Extracting prog: 12m45.48801768s Minimizing prog: 1h24m11.190757424s Simplifying prog options: 14m36.140156344s Extracting C: 36.08763062s Simplifying C: 0s extracting reproducer from 81 programs first checking the prog from the crash report single: executing 1 programs separately with timeout 30s testing program (duration=30s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): openat$kvm-ioctl$KVM_CREATE_VM-ioctl$KVM_CREATE_VCPU-ioctl$KVM_SET_CPUID2-ioctl$KVM_SET_USER_MEMORY_REGION-ioctl$KVM_REGISTER_COALESCED_MMIO-ioctl$KVM_REGISTER_COALESCED_MMIO-ioctl$KVM_CREATE_IRQCHIP-ioctl$KVM_CREATE_VCPU-ioctl$KVM_RUN-ioctl$KVM_RUN detailed listing: executing program 0: r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000340), 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) r2 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0) ioctl$KVM_SET_CPUID2(r2, 0x4008ae90, &(0x7f00000000c0)={0x1, 0x0, [{0xa, 0x200, 0x0, 0xfffffff8, 0x95, 0xf, 0x4ca}]}) ioctl$KVM_SET_USER_MEMORY_REGION(r1, 0x4020ae46, &(0x7f0000000400)={0x0, 0x0, 0x0, 0x20002000, &(0x7f0000000000/0x2000)=nil}) ioctl$KVM_REGISTER_COALESCED_MMIO(r1, 0x4010ae67, &(0x7f0000000180)={0x3000, 0x5000, 0x1}) ioctl$KVM_REGISTER_COALESCED_MMIO(r1, 0x4010ae67, &(0x7f0000000080)={0x2, 0x25000, 0x1}) ioctl$KVM_CREATE_IRQCHIP(r1, 0xae60) r3 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x2) ioctl$KVM_RUN(r3, 0xae80, 0x0) ioctl$KVM_RUN(r2, 0xae80, 0x0) program did not crash single: failed to extract reproducer bisect: bisecting 81 programs with base timeout 30s testing program (duration=50s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): [6, 10, 1, 3, 25, 5, 2, 1, 1, 2, 6, 6, 4, 25, 7, 7, 14, 3, 16, 3, 7, 7, 5, 11, 30, 16, 7, 10, 10, 2, 2, 5, 4, 14, 30, 5, 1, 30, 30, 14, 5, 2, 2, 1, 3, 14, 2, 2, 8, 2, 2, 14, 1, 2, 5, 2, 2, 12, 15, 21, 10, 3, 4, 15, 9, 10, 3, 11, 4, 21, 6, 10, 9, 11, 24, 8, 10, 3, 4, 20, 11] detailed listing: executing program 32: write$bt_hci(0xffffffffffffffff, 0x0, 0x8) r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000000), 0x42901, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, 0x0) r1 = socket$kcm(0x2, 0xa, 0x2) ioctl$SIOCSIFHWADDR(r1, 0x8914, &(0x7f0000000180)={'syzkaller1\x00', @broadcast}) write$tun(r0, &(0x7f0000000240)=ANY=[@ANYBLOB="034886dd0900300003003000000060ce902d9f0c2f0081e949b93897bc3b0000000000007d01ff020000000000000000000000000001"], 0xfdef) executing program 33: r0 = socket$packet(0x11, 0x3, 0x300) ioctl$BTRFS_IOC_SET_RECEIVED_SUBVOL(0xffffffffffffffff, 0xc0c89425, 0x0) ioctl$BTRFS_IOC_SNAP_DESTROY_V2(0xffffffffffffffff, 0x5000943f, &(0x7f0000002680)={{}, 0x0, 0x0, @inherit={0x0, 0x0}, @subvolid=0x5}) sendmsg$NFT_BATCH(0xffffffffffffffff, 0x0, 0x20050800) syz_usb_connect(0x3, 0x39, 0x0, 0x0) setsockopt$packet_fanout(r0, 0x107, 0x12, &(0x7f0000000000)={0x0, 0x8000}, 0x4) r1 = socket$inet_udp(0x2, 0x2, 0x0) bind$inet(r1, &(0x7f0000000240)={0x2, 0xffff, @dev={0xac, 0x14, 0x14, 0x2d}}, 0x10) sendmmsg$inet(r1, &(0x7f0000002080)=[{{&(0x7f0000000080)={0x2, 0x4e24, @multicast2}, 0x10, &(0x7f0000000c80)=[{&(0x7f00000000c0)="fe3c75b276077fc35911f546eac465645aa92c329d22ffbc788e506d852723e2337591365c05e594c38a11b4f2baff4d0f1602c0bdf4c3fbb581421631d4e319aad5acd0922cc47e1ad1af5118208a8887090b7589a06ee0cdfc4a91092393ff52aa490100032d557ceec6ff521222d645daf4da328a8e481f4e07e0bca05b5a8f87a1ae2bbb7e428921b3f350c9641376946127f5ffa0953dea4489a5071812df69bd736d31ac5920beb426e82aef92caa9426c45a59ba821f951b1eb3009237bc67102b3d53cd38229b990778c9f1eddc861d9a8e88518793bc58a696d47b6c44573599123bf52a5965f4b0d03dc76c0a87ea24812681833d2788d022bf57bee519bfa20c6c698480062647785d9667cd3804ac83d5e65c9a667aa43a063", 0x11f}, {&(0x7f0000000640)="6c8c778bd61f52153eadf672a8afd4ac2cd4485dcd4ec767a7bc9928c1328c782cc6c00961536b8714456de68c0b95c356c5b4aabed86f3324eeb0d0c5180e6ee7", 0x41}, {&(0x7f00000006c0)="0998b6d80a5faee59cbeec7bcfcf9c1e2063f5c7082c6896033bfc01320f555949aa7fb3aa9d03660281ad546de98f985dd938e4ed7e46ad0a835981830e04e89e6a70df4c3d0e95a4ff35c7fdcdc22db9305a009437df2d7eeb7d268c412a2a8b4dc9a4a82b330784399d9b907b59e310e590915cf77c7e8aebd679af6993193e5d6f9b2d040a353af1b5a36d640147dc4a59034dfb80c58eaf1ed1b1c0a1d6c26cd0e6238521f2e427", 0xaa}, {&(0x7f0000000780)="b36fb12aeed1fca7dbe86cf8a51fcba64a4500b788fff99c2fea82772ec33fc8474c776390bdeadd0d0163242a6aeee9", 0x30}, {&(0x7f00000007c0)="c53403c9821d42ed436ddabc91e99c52cf74e4b7206281f94b750df03503ba7407ac3ed8d4423ff381d8c5ac6672bec3e85d29de039e96e57d5f68983261f0f7ab687cee54125ba3c3ae32dc0a78f5fefac1a06071f63da3c50eac66f63e6faad0176c96972e6e4e6314f80acf08a24b714ad9cd607f1e1d680b8f6be20f06fad2a91d3bbed6eb8651887af873", 0x8d}], 0x5}}, {{0x0, 0x0, &(0x7f0000003780)=[{&(0x7f00000037c0)="6985100ddecb741d39068639baefb93383602f529580bd26d98f9828ed127dc304fdbd412cc02db818e9aa5a571f4983db5477c17a5166c472fa579c92bd6748b0f88f7a2909e7ec90e01a290bc57641e89ab31b7997f4e77b7e2593fa025834ebad7838e2ac033a1b08c204f5edf137845a52cc8464cc0c830bee7efcaa7e7198735b9555b2b57898f2fa42b97f3f6e64fddace78578c97f758559d5146abcfdd1a5f4edeb1c0680f2d95f86b8efd69a60d1a65320421d09224d9cd3fa1396ce69c1d98ef782820e57640dc567209d4cc1fd2fec98ef36a18e90ba68f415f2c7a70ecd21a964ba0a2dc76bee9d8534da8d976607882b63076cf18f34b2b888b56d18993074fec22409fabfe420740c3b7305a005459d8916d796929111028cd9919704c2a55c55b1507476832867d4b0014fc5332ccb7a79a8c30b6c40d9601931d320a4ad31dfd2307d2962df7ac92dd5aea2b2912bd92654bfbc4109ab73805b59d42d687e35a76390b252526f5fc8baa10faae1b26861f730661f0678deeafc08d40f6cbce9d38f8e788fd3dbc4811b75544e494f9857af640880e082098a7d0a621cc341f05d9f9d8fd4585d0d8e55514f6f974d07f064fda30fafc7fb5d123250c4eab673fceeaeb247ec3fa2499257001dcf140222519cd44b04cf1c73c87d73d97e7c5acd63dcb6c37454bb37ef299183574e059b6849dfa6c9f9785d6becfe7e150effe821f2d13d804c0fcc31769ff2d3b13a41681ce046a790159dd996525e65c43201fa21967e002771e47cdb5fb4dceb24147c7c4e6ebb14cebfa8598a8a848bd43b44e79c22be5a053bd3ce2a7bfa48b05db8413a38772321617ee68c8f79d30f799ec85b6b4cace3b98350733c393aebdea0f62f937a3e9f9fa48eb3cbadcd33e70cacd5e803aeb6842278107925c8f419890947a4665866c40a0327f4ecb818a65941f4b4e854909335aec1fb9c01b9a84fe8cd2009ebabc855d8df6a3fdafec88c954cf1dec34031024f0aa711bb7ea4bbc69e8cefc349398f4bbc5b4926ad9151f5c86c4f0ba56c41755509424", 0x2f6}], 0x1}}], 0x2, 0x2000c044) writev(r1, &(0x7f0000002640)=[{&(0x7f0000000c40)="b4", 0x1}], 0x1) executing program 34: mremap(&(0x7f00008ba000/0x1000)=nil, 0x1000, 0x2000, 0x3, &(0x7f00005b7000/0x2000)=nil) executing program 35: r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0) executing program 36: r0 = socket$inet6_sctp(0xa, 0x1, 0x84) mkdir(&(0x7f0000000000)='my_sys\x00', 0x1ff) mount(0x0, &(0x7f0000000200)='my_sys\x00', &(0x7f0000000300)='sysfs\x00', 0x0, 0x0) r1 = openat(0xffffffffffffff9c, &(0x7f0000000500)='my_sys/bus/pci/devices/0000:00:03.0/resource1\x00', 0x2, 0x0) mmap$IORING_OFF_SQ_RING(0x0, 0x4, 0x1000002, 0x12, r1, 0x0) syz_fuse_handle_req(0xffffffffffffffff, 0x0, 0x0, &(0x7f0000000a00)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f0000000200)={0x90, 0x0, 0x0, {0x0, 0x0, 0x0, 0xfffffffffffffffc, 0x200, 0x0, {0x20000000000005, 0x0, 0x7, 0x1000007, 0x3, 0x0, 0xfffffffe, 0x8000000, 0x0, 0xa000, 0x10000, 0x0, 0x0, 0x734, 0x20}}}, 0x0, 0x0, 0x0, 0x0, 0x0}) r2 = syz_clone(0x11, 0x0, 0x0, 0x0, 0x0, 0x0) ptrace(0x10, r2) ptrace$setregs(0xd, r2, 0x2, &(0x7f0000000180)) ptrace$cont(0x21, r2, 0x80000001, 0x4) setsockopt$SO_ATTACH_FILTER(r0, 0x1, 0x1a, &(0x7f0000000100)={0x1, &(0x7f0000000080)=[{0x6, 0x6e, 0x5, 0x6}]}, 0x10) setsockopt$inet_sctp_SCTP_SOCKOPT_BINDX_ADD(r0, 0x84, 0x64, &(0x7f0000000000)=[@in6={0xa, 0x4e23, 0x0, @loopback}], 0x1c) mkdirat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000)='./cgroup.net/syz0\x00', 0x1ff) r3 = openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000), 0x200002, 0x0) r4 = openat$cgroup_freezer_state(r3, &(0x7f0000000140), 0x2, 0x0) r5 = syz_clone(0x2100, 0x0, 0x0, 0x0, 0x0, 0x0) r6 = openat$ppp(0xffffffffffffff9c, &(0x7f0000000000), 0xc0802, 0x0) ioctl$PPPIOCNEWUNIT(r6, 0xc004743e, &(0x7f00000000c0)) ioctl$PPPIOCSMAXCID(r6, 0x40047451, &(0x7f0000000200)=0x8) ioctl$PPPIOCSFLAGS1(r6, 0x40047459, &(0x7f0000000100)=0x2000004) pwritev(r6, &(0x7f00000003c0)=[{&(0x7f0000000300)='\x00!', 0x2}], 0x1, 0x73a, 0xfffffffc) r7 = openat$cgroup_procs(r3, &(0x7f00000002c0)='tasks\x00', 0x2, 0x0) syz_open_dev$I2C(&(0x7f0000001c40), 0x0, 0x0) write$cgroup_pid(r7, &(0x7f0000000300)=r5, 0x12) write$cgroup_freezer_state(r4, &(0x7f0000000080)='THAWED\x00', 0x7) executing program 37: pipe2(&(0x7f0000000080)={0xffffffffffffffff}, 0x0) r1 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) r2 = ioctl$KVM_CREATE_VM(r1, 0xae01, 0x0) ioctl$KVM_CREATE_VCPU(r2, 0xae41, 0x0) close_range(r0, 0xffffffffffffffff, 0x0) executing program 38: r0 = openat(0xffffffffffffff9c, &(0x7f0000000180)='./cgroup.net/devices.allow\x00', 0x2, 0x48) poll(&(0x7f00000001c0)=[{r0, 0x4c0}], 0x1, 0x4) executing program 39: syz_open_procfs(0xffffffffffffffff, &(0x7f0000000040)='net/ip6_flowlabel\x00') executing program 40: mlock(&(0x7f0000a51000/0x2000)=nil, 0x2000) (fail_nth: 1) executing program 41: r0 = socket$kcm(0xa, 0x3, 0x3a) ioctl$EXT4_IOC_MOVE_EXT(r0, 0xc028660f, 0x0) (fail_nth: 1) executing program 42: r0 = syz_open_dev$sndctrl(&(0x7f0000000000), 0x1, 0x0) ioctl$SNDRV_CTL_IOCTL_ELEM_READ(r0, 0xc4c85512, &(0x7f0000000280)={{0x4, 0x0, 0x0, 0x0, 'syz1\x00'}, 0x0, [0x0, 0x0, 0x1, 0x8000003, 0x0, 0xffffffffffffffff, 0x9, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xef0, 0x0, 0x5, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffffffffffe, 0x0, 0x3fffffffffffffff, 0x0, 0x0, 0xfffffffffffffffc, 0x0, 0x0, 0x0, 0x0, 0x1fe, 0x0, 0x0, 0xfffffffffffffffe, 0x0, 0xc874, 0x0, 0x0, 0x0, 0x40, 0x0, 0x0, 0x0, 0x7f, 0x2, 0x0, 0x0, 0x2, 0x9, 0x0, 0x0, 0x2, 0x0, 0x2, 0x1004, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xf, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x400000000, 0x0, 0x40, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x400000000000fc, 0x0, 0x0, 0x0, 0x0, 0x200000010000, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x4a54, 0x0, 0x1000000000, 0x0, 0x0, 0x0, 0x0, 0x4, 0x0, 0x0, 0x0, 0x0, 0x8000000eff8, 0x0, 0x0, 0x0, 0x8, 0x0, 0x20000e9a, 0x0, 0x0, 0x7fffffff, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8000000]}) r1 = openat$binderfs(0xffffffffffffff9c, &(0x7f00000000c0)='./binderfs/binder1\x00', 0x0, 0x0) r2 = openat$vimc0(0xffffffffffffff9c, &(0x7f0000000000), 0x2, 0x0) ioctl$VIDIOC_QUERY_DV_TIMINGS(r2, 0x80845663, &(0x7f0000000100)={0x0, @reserved}) ioctl$BINDER_SET_MAX_THREADS(r1, 0x40046205, 0x0) executing program 43: r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000240), 0x2041, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x17) ioctl$KVM_CREATE_IRQCHIP(r1, 0xae60) r2 = openat$comedi(0xffffffffffffff9c, &(0x7f0000000000)='/dev/comedi4\x00', 0x0, 0x0) ioctl$COMEDI_INSNLIST(r2, 0x8010640b, &(0x7f00000e9700)={0x2, &(0x7f00000a4a00)=[{0x6000004, 0x0, 0x0, 0x81, 0x3}, {0xa000005, 0x0, 0x0, 0x3, 0x1}]}) ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x1) executing program 44: r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000240), 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) ioctl$KVM_CREATE_IRQCHIP(r1, 0xae60) ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0) (fail_nth: 1) executing program 45: r0 = socket$inet6_sctp(0xa, 0x1, 0x84) mkdir(&(0x7f0000000000)='my_sys\x00', 0x1ff) mount(0x0, &(0x7f0000000200)='my_sys\x00', &(0x7f0000000300)='sysfs\x00', 0x0, 0x0) r1 = openat(0xffffffffffffff9c, &(0x7f0000000500)='my_sys/bus/pci/devices/0000:00:03.0/resource1\x00', 0x2, 0x0) mmap$IORING_OFF_SQ_RING(0x0, 0x4, 0x1000002, 0x12, r1, 0x0) syz_fuse_handle_req(0xffffffffffffffff, 0x0, 0x0, &(0x7f0000000a00)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f0000000200)={0x90, 0x0, 0x0, {0x0, 0x0, 0x0, 0xfffffffffffffffc, 0x200, 0x0, {0x20000000000005, 0x0, 0x7, 0x1000007, 0x3, 0x0, 0xfffffffe, 0x8000000, 0x0, 0xa000, 0x10000, 0x0, 0x0, 0x734, 0x20}}}, 0x0, 0x0, 0x0, 0x0, 0x0}) r2 = syz_clone(0x11, 0x0, 0x0, 0x0, 0x0, 0x0) ptrace(0x10, r2) ptrace$setregs(0xd, r2, 0x2, &(0x7f0000000180)) ptrace$cont(0x21, r2, 0x80000001, 0x4) setsockopt$SO_ATTACH_FILTER(r0, 0x1, 0x1a, &(0x7f0000000100)={0x1, &(0x7f0000000080)=[{0x6, 0x6e, 0x5, 0x6}]}, 0x10) setsockopt$inet_sctp_SCTP_SOCKOPT_BINDX_ADD(r0, 0x84, 0x64, &(0x7f0000000000)=[@in6={0xa, 0x4e23, 0x0, @loopback}], 0x1c) mkdirat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000)='./cgroup.net/syz0\x00', 0x1ff) r3 = openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000), 0x200002, 0x0) r4 = openat$cgroup_freezer_state(r3, &(0x7f0000000140), 0x2, 0x0) syz_clone(0x2100, 0x0, 0x0, 0x0, 0x0, 0x0) r5 = openat$ppp(0xffffffffffffff9c, &(0x7f0000000000), 0xc0802, 0x0) ioctl$PPPIOCNEWUNIT(r5, 0xc004743e, &(0x7f00000000c0)) ioctl$PPPIOCSMAXCID(r5, 0x40047451, &(0x7f0000000200)=0x8) ioctl$PPPIOCSFLAGS1(r5, 0x40047459, &(0x7f0000000100)=0x2000004) pwritev(r5, &(0x7f00000003c0)=[{&(0x7f0000000300)='\x00!', 0x2}], 0x1, 0x73a, 0xfffffffc) openat$cgroup_procs(r3, &(0x7f00000002c0)='tasks\x00', 0x2, 0x0) r6 = syz_open_dev$I2C(&(0x7f0000001c40), 0x0, 0x0) ioctl$I2C_TENBIT(r6, 0x704, 0x0) write$cgroup_freezer_state(r4, &(0x7f0000000080)='THAWED\x00', 0x7) executing program 6: r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000340), 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) ioctl$KVM_SET_USER_MEMORY_REGION(r1, 0x4020ae46, &(0x7f0000000400)={0x0, 0x0, 0x0, 0x20002000, &(0x7f0000000000/0x2000)=nil}) r2 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0) ioctl$KVM_RUN(r2, 0xae80, 0x0) ioctl$KVM_REGISTER_COALESCED_MMIO(r1, 0x4010ae67, &(0x7f0000000000)={0x6000, 0x2000, 0x1}) ioctl$KVM_RUN(r2, 0xae80, 0x0) executing program 6: r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000340), 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) ioctl$KVM_SET_USER_MEMORY_REGION(r1, 0x4020ae46, &(0x7f0000000400)={0x0, 0x0, 0x0, 0x20002000, &(0x7f0000000000/0x2000)=nil}) r2 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0) ioctl$KVM_RUN(r2, 0xae80, 0x0) ioctl$KVM_REGISTER_COALESCED_MMIO(r1, 0x4010ae67, &(0x7f0000000000)={0x6000, 0x2000, 0x1}) ioctl$KVM_RUN(r2, 0xae80, 0x0) (fail_nth: 1) executing program 6: r0 = socket$netlink(0x10, 0x3, 0xc) r1 = socket(0x40000000015, 0x5, 0x0) setsockopt$RDS_CONG_MONITOR(r1, 0x114, 0x6, &(0x7f0000000080)=0x1, 0x4) write$uinput_user_dev(0xffffffffffffffff, &(0x7f0000000400)={'syz0\x00', {0x3, 0x2, 0x6, 0xfffa}, 0x3a, [0x0, 0xc95a, 0xf, 0x8, 0x80, 0x4, 0x3, 0x80000000, 0x20000006, 0x4d, 0x9, 0x5d, 0xa, 0x5, 0xffff2d38, 0xffffff03, 0x6, 0x3, 0x0, 0xe, 0x7, 0x0, 0x7, 0x23c5b, 0x1, 0x20, 0xd, 0x7, 0x0, 0xffffffff, 0xe661, 0x4, 0x7, 0x7, 0x8, 0x4c74, 0x80000000, 0x242, 0x3, 0xe, 0x0, 0x80008071, 0x7, 0x17, 0x1, 0x7, 0x6, 0x3e, 0x4000008c, 0x6, 0x5, 0x0, 0x4, 0x4, 0x8008, 0x400, 0x80, 0x0, 0x5, 0x6, 0x6, 0x4, 0x1, 0xf], [0x10000007, 0x9, 0x8000012f, 0x2008004, 0x5, 0xfffffff3, 0x129432e6, 0xc8, 0xf9, 0xe, 0x2c0, 0x2, 0x9, 0xfffffffe, 0x3, 0x0, 0x0, 0x5, 0x2f, 0x0, 0x312, 0x78, 0xe, 0xfffffffe, 0x4, 0x7, 0x7fff, 0x5, 0x400, 0x401, 0x7, 0x1, 0xff, 0x5, 0x1000005, 0x5f2e, 0x1, 0x4e2, 0xc, 0x4, 0xb, 0x10000, 0x9, 0x8, 0x1009, 0x6, 0x47, 0x8000, 0x1, 0xfe000000, 0xffff, 0x0, 0x4, 0x9, 0x3, 0x3, 0x9, 0x1, 0x3, 0x3, 0x94f, 0x48c93690, 0x42, 0x3], [0x5, 0x408, 0x7, 0x5, 0xfffffffe, 0x6, 0x8d2, 0x9, 0x5, 0x8002, 0x0, 0x5, 0xb, 0x4, 0x5, 0x7, 0x0, 0x1ef, 0x5, 0x8, 0x86, 0x3, 0x303c, 0x3e7, 0xb, 0x5, 0x2, 0x2, 0x3, 0x2, 0x4, 0x6d01, 0x3, 0x38, 0x800003, 0x200, 0x80, 0x3, 0x4, 0x2950bfaf, 0xc8, 0xa2, 0x7, 0xa9, 0x5, 0x6, 0xac8, 0xca, 0x2, 0x3, 0x7ff, 0x12b, 0x4, 0x1, 0xa, 0x0, 0x1, 0x1c, 0x7, 0x3, 0x3, 0x5, 0x4, 0x3c484551], [0x9, 0xbb33, 0x7, 0x0, 0x5, 0x93a, 0x5, 0x2, 0xfffffffc, 0xb9, 0xce7, 0x203, 0x2, 0x57, 0x5, 0x3, 0x101, 0x10000, 0xb8, 0x3, 0x28, 0xa620, 0x2, 0x5, 0x1, 0x7ff, 0x14c, 0x20a7, 0x6, 0x16, 0xffffffff, 0x80000000, 0x5, 0x8, 0xc8, 0xfffffff9, 0xfffff000, 0x10000, 0x10001, 0x7e, 0x100, 0x9602, 0x7, 0xaf, 0x5, 0xfffffff9, 0x226, 0x5, 0x5, 0x8, 0x30b1d693, 0xb1f, 0x8, 0x7, 0x1, 0x6c1b, 0x0, 0x4, 0x5, 0xb1e, 0xd8, 0x200, 0xffff3441, 0xfff]}, 0x45c) r2 = socket(0x2, 0x80805, 0x0) sendmmsg$inet_sctp(r2, &(0x7f0000000dc0)=[{0x0, 0x0, 0x0, 0x0, &(0x7f00000002c0)=[@authinfo={0x18, 0x84, 0x6, {0x3800}}], 0x18, 0x40c0}], 0x1, 0x20000140) ppoll(&(0x7f00000000c0)=[{}, {}], 0x20000000000000dc, 0x0, 0x0, 0x0) bind$netlink(r0, &(0x7f0000514ff4)={0x10, 0x0, 0x0, 0x2ffffffff}, 0xc) r3 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPCTNL_MSG_CT_NEW(r3, &(0x7f0000000080)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000500)=ANY=[@ANYBLOB="940000000001010400000000000000000afe8000000000000000000000000000aa1400044900000000000000000000ffff0a0101020c00028005000100000000003c0002802c00018014000300fc02000000000000000000000000000014000400fe8000000000000000000000000000aa0c0002800500010000000000080007400100000047bb6e3421fe19b818d8f66660c30370d9c8b08e0b152e35a7282bd0e46103ffbde595b893cdc5a6ba1b80a5aa0f90c08663f47c12af7f10df52fcdb7bb811abc8a0022d2f1920a8b6683a524f7c38a01fa66f2ef599c4d97f5a1ffc055683547d6f85b7f1d51293d18f395f786072119bedb9b0d2a59a1fa3063342d8a139e72939170c2efb"], 0x94}, 0x1, 0x0, 0x0, 0x40}, 0x0) r4 = openat$sndseq(0xffffffffffffff9c, &(0x7f0000000000), 0x882) ioctl$SNDRV_SEQ_IOCTL_SET_QUEUE_TIMER(r4, 0x40605346, &(0x7f0000000440)={0x0, 0x0, {0x3, 0x2, 0x0, 0x0, 0x1}, 0x800004}) write$sndseq(r4, &(0x7f0000000140)=[{0x1f, 0x0, 0x0, 0xfd, @tick, {}, {}, @raw32}], 0x1c) sendmsg$IPCTNL_MSG_CT_DELETE(r3, &(0x7f0000000300)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000380)=ANY=[@ANYRES8=r4], 0x14}, 0x1, 0x0, 0x0, 0x20044892}, 0x4040050) executing program 6: r0 = openat$kvm(0xffffffffffffff9c, &(0x7f00000000c0), 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) ioctl$KVM_CREATE_DEVICE(r1, 0xc00caee0, &(0x7f0000000040)={0x4}) executing program 6: r0 = socket$inet6_sctp(0xa, 0x1, 0x84) mkdir(&(0x7f0000000000)='my_sys\x00', 0x1ff) mount(0x0, &(0x7f0000000200)='my_sys\x00', &(0x7f0000000300)='sysfs\x00', 0x0, 0x0) r1 = openat(0xffffffffffffff9c, &(0x7f0000000500)='my_sys/bus/pci/devices/0000:00:03.0/resource1\x00', 0x2, 0x0) mmap$IORING_OFF_SQ_RING(0x0, 0x4, 0x1000002, 0x12, r1, 0x0) syz_fuse_handle_req(0xffffffffffffffff, 0x0, 0x0, &(0x7f0000000a00)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f0000000200)={0x90, 0x0, 0x0, {0x0, 0x0, 0x0, 0xfffffffffffffffc, 0x200, 0x0, {0x20000000000005, 0x0, 0x7, 0x1000007, 0x3, 0x0, 0xfffffffe, 0x8000000, 0x0, 0xa000, 0x10000, 0x0, 0x0, 0x734, 0x20}}}, 0x0, 0x0, 0x0, 0x0, 0x0}) r2 = syz_clone(0x11, 0x0, 0x0, 0x0, 0x0, 0x0) ptrace(0x10, r2) ptrace$setregs(0xd, r2, 0x2, &(0x7f0000000180)) ptrace$cont(0x21, r2, 0x80000001, 0x4) setsockopt$SO_ATTACH_FILTER(r0, 0x1, 0x1a, &(0x7f0000000100)={0x1, &(0x7f0000000080)=[{0x6, 0x6e, 0x5, 0x6}]}, 0x10) setsockopt$inet_sctp_SCTP_SOCKOPT_BINDX_ADD(r0, 0x84, 0x64, &(0x7f0000000000)=[@in6={0xa, 0x4e23, 0x0, @loopback}], 0x1c) mkdirat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000)='./cgroup.net/syz0\x00', 0x1ff) r3 = openat$cgroup_freezer_state(0xffffffffffffffff, &(0x7f0000000140), 0x2, 0x0) write$cgroup_freezer_state(r3, &(0x7f0000000080)='THAWED\x00', 0x7) syz_usb_connect(0x6, 0x3f, &(0x7f0000000040)=ANY=[@ANYRES64=r0, @ANYRESOCT=r0], 0x0) executing program 7: r0 = openat$kvm(0xffffffffffffff9c, &(0x7f00000000c0), 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) ioctl$KVM_CREATE_DEVICE(r1, 0xc00caee0, &(0x7f0000000040)={0x4}) (fail_nth: 1) executing program 6: sendmmsg$inet6(0xffffffffffffffff, 0x0, 0x0, 0x4000010) sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x2) r0 = socket$inet6_icmp_raw(0xa, 0x3, 0x3a) setsockopt$inet6_IPV6_HOPOPTS(r0, 0x29, 0x36, &(0x7f0000000400)=ANY=[], 0x8) connect$inet6(r0, &(0x7f0000000000)={0xa, 0x0, 0x0, @mcast2, 0x5}, 0x1c) setsockopt$SO_BINDTODEVICE(r0, 0x1, 0x19, &(0x7f0000000240)='bridge0\x00', 0x10) write(r0, &(0x7f00000000c0)="8f2a0a65bd8c002b0304000e0580a7b6070d63e286a5cefe", 0x5ac) executing program 7: sendmmsg$inet6(0xffffffffffffffff, 0x0, 0x0, 0x4000010) sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x2) r0 = socket$inet6_icmp_raw(0xa, 0x3, 0x3a) setsockopt$inet6_IPV6_HOPOPTS(r0, 0x29, 0x36, &(0x7f0000000400)=ANY=[], 0x8) connect$inet6(r0, &(0x7f0000000000)={0xa, 0x0, 0x0, @mcast2, 0x5}, 0x1c) setsockopt$SO_BINDTODEVICE(r0, 0x1, 0x19, &(0x7f0000000240)='bridge0\x00', 0x10) write(r0, &(0x7f00000000c0)="8f2a0a65bd8c002b0304000e0580a7b6070d63e286a5cefe", 0x5ac) (fail_nth: 1) executing program 7: r0 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r0, &(0x7f000000c2c0)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000340)=ANY=[@ANYBLOB="140000001000010000000000000000000000000a28000000000a0101000000005e1affd5020000000900010073797a300000000008000240000000032c000000030a01030000e6ff00000000020000000900010073797a30000000000900030073797a320000000014000000110001"], 0x7c}}, 0x0) sendmsg$NFT_BATCH(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000480)=ANY=[@ANYBLOB="140000001000010000000000000000000000000a78000000060a0b0400000000eba1c5620200fffe4c0004802800018007000100637400001c00028008000140000000020800024000000016050003000000000020000180070001006374000014000280080002400000000d080004400000000c0900010073797a30000000000900020073797a320000000014000000110001"], 0xa0}, 0x1, 0x0, 0x0, 0x840}, 0x0) close(r0) mount(&(0x7f0000000080)=@loop={'/dev/loop', 0x0}, &(0x7f0000000000)='./cgroup\x00', &(0x7f00000000c0)='erofs\x00', 0x1200011, 0x0) executing program 46: mmap$IORING_OFF_SQ_RING(0x0, 0xc00000, 0x2000006, 0x401d031, 0xffffffffffffffff, 0x0) ioctl$VIDIOC_QUERYMENU(0xffffffffffffffff, 0xc02c5625, &(0x7f0000000180)={0x8000, 0xc5f7, @name="78d56294ae9837bd2a35b13d75c994201f86e575f2e26c5ca64c40400fba0fd0"}) r0 = add_key$user(&(0x7f00000001c0), &(0x7f00000002c0)={'syz', 0x1}, &(0x7f0000000480)="fef0eda8c799a4a0c3", 0x9, 0xfffffffffffffffe) r1 = add_key$user(&(0x7f00000003c0), &(0x7f0000000440), &(0x7f00000000c0), 0xc9, 0xfffffffffffffffd) keyctl$dh_compute(0x17, &(0x7f0000000140)={r1, r1, r0}, &(0x7f00000000c0)=""/83, 0x53, 0x0) r2 = syz_ublk_setup_io_uring(0x21, 0x0, &(0x7f0000000000)=0x0, &(0x7f0000000100)=0x0, &(0x7f0000000040)=0x0) r6 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r6, &(0x7f0000000d80)={0x0, 0x0, &(0x7f00000001c0)={&(0x7f0000000d00)=ANY=[@ANYBLOB="140000001000010000000000000000000220000a3c000000120a09080000000000000000020000000900020073797a310000000008000440000000000900010073797a3000000000080003"], 0x64}, 0x1, 0x0, 0x0, 0x5}, 0x0) ioctl$sock_proto_private(r6, 0x89e1, &(0x7f0000000200)="d5b229183585887a3d6fc8d12695c87cf8a0c3c18105420fdb81dd3696b170fdbaf0bbe3c119f8808e5a802a86a06ce5ca7d39b9dfd8ee994fe7025f6df49a5634bb654c6513778417a55e8bcc847186ec940ddd430f7c70c007fb73dc9f090b19b9b68ab5d60df80f6a9e3d887d5fd4fe0d83bef1dea947b633837976aeb3257284cdf8270ade3863770f96e3483ab82bb337c9412d") syz_io_uring_submit(r3, r4, r5, &(0x7f0000000980)=@IORING_OP_SEND_ZC={0x2f, 0x1, 0x20, 0xffffffffffffffff, 0x0, 0x0, 0xde, 0x51}) syz_ublk_add_dev(r2, r3, r4, r5, &(0x7f00000003c0)={0x2e, 0x5, 0x0, 0xffffffffffffffff, 0xc0207504, 0x0, 0x0, 0x0, 0x0, 0x9, 0x0, 0x0, '\x00', {0xffffffff, 0xffff, 0x0, 0x0}}, 0x0) executing program 7: r0 = socket$inet_udp(0x2, 0x2, 0x0) r1 = accept$inet(r0, &(0x7f0000000000)={0x2, 0x0, @initdev}, &(0x7f0000000040)=0x10) read(r0, &(0x7f0000000080)=""/155, 0x9b) (async) write(r1, &(0x7f0000000140)="d45cfa6f4318c07243160e525f42126ae6a6c01b435e30020bafa260cf51f5f71826309d27604a963a7e9aad46c55399f9cfb8127b7d6ce3c8f235ef82eacf6eea0c65b8402da496c8f0a5c4f5cb0adfcb38b38656c6ee236b654ac4b55ff6b79f9523f6a9885a56be4c73648d1dba44077727dfc38e7e226ff9d550eaa99a305bd5b0c9b72907c9813a441b84a4608870c6c96b0f13a39876b9eee7f73c8a31dd7aa044ce43698d6c885f5c6d5d50ad3fef8c8d9b9757", 0xb7) (async) ioctl$DVB_DVR_DMX_EXPBUF(0xffffffffffffffff, 0xc00c6f3e, &(0x7f0000000200)={0x7401fc32, 0x80000, r1}) getsockopt$inet_mreq(r2, 0x0, 0x20, &(0x7f0000000240)={@multicast2, @private}, &(0x7f0000000280)=0x8) (async) ioctl$sock_ipv6_tunnel_SIOCCHGPRL(r0, 0x89f7, &(0x7f0000000380)={'sit0\x00', &(0x7f00000002c0)={@broadcast, 0x0, 0x0, 0x80, 0x0, [{@loopback}, {@broadcast}, {@multicast2}, {@initdev}, {@dev}, {@dev}, {@local}, {@dev}]}}) (async, rerun: 64) ioctl$BTRFS_IOC_QGROUP_CREATE(r0, 0x4010942a, &(0x7f00000003c0)={0x1, 0x100}) (async, rerun: 64) ioctl$NILFS_IOCTL_SET_SUINFO(r0, 0x40186e8d, &(0x7f0000000440)={&(0x7f0000000400)=[{0x9, 0x0, 0x0, {0x1, 0x9, 0x3}}, {0x8, 0x1, 0x0, {0x4, 0x7, 0x1}}], 0x2, 0x20, 0x3, 0x7}) (async) ioctl$BLKTRACESETUP(r0, 0xc0481273, &(0x7f0000000480)={'\x00', 0x0, 0x89, 0x8, 0x5, 0x81, 0xffffffffffffffff}) ioctl$UBLK_U_CMD_ADD_DEV(r2, 0xc0207504, &(0x7f0000000540)={0xffffffff, 0xffff, 0x40, &(0x7f0000000500)=@any_dev={0x4, 0x686, 0x0, 0x0, 0x1000, 0x40000000, r3}}) (async) setsockopt$inet_opts(r0, 0x0, 0x0, &(0x7f00000005c0)="cdca8841105d816d6e224311095a2a90332292654aceae72b93baf7126688c214be8570e3a6cba6b4013bea43137f4d7a9da35c9f3431a0b3a74", 0x3a) (async) ioctl$UBLK_U_CMD_GET_PARAMS(r2, 0x80207509, &(0x7f0000000680)={0x0, 0xffff, 0x70, &(0x7f0000000600)={0x70}}) (async) ioctl$MEMERASE(0xffffffffffffffff, 0x40084d02, &(0x7f0000000700)={0x9, 0x3}) r4 = openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000740)='./cgroup/syz1\x00', 0x200002, 0x0) r5 = openat$cgroup_type(r4, &(0x7f0000000780), 0x2, 0x0) (async) ioctl$VIDIOC_SUBDEV_S_FMT(r2, 0xc0585605, &(0x7f00000007c0)={0x1, 0x0, {0xe, 0xfffff540, 0x1001, 0x9, 0x4, 0x41a589970e9d537e, 0x1, 0x1}}) sendto$x25(r2, &(0x7f0000000840)="fe1674a0fc2c4dd943fa3ae770fcb302f6d4337cb0d281dfa97f6424ab802f306bc26e0b2f28f44efd0e94ce4b18819aa20accb613ea3e4fd3647e1427c17e0fe95c2183962dd0cb64e4aabe944aecaca1e224f020a5881bbb3e2b0005067d0e98d64ca5d8d46c07c76950e130c946890fd228053005af14ff4322d129c30f36d2c8eaddda39e90e8edad124337f8bff811d4ae38c75b9dd229357274d48f1", 0x9f, 0x8000, &(0x7f0000000900)={0x9, @remote={'\xcc\xcc\xcc\xcc\xcc\xcc\xcc\xcc\xcc\xcc\xcc\xcc\xcc\xcc', 0x0}}, 0x12) close_range(r4, r5, 0x2) (async) ioctl$EXT4_IOC_GET_ES_CACHE(r4, 0xc020662a, &(0x7f0000000940)={0x4, 0x100000000, 0x3, 0x2, 0x5, 0x0, [{0x3, 0x8a, 0x8000000000000001, '\x00', 0x4}, {0x0, 0x9, 0x977b, '\x00', 0x602}, {0x11, 0xc6163d5, 0x278, '\x00', 0x80}, {0x0, 0x5, 0x958}, {0xff, 0x71, 0x0, '\x00', 0x301}]}) ioctl$XFS_IOC_PATH_TO_HANDLE(r5, 0xc0385869, &(0x7f0000000b80)={r2, &(0x7f0000000a80)='\xcc\xcc\xcc\xcc\xcc\xcc\xcc\xcc\xcc\xcc\xcc\xcc\xcc\xcc', 0x200000, &(0x7f0000000ac0)={@align=0x4, {0x8, 0xb6fe, 0xd, 0x6}}, 0xf1, &(0x7f0000000b00), &(0x7f0000000b40)=0x8000}) read(r6, &(0x7f0000000bc0)=""/66, 0x42) (async) ioctl$EXT4_IOC_ALLOC_DA_BLKS(r5, 0x660c) (async) r7 = accept$phonet_pipe(r2, &(0x7f0000000c40), &(0x7f0000000c80)=0x10) ioctl$XFS_IOC_GET_RESBLKS(r7, 0x80105873, &(0x7f0000000cc0)) (async, rerun: 64) ioctl$ifreq_SIOCGIFINDEX_vcan(r7, 0x8933, &(0x7f0000000d00)={'vcan0\x00', 0x0}) (rerun: 64) ioctl$sock_ipv4_tunnel_SIOCGETTUNNEL(r2, 0x89f0, &(0x7f0000000e40)={'gre0\x00', &(0x7f0000000d40)={'ip_vti0\x00', r8, 0x80, 0x0, 0x6, 0xbac8, {{0x2f, 0x4, 0x3, 0x27, 0xbc, 0x68, 0x0, 0x0, 0x4, 0x0, @empty, @local, {[@timestamp={0x44, 0x10, 0x6c, 0x0, 0x6, [0x6, 0x0, 0x2]}, @cipso={0x86, 0x23, 0xffffffffffffffff, [{0x0, 0xb, "b40bf990b95aaa99d4"}, {0x5, 0x7, "302f84ca8e"}, {0x0, 0x7, "7cf0462b28"}, {0x1, 0x4, "e7fb"}]}, @end, @cipso={0x86, 0x55, 0x1, [{0x2, 0x10, "1a4b0cf62d5249827fc6939c185a"}, {0x7, 0x11, "a54ffff76a2a43d32b6fe321d9c1d3"}, {0x2, 0x12, "ebfeacaa5d3ffaf789bb2ac229990dbf"}, {0x4, 0xc, "9ff6a9b86d2946eced0e"}, {0x0, 0x10, "1ee2875af2d49c05a29e9111910a"}]}, @timestamp_prespec={0x44, 0x1c, 0x50, 0x3, 0x0, [{@local, 0x5}, {@local, 0x9}, {@empty, 0x8}]}]}}}}}) (async) setsockopt$inet_sctp_SCTP_RECVRCVINFO(r6, 0x84, 0x20, &(0x7f0000000e80)=0xe77, 0x4) (async, rerun: 32) ioctl$XFS_IOC_PATH_TO_HANDLE(r0, 0xc0385869, &(0x7f0000000fc0)={r6, &(0x7f0000000ec0)='{}\x00', 0x400, &(0x7f0000000f00)={@_ha_fsid={[0x7d]}, {0x5, 0x6, 0xfffffffa, 0x7ff}}, 0x4, &(0x7f0000000f40), &(0x7f0000000f80)=0x5}) (async, rerun: 32) sendmsg$nl_xfrm(r6, &(0x7f0000001100)={&(0x7f0000001000)={0x10, 0x0, 0x0, 0x10000}, 0xc, &(0x7f00000010c0)={&(0x7f0000001040)=@getsa={0x54, 0x12, 0x1, 0x70bd2a, 0x25dfdbfd, {@in=@broadcast, 0x4d2, 0x2, 0x33}, [@lifetime_val={0x24, 0x9, {0x0, 0x942, 0x1, 0x9}}, @sa_dir={0x5, 0x21, 0x1}]}, 0x54}, 0x1, 0x0, 0x0, 0x550}, 0x800) executing program 7: r0 = socket$inet6_sctp(0xa, 0x1, 0x84) mkdir(&(0x7f0000000000)='my_sys\x00', 0x1ff) mount(0x0, &(0x7f0000000200)='my_sys\x00', &(0x7f0000000300)='sysfs\x00', 0x0, 0x0) r1 = openat(0xffffffffffffff9c, &(0x7f0000000500)='my_sys/bus/pci/devices/0000:00:03.0/resource1\x00', 0x2, 0x0) mmap$IORING_OFF_SQ_RING(0x0, 0x4, 0x1000002, 0x12, r1, 0x0) syz_fuse_handle_req(0xffffffffffffffff, 0x0, 0x0, &(0x7f0000000a00)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f0000000200)={0x90, 0x0, 0x0, {0x0, 0x0, 0x0, 0xfffffffffffffffc, 0x200, 0x0, {0x20000000000005, 0x0, 0x7, 0x1000007, 0x3, 0x0, 0xfffffffe, 0x8000000, 0x0, 0xa000, 0x10000, 0x0, 0x0, 0x734, 0x20}}}, 0x0, 0x0, 0x0, 0x0, 0x0}) r2 = syz_clone(0x11, 0x0, 0x0, 0x0, 0x0, 0x0) ptrace(0x10, r2) ptrace$setregs(0xd, r2, 0x2, &(0x7f0000000180)) ptrace$cont(0x21, r2, 0x80000001, 0x4) setsockopt$SO_ATTACH_FILTER(r0, 0x1, 0x1a, &(0x7f0000000100)={0x1, &(0x7f0000000080)=[{0x6, 0x6e, 0x5, 0x6}]}, 0x10) setsockopt$inet_sctp_SCTP_SOCKOPT_BINDX_ADD(r0, 0x84, 0x64, &(0x7f0000000000)=[@in6={0xa, 0x4e23, 0x0, @loopback}], 0x1c) r3 = openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000), 0x200002, 0x0) r4 = openat$cgroup_freezer_state(r3, &(0x7f0000000140), 0x2, 0x0) write$cgroup_freezer_state(r4, &(0x7f0000000080)='THAWED\x00', 0x7) syz_usb_connect(0x6, 0x3f, &(0x7f0000000040)=ANY=[@ANYRES64=r0, @ANYRESOCT=r0], 0x0) executing program 47: sendmmsg$inet6(0xffffffffffffffff, 0x0, 0x0, 0x4000010) sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x2) r0 = socket$inet6_icmp_raw(0xa, 0x3, 0x3a) setsockopt$inet6_IPV6_HOPOPTS(r0, 0x29, 0x36, &(0x7f0000000400)=ANY=[], 0x8) connect$inet6(r0, &(0x7f0000000000)={0xa, 0x0, 0x0, @mcast2, 0x5}, 0x1c) setsockopt$SO_BINDTODEVICE(r0, 0x1, 0x19, &(0x7f0000000240)='bridge0\x00', 0x10) write(r0, &(0x7f00000000c0)="8f2a0a65bd8c002b0304000e0580a7b6070d63e286a5cefe", 0x5ac) executing program 7: r0 = socket$kcm(0x10, 0x2, 0x0) r1 = openat$tun(0xffffffffffffff9c, &(0x7f00000002c0), 0xa0281, 0x0) ioctl$TUNSETIFF(r1, 0x400454ca, &(0x7f0000000140)={'pim6reg1\x00', 0x1}) ioctl$TUNSETLINK(r1, 0x400454cd, 0x339) socketpair$nbd(0x1, 0x1, 0x0, &(0x7f00000001c0)) r2 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000002180)='blkio.bfq.io_merged\x00', 0x275a, 0x0) close_range(r2, 0xffffffffffffffff, 0x0) ioctl$SIOCSIFHWADDR(r0, 0x8914, &(0x7f0000000040)={'veth1_to_hsr\x00', @local}) ioctl$TUNSETOFFLOAD(r1, 0x400454d0, 0x4) sendmsg$inet(r0, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000000)=[{&(0x7f0000000140)="5c00000012006bab9a3fe3d86e17aa0b046b876c1d0048380019000800004460bc06000000a701251e6182949a3651fbffffffd4d4938037e7c7a0a03400ac09c51c268811000096859fc57a00000000000000002571cd53b9851b30", 0x5c}], 0x1, 0x0, 0x0, 0x1f00c00e}, 0x8000) executing program 48: r0 = socket$kcm(0x10, 0x2, 0x0) r1 = openat$tun(0xffffffffffffff9c, &(0x7f00000002c0), 0xa0281, 0x0) ioctl$TUNSETIFF(r1, 0x400454ca, &(0x7f0000000140)={'pim6reg1\x00', 0x1}) ioctl$TUNSETLINK(r1, 0x400454cd, 0x339) socketpair$nbd(0x1, 0x1, 0x0, &(0x7f00000001c0)) r2 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000002180)='blkio.bfq.io_merged\x00', 0x275a, 0x0) close_range(r2, 0xffffffffffffffff, 0x0) ioctl$SIOCSIFHWADDR(r0, 0x8914, &(0x7f0000000040)={'veth1_to_hsr\x00', @local}) ioctl$TUNSETOFFLOAD(r1, 0x400454d0, 0x4) sendmsg$inet(r0, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000000)=[{&(0x7f0000000140)="5c00000012006bab9a3fe3d86e17aa0b046b876c1d0048380019000800004460bc06000000a701251e6182949a3651fbffffffd4d4938037e7c7a0a03400ac09c51c268811000096859fc57a00000000000000002571cd53b9851b30", 0x5c}], 0x1, 0x0, 0x0, 0x1f00c00e}, 0x8000) executing program 5: r0 = syz_ublk_setup_io_uring(0x20, &(0x7f0000000040)={0x0, 0x2, 0x1000, 0x1}, &(0x7f0000000000)=0x0, &(0x7f0000000100)=0x0, &(0x7f0000000140)=0x0) syz_ublk_add_dev(r0, r1, r2, r3, &(0x7f0000000180)={0x2e, 0x0, 0x0, 0xffffffffffffffff, 0xc0207504, 0x0, 0x0, 0x0, 0x0, 0x9, 0x0, 0x0, '\x00', {0xffffffff, 0xffff, 0x40, &(0x7f00000000c0)=@any_dev={0x1, 0xe50, 0x0, 0x0, 0x1000, 0x2000003, 0x0, 0x0, 0x16}}}, &(0x7f0000000280)) executing program 5: r0 = syz_ublk_setup_io_uring(0x20, &(0x7f0000000040)={0x0, 0x2, 0x1000, 0x1}, &(0x7f0000000000)=0x0, &(0x7f0000000100)=0x0, &(0x7f0000000140)=0x0) syz_ublk_add_dev(r0, r1, r2, r3, &(0x7f0000000180)={0x2e, 0x0, 0x0, 0xffffffffffffffff, 0xc0207504, 0x0, 0x0, 0x0, 0x0, 0x9, 0x0, 0x0, '\x00', {0xffffffff, 0xffff, 0x40, &(0x7f00000000c0)=@any_dev={0x4001, 0xe50, 0x0, 0x0, 0x1000, 0x2000003, 0x0, 0x0, 0xa0}}}, &(0x7f0000000280)) executing program 5: socket$kcm(0xa, 0x3, 0x3a) r0 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r0, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000340)=ANY=[@ANYBLOB="140000001000010000000000000000000500000a28000000000a030000000000000000000a00000708000240000000020900010073797a31000000002c000000030a010100000000000000000a0000070900010073797a31000000000900030073797a320000000014000000110001"], 0x7c}, 0x1, 0x0, 0x0, 0xc000}, 0x0) r1 = socket$kcm(0x10, 0x2, 0x0) sendmsg$kcm(r1, &(0x7f0000000940)={0x0, 0x0, &(0x7f00000001c0)=[{&(0x7f00000013c0)="d8000000100081040100000000000000021d080b01000000e8fe55a118001500060014000300001208000d0074be0000a8001600a400014020000600ffffff7fb94dcf5c0461c1d67f6f94007134cf6ee08000a0e408e8d8ef52a9d7c7c0b7a196e6f66112c88ac417898516277ceb6bbace80177ccbec4c2ee5a7cef4090000001fb791643a5ee4ce1b14d6d930dfe1d9d322fe7c9f8775730d0080000000000000b57a5025ccca9e00360db70100000040fad95667e006dcdf63951f215ce3bb14feb9f5588a63644caf1ce1bd6c769ad809d52a9ecbee", 0xd8}], 0x1}, 0x0) executing program 5: r0 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) bind$bt_hci(r0, &(0x7f0000000000)={0x1f, 0xffff, 0x2}, 0x6) r1 = socket$kcm(0xa, 0x1, 0x106) sendmsg$sock(r1, &(0x7f0000000400)={0x0, 0x0, 0x0}, 0x2004c040) executing program 5: r0 = socket$inet6_sctp(0xa, 0x1, 0x84) mkdir(&(0x7f0000000000)='my_sys\x00', 0x1ff) mount(0x0, &(0x7f0000000200)='my_sys\x00', &(0x7f0000000300)='sysfs\x00', 0x0, 0x0) r1 = openat(0xffffffffffffff9c, &(0x7f0000000500)='my_sys/bus/pci/devices/0000:00:03.0/resource1\x00', 0x2, 0x0) mmap$IORING_OFF_SQ_RING(0x0, 0x4, 0x1000002, 0x12, r1, 0x0) syz_fuse_handle_req(0xffffffffffffffff, 0x0, 0x0, &(0x7f0000000a00)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f0000000200)={0x90, 0x0, 0x0, {0x0, 0x0, 0x0, 0xfffffffffffffffc, 0x200, 0x0, {0x20000000000005, 0x0, 0x7, 0x1000007, 0x3, 0x0, 0xfffffffe, 0x8000000, 0x0, 0xa000, 0x10000, 0x0, 0x0, 0x734, 0x20}}}, 0x0, 0x0, 0x0, 0x0, 0x0}) r2 = syz_clone(0x11, 0x0, 0x0, 0x0, 0x0, 0x0) ptrace(0x10, r2) ptrace$setregs(0xd, r2, 0x2, &(0x7f0000000180)) mkdirat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000)='./cgroup.net/syz0\x00', 0x1ff) r3 = openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000), 0x200002, 0x0) r4 = openat$cgroup_freezer_state(r3, &(0x7f0000000140), 0x2, 0x0) write$cgroup_freezer_state(r4, &(0x7f0000000080)='THAWED\x00', 0x7) syz_usb_connect(0x6, 0x3f, &(0x7f0000000040)=ANY=[@ANYRES64=r0, @ANYRESOCT=r0], 0x0) executing program 9: r0 = socket(0x2b, 0x6, 0x0) setsockopt$inet6_group_source_req(r0, 0x29, 0x2a, &(0x7f0000000080)={0x0, {{0xa, 0x0, 0x0, @mcast1={0xff, 0x7}}}, {{0xa, 0x0, 0x0, @initdev={0xfe, 0x88, '\x00', 0x0, 0x0}, 0x9}}}, 0x108) setsockopt$inet6_group_source_req(r0, 0x29, 0x2e, &(0x7f0000000200)={0x101, {{0xa, 0x80, 0x0, @mcast1={0xff, 0x7}}}, {{0xa, 0x4, 0x0, @empty, 0x4}}}, 0x108) r1 = openat$kvm(0xffffffffffffff9c, &(0x7f00000000c0), 0x40000, 0x0) r2 = ioctl$KVM_CREATE_VM(r1, 0xae01, 0x0) ioctl$KVM_CREATE_DEVICE(r2, 0xc00caee0, &(0x7f0000000480)={0x4, 0xffffffffffffffff}) ioctl$KVM_HAS_DEVICE_ATTR(r3, 0x4018aee3, &(0x7f0000000140)=@attr_riscv64=@attr_addr={0x0, 0x1, @imsic=0x5, &(0x7f0000000000)=0xd9}) setsockopt$inet_sctp6_SCTP_EVENTS(0xffffffffffffffff, 0x84, 0xb, &(0x7f0000000380)={0x35, 0x6, 0x40, 0x7, 0x6, 0x6, 0x35, 0x5, 0xd2, 0x86, 0xf2, 0xb, 0x0, 0x8}, 0xe) kexec_load(0x0, 0x10, &(0x7f0000000340)=[{0x0, 0x0, 0x0, 0x3e0000000000}], 0x0) r4 = socket(0x80000000000000a, 0x2, 0x0) r5 = socket$inet6_sctp(0xa, 0x5, 0x84) r6 = socket$inet_sctp(0x2, 0x1, 0x84) getsockopt$inet_sctp_SCTP_MAX_BURST(r6, 0x84, 0x14, &(0x7f0000000000)=@assoc_value={0x0}, &(0x7f00000003c0)=0x8) setsockopt$inet_sctp6_SCTP_ENABLE_STREAM_RESET(r5, 0x84, 0x76, &(0x7f0000000240)={r7, 0x2}, 0x8) getsockopt$inet_sctp6_SCTP_GET_LOCAL_ADDRS(r4, 0x84, 0x6d, &(0x7f00000003c0)={0x0, 0xf4, "e18cadd478bcd61fbeda4a78b8e9148f6ef6076d9cffe676db4cf63f52a2afb80abcfc8abff6981247e96a2a3573c604755f5f37a04b3b5fd6a7e8b47063fc2fde4ef31d3f52b6c633b9ae27a8bc8c9a389c8b99d219b6256f8a57147a9d1156427d31041dab3e05816cb4585c74584b91294acda3caeb429d4d6d9b40b65aeb4553c8556c9ce2f78771ca9b9058854f65afab375afacaadc975efdbbe2c68a15f59ff457ba494f4185e0dfc932d6dc66a741d3ca65b8eb22eb1b4bf8128a0a579ad0d00ecb50283ef6f48fb79cb75b1d8bbd9f337260ee4f267ffd74f600ac0214d40a2bdfee7768e7138e5f22232184fd3ae33"}, &(0x7f00000004c0)=0xfc) getsockopt$inet_sctp6_SCTP_STATUS(r4, 0x84, 0xe, &(0x7f0000000580)={r7, 0x1, 0x10, 0x2, 0x3f5, 0x6, 0xff, 0xa, {r8, @in={{0x2, 0x4e23, @private=0xa010102}}, 0x647, 0x5, 0x0, 0xffffffff, 0x6}}, &(0x7f0000000640)=0xb0) setsockopt$inet6_group_source_req(r4, 0x29, 0x2e, &(0x7f0000000200)={0x0, {{0xa, 0x0, 0x0, @mcast1={0xff, 0x7}}}, {{0xa, 0x0, 0x0, @initdev={0xfe, 0x88, '\x00', 0x0, 0x0}}}}, 0x108) r9 = socket(0x80000000000000a, 0x2, 0x0) r10 = syz_init_net_socket$bt_hidp(0x1f, 0x3, 0x6) r11 = syz_init_net_socket$bt_l2cap(0x1f, 0x2, 0x0) connect$bt_l2cap(r11, &(0x7f0000000080)={0x1f, 0x0, @fixed={'\xaa\xaa\xaa\xaa\xaa', 0x10}, 0x7ff}, 0xe) ioctl$sock_bt_hidp_HIDPCONNADD(r10, 0x400448c8, &(0x7f0000000340)={r11, r11, 0xd, 0x1, &(0x7f0000000140)="c2", 0xb, 0xf9, 0x10cf, 0x3737, 0x8b, 0x2, 0x9, 'syz1\x00'}) sendmmsg$inet6(r4, &(0x7f0000000940)=[{{0x0, 0x0, &(0x7f0000000900)=[{&(0x7f0000000680)="999c2786be2523c8f52dbfe23d52ab85afd6a17aa58dafd37f68248f801fb7d79535eca2edc20a6379e87fc70c72fbbf295fb32279ee747a534d3d8c4d76376fb1ee4e57e428bc1302d6eade4c9d1b8a51588508659e3b4e4c2e0d1c54d6ad376e5e62d8020bbfb0e65a65ae410d15c3add98e5df42fe25fe4e8766478b7ecd9741e6167cd27e94be763c700ac79869a244a6ec4a1d2cb490f202c5a71b37e17180c74b3fe4effa699a583a9f5a05769c1a0cdcac35f4d4f4cf087", 0xbb}, {&(0x7f0000000740)="eaf7dfedc24dbc0fcf2ef6b94332687e102958b54374977772b56a3e286e0d48e7a5c21745c2f7363d1c93b1c8a3edbfc76c1c6de97facd08706379d77d5a8cfe365bbfac4bcd19a5893db8537124d0560f81036a16e628bf8d6706180c82191f0a4c83e67a5ced08290602c3d9d4b563f76b2dfaea58b0151795981561bc7f3e9d70b209e06c528a67e364fd8fd82e6887f581b1884caaa2c3172610e8b2a88fcf2", 0xa2}, {&(0x7f0000000800)="f66c62ce1a9d3f4c4d6e0a9ce1", 0xd}, {&(0x7f0000000840)="0b958ea6f74c71f338c8f832854d04ed09fb058625dd15ec930fb7bc6d462976bddc26727a7531306bca97bc23e792e6ae7afbbe119cd87699f754ab0688e3a7050c849e655645dcdea4bf4d20dfb07c8cf72b01aca94b3602cead960355ede9567a29d639a214f5ea8df7303eda0c75c49c371deb63783f15230fcbd7140a13be8e6ce715d8", 0x86}], 0x4}}], 0x1, 0x90) setsockopt$inet6_group_source_req(r9, 0x29, 0x2a, &(0x7f0000000080)={0x24, {{0xa, 0x0, 0x0, @mcast1={0xff, 0x7}}}, {{0xa, 0x0, 0x0, @remote}}}, 0x108) setsockopt$inet6_group_source_req(r9, 0x29, 0x2e, &(0x7f0000000200)={0x0, {{0xa, 0x1, 0x0, @mcast1={0xff, 0x7}}}, {{0xa, 0x4e23, 0x0, @private2={0xfc, 0x2, '\x00', 0x1}}}}, 0x108) r12 = seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0x0, &(0x7f00000000c0)={0x1, &(0x7f0000000100)=[{0x6, 0x0, 0x0, 0x7fff0026}]}) close_range(r12, 0xffffffffffffffff, 0x0) syz_usb_connect(0x5, 0x4e, &(0x7f0000000500)=ANY=[@ANYBLOB="12010002ff000040cd06310100010102030109023c00010100a0320904000006ff0000000705010240000007050202400000070504024000000705060240000007058103"], 0x0) ioctl$KVM_CREATE_VM(0xffffffffffffffff, 0x7040, 0x800000000000033) syz_ublk_setup_io_uring(0x19, &(0x7f0000000040)={0x0, 0x30b7, 0x4000, 0x2, 0x154}, &(0x7f0000000100), &(0x7f0000000280), &(0x7f00000001c0)) executing program 9: socket$kcm(0xa, 0x3, 0x3a) r0 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r0, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000340)=ANY=[@ANYBLOB="140000001000010000000000000000000500000a28000000000a030000000000000000000a00000708000240000000020900010073797a31000000002c000000030a010100000000000000000a0000070900010073797a31000000000900030073797a320000000014000000110001"], 0x7c}, 0x1, 0x0, 0x0, 0xc000}, 0x0) r1 = socket$kcm(0x10, 0x2, 0x0) sendmsg$kcm(r1, &(0x7f0000000940)={0x0, 0x0, &(0x7f00000001c0)=[{&(0x7f00000013c0)="d8000000100081040100000000000000021d080b01000000e8fe55a118001500060014000300001208000d0074be0000a8001600a400014020000600ffffff7fb94dcf5c0461c1d67f6f94007134cf6ee08000a0e408e8d8ef52a9d7c7c0b7a196e6f66112c88ac417898516277ceb6bbace80177ccbec4c2ee5a7cef4090000001fb791643a5ee4ce1b14d6d930dfe1d9d322fe7c9f8775730d0080000000000000b57a5025ccca9e00360db70100000040fad95667e006dcdf63951f215ce3bb14feb9f5588a63644caf1ce1bd6c769ad809d52a9ecbee", 0xd8}], 0x1}, 0x0) executing program 5: openat$sndseq(0xffffffffffffff9c, &(0x7f0000000000), 0x0) (fail_nth: 1) executing program 9: r0 = openat$snapshot(0xffffffffffffff9c, &(0x7f00000000c0), 0x8000, 0x0) ioctl$SNAPSHOT_S2RAM(r0, 0x330b) r1 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r1, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000300)={&(0x7f00000001c0)=ANY=[@ANYBLOB="740000001e0001032a9d70f8fddbdf24ac14140f000000000000000000000000000004d60a002b00ac1e11010000000000000000000000000300000007350000200017"], 0x74}, 0x1, 0x0, 0x0, 0x40800}, 0x0) mkdir(&(0x7f0000000240)='./file0\x00', 0x162) r2 = socket$unix(0x1, 0x1, 0x0) r3 = socket$inet6_mptcp(0xa, 0x1, 0x106) bind$inet6(r3, &(0x7f0000000080)={0xa, 0x4e22, 0x0, @empty}, 0x1c) listen(r3, 0x0) r4 = socket$inet_mptcp(0x2, 0x1, 0x106) connect$inet(r4, &(0x7f0000000000)={0x2, 0x4e22, @local}, 0x10) listen(0xffffffffffffffff, 0x8) setsockopt$inet_sctp_SCTP_MAXSEG(0xffffffffffffffff, 0x84, 0xd, &(0x7f0000000380), 0x4) r5 = accept4(0xffffffffffffffff, 0x0, 0x0, 0x0) write(r5, &(0x7f0000000000)="ea", 0x1) write(r5, &(0x7f00000002c0)="04", 0x1) writev(r5, &(0x7f0000000140)=[{&(0x7f0000000040)='w', 0x1}], 0x1) r6 = socket$nl_generic(0x10, 0x3, 0x10) syz_genetlink_get_family_id$mptcp(&(0x7f0000000100), r6) sendmsg$MPTCP_PM_CMD_ADD_ADDR(r6, &(0x7f0000000180)={0x0, 0x0, &(0x7f00000003c0)={&(0x7f0000000300)=ANY=[], 0x3c}}, 0x8000) bind$unix(r2, &(0x7f0000003000)=@abs={0x1, 0x0, 0x4e23}, 0x6e) listen(r2, 0x5) fsconfig$FSCONFIG_SET_PATH(0xffffffffffffffff, 0x3, &(0x7f0000000400)='%\xb6\\/]\x00', &(0x7f0000000480)='./file0\x00', 0xffffffffffffffff) connect$unix(0xffffffffffffffff, &(0x7f0000000640)=@file={0x1, '\xe9\x1fq\x89Y\x1e\x923aK\x00'}, 0x6e) syz_open_procfs(0x0, &(0x7f00000006c0)='fdinfo/3\x00') socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000180)={0xffffffffffffffff, 0xffffffffffffffff}) getsockopt$sock_buf(r7, 0x1, 0x1f, 0x0, &(0x7f00000001c0)) openat$audio(0xffffffffffffff9c, &(0x7f0000000440), 0x3318c0, 0x0) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000080)) syz_open_dev$sg(&(0x7f0000000040), 0x0, 0xc0080) executing program 9: r0 = openat$kvm(0xffffffffffffff9c, 0x0, 0x0, 0x0) socket$nl_netfilter(0x10, 0x3, 0xc) ioctl$KVM_CREATE_IRQCHIP(0xffffffffffffffff, 0xae60) ioctl$KVM_CREATE_IRQCHIP(0xffffffffffffffff, 0xae60) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x26) r2 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x4000) r3 = socket$nl_generic(0x10, 0x3, 0x10) r4 = socket$packet(0x11, 0x2, 0x300) setsockopt$sock_int(r4, 0x1, 0x1e, &(0x7f0000000040)=0xfffffffc, 0x4) sendmsg$NL80211_CMD_GET_SCAN(r3, &(0x7f0000000f00)={0x0, 0x0, &(0x7f0000000ec0)={&(0x7f0000000380)={0x1c, 0x0, 0xf21, 0x0, 0x25dfdbfe, {{}, {@val={0x8}, @void}}}, 0x1c}, 0x1, 0x0, 0x0, 0x48010}, 0x200000000000000) r5 = openat$ppp(0xffffffffffffff9c, &(0x7f0000000000), 0xc0802, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000e00)='./proc\x00', 0x1ff) mount(0x0, &(0x7f0000000e80)='./proc\x00', &(0x7f0000000ec0)='proc\x00', 0x0, 0x0) r6 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./proc/net/rpc/auth.rpcsec.context/channel\x00', 0x1, 0x0) write(r6, &(0x7f0000000140)="01303230333034203230303030303030303020302030203020", 0x19) ioctl$PPPIOCNEWUNIT(r5, 0xc004743e, &(0x7f00000000c0)) ioctl$PPPIOCSMAXCID(r5, 0x40047451, &(0x7f0000000200)=0x8) ioctl$PPPIOCSFLAGS1(r5, 0x40047459, &(0x7f0000000100)=0x2000004) pwritev(r5, &(0x7f00000003c0)=[{&(0x7f00000004c0)="00214717a7070000000003060000000000000000aaa6721d5874f72cf86d73d32f46380feb56a29357215d78fc44fac3f44d", 0x32}], 0x1, 0x73a, 0x1) ioctl$KVM_SET_USER_MEMORY_REGION(0xffffffffffffffff, 0x4020ae46, 0x0) ioctl$KVM_SET_REGS(r2, 0x4090ae82, 0x0) mmap(&(0x7f0000000000/0xff5000)=nil, 0xff5000, 0x2, 0x4c831, 0xffffffffffffffff, 0x0) ioctl$UFFDIO_REGISTER(0xffffffffffffffff, 0xc020aa00, 0x0) r7 = socket$inet6_sctp(0xa, 0x1, 0x84) getsockopt$inet_sctp6_SCTP_GET_ASSOC_ID_LIST(r7, 0x84, 0x1d, 0x0, &(0x7f0000000540)) ioctl$UFFDIO_CONTINUE(0xffffffffffffffff, 0xc020aa07, 0x0) openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x4043, 0x1ff) execveat(0xffffffffffffff9c, &(0x7f0000000140)='./file1\x00', 0x0, 0x0, 0x1000) getresuid(&(0x7f0000000080), 0x0, 0x0) syz_open_procfs(0x0, &(0x7f0000000100)='task\x00') executing program 9: r0 = socket$inet6_sctp(0xa, 0x1, 0x84) mkdir(&(0x7f0000000000)='my_sys\x00', 0x1ff) mount(0x0, &(0x7f0000000200)='my_sys\x00', &(0x7f0000000300)='sysfs\x00', 0x0, 0x0) r1 = openat(0xffffffffffffff9c, &(0x7f0000000500)='my_sys/bus/pci/devices/0000:00:03.0/resource1\x00', 0x2, 0x0) mmap$IORING_OFF_SQ_RING(0x0, 0x4, 0x1000002, 0x12, r1, 0x0) syz_fuse_handle_req(0xffffffffffffffff, 0x0, 0x0, &(0x7f0000000a00)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f0000000200)={0x90, 0x0, 0x0, {0x0, 0x0, 0x0, 0xfffffffffffffffc, 0x200, 0x0, {0x20000000000005, 0x0, 0x7, 0x1000007, 0x3, 0x0, 0xfffffffe, 0x8000000, 0x0, 0xa000, 0x10000, 0x0, 0x0, 0x734, 0x20}}}, 0x0, 0x0, 0x0, 0x0, 0x0}) r2 = syz_clone(0x11, 0x0, 0x0, 0x0, 0x0, 0x0) ptrace(0x10, r2) ptrace$setregs(0xd, r2, 0x2, &(0x7f0000000180)) mkdirat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000)='./cgroup.net/syz0\x00', 0x1ff) r3 = openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000), 0x200002, 0x0) r4 = openat$cgroup_freezer_state(r3, &(0x7f0000000140), 0x2, 0x0) write$cgroup_freezer_state(r4, &(0x7f0000000080)='THAWED\x00', 0x7) syz_usb_connect(0x6, 0x3f, &(0x7f0000000040)=ANY=[@ANYRES64=r0, @ANYRESOCT=r0], 0x0) executing program 9: r0 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$inet6_tcp_int(r0, 0x6, 0x13, &(0x7f0000000000)=0x100000001, 0x4) connect$inet6(r0, &(0x7f0000000100)={0xa, 0x4, 0x0, @loopback, 0x4}, 0x1c) setsockopt$inet6_tcp_TCP_ULP(r0, 0x6, 0x1f, &(0x7f0000000040), 0x4) setsockopt$inet6_tcp_TLS_TX(r0, 0x11a, 0x1, &(0x7f00000000c0)=@gcm_128={{0x304}, "0000000400", "6abc00000000000000000000001000", "f0630400"}, 0x28) executing program 3: r0 = socket$kcm(0x10, 0x2, 0x0) sendmsg$kcm(r0, &(0x7f0000000000)={0x0, 0x4, &(0x7f0000000080)=[{&(0x7f0000000200)="2e0400001c008102e00f80ecdb4cb9f207c804a00d00000088081afb0a0002000a0ada1b40d80800c500c50083b8", 0xfec9}], 0x1, 0x0, 0x0, 0x5865}, 0x0) executing program 3: r0 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) sendmsg$NLBL_CALIPSO_C_ADD(r0, &(0x7f0000000100)={0x0, 0x0, &(0x7f0000000300)={&(0x7f0000000400)={0x24, 0x0, 0x1, 0x0, 0x0, {}, [@NLBL_CALIPSO_A_DOI={0x8, 0x1, 0x1}, @NLBL_CALIPSO_A_MTYPE={0x8}]}, 0x24}}, 0x0) executing program 3: timer_create(0x0, &(0x7f0000000240)={0x0, 0x21, 0x0, @thr={0x0, 0x0}}, &(0x7f0000000300)) executing program 3: r0 = socket(0x80000000000000a, 0x2, 0x0) setsockopt$inet6_group_source_req(r0, 0x29, 0x2a, &(0x7f0000000080)={0x24, {{0xa, 0x0, 0x0, @mcast1={0xff, 0x7}}}, {{0xa, 0x0, 0x0, @remote}}}, 0x108) setsockopt$inet6_group_source_req(r0, 0x29, 0x2e, &(0x7f0000000200)={0x0, {{0xa, 0x1, 0x0, @mcast1={0xff, 0x7}}}, {{0xa, 0x4e23, 0x0, @private2={0xfc, 0x2, '\x00', 0x1}}}}, 0x108) executing program 3: r0 = socket$inet6_sctp(0xa, 0x1, 0x84) mkdir(&(0x7f0000000000)='my_sys\x00', 0x1ff) mount(0x0, &(0x7f0000000200)='my_sys\x00', &(0x7f0000000300)='sysfs\x00', 0x0, 0x0) r1 = openat(0xffffffffffffff9c, &(0x7f0000000500)='my_sys/bus/pci/devices/0000:00:03.0/resource1\x00', 0x2, 0x0) mmap$IORING_OFF_SQ_RING(0x0, 0x4, 0x1000002, 0x12, r1, 0x0) syz_fuse_handle_req(0xffffffffffffffff, 0x0, 0x0, &(0x7f0000000a00)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f0000000200)={0x90, 0x0, 0x0, {0x0, 0x0, 0x0, 0xfffffffffffffffc, 0x200, 0x0, {0x20000000000005, 0x0, 0x7, 0x1000007, 0x3, 0x0, 0xfffffffe, 0x8000000, 0x0, 0xa000, 0x10000, 0x0, 0x0, 0x734, 0x20}}}, 0x0, 0x0, 0x0, 0x0, 0x0}) r2 = syz_clone(0x11, 0x0, 0x0, 0x0, 0x0, 0x0) ptrace(0x10, r2) ptrace$cont(0x21, r2, 0x80000001, 0x4) mkdirat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000)='./cgroup.net/syz0\x00', 0x1ff) r3 = openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000), 0x200002, 0x0) r4 = openat$cgroup_freezer_state(r3, &(0x7f0000000140), 0x2, 0x0) write$cgroup_freezer_state(r4, &(0x7f0000000080)='THAWED\x00', 0x7) syz_usb_connect(0x6, 0x3f, &(0x7f0000000040)=ANY=[@ANYRES64=r0, @ANYRESOCT=r0], 0x0) executing program 3: r0 = socket$kcm(0x10, 0x2, 0x0) sendmsg$kcm(r0, &(0x7f0000000000)={0x0, 0x4, &(0x7f0000000080)=[{&(0x7f0000000200)="2e0400001c008102e00f80ecdb4cb9f207c804a00d00000088081afb0a0002000a0ada1b40d80800c500c50083b8", 0xfec9}], 0x1, 0x0, 0x0, 0x5865}, 0x0) executing program 8: r0 = socket(0x80000000000000a, 0x2, 0x0) setsockopt$inet6_group_source_req(r0, 0x29, 0x2e, &(0x7f0000000200)={0x0, {{0xa, 0x1, 0x0, @mcast1={0xff, 0x7}}}, {{0xa, 0x4e23, 0x0, @private2={0xfc, 0x2, '\x00', 0x1}}}}, 0x108) executing program 8: r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$ethtool(&(0x7f0000001080), 0xffffffffffffffff) r2 = syz_genetlink_get_family_id$ethtool(&(0x7f0000000080), 0xffffffffffffffff) r3 = socket$inet_udp(0x2, 0x2, 0x0) ioctl$sock_SIOCGIFINDEX(r3, 0x8933, &(0x7f00000004c0)={'syz_tun\x00', 0x0}) r5 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$ETHTOOL_MSG_LINKMODES_SET(r5, &(0x7f0000000200)={0x0, 0x0, &(0x7f0000000000)={&(0x7f00000000c0)={0x34, r2, 0x1, 0x70bd25, 0x25dfdbfe, {}, [@ETHTOOL_A_LINKMODES_OURS={0x14, 0x3, 0x0, 0x1, [@ETHTOOL_A_BITSET_VALUE={0x4}, @ETHTOOL_A_BITSET_MASK={0x4}, @ETHTOOL_A_BITSET_SIZE={0x8}]}, @ETHTOOL_A_LINKMODES_HEADER={0xc, 0x1, 0x0, 0x1, [@ETHTOOL_A_HEADER_DEV_INDEX={0x8, 0x1, r4}]}]}, 0x34}, 0x1, 0x0, 0x0, 0x20004000}, 0x4044094) sendmsg$ETHTOOL_MSG_LINKMODES_SET(r0, &(0x7f0000000280)={0x0, 0x0, &(0x7f00000001c0)={&(0x7f0000000040)={0x2c, r1, 0x1, 0x0, 0x0, {0x29}, [@ETHTOOL_A_LINKMODES_HEADER={0x18, 0x1, 0x0, 0x1, [@ETHTOOL_A_HEADER_DEV_NAME={0x14, 0x2, 'vcan0\x00'}]}]}, 0x2c}}, 0x0) executing program 8: r0 = socket$inet6_sctp(0xa, 0x801, 0x84) sendmmsg$inet6(r0, &(0x7f000000a540)=[{{&(0x7f00000000c0)={0xa, 0x4e24, 0x9, @private2, 0x8}, 0x1c, &(0x7f0000002840)=[{&(0x7f0000000240)="f0b4", 0x2}], 0x1}}], 0x1, 0x20000000) (fail_nth: 1) executing program 8: r0 = socket$kcm(0xa, 0x2, 0x0) getsockopt$IP_VS_SO_GET_VERSION(r0, 0x0, 0x480, &(0x7f0000000080), &(0x7f00000000c0)=0x40) executing program 8: r0 = socket$inet6_sctp(0xa, 0x1, 0x84) mkdir(&(0x7f0000000000)='my_sys\x00', 0x1ff) mount(0x0, &(0x7f0000000200)='my_sys\x00', &(0x7f0000000300)='sysfs\x00', 0x0, 0x0) r1 = openat(0xffffffffffffff9c, &(0x7f0000000500)='my_sys/bus/pci/devices/0000:00:03.0/resource1\x00', 0x2, 0x0) mmap$IORING_OFF_SQ_RING(0x0, 0x4, 0x1000002, 0x12, r1, 0x0) syz_fuse_handle_req(0xffffffffffffffff, 0x0, 0x0, &(0x7f0000000a00)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f0000000200)={0x90, 0x0, 0x0, {0x0, 0x0, 0x0, 0xfffffffffffffffc, 0x200, 0x0, {0x20000000000005, 0x0, 0x7, 0x1000007, 0x3, 0x0, 0xfffffffe, 0x8000000, 0x0, 0xa000, 0x10000, 0x0, 0x0, 0x734, 0x20}}}, 0x0, 0x0, 0x0, 0x0, 0x0}) r2 = syz_clone(0x11, 0x0, 0x0, 0x0, 0x0, 0x0) ptrace(0x10, r2) ptrace$cont(0x21, r2, 0x80000001, 0x4) mkdirat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000)='./cgroup.net/syz0\x00', 0x1ff) r3 = openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000), 0x200002, 0x0) r4 = openat$cgroup_freezer_state(r3, &(0x7f0000000140), 0x2, 0x0) write$cgroup_freezer_state(r4, &(0x7f0000000080)='THAWED\x00', 0x7) syz_usb_connect(0x6, 0x3f, &(0x7f0000000040)=ANY=[@ANYRES64=r0, @ANYRESOCT=r0], 0x0) executing program 49: openat$sndseq(0xffffffffffffff9c, &(0x7f0000000000), 0x0) (fail_nth: 1) executing program 8: r0 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) sendmsg$NLBL_CALIPSO_C_ADD(r0, &(0x7f0000000100)={0x0, 0x0, &(0x7f0000000300)={&(0x7f0000000400)={0x24, 0x0, 0x1, 0x0, 0x0, {}, [@NLBL_CALIPSO_A_DOI={0x8, 0x1, 0x1}, @NLBL_CALIPSO_A_MTYPE={0x8}]}, 0x24}}, 0x0) executing program 50: r0 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$inet6_tcp_int(r0, 0x6, 0x13, &(0x7f0000000000)=0x100000001, 0x4) connect$inet6(r0, &(0x7f0000000100)={0xa, 0x4, 0x0, @loopback, 0x4}, 0x1c) setsockopt$inet6_tcp_TCP_ULP(r0, 0x6, 0x1f, &(0x7f0000000040), 0x4) setsockopt$inet6_tcp_TLS_TX(r0, 0x11a, 0x1, &(0x7f00000000c0)=@gcm_128={{0x304}, "0000000400", "6abc00000000000000000000001000", "f0630400"}, 0x28) executing program 51: r0 = socket$kcm(0x10, 0x2, 0x0) sendmsg$kcm(r0, &(0x7f0000000000)={0x0, 0x4, &(0x7f0000000080)=[{&(0x7f0000000200)="2e0400001c008102e00f80ecdb4cb9f207c804a00d00000088081afb0a0002000a0ada1b40d80800c500c50083b8", 0xfec9}], 0x1, 0x0, 0x0, 0x5865}, 0x0) executing program 52: r0 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) sendmsg$NLBL_CALIPSO_C_ADD(r0, &(0x7f0000000100)={0x0, 0x0, &(0x7f0000000300)={&(0x7f0000000400)={0x24, 0x0, 0x1, 0x0, 0x0, {}, [@NLBL_CALIPSO_A_DOI={0x8, 0x1, 0x1}, @NLBL_CALIPSO_A_MTYPE={0x8}]}, 0x24}}, 0x0) executing program 2: r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000340), 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) r2 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0) ioctl$KVM_SET_CPUID2(r2, 0x4008ae90, &(0x7f00000000c0)={0x1, 0x0, [{0xa, 0x200, 0x0, 0xfffffff8, 0x95, 0xf, 0x4ca}]}) ioctl$KVM_SET_USER_MEMORY_REGION(r1, 0x4020ae46, &(0x7f0000000400)={0x0, 0x0, 0x0, 0x20002000, &(0x7f0000000000/0x2000)=nil}) ioctl$KVM_REGISTER_COALESCED_MMIO(r1, 0x4010ae67, &(0x7f0000000180)={0x3000, 0x5000, 0x1}) ioctl$KVM_REGISTER_COALESCED_MMIO(r1, 0x4010ae67, &(0x7f0000000080)={0x2, 0x25000, 0x1}) r3 = memfd_create(0x0, 0x2) ioctl$KVM_CREATE_IRQCHIP(r1, 0xae60) fsetxattr$system_posix_acl(r3, &(0x7f0000000580)='system.posix_acl_access\x00', &(0x7f00000001c0)=ANY=[@ANYBLOB="02000000010009000000f3ff0300060000000000100000000000000020000100000000007b0f261b3539943941aa1da63a17cc52"], 0x24, 0x0) ioctl$KVM_RUN(0xffffffffffffffff, 0xae80, 0x0) ioctl$KVM_RUN(r2, 0xae80, 0x0) executing program 2: r0 = syz_open_dev$sndpcmc(&(0x7f0000000120), 0x1, 0x2) ioctl$SNDRV_PCM_IOCTL_HW_PARAMS(r0, 0xc2604111, &(0x7f0000000680)={0x0, [[0xfffffffe, 0xffffffff, 0xffffffff, 0x1, 0xffffffff, 0xfffffffc, 0xffffffff, 0xffffffff], [0xffffffff, 0x2, 0xfffffffd, 0xa, 0xffffffff, 0xffffffff, 0xffffffff, 0xffffffff], [0xffffffff, 0xffffffff, 0x83, 0xffffffff, 0xffffffff, 0xffffffff, 0x3, 0xffffffff]], '\x00', [{0x10, 0x10, 0x0, 0x0, 0x1}, {0x20, 0x20, 0x0, 0x0, 0x1}, {0x2, 0x9, 0x0, 0x0, 0x1}, {0xac44, 0xac44, 0x0, 0x0, 0x1}, {0xa, 0x186a0, 0x0, 0x0, 0x1}, {0x103, 0x400, 0x0, 0x0, 0x1}, {0x400, 0x101000, 0x0, 0x0, 0x1}, {0x2, 0x8, 0x0, 0x0, 0x1}, {0x2710, 0xf4240, 0x0, 0x0, 0x1}, {0x400, 0xffd, 0x0, 0x0, 0x1}, {0x1000, 0x4000, 0x0, 0x0, 0x1}, {0x0, 0xf4240, 0x0, 0x0, 0x1}], '\x00', 0x4}) ioctl$SNDRV_PCM_IOCTL_PREPARE(r0, 0x4140, 0x0) r1 = openat$adsp1(0xffffffffffffff9c, &(0x7f0000000040), 0xa0201, 0x0) write$dsp(r1, &(0x7f00000012c0)="a52876830a602214f6b4e928d758f38a5a7cb4b31c4c09289e9ebb6286784ca3", 0x4000) r2 = fsopen(&(0x7f0000000140)='debugfs\x00', 0x1) r3 = openat(0xffffffffffffff9c, &(0x7f0000000500)='my_sys/bus/pci/devices/0000:00:03.0/resource1\x00', 0x2, 0x0) mmap(&(0x7f0000ffc000/0x4000)=nil, 0x4000, 0x3, 0x11, r3, 0x0) fsmount(r2, 0x0, 0xd) seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0x0, &(0x7f0000000340)={0x1, &(0x7f0000000000)=[{0x6, 0xf, 0x0, 0x7fff8000}]}) openat(0xffffffffffffff9c, &(0x7f0000000500)='./tracing/events/kvm/kvm_hv_stimer_cleanup/trigger\x00', 0x2d80, 0x82) syz_usb_connect(0x0, 0x2d, &(0x7f0000001080)=ANY=[@ANYBLOB="120110012dcef620ca160215994b0102030109021b000108d050080904"], 0x0) socket$nl_generic(0x10, 0x3, 0x10) syz_genetlink_get_family_id$mptcp(&(0x7f0000000380), 0xffffffffffffffff) move_pages(0x0, 0x1efe, &(0x7f0000000080), 0x0, &(0x7f0000000040), 0x0) executing program 1: r0 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000040), 0xffffffffffffffff) r1 = socket$nl_generic(0x10, 0x3, 0x10) r2 = syz_open_dev$tty1(0xc, 0x4, 0x1) r3 = socket(0x1e, 0x2, 0x0) setsockopt$TIPC_DEST_DROPPABLE(r3, 0x10f, 0x81, &(0x7f0000000480), 0x4) mmap(&(0x7f0000001000/0x1000)=nil, 0x1000, 0x3, 0x32, 0xffffffffffffffff, 0x0) mprotect(&(0x7f0000001000/0x1000)=nil, 0x1000, 0x0) ioctl$sock_SIOCETHTOOL(0xffffffffffffffff, 0x8946, 0x0) recvmmsg(r3, &(0x7f0000003040)=[{{0x0, 0x0, &(0x7f0000000780)=[{&(0x7f0000001e40)=""/174, 0xae}], 0x1, &(0x7f0000001fc0)=""/67, 0x43}, 0x2001}], 0x1, 0x40002122, 0x0) sendmsg$tipc(r3, &(0x7f0000000100)={&(0x7f0000000040)=@nameseq={0x1e, 0x1, 0x0, {0x1, 0x1, 0x4}}, 0x10, 0x0}, 0x4800) ioctl$TCSETS(r2, 0x4b72, &(0x7f0000000140)={0x5, 0x2, 0x0, 0x0, 0x11, "0060930000efa4890200"}) ioctl$sock_SIOCGIFINDEX_80211(r1, 0x8933, &(0x7f0000000100)={'wlan1\x00', 0x0}) sendmsg$NL80211_CMD_VENDOR(r1, &(0x7f0000000000)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f00000003c0)=ANY=[@ANYBLOB='0\x00\x00\x00', @ANYRES16=r0, @ANYBLOB="010200000000000000006700000008000300", @ANYRES32=r4, @ANYBLOB="0800c300741300000800c40001"], 0x30}}, 0x0) r5 = socket$nl_netfilter(0x10, 0x3, 0xc) r6 = socket(0x40000000015, 0x5, 0x0) bind$inet6(r6, &(0x7f0000000140)={0xa, 0x0, 0x0, @loopback}, 0x1c) connect$inet6(r6, &(0x7f0000000000)={0xa, 0x4e21, 0x2, @remote, 0x6}, 0x1c) connect$inet6(r6, &(0x7f0000000100)={0xa, 0x4e23, 0x7, @initdev={0xfe, 0x88, '\x00', 0x0, 0x0}, 0x8}, 0x1c) setsockopt$netlink_NETLINK_PKTINFO(r5, 0x10e, 0x3, &(0x7f0000000000)=0x131e, 0x4) sendmsg$NFT_BATCH(r5, &(0x7f000000c2c0)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000340)=ANY=[@ANYBLOB="140000001000010000000000000000000000000a28000000000a0101000000005e1affd5020000000900010073797a300000000008000240000000032c000000030a01030000e6ff00000000020000000900010073797a30000000000900030073797a320000000014000000110001"], 0x7c}}, 0x0) syz_usb_connect(0x5, 0x36, &(0x7f00000000c0)=ANY=[@ANYBLOB="120100001a77aa4094225b4210a20102030109022400010000000009040000029233500009050602ff030000000905ba3e"], 0x0) executing program 2: syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) ioctl$ifreq_SIOCGIFINDEX_vcan(0xffffffffffffffff, 0x8933, &(0x7f0000000100)={'vcan0\x00'}) mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./trace\x00', 0x1ff) mount(0x0, &(0x7f0000000000)='./trace\x00', &(0x7f0000000100)='tracefs\x00', 0x0, 0x0) openat(0xffffffffffffff9c, &(0x7f0000000500)='./dummy\x00', 0x42, 0x1ff) r0 = openat(0xffffffffffffff9c, &(0x7f0000000200)='./trace/uprobe_events\x00', 0x2, 0x0) write(r0, &(0x7f0000000300)='p:mygroup/myevent ./dummy:0', 0x1b) setsockopt$inet6_int(0xffffffffffffffff, 0x29, 0xcb, 0x0, 0x0) socket$inet_tcp(0x2, 0x1, 0x0) lsetxattr$system_posix_acl(0x0, 0x0, &(0x7f0000000040)={{}, {0x10, 0x4}, [], {0x4, 0x1}, [], {}, {0x20, 0x4}}, 0x24, 0x0) executing program 2: openat$sysfs(0xffffffffffffff9c, 0x0, 0x24a01, 0xa2) r0 = socket$netlink(0x10, 0x3, 0x0) sendmsg$netlink(r0, &(0x7f0000001e00)={0x0, 0x0, &(0x7f0000000080)=[{0x0, 0x28}], 0x1}, 0x14008010) executing program 2: r0 = syz_genetlink_get_family_id$nl80211(0x0, 0xffffffffffffffff) r1 = socket$nl_generic(0x10, 0x3, 0x10) ioctl$sock_SIOCGIFINDEX_80211(r1, 0x8933, &(0x7f0000000100)={'wlan1\x00', 0x0}) sendmsg$NL80211_CMD_VENDOR(r1, &(0x7f0000000000)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f00000003c0)=ANY=[@ANYBLOB='0\x00\x00\x00', @ANYRES16=r0, @ANYBLOB="010200000000000000006700000008000300", @ANYRES32=r2, @ANYBLOB="0800c300741300000800c40001"], 0x30}}, 0x0) executing program 2: r0 = syz_open_dev$sndpcmc(&(0x7f0000000120), 0x1, 0x2) ioctl$SNDRV_PCM_IOCTL_HW_PARAMS(r0, 0xc2604111, &(0x7f0000000680)={0x0, [[0xfffffffe, 0xffffffff, 0xffffffff, 0x1, 0xffffffff, 0xfffffffc, 0xffffffff, 0xffffffff], [0xffffffff, 0x2, 0xfffffffd, 0xa, 0xffffffff, 0xffffffff, 0xffffffff, 0xffffffff], [0xffffffff, 0xffffffff, 0x83, 0xffffffff, 0xffffffff, 0xffffffff, 0x3, 0xffffffff]], '\x00', [{0x10, 0x10, 0x0, 0x0, 0x1}, {0x20, 0x20, 0x0, 0x0, 0x1}, {0x2, 0x9, 0x0, 0x0, 0x1}, {0xac44, 0xac44, 0x0, 0x0, 0x1}, {0xa, 0x186a0, 0x0, 0x0, 0x1}, {0x103, 0x400, 0x0, 0x0, 0x1}, {0x400, 0x101000, 0x0, 0x0, 0x1}, {0x2, 0x8, 0x0, 0x0, 0x1}, {0x2710, 0xf4240, 0x0, 0x0, 0x1}, {0x400, 0xffd, 0x0, 0x0, 0x1}, {0x1000, 0x4000, 0x0, 0x0, 0x1}, {0x0, 0xf4240, 0x0, 0x0, 0x1}], '\x00', 0x4}) ioctl$SNDRV_PCM_IOCTL_PREPARE(r0, 0x4140, 0x0) r1 = openat$adsp1(0xffffffffffffff9c, &(0x7f0000000040), 0xa0201, 0x0) write$dsp(r1, &(0x7f00000012c0)="a52876830a602214f6b4e928d758f38a5a7cb4b31c4c09289e9ebb6286784ca3", 0x4000) fsconfig$FSCONFIG_CMD_CREATE(0xffffffffffffffff, 0x6, 0x0, 0x0, 0x0) r2 = openat(0xffffffffffffff9c, &(0x7f0000000500)='my_sys/bus/pci/devices/0000:00:03.0/resource1\x00', 0x2, 0x0) mmap(&(0x7f0000ffc000/0x4000)=nil, 0x4000, 0x3, 0x11, r2, 0x0) fsmount(0xffffffffffffffff, 0x0, 0xd) seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0x0, &(0x7f0000000340)={0x1, &(0x7f0000000000)=[{0x6, 0xf, 0x0, 0x7fff8000}]}) openat(0xffffffffffffff9c, &(0x7f0000000500)='./tracing/events/kvm/kvm_hv_stimer_cleanup/trigger\x00', 0x2d80, 0x82) syz_usb_connect(0x0, 0x2d, &(0x7f0000001080)=ANY=[@ANYBLOB="120110012dcef620ca160215994b0102030109021b000108d050080904"], 0x0) socket$nl_generic(0x10, 0x3, 0x10) syz_genetlink_get_family_id$mptcp(&(0x7f0000000380), 0xffffffffffffffff) move_pages(0x0, 0x1efe, &(0x7f0000000080), 0x0, &(0x7f0000000040), 0x0) executing program 1: creat(&(0x7f00000011c0)='./file0\x00', 0x0) mount$nfs(0x0, &(0x7f0000000040)='./file0\x00', &(0x7f0000000000), 0x8402, &(0x7f0000002200)={[{'nointr'}]}) r0 = open(&(0x7f0000000000)='.\x00', 0x0, 0x0) renameat2(0xffffffffffffffff, &(0x7f0000000100)='\x13\x13w\xc5\xfc5\xd4\x14T\xd5\xd4\x1d)\xad\x1a`)Y\x81F\xe6\xbe\x16nA\xad\r\xbd@T\x03<\x9f3\xbb\xda\x82$\xa2\xf3\xd7r\xe7cnH\xb3<\xbfp\x83r\xe8\xf1\xb9\x93>\xc5\x12wC\xbe\"\x06 \x9e\xf0-\xf9\xcb\xf2\xf6\xe8\x80\xd38/\x00', r0, &(0x7f0000000240)='./file1/file0\x00', 0x6) ioctl$FS_IOC_SETFLAGS(0xffffffffffffffff, 0x40086602, &(0x7f00000001c0)=0x10000) prlimit64(0x0, 0x6, &(0x7f0000000040)={0x0, 0x1}, 0x0) munmap(&(0x7f0000ff3000/0xb000)=nil, 0xb000) prctl$PR_SET_MM_MAP(0x23, 0xe, &(0x7f0000000080)={&(0x7f0000ff1000/0x3000)=nil, &(0x7f0000ffd000/0x1000)=nil, &(0x7f0000ffc000/0x4000)=nil, &(0x7f0000ffc000/0x4000)=nil, &(0x7f0000ff0000/0xd000)=nil, &(0x7f0000ff3000/0x4000)=nil, &(0x7f0000ffd000/0x1000)=nil, &(0x7f0000ffa000/0x1000)=nil, &(0x7f0000ffc000/0x2000)=nil, &(0x7f0000ffa000/0x1000)=nil, &(0x7f0000ffa000/0x2000)=nil, 0x0}, 0x68) brk(0x200000ffc000) executing program 1: syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) ioctl$ifreq_SIOCGIFINDEX_vcan(0xffffffffffffffff, 0x8933, &(0x7f0000000100)={'vcan0\x00'}) mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./trace\x00', 0x1ff) mount(0x0, &(0x7f0000000000)='./trace\x00', &(0x7f0000000100)='tracefs\x00', 0x0, 0x0) openat(0xffffffffffffff9c, &(0x7f0000000500)='./dummy\x00', 0x42, 0x1ff) r0 = openat(0xffffffffffffff9c, &(0x7f0000000200)='./trace/uprobe_events\x00', 0x2, 0x0) write(r0, &(0x7f0000000300)='p:mygroup/myevent ./dummy:0', 0x1b) setsockopt$inet6_int(0xffffffffffffffff, 0x29, 0xcb, 0x0, 0x0) socket$inet_tcp(0x2, 0x1, 0x0) lsetxattr$system_posix_acl(0x0, 0x0, &(0x7f0000000040)={{}, {0x10, 0x4}, [], {0x4, 0x1}, [], {}, {0x20, 0x4}}, 0x24, 0x0) executing program 0: r0 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r0, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000240)=ANY=[@ANYBLOB="140000001000010000000000000000000500000a28000000000a030000000000000000000a00000708000240000000020900010073797a31000000002c000000030a010100000000000000000a0000070900010073797a31000000000900030073797a320000000014"], 0x7c}, 0x1, 0x0, 0x0, 0x4000}, 0x0) sendmsg$NFT_BATCH(r0, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000440)={{0x14, 0x10, 0x1, 0x0, 0x0, {0x2}}, [@NFT_MSG_NEWRULE={0x90, 0x6, 0xa, 0x401, 0x0, 0x0, {0xa, 0x0, 0x405}, [@NFTA_RULE_TABLE={0x9, 0x1, 'syz1\x00'}, @NFTA_RULE_EXPRESSIONS={0x64, 0x4, 0x0, 0x1, [{0x60, 0x1, 0x0, 0x1, @inner={{0xa}, @val={0x50, 0x2, 0x0, 0x1, [@NFTA_INNER_HDRSIZE={0x8, 0x4, 0x1, 0x0, 0x17}, @NFTA_INNER_EXPR={0x34, 0x5, 0x0, 0x1, @payload={{0xc}, @val={0x24, 0x2, 0x0, 0x1, [@NFTA_PAYLOAD_OFFSET={0x8, 0x3, 0x1, 0x0, 0x92}, @NFTA_PAYLOAD_LEN={0x8, 0x4, 0x1, 0x0, 0xca}, @NFTA_PAYLOAD_DREG={0x8, 0x1, 0x1, 0x0, 0x9}, @NFTA_PAYLOAD_BASE={0x8, 0x2, 0x1, 0x0, 0x2}]}}}, @NFTA_INNER_FLAGS={0x8, 0x3, 0x1, 0x0, 0x4}, @NFTA_INNER_TYPE={0x8, 0x2, 0x1, 0x0, 0x84}]}}}]}, @NFTA_RULE_CHAIN={0x9, 0x2, 'syz2\x00'}]}], {0x14, 0x11, 0x1, 0x0, 0x0, {0x1}}}, 0xb8}, 0x1, 0x0, 0x0, 0x48890}, 0x24000000) executing program 1: r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000340), 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) r2 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0) ioctl$KVM_SET_CPUID2(r2, 0x4008ae90, &(0x7f00000000c0)={0x1, 0x0, [{0xa, 0x200, 0x0, 0xfffffff8, 0x95, 0xf, 0x4ca}]}) ioctl$KVM_SET_USER_MEMORY_REGION(r1, 0x4020ae46, &(0x7f0000000400)={0x0, 0x0, 0x0, 0x20002000, &(0x7f0000000000/0x2000)=nil}) ioctl$KVM_REGISTER_COALESCED_MMIO(r1, 0x4010ae67, &(0x7f0000000180)={0x3000, 0x5000, 0x1}) ioctl$KVM_REGISTER_COALESCED_MMIO(r1, 0x4010ae67, &(0x7f0000000080)={0x2, 0x25000, 0x1}) memfd_create(0x0, 0x2) r3 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x2) ioctl$KVM_RUN(r3, 0xae80, 0x0) ioctl$KVM_RUN(r2, 0xae80, 0x0) executing program 0: r0 = syz_genetlink_get_family_id$nl80211(0x0, 0xffffffffffffffff) r1 = socket$nl_generic(0x10, 0x3, 0x10) ioctl$sock_SIOCGIFINDEX_80211(r1, 0x8933, &(0x7f0000000100)={'wlan1\x00', 0x0}) sendmsg$NL80211_CMD_VENDOR(r1, &(0x7f0000000000)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f00000003c0)=ANY=[@ANYBLOB='0\x00\x00\x00', @ANYRES16=r0, @ANYBLOB="010200000000000000006700000008000300", @ANYRES32=r2, @ANYBLOB="0800c300741300000800c40001"], 0x30}}, 0x0) executing program 4: r0 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000040), 0xffffffffffffffff) r1 = socket$nl_generic(0x10, 0x3, 0x10) r2 = syz_open_dev$tty1(0xc, 0x4, 0x1) r3 = socket(0x1e, 0x2, 0x0) setsockopt$TIPC_DEST_DROPPABLE(r3, 0x10f, 0x81, &(0x7f0000000480), 0x4) mmap(&(0x7f0000001000/0x1000)=nil, 0x1000, 0x3, 0x32, 0xffffffffffffffff, 0x0) mprotect(&(0x7f0000001000/0x1000)=nil, 0x1000, 0x0) ioctl$sock_SIOCETHTOOL(0xffffffffffffffff, 0x8946, 0x0) recvmmsg(r3, &(0x7f0000003040)=[{{0x0, 0x0, &(0x7f0000000780)=[{&(0x7f0000001e40)=""/174, 0xae}], 0x1, &(0x7f0000001fc0)=""/67, 0x43}, 0x2001}], 0x1, 0x40002122, 0x0) sendmsg$tipc(r3, &(0x7f0000000100)={&(0x7f0000000040)=@nameseq={0x1e, 0x1, 0x0, {0x1, 0x1, 0x4}}, 0x10, 0x0}, 0x4800) ioctl$TCSETS(r2, 0x4b72, &(0x7f0000000140)={0x5, 0x2, 0x0, 0x0, 0x11, "0060930000efa4890200"}) ioctl$sock_SIOCGIFINDEX_80211(r1, 0x8933, &(0x7f0000000100)={'wlan1\x00', 0x0}) sendmsg$NL80211_CMD_VENDOR(r1, &(0x7f0000000000)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f00000003c0)=ANY=[@ANYBLOB='0\x00\x00\x00', @ANYRES16=r0, @ANYBLOB="010200000000000000006700000008000300", @ANYRES32=r4, @ANYBLOB="0800c300741300000800c40001"], 0x30}}, 0x0) r5 = socket$nl_netfilter(0x10, 0x3, 0xc) r6 = socket(0x40000000015, 0x5, 0x0) bind$inet6(r6, &(0x7f0000000140)={0xa, 0x0, 0x0, @loopback}, 0x1c) connect$inet6(r6, &(0x7f0000000000)={0xa, 0x4e21, 0x2, @remote, 0x6}, 0x1c) connect$inet6(r6, &(0x7f0000000100)={0xa, 0x4e23, 0x7, @initdev={0xfe, 0x88, '\x00', 0x0, 0x0}, 0x8}, 0x1c) setsockopt$netlink_NETLINK_PKTINFO(r5, 0x10e, 0x3, &(0x7f0000000000)=0x131e, 0x4) sendmsg$NFT_BATCH(r5, &(0x7f000000c2c0)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000340)=ANY=[@ANYBLOB="140000001000010000000000000000000000000a28000000000a0101000000005e1affd5020000000900010073797a300000000008000240000000032c000000030a01030000e6ff00000000020000000900010073797a30000000000900030073797a320000000014000000110001"], 0x7c}}, 0x0) syz_usb_connect(0x5, 0x36, &(0x7f00000000c0)=ANY=[@ANYBLOB="120100001a77aa4094225b4210a20102030109022400010000000009040000029233500009050602ff030000000905ba3e"], 0x0) executing program 0: r0 = syz_open_dev$loop(&(0x7f0000000240), 0x75f, 0xa8182) r1 = memfd_create(&(0x7f0000000340)='C\x13\xfc2\x95WD\xaa\xba^\x90\xfd\x8d\xc2\xb1[\x81\xda\xda\xd6\x8c\xc99\xec\x0e*||\xe4\xb3\xc4\xb6\v\xaa\x15\x86,\xac\x8d\x89cu\x10\xdc\x93\x9b\xb4\x93\xafE*:\xe4\xdd\xa5\xa75\xb8\x1e;7\xb7.V\xdcrw[\r\x98\x93j\x9c\xf6\xf8\x99\xefF_\xcd\xdf!b\xc5\xec\ntb\xff\b\xaaF?!\x9f\a\x1a\x03\f\xe94\x1deU\x06zS\xc90\xb9voI\xa5/\xb4\xa7@\xa1\\B\xc2@\r_b\x9a\xeb\b\x81\x00V\xd6/N\xc5\xc6f\xb1\x95Z\xe5w^\xd8\xe7J\x80\xf7\xae\xafuv\x84\x9eG\xd1\xe7\x9b\xf0_9\xc2\x9b\xfd\xc3\xf3\xe4\x95P\xf1m\xcf\xc2\xe1\xe6\x1e\xf1\xaf)\x04\xc3\x18)\xa6\x8c\x11\xfb\xb8S\x8b\x92\\\asW-Ee\x02\x00\x00\x00\xd0;Q\xc1~\x89\xec\xc8\x9b\x88\a\xf2\x93\x82(\x8b\x00\xd8\xb4T\x80\x95\x93\x9c5\xcf\t\x04\x00\x00\x00\x00\x00\x00v\xef\xee+\xab\x9c\x00^R\xb2n?i=\xbe\x16\x8a\xbf\xe3\xcdB\xed\xe14\xe8\xd0\xb7\xff\xfeQ\x1c\x85n8\x1b\xc1\b\x00\x00\x00\x00\x00\x00\x00\x17\x94\xdfW\x92z\xbe\xb2R)\xf1K\xd7\xaf\x99\xf6d\xe8\xec\xb7\xbd+T3\xa6\xa9\xfaY-1qs\x82\xefn*\x96\xc9\x1e\xf4\xd1\x02Dt\xc0\x19\xf7\x89\x96.D [F\xeeYW\x95\x13\xc7;\x94\x13^\x13\xaf\xf0C\x9c\xabf\x1daCS2\x02\xb0\xef\xc7\x8c\x9e\xed\a\n0x0}) sendmsg$NL80211_CMD_VENDOR(r1, &(0x7f0000000000)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f00000003c0)=ANY=[@ANYBLOB='0\x00\x00\x00', @ANYRES16=r0, @ANYBLOB="010200000000000000006700000008000300", @ANYRES32=r2, @ANYBLOB="0800c300741300000800c40001"], 0x30}}, 0x0) executing program 4: r0 = openat$nci(0xffffffffffffff9c, &(0x7f0000000080), 0x2, 0x0) r1 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r2 = syz_genetlink_get_family_id$nfc(&(0x7f0000000100), r1) (async) ioctl$IOCTL_GET_NCIDEV_IDX(r0, 0x0, &(0x7f0000000140)=0x0) (async) ioctl$IOCTL_GET_NCIDEV_IDX(r0, 0x0, &(0x7f00000001c0)=0x0) (async) ioctl$IOCTL_GET_NCIDEV_IDX(r0, 0x0, &(0x7f0000000240)=0x0) (async) ioctl$IOCTL_GET_NCIDEV_IDX(r0, 0x0, &(0x7f0000000340)=0x0) ioctl$IOCTL_GET_NCIDEV_IDX(r0, 0x0, &(0x7f0000000380)=0x0) ioctl$IOCTL_GET_NCIDEV_IDX(r0, 0x0, &(0x7f00000003c0)=0x0) ioctl$IOCTL_GET_NCIDEV_IDX(r0, 0x0, &(0x7f0000000400)=0x0) (async) ioctl$IOCTL_GET_NCIDEV_IDX(r0, 0x0, &(0x7f0000000440)=0x0) (async) ioctl$IOCTL_GET_NCIDEV_IDX(0xffffffffffffffff, 0x0, &(0x7f0000000480)=0x0) (async) ioctl$IOCTL_GET_NCIDEV_IDX(r0, 0x0, &(0x7f00000004c0)=0x0) sendmsg$NFC_CMD_DEV_UP(r1, &(0x7f00000005c0)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x400000}, 0xc, &(0x7f0000000580)={&(0x7f0000000500)={0x64, r2, 0x200, 0x70bd29, 0x25dfdbfe, {}, [@NFC_ATTR_DEVICE_INDEX={0x8, 0x1, r3}, @NFC_ATTR_DEVICE_INDEX={0x8, 0x1, r4}, @NFC_ATTR_DEVICE_INDEX={0x8, 0x1, r5}, @NFC_ATTR_DEVICE_INDEX={0x8, 0x1, r6}, @NFC_ATTR_DEVICE_INDEX={0x8, 0x1, r7}, @NFC_ATTR_DEVICE_INDEX={0x8, 0x1, r8}, @NFC_ATTR_DEVICE_INDEX={0x8, 0x1, r9}, @NFC_ATTR_DEVICE_INDEX={0x8, 0x1, r10}, @NFC_ATTR_DEVICE_INDEX={0x8, 0x1, r11}, @NFC_ATTR_DEVICE_INDEX={0x8, 0x1, r12}]}, 0x64}, 0x1, 0x0, 0x0, 0x4008000}, 0x20000040) r13 = syz_genetlink_get_family_id$nfc(&(0x7f0000000040), r1) ioctl$IOCTL_GET_NCIDEV_IDX(r0, 0x0, &(0x7f00000000c0)=0x0) sendmsg$NFC_CMD_DEV_UP(r1, &(0x7f0000000200)={0x0, 0x0, &(0x7f0000000180)={&(0x7f00000002c0)=ANY=[@ANYBLOB="1c000000", @ANYRES16=r13, @ANYBLOB="010026bd7000fcdbdf250200000008000100", @ANYRES32=r14], 0x1c}}, 0x840) (async) unshare(0x2c020400) write$nci(r0, &(0x7f0000000280)=ANY=[@ANYBLOB="400404"], 0x7) write$nci(r0, &(0x7f0000000300)=ANY=[@ANYBLOB="60060202"], 0x8) executing program 4: r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000340), 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) r2 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0) ioctl$KVM_SET_CPUID2(r2, 0x4008ae90, &(0x7f00000000c0)={0x1, 0x0, [{0xa, 0x200, 0x0, 0xfffffff8, 0x95, 0xf, 0x4ca}]}) ioctl$KVM_SET_USER_MEMORY_REGION(r1, 0x4020ae46, &(0x7f0000000400)={0x0, 0x0, 0x0, 0x20002000, &(0x7f0000000000/0x2000)=nil}) ioctl$KVM_REGISTER_COALESCED_MMIO(r1, 0x4010ae67, &(0x7f0000000180)={0x3000, 0x5000, 0x1}) ioctl$KVM_REGISTER_COALESCED_MMIO(r1, 0x4010ae67, &(0x7f0000000080)={0x2, 0x25000, 0x1}) ioctl$KVM_CREATE_IRQCHIP(r1, 0xae60) r3 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x2) ioctl$KVM_RUN(r3, 0xae80, 0x0) ioctl$KVM_RUN(r2, 0xae80, 0x0) program did not crash replaying the whole log did not cause a kernel crash single: executing 1 programs separately with timeout 1m40s testing program (duration=1m40s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): openat$kvm-ioctl$KVM_CREATE_VM-ioctl$KVM_CREATE_VCPU-ioctl$KVM_SET_CPUID2-ioctl$KVM_SET_USER_MEMORY_REGION-ioctl$KVM_REGISTER_COALESCED_MMIO-ioctl$KVM_REGISTER_COALESCED_MMIO-ioctl$KVM_CREATE_IRQCHIP-ioctl$KVM_CREATE_VCPU-ioctl$KVM_RUN-ioctl$KVM_RUN detailed listing: executing program 0: r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000340), 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) r2 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0) ioctl$KVM_SET_CPUID2(r2, 0x4008ae90, &(0x7f00000000c0)={0x1, 0x0, [{0xa, 0x200, 0x0, 0xfffffff8, 0x95, 0xf, 0x4ca}]}) ioctl$KVM_SET_USER_MEMORY_REGION(r1, 0x4020ae46, &(0x7f0000000400)={0x0, 0x0, 0x0, 0x20002000, &(0x7f0000000000/0x2000)=nil}) ioctl$KVM_REGISTER_COALESCED_MMIO(r1, 0x4010ae67, &(0x7f0000000180)={0x3000, 0x5000, 0x1}) ioctl$KVM_REGISTER_COALESCED_MMIO(r1, 0x4010ae67, &(0x7f0000000080)={0x2, 0x25000, 0x1}) ioctl$KVM_CREATE_IRQCHIP(r1, 0xae60) r3 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x2) ioctl$KVM_RUN(r3, 0xae80, 0x0) ioctl$KVM_RUN(r2, 0xae80, 0x0) program did not crash single: failed to extract reproducer bisect: bisecting 81 programs with base timeout 1m40s testing program (duration=2m0s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): [6, 10, 1, 3, 25, 5, 2, 1, 1, 2, 6, 6, 4, 25, 7, 7, 14, 3, 16, 3, 7, 7, 5, 11, 30, 16, 7, 10, 10, 2, 2, 5, 4, 14, 30, 5, 1, 30, 30, 14, 5, 2, 2, 1, 3, 14, 2, 2, 8, 2, 2, 14, 1, 2, 5, 2, 2, 12, 15, 21, 10, 3, 4, 15, 9, 10, 3, 11, 4, 21, 6, 10, 9, 11, 24, 8, 10, 3, 4, 20, 11] detailed listing: executing program 32: write$bt_hci(0xffffffffffffffff, 0x0, 0x8) r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000000), 0x42901, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, 0x0) r1 = socket$kcm(0x2, 0xa, 0x2) ioctl$SIOCSIFHWADDR(r1, 0x8914, &(0x7f0000000180)={'syzkaller1\x00', @broadcast}) write$tun(r0, &(0x7f0000000240)=ANY=[@ANYBLOB="034886dd0900300003003000000060ce902d9f0c2f0081e949b93897bc3b0000000000007d01ff020000000000000000000000000001"], 0xfdef) executing program 33: r0 = socket$packet(0x11, 0x3, 0x300) ioctl$BTRFS_IOC_SET_RECEIVED_SUBVOL(0xffffffffffffffff, 0xc0c89425, 0x0) ioctl$BTRFS_IOC_SNAP_DESTROY_V2(0xffffffffffffffff, 0x5000943f, &(0x7f0000002680)={{}, 0x0, 0x0, @inherit={0x0, 0x0}, @subvolid=0x5}) sendmsg$NFT_BATCH(0xffffffffffffffff, 0x0, 0x20050800) syz_usb_connect(0x3, 0x39, 0x0, 0x0) setsockopt$packet_fanout(r0, 0x107, 0x12, &(0x7f0000000000)={0x0, 0x8000}, 0x4) r1 = socket$inet_udp(0x2, 0x2, 0x0) bind$inet(r1, &(0x7f0000000240)={0x2, 0xffff, @dev={0xac, 0x14, 0x14, 0x2d}}, 0x10) sendmmsg$inet(r1, &(0x7f0000002080)=[{{&(0x7f0000000080)={0x2, 0x4e24, @multicast2}, 0x10, &(0x7f0000000c80)=[{&(0x7f00000000c0)="fe3c75b276077fc35911f546eac465645aa92c329d22ffbc788e506d852723e2337591365c05e594c38a11b4f2baff4d0f1602c0bdf4c3fbb581421631d4e319aad5acd0922cc47e1ad1af5118208a8887090b7589a06ee0cdfc4a91092393ff52aa490100032d557ceec6ff521222d645daf4da328a8e481f4e07e0bca05b5a8f87a1ae2bbb7e428921b3f350c9641376946127f5ffa0953dea4489a5071812df69bd736d31ac5920beb426e82aef92caa9426c45a59ba821f951b1eb3009237bc67102b3d53cd38229b990778c9f1eddc861d9a8e88518793bc58a696d47b6c44573599123bf52a5965f4b0d03dc76c0a87ea24812681833d2788d022bf57bee519bfa20c6c698480062647785d9667cd3804ac83d5e65c9a667aa43a063", 0x11f}, {&(0x7f0000000640)="6c8c778bd61f52153eadf672a8afd4ac2cd4485dcd4ec767a7bc9928c1328c782cc6c00961536b8714456de68c0b95c356c5b4aabed86f3324eeb0d0c5180e6ee7", 0x41}, {&(0x7f00000006c0)="0998b6d80a5faee59cbeec7bcfcf9c1e2063f5c7082c6896033bfc01320f555949aa7fb3aa9d03660281ad546de98f985dd938e4ed7e46ad0a835981830e04e89e6a70df4c3d0e95a4ff35c7fdcdc22db9305a009437df2d7eeb7d268c412a2a8b4dc9a4a82b330784399d9b907b59e310e590915cf77c7e8aebd679af6993193e5d6f9b2d040a353af1b5a36d640147dc4a59034dfb80c58eaf1ed1b1c0a1d6c26cd0e6238521f2e427", 0xaa}, {&(0x7f0000000780)="b36fb12aeed1fca7dbe86cf8a51fcba64a4500b788fff99c2fea82772ec33fc8474c776390bdeadd0d0163242a6aeee9", 0x30}, {&(0x7f00000007c0)="c53403c9821d42ed436ddabc91e99c52cf74e4b7206281f94b750df03503ba7407ac3ed8d4423ff381d8c5ac6672bec3e85d29de039e96e57d5f68983261f0f7ab687cee54125ba3c3ae32dc0a78f5fefac1a06071f63da3c50eac66f63e6faad0176c96972e6e4e6314f80acf08a24b714ad9cd607f1e1d680b8f6be20f06fad2a91d3bbed6eb8651887af873", 0x8d}], 0x5}}, {{0x0, 0x0, &(0x7f0000003780)=[{&(0x7f00000037c0)="6985100ddecb741d39068639baefb93383602f529580bd26d98f9828ed127dc304fdbd412cc02db818e9aa5a571f4983db5477c17a5166c472fa579c92bd6748b0f88f7a2909e7ec90e01a290bc57641e89ab31b7997f4e77b7e2593fa025834ebad7838e2ac033a1b08c204f5edf137845a52cc8464cc0c830bee7efcaa7e7198735b9555b2b57898f2fa42b97f3f6e64fddace78578c97f758559d5146abcfdd1a5f4edeb1c0680f2d95f86b8efd69a60d1a65320421d09224d9cd3fa1396ce69c1d98ef782820e57640dc567209d4cc1fd2fec98ef36a18e90ba68f415f2c7a70ecd21a964ba0a2dc76bee9d8534da8d976607882b63076cf18f34b2b888b56d18993074fec22409fabfe420740c3b7305a005459d8916d796929111028cd9919704c2a55c55b1507476832867d4b0014fc5332ccb7a79a8c30b6c40d9601931d320a4ad31dfd2307d2962df7ac92dd5aea2b2912bd92654bfbc4109ab73805b59d42d687e35a76390b252526f5fc8baa10faae1b26861f730661f0678deeafc08d40f6cbce9d38f8e788fd3dbc4811b75544e494f9857af640880e082098a7d0a621cc341f05d9f9d8fd4585d0d8e55514f6f974d07f064fda30fafc7fb5d123250c4eab673fceeaeb247ec3fa2499257001dcf140222519cd44b04cf1c73c87d73d97e7c5acd63dcb6c37454bb37ef299183574e059b6849dfa6c9f9785d6becfe7e150effe821f2d13d804c0fcc31769ff2d3b13a41681ce046a790159dd996525e65c43201fa21967e002771e47cdb5fb4dceb24147c7c4e6ebb14cebfa8598a8a848bd43b44e79c22be5a053bd3ce2a7bfa48b05db8413a38772321617ee68c8f79d30f799ec85b6b4cace3b98350733c393aebdea0f62f937a3e9f9fa48eb3cbadcd33e70cacd5e803aeb6842278107925c8f419890947a4665866c40a0327f4ecb818a65941f4b4e854909335aec1fb9c01b9a84fe8cd2009ebabc855d8df6a3fdafec88c954cf1dec34031024f0aa711bb7ea4bbc69e8cefc349398f4bbc5b4926ad9151f5c86c4f0ba56c41755509424", 0x2f6}], 0x1}}], 0x2, 0x2000c044) writev(r1, &(0x7f0000002640)=[{&(0x7f0000000c40)="b4", 0x1}], 0x1) executing program 34: mremap(&(0x7f00008ba000/0x1000)=nil, 0x1000, 0x2000, 0x3, &(0x7f00005b7000/0x2000)=nil) executing program 35: r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0) executing program 36: r0 = socket$inet6_sctp(0xa, 0x1, 0x84) mkdir(&(0x7f0000000000)='my_sys\x00', 0x1ff) mount(0x0, &(0x7f0000000200)='my_sys\x00', &(0x7f0000000300)='sysfs\x00', 0x0, 0x0) r1 = openat(0xffffffffffffff9c, &(0x7f0000000500)='my_sys/bus/pci/devices/0000:00:03.0/resource1\x00', 0x2, 0x0) mmap$IORING_OFF_SQ_RING(0x0, 0x4, 0x1000002, 0x12, r1, 0x0) syz_fuse_handle_req(0xffffffffffffffff, 0x0, 0x0, &(0x7f0000000a00)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f0000000200)={0x90, 0x0, 0x0, {0x0, 0x0, 0x0, 0xfffffffffffffffc, 0x200, 0x0, {0x20000000000005, 0x0, 0x7, 0x1000007, 0x3, 0x0, 0xfffffffe, 0x8000000, 0x0, 0xa000, 0x10000, 0x0, 0x0, 0x734, 0x20}}}, 0x0, 0x0, 0x0, 0x0, 0x0}) r2 = syz_clone(0x11, 0x0, 0x0, 0x0, 0x0, 0x0) ptrace(0x10, r2) ptrace$setregs(0xd, r2, 0x2, &(0x7f0000000180)) ptrace$cont(0x21, r2, 0x80000001, 0x4) setsockopt$SO_ATTACH_FILTER(r0, 0x1, 0x1a, &(0x7f0000000100)={0x1, &(0x7f0000000080)=[{0x6, 0x6e, 0x5, 0x6}]}, 0x10) setsockopt$inet_sctp_SCTP_SOCKOPT_BINDX_ADD(r0, 0x84, 0x64, &(0x7f0000000000)=[@in6={0xa, 0x4e23, 0x0, @loopback}], 0x1c) mkdirat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000)='./cgroup.net/syz0\x00', 0x1ff) r3 = openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000), 0x200002, 0x0) r4 = openat$cgroup_freezer_state(r3, &(0x7f0000000140), 0x2, 0x0) r5 = syz_clone(0x2100, 0x0, 0x0, 0x0, 0x0, 0x0) r6 = openat$ppp(0xffffffffffffff9c, &(0x7f0000000000), 0xc0802, 0x0) ioctl$PPPIOCNEWUNIT(r6, 0xc004743e, &(0x7f00000000c0)) ioctl$PPPIOCSMAXCID(r6, 0x40047451, &(0x7f0000000200)=0x8) ioctl$PPPIOCSFLAGS1(r6, 0x40047459, &(0x7f0000000100)=0x2000004) pwritev(r6, &(0x7f00000003c0)=[{&(0x7f0000000300)='\x00!', 0x2}], 0x1, 0x73a, 0xfffffffc) r7 = openat$cgroup_procs(r3, &(0x7f00000002c0)='tasks\x00', 0x2, 0x0) syz_open_dev$I2C(&(0x7f0000001c40), 0x0, 0x0) write$cgroup_pid(r7, &(0x7f0000000300)=r5, 0x12) write$cgroup_freezer_state(r4, &(0x7f0000000080)='THAWED\x00', 0x7) executing program 37: pipe2(&(0x7f0000000080)={0xffffffffffffffff}, 0x0) r1 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) r2 = ioctl$KVM_CREATE_VM(r1, 0xae01, 0x0) ioctl$KVM_CREATE_VCPU(r2, 0xae41, 0x0) close_range(r0, 0xffffffffffffffff, 0x0) executing program 38: r0 = openat(0xffffffffffffff9c, &(0x7f0000000180)='./cgroup.net/devices.allow\x00', 0x2, 0x48) poll(&(0x7f00000001c0)=[{r0, 0x4c0}], 0x1, 0x4) executing program 39: syz_open_procfs(0xffffffffffffffff, &(0x7f0000000040)='net/ip6_flowlabel\x00') executing program 40: mlock(&(0x7f0000a51000/0x2000)=nil, 0x2000) (fail_nth: 1) executing program 41: r0 = socket$kcm(0xa, 0x3, 0x3a) ioctl$EXT4_IOC_MOVE_EXT(r0, 0xc028660f, 0x0) (fail_nth: 1) executing program 42: r0 = syz_open_dev$sndctrl(&(0x7f0000000000), 0x1, 0x0) ioctl$SNDRV_CTL_IOCTL_ELEM_READ(r0, 0xc4c85512, &(0x7f0000000280)={{0x4, 0x0, 0x0, 0x0, 'syz1\x00'}, 0x0, [0x0, 0x0, 0x1, 0x8000003, 0x0, 0xffffffffffffffff, 0x9, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xef0, 0x0, 0x5, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffffffffffe, 0x0, 0x3fffffffffffffff, 0x0, 0x0, 0xfffffffffffffffc, 0x0, 0x0, 0x0, 0x0, 0x1fe, 0x0, 0x0, 0xfffffffffffffffe, 0x0, 0xc874, 0x0, 0x0, 0x0, 0x40, 0x0, 0x0, 0x0, 0x7f, 0x2, 0x0, 0x0, 0x2, 0x9, 0x0, 0x0, 0x2, 0x0, 0x2, 0x1004, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xf, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x400000000, 0x0, 0x40, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x400000000000fc, 0x0, 0x0, 0x0, 0x0, 0x200000010000, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x4a54, 0x0, 0x1000000000, 0x0, 0x0, 0x0, 0x0, 0x4, 0x0, 0x0, 0x0, 0x0, 0x8000000eff8, 0x0, 0x0, 0x0, 0x8, 0x0, 0x20000e9a, 0x0, 0x0, 0x7fffffff, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8000000]}) r1 = openat$binderfs(0xffffffffffffff9c, &(0x7f00000000c0)='./binderfs/binder1\x00', 0x0, 0x0) r2 = openat$vimc0(0xffffffffffffff9c, &(0x7f0000000000), 0x2, 0x0) ioctl$VIDIOC_QUERY_DV_TIMINGS(r2, 0x80845663, &(0x7f0000000100)={0x0, @reserved}) ioctl$BINDER_SET_MAX_THREADS(r1, 0x40046205, 0x0) executing program 43: r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000240), 0x2041, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x17) ioctl$KVM_CREATE_IRQCHIP(r1, 0xae60) r2 = openat$comedi(0xffffffffffffff9c, &(0x7f0000000000)='/dev/comedi4\x00', 0x0, 0x0) ioctl$COMEDI_INSNLIST(r2, 0x8010640b, &(0x7f00000e9700)={0x2, &(0x7f00000a4a00)=[{0x6000004, 0x0, 0x0, 0x81, 0x3}, {0xa000005, 0x0, 0x0, 0x3, 0x1}]}) ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x1) executing program 44: r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000240), 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) ioctl$KVM_CREATE_IRQCHIP(r1, 0xae60) ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0) (fail_nth: 1) executing program 45: r0 = socket$inet6_sctp(0xa, 0x1, 0x84) mkdir(&(0x7f0000000000)='my_sys\x00', 0x1ff) mount(0x0, &(0x7f0000000200)='my_sys\x00', &(0x7f0000000300)='sysfs\x00', 0x0, 0x0) r1 = openat(0xffffffffffffff9c, &(0x7f0000000500)='my_sys/bus/pci/devices/0000:00:03.0/resource1\x00', 0x2, 0x0) mmap$IORING_OFF_SQ_RING(0x0, 0x4, 0x1000002, 0x12, r1, 0x0) syz_fuse_handle_req(0xffffffffffffffff, 0x0, 0x0, &(0x7f0000000a00)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f0000000200)={0x90, 0x0, 0x0, {0x0, 0x0, 0x0, 0xfffffffffffffffc, 0x200, 0x0, {0x20000000000005, 0x0, 0x7, 0x1000007, 0x3, 0x0, 0xfffffffe, 0x8000000, 0x0, 0xa000, 0x10000, 0x0, 0x0, 0x734, 0x20}}}, 0x0, 0x0, 0x0, 0x0, 0x0}) r2 = syz_clone(0x11, 0x0, 0x0, 0x0, 0x0, 0x0) ptrace(0x10, r2) ptrace$setregs(0xd, r2, 0x2, &(0x7f0000000180)) ptrace$cont(0x21, r2, 0x80000001, 0x4) setsockopt$SO_ATTACH_FILTER(r0, 0x1, 0x1a, &(0x7f0000000100)={0x1, &(0x7f0000000080)=[{0x6, 0x6e, 0x5, 0x6}]}, 0x10) setsockopt$inet_sctp_SCTP_SOCKOPT_BINDX_ADD(r0, 0x84, 0x64, &(0x7f0000000000)=[@in6={0xa, 0x4e23, 0x0, @loopback}], 0x1c) mkdirat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000)='./cgroup.net/syz0\x00', 0x1ff) r3 = openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000), 0x200002, 0x0) r4 = openat$cgroup_freezer_state(r3, &(0x7f0000000140), 0x2, 0x0) syz_clone(0x2100, 0x0, 0x0, 0x0, 0x0, 0x0) r5 = openat$ppp(0xffffffffffffff9c, &(0x7f0000000000), 0xc0802, 0x0) ioctl$PPPIOCNEWUNIT(r5, 0xc004743e, &(0x7f00000000c0)) ioctl$PPPIOCSMAXCID(r5, 0x40047451, &(0x7f0000000200)=0x8) ioctl$PPPIOCSFLAGS1(r5, 0x40047459, &(0x7f0000000100)=0x2000004) pwritev(r5, &(0x7f00000003c0)=[{&(0x7f0000000300)='\x00!', 0x2}], 0x1, 0x73a, 0xfffffffc) openat$cgroup_procs(r3, &(0x7f00000002c0)='tasks\x00', 0x2, 0x0) r6 = syz_open_dev$I2C(&(0x7f0000001c40), 0x0, 0x0) ioctl$I2C_TENBIT(r6, 0x704, 0x0) write$cgroup_freezer_state(r4, &(0x7f0000000080)='THAWED\x00', 0x7) executing program 6: r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000340), 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) ioctl$KVM_SET_USER_MEMORY_REGION(r1, 0x4020ae46, &(0x7f0000000400)={0x0, 0x0, 0x0, 0x20002000, &(0x7f0000000000/0x2000)=nil}) r2 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0) ioctl$KVM_RUN(r2, 0xae80, 0x0) ioctl$KVM_REGISTER_COALESCED_MMIO(r1, 0x4010ae67, &(0x7f0000000000)={0x6000, 0x2000, 0x1}) ioctl$KVM_RUN(r2, 0xae80, 0x0) executing program 6: r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000340), 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) ioctl$KVM_SET_USER_MEMORY_REGION(r1, 0x4020ae46, &(0x7f0000000400)={0x0, 0x0, 0x0, 0x20002000, &(0x7f0000000000/0x2000)=nil}) r2 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0) ioctl$KVM_RUN(r2, 0xae80, 0x0) ioctl$KVM_REGISTER_COALESCED_MMIO(r1, 0x4010ae67, &(0x7f0000000000)={0x6000, 0x2000, 0x1}) ioctl$KVM_RUN(r2, 0xae80, 0x0) (fail_nth: 1) executing program 6: r0 = socket$netlink(0x10, 0x3, 0xc) r1 = socket(0x40000000015, 0x5, 0x0) setsockopt$RDS_CONG_MONITOR(r1, 0x114, 0x6, &(0x7f0000000080)=0x1, 0x4) write$uinput_user_dev(0xffffffffffffffff, &(0x7f0000000400)={'syz0\x00', {0x3, 0x2, 0x6, 0xfffa}, 0x3a, [0x0, 0xc95a, 0xf, 0x8, 0x80, 0x4, 0x3, 0x80000000, 0x20000006, 0x4d, 0x9, 0x5d, 0xa, 0x5, 0xffff2d38, 0xffffff03, 0x6, 0x3, 0x0, 0xe, 0x7, 0x0, 0x7, 0x23c5b, 0x1, 0x20, 0xd, 0x7, 0x0, 0xffffffff, 0xe661, 0x4, 0x7, 0x7, 0x8, 0x4c74, 0x80000000, 0x242, 0x3, 0xe, 0x0, 0x80008071, 0x7, 0x17, 0x1, 0x7, 0x6, 0x3e, 0x4000008c, 0x6, 0x5, 0x0, 0x4, 0x4, 0x8008, 0x400, 0x80, 0x0, 0x5, 0x6, 0x6, 0x4, 0x1, 0xf], [0x10000007, 0x9, 0x8000012f, 0x2008004, 0x5, 0xfffffff3, 0x129432e6, 0xc8, 0xf9, 0xe, 0x2c0, 0x2, 0x9, 0xfffffffe, 0x3, 0x0, 0x0, 0x5, 0x2f, 0x0, 0x312, 0x78, 0xe, 0xfffffffe, 0x4, 0x7, 0x7fff, 0x5, 0x400, 0x401, 0x7, 0x1, 0xff, 0x5, 0x1000005, 0x5f2e, 0x1, 0x4e2, 0xc, 0x4, 0xb, 0x10000, 0x9, 0x8, 0x1009, 0x6, 0x47, 0x8000, 0x1, 0xfe000000, 0xffff, 0x0, 0x4, 0x9, 0x3, 0x3, 0x9, 0x1, 0x3, 0x3, 0x94f, 0x48c93690, 0x42, 0x3], [0x5, 0x408, 0x7, 0x5, 0xfffffffe, 0x6, 0x8d2, 0x9, 0x5, 0x8002, 0x0, 0x5, 0xb, 0x4, 0x5, 0x7, 0x0, 0x1ef, 0x5, 0x8, 0x86, 0x3, 0x303c, 0x3e7, 0xb, 0x5, 0x2, 0x2, 0x3, 0x2, 0x4, 0x6d01, 0x3, 0x38, 0x800003, 0x200, 0x80, 0x3, 0x4, 0x2950bfaf, 0xc8, 0xa2, 0x7, 0xa9, 0x5, 0x6, 0xac8, 0xca, 0x2, 0x3, 0x7ff, 0x12b, 0x4, 0x1, 0xa, 0x0, 0x1, 0x1c, 0x7, 0x3, 0x3, 0x5, 0x4, 0x3c484551], [0x9, 0xbb33, 0x7, 0x0, 0x5, 0x93a, 0x5, 0x2, 0xfffffffc, 0xb9, 0xce7, 0x203, 0x2, 0x57, 0x5, 0x3, 0x101, 0x10000, 0xb8, 0x3, 0x28, 0xa620, 0x2, 0x5, 0x1, 0x7ff, 0x14c, 0x20a7, 0x6, 0x16, 0xffffffff, 0x80000000, 0x5, 0x8, 0xc8, 0xfffffff9, 0xfffff000, 0x10000, 0x10001, 0x7e, 0x100, 0x9602, 0x7, 0xaf, 0x5, 0xfffffff9, 0x226, 0x5, 0x5, 0x8, 0x30b1d693, 0xb1f, 0x8, 0x7, 0x1, 0x6c1b, 0x0, 0x4, 0x5, 0xb1e, 0xd8, 0x200, 0xffff3441, 0xfff]}, 0x45c) r2 = socket(0x2, 0x80805, 0x0) sendmmsg$inet_sctp(r2, &(0x7f0000000dc0)=[{0x0, 0x0, 0x0, 0x0, &(0x7f00000002c0)=[@authinfo={0x18, 0x84, 0x6, {0x3800}}], 0x18, 0x40c0}], 0x1, 0x20000140) ppoll(&(0x7f00000000c0)=[{}, {}], 0x20000000000000dc, 0x0, 0x0, 0x0) bind$netlink(r0, &(0x7f0000514ff4)={0x10, 0x0, 0x0, 0x2ffffffff}, 0xc) r3 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPCTNL_MSG_CT_NEW(r3, &(0x7f0000000080)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000500)=ANY=[@ANYBLOB="940000000001010400000000000000000afe8000000000000000000000000000aa1400044900000000000000000000ffff0a0101020c00028005000100000000003c0002802c00018014000300fc02000000000000000000000000000014000400fe8000000000000000000000000000aa0c0002800500010000000000080007400100000047bb6e3421fe19b818d8f66660c30370d9c8b08e0b152e35a7282bd0e46103ffbde595b893cdc5a6ba1b80a5aa0f90c08663f47c12af7f10df52fcdb7bb811abc8a0022d2f1920a8b6683a524f7c38a01fa66f2ef599c4d97f5a1ffc055683547d6f85b7f1d51293d18f395f786072119bedb9b0d2a59a1fa3063342d8a139e72939170c2efb"], 0x94}, 0x1, 0x0, 0x0, 0x40}, 0x0) r4 = openat$sndseq(0xffffffffffffff9c, &(0x7f0000000000), 0x882) ioctl$SNDRV_SEQ_IOCTL_SET_QUEUE_TIMER(r4, 0x40605346, &(0x7f0000000440)={0x0, 0x0, {0x3, 0x2, 0x0, 0x0, 0x1}, 0x800004}) write$sndseq(r4, &(0x7f0000000140)=[{0x1f, 0x0, 0x0, 0xfd, @tick, {}, {}, @raw32}], 0x1c) sendmsg$IPCTNL_MSG_CT_DELETE(r3, &(0x7f0000000300)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000380)=ANY=[@ANYRES8=r4], 0x14}, 0x1, 0x0, 0x0, 0x20044892}, 0x4040050) executing program 6: r0 = openat$kvm(0xffffffffffffff9c, &(0x7f00000000c0), 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) ioctl$KVM_CREATE_DEVICE(r1, 0xc00caee0, &(0x7f0000000040)={0x4}) executing program 6: r0 = socket$inet6_sctp(0xa, 0x1, 0x84) mkdir(&(0x7f0000000000)='my_sys\x00', 0x1ff) mount(0x0, &(0x7f0000000200)='my_sys\x00', &(0x7f0000000300)='sysfs\x00', 0x0, 0x0) r1 = openat(0xffffffffffffff9c, &(0x7f0000000500)='my_sys/bus/pci/devices/0000:00:03.0/resource1\x00', 0x2, 0x0) mmap$IORING_OFF_SQ_RING(0x0, 0x4, 0x1000002, 0x12, r1, 0x0) syz_fuse_handle_req(0xffffffffffffffff, 0x0, 0x0, &(0x7f0000000a00)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f0000000200)={0x90, 0x0, 0x0, {0x0, 0x0, 0x0, 0xfffffffffffffffc, 0x200, 0x0, {0x20000000000005, 0x0, 0x7, 0x1000007, 0x3, 0x0, 0xfffffffe, 0x8000000, 0x0, 0xa000, 0x10000, 0x0, 0x0, 0x734, 0x20}}}, 0x0, 0x0, 0x0, 0x0, 0x0}) r2 = syz_clone(0x11, 0x0, 0x0, 0x0, 0x0, 0x0) ptrace(0x10, r2) ptrace$setregs(0xd, r2, 0x2, &(0x7f0000000180)) ptrace$cont(0x21, r2, 0x80000001, 0x4) setsockopt$SO_ATTACH_FILTER(r0, 0x1, 0x1a, &(0x7f0000000100)={0x1, &(0x7f0000000080)=[{0x6, 0x6e, 0x5, 0x6}]}, 0x10) setsockopt$inet_sctp_SCTP_SOCKOPT_BINDX_ADD(r0, 0x84, 0x64, &(0x7f0000000000)=[@in6={0xa, 0x4e23, 0x0, @loopback}], 0x1c) mkdirat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000)='./cgroup.net/syz0\x00', 0x1ff) r3 = openat$cgroup_freezer_state(0xffffffffffffffff, &(0x7f0000000140), 0x2, 0x0) write$cgroup_freezer_state(r3, &(0x7f0000000080)='THAWED\x00', 0x7) syz_usb_connect(0x6, 0x3f, &(0x7f0000000040)=ANY=[@ANYRES64=r0, @ANYRESOCT=r0], 0x0) executing program 7: r0 = openat$kvm(0xffffffffffffff9c, &(0x7f00000000c0), 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) ioctl$KVM_CREATE_DEVICE(r1, 0xc00caee0, &(0x7f0000000040)={0x4}) (fail_nth: 1) executing program 6: sendmmsg$inet6(0xffffffffffffffff, 0x0, 0x0, 0x4000010) sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x2) r0 = socket$inet6_icmp_raw(0xa, 0x3, 0x3a) setsockopt$inet6_IPV6_HOPOPTS(r0, 0x29, 0x36, &(0x7f0000000400)=ANY=[], 0x8) connect$inet6(r0, &(0x7f0000000000)={0xa, 0x0, 0x0, @mcast2, 0x5}, 0x1c) setsockopt$SO_BINDTODEVICE(r0, 0x1, 0x19, &(0x7f0000000240)='bridge0\x00', 0x10) write(r0, &(0x7f00000000c0)="8f2a0a65bd8c002b0304000e0580a7b6070d63e286a5cefe", 0x5ac) executing program 7: sendmmsg$inet6(0xffffffffffffffff, 0x0, 0x0, 0x4000010) sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x2) r0 = socket$inet6_icmp_raw(0xa, 0x3, 0x3a) setsockopt$inet6_IPV6_HOPOPTS(r0, 0x29, 0x36, &(0x7f0000000400)=ANY=[], 0x8) connect$inet6(r0, &(0x7f0000000000)={0xa, 0x0, 0x0, @mcast2, 0x5}, 0x1c) setsockopt$SO_BINDTODEVICE(r0, 0x1, 0x19, &(0x7f0000000240)='bridge0\x00', 0x10) write(r0, &(0x7f00000000c0)="8f2a0a65bd8c002b0304000e0580a7b6070d63e286a5cefe", 0x5ac) (fail_nth: 1) executing program 7: r0 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r0, &(0x7f000000c2c0)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000340)=ANY=[@ANYBLOB="140000001000010000000000000000000000000a28000000000a0101000000005e1affd5020000000900010073797a300000000008000240000000032c000000030a01030000e6ff00000000020000000900010073797a30000000000900030073797a320000000014000000110001"], 0x7c}}, 0x0) sendmsg$NFT_BATCH(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000480)=ANY=[@ANYBLOB="140000001000010000000000000000000000000a78000000060a0b0400000000eba1c5620200fffe4c0004802800018007000100637400001c00028008000140000000020800024000000016050003000000000020000180070001006374000014000280080002400000000d080004400000000c0900010073797a30000000000900020073797a320000000014000000110001"], 0xa0}, 0x1, 0x0, 0x0, 0x840}, 0x0) close(r0) mount(&(0x7f0000000080)=@loop={'/dev/loop', 0x0}, &(0x7f0000000000)='./cgroup\x00', &(0x7f00000000c0)='erofs\x00', 0x1200011, 0x0) executing program 46: mmap$IORING_OFF_SQ_RING(0x0, 0xc00000, 0x2000006, 0x401d031, 0xffffffffffffffff, 0x0) ioctl$VIDIOC_QUERYMENU(0xffffffffffffffff, 0xc02c5625, &(0x7f0000000180)={0x8000, 0xc5f7, @name="78d56294ae9837bd2a35b13d75c994201f86e575f2e26c5ca64c40400fba0fd0"}) r0 = add_key$user(&(0x7f00000001c0), &(0x7f00000002c0)={'syz', 0x1}, &(0x7f0000000480)="fef0eda8c799a4a0c3", 0x9, 0xfffffffffffffffe) r1 = add_key$user(&(0x7f00000003c0), &(0x7f0000000440), &(0x7f00000000c0), 0xc9, 0xfffffffffffffffd) keyctl$dh_compute(0x17, &(0x7f0000000140)={r1, r1, r0}, &(0x7f00000000c0)=""/83, 0x53, 0x0) r2 = syz_ublk_setup_io_uring(0x21, 0x0, &(0x7f0000000000)=0x0, &(0x7f0000000100)=0x0, &(0x7f0000000040)=0x0) r6 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r6, &(0x7f0000000d80)={0x0, 0x0, &(0x7f00000001c0)={&(0x7f0000000d00)=ANY=[@ANYBLOB="140000001000010000000000000000000220000a3c000000120a09080000000000000000020000000900020073797a310000000008000440000000000900010073797a3000000000080003"], 0x64}, 0x1, 0x0, 0x0, 0x5}, 0x0) ioctl$sock_proto_private(r6, 0x89e1, &(0x7f0000000200)="d5b229183585887a3d6fc8d12695c87cf8a0c3c18105420fdb81dd3696b170fdbaf0bbe3c119f8808e5a802a86a06ce5ca7d39b9dfd8ee994fe7025f6df49a5634bb654c6513778417a55e8bcc847186ec940ddd430f7c70c007fb73dc9f090b19b9b68ab5d60df80f6a9e3d887d5fd4fe0d83bef1dea947b633837976aeb3257284cdf8270ade3863770f96e3483ab82bb337c9412d") syz_io_uring_submit(r3, r4, r5, &(0x7f0000000980)=@IORING_OP_SEND_ZC={0x2f, 0x1, 0x20, 0xffffffffffffffff, 0x0, 0x0, 0xde, 0x51}) syz_ublk_add_dev(r2, r3, r4, r5, &(0x7f00000003c0)={0x2e, 0x5, 0x0, 0xffffffffffffffff, 0xc0207504, 0x0, 0x0, 0x0, 0x0, 0x9, 0x0, 0x0, '\x00', {0xffffffff, 0xffff, 0x0, 0x0}}, 0x0) executing program 7: r0 = socket$inet_udp(0x2, 0x2, 0x0) r1 = accept$inet(r0, &(0x7f0000000000)={0x2, 0x0, @initdev}, &(0x7f0000000040)=0x10) read(r0, &(0x7f0000000080)=""/155, 0x9b) (async) write(r1, &(0x7f0000000140)="d45cfa6f4318c07243160e525f42126ae6a6c01b435e30020bafa260cf51f5f71826309d27604a963a7e9aad46c55399f9cfb8127b7d6ce3c8f235ef82eacf6eea0c65b8402da496c8f0a5c4f5cb0adfcb38b38656c6ee236b654ac4b55ff6b79f9523f6a9885a56be4c73648d1dba44077727dfc38e7e226ff9d550eaa99a305bd5b0c9b72907c9813a441b84a4608870c6c96b0f13a39876b9eee7f73c8a31dd7aa044ce43698d6c885f5c6d5d50ad3fef8c8d9b9757", 0xb7) (async) ioctl$DVB_DVR_DMX_EXPBUF(0xffffffffffffffff, 0xc00c6f3e, &(0x7f0000000200)={0x7401fc32, 0x80000, r1}) getsockopt$inet_mreq(r2, 0x0, 0x20, &(0x7f0000000240)={@multicast2, @private}, &(0x7f0000000280)=0x8) (async) ioctl$sock_ipv6_tunnel_SIOCCHGPRL(r0, 0x89f7, &(0x7f0000000380)={'sit0\x00', &(0x7f00000002c0)={@broadcast, 0x0, 0x0, 0x80, 0x0, [{@loopback}, {@broadcast}, {@multicast2}, {@initdev}, {@dev}, {@dev}, {@local}, {@dev}]}}) (async, rerun: 64) ioctl$BTRFS_IOC_QGROUP_CREATE(r0, 0x4010942a, &(0x7f00000003c0)={0x1, 0x100}) (async, rerun: 64) ioctl$NILFS_IOCTL_SET_SUINFO(r0, 0x40186e8d, &(0x7f0000000440)={&(0x7f0000000400)=[{0x9, 0x0, 0x0, {0x1, 0x9, 0x3}}, {0x8, 0x1, 0x0, {0x4, 0x7, 0x1}}], 0x2, 0x20, 0x3, 0x7}) (async) ioctl$BLKTRACESETUP(r0, 0xc0481273, &(0x7f0000000480)={'\x00', 0x0, 0x89, 0x8, 0x5, 0x81, 0xffffffffffffffff}) ioctl$UBLK_U_CMD_ADD_DEV(r2, 0xc0207504, &(0x7f0000000540)={0xffffffff, 0xffff, 0x40, &(0x7f0000000500)=@any_dev={0x4, 0x686, 0x0, 0x0, 0x1000, 0x40000000, r3}}) (async) setsockopt$inet_opts(r0, 0x0, 0x0, &(0x7f00000005c0)="cdca8841105d816d6e224311095a2a90332292654aceae72b93baf7126688c214be8570e3a6cba6b4013bea43137f4d7a9da35c9f3431a0b3a74", 0x3a) (async) ioctl$UBLK_U_CMD_GET_PARAMS(r2, 0x80207509, &(0x7f0000000680)={0x0, 0xffff, 0x70, &(0x7f0000000600)={0x70}}) (async) ioctl$MEMERASE(0xffffffffffffffff, 0x40084d02, &(0x7f0000000700)={0x9, 0x3}) r4 = openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000740)='./cgroup/syz1\x00', 0x200002, 0x0) r5 = openat$cgroup_type(r4, &(0x7f0000000780), 0x2, 0x0) (async) ioctl$VIDIOC_SUBDEV_S_FMT(r2, 0xc0585605, &(0x7f00000007c0)={0x1, 0x0, {0xe, 0xfffff540, 0x1001, 0x9, 0x4, 0x41a589970e9d537e, 0x1, 0x1}}) sendto$x25(r2, &(0x7f0000000840)="fe1674a0fc2c4dd943fa3ae770fcb302f6d4337cb0d281dfa97f6424ab802f306bc26e0b2f28f44efd0e94ce4b18819aa20accb613ea3e4fd3647e1427c17e0fe95c2183962dd0cb64e4aabe944aecaca1e224f020a5881bbb3e2b0005067d0e98d64ca5d8d46c07c76950e130c946890fd228053005af14ff4322d129c30f36d2c8eaddda39e90e8edad124337f8bff811d4ae38c75b9dd229357274d48f1", 0x9f, 0x8000, &(0x7f0000000900)={0x9, @remote={'\xcc\xcc\xcc\xcc\xcc\xcc\xcc\xcc\xcc\xcc\xcc\xcc\xcc\xcc', 0x0}}, 0x12) close_range(r4, r5, 0x2) (async) ioctl$EXT4_IOC_GET_ES_CACHE(r4, 0xc020662a, &(0x7f0000000940)={0x4, 0x100000000, 0x3, 0x2, 0x5, 0x0, [{0x3, 0x8a, 0x8000000000000001, '\x00', 0x4}, {0x0, 0x9, 0x977b, '\x00', 0x602}, {0x11, 0xc6163d5, 0x278, '\x00', 0x80}, {0x0, 0x5, 0x958}, {0xff, 0x71, 0x0, '\x00', 0x301}]}) ioctl$XFS_IOC_PATH_TO_HANDLE(r5, 0xc0385869, &(0x7f0000000b80)={r2, &(0x7f0000000a80)='\xcc\xcc\xcc\xcc\xcc\xcc\xcc\xcc\xcc\xcc\xcc\xcc\xcc\xcc', 0x200000, &(0x7f0000000ac0)={@align=0x4, {0x8, 0xb6fe, 0xd, 0x6}}, 0xf1, &(0x7f0000000b00), &(0x7f0000000b40)=0x8000}) read(r6, &(0x7f0000000bc0)=""/66, 0x42) (async) ioctl$EXT4_IOC_ALLOC_DA_BLKS(r5, 0x660c) (async) r7 = accept$phonet_pipe(r2, &(0x7f0000000c40), &(0x7f0000000c80)=0x10) ioctl$XFS_IOC_GET_RESBLKS(r7, 0x80105873, &(0x7f0000000cc0)) (async, rerun: 64) ioctl$ifreq_SIOCGIFINDEX_vcan(r7, 0x8933, &(0x7f0000000d00)={'vcan0\x00', 0x0}) (rerun: 64) ioctl$sock_ipv4_tunnel_SIOCGETTUNNEL(r2, 0x89f0, &(0x7f0000000e40)={'gre0\x00', &(0x7f0000000d40)={'ip_vti0\x00', r8, 0x80, 0x0, 0x6, 0xbac8, {{0x2f, 0x4, 0x3, 0x27, 0xbc, 0x68, 0x0, 0x0, 0x4, 0x0, @empty, @local, {[@timestamp={0x44, 0x10, 0x6c, 0x0, 0x6, [0x6, 0x0, 0x2]}, @cipso={0x86, 0x23, 0xffffffffffffffff, [{0x0, 0xb, "b40bf990b95aaa99d4"}, {0x5, 0x7, "302f84ca8e"}, {0x0, 0x7, "7cf0462b28"}, {0x1, 0x4, "e7fb"}]}, @end, @cipso={0x86, 0x55, 0x1, [{0x2, 0x10, "1a4b0cf62d5249827fc6939c185a"}, {0x7, 0x11, "a54ffff76a2a43d32b6fe321d9c1d3"}, {0x2, 0x12, "ebfeacaa5d3ffaf789bb2ac229990dbf"}, {0x4, 0xc, "9ff6a9b86d2946eced0e"}, {0x0, 0x10, "1ee2875af2d49c05a29e9111910a"}]}, @timestamp_prespec={0x44, 0x1c, 0x50, 0x3, 0x0, [{@local, 0x5}, {@local, 0x9}, {@empty, 0x8}]}]}}}}}) (async) setsockopt$inet_sctp_SCTP_RECVRCVINFO(r6, 0x84, 0x20, &(0x7f0000000e80)=0xe77, 0x4) (async, rerun: 32) ioctl$XFS_IOC_PATH_TO_HANDLE(r0, 0xc0385869, &(0x7f0000000fc0)={r6, &(0x7f0000000ec0)='{}\x00', 0x400, &(0x7f0000000f00)={@_ha_fsid={[0x7d]}, {0x5, 0x6, 0xfffffffa, 0x7ff}}, 0x4, &(0x7f0000000f40), &(0x7f0000000f80)=0x5}) (async, rerun: 32) sendmsg$nl_xfrm(r6, &(0x7f0000001100)={&(0x7f0000001000)={0x10, 0x0, 0x0, 0x10000}, 0xc, &(0x7f00000010c0)={&(0x7f0000001040)=@getsa={0x54, 0x12, 0x1, 0x70bd2a, 0x25dfdbfd, {@in=@broadcast, 0x4d2, 0x2, 0x33}, [@lifetime_val={0x24, 0x9, {0x0, 0x942, 0x1, 0x9}}, @sa_dir={0x5, 0x21, 0x1}]}, 0x54}, 0x1, 0x0, 0x0, 0x550}, 0x800) executing program 7: r0 = socket$inet6_sctp(0xa, 0x1, 0x84) mkdir(&(0x7f0000000000)='my_sys\x00', 0x1ff) mount(0x0, &(0x7f0000000200)='my_sys\x00', &(0x7f0000000300)='sysfs\x00', 0x0, 0x0) r1 = openat(0xffffffffffffff9c, &(0x7f0000000500)='my_sys/bus/pci/devices/0000:00:03.0/resource1\x00', 0x2, 0x0) mmap$IORING_OFF_SQ_RING(0x0, 0x4, 0x1000002, 0x12, r1, 0x0) syz_fuse_handle_req(0xffffffffffffffff, 0x0, 0x0, &(0x7f0000000a00)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f0000000200)={0x90, 0x0, 0x0, {0x0, 0x0, 0x0, 0xfffffffffffffffc, 0x200, 0x0, {0x20000000000005, 0x0, 0x7, 0x1000007, 0x3, 0x0, 0xfffffffe, 0x8000000, 0x0, 0xa000, 0x10000, 0x0, 0x0, 0x734, 0x20}}}, 0x0, 0x0, 0x0, 0x0, 0x0}) r2 = syz_clone(0x11, 0x0, 0x0, 0x0, 0x0, 0x0) ptrace(0x10, r2) ptrace$setregs(0xd, r2, 0x2, &(0x7f0000000180)) ptrace$cont(0x21, r2, 0x80000001, 0x4) setsockopt$SO_ATTACH_FILTER(r0, 0x1, 0x1a, &(0x7f0000000100)={0x1, &(0x7f0000000080)=[{0x6, 0x6e, 0x5, 0x6}]}, 0x10) setsockopt$inet_sctp_SCTP_SOCKOPT_BINDX_ADD(r0, 0x84, 0x64, &(0x7f0000000000)=[@in6={0xa, 0x4e23, 0x0, @loopback}], 0x1c) r3 = openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000), 0x200002, 0x0) r4 = openat$cgroup_freezer_state(r3, &(0x7f0000000140), 0x2, 0x0) write$cgroup_freezer_state(r4, &(0x7f0000000080)='THAWED\x00', 0x7) syz_usb_connect(0x6, 0x3f, &(0x7f0000000040)=ANY=[@ANYRES64=r0, @ANYRESOCT=r0], 0x0) executing program 47: sendmmsg$inet6(0xffffffffffffffff, 0x0, 0x0, 0x4000010) sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x2) r0 = socket$inet6_icmp_raw(0xa, 0x3, 0x3a) setsockopt$inet6_IPV6_HOPOPTS(r0, 0x29, 0x36, &(0x7f0000000400)=ANY=[], 0x8) connect$inet6(r0, &(0x7f0000000000)={0xa, 0x0, 0x0, @mcast2, 0x5}, 0x1c) setsockopt$SO_BINDTODEVICE(r0, 0x1, 0x19, &(0x7f0000000240)='bridge0\x00', 0x10) write(r0, &(0x7f00000000c0)="8f2a0a65bd8c002b0304000e0580a7b6070d63e286a5cefe", 0x5ac) executing program 7: r0 = socket$kcm(0x10, 0x2, 0x0) r1 = openat$tun(0xffffffffffffff9c, &(0x7f00000002c0), 0xa0281, 0x0) ioctl$TUNSETIFF(r1, 0x400454ca, &(0x7f0000000140)={'pim6reg1\x00', 0x1}) ioctl$TUNSETLINK(r1, 0x400454cd, 0x339) socketpair$nbd(0x1, 0x1, 0x0, &(0x7f00000001c0)) r2 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000002180)='blkio.bfq.io_merged\x00', 0x275a, 0x0) close_range(r2, 0xffffffffffffffff, 0x0) ioctl$SIOCSIFHWADDR(r0, 0x8914, &(0x7f0000000040)={'veth1_to_hsr\x00', @local}) ioctl$TUNSETOFFLOAD(r1, 0x400454d0, 0x4) sendmsg$inet(r0, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000000)=[{&(0x7f0000000140)="5c00000012006bab9a3fe3d86e17aa0b046b876c1d0048380019000800004460bc06000000a701251e6182949a3651fbffffffd4d4938037e7c7a0a03400ac09c51c268811000096859fc57a00000000000000002571cd53b9851b30", 0x5c}], 0x1, 0x0, 0x0, 0x1f00c00e}, 0x8000) executing program 48: r0 = socket$kcm(0x10, 0x2, 0x0) r1 = openat$tun(0xffffffffffffff9c, &(0x7f00000002c0), 0xa0281, 0x0) ioctl$TUNSETIFF(r1, 0x400454ca, &(0x7f0000000140)={'pim6reg1\x00', 0x1}) ioctl$TUNSETLINK(r1, 0x400454cd, 0x339) socketpair$nbd(0x1, 0x1, 0x0, &(0x7f00000001c0)) r2 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000002180)='blkio.bfq.io_merged\x00', 0x275a, 0x0) close_range(r2, 0xffffffffffffffff, 0x0) ioctl$SIOCSIFHWADDR(r0, 0x8914, &(0x7f0000000040)={'veth1_to_hsr\x00', @local}) ioctl$TUNSETOFFLOAD(r1, 0x400454d0, 0x4) sendmsg$inet(r0, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000000)=[{&(0x7f0000000140)="5c00000012006bab9a3fe3d86e17aa0b046b876c1d0048380019000800004460bc06000000a701251e6182949a3651fbffffffd4d4938037e7c7a0a03400ac09c51c268811000096859fc57a00000000000000002571cd53b9851b30", 0x5c}], 0x1, 0x0, 0x0, 0x1f00c00e}, 0x8000) executing program 5: r0 = syz_ublk_setup_io_uring(0x20, &(0x7f0000000040)={0x0, 0x2, 0x1000, 0x1}, &(0x7f0000000000)=0x0, &(0x7f0000000100)=0x0, &(0x7f0000000140)=0x0) syz_ublk_add_dev(r0, r1, r2, r3, &(0x7f0000000180)={0x2e, 0x0, 0x0, 0xffffffffffffffff, 0xc0207504, 0x0, 0x0, 0x0, 0x0, 0x9, 0x0, 0x0, '\x00', {0xffffffff, 0xffff, 0x40, &(0x7f00000000c0)=@any_dev={0x1, 0xe50, 0x0, 0x0, 0x1000, 0x2000003, 0x0, 0x0, 0x16}}}, &(0x7f0000000280)) executing program 5: r0 = syz_ublk_setup_io_uring(0x20, &(0x7f0000000040)={0x0, 0x2, 0x1000, 0x1}, &(0x7f0000000000)=0x0, &(0x7f0000000100)=0x0, &(0x7f0000000140)=0x0) syz_ublk_add_dev(r0, r1, r2, r3, &(0x7f0000000180)={0x2e, 0x0, 0x0, 0xffffffffffffffff, 0xc0207504, 0x0, 0x0, 0x0, 0x0, 0x9, 0x0, 0x0, '\x00', {0xffffffff, 0xffff, 0x40, &(0x7f00000000c0)=@any_dev={0x4001, 0xe50, 0x0, 0x0, 0x1000, 0x2000003, 0x0, 0x0, 0xa0}}}, &(0x7f0000000280)) executing program 5: socket$kcm(0xa, 0x3, 0x3a) r0 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r0, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000340)=ANY=[@ANYBLOB="140000001000010000000000000000000500000a28000000000a030000000000000000000a00000708000240000000020900010073797a31000000002c000000030a010100000000000000000a0000070900010073797a31000000000900030073797a320000000014000000110001"], 0x7c}, 0x1, 0x0, 0x0, 0xc000}, 0x0) r1 = socket$kcm(0x10, 0x2, 0x0) sendmsg$kcm(r1, &(0x7f0000000940)={0x0, 0x0, &(0x7f00000001c0)=[{&(0x7f00000013c0)="d8000000100081040100000000000000021d080b01000000e8fe55a118001500060014000300001208000d0074be0000a8001600a400014020000600ffffff7fb94dcf5c0461c1d67f6f94007134cf6ee08000a0e408e8d8ef52a9d7c7c0b7a196e6f66112c88ac417898516277ceb6bbace80177ccbec4c2ee5a7cef4090000001fb791643a5ee4ce1b14d6d930dfe1d9d322fe7c9f8775730d0080000000000000b57a5025ccca9e00360db70100000040fad95667e006dcdf63951f215ce3bb14feb9f5588a63644caf1ce1bd6c769ad809d52a9ecbee", 0xd8}], 0x1}, 0x0) executing program 5: r0 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) bind$bt_hci(r0, &(0x7f0000000000)={0x1f, 0xffff, 0x2}, 0x6) r1 = socket$kcm(0xa, 0x1, 0x106) sendmsg$sock(r1, &(0x7f0000000400)={0x0, 0x0, 0x0}, 0x2004c040) executing program 5: r0 = socket$inet6_sctp(0xa, 0x1, 0x84) mkdir(&(0x7f0000000000)='my_sys\x00', 0x1ff) mount(0x0, &(0x7f0000000200)='my_sys\x00', &(0x7f0000000300)='sysfs\x00', 0x0, 0x0) r1 = openat(0xffffffffffffff9c, &(0x7f0000000500)='my_sys/bus/pci/devices/0000:00:03.0/resource1\x00', 0x2, 0x0) mmap$IORING_OFF_SQ_RING(0x0, 0x4, 0x1000002, 0x12, r1, 0x0) syz_fuse_handle_req(0xffffffffffffffff, 0x0, 0x0, &(0x7f0000000a00)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f0000000200)={0x90, 0x0, 0x0, {0x0, 0x0, 0x0, 0xfffffffffffffffc, 0x200, 0x0, {0x20000000000005, 0x0, 0x7, 0x1000007, 0x3, 0x0, 0xfffffffe, 0x8000000, 0x0, 0xa000, 0x10000, 0x0, 0x0, 0x734, 0x20}}}, 0x0, 0x0, 0x0, 0x0, 0x0}) r2 = syz_clone(0x11, 0x0, 0x0, 0x0, 0x0, 0x0) ptrace(0x10, r2) ptrace$setregs(0xd, r2, 0x2, &(0x7f0000000180)) mkdirat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000)='./cgroup.net/syz0\x00', 0x1ff) r3 = openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000), 0x200002, 0x0) r4 = openat$cgroup_freezer_state(r3, &(0x7f0000000140), 0x2, 0x0) write$cgroup_freezer_state(r4, &(0x7f0000000080)='THAWED\x00', 0x7) syz_usb_connect(0x6, 0x3f, &(0x7f0000000040)=ANY=[@ANYRES64=r0, @ANYRESOCT=r0], 0x0) executing program 9: r0 = socket(0x2b, 0x6, 0x0) setsockopt$inet6_group_source_req(r0, 0x29, 0x2a, &(0x7f0000000080)={0x0, {{0xa, 0x0, 0x0, @mcast1={0xff, 0x7}}}, {{0xa, 0x0, 0x0, @initdev={0xfe, 0x88, '\x00', 0x0, 0x0}, 0x9}}}, 0x108) setsockopt$inet6_group_source_req(r0, 0x29, 0x2e, &(0x7f0000000200)={0x101, {{0xa, 0x80, 0x0, @mcast1={0xff, 0x7}}}, {{0xa, 0x4, 0x0, @empty, 0x4}}}, 0x108) r1 = openat$kvm(0xffffffffffffff9c, &(0x7f00000000c0), 0x40000, 0x0) r2 = ioctl$KVM_CREATE_VM(r1, 0xae01, 0x0) ioctl$KVM_CREATE_DEVICE(r2, 0xc00caee0, &(0x7f0000000480)={0x4, 0xffffffffffffffff}) ioctl$KVM_HAS_DEVICE_ATTR(r3, 0x4018aee3, &(0x7f0000000140)=@attr_riscv64=@attr_addr={0x0, 0x1, @imsic=0x5, &(0x7f0000000000)=0xd9}) setsockopt$inet_sctp6_SCTP_EVENTS(0xffffffffffffffff, 0x84, 0xb, &(0x7f0000000380)={0x35, 0x6, 0x40, 0x7, 0x6, 0x6, 0x35, 0x5, 0xd2, 0x86, 0xf2, 0xb, 0x0, 0x8}, 0xe) kexec_load(0x0, 0x10, &(0x7f0000000340)=[{0x0, 0x0, 0x0, 0x3e0000000000}], 0x0) r4 = socket(0x80000000000000a, 0x2, 0x0) r5 = socket$inet6_sctp(0xa, 0x5, 0x84) r6 = socket$inet_sctp(0x2, 0x1, 0x84) getsockopt$inet_sctp_SCTP_MAX_BURST(r6, 0x84, 0x14, &(0x7f0000000000)=@assoc_value={0x0}, &(0x7f00000003c0)=0x8) setsockopt$inet_sctp6_SCTP_ENABLE_STREAM_RESET(r5, 0x84, 0x76, &(0x7f0000000240)={r7, 0x2}, 0x8) getsockopt$inet_sctp6_SCTP_GET_LOCAL_ADDRS(r4, 0x84, 0x6d, &(0x7f00000003c0)={0x0, 0xf4, "e18cadd478bcd61fbeda4a78b8e9148f6ef6076d9cffe676db4cf63f52a2afb80abcfc8abff6981247e96a2a3573c604755f5f37a04b3b5fd6a7e8b47063fc2fde4ef31d3f52b6c633b9ae27a8bc8c9a389c8b99d219b6256f8a57147a9d1156427d31041dab3e05816cb4585c74584b91294acda3caeb429d4d6d9b40b65aeb4553c8556c9ce2f78771ca9b9058854f65afab375afacaadc975efdbbe2c68a15f59ff457ba494f4185e0dfc932d6dc66a741d3ca65b8eb22eb1b4bf8128a0a579ad0d00ecb50283ef6f48fb79cb75b1d8bbd9f337260ee4f267ffd74f600ac0214d40a2bdfee7768e7138e5f22232184fd3ae33"}, &(0x7f00000004c0)=0xfc) getsockopt$inet_sctp6_SCTP_STATUS(r4, 0x84, 0xe, &(0x7f0000000580)={r7, 0x1, 0x10, 0x2, 0x3f5, 0x6, 0xff, 0xa, {r8, @in={{0x2, 0x4e23, @private=0xa010102}}, 0x647, 0x5, 0x0, 0xffffffff, 0x6}}, &(0x7f0000000640)=0xb0) setsockopt$inet6_group_source_req(r4, 0x29, 0x2e, &(0x7f0000000200)={0x0, {{0xa, 0x0, 0x0, @mcast1={0xff, 0x7}}}, {{0xa, 0x0, 0x0, @initdev={0xfe, 0x88, '\x00', 0x0, 0x0}}}}, 0x108) r9 = socket(0x80000000000000a, 0x2, 0x0) r10 = syz_init_net_socket$bt_hidp(0x1f, 0x3, 0x6) r11 = syz_init_net_socket$bt_l2cap(0x1f, 0x2, 0x0) connect$bt_l2cap(r11, &(0x7f0000000080)={0x1f, 0x0, @fixed={'\xaa\xaa\xaa\xaa\xaa', 0x10}, 0x7ff}, 0xe) ioctl$sock_bt_hidp_HIDPCONNADD(r10, 0x400448c8, &(0x7f0000000340)={r11, r11, 0xd, 0x1, &(0x7f0000000140)="c2", 0xb, 0xf9, 0x10cf, 0x3737, 0x8b, 0x2, 0x9, 'syz1\x00'}) sendmmsg$inet6(r4, &(0x7f0000000940)=[{{0x0, 0x0, &(0x7f0000000900)=[{&(0x7f0000000680)="999c2786be2523c8f52dbfe23d52ab85afd6a17aa58dafd37f68248f801fb7d79535eca2edc20a6379e87fc70c72fbbf295fb32279ee747a534d3d8c4d76376fb1ee4e57e428bc1302d6eade4c9d1b8a51588508659e3b4e4c2e0d1c54d6ad376e5e62d8020bbfb0e65a65ae410d15c3add98e5df42fe25fe4e8766478b7ecd9741e6167cd27e94be763c700ac79869a244a6ec4a1d2cb490f202c5a71b37e17180c74b3fe4effa699a583a9f5a05769c1a0cdcac35f4d4f4cf087", 0xbb}, {&(0x7f0000000740)="eaf7dfedc24dbc0fcf2ef6b94332687e102958b54374977772b56a3e286e0d48e7a5c21745c2f7363d1c93b1c8a3edbfc76c1c6de97facd08706379d77d5a8cfe365bbfac4bcd19a5893db8537124d0560f81036a16e628bf8d6706180c82191f0a4c83e67a5ced08290602c3d9d4b563f76b2dfaea58b0151795981561bc7f3e9d70b209e06c528a67e364fd8fd82e6887f581b1884caaa2c3172610e8b2a88fcf2", 0xa2}, {&(0x7f0000000800)="f66c62ce1a9d3f4c4d6e0a9ce1", 0xd}, {&(0x7f0000000840)="0b958ea6f74c71f338c8f832854d04ed09fb058625dd15ec930fb7bc6d462976bddc26727a7531306bca97bc23e792e6ae7afbbe119cd87699f754ab0688e3a7050c849e655645dcdea4bf4d20dfb07c8cf72b01aca94b3602cead960355ede9567a29d639a214f5ea8df7303eda0c75c49c371deb63783f15230fcbd7140a13be8e6ce715d8", 0x86}], 0x4}}], 0x1, 0x90) setsockopt$inet6_group_source_req(r9, 0x29, 0x2a, &(0x7f0000000080)={0x24, {{0xa, 0x0, 0x0, @mcast1={0xff, 0x7}}}, {{0xa, 0x0, 0x0, @remote}}}, 0x108) setsockopt$inet6_group_source_req(r9, 0x29, 0x2e, &(0x7f0000000200)={0x0, {{0xa, 0x1, 0x0, @mcast1={0xff, 0x7}}}, {{0xa, 0x4e23, 0x0, @private2={0xfc, 0x2, '\x00', 0x1}}}}, 0x108) r12 = seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0x0, &(0x7f00000000c0)={0x1, &(0x7f0000000100)=[{0x6, 0x0, 0x0, 0x7fff0026}]}) close_range(r12, 0xffffffffffffffff, 0x0) syz_usb_connect(0x5, 0x4e, &(0x7f0000000500)=ANY=[@ANYBLOB="12010002ff000040cd06310100010102030109023c00010100a0320904000006ff0000000705010240000007050202400000070504024000000705060240000007058103"], 0x0) ioctl$KVM_CREATE_VM(0xffffffffffffffff, 0x7040, 0x800000000000033) syz_ublk_setup_io_uring(0x19, &(0x7f0000000040)={0x0, 0x30b7, 0x4000, 0x2, 0x154}, &(0x7f0000000100), &(0x7f0000000280), &(0x7f00000001c0)) executing program 9: socket$kcm(0xa, 0x3, 0x3a) r0 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r0, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000340)=ANY=[@ANYBLOB="140000001000010000000000000000000500000a28000000000a030000000000000000000a00000708000240000000020900010073797a31000000002c000000030a010100000000000000000a0000070900010073797a31000000000900030073797a320000000014000000110001"], 0x7c}, 0x1, 0x0, 0x0, 0xc000}, 0x0) r1 = socket$kcm(0x10, 0x2, 0x0) sendmsg$kcm(r1, &(0x7f0000000940)={0x0, 0x0, &(0x7f00000001c0)=[{&(0x7f00000013c0)="d8000000100081040100000000000000021d080b01000000e8fe55a118001500060014000300001208000d0074be0000a8001600a400014020000600ffffff7fb94dcf5c0461c1d67f6f94007134cf6ee08000a0e408e8d8ef52a9d7c7c0b7a196e6f66112c88ac417898516277ceb6bbace80177ccbec4c2ee5a7cef4090000001fb791643a5ee4ce1b14d6d930dfe1d9d322fe7c9f8775730d0080000000000000b57a5025ccca9e00360db70100000040fad95667e006dcdf63951f215ce3bb14feb9f5588a63644caf1ce1bd6c769ad809d52a9ecbee", 0xd8}], 0x1}, 0x0) executing program 5: openat$sndseq(0xffffffffffffff9c, &(0x7f0000000000), 0x0) (fail_nth: 1) executing program 9: r0 = openat$snapshot(0xffffffffffffff9c, &(0x7f00000000c0), 0x8000, 0x0) ioctl$SNAPSHOT_S2RAM(r0, 0x330b) r1 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r1, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000300)={&(0x7f00000001c0)=ANY=[@ANYBLOB="740000001e0001032a9d70f8fddbdf24ac14140f000000000000000000000000000004d60a002b00ac1e11010000000000000000000000000300000007350000200017"], 0x74}, 0x1, 0x0, 0x0, 0x40800}, 0x0) mkdir(&(0x7f0000000240)='./file0\x00', 0x162) r2 = socket$unix(0x1, 0x1, 0x0) r3 = socket$inet6_mptcp(0xa, 0x1, 0x106) bind$inet6(r3, &(0x7f0000000080)={0xa, 0x4e22, 0x0, @empty}, 0x1c) listen(r3, 0x0) r4 = socket$inet_mptcp(0x2, 0x1, 0x106) connect$inet(r4, &(0x7f0000000000)={0x2, 0x4e22, @local}, 0x10) listen(0xffffffffffffffff, 0x8) setsockopt$inet_sctp_SCTP_MAXSEG(0xffffffffffffffff, 0x84, 0xd, &(0x7f0000000380), 0x4) r5 = accept4(0xffffffffffffffff, 0x0, 0x0, 0x0) write(r5, &(0x7f0000000000)="ea", 0x1) write(r5, &(0x7f00000002c0)="04", 0x1) writev(r5, &(0x7f0000000140)=[{&(0x7f0000000040)='w', 0x1}], 0x1) r6 = socket$nl_generic(0x10, 0x3, 0x10) syz_genetlink_get_family_id$mptcp(&(0x7f0000000100), r6) sendmsg$MPTCP_PM_CMD_ADD_ADDR(r6, &(0x7f0000000180)={0x0, 0x0, &(0x7f00000003c0)={&(0x7f0000000300)=ANY=[], 0x3c}}, 0x8000) bind$unix(r2, &(0x7f0000003000)=@abs={0x1, 0x0, 0x4e23}, 0x6e) listen(r2, 0x5) fsconfig$FSCONFIG_SET_PATH(0xffffffffffffffff, 0x3, &(0x7f0000000400)='%\xb6\\/]\x00', &(0x7f0000000480)='./file0\x00', 0xffffffffffffffff) connect$unix(0xffffffffffffffff, &(0x7f0000000640)=@file={0x1, '\xe9\x1fq\x89Y\x1e\x923aK\x00'}, 0x6e) syz_open_procfs(0x0, &(0x7f00000006c0)='fdinfo/3\x00') socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000180)={0xffffffffffffffff, 0xffffffffffffffff}) getsockopt$sock_buf(r7, 0x1, 0x1f, 0x0, &(0x7f00000001c0)) openat$audio(0xffffffffffffff9c, &(0x7f0000000440), 0x3318c0, 0x0) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000080)) syz_open_dev$sg(&(0x7f0000000040), 0x0, 0xc0080) executing program 9: r0 = openat$kvm(0xffffffffffffff9c, 0x0, 0x0, 0x0) socket$nl_netfilter(0x10, 0x3, 0xc) ioctl$KVM_CREATE_IRQCHIP(0xffffffffffffffff, 0xae60) ioctl$KVM_CREATE_IRQCHIP(0xffffffffffffffff, 0xae60) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x26) r2 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x4000) r3 = socket$nl_generic(0x10, 0x3, 0x10) r4 = socket$packet(0x11, 0x2, 0x300) setsockopt$sock_int(r4, 0x1, 0x1e, &(0x7f0000000040)=0xfffffffc, 0x4) sendmsg$NL80211_CMD_GET_SCAN(r3, &(0x7f0000000f00)={0x0, 0x0, &(0x7f0000000ec0)={&(0x7f0000000380)={0x1c, 0x0, 0xf21, 0x0, 0x25dfdbfe, {{}, {@val={0x8}, @void}}}, 0x1c}, 0x1, 0x0, 0x0, 0x48010}, 0x200000000000000) r5 = openat$ppp(0xffffffffffffff9c, &(0x7f0000000000), 0xc0802, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000e00)='./proc\x00', 0x1ff) mount(0x0, &(0x7f0000000e80)='./proc\x00', &(0x7f0000000ec0)='proc\x00', 0x0, 0x0) r6 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./proc/net/rpc/auth.rpcsec.context/channel\x00', 0x1, 0x0) write(r6, &(0x7f0000000140)="01303230333034203230303030303030303020302030203020", 0x19) ioctl$PPPIOCNEWUNIT(r5, 0xc004743e, &(0x7f00000000c0)) ioctl$PPPIOCSMAXCID(r5, 0x40047451, &(0x7f0000000200)=0x8) ioctl$PPPIOCSFLAGS1(r5, 0x40047459, &(0x7f0000000100)=0x2000004) pwritev(r5, &(0x7f00000003c0)=[{&(0x7f00000004c0)="00214717a7070000000003060000000000000000aaa6721d5874f72cf86d73d32f46380feb56a29357215d78fc44fac3f44d", 0x32}], 0x1, 0x73a, 0x1) ioctl$KVM_SET_USER_MEMORY_REGION(0xffffffffffffffff, 0x4020ae46, 0x0) ioctl$KVM_SET_REGS(r2, 0x4090ae82, 0x0) mmap(&(0x7f0000000000/0xff5000)=nil, 0xff5000, 0x2, 0x4c831, 0xffffffffffffffff, 0x0) ioctl$UFFDIO_REGISTER(0xffffffffffffffff, 0xc020aa00, 0x0) r7 = socket$inet6_sctp(0xa, 0x1, 0x84) getsockopt$inet_sctp6_SCTP_GET_ASSOC_ID_LIST(r7, 0x84, 0x1d, 0x0, &(0x7f0000000540)) ioctl$UFFDIO_CONTINUE(0xffffffffffffffff, 0xc020aa07, 0x0) openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x4043, 0x1ff) execveat(0xffffffffffffff9c, &(0x7f0000000140)='./file1\x00', 0x0, 0x0, 0x1000) getresuid(&(0x7f0000000080), 0x0, 0x0) syz_open_procfs(0x0, &(0x7f0000000100)='task\x00') executing program 9: r0 = socket$inet6_sctp(0xa, 0x1, 0x84) mkdir(&(0x7f0000000000)='my_sys\x00', 0x1ff) mount(0x0, &(0x7f0000000200)='my_sys\x00', &(0x7f0000000300)='sysfs\x00', 0x0, 0x0) r1 = openat(0xffffffffffffff9c, &(0x7f0000000500)='my_sys/bus/pci/devices/0000:00:03.0/resource1\x00', 0x2, 0x0) mmap$IORING_OFF_SQ_RING(0x0, 0x4, 0x1000002, 0x12, r1, 0x0) syz_fuse_handle_req(0xffffffffffffffff, 0x0, 0x0, &(0x7f0000000a00)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f0000000200)={0x90, 0x0, 0x0, {0x0, 0x0, 0x0, 0xfffffffffffffffc, 0x200, 0x0, {0x20000000000005, 0x0, 0x7, 0x1000007, 0x3, 0x0, 0xfffffffe, 0x8000000, 0x0, 0xa000, 0x10000, 0x0, 0x0, 0x734, 0x20}}}, 0x0, 0x0, 0x0, 0x0, 0x0}) r2 = syz_clone(0x11, 0x0, 0x0, 0x0, 0x0, 0x0) ptrace(0x10, r2) ptrace$setregs(0xd, r2, 0x2, &(0x7f0000000180)) mkdirat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000)='./cgroup.net/syz0\x00', 0x1ff) r3 = openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000), 0x200002, 0x0) r4 = openat$cgroup_freezer_state(r3, &(0x7f0000000140), 0x2, 0x0) write$cgroup_freezer_state(r4, &(0x7f0000000080)='THAWED\x00', 0x7) syz_usb_connect(0x6, 0x3f, &(0x7f0000000040)=ANY=[@ANYRES64=r0, @ANYRESOCT=r0], 0x0) executing program 9: r0 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$inet6_tcp_int(r0, 0x6, 0x13, &(0x7f0000000000)=0x100000001, 0x4) connect$inet6(r0, &(0x7f0000000100)={0xa, 0x4, 0x0, @loopback, 0x4}, 0x1c) setsockopt$inet6_tcp_TCP_ULP(r0, 0x6, 0x1f, &(0x7f0000000040), 0x4) setsockopt$inet6_tcp_TLS_TX(r0, 0x11a, 0x1, &(0x7f00000000c0)=@gcm_128={{0x304}, "0000000400", "6abc00000000000000000000001000", "f0630400"}, 0x28) executing program 3: r0 = socket$kcm(0x10, 0x2, 0x0) sendmsg$kcm(r0, &(0x7f0000000000)={0x0, 0x4, &(0x7f0000000080)=[{&(0x7f0000000200)="2e0400001c008102e00f80ecdb4cb9f207c804a00d00000088081afb0a0002000a0ada1b40d80800c500c50083b8", 0xfec9}], 0x1, 0x0, 0x0, 0x5865}, 0x0) executing program 3: r0 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) sendmsg$NLBL_CALIPSO_C_ADD(r0, &(0x7f0000000100)={0x0, 0x0, &(0x7f0000000300)={&(0x7f0000000400)={0x24, 0x0, 0x1, 0x0, 0x0, {}, [@NLBL_CALIPSO_A_DOI={0x8, 0x1, 0x1}, @NLBL_CALIPSO_A_MTYPE={0x8}]}, 0x24}}, 0x0) executing program 3: timer_create(0x0, &(0x7f0000000240)={0x0, 0x21, 0x0, @thr={0x0, 0x0}}, &(0x7f0000000300)) executing program 3: r0 = socket(0x80000000000000a, 0x2, 0x0) setsockopt$inet6_group_source_req(r0, 0x29, 0x2a, &(0x7f0000000080)={0x24, {{0xa, 0x0, 0x0, @mcast1={0xff, 0x7}}}, {{0xa, 0x0, 0x0, @remote}}}, 0x108) setsockopt$inet6_group_source_req(r0, 0x29, 0x2e, &(0x7f0000000200)={0x0, {{0xa, 0x1, 0x0, @mcast1={0xff, 0x7}}}, {{0xa, 0x4e23, 0x0, @private2={0xfc, 0x2, '\x00', 0x1}}}}, 0x108) executing program 3: r0 = socket$inet6_sctp(0xa, 0x1, 0x84) mkdir(&(0x7f0000000000)='my_sys\x00', 0x1ff) mount(0x0, &(0x7f0000000200)='my_sys\x00', &(0x7f0000000300)='sysfs\x00', 0x0, 0x0) r1 = openat(0xffffffffffffff9c, &(0x7f0000000500)='my_sys/bus/pci/devices/0000:00:03.0/resource1\x00', 0x2, 0x0) mmap$IORING_OFF_SQ_RING(0x0, 0x4, 0x1000002, 0x12, r1, 0x0) syz_fuse_handle_req(0xffffffffffffffff, 0x0, 0x0, &(0x7f0000000a00)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f0000000200)={0x90, 0x0, 0x0, {0x0, 0x0, 0x0, 0xfffffffffffffffc, 0x200, 0x0, {0x20000000000005, 0x0, 0x7, 0x1000007, 0x3, 0x0, 0xfffffffe, 0x8000000, 0x0, 0xa000, 0x10000, 0x0, 0x0, 0x734, 0x20}}}, 0x0, 0x0, 0x0, 0x0, 0x0}) r2 = syz_clone(0x11, 0x0, 0x0, 0x0, 0x0, 0x0) ptrace(0x10, r2) ptrace$cont(0x21, r2, 0x80000001, 0x4) mkdirat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000)='./cgroup.net/syz0\x00', 0x1ff) r3 = openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000), 0x200002, 0x0) r4 = openat$cgroup_freezer_state(r3, &(0x7f0000000140), 0x2, 0x0) write$cgroup_freezer_state(r4, &(0x7f0000000080)='THAWED\x00', 0x7) syz_usb_connect(0x6, 0x3f, &(0x7f0000000040)=ANY=[@ANYRES64=r0, @ANYRESOCT=r0], 0x0) executing program 3: r0 = socket$kcm(0x10, 0x2, 0x0) sendmsg$kcm(r0, &(0x7f0000000000)={0x0, 0x4, &(0x7f0000000080)=[{&(0x7f0000000200)="2e0400001c008102e00f80ecdb4cb9f207c804a00d00000088081afb0a0002000a0ada1b40d80800c500c50083b8", 0xfec9}], 0x1, 0x0, 0x0, 0x5865}, 0x0) executing program 8: r0 = socket(0x80000000000000a, 0x2, 0x0) setsockopt$inet6_group_source_req(r0, 0x29, 0x2e, &(0x7f0000000200)={0x0, {{0xa, 0x1, 0x0, @mcast1={0xff, 0x7}}}, {{0xa, 0x4e23, 0x0, @private2={0xfc, 0x2, '\x00', 0x1}}}}, 0x108) executing program 8: r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$ethtool(&(0x7f0000001080), 0xffffffffffffffff) r2 = syz_genetlink_get_family_id$ethtool(&(0x7f0000000080), 0xffffffffffffffff) r3 = socket$inet_udp(0x2, 0x2, 0x0) ioctl$sock_SIOCGIFINDEX(r3, 0x8933, &(0x7f00000004c0)={'syz_tun\x00', 0x0}) r5 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$ETHTOOL_MSG_LINKMODES_SET(r5, &(0x7f0000000200)={0x0, 0x0, &(0x7f0000000000)={&(0x7f00000000c0)={0x34, r2, 0x1, 0x70bd25, 0x25dfdbfe, {}, [@ETHTOOL_A_LINKMODES_OURS={0x14, 0x3, 0x0, 0x1, [@ETHTOOL_A_BITSET_VALUE={0x4}, @ETHTOOL_A_BITSET_MASK={0x4}, @ETHTOOL_A_BITSET_SIZE={0x8}]}, @ETHTOOL_A_LINKMODES_HEADER={0xc, 0x1, 0x0, 0x1, [@ETHTOOL_A_HEADER_DEV_INDEX={0x8, 0x1, r4}]}]}, 0x34}, 0x1, 0x0, 0x0, 0x20004000}, 0x4044094) sendmsg$ETHTOOL_MSG_LINKMODES_SET(r0, &(0x7f0000000280)={0x0, 0x0, &(0x7f00000001c0)={&(0x7f0000000040)={0x2c, r1, 0x1, 0x0, 0x0, {0x29}, [@ETHTOOL_A_LINKMODES_HEADER={0x18, 0x1, 0x0, 0x1, [@ETHTOOL_A_HEADER_DEV_NAME={0x14, 0x2, 'vcan0\x00'}]}]}, 0x2c}}, 0x0) executing program 8: r0 = socket$inet6_sctp(0xa, 0x801, 0x84) sendmmsg$inet6(r0, &(0x7f000000a540)=[{{&(0x7f00000000c0)={0xa, 0x4e24, 0x9, @private2, 0x8}, 0x1c, &(0x7f0000002840)=[{&(0x7f0000000240)="f0b4", 0x2}], 0x1}}], 0x1, 0x20000000) (fail_nth: 1) executing program 8: r0 = socket$kcm(0xa, 0x2, 0x0) getsockopt$IP_VS_SO_GET_VERSION(r0, 0x0, 0x480, &(0x7f0000000080), &(0x7f00000000c0)=0x40) executing program 8: r0 = socket$inet6_sctp(0xa, 0x1, 0x84) mkdir(&(0x7f0000000000)='my_sys\x00', 0x1ff) mount(0x0, &(0x7f0000000200)='my_sys\x00', &(0x7f0000000300)='sysfs\x00', 0x0, 0x0) r1 = openat(0xffffffffffffff9c, &(0x7f0000000500)='my_sys/bus/pci/devices/0000:00:03.0/resource1\x00', 0x2, 0x0) mmap$IORING_OFF_SQ_RING(0x0, 0x4, 0x1000002, 0x12, r1, 0x0) syz_fuse_handle_req(0xffffffffffffffff, 0x0, 0x0, &(0x7f0000000a00)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f0000000200)={0x90, 0x0, 0x0, {0x0, 0x0, 0x0, 0xfffffffffffffffc, 0x200, 0x0, {0x20000000000005, 0x0, 0x7, 0x1000007, 0x3, 0x0, 0xfffffffe, 0x8000000, 0x0, 0xa000, 0x10000, 0x0, 0x0, 0x734, 0x20}}}, 0x0, 0x0, 0x0, 0x0, 0x0}) r2 = syz_clone(0x11, 0x0, 0x0, 0x0, 0x0, 0x0) ptrace(0x10, r2) ptrace$cont(0x21, r2, 0x80000001, 0x4) mkdirat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000)='./cgroup.net/syz0\x00', 0x1ff) r3 = openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000), 0x200002, 0x0) r4 = openat$cgroup_freezer_state(r3, &(0x7f0000000140), 0x2, 0x0) write$cgroup_freezer_state(r4, &(0x7f0000000080)='THAWED\x00', 0x7) syz_usb_connect(0x6, 0x3f, &(0x7f0000000040)=ANY=[@ANYRES64=r0, @ANYRESOCT=r0], 0x0) executing program 49: openat$sndseq(0xffffffffffffff9c, &(0x7f0000000000), 0x0) (fail_nth: 1) executing program 8: r0 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) sendmsg$NLBL_CALIPSO_C_ADD(r0, &(0x7f0000000100)={0x0, 0x0, &(0x7f0000000300)={&(0x7f0000000400)={0x24, 0x0, 0x1, 0x0, 0x0, {}, [@NLBL_CALIPSO_A_DOI={0x8, 0x1, 0x1}, @NLBL_CALIPSO_A_MTYPE={0x8}]}, 0x24}}, 0x0) executing program 50: r0 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$inet6_tcp_int(r0, 0x6, 0x13, &(0x7f0000000000)=0x100000001, 0x4) connect$inet6(r0, &(0x7f0000000100)={0xa, 0x4, 0x0, @loopback, 0x4}, 0x1c) setsockopt$inet6_tcp_TCP_ULP(r0, 0x6, 0x1f, &(0x7f0000000040), 0x4) setsockopt$inet6_tcp_TLS_TX(r0, 0x11a, 0x1, &(0x7f00000000c0)=@gcm_128={{0x304}, "0000000400", "6abc00000000000000000000001000", "f0630400"}, 0x28) executing program 51: r0 = socket$kcm(0x10, 0x2, 0x0) sendmsg$kcm(r0, &(0x7f0000000000)={0x0, 0x4, &(0x7f0000000080)=[{&(0x7f0000000200)="2e0400001c008102e00f80ecdb4cb9f207c804a00d00000088081afb0a0002000a0ada1b40d80800c500c50083b8", 0xfec9}], 0x1, 0x0, 0x0, 0x5865}, 0x0) executing program 52: r0 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) sendmsg$NLBL_CALIPSO_C_ADD(r0, &(0x7f0000000100)={0x0, 0x0, &(0x7f0000000300)={&(0x7f0000000400)={0x24, 0x0, 0x1, 0x0, 0x0, {}, [@NLBL_CALIPSO_A_DOI={0x8, 0x1, 0x1}, @NLBL_CALIPSO_A_MTYPE={0x8}]}, 0x24}}, 0x0) executing program 2: r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000340), 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) r2 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0) ioctl$KVM_SET_CPUID2(r2, 0x4008ae90, &(0x7f00000000c0)={0x1, 0x0, [{0xa, 0x200, 0x0, 0xfffffff8, 0x95, 0xf, 0x4ca}]}) ioctl$KVM_SET_USER_MEMORY_REGION(r1, 0x4020ae46, &(0x7f0000000400)={0x0, 0x0, 0x0, 0x20002000, &(0x7f0000000000/0x2000)=nil}) ioctl$KVM_REGISTER_COALESCED_MMIO(r1, 0x4010ae67, &(0x7f0000000180)={0x3000, 0x5000, 0x1}) ioctl$KVM_REGISTER_COALESCED_MMIO(r1, 0x4010ae67, &(0x7f0000000080)={0x2, 0x25000, 0x1}) r3 = memfd_create(0x0, 0x2) ioctl$KVM_CREATE_IRQCHIP(r1, 0xae60) fsetxattr$system_posix_acl(r3, &(0x7f0000000580)='system.posix_acl_access\x00', &(0x7f00000001c0)=ANY=[@ANYBLOB="02000000010009000000f3ff0300060000000000100000000000000020000100000000007b0f261b3539943941aa1da63a17cc52"], 0x24, 0x0) ioctl$KVM_RUN(0xffffffffffffffff, 0xae80, 0x0) ioctl$KVM_RUN(r2, 0xae80, 0x0) executing program 2: r0 = syz_open_dev$sndpcmc(&(0x7f0000000120), 0x1, 0x2) ioctl$SNDRV_PCM_IOCTL_HW_PARAMS(r0, 0xc2604111, &(0x7f0000000680)={0x0, [[0xfffffffe, 0xffffffff, 0xffffffff, 0x1, 0xffffffff, 0xfffffffc, 0xffffffff, 0xffffffff], [0xffffffff, 0x2, 0xfffffffd, 0xa, 0xffffffff, 0xffffffff, 0xffffffff, 0xffffffff], [0xffffffff, 0xffffffff, 0x83, 0xffffffff, 0xffffffff, 0xffffffff, 0x3, 0xffffffff]], '\x00', [{0x10, 0x10, 0x0, 0x0, 0x1}, {0x20, 0x20, 0x0, 0x0, 0x1}, {0x2, 0x9, 0x0, 0x0, 0x1}, {0xac44, 0xac44, 0x0, 0x0, 0x1}, {0xa, 0x186a0, 0x0, 0x0, 0x1}, {0x103, 0x400, 0x0, 0x0, 0x1}, {0x400, 0x101000, 0x0, 0x0, 0x1}, {0x2, 0x8, 0x0, 0x0, 0x1}, {0x2710, 0xf4240, 0x0, 0x0, 0x1}, {0x400, 0xffd, 0x0, 0x0, 0x1}, {0x1000, 0x4000, 0x0, 0x0, 0x1}, {0x0, 0xf4240, 0x0, 0x0, 0x1}], '\x00', 0x4}) ioctl$SNDRV_PCM_IOCTL_PREPARE(r0, 0x4140, 0x0) r1 = openat$adsp1(0xffffffffffffff9c, &(0x7f0000000040), 0xa0201, 0x0) write$dsp(r1, &(0x7f00000012c0)="a52876830a602214f6b4e928d758f38a5a7cb4b31c4c09289e9ebb6286784ca3", 0x4000) r2 = fsopen(&(0x7f0000000140)='debugfs\x00', 0x1) r3 = openat(0xffffffffffffff9c, &(0x7f0000000500)='my_sys/bus/pci/devices/0000:00:03.0/resource1\x00', 0x2, 0x0) mmap(&(0x7f0000ffc000/0x4000)=nil, 0x4000, 0x3, 0x11, r3, 0x0) fsmount(r2, 0x0, 0xd) seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0x0, &(0x7f0000000340)={0x1, &(0x7f0000000000)=[{0x6, 0xf, 0x0, 0x7fff8000}]}) openat(0xffffffffffffff9c, &(0x7f0000000500)='./tracing/events/kvm/kvm_hv_stimer_cleanup/trigger\x00', 0x2d80, 0x82) syz_usb_connect(0x0, 0x2d, &(0x7f0000001080)=ANY=[@ANYBLOB="120110012dcef620ca160215994b0102030109021b000108d050080904"], 0x0) socket$nl_generic(0x10, 0x3, 0x10) syz_genetlink_get_family_id$mptcp(&(0x7f0000000380), 0xffffffffffffffff) move_pages(0x0, 0x1efe, &(0x7f0000000080), 0x0, &(0x7f0000000040), 0x0) executing program 1: r0 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000040), 0xffffffffffffffff) r1 = socket$nl_generic(0x10, 0x3, 0x10) r2 = syz_open_dev$tty1(0xc, 0x4, 0x1) r3 = socket(0x1e, 0x2, 0x0) setsockopt$TIPC_DEST_DROPPABLE(r3, 0x10f, 0x81, &(0x7f0000000480), 0x4) mmap(&(0x7f0000001000/0x1000)=nil, 0x1000, 0x3, 0x32, 0xffffffffffffffff, 0x0) mprotect(&(0x7f0000001000/0x1000)=nil, 0x1000, 0x0) ioctl$sock_SIOCETHTOOL(0xffffffffffffffff, 0x8946, 0x0) recvmmsg(r3, &(0x7f0000003040)=[{{0x0, 0x0, &(0x7f0000000780)=[{&(0x7f0000001e40)=""/174, 0xae}], 0x1, &(0x7f0000001fc0)=""/67, 0x43}, 0x2001}], 0x1, 0x40002122, 0x0) sendmsg$tipc(r3, &(0x7f0000000100)={&(0x7f0000000040)=@nameseq={0x1e, 0x1, 0x0, {0x1, 0x1, 0x4}}, 0x10, 0x0}, 0x4800) ioctl$TCSETS(r2, 0x4b72, &(0x7f0000000140)={0x5, 0x2, 0x0, 0x0, 0x11, "0060930000efa4890200"}) ioctl$sock_SIOCGIFINDEX_80211(r1, 0x8933, &(0x7f0000000100)={'wlan1\x00', 0x0}) sendmsg$NL80211_CMD_VENDOR(r1, &(0x7f0000000000)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f00000003c0)=ANY=[@ANYBLOB='0\x00\x00\x00', @ANYRES16=r0, @ANYBLOB="010200000000000000006700000008000300", @ANYRES32=r4, @ANYBLOB="0800c300741300000800c40001"], 0x30}}, 0x0) r5 = socket$nl_netfilter(0x10, 0x3, 0xc) r6 = socket(0x40000000015, 0x5, 0x0) bind$inet6(r6, &(0x7f0000000140)={0xa, 0x0, 0x0, @loopback}, 0x1c) connect$inet6(r6, &(0x7f0000000000)={0xa, 0x4e21, 0x2, @remote, 0x6}, 0x1c) connect$inet6(r6, &(0x7f0000000100)={0xa, 0x4e23, 0x7, @initdev={0xfe, 0x88, '\x00', 0x0, 0x0}, 0x8}, 0x1c) setsockopt$netlink_NETLINK_PKTINFO(r5, 0x10e, 0x3, &(0x7f0000000000)=0x131e, 0x4) sendmsg$NFT_BATCH(r5, &(0x7f000000c2c0)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000340)=ANY=[@ANYBLOB="140000001000010000000000000000000000000a28000000000a0101000000005e1affd5020000000900010073797a300000000008000240000000032c000000030a01030000e6ff00000000020000000900010073797a30000000000900030073797a320000000014000000110001"], 0x7c}}, 0x0) syz_usb_connect(0x5, 0x36, &(0x7f00000000c0)=ANY=[@ANYBLOB="120100001a77aa4094225b4210a20102030109022400010000000009040000029233500009050602ff030000000905ba3e"], 0x0) executing program 2: syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) ioctl$ifreq_SIOCGIFINDEX_vcan(0xffffffffffffffff, 0x8933, &(0x7f0000000100)={'vcan0\x00'}) mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./trace\x00', 0x1ff) mount(0x0, &(0x7f0000000000)='./trace\x00', &(0x7f0000000100)='tracefs\x00', 0x0, 0x0) openat(0xffffffffffffff9c, &(0x7f0000000500)='./dummy\x00', 0x42, 0x1ff) r0 = openat(0xffffffffffffff9c, &(0x7f0000000200)='./trace/uprobe_events\x00', 0x2, 0x0) write(r0, &(0x7f0000000300)='p:mygroup/myevent ./dummy:0', 0x1b) setsockopt$inet6_int(0xffffffffffffffff, 0x29, 0xcb, 0x0, 0x0) socket$inet_tcp(0x2, 0x1, 0x0) lsetxattr$system_posix_acl(0x0, 0x0, &(0x7f0000000040)={{}, {0x10, 0x4}, [], {0x4, 0x1}, [], {}, {0x20, 0x4}}, 0x24, 0x0) executing program 2: openat$sysfs(0xffffffffffffff9c, 0x0, 0x24a01, 0xa2) r0 = socket$netlink(0x10, 0x3, 0x0) sendmsg$netlink(r0, &(0x7f0000001e00)={0x0, 0x0, &(0x7f0000000080)=[{0x0, 0x28}], 0x1}, 0x14008010) executing program 2: r0 = syz_genetlink_get_family_id$nl80211(0x0, 0xffffffffffffffff) r1 = socket$nl_generic(0x10, 0x3, 0x10) ioctl$sock_SIOCGIFINDEX_80211(r1, 0x8933, &(0x7f0000000100)={'wlan1\x00', 0x0}) sendmsg$NL80211_CMD_VENDOR(r1, &(0x7f0000000000)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f00000003c0)=ANY=[@ANYBLOB='0\x00\x00\x00', @ANYRES16=r0, @ANYBLOB="010200000000000000006700000008000300", @ANYRES32=r2, @ANYBLOB="0800c300741300000800c40001"], 0x30}}, 0x0) executing program 2: r0 = syz_open_dev$sndpcmc(&(0x7f0000000120), 0x1, 0x2) ioctl$SNDRV_PCM_IOCTL_HW_PARAMS(r0, 0xc2604111, &(0x7f0000000680)={0x0, [[0xfffffffe, 0xffffffff, 0xffffffff, 0x1, 0xffffffff, 0xfffffffc, 0xffffffff, 0xffffffff], [0xffffffff, 0x2, 0xfffffffd, 0xa, 0xffffffff, 0xffffffff, 0xffffffff, 0xffffffff], [0xffffffff, 0xffffffff, 0x83, 0xffffffff, 0xffffffff, 0xffffffff, 0x3, 0xffffffff]], '\x00', [{0x10, 0x10, 0x0, 0x0, 0x1}, {0x20, 0x20, 0x0, 0x0, 0x1}, {0x2, 0x9, 0x0, 0x0, 0x1}, {0xac44, 0xac44, 0x0, 0x0, 0x1}, {0xa, 0x186a0, 0x0, 0x0, 0x1}, {0x103, 0x400, 0x0, 0x0, 0x1}, {0x400, 0x101000, 0x0, 0x0, 0x1}, {0x2, 0x8, 0x0, 0x0, 0x1}, {0x2710, 0xf4240, 0x0, 0x0, 0x1}, {0x400, 0xffd, 0x0, 0x0, 0x1}, {0x1000, 0x4000, 0x0, 0x0, 0x1}, {0x0, 0xf4240, 0x0, 0x0, 0x1}], '\x00', 0x4}) ioctl$SNDRV_PCM_IOCTL_PREPARE(r0, 0x4140, 0x0) r1 = openat$adsp1(0xffffffffffffff9c, &(0x7f0000000040), 0xa0201, 0x0) write$dsp(r1, &(0x7f00000012c0)="a52876830a602214f6b4e928d758f38a5a7cb4b31c4c09289e9ebb6286784ca3", 0x4000) fsconfig$FSCONFIG_CMD_CREATE(0xffffffffffffffff, 0x6, 0x0, 0x0, 0x0) r2 = openat(0xffffffffffffff9c, &(0x7f0000000500)='my_sys/bus/pci/devices/0000:00:03.0/resource1\x00', 0x2, 0x0) mmap(&(0x7f0000ffc000/0x4000)=nil, 0x4000, 0x3, 0x11, r2, 0x0) fsmount(0xffffffffffffffff, 0x0, 0xd) seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0x0, &(0x7f0000000340)={0x1, &(0x7f0000000000)=[{0x6, 0xf, 0x0, 0x7fff8000}]}) openat(0xffffffffffffff9c, &(0x7f0000000500)='./tracing/events/kvm/kvm_hv_stimer_cleanup/trigger\x00', 0x2d80, 0x82) syz_usb_connect(0x0, 0x2d, &(0x7f0000001080)=ANY=[@ANYBLOB="120110012dcef620ca160215994b0102030109021b000108d050080904"], 0x0) socket$nl_generic(0x10, 0x3, 0x10) syz_genetlink_get_family_id$mptcp(&(0x7f0000000380), 0xffffffffffffffff) move_pages(0x0, 0x1efe, &(0x7f0000000080), 0x0, &(0x7f0000000040), 0x0) executing program 1: creat(&(0x7f00000011c0)='./file0\x00', 0x0) mount$nfs(0x0, &(0x7f0000000040)='./file0\x00', &(0x7f0000000000), 0x8402, &(0x7f0000002200)={[{'nointr'}]}) r0 = open(&(0x7f0000000000)='.\x00', 0x0, 0x0) renameat2(0xffffffffffffffff, &(0x7f0000000100)='\x13\x13w\xc5\xfc5\xd4\x14T\xd5\xd4\x1d)\xad\x1a`)Y\x81F\xe6\xbe\x16nA\xad\r\xbd@T\x03<\x9f3\xbb\xda\x82$\xa2\xf3\xd7r\xe7cnH\xb3<\xbfp\x83r\xe8\xf1\xb9\x93>\xc5\x12wC\xbe\"\x06 \x9e\xf0-\xf9\xcb\xf2\xf6\xe8\x80\xd38/\x00', r0, &(0x7f0000000240)='./file1/file0\x00', 0x6) ioctl$FS_IOC_SETFLAGS(0xffffffffffffffff, 0x40086602, &(0x7f00000001c0)=0x10000) prlimit64(0x0, 0x6, &(0x7f0000000040)={0x0, 0x1}, 0x0) munmap(&(0x7f0000ff3000/0xb000)=nil, 0xb000) prctl$PR_SET_MM_MAP(0x23, 0xe, &(0x7f0000000080)={&(0x7f0000ff1000/0x3000)=nil, &(0x7f0000ffd000/0x1000)=nil, &(0x7f0000ffc000/0x4000)=nil, &(0x7f0000ffc000/0x4000)=nil, &(0x7f0000ff0000/0xd000)=nil, &(0x7f0000ff3000/0x4000)=nil, &(0x7f0000ffd000/0x1000)=nil, &(0x7f0000ffa000/0x1000)=nil, &(0x7f0000ffc000/0x2000)=nil, &(0x7f0000ffa000/0x1000)=nil, &(0x7f0000ffa000/0x2000)=nil, 0x0}, 0x68) brk(0x200000ffc000) executing program 1: syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) ioctl$ifreq_SIOCGIFINDEX_vcan(0xffffffffffffffff, 0x8933, &(0x7f0000000100)={'vcan0\x00'}) mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./trace\x00', 0x1ff) mount(0x0, &(0x7f0000000000)='./trace\x00', &(0x7f0000000100)='tracefs\x00', 0x0, 0x0) openat(0xffffffffffffff9c, &(0x7f0000000500)='./dummy\x00', 0x42, 0x1ff) r0 = openat(0xffffffffffffff9c, &(0x7f0000000200)='./trace/uprobe_events\x00', 0x2, 0x0) write(r0, &(0x7f0000000300)='p:mygroup/myevent ./dummy:0', 0x1b) setsockopt$inet6_int(0xffffffffffffffff, 0x29, 0xcb, 0x0, 0x0) socket$inet_tcp(0x2, 0x1, 0x0) lsetxattr$system_posix_acl(0x0, 0x0, &(0x7f0000000040)={{}, {0x10, 0x4}, [], {0x4, 0x1}, [], {}, {0x20, 0x4}}, 0x24, 0x0) executing program 0: r0 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r0, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000240)=ANY=[@ANYBLOB="140000001000010000000000000000000500000a28000000000a030000000000000000000a00000708000240000000020900010073797a31000000002c000000030a010100000000000000000a0000070900010073797a31000000000900030073797a320000000014"], 0x7c}, 0x1, 0x0, 0x0, 0x4000}, 0x0) sendmsg$NFT_BATCH(r0, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000440)={{0x14, 0x10, 0x1, 0x0, 0x0, {0x2}}, [@NFT_MSG_NEWRULE={0x90, 0x6, 0xa, 0x401, 0x0, 0x0, {0xa, 0x0, 0x405}, [@NFTA_RULE_TABLE={0x9, 0x1, 'syz1\x00'}, @NFTA_RULE_EXPRESSIONS={0x64, 0x4, 0x0, 0x1, [{0x60, 0x1, 0x0, 0x1, @inner={{0xa}, @val={0x50, 0x2, 0x0, 0x1, [@NFTA_INNER_HDRSIZE={0x8, 0x4, 0x1, 0x0, 0x17}, @NFTA_INNER_EXPR={0x34, 0x5, 0x0, 0x1, @payload={{0xc}, @val={0x24, 0x2, 0x0, 0x1, [@NFTA_PAYLOAD_OFFSET={0x8, 0x3, 0x1, 0x0, 0x92}, @NFTA_PAYLOAD_LEN={0x8, 0x4, 0x1, 0x0, 0xca}, @NFTA_PAYLOAD_DREG={0x8, 0x1, 0x1, 0x0, 0x9}, @NFTA_PAYLOAD_BASE={0x8, 0x2, 0x1, 0x0, 0x2}]}}}, @NFTA_INNER_FLAGS={0x8, 0x3, 0x1, 0x0, 0x4}, @NFTA_INNER_TYPE={0x8, 0x2, 0x1, 0x0, 0x84}]}}}]}, @NFTA_RULE_CHAIN={0x9, 0x2, 'syz2\x00'}]}], {0x14, 0x11, 0x1, 0x0, 0x0, {0x1}}}, 0xb8}, 0x1, 0x0, 0x0, 0x48890}, 0x24000000) executing program 1: r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000340), 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) r2 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0) ioctl$KVM_SET_CPUID2(r2, 0x4008ae90, &(0x7f00000000c0)={0x1, 0x0, [{0xa, 0x200, 0x0, 0xfffffff8, 0x95, 0xf, 0x4ca}]}) ioctl$KVM_SET_USER_MEMORY_REGION(r1, 0x4020ae46, &(0x7f0000000400)={0x0, 0x0, 0x0, 0x20002000, &(0x7f0000000000/0x2000)=nil}) ioctl$KVM_REGISTER_COALESCED_MMIO(r1, 0x4010ae67, &(0x7f0000000180)={0x3000, 0x5000, 0x1}) ioctl$KVM_REGISTER_COALESCED_MMIO(r1, 0x4010ae67, &(0x7f0000000080)={0x2, 0x25000, 0x1}) memfd_create(0x0, 0x2) r3 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x2) ioctl$KVM_RUN(r3, 0xae80, 0x0) ioctl$KVM_RUN(r2, 0xae80, 0x0) executing program 0: r0 = syz_genetlink_get_family_id$nl80211(0x0, 0xffffffffffffffff) r1 = socket$nl_generic(0x10, 0x3, 0x10) ioctl$sock_SIOCGIFINDEX_80211(r1, 0x8933, &(0x7f0000000100)={'wlan1\x00', 0x0}) sendmsg$NL80211_CMD_VENDOR(r1, &(0x7f0000000000)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f00000003c0)=ANY=[@ANYBLOB='0\x00\x00\x00', @ANYRES16=r0, @ANYBLOB="010200000000000000006700000008000300", @ANYRES32=r2, @ANYBLOB="0800c300741300000800c40001"], 0x30}}, 0x0) executing program 4: r0 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000040), 0xffffffffffffffff) r1 = socket$nl_generic(0x10, 0x3, 0x10) r2 = syz_open_dev$tty1(0xc, 0x4, 0x1) r3 = socket(0x1e, 0x2, 0x0) setsockopt$TIPC_DEST_DROPPABLE(r3, 0x10f, 0x81, &(0x7f0000000480), 0x4) mmap(&(0x7f0000001000/0x1000)=nil, 0x1000, 0x3, 0x32, 0xffffffffffffffff, 0x0) mprotect(&(0x7f0000001000/0x1000)=nil, 0x1000, 0x0) ioctl$sock_SIOCETHTOOL(0xffffffffffffffff, 0x8946, 0x0) recvmmsg(r3, &(0x7f0000003040)=[{{0x0, 0x0, &(0x7f0000000780)=[{&(0x7f0000001e40)=""/174, 0xae}], 0x1, &(0x7f0000001fc0)=""/67, 0x43}, 0x2001}], 0x1, 0x40002122, 0x0) sendmsg$tipc(r3, &(0x7f0000000100)={&(0x7f0000000040)=@nameseq={0x1e, 0x1, 0x0, {0x1, 0x1, 0x4}}, 0x10, 0x0}, 0x4800) ioctl$TCSETS(r2, 0x4b72, &(0x7f0000000140)={0x5, 0x2, 0x0, 0x0, 0x11, "0060930000efa4890200"}) ioctl$sock_SIOCGIFINDEX_80211(r1, 0x8933, &(0x7f0000000100)={'wlan1\x00', 0x0}) sendmsg$NL80211_CMD_VENDOR(r1, &(0x7f0000000000)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f00000003c0)=ANY=[@ANYBLOB='0\x00\x00\x00', @ANYRES16=r0, @ANYBLOB="010200000000000000006700000008000300", @ANYRES32=r4, @ANYBLOB="0800c300741300000800c40001"], 0x30}}, 0x0) r5 = socket$nl_netfilter(0x10, 0x3, 0xc) r6 = socket(0x40000000015, 0x5, 0x0) bind$inet6(r6, &(0x7f0000000140)={0xa, 0x0, 0x0, @loopback}, 0x1c) connect$inet6(r6, &(0x7f0000000000)={0xa, 0x4e21, 0x2, @remote, 0x6}, 0x1c) connect$inet6(r6, &(0x7f0000000100)={0xa, 0x4e23, 0x7, @initdev={0xfe, 0x88, '\x00', 0x0, 0x0}, 0x8}, 0x1c) setsockopt$netlink_NETLINK_PKTINFO(r5, 0x10e, 0x3, &(0x7f0000000000)=0x131e, 0x4) sendmsg$NFT_BATCH(r5, &(0x7f000000c2c0)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000340)=ANY=[@ANYBLOB="140000001000010000000000000000000000000a28000000000a0101000000005e1affd5020000000900010073797a300000000008000240000000032c000000030a01030000e6ff00000000020000000900010073797a30000000000900030073797a320000000014000000110001"], 0x7c}}, 0x0) syz_usb_connect(0x5, 0x36, &(0x7f00000000c0)=ANY=[@ANYBLOB="120100001a77aa4094225b4210a20102030109022400010000000009040000029233500009050602ff030000000905ba3e"], 0x0) executing program 0: r0 = syz_open_dev$loop(&(0x7f0000000240), 0x75f, 0xa8182) r1 = memfd_create(&(0x7f0000000340)='C\x13\xfc2\x95WD\xaa\xba^\x90\xfd\x8d\xc2\xb1[\x81\xda\xda\xd6\x8c\xc99\xec\x0e*||\xe4\xb3\xc4\xb6\v\xaa\x15\x86,\xac\x8d\x89cu\x10\xdc\x93\x9b\xb4\x93\xafE*:\xe4\xdd\xa5\xa75\xb8\x1e;7\xb7.V\xdcrw[\r\x98\x93j\x9c\xf6\xf8\x99\xefF_\xcd\xdf!b\xc5\xec\ntb\xff\b\xaaF?!\x9f\a\x1a\x03\f\xe94\x1deU\x06zS\xc90\xb9voI\xa5/\xb4\xa7@\xa1\\B\xc2@\r_b\x9a\xeb\b\x81\x00V\xd6/N\xc5\xc6f\xb1\x95Z\xe5w^\xd8\xe7J\x80\xf7\xae\xafuv\x84\x9eG\xd1\xe7\x9b\xf0_9\xc2\x9b\xfd\xc3\xf3\xe4\x95P\xf1m\xcf\xc2\xe1\xe6\x1e\xf1\xaf)\x04\xc3\x18)\xa6\x8c\x11\xfb\xb8S\x8b\x92\\\asW-Ee\x02\x00\x00\x00\xd0;Q\xc1~\x89\xec\xc8\x9b\x88\a\xf2\x93\x82(\x8b\x00\xd8\xb4T\x80\x95\x93\x9c5\xcf\t\x04\x00\x00\x00\x00\x00\x00v\xef\xee+\xab\x9c\x00^R\xb2n?i=\xbe\x16\x8a\xbf\xe3\xcdB\xed\xe14\xe8\xd0\xb7\xff\xfeQ\x1c\x85n8\x1b\xc1\b\x00\x00\x00\x00\x00\x00\x00\x17\x94\xdfW\x92z\xbe\xb2R)\xf1K\xd7\xaf\x99\xf6d\xe8\xec\xb7\xbd+T3\xa6\xa9\xfaY-1qs\x82\xefn*\x96\xc9\x1e\xf4\xd1\x02Dt\xc0\x19\xf7\x89\x96.D [F\xeeYW\x95\x13\xc7;\x94\x13^\x13\xaf\xf0C\x9c\xabf\x1daCS2\x02\xb0\xef\xc7\x8c\x9e\xed\a\n0x0}) sendmsg$NL80211_CMD_VENDOR(r1, &(0x7f0000000000)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f00000003c0)=ANY=[@ANYBLOB='0\x00\x00\x00', @ANYRES16=r0, @ANYBLOB="010200000000000000006700000008000300", @ANYRES32=r2, @ANYBLOB="0800c300741300000800c40001"], 0x30}}, 0x0) executing program 4: r0 = openat$nci(0xffffffffffffff9c, &(0x7f0000000080), 0x2, 0x0) r1 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r2 = syz_genetlink_get_family_id$nfc(&(0x7f0000000100), r1) (async) ioctl$IOCTL_GET_NCIDEV_IDX(r0, 0x0, &(0x7f0000000140)=0x0) (async) ioctl$IOCTL_GET_NCIDEV_IDX(r0, 0x0, &(0x7f00000001c0)=0x0) (async) ioctl$IOCTL_GET_NCIDEV_IDX(r0, 0x0, &(0x7f0000000240)=0x0) (async) ioctl$IOCTL_GET_NCIDEV_IDX(r0, 0x0, &(0x7f0000000340)=0x0) ioctl$IOCTL_GET_NCIDEV_IDX(r0, 0x0, &(0x7f0000000380)=0x0) ioctl$IOCTL_GET_NCIDEV_IDX(r0, 0x0, &(0x7f00000003c0)=0x0) ioctl$IOCTL_GET_NCIDEV_IDX(r0, 0x0, &(0x7f0000000400)=0x0) (async) ioctl$IOCTL_GET_NCIDEV_IDX(r0, 0x0, &(0x7f0000000440)=0x0) (async) ioctl$IOCTL_GET_NCIDEV_IDX(0xffffffffffffffff, 0x0, &(0x7f0000000480)=0x0) (async) ioctl$IOCTL_GET_NCIDEV_IDX(r0, 0x0, &(0x7f00000004c0)=0x0) sendmsg$NFC_CMD_DEV_UP(r1, &(0x7f00000005c0)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x400000}, 0xc, &(0x7f0000000580)={&(0x7f0000000500)={0x64, r2, 0x200, 0x70bd29, 0x25dfdbfe, {}, [@NFC_ATTR_DEVICE_INDEX={0x8, 0x1, r3}, @NFC_ATTR_DEVICE_INDEX={0x8, 0x1, r4}, @NFC_ATTR_DEVICE_INDEX={0x8, 0x1, r5}, @NFC_ATTR_DEVICE_INDEX={0x8, 0x1, r6}, @NFC_ATTR_DEVICE_INDEX={0x8, 0x1, r7}, @NFC_ATTR_DEVICE_INDEX={0x8, 0x1, r8}, @NFC_ATTR_DEVICE_INDEX={0x8, 0x1, r9}, @NFC_ATTR_DEVICE_INDEX={0x8, 0x1, r10}, @NFC_ATTR_DEVICE_INDEX={0x8, 0x1, r11}, @NFC_ATTR_DEVICE_INDEX={0x8, 0x1, r12}]}, 0x64}, 0x1, 0x0, 0x0, 0x4008000}, 0x20000040) r13 = syz_genetlink_get_family_id$nfc(&(0x7f0000000040), r1) ioctl$IOCTL_GET_NCIDEV_IDX(r0, 0x0, &(0x7f00000000c0)=0x0) sendmsg$NFC_CMD_DEV_UP(r1, &(0x7f0000000200)={0x0, 0x0, &(0x7f0000000180)={&(0x7f00000002c0)=ANY=[@ANYBLOB="1c000000", @ANYRES16=r13, @ANYBLOB="010026bd7000fcdbdf250200000008000100", @ANYRES32=r14], 0x1c}}, 0x840) (async) unshare(0x2c020400) write$nci(r0, &(0x7f0000000280)=ANY=[@ANYBLOB="400404"], 0x7) write$nci(r0, &(0x7f0000000300)=ANY=[@ANYBLOB="60060202"], 0x8) executing program 4: r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000340), 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) r2 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0) ioctl$KVM_SET_CPUID2(r2, 0x4008ae90, &(0x7f00000000c0)={0x1, 0x0, [{0xa, 0x200, 0x0, 0xfffffff8, 0x95, 0xf, 0x4ca}]}) ioctl$KVM_SET_USER_MEMORY_REGION(r1, 0x4020ae46, &(0x7f0000000400)={0x0, 0x0, 0x0, 0x20002000, &(0x7f0000000000/0x2000)=nil}) ioctl$KVM_REGISTER_COALESCED_MMIO(r1, 0x4010ae67, &(0x7f0000000180)={0x3000, 0x5000, 0x1}) ioctl$KVM_REGISTER_COALESCED_MMIO(r1, 0x4010ae67, &(0x7f0000000080)={0x2, 0x25000, 0x1}) ioctl$KVM_CREATE_IRQCHIP(r1, 0xae60) r3 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x2) ioctl$KVM_RUN(r3, 0xae80, 0x0) ioctl$KVM_RUN(r2, 0xae80, 0x0) program did not crash replaying the whole log did not cause a kernel crash single: executing 1 programs separately with timeout 6m0s testing program (duration=6m0s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): openat$kvm-ioctl$KVM_CREATE_VM-ioctl$KVM_CREATE_VCPU-ioctl$KVM_SET_CPUID2-ioctl$KVM_SET_USER_MEMORY_REGION-ioctl$KVM_REGISTER_COALESCED_MMIO-ioctl$KVM_REGISTER_COALESCED_MMIO-ioctl$KVM_CREATE_IRQCHIP-ioctl$KVM_CREATE_VCPU-ioctl$KVM_RUN-ioctl$KVM_RUN detailed listing: executing program 0: r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000340), 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) r2 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0) ioctl$KVM_SET_CPUID2(r2, 0x4008ae90, &(0x7f00000000c0)={0x1, 0x0, [{0xa, 0x200, 0x0, 0xfffffff8, 0x95, 0xf, 0x4ca}]}) ioctl$KVM_SET_USER_MEMORY_REGION(r1, 0x4020ae46, &(0x7f0000000400)={0x0, 0x0, 0x0, 0x20002000, &(0x7f0000000000/0x2000)=nil}) ioctl$KVM_REGISTER_COALESCED_MMIO(r1, 0x4010ae67, &(0x7f0000000180)={0x3000, 0x5000, 0x1}) ioctl$KVM_REGISTER_COALESCED_MMIO(r1, 0x4010ae67, &(0x7f0000000080)={0x2, 0x25000, 0x1}) ioctl$KVM_CREATE_IRQCHIP(r1, 0xae60) r3 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x2) ioctl$KVM_RUN(r3, 0xae80, 0x0) ioctl$KVM_RUN(r2, 0xae80, 0x0) program crashed: WARNING in kvm_put_kvm single: successfully extracted reproducer found reproducer with 11 syscalls minimizing guilty program testing program (duration=6m31.783985958s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): openat$kvm-ioctl$KVM_CREATE_VM-ioctl$KVM_CREATE_VCPU-ioctl$KVM_SET_CPUID2-ioctl$KVM_SET_USER_MEMORY_REGION-ioctl$KVM_REGISTER_COALESCED_MMIO-ioctl$KVM_REGISTER_COALESCED_MMIO-ioctl$KVM_CREATE_IRQCHIP-ioctl$KVM_CREATE_VCPU-ioctl$KVM_RUN detailed listing: executing program 0: r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000340), 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) r2 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0) ioctl$KVM_SET_CPUID2(r2, 0x4008ae90, &(0x7f00000000c0)={0x1, 0x0, [{0xa, 0x200, 0x0, 0xfffffff8, 0x95, 0xf, 0x4ca}]}) ioctl$KVM_SET_USER_MEMORY_REGION(r1, 0x4020ae46, &(0x7f0000000400)={0x0, 0x0, 0x0, 0x20002000, &(0x7f0000000000/0x2000)=nil}) ioctl$KVM_REGISTER_COALESCED_MMIO(r1, 0x4010ae67, &(0x7f0000000180)={0x3000, 0x5000, 0x1}) ioctl$KVM_REGISTER_COALESCED_MMIO(r1, 0x4010ae67, &(0x7f0000000080)={0x2, 0x25000, 0x1}) ioctl$KVM_CREATE_IRQCHIP(r1, 0xae60) r3 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x2) ioctl$KVM_RUN(r3, 0xae80, 0x0) program did not crash testing program (duration=6m31.783985958s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): openat$kvm-ioctl$KVM_CREATE_VM-ioctl$KVM_CREATE_VCPU-ioctl$KVM_SET_CPUID2-ioctl$KVM_SET_USER_MEMORY_REGION-ioctl$KVM_REGISTER_COALESCED_MMIO-ioctl$KVM_REGISTER_COALESCED_MMIO-ioctl$KVM_CREATE_IRQCHIP-ioctl$KVM_CREATE_VCPU-ioctl$KVM_RUN detailed listing: executing program 0: r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000340), 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) r2 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0) ioctl$KVM_SET_CPUID2(r2, 0x4008ae90, &(0x7f00000000c0)={0x1, 0x0, [{0xa, 0x200, 0x0, 0xfffffff8, 0x95, 0xf, 0x4ca}]}) ioctl$KVM_SET_USER_MEMORY_REGION(r1, 0x4020ae46, &(0x7f0000000400)={0x0, 0x0, 0x0, 0x20002000, &(0x7f0000000000/0x2000)=nil}) ioctl$KVM_REGISTER_COALESCED_MMIO(r1, 0x4010ae67, &(0x7f0000000180)={0x3000, 0x5000, 0x1}) ioctl$KVM_REGISTER_COALESCED_MMIO(r1, 0x4010ae67, &(0x7f0000000080)={0x2, 0x25000, 0x1}) ioctl$KVM_CREATE_IRQCHIP(r1, 0xae60) ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x2) ioctl$KVM_RUN(r2, 0xae80, 0x0) program crashed: WARNING in kvm_put_kvm testing program (duration=6m31.783985958s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): openat$kvm-ioctl$KVM_CREATE_VM-ioctl$KVM_CREATE_VCPU-ioctl$KVM_SET_CPUID2-ioctl$KVM_SET_USER_MEMORY_REGION-ioctl$KVM_REGISTER_COALESCED_MMIO-ioctl$KVM_REGISTER_COALESCED_MMIO-ioctl$KVM_CREATE_IRQCHIP-ioctl$KVM_RUN detailed listing: executing program 0: r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000340), 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) r2 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0) ioctl$KVM_SET_CPUID2(r2, 0x4008ae90, &(0x7f00000000c0)={0x1, 0x0, [{0xa, 0x200, 0x0, 0xfffffff8, 0x95, 0xf, 0x4ca}]}) ioctl$KVM_SET_USER_MEMORY_REGION(r1, 0x4020ae46, &(0x7f0000000400)={0x0, 0x0, 0x0, 0x20002000, &(0x7f0000000000/0x2000)=nil}) ioctl$KVM_REGISTER_COALESCED_MMIO(r1, 0x4010ae67, &(0x7f0000000180)={0x3000, 0x5000, 0x1}) ioctl$KVM_REGISTER_COALESCED_MMIO(r1, 0x4010ae67, &(0x7f0000000080)={0x2, 0x25000, 0x1}) ioctl$KVM_CREATE_IRQCHIP(r1, 0xae60) ioctl$KVM_RUN(r2, 0xae80, 0x0) program crashed: WARNING in kvm_put_kvm testing program (duration=6m31.783985958s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): openat$kvm-ioctl$KVM_CREATE_VM-ioctl$KVM_CREATE_VCPU-ioctl$KVM_SET_CPUID2-ioctl$KVM_SET_USER_MEMORY_REGION-ioctl$KVM_REGISTER_COALESCED_MMIO-ioctl$KVM_REGISTER_COALESCED_MMIO-ioctl$KVM_RUN detailed listing: executing program 0: r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000340), 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) r2 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0) ioctl$KVM_SET_CPUID2(r2, 0x4008ae90, &(0x7f00000000c0)={0x1, 0x0, [{0xa, 0x200, 0x0, 0xfffffff8, 0x95, 0xf, 0x4ca}]}) ioctl$KVM_SET_USER_MEMORY_REGION(r1, 0x4020ae46, &(0x7f0000000400)={0x0, 0x0, 0x0, 0x20002000, &(0x7f0000000000/0x2000)=nil}) ioctl$KVM_REGISTER_COALESCED_MMIO(r1, 0x4010ae67, &(0x7f0000000180)={0x3000, 0x5000, 0x1}) ioctl$KVM_REGISTER_COALESCED_MMIO(r1, 0x4010ae67, &(0x7f0000000080)={0x2, 0x25000, 0x1}) ioctl$KVM_RUN(r2, 0xae80, 0x0) program did not crash testing program (duration=6m31.783985958s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): openat$kvm-ioctl$KVM_CREATE_VM-ioctl$KVM_CREATE_VCPU-ioctl$KVM_SET_CPUID2-ioctl$KVM_SET_USER_MEMORY_REGION-ioctl$KVM_REGISTER_COALESCED_MMIO-ioctl$KVM_CREATE_IRQCHIP-ioctl$KVM_RUN detailed listing: executing program 0: r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000340), 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) r2 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0) ioctl$KVM_SET_CPUID2(r2, 0x4008ae90, &(0x7f00000000c0)={0x1, 0x0, [{0xa, 0x200, 0x0, 0xfffffff8, 0x95, 0xf, 0x4ca}]}) ioctl$KVM_SET_USER_MEMORY_REGION(r1, 0x4020ae46, &(0x7f0000000400)={0x0, 0x0, 0x0, 0x20002000, &(0x7f0000000000/0x2000)=nil}) ioctl$KVM_REGISTER_COALESCED_MMIO(r1, 0x4010ae67, &(0x7f0000000180)={0x3000, 0x5000, 0x1}) ioctl$KVM_CREATE_IRQCHIP(r1, 0xae60) ioctl$KVM_RUN(r2, 0xae80, 0x0) program crashed: lost connection to test machine suppressed program crash: lost connection to test machine testing program (duration=6m31.783985958s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): openat$kvm-ioctl$KVM_CREATE_VM-ioctl$KVM_CREATE_VCPU-ioctl$KVM_SET_CPUID2-ioctl$KVM_SET_USER_MEMORY_REGION-ioctl$KVM_REGISTER_COALESCED_MMIO-ioctl$KVM_CREATE_IRQCHIP-ioctl$KVM_RUN detailed listing: executing program 0: r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000340), 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) r2 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0) ioctl$KVM_SET_CPUID2(r2, 0x4008ae90, &(0x7f00000000c0)={0x1, 0x0, [{0xa, 0x200, 0x0, 0xfffffff8, 0x95, 0xf, 0x4ca}]}) ioctl$KVM_SET_USER_MEMORY_REGION(r1, 0x4020ae46, &(0x7f0000000400)={0x0, 0x0, 0x0, 0x20002000, &(0x7f0000000000/0x2000)=nil}) ioctl$KVM_REGISTER_COALESCED_MMIO(r1, 0x4010ae67, &(0x7f0000000080)={0x2, 0x25000, 0x1}) ioctl$KVM_CREATE_IRQCHIP(r1, 0xae60) ioctl$KVM_RUN(r2, 0xae80, 0x0) program did not crash testing program (duration=6m31.783985958s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): openat$kvm-ioctl$KVM_CREATE_VM-ioctl$KVM_CREATE_VCPU-ioctl$KVM_SET_CPUID2-ioctl$KVM_REGISTER_COALESCED_MMIO-ioctl$KVM_REGISTER_COALESCED_MMIO-ioctl$KVM_CREATE_IRQCHIP-ioctl$KVM_RUN detailed listing: executing program 0: r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000340), 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) r2 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0) ioctl$KVM_SET_CPUID2(r2, 0x4008ae90, &(0x7f00000000c0)={0x1, 0x0, [{0xa, 0x200, 0x0, 0xfffffff8, 0x95, 0xf, 0x4ca}]}) ioctl$KVM_REGISTER_COALESCED_MMIO(r1, 0x4010ae67, &(0x7f0000000180)={0x3000, 0x5000, 0x1}) ioctl$KVM_REGISTER_COALESCED_MMIO(r1, 0x4010ae67, &(0x7f0000000080)={0x2, 0x25000, 0x1}) ioctl$KVM_CREATE_IRQCHIP(r1, 0xae60) ioctl$KVM_RUN(r2, 0xae80, 0x0) program crashed: WARNING in kvm_put_kvm testing program (duration=6m31.783985958s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): openat$kvm-ioctl$KVM_CREATE_VM-ioctl$KVM_CREATE_VCPU-ioctl$KVM_REGISTER_COALESCED_MMIO-ioctl$KVM_REGISTER_COALESCED_MMIO-ioctl$KVM_CREATE_IRQCHIP-ioctl$KVM_RUN detailed listing: executing program 0: r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000340), 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) r2 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0) ioctl$KVM_REGISTER_COALESCED_MMIO(r1, 0x4010ae67, &(0x7f0000000180)={0x3000, 0x5000, 0x1}) ioctl$KVM_REGISTER_COALESCED_MMIO(r1, 0x4010ae67, &(0x7f0000000080)={0x2, 0x25000, 0x1}) ioctl$KVM_CREATE_IRQCHIP(r1, 0xae60) ioctl$KVM_RUN(r2, 0xae80, 0x0) program did not crash testing program (duration=6m31.783985958s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): openat$kvm-ioctl$KVM_CREATE_VM-ioctl$KVM_SET_CPUID2-ioctl$KVM_REGISTER_COALESCED_MMIO-ioctl$KVM_REGISTER_COALESCED_MMIO-ioctl$KVM_CREATE_IRQCHIP-ioctl$KVM_RUN detailed listing: executing program 0: r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000340), 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) ioctl$KVM_SET_CPUID2(0xffffffffffffffff, 0x4008ae90, &(0x7f00000000c0)={0x1, 0x0, [{0xa, 0x200, 0x0, 0xfffffff8, 0x95, 0xf, 0x4ca}]}) ioctl$KVM_REGISTER_COALESCED_MMIO(r1, 0x4010ae67, &(0x7f0000000180)={0x3000, 0x5000, 0x1}) ioctl$KVM_REGISTER_COALESCED_MMIO(r1, 0x4010ae67, &(0x7f0000000080)={0x2, 0x25000, 0x1}) ioctl$KVM_CREATE_IRQCHIP(r1, 0xae60) ioctl$KVM_RUN(0xffffffffffffffff, 0xae80, 0x0) program did not crash testing program (duration=6m31.783985958s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): openat$kvm-ioctl$KVM_CREATE_VCPU-ioctl$KVM_SET_CPUID2-ioctl$KVM_REGISTER_COALESCED_MMIO-ioctl$KVM_REGISTER_COALESCED_MMIO-ioctl$KVM_CREATE_IRQCHIP-ioctl$KVM_RUN detailed listing: executing program 0: openat$kvm(0xffffffffffffff9c, &(0x7f0000000340), 0x0, 0x0) r0 = ioctl$KVM_CREATE_VCPU(0xffffffffffffffff, 0xae41, 0x0) ioctl$KVM_SET_CPUID2(r0, 0x4008ae90, &(0x7f00000000c0)={0x1, 0x0, [{0xa, 0x200, 0x0, 0xfffffff8, 0x95, 0xf, 0x4ca}]}) ioctl$KVM_REGISTER_COALESCED_MMIO(0xffffffffffffffff, 0x4010ae67, &(0x7f0000000180)={0x3000, 0x5000, 0x1}) ioctl$KVM_REGISTER_COALESCED_MMIO(0xffffffffffffffff, 0x4010ae67, &(0x7f0000000080)={0x2, 0x25000, 0x1}) ioctl$KVM_CREATE_IRQCHIP(0xffffffffffffffff, 0xae60) ioctl$KVM_RUN(r0, 0xae80, 0x0) program did not crash testing program (duration=6m31.783985958s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): ioctl$KVM_CREATE_VM-ioctl$KVM_CREATE_VCPU-ioctl$KVM_SET_CPUID2-ioctl$KVM_REGISTER_COALESCED_MMIO-ioctl$KVM_REGISTER_COALESCED_MMIO-ioctl$KVM_CREATE_IRQCHIP-ioctl$KVM_RUN detailed listing: executing program 0: r0 = ioctl$KVM_CREATE_VM(0xffffffffffffffff, 0xae01, 0x0) r1 = ioctl$KVM_CREATE_VCPU(r0, 0xae41, 0x0) ioctl$KVM_SET_CPUID2(r1, 0x4008ae90, &(0x7f00000000c0)={0x1, 0x0, [{0xa, 0x200, 0x0, 0xfffffff8, 0x95, 0xf, 0x4ca}]}) ioctl$KVM_REGISTER_COALESCED_MMIO(r0, 0x4010ae67, &(0x7f0000000180)={0x3000, 0x5000, 0x1}) ioctl$KVM_REGISTER_COALESCED_MMIO(r0, 0x4010ae67, &(0x7f0000000080)={0x2, 0x25000, 0x1}) ioctl$KVM_CREATE_IRQCHIP(r0, 0xae60) ioctl$KVM_RUN(r1, 0xae80, 0x0) program did not crash testing program (duration=6m31.783985958s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): openat$kvm-ioctl$KVM_CREATE_VM-ioctl$KVM_CREATE_VCPU-ioctl$KVM_SET_CPUID2-ioctl$KVM_REGISTER_COALESCED_MMIO-ioctl$KVM_REGISTER_COALESCED_MMIO-ioctl$KVM_CREATE_IRQCHIP-ioctl$KVM_RUN detailed listing: executing program 0: r0 = openat$kvm(0xffffffffffffff9c, 0x0, 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) r2 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0) ioctl$KVM_SET_CPUID2(r2, 0x4008ae90, &(0x7f00000000c0)={0x1, 0x0, [{0xa, 0x200, 0x0, 0xfffffff8, 0x95, 0xf, 0x4ca}]}) ioctl$KVM_REGISTER_COALESCED_MMIO(r1, 0x4010ae67, &(0x7f0000000180)={0x3000, 0x5000, 0x1}) ioctl$KVM_REGISTER_COALESCED_MMIO(r1, 0x4010ae67, &(0x7f0000000080)={0x2, 0x25000, 0x1}) ioctl$KVM_CREATE_IRQCHIP(r1, 0xae60) ioctl$KVM_RUN(r2, 0xae80, 0x0) program did not crash testing program (duration=6m31.783985958s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): openat$kvm-ioctl$KVM_CREATE_VM-ioctl$KVM_CREATE_VCPU-ioctl$KVM_SET_CPUID2-ioctl$KVM_REGISTER_COALESCED_MMIO-ioctl$KVM_REGISTER_COALESCED_MMIO-ioctl$KVM_CREATE_IRQCHIP-ioctl$KVM_RUN detailed listing: executing program 0: r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000340), 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) r2 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0) ioctl$KVM_SET_CPUID2(r2, 0x4008ae90, 0x0) ioctl$KVM_REGISTER_COALESCED_MMIO(r1, 0x4010ae67, &(0x7f0000000180)={0x3000, 0x5000, 0x1}) ioctl$KVM_REGISTER_COALESCED_MMIO(r1, 0x4010ae67, &(0x7f0000000080)={0x2, 0x25000, 0x1}) ioctl$KVM_CREATE_IRQCHIP(r1, 0xae60) ioctl$KVM_RUN(r2, 0xae80, 0x0) program crashed: WARNING in kvm_put_kvm testing program (duration=6m31.783985958s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): openat$kvm-ioctl$KVM_CREATE_VM-ioctl$KVM_CREATE_VCPU-ioctl$KVM_SET_CPUID2-ioctl$KVM_REGISTER_COALESCED_MMIO-ioctl$KVM_REGISTER_COALESCED_MMIO-ioctl$KVM_CREATE_IRQCHIP-ioctl$KVM_RUN detailed listing: executing program 0: r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000340), 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) r2 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0) ioctl$KVM_SET_CPUID2(r2, 0x4008ae90, 0x0) ioctl$KVM_REGISTER_COALESCED_MMIO(r1, 0x4010ae67, 0x0) ioctl$KVM_REGISTER_COALESCED_MMIO(r1, 0x4010ae67, &(0x7f0000000080)={0x2, 0x25000, 0x1}) ioctl$KVM_CREATE_IRQCHIP(r1, 0xae60) ioctl$KVM_RUN(r2, 0xae80, 0x0) program did not crash testing program (duration=6m31.783985958s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): openat$kvm-ioctl$KVM_CREATE_VM-ioctl$KVM_CREATE_VCPU-ioctl$KVM_SET_CPUID2-ioctl$KVM_REGISTER_COALESCED_MMIO-ioctl$KVM_REGISTER_COALESCED_MMIO-ioctl$KVM_CREATE_IRQCHIP-ioctl$KVM_RUN detailed listing: executing program 0: r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000340), 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) r2 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0) ioctl$KVM_SET_CPUID2(r2, 0x4008ae90, 0x0) ioctl$KVM_REGISTER_COALESCED_MMIO(r1, 0x4010ae67, &(0x7f0000000180)={0x3000, 0x5000, 0x1}) ioctl$KVM_REGISTER_COALESCED_MMIO(r1, 0x4010ae67, 0x0) ioctl$KVM_CREATE_IRQCHIP(r1, 0xae60) ioctl$KVM_RUN(r2, 0xae80, 0x0) program did not crash extracting C reproducer testing compiled C program (duration=6m31.783985958s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): openat$kvm-ioctl$KVM_CREATE_VM-ioctl$KVM_CREATE_VCPU-ioctl$KVM_SET_CPUID2-ioctl$KVM_REGISTER_COALESCED_MMIO-ioctl$KVM_REGISTER_COALESCED_MMIO-ioctl$KVM_CREATE_IRQCHIP-ioctl$KVM_RUN program did not crash simplifying guilty program options testing program (duration=6m31.783985958s, {Threaded:false Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): openat$kvm-ioctl$KVM_CREATE_VM-ioctl$KVM_CREATE_VCPU-ioctl$KVM_SET_CPUID2-ioctl$KVM_REGISTER_COALESCED_MMIO-ioctl$KVM_REGISTER_COALESCED_MMIO-ioctl$KVM_CREATE_IRQCHIP-ioctl$KVM_RUN detailed listing: executing program 0: r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000340), 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) r2 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0) ioctl$KVM_SET_CPUID2(r2, 0x4008ae90, 0x0) ioctl$KVM_REGISTER_COALESCED_MMIO(r1, 0x4010ae67, &(0x7f0000000180)={0x3000, 0x5000, 0x1}) ioctl$KVM_REGISTER_COALESCED_MMIO(r1, 0x4010ae67, &(0x7f0000000080)={0x2, 0x25000, 0x1}) ioctl$KVM_CREATE_IRQCHIP(r1, 0xae60) ioctl$KVM_RUN(r2, 0xae80, 0x0) program did not crash testing program (duration=6m31.783985958s, {Threaded:true Repeat:true RepeatTimes:0 Procs:1 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): openat$kvm-ioctl$KVM_CREATE_VM-ioctl$KVM_CREATE_VCPU-ioctl$KVM_SET_CPUID2-ioctl$KVM_REGISTER_COALESCED_MMIO-ioctl$KVM_REGISTER_COALESCED_MMIO-ioctl$KVM_CREATE_IRQCHIP-ioctl$KVM_RUN detailed listing: executing program 0: r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000340), 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) r2 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0) ioctl$KVM_SET_CPUID2(r2, 0x4008ae90, 0x0) ioctl$KVM_REGISTER_COALESCED_MMIO(r1, 0x4010ae67, &(0x7f0000000180)={0x3000, 0x5000, 0x1}) ioctl$KVM_REGISTER_COALESCED_MMIO(r1, 0x4010ae67, &(0x7f0000000080)={0x2, 0x25000, 0x1}) ioctl$KVM_CREATE_IRQCHIP(r1, 0xae60) ioctl$KVM_RUN(r2, 0xae80, 0x0) program did not crash testing program (duration=6m31.783985958s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): openat$kvm-ioctl$KVM_CREATE_VM-ioctl$KVM_CREATE_VCPU-ioctl$KVM_SET_CPUID2-ioctl$KVM_REGISTER_COALESCED_MMIO-ioctl$KVM_REGISTER_COALESCED_MMIO-ioctl$KVM_CREATE_IRQCHIP-ioctl$KVM_RUN detailed listing: executing program 0: r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000340), 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) r2 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0) ioctl$KVM_SET_CPUID2(r2, 0x4008ae90, 0x0) ioctl$KVM_REGISTER_COALESCED_MMIO(r1, 0x4010ae67, &(0x7f0000000180)={0x3000, 0x5000, 0x1}) ioctl$KVM_REGISTER_COALESCED_MMIO(r1, 0x4010ae67, &(0x7f0000000080)={0x2, 0x25000, 0x1}) ioctl$KVM_CREATE_IRQCHIP(r1, 0xae60) ioctl$KVM_RUN(r2, 0xae80, 0x0) program did not crash validation run: crashed=false testing program (duration=6m31.783985958s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): openat$kvm-ioctl$KVM_CREATE_VM-ioctl$KVM_CREATE_VCPU-ioctl$KVM_SET_CPUID2-ioctl$KVM_REGISTER_COALESCED_MMIO-ioctl$KVM_REGISTER_COALESCED_MMIO-ioctl$KVM_CREATE_IRQCHIP-ioctl$KVM_RUN detailed listing: executing program 0: r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000340), 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) r2 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0) ioctl$KVM_SET_CPUID2(r2, 0x4008ae90, 0x0) ioctl$KVM_REGISTER_COALESCED_MMIO(r1, 0x4010ae67, &(0x7f0000000180)={0x3000, 0x5000, 0x1}) ioctl$KVM_REGISTER_COALESCED_MMIO(r1, 0x4010ae67, &(0x7f0000000080)={0x2, 0x25000, 0x1}) ioctl$KVM_CREATE_IRQCHIP(r1, 0xae60) ioctl$KVM_RUN(r2, 0xae80, 0x0) program did not crash validation run: crashed=false testing program (duration=6m31.783985958s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): openat$kvm-ioctl$KVM_CREATE_VM-ioctl$KVM_CREATE_VCPU-ioctl$KVM_SET_CPUID2-ioctl$KVM_REGISTER_COALESCED_MMIO-ioctl$KVM_REGISTER_COALESCED_MMIO-ioctl$KVM_CREATE_IRQCHIP-ioctl$KVM_RUN detailed listing: executing program 0: r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000340), 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) r2 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0) ioctl$KVM_SET_CPUID2(r2, 0x4008ae90, 0x0) ioctl$KVM_REGISTER_COALESCED_MMIO(r1, 0x4010ae67, &(0x7f0000000180)={0x3000, 0x5000, 0x1}) ioctl$KVM_REGISTER_COALESCED_MMIO(r1, 0x4010ae67, &(0x7f0000000080)={0x2, 0x25000, 0x1}) ioctl$KVM_CREATE_IRQCHIP(r1, 0xae60) ioctl$KVM_RUN(r2, 0xae80, 0x0) program did not crash validation run: crashed=false testing program (duration=6m31.783985958s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): openat$kvm-ioctl$KVM_CREATE_VM-ioctl$KVM_CREATE_VCPU-ioctl$KVM_SET_CPUID2-ioctl$KVM_REGISTER_COALESCED_MMIO-ioctl$KVM_REGISTER_COALESCED_MMIO-ioctl$KVM_CREATE_IRQCHIP-ioctl$KVM_RUN detailed listing: executing program 0: r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000340), 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) r2 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0) ioctl$KVM_SET_CPUID2(r2, 0x4008ae90, 0x0) ioctl$KVM_REGISTER_COALESCED_MMIO(r1, 0x4010ae67, &(0x7f0000000180)={0x3000, 0x5000, 0x1}) ioctl$KVM_REGISTER_COALESCED_MMIO(r1, 0x4010ae67, &(0x7f0000000080)={0x2, 0x25000, 0x1}) ioctl$KVM_CREATE_IRQCHIP(r1, 0xae60) ioctl$KVM_RUN(r2, 0xae80, 0x0) program did not crash validation run: crashed=false testing program (duration=6m31.783985958s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): openat$kvm-ioctl$KVM_CREATE_VM-ioctl$KVM_CREATE_VCPU-ioctl$KVM_SET_CPUID2-ioctl$KVM_REGISTER_COALESCED_MMIO-ioctl$KVM_REGISTER_COALESCED_MMIO-ioctl$KVM_CREATE_IRQCHIP-ioctl$KVM_RUN detailed listing: executing program 0: r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000340), 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) r2 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0) ioctl$KVM_SET_CPUID2(r2, 0x4008ae90, 0x0) ioctl$KVM_REGISTER_COALESCED_MMIO(r1, 0x4010ae67, &(0x7f0000000180)={0x3000, 0x5000, 0x1}) ioctl$KVM_REGISTER_COALESCED_MMIO(r1, 0x4010ae67, &(0x7f0000000080)={0x2, 0x25000, 0x1}) ioctl$KVM_CREATE_IRQCHIP(r1, 0xae60) ioctl$KVM_RUN(r2, 0xae80, 0x0) program crashed: WARNING in kvm_put_kvm validation run: crashed=true testing program (duration=6m31.783985958s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): openat$kvm-ioctl$KVM_CREATE_VM-ioctl$KVM_CREATE_VCPU-ioctl$KVM_SET_CPUID2-ioctl$KVM_REGISTER_COALESCED_MMIO-ioctl$KVM_REGISTER_COALESCED_MMIO-ioctl$KVM_CREATE_IRQCHIP-ioctl$KVM_RUN detailed listing: executing program 0: r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000340), 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) r2 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0) ioctl$KVM_SET_CPUID2(r2, 0x4008ae90, 0x0) ioctl$KVM_REGISTER_COALESCED_MMIO(r1, 0x4010ae67, &(0x7f0000000180)={0x3000, 0x5000, 0x1}) ioctl$KVM_REGISTER_COALESCED_MMIO(r1, 0x4010ae67, &(0x7f0000000080)={0x2, 0x25000, 0x1}) ioctl$KVM_CREATE_IRQCHIP(r1, 0xae60) ioctl$KVM_RUN(r2, 0xae80, 0x0) program crashed: WARNING in kvm_put_kvm validation run: crashed=true testing program (duration=6m31.783985958s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): openat$kvm-ioctl$KVM_CREATE_VM-ioctl$KVM_CREATE_VCPU-ioctl$KVM_SET_CPUID2-ioctl$KVM_REGISTER_COALESCED_MMIO-ioctl$KVM_REGISTER_COALESCED_MMIO-ioctl$KVM_CREATE_IRQCHIP-ioctl$KVM_RUN detailed listing: executing program 0: r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000340), 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) r2 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0) ioctl$KVM_SET_CPUID2(r2, 0x4008ae90, 0x0) ioctl$KVM_REGISTER_COALESCED_MMIO(r1, 0x4010ae67, &(0x7f0000000180)={0x3000, 0x5000, 0x1}) ioctl$KVM_REGISTER_COALESCED_MMIO(r1, 0x4010ae67, &(0x7f0000000080)={0x2, 0x25000, 0x1}) ioctl$KVM_CREATE_IRQCHIP(r1, 0xae60) ioctl$KVM_RUN(r2, 0xae80, 0x0) program crashed: WARNING in kvm_put_kvm validation run: crashed=true reproducing took 2h27m59.879759884s repro crashed as (corrupted=false): ------------[ cut here ]------------ timer_delete_sync(&sdp->delay_work) && rcu_segcblist_n_cbs(&sdp->srcu_cblist) WARNING: kernel/rcu/srcutree.c:707 at cleanup_srcu_struct+0x3d6/0x8b0 kernel/rcu/srcutree.c:706, CPU#0: syz.0.2032/12033 Modules linked in: CPU: 0 UID: 0 PID: 12033 Comm: syz.0.2032 Not tainted syzkaller #0 PREEMPT(full) Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 RIP: 0010:cleanup_srcu_struct+0x3d6/0x8b0 kernel/rcu/srcutree.c:706 Code: c0 8b 00 48 83 7d 00 00 4c 8b 74 24 10 0f 85 dd 03 00 00 41 ff c5 41 83 e5 0f 41 83 fd 07 0f 86 e2 fe ff ff e9 ab 00 00 00 90 <0f> 0b 90 4c 8d b5 00 02 00 00 4c 89 f3 48 c1 eb 03 48 b8 00 00 00 RSP: 0018:ffffc9000434fc50 EFLAGS: 00010206 RAX: 1ffffd1ffff8977d RBX: 0000607edb3c1b00 RCX: dffffc0000000000 RDX: 0000000000000001 RSI: ffffffff8e5877bc RDI: 00000000ffffffff RBP: ffffe8ffffc4bb00 R08: ffffffff909ba47f R09: 1ffffffff213748f R10: dffffc0000000000 R11: fffffbfff2137490 R12: ffff888029fa9800 R13: 0000000000000000 R14: ffffe8ffffc4bbe8 R15: 1ffffffff1d0b5de FS: 0000555560c0b500(0000) GS:ffff88812488a000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: 00007fffe2079fd0 CR3: 000000007d666000 CR4: 00000000003526f0 Call Trace: kvm_destroy_vm virt/kvm/kvm_main.c:1303 [inline] kvm_put_kvm+0x9cb/0xb50 virt/kvm/kvm_main.c:1332 kvm_vm_release+0x43/0x50 virt/kvm/kvm_main.c:1355 __fput+0x418/0xa50 fs/file_table.c:512 task_work_run+0x1d9/0x270 kernel/task_work.c:233 resume_user_mode_work include/linux/resume_user_mode.h:50 [inline] __exit_to_user_mode_loop kernel/entry/common.c:70 [inline] exit_to_user_mode_loop+0x204/0x770 kernel/entry/common.c:101 __exit_to_user_mode_prepare include/linux/irq-entry-common.h:207 [inline] syscall_exit_to_user_mode_prepare include/linux/irq-entry-common.h:230 [inline] syscall_exit_to_user_mode include/linux/entry-common.h:336 [inline] do_syscall_64+0x328/0x520 arch/x86/entry/syscall_64.c:89 entry_SYSCALL_64_after_hwframe+0x77/0x7f RIP: 0033:0x7fabdcf9e0d9 Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 RSP: 002b:00007ffd8ea1aec8 EFLAGS: 00000246 ORIG_RAX: 00000000000001b4 RAX: 0000000000000000 RBX: 00007ffd8ea1afb0 RCX: 00007fabdcf9e0d9 RDX: 0000000000000000 RSI: 000000000000001e RDI: 0000000000000003 RBP: 0000000000041a08 R08: 0000000000000001 R09: 0000000000000000 R10: 0000001b2cb20000 R11: 0000000000000246 R12: 00007ffd8ea1aff0 R13: 00007fabdd225fac R14: 0000000000041a47 R15: 00007fabdd225fa0 final repro crashed as (corrupted=false): ------------[ cut here ]------------ timer_delete_sync(&sdp->delay_work) && rcu_segcblist_n_cbs(&sdp->srcu_cblist) WARNING: kernel/rcu/srcutree.c:707 at cleanup_srcu_struct+0x3d6/0x8b0 kernel/rcu/srcutree.c:706, CPU#0: syz.0.2032/12033 Modules linked in: CPU: 0 UID: 0 PID: 12033 Comm: syz.0.2032 Not tainted syzkaller #0 PREEMPT(full) Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 RIP: 0010:cleanup_srcu_struct+0x3d6/0x8b0 kernel/rcu/srcutree.c:706 Code: c0 8b 00 48 83 7d 00 00 4c 8b 74 24 10 0f 85 dd 03 00 00 41 ff c5 41 83 e5 0f 41 83 fd 07 0f 86 e2 fe ff ff e9 ab 00 00 00 90 <0f> 0b 90 4c 8d b5 00 02 00 00 4c 89 f3 48 c1 eb 03 48 b8 00 00 00 RSP: 0018:ffffc9000434fc50 EFLAGS: 00010206 RAX: 1ffffd1ffff8977d RBX: 0000607edb3c1b00 RCX: dffffc0000000000 RDX: 0000000000000001 RSI: ffffffff8e5877bc RDI: 00000000ffffffff RBP: ffffe8ffffc4bb00 R08: ffffffff909ba47f R09: 1ffffffff213748f R10: dffffc0000000000 R11: fffffbfff2137490 R12: ffff888029fa9800 R13: 0000000000000000 R14: ffffe8ffffc4bbe8 R15: 1ffffffff1d0b5de FS: 0000555560c0b500(0000) GS:ffff88812488a000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: 00007fffe2079fd0 CR3: 000000007d666000 CR4: 00000000003526f0 Call Trace: kvm_destroy_vm virt/kvm/kvm_main.c:1303 [inline] kvm_put_kvm+0x9cb/0xb50 virt/kvm/kvm_main.c:1332 kvm_vm_release+0x43/0x50 virt/kvm/kvm_main.c:1355 __fput+0x418/0xa50 fs/file_table.c:512 task_work_run+0x1d9/0x270 kernel/task_work.c:233 resume_user_mode_work include/linux/resume_user_mode.h:50 [inline] __exit_to_user_mode_loop kernel/entry/common.c:70 [inline] exit_to_user_mode_loop+0x204/0x770 kernel/entry/common.c:101 __exit_to_user_mode_prepare include/linux/irq-entry-common.h:207 [inline] syscall_exit_to_user_mode_prepare include/linux/irq-entry-common.h:230 [inline] syscall_exit_to_user_mode include/linux/entry-common.h:336 [inline] do_syscall_64+0x328/0x520 arch/x86/entry/syscall_64.c:89 entry_SYSCALL_64_after_hwframe+0x77/0x7f RIP: 0033:0x7fabdcf9e0d9 Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 RSP: 002b:00007ffd8ea1aec8 EFLAGS: 00000246 ORIG_RAX: 00000000000001b4 RAX: 0000000000000000 RBX: 00007ffd8ea1afb0 RCX: 00007fabdcf9e0d9 RDX: 0000000000000000 RSI: 000000000000001e RDI: 0000000000000003 RBP: 0000000000041a08 R08: 0000000000000001 R09: 0000000000000000 R10: 0000001b2cb20000 R11: 0000000000000246 R12: 00007ffd8ea1aff0 R13: 00007fabdd225fac R14: 0000000000041a47 R15: 00007fabdd225fa0