Warning: Permanently added '[localhost]:49114' (ECDSA) to the list of known hosts. 2025/08/31 17:43:13 fuzzer started 2025/08/31 17:43:14 dialing manager at localhost:43077 syzkaller login: [ 51.492152] cgroup: Unknown subsys name 'net' [ 51.561825] cgroup: Unknown subsys name 'cpuset' [ 51.576619] cgroup: Unknown subsys name 'rlimit' 2025/08/31 17:43:24 syscalls: 204 2025/08/31 17:43:24 code coverage: enabled 2025/08/31 17:43:24 comparison tracing: enabled 2025/08/31 17:43:24 extra coverage: enabled 2025/08/31 17:43:24 setuid sandbox: enabled 2025/08/31 17:43:24 namespace sandbox: enabled 2025/08/31 17:43:24 Android sandbox: enabled 2025/08/31 17:43:24 fault injection: enabled 2025/08/31 17:43:24 leak checking: enabled 2025/08/31 17:43:24 net packet injection: enabled 2025/08/31 17:43:24 net device setup: enabled 2025/08/31 17:43:24 concurrency sanitizer: /sys/kernel/debug/kcsan does not exist 2025/08/31 17:43:24 devlink PCI setup: PCI device 0000:00:10.0 is not available 2025/08/31 17:43:24 USB emulation: enabled 2025/08/31 17:43:24 hci packet injection: enabled 2025/08/31 17:43:24 wifi device emulation: enabled 2025/08/31 17:43:24 802.15.4 emulation: enabled 2025/08/31 17:43:24 fetching corpus: 0, signal 0/0 (executing program) 2025/08/31 17:43:25 starting 8 fuzzer processes 17:43:26 executing program 0: get_thread_area(&(0x7f0000000000)={0x7, 0x20000800, 0x4000, 0x0, 0x1, 0x0, 0x0, 0x1, 0x1, 0x1}) r0 = openat$vcsu(0xffffffffffffff9c, &(0x7f0000000040), 0x200000, 0x0) getsockopt$inet_tcp_TCP_REPAIR_WINDOW(r0, 0x6, 0x1d, &(0x7f0000000080), &(0x7f00000000c0)=0x14) r1 = openat$nvram(0xffffffffffffff9c, &(0x7f0000000100), 0x2000, 0x0) setsockopt$inet_tcp_TCP_FASTOPEN_KEY(r1, 0x6, 0x21, &(0x7f0000000140)="1bb9d563048b6ec78effc0f14d974b17", 0x10) setsockopt$inet_tcp_int(r1, 0x6, 0x1b, &(0x7f0000000180)=0x5, 0x4) ioctl$SNDRV_TIMER_IOCTL_STATUS32(r1, 0x80585414, &(0x7f00000001c0)) setsockopt$inet_tcp_TCP_QUEUE_SEQ(r0, 0x6, 0x15, &(0x7f0000000240)=0x1, 0x4) getsockopt$inet_tcp_TCP_ZEROCOPY_RECEIVE(r1, 0x6, 0x23, &(0x7f0000000340)={&(0x7f0000ffc000/0x2000)=nil, 0x2000, 0x0, 0x0, 0x0, &(0x7f0000000280)=""/37, 0x25, 0x1, &(0x7f00000002c0)=""/109, 0x6d}, &(0x7f0000000380)=0x40) r2 = socket$inet_tcp(0x2, 0x1, 0x0) ioctl$sock_inet_tcp_SIOCINQ(r2, 0x541b, &(0x7f00000003c0)) move_pages(0x0, 0x8, &(0x7f0000000400)=[&(0x7f0000ffd000/0x1000)=nil, &(0x7f0000ffd000/0x3000)=nil, &(0x7f0000ffd000/0x3000)=nil, &(0x7f0000ffb000/0x2000)=nil, &(0x7f0000ffc000/0x1000)=nil, &(0x7f0000ffe000/0x2000)=nil, &(0x7f0000ffb000/0x4000)=nil, &(0x7f0000ffd000/0x3000)=nil], &(0x7f0000000440)=[0xfff], &(0x7f0000000480)=[0x0, 0x0, 0x0], 0x4) r3 = syz_genetlink_get_family_id$SEG6(&(0x7f0000000500), r1) sendmsg$SEG6_CMD_GET_TUNSRC(r0, &(0x7f00000005c0)={&(0x7f00000004c0)={0x10, 0x0, 0x0, 0x4000000}, 0xc, &(0x7f0000000580)={&(0x7f0000000540)={0x38, r3, 0x300, 0x70bd2a, 0x25dfdbfc, {}, [@SEG6_ATTR_HMACKEYID={0x8, 0x3, 0x24}, @SEG6_ATTR_DST={0x14, 0x1, @mcast1}, @SEG6_ATTR_DSTLEN={0x8, 0x2, 0x2}]}, 0x38}, 0x1, 0x0, 0x0, 0x20008810}, 0x4040010) ioctl$SNDRV_SEQ_IOCTL_SET_QUEUE_TIMER(r1, 0x40605346, &(0x7f0000000600)={0x80, 0x1, {0x1, 0x0, 0x81}, 0x2}) sendmsg$SEG6_CMD_DUMPHMAC(0xffffffffffffffff, &(0x7f0000000740)={&(0x7f0000000680)={0x10, 0x0, 0x0, 0x240000}, 0xc, &(0x7f0000000700)={&(0x7f00000006c0)={0x2c, r3, 0x1, 0x70bd2c, 0x25dfdbfe, {}, [@SEG6_ATTR_SECRET={0x8, 0x4, [0x1]}, @SEG6_ATTR_DSTLEN={0x8, 0x2, 0x5}, @SEG6_ATTR_DSTLEN={0x8}]}, 0x2c}, 0x1, 0x0, 0x0, 0x4000000}, 0x4000000) r4 = pidfd_getfd(r1, r2, 0x0) setsockopt$inet_tcp_TCP_CONGESTION(r4, 0x6, 0xd, &(0x7f0000000780)='westwood\x00', 0x9) r5 = syz_genetlink_get_family_id$ieee802154(&(0x7f0000000800), 0xffffffffffffffff) sendmsg$IEEE802154_LLSEC_DEL_DEV(0xffffffffffffffff, &(0x7f00000008c0)={&(0x7f00000007c0)={0x10, 0x0, 0x0, 0x40000}, 0xc, &(0x7f0000000880)={&(0x7f0000000840)={0x20, r5, 0x10, 0x70bd27, 0x25dfdbfe, {}, [@IEEE802154_ATTR_DEV_NAME={0xa, 0x1, 'wpan4\x00'}]}, 0x20}, 0x1, 0x0, 0x0, 0x4048044}, 0x811) 17:43:26 executing program 1: shmget$private(0x0, 0x4000, 0x80, &(0x7f0000ffb000/0x4000)=nil) shmget(0x3, 0x2000, 0x4, &(0x7f0000ffc000/0x2000)=nil) mlock(&(0x7f0000ff0000/0x10000)=nil, 0x10000) shmget(0x1, 0x1000, 0x10, &(0x7f0000ff5000/0x1000)=nil) ioctl$sock_ipv4_tunnel_SIOCGETTUNNEL(0xffffffffffffffff, 0x89f0, &(0x7f0000000140)={'syztnl1\x00', &(0x7f00000000c0)={'syztnl2\x00', 0x0, 0x20, 0x1, 0x6, 0x9, {{0xd, 0x4, 0x1, 0x19, 0x34, 0x68, 0x0, 0x9, 0x29, 0x0, @empty, @dev={0xac, 0x14, 0x14, 0x29}, {[@timestamp_addr={0x44, 0x14, 0xc2, 0x1, 0x4, [{@multicast1}, {@private=0xa010101}]}, @rr={0x7, 0xb, 0xc8, [@initdev={0xac, 0x1e, 0x1, 0x0}, @private=0xa010102]}]}}}}}) ioctl$sock_ipv4_tunnel_SIOCADDTUNNEL(0xffffffffffffffff, 0x89f1, &(0x7f0000000280)={'tunl0\x00', &(0x7f0000000180)={'tunl0\x00', r0, 0x7, 0x8000, 0xfffffffc, 0x8, {{0x2f, 0x4, 0x0, 0x2, 0xbc, 0x65, 0x0, 0x0, 0x4, 0x0, @empty, @broadcast, {[@generic={0x89, 0x9, "8db1d464c6af68"}, @noop, @ra={0x94, 0x4, 0x1}, @timestamp={0x44, 0x1c, 0x53, 0x0, 0x7, [0x40, 0x7fffffff, 0xfffffffd, 0x5, 0x5c, 0x77]}, @cipso={0x86, 0x2f, 0x3, [{0x1, 0x4, "1eba"}, {0x1, 0x7, "e3ccb5ddcf"}, {0x6, 0xa, "5db18b961780af33"}, {0x2, 0xe, "7353a9824b57fd7d39232ac5"}, {0x1, 0x6, "2e1ccd27"}]}, @noop, @cipso={0x86, 0x37, 0xffffffffffffffff, [{0x2, 0xf, "227467028cabd4e137b820c5c9"}, {0x7, 0x6, "90569992"}, {0x2, 0xc, "2071b0a8c9ce92782e72"}, {0x6, 0xa, "14f2b9bca55ce3dd"}, {0x6, 0x6, "2cd22a8f"}]}, @timestamp={0x44, 0x14, 0xd4, 0x0, 0x5, [0x81, 0x5d23, 0x63ab, 0x1]}]}}}}}) ioctl$sock_ipv4_tunnel_SIOCDELTUNNEL(0xffffffffffffffff, 0x89f2, &(0x7f0000000380)={'gretap0\x00', &(0x7f00000002c0)={'syztnl2\x00', 0x0, 0x7800, 0x7, 0x40, 0xe180, {{0x22, 0x4, 0x0, 0x1, 0x88, 0x64, 0x0, 0x1, 0x29, 0x0, @multicast2, @multicast1, {[@end, @lsrr={0x83, 0x1f, 0x2f, [@multicast2, @local, @local, @multicast1, @rand_addr=0x64010102, @loopback, @private=0xa010100]}, @rr={0x7, 0x27, 0x6c, [@multicast1, @rand_addr=0x64010102, @remote, @multicast1, @loopback, @initdev={0xac, 0x1e, 0x0, 0x0}, @initdev={0xac, 0x1e, 0x1, 0x0}, @broadcast, @empty]}, @ra={0x94, 0x4, 0x1}, @timestamp={0x44, 0x10, 0x2d, 0x0, 0x8, [0x1, 0x100, 0x401]}, @ssrr={0x89, 0x13, 0x56, [@dev={0xac, 0x14, 0x14, 0x28}, @multicast2, @initdev={0xac, 0x1e, 0x0, 0x0}, @remote]}, @ra={0x94, 0x4, 0x1}]}}}}}) shmget(0x3, 0x4000, 0x4, &(0x7f0000ff9000/0x4000)=nil) mmap$IORING_OFF_CQ_RING(&(0x7f0000ffd000/0x3000)=nil, 0x3000, 0x2000008, 0x30, 0xffffffffffffffff, 0x8000000) r1 = syz_genetlink_get_family_id$nl802154(&(0x7f0000000400), 0xffffffffffffffff) ioctl$sock_SIOCGIFINDEX_802154(0xffffffffffffffff, 0x8933, &(0x7f0000000440)={'wpan1\x00', 0x0}) sendmsg$NL802154_CMD_NEW_INTERFACE(0xffffffffffffffff, &(0x7f0000000540)={&(0x7f00000003c0)={0x10, 0x0, 0x0, 0x2}, 0xc, &(0x7f0000000500)={&(0x7f0000000480)={0x48, r1, 0x200, 0x70bd2a, 0x25dfdbfd, {}, [@NL802154_ATTR_IFNAME={0xa, 0x4, 'wpan0\x00'}, @NL802154_ATTR_IFINDEX={0x8}, @NL802154_ATTR_IFNAME={0xa, 0x4, 'wpan1\x00'}, @NL802154_ATTR_EXTENDED_ADDR={0xc, 0x17, {0xaaaaaaaaaaaa0002}}, @NL802154_ATTR_IFINDEX={0x8, 0x3, r2}]}, 0x48}}, 0x4001) mmap$binder(&(0x7f0000fef000/0x11000)=nil, 0x11000, 0x1, 0x11, 0xffffffffffffffff, 0x6) shmget$private(0x0, 0x4000, 0x200, &(0x7f0000ffc000/0x4000)=nil) r3 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) ioctl$sock_SIOCGIFINDEX_802154(0xffffffffffffffff, 0x8933, &(0x7f00000005c0)={'wpan0\x00', 0x0}) sendmsg$IEEE802154_LLSEC_ADD_SECLEVEL(r3, &(0x7f00000006c0)={&(0x7f0000000580)={0x10, 0x0, 0x0, 0x4000000}, 0xc, &(0x7f0000000680)={&(0x7f0000000600)={0x44, 0x0, 0x200, 0x70bd2a, 0x25dfdbff, {}, [@IEEE802154_ATTR_LLSEC_FRAME_TYPE={0x5, 0x33, 0x34}, @IEEE802154_ATTR_DEV_INDEX={0x8, 0x2, r4}, @IEEE802154_ATTR_LLSEC_CMD_FRAME_ID={0x5, 0x34, 0x1}, @IEEE802154_ATTR_DEV_NAME={0xa, 0x1, 'wpan0\x00'}, @IEEE802154_ATTR_DEV_NAME={0xa, 0x1, 'wpan4\x00'}]}, 0x44}, 0x1, 0x0, 0x0, 0x8800}, 0x0) sendmsg$IEEE802154_START_REQ(r3, &(0x7f00000007c0)={&(0x7f0000000700)={0x10, 0x0, 0x0, 0x4}, 0xc, &(0x7f0000000780)={&(0x7f0000000740)={0x1c, 0x0, 0x200, 0x70bd2d, 0x25dfdbfb, {}, [@IEEE802154_ATTR_CHANNEL={0x5, 0x7, 0x6}]}, 0x1c}, 0x1, 0x0, 0x0, 0x40100}, 0x801) mlock(&(0x7f0000fef000/0x1000)=nil, 0x1000) syz_io_uring_setup(0x4726, &(0x7f0000000840)={0x0, 0x502f, 0x20, 0x0, 0x12e}, &(0x7f0000ffe000/0x2000)=nil, &(0x7f0000ffb000/0x4000)=nil, &(0x7f00000008c0), &(0x7f0000000900)) 17:43:26 executing program 2: prctl$PR_MPX_ENABLE_MANAGEMENT(0x2b) r0 = socket$inet(0x2, 0x5, 0x4) r1 = openat$vcsu(0xffffffffffffff9c, &(0x7f0000000000), 0x3c1480, 0x0) ioctl$sock_ipv4_tunnel_SIOCGETTUNNEL(r1, 0x89f0, &(0x7f00000000c0)={'syztnl2\x00', &(0x7f0000000040)={'erspan0\x00', 0x0, 0x700, 0x40, 0x3, 0x22, {{0x15, 0x4, 0x3, 0x17, 0x54, 0x64, 0x0, 0x1, 0x2f, 0x0, @broadcast, @dev={0xac, 0x14, 0x14, 0x36}, {[@cipso={0x86, 0x3d, 0x1, [{0x5, 0x9, "c8a7bec58c2c80"}, {0x0, 0x9, "fabb6c2e64ba82"}, {0x7, 0xf, "6b1b69e07efcb7230cc07a2cf7"}, {0x1, 0x6, "a2118bdb"}, {0x5, 0x10, "67115d3e7766231c7b08cf3c48e4"}]}]}}}}}) prctl$PR_MPX_ENABLE_MANAGEMENT(0x2b) r2 = openat$vcsa(0xffffffffffffff9c, &(0x7f0000000100), 0x202c0, 0x0) ioctl$SNDRV_SEQ_IOCTL_GET_QUEUE_TEMPO(r2, 0xc02c5341, &(0x7f0000000140)) ioctl$SNDRV_TIMER_IOCTL_SELECT(r1, 0x40345410, &(0x7f00000001c0)={{0x0, 0x2, 0x3f, 0x3, 0x80000001}}) ioctl$SNDRV_SEQ_IOCTL_GET_QUEUE_TEMPO(r1, 0xc02c5341, &(0x7f0000000200)) ioctl$sock_inet_tcp_SIOCOUTQ(r0, 0x5411, &(0x7f0000000280)) r3 = syz_open_dev$evdev(&(0x7f00000002c0), 0x1, 0x50000) ioctl$EVIOCGLED(r3, 0x80404519, &(0x7f0000000300)=""/21) seccomp$SECCOMP_GET_NOTIF_SIZES(0x3, 0x0, &(0x7f0000000340)) ioctl$SNDRV_TIMER_IOCTL_NEXT_DEVICE(r2, 0xc0145401, &(0x7f0000000380)={0x3, 0x2, 0x8, 0x2, 0x733}) munlock(&(0x7f0000ff9000/0x4000)=nil, 0x4000) getsockopt$inet_tcp_buf(r1, 0x6, 0x1a, &(0x7f00000003c0)=""/1, &(0x7f0000000400)=0x1) ioctl$SNDRV_SEQ_IOCTL_GET_QUEUE_INFO(r2, 0xc08c5334, &(0x7f0000000440)={0x0, 0x80, 0x0, 'queue0\x00', 0x8}) r4 = syz_open_procfs(0x0, &(0x7f0000000500)='schedstat\x00') ioctl$SNDRV_TIMER_IOCTL_PVERSION(r4, 0x80045400, &(0x7f0000000540)) sendmsg$SEG6_CMD_DUMPHMAC(r1, &(0x7f0000000640)={&(0x7f0000000580)={0x10, 0x0, 0x0, 0x40000000}, 0xc, &(0x7f0000000600)={&(0x7f00000005c0)={0x24, 0x0, 0x100, 0x70bd2c, 0x25dfdbfc, {}, [@SEG6_ATTR_HMACKEYID={0x8, 0x3, 0x8}, @SEG6_ATTR_DSTLEN={0x8, 0x2, 0x8}]}, 0x24}}, 0x20008080) 17:43:26 executing program 4: ioctl$SNDRV_TIMER_IOCTL_TREAD(0xffffffffffffffff, 0x40045402, &(0x7f0000000000)) wait4(0xffffffffffffffff, &(0x7f0000000040), 0x1, &(0x7f0000000080)) waitid$P_PIDFD(0x3, 0xffffffffffffffff, &(0x7f0000000140), 0x40000002, &(0x7f00000001c0)) shmget$private(0x0, 0x3000, 0x20, &(0x7f0000ffa000/0x3000)=nil) sendmsg$SEG6_CMD_SETHMAC(0xffffffffffffffff, &(0x7f0000000380)={&(0x7f0000000280)={0x10, 0x0, 0x0, 0x2}, 0xc, &(0x7f0000000340)={&(0x7f00000002c0)={0x48, 0x0, 0x10, 0x70bd25, 0x25dfdbff, {}, [@SEG6_ATTR_ALGID={0x5, 0x6, 0x4}, @SEG6_ATTR_ALGID={0x5, 0x6, 0x20}, @SEG6_ATTR_ALGID={0x5, 0x6, 0x8}, @SEG6_ATTR_HMACKEYID={0x8, 0x3, 0x1}, @SEG6_ATTR_SECRETLEN={0x5, 0x5, 0x5}, @SEG6_ATTR_SECRET={0x4}, @SEG6_ATTR_DSTLEN={0x8, 0x2, 0x1f}]}, 0x48}}, 0x0) r0 = openat$vcsa(0xffffffffffffff9c, &(0x7f00000003c0), 0x48000, 0x0) ioctl$SNDRV_TIMER_IOCTL_START(r0, 0x54a0) r1 = syz_open_procfs(0x0, &(0x7f0000000400)='smaps_rollup\x00') ioctl$EVIOCSREP(r1, 0x40084503, &(0x7f0000000440)=[0x8, 0x7ff]) socket$inet_udp(0x2, 0x2, 0x0) socket$inet6_tcp(0xa, 0x1, 0x0) r2 = openat$vcsu(0xffffffffffffff9c, &(0x7f0000000480), 0x0, 0x0) process_mrelease(r2, 0x0) r3 = openat$vcsa(0xffffffffffffff9c, &(0x7f00000004c0), 0x0, 0x0) ioctl$EVIOCGABS2F(r3, 0x8018456f, &(0x7f0000000500)=""/236) r4 = io_uring_setup(0x653f, &(0x7f0000000600)={0x0, 0x55d7, 0x20, 0x1, 0x281, 0x0, r2}) mmap$IORING_OFF_SQ_RING(&(0x7f0000ffd000/0x3000)=nil, 0x3000, 0x2, 0x30, r4, 0x0) syz_open_dev$char_usb(0xc, 0xb4, 0x400) ioctl$EVIOCGBITSW(r3, 0x80404525, &(0x7f0000000680)=""/213) shmget(0x1, 0x3000, 0x20, &(0x7f0000ffc000/0x3000)=nil) 17:43:26 executing program 3: getsockopt$inet_udp_int(0xffffffffffffffff, 0x11, 0x1, &(0x7f0000000000), &(0x7f0000000040)=0x4) setsockopt$inet_udp_int(0xffffffffffffffff, 0x11, 0x1, &(0x7f0000000080)=0x7, 0x4) ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, &(0x7f0000000240)={0x54, 0x0, &(0x7f00000000c0)=[@acquire_done={0x40106309, 0x1}, @free_buffer, @request_death={0x400c630e, 0x1}, @request_death, @decrefs, @dead_binder_done], 0xc7, 0x0, &(0x7f0000000140)="aa36e0fef6a6cd3a6060f434b2a2306a435d6c33ca3bfb20c9d046886ded10cf23d0938b55b8a812702a5a7579cb8813f0cf3954f24fa081e8c35a9d4674b51115d91e7f6e38920909a8fba27ba7bbb0522974a9d83826c23d40a56c3f88dc24276a8312ae50d15d3531211e4378a34980ea70ac3cefef2439af0baa6b387df4ff26b593ca52e94dda8ce3656a81180693ab97746e30b1301f30922ec565bba820fc06168927e446c06efe1fc7cb37b804ba0342e58e70da81c074407ec9cf690a9ab1e3a62a68"}) r0 = openat$vcsa(0xffffffffffffff9c, &(0x7f0000000280), 0x1, 0x0) r1 = openat$vcsa(0xffffffffffffff9c, &(0x7f00000002c0), 0x80, 0x0) ioctl$SNDRV_SEQ_IOCTL_QUERY_NEXT_PORT(r0, 0xc0a85352, &(0x7f0000000300)={{0x4, 0x6}, 'port0\x00', 0x5, 0x1, 0x0, 0xffff, 0x7, 0x7, 0x5, 0x0, 0x2, 0xc0}) ioctl$SNDRV_SEQ_IOCTL_QUERY_NEXT_CLIENT(r1, 0xc0bc5351, &(0x7f00000003c0)={0xffff7fff, 0x0, 'client0\x00', 0xffffffff80000002, "9aa89fbb0e155330", "7e3a03465d7350a6322e39e7997e8c634c3224eb46d1223d24ed4ce35c7b1dd2", 0x0, 0x6}) r2 = openat$nvram(0xffffffffffffff9c, &(0x7f0000000480), 0x1, 0x0) ioctl$PERF_EVENT_IOC_PAUSE_OUTPUT(r2, 0x40042409, 0x0) process_mrelease(r0, 0x0) ioctl$SNDRV_TIMER_IOCTL_TREAD(r1, 0x40045402, &(0x7f00000004c0)) r3 = socket$inet_udp(0x2, 0x2, 0x0) ioctl$sock_inet_udp_SIOCINQ(r3, 0x541b, &(0x7f0000000500)) getsockopt$inet_IP_IPSEC_POLICY(r0, 0x0, 0x10, &(0x7f0000000540)={{{@in=@broadcast, @in6=@mcast1}}, {{@in=@broadcast}, 0x0, @in6=@mcast2}}, &(0x7f0000000640)=0xe8) setsockopt$inet_udp_encap(r1, 0x11, 0x64, &(0x7f0000000680)=0x3, 0x4) r4 = syz_open_procfs(0xffffffffffffffff, &(0x7f00000006c0)='net/packet\x00') pidfd_getfd(r4, 0xffffffffffffffff, 0x0) r5 = openat$nvram(0xffffffffffffff9c, &(0x7f0000000700), 0x800, 0x0) ioctl$SECCOMP_IOCTL_NOTIF_RECV(r2, 0xc0502100, &(0x7f0000000740)={0x0, 0x0}) write$P9_RGETLOCK(r5, &(0x7f00000007c0)={0x1e, 0x37, 0x2, {0x2, 0x6, 0x101, r6}}, 0x1e) 17:43:26 executing program 5: clock_gettime(0x5, &(0x7f0000000000)) clock_settime(0x2, &(0x7f0000000040)) sched_rr_get_interval(0xffffffffffffffff, &(0x7f0000000080)) sched_rr_get_interval(0x0, &(0x7f00000000c0)) sendmsg$NL802154_CMD_GET_SEC_KEY(0xffffffffffffffff, &(0x7f00000001c0)={&(0x7f0000000100)={0x10, 0x0, 0x0, 0x20000000}, 0xc, &(0x7f0000000180)={&(0x7f0000000140)={0x24, 0x0, 0x200, 0x70bd26, 0x25dfdbfe, {}, [@NL802154_ATTR_IFINDEX={0x8}, @NL802154_ATTR_IFINDEX={0x8}]}, 0x24}, 0x1, 0x0, 0x0, 0x4000000}, 0x181) clock_gettime(0x0, &(0x7f0000000200)) pipe2$9p(&(0x7f0000000240)={0xffffffffffffffff, 0xffffffffffffffff}, 0x800) r1 = syz_io_uring_setup(0x776a, &(0x7f0000000280)={0x0, 0x2728, 0x2, 0x1, 0x37c}, &(0x7f0000000000/0x3000)=nil, &(0x7f0000000000/0x400000)=nil, &(0x7f0000000300), &(0x7f0000000340)) ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, &(0x7f0000000540)={0x64, 0x0, &(0x7f0000000440)=[@transaction_sg={0x40486311, {0x1, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x50, 0x18, &(0x7f0000000380)={@fd={0x66642a85, 0x0, r0}, @fd={0x66642a85, 0x0, r1}, @fda={0x66646185, 0x0, 0x2, 0x36}}, &(0x7f0000000400)={0x0, 0x18, 0x30}}}, @request_death, @release={0x40046306, 0x1}], 0x7e, 0x0, &(0x7f00000004c0)="7685c519d1cbea63a1a8f022f8c0085baf770aa5d1fa9bfb1a5399fdb134953d619e962218bba650b68d6206fde39ff17760aa4bbcb62f6802c48e17294a17a3b768ab60bbae37aa37e33e24b09f6bdea37853f7ab2622451803788c9d172b7d71d6d87911129b8ef5cc9e0169404b09abfa991f3a7a3640686df445d387"}) pipe2$9p(&(0x7f0000000580), 0x800) ioctl$EVIOCGVERSION(0xffffffffffffffff, 0x80044501, &(0x7f00000005c0)=""/174) r2 = openat$nvram(0xffffffffffffff9c, &(0x7f0000000680), 0x400, 0x0) write$P9_RSTAT(r2, &(0x7f00000006c0)={0x3f, 0x7d, 0x1, {0x0, 0x38, 0x401, 0x8000, {0x80, 0x4, 0x1}, 0x2020000, 0x4, 0x60, 0x9, 0x1, '\x00', 0x2, '.-', 0x1, '\x00', 0x1, '\x00'}}, 0x3f) r3 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r4 = syz_genetlink_get_family_id$ieee802154(&(0x7f0000000740), 0xffffffffffffffff) sendmsg$IEEE802154_LLSEC_DEL_KEY(r3, &(0x7f0000000840)={&(0x7f0000000700)={0x10, 0x0, 0x0, 0x800000}, 0xc, &(0x7f0000000800)={&(0x7f0000000780)={0x54, r4, 0x800, 0x70bd27, 0x25dfdbfc, {}, [@IEEE802154_ATTR_LLSEC_KEY_SOURCE_SHORT={0x8, 0x2c, 0x5}, @IEEE802154_ATTR_LLSEC_KEY_SOURCE_EXTENDED={0xc, 0x2d, {0xaaaaaaaaaaaa0002}}, @IEEE802154_ATTR_PAN_ID={0x6, 0x6, 0x2}, @IEEE802154_ATTR_DEV_INDEX={0x8}, @IEEE802154_ATTR_LLSEC_KEY_MODE={0x5, 0x2b, 0x1}, @IEEE802154_ATTR_HW_ADDR={0xc, 0x5, {0xaaaaaaaaaaaa0002}}, @IEEE802154_ATTR_LLSEC_KEY_MODE={0x5, 0x2b, 0x3}]}, 0x54}, 0x1, 0x0, 0x0, 0x40}, 0x2000c814) clock_getres(0x3, &(0x7f0000000880)) clock_getres(0x6, &(0x7f00000008c0)) r5 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) sendmsg$IEEE802154_ADD_IFACE(r5, &(0x7f0000000a00)={&(0x7f0000000900)={0x10, 0x0, 0x0, 0x40c}, 0xc, &(0x7f00000009c0)={&(0x7f0000000940)={0x44, r4, 0x200, 0x70bd29, 0x25dfdbfe, {}, [@IEEE802154_ATTR_PHY_NAME={0x9, 0x1f, 'phy1\x00'}, @IEEE802154_ATTR_DEV_NAME={0xa, 0x1, 'wpan4\x00'}, @IEEE802154_ATTR_DEV_NAME={0xa, 0x1, 'wpan1\x00'}, @IEEE802154_ATTR_DEV_NAME={0xa, 0x1, 'wpan0\x00'}]}, 0x44}, 0x1, 0x0, 0x0, 0x20000084}, 0x44000) [ 62.539079] audit: type=1400 audit(1756662206.159:7): avc: denied { execmem } for pid=272 comm="syz-executor.2" scontext=system_u:system_r:kernel_t:s0 tcontext=system_u:system_r:kernel_t:s0 tclass=process permissive=1 17:43:26 executing program 6: r0 = perf_event_open(&(0x7f00000000c0)={0x1, 0x80, 0x0, 0xc0, 0xfa, 0x1, 0x0, 0x7fffffff, 0x10811, 0x1, 0x1, 0x1, 0x1, 0x1, 0x1, 0x1, 0x1, 0x1, 0x0, 0x1, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x1, 0x0, 0x1, 0x0, 0x0, 0x0, 0x1, 0x1, 0x1, 0x1, 0x1, 0x1, 0x1, 0x0, 0x1, 0x1, 0x1, 0x1, 0x0, 0x0, 0xfff, 0x7, @perf_config_ext={0x7, 0x7fffffff}, 0x41000, 0x80000000, 0x5, 0x3, 0x9, 0x2, 0x9, 0x0, 0x5, 0x0, 0x4}, 0x0, 0xb, 0xffffffffffffffff, 0x1) perf_event_open(&(0x7f0000000040)={0x0, 0x80, 0x0, 0x40, 0x80, 0x9, 0x0, 0x3, 0x10040, 0x1, 0x0, 0x0, 0x1, 0x1, 0x1, 0x1, 0x1, 0x1, 0x1, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x3, 0x1, 0x0, 0x1, 0x0, 0x1, 0x1, 0x0, 0x0, 0x1, 0x1, 0x1, 0x0, 0x1, 0x0, 0x0, 0x0, 0x1, 0x0, 0x1, 0x0, 0x1, 0x0, 0x0, 0x1, @perf_bp={&(0x7f0000000000), 0x10}, 0x8080, 0x800, 0x2, 0x3, 0x36dc, 0x31df3b33, 0xff, 0x0, 0x9, 0x0, 0x5}, 0xffffffffffffffff, 0x9, r0, 0x9) ioctl$PERF_EVENT_IOC_PAUSE_OUTPUT(r0, 0x40042409, 0x0) ioctl$PERF_EVENT_IOC_PERIOD(0xffffffffffffffff, 0x40082404, &(0x7f0000000140)=0x8) r1 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl$sock_ipv4_tunnel_SIOCADDTUNNEL(r1, 0x89f1, &(0x7f00000001c0)={'syztnl1\x00', &(0x7f0000000180)={'syztnl0\x00', 0x0, 0x1, 0x40, 0x0, 0x5, {{0x5, 0x4, 0x2, 0x19, 0x14, 0x65, 0x0, 0x1f, 0x4, 0x0, @multicast2, @remote}}}}) ioctl$PERF_EVENT_IOC_PERIOD(r0, 0x40082404, &(0x7f0000000200)=0x9) ioctl$SNDRV_SEQ_IOCTL_GET_PORT_INFO(0xffffffffffffffff, 0xc0a85322, &(0x7f0000000240)) ioctl$SNDRV_SEQ_IOCTL_SYSTEM_INFO(0xffffffffffffffff, 0xc0305302, &(0x7f0000000300)={0x9, 0x101, 0x1, 0x6, 0x3, 0x5}) r2 = syz_open_procfs(0x0, &(0x7f0000000340)='children\x00') openat$cgroup_type(r2, &(0x7f0000000380), 0x2, 0x0) ioctl$EVIOCGABS20(r2, 0x80184560, &(0x7f00000003c0)=""/4096) socket$inet6_tcp(0xa, 0x1, 0x0) r3 = openat$nvram(0xffffffffffffff9c, &(0x7f00000013c0), 0xdd0e52fd5a017ff5, 0x0) mmap$perf(&(0x7f0000ffe000/0x2000)=nil, 0x2000, 0x2000001, 0x10, r3, 0x4) r4 = openat$vcsu(0xffffffffffffff9c, &(0x7f0000001400), 0x280103, 0x0) ioctl$SNDRV_SEQ_IOCTL_QUERY_NEXT_PORT(r4, 0xc0a85352, &(0x7f0000001440)={{0x20, 0x1}, 'port1\x00', 0x88, 0x22, 0x7, 0x5, 0x1000000, 0x2, 0x10000, 0x0, 0x5, 0xf0}) r5 = pidfd_getfd(r3, r3, 0x0) write$cgroup_type(r5, &(0x7f0000001500), 0x9) ioctl$PERF_EVENT_IOC_PERIOD(r2, 0x40082404, &(0x7f0000001540)=0x2) 17:43:26 executing program 7: r0 = perf_event_open(&(0x7f0000000040)={0x4, 0x80, 0x6f, 0x8, 0x8, 0x1, 0x0, 0x6, 0x4, 0x1, 0x1, 0x0, 0x0, 0x1, 0x1, 0x1, 0x0, 0x0, 0x1, 0x0, 0x0, 0x1, 0x1, 0x0, 0x0, 0x2, 0x1, 0x0, 0x0, 0x1, 0x0, 0x0, 0x1, 0x0, 0x1, 0x0, 0x0, 0x0, 0x1, 0x1, 0x1, 0x0, 0x1, 0x1, 0x1, 0x0, 0x1, 0x0, 0x50, 0x2, @perf_bp={&(0x7f0000000000), 0xa}, 0x2100, 0x7, 0x1, 0x3, 0x6, 0x93d3, 0x0, 0x0, 0x3a, 0x0, 0x9}, 0xffffffffffffffff, 0xc, 0xffffffffffffffff, 0x8) mmap$perf(&(0x7f0000ffb000/0x2000)=nil, 0x2000, 0xb, 0x11, r0, 0x8) munmap(&(0x7f0000ffb000/0x3000)=nil, 0x3000) getsockopt$inet6_tcp_TCP_ZEROCOPY_RECEIVE(0xffffffffffffffff, 0x6, 0x23, &(0x7f0000001180)={&(0x7f0000ffd000/0x2000)=nil, 0x2000, 0x0, 0x0, 0x0, &(0x7f00000000c0)=""/162, 0xa2, 0x0, &(0x7f0000000180)=""/4096, 0x1000}, &(0x7f00000011c0)=0x40) r1 = openat$vcsa(0xffffffffffffff9c, &(0x7f0000001200), 0x14d080, 0x0) ioctl$SNDRV_SEQ_IOCTL_SUBSCRIBE_PORT(r1, 0x40505330, &(0x7f0000001240)={{0x3f, 0x40}, {0x9, 0x2}, 0x43, 0x0, 0x1}) r2 = mmap$binder(&(0x7f0000ffc000/0x1000)=nil, 0x1000, 0x1, 0x11, r1, 0x81) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000001380)={0x44, 0x0, &(0x7f00000012c0)=[@acquire={0x40046305, 0x3}, @increfs, @free_buffer={0x40086303, r2}, @exit_looper, @request_death={0x400c630e, 0x3}, @increfs={0x40046304, 0x2}, @free_buffer], 0x1d, 0x0, &(0x7f0000001340)="63170b84a45d435cf194bbb38c0432388cb6578156ee80dc59b93c914c"}) r3 = openat$vcsa(0xffffffffffffff9c, &(0x7f00000013c0), 0x400000, 0x0) ioctl$SNDRV_SEQ_IOCTL_GET_SUBSCRIPTION(r3, 0xc0505350, &(0x7f0000001400)={{0x1, 0x6}, {0x1f, 0x81}, 0x4, 0x3, 0x7}) r4 = openat$nvram(0xffffffffffffff9c, &(0x7f0000001480), 0x105500, 0x0) mmap$IORING_OFF_SQ_RING(&(0x7f0000ffd000/0x1000)=nil, 0x1000, 0x0, 0x13, r4, 0x0) munmap(&(0x7f0000ffc000/0x2000)=nil, 0x2000) setsockopt$inet_tcp_TLS_TX(r3, 0x6, 0x1, &(0x7f00000014c0)=@gcm_128={{0x304}, "c7158b5e86708544", "366c7e9fd1d7fe2728acf2d3b734f3db", "b710fe41", "ad55c6ad971e7ae7"}, 0x28) mlock(&(0x7f0000ffd000/0x1000)=nil, 0x1000) ioctl$SECCOMP_IOCTL_NOTIF_RECV(r3, 0xc0502100, &(0x7f0000001500)={0x0, 0x0}) move_pages(r5, 0x2, &(0x7f0000001580)=[&(0x7f0000ffd000/0x3000)=nil, &(0x7f0000ffd000/0x1000)=nil], &(0x7f00000015c0)=[0x2, 0x6, 0x3, 0x400], &(0x7f0000001600)=[0x0, 0x0, 0x0, 0x0, 0x0, 0x0], 0x1) r6 = openat$nvram(0xffffffffffffff9c, &(0x7f0000001640), 0x40000, 0x0) write$sndseq(r6, &(0x7f00000016c0)=[{0x2, 0x8, 0x80, 0x1, @time={0x40, 0x5}, {0x2, 0x8}, {0x3, 0x4}, @raw32={[0xffff8000, 0x9, 0xbd1]}}, {0x1f, 0x0, 0x0, 0x5, @time={0x3, 0x5}, {0x20}, {}, @addr={0x8b, 0xca}}, {0x4, 0x8, 0xff, 0x5f, @tick=0xffffffff, {0x9, 0x80}, {0x6, 0x3}, @control={0x40, 0x3, 0x105}}, {0x80, 0x1, 0x8c, 0x3, @tick=0x3, {0x1, 0x40}, {0x9, 0x41}, @raw8={"734e6b3936ff731b516b11c3"}}, {0x4, 0x5, 0x4, 0x0, @time={0x2, 0xb175}, {0x30, 0xff}, {0x1}, @ext={0x1f, &(0x7f0000001680)="3a491fb488d546f729c7689e94b5cdce0cb71c51082283a43f3327e29d0948"}}, {0x3, 0x14, 0x7, 0x8, @tick=0x1f, {0xf7, 0x1}, {0x3f, 0xff}, @control={0x81, 0x8, 0xffffffff}}], 0xa8) shmget(0x0, 0x1000, 0x200, &(0x7f0000ffd000/0x1000)=nil) [ 63.697044] Bluetooth: hci0: unexpected cc 0x0c03 length: 249 > 1 [ 63.698752] Bluetooth: hci1: unexpected cc 0x0c03 length: 249 > 1 [ 63.701187] Bluetooth: hci0: unexpected cc 0x1003 length: 249 > 9 [ 63.702699] Bluetooth: hci1: unexpected cc 0x1003 length: 249 > 9 [ 63.704638] Bluetooth: hci0: unexpected cc 0x1001 length: 249 > 9 [ 63.706576] Bluetooth: hci1: unexpected cc 0x1001 length: 249 > 9 [ 63.712411] Bluetooth: hci1: unexpected cc 0x0c23 length: 249 > 4 [ 63.716699] Bluetooth: hci1: unexpected cc 0x0c38 length: 249 > 2 [ 63.718414] Bluetooth: hci0: unexpected cc 0x0c23 length: 249 > 4 [ 63.725548] Bluetooth: hci0: unexpected cc 0x0c38 length: 249 > 2 [ 63.822324] Bluetooth: hci2: unexpected cc 0x0c03 length: 249 > 1 [ 63.826722] Bluetooth: hci2: unexpected cc 0x1003 length: 249 > 9 [ 63.853387] Bluetooth: hci3: unexpected cc 0x0c03 length: 249 > 1 [ 63.855135] Bluetooth: hci4: unexpected cc 0x0c03 length: 249 > 1 [ 63.857447] Bluetooth: hci3: unexpected cc 0x1003 length: 249 > 9 [ 63.862328] Bluetooth: hci3: unexpected cc 0x1001 length: 249 > 9 [ 63.864002] Bluetooth: hci4: unexpected cc 0x1003 length: 249 > 9 [ 63.872095] Bluetooth: hci4: unexpected cc 0x1001 length: 249 > 9 [ 63.876352] Bluetooth: hci3: unexpected cc 0x0c23 length: 249 > 4 [ 63.877949] Bluetooth: hci2: unexpected cc 0x1001 length: 249 > 9 [ 63.894507] Bluetooth: hci5: unexpected cc 0x0c03 length: 249 > 1 [ 63.899251] Bluetooth: hci3: unexpected cc 0x0c38 length: 249 > 2 [ 63.900797] Bluetooth: hci2: unexpected cc 0x0c23 length: 249 > 4 [ 63.903374] Bluetooth: hci2: unexpected cc 0x0c38 length: 249 > 2 [ 63.906522] Bluetooth: hci6: unexpected cc 0x0c03 length: 249 > 1 [ 63.908205] Bluetooth: hci5: unexpected cc 0x1003 length: 249 > 9 [ 63.910691] Bluetooth: hci4: unexpected cc 0x0c23 length: 249 > 4 [ 63.914509] Bluetooth: hci7: unexpected cc 0x0c03 length: 249 > 1 [ 63.916423] Bluetooth: hci7: unexpected cc 0x1003 length: 249 > 9 [ 63.918066] Bluetooth: hci4: unexpected cc 0x0c38 length: 249 > 2 [ 63.919382] Bluetooth: hci7: unexpected cc 0x1001 length: 249 > 9 [ 63.929942] Bluetooth: hci5: unexpected cc 0x1001 length: 249 > 9 [ 63.932129] Bluetooth: hci7: unexpected cc 0x0c23 length: 249 > 4 [ 63.936115] Bluetooth: hci7: unexpected cc 0x0c38 length: 249 > 2 [ 63.943704] Bluetooth: hci6: unexpected cc 0x1003 length: 249 > 9 [ 63.952291] Bluetooth: hci6: unexpected cc 0x1001 length: 249 > 9 [ 63.979299] Bluetooth: hci6: unexpected cc 0x0c23 length: 249 > 4 [ 63.984736] Bluetooth: hci6: unexpected cc 0x0c38 length: 249 > 2 [ 63.992804] Bluetooth: hci5: unexpected cc 0x0c23 length: 249 > 4 [ 64.019587] Bluetooth: hci5: unexpected cc 0x0c38 length: 249 > 2 [ 65.786414] Bluetooth: hci1: command tx timeout [ 65.787990] Bluetooth: hci0: command tx timeout [ 65.978033] Bluetooth: hci3: command tx timeout [ 65.978085] Bluetooth: hci4: command tx timeout [ 66.042389] Bluetooth: hci2: command tx timeout [ 66.042422] Bluetooth: hci6: command tx timeout [ 66.043537] Bluetooth: hci7: command tx timeout [ 66.105914] Bluetooth: hci5: command tx timeout [ 67.835908] Bluetooth: hci1: command tx timeout [ 67.835925] Bluetooth: hci0: command tx timeout [ 68.025984] Bluetooth: hci4: command tx timeout [ 68.027554] Bluetooth: hci3: command tx timeout [ 68.090059] Bluetooth: hci7: command tx timeout [ 68.091013] Bluetooth: hci6: command tx timeout [ 68.091121] Bluetooth: hci2: command tx timeout [ 68.153903] Bluetooth: hci5: command tx timeout [ 69.882127] Bluetooth: hci1: command tx timeout [ 69.882943] Bluetooth: hci0: command tx timeout [ 70.076052] Bluetooth: hci3: command tx timeout [ 70.076811] Bluetooth: hci4: command tx timeout [ 70.137987] Bluetooth: hci2: command tx timeout [ 70.139169] Bluetooth: hci6: command tx timeout [ 70.139244] Bluetooth: hci7: command tx timeout [ 70.201935] Bluetooth: hci5: command tx timeout [ 71.931892] Bluetooth: hci1: command tx timeout [ 71.932082] Bluetooth: hci0: command tx timeout [ 72.122269] Bluetooth: hci4: command tx timeout [ 72.122374] Bluetooth: hci3: command tx timeout [ 72.186161] Bluetooth: hci6: command tx timeout [ 72.186239] Bluetooth: hci2: command tx timeout [ 72.187709] Bluetooth: hci7: command tx timeout [ 72.249952] Bluetooth: hci5: command tx timeout [ 105.370385] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 105.371071] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 105.509804] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 105.510671] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 106.105456] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 106.106119] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 17:44:09 executing program 4: ioctl$SNDRV_TIMER_IOCTL_TREAD(0xffffffffffffffff, 0x40045402, &(0x7f0000000000)) wait4(0xffffffffffffffff, &(0x7f0000000040), 0x1, &(0x7f0000000080)) waitid$P_PIDFD(0x3, 0xffffffffffffffff, &(0x7f0000000140), 0x40000002, &(0x7f00000001c0)) shmget$private(0x0, 0x3000, 0x20, &(0x7f0000ffa000/0x3000)=nil) sendmsg$SEG6_CMD_SETHMAC(0xffffffffffffffff, &(0x7f0000000380)={&(0x7f0000000280)={0x10, 0x0, 0x0, 0x2}, 0xc, &(0x7f0000000340)={&(0x7f00000002c0)={0x48, 0x0, 0x10, 0x70bd25, 0x25dfdbff, {}, [@SEG6_ATTR_ALGID={0x5, 0x6, 0x4}, @SEG6_ATTR_ALGID={0x5, 0x6, 0x20}, @SEG6_ATTR_ALGID={0x5, 0x6, 0x8}, @SEG6_ATTR_HMACKEYID={0x8, 0x3, 0x1}, @SEG6_ATTR_SECRETLEN={0x5, 0x5, 0x5}, @SEG6_ATTR_SECRET={0x4}, @SEG6_ATTR_DSTLEN={0x8, 0x2, 0x1f}]}, 0x48}}, 0x0) r0 = openat$vcsa(0xffffffffffffff9c, &(0x7f00000003c0), 0x48000, 0x0) ioctl$SNDRV_TIMER_IOCTL_START(r0, 0x54a0) r1 = syz_open_procfs(0x0, &(0x7f0000000400)='smaps_rollup\x00') ioctl$EVIOCSREP(r1, 0x40084503, &(0x7f0000000440)=[0x8, 0x7ff]) socket$inet_udp(0x2, 0x2, 0x0) socket$inet6_tcp(0xa, 0x1, 0x0) r2 = openat$vcsu(0xffffffffffffff9c, &(0x7f0000000480), 0x0, 0x0) process_mrelease(r2, 0x0) r3 = openat$vcsa(0xffffffffffffff9c, &(0x7f00000004c0), 0x0, 0x0) ioctl$EVIOCGABS2F(r3, 0x8018456f, &(0x7f0000000500)=""/236) r4 = io_uring_setup(0x653f, &(0x7f0000000600)={0x0, 0x55d7, 0x20, 0x1, 0x281, 0x0, r2}) mmap$IORING_OFF_SQ_RING(&(0x7f0000ffd000/0x3000)=nil, 0x3000, 0x2, 0x30, r4, 0x0) syz_open_dev$char_usb(0xc, 0xb4, 0x400) ioctl$EVIOCGBITSW(r3, 0x80404525, &(0x7f0000000680)=""/213) shmget(0x1, 0x3000, 0x20, &(0x7f0000ffc000/0x3000)=nil) 17:44:09 executing program 4: ioctl$SNDRV_TIMER_IOCTL_TREAD(0xffffffffffffffff, 0x40045402, &(0x7f0000000000)) wait4(0xffffffffffffffff, &(0x7f0000000040), 0x1, &(0x7f0000000080)) waitid$P_PIDFD(0x3, 0xffffffffffffffff, &(0x7f0000000140), 0x40000002, &(0x7f00000001c0)) shmget$private(0x0, 0x3000, 0x20, &(0x7f0000ffa000/0x3000)=nil) sendmsg$SEG6_CMD_SETHMAC(0xffffffffffffffff, &(0x7f0000000380)={&(0x7f0000000280)={0x10, 0x0, 0x0, 0x2}, 0xc, &(0x7f0000000340)={&(0x7f00000002c0)={0x48, 0x0, 0x10, 0x70bd25, 0x25dfdbff, {}, [@SEG6_ATTR_ALGID={0x5, 0x6, 0x4}, @SEG6_ATTR_ALGID={0x5, 0x6, 0x20}, @SEG6_ATTR_ALGID={0x5, 0x6, 0x8}, @SEG6_ATTR_HMACKEYID={0x8, 0x3, 0x1}, @SEG6_ATTR_SECRETLEN={0x5, 0x5, 0x5}, @SEG6_ATTR_SECRET={0x4}, @SEG6_ATTR_DSTLEN={0x8, 0x2, 0x1f}]}, 0x48}}, 0x0) r0 = openat$vcsa(0xffffffffffffff9c, &(0x7f00000003c0), 0x48000, 0x0) ioctl$SNDRV_TIMER_IOCTL_START(r0, 0x54a0) r1 = syz_open_procfs(0x0, &(0x7f0000000400)='smaps_rollup\x00') ioctl$EVIOCSREP(r1, 0x40084503, &(0x7f0000000440)=[0x8, 0x7ff]) socket$inet_udp(0x2, 0x2, 0x0) socket$inet6_tcp(0xa, 0x1, 0x0) r2 = openat$vcsu(0xffffffffffffff9c, &(0x7f0000000480), 0x0, 0x0) process_mrelease(r2, 0x0) r3 = openat$vcsa(0xffffffffffffff9c, &(0x7f00000004c0), 0x0, 0x0) ioctl$EVIOCGABS2F(r3, 0x8018456f, &(0x7f0000000500)=""/236) r4 = io_uring_setup(0x653f, &(0x7f0000000600)={0x0, 0x55d7, 0x20, 0x1, 0x281, 0x0, r2}) mmap$IORING_OFF_SQ_RING(&(0x7f0000ffd000/0x3000)=nil, 0x3000, 0x2, 0x30, r4, 0x0) syz_open_dev$char_usb(0xc, 0xb4, 0x400) ioctl$EVIOCGBITSW(r3, 0x80404525, &(0x7f0000000680)=""/213) shmget(0x1, 0x3000, 0x20, &(0x7f0000ffc000/0x3000)=nil) [ 106.447247] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 106.447940] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 17:44:10 executing program 4: ioctl$SNDRV_TIMER_IOCTL_TREAD(0xffffffffffffffff, 0x40045402, &(0x7f0000000000)) wait4(0xffffffffffffffff, &(0x7f0000000040), 0x1, &(0x7f0000000080)) waitid$P_PIDFD(0x3, 0xffffffffffffffff, &(0x7f0000000140), 0x40000002, &(0x7f00000001c0)) shmget$private(0x0, 0x3000, 0x20, &(0x7f0000ffa000/0x3000)=nil) sendmsg$SEG6_CMD_SETHMAC(0xffffffffffffffff, &(0x7f0000000380)={&(0x7f0000000280)={0x10, 0x0, 0x0, 0x2}, 0xc, &(0x7f0000000340)={&(0x7f00000002c0)={0x48, 0x0, 0x10, 0x70bd25, 0x25dfdbff, {}, [@SEG6_ATTR_ALGID={0x5, 0x6, 0x4}, @SEG6_ATTR_ALGID={0x5, 0x6, 0x20}, @SEG6_ATTR_ALGID={0x5, 0x6, 0x8}, @SEG6_ATTR_HMACKEYID={0x8, 0x3, 0x1}, @SEG6_ATTR_SECRETLEN={0x5, 0x5, 0x5}, @SEG6_ATTR_SECRET={0x4}, @SEG6_ATTR_DSTLEN={0x8, 0x2, 0x1f}]}, 0x48}}, 0x0) r0 = openat$vcsa(0xffffffffffffff9c, &(0x7f00000003c0), 0x48000, 0x0) ioctl$SNDRV_TIMER_IOCTL_START(r0, 0x54a0) r1 = syz_open_procfs(0x0, &(0x7f0000000400)='smaps_rollup\x00') ioctl$EVIOCSREP(r1, 0x40084503, &(0x7f0000000440)=[0x8, 0x7ff]) socket$inet_udp(0x2, 0x2, 0x0) socket$inet6_tcp(0xa, 0x1, 0x0) r2 = openat$vcsu(0xffffffffffffff9c, &(0x7f0000000480), 0x0, 0x0) process_mrelease(r2, 0x0) r3 = openat$vcsa(0xffffffffffffff9c, &(0x7f00000004c0), 0x0, 0x0) ioctl$EVIOCGABS2F(r3, 0x8018456f, &(0x7f0000000500)=""/236) r4 = io_uring_setup(0x653f, &(0x7f0000000600)={0x0, 0x55d7, 0x20, 0x1, 0x281, 0x0, r2}) mmap$IORING_OFF_SQ_RING(&(0x7f0000ffd000/0x3000)=nil, 0x3000, 0x2, 0x30, r4, 0x0) syz_open_dev$char_usb(0xc, 0xb4, 0x400) ioctl$EVIOCGBITSW(r3, 0x80404525, &(0x7f0000000680)=""/213) shmget(0x1, 0x3000, 0x20, &(0x7f0000ffc000/0x3000)=nil) 17:44:10 executing program 4: ioctl$SNDRV_TIMER_IOCTL_TREAD(0xffffffffffffffff, 0x40045402, &(0x7f0000000000)) wait4(0xffffffffffffffff, &(0x7f0000000040), 0x1, &(0x7f0000000080)) waitid$P_PIDFD(0x3, 0xffffffffffffffff, &(0x7f0000000140), 0x40000002, &(0x7f00000001c0)) shmget$private(0x0, 0x3000, 0x20, &(0x7f0000ffa000/0x3000)=nil) sendmsg$SEG6_CMD_SETHMAC(0xffffffffffffffff, &(0x7f0000000380)={&(0x7f0000000280)={0x10, 0x0, 0x0, 0x2}, 0xc, &(0x7f0000000340)={&(0x7f00000002c0)={0x48, 0x0, 0x10, 0x70bd25, 0x25dfdbff, {}, [@SEG6_ATTR_ALGID={0x5, 0x6, 0x4}, @SEG6_ATTR_ALGID={0x5, 0x6, 0x20}, @SEG6_ATTR_ALGID={0x5, 0x6, 0x8}, @SEG6_ATTR_HMACKEYID={0x8, 0x3, 0x1}, @SEG6_ATTR_SECRETLEN={0x5, 0x5, 0x5}, @SEG6_ATTR_SECRET={0x4}, @SEG6_ATTR_DSTLEN={0x8, 0x2, 0x1f}]}, 0x48}}, 0x0) r0 = openat$vcsa(0xffffffffffffff9c, &(0x7f00000003c0), 0x48000, 0x0) ioctl$SNDRV_TIMER_IOCTL_START(r0, 0x54a0) r1 = syz_open_procfs(0x0, &(0x7f0000000400)='smaps_rollup\x00') ioctl$EVIOCSREP(r1, 0x40084503, &(0x7f0000000440)=[0x8, 0x7ff]) socket$inet_udp(0x2, 0x2, 0x0) socket$inet6_tcp(0xa, 0x1, 0x0) r2 = openat$vcsu(0xffffffffffffff9c, &(0x7f0000000480), 0x0, 0x0) process_mrelease(r2, 0x0) r3 = openat$vcsa(0xffffffffffffff9c, &(0x7f00000004c0), 0x0, 0x0) ioctl$EVIOCGABS2F(r3, 0x8018456f, &(0x7f0000000500)=""/236) r4 = io_uring_setup(0x653f, &(0x7f0000000600)={0x0, 0x55d7, 0x20, 0x1, 0x281, 0x0, r2}) mmap$IORING_OFF_SQ_RING(&(0x7f0000ffd000/0x3000)=nil, 0x3000, 0x2, 0x30, r4, 0x0) syz_open_dev$char_usb(0xc, 0xb4, 0x400) shmget(0x1, 0x3000, 0x20, &(0x7f0000ffc000/0x3000)=nil) 17:44:10 executing program 4: ioctl$SNDRV_TIMER_IOCTL_TREAD(0xffffffffffffffff, 0x40045402, &(0x7f0000000000)) wait4(0xffffffffffffffff, &(0x7f0000000040), 0x1, &(0x7f0000000080)) waitid$P_PIDFD(0x3, 0xffffffffffffffff, &(0x7f0000000140), 0x40000002, &(0x7f00000001c0)) shmget$private(0x0, 0x3000, 0x20, &(0x7f0000ffa000/0x3000)=nil) sendmsg$SEG6_CMD_SETHMAC(0xffffffffffffffff, &(0x7f0000000380)={&(0x7f0000000280)={0x10, 0x0, 0x0, 0x2}, 0xc, &(0x7f0000000340)={&(0x7f00000002c0)={0x48, 0x0, 0x10, 0x70bd25, 0x25dfdbff, {}, [@SEG6_ATTR_ALGID={0x5, 0x6, 0x4}, @SEG6_ATTR_ALGID={0x5, 0x6, 0x20}, @SEG6_ATTR_ALGID={0x5, 0x6, 0x8}, @SEG6_ATTR_HMACKEYID={0x8, 0x3, 0x1}, @SEG6_ATTR_SECRETLEN={0x5, 0x5, 0x5}, @SEG6_ATTR_SECRET={0x4}, @SEG6_ATTR_DSTLEN={0x8, 0x2, 0x1f}]}, 0x48}}, 0x0) r0 = openat$vcsa(0xffffffffffffff9c, &(0x7f00000003c0), 0x48000, 0x0) ioctl$SNDRV_TIMER_IOCTL_START(r0, 0x54a0) r1 = syz_open_procfs(0x0, &(0x7f0000000400)='smaps_rollup\x00') ioctl$EVIOCSREP(r1, 0x40084503, &(0x7f0000000440)=[0x8, 0x7ff]) socket$inet_udp(0x2, 0x2, 0x0) socket$inet6_tcp(0xa, 0x1, 0x0) r2 = openat$vcsu(0xffffffffffffff9c, &(0x7f0000000480), 0x0, 0x0) process_mrelease(r2, 0x0) r3 = openat$vcsa(0xffffffffffffff9c, &(0x7f00000004c0), 0x0, 0x0) ioctl$EVIOCGABS2F(r3, 0x8018456f, &(0x7f0000000500)=""/236) r4 = io_uring_setup(0x653f, &(0x7f0000000600)={0x0, 0x55d7, 0x20, 0x1, 0x281, 0x0, r2}) mmap$IORING_OFF_SQ_RING(&(0x7f0000ffd000/0x3000)=nil, 0x3000, 0x2, 0x30, r4, 0x0) shmget(0x1, 0x3000, 0x20, &(0x7f0000ffc000/0x3000)=nil) 17:44:10 executing program 4: ioctl$SNDRV_TIMER_IOCTL_TREAD(0xffffffffffffffff, 0x40045402, &(0x7f0000000000)) wait4(0xffffffffffffffff, &(0x7f0000000040), 0x1, &(0x7f0000000080)) waitid$P_PIDFD(0x3, 0xffffffffffffffff, &(0x7f0000000140), 0x40000002, &(0x7f00000001c0)) shmget$private(0x0, 0x3000, 0x20, &(0x7f0000ffa000/0x3000)=nil) sendmsg$SEG6_CMD_SETHMAC(0xffffffffffffffff, &(0x7f0000000380)={&(0x7f0000000280)={0x10, 0x0, 0x0, 0x2}, 0xc, &(0x7f0000000340)={&(0x7f00000002c0)={0x48, 0x0, 0x10, 0x70bd25, 0x25dfdbff, {}, [@SEG6_ATTR_ALGID={0x5, 0x6, 0x4}, @SEG6_ATTR_ALGID={0x5, 0x6, 0x20}, @SEG6_ATTR_ALGID={0x5, 0x6, 0x8}, @SEG6_ATTR_HMACKEYID={0x8, 0x3, 0x1}, @SEG6_ATTR_SECRETLEN={0x5, 0x5, 0x5}, @SEG6_ATTR_SECRET={0x4}, @SEG6_ATTR_DSTLEN={0x8, 0x2, 0x1f}]}, 0x48}}, 0x0) r0 = openat$vcsa(0xffffffffffffff9c, &(0x7f00000003c0), 0x48000, 0x0) ioctl$SNDRV_TIMER_IOCTL_START(r0, 0x54a0) r1 = syz_open_procfs(0x0, &(0x7f0000000400)='smaps_rollup\x00') ioctl$EVIOCSREP(r1, 0x40084503, &(0x7f0000000440)=[0x8, 0x7ff]) socket$inet_udp(0x2, 0x2, 0x0) socket$inet6_tcp(0xa, 0x1, 0x0) r2 = openat$vcsu(0xffffffffffffff9c, &(0x7f0000000480), 0x0, 0x0) process_mrelease(r2, 0x0) r3 = openat$vcsa(0xffffffffffffff9c, &(0x7f00000004c0), 0x0, 0x0) ioctl$EVIOCGABS2F(r3, 0x8018456f, &(0x7f0000000500)=""/236) io_uring_setup(0x653f, &(0x7f0000000600)={0x0, 0x55d7, 0x20, 0x1, 0x281, 0x0, r2}) shmget(0x1, 0x3000, 0x20, &(0x7f0000ffc000/0x3000)=nil) 17:44:10 executing program 4: ioctl$SNDRV_TIMER_IOCTL_TREAD(0xffffffffffffffff, 0x40045402, &(0x7f0000000000)) wait4(0xffffffffffffffff, &(0x7f0000000040), 0x1, &(0x7f0000000080)) waitid$P_PIDFD(0x3, 0xffffffffffffffff, &(0x7f0000000140), 0x40000002, &(0x7f00000001c0)) shmget$private(0x0, 0x3000, 0x20, &(0x7f0000ffa000/0x3000)=nil) sendmsg$SEG6_CMD_SETHMAC(0xffffffffffffffff, &(0x7f0000000380)={&(0x7f0000000280)={0x10, 0x0, 0x0, 0x2}, 0xc, &(0x7f0000000340)={&(0x7f00000002c0)={0x48, 0x0, 0x10, 0x70bd25, 0x25dfdbff, {}, [@SEG6_ATTR_ALGID={0x5, 0x6, 0x4}, @SEG6_ATTR_ALGID={0x5, 0x6, 0x20}, @SEG6_ATTR_ALGID={0x5, 0x6, 0x8}, @SEG6_ATTR_HMACKEYID={0x8, 0x3, 0x1}, @SEG6_ATTR_SECRETLEN={0x5, 0x5, 0x5}, @SEG6_ATTR_SECRET={0x4}, @SEG6_ATTR_DSTLEN={0x8, 0x2, 0x1f}]}, 0x48}}, 0x0) r0 = openat$vcsa(0xffffffffffffff9c, &(0x7f00000003c0), 0x48000, 0x0) ioctl$SNDRV_TIMER_IOCTL_START(r0, 0x54a0) r1 = syz_open_procfs(0x0, &(0x7f0000000400)='smaps_rollup\x00') ioctl$EVIOCSREP(r1, 0x40084503, &(0x7f0000000440)=[0x8, 0x7ff]) socket$inet_udp(0x2, 0x2, 0x0) socket$inet6_tcp(0xa, 0x1, 0x0) r2 = openat$vcsu(0xffffffffffffff9c, &(0x7f0000000480), 0x0, 0x0) process_mrelease(r2, 0x0) r3 = openat$vcsa(0xffffffffffffff9c, &(0x7f00000004c0), 0x0, 0x0) ioctl$EVIOCGABS2F(r3, 0x8018456f, &(0x7f0000000500)=""/236) shmget(0x1, 0x3000, 0x20, &(0x7f0000ffc000/0x3000)=nil) 17:44:10 executing program 4: ioctl$SNDRV_TIMER_IOCTL_TREAD(0xffffffffffffffff, 0x40045402, &(0x7f0000000000)) wait4(0xffffffffffffffff, &(0x7f0000000040), 0x1, &(0x7f0000000080)) waitid$P_PIDFD(0x3, 0xffffffffffffffff, &(0x7f0000000140), 0x40000002, &(0x7f00000001c0)) shmget$private(0x0, 0x3000, 0x20, &(0x7f0000ffa000/0x3000)=nil) sendmsg$SEG6_CMD_SETHMAC(0xffffffffffffffff, &(0x7f0000000380)={&(0x7f0000000280)={0x10, 0x0, 0x0, 0x2}, 0xc, &(0x7f0000000340)={&(0x7f00000002c0)={0x48, 0x0, 0x10, 0x70bd25, 0x25dfdbff, {}, [@SEG6_ATTR_ALGID={0x5, 0x6, 0x4}, @SEG6_ATTR_ALGID={0x5, 0x6, 0x20}, @SEG6_ATTR_ALGID={0x5, 0x6, 0x8}, @SEG6_ATTR_HMACKEYID={0x8, 0x3, 0x1}, @SEG6_ATTR_SECRETLEN={0x5, 0x5, 0x5}, @SEG6_ATTR_SECRET={0x4}, @SEG6_ATTR_DSTLEN={0x8, 0x2, 0x1f}]}, 0x48}}, 0x0) r0 = openat$vcsa(0xffffffffffffff9c, &(0x7f00000003c0), 0x48000, 0x0) ioctl$SNDRV_TIMER_IOCTL_START(r0, 0x54a0) r1 = syz_open_procfs(0x0, &(0x7f0000000400)='smaps_rollup\x00') ioctl$EVIOCSREP(r1, 0x40084503, &(0x7f0000000440)=[0x8, 0x7ff]) socket$inet_udp(0x2, 0x2, 0x0) socket$inet6_tcp(0xa, 0x1, 0x0) r2 = openat$vcsu(0xffffffffffffff9c, &(0x7f0000000480), 0x0, 0x0) process_mrelease(r2, 0x0) openat$vcsa(0xffffffffffffff9c, &(0x7f00000004c0), 0x0, 0x0) shmget(0x1, 0x3000, 0x20, &(0x7f0000ffc000/0x3000)=nil) [ 107.380911] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 107.381540] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 107.441632] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 107.442606] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 108.024972] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 108.025598] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 108.147065] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 108.147620] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 108.280279] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 108.280838] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 108.334326] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 108.334955] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 108.702955] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 108.704203] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 108.856241] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 108.857143] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 109.030967] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 109.031574] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 109.073352] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 109.073918] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 109.568241] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 109.568978] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 109.594588] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 109.595288] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 109.681968] UDPLite: UDP-Lite is deprecated and scheduled to be removed in 2025, please contact the netdev mailing list [ 109.683074] audit: type=1400 audit(1756662253.302:8): avc: denied { open } for pid=3924 comm="syz-executor.6" scontext=system_u:system_r:kernel_t:s0 tcontext=system_u:system_r:kernel_t:s0 tclass=perf_event permissive=1 17:44:25 executing program 3: getsockopt$inet_udp_int(0xffffffffffffffff, 0x11, 0x1, &(0x7f0000000000), &(0x7f0000000040)=0x4) setsockopt$inet_udp_int(0xffffffffffffffff, 0x11, 0x1, &(0x7f0000000080)=0x7, 0x4) ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, &(0x7f0000000240)={0x54, 0x0, &(0x7f00000000c0)=[@acquire_done={0x40106309, 0x1}, @free_buffer, @request_death={0x400c630e, 0x1}, @request_death, @decrefs, @dead_binder_done], 0xc7, 0x0, &(0x7f0000000140)="aa36e0fef6a6cd3a6060f434b2a2306a435d6c33ca3bfb20c9d046886ded10cf23d0938b55b8a812702a5a7579cb8813f0cf3954f24fa081e8c35a9d4674b51115d91e7f6e38920909a8fba27ba7bbb0522974a9d83826c23d40a56c3f88dc24276a8312ae50d15d3531211e4378a34980ea70ac3cefef2439af0baa6b387df4ff26b593ca52e94dda8ce3656a81180693ab97746e30b1301f30922ec565bba820fc06168927e446c06efe1fc7cb37b804ba0342e58e70da81c074407ec9cf690a9ab1e3a62a68"}) r0 = openat$vcsa(0xffffffffffffff9c, &(0x7f0000000280), 0x1, 0x0) r1 = openat$vcsa(0xffffffffffffff9c, &(0x7f00000002c0), 0x80, 0x0) ioctl$SNDRV_SEQ_IOCTL_QUERY_NEXT_PORT(r0, 0xc0a85352, &(0x7f0000000300)={{0x4, 0x6}, 'port0\x00', 0x5, 0x1, 0x0, 0xffff, 0x7, 0x7, 0x5, 0x0, 0x2, 0xc0}) ioctl$SNDRV_SEQ_IOCTL_QUERY_NEXT_CLIENT(r1, 0xc0bc5351, &(0x7f00000003c0)={0xffff7fff, 0x0, 'client0\x00', 0xffffffff80000002, "9aa89fbb0e155330", "7e3a03465d7350a6322e39e7997e8c634c3224eb46d1223d24ed4ce35c7b1dd2", 0x0, 0x6}) r2 = openat$nvram(0xffffffffffffff9c, &(0x7f0000000480), 0x1, 0x0) ioctl$PERF_EVENT_IOC_PAUSE_OUTPUT(r2, 0x40042409, 0x0) process_mrelease(r0, 0x0) ioctl$SNDRV_TIMER_IOCTL_TREAD(r1, 0x40045402, &(0x7f00000004c0)) r3 = socket$inet_udp(0x2, 0x2, 0x0) ioctl$sock_inet_udp_SIOCINQ(r3, 0x541b, &(0x7f0000000500)) getsockopt$inet_IP_IPSEC_POLICY(r0, 0x0, 0x10, &(0x7f0000000540)={{{@in=@broadcast, @in6=@mcast1}}, {{@in=@broadcast}, 0x0, @in6=@mcast2}}, &(0x7f0000000640)=0xe8) setsockopt$inet_udp_encap(r1, 0x11, 0x64, &(0x7f0000000680)=0x3, 0x4) r4 = syz_open_procfs(0xffffffffffffffff, &(0x7f00000006c0)='net/packet\x00') pidfd_getfd(r4, 0xffffffffffffffff, 0x0) r5 = openat$nvram(0xffffffffffffff9c, &(0x7f0000000700), 0x800, 0x0) ioctl$SECCOMP_IOCTL_NOTIF_RECV(r2, 0xc0502100, &(0x7f0000000740)={0x0, 0x0}) write$P9_RGETLOCK(r5, &(0x7f00000007c0)={0x1e, 0x37, 0x2, {0x2, 0x6, 0x101, r6}}, 0x1e) 17:44:25 executing program 1: shmget$private(0x0, 0x4000, 0x80, &(0x7f0000ffb000/0x4000)=nil) shmget(0x3, 0x2000, 0x4, &(0x7f0000ffc000/0x2000)=nil) mlock(&(0x7f0000ff0000/0x10000)=nil, 0x10000) shmget(0x1, 0x1000, 0x10, &(0x7f0000ff5000/0x1000)=nil) ioctl$sock_ipv4_tunnel_SIOCGETTUNNEL(0xffffffffffffffff, 0x89f0, &(0x7f0000000140)={'syztnl1\x00', &(0x7f00000000c0)={'syztnl2\x00', 0x0, 0x20, 0x1, 0x6, 0x9, {{0xd, 0x4, 0x1, 0x19, 0x34, 0x68, 0x0, 0x9, 0x29, 0x0, @empty, @dev={0xac, 0x14, 0x14, 0x29}, {[@timestamp_addr={0x44, 0x14, 0xc2, 0x1, 0x4, [{@multicast1}, {@private=0xa010101}]}, @rr={0x7, 0xb, 0xc8, [@initdev={0xac, 0x1e, 0x1, 0x0}, @private=0xa010102]}]}}}}}) ioctl$sock_ipv4_tunnel_SIOCADDTUNNEL(0xffffffffffffffff, 0x89f1, &(0x7f0000000280)={'tunl0\x00', &(0x7f0000000180)={'tunl0\x00', r0, 0x7, 0x8000, 0xfffffffc, 0x8, {{0x2f, 0x4, 0x0, 0x2, 0xbc, 0x65, 0x0, 0x0, 0x4, 0x0, @empty, @broadcast, {[@generic={0x89, 0x9, "8db1d464c6af68"}, @noop, @ra={0x94, 0x4, 0x1}, @timestamp={0x44, 0x1c, 0x53, 0x0, 0x7, [0x40, 0x7fffffff, 0xfffffffd, 0x5, 0x5c, 0x77]}, @cipso={0x86, 0x2f, 0x3, [{0x1, 0x4, "1eba"}, {0x1, 0x7, "e3ccb5ddcf"}, {0x6, 0xa, "5db18b961780af33"}, {0x2, 0xe, "7353a9824b57fd7d39232ac5"}, {0x1, 0x6, "2e1ccd27"}]}, @noop, @cipso={0x86, 0x37, 0xffffffffffffffff, [{0x2, 0xf, "227467028cabd4e137b820c5c9"}, {0x7, 0x6, "90569992"}, {0x2, 0xc, "2071b0a8c9ce92782e72"}, {0x6, 0xa, "14f2b9bca55ce3dd"}, {0x6, 0x6, "2cd22a8f"}]}, @timestamp={0x44, 0x14, 0xd4, 0x0, 0x5, [0x81, 0x5d23, 0x63ab, 0x1]}]}}}}}) ioctl$sock_ipv4_tunnel_SIOCDELTUNNEL(0xffffffffffffffff, 0x89f2, &(0x7f0000000380)={'gretap0\x00', &(0x7f00000002c0)={'syztnl2\x00', 0x0, 0x7800, 0x7, 0x40, 0xe180, {{0x22, 0x4, 0x0, 0x1, 0x88, 0x64, 0x0, 0x1, 0x29, 0x0, @multicast2, @multicast1, {[@end, @lsrr={0x83, 0x1f, 0x2f, [@multicast2, @local, @local, @multicast1, @rand_addr=0x64010102, @loopback, @private=0xa010100]}, @rr={0x7, 0x27, 0x6c, [@multicast1, @rand_addr=0x64010102, @remote, @multicast1, @loopback, @initdev={0xac, 0x1e, 0x0, 0x0}, @initdev={0xac, 0x1e, 0x1, 0x0}, @broadcast, @empty]}, @ra={0x94, 0x4, 0x1}, @timestamp={0x44, 0x10, 0x2d, 0x0, 0x8, [0x1, 0x100, 0x401]}, @ssrr={0x89, 0x13, 0x56, [@dev={0xac, 0x14, 0x14, 0x28}, @multicast2, @initdev={0xac, 0x1e, 0x0, 0x0}, @remote]}, @ra={0x94, 0x4, 0x1}]}}}}}) shmget(0x3, 0x4000, 0x4, &(0x7f0000ff9000/0x4000)=nil) mmap$IORING_OFF_CQ_RING(&(0x7f0000ffd000/0x3000)=nil, 0x3000, 0x2000008, 0x30, 0xffffffffffffffff, 0x8000000) r1 = syz_genetlink_get_family_id$nl802154(&(0x7f0000000400), 0xffffffffffffffff) ioctl$sock_SIOCGIFINDEX_802154(0xffffffffffffffff, 0x8933, &(0x7f0000000440)={'wpan1\x00', 0x0}) sendmsg$NL802154_CMD_NEW_INTERFACE(0xffffffffffffffff, &(0x7f0000000540)={&(0x7f00000003c0)={0x10, 0x0, 0x0, 0x2}, 0xc, &(0x7f0000000500)={&(0x7f0000000480)={0x48, r1, 0x200, 0x70bd2a, 0x25dfdbfd, {}, [@NL802154_ATTR_IFNAME={0xa, 0x4, 'wpan0\x00'}, @NL802154_ATTR_IFINDEX={0x8}, @NL802154_ATTR_IFNAME={0xa, 0x4, 'wpan1\x00'}, @NL802154_ATTR_EXTENDED_ADDR={0xc, 0x17, {0xaaaaaaaaaaaa0002}}, @NL802154_ATTR_IFINDEX={0x8, 0x3, r2}]}, 0x48}}, 0x4001) mmap$binder(&(0x7f0000fef000/0x11000)=nil, 0x11000, 0x1, 0x11, 0xffffffffffffffff, 0x6) shmget$private(0x0, 0x4000, 0x200, &(0x7f0000ffc000/0x4000)=nil) r3 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) ioctl$sock_SIOCGIFINDEX_802154(0xffffffffffffffff, 0x8933, &(0x7f00000005c0)={'wpan0\x00', 0x0}) sendmsg$IEEE802154_LLSEC_ADD_SECLEVEL(r3, &(0x7f00000006c0)={&(0x7f0000000580)={0x10, 0x0, 0x0, 0x4000000}, 0xc, &(0x7f0000000680)={&(0x7f0000000600)={0x44, 0x0, 0x200, 0x70bd2a, 0x25dfdbff, {}, [@IEEE802154_ATTR_LLSEC_FRAME_TYPE={0x5, 0x33, 0x34}, @IEEE802154_ATTR_DEV_INDEX={0x8, 0x2, r4}, @IEEE802154_ATTR_LLSEC_CMD_FRAME_ID={0x5, 0x34, 0x1}, @IEEE802154_ATTR_DEV_NAME={0xa, 0x1, 'wpan0\x00'}, @IEEE802154_ATTR_DEV_NAME={0xa, 0x1, 'wpan4\x00'}]}, 0x44}, 0x1, 0x0, 0x0, 0x8800}, 0x0) sendmsg$IEEE802154_START_REQ(r3, &(0x7f00000007c0)={&(0x7f0000000700)={0x10, 0x0, 0x0, 0x4}, 0xc, &(0x7f0000000780)={&(0x7f0000000740)={0x1c, 0x0, 0x200, 0x70bd2d, 0x25dfdbfb, {}, [@IEEE802154_ATTR_CHANNEL={0x5, 0x7, 0x6}]}, 0x1c}, 0x1, 0x0, 0x0, 0x40100}, 0x801) mlock(&(0x7f0000fef000/0x1000)=nil, 0x1000) syz_io_uring_setup(0x4726, &(0x7f0000000840)={0x0, 0x502f, 0x20, 0x0, 0x12e}, &(0x7f0000ffe000/0x2000)=nil, &(0x7f0000ffb000/0x4000)=nil, &(0x7f00000008c0), &(0x7f0000000900)) 17:44:25 executing program 0: get_thread_area(&(0x7f0000000000)={0x7, 0x20000800, 0x4000, 0x0, 0x1, 0x0, 0x0, 0x1, 0x1, 0x1}) r0 = openat$vcsu(0xffffffffffffff9c, &(0x7f0000000040), 0x200000, 0x0) getsockopt$inet_tcp_TCP_REPAIR_WINDOW(r0, 0x6, 0x1d, &(0x7f0000000080), &(0x7f00000000c0)=0x14) r1 = openat$nvram(0xffffffffffffff9c, &(0x7f0000000100), 0x2000, 0x0) setsockopt$inet_tcp_TCP_FASTOPEN_KEY(r1, 0x6, 0x21, &(0x7f0000000140)="1bb9d563048b6ec78effc0f14d974b17", 0x10) setsockopt$inet_tcp_int(r1, 0x6, 0x1b, &(0x7f0000000180)=0x5, 0x4) ioctl$SNDRV_TIMER_IOCTL_STATUS32(r1, 0x80585414, &(0x7f00000001c0)) setsockopt$inet_tcp_TCP_QUEUE_SEQ(r0, 0x6, 0x15, &(0x7f0000000240)=0x1, 0x4) getsockopt$inet_tcp_TCP_ZEROCOPY_RECEIVE(r1, 0x6, 0x23, &(0x7f0000000340)={&(0x7f0000ffc000/0x2000)=nil, 0x2000, 0x0, 0x0, 0x0, &(0x7f0000000280)=""/37, 0x25, 0x1, &(0x7f00000002c0)=""/109, 0x6d}, &(0x7f0000000380)=0x40) r2 = socket$inet_tcp(0x2, 0x1, 0x0) ioctl$sock_inet_tcp_SIOCINQ(r2, 0x541b, &(0x7f00000003c0)) move_pages(0x0, 0x8, &(0x7f0000000400)=[&(0x7f0000ffd000/0x1000)=nil, &(0x7f0000ffd000/0x3000)=nil, &(0x7f0000ffd000/0x3000)=nil, &(0x7f0000ffb000/0x2000)=nil, &(0x7f0000ffc000/0x1000)=nil, &(0x7f0000ffe000/0x2000)=nil, &(0x7f0000ffb000/0x4000)=nil, &(0x7f0000ffd000/0x3000)=nil], &(0x7f0000000440)=[0xfff], &(0x7f0000000480)=[0x0, 0x0, 0x0], 0x4) r3 = syz_genetlink_get_family_id$SEG6(&(0x7f0000000500), r1) sendmsg$SEG6_CMD_GET_TUNSRC(r0, &(0x7f00000005c0)={&(0x7f00000004c0)={0x10, 0x0, 0x0, 0x4000000}, 0xc, &(0x7f0000000580)={&(0x7f0000000540)={0x38, r3, 0x300, 0x70bd2a, 0x25dfdbfc, {}, [@SEG6_ATTR_HMACKEYID={0x8, 0x3, 0x24}, @SEG6_ATTR_DST={0x14, 0x1, @mcast1}, @SEG6_ATTR_DSTLEN={0x8, 0x2, 0x2}]}, 0x38}, 0x1, 0x0, 0x0, 0x20008810}, 0x4040010) ioctl$SNDRV_SEQ_IOCTL_SET_QUEUE_TIMER(r1, 0x40605346, &(0x7f0000000600)={0x80, 0x1, {0x1, 0x0, 0x81}, 0x2}) sendmsg$SEG6_CMD_DUMPHMAC(0xffffffffffffffff, &(0x7f0000000740)={&(0x7f0000000680)={0x10, 0x0, 0x0, 0x240000}, 0xc, &(0x7f0000000700)={&(0x7f00000006c0)={0x2c, r3, 0x1, 0x70bd2c, 0x25dfdbfe, {}, [@SEG6_ATTR_SECRET={0x8, 0x4, [0x1]}, @SEG6_ATTR_DSTLEN={0x8, 0x2, 0x5}, @SEG6_ATTR_DSTLEN={0x8}]}, 0x2c}, 0x1, 0x0, 0x0, 0x4000000}, 0x4000000) r4 = pidfd_getfd(r1, r2, 0x0) setsockopt$inet_tcp_TCP_CONGESTION(r4, 0x6, 0xd, &(0x7f0000000780)='westwood\x00', 0x9) r5 = syz_genetlink_get_family_id$ieee802154(&(0x7f0000000800), 0xffffffffffffffff) sendmsg$IEEE802154_LLSEC_DEL_DEV(0xffffffffffffffff, &(0x7f00000008c0)={&(0x7f00000007c0)={0x10, 0x0, 0x0, 0x40000}, 0xc, &(0x7f0000000880)={&(0x7f0000000840)={0x20, r5, 0x10, 0x70bd27, 0x25dfdbfe, {}, [@IEEE802154_ATTR_DEV_NAME={0xa, 0x1, 'wpan4\x00'}]}, 0x20}, 0x1, 0x0, 0x0, 0x4048044}, 0x811) 17:44:25 executing program 6: r0 = perf_event_open(&(0x7f00000000c0)={0x1, 0x80, 0x0, 0xc0, 0xfa, 0x1, 0x0, 0x7fffffff, 0x10811, 0x1, 0x1, 0x1, 0x1, 0x1, 0x1, 0x1, 0x1, 0x1, 0x0, 0x1, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x1, 0x0, 0x1, 0x0, 0x0, 0x0, 0x1, 0x1, 0x1, 0x1, 0x1, 0x1, 0x1, 0x0, 0x1, 0x1, 0x1, 0x1, 0x0, 0x0, 0xfff, 0x7, @perf_config_ext={0x7, 0x7fffffff}, 0x41000, 0x80000000, 0x5, 0x3, 0x9, 0x2, 0x9, 0x0, 0x5, 0x0, 0x4}, 0x0, 0xb, 0xffffffffffffffff, 0x1) perf_event_open(&(0x7f0000000040)={0x0, 0x80, 0x0, 0x40, 0x80, 0x9, 0x0, 0x3, 0x10040, 0x1, 0x0, 0x0, 0x1, 0x1, 0x1, 0x1, 0x1, 0x1, 0x1, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x3, 0x1, 0x0, 0x1, 0x0, 0x1, 0x1, 0x0, 0x0, 0x1, 0x1, 0x1, 0x0, 0x1, 0x0, 0x0, 0x0, 0x1, 0x0, 0x1, 0x0, 0x1, 0x0, 0x0, 0x1, @perf_bp={&(0x7f0000000000), 0x10}, 0x8080, 0x800, 0x2, 0x3, 0x36dc, 0x31df3b33, 0xff, 0x0, 0x9, 0x0, 0x5}, 0xffffffffffffffff, 0x9, r0, 0x9) ioctl$PERF_EVENT_IOC_PAUSE_OUTPUT(r0, 0x40042409, 0x0) ioctl$PERF_EVENT_IOC_PERIOD(0xffffffffffffffff, 0x40082404, &(0x7f0000000140)=0x8) r1 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl$sock_ipv4_tunnel_SIOCADDTUNNEL(r1, 0x89f1, &(0x7f00000001c0)={'syztnl1\x00', &(0x7f0000000180)={'syztnl0\x00', 0x0, 0x1, 0x40, 0x0, 0x5, {{0x5, 0x4, 0x2, 0x19, 0x14, 0x65, 0x0, 0x1f, 0x4, 0x0, @multicast2, @remote}}}}) ioctl$PERF_EVENT_IOC_PERIOD(r0, 0x40082404, &(0x7f0000000200)=0x9) ioctl$SNDRV_SEQ_IOCTL_GET_PORT_INFO(0xffffffffffffffff, 0xc0a85322, &(0x7f0000000240)) ioctl$SNDRV_SEQ_IOCTL_SYSTEM_INFO(0xffffffffffffffff, 0xc0305302, &(0x7f0000000300)={0x9, 0x101, 0x1, 0x6, 0x3, 0x5}) r2 = syz_open_procfs(0x0, &(0x7f0000000340)='children\x00') openat$cgroup_type(r2, &(0x7f0000000380), 0x2, 0x0) ioctl$EVIOCGABS20(r2, 0x80184560, &(0x7f00000003c0)=""/4096) socket$inet6_tcp(0xa, 0x1, 0x0) r3 = openat$nvram(0xffffffffffffff9c, &(0x7f00000013c0), 0xdd0e52fd5a017ff5, 0x0) mmap$perf(&(0x7f0000ffe000/0x2000)=nil, 0x2000, 0x2000001, 0x10, r3, 0x4) r4 = openat$vcsu(0xffffffffffffff9c, &(0x7f0000001400), 0x280103, 0x0) ioctl$SNDRV_SEQ_IOCTL_QUERY_NEXT_PORT(r4, 0xc0a85352, &(0x7f0000001440)={{0x20, 0x1}, 'port1\x00', 0x88, 0x22, 0x7, 0x5, 0x1000000, 0x2, 0x10000, 0x0, 0x5, 0xf0}) r5 = pidfd_getfd(r3, r3, 0x0) write$cgroup_type(r5, &(0x7f0000001500), 0x9) ioctl$PERF_EVENT_IOC_PERIOD(r2, 0x40082404, &(0x7f0000001540)=0x2) 17:44:25 executing program 2: prctl$PR_MPX_ENABLE_MANAGEMENT(0x2b) r0 = socket$inet(0x2, 0x5, 0x4) r1 = openat$vcsu(0xffffffffffffff9c, &(0x7f0000000000), 0x3c1480, 0x0) ioctl$sock_ipv4_tunnel_SIOCGETTUNNEL(r1, 0x89f0, &(0x7f00000000c0)={'syztnl2\x00', &(0x7f0000000040)={'erspan0\x00', 0x0, 0x700, 0x40, 0x3, 0x22, {{0x15, 0x4, 0x3, 0x17, 0x54, 0x64, 0x0, 0x1, 0x2f, 0x0, @broadcast, @dev={0xac, 0x14, 0x14, 0x36}, {[@cipso={0x86, 0x3d, 0x1, [{0x5, 0x9, "c8a7bec58c2c80"}, {0x0, 0x9, "fabb6c2e64ba82"}, {0x7, 0xf, "6b1b69e07efcb7230cc07a2cf7"}, {0x1, 0x6, "a2118bdb"}, {0x5, 0x10, "67115d3e7766231c7b08cf3c48e4"}]}]}}}}}) prctl$PR_MPX_ENABLE_MANAGEMENT(0x2b) r2 = openat$vcsa(0xffffffffffffff9c, &(0x7f0000000100), 0x202c0, 0x0) ioctl$SNDRV_SEQ_IOCTL_GET_QUEUE_TEMPO(r2, 0xc02c5341, &(0x7f0000000140)) ioctl$SNDRV_TIMER_IOCTL_SELECT(r1, 0x40345410, &(0x7f00000001c0)={{0x0, 0x2, 0x3f, 0x3, 0x80000001}}) ioctl$SNDRV_SEQ_IOCTL_GET_QUEUE_TEMPO(r1, 0xc02c5341, &(0x7f0000000200)) ioctl$sock_inet_tcp_SIOCOUTQ(r0, 0x5411, &(0x7f0000000280)) r3 = syz_open_dev$evdev(&(0x7f00000002c0), 0x1, 0x50000) ioctl$EVIOCGLED(r3, 0x80404519, &(0x7f0000000300)=""/21) seccomp$SECCOMP_GET_NOTIF_SIZES(0x3, 0x0, &(0x7f0000000340)) ioctl$SNDRV_TIMER_IOCTL_NEXT_DEVICE(r2, 0xc0145401, &(0x7f0000000380)={0x3, 0x2, 0x8, 0x2, 0x733}) munlock(&(0x7f0000ff9000/0x4000)=nil, 0x4000) getsockopt$inet_tcp_buf(r1, 0x6, 0x1a, &(0x7f00000003c0)=""/1, &(0x7f0000000400)=0x1) ioctl$SNDRV_SEQ_IOCTL_GET_QUEUE_INFO(r2, 0xc08c5334, &(0x7f0000000440)={0x0, 0x80, 0x0, 'queue0\x00', 0x8}) r4 = syz_open_procfs(0x0, &(0x7f0000000500)='schedstat\x00') ioctl$SNDRV_TIMER_IOCTL_PVERSION(r4, 0x80045400, &(0x7f0000000540)) sendmsg$SEG6_CMD_DUMPHMAC(r1, &(0x7f0000000640)={&(0x7f0000000580)={0x10, 0x0, 0x0, 0x40000000}, 0xc, &(0x7f0000000600)={&(0x7f00000005c0)={0x24, 0x0, 0x100, 0x70bd2c, 0x25dfdbfc, {}, [@SEG6_ATTR_HMACKEYID={0x8, 0x3, 0x8}, @SEG6_ATTR_DSTLEN={0x8, 0x2, 0x8}]}, 0x24}}, 0x20008080) 17:44:25 executing program 7: r0 = perf_event_open(&(0x7f0000000040)={0x4, 0x80, 0x6f, 0x8, 0x8, 0x1, 0x0, 0x6, 0x4, 0x1, 0x1, 0x0, 0x0, 0x1, 0x1, 0x1, 0x0, 0x0, 0x1, 0x0, 0x0, 0x1, 0x1, 0x0, 0x0, 0x2, 0x1, 0x0, 0x0, 0x1, 0x0, 0x0, 0x1, 0x0, 0x1, 0x0, 0x0, 0x0, 0x1, 0x1, 0x1, 0x0, 0x1, 0x1, 0x1, 0x0, 0x1, 0x0, 0x50, 0x2, @perf_bp={&(0x7f0000000000), 0xa}, 0x2100, 0x7, 0x1, 0x3, 0x6, 0x93d3, 0x0, 0x0, 0x3a, 0x0, 0x9}, 0xffffffffffffffff, 0xc, 0xffffffffffffffff, 0x8) mmap$perf(&(0x7f0000ffb000/0x2000)=nil, 0x2000, 0xb, 0x11, r0, 0x8) munmap(&(0x7f0000ffb000/0x3000)=nil, 0x3000) getsockopt$inet6_tcp_TCP_ZEROCOPY_RECEIVE(0xffffffffffffffff, 0x6, 0x23, &(0x7f0000001180)={&(0x7f0000ffd000/0x2000)=nil, 0x2000, 0x0, 0x0, 0x0, &(0x7f00000000c0)=""/162, 0xa2, 0x0, &(0x7f0000000180)=""/4096, 0x1000}, &(0x7f00000011c0)=0x40) r1 = openat$vcsa(0xffffffffffffff9c, &(0x7f0000001200), 0x14d080, 0x0) ioctl$SNDRV_SEQ_IOCTL_SUBSCRIBE_PORT(r1, 0x40505330, &(0x7f0000001240)={{0x3f, 0x40}, {0x9, 0x2}, 0x43, 0x0, 0x1}) r2 = mmap$binder(&(0x7f0000ffc000/0x1000)=nil, 0x1000, 0x1, 0x11, r1, 0x81) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000001380)={0x44, 0x0, &(0x7f00000012c0)=[@acquire={0x40046305, 0x3}, @increfs, @free_buffer={0x40086303, r2}, @exit_looper, @request_death={0x400c630e, 0x3}, @increfs={0x40046304, 0x2}, @free_buffer], 0x1d, 0x0, &(0x7f0000001340)="63170b84a45d435cf194bbb38c0432388cb6578156ee80dc59b93c914c"}) r3 = openat$vcsa(0xffffffffffffff9c, &(0x7f00000013c0), 0x400000, 0x0) ioctl$SNDRV_SEQ_IOCTL_GET_SUBSCRIPTION(r3, 0xc0505350, &(0x7f0000001400)={{0x1, 0x6}, {0x1f, 0x81}, 0x4, 0x3, 0x7}) r4 = openat$nvram(0xffffffffffffff9c, &(0x7f0000001480), 0x105500, 0x0) mmap$IORING_OFF_SQ_RING(&(0x7f0000ffd000/0x1000)=nil, 0x1000, 0x0, 0x13, r4, 0x0) munmap(&(0x7f0000ffc000/0x2000)=nil, 0x2000) setsockopt$inet_tcp_TLS_TX(r3, 0x6, 0x1, &(0x7f00000014c0)=@gcm_128={{0x304}, "c7158b5e86708544", "366c7e9fd1d7fe2728acf2d3b734f3db", "b710fe41", "ad55c6ad971e7ae7"}, 0x28) mlock(&(0x7f0000ffd000/0x1000)=nil, 0x1000) ioctl$SECCOMP_IOCTL_NOTIF_RECV(r3, 0xc0502100, &(0x7f0000001500)={0x0, 0x0}) move_pages(r5, 0x2, &(0x7f0000001580)=[&(0x7f0000ffd000/0x3000)=nil, &(0x7f0000ffd000/0x1000)=nil], &(0x7f00000015c0)=[0x2, 0x6, 0x3, 0x400], &(0x7f0000001600)=[0x0, 0x0, 0x0, 0x0, 0x0, 0x0], 0x1) r6 = openat$nvram(0xffffffffffffff9c, &(0x7f0000001640), 0x40000, 0x0) write$sndseq(r6, &(0x7f00000016c0)=[{0x2, 0x8, 0x80, 0x1, @time={0x40, 0x5}, {0x2, 0x8}, {0x3, 0x4}, @raw32={[0xffff8000, 0x9, 0xbd1]}}, {0x1f, 0x0, 0x0, 0x5, @time={0x3, 0x5}, {0x20}, {}, @addr={0x8b, 0xca}}, {0x4, 0x8, 0xff, 0x5f, @tick=0xffffffff, {0x9, 0x80}, {0x6, 0x3}, @control={0x40, 0x3, 0x105}}, {0x80, 0x1, 0x8c, 0x3, @tick=0x3, {0x1, 0x40}, {0x9, 0x41}, @raw8={"734e6b3936ff731b516b11c3"}}, {0x4, 0x5, 0x4, 0x0, @time={0x2, 0xb175}, {0x30, 0xff}, {0x1}, @ext={0x1f, &(0x7f0000001680)="3a491fb488d546f729c7689e94b5cdce0cb71c51082283a43f3327e29d0948"}}, {0x3, 0x14, 0x7, 0x8, @tick=0x1f, {0xf7, 0x1}, {0x3f, 0xff}, @control={0x81, 0x8, 0xffffffff}}], 0xa8) shmget(0x0, 0x1000, 0x200, &(0x7f0000ffd000/0x1000)=nil) 17:44:25 executing program 5: clock_gettime(0x5, &(0x7f0000000000)) clock_settime(0x2, &(0x7f0000000040)) sched_rr_get_interval(0xffffffffffffffff, &(0x7f0000000080)) sched_rr_get_interval(0x0, &(0x7f00000000c0)) sendmsg$NL802154_CMD_GET_SEC_KEY(0xffffffffffffffff, &(0x7f00000001c0)={&(0x7f0000000100)={0x10, 0x0, 0x0, 0x20000000}, 0xc, &(0x7f0000000180)={&(0x7f0000000140)={0x24, 0x0, 0x200, 0x70bd26, 0x25dfdbfe, {}, [@NL802154_ATTR_IFINDEX={0x8}, @NL802154_ATTR_IFINDEX={0x8}]}, 0x24}, 0x1, 0x0, 0x0, 0x4000000}, 0x181) clock_gettime(0x0, &(0x7f0000000200)) pipe2$9p(&(0x7f0000000240)={0xffffffffffffffff, 0xffffffffffffffff}, 0x800) r1 = syz_io_uring_setup(0x776a, &(0x7f0000000280)={0x0, 0x2728, 0x2, 0x1, 0x37c}, &(0x7f0000000000/0x3000)=nil, &(0x7f0000000000/0x400000)=nil, &(0x7f0000000300), &(0x7f0000000340)) ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, &(0x7f0000000540)={0x64, 0x0, &(0x7f0000000440)=[@transaction_sg={0x40486311, {0x1, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x50, 0x18, &(0x7f0000000380)={@fd={0x66642a85, 0x0, r0}, @fd={0x66642a85, 0x0, r1}, @fda={0x66646185, 0x0, 0x2, 0x36}}, &(0x7f0000000400)={0x0, 0x18, 0x30}}}, @request_death, @release={0x40046306, 0x1}], 0x7e, 0x0, &(0x7f00000004c0)="7685c519d1cbea63a1a8f022f8c0085baf770aa5d1fa9bfb1a5399fdb134953d619e962218bba650b68d6206fde39ff17760aa4bbcb62f6802c48e17294a17a3b768ab60bbae37aa37e33e24b09f6bdea37853f7ab2622451803788c9d172b7d71d6d87911129b8ef5cc9e0169404b09abfa991f3a7a3640686df445d387"}) pipe2$9p(&(0x7f0000000580), 0x800) ioctl$EVIOCGVERSION(0xffffffffffffffff, 0x80044501, &(0x7f00000005c0)=""/174) r2 = openat$nvram(0xffffffffffffff9c, &(0x7f0000000680), 0x400, 0x0) write$P9_RSTAT(r2, &(0x7f00000006c0)={0x3f, 0x7d, 0x1, {0x0, 0x38, 0x401, 0x8000, {0x80, 0x4, 0x1}, 0x2020000, 0x4, 0x60, 0x9, 0x1, '\x00', 0x2, '.-', 0x1, '\x00', 0x1, '\x00'}}, 0x3f) r3 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r4 = syz_genetlink_get_family_id$ieee802154(&(0x7f0000000740), 0xffffffffffffffff) sendmsg$IEEE802154_LLSEC_DEL_KEY(r3, &(0x7f0000000840)={&(0x7f0000000700)={0x10, 0x0, 0x0, 0x800000}, 0xc, &(0x7f0000000800)={&(0x7f0000000780)={0x54, r4, 0x800, 0x70bd27, 0x25dfdbfc, {}, [@IEEE802154_ATTR_LLSEC_KEY_SOURCE_SHORT={0x8, 0x2c, 0x5}, @IEEE802154_ATTR_LLSEC_KEY_SOURCE_EXTENDED={0xc, 0x2d, {0xaaaaaaaaaaaa0002}}, @IEEE802154_ATTR_PAN_ID={0x6, 0x6, 0x2}, @IEEE802154_ATTR_DEV_INDEX={0x8}, @IEEE802154_ATTR_LLSEC_KEY_MODE={0x5, 0x2b, 0x1}, @IEEE802154_ATTR_HW_ADDR={0xc, 0x5, {0xaaaaaaaaaaaa0002}}, @IEEE802154_ATTR_LLSEC_KEY_MODE={0x5, 0x2b, 0x3}]}, 0x54}, 0x1, 0x0, 0x0, 0x40}, 0x2000c814) clock_getres(0x3, &(0x7f0000000880)) clock_getres(0x6, &(0x7f00000008c0)) r5 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) sendmsg$IEEE802154_ADD_IFACE(r5, &(0x7f0000000a00)={&(0x7f0000000900)={0x10, 0x0, 0x0, 0x40c}, 0xc, &(0x7f00000009c0)={&(0x7f0000000940)={0x44, r4, 0x200, 0x70bd29, 0x25dfdbfe, {}, [@IEEE802154_ATTR_PHY_NAME={0x9, 0x1f, 'phy1\x00'}, @IEEE802154_ATTR_DEV_NAME={0xa, 0x1, 'wpan4\x00'}, @IEEE802154_ATTR_DEV_NAME={0xa, 0x1, 'wpan1\x00'}, @IEEE802154_ATTR_DEV_NAME={0xa, 0x1, 'wpan0\x00'}]}, 0x44}, 0x1, 0x0, 0x0, 0x20000084}, 0x44000) 17:44:25 executing program 4: ioctl$SNDRV_TIMER_IOCTL_TREAD(0xffffffffffffffff, 0x40045402, &(0x7f0000000000)) wait4(0xffffffffffffffff, &(0x7f0000000040), 0x1, &(0x7f0000000080)) waitid$P_PIDFD(0x3, 0xffffffffffffffff, &(0x7f0000000140), 0x40000002, &(0x7f00000001c0)) shmget$private(0x0, 0x3000, 0x20, &(0x7f0000ffa000/0x3000)=nil) sendmsg$SEG6_CMD_SETHMAC(0xffffffffffffffff, &(0x7f0000000380)={&(0x7f0000000280)={0x10, 0x0, 0x0, 0x2}, 0xc, &(0x7f0000000340)={&(0x7f00000002c0)={0x48, 0x0, 0x10, 0x70bd25, 0x25dfdbff, {}, [@SEG6_ATTR_ALGID={0x5, 0x6, 0x4}, @SEG6_ATTR_ALGID={0x5, 0x6, 0x20}, @SEG6_ATTR_ALGID={0x5, 0x6, 0x8}, @SEG6_ATTR_HMACKEYID={0x8, 0x3, 0x1}, @SEG6_ATTR_SECRETLEN={0x5, 0x5, 0x5}, @SEG6_ATTR_SECRET={0x4}, @SEG6_ATTR_DSTLEN={0x8, 0x2, 0x1f}]}, 0x48}}, 0x0) r0 = openat$vcsa(0xffffffffffffff9c, &(0x7f00000003c0), 0x48000, 0x0) ioctl$SNDRV_TIMER_IOCTL_START(r0, 0x54a0) r1 = syz_open_procfs(0x0, &(0x7f0000000400)='smaps_rollup\x00') ioctl$EVIOCSREP(r1, 0x40084503, &(0x7f0000000440)=[0x8, 0x7ff]) socket$inet_udp(0x2, 0x2, 0x0) socket$inet6_tcp(0xa, 0x1, 0x0) r2 = openat$vcsu(0xffffffffffffff9c, &(0x7f0000000480), 0x0, 0x0) process_mrelease(r2, 0x0) shmget(0x1, 0x3000, 0x20, &(0x7f0000ffc000/0x3000)=nil) 17:44:25 executing program 7: r0 = perf_event_open(&(0x7f0000000040)={0x4, 0x80, 0x6f, 0x8, 0x8, 0x1, 0x0, 0x6, 0x4, 0x1, 0x1, 0x0, 0x0, 0x1, 0x1, 0x1, 0x0, 0x0, 0x1, 0x0, 0x0, 0x1, 0x1, 0x0, 0x0, 0x2, 0x1, 0x0, 0x0, 0x1, 0x0, 0x0, 0x1, 0x0, 0x1, 0x0, 0x0, 0x0, 0x1, 0x1, 0x1, 0x0, 0x1, 0x1, 0x1, 0x0, 0x1, 0x0, 0x50, 0x2, @perf_bp={&(0x7f0000000000), 0xa}, 0x2100, 0x7, 0x1, 0x3, 0x6, 0x93d3, 0x0, 0x0, 0x3a, 0x0, 0x9}, 0xffffffffffffffff, 0xc, 0xffffffffffffffff, 0x8) mmap$perf(&(0x7f0000ffb000/0x2000)=nil, 0x2000, 0xb, 0x11, r0, 0x8) munmap(&(0x7f0000ffb000/0x3000)=nil, 0x3000) getsockopt$inet6_tcp_TCP_ZEROCOPY_RECEIVE(0xffffffffffffffff, 0x6, 0x23, &(0x7f0000001180)={&(0x7f0000ffd000/0x2000)=nil, 0x2000, 0x0, 0x0, 0x0, &(0x7f00000000c0)=""/162, 0xa2, 0x0, &(0x7f0000000180)=""/4096, 0x1000}, &(0x7f00000011c0)=0x40) r1 = openat$vcsa(0xffffffffffffff9c, &(0x7f0000001200), 0x14d080, 0x0) ioctl$SNDRV_SEQ_IOCTL_SUBSCRIBE_PORT(r1, 0x40505330, &(0x7f0000001240)={{0x3f, 0x40}, {0x9, 0x2}, 0x43, 0x0, 0x1}) r2 = mmap$binder(&(0x7f0000ffc000/0x1000)=nil, 0x1000, 0x1, 0x11, r1, 0x81) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000001380)={0x44, 0x0, &(0x7f00000012c0)=[@acquire={0x40046305, 0x3}, @increfs, @free_buffer={0x40086303, r2}, @exit_looper, @request_death={0x400c630e, 0x3}, @increfs={0x40046304, 0x2}, @free_buffer], 0x1d, 0x0, &(0x7f0000001340)="63170b84a45d435cf194bbb38c0432388cb6578156ee80dc59b93c914c"}) r3 = openat$vcsa(0xffffffffffffff9c, &(0x7f00000013c0), 0x400000, 0x0) ioctl$SNDRV_SEQ_IOCTL_GET_SUBSCRIPTION(r3, 0xc0505350, &(0x7f0000001400)={{0x1, 0x6}, {0x1f, 0x81}, 0x4, 0x3, 0x7}) r4 = openat$nvram(0xffffffffffffff9c, &(0x7f0000001480), 0x105500, 0x0) mmap$IORING_OFF_SQ_RING(&(0x7f0000ffd000/0x1000)=nil, 0x1000, 0x0, 0x13, r4, 0x0) munmap(&(0x7f0000ffc000/0x2000)=nil, 0x2000) setsockopt$inet_tcp_TLS_TX(r3, 0x6, 0x1, &(0x7f00000014c0)=@gcm_128={{0x304}, "c7158b5e86708544", "366c7e9fd1d7fe2728acf2d3b734f3db", "b710fe41", "ad55c6ad971e7ae7"}, 0x28) mlock(&(0x7f0000ffd000/0x1000)=nil, 0x1000) ioctl$SECCOMP_IOCTL_NOTIF_RECV(r3, 0xc0502100, &(0x7f0000001500)={0x0, 0x0}) move_pages(r5, 0x2, &(0x7f0000001580)=[&(0x7f0000ffd000/0x3000)=nil, &(0x7f0000ffd000/0x1000)=nil], &(0x7f00000015c0)=[0x2, 0x6, 0x3, 0x400], &(0x7f0000001600)=[0x0, 0x0, 0x0, 0x0, 0x0, 0x0], 0x1) r6 = openat$nvram(0xffffffffffffff9c, &(0x7f0000001640), 0x40000, 0x0) write$sndseq(r6, &(0x7f00000016c0)=[{0x2, 0x8, 0x80, 0x1, @time={0x40, 0x5}, {0x2, 0x8}, {0x3, 0x4}, @raw32={[0xffff8000, 0x9, 0xbd1]}}, {0x1f, 0x0, 0x0, 0x5, @time={0x3, 0x5}, {0x20}, {}, @addr={0x8b, 0xca}}, {0x4, 0x8, 0xff, 0x5f, @tick=0xffffffff, {0x9, 0x80}, {0x6, 0x3}, @control={0x40, 0x3, 0x105}}, {0x80, 0x1, 0x8c, 0x3, @tick=0x3, {0x1, 0x40}, {0x9, 0x41}, @raw8={"734e6b3936ff731b516b11c3"}}, {0x4, 0x5, 0x4, 0x0, @time={0x2, 0xb175}, {0x30, 0xff}, {0x1}, @ext={0x1f, &(0x7f0000001680)="3a491fb488d546f729c7689e94b5cdce0cb71c51082283a43f3327e29d0948"}}, {0x3, 0x14, 0x7, 0x8, @tick=0x1f, {0xf7, 0x1}, {0x3f, 0xff}, @control={0x81, 0x8, 0xffffffff}}], 0xa8) shmget(0x0, 0x1000, 0x200, &(0x7f0000ffd000/0x1000)=nil) 17:44:25 executing program 4: ioctl$SNDRV_TIMER_IOCTL_TREAD(0xffffffffffffffff, 0x40045402, &(0x7f0000000000)) wait4(0xffffffffffffffff, &(0x7f0000000040), 0x1, &(0x7f0000000080)) waitid$P_PIDFD(0x3, 0xffffffffffffffff, &(0x7f0000000140), 0x40000002, &(0x7f00000001c0)) shmget$private(0x0, 0x3000, 0x20, &(0x7f0000ffa000/0x3000)=nil) sendmsg$SEG6_CMD_SETHMAC(0xffffffffffffffff, &(0x7f0000000380)={&(0x7f0000000280)={0x10, 0x0, 0x0, 0x2}, 0xc, &(0x7f0000000340)={&(0x7f00000002c0)={0x48, 0x0, 0x10, 0x70bd25, 0x25dfdbff, {}, [@SEG6_ATTR_ALGID={0x5, 0x6, 0x4}, @SEG6_ATTR_ALGID={0x5, 0x6, 0x20}, @SEG6_ATTR_ALGID={0x5, 0x6, 0x8}, @SEG6_ATTR_HMACKEYID={0x8, 0x3, 0x1}, @SEG6_ATTR_SECRETLEN={0x5, 0x5, 0x5}, @SEG6_ATTR_SECRET={0x4}, @SEG6_ATTR_DSTLEN={0x8, 0x2, 0x1f}]}, 0x48}}, 0x0) r0 = openat$vcsa(0xffffffffffffff9c, &(0x7f00000003c0), 0x48000, 0x0) ioctl$SNDRV_TIMER_IOCTL_START(r0, 0x54a0) r1 = syz_open_procfs(0x0, &(0x7f0000000400)='smaps_rollup\x00') ioctl$EVIOCSREP(r1, 0x40084503, &(0x7f0000000440)=[0x8, 0x7ff]) socket$inet_udp(0x2, 0x2, 0x0) socket$inet6_tcp(0xa, 0x1, 0x0) openat$vcsu(0xffffffffffffff9c, &(0x7f0000000480), 0x0, 0x0) shmget(0x1, 0x3000, 0x20, &(0x7f0000ffc000/0x3000)=nil) 17:44:36 executing program 3: getsockopt$inet_udp_int(0xffffffffffffffff, 0x11, 0x1, &(0x7f0000000000), &(0x7f0000000040)=0x4) setsockopt$inet_udp_int(0xffffffffffffffff, 0x11, 0x1, &(0x7f0000000080)=0x7, 0x4) ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, &(0x7f0000000240)={0x54, 0x0, &(0x7f00000000c0)=[@acquire_done={0x40106309, 0x1}, @free_buffer, @request_death={0x400c630e, 0x1}, @request_death, @decrefs, @dead_binder_done], 0xc7, 0x0, &(0x7f0000000140)="aa36e0fef6a6cd3a6060f434b2a2306a435d6c33ca3bfb20c9d046886ded10cf23d0938b55b8a812702a5a7579cb8813f0cf3954f24fa081e8c35a9d4674b51115d91e7f6e38920909a8fba27ba7bbb0522974a9d83826c23d40a56c3f88dc24276a8312ae50d15d3531211e4378a34980ea70ac3cefef2439af0baa6b387df4ff26b593ca52e94dda8ce3656a81180693ab97746e30b1301f30922ec565bba820fc06168927e446c06efe1fc7cb37b804ba0342e58e70da81c074407ec9cf690a9ab1e3a62a68"}) r0 = openat$vcsa(0xffffffffffffff9c, &(0x7f0000000280), 0x1, 0x0) r1 = openat$vcsa(0xffffffffffffff9c, &(0x7f00000002c0), 0x80, 0x0) ioctl$SNDRV_SEQ_IOCTL_QUERY_NEXT_PORT(r0, 0xc0a85352, &(0x7f0000000300)={{0x4, 0x6}, 'port0\x00', 0x5, 0x1, 0x0, 0xffff, 0x7, 0x7, 0x5, 0x0, 0x2, 0xc0}) ioctl$SNDRV_SEQ_IOCTL_QUERY_NEXT_CLIENT(r1, 0xc0bc5351, &(0x7f00000003c0)={0xffff7fff, 0x0, 'client0\x00', 0xffffffff80000002, "9aa89fbb0e155330", "7e3a03465d7350a6322e39e7997e8c634c3224eb46d1223d24ed4ce35c7b1dd2", 0x0, 0x6}) r2 = openat$nvram(0xffffffffffffff9c, &(0x7f0000000480), 0x1, 0x0) ioctl$PERF_EVENT_IOC_PAUSE_OUTPUT(r2, 0x40042409, 0x0) process_mrelease(r0, 0x0) ioctl$SNDRV_TIMER_IOCTL_TREAD(r1, 0x40045402, &(0x7f00000004c0)) r3 = socket$inet_udp(0x2, 0x2, 0x0) ioctl$sock_inet_udp_SIOCINQ(r3, 0x541b, &(0x7f0000000500)) getsockopt$inet_IP_IPSEC_POLICY(r0, 0x0, 0x10, &(0x7f0000000540)={{{@in=@broadcast, @in6=@mcast1}}, {{@in=@broadcast}, 0x0, @in6=@mcast2}}, &(0x7f0000000640)=0xe8) setsockopt$inet_udp_encap(r1, 0x11, 0x64, &(0x7f0000000680)=0x3, 0x4) r4 = syz_open_procfs(0xffffffffffffffff, &(0x7f00000006c0)='net/packet\x00') pidfd_getfd(r4, 0xffffffffffffffff, 0x0) r5 = openat$nvram(0xffffffffffffff9c, &(0x7f0000000700), 0x800, 0x0) ioctl$SECCOMP_IOCTL_NOTIF_RECV(r2, 0xc0502100, &(0x7f0000000740)={0x0, 0x0}) write$P9_RGETLOCK(r5, &(0x7f00000007c0)={0x1e, 0x37, 0x2, {0x2, 0x6, 0x101, r6}}, 0x1e) 17:44:36 executing program 2: prctl$PR_MPX_ENABLE_MANAGEMENT(0x2b) r0 = socket$inet(0x2, 0x5, 0x4) r1 = openat$vcsu(0xffffffffffffff9c, &(0x7f0000000000), 0x3c1480, 0x0) ioctl$sock_ipv4_tunnel_SIOCGETTUNNEL(r1, 0x89f0, &(0x7f00000000c0)={'syztnl2\x00', &(0x7f0000000040)={'erspan0\x00', 0x0, 0x700, 0x40, 0x3, 0x22, {{0x15, 0x4, 0x3, 0x17, 0x54, 0x64, 0x0, 0x1, 0x2f, 0x0, @broadcast, @dev={0xac, 0x14, 0x14, 0x36}, {[@cipso={0x86, 0x3d, 0x1, [{0x5, 0x9, "c8a7bec58c2c80"}, {0x0, 0x9, "fabb6c2e64ba82"}, {0x7, 0xf, "6b1b69e07efcb7230cc07a2cf7"}, {0x1, 0x6, "a2118bdb"}, {0x5, 0x10, "67115d3e7766231c7b08cf3c48e4"}]}]}}}}}) prctl$PR_MPX_ENABLE_MANAGEMENT(0x2b) r2 = openat$vcsa(0xffffffffffffff9c, &(0x7f0000000100), 0x202c0, 0x0) ioctl$SNDRV_SEQ_IOCTL_GET_QUEUE_TEMPO(r2, 0xc02c5341, &(0x7f0000000140)) ioctl$SNDRV_TIMER_IOCTL_SELECT(r1, 0x40345410, &(0x7f00000001c0)={{0x0, 0x2, 0x3f, 0x3, 0x80000001}}) ioctl$SNDRV_SEQ_IOCTL_GET_QUEUE_TEMPO(r1, 0xc02c5341, &(0x7f0000000200)) ioctl$sock_inet_tcp_SIOCOUTQ(r0, 0x5411, &(0x7f0000000280)) r3 = syz_open_dev$evdev(&(0x7f00000002c0), 0x1, 0x50000) ioctl$EVIOCGLED(r3, 0x80404519, &(0x7f0000000300)=""/21) seccomp$SECCOMP_GET_NOTIF_SIZES(0x3, 0x0, &(0x7f0000000340)) ioctl$SNDRV_TIMER_IOCTL_NEXT_DEVICE(r2, 0xc0145401, &(0x7f0000000380)={0x3, 0x2, 0x8, 0x2, 0x733}) munlock(&(0x7f0000ff9000/0x4000)=nil, 0x4000) getsockopt$inet_tcp_buf(r1, 0x6, 0x1a, &(0x7f00000003c0)=""/1, &(0x7f0000000400)=0x1) ioctl$SNDRV_SEQ_IOCTL_GET_QUEUE_INFO(r2, 0xc08c5334, &(0x7f0000000440)={0x0, 0x80, 0x0, 'queue0\x00', 0x8}) r4 = syz_open_procfs(0x0, &(0x7f0000000500)='schedstat\x00') ioctl$SNDRV_TIMER_IOCTL_PVERSION(r4, 0x80045400, &(0x7f0000000540)) sendmsg$SEG6_CMD_DUMPHMAC(r1, &(0x7f0000000640)={&(0x7f0000000580)={0x10, 0x0, 0x0, 0x40000000}, 0xc, &(0x7f0000000600)={&(0x7f00000005c0)={0x24, 0x0, 0x100, 0x70bd2c, 0x25dfdbfc, {}, [@SEG6_ATTR_HMACKEYID={0x8, 0x3, 0x8}, @SEG6_ATTR_DSTLEN={0x8, 0x2, 0x8}]}, 0x24}}, 0x20008080) 17:44:36 executing program 0: get_thread_area(&(0x7f0000000000)={0x7, 0x20000800, 0x4000, 0x0, 0x1, 0x0, 0x0, 0x1, 0x1, 0x1}) r0 = openat$vcsu(0xffffffffffffff9c, &(0x7f0000000040), 0x200000, 0x0) getsockopt$inet_tcp_TCP_REPAIR_WINDOW(r0, 0x6, 0x1d, &(0x7f0000000080), &(0x7f00000000c0)=0x14) r1 = openat$nvram(0xffffffffffffff9c, &(0x7f0000000100), 0x2000, 0x0) setsockopt$inet_tcp_TCP_FASTOPEN_KEY(r1, 0x6, 0x21, &(0x7f0000000140)="1bb9d563048b6ec78effc0f14d974b17", 0x10) setsockopt$inet_tcp_int(r1, 0x6, 0x1b, &(0x7f0000000180)=0x5, 0x4) ioctl$SNDRV_TIMER_IOCTL_STATUS32(r1, 0x80585414, &(0x7f00000001c0)) setsockopt$inet_tcp_TCP_QUEUE_SEQ(r0, 0x6, 0x15, &(0x7f0000000240)=0x1, 0x4) getsockopt$inet_tcp_TCP_ZEROCOPY_RECEIVE(r1, 0x6, 0x23, &(0x7f0000000340)={&(0x7f0000ffc000/0x2000)=nil, 0x2000, 0x0, 0x0, 0x0, &(0x7f0000000280)=""/37, 0x25, 0x1, &(0x7f00000002c0)=""/109, 0x6d}, &(0x7f0000000380)=0x40) r2 = socket$inet_tcp(0x2, 0x1, 0x0) ioctl$sock_inet_tcp_SIOCINQ(r2, 0x541b, &(0x7f00000003c0)) move_pages(0x0, 0x8, &(0x7f0000000400)=[&(0x7f0000ffd000/0x1000)=nil, &(0x7f0000ffd000/0x3000)=nil, &(0x7f0000ffd000/0x3000)=nil, &(0x7f0000ffb000/0x2000)=nil, &(0x7f0000ffc000/0x1000)=nil, &(0x7f0000ffe000/0x2000)=nil, &(0x7f0000ffb000/0x4000)=nil, &(0x7f0000ffd000/0x3000)=nil], &(0x7f0000000440)=[0xfff], &(0x7f0000000480)=[0x0, 0x0, 0x0], 0x4) r3 = syz_genetlink_get_family_id$SEG6(&(0x7f0000000500), r1) sendmsg$SEG6_CMD_GET_TUNSRC(r0, &(0x7f00000005c0)={&(0x7f00000004c0)={0x10, 0x0, 0x0, 0x4000000}, 0xc, &(0x7f0000000580)={&(0x7f0000000540)={0x38, r3, 0x300, 0x70bd2a, 0x25dfdbfc, {}, [@SEG6_ATTR_HMACKEYID={0x8, 0x3, 0x24}, @SEG6_ATTR_DST={0x14, 0x1, @mcast1}, @SEG6_ATTR_DSTLEN={0x8, 0x2, 0x2}]}, 0x38}, 0x1, 0x0, 0x0, 0x20008810}, 0x4040010) ioctl$SNDRV_SEQ_IOCTL_SET_QUEUE_TIMER(r1, 0x40605346, &(0x7f0000000600)={0x80, 0x1, {0x1, 0x0, 0x81}, 0x2}) sendmsg$SEG6_CMD_DUMPHMAC(0xffffffffffffffff, &(0x7f0000000740)={&(0x7f0000000680)={0x10, 0x0, 0x0, 0x240000}, 0xc, &(0x7f0000000700)={&(0x7f00000006c0)={0x2c, r3, 0x1, 0x70bd2c, 0x25dfdbfe, {}, [@SEG6_ATTR_SECRET={0x8, 0x4, [0x1]}, @SEG6_ATTR_DSTLEN={0x8, 0x2, 0x5}, @SEG6_ATTR_DSTLEN={0x8}]}, 0x2c}, 0x1, 0x0, 0x0, 0x4000000}, 0x4000000) r4 = pidfd_getfd(r1, r2, 0x0) setsockopt$inet_tcp_TCP_CONGESTION(r4, 0x6, 0xd, &(0x7f0000000780)='westwood\x00', 0x9) r5 = syz_genetlink_get_family_id$ieee802154(&(0x7f0000000800), 0xffffffffffffffff) sendmsg$IEEE802154_LLSEC_DEL_DEV(0xffffffffffffffff, &(0x7f00000008c0)={&(0x7f00000007c0)={0x10, 0x0, 0x0, 0x40000}, 0xc, &(0x7f0000000880)={&(0x7f0000000840)={0x20, r5, 0x10, 0x70bd27, 0x25dfdbfe, {}, [@IEEE802154_ATTR_DEV_NAME={0xa, 0x1, 'wpan4\x00'}]}, 0x20}, 0x1, 0x0, 0x0, 0x4048044}, 0x811) 17:44:36 executing program 6: r0 = perf_event_open(&(0x7f00000000c0)={0x1, 0x80, 0x0, 0xc0, 0xfa, 0x1, 0x0, 0x7fffffff, 0x10811, 0x1, 0x1, 0x1, 0x1, 0x1, 0x1, 0x1, 0x1, 0x1, 0x0, 0x1, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x1, 0x0, 0x1, 0x0, 0x0, 0x0, 0x1, 0x1, 0x1, 0x1, 0x1, 0x1, 0x1, 0x0, 0x1, 0x1, 0x1, 0x1, 0x0, 0x0, 0xfff, 0x7, @perf_config_ext={0x7, 0x7fffffff}, 0x41000, 0x80000000, 0x5, 0x3, 0x9, 0x2, 0x9, 0x0, 0x5, 0x0, 0x4}, 0x0, 0xb, 0xffffffffffffffff, 0x1) perf_event_open(&(0x7f0000000040)={0x0, 0x80, 0x0, 0x40, 0x80, 0x9, 0x0, 0x3, 0x10040, 0x1, 0x0, 0x0, 0x1, 0x1, 0x1, 0x1, 0x1, 0x1, 0x1, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x3, 0x1, 0x0, 0x1, 0x0, 0x1, 0x1, 0x0, 0x0, 0x1, 0x1, 0x1, 0x0, 0x1, 0x0, 0x0, 0x0, 0x1, 0x0, 0x1, 0x0, 0x1, 0x0, 0x0, 0x1, @perf_bp={&(0x7f0000000000), 0x10}, 0x8080, 0x800, 0x2, 0x3, 0x36dc, 0x31df3b33, 0xff, 0x0, 0x9, 0x0, 0x5}, 0xffffffffffffffff, 0x9, r0, 0x9) ioctl$PERF_EVENT_IOC_PAUSE_OUTPUT(r0, 0x40042409, 0x0) ioctl$PERF_EVENT_IOC_PERIOD(0xffffffffffffffff, 0x40082404, &(0x7f0000000140)=0x8) r1 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl$sock_ipv4_tunnel_SIOCADDTUNNEL(r1, 0x89f1, &(0x7f00000001c0)={'syztnl1\x00', &(0x7f0000000180)={'syztnl0\x00', 0x0, 0x1, 0x40, 0x0, 0x5, {{0x5, 0x4, 0x2, 0x19, 0x14, 0x65, 0x0, 0x1f, 0x4, 0x0, @multicast2, @remote}}}}) ioctl$PERF_EVENT_IOC_PERIOD(r0, 0x40082404, &(0x7f0000000200)=0x9) ioctl$SNDRV_SEQ_IOCTL_GET_PORT_INFO(0xffffffffffffffff, 0xc0a85322, &(0x7f0000000240)) ioctl$SNDRV_SEQ_IOCTL_SYSTEM_INFO(0xffffffffffffffff, 0xc0305302, &(0x7f0000000300)={0x9, 0x101, 0x1, 0x6, 0x3, 0x5}) r2 = syz_open_procfs(0x0, &(0x7f0000000340)='children\x00') openat$cgroup_type(r2, &(0x7f0000000380), 0x2, 0x0) ioctl$EVIOCGABS20(r2, 0x80184560, &(0x7f00000003c0)=""/4096) socket$inet6_tcp(0xa, 0x1, 0x0) r3 = openat$nvram(0xffffffffffffff9c, &(0x7f00000013c0), 0xdd0e52fd5a017ff5, 0x0) mmap$perf(&(0x7f0000ffe000/0x2000)=nil, 0x2000, 0x2000001, 0x10, r3, 0x4) r4 = openat$vcsu(0xffffffffffffff9c, &(0x7f0000001400), 0x280103, 0x0) ioctl$SNDRV_SEQ_IOCTL_QUERY_NEXT_PORT(r4, 0xc0a85352, &(0x7f0000001440)={{0x20, 0x1}, 'port1\x00', 0x88, 0x22, 0x7, 0x5, 0x1000000, 0x2, 0x10000, 0x0, 0x5, 0xf0}) r5 = pidfd_getfd(r3, r3, 0x0) write$cgroup_type(r5, &(0x7f0000001500), 0x9) ioctl$PERF_EVENT_IOC_PERIOD(r2, 0x40082404, &(0x7f0000001540)=0x2) 17:44:36 executing program 5: clock_gettime(0x5, &(0x7f0000000000)) clock_settime(0x2, &(0x7f0000000040)) sched_rr_get_interval(0xffffffffffffffff, &(0x7f0000000080)) sched_rr_get_interval(0x0, &(0x7f00000000c0)) sendmsg$NL802154_CMD_GET_SEC_KEY(0xffffffffffffffff, &(0x7f00000001c0)={&(0x7f0000000100)={0x10, 0x0, 0x0, 0x20000000}, 0xc, &(0x7f0000000180)={&(0x7f0000000140)={0x24, 0x0, 0x200, 0x70bd26, 0x25dfdbfe, {}, [@NL802154_ATTR_IFINDEX={0x8}, @NL802154_ATTR_IFINDEX={0x8}]}, 0x24}, 0x1, 0x0, 0x0, 0x4000000}, 0x181) clock_gettime(0x0, &(0x7f0000000200)) pipe2$9p(&(0x7f0000000240)={0xffffffffffffffff, 0xffffffffffffffff}, 0x800) r1 = syz_io_uring_setup(0x776a, &(0x7f0000000280)={0x0, 0x2728, 0x2, 0x1, 0x37c}, &(0x7f0000000000/0x3000)=nil, &(0x7f0000000000/0x400000)=nil, &(0x7f0000000300), &(0x7f0000000340)) ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, &(0x7f0000000540)={0x64, 0x0, &(0x7f0000000440)=[@transaction_sg={0x40486311, {0x1, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x50, 0x18, &(0x7f0000000380)={@fd={0x66642a85, 0x0, r0}, @fd={0x66642a85, 0x0, r1}, @fda={0x66646185, 0x0, 0x2, 0x36}}, &(0x7f0000000400)={0x0, 0x18, 0x30}}}, @request_death, @release={0x40046306, 0x1}], 0x7e, 0x0, &(0x7f00000004c0)="7685c519d1cbea63a1a8f022f8c0085baf770aa5d1fa9bfb1a5399fdb134953d619e962218bba650b68d6206fde39ff17760aa4bbcb62f6802c48e17294a17a3b768ab60bbae37aa37e33e24b09f6bdea37853f7ab2622451803788c9d172b7d71d6d87911129b8ef5cc9e0169404b09abfa991f3a7a3640686df445d387"}) pipe2$9p(&(0x7f0000000580), 0x800) ioctl$EVIOCGVERSION(0xffffffffffffffff, 0x80044501, &(0x7f00000005c0)=""/174) r2 = openat$nvram(0xffffffffffffff9c, &(0x7f0000000680), 0x400, 0x0) write$P9_RSTAT(r2, &(0x7f00000006c0)={0x3f, 0x7d, 0x1, {0x0, 0x38, 0x401, 0x8000, {0x80, 0x4, 0x1}, 0x2020000, 0x4, 0x60, 0x9, 0x1, '\x00', 0x2, '.-', 0x1, '\x00', 0x1, '\x00'}}, 0x3f) r3 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r4 = syz_genetlink_get_family_id$ieee802154(&(0x7f0000000740), 0xffffffffffffffff) sendmsg$IEEE802154_LLSEC_DEL_KEY(r3, &(0x7f0000000840)={&(0x7f0000000700)={0x10, 0x0, 0x0, 0x800000}, 0xc, &(0x7f0000000800)={&(0x7f0000000780)={0x54, r4, 0x800, 0x70bd27, 0x25dfdbfc, {}, [@IEEE802154_ATTR_LLSEC_KEY_SOURCE_SHORT={0x8, 0x2c, 0x5}, @IEEE802154_ATTR_LLSEC_KEY_SOURCE_EXTENDED={0xc, 0x2d, {0xaaaaaaaaaaaa0002}}, @IEEE802154_ATTR_PAN_ID={0x6, 0x6, 0x2}, @IEEE802154_ATTR_DEV_INDEX={0x8}, @IEEE802154_ATTR_LLSEC_KEY_MODE={0x5, 0x2b, 0x1}, @IEEE802154_ATTR_HW_ADDR={0xc, 0x5, {0xaaaaaaaaaaaa0002}}, @IEEE802154_ATTR_LLSEC_KEY_MODE={0x5, 0x2b, 0x3}]}, 0x54}, 0x1, 0x0, 0x0, 0x40}, 0x2000c814) clock_getres(0x3, &(0x7f0000000880)) clock_getres(0x6, &(0x7f00000008c0)) r5 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) sendmsg$IEEE802154_ADD_IFACE(r5, &(0x7f0000000a00)={&(0x7f0000000900)={0x10, 0x0, 0x0, 0x40c}, 0xc, &(0x7f00000009c0)={&(0x7f0000000940)={0x44, r4, 0x200, 0x70bd29, 0x25dfdbfe, {}, [@IEEE802154_ATTR_PHY_NAME={0x9, 0x1f, 'phy1\x00'}, @IEEE802154_ATTR_DEV_NAME={0xa, 0x1, 'wpan4\x00'}, @IEEE802154_ATTR_DEV_NAME={0xa, 0x1, 'wpan1\x00'}, @IEEE802154_ATTR_DEV_NAME={0xa, 0x1, 'wpan0\x00'}]}, 0x44}, 0x1, 0x0, 0x0, 0x20000084}, 0x44000) 17:44:36 executing program 4: ioctl$SNDRV_TIMER_IOCTL_TREAD(0xffffffffffffffff, 0x40045402, &(0x7f0000000000)) wait4(0xffffffffffffffff, &(0x7f0000000040), 0x1, &(0x7f0000000080)) waitid$P_PIDFD(0x3, 0xffffffffffffffff, &(0x7f0000000140), 0x40000002, &(0x7f00000001c0)) shmget$private(0x0, 0x3000, 0x20, &(0x7f0000ffa000/0x3000)=nil) sendmsg$SEG6_CMD_SETHMAC(0xffffffffffffffff, &(0x7f0000000380)={&(0x7f0000000280)={0x10, 0x0, 0x0, 0x2}, 0xc, &(0x7f0000000340)={&(0x7f00000002c0)={0x48, 0x0, 0x10, 0x70bd25, 0x25dfdbff, {}, [@SEG6_ATTR_ALGID={0x5, 0x6, 0x4}, @SEG6_ATTR_ALGID={0x5, 0x6, 0x20}, @SEG6_ATTR_ALGID={0x5, 0x6, 0x8}, @SEG6_ATTR_HMACKEYID={0x8, 0x3, 0x1}, @SEG6_ATTR_SECRETLEN={0x5, 0x5, 0x5}, @SEG6_ATTR_SECRET={0x4}, @SEG6_ATTR_DSTLEN={0x8, 0x2, 0x1f}]}, 0x48}}, 0x0) r0 = openat$vcsa(0xffffffffffffff9c, &(0x7f00000003c0), 0x48000, 0x0) ioctl$SNDRV_TIMER_IOCTL_START(r0, 0x54a0) r1 = syz_open_procfs(0x0, &(0x7f0000000400)='smaps_rollup\x00') ioctl$EVIOCSREP(r1, 0x40084503, &(0x7f0000000440)=[0x8, 0x7ff]) socket$inet_udp(0x2, 0x2, 0x0) socket$inet6_tcp(0xa, 0x1, 0x0) shmget(0x1, 0x3000, 0x20, &(0x7f0000ffc000/0x3000)=nil) 17:44:36 executing program 7: r0 = perf_event_open(&(0x7f0000000040)={0x4, 0x80, 0x6f, 0x8, 0x8, 0x1, 0x0, 0x6, 0x4, 0x1, 0x1, 0x0, 0x0, 0x1, 0x1, 0x1, 0x0, 0x0, 0x1, 0x0, 0x0, 0x1, 0x1, 0x0, 0x0, 0x2, 0x1, 0x0, 0x0, 0x1, 0x0, 0x0, 0x1, 0x0, 0x1, 0x0, 0x0, 0x0, 0x1, 0x1, 0x1, 0x0, 0x1, 0x1, 0x1, 0x0, 0x1, 0x0, 0x50, 0x2, @perf_bp={&(0x7f0000000000), 0xa}, 0x2100, 0x7, 0x1, 0x3, 0x6, 0x93d3, 0x0, 0x0, 0x3a, 0x0, 0x9}, 0xffffffffffffffff, 0xc, 0xffffffffffffffff, 0x8) mmap$perf(&(0x7f0000ffb000/0x2000)=nil, 0x2000, 0xb, 0x11, r0, 0x8) munmap(&(0x7f0000ffb000/0x3000)=nil, 0x3000) getsockopt$inet6_tcp_TCP_ZEROCOPY_RECEIVE(0xffffffffffffffff, 0x6, 0x23, &(0x7f0000001180)={&(0x7f0000ffd000/0x2000)=nil, 0x2000, 0x0, 0x0, 0x0, &(0x7f00000000c0)=""/162, 0xa2, 0x0, &(0x7f0000000180)=""/4096, 0x1000}, &(0x7f00000011c0)=0x40) r1 = openat$vcsa(0xffffffffffffff9c, &(0x7f0000001200), 0x14d080, 0x0) ioctl$SNDRV_SEQ_IOCTL_SUBSCRIBE_PORT(r1, 0x40505330, &(0x7f0000001240)={{0x3f, 0x40}, {0x9, 0x2}, 0x43, 0x0, 0x1}) r2 = mmap$binder(&(0x7f0000ffc000/0x1000)=nil, 0x1000, 0x1, 0x11, r1, 0x81) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000001380)={0x44, 0x0, &(0x7f00000012c0)=[@acquire={0x40046305, 0x3}, @increfs, @free_buffer={0x40086303, r2}, @exit_looper, @request_death={0x400c630e, 0x3}, @increfs={0x40046304, 0x2}, @free_buffer], 0x1d, 0x0, &(0x7f0000001340)="63170b84a45d435cf194bbb38c0432388cb6578156ee80dc59b93c914c"}) r3 = openat$vcsa(0xffffffffffffff9c, &(0x7f00000013c0), 0x400000, 0x0) ioctl$SNDRV_SEQ_IOCTL_GET_SUBSCRIPTION(r3, 0xc0505350, &(0x7f0000001400)={{0x1, 0x6}, {0x1f, 0x81}, 0x4, 0x3, 0x7}) r4 = openat$nvram(0xffffffffffffff9c, &(0x7f0000001480), 0x105500, 0x0) mmap$IORING_OFF_SQ_RING(&(0x7f0000ffd000/0x1000)=nil, 0x1000, 0x0, 0x13, r4, 0x0) munmap(&(0x7f0000ffc000/0x2000)=nil, 0x2000) setsockopt$inet_tcp_TLS_TX(r3, 0x6, 0x1, &(0x7f00000014c0)=@gcm_128={{0x304}, "c7158b5e86708544", "366c7e9fd1d7fe2728acf2d3b734f3db", "b710fe41", "ad55c6ad971e7ae7"}, 0x28) mlock(&(0x7f0000ffd000/0x1000)=nil, 0x1000) ioctl$SECCOMP_IOCTL_NOTIF_RECV(r3, 0xc0502100, &(0x7f0000001500)={0x0, 0x0}) move_pages(r5, 0x2, &(0x7f0000001580)=[&(0x7f0000ffd000/0x3000)=nil, &(0x7f0000ffd000/0x1000)=nil], &(0x7f00000015c0)=[0x2, 0x6, 0x3, 0x400], &(0x7f0000001600)=[0x0, 0x0, 0x0, 0x0, 0x0, 0x0], 0x1) r6 = openat$nvram(0xffffffffffffff9c, &(0x7f0000001640), 0x40000, 0x0) write$sndseq(r6, &(0x7f00000016c0)=[{0x2, 0x8, 0x80, 0x1, @time={0x40, 0x5}, {0x2, 0x8}, {0x3, 0x4}, @raw32={[0xffff8000, 0x9, 0xbd1]}}, {0x1f, 0x0, 0x0, 0x5, @time={0x3, 0x5}, {0x20}, {}, @addr={0x8b, 0xca}}, {0x4, 0x8, 0xff, 0x5f, @tick=0xffffffff, {0x9, 0x80}, {0x6, 0x3}, @control={0x40, 0x3, 0x105}}, {0x80, 0x1, 0x8c, 0x3, @tick=0x3, {0x1, 0x40}, {0x9, 0x41}, @raw8={"734e6b3936ff731b516b11c3"}}, {0x4, 0x5, 0x4, 0x0, @time={0x2, 0xb175}, {0x30, 0xff}, {0x1}, @ext={0x1f, &(0x7f0000001680)="3a491fb488d546f729c7689e94b5cdce0cb71c51082283a43f3327e29d0948"}}, {0x3, 0x14, 0x7, 0x8, @tick=0x1f, {0xf7, 0x1}, {0x3f, 0xff}, @control={0x81, 0x8, 0xffffffff}}], 0xa8) shmget(0x0, 0x1000, 0x200, &(0x7f0000ffd000/0x1000)=nil) 17:44:36 executing program 1: shmget$private(0x0, 0x4000, 0x80, &(0x7f0000ffb000/0x4000)=nil) shmget(0x3, 0x2000, 0x4, &(0x7f0000ffc000/0x2000)=nil) mlock(&(0x7f0000ff0000/0x10000)=nil, 0x10000) shmget(0x1, 0x1000, 0x10, &(0x7f0000ff5000/0x1000)=nil) ioctl$sock_ipv4_tunnel_SIOCGETTUNNEL(0xffffffffffffffff, 0x89f0, &(0x7f0000000140)={'syztnl1\x00', &(0x7f00000000c0)={'syztnl2\x00', 0x0, 0x20, 0x1, 0x6, 0x9, {{0xd, 0x4, 0x1, 0x19, 0x34, 0x68, 0x0, 0x9, 0x29, 0x0, @empty, @dev={0xac, 0x14, 0x14, 0x29}, {[@timestamp_addr={0x44, 0x14, 0xc2, 0x1, 0x4, [{@multicast1}, {@private=0xa010101}]}, @rr={0x7, 0xb, 0xc8, [@initdev={0xac, 0x1e, 0x1, 0x0}, @private=0xa010102]}]}}}}}) ioctl$sock_ipv4_tunnel_SIOCADDTUNNEL(0xffffffffffffffff, 0x89f1, &(0x7f0000000280)={'tunl0\x00', &(0x7f0000000180)={'tunl0\x00', r0, 0x7, 0x8000, 0xfffffffc, 0x8, {{0x2f, 0x4, 0x0, 0x2, 0xbc, 0x65, 0x0, 0x0, 0x4, 0x0, @empty, @broadcast, {[@generic={0x89, 0x9, "8db1d464c6af68"}, @noop, @ra={0x94, 0x4, 0x1}, @timestamp={0x44, 0x1c, 0x53, 0x0, 0x7, [0x40, 0x7fffffff, 0xfffffffd, 0x5, 0x5c, 0x77]}, @cipso={0x86, 0x2f, 0x3, [{0x1, 0x4, "1eba"}, {0x1, 0x7, "e3ccb5ddcf"}, {0x6, 0xa, "5db18b961780af33"}, {0x2, 0xe, "7353a9824b57fd7d39232ac5"}, {0x1, 0x6, "2e1ccd27"}]}, @noop, @cipso={0x86, 0x37, 0xffffffffffffffff, [{0x2, 0xf, "227467028cabd4e137b820c5c9"}, {0x7, 0x6, "90569992"}, {0x2, 0xc, "2071b0a8c9ce92782e72"}, {0x6, 0xa, "14f2b9bca55ce3dd"}, {0x6, 0x6, "2cd22a8f"}]}, @timestamp={0x44, 0x14, 0xd4, 0x0, 0x5, [0x81, 0x5d23, 0x63ab, 0x1]}]}}}}}) ioctl$sock_ipv4_tunnel_SIOCDELTUNNEL(0xffffffffffffffff, 0x89f2, &(0x7f0000000380)={'gretap0\x00', &(0x7f00000002c0)={'syztnl2\x00', 0x0, 0x7800, 0x7, 0x40, 0xe180, {{0x22, 0x4, 0x0, 0x1, 0x88, 0x64, 0x0, 0x1, 0x29, 0x0, @multicast2, @multicast1, {[@end, @lsrr={0x83, 0x1f, 0x2f, [@multicast2, @local, @local, @multicast1, @rand_addr=0x64010102, @loopback, @private=0xa010100]}, @rr={0x7, 0x27, 0x6c, [@multicast1, @rand_addr=0x64010102, @remote, @multicast1, @loopback, @initdev={0xac, 0x1e, 0x0, 0x0}, @initdev={0xac, 0x1e, 0x1, 0x0}, @broadcast, @empty]}, @ra={0x94, 0x4, 0x1}, @timestamp={0x44, 0x10, 0x2d, 0x0, 0x8, [0x1, 0x100, 0x401]}, @ssrr={0x89, 0x13, 0x56, [@dev={0xac, 0x14, 0x14, 0x28}, @multicast2, @initdev={0xac, 0x1e, 0x0, 0x0}, @remote]}, @ra={0x94, 0x4, 0x1}]}}}}}) shmget(0x3, 0x4000, 0x4, &(0x7f0000ff9000/0x4000)=nil) mmap$IORING_OFF_CQ_RING(&(0x7f0000ffd000/0x3000)=nil, 0x3000, 0x2000008, 0x30, 0xffffffffffffffff, 0x8000000) r1 = syz_genetlink_get_family_id$nl802154(&(0x7f0000000400), 0xffffffffffffffff) ioctl$sock_SIOCGIFINDEX_802154(0xffffffffffffffff, 0x8933, &(0x7f0000000440)={'wpan1\x00', 0x0}) sendmsg$NL802154_CMD_NEW_INTERFACE(0xffffffffffffffff, &(0x7f0000000540)={&(0x7f00000003c0)={0x10, 0x0, 0x0, 0x2}, 0xc, &(0x7f0000000500)={&(0x7f0000000480)={0x48, r1, 0x200, 0x70bd2a, 0x25dfdbfd, {}, [@NL802154_ATTR_IFNAME={0xa, 0x4, 'wpan0\x00'}, @NL802154_ATTR_IFINDEX={0x8}, @NL802154_ATTR_IFNAME={0xa, 0x4, 'wpan1\x00'}, @NL802154_ATTR_EXTENDED_ADDR={0xc, 0x17, {0xaaaaaaaaaaaa0002}}, @NL802154_ATTR_IFINDEX={0x8, 0x3, r2}]}, 0x48}}, 0x4001) mmap$binder(&(0x7f0000fef000/0x11000)=nil, 0x11000, 0x1, 0x11, 0xffffffffffffffff, 0x6) shmget$private(0x0, 0x4000, 0x200, &(0x7f0000ffc000/0x4000)=nil) r3 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) ioctl$sock_SIOCGIFINDEX_802154(0xffffffffffffffff, 0x8933, &(0x7f00000005c0)={'wpan0\x00', 0x0}) sendmsg$IEEE802154_LLSEC_ADD_SECLEVEL(r3, &(0x7f00000006c0)={&(0x7f0000000580)={0x10, 0x0, 0x0, 0x4000000}, 0xc, &(0x7f0000000680)={&(0x7f0000000600)={0x44, 0x0, 0x200, 0x70bd2a, 0x25dfdbff, {}, [@IEEE802154_ATTR_LLSEC_FRAME_TYPE={0x5, 0x33, 0x34}, @IEEE802154_ATTR_DEV_INDEX={0x8, 0x2, r4}, @IEEE802154_ATTR_LLSEC_CMD_FRAME_ID={0x5, 0x34, 0x1}, @IEEE802154_ATTR_DEV_NAME={0xa, 0x1, 'wpan0\x00'}, @IEEE802154_ATTR_DEV_NAME={0xa, 0x1, 'wpan4\x00'}]}, 0x44}, 0x1, 0x0, 0x0, 0x8800}, 0x0) sendmsg$IEEE802154_START_REQ(r3, &(0x7f00000007c0)={&(0x7f0000000700)={0x10, 0x0, 0x0, 0x4}, 0xc, &(0x7f0000000780)={&(0x7f0000000740)={0x1c, 0x0, 0x200, 0x70bd2d, 0x25dfdbfb, {}, [@IEEE802154_ATTR_CHANNEL={0x5, 0x7, 0x6}]}, 0x1c}, 0x1, 0x0, 0x0, 0x40100}, 0x801) mlock(&(0x7f0000fef000/0x1000)=nil, 0x1000) syz_io_uring_setup(0x4726, &(0x7f0000000840)={0x0, 0x502f, 0x20, 0x0, 0x12e}, &(0x7f0000ffe000/0x2000)=nil, &(0x7f0000ffb000/0x4000)=nil, &(0x7f00000008c0), &(0x7f0000000900)) [ 132.803604] kmemleak: Found object by alias at 0x607f1a62a634 17:44:36 executing program 4: ioctl$SNDRV_TIMER_IOCTL_TREAD(0xffffffffffffffff, 0x40045402, &(0x7f0000000000)) wait4(0xffffffffffffffff, &(0x7f0000000040), 0x1, &(0x7f0000000080)) waitid$P_PIDFD(0x3, 0xffffffffffffffff, &(0x7f0000000140), 0x40000002, &(0x7f00000001c0)) shmget$private(0x0, 0x3000, 0x20, &(0x7f0000ffa000/0x3000)=nil) sendmsg$SEG6_CMD_SETHMAC(0xffffffffffffffff, &(0x7f0000000380)={&(0x7f0000000280)={0x10, 0x0, 0x0, 0x2}, 0xc, &(0x7f0000000340)={&(0x7f00000002c0)={0x48, 0x0, 0x10, 0x70bd25, 0x25dfdbff, {}, [@SEG6_ATTR_ALGID={0x5, 0x6, 0x4}, @SEG6_ATTR_ALGID={0x5, 0x6, 0x20}, @SEG6_ATTR_ALGID={0x5, 0x6, 0x8}, @SEG6_ATTR_HMACKEYID={0x8, 0x3, 0x1}, @SEG6_ATTR_SECRETLEN={0x5, 0x5, 0x5}, @SEG6_ATTR_SECRET={0x4}, @SEG6_ATTR_DSTLEN={0x8, 0x2, 0x1f}]}, 0x48}}, 0x0) r0 = openat$vcsa(0xffffffffffffff9c, &(0x7f00000003c0), 0x48000, 0x0) ioctl$SNDRV_TIMER_IOCTL_START(r0, 0x54a0) r1 = syz_open_procfs(0x0, &(0x7f0000000400)='smaps_rollup\x00') ioctl$EVIOCSREP(r1, 0x40084503, &(0x7f0000000440)=[0x8, 0x7ff]) socket$inet_udp(0x2, 0x2, 0x0) shmget(0x1, 0x3000, 0x20, &(0x7f0000ffc000/0x3000)=nil) [ 132.803635] CPU: 0 UID: 0 PID: 3981 Comm: syz-executor.7 Tainted: G W 6.17.0-rc3-next-20250829 #1 PREEMPT(voluntary) [ 132.803664] Tainted: [W]=WARN [ 132.803670] Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.12.0-1 04/01/2014 [ 132.803682] Call Trace: [ 132.803688] [ 132.803695] dump_stack_lvl+0xca/0x120 [ 132.803732] __lookup_object+0x94/0xb0 [ 132.803757] delete_object_full+0x27/0x70 [ 132.803783] free_percpu+0x30/0x1160 [ 132.803808] ? arch_uprobe_clear_state+0x16/0x140 [ 132.803840] futex_hash_free+0x38/0xc0 [ 132.803867] mmput+0x2d3/0x390 [ 132.803897] do_exit+0x79d/0x2970 [ 132.803918] ? lock_release+0xc8/0x290 [ 132.803944] ? __pfx_do_exit+0x10/0x10 [ 132.803967] ? find_held_lock+0x2b/0x80 [ 132.803994] ? get_signal+0x835/0x2340 [ 132.804026] do_group_exit+0xd3/0x2a0 [ 132.804049] get_signal+0x2315/0x2340 [ 132.804085] ? __pfx_get_signal+0x10/0x10 [ 132.804111] ? do_futex+0x135/0x370 [ 132.804133] ? __pfx_do_futex+0x10/0x10 [ 132.804157] arch_do_signal_or_restart+0x80/0x790 [ 132.804185] ? __pfx_arch_do_signal_or_restart+0x10/0x10 [ 132.804210] ? __x64_sys_futex+0x1c9/0x4d0 [ 132.804230] ? __x64_sys_futex+0x1d2/0x4d0 [ 132.804254] ? __pfx___x64_sys_futex+0x10/0x10 [ 132.804275] ? __x64_sys_shmget+0x13b/0x1b0 [ 132.804299] ? __pfx___x64_sys_shmget+0x10/0x10 [ 132.804327] exit_to_user_mode_loop+0x8b/0x110 [ 132.804347] do_syscall_64+0x2f7/0x360 [ 132.804365] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 132.804384] RIP: 0033:0x7f8e7f8bbb19 [ 132.804399] Code: Unable to access opcode bytes at 0x7f8e7f8bbaef. [ 132.804407] RSP: 002b:00007f8e7ce31218 EFLAGS: 00000246 ORIG_RAX: 00000000000000ca [ 132.804425] RAX: fffffffffffffe00 RBX: 00007f8e7f9cef68 RCX: 00007f8e7f8bbb19 [ 132.804438] RDX: 0000000000000000 RSI: 0000000000000080 RDI: 00007f8e7f9cef68 [ 132.804449] RBP: 00007f8e7f9cef60 R08: 0000000000000000 R09: 0000000000000000 [ 132.804460] R10: 0000000000000000 R11: 0000000000000246 R12: 00007f8e7f9cef6c [ 132.804471] R13: 00007fff562de65f R14: 00007f8e7ce31300 R15: 0000000000022000 [ 132.804496] [ 132.804502] kmemleak: Object (percpu) 0x607f1a62a630 (size 8): [ 132.804513] kmemleak: comm "syz-executor.5", pid 3974, jiffies 4294799535 [ 132.804525] kmemleak: min_count = 1 [ 132.804531] kmemleak: count = 0 [ 132.804536] kmemleak: flags = 0x21 [ 132.804542] kmemleak: checksum = 0 [ 132.804548] kmemleak: backtrace: [ 132.804554] pcpu_alloc_noprof+0x87a/0x1170 [ 132.804577] percpu_ref_init+0x37/0x400 [ 132.804605] io_uring_setup+0x44c/0x2000 [ 132.804623] __x64_sys_io_uring_setup+0xc8/0x170 [ 132.804640] do_syscall_64+0xbf/0x360 [ 132.804654] entry_SYSCALL_64_after_hwframe+0x77/0x7f 17:44:36 executing program 6: r0 = perf_event_open(&(0x7f00000000c0)={0x1, 0x80, 0x0, 0xc0, 0xfa, 0x1, 0x0, 0x7fffffff, 0x10811, 0x1, 0x1, 0x1, 0x1, 0x1, 0x1, 0x1, 0x1, 0x1, 0x0, 0x1, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x1, 0x0, 0x1, 0x0, 0x0, 0x0, 0x1, 0x1, 0x1, 0x1, 0x1, 0x1, 0x1, 0x0, 0x1, 0x1, 0x1, 0x1, 0x0, 0x0, 0xfff, 0x7, @perf_config_ext={0x7, 0x7fffffff}, 0x41000, 0x80000000, 0x5, 0x3, 0x9, 0x2, 0x9, 0x0, 0x5, 0x0, 0x4}, 0x0, 0xb, 0xffffffffffffffff, 0x1) perf_event_open(&(0x7f0000000040)={0x0, 0x80, 0x0, 0x40, 0x80, 0x9, 0x0, 0x3, 0x10040, 0x1, 0x0, 0x0, 0x1, 0x1, 0x1, 0x1, 0x1, 0x1, 0x1, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x3, 0x1, 0x0, 0x1, 0x0, 0x1, 0x1, 0x0, 0x0, 0x1, 0x1, 0x1, 0x0, 0x1, 0x0, 0x0, 0x0, 0x1, 0x0, 0x1, 0x0, 0x1, 0x0, 0x0, 0x1, @perf_bp={&(0x7f0000000000), 0x10}, 0x8080, 0x800, 0x2, 0x3, 0x36dc, 0x31df3b33, 0xff, 0x0, 0x9, 0x0, 0x5}, 0xffffffffffffffff, 0x9, r0, 0x9) ioctl$PERF_EVENT_IOC_PAUSE_OUTPUT(r0, 0x40042409, 0x0) ioctl$PERF_EVENT_IOC_PERIOD(0xffffffffffffffff, 0x40082404, &(0x7f0000000140)=0x8) r1 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl$sock_ipv4_tunnel_SIOCADDTUNNEL(r1, 0x89f1, &(0x7f00000001c0)={'syztnl1\x00', &(0x7f0000000180)={'syztnl0\x00', 0x0, 0x1, 0x40, 0x0, 0x5, {{0x5, 0x4, 0x2, 0x19, 0x14, 0x65, 0x0, 0x1f, 0x4, 0x0, @multicast2, @remote}}}}) ioctl$PERF_EVENT_IOC_PERIOD(r0, 0x40082404, &(0x7f0000000200)=0x9) ioctl$SNDRV_SEQ_IOCTL_GET_PORT_INFO(0xffffffffffffffff, 0xc0a85322, &(0x7f0000000240)) ioctl$SNDRV_SEQ_IOCTL_SYSTEM_INFO(0xffffffffffffffff, 0xc0305302, &(0x7f0000000300)={0x9, 0x101, 0x1, 0x6, 0x3, 0x5}) r2 = syz_open_procfs(0x0, &(0x7f0000000340)='children\x00') openat$cgroup_type(r2, &(0x7f0000000380), 0x2, 0x0) ioctl$EVIOCGABS20(r2, 0x80184560, &(0x7f00000003c0)=""/4096) socket$inet6_tcp(0xa, 0x1, 0x0) r3 = openat$nvram(0xffffffffffffff9c, &(0x7f00000013c0), 0xdd0e52fd5a017ff5, 0x0) mmap$perf(&(0x7f0000ffe000/0x2000)=nil, 0x2000, 0x2000001, 0x10, r3, 0x4) r4 = openat$vcsu(0xffffffffffffff9c, &(0x7f0000001400), 0x280103, 0x0) ioctl$SNDRV_SEQ_IOCTL_QUERY_NEXT_PORT(r4, 0xc0a85352, &(0x7f0000001440)={{0x20, 0x1}, 'port1\x00', 0x88, 0x22, 0x7, 0x5, 0x1000000, 0x2, 0x10000, 0x0, 0x5, 0xf0}) r5 = pidfd_getfd(r3, r3, 0x0) write$cgroup_type(r5, &(0x7f0000001500), 0x9) ioctl$PERF_EVENT_IOC_PERIOD(r2, 0x40082404, &(0x7f0000001540)=0x2) 17:44:36 executing program 3: getsockopt$inet_udp_int(0xffffffffffffffff, 0x11, 0x1, &(0x7f0000000000), &(0x7f0000000040)=0x4) setsockopt$inet_udp_int(0xffffffffffffffff, 0x11, 0x1, &(0x7f0000000080)=0x7, 0x4) ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, &(0x7f0000000240)={0x54, 0x0, &(0x7f00000000c0)=[@acquire_done={0x40106309, 0x1}, @free_buffer, @request_death={0x400c630e, 0x1}, @request_death, @decrefs, @dead_binder_done], 0xc7, 0x0, &(0x7f0000000140)="aa36e0fef6a6cd3a6060f434b2a2306a435d6c33ca3bfb20c9d046886ded10cf23d0938b55b8a812702a5a7579cb8813f0cf3954f24fa081e8c35a9d4674b51115d91e7f6e38920909a8fba27ba7bbb0522974a9d83826c23d40a56c3f88dc24276a8312ae50d15d3531211e4378a34980ea70ac3cefef2439af0baa6b387df4ff26b593ca52e94dda8ce3656a81180693ab97746e30b1301f30922ec565bba820fc06168927e446c06efe1fc7cb37b804ba0342e58e70da81c074407ec9cf690a9ab1e3a62a68"}) r0 = openat$vcsa(0xffffffffffffff9c, &(0x7f0000000280), 0x1, 0x0) r1 = openat$vcsa(0xffffffffffffff9c, &(0x7f00000002c0), 0x80, 0x0) ioctl$SNDRV_SEQ_IOCTL_QUERY_NEXT_PORT(r0, 0xc0a85352, &(0x7f0000000300)={{0x4, 0x6}, 'port0\x00', 0x5, 0x1, 0x0, 0xffff, 0x7, 0x7, 0x5, 0x0, 0x2, 0xc0}) ioctl$SNDRV_SEQ_IOCTL_QUERY_NEXT_CLIENT(r1, 0xc0bc5351, &(0x7f00000003c0)={0xffff7fff, 0x0, 'client0\x00', 0xffffffff80000002, "9aa89fbb0e155330", "7e3a03465d7350a6322e39e7997e8c634c3224eb46d1223d24ed4ce35c7b1dd2", 0x0, 0x6}) r2 = openat$nvram(0xffffffffffffff9c, &(0x7f0000000480), 0x1, 0x0) ioctl$PERF_EVENT_IOC_PAUSE_OUTPUT(r2, 0x40042409, 0x0) process_mrelease(r0, 0x0) ioctl$SNDRV_TIMER_IOCTL_TREAD(r1, 0x40045402, &(0x7f00000004c0)) r3 = socket$inet_udp(0x2, 0x2, 0x0) ioctl$sock_inet_udp_SIOCINQ(r3, 0x541b, &(0x7f0000000500)) getsockopt$inet_IP_IPSEC_POLICY(r0, 0x0, 0x10, &(0x7f0000000540)={{{@in=@broadcast, @in6=@mcast1}}, {{@in=@broadcast}, 0x0, @in6=@mcast2}}, &(0x7f0000000640)=0xe8) setsockopt$inet_udp_encap(r1, 0x11, 0x64, &(0x7f0000000680)=0x3, 0x4) r4 = syz_open_procfs(0xffffffffffffffff, &(0x7f00000006c0)='net/packet\x00') pidfd_getfd(r4, 0xffffffffffffffff, 0x0) r5 = openat$nvram(0xffffffffffffff9c, &(0x7f0000000700), 0x800, 0x0) ioctl$SECCOMP_IOCTL_NOTIF_RECV(r2, 0xc0502100, &(0x7f0000000740)={0x0, 0x0}) write$P9_RGETLOCK(r5, &(0x7f00000007c0)={0x1e, 0x37, 0x2, {0x2, 0x6, 0x101, r6}}, 0x1e) 17:44:36 executing program 0: get_thread_area(&(0x7f0000000000)={0x7, 0x20000800, 0x4000, 0x0, 0x1, 0x0, 0x0, 0x1, 0x1, 0x1}) r0 = openat$vcsu(0xffffffffffffff9c, &(0x7f0000000040), 0x200000, 0x0) getsockopt$inet_tcp_TCP_REPAIR_WINDOW(r0, 0x6, 0x1d, &(0x7f0000000080), &(0x7f00000000c0)=0x14) r1 = openat$nvram(0xffffffffffffff9c, &(0x7f0000000100), 0x2000, 0x0) setsockopt$inet_tcp_TCP_FASTOPEN_KEY(r1, 0x6, 0x21, &(0x7f0000000140)="1bb9d563048b6ec78effc0f14d974b17", 0x10) setsockopt$inet_tcp_int(r1, 0x6, 0x1b, &(0x7f0000000180)=0x5, 0x4) ioctl$SNDRV_TIMER_IOCTL_STATUS32(r1, 0x80585414, &(0x7f00000001c0)) setsockopt$inet_tcp_TCP_QUEUE_SEQ(r0, 0x6, 0x15, &(0x7f0000000240)=0x1, 0x4) getsockopt$inet_tcp_TCP_ZEROCOPY_RECEIVE(r1, 0x6, 0x23, &(0x7f0000000340)={&(0x7f0000ffc000/0x2000)=nil, 0x2000, 0x0, 0x0, 0x0, &(0x7f0000000280)=""/37, 0x25, 0x1, &(0x7f00000002c0)=""/109, 0x6d}, &(0x7f0000000380)=0x40) r2 = socket$inet_tcp(0x2, 0x1, 0x0) ioctl$sock_inet_tcp_SIOCINQ(r2, 0x541b, &(0x7f00000003c0)) move_pages(0x0, 0x8, &(0x7f0000000400)=[&(0x7f0000ffd000/0x1000)=nil, &(0x7f0000ffd000/0x3000)=nil, &(0x7f0000ffd000/0x3000)=nil, &(0x7f0000ffb000/0x2000)=nil, &(0x7f0000ffc000/0x1000)=nil, &(0x7f0000ffe000/0x2000)=nil, &(0x7f0000ffb000/0x4000)=nil, &(0x7f0000ffd000/0x3000)=nil], &(0x7f0000000440)=[0xfff], &(0x7f0000000480)=[0x0, 0x0, 0x0], 0x4) r3 = syz_genetlink_get_family_id$SEG6(&(0x7f0000000500), r1) sendmsg$SEG6_CMD_GET_TUNSRC(r0, &(0x7f00000005c0)={&(0x7f00000004c0)={0x10, 0x0, 0x0, 0x4000000}, 0xc, &(0x7f0000000580)={&(0x7f0000000540)={0x38, r3, 0x300, 0x70bd2a, 0x25dfdbfc, {}, [@SEG6_ATTR_HMACKEYID={0x8, 0x3, 0x24}, @SEG6_ATTR_DST={0x14, 0x1, @mcast1}, @SEG6_ATTR_DSTLEN={0x8, 0x2, 0x2}]}, 0x38}, 0x1, 0x0, 0x0, 0x20008810}, 0x4040010) ioctl$SNDRV_SEQ_IOCTL_SET_QUEUE_TIMER(r1, 0x40605346, &(0x7f0000000600)={0x80, 0x1, {0x1, 0x0, 0x81}, 0x2}) sendmsg$SEG6_CMD_DUMPHMAC(0xffffffffffffffff, &(0x7f0000000740)={&(0x7f0000000680)={0x10, 0x0, 0x0, 0x240000}, 0xc, &(0x7f0000000700)={&(0x7f00000006c0)={0x2c, r3, 0x1, 0x70bd2c, 0x25dfdbfe, {}, [@SEG6_ATTR_SECRET={0x8, 0x4, [0x1]}, @SEG6_ATTR_DSTLEN={0x8, 0x2, 0x5}, @SEG6_ATTR_DSTLEN={0x8}]}, 0x2c}, 0x1, 0x0, 0x0, 0x4000000}, 0x4000000) r4 = pidfd_getfd(r1, r2, 0x0) setsockopt$inet_tcp_TCP_CONGESTION(r4, 0x6, 0xd, &(0x7f0000000780)='westwood\x00', 0x9) r5 = syz_genetlink_get_family_id$ieee802154(&(0x7f0000000800), 0xffffffffffffffff) sendmsg$IEEE802154_LLSEC_DEL_DEV(0xffffffffffffffff, &(0x7f00000008c0)={&(0x7f00000007c0)={0x10, 0x0, 0x0, 0x40000}, 0xc, &(0x7f0000000880)={&(0x7f0000000840)={0x20, r5, 0x10, 0x70bd27, 0x25dfdbfe, {}, [@IEEE802154_ATTR_DEV_NAME={0xa, 0x1, 'wpan4\x00'}]}, 0x20}, 0x1, 0x0, 0x0, 0x4048044}, 0x811) 17:44:36 executing program 1: shmget$private(0x0, 0x4000, 0x80, &(0x7f0000ffb000/0x4000)=nil) shmget(0x3, 0x2000, 0x4, &(0x7f0000ffc000/0x2000)=nil) mlock(&(0x7f0000ff0000/0x10000)=nil, 0x10000) shmget(0x1, 0x1000, 0x10, &(0x7f0000ff5000/0x1000)=nil) ioctl$sock_ipv4_tunnel_SIOCGETTUNNEL(0xffffffffffffffff, 0x89f0, &(0x7f0000000140)={'syztnl1\x00', &(0x7f00000000c0)={'syztnl2\x00', 0x0, 0x20, 0x1, 0x6, 0x9, {{0xd, 0x4, 0x1, 0x19, 0x34, 0x68, 0x0, 0x9, 0x29, 0x0, @empty, @dev={0xac, 0x14, 0x14, 0x29}, {[@timestamp_addr={0x44, 0x14, 0xc2, 0x1, 0x4, [{@multicast1}, {@private=0xa010101}]}, @rr={0x7, 0xb, 0xc8, [@initdev={0xac, 0x1e, 0x1, 0x0}, @private=0xa010102]}]}}}}}) ioctl$sock_ipv4_tunnel_SIOCADDTUNNEL(0xffffffffffffffff, 0x89f1, &(0x7f0000000280)={'tunl0\x00', &(0x7f0000000180)={'tunl0\x00', r0, 0x7, 0x8000, 0xfffffffc, 0x8, {{0x2f, 0x4, 0x0, 0x2, 0xbc, 0x65, 0x0, 0x0, 0x4, 0x0, @empty, @broadcast, {[@generic={0x89, 0x9, "8db1d464c6af68"}, @noop, @ra={0x94, 0x4, 0x1}, @timestamp={0x44, 0x1c, 0x53, 0x0, 0x7, [0x40, 0x7fffffff, 0xfffffffd, 0x5, 0x5c, 0x77]}, @cipso={0x86, 0x2f, 0x3, [{0x1, 0x4, "1eba"}, {0x1, 0x7, "e3ccb5ddcf"}, {0x6, 0xa, "5db18b961780af33"}, {0x2, 0xe, "7353a9824b57fd7d39232ac5"}, {0x1, 0x6, "2e1ccd27"}]}, @noop, @cipso={0x86, 0x37, 0xffffffffffffffff, [{0x2, 0xf, "227467028cabd4e137b820c5c9"}, {0x7, 0x6, "90569992"}, {0x2, 0xc, "2071b0a8c9ce92782e72"}, {0x6, 0xa, "14f2b9bca55ce3dd"}, {0x6, 0x6, "2cd22a8f"}]}, @timestamp={0x44, 0x14, 0xd4, 0x0, 0x5, [0x81, 0x5d23, 0x63ab, 0x1]}]}}}}}) ioctl$sock_ipv4_tunnel_SIOCDELTUNNEL(0xffffffffffffffff, 0x89f2, &(0x7f0000000380)={'gretap0\x00', &(0x7f00000002c0)={'syztnl2\x00', 0x0, 0x7800, 0x7, 0x40, 0xe180, {{0x22, 0x4, 0x0, 0x1, 0x88, 0x64, 0x0, 0x1, 0x29, 0x0, @multicast2, @multicast1, {[@end, @lsrr={0x83, 0x1f, 0x2f, [@multicast2, @local, @local, @multicast1, @rand_addr=0x64010102, @loopback, @private=0xa010100]}, @rr={0x7, 0x27, 0x6c, [@multicast1, @rand_addr=0x64010102, @remote, @multicast1, @loopback, @initdev={0xac, 0x1e, 0x0, 0x0}, @initdev={0xac, 0x1e, 0x1, 0x0}, @broadcast, @empty]}, @ra={0x94, 0x4, 0x1}, @timestamp={0x44, 0x10, 0x2d, 0x0, 0x8, [0x1, 0x100, 0x401]}, @ssrr={0x89, 0x13, 0x56, [@dev={0xac, 0x14, 0x14, 0x28}, @multicast2, @initdev={0xac, 0x1e, 0x0, 0x0}, @remote]}, @ra={0x94, 0x4, 0x1}]}}}}}) shmget(0x3, 0x4000, 0x4, &(0x7f0000ff9000/0x4000)=nil) mmap$IORING_OFF_CQ_RING(&(0x7f0000ffd000/0x3000)=nil, 0x3000, 0x2000008, 0x30, 0xffffffffffffffff, 0x8000000) r1 = syz_genetlink_get_family_id$nl802154(&(0x7f0000000400), 0xffffffffffffffff) ioctl$sock_SIOCGIFINDEX_802154(0xffffffffffffffff, 0x8933, &(0x7f0000000440)={'wpan1\x00', 0x0}) sendmsg$NL802154_CMD_NEW_INTERFACE(0xffffffffffffffff, &(0x7f0000000540)={&(0x7f00000003c0)={0x10, 0x0, 0x0, 0x2}, 0xc, &(0x7f0000000500)={&(0x7f0000000480)={0x48, r1, 0x200, 0x70bd2a, 0x25dfdbfd, {}, [@NL802154_ATTR_IFNAME={0xa, 0x4, 'wpan0\x00'}, @NL802154_ATTR_IFINDEX={0x8}, @NL802154_ATTR_IFNAME={0xa, 0x4, 'wpan1\x00'}, @NL802154_ATTR_EXTENDED_ADDR={0xc, 0x17, {0xaaaaaaaaaaaa0002}}, @NL802154_ATTR_IFINDEX={0x8, 0x3, r2}]}, 0x48}}, 0x4001) mmap$binder(&(0x7f0000fef000/0x11000)=nil, 0x11000, 0x1, 0x11, 0xffffffffffffffff, 0x6) shmget$private(0x0, 0x4000, 0x200, &(0x7f0000ffc000/0x4000)=nil) r3 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) ioctl$sock_SIOCGIFINDEX_802154(0xffffffffffffffff, 0x8933, &(0x7f00000005c0)={'wpan0\x00', 0x0}) sendmsg$IEEE802154_LLSEC_ADD_SECLEVEL(r3, &(0x7f00000006c0)={&(0x7f0000000580)={0x10, 0x0, 0x0, 0x4000000}, 0xc, &(0x7f0000000680)={&(0x7f0000000600)={0x44, 0x0, 0x200, 0x70bd2a, 0x25dfdbff, {}, [@IEEE802154_ATTR_LLSEC_FRAME_TYPE={0x5, 0x33, 0x34}, @IEEE802154_ATTR_DEV_INDEX={0x8, 0x2, r4}, @IEEE802154_ATTR_LLSEC_CMD_FRAME_ID={0x5, 0x34, 0x1}, @IEEE802154_ATTR_DEV_NAME={0xa, 0x1, 'wpan0\x00'}, @IEEE802154_ATTR_DEV_NAME={0xa, 0x1, 'wpan4\x00'}]}, 0x44}, 0x1, 0x0, 0x0, 0x8800}, 0x0) sendmsg$IEEE802154_START_REQ(r3, &(0x7f00000007c0)={&(0x7f0000000700)={0x10, 0x0, 0x0, 0x4}, 0xc, &(0x7f0000000780)={&(0x7f0000000740)={0x1c, 0x0, 0x200, 0x70bd2d, 0x25dfdbfb, {}, [@IEEE802154_ATTR_CHANNEL={0x5, 0x7, 0x6}]}, 0x1c}, 0x1, 0x0, 0x0, 0x40100}, 0x801) mlock(&(0x7f0000fef000/0x1000)=nil, 0x1000) syz_io_uring_setup(0x4726, &(0x7f0000000840)={0x0, 0x502f, 0x20, 0x0, 0x12e}, &(0x7f0000ffe000/0x2000)=nil, &(0x7f0000ffb000/0x4000)=nil, &(0x7f00000008c0), &(0x7f0000000900)) 17:44:36 executing program 5: clock_gettime(0x5, &(0x7f0000000000)) clock_settime(0x2, &(0x7f0000000040)) sched_rr_get_interval(0xffffffffffffffff, &(0x7f0000000080)) sched_rr_get_interval(0x0, &(0x7f00000000c0)) sendmsg$NL802154_CMD_GET_SEC_KEY(0xffffffffffffffff, &(0x7f00000001c0)={&(0x7f0000000100)={0x10, 0x0, 0x0, 0x20000000}, 0xc, &(0x7f0000000180)={&(0x7f0000000140)={0x24, 0x0, 0x200, 0x70bd26, 0x25dfdbfe, {}, [@NL802154_ATTR_IFINDEX={0x8}, @NL802154_ATTR_IFINDEX={0x8}]}, 0x24}, 0x1, 0x0, 0x0, 0x4000000}, 0x181) clock_gettime(0x0, &(0x7f0000000200)) pipe2$9p(&(0x7f0000000240)={0xffffffffffffffff, 0xffffffffffffffff}, 0x800) r1 = syz_io_uring_setup(0x776a, &(0x7f0000000280)={0x0, 0x2728, 0x2, 0x1, 0x37c}, &(0x7f0000000000/0x3000)=nil, &(0x7f0000000000/0x400000)=nil, &(0x7f0000000300), &(0x7f0000000340)) ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, &(0x7f0000000540)={0x64, 0x0, &(0x7f0000000440)=[@transaction_sg={0x40486311, {0x1, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x50, 0x18, &(0x7f0000000380)={@fd={0x66642a85, 0x0, r0}, @fd={0x66642a85, 0x0, r1}, @fda={0x66646185, 0x0, 0x2, 0x36}}, &(0x7f0000000400)={0x0, 0x18, 0x30}}}, @request_death, @release={0x40046306, 0x1}], 0x7e, 0x0, &(0x7f00000004c0)="7685c519d1cbea63a1a8f022f8c0085baf770aa5d1fa9bfb1a5399fdb134953d619e962218bba650b68d6206fde39ff17760aa4bbcb62f6802c48e17294a17a3b768ab60bbae37aa37e33e24b09f6bdea37853f7ab2622451803788c9d172b7d71d6d87911129b8ef5cc9e0169404b09abfa991f3a7a3640686df445d387"}) pipe2$9p(&(0x7f0000000580), 0x800) ioctl$EVIOCGVERSION(0xffffffffffffffff, 0x80044501, &(0x7f00000005c0)=""/174) r2 = openat$nvram(0xffffffffffffff9c, &(0x7f0000000680), 0x400, 0x0) write$P9_RSTAT(r2, &(0x7f00000006c0)={0x3f, 0x7d, 0x1, {0x0, 0x38, 0x401, 0x8000, {0x80, 0x4, 0x1}, 0x2020000, 0x4, 0x60, 0x9, 0x1, '\x00', 0x2, '.-', 0x1, '\x00', 0x1, '\x00'}}, 0x3f) r3 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r4 = syz_genetlink_get_family_id$ieee802154(&(0x7f0000000740), 0xffffffffffffffff) sendmsg$IEEE802154_LLSEC_DEL_KEY(r3, &(0x7f0000000840)={&(0x7f0000000700)={0x10, 0x0, 0x0, 0x800000}, 0xc, &(0x7f0000000800)={&(0x7f0000000780)={0x54, r4, 0x800, 0x70bd27, 0x25dfdbfc, {}, [@IEEE802154_ATTR_LLSEC_KEY_SOURCE_SHORT={0x8, 0x2c, 0x5}, @IEEE802154_ATTR_LLSEC_KEY_SOURCE_EXTENDED={0xc, 0x2d, {0xaaaaaaaaaaaa0002}}, @IEEE802154_ATTR_PAN_ID={0x6, 0x6, 0x2}, @IEEE802154_ATTR_DEV_INDEX={0x8}, @IEEE802154_ATTR_LLSEC_KEY_MODE={0x5, 0x2b, 0x1}, @IEEE802154_ATTR_HW_ADDR={0xc, 0x5, {0xaaaaaaaaaaaa0002}}, @IEEE802154_ATTR_LLSEC_KEY_MODE={0x5, 0x2b, 0x3}]}, 0x54}, 0x1, 0x0, 0x0, 0x40}, 0x2000c814) clock_getres(0x3, &(0x7f0000000880)) clock_getres(0x6, &(0x7f00000008c0)) r5 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) sendmsg$IEEE802154_ADD_IFACE(r5, &(0x7f0000000a00)={&(0x7f0000000900)={0x10, 0x0, 0x0, 0x40c}, 0xc, &(0x7f00000009c0)={&(0x7f0000000940)={0x44, r4, 0x200, 0x70bd29, 0x25dfdbfe, {}, [@IEEE802154_ATTR_PHY_NAME={0x9, 0x1f, 'phy1\x00'}, @IEEE802154_ATTR_DEV_NAME={0xa, 0x1, 'wpan4\x00'}, @IEEE802154_ATTR_DEV_NAME={0xa, 0x1, 'wpan1\x00'}, @IEEE802154_ATTR_DEV_NAME={0xa, 0x1, 'wpan0\x00'}]}, 0x44}, 0x1, 0x0, 0x0, 0x20000084}, 0x44000) 17:44:45 executing program 7: r0 = perf_event_open(&(0x7f0000000040)={0x4, 0x80, 0x6f, 0x8, 0x8, 0x1, 0x0, 0x6, 0x4, 0x1, 0x1, 0x0, 0x0, 0x1, 0x1, 0x1, 0x0, 0x0, 0x1, 0x0, 0x0, 0x1, 0x1, 0x0, 0x0, 0x2, 0x1, 0x0, 0x0, 0x1, 0x0, 0x0, 0x1, 0x0, 0x1, 0x0, 0x0, 0x0, 0x1, 0x1, 0x1, 0x0, 0x1, 0x1, 0x1, 0x0, 0x1, 0x0, 0x50, 0x2, @perf_bp={&(0x7f0000000000), 0xa}, 0x2100, 0x7, 0x1, 0x3, 0x6, 0x93d3, 0x0, 0x0, 0x3a, 0x0, 0x9}, 0xffffffffffffffff, 0xc, 0xffffffffffffffff, 0x8) mmap$perf(&(0x7f0000ffb000/0x2000)=nil, 0x2000, 0xb, 0x11, r0, 0x8) munmap(&(0x7f0000ffb000/0x3000)=nil, 0x3000) getsockopt$inet6_tcp_TCP_ZEROCOPY_RECEIVE(0xffffffffffffffff, 0x6, 0x23, &(0x7f0000001180)={&(0x7f0000ffd000/0x2000)=nil, 0x2000, 0x0, 0x0, 0x0, &(0x7f00000000c0)=""/162, 0xa2, 0x0, &(0x7f0000000180)=""/4096, 0x1000}, &(0x7f00000011c0)=0x40) r1 = openat$vcsa(0xffffffffffffff9c, &(0x7f0000001200), 0x14d080, 0x0) ioctl$SNDRV_SEQ_IOCTL_SUBSCRIBE_PORT(r1, 0x40505330, &(0x7f0000001240)={{0x3f, 0x40}, {0x9, 0x2}, 0x43, 0x0, 0x1}) r2 = mmap$binder(&(0x7f0000ffc000/0x1000)=nil, 0x1000, 0x1, 0x11, r1, 0x81) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000001380)={0x44, 0x0, &(0x7f00000012c0)=[@acquire={0x40046305, 0x3}, @increfs, @free_buffer={0x40086303, r2}, @exit_looper, @request_death={0x400c630e, 0x3}, @increfs={0x40046304, 0x2}, @free_buffer], 0x1d, 0x0, &(0x7f0000001340)="63170b84a45d435cf194bbb38c0432388cb6578156ee80dc59b93c914c"}) r3 = openat$vcsa(0xffffffffffffff9c, &(0x7f00000013c0), 0x400000, 0x0) ioctl$SNDRV_SEQ_IOCTL_GET_SUBSCRIPTION(r3, 0xc0505350, &(0x7f0000001400)={{0x1, 0x6}, {0x1f, 0x81}, 0x4, 0x3, 0x7}) r4 = openat$nvram(0xffffffffffffff9c, &(0x7f0000001480), 0x105500, 0x0) mmap$IORING_OFF_SQ_RING(&(0x7f0000ffd000/0x1000)=nil, 0x1000, 0x0, 0x13, r4, 0x0) munmap(&(0x7f0000ffc000/0x2000)=nil, 0x2000) setsockopt$inet_tcp_TLS_TX(r3, 0x6, 0x1, &(0x7f00000014c0)=@gcm_128={{0x304}, "c7158b5e86708544", "366c7e9fd1d7fe2728acf2d3b734f3db", "b710fe41", "ad55c6ad971e7ae7"}, 0x28) mlock(&(0x7f0000ffd000/0x1000)=nil, 0x1000) ioctl$SECCOMP_IOCTL_NOTIF_RECV(r3, 0xc0502100, &(0x7f0000001500)={0x0, 0x0}) move_pages(r5, 0x2, &(0x7f0000001580)=[&(0x7f0000ffd000/0x3000)=nil, &(0x7f0000ffd000/0x1000)=nil], &(0x7f00000015c0)=[0x2, 0x6, 0x3, 0x400], &(0x7f0000001600)=[0x0, 0x0, 0x0, 0x0, 0x0, 0x0], 0x1) openat$nvram(0xffffffffffffff9c, &(0x7f0000001640), 0x40000, 0x0) shmget(0x0, 0x1000, 0x200, &(0x7f0000ffd000/0x1000)=nil) 17:44:45 executing program 5: clock_gettime(0x5, &(0x7f0000000000)) clock_settime(0x2, &(0x7f0000000040)) sched_rr_get_interval(0xffffffffffffffff, &(0x7f0000000080)) sched_rr_get_interval(0x0, &(0x7f00000000c0)) sendmsg$NL802154_CMD_GET_SEC_KEY(0xffffffffffffffff, &(0x7f00000001c0)={&(0x7f0000000100)={0x10, 0x0, 0x0, 0x20000000}, 0xc, &(0x7f0000000180)={&(0x7f0000000140)={0x24, 0x0, 0x200, 0x70bd26, 0x25dfdbfe, {}, [@NL802154_ATTR_IFINDEX={0x8}, @NL802154_ATTR_IFINDEX={0x8}]}, 0x24}, 0x1, 0x0, 0x0, 0x4000000}, 0x181) clock_gettime(0x0, &(0x7f0000000200)) pipe2$9p(&(0x7f0000000240)={0xffffffffffffffff, 0xffffffffffffffff}, 0x800) r1 = syz_io_uring_setup(0x776a, &(0x7f0000000280)={0x0, 0x2728, 0x2, 0x1, 0x37c}, &(0x7f0000000000/0x3000)=nil, &(0x7f0000000000/0x400000)=nil, &(0x7f0000000300), &(0x7f0000000340)) ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, &(0x7f0000000540)={0x64, 0x0, &(0x7f0000000440)=[@transaction_sg={0x40486311, {0x1, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x50, 0x18, &(0x7f0000000380)={@fd={0x66642a85, 0x0, r0}, @fd={0x66642a85, 0x0, r1}, @fda={0x66646185, 0x0, 0x2, 0x36}}, &(0x7f0000000400)={0x0, 0x18, 0x30}}}, @request_death, @release={0x40046306, 0x1}], 0x7e, 0x0, &(0x7f00000004c0)="7685c519d1cbea63a1a8f022f8c0085baf770aa5d1fa9bfb1a5399fdb134953d619e962218bba650b68d6206fde39ff17760aa4bbcb62f6802c48e17294a17a3b768ab60bbae37aa37e33e24b09f6bdea37853f7ab2622451803788c9d172b7d71d6d87911129b8ef5cc9e0169404b09abfa991f3a7a3640686df445d387"}) pipe2$9p(&(0x7f0000000580), 0x800) ioctl$EVIOCGVERSION(0xffffffffffffffff, 0x80044501, &(0x7f00000005c0)=""/174) r2 = openat$nvram(0xffffffffffffff9c, &(0x7f0000000680), 0x400, 0x0) write$P9_RSTAT(r2, &(0x7f00000006c0)={0x3f, 0x7d, 0x1, {0x0, 0x38, 0x401, 0x8000, {0x80, 0x4, 0x1}, 0x2020000, 0x4, 0x60, 0x9, 0x1, '\x00', 0x2, '.-', 0x1, '\x00', 0x1, '\x00'}}, 0x3f) r3 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r4 = syz_genetlink_get_family_id$ieee802154(&(0x7f0000000740), 0xffffffffffffffff) sendmsg$IEEE802154_LLSEC_DEL_KEY(r3, &(0x7f0000000840)={&(0x7f0000000700)={0x10, 0x0, 0x0, 0x800000}, 0xc, &(0x7f0000000800)={&(0x7f0000000780)={0x54, r4, 0x800, 0x70bd27, 0x25dfdbfc, {}, [@IEEE802154_ATTR_LLSEC_KEY_SOURCE_SHORT={0x8, 0x2c, 0x5}, @IEEE802154_ATTR_LLSEC_KEY_SOURCE_EXTENDED={0xc, 0x2d, {0xaaaaaaaaaaaa0002}}, @IEEE802154_ATTR_PAN_ID={0x6, 0x6, 0x2}, @IEEE802154_ATTR_DEV_INDEX={0x8}, @IEEE802154_ATTR_LLSEC_KEY_MODE={0x5, 0x2b, 0x1}, @IEEE802154_ATTR_HW_ADDR={0xc, 0x5, {0xaaaaaaaaaaaa0002}}, @IEEE802154_ATTR_LLSEC_KEY_MODE={0x5, 0x2b, 0x3}]}, 0x54}, 0x1, 0x0, 0x0, 0x40}, 0x2000c814) clock_getres(0x3, &(0x7f0000000880)) clock_getres(0x6, &(0x7f00000008c0)) sendmsg$IEEE802154_ADD_IFACE(0xffffffffffffffff, &(0x7f0000000a00)={&(0x7f0000000900)={0x10, 0x0, 0x0, 0x40c}, 0xc, &(0x7f00000009c0)={&(0x7f0000000940)={0x44, r4, 0x200, 0x70bd29, 0x25dfdbfe, {}, [@IEEE802154_ATTR_PHY_NAME={0x9, 0x1f, 'phy1\x00'}, @IEEE802154_ATTR_DEV_NAME={0xa, 0x1, 'wpan4\x00'}, @IEEE802154_ATTR_DEV_NAME={0xa, 0x1, 'wpan1\x00'}, @IEEE802154_ATTR_DEV_NAME={0xa, 0x1, 'wpan0\x00'}]}, 0x44}, 0x1, 0x0, 0x0, 0x20000084}, 0x44000) 17:44:45 executing program 6: r0 = perf_event_open(&(0x7f00000000c0)={0x1, 0x80, 0x0, 0xc0, 0xfa, 0x1, 0x0, 0x7fffffff, 0x10811, 0x1, 0x1, 0x1, 0x1, 0x1, 0x1, 0x1, 0x1, 0x1, 0x0, 0x1, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x1, 0x0, 0x1, 0x0, 0x0, 0x0, 0x1, 0x1, 0x1, 0x1, 0x1, 0x1, 0x1, 0x0, 0x1, 0x1, 0x1, 0x1, 0x0, 0x0, 0xfff, 0x7, @perf_config_ext={0x7, 0x7fffffff}, 0x41000, 0x80000000, 0x5, 0x3, 0x9, 0x2, 0x9, 0x0, 0x5, 0x0, 0x4}, 0x0, 0xb, 0xffffffffffffffff, 0x1) perf_event_open(&(0x7f0000000040)={0x0, 0x80, 0x0, 0x40, 0x80, 0x9, 0x0, 0x3, 0x10040, 0x1, 0x0, 0x0, 0x1, 0x1, 0x1, 0x1, 0x1, 0x1, 0x1, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x3, 0x1, 0x0, 0x1, 0x0, 0x1, 0x1, 0x0, 0x0, 0x1, 0x1, 0x1, 0x0, 0x1, 0x0, 0x0, 0x0, 0x1, 0x0, 0x1, 0x0, 0x1, 0x0, 0x0, 0x1, @perf_bp={&(0x7f0000000000), 0x10}, 0x8080, 0x800, 0x2, 0x3, 0x36dc, 0x31df3b33, 0xff, 0x0, 0x9, 0x0, 0x5}, 0xffffffffffffffff, 0x9, r0, 0x9) ioctl$PERF_EVENT_IOC_PAUSE_OUTPUT(r0, 0x40042409, 0x0) ioctl$PERF_EVENT_IOC_PERIOD(0xffffffffffffffff, 0x40082404, &(0x7f0000000140)=0x8) r1 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl$sock_ipv4_tunnel_SIOCADDTUNNEL(r1, 0x89f1, &(0x7f00000001c0)={'syztnl1\x00', &(0x7f0000000180)={'syztnl0\x00', 0x0, 0x1, 0x40, 0x0, 0x5, {{0x5, 0x4, 0x2, 0x19, 0x14, 0x65, 0x0, 0x1f, 0x4, 0x0, @multicast2, @remote}}}}) ioctl$PERF_EVENT_IOC_PERIOD(r0, 0x40082404, &(0x7f0000000200)=0x9) ioctl$SNDRV_SEQ_IOCTL_GET_PORT_INFO(0xffffffffffffffff, 0xc0a85322, &(0x7f0000000240)) ioctl$SNDRV_SEQ_IOCTL_SYSTEM_INFO(0xffffffffffffffff, 0xc0305302, &(0x7f0000000300)={0x9, 0x101, 0x1, 0x6, 0x3, 0x5}) r2 = syz_open_procfs(0x0, &(0x7f0000000340)='children\x00') openat$cgroup_type(r2, &(0x7f0000000380), 0x2, 0x0) ioctl$EVIOCGABS20(r2, 0x80184560, &(0x7f00000003c0)=""/4096) socket$inet6_tcp(0xa, 0x1, 0x0) r3 = openat$nvram(0xffffffffffffff9c, &(0x7f00000013c0), 0xdd0e52fd5a017ff5, 0x0) mmap$perf(&(0x7f0000ffe000/0x2000)=nil, 0x2000, 0x2000001, 0x10, r3, 0x4) r4 = openat$vcsu(0xffffffffffffff9c, &(0x7f0000001400), 0x280103, 0x0) ioctl$SNDRV_SEQ_IOCTL_QUERY_NEXT_PORT(r4, 0xc0a85352, &(0x7f0000001440)={{0x20, 0x1}, 'port1\x00', 0x88, 0x22, 0x7, 0x5, 0x1000000, 0x2, 0x10000, 0x0, 0x5, 0xf0}) r5 = pidfd_getfd(r3, r3, 0x0) write$cgroup_type(r5, &(0x7f0000001500), 0x9) 17:44:45 executing program 3: getsockopt$inet_udp_int(0xffffffffffffffff, 0x11, 0x1, &(0x7f0000000000), &(0x7f0000000040)=0x4) setsockopt$inet_udp_int(0xffffffffffffffff, 0x11, 0x1, &(0x7f0000000080)=0x7, 0x4) ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, &(0x7f0000000240)={0x54, 0x0, &(0x7f00000000c0)=[@acquire_done={0x40106309, 0x1}, @free_buffer, @request_death={0x400c630e, 0x1}, @request_death, @decrefs, @dead_binder_done], 0xc7, 0x0, &(0x7f0000000140)="aa36e0fef6a6cd3a6060f434b2a2306a435d6c33ca3bfb20c9d046886ded10cf23d0938b55b8a812702a5a7579cb8813f0cf3954f24fa081e8c35a9d4674b51115d91e7f6e38920909a8fba27ba7bbb0522974a9d83826c23d40a56c3f88dc24276a8312ae50d15d3531211e4378a34980ea70ac3cefef2439af0baa6b387df4ff26b593ca52e94dda8ce3656a81180693ab97746e30b1301f30922ec565bba820fc06168927e446c06efe1fc7cb37b804ba0342e58e70da81c074407ec9cf690a9ab1e3a62a68"}) r0 = openat$vcsa(0xffffffffffffff9c, &(0x7f0000000280), 0x1, 0x0) r1 = openat$vcsa(0xffffffffffffff9c, &(0x7f00000002c0), 0x80, 0x0) ioctl$SNDRV_SEQ_IOCTL_QUERY_NEXT_PORT(r0, 0xc0a85352, &(0x7f0000000300)={{0x4, 0x6}, 'port0\x00', 0x5, 0x1, 0x0, 0xffff, 0x7, 0x7, 0x5, 0x0, 0x2, 0xc0}) ioctl$SNDRV_SEQ_IOCTL_QUERY_NEXT_CLIENT(r1, 0xc0bc5351, &(0x7f00000003c0)={0xffff7fff, 0x0, 'client0\x00', 0xffffffff80000002, "9aa89fbb0e155330", "7e3a03465d7350a6322e39e7997e8c634c3224eb46d1223d24ed4ce35c7b1dd2", 0x0, 0x6}) r2 = openat$nvram(0xffffffffffffff9c, &(0x7f0000000480), 0x1, 0x0) ioctl$PERF_EVENT_IOC_PAUSE_OUTPUT(r2, 0x40042409, 0x0) process_mrelease(r0, 0x0) ioctl$SNDRV_TIMER_IOCTL_TREAD(r1, 0x40045402, &(0x7f00000004c0)) r3 = socket$inet_udp(0x2, 0x2, 0x0) ioctl$sock_inet_udp_SIOCINQ(r3, 0x541b, &(0x7f0000000500)) getsockopt$inet_IP_IPSEC_POLICY(r0, 0x0, 0x10, &(0x7f0000000540)={{{@in=@broadcast, @in6=@mcast1}}, {{@in=@broadcast}, 0x0, @in6=@mcast2}}, &(0x7f0000000640)=0xe8) setsockopt$inet_udp_encap(r1, 0x11, 0x64, &(0x7f0000000680)=0x3, 0x4) r4 = syz_open_procfs(0xffffffffffffffff, &(0x7f00000006c0)='net/packet\x00') pidfd_getfd(r4, 0xffffffffffffffff, 0x0) r5 = openat$nvram(0xffffffffffffff9c, &(0x7f0000000700), 0x800, 0x0) write$P9_RGETLOCK(r5, &(0x7f00000007c0)={0x1e, 0x37, 0x2, {0x2, 0x6, 0x101}}, 0x1e) 17:44:45 executing program 4: ioctl$SNDRV_TIMER_IOCTL_TREAD(0xffffffffffffffff, 0x40045402, &(0x7f0000000000)) wait4(0xffffffffffffffff, &(0x7f0000000040), 0x1, &(0x7f0000000080)) waitid$P_PIDFD(0x3, 0xffffffffffffffff, &(0x7f0000000140), 0x40000002, &(0x7f00000001c0)) shmget$private(0x0, 0x3000, 0x20, &(0x7f0000ffa000/0x3000)=nil) sendmsg$SEG6_CMD_SETHMAC(0xffffffffffffffff, &(0x7f0000000380)={&(0x7f0000000280)={0x10, 0x0, 0x0, 0x2}, 0xc, &(0x7f0000000340)={&(0x7f00000002c0)={0x48, 0x0, 0x10, 0x70bd25, 0x25dfdbff, {}, [@SEG6_ATTR_ALGID={0x5, 0x6, 0x4}, @SEG6_ATTR_ALGID={0x5, 0x6, 0x20}, @SEG6_ATTR_ALGID={0x5, 0x6, 0x8}, @SEG6_ATTR_HMACKEYID={0x8, 0x3, 0x1}, @SEG6_ATTR_SECRETLEN={0x5, 0x5, 0x5}, @SEG6_ATTR_SECRET={0x4}, @SEG6_ATTR_DSTLEN={0x8, 0x2, 0x1f}]}, 0x48}}, 0x0) r0 = openat$vcsa(0xffffffffffffff9c, &(0x7f00000003c0), 0x48000, 0x0) ioctl$SNDRV_TIMER_IOCTL_START(r0, 0x54a0) r1 = syz_open_procfs(0x0, &(0x7f0000000400)='smaps_rollup\x00') ioctl$EVIOCSREP(r1, 0x40084503, &(0x7f0000000440)=[0x8, 0x7ff]) shmget(0x1, 0x3000, 0x20, &(0x7f0000ffc000/0x3000)=nil) 17:44:45 executing program 2: prctl$PR_MPX_ENABLE_MANAGEMENT(0x2b) r0 = socket$inet(0x2, 0x5, 0x4) r1 = openat$vcsu(0xffffffffffffff9c, &(0x7f0000000000), 0x3c1480, 0x0) ioctl$sock_ipv4_tunnel_SIOCGETTUNNEL(r1, 0x89f0, &(0x7f00000000c0)={'syztnl2\x00', &(0x7f0000000040)={'erspan0\x00', 0x0, 0x700, 0x40, 0x3, 0x22, {{0x15, 0x4, 0x3, 0x17, 0x54, 0x64, 0x0, 0x1, 0x2f, 0x0, @broadcast, @dev={0xac, 0x14, 0x14, 0x36}, {[@cipso={0x86, 0x3d, 0x1, [{0x5, 0x9, "c8a7bec58c2c80"}, {0x0, 0x9, "fabb6c2e64ba82"}, {0x7, 0xf, "6b1b69e07efcb7230cc07a2cf7"}, {0x1, 0x6, "a2118bdb"}, {0x5, 0x10, "67115d3e7766231c7b08cf3c48e4"}]}]}}}}}) prctl$PR_MPX_ENABLE_MANAGEMENT(0x2b) r2 = openat$vcsa(0xffffffffffffff9c, &(0x7f0000000100), 0x202c0, 0x0) ioctl$SNDRV_SEQ_IOCTL_GET_QUEUE_TEMPO(r2, 0xc02c5341, &(0x7f0000000140)) ioctl$SNDRV_TIMER_IOCTL_SELECT(r1, 0x40345410, &(0x7f00000001c0)={{0x0, 0x2, 0x3f, 0x3, 0x80000001}}) ioctl$SNDRV_SEQ_IOCTL_GET_QUEUE_TEMPO(r1, 0xc02c5341, &(0x7f0000000200)) ioctl$sock_inet_tcp_SIOCOUTQ(r0, 0x5411, &(0x7f0000000280)) r3 = syz_open_dev$evdev(&(0x7f00000002c0), 0x1, 0x50000) ioctl$EVIOCGLED(r3, 0x80404519, &(0x7f0000000300)=""/21) seccomp$SECCOMP_GET_NOTIF_SIZES(0x3, 0x0, &(0x7f0000000340)) ioctl$SNDRV_TIMER_IOCTL_NEXT_DEVICE(r2, 0xc0145401, &(0x7f0000000380)={0x3, 0x2, 0x8, 0x2, 0x733}) munlock(&(0x7f0000ff9000/0x4000)=nil, 0x4000) getsockopt$inet_tcp_buf(r1, 0x6, 0x1a, &(0x7f00000003c0)=""/1, &(0x7f0000000400)=0x1) ioctl$SNDRV_SEQ_IOCTL_GET_QUEUE_INFO(r2, 0xc08c5334, &(0x7f0000000440)={0x0, 0x80, 0x0, 'queue0\x00', 0x8}) r4 = syz_open_procfs(0x0, &(0x7f0000000500)='schedstat\x00') ioctl$SNDRV_TIMER_IOCTL_PVERSION(r4, 0x80045400, &(0x7f0000000540)) sendmsg$SEG6_CMD_DUMPHMAC(r1, &(0x7f0000000640)={&(0x7f0000000580)={0x10, 0x0, 0x0, 0x40000000}, 0xc, &(0x7f0000000600)={&(0x7f00000005c0)={0x24, 0x0, 0x100, 0x70bd2c, 0x25dfdbfc, {}, [@SEG6_ATTR_HMACKEYID={0x8, 0x3, 0x8}, @SEG6_ATTR_DSTLEN={0x8, 0x2, 0x8}]}, 0x24}}, 0x20008080) 17:44:45 executing program 0: get_thread_area(&(0x7f0000000000)={0x7, 0x20000800, 0x4000, 0x0, 0x1, 0x0, 0x0, 0x1, 0x1, 0x1}) r0 = openat$vcsu(0xffffffffffffff9c, &(0x7f0000000040), 0x200000, 0x0) getsockopt$inet_tcp_TCP_REPAIR_WINDOW(r0, 0x6, 0x1d, &(0x7f0000000080), &(0x7f00000000c0)=0x14) r1 = openat$nvram(0xffffffffffffff9c, &(0x7f0000000100), 0x2000, 0x0) setsockopt$inet_tcp_TCP_FASTOPEN_KEY(r1, 0x6, 0x21, &(0x7f0000000140)="1bb9d563048b6ec78effc0f14d974b17", 0x10) setsockopt$inet_tcp_int(r1, 0x6, 0x1b, &(0x7f0000000180)=0x5, 0x4) ioctl$SNDRV_TIMER_IOCTL_STATUS32(r1, 0x80585414, &(0x7f00000001c0)) setsockopt$inet_tcp_TCP_QUEUE_SEQ(r0, 0x6, 0x15, &(0x7f0000000240)=0x1, 0x4) getsockopt$inet_tcp_TCP_ZEROCOPY_RECEIVE(r1, 0x6, 0x23, &(0x7f0000000340)={&(0x7f0000ffc000/0x2000)=nil, 0x2000, 0x0, 0x0, 0x0, &(0x7f0000000280)=""/37, 0x25, 0x1, &(0x7f00000002c0)=""/109, 0x6d}, &(0x7f0000000380)=0x40) r2 = socket$inet_tcp(0x2, 0x1, 0x0) ioctl$sock_inet_tcp_SIOCINQ(r2, 0x541b, &(0x7f00000003c0)) move_pages(0x0, 0x8, &(0x7f0000000400)=[&(0x7f0000ffd000/0x1000)=nil, &(0x7f0000ffd000/0x3000)=nil, &(0x7f0000ffd000/0x3000)=nil, &(0x7f0000ffb000/0x2000)=nil, &(0x7f0000ffc000/0x1000)=nil, &(0x7f0000ffe000/0x2000)=nil, &(0x7f0000ffb000/0x4000)=nil, &(0x7f0000ffd000/0x3000)=nil], &(0x7f0000000440)=[0xfff], &(0x7f0000000480)=[0x0, 0x0, 0x0], 0x4) r3 = syz_genetlink_get_family_id$SEG6(&(0x7f0000000500), r1) sendmsg$SEG6_CMD_GET_TUNSRC(r0, &(0x7f00000005c0)={&(0x7f00000004c0)={0x10, 0x0, 0x0, 0x4000000}, 0xc, &(0x7f0000000580)={&(0x7f0000000540)={0x38, r3, 0x300, 0x70bd2a, 0x25dfdbfc, {}, [@SEG6_ATTR_HMACKEYID={0x8, 0x3, 0x24}, @SEG6_ATTR_DST={0x14, 0x1, @mcast1}, @SEG6_ATTR_DSTLEN={0x8, 0x2, 0x2}]}, 0x38}, 0x1, 0x0, 0x0, 0x20008810}, 0x4040010) ioctl$SNDRV_SEQ_IOCTL_SET_QUEUE_TIMER(r1, 0x40605346, &(0x7f0000000600)={0x80, 0x1, {0x1, 0x0, 0x81}, 0x2}) sendmsg$SEG6_CMD_DUMPHMAC(0xffffffffffffffff, &(0x7f0000000740)={&(0x7f0000000680)={0x10, 0x0, 0x0, 0x240000}, 0xc, &(0x7f0000000700)={&(0x7f00000006c0)={0x2c, r3, 0x1, 0x70bd2c, 0x25dfdbfe, {}, [@SEG6_ATTR_SECRET={0x8, 0x4, [0x1]}, @SEG6_ATTR_DSTLEN={0x8, 0x2, 0x5}, @SEG6_ATTR_DSTLEN={0x8}]}, 0x2c}, 0x1, 0x0, 0x0, 0x4000000}, 0x4000000) r4 = pidfd_getfd(r1, r2, 0x0) setsockopt$inet_tcp_TCP_CONGESTION(r4, 0x6, 0xd, &(0x7f0000000780)='westwood\x00', 0x9) syz_genetlink_get_family_id$ieee802154(&(0x7f0000000800), 0xffffffffffffffff) 17:44:45 executing program 1: shmget$private(0x0, 0x4000, 0x80, &(0x7f0000ffb000/0x4000)=nil) shmget(0x3, 0x2000, 0x4, &(0x7f0000ffc000/0x2000)=nil) mlock(&(0x7f0000ff0000/0x10000)=nil, 0x10000) shmget(0x1, 0x1000, 0x10, &(0x7f0000ff5000/0x1000)=nil) ioctl$sock_ipv4_tunnel_SIOCGETTUNNEL(0xffffffffffffffff, 0x89f0, &(0x7f0000000140)={'syztnl1\x00', &(0x7f00000000c0)={'syztnl2\x00', 0x0, 0x20, 0x1, 0x6, 0x9, {{0xd, 0x4, 0x1, 0x19, 0x34, 0x68, 0x0, 0x9, 0x29, 0x0, @empty, @dev={0xac, 0x14, 0x14, 0x29}, {[@timestamp_addr={0x44, 0x14, 0xc2, 0x1, 0x4, [{@multicast1}, {@private=0xa010101}]}, @rr={0x7, 0xb, 0xc8, [@initdev={0xac, 0x1e, 0x1, 0x0}, @private=0xa010102]}]}}}}}) ioctl$sock_ipv4_tunnel_SIOCADDTUNNEL(0xffffffffffffffff, 0x89f1, &(0x7f0000000280)={'tunl0\x00', &(0x7f0000000180)={'tunl0\x00', r0, 0x7, 0x8000, 0xfffffffc, 0x8, {{0x2f, 0x4, 0x0, 0x2, 0xbc, 0x65, 0x0, 0x0, 0x4, 0x0, @empty, @broadcast, {[@generic={0x89, 0x9, "8db1d464c6af68"}, @noop, @ra={0x94, 0x4, 0x1}, @timestamp={0x44, 0x1c, 0x53, 0x0, 0x7, [0x40, 0x7fffffff, 0xfffffffd, 0x5, 0x5c, 0x77]}, @cipso={0x86, 0x2f, 0x3, [{0x1, 0x4, "1eba"}, {0x1, 0x7, "e3ccb5ddcf"}, {0x6, 0xa, "5db18b961780af33"}, {0x2, 0xe, "7353a9824b57fd7d39232ac5"}, {0x1, 0x6, "2e1ccd27"}]}, @noop, @cipso={0x86, 0x37, 0xffffffffffffffff, [{0x2, 0xf, "227467028cabd4e137b820c5c9"}, {0x7, 0x6, "90569992"}, {0x2, 0xc, "2071b0a8c9ce92782e72"}, {0x6, 0xa, "14f2b9bca55ce3dd"}, {0x6, 0x6, "2cd22a8f"}]}, @timestamp={0x44, 0x14, 0xd4, 0x0, 0x5, [0x81, 0x5d23, 0x63ab, 0x1]}]}}}}}) ioctl$sock_ipv4_tunnel_SIOCDELTUNNEL(0xffffffffffffffff, 0x89f2, &(0x7f0000000380)={'gretap0\x00', &(0x7f00000002c0)={'syztnl2\x00', 0x0, 0x7800, 0x7, 0x40, 0xe180, {{0x22, 0x4, 0x0, 0x1, 0x88, 0x64, 0x0, 0x1, 0x29, 0x0, @multicast2, @multicast1, {[@end, @lsrr={0x83, 0x1f, 0x2f, [@multicast2, @local, @local, @multicast1, @rand_addr=0x64010102, @loopback, @private=0xa010100]}, @rr={0x7, 0x27, 0x6c, [@multicast1, @rand_addr=0x64010102, @remote, @multicast1, @loopback, @initdev={0xac, 0x1e, 0x0, 0x0}, @initdev={0xac, 0x1e, 0x1, 0x0}, @broadcast, @empty]}, @ra={0x94, 0x4, 0x1}, @timestamp={0x44, 0x10, 0x2d, 0x0, 0x8, [0x1, 0x100, 0x401]}, @ssrr={0x89, 0x13, 0x56, [@dev={0xac, 0x14, 0x14, 0x28}, @multicast2, @initdev={0xac, 0x1e, 0x0, 0x0}, @remote]}, @ra={0x94, 0x4, 0x1}]}}}}}) shmget(0x3, 0x4000, 0x4, &(0x7f0000ff9000/0x4000)=nil) mmap$IORING_OFF_CQ_RING(&(0x7f0000ffd000/0x3000)=nil, 0x3000, 0x2000008, 0x30, 0xffffffffffffffff, 0x8000000) r1 = syz_genetlink_get_family_id$nl802154(&(0x7f0000000400), 0xffffffffffffffff) ioctl$sock_SIOCGIFINDEX_802154(0xffffffffffffffff, 0x8933, &(0x7f0000000440)={'wpan1\x00', 0x0}) sendmsg$NL802154_CMD_NEW_INTERFACE(0xffffffffffffffff, &(0x7f0000000540)={&(0x7f00000003c0)={0x10, 0x0, 0x0, 0x2}, 0xc, &(0x7f0000000500)={&(0x7f0000000480)={0x48, r1, 0x200, 0x70bd2a, 0x25dfdbfd, {}, [@NL802154_ATTR_IFNAME={0xa, 0x4, 'wpan0\x00'}, @NL802154_ATTR_IFINDEX={0x8}, @NL802154_ATTR_IFNAME={0xa, 0x4, 'wpan1\x00'}, @NL802154_ATTR_EXTENDED_ADDR={0xc, 0x17, {0xaaaaaaaaaaaa0002}}, @NL802154_ATTR_IFINDEX={0x8, 0x3, r2}]}, 0x48}}, 0x4001) mmap$binder(&(0x7f0000fef000/0x11000)=nil, 0x11000, 0x1, 0x11, 0xffffffffffffffff, 0x6) shmget$private(0x0, 0x4000, 0x200, &(0x7f0000ffc000/0x4000)=nil) r3 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) ioctl$sock_SIOCGIFINDEX_802154(0xffffffffffffffff, 0x8933, &(0x7f00000005c0)={'wpan0\x00', 0x0}) sendmsg$IEEE802154_LLSEC_ADD_SECLEVEL(r3, &(0x7f00000006c0)={&(0x7f0000000580)={0x10, 0x0, 0x0, 0x4000000}, 0xc, &(0x7f0000000680)={&(0x7f0000000600)={0x44, 0x0, 0x200, 0x70bd2a, 0x25dfdbff, {}, [@IEEE802154_ATTR_LLSEC_FRAME_TYPE={0x5, 0x33, 0x34}, @IEEE802154_ATTR_DEV_INDEX={0x8, 0x2, r4}, @IEEE802154_ATTR_LLSEC_CMD_FRAME_ID={0x5, 0x34, 0x1}, @IEEE802154_ATTR_DEV_NAME={0xa, 0x1, 'wpan0\x00'}, @IEEE802154_ATTR_DEV_NAME={0xa, 0x1, 'wpan4\x00'}]}, 0x44}, 0x1, 0x0, 0x0, 0x8800}, 0x0) sendmsg$IEEE802154_START_REQ(r3, &(0x7f00000007c0)={&(0x7f0000000700)={0x10, 0x0, 0x0, 0x4}, 0xc, &(0x7f0000000780)={&(0x7f0000000740)={0x1c, 0x0, 0x200, 0x70bd2d, 0x25dfdbfb, {}, [@IEEE802154_ATTR_CHANNEL={0x5, 0x7, 0x6}]}, 0x1c}, 0x1, 0x0, 0x0, 0x40100}, 0x801) syz_io_uring_setup(0x4726, &(0x7f0000000840)={0x0, 0x502f, 0x20, 0x0, 0x12e}, &(0x7f0000ffe000/0x2000)=nil, &(0x7f0000ffb000/0x4000)=nil, &(0x7f00000008c0), &(0x7f0000000900)) 17:44:45 executing program 4: ioctl$SNDRV_TIMER_IOCTL_TREAD(0xffffffffffffffff, 0x40045402, &(0x7f0000000000)) wait4(0xffffffffffffffff, &(0x7f0000000040), 0x1, &(0x7f0000000080)) waitid$P_PIDFD(0x3, 0xffffffffffffffff, &(0x7f0000000140), 0x40000002, &(0x7f00000001c0)) shmget$private(0x0, 0x3000, 0x20, &(0x7f0000ffa000/0x3000)=nil) sendmsg$SEG6_CMD_SETHMAC(0xffffffffffffffff, &(0x7f0000000380)={&(0x7f0000000280)={0x10, 0x0, 0x0, 0x2}, 0xc, &(0x7f0000000340)={&(0x7f00000002c0)={0x48, 0x0, 0x10, 0x70bd25, 0x25dfdbff, {}, [@SEG6_ATTR_ALGID={0x5, 0x6, 0x4}, @SEG6_ATTR_ALGID={0x5, 0x6, 0x20}, @SEG6_ATTR_ALGID={0x5, 0x6, 0x8}, @SEG6_ATTR_HMACKEYID={0x8, 0x3, 0x1}, @SEG6_ATTR_SECRETLEN={0x5, 0x5, 0x5}, @SEG6_ATTR_SECRET={0x4}, @SEG6_ATTR_DSTLEN={0x8, 0x2, 0x1f}]}, 0x48}}, 0x0) r0 = openat$vcsa(0xffffffffffffff9c, &(0x7f00000003c0), 0x48000, 0x0) ioctl$SNDRV_TIMER_IOCTL_START(r0, 0x54a0) syz_open_procfs(0x0, &(0x7f0000000400)='smaps_rollup\x00') shmget(0x1, 0x3000, 0x20, &(0x7f0000ffc000/0x3000)=nil) 17:44:45 executing program 5: clock_gettime(0x5, &(0x7f0000000000)) clock_settime(0x2, &(0x7f0000000040)) sched_rr_get_interval(0xffffffffffffffff, &(0x7f0000000080)) sched_rr_get_interval(0x0, &(0x7f00000000c0)) sendmsg$NL802154_CMD_GET_SEC_KEY(0xffffffffffffffff, &(0x7f00000001c0)={&(0x7f0000000100)={0x10, 0x0, 0x0, 0x20000000}, 0xc, &(0x7f0000000180)={&(0x7f0000000140)={0x24, 0x0, 0x200, 0x70bd26, 0x25dfdbfe, {}, [@NL802154_ATTR_IFINDEX={0x8}, @NL802154_ATTR_IFINDEX={0x8}]}, 0x24}, 0x1, 0x0, 0x0, 0x4000000}, 0x181) clock_gettime(0x0, &(0x7f0000000200)) pipe2$9p(&(0x7f0000000240)={0xffffffffffffffff, 0xffffffffffffffff}, 0x800) r1 = syz_io_uring_setup(0x776a, &(0x7f0000000280)={0x0, 0x2728, 0x2, 0x1, 0x37c}, &(0x7f0000000000/0x3000)=nil, &(0x7f0000000000/0x400000)=nil, &(0x7f0000000300), &(0x7f0000000340)) ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, &(0x7f0000000540)={0x64, 0x0, &(0x7f0000000440)=[@transaction_sg={0x40486311, {0x1, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x50, 0x18, &(0x7f0000000380)={@fd={0x66642a85, 0x0, r0}, @fd={0x66642a85, 0x0, r1}, @fda={0x66646185, 0x0, 0x2, 0x36}}, &(0x7f0000000400)={0x0, 0x18, 0x30}}}, @request_death, @release={0x40046306, 0x1}], 0x7e, 0x0, &(0x7f00000004c0)="7685c519d1cbea63a1a8f022f8c0085baf770aa5d1fa9bfb1a5399fdb134953d619e962218bba650b68d6206fde39ff17760aa4bbcb62f6802c48e17294a17a3b768ab60bbae37aa37e33e24b09f6bdea37853f7ab2622451803788c9d172b7d71d6d87911129b8ef5cc9e0169404b09abfa991f3a7a3640686df445d387"}) pipe2$9p(&(0x7f0000000580), 0x800) ioctl$EVIOCGVERSION(0xffffffffffffffff, 0x80044501, &(0x7f00000005c0)=""/174) r2 = openat$nvram(0xffffffffffffff9c, &(0x7f0000000680), 0x400, 0x0) write$P9_RSTAT(r2, &(0x7f00000006c0)={0x3f, 0x7d, 0x1, {0x0, 0x38, 0x401, 0x8000, {0x80, 0x4, 0x1}, 0x2020000, 0x4, 0x60, 0x9, 0x1, '\x00', 0x2, '.-', 0x1, '\x00', 0x1, '\x00'}}, 0x3f) r3 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r4 = syz_genetlink_get_family_id$ieee802154(&(0x7f0000000740), 0xffffffffffffffff) sendmsg$IEEE802154_LLSEC_DEL_KEY(r3, &(0x7f0000000840)={&(0x7f0000000700)={0x10, 0x0, 0x0, 0x800000}, 0xc, &(0x7f0000000800)={&(0x7f0000000780)={0x54, r4, 0x800, 0x70bd27, 0x25dfdbfc, {}, [@IEEE802154_ATTR_LLSEC_KEY_SOURCE_SHORT={0x8, 0x2c, 0x5}, @IEEE802154_ATTR_LLSEC_KEY_SOURCE_EXTENDED={0xc, 0x2d, {0xaaaaaaaaaaaa0002}}, @IEEE802154_ATTR_PAN_ID={0x6, 0x6, 0x2}, @IEEE802154_ATTR_DEV_INDEX={0x8}, @IEEE802154_ATTR_LLSEC_KEY_MODE={0x5, 0x2b, 0x1}, @IEEE802154_ATTR_HW_ADDR={0xc, 0x5, {0xaaaaaaaaaaaa0002}}, @IEEE802154_ATTR_LLSEC_KEY_MODE={0x5, 0x2b, 0x3}]}, 0x54}, 0x1, 0x0, 0x0, 0x40}, 0x2000c814) clock_getres(0x3, &(0x7f0000000880)) clock_getres(0x6, &(0x7f00000008c0)) sendmsg$IEEE802154_ADD_IFACE(0xffffffffffffffff, &(0x7f0000000a00)={&(0x7f0000000900)={0x10, 0x0, 0x0, 0x40c}, 0xc, &(0x7f00000009c0)={&(0x7f0000000940)={0x44, r4, 0x200, 0x70bd29, 0x25dfdbfe, {}, [@IEEE802154_ATTR_PHY_NAME={0x9, 0x1f, 'phy1\x00'}, @IEEE802154_ATTR_DEV_NAME={0xa, 0x1, 'wpan4\x00'}, @IEEE802154_ATTR_DEV_NAME={0xa, 0x1, 'wpan1\x00'}, @IEEE802154_ATTR_DEV_NAME={0xa, 0x1, 'wpan0\x00'}]}, 0x44}, 0x1, 0x0, 0x0, 0x20000084}, 0x44000) 17:44:45 executing program 1: shmget$private(0x0, 0x4000, 0x80, &(0x7f0000ffb000/0x4000)=nil) shmget(0x3, 0x2000, 0x4, &(0x7f0000ffc000/0x2000)=nil) mlock(&(0x7f0000ff0000/0x10000)=nil, 0x10000) shmget(0x1, 0x1000, 0x10, &(0x7f0000ff5000/0x1000)=nil) ioctl$sock_ipv4_tunnel_SIOCGETTUNNEL(0xffffffffffffffff, 0x89f0, &(0x7f0000000140)={'syztnl1\x00', &(0x7f00000000c0)={'syztnl2\x00', 0x0, 0x20, 0x1, 0x6, 0x9, {{0xd, 0x4, 0x1, 0x19, 0x34, 0x68, 0x0, 0x9, 0x29, 0x0, @empty, @dev={0xac, 0x14, 0x14, 0x29}, {[@timestamp_addr={0x44, 0x14, 0xc2, 0x1, 0x4, [{@multicast1}, {@private=0xa010101}]}, @rr={0x7, 0xb, 0xc8, [@initdev={0xac, 0x1e, 0x1, 0x0}, @private=0xa010102]}]}}}}}) ioctl$sock_ipv4_tunnel_SIOCADDTUNNEL(0xffffffffffffffff, 0x89f1, &(0x7f0000000280)={'tunl0\x00', &(0x7f0000000180)={'tunl0\x00', r0, 0x7, 0x8000, 0xfffffffc, 0x8, {{0x2f, 0x4, 0x0, 0x2, 0xbc, 0x65, 0x0, 0x0, 0x4, 0x0, @empty, @broadcast, {[@generic={0x89, 0x9, "8db1d464c6af68"}, @noop, @ra={0x94, 0x4, 0x1}, @timestamp={0x44, 0x1c, 0x53, 0x0, 0x7, [0x40, 0x7fffffff, 0xfffffffd, 0x5, 0x5c, 0x77]}, @cipso={0x86, 0x2f, 0x3, [{0x1, 0x4, "1eba"}, {0x1, 0x7, "e3ccb5ddcf"}, {0x6, 0xa, "5db18b961780af33"}, {0x2, 0xe, "7353a9824b57fd7d39232ac5"}, {0x1, 0x6, "2e1ccd27"}]}, @noop, @cipso={0x86, 0x37, 0xffffffffffffffff, [{0x2, 0xf, "227467028cabd4e137b820c5c9"}, {0x7, 0x6, "90569992"}, {0x2, 0xc, "2071b0a8c9ce92782e72"}, {0x6, 0xa, "14f2b9bca55ce3dd"}, {0x6, 0x6, "2cd22a8f"}]}, @timestamp={0x44, 0x14, 0xd4, 0x0, 0x5, [0x81, 0x5d23, 0x63ab, 0x1]}]}}}}}) ioctl$sock_ipv4_tunnel_SIOCDELTUNNEL(0xffffffffffffffff, 0x89f2, &(0x7f0000000380)={'gretap0\x00', &(0x7f00000002c0)={'syztnl2\x00', 0x0, 0x7800, 0x7, 0x40, 0xe180, {{0x22, 0x4, 0x0, 0x1, 0x88, 0x64, 0x0, 0x1, 0x29, 0x0, @multicast2, @multicast1, {[@end, @lsrr={0x83, 0x1f, 0x2f, [@multicast2, @local, @local, @multicast1, @rand_addr=0x64010102, @loopback, @private=0xa010100]}, @rr={0x7, 0x27, 0x6c, [@multicast1, @rand_addr=0x64010102, @remote, @multicast1, @loopback, @initdev={0xac, 0x1e, 0x0, 0x0}, @initdev={0xac, 0x1e, 0x1, 0x0}, @broadcast, @empty]}, @ra={0x94, 0x4, 0x1}, @timestamp={0x44, 0x10, 0x2d, 0x0, 0x8, [0x1, 0x100, 0x401]}, @ssrr={0x89, 0x13, 0x56, [@dev={0xac, 0x14, 0x14, 0x28}, @multicast2, @initdev={0xac, 0x1e, 0x0, 0x0}, @remote]}, @ra={0x94, 0x4, 0x1}]}}}}}) shmget(0x3, 0x4000, 0x4, &(0x7f0000ff9000/0x4000)=nil) mmap$IORING_OFF_CQ_RING(&(0x7f0000ffd000/0x3000)=nil, 0x3000, 0x2000008, 0x30, 0xffffffffffffffff, 0x8000000) r1 = syz_genetlink_get_family_id$nl802154(&(0x7f0000000400), 0xffffffffffffffff) ioctl$sock_SIOCGIFINDEX_802154(0xffffffffffffffff, 0x8933, &(0x7f0000000440)={'wpan1\x00', 0x0}) sendmsg$NL802154_CMD_NEW_INTERFACE(0xffffffffffffffff, &(0x7f0000000540)={&(0x7f00000003c0)={0x10, 0x0, 0x0, 0x2}, 0xc, &(0x7f0000000500)={&(0x7f0000000480)={0x48, r1, 0x200, 0x70bd2a, 0x25dfdbfd, {}, [@NL802154_ATTR_IFNAME={0xa, 0x4, 'wpan0\x00'}, @NL802154_ATTR_IFINDEX={0x8}, @NL802154_ATTR_IFNAME={0xa, 0x4, 'wpan1\x00'}, @NL802154_ATTR_EXTENDED_ADDR={0xc, 0x17, {0xaaaaaaaaaaaa0002}}, @NL802154_ATTR_IFINDEX={0x8, 0x3, r2}]}, 0x48}}, 0x4001) mmap$binder(&(0x7f0000fef000/0x11000)=nil, 0x11000, 0x1, 0x11, 0xffffffffffffffff, 0x6) shmget$private(0x0, 0x4000, 0x200, &(0x7f0000ffc000/0x4000)=nil) r3 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) ioctl$sock_SIOCGIFINDEX_802154(0xffffffffffffffff, 0x8933, &(0x7f00000005c0)={'wpan0\x00', 0x0}) sendmsg$IEEE802154_LLSEC_ADD_SECLEVEL(r3, &(0x7f00000006c0)={&(0x7f0000000580)={0x10, 0x0, 0x0, 0x4000000}, 0xc, &(0x7f0000000680)={&(0x7f0000000600)={0x44, 0x0, 0x200, 0x70bd2a, 0x25dfdbff, {}, [@IEEE802154_ATTR_LLSEC_FRAME_TYPE={0x5, 0x33, 0x34}, @IEEE802154_ATTR_DEV_INDEX={0x8, 0x2, r4}, @IEEE802154_ATTR_LLSEC_CMD_FRAME_ID={0x5, 0x34, 0x1}, @IEEE802154_ATTR_DEV_NAME={0xa, 0x1, 'wpan0\x00'}, @IEEE802154_ATTR_DEV_NAME={0xa, 0x1, 'wpan4\x00'}]}, 0x44}, 0x1, 0x0, 0x0, 0x8800}, 0x0) sendmsg$IEEE802154_START_REQ(r3, &(0x7f00000007c0)={&(0x7f0000000700)={0x10, 0x0, 0x0, 0x4}, 0xc, &(0x7f0000000780)={&(0x7f0000000740)={0x1c, 0x0, 0x200, 0x70bd2d, 0x25dfdbfb, {}, [@IEEE802154_ATTR_CHANNEL={0x5, 0x7, 0x6}]}, 0x1c}, 0x1, 0x0, 0x0, 0x40100}, 0x801) syz_io_uring_setup(0x4726, &(0x7f0000000840)={0x0, 0x502f, 0x20, 0x0, 0x12e}, &(0x7f0000ffe000/0x2000)=nil, &(0x7f0000ffb000/0x4000)=nil, &(0x7f00000008c0), &(0x7f0000000900)) 17:44:45 executing program 7: r0 = perf_event_open(&(0x7f0000000040)={0x4, 0x80, 0x6f, 0x8, 0x8, 0x1, 0x0, 0x6, 0x4, 0x1, 0x1, 0x0, 0x0, 0x1, 0x1, 0x1, 0x0, 0x0, 0x1, 0x0, 0x0, 0x1, 0x1, 0x0, 0x0, 0x2, 0x1, 0x0, 0x0, 0x1, 0x0, 0x0, 0x1, 0x0, 0x1, 0x0, 0x0, 0x0, 0x1, 0x1, 0x1, 0x0, 0x1, 0x1, 0x1, 0x0, 0x1, 0x0, 0x50, 0x2, @perf_bp={&(0x7f0000000000), 0xa}, 0x2100, 0x7, 0x1, 0x3, 0x6, 0x93d3, 0x0, 0x0, 0x3a, 0x0, 0x9}, 0xffffffffffffffff, 0xc, 0xffffffffffffffff, 0x8) mmap$perf(&(0x7f0000ffb000/0x2000)=nil, 0x2000, 0xb, 0x11, r0, 0x8) munmap(&(0x7f0000ffb000/0x3000)=nil, 0x3000) getsockopt$inet6_tcp_TCP_ZEROCOPY_RECEIVE(0xffffffffffffffff, 0x6, 0x23, &(0x7f0000001180)={&(0x7f0000ffd000/0x2000)=nil, 0x2000, 0x0, 0x0, 0x0, &(0x7f00000000c0)=""/162, 0xa2, 0x0, &(0x7f0000000180)=""/4096, 0x1000}, &(0x7f00000011c0)=0x40) r1 = openat$vcsa(0xffffffffffffff9c, &(0x7f0000001200), 0x14d080, 0x0) ioctl$SNDRV_SEQ_IOCTL_SUBSCRIBE_PORT(r1, 0x40505330, &(0x7f0000001240)={{0x3f, 0x40}, {0x9, 0x2}, 0x43, 0x0, 0x1}) r2 = mmap$binder(&(0x7f0000ffc000/0x1000)=nil, 0x1000, 0x1, 0x11, r1, 0x81) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000001380)={0x44, 0x0, &(0x7f00000012c0)=[@acquire={0x40046305, 0x3}, @increfs, @free_buffer={0x40086303, r2}, @exit_looper, @request_death={0x400c630e, 0x3}, @increfs={0x40046304, 0x2}, @free_buffer], 0x1d, 0x0, &(0x7f0000001340)="63170b84a45d435cf194bbb38c0432388cb6578156ee80dc59b93c914c"}) r3 = openat$vcsa(0xffffffffffffff9c, &(0x7f00000013c0), 0x400000, 0x0) ioctl$SNDRV_SEQ_IOCTL_GET_SUBSCRIPTION(r3, 0xc0505350, &(0x7f0000001400)={{0x1, 0x6}, {0x1f, 0x81}, 0x4, 0x3, 0x7}) r4 = openat$nvram(0xffffffffffffff9c, &(0x7f0000001480), 0x105500, 0x0) mmap$IORING_OFF_SQ_RING(&(0x7f0000ffd000/0x1000)=nil, 0x1000, 0x0, 0x13, r4, 0x0) munmap(&(0x7f0000ffc000/0x2000)=nil, 0x2000) setsockopt$inet_tcp_TLS_TX(r3, 0x6, 0x1, &(0x7f00000014c0)=@gcm_128={{0x304}, "c7158b5e86708544", "366c7e9fd1d7fe2728acf2d3b734f3db", "b710fe41", "ad55c6ad971e7ae7"}, 0x28) mlock(&(0x7f0000ffd000/0x1000)=nil, 0x1000) ioctl$SECCOMP_IOCTL_NOTIF_RECV(r3, 0xc0502100, &(0x7f0000001500)={0x0, 0x0}) move_pages(r5, 0x2, &(0x7f0000001580)=[&(0x7f0000ffd000/0x3000)=nil, &(0x7f0000ffd000/0x1000)=nil], &(0x7f00000015c0)=[0x2, 0x6, 0x3, 0x400], &(0x7f0000001600)=[0x0, 0x0, 0x0, 0x0, 0x0, 0x0], 0x1) shmget(0x0, 0x1000, 0x200, &(0x7f0000ffd000/0x1000)=nil) 17:44:45 executing program 3: getsockopt$inet_udp_int(0xffffffffffffffff, 0x11, 0x1, &(0x7f0000000000), &(0x7f0000000040)=0x4) setsockopt$inet_udp_int(0xffffffffffffffff, 0x11, 0x1, &(0x7f0000000080)=0x7, 0x4) ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, &(0x7f0000000240)={0x54, 0x0, &(0x7f00000000c0)=[@acquire_done={0x40106309, 0x1}, @free_buffer, @request_death={0x400c630e, 0x1}, @request_death, @decrefs, @dead_binder_done], 0xc7, 0x0, &(0x7f0000000140)="aa36e0fef6a6cd3a6060f434b2a2306a435d6c33ca3bfb20c9d046886ded10cf23d0938b55b8a812702a5a7579cb8813f0cf3954f24fa081e8c35a9d4674b51115d91e7f6e38920909a8fba27ba7bbb0522974a9d83826c23d40a56c3f88dc24276a8312ae50d15d3531211e4378a34980ea70ac3cefef2439af0baa6b387df4ff26b593ca52e94dda8ce3656a81180693ab97746e30b1301f30922ec565bba820fc06168927e446c06efe1fc7cb37b804ba0342e58e70da81c074407ec9cf690a9ab1e3a62a68"}) r0 = openat$vcsa(0xffffffffffffff9c, &(0x7f0000000280), 0x1, 0x0) r1 = openat$vcsa(0xffffffffffffff9c, &(0x7f00000002c0), 0x80, 0x0) ioctl$SNDRV_SEQ_IOCTL_QUERY_NEXT_PORT(r0, 0xc0a85352, &(0x7f0000000300)={{0x4, 0x6}, 'port0\x00', 0x5, 0x1, 0x0, 0xffff, 0x7, 0x7, 0x5, 0x0, 0x2, 0xc0}) ioctl$SNDRV_SEQ_IOCTL_QUERY_NEXT_CLIENT(r1, 0xc0bc5351, &(0x7f00000003c0)={0xffff7fff, 0x0, 'client0\x00', 0xffffffff80000002, "9aa89fbb0e155330", "7e3a03465d7350a6322e39e7997e8c634c3224eb46d1223d24ed4ce35c7b1dd2", 0x0, 0x6}) r2 = openat$nvram(0xffffffffffffff9c, &(0x7f0000000480), 0x1, 0x0) ioctl$PERF_EVENT_IOC_PAUSE_OUTPUT(r2, 0x40042409, 0x0) process_mrelease(r0, 0x0) ioctl$SNDRV_TIMER_IOCTL_TREAD(r1, 0x40045402, &(0x7f00000004c0)) r3 = socket$inet_udp(0x2, 0x2, 0x0) ioctl$sock_inet_udp_SIOCINQ(r3, 0x541b, &(0x7f0000000500)) getsockopt$inet_IP_IPSEC_POLICY(r0, 0x0, 0x10, &(0x7f0000000540)={{{@in=@broadcast, @in6=@mcast1}}, {{@in=@broadcast}, 0x0, @in6=@mcast2}}, &(0x7f0000000640)=0xe8) setsockopt$inet_udp_encap(r1, 0x11, 0x64, &(0x7f0000000680)=0x3, 0x4) r4 = syz_open_procfs(0xffffffffffffffff, &(0x7f00000006c0)='net/packet\x00') pidfd_getfd(r4, 0xffffffffffffffff, 0x0) write$P9_RGETLOCK(0xffffffffffffffff, &(0x7f00000007c0)={0x1e, 0x37, 0x2, {0x2, 0x6, 0x101}}, 0x1e) 17:44:45 executing program 0: get_thread_area(&(0x7f0000000000)={0x7, 0x20000800, 0x4000, 0x0, 0x1, 0x0, 0x0, 0x1, 0x1, 0x1}) r0 = openat$vcsu(0xffffffffffffff9c, &(0x7f0000000040), 0x200000, 0x0) getsockopt$inet_tcp_TCP_REPAIR_WINDOW(r0, 0x6, 0x1d, &(0x7f0000000080), &(0x7f00000000c0)=0x14) r1 = openat$nvram(0xffffffffffffff9c, &(0x7f0000000100), 0x2000, 0x0) setsockopt$inet_tcp_TCP_FASTOPEN_KEY(r1, 0x6, 0x21, &(0x7f0000000140)="1bb9d563048b6ec78effc0f14d974b17", 0x10) setsockopt$inet_tcp_int(r1, 0x6, 0x1b, &(0x7f0000000180)=0x5, 0x4) ioctl$SNDRV_TIMER_IOCTL_STATUS32(r1, 0x80585414, &(0x7f00000001c0)) setsockopt$inet_tcp_TCP_QUEUE_SEQ(r0, 0x6, 0x15, &(0x7f0000000240)=0x1, 0x4) getsockopt$inet_tcp_TCP_ZEROCOPY_RECEIVE(r1, 0x6, 0x23, &(0x7f0000000340)={&(0x7f0000ffc000/0x2000)=nil, 0x2000, 0x0, 0x0, 0x0, &(0x7f0000000280)=""/37, 0x25, 0x1, &(0x7f00000002c0)=""/109, 0x6d}, &(0x7f0000000380)=0x40) r2 = socket$inet_tcp(0x2, 0x1, 0x0) ioctl$sock_inet_tcp_SIOCINQ(r2, 0x541b, &(0x7f00000003c0)) move_pages(0x0, 0x8, &(0x7f0000000400)=[&(0x7f0000ffd000/0x1000)=nil, &(0x7f0000ffd000/0x3000)=nil, &(0x7f0000ffd000/0x3000)=nil, &(0x7f0000ffb000/0x2000)=nil, &(0x7f0000ffc000/0x1000)=nil, &(0x7f0000ffe000/0x2000)=nil, &(0x7f0000ffb000/0x4000)=nil, &(0x7f0000ffd000/0x3000)=nil], &(0x7f0000000440)=[0xfff], &(0x7f0000000480)=[0x0, 0x0, 0x0], 0x4) r3 = syz_genetlink_get_family_id$SEG6(&(0x7f0000000500), r1) sendmsg$SEG6_CMD_GET_TUNSRC(r0, &(0x7f00000005c0)={&(0x7f00000004c0)={0x10, 0x0, 0x0, 0x4000000}, 0xc, &(0x7f0000000580)={&(0x7f0000000540)={0x38, r3, 0x300, 0x70bd2a, 0x25dfdbfc, {}, [@SEG6_ATTR_HMACKEYID={0x8, 0x3, 0x24}, @SEG6_ATTR_DST={0x14, 0x1, @mcast1}, @SEG6_ATTR_DSTLEN={0x8, 0x2, 0x2}]}, 0x38}, 0x1, 0x0, 0x0, 0x20008810}, 0x4040010) ioctl$SNDRV_SEQ_IOCTL_SET_QUEUE_TIMER(r1, 0x40605346, &(0x7f0000000600)={0x80, 0x1, {0x1, 0x0, 0x81}, 0x2}) sendmsg$SEG6_CMD_DUMPHMAC(0xffffffffffffffff, &(0x7f0000000740)={&(0x7f0000000680)={0x10, 0x0, 0x0, 0x240000}, 0xc, &(0x7f0000000700)={&(0x7f00000006c0)={0x2c, r3, 0x1, 0x70bd2c, 0x25dfdbfe, {}, [@SEG6_ATTR_SECRET={0x8, 0x4, [0x1]}, @SEG6_ATTR_DSTLEN={0x8, 0x2, 0x5}, @SEG6_ATTR_DSTLEN={0x8}]}, 0x2c}, 0x1, 0x0, 0x0, 0x4000000}, 0x4000000) pidfd_getfd(r1, r2, 0x0) syz_genetlink_get_family_id$ieee802154(&(0x7f0000000800), 0xffffffffffffffff) 17:44:54 executing program 4: ioctl$SNDRV_TIMER_IOCTL_TREAD(0xffffffffffffffff, 0x40045402, &(0x7f0000000000)) wait4(0xffffffffffffffff, &(0x7f0000000040), 0x1, &(0x7f0000000080)) waitid$P_PIDFD(0x3, 0xffffffffffffffff, &(0x7f0000000140), 0x40000002, &(0x7f00000001c0)) shmget$private(0x0, 0x3000, 0x20, &(0x7f0000ffa000/0x3000)=nil) sendmsg$SEG6_CMD_SETHMAC(0xffffffffffffffff, &(0x7f0000000380)={&(0x7f0000000280)={0x10, 0x0, 0x0, 0x2}, 0xc, &(0x7f0000000340)={&(0x7f00000002c0)={0x48, 0x0, 0x10, 0x70bd25, 0x25dfdbff, {}, [@SEG6_ATTR_ALGID={0x5, 0x6, 0x4}, @SEG6_ATTR_ALGID={0x5, 0x6, 0x20}, @SEG6_ATTR_ALGID={0x5, 0x6, 0x8}, @SEG6_ATTR_HMACKEYID={0x8, 0x3, 0x1}, @SEG6_ATTR_SECRETLEN={0x5, 0x5, 0x5}, @SEG6_ATTR_SECRET={0x4}, @SEG6_ATTR_DSTLEN={0x8, 0x2, 0x1f}]}, 0x48}}, 0x0) r0 = openat$vcsa(0xffffffffffffff9c, &(0x7f00000003c0), 0x48000, 0x0) ioctl$SNDRV_TIMER_IOCTL_START(r0, 0x54a0) shmget(0x1, 0x3000, 0x20, &(0x7f0000ffc000/0x3000)=nil) 17:44:54 executing program 1: shmget$private(0x0, 0x4000, 0x80, &(0x7f0000ffb000/0x4000)=nil) shmget(0x3, 0x2000, 0x4, &(0x7f0000ffc000/0x2000)=nil) mlock(&(0x7f0000ff0000/0x10000)=nil, 0x10000) shmget(0x1, 0x1000, 0x10, &(0x7f0000ff5000/0x1000)=nil) ioctl$sock_ipv4_tunnel_SIOCGETTUNNEL(0xffffffffffffffff, 0x89f0, &(0x7f0000000140)={'syztnl1\x00', &(0x7f00000000c0)={'syztnl2\x00', 0x0, 0x20, 0x1, 0x6, 0x9, {{0xd, 0x4, 0x1, 0x19, 0x34, 0x68, 0x0, 0x9, 0x29, 0x0, @empty, @dev={0xac, 0x14, 0x14, 0x29}, {[@timestamp_addr={0x44, 0x14, 0xc2, 0x1, 0x4, [{@multicast1}, {@private=0xa010101}]}, @rr={0x7, 0xb, 0xc8, [@initdev={0xac, 0x1e, 0x1, 0x0}, @private=0xa010102]}]}}}}}) ioctl$sock_ipv4_tunnel_SIOCADDTUNNEL(0xffffffffffffffff, 0x89f1, &(0x7f0000000280)={'tunl0\x00', &(0x7f0000000180)={'tunl0\x00', r0, 0x7, 0x8000, 0xfffffffc, 0x8, {{0x2f, 0x4, 0x0, 0x2, 0xbc, 0x65, 0x0, 0x0, 0x4, 0x0, @empty, @broadcast, {[@generic={0x89, 0x9, "8db1d464c6af68"}, @noop, @ra={0x94, 0x4, 0x1}, @timestamp={0x44, 0x1c, 0x53, 0x0, 0x7, [0x40, 0x7fffffff, 0xfffffffd, 0x5, 0x5c, 0x77]}, @cipso={0x86, 0x2f, 0x3, [{0x1, 0x4, "1eba"}, {0x1, 0x7, "e3ccb5ddcf"}, {0x6, 0xa, "5db18b961780af33"}, {0x2, 0xe, "7353a9824b57fd7d39232ac5"}, {0x1, 0x6, "2e1ccd27"}]}, @noop, @cipso={0x86, 0x37, 0xffffffffffffffff, [{0x2, 0xf, "227467028cabd4e137b820c5c9"}, {0x7, 0x6, "90569992"}, {0x2, 0xc, "2071b0a8c9ce92782e72"}, {0x6, 0xa, "14f2b9bca55ce3dd"}, {0x6, 0x6, "2cd22a8f"}]}, @timestamp={0x44, 0x14, 0xd4, 0x0, 0x5, [0x81, 0x5d23, 0x63ab, 0x1]}]}}}}}) ioctl$sock_ipv4_tunnel_SIOCDELTUNNEL(0xffffffffffffffff, 0x89f2, &(0x7f0000000380)={'gretap0\x00', &(0x7f00000002c0)={'syztnl2\x00', 0x0, 0x7800, 0x7, 0x40, 0xe180, {{0x22, 0x4, 0x0, 0x1, 0x88, 0x64, 0x0, 0x1, 0x29, 0x0, @multicast2, @multicast1, {[@end, @lsrr={0x83, 0x1f, 0x2f, [@multicast2, @local, @local, @multicast1, @rand_addr=0x64010102, @loopback, @private=0xa010100]}, @rr={0x7, 0x27, 0x6c, [@multicast1, @rand_addr=0x64010102, @remote, @multicast1, @loopback, @initdev={0xac, 0x1e, 0x0, 0x0}, @initdev={0xac, 0x1e, 0x1, 0x0}, @broadcast, @empty]}, @ra={0x94, 0x4, 0x1}, @timestamp={0x44, 0x10, 0x2d, 0x0, 0x8, [0x1, 0x100, 0x401]}, @ssrr={0x89, 0x13, 0x56, [@dev={0xac, 0x14, 0x14, 0x28}, @multicast2, @initdev={0xac, 0x1e, 0x0, 0x0}, @remote]}, @ra={0x94, 0x4, 0x1}]}}}}}) shmget(0x3, 0x4000, 0x4, &(0x7f0000ff9000/0x4000)=nil) mmap$IORING_OFF_CQ_RING(&(0x7f0000ffd000/0x3000)=nil, 0x3000, 0x2000008, 0x30, 0xffffffffffffffff, 0x8000000) r1 = syz_genetlink_get_family_id$nl802154(&(0x7f0000000400), 0xffffffffffffffff) ioctl$sock_SIOCGIFINDEX_802154(0xffffffffffffffff, 0x8933, &(0x7f0000000440)={'wpan1\x00', 0x0}) sendmsg$NL802154_CMD_NEW_INTERFACE(0xffffffffffffffff, &(0x7f0000000540)={&(0x7f00000003c0)={0x10, 0x0, 0x0, 0x2}, 0xc, &(0x7f0000000500)={&(0x7f0000000480)={0x48, r1, 0x200, 0x70bd2a, 0x25dfdbfd, {}, [@NL802154_ATTR_IFNAME={0xa, 0x4, 'wpan0\x00'}, @NL802154_ATTR_IFINDEX={0x8}, @NL802154_ATTR_IFNAME={0xa, 0x4, 'wpan1\x00'}, @NL802154_ATTR_EXTENDED_ADDR={0xc, 0x17, {0xaaaaaaaaaaaa0002}}, @NL802154_ATTR_IFINDEX={0x8, 0x3, r2}]}, 0x48}}, 0x4001) mmap$binder(&(0x7f0000fef000/0x11000)=nil, 0x11000, 0x1, 0x11, 0xffffffffffffffff, 0x6) shmget$private(0x0, 0x4000, 0x200, &(0x7f0000ffc000/0x4000)=nil) r3 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) ioctl$sock_SIOCGIFINDEX_802154(0xffffffffffffffff, 0x8933, &(0x7f00000005c0)={'wpan0\x00', 0x0}) sendmsg$IEEE802154_LLSEC_ADD_SECLEVEL(r3, &(0x7f00000006c0)={&(0x7f0000000580)={0x10, 0x0, 0x0, 0x4000000}, 0xc, &(0x7f0000000680)={&(0x7f0000000600)={0x44, 0x0, 0x200, 0x70bd2a, 0x25dfdbff, {}, [@IEEE802154_ATTR_LLSEC_FRAME_TYPE={0x5, 0x33, 0x34}, @IEEE802154_ATTR_DEV_INDEX={0x8, 0x2, r4}, @IEEE802154_ATTR_LLSEC_CMD_FRAME_ID={0x5, 0x34, 0x1}, @IEEE802154_ATTR_DEV_NAME={0xa, 0x1, 'wpan0\x00'}, @IEEE802154_ATTR_DEV_NAME={0xa, 0x1, 'wpan4\x00'}]}, 0x44}, 0x1, 0x0, 0x0, 0x8800}, 0x0) sendmsg$IEEE802154_START_REQ(r3, &(0x7f00000007c0)={&(0x7f0000000700)={0x10, 0x0, 0x0, 0x4}, 0xc, &(0x7f0000000780)={&(0x7f0000000740)={0x1c, 0x0, 0x200, 0x70bd2d, 0x25dfdbfb, {}, [@IEEE802154_ATTR_CHANNEL={0x5, 0x7, 0x6}]}, 0x1c}, 0x1, 0x0, 0x0, 0x40100}, 0x801) syz_io_uring_setup(0x4726, &(0x7f0000000840)={0x0, 0x502f, 0x20, 0x0, 0x12e}, &(0x7f0000ffe000/0x2000)=nil, &(0x7f0000ffb000/0x4000)=nil, &(0x7f00000008c0), &(0x7f0000000900)) 17:44:54 executing program 6: r0 = perf_event_open(&(0x7f00000000c0)={0x1, 0x80, 0x0, 0xc0, 0xfa, 0x1, 0x0, 0x7fffffff, 0x10811, 0x1, 0x1, 0x1, 0x1, 0x1, 0x1, 0x1, 0x1, 0x1, 0x0, 0x1, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x1, 0x0, 0x1, 0x0, 0x0, 0x0, 0x1, 0x1, 0x1, 0x1, 0x1, 0x1, 0x1, 0x0, 0x1, 0x1, 0x1, 0x1, 0x0, 0x0, 0xfff, 0x7, @perf_config_ext={0x7, 0x7fffffff}, 0x41000, 0x80000000, 0x5, 0x3, 0x9, 0x2, 0x9, 0x0, 0x5, 0x0, 0x4}, 0x0, 0xb, 0xffffffffffffffff, 0x1) perf_event_open(&(0x7f0000000040)={0x0, 0x80, 0x0, 0x40, 0x80, 0x9, 0x0, 0x3, 0x10040, 0x1, 0x0, 0x0, 0x1, 0x1, 0x1, 0x1, 0x1, 0x1, 0x1, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x3, 0x1, 0x0, 0x1, 0x0, 0x1, 0x1, 0x0, 0x0, 0x1, 0x1, 0x1, 0x0, 0x1, 0x0, 0x0, 0x0, 0x1, 0x0, 0x1, 0x0, 0x1, 0x0, 0x0, 0x1, @perf_bp={&(0x7f0000000000), 0x10}, 0x8080, 0x800, 0x2, 0x3, 0x36dc, 0x31df3b33, 0xff, 0x0, 0x9, 0x0, 0x5}, 0xffffffffffffffff, 0x9, r0, 0x9) ioctl$PERF_EVENT_IOC_PAUSE_OUTPUT(r0, 0x40042409, 0x0) ioctl$PERF_EVENT_IOC_PERIOD(0xffffffffffffffff, 0x40082404, &(0x7f0000000140)=0x8) r1 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl$sock_ipv4_tunnel_SIOCADDTUNNEL(r1, 0x89f1, &(0x7f00000001c0)={'syztnl1\x00', &(0x7f0000000180)={'syztnl0\x00', 0x0, 0x1, 0x40, 0x0, 0x5, {{0x5, 0x4, 0x2, 0x19, 0x14, 0x65, 0x0, 0x1f, 0x4, 0x0, @multicast2, @remote}}}}) ioctl$PERF_EVENT_IOC_PERIOD(r0, 0x40082404, &(0x7f0000000200)=0x9) ioctl$SNDRV_SEQ_IOCTL_GET_PORT_INFO(0xffffffffffffffff, 0xc0a85322, &(0x7f0000000240)) ioctl$SNDRV_SEQ_IOCTL_SYSTEM_INFO(0xffffffffffffffff, 0xc0305302, &(0x7f0000000300)={0x9, 0x101, 0x1, 0x6, 0x3, 0x5}) r2 = syz_open_procfs(0x0, &(0x7f0000000340)='children\x00') openat$cgroup_type(r2, &(0x7f0000000380), 0x2, 0x0) ioctl$EVIOCGABS20(r2, 0x80184560, &(0x7f00000003c0)=""/4096) socket$inet6_tcp(0xa, 0x1, 0x0) r3 = openat$nvram(0xffffffffffffff9c, &(0x7f00000013c0), 0xdd0e52fd5a017ff5, 0x0) mmap$perf(&(0x7f0000ffe000/0x2000)=nil, 0x2000, 0x2000001, 0x10, r3, 0x4) r4 = openat$vcsu(0xffffffffffffff9c, &(0x7f0000001400), 0x280103, 0x0) ioctl$SNDRV_SEQ_IOCTL_QUERY_NEXT_PORT(r4, 0xc0a85352, &(0x7f0000001440)={{0x20, 0x1}, 'port1\x00', 0x88, 0x22, 0x7, 0x5, 0x1000000, 0x2, 0x10000, 0x0, 0x5, 0xf0}) write$cgroup_type(0xffffffffffffffff, &(0x7f0000001500), 0x9) 17:44:54 executing program 0: get_thread_area(&(0x7f0000000000)={0x7, 0x20000800, 0x4000, 0x0, 0x1, 0x0, 0x0, 0x1, 0x1, 0x1}) r0 = openat$vcsu(0xffffffffffffff9c, &(0x7f0000000040), 0x200000, 0x0) getsockopt$inet_tcp_TCP_REPAIR_WINDOW(r0, 0x6, 0x1d, &(0x7f0000000080), &(0x7f00000000c0)=0x14) r1 = openat$nvram(0xffffffffffffff9c, &(0x7f0000000100), 0x2000, 0x0) setsockopt$inet_tcp_TCP_FASTOPEN_KEY(r1, 0x6, 0x21, &(0x7f0000000140)="1bb9d563048b6ec78effc0f14d974b17", 0x10) setsockopt$inet_tcp_int(r1, 0x6, 0x1b, &(0x7f0000000180)=0x5, 0x4) ioctl$SNDRV_TIMER_IOCTL_STATUS32(r1, 0x80585414, &(0x7f00000001c0)) setsockopt$inet_tcp_TCP_QUEUE_SEQ(r0, 0x6, 0x15, &(0x7f0000000240)=0x1, 0x4) getsockopt$inet_tcp_TCP_ZEROCOPY_RECEIVE(r1, 0x6, 0x23, &(0x7f0000000340)={&(0x7f0000ffc000/0x2000)=nil, 0x2000, 0x0, 0x0, 0x0, &(0x7f0000000280)=""/37, 0x25, 0x1, &(0x7f00000002c0)=""/109, 0x6d}, &(0x7f0000000380)=0x40) r2 = socket$inet_tcp(0x2, 0x1, 0x0) ioctl$sock_inet_tcp_SIOCINQ(r2, 0x541b, &(0x7f00000003c0)) move_pages(0x0, 0x8, &(0x7f0000000400)=[&(0x7f0000ffd000/0x1000)=nil, &(0x7f0000ffd000/0x3000)=nil, &(0x7f0000ffd000/0x3000)=nil, &(0x7f0000ffb000/0x2000)=nil, &(0x7f0000ffc000/0x1000)=nil, &(0x7f0000ffe000/0x2000)=nil, &(0x7f0000ffb000/0x4000)=nil, &(0x7f0000ffd000/0x3000)=nil], &(0x7f0000000440)=[0xfff], &(0x7f0000000480)=[0x0, 0x0, 0x0], 0x4) r3 = syz_genetlink_get_family_id$SEG6(&(0x7f0000000500), r1) sendmsg$SEG6_CMD_GET_TUNSRC(r0, &(0x7f00000005c0)={&(0x7f00000004c0)={0x10, 0x0, 0x0, 0x4000000}, 0xc, &(0x7f0000000580)={&(0x7f0000000540)={0x38, r3, 0x300, 0x70bd2a, 0x25dfdbfc, {}, [@SEG6_ATTR_HMACKEYID={0x8, 0x3, 0x24}, @SEG6_ATTR_DST={0x14, 0x1, @mcast1}, @SEG6_ATTR_DSTLEN={0x8, 0x2, 0x2}]}, 0x38}, 0x1, 0x0, 0x0, 0x20008810}, 0x4040010) ioctl$SNDRV_SEQ_IOCTL_SET_QUEUE_TIMER(r1, 0x40605346, &(0x7f0000000600)={0x80, 0x1, {0x1, 0x0, 0x81}, 0x2}) sendmsg$SEG6_CMD_DUMPHMAC(0xffffffffffffffff, &(0x7f0000000740)={&(0x7f0000000680)={0x10, 0x0, 0x0, 0x240000}, 0xc, &(0x7f0000000700)={&(0x7f00000006c0)={0x2c, r3, 0x1, 0x70bd2c, 0x25dfdbfe, {}, [@SEG6_ATTR_SECRET={0x8, 0x4, [0x1]}, @SEG6_ATTR_DSTLEN={0x8, 0x2, 0x5}, @SEG6_ATTR_DSTLEN={0x8}]}, 0x2c}, 0x1, 0x0, 0x0, 0x4000000}, 0x4000000) syz_genetlink_get_family_id$ieee802154(&(0x7f0000000800), 0xffffffffffffffff) 17:44:54 executing program 5: clock_gettime(0x5, &(0x7f0000000000)) clock_settime(0x2, &(0x7f0000000040)) sched_rr_get_interval(0xffffffffffffffff, &(0x7f0000000080)) sched_rr_get_interval(0x0, &(0x7f00000000c0)) sendmsg$NL802154_CMD_GET_SEC_KEY(0xffffffffffffffff, &(0x7f00000001c0)={&(0x7f0000000100)={0x10, 0x0, 0x0, 0x20000000}, 0xc, &(0x7f0000000180)={&(0x7f0000000140)={0x24, 0x0, 0x200, 0x70bd26, 0x25dfdbfe, {}, [@NL802154_ATTR_IFINDEX={0x8}, @NL802154_ATTR_IFINDEX={0x8}]}, 0x24}, 0x1, 0x0, 0x0, 0x4000000}, 0x181) clock_gettime(0x0, &(0x7f0000000200)) pipe2$9p(&(0x7f0000000240)={0xffffffffffffffff, 0xffffffffffffffff}, 0x800) r1 = syz_io_uring_setup(0x776a, &(0x7f0000000280)={0x0, 0x2728, 0x2, 0x1, 0x37c}, &(0x7f0000000000/0x3000)=nil, &(0x7f0000000000/0x400000)=nil, &(0x7f0000000300), &(0x7f0000000340)) ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, &(0x7f0000000540)={0x64, 0x0, &(0x7f0000000440)=[@transaction_sg={0x40486311, {0x1, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x50, 0x18, &(0x7f0000000380)={@fd={0x66642a85, 0x0, r0}, @fd={0x66642a85, 0x0, r1}, @fda={0x66646185, 0x0, 0x2, 0x36}}, &(0x7f0000000400)={0x0, 0x18, 0x30}}}, @request_death, @release={0x40046306, 0x1}], 0x7e, 0x0, &(0x7f00000004c0)="7685c519d1cbea63a1a8f022f8c0085baf770aa5d1fa9bfb1a5399fdb134953d619e962218bba650b68d6206fde39ff17760aa4bbcb62f6802c48e17294a17a3b768ab60bbae37aa37e33e24b09f6bdea37853f7ab2622451803788c9d172b7d71d6d87911129b8ef5cc9e0169404b09abfa991f3a7a3640686df445d387"}) pipe2$9p(&(0x7f0000000580), 0x800) ioctl$EVIOCGVERSION(0xffffffffffffffff, 0x80044501, &(0x7f00000005c0)=""/174) r2 = openat$nvram(0xffffffffffffff9c, &(0x7f0000000680), 0x400, 0x0) write$P9_RSTAT(r2, &(0x7f00000006c0)={0x3f, 0x7d, 0x1, {0x0, 0x38, 0x401, 0x8000, {0x80, 0x4, 0x1}, 0x2020000, 0x4, 0x60, 0x9, 0x1, '\x00', 0x2, '.-', 0x1, '\x00', 0x1, '\x00'}}, 0x3f) r3 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r4 = syz_genetlink_get_family_id$ieee802154(&(0x7f0000000740), 0xffffffffffffffff) sendmsg$IEEE802154_LLSEC_DEL_KEY(r3, &(0x7f0000000840)={&(0x7f0000000700)={0x10, 0x0, 0x0, 0x800000}, 0xc, &(0x7f0000000800)={&(0x7f0000000780)={0x54, r4, 0x800, 0x70bd27, 0x25dfdbfc, {}, [@IEEE802154_ATTR_LLSEC_KEY_SOURCE_SHORT={0x8, 0x2c, 0x5}, @IEEE802154_ATTR_LLSEC_KEY_SOURCE_EXTENDED={0xc, 0x2d, {0xaaaaaaaaaaaa0002}}, @IEEE802154_ATTR_PAN_ID={0x6, 0x6, 0x2}, @IEEE802154_ATTR_DEV_INDEX={0x8}, @IEEE802154_ATTR_LLSEC_KEY_MODE={0x5, 0x2b, 0x1}, @IEEE802154_ATTR_HW_ADDR={0xc, 0x5, {0xaaaaaaaaaaaa0002}}, @IEEE802154_ATTR_LLSEC_KEY_MODE={0x5, 0x2b, 0x3}]}, 0x54}, 0x1, 0x0, 0x0, 0x40}, 0x2000c814) clock_getres(0x3, &(0x7f0000000880)) clock_getres(0x6, &(0x7f00000008c0)) sendmsg$IEEE802154_ADD_IFACE(0xffffffffffffffff, &(0x7f0000000a00)={&(0x7f0000000900)={0x10, 0x0, 0x0, 0x40c}, 0xc, &(0x7f00000009c0)={&(0x7f0000000940)={0x44, r4, 0x200, 0x70bd29, 0x25dfdbfe, {}, [@IEEE802154_ATTR_PHY_NAME={0x9, 0x1f, 'phy1\x00'}, @IEEE802154_ATTR_DEV_NAME={0xa, 0x1, 'wpan4\x00'}, @IEEE802154_ATTR_DEV_NAME={0xa, 0x1, 'wpan1\x00'}, @IEEE802154_ATTR_DEV_NAME={0xa, 0x1, 'wpan0\x00'}]}, 0x44}, 0x1, 0x0, 0x0, 0x20000084}, 0x44000) 17:44:54 executing program 2: prctl$PR_MPX_ENABLE_MANAGEMENT(0x2b) r0 = socket$inet(0x2, 0x5, 0x4) r1 = openat$vcsu(0xffffffffffffff9c, &(0x7f0000000000), 0x3c1480, 0x0) ioctl$sock_ipv4_tunnel_SIOCGETTUNNEL(r1, 0x89f0, &(0x7f00000000c0)={'syztnl2\x00', &(0x7f0000000040)={'erspan0\x00', 0x0, 0x700, 0x40, 0x3, 0x22, {{0x15, 0x4, 0x3, 0x17, 0x54, 0x64, 0x0, 0x1, 0x2f, 0x0, @broadcast, @dev={0xac, 0x14, 0x14, 0x36}, {[@cipso={0x86, 0x3d, 0x1, [{0x5, 0x9, "c8a7bec58c2c80"}, {0x0, 0x9, "fabb6c2e64ba82"}, {0x7, 0xf, "6b1b69e07efcb7230cc07a2cf7"}, {0x1, 0x6, "a2118bdb"}, {0x5, 0x10, "67115d3e7766231c7b08cf3c48e4"}]}]}}}}}) prctl$PR_MPX_ENABLE_MANAGEMENT(0x2b) r2 = openat$vcsa(0xffffffffffffff9c, &(0x7f0000000100), 0x202c0, 0x0) ioctl$SNDRV_SEQ_IOCTL_GET_QUEUE_TEMPO(r2, 0xc02c5341, &(0x7f0000000140)) ioctl$SNDRV_TIMER_IOCTL_SELECT(r1, 0x40345410, &(0x7f00000001c0)={{0x0, 0x2, 0x3f, 0x3, 0x80000001}}) ioctl$SNDRV_SEQ_IOCTL_GET_QUEUE_TEMPO(r1, 0xc02c5341, &(0x7f0000000200)) ioctl$sock_inet_tcp_SIOCOUTQ(r0, 0x5411, &(0x7f0000000280)) r3 = syz_open_dev$evdev(&(0x7f00000002c0), 0x1, 0x50000) ioctl$EVIOCGLED(r3, 0x80404519, &(0x7f0000000300)=""/21) seccomp$SECCOMP_GET_NOTIF_SIZES(0x3, 0x0, &(0x7f0000000340)) ioctl$SNDRV_TIMER_IOCTL_NEXT_DEVICE(r2, 0xc0145401, &(0x7f0000000380)={0x3, 0x2, 0x8, 0x2, 0x733}) munlock(&(0x7f0000ff9000/0x4000)=nil, 0x4000) getsockopt$inet_tcp_buf(r1, 0x6, 0x1a, &(0x7f00000003c0)=""/1, &(0x7f0000000400)=0x1) ioctl$SNDRV_SEQ_IOCTL_GET_QUEUE_INFO(r2, 0xc08c5334, &(0x7f0000000440)={0x0, 0x80, 0x0, 'queue0\x00', 0x8}) r4 = syz_open_procfs(0x0, &(0x7f0000000500)='schedstat\x00') ioctl$SNDRV_TIMER_IOCTL_PVERSION(r4, 0x80045400, &(0x7f0000000540)) 17:44:54 executing program 3: getsockopt$inet_udp_int(0xffffffffffffffff, 0x11, 0x1, &(0x7f0000000000), &(0x7f0000000040)=0x4) setsockopt$inet_udp_int(0xffffffffffffffff, 0x11, 0x1, &(0x7f0000000080)=0x7, 0x4) ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, &(0x7f0000000240)={0x54, 0x0, &(0x7f00000000c0)=[@acquire_done={0x40106309, 0x1}, @free_buffer, @request_death={0x400c630e, 0x1}, @request_death, @decrefs, @dead_binder_done], 0xc7, 0x0, &(0x7f0000000140)="aa36e0fef6a6cd3a6060f434b2a2306a435d6c33ca3bfb20c9d046886ded10cf23d0938b55b8a812702a5a7579cb8813f0cf3954f24fa081e8c35a9d4674b51115d91e7f6e38920909a8fba27ba7bbb0522974a9d83826c23d40a56c3f88dc24276a8312ae50d15d3531211e4378a34980ea70ac3cefef2439af0baa6b387df4ff26b593ca52e94dda8ce3656a81180693ab97746e30b1301f30922ec565bba820fc06168927e446c06efe1fc7cb37b804ba0342e58e70da81c074407ec9cf690a9ab1e3a62a68"}) r0 = openat$vcsa(0xffffffffffffff9c, &(0x7f0000000280), 0x1, 0x0) r1 = openat$vcsa(0xffffffffffffff9c, &(0x7f00000002c0), 0x80, 0x0) ioctl$SNDRV_SEQ_IOCTL_QUERY_NEXT_PORT(r0, 0xc0a85352, &(0x7f0000000300)={{0x4, 0x6}, 'port0\x00', 0x5, 0x1, 0x0, 0xffff, 0x7, 0x7, 0x5, 0x0, 0x2, 0xc0}) ioctl$SNDRV_SEQ_IOCTL_QUERY_NEXT_CLIENT(r1, 0xc0bc5351, &(0x7f00000003c0)={0xffff7fff, 0x0, 'client0\x00', 0xffffffff80000002, "9aa89fbb0e155330", "7e3a03465d7350a6322e39e7997e8c634c3224eb46d1223d24ed4ce35c7b1dd2", 0x0, 0x6}) r2 = openat$nvram(0xffffffffffffff9c, &(0x7f0000000480), 0x1, 0x0) ioctl$PERF_EVENT_IOC_PAUSE_OUTPUT(r2, 0x40042409, 0x0) process_mrelease(r0, 0x0) ioctl$SNDRV_TIMER_IOCTL_TREAD(r1, 0x40045402, &(0x7f00000004c0)) r3 = socket$inet_udp(0x2, 0x2, 0x0) ioctl$sock_inet_udp_SIOCINQ(r3, 0x541b, &(0x7f0000000500)) getsockopt$inet_IP_IPSEC_POLICY(r0, 0x0, 0x10, &(0x7f0000000540)={{{@in=@broadcast, @in6=@mcast1}}, {{@in=@broadcast}, 0x0, @in6=@mcast2}}, &(0x7f0000000640)=0xe8) setsockopt$inet_udp_encap(r1, 0x11, 0x64, &(0x7f0000000680)=0x3, 0x4) r4 = syz_open_procfs(0xffffffffffffffff, &(0x7f00000006c0)='net/packet\x00') pidfd_getfd(r4, 0xffffffffffffffff, 0x0) write$P9_RGETLOCK(0xffffffffffffffff, &(0x7f00000007c0)={0x1e, 0x37, 0x2, {0x2, 0x6, 0x101}}, 0x1e) 17:44:54 executing program 7: r0 = perf_event_open(&(0x7f0000000040)={0x4, 0x80, 0x6f, 0x8, 0x8, 0x1, 0x0, 0x6, 0x4, 0x1, 0x1, 0x0, 0x0, 0x1, 0x1, 0x1, 0x0, 0x0, 0x1, 0x0, 0x0, 0x1, 0x1, 0x0, 0x0, 0x2, 0x1, 0x0, 0x0, 0x1, 0x0, 0x0, 0x1, 0x0, 0x1, 0x0, 0x0, 0x0, 0x1, 0x1, 0x1, 0x0, 0x1, 0x1, 0x1, 0x0, 0x1, 0x0, 0x50, 0x2, @perf_bp={&(0x7f0000000000), 0xa}, 0x2100, 0x7, 0x1, 0x3, 0x6, 0x93d3, 0x0, 0x0, 0x3a, 0x0, 0x9}, 0xffffffffffffffff, 0xc, 0xffffffffffffffff, 0x8) mmap$perf(&(0x7f0000ffb000/0x2000)=nil, 0x2000, 0xb, 0x11, r0, 0x8) munmap(&(0x7f0000ffb000/0x3000)=nil, 0x3000) getsockopt$inet6_tcp_TCP_ZEROCOPY_RECEIVE(0xffffffffffffffff, 0x6, 0x23, &(0x7f0000001180)={&(0x7f0000ffd000/0x2000)=nil, 0x2000, 0x0, 0x0, 0x0, &(0x7f00000000c0)=""/162, 0xa2, 0x0, &(0x7f0000000180)=""/4096, 0x1000}, &(0x7f00000011c0)=0x40) r1 = openat$vcsa(0xffffffffffffff9c, &(0x7f0000001200), 0x14d080, 0x0) ioctl$SNDRV_SEQ_IOCTL_SUBSCRIBE_PORT(r1, 0x40505330, &(0x7f0000001240)={{0x3f, 0x40}, {0x9, 0x2}, 0x43, 0x0, 0x1}) r2 = mmap$binder(&(0x7f0000ffc000/0x1000)=nil, 0x1000, 0x1, 0x11, r1, 0x81) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000001380)={0x44, 0x0, &(0x7f00000012c0)=[@acquire={0x40046305, 0x3}, @increfs, @free_buffer={0x40086303, r2}, @exit_looper, @request_death={0x400c630e, 0x3}, @increfs={0x40046304, 0x2}, @free_buffer], 0x1d, 0x0, &(0x7f0000001340)="63170b84a45d435cf194bbb38c0432388cb6578156ee80dc59b93c914c"}) r3 = openat$vcsa(0xffffffffffffff9c, &(0x7f00000013c0), 0x400000, 0x0) ioctl$SNDRV_SEQ_IOCTL_GET_SUBSCRIPTION(r3, 0xc0505350, &(0x7f0000001400)={{0x1, 0x6}, {0x1f, 0x81}, 0x4, 0x3, 0x7}) r4 = openat$nvram(0xffffffffffffff9c, &(0x7f0000001480), 0x105500, 0x0) mmap$IORING_OFF_SQ_RING(&(0x7f0000ffd000/0x1000)=nil, 0x1000, 0x0, 0x13, r4, 0x0) munmap(&(0x7f0000ffc000/0x2000)=nil, 0x2000) setsockopt$inet_tcp_TLS_TX(r3, 0x6, 0x1, &(0x7f00000014c0)=@gcm_128={{0x304}, "c7158b5e86708544", "366c7e9fd1d7fe2728acf2d3b734f3db", "b710fe41", "ad55c6ad971e7ae7"}, 0x28) mlock(&(0x7f0000ffd000/0x1000)=nil, 0x1000) ioctl$SECCOMP_IOCTL_NOTIF_RECV(r3, 0xc0502100, &(0x7f0000001500)) shmget(0x0, 0x1000, 0x200, &(0x7f0000ffd000/0x1000)=nil) 17:44:54 executing program 4: ioctl$SNDRV_TIMER_IOCTL_TREAD(0xffffffffffffffff, 0x40045402, &(0x7f0000000000)) wait4(0xffffffffffffffff, &(0x7f0000000040), 0x1, &(0x7f0000000080)) waitid$P_PIDFD(0x3, 0xffffffffffffffff, &(0x7f0000000140), 0x40000002, &(0x7f00000001c0)) shmget$private(0x0, 0x3000, 0x20, &(0x7f0000ffa000/0x3000)=nil) sendmsg$SEG6_CMD_SETHMAC(0xffffffffffffffff, &(0x7f0000000380)={&(0x7f0000000280)={0x10, 0x0, 0x0, 0x2}, 0xc, &(0x7f0000000340)={&(0x7f00000002c0)={0x48, 0x0, 0x10, 0x70bd25, 0x25dfdbff, {}, [@SEG6_ATTR_ALGID={0x5, 0x6, 0x4}, @SEG6_ATTR_ALGID={0x5, 0x6, 0x20}, @SEG6_ATTR_ALGID={0x5, 0x6, 0x8}, @SEG6_ATTR_HMACKEYID={0x8, 0x3, 0x1}, @SEG6_ATTR_SECRETLEN={0x5, 0x5, 0x5}, @SEG6_ATTR_SECRET={0x4}, @SEG6_ATTR_DSTLEN={0x8, 0x2, 0x1f}]}, 0x48}}, 0x0) openat$vcsa(0xffffffffffffff9c, &(0x7f00000003c0), 0x48000, 0x0) shmget(0x1, 0x3000, 0x20, &(0x7f0000ffc000/0x3000)=nil) 17:44:54 executing program 7: r0 = perf_event_open(&(0x7f0000000040)={0x4, 0x80, 0x6f, 0x8, 0x8, 0x1, 0x0, 0x6, 0x4, 0x1, 0x1, 0x0, 0x0, 0x1, 0x1, 0x1, 0x0, 0x0, 0x1, 0x0, 0x0, 0x1, 0x1, 0x0, 0x0, 0x2, 0x1, 0x0, 0x0, 0x1, 0x0, 0x0, 0x1, 0x0, 0x1, 0x0, 0x0, 0x0, 0x1, 0x1, 0x1, 0x0, 0x1, 0x1, 0x1, 0x0, 0x1, 0x0, 0x50, 0x2, @perf_bp={&(0x7f0000000000), 0xa}, 0x2100, 0x7, 0x1, 0x3, 0x6, 0x93d3, 0x0, 0x0, 0x3a, 0x0, 0x9}, 0xffffffffffffffff, 0xc, 0xffffffffffffffff, 0x8) mmap$perf(&(0x7f0000ffb000/0x2000)=nil, 0x2000, 0xb, 0x11, r0, 0x8) munmap(&(0x7f0000ffb000/0x3000)=nil, 0x3000) getsockopt$inet6_tcp_TCP_ZEROCOPY_RECEIVE(0xffffffffffffffff, 0x6, 0x23, &(0x7f0000001180)={&(0x7f0000ffd000/0x2000)=nil, 0x2000, 0x0, 0x0, 0x0, &(0x7f00000000c0)=""/162, 0xa2, 0x0, &(0x7f0000000180)=""/4096, 0x1000}, &(0x7f00000011c0)=0x40) r1 = openat$vcsa(0xffffffffffffff9c, &(0x7f0000001200), 0x14d080, 0x0) ioctl$SNDRV_SEQ_IOCTL_SUBSCRIBE_PORT(r1, 0x40505330, &(0x7f0000001240)={{0x3f, 0x40}, {0x9, 0x2}, 0x43, 0x0, 0x1}) r2 = mmap$binder(&(0x7f0000ffc000/0x1000)=nil, 0x1000, 0x1, 0x11, r1, 0x81) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000001380)={0x44, 0x0, &(0x7f00000012c0)=[@acquire={0x40046305, 0x3}, @increfs, @free_buffer={0x40086303, r2}, @exit_looper, @request_death={0x400c630e, 0x3}, @increfs={0x40046304, 0x2}, @free_buffer], 0x1d, 0x0, &(0x7f0000001340)="63170b84a45d435cf194bbb38c0432388cb6578156ee80dc59b93c914c"}) r3 = openat$vcsa(0xffffffffffffff9c, &(0x7f00000013c0), 0x400000, 0x0) ioctl$SNDRV_SEQ_IOCTL_GET_SUBSCRIPTION(r3, 0xc0505350, &(0x7f0000001400)={{0x1, 0x6}, {0x1f, 0x81}, 0x4, 0x3, 0x7}) r4 = openat$nvram(0xffffffffffffff9c, &(0x7f0000001480), 0x105500, 0x0) mmap$IORING_OFF_SQ_RING(&(0x7f0000ffd000/0x1000)=nil, 0x1000, 0x0, 0x13, r4, 0x0) munmap(&(0x7f0000ffc000/0x2000)=nil, 0x2000) setsockopt$inet_tcp_TLS_TX(r3, 0x6, 0x1, &(0x7f00000014c0)=@gcm_128={{0x304}, "c7158b5e86708544", "366c7e9fd1d7fe2728acf2d3b734f3db", "b710fe41", "ad55c6ad971e7ae7"}, 0x28) mlock(&(0x7f0000ffd000/0x1000)=nil, 0x1000) shmget(0x0, 0x1000, 0x200, &(0x7f0000ffd000/0x1000)=nil) 17:44:54 executing program 4: ioctl$SNDRV_TIMER_IOCTL_TREAD(0xffffffffffffffff, 0x40045402, &(0x7f0000000000)) wait4(0xffffffffffffffff, &(0x7f0000000040), 0x1, &(0x7f0000000080)) waitid$P_PIDFD(0x3, 0xffffffffffffffff, &(0x7f0000000140), 0x40000002, &(0x7f00000001c0)) shmget$private(0x0, 0x3000, 0x20, &(0x7f0000ffa000/0x3000)=nil) sendmsg$SEG6_CMD_SETHMAC(0xffffffffffffffff, &(0x7f0000000380)={&(0x7f0000000280)={0x10, 0x0, 0x0, 0x2}, 0xc, &(0x7f0000000340)={&(0x7f00000002c0)={0x48, 0x0, 0x10, 0x70bd25, 0x25dfdbff, {}, [@SEG6_ATTR_ALGID={0x5, 0x6, 0x4}, @SEG6_ATTR_ALGID={0x5, 0x6, 0x20}, @SEG6_ATTR_ALGID={0x5, 0x6, 0x8}, @SEG6_ATTR_HMACKEYID={0x8, 0x3, 0x1}, @SEG6_ATTR_SECRETLEN={0x5, 0x5, 0x5}, @SEG6_ATTR_SECRET={0x4}, @SEG6_ATTR_DSTLEN={0x8, 0x2, 0x1f}]}, 0x48}}, 0x0) shmget(0x1, 0x3000, 0x20, &(0x7f0000ffc000/0x3000)=nil) 17:44:54 executing program 0: get_thread_area(&(0x7f0000000000)={0x7, 0x20000800, 0x4000, 0x0, 0x1, 0x0, 0x0, 0x1, 0x1, 0x1}) r0 = openat$vcsu(0xffffffffffffff9c, &(0x7f0000000040), 0x200000, 0x0) getsockopt$inet_tcp_TCP_REPAIR_WINDOW(r0, 0x6, 0x1d, &(0x7f0000000080), &(0x7f00000000c0)=0x14) r1 = openat$nvram(0xffffffffffffff9c, &(0x7f0000000100), 0x2000, 0x0) setsockopt$inet_tcp_TCP_FASTOPEN_KEY(r1, 0x6, 0x21, &(0x7f0000000140)="1bb9d563048b6ec78effc0f14d974b17", 0x10) setsockopt$inet_tcp_int(r1, 0x6, 0x1b, &(0x7f0000000180)=0x5, 0x4) ioctl$SNDRV_TIMER_IOCTL_STATUS32(r1, 0x80585414, &(0x7f00000001c0)) setsockopt$inet_tcp_TCP_QUEUE_SEQ(r0, 0x6, 0x15, &(0x7f0000000240)=0x1, 0x4) getsockopt$inet_tcp_TCP_ZEROCOPY_RECEIVE(r1, 0x6, 0x23, &(0x7f0000000340)={&(0x7f0000ffc000/0x2000)=nil, 0x2000, 0x0, 0x0, 0x0, &(0x7f0000000280)=""/37, 0x25, 0x1, &(0x7f00000002c0)=""/109, 0x6d}, &(0x7f0000000380)=0x40) r2 = socket$inet_tcp(0x2, 0x1, 0x0) ioctl$sock_inet_tcp_SIOCINQ(r2, 0x541b, &(0x7f00000003c0)) move_pages(0x0, 0x8, &(0x7f0000000400)=[&(0x7f0000ffd000/0x1000)=nil, &(0x7f0000ffd000/0x3000)=nil, &(0x7f0000ffd000/0x3000)=nil, &(0x7f0000ffb000/0x2000)=nil, &(0x7f0000ffc000/0x1000)=nil, &(0x7f0000ffe000/0x2000)=nil, &(0x7f0000ffb000/0x4000)=nil, &(0x7f0000ffd000/0x3000)=nil], &(0x7f0000000440)=[0xfff], &(0x7f0000000480)=[0x0, 0x0, 0x0], 0x4) r3 = syz_genetlink_get_family_id$SEG6(&(0x7f0000000500), r1) sendmsg$SEG6_CMD_GET_TUNSRC(r0, &(0x7f00000005c0)={&(0x7f00000004c0)={0x10, 0x0, 0x0, 0x4000000}, 0xc, &(0x7f0000000580)={&(0x7f0000000540)={0x38, r3, 0x300, 0x70bd2a, 0x25dfdbfc, {}, [@SEG6_ATTR_HMACKEYID={0x8, 0x3, 0x24}, @SEG6_ATTR_DST={0x14, 0x1, @mcast1}, @SEG6_ATTR_DSTLEN={0x8, 0x2, 0x2}]}, 0x38}, 0x1, 0x0, 0x0, 0x20008810}, 0x4040010) ioctl$SNDRV_SEQ_IOCTL_SET_QUEUE_TIMER(r1, 0x40605346, &(0x7f0000000600)={0x80, 0x1, {0x1, 0x0, 0x81}, 0x2}) sendmsg$SEG6_CMD_DUMPHMAC(0xffffffffffffffff, &(0x7f0000000740)={&(0x7f0000000680)={0x10, 0x0, 0x0, 0x240000}, 0xc, &(0x7f0000000700)={&(0x7f00000006c0)={0x2c, r3, 0x1, 0x70bd2c, 0x25dfdbfe, {}, [@SEG6_ATTR_SECRET={0x8, 0x4, [0x1]}, @SEG6_ATTR_DSTLEN={0x8, 0x2, 0x5}, @SEG6_ATTR_DSTLEN={0x8}]}, 0x2c}, 0x1, 0x0, 0x0, 0x4000000}, 0x4000000) syz_genetlink_get_family_id$ieee802154(&(0x7f0000000800), 0xffffffffffffffff) 17:44:54 executing program 3: getsockopt$inet_udp_int(0xffffffffffffffff, 0x11, 0x1, &(0x7f0000000000), &(0x7f0000000040)=0x4) setsockopt$inet_udp_int(0xffffffffffffffff, 0x11, 0x1, &(0x7f0000000080)=0x7, 0x4) ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, &(0x7f0000000240)={0x54, 0x0, &(0x7f00000000c0)=[@acquire_done={0x40106309, 0x1}, @free_buffer, @request_death={0x400c630e, 0x1}, @request_death, @decrefs, @dead_binder_done], 0xc7, 0x0, &(0x7f0000000140)="aa36e0fef6a6cd3a6060f434b2a2306a435d6c33ca3bfb20c9d046886ded10cf23d0938b55b8a812702a5a7579cb8813f0cf3954f24fa081e8c35a9d4674b51115d91e7f6e38920909a8fba27ba7bbb0522974a9d83826c23d40a56c3f88dc24276a8312ae50d15d3531211e4378a34980ea70ac3cefef2439af0baa6b387df4ff26b593ca52e94dda8ce3656a81180693ab97746e30b1301f30922ec565bba820fc06168927e446c06efe1fc7cb37b804ba0342e58e70da81c074407ec9cf690a9ab1e3a62a68"}) r0 = openat$vcsa(0xffffffffffffff9c, &(0x7f0000000280), 0x1, 0x0) r1 = openat$vcsa(0xffffffffffffff9c, &(0x7f00000002c0), 0x80, 0x0) ioctl$SNDRV_SEQ_IOCTL_QUERY_NEXT_PORT(r0, 0xc0a85352, &(0x7f0000000300)={{0x4, 0x6}, 'port0\x00', 0x5, 0x1, 0x0, 0xffff, 0x7, 0x7, 0x5, 0x0, 0x2, 0xc0}) ioctl$SNDRV_SEQ_IOCTL_QUERY_NEXT_CLIENT(r1, 0xc0bc5351, &(0x7f00000003c0)={0xffff7fff, 0x0, 'client0\x00', 0xffffffff80000002, "9aa89fbb0e155330", "7e3a03465d7350a6322e39e7997e8c634c3224eb46d1223d24ed4ce35c7b1dd2", 0x0, 0x6}) r2 = openat$nvram(0xffffffffffffff9c, &(0x7f0000000480), 0x1, 0x0) ioctl$PERF_EVENT_IOC_PAUSE_OUTPUT(r2, 0x40042409, 0x0) process_mrelease(r0, 0x0) ioctl$SNDRV_TIMER_IOCTL_TREAD(r1, 0x40045402, &(0x7f00000004c0)) r3 = socket$inet_udp(0x2, 0x2, 0x0) ioctl$sock_inet_udp_SIOCINQ(r3, 0x541b, &(0x7f0000000500)) getsockopt$inet_IP_IPSEC_POLICY(r0, 0x0, 0x10, &(0x7f0000000540)={{{@in=@broadcast, @in6=@mcast1}}, {{@in=@broadcast}, 0x0, @in6=@mcast2}}, &(0x7f0000000640)=0xe8) setsockopt$inet_udp_encap(r1, 0x11, 0x64, &(0x7f0000000680)=0x3, 0x4) r4 = syz_open_procfs(0xffffffffffffffff, &(0x7f00000006c0)='net/packet\x00') pidfd_getfd(r4, 0xffffffffffffffff, 0x0) write$P9_RGETLOCK(0xffffffffffffffff, &(0x7f00000007c0)={0x1e, 0x37, 0x2, {0x2, 0x6, 0x101}}, 0x1e) 17:44:54 executing program 5: clock_gettime(0x5, &(0x7f0000000000)) clock_settime(0x2, &(0x7f0000000040)) sched_rr_get_interval(0xffffffffffffffff, &(0x7f0000000080)) sched_rr_get_interval(0x0, &(0x7f00000000c0)) sendmsg$NL802154_CMD_GET_SEC_KEY(0xffffffffffffffff, &(0x7f00000001c0)={&(0x7f0000000100)={0x10, 0x0, 0x0, 0x20000000}, 0xc, &(0x7f0000000180)={&(0x7f0000000140)={0x24, 0x0, 0x200, 0x70bd26, 0x25dfdbfe, {}, [@NL802154_ATTR_IFINDEX={0x8}, @NL802154_ATTR_IFINDEX={0x8}]}, 0x24}, 0x1, 0x0, 0x0, 0x4000000}, 0x181) clock_gettime(0x0, &(0x7f0000000200)) pipe2$9p(&(0x7f0000000240)={0xffffffffffffffff, 0xffffffffffffffff}, 0x800) r1 = syz_io_uring_setup(0x776a, &(0x7f0000000280)={0x0, 0x2728, 0x2, 0x1, 0x37c}, &(0x7f0000000000/0x3000)=nil, &(0x7f0000000000/0x400000)=nil, &(0x7f0000000300), &(0x7f0000000340)) ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, &(0x7f0000000540)={0x64, 0x0, &(0x7f0000000440)=[@transaction_sg={0x40486311, {0x1, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x50, 0x18, &(0x7f0000000380)={@fd={0x66642a85, 0x0, r0}, @fd={0x66642a85, 0x0, r1}, @fda={0x66646185, 0x0, 0x2, 0x36}}, &(0x7f0000000400)={0x0, 0x18, 0x30}}}, @request_death, @release={0x40046306, 0x1}], 0x7e, 0x0, &(0x7f00000004c0)="7685c519d1cbea63a1a8f022f8c0085baf770aa5d1fa9bfb1a5399fdb134953d619e962218bba650b68d6206fde39ff17760aa4bbcb62f6802c48e17294a17a3b768ab60bbae37aa37e33e24b09f6bdea37853f7ab2622451803788c9d172b7d71d6d87911129b8ef5cc9e0169404b09abfa991f3a7a3640686df445d387"}) pipe2$9p(&(0x7f0000000580), 0x800) ioctl$EVIOCGVERSION(0xffffffffffffffff, 0x80044501, &(0x7f00000005c0)=""/174) r2 = openat$nvram(0xffffffffffffff9c, &(0x7f0000000680), 0x400, 0x0) write$P9_RSTAT(r2, &(0x7f00000006c0)={0x3f, 0x7d, 0x1, {0x0, 0x38, 0x401, 0x8000, {0x80, 0x4, 0x1}, 0x2020000, 0x4, 0x60, 0x9, 0x1, '\x00', 0x2, '.-', 0x1, '\x00', 0x1, '\x00'}}, 0x3f) r3 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r4 = syz_genetlink_get_family_id$ieee802154(&(0x7f0000000740), 0xffffffffffffffff) sendmsg$IEEE802154_LLSEC_DEL_KEY(r3, &(0x7f0000000840)={&(0x7f0000000700)={0x10, 0x0, 0x0, 0x800000}, 0xc, &(0x7f0000000800)={&(0x7f0000000780)={0x54, r4, 0x800, 0x70bd27, 0x25dfdbfc, {}, [@IEEE802154_ATTR_LLSEC_KEY_SOURCE_SHORT={0x8, 0x2c, 0x5}, @IEEE802154_ATTR_LLSEC_KEY_SOURCE_EXTENDED={0xc, 0x2d, {0xaaaaaaaaaaaa0002}}, @IEEE802154_ATTR_PAN_ID={0x6, 0x6, 0x2}, @IEEE802154_ATTR_DEV_INDEX={0x8}, @IEEE802154_ATTR_LLSEC_KEY_MODE={0x5, 0x2b, 0x1}, @IEEE802154_ATTR_HW_ADDR={0xc, 0x5, {0xaaaaaaaaaaaa0002}}, @IEEE802154_ATTR_LLSEC_KEY_MODE={0x5, 0x2b, 0x3}]}, 0x54}, 0x1, 0x0, 0x0, 0x40}, 0x2000c814) clock_getres(0x3, &(0x7f0000000880)) r5 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) sendmsg$IEEE802154_ADD_IFACE(r5, &(0x7f0000000a00)={&(0x7f0000000900)={0x10, 0x0, 0x0, 0x40c}, 0xc, &(0x7f00000009c0)={&(0x7f0000000940)={0x44, r4, 0x200, 0x70bd29, 0x25dfdbfe, {}, [@IEEE802154_ATTR_PHY_NAME={0x9, 0x1f, 'phy1\x00'}, @IEEE802154_ATTR_DEV_NAME={0xa, 0x1, 'wpan4\x00'}, @IEEE802154_ATTR_DEV_NAME={0xa, 0x1, 'wpan1\x00'}, @IEEE802154_ATTR_DEV_NAME={0xa, 0x1, 'wpan0\x00'}]}, 0x44}, 0x1, 0x0, 0x0, 0x20000084}, 0x44000) 17:44:54 executing program 1: shmget$private(0x0, 0x4000, 0x80, &(0x7f0000ffb000/0x4000)=nil) shmget(0x3, 0x2000, 0x4, &(0x7f0000ffc000/0x2000)=nil) mlock(&(0x7f0000ff0000/0x10000)=nil, 0x10000) shmget(0x1, 0x1000, 0x10, &(0x7f0000ff5000/0x1000)=nil) ioctl$sock_ipv4_tunnel_SIOCGETTUNNEL(0xffffffffffffffff, 0x89f0, &(0x7f0000000140)={'syztnl1\x00', &(0x7f00000000c0)={'syztnl2\x00', 0x0, 0x20, 0x1, 0x6, 0x9, {{0xd, 0x4, 0x1, 0x19, 0x34, 0x68, 0x0, 0x9, 0x29, 0x0, @empty, @dev={0xac, 0x14, 0x14, 0x29}, {[@timestamp_addr={0x44, 0x14, 0xc2, 0x1, 0x4, [{@multicast1}, {@private=0xa010101}]}, @rr={0x7, 0xb, 0xc8, [@initdev={0xac, 0x1e, 0x1, 0x0}, @private=0xa010102]}]}}}}}) ioctl$sock_ipv4_tunnel_SIOCADDTUNNEL(0xffffffffffffffff, 0x89f1, &(0x7f0000000280)={'tunl0\x00', &(0x7f0000000180)={'tunl0\x00', r0, 0x7, 0x8000, 0xfffffffc, 0x8, {{0x2f, 0x4, 0x0, 0x2, 0xbc, 0x65, 0x0, 0x0, 0x4, 0x0, @empty, @broadcast, {[@generic={0x89, 0x9, "8db1d464c6af68"}, @noop, @ra={0x94, 0x4, 0x1}, @timestamp={0x44, 0x1c, 0x53, 0x0, 0x7, [0x40, 0x7fffffff, 0xfffffffd, 0x5, 0x5c, 0x77]}, @cipso={0x86, 0x2f, 0x3, [{0x1, 0x4, "1eba"}, {0x1, 0x7, "e3ccb5ddcf"}, {0x6, 0xa, "5db18b961780af33"}, {0x2, 0xe, "7353a9824b57fd7d39232ac5"}, {0x1, 0x6, "2e1ccd27"}]}, @noop, @cipso={0x86, 0x37, 0xffffffffffffffff, [{0x2, 0xf, "227467028cabd4e137b820c5c9"}, {0x7, 0x6, "90569992"}, {0x2, 0xc, "2071b0a8c9ce92782e72"}, {0x6, 0xa, "14f2b9bca55ce3dd"}, {0x6, 0x6, "2cd22a8f"}]}, @timestamp={0x44, 0x14, 0xd4, 0x0, 0x5, [0x81, 0x5d23, 0x63ab, 0x1]}]}}}}}) ioctl$sock_ipv4_tunnel_SIOCDELTUNNEL(0xffffffffffffffff, 0x89f2, &(0x7f0000000380)={'gretap0\x00', &(0x7f00000002c0)={'syztnl2\x00', 0x0, 0x7800, 0x7, 0x40, 0xe180, {{0x22, 0x4, 0x0, 0x1, 0x88, 0x64, 0x0, 0x1, 0x29, 0x0, @multicast2, @multicast1, {[@end, @lsrr={0x83, 0x1f, 0x2f, [@multicast2, @local, @local, @multicast1, @rand_addr=0x64010102, @loopback, @private=0xa010100]}, @rr={0x7, 0x27, 0x6c, [@multicast1, @rand_addr=0x64010102, @remote, @multicast1, @loopback, @initdev={0xac, 0x1e, 0x0, 0x0}, @initdev={0xac, 0x1e, 0x1, 0x0}, @broadcast, @empty]}, @ra={0x94, 0x4, 0x1}, @timestamp={0x44, 0x10, 0x2d, 0x0, 0x8, [0x1, 0x100, 0x401]}, @ssrr={0x89, 0x13, 0x56, [@dev={0xac, 0x14, 0x14, 0x28}, @multicast2, @initdev={0xac, 0x1e, 0x0, 0x0}, @remote]}, @ra={0x94, 0x4, 0x1}]}}}}}) shmget(0x3, 0x4000, 0x4, &(0x7f0000ff9000/0x4000)=nil) mmap$IORING_OFF_CQ_RING(&(0x7f0000ffd000/0x3000)=nil, 0x3000, 0x2000008, 0x30, 0xffffffffffffffff, 0x8000000) r1 = syz_genetlink_get_family_id$nl802154(&(0x7f0000000400), 0xffffffffffffffff) ioctl$sock_SIOCGIFINDEX_802154(0xffffffffffffffff, 0x8933, &(0x7f0000000440)={'wpan1\x00', 0x0}) sendmsg$NL802154_CMD_NEW_INTERFACE(0xffffffffffffffff, &(0x7f0000000540)={&(0x7f00000003c0)={0x10, 0x0, 0x0, 0x2}, 0xc, &(0x7f0000000500)={&(0x7f0000000480)={0x48, r1, 0x200, 0x70bd2a, 0x25dfdbfd, {}, [@NL802154_ATTR_IFNAME={0xa, 0x4, 'wpan0\x00'}, @NL802154_ATTR_IFINDEX={0x8}, @NL802154_ATTR_IFNAME={0xa, 0x4, 'wpan1\x00'}, @NL802154_ATTR_EXTENDED_ADDR={0xc, 0x17, {0xaaaaaaaaaaaa0002}}, @NL802154_ATTR_IFINDEX={0x8, 0x3, r2}]}, 0x48}}, 0x4001) mmap$binder(&(0x7f0000fef000/0x11000)=nil, 0x11000, 0x1, 0x11, 0xffffffffffffffff, 0x6) shmget$private(0x0, 0x4000, 0x200, &(0x7f0000ffc000/0x4000)=nil) r3 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) ioctl$sock_SIOCGIFINDEX_802154(0xffffffffffffffff, 0x8933, &(0x7f00000005c0)={'wpan0\x00', 0x0}) sendmsg$IEEE802154_LLSEC_ADD_SECLEVEL(r3, &(0x7f00000006c0)={&(0x7f0000000580)={0x10, 0x0, 0x0, 0x4000000}, 0xc, &(0x7f0000000680)={&(0x7f0000000600)={0x44, 0x0, 0x200, 0x70bd2a, 0x25dfdbff, {}, [@IEEE802154_ATTR_LLSEC_FRAME_TYPE={0x5, 0x33, 0x34}, @IEEE802154_ATTR_DEV_INDEX={0x8, 0x2, r4}, @IEEE802154_ATTR_LLSEC_CMD_FRAME_ID={0x5, 0x34, 0x1}, @IEEE802154_ATTR_DEV_NAME={0xa, 0x1, 'wpan0\x00'}, @IEEE802154_ATTR_DEV_NAME={0xa, 0x1, 'wpan4\x00'}]}, 0x44}, 0x1, 0x0, 0x0, 0x8800}, 0x0) mlock(&(0x7f0000fef000/0x1000)=nil, 0x1000) syz_io_uring_setup(0x4726, &(0x7f0000000840)={0x0, 0x502f, 0x20, 0x0, 0x12e}, &(0x7f0000ffe000/0x2000)=nil, &(0x7f0000ffb000/0x4000)=nil, &(0x7f00000008c0), &(0x7f0000000900)) 17:44:54 executing program 2: prctl$PR_MPX_ENABLE_MANAGEMENT(0x2b) r0 = socket$inet(0x2, 0x5, 0x4) r1 = openat$vcsu(0xffffffffffffff9c, &(0x7f0000000000), 0x3c1480, 0x0) ioctl$sock_ipv4_tunnel_SIOCGETTUNNEL(r1, 0x89f0, &(0x7f00000000c0)={'syztnl2\x00', &(0x7f0000000040)={'erspan0\x00', 0x0, 0x700, 0x40, 0x3, 0x22, {{0x15, 0x4, 0x3, 0x17, 0x54, 0x64, 0x0, 0x1, 0x2f, 0x0, @broadcast, @dev={0xac, 0x14, 0x14, 0x36}, {[@cipso={0x86, 0x3d, 0x1, [{0x5, 0x9, "c8a7bec58c2c80"}, {0x0, 0x9, "fabb6c2e64ba82"}, {0x7, 0xf, "6b1b69e07efcb7230cc07a2cf7"}, {0x1, 0x6, "a2118bdb"}, {0x5, 0x10, "67115d3e7766231c7b08cf3c48e4"}]}]}}}}}) prctl$PR_MPX_ENABLE_MANAGEMENT(0x2b) r2 = openat$vcsa(0xffffffffffffff9c, &(0x7f0000000100), 0x202c0, 0x0) ioctl$SNDRV_SEQ_IOCTL_GET_QUEUE_TEMPO(r2, 0xc02c5341, &(0x7f0000000140)) ioctl$SNDRV_TIMER_IOCTL_SELECT(r1, 0x40345410, &(0x7f00000001c0)={{0x0, 0x2, 0x3f, 0x3, 0x80000001}}) ioctl$SNDRV_SEQ_IOCTL_GET_QUEUE_TEMPO(r1, 0xc02c5341, &(0x7f0000000200)) ioctl$sock_inet_tcp_SIOCOUTQ(r0, 0x5411, &(0x7f0000000280)) r3 = syz_open_dev$evdev(&(0x7f00000002c0), 0x1, 0x50000) ioctl$EVIOCGLED(r3, 0x80404519, &(0x7f0000000300)=""/21) seccomp$SECCOMP_GET_NOTIF_SIZES(0x3, 0x0, &(0x7f0000000340)) ioctl$SNDRV_TIMER_IOCTL_NEXT_DEVICE(r2, 0xc0145401, &(0x7f0000000380)={0x3, 0x2, 0x8, 0x2, 0x733}) munlock(&(0x7f0000ff9000/0x4000)=nil, 0x4000) getsockopt$inet_tcp_buf(r1, 0x6, 0x1a, &(0x7f00000003c0)=""/1, &(0x7f0000000400)=0x1) ioctl$SNDRV_SEQ_IOCTL_GET_QUEUE_INFO(r2, 0xc08c5334, &(0x7f0000000440)={0x0, 0x80, 0x0, 'queue0\x00', 0x8}) syz_open_procfs(0x0, &(0x7f0000000500)='schedstat\x00') 17:45:03 executing program 4: ioctl$SNDRV_TIMER_IOCTL_TREAD(0xffffffffffffffff, 0x40045402, &(0x7f0000000000)) wait4(0xffffffffffffffff, &(0x7f0000000040), 0x1, &(0x7f0000000080)) waitid$P_PIDFD(0x3, 0xffffffffffffffff, &(0x7f0000000140), 0x40000002, &(0x7f00000001c0)) shmget$private(0x0, 0x3000, 0x20, &(0x7f0000ffa000/0x3000)=nil) shmget(0x1, 0x3000, 0x20, &(0x7f0000ffc000/0x3000)=nil) 17:45:03 executing program 1: shmget$private(0x0, 0x4000, 0x80, &(0x7f0000ffb000/0x4000)=nil) shmget(0x3, 0x2000, 0x4, &(0x7f0000ffc000/0x2000)=nil) mlock(&(0x7f0000ff0000/0x10000)=nil, 0x10000) shmget(0x1, 0x1000, 0x10, &(0x7f0000ff5000/0x1000)=nil) ioctl$sock_ipv4_tunnel_SIOCGETTUNNEL(0xffffffffffffffff, 0x89f0, &(0x7f0000000140)={'syztnl1\x00', &(0x7f00000000c0)={'syztnl2\x00', 0x0, 0x20, 0x1, 0x6, 0x9, {{0xd, 0x4, 0x1, 0x19, 0x34, 0x68, 0x0, 0x9, 0x29, 0x0, @empty, @dev={0xac, 0x14, 0x14, 0x29}, {[@timestamp_addr={0x44, 0x14, 0xc2, 0x1, 0x4, [{@multicast1}, {@private=0xa010101}]}, @rr={0x7, 0xb, 0xc8, [@initdev={0xac, 0x1e, 0x1, 0x0}, @private=0xa010102]}]}}}}}) ioctl$sock_ipv4_tunnel_SIOCADDTUNNEL(0xffffffffffffffff, 0x89f1, &(0x7f0000000280)={'tunl0\x00', &(0x7f0000000180)={'tunl0\x00', r0, 0x7, 0x8000, 0xfffffffc, 0x8, {{0x2f, 0x4, 0x0, 0x2, 0xbc, 0x65, 0x0, 0x0, 0x4, 0x0, @empty, @broadcast, {[@generic={0x89, 0x9, "8db1d464c6af68"}, @noop, @ra={0x94, 0x4, 0x1}, @timestamp={0x44, 0x1c, 0x53, 0x0, 0x7, [0x40, 0x7fffffff, 0xfffffffd, 0x5, 0x5c, 0x77]}, @cipso={0x86, 0x2f, 0x3, [{0x1, 0x4, "1eba"}, {0x1, 0x7, "e3ccb5ddcf"}, {0x6, 0xa, "5db18b961780af33"}, {0x2, 0xe, "7353a9824b57fd7d39232ac5"}, {0x1, 0x6, "2e1ccd27"}]}, @noop, @cipso={0x86, 0x37, 0xffffffffffffffff, [{0x2, 0xf, "227467028cabd4e137b820c5c9"}, {0x7, 0x6, "90569992"}, {0x2, 0xc, "2071b0a8c9ce92782e72"}, {0x6, 0xa, "14f2b9bca55ce3dd"}, {0x6, 0x6, "2cd22a8f"}]}, @timestamp={0x44, 0x14, 0xd4, 0x0, 0x5, [0x81, 0x5d23, 0x63ab, 0x1]}]}}}}}) ioctl$sock_ipv4_tunnel_SIOCDELTUNNEL(0xffffffffffffffff, 0x89f2, &(0x7f0000000380)={'gretap0\x00', &(0x7f00000002c0)={'syztnl2\x00', 0x0, 0x7800, 0x7, 0x40, 0xe180, {{0x22, 0x4, 0x0, 0x1, 0x88, 0x64, 0x0, 0x1, 0x29, 0x0, @multicast2, @multicast1, {[@end, @lsrr={0x83, 0x1f, 0x2f, [@multicast2, @local, @local, @multicast1, @rand_addr=0x64010102, @loopback, @private=0xa010100]}, @rr={0x7, 0x27, 0x6c, [@multicast1, @rand_addr=0x64010102, @remote, @multicast1, @loopback, @initdev={0xac, 0x1e, 0x0, 0x0}, @initdev={0xac, 0x1e, 0x1, 0x0}, @broadcast, @empty]}, @ra={0x94, 0x4, 0x1}, @timestamp={0x44, 0x10, 0x2d, 0x0, 0x8, [0x1, 0x100, 0x401]}, @ssrr={0x89, 0x13, 0x56, [@dev={0xac, 0x14, 0x14, 0x28}, @multicast2, @initdev={0xac, 0x1e, 0x0, 0x0}, @remote]}, @ra={0x94, 0x4, 0x1}]}}}}}) shmget(0x3, 0x4000, 0x4, &(0x7f0000ff9000/0x4000)=nil) mmap$IORING_OFF_CQ_RING(&(0x7f0000ffd000/0x3000)=nil, 0x3000, 0x2000008, 0x30, 0xffffffffffffffff, 0x8000000) r1 = syz_genetlink_get_family_id$nl802154(&(0x7f0000000400), 0xffffffffffffffff) ioctl$sock_SIOCGIFINDEX_802154(0xffffffffffffffff, 0x8933, &(0x7f0000000440)={'wpan1\x00', 0x0}) sendmsg$NL802154_CMD_NEW_INTERFACE(0xffffffffffffffff, &(0x7f0000000540)={&(0x7f00000003c0)={0x10, 0x0, 0x0, 0x2}, 0xc, &(0x7f0000000500)={&(0x7f0000000480)={0x48, r1, 0x200, 0x70bd2a, 0x25dfdbfd, {}, [@NL802154_ATTR_IFNAME={0xa, 0x4, 'wpan0\x00'}, @NL802154_ATTR_IFINDEX={0x8}, @NL802154_ATTR_IFNAME={0xa, 0x4, 'wpan1\x00'}, @NL802154_ATTR_EXTENDED_ADDR={0xc, 0x17, {0xaaaaaaaaaaaa0002}}, @NL802154_ATTR_IFINDEX={0x8, 0x3, r2}]}, 0x48}}, 0x4001) mmap$binder(&(0x7f0000fef000/0x11000)=nil, 0x11000, 0x1, 0x11, 0xffffffffffffffff, 0x6) shmget$private(0x0, 0x4000, 0x200, &(0x7f0000ffc000/0x4000)=nil) r3 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) ioctl$sock_SIOCGIFINDEX_802154(0xffffffffffffffff, 0x8933, &(0x7f00000005c0)={'wpan0\x00', 0x0}) sendmsg$IEEE802154_LLSEC_ADD_SECLEVEL(r3, &(0x7f00000006c0)={&(0x7f0000000580)={0x10, 0x0, 0x0, 0x4000000}, 0xc, &(0x7f0000000680)={&(0x7f0000000600)={0x44, 0x0, 0x200, 0x70bd2a, 0x25dfdbff, {}, [@IEEE802154_ATTR_LLSEC_FRAME_TYPE={0x5, 0x33, 0x34}, @IEEE802154_ATTR_DEV_INDEX={0x8, 0x2, r4}, @IEEE802154_ATTR_LLSEC_CMD_FRAME_ID={0x5, 0x34, 0x1}, @IEEE802154_ATTR_DEV_NAME={0xa, 0x1, 'wpan0\x00'}, @IEEE802154_ATTR_DEV_NAME={0xa, 0x1, 'wpan4\x00'}]}, 0x44}, 0x1, 0x0, 0x0, 0x8800}, 0x0) mlock(&(0x7f0000fef000/0x1000)=nil, 0x1000) syz_io_uring_setup(0x4726, &(0x7f0000000840)={0x0, 0x502f, 0x20, 0x0, 0x12e}, &(0x7f0000ffe000/0x2000)=nil, &(0x7f0000ffb000/0x4000)=nil, &(0x7f00000008c0), &(0x7f0000000900)) 17:45:03 executing program 5: clock_gettime(0x5, &(0x7f0000000000)) clock_settime(0x2, &(0x7f0000000040)) sched_rr_get_interval(0xffffffffffffffff, &(0x7f0000000080)) sched_rr_get_interval(0x0, &(0x7f00000000c0)) sendmsg$NL802154_CMD_GET_SEC_KEY(0xffffffffffffffff, &(0x7f00000001c0)={&(0x7f0000000100)={0x10, 0x0, 0x0, 0x20000000}, 0xc, &(0x7f0000000180)={&(0x7f0000000140)={0x24, 0x0, 0x200, 0x70bd26, 0x25dfdbfe, {}, [@NL802154_ATTR_IFINDEX={0x8}, @NL802154_ATTR_IFINDEX={0x8}]}, 0x24}, 0x1, 0x0, 0x0, 0x4000000}, 0x181) clock_gettime(0x0, &(0x7f0000000200)) pipe2$9p(&(0x7f0000000240)={0xffffffffffffffff, 0xffffffffffffffff}, 0x800) r1 = syz_io_uring_setup(0x776a, &(0x7f0000000280)={0x0, 0x2728, 0x2, 0x1, 0x37c}, &(0x7f0000000000/0x3000)=nil, &(0x7f0000000000/0x400000)=nil, &(0x7f0000000300), &(0x7f0000000340)) ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, &(0x7f0000000540)={0x64, 0x0, &(0x7f0000000440)=[@transaction_sg={0x40486311, {0x1, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x50, 0x18, &(0x7f0000000380)={@fd={0x66642a85, 0x0, r0}, @fd={0x66642a85, 0x0, r1}, @fda={0x66646185, 0x0, 0x2, 0x36}}, &(0x7f0000000400)={0x0, 0x18, 0x30}}}, @request_death, @release={0x40046306, 0x1}], 0x7e, 0x0, &(0x7f00000004c0)="7685c519d1cbea63a1a8f022f8c0085baf770aa5d1fa9bfb1a5399fdb134953d619e962218bba650b68d6206fde39ff17760aa4bbcb62f6802c48e17294a17a3b768ab60bbae37aa37e33e24b09f6bdea37853f7ab2622451803788c9d172b7d71d6d87911129b8ef5cc9e0169404b09abfa991f3a7a3640686df445d387"}) pipe2$9p(&(0x7f0000000580), 0x800) ioctl$EVIOCGVERSION(0xffffffffffffffff, 0x80044501, &(0x7f00000005c0)=""/174) r2 = openat$nvram(0xffffffffffffff9c, &(0x7f0000000680), 0x400, 0x0) write$P9_RSTAT(r2, &(0x7f00000006c0)={0x3f, 0x7d, 0x1, {0x0, 0x38, 0x401, 0x8000, {0x80, 0x4, 0x1}, 0x2020000, 0x4, 0x60, 0x9, 0x1, '\x00', 0x2, '.-', 0x1, '\x00', 0x1, '\x00'}}, 0x3f) r3 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r4 = syz_genetlink_get_family_id$ieee802154(&(0x7f0000000740), 0xffffffffffffffff) sendmsg$IEEE802154_LLSEC_DEL_KEY(r3, &(0x7f0000000840)={&(0x7f0000000700)={0x10, 0x0, 0x0, 0x800000}, 0xc, &(0x7f0000000800)={&(0x7f0000000780)={0x54, r4, 0x800, 0x70bd27, 0x25dfdbfc, {}, [@IEEE802154_ATTR_LLSEC_KEY_SOURCE_SHORT={0x8, 0x2c, 0x5}, @IEEE802154_ATTR_LLSEC_KEY_SOURCE_EXTENDED={0xc, 0x2d, {0xaaaaaaaaaaaa0002}}, @IEEE802154_ATTR_PAN_ID={0x6, 0x6, 0x2}, @IEEE802154_ATTR_DEV_INDEX={0x8}, @IEEE802154_ATTR_LLSEC_KEY_MODE={0x5, 0x2b, 0x1}, @IEEE802154_ATTR_HW_ADDR={0xc, 0x5, {0xaaaaaaaaaaaa0002}}, @IEEE802154_ATTR_LLSEC_KEY_MODE={0x5, 0x2b, 0x3}]}, 0x54}, 0x1, 0x0, 0x0, 0x40}, 0x2000c814) r5 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) sendmsg$IEEE802154_ADD_IFACE(r5, &(0x7f0000000a00)={&(0x7f0000000900)={0x10, 0x0, 0x0, 0x40c}, 0xc, &(0x7f00000009c0)={&(0x7f0000000940)={0x44, r4, 0x200, 0x70bd29, 0x25dfdbfe, {}, [@IEEE802154_ATTR_PHY_NAME={0x9, 0x1f, 'phy1\x00'}, @IEEE802154_ATTR_DEV_NAME={0xa, 0x1, 'wpan4\x00'}, @IEEE802154_ATTR_DEV_NAME={0xa, 0x1, 'wpan1\x00'}, @IEEE802154_ATTR_DEV_NAME={0xa, 0x1, 'wpan0\x00'}]}, 0x44}, 0x1, 0x0, 0x0, 0x20000084}, 0x44000) 17:45:03 executing program 3: getsockopt$inet_udp_int(0xffffffffffffffff, 0x11, 0x1, &(0x7f0000000000), &(0x7f0000000040)=0x4) setsockopt$inet_udp_int(0xffffffffffffffff, 0x11, 0x1, &(0x7f0000000080)=0x7, 0x4) ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, &(0x7f0000000240)={0x54, 0x0, &(0x7f00000000c0)=[@acquire_done={0x40106309, 0x1}, @free_buffer, @request_death={0x400c630e, 0x1}, @request_death, @decrefs, @dead_binder_done], 0xc7, 0x0, &(0x7f0000000140)="aa36e0fef6a6cd3a6060f434b2a2306a435d6c33ca3bfb20c9d046886ded10cf23d0938b55b8a812702a5a7579cb8813f0cf3954f24fa081e8c35a9d4674b51115d91e7f6e38920909a8fba27ba7bbb0522974a9d83826c23d40a56c3f88dc24276a8312ae50d15d3531211e4378a34980ea70ac3cefef2439af0baa6b387df4ff26b593ca52e94dda8ce3656a81180693ab97746e30b1301f30922ec565bba820fc06168927e446c06efe1fc7cb37b804ba0342e58e70da81c074407ec9cf690a9ab1e3a62a68"}) r0 = openat$vcsa(0xffffffffffffff9c, &(0x7f0000000280), 0x1, 0x0) r1 = openat$vcsa(0xffffffffffffff9c, &(0x7f00000002c0), 0x80, 0x0) ioctl$SNDRV_SEQ_IOCTL_QUERY_NEXT_PORT(r0, 0xc0a85352, &(0x7f0000000300)={{0x4, 0x6}, 'port0\x00', 0x5, 0x1, 0x0, 0xffff, 0x7, 0x7, 0x5, 0x0, 0x2, 0xc0}) ioctl$SNDRV_SEQ_IOCTL_QUERY_NEXT_CLIENT(r1, 0xc0bc5351, &(0x7f00000003c0)={0xffff7fff, 0x0, 'client0\x00', 0xffffffff80000002, "9aa89fbb0e155330", "7e3a03465d7350a6322e39e7997e8c634c3224eb46d1223d24ed4ce35c7b1dd2", 0x0, 0x6}) r2 = openat$nvram(0xffffffffffffff9c, &(0x7f0000000480), 0x1, 0x0) ioctl$PERF_EVENT_IOC_PAUSE_OUTPUT(r2, 0x40042409, 0x0) process_mrelease(r0, 0x0) ioctl$SNDRV_TIMER_IOCTL_TREAD(r1, 0x40045402, &(0x7f00000004c0)) r3 = socket$inet_udp(0x2, 0x2, 0x0) ioctl$sock_inet_udp_SIOCINQ(r3, 0x541b, &(0x7f0000000500)) getsockopt$inet_IP_IPSEC_POLICY(r0, 0x0, 0x10, &(0x7f0000000540)={{{@in=@broadcast, @in6=@mcast1}}, {{@in=@broadcast}, 0x0, @in6=@mcast2}}, &(0x7f0000000640)=0xe8) setsockopt$inet_udp_encap(r1, 0x11, 0x64, &(0x7f0000000680)=0x3, 0x4) syz_open_procfs(0xffffffffffffffff, &(0x7f00000006c0)='net/packet\x00') r4 = openat$nvram(0xffffffffffffff9c, &(0x7f0000000700), 0x800, 0x0) write$P9_RGETLOCK(r4, &(0x7f00000007c0)={0x1e, 0x37, 0x2, {0x2, 0x6, 0x101}}, 0x1e) 17:45:03 executing program 7: r0 = perf_event_open(&(0x7f0000000040)={0x4, 0x80, 0x6f, 0x8, 0x8, 0x1, 0x0, 0x6, 0x4, 0x1, 0x1, 0x0, 0x0, 0x1, 0x1, 0x1, 0x0, 0x0, 0x1, 0x0, 0x0, 0x1, 0x1, 0x0, 0x0, 0x2, 0x1, 0x0, 0x0, 0x1, 0x0, 0x0, 0x1, 0x0, 0x1, 0x0, 0x0, 0x0, 0x1, 0x1, 0x1, 0x0, 0x1, 0x1, 0x1, 0x0, 0x1, 0x0, 0x50, 0x2, @perf_bp={&(0x7f0000000000), 0xa}, 0x2100, 0x7, 0x1, 0x3, 0x6, 0x93d3, 0x0, 0x0, 0x3a, 0x0, 0x9}, 0xffffffffffffffff, 0xc, 0xffffffffffffffff, 0x8) mmap$perf(&(0x7f0000ffb000/0x2000)=nil, 0x2000, 0xb, 0x11, r0, 0x8) munmap(&(0x7f0000ffb000/0x3000)=nil, 0x3000) getsockopt$inet6_tcp_TCP_ZEROCOPY_RECEIVE(0xffffffffffffffff, 0x6, 0x23, &(0x7f0000001180)={&(0x7f0000ffd000/0x2000)=nil, 0x2000, 0x0, 0x0, 0x0, &(0x7f00000000c0)=""/162, 0xa2, 0x0, &(0x7f0000000180)=""/4096, 0x1000}, &(0x7f00000011c0)=0x40) r1 = openat$vcsa(0xffffffffffffff9c, &(0x7f0000001200), 0x14d080, 0x0) ioctl$SNDRV_SEQ_IOCTL_SUBSCRIBE_PORT(r1, 0x40505330, &(0x7f0000001240)={{0x3f, 0x40}, {0x9, 0x2}, 0x43, 0x0, 0x1}) r2 = mmap$binder(&(0x7f0000ffc000/0x1000)=nil, 0x1000, 0x1, 0x11, r1, 0x81) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000001380)={0x44, 0x0, &(0x7f00000012c0)=[@acquire={0x40046305, 0x3}, @increfs, @free_buffer={0x40086303, r2}, @exit_looper, @request_death={0x400c630e, 0x3}, @increfs={0x40046304, 0x2}, @free_buffer], 0x1d, 0x0, &(0x7f0000001340)="63170b84a45d435cf194bbb38c0432388cb6578156ee80dc59b93c914c"}) r3 = openat$vcsa(0xffffffffffffff9c, &(0x7f00000013c0), 0x400000, 0x0) ioctl$SNDRV_SEQ_IOCTL_GET_SUBSCRIPTION(r3, 0xc0505350, &(0x7f0000001400)={{0x1, 0x6}, {0x1f, 0x81}, 0x4, 0x3, 0x7}) r4 = openat$nvram(0xffffffffffffff9c, &(0x7f0000001480), 0x105500, 0x0) mmap$IORING_OFF_SQ_RING(&(0x7f0000ffd000/0x1000)=nil, 0x1000, 0x0, 0x13, r4, 0x0) munmap(&(0x7f0000ffc000/0x2000)=nil, 0x2000) setsockopt$inet_tcp_TLS_TX(r3, 0x6, 0x1, &(0x7f00000014c0)=@gcm_128={{0x304}, "c7158b5e86708544", "366c7e9fd1d7fe2728acf2d3b734f3db", "b710fe41", "ad55c6ad971e7ae7"}, 0x28) shmget(0x0, 0x1000, 0x200, &(0x7f0000ffd000/0x1000)=nil) 17:45:03 executing program 0: get_thread_area(&(0x7f0000000000)={0x7, 0x20000800, 0x4000, 0x0, 0x1, 0x0, 0x0, 0x1, 0x1, 0x1}) r0 = openat$vcsu(0xffffffffffffff9c, &(0x7f0000000040), 0x200000, 0x0) getsockopt$inet_tcp_TCP_REPAIR_WINDOW(r0, 0x6, 0x1d, &(0x7f0000000080), &(0x7f00000000c0)=0x14) r1 = openat$nvram(0xffffffffffffff9c, &(0x7f0000000100), 0x2000, 0x0) setsockopt$inet_tcp_TCP_FASTOPEN_KEY(r1, 0x6, 0x21, &(0x7f0000000140)="1bb9d563048b6ec78effc0f14d974b17", 0x10) setsockopt$inet_tcp_int(r1, 0x6, 0x1b, &(0x7f0000000180)=0x5, 0x4) ioctl$SNDRV_TIMER_IOCTL_STATUS32(r1, 0x80585414, &(0x7f00000001c0)) setsockopt$inet_tcp_TCP_QUEUE_SEQ(r0, 0x6, 0x15, &(0x7f0000000240)=0x1, 0x4) getsockopt$inet_tcp_TCP_ZEROCOPY_RECEIVE(r1, 0x6, 0x23, &(0x7f0000000340)={&(0x7f0000ffc000/0x2000)=nil, 0x2000, 0x0, 0x0, 0x0, &(0x7f0000000280)=""/37, 0x25, 0x1, &(0x7f00000002c0)=""/109, 0x6d}, &(0x7f0000000380)=0x40) r2 = socket$inet_tcp(0x2, 0x1, 0x0) ioctl$sock_inet_tcp_SIOCINQ(r2, 0x541b, &(0x7f00000003c0)) move_pages(0x0, 0x8, &(0x7f0000000400)=[&(0x7f0000ffd000/0x1000)=nil, &(0x7f0000ffd000/0x3000)=nil, &(0x7f0000ffd000/0x3000)=nil, &(0x7f0000ffb000/0x2000)=nil, &(0x7f0000ffc000/0x1000)=nil, &(0x7f0000ffe000/0x2000)=nil, &(0x7f0000ffb000/0x4000)=nil, &(0x7f0000ffd000/0x3000)=nil], &(0x7f0000000440)=[0xfff], &(0x7f0000000480)=[0x0, 0x0, 0x0], 0x4) r3 = syz_genetlink_get_family_id$SEG6(&(0x7f0000000500), r1) sendmsg$SEG6_CMD_GET_TUNSRC(r0, &(0x7f00000005c0)={&(0x7f00000004c0)={0x10, 0x0, 0x0, 0x4000000}, 0xc, &(0x7f0000000580)={&(0x7f0000000540)={0x38, r3, 0x300, 0x70bd2a, 0x25dfdbfc, {}, [@SEG6_ATTR_HMACKEYID={0x8, 0x3, 0x24}, @SEG6_ATTR_DST={0x14, 0x1, @mcast1}, @SEG6_ATTR_DSTLEN={0x8, 0x2, 0x2}]}, 0x38}, 0x1, 0x0, 0x0, 0x20008810}, 0x4040010) ioctl$SNDRV_SEQ_IOCTL_SET_QUEUE_TIMER(r1, 0x40605346, &(0x7f0000000600)={0x80, 0x1, {0x1, 0x0, 0x81}, 0x2}) sendmsg$SEG6_CMD_DUMPHMAC(0xffffffffffffffff, &(0x7f0000000740)={&(0x7f0000000680)={0x10, 0x0, 0x0, 0x240000}, 0xc, &(0x7f0000000700)={&(0x7f00000006c0)={0x2c, r3, 0x1, 0x70bd2c, 0x25dfdbfe, {}, [@SEG6_ATTR_SECRET={0x8, 0x4, [0x1]}, @SEG6_ATTR_DSTLEN={0x8, 0x2, 0x5}, @SEG6_ATTR_DSTLEN={0x8}]}, 0x2c}, 0x1, 0x0, 0x0, 0x4000000}, 0x4000000) syz_genetlink_get_family_id$ieee802154(&(0x7f0000000800), 0xffffffffffffffff) 17:45:03 executing program 2: prctl$PR_MPX_ENABLE_MANAGEMENT(0x2b) r0 = socket$inet(0x2, 0x5, 0x4) r1 = openat$vcsu(0xffffffffffffff9c, &(0x7f0000000000), 0x3c1480, 0x0) ioctl$sock_ipv4_tunnel_SIOCGETTUNNEL(r1, 0x89f0, &(0x7f00000000c0)={'syztnl2\x00', &(0x7f0000000040)={'erspan0\x00', 0x0, 0x700, 0x40, 0x3, 0x22, {{0x15, 0x4, 0x3, 0x17, 0x54, 0x64, 0x0, 0x1, 0x2f, 0x0, @broadcast, @dev={0xac, 0x14, 0x14, 0x36}, {[@cipso={0x86, 0x3d, 0x1, [{0x5, 0x9, "c8a7bec58c2c80"}, {0x0, 0x9, "fabb6c2e64ba82"}, {0x7, 0xf, "6b1b69e07efcb7230cc07a2cf7"}, {0x1, 0x6, "a2118bdb"}, {0x5, 0x10, "67115d3e7766231c7b08cf3c48e4"}]}]}}}}}) prctl$PR_MPX_ENABLE_MANAGEMENT(0x2b) r2 = openat$vcsa(0xffffffffffffff9c, &(0x7f0000000100), 0x202c0, 0x0) ioctl$SNDRV_SEQ_IOCTL_GET_QUEUE_TEMPO(r2, 0xc02c5341, &(0x7f0000000140)) ioctl$SNDRV_TIMER_IOCTL_SELECT(r1, 0x40345410, &(0x7f00000001c0)={{0x0, 0x2, 0x3f, 0x3, 0x80000001}}) ioctl$SNDRV_SEQ_IOCTL_GET_QUEUE_TEMPO(r1, 0xc02c5341, &(0x7f0000000200)) ioctl$sock_inet_tcp_SIOCOUTQ(r0, 0x5411, &(0x7f0000000280)) r3 = syz_open_dev$evdev(&(0x7f00000002c0), 0x1, 0x50000) ioctl$EVIOCGLED(r3, 0x80404519, &(0x7f0000000300)=""/21) seccomp$SECCOMP_GET_NOTIF_SIZES(0x3, 0x0, &(0x7f0000000340)) ioctl$SNDRV_TIMER_IOCTL_NEXT_DEVICE(r2, 0xc0145401, &(0x7f0000000380)={0x3, 0x2, 0x8, 0x2, 0x733}) munlock(&(0x7f0000ff9000/0x4000)=nil, 0x4000) getsockopt$inet_tcp_buf(r1, 0x6, 0x1a, &(0x7f00000003c0)=""/1, &(0x7f0000000400)=0x1) syz_open_procfs(0x0, &(0x7f0000000500)='schedstat\x00') 17:45:03 executing program 6: r0 = perf_event_open(&(0x7f00000000c0)={0x1, 0x80, 0x0, 0xc0, 0xfa, 0x1, 0x0, 0x7fffffff, 0x10811, 0x1, 0x1, 0x1, 0x1, 0x1, 0x1, 0x1, 0x1, 0x1, 0x0, 0x1, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x1, 0x0, 0x1, 0x0, 0x0, 0x0, 0x1, 0x1, 0x1, 0x1, 0x1, 0x1, 0x1, 0x0, 0x1, 0x1, 0x1, 0x1, 0x0, 0x0, 0xfff, 0x7, @perf_config_ext={0x7, 0x7fffffff}, 0x41000, 0x80000000, 0x5, 0x3, 0x9, 0x2, 0x9, 0x0, 0x5, 0x0, 0x4}, 0x0, 0xb, 0xffffffffffffffff, 0x1) perf_event_open(&(0x7f0000000040)={0x0, 0x80, 0x0, 0x40, 0x80, 0x9, 0x0, 0x3, 0x10040, 0x1, 0x0, 0x0, 0x1, 0x1, 0x1, 0x1, 0x1, 0x1, 0x1, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x3, 0x1, 0x0, 0x1, 0x0, 0x1, 0x1, 0x0, 0x0, 0x1, 0x1, 0x1, 0x0, 0x1, 0x0, 0x0, 0x0, 0x1, 0x0, 0x1, 0x0, 0x1, 0x0, 0x0, 0x1, @perf_bp={&(0x7f0000000000), 0x10}, 0x8080, 0x800, 0x2, 0x3, 0x36dc, 0x31df3b33, 0xff, 0x0, 0x9, 0x0, 0x5}, 0xffffffffffffffff, 0x9, r0, 0x9) ioctl$PERF_EVENT_IOC_PAUSE_OUTPUT(r0, 0x40042409, 0x0) ioctl$PERF_EVENT_IOC_PERIOD(0xffffffffffffffff, 0x40082404, &(0x7f0000000140)=0x8) r1 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl$sock_ipv4_tunnel_SIOCADDTUNNEL(r1, 0x89f1, &(0x7f00000001c0)={'syztnl1\x00', &(0x7f0000000180)={'syztnl0\x00', 0x0, 0x1, 0x40, 0x0, 0x5, {{0x5, 0x4, 0x2, 0x19, 0x14, 0x65, 0x0, 0x1f, 0x4, 0x0, @multicast2, @remote}}}}) ioctl$PERF_EVENT_IOC_PERIOD(r0, 0x40082404, &(0x7f0000000200)=0x9) ioctl$SNDRV_SEQ_IOCTL_GET_PORT_INFO(0xffffffffffffffff, 0xc0a85322, &(0x7f0000000240)) ioctl$SNDRV_SEQ_IOCTL_SYSTEM_INFO(0xffffffffffffffff, 0xc0305302, &(0x7f0000000300)={0x9, 0x101, 0x1, 0x6, 0x3, 0x5}) r2 = syz_open_procfs(0x0, &(0x7f0000000340)='children\x00') openat$cgroup_type(r2, &(0x7f0000000380), 0x2, 0x0) ioctl$EVIOCGABS20(r2, 0x80184560, &(0x7f00000003c0)=""/4096) socket$inet6_tcp(0xa, 0x1, 0x0) r3 = openat$nvram(0xffffffffffffff9c, &(0x7f00000013c0), 0xdd0e52fd5a017ff5, 0x0) mmap$perf(&(0x7f0000ffe000/0x2000)=nil, 0x2000, 0x2000001, 0x10, r3, 0x4) openat$vcsu(0xffffffffffffff9c, &(0x7f0000001400), 0x280103, 0x0) write$cgroup_type(0xffffffffffffffff, &(0x7f0000001500), 0x9) 17:45:03 executing program 3: getsockopt$inet_udp_int(0xffffffffffffffff, 0x11, 0x1, &(0x7f0000000000), &(0x7f0000000040)=0x4) setsockopt$inet_udp_int(0xffffffffffffffff, 0x11, 0x1, &(0x7f0000000080)=0x7, 0x4) ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, &(0x7f0000000240)={0x54, 0x0, &(0x7f00000000c0)=[@acquire_done={0x40106309, 0x1}, @free_buffer, @request_death={0x400c630e, 0x1}, @request_death, @decrefs, @dead_binder_done], 0xc7, 0x0, &(0x7f0000000140)="aa36e0fef6a6cd3a6060f434b2a2306a435d6c33ca3bfb20c9d046886ded10cf23d0938b55b8a812702a5a7579cb8813f0cf3954f24fa081e8c35a9d4674b51115d91e7f6e38920909a8fba27ba7bbb0522974a9d83826c23d40a56c3f88dc24276a8312ae50d15d3531211e4378a34980ea70ac3cefef2439af0baa6b387df4ff26b593ca52e94dda8ce3656a81180693ab97746e30b1301f30922ec565bba820fc06168927e446c06efe1fc7cb37b804ba0342e58e70da81c074407ec9cf690a9ab1e3a62a68"}) r0 = openat$vcsa(0xffffffffffffff9c, &(0x7f0000000280), 0x1, 0x0) r1 = openat$vcsa(0xffffffffffffff9c, &(0x7f00000002c0), 0x80, 0x0) ioctl$SNDRV_SEQ_IOCTL_QUERY_NEXT_PORT(r0, 0xc0a85352, &(0x7f0000000300)={{0x4, 0x6}, 'port0\x00', 0x5, 0x1, 0x0, 0xffff, 0x7, 0x7, 0x5, 0x0, 0x2, 0xc0}) ioctl$SNDRV_SEQ_IOCTL_QUERY_NEXT_CLIENT(r1, 0xc0bc5351, &(0x7f00000003c0)={0xffff7fff, 0x0, 'client0\x00', 0xffffffff80000002, "9aa89fbb0e155330", "7e3a03465d7350a6322e39e7997e8c634c3224eb46d1223d24ed4ce35c7b1dd2", 0x0, 0x6}) r2 = openat$nvram(0xffffffffffffff9c, &(0x7f0000000480), 0x1, 0x0) ioctl$PERF_EVENT_IOC_PAUSE_OUTPUT(r2, 0x40042409, 0x0) process_mrelease(r0, 0x0) ioctl$SNDRV_TIMER_IOCTL_TREAD(r1, 0x40045402, &(0x7f00000004c0)) r3 = socket$inet_udp(0x2, 0x2, 0x0) ioctl$sock_inet_udp_SIOCINQ(r3, 0x541b, &(0x7f0000000500)) getsockopt$inet_IP_IPSEC_POLICY(r0, 0x0, 0x10, &(0x7f0000000540)={{{@in=@broadcast, @in6=@mcast1}}, {{@in=@broadcast}, 0x0, @in6=@mcast2}}, &(0x7f0000000640)=0xe8) setsockopt$inet_udp_encap(r1, 0x11, 0x64, &(0x7f0000000680)=0x3, 0x4) r4 = openat$nvram(0xffffffffffffff9c, &(0x7f0000000700), 0x800, 0x0) write$P9_RGETLOCK(r4, &(0x7f00000007c0)={0x1e, 0x37, 0x2, {0x2, 0x6, 0x101}}, 0x1e) 17:45:03 executing program 5: clock_gettime(0x5, &(0x7f0000000000)) clock_settime(0x2, &(0x7f0000000040)) sched_rr_get_interval(0xffffffffffffffff, &(0x7f0000000080)) sched_rr_get_interval(0x0, &(0x7f00000000c0)) sendmsg$NL802154_CMD_GET_SEC_KEY(0xffffffffffffffff, &(0x7f00000001c0)={&(0x7f0000000100)={0x10, 0x0, 0x0, 0x20000000}, 0xc, &(0x7f0000000180)={&(0x7f0000000140)={0x24, 0x0, 0x200, 0x70bd26, 0x25dfdbfe, {}, [@NL802154_ATTR_IFINDEX={0x8}, @NL802154_ATTR_IFINDEX={0x8}]}, 0x24}, 0x1, 0x0, 0x0, 0x4000000}, 0x181) clock_gettime(0x0, &(0x7f0000000200)) pipe2$9p(&(0x7f0000000240)={0xffffffffffffffff, 0xffffffffffffffff}, 0x800) r1 = syz_io_uring_setup(0x776a, &(0x7f0000000280)={0x0, 0x2728, 0x2, 0x1, 0x37c}, &(0x7f0000000000/0x3000)=nil, &(0x7f0000000000/0x400000)=nil, &(0x7f0000000300), &(0x7f0000000340)) ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, &(0x7f0000000540)={0x64, 0x0, &(0x7f0000000440)=[@transaction_sg={0x40486311, {0x1, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x50, 0x18, &(0x7f0000000380)={@fd={0x66642a85, 0x0, r0}, @fd={0x66642a85, 0x0, r1}, @fda={0x66646185, 0x0, 0x2, 0x36}}, &(0x7f0000000400)={0x0, 0x18, 0x30}}}, @request_death, @release={0x40046306, 0x1}], 0x7e, 0x0, &(0x7f00000004c0)="7685c519d1cbea63a1a8f022f8c0085baf770aa5d1fa9bfb1a5399fdb134953d619e962218bba650b68d6206fde39ff17760aa4bbcb62f6802c48e17294a17a3b768ab60bbae37aa37e33e24b09f6bdea37853f7ab2622451803788c9d172b7d71d6d87911129b8ef5cc9e0169404b09abfa991f3a7a3640686df445d387"}) pipe2$9p(&(0x7f0000000580), 0x800) ioctl$EVIOCGVERSION(0xffffffffffffffff, 0x80044501, &(0x7f00000005c0)=""/174) r2 = openat$nvram(0xffffffffffffff9c, &(0x7f0000000680), 0x400, 0x0) write$P9_RSTAT(r2, &(0x7f00000006c0)={0x3f, 0x7d, 0x1, {0x0, 0x38, 0x401, 0x8000, {0x80, 0x4, 0x1}, 0x2020000, 0x4, 0x60, 0x9, 0x1, '\x00', 0x2, '.-', 0x1, '\x00', 0x1, '\x00'}}, 0x3f) r3 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r4 = syz_genetlink_get_family_id$ieee802154(&(0x7f0000000740), 0xffffffffffffffff) sendmsg$IEEE802154_LLSEC_DEL_KEY(r3, &(0x7f0000000840)={&(0x7f0000000700)={0x10, 0x0, 0x0, 0x800000}, 0xc, &(0x7f0000000800)={&(0x7f0000000780)={0x54, r4, 0x800, 0x70bd27, 0x25dfdbfc, {}, [@IEEE802154_ATTR_LLSEC_KEY_SOURCE_SHORT={0x8, 0x2c, 0x5}, @IEEE802154_ATTR_LLSEC_KEY_SOURCE_EXTENDED={0xc, 0x2d, {0xaaaaaaaaaaaa0002}}, @IEEE802154_ATTR_PAN_ID={0x6, 0x6, 0x2}, @IEEE802154_ATTR_DEV_INDEX={0x8}, @IEEE802154_ATTR_LLSEC_KEY_MODE={0x5, 0x2b, 0x1}, @IEEE802154_ATTR_HW_ADDR={0xc, 0x5, {0xaaaaaaaaaaaa0002}}, @IEEE802154_ATTR_LLSEC_KEY_MODE={0x5, 0x2b, 0x3}]}, 0x54}, 0x1, 0x0, 0x0, 0x40}, 0x2000c814) r5 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) sendmsg$IEEE802154_ADD_IFACE(r5, &(0x7f0000000a00)={&(0x7f0000000900)={0x10, 0x0, 0x0, 0x40c}, 0xc, &(0x7f00000009c0)={&(0x7f0000000940)={0x44, r4, 0x200, 0x70bd29, 0x25dfdbfe, {}, [@IEEE802154_ATTR_PHY_NAME={0x9, 0x1f, 'phy1\x00'}, @IEEE802154_ATTR_DEV_NAME={0xa, 0x1, 'wpan4\x00'}, @IEEE802154_ATTR_DEV_NAME={0xa, 0x1, 'wpan1\x00'}, @IEEE802154_ATTR_DEV_NAME={0xa, 0x1, 'wpan0\x00'}]}, 0x44}, 0x1, 0x0, 0x0, 0x20000084}, 0x44000) [ 159.749645] kmemleak: Found object by alias at 0x607f1a62a634 [ 159.749663] CPU: 0 UID: 0 PID: 4117 Comm: syz-executor.7 Tainted: G W 6.17.0-rc3-next-20250829 #1 PREEMPT(voluntary) [ 159.749681] Tainted: [W]=WARN [ 159.749685] Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.12.0-1 04/01/2014 [ 159.749691] Call Trace: [ 159.749695] [ 159.749700] dump_stack_lvl+0xca/0x120 [ 159.749724] __lookup_object+0x94/0xb0 [ 159.749740] delete_object_full+0x27/0x70 [ 159.749756] free_percpu+0x30/0x1160 [ 159.749772] ? arch_uprobe_clear_state+0x16/0x140 [ 159.749791] futex_hash_free+0x38/0xc0 [ 159.749805] mmput+0x2d3/0x390 [ 159.749823] do_exit+0x79d/0x2970 [ 159.749845] ? __pfx_do_exit+0x10/0x10 [ 159.749859] ? find_held_lock+0x2b/0x80 [ 159.749876] ? get_signal+0x835/0x2340 [ 159.749896] do_group_exit+0xd3/0x2a0 [ 159.749910] get_signal+0x2315/0x2340 [ 159.749927] ? put_task_stack+0xd2/0x240 [ 159.749941] ? __pfx_get_signal+0x10/0x10 [ 159.749957] ? __schedule+0xe91/0x3590 [ 159.749976] arch_do_signal_or_restart+0x80/0x790 [ 159.749993] ? __pfx_arch_do_signal_or_restart+0x10/0x10 [ 159.750009] ? __x64_sys_futex+0x1c9/0x4d0 [ 159.750021] ? __x64_sys_futex+0x1d2/0x4d0 [ 159.750035] ? __pfx___x64_sys_futex+0x10/0x10 [ 159.750048] ? __x64_sys_shmget+0x13b/0x1b0 [ 159.750068] exit_to_user_mode_loop+0x8b/0x110 [ 159.750080] do_syscall_64+0x2f7/0x360 [ 159.750092] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 159.750104] RIP: 0033:0x7f8e7f8bbb19 [ 159.750112] Code: Unable to access opcode bytes at 0x7f8e7f8bbaef. [ 159.750117] RSP: 002b:00007f8e7ce31218 EFLAGS: 00000246 ORIG_RAX: 00000000000000ca [ 159.750129] RAX: 0000000000000001 RBX: 00007f8e7f9cef68 RCX: 00007f8e7f8bbb19 [ 159.750136] RDX: 00000000000f4240 RSI: 0000000000000081 RDI: 00007f8e7f9cef6c [ 159.750143] RBP: 00007f8e7f9cef60 R08: 000000000000000e R09: 0000000000000000 [ 159.750149] R10: 0000000000000000 R11: 0000000000000246 R12: 00007f8e7f9cef6c [ 159.750156] R13: 00007fff562de65f R14: 00007f8e7ce31300 R15: 0000000000022000 [ 159.750171] [ 159.750175] kmemleak: Object (percpu) 0x607f1a62a630 (size 8): [ 159.750181] kmemleak: comm "syz-executor.1", pid 4119, jiffies 4294826560 [ 159.750188] kmemleak: min_count = 1 [ 159.750192] kmemleak: count = 0 [ 159.750195] kmemleak: flags = 0x21 [ 159.750199] kmemleak: checksum = 0 [ 159.750203] kmemleak: backtrace: [ 159.750206] pcpu_alloc_noprof+0x87a/0x1170 [ 159.750221] percpu_ref_init+0x37/0x400 [ 159.750238] io_uring_setup+0x44c/0x2000 [ 159.750249] __x64_sys_io_uring_setup+0xc8/0x170 [ 159.750259] do_syscall_64+0xbf/0x360 [ 159.750268] entry_SYSCALL_64_after_hwframe+0x77/0x7f 17:45:03 executing program 4: ioctl$SNDRV_TIMER_IOCTL_TREAD(0xffffffffffffffff, 0x40045402, &(0x7f0000000000)) wait4(0xffffffffffffffff, &(0x7f0000000040), 0x1, &(0x7f0000000080)) waitid$P_PIDFD(0x3, 0xffffffffffffffff, &(0x7f0000000140), 0x40000002, &(0x7f00000001c0)) shmget(0x1, 0x3000, 0x20, &(0x7f0000ffc000/0x3000)=nil) 17:45:03 executing program 0: get_thread_area(&(0x7f0000000000)={0x7, 0x20000800, 0x4000, 0x0, 0x1, 0x0, 0x0, 0x1, 0x1, 0x1}) r0 = openat$vcsu(0xffffffffffffff9c, &(0x7f0000000040), 0x200000, 0x0) getsockopt$inet_tcp_TCP_REPAIR_WINDOW(r0, 0x6, 0x1d, &(0x7f0000000080), &(0x7f00000000c0)=0x14) r1 = openat$nvram(0xffffffffffffff9c, &(0x7f0000000100), 0x2000, 0x0) setsockopt$inet_tcp_TCP_FASTOPEN_KEY(r1, 0x6, 0x21, &(0x7f0000000140)="1bb9d563048b6ec78effc0f14d974b17", 0x10) setsockopt$inet_tcp_int(r1, 0x6, 0x1b, &(0x7f0000000180)=0x5, 0x4) ioctl$SNDRV_TIMER_IOCTL_STATUS32(r1, 0x80585414, &(0x7f00000001c0)) setsockopt$inet_tcp_TCP_QUEUE_SEQ(r0, 0x6, 0x15, &(0x7f0000000240)=0x1, 0x4) getsockopt$inet_tcp_TCP_ZEROCOPY_RECEIVE(r1, 0x6, 0x23, &(0x7f0000000340)={&(0x7f0000ffc000/0x2000)=nil, 0x2000, 0x0, 0x0, 0x0, &(0x7f0000000280)=""/37, 0x25, 0x1, &(0x7f00000002c0)=""/109, 0x6d}, &(0x7f0000000380)=0x40) r2 = socket$inet_tcp(0x2, 0x1, 0x0) ioctl$sock_inet_tcp_SIOCINQ(r2, 0x541b, &(0x7f00000003c0)) move_pages(0x0, 0x8, &(0x7f0000000400)=[&(0x7f0000ffd000/0x1000)=nil, &(0x7f0000ffd000/0x3000)=nil, &(0x7f0000ffd000/0x3000)=nil, &(0x7f0000ffb000/0x2000)=nil, &(0x7f0000ffc000/0x1000)=nil, &(0x7f0000ffe000/0x2000)=nil, &(0x7f0000ffb000/0x4000)=nil, &(0x7f0000ffd000/0x3000)=nil], &(0x7f0000000440)=[0xfff], &(0x7f0000000480)=[0x0, 0x0, 0x0], 0x4) r3 = syz_genetlink_get_family_id$SEG6(&(0x7f0000000500), r1) sendmsg$SEG6_CMD_GET_TUNSRC(r0, &(0x7f00000005c0)={&(0x7f00000004c0)={0x10, 0x0, 0x0, 0x4000000}, 0xc, &(0x7f0000000580)={&(0x7f0000000540)={0x38, r3, 0x300, 0x70bd2a, 0x25dfdbfc, {}, [@SEG6_ATTR_HMACKEYID={0x8, 0x3, 0x24}, @SEG6_ATTR_DST={0x14, 0x1, @mcast1}, @SEG6_ATTR_DSTLEN={0x8, 0x2, 0x2}]}, 0x38}, 0x1, 0x0, 0x0, 0x20008810}, 0x4040010) ioctl$SNDRV_SEQ_IOCTL_SET_QUEUE_TIMER(r1, 0x40605346, &(0x7f0000000600)={0x80, 0x1, {0x1, 0x0, 0x81}, 0x2}) pidfd_getfd(r1, r2, 0x0) syz_genetlink_get_family_id$ieee802154(&(0x7f0000000800), 0xffffffffffffffff) 17:45:03 executing program 7: r0 = perf_event_open(&(0x7f0000000040)={0x4, 0x80, 0x6f, 0x8, 0x8, 0x1, 0x0, 0x6, 0x4, 0x1, 0x1, 0x0, 0x0, 0x1, 0x1, 0x1, 0x0, 0x0, 0x1, 0x0, 0x0, 0x1, 0x1, 0x0, 0x0, 0x2, 0x1, 0x0, 0x0, 0x1, 0x0, 0x0, 0x1, 0x0, 0x1, 0x0, 0x0, 0x0, 0x1, 0x1, 0x1, 0x0, 0x1, 0x1, 0x1, 0x0, 0x1, 0x0, 0x50, 0x2, @perf_bp={&(0x7f0000000000), 0xa}, 0x2100, 0x7, 0x1, 0x3, 0x6, 0x93d3, 0x0, 0x0, 0x3a, 0x0, 0x9}, 0xffffffffffffffff, 0xc, 0xffffffffffffffff, 0x8) mmap$perf(&(0x7f0000ffb000/0x2000)=nil, 0x2000, 0xb, 0x11, r0, 0x8) munmap(&(0x7f0000ffb000/0x3000)=nil, 0x3000) getsockopt$inet6_tcp_TCP_ZEROCOPY_RECEIVE(0xffffffffffffffff, 0x6, 0x23, &(0x7f0000001180)={&(0x7f0000ffd000/0x2000)=nil, 0x2000, 0x0, 0x0, 0x0, &(0x7f00000000c0)=""/162, 0xa2, 0x0, &(0x7f0000000180)=""/4096, 0x1000}, &(0x7f00000011c0)=0x40) r1 = openat$vcsa(0xffffffffffffff9c, &(0x7f0000001200), 0x14d080, 0x0) ioctl$SNDRV_SEQ_IOCTL_SUBSCRIBE_PORT(r1, 0x40505330, &(0x7f0000001240)={{0x3f, 0x40}, {0x9, 0x2}, 0x43, 0x0, 0x1}) r2 = mmap$binder(&(0x7f0000ffc000/0x1000)=nil, 0x1000, 0x1, 0x11, r1, 0x81) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000001380)={0x44, 0x0, &(0x7f00000012c0)=[@acquire={0x40046305, 0x3}, @increfs, @free_buffer={0x40086303, r2}, @exit_looper, @request_death={0x400c630e, 0x3}, @increfs={0x40046304, 0x2}, @free_buffer], 0x1d, 0x0, &(0x7f0000001340)="63170b84a45d435cf194bbb38c0432388cb6578156ee80dc59b93c914c"}) r3 = openat$vcsa(0xffffffffffffff9c, &(0x7f00000013c0), 0x400000, 0x0) ioctl$SNDRV_SEQ_IOCTL_GET_SUBSCRIPTION(r3, 0xc0505350, &(0x7f0000001400)={{0x1, 0x6}, {0x1f, 0x81}, 0x4, 0x3, 0x7}) r4 = openat$nvram(0xffffffffffffff9c, &(0x7f0000001480), 0x105500, 0x0) mmap$IORING_OFF_SQ_RING(&(0x7f0000ffd000/0x1000)=nil, 0x1000, 0x0, 0x13, r4, 0x0) munmap(&(0x7f0000ffc000/0x2000)=nil, 0x2000) shmget(0x0, 0x1000, 0x200, &(0x7f0000ffd000/0x1000)=nil) 17:45:03 executing program 5: clock_gettime(0x5, &(0x7f0000000000)) clock_settime(0x2, &(0x7f0000000040)) sched_rr_get_interval(0xffffffffffffffff, &(0x7f0000000080)) sched_rr_get_interval(0x0, &(0x7f00000000c0)) sendmsg$NL802154_CMD_GET_SEC_KEY(0xffffffffffffffff, &(0x7f00000001c0)={&(0x7f0000000100)={0x10, 0x0, 0x0, 0x20000000}, 0xc, &(0x7f0000000180)={&(0x7f0000000140)={0x24, 0x0, 0x200, 0x70bd26, 0x25dfdbfe, {}, [@NL802154_ATTR_IFINDEX={0x8}, @NL802154_ATTR_IFINDEX={0x8}]}, 0x24}, 0x1, 0x0, 0x0, 0x4000000}, 0x181) clock_gettime(0x0, &(0x7f0000000200)) pipe2$9p(&(0x7f0000000240)={0xffffffffffffffff, 0xffffffffffffffff}, 0x800) r1 = syz_io_uring_setup(0x776a, &(0x7f0000000280)={0x0, 0x2728, 0x2, 0x1, 0x37c}, &(0x7f0000000000/0x3000)=nil, &(0x7f0000000000/0x400000)=nil, &(0x7f0000000300), &(0x7f0000000340)) ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, &(0x7f0000000540)={0x64, 0x0, &(0x7f0000000440)=[@transaction_sg={0x40486311, {0x1, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x50, 0x18, &(0x7f0000000380)={@fd={0x66642a85, 0x0, r0}, @fd={0x66642a85, 0x0, r1}, @fda={0x66646185, 0x0, 0x2, 0x36}}, &(0x7f0000000400)={0x0, 0x18, 0x30}}}, @request_death, @release={0x40046306, 0x1}], 0x7e, 0x0, &(0x7f00000004c0)="7685c519d1cbea63a1a8f022f8c0085baf770aa5d1fa9bfb1a5399fdb134953d619e962218bba650b68d6206fde39ff17760aa4bbcb62f6802c48e17294a17a3b768ab60bbae37aa37e33e24b09f6bdea37853f7ab2622451803788c9d172b7d71d6d87911129b8ef5cc9e0169404b09abfa991f3a7a3640686df445d387"}) pipe2$9p(&(0x7f0000000580), 0x800) ioctl$EVIOCGVERSION(0xffffffffffffffff, 0x80044501, &(0x7f00000005c0)=""/174) r2 = openat$nvram(0xffffffffffffff9c, &(0x7f0000000680), 0x400, 0x0) write$P9_RSTAT(r2, &(0x7f00000006c0)={0x3f, 0x7d, 0x1, {0x0, 0x38, 0x401, 0x8000, {0x80, 0x4, 0x1}, 0x2020000, 0x4, 0x60, 0x9, 0x1, '\x00', 0x2, '.-', 0x1, '\x00', 0x1, '\x00'}}, 0x3f) r3 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r4 = syz_genetlink_get_family_id$ieee802154(&(0x7f0000000740), 0xffffffffffffffff) sendmsg$IEEE802154_LLSEC_DEL_KEY(r3, &(0x7f0000000840)={&(0x7f0000000700)={0x10, 0x0, 0x0, 0x800000}, 0xc, &(0x7f0000000800)={&(0x7f0000000780)={0x54, r4, 0x800, 0x70bd27, 0x25dfdbfc, {}, [@IEEE802154_ATTR_LLSEC_KEY_SOURCE_SHORT={0x8, 0x2c, 0x5}, @IEEE802154_ATTR_LLSEC_KEY_SOURCE_EXTENDED={0xc, 0x2d, {0xaaaaaaaaaaaa0002}}, @IEEE802154_ATTR_PAN_ID={0x6, 0x6, 0x2}, @IEEE802154_ATTR_DEV_INDEX={0x8}, @IEEE802154_ATTR_LLSEC_KEY_MODE={0x5, 0x2b, 0x1}, @IEEE802154_ATTR_HW_ADDR={0xc, 0x5, {0xaaaaaaaaaaaa0002}}, @IEEE802154_ATTR_LLSEC_KEY_MODE={0x5, 0x2b, 0x3}]}, 0x54}, 0x1, 0x0, 0x0, 0x40}, 0x2000c814) r5 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) sendmsg$IEEE802154_ADD_IFACE(r5, &(0x7f0000000a00)={&(0x7f0000000900)={0x10, 0x0, 0x0, 0x40c}, 0xc, &(0x7f00000009c0)={&(0x7f0000000940)={0x44, r4, 0x200, 0x70bd29, 0x25dfdbfe, {}, [@IEEE802154_ATTR_PHY_NAME={0x9, 0x1f, 'phy1\x00'}, @IEEE802154_ATTR_DEV_NAME={0xa, 0x1, 'wpan4\x00'}, @IEEE802154_ATTR_DEV_NAME={0xa, 0x1, 'wpan1\x00'}, @IEEE802154_ATTR_DEV_NAME={0xa, 0x1, 'wpan0\x00'}]}, 0x44}, 0x1, 0x0, 0x0, 0x20000084}, 0x44000) 17:45:03 executing program 1: shmget$private(0x0, 0x4000, 0x80, &(0x7f0000ffb000/0x4000)=nil) shmget(0x3, 0x2000, 0x4, &(0x7f0000ffc000/0x2000)=nil) mlock(&(0x7f0000ff0000/0x10000)=nil, 0x10000) shmget(0x1, 0x1000, 0x10, &(0x7f0000ff5000/0x1000)=nil) ioctl$sock_ipv4_tunnel_SIOCGETTUNNEL(0xffffffffffffffff, 0x89f0, &(0x7f0000000140)={'syztnl1\x00', &(0x7f00000000c0)={'syztnl2\x00', 0x0, 0x20, 0x1, 0x6, 0x9, {{0xd, 0x4, 0x1, 0x19, 0x34, 0x68, 0x0, 0x9, 0x29, 0x0, @empty, @dev={0xac, 0x14, 0x14, 0x29}, {[@timestamp_addr={0x44, 0x14, 0xc2, 0x1, 0x4, [{@multicast1}, {@private=0xa010101}]}, @rr={0x7, 0xb, 0xc8, [@initdev={0xac, 0x1e, 0x1, 0x0}, @private=0xa010102]}]}}}}}) ioctl$sock_ipv4_tunnel_SIOCADDTUNNEL(0xffffffffffffffff, 0x89f1, &(0x7f0000000280)={'tunl0\x00', &(0x7f0000000180)={'tunl0\x00', r0, 0x7, 0x8000, 0xfffffffc, 0x8, {{0x2f, 0x4, 0x0, 0x2, 0xbc, 0x65, 0x0, 0x0, 0x4, 0x0, @empty, @broadcast, {[@generic={0x89, 0x9, "8db1d464c6af68"}, @noop, @ra={0x94, 0x4, 0x1}, @timestamp={0x44, 0x1c, 0x53, 0x0, 0x7, [0x40, 0x7fffffff, 0xfffffffd, 0x5, 0x5c, 0x77]}, @cipso={0x86, 0x2f, 0x3, [{0x1, 0x4, "1eba"}, {0x1, 0x7, "e3ccb5ddcf"}, {0x6, 0xa, "5db18b961780af33"}, {0x2, 0xe, "7353a9824b57fd7d39232ac5"}, {0x1, 0x6, "2e1ccd27"}]}, @noop, @cipso={0x86, 0x37, 0xffffffffffffffff, [{0x2, 0xf, "227467028cabd4e137b820c5c9"}, {0x7, 0x6, "90569992"}, {0x2, 0xc, "2071b0a8c9ce92782e72"}, {0x6, 0xa, "14f2b9bca55ce3dd"}, {0x6, 0x6, "2cd22a8f"}]}, @timestamp={0x44, 0x14, 0xd4, 0x0, 0x5, [0x81, 0x5d23, 0x63ab, 0x1]}]}}}}}) ioctl$sock_ipv4_tunnel_SIOCDELTUNNEL(0xffffffffffffffff, 0x89f2, &(0x7f0000000380)={'gretap0\x00', &(0x7f00000002c0)={'syztnl2\x00', 0x0, 0x7800, 0x7, 0x40, 0xe180, {{0x22, 0x4, 0x0, 0x1, 0x88, 0x64, 0x0, 0x1, 0x29, 0x0, @multicast2, @multicast1, {[@end, @lsrr={0x83, 0x1f, 0x2f, [@multicast2, @local, @local, @multicast1, @rand_addr=0x64010102, @loopback, @private=0xa010100]}, @rr={0x7, 0x27, 0x6c, [@multicast1, @rand_addr=0x64010102, @remote, @multicast1, @loopback, @initdev={0xac, 0x1e, 0x0, 0x0}, @initdev={0xac, 0x1e, 0x1, 0x0}, @broadcast, @empty]}, @ra={0x94, 0x4, 0x1}, @timestamp={0x44, 0x10, 0x2d, 0x0, 0x8, [0x1, 0x100, 0x401]}, @ssrr={0x89, 0x13, 0x56, [@dev={0xac, 0x14, 0x14, 0x28}, @multicast2, @initdev={0xac, 0x1e, 0x0, 0x0}, @remote]}, @ra={0x94, 0x4, 0x1}]}}}}}) shmget(0x3, 0x4000, 0x4, &(0x7f0000ff9000/0x4000)=nil) mmap$IORING_OFF_CQ_RING(&(0x7f0000ffd000/0x3000)=nil, 0x3000, 0x2000008, 0x30, 0xffffffffffffffff, 0x8000000) r1 = syz_genetlink_get_family_id$nl802154(&(0x7f0000000400), 0xffffffffffffffff) ioctl$sock_SIOCGIFINDEX_802154(0xffffffffffffffff, 0x8933, &(0x7f0000000440)={'wpan1\x00', 0x0}) sendmsg$NL802154_CMD_NEW_INTERFACE(0xffffffffffffffff, &(0x7f0000000540)={&(0x7f00000003c0)={0x10, 0x0, 0x0, 0x2}, 0xc, &(0x7f0000000500)={&(0x7f0000000480)={0x48, r1, 0x200, 0x70bd2a, 0x25dfdbfd, {}, [@NL802154_ATTR_IFNAME={0xa, 0x4, 'wpan0\x00'}, @NL802154_ATTR_IFINDEX={0x8}, @NL802154_ATTR_IFNAME={0xa, 0x4, 'wpan1\x00'}, @NL802154_ATTR_EXTENDED_ADDR={0xc, 0x17, {0xaaaaaaaaaaaa0002}}, @NL802154_ATTR_IFINDEX={0x8, 0x3, r2}]}, 0x48}}, 0x4001) mmap$binder(&(0x7f0000fef000/0x11000)=nil, 0x11000, 0x1, 0x11, 0xffffffffffffffff, 0x6) shmget$private(0x0, 0x4000, 0x200, &(0x7f0000ffc000/0x4000)=nil) r3 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) ioctl$sock_SIOCGIFINDEX_802154(0xffffffffffffffff, 0x8933, &(0x7f00000005c0)={'wpan0\x00', 0x0}) sendmsg$IEEE802154_LLSEC_ADD_SECLEVEL(r3, &(0x7f00000006c0)={&(0x7f0000000580)={0x10, 0x0, 0x0, 0x4000000}, 0xc, &(0x7f0000000680)={&(0x7f0000000600)={0x44, 0x0, 0x200, 0x70bd2a, 0x25dfdbff, {}, [@IEEE802154_ATTR_LLSEC_FRAME_TYPE={0x5, 0x33, 0x34}, @IEEE802154_ATTR_DEV_INDEX={0x8, 0x2, r4}, @IEEE802154_ATTR_LLSEC_CMD_FRAME_ID={0x5, 0x34, 0x1}, @IEEE802154_ATTR_DEV_NAME={0xa, 0x1, 'wpan0\x00'}, @IEEE802154_ATTR_DEV_NAME={0xa, 0x1, 'wpan4\x00'}]}, 0x44}, 0x1, 0x0, 0x0, 0x8800}, 0x0) mlock(&(0x7f0000fef000/0x1000)=nil, 0x1000) syz_io_uring_setup(0x4726, &(0x7f0000000840)={0x0, 0x502f, 0x20, 0x0, 0x12e}, &(0x7f0000ffe000/0x2000)=nil, &(0x7f0000ffb000/0x4000)=nil, &(0x7f00000008c0), &(0x7f0000000900)) 17:45:03 executing program 3: getsockopt$inet_udp_int(0xffffffffffffffff, 0x11, 0x1, &(0x7f0000000000), &(0x7f0000000040)=0x4) setsockopt$inet_udp_int(0xffffffffffffffff, 0x11, 0x1, &(0x7f0000000080)=0x7, 0x4) ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, &(0x7f0000000240)={0x54, 0x0, &(0x7f00000000c0)=[@acquire_done={0x40106309, 0x1}, @free_buffer, @request_death={0x400c630e, 0x1}, @request_death, @decrefs, @dead_binder_done], 0xc7, 0x0, &(0x7f0000000140)="aa36e0fef6a6cd3a6060f434b2a2306a435d6c33ca3bfb20c9d046886ded10cf23d0938b55b8a812702a5a7579cb8813f0cf3954f24fa081e8c35a9d4674b51115d91e7f6e38920909a8fba27ba7bbb0522974a9d83826c23d40a56c3f88dc24276a8312ae50d15d3531211e4378a34980ea70ac3cefef2439af0baa6b387df4ff26b593ca52e94dda8ce3656a81180693ab97746e30b1301f30922ec565bba820fc06168927e446c06efe1fc7cb37b804ba0342e58e70da81c074407ec9cf690a9ab1e3a62a68"}) r0 = openat$vcsa(0xffffffffffffff9c, &(0x7f0000000280), 0x1, 0x0) r1 = openat$vcsa(0xffffffffffffff9c, &(0x7f00000002c0), 0x80, 0x0) ioctl$SNDRV_SEQ_IOCTL_QUERY_NEXT_PORT(r0, 0xc0a85352, &(0x7f0000000300)={{0x4, 0x6}, 'port0\x00', 0x5, 0x1, 0x0, 0xffff, 0x7, 0x7, 0x5, 0x0, 0x2, 0xc0}) ioctl$SNDRV_SEQ_IOCTL_QUERY_NEXT_CLIENT(r1, 0xc0bc5351, &(0x7f00000003c0)={0xffff7fff, 0x0, 'client0\x00', 0xffffffff80000002, "9aa89fbb0e155330", "7e3a03465d7350a6322e39e7997e8c634c3224eb46d1223d24ed4ce35c7b1dd2", 0x0, 0x6}) r2 = openat$nvram(0xffffffffffffff9c, &(0x7f0000000480), 0x1, 0x0) ioctl$PERF_EVENT_IOC_PAUSE_OUTPUT(r2, 0x40042409, 0x0) process_mrelease(r0, 0x0) ioctl$SNDRV_TIMER_IOCTL_TREAD(r1, 0x40045402, &(0x7f00000004c0)) r3 = socket$inet_udp(0x2, 0x2, 0x0) ioctl$sock_inet_udp_SIOCINQ(r3, 0x541b, &(0x7f0000000500)) getsockopt$inet_IP_IPSEC_POLICY(r0, 0x0, 0x10, &(0x7f0000000540)={{{@in=@broadcast, @in6=@mcast1}}, {{@in=@broadcast}, 0x0, @in6=@mcast2}}, &(0x7f0000000640)=0xe8) r4 = openat$nvram(0xffffffffffffff9c, &(0x7f0000000700), 0x800, 0x0) write$P9_RGETLOCK(r4, &(0x7f00000007c0)={0x1e, 0x37, 0x2, {0x2, 0x6, 0x101}}, 0x1e) 17:45:03 executing program 6: r0 = perf_event_open(&(0x7f00000000c0)={0x1, 0x80, 0x0, 0xc0, 0xfa, 0x1, 0x0, 0x7fffffff, 0x10811, 0x1, 0x1, 0x1, 0x1, 0x1, 0x1, 0x1, 0x1, 0x1, 0x0, 0x1, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x1, 0x0, 0x1, 0x0, 0x0, 0x0, 0x1, 0x1, 0x1, 0x1, 0x1, 0x1, 0x1, 0x0, 0x1, 0x1, 0x1, 0x1, 0x0, 0x0, 0xfff, 0x7, @perf_config_ext={0x7, 0x7fffffff}, 0x41000, 0x80000000, 0x5, 0x3, 0x9, 0x2, 0x9, 0x0, 0x5, 0x0, 0x4}, 0x0, 0xb, 0xffffffffffffffff, 0x1) perf_event_open(&(0x7f0000000040)={0x0, 0x80, 0x0, 0x40, 0x80, 0x9, 0x0, 0x3, 0x10040, 0x1, 0x0, 0x0, 0x1, 0x1, 0x1, 0x1, 0x1, 0x1, 0x1, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x3, 0x1, 0x0, 0x1, 0x0, 0x1, 0x1, 0x0, 0x0, 0x1, 0x1, 0x1, 0x0, 0x1, 0x0, 0x0, 0x0, 0x1, 0x0, 0x1, 0x0, 0x1, 0x0, 0x0, 0x1, @perf_bp={&(0x7f0000000000), 0x10}, 0x8080, 0x800, 0x2, 0x3, 0x36dc, 0x31df3b33, 0xff, 0x0, 0x9, 0x0, 0x5}, 0xffffffffffffffff, 0x9, r0, 0x9) ioctl$PERF_EVENT_IOC_PAUSE_OUTPUT(r0, 0x40042409, 0x0) ioctl$PERF_EVENT_IOC_PERIOD(0xffffffffffffffff, 0x40082404, &(0x7f0000000140)=0x8) r1 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl$sock_ipv4_tunnel_SIOCADDTUNNEL(r1, 0x89f1, &(0x7f00000001c0)={'syztnl1\x00', &(0x7f0000000180)={'syztnl0\x00', 0x0, 0x1, 0x40, 0x0, 0x5, {{0x5, 0x4, 0x2, 0x19, 0x14, 0x65, 0x0, 0x1f, 0x4, 0x0, @multicast2, @remote}}}}) ioctl$PERF_EVENT_IOC_PERIOD(r0, 0x40082404, &(0x7f0000000200)=0x9) ioctl$SNDRV_SEQ_IOCTL_GET_PORT_INFO(0xffffffffffffffff, 0xc0a85322, &(0x7f0000000240)) ioctl$SNDRV_SEQ_IOCTL_SYSTEM_INFO(0xffffffffffffffff, 0xc0305302, &(0x7f0000000300)={0x9, 0x101, 0x1, 0x6, 0x3, 0x5}) r2 = syz_open_procfs(0x0, &(0x7f0000000340)='children\x00') openat$cgroup_type(r2, &(0x7f0000000380), 0x2, 0x0) ioctl$EVIOCGABS20(r2, 0x80184560, &(0x7f00000003c0)=""/4096) socket$inet6_tcp(0xa, 0x1, 0x0) r3 = openat$nvram(0xffffffffffffff9c, &(0x7f00000013c0), 0xdd0e52fd5a017ff5, 0x0) mmap$perf(&(0x7f0000ffe000/0x2000)=nil, 0x2000, 0x2000001, 0x10, r3, 0x4) write$cgroup_type(0xffffffffffffffff, &(0x7f0000001500), 0x9) 17:45:03 executing program 7: r0 = perf_event_open(&(0x7f0000000040)={0x4, 0x80, 0x6f, 0x8, 0x8, 0x1, 0x0, 0x6, 0x4, 0x1, 0x1, 0x0, 0x0, 0x1, 0x1, 0x1, 0x0, 0x0, 0x1, 0x0, 0x0, 0x1, 0x1, 0x0, 0x0, 0x2, 0x1, 0x0, 0x0, 0x1, 0x0, 0x0, 0x1, 0x0, 0x1, 0x0, 0x0, 0x0, 0x1, 0x1, 0x1, 0x0, 0x1, 0x1, 0x1, 0x0, 0x1, 0x0, 0x50, 0x2, @perf_bp={&(0x7f0000000000), 0xa}, 0x2100, 0x7, 0x1, 0x3, 0x6, 0x93d3, 0x0, 0x0, 0x3a, 0x0, 0x9}, 0xffffffffffffffff, 0xc, 0xffffffffffffffff, 0x8) mmap$perf(&(0x7f0000ffb000/0x2000)=nil, 0x2000, 0xb, 0x11, r0, 0x8) munmap(&(0x7f0000ffb000/0x3000)=nil, 0x3000) getsockopt$inet6_tcp_TCP_ZEROCOPY_RECEIVE(0xffffffffffffffff, 0x6, 0x23, &(0x7f0000001180)={&(0x7f0000ffd000/0x2000)=nil, 0x2000, 0x0, 0x0, 0x0, &(0x7f00000000c0)=""/162, 0xa2, 0x0, &(0x7f0000000180)=""/4096, 0x1000}, &(0x7f00000011c0)=0x40) r1 = openat$vcsa(0xffffffffffffff9c, &(0x7f0000001200), 0x14d080, 0x0) ioctl$SNDRV_SEQ_IOCTL_SUBSCRIBE_PORT(r1, 0x40505330, &(0x7f0000001240)={{0x3f, 0x40}, {0x9, 0x2}, 0x43, 0x0, 0x1}) r2 = mmap$binder(&(0x7f0000ffc000/0x1000)=nil, 0x1000, 0x1, 0x11, r1, 0x81) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000001380)={0x44, 0x0, &(0x7f00000012c0)=[@acquire={0x40046305, 0x3}, @increfs, @free_buffer={0x40086303, r2}, @exit_looper, @request_death={0x400c630e, 0x3}, @increfs={0x40046304, 0x2}, @free_buffer], 0x1d, 0x0, &(0x7f0000001340)="63170b84a45d435cf194bbb38c0432388cb6578156ee80dc59b93c914c"}) r3 = openat$vcsa(0xffffffffffffff9c, &(0x7f00000013c0), 0x400000, 0x0) ioctl$SNDRV_SEQ_IOCTL_GET_SUBSCRIPTION(r3, 0xc0505350, &(0x7f0000001400)={{0x1, 0x6}, {0x1f, 0x81}, 0x4, 0x3, 0x7}) r4 = openat$nvram(0xffffffffffffff9c, &(0x7f0000001480), 0x105500, 0x0) mmap$IORING_OFF_SQ_RING(&(0x7f0000ffd000/0x1000)=nil, 0x1000, 0x0, 0x13, r4, 0x0) shmget(0x0, 0x1000, 0x200, &(0x7f0000ffd000/0x1000)=nil) 17:45:03 executing program 5: clock_gettime(0x5, &(0x7f0000000000)) clock_settime(0x2, &(0x7f0000000040)) sched_rr_get_interval(0xffffffffffffffff, &(0x7f0000000080)) sched_rr_get_interval(0x0, &(0x7f00000000c0)) sendmsg$NL802154_CMD_GET_SEC_KEY(0xffffffffffffffff, &(0x7f00000001c0)={&(0x7f0000000100)={0x10, 0x0, 0x0, 0x20000000}, 0xc, &(0x7f0000000180)={&(0x7f0000000140)={0x24, 0x0, 0x200, 0x70bd26, 0x25dfdbfe, {}, [@NL802154_ATTR_IFINDEX={0x8}, @NL802154_ATTR_IFINDEX={0x8}]}, 0x24}, 0x1, 0x0, 0x0, 0x4000000}, 0x181) clock_gettime(0x0, &(0x7f0000000200)) pipe2$9p(&(0x7f0000000240)={0xffffffffffffffff, 0xffffffffffffffff}, 0x800) r1 = syz_io_uring_setup(0x776a, &(0x7f0000000280)={0x0, 0x2728, 0x2, 0x1, 0x37c}, &(0x7f0000000000/0x3000)=nil, &(0x7f0000000000/0x400000)=nil, &(0x7f0000000300), &(0x7f0000000340)) ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, &(0x7f0000000540)={0x64, 0x0, &(0x7f0000000440)=[@transaction_sg={0x40486311, {0x1, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x50, 0x18, &(0x7f0000000380)={@fd={0x66642a85, 0x0, r0}, @fd={0x66642a85, 0x0, r1}, @fda={0x66646185, 0x0, 0x2, 0x36}}, &(0x7f0000000400)={0x0, 0x18, 0x30}}}, @request_death, @release={0x40046306, 0x1}], 0x7e, 0x0, &(0x7f00000004c0)="7685c519d1cbea63a1a8f022f8c0085baf770aa5d1fa9bfb1a5399fdb134953d619e962218bba650b68d6206fde39ff17760aa4bbcb62f6802c48e17294a17a3b768ab60bbae37aa37e33e24b09f6bdea37853f7ab2622451803788c9d172b7d71d6d87911129b8ef5cc9e0169404b09abfa991f3a7a3640686df445d387"}) pipe2$9p(&(0x7f0000000580), 0x800) ioctl$EVIOCGVERSION(0xffffffffffffffff, 0x80044501, &(0x7f00000005c0)=""/174) r2 = openat$nvram(0xffffffffffffff9c, &(0x7f0000000680), 0x400, 0x0) write$P9_RSTAT(r2, &(0x7f00000006c0)={0x3f, 0x7d, 0x1, {0x0, 0x38, 0x401, 0x8000, {0x80, 0x4, 0x1}, 0x2020000, 0x4, 0x60, 0x9, 0x1, '\x00', 0x2, '.-', 0x1, '\x00', 0x1, '\x00'}}, 0x3f) syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r3 = syz_genetlink_get_family_id$ieee802154(&(0x7f0000000740), 0xffffffffffffffff) clock_getres(0x3, &(0x7f0000000880)) r4 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) sendmsg$IEEE802154_ADD_IFACE(r4, &(0x7f0000000a00)={&(0x7f0000000900)={0x10, 0x0, 0x0, 0x40c}, 0xc, &(0x7f00000009c0)={&(0x7f0000000940)={0x44, r3, 0x200, 0x70bd29, 0x25dfdbfe, {}, [@IEEE802154_ATTR_PHY_NAME={0x9, 0x1f, 'phy1\x00'}, @IEEE802154_ATTR_DEV_NAME={0xa, 0x1, 'wpan4\x00'}, @IEEE802154_ATTR_DEV_NAME={0xa, 0x1, 'wpan1\x00'}, @IEEE802154_ATTR_DEV_NAME={0xa, 0x1, 'wpan0\x00'}]}, 0x44}, 0x1, 0x0, 0x0, 0x20000084}, 0x44000) 17:45:03 executing program 0: get_thread_area(&(0x7f0000000000)={0x7, 0x20000800, 0x4000, 0x0, 0x1, 0x0, 0x0, 0x1, 0x1, 0x1}) r0 = openat$vcsu(0xffffffffffffff9c, &(0x7f0000000040), 0x200000, 0x0) getsockopt$inet_tcp_TCP_REPAIR_WINDOW(r0, 0x6, 0x1d, &(0x7f0000000080), &(0x7f00000000c0)=0x14) r1 = openat$nvram(0xffffffffffffff9c, &(0x7f0000000100), 0x2000, 0x0) setsockopt$inet_tcp_TCP_FASTOPEN_KEY(r1, 0x6, 0x21, &(0x7f0000000140)="1bb9d563048b6ec78effc0f14d974b17", 0x10) setsockopt$inet_tcp_int(r1, 0x6, 0x1b, &(0x7f0000000180)=0x5, 0x4) ioctl$SNDRV_TIMER_IOCTL_STATUS32(r1, 0x80585414, &(0x7f00000001c0)) setsockopt$inet_tcp_TCP_QUEUE_SEQ(r0, 0x6, 0x15, &(0x7f0000000240)=0x1, 0x4) getsockopt$inet_tcp_TCP_ZEROCOPY_RECEIVE(r1, 0x6, 0x23, &(0x7f0000000340)={&(0x7f0000ffc000/0x2000)=nil, 0x2000, 0x0, 0x0, 0x0, &(0x7f0000000280)=""/37, 0x25, 0x1, &(0x7f00000002c0)=""/109, 0x6d}, &(0x7f0000000380)=0x40) r2 = socket$inet_tcp(0x2, 0x1, 0x0) ioctl$sock_inet_tcp_SIOCINQ(r2, 0x541b, &(0x7f00000003c0)) move_pages(0x0, 0x8, &(0x7f0000000400)=[&(0x7f0000ffd000/0x1000)=nil, &(0x7f0000ffd000/0x3000)=nil, &(0x7f0000ffd000/0x3000)=nil, &(0x7f0000ffb000/0x2000)=nil, &(0x7f0000ffc000/0x1000)=nil, &(0x7f0000ffe000/0x2000)=nil, &(0x7f0000ffb000/0x4000)=nil, &(0x7f0000ffd000/0x3000)=nil], &(0x7f0000000440)=[0xfff], &(0x7f0000000480)=[0x0, 0x0, 0x0], 0x4) r3 = syz_genetlink_get_family_id$SEG6(&(0x7f0000000500), r1) sendmsg$SEG6_CMD_GET_TUNSRC(r0, &(0x7f00000005c0)={&(0x7f00000004c0)={0x10, 0x0, 0x0, 0x4000000}, 0xc, &(0x7f0000000580)={&(0x7f0000000540)={0x38, r3, 0x300, 0x70bd2a, 0x25dfdbfc, {}, [@SEG6_ATTR_HMACKEYID={0x8, 0x3, 0x24}, @SEG6_ATTR_DST={0x14, 0x1, @mcast1}, @SEG6_ATTR_DSTLEN={0x8, 0x2, 0x2}]}, 0x38}, 0x1, 0x0, 0x0, 0x20008810}, 0x4040010) ioctl$SNDRV_SEQ_IOCTL_SET_QUEUE_TIMER(r1, 0x40605346, &(0x7f0000000600)={0x80, 0x1, {0x1, 0x0, 0x81}, 0x2}) pidfd_getfd(r1, r2, 0x0) syz_genetlink_get_family_id$ieee802154(&(0x7f0000000800), 0xffffffffffffffff) 17:45:12 executing program 4: ioctl$SNDRV_TIMER_IOCTL_TREAD(0xffffffffffffffff, 0x40045402, &(0x7f0000000000)) wait4(0xffffffffffffffff, &(0x7f0000000040), 0x1, &(0x7f0000000080)) shmget(0x1, 0x3000, 0x20, &(0x7f0000ffc000/0x3000)=nil) 17:45:12 executing program 5: clock_gettime(0x5, &(0x7f0000000000)) clock_settime(0x2, &(0x7f0000000040)) sched_rr_get_interval(0xffffffffffffffff, &(0x7f0000000080)) sched_rr_get_interval(0x0, &(0x7f00000000c0)) sendmsg$NL802154_CMD_GET_SEC_KEY(0xffffffffffffffff, &(0x7f00000001c0)={&(0x7f0000000100)={0x10, 0x0, 0x0, 0x20000000}, 0xc, &(0x7f0000000180)={&(0x7f0000000140)={0x24, 0x0, 0x200, 0x70bd26, 0x25dfdbfe, {}, [@NL802154_ATTR_IFINDEX={0x8}, @NL802154_ATTR_IFINDEX={0x8}]}, 0x24}, 0x1, 0x0, 0x0, 0x4000000}, 0x181) clock_gettime(0x0, &(0x7f0000000200)) pipe2$9p(&(0x7f0000000240)={0xffffffffffffffff, 0xffffffffffffffff}, 0x800) r1 = syz_io_uring_setup(0x776a, &(0x7f0000000280)={0x0, 0x2728, 0x2, 0x1, 0x37c}, &(0x7f0000000000/0x3000)=nil, &(0x7f0000000000/0x400000)=nil, &(0x7f0000000300), &(0x7f0000000340)) ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, &(0x7f0000000540)={0x64, 0x0, &(0x7f0000000440)=[@transaction_sg={0x40486311, {0x1, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x50, 0x18, &(0x7f0000000380)={@fd={0x66642a85, 0x0, r0}, @fd={0x66642a85, 0x0, r1}, @fda={0x66646185, 0x0, 0x2, 0x36}}, &(0x7f0000000400)={0x0, 0x18, 0x30}}}, @request_death, @release={0x40046306, 0x1}], 0x7e, 0x0, &(0x7f00000004c0)="7685c519d1cbea63a1a8f022f8c0085baf770aa5d1fa9bfb1a5399fdb134953d619e962218bba650b68d6206fde39ff17760aa4bbcb62f6802c48e17294a17a3b768ab60bbae37aa37e33e24b09f6bdea37853f7ab2622451803788c9d172b7d71d6d87911129b8ef5cc9e0169404b09abfa991f3a7a3640686df445d387"}) pipe2$9p(&(0x7f0000000580), 0x800) ioctl$EVIOCGVERSION(0xffffffffffffffff, 0x80044501, &(0x7f00000005c0)=""/174) r2 = openat$nvram(0xffffffffffffff9c, &(0x7f0000000680), 0x400, 0x0) write$P9_RSTAT(r2, &(0x7f00000006c0)={0x3f, 0x7d, 0x1, {0x0, 0x38, 0x401, 0x8000, {0x80, 0x4, 0x1}, 0x2020000, 0x4, 0x60, 0x9, 0x1, '\x00', 0x2, '.-', 0x1, '\x00', 0x1, '\x00'}}, 0x3f) syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r3 = syz_genetlink_get_family_id$ieee802154(&(0x7f0000000740), 0xffffffffffffffff) clock_getres(0x3, &(0x7f0000000880)) r4 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) sendmsg$IEEE802154_ADD_IFACE(r4, &(0x7f0000000a00)={&(0x7f0000000900)={0x10, 0x0, 0x0, 0x40c}, 0xc, &(0x7f00000009c0)={&(0x7f0000000940)={0x44, r3, 0x200, 0x70bd29, 0x25dfdbfe, {}, [@IEEE802154_ATTR_PHY_NAME={0x9, 0x1f, 'phy1\x00'}, @IEEE802154_ATTR_DEV_NAME={0xa, 0x1, 'wpan4\x00'}, @IEEE802154_ATTR_DEV_NAME={0xa, 0x1, 'wpan1\x00'}, @IEEE802154_ATTR_DEV_NAME={0xa, 0x1, 'wpan0\x00'}]}, 0x44}, 0x1, 0x0, 0x0, 0x20000084}, 0x44000) 17:45:12 executing program 6: r0 = perf_event_open(&(0x7f00000000c0)={0x1, 0x80, 0x0, 0xc0, 0xfa, 0x1, 0x0, 0x7fffffff, 0x10811, 0x1, 0x1, 0x1, 0x1, 0x1, 0x1, 0x1, 0x1, 0x1, 0x0, 0x1, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x1, 0x0, 0x1, 0x0, 0x0, 0x0, 0x1, 0x1, 0x1, 0x1, 0x1, 0x1, 0x1, 0x0, 0x1, 0x1, 0x1, 0x1, 0x0, 0x0, 0xfff, 0x7, @perf_config_ext={0x7, 0x7fffffff}, 0x41000, 0x80000000, 0x5, 0x3, 0x9, 0x2, 0x9, 0x0, 0x5, 0x0, 0x4}, 0x0, 0xb, 0xffffffffffffffff, 0x1) perf_event_open(&(0x7f0000000040)={0x0, 0x80, 0x0, 0x40, 0x80, 0x9, 0x0, 0x3, 0x10040, 0x1, 0x0, 0x0, 0x1, 0x1, 0x1, 0x1, 0x1, 0x1, 0x1, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x3, 0x1, 0x0, 0x1, 0x0, 0x1, 0x1, 0x0, 0x0, 0x1, 0x1, 0x1, 0x0, 0x1, 0x0, 0x0, 0x0, 0x1, 0x0, 0x1, 0x0, 0x1, 0x0, 0x0, 0x1, @perf_bp={&(0x7f0000000000), 0x10}, 0x8080, 0x800, 0x2, 0x3, 0x36dc, 0x31df3b33, 0xff, 0x0, 0x9, 0x0, 0x5}, 0xffffffffffffffff, 0x9, r0, 0x9) ioctl$PERF_EVENT_IOC_PAUSE_OUTPUT(r0, 0x40042409, 0x0) ioctl$PERF_EVENT_IOC_PERIOD(0xffffffffffffffff, 0x40082404, &(0x7f0000000140)=0x8) r1 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl$sock_ipv4_tunnel_SIOCADDTUNNEL(r1, 0x89f1, &(0x7f00000001c0)={'syztnl1\x00', &(0x7f0000000180)={'syztnl0\x00', 0x0, 0x1, 0x40, 0x0, 0x5, {{0x5, 0x4, 0x2, 0x19, 0x14, 0x65, 0x0, 0x1f, 0x4, 0x0, @multicast2, @remote}}}}) ioctl$PERF_EVENT_IOC_PERIOD(r0, 0x40082404, &(0x7f0000000200)=0x9) ioctl$SNDRV_SEQ_IOCTL_GET_PORT_INFO(0xffffffffffffffff, 0xc0a85322, &(0x7f0000000240)) ioctl$SNDRV_SEQ_IOCTL_SYSTEM_INFO(0xffffffffffffffff, 0xc0305302, &(0x7f0000000300)={0x9, 0x101, 0x1, 0x6, 0x3, 0x5}) r2 = syz_open_procfs(0x0, &(0x7f0000000340)='children\x00') openat$cgroup_type(r2, &(0x7f0000000380), 0x2, 0x0) ioctl$EVIOCGABS20(r2, 0x80184560, &(0x7f00000003c0)=""/4096) socket$inet6_tcp(0xa, 0x1, 0x0) openat$nvram(0xffffffffffffff9c, &(0x7f00000013c0), 0xdd0e52fd5a017ff5, 0x0) write$cgroup_type(0xffffffffffffffff, &(0x7f0000001500), 0x9) 17:45:12 executing program 0: get_thread_area(&(0x7f0000000000)={0x7, 0x20000800, 0x4000, 0x0, 0x1, 0x0, 0x0, 0x1, 0x1, 0x1}) r0 = openat$vcsu(0xffffffffffffff9c, &(0x7f0000000040), 0x200000, 0x0) getsockopt$inet_tcp_TCP_REPAIR_WINDOW(r0, 0x6, 0x1d, &(0x7f0000000080), &(0x7f00000000c0)=0x14) r1 = openat$nvram(0xffffffffffffff9c, &(0x7f0000000100), 0x2000, 0x0) setsockopt$inet_tcp_TCP_FASTOPEN_KEY(r1, 0x6, 0x21, &(0x7f0000000140)="1bb9d563048b6ec78effc0f14d974b17", 0x10) setsockopt$inet_tcp_int(r1, 0x6, 0x1b, &(0x7f0000000180)=0x5, 0x4) ioctl$SNDRV_TIMER_IOCTL_STATUS32(r1, 0x80585414, &(0x7f00000001c0)) setsockopt$inet_tcp_TCP_QUEUE_SEQ(r0, 0x6, 0x15, &(0x7f0000000240)=0x1, 0x4) getsockopt$inet_tcp_TCP_ZEROCOPY_RECEIVE(r1, 0x6, 0x23, &(0x7f0000000340)={&(0x7f0000ffc000/0x2000)=nil, 0x2000, 0x0, 0x0, 0x0, &(0x7f0000000280)=""/37, 0x25, 0x1, &(0x7f00000002c0)=""/109, 0x6d}, &(0x7f0000000380)=0x40) r2 = socket$inet_tcp(0x2, 0x1, 0x0) ioctl$sock_inet_tcp_SIOCINQ(r2, 0x541b, &(0x7f00000003c0)) move_pages(0x0, 0x8, &(0x7f0000000400)=[&(0x7f0000ffd000/0x1000)=nil, &(0x7f0000ffd000/0x3000)=nil, &(0x7f0000ffd000/0x3000)=nil, &(0x7f0000ffb000/0x2000)=nil, &(0x7f0000ffc000/0x1000)=nil, &(0x7f0000ffe000/0x2000)=nil, &(0x7f0000ffb000/0x4000)=nil, &(0x7f0000ffd000/0x3000)=nil], &(0x7f0000000440)=[0xfff], &(0x7f0000000480)=[0x0, 0x0, 0x0], 0x4) r3 = syz_genetlink_get_family_id$SEG6(&(0x7f0000000500), r1) sendmsg$SEG6_CMD_GET_TUNSRC(r0, &(0x7f00000005c0)={&(0x7f00000004c0)={0x10, 0x0, 0x0, 0x4000000}, 0xc, &(0x7f0000000580)={&(0x7f0000000540)={0x38, r3, 0x300, 0x70bd2a, 0x25dfdbfc, {}, [@SEG6_ATTR_HMACKEYID={0x8, 0x3, 0x24}, @SEG6_ATTR_DST={0x14, 0x1, @mcast1}, @SEG6_ATTR_DSTLEN={0x8, 0x2, 0x2}]}, 0x38}, 0x1, 0x0, 0x0, 0x20008810}, 0x4040010) ioctl$SNDRV_SEQ_IOCTL_SET_QUEUE_TIMER(r1, 0x40605346, &(0x7f0000000600)={0x80, 0x1, {0x1, 0x0, 0x81}, 0x2}) pidfd_getfd(r1, r2, 0x0) syz_genetlink_get_family_id$ieee802154(&(0x7f0000000800), 0xffffffffffffffff) 17:45:12 executing program 1: shmget$private(0x0, 0x4000, 0x80, &(0x7f0000ffb000/0x4000)=nil) shmget(0x3, 0x2000, 0x4, &(0x7f0000ffc000/0x2000)=nil) mlock(&(0x7f0000ff0000/0x10000)=nil, 0x10000) shmget(0x1, 0x1000, 0x10, &(0x7f0000ff5000/0x1000)=nil) ioctl$sock_ipv4_tunnel_SIOCGETTUNNEL(0xffffffffffffffff, 0x89f0, &(0x7f0000000140)={'syztnl1\x00', &(0x7f00000000c0)={'syztnl2\x00', 0x0, 0x20, 0x1, 0x6, 0x9, {{0xd, 0x4, 0x1, 0x19, 0x34, 0x68, 0x0, 0x9, 0x29, 0x0, @empty, @dev={0xac, 0x14, 0x14, 0x29}, {[@timestamp_addr={0x44, 0x14, 0xc2, 0x1, 0x4, [{@multicast1}, {@private=0xa010101}]}, @rr={0x7, 0xb, 0xc8, [@initdev={0xac, 0x1e, 0x1, 0x0}, @private=0xa010102]}]}}}}}) ioctl$sock_ipv4_tunnel_SIOCADDTUNNEL(0xffffffffffffffff, 0x89f1, &(0x7f0000000280)={'tunl0\x00', &(0x7f0000000180)={'tunl0\x00', r0, 0x7, 0x8000, 0xfffffffc, 0x8, {{0x2f, 0x4, 0x0, 0x2, 0xbc, 0x65, 0x0, 0x0, 0x4, 0x0, @empty, @broadcast, {[@generic={0x89, 0x9, "8db1d464c6af68"}, @noop, @ra={0x94, 0x4, 0x1}, @timestamp={0x44, 0x1c, 0x53, 0x0, 0x7, [0x40, 0x7fffffff, 0xfffffffd, 0x5, 0x5c, 0x77]}, @cipso={0x86, 0x2f, 0x3, [{0x1, 0x4, "1eba"}, {0x1, 0x7, "e3ccb5ddcf"}, {0x6, 0xa, "5db18b961780af33"}, {0x2, 0xe, "7353a9824b57fd7d39232ac5"}, {0x1, 0x6, "2e1ccd27"}]}, @noop, @cipso={0x86, 0x37, 0xffffffffffffffff, [{0x2, 0xf, "227467028cabd4e137b820c5c9"}, {0x7, 0x6, "90569992"}, {0x2, 0xc, "2071b0a8c9ce92782e72"}, {0x6, 0xa, "14f2b9bca55ce3dd"}, {0x6, 0x6, "2cd22a8f"}]}, @timestamp={0x44, 0x14, 0xd4, 0x0, 0x5, [0x81, 0x5d23, 0x63ab, 0x1]}]}}}}}) ioctl$sock_ipv4_tunnel_SIOCDELTUNNEL(0xffffffffffffffff, 0x89f2, &(0x7f0000000380)={'gretap0\x00', &(0x7f00000002c0)={'syztnl2\x00', 0x0, 0x7800, 0x7, 0x40, 0xe180, {{0x22, 0x4, 0x0, 0x1, 0x88, 0x64, 0x0, 0x1, 0x29, 0x0, @multicast2, @multicast1, {[@end, @lsrr={0x83, 0x1f, 0x2f, [@multicast2, @local, @local, @multicast1, @rand_addr=0x64010102, @loopback, @private=0xa010100]}, @rr={0x7, 0x27, 0x6c, [@multicast1, @rand_addr=0x64010102, @remote, @multicast1, @loopback, @initdev={0xac, 0x1e, 0x0, 0x0}, @initdev={0xac, 0x1e, 0x1, 0x0}, @broadcast, @empty]}, @ra={0x94, 0x4, 0x1}, @timestamp={0x44, 0x10, 0x2d, 0x0, 0x8, [0x1, 0x100, 0x401]}, @ssrr={0x89, 0x13, 0x56, [@dev={0xac, 0x14, 0x14, 0x28}, @multicast2, @initdev={0xac, 0x1e, 0x0, 0x0}, @remote]}, @ra={0x94, 0x4, 0x1}]}}}}}) shmget(0x3, 0x4000, 0x4, &(0x7f0000ff9000/0x4000)=nil) mmap$IORING_OFF_CQ_RING(&(0x7f0000ffd000/0x3000)=nil, 0x3000, 0x2000008, 0x30, 0xffffffffffffffff, 0x8000000) r1 = syz_genetlink_get_family_id$nl802154(&(0x7f0000000400), 0xffffffffffffffff) ioctl$sock_SIOCGIFINDEX_802154(0xffffffffffffffff, 0x8933, &(0x7f0000000440)={'wpan1\x00', 0x0}) sendmsg$NL802154_CMD_NEW_INTERFACE(0xffffffffffffffff, &(0x7f0000000540)={&(0x7f00000003c0)={0x10, 0x0, 0x0, 0x2}, 0xc, &(0x7f0000000500)={&(0x7f0000000480)={0x48, r1, 0x200, 0x70bd2a, 0x25dfdbfd, {}, [@NL802154_ATTR_IFNAME={0xa, 0x4, 'wpan0\x00'}, @NL802154_ATTR_IFINDEX={0x8}, @NL802154_ATTR_IFNAME={0xa, 0x4, 'wpan1\x00'}, @NL802154_ATTR_EXTENDED_ADDR={0xc, 0x17, {0xaaaaaaaaaaaa0002}}, @NL802154_ATTR_IFINDEX={0x8, 0x3, r2}]}, 0x48}}, 0x4001) mmap$binder(&(0x7f0000fef000/0x11000)=nil, 0x11000, 0x1, 0x11, 0xffffffffffffffff, 0x6) shmget$private(0x0, 0x4000, 0x200, &(0x7f0000ffc000/0x4000)=nil) r3 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) ioctl$sock_SIOCGIFINDEX_802154(0xffffffffffffffff, 0x8933, &(0x7f00000005c0)={'wpan0\x00'}) sendmsg$IEEE802154_START_REQ(r3, &(0x7f00000007c0)={&(0x7f0000000700)={0x10, 0x0, 0x0, 0x4}, 0xc, &(0x7f0000000780)={&(0x7f0000000740)={0x1c, 0x0, 0x200, 0x70bd2d, 0x25dfdbfb, {}, [@IEEE802154_ATTR_CHANNEL={0x5, 0x7, 0x6}]}, 0x1c}, 0x1, 0x0, 0x0, 0x40100}, 0x801) mlock(&(0x7f0000fef000/0x1000)=nil, 0x1000) syz_io_uring_setup(0x4726, &(0x7f0000000840)={0x0, 0x502f, 0x20, 0x0, 0x12e}, &(0x7f0000ffe000/0x2000)=nil, &(0x7f0000ffb000/0x4000)=nil, &(0x7f00000008c0), &(0x7f0000000900)) 17:45:12 executing program 7: r0 = perf_event_open(&(0x7f0000000040)={0x4, 0x80, 0x6f, 0x8, 0x8, 0x1, 0x0, 0x6, 0x4, 0x1, 0x1, 0x0, 0x0, 0x1, 0x1, 0x1, 0x0, 0x0, 0x1, 0x0, 0x0, 0x1, 0x1, 0x0, 0x0, 0x2, 0x1, 0x0, 0x0, 0x1, 0x0, 0x0, 0x1, 0x0, 0x1, 0x0, 0x0, 0x0, 0x1, 0x1, 0x1, 0x0, 0x1, 0x1, 0x1, 0x0, 0x1, 0x0, 0x50, 0x2, @perf_bp={&(0x7f0000000000), 0xa}, 0x2100, 0x7, 0x1, 0x3, 0x6, 0x93d3, 0x0, 0x0, 0x3a, 0x0, 0x9}, 0xffffffffffffffff, 0xc, 0xffffffffffffffff, 0x8) mmap$perf(&(0x7f0000ffb000/0x2000)=nil, 0x2000, 0xb, 0x11, r0, 0x8) munmap(&(0x7f0000ffb000/0x3000)=nil, 0x3000) getsockopt$inet6_tcp_TCP_ZEROCOPY_RECEIVE(0xffffffffffffffff, 0x6, 0x23, &(0x7f0000001180)={&(0x7f0000ffd000/0x2000)=nil, 0x2000, 0x0, 0x0, 0x0, &(0x7f00000000c0)=""/162, 0xa2, 0x0, &(0x7f0000000180)=""/4096, 0x1000}, &(0x7f00000011c0)=0x40) r1 = openat$vcsa(0xffffffffffffff9c, &(0x7f0000001200), 0x14d080, 0x0) ioctl$SNDRV_SEQ_IOCTL_SUBSCRIBE_PORT(r1, 0x40505330, &(0x7f0000001240)={{0x3f, 0x40}, {0x9, 0x2}, 0x43, 0x0, 0x1}) r2 = mmap$binder(&(0x7f0000ffc000/0x1000)=nil, 0x1000, 0x1, 0x11, r1, 0x81) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000001380)={0x44, 0x0, &(0x7f00000012c0)=[@acquire={0x40046305, 0x3}, @increfs, @free_buffer={0x40086303, r2}, @exit_looper, @request_death={0x400c630e, 0x3}, @increfs={0x40046304, 0x2}, @free_buffer], 0x1d, 0x0, &(0x7f0000001340)="63170b84a45d435cf194bbb38c0432388cb6578156ee80dc59b93c914c"}) r3 = openat$vcsa(0xffffffffffffff9c, &(0x7f00000013c0), 0x400000, 0x0) ioctl$SNDRV_SEQ_IOCTL_GET_SUBSCRIPTION(r3, 0xc0505350, &(0x7f0000001400)={{0x1, 0x6}, {0x1f, 0x81}, 0x4, 0x3, 0x7}) openat$nvram(0xffffffffffffff9c, &(0x7f0000001480), 0x105500, 0x0) shmget(0x0, 0x1000, 0x200, &(0x7f0000ffd000/0x1000)=nil) 17:45:12 executing program 3: getsockopt$inet_udp_int(0xffffffffffffffff, 0x11, 0x1, &(0x7f0000000000), &(0x7f0000000040)=0x4) setsockopt$inet_udp_int(0xffffffffffffffff, 0x11, 0x1, &(0x7f0000000080)=0x7, 0x4) ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, &(0x7f0000000240)={0x54, 0x0, &(0x7f00000000c0)=[@acquire_done={0x40106309, 0x1}, @free_buffer, @request_death={0x400c630e, 0x1}, @request_death, @decrefs, @dead_binder_done], 0xc7, 0x0, &(0x7f0000000140)="aa36e0fef6a6cd3a6060f434b2a2306a435d6c33ca3bfb20c9d046886ded10cf23d0938b55b8a812702a5a7579cb8813f0cf3954f24fa081e8c35a9d4674b51115d91e7f6e38920909a8fba27ba7bbb0522974a9d83826c23d40a56c3f88dc24276a8312ae50d15d3531211e4378a34980ea70ac3cefef2439af0baa6b387df4ff26b593ca52e94dda8ce3656a81180693ab97746e30b1301f30922ec565bba820fc06168927e446c06efe1fc7cb37b804ba0342e58e70da81c074407ec9cf690a9ab1e3a62a68"}) r0 = openat$vcsa(0xffffffffffffff9c, &(0x7f0000000280), 0x1, 0x0) r1 = openat$vcsa(0xffffffffffffff9c, &(0x7f00000002c0), 0x80, 0x0) ioctl$SNDRV_SEQ_IOCTL_QUERY_NEXT_PORT(r0, 0xc0a85352, &(0x7f0000000300)={{0x4, 0x6}, 'port0\x00', 0x5, 0x1, 0x0, 0xffff, 0x7, 0x7, 0x5, 0x0, 0x2, 0xc0}) ioctl$SNDRV_SEQ_IOCTL_QUERY_NEXT_CLIENT(r1, 0xc0bc5351, &(0x7f00000003c0)={0xffff7fff, 0x0, 'client0\x00', 0xffffffff80000002, "9aa89fbb0e155330", "7e3a03465d7350a6322e39e7997e8c634c3224eb46d1223d24ed4ce35c7b1dd2", 0x0, 0x6}) r2 = openat$nvram(0xffffffffffffff9c, &(0x7f0000000480), 0x1, 0x0) ioctl$PERF_EVENT_IOC_PAUSE_OUTPUT(r2, 0x40042409, 0x0) process_mrelease(r0, 0x0) ioctl$SNDRV_TIMER_IOCTL_TREAD(r1, 0x40045402, &(0x7f00000004c0)) r3 = socket$inet_udp(0x2, 0x2, 0x0) ioctl$sock_inet_udp_SIOCINQ(r3, 0x541b, &(0x7f0000000500)) r4 = openat$nvram(0xffffffffffffff9c, &(0x7f0000000700), 0x800, 0x0) write$P9_RGETLOCK(r4, &(0x7f00000007c0)={0x1e, 0x37, 0x2, {0x2, 0x6, 0x101}}, 0x1e) 17:45:12 executing program 2: prctl$PR_MPX_ENABLE_MANAGEMENT(0x2b) r0 = socket$inet(0x2, 0x5, 0x4) r1 = openat$vcsu(0xffffffffffffff9c, &(0x7f0000000000), 0x3c1480, 0x0) ioctl$sock_ipv4_tunnel_SIOCGETTUNNEL(r1, 0x89f0, &(0x7f00000000c0)={'syztnl2\x00', &(0x7f0000000040)={'erspan0\x00', 0x0, 0x700, 0x40, 0x3, 0x22, {{0x15, 0x4, 0x3, 0x17, 0x54, 0x64, 0x0, 0x1, 0x2f, 0x0, @broadcast, @dev={0xac, 0x14, 0x14, 0x36}, {[@cipso={0x86, 0x3d, 0x1, [{0x5, 0x9, "c8a7bec58c2c80"}, {0x0, 0x9, "fabb6c2e64ba82"}, {0x7, 0xf, "6b1b69e07efcb7230cc07a2cf7"}, {0x1, 0x6, "a2118bdb"}, {0x5, 0x10, "67115d3e7766231c7b08cf3c48e4"}]}]}}}}}) prctl$PR_MPX_ENABLE_MANAGEMENT(0x2b) r2 = openat$vcsa(0xffffffffffffff9c, &(0x7f0000000100), 0x202c0, 0x0) ioctl$SNDRV_SEQ_IOCTL_GET_QUEUE_TEMPO(r2, 0xc02c5341, &(0x7f0000000140)) ioctl$SNDRV_TIMER_IOCTL_SELECT(r1, 0x40345410, &(0x7f00000001c0)={{0x0, 0x2, 0x3f, 0x3, 0x80000001}}) ioctl$SNDRV_SEQ_IOCTL_GET_QUEUE_TEMPO(r1, 0xc02c5341, &(0x7f0000000200)) ioctl$sock_inet_tcp_SIOCOUTQ(r0, 0x5411, &(0x7f0000000280)) r3 = syz_open_dev$evdev(&(0x7f00000002c0), 0x1, 0x50000) ioctl$EVIOCGLED(r3, 0x80404519, &(0x7f0000000300)=""/21) seccomp$SECCOMP_GET_NOTIF_SIZES(0x3, 0x0, &(0x7f0000000340)) ioctl$SNDRV_TIMER_IOCTL_NEXT_DEVICE(r2, 0xc0145401, &(0x7f0000000380)={0x3, 0x2, 0x8, 0x2, 0x733}) munlock(&(0x7f0000ff9000/0x4000)=nil, 0x4000) getsockopt$inet_tcp_buf(r1, 0x6, 0x1a, &(0x7f00000003c0)=""/1, &(0x7f0000000400)=0x1) syz_open_procfs(0x0, &(0x7f0000000500)='schedstat\x00') 17:45:12 executing program 7: r0 = perf_event_open(&(0x7f0000000040)={0x4, 0x80, 0x6f, 0x8, 0x8, 0x1, 0x0, 0x6, 0x4, 0x1, 0x1, 0x0, 0x0, 0x1, 0x1, 0x1, 0x0, 0x0, 0x1, 0x0, 0x0, 0x1, 0x1, 0x0, 0x0, 0x2, 0x1, 0x0, 0x0, 0x1, 0x0, 0x0, 0x1, 0x0, 0x1, 0x0, 0x0, 0x0, 0x1, 0x1, 0x1, 0x0, 0x1, 0x1, 0x1, 0x0, 0x1, 0x0, 0x50, 0x2, @perf_bp={&(0x7f0000000000), 0xa}, 0x2100, 0x7, 0x1, 0x3, 0x6, 0x93d3, 0x0, 0x0, 0x3a, 0x0, 0x9}, 0xffffffffffffffff, 0xc, 0xffffffffffffffff, 0x8) mmap$perf(&(0x7f0000ffb000/0x2000)=nil, 0x2000, 0xb, 0x11, r0, 0x8) munmap(&(0x7f0000ffb000/0x3000)=nil, 0x3000) getsockopt$inet6_tcp_TCP_ZEROCOPY_RECEIVE(0xffffffffffffffff, 0x6, 0x23, &(0x7f0000001180)={&(0x7f0000ffd000/0x2000)=nil, 0x2000, 0x0, 0x0, 0x0, &(0x7f00000000c0)=""/162, 0xa2, 0x0, &(0x7f0000000180)=""/4096, 0x1000}, &(0x7f00000011c0)=0x40) r1 = openat$vcsa(0xffffffffffffff9c, &(0x7f0000001200), 0x14d080, 0x0) ioctl$SNDRV_SEQ_IOCTL_SUBSCRIBE_PORT(r1, 0x40505330, &(0x7f0000001240)={{0x3f, 0x40}, {0x9, 0x2}, 0x43, 0x0, 0x1}) r2 = mmap$binder(&(0x7f0000ffc000/0x1000)=nil, 0x1000, 0x1, 0x11, r1, 0x81) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000001380)={0x44, 0x0, &(0x7f00000012c0)=[@acquire={0x40046305, 0x3}, @increfs, @free_buffer={0x40086303, r2}, @exit_looper, @request_death={0x400c630e, 0x3}, @increfs={0x40046304, 0x2}, @free_buffer], 0x1d, 0x0, &(0x7f0000001340)="63170b84a45d435cf194bbb38c0432388cb6578156ee80dc59b93c914c"}) r3 = openat$vcsa(0xffffffffffffff9c, &(0x7f00000013c0), 0x400000, 0x0) ioctl$SNDRV_SEQ_IOCTL_GET_SUBSCRIPTION(r3, 0xc0505350, &(0x7f0000001400)={{0x1, 0x6}, {0x1f, 0x81}, 0x4, 0x3, 0x7}) shmget(0x0, 0x1000, 0x200, &(0x7f0000ffd000/0x1000)=nil) 17:45:21 executing program 3: getsockopt$inet_udp_int(0xffffffffffffffff, 0x11, 0x1, &(0x7f0000000000), &(0x7f0000000040)=0x4) setsockopt$inet_udp_int(0xffffffffffffffff, 0x11, 0x1, &(0x7f0000000080)=0x7, 0x4) ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, &(0x7f0000000240)={0x54, 0x0, &(0x7f00000000c0)=[@acquire_done={0x40106309, 0x1}, @free_buffer, @request_death={0x400c630e, 0x1}, @request_death, @decrefs, @dead_binder_done], 0xc7, 0x0, &(0x7f0000000140)="aa36e0fef6a6cd3a6060f434b2a2306a435d6c33ca3bfb20c9d046886ded10cf23d0938b55b8a812702a5a7579cb8813f0cf3954f24fa081e8c35a9d4674b51115d91e7f6e38920909a8fba27ba7bbb0522974a9d83826c23d40a56c3f88dc24276a8312ae50d15d3531211e4378a34980ea70ac3cefef2439af0baa6b387df4ff26b593ca52e94dda8ce3656a81180693ab97746e30b1301f30922ec565bba820fc06168927e446c06efe1fc7cb37b804ba0342e58e70da81c074407ec9cf690a9ab1e3a62a68"}) r0 = openat$vcsa(0xffffffffffffff9c, &(0x7f0000000280), 0x1, 0x0) r1 = openat$vcsa(0xffffffffffffff9c, &(0x7f00000002c0), 0x80, 0x0) ioctl$SNDRV_SEQ_IOCTL_QUERY_NEXT_PORT(r0, 0xc0a85352, &(0x7f0000000300)={{0x4, 0x6}, 'port0\x00', 0x5, 0x1, 0x0, 0xffff, 0x7, 0x7, 0x5, 0x0, 0x2, 0xc0}) ioctl$SNDRV_SEQ_IOCTL_QUERY_NEXT_CLIENT(r1, 0xc0bc5351, &(0x7f00000003c0)={0xffff7fff, 0x0, 'client0\x00', 0xffffffff80000002, "9aa89fbb0e155330", "7e3a03465d7350a6322e39e7997e8c634c3224eb46d1223d24ed4ce35c7b1dd2", 0x0, 0x6}) r2 = openat$nvram(0xffffffffffffff9c, &(0x7f0000000480), 0x1, 0x0) ioctl$PERF_EVENT_IOC_PAUSE_OUTPUT(r2, 0x40042409, 0x0) process_mrelease(r0, 0x0) ioctl$SNDRV_TIMER_IOCTL_TREAD(r1, 0x40045402, &(0x7f00000004c0)) socket$inet_udp(0x2, 0x2, 0x0) r3 = openat$nvram(0xffffffffffffff9c, &(0x7f0000000700), 0x800, 0x0) write$P9_RGETLOCK(r3, &(0x7f00000007c0)={0x1e, 0x37, 0x2, {0x2, 0x6, 0x101}}, 0x1e) 17:45:21 executing program 4: ioctl$SNDRV_TIMER_IOCTL_TREAD(0xffffffffffffffff, 0x40045402, &(0x7f0000000000)) shmget(0x1, 0x3000, 0x20, &(0x7f0000ffc000/0x3000)=nil) 17:45:21 executing program 1: shmget$private(0x0, 0x4000, 0x80, &(0x7f0000ffb000/0x4000)=nil) shmget(0x3, 0x2000, 0x4, &(0x7f0000ffc000/0x2000)=nil) mlock(&(0x7f0000ff0000/0x10000)=nil, 0x10000) shmget(0x1, 0x1000, 0x10, &(0x7f0000ff5000/0x1000)=nil) ioctl$sock_ipv4_tunnel_SIOCGETTUNNEL(0xffffffffffffffff, 0x89f0, &(0x7f0000000140)={'syztnl1\x00', &(0x7f00000000c0)={'syztnl2\x00', 0x0, 0x20, 0x1, 0x6, 0x9, {{0xd, 0x4, 0x1, 0x19, 0x34, 0x68, 0x0, 0x9, 0x29, 0x0, @empty, @dev={0xac, 0x14, 0x14, 0x29}, {[@timestamp_addr={0x44, 0x14, 0xc2, 0x1, 0x4, [{@multicast1}, {@private=0xa010101}]}, @rr={0x7, 0xb, 0xc8, [@initdev={0xac, 0x1e, 0x1, 0x0}, @private=0xa010102]}]}}}}}) ioctl$sock_ipv4_tunnel_SIOCADDTUNNEL(0xffffffffffffffff, 0x89f1, &(0x7f0000000280)={'tunl0\x00', &(0x7f0000000180)={'tunl0\x00', r0, 0x7, 0x8000, 0xfffffffc, 0x8, {{0x2f, 0x4, 0x0, 0x2, 0xbc, 0x65, 0x0, 0x0, 0x4, 0x0, @empty, @broadcast, {[@generic={0x89, 0x9, "8db1d464c6af68"}, @noop, @ra={0x94, 0x4, 0x1}, @timestamp={0x44, 0x1c, 0x53, 0x0, 0x7, [0x40, 0x7fffffff, 0xfffffffd, 0x5, 0x5c, 0x77]}, @cipso={0x86, 0x2f, 0x3, [{0x1, 0x4, "1eba"}, {0x1, 0x7, "e3ccb5ddcf"}, {0x6, 0xa, "5db18b961780af33"}, {0x2, 0xe, "7353a9824b57fd7d39232ac5"}, {0x1, 0x6, "2e1ccd27"}]}, @noop, @cipso={0x86, 0x37, 0xffffffffffffffff, [{0x2, 0xf, "227467028cabd4e137b820c5c9"}, {0x7, 0x6, "90569992"}, {0x2, 0xc, "2071b0a8c9ce92782e72"}, {0x6, 0xa, "14f2b9bca55ce3dd"}, {0x6, 0x6, "2cd22a8f"}]}, @timestamp={0x44, 0x14, 0xd4, 0x0, 0x5, [0x81, 0x5d23, 0x63ab, 0x1]}]}}}}}) ioctl$sock_ipv4_tunnel_SIOCDELTUNNEL(0xffffffffffffffff, 0x89f2, &(0x7f0000000380)={'gretap0\x00', &(0x7f00000002c0)={'syztnl2\x00', 0x0, 0x7800, 0x7, 0x40, 0xe180, {{0x22, 0x4, 0x0, 0x1, 0x88, 0x64, 0x0, 0x1, 0x29, 0x0, @multicast2, @multicast1, {[@end, @lsrr={0x83, 0x1f, 0x2f, [@multicast2, @local, @local, @multicast1, @rand_addr=0x64010102, @loopback, @private=0xa010100]}, @rr={0x7, 0x27, 0x6c, [@multicast1, @rand_addr=0x64010102, @remote, @multicast1, @loopback, @initdev={0xac, 0x1e, 0x0, 0x0}, @initdev={0xac, 0x1e, 0x1, 0x0}, @broadcast, @empty]}, @ra={0x94, 0x4, 0x1}, @timestamp={0x44, 0x10, 0x2d, 0x0, 0x8, [0x1, 0x100, 0x401]}, @ssrr={0x89, 0x13, 0x56, [@dev={0xac, 0x14, 0x14, 0x28}, @multicast2, @initdev={0xac, 0x1e, 0x0, 0x0}, @remote]}, @ra={0x94, 0x4, 0x1}]}}}}}) shmget(0x3, 0x4000, 0x4, &(0x7f0000ff9000/0x4000)=nil) mmap$IORING_OFF_CQ_RING(&(0x7f0000ffd000/0x3000)=nil, 0x3000, 0x2000008, 0x30, 0xffffffffffffffff, 0x8000000) r1 = syz_genetlink_get_family_id$nl802154(&(0x7f0000000400), 0xffffffffffffffff) ioctl$sock_SIOCGIFINDEX_802154(0xffffffffffffffff, 0x8933, &(0x7f0000000440)={'wpan1\x00', 0x0}) sendmsg$NL802154_CMD_NEW_INTERFACE(0xffffffffffffffff, &(0x7f0000000540)={&(0x7f00000003c0)={0x10, 0x0, 0x0, 0x2}, 0xc, &(0x7f0000000500)={&(0x7f0000000480)={0x48, r1, 0x200, 0x70bd2a, 0x25dfdbfd, {}, [@NL802154_ATTR_IFNAME={0xa, 0x4, 'wpan0\x00'}, @NL802154_ATTR_IFINDEX={0x8}, @NL802154_ATTR_IFNAME={0xa, 0x4, 'wpan1\x00'}, @NL802154_ATTR_EXTENDED_ADDR={0xc, 0x17, {0xaaaaaaaaaaaa0002}}, @NL802154_ATTR_IFINDEX={0x8, 0x3, r2}]}, 0x48}}, 0x4001) mmap$binder(&(0x7f0000fef000/0x11000)=nil, 0x11000, 0x1, 0x11, 0xffffffffffffffff, 0x6) shmget$private(0x0, 0x4000, 0x200, &(0x7f0000ffc000/0x4000)=nil) r3 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) ioctl$sock_SIOCGIFINDEX_802154(0xffffffffffffffff, 0x8933, &(0x7f00000005c0)={'wpan0\x00'}) sendmsg$IEEE802154_START_REQ(r3, &(0x7f00000007c0)={&(0x7f0000000700)={0x10, 0x0, 0x0, 0x4}, 0xc, &(0x7f0000000780)={&(0x7f0000000740)={0x1c, 0x0, 0x200, 0x70bd2d, 0x25dfdbfb, {}, [@IEEE802154_ATTR_CHANNEL={0x5, 0x7, 0x6}]}, 0x1c}, 0x1, 0x0, 0x0, 0x40100}, 0x801) mlock(&(0x7f0000fef000/0x1000)=nil, 0x1000) syz_io_uring_setup(0x4726, &(0x7f0000000840)={0x0, 0x502f, 0x20, 0x0, 0x12e}, &(0x7f0000ffe000/0x2000)=nil, &(0x7f0000ffb000/0x4000)=nil, &(0x7f00000008c0), &(0x7f0000000900)) 17:45:21 executing program 7: r0 = perf_event_open(&(0x7f0000000040)={0x4, 0x80, 0x6f, 0x8, 0x8, 0x1, 0x0, 0x6, 0x4, 0x1, 0x1, 0x0, 0x0, 0x1, 0x1, 0x1, 0x0, 0x0, 0x1, 0x0, 0x0, 0x1, 0x1, 0x0, 0x0, 0x2, 0x1, 0x0, 0x0, 0x1, 0x0, 0x0, 0x1, 0x0, 0x1, 0x0, 0x0, 0x0, 0x1, 0x1, 0x1, 0x0, 0x1, 0x1, 0x1, 0x0, 0x1, 0x0, 0x50, 0x2, @perf_bp={&(0x7f0000000000), 0xa}, 0x2100, 0x7, 0x1, 0x3, 0x6, 0x93d3, 0x0, 0x0, 0x3a, 0x0, 0x9}, 0xffffffffffffffff, 0xc, 0xffffffffffffffff, 0x8) mmap$perf(&(0x7f0000ffb000/0x2000)=nil, 0x2000, 0xb, 0x11, r0, 0x8) munmap(&(0x7f0000ffb000/0x3000)=nil, 0x3000) getsockopt$inet6_tcp_TCP_ZEROCOPY_RECEIVE(0xffffffffffffffff, 0x6, 0x23, &(0x7f0000001180)={&(0x7f0000ffd000/0x2000)=nil, 0x2000, 0x0, 0x0, 0x0, &(0x7f00000000c0)=""/162, 0xa2, 0x0, &(0x7f0000000180)=""/4096, 0x1000}, &(0x7f00000011c0)=0x40) r1 = openat$vcsa(0xffffffffffffff9c, &(0x7f0000001200), 0x14d080, 0x0) ioctl$SNDRV_SEQ_IOCTL_SUBSCRIBE_PORT(r1, 0x40505330, &(0x7f0000001240)={{0x3f, 0x40}, {0x9, 0x2}, 0x43, 0x0, 0x1}) r2 = mmap$binder(&(0x7f0000ffc000/0x1000)=nil, 0x1000, 0x1, 0x11, r1, 0x81) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000001380)={0x44, 0x0, &(0x7f00000012c0)=[@acquire={0x40046305, 0x3}, @increfs, @free_buffer={0x40086303, r2}, @exit_looper, @request_death={0x400c630e, 0x3}, @increfs={0x40046304, 0x2}, @free_buffer], 0x1d, 0x0, &(0x7f0000001340)="63170b84a45d435cf194bbb38c0432388cb6578156ee80dc59b93c914c"}) openat$vcsa(0xffffffffffffff9c, &(0x7f00000013c0), 0x400000, 0x0) shmget(0x0, 0x1000, 0x200, &(0x7f0000ffd000/0x1000)=nil) 17:45:21 executing program 0: get_thread_area(&(0x7f0000000000)={0x7, 0x20000800, 0x4000, 0x0, 0x1, 0x0, 0x0, 0x1, 0x1, 0x1}) r0 = openat$vcsu(0xffffffffffffff9c, &(0x7f0000000040), 0x200000, 0x0) getsockopt$inet_tcp_TCP_REPAIR_WINDOW(r0, 0x6, 0x1d, &(0x7f0000000080), &(0x7f00000000c0)=0x14) r1 = openat$nvram(0xffffffffffffff9c, &(0x7f0000000100), 0x2000, 0x0) setsockopt$inet_tcp_TCP_FASTOPEN_KEY(r1, 0x6, 0x21, &(0x7f0000000140)="1bb9d563048b6ec78effc0f14d974b17", 0x10) setsockopt$inet_tcp_int(r1, 0x6, 0x1b, &(0x7f0000000180)=0x5, 0x4) ioctl$SNDRV_TIMER_IOCTL_STATUS32(r1, 0x80585414, &(0x7f00000001c0)) setsockopt$inet_tcp_TCP_QUEUE_SEQ(r0, 0x6, 0x15, &(0x7f0000000240)=0x1, 0x4) getsockopt$inet_tcp_TCP_ZEROCOPY_RECEIVE(r1, 0x6, 0x23, &(0x7f0000000340)={&(0x7f0000ffc000/0x2000)=nil, 0x2000, 0x0, 0x0, 0x0, &(0x7f0000000280)=""/37, 0x25, 0x1, &(0x7f00000002c0)=""/109, 0x6d}, &(0x7f0000000380)=0x40) r2 = socket$inet_tcp(0x2, 0x1, 0x0) ioctl$sock_inet_tcp_SIOCINQ(r2, 0x541b, &(0x7f00000003c0)) move_pages(0x0, 0x8, &(0x7f0000000400)=[&(0x7f0000ffd000/0x1000)=nil, &(0x7f0000ffd000/0x3000)=nil, &(0x7f0000ffd000/0x3000)=nil, &(0x7f0000ffb000/0x2000)=nil, &(0x7f0000ffc000/0x1000)=nil, &(0x7f0000ffe000/0x2000)=nil, &(0x7f0000ffb000/0x4000)=nil, &(0x7f0000ffd000/0x3000)=nil], &(0x7f0000000440)=[0xfff], &(0x7f0000000480)=[0x0, 0x0, 0x0], 0x4) r3 = syz_genetlink_get_family_id$SEG6(&(0x7f0000000500), r1) sendmsg$SEG6_CMD_GET_TUNSRC(r0, &(0x7f00000005c0)={&(0x7f00000004c0)={0x10, 0x0, 0x0, 0x4000000}, 0xc, &(0x7f0000000580)={&(0x7f0000000540)={0x38, r3, 0x300, 0x70bd2a, 0x25dfdbfc, {}, [@SEG6_ATTR_HMACKEYID={0x8, 0x3, 0x24}, @SEG6_ATTR_DST={0x14, 0x1, @mcast1}, @SEG6_ATTR_DSTLEN={0x8, 0x2, 0x2}]}, 0x38}, 0x1, 0x0, 0x0, 0x20008810}, 0x4040010) sendmsg$SEG6_CMD_DUMPHMAC(0xffffffffffffffff, &(0x7f0000000740)={&(0x7f0000000680)={0x10, 0x0, 0x0, 0x240000}, 0xc, &(0x7f0000000700)={&(0x7f00000006c0)={0x2c, r3, 0x1, 0x70bd2c, 0x25dfdbfe, {}, [@SEG6_ATTR_SECRET={0x8, 0x4, [0x1]}, @SEG6_ATTR_DSTLEN={0x8, 0x2, 0x5}, @SEG6_ATTR_DSTLEN={0x8}]}, 0x2c}, 0x1, 0x0, 0x0, 0x4000000}, 0x4000000) pidfd_getfd(r1, r2, 0x0) syz_genetlink_get_family_id$ieee802154(&(0x7f0000000800), 0xffffffffffffffff) 17:45:21 executing program 5: clock_gettime(0x5, &(0x7f0000000000)) clock_settime(0x2, &(0x7f0000000040)) sched_rr_get_interval(0xffffffffffffffff, &(0x7f0000000080)) sched_rr_get_interval(0x0, &(0x7f00000000c0)) sendmsg$NL802154_CMD_GET_SEC_KEY(0xffffffffffffffff, &(0x7f00000001c0)={&(0x7f0000000100)={0x10, 0x0, 0x0, 0x20000000}, 0xc, &(0x7f0000000180)={&(0x7f0000000140)={0x24, 0x0, 0x200, 0x70bd26, 0x25dfdbfe, {}, [@NL802154_ATTR_IFINDEX={0x8}, @NL802154_ATTR_IFINDEX={0x8}]}, 0x24}, 0x1, 0x0, 0x0, 0x4000000}, 0x181) clock_gettime(0x0, &(0x7f0000000200)) pipe2$9p(&(0x7f0000000240)={0xffffffffffffffff, 0xffffffffffffffff}, 0x800) r1 = syz_io_uring_setup(0x776a, &(0x7f0000000280)={0x0, 0x2728, 0x2, 0x1, 0x37c}, &(0x7f0000000000/0x3000)=nil, &(0x7f0000000000/0x400000)=nil, &(0x7f0000000300), &(0x7f0000000340)) ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, &(0x7f0000000540)={0x64, 0x0, &(0x7f0000000440)=[@transaction_sg={0x40486311, {0x1, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x50, 0x18, &(0x7f0000000380)={@fd={0x66642a85, 0x0, r0}, @fd={0x66642a85, 0x0, r1}, @fda={0x66646185, 0x0, 0x2, 0x36}}, &(0x7f0000000400)={0x0, 0x18, 0x30}}}, @request_death, @release={0x40046306, 0x1}], 0x7e, 0x0, &(0x7f00000004c0)="7685c519d1cbea63a1a8f022f8c0085baf770aa5d1fa9bfb1a5399fdb134953d619e962218bba650b68d6206fde39ff17760aa4bbcb62f6802c48e17294a17a3b768ab60bbae37aa37e33e24b09f6bdea37853f7ab2622451803788c9d172b7d71d6d87911129b8ef5cc9e0169404b09abfa991f3a7a3640686df445d387"}) pipe2$9p(&(0x7f0000000580), 0x800) ioctl$EVIOCGVERSION(0xffffffffffffffff, 0x80044501, &(0x7f00000005c0)=""/174) r2 = openat$nvram(0xffffffffffffff9c, &(0x7f0000000680), 0x400, 0x0) write$P9_RSTAT(r2, &(0x7f00000006c0)={0x3f, 0x7d, 0x1, {0x0, 0x38, 0x401, 0x8000, {0x80, 0x4, 0x1}, 0x2020000, 0x4, 0x60, 0x9, 0x1, '\x00', 0x2, '.-', 0x1, '\x00', 0x1, '\x00'}}, 0x3f) syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r3 = syz_genetlink_get_family_id$ieee802154(&(0x7f0000000740), 0xffffffffffffffff) clock_getres(0x3, &(0x7f0000000880)) r4 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) sendmsg$IEEE802154_ADD_IFACE(r4, &(0x7f0000000a00)={&(0x7f0000000900)={0x10, 0x0, 0x0, 0x40c}, 0xc, &(0x7f00000009c0)={&(0x7f0000000940)={0x44, r3, 0x200, 0x70bd29, 0x25dfdbfe, {}, [@IEEE802154_ATTR_PHY_NAME={0x9, 0x1f, 'phy1\x00'}, @IEEE802154_ATTR_DEV_NAME={0xa, 0x1, 'wpan4\x00'}, @IEEE802154_ATTR_DEV_NAME={0xa, 0x1, 'wpan1\x00'}, @IEEE802154_ATTR_DEV_NAME={0xa, 0x1, 'wpan0\x00'}]}, 0x44}, 0x1, 0x0, 0x0, 0x20000084}, 0x44000) 17:45:21 executing program 6: r0 = perf_event_open(&(0x7f00000000c0)={0x1, 0x80, 0x0, 0xc0, 0xfa, 0x1, 0x0, 0x7fffffff, 0x10811, 0x1, 0x1, 0x1, 0x1, 0x1, 0x1, 0x1, 0x1, 0x1, 0x0, 0x1, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x1, 0x0, 0x1, 0x0, 0x0, 0x0, 0x1, 0x1, 0x1, 0x1, 0x1, 0x1, 0x1, 0x0, 0x1, 0x1, 0x1, 0x1, 0x0, 0x0, 0xfff, 0x7, @perf_config_ext={0x7, 0x7fffffff}, 0x41000, 0x80000000, 0x5, 0x3, 0x9, 0x2, 0x9, 0x0, 0x5, 0x0, 0x4}, 0x0, 0xb, 0xffffffffffffffff, 0x1) perf_event_open(&(0x7f0000000040)={0x0, 0x80, 0x0, 0x40, 0x80, 0x9, 0x0, 0x3, 0x10040, 0x1, 0x0, 0x0, 0x1, 0x1, 0x1, 0x1, 0x1, 0x1, 0x1, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x3, 0x1, 0x0, 0x1, 0x0, 0x1, 0x1, 0x0, 0x0, 0x1, 0x1, 0x1, 0x0, 0x1, 0x0, 0x0, 0x0, 0x1, 0x0, 0x1, 0x0, 0x1, 0x0, 0x0, 0x1, @perf_bp={&(0x7f0000000000), 0x10}, 0x8080, 0x800, 0x2, 0x3, 0x36dc, 0x31df3b33, 0xff, 0x0, 0x9, 0x0, 0x5}, 0xffffffffffffffff, 0x9, r0, 0x9) ioctl$PERF_EVENT_IOC_PAUSE_OUTPUT(r0, 0x40042409, 0x0) ioctl$PERF_EVENT_IOC_PERIOD(0xffffffffffffffff, 0x40082404, &(0x7f0000000140)=0x8) r1 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl$sock_ipv4_tunnel_SIOCADDTUNNEL(r1, 0x89f1, &(0x7f00000001c0)={'syztnl1\x00', &(0x7f0000000180)={'syztnl0\x00', 0x0, 0x1, 0x40, 0x0, 0x5, {{0x5, 0x4, 0x2, 0x19, 0x14, 0x65, 0x0, 0x1f, 0x4, 0x0, @multicast2, @remote}}}}) ioctl$PERF_EVENT_IOC_PERIOD(r0, 0x40082404, &(0x7f0000000200)=0x9) ioctl$SNDRV_SEQ_IOCTL_GET_PORT_INFO(0xffffffffffffffff, 0xc0a85322, &(0x7f0000000240)) ioctl$SNDRV_SEQ_IOCTL_SYSTEM_INFO(0xffffffffffffffff, 0xc0305302, &(0x7f0000000300)={0x9, 0x101, 0x1, 0x6, 0x3, 0x5}) r2 = syz_open_procfs(0x0, &(0x7f0000000340)='children\x00') openat$cgroup_type(r2, &(0x7f0000000380), 0x2, 0x0) ioctl$EVIOCGABS20(r2, 0x80184560, &(0x7f00000003c0)=""/4096) socket$inet6_tcp(0xa, 0x1, 0x0) write$cgroup_type(0xffffffffffffffff, &(0x7f0000001500), 0x9) 17:45:21 executing program 2: prctl$PR_MPX_ENABLE_MANAGEMENT(0x2b) r0 = socket$inet(0x2, 0x5, 0x4) r1 = openat$vcsu(0xffffffffffffff9c, &(0x7f0000000000), 0x3c1480, 0x0) ioctl$sock_ipv4_tunnel_SIOCGETTUNNEL(r1, 0x89f0, &(0x7f00000000c0)={'syztnl2\x00', &(0x7f0000000040)={'erspan0\x00', 0x0, 0x700, 0x40, 0x3, 0x22, {{0x15, 0x4, 0x3, 0x17, 0x54, 0x64, 0x0, 0x1, 0x2f, 0x0, @broadcast, @dev={0xac, 0x14, 0x14, 0x36}, {[@cipso={0x86, 0x3d, 0x1, [{0x5, 0x9, "c8a7bec58c2c80"}, {0x0, 0x9, "fabb6c2e64ba82"}, {0x7, 0xf, "6b1b69e07efcb7230cc07a2cf7"}, {0x1, 0x6, "a2118bdb"}, {0x5, 0x10, "67115d3e7766231c7b08cf3c48e4"}]}]}}}}}) prctl$PR_MPX_ENABLE_MANAGEMENT(0x2b) r2 = openat$vcsa(0xffffffffffffff9c, &(0x7f0000000100), 0x202c0, 0x0) ioctl$SNDRV_SEQ_IOCTL_GET_QUEUE_TEMPO(r2, 0xc02c5341, &(0x7f0000000140)) ioctl$SNDRV_TIMER_IOCTL_SELECT(r1, 0x40345410, &(0x7f00000001c0)={{0x0, 0x2, 0x3f, 0x3, 0x80000001}}) ioctl$SNDRV_SEQ_IOCTL_GET_QUEUE_TEMPO(r1, 0xc02c5341, &(0x7f0000000200)) ioctl$sock_inet_tcp_SIOCOUTQ(r0, 0x5411, &(0x7f0000000280)) r3 = syz_open_dev$evdev(&(0x7f00000002c0), 0x1, 0x50000) ioctl$EVIOCGLED(r3, 0x80404519, &(0x7f0000000300)=""/21) seccomp$SECCOMP_GET_NOTIF_SIZES(0x3, 0x0, &(0x7f0000000340)) ioctl$SNDRV_TIMER_IOCTL_NEXT_DEVICE(r2, 0xc0145401, &(0x7f0000000380)={0x3, 0x2, 0x8, 0x2, 0x733}) munlock(&(0x7f0000ff9000/0x4000)=nil, 0x4000) getsockopt$inet_tcp_buf(r1, 0x6, 0x1a, &(0x7f00000003c0)=""/1, &(0x7f0000000400)=0x1) syz_open_procfs(0x0, &(0x7f0000000500)='schedstat\x00') 17:45:21 executing program 3: getsockopt$inet_udp_int(0xffffffffffffffff, 0x11, 0x1, &(0x7f0000000000), &(0x7f0000000040)=0x4) setsockopt$inet_udp_int(0xffffffffffffffff, 0x11, 0x1, &(0x7f0000000080)=0x7, 0x4) ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, &(0x7f0000000240)={0x54, 0x0, &(0x7f00000000c0)=[@acquire_done={0x40106309, 0x1}, @free_buffer, @request_death={0x400c630e, 0x1}, @request_death, @decrefs, @dead_binder_done], 0xc7, 0x0, &(0x7f0000000140)="aa36e0fef6a6cd3a6060f434b2a2306a435d6c33ca3bfb20c9d046886ded10cf23d0938b55b8a812702a5a7579cb8813f0cf3954f24fa081e8c35a9d4674b51115d91e7f6e38920909a8fba27ba7bbb0522974a9d83826c23d40a56c3f88dc24276a8312ae50d15d3531211e4378a34980ea70ac3cefef2439af0baa6b387df4ff26b593ca52e94dda8ce3656a81180693ab97746e30b1301f30922ec565bba820fc06168927e446c06efe1fc7cb37b804ba0342e58e70da81c074407ec9cf690a9ab1e3a62a68"}) r0 = openat$vcsa(0xffffffffffffff9c, &(0x7f0000000280), 0x1, 0x0) r1 = openat$vcsa(0xffffffffffffff9c, &(0x7f00000002c0), 0x80, 0x0) ioctl$SNDRV_SEQ_IOCTL_QUERY_NEXT_PORT(r0, 0xc0a85352, &(0x7f0000000300)={{0x4, 0x6}, 'port0\x00', 0x5, 0x1, 0x0, 0xffff, 0x7, 0x7, 0x5, 0x0, 0x2, 0xc0}) ioctl$SNDRV_SEQ_IOCTL_QUERY_NEXT_CLIENT(r1, 0xc0bc5351, &(0x7f00000003c0)={0xffff7fff, 0x0, 'client0\x00', 0xffffffff80000002, "9aa89fbb0e155330", "7e3a03465d7350a6322e39e7997e8c634c3224eb46d1223d24ed4ce35c7b1dd2", 0x0, 0x6}) r2 = openat$nvram(0xffffffffffffff9c, &(0x7f0000000480), 0x1, 0x0) ioctl$PERF_EVENT_IOC_PAUSE_OUTPUT(r2, 0x40042409, 0x0) process_mrelease(r0, 0x0) ioctl$SNDRV_TIMER_IOCTL_TREAD(r1, 0x40045402, &(0x7f00000004c0)) r3 = openat$nvram(0xffffffffffffff9c, &(0x7f0000000700), 0x800, 0x0) write$P9_RGETLOCK(r3, &(0x7f00000007c0)={0x1e, 0x37, 0x2, {0x2, 0x6, 0x101}}, 0x1e) 17:45:21 executing program 1: shmget$private(0x0, 0x4000, 0x80, &(0x7f0000ffb000/0x4000)=nil) shmget(0x3, 0x2000, 0x4, &(0x7f0000ffc000/0x2000)=nil) mlock(&(0x7f0000ff0000/0x10000)=nil, 0x10000) shmget(0x1, 0x1000, 0x10, &(0x7f0000ff5000/0x1000)=nil) ioctl$sock_ipv4_tunnel_SIOCGETTUNNEL(0xffffffffffffffff, 0x89f0, &(0x7f0000000140)={'syztnl1\x00', &(0x7f00000000c0)={'syztnl2\x00', 0x0, 0x20, 0x1, 0x6, 0x9, {{0xd, 0x4, 0x1, 0x19, 0x34, 0x68, 0x0, 0x9, 0x29, 0x0, @empty, @dev={0xac, 0x14, 0x14, 0x29}, {[@timestamp_addr={0x44, 0x14, 0xc2, 0x1, 0x4, [{@multicast1}, {@private=0xa010101}]}, @rr={0x7, 0xb, 0xc8, [@initdev={0xac, 0x1e, 0x1, 0x0}, @private=0xa010102]}]}}}}}) ioctl$sock_ipv4_tunnel_SIOCADDTUNNEL(0xffffffffffffffff, 0x89f1, &(0x7f0000000280)={'tunl0\x00', &(0x7f0000000180)={'tunl0\x00', r0, 0x7, 0x8000, 0xfffffffc, 0x8, {{0x2f, 0x4, 0x0, 0x2, 0xbc, 0x65, 0x0, 0x0, 0x4, 0x0, @empty, @broadcast, {[@generic={0x89, 0x9, "8db1d464c6af68"}, @noop, @ra={0x94, 0x4, 0x1}, @timestamp={0x44, 0x1c, 0x53, 0x0, 0x7, [0x40, 0x7fffffff, 0xfffffffd, 0x5, 0x5c, 0x77]}, @cipso={0x86, 0x2f, 0x3, [{0x1, 0x4, "1eba"}, {0x1, 0x7, "e3ccb5ddcf"}, {0x6, 0xa, "5db18b961780af33"}, {0x2, 0xe, "7353a9824b57fd7d39232ac5"}, {0x1, 0x6, "2e1ccd27"}]}, @noop, @cipso={0x86, 0x37, 0xffffffffffffffff, [{0x2, 0xf, "227467028cabd4e137b820c5c9"}, {0x7, 0x6, "90569992"}, {0x2, 0xc, "2071b0a8c9ce92782e72"}, {0x6, 0xa, "14f2b9bca55ce3dd"}, {0x6, 0x6, "2cd22a8f"}]}, @timestamp={0x44, 0x14, 0xd4, 0x0, 0x5, [0x81, 0x5d23, 0x63ab, 0x1]}]}}}}}) ioctl$sock_ipv4_tunnel_SIOCDELTUNNEL(0xffffffffffffffff, 0x89f2, &(0x7f0000000380)={'gretap0\x00', &(0x7f00000002c0)={'syztnl2\x00', 0x0, 0x7800, 0x7, 0x40, 0xe180, {{0x22, 0x4, 0x0, 0x1, 0x88, 0x64, 0x0, 0x1, 0x29, 0x0, @multicast2, @multicast1, {[@end, @lsrr={0x83, 0x1f, 0x2f, [@multicast2, @local, @local, @multicast1, @rand_addr=0x64010102, @loopback, @private=0xa010100]}, @rr={0x7, 0x27, 0x6c, [@multicast1, @rand_addr=0x64010102, @remote, @multicast1, @loopback, @initdev={0xac, 0x1e, 0x0, 0x0}, @initdev={0xac, 0x1e, 0x1, 0x0}, @broadcast, @empty]}, @ra={0x94, 0x4, 0x1}, @timestamp={0x44, 0x10, 0x2d, 0x0, 0x8, [0x1, 0x100, 0x401]}, @ssrr={0x89, 0x13, 0x56, [@dev={0xac, 0x14, 0x14, 0x28}, @multicast2, @initdev={0xac, 0x1e, 0x0, 0x0}, @remote]}, @ra={0x94, 0x4, 0x1}]}}}}}) shmget(0x3, 0x4000, 0x4, &(0x7f0000ff9000/0x4000)=nil) mmap$IORING_OFF_CQ_RING(&(0x7f0000ffd000/0x3000)=nil, 0x3000, 0x2000008, 0x30, 0xffffffffffffffff, 0x8000000) r1 = syz_genetlink_get_family_id$nl802154(&(0x7f0000000400), 0xffffffffffffffff) ioctl$sock_SIOCGIFINDEX_802154(0xffffffffffffffff, 0x8933, &(0x7f0000000440)={'wpan1\x00', 0x0}) sendmsg$NL802154_CMD_NEW_INTERFACE(0xffffffffffffffff, &(0x7f0000000540)={&(0x7f00000003c0)={0x10, 0x0, 0x0, 0x2}, 0xc, &(0x7f0000000500)={&(0x7f0000000480)={0x48, r1, 0x200, 0x70bd2a, 0x25dfdbfd, {}, [@NL802154_ATTR_IFNAME={0xa, 0x4, 'wpan0\x00'}, @NL802154_ATTR_IFINDEX={0x8}, @NL802154_ATTR_IFNAME={0xa, 0x4, 'wpan1\x00'}, @NL802154_ATTR_EXTENDED_ADDR={0xc, 0x17, {0xaaaaaaaaaaaa0002}}, @NL802154_ATTR_IFINDEX={0x8, 0x3, r2}]}, 0x48}}, 0x4001) mmap$binder(&(0x7f0000fef000/0x11000)=nil, 0x11000, 0x1, 0x11, 0xffffffffffffffff, 0x6) shmget$private(0x0, 0x4000, 0x200, &(0x7f0000ffc000/0x4000)=nil) r3 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) ioctl$sock_SIOCGIFINDEX_802154(0xffffffffffffffff, 0x8933, &(0x7f00000005c0)={'wpan0\x00'}) sendmsg$IEEE802154_START_REQ(r3, &(0x7f00000007c0)={&(0x7f0000000700)={0x10, 0x0, 0x0, 0x4}, 0xc, &(0x7f0000000780)={&(0x7f0000000740)={0x1c, 0x0, 0x200, 0x70bd2d, 0x25dfdbfb, {}, [@IEEE802154_ATTR_CHANNEL={0x5, 0x7, 0x6}]}, 0x1c}, 0x1, 0x0, 0x0, 0x40100}, 0x801) mlock(&(0x7f0000fef000/0x1000)=nil, 0x1000) syz_io_uring_setup(0x4726, &(0x7f0000000840)={0x0, 0x502f, 0x20, 0x0, 0x12e}, &(0x7f0000ffe000/0x2000)=nil, &(0x7f0000ffb000/0x4000)=nil, &(0x7f00000008c0), &(0x7f0000000900)) 17:45:21 executing program 0: get_thread_area(&(0x7f0000000000)={0x7, 0x20000800, 0x4000, 0x0, 0x1, 0x0, 0x0, 0x1, 0x1, 0x1}) r0 = openat$vcsu(0xffffffffffffff9c, &(0x7f0000000040), 0x200000, 0x0) getsockopt$inet_tcp_TCP_REPAIR_WINDOW(r0, 0x6, 0x1d, &(0x7f0000000080), &(0x7f00000000c0)=0x14) r1 = openat$nvram(0xffffffffffffff9c, &(0x7f0000000100), 0x2000, 0x0) setsockopt$inet_tcp_TCP_FASTOPEN_KEY(r1, 0x6, 0x21, &(0x7f0000000140)="1bb9d563048b6ec78effc0f14d974b17", 0x10) setsockopt$inet_tcp_int(r1, 0x6, 0x1b, &(0x7f0000000180)=0x5, 0x4) ioctl$SNDRV_TIMER_IOCTL_STATUS32(r1, 0x80585414, &(0x7f00000001c0)) setsockopt$inet_tcp_TCP_QUEUE_SEQ(r0, 0x6, 0x15, &(0x7f0000000240)=0x1, 0x4) getsockopt$inet_tcp_TCP_ZEROCOPY_RECEIVE(r1, 0x6, 0x23, &(0x7f0000000340)={&(0x7f0000ffc000/0x2000)=nil, 0x2000, 0x0, 0x0, 0x0, &(0x7f0000000280)=""/37, 0x25, 0x1, &(0x7f00000002c0)=""/109, 0x6d}, &(0x7f0000000380)=0x40) r2 = socket$inet_tcp(0x2, 0x1, 0x0) ioctl$sock_inet_tcp_SIOCINQ(r2, 0x541b, &(0x7f00000003c0)) move_pages(0x0, 0x8, &(0x7f0000000400)=[&(0x7f0000ffd000/0x1000)=nil, &(0x7f0000ffd000/0x3000)=nil, &(0x7f0000ffd000/0x3000)=nil, &(0x7f0000ffb000/0x2000)=nil, &(0x7f0000ffc000/0x1000)=nil, &(0x7f0000ffe000/0x2000)=nil, &(0x7f0000ffb000/0x4000)=nil, &(0x7f0000ffd000/0x3000)=nil], &(0x7f0000000440)=[0xfff], &(0x7f0000000480)=[0x0, 0x0, 0x0], 0x4) r3 = syz_genetlink_get_family_id$SEG6(&(0x7f0000000500), r1) sendmsg$SEG6_CMD_GET_TUNSRC(r0, &(0x7f00000005c0)={&(0x7f00000004c0)={0x10, 0x0, 0x0, 0x4000000}, 0xc, &(0x7f0000000580)={&(0x7f0000000540)={0x38, r3, 0x300, 0x70bd2a, 0x25dfdbfc, {}, [@SEG6_ATTR_HMACKEYID={0x8, 0x3, 0x24}, @SEG6_ATTR_DST={0x14, 0x1, @mcast1}, @SEG6_ATTR_DSTLEN={0x8, 0x2, 0x2}]}, 0x38}, 0x1, 0x0, 0x0, 0x20008810}, 0x4040010) sendmsg$SEG6_CMD_DUMPHMAC(0xffffffffffffffff, &(0x7f0000000740)={&(0x7f0000000680)={0x10, 0x0, 0x0, 0x240000}, 0xc, &(0x7f0000000700)={&(0x7f00000006c0)={0x2c, r3, 0x1, 0x70bd2c, 0x25dfdbfe, {}, [@SEG6_ATTR_SECRET={0x8, 0x4, [0x1]}, @SEG6_ATTR_DSTLEN={0x8, 0x2, 0x5}, @SEG6_ATTR_DSTLEN={0x8}]}, 0x2c}, 0x1, 0x0, 0x0, 0x4000000}, 0x4000000) pidfd_getfd(r1, r2, 0x0) syz_genetlink_get_family_id$ieee802154(&(0x7f0000000800), 0xffffffffffffffff) 17:45:21 executing program 4: shmget(0x1, 0x3000, 0x20, &(0x7f0000ffc000/0x3000)=nil) 17:45:21 executing program 7: r0 = perf_event_open(&(0x7f0000000040)={0x4, 0x80, 0x6f, 0x8, 0x8, 0x1, 0x0, 0x6, 0x4, 0x1, 0x1, 0x0, 0x0, 0x1, 0x1, 0x1, 0x0, 0x0, 0x1, 0x0, 0x0, 0x1, 0x1, 0x0, 0x0, 0x2, 0x1, 0x0, 0x0, 0x1, 0x0, 0x0, 0x1, 0x0, 0x1, 0x0, 0x0, 0x0, 0x1, 0x1, 0x1, 0x0, 0x1, 0x1, 0x1, 0x0, 0x1, 0x0, 0x50, 0x2, @perf_bp={&(0x7f0000000000), 0xa}, 0x2100, 0x7, 0x1, 0x3, 0x6, 0x93d3, 0x0, 0x0, 0x3a, 0x0, 0x9}, 0xffffffffffffffff, 0xc, 0xffffffffffffffff, 0x8) mmap$perf(&(0x7f0000ffb000/0x2000)=nil, 0x2000, 0xb, 0x11, r0, 0x8) munmap(&(0x7f0000ffb000/0x3000)=nil, 0x3000) getsockopt$inet6_tcp_TCP_ZEROCOPY_RECEIVE(0xffffffffffffffff, 0x6, 0x23, &(0x7f0000001180)={&(0x7f0000ffd000/0x2000)=nil, 0x2000, 0x0, 0x0, 0x0, &(0x7f00000000c0)=""/162, 0xa2, 0x0, &(0x7f0000000180)=""/4096, 0x1000}, &(0x7f00000011c0)=0x40) r1 = openat$vcsa(0xffffffffffffff9c, &(0x7f0000001200), 0x14d080, 0x0) ioctl$SNDRV_SEQ_IOCTL_SUBSCRIBE_PORT(r1, 0x40505330, &(0x7f0000001240)={{0x3f, 0x40}, {0x9, 0x2}, 0x43, 0x0, 0x1}) r2 = mmap$binder(&(0x7f0000ffc000/0x1000)=nil, 0x1000, 0x1, 0x11, r1, 0x81) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000001380)={0x44, 0x0, &(0x7f00000012c0)=[@acquire={0x40046305, 0x3}, @increfs, @free_buffer={0x40086303, r2}, @exit_looper, @request_death={0x400c630e, 0x3}, @increfs={0x40046304, 0x2}, @free_buffer], 0x1d, 0x0, &(0x7f0000001340)="63170b84a45d435cf194bbb38c0432388cb6578156ee80dc59b93c914c"}) shmget(0x0, 0x1000, 0x200, &(0x7f0000ffd000/0x1000)=nil) 17:45:22 executing program 5: clock_gettime(0x5, &(0x7f0000000000)) clock_settime(0x2, &(0x7f0000000040)) sched_rr_get_interval(0xffffffffffffffff, &(0x7f0000000080)) sched_rr_get_interval(0x0, &(0x7f00000000c0)) sendmsg$NL802154_CMD_GET_SEC_KEY(0xffffffffffffffff, &(0x7f00000001c0)={&(0x7f0000000100)={0x10, 0x0, 0x0, 0x20000000}, 0xc, &(0x7f0000000180)={&(0x7f0000000140)={0x24, 0x0, 0x200, 0x70bd26, 0x25dfdbfe, {}, [@NL802154_ATTR_IFINDEX={0x8}, @NL802154_ATTR_IFINDEX={0x8}]}, 0x24}, 0x1, 0x0, 0x0, 0x4000000}, 0x181) clock_gettime(0x0, &(0x7f0000000200)) pipe2$9p(&(0x7f0000000240)={0xffffffffffffffff, 0xffffffffffffffff}, 0x800) r1 = syz_io_uring_setup(0x776a, &(0x7f0000000280)={0x0, 0x2728, 0x2, 0x1, 0x37c}, &(0x7f0000000000/0x3000)=nil, &(0x7f0000000000/0x400000)=nil, &(0x7f0000000300), &(0x7f0000000340)) ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, &(0x7f0000000540)={0x64, 0x0, &(0x7f0000000440)=[@transaction_sg={0x40486311, {0x1, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x50, 0x18, &(0x7f0000000380)={@fd={0x66642a85, 0x0, r0}, @fd={0x66642a85, 0x0, r1}, @fda={0x66646185, 0x0, 0x2, 0x36}}, &(0x7f0000000400)={0x0, 0x18, 0x30}}}, @request_death, @release={0x40046306, 0x1}], 0x7e, 0x0, &(0x7f00000004c0)="7685c519d1cbea63a1a8f022f8c0085baf770aa5d1fa9bfb1a5399fdb134953d619e962218bba650b68d6206fde39ff17760aa4bbcb62f6802c48e17294a17a3b768ab60bbae37aa37e33e24b09f6bdea37853f7ab2622451803788c9d172b7d71d6d87911129b8ef5cc9e0169404b09abfa991f3a7a3640686df445d387"}) pipe2$9p(&(0x7f0000000580), 0x800) ioctl$EVIOCGVERSION(0xffffffffffffffff, 0x80044501, &(0x7f00000005c0)=""/174) r2 = openat$nvram(0xffffffffffffff9c, &(0x7f0000000680), 0x400, 0x0) write$P9_RSTAT(r2, &(0x7f00000006c0)={0x3f, 0x7d, 0x1, {0x0, 0x38, 0x401, 0x8000, {0x80, 0x4, 0x1}, 0x2020000, 0x4, 0x60, 0x9, 0x1, '\x00', 0x2, '.-', 0x1, '\x00', 0x1, '\x00'}}, 0x3f) r3 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) sendmsg$IEEE802154_LLSEC_DEL_KEY(r3, &(0x7f0000000840)={&(0x7f0000000700)={0x10, 0x0, 0x0, 0x800000}, 0xc, &(0x7f0000000800)={&(0x7f0000000780)={0x54, 0x0, 0x800, 0x70bd27, 0x25dfdbfc, {}, [@IEEE802154_ATTR_LLSEC_KEY_SOURCE_SHORT={0x8, 0x2c, 0x5}, @IEEE802154_ATTR_LLSEC_KEY_SOURCE_EXTENDED={0xc, 0x2d, {0xaaaaaaaaaaaa0002}}, @IEEE802154_ATTR_PAN_ID={0x6, 0x6, 0x2}, @IEEE802154_ATTR_DEV_INDEX={0x8}, @IEEE802154_ATTR_LLSEC_KEY_MODE={0x5, 0x2b, 0x1}, @IEEE802154_ATTR_HW_ADDR={0xc, 0x5, {0xaaaaaaaaaaaa0002}}, @IEEE802154_ATTR_LLSEC_KEY_MODE={0x5, 0x2b, 0x3}]}, 0x54}, 0x1, 0x0, 0x0, 0x40}, 0x2000c814) clock_getres(0x3, &(0x7f0000000880)) r4 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) sendmsg$IEEE802154_ADD_IFACE(r4, &(0x7f0000000a00)={&(0x7f0000000900)={0x10, 0x0, 0x0, 0x40c}, 0xc, &(0x7f00000009c0)={&(0x7f0000000940)={0x44, 0x0, 0x200, 0x70bd29, 0x25dfdbfe, {}, [@IEEE802154_ATTR_PHY_NAME={0x9, 0x1f, 'phy1\x00'}, @IEEE802154_ATTR_DEV_NAME={0xa, 0x1, 'wpan4\x00'}, @IEEE802154_ATTR_DEV_NAME={0xa, 0x1, 'wpan1\x00'}, @IEEE802154_ATTR_DEV_NAME={0xa, 0x1, 'wpan0\x00'}]}, 0x44}, 0x1, 0x0, 0x0, 0x20000084}, 0x44000) 17:45:22 executing program 3: getsockopt$inet_udp_int(0xffffffffffffffff, 0x11, 0x1, &(0x7f0000000000), &(0x7f0000000040)=0x4) setsockopt$inet_udp_int(0xffffffffffffffff, 0x11, 0x1, &(0x7f0000000080)=0x7, 0x4) ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, &(0x7f0000000240)={0x54, 0x0, &(0x7f00000000c0)=[@acquire_done={0x40106309, 0x1}, @free_buffer, @request_death={0x400c630e, 0x1}, @request_death, @decrefs, @dead_binder_done], 0xc7, 0x0, &(0x7f0000000140)="aa36e0fef6a6cd3a6060f434b2a2306a435d6c33ca3bfb20c9d046886ded10cf23d0938b55b8a812702a5a7579cb8813f0cf3954f24fa081e8c35a9d4674b51115d91e7f6e38920909a8fba27ba7bbb0522974a9d83826c23d40a56c3f88dc24276a8312ae50d15d3531211e4378a34980ea70ac3cefef2439af0baa6b387df4ff26b593ca52e94dda8ce3656a81180693ab97746e30b1301f30922ec565bba820fc06168927e446c06efe1fc7cb37b804ba0342e58e70da81c074407ec9cf690a9ab1e3a62a68"}) r0 = openat$vcsa(0xffffffffffffff9c, &(0x7f0000000280), 0x1, 0x0) r1 = openat$vcsa(0xffffffffffffff9c, &(0x7f00000002c0), 0x80, 0x0) ioctl$SNDRV_SEQ_IOCTL_QUERY_NEXT_PORT(r0, 0xc0a85352, &(0x7f0000000300)={{0x4, 0x6}, 'port0\x00', 0x5, 0x1, 0x0, 0xffff, 0x7, 0x7, 0x5, 0x0, 0x2, 0xc0}) ioctl$SNDRV_SEQ_IOCTL_QUERY_NEXT_CLIENT(r1, 0xc0bc5351, &(0x7f00000003c0)={0xffff7fff, 0x0, 'client0\x00', 0xffffffff80000002, "9aa89fbb0e155330", "7e3a03465d7350a6322e39e7997e8c634c3224eb46d1223d24ed4ce35c7b1dd2", 0x0, 0x6}) r2 = openat$nvram(0xffffffffffffff9c, &(0x7f0000000480), 0x1, 0x0) ioctl$PERF_EVENT_IOC_PAUSE_OUTPUT(r2, 0x40042409, 0x0) process_mrelease(r0, 0x0) r3 = openat$nvram(0xffffffffffffff9c, &(0x7f0000000700), 0x800, 0x0) write$P9_RGETLOCK(r3, &(0x7f00000007c0)={0x1e, 0x37, 0x2, {0x2, 0x6, 0x101}}, 0x1e) 17:45:22 executing program 0: get_thread_area(&(0x7f0000000000)={0x7, 0x20000800, 0x4000, 0x0, 0x1, 0x0, 0x0, 0x1, 0x1, 0x1}) r0 = openat$vcsu(0xffffffffffffff9c, &(0x7f0000000040), 0x200000, 0x0) getsockopt$inet_tcp_TCP_REPAIR_WINDOW(r0, 0x6, 0x1d, &(0x7f0000000080), &(0x7f00000000c0)=0x14) r1 = openat$nvram(0xffffffffffffff9c, &(0x7f0000000100), 0x2000, 0x0) setsockopt$inet_tcp_TCP_FASTOPEN_KEY(r1, 0x6, 0x21, &(0x7f0000000140)="1bb9d563048b6ec78effc0f14d974b17", 0x10) setsockopt$inet_tcp_int(r1, 0x6, 0x1b, &(0x7f0000000180)=0x5, 0x4) ioctl$SNDRV_TIMER_IOCTL_STATUS32(r1, 0x80585414, &(0x7f00000001c0)) setsockopt$inet_tcp_TCP_QUEUE_SEQ(r0, 0x6, 0x15, &(0x7f0000000240)=0x1, 0x4) getsockopt$inet_tcp_TCP_ZEROCOPY_RECEIVE(r1, 0x6, 0x23, &(0x7f0000000340)={&(0x7f0000ffc000/0x2000)=nil, 0x2000, 0x0, 0x0, 0x0, &(0x7f0000000280)=""/37, 0x25, 0x1, &(0x7f00000002c0)=""/109, 0x6d}, &(0x7f0000000380)=0x40) r2 = socket$inet_tcp(0x2, 0x1, 0x0) ioctl$sock_inet_tcp_SIOCINQ(r2, 0x541b, &(0x7f00000003c0)) move_pages(0x0, 0x8, &(0x7f0000000400)=[&(0x7f0000ffd000/0x1000)=nil, &(0x7f0000ffd000/0x3000)=nil, &(0x7f0000ffd000/0x3000)=nil, &(0x7f0000ffb000/0x2000)=nil, &(0x7f0000ffc000/0x1000)=nil, &(0x7f0000ffe000/0x2000)=nil, &(0x7f0000ffb000/0x4000)=nil, &(0x7f0000ffd000/0x3000)=nil], &(0x7f0000000440)=[0xfff], &(0x7f0000000480)=[0x0, 0x0, 0x0], 0x4) r3 = syz_genetlink_get_family_id$SEG6(&(0x7f0000000500), r1) sendmsg$SEG6_CMD_GET_TUNSRC(r0, &(0x7f00000005c0)={&(0x7f00000004c0)={0x10, 0x0, 0x0, 0x4000000}, 0xc, &(0x7f0000000580)={&(0x7f0000000540)={0x38, r3, 0x300, 0x70bd2a, 0x25dfdbfc, {}, [@SEG6_ATTR_HMACKEYID={0x8, 0x3, 0x24}, @SEG6_ATTR_DST={0x14, 0x1, @mcast1}, @SEG6_ATTR_DSTLEN={0x8, 0x2, 0x2}]}, 0x38}, 0x1, 0x0, 0x0, 0x20008810}, 0x4040010) sendmsg$SEG6_CMD_DUMPHMAC(0xffffffffffffffff, &(0x7f0000000740)={&(0x7f0000000680)={0x10, 0x0, 0x0, 0x240000}, 0xc, &(0x7f0000000700)={&(0x7f00000006c0)={0x2c, r3, 0x1, 0x70bd2c, 0x25dfdbfe, {}, [@SEG6_ATTR_SECRET={0x8, 0x4, [0x1]}, @SEG6_ATTR_DSTLEN={0x8, 0x2, 0x5}, @SEG6_ATTR_DSTLEN={0x8}]}, 0x2c}, 0x1, 0x0, 0x0, 0x4000000}, 0x4000000) pidfd_getfd(r1, r2, 0x0) syz_genetlink_get_family_id$ieee802154(&(0x7f0000000800), 0xffffffffffffffff) 17:45:22 executing program 2: prctl$PR_MPX_ENABLE_MANAGEMENT(0x2b) r0 = socket$inet(0x2, 0x5, 0x4) r1 = openat$vcsu(0xffffffffffffff9c, &(0x7f0000000000), 0x3c1480, 0x0) ioctl$sock_ipv4_tunnel_SIOCGETTUNNEL(r1, 0x89f0, &(0x7f00000000c0)={'syztnl2\x00', &(0x7f0000000040)={'erspan0\x00', 0x0, 0x700, 0x40, 0x3, 0x22, {{0x15, 0x4, 0x3, 0x17, 0x54, 0x64, 0x0, 0x1, 0x2f, 0x0, @broadcast, @dev={0xac, 0x14, 0x14, 0x36}, {[@cipso={0x86, 0x3d, 0x1, [{0x5, 0x9, "c8a7bec58c2c80"}, {0x0, 0x9, "fabb6c2e64ba82"}, {0x7, 0xf, "6b1b69e07efcb7230cc07a2cf7"}, {0x1, 0x6, "a2118bdb"}, {0x5, 0x10, "67115d3e7766231c7b08cf3c48e4"}]}]}}}}}) prctl$PR_MPX_ENABLE_MANAGEMENT(0x2b) r2 = openat$vcsa(0xffffffffffffff9c, &(0x7f0000000100), 0x202c0, 0x0) ioctl$SNDRV_SEQ_IOCTL_GET_QUEUE_TEMPO(r2, 0xc02c5341, &(0x7f0000000140)) ioctl$SNDRV_TIMER_IOCTL_SELECT(r1, 0x40345410, &(0x7f00000001c0)={{0x0, 0x2, 0x3f, 0x3, 0x80000001}}) ioctl$SNDRV_SEQ_IOCTL_GET_QUEUE_TEMPO(r1, 0xc02c5341, &(0x7f0000000200)) ioctl$sock_inet_tcp_SIOCOUTQ(r0, 0x5411, &(0x7f0000000280)) r3 = syz_open_dev$evdev(&(0x7f00000002c0), 0x1, 0x50000) ioctl$EVIOCGLED(r3, 0x80404519, &(0x7f0000000300)=""/21) seccomp$SECCOMP_GET_NOTIF_SIZES(0x3, 0x0, &(0x7f0000000340)) ioctl$SNDRV_TIMER_IOCTL_NEXT_DEVICE(r2, 0xc0145401, &(0x7f0000000380)={0x3, 0x2, 0x8, 0x2, 0x733}) munlock(&(0x7f0000ff9000/0x4000)=nil, 0x4000) syz_open_procfs(0x0, &(0x7f0000000500)='schedstat\x00') 17:45:22 executing program 4: shmget(0x1, 0x3000, 0x0, &(0x7f0000ffc000/0x3000)=nil) 17:45:22 executing program 7: r0 = perf_event_open(&(0x7f0000000040)={0x4, 0x80, 0x6f, 0x8, 0x8, 0x1, 0x0, 0x6, 0x4, 0x1, 0x1, 0x0, 0x0, 0x1, 0x1, 0x1, 0x0, 0x0, 0x1, 0x0, 0x0, 0x1, 0x1, 0x0, 0x0, 0x2, 0x1, 0x0, 0x0, 0x1, 0x0, 0x0, 0x1, 0x0, 0x1, 0x0, 0x0, 0x0, 0x1, 0x1, 0x1, 0x0, 0x1, 0x1, 0x1, 0x0, 0x1, 0x0, 0x50, 0x2, @perf_bp={&(0x7f0000000000), 0xa}, 0x2100, 0x7, 0x1, 0x3, 0x6, 0x93d3, 0x0, 0x0, 0x3a, 0x0, 0x9}, 0xffffffffffffffff, 0xc, 0xffffffffffffffff, 0x8) mmap$perf(&(0x7f0000ffb000/0x2000)=nil, 0x2000, 0xb, 0x11, r0, 0x8) munmap(&(0x7f0000ffb000/0x3000)=nil, 0x3000) getsockopt$inet6_tcp_TCP_ZEROCOPY_RECEIVE(0xffffffffffffffff, 0x6, 0x23, &(0x7f0000001180)={&(0x7f0000ffd000/0x2000)=nil, 0x2000, 0x0, 0x0, 0x0, &(0x7f00000000c0)=""/162, 0xa2, 0x0, &(0x7f0000000180)=""/4096, 0x1000}, &(0x7f00000011c0)=0x40) r1 = openat$vcsa(0xffffffffffffff9c, &(0x7f0000001200), 0x14d080, 0x0) ioctl$SNDRV_SEQ_IOCTL_SUBSCRIBE_PORT(r1, 0x40505330, &(0x7f0000001240)={{0x3f, 0x40}, {0x9, 0x2}, 0x43, 0x0, 0x1}) mmap$binder(&(0x7f0000ffc000/0x1000)=nil, 0x1000, 0x1, 0x11, r1, 0x81) shmget(0x0, 0x1000, 0x200, &(0x7f0000ffd000/0x1000)=nil) [ 187.833953] Bluetooth: hci2: command 0x0406 tx timeout [ 187.835424] Bluetooth: hci4: command 0x0406 tx timeout [ 187.836466] Bluetooth: hci7: command 0x0406 tx timeout [ 187.838654] Bluetooth: hci6: command 0x0406 tx timeout [ 187.840036] Bluetooth: hci3: command 0x0406 tx timeout [ 187.841020] Bluetooth: hci0: command 0x0406 tx timeout [ 187.842014] Bluetooth: hci1: command 0x0406 tx timeout [ 187.842975] Bluetooth: hci5: command 0x0406 tx timeout 17:45:31 executing program 5: clock_gettime(0x5, &(0x7f0000000000)) clock_settime(0x2, &(0x7f0000000040)) sched_rr_get_interval(0xffffffffffffffff, &(0x7f0000000080)) sched_rr_get_interval(0x0, &(0x7f00000000c0)) sendmsg$NL802154_CMD_GET_SEC_KEY(0xffffffffffffffff, &(0x7f00000001c0)={&(0x7f0000000100)={0x10, 0x0, 0x0, 0x20000000}, 0xc, &(0x7f0000000180)={&(0x7f0000000140)={0x24, 0x0, 0x200, 0x70bd26, 0x25dfdbfe, {}, [@NL802154_ATTR_IFINDEX={0x8}, @NL802154_ATTR_IFINDEX={0x8}]}, 0x24}, 0x1, 0x0, 0x0, 0x4000000}, 0x181) clock_gettime(0x0, &(0x7f0000000200)) pipe2$9p(&(0x7f0000000240)={0xffffffffffffffff, 0xffffffffffffffff}, 0x800) r1 = syz_io_uring_setup(0x776a, &(0x7f0000000280)={0x0, 0x2728, 0x2, 0x1, 0x37c}, &(0x7f0000000000/0x3000)=nil, &(0x7f0000000000/0x400000)=nil, &(0x7f0000000300), &(0x7f0000000340)) ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, &(0x7f0000000540)={0x64, 0x0, &(0x7f0000000440)=[@transaction_sg={0x40486311, {0x1, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x50, 0x18, &(0x7f0000000380)={@fd={0x66642a85, 0x0, r0}, @fd={0x66642a85, 0x0, r1}, @fda={0x66646185, 0x0, 0x2, 0x36}}, &(0x7f0000000400)={0x0, 0x18, 0x30}}}, @request_death, @release={0x40046306, 0x1}], 0x7e, 0x0, &(0x7f00000004c0)="7685c519d1cbea63a1a8f022f8c0085baf770aa5d1fa9bfb1a5399fdb134953d619e962218bba650b68d6206fde39ff17760aa4bbcb62f6802c48e17294a17a3b768ab60bbae37aa37e33e24b09f6bdea37853f7ab2622451803788c9d172b7d71d6d87911129b8ef5cc9e0169404b09abfa991f3a7a3640686df445d387"}) pipe2$9p(&(0x7f0000000580), 0x800) ioctl$EVIOCGVERSION(0xffffffffffffffff, 0x80044501, &(0x7f00000005c0)=""/174) r2 = openat$nvram(0xffffffffffffff9c, &(0x7f0000000680), 0x400, 0x0) write$P9_RSTAT(r2, &(0x7f00000006c0)={0x3f, 0x7d, 0x1, {0x0, 0x38, 0x401, 0x8000, {0x80, 0x4, 0x1}, 0x2020000, 0x4, 0x60, 0x9, 0x1, '\x00', 0x2, '.-', 0x1, '\x00', 0x1, '\x00'}}, 0x3f) r3 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) sendmsg$IEEE802154_LLSEC_DEL_KEY(r3, &(0x7f0000000840)={&(0x7f0000000700)={0x10, 0x0, 0x0, 0x800000}, 0xc, &(0x7f0000000800)={&(0x7f0000000780)={0x54, 0x0, 0x800, 0x70bd27, 0x25dfdbfc, {}, [@IEEE802154_ATTR_LLSEC_KEY_SOURCE_SHORT={0x8, 0x2c, 0x5}, @IEEE802154_ATTR_LLSEC_KEY_SOURCE_EXTENDED={0xc, 0x2d, {0xaaaaaaaaaaaa0002}}, @IEEE802154_ATTR_PAN_ID={0x6, 0x6, 0x2}, @IEEE802154_ATTR_DEV_INDEX={0x8}, @IEEE802154_ATTR_LLSEC_KEY_MODE={0x5, 0x2b, 0x1}, @IEEE802154_ATTR_HW_ADDR={0xc, 0x5, {0xaaaaaaaaaaaa0002}}, @IEEE802154_ATTR_LLSEC_KEY_MODE={0x5, 0x2b, 0x3}]}, 0x54}, 0x1, 0x0, 0x0, 0x40}, 0x2000c814) clock_getres(0x3, &(0x7f0000000880)) r4 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) sendmsg$IEEE802154_ADD_IFACE(r4, &(0x7f0000000a00)={&(0x7f0000000900)={0x10, 0x0, 0x0, 0x40c}, 0xc, &(0x7f00000009c0)={&(0x7f0000000940)={0x44, 0x0, 0x200, 0x70bd29, 0x25dfdbfe, {}, [@IEEE802154_ATTR_PHY_NAME={0x9, 0x1f, 'phy1\x00'}, @IEEE802154_ATTR_DEV_NAME={0xa, 0x1, 'wpan4\x00'}, @IEEE802154_ATTR_DEV_NAME={0xa, 0x1, 'wpan1\x00'}, @IEEE802154_ATTR_DEV_NAME={0xa, 0x1, 'wpan0\x00'}]}, 0x44}, 0x1, 0x0, 0x0, 0x20000084}, 0x44000) 17:45:31 executing program 2: prctl$PR_MPX_ENABLE_MANAGEMENT(0x2b) r0 = socket$inet(0x2, 0x5, 0x4) r1 = openat$vcsu(0xffffffffffffff9c, &(0x7f0000000000), 0x3c1480, 0x0) ioctl$sock_ipv4_tunnel_SIOCGETTUNNEL(r1, 0x89f0, &(0x7f00000000c0)={'syztnl2\x00', &(0x7f0000000040)={'erspan0\x00', 0x0, 0x700, 0x40, 0x3, 0x22, {{0x15, 0x4, 0x3, 0x17, 0x54, 0x64, 0x0, 0x1, 0x2f, 0x0, @broadcast, @dev={0xac, 0x14, 0x14, 0x36}, {[@cipso={0x86, 0x3d, 0x1, [{0x5, 0x9, "c8a7bec58c2c80"}, {0x0, 0x9, "fabb6c2e64ba82"}, {0x7, 0xf, "6b1b69e07efcb7230cc07a2cf7"}, {0x1, 0x6, "a2118bdb"}, {0x5, 0x10, "67115d3e7766231c7b08cf3c48e4"}]}]}}}}}) prctl$PR_MPX_ENABLE_MANAGEMENT(0x2b) r2 = openat$vcsa(0xffffffffffffff9c, &(0x7f0000000100), 0x202c0, 0x0) ioctl$SNDRV_SEQ_IOCTL_GET_QUEUE_TEMPO(r2, 0xc02c5341, &(0x7f0000000140)) ioctl$SNDRV_TIMER_IOCTL_SELECT(r1, 0x40345410, &(0x7f00000001c0)={{0x0, 0x2, 0x3f, 0x3, 0x80000001}}) ioctl$SNDRV_SEQ_IOCTL_GET_QUEUE_TEMPO(r1, 0xc02c5341, &(0x7f0000000200)) ioctl$sock_inet_tcp_SIOCOUTQ(r0, 0x5411, &(0x7f0000000280)) r3 = syz_open_dev$evdev(&(0x7f00000002c0), 0x1, 0x50000) ioctl$EVIOCGLED(r3, 0x80404519, &(0x7f0000000300)=""/21) seccomp$SECCOMP_GET_NOTIF_SIZES(0x3, 0x0, &(0x7f0000000340)) ioctl$SNDRV_TIMER_IOCTL_NEXT_DEVICE(r2, 0xc0145401, &(0x7f0000000380)={0x3, 0x2, 0x8, 0x2, 0x733}) syz_open_procfs(0x0, &(0x7f0000000500)='schedstat\x00') 17:45:31 executing program 6: r0 = perf_event_open(&(0x7f00000000c0)={0x1, 0x80, 0x0, 0xc0, 0xfa, 0x1, 0x0, 0x7fffffff, 0x10811, 0x1, 0x1, 0x1, 0x1, 0x1, 0x1, 0x1, 0x1, 0x1, 0x0, 0x1, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x1, 0x0, 0x1, 0x0, 0x0, 0x0, 0x1, 0x1, 0x1, 0x1, 0x1, 0x1, 0x1, 0x0, 0x1, 0x1, 0x1, 0x1, 0x0, 0x0, 0xfff, 0x7, @perf_config_ext={0x7, 0x7fffffff}, 0x41000, 0x80000000, 0x5, 0x3, 0x9, 0x2, 0x9, 0x0, 0x5, 0x0, 0x4}, 0x0, 0xb, 0xffffffffffffffff, 0x1) perf_event_open(&(0x7f0000000040)={0x0, 0x80, 0x0, 0x40, 0x80, 0x9, 0x0, 0x3, 0x10040, 0x1, 0x0, 0x0, 0x1, 0x1, 0x1, 0x1, 0x1, 0x1, 0x1, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x3, 0x1, 0x0, 0x1, 0x0, 0x1, 0x1, 0x0, 0x0, 0x1, 0x1, 0x1, 0x0, 0x1, 0x0, 0x0, 0x0, 0x1, 0x0, 0x1, 0x0, 0x1, 0x0, 0x0, 0x1, @perf_bp={&(0x7f0000000000), 0x10}, 0x8080, 0x800, 0x2, 0x3, 0x36dc, 0x31df3b33, 0xff, 0x0, 0x9, 0x0, 0x5}, 0xffffffffffffffff, 0x9, r0, 0x9) ioctl$PERF_EVENT_IOC_PAUSE_OUTPUT(r0, 0x40042409, 0x0) ioctl$PERF_EVENT_IOC_PERIOD(0xffffffffffffffff, 0x40082404, &(0x7f0000000140)=0x8) r1 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl$sock_ipv4_tunnel_SIOCADDTUNNEL(r1, 0x89f1, &(0x7f00000001c0)={'syztnl1\x00', &(0x7f0000000180)={'syztnl0\x00', 0x0, 0x1, 0x40, 0x0, 0x5, {{0x5, 0x4, 0x2, 0x19, 0x14, 0x65, 0x0, 0x1f, 0x4, 0x0, @multicast2, @remote}}}}) ioctl$PERF_EVENT_IOC_PERIOD(r0, 0x40082404, &(0x7f0000000200)=0x9) ioctl$SNDRV_SEQ_IOCTL_GET_PORT_INFO(0xffffffffffffffff, 0xc0a85322, &(0x7f0000000240)) ioctl$SNDRV_SEQ_IOCTL_SYSTEM_INFO(0xffffffffffffffff, 0xc0305302, &(0x7f0000000300)={0x9, 0x101, 0x1, 0x6, 0x3, 0x5}) r2 = syz_open_procfs(0x0, &(0x7f0000000340)='children\x00') openat$cgroup_type(r2, &(0x7f0000000380), 0x2, 0x0) ioctl$EVIOCGABS20(r2, 0x80184560, &(0x7f00000003c0)=""/4096) write$cgroup_type(0xffffffffffffffff, &(0x7f0000001500), 0x9) 17:45:31 executing program 1: shmget$private(0x0, 0x4000, 0x80, &(0x7f0000ffb000/0x4000)=nil) shmget(0x3, 0x2000, 0x4, &(0x7f0000ffc000/0x2000)=nil) mlock(&(0x7f0000ff0000/0x10000)=nil, 0x10000) shmget(0x1, 0x1000, 0x10, &(0x7f0000ff5000/0x1000)=nil) ioctl$sock_ipv4_tunnel_SIOCGETTUNNEL(0xffffffffffffffff, 0x89f0, &(0x7f0000000140)={'syztnl1\x00', &(0x7f00000000c0)={'syztnl2\x00', 0x0, 0x20, 0x1, 0x6, 0x9, {{0xd, 0x4, 0x1, 0x19, 0x34, 0x68, 0x0, 0x9, 0x29, 0x0, @empty, @dev={0xac, 0x14, 0x14, 0x29}, {[@timestamp_addr={0x44, 0x14, 0xc2, 0x1, 0x4, [{@multicast1}, {@private=0xa010101}]}, @rr={0x7, 0xb, 0xc8, [@initdev={0xac, 0x1e, 0x1, 0x0}, @private=0xa010102]}]}}}}}) ioctl$sock_ipv4_tunnel_SIOCADDTUNNEL(0xffffffffffffffff, 0x89f1, &(0x7f0000000280)={'tunl0\x00', &(0x7f0000000180)={'tunl0\x00', r0, 0x7, 0x8000, 0xfffffffc, 0x8, {{0x2f, 0x4, 0x0, 0x2, 0xbc, 0x65, 0x0, 0x0, 0x4, 0x0, @empty, @broadcast, {[@generic={0x89, 0x9, "8db1d464c6af68"}, @noop, @ra={0x94, 0x4, 0x1}, @timestamp={0x44, 0x1c, 0x53, 0x0, 0x7, [0x40, 0x7fffffff, 0xfffffffd, 0x5, 0x5c, 0x77]}, @cipso={0x86, 0x2f, 0x3, [{0x1, 0x4, "1eba"}, {0x1, 0x7, "e3ccb5ddcf"}, {0x6, 0xa, "5db18b961780af33"}, {0x2, 0xe, "7353a9824b57fd7d39232ac5"}, {0x1, 0x6, "2e1ccd27"}]}, @noop, @cipso={0x86, 0x37, 0xffffffffffffffff, [{0x2, 0xf, "227467028cabd4e137b820c5c9"}, {0x7, 0x6, "90569992"}, {0x2, 0xc, "2071b0a8c9ce92782e72"}, {0x6, 0xa, "14f2b9bca55ce3dd"}, {0x6, 0x6, "2cd22a8f"}]}, @timestamp={0x44, 0x14, 0xd4, 0x0, 0x5, [0x81, 0x5d23, 0x63ab, 0x1]}]}}}}}) ioctl$sock_ipv4_tunnel_SIOCDELTUNNEL(0xffffffffffffffff, 0x89f2, &(0x7f0000000380)={'gretap0\x00', &(0x7f00000002c0)={'syztnl2\x00', 0x0, 0x7800, 0x7, 0x40, 0xe180, {{0x22, 0x4, 0x0, 0x1, 0x88, 0x64, 0x0, 0x1, 0x29, 0x0, @multicast2, @multicast1, {[@end, @lsrr={0x83, 0x1f, 0x2f, [@multicast2, @local, @local, @multicast1, @rand_addr=0x64010102, @loopback, @private=0xa010100]}, @rr={0x7, 0x27, 0x6c, [@multicast1, @rand_addr=0x64010102, @remote, @multicast1, @loopback, @initdev={0xac, 0x1e, 0x0, 0x0}, @initdev={0xac, 0x1e, 0x1, 0x0}, @broadcast, @empty]}, @ra={0x94, 0x4, 0x1}, @timestamp={0x44, 0x10, 0x2d, 0x0, 0x8, [0x1, 0x100, 0x401]}, @ssrr={0x89, 0x13, 0x56, [@dev={0xac, 0x14, 0x14, 0x28}, @multicast2, @initdev={0xac, 0x1e, 0x0, 0x0}, @remote]}, @ra={0x94, 0x4, 0x1}]}}}}}) shmget(0x3, 0x4000, 0x4, &(0x7f0000ff9000/0x4000)=nil) mmap$IORING_OFF_CQ_RING(&(0x7f0000ffd000/0x3000)=nil, 0x3000, 0x2000008, 0x30, 0xffffffffffffffff, 0x8000000) r1 = syz_genetlink_get_family_id$nl802154(&(0x7f0000000400), 0xffffffffffffffff) ioctl$sock_SIOCGIFINDEX_802154(0xffffffffffffffff, 0x8933, &(0x7f0000000440)={'wpan1\x00', 0x0}) sendmsg$NL802154_CMD_NEW_INTERFACE(0xffffffffffffffff, &(0x7f0000000540)={&(0x7f00000003c0)={0x10, 0x0, 0x0, 0x2}, 0xc, &(0x7f0000000500)={&(0x7f0000000480)={0x48, r1, 0x200, 0x70bd2a, 0x25dfdbfd, {}, [@NL802154_ATTR_IFNAME={0xa, 0x4, 'wpan0\x00'}, @NL802154_ATTR_IFINDEX={0x8}, @NL802154_ATTR_IFNAME={0xa, 0x4, 'wpan1\x00'}, @NL802154_ATTR_EXTENDED_ADDR={0xc, 0x17, {0xaaaaaaaaaaaa0002}}, @NL802154_ATTR_IFINDEX={0x8, 0x3, r2}]}, 0x48}}, 0x4001) mmap$binder(&(0x7f0000fef000/0x11000)=nil, 0x11000, 0x1, 0x11, 0xffffffffffffffff, 0x6) shmget$private(0x0, 0x4000, 0x200, &(0x7f0000ffc000/0x4000)=nil) r3 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) sendmsg$IEEE802154_LLSEC_ADD_SECLEVEL(r3, &(0x7f00000006c0)={&(0x7f0000000580)={0x10, 0x0, 0x0, 0x4000000}, 0xc, &(0x7f0000000680)={&(0x7f0000000600)={0x44, 0x0, 0x200, 0x70bd2a, 0x25dfdbff, {}, [@IEEE802154_ATTR_LLSEC_FRAME_TYPE={0x5, 0x33, 0x34}, @IEEE802154_ATTR_DEV_INDEX={0x8}, @IEEE802154_ATTR_LLSEC_CMD_FRAME_ID={0x5, 0x34, 0x1}, @IEEE802154_ATTR_DEV_NAME={0xa, 0x1, 'wpan0\x00'}, @IEEE802154_ATTR_DEV_NAME={0xa, 0x1, 'wpan4\x00'}]}, 0x44}, 0x1, 0x0, 0x0, 0x8800}, 0x0) sendmsg$IEEE802154_START_REQ(r3, &(0x7f00000007c0)={&(0x7f0000000700)={0x10, 0x0, 0x0, 0x4}, 0xc, &(0x7f0000000780)={&(0x7f0000000740)={0x1c, 0x0, 0x200, 0x70bd2d, 0x25dfdbfb, {}, [@IEEE802154_ATTR_CHANNEL={0x5, 0x7, 0x6}]}, 0x1c}, 0x1, 0x0, 0x0, 0x40100}, 0x801) mlock(&(0x7f0000fef000/0x1000)=nil, 0x1000) syz_io_uring_setup(0x4726, &(0x7f0000000840)={0x0, 0x502f, 0x20, 0x0, 0x12e}, &(0x7f0000ffe000/0x2000)=nil, &(0x7f0000ffb000/0x4000)=nil, &(0x7f00000008c0), &(0x7f0000000900)) 17:45:31 executing program 3: getsockopt$inet_udp_int(0xffffffffffffffff, 0x11, 0x1, &(0x7f0000000000), &(0x7f0000000040)=0x4) setsockopt$inet_udp_int(0xffffffffffffffff, 0x11, 0x1, &(0x7f0000000080)=0x7, 0x4) ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, &(0x7f0000000240)={0x54, 0x0, &(0x7f00000000c0)=[@acquire_done={0x40106309, 0x1}, @free_buffer, @request_death={0x400c630e, 0x1}, @request_death, @decrefs, @dead_binder_done], 0xc7, 0x0, &(0x7f0000000140)="aa36e0fef6a6cd3a6060f434b2a2306a435d6c33ca3bfb20c9d046886ded10cf23d0938b55b8a812702a5a7579cb8813f0cf3954f24fa081e8c35a9d4674b51115d91e7f6e38920909a8fba27ba7bbb0522974a9d83826c23d40a56c3f88dc24276a8312ae50d15d3531211e4378a34980ea70ac3cefef2439af0baa6b387df4ff26b593ca52e94dda8ce3656a81180693ab97746e30b1301f30922ec565bba820fc06168927e446c06efe1fc7cb37b804ba0342e58e70da81c074407ec9cf690a9ab1e3a62a68"}) r0 = openat$vcsa(0xffffffffffffff9c, &(0x7f0000000280), 0x1, 0x0) r1 = openat$vcsa(0xffffffffffffff9c, &(0x7f00000002c0), 0x80, 0x0) ioctl$SNDRV_SEQ_IOCTL_QUERY_NEXT_PORT(r0, 0xc0a85352, &(0x7f0000000300)={{0x4, 0x6}, 'port0\x00', 0x5, 0x1, 0x0, 0xffff, 0x7, 0x7, 0x5, 0x0, 0x2, 0xc0}) ioctl$SNDRV_SEQ_IOCTL_QUERY_NEXT_CLIENT(r1, 0xc0bc5351, &(0x7f00000003c0)={0xffff7fff, 0x0, 'client0\x00', 0xffffffff80000002, "9aa89fbb0e155330", "7e3a03465d7350a6322e39e7997e8c634c3224eb46d1223d24ed4ce35c7b1dd2", 0x0, 0x6}) r2 = openat$nvram(0xffffffffffffff9c, &(0x7f0000000480), 0x1, 0x0) ioctl$PERF_EVENT_IOC_PAUSE_OUTPUT(r2, 0x40042409, 0x0) r3 = openat$nvram(0xffffffffffffff9c, &(0x7f0000000700), 0x800, 0x0) write$P9_RGETLOCK(r3, &(0x7f00000007c0)={0x1e, 0x37, 0x2, {0x2, 0x6, 0x101}}, 0x1e) 17:45:31 executing program 4: r0 = perf_event_open(&(0x7f00000000c0)={0x1, 0x80, 0x0, 0xc0, 0xfa, 0x1, 0x0, 0x7fffffff, 0x10811, 0x1, 0x1, 0x1, 0x1, 0x1, 0x1, 0x1, 0x1, 0x1, 0x0, 0x1, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x1, 0x0, 0x1, 0x0, 0x0, 0x0, 0x1, 0x1, 0x1, 0x1, 0x1, 0x1, 0x1, 0x0, 0x1, 0x1, 0x1, 0x1, 0x0, 0x0, 0xfff, 0x7, @perf_config_ext={0x7, 0x7fffffff}, 0x41000, 0x80000000, 0x5, 0x3, 0x9, 0x2, 0x9, 0x0, 0x5, 0x0, 0x4}, 0x0, 0xb, 0xffffffffffffffff, 0x1) perf_event_open(&(0x7f0000000040)={0x0, 0x80, 0x0, 0x40, 0x80, 0x9, 0x0, 0x3, 0x10040, 0x1, 0x0, 0x0, 0x1, 0x1, 0x1, 0x1, 0x1, 0x1, 0x1, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x3, 0x1, 0x0, 0x1, 0x0, 0x1, 0x1, 0x0, 0x0, 0x1, 0x1, 0x1, 0x0, 0x1, 0x0, 0x0, 0x0, 0x1, 0x0, 0x1, 0x0, 0x1, 0x0, 0x0, 0x1, @perf_bp={&(0x7f0000000000), 0x10}, 0x8080, 0x800, 0x2, 0x3, 0x36dc, 0x31df3b33, 0xff, 0x0, 0x9, 0x0, 0x5}, 0xffffffffffffffff, 0x9, r0, 0x9) ioctl$PERF_EVENT_IOC_PAUSE_OUTPUT(r0, 0x40042409, 0x0) ioctl$PERF_EVENT_IOC_PERIOD(0xffffffffffffffff, 0x40082404, &(0x7f0000000140)=0x8) r1 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl$sock_ipv4_tunnel_SIOCADDTUNNEL(r1, 0x89f1, &(0x7f00000001c0)={'syztnl1\x00', &(0x7f0000000180)={'syztnl0\x00', 0x0, 0x1, 0x40, 0x0, 0x5, {{0x5, 0x4, 0x2, 0x19, 0x14, 0x65, 0x0, 0x1f, 0x4, 0x0, @multicast2, @remote}}}}) ioctl$PERF_EVENT_IOC_PERIOD(r0, 0x40082404, &(0x7f0000000200)=0x9) ioctl$SNDRV_SEQ_IOCTL_GET_PORT_INFO(0xffffffffffffffff, 0xc0a85322, &(0x7f0000000240)) ioctl$SNDRV_SEQ_IOCTL_SYSTEM_INFO(0xffffffffffffffff, 0xc0305302, &(0x7f0000000300)={0x9, 0x101, 0x1, 0x6, 0x3, 0x5}) r2 = syz_open_procfs(0x0, &(0x7f0000000340)='children\x00') openat$cgroup_type(r2, &(0x7f0000000380), 0x2, 0x0) ioctl$EVIOCGABS20(r2, 0x80184560, &(0x7f00000003c0)=""/4096) socket$inet6_tcp(0xa, 0x1, 0x0) write$cgroup_type(0xffffffffffffffff, &(0x7f0000001500), 0x9) 17:45:31 executing program 0: get_thread_area(&(0x7f0000000000)={0x7, 0x20000800, 0x4000, 0x0, 0x1, 0x0, 0x0, 0x1, 0x1, 0x1}) r0 = openat$vcsu(0xffffffffffffff9c, &(0x7f0000000040), 0x200000, 0x0) getsockopt$inet_tcp_TCP_REPAIR_WINDOW(r0, 0x6, 0x1d, &(0x7f0000000080), &(0x7f00000000c0)=0x14) r1 = openat$nvram(0xffffffffffffff9c, &(0x7f0000000100), 0x2000, 0x0) setsockopt$inet_tcp_TCP_FASTOPEN_KEY(r1, 0x6, 0x21, &(0x7f0000000140)="1bb9d563048b6ec78effc0f14d974b17", 0x10) setsockopt$inet_tcp_int(r1, 0x6, 0x1b, &(0x7f0000000180)=0x5, 0x4) ioctl$SNDRV_TIMER_IOCTL_STATUS32(r1, 0x80585414, &(0x7f00000001c0)) setsockopt$inet_tcp_TCP_QUEUE_SEQ(r0, 0x6, 0x15, &(0x7f0000000240)=0x1, 0x4) getsockopt$inet_tcp_TCP_ZEROCOPY_RECEIVE(r1, 0x6, 0x23, &(0x7f0000000340)={&(0x7f0000ffc000/0x2000)=nil, 0x2000, 0x0, 0x0, 0x0, &(0x7f0000000280)=""/37, 0x25, 0x1, &(0x7f00000002c0)=""/109, 0x6d}, &(0x7f0000000380)=0x40) r2 = socket$inet_tcp(0x2, 0x1, 0x0) ioctl$sock_inet_tcp_SIOCINQ(r2, 0x541b, &(0x7f00000003c0)) move_pages(0x0, 0x8, &(0x7f0000000400)=[&(0x7f0000ffd000/0x1000)=nil, &(0x7f0000ffd000/0x3000)=nil, &(0x7f0000ffd000/0x3000)=nil, &(0x7f0000ffb000/0x2000)=nil, &(0x7f0000ffc000/0x1000)=nil, &(0x7f0000ffe000/0x2000)=nil, &(0x7f0000ffb000/0x4000)=nil, &(0x7f0000ffd000/0x3000)=nil], &(0x7f0000000440)=[0xfff], &(0x7f0000000480)=[0x0, 0x0, 0x0], 0x4) r3 = syz_genetlink_get_family_id$SEG6(&(0x7f0000000500), r1) sendmsg$SEG6_CMD_DUMPHMAC(0xffffffffffffffff, &(0x7f0000000740)={&(0x7f0000000680)={0x10, 0x0, 0x0, 0x240000}, 0xc, &(0x7f0000000700)={&(0x7f00000006c0)={0x2c, r3, 0x1, 0x70bd2c, 0x25dfdbfe, {}, [@SEG6_ATTR_SECRET={0x8, 0x4, [0x1]}, @SEG6_ATTR_DSTLEN={0x8, 0x2, 0x5}, @SEG6_ATTR_DSTLEN={0x8}]}, 0x2c}, 0x1, 0x0, 0x0, 0x4000000}, 0x4000000) pidfd_getfd(r1, r2, 0x0) syz_genetlink_get_family_id$ieee802154(&(0x7f0000000800), 0xffffffffffffffff) 17:45:31 executing program 7: r0 = perf_event_open(&(0x7f0000000040)={0x4, 0x80, 0x6f, 0x8, 0x8, 0x1, 0x0, 0x6, 0x4, 0x1, 0x1, 0x0, 0x0, 0x1, 0x1, 0x1, 0x0, 0x0, 0x1, 0x0, 0x0, 0x1, 0x1, 0x0, 0x0, 0x2, 0x1, 0x0, 0x0, 0x1, 0x0, 0x0, 0x1, 0x0, 0x1, 0x0, 0x0, 0x0, 0x1, 0x1, 0x1, 0x0, 0x1, 0x1, 0x1, 0x0, 0x1, 0x0, 0x50, 0x2, @perf_bp={&(0x7f0000000000), 0xa}, 0x2100, 0x7, 0x1, 0x3, 0x6, 0x93d3, 0x0, 0x0, 0x3a, 0x0, 0x9}, 0xffffffffffffffff, 0xc, 0xffffffffffffffff, 0x8) mmap$perf(&(0x7f0000ffb000/0x2000)=nil, 0x2000, 0xb, 0x11, r0, 0x8) munmap(&(0x7f0000ffb000/0x3000)=nil, 0x3000) getsockopt$inet6_tcp_TCP_ZEROCOPY_RECEIVE(0xffffffffffffffff, 0x6, 0x23, &(0x7f0000001180)={&(0x7f0000ffd000/0x2000)=nil, 0x2000, 0x0, 0x0, 0x0, &(0x7f00000000c0)=""/162, 0xa2, 0x0, &(0x7f0000000180)=""/4096, 0x1000}, &(0x7f00000011c0)=0x40) r1 = openat$vcsa(0xffffffffffffff9c, &(0x7f0000001200), 0x14d080, 0x0) ioctl$SNDRV_SEQ_IOCTL_SUBSCRIBE_PORT(r1, 0x40505330, &(0x7f0000001240)={{0x3f, 0x40}, {0x9, 0x2}, 0x43, 0x0, 0x1}) shmget(0x0, 0x1000, 0x200, &(0x7f0000ffd000/0x1000)=nil) 17:45:31 executing program 5: clock_gettime(0x5, &(0x7f0000000000)) clock_settime(0x2, &(0x7f0000000040)) sched_rr_get_interval(0xffffffffffffffff, &(0x7f0000000080)) sched_rr_get_interval(0x0, &(0x7f00000000c0)) sendmsg$NL802154_CMD_GET_SEC_KEY(0xffffffffffffffff, &(0x7f00000001c0)={&(0x7f0000000100)={0x10, 0x0, 0x0, 0x20000000}, 0xc, &(0x7f0000000180)={&(0x7f0000000140)={0x24, 0x0, 0x200, 0x70bd26, 0x25dfdbfe, {}, [@NL802154_ATTR_IFINDEX={0x8}, @NL802154_ATTR_IFINDEX={0x8}]}, 0x24}, 0x1, 0x0, 0x0, 0x4000000}, 0x181) clock_gettime(0x0, &(0x7f0000000200)) pipe2$9p(&(0x7f0000000240)={0xffffffffffffffff, 0xffffffffffffffff}, 0x800) r1 = syz_io_uring_setup(0x776a, &(0x7f0000000280)={0x0, 0x2728, 0x2, 0x1, 0x37c}, &(0x7f0000000000/0x3000)=nil, &(0x7f0000000000/0x400000)=nil, &(0x7f0000000300), &(0x7f0000000340)) ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, &(0x7f0000000540)={0x64, 0x0, &(0x7f0000000440)=[@transaction_sg={0x40486311, {0x1, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x50, 0x18, &(0x7f0000000380)={@fd={0x66642a85, 0x0, r0}, @fd={0x66642a85, 0x0, r1}, @fda={0x66646185, 0x0, 0x2, 0x36}}, &(0x7f0000000400)={0x0, 0x18, 0x30}}}, @request_death, @release={0x40046306, 0x1}], 0x7e, 0x0, &(0x7f00000004c0)="7685c519d1cbea63a1a8f022f8c0085baf770aa5d1fa9bfb1a5399fdb134953d619e962218bba650b68d6206fde39ff17760aa4bbcb62f6802c48e17294a17a3b768ab60bbae37aa37e33e24b09f6bdea37853f7ab2622451803788c9d172b7d71d6d87911129b8ef5cc9e0169404b09abfa991f3a7a3640686df445d387"}) pipe2$9p(&(0x7f0000000580), 0x800) ioctl$EVIOCGVERSION(0xffffffffffffffff, 0x80044501, &(0x7f00000005c0)=""/174) r2 = openat$nvram(0xffffffffffffff9c, &(0x7f0000000680), 0x400, 0x0) write$P9_RSTAT(r2, &(0x7f00000006c0)={0x3f, 0x7d, 0x1, {0x0, 0x38, 0x401, 0x8000, {0x80, 0x4, 0x1}, 0x2020000, 0x4, 0x60, 0x9, 0x1, '\x00', 0x2, '.-', 0x1, '\x00', 0x1, '\x00'}}, 0x3f) r3 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) sendmsg$IEEE802154_LLSEC_DEL_KEY(r3, &(0x7f0000000840)={&(0x7f0000000700)={0x10, 0x0, 0x0, 0x800000}, 0xc, &(0x7f0000000800)={&(0x7f0000000780)={0x54, 0x0, 0x800, 0x70bd27, 0x25dfdbfc, {}, [@IEEE802154_ATTR_LLSEC_KEY_SOURCE_SHORT={0x8, 0x2c, 0x5}, @IEEE802154_ATTR_LLSEC_KEY_SOURCE_EXTENDED={0xc, 0x2d, {0xaaaaaaaaaaaa0002}}, @IEEE802154_ATTR_PAN_ID={0x6, 0x6, 0x2}, @IEEE802154_ATTR_DEV_INDEX={0x8}, @IEEE802154_ATTR_LLSEC_KEY_MODE={0x5, 0x2b, 0x1}, @IEEE802154_ATTR_HW_ADDR={0xc, 0x5, {0xaaaaaaaaaaaa0002}}, @IEEE802154_ATTR_LLSEC_KEY_MODE={0x5, 0x2b, 0x3}]}, 0x54}, 0x1, 0x0, 0x0, 0x40}, 0x2000c814) clock_getres(0x3, &(0x7f0000000880)) r4 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) sendmsg$IEEE802154_ADD_IFACE(r4, &(0x7f0000000a00)={&(0x7f0000000900)={0x10, 0x0, 0x0, 0x40c}, 0xc, &(0x7f00000009c0)={&(0x7f0000000940)={0x44, 0x0, 0x200, 0x70bd29, 0x25dfdbfe, {}, [@IEEE802154_ATTR_PHY_NAME={0x9, 0x1f, 'phy1\x00'}, @IEEE802154_ATTR_DEV_NAME={0xa, 0x1, 'wpan4\x00'}, @IEEE802154_ATTR_DEV_NAME={0xa, 0x1, 'wpan1\x00'}, @IEEE802154_ATTR_DEV_NAME={0xa, 0x1, 'wpan0\x00'}]}, 0x44}, 0x1, 0x0, 0x0, 0x20000084}, 0x44000) 17:45:32 executing program 3: getsockopt$inet_udp_int(0xffffffffffffffff, 0x11, 0x1, &(0x7f0000000000), &(0x7f0000000040)=0x4) setsockopt$inet_udp_int(0xffffffffffffffff, 0x11, 0x1, &(0x7f0000000080)=0x7, 0x4) ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, &(0x7f0000000240)={0x54, 0x0, &(0x7f00000000c0)=[@acquire_done={0x40106309, 0x1}, @free_buffer, @request_death={0x400c630e, 0x1}, @request_death, @decrefs, @dead_binder_done], 0xc7, 0x0, &(0x7f0000000140)="aa36e0fef6a6cd3a6060f434b2a2306a435d6c33ca3bfb20c9d046886ded10cf23d0938b55b8a812702a5a7579cb8813f0cf3954f24fa081e8c35a9d4674b51115d91e7f6e38920909a8fba27ba7bbb0522974a9d83826c23d40a56c3f88dc24276a8312ae50d15d3531211e4378a34980ea70ac3cefef2439af0baa6b387df4ff26b593ca52e94dda8ce3656a81180693ab97746e30b1301f30922ec565bba820fc06168927e446c06efe1fc7cb37b804ba0342e58e70da81c074407ec9cf690a9ab1e3a62a68"}) r0 = openat$vcsa(0xffffffffffffff9c, &(0x7f0000000280), 0x1, 0x0) r1 = openat$vcsa(0xffffffffffffff9c, &(0x7f00000002c0), 0x80, 0x0) ioctl$SNDRV_SEQ_IOCTL_QUERY_NEXT_PORT(r0, 0xc0a85352, &(0x7f0000000300)={{0x4, 0x6}, 'port0\x00', 0x5, 0x1, 0x0, 0xffff, 0x7, 0x7, 0x5, 0x0, 0x2, 0xc0}) ioctl$SNDRV_SEQ_IOCTL_QUERY_NEXT_CLIENT(r1, 0xc0bc5351, &(0x7f00000003c0)={0xffff7fff, 0x0, 'client0\x00', 0xffffffff80000002, "9aa89fbb0e155330", "7e3a03465d7350a6322e39e7997e8c634c3224eb46d1223d24ed4ce35c7b1dd2", 0x0, 0x6}) openat$nvram(0xffffffffffffff9c, &(0x7f0000000480), 0x1, 0x0) r2 = openat$nvram(0xffffffffffffff9c, &(0x7f0000000700), 0x800, 0x0) write$P9_RGETLOCK(r2, &(0x7f00000007c0)={0x1e, 0x37, 0x2, {0x2, 0x6, 0x101}}, 0x1e) 17:45:32 executing program 2: prctl$PR_MPX_ENABLE_MANAGEMENT(0x2b) r0 = socket$inet(0x2, 0x5, 0x4) r1 = openat$vcsu(0xffffffffffffff9c, &(0x7f0000000000), 0x3c1480, 0x0) ioctl$sock_ipv4_tunnel_SIOCGETTUNNEL(r1, 0x89f0, &(0x7f00000000c0)={'syztnl2\x00', &(0x7f0000000040)={'erspan0\x00', 0x0, 0x700, 0x40, 0x3, 0x22, {{0x15, 0x4, 0x3, 0x17, 0x54, 0x64, 0x0, 0x1, 0x2f, 0x0, @broadcast, @dev={0xac, 0x14, 0x14, 0x36}, {[@cipso={0x86, 0x3d, 0x1, [{0x5, 0x9, "c8a7bec58c2c80"}, {0x0, 0x9, "fabb6c2e64ba82"}, {0x7, 0xf, "6b1b69e07efcb7230cc07a2cf7"}, {0x1, 0x6, "a2118bdb"}, {0x5, 0x10, "67115d3e7766231c7b08cf3c48e4"}]}]}}}}}) prctl$PR_MPX_ENABLE_MANAGEMENT(0x2b) r2 = openat$vcsa(0xffffffffffffff9c, &(0x7f0000000100), 0x202c0, 0x0) ioctl$SNDRV_SEQ_IOCTL_GET_QUEUE_TEMPO(r2, 0xc02c5341, &(0x7f0000000140)) ioctl$SNDRV_TIMER_IOCTL_SELECT(r1, 0x40345410, &(0x7f00000001c0)={{0x0, 0x2, 0x3f, 0x3, 0x80000001}}) ioctl$SNDRV_SEQ_IOCTL_GET_QUEUE_TEMPO(r1, 0xc02c5341, &(0x7f0000000200)) ioctl$sock_inet_tcp_SIOCOUTQ(r0, 0x5411, &(0x7f0000000280)) r3 = syz_open_dev$evdev(&(0x7f00000002c0), 0x1, 0x50000) ioctl$EVIOCGLED(r3, 0x80404519, &(0x7f0000000300)=""/21) seccomp$SECCOMP_GET_NOTIF_SIZES(0x3, 0x0, &(0x7f0000000340)) syz_open_procfs(0x0, &(0x7f0000000500)='schedstat\x00') 17:45:32 executing program 0: get_thread_area(&(0x7f0000000000)={0x7, 0x20000800, 0x4000, 0x0, 0x1, 0x0, 0x0, 0x1, 0x1, 0x1}) r0 = openat$vcsu(0xffffffffffffff9c, &(0x7f0000000040), 0x200000, 0x0) getsockopt$inet_tcp_TCP_REPAIR_WINDOW(r0, 0x6, 0x1d, &(0x7f0000000080), &(0x7f00000000c0)=0x14) r1 = openat$nvram(0xffffffffffffff9c, &(0x7f0000000100), 0x2000, 0x0) setsockopt$inet_tcp_TCP_FASTOPEN_KEY(r1, 0x6, 0x21, &(0x7f0000000140)="1bb9d563048b6ec78effc0f14d974b17", 0x10) setsockopt$inet_tcp_int(r1, 0x6, 0x1b, &(0x7f0000000180)=0x5, 0x4) ioctl$SNDRV_TIMER_IOCTL_STATUS32(r1, 0x80585414, &(0x7f00000001c0)) setsockopt$inet_tcp_TCP_QUEUE_SEQ(r0, 0x6, 0x15, &(0x7f0000000240)=0x1, 0x4) getsockopt$inet_tcp_TCP_ZEROCOPY_RECEIVE(r1, 0x6, 0x23, &(0x7f0000000340)={&(0x7f0000ffc000/0x2000)=nil, 0x2000, 0x0, 0x0, 0x0, &(0x7f0000000280)=""/37, 0x25, 0x1, &(0x7f00000002c0)=""/109, 0x6d}, &(0x7f0000000380)=0x40) r2 = socket$inet_tcp(0x2, 0x1, 0x0) ioctl$sock_inet_tcp_SIOCINQ(r2, 0x541b, &(0x7f00000003c0)) move_pages(0x0, 0x8, &(0x7f0000000400)=[&(0x7f0000ffd000/0x1000)=nil, &(0x7f0000ffd000/0x3000)=nil, &(0x7f0000ffd000/0x3000)=nil, &(0x7f0000ffb000/0x2000)=nil, &(0x7f0000ffc000/0x1000)=nil, &(0x7f0000ffe000/0x2000)=nil, &(0x7f0000ffb000/0x4000)=nil, &(0x7f0000ffd000/0x3000)=nil], &(0x7f0000000440)=[0xfff], &(0x7f0000000480)=[0x0, 0x0, 0x0], 0x4) r3 = syz_genetlink_get_family_id$SEG6(&(0x7f0000000500), r1) sendmsg$SEG6_CMD_DUMPHMAC(0xffffffffffffffff, &(0x7f0000000740)={&(0x7f0000000680)={0x10, 0x0, 0x0, 0x240000}, 0xc, &(0x7f0000000700)={&(0x7f00000006c0)={0x2c, r3, 0x1, 0x70bd2c, 0x25dfdbfe, {}, [@SEG6_ATTR_SECRET={0x8, 0x4, [0x1]}, @SEG6_ATTR_DSTLEN={0x8, 0x2, 0x5}, @SEG6_ATTR_DSTLEN={0x8}]}, 0x2c}, 0x1, 0x0, 0x0, 0x4000000}, 0x4000000) pidfd_getfd(r1, r2, 0x0) syz_genetlink_get_family_id$ieee802154(&(0x7f0000000800), 0xffffffffffffffff) 17:45:32 executing program 7: r0 = perf_event_open(&(0x7f0000000040)={0x4, 0x80, 0x6f, 0x8, 0x8, 0x1, 0x0, 0x6, 0x4, 0x1, 0x1, 0x0, 0x0, 0x1, 0x1, 0x1, 0x0, 0x0, 0x1, 0x0, 0x0, 0x1, 0x1, 0x0, 0x0, 0x2, 0x1, 0x0, 0x0, 0x1, 0x0, 0x0, 0x1, 0x0, 0x1, 0x0, 0x0, 0x0, 0x1, 0x1, 0x1, 0x0, 0x1, 0x1, 0x1, 0x0, 0x1, 0x0, 0x50, 0x2, @perf_bp={&(0x7f0000000000), 0xa}, 0x2100, 0x7, 0x1, 0x3, 0x6, 0x93d3, 0x0, 0x0, 0x3a, 0x0, 0x9}, 0xffffffffffffffff, 0xc, 0xffffffffffffffff, 0x8) mmap$perf(&(0x7f0000ffb000/0x2000)=nil, 0x2000, 0xb, 0x11, r0, 0x8) munmap(&(0x7f0000ffb000/0x3000)=nil, 0x3000) getsockopt$inet6_tcp_TCP_ZEROCOPY_RECEIVE(0xffffffffffffffff, 0x6, 0x23, &(0x7f0000001180)={&(0x7f0000ffd000/0x2000)=nil, 0x2000, 0x0, 0x0, 0x0, &(0x7f00000000c0)=""/162, 0xa2, 0x0, &(0x7f0000000180)=""/4096, 0x1000}, &(0x7f00000011c0)=0x40) openat$vcsa(0xffffffffffffff9c, &(0x7f0000001200), 0x14d080, 0x0) shmget(0x0, 0x1000, 0x200, &(0x7f0000ffd000/0x1000)=nil) 17:45:32 executing program 1: shmget$private(0x0, 0x4000, 0x80, &(0x7f0000ffb000/0x4000)=nil) shmget(0x3, 0x2000, 0x4, &(0x7f0000ffc000/0x2000)=nil) mlock(&(0x7f0000ff0000/0x10000)=nil, 0x10000) shmget(0x1, 0x1000, 0x10, &(0x7f0000ff5000/0x1000)=nil) ioctl$sock_ipv4_tunnel_SIOCGETTUNNEL(0xffffffffffffffff, 0x89f0, &(0x7f0000000140)={'syztnl1\x00', &(0x7f00000000c0)={'syztnl2\x00', 0x0, 0x20, 0x1, 0x6, 0x9, {{0xd, 0x4, 0x1, 0x19, 0x34, 0x68, 0x0, 0x9, 0x29, 0x0, @empty, @dev={0xac, 0x14, 0x14, 0x29}, {[@timestamp_addr={0x44, 0x14, 0xc2, 0x1, 0x4, [{@multicast1}, {@private=0xa010101}]}, @rr={0x7, 0xb, 0xc8, [@initdev={0xac, 0x1e, 0x1, 0x0}, @private=0xa010102]}]}}}}}) ioctl$sock_ipv4_tunnel_SIOCADDTUNNEL(0xffffffffffffffff, 0x89f1, &(0x7f0000000280)={'tunl0\x00', &(0x7f0000000180)={'tunl0\x00', r0, 0x7, 0x8000, 0xfffffffc, 0x8, {{0x2f, 0x4, 0x0, 0x2, 0xbc, 0x65, 0x0, 0x0, 0x4, 0x0, @empty, @broadcast, {[@generic={0x89, 0x9, "8db1d464c6af68"}, @noop, @ra={0x94, 0x4, 0x1}, @timestamp={0x44, 0x1c, 0x53, 0x0, 0x7, [0x40, 0x7fffffff, 0xfffffffd, 0x5, 0x5c, 0x77]}, @cipso={0x86, 0x2f, 0x3, [{0x1, 0x4, "1eba"}, {0x1, 0x7, "e3ccb5ddcf"}, {0x6, 0xa, "5db18b961780af33"}, {0x2, 0xe, "7353a9824b57fd7d39232ac5"}, {0x1, 0x6, "2e1ccd27"}]}, @noop, @cipso={0x86, 0x37, 0xffffffffffffffff, [{0x2, 0xf, "227467028cabd4e137b820c5c9"}, {0x7, 0x6, "90569992"}, {0x2, 0xc, "2071b0a8c9ce92782e72"}, {0x6, 0xa, "14f2b9bca55ce3dd"}, {0x6, 0x6, "2cd22a8f"}]}, @timestamp={0x44, 0x14, 0xd4, 0x0, 0x5, [0x81, 0x5d23, 0x63ab, 0x1]}]}}}}}) ioctl$sock_ipv4_tunnel_SIOCDELTUNNEL(0xffffffffffffffff, 0x89f2, &(0x7f0000000380)={'gretap0\x00', &(0x7f00000002c0)={'syztnl2\x00', 0x0, 0x7800, 0x7, 0x40, 0xe180, {{0x22, 0x4, 0x0, 0x1, 0x88, 0x64, 0x0, 0x1, 0x29, 0x0, @multicast2, @multicast1, {[@end, @lsrr={0x83, 0x1f, 0x2f, [@multicast2, @local, @local, @multicast1, @rand_addr=0x64010102, @loopback, @private=0xa010100]}, @rr={0x7, 0x27, 0x6c, [@multicast1, @rand_addr=0x64010102, @remote, @multicast1, @loopback, @initdev={0xac, 0x1e, 0x0, 0x0}, @initdev={0xac, 0x1e, 0x1, 0x0}, @broadcast, @empty]}, @ra={0x94, 0x4, 0x1}, @timestamp={0x44, 0x10, 0x2d, 0x0, 0x8, [0x1, 0x100, 0x401]}, @ssrr={0x89, 0x13, 0x56, [@dev={0xac, 0x14, 0x14, 0x28}, @multicast2, @initdev={0xac, 0x1e, 0x0, 0x0}, @remote]}, @ra={0x94, 0x4, 0x1}]}}}}}) shmget(0x3, 0x4000, 0x4, &(0x7f0000ff9000/0x4000)=nil) mmap$IORING_OFF_CQ_RING(&(0x7f0000ffd000/0x3000)=nil, 0x3000, 0x2000008, 0x30, 0xffffffffffffffff, 0x8000000) r1 = syz_genetlink_get_family_id$nl802154(&(0x7f0000000400), 0xffffffffffffffff) ioctl$sock_SIOCGIFINDEX_802154(0xffffffffffffffff, 0x8933, &(0x7f0000000440)={'wpan1\x00', 0x0}) sendmsg$NL802154_CMD_NEW_INTERFACE(0xffffffffffffffff, &(0x7f0000000540)={&(0x7f00000003c0)={0x10, 0x0, 0x0, 0x2}, 0xc, &(0x7f0000000500)={&(0x7f0000000480)={0x48, r1, 0x200, 0x70bd2a, 0x25dfdbfd, {}, [@NL802154_ATTR_IFNAME={0xa, 0x4, 'wpan0\x00'}, @NL802154_ATTR_IFINDEX={0x8}, @NL802154_ATTR_IFNAME={0xa, 0x4, 'wpan1\x00'}, @NL802154_ATTR_EXTENDED_ADDR={0xc, 0x17, {0xaaaaaaaaaaaa0002}}, @NL802154_ATTR_IFINDEX={0x8, 0x3, r2}]}, 0x48}}, 0x4001) mmap$binder(&(0x7f0000fef000/0x11000)=nil, 0x11000, 0x1, 0x11, 0xffffffffffffffff, 0x6) shmget$private(0x0, 0x4000, 0x200, &(0x7f0000ffc000/0x4000)=nil) r3 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) sendmsg$IEEE802154_LLSEC_ADD_SECLEVEL(r3, &(0x7f00000006c0)={&(0x7f0000000580)={0x10, 0x0, 0x0, 0x4000000}, 0xc, &(0x7f0000000680)={&(0x7f0000000600)={0x44, 0x0, 0x200, 0x70bd2a, 0x25dfdbff, {}, [@IEEE802154_ATTR_LLSEC_FRAME_TYPE={0x5, 0x33, 0x34}, @IEEE802154_ATTR_DEV_INDEX={0x8}, @IEEE802154_ATTR_LLSEC_CMD_FRAME_ID={0x5, 0x34, 0x1}, @IEEE802154_ATTR_DEV_NAME={0xa, 0x1, 'wpan0\x00'}, @IEEE802154_ATTR_DEV_NAME={0xa, 0x1, 'wpan4\x00'}]}, 0x44}, 0x1, 0x0, 0x0, 0x8800}, 0x0) sendmsg$IEEE802154_START_REQ(r3, &(0x7f00000007c0)={&(0x7f0000000700)={0x10, 0x0, 0x0, 0x4}, 0xc, &(0x7f0000000780)={&(0x7f0000000740)={0x1c, 0x0, 0x200, 0x70bd2d, 0x25dfdbfb, {}, [@IEEE802154_ATTR_CHANNEL={0x5, 0x7, 0x6}]}, 0x1c}, 0x1, 0x0, 0x0, 0x40100}, 0x801) mlock(&(0x7f0000fef000/0x1000)=nil, 0x1000) syz_io_uring_setup(0x4726, &(0x7f0000000840)={0x0, 0x502f, 0x20, 0x0, 0x12e}, &(0x7f0000ffe000/0x2000)=nil, &(0x7f0000ffb000/0x4000)=nil, &(0x7f00000008c0), &(0x7f0000000900)) 17:45:32 executing program 5: clock_gettime(0x5, &(0x7f0000000000)) clock_settime(0x2, &(0x7f0000000040)) sched_rr_get_interval(0xffffffffffffffff, &(0x7f0000000080)) sched_rr_get_interval(0x0, &(0x7f00000000c0)) sendmsg$NL802154_CMD_GET_SEC_KEY(0xffffffffffffffff, &(0x7f00000001c0)={&(0x7f0000000100)={0x10, 0x0, 0x0, 0x20000000}, 0xc, &(0x7f0000000180)={&(0x7f0000000140)={0x24, 0x0, 0x200, 0x70bd26, 0x25dfdbfe, {}, [@NL802154_ATTR_IFINDEX={0x8}, @NL802154_ATTR_IFINDEX={0x8}]}, 0x24}, 0x1, 0x0, 0x0, 0x4000000}, 0x181) clock_gettime(0x0, &(0x7f0000000200)) pipe2$9p(&(0x7f0000000240)={0xffffffffffffffff, 0xffffffffffffffff}, 0x800) r1 = syz_io_uring_setup(0x776a, &(0x7f0000000280)={0x0, 0x2728, 0x2, 0x1, 0x37c}, &(0x7f0000000000/0x3000)=nil, &(0x7f0000000000/0x400000)=nil, &(0x7f0000000300), &(0x7f0000000340)) ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, &(0x7f0000000540)={0x64, 0x0, &(0x7f0000000440)=[@transaction_sg={0x40486311, {0x1, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x50, 0x18, &(0x7f0000000380)={@fd={0x66642a85, 0x0, r0}, @fd={0x66642a85, 0x0, r1}, @fda={0x66646185, 0x0, 0x2, 0x36}}, &(0x7f0000000400)={0x0, 0x18, 0x30}}}, @request_death, @release={0x40046306, 0x1}], 0x7e, 0x0, &(0x7f00000004c0)="7685c519d1cbea63a1a8f022f8c0085baf770aa5d1fa9bfb1a5399fdb134953d619e962218bba650b68d6206fde39ff17760aa4bbcb62f6802c48e17294a17a3b768ab60bbae37aa37e33e24b09f6bdea37853f7ab2622451803788c9d172b7d71d6d87911129b8ef5cc9e0169404b09abfa991f3a7a3640686df445d387"}) pipe2$9p(&(0x7f0000000580), 0x800) ioctl$EVIOCGVERSION(0xffffffffffffffff, 0x80044501, &(0x7f00000005c0)=""/174) r2 = openat$nvram(0xffffffffffffff9c, &(0x7f0000000680), 0x400, 0x0) write$P9_RSTAT(r2, &(0x7f00000006c0)={0x3f, 0x7d, 0x1, {0x0, 0x38, 0x401, 0x8000, {0x80, 0x4, 0x1}, 0x2020000, 0x4, 0x60, 0x9, 0x1, '\x00', 0x2, '.-', 0x1, '\x00', 0x1, '\x00'}}, 0x3f) r3 = syz_genetlink_get_family_id$ieee802154(&(0x7f0000000740), 0xffffffffffffffff) sendmsg$IEEE802154_LLSEC_DEL_KEY(0xffffffffffffffff, &(0x7f0000000840)={&(0x7f0000000700)={0x10, 0x0, 0x0, 0x800000}, 0xc, &(0x7f0000000800)={&(0x7f0000000780)={0x54, r3, 0x800, 0x70bd27, 0x25dfdbfc, {}, [@IEEE802154_ATTR_LLSEC_KEY_SOURCE_SHORT={0x8, 0x2c, 0x5}, @IEEE802154_ATTR_LLSEC_KEY_SOURCE_EXTENDED={0xc, 0x2d, {0xaaaaaaaaaaaa0002}}, @IEEE802154_ATTR_PAN_ID={0x6, 0x6, 0x2}, @IEEE802154_ATTR_DEV_INDEX={0x8}, @IEEE802154_ATTR_LLSEC_KEY_MODE={0x5, 0x2b, 0x1}, @IEEE802154_ATTR_HW_ADDR={0xc, 0x5, {0xaaaaaaaaaaaa0002}}, @IEEE802154_ATTR_LLSEC_KEY_MODE={0x5, 0x2b, 0x3}]}, 0x54}, 0x1, 0x0, 0x0, 0x40}, 0x2000c814) clock_getres(0x3, &(0x7f0000000880)) r4 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) sendmsg$IEEE802154_ADD_IFACE(r4, &(0x7f0000000a00)={&(0x7f0000000900)={0x10, 0x0, 0x0, 0x40c}, 0xc, &(0x7f00000009c0)={&(0x7f0000000940)={0x44, r3, 0x200, 0x70bd29, 0x25dfdbfe, {}, [@IEEE802154_ATTR_PHY_NAME={0x9, 0x1f, 'phy1\x00'}, @IEEE802154_ATTR_DEV_NAME={0xa, 0x1, 'wpan4\x00'}, @IEEE802154_ATTR_DEV_NAME={0xa, 0x1, 'wpan1\x00'}, @IEEE802154_ATTR_DEV_NAME={0xa, 0x1, 'wpan0\x00'}]}, 0x44}, 0x1, 0x0, 0x0, 0x20000084}, 0x44000) 17:45:32 executing program 4: r0 = perf_event_open(&(0x7f00000000c0)={0x1, 0x80, 0x0, 0xc0, 0xfa, 0x1, 0x0, 0x7fffffff, 0x10811, 0x1, 0x1, 0x1, 0x1, 0x1, 0x1, 0x1, 0x1, 0x1, 0x0, 0x1, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x1, 0x0, 0x1, 0x0, 0x0, 0x0, 0x1, 0x1, 0x1, 0x1, 0x1, 0x1, 0x1, 0x0, 0x1, 0x1, 0x1, 0x1, 0x0, 0x0, 0xfff, 0x7, @perf_config_ext={0x7, 0x7fffffff}, 0x41000, 0x80000000, 0x5, 0x3, 0x9, 0x2, 0x9, 0x0, 0x5, 0x0, 0x4}, 0x0, 0xb, 0xffffffffffffffff, 0x1) perf_event_open(&(0x7f0000000040)={0x0, 0x80, 0x0, 0x40, 0x80, 0x9, 0x0, 0x3, 0x10040, 0x1, 0x0, 0x0, 0x1, 0x1, 0x1, 0x1, 0x1, 0x1, 0x1, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x3, 0x1, 0x0, 0x1, 0x0, 0x1, 0x1, 0x0, 0x0, 0x1, 0x1, 0x1, 0x0, 0x1, 0x0, 0x0, 0x0, 0x1, 0x0, 0x1, 0x0, 0x1, 0x0, 0x0, 0x1, @perf_bp={&(0x7f0000000000), 0x10}, 0x8080, 0x800, 0x2, 0x3, 0x36dc, 0x31df3b33, 0xff, 0x0, 0x9, 0x0, 0x5}, 0xffffffffffffffff, 0x9, r0, 0x9) ioctl$PERF_EVENT_IOC_PAUSE_OUTPUT(r0, 0x40042409, 0x0) ioctl$PERF_EVENT_IOC_PERIOD(0xffffffffffffffff, 0x40082404, &(0x7f0000000140)=0x8) r1 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl$sock_ipv4_tunnel_SIOCADDTUNNEL(r1, 0x89f1, &(0x7f00000001c0)={'syztnl1\x00', &(0x7f0000000180)={'syztnl0\x00', 0x0, 0x1, 0x40, 0x0, 0x5, {{0x5, 0x4, 0x2, 0x19, 0x14, 0x65, 0x0, 0x1f, 0x4, 0x0, @multicast2, @remote}}}}) ioctl$PERF_EVENT_IOC_PERIOD(r0, 0x40082404, &(0x7f0000000200)=0x9) ioctl$SNDRV_SEQ_IOCTL_GET_PORT_INFO(0xffffffffffffffff, 0xc0a85322, &(0x7f0000000240)) ioctl$SNDRV_SEQ_IOCTL_SYSTEM_INFO(0xffffffffffffffff, 0xc0305302, &(0x7f0000000300)={0x9, 0x101, 0x1, 0x6, 0x3, 0x5}) r2 = syz_open_procfs(0x0, &(0x7f0000000340)='children\x00') openat$cgroup_type(r2, &(0x7f0000000380), 0x2, 0x0) ioctl$EVIOCGABS20(r2, 0x80184560, &(0x7f00000003c0)=""/4096) socket$inet6_tcp(0xa, 0x1, 0x0) write$cgroup_type(0xffffffffffffffff, &(0x7f0000001500), 0x9) 17:45:32 executing program 6: r0 = perf_event_open(&(0x7f00000000c0)={0x1, 0x80, 0x0, 0xc0, 0xfa, 0x1, 0x0, 0x7fffffff, 0x10811, 0x1, 0x1, 0x1, 0x1, 0x1, 0x1, 0x1, 0x1, 0x1, 0x0, 0x1, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x1, 0x0, 0x1, 0x0, 0x0, 0x0, 0x1, 0x1, 0x1, 0x1, 0x1, 0x1, 0x1, 0x0, 0x1, 0x1, 0x1, 0x1, 0x0, 0x0, 0xfff, 0x7, @perf_config_ext={0x7, 0x7fffffff}, 0x41000, 0x80000000, 0x5, 0x3, 0x9, 0x2, 0x9, 0x0, 0x5, 0x0, 0x4}, 0x0, 0xb, 0xffffffffffffffff, 0x1) perf_event_open(&(0x7f0000000040)={0x0, 0x80, 0x0, 0x40, 0x80, 0x9, 0x0, 0x3, 0x10040, 0x1, 0x0, 0x0, 0x1, 0x1, 0x1, 0x1, 0x1, 0x1, 0x1, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x3, 0x1, 0x0, 0x1, 0x0, 0x1, 0x1, 0x0, 0x0, 0x1, 0x1, 0x1, 0x0, 0x1, 0x0, 0x0, 0x0, 0x1, 0x0, 0x1, 0x0, 0x1, 0x0, 0x0, 0x1, @perf_bp={&(0x7f0000000000), 0x10}, 0x8080, 0x800, 0x2, 0x3, 0x36dc, 0x31df3b33, 0xff, 0x0, 0x9, 0x0, 0x5}, 0xffffffffffffffff, 0x9, r0, 0x9) ioctl$PERF_EVENT_IOC_PAUSE_OUTPUT(r0, 0x40042409, 0x0) ioctl$PERF_EVENT_IOC_PERIOD(0xffffffffffffffff, 0x40082404, &(0x7f0000000140)=0x8) r1 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl$sock_ipv4_tunnel_SIOCADDTUNNEL(r1, 0x89f1, &(0x7f00000001c0)={'syztnl1\x00', &(0x7f0000000180)={'syztnl0\x00', 0x0, 0x1, 0x40, 0x0, 0x5, {{0x5, 0x4, 0x2, 0x19, 0x14, 0x65, 0x0, 0x1f, 0x4, 0x0, @multicast2, @remote}}}}) ioctl$PERF_EVENT_IOC_PERIOD(r0, 0x40082404, &(0x7f0000000200)=0x9) ioctl$SNDRV_SEQ_IOCTL_GET_PORT_INFO(0xffffffffffffffff, 0xc0a85322, &(0x7f0000000240)) ioctl$SNDRV_SEQ_IOCTL_SYSTEM_INFO(0xffffffffffffffff, 0xc0305302, &(0x7f0000000300)={0x9, 0x101, 0x1, 0x6, 0x3, 0x5}) r2 = syz_open_procfs(0x0, &(0x7f0000000340)='children\x00') openat$cgroup_type(r2, &(0x7f0000000380), 0x2, 0x0) write$cgroup_type(0xffffffffffffffff, &(0x7f0000001500), 0x9) 17:45:32 executing program 1: shmget$private(0x0, 0x4000, 0x80, &(0x7f0000ffb000/0x4000)=nil) shmget(0x3, 0x2000, 0x4, &(0x7f0000ffc000/0x2000)=nil) mlock(&(0x7f0000ff0000/0x10000)=nil, 0x10000) shmget(0x1, 0x1000, 0x10, &(0x7f0000ff5000/0x1000)=nil) ioctl$sock_ipv4_tunnel_SIOCGETTUNNEL(0xffffffffffffffff, 0x89f0, &(0x7f0000000140)={'syztnl1\x00', &(0x7f00000000c0)={'syztnl2\x00', 0x0, 0x20, 0x1, 0x6, 0x9, {{0xd, 0x4, 0x1, 0x19, 0x34, 0x68, 0x0, 0x9, 0x29, 0x0, @empty, @dev={0xac, 0x14, 0x14, 0x29}, {[@timestamp_addr={0x44, 0x14, 0xc2, 0x1, 0x4, [{@multicast1}, {@private=0xa010101}]}, @rr={0x7, 0xb, 0xc8, [@initdev={0xac, 0x1e, 0x1, 0x0}, @private=0xa010102]}]}}}}}) ioctl$sock_ipv4_tunnel_SIOCADDTUNNEL(0xffffffffffffffff, 0x89f1, &(0x7f0000000280)={'tunl0\x00', &(0x7f0000000180)={'tunl0\x00', r0, 0x7, 0x8000, 0xfffffffc, 0x8, {{0x2f, 0x4, 0x0, 0x2, 0xbc, 0x65, 0x0, 0x0, 0x4, 0x0, @empty, @broadcast, {[@generic={0x89, 0x9, "8db1d464c6af68"}, @noop, @ra={0x94, 0x4, 0x1}, @timestamp={0x44, 0x1c, 0x53, 0x0, 0x7, [0x40, 0x7fffffff, 0xfffffffd, 0x5, 0x5c, 0x77]}, @cipso={0x86, 0x2f, 0x3, [{0x1, 0x4, "1eba"}, {0x1, 0x7, "e3ccb5ddcf"}, {0x6, 0xa, "5db18b961780af33"}, {0x2, 0xe, "7353a9824b57fd7d39232ac5"}, {0x1, 0x6, "2e1ccd27"}]}, @noop, @cipso={0x86, 0x37, 0xffffffffffffffff, [{0x2, 0xf, "227467028cabd4e137b820c5c9"}, {0x7, 0x6, "90569992"}, {0x2, 0xc, "2071b0a8c9ce92782e72"}, {0x6, 0xa, "14f2b9bca55ce3dd"}, {0x6, 0x6, "2cd22a8f"}]}, @timestamp={0x44, 0x14, 0xd4, 0x0, 0x5, [0x81, 0x5d23, 0x63ab, 0x1]}]}}}}}) ioctl$sock_ipv4_tunnel_SIOCDELTUNNEL(0xffffffffffffffff, 0x89f2, &(0x7f0000000380)={'gretap0\x00', &(0x7f00000002c0)={'syztnl2\x00', 0x0, 0x7800, 0x7, 0x40, 0xe180, {{0x22, 0x4, 0x0, 0x1, 0x88, 0x64, 0x0, 0x1, 0x29, 0x0, @multicast2, @multicast1, {[@end, @lsrr={0x83, 0x1f, 0x2f, [@multicast2, @local, @local, @multicast1, @rand_addr=0x64010102, @loopback, @private=0xa010100]}, @rr={0x7, 0x27, 0x6c, [@multicast1, @rand_addr=0x64010102, @remote, @multicast1, @loopback, @initdev={0xac, 0x1e, 0x0, 0x0}, @initdev={0xac, 0x1e, 0x1, 0x0}, @broadcast, @empty]}, @ra={0x94, 0x4, 0x1}, @timestamp={0x44, 0x10, 0x2d, 0x0, 0x8, [0x1, 0x100, 0x401]}, @ssrr={0x89, 0x13, 0x56, [@dev={0xac, 0x14, 0x14, 0x28}, @multicast2, @initdev={0xac, 0x1e, 0x0, 0x0}, @remote]}, @ra={0x94, 0x4, 0x1}]}}}}}) shmget(0x3, 0x4000, 0x4, &(0x7f0000ff9000/0x4000)=nil) mmap$IORING_OFF_CQ_RING(&(0x7f0000ffd000/0x3000)=nil, 0x3000, 0x2000008, 0x30, 0xffffffffffffffff, 0x8000000) r1 = syz_genetlink_get_family_id$nl802154(&(0x7f0000000400), 0xffffffffffffffff) ioctl$sock_SIOCGIFINDEX_802154(0xffffffffffffffff, 0x8933, &(0x7f0000000440)={'wpan1\x00', 0x0}) sendmsg$NL802154_CMD_NEW_INTERFACE(0xffffffffffffffff, &(0x7f0000000540)={&(0x7f00000003c0)={0x10, 0x0, 0x0, 0x2}, 0xc, &(0x7f0000000500)={&(0x7f0000000480)={0x48, r1, 0x200, 0x70bd2a, 0x25dfdbfd, {}, [@NL802154_ATTR_IFNAME={0xa, 0x4, 'wpan0\x00'}, @NL802154_ATTR_IFINDEX={0x8}, @NL802154_ATTR_IFNAME={0xa, 0x4, 'wpan1\x00'}, @NL802154_ATTR_EXTENDED_ADDR={0xc, 0x17, {0xaaaaaaaaaaaa0002}}, @NL802154_ATTR_IFINDEX={0x8, 0x3, r2}]}, 0x48}}, 0x4001) mmap$binder(&(0x7f0000fef000/0x11000)=nil, 0x11000, 0x1, 0x11, 0xffffffffffffffff, 0x6) shmget$private(0x0, 0x4000, 0x200, &(0x7f0000ffc000/0x4000)=nil) sendmsg$IEEE802154_LLSEC_ADD_SECLEVEL(0xffffffffffffffff, &(0x7f00000006c0)={&(0x7f0000000580)={0x10, 0x0, 0x0, 0x4000000}, 0xc, &(0x7f0000000680)={&(0x7f0000000600)={0x44, 0x0, 0x200, 0x70bd2a, 0x25dfdbff, {}, [@IEEE802154_ATTR_LLSEC_FRAME_TYPE={0x5, 0x33, 0x34}, @IEEE802154_ATTR_DEV_INDEX={0x8}, @IEEE802154_ATTR_LLSEC_CMD_FRAME_ID={0x5, 0x34, 0x1}, @IEEE802154_ATTR_DEV_NAME={0xa, 0x1, 'wpan0\x00'}, @IEEE802154_ATTR_DEV_NAME={0xa, 0x1, 'wpan4\x00'}]}, 0x44}, 0x1, 0x0, 0x0, 0x8800}, 0x0) sendmsg$IEEE802154_START_REQ(0xffffffffffffffff, &(0x7f00000007c0)={&(0x7f0000000700)={0x10, 0x0, 0x0, 0x4}, 0xc, &(0x7f0000000780)={&(0x7f0000000740)={0x1c, 0x0, 0x200, 0x70bd2d, 0x25dfdbfb, {}, [@IEEE802154_ATTR_CHANNEL={0x5, 0x7, 0x6}]}, 0x1c}, 0x1, 0x0, 0x0, 0x40100}, 0x801) mlock(&(0x7f0000fef000/0x1000)=nil, 0x1000) syz_io_uring_setup(0x4726, &(0x7f0000000840)={0x0, 0x502f, 0x20, 0x0, 0x12e}, &(0x7f0000ffe000/0x2000)=nil, &(0x7f0000ffb000/0x4000)=nil, &(0x7f00000008c0), &(0x7f0000000900)) 17:45:32 executing program 5: clock_gettime(0x5, &(0x7f0000000000)) clock_settime(0x2, &(0x7f0000000040)) sched_rr_get_interval(0xffffffffffffffff, &(0x7f0000000080)) sched_rr_get_interval(0x0, &(0x7f00000000c0)) sendmsg$NL802154_CMD_GET_SEC_KEY(0xffffffffffffffff, &(0x7f00000001c0)={&(0x7f0000000100)={0x10, 0x0, 0x0, 0x20000000}, 0xc, &(0x7f0000000180)={&(0x7f0000000140)={0x24, 0x0, 0x200, 0x70bd26, 0x25dfdbfe, {}, [@NL802154_ATTR_IFINDEX={0x8}, @NL802154_ATTR_IFINDEX={0x8}]}, 0x24}, 0x1, 0x0, 0x0, 0x4000000}, 0x181) clock_gettime(0x0, &(0x7f0000000200)) pipe2$9p(&(0x7f0000000240)={0xffffffffffffffff, 0xffffffffffffffff}, 0x800) r1 = syz_io_uring_setup(0x776a, &(0x7f0000000280)={0x0, 0x2728, 0x2, 0x1, 0x37c}, &(0x7f0000000000/0x3000)=nil, &(0x7f0000000000/0x400000)=nil, &(0x7f0000000300), &(0x7f0000000340)) ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, &(0x7f0000000540)={0x64, 0x0, &(0x7f0000000440)=[@transaction_sg={0x40486311, {0x1, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x50, 0x18, &(0x7f0000000380)={@fd={0x66642a85, 0x0, r0}, @fd={0x66642a85, 0x0, r1}, @fda={0x66646185, 0x0, 0x2, 0x36}}, &(0x7f0000000400)={0x0, 0x18, 0x30}}}, @request_death, @release={0x40046306, 0x1}], 0x7e, 0x0, &(0x7f00000004c0)="7685c519d1cbea63a1a8f022f8c0085baf770aa5d1fa9bfb1a5399fdb134953d619e962218bba650b68d6206fde39ff17760aa4bbcb62f6802c48e17294a17a3b768ab60bbae37aa37e33e24b09f6bdea37853f7ab2622451803788c9d172b7d71d6d87911129b8ef5cc9e0169404b09abfa991f3a7a3640686df445d387"}) pipe2$9p(&(0x7f0000000580), 0x800) ioctl$EVIOCGVERSION(0xffffffffffffffff, 0x80044501, &(0x7f00000005c0)=""/174) r2 = openat$nvram(0xffffffffffffff9c, &(0x7f0000000680), 0x400, 0x0) write$P9_RSTAT(r2, &(0x7f00000006c0)={0x3f, 0x7d, 0x1, {0x0, 0x38, 0x401, 0x8000, {0x80, 0x4, 0x1}, 0x2020000, 0x4, 0x60, 0x9, 0x1, '\x00', 0x2, '.-', 0x1, '\x00', 0x1, '\x00'}}, 0x3f) r3 = syz_genetlink_get_family_id$ieee802154(&(0x7f0000000740), 0xffffffffffffffff) sendmsg$IEEE802154_LLSEC_DEL_KEY(0xffffffffffffffff, &(0x7f0000000840)={&(0x7f0000000700)={0x10, 0x0, 0x0, 0x800000}, 0xc, &(0x7f0000000800)={&(0x7f0000000780)={0x54, r3, 0x800, 0x70bd27, 0x25dfdbfc, {}, [@IEEE802154_ATTR_LLSEC_KEY_SOURCE_SHORT={0x8, 0x2c, 0x5}, @IEEE802154_ATTR_LLSEC_KEY_SOURCE_EXTENDED={0xc, 0x2d, {0xaaaaaaaaaaaa0002}}, @IEEE802154_ATTR_PAN_ID={0x6, 0x6, 0x2}, @IEEE802154_ATTR_DEV_INDEX={0x8}, @IEEE802154_ATTR_LLSEC_KEY_MODE={0x5, 0x2b, 0x1}, @IEEE802154_ATTR_HW_ADDR={0xc, 0x5, {0xaaaaaaaaaaaa0002}}, @IEEE802154_ATTR_LLSEC_KEY_MODE={0x5, 0x2b, 0x3}]}, 0x54}, 0x1, 0x0, 0x0, 0x40}, 0x2000c814) clock_getres(0x3, &(0x7f0000000880)) r4 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) sendmsg$IEEE802154_ADD_IFACE(r4, &(0x7f0000000a00)={&(0x7f0000000900)={0x10, 0x0, 0x0, 0x40c}, 0xc, &(0x7f00000009c0)={&(0x7f0000000940)={0x44, r3, 0x200, 0x70bd29, 0x25dfdbfe, {}, [@IEEE802154_ATTR_PHY_NAME={0x9, 0x1f, 'phy1\x00'}, @IEEE802154_ATTR_DEV_NAME={0xa, 0x1, 'wpan4\x00'}, @IEEE802154_ATTR_DEV_NAME={0xa, 0x1, 'wpan1\x00'}, @IEEE802154_ATTR_DEV_NAME={0xa, 0x1, 'wpan0\x00'}]}, 0x44}, 0x1, 0x0, 0x0, 0x20000084}, 0x44000) 17:45:32 executing program 3: getsockopt$inet_udp_int(0xffffffffffffffff, 0x11, 0x1, &(0x7f0000000000), &(0x7f0000000040)=0x4) setsockopt$inet_udp_int(0xffffffffffffffff, 0x11, 0x1, &(0x7f0000000080)=0x7, 0x4) ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, &(0x7f0000000240)={0x54, 0x0, &(0x7f00000000c0)=[@acquire_done={0x40106309, 0x1}, @free_buffer, @request_death={0x400c630e, 0x1}, @request_death, @decrefs, @dead_binder_done], 0xc7, 0x0, &(0x7f0000000140)="aa36e0fef6a6cd3a6060f434b2a2306a435d6c33ca3bfb20c9d046886ded10cf23d0938b55b8a812702a5a7579cb8813f0cf3954f24fa081e8c35a9d4674b51115d91e7f6e38920909a8fba27ba7bbb0522974a9d83826c23d40a56c3f88dc24276a8312ae50d15d3531211e4378a34980ea70ac3cefef2439af0baa6b387df4ff26b593ca52e94dda8ce3656a81180693ab97746e30b1301f30922ec565bba820fc06168927e446c06efe1fc7cb37b804ba0342e58e70da81c074407ec9cf690a9ab1e3a62a68"}) r0 = openat$vcsa(0xffffffffffffff9c, &(0x7f0000000280), 0x1, 0x0) r1 = openat$vcsa(0xffffffffffffff9c, &(0x7f00000002c0), 0x80, 0x0) ioctl$SNDRV_SEQ_IOCTL_QUERY_NEXT_PORT(r0, 0xc0a85352, &(0x7f0000000300)={{0x4, 0x6}, 'port0\x00', 0x5, 0x1, 0x0, 0xffff, 0x7, 0x7, 0x5, 0x0, 0x2, 0xc0}) ioctl$SNDRV_SEQ_IOCTL_QUERY_NEXT_CLIENT(r1, 0xc0bc5351, &(0x7f00000003c0)={0xffff7fff, 0x0, 'client0\x00', 0xffffffff80000002, "9aa89fbb0e155330", "7e3a03465d7350a6322e39e7997e8c634c3224eb46d1223d24ed4ce35c7b1dd2", 0x0, 0x6}) r2 = openat$nvram(0xffffffffffffff9c, &(0x7f0000000700), 0x800, 0x0) write$P9_RGETLOCK(r2, &(0x7f00000007c0)={0x1e, 0x37, 0x2, {0x2, 0x6, 0x101}}, 0x1e) 17:45:32 executing program 1: shmget$private(0x0, 0x4000, 0x80, &(0x7f0000ffb000/0x4000)=nil) shmget(0x3, 0x2000, 0x4, &(0x7f0000ffc000/0x2000)=nil) mlock(&(0x7f0000ff0000/0x10000)=nil, 0x10000) shmget(0x1, 0x1000, 0x10, &(0x7f0000ff5000/0x1000)=nil) ioctl$sock_ipv4_tunnel_SIOCGETTUNNEL(0xffffffffffffffff, 0x89f0, &(0x7f0000000140)={'syztnl1\x00', &(0x7f00000000c0)={'syztnl2\x00', 0x0, 0x20, 0x1, 0x6, 0x9, {{0xd, 0x4, 0x1, 0x19, 0x34, 0x68, 0x0, 0x9, 0x29, 0x0, @empty, @dev={0xac, 0x14, 0x14, 0x29}, {[@timestamp_addr={0x44, 0x14, 0xc2, 0x1, 0x4, [{@multicast1}, {@private=0xa010101}]}, @rr={0x7, 0xb, 0xc8, [@initdev={0xac, 0x1e, 0x1, 0x0}, @private=0xa010102]}]}}}}}) ioctl$sock_ipv4_tunnel_SIOCADDTUNNEL(0xffffffffffffffff, 0x89f1, &(0x7f0000000280)={'tunl0\x00', &(0x7f0000000180)={'tunl0\x00', r0, 0x7, 0x8000, 0xfffffffc, 0x8, {{0x2f, 0x4, 0x0, 0x2, 0xbc, 0x65, 0x0, 0x0, 0x4, 0x0, @empty, @broadcast, {[@generic={0x89, 0x9, "8db1d464c6af68"}, @noop, @ra={0x94, 0x4, 0x1}, @timestamp={0x44, 0x1c, 0x53, 0x0, 0x7, [0x40, 0x7fffffff, 0xfffffffd, 0x5, 0x5c, 0x77]}, @cipso={0x86, 0x2f, 0x3, [{0x1, 0x4, "1eba"}, {0x1, 0x7, "e3ccb5ddcf"}, {0x6, 0xa, "5db18b961780af33"}, {0x2, 0xe, "7353a9824b57fd7d39232ac5"}, {0x1, 0x6, "2e1ccd27"}]}, @noop, @cipso={0x86, 0x37, 0xffffffffffffffff, [{0x2, 0xf, "227467028cabd4e137b820c5c9"}, {0x7, 0x6, "90569992"}, {0x2, 0xc, "2071b0a8c9ce92782e72"}, {0x6, 0xa, "14f2b9bca55ce3dd"}, {0x6, 0x6, "2cd22a8f"}]}, @timestamp={0x44, 0x14, 0xd4, 0x0, 0x5, [0x81, 0x5d23, 0x63ab, 0x1]}]}}}}}) ioctl$sock_ipv4_tunnel_SIOCDELTUNNEL(0xffffffffffffffff, 0x89f2, &(0x7f0000000380)={'gretap0\x00', &(0x7f00000002c0)={'syztnl2\x00', 0x0, 0x7800, 0x7, 0x40, 0xe180, {{0x22, 0x4, 0x0, 0x1, 0x88, 0x64, 0x0, 0x1, 0x29, 0x0, @multicast2, @multicast1, {[@end, @lsrr={0x83, 0x1f, 0x2f, [@multicast2, @local, @local, @multicast1, @rand_addr=0x64010102, @loopback, @private=0xa010100]}, @rr={0x7, 0x27, 0x6c, [@multicast1, @rand_addr=0x64010102, @remote, @multicast1, @loopback, @initdev={0xac, 0x1e, 0x0, 0x0}, @initdev={0xac, 0x1e, 0x1, 0x0}, @broadcast, @empty]}, @ra={0x94, 0x4, 0x1}, @timestamp={0x44, 0x10, 0x2d, 0x0, 0x8, [0x1, 0x100, 0x401]}, @ssrr={0x89, 0x13, 0x56, [@dev={0xac, 0x14, 0x14, 0x28}, @multicast2, @initdev={0xac, 0x1e, 0x0, 0x0}, @remote]}, @ra={0x94, 0x4, 0x1}]}}}}}) shmget(0x3, 0x4000, 0x4, &(0x7f0000ff9000/0x4000)=nil) mmap$IORING_OFF_CQ_RING(&(0x7f0000ffd000/0x3000)=nil, 0x3000, 0x2000008, 0x30, 0xffffffffffffffff, 0x8000000) r1 = syz_genetlink_get_family_id$nl802154(&(0x7f0000000400), 0xffffffffffffffff) ioctl$sock_SIOCGIFINDEX_802154(0xffffffffffffffff, 0x8933, &(0x7f0000000440)={'wpan1\x00', 0x0}) sendmsg$NL802154_CMD_NEW_INTERFACE(0xffffffffffffffff, &(0x7f0000000540)={&(0x7f00000003c0)={0x10, 0x0, 0x0, 0x2}, 0xc, &(0x7f0000000500)={&(0x7f0000000480)={0x48, r1, 0x200, 0x70bd2a, 0x25dfdbfd, {}, [@NL802154_ATTR_IFNAME={0xa, 0x4, 'wpan0\x00'}, @NL802154_ATTR_IFINDEX={0x8}, @NL802154_ATTR_IFNAME={0xa, 0x4, 'wpan1\x00'}, @NL802154_ATTR_EXTENDED_ADDR={0xc, 0x17, {0xaaaaaaaaaaaa0002}}, @NL802154_ATTR_IFINDEX={0x8, 0x3, r2}]}, 0x48}}, 0x4001) mmap$binder(&(0x7f0000fef000/0x11000)=nil, 0x11000, 0x1, 0x11, 0xffffffffffffffff, 0x6) shmget$private(0x0, 0x4000, 0x200, &(0x7f0000ffc000/0x4000)=nil) sendmsg$IEEE802154_LLSEC_ADD_SECLEVEL(0xffffffffffffffff, &(0x7f00000006c0)={&(0x7f0000000580)={0x10, 0x0, 0x0, 0x4000000}, 0xc, &(0x7f0000000680)={&(0x7f0000000600)={0x44, 0x0, 0x200, 0x70bd2a, 0x25dfdbff, {}, [@IEEE802154_ATTR_LLSEC_FRAME_TYPE={0x5, 0x33, 0x34}, @IEEE802154_ATTR_DEV_INDEX={0x8}, @IEEE802154_ATTR_LLSEC_CMD_FRAME_ID={0x5, 0x34, 0x1}, @IEEE802154_ATTR_DEV_NAME={0xa, 0x1, 'wpan0\x00'}, @IEEE802154_ATTR_DEV_NAME={0xa, 0x1, 'wpan4\x00'}]}, 0x44}, 0x1, 0x0, 0x0, 0x8800}, 0x0) sendmsg$IEEE802154_START_REQ(0xffffffffffffffff, &(0x7f00000007c0)={&(0x7f0000000700)={0x10, 0x0, 0x0, 0x4}, 0xc, &(0x7f0000000780)={&(0x7f0000000740)={0x1c, 0x0, 0x200, 0x70bd2d, 0x25dfdbfb, {}, [@IEEE802154_ATTR_CHANNEL={0x5, 0x7, 0x6}]}, 0x1c}, 0x1, 0x0, 0x0, 0x40100}, 0x801) mlock(&(0x7f0000fef000/0x1000)=nil, 0x1000) syz_io_uring_setup(0x4726, &(0x7f0000000840)={0x0, 0x502f, 0x20, 0x0, 0x12e}, &(0x7f0000ffe000/0x2000)=nil, &(0x7f0000ffb000/0x4000)=nil, &(0x7f00000008c0), &(0x7f0000000900)) 17:45:32 executing program 4: r0 = perf_event_open(&(0x7f00000000c0)={0x1, 0x80, 0x0, 0xc0, 0xfa, 0x1, 0x0, 0x7fffffff, 0x10811, 0x1, 0x1, 0x1, 0x1, 0x1, 0x1, 0x1, 0x1, 0x1, 0x0, 0x1, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x1, 0x0, 0x1, 0x0, 0x0, 0x0, 0x1, 0x1, 0x1, 0x1, 0x1, 0x1, 0x1, 0x0, 0x1, 0x1, 0x1, 0x1, 0x0, 0x0, 0xfff, 0x7, @perf_config_ext={0x7, 0x7fffffff}, 0x41000, 0x80000000, 0x5, 0x3, 0x9, 0x2, 0x9, 0x0, 0x5, 0x0, 0x4}, 0x0, 0xb, 0xffffffffffffffff, 0x1) perf_event_open(&(0x7f0000000040)={0x0, 0x80, 0x0, 0x40, 0x80, 0x9, 0x0, 0x3, 0x10040, 0x1, 0x0, 0x0, 0x1, 0x1, 0x1, 0x1, 0x1, 0x1, 0x1, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x3, 0x1, 0x0, 0x1, 0x0, 0x1, 0x1, 0x0, 0x0, 0x1, 0x1, 0x1, 0x0, 0x1, 0x0, 0x0, 0x0, 0x1, 0x0, 0x1, 0x0, 0x1, 0x0, 0x0, 0x1, @perf_bp={&(0x7f0000000000), 0x10}, 0x8080, 0x800, 0x2, 0x3, 0x36dc, 0x31df3b33, 0xff, 0x0, 0x9, 0x0, 0x5}, 0xffffffffffffffff, 0x9, r0, 0x9) ioctl$PERF_EVENT_IOC_PAUSE_OUTPUT(r0, 0x40042409, 0x0) ioctl$PERF_EVENT_IOC_PERIOD(0xffffffffffffffff, 0x40082404, &(0x7f0000000140)=0x8) r1 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl$sock_ipv4_tunnel_SIOCADDTUNNEL(r1, 0x89f1, &(0x7f00000001c0)={'syztnl1\x00', &(0x7f0000000180)={'syztnl0\x00', 0x0, 0x1, 0x40, 0x0, 0x5, {{0x5, 0x4, 0x2, 0x19, 0x14, 0x65, 0x0, 0x1f, 0x4, 0x0, @multicast2, @remote}}}}) ioctl$PERF_EVENT_IOC_PERIOD(r0, 0x40082404, &(0x7f0000000200)=0x9) ioctl$SNDRV_SEQ_IOCTL_GET_PORT_INFO(0xffffffffffffffff, 0xc0a85322, &(0x7f0000000240)) ioctl$SNDRV_SEQ_IOCTL_SYSTEM_INFO(0xffffffffffffffff, 0xc0305302, &(0x7f0000000300)={0x9, 0x101, 0x1, 0x6, 0x3, 0x5}) r2 = syz_open_procfs(0x0, &(0x7f0000000340)='children\x00') openat$cgroup_type(r2, &(0x7f0000000380), 0x2, 0x0) ioctl$EVIOCGABS20(r2, 0x80184560, &(0x7f00000003c0)=""/4096) socket$inet6_tcp(0xa, 0x1, 0x0) write$cgroup_type(0xffffffffffffffff, &(0x7f0000001500), 0x9) 17:45:40 executing program 4: r0 = perf_event_open(&(0x7f00000000c0)={0x1, 0x80, 0x0, 0xc0, 0xfa, 0x1, 0x0, 0x7fffffff, 0x10811, 0x1, 0x1, 0x1, 0x1, 0x1, 0x1, 0x1, 0x1, 0x1, 0x0, 0x1, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x1, 0x0, 0x1, 0x0, 0x0, 0x0, 0x1, 0x1, 0x1, 0x1, 0x1, 0x1, 0x1, 0x0, 0x1, 0x1, 0x1, 0x1, 0x0, 0x0, 0xfff, 0x7, @perf_config_ext={0x7, 0x7fffffff}, 0x41000, 0x80000000, 0x5, 0x3, 0x9, 0x2, 0x9, 0x0, 0x5, 0x0, 0x4}, 0x0, 0xb, 0xffffffffffffffff, 0x1) perf_event_open(&(0x7f0000000040)={0x0, 0x80, 0x0, 0x40, 0x80, 0x9, 0x0, 0x3, 0x10040, 0x1, 0x0, 0x0, 0x1, 0x1, 0x1, 0x1, 0x1, 0x1, 0x1, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x3, 0x1, 0x0, 0x1, 0x0, 0x1, 0x1, 0x0, 0x0, 0x1, 0x1, 0x1, 0x0, 0x1, 0x0, 0x0, 0x0, 0x1, 0x0, 0x1, 0x0, 0x1, 0x0, 0x0, 0x1, @perf_bp={&(0x7f0000000000), 0x10}, 0x8080, 0x800, 0x2, 0x3, 0x36dc, 0x31df3b33, 0xff, 0x0, 0x9, 0x0, 0x5}, 0xffffffffffffffff, 0x9, r0, 0x9) ioctl$PERF_EVENT_IOC_PAUSE_OUTPUT(r0, 0x40042409, 0x0) ioctl$PERF_EVENT_IOC_PERIOD(0xffffffffffffffff, 0x40082404, &(0x7f0000000140)=0x8) r1 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl$sock_ipv4_tunnel_SIOCADDTUNNEL(r1, 0x89f1, &(0x7f00000001c0)={'syztnl1\x00', &(0x7f0000000180)={'syztnl0\x00', 0x0, 0x1, 0x40, 0x0, 0x5, {{0x5, 0x4, 0x2, 0x19, 0x14, 0x65, 0x0, 0x1f, 0x4, 0x0, @multicast2, @remote}}}}) ioctl$PERF_EVENT_IOC_PERIOD(r0, 0x40082404, &(0x7f0000000200)=0x9) ioctl$SNDRV_SEQ_IOCTL_GET_PORT_INFO(0xffffffffffffffff, 0xc0a85322, &(0x7f0000000240)) ioctl$SNDRV_SEQ_IOCTL_SYSTEM_INFO(0xffffffffffffffff, 0xc0305302, &(0x7f0000000300)={0x9, 0x101, 0x1, 0x6, 0x3, 0x5}) r2 = syz_open_procfs(0x0, &(0x7f0000000340)='children\x00') openat$cgroup_type(r2, &(0x7f0000000380), 0x2, 0x0) ioctl$EVIOCGABS20(r2, 0x80184560, &(0x7f00000003c0)=""/4096) socket$inet6_tcp(0xa, 0x1, 0x0) 17:45:40 executing program 2: prctl$PR_MPX_ENABLE_MANAGEMENT(0x2b) r0 = socket$inet(0x2, 0x5, 0x4) r1 = openat$vcsu(0xffffffffffffff9c, &(0x7f0000000000), 0x3c1480, 0x0) ioctl$sock_ipv4_tunnel_SIOCGETTUNNEL(r1, 0x89f0, &(0x7f00000000c0)={'syztnl2\x00', &(0x7f0000000040)={'erspan0\x00', 0x0, 0x700, 0x40, 0x3, 0x22, {{0x15, 0x4, 0x3, 0x17, 0x54, 0x64, 0x0, 0x1, 0x2f, 0x0, @broadcast, @dev={0xac, 0x14, 0x14, 0x36}, {[@cipso={0x86, 0x3d, 0x1, [{0x5, 0x9, "c8a7bec58c2c80"}, {0x0, 0x9, "fabb6c2e64ba82"}, {0x7, 0xf, "6b1b69e07efcb7230cc07a2cf7"}, {0x1, 0x6, "a2118bdb"}, {0x5, 0x10, "67115d3e7766231c7b08cf3c48e4"}]}]}}}}}) prctl$PR_MPX_ENABLE_MANAGEMENT(0x2b) r2 = openat$vcsa(0xffffffffffffff9c, &(0x7f0000000100), 0x202c0, 0x0) ioctl$SNDRV_SEQ_IOCTL_GET_QUEUE_TEMPO(r2, 0xc02c5341, &(0x7f0000000140)) ioctl$SNDRV_TIMER_IOCTL_SELECT(r1, 0x40345410, &(0x7f00000001c0)={{0x0, 0x2, 0x3f, 0x3, 0x80000001}}) ioctl$SNDRV_SEQ_IOCTL_GET_QUEUE_TEMPO(r1, 0xc02c5341, &(0x7f0000000200)) ioctl$sock_inet_tcp_SIOCOUTQ(r0, 0x5411, &(0x7f0000000280)) r3 = syz_open_dev$evdev(&(0x7f00000002c0), 0x1, 0x50000) ioctl$EVIOCGLED(r3, 0x80404519, &(0x7f0000000300)=""/21) syz_open_procfs(0x0, &(0x7f0000000500)='schedstat\x00') 17:45:40 executing program 7: r0 = perf_event_open(&(0x7f0000000040)={0x4, 0x80, 0x6f, 0x8, 0x8, 0x1, 0x0, 0x6, 0x4, 0x1, 0x1, 0x0, 0x0, 0x1, 0x1, 0x1, 0x0, 0x0, 0x1, 0x0, 0x0, 0x1, 0x1, 0x0, 0x0, 0x2, 0x1, 0x0, 0x0, 0x1, 0x0, 0x0, 0x1, 0x0, 0x1, 0x0, 0x0, 0x0, 0x1, 0x1, 0x1, 0x0, 0x1, 0x1, 0x1, 0x0, 0x1, 0x0, 0x50, 0x2, @perf_bp={&(0x7f0000000000), 0xa}, 0x2100, 0x7, 0x1, 0x3, 0x6, 0x93d3, 0x0, 0x0, 0x3a, 0x0, 0x9}, 0xffffffffffffffff, 0xc, 0xffffffffffffffff, 0x8) mmap$perf(&(0x7f0000ffb000/0x2000)=nil, 0x2000, 0xb, 0x11, r0, 0x8) munmap(&(0x7f0000ffb000/0x3000)=nil, 0x3000) getsockopt$inet6_tcp_TCP_ZEROCOPY_RECEIVE(0xffffffffffffffff, 0x6, 0x23, &(0x7f0000001180)={&(0x7f0000ffd000/0x2000)=nil, 0x2000, 0x0, 0x0, 0x0, &(0x7f00000000c0)=""/162, 0xa2, 0x0, &(0x7f0000000180)=""/4096, 0x1000}, &(0x7f00000011c0)=0x40) shmget(0x0, 0x1000, 0x200, &(0x7f0000ffd000/0x1000)=nil) 17:45:40 executing program 5: clock_gettime(0x5, &(0x7f0000000000)) clock_settime(0x2, &(0x7f0000000040)) sched_rr_get_interval(0xffffffffffffffff, &(0x7f0000000080)) sched_rr_get_interval(0x0, &(0x7f00000000c0)) sendmsg$NL802154_CMD_GET_SEC_KEY(0xffffffffffffffff, &(0x7f00000001c0)={&(0x7f0000000100)={0x10, 0x0, 0x0, 0x20000000}, 0xc, &(0x7f0000000180)={&(0x7f0000000140)={0x24, 0x0, 0x200, 0x70bd26, 0x25dfdbfe, {}, [@NL802154_ATTR_IFINDEX={0x8}, @NL802154_ATTR_IFINDEX={0x8}]}, 0x24}, 0x1, 0x0, 0x0, 0x4000000}, 0x181) clock_gettime(0x0, &(0x7f0000000200)) pipe2$9p(&(0x7f0000000240)={0xffffffffffffffff, 0xffffffffffffffff}, 0x800) r1 = syz_io_uring_setup(0x776a, &(0x7f0000000280)={0x0, 0x2728, 0x2, 0x1, 0x37c}, &(0x7f0000000000/0x3000)=nil, &(0x7f0000000000/0x400000)=nil, &(0x7f0000000300), &(0x7f0000000340)) ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, &(0x7f0000000540)={0x64, 0x0, &(0x7f0000000440)=[@transaction_sg={0x40486311, {0x1, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x50, 0x18, &(0x7f0000000380)={@fd={0x66642a85, 0x0, r0}, @fd={0x66642a85, 0x0, r1}, @fda={0x66646185, 0x0, 0x2, 0x36}}, &(0x7f0000000400)={0x0, 0x18, 0x30}}}, @request_death, @release={0x40046306, 0x1}], 0x7e, 0x0, &(0x7f00000004c0)="7685c519d1cbea63a1a8f022f8c0085baf770aa5d1fa9bfb1a5399fdb134953d619e962218bba650b68d6206fde39ff17760aa4bbcb62f6802c48e17294a17a3b768ab60bbae37aa37e33e24b09f6bdea37853f7ab2622451803788c9d172b7d71d6d87911129b8ef5cc9e0169404b09abfa991f3a7a3640686df445d387"}) pipe2$9p(&(0x7f0000000580), 0x800) ioctl$EVIOCGVERSION(0xffffffffffffffff, 0x80044501, &(0x7f00000005c0)=""/174) r2 = openat$nvram(0xffffffffffffff9c, &(0x7f0000000680), 0x400, 0x0) write$P9_RSTAT(r2, &(0x7f00000006c0)={0x3f, 0x7d, 0x1, {0x0, 0x38, 0x401, 0x8000, {0x80, 0x4, 0x1}, 0x2020000, 0x4, 0x60, 0x9, 0x1, '\x00', 0x2, '.-', 0x1, '\x00', 0x1, '\x00'}}, 0x3f) r3 = syz_genetlink_get_family_id$ieee802154(&(0x7f0000000740), 0xffffffffffffffff) sendmsg$IEEE802154_LLSEC_DEL_KEY(0xffffffffffffffff, &(0x7f0000000840)={&(0x7f0000000700)={0x10, 0x0, 0x0, 0x800000}, 0xc, &(0x7f0000000800)={&(0x7f0000000780)={0x54, r3, 0x800, 0x70bd27, 0x25dfdbfc, {}, [@IEEE802154_ATTR_LLSEC_KEY_SOURCE_SHORT={0x8, 0x2c, 0x5}, @IEEE802154_ATTR_LLSEC_KEY_SOURCE_EXTENDED={0xc, 0x2d, {0xaaaaaaaaaaaa0002}}, @IEEE802154_ATTR_PAN_ID={0x6, 0x6, 0x2}, @IEEE802154_ATTR_DEV_INDEX={0x8}, @IEEE802154_ATTR_LLSEC_KEY_MODE={0x5, 0x2b, 0x1}, @IEEE802154_ATTR_HW_ADDR={0xc, 0x5, {0xaaaaaaaaaaaa0002}}, @IEEE802154_ATTR_LLSEC_KEY_MODE={0x5, 0x2b, 0x3}]}, 0x54}, 0x1, 0x0, 0x0, 0x40}, 0x2000c814) clock_getres(0x3, &(0x7f0000000880)) r4 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) sendmsg$IEEE802154_ADD_IFACE(r4, &(0x7f0000000a00)={&(0x7f0000000900)={0x10, 0x0, 0x0, 0x40c}, 0xc, &(0x7f00000009c0)={&(0x7f0000000940)={0x44, r3, 0x200, 0x70bd29, 0x25dfdbfe, {}, [@IEEE802154_ATTR_PHY_NAME={0x9, 0x1f, 'phy1\x00'}, @IEEE802154_ATTR_DEV_NAME={0xa, 0x1, 'wpan4\x00'}, @IEEE802154_ATTR_DEV_NAME={0xa, 0x1, 'wpan1\x00'}, @IEEE802154_ATTR_DEV_NAME={0xa, 0x1, 'wpan0\x00'}]}, 0x44}, 0x1, 0x0, 0x0, 0x20000084}, 0x44000) 17:45:40 executing program 0: get_thread_area(&(0x7f0000000000)={0x7, 0x20000800, 0x4000, 0x0, 0x1, 0x0, 0x0, 0x1, 0x1, 0x1}) r0 = openat$vcsu(0xffffffffffffff9c, &(0x7f0000000040), 0x200000, 0x0) getsockopt$inet_tcp_TCP_REPAIR_WINDOW(r0, 0x6, 0x1d, &(0x7f0000000080), &(0x7f00000000c0)=0x14) r1 = openat$nvram(0xffffffffffffff9c, &(0x7f0000000100), 0x2000, 0x0) setsockopt$inet_tcp_TCP_FASTOPEN_KEY(r1, 0x6, 0x21, &(0x7f0000000140)="1bb9d563048b6ec78effc0f14d974b17", 0x10) setsockopt$inet_tcp_int(r1, 0x6, 0x1b, &(0x7f0000000180)=0x5, 0x4) ioctl$SNDRV_TIMER_IOCTL_STATUS32(r1, 0x80585414, &(0x7f00000001c0)) setsockopt$inet_tcp_TCP_QUEUE_SEQ(r0, 0x6, 0x15, &(0x7f0000000240)=0x1, 0x4) getsockopt$inet_tcp_TCP_ZEROCOPY_RECEIVE(r1, 0x6, 0x23, &(0x7f0000000340)={&(0x7f0000ffc000/0x2000)=nil, 0x2000, 0x0, 0x0, 0x0, &(0x7f0000000280)=""/37, 0x25, 0x1, &(0x7f00000002c0)=""/109, 0x6d}, &(0x7f0000000380)=0x40) r2 = socket$inet_tcp(0x2, 0x1, 0x0) ioctl$sock_inet_tcp_SIOCINQ(r2, 0x541b, &(0x7f00000003c0)) move_pages(0x0, 0x8, &(0x7f0000000400)=[&(0x7f0000ffd000/0x1000)=nil, &(0x7f0000ffd000/0x3000)=nil, &(0x7f0000ffd000/0x3000)=nil, &(0x7f0000ffb000/0x2000)=nil, &(0x7f0000ffc000/0x1000)=nil, &(0x7f0000ffe000/0x2000)=nil, &(0x7f0000ffb000/0x4000)=nil, &(0x7f0000ffd000/0x3000)=nil], &(0x7f0000000440)=[0xfff], &(0x7f0000000480)=[0x0, 0x0, 0x0], 0x4) r3 = syz_genetlink_get_family_id$SEG6(&(0x7f0000000500), r1) sendmsg$SEG6_CMD_DUMPHMAC(0xffffffffffffffff, &(0x7f0000000740)={&(0x7f0000000680)={0x10, 0x0, 0x0, 0x240000}, 0xc, &(0x7f0000000700)={&(0x7f00000006c0)={0x2c, r3, 0x1, 0x70bd2c, 0x25dfdbfe, {}, [@SEG6_ATTR_SECRET={0x8, 0x4, [0x1]}, @SEG6_ATTR_DSTLEN={0x8, 0x2, 0x5}, @SEG6_ATTR_DSTLEN={0x8}]}, 0x2c}, 0x1, 0x0, 0x0, 0x4000000}, 0x4000000) pidfd_getfd(r1, r2, 0x0) syz_genetlink_get_family_id$ieee802154(&(0x7f0000000800), 0xffffffffffffffff) 17:45:40 executing program 1: shmget$private(0x0, 0x4000, 0x80, &(0x7f0000ffb000/0x4000)=nil) shmget(0x3, 0x2000, 0x4, &(0x7f0000ffc000/0x2000)=nil) mlock(&(0x7f0000ff0000/0x10000)=nil, 0x10000) shmget(0x1, 0x1000, 0x10, &(0x7f0000ff5000/0x1000)=nil) ioctl$sock_ipv4_tunnel_SIOCGETTUNNEL(0xffffffffffffffff, 0x89f0, &(0x7f0000000140)={'syztnl1\x00', &(0x7f00000000c0)={'syztnl2\x00', 0x0, 0x20, 0x1, 0x6, 0x9, {{0xd, 0x4, 0x1, 0x19, 0x34, 0x68, 0x0, 0x9, 0x29, 0x0, @empty, @dev={0xac, 0x14, 0x14, 0x29}, {[@timestamp_addr={0x44, 0x14, 0xc2, 0x1, 0x4, [{@multicast1}, {@private=0xa010101}]}, @rr={0x7, 0xb, 0xc8, [@initdev={0xac, 0x1e, 0x1, 0x0}, @private=0xa010102]}]}}}}}) ioctl$sock_ipv4_tunnel_SIOCADDTUNNEL(0xffffffffffffffff, 0x89f1, &(0x7f0000000280)={'tunl0\x00', &(0x7f0000000180)={'tunl0\x00', r0, 0x7, 0x8000, 0xfffffffc, 0x8, {{0x2f, 0x4, 0x0, 0x2, 0xbc, 0x65, 0x0, 0x0, 0x4, 0x0, @empty, @broadcast, {[@generic={0x89, 0x9, "8db1d464c6af68"}, @noop, @ra={0x94, 0x4, 0x1}, @timestamp={0x44, 0x1c, 0x53, 0x0, 0x7, [0x40, 0x7fffffff, 0xfffffffd, 0x5, 0x5c, 0x77]}, @cipso={0x86, 0x2f, 0x3, [{0x1, 0x4, "1eba"}, {0x1, 0x7, "e3ccb5ddcf"}, {0x6, 0xa, "5db18b961780af33"}, {0x2, 0xe, "7353a9824b57fd7d39232ac5"}, {0x1, 0x6, "2e1ccd27"}]}, @noop, @cipso={0x86, 0x37, 0xffffffffffffffff, [{0x2, 0xf, "227467028cabd4e137b820c5c9"}, {0x7, 0x6, "90569992"}, {0x2, 0xc, "2071b0a8c9ce92782e72"}, {0x6, 0xa, "14f2b9bca55ce3dd"}, {0x6, 0x6, "2cd22a8f"}]}, @timestamp={0x44, 0x14, 0xd4, 0x0, 0x5, [0x81, 0x5d23, 0x63ab, 0x1]}]}}}}}) ioctl$sock_ipv4_tunnel_SIOCDELTUNNEL(0xffffffffffffffff, 0x89f2, &(0x7f0000000380)={'gretap0\x00', &(0x7f00000002c0)={'syztnl2\x00', 0x0, 0x7800, 0x7, 0x40, 0xe180, {{0x22, 0x4, 0x0, 0x1, 0x88, 0x64, 0x0, 0x1, 0x29, 0x0, @multicast2, @multicast1, {[@end, @lsrr={0x83, 0x1f, 0x2f, [@multicast2, @local, @local, @multicast1, @rand_addr=0x64010102, @loopback, @private=0xa010100]}, @rr={0x7, 0x27, 0x6c, [@multicast1, @rand_addr=0x64010102, @remote, @multicast1, @loopback, @initdev={0xac, 0x1e, 0x0, 0x0}, @initdev={0xac, 0x1e, 0x1, 0x0}, @broadcast, @empty]}, @ra={0x94, 0x4, 0x1}, @timestamp={0x44, 0x10, 0x2d, 0x0, 0x8, [0x1, 0x100, 0x401]}, @ssrr={0x89, 0x13, 0x56, [@dev={0xac, 0x14, 0x14, 0x28}, @multicast2, @initdev={0xac, 0x1e, 0x0, 0x0}, @remote]}, @ra={0x94, 0x4, 0x1}]}}}}}) shmget(0x3, 0x4000, 0x4, &(0x7f0000ff9000/0x4000)=nil) mmap$IORING_OFF_CQ_RING(&(0x7f0000ffd000/0x3000)=nil, 0x3000, 0x2000008, 0x30, 0xffffffffffffffff, 0x8000000) r1 = syz_genetlink_get_family_id$nl802154(&(0x7f0000000400), 0xffffffffffffffff) ioctl$sock_SIOCGIFINDEX_802154(0xffffffffffffffff, 0x8933, &(0x7f0000000440)={'wpan1\x00', 0x0}) sendmsg$NL802154_CMD_NEW_INTERFACE(0xffffffffffffffff, &(0x7f0000000540)={&(0x7f00000003c0)={0x10, 0x0, 0x0, 0x2}, 0xc, &(0x7f0000000500)={&(0x7f0000000480)={0x48, r1, 0x200, 0x70bd2a, 0x25dfdbfd, {}, [@NL802154_ATTR_IFNAME={0xa, 0x4, 'wpan0\x00'}, @NL802154_ATTR_IFINDEX={0x8}, @NL802154_ATTR_IFNAME={0xa, 0x4, 'wpan1\x00'}, @NL802154_ATTR_EXTENDED_ADDR={0xc, 0x17, {0xaaaaaaaaaaaa0002}}, @NL802154_ATTR_IFINDEX={0x8, 0x3, r2}]}, 0x48}}, 0x4001) mmap$binder(&(0x7f0000fef000/0x11000)=nil, 0x11000, 0x1, 0x11, 0xffffffffffffffff, 0x6) shmget$private(0x0, 0x4000, 0x200, &(0x7f0000ffc000/0x4000)=nil) sendmsg$IEEE802154_LLSEC_ADD_SECLEVEL(0xffffffffffffffff, &(0x7f00000006c0)={&(0x7f0000000580)={0x10, 0x0, 0x0, 0x4000000}, 0xc, &(0x7f0000000680)={&(0x7f0000000600)={0x44, 0x0, 0x200, 0x70bd2a, 0x25dfdbff, {}, [@IEEE802154_ATTR_LLSEC_FRAME_TYPE={0x5, 0x33, 0x34}, @IEEE802154_ATTR_DEV_INDEX={0x8}, @IEEE802154_ATTR_LLSEC_CMD_FRAME_ID={0x5, 0x34, 0x1}, @IEEE802154_ATTR_DEV_NAME={0xa, 0x1, 'wpan0\x00'}, @IEEE802154_ATTR_DEV_NAME={0xa, 0x1, 'wpan4\x00'}]}, 0x44}, 0x1, 0x0, 0x0, 0x8800}, 0x0) sendmsg$IEEE802154_START_REQ(0xffffffffffffffff, &(0x7f00000007c0)={&(0x7f0000000700)={0x10, 0x0, 0x0, 0x4}, 0xc, &(0x7f0000000780)={&(0x7f0000000740)={0x1c, 0x0, 0x200, 0x70bd2d, 0x25dfdbfb, {}, [@IEEE802154_ATTR_CHANNEL={0x5, 0x7, 0x6}]}, 0x1c}, 0x1, 0x0, 0x0, 0x40100}, 0x801) mlock(&(0x7f0000fef000/0x1000)=nil, 0x1000) syz_io_uring_setup(0x4726, &(0x7f0000000840)={0x0, 0x502f, 0x20, 0x0, 0x12e}, &(0x7f0000ffe000/0x2000)=nil, &(0x7f0000ffb000/0x4000)=nil, &(0x7f00000008c0), &(0x7f0000000900)) 17:45:40 executing program 6: r0 = perf_event_open(&(0x7f00000000c0)={0x1, 0x80, 0x0, 0xc0, 0xfa, 0x1, 0x0, 0x7fffffff, 0x10811, 0x1, 0x1, 0x1, 0x1, 0x1, 0x1, 0x1, 0x1, 0x1, 0x0, 0x1, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x1, 0x0, 0x1, 0x0, 0x0, 0x0, 0x1, 0x1, 0x1, 0x1, 0x1, 0x1, 0x1, 0x0, 0x1, 0x1, 0x1, 0x1, 0x0, 0x0, 0xfff, 0x7, @perf_config_ext={0x7, 0x7fffffff}, 0x41000, 0x80000000, 0x5, 0x3, 0x9, 0x2, 0x9, 0x0, 0x5, 0x0, 0x4}, 0x0, 0xb, 0xffffffffffffffff, 0x1) perf_event_open(&(0x7f0000000040)={0x0, 0x80, 0x0, 0x40, 0x80, 0x9, 0x0, 0x3, 0x10040, 0x1, 0x0, 0x0, 0x1, 0x1, 0x1, 0x1, 0x1, 0x1, 0x1, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x3, 0x1, 0x0, 0x1, 0x0, 0x1, 0x1, 0x0, 0x0, 0x1, 0x1, 0x1, 0x0, 0x1, 0x0, 0x0, 0x0, 0x1, 0x0, 0x1, 0x0, 0x1, 0x0, 0x0, 0x1, @perf_bp={&(0x7f0000000000), 0x10}, 0x8080, 0x800, 0x2, 0x3, 0x36dc, 0x31df3b33, 0xff, 0x0, 0x9, 0x0, 0x5}, 0xffffffffffffffff, 0x9, r0, 0x9) ioctl$PERF_EVENT_IOC_PAUSE_OUTPUT(r0, 0x40042409, 0x0) ioctl$PERF_EVENT_IOC_PERIOD(0xffffffffffffffff, 0x40082404, &(0x7f0000000140)=0x8) r1 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl$sock_ipv4_tunnel_SIOCADDTUNNEL(r1, 0x89f1, &(0x7f00000001c0)={'syztnl1\x00', &(0x7f0000000180)={'syztnl0\x00', 0x0, 0x1, 0x40, 0x0, 0x5, {{0x5, 0x4, 0x2, 0x19, 0x14, 0x65, 0x0, 0x1f, 0x4, 0x0, @multicast2, @remote}}}}) ioctl$PERF_EVENT_IOC_PERIOD(r0, 0x40082404, &(0x7f0000000200)=0x9) ioctl$SNDRV_SEQ_IOCTL_GET_PORT_INFO(0xffffffffffffffff, 0xc0a85322, &(0x7f0000000240)) ioctl$SNDRV_SEQ_IOCTL_SYSTEM_INFO(0xffffffffffffffff, 0xc0305302, &(0x7f0000000300)={0x9, 0x101, 0x1, 0x6, 0x3, 0x5}) syz_open_procfs(0x0, &(0x7f0000000340)='children\x00') write$cgroup_type(0xffffffffffffffff, &(0x7f0000001500), 0x9) 17:45:40 executing program 3: getsockopt$inet_udp_int(0xffffffffffffffff, 0x11, 0x1, &(0x7f0000000000), &(0x7f0000000040)=0x4) setsockopt$inet_udp_int(0xffffffffffffffff, 0x11, 0x1, &(0x7f0000000080)=0x7, 0x4) ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, &(0x7f0000000240)={0x54, 0x0, &(0x7f00000000c0)=[@acquire_done={0x40106309, 0x1}, @free_buffer, @request_death={0x400c630e, 0x1}, @request_death, @decrefs, @dead_binder_done], 0xc7, 0x0, &(0x7f0000000140)="aa36e0fef6a6cd3a6060f434b2a2306a435d6c33ca3bfb20c9d046886ded10cf23d0938b55b8a812702a5a7579cb8813f0cf3954f24fa081e8c35a9d4674b51115d91e7f6e38920909a8fba27ba7bbb0522974a9d83826c23d40a56c3f88dc24276a8312ae50d15d3531211e4378a34980ea70ac3cefef2439af0baa6b387df4ff26b593ca52e94dda8ce3656a81180693ab97746e30b1301f30922ec565bba820fc06168927e446c06efe1fc7cb37b804ba0342e58e70da81c074407ec9cf690a9ab1e3a62a68"}) r0 = openat$vcsa(0xffffffffffffff9c, &(0x7f0000000280), 0x1, 0x0) openat$vcsa(0xffffffffffffff9c, &(0x7f00000002c0), 0x80, 0x0) ioctl$SNDRV_SEQ_IOCTL_QUERY_NEXT_PORT(r0, 0xc0a85352, &(0x7f0000000300)={{0x4, 0x6}, 'port0\x00', 0x5, 0x1, 0x0, 0xffff, 0x7, 0x7, 0x5, 0x0, 0x2, 0xc0}) r1 = openat$nvram(0xffffffffffffff9c, &(0x7f0000000700), 0x800, 0x0) write$P9_RGETLOCK(r1, &(0x7f00000007c0)={0x1e, 0x37, 0x2, {0x2, 0x6, 0x101}}, 0x1e) 17:45:40 executing program 1: shmget$private(0x0, 0x4000, 0x80, &(0x7f0000ffb000/0x4000)=nil) shmget(0x3, 0x2000, 0x4, &(0x7f0000ffc000/0x2000)=nil) mlock(&(0x7f0000ff0000/0x10000)=nil, 0x10000) shmget(0x1, 0x1000, 0x10, &(0x7f0000ff5000/0x1000)=nil) ioctl$sock_ipv4_tunnel_SIOCGETTUNNEL(0xffffffffffffffff, 0x89f0, &(0x7f0000000140)={'syztnl1\x00', &(0x7f00000000c0)={'syztnl2\x00', 0x0, 0x20, 0x1, 0x6, 0x9, {{0xd, 0x4, 0x1, 0x19, 0x34, 0x68, 0x0, 0x9, 0x29, 0x0, @empty, @dev={0xac, 0x14, 0x14, 0x29}, {[@timestamp_addr={0x44, 0x14, 0xc2, 0x1, 0x4, [{@multicast1}, {@private=0xa010101}]}, @rr={0x7, 0xb, 0xc8, [@initdev={0xac, 0x1e, 0x1, 0x0}, @private=0xa010102]}]}}}}}) ioctl$sock_ipv4_tunnel_SIOCADDTUNNEL(0xffffffffffffffff, 0x89f1, &(0x7f0000000280)={'tunl0\x00', &(0x7f0000000180)={'tunl0\x00', r0, 0x7, 0x8000, 0xfffffffc, 0x8, {{0x2f, 0x4, 0x0, 0x2, 0xbc, 0x65, 0x0, 0x0, 0x4, 0x0, @empty, @broadcast, {[@generic={0x89, 0x9, "8db1d464c6af68"}, @noop, @ra={0x94, 0x4, 0x1}, @timestamp={0x44, 0x1c, 0x53, 0x0, 0x7, [0x40, 0x7fffffff, 0xfffffffd, 0x5, 0x5c, 0x77]}, @cipso={0x86, 0x2f, 0x3, [{0x1, 0x4, "1eba"}, {0x1, 0x7, "e3ccb5ddcf"}, {0x6, 0xa, "5db18b961780af33"}, {0x2, 0xe, "7353a9824b57fd7d39232ac5"}, {0x1, 0x6, "2e1ccd27"}]}, @noop, @cipso={0x86, 0x37, 0xffffffffffffffff, [{0x2, 0xf, "227467028cabd4e137b820c5c9"}, {0x7, 0x6, "90569992"}, {0x2, 0xc, "2071b0a8c9ce92782e72"}, {0x6, 0xa, "14f2b9bca55ce3dd"}, {0x6, 0x6, "2cd22a8f"}]}, @timestamp={0x44, 0x14, 0xd4, 0x0, 0x5, [0x81, 0x5d23, 0x63ab, 0x1]}]}}}}}) ioctl$sock_ipv4_tunnel_SIOCDELTUNNEL(0xffffffffffffffff, 0x89f2, &(0x7f0000000380)={'gretap0\x00', &(0x7f00000002c0)={'syztnl2\x00', 0x0, 0x7800, 0x7, 0x40, 0xe180, {{0x22, 0x4, 0x0, 0x1, 0x88, 0x64, 0x0, 0x1, 0x29, 0x0, @multicast2, @multicast1, {[@end, @lsrr={0x83, 0x1f, 0x2f, [@multicast2, @local, @local, @multicast1, @rand_addr=0x64010102, @loopback, @private=0xa010100]}, @rr={0x7, 0x27, 0x6c, [@multicast1, @rand_addr=0x64010102, @remote, @multicast1, @loopback, @initdev={0xac, 0x1e, 0x0, 0x0}, @initdev={0xac, 0x1e, 0x1, 0x0}, @broadcast, @empty]}, @ra={0x94, 0x4, 0x1}, @timestamp={0x44, 0x10, 0x2d, 0x0, 0x8, [0x1, 0x100, 0x401]}, @ssrr={0x89, 0x13, 0x56, [@dev={0xac, 0x14, 0x14, 0x28}, @multicast2, @initdev={0xac, 0x1e, 0x0, 0x0}, @remote]}, @ra={0x94, 0x4, 0x1}]}}}}}) shmget(0x3, 0x4000, 0x4, &(0x7f0000ff9000/0x4000)=nil) mmap$IORING_OFF_CQ_RING(&(0x7f0000ffd000/0x3000)=nil, 0x3000, 0x2000008, 0x30, 0xffffffffffffffff, 0x8000000) r1 = syz_genetlink_get_family_id$nl802154(&(0x7f0000000400), 0xffffffffffffffff) ioctl$sock_SIOCGIFINDEX_802154(0xffffffffffffffff, 0x8933, &(0x7f0000000440)={'wpan1\x00', 0x0}) sendmsg$NL802154_CMD_NEW_INTERFACE(0xffffffffffffffff, &(0x7f0000000540)={&(0x7f00000003c0)={0x10, 0x0, 0x0, 0x2}, 0xc, &(0x7f0000000500)={&(0x7f0000000480)={0x48, r1, 0x200, 0x70bd2a, 0x25dfdbfd, {}, [@NL802154_ATTR_IFNAME={0xa, 0x4, 'wpan0\x00'}, @NL802154_ATTR_IFINDEX={0x8}, @NL802154_ATTR_IFNAME={0xa, 0x4, 'wpan1\x00'}, @NL802154_ATTR_EXTENDED_ADDR={0xc, 0x17, {0xaaaaaaaaaaaa0002}}, @NL802154_ATTR_IFINDEX={0x8, 0x3, r2}]}, 0x48}}, 0x4001) mmap$binder(&(0x7f0000fef000/0x11000)=nil, 0x11000, 0x1, 0x11, 0xffffffffffffffff, 0x6) r3 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) sendmsg$IEEE802154_LLSEC_ADD_SECLEVEL(r3, &(0x7f00000006c0)={&(0x7f0000000580)={0x10, 0x0, 0x0, 0x4000000}, 0xc, &(0x7f0000000680)={&(0x7f0000000600)={0x44, 0x0, 0x200, 0x70bd2a, 0x25dfdbff, {}, [@IEEE802154_ATTR_LLSEC_FRAME_TYPE={0x5, 0x33, 0x34}, @IEEE802154_ATTR_DEV_INDEX={0x8}, @IEEE802154_ATTR_LLSEC_CMD_FRAME_ID={0x5, 0x34, 0x1}, @IEEE802154_ATTR_DEV_NAME={0xa, 0x1, 'wpan0\x00'}, @IEEE802154_ATTR_DEV_NAME={0xa, 0x1, 'wpan4\x00'}]}, 0x44}, 0x1, 0x0, 0x0, 0x8800}, 0x0) sendmsg$IEEE802154_START_REQ(r3, &(0x7f00000007c0)={&(0x7f0000000700)={0x10, 0x0, 0x0, 0x4}, 0xc, &(0x7f0000000780)={&(0x7f0000000740)={0x1c, 0x0, 0x200, 0x70bd2d, 0x25dfdbfb, {}, [@IEEE802154_ATTR_CHANNEL={0x5, 0x7, 0x6}]}, 0x1c}, 0x1, 0x0, 0x0, 0x40100}, 0x801) mlock(&(0x7f0000fef000/0x1000)=nil, 0x1000) syz_io_uring_setup(0x4726, &(0x7f0000000840)={0x0, 0x502f, 0x20, 0x0, 0x12e}, &(0x7f0000ffe000/0x2000)=nil, &(0x7f0000ffb000/0x4000)=nil, &(0x7f00000008c0), &(0x7f0000000900)) 17:45:40 executing program 5: clock_gettime(0x5, &(0x7f0000000000)) clock_settime(0x2, &(0x7f0000000040)) sched_rr_get_interval(0xffffffffffffffff, &(0x7f0000000080)) sched_rr_get_interval(0x0, &(0x7f00000000c0)) sendmsg$NL802154_CMD_GET_SEC_KEY(0xffffffffffffffff, &(0x7f00000001c0)={&(0x7f0000000100)={0x10, 0x0, 0x0, 0x20000000}, 0xc, &(0x7f0000000180)={&(0x7f0000000140)={0x24, 0x0, 0x200, 0x70bd26, 0x25dfdbfe, {}, [@NL802154_ATTR_IFINDEX={0x8}, @NL802154_ATTR_IFINDEX={0x8}]}, 0x24}, 0x1, 0x0, 0x0, 0x4000000}, 0x181) clock_gettime(0x0, &(0x7f0000000200)) pipe2$9p(&(0x7f0000000240)={0xffffffffffffffff, 0xffffffffffffffff}, 0x800) r1 = syz_io_uring_setup(0x776a, &(0x7f0000000280)={0x0, 0x2728, 0x2, 0x1, 0x37c}, &(0x7f0000000000/0x3000)=nil, &(0x7f0000000000/0x400000)=nil, &(0x7f0000000300), &(0x7f0000000340)) ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, &(0x7f0000000540)={0x64, 0x0, &(0x7f0000000440)=[@transaction_sg={0x40486311, {0x1, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x50, 0x18, &(0x7f0000000380)={@fd={0x66642a85, 0x0, r0}, @fd={0x66642a85, 0x0, r1}, @fda={0x66646185, 0x0, 0x2, 0x36}}, &(0x7f0000000400)={0x0, 0x18, 0x30}}}, @request_death, @release={0x40046306, 0x1}], 0x7e, 0x0, &(0x7f00000004c0)="7685c519d1cbea63a1a8f022f8c0085baf770aa5d1fa9bfb1a5399fdb134953d619e962218bba650b68d6206fde39ff17760aa4bbcb62f6802c48e17294a17a3b768ab60bbae37aa37e33e24b09f6bdea37853f7ab2622451803788c9d172b7d71d6d87911129b8ef5cc9e0169404b09abfa991f3a7a3640686df445d387"}) pipe2$9p(&(0x7f0000000580), 0x800) ioctl$EVIOCGVERSION(0xffffffffffffffff, 0x80044501, &(0x7f00000005c0)=""/174) openat$nvram(0xffffffffffffff9c, &(0x7f0000000680), 0x400, 0x0) r2 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r3 = syz_genetlink_get_family_id$ieee802154(&(0x7f0000000740), 0xffffffffffffffff) sendmsg$IEEE802154_LLSEC_DEL_KEY(r2, &(0x7f0000000840)={&(0x7f0000000700)={0x10, 0x0, 0x0, 0x800000}, 0xc, &(0x7f0000000800)={&(0x7f0000000780)={0x54, r3, 0x800, 0x70bd27, 0x25dfdbfc, {}, [@IEEE802154_ATTR_LLSEC_KEY_SOURCE_SHORT={0x8, 0x2c, 0x5}, @IEEE802154_ATTR_LLSEC_KEY_SOURCE_EXTENDED={0xc, 0x2d, {0xaaaaaaaaaaaa0002}}, @IEEE802154_ATTR_PAN_ID={0x6, 0x6, 0x2}, @IEEE802154_ATTR_DEV_INDEX={0x8}, @IEEE802154_ATTR_LLSEC_KEY_MODE={0x5, 0x2b, 0x1}, @IEEE802154_ATTR_HW_ADDR={0xc, 0x5, {0xaaaaaaaaaaaa0002}}, @IEEE802154_ATTR_LLSEC_KEY_MODE={0x5, 0x2b, 0x3}]}, 0x54}, 0x1, 0x0, 0x0, 0x40}, 0x2000c814) clock_getres(0x3, &(0x7f0000000880)) r4 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) sendmsg$IEEE802154_ADD_IFACE(r4, &(0x7f0000000a00)={&(0x7f0000000900)={0x10, 0x0, 0x0, 0x40c}, 0xc, &(0x7f00000009c0)={&(0x7f0000000940)={0x44, r3, 0x200, 0x70bd29, 0x25dfdbfe, {}, [@IEEE802154_ATTR_PHY_NAME={0x9, 0x1f, 'phy1\x00'}, @IEEE802154_ATTR_DEV_NAME={0xa, 0x1, 'wpan4\x00'}, @IEEE802154_ATTR_DEV_NAME={0xa, 0x1, 'wpan1\x00'}, @IEEE802154_ATTR_DEV_NAME={0xa, 0x1, 'wpan0\x00'}]}, 0x44}, 0x1, 0x0, 0x0, 0x20000084}, 0x44000) 17:45:40 executing program 7: r0 = perf_event_open(&(0x7f0000000040)={0x4, 0x80, 0x6f, 0x8, 0x8, 0x1, 0x0, 0x6, 0x4, 0x1, 0x1, 0x0, 0x0, 0x1, 0x1, 0x1, 0x0, 0x0, 0x1, 0x0, 0x0, 0x1, 0x1, 0x0, 0x0, 0x2, 0x1, 0x0, 0x0, 0x1, 0x0, 0x0, 0x1, 0x0, 0x1, 0x0, 0x0, 0x0, 0x1, 0x1, 0x1, 0x0, 0x1, 0x1, 0x1, 0x0, 0x1, 0x0, 0x50, 0x2, @perf_bp={&(0x7f0000000000), 0xa}, 0x2100, 0x7, 0x1, 0x3, 0x6, 0x93d3, 0x0, 0x0, 0x3a, 0x0, 0x9}, 0xffffffffffffffff, 0xc, 0xffffffffffffffff, 0x8) mmap$perf(&(0x7f0000ffb000/0x2000)=nil, 0x2000, 0xb, 0x11, r0, 0x8) munmap(&(0x7f0000ffb000/0x3000)=nil, 0x3000) shmget(0x0, 0x1000, 0x200, &(0x7f0000ffd000/0x1000)=nil) 17:45:40 executing program 3: getsockopt$inet_udp_int(0xffffffffffffffff, 0x11, 0x1, &(0x7f0000000000), &(0x7f0000000040)=0x4) setsockopt$inet_udp_int(0xffffffffffffffff, 0x11, 0x1, &(0x7f0000000080)=0x7, 0x4) ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, &(0x7f0000000240)={0x54, 0x0, &(0x7f00000000c0)=[@acquire_done={0x40106309, 0x1}, @free_buffer, @request_death={0x400c630e, 0x1}, @request_death, @decrefs, @dead_binder_done], 0xc7, 0x0, &(0x7f0000000140)="aa36e0fef6a6cd3a6060f434b2a2306a435d6c33ca3bfb20c9d046886ded10cf23d0938b55b8a812702a5a7579cb8813f0cf3954f24fa081e8c35a9d4674b51115d91e7f6e38920909a8fba27ba7bbb0522974a9d83826c23d40a56c3f88dc24276a8312ae50d15d3531211e4378a34980ea70ac3cefef2439af0baa6b387df4ff26b593ca52e94dda8ce3656a81180693ab97746e30b1301f30922ec565bba820fc06168927e446c06efe1fc7cb37b804ba0342e58e70da81c074407ec9cf690a9ab1e3a62a68"}) openat$vcsa(0xffffffffffffff9c, &(0x7f0000000280), 0x1, 0x0) openat$vcsa(0xffffffffffffff9c, &(0x7f00000002c0), 0x80, 0x0) r0 = openat$nvram(0xffffffffffffff9c, &(0x7f0000000700), 0x800, 0x0) write$P9_RGETLOCK(r0, &(0x7f00000007c0)={0x1e, 0x37, 0x2, {0x2, 0x6, 0x101}}, 0x1e) 17:45:50 executing program 2: prctl$PR_MPX_ENABLE_MANAGEMENT(0x2b) r0 = socket$inet(0x2, 0x5, 0x4) r1 = openat$vcsu(0xffffffffffffff9c, &(0x7f0000000000), 0x3c1480, 0x0) ioctl$sock_ipv4_tunnel_SIOCGETTUNNEL(r1, 0x89f0, &(0x7f00000000c0)={'syztnl2\x00', &(0x7f0000000040)={'erspan0\x00', 0x0, 0x700, 0x40, 0x3, 0x22, {{0x15, 0x4, 0x3, 0x17, 0x54, 0x64, 0x0, 0x1, 0x2f, 0x0, @broadcast, @dev={0xac, 0x14, 0x14, 0x36}, {[@cipso={0x86, 0x3d, 0x1, [{0x5, 0x9, "c8a7bec58c2c80"}, {0x0, 0x9, "fabb6c2e64ba82"}, {0x7, 0xf, "6b1b69e07efcb7230cc07a2cf7"}, {0x1, 0x6, "a2118bdb"}, {0x5, 0x10, "67115d3e7766231c7b08cf3c48e4"}]}]}}}}}) prctl$PR_MPX_ENABLE_MANAGEMENT(0x2b) r2 = openat$vcsa(0xffffffffffffff9c, &(0x7f0000000100), 0x202c0, 0x0) ioctl$SNDRV_SEQ_IOCTL_GET_QUEUE_TEMPO(r2, 0xc02c5341, &(0x7f0000000140)) ioctl$SNDRV_TIMER_IOCTL_SELECT(r1, 0x40345410, &(0x7f00000001c0)={{0x0, 0x2, 0x3f, 0x3, 0x80000001}}) ioctl$SNDRV_SEQ_IOCTL_GET_QUEUE_TEMPO(r1, 0xc02c5341, &(0x7f0000000200)) ioctl$sock_inet_tcp_SIOCOUTQ(r0, 0x5411, &(0x7f0000000280)) r3 = syz_open_dev$evdev(&(0x7f00000002c0), 0x1, 0x50000) ioctl$EVIOCGLED(r3, 0x80404519, &(0x7f0000000300)=""/21) syz_open_procfs(0x0, &(0x7f0000000500)='schedstat\x00') 17:45:50 executing program 4: r0 = perf_event_open(&(0x7f00000000c0)={0x1, 0x80, 0x0, 0xc0, 0xfa, 0x1, 0x0, 0x7fffffff, 0x10811, 0x1, 0x1, 0x1, 0x1, 0x1, 0x1, 0x1, 0x1, 0x1, 0x0, 0x1, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x1, 0x0, 0x1, 0x0, 0x0, 0x0, 0x1, 0x1, 0x1, 0x1, 0x1, 0x1, 0x1, 0x0, 0x1, 0x1, 0x1, 0x1, 0x0, 0x0, 0xfff, 0x7, @perf_config_ext={0x7, 0x7fffffff}, 0x41000, 0x80000000, 0x5, 0x3, 0x9, 0x2, 0x9, 0x0, 0x5, 0x0, 0x4}, 0x0, 0xb, 0xffffffffffffffff, 0x1) perf_event_open(&(0x7f0000000040)={0x0, 0x80, 0x0, 0x40, 0x80, 0x9, 0x0, 0x3, 0x10040, 0x1, 0x0, 0x0, 0x1, 0x1, 0x1, 0x1, 0x1, 0x1, 0x1, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x3, 0x1, 0x0, 0x1, 0x0, 0x1, 0x1, 0x0, 0x0, 0x1, 0x1, 0x1, 0x0, 0x1, 0x0, 0x0, 0x0, 0x1, 0x0, 0x1, 0x0, 0x1, 0x0, 0x0, 0x1, @perf_bp={&(0x7f0000000000), 0x10}, 0x8080, 0x800, 0x2, 0x3, 0x36dc, 0x31df3b33, 0xff, 0x0, 0x9, 0x0, 0x5}, 0xffffffffffffffff, 0x9, r0, 0x9) ioctl$PERF_EVENT_IOC_PAUSE_OUTPUT(r0, 0x40042409, 0x0) ioctl$PERF_EVENT_IOC_PERIOD(0xffffffffffffffff, 0x40082404, &(0x7f0000000140)=0x8) r1 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl$sock_ipv4_tunnel_SIOCADDTUNNEL(r1, 0x89f1, &(0x7f00000001c0)={'syztnl1\x00', &(0x7f0000000180)={'syztnl0\x00', 0x0, 0x1, 0x40, 0x0, 0x5, {{0x5, 0x4, 0x2, 0x19, 0x14, 0x65, 0x0, 0x1f, 0x4, 0x0, @multicast2, @remote}}}}) ioctl$PERF_EVENT_IOC_PERIOD(r0, 0x40082404, &(0x7f0000000200)=0x9) ioctl$SNDRV_SEQ_IOCTL_GET_PORT_INFO(0xffffffffffffffff, 0xc0a85322, &(0x7f0000000240)) ioctl$SNDRV_SEQ_IOCTL_SYSTEM_INFO(0xffffffffffffffff, 0xc0305302, &(0x7f0000000300)={0x9, 0x101, 0x1, 0x6, 0x3, 0x5}) r2 = syz_open_procfs(0x0, &(0x7f0000000340)='children\x00') openat$cgroup_type(r2, &(0x7f0000000380), 0x2, 0x0) ioctl$EVIOCGABS20(r2, 0x80184560, &(0x7f00000003c0)=""/4096) socket$inet6_tcp(0xa, 0x1, 0x0) 17:45:50 executing program 1: shmget$private(0x0, 0x4000, 0x80, &(0x7f0000ffb000/0x4000)=nil) shmget(0x3, 0x2000, 0x4, &(0x7f0000ffc000/0x2000)=nil) mlock(&(0x7f0000ff0000/0x10000)=nil, 0x10000) shmget(0x1, 0x1000, 0x10, &(0x7f0000ff5000/0x1000)=nil) ioctl$sock_ipv4_tunnel_SIOCGETTUNNEL(0xffffffffffffffff, 0x89f0, &(0x7f0000000140)={'syztnl1\x00', &(0x7f00000000c0)={'syztnl2\x00', 0x0, 0x20, 0x1, 0x6, 0x9, {{0xd, 0x4, 0x1, 0x19, 0x34, 0x68, 0x0, 0x9, 0x29, 0x0, @empty, @dev={0xac, 0x14, 0x14, 0x29}, {[@timestamp_addr={0x44, 0x14, 0xc2, 0x1, 0x4, [{@multicast1}, {@private=0xa010101}]}, @rr={0x7, 0xb, 0xc8, [@initdev={0xac, 0x1e, 0x1, 0x0}, @private=0xa010102]}]}}}}}) ioctl$sock_ipv4_tunnel_SIOCADDTUNNEL(0xffffffffffffffff, 0x89f1, &(0x7f0000000280)={'tunl0\x00', &(0x7f0000000180)={'tunl0\x00', r0, 0x7, 0x8000, 0xfffffffc, 0x8, {{0x2f, 0x4, 0x0, 0x2, 0xbc, 0x65, 0x0, 0x0, 0x4, 0x0, @empty, @broadcast, {[@generic={0x89, 0x9, "8db1d464c6af68"}, @noop, @ra={0x94, 0x4, 0x1}, @timestamp={0x44, 0x1c, 0x53, 0x0, 0x7, [0x40, 0x7fffffff, 0xfffffffd, 0x5, 0x5c, 0x77]}, @cipso={0x86, 0x2f, 0x3, [{0x1, 0x4, "1eba"}, {0x1, 0x7, "e3ccb5ddcf"}, {0x6, 0xa, "5db18b961780af33"}, {0x2, 0xe, "7353a9824b57fd7d39232ac5"}, {0x1, 0x6, "2e1ccd27"}]}, @noop, @cipso={0x86, 0x37, 0xffffffffffffffff, [{0x2, 0xf, "227467028cabd4e137b820c5c9"}, {0x7, 0x6, "90569992"}, {0x2, 0xc, "2071b0a8c9ce92782e72"}, {0x6, 0xa, "14f2b9bca55ce3dd"}, {0x6, 0x6, "2cd22a8f"}]}, @timestamp={0x44, 0x14, 0xd4, 0x0, 0x5, [0x81, 0x5d23, 0x63ab, 0x1]}]}}}}}) ioctl$sock_ipv4_tunnel_SIOCDELTUNNEL(0xffffffffffffffff, 0x89f2, &(0x7f0000000380)={'gretap0\x00', &(0x7f00000002c0)={'syztnl2\x00', 0x0, 0x7800, 0x7, 0x40, 0xe180, {{0x22, 0x4, 0x0, 0x1, 0x88, 0x64, 0x0, 0x1, 0x29, 0x0, @multicast2, @multicast1, {[@end, @lsrr={0x83, 0x1f, 0x2f, [@multicast2, @local, @local, @multicast1, @rand_addr=0x64010102, @loopback, @private=0xa010100]}, @rr={0x7, 0x27, 0x6c, [@multicast1, @rand_addr=0x64010102, @remote, @multicast1, @loopback, @initdev={0xac, 0x1e, 0x0, 0x0}, @initdev={0xac, 0x1e, 0x1, 0x0}, @broadcast, @empty]}, @ra={0x94, 0x4, 0x1}, @timestamp={0x44, 0x10, 0x2d, 0x0, 0x8, [0x1, 0x100, 0x401]}, @ssrr={0x89, 0x13, 0x56, [@dev={0xac, 0x14, 0x14, 0x28}, @multicast2, @initdev={0xac, 0x1e, 0x0, 0x0}, @remote]}, @ra={0x94, 0x4, 0x1}]}}}}}) shmget(0x3, 0x4000, 0x4, &(0x7f0000ff9000/0x4000)=nil) mmap$IORING_OFF_CQ_RING(&(0x7f0000ffd000/0x3000)=nil, 0x3000, 0x2000008, 0x30, 0xffffffffffffffff, 0x8000000) r1 = syz_genetlink_get_family_id$nl802154(&(0x7f0000000400), 0xffffffffffffffff) ioctl$sock_SIOCGIFINDEX_802154(0xffffffffffffffff, 0x8933, &(0x7f0000000440)={'wpan1\x00', 0x0}) sendmsg$NL802154_CMD_NEW_INTERFACE(0xffffffffffffffff, &(0x7f0000000540)={&(0x7f00000003c0)={0x10, 0x0, 0x0, 0x2}, 0xc, &(0x7f0000000500)={&(0x7f0000000480)={0x48, r1, 0x200, 0x70bd2a, 0x25dfdbfd, {}, [@NL802154_ATTR_IFNAME={0xa, 0x4, 'wpan0\x00'}, @NL802154_ATTR_IFINDEX={0x8}, @NL802154_ATTR_IFNAME={0xa, 0x4, 'wpan1\x00'}, @NL802154_ATTR_EXTENDED_ADDR={0xc, 0x17, {0xaaaaaaaaaaaa0002}}, @NL802154_ATTR_IFINDEX={0x8, 0x3, r2}]}, 0x48}}, 0x4001) r3 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) sendmsg$IEEE802154_LLSEC_ADD_SECLEVEL(r3, &(0x7f00000006c0)={&(0x7f0000000580)={0x10, 0x0, 0x0, 0x4000000}, 0xc, &(0x7f0000000680)={&(0x7f0000000600)={0x44, 0x0, 0x200, 0x70bd2a, 0x25dfdbff, {}, [@IEEE802154_ATTR_LLSEC_FRAME_TYPE={0x5, 0x33, 0x34}, @IEEE802154_ATTR_DEV_INDEX={0x8}, @IEEE802154_ATTR_LLSEC_CMD_FRAME_ID={0x5, 0x34, 0x1}, @IEEE802154_ATTR_DEV_NAME={0xa, 0x1, 'wpan0\x00'}, @IEEE802154_ATTR_DEV_NAME={0xa, 0x1, 'wpan4\x00'}]}, 0x44}, 0x1, 0x0, 0x0, 0x8800}, 0x0) sendmsg$IEEE802154_START_REQ(r3, &(0x7f00000007c0)={&(0x7f0000000700)={0x10, 0x0, 0x0, 0x4}, 0xc, &(0x7f0000000780)={&(0x7f0000000740)={0x1c, 0x0, 0x200, 0x70bd2d, 0x25dfdbfb, {}, [@IEEE802154_ATTR_CHANNEL={0x5, 0x7, 0x6}]}, 0x1c}, 0x1, 0x0, 0x0, 0x40100}, 0x801) mlock(&(0x7f0000fef000/0x1000)=nil, 0x1000) syz_io_uring_setup(0x4726, &(0x7f0000000840)={0x0, 0x502f, 0x20, 0x0, 0x12e}, &(0x7f0000ffe000/0x2000)=nil, &(0x7f0000ffb000/0x4000)=nil, &(0x7f00000008c0), &(0x7f0000000900)) 17:45:50 executing program 0: get_thread_area(&(0x7f0000000000)={0x7, 0x20000800, 0x4000, 0x0, 0x1, 0x0, 0x0, 0x1, 0x1, 0x1}) r0 = openat$vcsu(0xffffffffffffff9c, &(0x7f0000000040), 0x200000, 0x0) getsockopt$inet_tcp_TCP_REPAIR_WINDOW(r0, 0x6, 0x1d, &(0x7f0000000080), &(0x7f00000000c0)=0x14) r1 = openat$nvram(0xffffffffffffff9c, &(0x7f0000000100), 0x2000, 0x0) setsockopt$inet_tcp_TCP_FASTOPEN_KEY(r1, 0x6, 0x21, &(0x7f0000000140)="1bb9d563048b6ec78effc0f14d974b17", 0x10) setsockopt$inet_tcp_int(r1, 0x6, 0x1b, &(0x7f0000000180)=0x5, 0x4) ioctl$SNDRV_TIMER_IOCTL_STATUS32(r1, 0x80585414, &(0x7f00000001c0)) setsockopt$inet_tcp_TCP_QUEUE_SEQ(r0, 0x6, 0x15, &(0x7f0000000240)=0x1, 0x4) getsockopt$inet_tcp_TCP_ZEROCOPY_RECEIVE(r1, 0x6, 0x23, &(0x7f0000000340)={&(0x7f0000ffc000/0x2000)=nil, 0x2000, 0x0, 0x0, 0x0, &(0x7f0000000280)=""/37, 0x25, 0x1, &(0x7f00000002c0)=""/109, 0x6d}, &(0x7f0000000380)=0x40) r2 = socket$inet_tcp(0x2, 0x1, 0x0) ioctl$sock_inet_tcp_SIOCINQ(r2, 0x541b, &(0x7f00000003c0)) move_pages(0x0, 0x8, &(0x7f0000000400)=[&(0x7f0000ffd000/0x1000)=nil, &(0x7f0000ffd000/0x3000)=nil, &(0x7f0000ffd000/0x3000)=nil, &(0x7f0000ffb000/0x2000)=nil, &(0x7f0000ffc000/0x1000)=nil, &(0x7f0000ffe000/0x2000)=nil, &(0x7f0000ffb000/0x4000)=nil, &(0x7f0000ffd000/0x3000)=nil], &(0x7f0000000440)=[0xfff], &(0x7f0000000480)=[0x0, 0x0, 0x0], 0x4) sendmsg$SEG6_CMD_GET_TUNSRC(r0, &(0x7f00000005c0)={&(0x7f00000004c0)={0x10, 0x0, 0x0, 0x4000000}, 0xc, &(0x7f0000000580)={&(0x7f0000000540)={0x38, 0x0, 0x300, 0x70bd2a, 0x25dfdbfc, {}, [@SEG6_ATTR_HMACKEYID={0x8, 0x3, 0x24}, @SEG6_ATTR_DST={0x14, 0x1, @mcast1}, @SEG6_ATTR_DSTLEN={0x8, 0x2, 0x2}]}, 0x38}, 0x1, 0x0, 0x0, 0x20008810}, 0x4040010) sendmsg$SEG6_CMD_DUMPHMAC(0xffffffffffffffff, &(0x7f0000000740)={&(0x7f0000000680)={0x10, 0x0, 0x0, 0x240000}, 0xc, &(0x7f0000000700)={&(0x7f00000006c0)={0x2c, 0x0, 0x1, 0x70bd2c, 0x25dfdbfe, {}, [@SEG6_ATTR_SECRET={0x8, 0x4, [0x1]}, @SEG6_ATTR_DSTLEN={0x8, 0x2, 0x5}, @SEG6_ATTR_DSTLEN={0x8}]}, 0x2c}, 0x1, 0x0, 0x0, 0x4000000}, 0x4000000) pidfd_getfd(r1, r2, 0x0) syz_genetlink_get_family_id$ieee802154(&(0x7f0000000800), 0xffffffffffffffff) 17:45:50 executing program 5: clock_gettime(0x5, &(0x7f0000000000)) clock_settime(0x2, &(0x7f0000000040)) sched_rr_get_interval(0xffffffffffffffff, &(0x7f0000000080)) sched_rr_get_interval(0x0, &(0x7f00000000c0)) sendmsg$NL802154_CMD_GET_SEC_KEY(0xffffffffffffffff, &(0x7f00000001c0)={&(0x7f0000000100)={0x10, 0x0, 0x0, 0x20000000}, 0xc, &(0x7f0000000180)={&(0x7f0000000140)={0x24, 0x0, 0x200, 0x70bd26, 0x25dfdbfe, {}, [@NL802154_ATTR_IFINDEX={0x8}, @NL802154_ATTR_IFINDEX={0x8}]}, 0x24}, 0x1, 0x0, 0x0, 0x4000000}, 0x181) clock_gettime(0x0, &(0x7f0000000200)) pipe2$9p(&(0x7f0000000240)={0xffffffffffffffff, 0xffffffffffffffff}, 0x800) r1 = syz_io_uring_setup(0x776a, &(0x7f0000000280)={0x0, 0x2728, 0x2, 0x1, 0x37c}, &(0x7f0000000000/0x3000)=nil, &(0x7f0000000000/0x400000)=nil, &(0x7f0000000300), &(0x7f0000000340)) ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, &(0x7f0000000540)={0x64, 0x0, &(0x7f0000000440)=[@transaction_sg={0x40486311, {0x1, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x50, 0x18, &(0x7f0000000380)={@fd={0x66642a85, 0x0, r0}, @fd={0x66642a85, 0x0, r1}, @fda={0x66646185, 0x0, 0x2, 0x36}}, &(0x7f0000000400)={0x0, 0x18, 0x30}}}, @request_death, @release={0x40046306, 0x1}], 0x7e, 0x0, &(0x7f00000004c0)="7685c519d1cbea63a1a8f022f8c0085baf770aa5d1fa9bfb1a5399fdb134953d619e962218bba650b68d6206fde39ff17760aa4bbcb62f6802c48e17294a17a3b768ab60bbae37aa37e33e24b09f6bdea37853f7ab2622451803788c9d172b7d71d6d87911129b8ef5cc9e0169404b09abfa991f3a7a3640686df445d387"}) pipe2$9p(&(0x7f0000000580), 0x800) ioctl$EVIOCGVERSION(0xffffffffffffffff, 0x80044501, &(0x7f00000005c0)=""/174) openat$nvram(0xffffffffffffff9c, &(0x7f0000000680), 0x400, 0x0) r2 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r3 = syz_genetlink_get_family_id$ieee802154(&(0x7f0000000740), 0xffffffffffffffff) sendmsg$IEEE802154_LLSEC_DEL_KEY(r2, &(0x7f0000000840)={&(0x7f0000000700)={0x10, 0x0, 0x0, 0x800000}, 0xc, &(0x7f0000000800)={&(0x7f0000000780)={0x54, r3, 0x800, 0x70bd27, 0x25dfdbfc, {}, [@IEEE802154_ATTR_LLSEC_KEY_SOURCE_SHORT={0x8, 0x2c, 0x5}, @IEEE802154_ATTR_LLSEC_KEY_SOURCE_EXTENDED={0xc, 0x2d, {0xaaaaaaaaaaaa0002}}, @IEEE802154_ATTR_PAN_ID={0x6, 0x6, 0x2}, @IEEE802154_ATTR_DEV_INDEX={0x8}, @IEEE802154_ATTR_LLSEC_KEY_MODE={0x5, 0x2b, 0x1}, @IEEE802154_ATTR_HW_ADDR={0xc, 0x5, {0xaaaaaaaaaaaa0002}}, @IEEE802154_ATTR_LLSEC_KEY_MODE={0x5, 0x2b, 0x3}]}, 0x54}, 0x1, 0x0, 0x0, 0x40}, 0x2000c814) clock_getres(0x3, &(0x7f0000000880)) r4 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) sendmsg$IEEE802154_ADD_IFACE(r4, &(0x7f0000000a00)={&(0x7f0000000900)={0x10, 0x0, 0x0, 0x40c}, 0xc, &(0x7f00000009c0)={&(0x7f0000000940)={0x44, r3, 0x200, 0x70bd29, 0x25dfdbfe, {}, [@IEEE802154_ATTR_PHY_NAME={0x9, 0x1f, 'phy1\x00'}, @IEEE802154_ATTR_DEV_NAME={0xa, 0x1, 'wpan4\x00'}, @IEEE802154_ATTR_DEV_NAME={0xa, 0x1, 'wpan1\x00'}, @IEEE802154_ATTR_DEV_NAME={0xa, 0x1, 'wpan0\x00'}]}, 0x44}, 0x1, 0x0, 0x0, 0x20000084}, 0x44000) 17:45:50 executing program 3: getsockopt$inet_udp_int(0xffffffffffffffff, 0x11, 0x1, &(0x7f0000000000), &(0x7f0000000040)=0x4) setsockopt$inet_udp_int(0xffffffffffffffff, 0x11, 0x1, &(0x7f0000000080)=0x7, 0x4) ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, &(0x7f0000000240)={0x54, 0x0, &(0x7f00000000c0)=[@acquire_done={0x40106309, 0x1}, @free_buffer, @request_death={0x400c630e, 0x1}, @request_death, @decrefs, @dead_binder_done], 0xc7, 0x0, &(0x7f0000000140)="aa36e0fef6a6cd3a6060f434b2a2306a435d6c33ca3bfb20c9d046886ded10cf23d0938b55b8a812702a5a7579cb8813f0cf3954f24fa081e8c35a9d4674b51115d91e7f6e38920909a8fba27ba7bbb0522974a9d83826c23d40a56c3f88dc24276a8312ae50d15d3531211e4378a34980ea70ac3cefef2439af0baa6b387df4ff26b593ca52e94dda8ce3656a81180693ab97746e30b1301f30922ec565bba820fc06168927e446c06efe1fc7cb37b804ba0342e58e70da81c074407ec9cf690a9ab1e3a62a68"}) openat$vcsa(0xffffffffffffff9c, &(0x7f0000000280), 0x1, 0x0) r0 = openat$nvram(0xffffffffffffff9c, &(0x7f0000000700), 0x800, 0x0) write$P9_RGETLOCK(r0, &(0x7f00000007c0)={0x1e, 0x37, 0x2, {0x2, 0x6, 0x101}}, 0x1e) 17:45:50 executing program 6: r0 = perf_event_open(&(0x7f00000000c0)={0x1, 0x80, 0x0, 0xc0, 0xfa, 0x1, 0x0, 0x7fffffff, 0x10811, 0x1, 0x1, 0x1, 0x1, 0x1, 0x1, 0x1, 0x1, 0x1, 0x0, 0x1, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x1, 0x0, 0x1, 0x0, 0x0, 0x0, 0x1, 0x1, 0x1, 0x1, 0x1, 0x1, 0x1, 0x0, 0x1, 0x1, 0x1, 0x1, 0x0, 0x0, 0xfff, 0x7, @perf_config_ext={0x7, 0x7fffffff}, 0x41000, 0x80000000, 0x5, 0x3, 0x9, 0x2, 0x9, 0x0, 0x5, 0x0, 0x4}, 0x0, 0xb, 0xffffffffffffffff, 0x1) perf_event_open(&(0x7f0000000040)={0x0, 0x80, 0x0, 0x40, 0x80, 0x9, 0x0, 0x3, 0x10040, 0x1, 0x0, 0x0, 0x1, 0x1, 0x1, 0x1, 0x1, 0x1, 0x1, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x3, 0x1, 0x0, 0x1, 0x0, 0x1, 0x1, 0x0, 0x0, 0x1, 0x1, 0x1, 0x0, 0x1, 0x0, 0x0, 0x0, 0x1, 0x0, 0x1, 0x0, 0x1, 0x0, 0x0, 0x1, @perf_bp={&(0x7f0000000000), 0x10}, 0x8080, 0x800, 0x2, 0x3, 0x36dc, 0x31df3b33, 0xff, 0x0, 0x9, 0x0, 0x5}, 0xffffffffffffffff, 0x9, r0, 0x9) ioctl$PERF_EVENT_IOC_PAUSE_OUTPUT(r0, 0x40042409, 0x0) ioctl$PERF_EVENT_IOC_PERIOD(0xffffffffffffffff, 0x40082404, &(0x7f0000000140)=0x8) r1 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl$sock_ipv4_tunnel_SIOCADDTUNNEL(r1, 0x89f1, &(0x7f00000001c0)={'syztnl1\x00', &(0x7f0000000180)={'syztnl0\x00', 0x0, 0x1, 0x40, 0x0, 0x5, {{0x5, 0x4, 0x2, 0x19, 0x14, 0x65, 0x0, 0x1f, 0x4, 0x0, @multicast2, @remote}}}}) ioctl$PERF_EVENT_IOC_PERIOD(r0, 0x40082404, &(0x7f0000000200)=0x9) ioctl$SNDRV_SEQ_IOCTL_GET_PORT_INFO(0xffffffffffffffff, 0xc0a85322, &(0x7f0000000240)) ioctl$SNDRV_SEQ_IOCTL_SYSTEM_INFO(0xffffffffffffffff, 0xc0305302, &(0x7f0000000300)={0x9, 0x101, 0x1, 0x6, 0x3, 0x5}) write$cgroup_type(0xffffffffffffffff, &(0x7f0000001500), 0x9) 17:45:50 executing program 7: r0 = perf_event_open(&(0x7f0000000040)={0x4, 0x80, 0x6f, 0x8, 0x8, 0x1, 0x0, 0x6, 0x4, 0x1, 0x1, 0x0, 0x0, 0x1, 0x1, 0x1, 0x0, 0x0, 0x1, 0x0, 0x0, 0x1, 0x1, 0x0, 0x0, 0x2, 0x1, 0x0, 0x0, 0x1, 0x0, 0x0, 0x1, 0x0, 0x1, 0x0, 0x0, 0x0, 0x1, 0x1, 0x1, 0x0, 0x1, 0x1, 0x1, 0x0, 0x1, 0x0, 0x50, 0x2, @perf_bp={&(0x7f0000000000), 0xa}, 0x2100, 0x7, 0x1, 0x3, 0x6, 0x93d3, 0x0, 0x0, 0x3a, 0x0, 0x9}, 0xffffffffffffffff, 0xc, 0xffffffffffffffff, 0x8) mmap$perf(&(0x7f0000ffb000/0x2000)=nil, 0x2000, 0xb, 0x11, r0, 0x8) shmget(0x0, 0x1000, 0x200, &(0x7f0000ffd000/0x1000)=nil) 17:45:50 executing program 3: getsockopt$inet_udp_int(0xffffffffffffffff, 0x11, 0x1, &(0x7f0000000000), &(0x7f0000000040)=0x4) setsockopt$inet_udp_int(0xffffffffffffffff, 0x11, 0x1, &(0x7f0000000080)=0x7, 0x4) ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, &(0x7f0000000240)={0x54, 0x0, &(0x7f00000000c0)=[@acquire_done={0x40106309, 0x1}, @free_buffer, @request_death={0x400c630e, 0x1}, @request_death, @decrefs, @dead_binder_done], 0xc7, 0x0, &(0x7f0000000140)="aa36e0fef6a6cd3a6060f434b2a2306a435d6c33ca3bfb20c9d046886ded10cf23d0938b55b8a812702a5a7579cb8813f0cf3954f24fa081e8c35a9d4674b51115d91e7f6e38920909a8fba27ba7bbb0522974a9d83826c23d40a56c3f88dc24276a8312ae50d15d3531211e4378a34980ea70ac3cefef2439af0baa6b387df4ff26b593ca52e94dda8ce3656a81180693ab97746e30b1301f30922ec565bba820fc06168927e446c06efe1fc7cb37b804ba0342e58e70da81c074407ec9cf690a9ab1e3a62a68"}) r0 = openat$nvram(0xffffffffffffff9c, &(0x7f0000000700), 0x800, 0x0) write$P9_RGETLOCK(r0, &(0x7f00000007c0)={0x1e, 0x37, 0x2, {0x2, 0x6, 0x101}}, 0x1e) 17:45:50 executing program 5: clock_gettime(0x5, &(0x7f0000000000)) clock_settime(0x2, &(0x7f0000000040)) sched_rr_get_interval(0xffffffffffffffff, &(0x7f0000000080)) sched_rr_get_interval(0x0, &(0x7f00000000c0)) sendmsg$NL802154_CMD_GET_SEC_KEY(0xffffffffffffffff, &(0x7f00000001c0)={&(0x7f0000000100)={0x10, 0x0, 0x0, 0x20000000}, 0xc, &(0x7f0000000180)={&(0x7f0000000140)={0x24, 0x0, 0x200, 0x70bd26, 0x25dfdbfe, {}, [@NL802154_ATTR_IFINDEX={0x8}, @NL802154_ATTR_IFINDEX={0x8}]}, 0x24}, 0x1, 0x0, 0x0, 0x4000000}, 0x181) clock_gettime(0x0, &(0x7f0000000200)) pipe2$9p(&(0x7f0000000240)={0xffffffffffffffff, 0xffffffffffffffff}, 0x800) r1 = syz_io_uring_setup(0x776a, &(0x7f0000000280)={0x0, 0x2728, 0x2, 0x1, 0x37c}, &(0x7f0000000000/0x3000)=nil, &(0x7f0000000000/0x400000)=nil, &(0x7f0000000300), &(0x7f0000000340)) ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, &(0x7f0000000540)={0x64, 0x0, &(0x7f0000000440)=[@transaction_sg={0x40486311, {0x1, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x50, 0x18, &(0x7f0000000380)={@fd={0x66642a85, 0x0, r0}, @fd={0x66642a85, 0x0, r1}, @fda={0x66646185, 0x0, 0x2, 0x36}}, &(0x7f0000000400)={0x0, 0x18, 0x30}}}, @request_death, @release={0x40046306, 0x1}], 0x7e, 0x0, &(0x7f00000004c0)="7685c519d1cbea63a1a8f022f8c0085baf770aa5d1fa9bfb1a5399fdb134953d619e962218bba650b68d6206fde39ff17760aa4bbcb62f6802c48e17294a17a3b768ab60bbae37aa37e33e24b09f6bdea37853f7ab2622451803788c9d172b7d71d6d87911129b8ef5cc9e0169404b09abfa991f3a7a3640686df445d387"}) pipe2$9p(&(0x7f0000000580), 0x800) ioctl$EVIOCGVERSION(0xffffffffffffffff, 0x80044501, &(0x7f00000005c0)=""/174) r2 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r3 = syz_genetlink_get_family_id$ieee802154(&(0x7f0000000740), 0xffffffffffffffff) sendmsg$IEEE802154_LLSEC_DEL_KEY(r2, &(0x7f0000000840)={&(0x7f0000000700)={0x10, 0x0, 0x0, 0x800000}, 0xc, &(0x7f0000000800)={&(0x7f0000000780)={0x54, r3, 0x800, 0x70bd27, 0x25dfdbfc, {}, [@IEEE802154_ATTR_LLSEC_KEY_SOURCE_SHORT={0x8, 0x2c, 0x5}, @IEEE802154_ATTR_LLSEC_KEY_SOURCE_EXTENDED={0xc, 0x2d, {0xaaaaaaaaaaaa0002}}, @IEEE802154_ATTR_PAN_ID={0x6, 0x6, 0x2}, @IEEE802154_ATTR_DEV_INDEX={0x8}, @IEEE802154_ATTR_LLSEC_KEY_MODE={0x5, 0x2b, 0x1}, @IEEE802154_ATTR_HW_ADDR={0xc, 0x5, {0xaaaaaaaaaaaa0002}}, @IEEE802154_ATTR_LLSEC_KEY_MODE={0x5, 0x2b, 0x3}]}, 0x54}, 0x1, 0x0, 0x0, 0x40}, 0x2000c814) clock_getres(0x3, &(0x7f0000000880)) r4 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) sendmsg$IEEE802154_ADD_IFACE(r4, &(0x7f0000000a00)={&(0x7f0000000900)={0x10, 0x0, 0x0, 0x40c}, 0xc, &(0x7f00000009c0)={&(0x7f0000000940)={0x44, r3, 0x200, 0x70bd29, 0x25dfdbfe, {}, [@IEEE802154_ATTR_PHY_NAME={0x9, 0x1f, 'phy1\x00'}, @IEEE802154_ATTR_DEV_NAME={0xa, 0x1, 'wpan4\x00'}, @IEEE802154_ATTR_DEV_NAME={0xa, 0x1, 'wpan1\x00'}, @IEEE802154_ATTR_DEV_NAME={0xa, 0x1, 'wpan0\x00'}]}, 0x44}, 0x1, 0x0, 0x0, 0x20000084}, 0x44000) 17:45:50 executing program 7: perf_event_open(&(0x7f0000000040)={0x4, 0x80, 0x6f, 0x8, 0x8, 0x1, 0x0, 0x6, 0x4, 0x1, 0x1, 0x0, 0x0, 0x1, 0x1, 0x1, 0x0, 0x0, 0x1, 0x0, 0x0, 0x1, 0x1, 0x0, 0x0, 0x2, 0x1, 0x0, 0x0, 0x1, 0x0, 0x0, 0x1, 0x0, 0x1, 0x0, 0x0, 0x0, 0x1, 0x1, 0x1, 0x0, 0x1, 0x1, 0x1, 0x0, 0x1, 0x0, 0x50, 0x2, @perf_bp={&(0x7f0000000000), 0xa}, 0x2100, 0x7, 0x1, 0x3, 0x6, 0x93d3, 0x0, 0x0, 0x3a, 0x0, 0x9}, 0xffffffffffffffff, 0xc, 0xffffffffffffffff, 0x8) shmget(0x0, 0x1000, 0x200, &(0x7f0000ffd000/0x1000)=nil) 17:45:50 executing program 0: get_thread_area(&(0x7f0000000000)={0x7, 0x20000800, 0x4000, 0x0, 0x1, 0x0, 0x0, 0x1, 0x1, 0x1}) r0 = openat$vcsu(0xffffffffffffff9c, &(0x7f0000000040), 0x200000, 0x0) getsockopt$inet_tcp_TCP_REPAIR_WINDOW(r0, 0x6, 0x1d, &(0x7f0000000080), &(0x7f00000000c0)=0x14) r1 = openat$nvram(0xffffffffffffff9c, &(0x7f0000000100), 0x2000, 0x0) setsockopt$inet_tcp_TCP_FASTOPEN_KEY(r1, 0x6, 0x21, &(0x7f0000000140)="1bb9d563048b6ec78effc0f14d974b17", 0x10) setsockopt$inet_tcp_int(r1, 0x6, 0x1b, &(0x7f0000000180)=0x5, 0x4) ioctl$SNDRV_TIMER_IOCTL_STATUS32(r1, 0x80585414, &(0x7f00000001c0)) setsockopt$inet_tcp_TCP_QUEUE_SEQ(r0, 0x6, 0x15, &(0x7f0000000240)=0x1, 0x4) getsockopt$inet_tcp_TCP_ZEROCOPY_RECEIVE(r1, 0x6, 0x23, &(0x7f0000000340)={&(0x7f0000ffc000/0x2000)=nil, 0x2000, 0x0, 0x0, 0x0, &(0x7f0000000280)=""/37, 0x25, 0x1, &(0x7f00000002c0)=""/109, 0x6d}, &(0x7f0000000380)=0x40) r2 = socket$inet_tcp(0x2, 0x1, 0x0) ioctl$sock_inet_tcp_SIOCINQ(r2, 0x541b, &(0x7f00000003c0)) move_pages(0x0, 0x8, &(0x7f0000000400)=[&(0x7f0000ffd000/0x1000)=nil, &(0x7f0000ffd000/0x3000)=nil, &(0x7f0000ffd000/0x3000)=nil, &(0x7f0000ffb000/0x2000)=nil, &(0x7f0000ffc000/0x1000)=nil, &(0x7f0000ffe000/0x2000)=nil, &(0x7f0000ffb000/0x4000)=nil, &(0x7f0000ffd000/0x3000)=nil], &(0x7f0000000440)=[0xfff], &(0x7f0000000480)=[0x0, 0x0, 0x0], 0x4) sendmsg$SEG6_CMD_GET_TUNSRC(r0, &(0x7f00000005c0)={&(0x7f00000004c0)={0x10, 0x0, 0x0, 0x4000000}, 0xc, &(0x7f0000000580)={&(0x7f0000000540)={0x38, 0x0, 0x300, 0x70bd2a, 0x25dfdbfc, {}, [@SEG6_ATTR_HMACKEYID={0x8, 0x3, 0x24}, @SEG6_ATTR_DST={0x14, 0x1, @mcast1}, @SEG6_ATTR_DSTLEN={0x8, 0x2, 0x2}]}, 0x38}, 0x1, 0x0, 0x0, 0x20008810}, 0x4040010) sendmsg$SEG6_CMD_DUMPHMAC(0xffffffffffffffff, &(0x7f0000000740)={&(0x7f0000000680)={0x10, 0x0, 0x0, 0x240000}, 0xc, &(0x7f0000000700)={&(0x7f00000006c0)={0x2c, 0x0, 0x1, 0x70bd2c, 0x25dfdbfe, {}, [@SEG6_ATTR_SECRET={0x8, 0x4, [0x1]}, @SEG6_ATTR_DSTLEN={0x8, 0x2, 0x5}, @SEG6_ATTR_DSTLEN={0x8}]}, 0x2c}, 0x1, 0x0, 0x0, 0x4000000}, 0x4000000) pidfd_getfd(r1, r2, 0x0) syz_genetlink_get_family_id$ieee802154(&(0x7f0000000800), 0xffffffffffffffff) 17:45:59 executing program 3: getsockopt$inet_udp_int(0xffffffffffffffff, 0x11, 0x1, &(0x7f0000000000), &(0x7f0000000040)=0x4) setsockopt$inet_udp_int(0xffffffffffffffff, 0x11, 0x1, &(0x7f0000000080)=0x7, 0x4) r0 = openat$nvram(0xffffffffffffff9c, &(0x7f0000000700), 0x800, 0x0) write$P9_RGETLOCK(r0, &(0x7f00000007c0)={0x1e, 0x37, 0x2, {0x2, 0x6, 0x101}}, 0x1e) 17:45:59 executing program 6: r0 = perf_event_open(&(0x7f00000000c0)={0x1, 0x80, 0x0, 0xc0, 0xfa, 0x1, 0x0, 0x7fffffff, 0x10811, 0x1, 0x1, 0x1, 0x1, 0x1, 0x1, 0x1, 0x1, 0x1, 0x0, 0x1, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x1, 0x0, 0x1, 0x0, 0x0, 0x0, 0x1, 0x1, 0x1, 0x1, 0x1, 0x1, 0x1, 0x0, 0x1, 0x1, 0x1, 0x1, 0x0, 0x0, 0xfff, 0x7, @perf_config_ext={0x7, 0x7fffffff}, 0x41000, 0x80000000, 0x5, 0x3, 0x9, 0x2, 0x9, 0x0, 0x5, 0x0, 0x4}, 0x0, 0xb, 0xffffffffffffffff, 0x1) perf_event_open(&(0x7f0000000040)={0x0, 0x80, 0x0, 0x40, 0x80, 0x9, 0x0, 0x3, 0x10040, 0x1, 0x0, 0x0, 0x1, 0x1, 0x1, 0x1, 0x1, 0x1, 0x1, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x3, 0x1, 0x0, 0x1, 0x0, 0x1, 0x1, 0x0, 0x0, 0x1, 0x1, 0x1, 0x0, 0x1, 0x0, 0x0, 0x0, 0x1, 0x0, 0x1, 0x0, 0x1, 0x0, 0x0, 0x1, @perf_bp={&(0x7f0000000000), 0x10}, 0x8080, 0x800, 0x2, 0x3, 0x36dc, 0x31df3b33, 0xff, 0x0, 0x9, 0x0, 0x5}, 0xffffffffffffffff, 0x9, r0, 0x9) ioctl$PERF_EVENT_IOC_PAUSE_OUTPUT(r0, 0x40042409, 0x0) ioctl$PERF_EVENT_IOC_PERIOD(0xffffffffffffffff, 0x40082404, &(0x7f0000000140)=0x8) r1 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl$sock_ipv4_tunnel_SIOCADDTUNNEL(r1, 0x89f1, &(0x7f00000001c0)={'syztnl1\x00', &(0x7f0000000180)={'syztnl0\x00', 0x0, 0x1, 0x40, 0x0, 0x5, {{0x5, 0x4, 0x2, 0x19, 0x14, 0x65, 0x0, 0x1f, 0x4, 0x0, @multicast2, @remote}}}}) ioctl$PERF_EVENT_IOC_PERIOD(r0, 0x40082404, &(0x7f0000000200)=0x9) ioctl$SNDRV_SEQ_IOCTL_GET_PORT_INFO(0xffffffffffffffff, 0xc0a85322, &(0x7f0000000240)) write$cgroup_type(0xffffffffffffffff, &(0x7f0000001500), 0x9) 17:45:59 executing program 5: clock_gettime(0x5, &(0x7f0000000000)) clock_settime(0x2, &(0x7f0000000040)) sched_rr_get_interval(0xffffffffffffffff, &(0x7f0000000080)) sched_rr_get_interval(0x0, &(0x7f00000000c0)) sendmsg$NL802154_CMD_GET_SEC_KEY(0xffffffffffffffff, &(0x7f00000001c0)={&(0x7f0000000100)={0x10, 0x0, 0x0, 0x20000000}, 0xc, &(0x7f0000000180)={&(0x7f0000000140)={0x24, 0x0, 0x200, 0x70bd26, 0x25dfdbfe, {}, [@NL802154_ATTR_IFINDEX={0x8}, @NL802154_ATTR_IFINDEX={0x8}]}, 0x24}, 0x1, 0x0, 0x0, 0x4000000}, 0x181) clock_gettime(0x0, &(0x7f0000000200)) pipe2$9p(&(0x7f0000000240)={0xffffffffffffffff, 0xffffffffffffffff}, 0x800) r1 = syz_io_uring_setup(0x776a, &(0x7f0000000280)={0x0, 0x2728, 0x2, 0x1, 0x37c}, &(0x7f0000000000/0x3000)=nil, &(0x7f0000000000/0x400000)=nil, &(0x7f0000000300), &(0x7f0000000340)) ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, &(0x7f0000000540)={0x64, 0x0, &(0x7f0000000440)=[@transaction_sg={0x40486311, {0x1, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x50, 0x18, &(0x7f0000000380)={@fd={0x66642a85, 0x0, r0}, @fd={0x66642a85, 0x0, r1}, @fda={0x66646185, 0x0, 0x2, 0x36}}, &(0x7f0000000400)={0x0, 0x18, 0x30}}}, @request_death, @release={0x40046306, 0x1}], 0x7e, 0x0, &(0x7f00000004c0)="7685c519d1cbea63a1a8f022f8c0085baf770aa5d1fa9bfb1a5399fdb134953d619e962218bba650b68d6206fde39ff17760aa4bbcb62f6802c48e17294a17a3b768ab60bbae37aa37e33e24b09f6bdea37853f7ab2622451803788c9d172b7d71d6d87911129b8ef5cc9e0169404b09abfa991f3a7a3640686df445d387"}) pipe2$9p(&(0x7f0000000580), 0x800) ioctl$EVIOCGVERSION(0xffffffffffffffff, 0x80044501, &(0x7f00000005c0)=""/174) r2 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r3 = syz_genetlink_get_family_id$ieee802154(&(0x7f0000000740), 0xffffffffffffffff) sendmsg$IEEE802154_LLSEC_DEL_KEY(r2, &(0x7f0000000840)={&(0x7f0000000700)={0x10, 0x0, 0x0, 0x800000}, 0xc, &(0x7f0000000800)={&(0x7f0000000780)={0x54, r3, 0x800, 0x70bd27, 0x25dfdbfc, {}, [@IEEE802154_ATTR_LLSEC_KEY_SOURCE_SHORT={0x8, 0x2c, 0x5}, @IEEE802154_ATTR_LLSEC_KEY_SOURCE_EXTENDED={0xc, 0x2d, {0xaaaaaaaaaaaa0002}}, @IEEE802154_ATTR_PAN_ID={0x6, 0x6, 0x2}, @IEEE802154_ATTR_DEV_INDEX={0x8}, @IEEE802154_ATTR_LLSEC_KEY_MODE={0x5, 0x2b, 0x1}, @IEEE802154_ATTR_HW_ADDR={0xc, 0x5, {0xaaaaaaaaaaaa0002}}, @IEEE802154_ATTR_LLSEC_KEY_MODE={0x5, 0x2b, 0x3}]}, 0x54}, 0x1, 0x0, 0x0, 0x40}, 0x2000c814) clock_getres(0x3, &(0x7f0000000880)) r4 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) sendmsg$IEEE802154_ADD_IFACE(r4, &(0x7f0000000a00)={&(0x7f0000000900)={0x10, 0x0, 0x0, 0x40c}, 0xc, &(0x7f00000009c0)={&(0x7f0000000940)={0x44, r3, 0x200, 0x70bd29, 0x25dfdbfe, {}, [@IEEE802154_ATTR_PHY_NAME={0x9, 0x1f, 'phy1\x00'}, @IEEE802154_ATTR_DEV_NAME={0xa, 0x1, 'wpan4\x00'}, @IEEE802154_ATTR_DEV_NAME={0xa, 0x1, 'wpan1\x00'}, @IEEE802154_ATTR_DEV_NAME={0xa, 0x1, 'wpan0\x00'}]}, 0x44}, 0x1, 0x0, 0x0, 0x20000084}, 0x44000) 17:45:59 executing program 4: r0 = perf_event_open(&(0x7f00000000c0)={0x1, 0x80, 0x0, 0xc0, 0xfa, 0x1, 0x0, 0x7fffffff, 0x10811, 0x1, 0x1, 0x1, 0x1, 0x1, 0x1, 0x1, 0x1, 0x1, 0x0, 0x1, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x1, 0x0, 0x1, 0x0, 0x0, 0x0, 0x1, 0x1, 0x1, 0x1, 0x1, 0x1, 0x1, 0x0, 0x1, 0x1, 0x1, 0x1, 0x0, 0x0, 0xfff, 0x7, @perf_config_ext={0x7, 0x7fffffff}, 0x41000, 0x80000000, 0x5, 0x3, 0x9, 0x2, 0x9, 0x0, 0x5, 0x0, 0x4}, 0x0, 0xb, 0xffffffffffffffff, 0x1) perf_event_open(&(0x7f0000000040)={0x0, 0x80, 0x0, 0x40, 0x80, 0x9, 0x0, 0x3, 0x10040, 0x1, 0x0, 0x0, 0x1, 0x1, 0x1, 0x1, 0x1, 0x1, 0x1, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x3, 0x1, 0x0, 0x1, 0x0, 0x1, 0x1, 0x0, 0x0, 0x1, 0x1, 0x1, 0x0, 0x1, 0x0, 0x0, 0x0, 0x1, 0x0, 0x1, 0x0, 0x1, 0x0, 0x0, 0x1, @perf_bp={&(0x7f0000000000), 0x10}, 0x8080, 0x800, 0x2, 0x3, 0x36dc, 0x31df3b33, 0xff, 0x0, 0x9, 0x0, 0x5}, 0xffffffffffffffff, 0x9, r0, 0x9) ioctl$PERF_EVENT_IOC_PAUSE_OUTPUT(r0, 0x40042409, 0x0) ioctl$PERF_EVENT_IOC_PERIOD(0xffffffffffffffff, 0x40082404, &(0x7f0000000140)=0x8) r1 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl$sock_ipv4_tunnel_SIOCADDTUNNEL(r1, 0x89f1, &(0x7f00000001c0)={'syztnl1\x00', &(0x7f0000000180)={'syztnl0\x00', 0x0, 0x1, 0x40, 0x0, 0x5, {{0x5, 0x4, 0x2, 0x19, 0x14, 0x65, 0x0, 0x1f, 0x4, 0x0, @multicast2, @remote}}}}) ioctl$PERF_EVENT_IOC_PERIOD(r0, 0x40082404, &(0x7f0000000200)=0x9) ioctl$SNDRV_SEQ_IOCTL_GET_PORT_INFO(0xffffffffffffffff, 0xc0a85322, &(0x7f0000000240)) ioctl$SNDRV_SEQ_IOCTL_SYSTEM_INFO(0xffffffffffffffff, 0xc0305302, &(0x7f0000000300)={0x9, 0x101, 0x1, 0x6, 0x3, 0x5}) r2 = syz_open_procfs(0x0, &(0x7f0000000340)='children\x00') openat$cgroup_type(r2, &(0x7f0000000380), 0x2, 0x0) ioctl$EVIOCGABS20(r2, 0x80184560, &(0x7f00000003c0)=""/4096) socket$inet6_tcp(0xa, 0x1, 0x0) 17:45:59 executing program 2: prctl$PR_MPX_ENABLE_MANAGEMENT(0x2b) r0 = socket$inet(0x2, 0x5, 0x4) r1 = openat$vcsu(0xffffffffffffff9c, &(0x7f0000000000), 0x3c1480, 0x0) ioctl$sock_ipv4_tunnel_SIOCGETTUNNEL(r1, 0x89f0, &(0x7f00000000c0)={'syztnl2\x00', &(0x7f0000000040)={'erspan0\x00', 0x0, 0x700, 0x40, 0x3, 0x22, {{0x15, 0x4, 0x3, 0x17, 0x54, 0x64, 0x0, 0x1, 0x2f, 0x0, @broadcast, @dev={0xac, 0x14, 0x14, 0x36}, {[@cipso={0x86, 0x3d, 0x1, [{0x5, 0x9, "c8a7bec58c2c80"}, {0x0, 0x9, "fabb6c2e64ba82"}, {0x7, 0xf, "6b1b69e07efcb7230cc07a2cf7"}, {0x1, 0x6, "a2118bdb"}, {0x5, 0x10, "67115d3e7766231c7b08cf3c48e4"}]}]}}}}}) prctl$PR_MPX_ENABLE_MANAGEMENT(0x2b) r2 = openat$vcsa(0xffffffffffffff9c, &(0x7f0000000100), 0x202c0, 0x0) ioctl$SNDRV_SEQ_IOCTL_GET_QUEUE_TEMPO(r2, 0xc02c5341, &(0x7f0000000140)) ioctl$SNDRV_TIMER_IOCTL_SELECT(r1, 0x40345410, &(0x7f00000001c0)={{0x0, 0x2, 0x3f, 0x3, 0x80000001}}) ioctl$SNDRV_SEQ_IOCTL_GET_QUEUE_TEMPO(r1, 0xc02c5341, &(0x7f0000000200)) ioctl$sock_inet_tcp_SIOCOUTQ(r0, 0x5411, &(0x7f0000000280)) r3 = syz_open_dev$evdev(&(0x7f00000002c0), 0x1, 0x50000) ioctl$EVIOCGLED(r3, 0x80404519, &(0x7f0000000300)=""/21) syz_open_procfs(0x0, &(0x7f0000000500)='schedstat\x00') 17:45:59 executing program 0: get_thread_area(&(0x7f0000000000)={0x7, 0x20000800, 0x4000, 0x0, 0x1, 0x0, 0x0, 0x1, 0x1, 0x1}) r0 = openat$vcsu(0xffffffffffffff9c, &(0x7f0000000040), 0x200000, 0x0) getsockopt$inet_tcp_TCP_REPAIR_WINDOW(r0, 0x6, 0x1d, &(0x7f0000000080), &(0x7f00000000c0)=0x14) r1 = openat$nvram(0xffffffffffffff9c, &(0x7f0000000100), 0x2000, 0x0) setsockopt$inet_tcp_TCP_FASTOPEN_KEY(r1, 0x6, 0x21, &(0x7f0000000140)="1bb9d563048b6ec78effc0f14d974b17", 0x10) setsockopt$inet_tcp_int(r1, 0x6, 0x1b, &(0x7f0000000180)=0x5, 0x4) ioctl$SNDRV_TIMER_IOCTL_STATUS32(r1, 0x80585414, &(0x7f00000001c0)) setsockopt$inet_tcp_TCP_QUEUE_SEQ(r0, 0x6, 0x15, &(0x7f0000000240)=0x1, 0x4) getsockopt$inet_tcp_TCP_ZEROCOPY_RECEIVE(r1, 0x6, 0x23, &(0x7f0000000340)={&(0x7f0000ffc000/0x2000)=nil, 0x2000, 0x0, 0x0, 0x0, &(0x7f0000000280)=""/37, 0x25, 0x1, &(0x7f00000002c0)=""/109, 0x6d}, &(0x7f0000000380)=0x40) r2 = socket$inet_tcp(0x2, 0x1, 0x0) ioctl$sock_inet_tcp_SIOCINQ(r2, 0x541b, &(0x7f00000003c0)) move_pages(0x0, 0x8, &(0x7f0000000400)=[&(0x7f0000ffd000/0x1000)=nil, &(0x7f0000ffd000/0x3000)=nil, &(0x7f0000ffd000/0x3000)=nil, &(0x7f0000ffb000/0x2000)=nil, &(0x7f0000ffc000/0x1000)=nil, &(0x7f0000ffe000/0x2000)=nil, &(0x7f0000ffb000/0x4000)=nil, &(0x7f0000ffd000/0x3000)=nil], &(0x7f0000000440)=[0xfff], &(0x7f0000000480)=[0x0, 0x0, 0x0], 0x4) sendmsg$SEG6_CMD_GET_TUNSRC(r0, &(0x7f00000005c0)={&(0x7f00000004c0)={0x10, 0x0, 0x0, 0x4000000}, 0xc, &(0x7f0000000580)={&(0x7f0000000540)={0x38, 0x0, 0x300, 0x70bd2a, 0x25dfdbfc, {}, [@SEG6_ATTR_HMACKEYID={0x8, 0x3, 0x24}, @SEG6_ATTR_DST={0x14, 0x1, @mcast1}, @SEG6_ATTR_DSTLEN={0x8, 0x2, 0x2}]}, 0x38}, 0x1, 0x0, 0x0, 0x20008810}, 0x4040010) sendmsg$SEG6_CMD_DUMPHMAC(0xffffffffffffffff, &(0x7f0000000740)={&(0x7f0000000680)={0x10, 0x0, 0x0, 0x240000}, 0xc, &(0x7f0000000700)={&(0x7f00000006c0)={0x2c, 0x0, 0x1, 0x70bd2c, 0x25dfdbfe, {}, [@SEG6_ATTR_SECRET={0x8, 0x4, [0x1]}, @SEG6_ATTR_DSTLEN={0x8, 0x2, 0x5}, @SEG6_ATTR_DSTLEN={0x8}]}, 0x2c}, 0x1, 0x0, 0x0, 0x4000000}, 0x4000000) pidfd_getfd(r1, r2, 0x0) syz_genetlink_get_family_id$ieee802154(&(0x7f0000000800), 0xffffffffffffffff) 17:45:59 executing program 7: shmget(0x0, 0x1000, 0x200, &(0x7f0000ffd000/0x1000)=nil) 17:45:59 executing program 1: shmget$private(0x0, 0x4000, 0x80, &(0x7f0000ffb000/0x4000)=nil) shmget(0x3, 0x2000, 0x4, &(0x7f0000ffc000/0x2000)=nil) mlock(&(0x7f0000ff0000/0x10000)=nil, 0x10000) shmget(0x1, 0x1000, 0x10, &(0x7f0000ff5000/0x1000)=nil) ioctl$sock_ipv4_tunnel_SIOCGETTUNNEL(0xffffffffffffffff, 0x89f0, &(0x7f0000000140)={'syztnl1\x00', &(0x7f00000000c0)={'syztnl2\x00', 0x0, 0x20, 0x1, 0x6, 0x9, {{0xd, 0x4, 0x1, 0x19, 0x34, 0x68, 0x0, 0x9, 0x29, 0x0, @empty, @dev={0xac, 0x14, 0x14, 0x29}, {[@timestamp_addr={0x44, 0x14, 0xc2, 0x1, 0x4, [{@multicast1}, {@private=0xa010101}]}, @rr={0x7, 0xb, 0xc8, [@initdev={0xac, 0x1e, 0x1, 0x0}, @private=0xa010102]}]}}}}}) ioctl$sock_ipv4_tunnel_SIOCADDTUNNEL(0xffffffffffffffff, 0x89f1, &(0x7f0000000280)={'tunl0\x00', &(0x7f0000000180)={'tunl0\x00', r0, 0x7, 0x8000, 0xfffffffc, 0x8, {{0x2f, 0x4, 0x0, 0x2, 0xbc, 0x65, 0x0, 0x0, 0x4, 0x0, @empty, @broadcast, {[@generic={0x89, 0x9, "8db1d464c6af68"}, @noop, @ra={0x94, 0x4, 0x1}, @timestamp={0x44, 0x1c, 0x53, 0x0, 0x7, [0x40, 0x7fffffff, 0xfffffffd, 0x5, 0x5c, 0x77]}, @cipso={0x86, 0x2f, 0x3, [{0x1, 0x4, "1eba"}, {0x1, 0x7, "e3ccb5ddcf"}, {0x6, 0xa, "5db18b961780af33"}, {0x2, 0xe, "7353a9824b57fd7d39232ac5"}, {0x1, 0x6, "2e1ccd27"}]}, @noop, @cipso={0x86, 0x37, 0xffffffffffffffff, [{0x2, 0xf, "227467028cabd4e137b820c5c9"}, {0x7, 0x6, "90569992"}, {0x2, 0xc, "2071b0a8c9ce92782e72"}, {0x6, 0xa, "14f2b9bca55ce3dd"}, {0x6, 0x6, "2cd22a8f"}]}, @timestamp={0x44, 0x14, 0xd4, 0x0, 0x5, [0x81, 0x5d23, 0x63ab, 0x1]}]}}}}}) ioctl$sock_ipv4_tunnel_SIOCDELTUNNEL(0xffffffffffffffff, 0x89f2, &(0x7f0000000380)={'gretap0\x00', &(0x7f00000002c0)={'syztnl2\x00', 0x0, 0x7800, 0x7, 0x40, 0xe180, {{0x22, 0x4, 0x0, 0x1, 0x88, 0x64, 0x0, 0x1, 0x29, 0x0, @multicast2, @multicast1, {[@end, @lsrr={0x83, 0x1f, 0x2f, [@multicast2, @local, @local, @multicast1, @rand_addr=0x64010102, @loopback, @private=0xa010100]}, @rr={0x7, 0x27, 0x6c, [@multicast1, @rand_addr=0x64010102, @remote, @multicast1, @loopback, @initdev={0xac, 0x1e, 0x0, 0x0}, @initdev={0xac, 0x1e, 0x1, 0x0}, @broadcast, @empty]}, @ra={0x94, 0x4, 0x1}, @timestamp={0x44, 0x10, 0x2d, 0x0, 0x8, [0x1, 0x100, 0x401]}, @ssrr={0x89, 0x13, 0x56, [@dev={0xac, 0x14, 0x14, 0x28}, @multicast2, @initdev={0xac, 0x1e, 0x0, 0x0}, @remote]}, @ra={0x94, 0x4, 0x1}]}}}}}) shmget(0x3, 0x4000, 0x4, &(0x7f0000ff9000/0x4000)=nil) mmap$IORING_OFF_CQ_RING(&(0x7f0000ffd000/0x3000)=nil, 0x3000, 0x2000008, 0x30, 0xffffffffffffffff, 0x8000000) r1 = syz_genetlink_get_family_id$nl802154(&(0x7f0000000400), 0xffffffffffffffff) ioctl$sock_SIOCGIFINDEX_802154(0xffffffffffffffff, 0x8933, &(0x7f0000000440)={'wpan1\x00', 0x0}) sendmsg$NL802154_CMD_NEW_INTERFACE(0xffffffffffffffff, &(0x7f0000000540)={&(0x7f00000003c0)={0x10, 0x0, 0x0, 0x2}, 0xc, &(0x7f0000000500)={&(0x7f0000000480)={0x48, r1, 0x200, 0x70bd2a, 0x25dfdbfd, {}, [@NL802154_ATTR_IFNAME={0xa, 0x4, 'wpan0\x00'}, @NL802154_ATTR_IFINDEX={0x8}, @NL802154_ATTR_IFNAME={0xa, 0x4, 'wpan1\x00'}, @NL802154_ATTR_EXTENDED_ADDR={0xc, 0x17, {0xaaaaaaaaaaaa0002}}, @NL802154_ATTR_IFINDEX={0x8, 0x3, r2}]}, 0x48}}, 0x4001) r3 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) sendmsg$IEEE802154_LLSEC_ADD_SECLEVEL(r3, &(0x7f00000006c0)={&(0x7f0000000580)={0x10, 0x0, 0x0, 0x4000000}, 0xc, &(0x7f0000000680)={&(0x7f0000000600)={0x44, 0x0, 0x200, 0x70bd2a, 0x25dfdbff, {}, [@IEEE802154_ATTR_LLSEC_FRAME_TYPE={0x5, 0x33, 0x34}, @IEEE802154_ATTR_DEV_INDEX={0x8}, @IEEE802154_ATTR_LLSEC_CMD_FRAME_ID={0x5, 0x34, 0x1}, @IEEE802154_ATTR_DEV_NAME={0xa, 0x1, 'wpan0\x00'}, @IEEE802154_ATTR_DEV_NAME={0xa, 0x1, 'wpan4\x00'}]}, 0x44}, 0x1, 0x0, 0x0, 0x8800}, 0x0) sendmsg$IEEE802154_START_REQ(r3, &(0x7f00000007c0)={&(0x7f0000000700)={0x10, 0x0, 0x0, 0x4}, 0xc, &(0x7f0000000780)={&(0x7f0000000740)={0x1c, 0x0, 0x200, 0x70bd2d, 0x25dfdbfb, {}, [@IEEE802154_ATTR_CHANNEL={0x5, 0x7, 0x6}]}, 0x1c}, 0x1, 0x0, 0x0, 0x40100}, 0x801) mlock(&(0x7f0000fef000/0x1000)=nil, 0x1000) syz_io_uring_setup(0x4726, &(0x7f0000000840)={0x0, 0x502f, 0x20, 0x0, 0x12e}, &(0x7f0000ffe000/0x2000)=nil, &(0x7f0000ffb000/0x4000)=nil, &(0x7f00000008c0), &(0x7f0000000900)) 17:46:00 executing program 3: getsockopt$inet_udp_int(0xffffffffffffffff, 0x11, 0x1, &(0x7f0000000000), &(0x7f0000000040)=0x4) r0 = openat$nvram(0xffffffffffffff9c, &(0x7f0000000700), 0x800, 0x0) write$P9_RGETLOCK(r0, &(0x7f00000007c0)={0x1e, 0x37, 0x2, {0x2, 0x6, 0x101}}, 0x1e) 17:46:00 executing program 7: shmget(0x0, 0x1000, 0x0, &(0x7f0000ffd000/0x1000)=nil) 17:46:00 executing program 5: clock_gettime(0x5, &(0x7f0000000000)) clock_settime(0x2, &(0x7f0000000040)) sched_rr_get_interval(0xffffffffffffffff, &(0x7f0000000080)) sched_rr_get_interval(0x0, &(0x7f00000000c0)) sendmsg$NL802154_CMD_GET_SEC_KEY(0xffffffffffffffff, &(0x7f00000001c0)={&(0x7f0000000100)={0x10, 0x0, 0x0, 0x20000000}, 0xc, &(0x7f0000000180)={&(0x7f0000000140)={0x24, 0x0, 0x200, 0x70bd26, 0x25dfdbfe, {}, [@NL802154_ATTR_IFINDEX={0x8}, @NL802154_ATTR_IFINDEX={0x8}]}, 0x24}, 0x1, 0x0, 0x0, 0x4000000}, 0x181) clock_gettime(0x0, &(0x7f0000000200)) pipe2$9p(&(0x7f0000000240)={0xffffffffffffffff, 0xffffffffffffffff}, 0x800) r1 = syz_io_uring_setup(0x776a, &(0x7f0000000280)={0x0, 0x2728, 0x2, 0x1, 0x37c}, &(0x7f0000000000/0x3000)=nil, &(0x7f0000000000/0x400000)=nil, &(0x7f0000000300), &(0x7f0000000340)) ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, &(0x7f0000000540)={0x64, 0x0, &(0x7f0000000440)=[@transaction_sg={0x40486311, {0x1, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x50, 0x18, &(0x7f0000000380)={@fd={0x66642a85, 0x0, r0}, @fd={0x66642a85, 0x0, r1}, @fda={0x66646185, 0x0, 0x2, 0x36}}, &(0x7f0000000400)={0x0, 0x18, 0x30}}}, @request_death, @release={0x40046306, 0x1}], 0x7e, 0x0, &(0x7f00000004c0)="7685c519d1cbea63a1a8f022f8c0085baf770aa5d1fa9bfb1a5399fdb134953d619e962218bba650b68d6206fde39ff17760aa4bbcb62f6802c48e17294a17a3b768ab60bbae37aa37e33e24b09f6bdea37853f7ab2622451803788c9d172b7d71d6d87911129b8ef5cc9e0169404b09abfa991f3a7a3640686df445d387"}) pipe2$9p(&(0x7f0000000580), 0x800) ioctl$EVIOCGVERSION(0xffffffffffffffff, 0x80044501, &(0x7f00000005c0)=""/174) r2 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r3 = syz_genetlink_get_family_id$ieee802154(&(0x7f0000000740), 0xffffffffffffffff) sendmsg$IEEE802154_LLSEC_DEL_KEY(r2, &(0x7f0000000840)={&(0x7f0000000700)={0x10, 0x0, 0x0, 0x800000}, 0xc, &(0x7f0000000800)={&(0x7f0000000780)={0x54, r3, 0x800, 0x70bd27, 0x25dfdbfc, {}, [@IEEE802154_ATTR_LLSEC_KEY_SOURCE_SHORT={0x8, 0x2c, 0x5}, @IEEE802154_ATTR_LLSEC_KEY_SOURCE_EXTENDED={0xc, 0x2d, {0xaaaaaaaaaaaa0002}}, @IEEE802154_ATTR_PAN_ID={0x6, 0x6, 0x2}, @IEEE802154_ATTR_DEV_INDEX={0x8}, @IEEE802154_ATTR_LLSEC_KEY_MODE={0x5, 0x2b, 0x1}, @IEEE802154_ATTR_HW_ADDR={0xc, 0x5, {0xaaaaaaaaaaaa0002}}, @IEEE802154_ATTR_LLSEC_KEY_MODE={0x5, 0x2b, 0x3}]}, 0x54}, 0x1, 0x0, 0x0, 0x40}, 0x2000c814) clock_getres(0x3, &(0x7f0000000880)) r4 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) sendmsg$IEEE802154_ADD_IFACE(r4, &(0x7f0000000a00)={&(0x7f0000000900)={0x10, 0x0, 0x0, 0x40c}, 0xc, &(0x7f00000009c0)={&(0x7f0000000940)={0x44, r3, 0x200, 0x70bd29, 0x25dfdbfe, {}, [@IEEE802154_ATTR_PHY_NAME={0x9, 0x1f, 'phy1\x00'}, @IEEE802154_ATTR_DEV_NAME={0xa, 0x1, 'wpan4\x00'}, @IEEE802154_ATTR_DEV_NAME={0xa, 0x1, 'wpan1\x00'}, @IEEE802154_ATTR_DEV_NAME={0xa, 0x1, 'wpan0\x00'}]}, 0x44}, 0x1, 0x0, 0x0, 0x20000084}, 0x44000) 17:46:00 executing program 0: get_thread_area(&(0x7f0000000000)={0x7, 0x20000800, 0x4000, 0x0, 0x1, 0x0, 0x0, 0x1, 0x1, 0x1}) r0 = openat$vcsu(0xffffffffffffff9c, &(0x7f0000000040), 0x200000, 0x0) getsockopt$inet_tcp_TCP_REPAIR_WINDOW(r0, 0x6, 0x1d, &(0x7f0000000080), &(0x7f00000000c0)=0x14) r1 = openat$nvram(0xffffffffffffff9c, &(0x7f0000000100), 0x2000, 0x0) setsockopt$inet_tcp_TCP_FASTOPEN_KEY(r1, 0x6, 0x21, &(0x7f0000000140)="1bb9d563048b6ec78effc0f14d974b17", 0x10) setsockopt$inet_tcp_int(r1, 0x6, 0x1b, &(0x7f0000000180)=0x5, 0x4) ioctl$SNDRV_TIMER_IOCTL_STATUS32(r1, 0x80585414, &(0x7f00000001c0)) setsockopt$inet_tcp_TCP_QUEUE_SEQ(r0, 0x6, 0x15, &(0x7f0000000240)=0x1, 0x4) getsockopt$inet_tcp_TCP_ZEROCOPY_RECEIVE(r1, 0x6, 0x23, &(0x7f0000000340)={&(0x7f0000ffc000/0x2000)=nil, 0x2000, 0x0, 0x0, 0x0, &(0x7f0000000280)=""/37, 0x25, 0x1, &(0x7f00000002c0)=""/109, 0x6d}, &(0x7f0000000380)=0x40) r2 = socket$inet_tcp(0x2, 0x1, 0x0) ioctl$sock_inet_tcp_SIOCINQ(r2, 0x541b, &(0x7f00000003c0)) r3 = syz_genetlink_get_family_id$SEG6(&(0x7f0000000500), r1) sendmsg$SEG6_CMD_GET_TUNSRC(r0, &(0x7f00000005c0)={&(0x7f00000004c0)={0x10, 0x0, 0x0, 0x4000000}, 0xc, &(0x7f0000000580)={&(0x7f0000000540)={0x38, r3, 0x300, 0x70bd2a, 0x25dfdbfc, {}, [@SEG6_ATTR_HMACKEYID={0x8, 0x3, 0x24}, @SEG6_ATTR_DST={0x14, 0x1, @mcast1}, @SEG6_ATTR_DSTLEN={0x8, 0x2, 0x2}]}, 0x38}, 0x1, 0x0, 0x0, 0x20008810}, 0x4040010) sendmsg$SEG6_CMD_DUMPHMAC(0xffffffffffffffff, &(0x7f0000000740)={&(0x7f0000000680)={0x10, 0x0, 0x0, 0x240000}, 0xc, &(0x7f0000000700)={&(0x7f00000006c0)={0x2c, r3, 0x1, 0x70bd2c, 0x25dfdbfe, {}, [@SEG6_ATTR_SECRET={0x8, 0x4, [0x1]}, @SEG6_ATTR_DSTLEN={0x8, 0x2, 0x5}, @SEG6_ATTR_DSTLEN={0x8}]}, 0x2c}, 0x1, 0x0, 0x0, 0x4000000}, 0x4000000) pidfd_getfd(r1, r2, 0x0) syz_genetlink_get_family_id$ieee802154(&(0x7f0000000800), 0xffffffffffffffff) 17:46:00 executing program 1: shmget$private(0x0, 0x4000, 0x80, &(0x7f0000ffb000/0x4000)=nil) shmget(0x3, 0x2000, 0x4, &(0x7f0000ffc000/0x2000)=nil) mlock(&(0x7f0000ff0000/0x10000)=nil, 0x10000) shmget(0x1, 0x1000, 0x10, &(0x7f0000ff5000/0x1000)=nil) ioctl$sock_ipv4_tunnel_SIOCGETTUNNEL(0xffffffffffffffff, 0x89f0, &(0x7f0000000140)={'syztnl1\x00', &(0x7f00000000c0)={'syztnl2\x00', 0x0, 0x20, 0x1, 0x6, 0x9, {{0xd, 0x4, 0x1, 0x19, 0x34, 0x68, 0x0, 0x9, 0x29, 0x0, @empty, @dev={0xac, 0x14, 0x14, 0x29}, {[@timestamp_addr={0x44, 0x14, 0xc2, 0x1, 0x4, [{@multicast1}, {@private=0xa010101}]}, @rr={0x7, 0xb, 0xc8, [@initdev={0xac, 0x1e, 0x1, 0x0}, @private=0xa010102]}]}}}}}) ioctl$sock_ipv4_tunnel_SIOCADDTUNNEL(0xffffffffffffffff, 0x89f1, &(0x7f0000000280)={'tunl0\x00', &(0x7f0000000180)={'tunl0\x00', r0, 0x7, 0x8000, 0xfffffffc, 0x8, {{0x2f, 0x4, 0x0, 0x2, 0xbc, 0x65, 0x0, 0x0, 0x4, 0x0, @empty, @broadcast, {[@generic={0x89, 0x9, "8db1d464c6af68"}, @noop, @ra={0x94, 0x4, 0x1}, @timestamp={0x44, 0x1c, 0x53, 0x0, 0x7, [0x40, 0x7fffffff, 0xfffffffd, 0x5, 0x5c, 0x77]}, @cipso={0x86, 0x2f, 0x3, [{0x1, 0x4, "1eba"}, {0x1, 0x7, "e3ccb5ddcf"}, {0x6, 0xa, "5db18b961780af33"}, {0x2, 0xe, "7353a9824b57fd7d39232ac5"}, {0x1, 0x6, "2e1ccd27"}]}, @noop, @cipso={0x86, 0x37, 0xffffffffffffffff, [{0x2, 0xf, "227467028cabd4e137b820c5c9"}, {0x7, 0x6, "90569992"}, {0x2, 0xc, "2071b0a8c9ce92782e72"}, {0x6, 0xa, "14f2b9bca55ce3dd"}, {0x6, 0x6, "2cd22a8f"}]}, @timestamp={0x44, 0x14, 0xd4, 0x0, 0x5, [0x81, 0x5d23, 0x63ab, 0x1]}]}}}}}) ioctl$sock_ipv4_tunnel_SIOCDELTUNNEL(0xffffffffffffffff, 0x89f2, &(0x7f0000000380)={'gretap0\x00', &(0x7f00000002c0)={'syztnl2\x00', 0x0, 0x7800, 0x7, 0x40, 0xe180, {{0x22, 0x4, 0x0, 0x1, 0x88, 0x64, 0x0, 0x1, 0x29, 0x0, @multicast2, @multicast1, {[@end, @lsrr={0x83, 0x1f, 0x2f, [@multicast2, @local, @local, @multicast1, @rand_addr=0x64010102, @loopback, @private=0xa010100]}, @rr={0x7, 0x27, 0x6c, [@multicast1, @rand_addr=0x64010102, @remote, @multicast1, @loopback, @initdev={0xac, 0x1e, 0x0, 0x0}, @initdev={0xac, 0x1e, 0x1, 0x0}, @broadcast, @empty]}, @ra={0x94, 0x4, 0x1}, @timestamp={0x44, 0x10, 0x2d, 0x0, 0x8, [0x1, 0x100, 0x401]}, @ssrr={0x89, 0x13, 0x56, [@dev={0xac, 0x14, 0x14, 0x28}, @multicast2, @initdev={0xac, 0x1e, 0x0, 0x0}, @remote]}, @ra={0x94, 0x4, 0x1}]}}}}}) shmget(0x3, 0x4000, 0x4, &(0x7f0000ff9000/0x4000)=nil) mmap$IORING_OFF_CQ_RING(&(0x7f0000ffd000/0x3000)=nil, 0x3000, 0x2000008, 0x30, 0xffffffffffffffff, 0x8000000) r1 = syz_genetlink_get_family_id$nl802154(&(0x7f0000000400), 0xffffffffffffffff) ioctl$sock_SIOCGIFINDEX_802154(0xffffffffffffffff, 0x8933, &(0x7f0000000440)={'wpan1\x00', 0x0}) sendmsg$NL802154_CMD_NEW_INTERFACE(0xffffffffffffffff, &(0x7f0000000540)={&(0x7f00000003c0)={0x10, 0x0, 0x0, 0x2}, 0xc, &(0x7f0000000500)={&(0x7f0000000480)={0x48, r1, 0x200, 0x70bd2a, 0x25dfdbfd, {}, [@NL802154_ATTR_IFNAME={0xa, 0x4, 'wpan0\x00'}, @NL802154_ATTR_IFINDEX={0x8}, @NL802154_ATTR_IFNAME={0xa, 0x4, 'wpan1\x00'}, @NL802154_ATTR_EXTENDED_ADDR={0xc, 0x17, {0xaaaaaaaaaaaa0002}}, @NL802154_ATTR_IFINDEX={0x8, 0x3, r2}]}, 0x48}}, 0x4001) r3 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) sendmsg$IEEE802154_LLSEC_ADD_SECLEVEL(r3, &(0x7f00000006c0)={&(0x7f0000000580)={0x10, 0x0, 0x0, 0x4000000}, 0xc, &(0x7f0000000680)={&(0x7f0000000600)={0x44, 0x0, 0x200, 0x70bd2a, 0x25dfdbff, {}, [@IEEE802154_ATTR_LLSEC_FRAME_TYPE={0x5, 0x33, 0x34}, @IEEE802154_ATTR_DEV_INDEX={0x8}, @IEEE802154_ATTR_LLSEC_CMD_FRAME_ID={0x5, 0x34, 0x1}, @IEEE802154_ATTR_DEV_NAME={0xa, 0x1, 'wpan0\x00'}, @IEEE802154_ATTR_DEV_NAME={0xa, 0x1, 'wpan4\x00'}]}, 0x44}, 0x1, 0x0, 0x0, 0x8800}, 0x0) sendmsg$IEEE802154_START_REQ(r3, &(0x7f00000007c0)={&(0x7f0000000700)={0x10, 0x0, 0x0, 0x4}, 0xc, &(0x7f0000000780)={&(0x7f0000000740)={0x1c, 0x0, 0x200, 0x70bd2d, 0x25dfdbfb, {}, [@IEEE802154_ATTR_CHANNEL={0x5, 0x7, 0x6}]}, 0x1c}, 0x1, 0x0, 0x0, 0x40100}, 0x801) mlock(&(0x7f0000fef000/0x1000)=nil, 0x1000) syz_io_uring_setup(0x4726, &(0x7f0000000840)={0x0, 0x502f, 0x20, 0x0, 0x12e}, &(0x7f0000ffe000/0x2000)=nil, &(0x7f0000ffb000/0x4000)=nil, &(0x7f00000008c0), &(0x7f0000000900)) 17:46:00 executing program 3: r0 = openat$nvram(0xffffffffffffff9c, &(0x7f0000000700), 0x800, 0x0) write$P9_RGETLOCK(r0, &(0x7f00000007c0)={0x1e, 0x37, 0x2, {0x2, 0x6, 0x101}}, 0x1e) 17:46:00 executing program 4: r0 = perf_event_open(&(0x7f00000000c0)={0x1, 0x80, 0x0, 0xc0, 0xfa, 0x1, 0x0, 0x7fffffff, 0x10811, 0x1, 0x1, 0x1, 0x1, 0x1, 0x1, 0x1, 0x1, 0x1, 0x0, 0x1, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x1, 0x0, 0x1, 0x0, 0x0, 0x0, 0x1, 0x1, 0x1, 0x1, 0x1, 0x1, 0x1, 0x0, 0x1, 0x1, 0x1, 0x1, 0x0, 0x0, 0xfff, 0x7, @perf_config_ext={0x7, 0x7fffffff}, 0x41000, 0x80000000, 0x5, 0x3, 0x9, 0x2, 0x9, 0x0, 0x5, 0x0, 0x4}, 0x0, 0xb, 0xffffffffffffffff, 0x1) perf_event_open(&(0x7f0000000040)={0x0, 0x80, 0x0, 0x40, 0x80, 0x9, 0x0, 0x3, 0x10040, 0x1, 0x0, 0x0, 0x1, 0x1, 0x1, 0x1, 0x1, 0x1, 0x1, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x3, 0x1, 0x0, 0x1, 0x0, 0x1, 0x1, 0x0, 0x0, 0x1, 0x1, 0x1, 0x0, 0x1, 0x0, 0x0, 0x0, 0x1, 0x0, 0x1, 0x0, 0x1, 0x0, 0x0, 0x1, @perf_bp={&(0x7f0000000000), 0x10}, 0x8080, 0x800, 0x2, 0x3, 0x36dc, 0x31df3b33, 0xff, 0x0, 0x9, 0x0, 0x5}, 0xffffffffffffffff, 0x9, r0, 0x9) ioctl$PERF_EVENT_IOC_PAUSE_OUTPUT(r0, 0x40042409, 0x0) ioctl$PERF_EVENT_IOC_PERIOD(0xffffffffffffffff, 0x40082404, &(0x7f0000000140)=0x8) r1 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl$sock_ipv4_tunnel_SIOCADDTUNNEL(r1, 0x89f1, &(0x7f00000001c0)={'syztnl1\x00', &(0x7f0000000180)={'syztnl0\x00', 0x0, 0x1, 0x40, 0x0, 0x5, {{0x5, 0x4, 0x2, 0x19, 0x14, 0x65, 0x0, 0x1f, 0x4, 0x0, @multicast2, @remote}}}}) ioctl$PERF_EVENT_IOC_PERIOD(r0, 0x40082404, &(0x7f0000000200)=0x9) ioctl$SNDRV_SEQ_IOCTL_GET_PORT_INFO(0xffffffffffffffff, 0xc0a85322, &(0x7f0000000240)) ioctl$SNDRV_SEQ_IOCTL_SYSTEM_INFO(0xffffffffffffffff, 0xc0305302, &(0x7f0000000300)={0x9, 0x101, 0x1, 0x6, 0x3, 0x5}) r2 = syz_open_procfs(0x0, &(0x7f0000000340)='children\x00') openat$cgroup_type(r2, &(0x7f0000000380), 0x2, 0x0) ioctl$EVIOCGABS20(r2, 0x80184560, &(0x7f00000003c0)=""/4096) [ 216.659753] kmemleak: Found object by alias at 0x607f1a62a634 [ 216.659784] CPU: 1 UID: 0 PID: 4442 Comm: syz-executor.7 Tainted: G W 6.17.0-rc3-next-20250829 #1 PREEMPT(voluntary) [ 216.659820] Tainted: [W]=WARN [ 216.659828] Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.12.0-1 04/01/2014 [ 216.659849] Call Trace: [ 216.659856] [ 216.659865] dump_stack_lvl+0xca/0x120 [ 216.659910] __lookup_object+0x94/0xb0 [ 216.659942] delete_object_full+0x27/0x70 [ 216.659974] free_percpu+0x30/0x1160 [ 216.660005] ? arch_uprobe_clear_state+0x16/0x140 [ 216.660044] futex_hash_free+0x38/0xc0 [ 216.660071] mmput+0x2d3/0x390 [ 216.660122] do_exit+0x79d/0x2970 [ 216.660149] ? signal_wake_up_state+0x85/0x120 [ 216.660180] ? zap_other_threads+0x2b9/0x3a0 [ 216.660212] ? __pfx_do_exit+0x10/0x10 [ 216.660237] ? do_group_exit+0x1c3/0x2a0 [ 216.660265] ? lock_release+0xc8/0x290 [ 216.660298] do_group_exit+0xd3/0x2a0 [ 216.660328] __x64_sys_exit_group+0x3e/0x50 [ 216.660356] x64_sys_call+0x18c5/0x18d0 [ 216.660386] do_syscall_64+0xbf/0x360 [ 216.660409] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 216.660432] RIP: 0033:0x7f8e7f8bbb19 [ 216.660450] Code: Unable to access opcode bytes at 0x7f8e7f8bbaef. [ 216.660460] RSP: 002b:00007fff562de888 EFLAGS: 00000246 ORIG_RAX: 00000000000000e7 [ 216.660482] RAX: ffffffffffffffda RBX: 000000000000001e RCX: 00007f8e7f8bbb19 [ 216.660497] RDX: 00007f8e7f86e72b RSI: ffffffffffffffbc RDI: 0000000000000000 [ 216.660512] RBP: 0000000000000000 R08: 0000001b2d22001c R09: 0000000000000000 [ 216.660526] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 216.660539] R13: 0000000000000000 R14: 0000000000000001 R15: 00007fff562de970 [ 216.660571] [ 216.660578] kmemleak: Object (percpu) 0x607f1a62a630 (size 8): [ 216.660591] kmemleak: comm "syz-executor.5", pid 4450, jiffies 4294883458 [ 216.660605] kmemleak: min_count = 1 [ 216.660613] kmemleak: count = 0 [ 216.660620] kmemleak: flags = 0x21 [ 216.660628] kmemleak: checksum = 0 [ 216.660635] kmemleak: backtrace: [ 216.660642] pcpu_alloc_noprof+0x87a/0x1170 [ 216.660672] percpu_ref_init+0x37/0x400 [ 216.660706] io_uring_setup+0x44c/0x2000 [ 216.660727] __x64_sys_io_uring_setup+0xc8/0x170 [ 216.660750] do_syscall_64+0xbf/0x360 [ 216.660767] entry_SYSCALL_64_after_hwframe+0x77/0x7f 17:46:00 executing program 6: r0 = perf_event_open(&(0x7f00000000c0)={0x1, 0x80, 0x0, 0xc0, 0xfa, 0x1, 0x0, 0x7fffffff, 0x10811, 0x1, 0x1, 0x1, 0x1, 0x1, 0x1, 0x1, 0x1, 0x1, 0x0, 0x1, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x1, 0x0, 0x1, 0x0, 0x0, 0x0, 0x1, 0x1, 0x1, 0x1, 0x1, 0x1, 0x1, 0x0, 0x1, 0x1, 0x1, 0x1, 0x0, 0x0, 0xfff, 0x7, @perf_config_ext={0x7, 0x7fffffff}, 0x41000, 0x80000000, 0x5, 0x3, 0x9, 0x2, 0x9, 0x0, 0x5, 0x0, 0x4}, 0x0, 0xb, 0xffffffffffffffff, 0x1) perf_event_open(&(0x7f0000000040)={0x0, 0x80, 0x0, 0x40, 0x80, 0x9, 0x0, 0x3, 0x10040, 0x1, 0x0, 0x0, 0x1, 0x1, 0x1, 0x1, 0x1, 0x1, 0x1, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x3, 0x1, 0x0, 0x1, 0x0, 0x1, 0x1, 0x0, 0x0, 0x1, 0x1, 0x1, 0x0, 0x1, 0x0, 0x0, 0x0, 0x1, 0x0, 0x1, 0x0, 0x1, 0x0, 0x0, 0x1, @perf_bp={&(0x7f0000000000), 0x10}, 0x8080, 0x800, 0x2, 0x3, 0x36dc, 0x31df3b33, 0xff, 0x0, 0x9, 0x0, 0x5}, 0xffffffffffffffff, 0x9, r0, 0x9) ioctl$PERF_EVENT_IOC_PAUSE_OUTPUT(r0, 0x40042409, 0x0) ioctl$PERF_EVENT_IOC_PERIOD(0xffffffffffffffff, 0x40082404, &(0x7f0000000140)=0x8) r1 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl$sock_ipv4_tunnel_SIOCADDTUNNEL(r1, 0x89f1, &(0x7f00000001c0)={'syztnl1\x00', &(0x7f0000000180)={'syztnl0\x00', 0x0, 0x1, 0x40, 0x0, 0x5, {{0x5, 0x4, 0x2, 0x19, 0x14, 0x65, 0x0, 0x1f, 0x4, 0x0, @multicast2, @remote}}}}) ioctl$PERF_EVENT_IOC_PERIOD(r0, 0x40082404, &(0x7f0000000200)=0x9) write$cgroup_type(0xffffffffffffffff, &(0x7f0000001500), 0x9) 17:46:00 executing program 2: prctl$PR_MPX_ENABLE_MANAGEMENT(0x2b) r0 = socket$inet(0x2, 0x5, 0x4) r1 = openat$vcsu(0xffffffffffffff9c, &(0x7f0000000000), 0x3c1480, 0x0) ioctl$sock_ipv4_tunnel_SIOCGETTUNNEL(r1, 0x89f0, &(0x7f00000000c0)={'syztnl2\x00', &(0x7f0000000040)={'erspan0\x00', 0x0, 0x700, 0x40, 0x3, 0x22, {{0x15, 0x4, 0x3, 0x17, 0x54, 0x64, 0x0, 0x1, 0x2f, 0x0, @broadcast, @dev={0xac, 0x14, 0x14, 0x36}, {[@cipso={0x86, 0x3d, 0x1, [{0x5, 0x9, "c8a7bec58c2c80"}, {0x0, 0x9, "fabb6c2e64ba82"}, {0x7, 0xf, "6b1b69e07efcb7230cc07a2cf7"}, {0x1, 0x6, "a2118bdb"}, {0x5, 0x10, "67115d3e7766231c7b08cf3c48e4"}]}]}}}}}) prctl$PR_MPX_ENABLE_MANAGEMENT(0x2b) r2 = openat$vcsa(0xffffffffffffff9c, &(0x7f0000000100), 0x202c0, 0x0) ioctl$SNDRV_SEQ_IOCTL_GET_QUEUE_TEMPO(r2, 0xc02c5341, &(0x7f0000000140)) ioctl$SNDRV_TIMER_IOCTL_SELECT(r1, 0x40345410, &(0x7f00000001c0)={{0x0, 0x2, 0x3f, 0x3, 0x80000001}}) ioctl$SNDRV_SEQ_IOCTL_GET_QUEUE_TEMPO(r1, 0xc02c5341, &(0x7f0000000200)) ioctl$sock_inet_tcp_SIOCOUTQ(r0, 0x5411, &(0x7f0000000280)) syz_open_dev$evdev(&(0x7f00000002c0), 0x1, 0x50000) syz_open_procfs(0x0, &(0x7f0000000500)='schedstat\x00') 17:46:10 executing program 4: r0 = perf_event_open(&(0x7f00000000c0)={0x1, 0x80, 0x0, 0xc0, 0xfa, 0x1, 0x0, 0x7fffffff, 0x10811, 0x1, 0x1, 0x1, 0x1, 0x1, 0x1, 0x1, 0x1, 0x1, 0x0, 0x1, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x1, 0x0, 0x1, 0x0, 0x0, 0x0, 0x1, 0x1, 0x1, 0x1, 0x1, 0x1, 0x1, 0x0, 0x1, 0x1, 0x1, 0x1, 0x0, 0x0, 0xfff, 0x7, @perf_config_ext={0x7, 0x7fffffff}, 0x41000, 0x80000000, 0x5, 0x3, 0x9, 0x2, 0x9, 0x0, 0x5, 0x0, 0x4}, 0x0, 0xb, 0xffffffffffffffff, 0x1) perf_event_open(&(0x7f0000000040)={0x0, 0x80, 0x0, 0x40, 0x80, 0x9, 0x0, 0x3, 0x10040, 0x1, 0x0, 0x0, 0x1, 0x1, 0x1, 0x1, 0x1, 0x1, 0x1, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x3, 0x1, 0x0, 0x1, 0x0, 0x1, 0x1, 0x0, 0x0, 0x1, 0x1, 0x1, 0x0, 0x1, 0x0, 0x0, 0x0, 0x1, 0x0, 0x1, 0x0, 0x1, 0x0, 0x0, 0x1, @perf_bp={&(0x7f0000000000), 0x10}, 0x8080, 0x800, 0x2, 0x3, 0x36dc, 0x31df3b33, 0xff, 0x0, 0x9, 0x0, 0x5}, 0xffffffffffffffff, 0x9, r0, 0x9) ioctl$PERF_EVENT_IOC_PAUSE_OUTPUT(r0, 0x40042409, 0x0) ioctl$PERF_EVENT_IOC_PERIOD(0xffffffffffffffff, 0x40082404, &(0x7f0000000140)=0x8) r1 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl$sock_ipv4_tunnel_SIOCADDTUNNEL(r1, 0x89f1, &(0x7f00000001c0)={'syztnl1\x00', &(0x7f0000000180)={'syztnl0\x00', 0x0, 0x1, 0x40, 0x0, 0x5, {{0x5, 0x4, 0x2, 0x19, 0x14, 0x65, 0x0, 0x1f, 0x4, 0x0, @multicast2, @remote}}}}) ioctl$PERF_EVENT_IOC_PERIOD(r0, 0x40082404, &(0x7f0000000200)=0x9) ioctl$SNDRV_SEQ_IOCTL_GET_PORT_INFO(0xffffffffffffffff, 0xc0a85322, &(0x7f0000000240)) ioctl$SNDRV_SEQ_IOCTL_SYSTEM_INFO(0xffffffffffffffff, 0xc0305302, &(0x7f0000000300)={0x9, 0x101, 0x1, 0x6, 0x3, 0x5}) r2 = syz_open_procfs(0x0, &(0x7f0000000340)='children\x00') openat$cgroup_type(r2, &(0x7f0000000380), 0x2, 0x0) ioctl$EVIOCGABS20(r2, 0x80184560, &(0x7f00000003c0)=""/4096) 17:46:10 executing program 6: r0 = perf_event_open(&(0x7f00000000c0)={0x1, 0x80, 0x0, 0xc0, 0xfa, 0x1, 0x0, 0x7fffffff, 0x10811, 0x1, 0x1, 0x1, 0x1, 0x1, 0x1, 0x1, 0x1, 0x1, 0x0, 0x1, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x1, 0x0, 0x1, 0x0, 0x0, 0x0, 0x1, 0x1, 0x1, 0x1, 0x1, 0x1, 0x1, 0x0, 0x1, 0x1, 0x1, 0x1, 0x0, 0x0, 0xfff, 0x7, @perf_config_ext={0x7, 0x7fffffff}, 0x41000, 0x80000000, 0x5, 0x3, 0x9, 0x2, 0x9, 0x0, 0x5, 0x0, 0x4}, 0x0, 0xb, 0xffffffffffffffff, 0x1) perf_event_open(&(0x7f0000000040)={0x0, 0x80, 0x0, 0x40, 0x80, 0x9, 0x0, 0x3, 0x10040, 0x1, 0x0, 0x0, 0x1, 0x1, 0x1, 0x1, 0x1, 0x1, 0x1, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x3, 0x1, 0x0, 0x1, 0x0, 0x1, 0x1, 0x0, 0x0, 0x1, 0x1, 0x1, 0x0, 0x1, 0x0, 0x0, 0x0, 0x1, 0x0, 0x1, 0x0, 0x1, 0x0, 0x0, 0x1, @perf_bp={&(0x7f0000000000), 0x10}, 0x8080, 0x800, 0x2, 0x3, 0x36dc, 0x31df3b33, 0xff, 0x0, 0x9, 0x0, 0x5}, 0xffffffffffffffff, 0x9, r0, 0x9) ioctl$PERF_EVENT_IOC_PAUSE_OUTPUT(r0, 0x40042409, 0x0) ioctl$PERF_EVENT_IOC_PERIOD(0xffffffffffffffff, 0x40082404, &(0x7f0000000140)=0x8) r1 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl$sock_ipv4_tunnel_SIOCADDTUNNEL(r1, 0x89f1, &(0x7f00000001c0)={'syztnl1\x00', &(0x7f0000000180)={'syztnl0\x00', 0x0, 0x1, 0x40, 0x0, 0x5, {{0x5, 0x4, 0x2, 0x19, 0x14, 0x65, 0x0, 0x1f, 0x4, 0x0, @multicast2, @remote}}}}) write$cgroup_type(0xffffffffffffffff, &(0x7f0000001500), 0x9) 17:46:10 executing program 1: shmget$private(0x0, 0x4000, 0x80, &(0x7f0000ffb000/0x4000)=nil) shmget(0x3, 0x2000, 0x4, &(0x7f0000ffc000/0x2000)=nil) mlock(&(0x7f0000ff0000/0x10000)=nil, 0x10000) shmget(0x1, 0x1000, 0x10, &(0x7f0000ff5000/0x1000)=nil) ioctl$sock_ipv4_tunnel_SIOCGETTUNNEL(0xffffffffffffffff, 0x89f0, &(0x7f0000000140)={'syztnl1\x00', &(0x7f00000000c0)={'syztnl2\x00', 0x0, 0x20, 0x1, 0x6, 0x9, {{0xd, 0x4, 0x1, 0x19, 0x34, 0x68, 0x0, 0x9, 0x29, 0x0, @empty, @dev={0xac, 0x14, 0x14, 0x29}, {[@timestamp_addr={0x44, 0x14, 0xc2, 0x1, 0x4, [{@multicast1}, {@private=0xa010101}]}, @rr={0x7, 0xb, 0xc8, [@initdev={0xac, 0x1e, 0x1, 0x0}, @private=0xa010102]}]}}}}}) ioctl$sock_ipv4_tunnel_SIOCADDTUNNEL(0xffffffffffffffff, 0x89f1, &(0x7f0000000280)={'tunl0\x00', &(0x7f0000000180)={'tunl0\x00', r0, 0x7, 0x8000, 0xfffffffc, 0x8, {{0x2f, 0x4, 0x0, 0x2, 0xbc, 0x65, 0x0, 0x0, 0x4, 0x0, @empty, @broadcast, {[@generic={0x89, 0x9, "8db1d464c6af68"}, @noop, @ra={0x94, 0x4, 0x1}, @timestamp={0x44, 0x1c, 0x53, 0x0, 0x7, [0x40, 0x7fffffff, 0xfffffffd, 0x5, 0x5c, 0x77]}, @cipso={0x86, 0x2f, 0x3, [{0x1, 0x4, "1eba"}, {0x1, 0x7, "e3ccb5ddcf"}, {0x6, 0xa, "5db18b961780af33"}, {0x2, 0xe, "7353a9824b57fd7d39232ac5"}, {0x1, 0x6, "2e1ccd27"}]}, @noop, @cipso={0x86, 0x37, 0xffffffffffffffff, [{0x2, 0xf, "227467028cabd4e137b820c5c9"}, {0x7, 0x6, "90569992"}, {0x2, 0xc, "2071b0a8c9ce92782e72"}, {0x6, 0xa, "14f2b9bca55ce3dd"}, {0x6, 0x6, "2cd22a8f"}]}, @timestamp={0x44, 0x14, 0xd4, 0x0, 0x5, [0x81, 0x5d23, 0x63ab, 0x1]}]}}}}}) ioctl$sock_ipv4_tunnel_SIOCDELTUNNEL(0xffffffffffffffff, 0x89f2, &(0x7f0000000380)={'gretap0\x00', &(0x7f00000002c0)={'syztnl2\x00', 0x0, 0x7800, 0x7, 0x40, 0xe180, {{0x22, 0x4, 0x0, 0x1, 0x88, 0x64, 0x0, 0x1, 0x29, 0x0, @multicast2, @multicast1, {[@end, @lsrr={0x83, 0x1f, 0x2f, [@multicast2, @local, @local, @multicast1, @rand_addr=0x64010102, @loopback, @private=0xa010100]}, @rr={0x7, 0x27, 0x6c, [@multicast1, @rand_addr=0x64010102, @remote, @multicast1, @loopback, @initdev={0xac, 0x1e, 0x0, 0x0}, @initdev={0xac, 0x1e, 0x1, 0x0}, @broadcast, @empty]}, @ra={0x94, 0x4, 0x1}, @timestamp={0x44, 0x10, 0x2d, 0x0, 0x8, [0x1, 0x100, 0x401]}, @ssrr={0x89, 0x13, 0x56, [@dev={0xac, 0x14, 0x14, 0x28}, @multicast2, @initdev={0xac, 0x1e, 0x0, 0x0}, @remote]}, @ra={0x94, 0x4, 0x1}]}}}}}) shmget(0x3, 0x4000, 0x4, &(0x7f0000ff9000/0x4000)=nil) mmap$IORING_OFF_CQ_RING(&(0x7f0000ffd000/0x3000)=nil, 0x3000, 0x2000008, 0x30, 0xffffffffffffffff, 0x8000000) syz_genetlink_get_family_id$nl802154(&(0x7f0000000400), 0xffffffffffffffff) ioctl$sock_SIOCGIFINDEX_802154(0xffffffffffffffff, 0x8933, &(0x7f0000000440)={'wpan1\x00'}) mmap$binder(&(0x7f0000fef000/0x11000)=nil, 0x11000, 0x1, 0x11, 0xffffffffffffffff, 0x6) r1 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) sendmsg$IEEE802154_LLSEC_ADD_SECLEVEL(r1, &(0x7f00000006c0)={&(0x7f0000000580)={0x10, 0x0, 0x0, 0x4000000}, 0xc, &(0x7f0000000680)={&(0x7f0000000600)={0x44, 0x0, 0x200, 0x70bd2a, 0x25dfdbff, {}, [@IEEE802154_ATTR_LLSEC_FRAME_TYPE={0x5, 0x33, 0x34}, @IEEE802154_ATTR_DEV_INDEX={0x8}, @IEEE802154_ATTR_LLSEC_CMD_FRAME_ID={0x5, 0x34, 0x1}, @IEEE802154_ATTR_DEV_NAME={0xa, 0x1, 'wpan0\x00'}, @IEEE802154_ATTR_DEV_NAME={0xa, 0x1, 'wpan4\x00'}]}, 0x44}, 0x1, 0x0, 0x0, 0x8800}, 0x0) sendmsg$IEEE802154_START_REQ(r1, &(0x7f00000007c0)={&(0x7f0000000700)={0x10, 0x0, 0x0, 0x4}, 0xc, &(0x7f0000000780)={&(0x7f0000000740)={0x1c, 0x0, 0x200, 0x70bd2d, 0x25dfdbfb, {}, [@IEEE802154_ATTR_CHANNEL={0x5, 0x7, 0x6}]}, 0x1c}, 0x1, 0x0, 0x0, 0x40100}, 0x801) mlock(&(0x7f0000fef000/0x1000)=nil, 0x1000) syz_io_uring_setup(0x4726, &(0x7f0000000840)={0x0, 0x502f, 0x20, 0x0, 0x12e}, &(0x7f0000ffe000/0x2000)=nil, &(0x7f0000ffb000/0x4000)=nil, &(0x7f00000008c0), &(0x7f0000000900)) 17:46:10 executing program 7: clock_gettime(0x5, &(0x7f0000000000)) clock_settime(0x2, &(0x7f0000000040)) sched_rr_get_interval(0xffffffffffffffff, &(0x7f0000000080)) sched_rr_get_interval(0x0, &(0x7f00000000c0)) sendmsg$NL802154_CMD_GET_SEC_KEY(0xffffffffffffffff, &(0x7f00000001c0)={&(0x7f0000000100)={0x10, 0x0, 0x0, 0x20000000}, 0xc, &(0x7f0000000180)={&(0x7f0000000140)={0x24, 0x0, 0x200, 0x70bd26, 0x25dfdbfe, {}, [@NL802154_ATTR_IFINDEX={0x8}, @NL802154_ATTR_IFINDEX={0x8}]}, 0x24}, 0x1, 0x0, 0x0, 0x4000000}, 0x181) clock_gettime(0x0, &(0x7f0000000200)) pipe2$9p(&(0x7f0000000240)={0xffffffffffffffff, 0xffffffffffffffff}, 0x800) r1 = syz_io_uring_setup(0x776a, &(0x7f0000000280)={0x0, 0x2728, 0x2, 0x1, 0x37c}, &(0x7f0000000000/0x3000)=nil, &(0x7f0000000000/0x400000)=nil, &(0x7f0000000300), &(0x7f0000000340)) ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, &(0x7f0000000540)={0x64, 0x0, &(0x7f0000000440)=[@transaction_sg={0x40486311, {0x1, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x50, 0x18, &(0x7f0000000380)={@fd={0x66642a85, 0x0, r0}, @fd={0x66642a85, 0x0, r1}, @fda={0x66646185, 0x0, 0x2, 0x36}}, &(0x7f0000000400)={0x0, 0x18, 0x30}}}, @request_death, @release={0x40046306, 0x1}], 0x7e, 0x0, &(0x7f00000004c0)="7685c519d1cbea63a1a8f022f8c0085baf770aa5d1fa9bfb1a5399fdb134953d619e962218bba650b68d6206fde39ff17760aa4bbcb62f6802c48e17294a17a3b768ab60bbae37aa37e33e24b09f6bdea37853f7ab2622451803788c9d172b7d71d6d87911129b8ef5cc9e0169404b09abfa991f3a7a3640686df445d387"}) pipe2$9p(&(0x7f0000000580), 0x800) ioctl$EVIOCGVERSION(0xffffffffffffffff, 0x80044501, &(0x7f00000005c0)=""/174) r2 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r3 = syz_genetlink_get_family_id$ieee802154(&(0x7f0000000740), 0xffffffffffffffff) sendmsg$IEEE802154_LLSEC_DEL_KEY(r2, &(0x7f0000000840)={&(0x7f0000000700)={0x10, 0x0, 0x0, 0x800000}, 0xc, &(0x7f0000000800)={&(0x7f0000000780)={0x54, r3, 0x800, 0x70bd27, 0x25dfdbfc, {}, [@IEEE802154_ATTR_LLSEC_KEY_SOURCE_SHORT={0x8, 0x2c, 0x5}, @IEEE802154_ATTR_LLSEC_KEY_SOURCE_EXTENDED={0xc, 0x2d, {0xaaaaaaaaaaaa0002}}, @IEEE802154_ATTR_PAN_ID={0x6, 0x6, 0x2}, @IEEE802154_ATTR_DEV_INDEX={0x8}, @IEEE802154_ATTR_LLSEC_KEY_MODE={0x5, 0x2b, 0x1}, @IEEE802154_ATTR_HW_ADDR={0xc, 0x5, {0xaaaaaaaaaaaa0002}}, @IEEE802154_ATTR_LLSEC_KEY_MODE={0x5, 0x2b, 0x3}]}, 0x54}, 0x1, 0x0, 0x0, 0x40}, 0x2000c814) clock_getres(0x3, &(0x7f0000000880)) r4 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) sendmsg$IEEE802154_ADD_IFACE(r4, &(0x7f0000000a00)={&(0x7f0000000900)={0x10, 0x0, 0x0, 0x40c}, 0xc, &(0x7f00000009c0)={&(0x7f0000000940)={0x44, r3, 0x200, 0x70bd29, 0x25dfdbfe, {}, [@IEEE802154_ATTR_PHY_NAME={0x9, 0x1f, 'phy1\x00'}, @IEEE802154_ATTR_DEV_NAME={0xa, 0x1, 'wpan4\x00'}, @IEEE802154_ATTR_DEV_NAME={0xa, 0x1, 'wpan1\x00'}, @IEEE802154_ATTR_DEV_NAME={0xa, 0x1, 'wpan0\x00'}]}, 0x44}, 0x1, 0x0, 0x0, 0x20000084}, 0x44000) 17:46:10 executing program 3: r0 = openat$nvram(0xffffffffffffff9c, 0x0, 0x800, 0x0) write$P9_RGETLOCK(r0, &(0x7f00000007c0)={0x1e, 0x37, 0x2, {0x2, 0x6, 0x101}}, 0x1e) 17:46:10 executing program 5: clock_gettime(0x5, &(0x7f0000000000)) clock_settime(0x2, &(0x7f0000000040)) sched_rr_get_interval(0xffffffffffffffff, &(0x7f0000000080)) sched_rr_get_interval(0x0, &(0x7f00000000c0)) sendmsg$NL802154_CMD_GET_SEC_KEY(0xffffffffffffffff, &(0x7f00000001c0)={&(0x7f0000000100)={0x10, 0x0, 0x0, 0x20000000}, 0xc, &(0x7f0000000180)={&(0x7f0000000140)={0x24, 0x0, 0x200, 0x70bd26, 0x25dfdbfe, {}, [@NL802154_ATTR_IFINDEX={0x8}, @NL802154_ATTR_IFINDEX={0x8}]}, 0x24}, 0x1, 0x0, 0x0, 0x4000000}, 0x181) clock_gettime(0x0, &(0x7f0000000200)) pipe2$9p(&(0x7f0000000240)={0xffffffffffffffff, 0xffffffffffffffff}, 0x800) r1 = syz_io_uring_setup(0x776a, &(0x7f0000000280)={0x0, 0x2728, 0x2, 0x1, 0x37c}, &(0x7f0000000000/0x3000)=nil, &(0x7f0000000000/0x400000)=nil, &(0x7f0000000300), &(0x7f0000000340)) ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, &(0x7f0000000540)={0x64, 0x0, &(0x7f0000000440)=[@transaction_sg={0x40486311, {0x1, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x50, 0x18, &(0x7f0000000380)={@fd={0x66642a85, 0x0, r0}, @fd={0x66642a85, 0x0, r1}, @fda={0x66646185, 0x0, 0x2, 0x36}}, &(0x7f0000000400)={0x0, 0x18, 0x30}}}, @request_death, @release={0x40046306, 0x1}], 0x7e, 0x0, &(0x7f00000004c0)="7685c519d1cbea63a1a8f022f8c0085baf770aa5d1fa9bfb1a5399fdb134953d619e962218bba650b68d6206fde39ff17760aa4bbcb62f6802c48e17294a17a3b768ab60bbae37aa37e33e24b09f6bdea37853f7ab2622451803788c9d172b7d71d6d87911129b8ef5cc9e0169404b09abfa991f3a7a3640686df445d387"}) pipe2$9p(&(0x7f0000000580), 0x800) openat$nvram(0xffffffffffffff9c, &(0x7f0000000680), 0x400, 0x0) r2 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r3 = syz_genetlink_get_family_id$ieee802154(&(0x7f0000000740), 0xffffffffffffffff) sendmsg$IEEE802154_LLSEC_DEL_KEY(r2, &(0x7f0000000840)={&(0x7f0000000700)={0x10, 0x0, 0x0, 0x800000}, 0xc, &(0x7f0000000800)={&(0x7f0000000780)={0x54, r3, 0x800, 0x70bd27, 0x25dfdbfc, {}, [@IEEE802154_ATTR_LLSEC_KEY_SOURCE_SHORT={0x8, 0x2c, 0x5}, @IEEE802154_ATTR_LLSEC_KEY_SOURCE_EXTENDED={0xc, 0x2d, {0xaaaaaaaaaaaa0002}}, @IEEE802154_ATTR_PAN_ID={0x6, 0x6, 0x2}, @IEEE802154_ATTR_DEV_INDEX={0x8}, @IEEE802154_ATTR_LLSEC_KEY_MODE={0x5, 0x2b, 0x1}, @IEEE802154_ATTR_HW_ADDR={0xc, 0x5, {0xaaaaaaaaaaaa0002}}, @IEEE802154_ATTR_LLSEC_KEY_MODE={0x5, 0x2b, 0x3}]}, 0x54}, 0x1, 0x0, 0x0, 0x40}, 0x2000c814) clock_getres(0x3, &(0x7f0000000880)) r4 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) sendmsg$IEEE802154_ADD_IFACE(r4, &(0x7f0000000a00)={&(0x7f0000000900)={0x10, 0x0, 0x0, 0x40c}, 0xc, &(0x7f00000009c0)={&(0x7f0000000940)={0x44, r3, 0x200, 0x70bd29, 0x25dfdbfe, {}, [@IEEE802154_ATTR_PHY_NAME={0x9, 0x1f, 'phy1\x00'}, @IEEE802154_ATTR_DEV_NAME={0xa, 0x1, 'wpan4\x00'}, @IEEE802154_ATTR_DEV_NAME={0xa, 0x1, 'wpan1\x00'}, @IEEE802154_ATTR_DEV_NAME={0xa, 0x1, 'wpan0\x00'}]}, 0x44}, 0x1, 0x0, 0x0, 0x20000084}, 0x44000) 17:46:10 executing program 0: get_thread_area(&(0x7f0000000000)={0x7, 0x20000800, 0x4000, 0x0, 0x1, 0x0, 0x0, 0x1, 0x1, 0x1}) r0 = openat$vcsu(0xffffffffffffff9c, &(0x7f0000000040), 0x200000, 0x0) getsockopt$inet_tcp_TCP_REPAIR_WINDOW(r0, 0x6, 0x1d, &(0x7f0000000080), &(0x7f00000000c0)=0x14) r1 = openat$nvram(0xffffffffffffff9c, &(0x7f0000000100), 0x2000, 0x0) setsockopt$inet_tcp_TCP_FASTOPEN_KEY(r1, 0x6, 0x21, &(0x7f0000000140)="1bb9d563048b6ec78effc0f14d974b17", 0x10) setsockopt$inet_tcp_int(r1, 0x6, 0x1b, &(0x7f0000000180)=0x5, 0x4) ioctl$SNDRV_TIMER_IOCTL_STATUS32(r1, 0x80585414, &(0x7f00000001c0)) setsockopt$inet_tcp_TCP_QUEUE_SEQ(r0, 0x6, 0x15, &(0x7f0000000240)=0x1, 0x4) getsockopt$inet_tcp_TCP_ZEROCOPY_RECEIVE(r1, 0x6, 0x23, &(0x7f0000000340)={&(0x7f0000ffc000/0x2000)=nil, 0x2000, 0x0, 0x0, 0x0, &(0x7f0000000280)=""/37, 0x25, 0x1, &(0x7f00000002c0)=""/109, 0x6d}, &(0x7f0000000380)=0x40) r2 = socket$inet_tcp(0x2, 0x1, 0x0) ioctl$sock_inet_tcp_SIOCINQ(r2, 0x541b, &(0x7f00000003c0)) r3 = syz_genetlink_get_family_id$SEG6(&(0x7f0000000500), r1) sendmsg$SEG6_CMD_GET_TUNSRC(r0, &(0x7f00000005c0)={&(0x7f00000004c0)={0x10, 0x0, 0x0, 0x4000000}, 0xc, &(0x7f0000000580)={&(0x7f0000000540)={0x38, r3, 0x300, 0x70bd2a, 0x25dfdbfc, {}, [@SEG6_ATTR_HMACKEYID={0x8, 0x3, 0x24}, @SEG6_ATTR_DST={0x14, 0x1, @mcast1}, @SEG6_ATTR_DSTLEN={0x8, 0x2, 0x2}]}, 0x38}, 0x1, 0x0, 0x0, 0x20008810}, 0x4040010) sendmsg$SEG6_CMD_DUMPHMAC(0xffffffffffffffff, &(0x7f0000000740)={&(0x7f0000000680)={0x10, 0x0, 0x0, 0x240000}, 0xc, &(0x7f0000000700)={&(0x7f00000006c0)={0x2c, r3, 0x1, 0x70bd2c, 0x25dfdbfe, {}, [@SEG6_ATTR_SECRET={0x8, 0x4, [0x1]}, @SEG6_ATTR_DSTLEN={0x8, 0x2, 0x5}, @SEG6_ATTR_DSTLEN={0x8}]}, 0x2c}, 0x1, 0x0, 0x0, 0x4000000}, 0x4000000) pidfd_getfd(r1, r2, 0x0) syz_genetlink_get_family_id$ieee802154(&(0x7f0000000800), 0xffffffffffffffff) 17:46:10 executing program 2: prctl$PR_MPX_ENABLE_MANAGEMENT(0x2b) r0 = socket$inet(0x2, 0x5, 0x4) r1 = openat$vcsu(0xffffffffffffff9c, &(0x7f0000000000), 0x3c1480, 0x0) ioctl$sock_ipv4_tunnel_SIOCGETTUNNEL(r1, 0x89f0, &(0x7f00000000c0)={'syztnl2\x00', &(0x7f0000000040)={'erspan0\x00', 0x0, 0x700, 0x40, 0x3, 0x22, {{0x15, 0x4, 0x3, 0x17, 0x54, 0x64, 0x0, 0x1, 0x2f, 0x0, @broadcast, @dev={0xac, 0x14, 0x14, 0x36}, {[@cipso={0x86, 0x3d, 0x1, [{0x5, 0x9, "c8a7bec58c2c80"}, {0x0, 0x9, "fabb6c2e64ba82"}, {0x7, 0xf, "6b1b69e07efcb7230cc07a2cf7"}, {0x1, 0x6, "a2118bdb"}, {0x5, 0x10, "67115d3e7766231c7b08cf3c48e4"}]}]}}}}}) prctl$PR_MPX_ENABLE_MANAGEMENT(0x2b) r2 = openat$vcsa(0xffffffffffffff9c, &(0x7f0000000100), 0x202c0, 0x0) ioctl$SNDRV_SEQ_IOCTL_GET_QUEUE_TEMPO(r2, 0xc02c5341, &(0x7f0000000140)) ioctl$SNDRV_TIMER_IOCTL_SELECT(r1, 0x40345410, &(0x7f00000001c0)={{0x0, 0x2, 0x3f, 0x3, 0x80000001}}) ioctl$SNDRV_SEQ_IOCTL_GET_QUEUE_TEMPO(r1, 0xc02c5341, &(0x7f0000000200)) ioctl$sock_inet_tcp_SIOCOUTQ(r0, 0x5411, &(0x7f0000000280)) syz_open_procfs(0x0, &(0x7f0000000500)='schedstat\x00') 17:46:10 executing program 3: r0 = openat$nvram(0xffffffffffffff9c, 0x0, 0x800, 0x0) write$P9_RGETLOCK(r0, &(0x7f00000007c0)={0x1e, 0x37, 0x2, {0x2, 0x6, 0x101}}, 0x1e) 17:46:10 executing program 0: get_thread_area(&(0x7f0000000000)={0x7, 0x20000800, 0x4000, 0x0, 0x1, 0x0, 0x0, 0x1, 0x1, 0x1}) r0 = openat$vcsu(0xffffffffffffff9c, &(0x7f0000000040), 0x200000, 0x0) getsockopt$inet_tcp_TCP_REPAIR_WINDOW(r0, 0x6, 0x1d, &(0x7f0000000080), &(0x7f00000000c0)=0x14) r1 = openat$nvram(0xffffffffffffff9c, &(0x7f0000000100), 0x2000, 0x0) setsockopt$inet_tcp_TCP_FASTOPEN_KEY(r1, 0x6, 0x21, &(0x7f0000000140)="1bb9d563048b6ec78effc0f14d974b17", 0x10) setsockopt$inet_tcp_int(r1, 0x6, 0x1b, &(0x7f0000000180)=0x5, 0x4) ioctl$SNDRV_TIMER_IOCTL_STATUS32(r1, 0x80585414, &(0x7f00000001c0)) setsockopt$inet_tcp_TCP_QUEUE_SEQ(r0, 0x6, 0x15, &(0x7f0000000240)=0x1, 0x4) getsockopt$inet_tcp_TCP_ZEROCOPY_RECEIVE(r1, 0x6, 0x23, &(0x7f0000000340)={&(0x7f0000ffc000/0x2000)=nil, 0x2000, 0x0, 0x0, 0x0, &(0x7f0000000280)=""/37, 0x25, 0x1, &(0x7f00000002c0)=""/109, 0x6d}, &(0x7f0000000380)=0x40) r2 = socket$inet_tcp(0x2, 0x1, 0x0) ioctl$sock_inet_tcp_SIOCINQ(r2, 0x541b, &(0x7f00000003c0)) r3 = syz_genetlink_get_family_id$SEG6(&(0x7f0000000500), r1) sendmsg$SEG6_CMD_GET_TUNSRC(r0, &(0x7f00000005c0)={&(0x7f00000004c0)={0x10, 0x0, 0x0, 0x4000000}, 0xc, &(0x7f0000000580)={&(0x7f0000000540)={0x38, r3, 0x300, 0x70bd2a, 0x25dfdbfc, {}, [@SEG6_ATTR_HMACKEYID={0x8, 0x3, 0x24}, @SEG6_ATTR_DST={0x14, 0x1, @mcast1}, @SEG6_ATTR_DSTLEN={0x8, 0x2, 0x2}]}, 0x38}, 0x1, 0x0, 0x0, 0x20008810}, 0x4040010) sendmsg$SEG6_CMD_DUMPHMAC(0xffffffffffffffff, &(0x7f0000000740)={&(0x7f0000000680)={0x10, 0x0, 0x0, 0x240000}, 0xc, &(0x7f0000000700)={&(0x7f00000006c0)={0x2c, r3, 0x1, 0x70bd2c, 0x25dfdbfe, {}, [@SEG6_ATTR_SECRET={0x8, 0x4, [0x1]}, @SEG6_ATTR_DSTLEN={0x8, 0x2, 0x5}, @SEG6_ATTR_DSTLEN={0x8}]}, 0x2c}, 0x1, 0x0, 0x0, 0x4000000}, 0x4000000) pidfd_getfd(r1, r2, 0x0) syz_genetlink_get_family_id$ieee802154(&(0x7f0000000800), 0xffffffffffffffff) 17:46:10 executing program 1: shmget$private(0x0, 0x4000, 0x80, &(0x7f0000ffb000/0x4000)=nil) shmget(0x3, 0x2000, 0x4, &(0x7f0000ffc000/0x2000)=nil) mlock(&(0x7f0000ff0000/0x10000)=nil, 0x10000) shmget(0x1, 0x1000, 0x10, &(0x7f0000ff5000/0x1000)=nil) ioctl$sock_ipv4_tunnel_SIOCGETTUNNEL(0xffffffffffffffff, 0x89f0, &(0x7f0000000140)={'syztnl1\x00', &(0x7f00000000c0)={'syztnl2\x00', 0x0, 0x20, 0x1, 0x6, 0x9, {{0xd, 0x4, 0x1, 0x19, 0x34, 0x68, 0x0, 0x9, 0x29, 0x0, @empty, @dev={0xac, 0x14, 0x14, 0x29}, {[@timestamp_addr={0x44, 0x14, 0xc2, 0x1, 0x4, [{@multicast1}, {@private=0xa010101}]}, @rr={0x7, 0xb, 0xc8, [@initdev={0xac, 0x1e, 0x1, 0x0}, @private=0xa010102]}]}}}}}) ioctl$sock_ipv4_tunnel_SIOCADDTUNNEL(0xffffffffffffffff, 0x89f1, &(0x7f0000000280)={'tunl0\x00', &(0x7f0000000180)={'tunl0\x00', r0, 0x7, 0x8000, 0xfffffffc, 0x8, {{0x2f, 0x4, 0x0, 0x2, 0xbc, 0x65, 0x0, 0x0, 0x4, 0x0, @empty, @broadcast, {[@generic={0x89, 0x9, "8db1d464c6af68"}, @noop, @ra={0x94, 0x4, 0x1}, @timestamp={0x44, 0x1c, 0x53, 0x0, 0x7, [0x40, 0x7fffffff, 0xfffffffd, 0x5, 0x5c, 0x77]}, @cipso={0x86, 0x2f, 0x3, [{0x1, 0x4, "1eba"}, {0x1, 0x7, "e3ccb5ddcf"}, {0x6, 0xa, "5db18b961780af33"}, {0x2, 0xe, "7353a9824b57fd7d39232ac5"}, {0x1, 0x6, "2e1ccd27"}]}, @noop, @cipso={0x86, 0x37, 0xffffffffffffffff, [{0x2, 0xf, "227467028cabd4e137b820c5c9"}, {0x7, 0x6, "90569992"}, {0x2, 0xc, "2071b0a8c9ce92782e72"}, {0x6, 0xa, "14f2b9bca55ce3dd"}, {0x6, 0x6, "2cd22a8f"}]}, @timestamp={0x44, 0x14, 0xd4, 0x0, 0x5, [0x81, 0x5d23, 0x63ab, 0x1]}]}}}}}) ioctl$sock_ipv4_tunnel_SIOCDELTUNNEL(0xffffffffffffffff, 0x89f2, &(0x7f0000000380)={'gretap0\x00', &(0x7f00000002c0)={'syztnl2\x00', 0x0, 0x7800, 0x7, 0x40, 0xe180, {{0x22, 0x4, 0x0, 0x1, 0x88, 0x64, 0x0, 0x1, 0x29, 0x0, @multicast2, @multicast1, {[@end, @lsrr={0x83, 0x1f, 0x2f, [@multicast2, @local, @local, @multicast1, @rand_addr=0x64010102, @loopback, @private=0xa010100]}, @rr={0x7, 0x27, 0x6c, [@multicast1, @rand_addr=0x64010102, @remote, @multicast1, @loopback, @initdev={0xac, 0x1e, 0x0, 0x0}, @initdev={0xac, 0x1e, 0x1, 0x0}, @broadcast, @empty]}, @ra={0x94, 0x4, 0x1}, @timestamp={0x44, 0x10, 0x2d, 0x0, 0x8, [0x1, 0x100, 0x401]}, @ssrr={0x89, 0x13, 0x56, [@dev={0xac, 0x14, 0x14, 0x28}, @multicast2, @initdev={0xac, 0x1e, 0x0, 0x0}, @remote]}, @ra={0x94, 0x4, 0x1}]}}}}}) shmget(0x3, 0x4000, 0x4, &(0x7f0000ff9000/0x4000)=nil) mmap$IORING_OFF_CQ_RING(&(0x7f0000ffd000/0x3000)=nil, 0x3000, 0x2000008, 0x30, 0xffffffffffffffff, 0x8000000) syz_genetlink_get_family_id$nl802154(&(0x7f0000000400), 0xffffffffffffffff) ioctl$sock_SIOCGIFINDEX_802154(0xffffffffffffffff, 0x8933, &(0x7f0000000440)={'wpan1\x00'}) mmap$binder(&(0x7f0000fef000/0x11000)=nil, 0x11000, 0x1, 0x11, 0xffffffffffffffff, 0x6) r1 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) sendmsg$IEEE802154_LLSEC_ADD_SECLEVEL(r1, &(0x7f00000006c0)={&(0x7f0000000580)={0x10, 0x0, 0x0, 0x4000000}, 0xc, &(0x7f0000000680)={&(0x7f0000000600)={0x44, 0x0, 0x200, 0x70bd2a, 0x25dfdbff, {}, [@IEEE802154_ATTR_LLSEC_FRAME_TYPE={0x5, 0x33, 0x34}, @IEEE802154_ATTR_DEV_INDEX={0x8}, @IEEE802154_ATTR_LLSEC_CMD_FRAME_ID={0x5, 0x34, 0x1}, @IEEE802154_ATTR_DEV_NAME={0xa, 0x1, 'wpan0\x00'}, @IEEE802154_ATTR_DEV_NAME={0xa, 0x1, 'wpan4\x00'}]}, 0x44}, 0x1, 0x0, 0x0, 0x8800}, 0x0) sendmsg$IEEE802154_START_REQ(r1, &(0x7f00000007c0)={&(0x7f0000000700)={0x10, 0x0, 0x0, 0x4}, 0xc, &(0x7f0000000780)={&(0x7f0000000740)={0x1c, 0x0, 0x200, 0x70bd2d, 0x25dfdbfb, {}, [@IEEE802154_ATTR_CHANNEL={0x5, 0x7, 0x6}]}, 0x1c}, 0x1, 0x0, 0x0, 0x40100}, 0x801) mlock(&(0x7f0000fef000/0x1000)=nil, 0x1000) syz_io_uring_setup(0x4726, &(0x7f0000000840)={0x0, 0x502f, 0x20, 0x0, 0x12e}, &(0x7f0000ffe000/0x2000)=nil, &(0x7f0000ffb000/0x4000)=nil, &(0x7f00000008c0), &(0x7f0000000900)) 17:46:10 executing program 5: clock_gettime(0x5, &(0x7f0000000000)) clock_settime(0x2, &(0x7f0000000040)) sched_rr_get_interval(0xffffffffffffffff, &(0x7f0000000080)) sched_rr_get_interval(0x0, &(0x7f00000000c0)) sendmsg$NL802154_CMD_GET_SEC_KEY(0xffffffffffffffff, &(0x7f00000001c0)={&(0x7f0000000100)={0x10, 0x0, 0x0, 0x20000000}, 0xc, &(0x7f0000000180)={&(0x7f0000000140)={0x24, 0x0, 0x200, 0x70bd26, 0x25dfdbfe, {}, [@NL802154_ATTR_IFINDEX={0x8}, @NL802154_ATTR_IFINDEX={0x8}]}, 0x24}, 0x1, 0x0, 0x0, 0x4000000}, 0x181) clock_gettime(0x0, &(0x7f0000000200)) pipe2$9p(&(0x7f0000000240)={0xffffffffffffffff, 0xffffffffffffffff}, 0x800) r1 = syz_io_uring_setup(0x776a, &(0x7f0000000280)={0x0, 0x2728, 0x2, 0x1, 0x37c}, &(0x7f0000000000/0x3000)=nil, &(0x7f0000000000/0x400000)=nil, &(0x7f0000000300), &(0x7f0000000340)) ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, &(0x7f0000000540)={0x64, 0x0, &(0x7f0000000440)=[@transaction_sg={0x40486311, {0x1, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x50, 0x18, &(0x7f0000000380)={@fd={0x66642a85, 0x0, r0}, @fd={0x66642a85, 0x0, r1}, @fda={0x66646185, 0x0, 0x2, 0x36}}, &(0x7f0000000400)={0x0, 0x18, 0x30}}}, @request_death, @release={0x40046306, 0x1}], 0x7e, 0x0, &(0x7f00000004c0)="7685c519d1cbea63a1a8f022f8c0085baf770aa5d1fa9bfb1a5399fdb134953d619e962218bba650b68d6206fde39ff17760aa4bbcb62f6802c48e17294a17a3b768ab60bbae37aa37e33e24b09f6bdea37853f7ab2622451803788c9d172b7d71d6d87911129b8ef5cc9e0169404b09abfa991f3a7a3640686df445d387"}) openat$nvram(0xffffffffffffff9c, &(0x7f0000000680), 0x400, 0x0) r2 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r3 = syz_genetlink_get_family_id$ieee802154(&(0x7f0000000740), 0xffffffffffffffff) sendmsg$IEEE802154_LLSEC_DEL_KEY(r2, &(0x7f0000000840)={&(0x7f0000000700)={0x10, 0x0, 0x0, 0x800000}, 0xc, &(0x7f0000000800)={&(0x7f0000000780)={0x54, r3, 0x800, 0x70bd27, 0x25dfdbfc, {}, [@IEEE802154_ATTR_LLSEC_KEY_SOURCE_SHORT={0x8, 0x2c, 0x5}, @IEEE802154_ATTR_LLSEC_KEY_SOURCE_EXTENDED={0xc, 0x2d, {0xaaaaaaaaaaaa0002}}, @IEEE802154_ATTR_PAN_ID={0x6, 0x6, 0x2}, @IEEE802154_ATTR_DEV_INDEX={0x8}, @IEEE802154_ATTR_LLSEC_KEY_MODE={0x5, 0x2b, 0x1}, @IEEE802154_ATTR_HW_ADDR={0xc, 0x5, {0xaaaaaaaaaaaa0002}}, @IEEE802154_ATTR_LLSEC_KEY_MODE={0x5, 0x2b, 0x3}]}, 0x54}, 0x1, 0x0, 0x0, 0x40}, 0x2000c814) clock_getres(0x3, &(0x7f0000000880)) r4 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) sendmsg$IEEE802154_ADD_IFACE(r4, &(0x7f0000000a00)={&(0x7f0000000900)={0x10, 0x0, 0x0, 0x40c}, 0xc, &(0x7f00000009c0)={&(0x7f0000000940)={0x44, r3, 0x200, 0x70bd29, 0x25dfdbfe, {}, [@IEEE802154_ATTR_PHY_NAME={0x9, 0x1f, 'phy1\x00'}, @IEEE802154_ATTR_DEV_NAME={0xa, 0x1, 'wpan4\x00'}, @IEEE802154_ATTR_DEV_NAME={0xa, 0x1, 'wpan1\x00'}, @IEEE802154_ATTR_DEV_NAME={0xa, 0x1, 'wpan0\x00'}]}, 0x44}, 0x1, 0x0, 0x0, 0x20000084}, 0x44000) 17:46:10 executing program 7: clock_gettime(0x5, &(0x7f0000000000)) clock_settime(0x2, &(0x7f0000000040)) sched_rr_get_interval(0xffffffffffffffff, &(0x7f0000000080)) sched_rr_get_interval(0x0, &(0x7f00000000c0)) sendmsg$NL802154_CMD_GET_SEC_KEY(0xffffffffffffffff, &(0x7f00000001c0)={&(0x7f0000000100)={0x10, 0x0, 0x0, 0x20000000}, 0xc, &(0x7f0000000180)={&(0x7f0000000140)={0x24, 0x0, 0x200, 0x70bd26, 0x25dfdbfe, {}, [@NL802154_ATTR_IFINDEX={0x8}, @NL802154_ATTR_IFINDEX={0x8}]}, 0x24}, 0x1, 0x0, 0x0, 0x4000000}, 0x181) clock_gettime(0x0, &(0x7f0000000200)) pipe2$9p(&(0x7f0000000240)={0xffffffffffffffff, 0xffffffffffffffff}, 0x800) r1 = syz_io_uring_setup(0x776a, &(0x7f0000000280)={0x0, 0x2728, 0x2, 0x1, 0x37c}, &(0x7f0000000000/0x3000)=nil, &(0x7f0000000000/0x400000)=nil, &(0x7f0000000300), &(0x7f0000000340)) ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, &(0x7f0000000540)={0x64, 0x0, &(0x7f0000000440)=[@transaction_sg={0x40486311, {0x1, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x50, 0x18, &(0x7f0000000380)={@fd={0x66642a85, 0x0, r0}, @fd={0x66642a85, 0x0, r1}, @fda={0x66646185, 0x0, 0x2, 0x36}}, &(0x7f0000000400)={0x0, 0x18, 0x30}}}, @request_death, @release={0x40046306, 0x1}], 0x7e, 0x0, &(0x7f00000004c0)="7685c519d1cbea63a1a8f022f8c0085baf770aa5d1fa9bfb1a5399fdb134953d619e962218bba650b68d6206fde39ff17760aa4bbcb62f6802c48e17294a17a3b768ab60bbae37aa37e33e24b09f6bdea37853f7ab2622451803788c9d172b7d71d6d87911129b8ef5cc9e0169404b09abfa991f3a7a3640686df445d387"}) pipe2$9p(&(0x7f0000000580), 0x800) ioctl$EVIOCGVERSION(0xffffffffffffffff, 0x80044501, &(0x7f00000005c0)=""/174) r2 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r3 = syz_genetlink_get_family_id$ieee802154(&(0x7f0000000740), 0xffffffffffffffff) sendmsg$IEEE802154_LLSEC_DEL_KEY(r2, &(0x7f0000000840)={&(0x7f0000000700)={0x10, 0x0, 0x0, 0x800000}, 0xc, &(0x7f0000000800)={&(0x7f0000000780)={0x54, r3, 0x800, 0x70bd27, 0x25dfdbfc, {}, [@IEEE802154_ATTR_LLSEC_KEY_SOURCE_SHORT={0x8, 0x2c, 0x5}, @IEEE802154_ATTR_LLSEC_KEY_SOURCE_EXTENDED={0xc, 0x2d, {0xaaaaaaaaaaaa0002}}, @IEEE802154_ATTR_PAN_ID={0x6, 0x6, 0x2}, @IEEE802154_ATTR_DEV_INDEX={0x8}, @IEEE802154_ATTR_LLSEC_KEY_MODE={0x5, 0x2b, 0x1}, @IEEE802154_ATTR_HW_ADDR={0xc, 0x5, {0xaaaaaaaaaaaa0002}}, @IEEE802154_ATTR_LLSEC_KEY_MODE={0x5, 0x2b, 0x3}]}, 0x54}, 0x1, 0x0, 0x0, 0x40}, 0x2000c814) clock_getres(0x3, &(0x7f0000000880)) r4 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) sendmsg$IEEE802154_ADD_IFACE(r4, &(0x7f0000000a00)={&(0x7f0000000900)={0x10, 0x0, 0x0, 0x40c}, 0xc, &(0x7f00000009c0)={&(0x7f0000000940)={0x44, r3, 0x200, 0x70bd29, 0x25dfdbfe, {}, [@IEEE802154_ATTR_PHY_NAME={0x9, 0x1f, 'phy1\x00'}, @IEEE802154_ATTR_DEV_NAME={0xa, 0x1, 'wpan4\x00'}, @IEEE802154_ATTR_DEV_NAME={0xa, 0x1, 'wpan1\x00'}, @IEEE802154_ATTR_DEV_NAME={0xa, 0x1, 'wpan0\x00'}]}, 0x44}, 0x1, 0x0, 0x0, 0x20000084}, 0x44000) 17:46:10 executing program 3: r0 = openat$nvram(0xffffffffffffff9c, 0x0, 0x800, 0x0) write$P9_RGETLOCK(r0, &(0x7f00000007c0)={0x1e, 0x37, 0x2, {0x2, 0x6, 0x101}}, 0x1e) 17:46:10 executing program 2: prctl$PR_MPX_ENABLE_MANAGEMENT(0x2b) socket$inet(0x2, 0x5, 0x4) r0 = openat$vcsu(0xffffffffffffff9c, &(0x7f0000000000), 0x3c1480, 0x0) ioctl$sock_ipv4_tunnel_SIOCGETTUNNEL(r0, 0x89f0, &(0x7f00000000c0)={'syztnl2\x00', &(0x7f0000000040)={'erspan0\x00', 0x0, 0x700, 0x40, 0x3, 0x22, {{0x15, 0x4, 0x3, 0x17, 0x54, 0x64, 0x0, 0x1, 0x2f, 0x0, @broadcast, @dev={0xac, 0x14, 0x14, 0x36}, {[@cipso={0x86, 0x3d, 0x1, [{0x5, 0x9, "c8a7bec58c2c80"}, {0x0, 0x9, "fabb6c2e64ba82"}, {0x7, 0xf, "6b1b69e07efcb7230cc07a2cf7"}, {0x1, 0x6, "a2118bdb"}, {0x5, 0x10, "67115d3e7766231c7b08cf3c48e4"}]}]}}}}}) prctl$PR_MPX_ENABLE_MANAGEMENT(0x2b) r1 = openat$vcsa(0xffffffffffffff9c, &(0x7f0000000100), 0x202c0, 0x0) ioctl$SNDRV_SEQ_IOCTL_GET_QUEUE_TEMPO(r1, 0xc02c5341, &(0x7f0000000140)) ioctl$SNDRV_TIMER_IOCTL_SELECT(r0, 0x40345410, &(0x7f00000001c0)={{0x0, 0x2, 0x3f, 0x3, 0x80000001}}) ioctl$SNDRV_SEQ_IOCTL_GET_QUEUE_TEMPO(r0, 0xc02c5341, &(0x7f0000000200)) syz_open_procfs(0x0, &(0x7f0000000500)='schedstat\x00') 17:46:10 executing program 0: get_thread_area(&(0x7f0000000000)={0x7, 0x20000800, 0x4000, 0x0, 0x1, 0x0, 0x0, 0x1, 0x1, 0x1}) r0 = openat$vcsu(0xffffffffffffff9c, &(0x7f0000000040), 0x200000, 0x0) getsockopt$inet_tcp_TCP_REPAIR_WINDOW(r0, 0x6, 0x1d, &(0x7f0000000080), &(0x7f00000000c0)=0x14) r1 = openat$nvram(0xffffffffffffff9c, &(0x7f0000000100), 0x2000, 0x0) setsockopt$inet_tcp_TCP_FASTOPEN_KEY(r1, 0x6, 0x21, &(0x7f0000000140)="1bb9d563048b6ec78effc0f14d974b17", 0x10) setsockopt$inet_tcp_int(r1, 0x6, 0x1b, &(0x7f0000000180)=0x5, 0x4) ioctl$SNDRV_TIMER_IOCTL_STATUS32(r1, 0x80585414, &(0x7f00000001c0)) setsockopt$inet_tcp_TCP_QUEUE_SEQ(r0, 0x6, 0x15, &(0x7f0000000240)=0x1, 0x4) getsockopt$inet_tcp_TCP_ZEROCOPY_RECEIVE(r1, 0x6, 0x23, &(0x7f0000000340)={&(0x7f0000ffc000/0x2000)=nil, 0x2000, 0x0, 0x0, 0x0, &(0x7f0000000280)=""/37, 0x25, 0x1, &(0x7f00000002c0)=""/109, 0x6d}, &(0x7f0000000380)=0x40) r2 = socket$inet_tcp(0x2, 0x1, 0x0) move_pages(0x0, 0x8, &(0x7f0000000400)=[&(0x7f0000ffd000/0x1000)=nil, &(0x7f0000ffd000/0x3000)=nil, &(0x7f0000ffd000/0x3000)=nil, &(0x7f0000ffb000/0x2000)=nil, &(0x7f0000ffc000/0x1000)=nil, &(0x7f0000ffe000/0x2000)=nil, &(0x7f0000ffb000/0x4000)=nil, &(0x7f0000ffd000/0x3000)=nil], &(0x7f0000000440)=[0xfff], &(0x7f0000000480)=[0x0, 0x0, 0x0], 0x4) r3 = syz_genetlink_get_family_id$SEG6(&(0x7f0000000500), r1) sendmsg$SEG6_CMD_GET_TUNSRC(r0, &(0x7f00000005c0)={&(0x7f00000004c0)={0x10, 0x0, 0x0, 0x4000000}, 0xc, &(0x7f0000000580)={&(0x7f0000000540)={0x38, r3, 0x300, 0x70bd2a, 0x25dfdbfc, {}, [@SEG6_ATTR_HMACKEYID={0x8, 0x3, 0x24}, @SEG6_ATTR_DST={0x14, 0x1, @mcast1}, @SEG6_ATTR_DSTLEN={0x8, 0x2, 0x2}]}, 0x38}, 0x1, 0x0, 0x0, 0x20008810}, 0x4040010) sendmsg$SEG6_CMD_DUMPHMAC(0xffffffffffffffff, &(0x7f0000000740)={&(0x7f0000000680)={0x10, 0x0, 0x0, 0x240000}, 0xc, &(0x7f0000000700)={&(0x7f00000006c0)={0x2c, r3, 0x1, 0x70bd2c, 0x25dfdbfe, {}, [@SEG6_ATTR_SECRET={0x8, 0x4, [0x1]}, @SEG6_ATTR_DSTLEN={0x8, 0x2, 0x5}, @SEG6_ATTR_DSTLEN={0x8}]}, 0x2c}, 0x1, 0x0, 0x0, 0x4000000}, 0x4000000) pidfd_getfd(r1, r2, 0x0) syz_genetlink_get_family_id$ieee802154(&(0x7f0000000800), 0xffffffffffffffff) 17:46:19 executing program 0: get_thread_area(&(0x7f0000000000)={0x7, 0x20000800, 0x4000, 0x0, 0x1, 0x0, 0x0, 0x1, 0x1, 0x1}) r0 = openat$vcsu(0xffffffffffffff9c, &(0x7f0000000040), 0x200000, 0x0) getsockopt$inet_tcp_TCP_REPAIR_WINDOW(r0, 0x6, 0x1d, &(0x7f0000000080), &(0x7f00000000c0)=0x14) r1 = openat$nvram(0xffffffffffffff9c, &(0x7f0000000100), 0x2000, 0x0) setsockopt$inet_tcp_TCP_FASTOPEN_KEY(r1, 0x6, 0x21, &(0x7f0000000140)="1bb9d563048b6ec78effc0f14d974b17", 0x10) setsockopt$inet_tcp_int(r1, 0x6, 0x1b, &(0x7f0000000180)=0x5, 0x4) ioctl$SNDRV_TIMER_IOCTL_STATUS32(r1, 0x80585414, &(0x7f00000001c0)) setsockopt$inet_tcp_TCP_QUEUE_SEQ(r0, 0x6, 0x15, &(0x7f0000000240)=0x1, 0x4) getsockopt$inet_tcp_TCP_ZEROCOPY_RECEIVE(r1, 0x6, 0x23, &(0x7f0000000340)={&(0x7f0000ffc000/0x2000)=nil, 0x2000, 0x0, 0x0, 0x0, &(0x7f0000000280)=""/37, 0x25, 0x1, &(0x7f00000002c0)=""/109, 0x6d}, &(0x7f0000000380)=0x40) r2 = socket$inet_tcp(0x2, 0x1, 0x0) move_pages(0x0, 0x8, &(0x7f0000000400)=[&(0x7f0000ffd000/0x1000)=nil, &(0x7f0000ffd000/0x3000)=nil, &(0x7f0000ffd000/0x3000)=nil, &(0x7f0000ffb000/0x2000)=nil, &(0x7f0000ffc000/0x1000)=nil, &(0x7f0000ffe000/0x2000)=nil, &(0x7f0000ffb000/0x4000)=nil, &(0x7f0000ffd000/0x3000)=nil], &(0x7f0000000440)=[0xfff], &(0x7f0000000480)=[0x0, 0x0, 0x0], 0x4) r3 = syz_genetlink_get_family_id$SEG6(&(0x7f0000000500), r1) sendmsg$SEG6_CMD_GET_TUNSRC(r0, &(0x7f00000005c0)={&(0x7f00000004c0)={0x10, 0x0, 0x0, 0x4000000}, 0xc, &(0x7f0000000580)={&(0x7f0000000540)={0x38, r3, 0x300, 0x70bd2a, 0x25dfdbfc, {}, [@SEG6_ATTR_HMACKEYID={0x8, 0x3, 0x24}, @SEG6_ATTR_DST={0x14, 0x1, @mcast1}, @SEG6_ATTR_DSTLEN={0x8, 0x2, 0x2}]}, 0x38}, 0x1, 0x0, 0x0, 0x20008810}, 0x4040010) sendmsg$SEG6_CMD_DUMPHMAC(0xffffffffffffffff, &(0x7f0000000740)={&(0x7f0000000680)={0x10, 0x0, 0x0, 0x240000}, 0xc, &(0x7f0000000700)={&(0x7f00000006c0)={0x2c, r3, 0x1, 0x70bd2c, 0x25dfdbfe, {}, [@SEG6_ATTR_SECRET={0x8, 0x4, [0x1]}, @SEG6_ATTR_DSTLEN={0x8, 0x2, 0x5}, @SEG6_ATTR_DSTLEN={0x8}]}, 0x2c}, 0x1, 0x0, 0x0, 0x4000000}, 0x4000000) pidfd_getfd(r1, r2, 0x0) syz_genetlink_get_family_id$ieee802154(&(0x7f0000000800), 0xffffffffffffffff) 17:46:19 executing program 5: clock_gettime(0x5, &(0x7f0000000000)) clock_settime(0x2, &(0x7f0000000040)) sched_rr_get_interval(0xffffffffffffffff, &(0x7f0000000080)) sched_rr_get_interval(0x0, &(0x7f00000000c0)) sendmsg$NL802154_CMD_GET_SEC_KEY(0xffffffffffffffff, &(0x7f00000001c0)={&(0x7f0000000100)={0x10, 0x0, 0x0, 0x20000000}, 0xc, &(0x7f0000000180)={&(0x7f0000000140)={0x24, 0x0, 0x200, 0x70bd26, 0x25dfdbfe, {}, [@NL802154_ATTR_IFINDEX={0x8}, @NL802154_ATTR_IFINDEX={0x8}]}, 0x24}, 0x1, 0x0, 0x0, 0x4000000}, 0x181) clock_gettime(0x0, &(0x7f0000000200)) pipe2$9p(&(0x7f0000000240), 0x800) syz_io_uring_setup(0x776a, &(0x7f0000000280)={0x0, 0x2728, 0x2, 0x1, 0x37c}, &(0x7f0000000000/0x3000)=nil, &(0x7f0000000000/0x400000)=nil, &(0x7f0000000300), &(0x7f0000000340)) openat$nvram(0xffffffffffffff9c, &(0x7f0000000680), 0x400, 0x0) r0 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$ieee802154(&(0x7f0000000740), 0xffffffffffffffff) sendmsg$IEEE802154_LLSEC_DEL_KEY(r0, &(0x7f0000000840)={&(0x7f0000000700)={0x10, 0x0, 0x0, 0x800000}, 0xc, &(0x7f0000000800)={&(0x7f0000000780)={0x54, r1, 0x800, 0x70bd27, 0x25dfdbfc, {}, [@IEEE802154_ATTR_LLSEC_KEY_SOURCE_SHORT={0x8, 0x2c, 0x5}, @IEEE802154_ATTR_LLSEC_KEY_SOURCE_EXTENDED={0xc, 0x2d, {0xaaaaaaaaaaaa0002}}, @IEEE802154_ATTR_PAN_ID={0x6, 0x6, 0x2}, @IEEE802154_ATTR_DEV_INDEX={0x8}, @IEEE802154_ATTR_LLSEC_KEY_MODE={0x5, 0x2b, 0x1}, @IEEE802154_ATTR_HW_ADDR={0xc, 0x5, {0xaaaaaaaaaaaa0002}}, @IEEE802154_ATTR_LLSEC_KEY_MODE={0x5, 0x2b, 0x3}]}, 0x54}, 0x1, 0x0, 0x0, 0x40}, 0x2000c814) clock_getres(0x3, &(0x7f0000000880)) r2 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) sendmsg$IEEE802154_ADD_IFACE(r2, &(0x7f0000000a00)={&(0x7f0000000900)={0x10, 0x0, 0x0, 0x40c}, 0xc, &(0x7f00000009c0)={&(0x7f0000000940)={0x44, r1, 0x200, 0x70bd29, 0x25dfdbfe, {}, [@IEEE802154_ATTR_PHY_NAME={0x9, 0x1f, 'phy1\x00'}, @IEEE802154_ATTR_DEV_NAME={0xa, 0x1, 'wpan4\x00'}, @IEEE802154_ATTR_DEV_NAME={0xa, 0x1, 'wpan1\x00'}, @IEEE802154_ATTR_DEV_NAME={0xa, 0x1, 'wpan0\x00'}]}, 0x44}, 0x1, 0x0, 0x0, 0x20000084}, 0x44000) 17:46:19 executing program 6: r0 = perf_event_open(&(0x7f00000000c0)={0x1, 0x80, 0x0, 0xc0, 0xfa, 0x1, 0x0, 0x7fffffff, 0x10811, 0x1, 0x1, 0x1, 0x1, 0x1, 0x1, 0x1, 0x1, 0x1, 0x0, 0x1, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x1, 0x0, 0x1, 0x0, 0x0, 0x0, 0x1, 0x1, 0x1, 0x1, 0x1, 0x1, 0x1, 0x0, 0x1, 0x1, 0x1, 0x1, 0x0, 0x0, 0xfff, 0x7, @perf_config_ext={0x7, 0x7fffffff}, 0x41000, 0x80000000, 0x5, 0x3, 0x9, 0x2, 0x9, 0x0, 0x5, 0x0, 0x4}, 0x0, 0xb, 0xffffffffffffffff, 0x1) perf_event_open(&(0x7f0000000040)={0x0, 0x80, 0x0, 0x40, 0x80, 0x9, 0x0, 0x3, 0x10040, 0x1, 0x0, 0x0, 0x1, 0x1, 0x1, 0x1, 0x1, 0x1, 0x1, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x3, 0x1, 0x0, 0x1, 0x0, 0x1, 0x1, 0x0, 0x0, 0x1, 0x1, 0x1, 0x0, 0x1, 0x0, 0x0, 0x0, 0x1, 0x0, 0x1, 0x0, 0x1, 0x0, 0x0, 0x1, @perf_bp={&(0x7f0000000000), 0x10}, 0x8080, 0x800, 0x2, 0x3, 0x36dc, 0x31df3b33, 0xff, 0x0, 0x9, 0x0, 0x5}, 0xffffffffffffffff, 0x9, r0, 0x9) ioctl$PERF_EVENT_IOC_PAUSE_OUTPUT(r0, 0x40042409, 0x0) ioctl$PERF_EVENT_IOC_PERIOD(0xffffffffffffffff, 0x40082404, &(0x7f0000000140)=0x8) socket$inet_udplite(0x2, 0x2, 0x88) write$cgroup_type(0xffffffffffffffff, &(0x7f0000001500), 0x9) 17:46:19 executing program 1: shmget$private(0x0, 0x4000, 0x80, &(0x7f0000ffb000/0x4000)=nil) shmget(0x3, 0x2000, 0x4, &(0x7f0000ffc000/0x2000)=nil) mlock(&(0x7f0000ff0000/0x10000)=nil, 0x10000) shmget(0x1, 0x1000, 0x10, &(0x7f0000ff5000/0x1000)=nil) ioctl$sock_ipv4_tunnel_SIOCGETTUNNEL(0xffffffffffffffff, 0x89f0, &(0x7f0000000140)={'syztnl1\x00', &(0x7f00000000c0)={'syztnl2\x00', 0x0, 0x20, 0x1, 0x6, 0x9, {{0xd, 0x4, 0x1, 0x19, 0x34, 0x68, 0x0, 0x9, 0x29, 0x0, @empty, @dev={0xac, 0x14, 0x14, 0x29}, {[@timestamp_addr={0x44, 0x14, 0xc2, 0x1, 0x4, [{@multicast1}, {@private=0xa010101}]}, @rr={0x7, 0xb, 0xc8, [@initdev={0xac, 0x1e, 0x1, 0x0}, @private=0xa010102]}]}}}}}) ioctl$sock_ipv4_tunnel_SIOCADDTUNNEL(0xffffffffffffffff, 0x89f1, &(0x7f0000000280)={'tunl0\x00', &(0x7f0000000180)={'tunl0\x00', r0, 0x7, 0x8000, 0xfffffffc, 0x8, {{0x2f, 0x4, 0x0, 0x2, 0xbc, 0x65, 0x0, 0x0, 0x4, 0x0, @empty, @broadcast, {[@generic={0x89, 0x9, "8db1d464c6af68"}, @noop, @ra={0x94, 0x4, 0x1}, @timestamp={0x44, 0x1c, 0x53, 0x0, 0x7, [0x40, 0x7fffffff, 0xfffffffd, 0x5, 0x5c, 0x77]}, @cipso={0x86, 0x2f, 0x3, [{0x1, 0x4, "1eba"}, {0x1, 0x7, "e3ccb5ddcf"}, {0x6, 0xa, "5db18b961780af33"}, {0x2, 0xe, "7353a9824b57fd7d39232ac5"}, {0x1, 0x6, "2e1ccd27"}]}, @noop, @cipso={0x86, 0x37, 0xffffffffffffffff, [{0x2, 0xf, "227467028cabd4e137b820c5c9"}, {0x7, 0x6, "90569992"}, {0x2, 0xc, "2071b0a8c9ce92782e72"}, {0x6, 0xa, "14f2b9bca55ce3dd"}, {0x6, 0x6, "2cd22a8f"}]}, @timestamp={0x44, 0x14, 0xd4, 0x0, 0x5, [0x81, 0x5d23, 0x63ab, 0x1]}]}}}}}) ioctl$sock_ipv4_tunnel_SIOCDELTUNNEL(0xffffffffffffffff, 0x89f2, &(0x7f0000000380)={'gretap0\x00', &(0x7f00000002c0)={'syztnl2\x00', 0x0, 0x7800, 0x7, 0x40, 0xe180, {{0x22, 0x4, 0x0, 0x1, 0x88, 0x64, 0x0, 0x1, 0x29, 0x0, @multicast2, @multicast1, {[@end, @lsrr={0x83, 0x1f, 0x2f, [@multicast2, @local, @local, @multicast1, @rand_addr=0x64010102, @loopback, @private=0xa010100]}, @rr={0x7, 0x27, 0x6c, [@multicast1, @rand_addr=0x64010102, @remote, @multicast1, @loopback, @initdev={0xac, 0x1e, 0x0, 0x0}, @initdev={0xac, 0x1e, 0x1, 0x0}, @broadcast, @empty]}, @ra={0x94, 0x4, 0x1}, @timestamp={0x44, 0x10, 0x2d, 0x0, 0x8, [0x1, 0x100, 0x401]}, @ssrr={0x89, 0x13, 0x56, [@dev={0xac, 0x14, 0x14, 0x28}, @multicast2, @initdev={0xac, 0x1e, 0x0, 0x0}, @remote]}, @ra={0x94, 0x4, 0x1}]}}}}}) shmget(0x3, 0x4000, 0x4, &(0x7f0000ff9000/0x4000)=nil) mmap$IORING_OFF_CQ_RING(&(0x7f0000ffd000/0x3000)=nil, 0x3000, 0x2000008, 0x30, 0xffffffffffffffff, 0x8000000) syz_genetlink_get_family_id$nl802154(&(0x7f0000000400), 0xffffffffffffffff) ioctl$sock_SIOCGIFINDEX_802154(0xffffffffffffffff, 0x8933, &(0x7f0000000440)={'wpan1\x00'}) mmap$binder(&(0x7f0000fef000/0x11000)=nil, 0x11000, 0x1, 0x11, 0xffffffffffffffff, 0x6) r1 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) sendmsg$IEEE802154_LLSEC_ADD_SECLEVEL(r1, &(0x7f00000006c0)={&(0x7f0000000580)={0x10, 0x0, 0x0, 0x4000000}, 0xc, &(0x7f0000000680)={&(0x7f0000000600)={0x44, 0x0, 0x200, 0x70bd2a, 0x25dfdbff, {}, [@IEEE802154_ATTR_LLSEC_FRAME_TYPE={0x5, 0x33, 0x34}, @IEEE802154_ATTR_DEV_INDEX={0x8}, @IEEE802154_ATTR_LLSEC_CMD_FRAME_ID={0x5, 0x34, 0x1}, @IEEE802154_ATTR_DEV_NAME={0xa, 0x1, 'wpan0\x00'}, @IEEE802154_ATTR_DEV_NAME={0xa, 0x1, 'wpan4\x00'}]}, 0x44}, 0x1, 0x0, 0x0, 0x8800}, 0x0) sendmsg$IEEE802154_START_REQ(r1, &(0x7f00000007c0)={&(0x7f0000000700)={0x10, 0x0, 0x0, 0x4}, 0xc, &(0x7f0000000780)={&(0x7f0000000740)={0x1c, 0x0, 0x200, 0x70bd2d, 0x25dfdbfb, {}, [@IEEE802154_ATTR_CHANNEL={0x5, 0x7, 0x6}]}, 0x1c}, 0x1, 0x0, 0x0, 0x40100}, 0x801) mlock(&(0x7f0000fef000/0x1000)=nil, 0x1000) syz_io_uring_setup(0x4726, &(0x7f0000000840)={0x0, 0x502f, 0x20, 0x0, 0x12e}, &(0x7f0000ffe000/0x2000)=nil, &(0x7f0000ffb000/0x4000)=nil, &(0x7f00000008c0), &(0x7f0000000900)) 17:46:19 executing program 2: prctl$PR_MPX_ENABLE_MANAGEMENT(0x2b) socket$inet(0x2, 0x5, 0x4) r0 = openat$vcsu(0xffffffffffffff9c, &(0x7f0000000000), 0x3c1480, 0x0) ioctl$sock_ipv4_tunnel_SIOCGETTUNNEL(r0, 0x89f0, &(0x7f00000000c0)={'syztnl2\x00', &(0x7f0000000040)={'erspan0\x00', 0x0, 0x700, 0x40, 0x3, 0x22, {{0x15, 0x4, 0x3, 0x17, 0x54, 0x64, 0x0, 0x1, 0x2f, 0x0, @broadcast, @dev={0xac, 0x14, 0x14, 0x36}, {[@cipso={0x86, 0x3d, 0x1, [{0x5, 0x9, "c8a7bec58c2c80"}, {0x0, 0x9, "fabb6c2e64ba82"}, {0x7, 0xf, "6b1b69e07efcb7230cc07a2cf7"}, {0x1, 0x6, "a2118bdb"}, {0x5, 0x10, "67115d3e7766231c7b08cf3c48e4"}]}]}}}}}) prctl$PR_MPX_ENABLE_MANAGEMENT(0x2b) r1 = openat$vcsa(0xffffffffffffff9c, &(0x7f0000000100), 0x202c0, 0x0) ioctl$SNDRV_SEQ_IOCTL_GET_QUEUE_TEMPO(r1, 0xc02c5341, &(0x7f0000000140)) ioctl$SNDRV_TIMER_IOCTL_SELECT(r0, 0x40345410, &(0x7f00000001c0)={{0x0, 0x2, 0x3f, 0x3, 0x80000001}}) syz_open_procfs(0x0, &(0x7f0000000500)='schedstat\x00') 17:46:19 executing program 3: r0 = openat$nvram(0xffffffffffffff9c, &(0x7f0000000700), 0x0, 0x0) write$P9_RGETLOCK(r0, &(0x7f00000007c0)={0x1e, 0x37, 0x2, {0x2, 0x6, 0x101}}, 0x1e) 17:46:19 executing program 7: clock_gettime(0x5, &(0x7f0000000000)) clock_settime(0x2, &(0x7f0000000040)) sched_rr_get_interval(0xffffffffffffffff, &(0x7f0000000080)) sched_rr_get_interval(0x0, &(0x7f00000000c0)) sendmsg$NL802154_CMD_GET_SEC_KEY(0xffffffffffffffff, &(0x7f00000001c0)={&(0x7f0000000100)={0x10, 0x0, 0x0, 0x20000000}, 0xc, &(0x7f0000000180)={&(0x7f0000000140)={0x24, 0x0, 0x200, 0x70bd26, 0x25dfdbfe, {}, [@NL802154_ATTR_IFINDEX={0x8}, @NL802154_ATTR_IFINDEX={0x8}]}, 0x24}, 0x1, 0x0, 0x0, 0x4000000}, 0x181) clock_gettime(0x0, &(0x7f0000000200)) pipe2$9p(&(0x7f0000000240)={0xffffffffffffffff, 0xffffffffffffffff}, 0x800) r1 = syz_io_uring_setup(0x776a, &(0x7f0000000280)={0x0, 0x2728, 0x2, 0x1, 0x37c}, &(0x7f0000000000/0x3000)=nil, &(0x7f0000000000/0x400000)=nil, &(0x7f0000000300), &(0x7f0000000340)) ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, &(0x7f0000000540)={0x64, 0x0, &(0x7f0000000440)=[@transaction_sg={0x40486311, {0x1, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x50, 0x18, &(0x7f0000000380)={@fd={0x66642a85, 0x0, r0}, @fd={0x66642a85, 0x0, r1}, @fda={0x66646185, 0x0, 0x2, 0x36}}, &(0x7f0000000400)={0x0, 0x18, 0x30}}}, @request_death, @release={0x40046306, 0x1}], 0x7e, 0x0, &(0x7f00000004c0)="7685c519d1cbea63a1a8f022f8c0085baf770aa5d1fa9bfb1a5399fdb134953d619e962218bba650b68d6206fde39ff17760aa4bbcb62f6802c48e17294a17a3b768ab60bbae37aa37e33e24b09f6bdea37853f7ab2622451803788c9d172b7d71d6d87911129b8ef5cc9e0169404b09abfa991f3a7a3640686df445d387"}) pipe2$9p(&(0x7f0000000580), 0x800) ioctl$EVIOCGVERSION(0xffffffffffffffff, 0x80044501, &(0x7f00000005c0)=""/174) r2 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r3 = syz_genetlink_get_family_id$ieee802154(&(0x7f0000000740), 0xffffffffffffffff) sendmsg$IEEE802154_LLSEC_DEL_KEY(r2, &(0x7f0000000840)={&(0x7f0000000700)={0x10, 0x0, 0x0, 0x800000}, 0xc, &(0x7f0000000800)={&(0x7f0000000780)={0x54, r3, 0x800, 0x70bd27, 0x25dfdbfc, {}, [@IEEE802154_ATTR_LLSEC_KEY_SOURCE_SHORT={0x8, 0x2c, 0x5}, @IEEE802154_ATTR_LLSEC_KEY_SOURCE_EXTENDED={0xc, 0x2d, {0xaaaaaaaaaaaa0002}}, @IEEE802154_ATTR_PAN_ID={0x6, 0x6, 0x2}, @IEEE802154_ATTR_DEV_INDEX={0x8}, @IEEE802154_ATTR_LLSEC_KEY_MODE={0x5, 0x2b, 0x1}, @IEEE802154_ATTR_HW_ADDR={0xc, 0x5, {0xaaaaaaaaaaaa0002}}, @IEEE802154_ATTR_LLSEC_KEY_MODE={0x5, 0x2b, 0x3}]}, 0x54}, 0x1, 0x0, 0x0, 0x40}, 0x2000c814) clock_getres(0x3, &(0x7f0000000880)) r4 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) sendmsg$IEEE802154_ADD_IFACE(r4, &(0x7f0000000a00)={&(0x7f0000000900)={0x10, 0x0, 0x0, 0x40c}, 0xc, &(0x7f00000009c0)={&(0x7f0000000940)={0x44, r3, 0x200, 0x70bd29, 0x25dfdbfe, {}, [@IEEE802154_ATTR_PHY_NAME={0x9, 0x1f, 'phy1\x00'}, @IEEE802154_ATTR_DEV_NAME={0xa, 0x1, 'wpan4\x00'}, @IEEE802154_ATTR_DEV_NAME={0xa, 0x1, 'wpan1\x00'}, @IEEE802154_ATTR_DEV_NAME={0xa, 0x1, 'wpan0\x00'}]}, 0x44}, 0x1, 0x0, 0x0, 0x20000084}, 0x44000) 17:46:19 executing program 4: r0 = perf_event_open(&(0x7f00000000c0)={0x1, 0x80, 0x0, 0xc0, 0xfa, 0x1, 0x0, 0x7fffffff, 0x10811, 0x1, 0x1, 0x1, 0x1, 0x1, 0x1, 0x1, 0x1, 0x1, 0x0, 0x1, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x1, 0x0, 0x1, 0x0, 0x0, 0x0, 0x1, 0x1, 0x1, 0x1, 0x1, 0x1, 0x1, 0x0, 0x1, 0x1, 0x1, 0x1, 0x0, 0x0, 0xfff, 0x7, @perf_config_ext={0x7, 0x7fffffff}, 0x41000, 0x80000000, 0x5, 0x3, 0x9, 0x2, 0x9, 0x0, 0x5, 0x0, 0x4}, 0x0, 0xb, 0xffffffffffffffff, 0x1) perf_event_open(&(0x7f0000000040)={0x0, 0x80, 0x0, 0x40, 0x80, 0x9, 0x0, 0x3, 0x10040, 0x1, 0x0, 0x0, 0x1, 0x1, 0x1, 0x1, 0x1, 0x1, 0x1, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x3, 0x1, 0x0, 0x1, 0x0, 0x1, 0x1, 0x0, 0x0, 0x1, 0x1, 0x1, 0x0, 0x1, 0x0, 0x0, 0x0, 0x1, 0x0, 0x1, 0x0, 0x1, 0x0, 0x0, 0x1, @perf_bp={&(0x7f0000000000), 0x10}, 0x8080, 0x800, 0x2, 0x3, 0x36dc, 0x31df3b33, 0xff, 0x0, 0x9, 0x0, 0x5}, 0xffffffffffffffff, 0x9, r0, 0x9) ioctl$PERF_EVENT_IOC_PAUSE_OUTPUT(r0, 0x40042409, 0x0) ioctl$PERF_EVENT_IOC_PERIOD(0xffffffffffffffff, 0x40082404, &(0x7f0000000140)=0x8) r1 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl$sock_ipv4_tunnel_SIOCADDTUNNEL(r1, 0x89f1, &(0x7f00000001c0)={'syztnl1\x00', &(0x7f0000000180)={'syztnl0\x00', 0x0, 0x1, 0x40, 0x0, 0x5, {{0x5, 0x4, 0x2, 0x19, 0x14, 0x65, 0x0, 0x1f, 0x4, 0x0, @multicast2, @remote}}}}) ioctl$PERF_EVENT_IOC_PERIOD(r0, 0x40082404, &(0x7f0000000200)=0x9) ioctl$SNDRV_SEQ_IOCTL_GET_PORT_INFO(0xffffffffffffffff, 0xc0a85322, &(0x7f0000000240)) ioctl$SNDRV_SEQ_IOCTL_SYSTEM_INFO(0xffffffffffffffff, 0xc0305302, &(0x7f0000000300)={0x9, 0x101, 0x1, 0x6, 0x3, 0x5}) r2 = syz_open_procfs(0x0, &(0x7f0000000340)='children\x00') openat$cgroup_type(r2, &(0x7f0000000380), 0x2, 0x0) 17:46:19 executing program 5: clock_gettime(0x5, &(0x7f0000000000)) clock_settime(0x2, &(0x7f0000000040)) sched_rr_get_interval(0xffffffffffffffff, &(0x7f0000000080)) sched_rr_get_interval(0x0, &(0x7f00000000c0)) sendmsg$NL802154_CMD_GET_SEC_KEY(0xffffffffffffffff, &(0x7f00000001c0)={&(0x7f0000000100)={0x10, 0x0, 0x0, 0x20000000}, 0xc, &(0x7f0000000180)={&(0x7f0000000140)={0x24, 0x0, 0x200, 0x70bd26, 0x25dfdbfe, {}, [@NL802154_ATTR_IFINDEX={0x8}, @NL802154_ATTR_IFINDEX={0x8}]}, 0x24}, 0x1, 0x0, 0x0, 0x4000000}, 0x181) clock_gettime(0x0, &(0x7f0000000200)) pipe2$9p(&(0x7f0000000240), 0x800) openat$nvram(0xffffffffffffff9c, &(0x7f0000000680), 0x400, 0x0) r0 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$ieee802154(&(0x7f0000000740), 0xffffffffffffffff) sendmsg$IEEE802154_LLSEC_DEL_KEY(r0, &(0x7f0000000840)={&(0x7f0000000700)={0x10, 0x0, 0x0, 0x800000}, 0xc, &(0x7f0000000800)={&(0x7f0000000780)={0x54, r1, 0x800, 0x70bd27, 0x25dfdbfc, {}, [@IEEE802154_ATTR_LLSEC_KEY_SOURCE_SHORT={0x8, 0x2c, 0x5}, @IEEE802154_ATTR_LLSEC_KEY_SOURCE_EXTENDED={0xc, 0x2d, {0xaaaaaaaaaaaa0002}}, @IEEE802154_ATTR_PAN_ID={0x6, 0x6, 0x2}, @IEEE802154_ATTR_DEV_INDEX={0x8}, @IEEE802154_ATTR_LLSEC_KEY_MODE={0x5, 0x2b, 0x1}, @IEEE802154_ATTR_HW_ADDR={0xc, 0x5, {0xaaaaaaaaaaaa0002}}, @IEEE802154_ATTR_LLSEC_KEY_MODE={0x5, 0x2b, 0x3}]}, 0x54}, 0x1, 0x0, 0x0, 0x40}, 0x2000c814) clock_getres(0x3, &(0x7f0000000880)) r2 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) sendmsg$IEEE802154_ADD_IFACE(r2, &(0x7f0000000a00)={&(0x7f0000000900)={0x10, 0x0, 0x0, 0x40c}, 0xc, &(0x7f00000009c0)={&(0x7f0000000940)={0x44, r1, 0x200, 0x70bd29, 0x25dfdbfe, {}, [@IEEE802154_ATTR_PHY_NAME={0x9, 0x1f, 'phy1\x00'}, @IEEE802154_ATTR_DEV_NAME={0xa, 0x1, 'wpan4\x00'}, @IEEE802154_ATTR_DEV_NAME={0xa, 0x1, 'wpan1\x00'}, @IEEE802154_ATTR_DEV_NAME={0xa, 0x1, 'wpan0\x00'}]}, 0x44}, 0x1, 0x0, 0x0, 0x20000084}, 0x44000) 17:46:19 executing program 1: shmget$private(0x0, 0x4000, 0x80, &(0x7f0000ffb000/0x4000)=nil) shmget(0x3, 0x2000, 0x4, &(0x7f0000ffc000/0x2000)=nil) mlock(&(0x7f0000ff0000/0x10000)=nil, 0x10000) shmget(0x1, 0x1000, 0x10, &(0x7f0000ff5000/0x1000)=nil) ioctl$sock_ipv4_tunnel_SIOCGETTUNNEL(0xffffffffffffffff, 0x89f0, &(0x7f0000000140)={'syztnl1\x00', &(0x7f00000000c0)={'syztnl2\x00', 0x0, 0x20, 0x1, 0x6, 0x9, {{0xd, 0x4, 0x1, 0x19, 0x34, 0x68, 0x0, 0x9, 0x29, 0x0, @empty, @dev={0xac, 0x14, 0x14, 0x29}, {[@timestamp_addr={0x44, 0x14, 0xc2, 0x1, 0x4, [{@multicast1}, {@private=0xa010101}]}, @rr={0x7, 0xb, 0xc8, [@initdev={0xac, 0x1e, 0x1, 0x0}, @private=0xa010102]}]}}}}}) ioctl$sock_ipv4_tunnel_SIOCADDTUNNEL(0xffffffffffffffff, 0x89f1, &(0x7f0000000280)={'tunl0\x00', &(0x7f0000000180)={'tunl0\x00', r0, 0x7, 0x8000, 0xfffffffc, 0x8, {{0x2f, 0x4, 0x0, 0x2, 0xbc, 0x65, 0x0, 0x0, 0x4, 0x0, @empty, @broadcast, {[@generic={0x89, 0x9, "8db1d464c6af68"}, @noop, @ra={0x94, 0x4, 0x1}, @timestamp={0x44, 0x1c, 0x53, 0x0, 0x7, [0x40, 0x7fffffff, 0xfffffffd, 0x5, 0x5c, 0x77]}, @cipso={0x86, 0x2f, 0x3, [{0x1, 0x4, "1eba"}, {0x1, 0x7, "e3ccb5ddcf"}, {0x6, 0xa, "5db18b961780af33"}, {0x2, 0xe, "7353a9824b57fd7d39232ac5"}, {0x1, 0x6, "2e1ccd27"}]}, @noop, @cipso={0x86, 0x37, 0xffffffffffffffff, [{0x2, 0xf, "227467028cabd4e137b820c5c9"}, {0x7, 0x6, "90569992"}, {0x2, 0xc, "2071b0a8c9ce92782e72"}, {0x6, 0xa, "14f2b9bca55ce3dd"}, {0x6, 0x6, "2cd22a8f"}]}, @timestamp={0x44, 0x14, 0xd4, 0x0, 0x5, [0x81, 0x5d23, 0x63ab, 0x1]}]}}}}}) ioctl$sock_ipv4_tunnel_SIOCDELTUNNEL(0xffffffffffffffff, 0x89f2, &(0x7f0000000380)={'gretap0\x00', &(0x7f00000002c0)={'syztnl2\x00', 0x0, 0x7800, 0x7, 0x40, 0xe180, {{0x22, 0x4, 0x0, 0x1, 0x88, 0x64, 0x0, 0x1, 0x29, 0x0, @multicast2, @multicast1, {[@end, @lsrr={0x83, 0x1f, 0x2f, [@multicast2, @local, @local, @multicast1, @rand_addr=0x64010102, @loopback, @private=0xa010100]}, @rr={0x7, 0x27, 0x6c, [@multicast1, @rand_addr=0x64010102, @remote, @multicast1, @loopback, @initdev={0xac, 0x1e, 0x0, 0x0}, @initdev={0xac, 0x1e, 0x1, 0x0}, @broadcast, @empty]}, @ra={0x94, 0x4, 0x1}, @timestamp={0x44, 0x10, 0x2d, 0x0, 0x8, [0x1, 0x100, 0x401]}, @ssrr={0x89, 0x13, 0x56, [@dev={0xac, 0x14, 0x14, 0x28}, @multicast2, @initdev={0xac, 0x1e, 0x0, 0x0}, @remote]}, @ra={0x94, 0x4, 0x1}]}}}}}) shmget(0x3, 0x4000, 0x4, &(0x7f0000ff9000/0x4000)=nil) mmap$IORING_OFF_CQ_RING(&(0x7f0000ffd000/0x3000)=nil, 0x3000, 0x2000008, 0x30, 0xffffffffffffffff, 0x8000000) r1 = syz_genetlink_get_family_id$nl802154(&(0x7f0000000400), 0xffffffffffffffff) sendmsg$NL802154_CMD_NEW_INTERFACE(0xffffffffffffffff, &(0x7f0000000540)={&(0x7f00000003c0)={0x10, 0x0, 0x0, 0x2}, 0xc, &(0x7f0000000500)={&(0x7f0000000480)={0x48, r1, 0x200, 0x70bd2a, 0x25dfdbfd, {}, [@NL802154_ATTR_IFNAME={0xa, 0x4, 'wpan0\x00'}, @NL802154_ATTR_IFINDEX={0x8}, @NL802154_ATTR_IFNAME={0xa, 0x4, 'wpan1\x00'}, @NL802154_ATTR_EXTENDED_ADDR={0xc, 0x17, {0xaaaaaaaaaaaa0002}}, @NL802154_ATTR_IFINDEX={0x8}]}, 0x48}}, 0x4001) mmap$binder(&(0x7f0000fef000/0x11000)=nil, 0x11000, 0x1, 0x11, 0xffffffffffffffff, 0x6) r2 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) sendmsg$IEEE802154_LLSEC_ADD_SECLEVEL(r2, &(0x7f00000006c0)={&(0x7f0000000580)={0x10, 0x0, 0x0, 0x4000000}, 0xc, &(0x7f0000000680)={&(0x7f0000000600)={0x44, 0x0, 0x200, 0x70bd2a, 0x25dfdbff, {}, [@IEEE802154_ATTR_LLSEC_FRAME_TYPE={0x5, 0x33, 0x34}, @IEEE802154_ATTR_DEV_INDEX={0x8}, @IEEE802154_ATTR_LLSEC_CMD_FRAME_ID={0x5, 0x34, 0x1}, @IEEE802154_ATTR_DEV_NAME={0xa, 0x1, 'wpan0\x00'}, @IEEE802154_ATTR_DEV_NAME={0xa, 0x1, 'wpan4\x00'}]}, 0x44}, 0x1, 0x0, 0x0, 0x8800}, 0x0) sendmsg$IEEE802154_START_REQ(r2, &(0x7f00000007c0)={&(0x7f0000000700)={0x10, 0x0, 0x0, 0x4}, 0xc, &(0x7f0000000780)={&(0x7f0000000740)={0x1c, 0x0, 0x200, 0x70bd2d, 0x25dfdbfb, {}, [@IEEE802154_ATTR_CHANNEL={0x5, 0x7, 0x6}]}, 0x1c}, 0x1, 0x0, 0x0, 0x40100}, 0x801) mlock(&(0x7f0000fef000/0x1000)=nil, 0x1000) syz_io_uring_setup(0x4726, &(0x7f0000000840)={0x0, 0x502f, 0x20, 0x0, 0x12e}, &(0x7f0000ffe000/0x2000)=nil, &(0x7f0000ffb000/0x4000)=nil, &(0x7f00000008c0), &(0x7f0000000900)) 17:46:19 executing program 0: get_thread_area(&(0x7f0000000000)={0x7, 0x20000800, 0x4000, 0x0, 0x1, 0x0, 0x0, 0x1, 0x1, 0x1}) r0 = openat$vcsu(0xffffffffffffff9c, &(0x7f0000000040), 0x200000, 0x0) getsockopt$inet_tcp_TCP_REPAIR_WINDOW(r0, 0x6, 0x1d, &(0x7f0000000080), &(0x7f00000000c0)=0x14) r1 = openat$nvram(0xffffffffffffff9c, &(0x7f0000000100), 0x2000, 0x0) setsockopt$inet_tcp_TCP_FASTOPEN_KEY(r1, 0x6, 0x21, &(0x7f0000000140)="1bb9d563048b6ec78effc0f14d974b17", 0x10) setsockopt$inet_tcp_int(r1, 0x6, 0x1b, &(0x7f0000000180)=0x5, 0x4) ioctl$SNDRV_TIMER_IOCTL_STATUS32(r1, 0x80585414, &(0x7f00000001c0)) setsockopt$inet_tcp_TCP_QUEUE_SEQ(r0, 0x6, 0x15, &(0x7f0000000240)=0x1, 0x4) getsockopt$inet_tcp_TCP_ZEROCOPY_RECEIVE(r1, 0x6, 0x23, &(0x7f0000000340)={&(0x7f0000ffc000/0x2000)=nil, 0x2000, 0x0, 0x0, 0x0, &(0x7f0000000280)=""/37, 0x25, 0x1, &(0x7f00000002c0)=""/109, 0x6d}, &(0x7f0000000380)=0x40) r2 = socket$inet_tcp(0x2, 0x1, 0x0) move_pages(0x0, 0x8, &(0x7f0000000400)=[&(0x7f0000ffd000/0x1000)=nil, &(0x7f0000ffd000/0x3000)=nil, &(0x7f0000ffd000/0x3000)=nil, &(0x7f0000ffb000/0x2000)=nil, &(0x7f0000ffc000/0x1000)=nil, &(0x7f0000ffe000/0x2000)=nil, &(0x7f0000ffb000/0x4000)=nil, &(0x7f0000ffd000/0x3000)=nil], &(0x7f0000000440)=[0xfff], &(0x7f0000000480)=[0x0, 0x0, 0x0], 0x4) r3 = syz_genetlink_get_family_id$SEG6(&(0x7f0000000500), r1) sendmsg$SEG6_CMD_GET_TUNSRC(r0, &(0x7f00000005c0)={&(0x7f00000004c0)={0x10, 0x0, 0x0, 0x4000000}, 0xc, &(0x7f0000000580)={&(0x7f0000000540)={0x38, r3, 0x300, 0x70bd2a, 0x25dfdbfc, {}, [@SEG6_ATTR_HMACKEYID={0x8, 0x3, 0x24}, @SEG6_ATTR_DST={0x14, 0x1, @mcast1}, @SEG6_ATTR_DSTLEN={0x8, 0x2, 0x2}]}, 0x38}, 0x1, 0x0, 0x0, 0x20008810}, 0x4040010) sendmsg$SEG6_CMD_DUMPHMAC(0xffffffffffffffff, &(0x7f0000000740)={&(0x7f0000000680)={0x10, 0x0, 0x0, 0x240000}, 0xc, &(0x7f0000000700)={&(0x7f00000006c0)={0x2c, r3, 0x1, 0x70bd2c, 0x25dfdbfe, {}, [@SEG6_ATTR_SECRET={0x8, 0x4, [0x1]}, @SEG6_ATTR_DSTLEN={0x8, 0x2, 0x5}, @SEG6_ATTR_DSTLEN={0x8}]}, 0x2c}, 0x1, 0x0, 0x0, 0x4000000}, 0x4000000) pidfd_getfd(r1, r2, 0x0) syz_genetlink_get_family_id$ieee802154(&(0x7f0000000800), 0xffffffffffffffff) 17:46:19 executing program 6: r0 = perf_event_open(&(0x7f00000000c0)={0x1, 0x80, 0x0, 0xc0, 0xfa, 0x1, 0x0, 0x7fffffff, 0x10811, 0x1, 0x1, 0x1, 0x1, 0x1, 0x1, 0x1, 0x1, 0x1, 0x0, 0x1, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x1, 0x0, 0x1, 0x0, 0x0, 0x0, 0x1, 0x1, 0x1, 0x1, 0x1, 0x1, 0x1, 0x0, 0x1, 0x1, 0x1, 0x1, 0x0, 0x0, 0xfff, 0x7, @perf_config_ext={0x7, 0x7fffffff}, 0x41000, 0x80000000, 0x5, 0x3, 0x9, 0x2, 0x9, 0x0, 0x5, 0x0, 0x4}, 0x0, 0xb, 0xffffffffffffffff, 0x1) perf_event_open(&(0x7f0000000040)={0x0, 0x80, 0x0, 0x40, 0x80, 0x9, 0x0, 0x3, 0x10040, 0x1, 0x0, 0x0, 0x1, 0x1, 0x1, 0x1, 0x1, 0x1, 0x1, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x3, 0x1, 0x0, 0x1, 0x0, 0x1, 0x1, 0x0, 0x0, 0x1, 0x1, 0x1, 0x0, 0x1, 0x0, 0x0, 0x0, 0x1, 0x0, 0x1, 0x0, 0x1, 0x0, 0x0, 0x1, @perf_bp={&(0x7f0000000000), 0x10}, 0x8080, 0x800, 0x2, 0x3, 0x36dc, 0x31df3b33, 0xff, 0x0, 0x9, 0x0, 0x5}, 0xffffffffffffffff, 0x9, r0, 0x9) ioctl$PERF_EVENT_IOC_PAUSE_OUTPUT(r0, 0x40042409, 0x0) ioctl$PERF_EVENT_IOC_PERIOD(0xffffffffffffffff, 0x40082404, &(0x7f0000000140)=0x8) write$cgroup_type(0xffffffffffffffff, &(0x7f0000001500), 0x9) 17:46:19 executing program 3: openat$nvram(0xffffffffffffff9c, &(0x7f0000000700), 0x0, 0x0) write$P9_RGETLOCK(0xffffffffffffffff, &(0x7f00000007c0)={0x1e, 0x37, 0x2, {0x2, 0x6, 0x101}}, 0x1e) 17:46:19 executing program 5: clock_gettime(0x5, &(0x7f0000000000)) clock_settime(0x2, &(0x7f0000000040)) sched_rr_get_interval(0xffffffffffffffff, &(0x7f0000000080)) sched_rr_get_interval(0x0, &(0x7f00000000c0)) sendmsg$NL802154_CMD_GET_SEC_KEY(0xffffffffffffffff, &(0x7f00000001c0)={&(0x7f0000000100)={0x10, 0x0, 0x0, 0x20000000}, 0xc, &(0x7f0000000180)={&(0x7f0000000140)={0x24, 0x0, 0x200, 0x70bd26, 0x25dfdbfe, {}, [@NL802154_ATTR_IFINDEX={0x8}, @NL802154_ATTR_IFINDEX={0x8}]}, 0x24}, 0x1, 0x0, 0x0, 0x4000000}, 0x181) clock_gettime(0x0, &(0x7f0000000200)) pipe2$9p(&(0x7f0000000240), 0x800) openat$nvram(0xffffffffffffff9c, &(0x7f0000000680), 0x400, 0x0) r0 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$ieee802154(&(0x7f0000000740), 0xffffffffffffffff) sendmsg$IEEE802154_LLSEC_DEL_KEY(r0, &(0x7f0000000840)={&(0x7f0000000700)={0x10, 0x0, 0x0, 0x800000}, 0xc, &(0x7f0000000800)={&(0x7f0000000780)={0x54, r1, 0x800, 0x70bd27, 0x25dfdbfc, {}, [@IEEE802154_ATTR_LLSEC_KEY_SOURCE_SHORT={0x8, 0x2c, 0x5}, @IEEE802154_ATTR_LLSEC_KEY_SOURCE_EXTENDED={0xc, 0x2d, {0xaaaaaaaaaaaa0002}}, @IEEE802154_ATTR_PAN_ID={0x6, 0x6, 0x2}, @IEEE802154_ATTR_DEV_INDEX={0x8}, @IEEE802154_ATTR_LLSEC_KEY_MODE={0x5, 0x2b, 0x1}, @IEEE802154_ATTR_HW_ADDR={0xc, 0x5, {0xaaaaaaaaaaaa0002}}, @IEEE802154_ATTR_LLSEC_KEY_MODE={0x5, 0x2b, 0x3}]}, 0x54}, 0x1, 0x0, 0x0, 0x40}, 0x2000c814) clock_getres(0x3, &(0x7f0000000880)) r2 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) sendmsg$IEEE802154_ADD_IFACE(r2, &(0x7f0000000a00)={&(0x7f0000000900)={0x10, 0x0, 0x0, 0x40c}, 0xc, &(0x7f00000009c0)={&(0x7f0000000940)={0x44, r1, 0x200, 0x70bd29, 0x25dfdbfe, {}, [@IEEE802154_ATTR_PHY_NAME={0x9, 0x1f, 'phy1\x00'}, @IEEE802154_ATTR_DEV_NAME={0xa, 0x1, 'wpan4\x00'}, @IEEE802154_ATTR_DEV_NAME={0xa, 0x1, 'wpan1\x00'}, @IEEE802154_ATTR_DEV_NAME={0xa, 0x1, 'wpan0\x00'}]}, 0x44}, 0x1, 0x0, 0x0, 0x20000084}, 0x44000) 17:46:19 executing program 7: clock_gettime(0x5, &(0x7f0000000000)) clock_settime(0x2, &(0x7f0000000040)) sched_rr_get_interval(0xffffffffffffffff, &(0x7f0000000080)) sched_rr_get_interval(0x0, &(0x7f00000000c0)) sendmsg$NL802154_CMD_GET_SEC_KEY(0xffffffffffffffff, &(0x7f00000001c0)={&(0x7f0000000100)={0x10, 0x0, 0x0, 0x20000000}, 0xc, &(0x7f0000000180)={&(0x7f0000000140)={0x24, 0x0, 0x200, 0x70bd26, 0x25dfdbfe, {}, [@NL802154_ATTR_IFINDEX={0x8}, @NL802154_ATTR_IFINDEX={0x8}]}, 0x24}, 0x1, 0x0, 0x0, 0x4000000}, 0x181) clock_gettime(0x0, &(0x7f0000000200)) pipe2$9p(&(0x7f0000000240)={0xffffffffffffffff, 0xffffffffffffffff}, 0x800) r1 = syz_io_uring_setup(0x776a, &(0x7f0000000280)={0x0, 0x2728, 0x2, 0x1, 0x37c}, &(0x7f0000000000/0x3000)=nil, &(0x7f0000000000/0x400000)=nil, &(0x7f0000000300), &(0x7f0000000340)) ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, &(0x7f0000000540)={0x64, 0x0, &(0x7f0000000440)=[@transaction_sg={0x40486311, {0x1, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x50, 0x18, &(0x7f0000000380)={@fd={0x66642a85, 0x0, r0}, @fd={0x66642a85, 0x0, r1}, @fda={0x66646185, 0x0, 0x2, 0x36}}, &(0x7f0000000400)={0x0, 0x18, 0x30}}}, @request_death, @release={0x40046306, 0x1}], 0x7e, 0x0, &(0x7f00000004c0)="7685c519d1cbea63a1a8f022f8c0085baf770aa5d1fa9bfb1a5399fdb134953d619e962218bba650b68d6206fde39ff17760aa4bbcb62f6802c48e17294a17a3b768ab60bbae37aa37e33e24b09f6bdea37853f7ab2622451803788c9d172b7d71d6d87911129b8ef5cc9e0169404b09abfa991f3a7a3640686df445d387"}) pipe2$9p(&(0x7f0000000580), 0x800) ioctl$EVIOCGVERSION(0xffffffffffffffff, 0x80044501, &(0x7f00000005c0)=""/174) r2 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r3 = syz_genetlink_get_family_id$ieee802154(&(0x7f0000000740), 0xffffffffffffffff) sendmsg$IEEE802154_LLSEC_DEL_KEY(r2, &(0x7f0000000840)={&(0x7f0000000700)={0x10, 0x0, 0x0, 0x800000}, 0xc, &(0x7f0000000800)={&(0x7f0000000780)={0x54, r3, 0x800, 0x70bd27, 0x25dfdbfc, {}, [@IEEE802154_ATTR_LLSEC_KEY_SOURCE_SHORT={0x8, 0x2c, 0x5}, @IEEE802154_ATTR_LLSEC_KEY_SOURCE_EXTENDED={0xc, 0x2d, {0xaaaaaaaaaaaa0002}}, @IEEE802154_ATTR_PAN_ID={0x6, 0x6, 0x2}, @IEEE802154_ATTR_DEV_INDEX={0x8}, @IEEE802154_ATTR_LLSEC_KEY_MODE={0x5, 0x2b, 0x1}, @IEEE802154_ATTR_HW_ADDR={0xc, 0x5, {0xaaaaaaaaaaaa0002}}, @IEEE802154_ATTR_LLSEC_KEY_MODE={0x5, 0x2b, 0x3}]}, 0x54}, 0x1, 0x0, 0x0, 0x40}, 0x2000c814) clock_getres(0x3, &(0x7f0000000880)) syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) 17:46:19 executing program 1: shmget$private(0x0, 0x4000, 0x80, &(0x7f0000ffb000/0x4000)=nil) shmget(0x3, 0x2000, 0x4, &(0x7f0000ffc000/0x2000)=nil) mlock(&(0x7f0000ff0000/0x10000)=nil, 0x10000) shmget(0x1, 0x1000, 0x10, &(0x7f0000ff5000/0x1000)=nil) ioctl$sock_ipv4_tunnel_SIOCGETTUNNEL(0xffffffffffffffff, 0x89f0, &(0x7f0000000140)={'syztnl1\x00', &(0x7f00000000c0)={'syztnl2\x00', 0x0, 0x20, 0x1, 0x6, 0x9, {{0xd, 0x4, 0x1, 0x19, 0x34, 0x68, 0x0, 0x9, 0x29, 0x0, @empty, @dev={0xac, 0x14, 0x14, 0x29}, {[@timestamp_addr={0x44, 0x14, 0xc2, 0x1, 0x4, [{@multicast1}, {@private=0xa010101}]}, @rr={0x7, 0xb, 0xc8, [@initdev={0xac, 0x1e, 0x1, 0x0}, @private=0xa010102]}]}}}}}) ioctl$sock_ipv4_tunnel_SIOCADDTUNNEL(0xffffffffffffffff, 0x89f1, &(0x7f0000000280)={'tunl0\x00', &(0x7f0000000180)={'tunl0\x00', r0, 0x7, 0x8000, 0xfffffffc, 0x8, {{0x2f, 0x4, 0x0, 0x2, 0xbc, 0x65, 0x0, 0x0, 0x4, 0x0, @empty, @broadcast, {[@generic={0x89, 0x9, "8db1d464c6af68"}, @noop, @ra={0x94, 0x4, 0x1}, @timestamp={0x44, 0x1c, 0x53, 0x0, 0x7, [0x40, 0x7fffffff, 0xfffffffd, 0x5, 0x5c, 0x77]}, @cipso={0x86, 0x2f, 0x3, [{0x1, 0x4, "1eba"}, {0x1, 0x7, "e3ccb5ddcf"}, {0x6, 0xa, "5db18b961780af33"}, {0x2, 0xe, "7353a9824b57fd7d39232ac5"}, {0x1, 0x6, "2e1ccd27"}]}, @noop, @cipso={0x86, 0x37, 0xffffffffffffffff, [{0x2, 0xf, "227467028cabd4e137b820c5c9"}, {0x7, 0x6, "90569992"}, {0x2, 0xc, "2071b0a8c9ce92782e72"}, {0x6, 0xa, "14f2b9bca55ce3dd"}, {0x6, 0x6, "2cd22a8f"}]}, @timestamp={0x44, 0x14, 0xd4, 0x0, 0x5, [0x81, 0x5d23, 0x63ab, 0x1]}]}}}}}) ioctl$sock_ipv4_tunnel_SIOCDELTUNNEL(0xffffffffffffffff, 0x89f2, &(0x7f0000000380)={'gretap0\x00', &(0x7f00000002c0)={'syztnl2\x00', 0x0, 0x7800, 0x7, 0x40, 0xe180, {{0x22, 0x4, 0x0, 0x1, 0x88, 0x64, 0x0, 0x1, 0x29, 0x0, @multicast2, @multicast1, {[@end, @lsrr={0x83, 0x1f, 0x2f, [@multicast2, @local, @local, @multicast1, @rand_addr=0x64010102, @loopback, @private=0xa010100]}, @rr={0x7, 0x27, 0x6c, [@multicast1, @rand_addr=0x64010102, @remote, @multicast1, @loopback, @initdev={0xac, 0x1e, 0x0, 0x0}, @initdev={0xac, 0x1e, 0x1, 0x0}, @broadcast, @empty]}, @ra={0x94, 0x4, 0x1}, @timestamp={0x44, 0x10, 0x2d, 0x0, 0x8, [0x1, 0x100, 0x401]}, @ssrr={0x89, 0x13, 0x56, [@dev={0xac, 0x14, 0x14, 0x28}, @multicast2, @initdev={0xac, 0x1e, 0x0, 0x0}, @remote]}, @ra={0x94, 0x4, 0x1}]}}}}}) shmget(0x3, 0x4000, 0x4, &(0x7f0000ff9000/0x4000)=nil) mmap$IORING_OFF_CQ_RING(&(0x7f0000ffd000/0x3000)=nil, 0x3000, 0x2000008, 0x30, 0xffffffffffffffff, 0x8000000) r1 = syz_genetlink_get_family_id$nl802154(&(0x7f0000000400), 0xffffffffffffffff) sendmsg$NL802154_CMD_NEW_INTERFACE(0xffffffffffffffff, &(0x7f0000000540)={&(0x7f00000003c0)={0x10, 0x0, 0x0, 0x2}, 0xc, &(0x7f0000000500)={&(0x7f0000000480)={0x48, r1, 0x200, 0x70bd2a, 0x25dfdbfd, {}, [@NL802154_ATTR_IFNAME={0xa, 0x4, 'wpan0\x00'}, @NL802154_ATTR_IFINDEX={0x8}, @NL802154_ATTR_IFNAME={0xa, 0x4, 'wpan1\x00'}, @NL802154_ATTR_EXTENDED_ADDR={0xc, 0x17, {0xaaaaaaaaaaaa0002}}, @NL802154_ATTR_IFINDEX={0x8}]}, 0x48}}, 0x4001) mmap$binder(&(0x7f0000fef000/0x11000)=nil, 0x11000, 0x1, 0x11, 0xffffffffffffffff, 0x6) r2 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) sendmsg$IEEE802154_LLSEC_ADD_SECLEVEL(r2, &(0x7f00000006c0)={&(0x7f0000000580)={0x10, 0x0, 0x0, 0x4000000}, 0xc, &(0x7f0000000680)={&(0x7f0000000600)={0x44, 0x0, 0x200, 0x70bd2a, 0x25dfdbff, {}, [@IEEE802154_ATTR_LLSEC_FRAME_TYPE={0x5, 0x33, 0x34}, @IEEE802154_ATTR_DEV_INDEX={0x8}, @IEEE802154_ATTR_LLSEC_CMD_FRAME_ID={0x5, 0x34, 0x1}, @IEEE802154_ATTR_DEV_NAME={0xa, 0x1, 'wpan0\x00'}, @IEEE802154_ATTR_DEV_NAME={0xa, 0x1, 'wpan4\x00'}]}, 0x44}, 0x1, 0x0, 0x0, 0x8800}, 0x0) sendmsg$IEEE802154_START_REQ(r2, &(0x7f00000007c0)={&(0x7f0000000700)={0x10, 0x0, 0x0, 0x4}, 0xc, &(0x7f0000000780)={&(0x7f0000000740)={0x1c, 0x0, 0x200, 0x70bd2d, 0x25dfdbfb, {}, [@IEEE802154_ATTR_CHANNEL={0x5, 0x7, 0x6}]}, 0x1c}, 0x1, 0x0, 0x0, 0x40100}, 0x801) mlock(&(0x7f0000fef000/0x1000)=nil, 0x1000) syz_io_uring_setup(0x4726, &(0x7f0000000840)={0x0, 0x502f, 0x20, 0x0, 0x12e}, &(0x7f0000ffe000/0x2000)=nil, &(0x7f0000ffb000/0x4000)=nil, &(0x7f00000008c0), &(0x7f0000000900)) 17:46:19 executing program 2: prctl$PR_MPX_ENABLE_MANAGEMENT(0x2b) socket$inet(0x2, 0x5, 0x4) r0 = openat$vcsu(0xffffffffffffff9c, &(0x7f0000000000), 0x3c1480, 0x0) ioctl$sock_ipv4_tunnel_SIOCGETTUNNEL(r0, 0x89f0, &(0x7f00000000c0)={'syztnl2\x00', &(0x7f0000000040)={'erspan0\x00', 0x0, 0x700, 0x40, 0x3, 0x22, {{0x15, 0x4, 0x3, 0x17, 0x54, 0x64, 0x0, 0x1, 0x2f, 0x0, @broadcast, @dev={0xac, 0x14, 0x14, 0x36}, {[@cipso={0x86, 0x3d, 0x1, [{0x5, 0x9, "c8a7bec58c2c80"}, {0x0, 0x9, "fabb6c2e64ba82"}, {0x7, 0xf, "6b1b69e07efcb7230cc07a2cf7"}, {0x1, 0x6, "a2118bdb"}, {0x5, 0x10, "67115d3e7766231c7b08cf3c48e4"}]}]}}}}}) prctl$PR_MPX_ENABLE_MANAGEMENT(0x2b) r1 = openat$vcsa(0xffffffffffffff9c, &(0x7f0000000100), 0x202c0, 0x0) ioctl$SNDRV_SEQ_IOCTL_GET_QUEUE_TEMPO(r1, 0xc02c5341, &(0x7f0000000140)) syz_open_procfs(0x0, &(0x7f0000000500)='schedstat\x00') 17:46:19 executing program 5: clock_gettime(0x5, &(0x7f0000000000)) clock_settime(0x2, &(0x7f0000000040)) sched_rr_get_interval(0xffffffffffffffff, &(0x7f0000000080)) sched_rr_get_interval(0x0, &(0x7f00000000c0)) sendmsg$NL802154_CMD_GET_SEC_KEY(0xffffffffffffffff, &(0x7f00000001c0)={&(0x7f0000000100)={0x10, 0x0, 0x0, 0x20000000}, 0xc, &(0x7f0000000180)={&(0x7f0000000140)={0x24, 0x0, 0x200, 0x70bd26, 0x25dfdbfe, {}, [@NL802154_ATTR_IFINDEX={0x8}, @NL802154_ATTR_IFINDEX={0x8}]}, 0x24}, 0x1, 0x0, 0x0, 0x4000000}, 0x181) clock_gettime(0x0, &(0x7f0000000200)) pipe2$9p(&(0x7f0000000240), 0x800) openat$nvram(0xffffffffffffff9c, &(0x7f0000000680), 0x400, 0x0) r0 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$ieee802154(&(0x7f0000000740), 0xffffffffffffffff) sendmsg$IEEE802154_LLSEC_DEL_KEY(r0, &(0x7f0000000840)={&(0x7f0000000700)={0x10, 0x0, 0x0, 0x800000}, 0xc, &(0x7f0000000800)={&(0x7f0000000780)={0x54, r1, 0x800, 0x70bd27, 0x25dfdbfc, {}, [@IEEE802154_ATTR_LLSEC_KEY_SOURCE_SHORT={0x8, 0x2c, 0x5}, @IEEE802154_ATTR_LLSEC_KEY_SOURCE_EXTENDED={0xc, 0x2d, {0xaaaaaaaaaaaa0002}}, @IEEE802154_ATTR_PAN_ID={0x6, 0x6, 0x2}, @IEEE802154_ATTR_DEV_INDEX={0x8}, @IEEE802154_ATTR_LLSEC_KEY_MODE={0x5, 0x2b, 0x1}, @IEEE802154_ATTR_HW_ADDR={0xc, 0x5, {0xaaaaaaaaaaaa0002}}, @IEEE802154_ATTR_LLSEC_KEY_MODE={0x5, 0x2b, 0x3}]}, 0x54}, 0x1, 0x0, 0x0, 0x40}, 0x2000c814) clock_getres(0x3, &(0x7f0000000880)) r2 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) sendmsg$IEEE802154_ADD_IFACE(r2, &(0x7f0000000a00)={&(0x7f0000000900)={0x10, 0x0, 0x0, 0x40c}, 0xc, &(0x7f00000009c0)={&(0x7f0000000940)={0x44, r1, 0x200, 0x70bd29, 0x25dfdbfe, {}, [@IEEE802154_ATTR_PHY_NAME={0x9, 0x1f, 'phy1\x00'}, @IEEE802154_ATTR_DEV_NAME={0xa, 0x1, 'wpan4\x00'}, @IEEE802154_ATTR_DEV_NAME={0xa, 0x1, 'wpan1\x00'}, @IEEE802154_ATTR_DEV_NAME={0xa, 0x1, 'wpan0\x00'}]}, 0x44}, 0x1, 0x0, 0x0, 0x20000084}, 0x44000) 17:46:19 executing program 3: openat$nvram(0xffffffffffffff9c, &(0x7f0000000700), 0x0, 0x0) write$P9_RGETLOCK(0xffffffffffffffff, &(0x7f00000007c0)={0x1e, 0x37, 0x2, {0x2, 0x6, 0x101}}, 0x1e) 17:46:28 executing program 6: r0 = perf_event_open(&(0x7f00000000c0)={0x1, 0x80, 0x0, 0xc0, 0xfa, 0x1, 0x0, 0x7fffffff, 0x10811, 0x1, 0x1, 0x1, 0x1, 0x1, 0x1, 0x1, 0x1, 0x1, 0x0, 0x1, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x1, 0x0, 0x1, 0x0, 0x0, 0x0, 0x1, 0x1, 0x1, 0x1, 0x1, 0x1, 0x1, 0x0, 0x1, 0x1, 0x1, 0x1, 0x0, 0x0, 0xfff, 0x7, @perf_config_ext={0x7, 0x7fffffff}, 0x41000, 0x80000000, 0x5, 0x3, 0x9, 0x2, 0x9, 0x0, 0x5, 0x0, 0x4}, 0x0, 0xb, 0xffffffffffffffff, 0x1) perf_event_open(&(0x7f0000000040)={0x0, 0x80, 0x0, 0x40, 0x80, 0x9, 0x0, 0x3, 0x10040, 0x1, 0x0, 0x0, 0x1, 0x1, 0x1, 0x1, 0x1, 0x1, 0x1, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x3, 0x1, 0x0, 0x1, 0x0, 0x1, 0x1, 0x0, 0x0, 0x1, 0x1, 0x1, 0x0, 0x1, 0x0, 0x0, 0x0, 0x1, 0x0, 0x1, 0x0, 0x1, 0x0, 0x0, 0x1, @perf_bp={&(0x7f0000000000), 0x10}, 0x8080, 0x800, 0x2, 0x3, 0x36dc, 0x31df3b33, 0xff, 0x0, 0x9, 0x0, 0x5}, 0xffffffffffffffff, 0x9, r0, 0x9) ioctl$PERF_EVENT_IOC_PAUSE_OUTPUT(r0, 0x40042409, 0x0) write$cgroup_type(0xffffffffffffffff, &(0x7f0000001500), 0x9) 17:46:28 executing program 2: prctl$PR_MPX_ENABLE_MANAGEMENT(0x2b) socket$inet(0x2, 0x5, 0x4) r0 = openat$vcsu(0xffffffffffffff9c, &(0x7f0000000000), 0x3c1480, 0x0) ioctl$sock_ipv4_tunnel_SIOCGETTUNNEL(r0, 0x89f0, &(0x7f00000000c0)={'syztnl2\x00', &(0x7f0000000040)={'erspan0\x00', 0x0, 0x700, 0x40, 0x3, 0x22, {{0x15, 0x4, 0x3, 0x17, 0x54, 0x64, 0x0, 0x1, 0x2f, 0x0, @broadcast, @dev={0xac, 0x14, 0x14, 0x36}, {[@cipso={0x86, 0x3d, 0x1, [{0x5, 0x9, "c8a7bec58c2c80"}, {0x0, 0x9, "fabb6c2e64ba82"}, {0x7, 0xf, "6b1b69e07efcb7230cc07a2cf7"}, {0x1, 0x6, "a2118bdb"}, {0x5, 0x10, "67115d3e7766231c7b08cf3c48e4"}]}]}}}}}) prctl$PR_MPX_ENABLE_MANAGEMENT(0x2b) openat$vcsa(0xffffffffffffff9c, &(0x7f0000000100), 0x202c0, 0x0) syz_open_procfs(0x0, &(0x7f0000000500)='schedstat\x00') 17:46:28 executing program 1: shmget$private(0x0, 0x4000, 0x80, &(0x7f0000ffb000/0x4000)=nil) shmget(0x3, 0x2000, 0x4, &(0x7f0000ffc000/0x2000)=nil) mlock(&(0x7f0000ff0000/0x10000)=nil, 0x10000) shmget(0x1, 0x1000, 0x10, &(0x7f0000ff5000/0x1000)=nil) ioctl$sock_ipv4_tunnel_SIOCGETTUNNEL(0xffffffffffffffff, 0x89f0, &(0x7f0000000140)={'syztnl1\x00', &(0x7f00000000c0)={'syztnl2\x00', 0x0, 0x20, 0x1, 0x6, 0x9, {{0xd, 0x4, 0x1, 0x19, 0x34, 0x68, 0x0, 0x9, 0x29, 0x0, @empty, @dev={0xac, 0x14, 0x14, 0x29}, {[@timestamp_addr={0x44, 0x14, 0xc2, 0x1, 0x4, [{@multicast1}, {@private=0xa010101}]}, @rr={0x7, 0xb, 0xc8, [@initdev={0xac, 0x1e, 0x1, 0x0}, @private=0xa010102]}]}}}}}) ioctl$sock_ipv4_tunnel_SIOCADDTUNNEL(0xffffffffffffffff, 0x89f1, &(0x7f0000000280)={'tunl0\x00', &(0x7f0000000180)={'tunl0\x00', r0, 0x7, 0x8000, 0xfffffffc, 0x8, {{0x2f, 0x4, 0x0, 0x2, 0xbc, 0x65, 0x0, 0x0, 0x4, 0x0, @empty, @broadcast, {[@generic={0x89, 0x9, "8db1d464c6af68"}, @noop, @ra={0x94, 0x4, 0x1}, @timestamp={0x44, 0x1c, 0x53, 0x0, 0x7, [0x40, 0x7fffffff, 0xfffffffd, 0x5, 0x5c, 0x77]}, @cipso={0x86, 0x2f, 0x3, [{0x1, 0x4, "1eba"}, {0x1, 0x7, "e3ccb5ddcf"}, {0x6, 0xa, "5db18b961780af33"}, {0x2, 0xe, "7353a9824b57fd7d39232ac5"}, {0x1, 0x6, "2e1ccd27"}]}, @noop, @cipso={0x86, 0x37, 0xffffffffffffffff, [{0x2, 0xf, "227467028cabd4e137b820c5c9"}, {0x7, 0x6, "90569992"}, {0x2, 0xc, "2071b0a8c9ce92782e72"}, {0x6, 0xa, "14f2b9bca55ce3dd"}, {0x6, 0x6, "2cd22a8f"}]}, @timestamp={0x44, 0x14, 0xd4, 0x0, 0x5, [0x81, 0x5d23, 0x63ab, 0x1]}]}}}}}) ioctl$sock_ipv4_tunnel_SIOCDELTUNNEL(0xffffffffffffffff, 0x89f2, &(0x7f0000000380)={'gretap0\x00', &(0x7f00000002c0)={'syztnl2\x00', 0x0, 0x7800, 0x7, 0x40, 0xe180, {{0x22, 0x4, 0x0, 0x1, 0x88, 0x64, 0x0, 0x1, 0x29, 0x0, @multicast2, @multicast1, {[@end, @lsrr={0x83, 0x1f, 0x2f, [@multicast2, @local, @local, @multicast1, @rand_addr=0x64010102, @loopback, @private=0xa010100]}, @rr={0x7, 0x27, 0x6c, [@multicast1, @rand_addr=0x64010102, @remote, @multicast1, @loopback, @initdev={0xac, 0x1e, 0x0, 0x0}, @initdev={0xac, 0x1e, 0x1, 0x0}, @broadcast, @empty]}, @ra={0x94, 0x4, 0x1}, @timestamp={0x44, 0x10, 0x2d, 0x0, 0x8, [0x1, 0x100, 0x401]}, @ssrr={0x89, 0x13, 0x56, [@dev={0xac, 0x14, 0x14, 0x28}, @multicast2, @initdev={0xac, 0x1e, 0x0, 0x0}, @remote]}, @ra={0x94, 0x4, 0x1}]}}}}}) shmget(0x3, 0x4000, 0x4, &(0x7f0000ff9000/0x4000)=nil) mmap$IORING_OFF_CQ_RING(&(0x7f0000ffd000/0x3000)=nil, 0x3000, 0x2000008, 0x30, 0xffffffffffffffff, 0x8000000) r1 = syz_genetlink_get_family_id$nl802154(&(0x7f0000000400), 0xffffffffffffffff) sendmsg$NL802154_CMD_NEW_INTERFACE(0xffffffffffffffff, &(0x7f0000000540)={&(0x7f00000003c0)={0x10, 0x0, 0x0, 0x2}, 0xc, &(0x7f0000000500)={&(0x7f0000000480)={0x48, r1, 0x200, 0x70bd2a, 0x25dfdbfd, {}, [@NL802154_ATTR_IFNAME={0xa, 0x4, 'wpan0\x00'}, @NL802154_ATTR_IFINDEX={0x8}, @NL802154_ATTR_IFNAME={0xa, 0x4, 'wpan1\x00'}, @NL802154_ATTR_EXTENDED_ADDR={0xc, 0x17, {0xaaaaaaaaaaaa0002}}, @NL802154_ATTR_IFINDEX={0x8}]}, 0x48}}, 0x4001) mmap$binder(&(0x7f0000fef000/0x11000)=nil, 0x11000, 0x1, 0x11, 0xffffffffffffffff, 0x6) r2 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) sendmsg$IEEE802154_LLSEC_ADD_SECLEVEL(r2, &(0x7f00000006c0)={&(0x7f0000000580)={0x10, 0x0, 0x0, 0x4000000}, 0xc, &(0x7f0000000680)={&(0x7f0000000600)={0x44, 0x0, 0x200, 0x70bd2a, 0x25dfdbff, {}, [@IEEE802154_ATTR_LLSEC_FRAME_TYPE={0x5, 0x33, 0x34}, @IEEE802154_ATTR_DEV_INDEX={0x8}, @IEEE802154_ATTR_LLSEC_CMD_FRAME_ID={0x5, 0x34, 0x1}, @IEEE802154_ATTR_DEV_NAME={0xa, 0x1, 'wpan0\x00'}, @IEEE802154_ATTR_DEV_NAME={0xa, 0x1, 'wpan4\x00'}]}, 0x44}, 0x1, 0x0, 0x0, 0x8800}, 0x0) sendmsg$IEEE802154_START_REQ(r2, &(0x7f00000007c0)={&(0x7f0000000700)={0x10, 0x0, 0x0, 0x4}, 0xc, &(0x7f0000000780)={&(0x7f0000000740)={0x1c, 0x0, 0x200, 0x70bd2d, 0x25dfdbfb, {}, [@IEEE802154_ATTR_CHANNEL={0x5, 0x7, 0x6}]}, 0x1c}, 0x1, 0x0, 0x0, 0x40100}, 0x801) mlock(&(0x7f0000fef000/0x1000)=nil, 0x1000) syz_io_uring_setup(0x4726, &(0x7f0000000840)={0x0, 0x502f, 0x20, 0x0, 0x12e}, &(0x7f0000ffe000/0x2000)=nil, &(0x7f0000ffb000/0x4000)=nil, &(0x7f00000008c0), &(0x7f0000000900)) 17:46:28 executing program 7: clock_gettime(0x5, &(0x7f0000000000)) clock_settime(0x2, &(0x7f0000000040)) sched_rr_get_interval(0xffffffffffffffff, &(0x7f0000000080)) sched_rr_get_interval(0x0, &(0x7f00000000c0)) sendmsg$NL802154_CMD_GET_SEC_KEY(0xffffffffffffffff, &(0x7f00000001c0)={&(0x7f0000000100)={0x10, 0x0, 0x0, 0x20000000}, 0xc, &(0x7f0000000180)={&(0x7f0000000140)={0x24, 0x0, 0x200, 0x70bd26, 0x25dfdbfe, {}, [@NL802154_ATTR_IFINDEX={0x8}, @NL802154_ATTR_IFINDEX={0x8}]}, 0x24}, 0x1, 0x0, 0x0, 0x4000000}, 0x181) clock_gettime(0x0, &(0x7f0000000200)) pipe2$9p(&(0x7f0000000240)={0xffffffffffffffff, 0xffffffffffffffff}, 0x800) r1 = syz_io_uring_setup(0x776a, &(0x7f0000000280)={0x0, 0x2728, 0x2, 0x1, 0x37c}, &(0x7f0000000000/0x3000)=nil, &(0x7f0000000000/0x400000)=nil, &(0x7f0000000300), &(0x7f0000000340)) ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, &(0x7f0000000540)={0x64, 0x0, &(0x7f0000000440)=[@transaction_sg={0x40486311, {0x1, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x50, 0x18, &(0x7f0000000380)={@fd={0x66642a85, 0x0, r0}, @fd={0x66642a85, 0x0, r1}, @fda={0x66646185, 0x0, 0x2, 0x36}}, &(0x7f0000000400)={0x0, 0x18, 0x30}}}, @request_death, @release={0x40046306, 0x1}], 0x7e, 0x0, &(0x7f00000004c0)="7685c519d1cbea63a1a8f022f8c0085baf770aa5d1fa9bfb1a5399fdb134953d619e962218bba650b68d6206fde39ff17760aa4bbcb62f6802c48e17294a17a3b768ab60bbae37aa37e33e24b09f6bdea37853f7ab2622451803788c9d172b7d71d6d87911129b8ef5cc9e0169404b09abfa991f3a7a3640686df445d387"}) pipe2$9p(&(0x7f0000000580), 0x800) ioctl$EVIOCGVERSION(0xffffffffffffffff, 0x80044501, &(0x7f00000005c0)=""/174) r2 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r3 = syz_genetlink_get_family_id$ieee802154(&(0x7f0000000740), 0xffffffffffffffff) sendmsg$IEEE802154_LLSEC_DEL_KEY(r2, &(0x7f0000000840)={&(0x7f0000000700)={0x10, 0x0, 0x0, 0x800000}, 0xc, &(0x7f0000000800)={&(0x7f0000000780)={0x54, r3, 0x800, 0x70bd27, 0x25dfdbfc, {}, [@IEEE802154_ATTR_LLSEC_KEY_SOURCE_SHORT={0x8, 0x2c, 0x5}, @IEEE802154_ATTR_LLSEC_KEY_SOURCE_EXTENDED={0xc, 0x2d, {0xaaaaaaaaaaaa0002}}, @IEEE802154_ATTR_PAN_ID={0x6, 0x6, 0x2}, @IEEE802154_ATTR_DEV_INDEX={0x8}, @IEEE802154_ATTR_LLSEC_KEY_MODE={0x5, 0x2b, 0x1}, @IEEE802154_ATTR_HW_ADDR={0xc, 0x5, {0xaaaaaaaaaaaa0002}}, @IEEE802154_ATTR_LLSEC_KEY_MODE={0x5, 0x2b, 0x3}]}, 0x54}, 0x1, 0x0, 0x0, 0x40}, 0x2000c814) clock_getres(0x3, &(0x7f0000000880)) syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) 17:46:28 executing program 5: clock_gettime(0x5, &(0x7f0000000000)) clock_settime(0x2, &(0x7f0000000040)) sched_rr_get_interval(0xffffffffffffffff, &(0x7f0000000080)) sched_rr_get_interval(0x0, &(0x7f00000000c0)) sendmsg$NL802154_CMD_GET_SEC_KEY(0xffffffffffffffff, &(0x7f00000001c0)={&(0x7f0000000100)={0x10, 0x0, 0x0, 0x20000000}, 0xc, &(0x7f0000000180)={&(0x7f0000000140)={0x24, 0x0, 0x200, 0x70bd26, 0x25dfdbfe, {}, [@NL802154_ATTR_IFINDEX={0x8}, @NL802154_ATTR_IFINDEX={0x8}]}, 0x24}, 0x1, 0x0, 0x0, 0x4000000}, 0x181) clock_gettime(0x0, &(0x7f0000000200)) syz_io_uring_setup(0x776a, &(0x7f0000000280)={0x0, 0x2728, 0x2, 0x1, 0x37c}, &(0x7f0000000000/0x3000)=nil, &(0x7f0000000000/0x400000)=nil, &(0x7f0000000300), &(0x7f0000000340)) openat$nvram(0xffffffffffffff9c, &(0x7f0000000680), 0x400, 0x0) r0 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$ieee802154(&(0x7f0000000740), 0xffffffffffffffff) sendmsg$IEEE802154_LLSEC_DEL_KEY(r0, &(0x7f0000000840)={&(0x7f0000000700)={0x10, 0x0, 0x0, 0x800000}, 0xc, &(0x7f0000000800)={&(0x7f0000000780)={0x54, r1, 0x800, 0x70bd27, 0x25dfdbfc, {}, [@IEEE802154_ATTR_LLSEC_KEY_SOURCE_SHORT={0x8, 0x2c, 0x5}, @IEEE802154_ATTR_LLSEC_KEY_SOURCE_EXTENDED={0xc, 0x2d, {0xaaaaaaaaaaaa0002}}, @IEEE802154_ATTR_PAN_ID={0x6, 0x6, 0x2}, @IEEE802154_ATTR_DEV_INDEX={0x8}, @IEEE802154_ATTR_LLSEC_KEY_MODE={0x5, 0x2b, 0x1}, @IEEE802154_ATTR_HW_ADDR={0xc, 0x5, {0xaaaaaaaaaaaa0002}}, @IEEE802154_ATTR_LLSEC_KEY_MODE={0x5, 0x2b, 0x3}]}, 0x54}, 0x1, 0x0, 0x0, 0x40}, 0x2000c814) clock_getres(0x3, &(0x7f0000000880)) r2 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) sendmsg$IEEE802154_ADD_IFACE(r2, &(0x7f0000000a00)={&(0x7f0000000900)={0x10, 0x0, 0x0, 0x40c}, 0xc, &(0x7f00000009c0)={&(0x7f0000000940)={0x44, r1, 0x200, 0x70bd29, 0x25dfdbfe, {}, [@IEEE802154_ATTR_PHY_NAME={0x9, 0x1f, 'phy1\x00'}, @IEEE802154_ATTR_DEV_NAME={0xa, 0x1, 'wpan4\x00'}, @IEEE802154_ATTR_DEV_NAME={0xa, 0x1, 'wpan1\x00'}, @IEEE802154_ATTR_DEV_NAME={0xa, 0x1, 'wpan0\x00'}]}, 0x44}, 0x1, 0x0, 0x0, 0x20000084}, 0x44000) 17:46:28 executing program 3: openat$nvram(0xffffffffffffff9c, &(0x7f0000000700), 0x0, 0x0) write$P9_RGETLOCK(0xffffffffffffffff, &(0x7f00000007c0)={0x1e, 0x37, 0x2, {0x2, 0x6, 0x101}}, 0x1e) 17:46:28 executing program 4: r0 = perf_event_open(&(0x7f00000000c0)={0x1, 0x80, 0x0, 0xc0, 0xfa, 0x1, 0x0, 0x7fffffff, 0x10811, 0x1, 0x1, 0x1, 0x1, 0x1, 0x1, 0x1, 0x1, 0x1, 0x0, 0x1, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x1, 0x0, 0x1, 0x0, 0x0, 0x0, 0x1, 0x1, 0x1, 0x1, 0x1, 0x1, 0x1, 0x0, 0x1, 0x1, 0x1, 0x1, 0x0, 0x0, 0xfff, 0x7, @perf_config_ext={0x7, 0x7fffffff}, 0x41000, 0x80000000, 0x5, 0x3, 0x9, 0x2, 0x9, 0x0, 0x5, 0x0, 0x4}, 0x0, 0xb, 0xffffffffffffffff, 0x1) perf_event_open(&(0x7f0000000040)={0x0, 0x80, 0x0, 0x40, 0x80, 0x9, 0x0, 0x3, 0x10040, 0x1, 0x0, 0x0, 0x1, 0x1, 0x1, 0x1, 0x1, 0x1, 0x1, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x3, 0x1, 0x0, 0x1, 0x0, 0x1, 0x1, 0x0, 0x0, 0x1, 0x1, 0x1, 0x0, 0x1, 0x0, 0x0, 0x0, 0x1, 0x0, 0x1, 0x0, 0x1, 0x0, 0x0, 0x1, @perf_bp={&(0x7f0000000000), 0x10}, 0x8080, 0x800, 0x2, 0x3, 0x36dc, 0x31df3b33, 0xff, 0x0, 0x9, 0x0, 0x5}, 0xffffffffffffffff, 0x9, r0, 0x9) ioctl$PERF_EVENT_IOC_PAUSE_OUTPUT(r0, 0x40042409, 0x0) ioctl$PERF_EVENT_IOC_PERIOD(0xffffffffffffffff, 0x40082404, &(0x7f0000000140)=0x8) r1 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl$sock_ipv4_tunnel_SIOCADDTUNNEL(r1, 0x89f1, &(0x7f00000001c0)={'syztnl1\x00', &(0x7f0000000180)={'syztnl0\x00', 0x0, 0x1, 0x40, 0x0, 0x5, {{0x5, 0x4, 0x2, 0x19, 0x14, 0x65, 0x0, 0x1f, 0x4, 0x0, @multicast2, @remote}}}}) ioctl$PERF_EVENT_IOC_PERIOD(r0, 0x40082404, &(0x7f0000000200)=0x9) ioctl$SNDRV_SEQ_IOCTL_GET_PORT_INFO(0xffffffffffffffff, 0xc0a85322, &(0x7f0000000240)) ioctl$SNDRV_SEQ_IOCTL_SYSTEM_INFO(0xffffffffffffffff, 0xc0305302, &(0x7f0000000300)={0x9, 0x101, 0x1, 0x6, 0x3, 0x5}) r2 = syz_open_procfs(0x0, &(0x7f0000000340)='children\x00') openat$cgroup_type(r2, &(0x7f0000000380), 0x2, 0x0) 17:46:28 executing program 0: get_thread_area(&(0x7f0000000000)={0x7, 0x20000800, 0x4000, 0x0, 0x1, 0x0, 0x0, 0x1, 0x1, 0x1}) r0 = openat$vcsu(0xffffffffffffff9c, &(0x7f0000000040), 0x200000, 0x0) getsockopt$inet_tcp_TCP_REPAIR_WINDOW(r0, 0x6, 0x1d, &(0x7f0000000080), &(0x7f00000000c0)=0x14) r1 = openat$nvram(0xffffffffffffff9c, &(0x7f0000000100), 0x2000, 0x0) setsockopt$inet_tcp_TCP_FASTOPEN_KEY(r1, 0x6, 0x21, &(0x7f0000000140)="1bb9d563048b6ec78effc0f14d974b17", 0x10) setsockopt$inet_tcp_int(r1, 0x6, 0x1b, &(0x7f0000000180)=0x5, 0x4) ioctl$SNDRV_TIMER_IOCTL_STATUS32(r1, 0x80585414, &(0x7f00000001c0)) setsockopt$inet_tcp_TCP_QUEUE_SEQ(r0, 0x6, 0x15, &(0x7f0000000240)=0x1, 0x4) getsockopt$inet_tcp_TCP_ZEROCOPY_RECEIVE(r1, 0x6, 0x23, &(0x7f0000000340)={&(0x7f0000ffc000/0x2000)=nil, 0x2000, 0x0, 0x0, 0x0, &(0x7f0000000280)=""/37, 0x25, 0x1, &(0x7f00000002c0)=""/109, 0x6d}, &(0x7f0000000380)=0x40) ioctl$sock_inet_tcp_SIOCINQ(0xffffffffffffffff, 0x541b, &(0x7f00000003c0)) move_pages(0x0, 0x8, &(0x7f0000000400)=[&(0x7f0000ffd000/0x1000)=nil, &(0x7f0000ffd000/0x3000)=nil, &(0x7f0000ffd000/0x3000)=nil, &(0x7f0000ffb000/0x2000)=nil, &(0x7f0000ffc000/0x1000)=nil, &(0x7f0000ffe000/0x2000)=nil, &(0x7f0000ffb000/0x4000)=nil, &(0x7f0000ffd000/0x3000)=nil], &(0x7f0000000440)=[0xfff], &(0x7f0000000480)=[0x0, 0x0, 0x0], 0x4) r2 = syz_genetlink_get_family_id$SEG6(&(0x7f0000000500), r1) sendmsg$SEG6_CMD_GET_TUNSRC(r0, &(0x7f00000005c0)={&(0x7f00000004c0)={0x10, 0x0, 0x0, 0x4000000}, 0xc, &(0x7f0000000580)={&(0x7f0000000540)={0x38, r2, 0x300, 0x70bd2a, 0x25dfdbfc, {}, [@SEG6_ATTR_HMACKEYID={0x8, 0x3, 0x24}, @SEG6_ATTR_DST={0x14, 0x1, @mcast1}, @SEG6_ATTR_DSTLEN={0x8, 0x2, 0x2}]}, 0x38}, 0x1, 0x0, 0x0, 0x20008810}, 0x4040010) sendmsg$SEG6_CMD_DUMPHMAC(0xffffffffffffffff, &(0x7f0000000740)={&(0x7f0000000680)={0x10, 0x0, 0x0, 0x240000}, 0xc, &(0x7f0000000700)={&(0x7f00000006c0)={0x2c, r2, 0x1, 0x70bd2c, 0x25dfdbfe, {}, [@SEG6_ATTR_SECRET={0x8, 0x4, [0x1]}, @SEG6_ATTR_DSTLEN={0x8, 0x2, 0x5}, @SEG6_ATTR_DSTLEN={0x8}]}, 0x2c}, 0x1, 0x0, 0x0, 0x4000000}, 0x4000000) pidfd_getfd(r1, 0xffffffffffffffff, 0x0) syz_genetlink_get_family_id$ieee802154(&(0x7f0000000800), 0xffffffffffffffff) 17:46:28 executing program 0: get_thread_area(&(0x7f0000000000)={0x7, 0x20000800, 0x4000, 0x0, 0x1, 0x0, 0x0, 0x1, 0x1, 0x1}) r0 = openat$vcsu(0xffffffffffffff9c, &(0x7f0000000040), 0x200000, 0x0) getsockopt$inet_tcp_TCP_REPAIR_WINDOW(r0, 0x6, 0x1d, &(0x7f0000000080), &(0x7f00000000c0)=0x14) r1 = openat$nvram(0xffffffffffffff9c, &(0x7f0000000100), 0x2000, 0x0) setsockopt$inet_tcp_TCP_FASTOPEN_KEY(r1, 0x6, 0x21, &(0x7f0000000140)="1bb9d563048b6ec78effc0f14d974b17", 0x10) setsockopt$inet_tcp_int(r1, 0x6, 0x1b, &(0x7f0000000180)=0x5, 0x4) ioctl$SNDRV_TIMER_IOCTL_STATUS32(r1, 0x80585414, &(0x7f00000001c0)) setsockopt$inet_tcp_TCP_QUEUE_SEQ(r0, 0x6, 0x15, &(0x7f0000000240)=0x1, 0x4) getsockopt$inet_tcp_TCP_ZEROCOPY_RECEIVE(r1, 0x6, 0x23, &(0x7f0000000340)={&(0x7f0000ffc000/0x2000)=nil, 0x2000, 0x0, 0x0, 0x0, &(0x7f0000000280)=""/37, 0x25, 0x1, &(0x7f00000002c0)=""/109, 0x6d}, &(0x7f0000000380)=0x40) ioctl$sock_inet_tcp_SIOCINQ(0xffffffffffffffff, 0x541b, &(0x7f00000003c0)) move_pages(0x0, 0x8, &(0x7f0000000400)=[&(0x7f0000ffd000/0x1000)=nil, &(0x7f0000ffd000/0x3000)=nil, &(0x7f0000ffd000/0x3000)=nil, &(0x7f0000ffb000/0x2000)=nil, &(0x7f0000ffc000/0x1000)=nil, &(0x7f0000ffe000/0x2000)=nil, &(0x7f0000ffb000/0x4000)=nil, &(0x7f0000ffd000/0x3000)=nil], &(0x7f0000000440)=[0xfff], &(0x7f0000000480)=[0x0, 0x0, 0x0], 0x4) r2 = syz_genetlink_get_family_id$SEG6(&(0x7f0000000500), r1) sendmsg$SEG6_CMD_GET_TUNSRC(r0, &(0x7f00000005c0)={&(0x7f00000004c0)={0x10, 0x0, 0x0, 0x4000000}, 0xc, &(0x7f0000000580)={&(0x7f0000000540)={0x38, r2, 0x300, 0x70bd2a, 0x25dfdbfc, {}, [@SEG6_ATTR_HMACKEYID={0x8, 0x3, 0x24}, @SEG6_ATTR_DST={0x14, 0x1, @mcast1}, @SEG6_ATTR_DSTLEN={0x8, 0x2, 0x2}]}, 0x38}, 0x1, 0x0, 0x0, 0x20008810}, 0x4040010) sendmsg$SEG6_CMD_DUMPHMAC(0xffffffffffffffff, &(0x7f0000000740)={&(0x7f0000000680)={0x10, 0x0, 0x0, 0x240000}, 0xc, &(0x7f0000000700)={&(0x7f00000006c0)={0x2c, r2, 0x1, 0x70bd2c, 0x25dfdbfe, {}, [@SEG6_ATTR_SECRET={0x8, 0x4, [0x1]}, @SEG6_ATTR_DSTLEN={0x8, 0x2, 0x5}, @SEG6_ATTR_DSTLEN={0x8}]}, 0x2c}, 0x1, 0x0, 0x0, 0x4000000}, 0x4000000) pidfd_getfd(r1, 0xffffffffffffffff, 0x0) syz_genetlink_get_family_id$ieee802154(&(0x7f0000000800), 0xffffffffffffffff) 17:46:28 executing program 6: r0 = perf_event_open(&(0x7f00000000c0)={0x1, 0x80, 0x0, 0xc0, 0xfa, 0x1, 0x0, 0x7fffffff, 0x10811, 0x1, 0x1, 0x1, 0x1, 0x1, 0x1, 0x1, 0x1, 0x1, 0x0, 0x1, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x1, 0x0, 0x1, 0x0, 0x0, 0x0, 0x1, 0x1, 0x1, 0x1, 0x1, 0x1, 0x1, 0x0, 0x1, 0x1, 0x1, 0x1, 0x0, 0x0, 0xfff, 0x7, @perf_config_ext={0x7, 0x7fffffff}, 0x41000, 0x80000000, 0x5, 0x3, 0x9, 0x2, 0x9, 0x0, 0x5, 0x0, 0x4}, 0x0, 0xb, 0xffffffffffffffff, 0x1) perf_event_open(&(0x7f0000000040)={0x0, 0x80, 0x0, 0x40, 0x80, 0x9, 0x0, 0x3, 0x10040, 0x1, 0x0, 0x0, 0x1, 0x1, 0x1, 0x1, 0x1, 0x1, 0x1, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x3, 0x1, 0x0, 0x1, 0x0, 0x1, 0x1, 0x0, 0x0, 0x1, 0x1, 0x1, 0x0, 0x1, 0x0, 0x0, 0x0, 0x1, 0x0, 0x1, 0x0, 0x1, 0x0, 0x0, 0x1, @perf_bp={&(0x7f0000000000), 0x10}, 0x8080, 0x800, 0x2, 0x3, 0x36dc, 0x31df3b33, 0xff, 0x0, 0x9, 0x0, 0x5}, 0xffffffffffffffff, 0x9, r0, 0x9) write$cgroup_type(0xffffffffffffffff, &(0x7f0000001500), 0x9) 17:46:28 executing program 5: clock_gettime(0x5, &(0x7f0000000000)) clock_settime(0x2, &(0x7f0000000040)) sched_rr_get_interval(0xffffffffffffffff, &(0x7f0000000080)) sched_rr_get_interval(0x0, &(0x7f00000000c0)) sendmsg$NL802154_CMD_GET_SEC_KEY(0xffffffffffffffff, &(0x7f00000001c0)={&(0x7f0000000100)={0x10, 0x0, 0x0, 0x20000000}, 0xc, &(0x7f0000000180)={&(0x7f0000000140)={0x24, 0x0, 0x200, 0x70bd26, 0x25dfdbfe, {}, [@NL802154_ATTR_IFINDEX={0x8}, @NL802154_ATTR_IFINDEX={0x8}]}, 0x24}, 0x1, 0x0, 0x0, 0x4000000}, 0x181) clock_gettime(0x0, &(0x7f0000000200)) syz_io_uring_setup(0x776a, &(0x7f0000000280)={0x0, 0x2728, 0x2, 0x1, 0x37c}, &(0x7f0000000000/0x3000)=nil, &(0x7f0000000000/0x400000)=nil, &(0x7f0000000300), &(0x7f0000000340)) openat$nvram(0xffffffffffffff9c, &(0x7f0000000680), 0x400, 0x0) r0 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$ieee802154(&(0x7f0000000740), 0xffffffffffffffff) sendmsg$IEEE802154_LLSEC_DEL_KEY(r0, &(0x7f0000000840)={&(0x7f0000000700)={0x10, 0x0, 0x0, 0x800000}, 0xc, &(0x7f0000000800)={&(0x7f0000000780)={0x54, r1, 0x800, 0x70bd27, 0x25dfdbfc, {}, [@IEEE802154_ATTR_LLSEC_KEY_SOURCE_SHORT={0x8, 0x2c, 0x5}, @IEEE802154_ATTR_LLSEC_KEY_SOURCE_EXTENDED={0xc, 0x2d, {0xaaaaaaaaaaaa0002}}, @IEEE802154_ATTR_PAN_ID={0x6, 0x6, 0x2}, @IEEE802154_ATTR_DEV_INDEX={0x8}, @IEEE802154_ATTR_LLSEC_KEY_MODE={0x5, 0x2b, 0x1}, @IEEE802154_ATTR_HW_ADDR={0xc, 0x5, {0xaaaaaaaaaaaa0002}}, @IEEE802154_ATTR_LLSEC_KEY_MODE={0x5, 0x2b, 0x3}]}, 0x54}, 0x1, 0x0, 0x0, 0x40}, 0x2000c814) clock_getres(0x3, &(0x7f0000000880)) r2 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) sendmsg$IEEE802154_ADD_IFACE(r2, &(0x7f0000000a00)={&(0x7f0000000900)={0x10, 0x0, 0x0, 0x40c}, 0xc, &(0x7f00000009c0)={&(0x7f0000000940)={0x44, r1, 0x200, 0x70bd29, 0x25dfdbfe, {}, [@IEEE802154_ATTR_PHY_NAME={0x9, 0x1f, 'phy1\x00'}, @IEEE802154_ATTR_DEV_NAME={0xa, 0x1, 'wpan4\x00'}, @IEEE802154_ATTR_DEV_NAME={0xa, 0x1, 'wpan1\x00'}, @IEEE802154_ATTR_DEV_NAME={0xa, 0x1, 'wpan0\x00'}]}, 0x44}, 0x1, 0x0, 0x0, 0x20000084}, 0x44000) 17:46:28 executing program 3: r0 = openat$nvram(0xffffffffffffff9c, &(0x7f0000000700), 0x0, 0x0) write$P9_RGETLOCK(r0, 0x0, 0x0) 17:46:28 executing program 2: prctl$PR_MPX_ENABLE_MANAGEMENT(0x2b) socket$inet(0x2, 0x5, 0x4) r0 = openat$vcsu(0xffffffffffffff9c, &(0x7f0000000000), 0x3c1480, 0x0) ioctl$sock_ipv4_tunnel_SIOCGETTUNNEL(r0, 0x89f0, &(0x7f00000000c0)={'syztnl2\x00', &(0x7f0000000040)={'erspan0\x00', 0x0, 0x700, 0x40, 0x3, 0x22, {{0x15, 0x4, 0x3, 0x17, 0x54, 0x64, 0x0, 0x1, 0x2f, 0x0, @broadcast, @dev={0xac, 0x14, 0x14, 0x36}, {[@cipso={0x86, 0x3d, 0x1, [{0x5, 0x9, "c8a7bec58c2c80"}, {0x0, 0x9, "fabb6c2e64ba82"}, {0x7, 0xf, "6b1b69e07efcb7230cc07a2cf7"}, {0x1, 0x6, "a2118bdb"}, {0x5, 0x10, "67115d3e7766231c7b08cf3c48e4"}]}]}}}}}) prctl$PR_MPX_ENABLE_MANAGEMENT(0x2b) syz_open_procfs(0x0, &(0x7f0000000500)='schedstat\x00') 17:46:28 executing program 1: shmget$private(0x0, 0x4000, 0x80, &(0x7f0000ffb000/0x4000)=nil) shmget(0x3, 0x2000, 0x4, &(0x7f0000ffc000/0x2000)=nil) mlock(&(0x7f0000ff0000/0x10000)=nil, 0x10000) shmget(0x1, 0x1000, 0x10, &(0x7f0000ff5000/0x1000)=nil) ioctl$sock_ipv4_tunnel_SIOCGETTUNNEL(0xffffffffffffffff, 0x89f0, &(0x7f0000000140)={'syztnl1\x00', &(0x7f00000000c0)={'syztnl2\x00', 0x0, 0x20, 0x1, 0x6, 0x9, {{0xd, 0x4, 0x1, 0x19, 0x34, 0x68, 0x0, 0x9, 0x29, 0x0, @empty, @dev={0xac, 0x14, 0x14, 0x29}, {[@timestamp_addr={0x44, 0x14, 0xc2, 0x1, 0x4, [{@multicast1}, {@private=0xa010101}]}, @rr={0x7, 0xb, 0xc8, [@initdev={0xac, 0x1e, 0x1, 0x0}, @private=0xa010102]}]}}}}}) ioctl$sock_ipv4_tunnel_SIOCADDTUNNEL(0xffffffffffffffff, 0x89f1, &(0x7f0000000280)={'tunl0\x00', &(0x7f0000000180)={'tunl0\x00', r0, 0x7, 0x8000, 0xfffffffc, 0x8, {{0x2f, 0x4, 0x0, 0x2, 0xbc, 0x65, 0x0, 0x0, 0x4, 0x0, @empty, @broadcast, {[@generic={0x89, 0x9, "8db1d464c6af68"}, @noop, @ra={0x94, 0x4, 0x1}, @timestamp={0x44, 0x1c, 0x53, 0x0, 0x7, [0x40, 0x7fffffff, 0xfffffffd, 0x5, 0x5c, 0x77]}, @cipso={0x86, 0x2f, 0x3, [{0x1, 0x4, "1eba"}, {0x1, 0x7, "e3ccb5ddcf"}, {0x6, 0xa, "5db18b961780af33"}, {0x2, 0xe, "7353a9824b57fd7d39232ac5"}, {0x1, 0x6, "2e1ccd27"}]}, @noop, @cipso={0x86, 0x37, 0xffffffffffffffff, [{0x2, 0xf, "227467028cabd4e137b820c5c9"}, {0x7, 0x6, "90569992"}, {0x2, 0xc, "2071b0a8c9ce92782e72"}, {0x6, 0xa, "14f2b9bca55ce3dd"}, {0x6, 0x6, "2cd22a8f"}]}, @timestamp={0x44, 0x14, 0xd4, 0x0, 0x5, [0x81, 0x5d23, 0x63ab, 0x1]}]}}}}}) ioctl$sock_ipv4_tunnel_SIOCDELTUNNEL(0xffffffffffffffff, 0x89f2, &(0x7f0000000380)={'gretap0\x00', &(0x7f00000002c0)={'syztnl2\x00', 0x0, 0x7800, 0x7, 0x40, 0xe180, {{0x22, 0x4, 0x0, 0x1, 0x88, 0x64, 0x0, 0x1, 0x29, 0x0, @multicast2, @multicast1, {[@end, @lsrr={0x83, 0x1f, 0x2f, [@multicast2, @local, @local, @multicast1, @rand_addr=0x64010102, @loopback, @private=0xa010100]}, @rr={0x7, 0x27, 0x6c, [@multicast1, @rand_addr=0x64010102, @remote, @multicast1, @loopback, @initdev={0xac, 0x1e, 0x0, 0x0}, @initdev={0xac, 0x1e, 0x1, 0x0}, @broadcast, @empty]}, @ra={0x94, 0x4, 0x1}, @timestamp={0x44, 0x10, 0x2d, 0x0, 0x8, [0x1, 0x100, 0x401]}, @ssrr={0x89, 0x13, 0x56, [@dev={0xac, 0x14, 0x14, 0x28}, @multicast2, @initdev={0xac, 0x1e, 0x0, 0x0}, @remote]}, @ra={0x94, 0x4, 0x1}]}}}}}) shmget(0x3, 0x4000, 0x4, &(0x7f0000ff9000/0x4000)=nil) mmap$IORING_OFF_CQ_RING(&(0x7f0000ffd000/0x3000)=nil, 0x3000, 0x2000008, 0x30, 0xffffffffffffffff, 0x8000000) sendmsg$NL802154_CMD_NEW_INTERFACE(0xffffffffffffffff, &(0x7f0000000540)={&(0x7f00000003c0)={0x10, 0x0, 0x0, 0x2}, 0xc, &(0x7f0000000500)={&(0x7f0000000480)={0x48, 0x0, 0x200, 0x70bd2a, 0x25dfdbfd, {}, [@NL802154_ATTR_IFNAME={0xa, 0x4, 'wpan0\x00'}, @NL802154_ATTR_IFINDEX={0x8}, @NL802154_ATTR_IFNAME={0xa, 0x4, 'wpan1\x00'}, @NL802154_ATTR_EXTENDED_ADDR={0xc, 0x17, {0xaaaaaaaaaaaa0002}}, @NL802154_ATTR_IFINDEX={0x8}]}, 0x48}}, 0x4001) mmap$binder(&(0x7f0000fef000/0x11000)=nil, 0x11000, 0x1, 0x11, 0xffffffffffffffff, 0x6) r1 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) sendmsg$IEEE802154_LLSEC_ADD_SECLEVEL(r1, &(0x7f00000006c0)={&(0x7f0000000580)={0x10, 0x0, 0x0, 0x4000000}, 0xc, &(0x7f0000000680)={&(0x7f0000000600)={0x44, 0x0, 0x200, 0x70bd2a, 0x25dfdbff, {}, [@IEEE802154_ATTR_LLSEC_FRAME_TYPE={0x5, 0x33, 0x34}, @IEEE802154_ATTR_DEV_INDEX={0x8}, @IEEE802154_ATTR_LLSEC_CMD_FRAME_ID={0x5, 0x34, 0x1}, @IEEE802154_ATTR_DEV_NAME={0xa, 0x1, 'wpan0\x00'}, @IEEE802154_ATTR_DEV_NAME={0xa, 0x1, 'wpan4\x00'}]}, 0x44}, 0x1, 0x0, 0x0, 0x8800}, 0x0) sendmsg$IEEE802154_START_REQ(r1, &(0x7f00000007c0)={&(0x7f0000000700)={0x10, 0x0, 0x0, 0x4}, 0xc, &(0x7f0000000780)={&(0x7f0000000740)={0x1c, 0x0, 0x200, 0x70bd2d, 0x25dfdbfb, {}, [@IEEE802154_ATTR_CHANNEL={0x5, 0x7, 0x6}]}, 0x1c}, 0x1, 0x0, 0x0, 0x40100}, 0x801) mlock(&(0x7f0000fef000/0x1000)=nil, 0x1000) syz_io_uring_setup(0x4726, &(0x7f0000000840)={0x0, 0x502f, 0x20, 0x0, 0x12e}, &(0x7f0000ffe000/0x2000)=nil, &(0x7f0000ffb000/0x4000)=nil, &(0x7f00000008c0), &(0x7f0000000900)) 17:46:28 executing program 7: clock_gettime(0x5, &(0x7f0000000000)) clock_settime(0x2, &(0x7f0000000040)) sched_rr_get_interval(0xffffffffffffffff, &(0x7f0000000080)) sched_rr_get_interval(0x0, &(0x7f00000000c0)) sendmsg$NL802154_CMD_GET_SEC_KEY(0xffffffffffffffff, &(0x7f00000001c0)={&(0x7f0000000100)={0x10, 0x0, 0x0, 0x20000000}, 0xc, &(0x7f0000000180)={&(0x7f0000000140)={0x24, 0x0, 0x200, 0x70bd26, 0x25dfdbfe, {}, [@NL802154_ATTR_IFINDEX={0x8}, @NL802154_ATTR_IFINDEX={0x8}]}, 0x24}, 0x1, 0x0, 0x0, 0x4000000}, 0x181) clock_gettime(0x0, &(0x7f0000000200)) pipe2$9p(&(0x7f0000000240)={0xffffffffffffffff, 0xffffffffffffffff}, 0x800) r1 = syz_io_uring_setup(0x776a, &(0x7f0000000280)={0x0, 0x2728, 0x2, 0x1, 0x37c}, &(0x7f0000000000/0x3000)=nil, &(0x7f0000000000/0x400000)=nil, &(0x7f0000000300), &(0x7f0000000340)) ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, &(0x7f0000000540)={0x64, 0x0, &(0x7f0000000440)=[@transaction_sg={0x40486311, {0x1, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x50, 0x18, &(0x7f0000000380)={@fd={0x66642a85, 0x0, r0}, @fd={0x66642a85, 0x0, r1}, @fda={0x66646185, 0x0, 0x2, 0x36}}, &(0x7f0000000400)={0x0, 0x18, 0x30}}}, @request_death, @release={0x40046306, 0x1}], 0x7e, 0x0, &(0x7f00000004c0)="7685c519d1cbea63a1a8f022f8c0085baf770aa5d1fa9bfb1a5399fdb134953d619e962218bba650b68d6206fde39ff17760aa4bbcb62f6802c48e17294a17a3b768ab60bbae37aa37e33e24b09f6bdea37853f7ab2622451803788c9d172b7d71d6d87911129b8ef5cc9e0169404b09abfa991f3a7a3640686df445d387"}) pipe2$9p(&(0x7f0000000580), 0x800) ioctl$EVIOCGVERSION(0xffffffffffffffff, 0x80044501, &(0x7f00000005c0)=""/174) r2 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r3 = syz_genetlink_get_family_id$ieee802154(&(0x7f0000000740), 0xffffffffffffffff) sendmsg$IEEE802154_LLSEC_DEL_KEY(r2, &(0x7f0000000840)={&(0x7f0000000700)={0x10, 0x0, 0x0, 0x800000}, 0xc, &(0x7f0000000800)={&(0x7f0000000780)={0x54, r3, 0x800, 0x70bd27, 0x25dfdbfc, {}, [@IEEE802154_ATTR_LLSEC_KEY_SOURCE_SHORT={0x8, 0x2c, 0x5}, @IEEE802154_ATTR_LLSEC_KEY_SOURCE_EXTENDED={0xc, 0x2d, {0xaaaaaaaaaaaa0002}}, @IEEE802154_ATTR_PAN_ID={0x6, 0x6, 0x2}, @IEEE802154_ATTR_DEV_INDEX={0x8}, @IEEE802154_ATTR_LLSEC_KEY_MODE={0x5, 0x2b, 0x1}, @IEEE802154_ATTR_HW_ADDR={0xc, 0x5, {0xaaaaaaaaaaaa0002}}, @IEEE802154_ATTR_LLSEC_KEY_MODE={0x5, 0x2b, 0x3}]}, 0x54}, 0x1, 0x0, 0x0, 0x40}, 0x2000c814) clock_getres(0x3, &(0x7f0000000880)) syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) 17:46:36 executing program 5: clock_gettime(0x5, &(0x7f0000000000)) clock_settime(0x2, &(0x7f0000000040)) sched_rr_get_interval(0xffffffffffffffff, &(0x7f0000000080)) sched_rr_get_interval(0x0, &(0x7f00000000c0)) sendmsg$NL802154_CMD_GET_SEC_KEY(0xffffffffffffffff, &(0x7f00000001c0)={&(0x7f0000000100)={0x10, 0x0, 0x0, 0x20000000}, 0xc, &(0x7f0000000180)={&(0x7f0000000140)={0x24, 0x0, 0x200, 0x70bd26, 0x25dfdbfe, {}, [@NL802154_ATTR_IFINDEX={0x8}, @NL802154_ATTR_IFINDEX={0x8}]}, 0x24}, 0x1, 0x0, 0x0, 0x4000000}, 0x181) clock_gettime(0x0, &(0x7f0000000200)) syz_io_uring_setup(0x776a, &(0x7f0000000280)={0x0, 0x2728, 0x2, 0x1, 0x37c}, &(0x7f0000000000/0x3000)=nil, &(0x7f0000000000/0x400000)=nil, &(0x7f0000000300), &(0x7f0000000340)) openat$nvram(0xffffffffffffff9c, &(0x7f0000000680), 0x400, 0x0) r0 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$ieee802154(&(0x7f0000000740), 0xffffffffffffffff) sendmsg$IEEE802154_LLSEC_DEL_KEY(r0, &(0x7f0000000840)={&(0x7f0000000700)={0x10, 0x0, 0x0, 0x800000}, 0xc, &(0x7f0000000800)={&(0x7f0000000780)={0x54, r1, 0x800, 0x70bd27, 0x25dfdbfc, {}, [@IEEE802154_ATTR_LLSEC_KEY_SOURCE_SHORT={0x8, 0x2c, 0x5}, @IEEE802154_ATTR_LLSEC_KEY_SOURCE_EXTENDED={0xc, 0x2d, {0xaaaaaaaaaaaa0002}}, @IEEE802154_ATTR_PAN_ID={0x6, 0x6, 0x2}, @IEEE802154_ATTR_DEV_INDEX={0x8}, @IEEE802154_ATTR_LLSEC_KEY_MODE={0x5, 0x2b, 0x1}, @IEEE802154_ATTR_HW_ADDR={0xc, 0x5, {0xaaaaaaaaaaaa0002}}, @IEEE802154_ATTR_LLSEC_KEY_MODE={0x5, 0x2b, 0x3}]}, 0x54}, 0x1, 0x0, 0x0, 0x40}, 0x2000c814) clock_getres(0x3, &(0x7f0000000880)) r2 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) sendmsg$IEEE802154_ADD_IFACE(r2, &(0x7f0000000a00)={&(0x7f0000000900)={0x10, 0x0, 0x0, 0x40c}, 0xc, &(0x7f00000009c0)={&(0x7f0000000940)={0x44, r1, 0x200, 0x70bd29, 0x25dfdbfe, {}, [@IEEE802154_ATTR_PHY_NAME={0x9, 0x1f, 'phy1\x00'}, @IEEE802154_ATTR_DEV_NAME={0xa, 0x1, 'wpan4\x00'}, @IEEE802154_ATTR_DEV_NAME={0xa, 0x1, 'wpan1\x00'}, @IEEE802154_ATTR_DEV_NAME={0xa, 0x1, 'wpan0\x00'}]}, 0x44}, 0x1, 0x0, 0x0, 0x20000084}, 0x44000) 17:46:36 executing program 0: get_thread_area(&(0x7f0000000000)={0x7, 0x20000800, 0x4000, 0x0, 0x1, 0x0, 0x0, 0x1, 0x1, 0x1}) r0 = openat$vcsu(0xffffffffffffff9c, &(0x7f0000000040), 0x200000, 0x0) getsockopt$inet_tcp_TCP_REPAIR_WINDOW(r0, 0x6, 0x1d, &(0x7f0000000080), &(0x7f00000000c0)=0x14) r1 = openat$nvram(0xffffffffffffff9c, &(0x7f0000000100), 0x2000, 0x0) setsockopt$inet_tcp_TCP_FASTOPEN_KEY(r1, 0x6, 0x21, &(0x7f0000000140)="1bb9d563048b6ec78effc0f14d974b17", 0x10) setsockopt$inet_tcp_int(r1, 0x6, 0x1b, &(0x7f0000000180)=0x5, 0x4) ioctl$SNDRV_TIMER_IOCTL_STATUS32(r1, 0x80585414, &(0x7f00000001c0)) setsockopt$inet_tcp_TCP_QUEUE_SEQ(r0, 0x6, 0x15, &(0x7f0000000240)=0x1, 0x4) getsockopt$inet_tcp_TCP_ZEROCOPY_RECEIVE(r1, 0x6, 0x23, &(0x7f0000000340)={&(0x7f0000ffc000/0x2000)=nil, 0x2000, 0x0, 0x0, 0x0, &(0x7f0000000280)=""/37, 0x25, 0x1, &(0x7f00000002c0)=""/109, 0x6d}, &(0x7f0000000380)=0x40) ioctl$sock_inet_tcp_SIOCINQ(0xffffffffffffffff, 0x541b, &(0x7f00000003c0)) move_pages(0x0, 0x8, &(0x7f0000000400)=[&(0x7f0000ffd000/0x1000)=nil, &(0x7f0000ffd000/0x3000)=nil, &(0x7f0000ffd000/0x3000)=nil, &(0x7f0000ffb000/0x2000)=nil, &(0x7f0000ffc000/0x1000)=nil, &(0x7f0000ffe000/0x2000)=nil, &(0x7f0000ffb000/0x4000)=nil, &(0x7f0000ffd000/0x3000)=nil], &(0x7f0000000440)=[0xfff], &(0x7f0000000480)=[0x0, 0x0, 0x0], 0x4) r2 = syz_genetlink_get_family_id$SEG6(&(0x7f0000000500), r1) sendmsg$SEG6_CMD_GET_TUNSRC(r0, &(0x7f00000005c0)={&(0x7f00000004c0)={0x10, 0x0, 0x0, 0x4000000}, 0xc, &(0x7f0000000580)={&(0x7f0000000540)={0x38, r2, 0x300, 0x70bd2a, 0x25dfdbfc, {}, [@SEG6_ATTR_HMACKEYID={0x8, 0x3, 0x24}, @SEG6_ATTR_DST={0x14, 0x1, @mcast1}, @SEG6_ATTR_DSTLEN={0x8, 0x2, 0x2}]}, 0x38}, 0x1, 0x0, 0x0, 0x20008810}, 0x4040010) sendmsg$SEG6_CMD_DUMPHMAC(0xffffffffffffffff, &(0x7f0000000740)={&(0x7f0000000680)={0x10, 0x0, 0x0, 0x240000}, 0xc, &(0x7f0000000700)={&(0x7f00000006c0)={0x2c, r2, 0x1, 0x70bd2c, 0x25dfdbfe, {}, [@SEG6_ATTR_SECRET={0x8, 0x4, [0x1]}, @SEG6_ATTR_DSTLEN={0x8, 0x2, 0x5}, @SEG6_ATTR_DSTLEN={0x8}]}, 0x2c}, 0x1, 0x0, 0x0, 0x4000000}, 0x4000000) pidfd_getfd(r1, 0xffffffffffffffff, 0x0) syz_genetlink_get_family_id$ieee802154(&(0x7f0000000800), 0xffffffffffffffff) 17:46:36 executing program 4: r0 = perf_event_open(&(0x7f00000000c0)={0x1, 0x80, 0x0, 0xc0, 0xfa, 0x1, 0x0, 0x7fffffff, 0x10811, 0x1, 0x1, 0x1, 0x1, 0x1, 0x1, 0x1, 0x1, 0x1, 0x0, 0x1, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x1, 0x0, 0x1, 0x0, 0x0, 0x0, 0x1, 0x1, 0x1, 0x1, 0x1, 0x1, 0x1, 0x0, 0x1, 0x1, 0x1, 0x1, 0x0, 0x0, 0xfff, 0x7, @perf_config_ext={0x7, 0x7fffffff}, 0x41000, 0x80000000, 0x5, 0x3, 0x9, 0x2, 0x9, 0x0, 0x5, 0x0, 0x4}, 0x0, 0xb, 0xffffffffffffffff, 0x1) perf_event_open(&(0x7f0000000040)={0x0, 0x80, 0x0, 0x40, 0x80, 0x9, 0x0, 0x3, 0x10040, 0x1, 0x0, 0x0, 0x1, 0x1, 0x1, 0x1, 0x1, 0x1, 0x1, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x3, 0x1, 0x0, 0x1, 0x0, 0x1, 0x1, 0x0, 0x0, 0x1, 0x1, 0x1, 0x0, 0x1, 0x0, 0x0, 0x0, 0x1, 0x0, 0x1, 0x0, 0x1, 0x0, 0x0, 0x1, @perf_bp={&(0x7f0000000000), 0x10}, 0x8080, 0x800, 0x2, 0x3, 0x36dc, 0x31df3b33, 0xff, 0x0, 0x9, 0x0, 0x5}, 0xffffffffffffffff, 0x9, r0, 0x9) ioctl$PERF_EVENT_IOC_PAUSE_OUTPUT(r0, 0x40042409, 0x0) ioctl$PERF_EVENT_IOC_PERIOD(0xffffffffffffffff, 0x40082404, &(0x7f0000000140)=0x8) r1 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl$sock_ipv4_tunnel_SIOCADDTUNNEL(r1, 0x89f1, &(0x7f00000001c0)={'syztnl1\x00', &(0x7f0000000180)={'syztnl0\x00', 0x0, 0x1, 0x40, 0x0, 0x5, {{0x5, 0x4, 0x2, 0x19, 0x14, 0x65, 0x0, 0x1f, 0x4, 0x0, @multicast2, @remote}}}}) ioctl$PERF_EVENT_IOC_PERIOD(r0, 0x40082404, &(0x7f0000000200)=0x9) ioctl$SNDRV_SEQ_IOCTL_GET_PORT_INFO(0xffffffffffffffff, 0xc0a85322, &(0x7f0000000240)) ioctl$SNDRV_SEQ_IOCTL_SYSTEM_INFO(0xffffffffffffffff, 0xc0305302, &(0x7f0000000300)={0x9, 0x101, 0x1, 0x6, 0x3, 0x5}) syz_open_procfs(0x0, &(0x7f0000000340)='children\x00') 17:46:36 executing program 7: clock_gettime(0x5, &(0x7f0000000000)) clock_settime(0x2, &(0x7f0000000040)) sched_rr_get_interval(0xffffffffffffffff, &(0x7f0000000080)) sched_rr_get_interval(0x0, &(0x7f00000000c0)) sendmsg$NL802154_CMD_GET_SEC_KEY(0xffffffffffffffff, &(0x7f00000001c0)={&(0x7f0000000100)={0x10, 0x0, 0x0, 0x20000000}, 0xc, &(0x7f0000000180)={&(0x7f0000000140)={0x24, 0x0, 0x200, 0x70bd26, 0x25dfdbfe, {}, [@NL802154_ATTR_IFINDEX={0x8}, @NL802154_ATTR_IFINDEX={0x8}]}, 0x24}, 0x1, 0x0, 0x0, 0x4000000}, 0x181) clock_gettime(0x0, &(0x7f0000000200)) pipe2$9p(&(0x7f0000000240)={0xffffffffffffffff, 0xffffffffffffffff}, 0x800) r1 = syz_io_uring_setup(0x776a, &(0x7f0000000280)={0x0, 0x2728, 0x2, 0x1, 0x37c}, &(0x7f0000000000/0x3000)=nil, &(0x7f0000000000/0x400000)=nil, &(0x7f0000000300), &(0x7f0000000340)) ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, &(0x7f0000000540)={0x64, 0x0, &(0x7f0000000440)=[@transaction_sg={0x40486311, {0x1, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x50, 0x18, &(0x7f0000000380)={@fd={0x66642a85, 0x0, r0}, @fd={0x66642a85, 0x0, r1}, @fda={0x66646185, 0x0, 0x2, 0x36}}, &(0x7f0000000400)={0x0, 0x18, 0x30}}}, @request_death, @release={0x40046306, 0x1}], 0x7e, 0x0, &(0x7f00000004c0)="7685c519d1cbea63a1a8f022f8c0085baf770aa5d1fa9bfb1a5399fdb134953d619e962218bba650b68d6206fde39ff17760aa4bbcb62f6802c48e17294a17a3b768ab60bbae37aa37e33e24b09f6bdea37853f7ab2622451803788c9d172b7d71d6d87911129b8ef5cc9e0169404b09abfa991f3a7a3640686df445d387"}) pipe2$9p(&(0x7f0000000580), 0x800) ioctl$EVIOCGVERSION(0xffffffffffffffff, 0x80044501, &(0x7f00000005c0)=""/174) r2 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r3 = syz_genetlink_get_family_id$ieee802154(&(0x7f0000000740), 0xffffffffffffffff) sendmsg$IEEE802154_LLSEC_DEL_KEY(r2, &(0x7f0000000840)={&(0x7f0000000700)={0x10, 0x0, 0x0, 0x800000}, 0xc, &(0x7f0000000800)={&(0x7f0000000780)={0x54, r3, 0x800, 0x70bd27, 0x25dfdbfc, {}, [@IEEE802154_ATTR_LLSEC_KEY_SOURCE_SHORT={0x8, 0x2c, 0x5}, @IEEE802154_ATTR_LLSEC_KEY_SOURCE_EXTENDED={0xc, 0x2d, {0xaaaaaaaaaaaa0002}}, @IEEE802154_ATTR_PAN_ID={0x6, 0x6, 0x2}, @IEEE802154_ATTR_DEV_INDEX={0x8}, @IEEE802154_ATTR_LLSEC_KEY_MODE={0x5, 0x2b, 0x1}, @IEEE802154_ATTR_HW_ADDR={0xc, 0x5, {0xaaaaaaaaaaaa0002}}, @IEEE802154_ATTR_LLSEC_KEY_MODE={0x5, 0x2b, 0x3}]}, 0x54}, 0x1, 0x0, 0x0, 0x40}, 0x2000c814) clock_getres(0x3, &(0x7f0000000880)) 17:46:36 executing program 1: shmget$private(0x0, 0x4000, 0x80, &(0x7f0000ffb000/0x4000)=nil) shmget(0x3, 0x2000, 0x4, &(0x7f0000ffc000/0x2000)=nil) mlock(&(0x7f0000ff0000/0x10000)=nil, 0x10000) shmget(0x1, 0x1000, 0x10, &(0x7f0000ff5000/0x1000)=nil) ioctl$sock_ipv4_tunnel_SIOCGETTUNNEL(0xffffffffffffffff, 0x89f0, &(0x7f0000000140)={'syztnl1\x00', &(0x7f00000000c0)={'syztnl2\x00', 0x0, 0x20, 0x1, 0x6, 0x9, {{0xd, 0x4, 0x1, 0x19, 0x34, 0x68, 0x0, 0x9, 0x29, 0x0, @empty, @dev={0xac, 0x14, 0x14, 0x29}, {[@timestamp_addr={0x44, 0x14, 0xc2, 0x1, 0x4, [{@multicast1}, {@private=0xa010101}]}, @rr={0x7, 0xb, 0xc8, [@initdev={0xac, 0x1e, 0x1, 0x0}, @private=0xa010102]}]}}}}}) ioctl$sock_ipv4_tunnel_SIOCADDTUNNEL(0xffffffffffffffff, 0x89f1, &(0x7f0000000280)={'tunl0\x00', &(0x7f0000000180)={'tunl0\x00', r0, 0x7, 0x8000, 0xfffffffc, 0x8, {{0x2f, 0x4, 0x0, 0x2, 0xbc, 0x65, 0x0, 0x0, 0x4, 0x0, @empty, @broadcast, {[@generic={0x89, 0x9, "8db1d464c6af68"}, @noop, @ra={0x94, 0x4, 0x1}, @timestamp={0x44, 0x1c, 0x53, 0x0, 0x7, [0x40, 0x7fffffff, 0xfffffffd, 0x5, 0x5c, 0x77]}, @cipso={0x86, 0x2f, 0x3, [{0x1, 0x4, "1eba"}, {0x1, 0x7, "e3ccb5ddcf"}, {0x6, 0xa, "5db18b961780af33"}, {0x2, 0xe, "7353a9824b57fd7d39232ac5"}, {0x1, 0x6, "2e1ccd27"}]}, @noop, @cipso={0x86, 0x37, 0xffffffffffffffff, [{0x2, 0xf, "227467028cabd4e137b820c5c9"}, {0x7, 0x6, "90569992"}, {0x2, 0xc, "2071b0a8c9ce92782e72"}, {0x6, 0xa, "14f2b9bca55ce3dd"}, {0x6, 0x6, "2cd22a8f"}]}, @timestamp={0x44, 0x14, 0xd4, 0x0, 0x5, [0x81, 0x5d23, 0x63ab, 0x1]}]}}}}}) ioctl$sock_ipv4_tunnel_SIOCDELTUNNEL(0xffffffffffffffff, 0x89f2, &(0x7f0000000380)={'gretap0\x00', &(0x7f00000002c0)={'syztnl2\x00', 0x0, 0x7800, 0x7, 0x40, 0xe180, {{0x22, 0x4, 0x0, 0x1, 0x88, 0x64, 0x0, 0x1, 0x29, 0x0, @multicast2, @multicast1, {[@end, @lsrr={0x83, 0x1f, 0x2f, [@multicast2, @local, @local, @multicast1, @rand_addr=0x64010102, @loopback, @private=0xa010100]}, @rr={0x7, 0x27, 0x6c, [@multicast1, @rand_addr=0x64010102, @remote, @multicast1, @loopback, @initdev={0xac, 0x1e, 0x0, 0x0}, @initdev={0xac, 0x1e, 0x1, 0x0}, @broadcast, @empty]}, @ra={0x94, 0x4, 0x1}, @timestamp={0x44, 0x10, 0x2d, 0x0, 0x8, [0x1, 0x100, 0x401]}, @ssrr={0x89, 0x13, 0x56, [@dev={0xac, 0x14, 0x14, 0x28}, @multicast2, @initdev={0xac, 0x1e, 0x0, 0x0}, @remote]}, @ra={0x94, 0x4, 0x1}]}}}}}) shmget(0x3, 0x4000, 0x4, &(0x7f0000ff9000/0x4000)=nil) mmap$IORING_OFF_CQ_RING(&(0x7f0000ffd000/0x3000)=nil, 0x3000, 0x2000008, 0x30, 0xffffffffffffffff, 0x8000000) sendmsg$NL802154_CMD_NEW_INTERFACE(0xffffffffffffffff, &(0x7f0000000540)={&(0x7f00000003c0)={0x10, 0x0, 0x0, 0x2}, 0xc, &(0x7f0000000500)={&(0x7f0000000480)={0x48, 0x0, 0x200, 0x70bd2a, 0x25dfdbfd, {}, [@NL802154_ATTR_IFNAME={0xa, 0x4, 'wpan0\x00'}, @NL802154_ATTR_IFINDEX={0x8}, @NL802154_ATTR_IFNAME={0xa, 0x4, 'wpan1\x00'}, @NL802154_ATTR_EXTENDED_ADDR={0xc, 0x17, {0xaaaaaaaaaaaa0002}}, @NL802154_ATTR_IFINDEX={0x8}]}, 0x48}}, 0x4001) mmap$binder(&(0x7f0000fef000/0x11000)=nil, 0x11000, 0x1, 0x11, 0xffffffffffffffff, 0x6) r1 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) sendmsg$IEEE802154_LLSEC_ADD_SECLEVEL(r1, &(0x7f00000006c0)={&(0x7f0000000580)={0x10, 0x0, 0x0, 0x4000000}, 0xc, &(0x7f0000000680)={&(0x7f0000000600)={0x44, 0x0, 0x200, 0x70bd2a, 0x25dfdbff, {}, [@IEEE802154_ATTR_LLSEC_FRAME_TYPE={0x5, 0x33, 0x34}, @IEEE802154_ATTR_DEV_INDEX={0x8}, @IEEE802154_ATTR_LLSEC_CMD_FRAME_ID={0x5, 0x34, 0x1}, @IEEE802154_ATTR_DEV_NAME={0xa, 0x1, 'wpan0\x00'}, @IEEE802154_ATTR_DEV_NAME={0xa, 0x1, 'wpan4\x00'}]}, 0x44}, 0x1, 0x0, 0x0, 0x8800}, 0x0) sendmsg$IEEE802154_START_REQ(r1, &(0x7f00000007c0)={&(0x7f0000000700)={0x10, 0x0, 0x0, 0x4}, 0xc, &(0x7f0000000780)={&(0x7f0000000740)={0x1c, 0x0, 0x200, 0x70bd2d, 0x25dfdbfb, {}, [@IEEE802154_ATTR_CHANNEL={0x5, 0x7, 0x6}]}, 0x1c}, 0x1, 0x0, 0x0, 0x40100}, 0x801) mlock(&(0x7f0000fef000/0x1000)=nil, 0x1000) syz_io_uring_setup(0x4726, &(0x7f0000000840)={0x0, 0x502f, 0x20, 0x0, 0x12e}, &(0x7f0000ffe000/0x2000)=nil, &(0x7f0000ffb000/0x4000)=nil, &(0x7f00000008c0), &(0x7f0000000900)) 17:46:36 executing program 3: clock_gettime(0x5, &(0x7f0000000000)) clock_settime(0x2, &(0x7f0000000040)) sched_rr_get_interval(0xffffffffffffffff, &(0x7f0000000080)) sched_rr_get_interval(0x0, &(0x7f00000000c0)) sendmsg$NL802154_CMD_GET_SEC_KEY(0xffffffffffffffff, &(0x7f00000001c0)={&(0x7f0000000100)={0x10, 0x0, 0x0, 0x20000000}, 0xc, &(0x7f0000000180)={&(0x7f0000000140)={0x24, 0x0, 0x200, 0x70bd26, 0x25dfdbfe, {}, [@NL802154_ATTR_IFINDEX={0x8}, @NL802154_ATTR_IFINDEX={0x8}]}, 0x24}, 0x1, 0x0, 0x0, 0x4000000}, 0x181) clock_gettime(0x0, &(0x7f0000000200)) pipe2$9p(&(0x7f0000000240)={0xffffffffffffffff, 0xffffffffffffffff}, 0x800) r1 = syz_io_uring_setup(0x776a, &(0x7f0000000280)={0x0, 0x2728, 0x2, 0x1, 0x37c}, &(0x7f0000000000/0x3000)=nil, &(0x7f0000000000/0x400000)=nil, &(0x7f0000000300), &(0x7f0000000340)) ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, &(0x7f0000000540)={0x64, 0x0, &(0x7f0000000440)=[@transaction_sg={0x40486311, {0x1, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x50, 0x18, &(0x7f0000000380)={@fd={0x66642a85, 0x0, r0}, @fd={0x66642a85, 0x0, r1}, @fda={0x66646185, 0x0, 0x2, 0x36}}, &(0x7f0000000400)={0x0, 0x18, 0x30}}}, @request_death, @release={0x40046306, 0x1}], 0x7e, 0x0, &(0x7f00000004c0)="7685c519d1cbea63a1a8f022f8c0085baf770aa5d1fa9bfb1a5399fdb134953d619e962218bba650b68d6206fde39ff17760aa4bbcb62f6802c48e17294a17a3b768ab60bbae37aa37e33e24b09f6bdea37853f7ab2622451803788c9d172b7d71d6d87911129b8ef5cc9e0169404b09abfa991f3a7a3640686df445d387"}) pipe2$9p(&(0x7f0000000580), 0x800) ioctl$EVIOCGVERSION(0xffffffffffffffff, 0x80044501, &(0x7f00000005c0)=""/174) r2 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r3 = syz_genetlink_get_family_id$ieee802154(&(0x7f0000000740), 0xffffffffffffffff) sendmsg$IEEE802154_LLSEC_DEL_KEY(r2, &(0x7f0000000840)={&(0x7f0000000700)={0x10, 0x0, 0x0, 0x800000}, 0xc, &(0x7f0000000800)={&(0x7f0000000780)={0x54, r3, 0x800, 0x70bd27, 0x25dfdbfc, {}, [@IEEE802154_ATTR_LLSEC_KEY_SOURCE_SHORT={0x8, 0x2c, 0x5}, @IEEE802154_ATTR_LLSEC_KEY_SOURCE_EXTENDED={0xc, 0x2d, {0xaaaaaaaaaaaa0002}}, @IEEE802154_ATTR_PAN_ID={0x6, 0x6, 0x2}, @IEEE802154_ATTR_DEV_INDEX={0x8}, @IEEE802154_ATTR_LLSEC_KEY_MODE={0x5, 0x2b, 0x1}, @IEEE802154_ATTR_HW_ADDR={0xc, 0x5, {0xaaaaaaaaaaaa0002}}, @IEEE802154_ATTR_LLSEC_KEY_MODE={0x5, 0x2b, 0x3}]}, 0x54}, 0x1, 0x0, 0x0, 0x40}, 0x2000c814) clock_getres(0x3, &(0x7f0000000880)) syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) 17:46:36 executing program 2: prctl$PR_MPX_ENABLE_MANAGEMENT(0x2b) socket$inet(0x2, 0x5, 0x4) r0 = openat$vcsu(0xffffffffffffff9c, &(0x7f0000000000), 0x3c1480, 0x0) ioctl$sock_ipv4_tunnel_SIOCGETTUNNEL(r0, 0x89f0, &(0x7f00000000c0)={'syztnl2\x00', &(0x7f0000000040)={'erspan0\x00', 0x0, 0x700, 0x40, 0x3, 0x22, {{0x15, 0x4, 0x3, 0x17, 0x54, 0x64, 0x0, 0x1, 0x2f, 0x0, @broadcast, @dev={0xac, 0x14, 0x14, 0x36}, {[@cipso={0x86, 0x3d, 0x1, [{0x5, 0x9, "c8a7bec58c2c80"}, {0x0, 0x9, "fabb6c2e64ba82"}, {0x7, 0xf, "6b1b69e07efcb7230cc07a2cf7"}, {0x1, 0x6, "a2118bdb"}, {0x5, 0x10, "67115d3e7766231c7b08cf3c48e4"}]}]}}}}}) syz_open_procfs(0x0, &(0x7f0000000500)='schedstat\x00') 17:46:36 executing program 6: perf_event_open(&(0x7f00000000c0)={0x1, 0x80, 0x0, 0xc0, 0xfa, 0x1, 0x0, 0x7fffffff, 0x10811, 0x1, 0x1, 0x1, 0x1, 0x1, 0x1, 0x1, 0x1, 0x1, 0x0, 0x1, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x1, 0x0, 0x1, 0x0, 0x0, 0x0, 0x1, 0x1, 0x1, 0x1, 0x1, 0x1, 0x1, 0x0, 0x1, 0x1, 0x1, 0x1, 0x0, 0x0, 0xfff, 0x7, @perf_config_ext={0x7, 0x7fffffff}, 0x41000, 0x80000000, 0x5, 0x3, 0x9, 0x2, 0x9, 0x0, 0x5, 0x0, 0x4}, 0x0, 0xb, 0xffffffffffffffff, 0x1) write$cgroup_type(0xffffffffffffffff, &(0x7f0000001500), 0x9) 17:46:36 executing program 1: shmget$private(0x0, 0x4000, 0x80, &(0x7f0000ffb000/0x4000)=nil) shmget(0x3, 0x2000, 0x4, &(0x7f0000ffc000/0x2000)=nil) mlock(&(0x7f0000ff0000/0x10000)=nil, 0x10000) shmget(0x1, 0x1000, 0x10, &(0x7f0000ff5000/0x1000)=nil) ioctl$sock_ipv4_tunnel_SIOCGETTUNNEL(0xffffffffffffffff, 0x89f0, &(0x7f0000000140)={'syztnl1\x00', &(0x7f00000000c0)={'syztnl2\x00', 0x0, 0x20, 0x1, 0x6, 0x9, {{0xd, 0x4, 0x1, 0x19, 0x34, 0x68, 0x0, 0x9, 0x29, 0x0, @empty, @dev={0xac, 0x14, 0x14, 0x29}, {[@timestamp_addr={0x44, 0x14, 0xc2, 0x1, 0x4, [{@multicast1}, {@private=0xa010101}]}, @rr={0x7, 0xb, 0xc8, [@initdev={0xac, 0x1e, 0x1, 0x0}, @private=0xa010102]}]}}}}}) ioctl$sock_ipv4_tunnel_SIOCADDTUNNEL(0xffffffffffffffff, 0x89f1, &(0x7f0000000280)={'tunl0\x00', &(0x7f0000000180)={'tunl0\x00', r0, 0x7, 0x8000, 0xfffffffc, 0x8, {{0x2f, 0x4, 0x0, 0x2, 0xbc, 0x65, 0x0, 0x0, 0x4, 0x0, @empty, @broadcast, {[@generic={0x89, 0x9, "8db1d464c6af68"}, @noop, @ra={0x94, 0x4, 0x1}, @timestamp={0x44, 0x1c, 0x53, 0x0, 0x7, [0x40, 0x7fffffff, 0xfffffffd, 0x5, 0x5c, 0x77]}, @cipso={0x86, 0x2f, 0x3, [{0x1, 0x4, "1eba"}, {0x1, 0x7, "e3ccb5ddcf"}, {0x6, 0xa, "5db18b961780af33"}, {0x2, 0xe, "7353a9824b57fd7d39232ac5"}, {0x1, 0x6, "2e1ccd27"}]}, @noop, @cipso={0x86, 0x37, 0xffffffffffffffff, [{0x2, 0xf, "227467028cabd4e137b820c5c9"}, {0x7, 0x6, "90569992"}, {0x2, 0xc, "2071b0a8c9ce92782e72"}, {0x6, 0xa, "14f2b9bca55ce3dd"}, {0x6, 0x6, "2cd22a8f"}]}, @timestamp={0x44, 0x14, 0xd4, 0x0, 0x5, [0x81, 0x5d23, 0x63ab, 0x1]}]}}}}}) ioctl$sock_ipv4_tunnel_SIOCDELTUNNEL(0xffffffffffffffff, 0x89f2, &(0x7f0000000380)={'gretap0\x00', &(0x7f00000002c0)={'syztnl2\x00', 0x0, 0x7800, 0x7, 0x40, 0xe180, {{0x22, 0x4, 0x0, 0x1, 0x88, 0x64, 0x0, 0x1, 0x29, 0x0, @multicast2, @multicast1, {[@end, @lsrr={0x83, 0x1f, 0x2f, [@multicast2, @local, @local, @multicast1, @rand_addr=0x64010102, @loopback, @private=0xa010100]}, @rr={0x7, 0x27, 0x6c, [@multicast1, @rand_addr=0x64010102, @remote, @multicast1, @loopback, @initdev={0xac, 0x1e, 0x0, 0x0}, @initdev={0xac, 0x1e, 0x1, 0x0}, @broadcast, @empty]}, @ra={0x94, 0x4, 0x1}, @timestamp={0x44, 0x10, 0x2d, 0x0, 0x8, [0x1, 0x100, 0x401]}, @ssrr={0x89, 0x13, 0x56, [@dev={0xac, 0x14, 0x14, 0x28}, @multicast2, @initdev={0xac, 0x1e, 0x0, 0x0}, @remote]}, @ra={0x94, 0x4, 0x1}]}}}}}) shmget(0x3, 0x4000, 0x4, &(0x7f0000ff9000/0x4000)=nil) mmap$IORING_OFF_CQ_RING(&(0x7f0000ffd000/0x3000)=nil, 0x3000, 0x2000008, 0x30, 0xffffffffffffffff, 0x8000000) sendmsg$NL802154_CMD_NEW_INTERFACE(0xffffffffffffffff, &(0x7f0000000540)={&(0x7f00000003c0)={0x10, 0x0, 0x0, 0x2}, 0xc, &(0x7f0000000500)={&(0x7f0000000480)={0x48, 0x0, 0x200, 0x70bd2a, 0x25dfdbfd, {}, [@NL802154_ATTR_IFNAME={0xa, 0x4, 'wpan0\x00'}, @NL802154_ATTR_IFINDEX={0x8}, @NL802154_ATTR_IFNAME={0xa, 0x4, 'wpan1\x00'}, @NL802154_ATTR_EXTENDED_ADDR={0xc, 0x17, {0xaaaaaaaaaaaa0002}}, @NL802154_ATTR_IFINDEX={0x8}]}, 0x48}}, 0x4001) mmap$binder(&(0x7f0000fef000/0x11000)=nil, 0x11000, 0x1, 0x11, 0xffffffffffffffff, 0x6) r1 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) sendmsg$IEEE802154_LLSEC_ADD_SECLEVEL(r1, &(0x7f00000006c0)={&(0x7f0000000580)={0x10, 0x0, 0x0, 0x4000000}, 0xc, &(0x7f0000000680)={&(0x7f0000000600)={0x44, 0x0, 0x200, 0x70bd2a, 0x25dfdbff, {}, [@IEEE802154_ATTR_LLSEC_FRAME_TYPE={0x5, 0x33, 0x34}, @IEEE802154_ATTR_DEV_INDEX={0x8}, @IEEE802154_ATTR_LLSEC_CMD_FRAME_ID={0x5, 0x34, 0x1}, @IEEE802154_ATTR_DEV_NAME={0xa, 0x1, 'wpan0\x00'}, @IEEE802154_ATTR_DEV_NAME={0xa, 0x1, 'wpan4\x00'}]}, 0x44}, 0x1, 0x0, 0x0, 0x8800}, 0x0) sendmsg$IEEE802154_START_REQ(r1, &(0x7f00000007c0)={&(0x7f0000000700)={0x10, 0x0, 0x0, 0x4}, 0xc, &(0x7f0000000780)={&(0x7f0000000740)={0x1c, 0x0, 0x200, 0x70bd2d, 0x25dfdbfb, {}, [@IEEE802154_ATTR_CHANNEL={0x5, 0x7, 0x6}]}, 0x1c}, 0x1, 0x0, 0x0, 0x40100}, 0x801) mlock(&(0x7f0000fef000/0x1000)=nil, 0x1000) syz_io_uring_setup(0x4726, &(0x7f0000000840)={0x0, 0x502f, 0x20, 0x0, 0x12e}, &(0x7f0000ffe000/0x2000)=nil, &(0x7f0000ffb000/0x4000)=nil, &(0x7f00000008c0), &(0x7f0000000900)) 17:46:36 executing program 6: write$cgroup_type(0xffffffffffffffff, &(0x7f0000001500), 0x9) 17:46:36 executing program 3: clock_gettime(0x5, &(0x7f0000000000)) clock_settime(0x2, &(0x7f0000000040)) sched_rr_get_interval(0xffffffffffffffff, &(0x7f0000000080)) sched_rr_get_interval(0x0, &(0x7f00000000c0)) sendmsg$NL802154_CMD_GET_SEC_KEY(0xffffffffffffffff, &(0x7f00000001c0)={&(0x7f0000000100)={0x10, 0x0, 0x0, 0x20000000}, 0xc, &(0x7f0000000180)={&(0x7f0000000140)={0x24, 0x0, 0x200, 0x70bd26, 0x25dfdbfe, {}, [@NL802154_ATTR_IFINDEX={0x8}, @NL802154_ATTR_IFINDEX={0x8}]}, 0x24}, 0x1, 0x0, 0x0, 0x4000000}, 0x181) clock_gettime(0x0, &(0x7f0000000200)) pipe2$9p(&(0x7f0000000240)={0xffffffffffffffff, 0xffffffffffffffff}, 0x800) r1 = syz_io_uring_setup(0x776a, &(0x7f0000000280)={0x0, 0x2728, 0x2, 0x1, 0x37c}, &(0x7f0000000000/0x3000)=nil, &(0x7f0000000000/0x400000)=nil, &(0x7f0000000300), &(0x7f0000000340)) ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, &(0x7f0000000540)={0x64, 0x0, &(0x7f0000000440)=[@transaction_sg={0x40486311, {0x1, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x50, 0x18, &(0x7f0000000380)={@fd={0x66642a85, 0x0, r0}, @fd={0x66642a85, 0x0, r1}, @fda={0x66646185, 0x0, 0x2, 0x36}}, &(0x7f0000000400)={0x0, 0x18, 0x30}}}, @request_death, @release={0x40046306, 0x1}], 0x7e, 0x0, &(0x7f00000004c0)="7685c519d1cbea63a1a8f022f8c0085baf770aa5d1fa9bfb1a5399fdb134953d619e962218bba650b68d6206fde39ff17760aa4bbcb62f6802c48e17294a17a3b768ab60bbae37aa37e33e24b09f6bdea37853f7ab2622451803788c9d172b7d71d6d87911129b8ef5cc9e0169404b09abfa991f3a7a3640686df445d387"}) pipe2$9p(&(0x7f0000000580), 0x800) ioctl$EVIOCGVERSION(0xffffffffffffffff, 0x80044501, &(0x7f00000005c0)=""/174) r2 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r3 = syz_genetlink_get_family_id$ieee802154(&(0x7f0000000740), 0xffffffffffffffff) sendmsg$IEEE802154_LLSEC_DEL_KEY(r2, &(0x7f0000000840)={&(0x7f0000000700)={0x10, 0x0, 0x0, 0x800000}, 0xc, &(0x7f0000000800)={&(0x7f0000000780)={0x54, r3, 0x800, 0x70bd27, 0x25dfdbfc, {}, [@IEEE802154_ATTR_LLSEC_KEY_SOURCE_SHORT={0x8, 0x2c, 0x5}, @IEEE802154_ATTR_LLSEC_KEY_SOURCE_EXTENDED={0xc, 0x2d, {0xaaaaaaaaaaaa0002}}, @IEEE802154_ATTR_PAN_ID={0x6, 0x6, 0x2}, @IEEE802154_ATTR_DEV_INDEX={0x8}, @IEEE802154_ATTR_LLSEC_KEY_MODE={0x5, 0x2b, 0x1}, @IEEE802154_ATTR_HW_ADDR={0xc, 0x5, {0xaaaaaaaaaaaa0002}}, @IEEE802154_ATTR_LLSEC_KEY_MODE={0x5, 0x2b, 0x3}]}, 0x54}, 0x1, 0x0, 0x0, 0x40}, 0x2000c814) clock_getres(0x3, &(0x7f0000000880)) syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) 17:46:36 executing program 0: get_thread_area(&(0x7f0000000000)={0x7, 0x20000800, 0x4000, 0x0, 0x1, 0x0, 0x0, 0x1, 0x1, 0x1}) r0 = openat$vcsu(0xffffffffffffff9c, &(0x7f0000000040), 0x200000, 0x0) getsockopt$inet_tcp_TCP_REPAIR_WINDOW(r0, 0x6, 0x1d, &(0x7f0000000080), &(0x7f00000000c0)=0x14) r1 = openat$nvram(0xffffffffffffff9c, &(0x7f0000000100), 0x2000, 0x0) setsockopt$inet_tcp_TCP_FASTOPEN_KEY(r1, 0x6, 0x21, &(0x7f0000000140)="1bb9d563048b6ec78effc0f14d974b17", 0x10) setsockopt$inet_tcp_int(r1, 0x6, 0x1b, &(0x7f0000000180)=0x5, 0x4) ioctl$SNDRV_TIMER_IOCTL_STATUS32(r1, 0x80585414, &(0x7f00000001c0)) setsockopt$inet_tcp_TCP_QUEUE_SEQ(r0, 0x6, 0x15, &(0x7f0000000240)=0x1, 0x4) r2 = socket$inet_tcp(0x2, 0x1, 0x0) ioctl$sock_inet_tcp_SIOCINQ(r2, 0x541b, &(0x7f00000003c0)) move_pages(0x0, 0x8, &(0x7f0000000400)=[&(0x7f0000ffd000/0x1000)=nil, &(0x7f0000ffd000/0x3000)=nil, &(0x7f0000ffd000/0x3000)=nil, &(0x7f0000ffb000/0x2000)=nil, &(0x7f0000ffc000/0x1000)=nil, &(0x7f0000ffe000/0x2000)=nil, &(0x7f0000ffb000/0x4000)=nil, &(0x7f0000ffd000/0x3000)=nil], &(0x7f0000000440)=[0xfff], &(0x7f0000000480)=[0x0, 0x0, 0x0], 0x4) r3 = syz_genetlink_get_family_id$SEG6(&(0x7f0000000500), r1) sendmsg$SEG6_CMD_GET_TUNSRC(r0, &(0x7f00000005c0)={&(0x7f00000004c0)={0x10, 0x0, 0x0, 0x4000000}, 0xc, &(0x7f0000000580)={&(0x7f0000000540)={0x38, r3, 0x300, 0x70bd2a, 0x25dfdbfc, {}, [@SEG6_ATTR_HMACKEYID={0x8, 0x3, 0x24}, @SEG6_ATTR_DST={0x14, 0x1, @mcast1}, @SEG6_ATTR_DSTLEN={0x8, 0x2, 0x2}]}, 0x38}, 0x1, 0x0, 0x0, 0x20008810}, 0x4040010) sendmsg$SEG6_CMD_DUMPHMAC(0xffffffffffffffff, &(0x7f0000000740)={&(0x7f0000000680)={0x10, 0x0, 0x0, 0x240000}, 0xc, &(0x7f0000000700)={&(0x7f00000006c0)={0x2c, r3, 0x1, 0x70bd2c, 0x25dfdbfe, {}, [@SEG6_ATTR_SECRET={0x8, 0x4, [0x1]}, @SEG6_ATTR_DSTLEN={0x8, 0x2, 0x5}, @SEG6_ATTR_DSTLEN={0x8}]}, 0x2c}, 0x1, 0x0, 0x0, 0x4000000}, 0x4000000) pidfd_getfd(r1, r2, 0x0) syz_genetlink_get_family_id$ieee802154(&(0x7f0000000800), 0xffffffffffffffff) 17:46:36 executing program 5: clock_gettime(0x5, &(0x7f0000000000)) clock_settime(0x2, &(0x7f0000000040)) sched_rr_get_interval(0xffffffffffffffff, &(0x7f0000000080)) sched_rr_get_interval(0x0, &(0x7f00000000c0)) sendmsg$NL802154_CMD_GET_SEC_KEY(0xffffffffffffffff, &(0x7f00000001c0)={&(0x7f0000000100)={0x10, 0x0, 0x0, 0x20000000}, 0xc, &(0x7f0000000180)={&(0x7f0000000140)={0x24, 0x0, 0x200, 0x70bd26, 0x25dfdbfe, {}, [@NL802154_ATTR_IFINDEX={0x8}, @NL802154_ATTR_IFINDEX={0x8}]}, 0x24}, 0x1, 0x0, 0x0, 0x4000000}, 0x181) pipe2$9p(&(0x7f0000000240), 0x800) syz_io_uring_setup(0x776a, &(0x7f0000000280)={0x0, 0x2728, 0x2, 0x1, 0x37c}, &(0x7f0000000000/0x3000)=nil, &(0x7f0000000000/0x400000)=nil, &(0x7f0000000300), &(0x7f0000000340)) openat$nvram(0xffffffffffffff9c, &(0x7f0000000680), 0x400, 0x0) r0 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$ieee802154(&(0x7f0000000740), 0xffffffffffffffff) sendmsg$IEEE802154_LLSEC_DEL_KEY(r0, &(0x7f0000000840)={&(0x7f0000000700)={0x10, 0x0, 0x0, 0x800000}, 0xc, &(0x7f0000000800)={&(0x7f0000000780)={0x54, r1, 0x800, 0x70bd27, 0x25dfdbfc, {}, [@IEEE802154_ATTR_LLSEC_KEY_SOURCE_SHORT={0x8, 0x2c, 0x5}, @IEEE802154_ATTR_LLSEC_KEY_SOURCE_EXTENDED={0xc, 0x2d, {0xaaaaaaaaaaaa0002}}, @IEEE802154_ATTR_PAN_ID={0x6, 0x6, 0x2}, @IEEE802154_ATTR_DEV_INDEX={0x8}, @IEEE802154_ATTR_LLSEC_KEY_MODE={0x5, 0x2b, 0x1}, @IEEE802154_ATTR_HW_ADDR={0xc, 0x5, {0xaaaaaaaaaaaa0002}}, @IEEE802154_ATTR_LLSEC_KEY_MODE={0x5, 0x2b, 0x3}]}, 0x54}, 0x1, 0x0, 0x0, 0x40}, 0x2000c814) clock_getres(0x3, &(0x7f0000000880)) r2 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) sendmsg$IEEE802154_ADD_IFACE(r2, &(0x7f0000000a00)={&(0x7f0000000900)={0x10, 0x0, 0x0, 0x40c}, 0xc, &(0x7f00000009c0)={&(0x7f0000000940)={0x44, r1, 0x200, 0x70bd29, 0x25dfdbfe, {}, [@IEEE802154_ATTR_PHY_NAME={0x9, 0x1f, 'phy1\x00'}, @IEEE802154_ATTR_DEV_NAME={0xa, 0x1, 'wpan4\x00'}, @IEEE802154_ATTR_DEV_NAME={0xa, 0x1, 'wpan1\x00'}, @IEEE802154_ATTR_DEV_NAME={0xa, 0x1, 'wpan0\x00'}]}, 0x44}, 0x1, 0x0, 0x0, 0x20000084}, 0x44000) 17:46:36 executing program 7: clock_gettime(0x5, &(0x7f0000000000)) clock_settime(0x2, &(0x7f0000000040)) sched_rr_get_interval(0xffffffffffffffff, &(0x7f0000000080)) sched_rr_get_interval(0x0, &(0x7f00000000c0)) sendmsg$NL802154_CMD_GET_SEC_KEY(0xffffffffffffffff, &(0x7f00000001c0)={&(0x7f0000000100)={0x10, 0x0, 0x0, 0x20000000}, 0xc, &(0x7f0000000180)={&(0x7f0000000140)={0x24, 0x0, 0x200, 0x70bd26, 0x25dfdbfe, {}, [@NL802154_ATTR_IFINDEX={0x8}, @NL802154_ATTR_IFINDEX={0x8}]}, 0x24}, 0x1, 0x0, 0x0, 0x4000000}, 0x181) clock_gettime(0x0, &(0x7f0000000200)) pipe2$9p(&(0x7f0000000240)={0xffffffffffffffff, 0xffffffffffffffff}, 0x800) r1 = syz_io_uring_setup(0x776a, &(0x7f0000000280)={0x0, 0x2728, 0x2, 0x1, 0x37c}, &(0x7f0000000000/0x3000)=nil, &(0x7f0000000000/0x400000)=nil, &(0x7f0000000300), &(0x7f0000000340)) ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, &(0x7f0000000540)={0x64, 0x0, &(0x7f0000000440)=[@transaction_sg={0x40486311, {0x1, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x50, 0x18, &(0x7f0000000380)={@fd={0x66642a85, 0x0, r0}, @fd={0x66642a85, 0x0, r1}, @fda={0x66646185, 0x0, 0x2, 0x36}}, &(0x7f0000000400)={0x0, 0x18, 0x30}}}, @request_death, @release={0x40046306, 0x1}], 0x7e, 0x0, &(0x7f00000004c0)="7685c519d1cbea63a1a8f022f8c0085baf770aa5d1fa9bfb1a5399fdb134953d619e962218bba650b68d6206fde39ff17760aa4bbcb62f6802c48e17294a17a3b768ab60bbae37aa37e33e24b09f6bdea37853f7ab2622451803788c9d172b7d71d6d87911129b8ef5cc9e0169404b09abfa991f3a7a3640686df445d387"}) pipe2$9p(&(0x7f0000000580), 0x800) ioctl$EVIOCGVERSION(0xffffffffffffffff, 0x80044501, &(0x7f00000005c0)=""/174) r2 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r3 = syz_genetlink_get_family_id$ieee802154(&(0x7f0000000740), 0xffffffffffffffff) sendmsg$IEEE802154_LLSEC_DEL_KEY(r2, &(0x7f0000000840)={&(0x7f0000000700)={0x10, 0x0, 0x0, 0x800000}, 0xc, &(0x7f0000000800)={&(0x7f0000000780)={0x54, r3, 0x800, 0x70bd27, 0x25dfdbfc, {}, [@IEEE802154_ATTR_LLSEC_KEY_SOURCE_SHORT={0x8, 0x2c, 0x5}, @IEEE802154_ATTR_LLSEC_KEY_SOURCE_EXTENDED={0xc, 0x2d, {0xaaaaaaaaaaaa0002}}, @IEEE802154_ATTR_PAN_ID={0x6, 0x6, 0x2}, @IEEE802154_ATTR_DEV_INDEX={0x8}, @IEEE802154_ATTR_LLSEC_KEY_MODE={0x5, 0x2b, 0x1}, @IEEE802154_ATTR_HW_ADDR={0xc, 0x5, {0xaaaaaaaaaaaa0002}}, @IEEE802154_ATTR_LLSEC_KEY_MODE={0x5, 0x2b, 0x3}]}, 0x54}, 0x1, 0x0, 0x0, 0x40}, 0x2000c814) clock_getres(0x3, &(0x7f0000000880)) 17:46:36 executing program 1: shmget$private(0x0, 0x4000, 0x80, &(0x7f0000ffb000/0x4000)=nil) shmget(0x3, 0x2000, 0x4, &(0x7f0000ffc000/0x2000)=nil) mlock(&(0x7f0000ff0000/0x10000)=nil, 0x10000) shmget(0x1, 0x1000, 0x10, &(0x7f0000ff5000/0x1000)=nil) ioctl$sock_ipv4_tunnel_SIOCGETTUNNEL(0xffffffffffffffff, 0x89f0, &(0x7f0000000140)={'syztnl1\x00', &(0x7f00000000c0)={'syztnl2\x00', 0x0, 0x20, 0x1, 0x6, 0x9, {{0xd, 0x4, 0x1, 0x19, 0x34, 0x68, 0x0, 0x9, 0x29, 0x0, @empty, @dev={0xac, 0x14, 0x14, 0x29}, {[@timestamp_addr={0x44, 0x14, 0xc2, 0x1, 0x4, [{@multicast1}, {@private=0xa010101}]}, @rr={0x7, 0xb, 0xc8, [@initdev={0xac, 0x1e, 0x1, 0x0}, @private=0xa010102]}]}}}}}) ioctl$sock_ipv4_tunnel_SIOCADDTUNNEL(0xffffffffffffffff, 0x89f1, &(0x7f0000000280)={'tunl0\x00', &(0x7f0000000180)={'tunl0\x00', r0, 0x7, 0x8000, 0xfffffffc, 0x8, {{0x2f, 0x4, 0x0, 0x2, 0xbc, 0x65, 0x0, 0x0, 0x4, 0x0, @empty, @broadcast, {[@generic={0x89, 0x9, "8db1d464c6af68"}, @noop, @ra={0x94, 0x4, 0x1}, @timestamp={0x44, 0x1c, 0x53, 0x0, 0x7, [0x40, 0x7fffffff, 0xfffffffd, 0x5, 0x5c, 0x77]}, @cipso={0x86, 0x2f, 0x3, [{0x1, 0x4, "1eba"}, {0x1, 0x7, "e3ccb5ddcf"}, {0x6, 0xa, "5db18b961780af33"}, {0x2, 0xe, "7353a9824b57fd7d39232ac5"}, {0x1, 0x6, "2e1ccd27"}]}, @noop, @cipso={0x86, 0x37, 0xffffffffffffffff, [{0x2, 0xf, "227467028cabd4e137b820c5c9"}, {0x7, 0x6, "90569992"}, {0x2, 0xc, "2071b0a8c9ce92782e72"}, {0x6, 0xa, "14f2b9bca55ce3dd"}, {0x6, 0x6, "2cd22a8f"}]}, @timestamp={0x44, 0x14, 0xd4, 0x0, 0x5, [0x81, 0x5d23, 0x63ab, 0x1]}]}}}}}) ioctl$sock_ipv4_tunnel_SIOCDELTUNNEL(0xffffffffffffffff, 0x89f2, &(0x7f0000000380)={'gretap0\x00', &(0x7f00000002c0)={'syztnl2\x00', 0x0, 0x7800, 0x7, 0x40, 0xe180, {{0x22, 0x4, 0x0, 0x1, 0x88, 0x64, 0x0, 0x1, 0x29, 0x0, @multicast2, @multicast1, {[@end, @lsrr={0x83, 0x1f, 0x2f, [@multicast2, @local, @local, @multicast1, @rand_addr=0x64010102, @loopback, @private=0xa010100]}, @rr={0x7, 0x27, 0x6c, [@multicast1, @rand_addr=0x64010102, @remote, @multicast1, @loopback, @initdev={0xac, 0x1e, 0x0, 0x0}, @initdev={0xac, 0x1e, 0x1, 0x0}, @broadcast, @empty]}, @ra={0x94, 0x4, 0x1}, @timestamp={0x44, 0x10, 0x2d, 0x0, 0x8, [0x1, 0x100, 0x401]}, @ssrr={0x89, 0x13, 0x56, [@dev={0xac, 0x14, 0x14, 0x28}, @multicast2, @initdev={0xac, 0x1e, 0x0, 0x0}, @remote]}, @ra={0x94, 0x4, 0x1}]}}}}}) shmget(0x3, 0x4000, 0x4, &(0x7f0000ff9000/0x4000)=nil) r1 = syz_genetlink_get_family_id$nl802154(&(0x7f0000000400), 0xffffffffffffffff) sendmsg$NL802154_CMD_NEW_INTERFACE(0xffffffffffffffff, &(0x7f0000000540)={&(0x7f00000003c0)={0x10, 0x0, 0x0, 0x2}, 0xc, &(0x7f0000000500)={&(0x7f0000000480)={0x48, r1, 0x200, 0x70bd2a, 0x25dfdbfd, {}, [@NL802154_ATTR_IFNAME={0xa, 0x4, 'wpan0\x00'}, @NL802154_ATTR_IFINDEX={0x8}, @NL802154_ATTR_IFNAME={0xa, 0x4, 'wpan1\x00'}, @NL802154_ATTR_EXTENDED_ADDR={0xc, 0x17, {0xaaaaaaaaaaaa0002}}, @NL802154_ATTR_IFINDEX={0x8}]}, 0x48}}, 0x4001) mmap$binder(&(0x7f0000fef000/0x11000)=nil, 0x11000, 0x1, 0x11, 0xffffffffffffffff, 0x6) r2 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) sendmsg$IEEE802154_LLSEC_ADD_SECLEVEL(r2, &(0x7f00000006c0)={&(0x7f0000000580)={0x10, 0x0, 0x0, 0x4000000}, 0xc, &(0x7f0000000680)={&(0x7f0000000600)={0x44, 0x0, 0x200, 0x70bd2a, 0x25dfdbff, {}, [@IEEE802154_ATTR_LLSEC_FRAME_TYPE={0x5, 0x33, 0x34}, @IEEE802154_ATTR_DEV_INDEX={0x8}, @IEEE802154_ATTR_LLSEC_CMD_FRAME_ID={0x5, 0x34, 0x1}, @IEEE802154_ATTR_DEV_NAME={0xa, 0x1, 'wpan0\x00'}, @IEEE802154_ATTR_DEV_NAME={0xa, 0x1, 'wpan4\x00'}]}, 0x44}, 0x1, 0x0, 0x0, 0x8800}, 0x0) sendmsg$IEEE802154_START_REQ(r2, &(0x7f00000007c0)={&(0x7f0000000700)={0x10, 0x0, 0x0, 0x4}, 0xc, &(0x7f0000000780)={&(0x7f0000000740)={0x1c, 0x0, 0x200, 0x70bd2d, 0x25dfdbfb, {}, [@IEEE802154_ATTR_CHANNEL={0x5, 0x7, 0x6}]}, 0x1c}, 0x1, 0x0, 0x0, 0x40100}, 0x801) mlock(&(0x7f0000fef000/0x1000)=nil, 0x1000) syz_io_uring_setup(0x4726, &(0x7f0000000840)={0x0, 0x502f, 0x20, 0x0, 0x12e}, &(0x7f0000ffe000/0x2000)=nil, &(0x7f0000ffb000/0x4000)=nil, &(0x7f00000008c0), &(0x7f0000000900)) 17:46:36 executing program 5: clock_gettime(0x5, &(0x7f0000000000)) clock_settime(0x2, &(0x7f0000000040)) sched_rr_get_interval(0xffffffffffffffff, &(0x7f0000000080)) sched_rr_get_interval(0x0, &(0x7f00000000c0)) pipe2$9p(&(0x7f0000000240), 0x800) syz_io_uring_setup(0x776a, &(0x7f0000000280)={0x0, 0x2728, 0x2, 0x1, 0x37c}, &(0x7f0000000000/0x3000)=nil, &(0x7f0000000000/0x400000)=nil, &(0x7f0000000300), &(0x7f0000000340)) openat$nvram(0xffffffffffffff9c, &(0x7f0000000680), 0x400, 0x0) r0 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$ieee802154(&(0x7f0000000740), 0xffffffffffffffff) sendmsg$IEEE802154_LLSEC_DEL_KEY(r0, &(0x7f0000000840)={&(0x7f0000000700)={0x10, 0x0, 0x0, 0x800000}, 0xc, &(0x7f0000000800)={&(0x7f0000000780)={0x54, r1, 0x800, 0x70bd27, 0x25dfdbfc, {}, [@IEEE802154_ATTR_LLSEC_KEY_SOURCE_SHORT={0x8, 0x2c, 0x5}, @IEEE802154_ATTR_LLSEC_KEY_SOURCE_EXTENDED={0xc, 0x2d, {0xaaaaaaaaaaaa0002}}, @IEEE802154_ATTR_PAN_ID={0x6, 0x6, 0x2}, @IEEE802154_ATTR_DEV_INDEX={0x8}, @IEEE802154_ATTR_LLSEC_KEY_MODE={0x5, 0x2b, 0x1}, @IEEE802154_ATTR_HW_ADDR={0xc, 0x5, {0xaaaaaaaaaaaa0002}}, @IEEE802154_ATTR_LLSEC_KEY_MODE={0x5, 0x2b, 0x3}]}, 0x54}, 0x1, 0x0, 0x0, 0x40}, 0x2000c814) clock_getres(0x3, &(0x7f0000000880)) r2 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) sendmsg$IEEE802154_ADD_IFACE(r2, &(0x7f0000000a00)={&(0x7f0000000900)={0x10, 0x0, 0x0, 0x40c}, 0xc, &(0x7f00000009c0)={&(0x7f0000000940)={0x44, r1, 0x200, 0x70bd29, 0x25dfdbfe, {}, [@IEEE802154_ATTR_PHY_NAME={0x9, 0x1f, 'phy1\x00'}, @IEEE802154_ATTR_DEV_NAME={0xa, 0x1, 'wpan4\x00'}, @IEEE802154_ATTR_DEV_NAME={0xa, 0x1, 'wpan1\x00'}, @IEEE802154_ATTR_DEV_NAME={0xa, 0x1, 'wpan0\x00'}]}, 0x44}, 0x1, 0x0, 0x0, 0x20000084}, 0x44000) 17:46:36 executing program 0: get_thread_area(&(0x7f0000000000)={0x7, 0x20000800, 0x4000, 0x0, 0x1, 0x0, 0x0, 0x1, 0x1, 0x1}) r0 = openat$vcsu(0xffffffffffffff9c, &(0x7f0000000040), 0x200000, 0x0) getsockopt$inet_tcp_TCP_REPAIR_WINDOW(r0, 0x6, 0x1d, &(0x7f0000000080), &(0x7f00000000c0)=0x14) r1 = openat$nvram(0xffffffffffffff9c, &(0x7f0000000100), 0x2000, 0x0) setsockopt$inet_tcp_TCP_FASTOPEN_KEY(r1, 0x6, 0x21, &(0x7f0000000140)="1bb9d563048b6ec78effc0f14d974b17", 0x10) setsockopt$inet_tcp_int(r1, 0x6, 0x1b, &(0x7f0000000180)=0x5, 0x4) ioctl$SNDRV_TIMER_IOCTL_STATUS32(r1, 0x80585414, &(0x7f00000001c0)) r2 = socket$inet_tcp(0x2, 0x1, 0x0) ioctl$sock_inet_tcp_SIOCINQ(r2, 0x541b, &(0x7f00000003c0)) move_pages(0x0, 0x8, &(0x7f0000000400)=[&(0x7f0000ffd000/0x1000)=nil, &(0x7f0000ffd000/0x3000)=nil, &(0x7f0000ffd000/0x3000)=nil, &(0x7f0000ffb000/0x2000)=nil, &(0x7f0000ffc000/0x1000)=nil, &(0x7f0000ffe000/0x2000)=nil, &(0x7f0000ffb000/0x4000)=nil, &(0x7f0000ffd000/0x3000)=nil], &(0x7f0000000440)=[0xfff], &(0x7f0000000480)=[0x0, 0x0, 0x0], 0x4) r3 = syz_genetlink_get_family_id$SEG6(&(0x7f0000000500), r1) sendmsg$SEG6_CMD_GET_TUNSRC(r0, &(0x7f00000005c0)={&(0x7f00000004c0)={0x10, 0x0, 0x0, 0x4000000}, 0xc, &(0x7f0000000580)={&(0x7f0000000540)={0x38, r3, 0x300, 0x70bd2a, 0x25dfdbfc, {}, [@SEG6_ATTR_HMACKEYID={0x8, 0x3, 0x24}, @SEG6_ATTR_DST={0x14, 0x1, @mcast1}, @SEG6_ATTR_DSTLEN={0x8, 0x2, 0x2}]}, 0x38}, 0x1, 0x0, 0x0, 0x20008810}, 0x4040010) sendmsg$SEG6_CMD_DUMPHMAC(0xffffffffffffffff, &(0x7f0000000740)={&(0x7f0000000680)={0x10, 0x0, 0x0, 0x240000}, 0xc, &(0x7f0000000700)={&(0x7f00000006c0)={0x2c, r3, 0x1, 0x70bd2c, 0x25dfdbfe, {}, [@SEG6_ATTR_SECRET={0x8, 0x4, [0x1]}, @SEG6_ATTR_DSTLEN={0x8, 0x2, 0x5}, @SEG6_ATTR_DSTLEN={0x8}]}, 0x2c}, 0x1, 0x0, 0x0, 0x4000000}, 0x4000000) pidfd_getfd(r1, r2, 0x0) syz_genetlink_get_family_id$ieee802154(&(0x7f0000000800), 0xffffffffffffffff) 17:46:45 executing program 6: write$cgroup_type(0xffffffffffffffff, 0x0, 0x0) 17:46:45 executing program 5: clock_gettime(0x5, &(0x7f0000000000)) clock_settime(0x2, &(0x7f0000000040)) sched_rr_get_interval(0xffffffffffffffff, &(0x7f0000000080)) sched_rr_get_interval(0x0, &(0x7f00000000c0)) pipe2$9p(&(0x7f0000000240), 0x800) syz_io_uring_setup(0x776a, &(0x7f0000000280)={0x0, 0x2728, 0x2, 0x1, 0x37c}, &(0x7f0000000000/0x3000)=nil, &(0x7f0000000000/0x400000)=nil, &(0x7f0000000300), &(0x7f0000000340)) openat$nvram(0xffffffffffffff9c, &(0x7f0000000680), 0x400, 0x0) r0 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$ieee802154(&(0x7f0000000740), 0xffffffffffffffff) sendmsg$IEEE802154_LLSEC_DEL_KEY(r0, &(0x7f0000000840)={&(0x7f0000000700)={0x10, 0x0, 0x0, 0x800000}, 0xc, &(0x7f0000000800)={&(0x7f0000000780)={0x54, r1, 0x800, 0x70bd27, 0x25dfdbfc, {}, [@IEEE802154_ATTR_LLSEC_KEY_SOURCE_SHORT={0x8, 0x2c, 0x5}, @IEEE802154_ATTR_LLSEC_KEY_SOURCE_EXTENDED={0xc, 0x2d, {0xaaaaaaaaaaaa0002}}, @IEEE802154_ATTR_PAN_ID={0x6, 0x6, 0x2}, @IEEE802154_ATTR_DEV_INDEX={0x8}, @IEEE802154_ATTR_LLSEC_KEY_MODE={0x5, 0x2b, 0x1}, @IEEE802154_ATTR_HW_ADDR={0xc, 0x5, {0xaaaaaaaaaaaa0002}}, @IEEE802154_ATTR_LLSEC_KEY_MODE={0x5, 0x2b, 0x3}]}, 0x54}, 0x1, 0x0, 0x0, 0x40}, 0x2000c814) clock_getres(0x3, &(0x7f0000000880)) r2 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) sendmsg$IEEE802154_ADD_IFACE(r2, &(0x7f0000000a00)={&(0x7f0000000900)={0x10, 0x0, 0x0, 0x40c}, 0xc, &(0x7f00000009c0)={&(0x7f0000000940)={0x44, r1, 0x200, 0x70bd29, 0x25dfdbfe, {}, [@IEEE802154_ATTR_PHY_NAME={0x9, 0x1f, 'phy1\x00'}, @IEEE802154_ATTR_DEV_NAME={0xa, 0x1, 'wpan4\x00'}, @IEEE802154_ATTR_DEV_NAME={0xa, 0x1, 'wpan1\x00'}, @IEEE802154_ATTR_DEV_NAME={0xa, 0x1, 'wpan0\x00'}]}, 0x44}, 0x1, 0x0, 0x0, 0x20000084}, 0x44000) 17:46:45 executing program 7: clock_gettime(0x5, &(0x7f0000000000)) clock_settime(0x2, &(0x7f0000000040)) sched_rr_get_interval(0xffffffffffffffff, &(0x7f0000000080)) sched_rr_get_interval(0x0, &(0x7f00000000c0)) sendmsg$NL802154_CMD_GET_SEC_KEY(0xffffffffffffffff, &(0x7f00000001c0)={&(0x7f0000000100)={0x10, 0x0, 0x0, 0x20000000}, 0xc, &(0x7f0000000180)={&(0x7f0000000140)={0x24, 0x0, 0x200, 0x70bd26, 0x25dfdbfe, {}, [@NL802154_ATTR_IFINDEX={0x8}, @NL802154_ATTR_IFINDEX={0x8}]}, 0x24}, 0x1, 0x0, 0x0, 0x4000000}, 0x181) clock_gettime(0x0, &(0x7f0000000200)) pipe2$9p(&(0x7f0000000240)={0xffffffffffffffff, 0xffffffffffffffff}, 0x800) r1 = syz_io_uring_setup(0x776a, &(0x7f0000000280)={0x0, 0x2728, 0x2, 0x1, 0x37c}, &(0x7f0000000000/0x3000)=nil, &(0x7f0000000000/0x400000)=nil, &(0x7f0000000300), &(0x7f0000000340)) ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, &(0x7f0000000540)={0x64, 0x0, &(0x7f0000000440)=[@transaction_sg={0x40486311, {0x1, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x50, 0x18, &(0x7f0000000380)={@fd={0x66642a85, 0x0, r0}, @fd={0x66642a85, 0x0, r1}, @fda={0x66646185, 0x0, 0x2, 0x36}}, &(0x7f0000000400)={0x0, 0x18, 0x30}}}, @request_death, @release={0x40046306, 0x1}], 0x7e, 0x0, &(0x7f00000004c0)="7685c519d1cbea63a1a8f022f8c0085baf770aa5d1fa9bfb1a5399fdb134953d619e962218bba650b68d6206fde39ff17760aa4bbcb62f6802c48e17294a17a3b768ab60bbae37aa37e33e24b09f6bdea37853f7ab2622451803788c9d172b7d71d6d87911129b8ef5cc9e0169404b09abfa991f3a7a3640686df445d387"}) pipe2$9p(&(0x7f0000000580), 0x800) ioctl$EVIOCGVERSION(0xffffffffffffffff, 0x80044501, &(0x7f00000005c0)=""/174) r2 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r3 = syz_genetlink_get_family_id$ieee802154(&(0x7f0000000740), 0xffffffffffffffff) sendmsg$IEEE802154_LLSEC_DEL_KEY(r2, &(0x7f0000000840)={&(0x7f0000000700)={0x10, 0x0, 0x0, 0x800000}, 0xc, &(0x7f0000000800)={&(0x7f0000000780)={0x54, r3, 0x800, 0x70bd27, 0x25dfdbfc, {}, [@IEEE802154_ATTR_LLSEC_KEY_SOURCE_SHORT={0x8, 0x2c, 0x5}, @IEEE802154_ATTR_LLSEC_KEY_SOURCE_EXTENDED={0xc, 0x2d, {0xaaaaaaaaaaaa0002}}, @IEEE802154_ATTR_PAN_ID={0x6, 0x6, 0x2}, @IEEE802154_ATTR_DEV_INDEX={0x8}, @IEEE802154_ATTR_LLSEC_KEY_MODE={0x5, 0x2b, 0x1}, @IEEE802154_ATTR_HW_ADDR={0xc, 0x5, {0xaaaaaaaaaaaa0002}}, @IEEE802154_ATTR_LLSEC_KEY_MODE={0x5, 0x2b, 0x3}]}, 0x54}, 0x1, 0x0, 0x0, 0x40}, 0x2000c814) 17:46:45 executing program 2: prctl$PR_MPX_ENABLE_MANAGEMENT(0x2b) socket$inet(0x2, 0x5, 0x4) openat$vcsu(0xffffffffffffff9c, &(0x7f0000000000), 0x3c1480, 0x0) syz_open_procfs(0x0, &(0x7f0000000500)='schedstat\x00') 17:46:45 executing program 3: clock_gettime(0x5, &(0x7f0000000000)) clock_settime(0x2, &(0x7f0000000040)) sched_rr_get_interval(0xffffffffffffffff, &(0x7f0000000080)) sched_rr_get_interval(0x0, &(0x7f00000000c0)) sendmsg$NL802154_CMD_GET_SEC_KEY(0xffffffffffffffff, &(0x7f00000001c0)={&(0x7f0000000100)={0x10, 0x0, 0x0, 0x20000000}, 0xc, &(0x7f0000000180)={&(0x7f0000000140)={0x24, 0x0, 0x200, 0x70bd26, 0x25dfdbfe, {}, [@NL802154_ATTR_IFINDEX={0x8}, @NL802154_ATTR_IFINDEX={0x8}]}, 0x24}, 0x1, 0x0, 0x0, 0x4000000}, 0x181) clock_gettime(0x0, &(0x7f0000000200)) pipe2$9p(&(0x7f0000000240)={0xffffffffffffffff, 0xffffffffffffffff}, 0x800) r1 = syz_io_uring_setup(0x776a, &(0x7f0000000280)={0x0, 0x2728, 0x2, 0x1, 0x37c}, &(0x7f0000000000/0x3000)=nil, &(0x7f0000000000/0x400000)=nil, &(0x7f0000000300), &(0x7f0000000340)) ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, &(0x7f0000000540)={0x64, 0x0, &(0x7f0000000440)=[@transaction_sg={0x40486311, {0x1, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x50, 0x18, &(0x7f0000000380)={@fd={0x66642a85, 0x0, r0}, @fd={0x66642a85, 0x0, r1}, @fda={0x66646185, 0x0, 0x2, 0x36}}, &(0x7f0000000400)={0x0, 0x18, 0x30}}}, @request_death, @release={0x40046306, 0x1}], 0x7e, 0x0, &(0x7f00000004c0)="7685c519d1cbea63a1a8f022f8c0085baf770aa5d1fa9bfb1a5399fdb134953d619e962218bba650b68d6206fde39ff17760aa4bbcb62f6802c48e17294a17a3b768ab60bbae37aa37e33e24b09f6bdea37853f7ab2622451803788c9d172b7d71d6d87911129b8ef5cc9e0169404b09abfa991f3a7a3640686df445d387"}) pipe2$9p(&(0x7f0000000580), 0x800) ioctl$EVIOCGVERSION(0xffffffffffffffff, 0x80044501, &(0x7f00000005c0)=""/174) r2 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r3 = syz_genetlink_get_family_id$ieee802154(&(0x7f0000000740), 0xffffffffffffffff) sendmsg$IEEE802154_LLSEC_DEL_KEY(r2, &(0x7f0000000840)={&(0x7f0000000700)={0x10, 0x0, 0x0, 0x800000}, 0xc, &(0x7f0000000800)={&(0x7f0000000780)={0x54, r3, 0x800, 0x70bd27, 0x25dfdbfc, {}, [@IEEE802154_ATTR_LLSEC_KEY_SOURCE_SHORT={0x8, 0x2c, 0x5}, @IEEE802154_ATTR_LLSEC_KEY_SOURCE_EXTENDED={0xc, 0x2d, {0xaaaaaaaaaaaa0002}}, @IEEE802154_ATTR_PAN_ID={0x6, 0x6, 0x2}, @IEEE802154_ATTR_DEV_INDEX={0x8}, @IEEE802154_ATTR_LLSEC_KEY_MODE={0x5, 0x2b, 0x1}, @IEEE802154_ATTR_HW_ADDR={0xc, 0x5, {0xaaaaaaaaaaaa0002}}, @IEEE802154_ATTR_LLSEC_KEY_MODE={0x5, 0x2b, 0x3}]}, 0x54}, 0x1, 0x0, 0x0, 0x40}, 0x2000c814) clock_getres(0x3, &(0x7f0000000880)) syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) 17:46:45 executing program 1: shmget$private(0x0, 0x4000, 0x80, &(0x7f0000ffb000/0x4000)=nil) shmget(0x3, 0x2000, 0x4, &(0x7f0000ffc000/0x2000)=nil) mlock(&(0x7f0000ff0000/0x10000)=nil, 0x10000) shmget(0x1, 0x1000, 0x10, &(0x7f0000ff5000/0x1000)=nil) ioctl$sock_ipv4_tunnel_SIOCGETTUNNEL(0xffffffffffffffff, 0x89f0, &(0x7f0000000140)={'syztnl1\x00', &(0x7f00000000c0)={'syztnl2\x00', 0x0, 0x20, 0x1, 0x6, 0x9, {{0xd, 0x4, 0x1, 0x19, 0x34, 0x68, 0x0, 0x9, 0x29, 0x0, @empty, @dev={0xac, 0x14, 0x14, 0x29}, {[@timestamp_addr={0x44, 0x14, 0xc2, 0x1, 0x4, [{@multicast1}, {@private=0xa010101}]}, @rr={0x7, 0xb, 0xc8, [@initdev={0xac, 0x1e, 0x1, 0x0}, @private=0xa010102]}]}}}}}) ioctl$sock_ipv4_tunnel_SIOCADDTUNNEL(0xffffffffffffffff, 0x89f1, &(0x7f0000000280)={'tunl0\x00', &(0x7f0000000180)={'tunl0\x00', r0, 0x7, 0x8000, 0xfffffffc, 0x8, {{0x2f, 0x4, 0x0, 0x2, 0xbc, 0x65, 0x0, 0x0, 0x4, 0x0, @empty, @broadcast, {[@generic={0x89, 0x9, "8db1d464c6af68"}, @noop, @ra={0x94, 0x4, 0x1}, @timestamp={0x44, 0x1c, 0x53, 0x0, 0x7, [0x40, 0x7fffffff, 0xfffffffd, 0x5, 0x5c, 0x77]}, @cipso={0x86, 0x2f, 0x3, [{0x1, 0x4, "1eba"}, {0x1, 0x7, "e3ccb5ddcf"}, {0x6, 0xa, "5db18b961780af33"}, {0x2, 0xe, "7353a9824b57fd7d39232ac5"}, {0x1, 0x6, "2e1ccd27"}]}, @noop, @cipso={0x86, 0x37, 0xffffffffffffffff, [{0x2, 0xf, "227467028cabd4e137b820c5c9"}, {0x7, 0x6, "90569992"}, {0x2, 0xc, "2071b0a8c9ce92782e72"}, {0x6, 0xa, "14f2b9bca55ce3dd"}, {0x6, 0x6, "2cd22a8f"}]}, @timestamp={0x44, 0x14, 0xd4, 0x0, 0x5, [0x81, 0x5d23, 0x63ab, 0x1]}]}}}}}) ioctl$sock_ipv4_tunnel_SIOCDELTUNNEL(0xffffffffffffffff, 0x89f2, &(0x7f0000000380)={'gretap0\x00', &(0x7f00000002c0)={'syztnl2\x00', 0x0, 0x7800, 0x7, 0x40, 0xe180, {{0x22, 0x4, 0x0, 0x1, 0x88, 0x64, 0x0, 0x1, 0x29, 0x0, @multicast2, @multicast1, {[@end, @lsrr={0x83, 0x1f, 0x2f, [@multicast2, @local, @local, @multicast1, @rand_addr=0x64010102, @loopback, @private=0xa010100]}, @rr={0x7, 0x27, 0x6c, [@multicast1, @rand_addr=0x64010102, @remote, @multicast1, @loopback, @initdev={0xac, 0x1e, 0x0, 0x0}, @initdev={0xac, 0x1e, 0x1, 0x0}, @broadcast, @empty]}, @ra={0x94, 0x4, 0x1}, @timestamp={0x44, 0x10, 0x2d, 0x0, 0x8, [0x1, 0x100, 0x401]}, @ssrr={0x89, 0x13, 0x56, [@dev={0xac, 0x14, 0x14, 0x28}, @multicast2, @initdev={0xac, 0x1e, 0x0, 0x0}, @remote]}, @ra={0x94, 0x4, 0x1}]}}}}}) shmget(0x3, 0x4000, 0x4, &(0x7f0000ff9000/0x4000)=nil) r1 = syz_genetlink_get_family_id$nl802154(&(0x7f0000000400), 0xffffffffffffffff) sendmsg$NL802154_CMD_NEW_INTERFACE(0xffffffffffffffff, &(0x7f0000000540)={&(0x7f00000003c0)={0x10, 0x0, 0x0, 0x2}, 0xc, &(0x7f0000000500)={&(0x7f0000000480)={0x48, r1, 0x200, 0x70bd2a, 0x25dfdbfd, {}, [@NL802154_ATTR_IFNAME={0xa, 0x4, 'wpan0\x00'}, @NL802154_ATTR_IFINDEX={0x8}, @NL802154_ATTR_IFNAME={0xa, 0x4, 'wpan1\x00'}, @NL802154_ATTR_EXTENDED_ADDR={0xc, 0x17, {0xaaaaaaaaaaaa0002}}, @NL802154_ATTR_IFINDEX={0x8}]}, 0x48}}, 0x4001) mmap$binder(&(0x7f0000fef000/0x11000)=nil, 0x11000, 0x1, 0x11, 0xffffffffffffffff, 0x6) r2 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) sendmsg$IEEE802154_LLSEC_ADD_SECLEVEL(r2, &(0x7f00000006c0)={&(0x7f0000000580)={0x10, 0x0, 0x0, 0x4000000}, 0xc, &(0x7f0000000680)={&(0x7f0000000600)={0x44, 0x0, 0x200, 0x70bd2a, 0x25dfdbff, {}, [@IEEE802154_ATTR_LLSEC_FRAME_TYPE={0x5, 0x33, 0x34}, @IEEE802154_ATTR_DEV_INDEX={0x8}, @IEEE802154_ATTR_LLSEC_CMD_FRAME_ID={0x5, 0x34, 0x1}, @IEEE802154_ATTR_DEV_NAME={0xa, 0x1, 'wpan0\x00'}, @IEEE802154_ATTR_DEV_NAME={0xa, 0x1, 'wpan4\x00'}]}, 0x44}, 0x1, 0x0, 0x0, 0x8800}, 0x0) sendmsg$IEEE802154_START_REQ(r2, &(0x7f00000007c0)={&(0x7f0000000700)={0x10, 0x0, 0x0, 0x4}, 0xc, &(0x7f0000000780)={&(0x7f0000000740)={0x1c, 0x0, 0x200, 0x70bd2d, 0x25dfdbfb, {}, [@IEEE802154_ATTR_CHANNEL={0x5, 0x7, 0x6}]}, 0x1c}, 0x1, 0x0, 0x0, 0x40100}, 0x801) mlock(&(0x7f0000fef000/0x1000)=nil, 0x1000) syz_io_uring_setup(0x4726, &(0x7f0000000840)={0x0, 0x502f, 0x20, 0x0, 0x12e}, &(0x7f0000ffe000/0x2000)=nil, &(0x7f0000ffb000/0x4000)=nil, &(0x7f00000008c0), &(0x7f0000000900)) 17:46:45 executing program 0: get_thread_area(&(0x7f0000000000)={0x7, 0x20000800, 0x4000, 0x0, 0x1, 0x0, 0x0, 0x1, 0x1, 0x1}) r0 = openat$vcsu(0xffffffffffffff9c, &(0x7f0000000040), 0x200000, 0x0) getsockopt$inet_tcp_TCP_REPAIR_WINDOW(r0, 0x6, 0x1d, &(0x7f0000000080), &(0x7f00000000c0)=0x14) r1 = openat$nvram(0xffffffffffffff9c, &(0x7f0000000100), 0x2000, 0x0) setsockopt$inet_tcp_TCP_FASTOPEN_KEY(r1, 0x6, 0x21, &(0x7f0000000140)="1bb9d563048b6ec78effc0f14d974b17", 0x10) setsockopt$inet_tcp_int(r1, 0x6, 0x1b, &(0x7f0000000180)=0x5, 0x4) ioctl$SNDRV_TIMER_IOCTL_STATUS32(r1, 0x80585414, &(0x7f00000001c0)) r2 = socket$inet_tcp(0x2, 0x1, 0x0) ioctl$sock_inet_tcp_SIOCINQ(r2, 0x541b, &(0x7f00000003c0)) move_pages(0x0, 0x8, &(0x7f0000000400)=[&(0x7f0000ffd000/0x1000)=nil, &(0x7f0000ffd000/0x3000)=nil, &(0x7f0000ffd000/0x3000)=nil, &(0x7f0000ffb000/0x2000)=nil, &(0x7f0000ffc000/0x1000)=nil, &(0x7f0000ffe000/0x2000)=nil, &(0x7f0000ffb000/0x4000)=nil, &(0x7f0000ffd000/0x3000)=nil], &(0x7f0000000440)=[0xfff], &(0x7f0000000480)=[0x0, 0x0, 0x0], 0x4) r3 = syz_genetlink_get_family_id$SEG6(&(0x7f0000000500), r1) sendmsg$SEG6_CMD_GET_TUNSRC(r0, &(0x7f00000005c0)={&(0x7f00000004c0)={0x10, 0x0, 0x0, 0x4000000}, 0xc, &(0x7f0000000580)={&(0x7f0000000540)={0x38, r3, 0x300, 0x70bd2a, 0x25dfdbfc, {}, [@SEG6_ATTR_HMACKEYID={0x8, 0x3, 0x24}, @SEG6_ATTR_DST={0x14, 0x1, @mcast1}, @SEG6_ATTR_DSTLEN={0x8, 0x2, 0x2}]}, 0x38}, 0x1, 0x0, 0x0, 0x20008810}, 0x4040010) sendmsg$SEG6_CMD_DUMPHMAC(0xffffffffffffffff, &(0x7f0000000740)={&(0x7f0000000680)={0x10, 0x0, 0x0, 0x240000}, 0xc, &(0x7f0000000700)={&(0x7f00000006c0)={0x2c, r3, 0x1, 0x70bd2c, 0x25dfdbfe, {}, [@SEG6_ATTR_SECRET={0x8, 0x4, [0x1]}, @SEG6_ATTR_DSTLEN={0x8, 0x2, 0x5}, @SEG6_ATTR_DSTLEN={0x8}]}, 0x2c}, 0x1, 0x0, 0x0, 0x4000000}, 0x4000000) pidfd_getfd(r1, r2, 0x0) syz_genetlink_get_family_id$ieee802154(&(0x7f0000000800), 0xffffffffffffffff) 17:46:45 executing program 4: r0 = perf_event_open(&(0x7f00000000c0)={0x1, 0x80, 0x0, 0xc0, 0xfa, 0x1, 0x0, 0x7fffffff, 0x10811, 0x1, 0x1, 0x1, 0x1, 0x1, 0x1, 0x1, 0x1, 0x1, 0x0, 0x1, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x1, 0x0, 0x1, 0x0, 0x0, 0x0, 0x1, 0x1, 0x1, 0x1, 0x1, 0x1, 0x1, 0x0, 0x1, 0x1, 0x1, 0x1, 0x0, 0x0, 0xfff, 0x7, @perf_config_ext={0x7, 0x7fffffff}, 0x41000, 0x80000000, 0x5, 0x3, 0x9, 0x2, 0x9, 0x0, 0x5, 0x0, 0x4}, 0x0, 0xb, 0xffffffffffffffff, 0x1) perf_event_open(&(0x7f0000000040)={0x0, 0x80, 0x0, 0x40, 0x80, 0x9, 0x0, 0x3, 0x10040, 0x1, 0x0, 0x0, 0x1, 0x1, 0x1, 0x1, 0x1, 0x1, 0x1, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x3, 0x1, 0x0, 0x1, 0x0, 0x1, 0x1, 0x0, 0x0, 0x1, 0x1, 0x1, 0x0, 0x1, 0x0, 0x0, 0x0, 0x1, 0x0, 0x1, 0x0, 0x1, 0x0, 0x0, 0x1, @perf_bp={&(0x7f0000000000), 0x10}, 0x8080, 0x800, 0x2, 0x3, 0x36dc, 0x31df3b33, 0xff, 0x0, 0x9, 0x0, 0x5}, 0xffffffffffffffff, 0x9, r0, 0x9) ioctl$PERF_EVENT_IOC_PAUSE_OUTPUT(r0, 0x40042409, 0x0) ioctl$PERF_EVENT_IOC_PERIOD(0xffffffffffffffff, 0x40082404, &(0x7f0000000140)=0x8) r1 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl$sock_ipv4_tunnel_SIOCADDTUNNEL(r1, 0x89f1, &(0x7f00000001c0)={'syztnl1\x00', &(0x7f0000000180)={'syztnl0\x00', 0x0, 0x1, 0x40, 0x0, 0x5, {{0x5, 0x4, 0x2, 0x19, 0x14, 0x65, 0x0, 0x1f, 0x4, 0x0, @multicast2, @remote}}}}) ioctl$PERF_EVENT_IOC_PERIOD(r0, 0x40082404, &(0x7f0000000200)=0x9) ioctl$SNDRV_SEQ_IOCTL_GET_PORT_INFO(0xffffffffffffffff, 0xc0a85322, &(0x7f0000000240)) ioctl$SNDRV_SEQ_IOCTL_SYSTEM_INFO(0xffffffffffffffff, 0xc0305302, &(0x7f0000000300)={0x9, 0x101, 0x1, 0x6, 0x3, 0x5}) syz_open_procfs(0x0, &(0x7f0000000340)='children\x00') 17:46:45 executing program 0: get_thread_area(&(0x7f0000000000)={0x7, 0x20000800, 0x4000, 0x0, 0x1, 0x0, 0x0, 0x1, 0x1, 0x1}) r0 = openat$vcsu(0xffffffffffffff9c, &(0x7f0000000040), 0x200000, 0x0) getsockopt$inet_tcp_TCP_REPAIR_WINDOW(r0, 0x6, 0x1d, &(0x7f0000000080), &(0x7f00000000c0)=0x14) r1 = openat$nvram(0xffffffffffffff9c, &(0x7f0000000100), 0x2000, 0x0) setsockopt$inet_tcp_TCP_FASTOPEN_KEY(r1, 0x6, 0x21, &(0x7f0000000140)="1bb9d563048b6ec78effc0f14d974b17", 0x10) setsockopt$inet_tcp_int(r1, 0x6, 0x1b, &(0x7f0000000180)=0x5, 0x4) ioctl$SNDRV_TIMER_IOCTL_STATUS32(r1, 0x80585414, &(0x7f00000001c0)) r2 = socket$inet_tcp(0x2, 0x1, 0x0) ioctl$sock_inet_tcp_SIOCINQ(r2, 0x541b, &(0x7f00000003c0)) move_pages(0x0, 0x8, &(0x7f0000000400)=[&(0x7f0000ffd000/0x1000)=nil, &(0x7f0000ffd000/0x3000)=nil, &(0x7f0000ffd000/0x3000)=nil, &(0x7f0000ffb000/0x2000)=nil, &(0x7f0000ffc000/0x1000)=nil, &(0x7f0000ffe000/0x2000)=nil, &(0x7f0000ffb000/0x4000)=nil, &(0x7f0000ffd000/0x3000)=nil], &(0x7f0000000440)=[0xfff], &(0x7f0000000480)=[0x0, 0x0, 0x0], 0x4) r3 = syz_genetlink_get_family_id$SEG6(&(0x7f0000000500), r1) sendmsg$SEG6_CMD_GET_TUNSRC(r0, &(0x7f00000005c0)={&(0x7f00000004c0)={0x10, 0x0, 0x0, 0x4000000}, 0xc, &(0x7f0000000580)={&(0x7f0000000540)={0x38, r3, 0x300, 0x70bd2a, 0x25dfdbfc, {}, [@SEG6_ATTR_HMACKEYID={0x8, 0x3, 0x24}, @SEG6_ATTR_DST={0x14, 0x1, @mcast1}, @SEG6_ATTR_DSTLEN={0x8, 0x2, 0x2}]}, 0x38}, 0x1, 0x0, 0x0, 0x20008810}, 0x4040010) sendmsg$SEG6_CMD_DUMPHMAC(0xffffffffffffffff, &(0x7f0000000740)={&(0x7f0000000680)={0x10, 0x0, 0x0, 0x240000}, 0xc, &(0x7f0000000700)={&(0x7f00000006c0)={0x2c, r3, 0x1, 0x70bd2c, 0x25dfdbfe, {}, [@SEG6_ATTR_SECRET={0x8, 0x4, [0x1]}, @SEG6_ATTR_DSTLEN={0x8, 0x2, 0x5}, @SEG6_ATTR_DSTLEN={0x8}]}, 0x2c}, 0x1, 0x0, 0x0, 0x4000000}, 0x4000000) pidfd_getfd(r1, r2, 0x0) syz_genetlink_get_family_id$ieee802154(&(0x7f0000000800), 0xffffffffffffffff) 17:46:45 executing program 3: clock_gettime(0x5, &(0x7f0000000000)) clock_settime(0x2, &(0x7f0000000040)) sched_rr_get_interval(0xffffffffffffffff, &(0x7f0000000080)) sched_rr_get_interval(0x0, &(0x7f00000000c0)) sendmsg$NL802154_CMD_GET_SEC_KEY(0xffffffffffffffff, &(0x7f00000001c0)={&(0x7f0000000100)={0x10, 0x0, 0x0, 0x20000000}, 0xc, &(0x7f0000000180)={&(0x7f0000000140)={0x24, 0x0, 0x200, 0x70bd26, 0x25dfdbfe, {}, [@NL802154_ATTR_IFINDEX={0x8}, @NL802154_ATTR_IFINDEX={0x8}]}, 0x24}, 0x1, 0x0, 0x0, 0x4000000}, 0x181) clock_gettime(0x0, &(0x7f0000000200)) pipe2$9p(&(0x7f0000000240)={0xffffffffffffffff, 0xffffffffffffffff}, 0x800) r1 = syz_io_uring_setup(0x776a, &(0x7f0000000280)={0x0, 0x2728, 0x2, 0x1, 0x37c}, &(0x7f0000000000/0x3000)=nil, &(0x7f0000000000/0x400000)=nil, &(0x7f0000000300), &(0x7f0000000340)) ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, &(0x7f0000000540)={0x64, 0x0, &(0x7f0000000440)=[@transaction_sg={0x40486311, {0x1, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x50, 0x18, &(0x7f0000000380)={@fd={0x66642a85, 0x0, r0}, @fd={0x66642a85, 0x0, r1}, @fda={0x66646185, 0x0, 0x2, 0x36}}, &(0x7f0000000400)={0x0, 0x18, 0x30}}}, @request_death, @release={0x40046306, 0x1}], 0x7e, 0x0, &(0x7f00000004c0)="7685c519d1cbea63a1a8f022f8c0085baf770aa5d1fa9bfb1a5399fdb134953d619e962218bba650b68d6206fde39ff17760aa4bbcb62f6802c48e17294a17a3b768ab60bbae37aa37e33e24b09f6bdea37853f7ab2622451803788c9d172b7d71d6d87911129b8ef5cc9e0169404b09abfa991f3a7a3640686df445d387"}) pipe2$9p(&(0x7f0000000580), 0x800) ioctl$EVIOCGVERSION(0xffffffffffffffff, 0x80044501, &(0x7f00000005c0)=""/174) r2 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r3 = syz_genetlink_get_family_id$ieee802154(&(0x7f0000000740), 0xffffffffffffffff) sendmsg$IEEE802154_LLSEC_DEL_KEY(r2, &(0x7f0000000840)={&(0x7f0000000700)={0x10, 0x0, 0x0, 0x800000}, 0xc, &(0x7f0000000800)={&(0x7f0000000780)={0x54, r3, 0x800, 0x70bd27, 0x25dfdbfc, {}, [@IEEE802154_ATTR_LLSEC_KEY_SOURCE_SHORT={0x8, 0x2c, 0x5}, @IEEE802154_ATTR_LLSEC_KEY_SOURCE_EXTENDED={0xc, 0x2d, {0xaaaaaaaaaaaa0002}}, @IEEE802154_ATTR_PAN_ID={0x6, 0x6, 0x2}, @IEEE802154_ATTR_DEV_INDEX={0x8}, @IEEE802154_ATTR_LLSEC_KEY_MODE={0x5, 0x2b, 0x1}, @IEEE802154_ATTR_HW_ADDR={0xc, 0x5, {0xaaaaaaaaaaaa0002}}, @IEEE802154_ATTR_LLSEC_KEY_MODE={0x5, 0x2b, 0x3}]}, 0x54}, 0x1, 0x0, 0x0, 0x40}, 0x2000c814) clock_getres(0x3, &(0x7f0000000880)) 17:46:45 executing program 6: get_thread_area(&(0x7f0000000000)={0x7, 0x20000800, 0x4000, 0x0, 0x1, 0x0, 0x0, 0x1, 0x1, 0x1}) r0 = openat$vcsu(0xffffffffffffff9c, &(0x7f0000000040), 0x200000, 0x0) getsockopt$inet_tcp_TCP_REPAIR_WINDOW(r0, 0x6, 0x1d, &(0x7f0000000080), &(0x7f00000000c0)=0x14) r1 = openat$nvram(0xffffffffffffff9c, &(0x7f0000000100), 0x2000, 0x0) setsockopt$inet_tcp_TCP_FASTOPEN_KEY(r1, 0x6, 0x21, &(0x7f0000000140)="1bb9d563048b6ec78effc0f14d974b17", 0x10) setsockopt$inet_tcp_int(r1, 0x6, 0x1b, &(0x7f0000000180)=0x5, 0x4) ioctl$SNDRV_TIMER_IOCTL_STATUS32(r1, 0x80585414, &(0x7f00000001c0)) r2 = socket$inet_tcp(0x2, 0x1, 0x0) ioctl$sock_inet_tcp_SIOCINQ(r2, 0x541b, &(0x7f00000003c0)) move_pages(0x0, 0x8, &(0x7f0000000400)=[&(0x7f0000ffd000/0x1000)=nil, &(0x7f0000ffd000/0x3000)=nil, &(0x7f0000ffd000/0x3000)=nil, &(0x7f0000ffb000/0x2000)=nil, &(0x7f0000ffc000/0x1000)=nil, &(0x7f0000ffe000/0x2000)=nil, &(0x7f0000ffb000/0x4000)=nil, &(0x7f0000ffd000/0x3000)=nil], &(0x7f0000000440)=[0xfff], &(0x7f0000000480)=[0x0, 0x0, 0x0], 0x4) r3 = syz_genetlink_get_family_id$SEG6(&(0x7f0000000500), r1) sendmsg$SEG6_CMD_GET_TUNSRC(r0, &(0x7f00000005c0)={&(0x7f00000004c0)={0x10, 0x0, 0x0, 0x4000000}, 0xc, &(0x7f0000000580)={&(0x7f0000000540)={0x38, r3, 0x300, 0x70bd2a, 0x25dfdbfc, {}, [@SEG6_ATTR_HMACKEYID={0x8, 0x3, 0x24}, @SEG6_ATTR_DST={0x14, 0x1, @mcast1}, @SEG6_ATTR_DSTLEN={0x8, 0x2, 0x2}]}, 0x38}, 0x1, 0x0, 0x0, 0x20008810}, 0x4040010) sendmsg$SEG6_CMD_DUMPHMAC(0xffffffffffffffff, &(0x7f0000000740)={&(0x7f0000000680)={0x10, 0x0, 0x0, 0x240000}, 0xc, &(0x7f0000000700)={&(0x7f00000006c0)={0x2c, r3, 0x1, 0x70bd2c, 0x25dfdbfe, {}, [@SEG6_ATTR_SECRET={0x8, 0x4, [0x1]}, @SEG6_ATTR_DSTLEN={0x8, 0x2, 0x5}, @SEG6_ATTR_DSTLEN={0x8}]}, 0x2c}, 0x1, 0x0, 0x0, 0x4000000}, 0x4000000) pidfd_getfd(r1, r2, 0x0) syz_genetlink_get_family_id$ieee802154(&(0x7f0000000800), 0xffffffffffffffff) [ 262.307709] kmemleak: Found object by alias at 0x607f1a62a634 [ 262.307739] CPU: 1 UID: 0 PID: 4709 Comm: iou-sqp-4705 Tainted: G W 6.17.0-rc3-next-20250829 #1 PREEMPT(voluntary) [ 262.307771] Tainted: [W]=WARN [ 262.307778] Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.12.0-1 04/01/2014 [ 262.307790] Call Trace: [ 262.307797] [ 262.307805] dump_stack_lvl+0xca/0x120 [ 262.307856] __lookup_object+0x94/0xb0 [ 262.307885] delete_object_full+0x27/0x70 [ 262.307914] free_percpu+0x30/0x1160 [ 262.307942] ? arch_uprobe_clear_state+0x16/0x140 [ 262.307977] futex_hash_free+0x38/0xc0 [ 262.308002] mmput+0x2d3/0x390 [ 262.308035] do_exit+0x79d/0x2970 [ 262.308062] ? __pfx_try_to_wake_up+0x10/0x10 [ 262.308096] ? __pfx_do_exit+0x10/0x10 [ 262.308118] ? io_sq_thread+0xfbd/0x1b00 [ 262.308147] ? lock_release+0xc8/0x290 [ 262.308177] io_sq_thread+0xfc9/0x1b00 [ 262.308215] ? __pfx_io_sq_thread+0x10/0x10 [ 262.308245] ? __lock_acquire+0xc65/0x1b70 [ 262.308269] ? __pfx_autoremove_wake_function+0x10/0x10 [ 262.308296] ? __lock_acquire+0xc65/0x1b70 [ 262.308333] ? do_raw_spin_lock+0x123/0x260 [ 262.308361] ? find_held_lock+0x2b/0x80 [ 262.308390] ? __pfx_io_sq_thread+0x10/0x10 [ 262.308418] ? lock_release+0xc8/0x290 [ 262.308442] ? __pfx_io_sq_thread+0x10/0x10 [ 262.308471] ret_from_fork+0x34b/0x430 [ 262.308502] ? __pfx_io_sq_thread+0x10/0x10 [ 262.308530] ret_from_fork_asm+0x1a/0x30 [ 262.308572] [ 262.308579] kmemleak: Object (percpu) 0x607f1a62a630 (size 8): [ 262.308591] kmemleak: comm "syz-executor.3", pid 4718, jiffies 4294929115 [ 262.308617] kmemleak: min_count = 1 [ 262.308624] kmemleak: count = 0 [ 262.308631] kmemleak: flags = 0x21 [ 262.308638] kmemleak: checksum = 0 [ 262.308644] kmemleak: backtrace: [ 262.308650] pcpu_alloc_noprof+0x87a/0x1170 [ 262.308677] percpu_ref_init+0x37/0x400 [ 262.308707] io_uring_setup+0x44c/0x2000 [ 262.308727] __x64_sys_io_uring_setup+0xc8/0x170 [ 262.308747] do_syscall_64+0xbf/0x360 [ 262.308763] entry_SYSCALL_64_after_hwframe+0x77/0x7f 17:46:54 executing program 4: r0 = perf_event_open(&(0x7f00000000c0)={0x1, 0x80, 0x0, 0xc0, 0xfa, 0x1, 0x0, 0x7fffffff, 0x10811, 0x1, 0x1, 0x1, 0x1, 0x1, 0x1, 0x1, 0x1, 0x1, 0x0, 0x1, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x1, 0x0, 0x1, 0x0, 0x0, 0x0, 0x1, 0x1, 0x1, 0x1, 0x1, 0x1, 0x1, 0x0, 0x1, 0x1, 0x1, 0x1, 0x0, 0x0, 0xfff, 0x7, @perf_config_ext={0x7, 0x7fffffff}, 0x41000, 0x80000000, 0x5, 0x3, 0x9, 0x2, 0x9, 0x0, 0x5, 0x0, 0x4}, 0x0, 0xb, 0xffffffffffffffff, 0x1) perf_event_open(&(0x7f0000000040)={0x0, 0x80, 0x0, 0x40, 0x80, 0x9, 0x0, 0x3, 0x10040, 0x1, 0x0, 0x0, 0x1, 0x1, 0x1, 0x1, 0x1, 0x1, 0x1, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x3, 0x1, 0x0, 0x1, 0x0, 0x1, 0x1, 0x0, 0x0, 0x1, 0x1, 0x1, 0x0, 0x1, 0x0, 0x0, 0x0, 0x1, 0x0, 0x1, 0x0, 0x1, 0x0, 0x0, 0x1, @perf_bp={&(0x7f0000000000), 0x10}, 0x8080, 0x800, 0x2, 0x3, 0x36dc, 0x31df3b33, 0xff, 0x0, 0x9, 0x0, 0x5}, 0xffffffffffffffff, 0x9, r0, 0x9) ioctl$PERF_EVENT_IOC_PAUSE_OUTPUT(r0, 0x40042409, 0x0) ioctl$PERF_EVENT_IOC_PERIOD(0xffffffffffffffff, 0x40082404, &(0x7f0000000140)=0x8) r1 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl$sock_ipv4_tunnel_SIOCADDTUNNEL(r1, 0x89f1, &(0x7f00000001c0)={'syztnl1\x00', &(0x7f0000000180)={'syztnl0\x00', 0x0, 0x1, 0x40, 0x0, 0x5, {{0x5, 0x4, 0x2, 0x19, 0x14, 0x65, 0x0, 0x1f, 0x4, 0x0, @multicast2, @remote}}}}) ioctl$PERF_EVENT_IOC_PERIOD(r0, 0x40082404, &(0x7f0000000200)=0x9) ioctl$SNDRV_SEQ_IOCTL_GET_PORT_INFO(0xffffffffffffffff, 0xc0a85322, &(0x7f0000000240)) ioctl$SNDRV_SEQ_IOCTL_SYSTEM_INFO(0xffffffffffffffff, 0xc0305302, &(0x7f0000000300)={0x9, 0x101, 0x1, 0x6, 0x3, 0x5}) syz_open_procfs(0x0, &(0x7f0000000340)='children\x00') 17:46:54 executing program 0: get_thread_area(&(0x7f0000000000)={0x7, 0x20000800, 0x4000, 0x0, 0x1, 0x0, 0x0, 0x1, 0x1, 0x1}) r0 = openat$vcsu(0xffffffffffffff9c, &(0x7f0000000040), 0x200000, 0x0) getsockopt$inet_tcp_TCP_REPAIR_WINDOW(r0, 0x6, 0x1d, &(0x7f0000000080), &(0x7f00000000c0)=0x14) r1 = openat$nvram(0xffffffffffffff9c, &(0x7f0000000100), 0x2000, 0x0) setsockopt$inet_tcp_TCP_FASTOPEN_KEY(r1, 0x6, 0x21, &(0x7f0000000140)="1bb9d563048b6ec78effc0f14d974b17", 0x10) setsockopt$inet_tcp_int(r1, 0x6, 0x1b, &(0x7f0000000180)=0x5, 0x4) setsockopt$inet_tcp_TCP_QUEUE_SEQ(r0, 0x6, 0x15, &(0x7f0000000240)=0x1, 0x4) r2 = socket$inet_tcp(0x2, 0x1, 0x0) ioctl$sock_inet_tcp_SIOCINQ(r2, 0x541b, &(0x7f00000003c0)) move_pages(0x0, 0x8, &(0x7f0000000400)=[&(0x7f0000ffd000/0x1000)=nil, &(0x7f0000ffd000/0x3000)=nil, &(0x7f0000ffd000/0x3000)=nil, &(0x7f0000ffb000/0x2000)=nil, &(0x7f0000ffc000/0x1000)=nil, &(0x7f0000ffe000/0x2000)=nil, &(0x7f0000ffb000/0x4000)=nil, &(0x7f0000ffd000/0x3000)=nil], &(0x7f0000000440)=[0xfff], &(0x7f0000000480)=[0x0, 0x0, 0x0], 0x4) r3 = syz_genetlink_get_family_id$SEG6(&(0x7f0000000500), r1) sendmsg$SEG6_CMD_GET_TUNSRC(r0, &(0x7f00000005c0)={&(0x7f00000004c0)={0x10, 0x0, 0x0, 0x4000000}, 0xc, &(0x7f0000000580)={&(0x7f0000000540)={0x38, r3, 0x300, 0x70bd2a, 0x25dfdbfc, {}, [@SEG6_ATTR_HMACKEYID={0x8, 0x3, 0x24}, @SEG6_ATTR_DST={0x14, 0x1, @mcast1}, @SEG6_ATTR_DSTLEN={0x8, 0x2, 0x2}]}, 0x38}, 0x1, 0x0, 0x0, 0x20008810}, 0x4040010) sendmsg$SEG6_CMD_DUMPHMAC(0xffffffffffffffff, &(0x7f0000000740)={&(0x7f0000000680)={0x10, 0x0, 0x0, 0x240000}, 0xc, &(0x7f0000000700)={&(0x7f00000006c0)={0x2c, r3, 0x1, 0x70bd2c, 0x25dfdbfe, {}, [@SEG6_ATTR_SECRET={0x8, 0x4, [0x1]}, @SEG6_ATTR_DSTLEN={0x8, 0x2, 0x5}, @SEG6_ATTR_DSTLEN={0x8}]}, 0x2c}, 0x1, 0x0, 0x0, 0x4000000}, 0x4000000) pidfd_getfd(r1, r2, 0x0) syz_genetlink_get_family_id$ieee802154(&(0x7f0000000800), 0xffffffffffffffff) 17:46:54 executing program 2: prctl$PR_MPX_ENABLE_MANAGEMENT(0x2b) socket$inet(0x2, 0x5, 0x4) syz_open_procfs(0x0, &(0x7f0000000500)='schedstat\x00') 17:46:54 executing program 7: clock_gettime(0x5, &(0x7f0000000000)) clock_settime(0x2, &(0x7f0000000040)) sched_rr_get_interval(0xffffffffffffffff, &(0x7f0000000080)) sched_rr_get_interval(0x0, &(0x7f00000000c0)) sendmsg$NL802154_CMD_GET_SEC_KEY(0xffffffffffffffff, &(0x7f00000001c0)={&(0x7f0000000100)={0x10, 0x0, 0x0, 0x20000000}, 0xc, &(0x7f0000000180)={&(0x7f0000000140)={0x24, 0x0, 0x200, 0x70bd26, 0x25dfdbfe, {}, [@NL802154_ATTR_IFINDEX={0x8}, @NL802154_ATTR_IFINDEX={0x8}]}, 0x24}, 0x1, 0x0, 0x0, 0x4000000}, 0x181) clock_gettime(0x0, &(0x7f0000000200)) pipe2$9p(&(0x7f0000000240)={0xffffffffffffffff, 0xffffffffffffffff}, 0x800) r1 = syz_io_uring_setup(0x776a, &(0x7f0000000280)={0x0, 0x2728, 0x2, 0x1, 0x37c}, &(0x7f0000000000/0x3000)=nil, &(0x7f0000000000/0x400000)=nil, &(0x7f0000000300), &(0x7f0000000340)) ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, &(0x7f0000000540)={0x64, 0x0, &(0x7f0000000440)=[@transaction_sg={0x40486311, {0x1, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x50, 0x18, &(0x7f0000000380)={@fd={0x66642a85, 0x0, r0}, @fd={0x66642a85, 0x0, r1}, @fda={0x66646185, 0x0, 0x2, 0x36}}, &(0x7f0000000400)={0x0, 0x18, 0x30}}}, @request_death, @release={0x40046306, 0x1}], 0x7e, 0x0, &(0x7f00000004c0)="7685c519d1cbea63a1a8f022f8c0085baf770aa5d1fa9bfb1a5399fdb134953d619e962218bba650b68d6206fde39ff17760aa4bbcb62f6802c48e17294a17a3b768ab60bbae37aa37e33e24b09f6bdea37853f7ab2622451803788c9d172b7d71d6d87911129b8ef5cc9e0169404b09abfa991f3a7a3640686df445d387"}) pipe2$9p(&(0x7f0000000580), 0x800) ioctl$EVIOCGVERSION(0xffffffffffffffff, 0x80044501, &(0x7f00000005c0)=""/174) r2 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r3 = syz_genetlink_get_family_id$ieee802154(&(0x7f0000000740), 0xffffffffffffffff) sendmsg$IEEE802154_LLSEC_DEL_KEY(r2, &(0x7f0000000840)={&(0x7f0000000700)={0x10, 0x0, 0x0, 0x800000}, 0xc, &(0x7f0000000800)={&(0x7f0000000780)={0x54, r3, 0x800, 0x70bd27, 0x25dfdbfc, {}, [@IEEE802154_ATTR_LLSEC_KEY_SOURCE_SHORT={0x8, 0x2c, 0x5}, @IEEE802154_ATTR_LLSEC_KEY_SOURCE_EXTENDED={0xc, 0x2d, {0xaaaaaaaaaaaa0002}}, @IEEE802154_ATTR_PAN_ID={0x6, 0x6, 0x2}, @IEEE802154_ATTR_DEV_INDEX={0x8}, @IEEE802154_ATTR_LLSEC_KEY_MODE={0x5, 0x2b, 0x1}, @IEEE802154_ATTR_HW_ADDR={0xc, 0x5, {0xaaaaaaaaaaaa0002}}, @IEEE802154_ATTR_LLSEC_KEY_MODE={0x5, 0x2b, 0x3}]}, 0x54}, 0x1, 0x0, 0x0, 0x40}, 0x2000c814) 17:46:54 executing program 3: clock_gettime(0x5, &(0x7f0000000000)) clock_settime(0x2, &(0x7f0000000040)) sched_rr_get_interval(0xffffffffffffffff, &(0x7f0000000080)) sched_rr_get_interval(0x0, &(0x7f00000000c0)) sendmsg$NL802154_CMD_GET_SEC_KEY(0xffffffffffffffff, &(0x7f00000001c0)={&(0x7f0000000100)={0x10, 0x0, 0x0, 0x20000000}, 0xc, &(0x7f0000000180)={&(0x7f0000000140)={0x24, 0x0, 0x200, 0x70bd26, 0x25dfdbfe, {}, [@NL802154_ATTR_IFINDEX={0x8}, @NL802154_ATTR_IFINDEX={0x8}]}, 0x24}, 0x1, 0x0, 0x0, 0x4000000}, 0x181) clock_gettime(0x0, &(0x7f0000000200)) pipe2$9p(&(0x7f0000000240)={0xffffffffffffffff, 0xffffffffffffffff}, 0x800) r1 = syz_io_uring_setup(0x776a, &(0x7f0000000280)={0x0, 0x2728, 0x2, 0x1, 0x37c}, &(0x7f0000000000/0x3000)=nil, &(0x7f0000000000/0x400000)=nil, &(0x7f0000000300), &(0x7f0000000340)) ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, &(0x7f0000000540)={0x64, 0x0, &(0x7f0000000440)=[@transaction_sg={0x40486311, {0x1, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x50, 0x18, &(0x7f0000000380)={@fd={0x66642a85, 0x0, r0}, @fd={0x66642a85, 0x0, r1}, @fda={0x66646185, 0x0, 0x2, 0x36}}, &(0x7f0000000400)={0x0, 0x18, 0x30}}}, @request_death, @release={0x40046306, 0x1}], 0x7e, 0x0, &(0x7f00000004c0)="7685c519d1cbea63a1a8f022f8c0085baf770aa5d1fa9bfb1a5399fdb134953d619e962218bba650b68d6206fde39ff17760aa4bbcb62f6802c48e17294a17a3b768ab60bbae37aa37e33e24b09f6bdea37853f7ab2622451803788c9d172b7d71d6d87911129b8ef5cc9e0169404b09abfa991f3a7a3640686df445d387"}) pipe2$9p(&(0x7f0000000580), 0x800) ioctl$EVIOCGVERSION(0xffffffffffffffff, 0x80044501, &(0x7f00000005c0)=""/174) r2 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r3 = syz_genetlink_get_family_id$ieee802154(&(0x7f0000000740), 0xffffffffffffffff) sendmsg$IEEE802154_LLSEC_DEL_KEY(r2, &(0x7f0000000840)={&(0x7f0000000700)={0x10, 0x0, 0x0, 0x800000}, 0xc, &(0x7f0000000800)={&(0x7f0000000780)={0x54, r3, 0x800, 0x70bd27, 0x25dfdbfc, {}, [@IEEE802154_ATTR_LLSEC_KEY_SOURCE_SHORT={0x8, 0x2c, 0x5}, @IEEE802154_ATTR_LLSEC_KEY_SOURCE_EXTENDED={0xc, 0x2d, {0xaaaaaaaaaaaa0002}}, @IEEE802154_ATTR_PAN_ID={0x6, 0x6, 0x2}, @IEEE802154_ATTR_DEV_INDEX={0x8}, @IEEE802154_ATTR_LLSEC_KEY_MODE={0x5, 0x2b, 0x1}, @IEEE802154_ATTR_HW_ADDR={0xc, 0x5, {0xaaaaaaaaaaaa0002}}, @IEEE802154_ATTR_LLSEC_KEY_MODE={0x5, 0x2b, 0x3}]}, 0x54}, 0x1, 0x0, 0x0, 0x40}, 0x2000c814) 17:46:54 executing program 5: clock_gettime(0x5, &(0x7f0000000000)) clock_settime(0x2, &(0x7f0000000040)) sched_rr_get_interval(0xffffffffffffffff, &(0x7f0000000080)) pipe2$9p(&(0x7f0000000240), 0x800) syz_io_uring_setup(0x776a, &(0x7f0000000280)={0x0, 0x2728, 0x2, 0x1, 0x37c}, &(0x7f0000000000/0x3000)=nil, &(0x7f0000000000/0x400000)=nil, &(0x7f0000000300), &(0x7f0000000340)) openat$nvram(0xffffffffffffff9c, &(0x7f0000000680), 0x400, 0x0) r0 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$ieee802154(&(0x7f0000000740), 0xffffffffffffffff) sendmsg$IEEE802154_LLSEC_DEL_KEY(r0, &(0x7f0000000840)={&(0x7f0000000700)={0x10, 0x0, 0x0, 0x800000}, 0xc, &(0x7f0000000800)={&(0x7f0000000780)={0x54, r1, 0x800, 0x70bd27, 0x25dfdbfc, {}, [@IEEE802154_ATTR_LLSEC_KEY_SOURCE_SHORT={0x8, 0x2c, 0x5}, @IEEE802154_ATTR_LLSEC_KEY_SOURCE_EXTENDED={0xc, 0x2d, {0xaaaaaaaaaaaa0002}}, @IEEE802154_ATTR_PAN_ID={0x6, 0x6, 0x2}, @IEEE802154_ATTR_DEV_INDEX={0x8}, @IEEE802154_ATTR_LLSEC_KEY_MODE={0x5, 0x2b, 0x1}, @IEEE802154_ATTR_HW_ADDR={0xc, 0x5, {0xaaaaaaaaaaaa0002}}, @IEEE802154_ATTR_LLSEC_KEY_MODE={0x5, 0x2b, 0x3}]}, 0x54}, 0x1, 0x0, 0x0, 0x40}, 0x2000c814) clock_getres(0x3, &(0x7f0000000880)) r2 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) sendmsg$IEEE802154_ADD_IFACE(r2, &(0x7f0000000a00)={&(0x7f0000000900)={0x10, 0x0, 0x0, 0x40c}, 0xc, &(0x7f00000009c0)={&(0x7f0000000940)={0x44, r1, 0x200, 0x70bd29, 0x25dfdbfe, {}, [@IEEE802154_ATTR_PHY_NAME={0x9, 0x1f, 'phy1\x00'}, @IEEE802154_ATTR_DEV_NAME={0xa, 0x1, 'wpan4\x00'}, @IEEE802154_ATTR_DEV_NAME={0xa, 0x1, 'wpan1\x00'}, @IEEE802154_ATTR_DEV_NAME={0xa, 0x1, 'wpan0\x00'}]}, 0x44}, 0x1, 0x0, 0x0, 0x20000084}, 0x44000) 17:46:54 executing program 1: shmget$private(0x0, 0x4000, 0x80, &(0x7f0000ffb000/0x4000)=nil) shmget(0x3, 0x2000, 0x4, &(0x7f0000ffc000/0x2000)=nil) mlock(&(0x7f0000ff0000/0x10000)=nil, 0x10000) shmget(0x1, 0x1000, 0x10, &(0x7f0000ff5000/0x1000)=nil) ioctl$sock_ipv4_tunnel_SIOCGETTUNNEL(0xffffffffffffffff, 0x89f0, &(0x7f0000000140)={'syztnl1\x00', &(0x7f00000000c0)={'syztnl2\x00', 0x0, 0x20, 0x1, 0x6, 0x9, {{0xd, 0x4, 0x1, 0x19, 0x34, 0x68, 0x0, 0x9, 0x29, 0x0, @empty, @dev={0xac, 0x14, 0x14, 0x29}, {[@timestamp_addr={0x44, 0x14, 0xc2, 0x1, 0x4, [{@multicast1}, {@private=0xa010101}]}, @rr={0x7, 0xb, 0xc8, [@initdev={0xac, 0x1e, 0x1, 0x0}, @private=0xa010102]}]}}}}}) ioctl$sock_ipv4_tunnel_SIOCADDTUNNEL(0xffffffffffffffff, 0x89f1, &(0x7f0000000280)={'tunl0\x00', &(0x7f0000000180)={'tunl0\x00', r0, 0x7, 0x8000, 0xfffffffc, 0x8, {{0x2f, 0x4, 0x0, 0x2, 0xbc, 0x65, 0x0, 0x0, 0x4, 0x0, @empty, @broadcast, {[@generic={0x89, 0x9, "8db1d464c6af68"}, @noop, @ra={0x94, 0x4, 0x1}, @timestamp={0x44, 0x1c, 0x53, 0x0, 0x7, [0x40, 0x7fffffff, 0xfffffffd, 0x5, 0x5c, 0x77]}, @cipso={0x86, 0x2f, 0x3, [{0x1, 0x4, "1eba"}, {0x1, 0x7, "e3ccb5ddcf"}, {0x6, 0xa, "5db18b961780af33"}, {0x2, 0xe, "7353a9824b57fd7d39232ac5"}, {0x1, 0x6, "2e1ccd27"}]}, @noop, @cipso={0x86, 0x37, 0xffffffffffffffff, [{0x2, 0xf, "227467028cabd4e137b820c5c9"}, {0x7, 0x6, "90569992"}, {0x2, 0xc, "2071b0a8c9ce92782e72"}, {0x6, 0xa, "14f2b9bca55ce3dd"}, {0x6, 0x6, "2cd22a8f"}]}, @timestamp={0x44, 0x14, 0xd4, 0x0, 0x5, [0x81, 0x5d23, 0x63ab, 0x1]}]}}}}}) ioctl$sock_ipv4_tunnel_SIOCDELTUNNEL(0xffffffffffffffff, 0x89f2, &(0x7f0000000380)={'gretap0\x00', &(0x7f00000002c0)={'syztnl2\x00', 0x0, 0x7800, 0x7, 0x40, 0xe180, {{0x22, 0x4, 0x0, 0x1, 0x88, 0x64, 0x0, 0x1, 0x29, 0x0, @multicast2, @multicast1, {[@end, @lsrr={0x83, 0x1f, 0x2f, [@multicast2, @local, @local, @multicast1, @rand_addr=0x64010102, @loopback, @private=0xa010100]}, @rr={0x7, 0x27, 0x6c, [@multicast1, @rand_addr=0x64010102, @remote, @multicast1, @loopback, @initdev={0xac, 0x1e, 0x0, 0x0}, @initdev={0xac, 0x1e, 0x1, 0x0}, @broadcast, @empty]}, @ra={0x94, 0x4, 0x1}, @timestamp={0x44, 0x10, 0x2d, 0x0, 0x8, [0x1, 0x100, 0x401]}, @ssrr={0x89, 0x13, 0x56, [@dev={0xac, 0x14, 0x14, 0x28}, @multicast2, @initdev={0xac, 0x1e, 0x0, 0x0}, @remote]}, @ra={0x94, 0x4, 0x1}]}}}}}) shmget(0x3, 0x4000, 0x4, &(0x7f0000ff9000/0x4000)=nil) r1 = syz_genetlink_get_family_id$nl802154(&(0x7f0000000400), 0xffffffffffffffff) sendmsg$NL802154_CMD_NEW_INTERFACE(0xffffffffffffffff, &(0x7f0000000540)={&(0x7f00000003c0)={0x10, 0x0, 0x0, 0x2}, 0xc, &(0x7f0000000500)={&(0x7f0000000480)={0x48, r1, 0x200, 0x70bd2a, 0x25dfdbfd, {}, [@NL802154_ATTR_IFNAME={0xa, 0x4, 'wpan0\x00'}, @NL802154_ATTR_IFINDEX={0x8}, @NL802154_ATTR_IFNAME={0xa, 0x4, 'wpan1\x00'}, @NL802154_ATTR_EXTENDED_ADDR={0xc, 0x17, {0xaaaaaaaaaaaa0002}}, @NL802154_ATTR_IFINDEX={0x8}]}, 0x48}}, 0x4001) mmap$binder(&(0x7f0000fef000/0x11000)=nil, 0x11000, 0x1, 0x11, 0xffffffffffffffff, 0x6) r2 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) sendmsg$IEEE802154_LLSEC_ADD_SECLEVEL(r2, &(0x7f00000006c0)={&(0x7f0000000580)={0x10, 0x0, 0x0, 0x4000000}, 0xc, &(0x7f0000000680)={&(0x7f0000000600)={0x44, 0x0, 0x200, 0x70bd2a, 0x25dfdbff, {}, [@IEEE802154_ATTR_LLSEC_FRAME_TYPE={0x5, 0x33, 0x34}, @IEEE802154_ATTR_DEV_INDEX={0x8}, @IEEE802154_ATTR_LLSEC_CMD_FRAME_ID={0x5, 0x34, 0x1}, @IEEE802154_ATTR_DEV_NAME={0xa, 0x1, 'wpan0\x00'}, @IEEE802154_ATTR_DEV_NAME={0xa, 0x1, 'wpan4\x00'}]}, 0x44}, 0x1, 0x0, 0x0, 0x8800}, 0x0) sendmsg$IEEE802154_START_REQ(r2, &(0x7f00000007c0)={&(0x7f0000000700)={0x10, 0x0, 0x0, 0x4}, 0xc, &(0x7f0000000780)={&(0x7f0000000740)={0x1c, 0x0, 0x200, 0x70bd2d, 0x25dfdbfb, {}, [@IEEE802154_ATTR_CHANNEL={0x5, 0x7, 0x6}]}, 0x1c}, 0x1, 0x0, 0x0, 0x40100}, 0x801) mlock(&(0x7f0000fef000/0x1000)=nil, 0x1000) syz_io_uring_setup(0x4726, &(0x7f0000000840)={0x0, 0x502f, 0x20, 0x0, 0x12e}, &(0x7f0000ffe000/0x2000)=nil, &(0x7f0000ffb000/0x4000)=nil, &(0x7f00000008c0), &(0x7f0000000900)) 17:46:54 executing program 6: get_thread_area(&(0x7f0000000000)={0x7, 0x20000800, 0x4000, 0x0, 0x1, 0x0, 0x0, 0x1, 0x1, 0x1}) r0 = openat$vcsu(0xffffffffffffff9c, &(0x7f0000000040), 0x200000, 0x0) getsockopt$inet_tcp_TCP_REPAIR_WINDOW(r0, 0x6, 0x1d, &(0x7f0000000080), &(0x7f00000000c0)=0x14) r1 = openat$nvram(0xffffffffffffff9c, &(0x7f0000000100), 0x2000, 0x0) setsockopt$inet_tcp_TCP_FASTOPEN_KEY(r1, 0x6, 0x21, &(0x7f0000000140)="1bb9d563048b6ec78effc0f14d974b17", 0x10) setsockopt$inet_tcp_int(r1, 0x6, 0x1b, &(0x7f0000000180)=0x5, 0x4) ioctl$SNDRV_TIMER_IOCTL_STATUS32(r1, 0x80585414, &(0x7f00000001c0)) r2 = socket$inet_tcp(0x2, 0x1, 0x0) ioctl$sock_inet_tcp_SIOCINQ(r2, 0x541b, &(0x7f00000003c0)) move_pages(0x0, 0x8, &(0x7f0000000400)=[&(0x7f0000ffd000/0x1000)=nil, &(0x7f0000ffd000/0x3000)=nil, &(0x7f0000ffd000/0x3000)=nil, &(0x7f0000ffb000/0x2000)=nil, &(0x7f0000ffc000/0x1000)=nil, &(0x7f0000ffe000/0x2000)=nil, &(0x7f0000ffb000/0x4000)=nil, &(0x7f0000ffd000/0x3000)=nil], &(0x7f0000000440)=[0xfff], &(0x7f0000000480)=[0x0, 0x0, 0x0], 0x4) r3 = syz_genetlink_get_family_id$SEG6(&(0x7f0000000500), r1) sendmsg$SEG6_CMD_GET_TUNSRC(r0, &(0x7f00000005c0)={&(0x7f00000004c0)={0x10, 0x0, 0x0, 0x4000000}, 0xc, &(0x7f0000000580)={&(0x7f0000000540)={0x38, r3, 0x300, 0x70bd2a, 0x25dfdbfc, {}, [@SEG6_ATTR_HMACKEYID={0x8, 0x3, 0x24}, @SEG6_ATTR_DST={0x14, 0x1, @mcast1}, @SEG6_ATTR_DSTLEN={0x8, 0x2, 0x2}]}, 0x38}, 0x1, 0x0, 0x0, 0x20008810}, 0x4040010) sendmsg$SEG6_CMD_DUMPHMAC(0xffffffffffffffff, &(0x7f0000000740)={&(0x7f0000000680)={0x10, 0x0, 0x0, 0x240000}, 0xc, &(0x7f0000000700)={&(0x7f00000006c0)={0x2c, r3, 0x1, 0x70bd2c, 0x25dfdbfe, {}, [@SEG6_ATTR_SECRET={0x8, 0x4, [0x1]}, @SEG6_ATTR_DSTLEN={0x8, 0x2, 0x5}, @SEG6_ATTR_DSTLEN={0x8}]}, 0x2c}, 0x1, 0x0, 0x0, 0x4000000}, 0x4000000) pidfd_getfd(r1, r2, 0x0) syz_genetlink_get_family_id$ieee802154(&(0x7f0000000800), 0xffffffffffffffff) 17:46:54 executing program 0: get_thread_area(&(0x7f0000000000)={0x7, 0x20000800, 0x4000, 0x0, 0x1, 0x0, 0x0, 0x1, 0x1, 0x1}) r0 = openat$vcsu(0xffffffffffffff9c, &(0x7f0000000040), 0x200000, 0x0) getsockopt$inet_tcp_TCP_REPAIR_WINDOW(r0, 0x6, 0x1d, &(0x7f0000000080), &(0x7f00000000c0)=0x14) r1 = openat$nvram(0xffffffffffffff9c, &(0x7f0000000100), 0x2000, 0x0) setsockopt$inet_tcp_TCP_FASTOPEN_KEY(r1, 0x6, 0x21, &(0x7f0000000140)="1bb9d563048b6ec78effc0f14d974b17", 0x10) setsockopt$inet_tcp_int(r1, 0x6, 0x1b, &(0x7f0000000180)=0x5, 0x4) setsockopt$inet_tcp_TCP_QUEUE_SEQ(r0, 0x6, 0x15, &(0x7f0000000240)=0x1, 0x4) r2 = socket$inet_tcp(0x2, 0x1, 0x0) ioctl$sock_inet_tcp_SIOCINQ(r2, 0x541b, &(0x7f00000003c0)) move_pages(0x0, 0x8, &(0x7f0000000400)=[&(0x7f0000ffd000/0x1000)=nil, &(0x7f0000ffd000/0x3000)=nil, &(0x7f0000ffd000/0x3000)=nil, &(0x7f0000ffb000/0x2000)=nil, &(0x7f0000ffc000/0x1000)=nil, &(0x7f0000ffe000/0x2000)=nil, &(0x7f0000ffb000/0x4000)=nil, &(0x7f0000ffd000/0x3000)=nil], &(0x7f0000000440)=[0xfff], &(0x7f0000000480)=[0x0, 0x0, 0x0], 0x4) r3 = syz_genetlink_get_family_id$SEG6(&(0x7f0000000500), r1) sendmsg$SEG6_CMD_GET_TUNSRC(r0, &(0x7f00000005c0)={&(0x7f00000004c0)={0x10, 0x0, 0x0, 0x4000000}, 0xc, &(0x7f0000000580)={&(0x7f0000000540)={0x38, r3, 0x300, 0x70bd2a, 0x25dfdbfc, {}, [@SEG6_ATTR_HMACKEYID={0x8, 0x3, 0x24}, @SEG6_ATTR_DST={0x14, 0x1, @mcast1}, @SEG6_ATTR_DSTLEN={0x8, 0x2, 0x2}]}, 0x38}, 0x1, 0x0, 0x0, 0x20008810}, 0x4040010) sendmsg$SEG6_CMD_DUMPHMAC(0xffffffffffffffff, &(0x7f0000000740)={&(0x7f0000000680)={0x10, 0x0, 0x0, 0x240000}, 0xc, &(0x7f0000000700)={&(0x7f00000006c0)={0x2c, r3, 0x1, 0x70bd2c, 0x25dfdbfe, {}, [@SEG6_ATTR_SECRET={0x8, 0x4, [0x1]}, @SEG6_ATTR_DSTLEN={0x8, 0x2, 0x5}, @SEG6_ATTR_DSTLEN={0x8}]}, 0x2c}, 0x1, 0x0, 0x0, 0x4000000}, 0x4000000) pidfd_getfd(r1, r2, 0x0) syz_genetlink_get_family_id$ieee802154(&(0x7f0000000800), 0xffffffffffffffff) 17:46:54 executing program 1: shmget$private(0x0, 0x4000, 0x80, &(0x7f0000ffb000/0x4000)=nil) shmget(0x3, 0x2000, 0x4, &(0x7f0000ffc000/0x2000)=nil) mlock(&(0x7f0000ff0000/0x10000)=nil, 0x10000) shmget(0x1, 0x1000, 0x10, &(0x7f0000ff5000/0x1000)=nil) ioctl$sock_ipv4_tunnel_SIOCGETTUNNEL(0xffffffffffffffff, 0x89f0, &(0x7f0000000140)={'syztnl1\x00', &(0x7f00000000c0)={'syztnl2\x00', 0x0, 0x20, 0x1, 0x6, 0x9, {{0xd, 0x4, 0x1, 0x19, 0x34, 0x68, 0x0, 0x9, 0x29, 0x0, @empty, @dev={0xac, 0x14, 0x14, 0x29}, {[@timestamp_addr={0x44, 0x14, 0xc2, 0x1, 0x4, [{@multicast1}, {@private=0xa010101}]}, @rr={0x7, 0xb, 0xc8, [@initdev={0xac, 0x1e, 0x1, 0x0}, @private=0xa010102]}]}}}}}) ioctl$sock_ipv4_tunnel_SIOCADDTUNNEL(0xffffffffffffffff, 0x89f1, &(0x7f0000000280)={'tunl0\x00', &(0x7f0000000180)={'tunl0\x00', r0, 0x7, 0x8000, 0xfffffffc, 0x8, {{0x2f, 0x4, 0x0, 0x2, 0xbc, 0x65, 0x0, 0x0, 0x4, 0x0, @empty, @broadcast, {[@generic={0x89, 0x9, "8db1d464c6af68"}, @noop, @ra={0x94, 0x4, 0x1}, @timestamp={0x44, 0x1c, 0x53, 0x0, 0x7, [0x40, 0x7fffffff, 0xfffffffd, 0x5, 0x5c, 0x77]}, @cipso={0x86, 0x2f, 0x3, [{0x1, 0x4, "1eba"}, {0x1, 0x7, "e3ccb5ddcf"}, {0x6, 0xa, "5db18b961780af33"}, {0x2, 0xe, "7353a9824b57fd7d39232ac5"}, {0x1, 0x6, "2e1ccd27"}]}, @noop, @cipso={0x86, 0x37, 0xffffffffffffffff, [{0x2, 0xf, "227467028cabd4e137b820c5c9"}, {0x7, 0x6, "90569992"}, {0x2, 0xc, "2071b0a8c9ce92782e72"}, {0x6, 0xa, "14f2b9bca55ce3dd"}, {0x6, 0x6, "2cd22a8f"}]}, @timestamp={0x44, 0x14, 0xd4, 0x0, 0x5, [0x81, 0x5d23, 0x63ab, 0x1]}]}}}}}) ioctl$sock_ipv4_tunnel_SIOCDELTUNNEL(0xffffffffffffffff, 0x89f2, &(0x7f0000000380)={'gretap0\x00', &(0x7f00000002c0)={'syztnl2\x00', 0x0, 0x7800, 0x7, 0x40, 0xe180, {{0x22, 0x4, 0x0, 0x1, 0x88, 0x64, 0x0, 0x1, 0x29, 0x0, @multicast2, @multicast1, {[@end, @lsrr={0x83, 0x1f, 0x2f, [@multicast2, @local, @local, @multicast1, @rand_addr=0x64010102, @loopback, @private=0xa010100]}, @rr={0x7, 0x27, 0x6c, [@multicast1, @rand_addr=0x64010102, @remote, @multicast1, @loopback, @initdev={0xac, 0x1e, 0x0, 0x0}, @initdev={0xac, 0x1e, 0x1, 0x0}, @broadcast, @empty]}, @ra={0x94, 0x4, 0x1}, @timestamp={0x44, 0x10, 0x2d, 0x0, 0x8, [0x1, 0x100, 0x401]}, @ssrr={0x89, 0x13, 0x56, [@dev={0xac, 0x14, 0x14, 0x28}, @multicast2, @initdev={0xac, 0x1e, 0x0, 0x0}, @remote]}, @ra={0x94, 0x4, 0x1}]}}}}}) mmap$IORING_OFF_CQ_RING(&(0x7f0000ffd000/0x3000)=nil, 0x3000, 0x2000008, 0x30, 0xffffffffffffffff, 0x8000000) r1 = syz_genetlink_get_family_id$nl802154(&(0x7f0000000400), 0xffffffffffffffff) sendmsg$NL802154_CMD_NEW_INTERFACE(0xffffffffffffffff, &(0x7f0000000540)={&(0x7f00000003c0)={0x10, 0x0, 0x0, 0x2}, 0xc, &(0x7f0000000500)={&(0x7f0000000480)={0x48, r1, 0x200, 0x70bd2a, 0x25dfdbfd, {}, [@NL802154_ATTR_IFNAME={0xa, 0x4, 'wpan0\x00'}, @NL802154_ATTR_IFINDEX={0x8}, @NL802154_ATTR_IFNAME={0xa, 0x4, 'wpan1\x00'}, @NL802154_ATTR_EXTENDED_ADDR={0xc, 0x17, {0xaaaaaaaaaaaa0002}}, @NL802154_ATTR_IFINDEX={0x8}]}, 0x48}}, 0x4001) mmap$binder(&(0x7f0000fef000/0x11000)=nil, 0x11000, 0x1, 0x11, 0xffffffffffffffff, 0x6) r2 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) sendmsg$IEEE802154_LLSEC_ADD_SECLEVEL(r2, &(0x7f00000006c0)={&(0x7f0000000580)={0x10, 0x0, 0x0, 0x4000000}, 0xc, &(0x7f0000000680)={&(0x7f0000000600)={0x44, 0x0, 0x200, 0x70bd2a, 0x25dfdbff, {}, [@IEEE802154_ATTR_LLSEC_FRAME_TYPE={0x5, 0x33, 0x34}, @IEEE802154_ATTR_DEV_INDEX={0x8}, @IEEE802154_ATTR_LLSEC_CMD_FRAME_ID={0x5, 0x34, 0x1}, @IEEE802154_ATTR_DEV_NAME={0xa, 0x1, 'wpan0\x00'}, @IEEE802154_ATTR_DEV_NAME={0xa, 0x1, 'wpan4\x00'}]}, 0x44}, 0x1, 0x0, 0x0, 0x8800}, 0x0) sendmsg$IEEE802154_START_REQ(r2, &(0x7f00000007c0)={&(0x7f0000000700)={0x10, 0x0, 0x0, 0x4}, 0xc, &(0x7f0000000780)={&(0x7f0000000740)={0x1c, 0x0, 0x200, 0x70bd2d, 0x25dfdbfb, {}, [@IEEE802154_ATTR_CHANNEL={0x5, 0x7, 0x6}]}, 0x1c}, 0x1, 0x0, 0x0, 0x40100}, 0x801) mlock(&(0x7f0000fef000/0x1000)=nil, 0x1000) syz_io_uring_setup(0x4726, &(0x7f0000000840)={0x0, 0x502f, 0x20, 0x0, 0x12e}, &(0x7f0000ffe000/0x2000)=nil, &(0x7f0000ffb000/0x4000)=nil, &(0x7f00000008c0), &(0x7f0000000900)) 17:46:55 executing program 5: clock_gettime(0x5, &(0x7f0000000000)) clock_settime(0x2, &(0x7f0000000040)) pipe2$9p(&(0x7f0000000240), 0x800) syz_io_uring_setup(0x776a, &(0x7f0000000280)={0x0, 0x2728, 0x2, 0x1, 0x37c}, &(0x7f0000000000/0x3000)=nil, &(0x7f0000000000/0x400000)=nil, &(0x7f0000000300), &(0x7f0000000340)) openat$nvram(0xffffffffffffff9c, &(0x7f0000000680), 0x400, 0x0) r0 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$ieee802154(&(0x7f0000000740), 0xffffffffffffffff) sendmsg$IEEE802154_LLSEC_DEL_KEY(r0, &(0x7f0000000840)={&(0x7f0000000700)={0x10, 0x0, 0x0, 0x800000}, 0xc, &(0x7f0000000800)={&(0x7f0000000780)={0x54, r1, 0x800, 0x70bd27, 0x25dfdbfc, {}, [@IEEE802154_ATTR_LLSEC_KEY_SOURCE_SHORT={0x8, 0x2c, 0x5}, @IEEE802154_ATTR_LLSEC_KEY_SOURCE_EXTENDED={0xc, 0x2d, {0xaaaaaaaaaaaa0002}}, @IEEE802154_ATTR_PAN_ID={0x6, 0x6, 0x2}, @IEEE802154_ATTR_DEV_INDEX={0x8}, @IEEE802154_ATTR_LLSEC_KEY_MODE={0x5, 0x2b, 0x1}, @IEEE802154_ATTR_HW_ADDR={0xc, 0x5, {0xaaaaaaaaaaaa0002}}, @IEEE802154_ATTR_LLSEC_KEY_MODE={0x5, 0x2b, 0x3}]}, 0x54}, 0x1, 0x0, 0x0, 0x40}, 0x2000c814) clock_getres(0x3, &(0x7f0000000880)) r2 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) sendmsg$IEEE802154_ADD_IFACE(r2, &(0x7f0000000a00)={&(0x7f0000000900)={0x10, 0x0, 0x0, 0x40c}, 0xc, &(0x7f00000009c0)={&(0x7f0000000940)={0x44, r1, 0x200, 0x70bd29, 0x25dfdbfe, {}, [@IEEE802154_ATTR_PHY_NAME={0x9, 0x1f, 'phy1\x00'}, @IEEE802154_ATTR_DEV_NAME={0xa, 0x1, 'wpan4\x00'}, @IEEE802154_ATTR_DEV_NAME={0xa, 0x1, 'wpan1\x00'}, @IEEE802154_ATTR_DEV_NAME={0xa, 0x1, 'wpan0\x00'}]}, 0x44}, 0x1, 0x0, 0x0, 0x20000084}, 0x44000) 17:46:55 executing program 6: get_thread_area(&(0x7f0000000000)={0x7, 0x20000800, 0x4000, 0x0, 0x1, 0x0, 0x0, 0x1, 0x1, 0x1}) r0 = openat$vcsu(0xffffffffffffff9c, &(0x7f0000000040), 0x200000, 0x0) getsockopt$inet_tcp_TCP_REPAIR_WINDOW(r0, 0x6, 0x1d, &(0x7f0000000080), &(0x7f00000000c0)=0x14) r1 = openat$nvram(0xffffffffffffff9c, &(0x7f0000000100), 0x2000, 0x0) setsockopt$inet_tcp_TCP_FASTOPEN_KEY(r1, 0x6, 0x21, &(0x7f0000000140)="1bb9d563048b6ec78effc0f14d974b17", 0x10) setsockopt$inet_tcp_int(r1, 0x6, 0x1b, &(0x7f0000000180)=0x5, 0x4) ioctl$SNDRV_TIMER_IOCTL_STATUS32(r1, 0x80585414, &(0x7f00000001c0)) r2 = socket$inet_tcp(0x2, 0x1, 0x0) ioctl$sock_inet_tcp_SIOCINQ(r2, 0x541b, &(0x7f00000003c0)) move_pages(0x0, 0x8, &(0x7f0000000400)=[&(0x7f0000ffd000/0x1000)=nil, &(0x7f0000ffd000/0x3000)=nil, &(0x7f0000ffd000/0x3000)=nil, &(0x7f0000ffb000/0x2000)=nil, &(0x7f0000ffc000/0x1000)=nil, &(0x7f0000ffe000/0x2000)=nil, &(0x7f0000ffb000/0x4000)=nil, &(0x7f0000ffd000/0x3000)=nil], &(0x7f0000000440)=[0xfff], &(0x7f0000000480)=[0x0, 0x0, 0x0], 0x4) r3 = syz_genetlink_get_family_id$SEG6(&(0x7f0000000500), r1) sendmsg$SEG6_CMD_GET_TUNSRC(r0, &(0x7f00000005c0)={&(0x7f00000004c0)={0x10, 0x0, 0x0, 0x4000000}, 0xc, &(0x7f0000000580)={&(0x7f0000000540)={0x38, r3, 0x300, 0x70bd2a, 0x25dfdbfc, {}, [@SEG6_ATTR_HMACKEYID={0x8, 0x3, 0x24}, @SEG6_ATTR_DST={0x14, 0x1, @mcast1}, @SEG6_ATTR_DSTLEN={0x8, 0x2, 0x2}]}, 0x38}, 0x1, 0x0, 0x0, 0x20008810}, 0x4040010) sendmsg$SEG6_CMD_DUMPHMAC(0xffffffffffffffff, &(0x7f0000000740)={&(0x7f0000000680)={0x10, 0x0, 0x0, 0x240000}, 0xc, &(0x7f0000000700)={&(0x7f00000006c0)={0x2c, r3, 0x1, 0x70bd2c, 0x25dfdbfe, {}, [@SEG6_ATTR_SECRET={0x8, 0x4, [0x1]}, @SEG6_ATTR_DSTLEN={0x8, 0x2, 0x5}, @SEG6_ATTR_DSTLEN={0x8}]}, 0x2c}, 0x1, 0x0, 0x0, 0x4000000}, 0x4000000) pidfd_getfd(r1, r2, 0x0) syz_genetlink_get_family_id$ieee802154(&(0x7f0000000800), 0xffffffffffffffff) 17:46:55 executing program 3: clock_gettime(0x5, &(0x7f0000000000)) clock_settime(0x2, &(0x7f0000000040)) sched_rr_get_interval(0xffffffffffffffff, &(0x7f0000000080)) sched_rr_get_interval(0x0, &(0x7f00000000c0)) sendmsg$NL802154_CMD_GET_SEC_KEY(0xffffffffffffffff, &(0x7f00000001c0)={&(0x7f0000000100)={0x10, 0x0, 0x0, 0x20000000}, 0xc, &(0x7f0000000180)={&(0x7f0000000140)={0x24, 0x0, 0x200, 0x70bd26, 0x25dfdbfe, {}, [@NL802154_ATTR_IFINDEX={0x8}, @NL802154_ATTR_IFINDEX={0x8}]}, 0x24}, 0x1, 0x0, 0x0, 0x4000000}, 0x181) clock_gettime(0x0, &(0x7f0000000200)) pipe2$9p(&(0x7f0000000240)={0xffffffffffffffff, 0xffffffffffffffff}, 0x800) r1 = syz_io_uring_setup(0x776a, &(0x7f0000000280)={0x0, 0x2728, 0x2, 0x1, 0x37c}, &(0x7f0000000000/0x3000)=nil, &(0x7f0000000000/0x400000)=nil, &(0x7f0000000300), &(0x7f0000000340)) ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, &(0x7f0000000540)={0x64, 0x0, &(0x7f0000000440)=[@transaction_sg={0x40486311, {0x1, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x50, 0x18, &(0x7f0000000380)={@fd={0x66642a85, 0x0, r0}, @fd={0x66642a85, 0x0, r1}, @fda={0x66646185, 0x0, 0x2, 0x36}}, &(0x7f0000000400)={0x0, 0x18, 0x30}}}, @request_death, @release={0x40046306, 0x1}], 0x7e, 0x0, &(0x7f00000004c0)="7685c519d1cbea63a1a8f022f8c0085baf770aa5d1fa9bfb1a5399fdb134953d619e962218bba650b68d6206fde39ff17760aa4bbcb62f6802c48e17294a17a3b768ab60bbae37aa37e33e24b09f6bdea37853f7ab2622451803788c9d172b7d71d6d87911129b8ef5cc9e0169404b09abfa991f3a7a3640686df445d387"}) pipe2$9p(&(0x7f0000000580), 0x800) ioctl$EVIOCGVERSION(0xffffffffffffffff, 0x80044501, &(0x7f00000005c0)=""/174) r2 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) sendmsg$IEEE802154_LLSEC_DEL_KEY(r2, &(0x7f0000000840)={&(0x7f0000000700)={0x10, 0x0, 0x0, 0x800000}, 0xc, &(0x7f0000000800)={&(0x7f0000000780)={0x54, 0x0, 0x800, 0x70bd27, 0x25dfdbfc, {}, [@IEEE802154_ATTR_LLSEC_KEY_SOURCE_SHORT={0x8, 0x2c, 0x5}, @IEEE802154_ATTR_LLSEC_KEY_SOURCE_EXTENDED={0xc, 0x2d, {0xaaaaaaaaaaaa0002}}, @IEEE802154_ATTR_PAN_ID={0x6, 0x6, 0x2}, @IEEE802154_ATTR_DEV_INDEX={0x8}, @IEEE802154_ATTR_LLSEC_KEY_MODE={0x5, 0x2b, 0x1}, @IEEE802154_ATTR_HW_ADDR={0xc, 0x5, {0xaaaaaaaaaaaa0002}}, @IEEE802154_ATTR_LLSEC_KEY_MODE={0x5, 0x2b, 0x3}]}, 0x54}, 0x1, 0x0, 0x0, 0x40}, 0x2000c814) 17:46:55 executing program 7: clock_gettime(0x5, &(0x7f0000000000)) clock_settime(0x2, &(0x7f0000000040)) sched_rr_get_interval(0xffffffffffffffff, &(0x7f0000000080)) sched_rr_get_interval(0x0, &(0x7f00000000c0)) sendmsg$NL802154_CMD_GET_SEC_KEY(0xffffffffffffffff, &(0x7f00000001c0)={&(0x7f0000000100)={0x10, 0x0, 0x0, 0x20000000}, 0xc, &(0x7f0000000180)={&(0x7f0000000140)={0x24, 0x0, 0x200, 0x70bd26, 0x25dfdbfe, {}, [@NL802154_ATTR_IFINDEX={0x8}, @NL802154_ATTR_IFINDEX={0x8}]}, 0x24}, 0x1, 0x0, 0x0, 0x4000000}, 0x181) clock_gettime(0x0, &(0x7f0000000200)) pipe2$9p(&(0x7f0000000240)={0xffffffffffffffff, 0xffffffffffffffff}, 0x800) r1 = syz_io_uring_setup(0x776a, &(0x7f0000000280)={0x0, 0x2728, 0x2, 0x1, 0x37c}, &(0x7f0000000000/0x3000)=nil, &(0x7f0000000000/0x400000)=nil, &(0x7f0000000300), &(0x7f0000000340)) ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, &(0x7f0000000540)={0x64, 0x0, &(0x7f0000000440)=[@transaction_sg={0x40486311, {0x1, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x50, 0x18, &(0x7f0000000380)={@fd={0x66642a85, 0x0, r0}, @fd={0x66642a85, 0x0, r1}, @fda={0x66646185, 0x0, 0x2, 0x36}}, &(0x7f0000000400)={0x0, 0x18, 0x30}}}, @request_death, @release={0x40046306, 0x1}], 0x7e, 0x0, &(0x7f00000004c0)="7685c519d1cbea63a1a8f022f8c0085baf770aa5d1fa9bfb1a5399fdb134953d619e962218bba650b68d6206fde39ff17760aa4bbcb62f6802c48e17294a17a3b768ab60bbae37aa37e33e24b09f6bdea37853f7ab2622451803788c9d172b7d71d6d87911129b8ef5cc9e0169404b09abfa991f3a7a3640686df445d387"}) pipe2$9p(&(0x7f0000000580), 0x800) ioctl$EVIOCGVERSION(0xffffffffffffffff, 0x80044501, &(0x7f00000005c0)=""/174) r2 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r3 = syz_genetlink_get_family_id$ieee802154(&(0x7f0000000740), 0xffffffffffffffff) sendmsg$IEEE802154_LLSEC_DEL_KEY(r2, &(0x7f0000000840)={&(0x7f0000000700)={0x10, 0x0, 0x0, 0x800000}, 0xc, &(0x7f0000000800)={&(0x7f0000000780)={0x54, r3, 0x800, 0x70bd27, 0x25dfdbfc, {}, [@IEEE802154_ATTR_LLSEC_KEY_SOURCE_SHORT={0x8, 0x2c, 0x5}, @IEEE802154_ATTR_LLSEC_KEY_SOURCE_EXTENDED={0xc, 0x2d, {0xaaaaaaaaaaaa0002}}, @IEEE802154_ATTR_PAN_ID={0x6, 0x6, 0x2}, @IEEE802154_ATTR_DEV_INDEX={0x8}, @IEEE802154_ATTR_LLSEC_KEY_MODE={0x5, 0x2b, 0x1}, @IEEE802154_ATTR_HW_ADDR={0xc, 0x5, {0xaaaaaaaaaaaa0002}}, @IEEE802154_ATTR_LLSEC_KEY_MODE={0x5, 0x2b, 0x3}]}, 0x54}, 0x1, 0x0, 0x0, 0x40}, 0x2000c814) 17:46:55 executing program 2: prctl$PR_MPX_ENABLE_MANAGEMENT(0x2b) syz_open_procfs(0x0, &(0x7f0000000500)='schedstat\x00') 17:46:55 executing program 5: clock_gettime(0x5, &(0x7f0000000000)) pipe2$9p(&(0x7f0000000240), 0x800) syz_io_uring_setup(0x776a, &(0x7f0000000280)={0x0, 0x2728, 0x2, 0x1, 0x37c}, &(0x7f0000000000/0x3000)=nil, &(0x7f0000000000/0x400000)=nil, &(0x7f0000000300), &(0x7f0000000340)) openat$nvram(0xffffffffffffff9c, &(0x7f0000000680), 0x400, 0x0) r0 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$ieee802154(&(0x7f0000000740), 0xffffffffffffffff) sendmsg$IEEE802154_LLSEC_DEL_KEY(r0, &(0x7f0000000840)={&(0x7f0000000700)={0x10, 0x0, 0x0, 0x800000}, 0xc, &(0x7f0000000800)={&(0x7f0000000780)={0x54, r1, 0x800, 0x70bd27, 0x25dfdbfc, {}, [@IEEE802154_ATTR_LLSEC_KEY_SOURCE_SHORT={0x8, 0x2c, 0x5}, @IEEE802154_ATTR_LLSEC_KEY_SOURCE_EXTENDED={0xc, 0x2d, {0xaaaaaaaaaaaa0002}}, @IEEE802154_ATTR_PAN_ID={0x6, 0x6, 0x2}, @IEEE802154_ATTR_DEV_INDEX={0x8}, @IEEE802154_ATTR_LLSEC_KEY_MODE={0x5, 0x2b, 0x1}, @IEEE802154_ATTR_HW_ADDR={0xc, 0x5, {0xaaaaaaaaaaaa0002}}, @IEEE802154_ATTR_LLSEC_KEY_MODE={0x5, 0x2b, 0x3}]}, 0x54}, 0x1, 0x0, 0x0, 0x40}, 0x2000c814) clock_getres(0x3, &(0x7f0000000880)) r2 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) sendmsg$IEEE802154_ADD_IFACE(r2, &(0x7f0000000a00)={&(0x7f0000000900)={0x10, 0x0, 0x0, 0x40c}, 0xc, &(0x7f00000009c0)={&(0x7f0000000940)={0x44, r1, 0x200, 0x70bd29, 0x25dfdbfe, {}, [@IEEE802154_ATTR_PHY_NAME={0x9, 0x1f, 'phy1\x00'}, @IEEE802154_ATTR_DEV_NAME={0xa, 0x1, 'wpan4\x00'}, @IEEE802154_ATTR_DEV_NAME={0xa, 0x1, 'wpan1\x00'}, @IEEE802154_ATTR_DEV_NAME={0xa, 0x1, 'wpan0\x00'}]}, 0x44}, 0x1, 0x0, 0x0, 0x20000084}, 0x44000) 17:46:55 executing program 4: r0 = perf_event_open(&(0x7f00000000c0)={0x1, 0x80, 0x0, 0xc0, 0xfa, 0x1, 0x0, 0x7fffffff, 0x10811, 0x1, 0x1, 0x1, 0x1, 0x1, 0x1, 0x1, 0x1, 0x1, 0x0, 0x1, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x1, 0x0, 0x1, 0x0, 0x0, 0x0, 0x1, 0x1, 0x1, 0x1, 0x1, 0x1, 0x1, 0x0, 0x1, 0x1, 0x1, 0x1, 0x0, 0x0, 0xfff, 0x7, @perf_config_ext={0x7, 0x7fffffff}, 0x41000, 0x80000000, 0x5, 0x3, 0x9, 0x2, 0x9, 0x0, 0x5, 0x0, 0x4}, 0x0, 0xb, 0xffffffffffffffff, 0x1) perf_event_open(&(0x7f0000000040)={0x0, 0x80, 0x0, 0x40, 0x80, 0x9, 0x0, 0x3, 0x10040, 0x1, 0x0, 0x0, 0x1, 0x1, 0x1, 0x1, 0x1, 0x1, 0x1, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x3, 0x1, 0x0, 0x1, 0x0, 0x1, 0x1, 0x0, 0x0, 0x1, 0x1, 0x1, 0x0, 0x1, 0x0, 0x0, 0x0, 0x1, 0x0, 0x1, 0x0, 0x1, 0x0, 0x0, 0x1, @perf_bp={&(0x7f0000000000), 0x10}, 0x8080, 0x800, 0x2, 0x3, 0x36dc, 0x31df3b33, 0xff, 0x0, 0x9, 0x0, 0x5}, 0xffffffffffffffff, 0x9, r0, 0x9) ioctl$PERF_EVENT_IOC_PAUSE_OUTPUT(r0, 0x40042409, 0x0) ioctl$PERF_EVENT_IOC_PERIOD(0xffffffffffffffff, 0x40082404, &(0x7f0000000140)=0x8) r1 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl$sock_ipv4_tunnel_SIOCADDTUNNEL(r1, 0x89f1, &(0x7f00000001c0)={'syztnl1\x00', &(0x7f0000000180)={'syztnl0\x00', 0x0, 0x1, 0x40, 0x0, 0x5, {{0x5, 0x4, 0x2, 0x19, 0x14, 0x65, 0x0, 0x1f, 0x4, 0x0, @multicast2, @remote}}}}) ioctl$PERF_EVENT_IOC_PERIOD(r0, 0x40082404, &(0x7f0000000200)=0x9) ioctl$SNDRV_SEQ_IOCTL_GET_PORT_INFO(0xffffffffffffffff, 0xc0a85322, &(0x7f0000000240)) syz_open_procfs(0x0, &(0x7f0000000340)='children\x00') 17:46:55 executing program 0: get_thread_area(&(0x7f0000000000)={0x7, 0x20000800, 0x4000, 0x0, 0x1, 0x0, 0x0, 0x1, 0x1, 0x1}) r0 = openat$vcsu(0xffffffffffffff9c, &(0x7f0000000040), 0x200000, 0x0) getsockopt$inet_tcp_TCP_REPAIR_WINDOW(r0, 0x6, 0x1d, &(0x7f0000000080), &(0x7f00000000c0)=0x14) r1 = openat$nvram(0xffffffffffffff9c, &(0x7f0000000100), 0x2000, 0x0) setsockopt$inet_tcp_TCP_FASTOPEN_KEY(r1, 0x6, 0x21, &(0x7f0000000140)="1bb9d563048b6ec78effc0f14d974b17", 0x10) setsockopt$inet_tcp_int(r1, 0x6, 0x1b, &(0x7f0000000180)=0x5, 0x4) setsockopt$inet_tcp_TCP_QUEUE_SEQ(r0, 0x6, 0x15, &(0x7f0000000240)=0x1, 0x4) r2 = socket$inet_tcp(0x2, 0x1, 0x0) ioctl$sock_inet_tcp_SIOCINQ(r2, 0x541b, &(0x7f00000003c0)) move_pages(0x0, 0x8, &(0x7f0000000400)=[&(0x7f0000ffd000/0x1000)=nil, &(0x7f0000ffd000/0x3000)=nil, &(0x7f0000ffd000/0x3000)=nil, &(0x7f0000ffb000/0x2000)=nil, &(0x7f0000ffc000/0x1000)=nil, &(0x7f0000ffe000/0x2000)=nil, &(0x7f0000ffb000/0x4000)=nil, &(0x7f0000ffd000/0x3000)=nil], &(0x7f0000000440)=[0xfff], &(0x7f0000000480)=[0x0, 0x0, 0x0], 0x4) r3 = syz_genetlink_get_family_id$SEG6(&(0x7f0000000500), r1) sendmsg$SEG6_CMD_GET_TUNSRC(r0, &(0x7f00000005c0)={&(0x7f00000004c0)={0x10, 0x0, 0x0, 0x4000000}, 0xc, &(0x7f0000000580)={&(0x7f0000000540)={0x38, r3, 0x300, 0x70bd2a, 0x25dfdbfc, {}, [@SEG6_ATTR_HMACKEYID={0x8, 0x3, 0x24}, @SEG6_ATTR_DST={0x14, 0x1, @mcast1}, @SEG6_ATTR_DSTLEN={0x8, 0x2, 0x2}]}, 0x38}, 0x1, 0x0, 0x0, 0x20008810}, 0x4040010) sendmsg$SEG6_CMD_DUMPHMAC(0xffffffffffffffff, &(0x7f0000000740)={&(0x7f0000000680)={0x10, 0x0, 0x0, 0x240000}, 0xc, &(0x7f0000000700)={&(0x7f00000006c0)={0x2c, r3, 0x1, 0x70bd2c, 0x25dfdbfe, {}, [@SEG6_ATTR_SECRET={0x8, 0x4, [0x1]}, @SEG6_ATTR_DSTLEN={0x8, 0x2, 0x5}, @SEG6_ATTR_DSTLEN={0x8}]}, 0x2c}, 0x1, 0x0, 0x0, 0x4000000}, 0x4000000) pidfd_getfd(r1, r2, 0x0) syz_genetlink_get_family_id$ieee802154(&(0x7f0000000800), 0xffffffffffffffff) 17:46:55 executing program 1: shmget$private(0x0, 0x4000, 0x80, &(0x7f0000ffb000/0x4000)=nil) shmget(0x3, 0x2000, 0x4, &(0x7f0000ffc000/0x2000)=nil) mlock(&(0x7f0000ff0000/0x10000)=nil, 0x10000) shmget(0x1, 0x1000, 0x10, &(0x7f0000ff5000/0x1000)=nil) ioctl$sock_ipv4_tunnel_SIOCGETTUNNEL(0xffffffffffffffff, 0x89f0, &(0x7f0000000140)={'syztnl1\x00', &(0x7f00000000c0)={'syztnl2\x00', 0x0, 0x20, 0x1, 0x6, 0x9, {{0xd, 0x4, 0x1, 0x19, 0x34, 0x68, 0x0, 0x9, 0x29, 0x0, @empty, @dev={0xac, 0x14, 0x14, 0x29}, {[@timestamp_addr={0x44, 0x14, 0xc2, 0x1, 0x4, [{@multicast1}, {@private=0xa010101}]}, @rr={0x7, 0xb, 0xc8, [@initdev={0xac, 0x1e, 0x1, 0x0}, @private=0xa010102]}]}}}}}) ioctl$sock_ipv4_tunnel_SIOCADDTUNNEL(0xffffffffffffffff, 0x89f1, &(0x7f0000000280)={'tunl0\x00', &(0x7f0000000180)={'tunl0\x00', r0, 0x7, 0x8000, 0xfffffffc, 0x8, {{0x2f, 0x4, 0x0, 0x2, 0xbc, 0x65, 0x0, 0x0, 0x4, 0x0, @empty, @broadcast, {[@generic={0x89, 0x9, "8db1d464c6af68"}, @noop, @ra={0x94, 0x4, 0x1}, @timestamp={0x44, 0x1c, 0x53, 0x0, 0x7, [0x40, 0x7fffffff, 0xfffffffd, 0x5, 0x5c, 0x77]}, @cipso={0x86, 0x2f, 0x3, [{0x1, 0x4, "1eba"}, {0x1, 0x7, "e3ccb5ddcf"}, {0x6, 0xa, "5db18b961780af33"}, {0x2, 0xe, "7353a9824b57fd7d39232ac5"}, {0x1, 0x6, "2e1ccd27"}]}, @noop, @cipso={0x86, 0x37, 0xffffffffffffffff, [{0x2, 0xf, "227467028cabd4e137b820c5c9"}, {0x7, 0x6, "90569992"}, {0x2, 0xc, "2071b0a8c9ce92782e72"}, {0x6, 0xa, "14f2b9bca55ce3dd"}, {0x6, 0x6, "2cd22a8f"}]}, @timestamp={0x44, 0x14, 0xd4, 0x0, 0x5, [0x81, 0x5d23, 0x63ab, 0x1]}]}}}}}) mmap$IORING_OFF_CQ_RING(&(0x7f0000ffd000/0x3000)=nil, 0x3000, 0x2000008, 0x30, 0xffffffffffffffff, 0x8000000) r1 = syz_genetlink_get_family_id$nl802154(&(0x7f0000000400), 0xffffffffffffffff) sendmsg$NL802154_CMD_NEW_INTERFACE(0xffffffffffffffff, &(0x7f0000000540)={&(0x7f00000003c0)={0x10, 0x0, 0x0, 0x2}, 0xc, &(0x7f0000000500)={&(0x7f0000000480)={0x48, r1, 0x200, 0x70bd2a, 0x25dfdbfd, {}, [@NL802154_ATTR_IFNAME={0xa, 0x4, 'wpan0\x00'}, @NL802154_ATTR_IFINDEX={0x8}, @NL802154_ATTR_IFNAME={0xa, 0x4, 'wpan1\x00'}, @NL802154_ATTR_EXTENDED_ADDR={0xc, 0x17, {0xaaaaaaaaaaaa0002}}, @NL802154_ATTR_IFINDEX={0x8}]}, 0x48}}, 0x4001) mmap$binder(&(0x7f0000fef000/0x11000)=nil, 0x11000, 0x1, 0x11, 0xffffffffffffffff, 0x6) r2 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) sendmsg$IEEE802154_LLSEC_ADD_SECLEVEL(r2, &(0x7f00000006c0)={&(0x7f0000000580)={0x10, 0x0, 0x0, 0x4000000}, 0xc, &(0x7f0000000680)={&(0x7f0000000600)={0x44, 0x0, 0x200, 0x70bd2a, 0x25dfdbff, {}, [@IEEE802154_ATTR_LLSEC_FRAME_TYPE={0x5, 0x33, 0x34}, @IEEE802154_ATTR_DEV_INDEX={0x8}, @IEEE802154_ATTR_LLSEC_CMD_FRAME_ID={0x5, 0x34, 0x1}, @IEEE802154_ATTR_DEV_NAME={0xa, 0x1, 'wpan0\x00'}, @IEEE802154_ATTR_DEV_NAME={0xa, 0x1, 'wpan4\x00'}]}, 0x44}, 0x1, 0x0, 0x0, 0x8800}, 0x0) sendmsg$IEEE802154_START_REQ(r2, &(0x7f00000007c0)={&(0x7f0000000700)={0x10, 0x0, 0x0, 0x4}, 0xc, &(0x7f0000000780)={&(0x7f0000000740)={0x1c, 0x0, 0x200, 0x70bd2d, 0x25dfdbfb, {}, [@IEEE802154_ATTR_CHANNEL={0x5, 0x7, 0x6}]}, 0x1c}, 0x1, 0x0, 0x0, 0x40100}, 0x801) mlock(&(0x7f0000fef000/0x1000)=nil, 0x1000) syz_io_uring_setup(0x4726, &(0x7f0000000840)={0x0, 0x502f, 0x20, 0x0, 0x12e}, &(0x7f0000ffe000/0x2000)=nil, &(0x7f0000ffb000/0x4000)=nil, &(0x7f00000008c0), &(0x7f0000000900)) 17:46:55 executing program 6: get_thread_area(&(0x7f0000000000)={0x7, 0x20000800, 0x4000, 0x0, 0x1, 0x0, 0x0, 0x1, 0x1, 0x1}) r0 = openat$vcsu(0xffffffffffffff9c, &(0x7f0000000040), 0x200000, 0x0) getsockopt$inet_tcp_TCP_REPAIR_WINDOW(r0, 0x6, 0x1d, &(0x7f0000000080), &(0x7f00000000c0)=0x14) r1 = openat$nvram(0xffffffffffffff9c, &(0x7f0000000100), 0x2000, 0x0) setsockopt$inet_tcp_TCP_FASTOPEN_KEY(r1, 0x6, 0x21, &(0x7f0000000140)="1bb9d563048b6ec78effc0f14d974b17", 0x10) setsockopt$inet_tcp_int(r1, 0x6, 0x1b, &(0x7f0000000180)=0x5, 0x4) ioctl$SNDRV_TIMER_IOCTL_STATUS32(r1, 0x80585414, &(0x7f00000001c0)) r2 = socket$inet_tcp(0x2, 0x1, 0x0) ioctl$sock_inet_tcp_SIOCINQ(r2, 0x541b, &(0x7f00000003c0)) move_pages(0x0, 0x8, &(0x7f0000000400)=[&(0x7f0000ffd000/0x1000)=nil, &(0x7f0000ffd000/0x3000)=nil, &(0x7f0000ffd000/0x3000)=nil, &(0x7f0000ffb000/0x2000)=nil, &(0x7f0000ffc000/0x1000)=nil, &(0x7f0000ffe000/0x2000)=nil, &(0x7f0000ffb000/0x4000)=nil, &(0x7f0000ffd000/0x3000)=nil], &(0x7f0000000440)=[0xfff], &(0x7f0000000480)=[0x0, 0x0, 0x0], 0x4) r3 = syz_genetlink_get_family_id$SEG6(&(0x7f0000000500), r1) sendmsg$SEG6_CMD_GET_TUNSRC(r0, &(0x7f00000005c0)={&(0x7f00000004c0)={0x10, 0x0, 0x0, 0x4000000}, 0xc, &(0x7f0000000580)={&(0x7f0000000540)={0x38, r3, 0x300, 0x70bd2a, 0x25dfdbfc, {}, [@SEG6_ATTR_HMACKEYID={0x8, 0x3, 0x24}, @SEG6_ATTR_DST={0x14, 0x1, @mcast1}, @SEG6_ATTR_DSTLEN={0x8, 0x2, 0x2}]}, 0x38}, 0x1, 0x0, 0x0, 0x20008810}, 0x4040010) sendmsg$SEG6_CMD_DUMPHMAC(0xffffffffffffffff, &(0x7f0000000740)={&(0x7f0000000680)={0x10, 0x0, 0x0, 0x240000}, 0xc, &(0x7f0000000700)={&(0x7f00000006c0)={0x2c, r3, 0x1, 0x70bd2c, 0x25dfdbfe, {}, [@SEG6_ATTR_SECRET={0x8, 0x4, [0x1]}, @SEG6_ATTR_DSTLEN={0x8, 0x2, 0x5}, @SEG6_ATTR_DSTLEN={0x8}]}, 0x2c}, 0x1, 0x0, 0x0, 0x4000000}, 0x4000000) syz_genetlink_get_family_id$ieee802154(&(0x7f0000000800), 0xffffffffffffffff) 17:46:55 executing program 5: clock_gettime(0x5, &(0x7f0000000000)) pipe2$9p(&(0x7f0000000240), 0x800) syz_io_uring_setup(0x776a, &(0x7f0000000280)={0x0, 0x2728, 0x2, 0x1, 0x37c}, &(0x7f0000000000/0x3000)=nil, &(0x7f0000000000/0x400000)=nil, &(0x7f0000000300), &(0x7f0000000340)) openat$nvram(0xffffffffffffff9c, &(0x7f0000000680), 0x400, 0x0) r0 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$ieee802154(&(0x7f0000000740), 0xffffffffffffffff) sendmsg$IEEE802154_LLSEC_DEL_KEY(r0, &(0x7f0000000840)={&(0x7f0000000700)={0x10, 0x0, 0x0, 0x800000}, 0xc, &(0x7f0000000800)={&(0x7f0000000780)={0x54, r1, 0x800, 0x70bd27, 0x25dfdbfc, {}, [@IEEE802154_ATTR_LLSEC_KEY_SOURCE_SHORT={0x8, 0x2c, 0x5}, @IEEE802154_ATTR_LLSEC_KEY_SOURCE_EXTENDED={0xc, 0x2d, {0xaaaaaaaaaaaa0002}}, @IEEE802154_ATTR_PAN_ID={0x6, 0x6, 0x2}, @IEEE802154_ATTR_DEV_INDEX={0x8}, @IEEE802154_ATTR_LLSEC_KEY_MODE={0x5, 0x2b, 0x1}, @IEEE802154_ATTR_HW_ADDR={0xc, 0x5, {0xaaaaaaaaaaaa0002}}, @IEEE802154_ATTR_LLSEC_KEY_MODE={0x5, 0x2b, 0x3}]}, 0x54}, 0x1, 0x0, 0x0, 0x40}, 0x2000c814) clock_getres(0x3, &(0x7f0000000880)) r2 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) sendmsg$IEEE802154_ADD_IFACE(r2, &(0x7f0000000a00)={&(0x7f0000000900)={0x10, 0x0, 0x0, 0x40c}, 0xc, &(0x7f00000009c0)={&(0x7f0000000940)={0x44, r1, 0x200, 0x70bd29, 0x25dfdbfe, {}, [@IEEE802154_ATTR_PHY_NAME={0x9, 0x1f, 'phy1\x00'}, @IEEE802154_ATTR_DEV_NAME={0xa, 0x1, 'wpan4\x00'}, @IEEE802154_ATTR_DEV_NAME={0xa, 0x1, 'wpan1\x00'}, @IEEE802154_ATTR_DEV_NAME={0xa, 0x1, 'wpan0\x00'}]}, 0x44}, 0x1, 0x0, 0x0, 0x20000084}, 0x44000) 17:47:03 executing program 2: syz_open_procfs(0x0, &(0x7f0000000500)='schedstat\x00') 17:47:03 executing program 4: r0 = perf_event_open(&(0x7f00000000c0)={0x1, 0x80, 0x0, 0xc0, 0xfa, 0x1, 0x0, 0x7fffffff, 0x10811, 0x1, 0x1, 0x1, 0x1, 0x1, 0x1, 0x1, 0x1, 0x1, 0x0, 0x1, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x1, 0x0, 0x1, 0x0, 0x0, 0x0, 0x1, 0x1, 0x1, 0x1, 0x1, 0x1, 0x1, 0x0, 0x1, 0x1, 0x1, 0x1, 0x0, 0x0, 0xfff, 0x7, @perf_config_ext={0x7, 0x7fffffff}, 0x41000, 0x80000000, 0x5, 0x3, 0x9, 0x2, 0x9, 0x0, 0x5, 0x0, 0x4}, 0x0, 0xb, 0xffffffffffffffff, 0x1) perf_event_open(&(0x7f0000000040)={0x0, 0x80, 0x0, 0x40, 0x80, 0x9, 0x0, 0x3, 0x10040, 0x1, 0x0, 0x0, 0x1, 0x1, 0x1, 0x1, 0x1, 0x1, 0x1, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x3, 0x1, 0x0, 0x1, 0x0, 0x1, 0x1, 0x0, 0x0, 0x1, 0x1, 0x1, 0x0, 0x1, 0x0, 0x0, 0x0, 0x1, 0x0, 0x1, 0x0, 0x1, 0x0, 0x0, 0x1, @perf_bp={&(0x7f0000000000), 0x10}, 0x8080, 0x800, 0x2, 0x3, 0x36dc, 0x31df3b33, 0xff, 0x0, 0x9, 0x0, 0x5}, 0xffffffffffffffff, 0x9, r0, 0x9) ioctl$PERF_EVENT_IOC_PAUSE_OUTPUT(r0, 0x40042409, 0x0) ioctl$PERF_EVENT_IOC_PERIOD(0xffffffffffffffff, 0x40082404, &(0x7f0000000140)=0x8) r1 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl$sock_ipv4_tunnel_SIOCADDTUNNEL(r1, 0x89f1, &(0x7f00000001c0)={'syztnl1\x00', &(0x7f0000000180)={'syztnl0\x00', 0x0, 0x1, 0x40, 0x0, 0x5, {{0x5, 0x4, 0x2, 0x19, 0x14, 0x65, 0x0, 0x1f, 0x4, 0x0, @multicast2, @remote}}}}) ioctl$PERF_EVENT_IOC_PERIOD(r0, 0x40082404, &(0x7f0000000200)=0x9) ioctl$SNDRV_SEQ_IOCTL_GET_PORT_INFO(0xffffffffffffffff, 0xc0a85322, &(0x7f0000000240)) syz_open_procfs(0x0, &(0x7f0000000340)='children\x00') 17:47:03 executing program 1: shmget$private(0x0, 0x4000, 0x80, &(0x7f0000ffb000/0x4000)=nil) shmget(0x3, 0x2000, 0x4, &(0x7f0000ffc000/0x2000)=nil) mlock(&(0x7f0000ff0000/0x10000)=nil, 0x10000) shmget(0x1, 0x1000, 0x10, &(0x7f0000ff5000/0x1000)=nil) ioctl$sock_ipv4_tunnel_SIOCGETTUNNEL(0xffffffffffffffff, 0x89f0, &(0x7f0000000140)={'syztnl1\x00', &(0x7f00000000c0)={'syztnl2\x00', 0x0, 0x20, 0x1, 0x6, 0x9, {{0xd, 0x4, 0x1, 0x19, 0x34, 0x68, 0x0, 0x9, 0x29, 0x0, @empty, @dev={0xac, 0x14, 0x14, 0x29}, {[@timestamp_addr={0x44, 0x14, 0xc2, 0x1, 0x4, [{@multicast1}, {@private=0xa010101}]}, @rr={0x7, 0xb, 0xc8, [@initdev={0xac, 0x1e, 0x1, 0x0}, @private=0xa010102]}]}}}}}) ioctl$sock_ipv4_tunnel_SIOCADDTUNNEL(0xffffffffffffffff, 0x89f1, &(0x7f0000000280)={'tunl0\x00', &(0x7f0000000180)={'tunl0\x00', r0, 0x7, 0x8000, 0xfffffffc, 0x8, {{0x2f, 0x4, 0x0, 0x2, 0xbc, 0x65, 0x0, 0x0, 0x4, 0x0, @empty, @broadcast, {[@generic={0x89, 0x9, "8db1d464c6af68"}, @noop, @ra={0x94, 0x4, 0x1}, @timestamp={0x44, 0x1c, 0x53, 0x0, 0x7, [0x40, 0x7fffffff, 0xfffffffd, 0x5, 0x5c, 0x77]}, @cipso={0x86, 0x2f, 0x3, [{0x1, 0x4, "1eba"}, {0x1, 0x7, "e3ccb5ddcf"}, {0x6, 0xa, "5db18b961780af33"}, {0x2, 0xe, "7353a9824b57fd7d39232ac5"}, {0x1, 0x6, "2e1ccd27"}]}, @noop, @cipso={0x86, 0x37, 0xffffffffffffffff, [{0x2, 0xf, "227467028cabd4e137b820c5c9"}, {0x7, 0x6, "90569992"}, {0x2, 0xc, "2071b0a8c9ce92782e72"}, {0x6, 0xa, "14f2b9bca55ce3dd"}, {0x6, 0x6, "2cd22a8f"}]}, @timestamp={0x44, 0x14, 0xd4, 0x0, 0x5, [0x81, 0x5d23, 0x63ab, 0x1]}]}}}}}) mmap$IORING_OFF_CQ_RING(&(0x7f0000ffd000/0x3000)=nil, 0x3000, 0x2000008, 0x30, 0xffffffffffffffff, 0x8000000) r1 = syz_genetlink_get_family_id$nl802154(&(0x7f0000000400), 0xffffffffffffffff) sendmsg$NL802154_CMD_NEW_INTERFACE(0xffffffffffffffff, &(0x7f0000000540)={&(0x7f00000003c0)={0x10, 0x0, 0x0, 0x2}, 0xc, &(0x7f0000000500)={&(0x7f0000000480)={0x48, r1, 0x200, 0x70bd2a, 0x25dfdbfd, {}, [@NL802154_ATTR_IFNAME={0xa, 0x4, 'wpan0\x00'}, @NL802154_ATTR_IFINDEX={0x8}, @NL802154_ATTR_IFNAME={0xa, 0x4, 'wpan1\x00'}, @NL802154_ATTR_EXTENDED_ADDR={0xc, 0x17, {0xaaaaaaaaaaaa0002}}, @NL802154_ATTR_IFINDEX={0x8}]}, 0x48}}, 0x4001) mmap$binder(&(0x7f0000fef000/0x11000)=nil, 0x11000, 0x1, 0x11, 0xffffffffffffffff, 0x6) r2 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) sendmsg$IEEE802154_LLSEC_ADD_SECLEVEL(r2, &(0x7f00000006c0)={&(0x7f0000000580)={0x10, 0x0, 0x0, 0x4000000}, 0xc, &(0x7f0000000680)={&(0x7f0000000600)={0x44, 0x0, 0x200, 0x70bd2a, 0x25dfdbff, {}, [@IEEE802154_ATTR_LLSEC_FRAME_TYPE={0x5, 0x33, 0x34}, @IEEE802154_ATTR_DEV_INDEX={0x8}, @IEEE802154_ATTR_LLSEC_CMD_FRAME_ID={0x5, 0x34, 0x1}, @IEEE802154_ATTR_DEV_NAME={0xa, 0x1, 'wpan0\x00'}, @IEEE802154_ATTR_DEV_NAME={0xa, 0x1, 'wpan4\x00'}]}, 0x44}, 0x1, 0x0, 0x0, 0x8800}, 0x0) sendmsg$IEEE802154_START_REQ(r2, &(0x7f00000007c0)={&(0x7f0000000700)={0x10, 0x0, 0x0, 0x4}, 0xc, &(0x7f0000000780)={&(0x7f0000000740)={0x1c, 0x0, 0x200, 0x70bd2d, 0x25dfdbfb, {}, [@IEEE802154_ATTR_CHANNEL={0x5, 0x7, 0x6}]}, 0x1c}, 0x1, 0x0, 0x0, 0x40100}, 0x801) mlock(&(0x7f0000fef000/0x1000)=nil, 0x1000) syz_io_uring_setup(0x4726, &(0x7f0000000840)={0x0, 0x502f, 0x20, 0x0, 0x12e}, &(0x7f0000ffe000/0x2000)=nil, &(0x7f0000ffb000/0x4000)=nil, &(0x7f00000008c0), &(0x7f0000000900)) 17:47:03 executing program 0: get_thread_area(&(0x7f0000000000)={0x7, 0x20000800, 0x4000, 0x0, 0x1, 0x0, 0x0, 0x1, 0x1, 0x1}) r0 = openat$vcsu(0xffffffffffffff9c, &(0x7f0000000040), 0x200000, 0x0) getsockopt$inet_tcp_TCP_REPAIR_WINDOW(r0, 0x6, 0x1d, &(0x7f0000000080), &(0x7f00000000c0)=0x14) r1 = openat$nvram(0xffffffffffffff9c, &(0x7f0000000100), 0x2000, 0x0) setsockopt$inet_tcp_TCP_FASTOPEN_KEY(r1, 0x6, 0x21, &(0x7f0000000140)="1bb9d563048b6ec78effc0f14d974b17", 0x10) ioctl$SNDRV_TIMER_IOCTL_STATUS32(r1, 0x80585414, &(0x7f00000001c0)) setsockopt$inet_tcp_TCP_QUEUE_SEQ(r0, 0x6, 0x15, &(0x7f0000000240)=0x1, 0x4) r2 = socket$inet_tcp(0x2, 0x1, 0x0) ioctl$sock_inet_tcp_SIOCINQ(r2, 0x541b, &(0x7f00000003c0)) move_pages(0x0, 0x8, &(0x7f0000000400)=[&(0x7f0000ffd000/0x1000)=nil, &(0x7f0000ffd000/0x3000)=nil, &(0x7f0000ffd000/0x3000)=nil, &(0x7f0000ffb000/0x2000)=nil, &(0x7f0000ffc000/0x1000)=nil, &(0x7f0000ffe000/0x2000)=nil, &(0x7f0000ffb000/0x4000)=nil, &(0x7f0000ffd000/0x3000)=nil], &(0x7f0000000440)=[0xfff], &(0x7f0000000480)=[0x0, 0x0, 0x0], 0x4) r3 = syz_genetlink_get_family_id$SEG6(&(0x7f0000000500), r1) sendmsg$SEG6_CMD_GET_TUNSRC(r0, &(0x7f00000005c0)={&(0x7f00000004c0)={0x10, 0x0, 0x0, 0x4000000}, 0xc, &(0x7f0000000580)={&(0x7f0000000540)={0x38, r3, 0x300, 0x70bd2a, 0x25dfdbfc, {}, [@SEG6_ATTR_HMACKEYID={0x8, 0x3, 0x24}, @SEG6_ATTR_DST={0x14, 0x1, @mcast1}, @SEG6_ATTR_DSTLEN={0x8, 0x2, 0x2}]}, 0x38}, 0x1, 0x0, 0x0, 0x20008810}, 0x4040010) sendmsg$SEG6_CMD_DUMPHMAC(0xffffffffffffffff, &(0x7f0000000740)={&(0x7f0000000680)={0x10, 0x0, 0x0, 0x240000}, 0xc, &(0x7f0000000700)={&(0x7f00000006c0)={0x2c, r3, 0x1, 0x70bd2c, 0x25dfdbfe, {}, [@SEG6_ATTR_SECRET={0x8, 0x4, [0x1]}, @SEG6_ATTR_DSTLEN={0x8, 0x2, 0x5}, @SEG6_ATTR_DSTLEN={0x8}]}, 0x2c}, 0x1, 0x0, 0x0, 0x4000000}, 0x4000000) pidfd_getfd(r1, r2, 0x0) syz_genetlink_get_family_id$ieee802154(&(0x7f0000000800), 0xffffffffffffffff) 17:47:03 executing program 5: clock_gettime(0x5, &(0x7f0000000000)) pipe2$9p(&(0x7f0000000240), 0x800) syz_io_uring_setup(0x776a, &(0x7f0000000280)={0x0, 0x2728, 0x2, 0x1, 0x37c}, &(0x7f0000000000/0x3000)=nil, &(0x7f0000000000/0x400000)=nil, &(0x7f0000000300), &(0x7f0000000340)) openat$nvram(0xffffffffffffff9c, &(0x7f0000000680), 0x400, 0x0) r0 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$ieee802154(&(0x7f0000000740), 0xffffffffffffffff) sendmsg$IEEE802154_LLSEC_DEL_KEY(r0, &(0x7f0000000840)={&(0x7f0000000700)={0x10, 0x0, 0x0, 0x800000}, 0xc, &(0x7f0000000800)={&(0x7f0000000780)={0x54, r1, 0x800, 0x70bd27, 0x25dfdbfc, {}, [@IEEE802154_ATTR_LLSEC_KEY_SOURCE_SHORT={0x8, 0x2c, 0x5}, @IEEE802154_ATTR_LLSEC_KEY_SOURCE_EXTENDED={0xc, 0x2d, {0xaaaaaaaaaaaa0002}}, @IEEE802154_ATTR_PAN_ID={0x6, 0x6, 0x2}, @IEEE802154_ATTR_DEV_INDEX={0x8}, @IEEE802154_ATTR_LLSEC_KEY_MODE={0x5, 0x2b, 0x1}, @IEEE802154_ATTR_HW_ADDR={0xc, 0x5, {0xaaaaaaaaaaaa0002}}, @IEEE802154_ATTR_LLSEC_KEY_MODE={0x5, 0x2b, 0x3}]}, 0x54}, 0x1, 0x0, 0x0, 0x40}, 0x2000c814) clock_getres(0x3, &(0x7f0000000880)) r2 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) sendmsg$IEEE802154_ADD_IFACE(r2, &(0x7f0000000a00)={&(0x7f0000000900)={0x10, 0x0, 0x0, 0x40c}, 0xc, &(0x7f00000009c0)={&(0x7f0000000940)={0x44, r1, 0x200, 0x70bd29, 0x25dfdbfe, {}, [@IEEE802154_ATTR_PHY_NAME={0x9, 0x1f, 'phy1\x00'}, @IEEE802154_ATTR_DEV_NAME={0xa, 0x1, 'wpan4\x00'}, @IEEE802154_ATTR_DEV_NAME={0xa, 0x1, 'wpan1\x00'}, @IEEE802154_ATTR_DEV_NAME={0xa, 0x1, 'wpan0\x00'}]}, 0x44}, 0x1, 0x0, 0x0, 0x20000084}, 0x44000) 17:47:03 executing program 6: get_thread_area(&(0x7f0000000000)={0x7, 0x20000800, 0x4000, 0x0, 0x1, 0x0, 0x0, 0x1, 0x1, 0x1}) r0 = openat$vcsu(0xffffffffffffff9c, &(0x7f0000000040), 0x200000, 0x0) getsockopt$inet_tcp_TCP_REPAIR_WINDOW(r0, 0x6, 0x1d, &(0x7f0000000080), &(0x7f00000000c0)=0x14) r1 = openat$nvram(0xffffffffffffff9c, &(0x7f0000000100), 0x2000, 0x0) setsockopt$inet_tcp_TCP_FASTOPEN_KEY(r1, 0x6, 0x21, &(0x7f0000000140)="1bb9d563048b6ec78effc0f14d974b17", 0x10) setsockopt$inet_tcp_int(r1, 0x6, 0x1b, &(0x7f0000000180)=0x5, 0x4) ioctl$SNDRV_TIMER_IOCTL_STATUS32(r1, 0x80585414, &(0x7f00000001c0)) r2 = socket$inet_tcp(0x2, 0x1, 0x0) ioctl$sock_inet_tcp_SIOCINQ(r2, 0x541b, &(0x7f00000003c0)) move_pages(0x0, 0x8, &(0x7f0000000400)=[&(0x7f0000ffd000/0x1000)=nil, &(0x7f0000ffd000/0x3000)=nil, &(0x7f0000ffd000/0x3000)=nil, &(0x7f0000ffb000/0x2000)=nil, &(0x7f0000ffc000/0x1000)=nil, &(0x7f0000ffe000/0x2000)=nil, &(0x7f0000ffb000/0x4000)=nil, &(0x7f0000ffd000/0x3000)=nil], &(0x7f0000000440)=[0xfff], &(0x7f0000000480)=[0x0, 0x0, 0x0], 0x4) r3 = syz_genetlink_get_family_id$SEG6(&(0x7f0000000500), r1) sendmsg$SEG6_CMD_GET_TUNSRC(r0, &(0x7f00000005c0)={&(0x7f00000004c0)={0x10, 0x0, 0x0, 0x4000000}, 0xc, &(0x7f0000000580)={&(0x7f0000000540)={0x38, r3, 0x300, 0x70bd2a, 0x25dfdbfc, {}, [@SEG6_ATTR_HMACKEYID={0x8, 0x3, 0x24}, @SEG6_ATTR_DST={0x14, 0x1, @mcast1}, @SEG6_ATTR_DSTLEN={0x8, 0x2, 0x2}]}, 0x38}, 0x1, 0x0, 0x0, 0x20008810}, 0x4040010) syz_genetlink_get_family_id$ieee802154(&(0x7f0000000800), 0xffffffffffffffff) 17:47:03 executing program 3: clock_gettime(0x5, &(0x7f0000000000)) clock_settime(0x2, &(0x7f0000000040)) sched_rr_get_interval(0xffffffffffffffff, &(0x7f0000000080)) sched_rr_get_interval(0x0, &(0x7f00000000c0)) sendmsg$NL802154_CMD_GET_SEC_KEY(0xffffffffffffffff, &(0x7f00000001c0)={&(0x7f0000000100)={0x10, 0x0, 0x0, 0x20000000}, 0xc, &(0x7f0000000180)={&(0x7f0000000140)={0x24, 0x0, 0x200, 0x70bd26, 0x25dfdbfe, {}, [@NL802154_ATTR_IFINDEX={0x8}, @NL802154_ATTR_IFINDEX={0x8}]}, 0x24}, 0x1, 0x0, 0x0, 0x4000000}, 0x181) clock_gettime(0x0, &(0x7f0000000200)) pipe2$9p(&(0x7f0000000240)={0xffffffffffffffff, 0xffffffffffffffff}, 0x800) r1 = syz_io_uring_setup(0x776a, &(0x7f0000000280)={0x0, 0x2728, 0x2, 0x1, 0x37c}, &(0x7f0000000000/0x3000)=nil, &(0x7f0000000000/0x400000)=nil, &(0x7f0000000300), &(0x7f0000000340)) ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, &(0x7f0000000540)={0x64, 0x0, &(0x7f0000000440)=[@transaction_sg={0x40486311, {0x1, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x50, 0x18, &(0x7f0000000380)={@fd={0x66642a85, 0x0, r0}, @fd={0x66642a85, 0x0, r1}, @fda={0x66646185, 0x0, 0x2, 0x36}}, &(0x7f0000000400)={0x0, 0x18, 0x30}}}, @request_death, @release={0x40046306, 0x1}], 0x7e, 0x0, &(0x7f00000004c0)="7685c519d1cbea63a1a8f022f8c0085baf770aa5d1fa9bfb1a5399fdb134953d619e962218bba650b68d6206fde39ff17760aa4bbcb62f6802c48e17294a17a3b768ab60bbae37aa37e33e24b09f6bdea37853f7ab2622451803788c9d172b7d71d6d87911129b8ef5cc9e0169404b09abfa991f3a7a3640686df445d387"}) pipe2$9p(&(0x7f0000000580), 0x800) ioctl$EVIOCGVERSION(0xffffffffffffffff, 0x80044501, &(0x7f00000005c0)=""/174) r2 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) sendmsg$IEEE802154_LLSEC_DEL_KEY(r2, &(0x7f0000000840)={&(0x7f0000000700)={0x10, 0x0, 0x0, 0x800000}, 0xc, &(0x7f0000000800)={&(0x7f0000000780)={0x54, 0x0, 0x800, 0x70bd27, 0x25dfdbfc, {}, [@IEEE802154_ATTR_LLSEC_KEY_SOURCE_SHORT={0x8, 0x2c, 0x5}, @IEEE802154_ATTR_LLSEC_KEY_SOURCE_EXTENDED={0xc, 0x2d, {0xaaaaaaaaaaaa0002}}, @IEEE802154_ATTR_PAN_ID={0x6, 0x6, 0x2}, @IEEE802154_ATTR_DEV_INDEX={0x8}, @IEEE802154_ATTR_LLSEC_KEY_MODE={0x5, 0x2b, 0x1}, @IEEE802154_ATTR_HW_ADDR={0xc, 0x5, {0xaaaaaaaaaaaa0002}}, @IEEE802154_ATTR_LLSEC_KEY_MODE={0x5, 0x2b, 0x3}]}, 0x54}, 0x1, 0x0, 0x0, 0x40}, 0x2000c814) 17:47:03 executing program 7: clock_gettime(0x5, &(0x7f0000000000)) clock_settime(0x2, &(0x7f0000000040)) sched_rr_get_interval(0xffffffffffffffff, &(0x7f0000000080)) sched_rr_get_interval(0x0, &(0x7f00000000c0)) sendmsg$NL802154_CMD_GET_SEC_KEY(0xffffffffffffffff, &(0x7f00000001c0)={&(0x7f0000000100)={0x10, 0x0, 0x0, 0x20000000}, 0xc, &(0x7f0000000180)={&(0x7f0000000140)={0x24, 0x0, 0x200, 0x70bd26, 0x25dfdbfe, {}, [@NL802154_ATTR_IFINDEX={0x8}, @NL802154_ATTR_IFINDEX={0x8}]}, 0x24}, 0x1, 0x0, 0x0, 0x4000000}, 0x181) clock_gettime(0x0, &(0x7f0000000200)) pipe2$9p(&(0x7f0000000240)={0xffffffffffffffff, 0xffffffffffffffff}, 0x800) r1 = syz_io_uring_setup(0x776a, &(0x7f0000000280)={0x0, 0x2728, 0x2, 0x1, 0x37c}, &(0x7f0000000000/0x3000)=nil, &(0x7f0000000000/0x400000)=nil, &(0x7f0000000300), &(0x7f0000000340)) ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, &(0x7f0000000540)={0x64, 0x0, &(0x7f0000000440)=[@transaction_sg={0x40486311, {0x1, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x50, 0x18, &(0x7f0000000380)={@fd={0x66642a85, 0x0, r0}, @fd={0x66642a85, 0x0, r1}, @fda={0x66646185, 0x0, 0x2, 0x36}}, &(0x7f0000000400)={0x0, 0x18, 0x30}}}, @request_death, @release={0x40046306, 0x1}], 0x7e, 0x0, &(0x7f00000004c0)="7685c519d1cbea63a1a8f022f8c0085baf770aa5d1fa9bfb1a5399fdb134953d619e962218bba650b68d6206fde39ff17760aa4bbcb62f6802c48e17294a17a3b768ab60bbae37aa37e33e24b09f6bdea37853f7ab2622451803788c9d172b7d71d6d87911129b8ef5cc9e0169404b09abfa991f3a7a3640686df445d387"}) pipe2$9p(&(0x7f0000000580), 0x800) ioctl$EVIOCGVERSION(0xffffffffffffffff, 0x80044501, &(0x7f00000005c0)=""/174) syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) syz_genetlink_get_family_id$ieee802154(&(0x7f0000000740), 0xffffffffffffffff) clock_getres(0x3, &(0x7f0000000880)) 17:47:03 executing program 5: pipe2$9p(&(0x7f0000000240), 0x800) syz_io_uring_setup(0x776a, &(0x7f0000000280)={0x0, 0x2728, 0x2, 0x1, 0x37c}, &(0x7f0000000000/0x3000)=nil, &(0x7f0000000000/0x400000)=nil, &(0x7f0000000300), &(0x7f0000000340)) openat$nvram(0xffffffffffffff9c, &(0x7f0000000680), 0x400, 0x0) r0 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$ieee802154(&(0x7f0000000740), 0xffffffffffffffff) sendmsg$IEEE802154_LLSEC_DEL_KEY(r0, &(0x7f0000000840)={&(0x7f0000000700)={0x10, 0x0, 0x0, 0x800000}, 0xc, &(0x7f0000000800)={&(0x7f0000000780)={0x54, r1, 0x800, 0x70bd27, 0x25dfdbfc, {}, [@IEEE802154_ATTR_LLSEC_KEY_SOURCE_SHORT={0x8, 0x2c, 0x5}, @IEEE802154_ATTR_LLSEC_KEY_SOURCE_EXTENDED={0xc, 0x2d, {0xaaaaaaaaaaaa0002}}, @IEEE802154_ATTR_PAN_ID={0x6, 0x6, 0x2}, @IEEE802154_ATTR_DEV_INDEX={0x8}, @IEEE802154_ATTR_LLSEC_KEY_MODE={0x5, 0x2b, 0x1}, @IEEE802154_ATTR_HW_ADDR={0xc, 0x5, {0xaaaaaaaaaaaa0002}}, @IEEE802154_ATTR_LLSEC_KEY_MODE={0x5, 0x2b, 0x3}]}, 0x54}, 0x1, 0x0, 0x0, 0x40}, 0x2000c814) clock_getres(0x3, &(0x7f0000000880)) r2 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) sendmsg$IEEE802154_ADD_IFACE(r2, &(0x7f0000000a00)={&(0x7f0000000900)={0x10, 0x0, 0x0, 0x40c}, 0xc, &(0x7f00000009c0)={&(0x7f0000000940)={0x44, r1, 0x200, 0x70bd29, 0x25dfdbfe, {}, [@IEEE802154_ATTR_PHY_NAME={0x9, 0x1f, 'phy1\x00'}, @IEEE802154_ATTR_DEV_NAME={0xa, 0x1, 'wpan4\x00'}, @IEEE802154_ATTR_DEV_NAME={0xa, 0x1, 'wpan1\x00'}, @IEEE802154_ATTR_DEV_NAME={0xa, 0x1, 'wpan0\x00'}]}, 0x44}, 0x1, 0x0, 0x0, 0x20000084}, 0x44000) [ 280.209082] kmemleak: Found object by alias at 0x607f1a62a634 [ 280.209103] CPU: 0 UID: 0 PID: 4801 Comm: iou-sqp-4800 Tainted: G W 6.17.0-rc3-next-20250829 #1 PREEMPT(voluntary) [ 280.209121] Tainted: [W]=WARN [ 280.209125] Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.12.0-1 04/01/2014 [ 280.209132] Call Trace: [ 280.209136] [ 280.209141] dump_stack_lvl+0xca/0x120 [ 280.209165] __lookup_object+0x94/0xb0 [ 280.209181] delete_object_full+0x27/0x70 [ 280.209197] free_percpu+0x30/0x1160 [ 280.209213] ? arch_uprobe_clear_state+0x16/0x140 [ 280.209232] futex_hash_free+0x38/0xc0 [ 280.209246] mmput+0x2d3/0x390 [ 280.209264] do_exit+0x79d/0x2970 [ 280.209282] ? __pfx_do_exit+0x10/0x10 [ 280.209293] ? io_sq_thread+0xfbd/0x1b00 [ 280.209309] ? lock_release+0xc8/0x290 [ 280.209326] io_sq_thread+0xfc9/0x1b00 [ 280.209346] ? __pfx_io_sq_thread+0x10/0x10 [ 280.209363] ? __lock_acquire+0xc65/0x1b70 [ 280.209375] ? __pfx_autoremove_wake_function+0x10/0x10 [ 280.209390] ? __lock_acquire+0xc65/0x1b70 [ 280.209410] ? do_raw_spin_lock+0x123/0x260 [ 280.209425] ? find_held_lock+0x2b/0x80 [ 280.209441] ? __pfx_io_sq_thread+0x10/0x10 [ 280.209456] ? lock_release+0xc8/0x290 [ 280.209469] ? __pfx_io_sq_thread+0x10/0x10 [ 280.209484] ret_from_fork+0x34b/0x430 [ 280.209501] ? __pfx_io_sq_thread+0x10/0x10 [ 280.209516] ret_from_fork_asm+0x1a/0x30 [ 280.209539] [ 280.209543] kmemleak: Object (percpu) 0x607f1a62a630 (size 8): [ 280.209550] kmemleak: comm "syz-executor.5", pid 4809, jiffies 4294947020 [ 280.209556] kmemleak: min_count = 1 [ 280.209560] kmemleak: count = 0 [ 280.209564] kmemleak: flags = 0x21 [ 280.209567] kmemleak: checksum = 0 [ 280.209571] kmemleak: backtrace: [ 280.209575] pcpu_alloc_noprof+0x87a/0x1170 [ 280.209589] percpu_ref_init+0x37/0x400 [ 280.209606] io_uring_setup+0x44c/0x2000 [ 280.209617] __x64_sys_io_uring_setup+0xc8/0x170 [ 280.209627] do_syscall_64+0xbf/0x360 [ 280.209637] entry_SYSCALL_64_after_hwframe+0x77/0x7f 17:47:03 executing program 7: clock_gettime(0x5, &(0x7f0000000000)) clock_settime(0x2, &(0x7f0000000040)) sched_rr_get_interval(0xffffffffffffffff, &(0x7f0000000080)) sched_rr_get_interval(0x0, &(0x7f00000000c0)) sendmsg$NL802154_CMD_GET_SEC_KEY(0xffffffffffffffff, &(0x7f00000001c0)={&(0x7f0000000100)={0x10, 0x0, 0x0, 0x20000000}, 0xc, &(0x7f0000000180)={&(0x7f0000000140)={0x24, 0x0, 0x200, 0x70bd26, 0x25dfdbfe, {}, [@NL802154_ATTR_IFINDEX={0x8}, @NL802154_ATTR_IFINDEX={0x8}]}, 0x24}, 0x1, 0x0, 0x0, 0x4000000}, 0x181) clock_gettime(0x0, &(0x7f0000000200)) pipe2$9p(&(0x7f0000000240)={0xffffffffffffffff, 0xffffffffffffffff}, 0x800) r1 = syz_io_uring_setup(0x776a, &(0x7f0000000280)={0x0, 0x2728, 0x2, 0x1, 0x37c}, &(0x7f0000000000/0x3000)=nil, &(0x7f0000000000/0x400000)=nil, &(0x7f0000000300), &(0x7f0000000340)) ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, &(0x7f0000000540)={0x64, 0x0, &(0x7f0000000440)=[@transaction_sg={0x40486311, {0x1, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x50, 0x18, &(0x7f0000000380)={@fd={0x66642a85, 0x0, r0}, @fd={0x66642a85, 0x0, r1}, @fda={0x66646185, 0x0, 0x2, 0x36}}, &(0x7f0000000400)={0x0, 0x18, 0x30}}}, @request_death, @release={0x40046306, 0x1}], 0x7e, 0x0, &(0x7f00000004c0)="7685c519d1cbea63a1a8f022f8c0085baf770aa5d1fa9bfb1a5399fdb134953d619e962218bba650b68d6206fde39ff17760aa4bbcb62f6802c48e17294a17a3b768ab60bbae37aa37e33e24b09f6bdea37853f7ab2622451803788c9d172b7d71d6d87911129b8ef5cc9e0169404b09abfa991f3a7a3640686df445d387"}) pipe2$9p(&(0x7f0000000580), 0x800) ioctl$EVIOCGVERSION(0xffffffffffffffff, 0x80044501, &(0x7f00000005c0)=""/174) syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) syz_genetlink_get_family_id$ieee802154(&(0x7f0000000740), 0xffffffffffffffff) clock_getres(0x3, &(0x7f0000000880)) 17:47:03 executing program 3: clock_gettime(0x5, &(0x7f0000000000)) clock_settime(0x2, &(0x7f0000000040)) sched_rr_get_interval(0xffffffffffffffff, &(0x7f0000000080)) sched_rr_get_interval(0x0, &(0x7f00000000c0)) sendmsg$NL802154_CMD_GET_SEC_KEY(0xffffffffffffffff, &(0x7f00000001c0)={&(0x7f0000000100)={0x10, 0x0, 0x0, 0x20000000}, 0xc, &(0x7f0000000180)={&(0x7f0000000140)={0x24, 0x0, 0x200, 0x70bd26, 0x25dfdbfe, {}, [@NL802154_ATTR_IFINDEX={0x8}, @NL802154_ATTR_IFINDEX={0x8}]}, 0x24}, 0x1, 0x0, 0x0, 0x4000000}, 0x181) clock_gettime(0x0, &(0x7f0000000200)) pipe2$9p(&(0x7f0000000240)={0xffffffffffffffff, 0xffffffffffffffff}, 0x800) r1 = syz_io_uring_setup(0x776a, &(0x7f0000000280)={0x0, 0x2728, 0x2, 0x1, 0x37c}, &(0x7f0000000000/0x3000)=nil, &(0x7f0000000000/0x400000)=nil, &(0x7f0000000300), &(0x7f0000000340)) ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, &(0x7f0000000540)={0x64, 0x0, &(0x7f0000000440)=[@transaction_sg={0x40486311, {0x1, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x50, 0x18, &(0x7f0000000380)={@fd={0x66642a85, 0x0, r0}, @fd={0x66642a85, 0x0, r1}, @fda={0x66646185, 0x0, 0x2, 0x36}}, &(0x7f0000000400)={0x0, 0x18, 0x30}}}, @request_death, @release={0x40046306, 0x1}], 0x7e, 0x0, &(0x7f00000004c0)="7685c519d1cbea63a1a8f022f8c0085baf770aa5d1fa9bfb1a5399fdb134953d619e962218bba650b68d6206fde39ff17760aa4bbcb62f6802c48e17294a17a3b768ab60bbae37aa37e33e24b09f6bdea37853f7ab2622451803788c9d172b7d71d6d87911129b8ef5cc9e0169404b09abfa991f3a7a3640686df445d387"}) pipe2$9p(&(0x7f0000000580), 0x800) ioctl$EVIOCGVERSION(0xffffffffffffffff, 0x80044501, &(0x7f00000005c0)=""/174) r2 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) sendmsg$IEEE802154_LLSEC_DEL_KEY(r2, &(0x7f0000000840)={&(0x7f0000000700)={0x10, 0x0, 0x0, 0x800000}, 0xc, &(0x7f0000000800)={&(0x7f0000000780)={0x54, 0x0, 0x800, 0x70bd27, 0x25dfdbfc, {}, [@IEEE802154_ATTR_LLSEC_KEY_SOURCE_SHORT={0x8, 0x2c, 0x5}, @IEEE802154_ATTR_LLSEC_KEY_SOURCE_EXTENDED={0xc, 0x2d, {0xaaaaaaaaaaaa0002}}, @IEEE802154_ATTR_PAN_ID={0x6, 0x6, 0x2}, @IEEE802154_ATTR_DEV_INDEX={0x8}, @IEEE802154_ATTR_LLSEC_KEY_MODE={0x5, 0x2b, 0x1}, @IEEE802154_ATTR_HW_ADDR={0xc, 0x5, {0xaaaaaaaaaaaa0002}}, @IEEE802154_ATTR_LLSEC_KEY_MODE={0x5, 0x2b, 0x3}]}, 0x54}, 0x1, 0x0, 0x0, 0x40}, 0x2000c814) 17:47:03 executing program 2: syz_open_procfs(0x0, 0x0) 17:47:03 executing program 6: get_thread_area(&(0x7f0000000000)={0x7, 0x20000800, 0x4000, 0x0, 0x1, 0x0, 0x0, 0x1, 0x1, 0x1}) r0 = openat$vcsu(0xffffffffffffff9c, &(0x7f0000000040), 0x200000, 0x0) getsockopt$inet_tcp_TCP_REPAIR_WINDOW(r0, 0x6, 0x1d, &(0x7f0000000080), &(0x7f00000000c0)=0x14) r1 = openat$nvram(0xffffffffffffff9c, &(0x7f0000000100), 0x2000, 0x0) setsockopt$inet_tcp_TCP_FASTOPEN_KEY(r1, 0x6, 0x21, &(0x7f0000000140)="1bb9d563048b6ec78effc0f14d974b17", 0x10) setsockopt$inet_tcp_int(r1, 0x6, 0x1b, &(0x7f0000000180)=0x5, 0x4) ioctl$SNDRV_TIMER_IOCTL_STATUS32(r1, 0x80585414, &(0x7f00000001c0)) r2 = socket$inet_tcp(0x2, 0x1, 0x0) ioctl$sock_inet_tcp_SIOCINQ(r2, 0x541b, &(0x7f00000003c0)) move_pages(0x0, 0x8, &(0x7f0000000400)=[&(0x7f0000ffd000/0x1000)=nil, &(0x7f0000ffd000/0x3000)=nil, &(0x7f0000ffd000/0x3000)=nil, &(0x7f0000ffb000/0x2000)=nil, &(0x7f0000ffc000/0x1000)=nil, &(0x7f0000ffe000/0x2000)=nil, &(0x7f0000ffb000/0x4000)=nil, &(0x7f0000ffd000/0x3000)=nil], &(0x7f0000000440)=[0xfff], &(0x7f0000000480)=[0x0, 0x0, 0x0], 0x4) syz_genetlink_get_family_id$SEG6(&(0x7f0000000500), r1) syz_genetlink_get_family_id$ieee802154(&(0x7f0000000800), 0xffffffffffffffff) 17:47:03 executing program 0: get_thread_area(&(0x7f0000000000)={0x7, 0x20000800, 0x4000, 0x0, 0x1, 0x0, 0x0, 0x1, 0x1, 0x1}) r0 = openat$vcsu(0xffffffffffffff9c, &(0x7f0000000040), 0x200000, 0x0) getsockopt$inet_tcp_TCP_REPAIR_WINDOW(r0, 0x6, 0x1d, &(0x7f0000000080), &(0x7f00000000c0)=0x14) r1 = openat$nvram(0xffffffffffffff9c, &(0x7f0000000100), 0x2000, 0x0) setsockopt$inet_tcp_TCP_FASTOPEN_KEY(r1, 0x6, 0x21, &(0x7f0000000140)="1bb9d563048b6ec78effc0f14d974b17", 0x10) ioctl$SNDRV_TIMER_IOCTL_STATUS32(r1, 0x80585414, &(0x7f00000001c0)) setsockopt$inet_tcp_TCP_QUEUE_SEQ(r0, 0x6, 0x15, &(0x7f0000000240)=0x1, 0x4) r2 = socket$inet_tcp(0x2, 0x1, 0x0) ioctl$sock_inet_tcp_SIOCINQ(r2, 0x541b, &(0x7f00000003c0)) move_pages(0x0, 0x8, &(0x7f0000000400)=[&(0x7f0000ffd000/0x1000)=nil, &(0x7f0000ffd000/0x3000)=nil, &(0x7f0000ffd000/0x3000)=nil, &(0x7f0000ffb000/0x2000)=nil, &(0x7f0000ffc000/0x1000)=nil, &(0x7f0000ffe000/0x2000)=nil, &(0x7f0000ffb000/0x4000)=nil, &(0x7f0000ffd000/0x3000)=nil], &(0x7f0000000440)=[0xfff], &(0x7f0000000480)=[0x0, 0x0, 0x0], 0x4) r3 = syz_genetlink_get_family_id$SEG6(&(0x7f0000000500), r1) sendmsg$SEG6_CMD_GET_TUNSRC(r0, &(0x7f00000005c0)={&(0x7f00000004c0)={0x10, 0x0, 0x0, 0x4000000}, 0xc, &(0x7f0000000580)={&(0x7f0000000540)={0x38, r3, 0x300, 0x70bd2a, 0x25dfdbfc, {}, [@SEG6_ATTR_HMACKEYID={0x8, 0x3, 0x24}, @SEG6_ATTR_DST={0x14, 0x1, @mcast1}, @SEG6_ATTR_DSTLEN={0x8, 0x2, 0x2}]}, 0x38}, 0x1, 0x0, 0x0, 0x20008810}, 0x4040010) sendmsg$SEG6_CMD_DUMPHMAC(0xffffffffffffffff, &(0x7f0000000740)={&(0x7f0000000680)={0x10, 0x0, 0x0, 0x240000}, 0xc, &(0x7f0000000700)={&(0x7f00000006c0)={0x2c, r3, 0x1, 0x70bd2c, 0x25dfdbfe, {}, [@SEG6_ATTR_SECRET={0x8, 0x4, [0x1]}, @SEG6_ATTR_DSTLEN={0x8, 0x2, 0x5}, @SEG6_ATTR_DSTLEN={0x8}]}, 0x2c}, 0x1, 0x0, 0x0, 0x4000000}, 0x4000000) pidfd_getfd(r1, r2, 0x0) syz_genetlink_get_family_id$ieee802154(&(0x7f0000000800), 0xffffffffffffffff) 17:47:13 executing program 6: get_thread_area(&(0x7f0000000000)={0x7, 0x20000800, 0x4000, 0x0, 0x1, 0x0, 0x0, 0x1, 0x1, 0x1}) r0 = openat$vcsu(0xffffffffffffff9c, &(0x7f0000000040), 0x200000, 0x0) getsockopt$inet_tcp_TCP_REPAIR_WINDOW(r0, 0x6, 0x1d, &(0x7f0000000080), &(0x7f00000000c0)=0x14) r1 = openat$nvram(0xffffffffffffff9c, &(0x7f0000000100), 0x2000, 0x0) setsockopt$inet_tcp_TCP_FASTOPEN_KEY(r1, 0x6, 0x21, &(0x7f0000000140)="1bb9d563048b6ec78effc0f14d974b17", 0x10) setsockopt$inet_tcp_int(r1, 0x6, 0x1b, &(0x7f0000000180)=0x5, 0x4) ioctl$SNDRV_TIMER_IOCTL_STATUS32(r1, 0x80585414, &(0x7f00000001c0)) r2 = socket$inet_tcp(0x2, 0x1, 0x0) ioctl$sock_inet_tcp_SIOCINQ(r2, 0x541b, &(0x7f00000003c0)) move_pages(0x0, 0x8, &(0x7f0000000400)=[&(0x7f0000ffd000/0x1000)=nil, &(0x7f0000ffd000/0x3000)=nil, &(0x7f0000ffd000/0x3000)=nil, &(0x7f0000ffb000/0x2000)=nil, &(0x7f0000ffc000/0x1000)=nil, &(0x7f0000ffe000/0x2000)=nil, &(0x7f0000ffb000/0x4000)=nil, &(0x7f0000ffd000/0x3000)=nil], &(0x7f0000000440)=[0xfff], &(0x7f0000000480)=[0x0, 0x0, 0x0], 0x4) syz_genetlink_get_family_id$ieee802154(&(0x7f0000000800), 0xffffffffffffffff) 17:47:13 executing program 5: pipe2$9p(0x0, 0x800) syz_io_uring_setup(0x776a, &(0x7f0000000280)={0x0, 0x2728, 0x2, 0x1, 0x37c}, &(0x7f0000000000/0x3000)=nil, &(0x7f0000000000/0x400000)=nil, &(0x7f0000000300), &(0x7f0000000340)) openat$nvram(0xffffffffffffff9c, &(0x7f0000000680), 0x400, 0x0) r0 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$ieee802154(&(0x7f0000000740), 0xffffffffffffffff) sendmsg$IEEE802154_LLSEC_DEL_KEY(r0, &(0x7f0000000840)={&(0x7f0000000700)={0x10, 0x0, 0x0, 0x800000}, 0xc, &(0x7f0000000800)={&(0x7f0000000780)={0x54, r1, 0x800, 0x70bd27, 0x25dfdbfc, {}, [@IEEE802154_ATTR_LLSEC_KEY_SOURCE_SHORT={0x8, 0x2c, 0x5}, @IEEE802154_ATTR_LLSEC_KEY_SOURCE_EXTENDED={0xc, 0x2d, {0xaaaaaaaaaaaa0002}}, @IEEE802154_ATTR_PAN_ID={0x6, 0x6, 0x2}, @IEEE802154_ATTR_DEV_INDEX={0x8}, @IEEE802154_ATTR_LLSEC_KEY_MODE={0x5, 0x2b, 0x1}, @IEEE802154_ATTR_HW_ADDR={0xc, 0x5, {0xaaaaaaaaaaaa0002}}, @IEEE802154_ATTR_LLSEC_KEY_MODE={0x5, 0x2b, 0x3}]}, 0x54}, 0x1, 0x0, 0x0, 0x40}, 0x2000c814) clock_getres(0x3, &(0x7f0000000880)) r2 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) sendmsg$IEEE802154_ADD_IFACE(r2, &(0x7f0000000a00)={&(0x7f0000000900)={0x10, 0x0, 0x0, 0x40c}, 0xc, &(0x7f00000009c0)={&(0x7f0000000940)={0x44, r1, 0x200, 0x70bd29, 0x25dfdbfe, {}, [@IEEE802154_ATTR_PHY_NAME={0x9, 0x1f, 'phy1\x00'}, @IEEE802154_ATTR_DEV_NAME={0xa, 0x1, 'wpan4\x00'}, @IEEE802154_ATTR_DEV_NAME={0xa, 0x1, 'wpan1\x00'}, @IEEE802154_ATTR_DEV_NAME={0xa, 0x1, 'wpan0\x00'}]}, 0x44}, 0x1, 0x0, 0x0, 0x20000084}, 0x44000) 17:47:13 executing program 3: clock_gettime(0x5, &(0x7f0000000000)) clock_settime(0x2, &(0x7f0000000040)) sched_rr_get_interval(0xffffffffffffffff, &(0x7f0000000080)) sched_rr_get_interval(0x0, &(0x7f00000000c0)) sendmsg$NL802154_CMD_GET_SEC_KEY(0xffffffffffffffff, &(0x7f00000001c0)={&(0x7f0000000100)={0x10, 0x0, 0x0, 0x20000000}, 0xc, &(0x7f0000000180)={&(0x7f0000000140)={0x24, 0x0, 0x200, 0x70bd26, 0x25dfdbfe, {}, [@NL802154_ATTR_IFINDEX={0x8}, @NL802154_ATTR_IFINDEX={0x8}]}, 0x24}, 0x1, 0x0, 0x0, 0x4000000}, 0x181) clock_gettime(0x0, &(0x7f0000000200)) pipe2$9p(&(0x7f0000000240)={0xffffffffffffffff, 0xffffffffffffffff}, 0x800) r1 = syz_io_uring_setup(0x776a, &(0x7f0000000280)={0x0, 0x2728, 0x2, 0x1, 0x37c}, &(0x7f0000000000/0x3000)=nil, &(0x7f0000000000/0x400000)=nil, &(0x7f0000000300), &(0x7f0000000340)) ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, &(0x7f0000000540)={0x64, 0x0, &(0x7f0000000440)=[@transaction_sg={0x40486311, {0x1, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x50, 0x18, &(0x7f0000000380)={@fd={0x66642a85, 0x0, r0}, @fd={0x66642a85, 0x0, r1}, @fda={0x66646185, 0x0, 0x2, 0x36}}, &(0x7f0000000400)={0x0, 0x18, 0x30}}}, @request_death, @release={0x40046306, 0x1}], 0x7e, 0x0, &(0x7f00000004c0)="7685c519d1cbea63a1a8f022f8c0085baf770aa5d1fa9bfb1a5399fdb134953d619e962218bba650b68d6206fde39ff17760aa4bbcb62f6802c48e17294a17a3b768ab60bbae37aa37e33e24b09f6bdea37853f7ab2622451803788c9d172b7d71d6d87911129b8ef5cc9e0169404b09abfa991f3a7a3640686df445d387"}) pipe2$9p(&(0x7f0000000580), 0x800) ioctl$EVIOCGVERSION(0xffffffffffffffff, 0x80044501, &(0x7f00000005c0)=""/174) r2 = syz_genetlink_get_family_id$ieee802154(&(0x7f0000000740), 0xffffffffffffffff) sendmsg$IEEE802154_LLSEC_DEL_KEY(0xffffffffffffffff, &(0x7f0000000840)={&(0x7f0000000700)={0x10, 0x0, 0x0, 0x800000}, 0xc, &(0x7f0000000800)={&(0x7f0000000780)={0x54, r2, 0x800, 0x70bd27, 0x25dfdbfc, {}, [@IEEE802154_ATTR_LLSEC_KEY_SOURCE_SHORT={0x8, 0x2c, 0x5}, @IEEE802154_ATTR_LLSEC_KEY_SOURCE_EXTENDED={0xc, 0x2d, {0xaaaaaaaaaaaa0002}}, @IEEE802154_ATTR_PAN_ID={0x6, 0x6, 0x2}, @IEEE802154_ATTR_DEV_INDEX={0x8}, @IEEE802154_ATTR_LLSEC_KEY_MODE={0x5, 0x2b, 0x1}, @IEEE802154_ATTR_HW_ADDR={0xc, 0x5, {0xaaaaaaaaaaaa0002}}, @IEEE802154_ATTR_LLSEC_KEY_MODE={0x5, 0x2b, 0x3}]}, 0x54}, 0x1, 0x0, 0x0, 0x40}, 0x2000c814) 17:47:13 executing program 0: get_thread_area(&(0x7f0000000000)={0x7, 0x20000800, 0x4000, 0x0, 0x1, 0x0, 0x0, 0x1, 0x1, 0x1}) r0 = openat$vcsu(0xffffffffffffff9c, &(0x7f0000000040), 0x200000, 0x0) getsockopt$inet_tcp_TCP_REPAIR_WINDOW(r0, 0x6, 0x1d, &(0x7f0000000080), &(0x7f00000000c0)=0x14) r1 = openat$nvram(0xffffffffffffff9c, &(0x7f0000000100), 0x2000, 0x0) setsockopt$inet_tcp_TCP_FASTOPEN_KEY(r1, 0x6, 0x21, &(0x7f0000000140)="1bb9d563048b6ec78effc0f14d974b17", 0x10) ioctl$SNDRV_TIMER_IOCTL_STATUS32(r1, 0x80585414, &(0x7f00000001c0)) setsockopt$inet_tcp_TCP_QUEUE_SEQ(r0, 0x6, 0x15, &(0x7f0000000240)=0x1, 0x4) r2 = socket$inet_tcp(0x2, 0x1, 0x0) ioctl$sock_inet_tcp_SIOCINQ(r2, 0x541b, &(0x7f00000003c0)) move_pages(0x0, 0x8, &(0x7f0000000400)=[&(0x7f0000ffd000/0x1000)=nil, &(0x7f0000ffd000/0x3000)=nil, &(0x7f0000ffd000/0x3000)=nil, &(0x7f0000ffb000/0x2000)=nil, &(0x7f0000ffc000/0x1000)=nil, &(0x7f0000ffe000/0x2000)=nil, &(0x7f0000ffb000/0x4000)=nil, &(0x7f0000ffd000/0x3000)=nil], &(0x7f0000000440)=[0xfff], &(0x7f0000000480)=[0x0, 0x0, 0x0], 0x4) r3 = syz_genetlink_get_family_id$SEG6(&(0x7f0000000500), r1) sendmsg$SEG6_CMD_GET_TUNSRC(r0, &(0x7f00000005c0)={&(0x7f00000004c0)={0x10, 0x0, 0x0, 0x4000000}, 0xc, &(0x7f0000000580)={&(0x7f0000000540)={0x38, r3, 0x300, 0x70bd2a, 0x25dfdbfc, {}, [@SEG6_ATTR_HMACKEYID={0x8, 0x3, 0x24}, @SEG6_ATTR_DST={0x14, 0x1, @mcast1}, @SEG6_ATTR_DSTLEN={0x8, 0x2, 0x2}]}, 0x38}, 0x1, 0x0, 0x0, 0x20008810}, 0x4040010) sendmsg$SEG6_CMD_DUMPHMAC(0xffffffffffffffff, &(0x7f0000000740)={&(0x7f0000000680)={0x10, 0x0, 0x0, 0x240000}, 0xc, &(0x7f0000000700)={&(0x7f00000006c0)={0x2c, r3, 0x1, 0x70bd2c, 0x25dfdbfe, {}, [@SEG6_ATTR_SECRET={0x8, 0x4, [0x1]}, @SEG6_ATTR_DSTLEN={0x8, 0x2, 0x5}, @SEG6_ATTR_DSTLEN={0x8}]}, 0x2c}, 0x1, 0x0, 0x0, 0x4000000}, 0x4000000) pidfd_getfd(r1, r2, 0x0) syz_genetlink_get_family_id$ieee802154(&(0x7f0000000800), 0xffffffffffffffff) 17:47:13 executing program 7: clock_gettime(0x5, &(0x7f0000000000)) clock_settime(0x2, &(0x7f0000000040)) sched_rr_get_interval(0xffffffffffffffff, &(0x7f0000000080)) sched_rr_get_interval(0x0, &(0x7f00000000c0)) sendmsg$NL802154_CMD_GET_SEC_KEY(0xffffffffffffffff, &(0x7f00000001c0)={&(0x7f0000000100)={0x10, 0x0, 0x0, 0x20000000}, 0xc, &(0x7f0000000180)={&(0x7f0000000140)={0x24, 0x0, 0x200, 0x70bd26, 0x25dfdbfe, {}, [@NL802154_ATTR_IFINDEX={0x8}, @NL802154_ATTR_IFINDEX={0x8}]}, 0x24}, 0x1, 0x0, 0x0, 0x4000000}, 0x181) clock_gettime(0x0, &(0x7f0000000200)) pipe2$9p(&(0x7f0000000240)={0xffffffffffffffff, 0xffffffffffffffff}, 0x800) r1 = syz_io_uring_setup(0x776a, &(0x7f0000000280)={0x0, 0x2728, 0x2, 0x1, 0x37c}, &(0x7f0000000000/0x3000)=nil, &(0x7f0000000000/0x400000)=nil, &(0x7f0000000300), &(0x7f0000000340)) ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, &(0x7f0000000540)={0x64, 0x0, &(0x7f0000000440)=[@transaction_sg={0x40486311, {0x1, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x50, 0x18, &(0x7f0000000380)={@fd={0x66642a85, 0x0, r0}, @fd={0x66642a85, 0x0, r1}, @fda={0x66646185, 0x0, 0x2, 0x36}}, &(0x7f0000000400)={0x0, 0x18, 0x30}}}, @request_death, @release={0x40046306, 0x1}], 0x7e, 0x0, &(0x7f00000004c0)="7685c519d1cbea63a1a8f022f8c0085baf770aa5d1fa9bfb1a5399fdb134953d619e962218bba650b68d6206fde39ff17760aa4bbcb62f6802c48e17294a17a3b768ab60bbae37aa37e33e24b09f6bdea37853f7ab2622451803788c9d172b7d71d6d87911129b8ef5cc9e0169404b09abfa991f3a7a3640686df445d387"}) pipe2$9p(&(0x7f0000000580), 0x800) ioctl$EVIOCGVERSION(0xffffffffffffffff, 0x80044501, &(0x7f00000005c0)=""/174) syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) clock_getres(0x3, &(0x7f0000000880)) 17:47:13 executing program 1: shmget$private(0x0, 0x4000, 0x80, &(0x7f0000ffb000/0x4000)=nil) shmget(0x3, 0x2000, 0x4, &(0x7f0000ffc000/0x2000)=nil) mlock(&(0x7f0000ff0000/0x10000)=nil, 0x10000) shmget(0x1, 0x1000, 0x10, &(0x7f0000ff5000/0x1000)=nil) ioctl$sock_ipv4_tunnel_SIOCGETTUNNEL(0xffffffffffffffff, 0x89f0, &(0x7f0000000140)={'syztnl1\x00', &(0x7f00000000c0)={'syztnl2\x00', 0x0, 0x20, 0x1, 0x6, 0x9, {{0xd, 0x4, 0x1, 0x19, 0x34, 0x68, 0x0, 0x9, 0x29, 0x0, @empty, @dev={0xac, 0x14, 0x14, 0x29}, {[@timestamp_addr={0x44, 0x14, 0xc2, 0x1, 0x4, [{@multicast1}, {@private=0xa010101}]}, @rr={0x7, 0xb, 0xc8, [@initdev={0xac, 0x1e, 0x1, 0x0}, @private=0xa010102]}]}}}}}) ioctl$sock_ipv4_tunnel_SIOCADDTUNNEL(0xffffffffffffffff, 0x89f1, &(0x7f0000000280)={'tunl0\x00', &(0x7f0000000180)={'tunl0\x00', r0, 0x7, 0x8000, 0xfffffffc, 0x8, {{0x2f, 0x4, 0x0, 0x2, 0xbc, 0x65, 0x0, 0x0, 0x4, 0x0, @empty, @broadcast, {[@generic={0x89, 0x9, "8db1d464c6af68"}, @noop, @ra={0x94, 0x4, 0x1}, @timestamp={0x44, 0x1c, 0x53, 0x0, 0x7, [0x40, 0x7fffffff, 0xfffffffd, 0x5, 0x5c, 0x77]}, @cipso={0x86, 0x2f, 0x3, [{0x1, 0x4, "1eba"}, {0x1, 0x7, "e3ccb5ddcf"}, {0x6, 0xa, "5db18b961780af33"}, {0x2, 0xe, "7353a9824b57fd7d39232ac5"}, {0x1, 0x6, "2e1ccd27"}]}, @noop, @cipso={0x86, 0x37, 0xffffffffffffffff, [{0x2, 0xf, "227467028cabd4e137b820c5c9"}, {0x7, 0x6, "90569992"}, {0x2, 0xc, "2071b0a8c9ce92782e72"}, {0x6, 0xa, "14f2b9bca55ce3dd"}, {0x6, 0x6, "2cd22a8f"}]}, @timestamp={0x44, 0x14, 0xd4, 0x0, 0x5, [0x81, 0x5d23, 0x63ab, 0x1]}]}}}}}) mmap$IORING_OFF_CQ_RING(&(0x7f0000ffd000/0x3000)=nil, 0x3000, 0x2000008, 0x30, 0xffffffffffffffff, 0x8000000) r1 = syz_genetlink_get_family_id$nl802154(&(0x7f0000000400), 0xffffffffffffffff) sendmsg$NL802154_CMD_NEW_INTERFACE(0xffffffffffffffff, &(0x7f0000000540)={&(0x7f00000003c0)={0x10, 0x0, 0x0, 0x2}, 0xc, &(0x7f0000000500)={&(0x7f0000000480)={0x48, r1, 0x200, 0x70bd2a, 0x25dfdbfd, {}, [@NL802154_ATTR_IFNAME={0xa, 0x4, 'wpan0\x00'}, @NL802154_ATTR_IFINDEX={0x8}, @NL802154_ATTR_IFNAME={0xa, 0x4, 'wpan1\x00'}, @NL802154_ATTR_EXTENDED_ADDR={0xc, 0x17, {0xaaaaaaaaaaaa0002}}, @NL802154_ATTR_IFINDEX={0x8}]}, 0x48}}, 0x4001) mmap$binder(&(0x7f0000fef000/0x11000)=nil, 0x11000, 0x1, 0x11, 0xffffffffffffffff, 0x6) r2 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) sendmsg$IEEE802154_LLSEC_ADD_SECLEVEL(r2, &(0x7f00000006c0)={&(0x7f0000000580)={0x10, 0x0, 0x0, 0x4000000}, 0xc, &(0x7f0000000680)={&(0x7f0000000600)={0x44, 0x0, 0x200, 0x70bd2a, 0x25dfdbff, {}, [@IEEE802154_ATTR_LLSEC_FRAME_TYPE={0x5, 0x33, 0x34}, @IEEE802154_ATTR_DEV_INDEX={0x8}, @IEEE802154_ATTR_LLSEC_CMD_FRAME_ID={0x5, 0x34, 0x1}, @IEEE802154_ATTR_DEV_NAME={0xa, 0x1, 'wpan0\x00'}, @IEEE802154_ATTR_DEV_NAME={0xa, 0x1, 'wpan4\x00'}]}, 0x44}, 0x1, 0x0, 0x0, 0x8800}, 0x0) sendmsg$IEEE802154_START_REQ(r2, &(0x7f00000007c0)={&(0x7f0000000700)={0x10, 0x0, 0x0, 0x4}, 0xc, &(0x7f0000000780)={&(0x7f0000000740)={0x1c, 0x0, 0x200, 0x70bd2d, 0x25dfdbfb, {}, [@IEEE802154_ATTR_CHANNEL={0x5, 0x7, 0x6}]}, 0x1c}, 0x1, 0x0, 0x0, 0x40100}, 0x801) mlock(&(0x7f0000fef000/0x1000)=nil, 0x1000) syz_io_uring_setup(0x4726, &(0x7f0000000840)={0x0, 0x502f, 0x20, 0x0, 0x12e}, &(0x7f0000ffe000/0x2000)=nil, &(0x7f0000ffb000/0x4000)=nil, &(0x7f00000008c0), &(0x7f0000000900)) 17:47:13 executing program 4: r0 = perf_event_open(&(0x7f00000000c0)={0x1, 0x80, 0x0, 0xc0, 0xfa, 0x1, 0x0, 0x7fffffff, 0x10811, 0x1, 0x1, 0x1, 0x1, 0x1, 0x1, 0x1, 0x1, 0x1, 0x0, 0x1, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x1, 0x0, 0x1, 0x0, 0x0, 0x0, 0x1, 0x1, 0x1, 0x1, 0x1, 0x1, 0x1, 0x0, 0x1, 0x1, 0x1, 0x1, 0x0, 0x0, 0xfff, 0x7, @perf_config_ext={0x7, 0x7fffffff}, 0x41000, 0x80000000, 0x5, 0x3, 0x9, 0x2, 0x9, 0x0, 0x5, 0x0, 0x4}, 0x0, 0xb, 0xffffffffffffffff, 0x1) perf_event_open(&(0x7f0000000040)={0x0, 0x80, 0x0, 0x40, 0x80, 0x9, 0x0, 0x3, 0x10040, 0x1, 0x0, 0x0, 0x1, 0x1, 0x1, 0x1, 0x1, 0x1, 0x1, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x3, 0x1, 0x0, 0x1, 0x0, 0x1, 0x1, 0x0, 0x0, 0x1, 0x1, 0x1, 0x0, 0x1, 0x0, 0x0, 0x0, 0x1, 0x0, 0x1, 0x0, 0x1, 0x0, 0x0, 0x1, @perf_bp={&(0x7f0000000000), 0x10}, 0x8080, 0x800, 0x2, 0x3, 0x36dc, 0x31df3b33, 0xff, 0x0, 0x9, 0x0, 0x5}, 0xffffffffffffffff, 0x9, r0, 0x9) ioctl$PERF_EVENT_IOC_PAUSE_OUTPUT(r0, 0x40042409, 0x0) ioctl$PERF_EVENT_IOC_PERIOD(0xffffffffffffffff, 0x40082404, &(0x7f0000000140)=0x8) r1 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl$sock_ipv4_tunnel_SIOCADDTUNNEL(r1, 0x89f1, &(0x7f00000001c0)={'syztnl1\x00', &(0x7f0000000180)={'syztnl0\x00', 0x0, 0x1, 0x40, 0x0, 0x5, {{0x5, 0x4, 0x2, 0x19, 0x14, 0x65, 0x0, 0x1f, 0x4, 0x0, @multicast2, @remote}}}}) ioctl$PERF_EVENT_IOC_PERIOD(r0, 0x40082404, &(0x7f0000000200)=0x9) ioctl$SNDRV_SEQ_IOCTL_GET_PORT_INFO(0xffffffffffffffff, 0xc0a85322, &(0x7f0000000240)) syz_open_procfs(0x0, &(0x7f0000000340)='children\x00') 17:47:13 executing program 2: syz_open_procfs(0x0, 0x0) 17:47:14 executing program 2: syz_open_procfs(0x0, 0x0) 17:47:14 executing program 6: get_thread_area(&(0x7f0000000000)={0x7, 0x20000800, 0x4000, 0x0, 0x1, 0x0, 0x0, 0x1, 0x1, 0x1}) r0 = openat$vcsu(0xffffffffffffff9c, &(0x7f0000000040), 0x200000, 0x0) getsockopt$inet_tcp_TCP_REPAIR_WINDOW(r0, 0x6, 0x1d, &(0x7f0000000080), &(0x7f00000000c0)=0x14) r1 = openat$nvram(0xffffffffffffff9c, &(0x7f0000000100), 0x2000, 0x0) setsockopt$inet_tcp_TCP_FASTOPEN_KEY(r1, 0x6, 0x21, &(0x7f0000000140)="1bb9d563048b6ec78effc0f14d974b17", 0x10) setsockopt$inet_tcp_int(r1, 0x6, 0x1b, &(0x7f0000000180)=0x5, 0x4) ioctl$SNDRV_TIMER_IOCTL_STATUS32(r1, 0x80585414, &(0x7f00000001c0)) r2 = socket$inet_tcp(0x2, 0x1, 0x0) ioctl$sock_inet_tcp_SIOCINQ(r2, 0x541b, &(0x7f00000003c0)) move_pages(0x0, 0x8, &(0x7f0000000400)=[&(0x7f0000ffd000/0x1000)=nil, &(0x7f0000ffd000/0x3000)=nil, &(0x7f0000ffd000/0x3000)=nil, &(0x7f0000ffb000/0x2000)=nil, &(0x7f0000ffc000/0x1000)=nil, &(0x7f0000ffe000/0x2000)=nil, &(0x7f0000ffb000/0x4000)=nil, &(0x7f0000ffd000/0x3000)=nil], &(0x7f0000000440)=[0xfff], &(0x7f0000000480)=[0x0, 0x0, 0x0], 0x4) syz_genetlink_get_family_id$ieee802154(&(0x7f0000000800), 0xffffffffffffffff) 17:47:14 executing program 1: shmget$private(0x0, 0x4000, 0x80, &(0x7f0000ffb000/0x4000)=nil) shmget(0x3, 0x2000, 0x4, &(0x7f0000ffc000/0x2000)=nil) mlock(&(0x7f0000ff0000/0x10000)=nil, 0x10000) shmget(0x1, 0x1000, 0x10, &(0x7f0000ff5000/0x1000)=nil) ioctl$sock_ipv4_tunnel_SIOCGETTUNNEL(0xffffffffffffffff, 0x89f0, &(0x7f0000000140)={'syztnl1\x00', &(0x7f00000000c0)={'syztnl2\x00', 0x0, 0x20, 0x1, 0x6, 0x9, {{0xd, 0x4, 0x1, 0x19, 0x34, 0x68, 0x0, 0x9, 0x29, 0x0, @empty, @dev={0xac, 0x14, 0x14, 0x29}, {[@timestamp_addr={0x44, 0x14, 0xc2, 0x1, 0x4, [{@multicast1}, {@private=0xa010101}]}, @rr={0x7, 0xb, 0xc8, [@initdev={0xac, 0x1e, 0x1, 0x0}, @private=0xa010102]}]}}}}}) ioctl$sock_ipv4_tunnel_SIOCDELTUNNEL(0xffffffffffffffff, 0x89f2, &(0x7f0000000380)={'gretap0\x00', &(0x7f00000002c0)={'syztnl2\x00', 0x0, 0x7800, 0x7, 0x40, 0xe180, {{0x22, 0x4, 0x0, 0x1, 0x88, 0x64, 0x0, 0x1, 0x29, 0x0, @multicast2, @multicast1, {[@end, @lsrr={0x83, 0x1f, 0x2f, [@multicast2, @local, @local, @multicast1, @rand_addr=0x64010102, @loopback, @private=0xa010100]}, @rr={0x7, 0x27, 0x6c, [@multicast1, @rand_addr=0x64010102, @remote, @multicast1, @loopback, @initdev={0xac, 0x1e, 0x0, 0x0}, @initdev={0xac, 0x1e, 0x1, 0x0}, @broadcast, @empty]}, @ra={0x94, 0x4, 0x1}, @timestamp={0x44, 0x10, 0x2d, 0x0, 0x8, [0x1, 0x100, 0x401]}, @ssrr={0x89, 0x13, 0x56, [@dev={0xac, 0x14, 0x14, 0x28}, @multicast2, @initdev={0xac, 0x1e, 0x0, 0x0}, @remote]}, @ra={0x94, 0x4, 0x1}]}}}}}) mmap$IORING_OFF_CQ_RING(&(0x7f0000ffd000/0x3000)=nil, 0x3000, 0x2000008, 0x30, 0xffffffffffffffff, 0x8000000) r0 = syz_genetlink_get_family_id$nl802154(&(0x7f0000000400), 0xffffffffffffffff) sendmsg$NL802154_CMD_NEW_INTERFACE(0xffffffffffffffff, &(0x7f0000000540)={&(0x7f00000003c0)={0x10, 0x0, 0x0, 0x2}, 0xc, &(0x7f0000000500)={&(0x7f0000000480)={0x48, r0, 0x200, 0x70bd2a, 0x25dfdbfd, {}, [@NL802154_ATTR_IFNAME={0xa, 0x4, 'wpan0\x00'}, @NL802154_ATTR_IFINDEX={0x8}, @NL802154_ATTR_IFNAME={0xa, 0x4, 'wpan1\x00'}, @NL802154_ATTR_EXTENDED_ADDR={0xc, 0x17, {0xaaaaaaaaaaaa0002}}, @NL802154_ATTR_IFINDEX={0x8}]}, 0x48}}, 0x4001) mmap$binder(&(0x7f0000fef000/0x11000)=nil, 0x11000, 0x1, 0x11, 0xffffffffffffffff, 0x6) r1 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) sendmsg$IEEE802154_LLSEC_ADD_SECLEVEL(r1, &(0x7f00000006c0)={&(0x7f0000000580)={0x10, 0x0, 0x0, 0x4000000}, 0xc, &(0x7f0000000680)={&(0x7f0000000600)={0x44, 0x0, 0x200, 0x70bd2a, 0x25dfdbff, {}, [@IEEE802154_ATTR_LLSEC_FRAME_TYPE={0x5, 0x33, 0x34}, @IEEE802154_ATTR_DEV_INDEX={0x8}, @IEEE802154_ATTR_LLSEC_CMD_FRAME_ID={0x5, 0x34, 0x1}, @IEEE802154_ATTR_DEV_NAME={0xa, 0x1, 'wpan0\x00'}, @IEEE802154_ATTR_DEV_NAME={0xa, 0x1, 'wpan4\x00'}]}, 0x44}, 0x1, 0x0, 0x0, 0x8800}, 0x0) sendmsg$IEEE802154_START_REQ(r1, &(0x7f00000007c0)={&(0x7f0000000700)={0x10, 0x0, 0x0, 0x4}, 0xc, &(0x7f0000000780)={&(0x7f0000000740)={0x1c, 0x0, 0x200, 0x70bd2d, 0x25dfdbfb, {}, [@IEEE802154_ATTR_CHANNEL={0x5, 0x7, 0x6}]}, 0x1c}, 0x1, 0x0, 0x0, 0x40100}, 0x801) mlock(&(0x7f0000fef000/0x1000)=nil, 0x1000) syz_io_uring_setup(0x4726, &(0x7f0000000840)={0x0, 0x502f, 0x20, 0x0, 0x12e}, &(0x7f0000ffe000/0x2000)=nil, &(0x7f0000ffb000/0x4000)=nil, &(0x7f00000008c0), &(0x7f0000000900)) 17:47:14 executing program 0: get_thread_area(&(0x7f0000000000)={0x7, 0x20000800, 0x4000, 0x0, 0x1, 0x0, 0x0, 0x1, 0x1, 0x1}) r0 = openat$vcsu(0xffffffffffffff9c, &(0x7f0000000040), 0x200000, 0x0) getsockopt$inet_tcp_TCP_REPAIR_WINDOW(r0, 0x6, 0x1d, &(0x7f0000000080), &(0x7f00000000c0)=0x14) r1 = openat$nvram(0xffffffffffffff9c, &(0x7f0000000100), 0x2000, 0x0) setsockopt$inet_tcp_int(r1, 0x6, 0x1b, &(0x7f0000000180)=0x5, 0x4) ioctl$SNDRV_TIMER_IOCTL_STATUS32(r1, 0x80585414, &(0x7f00000001c0)) setsockopt$inet_tcp_TCP_QUEUE_SEQ(r0, 0x6, 0x15, &(0x7f0000000240)=0x1, 0x4) r2 = socket$inet_tcp(0x2, 0x1, 0x0) ioctl$sock_inet_tcp_SIOCINQ(r2, 0x541b, &(0x7f00000003c0)) move_pages(0x0, 0x8, &(0x7f0000000400)=[&(0x7f0000ffd000/0x1000)=nil, &(0x7f0000ffd000/0x3000)=nil, &(0x7f0000ffd000/0x3000)=nil, &(0x7f0000ffb000/0x2000)=nil, &(0x7f0000ffc000/0x1000)=nil, &(0x7f0000ffe000/0x2000)=nil, &(0x7f0000ffb000/0x4000)=nil, &(0x7f0000ffd000/0x3000)=nil], &(0x7f0000000440)=[0xfff], &(0x7f0000000480)=[0x0, 0x0, 0x0], 0x4) r3 = syz_genetlink_get_family_id$SEG6(&(0x7f0000000500), r1) sendmsg$SEG6_CMD_GET_TUNSRC(r0, &(0x7f00000005c0)={&(0x7f00000004c0)={0x10, 0x0, 0x0, 0x4000000}, 0xc, &(0x7f0000000580)={&(0x7f0000000540)={0x38, r3, 0x300, 0x70bd2a, 0x25dfdbfc, {}, [@SEG6_ATTR_HMACKEYID={0x8, 0x3, 0x24}, @SEG6_ATTR_DST={0x14, 0x1, @mcast1}, @SEG6_ATTR_DSTLEN={0x8, 0x2, 0x2}]}, 0x38}, 0x1, 0x0, 0x0, 0x20008810}, 0x4040010) sendmsg$SEG6_CMD_DUMPHMAC(0xffffffffffffffff, &(0x7f0000000740)={&(0x7f0000000680)={0x10, 0x0, 0x0, 0x240000}, 0xc, &(0x7f0000000700)={&(0x7f00000006c0)={0x2c, r3, 0x1, 0x70bd2c, 0x25dfdbfe, {}, [@SEG6_ATTR_SECRET={0x8, 0x4, [0x1]}, @SEG6_ATTR_DSTLEN={0x8, 0x2, 0x5}, @SEG6_ATTR_DSTLEN={0x8}]}, 0x2c}, 0x1, 0x0, 0x0, 0x4000000}, 0x4000000) pidfd_getfd(r1, r2, 0x0) syz_genetlink_get_family_id$ieee802154(&(0x7f0000000800), 0xffffffffffffffff) 17:47:14 executing program 3: clock_gettime(0x5, &(0x7f0000000000)) clock_settime(0x2, &(0x7f0000000040)) sched_rr_get_interval(0xffffffffffffffff, &(0x7f0000000080)) sched_rr_get_interval(0x0, &(0x7f00000000c0)) sendmsg$NL802154_CMD_GET_SEC_KEY(0xffffffffffffffff, &(0x7f00000001c0)={&(0x7f0000000100)={0x10, 0x0, 0x0, 0x20000000}, 0xc, &(0x7f0000000180)={&(0x7f0000000140)={0x24, 0x0, 0x200, 0x70bd26, 0x25dfdbfe, {}, [@NL802154_ATTR_IFINDEX={0x8}, @NL802154_ATTR_IFINDEX={0x8}]}, 0x24}, 0x1, 0x0, 0x0, 0x4000000}, 0x181) clock_gettime(0x0, &(0x7f0000000200)) pipe2$9p(&(0x7f0000000240)={0xffffffffffffffff, 0xffffffffffffffff}, 0x800) r1 = syz_io_uring_setup(0x776a, &(0x7f0000000280)={0x0, 0x2728, 0x2, 0x1, 0x37c}, &(0x7f0000000000/0x3000)=nil, &(0x7f0000000000/0x400000)=nil, &(0x7f0000000300), &(0x7f0000000340)) ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, &(0x7f0000000540)={0x64, 0x0, &(0x7f0000000440)=[@transaction_sg={0x40486311, {0x1, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x50, 0x18, &(0x7f0000000380)={@fd={0x66642a85, 0x0, r0}, @fd={0x66642a85, 0x0, r1}, @fda={0x66646185, 0x0, 0x2, 0x36}}, &(0x7f0000000400)={0x0, 0x18, 0x30}}}, @request_death, @release={0x40046306, 0x1}], 0x7e, 0x0, &(0x7f00000004c0)="7685c519d1cbea63a1a8f022f8c0085baf770aa5d1fa9bfb1a5399fdb134953d619e962218bba650b68d6206fde39ff17760aa4bbcb62f6802c48e17294a17a3b768ab60bbae37aa37e33e24b09f6bdea37853f7ab2622451803788c9d172b7d71d6d87911129b8ef5cc9e0169404b09abfa991f3a7a3640686df445d387"}) pipe2$9p(&(0x7f0000000580), 0x800) ioctl$EVIOCGVERSION(0xffffffffffffffff, 0x80044501, &(0x7f00000005c0)=""/174) r2 = syz_genetlink_get_family_id$ieee802154(&(0x7f0000000740), 0xffffffffffffffff) sendmsg$IEEE802154_LLSEC_DEL_KEY(0xffffffffffffffff, &(0x7f0000000840)={&(0x7f0000000700)={0x10, 0x0, 0x0, 0x800000}, 0xc, &(0x7f0000000800)={&(0x7f0000000780)={0x54, r2, 0x800, 0x70bd27, 0x25dfdbfc, {}, [@IEEE802154_ATTR_LLSEC_KEY_SOURCE_SHORT={0x8, 0x2c, 0x5}, @IEEE802154_ATTR_LLSEC_KEY_SOURCE_EXTENDED={0xc, 0x2d, {0xaaaaaaaaaaaa0002}}, @IEEE802154_ATTR_PAN_ID={0x6, 0x6, 0x2}, @IEEE802154_ATTR_DEV_INDEX={0x8}, @IEEE802154_ATTR_LLSEC_KEY_MODE={0x5, 0x2b, 0x1}, @IEEE802154_ATTR_HW_ADDR={0xc, 0x5, {0xaaaaaaaaaaaa0002}}, @IEEE802154_ATTR_LLSEC_KEY_MODE={0x5, 0x2b, 0x3}]}, 0x54}, 0x1, 0x0, 0x0, 0x40}, 0x2000c814) 17:47:14 executing program 5: pipe2$9p(0x0, 0x800) syz_io_uring_setup(0x776a, &(0x7f0000000280)={0x0, 0x2728, 0x2, 0x1, 0x37c}, &(0x7f0000000000/0x3000)=nil, &(0x7f0000000000/0x400000)=nil, &(0x7f0000000300), &(0x7f0000000340)) openat$nvram(0xffffffffffffff9c, &(0x7f0000000680), 0x400, 0x0) r0 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$ieee802154(&(0x7f0000000740), 0xffffffffffffffff) sendmsg$IEEE802154_LLSEC_DEL_KEY(r0, &(0x7f0000000840)={&(0x7f0000000700)={0x10, 0x0, 0x0, 0x800000}, 0xc, &(0x7f0000000800)={&(0x7f0000000780)={0x54, r1, 0x800, 0x70bd27, 0x25dfdbfc, {}, [@IEEE802154_ATTR_LLSEC_KEY_SOURCE_SHORT={0x8, 0x2c, 0x5}, @IEEE802154_ATTR_LLSEC_KEY_SOURCE_EXTENDED={0xc, 0x2d, {0xaaaaaaaaaaaa0002}}, @IEEE802154_ATTR_PAN_ID={0x6, 0x6, 0x2}, @IEEE802154_ATTR_DEV_INDEX={0x8}, @IEEE802154_ATTR_LLSEC_KEY_MODE={0x5, 0x2b, 0x1}, @IEEE802154_ATTR_HW_ADDR={0xc, 0x5, {0xaaaaaaaaaaaa0002}}, @IEEE802154_ATTR_LLSEC_KEY_MODE={0x5, 0x2b, 0x3}]}, 0x54}, 0x1, 0x0, 0x0, 0x40}, 0x2000c814) clock_getres(0x3, &(0x7f0000000880)) r2 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) sendmsg$IEEE802154_ADD_IFACE(r2, &(0x7f0000000a00)={&(0x7f0000000900)={0x10, 0x0, 0x0, 0x40c}, 0xc, &(0x7f00000009c0)={&(0x7f0000000940)={0x44, r1, 0x200, 0x70bd29, 0x25dfdbfe, {}, [@IEEE802154_ATTR_PHY_NAME={0x9, 0x1f, 'phy1\x00'}, @IEEE802154_ATTR_DEV_NAME={0xa, 0x1, 'wpan4\x00'}, @IEEE802154_ATTR_DEV_NAME={0xa, 0x1, 'wpan1\x00'}, @IEEE802154_ATTR_DEV_NAME={0xa, 0x1, 'wpan0\x00'}]}, 0x44}, 0x1, 0x0, 0x0, 0x20000084}, 0x44000) 17:47:14 executing program 7: clock_gettime(0x5, &(0x7f0000000000)) clock_settime(0x2, &(0x7f0000000040)) sched_rr_get_interval(0xffffffffffffffff, &(0x7f0000000080)) sched_rr_get_interval(0x0, &(0x7f00000000c0)) sendmsg$NL802154_CMD_GET_SEC_KEY(0xffffffffffffffff, &(0x7f00000001c0)={&(0x7f0000000100)={0x10, 0x0, 0x0, 0x20000000}, 0xc, &(0x7f0000000180)={&(0x7f0000000140)={0x24, 0x0, 0x200, 0x70bd26, 0x25dfdbfe, {}, [@NL802154_ATTR_IFINDEX={0x8}, @NL802154_ATTR_IFINDEX={0x8}]}, 0x24}, 0x1, 0x0, 0x0, 0x4000000}, 0x181) clock_gettime(0x0, &(0x7f0000000200)) pipe2$9p(&(0x7f0000000240)={0xffffffffffffffff, 0xffffffffffffffff}, 0x800) r1 = syz_io_uring_setup(0x776a, &(0x7f0000000280)={0x0, 0x2728, 0x2, 0x1, 0x37c}, &(0x7f0000000000/0x3000)=nil, &(0x7f0000000000/0x400000)=nil, &(0x7f0000000300), &(0x7f0000000340)) ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, &(0x7f0000000540)={0x64, 0x0, &(0x7f0000000440)=[@transaction_sg={0x40486311, {0x1, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x50, 0x18, &(0x7f0000000380)={@fd={0x66642a85, 0x0, r0}, @fd={0x66642a85, 0x0, r1}, @fda={0x66646185, 0x0, 0x2, 0x36}}, &(0x7f0000000400)={0x0, 0x18, 0x30}}}, @request_death, @release={0x40046306, 0x1}], 0x7e, 0x0, &(0x7f00000004c0)="7685c519d1cbea63a1a8f022f8c0085baf770aa5d1fa9bfb1a5399fdb134953d619e962218bba650b68d6206fde39ff17760aa4bbcb62f6802c48e17294a17a3b768ab60bbae37aa37e33e24b09f6bdea37853f7ab2622451803788c9d172b7d71d6d87911129b8ef5cc9e0169404b09abfa991f3a7a3640686df445d387"}) pipe2$9p(&(0x7f0000000580), 0x800) ioctl$EVIOCGVERSION(0xffffffffffffffff, 0x80044501, &(0x7f00000005c0)=""/174) syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) clock_getres(0x3, &(0x7f0000000880)) 17:47:14 executing program 6: get_thread_area(&(0x7f0000000000)={0x7, 0x20000800, 0x4000, 0x0, 0x1, 0x0, 0x0, 0x1, 0x1, 0x1}) r0 = openat$vcsu(0xffffffffffffff9c, &(0x7f0000000040), 0x200000, 0x0) getsockopt$inet_tcp_TCP_REPAIR_WINDOW(r0, 0x6, 0x1d, &(0x7f0000000080), &(0x7f00000000c0)=0x14) r1 = openat$nvram(0xffffffffffffff9c, &(0x7f0000000100), 0x2000, 0x0) setsockopt$inet_tcp_TCP_FASTOPEN_KEY(r1, 0x6, 0x21, &(0x7f0000000140)="1bb9d563048b6ec78effc0f14d974b17", 0x10) setsockopt$inet_tcp_int(r1, 0x6, 0x1b, &(0x7f0000000180)=0x5, 0x4) ioctl$SNDRV_TIMER_IOCTL_STATUS32(r1, 0x80585414, &(0x7f00000001c0)) r2 = socket$inet_tcp(0x2, 0x1, 0x0) ioctl$sock_inet_tcp_SIOCINQ(r2, 0x541b, &(0x7f00000003c0)) move_pages(0x0, 0x8, &(0x7f0000000400)=[&(0x7f0000ffd000/0x1000)=nil, &(0x7f0000ffd000/0x3000)=nil, &(0x7f0000ffd000/0x3000)=nil, &(0x7f0000ffb000/0x2000)=nil, &(0x7f0000ffc000/0x1000)=nil, &(0x7f0000ffe000/0x2000)=nil, &(0x7f0000ffb000/0x4000)=nil, &(0x7f0000ffd000/0x3000)=nil], &(0x7f0000000440)=[0xfff], &(0x7f0000000480)=[0x0, 0x0, 0x0], 0x4) syz_genetlink_get_family_id$ieee802154(&(0x7f0000000800), 0xffffffffffffffff) 17:47:14 executing program 0: get_thread_area(&(0x7f0000000000)={0x7, 0x20000800, 0x4000, 0x0, 0x1, 0x0, 0x0, 0x1, 0x1, 0x1}) r0 = openat$vcsu(0xffffffffffffff9c, &(0x7f0000000040), 0x200000, 0x0) getsockopt$inet_tcp_TCP_REPAIR_WINDOW(r0, 0x6, 0x1d, &(0x7f0000000080), &(0x7f00000000c0)=0x14) r1 = openat$nvram(0xffffffffffffff9c, &(0x7f0000000100), 0x2000, 0x0) setsockopt$inet_tcp_int(r1, 0x6, 0x1b, &(0x7f0000000180)=0x5, 0x4) ioctl$SNDRV_TIMER_IOCTL_STATUS32(r1, 0x80585414, &(0x7f00000001c0)) setsockopt$inet_tcp_TCP_QUEUE_SEQ(r0, 0x6, 0x15, &(0x7f0000000240)=0x1, 0x4) r2 = socket$inet_tcp(0x2, 0x1, 0x0) ioctl$sock_inet_tcp_SIOCINQ(r2, 0x541b, &(0x7f00000003c0)) move_pages(0x0, 0x8, &(0x7f0000000400)=[&(0x7f0000ffd000/0x1000)=nil, &(0x7f0000ffd000/0x3000)=nil, &(0x7f0000ffd000/0x3000)=nil, &(0x7f0000ffb000/0x2000)=nil, &(0x7f0000ffc000/0x1000)=nil, &(0x7f0000ffe000/0x2000)=nil, &(0x7f0000ffb000/0x4000)=nil, &(0x7f0000ffd000/0x3000)=nil], &(0x7f0000000440)=[0xfff], &(0x7f0000000480)=[0x0, 0x0, 0x0], 0x4) r3 = syz_genetlink_get_family_id$SEG6(&(0x7f0000000500), r1) sendmsg$SEG6_CMD_GET_TUNSRC(r0, &(0x7f00000005c0)={&(0x7f00000004c0)={0x10, 0x0, 0x0, 0x4000000}, 0xc, &(0x7f0000000580)={&(0x7f0000000540)={0x38, r3, 0x300, 0x70bd2a, 0x25dfdbfc, {}, [@SEG6_ATTR_HMACKEYID={0x8, 0x3, 0x24}, @SEG6_ATTR_DST={0x14, 0x1, @mcast1}, @SEG6_ATTR_DSTLEN={0x8, 0x2, 0x2}]}, 0x38}, 0x1, 0x0, 0x0, 0x20008810}, 0x4040010) sendmsg$SEG6_CMD_DUMPHMAC(0xffffffffffffffff, &(0x7f0000000740)={&(0x7f0000000680)={0x10, 0x0, 0x0, 0x240000}, 0xc, &(0x7f0000000700)={&(0x7f00000006c0)={0x2c, r3, 0x1, 0x70bd2c, 0x25dfdbfe, {}, [@SEG6_ATTR_SECRET={0x8, 0x4, [0x1]}, @SEG6_ATTR_DSTLEN={0x8, 0x2, 0x5}, @SEG6_ATTR_DSTLEN={0x8}]}, 0x2c}, 0x1, 0x0, 0x0, 0x4000000}, 0x4000000) pidfd_getfd(r1, r2, 0x0) syz_genetlink_get_family_id$ieee802154(&(0x7f0000000800), 0xffffffffffffffff) 17:47:14 executing program 4: r0 = perf_event_open(&(0x7f00000000c0)={0x1, 0x80, 0x0, 0xc0, 0xfa, 0x1, 0x0, 0x7fffffff, 0x10811, 0x1, 0x1, 0x1, 0x1, 0x1, 0x1, 0x1, 0x1, 0x1, 0x0, 0x1, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x1, 0x0, 0x1, 0x0, 0x0, 0x0, 0x1, 0x1, 0x1, 0x1, 0x1, 0x1, 0x1, 0x0, 0x1, 0x1, 0x1, 0x1, 0x0, 0x0, 0xfff, 0x7, @perf_config_ext={0x7, 0x7fffffff}, 0x41000, 0x80000000, 0x5, 0x3, 0x9, 0x2, 0x9, 0x0, 0x5, 0x0, 0x4}, 0x0, 0xb, 0xffffffffffffffff, 0x1) perf_event_open(&(0x7f0000000040)={0x0, 0x80, 0x0, 0x40, 0x80, 0x9, 0x0, 0x3, 0x10040, 0x1, 0x0, 0x0, 0x1, 0x1, 0x1, 0x1, 0x1, 0x1, 0x1, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x3, 0x1, 0x0, 0x1, 0x0, 0x1, 0x1, 0x0, 0x0, 0x1, 0x1, 0x1, 0x0, 0x1, 0x0, 0x0, 0x0, 0x1, 0x0, 0x1, 0x0, 0x1, 0x0, 0x0, 0x1, @perf_bp={&(0x7f0000000000), 0x10}, 0x8080, 0x800, 0x2, 0x3, 0x36dc, 0x31df3b33, 0xff, 0x0, 0x9, 0x0, 0x5}, 0xffffffffffffffff, 0x9, r0, 0x9) ioctl$PERF_EVENT_IOC_PAUSE_OUTPUT(r0, 0x40042409, 0x0) ioctl$PERF_EVENT_IOC_PERIOD(0xffffffffffffffff, 0x40082404, &(0x7f0000000140)=0x8) r1 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl$sock_ipv4_tunnel_SIOCADDTUNNEL(r1, 0x89f1, &(0x7f00000001c0)={'syztnl1\x00', &(0x7f0000000180)={'syztnl0\x00', 0x0, 0x1, 0x40, 0x0, 0x5, {{0x5, 0x4, 0x2, 0x19, 0x14, 0x65, 0x0, 0x1f, 0x4, 0x0, @multicast2, @remote}}}}) ioctl$PERF_EVENT_IOC_PERIOD(r0, 0x40082404, &(0x7f0000000200)=0x9) ioctl$SNDRV_SEQ_IOCTL_SYSTEM_INFO(0xffffffffffffffff, 0xc0305302, &(0x7f0000000300)={0x9, 0x101, 0x1, 0x6, 0x3, 0x5}) syz_open_procfs(0x0, &(0x7f0000000340)='children\x00') 17:47:22 executing program 7: clock_gettime(0x5, &(0x7f0000000000)) clock_settime(0x2, &(0x7f0000000040)) sched_rr_get_interval(0xffffffffffffffff, &(0x7f0000000080)) sched_rr_get_interval(0x0, &(0x7f00000000c0)) sendmsg$NL802154_CMD_GET_SEC_KEY(0xffffffffffffffff, &(0x7f00000001c0)={&(0x7f0000000100)={0x10, 0x0, 0x0, 0x20000000}, 0xc, &(0x7f0000000180)={&(0x7f0000000140)={0x24, 0x0, 0x200, 0x70bd26, 0x25dfdbfe, {}, [@NL802154_ATTR_IFINDEX={0x8}, @NL802154_ATTR_IFINDEX={0x8}]}, 0x24}, 0x1, 0x0, 0x0, 0x4000000}, 0x181) clock_gettime(0x0, &(0x7f0000000200)) pipe2$9p(&(0x7f0000000240)={0xffffffffffffffff, 0xffffffffffffffff}, 0x800) r1 = syz_io_uring_setup(0x776a, &(0x7f0000000280)={0x0, 0x2728, 0x2, 0x1, 0x37c}, &(0x7f0000000000/0x3000)=nil, &(0x7f0000000000/0x400000)=nil, &(0x7f0000000300), &(0x7f0000000340)) ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, &(0x7f0000000540)={0x64, 0x0, &(0x7f0000000440)=[@transaction_sg={0x40486311, {0x1, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x50, 0x18, &(0x7f0000000380)={@fd={0x66642a85, 0x0, r0}, @fd={0x66642a85, 0x0, r1}, @fda={0x66646185, 0x0, 0x2, 0x36}}, &(0x7f0000000400)={0x0, 0x18, 0x30}}}, @request_death, @release={0x40046306, 0x1}], 0x7e, 0x0, &(0x7f00000004c0)="7685c519d1cbea63a1a8f022f8c0085baf770aa5d1fa9bfb1a5399fdb134953d619e962218bba650b68d6206fde39ff17760aa4bbcb62f6802c48e17294a17a3b768ab60bbae37aa37e33e24b09f6bdea37853f7ab2622451803788c9d172b7d71d6d87911129b8ef5cc9e0169404b09abfa991f3a7a3640686df445d387"}) pipe2$9p(&(0x7f0000000580), 0x800) ioctl$EVIOCGVERSION(0xffffffffffffffff, 0x80044501, &(0x7f00000005c0)=""/174) syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) clock_getres(0x3, &(0x7f0000000880)) 17:47:22 executing program 1: shmget$private(0x0, 0x4000, 0x80, &(0x7f0000ffb000/0x4000)=nil) shmget(0x3, 0x2000, 0x4, &(0x7f0000ffc000/0x2000)=nil) mlock(&(0x7f0000ff0000/0x10000)=nil, 0x10000) shmget(0x1, 0x1000, 0x10, &(0x7f0000ff5000/0x1000)=nil) ioctl$sock_ipv4_tunnel_SIOCGETTUNNEL(0xffffffffffffffff, 0x89f0, &(0x7f0000000140)={'syztnl1\x00', &(0x7f00000000c0)={'syztnl2\x00', 0x0, 0x20, 0x1, 0x6, 0x9, {{0xd, 0x4, 0x1, 0x19, 0x34, 0x68, 0x0, 0x9, 0x29, 0x0, @empty, @dev={0xac, 0x14, 0x14, 0x29}, {[@timestamp_addr={0x44, 0x14, 0xc2, 0x1, 0x4, [{@multicast1}, {@private=0xa010101}]}, @rr={0x7, 0xb, 0xc8, [@initdev={0xac, 0x1e, 0x1, 0x0}, @private=0xa010102]}]}}}}}) ioctl$sock_ipv4_tunnel_SIOCDELTUNNEL(0xffffffffffffffff, 0x89f2, &(0x7f0000000380)={'gretap0\x00', &(0x7f00000002c0)={'syztnl2\x00', 0x0, 0x7800, 0x7, 0x40, 0xe180, {{0x22, 0x4, 0x0, 0x1, 0x88, 0x64, 0x0, 0x1, 0x29, 0x0, @multicast2, @multicast1, {[@end, @lsrr={0x83, 0x1f, 0x2f, [@multicast2, @local, @local, @multicast1, @rand_addr=0x64010102, @loopback, @private=0xa010100]}, @rr={0x7, 0x27, 0x6c, [@multicast1, @rand_addr=0x64010102, @remote, @multicast1, @loopback, @initdev={0xac, 0x1e, 0x0, 0x0}, @initdev={0xac, 0x1e, 0x1, 0x0}, @broadcast, @empty]}, @ra={0x94, 0x4, 0x1}, @timestamp={0x44, 0x10, 0x2d, 0x0, 0x8, [0x1, 0x100, 0x401]}, @ssrr={0x89, 0x13, 0x56, [@dev={0xac, 0x14, 0x14, 0x28}, @multicast2, @initdev={0xac, 0x1e, 0x0, 0x0}, @remote]}, @ra={0x94, 0x4, 0x1}]}}}}}) mmap$IORING_OFF_CQ_RING(&(0x7f0000ffd000/0x3000)=nil, 0x3000, 0x2000008, 0x30, 0xffffffffffffffff, 0x8000000) r0 = syz_genetlink_get_family_id$nl802154(&(0x7f0000000400), 0xffffffffffffffff) sendmsg$NL802154_CMD_NEW_INTERFACE(0xffffffffffffffff, &(0x7f0000000540)={&(0x7f00000003c0)={0x10, 0x0, 0x0, 0x2}, 0xc, &(0x7f0000000500)={&(0x7f0000000480)={0x48, r0, 0x200, 0x70bd2a, 0x25dfdbfd, {}, [@NL802154_ATTR_IFNAME={0xa, 0x4, 'wpan0\x00'}, @NL802154_ATTR_IFINDEX={0x8}, @NL802154_ATTR_IFNAME={0xa, 0x4, 'wpan1\x00'}, @NL802154_ATTR_EXTENDED_ADDR={0xc, 0x17, {0xaaaaaaaaaaaa0002}}, @NL802154_ATTR_IFINDEX={0x8}]}, 0x48}}, 0x4001) mmap$binder(&(0x7f0000fef000/0x11000)=nil, 0x11000, 0x1, 0x11, 0xffffffffffffffff, 0x6) r1 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) sendmsg$IEEE802154_LLSEC_ADD_SECLEVEL(r1, &(0x7f00000006c0)={&(0x7f0000000580)={0x10, 0x0, 0x0, 0x4000000}, 0xc, &(0x7f0000000680)={&(0x7f0000000600)={0x44, 0x0, 0x200, 0x70bd2a, 0x25dfdbff, {}, [@IEEE802154_ATTR_LLSEC_FRAME_TYPE={0x5, 0x33, 0x34}, @IEEE802154_ATTR_DEV_INDEX={0x8}, @IEEE802154_ATTR_LLSEC_CMD_FRAME_ID={0x5, 0x34, 0x1}, @IEEE802154_ATTR_DEV_NAME={0xa, 0x1, 'wpan0\x00'}, @IEEE802154_ATTR_DEV_NAME={0xa, 0x1, 'wpan4\x00'}]}, 0x44}, 0x1, 0x0, 0x0, 0x8800}, 0x0) sendmsg$IEEE802154_START_REQ(r1, &(0x7f00000007c0)={&(0x7f0000000700)={0x10, 0x0, 0x0, 0x4}, 0xc, &(0x7f0000000780)={&(0x7f0000000740)={0x1c, 0x0, 0x200, 0x70bd2d, 0x25dfdbfb, {}, [@IEEE802154_ATTR_CHANNEL={0x5, 0x7, 0x6}]}, 0x1c}, 0x1, 0x0, 0x0, 0x40100}, 0x801) mlock(&(0x7f0000fef000/0x1000)=nil, 0x1000) syz_io_uring_setup(0x4726, &(0x7f0000000840)={0x0, 0x502f, 0x20, 0x0, 0x12e}, &(0x7f0000ffe000/0x2000)=nil, &(0x7f0000ffb000/0x4000)=nil, &(0x7f00000008c0), &(0x7f0000000900)) 17:47:22 executing program 2: clock_gettime(0x5, &(0x7f0000000000)) clock_settime(0x2, &(0x7f0000000040)) sched_rr_get_interval(0xffffffffffffffff, &(0x7f0000000080)) sched_rr_get_interval(0x0, &(0x7f00000000c0)) sendmsg$NL802154_CMD_GET_SEC_KEY(0xffffffffffffffff, &(0x7f00000001c0)={&(0x7f0000000100)={0x10, 0x0, 0x0, 0x20000000}, 0xc, &(0x7f0000000180)={&(0x7f0000000140)={0x24, 0x0, 0x200, 0x70bd26, 0x25dfdbfe, {}, [@NL802154_ATTR_IFINDEX={0x8}, @NL802154_ATTR_IFINDEX={0x8}]}, 0x24}, 0x1, 0x0, 0x0, 0x4000000}, 0x181) clock_gettime(0x0, &(0x7f0000000200)) pipe2$9p(&(0x7f0000000240)={0xffffffffffffffff, 0xffffffffffffffff}, 0x800) r1 = syz_io_uring_setup(0x776a, &(0x7f0000000280)={0x0, 0x2728, 0x2, 0x1, 0x37c}, &(0x7f0000000000/0x3000)=nil, &(0x7f0000000000/0x400000)=nil, &(0x7f0000000300), &(0x7f0000000340)) ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, &(0x7f0000000540)={0x64, 0x0, &(0x7f0000000440)=[@transaction_sg={0x40486311, {0x1, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x50, 0x18, &(0x7f0000000380)={@fd={0x66642a85, 0x0, r0}, @fd={0x66642a85, 0x0, r1}, @fda={0x66646185, 0x0, 0x2, 0x36}}, &(0x7f0000000400)={0x0, 0x18, 0x30}}}, @request_death, @release={0x40046306, 0x1}], 0x7e, 0x0, &(0x7f00000004c0)="7685c519d1cbea63a1a8f022f8c0085baf770aa5d1fa9bfb1a5399fdb134953d619e962218bba650b68d6206fde39ff17760aa4bbcb62f6802c48e17294a17a3b768ab60bbae37aa37e33e24b09f6bdea37853f7ab2622451803788c9d172b7d71d6d87911129b8ef5cc9e0169404b09abfa991f3a7a3640686df445d387"}) pipe2$9p(&(0x7f0000000580), 0x800) ioctl$EVIOCGVERSION(0xffffffffffffffff, 0x80044501, &(0x7f00000005c0)=""/174) syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) clock_getres(0x3, &(0x7f0000000880)) 17:47:22 executing program 4: r0 = perf_event_open(&(0x7f00000000c0)={0x1, 0x80, 0x0, 0xc0, 0xfa, 0x1, 0x0, 0x7fffffff, 0x10811, 0x1, 0x1, 0x1, 0x1, 0x1, 0x1, 0x1, 0x1, 0x1, 0x0, 0x1, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x1, 0x0, 0x1, 0x0, 0x0, 0x0, 0x1, 0x1, 0x1, 0x1, 0x1, 0x1, 0x1, 0x0, 0x1, 0x1, 0x1, 0x1, 0x0, 0x0, 0xfff, 0x7, @perf_config_ext={0x7, 0x7fffffff}, 0x41000, 0x80000000, 0x5, 0x3, 0x9, 0x2, 0x9, 0x0, 0x5, 0x0, 0x4}, 0x0, 0xb, 0xffffffffffffffff, 0x1) perf_event_open(&(0x7f0000000040)={0x0, 0x80, 0x0, 0x40, 0x80, 0x9, 0x0, 0x3, 0x10040, 0x1, 0x0, 0x0, 0x1, 0x1, 0x1, 0x1, 0x1, 0x1, 0x1, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x3, 0x1, 0x0, 0x1, 0x0, 0x1, 0x1, 0x0, 0x0, 0x1, 0x1, 0x1, 0x0, 0x1, 0x0, 0x0, 0x0, 0x1, 0x0, 0x1, 0x0, 0x1, 0x0, 0x0, 0x1, @perf_bp={&(0x7f0000000000), 0x10}, 0x8080, 0x800, 0x2, 0x3, 0x36dc, 0x31df3b33, 0xff, 0x0, 0x9, 0x0, 0x5}, 0xffffffffffffffff, 0x9, r0, 0x9) ioctl$PERF_EVENT_IOC_PAUSE_OUTPUT(r0, 0x40042409, 0x0) ioctl$PERF_EVENT_IOC_PERIOD(0xffffffffffffffff, 0x40082404, &(0x7f0000000140)=0x8) r1 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl$sock_ipv4_tunnel_SIOCADDTUNNEL(r1, 0x89f1, &(0x7f00000001c0)={'syztnl1\x00', &(0x7f0000000180)={'syztnl0\x00', 0x0, 0x1, 0x40, 0x0, 0x5, {{0x5, 0x4, 0x2, 0x19, 0x14, 0x65, 0x0, 0x1f, 0x4, 0x0, @multicast2, @remote}}}}) ioctl$SNDRV_SEQ_IOCTL_SYSTEM_INFO(0xffffffffffffffff, 0xc0305302, &(0x7f0000000300)={0x9, 0x101, 0x1, 0x6, 0x3, 0x5}) syz_open_procfs(0x0, &(0x7f0000000340)='children\x00') 17:47:22 executing program 6: get_thread_area(&(0x7f0000000000)={0x7, 0x20000800, 0x4000, 0x0, 0x1, 0x0, 0x0, 0x1, 0x1, 0x1}) r0 = openat$vcsu(0xffffffffffffff9c, &(0x7f0000000040), 0x200000, 0x0) getsockopt$inet_tcp_TCP_REPAIR_WINDOW(r0, 0x6, 0x1d, &(0x7f0000000080), &(0x7f00000000c0)=0x14) r1 = openat$nvram(0xffffffffffffff9c, &(0x7f0000000100), 0x2000, 0x0) setsockopt$inet_tcp_TCP_FASTOPEN_KEY(r1, 0x6, 0x21, &(0x7f0000000140)="1bb9d563048b6ec78effc0f14d974b17", 0x10) setsockopt$inet_tcp_int(r1, 0x6, 0x1b, &(0x7f0000000180)=0x5, 0x4) ioctl$SNDRV_TIMER_IOCTL_STATUS32(r1, 0x80585414, &(0x7f00000001c0)) r2 = socket$inet_tcp(0x2, 0x1, 0x0) ioctl$sock_inet_tcp_SIOCINQ(r2, 0x541b, &(0x7f00000003c0)) syz_genetlink_get_family_id$SEG6(&(0x7f0000000500), r1) syz_genetlink_get_family_id$ieee802154(&(0x7f0000000800), 0xffffffffffffffff) 17:47:22 executing program 3: clock_gettime(0x5, &(0x7f0000000000)) clock_settime(0x2, &(0x7f0000000040)) sched_rr_get_interval(0xffffffffffffffff, &(0x7f0000000080)) sched_rr_get_interval(0x0, &(0x7f00000000c0)) sendmsg$NL802154_CMD_GET_SEC_KEY(0xffffffffffffffff, &(0x7f00000001c0)={&(0x7f0000000100)={0x10, 0x0, 0x0, 0x20000000}, 0xc, &(0x7f0000000180)={&(0x7f0000000140)={0x24, 0x0, 0x200, 0x70bd26, 0x25dfdbfe, {}, [@NL802154_ATTR_IFINDEX={0x8}, @NL802154_ATTR_IFINDEX={0x8}]}, 0x24}, 0x1, 0x0, 0x0, 0x4000000}, 0x181) clock_gettime(0x0, &(0x7f0000000200)) pipe2$9p(&(0x7f0000000240)={0xffffffffffffffff, 0xffffffffffffffff}, 0x800) r1 = syz_io_uring_setup(0x776a, &(0x7f0000000280)={0x0, 0x2728, 0x2, 0x1, 0x37c}, &(0x7f0000000000/0x3000)=nil, &(0x7f0000000000/0x400000)=nil, &(0x7f0000000300), &(0x7f0000000340)) ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, &(0x7f0000000540)={0x64, 0x0, &(0x7f0000000440)=[@transaction_sg={0x40486311, {0x1, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x50, 0x18, &(0x7f0000000380)={@fd={0x66642a85, 0x0, r0}, @fd={0x66642a85, 0x0, r1}, @fda={0x66646185, 0x0, 0x2, 0x36}}, &(0x7f0000000400)={0x0, 0x18, 0x30}}}, @request_death, @release={0x40046306, 0x1}], 0x7e, 0x0, &(0x7f00000004c0)="7685c519d1cbea63a1a8f022f8c0085baf770aa5d1fa9bfb1a5399fdb134953d619e962218bba650b68d6206fde39ff17760aa4bbcb62f6802c48e17294a17a3b768ab60bbae37aa37e33e24b09f6bdea37853f7ab2622451803788c9d172b7d71d6d87911129b8ef5cc9e0169404b09abfa991f3a7a3640686df445d387"}) pipe2$9p(&(0x7f0000000580), 0x800) ioctl$EVIOCGVERSION(0xffffffffffffffff, 0x80044501, &(0x7f00000005c0)=""/174) r2 = syz_genetlink_get_family_id$ieee802154(&(0x7f0000000740), 0xffffffffffffffff) sendmsg$IEEE802154_LLSEC_DEL_KEY(0xffffffffffffffff, &(0x7f0000000840)={&(0x7f0000000700)={0x10, 0x0, 0x0, 0x800000}, 0xc, &(0x7f0000000800)={&(0x7f0000000780)={0x54, r2, 0x800, 0x70bd27, 0x25dfdbfc, {}, [@IEEE802154_ATTR_LLSEC_KEY_SOURCE_SHORT={0x8, 0x2c, 0x5}, @IEEE802154_ATTR_LLSEC_KEY_SOURCE_EXTENDED={0xc, 0x2d, {0xaaaaaaaaaaaa0002}}, @IEEE802154_ATTR_PAN_ID={0x6, 0x6, 0x2}, @IEEE802154_ATTR_DEV_INDEX={0x8}, @IEEE802154_ATTR_LLSEC_KEY_MODE={0x5, 0x2b, 0x1}, @IEEE802154_ATTR_HW_ADDR={0xc, 0x5, {0xaaaaaaaaaaaa0002}}, @IEEE802154_ATTR_LLSEC_KEY_MODE={0x5, 0x2b, 0x3}]}, 0x54}, 0x1, 0x0, 0x0, 0x40}, 0x2000c814) 17:47:22 executing program 5: pipe2$9p(0x0, 0x800) syz_io_uring_setup(0x776a, &(0x7f0000000280)={0x0, 0x2728, 0x2, 0x1, 0x37c}, &(0x7f0000000000/0x3000)=nil, &(0x7f0000000000/0x400000)=nil, &(0x7f0000000300), &(0x7f0000000340)) openat$nvram(0xffffffffffffff9c, &(0x7f0000000680), 0x400, 0x0) r0 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$ieee802154(&(0x7f0000000740), 0xffffffffffffffff) sendmsg$IEEE802154_LLSEC_DEL_KEY(r0, &(0x7f0000000840)={&(0x7f0000000700)={0x10, 0x0, 0x0, 0x800000}, 0xc, &(0x7f0000000800)={&(0x7f0000000780)={0x54, r1, 0x800, 0x70bd27, 0x25dfdbfc, {}, [@IEEE802154_ATTR_LLSEC_KEY_SOURCE_SHORT={0x8, 0x2c, 0x5}, @IEEE802154_ATTR_LLSEC_KEY_SOURCE_EXTENDED={0xc, 0x2d, {0xaaaaaaaaaaaa0002}}, @IEEE802154_ATTR_PAN_ID={0x6, 0x6, 0x2}, @IEEE802154_ATTR_DEV_INDEX={0x8}, @IEEE802154_ATTR_LLSEC_KEY_MODE={0x5, 0x2b, 0x1}, @IEEE802154_ATTR_HW_ADDR={0xc, 0x5, {0xaaaaaaaaaaaa0002}}, @IEEE802154_ATTR_LLSEC_KEY_MODE={0x5, 0x2b, 0x3}]}, 0x54}, 0x1, 0x0, 0x0, 0x40}, 0x2000c814) clock_getres(0x3, &(0x7f0000000880)) r2 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) sendmsg$IEEE802154_ADD_IFACE(r2, &(0x7f0000000a00)={&(0x7f0000000900)={0x10, 0x0, 0x0, 0x40c}, 0xc, &(0x7f00000009c0)={&(0x7f0000000940)={0x44, r1, 0x200, 0x70bd29, 0x25dfdbfe, {}, [@IEEE802154_ATTR_PHY_NAME={0x9, 0x1f, 'phy1\x00'}, @IEEE802154_ATTR_DEV_NAME={0xa, 0x1, 'wpan4\x00'}, @IEEE802154_ATTR_DEV_NAME={0xa, 0x1, 'wpan1\x00'}, @IEEE802154_ATTR_DEV_NAME={0xa, 0x1, 'wpan0\x00'}]}, 0x44}, 0x1, 0x0, 0x0, 0x20000084}, 0x44000) 17:47:22 executing program 0: get_thread_area(&(0x7f0000000000)={0x7, 0x20000800, 0x4000, 0x0, 0x1, 0x0, 0x0, 0x1, 0x1, 0x1}) r0 = openat$vcsu(0xffffffffffffff9c, &(0x7f0000000040), 0x200000, 0x0) getsockopt$inet_tcp_TCP_REPAIR_WINDOW(r0, 0x6, 0x1d, &(0x7f0000000080), &(0x7f00000000c0)=0x14) setsockopt$inet_tcp_int(0xffffffffffffffff, 0x6, 0x1b, &(0x7f0000000180)=0x5, 0x4) ioctl$SNDRV_TIMER_IOCTL_STATUS32(0xffffffffffffffff, 0x80585414, &(0x7f00000001c0)) setsockopt$inet_tcp_TCP_QUEUE_SEQ(r0, 0x6, 0x15, &(0x7f0000000240)=0x1, 0x4) r1 = socket$inet_tcp(0x2, 0x1, 0x0) ioctl$sock_inet_tcp_SIOCINQ(r1, 0x541b, &(0x7f00000003c0)) move_pages(0x0, 0x8, &(0x7f0000000400)=[&(0x7f0000ffd000/0x1000)=nil, &(0x7f0000ffd000/0x3000)=nil, &(0x7f0000ffd000/0x3000)=nil, &(0x7f0000ffb000/0x2000)=nil, &(0x7f0000ffc000/0x1000)=nil, &(0x7f0000ffe000/0x2000)=nil, &(0x7f0000ffb000/0x4000)=nil, &(0x7f0000ffd000/0x3000)=nil], &(0x7f0000000440)=[0xfff], &(0x7f0000000480)=[0x0, 0x0, 0x0], 0x4) r2 = syz_genetlink_get_family_id$SEG6(&(0x7f0000000500), 0xffffffffffffffff) sendmsg$SEG6_CMD_GET_TUNSRC(r0, &(0x7f00000005c0)={&(0x7f00000004c0)={0x10, 0x0, 0x0, 0x4000000}, 0xc, &(0x7f0000000580)={&(0x7f0000000540)={0x38, r2, 0x300, 0x70bd2a, 0x25dfdbfc, {}, [@SEG6_ATTR_HMACKEYID={0x8, 0x3, 0x24}, @SEG6_ATTR_DST={0x14, 0x1, @mcast1}, @SEG6_ATTR_DSTLEN={0x8, 0x2, 0x2}]}, 0x38}, 0x1, 0x0, 0x0, 0x20008810}, 0x4040010) sendmsg$SEG6_CMD_DUMPHMAC(0xffffffffffffffff, &(0x7f0000000740)={&(0x7f0000000680)={0x10, 0x0, 0x0, 0x240000}, 0xc, &(0x7f0000000700)={&(0x7f00000006c0)={0x2c, r2, 0x1, 0x70bd2c, 0x25dfdbfe, {}, [@SEG6_ATTR_SECRET={0x8, 0x4, [0x1]}, @SEG6_ATTR_DSTLEN={0x8, 0x2, 0x5}, @SEG6_ATTR_DSTLEN={0x8}]}, 0x2c}, 0x1, 0x0, 0x0, 0x4000000}, 0x4000000) pidfd_getfd(0xffffffffffffffff, r1, 0x0) syz_genetlink_get_family_id$ieee802154(&(0x7f0000000800), 0xffffffffffffffff) 17:47:22 executing program 7: clock_gettime(0x5, &(0x7f0000000000)) clock_settime(0x2, &(0x7f0000000040)) sched_rr_get_interval(0xffffffffffffffff, &(0x7f0000000080)) sched_rr_get_interval(0x0, &(0x7f00000000c0)) sendmsg$NL802154_CMD_GET_SEC_KEY(0xffffffffffffffff, &(0x7f00000001c0)={&(0x7f0000000100)={0x10, 0x0, 0x0, 0x20000000}, 0xc, &(0x7f0000000180)={&(0x7f0000000140)={0x24, 0x0, 0x200, 0x70bd26, 0x25dfdbfe, {}, [@NL802154_ATTR_IFINDEX={0x8}, @NL802154_ATTR_IFINDEX={0x8}]}, 0x24}, 0x1, 0x0, 0x0, 0x4000000}, 0x181) clock_gettime(0x0, &(0x7f0000000200)) pipe2$9p(&(0x7f0000000240)={0xffffffffffffffff, 0xffffffffffffffff}, 0x800) r1 = syz_io_uring_setup(0x776a, &(0x7f0000000280)={0x0, 0x2728, 0x2, 0x1, 0x37c}, &(0x7f0000000000/0x3000)=nil, &(0x7f0000000000/0x400000)=nil, &(0x7f0000000300), &(0x7f0000000340)) ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, &(0x7f0000000540)={0x64, 0x0, &(0x7f0000000440)=[@transaction_sg={0x40486311, {0x1, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x50, 0x18, &(0x7f0000000380)={@fd={0x66642a85, 0x0, r0}, @fd={0x66642a85, 0x0, r1}, @fda={0x66646185, 0x0, 0x2, 0x36}}, &(0x7f0000000400)={0x0, 0x18, 0x30}}}, @request_death, @release={0x40046306, 0x1}], 0x7e, 0x0, &(0x7f00000004c0)="7685c519d1cbea63a1a8f022f8c0085baf770aa5d1fa9bfb1a5399fdb134953d619e962218bba650b68d6206fde39ff17760aa4bbcb62f6802c48e17294a17a3b768ab60bbae37aa37e33e24b09f6bdea37853f7ab2622451803788c9d172b7d71d6d87911129b8ef5cc9e0169404b09abfa991f3a7a3640686df445d387"}) pipe2$9p(&(0x7f0000000580), 0x800) ioctl$EVIOCGVERSION(0xffffffffffffffff, 0x80044501, &(0x7f00000005c0)=""/174) clock_getres(0x3, &(0x7f0000000880)) 17:47:22 executing program 6: get_thread_area(&(0x7f0000000000)={0x7, 0x20000800, 0x4000, 0x0, 0x1, 0x0, 0x0, 0x1, 0x1, 0x1}) r0 = openat$vcsu(0xffffffffffffff9c, &(0x7f0000000040), 0x200000, 0x0) getsockopt$inet_tcp_TCP_REPAIR_WINDOW(r0, 0x6, 0x1d, &(0x7f0000000080), &(0x7f00000000c0)=0x14) r1 = openat$nvram(0xffffffffffffff9c, &(0x7f0000000100), 0x2000, 0x0) setsockopt$inet_tcp_TCP_FASTOPEN_KEY(r1, 0x6, 0x21, &(0x7f0000000140)="1bb9d563048b6ec78effc0f14d974b17", 0x10) setsockopt$inet_tcp_int(r1, 0x6, 0x1b, &(0x7f0000000180)=0x5, 0x4) ioctl$SNDRV_TIMER_IOCTL_STATUS32(r1, 0x80585414, &(0x7f00000001c0)) socket$inet_tcp(0x2, 0x1, 0x0) syz_genetlink_get_family_id$SEG6(&(0x7f0000000500), r1) syz_genetlink_get_family_id$ieee802154(&(0x7f0000000800), 0xffffffffffffffff) 17:47:22 executing program 5: pipe2$9p(&(0x7f0000000240), 0x0) syz_io_uring_setup(0x776a, &(0x7f0000000280)={0x0, 0x2728, 0x2, 0x1, 0x37c}, &(0x7f0000000000/0x3000)=nil, &(0x7f0000000000/0x400000)=nil, &(0x7f0000000300), &(0x7f0000000340)) openat$nvram(0xffffffffffffff9c, &(0x7f0000000680), 0x400, 0x0) r0 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$ieee802154(&(0x7f0000000740), 0xffffffffffffffff) sendmsg$IEEE802154_LLSEC_DEL_KEY(r0, &(0x7f0000000840)={&(0x7f0000000700)={0x10, 0x0, 0x0, 0x800000}, 0xc, &(0x7f0000000800)={&(0x7f0000000780)={0x54, r1, 0x800, 0x70bd27, 0x25dfdbfc, {}, [@IEEE802154_ATTR_LLSEC_KEY_SOURCE_SHORT={0x8, 0x2c, 0x5}, @IEEE802154_ATTR_LLSEC_KEY_SOURCE_EXTENDED={0xc, 0x2d, {0xaaaaaaaaaaaa0002}}, @IEEE802154_ATTR_PAN_ID={0x6, 0x6, 0x2}, @IEEE802154_ATTR_DEV_INDEX={0x8}, @IEEE802154_ATTR_LLSEC_KEY_MODE={0x5, 0x2b, 0x1}, @IEEE802154_ATTR_HW_ADDR={0xc, 0x5, {0xaaaaaaaaaaaa0002}}, @IEEE802154_ATTR_LLSEC_KEY_MODE={0x5, 0x2b, 0x3}]}, 0x54}, 0x1, 0x0, 0x0, 0x40}, 0x2000c814) clock_getres(0x3, &(0x7f0000000880)) r2 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) sendmsg$IEEE802154_ADD_IFACE(r2, &(0x7f0000000a00)={&(0x7f0000000900)={0x10, 0x0, 0x0, 0x40c}, 0xc, &(0x7f00000009c0)={&(0x7f0000000940)={0x44, r1, 0x200, 0x70bd29, 0x25dfdbfe, {}, [@IEEE802154_ATTR_PHY_NAME={0x9, 0x1f, 'phy1\x00'}, @IEEE802154_ATTR_DEV_NAME={0xa, 0x1, 'wpan4\x00'}, @IEEE802154_ATTR_DEV_NAME={0xa, 0x1, 'wpan1\x00'}, @IEEE802154_ATTR_DEV_NAME={0xa, 0x1, 'wpan0\x00'}]}, 0x44}, 0x1, 0x0, 0x0, 0x20000084}, 0x44000) 17:47:31 executing program 5: pipe2$9p(&(0x7f0000000240), 0x0) syz_io_uring_setup(0x0, &(0x7f0000000280)={0x0, 0x2728, 0x2, 0x1, 0x37c}, &(0x7f0000000000/0x3000)=nil, &(0x7f0000000000/0x400000)=nil, &(0x7f0000000300), &(0x7f0000000340)) openat$nvram(0xffffffffffffff9c, &(0x7f0000000680), 0x400, 0x0) r0 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$ieee802154(&(0x7f0000000740), 0xffffffffffffffff) sendmsg$IEEE802154_LLSEC_DEL_KEY(r0, &(0x7f0000000840)={&(0x7f0000000700)={0x10, 0x0, 0x0, 0x800000}, 0xc, &(0x7f0000000800)={&(0x7f0000000780)={0x54, r1, 0x800, 0x70bd27, 0x25dfdbfc, {}, [@IEEE802154_ATTR_LLSEC_KEY_SOURCE_SHORT={0x8, 0x2c, 0x5}, @IEEE802154_ATTR_LLSEC_KEY_SOURCE_EXTENDED={0xc, 0x2d, {0xaaaaaaaaaaaa0002}}, @IEEE802154_ATTR_PAN_ID={0x6, 0x6, 0x2}, @IEEE802154_ATTR_DEV_INDEX={0x8}, @IEEE802154_ATTR_LLSEC_KEY_MODE={0x5, 0x2b, 0x1}, @IEEE802154_ATTR_HW_ADDR={0xc, 0x5, {0xaaaaaaaaaaaa0002}}, @IEEE802154_ATTR_LLSEC_KEY_MODE={0x5, 0x2b, 0x3}]}, 0x54}, 0x1, 0x0, 0x0, 0x40}, 0x2000c814) clock_getres(0x3, &(0x7f0000000880)) r2 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) sendmsg$IEEE802154_ADD_IFACE(r2, &(0x7f0000000a00)={&(0x7f0000000900)={0x10, 0x0, 0x0, 0x40c}, 0xc, &(0x7f00000009c0)={&(0x7f0000000940)={0x44, r1, 0x200, 0x70bd29, 0x25dfdbfe, {}, [@IEEE802154_ATTR_PHY_NAME={0x9, 0x1f, 'phy1\x00'}, @IEEE802154_ATTR_DEV_NAME={0xa, 0x1, 'wpan4\x00'}, @IEEE802154_ATTR_DEV_NAME={0xa, 0x1, 'wpan1\x00'}, @IEEE802154_ATTR_DEV_NAME={0xa, 0x1, 'wpan0\x00'}]}, 0x44}, 0x1, 0x0, 0x0, 0x20000084}, 0x44000) 17:47:31 executing program 7: clock_gettime(0x5, &(0x7f0000000000)) clock_settime(0x2, &(0x7f0000000040)) sched_rr_get_interval(0xffffffffffffffff, &(0x7f0000000080)) sched_rr_get_interval(0x0, &(0x7f00000000c0)) sendmsg$NL802154_CMD_GET_SEC_KEY(0xffffffffffffffff, &(0x7f00000001c0)={&(0x7f0000000100)={0x10, 0x0, 0x0, 0x20000000}, 0xc, &(0x7f0000000180)={&(0x7f0000000140)={0x24, 0x0, 0x200, 0x70bd26, 0x25dfdbfe, {}, [@NL802154_ATTR_IFINDEX={0x8}, @NL802154_ATTR_IFINDEX={0x8}]}, 0x24}, 0x1, 0x0, 0x0, 0x4000000}, 0x181) clock_gettime(0x0, &(0x7f0000000200)) pipe2$9p(&(0x7f0000000240)={0xffffffffffffffff, 0xffffffffffffffff}, 0x800) r1 = syz_io_uring_setup(0x776a, &(0x7f0000000280)={0x0, 0x2728, 0x2, 0x1, 0x37c}, &(0x7f0000000000/0x3000)=nil, &(0x7f0000000000/0x400000)=nil, &(0x7f0000000300), &(0x7f0000000340)) ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, &(0x7f0000000540)={0x64, 0x0, &(0x7f0000000440)=[@transaction_sg={0x40486311, {0x1, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x50, 0x18, &(0x7f0000000380)={@fd={0x66642a85, 0x0, r0}, @fd={0x66642a85, 0x0, r1}, @fda={0x66646185, 0x0, 0x2, 0x36}}, &(0x7f0000000400)={0x0, 0x18, 0x30}}}, @request_death, @release={0x40046306, 0x1}], 0x7e, 0x0, &(0x7f00000004c0)="7685c519d1cbea63a1a8f022f8c0085baf770aa5d1fa9bfb1a5399fdb134953d619e962218bba650b68d6206fde39ff17760aa4bbcb62f6802c48e17294a17a3b768ab60bbae37aa37e33e24b09f6bdea37853f7ab2622451803788c9d172b7d71d6d87911129b8ef5cc9e0169404b09abfa991f3a7a3640686df445d387"}) pipe2$9p(&(0x7f0000000580), 0x800) ioctl$EVIOCGVERSION(0xffffffffffffffff, 0x80044501, &(0x7f00000005c0)=""/174) clock_getres(0x3, &(0x7f0000000880)) 17:47:31 executing program 1: shmget$private(0x0, 0x4000, 0x80, &(0x7f0000ffb000/0x4000)=nil) shmget(0x3, 0x2000, 0x4, &(0x7f0000ffc000/0x2000)=nil) mlock(&(0x7f0000ff0000/0x10000)=nil, 0x10000) shmget(0x1, 0x1000, 0x10, &(0x7f0000ff5000/0x1000)=nil) ioctl$sock_ipv4_tunnel_SIOCDELTUNNEL(0xffffffffffffffff, 0x89f2, &(0x7f0000000380)={'gretap0\x00', &(0x7f00000002c0)={'syztnl2\x00', 0x0, 0x7800, 0x7, 0x40, 0xe180, {{0x22, 0x4, 0x0, 0x1, 0x88, 0x64, 0x0, 0x1, 0x29, 0x0, @multicast2, @multicast1, {[@end, @lsrr={0x83, 0x1f, 0x2f, [@multicast2, @local, @local, @multicast1, @rand_addr=0x64010102, @loopback, @private=0xa010100]}, @rr={0x7, 0x27, 0x6c, [@multicast1, @rand_addr=0x64010102, @remote, @multicast1, @loopback, @initdev={0xac, 0x1e, 0x0, 0x0}, @initdev={0xac, 0x1e, 0x1, 0x0}, @broadcast, @empty]}, @ra={0x94, 0x4, 0x1}, @timestamp={0x44, 0x10, 0x2d, 0x0, 0x8, [0x1, 0x100, 0x401]}, @ssrr={0x89, 0x13, 0x56, [@dev={0xac, 0x14, 0x14, 0x28}, @multicast2, @initdev={0xac, 0x1e, 0x0, 0x0}, @remote]}, @ra={0x94, 0x4, 0x1}]}}}}}) mmap$IORING_OFF_CQ_RING(&(0x7f0000ffd000/0x3000)=nil, 0x3000, 0x2000008, 0x30, 0xffffffffffffffff, 0x8000000) r0 = syz_genetlink_get_family_id$nl802154(&(0x7f0000000400), 0xffffffffffffffff) sendmsg$NL802154_CMD_NEW_INTERFACE(0xffffffffffffffff, &(0x7f0000000540)={&(0x7f00000003c0)={0x10, 0x0, 0x0, 0x2}, 0xc, &(0x7f0000000500)={&(0x7f0000000480)={0x48, r0, 0x200, 0x70bd2a, 0x25dfdbfd, {}, [@NL802154_ATTR_IFNAME={0xa, 0x4, 'wpan0\x00'}, @NL802154_ATTR_IFINDEX={0x8}, @NL802154_ATTR_IFNAME={0xa, 0x4, 'wpan1\x00'}, @NL802154_ATTR_EXTENDED_ADDR={0xc, 0x17, {0xaaaaaaaaaaaa0002}}, @NL802154_ATTR_IFINDEX={0x8}]}, 0x48}}, 0x4001) mmap$binder(&(0x7f0000fef000/0x11000)=nil, 0x11000, 0x1, 0x11, 0xffffffffffffffff, 0x6) r1 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) sendmsg$IEEE802154_LLSEC_ADD_SECLEVEL(r1, &(0x7f00000006c0)={&(0x7f0000000580)={0x10, 0x0, 0x0, 0x4000000}, 0xc, &(0x7f0000000680)={&(0x7f0000000600)={0x44, 0x0, 0x200, 0x70bd2a, 0x25dfdbff, {}, [@IEEE802154_ATTR_LLSEC_FRAME_TYPE={0x5, 0x33, 0x34}, @IEEE802154_ATTR_DEV_INDEX={0x8}, @IEEE802154_ATTR_LLSEC_CMD_FRAME_ID={0x5, 0x34, 0x1}, @IEEE802154_ATTR_DEV_NAME={0xa, 0x1, 'wpan0\x00'}, @IEEE802154_ATTR_DEV_NAME={0xa, 0x1, 'wpan4\x00'}]}, 0x44}, 0x1, 0x0, 0x0, 0x8800}, 0x0) sendmsg$IEEE802154_START_REQ(r1, &(0x7f00000007c0)={&(0x7f0000000700)={0x10, 0x0, 0x0, 0x4}, 0xc, &(0x7f0000000780)={&(0x7f0000000740)={0x1c, 0x0, 0x200, 0x70bd2d, 0x25dfdbfb, {}, [@IEEE802154_ATTR_CHANNEL={0x5, 0x7, 0x6}]}, 0x1c}, 0x1, 0x0, 0x0, 0x40100}, 0x801) mlock(&(0x7f0000fef000/0x1000)=nil, 0x1000) syz_io_uring_setup(0x4726, &(0x7f0000000840)={0x0, 0x502f, 0x20, 0x0, 0x12e}, &(0x7f0000ffe000/0x2000)=nil, &(0x7f0000ffb000/0x4000)=nil, &(0x7f00000008c0), &(0x7f0000000900)) 17:47:31 executing program 4: r0 = perf_event_open(&(0x7f00000000c0)={0x1, 0x80, 0x0, 0xc0, 0xfa, 0x1, 0x0, 0x7fffffff, 0x10811, 0x1, 0x1, 0x1, 0x1, 0x1, 0x1, 0x1, 0x1, 0x1, 0x0, 0x1, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x1, 0x0, 0x1, 0x0, 0x0, 0x0, 0x1, 0x1, 0x1, 0x1, 0x1, 0x1, 0x1, 0x0, 0x1, 0x1, 0x1, 0x1, 0x0, 0x0, 0xfff, 0x7, @perf_config_ext={0x7, 0x7fffffff}, 0x41000, 0x80000000, 0x5, 0x3, 0x9, 0x2, 0x9, 0x0, 0x5, 0x0, 0x4}, 0x0, 0xb, 0xffffffffffffffff, 0x1) perf_event_open(&(0x7f0000000040)={0x0, 0x80, 0x0, 0x40, 0x80, 0x9, 0x0, 0x3, 0x10040, 0x1, 0x0, 0x0, 0x1, 0x1, 0x1, 0x1, 0x1, 0x1, 0x1, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x3, 0x1, 0x0, 0x1, 0x0, 0x1, 0x1, 0x0, 0x0, 0x1, 0x1, 0x1, 0x0, 0x1, 0x0, 0x0, 0x0, 0x1, 0x0, 0x1, 0x0, 0x1, 0x0, 0x0, 0x1, @perf_bp={&(0x7f0000000000), 0x10}, 0x8080, 0x800, 0x2, 0x3, 0x36dc, 0x31df3b33, 0xff, 0x0, 0x9, 0x0, 0x5}, 0xffffffffffffffff, 0x9, r0, 0x9) ioctl$PERF_EVENT_IOC_PAUSE_OUTPUT(r0, 0x40042409, 0x0) ioctl$PERF_EVENT_IOC_PERIOD(0xffffffffffffffff, 0x40082404, &(0x7f0000000140)=0x8) socket$inet_udplite(0x2, 0x2, 0x88) ioctl$SNDRV_SEQ_IOCTL_SYSTEM_INFO(0xffffffffffffffff, 0xc0305302, &(0x7f0000000300)={0x9, 0x101, 0x1, 0x6, 0x3, 0x5}) syz_open_procfs(0x0, &(0x7f0000000340)='children\x00') 17:47:31 executing program 0: get_thread_area(&(0x7f0000000000)={0x7, 0x20000800, 0x4000, 0x0, 0x1, 0x0, 0x0, 0x1, 0x1, 0x1}) r0 = openat$vcsu(0xffffffffffffff9c, &(0x7f0000000040), 0x200000, 0x0) getsockopt$inet_tcp_TCP_REPAIR_WINDOW(r0, 0x6, 0x1d, &(0x7f0000000080), &(0x7f00000000c0)=0x14) setsockopt$inet_tcp_int(0xffffffffffffffff, 0x6, 0x1b, &(0x7f0000000180)=0x5, 0x4) ioctl$SNDRV_TIMER_IOCTL_STATUS32(0xffffffffffffffff, 0x80585414, &(0x7f00000001c0)) setsockopt$inet_tcp_TCP_QUEUE_SEQ(r0, 0x6, 0x15, &(0x7f0000000240)=0x1, 0x4) r1 = socket$inet_tcp(0x2, 0x1, 0x0) ioctl$sock_inet_tcp_SIOCINQ(r1, 0x541b, &(0x7f00000003c0)) move_pages(0x0, 0x8, &(0x7f0000000400)=[&(0x7f0000ffd000/0x1000)=nil, &(0x7f0000ffd000/0x3000)=nil, &(0x7f0000ffd000/0x3000)=nil, &(0x7f0000ffb000/0x2000)=nil, &(0x7f0000ffc000/0x1000)=nil, &(0x7f0000ffe000/0x2000)=nil, &(0x7f0000ffb000/0x4000)=nil, &(0x7f0000ffd000/0x3000)=nil], &(0x7f0000000440)=[0xfff], &(0x7f0000000480)=[0x0, 0x0, 0x0], 0x4) r2 = syz_genetlink_get_family_id$SEG6(&(0x7f0000000500), 0xffffffffffffffff) sendmsg$SEG6_CMD_GET_TUNSRC(r0, &(0x7f00000005c0)={&(0x7f00000004c0)={0x10, 0x0, 0x0, 0x4000000}, 0xc, &(0x7f0000000580)={&(0x7f0000000540)={0x38, r2, 0x300, 0x70bd2a, 0x25dfdbfc, {}, [@SEG6_ATTR_HMACKEYID={0x8, 0x3, 0x24}, @SEG6_ATTR_DST={0x14, 0x1, @mcast1}, @SEG6_ATTR_DSTLEN={0x8, 0x2, 0x2}]}, 0x38}, 0x1, 0x0, 0x0, 0x20008810}, 0x4040010) sendmsg$SEG6_CMD_DUMPHMAC(0xffffffffffffffff, &(0x7f0000000740)={&(0x7f0000000680)={0x10, 0x0, 0x0, 0x240000}, 0xc, &(0x7f0000000700)={&(0x7f00000006c0)={0x2c, r2, 0x1, 0x70bd2c, 0x25dfdbfe, {}, [@SEG6_ATTR_SECRET={0x8, 0x4, [0x1]}, @SEG6_ATTR_DSTLEN={0x8, 0x2, 0x5}, @SEG6_ATTR_DSTLEN={0x8}]}, 0x2c}, 0x1, 0x0, 0x0, 0x4000000}, 0x4000000) pidfd_getfd(0xffffffffffffffff, r1, 0x0) syz_genetlink_get_family_id$ieee802154(&(0x7f0000000800), 0xffffffffffffffff) 17:47:31 executing program 2: clock_gettime(0x5, &(0x7f0000000000)) clock_settime(0x2, &(0x7f0000000040)) sched_rr_get_interval(0xffffffffffffffff, &(0x7f0000000080)) sched_rr_get_interval(0x0, &(0x7f00000000c0)) sendmsg$NL802154_CMD_GET_SEC_KEY(0xffffffffffffffff, &(0x7f00000001c0)={&(0x7f0000000100)={0x10, 0x0, 0x0, 0x20000000}, 0xc, &(0x7f0000000180)={&(0x7f0000000140)={0x24, 0x0, 0x200, 0x70bd26, 0x25dfdbfe, {}, [@NL802154_ATTR_IFINDEX={0x8}, @NL802154_ATTR_IFINDEX={0x8}]}, 0x24}, 0x1, 0x0, 0x0, 0x4000000}, 0x181) clock_gettime(0x0, &(0x7f0000000200)) pipe2$9p(&(0x7f0000000240)={0xffffffffffffffff, 0xffffffffffffffff}, 0x800) r1 = syz_io_uring_setup(0x776a, &(0x7f0000000280)={0x0, 0x2728, 0x2, 0x1, 0x37c}, &(0x7f0000000000/0x3000)=nil, &(0x7f0000000000/0x400000)=nil, &(0x7f0000000300), &(0x7f0000000340)) ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, &(0x7f0000000540)={0x64, 0x0, &(0x7f0000000440)=[@transaction_sg={0x40486311, {0x1, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x50, 0x18, &(0x7f0000000380)={@fd={0x66642a85, 0x0, r0}, @fd={0x66642a85, 0x0, r1}, @fda={0x66646185, 0x0, 0x2, 0x36}}, &(0x7f0000000400)={0x0, 0x18, 0x30}}}, @request_death, @release={0x40046306, 0x1}], 0x7e, 0x0, &(0x7f00000004c0)="7685c519d1cbea63a1a8f022f8c0085baf770aa5d1fa9bfb1a5399fdb134953d619e962218bba650b68d6206fde39ff17760aa4bbcb62f6802c48e17294a17a3b768ab60bbae37aa37e33e24b09f6bdea37853f7ab2622451803788c9d172b7d71d6d87911129b8ef5cc9e0169404b09abfa991f3a7a3640686df445d387"}) pipe2$9p(&(0x7f0000000580), 0x800) ioctl$EVIOCGVERSION(0xffffffffffffffff, 0x80044501, &(0x7f00000005c0)=""/174) syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) clock_getres(0x3, &(0x7f0000000880)) 17:47:31 executing program 6: get_thread_area(&(0x7f0000000000)={0x7, 0x20000800, 0x4000, 0x0, 0x1, 0x0, 0x0, 0x1, 0x1, 0x1}) r0 = openat$vcsu(0xffffffffffffff9c, &(0x7f0000000040), 0x200000, 0x0) getsockopt$inet_tcp_TCP_REPAIR_WINDOW(r0, 0x6, 0x1d, &(0x7f0000000080), &(0x7f00000000c0)=0x14) r1 = openat$nvram(0xffffffffffffff9c, &(0x7f0000000100), 0x2000, 0x0) setsockopt$inet_tcp_TCP_FASTOPEN_KEY(r1, 0x6, 0x21, &(0x7f0000000140)="1bb9d563048b6ec78effc0f14d974b17", 0x10) setsockopt$inet_tcp_int(r1, 0x6, 0x1b, &(0x7f0000000180)=0x5, 0x4) ioctl$SNDRV_TIMER_IOCTL_STATUS32(r1, 0x80585414, &(0x7f00000001c0)) socket$inet_tcp(0x2, 0x1, 0x0) syz_genetlink_get_family_id$SEG6(&(0x7f0000000500), r1) syz_genetlink_get_family_id$ieee802154(&(0x7f0000000800), 0xffffffffffffffff) 17:47:31 executing program 3: clock_gettime(0x5, &(0x7f0000000000)) clock_settime(0x2, &(0x7f0000000040)) sched_rr_get_interval(0xffffffffffffffff, &(0x7f0000000080)) sched_rr_get_interval(0x0, &(0x7f00000000c0)) sendmsg$NL802154_CMD_GET_SEC_KEY(0xffffffffffffffff, &(0x7f00000001c0)={&(0x7f0000000100)={0x10, 0x0, 0x0, 0x20000000}, 0xc, &(0x7f0000000180)={&(0x7f0000000140)={0x24, 0x0, 0x200, 0x70bd26, 0x25dfdbfe, {}, [@NL802154_ATTR_IFINDEX={0x8}, @NL802154_ATTR_IFINDEX={0x8}]}, 0x24}, 0x1, 0x0, 0x0, 0x4000000}, 0x181) clock_gettime(0x0, &(0x7f0000000200)) pipe2$9p(&(0x7f0000000240)={0xffffffffffffffff, 0xffffffffffffffff}, 0x800) r1 = syz_io_uring_setup(0x776a, &(0x7f0000000280)={0x0, 0x2728, 0x2, 0x1, 0x37c}, &(0x7f0000000000/0x3000)=nil, &(0x7f0000000000/0x400000)=nil, &(0x7f0000000300), &(0x7f0000000340)) ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, &(0x7f0000000540)={0x64, 0x0, &(0x7f0000000440)=[@transaction_sg={0x40486311, {0x1, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x50, 0x18, &(0x7f0000000380)={@fd={0x66642a85, 0x0, r0}, @fd={0x66642a85, 0x0, r1}, @fda={0x66646185, 0x0, 0x2, 0x36}}, &(0x7f0000000400)={0x0, 0x18, 0x30}}}, @request_death, @release={0x40046306, 0x1}], 0x7e, 0x0, &(0x7f00000004c0)="7685c519d1cbea63a1a8f022f8c0085baf770aa5d1fa9bfb1a5399fdb134953d619e962218bba650b68d6206fde39ff17760aa4bbcb62f6802c48e17294a17a3b768ab60bbae37aa37e33e24b09f6bdea37853f7ab2622451803788c9d172b7d71d6d87911129b8ef5cc9e0169404b09abfa991f3a7a3640686df445d387"}) pipe2$9p(&(0x7f0000000580), 0x800) r2 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r3 = syz_genetlink_get_family_id$ieee802154(&(0x7f0000000740), 0xffffffffffffffff) sendmsg$IEEE802154_LLSEC_DEL_KEY(r2, &(0x7f0000000840)={&(0x7f0000000700)={0x10, 0x0, 0x0, 0x800000}, 0xc, &(0x7f0000000800)={&(0x7f0000000780)={0x54, r3, 0x800, 0x70bd27, 0x25dfdbfc, {}, [@IEEE802154_ATTR_LLSEC_KEY_SOURCE_SHORT={0x8, 0x2c, 0x5}, @IEEE802154_ATTR_LLSEC_KEY_SOURCE_EXTENDED={0xc, 0x2d, {0xaaaaaaaaaaaa0002}}, @IEEE802154_ATTR_PAN_ID={0x6, 0x6, 0x2}, @IEEE802154_ATTR_DEV_INDEX={0x8}, @IEEE802154_ATTR_LLSEC_KEY_MODE={0x5, 0x2b, 0x1}, @IEEE802154_ATTR_HW_ADDR={0xc, 0x5, {0xaaaaaaaaaaaa0002}}, @IEEE802154_ATTR_LLSEC_KEY_MODE={0x5, 0x2b, 0x3}]}, 0x54}, 0x1, 0x0, 0x0, 0x40}, 0x2000c814) [ 307.869534] kmemleak: Found object by alias at 0x607f1a62a634 [ 307.869556] CPU: 0 UID: 0 PID: 4939 Comm: iou-sqp-4934 Tainted: G W 6.17.0-rc3-next-20250829 #1 PREEMPT(voluntary) [ 307.869574] Tainted: [W]=WARN [ 307.869578] Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.12.0-1 04/01/2014 [ 307.869586] Call Trace: [ 307.869590] [ 307.869595] dump_stack_lvl+0xca/0x120 [ 307.869623] __lookup_object+0x94/0xb0 [ 307.869641] delete_object_full+0x27/0x70 [ 307.869656] free_percpu+0x30/0x1160 [ 307.869673] ? arch_uprobe_clear_state+0x16/0x140 [ 307.869692] futex_hash_free+0x38/0xc0 [ 307.869707] mmput+0x2d3/0x390 [ 307.869726] do_exit+0x79d/0x2970 [ 307.869743] ? __pfx_do_exit+0x10/0x10 [ 307.869755] ? io_sq_thread+0xfbd/0x1b00 [ 307.869771] ? lock_release+0xc8/0x290 [ 307.869789] io_sq_thread+0xfc9/0x1b00 [ 307.869809] ? __pfx_io_sq_thread+0x10/0x10 [ 307.869826] ? __lock_acquire+0xc65/0x1b70 [ 307.869843] ? __pfx_autoremove_wake_function+0x10/0x10 [ 307.869858] ? __lock_acquire+0xc65/0x1b70 [ 307.869877] ? do_raw_spin_lock+0x123/0x260 [ 307.869893] ? find_held_lock+0x2b/0x80 [ 307.869909] ? __pfx_io_sq_thread+0x10/0x10 [ 307.869924] ? lock_release+0xc8/0x290 [ 307.869937] ? __pfx_io_sq_thread+0x10/0x10 [ 307.869952] ret_from_fork+0x34b/0x430 [ 307.869970] ? __pfx_io_sq_thread+0x10/0x10 [ 307.869985] ret_from_fork_asm+0x1a/0x30 [ 307.870008] [ 307.870012] kmemleak: Object (percpu) 0x607f1a62a630 (size 8): [ 307.870019] kmemleak: comm "syz-executor.2", pid 4942, jiffies 4294974680 [ 307.870026] kmemleak: min_count = 1 [ 307.870030] kmemleak: count = 0 [ 307.870034] kmemleak: flags = 0x21 [ 307.870037] kmemleak: checksum = 0 [ 307.870041] kmemleak: backtrace: [ 307.870045] pcpu_alloc_noprof+0x87a/0x1170 [ 307.870059] percpu_ref_init+0x37/0x400 [ 307.870077] io_uring_setup+0x44c/0x2000 [ 307.870088] __x64_sys_io_uring_setup+0xc8/0x170 [ 307.870098] do_syscall_64+0xbf/0x360 [ 307.870108] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 307.890038] kmemleak: Cannot insert 0x607f1a62a634 into the object search tree (overlaps existing) [ 307.890056] CPU: 0 UID: 0 PID: 4944 Comm: syz-executor.3 Tainted: G W 6.17.0-rc3-next-20250829 #1 PREEMPT(voluntary) [ 307.890074] Tainted: [W]=WARN [ 307.890078] Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.12.0-1 04/01/2014 [ 307.890085] Call Trace: [ 307.890089] [ 307.890093] dump_stack_lvl+0xca/0x120 [ 307.890115] __link_object+0x190/0x210 [ 307.890133] __create_object+0x48/0x80 [ 307.890150] pcpu_alloc_noprof+0x87a/0x1170 [ 307.890173] __percpu_counter_init_many+0x44/0x360 [ 307.890189] ? kasan_save_track+0x14/0x30 [ 307.890206] io_uring_alloc_task_context+0xce/0x650 [ 307.890226] ? __pfx_io_uring_alloc_task_context+0x10/0x10 [ 307.890245] ? _raw_spin_unlock_irqrestore+0x2c/0x50 [ 307.890264] io_sq_offload_create+0xbc6/0x11a0 [ 307.890282] ? __pfx_io_sq_offload_create+0x10/0x10 [ 307.890300] ? security_capable+0x2f/0x90 [ 307.890317] io_uring_setup+0x143e/0x2000 [ 307.890331] ? __pfx_io_uring_setup+0x10/0x10 [ 307.890355] ? __pfx___x64_sys_futex+0x10/0x10 [ 307.890370] ? __x64_sys_clock_gettime+0x16d/0x240 [ 307.890387] ? xfd_validate_state+0x55/0x180 [ 307.890408] __x64_sys_io_uring_setup+0xc8/0x170 [ 307.890422] do_syscall_64+0xbf/0x360 [ 307.890433] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 307.890445] RIP: 0033:0x7f2d35163b19 [ 307.890455] Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 bc ff ff ff f7 d8 64 89 01 48 [ 307.890466] RSP: 002b:00007f2d326d9108 EFLAGS: 00000202 ORIG_RAX: 00000000000001a9 [ 307.890478] RAX: ffffffffffffffda RBX: 00007f2d35276f60 RCX: 00007f2d35163b19 [ 307.890486] RDX: 0000000020000000 RSI: 0000000020000280 RDI: 000000000000776a [ 307.890493] RBP: 0000000020000280 R08: 0000000020000340 R09: 0000000020000340 [ 307.890500] R10: 0000000020000300 R11: 0000000000000202 R12: 0000000020000340 [ 307.890507] R13: 0000000020000000 R14: 0000000020000300 R15: 0000000020000000 [ 307.890523] [ 307.891200] kmemleak: Kernel memory leak detector disabled [ 307.891205] kmemleak: Object (percpu) 0x607f1a62a630 (size 8): [ 307.891212] kmemleak: comm "syz-executor.2", pid 4942, jiffies 4294974680 [ 307.891219] kmemleak: min_count = 1 [ 307.891223] kmemleak: count = 0 [ 307.891227] kmemleak: flags = 0x21 [ 307.891231] kmemleak: checksum = 0 [ 307.891235] kmemleak: backtrace: [ 307.891238] pcpu_alloc_noprof+0x87a/0x1170 [ 307.891254] percpu_ref_init+0x37/0x400 [ 307.891275] io_uring_setup+0x44c/0x2000 [ 307.891286] __x64_sys_io_uring_setup+0xc8/0x170 [ 307.891297] do_syscall_64+0xbf/0x360 [ 307.891306] entry_SYSCALL_64_after_hwframe+0x77/0x7f 17:47:31 executing program 4: r0 = perf_event_open(&(0x7f00000000c0)={0x1, 0x80, 0x0, 0xc0, 0xfa, 0x1, 0x0, 0x7fffffff, 0x10811, 0x1, 0x1, 0x1, 0x1, 0x1, 0x1, 0x1, 0x1, 0x1, 0x0, 0x1, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x1, 0x0, 0x1, 0x0, 0x0, 0x0, 0x1, 0x1, 0x1, 0x1, 0x1, 0x1, 0x1, 0x0, 0x1, 0x1, 0x1, 0x1, 0x0, 0x0, 0xfff, 0x7, @perf_config_ext={0x7, 0x7fffffff}, 0x41000, 0x80000000, 0x5, 0x3, 0x9, 0x2, 0x9, 0x0, 0x5, 0x0, 0x4}, 0x0, 0xb, 0xffffffffffffffff, 0x1) perf_event_open(&(0x7f0000000040)={0x0, 0x80, 0x0, 0x40, 0x80, 0x9, 0x0, 0x3, 0x10040, 0x1, 0x0, 0x0, 0x1, 0x1, 0x1, 0x1, 0x1, 0x1, 0x1, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x3, 0x1, 0x0, 0x1, 0x0, 0x1, 0x1, 0x0, 0x0, 0x1, 0x1, 0x1, 0x0, 0x1, 0x0, 0x0, 0x0, 0x1, 0x0, 0x1, 0x0, 0x1, 0x0, 0x0, 0x1, @perf_bp={&(0x7f0000000000), 0x10}, 0x8080, 0x800, 0x2, 0x3, 0x36dc, 0x31df3b33, 0xff, 0x0, 0x9, 0x0, 0x5}, 0xffffffffffffffff, 0x9, r0, 0x9) ioctl$PERF_EVENT_IOC_PAUSE_OUTPUT(r0, 0x40042409, 0x0) ioctl$PERF_EVENT_IOC_PERIOD(0xffffffffffffffff, 0x40082404, &(0x7f0000000140)=0x8) socket$inet_udplite(0x2, 0x2, 0x88) ioctl$SNDRV_SEQ_IOCTL_SYSTEM_INFO(0xffffffffffffffff, 0xc0305302, &(0x7f0000000300)={0x9, 0x101, 0x1, 0x6, 0x3, 0x5}) syz_open_procfs(0x0, &(0x7f0000000340)='children\x00') 17:47:31 executing program 0: get_thread_area(&(0x7f0000000000)={0x7, 0x20000800, 0x4000, 0x0, 0x1, 0x0, 0x0, 0x1, 0x1, 0x1}) r0 = openat$vcsu(0xffffffffffffff9c, &(0x7f0000000040), 0x200000, 0x0) getsockopt$inet_tcp_TCP_REPAIR_WINDOW(r0, 0x6, 0x1d, &(0x7f0000000080), &(0x7f00000000c0)=0x14) setsockopt$inet_tcp_int(0xffffffffffffffff, 0x6, 0x1b, &(0x7f0000000180)=0x5, 0x4) ioctl$SNDRV_TIMER_IOCTL_STATUS32(0xffffffffffffffff, 0x80585414, &(0x7f00000001c0)) setsockopt$inet_tcp_TCP_QUEUE_SEQ(r0, 0x6, 0x15, &(0x7f0000000240)=0x1, 0x4) r1 = socket$inet_tcp(0x2, 0x1, 0x0) ioctl$sock_inet_tcp_SIOCINQ(r1, 0x541b, &(0x7f00000003c0)) move_pages(0x0, 0x8, &(0x7f0000000400)=[&(0x7f0000ffd000/0x1000)=nil, &(0x7f0000ffd000/0x3000)=nil, &(0x7f0000ffd000/0x3000)=nil, &(0x7f0000ffb000/0x2000)=nil, &(0x7f0000ffc000/0x1000)=nil, &(0x7f0000ffe000/0x2000)=nil, &(0x7f0000ffb000/0x4000)=nil, &(0x7f0000ffd000/0x3000)=nil], &(0x7f0000000440)=[0xfff], &(0x7f0000000480)=[0x0, 0x0, 0x0], 0x4) r2 = syz_genetlink_get_family_id$SEG6(&(0x7f0000000500), 0xffffffffffffffff) sendmsg$SEG6_CMD_GET_TUNSRC(r0, &(0x7f00000005c0)={&(0x7f00000004c0)={0x10, 0x0, 0x0, 0x4000000}, 0xc, &(0x7f0000000580)={&(0x7f0000000540)={0x38, r2, 0x300, 0x70bd2a, 0x25dfdbfc, {}, [@SEG6_ATTR_HMACKEYID={0x8, 0x3, 0x24}, @SEG6_ATTR_DST={0x14, 0x1, @mcast1}, @SEG6_ATTR_DSTLEN={0x8, 0x2, 0x2}]}, 0x38}, 0x1, 0x0, 0x0, 0x20008810}, 0x4040010) sendmsg$SEG6_CMD_DUMPHMAC(0xffffffffffffffff, &(0x7f0000000740)={&(0x7f0000000680)={0x10, 0x0, 0x0, 0x240000}, 0xc, &(0x7f0000000700)={&(0x7f00000006c0)={0x2c, r2, 0x1, 0x70bd2c, 0x25dfdbfe, {}, [@SEG6_ATTR_SECRET={0x8, 0x4, [0x1]}, @SEG6_ATTR_DSTLEN={0x8, 0x2, 0x5}, @SEG6_ATTR_DSTLEN={0x8}]}, 0x2c}, 0x1, 0x0, 0x0, 0x4000000}, 0x4000000) pidfd_getfd(0xffffffffffffffff, r1, 0x0) syz_genetlink_get_family_id$ieee802154(&(0x7f0000000800), 0xffffffffffffffff) [ 307.943467] kmemleak: Automatic memory scanning thread ended 17:47:31 executing program 6: get_thread_area(&(0x7f0000000000)={0x7, 0x20000800, 0x4000, 0x0, 0x1, 0x0, 0x0, 0x1, 0x1, 0x1}) r0 = openat$vcsu(0xffffffffffffff9c, &(0x7f0000000040), 0x200000, 0x0) getsockopt$inet_tcp_TCP_REPAIR_WINDOW(r0, 0x6, 0x1d, &(0x7f0000000080), &(0x7f00000000c0)=0x14) r1 = openat$nvram(0xffffffffffffff9c, &(0x7f0000000100), 0x2000, 0x0) setsockopt$inet_tcp_TCP_FASTOPEN_KEY(r1, 0x6, 0x21, &(0x7f0000000140)="1bb9d563048b6ec78effc0f14d974b17", 0x10) setsockopt$inet_tcp_int(r1, 0x6, 0x1b, &(0x7f0000000180)=0x5, 0x4) ioctl$SNDRV_TIMER_IOCTL_STATUS32(r1, 0x80585414, &(0x7f00000001c0)) socket$inet_tcp(0x2, 0x1, 0x0) syz_genetlink_get_family_id$SEG6(&(0x7f0000000500), r1) syz_genetlink_get_family_id$ieee802154(&(0x7f0000000800), 0xffffffffffffffff) 17:47:31 executing program 1: shmget$private(0x0, 0x4000, 0x80, &(0x7f0000ffb000/0x4000)=nil) shmget(0x3, 0x2000, 0x4, &(0x7f0000ffc000/0x2000)=nil) mlock(&(0x7f0000ff0000/0x10000)=nil, 0x10000) ioctl$sock_ipv4_tunnel_SIOCDELTUNNEL(0xffffffffffffffff, 0x89f2, &(0x7f0000000380)={'gretap0\x00', &(0x7f00000002c0)={'syztnl2\x00', 0x0, 0x7800, 0x7, 0x40, 0xe180, {{0x22, 0x4, 0x0, 0x1, 0x88, 0x64, 0x0, 0x1, 0x29, 0x0, @multicast2, @multicast1, {[@end, @lsrr={0x83, 0x1f, 0x2f, [@multicast2, @local, @local, @multicast1, @rand_addr=0x64010102, @loopback, @private=0xa010100]}, @rr={0x7, 0x27, 0x6c, [@multicast1, @rand_addr=0x64010102, @remote, @multicast1, @loopback, @initdev={0xac, 0x1e, 0x0, 0x0}, @initdev={0xac, 0x1e, 0x1, 0x0}, @broadcast, @empty]}, @ra={0x94, 0x4, 0x1}, @timestamp={0x44, 0x10, 0x2d, 0x0, 0x8, [0x1, 0x100, 0x401]}, @ssrr={0x89, 0x13, 0x56, [@dev={0xac, 0x14, 0x14, 0x28}, @multicast2, @initdev={0xac, 0x1e, 0x0, 0x0}, @remote]}, @ra={0x94, 0x4, 0x1}]}}}}}) mmap$IORING_OFF_CQ_RING(&(0x7f0000ffd000/0x3000)=nil, 0x3000, 0x2000008, 0x30, 0xffffffffffffffff, 0x8000000) r0 = syz_genetlink_get_family_id$nl802154(&(0x7f0000000400), 0xffffffffffffffff) sendmsg$NL802154_CMD_NEW_INTERFACE(0xffffffffffffffff, &(0x7f0000000540)={&(0x7f00000003c0)={0x10, 0x0, 0x0, 0x2}, 0xc, &(0x7f0000000500)={&(0x7f0000000480)={0x48, r0, 0x200, 0x70bd2a, 0x25dfdbfd, {}, [@NL802154_ATTR_IFNAME={0xa, 0x4, 'wpan0\x00'}, @NL802154_ATTR_IFINDEX={0x8}, @NL802154_ATTR_IFNAME={0xa, 0x4, 'wpan1\x00'}, @NL802154_ATTR_EXTENDED_ADDR={0xc, 0x17, {0xaaaaaaaaaaaa0002}}, @NL802154_ATTR_IFINDEX={0x8}]}, 0x48}}, 0x4001) mmap$binder(&(0x7f0000fef000/0x11000)=nil, 0x11000, 0x1, 0x11, 0xffffffffffffffff, 0x6) r1 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) sendmsg$IEEE802154_LLSEC_ADD_SECLEVEL(r1, &(0x7f00000006c0)={&(0x7f0000000580)={0x10, 0x0, 0x0, 0x4000000}, 0xc, &(0x7f0000000680)={&(0x7f0000000600)={0x44, 0x0, 0x200, 0x70bd2a, 0x25dfdbff, {}, [@IEEE802154_ATTR_LLSEC_FRAME_TYPE={0x5, 0x33, 0x34}, @IEEE802154_ATTR_DEV_INDEX={0x8}, @IEEE802154_ATTR_LLSEC_CMD_FRAME_ID={0x5, 0x34, 0x1}, @IEEE802154_ATTR_DEV_NAME={0xa, 0x1, 'wpan0\x00'}, @IEEE802154_ATTR_DEV_NAME={0xa, 0x1, 'wpan4\x00'}]}, 0x44}, 0x1, 0x0, 0x0, 0x8800}, 0x0) sendmsg$IEEE802154_START_REQ(r1, &(0x7f00000007c0)={&(0x7f0000000700)={0x10, 0x0, 0x0, 0x4}, 0xc, &(0x7f0000000780)={&(0x7f0000000740)={0x1c, 0x0, 0x200, 0x70bd2d, 0x25dfdbfb, {}, [@IEEE802154_ATTR_CHANNEL={0x5, 0x7, 0x6}]}, 0x1c}, 0x1, 0x0, 0x0, 0x40100}, 0x801) mlock(&(0x7f0000fef000/0x1000)=nil, 0x1000) syz_io_uring_setup(0x4726, &(0x7f0000000840)={0x0, 0x502f, 0x20, 0x0, 0x12e}, &(0x7f0000ffe000/0x2000)=nil, &(0x7f0000ffb000/0x4000)=nil, &(0x7f00000008c0), &(0x7f0000000900)) 17:47:31 executing program 5: pipe2$9p(&(0x7f0000000240), 0x0) syz_io_uring_setup(0x0, &(0x7f0000000280)={0x0, 0x2728, 0x2, 0x1, 0x37c}, &(0x7f0000000000/0x3000)=nil, &(0x7f0000000000/0x400000)=nil, &(0x7f0000000300), &(0x7f0000000340)) openat$nvram(0xffffffffffffff9c, &(0x7f0000000680), 0x400, 0x0) r0 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$ieee802154(&(0x7f0000000740), 0xffffffffffffffff) sendmsg$IEEE802154_LLSEC_DEL_KEY(r0, &(0x7f0000000840)={&(0x7f0000000700)={0x10, 0x0, 0x0, 0x800000}, 0xc, &(0x7f0000000800)={&(0x7f0000000780)={0x54, r1, 0x800, 0x70bd27, 0x25dfdbfc, {}, [@IEEE802154_ATTR_LLSEC_KEY_SOURCE_SHORT={0x8, 0x2c, 0x5}, @IEEE802154_ATTR_LLSEC_KEY_SOURCE_EXTENDED={0xc, 0x2d, {0xaaaaaaaaaaaa0002}}, @IEEE802154_ATTR_PAN_ID={0x6, 0x6, 0x2}, @IEEE802154_ATTR_DEV_INDEX={0x8}, @IEEE802154_ATTR_LLSEC_KEY_MODE={0x5, 0x2b, 0x1}, @IEEE802154_ATTR_HW_ADDR={0xc, 0x5, {0xaaaaaaaaaaaa0002}}, @IEEE802154_ATTR_LLSEC_KEY_MODE={0x5, 0x2b, 0x3}]}, 0x54}, 0x1, 0x0, 0x0, 0x40}, 0x2000c814) clock_getres(0x3, &(0x7f0000000880)) r2 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) sendmsg$IEEE802154_ADD_IFACE(r2, &(0x7f0000000a00)={&(0x7f0000000900)={0x10, 0x0, 0x0, 0x40c}, 0xc, &(0x7f00000009c0)={&(0x7f0000000940)={0x44, r1, 0x200, 0x70bd29, 0x25dfdbfe, {}, [@IEEE802154_ATTR_PHY_NAME={0x9, 0x1f, 'phy1\x00'}, @IEEE802154_ATTR_DEV_NAME={0xa, 0x1, 'wpan4\x00'}, @IEEE802154_ATTR_DEV_NAME={0xa, 0x1, 'wpan1\x00'}, @IEEE802154_ATTR_DEV_NAME={0xa, 0x1, 'wpan0\x00'}]}, 0x44}, 0x1, 0x0, 0x0, 0x20000084}, 0x44000) 17:47:31 executing program 7: clock_gettime(0x5, &(0x7f0000000000)) clock_settime(0x2, &(0x7f0000000040)) sched_rr_get_interval(0xffffffffffffffff, &(0x7f0000000080)) sched_rr_get_interval(0x0, &(0x7f00000000c0)) sendmsg$NL802154_CMD_GET_SEC_KEY(0xffffffffffffffff, &(0x7f00000001c0)={&(0x7f0000000100)={0x10, 0x0, 0x0, 0x20000000}, 0xc, &(0x7f0000000180)={&(0x7f0000000140)={0x24, 0x0, 0x200, 0x70bd26, 0x25dfdbfe, {}, [@NL802154_ATTR_IFINDEX={0x8}, @NL802154_ATTR_IFINDEX={0x8}]}, 0x24}, 0x1, 0x0, 0x0, 0x4000000}, 0x181) clock_gettime(0x0, &(0x7f0000000200)) pipe2$9p(&(0x7f0000000240)={0xffffffffffffffff, 0xffffffffffffffff}, 0x800) r1 = syz_io_uring_setup(0x776a, &(0x7f0000000280)={0x0, 0x2728, 0x2, 0x1, 0x37c}, &(0x7f0000000000/0x3000)=nil, &(0x7f0000000000/0x400000)=nil, &(0x7f0000000300), &(0x7f0000000340)) ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, &(0x7f0000000540)={0x64, 0x0, &(0x7f0000000440)=[@transaction_sg={0x40486311, {0x1, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x50, 0x18, &(0x7f0000000380)={@fd={0x66642a85, 0x0, r0}, @fd={0x66642a85, 0x0, r1}, @fda={0x66646185, 0x0, 0x2, 0x36}}, &(0x7f0000000400)={0x0, 0x18, 0x30}}}, @request_death, @release={0x40046306, 0x1}], 0x7e, 0x0, &(0x7f00000004c0)="7685c519d1cbea63a1a8f022f8c0085baf770aa5d1fa9bfb1a5399fdb134953d619e962218bba650b68d6206fde39ff17760aa4bbcb62f6802c48e17294a17a3b768ab60bbae37aa37e33e24b09f6bdea37853f7ab2622451803788c9d172b7d71d6d87911129b8ef5cc9e0169404b09abfa991f3a7a3640686df445d387"}) pipe2$9p(&(0x7f0000000580), 0x800) ioctl$EVIOCGVERSION(0xffffffffffffffff, 0x80044501, &(0x7f00000005c0)=""/174) clock_getres(0x3, &(0x7f0000000880)) 17:47:31 executing program 2: clock_gettime(0x5, &(0x7f0000000000)) clock_settime(0x2, &(0x7f0000000040)) sched_rr_get_interval(0xffffffffffffffff, &(0x7f0000000080)) sched_rr_get_interval(0x0, &(0x7f00000000c0)) sendmsg$NL802154_CMD_GET_SEC_KEY(0xffffffffffffffff, &(0x7f00000001c0)={&(0x7f0000000100)={0x10, 0x0, 0x0, 0x20000000}, 0xc, &(0x7f0000000180)={&(0x7f0000000140)={0x24, 0x0, 0x200, 0x70bd26, 0x25dfdbfe, {}, [@NL802154_ATTR_IFINDEX={0x8}, @NL802154_ATTR_IFINDEX={0x8}]}, 0x24}, 0x1, 0x0, 0x0, 0x4000000}, 0x181) clock_gettime(0x0, &(0x7f0000000200)) pipe2$9p(&(0x7f0000000240)={0xffffffffffffffff, 0xffffffffffffffff}, 0x800) r1 = syz_io_uring_setup(0x776a, &(0x7f0000000280)={0x0, 0x2728, 0x2, 0x1, 0x37c}, &(0x7f0000000000/0x3000)=nil, &(0x7f0000000000/0x400000)=nil, &(0x7f0000000300), &(0x7f0000000340)) ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, &(0x7f0000000540)={0x64, 0x0, &(0x7f0000000440)=[@transaction_sg={0x40486311, {0x1, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x50, 0x18, &(0x7f0000000380)={@fd={0x66642a85, 0x0, r0}, @fd={0x66642a85, 0x0, r1}, @fda={0x66646185, 0x0, 0x2, 0x36}}, &(0x7f0000000400)={0x0, 0x18, 0x30}}}, @request_death, @release={0x40046306, 0x1}], 0x7e, 0x0, &(0x7f00000004c0)="7685c519d1cbea63a1a8f022f8c0085baf770aa5d1fa9bfb1a5399fdb134953d619e962218bba650b68d6206fde39ff17760aa4bbcb62f6802c48e17294a17a3b768ab60bbae37aa37e33e24b09f6bdea37853f7ab2622451803788c9d172b7d71d6d87911129b8ef5cc9e0169404b09abfa991f3a7a3640686df445d387"}) pipe2$9p(&(0x7f0000000580), 0x800) ioctl$EVIOCGVERSION(0xffffffffffffffff, 0x80044501, &(0x7f00000005c0)=""/174) syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) clock_getres(0x3, &(0x7f0000000880)) 17:47:31 executing program 4: r0 = perf_event_open(&(0x7f00000000c0)={0x1, 0x80, 0x0, 0xc0, 0xfa, 0x1, 0x0, 0x7fffffff, 0x10811, 0x1, 0x1, 0x1, 0x1, 0x1, 0x1, 0x1, 0x1, 0x1, 0x0, 0x1, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x1, 0x0, 0x1, 0x0, 0x0, 0x0, 0x1, 0x1, 0x1, 0x1, 0x1, 0x1, 0x1, 0x0, 0x1, 0x1, 0x1, 0x1, 0x0, 0x0, 0xfff, 0x7, @perf_config_ext={0x7, 0x7fffffff}, 0x41000, 0x80000000, 0x5, 0x3, 0x9, 0x2, 0x9, 0x0, 0x5, 0x0, 0x4}, 0x0, 0xb, 0xffffffffffffffff, 0x1) perf_event_open(&(0x7f0000000040)={0x0, 0x80, 0x0, 0x40, 0x80, 0x9, 0x0, 0x3, 0x10040, 0x1, 0x0, 0x0, 0x1, 0x1, 0x1, 0x1, 0x1, 0x1, 0x1, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x3, 0x1, 0x0, 0x1, 0x0, 0x1, 0x1, 0x0, 0x0, 0x1, 0x1, 0x1, 0x0, 0x1, 0x0, 0x0, 0x0, 0x1, 0x0, 0x1, 0x0, 0x1, 0x0, 0x0, 0x1, @perf_bp={&(0x7f0000000000), 0x10}, 0x8080, 0x800, 0x2, 0x3, 0x36dc, 0x31df3b33, 0xff, 0x0, 0x9, 0x0, 0x5}, 0xffffffffffffffff, 0x9, r0, 0x9) ioctl$PERF_EVENT_IOC_PAUSE_OUTPUT(r0, 0x40042409, 0x0) ioctl$PERF_EVENT_IOC_PERIOD(0xffffffffffffffff, 0x40082404, &(0x7f0000000140)=0x8) socket$inet_udplite(0x2, 0x2, 0x88) ioctl$SNDRV_SEQ_IOCTL_SYSTEM_INFO(0xffffffffffffffff, 0xc0305302, &(0x7f0000000300)={0x9, 0x101, 0x1, 0x6, 0x3, 0x5}) syz_open_procfs(0x0, &(0x7f0000000340)='children\x00') 17:47:31 executing program 3: clock_gettime(0x5, &(0x7f0000000000)) clock_settime(0x2, &(0x7f0000000040)) sched_rr_get_interval(0xffffffffffffffff, &(0x7f0000000080)) sched_rr_get_interval(0x0, &(0x7f00000000c0)) sendmsg$NL802154_CMD_GET_SEC_KEY(0xffffffffffffffff, &(0x7f00000001c0)={&(0x7f0000000100)={0x10, 0x0, 0x0, 0x20000000}, 0xc, &(0x7f0000000180)={&(0x7f0000000140)={0x24, 0x0, 0x200, 0x70bd26, 0x25dfdbfe, {}, [@NL802154_ATTR_IFINDEX={0x8}, @NL802154_ATTR_IFINDEX={0x8}]}, 0x24}, 0x1, 0x0, 0x0, 0x4000000}, 0x181) clock_gettime(0x0, &(0x7f0000000200)) pipe2$9p(&(0x7f0000000240)={0xffffffffffffffff, 0xffffffffffffffff}, 0x800) r1 = syz_io_uring_setup(0x776a, &(0x7f0000000280)={0x0, 0x2728, 0x2, 0x1, 0x37c}, &(0x7f0000000000/0x3000)=nil, &(0x7f0000000000/0x400000)=nil, &(0x7f0000000300), &(0x7f0000000340)) ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, &(0x7f0000000540)={0x64, 0x0, &(0x7f0000000440)=[@transaction_sg={0x40486311, {0x1, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x50, 0x18, &(0x7f0000000380)={@fd={0x66642a85, 0x0, r0}, @fd={0x66642a85, 0x0, r1}, @fda={0x66646185, 0x0, 0x2, 0x36}}, &(0x7f0000000400)={0x0, 0x18, 0x30}}}, @request_death, @release={0x40046306, 0x1}], 0x7e, 0x0, &(0x7f00000004c0)="7685c519d1cbea63a1a8f022f8c0085baf770aa5d1fa9bfb1a5399fdb134953d619e962218bba650b68d6206fde39ff17760aa4bbcb62f6802c48e17294a17a3b768ab60bbae37aa37e33e24b09f6bdea37853f7ab2622451803788c9d172b7d71d6d87911129b8ef5cc9e0169404b09abfa991f3a7a3640686df445d387"}) pipe2$9p(&(0x7f0000000580), 0x800) r2 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r3 = syz_genetlink_get_family_id$ieee802154(&(0x7f0000000740), 0xffffffffffffffff) sendmsg$IEEE802154_LLSEC_DEL_KEY(r2, &(0x7f0000000840)={&(0x7f0000000700)={0x10, 0x0, 0x0, 0x800000}, 0xc, &(0x7f0000000800)={&(0x7f0000000780)={0x54, r3, 0x800, 0x70bd27, 0x25dfdbfc, {}, [@IEEE802154_ATTR_LLSEC_KEY_SOURCE_SHORT={0x8, 0x2c, 0x5}, @IEEE802154_ATTR_LLSEC_KEY_SOURCE_EXTENDED={0xc, 0x2d, {0xaaaaaaaaaaaa0002}}, @IEEE802154_ATTR_PAN_ID={0x6, 0x6, 0x2}, @IEEE802154_ATTR_DEV_INDEX={0x8}, @IEEE802154_ATTR_LLSEC_KEY_MODE={0x5, 0x2b, 0x1}, @IEEE802154_ATTR_HW_ADDR={0xc, 0x5, {0xaaaaaaaaaaaa0002}}, @IEEE802154_ATTR_LLSEC_KEY_MODE={0x5, 0x2b, 0x3}]}, 0x54}, 0x1, 0x0, 0x0, 0x40}, 0x2000c814) 17:47:31 executing program 0: get_thread_area(&(0x7f0000000000)={0x7, 0x20000800, 0x4000, 0x0, 0x1, 0x0, 0x0, 0x1, 0x1, 0x1}) r0 = openat$vcsu(0xffffffffffffff9c, &(0x7f0000000040), 0x200000, 0x0) r1 = openat$nvram(0xffffffffffffff9c, &(0x7f0000000100), 0x2000, 0x0) setsockopt$inet_tcp_int(r1, 0x6, 0x1b, &(0x7f0000000180)=0x5, 0x4) ioctl$SNDRV_TIMER_IOCTL_STATUS32(r1, 0x80585414, &(0x7f00000001c0)) setsockopt$inet_tcp_TCP_QUEUE_SEQ(r0, 0x6, 0x15, &(0x7f0000000240)=0x1, 0x4) r2 = socket$inet_tcp(0x2, 0x1, 0x0) ioctl$sock_inet_tcp_SIOCINQ(r2, 0x541b, &(0x7f00000003c0)) move_pages(0x0, 0x8, &(0x7f0000000400)=[&(0x7f0000ffd000/0x1000)=nil, &(0x7f0000ffd000/0x3000)=nil, &(0x7f0000ffd000/0x3000)=nil, &(0x7f0000ffb000/0x2000)=nil, &(0x7f0000ffc000/0x1000)=nil, &(0x7f0000ffe000/0x2000)=nil, &(0x7f0000ffb000/0x4000)=nil, &(0x7f0000ffd000/0x3000)=nil], &(0x7f0000000440)=[0xfff], &(0x7f0000000480)=[0x0, 0x0, 0x0], 0x4) r3 = syz_genetlink_get_family_id$SEG6(&(0x7f0000000500), r1) sendmsg$SEG6_CMD_GET_TUNSRC(r0, &(0x7f00000005c0)={&(0x7f00000004c0)={0x10, 0x0, 0x0, 0x4000000}, 0xc, &(0x7f0000000580)={&(0x7f0000000540)={0x38, r3, 0x300, 0x70bd2a, 0x25dfdbfc, {}, [@SEG6_ATTR_HMACKEYID={0x8, 0x3, 0x24}, @SEG6_ATTR_DST={0x14, 0x1, @mcast1}, @SEG6_ATTR_DSTLEN={0x8, 0x2, 0x2}]}, 0x38}, 0x1, 0x0, 0x0, 0x20008810}, 0x4040010) sendmsg$SEG6_CMD_DUMPHMAC(0xffffffffffffffff, &(0x7f0000000740)={&(0x7f0000000680)={0x10, 0x0, 0x0, 0x240000}, 0xc, &(0x7f0000000700)={&(0x7f00000006c0)={0x2c, r3, 0x1, 0x70bd2c, 0x25dfdbfe, {}, [@SEG6_ATTR_SECRET={0x8, 0x4, [0x1]}, @SEG6_ATTR_DSTLEN={0x8, 0x2, 0x5}, @SEG6_ATTR_DSTLEN={0x8}]}, 0x2c}, 0x1, 0x0, 0x0, 0x4000000}, 0x4000000) pidfd_getfd(r1, r2, 0x0) syz_genetlink_get_family_id$ieee802154(&(0x7f0000000800), 0xffffffffffffffff) 17:47:31 executing program 4: r0 = perf_event_open(&(0x7f00000000c0)={0x1, 0x80, 0x0, 0xc0, 0xfa, 0x1, 0x0, 0x7fffffff, 0x10811, 0x1, 0x1, 0x1, 0x1, 0x1, 0x1, 0x1, 0x1, 0x1, 0x0, 0x1, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x1, 0x0, 0x1, 0x0, 0x0, 0x0, 0x1, 0x1, 0x1, 0x1, 0x1, 0x1, 0x1, 0x0, 0x1, 0x1, 0x1, 0x1, 0x0, 0x0, 0xfff, 0x7, @perf_config_ext={0x7, 0x7fffffff}, 0x41000, 0x80000000, 0x5, 0x3, 0x9, 0x2, 0x9, 0x0, 0x5, 0x0, 0x4}, 0x0, 0xb, 0xffffffffffffffff, 0x1) perf_event_open(&(0x7f0000000040)={0x0, 0x80, 0x0, 0x40, 0x80, 0x9, 0x0, 0x3, 0x10040, 0x1, 0x0, 0x0, 0x1, 0x1, 0x1, 0x1, 0x1, 0x1, 0x1, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x3, 0x1, 0x0, 0x1, 0x0, 0x1, 0x1, 0x0, 0x0, 0x1, 0x1, 0x1, 0x0, 0x1, 0x0, 0x0, 0x0, 0x1, 0x0, 0x1, 0x0, 0x1, 0x0, 0x0, 0x1, @perf_bp={&(0x7f0000000000), 0x10}, 0x8080, 0x800, 0x2, 0x3, 0x36dc, 0x31df3b33, 0xff, 0x0, 0x9, 0x0, 0x5}, 0xffffffffffffffff, 0x9, r0, 0x9) ioctl$PERF_EVENT_IOC_PAUSE_OUTPUT(r0, 0x40042409, 0x0) ioctl$PERF_EVENT_IOC_PERIOD(0xffffffffffffffff, 0x40082404, &(0x7f0000000140)=0x8) ioctl$sock_ipv4_tunnel_SIOCADDTUNNEL(0xffffffffffffffff, 0x89f1, &(0x7f00000001c0)={'syztnl1\x00', &(0x7f0000000180)={'syztnl0\x00', 0x0, 0x1, 0x40, 0x0, 0x5, {{0x5, 0x4, 0x2, 0x19, 0x14, 0x65, 0x0, 0x1f, 0x4, 0x0, @multicast2, @remote}}}}) ioctl$SNDRV_SEQ_IOCTL_SYSTEM_INFO(0xffffffffffffffff, 0xc0305302, &(0x7f0000000300)={0x9, 0x101, 0x1, 0x6, 0x3, 0x5}) syz_open_procfs(0x0, &(0x7f0000000340)='children\x00') SYZFAIL: failed to write(kmemleak, "scan") (errno 1: Operation not permitted) BUG: leak checking failed VM DIAGNOSIS: 17:47:31 Registers: info registers vcpu 0 RAX=dffffc0000000000 RBX=ffff88800a3cfc60 RCX=ffff88800a3cf804 RDX=0000000000000000 RSI=ffffffff85c1c760 RDI=ffff88800afb567c RBP=ffff88800afb5280 RSP=ffff88800a3cf810 R8 =0000000000000001 R9 =ffff88800a3cf8f0 R10=000000000003be53 R11=000000000001193c R12=ffff88800a3cf901 R13=ffff88800a3cf8f8 R14=ffff88800a3cfc30 R15=ffff88800a3cf8b0 RIP=ffffffff815bead0 RFL=00000217 [----APC] CPL=0 II=0 A20=1 SMM=0 HLT=0 ES =0000 0000000000000000 00000000 00000000 CS =0010 0000000000000000 ffffffff 00a09b00 DPL=0 CS64 [-RA] SS =0018 0000000000000000 ffffffff 00c09300 DPL=0 DS [-WA] DS =0000 0000000000000000 00000000 00000000 FS =0000 0000000000000000 00000000 00000000 GS =0000 ffff8880e55dd000 00000000 00000000 LDT=0000 fffffe1900000000 00000000 00000000 TR =0040 fffffe0000003000 00004087 00008b00 DPL=0 TSS64-busy GDT= fffffe0000001000 0000007f IDT= fffffe0000000000 00000fff CR0=80050033 CR2=0000556e20873001 CR3=000000000c4b8000 CR4=00350ef0 DR0=0000000000000000 DR1=0000000000000000 DR2=0000000000000000 DR3=0000000000000000 DR6=00000000ffff0ff0 DR7=0000000000000400 EFER=0000000000000d01 FCW=037f FSW=0000 [ST=0] FTW=00 MXCSR=00001f80 FPR0=0000000000000000 0000 FPR1=0000000000000000 0000 FPR2=0000000000000000 0000 FPR3=0000000000000000 0000 FPR4=0000000000000000 0000 FPR5=0000000000000000 0000 FPR6=0000000000000000 0000 FPR7=0000000000000000 0000 XMM00=7269762f736563697665642f7379732f XMM01=622f6c6175747269762f736563697665 XMM02=ffffff0f0e0d0c0b0a09080706050403 XMM03=696e656420737365636341002f737973 XMM04=2f2f2f2f2f2f2f2f2f2f2f2f2f2f2f2f XMM05=0000556e2084c7000000556e2084c6e0 XMM06=000000000000000000000000ffffffff XMM07=00000000000000000000000000000000 XMM08=2f63697361622f6372732f2e2e000d0a XMM09=00000000000000000000000000000000 XMM10=00000000002000000000000000200000 XMM11=00000000000000000000000000000000 XMM12=00000000000000000000000000000000 XMM13=00000000000000000000000000000000 XMM14=00000000000000000000000000000000 XMM15=00000000000000000000000000000000 info registers vcpu 1 RAX=dffffc0000000000 RBX=0000000000000001 RCX=ffffffff84bba95c RDX=000000000003bba9 RSI=000000000003bba9 RDI=ffffffff86d88408 RBP=ffff88806cf086b0 RSP=ffff88806cf085e8 R8 =0000000000000000 R9 =0000000000000000 R10=000000000003be53 R11=0000000000000001 R12=ffff88806cf086b8 R13=ffff88806cf086a0 R14=ffff88806cf08699 R15=ffff88806cf08658 RIP=ffffffff81358542 RFL=00000216 [----AP-] CPL=0 II=0 A20=1 SMM=0 HLT=0 ES =0000 0000000000000000 00000000 00000000 CS =0010 0000000000000000 ffffffff 00a09b00 DPL=0 CS64 [-RA] SS =0018 0000000000000000 ffffffff 00c09300 DPL=0 DS [-WA] DS =0000 0000000000000000 00000000 00000000 FS =0000 0000000000000000 00000000 00000000 GS =0000 ffff8880e56dd000 00000000 00000000 LDT=0000 fffffe2300000000 00000000 00000000 TR =0040 fffffe000004a000 00004087 00008b00 DPL=0 TSS64-busy GDT= fffffe0000048000 0000007f IDT= fffffe0000000000 00000fff CR0=80050033 CR2=0000556e20826f28 CR3=000000000dcc7000 CR4=00350ef0 DR0=0000000000000000 DR1=0000000000000000 DR2=0000000000000000 DR3=0000000000000000 DR6=00000000ffff0ff0 DR7=0000000000000400 EFER=0000000000000d01 FCW=037f FSW=0000 [ST=0] FTW=00 MXCSR=00001fa0 FPR0=0000000000000000 0000 FPR1=0000000000000000 0000 FPR2=0000000000000000 0000 FPR3=0000000000000000 0000 FPR4=0000000000000000 0000 FPR5=0000000000000000 0000 FPR6=0000000000000000 0000 FPR7=0000000000000000 0000 XMM00=00000000000000000000000000000000 XMM01=00000000000000000000000000000000 XMM02=0000000000000000bfe62e42fefa39ef XMM03=0000ff00000000000000000000000000 XMM04=732f6c61636f6c2f7273752f3d485441 XMM05=622f6c61636f6c2f7273752f3a6e6962 XMM06=73752f3a6e6962732f7273752f3a6e69 XMM07=6e69622f3a6e6962732f3a6e69622f72 XMM08=00000000000000000000000000000000 XMM09=00000000000000000000000000000000 XMM10=00000000000000000000000000000000 XMM11=00000000000000000000000000000000 XMM12=00000000000000000000000000000000 XMM13=00000000000000000000000000000000 XMM14=00000000000000000000000000000000 XMM15=00000000000000000000000000000000