Extracting prog: 7m57.686550516s Minimizing prog: 1h7m19.241020909s Simplifying prog options: 10m36.956271219s Extracting C: 2m0.003499489s Simplifying C: 0s extracting reproducer from 30 programs first checking the prog from the crash report single: executing 1 programs separately with timeout 30s testing program (duration=30s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): openat-bpf$MAP_CREATE_RINGBUF-bpf$BPF_PROG_RAW_TRACEPOINT_LOAD-close_range-mkdirat-mount-openat-write-syz_open_dev$mtd-socket$nl_generic-openat$cgroup_ro-close-socketpair$nbd-socket$nl_generic-sendmsg$nl_generic-bpf$MAP_CREATE-bpf$MAP_UPDATE_ELEM_TAIL_CALL-syz_genetlink_get_family_id$mptcp-sendmsg$MPTCP_PM_CMD_ADD_ADDR-ioctl$BLKPG-io_setup-syz_open_procfs-pread64-mkdirat-mount-openat-socket$netlink-sendmsg$netlink-io_submit detailed listing: executing program 0: r0 = openat(0xffffffffffffff9c, &(0x7f0000000000)='./file2\x00', 0x1c9442, 0x19c) r1 = bpf$MAP_CREATE_RINGBUF(0x0, &(0x7f0000000140)=ANY=[@ANYBLOB="1b0000000000000000000000000004"], 0x50) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000001380)={0x11, 0xf, &(0x7f0000001440)=@ringbuf={{0x18, 0x0, 0x0, 0x0, 0x8d, 0x0, 0x0, 0x0, 0xec5}, {{0x18, 0x1, 0x1, 0x0, r1}, {}, {0x7, 0x0, 0xb, 0x3, 0x0, 0x0, 0xfeff}, {0x85, 0x0, 0x0, 0x86}, {0x7, 0x1, 0xb, 0x9, 0x0, 0x20}}, {{0x5, 0x0, 0x5, 0x9, 0x0, 0x1, 0xffffffff}}, [], {{}, {0x7, 0x0, 0xb, 0x2, 0x0, 0x0, 0x3}, {0x85, 0x0, 0x0, 0x84}}}, &(0x7f00000014c0)='GPL\x00', 0xf, 0x0, 0x0, 0x41100, 0x4b, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0xfffffffc}, 0x94) close_range(r0, r0, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000240)='./proc\x00', 0x1ff) mount(0x0, &(0x7f0000001500)='./proc\x00', &(0x7f0000001540)='proc\x00', 0x0, 0x0) r2 = openat(0xffffffffffffff9c, &(0x7f0000001580)='./proc/thread-self/fail-nth\x00', 0x2, 0x12c) write(r2, &(0x7f00000015c0)='270', 0x3) r3 = syz_open_dev$mtd(&(0x7f0000001600), 0x0, 0x2) r4 = socket$nl_generic(0x10, 0x3, 0x10) r5 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000001640)='cpuacct.usage_percpu_user\x00', 0x26e1, 0x0) close(r5) socketpair$nbd(0x1, 0x1, 0x0, 0x0) r6 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$nl_generic(r6, &(0x7f00000016c0)={0x0, 0x0, &(0x7f0000001700)={&(0x7f0000001740)={0x20, 0x42, 0x100, 0x70bd2e, 0x25dfdbfb, {0x3, 0x7c}, [@nested={0xc, 0x1, 0x0, 0x1, [@typed={0x5, 0x2, 0x0, 0x0, @str='\x00'}]}]}, 0x20}, 0x1, 0x0, 0x0, 0x4048011}, 0x8800) r7 = bpf$MAP_CREATE(0x0, 0x0, 0x50) bpf$MAP_UPDATE_ELEM_TAIL_CALL(0x2, &(0x7f0000001780)={{r7}, &(0x7f00000017c0), &(0x7f0000001800)=r5}, 0x20) r8 = syz_genetlink_get_family_id$mptcp(&(0x7f0000001840), 0xffffffffffffffff) sendmsg$MPTCP_PM_CMD_ADD_ADDR(r4, &(0x7f0000001880)={0x0, 0x0, &(0x7f00000018c0)={&(0x7f0000001900)={0x20, r8, 0x1, 0x0, 0x0, {0x7}, [@MPTCP_PM_ATTR_ADDR={0xc, 0x1, 0x0, 0x1, [@MPTCP_PM_ADDR_ATTR_ID={0x5, 0x2, 0x1}]}]}, 0x20}, 0x1, 0x0, 0x0, 0x80}, 0x8) ioctl$BLKPG(r3, 0x1269, &(0x7f0000001940)={0x1, 0x1f, 0x98, &(0x7f0000001980)={0x3, 0xfffe, 0x12}}) io_setup(0x20fe, 0x0) r9 = syz_open_procfs(0xffffffffffffffff, &(0x7f0000000040)='net/ip6_tables_matches\x00') pread64(r9, &(0x7f0000000380)=""/4082, 0xff2, 0x7fffffff) mkdirat(0xffffffffffffff9c, &(0x7f0000000180)='./proc\x00', 0x1ff) mount(0x0, &(0x7f00000001c0)='./proc\x00', &(0x7f0000000200)='proc\x00', 0x0, 0x0) openat(0xffffffffffffff9c, 0x0, 0x1, 0x0) r10 = socket$netlink(0x10, 0x3, 0x0) sendmsg$netlink(r10, 0x0, 0x800) io_submit(0x0, 0x0, &(0x7f00000000c0)) program did not crash single: failed to extract reproducer bisect: bisecting 30 programs with base timeout 30s testing program (duration=37s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): [4, 2, 6, 2, 10, 4, 15, 2, 5, 9, 25, 2, 1, 4, 7, 2, 9, 6, 17, 3, 4, 12, 13, 2, 3, 5, 2, 2, 29, 25] detailed listing: executing program 2: r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route_sched(r0, &(0x7f0000000040)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000100)=@newqdisc={0x30, 0x24, 0x401, 0x70bd25, 0x25dfdbfb, {0x0, 0x0, 0x0, 0x1, {0x0, 0xffff}, {0xfff1, 0xffff}}, [@qdisc_kind_options=@q_ingress={0xc}]}, 0x30}}, 0x0) sendmsg$nl_route_sched(r0, &(0x7f0000000140)={0x0, 0x0, &(0x7f00000001c0)={&(0x7f0000000200)=@newtfilter={0x34, 0x2c, 0x401, 0x70bd25, 0x25dfdbfb, {0x0, 0x0, 0x0, 0x1, {0x1}, {0xfff1, 0xffff}, {0x3, 0x1}}, [@filter_kind_options=@f_cgroup={{0xb}, {0x4}}]}, 0x34}}, 0x0) sendmsg$nl_route_sched(r0, &(0x7f0000000240)={0x0, 0x0, &(0x7f00000002c0)={&(0x7f0000000300)=@deltfilter={0x24, 0x2d, 0x1, 0x70bd26, 0x25dfdbfb, {0x0, 0x0, 0x0, 0x1, {}, {0xfff1, 0xffff}, {0x3, 0x1}}}, 0x24}}, 0x0) executing program 2: r0 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPSET_CMD_ADD(r0, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000240)={&(0x7f0000000780)=ANY=[@ANYBLOB="74000000090601020000000000000000030000000900020073797a310000000005000100070000004c0007801800018014000240fe8000000000000000000300000000aa1800148014000240fc000000000000000000000000000000060004404e1f0000050007008400000006000540"], 0x74}, 0x1, 0x0, 0x0, 0x30044803}, 0x20000040) executing program 2: mkdirat(0xffffffffffffff9c, &(0x7f0000000140)='./dev\x00', 0x1ff) seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0x0, &(0x7f0000000180)={0x1, &(0x7f00000001c0)=[{0x6, 0x0, 0x0, 0x7fff0000}]}) mkdirat(0xffffffffffffff9c, 0x0, 0x1ff) mount(0x0, &(0x7f00000002c0)='./dev\x00', &(0x7f0000000300)='devtmpfs\x00', 0x0, 0x0) r0 = openat(0xffffffffffffff9c, &(0x7f00000003c0)='./dev/md0\x00', 0x4002, 0x0) ioctl(r0, 0x932, 0x0) executing program 2: r0 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$nl_generic(r0, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000000140)={0x20, 0x44, 0x1, 0x70bd29, 0x4, {0x2}, [@nested={0x4, 0x48}, @nested={0x8, 0x1, 0x0, 0x1, [@nested={0x4, 0x75}]}]}, 0x20}, 0x1, 0x0, 0x0, 0x200408d1}, 0x4008094) executing program 2: mkdirat(0xffffffffffffff9c, &(0x7f0000000280)='./tracing\x00', 0x1ff) mount(0x0, &(0x7f00000002c0)='./tracing\x00', &(0x7f0000000300)='tracefs\x00', 0x0, 0x0) r0 = openat(0xffffffffffffff9c, &(0x7f0000000340)='./tracing/per_cpu/cpu0/trace_pipe_raw\x00', 0x0, 0x0) bpf$PROG_LOAD(0x5, &(0x7f0000000080)={0x19, 0x3, &(0x7f0000000140)=ANY=[], 0x0, 0x0, 0x0, 0x0, 0x0, 0x9, '\x00', 0x0, @cgroup_sockopt=0x16, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) r1 = getpid() r2 = syz_pidfd_open(r1, 0x0) setns(r2, 0x24020000) syz_clone(0xb21e0000, 0x0, 0x0, 0x0, 0x0, 0x0) r3 = seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0x0, &(0x7f0000000380)={0x1, &(0x7f00000003c0)=[{0x6, 0x0, 0x0, 0x7fff0000}]}) sendfile(r3, r0, 0x0, 0x7ffff000) executing program 2: sendmsg$nl_route_sched(0xffffffffffffffff, 0x0, 0x10) sendmsg$nl_route(0xffffffffffffffff, &(0x7f0000000340)={0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x13d33d22cca65c15}, 0x4008840) socket$nl_generic(0x10, 0x3, 0x10) syz_emit_ethernet(0x2a, &(0x7f00000003c0)={@multicast, @broadcast, @void, {@ipv4={0x800, @udp={{0x5, 0x4, 0x0, 0x0, 0x1c, 0x0, 0x0, 0x0, 0x11, 0x0, @remote, @multicast1=0xac14140f}, {0x4e24, 0x4e20}}}}}, 0x0) executing program 4: bpf$PROG_LOAD(0x5, 0x0, 0x0) socket$nl_generic(0x10, 0x3, 0x10) socket$nl_generic(0x10, 0x3, 0x10) openat$cgroup_ro(0xffffffffffffff9c, 0x0, 0x7a05, 0x1700) sendmsg$nl_route_sched(0xffffffffffffffff, 0x0, 0x20044810) r0 = socket$inet6_mptcp(0xa, 0x1, 0x106) setsockopt$IP6T_SO_SET_REPLACE(0xffffffffffffffff, 0x29, 0x40, 0x0, 0x0) bind$inet6(r0, &(0x7f0000000a40)={0xa, 0x4e22, 0x0, @empty, 0x7}, 0x1c) syz_genetlink_get_family_id$mptcp(&(0x7f0000000a80), 0xffffffffffffffff) listen(r0, 0xc) r1 = socket$inet_mptcp(0x2, 0x1, 0x106) connect$inet(r1, &(0x7f0000000b80)={0x2, 0x4e22, @local}, 0x10) r2 = socket$nl_generic(0x10, 0x3, 0x10) r3 = syz_genetlink_get_family_id$mptcp(&(0x7f0000000bc0), 0xffffffffffffffff) sendmsg$MPTCP_PM_CMD_ADD_ADDR(r2, &(0x7f0000000c80)={0x0, 0x0, &(0x7f0000000cc0)={&(0x7f0000000d00)=ANY=[@ANYBLOB='<\x00\x00\x00', @ANYRES16=r3, @ANYBLOB="0100000000000000000001000000280001801400040000000000004e23000000ffffac1414aa060001000a0080000800060003"], 0x3c}, 0x1, 0x0, 0x0, 0x4000000}, 0x4000000) executing program 4: r0 = socket$rds(0x15, 0x5, 0x0) setsockopt$RDS_FREE_MR(r0, 0x114, 0x3, &(0x7f0000000000)={{0x2, 0x8}, 0x59}, 0x10) executing program 4: munmap(&(0x7f0000001000/0x3000)=nil, 0x3000) mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./proc_mnt\x00', 0x1ff) mount(0x0, &(0x7f0000000040)='./proc_mnt\x00', &(0x7f0000000080)='proc\x00', 0x0, 0x0) r0 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./proc_mnt/kcore\x00', 0x0, 0x0) read$FUSE(r0, &(0x7f0000000280)={0x2020}, 0x1b5d) executing program 4: r0 = io_uring_setup(0x2a8d, &(0x7f0000000240)={0x0, 0x86a1, 0x400, 0x3, 0x1fb}) mkdirat(0xffffffffffffff9c, &(0x7f00000008c0)='./file0\x00', 0x0) r1 = openat$fuse(0xffffffffffffff9c, &(0x7f0000000900), 0x2, 0x0) mount$fuse(0x0, &(0x7f0000000940)='./file0\x00', &(0x7f0000000980), 0x0, &(0x7f00000009c0)=ANY=[@ANYBLOB='fd=', @ANYRESHEX=r1, @ANYBLOB=',rootmode=00000000000000000040000,user_id=', @ANYRESDEC=0x0, @ANYBLOB=',group_id=', @ANYRESDEC=0x0]) read$FUSE(r1, &(0x7f0000000a40)={0x2020, 0x0, 0x0, 0x0, 0x0}, 0x2020) syz_fuse_handle_req(r1, &(0x7f0000002a80)="4e5350994ebf71ce3049a58c5d050078bf16b0757a4c27b455e2a547739587dd3380b5df8f40a0696c5bd6cdb672cffe4d870c5c90ca92095b9ebf3e92fe31d8cd74275d857d34a74f7eecc7fac15e2f148d4e9d47bb45b858bbf078999970d180f28d7b2cefd92635d45a563d9229c9fd770efdc0848e52fa5efd9ada5c94a1ba94b4b7c7507f8b0819bb20910f9f50a83a010abbe126dd9f6a7b84eab6b0d5ce78d2ade77a5f7e4e997df1d03ffab4b4c945d803e4457909013127a98769c938c237f37263bc509a42bc56ff2dbf80e847e2c407009eef94f18e1e59069d62298fdbadae007ffbdf403c5049a4530ac0abecceb5608da02754c9a575af52c0b7e41226e2d642a814861c4310c935bcbae413516dde2132652b39c7aa0218a6ce65dabb4494965209ce879ba7e7e59039db5c1d36d6a7f86d72dd59954fd6f46124a2506b245a0db11aa89d2feb312a6596ea2fecaa7b6021f37a255f628da7ff6b6c36b514d3b6be34e505f9dac6acfb888198004699fb350ac93431533554658c4957df36703591438d6488bc03dd8290a75ebb367a481a50e79a46b04d005649cabd79e5c6326c066bc2b6fc5febb87ef66d832ef31a16c2a450a0b990fb549a5d810c928d1a81fa1dc795db2607ac7d46cb5716b68acdeb00987e429fe6a394632c83b43336e7b51d9cfdb50e83d8c6ba1784d9f74c16b476e048e65e7ac0af683b347d7377ac1795422e00e5bd8da9b313af83abb3348861116de7a99959169b7dff9f7d9b7a6d107f2e76670a6214a419bf8298f80eb570fa29264ba57a383c5ec5836ce33104ecaf1aec76e311280a1d2c8bd7abff3a5a242e6a637f7db63038ef5d78aca9c680d72b60da4dbeb0e1e683ddc82898647c589a81b8f92db06711d8a0af05560cd77fa7005283db71e8da21713fccd450822062b994d152aaed2cdcf0dec9c60617e15ba4df628da4e71279bf9d1eee5c7f055c27cddfdd45f9225d5d5529ef7119e2e3c9838e7362971e069be487797e949b24297de19c61340d1cd7a2bfa3880b91a71e934720a59e1e0ea992d2a1633a0852ad8addfcab73a291e35745e694a6471f429b124305886c1f79f67c78de3f3ec998c91e7fc59d26766cd446f6f0de603f2c6892e13cdaa37d9e8e118d098b6986ccd991993ec152193e7d77394b05b99e7d310c506707f1be52249438fba9615f6dad2ec7244fedf36e34ec311b7d6bee64271d6491079e161190ded7e28e2ada4307a9b2986c267b1a30d2f720ff23408011f1d589ce9ee77f981c7833656ccf7df5b3a87ec253ff7c7ef1e67ceeb10c93e3fa683cdadad65850ffbc402b7744e94cdecef9db9d264c755c53d36278df23d4c9685fdefa69f7588a33b8a64b35191ee81abcb9765577d175cb06e31c582807ff7243bfef44961fbc0f8a235242f51ee991ea621803d4dcfed90d26f004b299425bf219f6d185fe6e088ae44601b03defada18794feac93787696a5d419f09f769bc590f43d2df6a131f6895da2de120c2644685e57b1d476c6aba5881e954fb2575356452b118b942cb02b4ea0fcf8f1bbb9a23b6e32c9d0accd3dd861452a3ad77b38fe709e216974932deb5397fd8033ff0e073d93ac0b4be762bca0424d69bd57b22ba914133f87671a29498b268c2911e793215463ca2164e38059456107dcb29beedfd6277e2b41a11d1c6f1361b19875c9384f04f9c53c1856d71f360a8fafe05f7aef750ec0cf2bfcfa971c017ad071b69a18fdaf970b384d4c889cfa5a0397dbe89543a5c6302645d6edf959aa60709ce0225fe6c3266c7ef62157ac8e78fddcd8a1f2ca5b58128218d19276885515775326aeeee0006cc810843eb05144bf8e2fe3340cf60b32cafd96d23cd7d0d3adcbdfec9a2a3d88307c362633b1c5637608ea8476d900b3f836a9734bc5862ef52983577128d3f74b903b0e3bf64326c1b564ae42aeeb0c07702b63a9ff74a2af6b45e5185a53f36c17bc29dfbc0ea28ca5cca43a15d751e9887ad3e6a87faacb6a278c4c8a8d21b9a77b9776f33102a6e645e99cc5cbc543ed0674282c2b9f8e5d14c2599aa9ac8f81438c77f2b9368bdac82edcdc5366f39adec9e9a3fbd55b79abc16d2ebff26b7d0c88f18b486e5836333575e3fc7808cb423b44781c57965767862922b4ff32d9bae76296843a46f430211c27ef9db168430026a5691623284dfd459dbdd1f1a6ec9bfad666507e6eacb1e2a7866da2e12e6d596d0bbb150500590013d9288af20596447f97bf1744eb9cfb244d8fca269b1fb71e14de664be4e95d83fff1d7abcfebcf3e78c1c66d28f260fb0c19f9fbcd2abbdd7dd7246e49dc25d954bf25f810a2ff6f9069dfdc62e7170fe3b0964b2ac95024256dfa3e7a426be5bb5f707fd82c2b3afec5d5dcf5bbb8fcb6dbc1b59f6c5330966c70d8b016956903a4278817414ba3652a102d7e7e37ecc79400267fc3bf7601c0731f87d479c33f100735e748874155267f708cea49d549e93cf7a398b20373dc90ad9afd56d9c77cd24e2c4a18f7130b366c7fe5b26bc4d11ca1ed1b98fa0b4d7396f82ae6593f4575d19f4d8fd586c991129e5cbe15c8bacc89c3ee15ca471dea966b5c48ede0d3ba2a7e28c75c04e6a4aa49a61f4e391ffe78eb5e40a5ef349f3aa4d15f2291cc86ec7e47ae301bf0b6083dae44b695820a893d46732553ef15ed1c16d28268d52a7e3a7e7c009d0c0708a356d3310c1ebcbcca4d7acf433e34bfc9fc115498142dcc725e7a16879c75e4c2f01c6c98b39619f3248bf530e6ee593467e38cf4026cfdc4db6296560000d587f3c580750b1453ecc141c0461495551297d88ae034acbd4f5e80ce198e6640c4c1e9501529988109cef006eb2090a6fcd974d7f60290b78f1a8ce3051ac2d69636c3219f0a6ad8c254764396a1684b2fd9805b1853525f2e640e513197283cc4d4073ac033e0539a88f08aabe1423cd40b8a7e073437d812b57a5d39a0531dcbe13f4466e89efc66c2a1e4b39a3e0b3073c9d44e6cf9b85f4df5c4e03628d05bc0f94ec04234c9eca4ed17463f190406834b02888728f625371cda75d15ec19efebd59f00ab659eb94eb88bcb2110862a369ad599610c1530fcc118f5b82205bc5215fe3623ac8ec297d8ff4eee75ace20731c5d505e6605c26203b7f754164c9463f0a6eefe3a2880b8e06e7bc66bb2adcc1a3f9b0325f5ec31d12a25f1f73c2aa6bb3a7680d786a082a63b13cce1822fa6a4b085a871ae3409eecbc1fd8661b5d52bb2b8b72f23e24a225075f272ed2ba0c6c5c693811a0ef8db6da7cfe7c966c647f0187ad223eedb1012a5b7af103e98464ac768c79b21ca45b12a52cf261de0d367442cda71c4b8ee39c94ded1b22ba06c13836cb467ebab4efea07bdf1e3de8da56a0ee6d4f848011253cc21fac10700003513d3167b7a73e0d752b861c49814bc5410ebe53a0264f76068c91ee6ec9e2daa343482b2f0f06e605c5aaf81f2a3cd570efc2094b4bc452f9526f1bbe7b22b694fb8109a5a987fabf6250912d6099e67da9cac79e8b6f2cce4702d1f17cbc5d06c38b8a48155ec758369c185ded839fb58cd736fbb74105fe5baf44e7e3ed06843f23601b60a43b1f88fd29e9b3f58479f9b95392a39d5ba1a31ee4441ca2d1fb57c0a8678a07a724b7a65b2ab16d1da197f435bce3ef003fce27fa2f0a67c9dd6c930a4bcf59e79e57b010000006fe34972958c28b56642d14ea89bf4d7d6f7fcbcf4fd92bd08fc9fe424de4359112b11f81fbdc1505658363697713ff6e1f8ca3c4be34a79993a9091f6017cda6c7489ae5c07062555231427c3eb42a049f42d22a060983b044a7d34ab5d2b5386cca79af72396a48aad6b8dcd7855410fc6106e4a165994f26efff1e7ea0aa8f560333b5dfdb2a0d899b0fda955155f90c75effd3c9535d88508e836feb7807d57b2a57cca42d3d08fe7de60d2a33376f49bdacdd3f814bd0927f417f15ad62a10b302f46dc53a26fd997f3af46bbf990b6ada45ef83ce13029d167c65134e7b82b59ddfdc367e61c40defd2732ccebb1d4000f6c742df964e1fb390c255d2b1dfc745c6ab34af8096b5b67aa179e3f341854f7a69f7bf47664c832037ec7a78f8e27209e3f20f833fb6e8c0fc4a40920a5ad2b0618982ff72540009d5db82f0f5bcaed2a27f35d1e50eaa0cf8e48c7a2d43c25d0264db750a7f33b44a4bfaae576cf9ee7594ed204513899566564ed8bbc97ed18b1d8868f926a5c70ac06fbac1eade46792186be7bf8ffa3301239edd093449b7d77192782b5111c14169d2b4a1b3443ad62e4abdf11aac6a5b89a5b20ab0ad0abd949b9d64582c67ffce018e7e46de4091fcc77a65b971fc67c8d9cbf0c341ca764b1056ee5014d9865059616a525a1d46ae2fad159afe86dd1df9b8246411827e19535ca0aa9f83050b06e70aa2737f27e93d584a9cef878a642e9361efaa5d20bd8da901fa2e064656f686d3b3ea31d1d850ae9196b7764548f5c6450a32a717e09b6b7e75d43fbbda76e43a24f186d5578933f408bfa28e0435cde525fb91e71d92d704cc5a9b5e3db7aaec46d2b1f8dcb3f921f69bd7397c96a1e132c39c8f1656cea4365c779abf76199cb5b6aada022edec5c901cdafa2e7f3765af9c8b20cb1a6785085fcb0dc901367b89051bdfdc6b68c5215fd04e2b3c7e1c454a4d21132953b25c50995af0f7159a5a8d0a1621f4808f126a5bd40ddc79fed90f49925ee367a57a05c070fbe39fe2c213e7c1724a907ecfa69efe6e021c06a262471a4377f3c9809e9fee4f375e27c31b6afbb2151da86b7cab63c7b4fa4b77fb30172b9d0d78b1c0535ec0639c4910b5eeecbb5b8b5c8aa74c140e7ad347812e36db3097a7ff85c09ab2c0020202307f50efefcdb497b9c060ca68c4be54a9165b4cebc6b2e2e14e5ffb9213142418faedcdf26fd326b7672399e71cfffe3ed712ced5317c254f9199ee10c24c802d102bd8749513d3145201ca4e01bc7c8bbcf430afa541ec5665f86dfb143be648521bb0f2b029018201444787f644f8c88b79e754e6ea9c797babdaec72a9680abadf3a41684cdd57c2b6e833acc0846be5aa927f1b1b36562d2acb9ecfb758455230d050daec6748ba280a5edc86d48e3f8af0f8f4ffb18ae3cd3c19a82d504a4fd52bb62289ae8026572a497fe268f87ef4b4b5886aa07eeb698b7cbf99683f710afc9ed1f8a488883ce0eb8f7fd055b82a9fe21a409caa231c41ba151008e9658919c611e157d7f3926a5e4248532a6860e615b9c86e9fea212128d96ed58c9b84ef22706071eb69f492e4d8321ed9faf6c6a8928f86172bdc930244583ea15be497d9ce4ae79cb3e6293a8512ffaa9e8e358f3c7c7117001fb92891a40b84f9126cc3def5cde67f463bbac9668b9f56c3e4ee72fceebb47e52fc226bab213d8193516e7064459fd1365350a95c5a1c3ac44a73bbba2a4c17ebe49dd781bff1995cd706b77bb533117594ad63566f4c0730beab85ff4c713b7f10b95480fe99a0f676c51ca11116b21e87887b462aa9770e85509e4e60f198148115f0a3ce6028516a946178d1acacf7767f6be7277891369eff67762aa58f928d48b7231e44d899cea8289003349117a53d61bc27b207fdc91c9db61e677d1e1a1bc6a1b6e8564130b335233db4b5de8d62324e6d0ccb2b08c2ff922324eb8c506711142d4b8d7a21223ef0a3d534fdb0de58be95cd827152f71bdd0a82766b62b4c87536f0b7e7df343c4263187da887de6e65d11d0360e2376c1d71c367ae85edeed8f767d24c644b1a9b455ded1dc3cc224f99936a6ee66931c45e5e3db2427719ab2d5cd9c20d9bb0ec004b69bccb00649f3d8e34a3572c257de114b9f027d76bc7db9007175cc03b9e2061b6b3fe7409e009b5371544e56fe438cbd361e5b11efbf2d79d1c250a1e73ca8c601c4f4d1e3761290950421c48c7daa45965e472f5ef3c4b8597444dc5dc01cd25358055b5000617f3e7291da3413e3f0853b1271366612405c35ff1b785b984d921b518425628a533a29ab65d3c11f44c6daa86f8b6457ebb9419274c481aa6f3fa4547641670aff58b9cc62c0993d49a509f02dee755ee5f1fd2710c995c43a91c4f873afa1bbdff14427cba2641052a8f361ecbc72e8a6cf587e83f8bd3110c95fb080edc77a6d43cd58c447b0e02261e4109500c6458dce70acb17aa8f9dc1d15b94a61354164031b5d563c25d0246fc45e6401cefceb501e1468903e5d677759dbe3f24bd48ce55ff8b8f26529fb3b2d669202a1e8a498984b449b4830a0126b18f0e78182c9ce78fe0c448c0e27845b926cfde28fa85e156fa98fefaeb19ed1247c9643b447b4342c97cba5ca94ef1c555d5b49aa70e6aad45bfb557f15e8fdb2d6e3d10d8338a13fe3f187751985b37a5bb10b750f79e36fc2e2ee9bdecc3ed156e202ed7b45a94809d77edaa398042fc6a825a4848c334c557303d24eb3f8e01be06995ceb283c70272b00da61c3381628f0e372fe2fcc779ff7daf7e4b7f2686c39d3fab674b8867b62b0bf9d5cfd0c1d3b270521f55f147de75142ffd7fc9ac7e5dae7ca2fdf26a9222d060823852409dd040cfd1f66f218c6dbdaaacddab34b123af22f97384d64fac64d84fd638c96378c8f9532a11927d48440bc777ff8b8b9be88f930f3b579a713c0bc449dca3a3bd5f2efa98240ccc594299e44451dc60c6c5c9edd0d7b777912b3dc40c57e0ea5f4425cd7047e686c7304f04ba9f7b5de6ad2bd524f1d29f8802a524441fa286015adf4589431710aa4d76de8a956dc1d39c0a13abb7fc309d24222d036e204ab6bb46ef8a7595d9e4512e0b9d5f8fd719a4e3072e1d806967045789c67a1681f2a9f1f4b19f4f5e1afdafc17db7a6d5196161499e62ab4b0ec27648f3eeb1fb2b78f8ecf9b05cf9509a3b9e2a361238deb1c91bdbc8b1d11bbeb939fd9da811cd439069da0ecc00665d72357aac01f259a0325409b201859cc0569e0eba67a7a9ca7e8b78078d9370bd3e37f0571680ede60cb6bbfe69435d6ab5efd80cf051d119a7004fc0b600844d49218d844de8f521524a47ee50229c7da25e42a8639b5db225e7f23967f5d4f8a297aff04a3cbedc2985b6393a5ba0b26b6c7b4ca22d369b35b410799d1ad02825104d34f73408db1948438597931ed1c1c260e78340517bfa2f734537dbdf5ec303518ff4640efe7f7b1c2f46ba8b9ddb7a18d5e87ced554c9d6de78f85d293349590c6c32483534bc968b24a28eb54b9515589d6dd8eb51a5ad0b4d896ce92250397cbc404323fcdf0ee47ed634e0c58213bc5b35a72b21a098e11b79c061430dc817c1e0c79a5b6ed3b002979933f1b83a17f250b1bd5c4958df4d75531ca03efbda89f6a92fe08c23ad9014ff562a7f3dcde578d6825b9847b5df04dbca4f2aa52d8e0f4cf8183ce121e39b50358a9796acde0372a8ff97769874a80ab997cd889145aad4888c06963c2f5b82f53a748a6729fbc79d35c06d84e05c62e44ff78040e56ebfc6efcf0d8b49337d5a17c4041f0d5a8b616244d585a162b69db073accd9071d12df5b326a43b834bbffc2f2a60deafcbddf1c6438a1769d6fb09fbe1990e89da12164ef237f326edb5be64bb64b143a030de8a99b3c5e543c871cb581e2be090a92134aa587701f864907cadd7c1ce20fcf8f5dc7f7ecd06a6c19d89a92ca0ad4393c208b80bba990c7a3702a9c79bddde75d5db244719ac32191b6ceb041ab541fb47680a97dc0422b8a50d91e32cb08cd341b0b099aca5bd12b69d4f89d10b755b351a6489180b786a3bebac926532a4a2d85b07bce6c090d1aaaff079e36d5394a612f1351b90c13a0fa6bf9d188d548dfe6fa51a9026edb52009c03ed45ac51d05c58a957bcc67e05a588985ba00d79f33ae9cdd5f5721d9fdc72ee6e880708be87e8a60c3c035c146f2091d1b9a4c2cfa56f292fe1ba62290d4e56c05669291bbe917f3cac51802a2cc8e9c90dadfe666c233c5a5bb71ee17deec51ce60c73f57bf9ecb84873afcc44815131810c6c1217bea485ef9aa2785e859b25315ef8aa3a274982786e45d622ae831fb76010d69a181b069e4cc55d4436edb10d1119b0c6000c6d5cff7c72f740a59dc0507e7a952b69403c62673f122c9d1264fac6ce2262e86cd8d6a402672f88530fc2d16f31736dd497a4e853253ac8d5aff8d1376895e9f5519b2490cc2a2412ba0c99cec855f668837310035e92fb646486de1b0acffb91ae7516df3eeef381456b55e65baa58e71461c928687e699d2b21814805591382e95e1b970aaa53259917f070281f2336b7d570249d838b3f1a32753c336864e15f4561badf8fee034a29c52ff3fca7456ae140f83e3b2fd5b57c9aef3f20c664200d235f236ec47dd2fc20b14dc6000812237aea992d987e5460679e8c5b76d931ef6d951e6c7087e3106b6ce2db9de6f228fdf3ffc38710c0e8d5000a195a79d1fa2301038f5b27c40b09c34c025e5099d40c2204ea0eae985263c9101cab88d6857a320c9e497f22348a24861a5fb8d734e08cad09f9933748ff01eab22f17756f58688dc1b486a397563ee9ad0784b8833cdb5f7c6bcf76d9c1105f71c3c6aabefd70dc6cd5c66d31caf916145ac5ed7fa070b4277c0448ab1eb78c943be9aeab0587d321a4bcb7754f070881178f8be668b686124899fac252519f4b60ec42db766a908755040463125c26850177402a977246d36d23afac0a11889d54640bd8f6f670d686cfd33f6fc5d90cf6cbd63d9d0fd201dd4c74dbbab899f3c23c0b7e37ea0b2aff421327200d0da58b5893a4186ae3652cc6e11c2c2a0e52184a3872532acce98c94cebf4f31333663a620f0dba0ffd89c3124380075bd28caa6d449a050b3661b8fbaf4747b77c4928b1378fdc8c7a7b38ade1aeec44bdfacc8271d0b132b2029b0f3582f9919f5c8cd543abc9caf6b82b197cd482c3ef61a64743506342bf50a3c1ff544563bb8b2002911ee1fad698f4ac133ffed5bfe81239c918207a03c7a8bd71a0a502aea78d38e970e3ab2abf754b598acb79cf276792aa08724d0ba24f2a694912ab795b3f45f52dec50d9bfbc99ae27e1d2c2216afec6709d6513a64b29ef58255bbe18478c5d4f15f74ea63a1e15487752eec8fd019f1d4a7aa25277664754bd2d7cd3a7a018b92c56d965a1974885363757286da9e055ef7fac17876f0a64c1026a597733b897a9155ecbf420159ae8e5209aa83a3544fff1fb4566f2d54f95e3bbd30dcca5f24397e4bd47ff01292f0d6fe9dd47a810e0c25382fa69b4987d1afd9b69ef125110ad6b240eaa9c85829a2646f9ab7874bc02bfa8346cc9190943e9d46b44880670b1e2aa3a29e83be5472d7418885a353faade6e8b18f4b588607bbb758588d1e2f11a9dfa1c4d61be50249f1ee32e6ff8c0c7722aaec1bc79654a4772efc578bd6a14c79abcc77a4e09c8b6c6ea35cd3ab31e35268fb55db843176f8042f8ce7be0ddd4ead6dbdad0ef9e7cb2323db5cc48119a72b27306b8ff6366c0bc682a85ab9e2cf2238b6d6eb2e38a97d5577e6334cb2aa6e7c86e489e876f9d7053577a5cb57f52812fab7c4bd7b19a34c228ffb67dcac9281612f778b58c580c140542200fd00cb3ad81d93420df93c5af2493f646d8de797102fa0a650b2c7638623b823ff11444fdde453570f99f9099b60061a908b83383ba8b82bb78edd074dccf9342afdf8d11a6129ba6ea7030f3629056264f1736c2b926171b6dc7e1fa455a473de656390495f3b6ad2f9f46f35eacb075628ff739ef78f28ba683448068c7f18fb63f28ba7dbbb78999100dde0a94e8b8570817c7114c13e139ceb333782b29a84a5b19497fa785915c7680dd7f972cb59ba22161f60886e5cb3c3e808726cbf96bc4da78914eee565c6d9d18e70d22cf8c0244cf3cf488c3550eaa400bc0f26d64e0f1bc8d0301a841d954073a641f3ef883d81f4d5db8e9df708e64e640b38df7295f7fe573863653086bae5507c880ab7fdb7a6c5ce77027ffa7395233d3ce536d77ae6c2e9c8ffb6fee78a3bcb3b5f888bd595caa3a5586948776b950a89cde4db8247ffff27491c882b430afdd60e7a22324f6635a9aa7139f3e624c6d9ece60f7f8153b2080cf0544fbf8e1c436503766e670b902604ab521e11aa5a65cedd64cfaf898ac5f55c08c87693c323517bcb0d99c28f5e072d4f6540c7ead70138d47c1a67fd72bd6ef5613af33a0af311c3d0a631ca2a2dfbe35d1021eb610e40b9be128683235a788b5a4cacf99babee382458d59e8aa1dd7bba7e09dd30c055a3df8ed721a1778b2c6ed587a403566325cd19962edd7831caa44a6b716517bad502130e7cf6a5ce5288dc84c0170f622ae0b1e1166a9c2c0771d91df9f9dd82ae210469602ce38964746c1c1d04321aae7d464eb801dbea7ec39505457e778208774d72673626c998b002c46a9b4b1e390d9344f0c1043a2100b35196bce42d40caa0ea9a486bf8526fd1f0f0d362c2cac463ea7377a20b54b9435442ca529fc00da4fd7e27c4eaf14215a06857b54254c26346956fd7fe215a5ce57ec38cedf50a3c759e563a4fd87494f00e7bd9b44f3b7e99c6ef67187056a21d2fe1ac9d24125b1947eb293189fdc448b591af4d9b8eb091d6bbb5e50fae79d000044e282bb2ab6c63cc9562b151c214e45015354e62be63e1881238b907f7bdb791ff44a4e03fa29dbd26db2f49d0f4729b7cd9ba69a65b0b493466d35d09b3f590c67c31660d95e2ab4af2c9f1df91f04ce5a57dde2d75206b42e3423126774d76593c2f713ae279d7092506b513fd5b38f0f52d3fafd7141dfd4a0de1063754dba865faf8dc0f6be9d90ef21ec86a275533f6ad4b4e360dc775413f29eab8b3daac6279b9abfe163ea2f183e09ed91ef67fbb090875109288a182cfdcc46d90678efe5edceda6518335e678438cac4bb47d376f3f0e12aa55301735d7f42653c073d6a4a37b2e17d332dc1be6b50918c007b14886307cc39250e81efecd63d24067a49994572725a9df1760caac13a28f5255556b27ec245e93969b85cdec7cd1c2d2a433d3f9572b93054a7ce8adff81bc1d30884d5fc4791e251bd907e37af5bec74235c3e2f804e4e0450b715289942b7859ad207bafcfec1b586dc15e7911fe6d20aa3d02fcd47e9956780e300d7c53c17dfa15754deb4c20efebc7270bda0fa6b37fc88c6be4250cac38c1b8186b364482026ab52d65d3a691903fccc39772277011bfaa421adba76bed9731077be00000000d40f36bbd2a839c67dc4b862c968491b877d4fd13fc90f8da57a29121e12f78e85af765cd66e72ba513593fe1cdf20019985b065d828707d8e509c6834eab188deea5c9ee97955f4b07d37b6fc7beed73be94887d423a349f35bb8782bc654ceaec870d97f061bda02ae73f6d575f81e0b6326eae6c1b3085cc584686120e12dd9ad8ce44036bec8a189f900", 0x2000, &(0x7f0000004a80)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f0000004b40)={0x90, 0x0, 0x4000000000000, {0x0, 0x1fffffffe, 0x8, 0x6, 0x8, 0x1, {0x1, 0x8010001, 0x4d0, 0x40d, 0x6, 0x0, 0xed1, 0x2, 0x5, 0xc000, 0x7ff, r3, r4, 0x3d5, 0x20000002}}}, 0x0, 0x0, 0x0, 0x0, 0x0}) write$FUSE_INIT(r1, &(0x7f0000004c00)={0x50, 0x0, r2, {0x7, 0x26, 0x5, 0x61001838, 0x0, 0xfffc, 0x6, 0x5d2186cc, 0x0, 0x0, 0x1, 0x10001}}, 0x50) openat$dir(0xffffffffffffff9c, &(0x7f0000004cc0)='./file0/file1\x00', 0x40, 0x10) close_range(r0, 0xffffffffffffffff, 0x0) executing program 3: socket$inet6_tcp(0xa, 0x1, 0x0) poll(&(0x7f0000000040)=[{0xffffffffffffffff, 0x20}, {0xffffffffffffffff, 0xa000}], 0x2, 0x8) r0 = syz_open_procfs(0xffffffffffffffff, &(0x7f0000000080)='attr/fscreate\x00') write$binfmt_script(r0, &(0x7f0000000740)={'#! ', './cgroup/file0aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa'}, 0xff1) socket$nl_route(0x10, 0x3, 0x0) r1 = socket$nl_xfrm(0x10, 0x3, 0x6) r2 = open(&(0x7f00000000c0)='./file0\x00', 0x80140, 0x0) fcntl$setlease(r2, 0x400, 0x1) r3 = socket$inet_tcp(0x2, 0x1, 0x0) bind$inet(r3, &(0x7f0000000100)={0x2, 0x4e20, @broadcast}, 0x10) shutdown(r3, 0x0) shutdown(r3, 0x1) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x3, 0x8031, 0xffffffffffffffff, 0x0) mmap$IORING_OFF_SQ_RING(0x110c230000, 0xc000002, 0x2000007, 0x401d031, 0xffffffffffffffff, 0x0) recvfrom(r3, 0x0, 0x0, 0x3, 0x0, 0x0) r4 = creat(&(0x7f00000001c0)='./file0\x00', 0x0) close_range(r2, r4, 0x0) r5 = socket$nl_route(0x10, 0x3, 0x0) r6 = socket$inet_udp(0x2, 0x2, 0x0) ioctl$sock_SIOCGIFINDEX(r6, 0x8933, &(0x7f0000000200)={'lo\x00', 0x0}) sendmsg$nl_route(r5, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000280)={&(0x7f00000002c0)=ANY=[@ANYBLOB="300000001400030500008000ffdbdf25020751ff", @ANYRES32=r7, @ANYBLOB], 0x30}, 0x1, 0x0, 0x0, 0xc090}, 0x0) ioctl$sock_ipv6_tunnel_SIOCADDTUNNEL(r4, 0x89f1, &(0x7f0000000300)={'syztnl0\x00', &(0x7f0000000340)={'ip6tnl0\x00', r7, 0x2f, 0x5, 0xe5, 0x3, 0x20, @private2, @private0={0xfc, 0x0, '\x00', 0x1}, 0x700, 0x80, 0x0, 0x7}}) sendmsg$nl_xfrm(r1, &(0x7f00000003c0)={0x0, 0x0, &(0x7f0000000400)={&(0x7f0000000440)=@polexpire={0xd4, 0x1b, 0x1, 0x0, 0x3, {{{@in6=@private0, @in=@empty, 0x0, 0x0, 0x0, 0x8, 0x0, 0x80, 0x20, 0xf}, {0x0, 0x0, 0x0, 0x3, 0x0, 0xffffffffffffffff, 0xfffffffffffffffc}, {}, 0x0, 0x6e6bb0, 0x0, 0x1, 0x1}}, [@etimer_thresh={0x8, 0xc, 0x8}, @policy_type={0xa, 0x10, {0x1}}]}, 0xd4}, 0x1, 0x0, 0x0, 0x665c3ed30a41084f}, 0x0) r8 = fsopen(&(0x7f0000000540)='cgroup2\x00', 0x1) fsmount(r8, 0x0, 0x0) executing program 1: r0 = openat$vimc0(0xffffffffffffff9c, &(0x7f0000000180), 0x2, 0x0) ioctl$VIDIOC_TRY_EXT_CTRLS(r0, 0xc0205649, &(0x7f00000001c0)={0x60000, 0x7, 0x0, 0xffffffffffffffff, 0x0, &(0x7f0000000200)={0x9e0903, 0x0, '\x00', @value64=0x4}}) executing program 1: syz_emit_ethernet(0x36, &(0x7f0000000680)={@local, @remote, @void, {@ipv4={0x800, @icmp={{0x5, 0x4, 0x0, 0x0, 0x28, 0x0, 0x20, 0x20, 0x2, 0x0, @initdev={0xac, 0x1e, 0x1, 0x0}, @multicast1=0xe0000300}, @timestamp={0xd, 0x0, 0x0, 0xb386, 0x2, 0xd, 0x7, 0x5}}}}}, 0x0) executing program 1: bpf$LINK_GET_NEXT_ID(0x1f, &(0x7f0000000140)={0x0, 0x0}, 0x8) r1 = bpf$LINK_GET_FD_BY_ID(0x1e, &(0x7f0000000180)=r0, 0x4) r2 = bpf$ITER_CREATE(0x21, &(0x7f00000001c0)={r1}, 0x8) read(r2, 0x0, 0x0) executing program 1: openat$nullb(0xffffffffffffff9c, &(0x7f0000000000), 0xc6902, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000040)='./sys\x00', 0x1ff) mount(0x0, &(0x7f0000000080)='./sys\x00', &(0x7f00000000c0)='sysfs\x00', 0x0, 0x0) r0 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./sys/module/kvm/parameters/nx_huge_pages\x00', 0x1, 0x0) mmap(&(0x7f0000000000/0x200000)=nil, 0x200000, 0xa, 0x204031, 0xffffffffffffffff, 0xc9751000) openat$kvm(0xffffff9c, &(0x7f0000000480), 0x20840, 0x0) write(r0, &(0x7f0000000140)='never', 0x5) executing program 1: r0 = socket$inet6_sctp(0xa, 0x1, 0x84) getsockopt$inet_sctp6_SCTP_FRAGMENT_INTERLEAVE(r0, 0x84, 0x12, &(0x7f0000000000), &(0x7f0000000040)=0x4) executing program 0: mkdirat(0xffffffffffffff9c, &(0x7f0000001500)='./dev\x00', 0x1ff) mount(0x0, &(0x7f0000001500)='./dev\x00', &(0x7f0000001600)='devtmpfs\x00', 0x0, 0x0) setsockopt$IPT_SO_SET_REPLACE(0xffffffffffffffff, 0x0, 0x40, &(0x7f0000000000)=@mangle={'mangle\x00', 0x44, 0x6, 0x3c8, 0x168, 0x168, 0x0, 0x200, 0x168, 0x370, 0x370, 0x370, 0x370, 0x370, 0x6, 0x0, {[{{@ip={@multicast1, @dev={0xac, 0x14, 0x14, 0x13}, 0xff, 0xff000000, 'pim6reg1\x00', 'bridge_slave_0\x00', {}, {0xff}, 0x88, 0x3}, 0x0, 0x70, 0x98}, @ECN={0x28, 'ECN\x00', 0x0, {0x30, 0x3, 0x3}}}, {{@ip={@private=0xa010100, @local, 0x0, 0x0, 'vcan0\x00', 'veth0_virt_wifi\x00', {}, {0xff}}, 0x0, 0x70, 0xd0}, @common=@SET={0x60, 'SET\x00', 0x0, {{0x0, [0x0, 0x1], 0x1}, {0x0, [0x0, 0x0, 0x0, 0x2, 0x4]}}}}, {{@ip={@initdev={0xac, 0x1e, 0x0, 0x0}, @local, 0xff, 0xff, 'bond_slave_0\x00', 'veth1_virt_wifi\x00', {}, {0xff}, 0x5c, 0x2}, 0x0, 0x70, 0x98}, @unspec=@CHECKSUM={0x28}}, {{@ip={@private=0xa010102, @multicast1, 0x0, 0xffffff00, 'syzkaller0\x00', 'bond0\x00', {}, {}, 0x0, 0x0, 0x13}, 0x0, 0x70, 0x98}, @unspec=@CHECKSUM={0x28}}, {{@ip={@remote, @loopback, 0x0, 0x0, 'lo\x00', 'batadv_slave_1\x00'}, 0x0, 0x70, 0x98}, @ECN={0x28}}], {{'\x00', 0x0, 0x70, 0x98}, {0x28}}}}, 0x428) mkdirat(0xffffffffffffff9c, &(0x7f0000000080)='./mnt\x00', 0x1ff) mount(&(0x7f00000000c0)=@filename='./dev/sda1\x00', &(0x7f0000000140)='./mnt\x00', &(0x7f0000000100)='ext4\x00', 0x8410, 0x0) mprotect(&(0x7f0000000000/0xf000)=nil, 0xf000, 0x1) r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000140), 0x519c02, 0x0) ioctl$FS_IOC_RESVSP(r0, 0x40305828, &(0x7f0000000040)={0x82, 0x1, 0x6, 0xfffffffffffffffe}) close(0x3) executing program 1: r0 = syz_usb_connect(0x5, 0x2d, &(0x7f0000000000)=ANY=[@ANYBLOB="120100004898b610c2154100201f0102030109021b0001000500ea09040002018c78fd00090582f3c6"], 0x0) syz_usb_control_io$cdc_ncm(r0, &(0x7f0000000040)={0x14, 0x0, &(0x7f0000000080)={0x0, 0x3, 0x1a, {0x1a}}}, 0x0) syz_usb_control_io(r0, 0x0, 0x0) syz_usb_control_io$hid(r0, 0x0, 0x0) r1 = syz_open_dev$evdev(&(0x7f00000000c0), 0x5, 0x40) ioctl$EVIOCSKEYCODE_V2(r1, 0x40284504, &(0x7f0000000100)={0x6, 0x8, 0x3, 0x98, "2a00000000000000441d220fe0bd40edb4b62483d1c87e95d93f18520c4f24b3"}) executing program 3: r0 = socket$nl_xfrm(0x10, 0x3, 0x6) ioctl$SIOCSIFHWADDR(r0, 0x8b14, 0x0) pipe(0x0) r1 = bpf$PROG_LOAD(0x5, &(0x7f000000e000)={0x10, 0x4, &(0x7f0000000040)=ANY=[@ANYBLOB="b4000000000000007910480000000000610400000000000095000080"], &(0x7f0000003ff6)='GPL\x00', 0x2, 0xfd90, &(0x7f000000cf3d)=""/195, 0x0, 0x0, '\x00', 0x0, @sk_msg}, 0x48) close(r1) r2 = socket$inet6(0xa, 0x2, 0x0) bind$inet6(r2, &(0x7f0000f5dfe4)={0xa, 0x4e20}, 0x1c) r3 = bpf$MAP_CREATE(0x0, &(0x7f0000000540)=ANY=[@ANYBLOB="0f00000004000000040000001200"], 0x50) r4 = bpf$PROG_LOAD_XDP(0x5, &(0x7f0000000340)={0xe, 0x4, &(0x7f0000000400)=ANY=[@ANYBLOB="18020000801000000000000004000000850000002700000095"], &(0x7f0000000000)='syzkaller\x00', 0x0, 0x0, 0x0, 0x41000, 0x0, '\x00', 0x0, 0x25, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0x2000}, 0x94) syz_emit_ethernet(0x4e, &(0x7f0000000340)={@local, @multicast, @void, {@ipv6={0x86dd, @udp={0xa, 0x6, "1b8100", 0x18, 0x11, 0x0, @empty, @mcast2, {[], {0x4e25, 0x4e20, 0x18, 0x0, @wg=@data={0x4, 0x5, 0x9}}}}}}}, 0x0) bpf$BPF_PROG_DETACH(0x8, &(0x7f00000006c0)=ANY=[@ANYRES32=r3, @ANYRES32=r4, @ANYBLOB="05"], 0x10) bpf$MAP_UPDATE_ELEM_TAIL_CALL(0x2, &(0x7f00000001c0)={{r3}, &(0x7f0000000140), &(0x7f0000000180)=r1}, 0x20) syz_emit_ethernet(0xbe, &(0x7f0000000000)={@dev={'\xaa\xaa\xaa\xaa\xaa', 0x23}, @dev={'\xaa\xaa\xaa\xaa\xaa', 0xc}, @void, {@ipv4={0x800, @udp={{0x5, 0x4, 0x0, 0x0, 0xb0, 0x0, 0x0, 0x0, 0x11, 0x0, @empty, @empty}, {0x0, 0x4e20, 0x9c, 0x0, @wg=@initiation={0x1, 0x0, "7b4b142b7461fd777b1c012bd14efb9f49fcdb8f080c26a04883ad5c8c82b8af", "584cbf2649a50f2dbc43efa8698d0a881c51852e4451b57d037ad3c04594282423424d00", "bcfd56f1375461caaa2f19935e6996c7096ffeeb0300000000000064", {"9a3bfbc1f39cb307b3472eb9cdb042d2", "643fcbb2c5a57df67d544af6e8dafe09"}}}}}}}, 0x0) bpf$PROG_LOAD_XDP(0x5, &(0x7f0000000140)={0x6, 0x3, &(0x7f0000000680)=ANY=[@ANYBLOB="1800000002000000000000000000000095"], 0x0, 0x2003}, 0x94) syz_genetlink_get_family_id$batadv(&(0x7f0000000080), 0xffffffffffffffff) r5 = bpf$PROG_LOAD_XDP(0x5, &(0x7f0000000480)={0x6, 0x3, &(0x7f0000000680)=ANY=[], &(0x7f0000000200)='syzkaller\x00', 0x9}, 0x94) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f0000000600)={r5, 0x5, 0xb68, 0x0, &(0x7f0000000000)='%', 0x0, 0xd01, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2}, 0x48) executing program 3: r0 = socket$inet_smc(0x2b, 0x1, 0x0) listen(r0, 0xfffffff8) setsockopt$inet_tcp_int(r0, 0x6, 0x1, &(0x7f0000000000)=0x81, 0x4) executing program 4: r0 = socket$nl_generic(0x10, 0x3, 0x10) syz_genetlink_get_family_id$tipc(0x0, 0xffffffffffffffff) sendmsg$TIPC_CMD_ENABLE_BEARER(r0, 0x0, 0x404c050) syz_emit_ethernet(0x16, &(0x7f0000000780)={@local, @remote, @void, {@mpls_mc={0x8848, {[], @llc={@snap={0x0, 0xaa, '!', "468b7f", 0xfbfb}}}}}}, 0x0) executing program 4: r0 = syz_usb_connect(0x0, 0x3f, &(0x7f0000000bc0)=ANY=[@ANYBLOB="11010000733336088dee1edb23610000000109022d0101100000000904000003fe03010009cd8d1f0002000000090505020000fcffff09058b1e20"], 0x0) syz_usb_control_io$printer(r0, 0x0, &(0x7f0000000c00)={0x34, &(0x7f0000000c40)=ANY=[], 0x0, 0x0, 0x0, 0x0, 0x0}) r1 = syz_open_dev$char_usb(0xc, 0xb4, 0x0) ioctl$HIDIOCGUSAGE(r1, 0xc0145b0e, &(0x7f0000000c80)={0x100000, 0x1, 0xffffff7f, 0x0, 0x3, 0xfffffffc}) r2 = creat(&(0x7f0000000080)='./bus\x00', 0x0) r3 = fanotify_init(0xf00, 0x2) fanotify_mark(r3, 0x105, 0x8971, r2, 0x0) mprotect(&(0x7f0000000000/0x3000)=nil, 0x3000, 0x1) r4 = openat$kvm(0xffffffffffffff9c, &(0x7f00000004c0), 0x20042, 0x0) ioctl$KVM_CREATE_VM(r4, 0xae01, 0x0) ioctl$KVM_RUN(0xffffffffffffffff, 0xae80, 0x0) mmap$binder(&(0x7f0000ffd000/0x3000)=nil, 0x3000, 0x1, 0x11, 0xffffffffffffffff, 0x10000000000) executing program 3: r0 = socket$inet6_tcp(0xa, 0x1, 0x0) close(r0) r1 = socket$inet6_mptcp(0xa, 0x1, 0x106) bind$inet6(r0, &(0x7f0000000040)={0xa, 0x4e22, 0x0, @empty, 0x200}, 0x1c) listen(r1, 0x0) r2 = socket$inet_mptcp(0x2, 0x1, 0x106) connect$inet(r2, &(0x7f0000000000)={0x2, 0x4e22, @empty}, 0x10) r3 = accept(r1, 0x0, 0x0) sendmsg$TEAM_CMD_OPTIONS_SET(r3, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000440)={&(0x7f00000004c0)=ANY=[], 0xfffffdef}, 0x1, 0x0, 0x0, 0x24008840}, 0x0) r4 = socket$nl_generic(0x10, 0x3, 0x10) syz_genetlink_get_family_id$mptcp(&(0x7f0000000400), r4) sendmsg$MPTCP_PM_CMD_ADD_ADDR(r4, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000180)={0x0}, 0x1, 0x900}, 0x0) setsockopt$inet_tcp_int(r3, 0x6, 0x1, &(0x7f00000000c0)=0x783a, 0x4) executing program 0: r0 = syz_open_dev$cec(&(0x7f0000000200), 0x0, 0x80240) ioctl$CEC_ADAP_S_LOG_ADDRS(r0, 0xc05c6104, &(0x7f0000000240)={"00000016", 0x0, 0x6, 0x4, 0x7, 0x2, "f759ca34000400", '\t\x00', "03000600", '\x00', ["8bada940edffea0a0800", "c2fed6cb0200004000", "000011cedce100000000ef00", "00080001000000000100"]}) executing program 0: r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$ethtool(&(0x7f0000000280), r0) sendmsg$ETHTOOL_MSG_PAUSE_GET(r0, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000340)={&(0x7f00000000c0)={0x20, r1, 0xfe0cef4d0db3b49, 0x70bd2a, 0x25dfdbff, {}, [@HEADER={0xc, 0x1, 0x0, 0x1, [@ETHTOOL_A_HEADER_DEV_INDEX={0x8}]}]}, 0x20}}, 0x10) executing program 0: sendmsg$kcm(0xffffffffffffffff, &(0x7f0000000480)={0x0, 0x0, &(0x7f0000002240)=[{&(0x7f0000000c40)='2', 0x1}], 0x1}, 0x8400) r0 = socket$packet(0x11, 0x3, 0x300) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000300)={'veth0\x00', 0x0}) setsockopt$packet_int(r0, 0x107, 0xf, &(0x7f0000000380)=0xf3f, 0x4) sendto$packet(r0, &(0x7f00000003c0)="3f03fe7f0312140006001e0089e9aaa911d7c2290f0086dd1327c9167c643c4a1b7880610cc96655b1b141ab059b24d0fbc50df71548a3f6c5609063382a0c153cfdf9435e3ffe46", 0xe90c, 0x0, &(0x7f0000000440)={0xc9, 0x0, r1, 0x1, 0x0, 0x6, @multicast}, 0x14) executing program 0: syz_usb_control_io$uac3(0xffffffffffffffff, &(0x7f00000000c0)={0xfffffffffffffcd0, 0x0, &(0x7f0000000040)={0x0, 0x3, 0x4, @lang_id={0x4, 0x3, 0x3668}}}, 0x0) syz_usb_control_io$uac3(0xffffffffffffffff, &(0x7f0000000000)={0x14, 0x0, &(0x7f0000000200)={0x0, 0x3, 0x4, @string={0x4, 0x3, "5b04"}}}, 0x0) executing program 3: r0 = syz_open_dev$ttys(0xc, 0x2, 0x1) ioctl$TIOCSIG(r0, 0x40045436, 0x0) executing program 0: r0 = openat(0xffffffffffffff9c, &(0x7f0000000000)='./file2\x00', 0x1c9442, 0x19c) r1 = bpf$MAP_CREATE_RINGBUF(0x0, &(0x7f0000000140)=ANY=[@ANYBLOB="1b0000000000000000000000000004"], 0x50) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000001380)={0x11, 0xf, &(0x7f0000001440)=@ringbuf={{0x18, 0x0, 0x0, 0x0, 0x8d, 0x0, 0x0, 0x0, 0xec5}, {{0x18, 0x1, 0x1, 0x0, r1}, {}, {0x7, 0x0, 0xb, 0x3, 0x0, 0x0, 0xfeff}, {0x85, 0x0, 0x0, 0x86}, {0x7, 0x1, 0xb, 0x9, 0x0, 0x20}}, {{0x5, 0x0, 0x5, 0x9, 0x0, 0x1, 0xffffffff}}, [], {{}, {0x7, 0x0, 0xb, 0x2, 0x0, 0x0, 0x3}, {0x85, 0x0, 0x0, 0x84}}}, &(0x7f00000014c0)='GPL\x00', 0xf, 0x0, 0x0, 0x41100, 0x4b, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0xfffffffc}, 0x94) close_range(r0, r0, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000240)='./proc\x00', 0x1ff) mount(0x0, &(0x7f0000001500)='./proc\x00', &(0x7f0000001540)='proc\x00', 0x0, 0x0) r2 = openat(0xffffffffffffff9c, &(0x7f0000001580)='./proc/thread-self/fail-nth\x00', 0x2, 0x12c) write(r2, &(0x7f00000015c0)='270', 0x3) r3 = syz_open_dev$mtd(&(0x7f0000001600), 0x0, 0x2) r4 = socket$nl_generic(0x10, 0x3, 0x10) r5 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000001640)='cpuacct.usage_percpu_user\x00', 0x26e1, 0x0) close(r5) socketpair$nbd(0x1, 0x1, 0x0, 0x0) r6 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$nl_generic(r6, &(0x7f00000016c0)={0x0, 0x0, &(0x7f0000001700)={&(0x7f0000001740)={0x20, 0x42, 0x100, 0x70bd2e, 0x25dfdbfb, {0x3, 0x7c}, [@nested={0xc, 0x1, 0x0, 0x1, [@typed={0x5, 0x2, 0x0, 0x0, @str='\x00'}]}]}, 0x20}, 0x1, 0x0, 0x0, 0x4048011}, 0x8800) r7 = bpf$MAP_CREATE(0x0, 0x0, 0x50) bpf$MAP_UPDATE_ELEM_TAIL_CALL(0x2, &(0x7f0000001780)={{r7}, &(0x7f00000017c0), &(0x7f0000001800)=r5}, 0x20) r8 = syz_genetlink_get_family_id$mptcp(&(0x7f0000001840), 0xffffffffffffffff) sendmsg$MPTCP_PM_CMD_ADD_ADDR(r4, &(0x7f0000001880)={0x0, 0x0, &(0x7f00000018c0)={&(0x7f0000001900)={0x20, r8, 0x1, 0x0, 0x0, {0x7}, [@MPTCP_PM_ATTR_ADDR={0xc, 0x1, 0x0, 0x1, [@MPTCP_PM_ADDR_ATTR_ID={0x5, 0x2, 0x1}]}]}, 0x20}, 0x1, 0x0, 0x0, 0x80}, 0x8) ioctl$BLKPG(r3, 0x1269, &(0x7f0000001940)={0x1, 0x1f, 0x98, &(0x7f0000001980)={0x3, 0xfffe, 0x12}}) io_setup(0x20fe, 0x0) r9 = syz_open_procfs(0xffffffffffffffff, &(0x7f0000000040)='net/ip6_tables_matches\x00') pread64(r9, &(0x7f0000000380)=""/4082, 0xff2, 0x7fffffff) mkdirat(0xffffffffffffff9c, &(0x7f0000000180)='./proc\x00', 0x1ff) mount(0x0, &(0x7f00000001c0)='./proc\x00', &(0x7f0000000200)='proc\x00', 0x0, 0x0) openat(0xffffffffffffff9c, 0x0, 0x1, 0x0) r10 = socket$netlink(0x10, 0x3, 0x0) sendmsg$netlink(r10, 0x0, 0x800) io_submit(0x0, 0x0, &(0x7f00000000c0)) executing program 3: socket$inet6_tcp(0xa, 0x1, 0x0) poll(&(0x7f0000000040)=[{0xffffffffffffffff, 0x20}, {0xffffffffffffffff, 0xa000}], 0x2, 0x8) r0 = syz_open_procfs(0xffffffffffffffff, &(0x7f0000000080)='attr/fscreate\x00') write$binfmt_script(r0, &(0x7f0000000740)={'#! ', './cgroup/file0aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa'}, 0xff1) socket$nl_route(0x10, 0x3, 0x0) r1 = socket$nl_xfrm(0x10, 0x3, 0x6) r2 = open(&(0x7f00000000c0)='./file0\x00', 0x80140, 0x0) fcntl$setlease(r2, 0x400, 0x1) r3 = socket$inet_tcp(0x2, 0x1, 0x0) bind$inet(r3, &(0x7f0000000100)={0x2, 0x4e20, @broadcast}, 0x10) shutdown(r3, 0x0) shutdown(r3, 0x1) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x3, 0x8031, 0xffffffffffffffff, 0x0) mmap$IORING_OFF_SQ_RING(0x110c230000, 0xc000002, 0x2000007, 0x401d031, 0xffffffffffffffff, 0x0) recvfrom(r3, 0x0, 0x0, 0x3, 0x0, 0x0) r4 = creat(&(0x7f00000001c0)='./file0\x00', 0x0) close_range(r2, r4, 0x0) r5 = socket$nl_route(0x10, 0x3, 0x0) r6 = socket$inet_udp(0x2, 0x2, 0x0) ioctl$sock_SIOCGIFINDEX(r6, 0x8933, &(0x7f0000000200)={'lo\x00', 0x0}) sendmsg$nl_route(r5, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000280)={&(0x7f00000002c0)=ANY=[@ANYBLOB="300000001400030500008000ffdbdf25020751ff", @ANYRES32=r7, @ANYBLOB="08000200"], 0x30}, 0x1, 0x0, 0x0, 0xc090}, 0x0) ioctl$sock_ipv6_tunnel_SIOCADDTUNNEL(r4, 0x89f1, &(0x7f0000000300)={'syztnl0\x00', &(0x7f0000000340)={'ip6tnl0\x00', r7, 0x2f, 0x5, 0xe5, 0x3, 0x20, @private2, @private0={0xfc, 0x0, '\x00', 0x1}, 0x700, 0x80, 0x0, 0x7}}) sendmsg$nl_xfrm(r1, &(0x7f00000003c0)={0x0, 0x0, &(0x7f0000000400)={&(0x7f0000000440)=@polexpire={0xd4, 0x1b, 0x1, 0x0, 0x3, {{{@in6=@private0, @in=@empty, 0x0, 0x0, 0x0, 0x8, 0x0, 0x80, 0x20, 0xf}, {0x0, 0x0, 0x0, 0x3, 0x0, 0xffffffffffffffff, 0xfffffffffffffffc}, {}, 0x0, 0x6e6bb0, 0x0, 0x1, 0x1}}, [@etimer_thresh={0x8, 0xc, 0x8}, @policy_type={0xa, 0x10, {0x1}}]}, 0xd4}, 0x1, 0x0, 0x0, 0x665c3ed30a41084f}, 0x0) r8 = fsopen(&(0x7f0000000540)='cgroup2\x00', 0x1) fsmount(r8, 0x0, 0x0) program crashed: WARNING in add_mtd_blktrans_dev bisect: bisecting 30 programs bisect: split chunks (needed=false): <29> bisect: split chunk #0 of len 29 into 3 parts bisect: testing without sub-chunk 1/3 testing program (duration=35s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): [25, 2, 1, 4, 7, 2, 9, 6, 17, 3, 4, 12, 13, 2, 3, 5, 2, 2, 29, 25] detailed listing: executing program 3: socket$inet6_tcp(0xa, 0x1, 0x0) poll(&(0x7f0000000040)=[{0xffffffffffffffff, 0x20}, {0xffffffffffffffff, 0xa000}], 0x2, 0x8) r0 = syz_open_procfs(0xffffffffffffffff, &(0x7f0000000080)='attr/fscreate\x00') write$binfmt_script(r0, &(0x7f0000000740)={'#! ', './cgroup/file0aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa'}, 0xff1) socket$nl_route(0x10, 0x3, 0x0) r1 = socket$nl_xfrm(0x10, 0x3, 0x6) r2 = open(&(0x7f00000000c0)='./file0\x00', 0x80140, 0x0) fcntl$setlease(r2, 0x400, 0x1) r3 = socket$inet_tcp(0x2, 0x1, 0x0) bind$inet(r3, &(0x7f0000000100)={0x2, 0x4e20, @broadcast}, 0x10) shutdown(r3, 0x0) shutdown(r3, 0x1) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x3, 0x8031, 0xffffffffffffffff, 0x0) mmap$IORING_OFF_SQ_RING(0x110c230000, 0xc000002, 0x2000007, 0x401d031, 0xffffffffffffffff, 0x0) recvfrom(r3, 0x0, 0x0, 0x3, 0x0, 0x0) r4 = creat(&(0x7f00000001c0)='./file0\x00', 0x0) close_range(r2, r4, 0x0) r5 = socket$nl_route(0x10, 0x3, 0x0) r6 = socket$inet_udp(0x2, 0x2, 0x0) ioctl$sock_SIOCGIFINDEX(r6, 0x8933, &(0x7f0000000200)={'lo\x00', 0x0}) sendmsg$nl_route(r5, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000280)={&(0x7f00000002c0)=ANY=[@ANYBLOB="300000001400030500008000ffdbdf25020751ff", @ANYRES32=r7, @ANYBLOB], 0x30}, 0x1, 0x0, 0x0, 0xc090}, 0x0) ioctl$sock_ipv6_tunnel_SIOCADDTUNNEL(r4, 0x89f1, &(0x7f0000000300)={'syztnl0\x00', &(0x7f0000000340)={'ip6tnl0\x00', r7, 0x2f, 0x5, 0xe5, 0x3, 0x20, @private2, @private0={0xfc, 0x0, '\x00', 0x1}, 0x700, 0x80, 0x0, 0x7}}) sendmsg$nl_xfrm(r1, &(0x7f00000003c0)={0x0, 0x0, &(0x7f0000000400)={&(0x7f0000000440)=@polexpire={0xd4, 0x1b, 0x1, 0x0, 0x3, {{{@in6=@private0, @in=@empty, 0x0, 0x0, 0x0, 0x8, 0x0, 0x80, 0x20, 0xf}, {0x0, 0x0, 0x0, 0x3, 0x0, 0xffffffffffffffff, 0xfffffffffffffffc}, {}, 0x0, 0x6e6bb0, 0x0, 0x1, 0x1}}, [@etimer_thresh={0x8, 0xc, 0x8}, @policy_type={0xa, 0x10, {0x1}}]}, 0xd4}, 0x1, 0x0, 0x0, 0x665c3ed30a41084f}, 0x0) r8 = fsopen(&(0x7f0000000540)='cgroup2\x00', 0x1) fsmount(r8, 0x0, 0x0) executing program 1: r0 = openat$vimc0(0xffffffffffffff9c, &(0x7f0000000180), 0x2, 0x0) ioctl$VIDIOC_TRY_EXT_CTRLS(r0, 0xc0205649, &(0x7f00000001c0)={0x60000, 0x7, 0x0, 0xffffffffffffffff, 0x0, &(0x7f0000000200)={0x9e0903, 0x0, '\x00', @value64=0x4}}) executing program 1: syz_emit_ethernet(0x36, &(0x7f0000000680)={@local, @remote, @void, {@ipv4={0x800, @icmp={{0x5, 0x4, 0x0, 0x0, 0x28, 0x0, 0x20, 0x20, 0x2, 0x0, @initdev={0xac, 0x1e, 0x1, 0x0}, @multicast1=0xe0000300}, @timestamp={0xd, 0x0, 0x0, 0xb386, 0x2, 0xd, 0x7, 0x5}}}}}, 0x0) executing program 1: bpf$LINK_GET_NEXT_ID(0x1f, &(0x7f0000000140)={0x0, 0x0}, 0x8) r1 = bpf$LINK_GET_FD_BY_ID(0x1e, &(0x7f0000000180)=r0, 0x4) r2 = bpf$ITER_CREATE(0x21, &(0x7f00000001c0)={r1}, 0x8) read(r2, 0x0, 0x0) executing program 1: openat$nullb(0xffffffffffffff9c, &(0x7f0000000000), 0xc6902, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000040)='./sys\x00', 0x1ff) mount(0x0, &(0x7f0000000080)='./sys\x00', &(0x7f00000000c0)='sysfs\x00', 0x0, 0x0) r0 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./sys/module/kvm/parameters/nx_huge_pages\x00', 0x1, 0x0) mmap(&(0x7f0000000000/0x200000)=nil, 0x200000, 0xa, 0x204031, 0xffffffffffffffff, 0xc9751000) openat$kvm(0xffffff9c, &(0x7f0000000480), 0x20840, 0x0) write(r0, &(0x7f0000000140)='never', 0x5) executing program 1: r0 = socket$inet6_sctp(0xa, 0x1, 0x84) getsockopt$inet_sctp6_SCTP_FRAGMENT_INTERLEAVE(r0, 0x84, 0x12, &(0x7f0000000000), &(0x7f0000000040)=0x4) executing program 0: mkdirat(0xffffffffffffff9c, &(0x7f0000001500)='./dev\x00', 0x1ff) mount(0x0, &(0x7f0000001500)='./dev\x00', &(0x7f0000001600)='devtmpfs\x00', 0x0, 0x0) setsockopt$IPT_SO_SET_REPLACE(0xffffffffffffffff, 0x0, 0x40, &(0x7f0000000000)=@mangle={'mangle\x00', 0x44, 0x6, 0x3c8, 0x168, 0x168, 0x0, 0x200, 0x168, 0x370, 0x370, 0x370, 0x370, 0x370, 0x6, 0x0, {[{{@ip={@multicast1, @dev={0xac, 0x14, 0x14, 0x13}, 0xff, 0xff000000, 'pim6reg1\x00', 'bridge_slave_0\x00', {}, {0xff}, 0x88, 0x3}, 0x0, 0x70, 0x98}, @ECN={0x28, 'ECN\x00', 0x0, {0x30, 0x3, 0x3}}}, {{@ip={@private=0xa010100, @local, 0x0, 0x0, 'vcan0\x00', 'veth0_virt_wifi\x00', {}, {0xff}}, 0x0, 0x70, 0xd0}, @common=@SET={0x60, 'SET\x00', 0x0, {{0x0, [0x0, 0x1], 0x1}, {0x0, [0x0, 0x0, 0x0, 0x2, 0x4]}}}}, {{@ip={@initdev={0xac, 0x1e, 0x0, 0x0}, @local, 0xff, 0xff, 'bond_slave_0\x00', 'veth1_virt_wifi\x00', {}, {0xff}, 0x5c, 0x2}, 0x0, 0x70, 0x98}, @unspec=@CHECKSUM={0x28}}, {{@ip={@private=0xa010102, @multicast1, 0x0, 0xffffff00, 'syzkaller0\x00', 'bond0\x00', {}, {}, 0x0, 0x0, 0x13}, 0x0, 0x70, 0x98}, @unspec=@CHECKSUM={0x28}}, {{@ip={@remote, @loopback, 0x0, 0x0, 'lo\x00', 'batadv_slave_1\x00'}, 0x0, 0x70, 0x98}, @ECN={0x28}}], {{'\x00', 0x0, 0x70, 0x98}, {0x28}}}}, 0x428) mkdirat(0xffffffffffffff9c, &(0x7f0000000080)='./mnt\x00', 0x1ff) mount(&(0x7f00000000c0)=@filename='./dev/sda1\x00', &(0x7f0000000140)='./mnt\x00', &(0x7f0000000100)='ext4\x00', 0x8410, 0x0) mprotect(&(0x7f0000000000/0xf000)=nil, 0xf000, 0x1) r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000140), 0x519c02, 0x0) ioctl$FS_IOC_RESVSP(r0, 0x40305828, &(0x7f0000000040)={0x82, 0x1, 0x6, 0xfffffffffffffffe}) close(0x3) executing program 1: r0 = syz_usb_connect(0x5, 0x2d, &(0x7f0000000000)=ANY=[@ANYBLOB="120100004898b610c2154100201f0102030109021b0001000500ea09040002018c78fd00090582f3c6"], 0x0) syz_usb_control_io$cdc_ncm(r0, &(0x7f0000000040)={0x14, 0x0, &(0x7f0000000080)={0x0, 0x3, 0x1a, {0x1a}}}, 0x0) syz_usb_control_io(r0, 0x0, 0x0) syz_usb_control_io$hid(r0, 0x0, 0x0) r1 = syz_open_dev$evdev(&(0x7f00000000c0), 0x5, 0x40) ioctl$EVIOCSKEYCODE_V2(r1, 0x40284504, &(0x7f0000000100)={0x6, 0x8, 0x3, 0x98, "2a00000000000000441d220fe0bd40edb4b62483d1c87e95d93f18520c4f24b3"}) executing program 3: r0 = socket$nl_xfrm(0x10, 0x3, 0x6) ioctl$SIOCSIFHWADDR(r0, 0x8b14, 0x0) pipe(0x0) r1 = bpf$PROG_LOAD(0x5, &(0x7f000000e000)={0x10, 0x4, &(0x7f0000000040)=ANY=[@ANYBLOB="b4000000000000007910480000000000610400000000000095000080"], &(0x7f0000003ff6)='GPL\x00', 0x2, 0xfd90, &(0x7f000000cf3d)=""/195, 0x0, 0x0, '\x00', 0x0, @sk_msg}, 0x48) close(r1) r2 = socket$inet6(0xa, 0x2, 0x0) bind$inet6(r2, &(0x7f0000f5dfe4)={0xa, 0x4e20}, 0x1c) r3 = bpf$MAP_CREATE(0x0, &(0x7f0000000540)=ANY=[@ANYBLOB="0f00000004000000040000001200"], 0x50) r4 = bpf$PROG_LOAD_XDP(0x5, &(0x7f0000000340)={0xe, 0x4, &(0x7f0000000400)=ANY=[@ANYBLOB="18020000801000000000000004000000850000002700000095"], &(0x7f0000000000)='syzkaller\x00', 0x0, 0x0, 0x0, 0x41000, 0x0, '\x00', 0x0, 0x25, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0x2000}, 0x94) syz_emit_ethernet(0x4e, &(0x7f0000000340)={@local, @multicast, @void, {@ipv6={0x86dd, @udp={0xa, 0x6, "1b8100", 0x18, 0x11, 0x0, @empty, @mcast2, {[], {0x4e25, 0x4e20, 0x18, 0x0, @wg=@data={0x4, 0x5, 0x9}}}}}}}, 0x0) bpf$BPF_PROG_DETACH(0x8, &(0x7f00000006c0)=ANY=[@ANYRES32=r3, @ANYRES32=r4, @ANYBLOB="05"], 0x10) bpf$MAP_UPDATE_ELEM_TAIL_CALL(0x2, &(0x7f00000001c0)={{r3}, &(0x7f0000000140), &(0x7f0000000180)=r1}, 0x20) syz_emit_ethernet(0xbe, &(0x7f0000000000)={@dev={'\xaa\xaa\xaa\xaa\xaa', 0x23}, @dev={'\xaa\xaa\xaa\xaa\xaa', 0xc}, @void, {@ipv4={0x800, @udp={{0x5, 0x4, 0x0, 0x0, 0xb0, 0x0, 0x0, 0x0, 0x11, 0x0, @empty, @empty}, {0x0, 0x4e20, 0x9c, 0x0, @wg=@initiation={0x1, 0x0, "7b4b142b7461fd777b1c012bd14efb9f49fcdb8f080c26a04883ad5c8c82b8af", "584cbf2649a50f2dbc43efa8698d0a881c51852e4451b57d037ad3c04594282423424d00", "bcfd56f1375461caaa2f19935e6996c7096ffeeb0300000000000064", {"9a3bfbc1f39cb307b3472eb9cdb042d2", "643fcbb2c5a57df67d544af6e8dafe09"}}}}}}}, 0x0) bpf$PROG_LOAD_XDP(0x5, &(0x7f0000000140)={0x6, 0x3, &(0x7f0000000680)=ANY=[@ANYBLOB="1800000002000000000000000000000095"], 0x0, 0x2003}, 0x94) syz_genetlink_get_family_id$batadv(&(0x7f0000000080), 0xffffffffffffffff) r5 = bpf$PROG_LOAD_XDP(0x5, &(0x7f0000000480)={0x6, 0x3, &(0x7f0000000680)=ANY=[], &(0x7f0000000200)='syzkaller\x00', 0x9}, 0x94) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f0000000600)={r5, 0x5, 0xb68, 0x0, &(0x7f0000000000)='%', 0x0, 0xd01, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2}, 0x48) executing program 3: r0 = socket$inet_smc(0x2b, 0x1, 0x0) listen(r0, 0xfffffff8) setsockopt$inet_tcp_int(r0, 0x6, 0x1, &(0x7f0000000000)=0x81, 0x4) executing program 4: r0 = socket$nl_generic(0x10, 0x3, 0x10) syz_genetlink_get_family_id$tipc(0x0, 0xffffffffffffffff) sendmsg$TIPC_CMD_ENABLE_BEARER(r0, 0x0, 0x404c050) syz_emit_ethernet(0x16, &(0x7f0000000780)={@local, @remote, @void, {@mpls_mc={0x8848, {[], @llc={@snap={0x0, 0xaa, '!', "468b7f", 0xfbfb}}}}}}, 0x0) executing program 4: r0 = syz_usb_connect(0x0, 0x3f, &(0x7f0000000bc0)=ANY=[@ANYBLOB="11010000733336088dee1edb23610000000109022d0101100000000904000003fe03010009cd8d1f0002000000090505020000fcffff09058b1e20"], 0x0) syz_usb_control_io$printer(r0, 0x0, &(0x7f0000000c00)={0x34, &(0x7f0000000c40)=ANY=[], 0x0, 0x0, 0x0, 0x0, 0x0}) r1 = syz_open_dev$char_usb(0xc, 0xb4, 0x0) ioctl$HIDIOCGUSAGE(r1, 0xc0145b0e, &(0x7f0000000c80)={0x100000, 0x1, 0xffffff7f, 0x0, 0x3, 0xfffffffc}) r2 = creat(&(0x7f0000000080)='./bus\x00', 0x0) r3 = fanotify_init(0xf00, 0x2) fanotify_mark(r3, 0x105, 0x8971, r2, 0x0) mprotect(&(0x7f0000000000/0x3000)=nil, 0x3000, 0x1) r4 = openat$kvm(0xffffffffffffff9c, &(0x7f00000004c0), 0x20042, 0x0) ioctl$KVM_CREATE_VM(r4, 0xae01, 0x0) ioctl$KVM_RUN(0xffffffffffffffff, 0xae80, 0x0) mmap$binder(&(0x7f0000ffd000/0x3000)=nil, 0x3000, 0x1, 0x11, 0xffffffffffffffff, 0x10000000000) executing program 3: r0 = socket$inet6_tcp(0xa, 0x1, 0x0) close(r0) r1 = socket$inet6_mptcp(0xa, 0x1, 0x106) bind$inet6(r0, &(0x7f0000000040)={0xa, 0x4e22, 0x0, @empty, 0x200}, 0x1c) listen(r1, 0x0) r2 = socket$inet_mptcp(0x2, 0x1, 0x106) connect$inet(r2, &(0x7f0000000000)={0x2, 0x4e22, @empty}, 0x10) r3 = accept(r1, 0x0, 0x0) sendmsg$TEAM_CMD_OPTIONS_SET(r3, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000440)={&(0x7f00000004c0)=ANY=[], 0xfffffdef}, 0x1, 0x0, 0x0, 0x24008840}, 0x0) r4 = socket$nl_generic(0x10, 0x3, 0x10) syz_genetlink_get_family_id$mptcp(&(0x7f0000000400), r4) sendmsg$MPTCP_PM_CMD_ADD_ADDR(r4, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000180)={0x0}, 0x1, 0x900}, 0x0) setsockopt$inet_tcp_int(r3, 0x6, 0x1, &(0x7f00000000c0)=0x783a, 0x4) executing program 0: r0 = syz_open_dev$cec(&(0x7f0000000200), 0x0, 0x80240) ioctl$CEC_ADAP_S_LOG_ADDRS(r0, 0xc05c6104, &(0x7f0000000240)={"00000016", 0x0, 0x6, 0x4, 0x7, 0x2, "f759ca34000400", '\t\x00', "03000600", '\x00', ["8bada940edffea0a0800", "c2fed6cb0200004000", "000011cedce100000000ef00", "00080001000000000100"]}) executing program 0: r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$ethtool(&(0x7f0000000280), r0) sendmsg$ETHTOOL_MSG_PAUSE_GET(r0, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000340)={&(0x7f00000000c0)={0x20, r1, 0xfe0cef4d0db3b49, 0x70bd2a, 0x25dfdbff, {}, [@HEADER={0xc, 0x1, 0x0, 0x1, [@ETHTOOL_A_HEADER_DEV_INDEX={0x8}]}]}, 0x20}}, 0x10) executing program 0: sendmsg$kcm(0xffffffffffffffff, &(0x7f0000000480)={0x0, 0x0, &(0x7f0000002240)=[{&(0x7f0000000c40)='2', 0x1}], 0x1}, 0x8400) r0 = socket$packet(0x11, 0x3, 0x300) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000300)={'veth0\x00', 0x0}) setsockopt$packet_int(r0, 0x107, 0xf, &(0x7f0000000380)=0xf3f, 0x4) sendto$packet(r0, &(0x7f00000003c0)="3f03fe7f0312140006001e0089e9aaa911d7c2290f0086dd1327c9167c643c4a1b7880610cc96655b1b141ab059b24d0fbc50df71548a3f6c5609063382a0c153cfdf9435e3ffe46", 0xe90c, 0x0, &(0x7f0000000440)={0xc9, 0x0, r1, 0x1, 0x0, 0x6, @multicast}, 0x14) executing program 0: syz_usb_control_io$uac3(0xffffffffffffffff, &(0x7f00000000c0)={0xfffffffffffffcd0, 0x0, &(0x7f0000000040)={0x0, 0x3, 0x4, @lang_id={0x4, 0x3, 0x3668}}}, 0x0) syz_usb_control_io$uac3(0xffffffffffffffff, &(0x7f0000000000)={0x14, 0x0, &(0x7f0000000200)={0x0, 0x3, 0x4, @string={0x4, 0x3, "5b04"}}}, 0x0) executing program 3: r0 = syz_open_dev$ttys(0xc, 0x2, 0x1) ioctl$TIOCSIG(r0, 0x40045436, 0x0) executing program 0: r0 = openat(0xffffffffffffff9c, &(0x7f0000000000)='./file2\x00', 0x1c9442, 0x19c) r1 = bpf$MAP_CREATE_RINGBUF(0x0, &(0x7f0000000140)=ANY=[@ANYBLOB="1b0000000000000000000000000004"], 0x50) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000001380)={0x11, 0xf, &(0x7f0000001440)=@ringbuf={{0x18, 0x0, 0x0, 0x0, 0x8d, 0x0, 0x0, 0x0, 0xec5}, {{0x18, 0x1, 0x1, 0x0, r1}, {}, {0x7, 0x0, 0xb, 0x3, 0x0, 0x0, 0xfeff}, {0x85, 0x0, 0x0, 0x86}, {0x7, 0x1, 0xb, 0x9, 0x0, 0x20}}, {{0x5, 0x0, 0x5, 0x9, 0x0, 0x1, 0xffffffff}}, [], {{}, {0x7, 0x0, 0xb, 0x2, 0x0, 0x0, 0x3}, {0x85, 0x0, 0x0, 0x84}}}, &(0x7f00000014c0)='GPL\x00', 0xf, 0x0, 0x0, 0x41100, 0x4b, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0xfffffffc}, 0x94) close_range(r0, r0, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000240)='./proc\x00', 0x1ff) mount(0x0, &(0x7f0000001500)='./proc\x00', &(0x7f0000001540)='proc\x00', 0x0, 0x0) r2 = openat(0xffffffffffffff9c, &(0x7f0000001580)='./proc/thread-self/fail-nth\x00', 0x2, 0x12c) write(r2, &(0x7f00000015c0)='270', 0x3) r3 = syz_open_dev$mtd(&(0x7f0000001600), 0x0, 0x2) r4 = socket$nl_generic(0x10, 0x3, 0x10) r5 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000001640)='cpuacct.usage_percpu_user\x00', 0x26e1, 0x0) close(r5) socketpair$nbd(0x1, 0x1, 0x0, 0x0) r6 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$nl_generic(r6, &(0x7f00000016c0)={0x0, 0x0, &(0x7f0000001700)={&(0x7f0000001740)={0x20, 0x42, 0x100, 0x70bd2e, 0x25dfdbfb, {0x3, 0x7c}, [@nested={0xc, 0x1, 0x0, 0x1, [@typed={0x5, 0x2, 0x0, 0x0, @str='\x00'}]}]}, 0x20}, 0x1, 0x0, 0x0, 0x4048011}, 0x8800) r7 = bpf$MAP_CREATE(0x0, 0x0, 0x50) bpf$MAP_UPDATE_ELEM_TAIL_CALL(0x2, &(0x7f0000001780)={{r7}, &(0x7f00000017c0), &(0x7f0000001800)=r5}, 0x20) r8 = syz_genetlink_get_family_id$mptcp(&(0x7f0000001840), 0xffffffffffffffff) sendmsg$MPTCP_PM_CMD_ADD_ADDR(r4, &(0x7f0000001880)={0x0, 0x0, &(0x7f00000018c0)={&(0x7f0000001900)={0x20, r8, 0x1, 0x0, 0x0, {0x7}, [@MPTCP_PM_ATTR_ADDR={0xc, 0x1, 0x0, 0x1, [@MPTCP_PM_ADDR_ATTR_ID={0x5, 0x2, 0x1}]}]}, 0x20}, 0x1, 0x0, 0x0, 0x80}, 0x8) ioctl$BLKPG(r3, 0x1269, &(0x7f0000001940)={0x1, 0x1f, 0x98, &(0x7f0000001980)={0x3, 0xfffe, 0x12}}) io_setup(0x20fe, 0x0) r9 = syz_open_procfs(0xffffffffffffffff, &(0x7f0000000040)='net/ip6_tables_matches\x00') pread64(r9, &(0x7f0000000380)=""/4082, 0xff2, 0x7fffffff) mkdirat(0xffffffffffffff9c, &(0x7f0000000180)='./proc\x00', 0x1ff) mount(0x0, &(0x7f00000001c0)='./proc\x00', &(0x7f0000000200)='proc\x00', 0x0, 0x0) openat(0xffffffffffffff9c, 0x0, 0x1, 0x0) r10 = socket$netlink(0x10, 0x3, 0x0) sendmsg$netlink(r10, 0x0, 0x800) io_submit(0x0, 0x0, &(0x7f00000000c0)) executing program 3: socket$inet6_tcp(0xa, 0x1, 0x0) poll(&(0x7f0000000040)=[{0xffffffffffffffff, 0x20}, {0xffffffffffffffff, 0xa000}], 0x2, 0x8) r0 = syz_open_procfs(0xffffffffffffffff, &(0x7f0000000080)='attr/fscreate\x00') write$binfmt_script(r0, &(0x7f0000000740)={'#! ', './cgroup/file0aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa'}, 0xff1) socket$nl_route(0x10, 0x3, 0x0) r1 = socket$nl_xfrm(0x10, 0x3, 0x6) r2 = open(&(0x7f00000000c0)='./file0\x00', 0x80140, 0x0) fcntl$setlease(r2, 0x400, 0x1) r3 = socket$inet_tcp(0x2, 0x1, 0x0) bind$inet(r3, &(0x7f0000000100)={0x2, 0x4e20, @broadcast}, 0x10) shutdown(r3, 0x0) shutdown(r3, 0x1) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x3, 0x8031, 0xffffffffffffffff, 0x0) mmap$IORING_OFF_SQ_RING(0x110c230000, 0xc000002, 0x2000007, 0x401d031, 0xffffffffffffffff, 0x0) recvfrom(r3, 0x0, 0x0, 0x3, 0x0, 0x0) r4 = creat(&(0x7f00000001c0)='./file0\x00', 0x0) close_range(r2, r4, 0x0) r5 = socket$nl_route(0x10, 0x3, 0x0) r6 = socket$inet_udp(0x2, 0x2, 0x0) ioctl$sock_SIOCGIFINDEX(r6, 0x8933, &(0x7f0000000200)={'lo\x00', 0x0}) sendmsg$nl_route(r5, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000280)={&(0x7f00000002c0)=ANY=[@ANYBLOB="300000001400030500008000ffdbdf25020751ff", @ANYRES32=r7, @ANYBLOB="08000200"], 0x30}, 0x1, 0x0, 0x0, 0xc090}, 0x0) ioctl$sock_ipv6_tunnel_SIOCADDTUNNEL(r4, 0x89f1, &(0x7f0000000300)={'syztnl0\x00', &(0x7f0000000340)={'ip6tnl0\x00', r7, 0x2f, 0x5, 0xe5, 0x3, 0x20, @private2, @private0={0xfc, 0x0, '\x00', 0x1}, 0x700, 0x80, 0x0, 0x7}}) sendmsg$nl_xfrm(r1, &(0x7f00000003c0)={0x0, 0x0, &(0x7f0000000400)={&(0x7f0000000440)=@polexpire={0xd4, 0x1b, 0x1, 0x0, 0x3, {{{@in6=@private0, @in=@empty, 0x0, 0x0, 0x0, 0x8, 0x0, 0x80, 0x20, 0xf}, {0x0, 0x0, 0x0, 0x3, 0x0, 0xffffffffffffffff, 0xfffffffffffffffc}, {}, 0x0, 0x6e6bb0, 0x0, 0x1, 0x1}}, [@etimer_thresh={0x8, 0xc, 0x8}, @policy_type={0xa, 0x10, {0x1}}]}, 0xd4}, 0x1, 0x0, 0x0, 0x665c3ed30a41084f}, 0x0) r8 = fsopen(&(0x7f0000000540)='cgroup2\x00', 0x1) fsmount(r8, 0x0, 0x0) program crashed: WARNING in add_mtd_blktrans_dev bisect: the chunk can be dropped bisect: testing without sub-chunk 2/3 testing program (duration=32s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): [4, 12, 13, 2, 3, 5, 2, 2, 29, 25] detailed listing: executing program 4: r0 = socket$nl_generic(0x10, 0x3, 0x10) syz_genetlink_get_family_id$tipc(0x0, 0xffffffffffffffff) sendmsg$TIPC_CMD_ENABLE_BEARER(r0, 0x0, 0x404c050) syz_emit_ethernet(0x16, &(0x7f0000000780)={@local, @remote, @void, {@mpls_mc={0x8848, {[], @llc={@snap={0x0, 0xaa, '!', "468b7f", 0xfbfb}}}}}}, 0x0) executing program 4: r0 = syz_usb_connect(0x0, 0x3f, &(0x7f0000000bc0)=ANY=[@ANYBLOB="11010000733336088dee1edb23610000000109022d0101100000000904000003fe03010009cd8d1f0002000000090505020000fcffff09058b1e20"], 0x0) syz_usb_control_io$printer(r0, 0x0, &(0x7f0000000c00)={0x34, &(0x7f0000000c40)=ANY=[], 0x0, 0x0, 0x0, 0x0, 0x0}) r1 = syz_open_dev$char_usb(0xc, 0xb4, 0x0) ioctl$HIDIOCGUSAGE(r1, 0xc0145b0e, &(0x7f0000000c80)={0x100000, 0x1, 0xffffff7f, 0x0, 0x3, 0xfffffffc}) r2 = creat(&(0x7f0000000080)='./bus\x00', 0x0) r3 = fanotify_init(0xf00, 0x2) fanotify_mark(r3, 0x105, 0x8971, r2, 0x0) mprotect(&(0x7f0000000000/0x3000)=nil, 0x3000, 0x1) r4 = openat$kvm(0xffffffffffffff9c, &(0x7f00000004c0), 0x20042, 0x0) ioctl$KVM_CREATE_VM(r4, 0xae01, 0x0) ioctl$KVM_RUN(0xffffffffffffffff, 0xae80, 0x0) mmap$binder(&(0x7f0000ffd000/0x3000)=nil, 0x3000, 0x1, 0x11, 0xffffffffffffffff, 0x10000000000) executing program 3: r0 = socket$inet6_tcp(0xa, 0x1, 0x0) close(r0) r1 = socket$inet6_mptcp(0xa, 0x1, 0x106) bind$inet6(r0, &(0x7f0000000040)={0xa, 0x4e22, 0x0, @empty, 0x200}, 0x1c) listen(r1, 0x0) r2 = socket$inet_mptcp(0x2, 0x1, 0x106) connect$inet(r2, &(0x7f0000000000)={0x2, 0x4e22, @empty}, 0x10) r3 = accept(r1, 0x0, 0x0) sendmsg$TEAM_CMD_OPTIONS_SET(r3, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000440)={&(0x7f00000004c0)=ANY=[], 0xfffffdef}, 0x1, 0x0, 0x0, 0x24008840}, 0x0) r4 = socket$nl_generic(0x10, 0x3, 0x10) syz_genetlink_get_family_id$mptcp(&(0x7f0000000400), r4) sendmsg$MPTCP_PM_CMD_ADD_ADDR(r4, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000180)={0x0}, 0x1, 0x900}, 0x0) setsockopt$inet_tcp_int(r3, 0x6, 0x1, &(0x7f00000000c0)=0x783a, 0x4) executing program 0: r0 = syz_open_dev$cec(&(0x7f0000000200), 0x0, 0x80240) ioctl$CEC_ADAP_S_LOG_ADDRS(r0, 0xc05c6104, &(0x7f0000000240)={"00000016", 0x0, 0x6, 0x4, 0x7, 0x2, "f759ca34000400", '\t\x00', "03000600", '\x00', ["8bada940edffea0a0800", "c2fed6cb0200004000", "000011cedce100000000ef00", "00080001000000000100"]}) executing program 0: r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$ethtool(&(0x7f0000000280), r0) sendmsg$ETHTOOL_MSG_PAUSE_GET(r0, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000340)={&(0x7f00000000c0)={0x20, r1, 0xfe0cef4d0db3b49, 0x70bd2a, 0x25dfdbff, {}, [@HEADER={0xc, 0x1, 0x0, 0x1, [@ETHTOOL_A_HEADER_DEV_INDEX={0x8}]}]}, 0x20}}, 0x10) executing program 0: sendmsg$kcm(0xffffffffffffffff, &(0x7f0000000480)={0x0, 0x0, &(0x7f0000002240)=[{&(0x7f0000000c40)='2', 0x1}], 0x1}, 0x8400) r0 = socket$packet(0x11, 0x3, 0x300) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000300)={'veth0\x00', 0x0}) setsockopt$packet_int(r0, 0x107, 0xf, &(0x7f0000000380)=0xf3f, 0x4) sendto$packet(r0, &(0x7f00000003c0)="3f03fe7f0312140006001e0089e9aaa911d7c2290f0086dd1327c9167c643c4a1b7880610cc96655b1b141ab059b24d0fbc50df71548a3f6c5609063382a0c153cfdf9435e3ffe46", 0xe90c, 0x0, &(0x7f0000000440)={0xc9, 0x0, r1, 0x1, 0x0, 0x6, @multicast}, 0x14) executing program 0: syz_usb_control_io$uac3(0xffffffffffffffff, &(0x7f00000000c0)={0xfffffffffffffcd0, 0x0, &(0x7f0000000040)={0x0, 0x3, 0x4, @lang_id={0x4, 0x3, 0x3668}}}, 0x0) syz_usb_control_io$uac3(0xffffffffffffffff, &(0x7f0000000000)={0x14, 0x0, &(0x7f0000000200)={0x0, 0x3, 0x4, @string={0x4, 0x3, "5b04"}}}, 0x0) executing program 3: r0 = syz_open_dev$ttys(0xc, 0x2, 0x1) ioctl$TIOCSIG(r0, 0x40045436, 0x0) executing program 0: r0 = openat(0xffffffffffffff9c, &(0x7f0000000000)='./file2\x00', 0x1c9442, 0x19c) r1 = bpf$MAP_CREATE_RINGBUF(0x0, &(0x7f0000000140)=ANY=[@ANYBLOB="1b0000000000000000000000000004"], 0x50) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000001380)={0x11, 0xf, &(0x7f0000001440)=@ringbuf={{0x18, 0x0, 0x0, 0x0, 0x8d, 0x0, 0x0, 0x0, 0xec5}, {{0x18, 0x1, 0x1, 0x0, r1}, {}, {0x7, 0x0, 0xb, 0x3, 0x0, 0x0, 0xfeff}, {0x85, 0x0, 0x0, 0x86}, {0x7, 0x1, 0xb, 0x9, 0x0, 0x20}}, {{0x5, 0x0, 0x5, 0x9, 0x0, 0x1, 0xffffffff}}, [], {{}, {0x7, 0x0, 0xb, 0x2, 0x0, 0x0, 0x3}, {0x85, 0x0, 0x0, 0x84}}}, &(0x7f00000014c0)='GPL\x00', 0xf, 0x0, 0x0, 0x41100, 0x4b, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0xfffffffc}, 0x94) close_range(r0, r0, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000240)='./proc\x00', 0x1ff) mount(0x0, &(0x7f0000001500)='./proc\x00', &(0x7f0000001540)='proc\x00', 0x0, 0x0) r2 = openat(0xffffffffffffff9c, &(0x7f0000001580)='./proc/thread-self/fail-nth\x00', 0x2, 0x12c) write(r2, &(0x7f00000015c0)='270', 0x3) r3 = syz_open_dev$mtd(&(0x7f0000001600), 0x0, 0x2) r4 = socket$nl_generic(0x10, 0x3, 0x10) r5 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000001640)='cpuacct.usage_percpu_user\x00', 0x26e1, 0x0) close(r5) socketpair$nbd(0x1, 0x1, 0x0, 0x0) r6 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$nl_generic(r6, &(0x7f00000016c0)={0x0, 0x0, &(0x7f0000001700)={&(0x7f0000001740)={0x20, 0x42, 0x100, 0x70bd2e, 0x25dfdbfb, {0x3, 0x7c}, [@nested={0xc, 0x1, 0x0, 0x1, [@typed={0x5, 0x2, 0x0, 0x0, @str='\x00'}]}]}, 0x20}, 0x1, 0x0, 0x0, 0x4048011}, 0x8800) r7 = bpf$MAP_CREATE(0x0, 0x0, 0x50) bpf$MAP_UPDATE_ELEM_TAIL_CALL(0x2, &(0x7f0000001780)={{r7}, &(0x7f00000017c0), &(0x7f0000001800)=r5}, 0x20) r8 = syz_genetlink_get_family_id$mptcp(&(0x7f0000001840), 0xffffffffffffffff) sendmsg$MPTCP_PM_CMD_ADD_ADDR(r4, &(0x7f0000001880)={0x0, 0x0, &(0x7f00000018c0)={&(0x7f0000001900)={0x20, r8, 0x1, 0x0, 0x0, {0x7}, [@MPTCP_PM_ATTR_ADDR={0xc, 0x1, 0x0, 0x1, [@MPTCP_PM_ADDR_ATTR_ID={0x5, 0x2, 0x1}]}]}, 0x20}, 0x1, 0x0, 0x0, 0x80}, 0x8) ioctl$BLKPG(r3, 0x1269, &(0x7f0000001940)={0x1, 0x1f, 0x98, &(0x7f0000001980)={0x3, 0xfffe, 0x12}}) io_setup(0x20fe, 0x0) r9 = syz_open_procfs(0xffffffffffffffff, &(0x7f0000000040)='net/ip6_tables_matches\x00') pread64(r9, &(0x7f0000000380)=""/4082, 0xff2, 0x7fffffff) mkdirat(0xffffffffffffff9c, &(0x7f0000000180)='./proc\x00', 0x1ff) mount(0x0, &(0x7f00000001c0)='./proc\x00', &(0x7f0000000200)='proc\x00', 0x0, 0x0) openat(0xffffffffffffff9c, 0x0, 0x1, 0x0) r10 = socket$netlink(0x10, 0x3, 0x0) sendmsg$netlink(r10, 0x0, 0x800) io_submit(0x0, 0x0, &(0x7f00000000c0)) executing program 3: socket$inet6_tcp(0xa, 0x1, 0x0) poll(&(0x7f0000000040)=[{0xffffffffffffffff, 0x20}, {0xffffffffffffffff, 0xa000}], 0x2, 0x8) r0 = syz_open_procfs(0xffffffffffffffff, &(0x7f0000000080)='attr/fscreate\x00') write$binfmt_script(r0, &(0x7f0000000740)={'#! ', './cgroup/file0aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa'}, 0xff1) socket$nl_route(0x10, 0x3, 0x0) r1 = socket$nl_xfrm(0x10, 0x3, 0x6) r2 = open(&(0x7f00000000c0)='./file0\x00', 0x80140, 0x0) fcntl$setlease(r2, 0x400, 0x1) r3 = socket$inet_tcp(0x2, 0x1, 0x0) bind$inet(r3, &(0x7f0000000100)={0x2, 0x4e20, @broadcast}, 0x10) shutdown(r3, 0x0) shutdown(r3, 0x1) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x3, 0x8031, 0xffffffffffffffff, 0x0) mmap$IORING_OFF_SQ_RING(0x110c230000, 0xc000002, 0x2000007, 0x401d031, 0xffffffffffffffff, 0x0) recvfrom(r3, 0x0, 0x0, 0x3, 0x0, 0x0) r4 = creat(&(0x7f00000001c0)='./file0\x00', 0x0) close_range(r2, r4, 0x0) r5 = socket$nl_route(0x10, 0x3, 0x0) r6 = socket$inet_udp(0x2, 0x2, 0x0) ioctl$sock_SIOCGIFINDEX(r6, 0x8933, &(0x7f0000000200)={'lo\x00', 0x0}) sendmsg$nl_route(r5, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000280)={&(0x7f00000002c0)=ANY=[@ANYBLOB="300000001400030500008000ffdbdf25020751ff", @ANYRES32=r7, @ANYBLOB="08000200"], 0x30}, 0x1, 0x0, 0x0, 0xc090}, 0x0) ioctl$sock_ipv6_tunnel_SIOCADDTUNNEL(r4, 0x89f1, &(0x7f0000000300)={'syztnl0\x00', &(0x7f0000000340)={'ip6tnl0\x00', r7, 0x2f, 0x5, 0xe5, 0x3, 0x20, @private2, @private0={0xfc, 0x0, '\x00', 0x1}, 0x700, 0x80, 0x0, 0x7}}) sendmsg$nl_xfrm(r1, &(0x7f00000003c0)={0x0, 0x0, &(0x7f0000000400)={&(0x7f0000000440)=@polexpire={0xd4, 0x1b, 0x1, 0x0, 0x3, {{{@in6=@private0, @in=@empty, 0x0, 0x0, 0x0, 0x8, 0x0, 0x80, 0x20, 0xf}, {0x0, 0x0, 0x0, 0x3, 0x0, 0xffffffffffffffff, 0xfffffffffffffffc}, {}, 0x0, 0x6e6bb0, 0x0, 0x1, 0x1}}, [@etimer_thresh={0x8, 0xc, 0x8}, @policy_type={0xa, 0x10, {0x1}}]}, 0xd4}, 0x1, 0x0, 0x0, 0x665c3ed30a41084f}, 0x0) r8 = fsopen(&(0x7f0000000540)='cgroup2\x00', 0x1) fsmount(r8, 0x0, 0x0) program crashed: WARNING in add_mtd_blktrans_dev bisect: the chunk can be dropped bisect: testing without sub-chunk 3/3 testing program (duration=30s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): openat-bpf$MAP_CREATE_RINGBUF-bpf$BPF_PROG_RAW_TRACEPOINT_LOAD-close_range-mkdirat-mount-openat-write-syz_open_dev$mtd-socket$nl_generic-openat$cgroup_ro-close-socketpair$nbd-socket$nl_generic-sendmsg$nl_generic-bpf$MAP_CREATE-bpf$MAP_UPDATE_ELEM_TAIL_CALL-syz_genetlink_get_family_id$mptcp-sendmsg$MPTCP_PM_CMD_ADD_ADDR-ioctl$BLKPG-io_setup-syz_open_procfs-pread64-mkdirat-mount-openat-socket$netlink-sendmsg$netlink-io_submit detailed listing: executing program 0: r0 = openat(0xffffffffffffff9c, &(0x7f0000000000)='./file2\x00', 0x1c9442, 0x19c) r1 = bpf$MAP_CREATE_RINGBUF(0x0, &(0x7f0000000140)=ANY=[@ANYBLOB="1b0000000000000000000000000004"], 0x50) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000001380)={0x11, 0xf, &(0x7f0000001440)=@ringbuf={{0x18, 0x0, 0x0, 0x0, 0x8d, 0x0, 0x0, 0x0, 0xec5}, {{0x18, 0x1, 0x1, 0x0, r1}, {}, {0x7, 0x0, 0xb, 0x3, 0x0, 0x0, 0xfeff}, {0x85, 0x0, 0x0, 0x86}, {0x7, 0x1, 0xb, 0x9, 0x0, 0x20}}, {{0x5, 0x0, 0x5, 0x9, 0x0, 0x1, 0xffffffff}}, [], {{}, {0x7, 0x0, 0xb, 0x2, 0x0, 0x0, 0x3}, {0x85, 0x0, 0x0, 0x84}}}, &(0x7f00000014c0)='GPL\x00', 0xf, 0x0, 0x0, 0x41100, 0x4b, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0xfffffffc}, 0x94) close_range(r0, r0, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000240)='./proc\x00', 0x1ff) mount(0x0, &(0x7f0000001500)='./proc\x00', &(0x7f0000001540)='proc\x00', 0x0, 0x0) r2 = openat(0xffffffffffffff9c, &(0x7f0000001580)='./proc/thread-self/fail-nth\x00', 0x2, 0x12c) write(r2, &(0x7f00000015c0)='270', 0x3) r3 = syz_open_dev$mtd(&(0x7f0000001600), 0x0, 0x2) r4 = socket$nl_generic(0x10, 0x3, 0x10) r5 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000001640)='cpuacct.usage_percpu_user\x00', 0x26e1, 0x0) close(r5) socketpair$nbd(0x1, 0x1, 0x0, 0x0) r6 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$nl_generic(r6, &(0x7f00000016c0)={0x0, 0x0, &(0x7f0000001700)={&(0x7f0000001740)={0x20, 0x42, 0x100, 0x70bd2e, 0x25dfdbfb, {0x3, 0x7c}, [@nested={0xc, 0x1, 0x0, 0x1, [@typed={0x5, 0x2, 0x0, 0x0, @str='\x00'}]}]}, 0x20}, 0x1, 0x0, 0x0, 0x4048011}, 0x8800) r7 = bpf$MAP_CREATE(0x0, 0x0, 0x50) bpf$MAP_UPDATE_ELEM_TAIL_CALL(0x2, &(0x7f0000001780)={{r7}, &(0x7f00000017c0), &(0x7f0000001800)=r5}, 0x20) r8 = syz_genetlink_get_family_id$mptcp(&(0x7f0000001840), 0xffffffffffffffff) sendmsg$MPTCP_PM_CMD_ADD_ADDR(r4, &(0x7f0000001880)={0x0, 0x0, &(0x7f00000018c0)={&(0x7f0000001900)={0x20, r8, 0x1, 0x0, 0x0, {0x7}, [@MPTCP_PM_ATTR_ADDR={0xc, 0x1, 0x0, 0x1, [@MPTCP_PM_ADDR_ATTR_ID={0x5, 0x2, 0x1}]}]}, 0x20}, 0x1, 0x0, 0x0, 0x80}, 0x8) ioctl$BLKPG(r3, 0x1269, &(0x7f0000001940)={0x1, 0x1f, 0x98, &(0x7f0000001980)={0x3, 0xfffe, 0x12}}) io_setup(0x20fe, 0x0) r9 = syz_open_procfs(0xffffffffffffffff, &(0x7f0000000040)='net/ip6_tables_matches\x00') pread64(r9, &(0x7f0000000380)=""/4082, 0xff2, 0x7fffffff) mkdirat(0xffffffffffffff9c, &(0x7f0000000180)='./proc\x00', 0x1ff) mount(0x0, &(0x7f00000001c0)='./proc\x00', &(0x7f0000000200)='proc\x00', 0x0, 0x0) openat(0xffffffffffffff9c, 0x0, 0x1, 0x0) r10 = socket$netlink(0x10, 0x3, 0x0) sendmsg$netlink(r10, 0x0, 0x800) io_submit(0x0, 0x0, &(0x7f00000000c0)) program crashed: WARNING in add_mtd_blktrans_dev bisect: the chunk can be dropped bisect: 1 programs left: executing program 0: r0 = openat(0xffffffffffffff9c, &(0x7f0000000000)='./file2\x00', 0x1c9442, 0x19c) r1 = bpf$MAP_CREATE_RINGBUF(0x0, &(0x7f0000000140)=ANY=[@ANYBLOB="1b0000000000000000000000000004"], 0x50) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000001380)={0x11, 0xf, &(0x7f0000001440)=@ringbuf={{0x18, 0x0, 0x0, 0x0, 0x8d, 0x0, 0x0, 0x0, 0xec5}, {{0x18, 0x1, 0x1, 0x0, r1}, {}, {0x7, 0x0, 0xb, 0x3, 0x0, 0x0, 0xfeff}, {0x85, 0x0, 0x0, 0x86}, {0x7, 0x1, 0xb, 0x9, 0x0, 0x20}}, {{0x5, 0x0, 0x5, 0x9, 0x0, 0x1, 0xffffffff}}, [], {{}, {0x7, 0x0, 0xb, 0x2, 0x0, 0x0, 0x3}, {0x85, 0x0, 0x0, 0x84}}}, &(0x7f00000014c0)='GPL\x00', 0xf, 0x0, 0x0, 0x41100, 0x4b, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0xfffffffc}, 0x94) close_range(r0, r0, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000240)='./proc\x00', 0x1ff) mount(0x0, &(0x7f0000001500)='./proc\x00', &(0x7f0000001540)='proc\x00', 0x0, 0x0) r2 = openat(0xffffffffffffff9c, &(0x7f0000001580)='./proc/thread-self/fail-nth\x00', 0x2, 0x12c) write(r2, &(0x7f00000015c0)='270', 0x3) r3 = syz_open_dev$mtd(&(0x7f0000001600), 0x0, 0x2) r4 = socket$nl_generic(0x10, 0x3, 0x10) r5 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000001640)='cpuacct.usage_percpu_user\x00', 0x26e1, 0x0) close(r5) socketpair$nbd(0x1, 0x1, 0x0, 0x0) r6 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$nl_generic(r6, &(0x7f00000016c0)={0x0, 0x0, &(0x7f0000001700)={&(0x7f0000001740)={0x20, 0x42, 0x100, 0x70bd2e, 0x25dfdbfb, {0x3, 0x7c}, [@nested={0xc, 0x1, 0x0, 0x1, [@typed={0x5, 0x2, 0x0, 0x0, @str='\x00'}]}]}, 0x20}, 0x1, 0x0, 0x0, 0x4048011}, 0x8800) r7 = bpf$MAP_CREATE(0x0, 0x0, 0x50) bpf$MAP_UPDATE_ELEM_TAIL_CALL(0x2, &(0x7f0000001780)={{r7}, &(0x7f00000017c0), &(0x7f0000001800)=r5}, 0x20) r8 = syz_genetlink_get_family_id$mptcp(&(0x7f0000001840), 0xffffffffffffffff) sendmsg$MPTCP_PM_CMD_ADD_ADDR(r4, &(0x7f0000001880)={0x0, 0x0, &(0x7f00000018c0)={&(0x7f0000001900)={0x20, r8, 0x1, 0x0, 0x0, {0x7}, [@MPTCP_PM_ATTR_ADDR={0xc, 0x1, 0x0, 0x1, [@MPTCP_PM_ADDR_ATTR_ID={0x5, 0x2, 0x1}]}]}, 0x20}, 0x1, 0x0, 0x0, 0x80}, 0x8) ioctl$BLKPG(r3, 0x1269, &(0x7f0000001940)={0x1, 0x1f, 0x98, &(0x7f0000001980)={0x3, 0xfffe, 0x12}}) io_setup(0x20fe, 0x0) r9 = syz_open_procfs(0xffffffffffffffff, &(0x7f0000000040)='net/ip6_tables_matches\x00') pread64(r9, &(0x7f0000000380)=""/4082, 0xff2, 0x7fffffff) mkdirat(0xffffffffffffff9c, &(0x7f0000000180)='./proc\x00', 0x1ff) mount(0x0, &(0x7f00000001c0)='./proc\x00', &(0x7f0000000200)='proc\x00', 0x0, 0x0) openat(0xffffffffffffff9c, 0x0, 0x1, 0x0) r10 = socket$netlink(0x10, 0x3, 0x0) sendmsg$netlink(r10, 0x0, 0x800) io_submit(0x0, 0x0, &(0x7f00000000c0)) bisect: trying to concatenate bisect: concatenate 1 entries testing program (duration=45s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): openat-bpf$MAP_CREATE_RINGBUF-bpf$BPF_PROG_RAW_TRACEPOINT_LOAD-close_range-mkdirat-mount-openat-write-syz_open_dev$mtd-socket$nl_generic-openat$cgroup_ro-close-socketpair$nbd-socket$nl_generic-sendmsg$nl_generic-bpf$MAP_CREATE-bpf$MAP_UPDATE_ELEM_TAIL_CALL-syz_genetlink_get_family_id$mptcp-sendmsg$MPTCP_PM_CMD_ADD_ADDR-ioctl$BLKPG-io_setup-syz_open_procfs-pread64-mkdirat-mount-openat-socket$netlink-sendmsg$netlink-io_submit detailed listing: executing program 0: r0 = openat(0xffffffffffffff9c, &(0x7f0000000000)='./file2\x00', 0x1c9442, 0x19c) r1 = bpf$MAP_CREATE_RINGBUF(0x0, &(0x7f0000000140)=ANY=[@ANYBLOB="1b0000000000000000000000000004"], 0x50) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000001380)={0x11, 0xf, &(0x7f0000001440)=@ringbuf={{0x18, 0x0, 0x0, 0x0, 0x8d, 0x0, 0x0, 0x0, 0xec5}, {{0x18, 0x1, 0x1, 0x0, r1}, {}, {0x7, 0x0, 0xb, 0x3, 0x0, 0x0, 0xfeff}, {0x85, 0x0, 0x0, 0x86}, {0x7, 0x1, 0xb, 0x9, 0x0, 0x20}}, {{0x5, 0x0, 0x5, 0x9, 0x0, 0x1, 0xffffffff}}, [], {{}, {0x7, 0x0, 0xb, 0x2, 0x0, 0x0, 0x3}, {0x85, 0x0, 0x0, 0x84}}}, &(0x7f00000014c0)='GPL\x00', 0xf, 0x0, 0x0, 0x41100, 0x4b, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0xfffffffc}, 0x94) close_range(r0, r0, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000240)='./proc\x00', 0x1ff) mount(0x0, &(0x7f0000001500)='./proc\x00', &(0x7f0000001540)='proc\x00', 0x0, 0x0) r2 = openat(0xffffffffffffff9c, &(0x7f0000001580)='./proc/thread-self/fail-nth\x00', 0x2, 0x12c) write(r2, &(0x7f00000015c0)='270', 0x3) r3 = syz_open_dev$mtd(&(0x7f0000001600), 0x0, 0x2) r4 = socket$nl_generic(0x10, 0x3, 0x10) r5 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000001640)='cpuacct.usage_percpu_user\x00', 0x26e1, 0x0) close(r5) socketpair$nbd(0x1, 0x1, 0x0, 0x0) r6 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$nl_generic(r6, &(0x7f00000016c0)={0x0, 0x0, &(0x7f0000001700)={&(0x7f0000001740)={0x20, 0x42, 0x100, 0x70bd2e, 0x25dfdbfb, {0x3, 0x7c}, [@nested={0xc, 0x1, 0x0, 0x1, [@typed={0x5, 0x2, 0x0, 0x0, @str='\x00'}]}]}, 0x20}, 0x1, 0x0, 0x0, 0x4048011}, 0x8800) r7 = bpf$MAP_CREATE(0x0, 0x0, 0x50) bpf$MAP_UPDATE_ELEM_TAIL_CALL(0x2, &(0x7f0000001780)={{r7}, &(0x7f00000017c0), &(0x7f0000001800)=r5}, 0x20) r8 = syz_genetlink_get_family_id$mptcp(&(0x7f0000001840), 0xffffffffffffffff) sendmsg$MPTCP_PM_CMD_ADD_ADDR(r4, &(0x7f0000001880)={0x0, 0x0, &(0x7f00000018c0)={&(0x7f0000001900)={0x20, r8, 0x1, 0x0, 0x0, {0x7}, [@MPTCP_PM_ATTR_ADDR={0xc, 0x1, 0x0, 0x1, [@MPTCP_PM_ADDR_ATTR_ID={0x5, 0x2, 0x1}]}]}, 0x20}, 0x1, 0x0, 0x0, 0x80}, 0x8) ioctl$BLKPG(r3, 0x1269, &(0x7f0000001940)={0x1, 0x1f, 0x98, &(0x7f0000001980)={0x3, 0xfffe, 0x12}}) io_setup(0x20fe, 0x0) r9 = syz_open_procfs(0xffffffffffffffff, &(0x7f0000000040)='net/ip6_tables_matches\x00') pread64(r9, &(0x7f0000000380)=""/4082, 0xff2, 0x7fffffff) mkdirat(0xffffffffffffff9c, &(0x7f0000000180)='./proc\x00', 0x1ff) mount(0x0, &(0x7f00000001c0)='./proc\x00', &(0x7f0000000200)='proc\x00', 0x0, 0x0) openat(0xffffffffffffff9c, 0x0, 0x1, 0x0) r10 = socket$netlink(0x10, 0x3, 0x0) sendmsg$netlink(r10, 0x0, 0x800) io_submit(0x0, 0x0, &(0x7f00000000c0)) program crashed: WARNING in add_mtd_blktrans_dev bisect: concatenation succeeded found reproducer with 29 syscalls minimizing guilty program testing program (duration=45s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): openat-bpf$MAP_CREATE_RINGBUF-bpf$BPF_PROG_RAW_TRACEPOINT_LOAD-close_range-mkdirat-mount-openat-write-syz_open_dev$mtd-socket$nl_generic-openat$cgroup_ro-close-socketpair$nbd-socket$nl_generic-sendmsg$nl_generic-bpf$MAP_CREATE-bpf$MAP_UPDATE_ELEM_TAIL_CALL-syz_genetlink_get_family_id$mptcp-sendmsg$MPTCP_PM_CMD_ADD_ADDR-ioctl$BLKPG-io_setup-syz_open_procfs-pread64-mkdirat-mount-openat-socket$netlink-sendmsg$netlink detailed listing: executing program 0: r0 = openat(0xffffffffffffff9c, &(0x7f0000000000)='./file2\x00', 0x1c9442, 0x19c) r1 = bpf$MAP_CREATE_RINGBUF(0x0, &(0x7f0000000140)=ANY=[@ANYBLOB="1b0000000000000000000000000004"], 0x50) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000001380)={0x11, 0xf, &(0x7f0000001440)=@ringbuf={{0x18, 0x0, 0x0, 0x0, 0x8d, 0x0, 0x0, 0x0, 0xec5}, {{0x18, 0x1, 0x1, 0x0, r1}, {}, {0x7, 0x0, 0xb, 0x3, 0x0, 0x0, 0xfeff}, {0x85, 0x0, 0x0, 0x86}, {0x7, 0x1, 0xb, 0x9, 0x0, 0x20}}, {{0x5, 0x0, 0x5, 0x9, 0x0, 0x1, 0xffffffff}}, [], {{}, {0x7, 0x0, 0xb, 0x2, 0x0, 0x0, 0x3}, {0x85, 0x0, 0x0, 0x84}}}, &(0x7f00000014c0)='GPL\x00', 0xf, 0x0, 0x0, 0x41100, 0x4b, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0xfffffffc}, 0x94) close_range(r0, r0, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000240)='./proc\x00', 0x1ff) mount(0x0, &(0x7f0000001500)='./proc\x00', &(0x7f0000001540)='proc\x00', 0x0, 0x0) r2 = openat(0xffffffffffffff9c, &(0x7f0000001580)='./proc/thread-self/fail-nth\x00', 0x2, 0x12c) write(r2, &(0x7f00000015c0)='270', 0x3) r3 = syz_open_dev$mtd(&(0x7f0000001600), 0x0, 0x2) r4 = socket$nl_generic(0x10, 0x3, 0x10) r5 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000001640)='cpuacct.usage_percpu_user\x00', 0x26e1, 0x0) close(r5) socketpair$nbd(0x1, 0x1, 0x0, 0x0) r6 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$nl_generic(r6, &(0x7f00000016c0)={0x0, 0x0, &(0x7f0000001700)={&(0x7f0000001740)={0x20, 0x42, 0x100, 0x70bd2e, 0x25dfdbfb, {0x3, 0x7c}, [@nested={0xc, 0x1, 0x0, 0x1, [@typed={0x5, 0x2, 0x0, 0x0, @str='\x00'}]}]}, 0x20}, 0x1, 0x0, 0x0, 0x4048011}, 0x8800) r7 = bpf$MAP_CREATE(0x0, 0x0, 0x50) bpf$MAP_UPDATE_ELEM_TAIL_CALL(0x2, &(0x7f0000001780)={{r7}, &(0x7f00000017c0), &(0x7f0000001800)=r5}, 0x20) r8 = syz_genetlink_get_family_id$mptcp(&(0x7f0000001840), 0xffffffffffffffff) sendmsg$MPTCP_PM_CMD_ADD_ADDR(r4, &(0x7f0000001880)={0x0, 0x0, &(0x7f00000018c0)={&(0x7f0000001900)={0x20, r8, 0x1, 0x0, 0x0, {0x7}, [@MPTCP_PM_ATTR_ADDR={0xc, 0x1, 0x0, 0x1, [@MPTCP_PM_ADDR_ATTR_ID={0x5, 0x2, 0x1}]}]}, 0x20}, 0x1, 0x0, 0x0, 0x80}, 0x8) ioctl$BLKPG(r3, 0x1269, &(0x7f0000001940)={0x1, 0x1f, 0x98, &(0x7f0000001980)={0x3, 0xfffe, 0x12}}) io_setup(0x20fe, 0x0) r9 = syz_open_procfs(0xffffffffffffffff, &(0x7f0000000040)='net/ip6_tables_matches\x00') pread64(r9, &(0x7f0000000380)=""/4082, 0xff2, 0x7fffffff) mkdirat(0xffffffffffffff9c, &(0x7f0000000180)='./proc\x00', 0x1ff) mount(0x0, &(0x7f00000001c0)='./proc\x00', &(0x7f0000000200)='proc\x00', 0x0, 0x0) openat(0xffffffffffffff9c, 0x0, 0x1, 0x0) r10 = socket$netlink(0x10, 0x3, 0x0) sendmsg$netlink(r10, 0x0, 0x800) program crashed: WARNING in add_mtd_blktrans_dev testing program (duration=45s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): openat-bpf$MAP_CREATE_RINGBUF-bpf$BPF_PROG_RAW_TRACEPOINT_LOAD-close_range-mkdirat-mount-openat-write-syz_open_dev$mtd-socket$nl_generic-openat$cgroup_ro-close-socketpair$nbd-socket$nl_generic-sendmsg$nl_generic-bpf$MAP_CREATE-bpf$MAP_UPDATE_ELEM_TAIL_CALL-syz_genetlink_get_family_id$mptcp-sendmsg$MPTCP_PM_CMD_ADD_ADDR-ioctl$BLKPG-io_setup-syz_open_procfs-pread64-mkdirat-mount-openat-socket$netlink detailed listing: executing program 0: r0 = openat(0xffffffffffffff9c, &(0x7f0000000000)='./file2\x00', 0x1c9442, 0x19c) r1 = bpf$MAP_CREATE_RINGBUF(0x0, &(0x7f0000000140)=ANY=[@ANYBLOB="1b0000000000000000000000000004"], 0x50) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000001380)={0x11, 0xf, &(0x7f0000001440)=@ringbuf={{0x18, 0x0, 0x0, 0x0, 0x8d, 0x0, 0x0, 0x0, 0xec5}, {{0x18, 0x1, 0x1, 0x0, r1}, {}, {0x7, 0x0, 0xb, 0x3, 0x0, 0x0, 0xfeff}, {0x85, 0x0, 0x0, 0x86}, {0x7, 0x1, 0xb, 0x9, 0x0, 0x20}}, {{0x5, 0x0, 0x5, 0x9, 0x0, 0x1, 0xffffffff}}, [], {{}, {0x7, 0x0, 0xb, 0x2, 0x0, 0x0, 0x3}, {0x85, 0x0, 0x0, 0x84}}}, &(0x7f00000014c0)='GPL\x00', 0xf, 0x0, 0x0, 0x41100, 0x4b, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0xfffffffc}, 0x94) close_range(r0, r0, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000240)='./proc\x00', 0x1ff) mount(0x0, &(0x7f0000001500)='./proc\x00', &(0x7f0000001540)='proc\x00', 0x0, 0x0) r2 = openat(0xffffffffffffff9c, &(0x7f0000001580)='./proc/thread-self/fail-nth\x00', 0x2, 0x12c) write(r2, &(0x7f00000015c0)='270', 0x3) r3 = syz_open_dev$mtd(&(0x7f0000001600), 0x0, 0x2) r4 = socket$nl_generic(0x10, 0x3, 0x10) r5 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000001640)='cpuacct.usage_percpu_user\x00', 0x26e1, 0x0) close(r5) socketpair$nbd(0x1, 0x1, 0x0, 0x0) r6 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$nl_generic(r6, &(0x7f00000016c0)={0x0, 0x0, &(0x7f0000001700)={&(0x7f0000001740)={0x20, 0x42, 0x100, 0x70bd2e, 0x25dfdbfb, {0x3, 0x7c}, [@nested={0xc, 0x1, 0x0, 0x1, [@typed={0x5, 0x2, 0x0, 0x0, @str='\x00'}]}]}, 0x20}, 0x1, 0x0, 0x0, 0x4048011}, 0x8800) r7 = bpf$MAP_CREATE(0x0, 0x0, 0x50) bpf$MAP_UPDATE_ELEM_TAIL_CALL(0x2, &(0x7f0000001780)={{r7}, &(0x7f00000017c0), &(0x7f0000001800)=r5}, 0x20) r8 = syz_genetlink_get_family_id$mptcp(&(0x7f0000001840), 0xffffffffffffffff) sendmsg$MPTCP_PM_CMD_ADD_ADDR(r4, &(0x7f0000001880)={0x0, 0x0, &(0x7f00000018c0)={&(0x7f0000001900)={0x20, r8, 0x1, 0x0, 0x0, {0x7}, [@MPTCP_PM_ATTR_ADDR={0xc, 0x1, 0x0, 0x1, [@MPTCP_PM_ADDR_ATTR_ID={0x5, 0x2, 0x1}]}]}, 0x20}, 0x1, 0x0, 0x0, 0x80}, 0x8) ioctl$BLKPG(r3, 0x1269, &(0x7f0000001940)={0x1, 0x1f, 0x98, &(0x7f0000001980)={0x3, 0xfffe, 0x12}}) io_setup(0x20fe, 0x0) r9 = syz_open_procfs(0xffffffffffffffff, &(0x7f0000000040)='net/ip6_tables_matches\x00') pread64(r9, &(0x7f0000000380)=""/4082, 0xff2, 0x7fffffff) mkdirat(0xffffffffffffff9c, &(0x7f0000000180)='./proc\x00', 0x1ff) mount(0x0, &(0x7f00000001c0)='./proc\x00', &(0x7f0000000200)='proc\x00', 0x0, 0x0) openat(0xffffffffffffff9c, 0x0, 0x1, 0x0) socket$netlink(0x10, 0x3, 0x0) program crashed: WARNING in add_mtd_blktrans_dev testing program (duration=45s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): openat-bpf$MAP_CREATE_RINGBUF-bpf$BPF_PROG_RAW_TRACEPOINT_LOAD-close_range-mkdirat-mount-openat-write-syz_open_dev$mtd-socket$nl_generic-openat$cgroup_ro-close-socketpair$nbd-socket$nl_generic-sendmsg$nl_generic-bpf$MAP_CREATE-bpf$MAP_UPDATE_ELEM_TAIL_CALL-syz_genetlink_get_family_id$mptcp-sendmsg$MPTCP_PM_CMD_ADD_ADDR-ioctl$BLKPG-io_setup-syz_open_procfs-pread64-mkdirat-mount-openat detailed listing: executing program 0: r0 = openat(0xffffffffffffff9c, &(0x7f0000000000)='./file2\x00', 0x1c9442, 0x19c) r1 = bpf$MAP_CREATE_RINGBUF(0x0, &(0x7f0000000140)=ANY=[@ANYBLOB="1b0000000000000000000000000004"], 0x50) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000001380)={0x11, 0xf, &(0x7f0000001440)=@ringbuf={{0x18, 0x0, 0x0, 0x0, 0x8d, 0x0, 0x0, 0x0, 0xec5}, {{0x18, 0x1, 0x1, 0x0, r1}, {}, {0x7, 0x0, 0xb, 0x3, 0x0, 0x0, 0xfeff}, {0x85, 0x0, 0x0, 0x86}, {0x7, 0x1, 0xb, 0x9, 0x0, 0x20}}, {{0x5, 0x0, 0x5, 0x9, 0x0, 0x1, 0xffffffff}}, [], {{}, {0x7, 0x0, 0xb, 0x2, 0x0, 0x0, 0x3}, {0x85, 0x0, 0x0, 0x84}}}, &(0x7f00000014c0)='GPL\x00', 0xf, 0x0, 0x0, 0x41100, 0x4b, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0xfffffffc}, 0x94) close_range(r0, r0, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000240)='./proc\x00', 0x1ff) mount(0x0, &(0x7f0000001500)='./proc\x00', &(0x7f0000001540)='proc\x00', 0x0, 0x0) r2 = openat(0xffffffffffffff9c, &(0x7f0000001580)='./proc/thread-self/fail-nth\x00', 0x2, 0x12c) write(r2, &(0x7f00000015c0)='270', 0x3) r3 = syz_open_dev$mtd(&(0x7f0000001600), 0x0, 0x2) r4 = socket$nl_generic(0x10, 0x3, 0x10) r5 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000001640)='cpuacct.usage_percpu_user\x00', 0x26e1, 0x0) close(r5) socketpair$nbd(0x1, 0x1, 0x0, 0x0) r6 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$nl_generic(r6, &(0x7f00000016c0)={0x0, 0x0, &(0x7f0000001700)={&(0x7f0000001740)={0x20, 0x42, 0x100, 0x70bd2e, 0x25dfdbfb, {0x3, 0x7c}, [@nested={0xc, 0x1, 0x0, 0x1, [@typed={0x5, 0x2, 0x0, 0x0, @str='\x00'}]}]}, 0x20}, 0x1, 0x0, 0x0, 0x4048011}, 0x8800) r7 = bpf$MAP_CREATE(0x0, 0x0, 0x50) bpf$MAP_UPDATE_ELEM_TAIL_CALL(0x2, &(0x7f0000001780)={{r7}, &(0x7f00000017c0), &(0x7f0000001800)=r5}, 0x20) r8 = syz_genetlink_get_family_id$mptcp(&(0x7f0000001840), 0xffffffffffffffff) sendmsg$MPTCP_PM_CMD_ADD_ADDR(r4, &(0x7f0000001880)={0x0, 0x0, &(0x7f00000018c0)={&(0x7f0000001900)={0x20, r8, 0x1, 0x0, 0x0, {0x7}, [@MPTCP_PM_ATTR_ADDR={0xc, 0x1, 0x0, 0x1, [@MPTCP_PM_ADDR_ATTR_ID={0x5, 0x2, 0x1}]}]}, 0x20}, 0x1, 0x0, 0x0, 0x80}, 0x8) ioctl$BLKPG(r3, 0x1269, &(0x7f0000001940)={0x1, 0x1f, 0x98, &(0x7f0000001980)={0x3, 0xfffe, 0x12}}) io_setup(0x20fe, 0x0) r9 = syz_open_procfs(0xffffffffffffffff, &(0x7f0000000040)='net/ip6_tables_matches\x00') pread64(r9, &(0x7f0000000380)=""/4082, 0xff2, 0x7fffffff) mkdirat(0xffffffffffffff9c, &(0x7f0000000180)='./proc\x00', 0x1ff) mount(0x0, &(0x7f00000001c0)='./proc\x00', &(0x7f0000000200)='proc\x00', 0x0, 0x0) openat(0xffffffffffffff9c, 0x0, 0x1, 0x0) program crashed: WARNING in add_mtd_blktrans_dev testing program (duration=45s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): openat-bpf$MAP_CREATE_RINGBUF-bpf$BPF_PROG_RAW_TRACEPOINT_LOAD-close_range-mkdirat-mount-openat-write-syz_open_dev$mtd-socket$nl_generic-openat$cgroup_ro-close-socketpair$nbd-socket$nl_generic-sendmsg$nl_generic-bpf$MAP_CREATE-bpf$MAP_UPDATE_ELEM_TAIL_CALL-syz_genetlink_get_family_id$mptcp-sendmsg$MPTCP_PM_CMD_ADD_ADDR-ioctl$BLKPG-io_setup-syz_open_procfs-pread64-mkdirat-mount detailed listing: executing program 0: r0 = openat(0xffffffffffffff9c, &(0x7f0000000000)='./file2\x00', 0x1c9442, 0x19c) r1 = bpf$MAP_CREATE_RINGBUF(0x0, &(0x7f0000000140)=ANY=[@ANYBLOB="1b0000000000000000000000000004"], 0x50) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000001380)={0x11, 0xf, &(0x7f0000001440)=@ringbuf={{0x18, 0x0, 0x0, 0x0, 0x8d, 0x0, 0x0, 0x0, 0xec5}, {{0x18, 0x1, 0x1, 0x0, r1}, {}, {0x7, 0x0, 0xb, 0x3, 0x0, 0x0, 0xfeff}, {0x85, 0x0, 0x0, 0x86}, {0x7, 0x1, 0xb, 0x9, 0x0, 0x20}}, {{0x5, 0x0, 0x5, 0x9, 0x0, 0x1, 0xffffffff}}, [], {{}, {0x7, 0x0, 0xb, 0x2, 0x0, 0x0, 0x3}, {0x85, 0x0, 0x0, 0x84}}}, &(0x7f00000014c0)='GPL\x00', 0xf, 0x0, 0x0, 0x41100, 0x4b, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0xfffffffc}, 0x94) close_range(r0, r0, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000240)='./proc\x00', 0x1ff) mount(0x0, &(0x7f0000001500)='./proc\x00', &(0x7f0000001540)='proc\x00', 0x0, 0x0) r2 = openat(0xffffffffffffff9c, &(0x7f0000001580)='./proc/thread-self/fail-nth\x00', 0x2, 0x12c) write(r2, &(0x7f00000015c0)='270', 0x3) r3 = syz_open_dev$mtd(&(0x7f0000001600), 0x0, 0x2) r4 = socket$nl_generic(0x10, 0x3, 0x10) r5 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000001640)='cpuacct.usage_percpu_user\x00', 0x26e1, 0x0) close(r5) socketpair$nbd(0x1, 0x1, 0x0, 0x0) r6 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$nl_generic(r6, &(0x7f00000016c0)={0x0, 0x0, &(0x7f0000001700)={&(0x7f0000001740)={0x20, 0x42, 0x100, 0x70bd2e, 0x25dfdbfb, {0x3, 0x7c}, [@nested={0xc, 0x1, 0x0, 0x1, [@typed={0x5, 0x2, 0x0, 0x0, @str='\x00'}]}]}, 0x20}, 0x1, 0x0, 0x0, 0x4048011}, 0x8800) r7 = bpf$MAP_CREATE(0x0, 0x0, 0x50) bpf$MAP_UPDATE_ELEM_TAIL_CALL(0x2, &(0x7f0000001780)={{r7}, &(0x7f00000017c0), &(0x7f0000001800)=r5}, 0x20) r8 = syz_genetlink_get_family_id$mptcp(&(0x7f0000001840), 0xffffffffffffffff) sendmsg$MPTCP_PM_CMD_ADD_ADDR(r4, &(0x7f0000001880)={0x0, 0x0, &(0x7f00000018c0)={&(0x7f0000001900)={0x20, r8, 0x1, 0x0, 0x0, {0x7}, [@MPTCP_PM_ATTR_ADDR={0xc, 0x1, 0x0, 0x1, [@MPTCP_PM_ADDR_ATTR_ID={0x5, 0x2, 0x1}]}]}, 0x20}, 0x1, 0x0, 0x0, 0x80}, 0x8) ioctl$BLKPG(r3, 0x1269, &(0x7f0000001940)={0x1, 0x1f, 0x98, &(0x7f0000001980)={0x3, 0xfffe, 0x12}}) io_setup(0x20fe, 0x0) r9 = syz_open_procfs(0xffffffffffffffff, &(0x7f0000000040)='net/ip6_tables_matches\x00') pread64(r9, &(0x7f0000000380)=""/4082, 0xff2, 0x7fffffff) mkdirat(0xffffffffffffff9c, &(0x7f0000000180)='./proc\x00', 0x1ff) mount(0x0, &(0x7f00000001c0)='./proc\x00', &(0x7f0000000200)='proc\x00', 0x0, 0x0) program crashed: WARNING in add_mtd_blktrans_dev testing program (duration=45s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): openat-bpf$MAP_CREATE_RINGBUF-bpf$BPF_PROG_RAW_TRACEPOINT_LOAD-close_range-mkdirat-mount-openat-write-syz_open_dev$mtd-socket$nl_generic-openat$cgroup_ro-close-socketpair$nbd-socket$nl_generic-sendmsg$nl_generic-bpf$MAP_CREATE-bpf$MAP_UPDATE_ELEM_TAIL_CALL-syz_genetlink_get_family_id$mptcp-sendmsg$MPTCP_PM_CMD_ADD_ADDR-ioctl$BLKPG-io_setup-syz_open_procfs-pread64-mkdirat detailed listing: executing program 0: r0 = openat(0xffffffffffffff9c, &(0x7f0000000000)='./file2\x00', 0x1c9442, 0x19c) r1 = bpf$MAP_CREATE_RINGBUF(0x0, &(0x7f0000000140)=ANY=[@ANYBLOB="1b0000000000000000000000000004"], 0x50) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000001380)={0x11, 0xf, &(0x7f0000001440)=@ringbuf={{0x18, 0x0, 0x0, 0x0, 0x8d, 0x0, 0x0, 0x0, 0xec5}, {{0x18, 0x1, 0x1, 0x0, r1}, {}, {0x7, 0x0, 0xb, 0x3, 0x0, 0x0, 0xfeff}, {0x85, 0x0, 0x0, 0x86}, {0x7, 0x1, 0xb, 0x9, 0x0, 0x20}}, {{0x5, 0x0, 0x5, 0x9, 0x0, 0x1, 0xffffffff}}, [], {{}, {0x7, 0x0, 0xb, 0x2, 0x0, 0x0, 0x3}, {0x85, 0x0, 0x0, 0x84}}}, &(0x7f00000014c0)='GPL\x00', 0xf, 0x0, 0x0, 0x41100, 0x4b, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0xfffffffc}, 0x94) close_range(r0, r0, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000240)='./proc\x00', 0x1ff) mount(0x0, &(0x7f0000001500)='./proc\x00', &(0x7f0000001540)='proc\x00', 0x0, 0x0) r2 = openat(0xffffffffffffff9c, &(0x7f0000001580)='./proc/thread-self/fail-nth\x00', 0x2, 0x12c) write(r2, &(0x7f00000015c0)='270', 0x3) r3 = syz_open_dev$mtd(&(0x7f0000001600), 0x0, 0x2) r4 = socket$nl_generic(0x10, 0x3, 0x10) r5 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000001640)='cpuacct.usage_percpu_user\x00', 0x26e1, 0x0) close(r5) socketpair$nbd(0x1, 0x1, 0x0, 0x0) r6 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$nl_generic(r6, &(0x7f00000016c0)={0x0, 0x0, &(0x7f0000001700)={&(0x7f0000001740)={0x20, 0x42, 0x100, 0x70bd2e, 0x25dfdbfb, {0x3, 0x7c}, [@nested={0xc, 0x1, 0x0, 0x1, [@typed={0x5, 0x2, 0x0, 0x0, @str='\x00'}]}]}, 0x20}, 0x1, 0x0, 0x0, 0x4048011}, 0x8800) r7 = bpf$MAP_CREATE(0x0, 0x0, 0x50) bpf$MAP_UPDATE_ELEM_TAIL_CALL(0x2, &(0x7f0000001780)={{r7}, &(0x7f00000017c0), &(0x7f0000001800)=r5}, 0x20) r8 = syz_genetlink_get_family_id$mptcp(&(0x7f0000001840), 0xffffffffffffffff) sendmsg$MPTCP_PM_CMD_ADD_ADDR(r4, &(0x7f0000001880)={0x0, 0x0, &(0x7f00000018c0)={&(0x7f0000001900)={0x20, r8, 0x1, 0x0, 0x0, {0x7}, [@MPTCP_PM_ATTR_ADDR={0xc, 0x1, 0x0, 0x1, [@MPTCP_PM_ADDR_ATTR_ID={0x5, 0x2, 0x1}]}]}, 0x20}, 0x1, 0x0, 0x0, 0x80}, 0x8) ioctl$BLKPG(r3, 0x1269, &(0x7f0000001940)={0x1, 0x1f, 0x98, &(0x7f0000001980)={0x3, 0xfffe, 0x12}}) io_setup(0x20fe, 0x0) r9 = syz_open_procfs(0xffffffffffffffff, &(0x7f0000000040)='net/ip6_tables_matches\x00') pread64(r9, &(0x7f0000000380)=""/4082, 0xff2, 0x7fffffff) mkdirat(0xffffffffffffff9c, &(0x7f0000000180)='./proc\x00', 0x1ff) program crashed: WARNING in add_mtd_blktrans_dev testing program (duration=45s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): openat-bpf$MAP_CREATE_RINGBUF-bpf$BPF_PROG_RAW_TRACEPOINT_LOAD-close_range-mkdirat-mount-openat-write-syz_open_dev$mtd-socket$nl_generic-openat$cgroup_ro-close-socketpair$nbd-socket$nl_generic-sendmsg$nl_generic-bpf$MAP_CREATE-bpf$MAP_UPDATE_ELEM_TAIL_CALL-syz_genetlink_get_family_id$mptcp-sendmsg$MPTCP_PM_CMD_ADD_ADDR-ioctl$BLKPG-io_setup-syz_open_procfs-pread64 detailed listing: executing program 0: r0 = openat(0xffffffffffffff9c, &(0x7f0000000000)='./file2\x00', 0x1c9442, 0x19c) r1 = bpf$MAP_CREATE_RINGBUF(0x0, &(0x7f0000000140)=ANY=[@ANYBLOB="1b0000000000000000000000000004"], 0x50) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000001380)={0x11, 0xf, &(0x7f0000001440)=@ringbuf={{0x18, 0x0, 0x0, 0x0, 0x8d, 0x0, 0x0, 0x0, 0xec5}, {{0x18, 0x1, 0x1, 0x0, r1}, {}, {0x7, 0x0, 0xb, 0x3, 0x0, 0x0, 0xfeff}, {0x85, 0x0, 0x0, 0x86}, {0x7, 0x1, 0xb, 0x9, 0x0, 0x20}}, {{0x5, 0x0, 0x5, 0x9, 0x0, 0x1, 0xffffffff}}, [], {{}, {0x7, 0x0, 0xb, 0x2, 0x0, 0x0, 0x3}, {0x85, 0x0, 0x0, 0x84}}}, &(0x7f00000014c0)='GPL\x00', 0xf, 0x0, 0x0, 0x41100, 0x4b, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0xfffffffc}, 0x94) close_range(r0, r0, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000240)='./proc\x00', 0x1ff) mount(0x0, &(0x7f0000001500)='./proc\x00', &(0x7f0000001540)='proc\x00', 0x0, 0x0) r2 = openat(0xffffffffffffff9c, &(0x7f0000001580)='./proc/thread-self/fail-nth\x00', 0x2, 0x12c) write(r2, &(0x7f00000015c0)='270', 0x3) r3 = syz_open_dev$mtd(&(0x7f0000001600), 0x0, 0x2) r4 = socket$nl_generic(0x10, 0x3, 0x10) r5 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000001640)='cpuacct.usage_percpu_user\x00', 0x26e1, 0x0) close(r5) socketpair$nbd(0x1, 0x1, 0x0, 0x0) r6 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$nl_generic(r6, &(0x7f00000016c0)={0x0, 0x0, &(0x7f0000001700)={&(0x7f0000001740)={0x20, 0x42, 0x100, 0x70bd2e, 0x25dfdbfb, {0x3, 0x7c}, [@nested={0xc, 0x1, 0x0, 0x1, [@typed={0x5, 0x2, 0x0, 0x0, @str='\x00'}]}]}, 0x20}, 0x1, 0x0, 0x0, 0x4048011}, 0x8800) r7 = bpf$MAP_CREATE(0x0, 0x0, 0x50) bpf$MAP_UPDATE_ELEM_TAIL_CALL(0x2, &(0x7f0000001780)={{r7}, &(0x7f00000017c0), &(0x7f0000001800)=r5}, 0x20) r8 = syz_genetlink_get_family_id$mptcp(&(0x7f0000001840), 0xffffffffffffffff) sendmsg$MPTCP_PM_CMD_ADD_ADDR(r4, &(0x7f0000001880)={0x0, 0x0, &(0x7f00000018c0)={&(0x7f0000001900)={0x20, r8, 0x1, 0x0, 0x0, {0x7}, [@MPTCP_PM_ATTR_ADDR={0xc, 0x1, 0x0, 0x1, [@MPTCP_PM_ADDR_ATTR_ID={0x5, 0x2, 0x1}]}]}, 0x20}, 0x1, 0x0, 0x0, 0x80}, 0x8) ioctl$BLKPG(r3, 0x1269, &(0x7f0000001940)={0x1, 0x1f, 0x98, &(0x7f0000001980)={0x3, 0xfffe, 0x12}}) io_setup(0x20fe, 0x0) r9 = syz_open_procfs(0xffffffffffffffff, &(0x7f0000000040)='net/ip6_tables_matches\x00') pread64(r9, &(0x7f0000000380)=""/4082, 0xff2, 0x7fffffff) program crashed: WARNING in add_mtd_blktrans_dev testing program (duration=45s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): openat-bpf$MAP_CREATE_RINGBUF-bpf$BPF_PROG_RAW_TRACEPOINT_LOAD-close_range-mkdirat-mount-openat-write-syz_open_dev$mtd-socket$nl_generic-openat$cgroup_ro-close-socketpair$nbd-socket$nl_generic-sendmsg$nl_generic-bpf$MAP_CREATE-bpf$MAP_UPDATE_ELEM_TAIL_CALL-syz_genetlink_get_family_id$mptcp-sendmsg$MPTCP_PM_CMD_ADD_ADDR-ioctl$BLKPG-io_setup-syz_open_procfs detailed listing: executing program 0: r0 = openat(0xffffffffffffff9c, &(0x7f0000000000)='./file2\x00', 0x1c9442, 0x19c) r1 = bpf$MAP_CREATE_RINGBUF(0x0, &(0x7f0000000140)=ANY=[@ANYBLOB="1b0000000000000000000000000004"], 0x50) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000001380)={0x11, 0xf, &(0x7f0000001440)=@ringbuf={{0x18, 0x0, 0x0, 0x0, 0x8d, 0x0, 0x0, 0x0, 0xec5}, {{0x18, 0x1, 0x1, 0x0, r1}, {}, {0x7, 0x0, 0xb, 0x3, 0x0, 0x0, 0xfeff}, {0x85, 0x0, 0x0, 0x86}, {0x7, 0x1, 0xb, 0x9, 0x0, 0x20}}, {{0x5, 0x0, 0x5, 0x9, 0x0, 0x1, 0xffffffff}}, [], {{}, {0x7, 0x0, 0xb, 0x2, 0x0, 0x0, 0x3}, {0x85, 0x0, 0x0, 0x84}}}, &(0x7f00000014c0)='GPL\x00', 0xf, 0x0, 0x0, 0x41100, 0x4b, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0xfffffffc}, 0x94) close_range(r0, r0, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000240)='./proc\x00', 0x1ff) mount(0x0, &(0x7f0000001500)='./proc\x00', &(0x7f0000001540)='proc\x00', 0x0, 0x0) r2 = openat(0xffffffffffffff9c, &(0x7f0000001580)='./proc/thread-self/fail-nth\x00', 0x2, 0x12c) write(r2, &(0x7f00000015c0)='270', 0x3) r3 = syz_open_dev$mtd(&(0x7f0000001600), 0x0, 0x2) r4 = socket$nl_generic(0x10, 0x3, 0x10) r5 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000001640)='cpuacct.usage_percpu_user\x00', 0x26e1, 0x0) close(r5) socketpair$nbd(0x1, 0x1, 0x0, 0x0) r6 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$nl_generic(r6, &(0x7f00000016c0)={0x0, 0x0, &(0x7f0000001700)={&(0x7f0000001740)={0x20, 0x42, 0x100, 0x70bd2e, 0x25dfdbfb, {0x3, 0x7c}, [@nested={0xc, 0x1, 0x0, 0x1, [@typed={0x5, 0x2, 0x0, 0x0, @str='\x00'}]}]}, 0x20}, 0x1, 0x0, 0x0, 0x4048011}, 0x8800) r7 = bpf$MAP_CREATE(0x0, 0x0, 0x50) bpf$MAP_UPDATE_ELEM_TAIL_CALL(0x2, &(0x7f0000001780)={{r7}, &(0x7f00000017c0), &(0x7f0000001800)=r5}, 0x20) r8 = syz_genetlink_get_family_id$mptcp(&(0x7f0000001840), 0xffffffffffffffff) sendmsg$MPTCP_PM_CMD_ADD_ADDR(r4, &(0x7f0000001880)={0x0, 0x0, &(0x7f00000018c0)={&(0x7f0000001900)={0x20, r8, 0x1, 0x0, 0x0, {0x7}, [@MPTCP_PM_ATTR_ADDR={0xc, 0x1, 0x0, 0x1, [@MPTCP_PM_ADDR_ATTR_ID={0x5, 0x2, 0x1}]}]}, 0x20}, 0x1, 0x0, 0x0, 0x80}, 0x8) ioctl$BLKPG(r3, 0x1269, &(0x7f0000001940)={0x1, 0x1f, 0x98, &(0x7f0000001980)={0x3, 0xfffe, 0x12}}) io_setup(0x20fe, 0x0) syz_open_procfs(0xffffffffffffffff, &(0x7f0000000040)='net/ip6_tables_matches\x00') program crashed: WARNING in add_mtd_blktrans_dev testing program (duration=45s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): openat-bpf$MAP_CREATE_RINGBUF-bpf$BPF_PROG_RAW_TRACEPOINT_LOAD-close_range-mkdirat-mount-openat-write-syz_open_dev$mtd-socket$nl_generic-openat$cgroup_ro-close-socketpair$nbd-socket$nl_generic-sendmsg$nl_generic-bpf$MAP_CREATE-bpf$MAP_UPDATE_ELEM_TAIL_CALL-syz_genetlink_get_family_id$mptcp-sendmsg$MPTCP_PM_CMD_ADD_ADDR-ioctl$BLKPG-io_setup detailed listing: executing program 0: r0 = openat(0xffffffffffffff9c, &(0x7f0000000000)='./file2\x00', 0x1c9442, 0x19c) r1 = bpf$MAP_CREATE_RINGBUF(0x0, &(0x7f0000000140)=ANY=[@ANYBLOB="1b0000000000000000000000000004"], 0x50) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000001380)={0x11, 0xf, &(0x7f0000001440)=@ringbuf={{0x18, 0x0, 0x0, 0x0, 0x8d, 0x0, 0x0, 0x0, 0xec5}, {{0x18, 0x1, 0x1, 0x0, r1}, {}, {0x7, 0x0, 0xb, 0x3, 0x0, 0x0, 0xfeff}, {0x85, 0x0, 0x0, 0x86}, {0x7, 0x1, 0xb, 0x9, 0x0, 0x20}}, {{0x5, 0x0, 0x5, 0x9, 0x0, 0x1, 0xffffffff}}, [], {{}, {0x7, 0x0, 0xb, 0x2, 0x0, 0x0, 0x3}, {0x85, 0x0, 0x0, 0x84}}}, &(0x7f00000014c0)='GPL\x00', 0xf, 0x0, 0x0, 0x41100, 0x4b, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0xfffffffc}, 0x94) close_range(r0, r0, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000240)='./proc\x00', 0x1ff) mount(0x0, &(0x7f0000001500)='./proc\x00', &(0x7f0000001540)='proc\x00', 0x0, 0x0) r2 = openat(0xffffffffffffff9c, &(0x7f0000001580)='./proc/thread-self/fail-nth\x00', 0x2, 0x12c) write(r2, &(0x7f00000015c0)='270', 0x3) r3 = syz_open_dev$mtd(&(0x7f0000001600), 0x0, 0x2) r4 = socket$nl_generic(0x10, 0x3, 0x10) r5 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000001640)='cpuacct.usage_percpu_user\x00', 0x26e1, 0x0) close(r5) socketpair$nbd(0x1, 0x1, 0x0, 0x0) r6 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$nl_generic(r6, &(0x7f00000016c0)={0x0, 0x0, &(0x7f0000001700)={&(0x7f0000001740)={0x20, 0x42, 0x100, 0x70bd2e, 0x25dfdbfb, {0x3, 0x7c}, [@nested={0xc, 0x1, 0x0, 0x1, [@typed={0x5, 0x2, 0x0, 0x0, @str='\x00'}]}]}, 0x20}, 0x1, 0x0, 0x0, 0x4048011}, 0x8800) r7 = bpf$MAP_CREATE(0x0, 0x0, 0x50) bpf$MAP_UPDATE_ELEM_TAIL_CALL(0x2, &(0x7f0000001780)={{r7}, &(0x7f00000017c0), &(0x7f0000001800)=r5}, 0x20) r8 = syz_genetlink_get_family_id$mptcp(&(0x7f0000001840), 0xffffffffffffffff) sendmsg$MPTCP_PM_CMD_ADD_ADDR(r4, &(0x7f0000001880)={0x0, 0x0, &(0x7f00000018c0)={&(0x7f0000001900)={0x20, r8, 0x1, 0x0, 0x0, {0x7}, [@MPTCP_PM_ATTR_ADDR={0xc, 0x1, 0x0, 0x1, [@MPTCP_PM_ADDR_ATTR_ID={0x5, 0x2, 0x1}]}]}, 0x20}, 0x1, 0x0, 0x0, 0x80}, 0x8) ioctl$BLKPG(r3, 0x1269, &(0x7f0000001940)={0x1, 0x1f, 0x98, &(0x7f0000001980)={0x3, 0xfffe, 0x12}}) io_setup(0x20fe, 0x0) program crashed: WARNING in add_mtd_blktrans_dev testing program (duration=45s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): openat-bpf$MAP_CREATE_RINGBUF-bpf$BPF_PROG_RAW_TRACEPOINT_LOAD-close_range-mkdirat-mount-openat-write-syz_open_dev$mtd-socket$nl_generic-openat$cgroup_ro-close-socketpair$nbd-socket$nl_generic-sendmsg$nl_generic-bpf$MAP_CREATE-bpf$MAP_UPDATE_ELEM_TAIL_CALL-syz_genetlink_get_family_id$mptcp-sendmsg$MPTCP_PM_CMD_ADD_ADDR-ioctl$BLKPG detailed listing: executing program 0: r0 = openat(0xffffffffffffff9c, &(0x7f0000000000)='./file2\x00', 0x1c9442, 0x19c) r1 = bpf$MAP_CREATE_RINGBUF(0x0, &(0x7f0000000140)=ANY=[@ANYBLOB="1b0000000000000000000000000004"], 0x50) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000001380)={0x11, 0xf, &(0x7f0000001440)=@ringbuf={{0x18, 0x0, 0x0, 0x0, 0x8d, 0x0, 0x0, 0x0, 0xec5}, {{0x18, 0x1, 0x1, 0x0, r1}, {}, {0x7, 0x0, 0xb, 0x3, 0x0, 0x0, 0xfeff}, {0x85, 0x0, 0x0, 0x86}, {0x7, 0x1, 0xb, 0x9, 0x0, 0x20}}, {{0x5, 0x0, 0x5, 0x9, 0x0, 0x1, 0xffffffff}}, [], {{}, {0x7, 0x0, 0xb, 0x2, 0x0, 0x0, 0x3}, {0x85, 0x0, 0x0, 0x84}}}, &(0x7f00000014c0)='GPL\x00', 0xf, 0x0, 0x0, 0x41100, 0x4b, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0xfffffffc}, 0x94) close_range(r0, r0, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000240)='./proc\x00', 0x1ff) mount(0x0, &(0x7f0000001500)='./proc\x00', &(0x7f0000001540)='proc\x00', 0x0, 0x0) r2 = openat(0xffffffffffffff9c, &(0x7f0000001580)='./proc/thread-self/fail-nth\x00', 0x2, 0x12c) write(r2, &(0x7f00000015c0)='270', 0x3) r3 = syz_open_dev$mtd(&(0x7f0000001600), 0x0, 0x2) r4 = socket$nl_generic(0x10, 0x3, 0x10) r5 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000001640)='cpuacct.usage_percpu_user\x00', 0x26e1, 0x0) close(r5) socketpair$nbd(0x1, 0x1, 0x0, 0x0) r6 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$nl_generic(r6, &(0x7f00000016c0)={0x0, 0x0, &(0x7f0000001700)={&(0x7f0000001740)={0x20, 0x42, 0x100, 0x70bd2e, 0x25dfdbfb, {0x3, 0x7c}, [@nested={0xc, 0x1, 0x0, 0x1, [@typed={0x5, 0x2, 0x0, 0x0, @str='\x00'}]}]}, 0x20}, 0x1, 0x0, 0x0, 0x4048011}, 0x8800) r7 = bpf$MAP_CREATE(0x0, 0x0, 0x50) bpf$MAP_UPDATE_ELEM_TAIL_CALL(0x2, &(0x7f0000001780)={{r7}, &(0x7f00000017c0), &(0x7f0000001800)=r5}, 0x20) r8 = syz_genetlink_get_family_id$mptcp(&(0x7f0000001840), 0xffffffffffffffff) sendmsg$MPTCP_PM_CMD_ADD_ADDR(r4, &(0x7f0000001880)={0x0, 0x0, &(0x7f00000018c0)={&(0x7f0000001900)={0x20, r8, 0x1, 0x0, 0x0, {0x7}, [@MPTCP_PM_ATTR_ADDR={0xc, 0x1, 0x0, 0x1, [@MPTCP_PM_ADDR_ATTR_ID={0x5, 0x2, 0x1}]}]}, 0x20}, 0x1, 0x0, 0x0, 0x80}, 0x8) ioctl$BLKPG(r3, 0x1269, &(0x7f0000001940)={0x1, 0x1f, 0x98, &(0x7f0000001980)={0x3, 0xfffe, 0x12}}) program crashed: WARNING in add_mtd_blktrans_dev testing program (duration=45s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): openat-bpf$MAP_CREATE_RINGBUF-bpf$BPF_PROG_RAW_TRACEPOINT_LOAD-close_range-mkdirat-mount-openat-write-syz_open_dev$mtd-socket$nl_generic-openat$cgroup_ro-close-socketpair$nbd-socket$nl_generic-sendmsg$nl_generic-bpf$MAP_CREATE-bpf$MAP_UPDATE_ELEM_TAIL_CALL-syz_genetlink_get_family_id$mptcp-sendmsg$MPTCP_PM_CMD_ADD_ADDR detailed listing: executing program 0: r0 = openat(0xffffffffffffff9c, &(0x7f0000000000)='./file2\x00', 0x1c9442, 0x19c) r1 = bpf$MAP_CREATE_RINGBUF(0x0, &(0x7f0000000140)=ANY=[@ANYBLOB="1b0000000000000000000000000004"], 0x50) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000001380)={0x11, 0xf, &(0x7f0000001440)=@ringbuf={{0x18, 0x0, 0x0, 0x0, 0x8d, 0x0, 0x0, 0x0, 0xec5}, {{0x18, 0x1, 0x1, 0x0, r1}, {}, {0x7, 0x0, 0xb, 0x3, 0x0, 0x0, 0xfeff}, {0x85, 0x0, 0x0, 0x86}, {0x7, 0x1, 0xb, 0x9, 0x0, 0x20}}, {{0x5, 0x0, 0x5, 0x9, 0x0, 0x1, 0xffffffff}}, [], {{}, {0x7, 0x0, 0xb, 0x2, 0x0, 0x0, 0x3}, {0x85, 0x0, 0x0, 0x84}}}, &(0x7f00000014c0)='GPL\x00', 0xf, 0x0, 0x0, 0x41100, 0x4b, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0xfffffffc}, 0x94) close_range(r0, r0, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000240)='./proc\x00', 0x1ff) mount(0x0, &(0x7f0000001500)='./proc\x00', &(0x7f0000001540)='proc\x00', 0x0, 0x0) r2 = openat(0xffffffffffffff9c, &(0x7f0000001580)='./proc/thread-self/fail-nth\x00', 0x2, 0x12c) write(r2, &(0x7f00000015c0)='270', 0x3) syz_open_dev$mtd(&(0x7f0000001600), 0x0, 0x2) r3 = socket$nl_generic(0x10, 0x3, 0x10) r4 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000001640)='cpuacct.usage_percpu_user\x00', 0x26e1, 0x0) close(r4) socketpair$nbd(0x1, 0x1, 0x0, 0x0) r5 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$nl_generic(r5, &(0x7f00000016c0)={0x0, 0x0, &(0x7f0000001700)={&(0x7f0000001740)={0x20, 0x42, 0x100, 0x70bd2e, 0x25dfdbfb, {0x3, 0x7c}, [@nested={0xc, 0x1, 0x0, 0x1, [@typed={0x5, 0x2, 0x0, 0x0, @str='\x00'}]}]}, 0x20}, 0x1, 0x0, 0x0, 0x4048011}, 0x8800) r6 = bpf$MAP_CREATE(0x0, 0x0, 0x50) bpf$MAP_UPDATE_ELEM_TAIL_CALL(0x2, &(0x7f0000001780)={{r6}, &(0x7f00000017c0), &(0x7f0000001800)=r4}, 0x20) r7 = syz_genetlink_get_family_id$mptcp(&(0x7f0000001840), 0xffffffffffffffff) sendmsg$MPTCP_PM_CMD_ADD_ADDR(r3, &(0x7f0000001880)={0x0, 0x0, &(0x7f00000018c0)={&(0x7f0000001900)={0x20, r7, 0x1, 0x0, 0x0, {0x7}, [@MPTCP_PM_ATTR_ADDR={0xc, 0x1, 0x0, 0x1, [@MPTCP_PM_ADDR_ATTR_ID={0x5, 0x2, 0x1}]}]}, 0x20}, 0x1, 0x0, 0x0, 0x80}, 0x8) program did not crash testing program (duration=45s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): openat-bpf$MAP_CREATE_RINGBUF-bpf$BPF_PROG_RAW_TRACEPOINT_LOAD-close_range-mkdirat-mount-openat-write-syz_open_dev$mtd-socket$nl_generic-openat$cgroup_ro-close-socketpair$nbd-socket$nl_generic-sendmsg$nl_generic-bpf$MAP_CREATE-bpf$MAP_UPDATE_ELEM_TAIL_CALL-syz_genetlink_get_family_id$mptcp-ioctl$BLKPG detailed listing: executing program 0: r0 = openat(0xffffffffffffff9c, &(0x7f0000000000)='./file2\x00', 0x1c9442, 0x19c) r1 = bpf$MAP_CREATE_RINGBUF(0x0, &(0x7f0000000140)=ANY=[@ANYBLOB="1b0000000000000000000000000004"], 0x50) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000001380)={0x11, 0xf, &(0x7f0000001440)=@ringbuf={{0x18, 0x0, 0x0, 0x0, 0x8d, 0x0, 0x0, 0x0, 0xec5}, {{0x18, 0x1, 0x1, 0x0, r1}, {}, {0x7, 0x0, 0xb, 0x3, 0x0, 0x0, 0xfeff}, {0x85, 0x0, 0x0, 0x86}, {0x7, 0x1, 0xb, 0x9, 0x0, 0x20}}, {{0x5, 0x0, 0x5, 0x9, 0x0, 0x1, 0xffffffff}}, [], {{}, {0x7, 0x0, 0xb, 0x2, 0x0, 0x0, 0x3}, {0x85, 0x0, 0x0, 0x84}}}, &(0x7f00000014c0)='GPL\x00', 0xf, 0x0, 0x0, 0x41100, 0x4b, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0xfffffffc}, 0x94) close_range(r0, r0, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000240)='./proc\x00', 0x1ff) mount(0x0, &(0x7f0000001500)='./proc\x00', &(0x7f0000001540)='proc\x00', 0x0, 0x0) r2 = openat(0xffffffffffffff9c, &(0x7f0000001580)='./proc/thread-self/fail-nth\x00', 0x2, 0x12c) write(r2, &(0x7f00000015c0)='270', 0x3) r3 = syz_open_dev$mtd(&(0x7f0000001600), 0x0, 0x2) socket$nl_generic(0x10, 0x3, 0x10) r4 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000001640)='cpuacct.usage_percpu_user\x00', 0x26e1, 0x0) close(r4) socketpair$nbd(0x1, 0x1, 0x0, 0x0) r5 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$nl_generic(r5, &(0x7f00000016c0)={0x0, 0x0, &(0x7f0000001700)={&(0x7f0000001740)={0x20, 0x42, 0x100, 0x70bd2e, 0x25dfdbfb, {0x3, 0x7c}, [@nested={0xc, 0x1, 0x0, 0x1, [@typed={0x5, 0x2, 0x0, 0x0, @str='\x00'}]}]}, 0x20}, 0x1, 0x0, 0x0, 0x4048011}, 0x8800) r6 = bpf$MAP_CREATE(0x0, 0x0, 0x50) bpf$MAP_UPDATE_ELEM_TAIL_CALL(0x2, &(0x7f0000001780)={{r6}, &(0x7f00000017c0), &(0x7f0000001800)=r4}, 0x20) syz_genetlink_get_family_id$mptcp(&(0x7f0000001840), 0xffffffffffffffff) ioctl$BLKPG(r3, 0x1269, &(0x7f0000001940)={0x1, 0x1f, 0x98, &(0x7f0000001980)={0x3, 0xfffe, 0x12}}) program crashed: WARNING in add_mtd_blktrans_dev testing program (duration=45s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): openat-bpf$MAP_CREATE_RINGBUF-bpf$BPF_PROG_RAW_TRACEPOINT_LOAD-close_range-mkdirat-mount-openat-write-syz_open_dev$mtd-socket$nl_generic-openat$cgroup_ro-close-socketpair$nbd-socket$nl_generic-sendmsg$nl_generic-bpf$MAP_CREATE-bpf$MAP_UPDATE_ELEM_TAIL_CALL-ioctl$BLKPG detailed listing: executing program 0: r0 = openat(0xffffffffffffff9c, &(0x7f0000000000)='./file2\x00', 0x1c9442, 0x19c) r1 = bpf$MAP_CREATE_RINGBUF(0x0, &(0x7f0000000140)=ANY=[@ANYBLOB="1b0000000000000000000000000004"], 0x50) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000001380)={0x11, 0xf, &(0x7f0000001440)=@ringbuf={{0x18, 0x0, 0x0, 0x0, 0x8d, 0x0, 0x0, 0x0, 0xec5}, {{0x18, 0x1, 0x1, 0x0, r1}, {}, {0x7, 0x0, 0xb, 0x3, 0x0, 0x0, 0xfeff}, {0x85, 0x0, 0x0, 0x86}, {0x7, 0x1, 0xb, 0x9, 0x0, 0x20}}, {{0x5, 0x0, 0x5, 0x9, 0x0, 0x1, 0xffffffff}}, [], {{}, {0x7, 0x0, 0xb, 0x2, 0x0, 0x0, 0x3}, {0x85, 0x0, 0x0, 0x84}}}, &(0x7f00000014c0)='GPL\x00', 0xf, 0x0, 0x0, 0x41100, 0x4b, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0xfffffffc}, 0x94) close_range(r0, r0, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000240)='./proc\x00', 0x1ff) mount(0x0, &(0x7f0000001500)='./proc\x00', &(0x7f0000001540)='proc\x00', 0x0, 0x0) r2 = openat(0xffffffffffffff9c, &(0x7f0000001580)='./proc/thread-self/fail-nth\x00', 0x2, 0x12c) write(r2, &(0x7f00000015c0)='270', 0x3) r3 = syz_open_dev$mtd(&(0x7f0000001600), 0x0, 0x2) socket$nl_generic(0x10, 0x3, 0x10) r4 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000001640)='cpuacct.usage_percpu_user\x00', 0x26e1, 0x0) close(r4) socketpair$nbd(0x1, 0x1, 0x0, 0x0) r5 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$nl_generic(r5, &(0x7f00000016c0)={0x0, 0x0, &(0x7f0000001700)={&(0x7f0000001740)={0x20, 0x42, 0x100, 0x70bd2e, 0x25dfdbfb, {0x3, 0x7c}, [@nested={0xc, 0x1, 0x0, 0x1, [@typed={0x5, 0x2, 0x0, 0x0, @str='\x00'}]}]}, 0x20}, 0x1, 0x0, 0x0, 0x4048011}, 0x8800) r6 = bpf$MAP_CREATE(0x0, 0x0, 0x50) bpf$MAP_UPDATE_ELEM_TAIL_CALL(0x2, &(0x7f0000001780)={{r6}, &(0x7f00000017c0), &(0x7f0000001800)=r4}, 0x20) ioctl$BLKPG(r3, 0x1269, &(0x7f0000001940)={0x1, 0x1f, 0x98, &(0x7f0000001980)={0x3, 0xfffe, 0x12}}) program crashed: WARNING in add_mtd_blktrans_dev testing program (duration=45s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): openat-bpf$MAP_CREATE_RINGBUF-bpf$BPF_PROG_RAW_TRACEPOINT_LOAD-close_range-mkdirat-mount-openat-write-syz_open_dev$mtd-socket$nl_generic-openat$cgroup_ro-close-socketpair$nbd-socket$nl_generic-sendmsg$nl_generic-bpf$MAP_CREATE-ioctl$BLKPG detailed listing: executing program 0: r0 = openat(0xffffffffffffff9c, &(0x7f0000000000)='./file2\x00', 0x1c9442, 0x19c) r1 = bpf$MAP_CREATE_RINGBUF(0x0, &(0x7f0000000140)=ANY=[@ANYBLOB="1b0000000000000000000000000004"], 0x50) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000001380)={0x11, 0xf, &(0x7f0000001440)=@ringbuf={{0x18, 0x0, 0x0, 0x0, 0x8d, 0x0, 0x0, 0x0, 0xec5}, {{0x18, 0x1, 0x1, 0x0, r1}, {}, {0x7, 0x0, 0xb, 0x3, 0x0, 0x0, 0xfeff}, {0x85, 0x0, 0x0, 0x86}, {0x7, 0x1, 0xb, 0x9, 0x0, 0x20}}, {{0x5, 0x0, 0x5, 0x9, 0x0, 0x1, 0xffffffff}}, [], {{}, {0x7, 0x0, 0xb, 0x2, 0x0, 0x0, 0x3}, {0x85, 0x0, 0x0, 0x84}}}, &(0x7f00000014c0)='GPL\x00', 0xf, 0x0, 0x0, 0x41100, 0x4b, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0xfffffffc}, 0x94) close_range(r0, r0, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000240)='./proc\x00', 0x1ff) mount(0x0, &(0x7f0000001500)='./proc\x00', &(0x7f0000001540)='proc\x00', 0x0, 0x0) r2 = openat(0xffffffffffffff9c, &(0x7f0000001580)='./proc/thread-self/fail-nth\x00', 0x2, 0x12c) write(r2, &(0x7f00000015c0)='270', 0x3) r3 = syz_open_dev$mtd(&(0x7f0000001600), 0x0, 0x2) socket$nl_generic(0x10, 0x3, 0x10) r4 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000001640)='cpuacct.usage_percpu_user\x00', 0x26e1, 0x0) close(r4) socketpair$nbd(0x1, 0x1, 0x0, 0x0) r5 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$nl_generic(r5, &(0x7f00000016c0)={0x0, 0x0, &(0x7f0000001700)={&(0x7f0000001740)={0x20, 0x42, 0x100, 0x70bd2e, 0x25dfdbfb, {0x3, 0x7c}, [@nested={0xc, 0x1, 0x0, 0x1, [@typed={0x5, 0x2, 0x0, 0x0, @str='\x00'}]}]}, 0x20}, 0x1, 0x0, 0x0, 0x4048011}, 0x8800) bpf$MAP_CREATE(0x0, 0x0, 0x50) ioctl$BLKPG(r3, 0x1269, &(0x7f0000001940)={0x1, 0x1f, 0x98, &(0x7f0000001980)={0x3, 0xfffe, 0x12}}) program crashed: WARNING in add_mtd_blktrans_dev testing program (duration=45s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): openat-bpf$MAP_CREATE_RINGBUF-bpf$BPF_PROG_RAW_TRACEPOINT_LOAD-close_range-mkdirat-mount-openat-write-syz_open_dev$mtd-socket$nl_generic-openat$cgroup_ro-close-socketpair$nbd-socket$nl_generic-sendmsg$nl_generic-ioctl$BLKPG detailed listing: executing program 0: r0 = openat(0xffffffffffffff9c, &(0x7f0000000000)='./file2\x00', 0x1c9442, 0x19c) r1 = bpf$MAP_CREATE_RINGBUF(0x0, &(0x7f0000000140)=ANY=[@ANYBLOB="1b0000000000000000000000000004"], 0x50) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000001380)={0x11, 0xf, &(0x7f0000001440)=@ringbuf={{0x18, 0x0, 0x0, 0x0, 0x8d, 0x0, 0x0, 0x0, 0xec5}, {{0x18, 0x1, 0x1, 0x0, r1}, {}, {0x7, 0x0, 0xb, 0x3, 0x0, 0x0, 0xfeff}, {0x85, 0x0, 0x0, 0x86}, {0x7, 0x1, 0xb, 0x9, 0x0, 0x20}}, {{0x5, 0x0, 0x5, 0x9, 0x0, 0x1, 0xffffffff}}, [], {{}, {0x7, 0x0, 0xb, 0x2, 0x0, 0x0, 0x3}, {0x85, 0x0, 0x0, 0x84}}}, &(0x7f00000014c0)='GPL\x00', 0xf, 0x0, 0x0, 0x41100, 0x4b, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0xfffffffc}, 0x94) close_range(r0, r0, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000240)='./proc\x00', 0x1ff) mount(0x0, &(0x7f0000001500)='./proc\x00', &(0x7f0000001540)='proc\x00', 0x0, 0x0) r2 = openat(0xffffffffffffff9c, &(0x7f0000001580)='./proc/thread-self/fail-nth\x00', 0x2, 0x12c) write(r2, &(0x7f00000015c0)='270', 0x3) r3 = syz_open_dev$mtd(&(0x7f0000001600), 0x0, 0x2) socket$nl_generic(0x10, 0x3, 0x10) r4 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000001640)='cpuacct.usage_percpu_user\x00', 0x26e1, 0x0) close(r4) socketpair$nbd(0x1, 0x1, 0x0, 0x0) r5 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$nl_generic(r5, &(0x7f00000016c0)={0x0, 0x0, &(0x7f0000001700)={&(0x7f0000001740)={0x20, 0x42, 0x100, 0x70bd2e, 0x25dfdbfb, {0x3, 0x7c}, [@nested={0xc, 0x1, 0x0, 0x1, [@typed={0x5, 0x2, 0x0, 0x0, @str='\x00'}]}]}, 0x20}, 0x1, 0x0, 0x0, 0x4048011}, 0x8800) ioctl$BLKPG(r3, 0x1269, &(0x7f0000001940)={0x1, 0x1f, 0x98, &(0x7f0000001980)={0x3, 0xfffe, 0x12}}) program crashed: WARNING in add_mtd_blktrans_dev testing program (duration=45s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): openat-bpf$MAP_CREATE_RINGBUF-bpf$BPF_PROG_RAW_TRACEPOINT_LOAD-close_range-mkdirat-mount-openat-write-syz_open_dev$mtd-socket$nl_generic-openat$cgroup_ro-close-socketpair$nbd-socket$nl_generic-ioctl$BLKPG detailed listing: executing program 0: r0 = openat(0xffffffffffffff9c, &(0x7f0000000000)='./file2\x00', 0x1c9442, 0x19c) r1 = bpf$MAP_CREATE_RINGBUF(0x0, &(0x7f0000000140)=ANY=[@ANYBLOB="1b0000000000000000000000000004"], 0x50) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000001380)={0x11, 0xf, &(0x7f0000001440)=@ringbuf={{0x18, 0x0, 0x0, 0x0, 0x8d, 0x0, 0x0, 0x0, 0xec5}, {{0x18, 0x1, 0x1, 0x0, r1}, {}, {0x7, 0x0, 0xb, 0x3, 0x0, 0x0, 0xfeff}, {0x85, 0x0, 0x0, 0x86}, {0x7, 0x1, 0xb, 0x9, 0x0, 0x20}}, {{0x5, 0x0, 0x5, 0x9, 0x0, 0x1, 0xffffffff}}, [], {{}, {0x7, 0x0, 0xb, 0x2, 0x0, 0x0, 0x3}, {0x85, 0x0, 0x0, 0x84}}}, &(0x7f00000014c0)='GPL\x00', 0xf, 0x0, 0x0, 0x41100, 0x4b, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0xfffffffc}, 0x94) close_range(r0, r0, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000240)='./proc\x00', 0x1ff) mount(0x0, &(0x7f0000001500)='./proc\x00', &(0x7f0000001540)='proc\x00', 0x0, 0x0) r2 = openat(0xffffffffffffff9c, &(0x7f0000001580)='./proc/thread-self/fail-nth\x00', 0x2, 0x12c) write(r2, &(0x7f00000015c0)='270', 0x3) r3 = syz_open_dev$mtd(&(0x7f0000001600), 0x0, 0x2) socket$nl_generic(0x10, 0x3, 0x10) r4 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000001640)='cpuacct.usage_percpu_user\x00', 0x26e1, 0x0) close(r4) socketpair$nbd(0x1, 0x1, 0x0, 0x0) socket$nl_generic(0x10, 0x3, 0x10) ioctl$BLKPG(r3, 0x1269, &(0x7f0000001940)={0x1, 0x1f, 0x98, &(0x7f0000001980)={0x3, 0xfffe, 0x12}}) program crashed: WARNING in add_mtd_blktrans_dev testing program (duration=45s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): openat-bpf$MAP_CREATE_RINGBUF-bpf$BPF_PROG_RAW_TRACEPOINT_LOAD-close_range-mkdirat-mount-openat-write-syz_open_dev$mtd-socket$nl_generic-openat$cgroup_ro-close-socketpair$nbd-ioctl$BLKPG detailed listing: executing program 0: r0 = openat(0xffffffffffffff9c, &(0x7f0000000000)='./file2\x00', 0x1c9442, 0x19c) r1 = bpf$MAP_CREATE_RINGBUF(0x0, &(0x7f0000000140)=ANY=[@ANYBLOB="1b0000000000000000000000000004"], 0x50) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000001380)={0x11, 0xf, &(0x7f0000001440)=@ringbuf={{0x18, 0x0, 0x0, 0x0, 0x8d, 0x0, 0x0, 0x0, 0xec5}, {{0x18, 0x1, 0x1, 0x0, r1}, {}, {0x7, 0x0, 0xb, 0x3, 0x0, 0x0, 0xfeff}, {0x85, 0x0, 0x0, 0x86}, {0x7, 0x1, 0xb, 0x9, 0x0, 0x20}}, {{0x5, 0x0, 0x5, 0x9, 0x0, 0x1, 0xffffffff}}, [], {{}, {0x7, 0x0, 0xb, 0x2, 0x0, 0x0, 0x3}, {0x85, 0x0, 0x0, 0x84}}}, &(0x7f00000014c0)='GPL\x00', 0xf, 0x0, 0x0, 0x41100, 0x4b, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0xfffffffc}, 0x94) close_range(r0, r0, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000240)='./proc\x00', 0x1ff) mount(0x0, &(0x7f0000001500)='./proc\x00', &(0x7f0000001540)='proc\x00', 0x0, 0x0) r2 = openat(0xffffffffffffff9c, &(0x7f0000001580)='./proc/thread-self/fail-nth\x00', 0x2, 0x12c) write(r2, &(0x7f00000015c0)='270', 0x3) r3 = syz_open_dev$mtd(&(0x7f0000001600), 0x0, 0x2) socket$nl_generic(0x10, 0x3, 0x10) r4 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000001640)='cpuacct.usage_percpu_user\x00', 0x26e1, 0x0) close(r4) socketpair$nbd(0x1, 0x1, 0x0, 0x0) ioctl$BLKPG(r3, 0x1269, &(0x7f0000001940)={0x1, 0x1f, 0x98, &(0x7f0000001980)={0x3, 0xfffe, 0x12}}) program crashed: WARNING in add_mtd_blktrans_dev testing program (duration=45s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): openat-bpf$MAP_CREATE_RINGBUF-bpf$BPF_PROG_RAW_TRACEPOINT_LOAD-close_range-mkdirat-mount-openat-write-syz_open_dev$mtd-socket$nl_generic-openat$cgroup_ro-close-ioctl$BLKPG detailed listing: executing program 0: r0 = openat(0xffffffffffffff9c, &(0x7f0000000000)='./file2\x00', 0x1c9442, 0x19c) r1 = bpf$MAP_CREATE_RINGBUF(0x0, &(0x7f0000000140)=ANY=[@ANYBLOB="1b0000000000000000000000000004"], 0x50) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000001380)={0x11, 0xf, &(0x7f0000001440)=@ringbuf={{0x18, 0x0, 0x0, 0x0, 0x8d, 0x0, 0x0, 0x0, 0xec5}, {{0x18, 0x1, 0x1, 0x0, r1}, {}, {0x7, 0x0, 0xb, 0x3, 0x0, 0x0, 0xfeff}, {0x85, 0x0, 0x0, 0x86}, {0x7, 0x1, 0xb, 0x9, 0x0, 0x20}}, {{0x5, 0x0, 0x5, 0x9, 0x0, 0x1, 0xffffffff}}, [], {{}, {0x7, 0x0, 0xb, 0x2, 0x0, 0x0, 0x3}, {0x85, 0x0, 0x0, 0x84}}}, &(0x7f00000014c0)='GPL\x00', 0xf, 0x0, 0x0, 0x41100, 0x4b, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0xfffffffc}, 0x94) close_range(r0, r0, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000240)='./proc\x00', 0x1ff) mount(0x0, &(0x7f0000001500)='./proc\x00', &(0x7f0000001540)='proc\x00', 0x0, 0x0) r2 = openat(0xffffffffffffff9c, &(0x7f0000001580)='./proc/thread-self/fail-nth\x00', 0x2, 0x12c) write(r2, &(0x7f00000015c0)='270', 0x3) r3 = syz_open_dev$mtd(&(0x7f0000001600), 0x0, 0x2) socket$nl_generic(0x10, 0x3, 0x10) r4 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000001640)='cpuacct.usage_percpu_user\x00', 0x26e1, 0x0) close(r4) ioctl$BLKPG(r3, 0x1269, &(0x7f0000001940)={0x1, 0x1f, 0x98, &(0x7f0000001980)={0x3, 0xfffe, 0x12}}) program crashed: WARNING in add_mtd_blktrans_dev testing program (duration=45s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): openat-bpf$MAP_CREATE_RINGBUF-bpf$BPF_PROG_RAW_TRACEPOINT_LOAD-close_range-mkdirat-mount-openat-write-syz_open_dev$mtd-socket$nl_generic-openat$cgroup_ro-ioctl$BLKPG detailed listing: executing program 0: r0 = openat(0xffffffffffffff9c, &(0x7f0000000000)='./file2\x00', 0x1c9442, 0x19c) r1 = bpf$MAP_CREATE_RINGBUF(0x0, &(0x7f0000000140)=ANY=[@ANYBLOB="1b0000000000000000000000000004"], 0x50) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000001380)={0x11, 0xf, &(0x7f0000001440)=@ringbuf={{0x18, 0x0, 0x0, 0x0, 0x8d, 0x0, 0x0, 0x0, 0xec5}, {{0x18, 0x1, 0x1, 0x0, r1}, {}, {0x7, 0x0, 0xb, 0x3, 0x0, 0x0, 0xfeff}, {0x85, 0x0, 0x0, 0x86}, {0x7, 0x1, 0xb, 0x9, 0x0, 0x20}}, {{0x5, 0x0, 0x5, 0x9, 0x0, 0x1, 0xffffffff}}, [], {{}, {0x7, 0x0, 0xb, 0x2, 0x0, 0x0, 0x3}, {0x85, 0x0, 0x0, 0x84}}}, &(0x7f00000014c0)='GPL\x00', 0xf, 0x0, 0x0, 0x41100, 0x4b, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0xfffffffc}, 0x94) close_range(r0, r0, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000240)='./proc\x00', 0x1ff) mount(0x0, &(0x7f0000001500)='./proc\x00', &(0x7f0000001540)='proc\x00', 0x0, 0x0) r2 = openat(0xffffffffffffff9c, &(0x7f0000001580)='./proc/thread-self/fail-nth\x00', 0x2, 0x12c) write(r2, &(0x7f00000015c0)='270', 0x3) r3 = syz_open_dev$mtd(&(0x7f0000001600), 0x0, 0x2) socket$nl_generic(0x10, 0x3, 0x10) openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000001640)='cpuacct.usage_percpu_user\x00', 0x26e1, 0x0) ioctl$BLKPG(r3, 0x1269, &(0x7f0000001940)={0x1, 0x1f, 0x98, &(0x7f0000001980)={0x3, 0xfffe, 0x12}}) program crashed: WARNING in add_mtd_blktrans_dev testing program (duration=45s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): openat-bpf$MAP_CREATE_RINGBUF-bpf$BPF_PROG_RAW_TRACEPOINT_LOAD-close_range-mkdirat-mount-openat-write-syz_open_dev$mtd-socket$nl_generic-ioctl$BLKPG detailed listing: executing program 0: r0 = openat(0xffffffffffffff9c, &(0x7f0000000000)='./file2\x00', 0x1c9442, 0x19c) r1 = bpf$MAP_CREATE_RINGBUF(0x0, &(0x7f0000000140)=ANY=[@ANYBLOB="1b0000000000000000000000000004"], 0x50) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000001380)={0x11, 0xf, &(0x7f0000001440)=@ringbuf={{0x18, 0x0, 0x0, 0x0, 0x8d, 0x0, 0x0, 0x0, 0xec5}, {{0x18, 0x1, 0x1, 0x0, r1}, {}, {0x7, 0x0, 0xb, 0x3, 0x0, 0x0, 0xfeff}, {0x85, 0x0, 0x0, 0x86}, {0x7, 0x1, 0xb, 0x9, 0x0, 0x20}}, {{0x5, 0x0, 0x5, 0x9, 0x0, 0x1, 0xffffffff}}, [], {{}, {0x7, 0x0, 0xb, 0x2, 0x0, 0x0, 0x3}, {0x85, 0x0, 0x0, 0x84}}}, &(0x7f00000014c0)='GPL\x00', 0xf, 0x0, 0x0, 0x41100, 0x4b, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0xfffffffc}, 0x94) close_range(r0, r0, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000240)='./proc\x00', 0x1ff) mount(0x0, &(0x7f0000001500)='./proc\x00', &(0x7f0000001540)='proc\x00', 0x0, 0x0) r2 = openat(0xffffffffffffff9c, &(0x7f0000001580)='./proc/thread-self/fail-nth\x00', 0x2, 0x12c) write(r2, &(0x7f00000015c0)='270', 0x3) r3 = syz_open_dev$mtd(&(0x7f0000001600), 0x0, 0x2) socket$nl_generic(0x10, 0x3, 0x10) ioctl$BLKPG(r3, 0x1269, &(0x7f0000001940)={0x1, 0x1f, 0x98, &(0x7f0000001980)={0x3, 0xfffe, 0x12}}) program crashed: WARNING in add_mtd_blktrans_dev testing program (duration=45s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): openat-bpf$MAP_CREATE_RINGBUF-bpf$BPF_PROG_RAW_TRACEPOINT_LOAD-close_range-mkdirat-mount-openat-write-syz_open_dev$mtd-ioctl$BLKPG detailed listing: executing program 0: r0 = openat(0xffffffffffffff9c, &(0x7f0000000000)='./file2\x00', 0x1c9442, 0x19c) r1 = bpf$MAP_CREATE_RINGBUF(0x0, &(0x7f0000000140)=ANY=[@ANYBLOB="1b0000000000000000000000000004"], 0x50) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000001380)={0x11, 0xf, &(0x7f0000001440)=@ringbuf={{0x18, 0x0, 0x0, 0x0, 0x8d, 0x0, 0x0, 0x0, 0xec5}, {{0x18, 0x1, 0x1, 0x0, r1}, {}, {0x7, 0x0, 0xb, 0x3, 0x0, 0x0, 0xfeff}, {0x85, 0x0, 0x0, 0x86}, {0x7, 0x1, 0xb, 0x9, 0x0, 0x20}}, {{0x5, 0x0, 0x5, 0x9, 0x0, 0x1, 0xffffffff}}, [], {{}, {0x7, 0x0, 0xb, 0x2, 0x0, 0x0, 0x3}, {0x85, 0x0, 0x0, 0x84}}}, &(0x7f00000014c0)='GPL\x00', 0xf, 0x0, 0x0, 0x41100, 0x4b, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0xfffffffc}, 0x94) close_range(r0, r0, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000240)='./proc\x00', 0x1ff) mount(0x0, &(0x7f0000001500)='./proc\x00', &(0x7f0000001540)='proc\x00', 0x0, 0x0) r2 = openat(0xffffffffffffff9c, &(0x7f0000001580)='./proc/thread-self/fail-nth\x00', 0x2, 0x12c) write(r2, &(0x7f00000015c0)='270', 0x3) r3 = syz_open_dev$mtd(&(0x7f0000001600), 0x0, 0x2) ioctl$BLKPG(r3, 0x1269, &(0x7f0000001940)={0x1, 0x1f, 0x98, &(0x7f0000001980)={0x3, 0xfffe, 0x12}}) program crashed: WARNING in add_mtd_blktrans_dev testing program (duration=45s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): openat-bpf$MAP_CREATE_RINGBUF-bpf$BPF_PROG_RAW_TRACEPOINT_LOAD-close_range-mkdirat-mount-openat-write-ioctl$BLKPG detailed listing: executing program 0: r0 = openat(0xffffffffffffff9c, &(0x7f0000000000)='./file2\x00', 0x1c9442, 0x19c) r1 = bpf$MAP_CREATE_RINGBUF(0x0, &(0x7f0000000140)=ANY=[@ANYBLOB="1b0000000000000000000000000004"], 0x50) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000001380)={0x11, 0xf, &(0x7f0000001440)=@ringbuf={{0x18, 0x0, 0x0, 0x0, 0x8d, 0x0, 0x0, 0x0, 0xec5}, {{0x18, 0x1, 0x1, 0x0, r1}, {}, {0x7, 0x0, 0xb, 0x3, 0x0, 0x0, 0xfeff}, {0x85, 0x0, 0x0, 0x86}, {0x7, 0x1, 0xb, 0x9, 0x0, 0x20}}, {{0x5, 0x0, 0x5, 0x9, 0x0, 0x1, 0xffffffff}}, [], {{}, {0x7, 0x0, 0xb, 0x2, 0x0, 0x0, 0x3}, {0x85, 0x0, 0x0, 0x84}}}, &(0x7f00000014c0)='GPL\x00', 0xf, 0x0, 0x0, 0x41100, 0x4b, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0xfffffffc}, 0x94) close_range(r0, r0, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000240)='./proc\x00', 0x1ff) mount(0x0, &(0x7f0000001500)='./proc\x00', &(0x7f0000001540)='proc\x00', 0x0, 0x0) r2 = openat(0xffffffffffffff9c, &(0x7f0000001580)='./proc/thread-self/fail-nth\x00', 0x2, 0x12c) write(r2, &(0x7f00000015c0)='270', 0x3) ioctl$BLKPG(0xffffffffffffffff, 0x1269, &(0x7f0000001940)={0x1, 0x1f, 0x98, &(0x7f0000001980)={0x3, 0xfffe, 0x12}}) program did not crash testing program (duration=45s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): openat-bpf$MAP_CREATE_RINGBUF-bpf$BPF_PROG_RAW_TRACEPOINT_LOAD-close_range-mkdirat-mount-openat-syz_open_dev$mtd-ioctl$BLKPG detailed listing: executing program 0: r0 = openat(0xffffffffffffff9c, &(0x7f0000000000)='./file2\x00', 0x1c9442, 0x19c) r1 = bpf$MAP_CREATE_RINGBUF(0x0, &(0x7f0000000140)=ANY=[@ANYBLOB="1b0000000000000000000000000004"], 0x50) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000001380)={0x11, 0xf, &(0x7f0000001440)=@ringbuf={{0x18, 0x0, 0x0, 0x0, 0x8d, 0x0, 0x0, 0x0, 0xec5}, {{0x18, 0x1, 0x1, 0x0, r1}, {}, {0x7, 0x0, 0xb, 0x3, 0x0, 0x0, 0xfeff}, {0x85, 0x0, 0x0, 0x86}, {0x7, 0x1, 0xb, 0x9, 0x0, 0x20}}, {{0x5, 0x0, 0x5, 0x9, 0x0, 0x1, 0xffffffff}}, [], {{}, {0x7, 0x0, 0xb, 0x2, 0x0, 0x0, 0x3}, {0x85, 0x0, 0x0, 0x84}}}, &(0x7f00000014c0)='GPL\x00', 0xf, 0x0, 0x0, 0x41100, 0x4b, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0xfffffffc}, 0x94) close_range(r0, r0, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000240)='./proc\x00', 0x1ff) mount(0x0, &(0x7f0000001500)='./proc\x00', &(0x7f0000001540)='proc\x00', 0x0, 0x0) openat(0xffffffffffffff9c, &(0x7f0000001580)='./proc/thread-self/fail-nth\x00', 0x2, 0x12c) r2 = syz_open_dev$mtd(&(0x7f0000001600), 0x0, 0x2) ioctl$BLKPG(r2, 0x1269, &(0x7f0000001940)={0x1, 0x1f, 0x98, &(0x7f0000001980)={0x3, 0xfffe, 0x12}}) program did not crash testing program (duration=45s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): openat-bpf$MAP_CREATE_RINGBUF-bpf$BPF_PROG_RAW_TRACEPOINT_LOAD-close_range-mkdirat-mount-write-syz_open_dev$mtd-ioctl$BLKPG detailed listing: executing program 0: r0 = openat(0xffffffffffffff9c, &(0x7f0000000000)='./file2\x00', 0x1c9442, 0x19c) r1 = bpf$MAP_CREATE_RINGBUF(0x0, &(0x7f0000000140)=ANY=[@ANYBLOB="1b0000000000000000000000000004"], 0x50) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000001380)={0x11, 0xf, &(0x7f0000001440)=@ringbuf={{0x18, 0x0, 0x0, 0x0, 0x8d, 0x0, 0x0, 0x0, 0xec5}, {{0x18, 0x1, 0x1, 0x0, r1}, {}, {0x7, 0x0, 0xb, 0x3, 0x0, 0x0, 0xfeff}, {0x85, 0x0, 0x0, 0x86}, {0x7, 0x1, 0xb, 0x9, 0x0, 0x20}}, {{0x5, 0x0, 0x5, 0x9, 0x0, 0x1, 0xffffffff}}, [], {{}, {0x7, 0x0, 0xb, 0x2, 0x0, 0x0, 0x3}, {0x85, 0x0, 0x0, 0x84}}}, &(0x7f00000014c0)='GPL\x00', 0xf, 0x0, 0x0, 0x41100, 0x4b, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0xfffffffc}, 0x94) close_range(r0, r0, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000240)='./proc\x00', 0x1ff) mount(0x0, &(0x7f0000001500)='./proc\x00', &(0x7f0000001540)='proc\x00', 0x0, 0x0) write(0xffffffffffffffff, &(0x7f00000015c0)='270', 0x3) r2 = syz_open_dev$mtd(&(0x7f0000001600), 0x0, 0x2) ioctl$BLKPG(r2, 0x1269, &(0x7f0000001940)={0x1, 0x1f, 0x98, &(0x7f0000001980)={0x3, 0xfffe, 0x12}}) program did not crash testing program (duration=45s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): openat-bpf$MAP_CREATE_RINGBUF-bpf$BPF_PROG_RAW_TRACEPOINT_LOAD-close_range-mkdirat-openat-write-syz_open_dev$mtd-ioctl$BLKPG detailed listing: executing program 0: r0 = openat(0xffffffffffffff9c, &(0x7f0000000000)='./file2\x00', 0x1c9442, 0x19c) r1 = bpf$MAP_CREATE_RINGBUF(0x0, &(0x7f0000000140)=ANY=[@ANYBLOB="1b0000000000000000000000000004"], 0x50) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000001380)={0x11, 0xf, &(0x7f0000001440)=@ringbuf={{0x18, 0x0, 0x0, 0x0, 0x8d, 0x0, 0x0, 0x0, 0xec5}, {{0x18, 0x1, 0x1, 0x0, r1}, {}, {0x7, 0x0, 0xb, 0x3, 0x0, 0x0, 0xfeff}, {0x85, 0x0, 0x0, 0x86}, {0x7, 0x1, 0xb, 0x9, 0x0, 0x20}}, {{0x5, 0x0, 0x5, 0x9, 0x0, 0x1, 0xffffffff}}, [], {{}, {0x7, 0x0, 0xb, 0x2, 0x0, 0x0, 0x3}, {0x85, 0x0, 0x0, 0x84}}}, &(0x7f00000014c0)='GPL\x00', 0xf, 0x0, 0x0, 0x41100, 0x4b, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0xfffffffc}, 0x94) close_range(r0, r0, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000240)='./proc\x00', 0x1ff) r2 = openat(0xffffffffffffff9c, &(0x7f0000001580)='./proc/thread-self/fail-nth\x00', 0x2, 0x12c) write(r2, &(0x7f00000015c0)='270', 0x3) r3 = syz_open_dev$mtd(&(0x7f0000001600), 0x0, 0x2) ioctl$BLKPG(r3, 0x1269, &(0x7f0000001940)={0x1, 0x1f, 0x98, &(0x7f0000001980)={0x3, 0xfffe, 0x12}}) program did not crash testing program (duration=45s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): openat-bpf$MAP_CREATE_RINGBUF-bpf$BPF_PROG_RAW_TRACEPOINT_LOAD-close_range-mount-openat-write-syz_open_dev$mtd-ioctl$BLKPG detailed listing: executing program 0: r0 = openat(0xffffffffffffff9c, &(0x7f0000000000)='./file2\x00', 0x1c9442, 0x19c) r1 = bpf$MAP_CREATE_RINGBUF(0x0, &(0x7f0000000140)=ANY=[@ANYBLOB="1b0000000000000000000000000004"], 0x50) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000001380)={0x11, 0xf, &(0x7f0000001440)=@ringbuf={{0x18, 0x0, 0x0, 0x0, 0x8d, 0x0, 0x0, 0x0, 0xec5}, {{0x18, 0x1, 0x1, 0x0, r1}, {}, {0x7, 0x0, 0xb, 0x3, 0x0, 0x0, 0xfeff}, {0x85, 0x0, 0x0, 0x86}, {0x7, 0x1, 0xb, 0x9, 0x0, 0x20}}, {{0x5, 0x0, 0x5, 0x9, 0x0, 0x1, 0xffffffff}}, [], {{}, {0x7, 0x0, 0xb, 0x2, 0x0, 0x0, 0x3}, {0x85, 0x0, 0x0, 0x84}}}, &(0x7f00000014c0)='GPL\x00', 0xf, 0x0, 0x0, 0x41100, 0x4b, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0xfffffffc}, 0x94) close_range(r0, r0, 0x0) mount(0x0, &(0x7f0000001500)='./proc\x00', &(0x7f0000001540)='proc\x00', 0x0, 0x0) r2 = openat(0xffffffffffffff9c, &(0x7f0000001580)='./proc/thread-self/fail-nth\x00', 0x2, 0x12c) write(r2, &(0x7f00000015c0)='270', 0x3) r3 = syz_open_dev$mtd(&(0x7f0000001600), 0x0, 0x2) ioctl$BLKPG(r3, 0x1269, &(0x7f0000001940)={0x1, 0x1f, 0x98, &(0x7f0000001980)={0x3, 0xfffe, 0x12}}) program did not crash testing program (duration=45s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): openat-bpf$MAP_CREATE_RINGBUF-bpf$BPF_PROG_RAW_TRACEPOINT_LOAD-mkdirat-mount-openat-write-syz_open_dev$mtd-ioctl$BLKPG detailed listing: executing program 0: openat(0xffffffffffffff9c, &(0x7f0000000000)='./file2\x00', 0x1c9442, 0x19c) r0 = bpf$MAP_CREATE_RINGBUF(0x0, &(0x7f0000000140)=ANY=[@ANYBLOB="1b0000000000000000000000000004"], 0x50) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000001380)={0x11, 0xf, &(0x7f0000001440)=@ringbuf={{0x18, 0x0, 0x0, 0x0, 0x8d, 0x0, 0x0, 0x0, 0xec5}, {{0x18, 0x1, 0x1, 0x0, r0}, {}, {0x7, 0x0, 0xb, 0x3, 0x0, 0x0, 0xfeff}, {0x85, 0x0, 0x0, 0x86}, {0x7, 0x1, 0xb, 0x9, 0x0, 0x20}}, {{0x5, 0x0, 0x5, 0x9, 0x0, 0x1, 0xffffffff}}, [], {{}, {0x7, 0x0, 0xb, 0x2, 0x0, 0x0, 0x3}, {0x85, 0x0, 0x0, 0x84}}}, &(0x7f00000014c0)='GPL\x00', 0xf, 0x0, 0x0, 0x41100, 0x4b, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0xfffffffc}, 0x94) mkdirat(0xffffffffffffff9c, &(0x7f0000000240)='./proc\x00', 0x1ff) mount(0x0, &(0x7f0000001500)='./proc\x00', &(0x7f0000001540)='proc\x00', 0x0, 0x0) r1 = openat(0xffffffffffffff9c, &(0x7f0000001580)='./proc/thread-self/fail-nth\x00', 0x2, 0x12c) write(r1, &(0x7f00000015c0)='270', 0x3) r2 = syz_open_dev$mtd(&(0x7f0000001600), 0x0, 0x2) ioctl$BLKPG(r2, 0x1269, &(0x7f0000001940)={0x1, 0x1f, 0x98, &(0x7f0000001980)={0x3, 0xfffe, 0x12}}) program did not crash testing program (duration=45s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): openat-bpf$MAP_CREATE_RINGBUF-close_range-mkdirat-mount-openat-write-syz_open_dev$mtd-ioctl$BLKPG detailed listing: executing program 0: r0 = openat(0xffffffffffffff9c, &(0x7f0000000000)='./file2\x00', 0x1c9442, 0x19c) bpf$MAP_CREATE_RINGBUF(0x0, &(0x7f0000000140)=ANY=[@ANYBLOB="1b0000000000000000000000000004"], 0x50) close_range(r0, r0, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000240)='./proc\x00', 0x1ff) mount(0x0, &(0x7f0000001500)='./proc\x00', &(0x7f0000001540)='proc\x00', 0x0, 0x0) r1 = openat(0xffffffffffffff9c, &(0x7f0000001580)='./proc/thread-self/fail-nth\x00', 0x2, 0x12c) write(r1, &(0x7f00000015c0)='270', 0x3) r2 = syz_open_dev$mtd(&(0x7f0000001600), 0x0, 0x2) ioctl$BLKPG(r2, 0x1269, &(0x7f0000001940)={0x1, 0x1f, 0x98, &(0x7f0000001980)={0x3, 0xfffe, 0x12}}) program did not crash testing program (duration=45s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): openat-bpf$BPF_PROG_RAW_TRACEPOINT_LOAD-close_range-mkdirat-mount-openat-write-syz_open_dev$mtd-ioctl$BLKPG detailed listing: executing program 0: r0 = openat(0xffffffffffffff9c, &(0x7f0000000000)='./file2\x00', 0x1c9442, 0x19c) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000001380)={0x11, 0xf, &(0x7f0000001440)=@ringbuf={{0x18, 0x0, 0x0, 0x0, 0x8d, 0x0, 0x0, 0x0, 0xec5}, {{}, {}, {0x7, 0x0, 0xb, 0x3, 0x0, 0x0, 0xfeff}, {0x85, 0x0, 0x0, 0x86}, {0x7, 0x1, 0xb, 0x9, 0x0, 0x20}}, {{0x5, 0x0, 0x5, 0x9, 0x0, 0x1, 0xffffffff}}, [], {{}, {0x7, 0x0, 0xb, 0x2, 0x0, 0x0, 0x3}, {0x85, 0x0, 0x0, 0x84}}}, &(0x7f00000014c0)='GPL\x00', 0xf, 0x0, 0x0, 0x41100, 0x4b, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0xfffffffc}, 0x94) close_range(r0, r0, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000240)='./proc\x00', 0x1ff) mount(0x0, &(0x7f0000001500)='./proc\x00', &(0x7f0000001540)='proc\x00', 0x0, 0x0) r1 = openat(0xffffffffffffff9c, &(0x7f0000001580)='./proc/thread-self/fail-nth\x00', 0x2, 0x12c) write(r1, &(0x7f00000015c0)='270', 0x3) r2 = syz_open_dev$mtd(&(0x7f0000001600), 0x0, 0x2) ioctl$BLKPG(r2, 0x1269, &(0x7f0000001940)={0x1, 0x1f, 0x98, &(0x7f0000001980)={0x3, 0xfffe, 0x12}}) program did not crash testing program (duration=45s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): bpf$MAP_CREATE_RINGBUF-bpf$BPF_PROG_RAW_TRACEPOINT_LOAD-close_range-mkdirat-mount-openat-write-syz_open_dev$mtd-ioctl$BLKPG detailed listing: executing program 0: r0 = bpf$MAP_CREATE_RINGBUF(0x0, &(0x7f0000000140)=ANY=[@ANYBLOB="1b0000000000000000000000000004"], 0x50) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000001380)={0x11, 0xf, &(0x7f0000001440)=@ringbuf={{0x18, 0x0, 0x0, 0x0, 0x8d, 0x0, 0x0, 0x0, 0xec5}, {{0x18, 0x1, 0x1, 0x0, r0}, {}, {0x7, 0x0, 0xb, 0x3, 0x0, 0x0, 0xfeff}, {0x85, 0x0, 0x0, 0x86}, {0x7, 0x1, 0xb, 0x9, 0x0, 0x20}}, {{0x5, 0x0, 0x5, 0x9, 0x0, 0x1, 0xffffffff}}, [], {{}, {0x7, 0x0, 0xb, 0x2, 0x0, 0x0, 0x3}, {0x85, 0x0, 0x0, 0x84}}}, &(0x7f00000014c0)='GPL\x00', 0xf, 0x0, 0x0, 0x41100, 0x4b, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0xfffffffc}, 0x94) close_range(0xffffffffffffffff, 0xffffffffffffffff, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000240)='./proc\x00', 0x1ff) mount(0x0, &(0x7f0000001500)='./proc\x00', &(0x7f0000001540)='proc\x00', 0x0, 0x0) r1 = openat(0xffffffffffffff9c, &(0x7f0000001580)='./proc/thread-self/fail-nth\x00', 0x2, 0x12c) write(r1, &(0x7f00000015c0)='270', 0x3) r2 = syz_open_dev$mtd(&(0x7f0000001600), 0x0, 0x2) ioctl$BLKPG(r2, 0x1269, &(0x7f0000001940)={0x1, 0x1f, 0x98, &(0x7f0000001980)={0x3, 0xfffe, 0x12}}) program did not crash testing program (duration=45s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): openat-bpf$MAP_CREATE_RINGBUF-bpf$BPF_PROG_RAW_TRACEPOINT_LOAD-close_range-mkdirat-mount-openat-write-syz_open_dev$mtd-ioctl$BLKPG detailed listing: executing program 0: r0 = openat(0xffffffffffffff9c, 0x0, 0x1c9442, 0x19c) r1 = bpf$MAP_CREATE_RINGBUF(0x0, &(0x7f0000000140)=ANY=[@ANYBLOB="1b0000000000000000000000000004"], 0x50) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000001380)={0x11, 0xf, &(0x7f0000001440)=@ringbuf={{0x18, 0x0, 0x0, 0x0, 0x8d, 0x0, 0x0, 0x0, 0xec5}, {{0x18, 0x1, 0x1, 0x0, r1}, {}, {0x7, 0x0, 0xb, 0x3, 0x0, 0x0, 0xfeff}, {0x85, 0x0, 0x0, 0x86}, {0x7, 0x1, 0xb, 0x9, 0x0, 0x20}}, {{0x5, 0x0, 0x5, 0x9, 0x0, 0x1, 0xffffffff}}, [], {{}, {0x7, 0x0, 0xb, 0x2, 0x0, 0x0, 0x3}, {0x85, 0x0, 0x0, 0x84}}}, &(0x7f00000014c0)='GPL\x00', 0xf, 0x0, 0x0, 0x41100, 0x4b, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0xfffffffc}, 0x94) close_range(r0, r0, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000240)='./proc\x00', 0x1ff) mount(0x0, &(0x7f0000001500)='./proc\x00', &(0x7f0000001540)='proc\x00', 0x0, 0x0) r2 = openat(0xffffffffffffff9c, &(0x7f0000001580)='./proc/thread-self/fail-nth\x00', 0x2, 0x12c) write(r2, &(0x7f00000015c0)='270', 0x3) r3 = syz_open_dev$mtd(&(0x7f0000001600), 0x0, 0x2) ioctl$BLKPG(r3, 0x1269, &(0x7f0000001940)={0x1, 0x1f, 0x98, &(0x7f0000001980)={0x3, 0xfffe, 0x12}}) program crashed: WARNING in add_mtd_blktrans_dev testing program (duration=45s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): openat-bpf$MAP_CREATE_RINGBUF-bpf$BPF_PROG_RAW_TRACEPOINT_LOAD-close_range-mkdirat-mount-openat-write-syz_open_dev$mtd-ioctl$BLKPG detailed listing: executing program 0: r0 = openat(0xffffffffffffff9c, 0x0, 0x1c9442, 0x19c) r1 = bpf$MAP_CREATE_RINGBUF(0x0, 0x0, 0x50) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000001380)={0x11, 0xf, &(0x7f0000001440)=@ringbuf={{0x18, 0x0, 0x0, 0x0, 0x8d, 0x0, 0x0, 0x0, 0xec5}, {{0x18, 0x1, 0x1, 0x0, r1}, {}, {0x7, 0x0, 0xb, 0x3, 0x0, 0x0, 0xfeff}, {0x85, 0x0, 0x0, 0x86}, {0x7, 0x1, 0xb, 0x9, 0x0, 0x20}}, {{0x5, 0x0, 0x5, 0x9, 0x0, 0x1, 0xffffffff}}, [], {{}, {0x7, 0x0, 0xb, 0x2, 0x0, 0x0, 0x3}, {0x85, 0x0, 0x0, 0x84}}}, &(0x7f00000014c0)='GPL\x00', 0xf, 0x0, 0x0, 0x41100, 0x4b, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0xfffffffc}, 0x94) close_range(r0, r0, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000240)='./proc\x00', 0x1ff) mount(0x0, &(0x7f0000001500)='./proc\x00', &(0x7f0000001540)='proc\x00', 0x0, 0x0) r2 = openat(0xffffffffffffff9c, &(0x7f0000001580)='./proc/thread-self/fail-nth\x00', 0x2, 0x12c) write(r2, &(0x7f00000015c0)='270', 0x3) r3 = syz_open_dev$mtd(&(0x7f0000001600), 0x0, 0x2) ioctl$BLKPG(r3, 0x1269, &(0x7f0000001940)={0x1, 0x1f, 0x98, &(0x7f0000001980)={0x3, 0xfffe, 0x12}}) program crashed: WARNING in add_mtd_blktrans_dev testing program (duration=45s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): openat-bpf$MAP_CREATE_RINGBUF-bpf$BPF_PROG_RAW_TRACEPOINT_LOAD-close_range-mkdirat-mount-openat-write-syz_open_dev$mtd-ioctl$BLKPG detailed listing: executing program 0: r0 = openat(0xffffffffffffff9c, 0x0, 0x1c9442, 0x19c) bpf$MAP_CREATE_RINGBUF(0x0, 0x0, 0x50) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, 0x0, 0x0) close_range(r0, r0, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000240)='./proc\x00', 0x1ff) mount(0x0, &(0x7f0000001500)='./proc\x00', &(0x7f0000001540)='proc\x00', 0x0, 0x0) r1 = openat(0xffffffffffffff9c, &(0x7f0000001580)='./proc/thread-self/fail-nth\x00', 0x2, 0x12c) write(r1, &(0x7f00000015c0)='270', 0x3) r2 = syz_open_dev$mtd(&(0x7f0000001600), 0x0, 0x2) ioctl$BLKPG(r2, 0x1269, &(0x7f0000001940)={0x1, 0x1f, 0x98, &(0x7f0000001980)={0x3, 0xfffe, 0x12}}) program did not crash testing program (duration=45s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): openat-bpf$MAP_CREATE_RINGBUF-bpf$BPF_PROG_RAW_TRACEPOINT_LOAD-close_range-mkdirat-mount-openat-write-syz_open_dev$mtd-ioctl$BLKPG detailed listing: executing program 0: r0 = openat(0xffffffffffffff9c, 0x0, 0x1c9442, 0x19c) bpf$MAP_CREATE_RINGBUF(0x0, 0x0, 0x50) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000001380)={0x11, 0x0, 0x0, &(0x7f00000014c0)='GPL\x00', 0xf, 0x0, 0x0, 0x41100, 0x4b, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0xfffffffc}, 0x94) close_range(r0, r0, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000240)='./proc\x00', 0x1ff) mount(0x0, &(0x7f0000001500)='./proc\x00', &(0x7f0000001540)='proc\x00', 0x0, 0x0) r1 = openat(0xffffffffffffff9c, &(0x7f0000001580)='./proc/thread-self/fail-nth\x00', 0x2, 0x12c) write(r1, &(0x7f00000015c0)='270', 0x3) r2 = syz_open_dev$mtd(&(0x7f0000001600), 0x0, 0x2) ioctl$BLKPG(r2, 0x1269, &(0x7f0000001940)={0x1, 0x1f, 0x98, &(0x7f0000001980)={0x3, 0xfffe, 0x12}}) program crashed: WARNING in add_mtd_blktrans_dev testing program (duration=45s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): openat-bpf$MAP_CREATE_RINGBUF-bpf$BPF_PROG_RAW_TRACEPOINT_LOAD-close_range-mkdirat-mount-openat-write-syz_open_dev$mtd-ioctl$BLKPG detailed listing: executing program 0: r0 = openat(0xffffffffffffff9c, 0x0, 0x1c9442, 0x19c) bpf$MAP_CREATE_RINGBUF(0x0, 0x0, 0x50) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000001380)={0x11, 0x0, 0x0, 0x0, 0xf, 0x0, 0x0, 0x41100, 0x4b, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0xfffffffc}, 0x94) close_range(r0, r0, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000240)='./proc\x00', 0x1ff) mount(0x0, &(0x7f0000001500)='./proc\x00', &(0x7f0000001540)='proc\x00', 0x0, 0x0) r1 = openat(0xffffffffffffff9c, &(0x7f0000001580)='./proc/thread-self/fail-nth\x00', 0x2, 0x12c) write(r1, &(0x7f00000015c0)='270', 0x3) r2 = syz_open_dev$mtd(&(0x7f0000001600), 0x0, 0x2) ioctl$BLKPG(r2, 0x1269, &(0x7f0000001940)={0x1, 0x1f, 0x98, &(0x7f0000001980)={0x3, 0xfffe, 0x12}}) program crashed: WARNING in add_mtd_blktrans_dev testing program (duration=45s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): openat-bpf$MAP_CREATE_RINGBUF-bpf$BPF_PROG_RAW_TRACEPOINT_LOAD-close_range-mkdirat-mount-openat-write-syz_open_dev$mtd-ioctl$BLKPG detailed listing: executing program 0: r0 = openat(0xffffffffffffff9c, 0x0, 0x1c9442, 0x19c) bpf$MAP_CREATE_RINGBUF(0x0, 0x0, 0x50) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000001380)={0x11, 0x0, 0x0, 0x0, 0xf, 0x0, 0x0, 0x41100, 0x4b, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0xfffffffc}, 0x94) close_range(r0, r0, 0x0) mkdirat(0xffffffffffffff9c, 0x0, 0x1ff) mount(0x0, &(0x7f0000001500)='./proc\x00', &(0x7f0000001540)='proc\x00', 0x0, 0x0) r1 = openat(0xffffffffffffff9c, &(0x7f0000001580)='./proc/thread-self/fail-nth\x00', 0x2, 0x12c) write(r1, &(0x7f00000015c0)='270', 0x3) r2 = syz_open_dev$mtd(&(0x7f0000001600), 0x0, 0x2) ioctl$BLKPG(r2, 0x1269, &(0x7f0000001940)={0x1, 0x1f, 0x98, &(0x7f0000001980)={0x3, 0xfffe, 0x12}}) program did not crash testing program (duration=45s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): openat-bpf$MAP_CREATE_RINGBUF-bpf$BPF_PROG_RAW_TRACEPOINT_LOAD-close_range-mkdirat-mount-openat-write-syz_open_dev$mtd-ioctl$BLKPG detailed listing: executing program 0: r0 = openat(0xffffffffffffff9c, 0x0, 0x1c9442, 0x19c) bpf$MAP_CREATE_RINGBUF(0x0, 0x0, 0x50) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000001380)={0x11, 0x0, 0x0, 0x0, 0xf, 0x0, 0x0, 0x41100, 0x4b, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0xfffffffc}, 0x94) close_range(r0, r0, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000240)='./proc\x00', 0x1ff) mount(0x0, 0x0, &(0x7f0000001540)='proc\x00', 0x0, 0x0) r1 = openat(0xffffffffffffff9c, &(0x7f0000001580)='./proc/thread-self/fail-nth\x00', 0x2, 0x12c) write(r1, &(0x7f00000015c0)='270', 0x3) r2 = syz_open_dev$mtd(&(0x7f0000001600), 0x0, 0x2) ioctl$BLKPG(r2, 0x1269, &(0x7f0000001940)={0x1, 0x1f, 0x98, &(0x7f0000001980)={0x3, 0xfffe, 0x12}}) program did not crash testing program (duration=45s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): openat-bpf$MAP_CREATE_RINGBUF-bpf$BPF_PROG_RAW_TRACEPOINT_LOAD-close_range-mkdirat-mount-openat-write-syz_open_dev$mtd-ioctl$BLKPG detailed listing: executing program 0: r0 = openat(0xffffffffffffff9c, 0x0, 0x1c9442, 0x19c) bpf$MAP_CREATE_RINGBUF(0x0, 0x0, 0x50) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000001380)={0x11, 0x0, 0x0, 0x0, 0xf, 0x0, 0x0, 0x41100, 0x4b, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0xfffffffc}, 0x94) close_range(r0, r0, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000240)='./proc\x00', 0x1ff) mount(0x0, &(0x7f0000001500)='./proc\x00', 0x0, 0x0, 0x0) r1 = openat(0xffffffffffffff9c, &(0x7f0000001580)='./proc/thread-self/fail-nth\x00', 0x2, 0x12c) write(r1, &(0x7f00000015c0)='270', 0x3) r2 = syz_open_dev$mtd(&(0x7f0000001600), 0x0, 0x2) ioctl$BLKPG(r2, 0x1269, &(0x7f0000001940)={0x1, 0x1f, 0x98, &(0x7f0000001980)={0x3, 0xfffe, 0x12}}) program did not crash testing program (duration=45s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): openat-bpf$MAP_CREATE_RINGBUF-bpf$BPF_PROG_RAW_TRACEPOINT_LOAD-close_range-mkdirat-mount-openat-write-syz_open_dev$mtd-ioctl$BLKPG detailed listing: executing program 0: r0 = openat(0xffffffffffffff9c, 0x0, 0x1c9442, 0x19c) bpf$MAP_CREATE_RINGBUF(0x0, 0x0, 0x50) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000001380)={0x11, 0x0, 0x0, 0x0, 0xf, 0x0, 0x0, 0x41100, 0x4b, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0xfffffffc}, 0x94) close_range(r0, r0, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000240)='./proc\x00', 0x1ff) mount(0x0, &(0x7f0000001500)='./proc\x00', &(0x7f0000001540)='proc\x00', 0x0, 0x0) r1 = openat(0xffffffffffffff9c, 0x0, 0x2, 0x12c) write(r1, &(0x7f00000015c0)='270', 0x3) r2 = syz_open_dev$mtd(&(0x7f0000001600), 0x0, 0x2) ioctl$BLKPG(r2, 0x1269, &(0x7f0000001940)={0x1, 0x1f, 0x98, &(0x7f0000001980)={0x3, 0xfffe, 0x12}}) program did not crash testing program (duration=45s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): openat-bpf$MAP_CREATE_RINGBUF-bpf$BPF_PROG_RAW_TRACEPOINT_LOAD-close_range-mkdirat-mount-openat-write-syz_open_dev$mtd-ioctl$BLKPG detailed listing: executing program 0: r0 = openat(0xffffffffffffff9c, 0x0, 0x1c9442, 0x19c) bpf$MAP_CREATE_RINGBUF(0x0, 0x0, 0x50) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000001380)={0x11, 0x0, 0x0, 0x0, 0xf, 0x0, 0x0, 0x41100, 0x4b, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0xfffffffc}, 0x94) close_range(r0, r0, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000240)='./proc\x00', 0x1ff) mount(0x0, &(0x7f0000001500)='./proc\x00', &(0x7f0000001540)='proc\x00', 0x0, 0x0) r1 = openat(0xffffffffffffff9c, &(0x7f0000001580)='./proc/thread-self/fail-nth\x00', 0x2, 0x12c) write(r1, 0x0, 0x0) r2 = syz_open_dev$mtd(&(0x7f0000001600), 0x0, 0x2) ioctl$BLKPG(r2, 0x1269, &(0x7f0000001940)={0x1, 0x1f, 0x98, &(0x7f0000001980)={0x3, 0xfffe, 0x12}}) program did not crash testing program (duration=45s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): openat-bpf$MAP_CREATE_RINGBUF-bpf$BPF_PROG_RAW_TRACEPOINT_LOAD-close_range-mkdirat-mount-openat-write-syz_open_dev$mtd-ioctl$BLKPG detailed listing: executing program 0: r0 = openat(0xffffffffffffff9c, 0x0, 0x1c9442, 0x19c) bpf$MAP_CREATE_RINGBUF(0x0, 0x0, 0x50) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000001380)={0x11, 0x0, 0x0, 0x0, 0xf, 0x0, 0x0, 0x41100, 0x4b, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0xfffffffc}, 0x94) close_range(r0, r0, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000240)='./proc\x00', 0x1ff) mount(0x0, &(0x7f0000001500)='./proc\x00', &(0x7f0000001540)='proc\x00', 0x0, 0x0) r1 = openat(0xffffffffffffff9c, &(0x7f0000001580)='./proc/thread-self/fail-nth\x00', 0x2, 0x12c) write(r1, &(0x7f00000015c0), 0x0) r2 = syz_open_dev$mtd(&(0x7f0000001600), 0x0, 0x2) ioctl$BLKPG(r2, 0x1269, &(0x7f0000001940)={0x1, 0x1f, 0x98, &(0x7f0000001980)={0x3, 0xfffe, 0x12}}) program did not crash testing program (duration=45s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): openat-bpf$MAP_CREATE_RINGBUF-bpf$BPF_PROG_RAW_TRACEPOINT_LOAD-close_range-mkdirat-mount-openat-write-syz_open_dev$mtd-ioctl$BLKPG detailed listing: executing program 0: r0 = openat(0xffffffffffffff9c, 0x0, 0x1c9442, 0x19c) bpf$MAP_CREATE_RINGBUF(0x0, 0x0, 0x50) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000001380)={0x11, 0x0, 0x0, 0x0, 0xf, 0x0, 0x0, 0x41100, 0x4b, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0xfffffffc}, 0x94) close_range(r0, r0, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000240)='./proc\x00', 0x1ff) mount(0x0, &(0x7f0000001500)='./proc\x00', &(0x7f0000001540)='proc\x00', 0x0, 0x0) r1 = openat(0xffffffffffffff9c, &(0x7f0000001580)='./proc/thread-self/fail-nth\x00', 0x2, 0x12c) write(r1, &(0x7f00000015c0)='270', 0x3) r2 = syz_open_dev$mtd(0x0, 0x0, 0x2) ioctl$BLKPG(r2, 0x1269, &(0x7f0000001940)={0x1, 0x1f, 0x98, &(0x7f0000001980)={0x3, 0xfffe, 0x12}}) program did not crash testing program (duration=45s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): openat-bpf$MAP_CREATE_RINGBUF-bpf$BPF_PROG_RAW_TRACEPOINT_LOAD-close_range-mkdirat-mount-openat-write-syz_open_dev$mtd-ioctl$BLKPG detailed listing: executing program 0: r0 = openat(0xffffffffffffff9c, 0x0, 0x1c9442, 0x19c) bpf$MAP_CREATE_RINGBUF(0x0, 0x0, 0x50) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000001380)={0x11, 0x0, 0x0, 0x0, 0xf, 0x0, 0x0, 0x41100, 0x4b, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0xfffffffc}, 0x94) close_range(r0, r0, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000240)='./proc\x00', 0x1ff) mount(0x0, &(0x7f0000001500)='./proc\x00', &(0x7f0000001540)='proc\x00', 0x0, 0x0) r1 = openat(0xffffffffffffff9c, &(0x7f0000001580)='./proc/thread-self/fail-nth\x00', 0x2, 0x12c) write(r1, &(0x7f00000015c0)='270', 0x3) r2 = syz_open_dev$mtd(&(0x7f0000001600), 0x0, 0x2) ioctl$BLKPG(r2, 0x1269, 0x0) program did not crash testing program (duration=45s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): openat-bpf$MAP_CREATE_RINGBUF-bpf$BPF_PROG_RAW_TRACEPOINT_LOAD-close_range-mkdirat-mount-openat-write-syz_open_dev$mtd-ioctl$BLKPG detailed listing: executing program 0: r0 = openat(0xffffffffffffff9c, 0x0, 0x1c9442, 0x19c) bpf$MAP_CREATE_RINGBUF(0x0, 0x0, 0x50) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000001380)={0x11, 0x0, 0x0, 0x0, 0xf, 0x0, 0x0, 0x41100, 0x4b, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0xfffffffc}, 0x94) close_range(r0, r0, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000240)='./proc\x00', 0x1ff) mount(0x0, &(0x7f0000001500)='./proc\x00', &(0x7f0000001540)='proc\x00', 0x0, 0x0) r1 = openat(0xffffffffffffff9c, &(0x7f0000001580)='./proc/thread-self/fail-nth\x00', 0x2, 0x12c) write(r1, &(0x7f00000015c0)='270', 0x3) r2 = syz_open_dev$mtd(&(0x7f0000001600), 0x0, 0x2) ioctl$BLKPG(r2, 0x1269, &(0x7f0000001940)={0x1, 0x1f, 0x0, 0x0}) program did not crash extracting C reproducer testing compiled C program (duration=45s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): openat-bpf$MAP_CREATE_RINGBUF-bpf$BPF_PROG_RAW_TRACEPOINT_LOAD-close_range-mkdirat-mount-openat-write-syz_open_dev$mtd-ioctl$BLKPG program did not crash simplifying guilty program options testing program (duration=45s, {Threaded:false Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): openat-bpf$MAP_CREATE_RINGBUF-bpf$BPF_PROG_RAW_TRACEPOINT_LOAD-close_range-mkdirat-mount-openat-write-syz_open_dev$mtd-ioctl$BLKPG detailed listing: executing program 0: r0 = openat(0xffffffffffffff9c, 0x0, 0x1c9442, 0x19c) bpf$MAP_CREATE_RINGBUF(0x0, 0x0, 0x50) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000001380)={0x11, 0x0, 0x0, 0x0, 0xf, 0x0, 0x0, 0x41100, 0x4b, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0xfffffffc}, 0x94) close_range(r0, r0, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000240)='./proc\x00', 0x1ff) mount(0x0, &(0x7f0000001500)='./proc\x00', &(0x7f0000001540)='proc\x00', 0x0, 0x0) r1 = openat(0xffffffffffffff9c, &(0x7f0000001580)='./proc/thread-self/fail-nth\x00', 0x2, 0x12c) write(r1, &(0x7f00000015c0)='270', 0x3) r2 = syz_open_dev$mtd(&(0x7f0000001600), 0x0, 0x2) ioctl$BLKPG(r2, 0x1269, &(0x7f0000001940)={0x1, 0x1f, 0x98, &(0x7f0000001980)={0x3, 0xfffe, 0x12}}) program crashed: WARNING in add_mtd_blktrans_dev extracting C reproducer testing compiled C program (duration=45s, {Threaded:false Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): openat-bpf$MAP_CREATE_RINGBUF-bpf$BPF_PROG_RAW_TRACEPOINT_LOAD-close_range-mkdirat-mount-openat-write-syz_open_dev$mtd-ioctl$BLKPG program did not crash testing program (duration=45s, {Threaded:false Repeat:false RepeatTimes:0 Procs:1 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:false Cgroups:false BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): openat-bpf$MAP_CREATE_RINGBUF-bpf$BPF_PROG_RAW_TRACEPOINT_LOAD-close_range-mkdirat-mount-openat-write-syz_open_dev$mtd-ioctl$BLKPG detailed listing: executing program 0: r0 = openat(0xffffffffffffff9c, 0x0, 0x1c9442, 0x19c) bpf$MAP_CREATE_RINGBUF(0x0, 0x0, 0x50) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000001380)={0x11, 0x0, 0x0, 0x0, 0xf, 0x0, 0x0, 0x41100, 0x4b, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0xfffffffc}, 0x94) close_range(r0, r0, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000240)='./proc\x00', 0x1ff) mount(0x0, &(0x7f0000001500)='./proc\x00', &(0x7f0000001540)='proc\x00', 0x0, 0x0) r1 = openat(0xffffffffffffff9c, &(0x7f0000001580)='./proc/thread-self/fail-nth\x00', 0x2, 0x12c) write(r1, &(0x7f00000015c0)='270', 0x3) r2 = syz_open_dev$mtd(&(0x7f0000001600), 0x0, 0x2) ioctl$BLKPG(r2, 0x1269, &(0x7f0000001940)={0x1, 0x1f, 0x98, &(0x7f0000001980)={0x3, 0xfffe, 0x12}}) program did not crash testing program (duration=45s, {Threaded:false Repeat:true RepeatTimes:0 Procs:1 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): openat-bpf$MAP_CREATE_RINGBUF-bpf$BPF_PROG_RAW_TRACEPOINT_LOAD-close_range-mkdirat-mount-openat-write-syz_open_dev$mtd-ioctl$BLKPG detailed listing: executing program 0: r0 = openat(0xffffffffffffff9c, 0x0, 0x1c9442, 0x19c) bpf$MAP_CREATE_RINGBUF(0x0, 0x0, 0x50) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000001380)={0x11, 0x0, 0x0, 0x0, 0xf, 0x0, 0x0, 0x41100, 0x4b, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0xfffffffc}, 0x94) close_range(r0, r0, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000240)='./proc\x00', 0x1ff) mount(0x0, &(0x7f0000001500)='./proc\x00', &(0x7f0000001540)='proc\x00', 0x0, 0x0) r1 = openat(0xffffffffffffff9c, &(0x7f0000001580)='./proc/thread-self/fail-nth\x00', 0x2, 0x12c) write(r1, &(0x7f00000015c0)='270', 0x3) r2 = syz_open_dev$mtd(&(0x7f0000001600), 0x0, 0x2) ioctl$BLKPG(r2, 0x1269, &(0x7f0000001940)={0x1, 0x1f, 0x98, &(0x7f0000001980)={0x3, 0xfffe, 0x12}}) program crashed: WARNING in add_mtd_blktrans_dev extracting C reproducer testing compiled C program (duration=45s, {Threaded:false Repeat:true RepeatTimes:0 Procs:1 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): openat-bpf$MAP_CREATE_RINGBUF-bpf$BPF_PROG_RAW_TRACEPOINT_LOAD-close_range-mkdirat-mount-openat-write-syz_open_dev$mtd-ioctl$BLKPG program did not crash testing program (duration=45s, {Threaded:false Repeat:true RepeatTimes:0 Procs:1 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): openat-bpf$MAP_CREATE_RINGBUF-bpf$BPF_PROG_RAW_TRACEPOINT_LOAD-close_range-mkdirat-mount-openat-write-syz_open_dev$mtd-ioctl$BLKPG detailed listing: executing program 0: r0 = openat(0xffffffffffffff9c, 0x0, 0x1c9442, 0x19c) bpf$MAP_CREATE_RINGBUF(0x0, 0x0, 0x50) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000001380)={0x11, 0x0, 0x0, 0x0, 0xf, 0x0, 0x0, 0x41100, 0x4b, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0xfffffffc}, 0x94) close_range(r0, r0, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000240)='./proc\x00', 0x1ff) mount(0x0, &(0x7f0000001500)='./proc\x00', &(0x7f0000001540)='proc\x00', 0x0, 0x0) r1 = openat(0xffffffffffffff9c, &(0x7f0000001580)='./proc/thread-self/fail-nth\x00', 0x2, 0x12c) write(r1, &(0x7f00000015c0)='270', 0x3) r2 = syz_open_dev$mtd(&(0x7f0000001600), 0x0, 0x2) ioctl$BLKPG(r2, 0x1269, &(0x7f0000001940)={0x1, 0x1f, 0x98, &(0x7f0000001980)={0x3, 0xfffe, 0x12}}) program crashed: WARNING in add_mtd_blktrans_dev validation run: crashed=true testing program (duration=45s, {Threaded:false Repeat:true RepeatTimes:0 Procs:1 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): openat-bpf$MAP_CREATE_RINGBUF-bpf$BPF_PROG_RAW_TRACEPOINT_LOAD-close_range-mkdirat-mount-openat-write-syz_open_dev$mtd-ioctl$BLKPG detailed listing: executing program 0: r0 = openat(0xffffffffffffff9c, 0x0, 0x1c9442, 0x19c) bpf$MAP_CREATE_RINGBUF(0x0, 0x0, 0x50) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000001380)={0x11, 0x0, 0x0, 0x0, 0xf, 0x0, 0x0, 0x41100, 0x4b, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0xfffffffc}, 0x94) close_range(r0, r0, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000240)='./proc\x00', 0x1ff) mount(0x0, &(0x7f0000001500)='./proc\x00', &(0x7f0000001540)='proc\x00', 0x0, 0x0) r1 = openat(0xffffffffffffff9c, &(0x7f0000001580)='./proc/thread-self/fail-nth\x00', 0x2, 0x12c) write(r1, &(0x7f00000015c0)='270', 0x3) r2 = syz_open_dev$mtd(&(0x7f0000001600), 0x0, 0x2) ioctl$BLKPG(r2, 0x1269, &(0x7f0000001940)={0x1, 0x1f, 0x98, &(0x7f0000001980)={0x3, 0xfffe, 0x12}}) program did not crash validation run: crashed=false testing program (duration=45s, {Threaded:false Repeat:true RepeatTimes:0 Procs:1 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): openat-bpf$MAP_CREATE_RINGBUF-bpf$BPF_PROG_RAW_TRACEPOINT_LOAD-close_range-mkdirat-mount-openat-write-syz_open_dev$mtd-ioctl$BLKPG detailed listing: executing program 0: r0 = openat(0xffffffffffffff9c, 0x0, 0x1c9442, 0x19c) bpf$MAP_CREATE_RINGBUF(0x0, 0x0, 0x50) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000001380)={0x11, 0x0, 0x0, 0x0, 0xf, 0x0, 0x0, 0x41100, 0x4b, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0xfffffffc}, 0x94) close_range(r0, r0, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000240)='./proc\x00', 0x1ff) mount(0x0, &(0x7f0000001500)='./proc\x00', &(0x7f0000001540)='proc\x00', 0x0, 0x0) r1 = openat(0xffffffffffffff9c, &(0x7f0000001580)='./proc/thread-self/fail-nth\x00', 0x2, 0x12c) write(r1, &(0x7f00000015c0)='270', 0x3) r2 = syz_open_dev$mtd(&(0x7f0000001600), 0x0, 0x2) ioctl$BLKPG(r2, 0x1269, &(0x7f0000001940)={0x1, 0x1f, 0x98, &(0x7f0000001980)={0x3, 0xfffe, 0x12}}) program did not crash validation run: crashed=false testing program (duration=45s, {Threaded:false Repeat:true RepeatTimes:0 Procs:1 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): openat-bpf$MAP_CREATE_RINGBUF-bpf$BPF_PROG_RAW_TRACEPOINT_LOAD-close_range-mkdirat-mount-openat-write-syz_open_dev$mtd-ioctl$BLKPG detailed listing: executing program 0: r0 = openat(0xffffffffffffff9c, 0x0, 0x1c9442, 0x19c) bpf$MAP_CREATE_RINGBUF(0x0, 0x0, 0x50) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000001380)={0x11, 0x0, 0x0, 0x0, 0xf, 0x0, 0x0, 0x41100, 0x4b, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0xfffffffc}, 0x94) close_range(r0, r0, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000240)='./proc\x00', 0x1ff) mount(0x0, &(0x7f0000001500)='./proc\x00', &(0x7f0000001540)='proc\x00', 0x0, 0x0) r1 = openat(0xffffffffffffff9c, &(0x7f0000001580)='./proc/thread-self/fail-nth\x00', 0x2, 0x12c) write(r1, &(0x7f00000015c0)='270', 0x3) r2 = syz_open_dev$mtd(&(0x7f0000001600), 0x0, 0x2) ioctl$BLKPG(r2, 0x1269, &(0x7f0000001940)={0x1, 0x1f, 0x98, &(0x7f0000001980)={0x3, 0xfffe, 0x12}}) program did not crash validation run: crashed=false testing program (duration=45s, {Threaded:false Repeat:true RepeatTimes:0 Procs:1 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): openat-bpf$MAP_CREATE_RINGBUF-bpf$BPF_PROG_RAW_TRACEPOINT_LOAD-close_range-mkdirat-mount-openat-write-syz_open_dev$mtd-ioctl$BLKPG detailed listing: executing program 0: r0 = openat(0xffffffffffffff9c, 0x0, 0x1c9442, 0x19c) bpf$MAP_CREATE_RINGBUF(0x0, 0x0, 0x50) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000001380)={0x11, 0x0, 0x0, 0x0, 0xf, 0x0, 0x0, 0x41100, 0x4b, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0xfffffffc}, 0x94) close_range(r0, r0, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000240)='./proc\x00', 0x1ff) mount(0x0, &(0x7f0000001500)='./proc\x00', &(0x7f0000001540)='proc\x00', 0x0, 0x0) r1 = openat(0xffffffffffffff9c, &(0x7f0000001580)='./proc/thread-self/fail-nth\x00', 0x2, 0x12c) write(r1, &(0x7f00000015c0)='270', 0x3) r2 = syz_open_dev$mtd(&(0x7f0000001600), 0x0, 0x2) ioctl$BLKPG(r2, 0x1269, &(0x7f0000001940)={0x1, 0x1f, 0x98, &(0x7f0000001980)={0x3, 0xfffe, 0x12}}) program crashed: WARNING in add_mtd_blktrans_dev validation run: crashed=true testing program (duration=45s, {Threaded:false Repeat:true RepeatTimes:0 Procs:1 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): openat-bpf$MAP_CREATE_RINGBUF-bpf$BPF_PROG_RAW_TRACEPOINT_LOAD-close_range-mkdirat-mount-openat-write-syz_open_dev$mtd-ioctl$BLKPG detailed listing: executing program 0: r0 = openat(0xffffffffffffff9c, 0x0, 0x1c9442, 0x19c) bpf$MAP_CREATE_RINGBUF(0x0, 0x0, 0x50) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000001380)={0x11, 0x0, 0x0, 0x0, 0xf, 0x0, 0x0, 0x41100, 0x4b, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0xfffffffc}, 0x94) close_range(r0, r0, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000240)='./proc\x00', 0x1ff) mount(0x0, &(0x7f0000001500)='./proc\x00', &(0x7f0000001540)='proc\x00', 0x0, 0x0) r1 = openat(0xffffffffffffff9c, &(0x7f0000001580)='./proc/thread-self/fail-nth\x00', 0x2, 0x12c) write(r1, &(0x7f00000015c0)='270', 0x3) r2 = syz_open_dev$mtd(&(0x7f0000001600), 0x0, 0x2) ioctl$BLKPG(r2, 0x1269, &(0x7f0000001940)={0x1, 0x1f, 0x98, &(0x7f0000001980)={0x3, 0xfffe, 0x12}}) program crashed: WARNING in add_mtd_blktrans_dev validation run: crashed=true reproducing took 1h37m20.685152717s repro crashed as (corrupted=false): RBP: 00007efc7ae86ab8 R08: 0000000000000000 R09: 0000000000000000 R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 R13: 00007efc7b076fac R14: 00007efc7b076fa0 R15: 00007efc7b076fa0 ------------[ cut here ]------------ WARNING: CPU: 1 PID: 4450 at block/genhd.c:554 device_add_disk+0x8d6/0xde0 block/genhd.c:552 Modules linked in: CPU: 0 PID: 4450 Comm: syz.0.51 Not tainted syzkaller #0 Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 RIP: 0010:device_add_disk+0x8d6/0xde0 block/genhd.c:554 Code: 04 48 89 d8 48 c1 e8 03 42 0f b6 04 30 84 c0 0f 85 8f 03 00 00 8b 33 48 c7 c7 00 f4 70 8d e8 b1 3d 37 00 eb 05 e8 ea 04 a6 fd <0f> 0b 41 bd 01 00 00 00 44 89 e8 48 83 c4 50 5b 41 5c 41 5d 41 5e RSP: 0018:ffffc900031ef470 EFLAGS: 00010293 RAX: ffffffff83d31e76 RBX: ffff88806aae0000 RCX: ffff88802cfe8000 RDX: 0000000000000000 RSI: 000000000000001f RDI: 0000000000000103 RBP: 000000000000001f R08: ffff888076dbc1db R09: 1ffff1100edb783b R10: dffffc0000000000 R11: ffffed100edb783c R12: ffff88805cc85e40 R13: ffff88806aae0150 R14: dffffc0000000000 R15: ffff88805cc85e40 FS: 0000555591911500(0000) GS:ffff8880b8e00000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: 000003ca2f90a000 CR3: 000000007931a000 CR4: 00000000003506f0 DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400 Call Trace: add_mtd_blktrans_dev+0xfb1/0x13f0 drivers/mtd/mtd_blkdevs.c:387 mtdblock_add_mtd+0x186/0x240 drivers/mtd/mtdblock.c:333 blktrans_notify_add+0x95/0xe0 drivers/mtd/mtd_blkdevs.c:464 add_mtd_device+0xd40/0x1260 drivers/mtd/mtdcore.c:693 mtd_add_partition+0x25d/0x420 drivers/mtd/mtdpart.c:273 mtdchar_blkpg_ioctl+0x283/0x2b0 drivers/mtd/mtdchar.c:562 mtdchar_ioctl+0x14cb/0x1d70 drivers/mtd/mtdchar.c:1010 mtdchar_unlocked_ioctl+0xad/0xd0 drivers/mtd/mtdchar.c:1033 vfs_ioctl fs/ioctl.c:51 [inline] __do_sys_ioctl fs/ioctl.c:874 [inline] __se_sys_ioctl+0xfa/0x170 fs/ioctl.c:860 do_syscall_x64 arch/x86/entry/common.c:50 [inline] do_syscall_64+0x4c/0xa0 arch/x86/entry/common.c:80 entry_SYSCALL_64_after_hwframe+0x66/0xd0 RIP: 0033:0x7efc7adef559 Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 RSP: 002b:00007ffc04cc9018 EFLAGS: 00000246 ORIG_RAX: 0000000000000010 RAX: ffffffffffffffda RBX: 00007efc7b076fa0 RCX: 00007efc7adef559 RDX: 0000200000001940 RSI: 0000000000001269 RDI: 0000000000000004 RBP: 00007efc7ae86ab8 R08: 0000000000000000 R09: 0000000000000000 R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 R13: 00007efc7b076fac R14: 00007efc7b076fa0 R15: 00007efc7b076fa0 final repro crashed as (corrupted=false): RBP: 00007efc7ae86ab8 R08: 0000000000000000 R09: 0000000000000000 R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 R13: 00007efc7b076fac R14: 00007efc7b076fa0 R15: 00007efc7b076fa0 ------------[ cut here ]------------ WARNING: CPU: 1 PID: 4450 at block/genhd.c:554 device_add_disk+0x8d6/0xde0 block/genhd.c:552 Modules linked in: CPU: 0 PID: 4450 Comm: syz.0.51 Not tainted syzkaller #0 Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 RIP: 0010:device_add_disk+0x8d6/0xde0 block/genhd.c:554 Code: 04 48 89 d8 48 c1 e8 03 42 0f b6 04 30 84 c0 0f 85 8f 03 00 00 8b 33 48 c7 c7 00 f4 70 8d e8 b1 3d 37 00 eb 05 e8 ea 04 a6 fd <0f> 0b 41 bd 01 00 00 00 44 89 e8 48 83 c4 50 5b 41 5c 41 5d 41 5e RSP: 0018:ffffc900031ef470 EFLAGS: 00010293 RAX: ffffffff83d31e76 RBX: ffff88806aae0000 RCX: ffff88802cfe8000 RDX: 0000000000000000 RSI: 000000000000001f RDI: 0000000000000103 RBP: 000000000000001f R08: ffff888076dbc1db R09: 1ffff1100edb783b R10: dffffc0000000000 R11: ffffed100edb783c R12: ffff88805cc85e40 R13: ffff88806aae0150 R14: dffffc0000000000 R15: ffff88805cc85e40 FS: 0000555591911500(0000) GS:ffff8880b8e00000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: 000003ca2f90a000 CR3: 000000007931a000 CR4: 00000000003506f0 DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400 Call Trace: add_mtd_blktrans_dev+0xfb1/0x13f0 drivers/mtd/mtd_blkdevs.c:387 mtdblock_add_mtd+0x186/0x240 drivers/mtd/mtdblock.c:333 blktrans_notify_add+0x95/0xe0 drivers/mtd/mtd_blkdevs.c:464 add_mtd_device+0xd40/0x1260 drivers/mtd/mtdcore.c:693 mtd_add_partition+0x25d/0x420 drivers/mtd/mtdpart.c:273 mtdchar_blkpg_ioctl+0x283/0x2b0 drivers/mtd/mtdchar.c:562 mtdchar_ioctl+0x14cb/0x1d70 drivers/mtd/mtdchar.c:1010 mtdchar_unlocked_ioctl+0xad/0xd0 drivers/mtd/mtdchar.c:1033 vfs_ioctl fs/ioctl.c:51 [inline] __do_sys_ioctl fs/ioctl.c:874 [inline] __se_sys_ioctl+0xfa/0x170 fs/ioctl.c:860 do_syscall_x64 arch/x86/entry/common.c:50 [inline] do_syscall_64+0x4c/0xa0 arch/x86/entry/common.c:80 entry_SYSCALL_64_after_hwframe+0x66/0xd0 RIP: 0033:0x7efc7adef559 Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 RSP: 002b:00007ffc04cc9018 EFLAGS: 00000246 ORIG_RAX: 0000000000000010 RAX: ffffffffffffffda RBX: 00007efc7b076fa0 RCX: 00007efc7adef559 RDX: 0000200000001940 RSI: 0000000000001269 RDI: 0000000000000004 RBP: 00007efc7ae86ab8 R08: 0000000000000000 R09: 0000000000000000 R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 R13: 00007efc7b076fac R14: 00007efc7b076fa0 R15: 00007efc7b076fa0