopt$sock_int(r0, 0x1, 0xf, &(0x7f0000000240)=0x9, 0x4) bind$inet6(r0, &(0x7f0000000040)={0xa, 0xe22}, 0x1c) setsockopt$sock_int(r0, 0x1, 0x31, &(0x7f0000001600), 0x4) r1 = socket$netlink(0x10, 0x3, 0x8000000004) writev(r1, &(0x7f0000000000)=[{&(0x7f00000003c0)="580000001500add427323b472545b4560a117fffffff81000e220e227f000008925aa80013007b00090080007f000001e809000000ff0000ffffc7100003ffffffffffffffffffffffe7ee000000deff0000000200000000", 0x58}], 0x1) add_key(&(0x7f0000000080)='id_resolver\x00', 0x0, &(0x7f0000000400)="308201d43082017ba00302010202142eea648d7f17e62e9e5869c887c68e1bd0f86fde300a06082a8648ce3d040302303a3138303606035504030c2f436572746966696361746520766572696669636174696f6e2045434453412073656c662d74657374696e67206b65793020170d3234303431333232313632365a180f32313234303332303232313632365a303a3138303606035504030c2f43657274696669630000000000000008666963617428a2e0861e1ae90d412073656c662d74657374696e67206b65793059301306072a8648ce3d020106082a8648ce3d0301070300000000e56b51affc19412c88926b775771039ee2fe6e6a714ec7299f90e177189fc2e70a82d08ae181a9717c5a73fb25b95b1e248c739ff838f848b4ad1619c022c6a35d305b301d0603551d0e041604142900bcea1deb7bc8479a84a23d758efdfdd2b2d3301f0603551d230418301683142900bcea1deb7bc8479a84a23d758efdfdd2b2d3300c0603551d130101ff04023000300b0603551d0f040403020780300a06082a8648ce3d040302034700304402201ad7ac07c89738f489437ec7666ea5007c121db409760c996b8c265de9705cb4022073b7c77a5adb670a964219cf4f674f356aee2925f24fc810149d79691c7ad75d", 0x1d8, 0xfffffffffffffffd) program crashed: WARNING in shmem_rmdir bisect: the chunk can be dropped bisect: split chunks (needed=true): <1> bisect: split chunk #0 of len 1 into 2 parts bisect: no way to further split the chunk bisect: 1 programs left: executing program 4: ioctl$sock_inet_SIOCSIFDSTADDR(0xffffffffffffffff, 0x8918, &(0x7f0000000000)={'wlan0\x00', {0x2, 0x4e23, @multicast1}}) mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./file0\x00', 0x0) mkdir(&(0x7f00000000c0)='./bus\x00', 0x0) mount$incfs(&(0x7f00000007c0)='.\x00', &(0x7f0000000800)='./bus\x00', &(0x7f0000000840), 0x1804002, 0x0) chdir(&(0x7f00000003c0)='./bus\x00') mount$overlay(0x0, &(0x7f0000000100)='./file0\x00', &(0x7f0000000b80), 0x8, &(0x7f0000000240)={[{@upperdir={'upperdir', 0x3d, './file0'}}, {@workdir={'workdir', 0x3d, './bus'}}, {@lowerdir={'lowerdir', 0x3d, '.'}}]}) r0 = socket$inet6(0xa, 0x2, 0x0) madvise(&(0x7f0000000000/0x800000)=nil, 0x800000, 0xe) setsockopt$inet_int(0xffffffffffffffff, 0x0, 0x17, &(0x7f0000000180)=0xfffffffc, 0x4) syz_clone(0x20b84311, 0x0, 0x0, 0x0, 0x0, 0x0) syz_clone(0x11, 0x0, 0x0, 0x0, 0x0, 0x0) setsockopt$sock_int(r0, 0x1, 0xf, &(0x7f0000000240)=0x9, 0x4) bind$inet6(r0, &(0x7f0000000040)={0xa, 0xe22}, 0x1c) setsockopt$sock_int(r0, 0x1, 0x31, &(0x7f0000001600), 0x4) r1 = socket$netlink(0x10, 0x3, 0x8000000004) writev(r1, &(0x7f0000000000)=[{&(0x7f00000003c0)="580000001500add427323b472545b4560a117fffffff81000e220e227f000008925aa80013007b00090080007f000001e809000000ff0000ffffc7100003ffffffffffffffffffffffe7ee000000deff0000000200000000", 0x58}], 0x1) add_key(&(0x7f0000000080)='id_resolver\x00', 0x0, &(0x7f0000000400)="308201d43082017ba00302010202142eea648d7f17e62e9e5869c887c68e1bd0f86fde300a06082a8648ce3d040302303a3138303606035504030c2f436572746966696361746520766572696669636174696f6e2045434453412073656c662d74657374696e67206b65793020170d3234303431333232313632365a180f32313234303332303232313632365a303a3138303606035504030c2f43657274696669630000000000000008666963617428a2e0861e1ae90d412073656c662d74657374696e67206b65793059301306072a8648ce3d020106082a8648ce3d0301070300000000e56b51affc19412c88926b775771039ee2fe6e6a714ec7299f90e177189fc2e70a82d08ae181a9717c5a73fb25b95b1e248c739ff838f848b4ad1619c022c6a35d305b301d0603551d0e041604142900bcea1deb7bc8479a84a23d758efdfdd2b2d3301f0603551d230418301683142900bcea1deb7bc8479a84a23d758efdfdd2b2d3300c0603551d130101ff04023000300b0603551d0f040403020780300a06082a8648ce3d040302034700304402201ad7ac07c89738f489437ec7666ea5007c121db409760c996b8c265de9705cb4022073b7c77a5adb670a964219cf4f674f356aee2925f24fc810149d79691c7ad75d", 0x1d8, 0xfffffffffffffffd) bisect: trying to concatenate bisect: concatenate 1 entries testing program (duration=45s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): ioctl$sock_inet_SIOCSIFDSTADDR-mkdirat-mkdir-mount$incfs-chdir-mount$overlay-socket$inet6-madvise-setsockopt$inet_int-syz_clone-syz_clone-setsockopt$sock_int-bind$inet6-setsockopt$sock_int-socket$netlink-writev-add_key detailed listing: executing program 0: ioctl$sock_inet_SIOCSIFDSTADDR(0xffffffffffffffff, 0x8918, &(0x7f0000000000)={'wlan0\x00', {0x2, 0x4e23, @multicast1}}) mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./file0\x00', 0x0) mkdir(&(0x7f00000000c0)='./bus\x00', 0x0) mount$incfs(&(0x7f00000007c0)='.\x00', &(0x7f0000000800)='./bus\x00', &(0x7f0000000840), 0x1804002, 0x0) chdir(&(0x7f00000003c0)='./bus\x00') mount$overlay(0x0, &(0x7f0000000100)='./file0\x00', &(0x7f0000000b80), 0x8, &(0x7f0000000240)={[{@upperdir={'upperdir', 0x3d, './file0'}}, {@workdir={'workdir', 0x3d, './bus'}}, {@lowerdir={'lowerdir', 0x3d, '.'}}]}) r0 = socket$inet6(0xa, 0x2, 0x0) madvise(&(0x7f0000000000/0x800000)=nil, 0x800000, 0xe) setsockopt$inet_int(0xffffffffffffffff, 0x0, 0x17, &(0x7f0000000180)=0xfffffffc, 0x4) syz_clone(0x20b84311, 0x0, 0x0, 0x0, 0x0, 0x0) syz_clone(0x11, 0x0, 0x0, 0x0, 0x0, 0x0) setsockopt$sock_int(r0, 0x1, 0xf, &(0x7f0000000240)=0x9, 0x4) bind$inet6(r0, &(0x7f0000000040)={0xa, 0xe22}, 0x1c) setsockopt$sock_int(r0, 0x1, 0x31, &(0x7f0000001600), 0x4) r1 = socket$netlink(0x10, 0x3, 0x8000000004) writev(r1, &(0x7f0000000000)=[{&(0x7f00000003c0)="580000001500add427323b472545b4560a117fffffff81000e220e227f000008925aa80013007b00090080007f000001e809000000ff0000ffffc7100003ffffffffffffffffffffffe7ee000000deff0000000200000000", 0x58}], 0x1) add_key(&(0x7f0000000080)='id_resolver\x00', 0x0, &(0x7f0000000400)="308201d43082017ba00302010202142eea648d7f17e62e9e5869c887c68e1bd0f86fde300a06082a8648ce3d040302303a3138303606035504030c2f436572746966696361746520766572696669636174696f6e2045434453412073656c662d74657374696e67206b65793020170d3234303431333232313632365a180f32313234303332303232313632365a303a3138303606035504030c2f43657274696669630000000000000008666963617428a2e0861e1ae90d412073656c662d74657374696e67206b65793059301306072a8648ce3d020106082a8648ce3d0301070300000000e56b51affc19412c88926b775771039ee2fe6e6a714ec7299f90e177189fc2e70a82d08ae181a9717c5a73fb25b95b1e248c739ff838f848b4ad1619c022c6a35d305b301d0603551d0e041604142900bcea1deb7bc8479a84a23d758efdfdd2b2d3301f0603551d230418301683142900bcea1deb7bc8479a84a23d758efdfdd2b2d3300c0603551d130101ff04023000300b0603551d0f040403020780300a06082a8648ce3d040302034700304402201ad7ac07c89738f489437ec7666ea5007c121db409760c996b8c265de9705cb4022073b7c77a5adb670a964219cf4f674f356aee2925f24fc810149d79691c7ad75d", 0x1d8, 0xfffffffffffffffd) program crashed: WARNING in shmem_rmdir bisect: concatenation succeeded found reproducer with 17 syscalls minimizing guilty program testing program (duration=42.108460728s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): ioctl$sock_inet_SIOCSIFDSTADDR-mkdirat-mkdir-mount$incfs-chdir-mount$overlay-socket$inet6-madvise-setsockopt$inet_int-syz_clone-syz_clone-setsockopt$sock_int-bind$inet6-setsockopt$sock_int-socket$netlink-writev detailed listing: executing program 0: ioctl$sock_inet_SIOCSIFDSTADDR(0xffffffffffffffff, 0x8918, &(0x7f0000000000)={'wlan0\x00', {0x2, 0x4e23, @multicast1}}) mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./file0\x00', 0x0) mkdir(&(0x7f00000000c0)='./bus\x00', 0x0) mount$incfs(&(0x7f00000007c0)='.\x00', &(0x7f0000000800)='./bus\x00', &(0x7f0000000840), 0x1804002, 0x0) chdir(&(0x7f00000003c0)='./bus\x00') mount$overlay(0x0, &(0x7f0000000100)='./file0\x00', &(0x7f0000000b80), 0x8, &(0x7f0000000240)={[{@upperdir={'upperdir', 0x3d, './file0'}}, {@workdir={'workdir', 0x3d, './bus'}}, {@lowerdir={'lowerdir', 0x3d, '.'}}]}) r0 = socket$inet6(0xa, 0x2, 0x0) madvise(&(0x7f0000000000/0x800000)=nil, 0x800000, 0xe) setsockopt$inet_int(0xffffffffffffffff, 0x0, 0x17, &(0x7f0000000180)=0xfffffffc, 0x4) syz_clone(0x20b84311, 0x0, 0x0, 0x0, 0x0, 0x0) syz_clone(0x11, 0x0, 0x0, 0x0, 0x0, 0x0) setsockopt$sock_int(r0, 0x1, 0xf, &(0x7f0000000240)=0x9, 0x4) bind$inet6(r0, &(0x7f0000000040)={0xa, 0xe22}, 0x1c) setsockopt$sock_int(r0, 0x1, 0x31, &(0x7f0000001600), 0x4) r1 = socket$netlink(0x10, 0x3, 0x8000000004) writev(r1, &(0x7f0000000000)=[{&(0x7f00000003c0)="580000001500add427323b472545b4560a117fffffff81000e220e227f000008925aa80013007b00090080007f000001e809000000ff0000ffffc7100003ffffffffffffffffffffffe7ee000000deff0000000200000000", 0x58}], 0x1) program crashed: WARNING in shmem_rmdir testing program (duration=42.108460728s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): ioctl$sock_inet_SIOCSIFDSTADDR-mkdirat-mkdir-mount$incfs-chdir-mount$overlay-socket$inet6-madvise-setsockopt$inet_int-syz_clone-syz_clone-setsockopt$sock_int-bind$inet6-setsockopt$sock_int-socket$netlink detailed listing: executing program 0: ioctl$sock_inet_SIOCSIFDSTADDR(0xffffffffffffffff, 0x8918, &(0x7f0000000000)={'wlan0\x00', {0x2, 0x4e23, @multicast1}}) mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./file0\x00', 0x0) mkdir(&(0x7f00000000c0)='./bus\x00', 0x0) mount$incfs(&(0x7f00000007c0)='.\x00', &(0x7f0000000800)='./bus\x00', &(0x7f0000000840), 0x1804002, 0x0) chdir(&(0x7f00000003c0)='./bus\x00') mount$overlay(0x0, &(0x7f0000000100)='./file0\x00', &(0x7f0000000b80), 0x8, &(0x7f0000000240)={[{@upperdir={'upperdir', 0x3d, './file0'}}, {@workdir={'workdir', 0x3d, './bus'}}, {@lowerdir={'lowerdir', 0x3d, '.'}}]}) r0 = socket$inet6(0xa, 0x2, 0x0) madvise(&(0x7f0000000000/0x800000)=nil, 0x800000, 0xe) setsockopt$inet_int(0xffffffffffffffff, 0x0, 0x17, &(0x7f0000000180)=0xfffffffc, 0x4) syz_clone(0x20b84311, 0x0, 0x0, 0x0, 0x0, 0x0) syz_clone(0x11, 0x0, 0x0, 0x0, 0x0, 0x0) setsockopt$sock_int(r0, 0x1, 0xf, &(0x7f0000000240)=0x9, 0x4) bind$inet6(r0, &(0x7f0000000040)={0xa, 0xe22}, 0x1c) setsockopt$sock_int(r0, 0x1, 0x31, &(0x7f0000001600), 0x4) socket$netlink(0x10, 0x3, 0x8000000004) program crashed: WARNING in shmem_rmdir testing program (duration=42.108460728s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): ioctl$sock_inet_SIOCSIFDSTADDR-mkdirat-mkdir-mount$incfs-chdir-mount$overlay-socket$inet6-madvise-setsockopt$inet_int-syz_clone-syz_clone-setsockopt$sock_int-bind$inet6-setsockopt$sock_int detailed listing: executing program 0: ioctl$sock_inet_SIOCSIFDSTADDR(0xffffffffffffffff, 0x8918, &(0x7f0000000000)={'wlan0\x00', {0x2, 0x4e23, @multicast1}}) mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./file0\x00', 0x0) mkdir(&(0x7f00000000c0)='./bus\x00', 0x0) mount$incfs(&(0x7f00000007c0)='.\x00', &(0x7f0000000800)='./bus\x00', &(0x7f0000000840), 0x1804002, 0x0) chdir(&(0x7f00000003c0)='./bus\x00') mount$overlay(0x0, &(0x7f0000000100)='./file0\x00', &(0x7f0000000b80), 0x8, &(0x7f0000000240)={[{@upperdir={'upperdir', 0x3d, './file0'}}, {@workdir={'workdir', 0x3d, './bus'}}, {@lowerdir={'lowerdir', 0x3d, '.'}}]}) r0 = socket$inet6(0xa, 0x2, 0x0) madvise(&(0x7f0000000000/0x800000)=nil, 0x800000, 0xe) setsockopt$inet_int(0xffffffffffffffff, 0x0, 0x17, &(0x7f0000000180)=0xfffffffc, 0x4) syz_clone(0x20b84311, 0x0, 0x0, 0x0, 0x0, 0x0) syz_clone(0x11, 0x0, 0x0, 0x0, 0x0, 0x0) setsockopt$sock_int(r0, 0x1, 0xf, &(0x7f0000000240)=0x9, 0x4) bind$inet6(r0, &(0x7f0000000040)={0xa, 0xe22}, 0x1c) setsockopt$sock_int(r0, 0x1, 0x31, &(0x7f0000001600), 0x4) program crashed: WARNING in shmem_rmdir testing program (duration=42.108460728s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): ioctl$sock_inet_SIOCSIFDSTADDR-mkdirat-mkdir-mount$incfs-chdir-mount$overlay-socket$inet6-madvise-setsockopt$inet_int-syz_clone-syz_clone-setsockopt$sock_int-bind$inet6 detailed listing: executing program 0: ioctl$sock_inet_SIOCSIFDSTADDR(0xffffffffffffffff, 0x8918, &(0x7f0000000000)={'wlan0\x00', {0x2, 0x4e23, @multicast1}}) mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./file0\x00', 0x0) mkdir(&(0x7f00000000c0)='./bus\x00', 0x0) mount$incfs(&(0x7f00000007c0)='.\x00', &(0x7f0000000800)='./bus\x00', &(0x7f0000000840), 0x1804002, 0x0) chdir(&(0x7f00000003c0)='./bus\x00') mount$overlay(0x0, &(0x7f0000000100)='./file0\x00', &(0x7f0000000b80), 0x8, &(0x7f0000000240)={[{@upperdir={'upperdir', 0x3d, './file0'}}, {@workdir={'workdir', 0x3d, './bus'}}, {@lowerdir={'lowerdir', 0x3d, '.'}}]}) r0 = socket$inet6(0xa, 0x2, 0x0) madvise(&(0x7f0000000000/0x800000)=nil, 0x800000, 0xe) setsockopt$inet_int(0xffffffffffffffff, 0x0, 0x17, &(0x7f0000000180)=0xfffffffc, 0x4) syz_clone(0x20b84311, 0x0, 0x0, 0x0, 0x0, 0x0) syz_clone(0x11, 0x0, 0x0, 0x0, 0x0, 0x0) setsockopt$sock_int(r0, 0x1, 0xf, &(0x7f0000000240)=0x9, 0x4) bind$inet6(r0, &(0x7f0000000040)={0xa, 0xe22}, 0x1c) program crashed: WARNING in shmem_rmdir testing program (duration=42.108460728s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): ioctl$sock_inet_SIOCSIFDSTADDR-mkdirat-mkdir-mount$incfs-chdir-mount$overlay-socket$inet6-madvise-setsockopt$inet_int-syz_clone-syz_clone-setsockopt$sock_int detailed listing: executing program 0: ioctl$sock_inet_SIOCSIFDSTADDR(0xffffffffffffffff, 0x8918, &(0x7f0000000000)={'wlan0\x00', {0x2, 0x4e23, @multicast1}}) mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./file0\x00', 0x0) mkdir(&(0x7f00000000c0)='./bus\x00', 0x0) mount$incfs(&(0x7f00000007c0)='.\x00', &(0x7f0000000800)='./bus\x00', &(0x7f0000000840), 0x1804002, 0x0) chdir(&(0x7f00000003c0)='./bus\x00') mount$overlay(0x0, &(0x7f0000000100)='./file0\x00', &(0x7f0000000b80), 0x8, &(0x7f0000000240)={[{@upperdir={'upperdir', 0x3d, './file0'}}, {@workdir={'workdir', 0x3d, './bus'}}, {@lowerdir={'lowerdir', 0x3d, '.'}}]}) r0 = socket$inet6(0xa, 0x2, 0x0) madvise(&(0x7f0000000000/0x800000)=nil, 0x800000, 0xe) setsockopt$inet_int(0xffffffffffffffff, 0x0, 0x17, &(0x7f0000000180)=0xfffffffc, 0x4) syz_clone(0x20b84311, 0x0, 0x0, 0x0, 0x0, 0x0) syz_clone(0x11, 0x0, 0x0, 0x0, 0x0, 0x0) setsockopt$sock_int(r0, 0x1, 0xf, &(0x7f0000000240)=0x9, 0x4) program crashed: WARNING in shmem_rmdir testing program (duration=42.108460728s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): ioctl$sock_inet_SIOCSIFDSTADDR-mkdirat-mkdir-mount$incfs-chdir-mount$overlay-socket$inet6-madvise-setsockopt$inet_int-syz_clone-syz_clone detailed listing: executing program 0: ioctl$sock_inet_SIOCSIFDSTADDR(0xffffffffffffffff, 0x8918, &(0x7f0000000000)={'wlan0\x00', {0x2, 0x4e23, @multicast1}}) mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./file0\x00', 0x0) mkdir(&(0x7f00000000c0)='./bus\x00', 0x0) mount$incfs(&(0x7f00000007c0)='.\x00', &(0x7f0000000800)='./bus\x00', &(0x7f0000000840), 0x1804002, 0x0) chdir(&(0x7f00000003c0)='./bus\x00') mount$overlay(0x0, &(0x7f0000000100)='./file0\x00', &(0x7f0000000b80), 0x8, &(0x7f0000000240)={[{@upperdir={'upperdir', 0x3d, './file0'}}, {@workdir={'workdir', 0x3d, './bus'}}, {@lowerdir={'lowerdir', 0x3d, '.'}}]}) socket$inet6(0xa, 0x2, 0x0) madvise(&(0x7f0000000000/0x800000)=nil, 0x800000, 0xe) setsockopt$inet_int(0xffffffffffffffff, 0x0, 0x17, &(0x7f0000000180)=0xfffffffc, 0x4) syz_clone(0x20b84311, 0x0, 0x0, 0x0, 0x0, 0x0) syz_clone(0x11, 0x0, 0x0, 0x0, 0x0, 0x0) program crashed: WARNING in shmem_rmdir testing program (duration=42.108460728s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): ioctl$sock_inet_SIOCSIFDSTADDR-mkdirat-mkdir-mount$incfs-chdir-mount$overlay-socket$inet6-madvise-setsockopt$inet_int-syz_clone detailed listing: executing program 0: ioctl$sock_inet_SIOCSIFDSTADDR(0xffffffffffffffff, 0x8918, &(0x7f0000000000)={'wlan0\x00', {0x2, 0x4e23, @multicast1}}) mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./file0\x00', 0x0) mkdir(&(0x7f00000000c0)='./bus\x00', 0x0) mount$incfs(&(0x7f00000007c0)='.\x00', &(0x7f0000000800)='./bus\x00', &(0x7f0000000840), 0x1804002, 0x0) chdir(&(0x7f00000003c0)='./bus\x00') mount$overlay(0x0, &(0x7f0000000100)='./file0\x00', &(0x7f0000000b80), 0x8, &(0x7f0000000240)={[{@upperdir={'upperdir', 0x3d, './file0'}}, {@workdir={'workdir', 0x3d, './bus'}}, {@lowerdir={'lowerdir', 0x3d, '.'}}]}) socket$inet6(0xa, 0x2, 0x0) madvise(&(0x7f0000000000/0x800000)=nil, 0x800000, 0xe) setsockopt$inet_int(0xffffffffffffffff, 0x0, 0x17, &(0x7f0000000180)=0xfffffffc, 0x4) syz_clone(0x20b84311, 0x0, 0x0, 0x0, 0x0, 0x0) program crashed: WARNING in shmem_rmdir testing program (duration=42.108460728s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): ioctl$sock_inet_SIOCSIFDSTADDR-mkdirat-mkdir-mount$incfs-chdir-mount$overlay-socket$inet6-madvise-setsockopt$inet_int detailed listing: executing program 0: ioctl$sock_inet_SIOCSIFDSTADDR(0xffffffffffffffff, 0x8918, &(0x7f0000000000)={'wlan0\x00', {0x2, 0x4e23, @multicast1}}) mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./file0\x00', 0x0) mkdir(&(0x7f00000000c0)='./bus\x00', 0x0) mount$incfs(&(0x7f00000007c0)='.\x00', &(0x7f0000000800)='./bus\x00', &(0x7f0000000840), 0x1804002, 0x0) chdir(&(0x7f00000003c0)='./bus\x00') mount$overlay(0x0, &(0x7f0000000100)='./file0\x00', &(0x7f0000000b80), 0x8, &(0x7f0000000240)={[{@upperdir={'upperdir', 0x3d, './file0'}}, {@workdir={'workdir', 0x3d, './bus'}}, {@lowerdir={'lowerdir', 0x3d, '.'}}]}) socket$inet6(0xa, 0x2, 0x0) madvise(&(0x7f0000000000/0x800000)=nil, 0x800000, 0xe) setsockopt$inet_int(0xffffffffffffffff, 0x0, 0x17, &(0x7f0000000180)=0xfffffffc, 0x4) program crashed: WARNING in shmem_rmdir testing program (duration=42.108460728s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): ioctl$sock_inet_SIOCSIFDSTADDR-mkdirat-mkdir-mount$incfs-chdir-mount$overlay-socket$inet6-madvise detailed listing: executing program 0: ioctl$sock_inet_SIOCSIFDSTADDR(0xffffffffffffffff, 0x8918, &(0x7f0000000000)={'wlan0\x00', {0x2, 0x4e23, @multicast1}}) mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./file0\x00', 0x0) mkdir(&(0x7f00000000c0)='./bus\x00', 0x0) mount$incfs(&(0x7f00000007c0)='.\x00', &(0x7f0000000800)='./bus\x00', &(0x7f0000000840), 0x1804002, 0x0) chdir(&(0x7f00000003c0)='./bus\x00') mount$overlay(0x0, &(0x7f0000000100)='./file0\x00', &(0x7f0000000b80), 0x8, &(0x7f0000000240)={[{@upperdir={'upperdir', 0x3d, './file0'}}, {@workdir={'workdir', 0x3d, './bus'}}, {@lowerdir={'lowerdir', 0x3d, '.'}}]}) socket$inet6(0xa, 0x2, 0x0) madvise(&(0x7f0000000000/0x800000)=nil, 0x800000, 0xe) program crashed: WARNING in shmem_rmdir testing program (duration=42.108460728s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): ioctl$sock_inet_SIOCSIFDSTADDR-mkdirat-mkdir-mount$incfs-chdir-mount$overlay-socket$inet6 detailed listing: executing program 0: ioctl$sock_inet_SIOCSIFDSTADDR(0xffffffffffffffff, 0x8918, &(0x7f0000000000)={'wlan0\x00', {0x2, 0x4e23, @multicast1}}) mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./file0\x00', 0x0) mkdir(&(0x7f00000000c0)='./bus\x00', 0x0) mount$incfs(&(0x7f00000007c0)='.\x00', &(0x7f0000000800)='./bus\x00', &(0x7f0000000840), 0x1804002, 0x0) chdir(&(0x7f00000003c0)='./bus\x00') mount$overlay(0x0, &(0x7f0000000100)='./file0\x00', &(0x7f0000000b80), 0x8, &(0x7f0000000240)={[{@upperdir={'upperdir', 0x3d, './file0'}}, {@workdir={'workdir', 0x3d, './bus'}}, {@lowerdir={'lowerdir', 0x3d, '.'}}]}) socket$inet6(0xa, 0x2, 0x0) program crashed: WARNING in shmem_rmdir testing program (duration=42.108460728s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): ioctl$sock_inet_SIOCSIFDSTADDR-mkdirat-mkdir-mount$incfs-chdir-mount$overlay detailed listing: executing program 0: ioctl$sock_inet_SIOCSIFDSTADDR(0xffffffffffffffff, 0x8918, &(0x7f0000000000)={'wlan0\x00', {0x2, 0x4e23, @multicast1}}) mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./file0\x00', 0x0) mkdir(&(0x7f00000000c0)='./bus\x00', 0x0) mount$incfs(&(0x7f00000007c0)='.\x00', &(0x7f0000000800)='./bus\x00', &(0x7f0000000840), 0x1804002, 0x0) chdir(&(0x7f00000003c0)='./bus\x00') mount$overlay(0x0, &(0x7f0000000100)='./file0\x00', &(0x7f0000000b80), 0x8, &(0x7f0000000240)={[{@upperdir={'upperdir', 0x3d, './file0'}}, {@workdir={'workdir', 0x3d, './bus'}}, {@lowerdir={'lowerdir', 0x3d, '.'}}]}) program crashed: WARNING in shmem_rmdir testing program (duration=42.108460728s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): ioctl$sock_inet_SIOCSIFDSTADDR-mkdirat-mkdir-mount$incfs-chdir detailed listing: executing program 0: ioctl$sock_inet_SIOCSIFDSTADDR(0xffffffffffffffff, 0x8918, &(0x7f0000000000)={'wlan0\x00', {0x2, 0x4e23, @multicast1}}) mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./file0\x00', 0x0) mkdir(&(0x7f00000000c0)='./bus\x00', 0x0) mount$incfs(&(0x7f00000007c0)='.\x00', &(0x7f0000000800)='./bus\x00', &(0x7f0000000840), 0x1804002, 0x0) chdir(&(0x7f00000003c0)='./bus\x00') program crashed: WARNING in shmem_rmdir testing program (duration=42.108460728s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): ioctl$sock_inet_SIOCSIFDSTADDR-mkdirat-mkdir-mount$incfs detailed listing: executing program 0: ioctl$sock_inet_SIOCSIFDSTADDR(0xffffffffffffffff, 0x8918, &(0x7f0000000000)={'wlan0\x00', {0x2, 0x4e23, @multicast1}}) mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./file0\x00', 0x0) mkdir(&(0x7f00000000c0)='./bus\x00', 0x0) mount$incfs(&(0x7f00000007c0)='.\x00', &(0x7f0000000800)='./bus\x00', &(0x7f0000000840), 0x1804002, 0x0) program crashed: WARNING in shmem_rmdir testing program (duration=42.108460728s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): ioctl$sock_inet_SIOCSIFDSTADDR-mkdirat-mkdir detailed listing: executing program 0: ioctl$sock_inet_SIOCSIFDSTADDR(0xffffffffffffffff, 0x8918, &(0x7f0000000000)={'wlan0\x00', {0x2, 0x4e23, @multicast1}}) mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./file0\x00', 0x0) mkdir(&(0x7f00000000c0)='./bus\x00', 0x0) program did not crash testing program (duration=42.108460728s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): ioctl$sock_inet_SIOCSIFDSTADDR-mkdirat-mount$incfs detailed listing: executing program 0: ioctl$sock_inet_SIOCSIFDSTADDR(0xffffffffffffffff, 0x8918, &(0x7f0000000000)={'wlan0\x00', {0x2, 0x4e23, @multicast1}}) mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./file0\x00', 0x0) mount$incfs(&(0x7f00000007c0)='.\x00', &(0x7f0000000800)='./bus\x00', &(0x7f0000000840), 0x1804002, 0x0) program did not crash testing program (duration=42.108460728s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): ioctl$sock_inet_SIOCSIFDSTADDR-mkdir-mount$incfs detailed listing: executing program 0: ioctl$sock_inet_SIOCSIFDSTADDR(0xffffffffffffffff, 0x8918, &(0x7f0000000000)={'wlan0\x00', {0x2, 0x4e23, @multicast1}}) mkdir(&(0x7f00000000c0)='./bus\x00', 0x0) mount$incfs(&(0x7f00000007c0)='.\x00', &(0x7f0000000800)='./bus\x00', &(0x7f0000000840), 0x1804002, 0x0) program crashed: WARNING in shmem_rmdir testing program (duration=42.108460728s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): mkdir-mount$incfs detailed listing: executing program 0: mkdir(&(0x7f00000000c0)='./bus\x00', 0x0) mount$incfs(&(0x7f00000007c0)='.\x00', &(0x7f0000000800)='./bus\x00', &(0x7f0000000840), 0x1804002, 0x0) program crashed: WARNING in shmem_rmdir testing program (duration=42.108460728s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): mkdir-mount$incfs detailed listing: executing program 0: mkdir(0x0, 0x0) mount$incfs(&(0x7f00000007c0)='.\x00', &(0x7f0000000800)='./bus\x00', &(0x7f0000000840), 0x1804002, 0x0) program did not crash testing program (duration=42.108460728s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): mkdir-mount$incfs detailed listing: executing program 0: mkdir(&(0x7f00000000c0)='./bus\x00', 0x0) mount$incfs(0x0, &(0x7f0000000800)='./bus\x00', &(0x7f0000000840), 0x1804002, 0x0) program did not crash testing program (duration=42.108460728s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): mkdir-mount$incfs detailed listing: executing program 0: mkdir(&(0x7f00000000c0)='./bus\x00', 0x0) mount$incfs(&(0x7f00000007c0)='.\x00', 0x0, &(0x7f0000000840), 0x1804002, 0x0) program did not crash testing program (duration=42.108460728s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): mkdir-mount$incfs detailed listing: executing program 0: mkdir(&(0x7f00000000c0)='./bus\x00', 0x0) mount$incfs(&(0x7f00000007c0)='.\x00', &(0x7f0000000800)='./bus\x00', 0x0, 0x1804002, 0x0) program did not crash extracting C reproducer testing compiled C program (duration=42.108460728s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): mkdir-mount$incfs program crashed: WARNING in shmem_rmdir simplifying C reproducer testing compiled C program (duration=42.108460728s, {Threaded:false Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): mkdir-mount$incfs program crashed: WARNING in shmem_rmdir testing compiled C program (duration=42.108460728s, {Threaded:false Repeat:false RepeatTimes:0 Procs:1 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:false Cgroups:false BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): mkdir-mount$incfs program did not crash testing compiled C program (duration=42.108460728s, {Threaded:false Repeat:true RepeatTimes:0 Procs:1 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): mkdir-mount$incfs program crashed: WARNING in shmem_rmdir testing compiled C program (duration=42.108460728s, {Threaded:false Repeat:true RepeatTimes:0 Procs:1 Slowdown:1 Sandbox: SandboxArg:0 Leak:false NetInjection:false NetDevices:false NetReset:false Cgroups:false BinfmtMisc:false CloseFDs:false KCSAN:false DevlinkPCI:false NicVF:false USB:false VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:false UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): mkdir-mount$incfs program did not crash testing compiled C program (duration=42.108460728s, {Threaded:false Repeat:true RepeatTimes:0 Procs:1 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:false NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): mkdir-mount$incfs program crashed: WARNING in shmem_rmdir testing compiled C program (duration=42.108460728s, {Threaded:false Repeat:true RepeatTimes:0 Procs:1 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:false NetDevices:false NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): mkdir-mount$incfs program crashed: WARNING in shmem_rmdir testing compiled C program (duration=42.108460728s, {Threaded:false Repeat:true RepeatTimes:0 Procs:1 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:false NetDevices:false NetReset:false Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): mkdir-mount$incfs program crashed: WARNING in shmem_rmdir testing compiled C program (duration=42.108460728s, {Threaded:false Repeat:true RepeatTimes:0 Procs:1 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:false NetDevices:false NetReset:false Cgroups:false BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): mkdir-mount$incfs program crashed: WARNING in shmem_rmdir testing compiled C program (duration=42.108460728s, {Threaded:false Repeat:true RepeatTimes:0 Procs:1 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:false NetDevices:false NetReset:false Cgroups:false BinfmtMisc:false CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): mkdir-mount$incfs program crashed: WARNING in shmem_rmdir testing compiled C program (duration=42.108460728s, {Threaded:false Repeat:true RepeatTimes:0 Procs:1 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:false NetDevices:false NetReset:false Cgroups:false BinfmtMisc:false CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:false VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): mkdir-mount$incfs program crashed: WARNING in shmem_rmdir testing compiled C program (duration=42.108460728s, {Threaded:false Repeat:true RepeatTimes:0 Procs:1 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:false NetDevices:false NetReset:false Cgroups:false BinfmtMisc:false CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:false VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:true UseTmpDir:false HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): mkdir-mount$incfs program did not crash testing compiled C program (duration=42.108460728s, {Threaded:false Repeat:true RepeatTimes:0 Procs:1 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:false NetDevices:false NetReset:false Cgroups:false BinfmtMisc:false CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:false VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:true UseTmpDir:true HandleSegv:false Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): mkdir-mount$incfs program crashed: WARNING in shmem_rmdir testing compiled C program (duration=42.108460728s, {Threaded:false Repeat:true RepeatTimes:0 Procs:1 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:false NetDevices:false NetReset:false Cgroups:false BinfmtMisc:false CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:false VhciInjection:false Wifi:false IEEE802154:false Sysctl:false Swap:true UseTmpDir:true HandleSegv:false Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): mkdir-mount$incfs program crashed: WARNING in shmem_rmdir testing compiled C program (duration=42.108460728s, {Threaded:false Repeat:true RepeatTimes:0 Procs:1 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:false NetDevices:false NetReset:false Cgroups:false BinfmtMisc:false CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:false VhciInjection:false Wifi:false IEEE802154:false Sysctl:false Swap:false UseTmpDir:true HandleSegv:false Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): mkdir-mount$incfs program crashed: WARNING in shmem_rmdir testing program (duration=42.108460728s, {Threaded:false Repeat:true RepeatTimes:0 Procs:1 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:false NetDevices:false NetReset:false Cgroups:false BinfmtMisc:false CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:false VhciInjection:false Wifi:false IEEE802154:false Sysctl:false Swap:false UseTmpDir:true HandleSegv:false Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): mkdir-mount$incfs detailed listing: executing program 0: mkdir(&(0x7f00000000c0)='./bus\x00', 0x0) mount$incfs(&(0x7f00000007c0)='.\x00', &(0x7f0000000800)='./bus\x00', &(0x7f0000000840), 0x1804002, 0x0) program crashed: WARNING in shmem_rmdir validation run: crashed=true testing program (duration=42.108460728s, {Threaded:false Repeat:true RepeatTimes:0 Procs:1 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:false NetDevices:false NetReset:false Cgroups:false BinfmtMisc:false CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:false VhciInjection:false Wifi:false IEEE802154:false Sysctl:false Swap:false UseTmpDir:true HandleSegv:false Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): mkdir-mount$incfs detailed listing: executing program 0: mkdir(&(0x7f00000000c0)='./bus\x00', 0x0) mount$incfs(&(0x7f00000007c0)='.\x00', &(0x7f0000000800)='./bus\x00', &(0x7f0000000840), 0x1804002, 0x0) program crashed: WARNING in shmem_rmdir validation run: crashed=true testing program (duration=42.108460728s, {Threaded:false Repeat:true RepeatTimes:0 Procs:1 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:false NetDevices:false NetReset:false Cgroups:false BinfmtMisc:false CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:false VhciInjection:false Wifi:false IEEE802154:false Sysctl:false Swap:false UseTmpDir:true HandleSegv:false Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): mkdir-mount$incfs detailed listing: executing program 0: mkdir(&(0x7f00000000c0)='./bus\x00', 0x0) mount$incfs(&(0x7f00000007c0)='.\x00', &(0x7f0000000800)='./bus\x00', &(0x7f0000000840), 0x1804002, 0x0) program crashed: WARNING in shmem_rmdir validation run: crashed=true reproducing took 51m33.596330069s repro crashed as (corrupted=false): veth0_vlan: entered promiscuous mode veth1_macvtap: entered promiscuous mode ------------[ cut here ]------------ WARNING: CPU: 1 PID: 378 at fs/inode.c:340 drop_nlink+0xce/0x110 fs/inode.c:340 Modules linked in: CPU: 1 UID: 0 PID: 378 Comm: syz-executor Not tainted syzkaller #0 238002c42480d657f84ffff3a67e0b81dcf43858 Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 RIP: 0010:drop_nlink+0xce/0x110 fs/inode.c:340 Code: 04 00 00 be 08 00 00 00 e8 0f 0d ee ff f0 48 ff 83 b8 04 00 00 5b 41 5c 41 5d 41 5e 41 5f 5d e9 d8 26 b5 03 cc e8 82 2f 95 ff <0f> 0b eb 81 44 89 f1 80 e1 07 80 c1 03 38 c1 0f 8c 59 ff ff ff 4c RSP: 0018:ffffc9000125fc88 EFLAGS: 00010293 RAX: ffffffff81f24a8e RBX: ffff888115cb8070 RCX: ffff888114810000 RDX: 0000000000000000 RSI: 0000000000000000 RDI: 0000000000000000 RBP: ffffc9000125fcb0 R08: 0000000000000003 R09: 0000000000000004 R10: dffffc0000000000 R11: fffff5200024bf80 R12: dffffc0000000000 R13: 1ffff11022b97017 R14: ffff888115cb80b8 R15: 0000000000000000 FS: 000055556ccd0500(0000) GS:ffff8881f6f00000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: 000055556ccf3958 CR3: 00000001143c4000 CR4: 00000000003526b0 Call Trace: shmem_rmdir+0x5f/0x90 mm/shmem.c:3826 vfs_rmdir+0x3de/0x560 fs/namei.c:4348 incfs_kill_sb+0x102/0x220 fs/incfs/vfs.c:1968 deactivate_locked_super+0xd5/0x270 fs/super.c:478 deactivate_super+0xb8/0xe0 fs/super.c:511 cleanup_mnt+0x438/0x4d0 fs/namespace.c:1380 __cleanup_mnt+0x1d/0x40 fs/namespace.c:1387 task_work_run+0x1e5/0x260 kernel/task_work.c:246 resume_user_mode_work+0x35/0x50 include/linux/resume_user_mode.h:50 exit_to_user_mode_loop kernel/entry/common.c:114 [inline] exit_to_user_mode_prepare include/linux/entry-common.h:328 [inline] __syscall_exit_to_user_mode_work kernel/entry/common.c:207 [inline] syscall_exit_to_user_mode+0x63/0xb0 kernel/entry/common.c:218 do_syscall_64+0x63/0xf0 arch/x86/entry/common.c:84 entry_SYSCALL_64_after_hwframe+0x76/0x7e RIP: 0033:0x7f033ed9f397 Code: a2 c7 05 5c 43 25 00 00 00 00 00 eb 96 e8 e1 12 00 00 90 31 f6 e9 09 00 00 00 66 0f 1f 84 00 00 00 00 00 b8 a6 00 00 00 0f 05 <48> 3d 00 f0 ff ff 77 01 c3 48 c7 c2 e8 ff ff ff f7 d8 64 89 02 b8 RSP: 002b:00007fff365b5838 EFLAGS: 00000246 ORIG_RAX: 00000000000000a6 RAX: 0000000000000000 RBX: 0000000000000000 RCX: 00007f033ed9f397 RDX: 0000000000000000 RSI: 0000000000000009 RDI: 00007fff365b58f0 RBP: 00007fff365b58f0 R08: 00007fff365b68f0 R09: 00000000ffffffff R10: 0000000000000000 R11: 0000000000000246 R12: 00007fff365b6980 R13: 00007f033ee3448b R14: 0000000000006d62 R15: 00007fff365b69c0 ---[ end trace 0000000000000000 ]--- ================================================================== BUG: KASAN: null-ptr-deref in instrument_atomic_read_write include/linux/instrumented.h:96 [inline] BUG: KASAN: null-ptr-deref in atomic_inc_return include/linux/atomic/atomic-instrumented.h:453 [inline] BUG: KASAN: null-ptr-deref in ihold+0x24/0x70 fs/inode.c:452 Write of size 4 at addr 0000000000000168 by task syz-executor/378 CPU: 0 UID: 0 PID: 378 Comm: syz-executor Tainted: G W syzkaller #0 238002c42480d657f84ffff3a67e0b81dcf43858 Tainted: [W]=WARN Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 Call Trace: __dump_stack+0x21/0x30 lib/dump_stack.c:94 dump_stack_lvl+0x140/0x1c0 lib/dump_stack.c:120 print_report+0x3d/0x70 mm/kasan/report.c:484 kasan_report+0x162/0x1a0 mm/kasan/report.c:594 check_region_inline mm/kasan/generic.c:-1 [inline] kasan_check_range+0x25a/0x2b0 mm/kasan/generic.c:189 __kasan_check_write+0x18/0x20 mm/kasan/shadow.c:37 instrument_atomic_read_write include/linux/instrumented.h:96 [inline] atomic_inc_return include/linux/atomic/atomic-instrumented.h:453 [inline] ihold+0x24/0x70 fs/inode.c:452 d_delete_notify include/linux/fsnotify.h:357 [inline] vfs_rmdir+0x25c/0x560 fs/namei.c:4361 incfs_kill_sb+0x102/0x220 fs/incfs/vfs.c:1968 deactivate_locked_super+0xd5/0x270 fs/super.c:478 deactivate_super+0xb8/0xe0 fs/super.c:511 cleanup_mnt+0x438/0x4d0 fs/namespace.c:1380 __cleanup_mnt+0x1d/0x40 fs/namespace.c:1387 task_work_run+0x1e5/0x260 kernel/task_work.c:246 resume_user_mode_work+0x35/0x50 include/linux/resume_user_mode.h:50 exit_to_user_mode_loop kernel/entry/common.c:114 [inline] exit_to_user_mode_prepare include/linux/entry-common.h:328 [inline] __syscall_exit_to_user_mode_work kernel/entry/common.c:207 [inline] syscall_exit_to_user_mode+0x63/0xb0 kernel/entry/common.c:218 do_syscall_64+0x63/0xf0 arch/x86/entry/common.c:84 entry_SYSCALL_64_after_hwframe+0x76/0x7e RIP: 0033:0x7f033ed9f397 Code: a2 c7 05 5c 43 25 00 00 00 00 00 eb 96 e8 e1 12 00 00 90 31 f6 e9 09 00 00 00 66 0f 1f 84 00 00 00 00 00 b8 a6 00 00 00 0f 05 <48> 3d 00 f0 ff ff 77 01 c3 48 c7 c2 e8 ff ff ff f7 d8 64 89 02 b8 RSP: 002b:00007fff365b5838 EFLAGS: 00000246 ORIG_RAX: 00000000000000a6 RAX: 0000000000000000 RBX: 0000000000000000 RCX: 00007f033ed9f397 RDX: 0000000000000000 RSI: 0000000000000009 RDI: 00007fff365b58f0 RBP: 00007fff365b58f0 R08: 00007fff365b68f0 R09: 00000000ffffffff R10: 0000000000000000 R11: 0000000000000246 R12: 00007fff365b6980 R13: 00007f033ee3448b R14: 0000000000006d62 R15: 00007fff365b69c0 ================================================================== BUG: kernel NULL pointer dereference, address: 0000000000000168 #PF: supervisor write access in kernel mode #PF: error_code(0x0002) - not-present page PGD 8000000115589067 P4D 8000000115589067 PUD 0 Oops: Oops: 0002 [#1] PREEMPT SMP KASAN PTI CPU: 0 UID: 0 PID: 378 Comm: syz-executor Tainted: G B W syzkaller #0 238002c42480d657f84ffff3a67e0b81dcf43858 Tainted: [B]=BAD_PAGE, [W]=WARN Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 RIP: 0010:arch_atomic_add_return arch/x86/include/asm/atomic.h:85 [inline] RIP: 0010:raw_atomic_add_return include/linux/atomic/atomic-arch-fallback.h:564 [inline] RIP: 0010:raw_atomic_inc_return include/linux/atomic/atomic-arch-fallback.h:1020 [inline] RIP: 0010:atomic_inc_return include/linux/atomic/atomic-instrumented.h:454 [inline] RIP: 0010:ihold+0x2a/0x70 fs/inode.c:452 Code: f3 0f 1e fa 55 48 89 e5 41 56 53 48 89 fb e8 6d 26 95 ff 48 8d bb 68 01 00 00 be 04 00 00 00 e8 cc 03 ee ff 41 be 01 00 00 00 44 0f c1 b3 68 01 00 00 41 ff c6 bf 02 00 00 00 44 89 f6 e8 7d RSP: 0018:ffffc9000125fcc8 EFLAGS: 00010246 RAX: ffff888114810000 RBX: 0000000000000000 RCX: ffff888114810000 RDX: 0000000000000000 RSI: 0000000000000000 RDI: 0000000000000000 RBP: ffffc9000125fcd8 R08: ffffffff88bba947 R09: 1ffffffff1177528 R10: dffffc0000000000 R11: fffffbfff1177529 R12: 0000000000000000 R13: 0000000000000000 R14: 0000000000000001 R15: dffffc0000000000 FS: 000055556ccd0500(0000) GS:ffff8881f6e00000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: 0000000000000168 CR3: 00000001143c4000 CR4: 00000000003526b0 Call Trace: d_delete_notify include/linux/fsnotify.h:357 [inline] vfs_rmdir+0x25c/0x560 fs/namei.c:4361 incfs_kill_sb+0x102/0x220 fs/incfs/vfs.c:1968 deactivate_locked_super+0xd5/0x270 fs/super.c:478 deactivate_super+0xb8/0xe0 fs/super.c:511 cleanup_mnt+0x438/0x4d0 fs/namespace.c:1380 __cleanup_mnt+0x1d/0x40 fs/namespace.c:1387 task_work_run+0x1e5/0x260 kernel/task_work.c:246 resume_user_mode_work+0x35/0x50 include/linux/resume_user_mode.h:50 exit_to_user_mode_loop kernel/entry/common.c:114 [inline] exit_to_user_mode_prepare include/linux/entry-common.h:328 [inline] __syscall_exit_to_user_mode_work kernel/entry/common.c:207 [inline] syscall_exit_to_user_mode+0x63/0xb0 kernel/entry/common.c:218 do_syscall_64+0x63/0xf0 arch/x86/entry/common.c:84 entry_SYSCALL_64_after_hwframe+0x76/0x7e RIP: 0033:0x7f033ed9f397 Code: a2 c7 05 5c 43 25 00 00 00 00 00 eb 96 e8 e1 12 00 00 90 31 f6 e9 09 00 00 00 66 0f 1f 84 00 00 00 00 00 b8 a6 00 00 00 0f 05 <48> 3d 00 f0 ff ff 77 01 c3 48 c7 c2 e8 ff ff ff f7 d8 64 89 02 b8 RSP: 002b:00007fff365b5838 EFLAGS: 00000246 ORIG_RAX: 00000000000000a6 RAX: 0000000000000000 RBX: 0000000000000000 RCX: 00007f033ed9f397 RDX: 0000000000000000 RSI: 0000000000000009 RDI: 00007fff365b58f0 RBP: 00007fff365b58f0 R08: 00007fff365b68f0 R09: 00000000ffffffff R10: 0000000000000000 R11: 0000000000000246 R12: 00007fff365b6980 R13: 00007f033ee3448b R14: 0000000000006d62 R15: 00007fff365b69c0 Modules linked in: CR2: 0000000000000168 ---[ end trace 0000000000000000 ]--- RIP: 0010:arch_atomic_add_return arch/x86/include/asm/atomic.h:85 [inline] RIP: 0010:raw_atomic_add_return include/linux/atomic/atomic-arch-fallback.h:564 [inline] RIP: 0010:raw_atomic_inc_return include/linux/atomic/atomic-arch-fallback.h:1020 [inline] RIP: 0010:atomic_inc_return include/linux/atomic/atomic-instrumented.h:454 [inline] RIP: 0010:ihold+0x2a/0x70 fs/inode.c:452 Code: f3 0f 1e fa 55 48 89 e5 41 56 53 48 89 fb e8 6d 26 95 ff 48 8d bb 68 01 00 00 be 04 00 00 00 e8 cc 03 ee ff 41 be 01 00 00 00 44 0f c1 b3 68 01 00 00 41 ff c6 bf 02 00 00 00 44 89 f6 e8 7d RSP: 0018:ffffc9000125fcc8 EFLAGS: 00010246 RAX: ffff888114810000 RBX: 0000000000000000 RCX: ffff888114810000 RDX: 0000000000000000 RSI: 0000000000000000 RDI: 0000000000000000 RBP: ffffc9000125fcd8 R08: ffffffff88bba947 R09: 1ffffffff1177528 R10: dffffc0000000000 R11: fffffbfff1177529 R12: 0000000000000000 R13: 0000000000000000 R14: 0000000000000001 R15: dffffc0000000000 FS: 000055556ccd0500(0000) GS:ffff8881f6e00000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: 0000000000000168 CR3: 00000001143c4000 CR4: 00000000003526b0 ---------------- Code disassembly (best guess): 0: f3 0f 1e fa endbr64 4: 55 push %rbp 5: 48 89 e5 mov %rsp,%rbp 8: 41 56 push %r14 a: 53 push %rbx b: 48 89 fb mov %rdi,%rbx e: e8 6d 26 95 ff call 0xff952680 13: 48 8d bb 68 01 00 00 lea 0x168(%rbx),%rdi 1a: be 04 00 00 00 mov $0x4,%esi 1f: e8 cc 03 ee ff call 0xffee03f0 24: 41 be 01 00 00 00 mov $0x1,%r14d * 2a: f0 44 0f c1 b3 68 01 lock xadd %r14d,0x168(%rbx) <-- trapping instruction 31: 00 00 33: 41 ff c6 inc %r14d 36: bf 02 00 00 00 mov $0x2,%edi 3b: 44 89 f6 mov %r14d,%esi 3e: e8 .byte 0xe8 3f: 7d .byte 0x7d final repro crashed as (corrupted=false): veth0_vlan: entered promiscuous mode veth1_macvtap: entered promiscuous mode ------------[ cut here ]------------ WARNING: CPU: 1 PID: 378 at fs/inode.c:340 drop_nlink+0xce/0x110 fs/inode.c:340 Modules linked in: CPU: 1 UID: 0 PID: 378 Comm: syz-executor Not tainted syzkaller #0 238002c42480d657f84ffff3a67e0b81dcf43858 Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 RIP: 0010:drop_nlink+0xce/0x110 fs/inode.c:340 Code: 04 00 00 be 08 00 00 00 e8 0f 0d ee ff f0 48 ff 83 b8 04 00 00 5b 41 5c 41 5d 41 5e 41 5f 5d e9 d8 26 b5 03 cc e8 82 2f 95 ff <0f> 0b eb 81 44 89 f1 80 e1 07 80 c1 03 38 c1 0f 8c 59 ff ff ff 4c RSP: 0018:ffffc9000125fc88 EFLAGS: 00010293 RAX: ffffffff81f24a8e RBX: ffff888115cb8070 RCX: ffff888114810000 RDX: 0000000000000000 RSI: 0000000000000000 RDI: 0000000000000000 RBP: ffffc9000125fcb0 R08: 0000000000000003 R09: 0000000000000004 R10: dffffc0000000000 R11: fffff5200024bf80 R12: dffffc0000000000 R13: 1ffff11022b97017 R14: ffff888115cb80b8 R15: 0000000000000000 FS: 000055556ccd0500(0000) GS:ffff8881f6f00000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: 000055556ccf3958 CR3: 00000001143c4000 CR4: 00000000003526b0 Call Trace: shmem_rmdir+0x5f/0x90 mm/shmem.c:3826 vfs_rmdir+0x3de/0x560 fs/namei.c:4348 incfs_kill_sb+0x102/0x220 fs/incfs/vfs.c:1968 deactivate_locked_super+0xd5/0x270 fs/super.c:478 deactivate_super+0xb8/0xe0 fs/super.c:511 cleanup_mnt+0x438/0x4d0 fs/namespace.c:1380 __cleanup_mnt+0x1d/0x40 fs/namespace.c:1387 task_work_run+0x1e5/0x260 kernel/task_work.c:246 resume_user_mode_work+0x35/0x50 include/linux/resume_user_mode.h:50 exit_to_user_mode_loop kernel/entry/common.c:114 [inline] exit_to_user_mode_prepare include/linux/entry-common.h:328 [inline] __syscall_exit_to_user_mode_work kernel/entry/common.c:207 [inline] syscall_exit_to_user_mode+0x63/0xb0 kernel/entry/common.c:218 do_syscall_64+0x63/0xf0 arch/x86/entry/common.c:84 entry_SYSCALL_64_after_hwframe+0x76/0x7e RIP: 0033:0x7f033ed9f397 Code: a2 c7 05 5c 43 25 00 00 00 00 00 eb 96 e8 e1 12 00 00 90 31 f6 e9 09 00 00 00 66 0f 1f 84 00 00 00 00 00 b8 a6 00 00 00 0f 05 <48> 3d 00 f0 ff ff 77 01 c3 48 c7 c2 e8 ff ff ff f7 d8 64 89 02 b8 RSP: 002b:00007fff365b5838 EFLAGS: 00000246 ORIG_RAX: 00000000000000a6 RAX: 0000000000000000 RBX: 0000000000000000 RCX: 00007f033ed9f397 RDX: 0000000000000000 RSI: 0000000000000009 RDI: 00007fff365b58f0 RBP: 00007fff365b58f0 R08: 00007fff365b68f0 R09: 00000000ffffffff R10: 0000000000000000 R11: 0000000000000246 R12: 00007fff365b6980 R13: 00007f033ee3448b R14: 0000000000006d62 R15: 00007fff365b69c0 ---[ end trace 0000000000000000 ]--- ================================================================== BUG: KASAN: null-ptr-deref in instrument_atomic_read_write include/linux/instrumented.h:96 [inline] BUG: KASAN: null-ptr-deref in atomic_inc_return include/linux/atomic/atomic-instrumented.h:453 [inline] BUG: KASAN: null-ptr-deref in ihold+0x24/0x70 fs/inode.c:452 Write of size 4 at addr 0000000000000168 by task syz-executor/378 CPU: 0 UID: 0 PID: 378 Comm: syz-executor Tainted: G W syzkaller #0 238002c42480d657f84ffff3a67e0b81dcf43858 Tainted: [W]=WARN Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 Call Trace: __dump_stack+0x21/0x30 lib/dump_stack.c:94 dump_stack_lvl+0x140/0x1c0 lib/dump_stack.c:120 print_report+0x3d/0x70 mm/kasan/report.c:484 kasan_report+0x162/0x1a0 mm/kasan/report.c:594 check_region_inline mm/kasan/generic.c:-1 [inline] kasan_check_range+0x25a/0x2b0 mm/kasan/generic.c:189 __kasan_check_write+0x18/0x20 mm/kasan/shadow.c:37 instrument_atomic_read_write include/linux/instrumented.h:96 [inline] atomic_inc_return include/linux/atomic/atomic-instrumented.h:453 [inline] ihold+0x24/0x70 fs/inode.c:452 d_delete_notify include/linux/fsnotify.h:357 [inline] vfs_rmdir+0x25c/0x560 fs/namei.c:4361 incfs_kill_sb+0x102/0x220 fs/incfs/vfs.c:1968 deactivate_locked_super+0xd5/0x270 fs/super.c:478 deactivate_super+0xb8/0xe0 fs/super.c:511 cleanup_mnt+0x438/0x4d0 fs/namespace.c:1380 __cleanup_mnt+0x1d/0x40 fs/namespace.c:1387 task_work_run+0x1e5/0x260 kernel/task_work.c:246 resume_user_mode_work+0x35/0x50 include/linux/resume_user_mode.h:50 exit_to_user_mode_loop kernel/entry/common.c:114 [inline] exit_to_user_mode_prepare include/linux/entry-common.h:328 [inline] __syscall_exit_to_user_mode_work kernel/entry/common.c:207 [inline] syscall_exit_to_user_mode+0x63/0xb0 kernel/entry/common.c:218 do_syscall_64+0x63/0xf0 arch/x86/entry/common.c:84 entry_SYSCALL_64_after_hwframe+0x76/0x7e RIP: 0033:0x7f033ed9f397 Code: a2 c7 05 5c 43 25 00 00 00 00 00 eb 96 e8 e1 12 00 00 90 31 f6 e9 09 00 00 00 66 0f 1f 84 00 00 00 00 00 b8 a6 00 00 00 0f 05 <48> 3d 00 f0 ff ff 77 01 c3 48 c7 c2 e8 ff ff ff f7 d8 64 89 02 b8 RSP: 002b:00007fff365b5838 EFLAGS: 00000246 ORIG_RAX: 00000000000000a6 RAX: 0000000000000000 RBX: 0000000000000000 RCX: 00007f033ed9f397 RDX: 0000000000000000 RSI: 0000000000000009 RDI: 00007fff365b58f0 RBP: 00007fff365b58f0 R08: 00007fff365b68f0 R09: 00000000ffffffff R10: 0000000000000000 R11: 0000000000000246 R12: 00007fff365b6980 R13: 00007f033ee3448b R14: 0000000000006d62 R15: 00007fff365b69c0 ================================================================== BUG: kernel NULL pointer dereference, address: 0000000000000168 #PF: supervisor write access in kernel mode #PF: error_code(0x0002) - not-present page PGD 8000000115589067 P4D 8000000115589067 PUD 0 Oops: Oops: 0002 [#1] PREEMPT SMP KASAN PTI CPU: 0 UID: 0 PID: 378 Comm: syz-executor Tainted: G B W syzkaller #0 238002c42480d657f84ffff3a67e0b81dcf43858 Tainted: [B]=BAD_PAGE, [W]=WARN Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 RIP: 0010:arch_atomic_add_return arch/x86/include/asm/atomic.h:85 [inline] RIP: 0010:raw_atomic_add_return include/linux/atomic/atomic-arch-fallback.h:564 [inline] RIP: 0010:raw_atomic_inc_return include/linux/atomic/atomic-arch-fallback.h:1020 [inline] RIP: 0010:atomic_inc_return include/linux/atomic/atomic-instrumented.h:454 [inline] RIP: 0010:ihold+0x2a/0x70 fs/inode.c:452 Code: f3 0f 1e fa 55 48 89 e5 41 56 53 48 89 fb e8 6d 26 95 ff 48 8d bb 68 01 00 00 be 04 00 00 00 e8 cc 03 ee ff 41 be 01 00 00 00 44 0f c1 b3 68 01 00 00 41 ff c6 bf 02 00 00 00 44 89 f6 e8 7d RSP: 0018:ffffc9000125fcc8 EFLAGS: 00010246 RAX: ffff888114810000 RBX: 0000000000000000 RCX: ffff888114810000 RDX: 0000000000000000 RSI: 0000000000000000 RDI: 0000000000000000 RBP: ffffc9000125fcd8 R08: ffffffff88bba947 R09: 1ffffffff1177528 R10: dffffc0000000000 R11: fffffbfff1177529 R12: 0000000000000000 R13: 0000000000000000 R14: 0000000000000001 R15: dffffc0000000000 FS: 000055556ccd0500(0000) GS:ffff8881f6e00000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: 0000000000000168 CR3: 00000001143c4000 CR4: 00000000003526b0 Call Trace: d_delete_notify include/linux/fsnotify.h:357 [inline] vfs_rmdir+0x25c/0x560 fs/namei.c:4361 incfs_kill_sb+0x102/0x220 fs/incfs/vfs.c:1968 deactivate_locked_super+0xd5/0x270 fs/super.c:478 deactivate_super+0xb8/0xe0 fs/super.c:511 cleanup_mnt+0x438/0x4d0 fs/namespace.c:1380 __cleanup_mnt+0x1d/0x40 fs/namespace.c:1387 task_work_run+0x1e5/0x260 kernel/task_work.c:246 resume_user_mode_work+0x35/0x50 include/linux/resume_user_mode.h:50 exit_to_user_mode_loop kernel/entry/common.c:114 [inline] exit_to_user_mode_prepare include/linux/entry-common.h:328 [inline] __syscall_exit_to_user_mode_work kernel/entry/common.c:207 [inline] syscall_exit_to_user_mode+0x63/0xb0 kernel/entry/common.c:218 do_syscall_64+0x63/0xf0 arch/x86/entry/common.c:84 entry_SYSCALL_64_after_hwframe+0x76/0x7e RIP: 0033:0x7f033ed9f397 Code: a2 c7 05 5c 43 25 00 00 00 00 00 eb 96 e8 e1 12 00 00 90 31 f6 e9 09 00 00 00 66 0f 1f 84 00 00 00 00 00 b8 a6 00 00 00 0f 05 <48> 3d 00 f0 ff ff 77 01 c3 48 c7 c2 e8 ff ff ff f7 d8 64 89 02 b8 RSP: 002b:00007fff365b5838 EFLAGS: 00000246 ORIG_RAX: 00000000000000a6 RAX: 0000000000000000 RBX: 0000000000000000 RCX: 00007f033ed9f397 RDX: 0000000000000000 RSI: 0000000000000009 RDI: 00007fff365b58f0 RBP: 00007fff365b58f0 R08: 00007fff365b68f0 R09: 00000000ffffffff R10: 0000000000000000 R11: 0000000000000246 R12: 00007fff365b6980 R13: 00007f033ee3448b R14: 0000000000006d62 R15: 00007fff365b69c0 Modules linked in: CR2: 0000000000000168 ---[ end trace 0000000000000000 ]--- RIP: 0010:arch_atomic_add_return arch/x86/include/asm/atomic.h:85 [inline] RIP: 0010:raw_atomic_add_return include/linux/atomic/atomic-arch-fallback.h:564 [inline] RIP: 0010:raw_atomic_inc_return include/linux/atomic/atomic-arch-fallback.h:1020 [inline] RIP: 0010:atomic_inc_return include/linux/atomic/atomic-instrumented.h:454 [inline] RIP: 0010:ihold+0x2a/0x70 fs/inode.c:452 Code: f3 0f 1e fa 55 48 89 e5 41 56 53 48 89 fb e8 6d 26 95 ff 48 8d bb 68 01 00 00 be 04 00 00 00 e8 cc 03 ee ff 41 be 01 00 00 00 44 0f c1 b3 68 01 00 00 41 ff c6 bf 02 00 00 00 44 89 f6 e8 7d RSP: 0018:ffffc9000125fcc8 EFLAGS: 00010246 RAX: ffff888114810000 RBX: 0000000000000000 RCX: ffff888114810000 RDX: 0000000000000000 RSI: 0000000000000000 RDI: 0000000000000000 RBP: ffffc9000125fcd8 R08: ffffffff88bba947 R09: 1ffffffff1177528 R10: dffffc0000000000 R11: fffffbfff1177529 R12: 0000000000000000 R13: 0000000000000000 R14: 0000000000000001 R15: dffffc0000000000 FS: 000055556ccd0500(0000) GS:ffff8881f6e00000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: 0000000000000168 CR3: 00000001143c4000 CR4: 00000000003526b0 ---------------- Code disassembly (best guess): 0: f3 0f 1e fa endbr64 4: 55 push %rbp 5: 48 89 e5 mov %rsp,%rbp 8: 41 56 push %r14 a: 53 push %rbx b: 48 89 fb mov %rdi,%rbx e: e8 6d 26 95 ff call 0xff952680 13: 48 8d bb 68 01 00 00 lea 0x168(%rbx),%rdi 1a: be 04 00 00 00 mov $0x4,%esi 1f: e8 cc 03 ee ff call 0xffee03f0 24: 41 be 01 00 00 00 mov $0x1,%r14d * 2a: f0 44 0f c1 b3 68 01 lock xadd %r14d,0x168(%rbx) <-- trapping instruction 31: 00 00 33: 41 ff c6 inc %r14d 36: bf 02 00 00 00 mov $0x2,%edi 3b: 44 89 f6 mov %r14d,%esi 3e: e8 .byte 0xe8 3f: 7d .byte 0x7d