{0x0, 0x7, {0x3, 0x7fff}}, {0x6850, 0x29e, {0x3, 0x9}}]}}}]}, 0x710}, 0x1, 0x0, 0x0, 0x11}, 0x71272780a8dc51e3) ioctl$SCSI_IOCTL_GET_IDLUN(r3, 0x5382, &(0x7f0000000f40)) sendmsg$NFQNL_MSG_VERDICT_BATCH(r3, &(0x7f0000001080)={&(0x7f0000000f80)={0x10, 0x0, 0x0, 0x20000}, 0xc, &(0x7f0000001040)={&(0x7f0000000fc0)={0x50, 0x3, 0x3, 0x101, 0x0, 0x0, {0xc, 0x0, 0x8}, [@NFQA_MARK={0x8, 0x3, 0x1, 0x0, 0x1}, @NFQA_VERDICT_HDR={0xc, 0x2, {0xfffffffffffffffd, 0x7}}, @NFQA_VERDICT_HDR={0xc, 0x2, {0x0, 0x2}}, @NFQA_VERDICT_HDR={0xc, 0x2, {0xfffffffffffffffe, 0x3}}, @NFQA_MARK={0x8, 0x3, 0x1, 0x0, 0x5}, @NFQA_MARK={0x8}]}, 0x50}, 0x1, 0x0, 0x0, 0x8080}, 0x8115) io_uring_setup(0x7c8f, &(0x7f0000001140)={0x0, 0xc240, 0x10, 0x3, 0x1c7, 0x0, r4}) 21:14:00 executing program 4: recvmmsg(0xffffffffffffffff, &(0x7f0000000280)=[{{0x0, 0x0, &(0x7f0000000140)=[{&(0x7f0000000000)=""/11, 0xb}, {&(0x7f0000000040)=""/238, 0xee}], 0x2, &(0x7f0000000180)=""/244, 0xf4}, 0xb67}], 0x1, 0x102, 0x0) sendmsg$NFULNL_MSG_CONFIG(0xffffffffffffffff, &(0x7f00000003c0)={&(0x7f00000002c0)={0x10, 0x0, 0x0, 0x1000000}, 0xc, &(0x7f0000000380)={&(0x7f0000000300)={0x50, 0x1, 0x4, 0x101, 0x0, 0x0, {0xc, 0x0, 0x3}, [@NFULA_CFG_MODE={0xa, 0x2, {0x0, 0x2}}, @NFULA_CFG_QTHRESH={0x8, 0x5, 0x1, 0x0, 0xffffffc0}, @NFULA_CFG_TIMEOUT={0x8, 0x4, 0x1, 0x0, 0x54}, @NFULA_CFG_FLAGS={0x6}, @NFULA_CFG_TIMEOUT={0x8, 0x4, 0x1, 0x0, 0x6}, @NFULA_CFG_NLBUFSIZ={0x8, 0x3, 0x1, 0x0, 0x7f}, @NFULA_CFG_NLBUFSIZ={0x8, 0x3, 0x1, 0x0, 0x8}]}, 0x50}, 0x1, 0x0, 0x0, 0x408d4}, 0x20000091) r0 = openat$procfs(0xffffffffffffff9c, &(0x7f0000000400)='/proc/schedstat\x00', 0x0, 0x0) syz_io_uring_submit(0x0, 0x0, &(0x7f0000000440)=@IORING_OP_SPLICE={0x1e, 0x2, 0x0, @fd, 0x9, {}, 0x830, 0xa, 0x0, {0x0, 0x0, r0}}, 0x5) connect$bt_l2cap(r0, &(0x7f0000000480)={0x1f, 0x71, @none, 0x4, 0x2}, 0xe) r1 = syz_open_dev$vcsa(&(0x7f00000004c0), 0x20, 0xc0101) setsockopt$bt_BT_SNDMTU(r1, 0x112, 0xc, &(0x7f0000000500), 0x2) r2 = syz_open_dev$sg(&(0x7f0000000540), 0x9, 0x18000) ioctl$SCSI_IOCTL_PROBE_HOST(r2, 0x5385, &(0x7f0000000580)={0xa2, ""/162}) syz_genetlink_get_family_id$mptcp(&(0x7f0000000640), r0) sendmsg$IPCTNL_MSG_CT_GET(r0, &(0x7f00000007c0)={&(0x7f0000000680)={0x10, 0x0, 0x0, 0x800000}, 0xc, &(0x7f0000000780)={&(0x7f00000006c0)={0xa4, 0x1, 0x1, 0x101, 0x0, 0x0, {0x0, 0x0, 0x8}, [@CTA_TUPLE_REPLY={0x4c, 0x2, 0x0, 0x1, [@CTA_TUPLE_PROTO={0xc, 0x2, 0x0, 0x1, {0x5, 0x1, 0x3a}}, @CTA_TUPLE_ZONE={0x6, 0x3, 0x1, 0x0, 0x1}, @CTA_TUPLE_ZONE={0x6, 0x3, 0x1, 0x0, 0x1}, @CTA_TUPLE_IP={0x2c, 0x1, 0x0, 0x1, @ipv6={{0x14, 0x3, @empty}, {0x14, 0x4, @dev={0xfe, 0x80, '\x00', 0x2a}}}}]}, @CTA_SEQ_ADJ_ORIG={0x24, 0xf, 0x0, 0x1, [@CTA_SEQADJ_CORRECTION_POS={0x8, 0x1, 0x1, 0x0, 0xc40f}, @CTA_SEQADJ_OFFSET_AFTER={0x8, 0x3, 0x1, 0x0, 0x9}, @CTA_SEQADJ_CORRECTION_POS={0x8}, @CTA_SEQADJ_CORRECTION_POS={0x8, 0x1, 0x1, 0x0, 0x8001}]}, @CTA_SEQ_ADJ_REPLY={0x14, 0x10, 0x0, 0x1, [@CTA_SEQADJ_OFFSET_BEFORE={0x8, 0x2, 0x1, 0x0, 0x6}, @CTA_SEQADJ_CORRECTION_POS={0x8, 0x1, 0x1, 0x0, 0x9}]}, @CTA_LABELS={0xc, 0x16, 0x1, 0x0, [0x8, 0x2]}]}, 0xa4}, 0x1, 0x0, 0x0, 0x41804}, 0x8095) bind$bt_l2cap(0xffffffffffffffff, &(0x7f0000000dc0)={0x1f, 0xb9e5, @fixed={'\xaa\xaa\xaa\xaa\xaa', 0x12}, 0x1f, 0x1}, 0xe) 21:14:00 executing program 6: r0 = request_key(&(0x7f0000000000)='dns_resolver\x00', &(0x7f0000000040)={'syz', 0x1}, &(0x7f0000000080)=',{{\x00', 0x0) r1 = add_key$keyring(&(0x7f0000000140), &(0x7f0000000180)={'syz', 0x1}, 0x0, 0x0, r0) r2 = add_key$keyring(&(0x7f00000000c0), &(0x7f0000000100)={'syz', 0x3}, 0x0, 0x0, r1) r3 = add_key(&(0x7f00000002c0)='keyring\x00', &(0x7f0000000300)={'syz', 0x0}, &(0x7f0000000340)="b2513106f064e11f553a90a7963719ea01c1290fb605a18636b528a3487b9ab36c7e4bd67fbf8e67", 0x28, r2) add_key$fscrypt_v1(&(0x7f00000001c0), &(0x7f0000000200)={'fscrypt:', @auto=[0x33, 0x31, 0x36, 0x6a, 0x33, 0x38, 0x65, 0x32, 0x34, 0x4, 0x35, 0x61, 0x0, 0x62, 0x33, 0xb1]}, &(0x7f0000000240)={0x0, "67fe36c9b2f9ec15ba3b297e79535fb785fc878cdb6d0c047ce0b9dc30e9c8f939461a73fd6905462f35f71fff021b998365789e6ddb39c7159cc0a59c187e43", 0x27}, 0x48, r3) openat$procfs(0xffffffffffffff9c, &(0x7f0000000380)='/proc/keys\x00', 0x0, 0x0) keyctl$KEYCTL_PKEY_SIGN(0x1b, &(0x7f00000009c0)={r1, 0x6c, 0x6d}, &(0x7f0000000a00)={'enc=', 'pkcs1', ' hash=', {'nhpoly1305-generic\x00'}}, &(0x7f0000000a80)="64824bc7426fe2f3e3c1e475569073ecff8ffb96e46626b91f3b9a2b2ac07610524644af1e29c43d27e1d513a86909a6ac4d9753ce88f3f3d0beb31db8dfdbcb65379a9cc111189465a0cd8a50f7c19f1579f44a95805d41c0c92de97999b1d961ee48d58cfddc3720b2cd20", &(0x7f0000000b00)=""/109) 21:14:00 executing program 5: ptrace$peekuser(0x3, 0xffffffffffffffff, 0x3ff) prctl$PR_MPX_ENABLE_MANAGEMENT(0x2b) clock_adjtime(0x0, &(0x7f0000000000)={0xf0, 0xfff, 0x6, 0x40, 0x1ff, 0x1ff, 0x1, 0xe1, 0x5, 0xe68c, 0x95c, 0x1000, 0xe, 0x100000000, 0x8000, 0x2, 0x6, 0xab, 0xffff, 0x3, 0xff, 0x9, 0x6a9f, 0x1, 0x4, 0xfffffffffffffff9}) prctl$PR_MPX_ENABLE_MANAGEMENT(0x2b) ioctl$SCSI_IOCTL_DOORUNLOCK(0xffffffffffffffff, 0x5381) ioctl$SG_GET_TIMEOUT(0xffffffffffffffff, 0x2202, 0x0) r0 = syz_open_dev$vcsa(&(0x7f0000000100), 0x1, 0x80100) ioctl$SCSI_IOCTL_DOORLOCK(r0, 0x5380) r1 = syz_open_dev$vcsa(&(0x7f0000000140), 0xb6, 0x101000) ioctl$SCSI_IOCTL_DOORUNLOCK(r1, 0x5381) sendmsg$NL80211_CMD_ASSOCIATE(r1, &(0x7f0000000440)={&(0x7f0000000300)={0x10, 0x0, 0x0, 0x8000000}, 0xc, &(0x7f0000000400)={&(0x7f0000000380)={0x54, 0x0, 0x4, 0x70bd2c, 0x25dfdbff, {{}, {@val={0x8}, @val={0xc, 0x99, {0x0, 0x78}}}}, [@NL80211_ATTR_SSID={0xa, 0x34, @default_ap_ssid}, @NL80211_ATTR_HT_CAPABILITY={0x1e, 0x1f, {0x300, 0x1, 0x1, 0x0, {0x6, 0x4c, 0x0, 0x4, 0x0, 0x1, 0x0, 0x1, 0x1}, 0x400, 0x2, 0x6}}]}, 0x54}}, 0x0) 21:14:00 executing program 3: r0 = openat$vcsa(0xffffffffffffff9c, &(0x7f0000000000), 0x180, 0x0) ioctl$SG_SET_FORCE_PACK_ID(r0, 0x227b, &(0x7f0000000040)=0x1) ioctl$SCSI_IOCTL_GET_BUS_NUMBER(r0, 0x5386, &(0x7f0000000080)) r1 = openat$hwrng(0xffffffffffffff9c, &(0x7f00000000c0), 0x22400, 0x0) ioctl$SCSI_IOCTL_DOORUNLOCK(r1, 0x5381) syz_open_dev$sg(&(0x7f0000000400), 0x494, 0x22000) 21:14:00 executing program 2: ioctl$SCSI_IOCTL_DOORUNLOCK(0xffffffffffffffff, 0x5381) r0 = syz_open_dev$mouse(&(0x7f0000000000), 0x578, 0x4000) ioctl$SG_GET_PACK_ID(r0, 0x227c, &(0x7f0000000040)) r1 = syz_genetlink_get_family_id$nl80211(&(0x7f00000000c0), r0) sendmsg$NL80211_CMD_NEW_KEY(r0, &(0x7f00000001c0)={&(0x7f0000000080)={0x10, 0x0, 0x0, 0x10}, 0xc, &(0x7f0000000180)={&(0x7f0000000100)={0x60, r1, 0x400, 0x70bd2b, 0x25dfdbff, {{}, {@val={0x8}, @void}}, [@NL80211_ATTR_KEY_TYPE={0x8, 0x37, 0x1}, @NL80211_ATTR_KEY_DEFAULT_MGMT={0x4}, @NL80211_ATTR_KEY={0x2c, 0x50, 0x0, 0x1, [@NL80211_KEY_DATA_WEP40={0x9, 0x1, "93f3c5ad5d"}, @NL80211_KEY_DEFAULT_TYPES={0x8, 0x8, 0x0, 0x1, [@NL80211_KEY_DEFAULT_TYPE_MULTICAST={0x4}]}, @NL80211_KEY_DATA_WEP104={0x11, 0x1, "8815558ac60368b42ebdf03bdb"}]}, @NL80211_ATTR_KEY_DATA_WEP40={0x9, 0x7, "74de692476"}]}, 0x60}, 0x1, 0x0, 0x0, 0x4000000}, 0x8000) r2 = openat$procfs(0xffffffffffffff9c, &(0x7f0000000200)='/proc/stat\x00', 0x0, 0x0) ioctl$SG_GET_TIMEOUT(r2, 0x2202, 0x0) ioctl$SG_SET_FORCE_PACK_ID(r0, 0x227b, &(0x7f0000000240)=0x1) ioctl$TUNGETIFF(r0, 0x800454d2, &(0x7f0000000280)={'vlan0\x00'}) sendmsg$NL80211_CMD_JOIN_MESH(r0, &(0x7f0000000400)={&(0x7f00000002c0)={0x10, 0x0, 0x0, 0x8}, 0xc, &(0x7f00000003c0)={&(0x7f0000000300)={0xc0, r1, 0x400, 0x70bd28, 0x25dfdbfc, {{}, {@void, @void}}, [@NL80211_ATTR_SOCKET_OWNER={0x4}, @NL80211_ATTR_MESH_SETUP={0xa8, 0x70, [@NL80211_MESH_SETUP_ENABLE_VENDOR_METRIC={0x5, 0x2, 0x1}, @NL80211_MESH_SETUP_IE={0x6b, 0x3, "432578a2646e5ab8df23d89ff57571f258fae075fd43855fb9486d9209824c25dbf24af1a18187d074463ff5b11350c72de592b494efe5b4f34cbc2a7a8a1160fd0a59dafb8fe7173e1b109dd23d0edf69c40605089d1c24278a427d497c415ba944a9a901d2b5"}, @NL80211_MESH_SETUP_USERSPACE_MPM={0x4}, @NL80211_MESH_SETUP_USERSPACE_AUTH={0x4}, @NL80211_MESH_SETUP_ENABLE_VENDOR_PATH_SEL={0x5, 0x1, 0x1}, @NL80211_MESH_SETUP_ENABLE_VENDOR_PATH_SEL={0x5, 0x1, 0x1}, @NL80211_MESH_SETUP_ENABLE_VENDOR_PATH_SEL={0x5, 0x1, 0x1}, @NL80211_MESH_SETUP_ENABLE_VENDOR_SYNC={0x5, 0x6, 0x1}, @NL80211_MESH_SETUP_USERSPACE_AUTH={0x4}, @NL80211_MESH_SETUP_USERSPACE_AMPE={0x4}]}]}, 0xc0}, 0x1, 0x0, 0x0, 0x10}, 0x4000001) ioctl$SCSI_IOCTL_DOORUNLOCK(r2, 0x5381) r3 = syz_open_dev$vcsa(&(0x7f0000000440), 0x56, 0x4000) r4 = syz_genetlink_get_family_id$nl80211(&(0x7f00000004c0), r0) ioctl$sock_SIOCGIFINDEX_80211(r0, 0x8933, &(0x7f0000000500)={'wlan0\x00', 0x0}) sendmsg$NL80211_CMD_SET_WDS_PEER(r3, &(0x7f0000000600)={&(0x7f0000000480)={0x10, 0x0, 0x0, 0x40}, 0xc, &(0x7f00000005c0)={&(0x7f0000000540)={0x64, r4, 0x100, 0x70bd2a, 0x25dfdbfc, {{}, {@val={0x8, 0x3, r5}, @void}}, [@NL80211_ATTR_MAC={0xa, 0x6, @from_mac}, @NL80211_ATTR_MAC={0xa, 0x6, @random="859953a6f042"}, @NL80211_ATTR_MAC={0xa, 0x6, @from_mac=@device_b}, @NL80211_ATTR_MAC={0xa, 0x6, @from_mac}, @NL80211_ATTR_MAC={0xa, 0x6, @random="15ad59d9ce59"}, @NL80211_ATTR_MAC={0xa, 0x6, @random="507f73076794"}]}, 0x64}, 0x1, 0x0, 0x0, 0x4000090}, 0x8000) r6 = openat$tcp_congestion(0xffffffffffffff9c, &(0x7f0000000800), 0x1, 0x0) write$tcp_congestion(r6, &(0x7f0000000840)='htcp\x00', 0x5) 21:14:00 executing program 0: r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000000), 0x521000, 0x0) ioctl$TUNSETPERSIST(r0, 0x400454cb, 0x1) ioctl$SIOCSIFHWADDR(0xffffffffffffffff, 0x8924, &(0x7f0000000040)={'erspan0\x00', @local}) ioctl$TUNGETSNDBUF(r0, 0x800454d3, &(0x7f0000000080)) r1 = syz_open_dev$mouse(&(0x7f00000000c0), 0x5, 0x111840) ioctl$TUNSETIFINDEX(r1, 0x400454da, &(0x7f0000000100)) r2 = openat$vcsa(0xffffffffffffff9c, &(0x7f0000000140), 0x101000, 0x0) r3 = syz_genetlink_get_family_id$mptcp(&(0x7f00000001c0), 0xffffffffffffffff) sendmsg$MPTCP_PM_CMD_SET_LIMITS(r2, &(0x7f0000000280)={&(0x7f0000000180)={0x10, 0x0, 0x0, 0x20000}, 0xc, &(0x7f0000000240)={&(0x7f0000000200)={0x1c, r3, 0x20, 0x70bd26, 0x25dfdbfb, {}, [@MPTCP_PM_ATTR_RCV_ADD_ADDRS={0x8, 0x2, 0x6}]}, 0x1c}, 0x1, 0x0, 0x0, 0x1000}, 0x20008050) r4 = syz_open_dev$mouse(&(0x7f00000002c0), 0x7fffffff, 0x230200) ioctl$TUNSETOWNER(r4, 0x400454cc, 0xee01) syz_open_dev$vcsa(&(0x7f0000000300), 0x7, 0x480) getresuid(&(0x7f0000000340), &(0x7f0000000380), &(0x7f00000003c0)) 21:14:00 executing program 7: write$P9_RSYMLINK(0xffffffffffffffff, &(0x7f0000000000)={0x14, 0x11, 0x2, {0x40, 0x3, 0x2}}, 0x14) ioctl$sock_ifreq(0xffffffffffffffff, 0x8935, &(0x7f0000000040)={'lo\x00', @ifru_addrs=@ethernet}) ioctl$sock_ifreq(0xffffffffffffffff, 0x8994, &(0x7f0000000080)={'ip6gretap0\x00', @ifru_flags}) sendmsg$IPSET_CMD_FLUSH(0xffffffffffffffff, &(0x7f0000000180)={&(0x7f00000000c0)={0x10, 0x0, 0x0, 0x10000}, 0xc, &(0x7f0000000140)={&(0x7f0000000100)={0x3c, 0x4, 0x6, 0x801, 0x0, 0x0, {0x3, 0x0, 0x4}, [@IPSET_ATTR_PROTOCOL={0x5}, @IPSET_ATTR_SETNAME={0x9, 0x2, 'syz0\x00'}, @IPSET_ATTR_SETNAME={0x9, 0x2, 'syz2\x00'}, @IPSET_ATTR_PROTOCOL={0x5}]}, 0x3c}}, 0x20000000) write$P9_RVERSION(0xffffffffffffffff, &(0x7f00000001c0)={0x13, 0x65, 0xffff, 0x3, 0x6, '9P2000'}, 0x13) pipe2$9p(&(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}, 0x0) write$P9_RSYMLINK(r0, &(0x7f0000000240)={0x14, 0x11, 0x1, {0x1, 0x3, 0x2}}, 0x14) add_key$fscrypt_v1(&(0x7f0000000280), &(0x7f00000002c0)={'fscrypt:', @desc2}, &(0x7f0000000300)={0x0, "ccf022eeb1aa5b4a9067674b5b7079352411c35248e190415959cbe4b7be99236abd831288583a8ed4db4b7b3f838c24d293f908bf3509b49f2c17852201f646", 0x19}, 0x48, 0xfffffffffffffffa) add_key$fscrypt_v1(&(0x7f0000000380), &(0x7f00000003c0)={'fscrypt:', @auto=[0x38, 0x65, 0x62, 0x61, 0x61, 0x62, 0x61, 0x64, 0x37, 0x32, 0x30, 0x61, 0x61, 0x50, 0x62, 0x62]}, &(0x7f0000000400)={0x0, "4916f745ecf1627b46363a6005d9ff599dde016c8b8d9d347624fd26c6e8bdbb7555714d1669e0e45bd9e03a462b54b255d728a05790d4698c32583ade59ecd8", 0x36}, 0x48, 0x0) r1 = syz_genetlink_get_family_id$mptcp(&(0x7f00000004c0), 0xffffffffffffffff) ioctl$ifreq_SIOCGIFINDEX_vcan(0xffffffffffffffff, 0x8933, &(0x7f00000005c0)={'vxcan0\x00', 0x0}) sendmsg$MPTCP_PM_CMD_GET_ADDR(0xffffffffffffffff, &(0x7f0000000740)={&(0x7f0000000480)={0x10, 0x0, 0x0, 0x80000000}, 0xc, &(0x7f0000000700)={&(0x7f0000000600)={0xcc, r1, 0x400, 0x70bd2c, 0x25dfdbfd, {}, [@MPTCP_PM_ATTR_ADDR={0x14, 0x1, 0x0, 0x1, [@MPTCP_PM_ADDR_ATTR_FLAGS={0x8, 0x6, 0x2}, @MPTCP_PM_ADDR_ATTR_ID={0x5}]}, @MPTCP_PM_ATTR_SUBFLOWS={0x8, 0x3, 0x1}, @MPTCP_PM_ATTR_ADDR={0x54, 0x1, 0x0, 0x1, [@MPTCP_PM_ADDR_ATTR_ADDR6={0x14, 0x4, @private1}, @MPTCP_PM_ADDR_ATTR_ID={0x5}, @MPTCP_PM_ADDR_ATTR_FAMILY={0x6, 0x1, 0x2}, @MPTCP_PM_ADDR_ATTR_ID={0x5, 0x2, 0x20}, @MPTCP_PM_ADDR_ATTR_IF_IDX={0x8}, @MPTCP_PM_ADDR_ATTR_ADDR6={0x14, 0x4, @rand_addr=' \x01\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x02'}, @MPTCP_PM_ADDR_ATTR_ADDR4={0x8, 0x3, @broadcast}]}, @MPTCP_PM_ATTR_ADDR={0x48, 0x1, 0x0, 0x1, [@MPTCP_PM_ADDR_ATTR_ADDR6={0x14, 0x4, @private2={0xfc, 0x2, '\x00', 0x1}}, @MPTCP_PM_ADDR_ATTR_IF_IDX={0x8, 0x7, r2}, @MPTCP_PM_ADDR_ATTR_FLAGS={0x8, 0x6, 0x4}, @MPTCP_PM_ADDR_ATTR_ADDR4={0x8, 0x3, @remote}, @MPTCP_PM_ADDR_ATTR_ADDR4={0x8, 0x3, @multicast1}, @MPTCP_PM_ADDR_ATTR_ADDR4={0x8, 0x3, @private=0xa010102}, @MPTCP_PM_ADDR_ATTR_ADDR4={0x8, 0x3, @rand_addr=0x64010101}]}]}, 0xcc}, 0x1, 0x0, 0x0, 0x8080}, 0x80) sendmsg$NL80211_CMD_GET_KEY(0xffffffffffffffff, &(0x7f0000000880)={&(0x7f0000000780)={0x10, 0x0, 0x0, 0x80000}, 0xc, &(0x7f0000000840)={&(0x7f00000007c0)={0x70, 0x0, 0x100, 0x70bd26, 0x25dfdbff, {{}, {@void, @void}}, [@NL80211_ATTR_KEY_DATA_WEP40={0x9, 0x7, "79d2a1c46c"}, @NL80211_ATTR_KEY_DATA_WEP104={0x11, 0x7, "e8db493fbaba6fa81c387c85d8"}, @NL80211_ATTR_KEY_DATA_WEP104={0x11, 0x7, "f8af8a10eebb9b4c600eb01c28"}, @NL80211_ATTR_KEY_SEQ={0x8, 0xa, "39cff2d0"}, @NL80211_ATTR_KEY_IDX={0x5, 0x8, 0x4}, @NL80211_ATTR_KEY_DEFAULT_TYPES={0xc, 0x6e, 0x0, 0x1, [@NL80211_KEY_DEFAULT_TYPE_MULTICAST={0x4}, @NL80211_KEY_DEFAULT_TYPE_UNICAST={0x4}]}, @NL80211_ATTR_MAC={0xa}]}, 0x70}, 0x1, 0x0, 0x0, 0x880}, 0x0) sendmsg$NL80211_CMD_GET_WOWLAN(0xffffffffffffffff, &(0x7f0000000980)={&(0x7f00000008c0)={0x10, 0x0, 0x0, 0x800000}, 0xc, &(0x7f0000000940)={&(0x7f0000000900)={0x1c, 0x0, 0x20, 0x70bd29, 0x25dfdbfc, {{}, {@void, @val={0x8}, @void}}, [""]}, 0x1c}, 0x1, 0x0, 0x0, 0x4044191}, 0x20040040) openat$vcsa(0xffffffffffffff9c, &(0x7f00000009c0), 0x14200, 0x0) syz_genetlink_get_family_id$mptcp(&(0x7f0000000a80), 0xffffffffffffffff) 21:14:00 executing program 6: r0 = request_key(&(0x7f0000000000)='dns_resolver\x00', &(0x7f0000000040)={'syz', 0x1}, &(0x7f0000000080)=',{{\x00', 0x0) r1 = add_key$keyring(&(0x7f0000000140), &(0x7f0000000180)={'syz', 0x1}, 0x0, 0x0, r0) r2 = add_key$keyring(&(0x7f00000000c0), &(0x7f0000000100)={'syz', 0x3}, 0x0, 0x0, r1) r3 = add_key(&(0x7f00000002c0)='keyring\x00', &(0x7f0000000300)={'syz', 0x0}, &(0x7f0000000340)="b2513106f064e11f553a90a7963719ea01c1290fb605a18636b528a3487b9ab36c7e4bd67fbf8e67", 0x28, r2) add_key$fscrypt_v1(&(0x7f00000001c0), &(0x7f0000000200)={'fscrypt:', @auto=[0x33, 0x31, 0x36, 0x6a, 0x33, 0x38, 0x65, 0x32, 0x34, 0x4, 0x35, 0x61, 0x0, 0x62, 0x33, 0xb1]}, &(0x7f0000000240)={0x0, "67fe36c9b2f9ec15ba3b297e79535fb785fc878cdb6d0c047ce0b9dc30e9c8f939461a73fd6905462f35f71fff021b998365789e6ddb39c7159cc0a59c187e43", 0x27}, 0x48, r3) keyctl$KEYCTL_PKEY_SIGN(0x1b, &(0x7f00000009c0)={r1, 0x6c, 0x6d}, &(0x7f0000000a00)={'enc=', 'pkcs1', ' hash=', {'nhpoly1305-generic\x00'}}, &(0x7f0000000a80)="64824bc7426fe2f3e3c1e475569073ecff8ffb96e46626b91f3b9a2b2ac07610524644af1e29c43d27e1d513a86909a6ac4d9753ce88f3f3d0beb31db8dfdbcb65379a9cc111189465a0cd8a50f7c19f1579f44a95805d41c0c92de97999b1d961ee48d58cfddc3720b2cd20", &(0x7f0000000b00)=""/109) 21:14:09 executing program 4: recvmmsg(0xffffffffffffffff, &(0x7f0000000280)=[{{0x0, 0x0, &(0x7f0000000140)=[{&(0x7f0000000000)=""/11, 0xb}, {&(0x7f0000000040)=""/238, 0xee}], 0x2, &(0x7f0000000180)=""/244, 0xf4}, 0xb67}], 0x1, 0x102, 0x0) sendmsg$NFULNL_MSG_CONFIG(0xffffffffffffffff, &(0x7f00000003c0)={&(0x7f00000002c0)={0x10, 0x0, 0x0, 0x1000000}, 0xc, &(0x7f0000000380)={&(0x7f0000000300)={0x50, 0x1, 0x4, 0x101, 0x0, 0x0, {0xc, 0x0, 0x3}, [@NFULA_CFG_MODE={0xa, 0x2, {0x0, 0x2}}, @NFULA_CFG_QTHRESH={0x8, 0x5, 0x1, 0x0, 0xffffffc0}, @NFULA_CFG_TIMEOUT={0x8, 0x4, 0x1, 0x0, 0x54}, @NFULA_CFG_FLAGS={0x6}, @NFULA_CFG_TIMEOUT={0x8, 0x4, 0x1, 0x0, 0x6}, @NFULA_CFG_NLBUFSIZ={0x8, 0x3, 0x1, 0x0, 0x7f}, @NFULA_CFG_NLBUFSIZ={0x8, 0x3, 0x1, 0x0, 0x8}]}, 0x50}, 0x1, 0x0, 0x0, 0x408d4}, 0x20000091) r0 = openat$procfs(0xffffffffffffff9c, &(0x7f0000000400)='/proc/schedstat\x00', 0x0, 0x0) syz_io_uring_submit(0x0, 0x0, &(0x7f0000000440)=@IORING_OP_SPLICE={0x1e, 0x2, 0x0, @fd, 0x9, {}, 0x830, 0xa, 0x0, {0x0, 0x0, r0}}, 0x5) connect$bt_l2cap(r0, &(0x7f0000000480)={0x1f, 0x71, @none, 0x4, 0x2}, 0xe) r1 = syz_open_dev$vcsa(&(0x7f00000004c0), 0x20, 0xc0101) setsockopt$bt_BT_SNDMTU(r1, 0x112, 0xc, &(0x7f0000000500), 0x2) r2 = syz_open_dev$sg(&(0x7f0000000540), 0x9, 0x18000) ioctl$SCSI_IOCTL_PROBE_HOST(r2, 0x5385, &(0x7f0000000580)={0xa2, ""/162}) syz_genetlink_get_family_id$mptcp(&(0x7f0000000640), r0) bind$bt_l2cap(0xffffffffffffffff, &(0x7f0000000dc0)={0x1f, 0xb9e5, @fixed={'\xaa\xaa\xaa\xaa\xaa', 0x12}, 0x1f, 0x1}, 0xe) 21:14:09 executing program 7: write$P9_RSYMLINK(0xffffffffffffffff, &(0x7f0000000000)={0x14, 0x11, 0x2, {0x40, 0x3, 0x2}}, 0x14) ioctl$sock_ifreq(0xffffffffffffffff, 0x8935, &(0x7f0000000040)={'lo\x00', @ifru_addrs=@ethernet}) ioctl$sock_ifreq(0xffffffffffffffff, 0x8994, &(0x7f0000000080)={'ip6gretap0\x00', @ifru_flags}) sendmsg$IPSET_CMD_FLUSH(0xffffffffffffffff, &(0x7f0000000180)={&(0x7f00000000c0)={0x10, 0x0, 0x0, 0x10000}, 0xc, &(0x7f0000000140)={&(0x7f0000000100)={0x3c, 0x4, 0x6, 0x801, 0x0, 0x0, {0x3, 0x0, 0x4}, [@IPSET_ATTR_PROTOCOL={0x5}, @IPSET_ATTR_SETNAME={0x9, 0x2, 'syz0\x00'}, @IPSET_ATTR_SETNAME={0x9, 0x2, 'syz2\x00'}, @IPSET_ATTR_PROTOCOL={0x5}]}, 0x3c}}, 0x20000000) write$P9_RVERSION(0xffffffffffffffff, &(0x7f00000001c0)={0x13, 0x65, 0xffff, 0x3, 0x6, '9P2000'}, 0x13) pipe2$9p(&(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}, 0x0) write$P9_RSYMLINK(r0, &(0x7f0000000240)={0x14, 0x11, 0x1, {0x1, 0x3, 0x2}}, 0x14) add_key$fscrypt_v1(&(0x7f0000000280), &(0x7f00000002c0)={'fscrypt:', @desc2}, &(0x7f0000000300)={0x0, "ccf022eeb1aa5b4a9067674b5b7079352411c35248e190415959cbe4b7be99236abd831288583a8ed4db4b7b3f838c24d293f908bf3509b49f2c17852201f646", 0x19}, 0x48, 0xfffffffffffffffa) add_key$fscrypt_v1(&(0x7f0000000380), &(0x7f00000003c0)={'fscrypt:', @auto=[0x38, 0x65, 0x62, 0x61, 0x61, 0x62, 0x61, 0x64, 0x37, 0x32, 0x30, 0x61, 0x61, 0x50, 0x62, 0x62]}, &(0x7f0000000400)={0x0, "4916f745ecf1627b46363a6005d9ff599dde016c8b8d9d347624fd26c6e8bdbb7555714d1669e0e45bd9e03a462b54b255d728a05790d4698c32583ade59ecd8", 0x36}, 0x48, 0x0) r1 = syz_genetlink_get_family_id$mptcp(&(0x7f00000004c0), 0xffffffffffffffff) ioctl$ifreq_SIOCGIFINDEX_vcan(0xffffffffffffffff, 0x8933, &(0x7f00000005c0)={'vxcan0\x00', 0x0}) sendmsg$MPTCP_PM_CMD_GET_ADDR(0xffffffffffffffff, &(0x7f0000000740)={&(0x7f0000000480)={0x10, 0x0, 0x0, 0x80000000}, 0xc, &(0x7f0000000700)={&(0x7f0000000600)={0xcc, r1, 0x400, 0x70bd2c, 0x25dfdbfd, {}, [@MPTCP_PM_ATTR_ADDR={0x14, 0x1, 0x0, 0x1, [@MPTCP_PM_ADDR_ATTR_FLAGS={0x8, 0x6, 0x2}, @MPTCP_PM_ADDR_ATTR_ID={0x5}]}, @MPTCP_PM_ATTR_SUBFLOWS={0x8, 0x3, 0x1}, @MPTCP_PM_ATTR_ADDR={0x54, 0x1, 0x0, 0x1, [@MPTCP_PM_ADDR_ATTR_ADDR6={0x14, 0x4, @private1}, @MPTCP_PM_ADDR_ATTR_ID={0x5}, @MPTCP_PM_ADDR_ATTR_FAMILY={0x6, 0x1, 0x2}, @MPTCP_PM_ADDR_ATTR_ID={0x5, 0x2, 0x20}, @MPTCP_PM_ADDR_ATTR_IF_IDX={0x8}, @MPTCP_PM_ADDR_ATTR_ADDR6={0x14, 0x4, @rand_addr=' \x01\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x02'}, @MPTCP_PM_ADDR_ATTR_ADDR4={0x8, 0x3, @broadcast}]}, @MPTCP_PM_ATTR_ADDR={0x48, 0x1, 0x0, 0x1, [@MPTCP_PM_ADDR_ATTR_ADDR6={0x14, 0x4, @private2={0xfc, 0x2, '\x00', 0x1}}, @MPTCP_PM_ADDR_ATTR_IF_IDX={0x8, 0x7, r2}, @MPTCP_PM_ADDR_ATTR_FLAGS={0x8, 0x6, 0x4}, @MPTCP_PM_ADDR_ATTR_ADDR4={0x8, 0x3, @remote}, @MPTCP_PM_ADDR_ATTR_ADDR4={0x8, 0x3, @multicast1}, @MPTCP_PM_ADDR_ATTR_ADDR4={0x8, 0x3, @private=0xa010102}, @MPTCP_PM_ADDR_ATTR_ADDR4={0x8, 0x3, @rand_addr=0x64010101}]}]}, 0xcc}, 0x1, 0x0, 0x0, 0x8080}, 0x80) sendmsg$NL80211_CMD_GET_KEY(0xffffffffffffffff, &(0x7f0000000880)={&(0x7f0000000780)={0x10, 0x0, 0x0, 0x80000}, 0xc, &(0x7f0000000840)={&(0x7f00000007c0)={0x70, 0x0, 0x100, 0x70bd26, 0x25dfdbff, {{}, {@void, @void}}, [@NL80211_ATTR_KEY_DATA_WEP40={0x9, 0x7, "79d2a1c46c"}, @NL80211_ATTR_KEY_DATA_WEP104={0x11, 0x7, "e8db493fbaba6fa81c387c85d8"}, @NL80211_ATTR_KEY_DATA_WEP104={0x11, 0x7, "f8af8a10eebb9b4c600eb01c28"}, @NL80211_ATTR_KEY_SEQ={0x8, 0xa, "39cff2d0"}, @NL80211_ATTR_KEY_IDX={0x5, 0x8, 0x4}, @NL80211_ATTR_KEY_DEFAULT_TYPES={0xc, 0x6e, 0x0, 0x1, [@NL80211_KEY_DEFAULT_TYPE_MULTICAST={0x4}, @NL80211_KEY_DEFAULT_TYPE_UNICAST={0x4}]}, @NL80211_ATTR_MAC={0xa}]}, 0x70}, 0x1, 0x0, 0x0, 0x880}, 0x0) sendmsg$NL80211_CMD_GET_WOWLAN(0xffffffffffffffff, &(0x7f0000000980)={&(0x7f00000008c0)={0x10, 0x0, 0x0, 0x800000}, 0xc, &(0x7f0000000940)={&(0x7f0000000900)={0x1c, 0x0, 0x20, 0x70bd29, 0x25dfdbfc, {{}, {@void, @val={0x8}, @void}}, [""]}, 0x1c}, 0x1, 0x0, 0x0, 0x4044191}, 0x20040040) syz_genetlink_get_family_id$mptcp(&(0x7f0000000a80), 0xffffffffffffffff) 21:14:09 executing program 2: ioctl$SCSI_IOCTL_DOORUNLOCK(0xffffffffffffffff, 0x5381) r0 = syz_open_dev$mouse(&(0x7f0000000000), 0x578, 0x4000) ioctl$SG_GET_PACK_ID(r0, 0x227c, &(0x7f0000000040)) r1 = syz_genetlink_get_family_id$nl80211(&(0x7f00000000c0), r0) sendmsg$NL80211_CMD_NEW_KEY(r0, &(0x7f00000001c0)={&(0x7f0000000080)={0x10, 0x0, 0x0, 0x10}, 0xc, &(0x7f0000000180)={&(0x7f0000000100)={0x60, r1, 0x400, 0x70bd2b, 0x25dfdbff, {{}, {@val={0x8}, @void}}, [@NL80211_ATTR_KEY_TYPE={0x8, 0x37, 0x1}, @NL80211_ATTR_KEY_DEFAULT_MGMT={0x4}, @NL80211_ATTR_KEY={0x2c, 0x50, 0x0, 0x1, [@NL80211_KEY_DATA_WEP40={0x9, 0x1, "93f3c5ad5d"}, @NL80211_KEY_DEFAULT_TYPES={0x8, 0x8, 0x0, 0x1, [@NL80211_KEY_DEFAULT_TYPE_MULTICAST={0x4}]}, @NL80211_KEY_DATA_WEP104={0x11, 0x1, "8815558ac60368b42ebdf03bdb"}]}, @NL80211_ATTR_KEY_DATA_WEP40={0x9, 0x7, "74de692476"}]}, 0x60}, 0x1, 0x0, 0x0, 0x4000000}, 0x8000) r2 = openat$procfs(0xffffffffffffff9c, &(0x7f0000000200)='/proc/stat\x00', 0x0, 0x0) ioctl$SG_GET_TIMEOUT(r2, 0x2202, 0x0) ioctl$SG_SET_FORCE_PACK_ID(r0, 0x227b, &(0x7f0000000240)=0x1) ioctl$TUNGETIFF(r0, 0x800454d2, &(0x7f0000000280)={'vlan0\x00'}) sendmsg$NL80211_CMD_JOIN_MESH(r0, &(0x7f0000000400)={&(0x7f00000002c0)={0x10, 0x0, 0x0, 0x8}, 0xc, &(0x7f00000003c0)={&(0x7f0000000300)={0xc0, r1, 0x400, 0x70bd28, 0x25dfdbfc, {{}, {@void, @void}}, [@NL80211_ATTR_SOCKET_OWNER={0x4}, @NL80211_ATTR_MESH_SETUP={0xa8, 0x70, [@NL80211_MESH_SETUP_ENABLE_VENDOR_METRIC={0x5, 0x2, 0x1}, @NL80211_MESH_SETUP_IE={0x6b, 0x3, "432578a2646e5ab8df23d89ff57571f258fae075fd43855fb9486d9209824c25dbf24af1a18187d074463ff5b11350c72de592b494efe5b4f34cbc2a7a8a1160fd0a59dafb8fe7173e1b109dd23d0edf69c40605089d1c24278a427d497c415ba944a9a901d2b5"}, @NL80211_MESH_SETUP_USERSPACE_MPM={0x4}, @NL80211_MESH_SETUP_USERSPACE_AUTH={0x4}, @NL80211_MESH_SETUP_ENABLE_VENDOR_PATH_SEL={0x5, 0x1, 0x1}, @NL80211_MESH_SETUP_ENABLE_VENDOR_PATH_SEL={0x5, 0x1, 0x1}, @NL80211_MESH_SETUP_ENABLE_VENDOR_PATH_SEL={0x5, 0x1, 0x1}, @NL80211_MESH_SETUP_ENABLE_VENDOR_SYNC={0x5, 0x6, 0x1}, @NL80211_MESH_SETUP_USERSPACE_AUTH={0x4}, @NL80211_MESH_SETUP_USERSPACE_AMPE={0x4}]}]}, 0xc0}, 0x1, 0x0, 0x0, 0x10}, 0x4000001) ioctl$SCSI_IOCTL_DOORUNLOCK(r2, 0x5381) r3 = syz_open_dev$vcsa(&(0x7f0000000440), 0x56, 0x4000) r4 = syz_genetlink_get_family_id$nl80211(&(0x7f00000004c0), r0) ioctl$sock_SIOCGIFINDEX_80211(r0, 0x8933, &(0x7f0000000500)={'wlan0\x00', 0x0}) sendmsg$NL80211_CMD_SET_WDS_PEER(r3, &(0x7f0000000600)={&(0x7f0000000480)={0x10, 0x0, 0x0, 0x40}, 0xc, &(0x7f00000005c0)={&(0x7f0000000540)={0x64, r4, 0x100, 0x70bd2a, 0x25dfdbfc, {{}, {@val={0x8, 0x3, r5}, @void}}, [@NL80211_ATTR_MAC={0xa, 0x6, @from_mac}, @NL80211_ATTR_MAC={0xa, 0x6, @random="859953a6f042"}, @NL80211_ATTR_MAC={0xa, 0x6, @from_mac=@device_b}, @NL80211_ATTR_MAC={0xa, 0x6, @from_mac}, @NL80211_ATTR_MAC={0xa, 0x6, @random="15ad59d9ce59"}, @NL80211_ATTR_MAC={0xa, 0x6, @random="507f73076794"}]}, 0x64}, 0x1, 0x0, 0x0, 0x4000090}, 0x8000) r6 = openat$tcp_congestion(0xffffffffffffff9c, &(0x7f0000000800), 0x1, 0x0) write$tcp_congestion(r6, &(0x7f0000000840)='htcp\x00', 0x5) 21:14:09 executing program 3: r0 = openat$vcsa(0xffffffffffffff9c, &(0x7f0000000000), 0x180, 0x0) ioctl$SG_SET_FORCE_PACK_ID(r0, 0x227b, &(0x7f0000000040)=0x1) ioctl$SCSI_IOCTL_GET_BUS_NUMBER(r0, 0x5386, &(0x7f0000000080)) openat$hwrng(0xffffffffffffff9c, &(0x7f00000000c0), 0x22400, 0x0) syz_open_dev$sg(&(0x7f0000000400), 0x494, 0x22000) 21:14:09 executing program 1: r0 = io_uring_setup(0x355e, &(0x7f0000000000)={0x0, 0x7682, 0x20, 0x1, 0x1be}) r1 = syz_io_uring_setup(0x8fe, &(0x7f0000000080)={0x0, 0x1830, 0x0, 0x0, 0x1b8, 0x0, r0}, &(0x7f0000ffb000/0x2000)=nil, &(0x7f0000ffb000/0x4000)=nil, &(0x7f0000000100), &(0x7f0000000140)=0x0) r3 = openat$hwrng(0xffffffffffffff9c, &(0x7f0000000180), 0x2, 0x0) r4 = syz_io_uring_setup(0x65dd, &(0x7f00000001c0)={0x0, 0xf46f, 0x20, 0x2, 0xdf}, &(0x7f0000ffe000/0x1000)=nil, &(0x7f0000ffd000/0x1000)=nil, &(0x7f0000000240), &(0x7f0000000280)) r5 = syz_genetlink_get_family_id$mptcp(&(0x7f0000000300), r3) sendmsg$MPTCP_PM_CMD_ADD_ADDR(r3, &(0x7f00000003c0)={&(0x7f00000002c0)={0x10, 0x0, 0x0, 0x10}, 0xc, &(0x7f0000000380)={&(0x7f0000000340)={0x24, r5, 0x300, 0x70bd26, 0x25dfdbfb, {}, [@MPTCP_PM_ATTR_SUBFLOWS={0x8, 0x3, 0x1}, @MPTCP_PM_ATTR_RCV_ADD_ADDRS={0x8, 0x2, 0x2}]}, 0x24}, 0x1, 0x0, 0x0, 0x20000004}, 0x8890) syz_io_uring_setup(0x20f8, &(0x7f0000000400)={0x0, 0x7677, 0x8, 0x3, 0x22f, 0x0, r4}, &(0x7f0000ffe000/0x2000)=nil, &(0x7f0000ffb000/0x2000)=nil, &(0x7f0000000480)=0x0, &(0x7f00000004c0)) r7 = openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000500)='./cgroup/syz1\x00', 0x200002, 0x0) syz_io_uring_submit(r6, r2, &(0x7f0000000580)=@IORING_OP_FILES_UPDATE={0x14, 0x4, 0x0, 0x0, 0x40, &(0x7f0000000540)=[r4, 0xffffffffffffffff, r7, r0, r1], 0x5}, 0x3) io_uring_setup(0x2812, &(0x7f00000005c0)={0x0, 0x5e1b, 0x2, 0x3, 0x12f, 0x0, r4}) getpeername(r3, &(0x7f0000000640)=@nfc, &(0x7f00000006c0)=0x80) ioctl$SIOCSIFHWADDR(r3, 0x8924, &(0x7f0000000700)={'hsr0\x00', @broadcast}) socket$inet6_tcp(0xa, 0x1, 0x0) sendmsg$OSF_MSG_REMOVE(r3, &(0x7f0000000f00)={&(0x7f0000000740)={0x10, 0x0, 0x0, 0x2000000}, 0xc, &(0x7f0000000ec0)={&(0x7f0000000780)={0x710, 0x1, 0x5, 0x201, 0x0, 0x0, {0x2, 0x0, 0xa}, [{{0x254, 0x1, {{0x3, 0xd16}, 0x5, 0x8, 0x9, 0xbad1, 0x1d, 'syz1\x00', "02d9d510ee96957b7df8dd68f410d3c0f3127247fd3254ba7a00035b858be02d", "f3957ad69b719399a72d8a9b4aefdb9275ec9eec85bc6745883fdd04eb14ed5b", [{0x2, 0xfbff, {0x3, 0x10000}}, {0x0, 0x8001, {0x0, 0x9}}, {0x7f, 0x0, {0x3, 0x800}}, {0x80, 0xad, {0x0, 0x6}}, {0x7f, 0x1, {0x1, 0x13}}, {0x2, 0x5, {0x1, 0x38}}, {0x0, 0x800, {0x0, 0xec0}}, {0x3, 0x0, {0x3, 0x5}}, {0x0, 0x400, {0x0, 0x8000}}, {0xffff, 0x9, {0x0, 0xcb04}}, {0x6, 0x1, {0x0, 0x3}}, {0x7, 0x7, {0x0, 0x7ff}}, {0xff3e, 0xed, {0x1, 0x20}}, {0x8, 0x8, {0x3, 0x3b}}, {0x0, 0x1ff, {0x1, 0x6}}, {0x7, 0x3f, {0x2, 0x10001}}, {0x1, 0x2, {0x1, 0x8}}, {0x3f, 0xa854, {0x2, 0x7}}, {0x9, 0x1ff, {0x0, 0x35e}}, {0xa7fd, 0x6e3, {0x0, 0x5af}}, {0x42c, 0x3, {0x1, 0x2}}, {0x1, 0xdd, {0x0, 0x57}}, {0x90, 0x2, {0x2, 0x4}}, {0x2, 0x2, {0x1, 0x2}}, {0x0, 0xfa, {0x0, 0x8}}, {0xb86, 0x6, {0x0, 0x7}}, {0xff1, 0x9, {0x0, 0xf05}}, {0x400, 0x8000, {0x1, 0x1}}, {0x0, 0x720, {0x3, 0x4}}, {0x9, 0xd84, {0x3, 0xeb5f}}, {0x8, 0x4, {0x2, 0x6}}, {0x8313, 0x7fff, {0x0, 0x1}}, {0x800, 0x6, {0x2, 0x6}}, {0xff, 0x4, {0x1, 0xfff}}, {0x1, 0x200, {0x2}}, {0x7f, 0x9, {0x0, 0x4}}, {0x1, 0x0, {0x0, 0x200}}, {0x7, 0x101, {0x3, 0x1}}, {0x3f, 0xfff, {0x1, 0xd385}}, {0xfffb, 0x401, {0x0, 0x6e49}}]}}}, {{0x254, 0x1, {{0x3, 0x7}, 0x55, 0x1, 0x7, 0x3258, 0x22, 'syz0\x00', "1372c553c4662b99d0128ae9de6223ccdf3460c1327fe339adab7cd55d8e4b3e", "9b9b700c2c6deb776a134b91af1485c90dfaf6614121cfae0e94dff30a6a0950", [{0x2, 0xfd, {0x3, 0x5}}, {0x20, 0xf24, {0x2, 0x9}}, {0xffff, 0x7, {0x0, 0x40}}, {0x9, 0x0, {0x3, 0x8}}, {0x7, 0x8, {0x2, 0x832}}, {0xba4b, 0x20, {0x3, 0x4}}, {0x20, 0x1fc0, {0x2, 0x6}}, {0x53df, 0x5, {0x0, 0x3014}}, {0x3, 0x5, {0x3, 0x6}}, {0x7ff, 0x2, {0x1, 0x10000}}, {0xee0, 0x7, {0x1, 0xfffffffa}}, {0x8, 0x6, {0x3, 0x9}}, {0x1, 0x3, {0x1, 0x6}}, {0x8, 0xfffa, {0x3, 0x1}}, {0x3, 0x8, {0x3}}, {0x8000, 0x3, {0x3, 0x4}}, {0xfff, 0x8, {0x1, 0x7}}, {0xf931, 0x3, {0x3, 0x2}}, {0x6, 0x8c3f}, {0x5, 0x9, {0x3, 0x11458ba5}}, {0x92, 0x1, {0x1, 0xfffffcf3}}, {0x2, 0x9, {0x0, 0x7fff}}, {0x96c, 0x40, {0x0, 0x4d}}, {0x3, 0x101, {0x3, 0x74f9}}, {0x2, 0x1, {0x3, 0x5}}, {0x8, 0xfffa, {0x0, 0x1}}, {0x8, 0xfffe, {0x0, 0x1410}}, {0xd5, 0x5, {0x1, 0x2}}, {0xffff, 0x8, {0x1, 0x1ff}}, {0x5, 0x7, {0x1, 0x2}}, {0x4, 0x3abe, {0x0, 0xdea}}, {0x5, 0x5, {0x0, 0x80}}, {0x5, 0x100, {0x2, 0x200}}, {0x8000, 0x6, {0x3, 0x6}}, {0x5, 0x3, {0x3, 0x7fffffff}}, {0x2e, 0x7, {0x3, 0xb6d1}}, {0x8, 0x5, {0x2, 0x6}}, {0x7ff, 0x9, {0x2, 0x41c4d1bc}}, {0x6, 0x858, {0x0, 0x9}}, {0x9, 0x4, {0x0, 0xf}}]}}}, {{0x254, 0x1, {{0x1, 0x84}, 0xff, 0x6, 0x2, 0x40, 0x3, 'syz1\x00', "2dcd30757a69ad11f635b1771ef0dba9f59d98d2260ee7db2b11138f872a7c19", "f93f6bdfb1db39415342f42f96cd7657435e0b32c989f60760498746881338cd", [{0x1, 0xa3e7, {0x2, 0x6}}, {0x4, 0x4, {0x1, 0x20}}, {0x200, 0x494, {0x1, 0x10001}}, {0x7, 0x1, {0x3, 0xffffff73}}, {0x1, 0x1ff, {0x2, 0xbc}}, {0x7, 0x33, {0x1, 0x1}}, {0x8, 0x7, {0x3, 0x4}}, {0xff, 0xffff, {0x1, 0x36a}}, {0x3, 0x7, {0x0, 0x1}}, {0x77df, 0xfff8, {0x1, 0x2}}, {0x7, 0x5}, {0x1, 0xb3, {0x3}}, {0x7, 0x7, {0x3, 0x1c000000}}, {0xcb, 0x47ec, {0x1, 0x5}}, {0xe4a9, 0xfe00, {0x1, 0x4}}, {0x20, 0x4eb1, {0x2, 0x46}}, {0x4, 0xfff9, {0x2, 0xffffffe1}}, {0x2, 0x100, {0x3}}, {0x6, 0x4, {0x0, 0x1}}, {0xc9, 0xed, {0x1, 0x7f}}, {0xffa7, 0x0, {0x3, 0x8000}}, {0x8, 0x1ff, {0x3, 0xfffff69e}}, {0x8000, 0x3, {0x1}}, {0x6, 0x8001, {0x1, 0x4}}, {0xd1a2, 0x100, {0x1, 0x7}}, {0x3ad, 0x5, {0x1, 0x3}}, {0x0, 0xfff, {0x1, 0x400}}, {0x1, 0x8, {0x3, 0x1}}, {0x3, 0x6, {0x0, 0x7}}, {0x2, 0x6, {0x0, 0xd8}}, {0x3, 0x400, {0x2, 0x7}}, {0x67d, 0x3, {0x0, 0x6348}}, {0x0, 0x8, {0x1, 0x9}}, {0x7d2, 0x3, {0x1, 0x80}}, {0x9, 0x3, {0x2, 0x1}}, {0x1ff, 0x1, {0x0, 0x16}}, {0x7, 0x9, {0x0, 0xe9}}, {0x6, 0x7, {0x3}}, {0x0, 0x7, {0x3, 0x7fff}}, {0x6850, 0x29e, {0x3, 0x9}}]}}}]}, 0x710}, 0x1, 0x0, 0x0, 0x11}, 0x71272780a8dc51e3) ioctl$SCSI_IOCTL_GET_IDLUN(r3, 0x5382, &(0x7f0000000f40)) openat$procfs(0xffffffffffffff9c, &(0x7f00000010c0)='/proc/crypto\x00', 0x0, 0x0) io_uring_setup(0x7c8f, &(0x7f0000001140)={0x0, 0xc240, 0x10, 0x3, 0x1c7, 0x0, r4}) 21:14:09 executing program 6: r0 = request_key(&(0x7f0000000000)='dns_resolver\x00', &(0x7f0000000040)={'syz', 0x1}, &(0x7f0000000080)=',{{\x00', 0x0) r1 = add_key$keyring(&(0x7f0000000140), &(0x7f0000000180)={'syz', 0x1}, 0x0, 0x0, r0) r2 = add_key$keyring(&(0x7f00000000c0), &(0x7f0000000100)={'syz', 0x3}, 0x0, 0x0, r1) add_key(&(0x7f00000002c0)='keyring\x00', &(0x7f0000000300)={'syz', 0x0}, &(0x7f0000000340)="b2513106f064e11f553a90a7963719ea01c1290fb605a18636b528a3487b9ab36c7e4bd67fbf8e67", 0x28, r2) keyctl$KEYCTL_PKEY_SIGN(0x1b, &(0x7f00000009c0)={r1, 0x6c, 0x6d}, &(0x7f0000000a00)={'enc=', 'pkcs1', ' hash=', {'nhpoly1305-generic\x00'}}, &(0x7f0000000a80)="64824bc7426fe2f3e3c1e475569073ecff8ffb96e46626b91f3b9a2b2ac07610524644af1e29c43d27e1d513a86909a6ac4d9753ce88f3f3d0beb31db8dfdbcb65379a9cc111189465a0cd8a50f7c19f1579f44a95805d41c0c92de97999b1d961ee48d58cfddc3720b2cd20", &(0x7f0000000b00)=""/109) 21:14:09 executing program 0: r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000000), 0x521000, 0x0) ioctl$TUNSETPERSIST(r0, 0x400454cb, 0x1) ioctl$SIOCSIFHWADDR(0xffffffffffffffff, 0x8924, &(0x7f0000000040)={'erspan0\x00', @local}) ioctl$TUNGETSNDBUF(r0, 0x800454d3, &(0x7f0000000080)) r1 = syz_open_dev$mouse(&(0x7f00000000c0), 0x5, 0x111840) ioctl$TUNSETIFINDEX(r1, 0x400454da, &(0x7f0000000100)) r2 = openat$vcsa(0xffffffffffffff9c, &(0x7f0000000140), 0x101000, 0x0) r3 = syz_genetlink_get_family_id$mptcp(&(0x7f00000001c0), 0xffffffffffffffff) sendmsg$MPTCP_PM_CMD_SET_LIMITS(r2, &(0x7f0000000280)={&(0x7f0000000180)={0x10, 0x0, 0x0, 0x20000}, 0xc, &(0x7f0000000240)={&(0x7f0000000200)={0x1c, r3, 0x20, 0x70bd26, 0x25dfdbfb, {}, [@MPTCP_PM_ATTR_RCV_ADD_ADDRS={0x8, 0x2, 0x6}]}, 0x1c}, 0x1, 0x0, 0x0, 0x1000}, 0x20008050) r4 = syz_open_dev$mouse(&(0x7f00000002c0), 0x7fffffff, 0x230200) ioctl$TUNSETOWNER(r4, 0x400454cc, 0xee01) getresuid(&(0x7f0000000340), &(0x7f0000000380), &(0x7f00000003c0)) 21:14:09 executing program 5: ptrace$peekuser(0x3, 0xffffffffffffffff, 0x3ff) prctl$PR_MPX_ENABLE_MANAGEMENT(0x2b) clock_adjtime(0x0, &(0x7f0000000000)={0xf0, 0xfff, 0x6, 0x40, 0x1ff, 0x1ff, 0x1, 0xe1, 0x5, 0xe68c, 0x95c, 0x1000, 0xe, 0x100000000, 0x8000, 0x2, 0x6, 0xab, 0xffff, 0x3, 0xff, 0x9, 0x6a9f, 0x1, 0x4, 0xfffffffffffffff9}) prctl$PR_MPX_ENABLE_MANAGEMENT(0x2b) ioctl$SCSI_IOCTL_DOORUNLOCK(0xffffffffffffffff, 0x5381) ioctl$SG_GET_TIMEOUT(0xffffffffffffffff, 0x2202, 0x0) r0 = syz_open_dev$vcsa(&(0x7f0000000100), 0x1, 0x80100) ioctl$SCSI_IOCTL_DOORLOCK(r0, 0x5380) r1 = syz_open_dev$vcsa(&(0x7f0000000140), 0xb6, 0x101000) sendmsg$NL80211_CMD_ASSOCIATE(r1, &(0x7f0000000440)={&(0x7f0000000300)={0x10, 0x0, 0x0, 0x8000000}, 0xc, &(0x7f0000000400)={&(0x7f0000000380)={0x54, 0x0, 0x4, 0x70bd2c, 0x25dfdbff, {{}, {@val={0x8}, @val={0xc, 0x99, {0x0, 0x78}}}}, [@NL80211_ATTR_SSID={0xa, 0x34, @default_ap_ssid}, @NL80211_ATTR_HT_CAPABILITY={0x1e, 0x1f, {0x300, 0x1, 0x1, 0x0, {0x6, 0x4c, 0x0, 0x4, 0x0, 0x1, 0x0, 0x1, 0x1}, 0x400, 0x2, 0x6}}]}, 0x54}}, 0x0) 21:14:09 executing program 5: ptrace$peekuser(0x3, 0xffffffffffffffff, 0x3ff) prctl$PR_MPX_ENABLE_MANAGEMENT(0x2b) clock_adjtime(0x0, &(0x7f0000000000)={0xf0, 0xfff, 0x6, 0x40, 0x1ff, 0x1ff, 0x1, 0xe1, 0x5, 0xe68c, 0x95c, 0x1000, 0xe, 0x100000000, 0x8000, 0x2, 0x6, 0xab, 0xffff, 0x3, 0xff, 0x9, 0x6a9f, 0x1, 0x4, 0xfffffffffffffff9}) prctl$PR_MPX_ENABLE_MANAGEMENT(0x2b) ioctl$SCSI_IOCTL_DOORUNLOCK(0xffffffffffffffff, 0x5381) ioctl$SG_GET_TIMEOUT(0xffffffffffffffff, 0x2202, 0x0) r0 = syz_open_dev$vcsa(&(0x7f0000000100), 0x1, 0x80100) ioctl$SCSI_IOCTL_DOORLOCK(r0, 0x5380) sendmsg$NL80211_CMD_ASSOCIATE(0xffffffffffffffff, &(0x7f0000000440)={&(0x7f0000000300)={0x10, 0x0, 0x0, 0x8000000}, 0xc, &(0x7f0000000400)={&(0x7f0000000380)={0x54, 0x0, 0x4, 0x70bd2c, 0x25dfdbff, {{}, {@val={0x8}, @val={0xc, 0x99, {0x0, 0x78}}}}, [@NL80211_ATTR_SSID={0xa, 0x34, @default_ap_ssid}, @NL80211_ATTR_HT_CAPABILITY={0x1e, 0x1f, {0x300, 0x1, 0x1, 0x0, {0x6, 0x4c, 0x0, 0x4, 0x0, 0x1, 0x0, 0x1, 0x1}, 0x400, 0x2, 0x6}}]}, 0x54}}, 0x0) 21:14:09 executing program 4: recvmmsg(0xffffffffffffffff, &(0x7f0000000280)=[{{0x0, 0x0, &(0x7f0000000140)=[{&(0x7f0000000000)=""/11, 0xb}, {&(0x7f0000000040)=""/238, 0xee}], 0x2, &(0x7f0000000180)=""/244, 0xf4}, 0xb67}], 0x1, 0x102, 0x0) sendmsg$NFULNL_MSG_CONFIG(0xffffffffffffffff, &(0x7f00000003c0)={&(0x7f00000002c0)={0x10, 0x0, 0x0, 0x1000000}, 0xc, &(0x7f0000000380)={&(0x7f0000000300)={0x50, 0x1, 0x4, 0x101, 0x0, 0x0, {0xc, 0x0, 0x3}, [@NFULA_CFG_MODE={0xa, 0x2, {0x0, 0x2}}, @NFULA_CFG_QTHRESH={0x8, 0x5, 0x1, 0x0, 0xffffffc0}, @NFULA_CFG_TIMEOUT={0x8, 0x4, 0x1, 0x0, 0x54}, @NFULA_CFG_FLAGS={0x6}, @NFULA_CFG_TIMEOUT={0x8, 0x4, 0x1, 0x0, 0x6}, @NFULA_CFG_NLBUFSIZ={0x8, 0x3, 0x1, 0x0, 0x7f}, @NFULA_CFG_NLBUFSIZ={0x8, 0x3, 0x1, 0x0, 0x8}]}, 0x50}, 0x1, 0x0, 0x0, 0x408d4}, 0x20000091) r0 = openat$procfs(0xffffffffffffff9c, &(0x7f0000000400)='/proc/schedstat\x00', 0x0, 0x0) syz_io_uring_submit(0x0, 0x0, &(0x7f0000000440)=@IORING_OP_SPLICE={0x1e, 0x2, 0x0, @fd, 0x9, {}, 0x830, 0xa, 0x0, {0x0, 0x0, r0}}, 0x5) connect$bt_l2cap(r0, &(0x7f0000000480)={0x1f, 0x71, @none, 0x4, 0x2}, 0xe) r1 = syz_open_dev$vcsa(&(0x7f00000004c0), 0x20, 0xc0101) setsockopt$bt_BT_SNDMTU(r1, 0x112, 0xc, &(0x7f0000000500), 0x2) r2 = syz_open_dev$sg(&(0x7f0000000540), 0x9, 0x18000) ioctl$SCSI_IOCTL_PROBE_HOST(r2, 0x5385, &(0x7f0000000580)={0xa2, ""/162}) bind$bt_l2cap(0xffffffffffffffff, &(0x7f0000000dc0)={0x1f, 0xb9e5, @fixed={'\xaa\xaa\xaa\xaa\xaa', 0x12}, 0x1f, 0x1}, 0xe) 21:14:18 executing program 0: r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000000), 0x521000, 0x0) ioctl$TUNSETPERSIST(r0, 0x400454cb, 0x1) ioctl$SIOCSIFHWADDR(0xffffffffffffffff, 0x8924, &(0x7f0000000040)={'erspan0\x00', @local}) ioctl$TUNGETSNDBUF(r0, 0x800454d3, &(0x7f0000000080)) r1 = syz_open_dev$mouse(&(0x7f00000000c0), 0x5, 0x111840) ioctl$TUNSETIFINDEX(r1, 0x400454da, &(0x7f0000000100)) r2 = openat$vcsa(0xffffffffffffff9c, &(0x7f0000000140), 0x101000, 0x0) r3 = syz_genetlink_get_family_id$mptcp(&(0x7f00000001c0), 0xffffffffffffffff) sendmsg$MPTCP_PM_CMD_SET_LIMITS(r2, &(0x7f0000000280)={&(0x7f0000000180)={0x10, 0x0, 0x0, 0x20000}, 0xc, &(0x7f0000000240)={&(0x7f0000000200)={0x1c, r3, 0x20, 0x70bd26, 0x25dfdbfb, {}, [@MPTCP_PM_ATTR_RCV_ADD_ADDRS={0x8, 0x2, 0x6}]}, 0x1c}, 0x1, 0x0, 0x0, 0x1000}, 0x20008050) syz_open_dev$mouse(&(0x7f00000002c0), 0x7fffffff, 0x230200) getresuid(&(0x7f0000000340), &(0x7f0000000380), &(0x7f00000003c0)) 21:14:18 executing program 1: r0 = io_uring_setup(0x355e, &(0x7f0000000000)={0x0, 0x7682, 0x20, 0x1, 0x1be}) r1 = syz_io_uring_setup(0x8fe, &(0x7f0000000080)={0x0, 0x1830, 0x0, 0x0, 0x1b8, 0x0, r0}, &(0x7f0000ffb000/0x2000)=nil, &(0x7f0000ffb000/0x4000)=nil, &(0x7f0000000100), &(0x7f0000000140)=0x0) r3 = openat$hwrng(0xffffffffffffff9c, &(0x7f0000000180), 0x2, 0x0) r4 = syz_io_uring_setup(0x65dd, &(0x7f00000001c0)={0x0, 0xf46f, 0x20, 0x2, 0xdf}, &(0x7f0000ffe000/0x1000)=nil, &(0x7f0000ffd000/0x1000)=nil, &(0x7f0000000240), &(0x7f0000000280)) r5 = syz_genetlink_get_family_id$mptcp(&(0x7f0000000300), r3) sendmsg$MPTCP_PM_CMD_ADD_ADDR(r3, &(0x7f00000003c0)={&(0x7f00000002c0)={0x10, 0x0, 0x0, 0x10}, 0xc, &(0x7f0000000380)={&(0x7f0000000340)={0x24, r5, 0x300, 0x70bd26, 0x25dfdbfb, {}, [@MPTCP_PM_ATTR_SUBFLOWS={0x8, 0x3, 0x1}, @MPTCP_PM_ATTR_RCV_ADD_ADDRS={0x8, 0x2, 0x2}]}, 0x24}, 0x1, 0x0, 0x0, 0x20000004}, 0x8890) syz_io_uring_setup(0x20f8, &(0x7f0000000400)={0x0, 0x7677, 0x8, 0x3, 0x22f, 0x0, r4}, &(0x7f0000ffe000/0x2000)=nil, &(0x7f0000ffb000/0x2000)=nil, &(0x7f0000000480)=0x0, &(0x7f00000004c0)) r7 = openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000500)='./cgroup/syz1\x00', 0x200002, 0x0) syz_io_uring_submit(r6, r2, &(0x7f0000000580)=@IORING_OP_FILES_UPDATE={0x14, 0x4, 0x0, 0x0, 0x40, &(0x7f0000000540)=[r4, 0xffffffffffffffff, r7, r0, r1], 0x5}, 0x3) io_uring_setup(0x2812, &(0x7f00000005c0)={0x0, 0x5e1b, 0x2, 0x3, 0x12f, 0x0, r4}) getpeername(r3, &(0x7f0000000640)=@nfc, &(0x7f00000006c0)=0x80) ioctl$SIOCSIFHWADDR(r3, 0x8924, &(0x7f0000000700)={'hsr0\x00', @broadcast}) socket$inet6_tcp(0xa, 0x1, 0x0) sendmsg$OSF_MSG_REMOVE(r3, &(0x7f0000000f00)={&(0x7f0000000740)={0x10, 0x0, 0x0, 0x2000000}, 0xc, &(0x7f0000000ec0)={&(0x7f0000000780)={0x710, 0x1, 0x5, 0x201, 0x0, 0x0, {0x2, 0x0, 0xa}, [{{0x254, 0x1, {{0x3, 0xd16}, 0x5, 0x8, 0x9, 0xbad1, 0x1d, 'syz1\x00', "02d9d510ee96957b7df8dd68f410d3c0f3127247fd3254ba7a00035b858be02d", "f3957ad69b719399a72d8a9b4aefdb9275ec9eec85bc6745883fdd04eb14ed5b", [{0x2, 0xfbff, {0x3, 0x10000}}, {0x0, 0x8001, {0x0, 0x9}}, {0x7f, 0x0, {0x3, 0x800}}, {0x80, 0xad, {0x0, 0x6}}, {0x7f, 0x1, {0x1, 0x13}}, {0x2, 0x5, {0x1, 0x38}}, {0x0, 0x800, {0x0, 0xec0}}, {0x3, 0x0, {0x3, 0x5}}, {0x0, 0x400, {0x0, 0x8000}}, {0xffff, 0x9, {0x0, 0xcb04}}, {0x6, 0x1, {0x0, 0x3}}, {0x7, 0x7, {0x0, 0x7ff}}, {0xff3e, 0xed, {0x1, 0x20}}, {0x8, 0x8, {0x3, 0x3b}}, {0x0, 0x1ff, {0x1, 0x6}}, {0x7, 0x3f, {0x2, 0x10001}}, {0x1, 0x2, {0x1, 0x8}}, {0x3f, 0xa854, {0x2, 0x7}}, {0x9, 0x1ff, {0x0, 0x35e}}, {0xa7fd, 0x6e3, {0x0, 0x5af}}, {0x42c, 0x3, {0x1, 0x2}}, {0x1, 0xdd, {0x0, 0x57}}, {0x90, 0x2, {0x2, 0x4}}, {0x2, 0x2, {0x1, 0x2}}, {0x0, 0xfa, {0x0, 0x8}}, {0xb86, 0x6, {0x0, 0x7}}, {0xff1, 0x9, {0x0, 0xf05}}, {0x400, 0x8000, {0x1, 0x1}}, {0x0, 0x720, {0x3, 0x4}}, {0x9, 0xd84, {0x3, 0xeb5f}}, {0x8, 0x4, {0x2, 0x6}}, {0x8313, 0x7fff, {0x0, 0x1}}, {0x800, 0x6, {0x2, 0x6}}, {0xff, 0x4, {0x1, 0xfff}}, {0x1, 0x200, {0x2}}, {0x7f, 0x9, {0x0, 0x4}}, {0x1, 0x0, {0x0, 0x200}}, {0x7, 0x101, {0x3, 0x1}}, {0x3f, 0xfff, {0x1, 0xd385}}, {0xfffb, 0x401, {0x0, 0x6e49}}]}}}, {{0x254, 0x1, {{0x3, 0x7}, 0x55, 0x1, 0x7, 0x3258, 0x22, 'syz0\x00', "1372c553c4662b99d0128ae9de6223ccdf3460c1327fe339adab7cd55d8e4b3e", "9b9b700c2c6deb776a134b91af1485c90dfaf6614121cfae0e94dff30a6a0950", [{0x2, 0xfd, {0x3, 0x5}}, {0x20, 0xf24, {0x2, 0x9}}, {0xffff, 0x7, {0x0, 0x40}}, {0x9, 0x0, {0x3, 0x8}}, {0x7, 0x8, {0x2, 0x832}}, {0xba4b, 0x20, {0x3, 0x4}}, {0x20, 0x1fc0, {0x2, 0x6}}, {0x53df, 0x5, {0x0, 0x3014}}, {0x3, 0x5, {0x3, 0x6}}, {0x7ff, 0x2, {0x1, 0x10000}}, {0xee0, 0x7, {0x1, 0xfffffffa}}, {0x8, 0x6, {0x3, 0x9}}, {0x1, 0x3, {0x1, 0x6}}, {0x8, 0xfffa, {0x3, 0x1}}, {0x3, 0x8, {0x3}}, {0x8000, 0x3, {0x3, 0x4}}, {0xfff, 0x8, {0x1, 0x7}}, {0xf931, 0x3, {0x3, 0x2}}, {0x6, 0x8c3f}, {0x5, 0x9, {0x3, 0x11458ba5}}, {0x92, 0x1, {0x1, 0xfffffcf3}}, {0x2, 0x9, {0x0, 0x7fff}}, {0x96c, 0x40, {0x0, 0x4d}}, {0x3, 0x101, {0x3, 0x74f9}}, {0x2, 0x1, {0x3, 0x5}}, {0x8, 0xfffa, {0x0, 0x1}}, {0x8, 0xfffe, {0x0, 0x1410}}, {0xd5, 0x5, {0x1, 0x2}}, {0xffff, 0x8, {0x1, 0x1ff}}, {0x5, 0x7, {0x1, 0x2}}, {0x4, 0x3abe, {0x0, 0xdea}}, {0x5, 0x5, {0x0, 0x80}}, {0x5, 0x100, {0x2, 0x200}}, {0x8000, 0x6, {0x3, 0x6}}, {0x5, 0x3, {0x3, 0x7fffffff}}, {0x2e, 0x7, {0x3, 0xb6d1}}, {0x8, 0x5, {0x2, 0x6}}, {0x7ff, 0x9, {0x2, 0x41c4d1bc}}, {0x6, 0x858, {0x0, 0x9}}, {0x9, 0x4, {0x0, 0xf}}]}}}, {{0x254, 0x1, {{0x1, 0x84}, 0xff, 0x6, 0x2, 0x40, 0x3, 'syz1\x00', "2dcd30757a69ad11f635b1771ef0dba9f59d98d2260ee7db2b11138f872a7c19", "f93f6bdfb1db39415342f42f96cd7657435e0b32c989f60760498746881338cd", [{0x1, 0xa3e7, {0x2, 0x6}}, {0x4, 0x4, {0x1, 0x20}}, {0x200, 0x494, {0x1, 0x10001}}, {0x7, 0x1, {0x3, 0xffffff73}}, {0x1, 0x1ff, {0x2, 0xbc}}, {0x7, 0x33, {0x1, 0x1}}, {0x8, 0x7, {0x3, 0x4}}, {0xff, 0xffff, {0x1, 0x36a}}, {0x3, 0x7, {0x0, 0x1}}, {0x77df, 0xfff8, {0x1, 0x2}}, {0x7, 0x5}, {0x1, 0xb3, {0x3}}, {0x7, 0x7, {0x3, 0x1c000000}}, {0xcb, 0x47ec, {0x1, 0x5}}, {0xe4a9, 0xfe00, {0x1, 0x4}}, {0x20, 0x4eb1, {0x2, 0x46}}, {0x4, 0xfff9, {0x2, 0xffffffe1}}, {0x2, 0x100, {0x3}}, {0x6, 0x4, {0x0, 0x1}}, {0xc9, 0xed, {0x1, 0x7f}}, {0xffa7, 0x0, {0x3, 0x8000}}, {0x8, 0x1ff, {0x3, 0xfffff69e}}, {0x8000, 0x3, {0x1}}, {0x6, 0x8001, {0x1, 0x4}}, {0xd1a2, 0x100, {0x1, 0x7}}, {0x3ad, 0x5, {0x1, 0x3}}, {0x0, 0xfff, {0x1, 0x400}}, {0x1, 0x8, {0x3, 0x1}}, {0x3, 0x6, {0x0, 0x7}}, {0x2, 0x6, {0x0, 0xd8}}, {0x3, 0x400, {0x2, 0x7}}, {0x67d, 0x3, {0x0, 0x6348}}, {0x0, 0x8, {0x1, 0x9}}, {0x7d2, 0x3, {0x1, 0x80}}, {0x9, 0x3, {0x2, 0x1}}, {0x1ff, 0x1, {0x0, 0x16}}, {0x7, 0x9, {0x0, 0xe9}}, {0x6, 0x7, {0x3}}, {0x0, 0x7, {0x3, 0x7fff}}, {0x6850, 0x29e, {0x3, 0x9}}]}}}]}, 0x710}, 0x1, 0x0, 0x0, 0x11}, 0x71272780a8dc51e3) ioctl$SCSI_IOCTL_GET_IDLUN(r3, 0x5382, &(0x7f0000000f40)) openat$procfs(0xffffffffffffff9c, &(0x7f00000010c0)='/proc/crypto\x00', 0x0, 0x0) io_uring_setup(0x7c8f, &(0x7f0000001140)={0x0, 0xc240, 0x10, 0x3, 0x1c7, 0x0, r4}) 21:14:18 executing program 5: ptrace$peekuser(0x3, 0xffffffffffffffff, 0x3ff) prctl$PR_MPX_ENABLE_MANAGEMENT(0x2b) clock_adjtime(0x0, &(0x7f0000000000)={0xf0, 0xfff, 0x6, 0x40, 0x1ff, 0x1ff, 0x1, 0xe1, 0x5, 0xe68c, 0x95c, 0x1000, 0xe, 0x100000000, 0x8000, 0x2, 0x6, 0xab, 0xffff, 0x3, 0xff, 0x9, 0x6a9f, 0x1, 0x4, 0xfffffffffffffff9}) prctl$PR_MPX_ENABLE_MANAGEMENT(0x2b) ioctl$SCSI_IOCTL_DOORUNLOCK(0xffffffffffffffff, 0x5381) ioctl$SG_GET_TIMEOUT(0xffffffffffffffff, 0x2202, 0x0) r0 = syz_open_dev$vcsa(&(0x7f0000000100), 0x1, 0x80100) ioctl$SCSI_IOCTL_DOORLOCK(r0, 0x5380) sendmsg$NL80211_CMD_ASSOCIATE(0xffffffffffffffff, &(0x7f0000000440)={&(0x7f0000000300)={0x10, 0x0, 0x0, 0x8000000}, 0xc, &(0x7f0000000400)={&(0x7f0000000380)={0x54, 0x0, 0x4, 0x70bd2c, 0x25dfdbff, {{}, {@val={0x8}, @val={0xc, 0x99, {0x0, 0x78}}}}, [@NL80211_ATTR_SSID={0xa, 0x34, @default_ap_ssid}, @NL80211_ATTR_HT_CAPABILITY={0x1e, 0x1f, {0x300, 0x1, 0x1, 0x0, {0x6, 0x4c, 0x0, 0x4, 0x0, 0x1, 0x0, 0x1, 0x1}, 0x400, 0x2, 0x6}}]}, 0x54}}, 0x0) 21:14:18 executing program 3: r0 = openat$vcsa(0xffffffffffffff9c, &(0x7f0000000000), 0x180, 0x0) ioctl$SG_SET_FORCE_PACK_ID(r0, 0x227b, &(0x7f0000000040)=0x1) ioctl$SCSI_IOCTL_GET_BUS_NUMBER(r0, 0x5386, &(0x7f0000000080)) syz_open_dev$sg(&(0x7f0000000400), 0x494, 0x22000) 21:14:18 executing program 2: ioctl$SCSI_IOCTL_DOORUNLOCK(0xffffffffffffffff, 0x5381) r0 = syz_open_dev$mouse(&(0x7f0000000000), 0x578, 0x4000) ioctl$SG_GET_PACK_ID(r0, 0x227c, &(0x7f0000000040)) r1 = syz_genetlink_get_family_id$nl80211(&(0x7f00000000c0), r0) sendmsg$NL80211_CMD_NEW_KEY(r0, &(0x7f00000001c0)={&(0x7f0000000080)={0x10, 0x0, 0x0, 0x10}, 0xc, &(0x7f0000000180)={&(0x7f0000000100)={0x60, r1, 0x400, 0x70bd2b, 0x25dfdbff, {{}, {@val={0x8}, @void}}, [@NL80211_ATTR_KEY_TYPE={0x8, 0x37, 0x1}, @NL80211_ATTR_KEY_DEFAULT_MGMT={0x4}, @NL80211_ATTR_KEY={0x2c, 0x50, 0x0, 0x1, [@NL80211_KEY_DATA_WEP40={0x9, 0x1, "93f3c5ad5d"}, @NL80211_KEY_DEFAULT_TYPES={0x8, 0x8, 0x0, 0x1, [@NL80211_KEY_DEFAULT_TYPE_MULTICAST={0x4}]}, @NL80211_KEY_DATA_WEP104={0x11, 0x1, "8815558ac60368b42ebdf03bdb"}]}, @NL80211_ATTR_KEY_DATA_WEP40={0x9, 0x7, "74de692476"}]}, 0x60}, 0x1, 0x0, 0x0, 0x4000000}, 0x8000) r2 = openat$procfs(0xffffffffffffff9c, &(0x7f0000000200)='/proc/stat\x00', 0x0, 0x0) ioctl$SG_GET_TIMEOUT(r2, 0x2202, 0x0) ioctl$SG_SET_FORCE_PACK_ID(r0, 0x227b, &(0x7f0000000240)=0x1) ioctl$TUNGETIFF(r0, 0x800454d2, &(0x7f0000000280)={'vlan0\x00'}) sendmsg$NL80211_CMD_JOIN_MESH(r0, &(0x7f0000000400)={&(0x7f00000002c0)={0x10, 0x0, 0x0, 0x8}, 0xc, &(0x7f00000003c0)={&(0x7f0000000300)={0xc0, r1, 0x400, 0x70bd28, 0x25dfdbfc, {{}, {@void, @void}}, [@NL80211_ATTR_SOCKET_OWNER={0x4}, @NL80211_ATTR_MESH_SETUP={0xa8, 0x70, [@NL80211_MESH_SETUP_ENABLE_VENDOR_METRIC={0x5, 0x2, 0x1}, @NL80211_MESH_SETUP_IE={0x6b, 0x3, "432578a2646e5ab8df23d89ff57571f258fae075fd43855fb9486d9209824c25dbf24af1a18187d074463ff5b11350c72de592b494efe5b4f34cbc2a7a8a1160fd0a59dafb8fe7173e1b109dd23d0edf69c40605089d1c24278a427d497c415ba944a9a901d2b5"}, @NL80211_MESH_SETUP_USERSPACE_MPM={0x4}, @NL80211_MESH_SETUP_USERSPACE_AUTH={0x4}, @NL80211_MESH_SETUP_ENABLE_VENDOR_PATH_SEL={0x5, 0x1, 0x1}, @NL80211_MESH_SETUP_ENABLE_VENDOR_PATH_SEL={0x5, 0x1, 0x1}, @NL80211_MESH_SETUP_ENABLE_VENDOR_PATH_SEL={0x5, 0x1, 0x1}, @NL80211_MESH_SETUP_ENABLE_VENDOR_SYNC={0x5, 0x6, 0x1}, @NL80211_MESH_SETUP_USERSPACE_AUTH={0x4}, @NL80211_MESH_SETUP_USERSPACE_AMPE={0x4}]}]}, 0xc0}, 0x1, 0x0, 0x0, 0x10}, 0x4000001) ioctl$SCSI_IOCTL_DOORUNLOCK(r2, 0x5381) syz_open_dev$vcsa(&(0x7f0000000440), 0x56, 0x4000) syz_genetlink_get_family_id$nl80211(&(0x7f00000004c0), r0) ioctl$sock_SIOCGIFINDEX_80211(r0, 0x8933, &(0x7f0000000500)={'wlan0\x00'}) socketpair(0x0, 0x3, 0x6, &(0x7f0000000640)) r3 = openat$tcp_congestion(0xffffffffffffff9c, &(0x7f0000000800), 0x1, 0x0) write$tcp_congestion(r3, &(0x7f0000000840)='htcp\x00', 0x5) 21:14:18 executing program 6: r0 = request_key(&(0x7f0000000000)='dns_resolver\x00', &(0x7f0000000040)={'syz', 0x1}, &(0x7f0000000080)=',{{\x00', 0x0) r1 = add_key$keyring(&(0x7f0000000140), &(0x7f0000000180)={'syz', 0x1}, 0x0, 0x0, r0) add_key$keyring(&(0x7f00000000c0), &(0x7f0000000100)={'syz', 0x3}, 0x0, 0x0, r1) keyctl$KEYCTL_PKEY_SIGN(0x1b, &(0x7f00000009c0)={r1, 0x6c, 0x6d}, &(0x7f0000000a00)={'enc=', 'pkcs1', ' hash=', {'nhpoly1305-generic\x00'}}, &(0x7f0000000a80)="64824bc7426fe2f3e3c1e475569073ecff8ffb96e46626b91f3b9a2b2ac07610524644af1e29c43d27e1d513a86909a6ac4d9753ce88f3f3d0beb31db8dfdbcb65379a9cc111189465a0cd8a50f7c19f1579f44a95805d41c0c92de97999b1d961ee48d58cfddc3720b2cd20", &(0x7f0000000b00)=""/109) 21:14:18 executing program 7: write$P9_RSYMLINK(0xffffffffffffffff, &(0x7f0000000000)={0x14, 0x11, 0x2, {0x40, 0x3, 0x2}}, 0x14) ioctl$sock_ifreq(0xffffffffffffffff, 0x8935, &(0x7f0000000040)={'lo\x00', @ifru_addrs=@ethernet}) ioctl$sock_ifreq(0xffffffffffffffff, 0x8994, &(0x7f0000000080)={'ip6gretap0\x00', @ifru_flags}) sendmsg$IPSET_CMD_FLUSH(0xffffffffffffffff, &(0x7f0000000180)={&(0x7f00000000c0)={0x10, 0x0, 0x0, 0x10000}, 0xc, &(0x7f0000000140)={&(0x7f0000000100)={0x3c, 0x4, 0x6, 0x801, 0x0, 0x0, {0x3, 0x0, 0x4}, [@IPSET_ATTR_PROTOCOL={0x5}, @IPSET_ATTR_SETNAME={0x9, 0x2, 'syz0\x00'}, @IPSET_ATTR_SETNAME={0x9, 0x2, 'syz2\x00'}, @IPSET_ATTR_PROTOCOL={0x5}]}, 0x3c}}, 0x20000000) write$P9_RVERSION(0xffffffffffffffff, &(0x7f00000001c0)={0x13, 0x65, 0xffff, 0x3, 0x6, '9P2000'}, 0x13) pipe2$9p(&(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}, 0x0) write$P9_RSYMLINK(r0, &(0x7f0000000240)={0x14, 0x11, 0x1, {0x1, 0x3, 0x2}}, 0x14) add_key$fscrypt_v1(&(0x7f0000000280), &(0x7f00000002c0)={'fscrypt:', @desc2}, &(0x7f0000000300)={0x0, "ccf022eeb1aa5b4a9067674b5b7079352411c35248e190415959cbe4b7be99236abd831288583a8ed4db4b7b3f838c24d293f908bf3509b49f2c17852201f646", 0x19}, 0x48, 0xfffffffffffffffa) add_key$fscrypt_v1(&(0x7f0000000380), &(0x7f00000003c0)={'fscrypt:', @auto=[0x38, 0x65, 0x62, 0x61, 0x61, 0x62, 0x61, 0x64, 0x37, 0x32, 0x30, 0x61, 0x61, 0x50, 0x62, 0x62]}, &(0x7f0000000400)={0x0, "4916f745ecf1627b46363a6005d9ff599dde016c8b8d9d347624fd26c6e8bdbb7555714d1669e0e45bd9e03a462b54b255d728a05790d4698c32583ade59ecd8", 0x36}, 0x48, 0x0) r1 = syz_genetlink_get_family_id$mptcp(&(0x7f00000004c0), 0xffffffffffffffff) ioctl$ifreq_SIOCGIFINDEX_vcan(0xffffffffffffffff, 0x8933, &(0x7f00000005c0)={'vxcan0\x00', 0x0}) sendmsg$MPTCP_PM_CMD_GET_ADDR(0xffffffffffffffff, &(0x7f0000000740)={&(0x7f0000000480)={0x10, 0x0, 0x0, 0x80000000}, 0xc, &(0x7f0000000700)={&(0x7f0000000600)={0xcc, r1, 0x400, 0x70bd2c, 0x25dfdbfd, {}, [@MPTCP_PM_ATTR_ADDR={0x14, 0x1, 0x0, 0x1, [@MPTCP_PM_ADDR_ATTR_FLAGS={0x8, 0x6, 0x2}, @MPTCP_PM_ADDR_ATTR_ID={0x5}]}, @MPTCP_PM_ATTR_SUBFLOWS={0x8, 0x3, 0x1}, @MPTCP_PM_ATTR_ADDR={0x54, 0x1, 0x0, 0x1, [@MPTCP_PM_ADDR_ATTR_ADDR6={0x14, 0x4, @private1}, @MPTCP_PM_ADDR_ATTR_ID={0x5}, @MPTCP_PM_ADDR_ATTR_FAMILY={0x6, 0x1, 0x2}, @MPTCP_PM_ADDR_ATTR_ID={0x5, 0x2, 0x20}, @MPTCP_PM_ADDR_ATTR_IF_IDX={0x8}, @MPTCP_PM_ADDR_ATTR_ADDR6={0x14, 0x4, @rand_addr=' \x01\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x02'}, @MPTCP_PM_ADDR_ATTR_ADDR4={0x8, 0x3, @broadcast}]}, @MPTCP_PM_ATTR_ADDR={0x48, 0x1, 0x0, 0x1, [@MPTCP_PM_ADDR_ATTR_ADDR6={0x14, 0x4, @private2={0xfc, 0x2, '\x00', 0x1}}, @MPTCP_PM_ADDR_ATTR_IF_IDX={0x8, 0x7, r2}, @MPTCP_PM_ADDR_ATTR_FLAGS={0x8, 0x6, 0x4}, @MPTCP_PM_ADDR_ATTR_ADDR4={0x8, 0x3, @remote}, @MPTCP_PM_ADDR_ATTR_ADDR4={0x8, 0x3, @multicast1}, @MPTCP_PM_ADDR_ATTR_ADDR4={0x8, 0x3, @private=0xa010102}, @MPTCP_PM_ADDR_ATTR_ADDR4={0x8, 0x3, @rand_addr=0x64010101}]}]}, 0xcc}, 0x1, 0x0, 0x0, 0x8080}, 0x80) sendmsg$NL80211_CMD_GET_KEY(0xffffffffffffffff, &(0x7f0000000880)={&(0x7f0000000780)={0x10, 0x0, 0x0, 0x80000}, 0xc, &(0x7f0000000840)={&(0x7f00000007c0)={0x70, 0x0, 0x100, 0x70bd26, 0x25dfdbff, {{}, {@void, @void}}, [@NL80211_ATTR_KEY_DATA_WEP40={0x9, 0x7, "79d2a1c46c"}, @NL80211_ATTR_KEY_DATA_WEP104={0x11, 0x7, "e8db493fbaba6fa81c387c85d8"}, @NL80211_ATTR_KEY_DATA_WEP104={0x11, 0x7, "f8af8a10eebb9b4c600eb01c28"}, @NL80211_ATTR_KEY_SEQ={0x8, 0xa, "39cff2d0"}, @NL80211_ATTR_KEY_IDX={0x5, 0x8, 0x4}, @NL80211_ATTR_KEY_DEFAULT_TYPES={0xc, 0x6e, 0x0, 0x1, [@NL80211_KEY_DEFAULT_TYPE_MULTICAST={0x4}, @NL80211_KEY_DEFAULT_TYPE_UNICAST={0x4}]}, @NL80211_ATTR_MAC={0xa}]}, 0x70}, 0x1, 0x0, 0x0, 0x880}, 0x0) sendmsg$NL80211_CMD_GET_WOWLAN(0xffffffffffffffff, &(0x7f0000000980)={&(0x7f00000008c0)={0x10, 0x0, 0x0, 0x800000}, 0xc, &(0x7f0000000940)={&(0x7f0000000900)={0x1c, 0x0, 0x20, 0x70bd29, 0x25dfdbfc, {{}, {@void, @val={0x8}, @void}}, [""]}, 0x1c}, 0x1, 0x0, 0x0, 0x4044191}, 0x20040040) syz_genetlink_get_family_id$mptcp(&(0x7f0000000a80), 0xffffffffffffffff) 21:14:18 executing program 4: recvmmsg(0xffffffffffffffff, &(0x7f0000000280)=[{{0x0, 0x0, &(0x7f0000000140)=[{&(0x7f0000000000)=""/11, 0xb}, {&(0x7f0000000040)=""/238, 0xee}], 0x2, &(0x7f0000000180)=""/244, 0xf4}, 0xb67}], 0x1, 0x102, 0x0) sendmsg$NFULNL_MSG_CONFIG(0xffffffffffffffff, &(0x7f00000003c0)={&(0x7f00000002c0)={0x10, 0x0, 0x0, 0x1000000}, 0xc, &(0x7f0000000380)={&(0x7f0000000300)={0x50, 0x1, 0x4, 0x101, 0x0, 0x0, {0xc, 0x0, 0x3}, [@NFULA_CFG_MODE={0xa, 0x2, {0x0, 0x2}}, @NFULA_CFG_QTHRESH={0x8, 0x5, 0x1, 0x0, 0xffffffc0}, @NFULA_CFG_TIMEOUT={0x8, 0x4, 0x1, 0x0, 0x54}, @NFULA_CFG_FLAGS={0x6}, @NFULA_CFG_TIMEOUT={0x8, 0x4, 0x1, 0x0, 0x6}, @NFULA_CFG_NLBUFSIZ={0x8, 0x3, 0x1, 0x0, 0x7f}, @NFULA_CFG_NLBUFSIZ={0x8, 0x3, 0x1, 0x0, 0x8}]}, 0x50}, 0x1, 0x0, 0x0, 0x408d4}, 0x20000091) r0 = openat$procfs(0xffffffffffffff9c, &(0x7f0000000400)='/proc/schedstat\x00', 0x0, 0x0) syz_io_uring_submit(0x0, 0x0, &(0x7f0000000440)=@IORING_OP_SPLICE={0x1e, 0x2, 0x0, @fd, 0x9, {}, 0x830, 0xa, 0x0, {0x0, 0x0, r0}}, 0x5) connect$bt_l2cap(r0, &(0x7f0000000480)={0x1f, 0x71, @none, 0x4, 0x2}, 0xe) r1 = syz_open_dev$vcsa(&(0x7f00000004c0), 0x20, 0xc0101) setsockopt$bt_BT_SNDMTU(r1, 0x112, 0xc, &(0x7f0000000500), 0x2) syz_open_dev$sg(&(0x7f0000000540), 0x9, 0x18000) bind$bt_l2cap(0xffffffffffffffff, &(0x7f0000000dc0)={0x1f, 0xb9e5, @fixed={'\xaa\xaa\xaa\xaa\xaa', 0x12}, 0x1f, 0x1}, 0xe) 21:14:18 executing program 3: r0 = openat$vcsa(0xffffffffffffff9c, &(0x7f0000000000), 0x180, 0x0) ioctl$SG_SET_FORCE_PACK_ID(r0, 0x227b, &(0x7f0000000040)=0x1) syz_open_dev$sg(&(0x7f0000000400), 0x494, 0x22000) 21:14:18 executing program 5: ptrace$peekuser(0x3, 0xffffffffffffffff, 0x3ff) prctl$PR_MPX_ENABLE_MANAGEMENT(0x2b) clock_adjtime(0x0, &(0x7f0000000000)={0xf0, 0xfff, 0x6, 0x40, 0x1ff, 0x1ff, 0x1, 0xe1, 0x5, 0xe68c, 0x95c, 0x1000, 0xe, 0x100000000, 0x8000, 0x2, 0x6, 0xab, 0xffff, 0x3, 0xff, 0x9, 0x6a9f, 0x1, 0x4, 0xfffffffffffffff9}) prctl$PR_MPX_ENABLE_MANAGEMENT(0x2b) ioctl$SCSI_IOCTL_DOORUNLOCK(0xffffffffffffffff, 0x5381) ioctl$SG_GET_TIMEOUT(0xffffffffffffffff, 0x2202, 0x0) r0 = syz_open_dev$vcsa(&(0x7f0000000100), 0x1, 0x80100) ioctl$SCSI_IOCTL_DOORLOCK(r0, 0x5380) sendmsg$NL80211_CMD_ASSOCIATE(0xffffffffffffffff, &(0x7f0000000440)={&(0x7f0000000300)={0x10, 0x0, 0x0, 0x8000000}, 0xc, &(0x7f0000000400)={&(0x7f0000000380)={0x54, 0x0, 0x4, 0x70bd2c, 0x25dfdbff, {{}, {@val={0x8}, @val={0xc, 0x99, {0x0, 0x78}}}}, [@NL80211_ATTR_SSID={0xa, 0x34, @default_ap_ssid}, @NL80211_ATTR_HT_CAPABILITY={0x1e, 0x1f, {0x300, 0x1, 0x1, 0x0, {0x6, 0x4c, 0x0, 0x4, 0x0, 0x1, 0x0, 0x1, 0x1}, 0x400, 0x2, 0x6}}]}, 0x54}}, 0x0) 21:14:18 executing program 1: r0 = io_uring_setup(0x355e, &(0x7f0000000000)={0x0, 0x7682, 0x20, 0x1, 0x1be}) r1 = syz_io_uring_setup(0x8fe, &(0x7f0000000080)={0x0, 0x1830, 0x0, 0x0, 0x1b8, 0x0, r0}, &(0x7f0000ffb000/0x2000)=nil, &(0x7f0000ffb000/0x4000)=nil, &(0x7f0000000100), &(0x7f0000000140)=0x0) r3 = openat$hwrng(0xffffffffffffff9c, &(0x7f0000000180), 0x2, 0x0) r4 = syz_io_uring_setup(0x65dd, &(0x7f00000001c0)={0x0, 0xf46f, 0x20, 0x2, 0xdf}, &(0x7f0000ffe000/0x1000)=nil, &(0x7f0000ffd000/0x1000)=nil, &(0x7f0000000240), &(0x7f0000000280)) r5 = syz_genetlink_get_family_id$mptcp(&(0x7f0000000300), r3) sendmsg$MPTCP_PM_CMD_ADD_ADDR(r3, &(0x7f00000003c0)={&(0x7f00000002c0)={0x10, 0x0, 0x0, 0x10}, 0xc, &(0x7f0000000380)={&(0x7f0000000340)={0x24, r5, 0x300, 0x70bd26, 0x25dfdbfb, {}, [@MPTCP_PM_ATTR_SUBFLOWS={0x8, 0x3, 0x1}, @MPTCP_PM_ATTR_RCV_ADD_ADDRS={0x8, 0x2, 0x2}]}, 0x24}, 0x1, 0x0, 0x0, 0x20000004}, 0x8890) syz_io_uring_setup(0x20f8, &(0x7f0000000400)={0x0, 0x7677, 0x8, 0x3, 0x22f, 0x0, r4}, &(0x7f0000ffe000/0x2000)=nil, &(0x7f0000ffb000/0x2000)=nil, &(0x7f0000000480)=0x0, &(0x7f00000004c0)) r7 = openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000500)='./cgroup/syz1\x00', 0x200002, 0x0) syz_io_uring_submit(r6, r2, &(0x7f0000000580)=@IORING_OP_FILES_UPDATE={0x14, 0x4, 0x0, 0x0, 0x40, &(0x7f0000000540)=[r4, 0xffffffffffffffff, r7, r0, r1], 0x5}, 0x3) io_uring_setup(0x2812, &(0x7f00000005c0)={0x0, 0x5e1b, 0x2, 0x3, 0x12f, 0x0, r4}) getpeername(r3, &(0x7f0000000640)=@nfc, &(0x7f00000006c0)=0x80) ioctl$SIOCSIFHWADDR(r3, 0x8924, &(0x7f0000000700)={'hsr0\x00', @broadcast}) socket$inet6_tcp(0xa, 0x1, 0x0) sendmsg$OSF_MSG_REMOVE(r3, &(0x7f0000000f00)={&(0x7f0000000740)={0x10, 0x0, 0x0, 0x2000000}, 0xc, &(0x7f0000000ec0)={&(0x7f0000000780)={0x710, 0x1, 0x5, 0x201, 0x0, 0x0, {0x2, 0x0, 0xa}, [{{0x254, 0x1, {{0x3, 0xd16}, 0x5, 0x8, 0x9, 0xbad1, 0x1d, 'syz1\x00', "02d9d510ee96957b7df8dd68f410d3c0f3127247fd3254ba7a00035b858be02d", "f3957ad69b719399a72d8a9b4aefdb9275ec9eec85bc6745883fdd04eb14ed5b", [{0x2, 0xfbff, {0x3, 0x10000}}, {0x0, 0x8001, {0x0, 0x9}}, {0x7f, 0x0, {0x3, 0x800}}, {0x80, 0xad, {0x0, 0x6}}, {0x7f, 0x1, {0x1, 0x13}}, {0x2, 0x5, {0x1, 0x38}}, {0x0, 0x800, {0x0, 0xec0}}, {0x3, 0x0, {0x3, 0x5}}, {0x0, 0x400, {0x0, 0x8000}}, {0xffff, 0x9, {0x0, 0xcb04}}, {0x6, 0x1, {0x0, 0x3}}, {0x7, 0x7, {0x0, 0x7ff}}, {0xff3e, 0xed, {0x1, 0x20}}, {0x8, 0x8, {0x3, 0x3b}}, {0x0, 0x1ff, {0x1, 0x6}}, {0x7, 0x3f, {0x2, 0x10001}}, {0x1, 0x2, {0x1, 0x8}}, {0x3f, 0xa854, {0x2, 0x7}}, {0x9, 0x1ff, {0x0, 0x35e}}, {0xa7fd, 0x6e3, {0x0, 0x5af}}, {0x42c, 0x3, {0x1, 0x2}}, {0x1, 0xdd, {0x0, 0x57}}, {0x90, 0x2, {0x2, 0x4}}, {0x2, 0x2, {0x1, 0x2}}, {0x0, 0xfa, {0x0, 0x8}}, {0xb86, 0x6, {0x0, 0x7}}, {0xff1, 0x9, {0x0, 0xf05}}, {0x400, 0x8000, {0x1, 0x1}}, {0x0, 0x720, {0x3, 0x4}}, {0x9, 0xd84, {0x3, 0xeb5f}}, {0x8, 0x4, {0x2, 0x6}}, {0x8313, 0x7fff, {0x0, 0x1}}, {0x800, 0x6, {0x2, 0x6}}, {0xff, 0x4, {0x1, 0xfff}}, {0x1, 0x200, {0x2}}, {0x7f, 0x9, {0x0, 0x4}}, {0x1, 0x0, {0x0, 0x200}}, {0x7, 0x101, {0x3, 0x1}}, {0x3f, 0xfff, {0x1, 0xd385}}, {0xfffb, 0x401, {0x0, 0x6e49}}]}}}, {{0x254, 0x1, {{0x3, 0x7}, 0x55, 0x1, 0x7, 0x3258, 0x22, 'syz0\x00', "1372c553c4662b99d0128ae9de6223ccdf3460c1327fe339adab7cd55d8e4b3e", "9b9b700c2c6deb776a134b91af1485c90dfaf6614121cfae0e94dff30a6a0950", [{0x2, 0xfd, {0x3, 0x5}}, {0x20, 0xf24, {0x2, 0x9}}, {0xffff, 0x7, {0x0, 0x40}}, {0x9, 0x0, {0x3, 0x8}}, {0x7, 0x8, {0x2, 0x832}}, {0xba4b, 0x20, {0x3, 0x4}}, {0x20, 0x1fc0, {0x2, 0x6}}, {0x53df, 0x5, {0x0, 0x3014}}, {0x3, 0x5, {0x3, 0x6}}, {0x7ff, 0x2, {0x1, 0x10000}}, {0xee0, 0x7, {0x1, 0xfffffffa}}, {0x8, 0x6, {0x3, 0x9}}, {0x1, 0x3, {0x1, 0x6}}, {0x8, 0xfffa, {0x3, 0x1}}, {0x3, 0x8, {0x3}}, {0x8000, 0x3, {0x3, 0x4}}, {0xfff, 0x8, {0x1, 0x7}}, {0xf931, 0x3, {0x3, 0x2}}, {0x6, 0x8c3f}, {0x5, 0x9, {0x3, 0x11458ba5}}, {0x92, 0x1, {0x1, 0xfffffcf3}}, {0x2, 0x9, {0x0, 0x7fff}}, {0x96c, 0x40, {0x0, 0x4d}}, {0x3, 0x101, {0x3, 0x74f9}}, {0x2, 0x1, {0x3, 0x5}}, {0x8, 0xfffa, {0x0, 0x1}}, {0x8, 0xfffe, {0x0, 0x1410}}, {0xd5, 0x5, {0x1, 0x2}}, {0xffff, 0x8, {0x1, 0x1ff}}, {0x5, 0x7, {0x1, 0x2}}, {0x4, 0x3abe, {0x0, 0xdea}}, {0x5, 0x5, {0x0, 0x80}}, {0x5, 0x100, {0x2, 0x200}}, {0x8000, 0x6, {0x3, 0x6}}, {0x5, 0x3, {0x3, 0x7fffffff}}, {0x2e, 0x7, {0x3, 0xb6d1}}, {0x8, 0x5, {0x2, 0x6}}, {0x7ff, 0x9, {0x2, 0x41c4d1bc}}, {0x6, 0x858, {0x0, 0x9}}, {0x9, 0x4, {0x0, 0xf}}]}}}, {{0x254, 0x1, {{0x1, 0x84}, 0xff, 0x6, 0x2, 0x40, 0x3, 'syz1\x00', "2dcd30757a69ad11f635b1771ef0dba9f59d98d2260ee7db2b11138f872a7c19", "f93f6bdfb1db39415342f42f96cd7657435e0b32c989f60760498746881338cd", [{0x1, 0xa3e7, {0x2, 0x6}}, {0x4, 0x4, {0x1, 0x20}}, {0x200, 0x494, {0x1, 0x10001}}, {0x7, 0x1, {0x3, 0xffffff73}}, {0x1, 0x1ff, {0x2, 0xbc}}, {0x7, 0x33, {0x1, 0x1}}, {0x8, 0x7, {0x3, 0x4}}, {0xff, 0xffff, {0x1, 0x36a}}, {0x3, 0x7, {0x0, 0x1}}, {0x77df, 0xfff8, {0x1, 0x2}}, {0x7, 0x5}, {0x1, 0xb3, {0x3}}, {0x7, 0x7, {0x3, 0x1c000000}}, {0xcb, 0x47ec, {0x1, 0x5}}, {0xe4a9, 0xfe00, {0x1, 0x4}}, {0x20, 0x4eb1, {0x2, 0x46}}, {0x4, 0xfff9, {0x2, 0xffffffe1}}, {0x2, 0x100, {0x3}}, {0x6, 0x4, {0x0, 0x1}}, {0xc9, 0xed, {0x1, 0x7f}}, {0xffa7, 0x0, {0x3, 0x8000}}, {0x8, 0x1ff, {0x3, 0xfffff69e}}, {0x8000, 0x3, {0x1}}, {0x6, 0x8001, {0x1, 0x4}}, {0xd1a2, 0x100, {0x1, 0x7}}, {0x3ad, 0x5, {0x1, 0x3}}, {0x0, 0xfff, {0x1, 0x400}}, {0x1, 0x8, {0x3, 0x1}}, {0x3, 0x6, {0x0, 0x7}}, {0x2, 0x6, {0x0, 0xd8}}, {0x3, 0x400, {0x2, 0x7}}, {0x67d, 0x3, {0x0, 0x6348}}, {0x0, 0x8, {0x1, 0x9}}, {0x7d2, 0x3, {0x1, 0x80}}, {0x9, 0x3, {0x2, 0x1}}, {0x1ff, 0x1, {0x0, 0x16}}, {0x7, 0x9, {0x0, 0xe9}}, {0x6, 0x7, {0x3}}, {0x0, 0x7, {0x3, 0x7fff}}, {0x6850, 0x29e, {0x3, 0x9}}]}}}]}, 0x710}, 0x1, 0x0, 0x0, 0x11}, 0x71272780a8dc51e3) openat$procfs(0xffffffffffffff9c, &(0x7f00000010c0)='/proc/crypto\x00', 0x0, 0x0) io_uring_setup(0x7c8f, &(0x7f0000001140)={0x0, 0xc240, 0x10, 0x3, 0x1c7, 0x0, r4}) 21:14:18 executing program 4: recvmmsg(0xffffffffffffffff, &(0x7f0000000280)=[{{0x0, 0x0, &(0x7f0000000140)=[{&(0x7f0000000000)=""/11, 0xb}, {&(0x7f0000000040)=""/238, 0xee}], 0x2, &(0x7f0000000180)=""/244, 0xf4}, 0xb67}], 0x1, 0x102, 0x0) sendmsg$NFULNL_MSG_CONFIG(0xffffffffffffffff, &(0x7f00000003c0)={&(0x7f00000002c0)={0x10, 0x0, 0x0, 0x1000000}, 0xc, &(0x7f0000000380)={&(0x7f0000000300)={0x50, 0x1, 0x4, 0x101, 0x0, 0x0, {0xc, 0x0, 0x3}, [@NFULA_CFG_MODE={0xa, 0x2, {0x0, 0x2}}, @NFULA_CFG_QTHRESH={0x8, 0x5, 0x1, 0x0, 0xffffffc0}, @NFULA_CFG_TIMEOUT={0x8, 0x4, 0x1, 0x0, 0x54}, @NFULA_CFG_FLAGS={0x6}, @NFULA_CFG_TIMEOUT={0x8, 0x4, 0x1, 0x0, 0x6}, @NFULA_CFG_NLBUFSIZ={0x8, 0x3, 0x1, 0x0, 0x7f}, @NFULA_CFG_NLBUFSIZ={0x8, 0x3, 0x1, 0x0, 0x8}]}, 0x50}, 0x1, 0x0, 0x0, 0x408d4}, 0x20000091) r0 = openat$procfs(0xffffffffffffff9c, &(0x7f0000000400)='/proc/schedstat\x00', 0x0, 0x0) syz_io_uring_submit(0x0, 0x0, &(0x7f0000000440)=@IORING_OP_SPLICE={0x1e, 0x2, 0x0, @fd, 0x9, {}, 0x830, 0xa, 0x0, {0x0, 0x0, r0}}, 0x5) connect$bt_l2cap(r0, &(0x7f0000000480)={0x1f, 0x71, @none, 0x4, 0x2}, 0xe) r1 = syz_open_dev$vcsa(&(0x7f00000004c0), 0x20, 0xc0101) setsockopt$bt_BT_SNDMTU(r1, 0x112, 0xc, &(0x7f0000000500), 0x2) bind$bt_l2cap(0xffffffffffffffff, &(0x7f0000000dc0)={0x1f, 0xb9e5, @fixed={'\xaa\xaa\xaa\xaa\xaa', 0x12}, 0x1f, 0x1}, 0xe) 21:14:18 executing program 6: r0 = request_key(&(0x7f0000000000)='dns_resolver\x00', &(0x7f0000000040)={'syz', 0x1}, &(0x7f0000000080)=',{{\x00', 0x0) r1 = add_key$keyring(&(0x7f0000000140), &(0x7f0000000180)={'syz', 0x1}, 0x0, 0x0, r0) keyctl$KEYCTL_PKEY_SIGN(0x1b, &(0x7f00000009c0)={r1, 0x6c, 0x6d}, &(0x7f0000000a00)={'enc=', 'pkcs1', ' hash=', {'nhpoly1305-generic\x00'}}, &(0x7f0000000a80)="64824bc7426fe2f3e3c1e475569073ecff8ffb96e46626b91f3b9a2b2ac07610524644af1e29c43d27e1d513a86909a6ac4d9753ce88f3f3d0beb31db8dfdbcb65379a9cc111189465a0cd8a50f7c19f1579f44a95805d41c0c92de97999b1d961ee48d58cfddc3720b2cd20", &(0x7f0000000b00)=""/109) 21:14:18 executing program 2: ioctl$SCSI_IOCTL_DOORUNLOCK(0xffffffffffffffff, 0x5381) r0 = syz_open_dev$mouse(&(0x7f0000000000), 0x578, 0x4000) ioctl$SG_GET_PACK_ID(r0, 0x227c, &(0x7f0000000040)) r1 = syz_genetlink_get_family_id$nl80211(&(0x7f00000000c0), r0) sendmsg$NL80211_CMD_NEW_KEY(r0, &(0x7f00000001c0)={&(0x7f0000000080)={0x10, 0x0, 0x0, 0x10}, 0xc, &(0x7f0000000180)={&(0x7f0000000100)={0x60, r1, 0x400, 0x70bd2b, 0x25dfdbff, {{}, {@val={0x8}, @void}}, [@NL80211_ATTR_KEY_TYPE={0x8, 0x37, 0x1}, @NL80211_ATTR_KEY_DEFAULT_MGMT={0x4}, @NL80211_ATTR_KEY={0x2c, 0x50, 0x0, 0x1, [@NL80211_KEY_DATA_WEP40={0x9, 0x1, "93f3c5ad5d"}, @NL80211_KEY_DEFAULT_TYPES={0x8, 0x8, 0x0, 0x1, [@NL80211_KEY_DEFAULT_TYPE_MULTICAST={0x4}]}, @NL80211_KEY_DATA_WEP104={0x11, 0x1, "8815558ac60368b42ebdf03bdb"}]}, @NL80211_ATTR_KEY_DATA_WEP40={0x9, 0x7, "74de692476"}]}, 0x60}, 0x1, 0x0, 0x0, 0x4000000}, 0x8000) r2 = openat$procfs(0xffffffffffffff9c, &(0x7f0000000200)='/proc/stat\x00', 0x0, 0x0) ioctl$SG_GET_TIMEOUT(r2, 0x2202, 0x0) ioctl$SG_SET_FORCE_PACK_ID(r0, 0x227b, &(0x7f0000000240)=0x1) ioctl$TUNGETIFF(r0, 0x800454d2, &(0x7f0000000280)={'vlan0\x00'}) sendmsg$NL80211_CMD_JOIN_MESH(r0, &(0x7f0000000400)={&(0x7f00000002c0)={0x10, 0x0, 0x0, 0x8}, 0xc, &(0x7f00000003c0)={&(0x7f0000000300)={0xc0, r1, 0x400, 0x70bd28, 0x25dfdbfc, {{}, {@void, @void}}, [@NL80211_ATTR_SOCKET_OWNER={0x4}, @NL80211_ATTR_MESH_SETUP={0xa8, 0x70, [@NL80211_MESH_SETUP_ENABLE_VENDOR_METRIC={0x5, 0x2, 0x1}, @NL80211_MESH_SETUP_IE={0x6b, 0x3, "432578a2646e5ab8df23d89ff57571f258fae075fd43855fb9486d9209824c25dbf24af1a18187d074463ff5b11350c72de592b494efe5b4f34cbc2a7a8a1160fd0a59dafb8fe7173e1b109dd23d0edf69c40605089d1c24278a427d497c415ba944a9a901d2b5"}, @NL80211_MESH_SETUP_USERSPACE_MPM={0x4}, @NL80211_MESH_SETUP_USERSPACE_AUTH={0x4}, @NL80211_MESH_SETUP_ENABLE_VENDOR_PATH_SEL={0x5, 0x1, 0x1}, @NL80211_MESH_SETUP_ENABLE_VENDOR_PATH_SEL={0x5, 0x1, 0x1}, @NL80211_MESH_SETUP_ENABLE_VENDOR_PATH_SEL={0x5, 0x1, 0x1}, @NL80211_MESH_SETUP_ENABLE_VENDOR_SYNC={0x5, 0x6, 0x1}, @NL80211_MESH_SETUP_USERSPACE_AUTH={0x4}, @NL80211_MESH_SETUP_USERSPACE_AMPE={0x4}]}]}, 0xc0}, 0x1, 0x0, 0x0, 0x10}, 0x4000001) ioctl$SCSI_IOCTL_DOORUNLOCK(r2, 0x5381) syz_open_dev$vcsa(&(0x7f0000000440), 0x56, 0x4000) syz_genetlink_get_family_id$nl80211(&(0x7f00000004c0), r0) socketpair(0x0, 0x3, 0x6, &(0x7f0000000640)) r3 = openat$tcp_congestion(0xffffffffffffff9c, &(0x7f0000000800), 0x1, 0x0) write$tcp_congestion(r3, &(0x7f0000000840)='htcp\x00', 0x5) 21:14:18 executing program 0: r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000000), 0x521000, 0x0) ioctl$TUNSETPERSIST(r0, 0x400454cb, 0x1) ioctl$SIOCSIFHWADDR(0xffffffffffffffff, 0x8924, &(0x7f0000000040)={'erspan0\x00', @local}) ioctl$TUNGETSNDBUF(r0, 0x800454d3, &(0x7f0000000080)) r1 = syz_open_dev$mouse(&(0x7f00000000c0), 0x5, 0x111840) ioctl$TUNSETIFINDEX(r1, 0x400454da, &(0x7f0000000100)) r2 = openat$vcsa(0xffffffffffffff9c, &(0x7f0000000140), 0x101000, 0x0) r3 = syz_genetlink_get_family_id$mptcp(&(0x7f00000001c0), 0xffffffffffffffff) sendmsg$MPTCP_PM_CMD_SET_LIMITS(r2, &(0x7f0000000280)={&(0x7f0000000180)={0x10, 0x0, 0x0, 0x20000}, 0xc, &(0x7f0000000240)={&(0x7f0000000200)={0x1c, r3, 0x20, 0x70bd26, 0x25dfdbfb, {}, [@MPTCP_PM_ATTR_RCV_ADD_ADDRS={0x8, 0x2, 0x6}]}, 0x1c}, 0x1, 0x0, 0x0, 0x1000}, 0x20008050) getresuid(&(0x7f0000000340), &(0x7f0000000380), &(0x7f00000003c0)) 21:14:18 executing program 3: openat$vcsa(0xffffffffffffff9c, &(0x7f0000000000), 0x180, 0x0) syz_open_dev$sg(&(0x7f0000000400), 0x494, 0x22000) 21:14:18 executing program 4: recvmmsg(0xffffffffffffffff, &(0x7f0000000280)=[{{0x0, 0x0, &(0x7f0000000140)=[{&(0x7f0000000000)=""/11, 0xb}, {&(0x7f0000000040)=""/238, 0xee}], 0x2, &(0x7f0000000180)=""/244, 0xf4}, 0xb67}], 0x1, 0x102, 0x0) sendmsg$NFULNL_MSG_CONFIG(0xffffffffffffffff, &(0x7f00000003c0)={&(0x7f00000002c0)={0x10, 0x0, 0x0, 0x1000000}, 0xc, &(0x7f0000000380)={&(0x7f0000000300)={0x50, 0x1, 0x4, 0x101, 0x0, 0x0, {0xc, 0x0, 0x3}, [@NFULA_CFG_MODE={0xa, 0x2, {0x0, 0x2}}, @NFULA_CFG_QTHRESH={0x8, 0x5, 0x1, 0x0, 0xffffffc0}, @NFULA_CFG_TIMEOUT={0x8, 0x4, 0x1, 0x0, 0x54}, @NFULA_CFG_FLAGS={0x6}, @NFULA_CFG_TIMEOUT={0x8, 0x4, 0x1, 0x0, 0x6}, @NFULA_CFG_NLBUFSIZ={0x8, 0x3, 0x1, 0x0, 0x7f}, @NFULA_CFG_NLBUFSIZ={0x8, 0x3, 0x1, 0x0, 0x8}]}, 0x50}, 0x1, 0x0, 0x0, 0x408d4}, 0x20000091) r0 = openat$procfs(0xffffffffffffff9c, &(0x7f0000000400)='/proc/schedstat\x00', 0x0, 0x0) syz_io_uring_submit(0x0, 0x0, &(0x7f0000000440)=@IORING_OP_SPLICE={0x1e, 0x2, 0x0, @fd, 0x9, {}, 0x830, 0xa, 0x0, {0x0, 0x0, r0}}, 0x5) connect$bt_l2cap(r0, &(0x7f0000000480)={0x1f, 0x71, @none, 0x4, 0x2}, 0xe) syz_open_dev$vcsa(&(0x7f00000004c0), 0x20, 0xc0101) bind$bt_l2cap(0xffffffffffffffff, &(0x7f0000000dc0)={0x1f, 0xb9e5, @fixed={'\xaa\xaa\xaa\xaa\xaa', 0x12}, 0x1f, 0x1}, 0xe) 21:14:18 executing program 5: ptrace$peekuser(0x3, 0xffffffffffffffff, 0x3ff) prctl$PR_MPX_ENABLE_MANAGEMENT(0x2b) clock_adjtime(0x0, &(0x7f0000000000)={0xf0, 0xfff, 0x6, 0x40, 0x1ff, 0x1ff, 0x1, 0xe1, 0x5, 0xe68c, 0x95c, 0x1000, 0xe, 0x100000000, 0x8000, 0x2, 0x6, 0xab, 0xffff, 0x3, 0xff, 0x9, 0x6a9f, 0x1, 0x4, 0xfffffffffffffff9}) prctl$PR_MPX_ENABLE_MANAGEMENT(0x2b) ioctl$SCSI_IOCTL_DOORUNLOCK(0xffffffffffffffff, 0x5381) ioctl$SG_GET_TIMEOUT(0xffffffffffffffff, 0x2202, 0x0) syz_open_dev$vcsa(&(0x7f0000000100), 0x1, 0x80100) r0 = syz_open_dev$vcsa(&(0x7f0000000140), 0xb6, 0x101000) sendmsg$NL80211_CMD_ASSOCIATE(r0, &(0x7f0000000440)={&(0x7f0000000300)={0x10, 0x0, 0x0, 0x8000000}, 0xc, &(0x7f0000000400)={&(0x7f0000000380)={0x54, 0x0, 0x4, 0x70bd2c, 0x25dfdbff, {{}, {@val={0x8}, @val={0xc, 0x99, {0x0, 0x78}}}}, [@NL80211_ATTR_SSID={0xa, 0x34, @default_ap_ssid}, @NL80211_ATTR_HT_CAPABILITY={0x1e, 0x1f, {0x300, 0x1, 0x1, 0x0, {0x6, 0x4c, 0x0, 0x4, 0x0, 0x1, 0x0, 0x1, 0x1}, 0x400, 0x2, 0x6}}]}, 0x54}}, 0x0) 21:14:18 executing program 4: recvmmsg(0xffffffffffffffff, &(0x7f0000000280)=[{{0x0, 0x0, &(0x7f0000000140)=[{&(0x7f0000000000)=""/11, 0xb}, {&(0x7f0000000040)=""/238, 0xee}], 0x2, &(0x7f0000000180)=""/244, 0xf4}, 0xb67}], 0x1, 0x102, 0x0) sendmsg$NFULNL_MSG_CONFIG(0xffffffffffffffff, &(0x7f00000003c0)={&(0x7f00000002c0)={0x10, 0x0, 0x0, 0x1000000}, 0xc, &(0x7f0000000380)={&(0x7f0000000300)={0x50, 0x1, 0x4, 0x101, 0x0, 0x0, {0xc, 0x0, 0x3}, [@NFULA_CFG_MODE={0xa, 0x2, {0x0, 0x2}}, @NFULA_CFG_QTHRESH={0x8, 0x5, 0x1, 0x0, 0xffffffc0}, @NFULA_CFG_TIMEOUT={0x8, 0x4, 0x1, 0x0, 0x54}, @NFULA_CFG_FLAGS={0x6}, @NFULA_CFG_TIMEOUT={0x8, 0x4, 0x1, 0x0, 0x6}, @NFULA_CFG_NLBUFSIZ={0x8, 0x3, 0x1, 0x0, 0x7f}, @NFULA_CFG_NLBUFSIZ={0x8, 0x3, 0x1, 0x0, 0x8}]}, 0x50}, 0x1, 0x0, 0x0, 0x408d4}, 0x20000091) r0 = openat$procfs(0xffffffffffffff9c, &(0x7f0000000400)='/proc/schedstat\x00', 0x0, 0x0) syz_io_uring_submit(0x0, 0x0, &(0x7f0000000440)=@IORING_OP_SPLICE={0x1e, 0x2, 0x0, @fd, 0x9, {}, 0x830, 0xa, 0x0, {0x0, 0x0, r0}}, 0x5) connect$bt_l2cap(r0, &(0x7f0000000480)={0x1f, 0x71, @none, 0x4, 0x2}, 0xe) bind$bt_l2cap(0xffffffffffffffff, &(0x7f0000000dc0)={0x1f, 0xb9e5, @fixed={'\xaa\xaa\xaa\xaa\xaa', 0x12}, 0x1f, 0x1}, 0xe) [ 191.900729] Bluetooth: hci7: command 0x0406 tx timeout [ 191.902299] Bluetooth: hci0: command 0x0406 tx timeout [ 191.902815] Bluetooth: hci1: command 0x0406 tx timeout [ 191.903445] Bluetooth: hci6: command 0x0406 tx timeout [ 191.905732] Bluetooth: hci2: command 0x0406 tx timeout [ 191.906425] Bluetooth: hci5: command 0x0406 tx timeout [ 191.906815] Bluetooth: hci3: command 0x0406 tx timeout [ 191.907741] Bluetooth: hci4: command 0x0406 tx timeout 21:14:27 executing program 0: r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000000), 0x521000, 0x0) ioctl$TUNSETPERSIST(r0, 0x400454cb, 0x1) ioctl$SIOCSIFHWADDR(0xffffffffffffffff, 0x8924, &(0x7f0000000040)={'erspan0\x00', @local}) ioctl$TUNGETSNDBUF(r0, 0x800454d3, &(0x7f0000000080)) r1 = syz_open_dev$mouse(&(0x7f00000000c0), 0x5, 0x111840) ioctl$TUNSETIFINDEX(r1, 0x400454da, &(0x7f0000000100)) openat$vcsa(0xffffffffffffff9c, &(0x7f0000000140), 0x101000, 0x0) syz_genetlink_get_family_id$mptcp(&(0x7f00000001c0), 0xffffffffffffffff) getresuid(&(0x7f0000000340), &(0x7f0000000380), &(0x7f00000003c0)) 21:14:27 executing program 5: ptrace$peekuser(0x3, 0xffffffffffffffff, 0x3ff) prctl$PR_MPX_ENABLE_MANAGEMENT(0x2b) clock_adjtime(0x0, &(0x7f0000000000)={0xf0, 0xfff, 0x6, 0x40, 0x1ff, 0x1ff, 0x1, 0xe1, 0x5, 0xe68c, 0x95c, 0x1000, 0xe, 0x100000000, 0x8000, 0x2, 0x6, 0xab, 0xffff, 0x3, 0xff, 0x9, 0x6a9f, 0x1, 0x4, 0xfffffffffffffff9}) prctl$PR_MPX_ENABLE_MANAGEMENT(0x2b) ioctl$SCSI_IOCTL_DOORUNLOCK(0xffffffffffffffff, 0x5381) ioctl$SG_GET_TIMEOUT(0xffffffffffffffff, 0x2202, 0x0) r0 = syz_open_dev$vcsa(&(0x7f0000000140), 0xb6, 0x101000) sendmsg$NL80211_CMD_ASSOCIATE(r0, &(0x7f0000000440)={&(0x7f0000000300)={0x10, 0x0, 0x0, 0x8000000}, 0xc, &(0x7f0000000400)={&(0x7f0000000380)={0x54, 0x0, 0x4, 0x70bd2c, 0x25dfdbff, {{}, {@val={0x8}, @val={0xc, 0x99, {0x0, 0x78}}}}, [@NL80211_ATTR_SSID={0xa, 0x34, @default_ap_ssid}, @NL80211_ATTR_HT_CAPABILITY={0x1e, 0x1f, {0x300, 0x1, 0x1, 0x0, {0x6, 0x4c, 0x0, 0x4, 0x0, 0x1, 0x0, 0x1, 0x1}, 0x400, 0x2, 0x6}}]}, 0x54}}, 0x0) 21:14:27 executing program 2: ioctl$SCSI_IOCTL_DOORUNLOCK(0xffffffffffffffff, 0x5381) r0 = syz_open_dev$mouse(&(0x7f0000000000), 0x578, 0x4000) ioctl$SG_GET_PACK_ID(r0, 0x227c, &(0x7f0000000040)) r1 = syz_genetlink_get_family_id$nl80211(&(0x7f00000000c0), r0) sendmsg$NL80211_CMD_NEW_KEY(r0, &(0x7f00000001c0)={&(0x7f0000000080)={0x10, 0x0, 0x0, 0x10}, 0xc, &(0x7f0000000180)={&(0x7f0000000100)={0x60, r1, 0x400, 0x70bd2b, 0x25dfdbff, {{}, {@val={0x8}, @void}}, [@NL80211_ATTR_KEY_TYPE={0x8, 0x37, 0x1}, @NL80211_ATTR_KEY_DEFAULT_MGMT={0x4}, @NL80211_ATTR_KEY={0x2c, 0x50, 0x0, 0x1, [@NL80211_KEY_DATA_WEP40={0x9, 0x1, "93f3c5ad5d"}, @NL80211_KEY_DEFAULT_TYPES={0x8, 0x8, 0x0, 0x1, [@NL80211_KEY_DEFAULT_TYPE_MULTICAST={0x4}]}, @NL80211_KEY_DATA_WEP104={0x11, 0x1, "8815558ac60368b42ebdf03bdb"}]}, @NL80211_ATTR_KEY_DATA_WEP40={0x9, 0x7, "74de692476"}]}, 0x60}, 0x1, 0x0, 0x0, 0x4000000}, 0x8000) r2 = openat$procfs(0xffffffffffffff9c, &(0x7f0000000200)='/proc/stat\x00', 0x0, 0x0) ioctl$SG_GET_TIMEOUT(r2, 0x2202, 0x0) ioctl$SG_SET_FORCE_PACK_ID(r0, 0x227b, &(0x7f0000000240)=0x1) ioctl$TUNGETIFF(r0, 0x800454d2, &(0x7f0000000280)={'vlan0\x00'}) sendmsg$NL80211_CMD_JOIN_MESH(r0, &(0x7f0000000400)={&(0x7f00000002c0)={0x10, 0x0, 0x0, 0x8}, 0xc, &(0x7f00000003c0)={&(0x7f0000000300)={0xc0, r1, 0x400, 0x70bd28, 0x25dfdbfc, {{}, {@void, @void}}, [@NL80211_ATTR_SOCKET_OWNER={0x4}, @NL80211_ATTR_MESH_SETUP={0xa8, 0x70, [@NL80211_MESH_SETUP_ENABLE_VENDOR_METRIC={0x5, 0x2, 0x1}, @NL80211_MESH_SETUP_IE={0x6b, 0x3, "432578a2646e5ab8df23d89ff57571f258fae075fd43855fb9486d9209824c25dbf24af1a18187d074463ff5b11350c72de592b494efe5b4f34cbc2a7a8a1160fd0a59dafb8fe7173e1b109dd23d0edf69c40605089d1c24278a427d497c415ba944a9a901d2b5"}, @NL80211_MESH_SETUP_USERSPACE_MPM={0x4}, @NL80211_MESH_SETUP_USERSPACE_AUTH={0x4}, @NL80211_MESH_SETUP_ENABLE_VENDOR_PATH_SEL={0x5, 0x1, 0x1}, @NL80211_MESH_SETUP_ENABLE_VENDOR_PATH_SEL={0x5, 0x1, 0x1}, @NL80211_MESH_SETUP_ENABLE_VENDOR_PATH_SEL={0x5, 0x1, 0x1}, @NL80211_MESH_SETUP_ENABLE_VENDOR_SYNC={0x5, 0x6, 0x1}, @NL80211_MESH_SETUP_USERSPACE_AUTH={0x4}, @NL80211_MESH_SETUP_USERSPACE_AMPE={0x4}]}]}, 0xc0}, 0x1, 0x0, 0x0, 0x10}, 0x4000001) ioctl$SCSI_IOCTL_DOORUNLOCK(r2, 0x5381) syz_open_dev$vcsa(&(0x7f0000000440), 0x56, 0x4000) syz_genetlink_get_family_id$nl80211(&(0x7f00000004c0), r0) socketpair(0x0, 0x3, 0x6, &(0x7f0000000640)) r3 = openat$tcp_congestion(0xffffffffffffff9c, &(0x7f0000000800), 0x1, 0x0) write$tcp_congestion(r3, &(0x7f0000000840)='htcp\x00', 0x5) 21:14:27 executing program 1: r0 = io_uring_setup(0x355e, &(0x7f0000000000)={0x0, 0x7682, 0x20, 0x1, 0x1be}) r1 = syz_io_uring_setup(0x8fe, &(0x7f0000000080)={0x0, 0x1830, 0x0, 0x0, 0x1b8, 0x0, r0}, &(0x7f0000ffb000/0x2000)=nil, &(0x7f0000ffb000/0x4000)=nil, &(0x7f0000000100), &(0x7f0000000140)=0x0) r3 = openat$hwrng(0xffffffffffffff9c, &(0x7f0000000180), 0x2, 0x0) r4 = syz_io_uring_setup(0x65dd, &(0x7f00000001c0)={0x0, 0xf46f, 0x20, 0x2, 0xdf}, &(0x7f0000ffe000/0x1000)=nil, &(0x7f0000ffd000/0x1000)=nil, &(0x7f0000000240), &(0x7f0000000280)) r5 = syz_genetlink_get_family_id$mptcp(&(0x7f0000000300), r3) sendmsg$MPTCP_PM_CMD_ADD_ADDR(r3, &(0x7f00000003c0)={&(0x7f00000002c0)={0x10, 0x0, 0x0, 0x10}, 0xc, &(0x7f0000000380)={&(0x7f0000000340)={0x24, r5, 0x300, 0x70bd26, 0x25dfdbfb, {}, [@MPTCP_PM_ATTR_SUBFLOWS={0x8, 0x3, 0x1}, @MPTCP_PM_ATTR_RCV_ADD_ADDRS={0x8, 0x2, 0x2}]}, 0x24}, 0x1, 0x0, 0x0, 0x20000004}, 0x8890) syz_io_uring_setup(0x20f8, &(0x7f0000000400)={0x0, 0x7677, 0x8, 0x3, 0x22f, 0x0, r4}, &(0x7f0000ffe000/0x2000)=nil, &(0x7f0000ffb000/0x2000)=nil, &(0x7f0000000480)=0x0, &(0x7f00000004c0)) r7 = openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000500)='./cgroup/syz1\x00', 0x200002, 0x0) syz_io_uring_submit(r6, r2, &(0x7f0000000580)=@IORING_OP_FILES_UPDATE={0x14, 0x4, 0x0, 0x0, 0x40, &(0x7f0000000540)=[r4, 0xffffffffffffffff, r7, r0, r1], 0x5}, 0x3) io_uring_setup(0x2812, &(0x7f00000005c0)={0x0, 0x5e1b, 0x2, 0x3, 0x12f, 0x0, r4}) getpeername(r3, &(0x7f0000000640)=@nfc, &(0x7f00000006c0)=0x80) ioctl$SIOCSIFHWADDR(r3, 0x8924, &(0x7f0000000700)={'hsr0\x00', @broadcast}) socket$inet6_tcp(0xa, 0x1, 0x0) openat$procfs(0xffffffffffffff9c, &(0x7f00000010c0)='/proc/crypto\x00', 0x0, 0x0) io_uring_setup(0x7c8f, &(0x7f0000001140)={0x0, 0xc240, 0x10, 0x3, 0x1c7, 0x0, r4}) 21:14:27 executing program 6: request_key(&(0x7f0000000000)='dns_resolver\x00', &(0x7f0000000040)={'syz', 0x1}, &(0x7f0000000080)=',{{\x00', 0x0) keyctl$KEYCTL_PKEY_SIGN(0x1b, &(0x7f00000009c0)={0x0, 0x6c, 0x6d}, &(0x7f0000000a00)={'enc=', 'pkcs1', ' hash=', {'nhpoly1305-generic\x00'}}, &(0x7f0000000a80)="64824bc7426fe2f3e3c1e475569073ecff8ffb96e46626b91f3b9a2b2ac07610524644af1e29c43d27e1d513a86909a6ac4d9753ce88f3f3d0beb31db8dfdbcb65379a9cc111189465a0cd8a50f7c19f1579f44a95805d41c0c92de97999b1d961ee48d58cfddc3720b2cd20", &(0x7f0000000b00)=""/109) 21:14:27 executing program 7: write$P9_RSYMLINK(0xffffffffffffffff, &(0x7f0000000000)={0x14, 0x11, 0x2, {0x40, 0x3, 0x2}}, 0x14) ioctl$sock_ifreq(0xffffffffffffffff, 0x8935, &(0x7f0000000040)={'lo\x00', @ifru_addrs=@ethernet}) ioctl$sock_ifreq(0xffffffffffffffff, 0x8994, &(0x7f0000000080)={'ip6gretap0\x00', @ifru_flags}) sendmsg$IPSET_CMD_FLUSH(0xffffffffffffffff, &(0x7f0000000180)={&(0x7f00000000c0)={0x10, 0x0, 0x0, 0x10000}, 0xc, &(0x7f0000000140)={&(0x7f0000000100)={0x3c, 0x4, 0x6, 0x801, 0x0, 0x0, {0x3, 0x0, 0x4}, [@IPSET_ATTR_PROTOCOL={0x5}, @IPSET_ATTR_SETNAME={0x9, 0x2, 'syz0\x00'}, @IPSET_ATTR_SETNAME={0x9, 0x2, 'syz2\x00'}, @IPSET_ATTR_PROTOCOL={0x5}]}, 0x3c}}, 0x20000000) write$P9_RVERSION(0xffffffffffffffff, &(0x7f00000001c0)={0x13, 0x65, 0xffff, 0x3, 0x6, '9P2000'}, 0x13) pipe2$9p(&(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}, 0x0) write$P9_RSYMLINK(r0, &(0x7f0000000240)={0x14, 0x11, 0x1, {0x1, 0x3, 0x2}}, 0x14) add_key$fscrypt_v1(&(0x7f0000000280), &(0x7f00000002c0)={'fscrypt:', @desc2}, &(0x7f0000000300)={0x0, "ccf022eeb1aa5b4a9067674b5b7079352411c35248e190415959cbe4b7be99236abd831288583a8ed4db4b7b3f838c24d293f908bf3509b49f2c17852201f646", 0x19}, 0x48, 0xfffffffffffffffa) add_key$fscrypt_v1(&(0x7f0000000380), &(0x7f00000003c0)={'fscrypt:', @auto=[0x38, 0x65, 0x62, 0x61, 0x61, 0x62, 0x61, 0x64, 0x37, 0x32, 0x30, 0x61, 0x61, 0x50, 0x62, 0x62]}, &(0x7f0000000400)={0x0, "4916f745ecf1627b46363a6005d9ff599dde016c8b8d9d347624fd26c6e8bdbb7555714d1669e0e45bd9e03a462b54b255d728a05790d4698c32583ade59ecd8", 0x36}, 0x48, 0x0) r1 = syz_genetlink_get_family_id$mptcp(&(0x7f00000004c0), 0xffffffffffffffff) ioctl$ifreq_SIOCGIFINDEX_vcan(0xffffffffffffffff, 0x8933, &(0x7f00000005c0)={'vxcan0\x00', 0x0}) sendmsg$MPTCP_PM_CMD_GET_ADDR(0xffffffffffffffff, &(0x7f0000000740)={&(0x7f0000000480)={0x10, 0x0, 0x0, 0x80000000}, 0xc, &(0x7f0000000700)={&(0x7f0000000600)={0xcc, r1, 0x400, 0x70bd2c, 0x25dfdbfd, {}, [@MPTCP_PM_ATTR_ADDR={0x14, 0x1, 0x0, 0x1, [@MPTCP_PM_ADDR_ATTR_FLAGS={0x8, 0x6, 0x2}, @MPTCP_PM_ADDR_ATTR_ID={0x5}]}, @MPTCP_PM_ATTR_SUBFLOWS={0x8, 0x3, 0x1}, @MPTCP_PM_ATTR_ADDR={0x54, 0x1, 0x0, 0x1, [@MPTCP_PM_ADDR_ATTR_ADDR6={0x14, 0x4, @private1}, @MPTCP_PM_ADDR_ATTR_ID={0x5}, @MPTCP_PM_ADDR_ATTR_FAMILY={0x6, 0x1, 0x2}, @MPTCP_PM_ADDR_ATTR_ID={0x5, 0x2, 0x20}, @MPTCP_PM_ADDR_ATTR_IF_IDX={0x8}, @MPTCP_PM_ADDR_ATTR_ADDR6={0x14, 0x4, @rand_addr=' \x01\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x02'}, @MPTCP_PM_ADDR_ATTR_ADDR4={0x8, 0x3, @broadcast}]}, @MPTCP_PM_ATTR_ADDR={0x48, 0x1, 0x0, 0x1, [@MPTCP_PM_ADDR_ATTR_ADDR6={0x14, 0x4, @private2={0xfc, 0x2, '\x00', 0x1}}, @MPTCP_PM_ADDR_ATTR_IF_IDX={0x8, 0x7, r2}, @MPTCP_PM_ADDR_ATTR_FLAGS={0x8, 0x6, 0x4}, @MPTCP_PM_ADDR_ATTR_ADDR4={0x8, 0x3, @remote}, @MPTCP_PM_ADDR_ATTR_ADDR4={0x8, 0x3, @multicast1}, @MPTCP_PM_ADDR_ATTR_ADDR4={0x8, 0x3, @private=0xa010102}, @MPTCP_PM_ADDR_ATTR_ADDR4={0x8, 0x3, @rand_addr=0x64010101}]}]}, 0xcc}, 0x1, 0x0, 0x0, 0x8080}, 0x80) sendmsg$NL80211_CMD_GET_KEY(0xffffffffffffffff, &(0x7f0000000880)={&(0x7f0000000780)={0x10, 0x0, 0x0, 0x80000}, 0xc, &(0x7f0000000840)={&(0x7f00000007c0)={0x70, 0x0, 0x100, 0x70bd26, 0x25dfdbff, {{}, {@void, @void}}, [@NL80211_ATTR_KEY_DATA_WEP40={0x9, 0x7, "79d2a1c46c"}, @NL80211_ATTR_KEY_DATA_WEP104={0x11, 0x7, "e8db493fbaba6fa81c387c85d8"}, @NL80211_ATTR_KEY_DATA_WEP104={0x11, 0x7, "f8af8a10eebb9b4c600eb01c28"}, @NL80211_ATTR_KEY_SEQ={0x8, 0xa, "39cff2d0"}, @NL80211_ATTR_KEY_IDX={0x5, 0x8, 0x4}, @NL80211_ATTR_KEY_DEFAULT_TYPES={0xc, 0x6e, 0x0, 0x1, [@NL80211_KEY_DEFAULT_TYPE_MULTICAST={0x4}, @NL80211_KEY_DEFAULT_TYPE_UNICAST={0x4}]}, @NL80211_ATTR_MAC={0xa}]}, 0x70}, 0x1, 0x0, 0x0, 0x880}, 0x0) sendmsg$NL80211_CMD_GET_WOWLAN(0xffffffffffffffff, &(0x7f0000000980)={&(0x7f00000008c0)={0x10, 0x0, 0x0, 0x800000}, 0xc, &(0x7f0000000940)={&(0x7f0000000900)={0x1c, 0x0, 0x20, 0x70bd29, 0x25dfdbfc, {{}, {@void, @val={0x8}, @void}}, [""]}, 0x1c}, 0x1, 0x0, 0x0, 0x4044191}, 0x20040040) syz_genetlink_get_family_id$mptcp(&(0x7f0000000a80), 0xffffffffffffffff) 21:14:27 executing program 4: recvmmsg(0xffffffffffffffff, &(0x7f0000000280)=[{{0x0, 0x0, &(0x7f0000000140)=[{&(0x7f0000000000)=""/11, 0xb}, {&(0x7f0000000040)=""/238, 0xee}], 0x2, &(0x7f0000000180)=""/244, 0xf4}, 0xb67}], 0x1, 0x102, 0x0) sendmsg$NFULNL_MSG_CONFIG(0xffffffffffffffff, &(0x7f00000003c0)={&(0x7f00000002c0)={0x10, 0x0, 0x0, 0x1000000}, 0xc, &(0x7f0000000380)={&(0x7f0000000300)={0x50, 0x1, 0x4, 0x101, 0x0, 0x0, {0xc, 0x0, 0x3}, [@NFULA_CFG_MODE={0xa, 0x2, {0x0, 0x2}}, @NFULA_CFG_QTHRESH={0x8, 0x5, 0x1, 0x0, 0xffffffc0}, @NFULA_CFG_TIMEOUT={0x8, 0x4, 0x1, 0x0, 0x54}, @NFULA_CFG_FLAGS={0x6}, @NFULA_CFG_TIMEOUT={0x8, 0x4, 0x1, 0x0, 0x6}, @NFULA_CFG_NLBUFSIZ={0x8, 0x3, 0x1, 0x0, 0x7f}, @NFULA_CFG_NLBUFSIZ={0x8, 0x3, 0x1, 0x0, 0x8}]}, 0x50}, 0x1, 0x0, 0x0, 0x408d4}, 0x20000091) r0 = openat$procfs(0xffffffffffffff9c, &(0x7f0000000400)='/proc/schedstat\x00', 0x0, 0x0) syz_io_uring_submit(0x0, 0x0, &(0x7f0000000440)=@IORING_OP_SPLICE={0x1e, 0x2, 0x0, @fd, 0x9, {}, 0x830, 0xa, 0x0, {0x0, 0x0, r0}}, 0x5) bind$bt_l2cap(0xffffffffffffffff, &(0x7f0000000dc0)={0x1f, 0xb9e5, @fixed={'\xaa\xaa\xaa\xaa\xaa', 0x12}, 0x1f, 0x1}, 0xe) 21:14:27 executing program 3: syz_open_dev$sg(&(0x7f0000000400), 0x494, 0x22000) 21:14:27 executing program 4: recvmmsg(0xffffffffffffffff, &(0x7f0000000280)=[{{0x0, 0x0, &(0x7f0000000140)=[{&(0x7f0000000000)=""/11, 0xb}, {&(0x7f0000000040)=""/238, 0xee}], 0x2, &(0x7f0000000180)=""/244, 0xf4}, 0xb67}], 0x1, 0x102, 0x0) sendmsg$NFULNL_MSG_CONFIG(0xffffffffffffffff, &(0x7f00000003c0)={&(0x7f00000002c0)={0x10, 0x0, 0x0, 0x1000000}, 0xc, &(0x7f0000000380)={&(0x7f0000000300)={0x50, 0x1, 0x4, 0x101, 0x0, 0x0, {0xc, 0x0, 0x3}, [@NFULA_CFG_MODE={0xa, 0x2, {0x0, 0x2}}, @NFULA_CFG_QTHRESH={0x8, 0x5, 0x1, 0x0, 0xffffffc0}, @NFULA_CFG_TIMEOUT={0x8, 0x4, 0x1, 0x0, 0x54}, @NFULA_CFG_FLAGS={0x6}, @NFULA_CFG_TIMEOUT={0x8, 0x4, 0x1, 0x0, 0x6}, @NFULA_CFG_NLBUFSIZ={0x8, 0x3, 0x1, 0x0, 0x7f}, @NFULA_CFG_NLBUFSIZ={0x8, 0x3, 0x1, 0x0, 0x8}]}, 0x50}, 0x1, 0x0, 0x0, 0x408d4}, 0x20000091) openat$procfs(0xffffffffffffff9c, &(0x7f0000000400)='/proc/schedstat\x00', 0x0, 0x0) bind$bt_l2cap(0xffffffffffffffff, &(0x7f0000000dc0)={0x1f, 0xb9e5, @fixed={'\xaa\xaa\xaa\xaa\xaa', 0x12}, 0x1f, 0x1}, 0xe) 21:14:27 executing program 5: ptrace$peekuser(0x3, 0xffffffffffffffff, 0x3ff) prctl$PR_MPX_ENABLE_MANAGEMENT(0x2b) clock_adjtime(0x0, &(0x7f0000000000)={0xf0, 0xfff, 0x6, 0x40, 0x1ff, 0x1ff, 0x1, 0xe1, 0x5, 0xe68c, 0x95c, 0x1000, 0xe, 0x100000000, 0x8000, 0x2, 0x6, 0xab, 0xffff, 0x3, 0xff, 0x9, 0x6a9f, 0x1, 0x4, 0xfffffffffffffff9}) prctl$PR_MPX_ENABLE_MANAGEMENT(0x2b) ioctl$SCSI_IOCTL_DOORUNLOCK(0xffffffffffffffff, 0x5381) r0 = syz_open_dev$vcsa(&(0x7f0000000140), 0xb6, 0x101000) sendmsg$NL80211_CMD_ASSOCIATE(r0, &(0x7f0000000440)={&(0x7f0000000300)={0x10, 0x0, 0x0, 0x8000000}, 0xc, &(0x7f0000000400)={&(0x7f0000000380)={0x54, 0x0, 0x4, 0x70bd2c, 0x25dfdbff, {{}, {@val={0x8}, @val={0xc, 0x99, {0x0, 0x78}}}}, [@NL80211_ATTR_SSID={0xa, 0x34, @default_ap_ssid}, @NL80211_ATTR_HT_CAPABILITY={0x1e, 0x1f, {0x300, 0x1, 0x1, 0x0, {0x6, 0x4c, 0x0, 0x4, 0x0, 0x1, 0x0, 0x1, 0x1}, 0x400, 0x2, 0x6}}]}, 0x54}}, 0x0) 21:14:27 executing program 3: syz_open_dev$sg(0x0, 0x494, 0x22000) 21:14:27 executing program 6: keyctl$KEYCTL_PKEY_SIGN(0x1b, &(0x7f00000009c0)={0x0, 0x6c, 0x6d}, &(0x7f0000000a00)={'enc=', 'pkcs1', ' hash=', {'nhpoly1305-generic\x00'}}, &(0x7f0000000a80)="64824bc7426fe2f3e3c1e475569073ecff8ffb96e46626b91f3b9a2b2ac07610524644af1e29c43d27e1d513a86909a6ac4d9753ce88f3f3d0beb31db8dfdbcb65379a9cc111189465a0cd8a50f7c19f1579f44a95805d41c0c92de97999b1d961ee48d58cfddc3720b2cd20", &(0x7f0000000b00)=""/109) 21:14:28 executing program 0: r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000000), 0x521000, 0x0) ioctl$TUNSETPERSIST(r0, 0x400454cb, 0x1) ioctl$SIOCSIFHWADDR(0xffffffffffffffff, 0x8924, &(0x7f0000000040)={'erspan0\x00', @local}) ioctl$TUNGETSNDBUF(r0, 0x800454d3, &(0x7f0000000080)) r1 = syz_open_dev$mouse(&(0x7f00000000c0), 0x5, 0x111840) ioctl$TUNSETIFINDEX(r1, 0x400454da, &(0x7f0000000100)) openat$vcsa(0xffffffffffffff9c, &(0x7f0000000140), 0x101000, 0x0) getresuid(&(0x7f0000000340), &(0x7f0000000380), &(0x7f00000003c0)) 21:14:28 executing program 1: r0 = io_uring_setup(0x355e, &(0x7f0000000000)={0x0, 0x7682, 0x20, 0x1, 0x1be}) r1 = syz_io_uring_setup(0x8fe, &(0x7f0000000080)={0x0, 0x1830, 0x0, 0x0, 0x1b8, 0x0, r0}, &(0x7f0000ffb000/0x2000)=nil, &(0x7f0000ffb000/0x4000)=nil, &(0x7f0000000100), &(0x7f0000000140)=0x0) r3 = openat$hwrng(0xffffffffffffff9c, &(0x7f0000000180), 0x2, 0x0) r4 = syz_io_uring_setup(0x65dd, &(0x7f00000001c0)={0x0, 0xf46f, 0x20, 0x2, 0xdf}, &(0x7f0000ffe000/0x1000)=nil, &(0x7f0000ffd000/0x1000)=nil, &(0x7f0000000240), &(0x7f0000000280)) r5 = syz_genetlink_get_family_id$mptcp(&(0x7f0000000300), r3) sendmsg$MPTCP_PM_CMD_ADD_ADDR(r3, &(0x7f00000003c0)={&(0x7f00000002c0)={0x10, 0x0, 0x0, 0x10}, 0xc, &(0x7f0000000380)={&(0x7f0000000340)={0x24, r5, 0x300, 0x70bd26, 0x25dfdbfb, {}, [@MPTCP_PM_ATTR_SUBFLOWS={0x8, 0x3, 0x1}, @MPTCP_PM_ATTR_RCV_ADD_ADDRS={0x8, 0x2, 0x2}]}, 0x24}, 0x1, 0x0, 0x0, 0x20000004}, 0x8890) syz_io_uring_setup(0x20f8, &(0x7f0000000400)={0x0, 0x7677, 0x8, 0x3, 0x22f, 0x0, r4}, &(0x7f0000ffe000/0x2000)=nil, &(0x7f0000ffb000/0x2000)=nil, &(0x7f0000000480)=0x0, &(0x7f00000004c0)) r7 = openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000500)='./cgroup/syz1\x00', 0x200002, 0x0) syz_io_uring_submit(r6, r2, &(0x7f0000000580)=@IORING_OP_FILES_UPDATE={0x14, 0x4, 0x0, 0x0, 0x40, &(0x7f0000000540)=[r4, 0xffffffffffffffff, r7, r0, r1], 0x5}, 0x3) io_uring_setup(0x2812, &(0x7f00000005c0)={0x0, 0x5e1b, 0x2, 0x3, 0x12f, 0x0, r4}) getpeername(r3, &(0x7f0000000640)=@nfc, &(0x7f00000006c0)=0x80) ioctl$SIOCSIFHWADDR(r3, 0x8924, &(0x7f0000000700)={'hsr0\x00', @broadcast}) openat$procfs(0xffffffffffffff9c, &(0x7f00000010c0)='/proc/crypto\x00', 0x0, 0x0) io_uring_setup(0x7c8f, &(0x7f0000001140)={0x0, 0xc240, 0x10, 0x3, 0x1c7, 0x0, r4}) 21:14:28 executing program 5: ptrace$peekuser(0x3, 0xffffffffffffffff, 0x3ff) prctl$PR_MPX_ENABLE_MANAGEMENT(0x2b) clock_adjtime(0x0, &(0x7f0000000000)={0xf0, 0xfff, 0x6, 0x40, 0x1ff, 0x1ff, 0x1, 0xe1, 0x5, 0xe68c, 0x95c, 0x1000, 0xe, 0x100000000, 0x8000, 0x2, 0x6, 0xab, 0xffff, 0x3, 0xff, 0x9, 0x6a9f, 0x1, 0x4, 0xfffffffffffffff9}) prctl$PR_MPX_ENABLE_MANAGEMENT(0x2b) r0 = syz_open_dev$vcsa(&(0x7f0000000140), 0xb6, 0x101000) sendmsg$NL80211_CMD_ASSOCIATE(r0, &(0x7f0000000440)={&(0x7f0000000300)={0x10, 0x0, 0x0, 0x8000000}, 0xc, &(0x7f0000000400)={&(0x7f0000000380)={0x54, 0x0, 0x4, 0x70bd2c, 0x25dfdbff, {{}, {@val={0x8}, @val={0xc, 0x99, {0x0, 0x78}}}}, [@NL80211_ATTR_SSID={0xa, 0x34, @default_ap_ssid}, @NL80211_ATTR_HT_CAPABILITY={0x1e, 0x1f, {0x300, 0x1, 0x1, 0x0, {0x6, 0x4c, 0x0, 0x4, 0x0, 0x1, 0x0, 0x1, 0x1}, 0x400, 0x2, 0x6}}]}, 0x54}}, 0x0) 21:14:28 executing program 4: recvmmsg(0xffffffffffffffff, &(0x7f0000000280)=[{{0x0, 0x0, &(0x7f0000000140)=[{&(0x7f0000000000)=""/11, 0xb}, {&(0x7f0000000040)=""/238, 0xee}], 0x2, &(0x7f0000000180)=""/244, 0xf4}, 0xb67}], 0x1, 0x102, 0x0) sendmsg$NFULNL_MSG_CONFIG(0xffffffffffffffff, &(0x7f00000003c0)={&(0x7f00000002c0)={0x10, 0x0, 0x0, 0x1000000}, 0xc, &(0x7f0000000380)={&(0x7f0000000300)={0x50, 0x1, 0x4, 0x101, 0x0, 0x0, {0xc, 0x0, 0x3}, [@NFULA_CFG_MODE={0xa, 0x2, {0x0, 0x2}}, @NFULA_CFG_QTHRESH={0x8, 0x5, 0x1, 0x0, 0xffffffc0}, @NFULA_CFG_TIMEOUT={0x8, 0x4, 0x1, 0x0, 0x54}, @NFULA_CFG_FLAGS={0x6}, @NFULA_CFG_TIMEOUT={0x8, 0x4, 0x1, 0x0, 0x6}, @NFULA_CFG_NLBUFSIZ={0x8, 0x3, 0x1, 0x0, 0x7f}, @NFULA_CFG_NLBUFSIZ={0x8, 0x3, 0x1, 0x0, 0x8}]}, 0x50}, 0x1, 0x0, 0x0, 0x408d4}, 0x20000091) bind$bt_l2cap(0xffffffffffffffff, &(0x7f0000000dc0)={0x1f, 0xb9e5, @fixed={'\xaa\xaa\xaa\xaa\xaa', 0x12}, 0x1f, 0x1}, 0xe) 21:14:28 executing program 2: ioctl$SCSI_IOCTL_DOORUNLOCK(0xffffffffffffffff, 0x5381) r0 = syz_open_dev$mouse(&(0x7f0000000000), 0x578, 0x4000) ioctl$SG_GET_PACK_ID(r0, 0x227c, &(0x7f0000000040)) r1 = syz_genetlink_get_family_id$nl80211(&(0x7f00000000c0), r0) sendmsg$NL80211_CMD_NEW_KEY(r0, &(0x7f00000001c0)={&(0x7f0000000080)={0x10, 0x0, 0x0, 0x10}, 0xc, &(0x7f0000000180)={&(0x7f0000000100)={0x60, r1, 0x400, 0x70bd2b, 0x25dfdbff, {{}, {@val={0x8}, @void}}, [@NL80211_ATTR_KEY_TYPE={0x8, 0x37, 0x1}, @NL80211_ATTR_KEY_DEFAULT_MGMT={0x4}, @NL80211_ATTR_KEY={0x2c, 0x50, 0x0, 0x1, [@NL80211_KEY_DATA_WEP40={0x9, 0x1, "93f3c5ad5d"}, @NL80211_KEY_DEFAULT_TYPES={0x8, 0x8, 0x0, 0x1, [@NL80211_KEY_DEFAULT_TYPE_MULTICAST={0x4}]}, @NL80211_KEY_DATA_WEP104={0x11, 0x1, "8815558ac60368b42ebdf03bdb"}]}, @NL80211_ATTR_KEY_DATA_WEP40={0x9, 0x7, "74de692476"}]}, 0x60}, 0x1, 0x0, 0x0, 0x4000000}, 0x8000) r2 = openat$procfs(0xffffffffffffff9c, &(0x7f0000000200)='/proc/stat\x00', 0x0, 0x0) ioctl$SG_GET_TIMEOUT(r2, 0x2202, 0x0) ioctl$SG_SET_FORCE_PACK_ID(r0, 0x227b, &(0x7f0000000240)=0x1) ioctl$TUNGETIFF(r0, 0x800454d2, &(0x7f0000000280)={'vlan0\x00'}) sendmsg$NL80211_CMD_JOIN_MESH(r0, &(0x7f0000000400)={&(0x7f00000002c0)={0x10, 0x0, 0x0, 0x8}, 0xc, &(0x7f00000003c0)={&(0x7f0000000300)={0xc0, r1, 0x400, 0x70bd28, 0x25dfdbfc, {{}, {@void, @void}}, [@NL80211_ATTR_SOCKET_OWNER={0x4}, @NL80211_ATTR_MESH_SETUP={0xa8, 0x70, [@NL80211_MESH_SETUP_ENABLE_VENDOR_METRIC={0x5, 0x2, 0x1}, @NL80211_MESH_SETUP_IE={0x6b, 0x3, "432578a2646e5ab8df23d89ff57571f258fae075fd43855fb9486d9209824c25dbf24af1a18187d074463ff5b11350c72de592b494efe5b4f34cbc2a7a8a1160fd0a59dafb8fe7173e1b109dd23d0edf69c40605089d1c24278a427d497c415ba944a9a901d2b5"}, @NL80211_MESH_SETUP_USERSPACE_MPM={0x4}, @NL80211_MESH_SETUP_USERSPACE_AUTH={0x4}, @NL80211_MESH_SETUP_ENABLE_VENDOR_PATH_SEL={0x5, 0x1, 0x1}, @NL80211_MESH_SETUP_ENABLE_VENDOR_PATH_SEL={0x5, 0x1, 0x1}, @NL80211_MESH_SETUP_ENABLE_VENDOR_PATH_SEL={0x5, 0x1, 0x1}, @NL80211_MESH_SETUP_ENABLE_VENDOR_SYNC={0x5, 0x6, 0x1}, @NL80211_MESH_SETUP_USERSPACE_AUTH={0x4}, @NL80211_MESH_SETUP_USERSPACE_AMPE={0x4}]}]}, 0xc0}, 0x1, 0x0, 0x0, 0x10}, 0x4000001) ioctl$SCSI_IOCTL_DOORUNLOCK(r2, 0x5381) syz_open_dev$vcsa(&(0x7f0000000440), 0x56, 0x4000) socketpair(0x0, 0x3, 0x6, &(0x7f0000000640)) r3 = openat$tcp_congestion(0xffffffffffffff9c, &(0x7f0000000800), 0x1, 0x0) write$tcp_congestion(r3, &(0x7f0000000840)='htcp\x00', 0x5) 21:14:28 executing program 7: write$P9_RSYMLINK(0xffffffffffffffff, &(0x7f0000000000)={0x14, 0x11, 0x2, {0x40, 0x3, 0x2}}, 0x14) ioctl$sock_ifreq(0xffffffffffffffff, 0x8935, &(0x7f0000000040)={'lo\x00', @ifru_addrs=@ethernet}) ioctl$sock_ifreq(0xffffffffffffffff, 0x8994, &(0x7f0000000080)={'ip6gretap0\x00', @ifru_flags}) sendmsg$IPSET_CMD_FLUSH(0xffffffffffffffff, &(0x7f0000000180)={&(0x7f00000000c0)={0x10, 0x0, 0x0, 0x10000}, 0xc, &(0x7f0000000140)={&(0x7f0000000100)={0x3c, 0x4, 0x6, 0x801, 0x0, 0x0, {0x3, 0x0, 0x4}, [@IPSET_ATTR_PROTOCOL={0x5}, @IPSET_ATTR_SETNAME={0x9, 0x2, 'syz0\x00'}, @IPSET_ATTR_SETNAME={0x9, 0x2, 'syz2\x00'}, @IPSET_ATTR_PROTOCOL={0x5}]}, 0x3c}}, 0x20000000) write$P9_RVERSION(0xffffffffffffffff, &(0x7f00000001c0)={0x13, 0x65, 0xffff, 0x3, 0x6, '9P2000'}, 0x13) pipe2$9p(&(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}, 0x0) write$P9_RSYMLINK(r0, &(0x7f0000000240)={0x14, 0x11, 0x1, {0x1, 0x3, 0x2}}, 0x14) add_key$fscrypt_v1(&(0x7f0000000280), &(0x7f00000002c0)={'fscrypt:', @desc2}, &(0x7f0000000300)={0x0, "ccf022eeb1aa5b4a9067674b5b7079352411c35248e190415959cbe4b7be99236abd831288583a8ed4db4b7b3f838c24d293f908bf3509b49f2c17852201f646", 0x19}, 0x48, 0xfffffffffffffffa) add_key$fscrypt_v1(&(0x7f0000000380), &(0x7f00000003c0)={'fscrypt:', @auto=[0x38, 0x65, 0x62, 0x61, 0x61, 0x62, 0x61, 0x64, 0x37, 0x32, 0x30, 0x61, 0x61, 0x50, 0x62, 0x62]}, &(0x7f0000000400)={0x0, "4916f745ecf1627b46363a6005d9ff599dde016c8b8d9d347624fd26c6e8bdbb7555714d1669e0e45bd9e03a462b54b255d728a05790d4698c32583ade59ecd8", 0x36}, 0x48, 0x0) r1 = syz_genetlink_get_family_id$mptcp(&(0x7f00000004c0), 0xffffffffffffffff) ioctl$ifreq_SIOCGIFINDEX_vcan(0xffffffffffffffff, 0x8933, &(0x7f00000005c0)={'vxcan0\x00', 0x0}) sendmsg$MPTCP_PM_CMD_GET_ADDR(0xffffffffffffffff, &(0x7f0000000740)={&(0x7f0000000480)={0x10, 0x0, 0x0, 0x80000000}, 0xc, &(0x7f0000000700)={&(0x7f0000000600)={0xcc, r1, 0x400, 0x70bd2c, 0x25dfdbfd, {}, [@MPTCP_PM_ATTR_ADDR={0x14, 0x1, 0x0, 0x1, [@MPTCP_PM_ADDR_ATTR_FLAGS={0x8, 0x6, 0x2}, @MPTCP_PM_ADDR_ATTR_ID={0x5}]}, @MPTCP_PM_ATTR_SUBFLOWS={0x8, 0x3, 0x1}, @MPTCP_PM_ATTR_ADDR={0x54, 0x1, 0x0, 0x1, [@MPTCP_PM_ADDR_ATTR_ADDR6={0x14, 0x4, @private1}, @MPTCP_PM_ADDR_ATTR_ID={0x5}, @MPTCP_PM_ADDR_ATTR_FAMILY={0x6, 0x1, 0x2}, @MPTCP_PM_ADDR_ATTR_ID={0x5, 0x2, 0x20}, @MPTCP_PM_ADDR_ATTR_IF_IDX={0x8}, @MPTCP_PM_ADDR_ATTR_ADDR6={0x14, 0x4, @rand_addr=' \x01\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x02'}, @MPTCP_PM_ADDR_ATTR_ADDR4={0x8, 0x3, @broadcast}]}, @MPTCP_PM_ATTR_ADDR={0x48, 0x1, 0x0, 0x1, [@MPTCP_PM_ADDR_ATTR_ADDR6={0x14, 0x4, @private2={0xfc, 0x2, '\x00', 0x1}}, @MPTCP_PM_ADDR_ATTR_IF_IDX={0x8, 0x7, r2}, @MPTCP_PM_ADDR_ATTR_FLAGS={0x8, 0x6, 0x4}, @MPTCP_PM_ADDR_ATTR_ADDR4={0x8, 0x3, @remote}, @MPTCP_PM_ADDR_ATTR_ADDR4={0x8, 0x3, @multicast1}, @MPTCP_PM_ADDR_ATTR_ADDR4={0x8, 0x3, @private=0xa010102}, @MPTCP_PM_ADDR_ATTR_ADDR4={0x8, 0x3, @rand_addr=0x64010101}]}]}, 0xcc}, 0x1, 0x0, 0x0, 0x8080}, 0x80) sendmsg$NL80211_CMD_GET_KEY(0xffffffffffffffff, &(0x7f0000000880)={&(0x7f0000000780)={0x10, 0x0, 0x0, 0x80000}, 0xc, &(0x7f0000000840)={&(0x7f00000007c0)={0x70, 0x0, 0x100, 0x70bd26, 0x25dfdbff, {{}, {@void, @void}}, [@NL80211_ATTR_KEY_DATA_WEP40={0x9, 0x7, "79d2a1c46c"}, @NL80211_ATTR_KEY_DATA_WEP104={0x11, 0x7, "e8db493fbaba6fa81c387c85d8"}, @NL80211_ATTR_KEY_DATA_WEP104={0x11, 0x7, "f8af8a10eebb9b4c600eb01c28"}, @NL80211_ATTR_KEY_SEQ={0x8, 0xa, "39cff2d0"}, @NL80211_ATTR_KEY_IDX={0x5, 0x8, 0x4}, @NL80211_ATTR_KEY_DEFAULT_TYPES={0xc, 0x6e, 0x0, 0x1, [@NL80211_KEY_DEFAULT_TYPE_MULTICAST={0x4}, @NL80211_KEY_DEFAULT_TYPE_UNICAST={0x4}]}, @NL80211_ATTR_MAC={0xa}]}, 0x70}, 0x1, 0x0, 0x0, 0x880}, 0x0) openat$vcsa(0xffffffffffffff9c, &(0x7f00000009c0), 0x14200, 0x0) syz_genetlink_get_family_id$mptcp(&(0x7f0000000a80), 0xffffffffffffffff) 21:14:38 executing program 0: r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000000), 0x521000, 0x0) ioctl$TUNSETPERSIST(r0, 0x400454cb, 0x1) ioctl$SIOCSIFHWADDR(0xffffffffffffffff, 0x8924, &(0x7f0000000040)={'erspan0\x00', @local}) ioctl$TUNGETSNDBUF(r0, 0x800454d3, &(0x7f0000000080)) r1 = syz_open_dev$mouse(&(0x7f00000000c0), 0x5, 0x111840) ioctl$TUNSETIFINDEX(r1, 0x400454da, &(0x7f0000000100)) getresuid(&(0x7f0000000340), &(0x7f0000000380), &(0x7f00000003c0)) 21:14:38 executing program 6: keyctl$KEYCTL_PKEY_SIGN(0x1b, 0x0, &(0x7f0000000a00)={'enc=', 'pkcs1', ' hash=', {'nhpoly1305-generic\x00'}}, &(0x7f0000000a80)="64824bc7426fe2f3e3c1e475569073ecff8ffb96e46626b91f3b9a2b2ac07610524644af1e29c43d27e1d513a86909a6ac4d9753ce88f3f3d0beb31db8dfdbcb65379a9cc111189465a0cd8a50f7c19f1579f44a95805d41c0c92de97999b1d961ee48d58cfddc3720b2cd20", &(0x7f0000000b00)=""/109) 21:14:38 executing program 2: ioctl$SCSI_IOCTL_DOORUNLOCK(0xffffffffffffffff, 0x5381) r0 = syz_open_dev$mouse(&(0x7f0000000000), 0x578, 0x4000) ioctl$SG_GET_PACK_ID(r0, 0x227c, &(0x7f0000000040)) r1 = syz_genetlink_get_family_id$nl80211(&(0x7f00000000c0), r0) sendmsg$NL80211_CMD_NEW_KEY(r0, &(0x7f00000001c0)={&(0x7f0000000080)={0x10, 0x0, 0x0, 0x10}, 0xc, &(0x7f0000000180)={&(0x7f0000000100)={0x60, r1, 0x400, 0x70bd2b, 0x25dfdbff, {{}, {@val={0x8}, @void}}, [@NL80211_ATTR_KEY_TYPE={0x8, 0x37, 0x1}, @NL80211_ATTR_KEY_DEFAULT_MGMT={0x4}, @NL80211_ATTR_KEY={0x2c, 0x50, 0x0, 0x1, [@NL80211_KEY_DATA_WEP40={0x9, 0x1, "93f3c5ad5d"}, @NL80211_KEY_DEFAULT_TYPES={0x8, 0x8, 0x0, 0x1, [@NL80211_KEY_DEFAULT_TYPE_MULTICAST={0x4}]}, @NL80211_KEY_DATA_WEP104={0x11, 0x1, "8815558ac60368b42ebdf03bdb"}]}, @NL80211_ATTR_KEY_DATA_WEP40={0x9, 0x7, "74de692476"}]}, 0x60}, 0x1, 0x0, 0x0, 0x4000000}, 0x8000) r2 = openat$procfs(0xffffffffffffff9c, &(0x7f0000000200)='/proc/stat\x00', 0x0, 0x0) ioctl$SG_GET_TIMEOUT(r2, 0x2202, 0x0) ioctl$SG_SET_FORCE_PACK_ID(r0, 0x227b, &(0x7f0000000240)=0x1) ioctl$TUNGETIFF(r0, 0x800454d2, &(0x7f0000000280)={'vlan0\x00'}) sendmsg$NL80211_CMD_JOIN_MESH(r0, &(0x7f0000000400)={&(0x7f00000002c0)={0x10, 0x0, 0x0, 0x8}, 0xc, &(0x7f00000003c0)={&(0x7f0000000300)={0xc0, r1, 0x400, 0x70bd28, 0x25dfdbfc, {{}, {@void, @void}}, [@NL80211_ATTR_SOCKET_OWNER={0x4}, @NL80211_ATTR_MESH_SETUP={0xa8, 0x70, [@NL80211_MESH_SETUP_ENABLE_VENDOR_METRIC={0x5, 0x2, 0x1}, @NL80211_MESH_SETUP_IE={0x6b, 0x3, "432578a2646e5ab8df23d89ff57571f258fae075fd43855fb9486d9209824c25dbf24af1a18187d074463ff5b11350c72de592b494efe5b4f34cbc2a7a8a1160fd0a59dafb8fe7173e1b109dd23d0edf69c40605089d1c24278a427d497c415ba944a9a901d2b5"}, @NL80211_MESH_SETUP_USERSPACE_MPM={0x4}, @NL80211_MESH_SETUP_USERSPACE_AUTH={0x4}, @NL80211_MESH_SETUP_ENABLE_VENDOR_PATH_SEL={0x5, 0x1, 0x1}, @NL80211_MESH_SETUP_ENABLE_VENDOR_PATH_SEL={0x5, 0x1, 0x1}, @NL80211_MESH_SETUP_ENABLE_VENDOR_PATH_SEL={0x5, 0x1, 0x1}, @NL80211_MESH_SETUP_ENABLE_VENDOR_SYNC={0x5, 0x6, 0x1}, @NL80211_MESH_SETUP_USERSPACE_AUTH={0x4}, @NL80211_MESH_SETUP_USERSPACE_AMPE={0x4}]}]}, 0xc0}, 0x1, 0x0, 0x0, 0x10}, 0x4000001) ioctl$SCSI_IOCTL_DOORUNLOCK(r2, 0x5381) socketpair(0x0, 0x3, 0x6, &(0x7f0000000640)) r3 = openat$tcp_congestion(0xffffffffffffff9c, &(0x7f0000000800), 0x1, 0x0) write$tcp_congestion(r3, &(0x7f0000000840)='htcp\x00', 0x5) 21:14:38 executing program 4: recvmmsg(0xffffffffffffffff, &(0x7f0000000280)=[{{0x0, 0x0, &(0x7f0000000140)=[{&(0x7f0000000000)=""/11, 0xb}, {&(0x7f0000000040)=""/238, 0xee}], 0x2, &(0x7f0000000180)=""/244, 0xf4}, 0xb67}], 0x1, 0x102, 0x0) bind$bt_l2cap(0xffffffffffffffff, &(0x7f0000000dc0)={0x1f, 0xb9e5, @fixed={'\xaa\xaa\xaa\xaa\xaa', 0x12}, 0x1f, 0x1}, 0xe) 21:14:38 executing program 7: write$P9_RSYMLINK(0xffffffffffffffff, &(0x7f0000000000)={0x14, 0x11, 0x2, {0x40, 0x3, 0x2}}, 0x14) ioctl$sock_ifreq(0xffffffffffffffff, 0x8935, &(0x7f0000000040)={'lo\x00', @ifru_addrs=@ethernet}) ioctl$sock_ifreq(0xffffffffffffffff, 0x8994, &(0x7f0000000080)={'ip6gretap0\x00', @ifru_flags}) sendmsg$IPSET_CMD_FLUSH(0xffffffffffffffff, &(0x7f0000000180)={&(0x7f00000000c0)={0x10, 0x0, 0x0, 0x10000}, 0xc, &(0x7f0000000140)={&(0x7f0000000100)={0x3c, 0x4, 0x6, 0x801, 0x0, 0x0, {0x3, 0x0, 0x4}, [@IPSET_ATTR_PROTOCOL={0x5}, @IPSET_ATTR_SETNAME={0x9, 0x2, 'syz0\x00'}, @IPSET_ATTR_SETNAME={0x9, 0x2, 'syz2\x00'}, @IPSET_ATTR_PROTOCOL={0x5}]}, 0x3c}}, 0x20000000) write$P9_RVERSION(0xffffffffffffffff, &(0x7f00000001c0)={0x13, 0x65, 0xffff, 0x3, 0x6, '9P2000'}, 0x13) pipe2$9p(&(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}, 0x0) write$P9_RSYMLINK(r0, &(0x7f0000000240)={0x14, 0x11, 0x1, {0x1, 0x3, 0x2}}, 0x14) add_key$fscrypt_v1(&(0x7f0000000280), &(0x7f00000002c0)={'fscrypt:', @desc2}, &(0x7f0000000300)={0x0, "ccf022eeb1aa5b4a9067674b5b7079352411c35248e190415959cbe4b7be99236abd831288583a8ed4db4b7b3f838c24d293f908bf3509b49f2c17852201f646", 0x19}, 0x48, 0xfffffffffffffffa) add_key$fscrypt_v1(&(0x7f0000000380), &(0x7f00000003c0)={'fscrypt:', @auto=[0x38, 0x65, 0x62, 0x61, 0x61, 0x62, 0x61, 0x64, 0x37, 0x32, 0x30, 0x61, 0x61, 0x50, 0x62, 0x62]}, &(0x7f0000000400)={0x0, "4916f745ecf1627b46363a6005d9ff599dde016c8b8d9d347624fd26c6e8bdbb7555714d1669e0e45bd9e03a462b54b255d728a05790d4698c32583ade59ecd8", 0x36}, 0x48, 0x0) r1 = syz_genetlink_get_family_id$mptcp(&(0x7f00000004c0), 0xffffffffffffffff) ioctl$ifreq_SIOCGIFINDEX_vcan(0xffffffffffffffff, 0x8933, &(0x7f00000005c0)={'vxcan0\x00', 0x0}) sendmsg$MPTCP_PM_CMD_GET_ADDR(0xffffffffffffffff, &(0x7f0000000740)={&(0x7f0000000480)={0x10, 0x0, 0x0, 0x80000000}, 0xc, &(0x7f0000000700)={&(0x7f0000000600)={0xcc, r1, 0x400, 0x70bd2c, 0x25dfdbfd, {}, [@MPTCP_PM_ATTR_ADDR={0x14, 0x1, 0x0, 0x1, [@MPTCP_PM_ADDR_ATTR_FLAGS={0x8, 0x6, 0x2}, @MPTCP_PM_ADDR_ATTR_ID={0x5}]}, @MPTCP_PM_ATTR_SUBFLOWS={0x8, 0x3, 0x1}, @MPTCP_PM_ATTR_ADDR={0x54, 0x1, 0x0, 0x1, [@MPTCP_PM_ADDR_ATTR_ADDR6={0x14, 0x4, @private1}, @MPTCP_PM_ADDR_ATTR_ID={0x5}, @MPTCP_PM_ADDR_ATTR_FAMILY={0x6, 0x1, 0x2}, @MPTCP_PM_ADDR_ATTR_ID={0x5, 0x2, 0x20}, @MPTCP_PM_ADDR_ATTR_IF_IDX={0x8}, @MPTCP_PM_ADDR_ATTR_ADDR6={0x14, 0x4, @rand_addr=' \x01\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x02'}, @MPTCP_PM_ADDR_ATTR_ADDR4={0x8, 0x3, @broadcast}]}, @MPTCP_PM_ATTR_ADDR={0x48, 0x1, 0x0, 0x1, [@MPTCP_PM_ADDR_ATTR_ADDR6={0x14, 0x4, @private2={0xfc, 0x2, '\x00', 0x1}}, @MPTCP_PM_ADDR_ATTR_IF_IDX={0x8, 0x7, r2}, @MPTCP_PM_ADDR_ATTR_FLAGS={0x8, 0x6, 0x4}, @MPTCP_PM_ADDR_ATTR_ADDR4={0x8, 0x3, @remote}, @MPTCP_PM_ADDR_ATTR_ADDR4={0x8, 0x3, @multicast1}, @MPTCP_PM_ADDR_ATTR_ADDR4={0x8, 0x3, @private=0xa010102}, @MPTCP_PM_ADDR_ATTR_ADDR4={0x8, 0x3, @rand_addr=0x64010101}]}]}, 0xcc}, 0x1, 0x0, 0x0, 0x8080}, 0x80) openat$vcsa(0xffffffffffffff9c, &(0x7f00000009c0), 0x14200, 0x0) syz_genetlink_get_family_id$mptcp(&(0x7f0000000a80), 0xffffffffffffffff) 21:14:38 executing program 5: ptrace$peekuser(0x3, 0xffffffffffffffff, 0x3ff) prctl$PR_MPX_ENABLE_MANAGEMENT(0x2b) clock_adjtime(0x0, &(0x7f0000000000)={0xf0, 0xfff, 0x6, 0x40, 0x1ff, 0x1ff, 0x1, 0xe1, 0x5, 0xe68c, 0x95c, 0x1000, 0xe, 0x100000000, 0x8000, 0x2, 0x6, 0xab, 0xffff, 0x3, 0xff, 0x9, 0x6a9f, 0x1, 0x4, 0xfffffffffffffff9}) r0 = syz_open_dev$vcsa(&(0x7f0000000140), 0xb6, 0x101000) sendmsg$NL80211_CMD_ASSOCIATE(r0, &(0x7f0000000440)={&(0x7f0000000300)={0x10, 0x0, 0x0, 0x8000000}, 0xc, &(0x7f0000000400)={&(0x7f0000000380)={0x54, 0x0, 0x4, 0x70bd2c, 0x25dfdbff, {{}, {@val={0x8}, @val={0xc, 0x99, {0x0, 0x78}}}}, [@NL80211_ATTR_SSID={0xa, 0x34, @default_ap_ssid}, @NL80211_ATTR_HT_CAPABILITY={0x1e, 0x1f, {0x300, 0x1, 0x1, 0x0, {0x6, 0x4c, 0x0, 0x4, 0x0, 0x1, 0x0, 0x1, 0x1}, 0x400, 0x2, 0x6}}]}, 0x54}}, 0x0) 21:14:38 executing program 1: r0 = io_uring_setup(0x355e, &(0x7f0000000000)={0x0, 0x7682, 0x20, 0x1, 0x1be}) r1 = syz_io_uring_setup(0x8fe, &(0x7f0000000080)={0x0, 0x1830, 0x0, 0x0, 0x1b8, 0x0, r0}, &(0x7f0000ffb000/0x2000)=nil, &(0x7f0000ffb000/0x4000)=nil, &(0x7f0000000100), &(0x7f0000000140)=0x0) r3 = openat$hwrng(0xffffffffffffff9c, &(0x7f0000000180), 0x2, 0x0) r4 = syz_io_uring_setup(0x65dd, &(0x7f00000001c0)={0x0, 0xf46f, 0x20, 0x2, 0xdf}, &(0x7f0000ffe000/0x1000)=nil, &(0x7f0000ffd000/0x1000)=nil, &(0x7f0000000240), &(0x7f0000000280)) r5 = syz_genetlink_get_family_id$mptcp(&(0x7f0000000300), r3) sendmsg$MPTCP_PM_CMD_ADD_ADDR(r3, &(0x7f00000003c0)={&(0x7f00000002c0)={0x10, 0x0, 0x0, 0x10}, 0xc, &(0x7f0000000380)={&(0x7f0000000340)={0x24, r5, 0x300, 0x70bd26, 0x25dfdbfb, {}, [@MPTCP_PM_ATTR_SUBFLOWS={0x8, 0x3, 0x1}, @MPTCP_PM_ATTR_RCV_ADD_ADDRS={0x8, 0x2, 0x2}]}, 0x24}, 0x1, 0x0, 0x0, 0x20000004}, 0x8890) syz_io_uring_setup(0x20f8, &(0x7f0000000400)={0x0, 0x7677, 0x8, 0x3, 0x22f, 0x0, r4}, &(0x7f0000ffe000/0x2000)=nil, &(0x7f0000ffb000/0x2000)=nil, &(0x7f0000000480)=0x0, &(0x7f00000004c0)) r7 = openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000500)='./cgroup/syz1\x00', 0x200002, 0x0) syz_io_uring_submit(r6, r2, &(0x7f0000000580)=@IORING_OP_FILES_UPDATE={0x14, 0x4, 0x0, 0x0, 0x40, &(0x7f0000000540)=[r4, 0xffffffffffffffff, r7, r0, r1], 0x5}, 0x3) io_uring_setup(0x2812, &(0x7f00000005c0)={0x0, 0x5e1b, 0x2, 0x3, 0x12f, 0x0, r4}) getpeername(r3, &(0x7f0000000640)=@nfc, &(0x7f00000006c0)=0x80) ioctl$SIOCSIFHWADDR(r3, 0x8924, &(0x7f0000000700)={'hsr0\x00', @broadcast}) openat$procfs(0xffffffffffffff9c, &(0x7f00000010c0)='/proc/crypto\x00', 0x0, 0x0) io_uring_setup(0x7c8f, &(0x7f0000001140)={0x0, 0xc240, 0x10, 0x3, 0x1c7, 0x0, r4}) 21:14:38 executing program 3: syz_open_dev$sg(0x0, 0x494, 0x22000) 21:14:39 executing program 6: keyctl$KEYCTL_PKEY_SIGN(0x1b, 0x0, &(0x7f0000000a00)={'enc=', 'pkcs1', ' hash=', {'nhpoly1305-generic\x00'}}, &(0x7f0000000a80)="64824bc7426fe2f3e3c1e475569073ecff8ffb96e46626b91f3b9a2b2ac07610524644af1e29c43d27e1d513a86909a6ac4d9753ce88f3f3d0beb31db8dfdbcb65379a9cc111189465a0cd8a50f7c19f1579f44a95805d41c0c92de97999b1d961ee48d58cfddc3720b2cd20", &(0x7f0000000b00)=""/109) 21:14:39 executing program 4: bind$bt_l2cap(0xffffffffffffffff, &(0x7f0000000dc0)={0x1f, 0xb9e5, @fixed={'\xaa\xaa\xaa\xaa\xaa', 0x12}, 0x1f, 0x1}, 0xe) 21:14:39 executing program 0: r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000000), 0x521000, 0x0) ioctl$TUNSETPERSIST(r0, 0x400454cb, 0x1) ioctl$SIOCSIFHWADDR(0xffffffffffffffff, 0x8924, &(0x7f0000000040)={'erspan0\x00', @local}) ioctl$TUNGETSNDBUF(r0, 0x800454d3, &(0x7f0000000080)) syz_open_dev$mouse(&(0x7f00000000c0), 0x5, 0x111840) getresuid(&(0x7f0000000340), &(0x7f0000000380), &(0x7f00000003c0)) 21:14:39 executing program 3: syz_open_dev$sg(0x0, 0x494, 0x22000) 21:14:39 executing program 5: ptrace$peekuser(0x3, 0xffffffffffffffff, 0x3ff) prctl$PR_MPX_ENABLE_MANAGEMENT(0x2b) r0 = syz_open_dev$vcsa(&(0x7f0000000140), 0xb6, 0x101000) sendmsg$NL80211_CMD_ASSOCIATE(r0, &(0x7f0000000440)={&(0x7f0000000300)={0x10, 0x0, 0x0, 0x8000000}, 0xc, &(0x7f0000000400)={&(0x7f0000000380)={0x54, 0x0, 0x4, 0x70bd2c, 0x25dfdbff, {{}, {@val={0x8}, @val={0xc, 0x99, {0x0, 0x78}}}}, [@NL80211_ATTR_SSID={0xa, 0x34, @default_ap_ssid}, @NL80211_ATTR_HT_CAPABILITY={0x1e, 0x1f, {0x300, 0x1, 0x1, 0x0, {0x6, 0x4c, 0x0, 0x4, 0x0, 0x1, 0x0, 0x1, 0x1}, 0x400, 0x2, 0x6}}]}, 0x54}}, 0x0) 21:14:39 executing program 6: keyctl$KEYCTL_PKEY_SIGN(0x1b, 0x0, &(0x7f0000000a00)={'enc=', 'pkcs1', ' hash=', {'nhpoly1305-generic\x00'}}, &(0x7f0000000a80)="64824bc7426fe2f3e3c1e475569073ecff8ffb96e46626b91f3b9a2b2ac07610524644af1e29c43d27e1d513a86909a6ac4d9753ce88f3f3d0beb31db8dfdbcb65379a9cc111189465a0cd8a50f7c19f1579f44a95805d41c0c92de97999b1d961ee48d58cfddc3720b2cd20", &(0x7f0000000b00)=""/109) 21:14:39 executing program 0: r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000000), 0x521000, 0x0) ioctl$TUNSETPERSIST(r0, 0x400454cb, 0x1) ioctl$SIOCSIFHWADDR(0xffffffffffffffff, 0x8924, &(0x7f0000000040)={'erspan0\x00', @local}) ioctl$TUNGETSNDBUF(r0, 0x800454d3, &(0x7f0000000080)) getresuid(&(0x7f0000000340), &(0x7f0000000380), &(0x7f00000003c0)) 21:14:39 executing program 7: write$P9_RSYMLINK(0xffffffffffffffff, &(0x7f0000000000)={0x14, 0x11, 0x2, {0x40, 0x3, 0x2}}, 0x14) ioctl$sock_ifreq(0xffffffffffffffff, 0x8935, &(0x7f0000000040)={'lo\x00', @ifru_addrs=@ethernet}) ioctl$sock_ifreq(0xffffffffffffffff, 0x8994, &(0x7f0000000080)={'ip6gretap0\x00', @ifru_flags}) sendmsg$IPSET_CMD_FLUSH(0xffffffffffffffff, &(0x7f0000000180)={&(0x7f00000000c0)={0x10, 0x0, 0x0, 0x10000}, 0xc, &(0x7f0000000140)={&(0x7f0000000100)={0x3c, 0x4, 0x6, 0x801, 0x0, 0x0, {0x3, 0x0, 0x4}, [@IPSET_ATTR_PROTOCOL={0x5}, @IPSET_ATTR_SETNAME={0x9, 0x2, 'syz0\x00'}, @IPSET_ATTR_SETNAME={0x9, 0x2, 'syz2\x00'}, @IPSET_ATTR_PROTOCOL={0x5}]}, 0x3c}}, 0x20000000) write$P9_RVERSION(0xffffffffffffffff, &(0x7f00000001c0)={0x13, 0x65, 0xffff, 0x3, 0x6, '9P2000'}, 0x13) pipe2$9p(&(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}, 0x0) write$P9_RSYMLINK(r0, &(0x7f0000000240)={0x14, 0x11, 0x1, {0x1, 0x3, 0x2}}, 0x14) add_key$fscrypt_v1(&(0x7f0000000280), &(0x7f00000002c0)={'fscrypt:', @desc2}, &(0x7f0000000300)={0x0, "ccf022eeb1aa5b4a9067674b5b7079352411c35248e190415959cbe4b7be99236abd831288583a8ed4db4b7b3f838c24d293f908bf3509b49f2c17852201f646", 0x19}, 0x48, 0xfffffffffffffffa) add_key$fscrypt_v1(&(0x7f0000000380), &(0x7f00000003c0)={'fscrypt:', @auto=[0x38, 0x65, 0x62, 0x61, 0x61, 0x62, 0x61, 0x64, 0x37, 0x32, 0x30, 0x61, 0x61, 0x50, 0x62, 0x62]}, &(0x7f0000000400)={0x0, "4916f745ecf1627b46363a6005d9ff599dde016c8b8d9d347624fd26c6e8bdbb7555714d1669e0e45bd9e03a462b54b255d728a05790d4698c32583ade59ecd8", 0x36}, 0x48, 0x0) r1 = syz_genetlink_get_family_id$mptcp(&(0x7f00000004c0), 0xffffffffffffffff) ioctl$ifreq_SIOCGIFINDEX_vcan(0xffffffffffffffff, 0x8933, &(0x7f00000005c0)={'vxcan0\x00', 0x0}) sendmsg$MPTCP_PM_CMD_GET_ADDR(0xffffffffffffffff, &(0x7f0000000740)={&(0x7f0000000480)={0x10, 0x0, 0x0, 0x80000000}, 0xc, &(0x7f0000000700)={&(0x7f0000000600)={0xcc, r1, 0x400, 0x70bd2c, 0x25dfdbfd, {}, [@MPTCP_PM_ATTR_ADDR={0x14, 0x1, 0x0, 0x1, [@MPTCP_PM_ADDR_ATTR_FLAGS={0x8, 0x6, 0x2}, @MPTCP_PM_ADDR_ATTR_ID={0x5}]}, @MPTCP_PM_ATTR_SUBFLOWS={0x8, 0x3, 0x1}, @MPTCP_PM_ATTR_ADDR={0x54, 0x1, 0x0, 0x1, [@MPTCP_PM_ADDR_ATTR_ADDR6={0x14, 0x4, @private1}, @MPTCP_PM_ADDR_ATTR_ID={0x5}, @MPTCP_PM_ADDR_ATTR_FAMILY={0x6, 0x1, 0x2}, @MPTCP_PM_ADDR_ATTR_ID={0x5, 0x2, 0x20}, @MPTCP_PM_ADDR_ATTR_IF_IDX={0x8}, @MPTCP_PM_ADDR_ATTR_ADDR6={0x14, 0x4, @rand_addr=' \x01\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x02'}, @MPTCP_PM_ADDR_ATTR_ADDR4={0x8, 0x3, @broadcast}]}, @MPTCP_PM_ATTR_ADDR={0x48, 0x1, 0x0, 0x1, [@MPTCP_PM_ADDR_ATTR_ADDR6={0x14, 0x4, @private2={0xfc, 0x2, '\x00', 0x1}}, @MPTCP_PM_ADDR_ATTR_IF_IDX={0x8, 0x7, r2}, @MPTCP_PM_ADDR_ATTR_FLAGS={0x8, 0x6, 0x4}, @MPTCP_PM_ADDR_ATTR_ADDR4={0x8, 0x3, @remote}, @MPTCP_PM_ADDR_ATTR_ADDR4={0x8, 0x3, @multicast1}, @MPTCP_PM_ADDR_ATTR_ADDR4={0x8, 0x3, @private=0xa010102}, @MPTCP_PM_ADDR_ATTR_ADDR4={0x8, 0x3, @rand_addr=0x64010101}]}]}, 0xcc}, 0x1, 0x0, 0x0, 0x8080}, 0x80) openat$vcsa(0xffffffffffffff9c, &(0x7f00000009c0), 0x14200, 0x0) syz_genetlink_get_family_id$mptcp(&(0x7f0000000a80), 0xffffffffffffffff) 21:14:39 executing program 1: r0 = io_uring_setup(0x355e, &(0x7f0000000000)={0x0, 0x7682, 0x20, 0x1, 0x1be}) r1 = syz_io_uring_setup(0x8fe, &(0x7f0000000080)={0x0, 0x1830, 0x0, 0x0, 0x1b8, 0x0, r0}, &(0x7f0000ffb000/0x2000)=nil, &(0x7f0000ffb000/0x4000)=nil, &(0x7f0000000100), &(0x7f0000000140)=0x0) r3 = openat$hwrng(0xffffffffffffff9c, &(0x7f0000000180), 0x2, 0x0) r4 = syz_io_uring_setup(0x65dd, &(0x7f00000001c0)={0x0, 0xf46f, 0x20, 0x2, 0xdf}, &(0x7f0000ffe000/0x1000)=nil, &(0x7f0000ffd000/0x1000)=nil, &(0x7f0000000240), &(0x7f0000000280)) r5 = syz_genetlink_get_family_id$mptcp(&(0x7f0000000300), r3) sendmsg$MPTCP_PM_CMD_ADD_ADDR(r3, &(0x7f00000003c0)={&(0x7f00000002c0)={0x10, 0x0, 0x0, 0x10}, 0xc, &(0x7f0000000380)={&(0x7f0000000340)={0x24, r5, 0x300, 0x70bd26, 0x25dfdbfb, {}, [@MPTCP_PM_ATTR_SUBFLOWS={0x8, 0x3, 0x1}, @MPTCP_PM_ATTR_RCV_ADD_ADDRS={0x8, 0x2, 0x2}]}, 0x24}, 0x1, 0x0, 0x0, 0x20000004}, 0x8890) syz_io_uring_setup(0x20f8, &(0x7f0000000400)={0x0, 0x7677, 0x8, 0x3, 0x22f, 0x0, r4}, &(0x7f0000ffe000/0x2000)=nil, &(0x7f0000ffb000/0x2000)=nil, &(0x7f0000000480)=0x0, &(0x7f00000004c0)) r7 = openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000500)='./cgroup/syz1\x00', 0x200002, 0x0) syz_io_uring_submit(r6, r2, &(0x7f0000000580)=@IORING_OP_FILES_UPDATE={0x14, 0x4, 0x0, 0x0, 0x40, &(0x7f0000000540)=[r4, 0xffffffffffffffff, r7, r0, r1], 0x5}, 0x3) io_uring_setup(0x2812, &(0x7f00000005c0)={0x0, 0x5e1b, 0x2, 0x3, 0x12f, 0x0, r4}) getpeername(r3, &(0x7f0000000640)=@nfc, &(0x7f00000006c0)=0x80) ioctl$SIOCSIFHWADDR(r3, 0x8924, &(0x7f0000000700)={'hsr0\x00', @broadcast}) openat$procfs(0xffffffffffffff9c, &(0x7f00000010c0)='/proc/crypto\x00', 0x0, 0x0) io_uring_setup(0x7c8f, &(0x7f0000001140)={0x0, 0xc240, 0x10, 0x3, 0x1c7, 0x0, r4}) 21:14:39 executing program 2: ioctl$SCSI_IOCTL_DOORUNLOCK(0xffffffffffffffff, 0x5381) r0 = syz_open_dev$mouse(&(0x7f0000000000), 0x578, 0x4000) ioctl$SG_GET_PACK_ID(r0, 0x227c, &(0x7f0000000040)) r1 = syz_genetlink_get_family_id$nl80211(&(0x7f00000000c0), r0) sendmsg$NL80211_CMD_NEW_KEY(r0, &(0x7f00000001c0)={&(0x7f0000000080)={0x10, 0x0, 0x0, 0x10}, 0xc, &(0x7f0000000180)={&(0x7f0000000100)={0x60, r1, 0x400, 0x70bd2b, 0x25dfdbff, {{}, {@val={0x8}, @void}}, [@NL80211_ATTR_KEY_TYPE={0x8, 0x37, 0x1}, @NL80211_ATTR_KEY_DEFAULT_MGMT={0x4}, @NL80211_ATTR_KEY={0x2c, 0x50, 0x0, 0x1, [@NL80211_KEY_DATA_WEP40={0x9, 0x1, "93f3c5ad5d"}, @NL80211_KEY_DEFAULT_TYPES={0x8, 0x8, 0x0, 0x1, [@NL80211_KEY_DEFAULT_TYPE_MULTICAST={0x4}]}, @NL80211_KEY_DATA_WEP104={0x11, 0x1, "8815558ac60368b42ebdf03bdb"}]}, @NL80211_ATTR_KEY_DATA_WEP40={0x9, 0x7, "74de692476"}]}, 0x60}, 0x1, 0x0, 0x0, 0x4000000}, 0x8000) r2 = openat$procfs(0xffffffffffffff9c, &(0x7f0000000200)='/proc/stat\x00', 0x0, 0x0) ioctl$SG_GET_TIMEOUT(r2, 0x2202, 0x0) ioctl$SG_SET_FORCE_PACK_ID(r0, 0x227b, &(0x7f0000000240)=0x1) ioctl$TUNGETIFF(r0, 0x800454d2, &(0x7f0000000280)={'vlan0\x00'}) sendmsg$NL80211_CMD_JOIN_MESH(r0, &(0x7f0000000400)={&(0x7f00000002c0)={0x10, 0x0, 0x0, 0x8}, 0xc, &(0x7f00000003c0)={&(0x7f0000000300)={0xc0, r1, 0x400, 0x70bd28, 0x25dfdbfc, {{}, {@void, @void}}, [@NL80211_ATTR_SOCKET_OWNER={0x4}, @NL80211_ATTR_MESH_SETUP={0xa8, 0x70, [@NL80211_MESH_SETUP_ENABLE_VENDOR_METRIC={0x5, 0x2, 0x1}, @NL80211_MESH_SETUP_IE={0x6b, 0x3, "432578a2646e5ab8df23d89ff57571f258fae075fd43855fb9486d9209824c25dbf24af1a18187d074463ff5b11350c72de592b494efe5b4f34cbc2a7a8a1160fd0a59dafb8fe7173e1b109dd23d0edf69c40605089d1c24278a427d497c415ba944a9a901d2b5"}, @NL80211_MESH_SETUP_USERSPACE_MPM={0x4}, @NL80211_MESH_SETUP_USERSPACE_AUTH={0x4}, @NL80211_MESH_SETUP_ENABLE_VENDOR_PATH_SEL={0x5, 0x1, 0x1}, @NL80211_MESH_SETUP_ENABLE_VENDOR_PATH_SEL={0x5, 0x1, 0x1}, @NL80211_MESH_SETUP_ENABLE_VENDOR_PATH_SEL={0x5, 0x1, 0x1}, @NL80211_MESH_SETUP_ENABLE_VENDOR_SYNC={0x5, 0x6, 0x1}, @NL80211_MESH_SETUP_USERSPACE_AUTH={0x4}, @NL80211_MESH_SETUP_USERSPACE_AMPE={0x4}]}]}, 0xc0}, 0x1, 0x0, 0x0, 0x10}, 0x4000001) ioctl$SCSI_IOCTL_DOORUNLOCK(r2, 0x5381) socketpair(0x0, 0x3, 0x6, &(0x7f0000000640)) r3 = openat$tcp_congestion(0xffffffffffffff9c, &(0x7f0000000800), 0x1, 0x0) write$tcp_congestion(r3, &(0x7f0000000840)='htcp\x00', 0x5) 21:14:48 executing program 4: bind$bt_l2cap(0xffffffffffffffff, 0x0, 0x0) 21:14:48 executing program 5: ptrace$peekuser(0x3, 0xffffffffffffffff, 0x3ff) r0 = syz_open_dev$vcsa(&(0x7f0000000140), 0xb6, 0x101000) sendmsg$NL80211_CMD_ASSOCIATE(r0, &(0x7f0000000440)={&(0x7f0000000300)={0x10, 0x0, 0x0, 0x8000000}, 0xc, &(0x7f0000000400)={&(0x7f0000000380)={0x54, 0x0, 0x4, 0x70bd2c, 0x25dfdbff, {{}, {@val={0x8}, @val={0xc, 0x99, {0x0, 0x78}}}}, [@NL80211_ATTR_SSID={0xa, 0x34, @default_ap_ssid}, @NL80211_ATTR_HT_CAPABILITY={0x1e, 0x1f, {0x300, 0x1, 0x1, 0x0, {0x6, 0x4c, 0x0, 0x4, 0x0, 0x1, 0x0, 0x1, 0x1}, 0x400, 0x2, 0x6}}]}, 0x54}}, 0x0) 21:14:48 executing program 7: write$P9_RSYMLINK(0xffffffffffffffff, &(0x7f0000000000)={0x14, 0x11, 0x2, {0x40, 0x3, 0x2}}, 0x14) ioctl$sock_ifreq(0xffffffffffffffff, 0x8935, &(0x7f0000000040)={'lo\x00', @ifru_addrs=@ethernet}) ioctl$sock_ifreq(0xffffffffffffffff, 0x8994, &(0x7f0000000080)={'ip6gretap0\x00', @ifru_flags}) sendmsg$IPSET_CMD_FLUSH(0xffffffffffffffff, &(0x7f0000000180)={&(0x7f00000000c0)={0x10, 0x0, 0x0, 0x10000}, 0xc, &(0x7f0000000140)={&(0x7f0000000100)={0x3c, 0x4, 0x6, 0x801, 0x0, 0x0, {0x3, 0x0, 0x4}, [@IPSET_ATTR_PROTOCOL={0x5}, @IPSET_ATTR_SETNAME={0x9, 0x2, 'syz0\x00'}, @IPSET_ATTR_SETNAME={0x9, 0x2, 'syz2\x00'}, @IPSET_ATTR_PROTOCOL={0x5}]}, 0x3c}}, 0x20000000) write$P9_RVERSION(0xffffffffffffffff, &(0x7f00000001c0)={0x13, 0x65, 0xffff, 0x3, 0x6, '9P2000'}, 0x13) pipe2$9p(&(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}, 0x0) write$P9_RSYMLINK(r0, &(0x7f0000000240)={0x14, 0x11, 0x1, {0x1, 0x3, 0x2}}, 0x14) add_key$fscrypt_v1(&(0x7f0000000280), &(0x7f00000002c0)={'fscrypt:', @desc2}, &(0x7f0000000300)={0x0, "ccf022eeb1aa5b4a9067674b5b7079352411c35248e190415959cbe4b7be99236abd831288583a8ed4db4b7b3f838c24d293f908bf3509b49f2c17852201f646", 0x19}, 0x48, 0xfffffffffffffffa) add_key$fscrypt_v1(&(0x7f0000000380), &(0x7f00000003c0)={'fscrypt:', @auto=[0x38, 0x65, 0x62, 0x61, 0x61, 0x62, 0x61, 0x64, 0x37, 0x32, 0x30, 0x61, 0x61, 0x50, 0x62, 0x62]}, &(0x7f0000000400)={0x0, "4916f745ecf1627b46363a6005d9ff599dde016c8b8d9d347624fd26c6e8bdbb7555714d1669e0e45bd9e03a462b54b255d728a05790d4698c32583ade59ecd8", 0x36}, 0x48, 0x0) syz_genetlink_get_family_id$mptcp(&(0x7f00000004c0), 0xffffffffffffffff) ioctl$ifreq_SIOCGIFINDEX_vcan(0xffffffffffffffff, 0x8933, &(0x7f00000005c0)={'vxcan0\x00'}) openat$vcsa(0xffffffffffffff9c, &(0x7f00000009c0), 0x14200, 0x0) syz_genetlink_get_family_id$mptcp(&(0x7f0000000a80), 0xffffffffffffffff) 21:14:48 executing program 6: keyctl$KEYCTL_PKEY_SIGN(0x1b, &(0x7f00000009c0)={0x0, 0x6c, 0x6d}, 0x0, &(0x7f0000000a80)="64824bc7426fe2f3e3c1e475569073ecff8ffb96e46626b91f3b9a2b2ac07610524644af1e29c43d27e1d513a86909a6ac4d9753ce88f3f3d0beb31db8dfdbcb65379a9cc111189465a0cd8a50f7c19f1579f44a95805d41c0c92de97999b1d961ee48d58cfddc3720b2cd20", &(0x7f0000000b00)=""/109) 21:14:48 executing program 2: ioctl$SCSI_IOCTL_DOORUNLOCK(0xffffffffffffffff, 0x5381) r0 = syz_open_dev$mouse(&(0x7f0000000000), 0x578, 0x4000) ioctl$SG_GET_PACK_ID(r0, 0x227c, &(0x7f0000000040)) r1 = syz_genetlink_get_family_id$nl80211(&(0x7f00000000c0), r0) sendmsg$NL80211_CMD_NEW_KEY(r0, &(0x7f00000001c0)={&(0x7f0000000080)={0x10, 0x0, 0x0, 0x10}, 0xc, &(0x7f0000000180)={&(0x7f0000000100)={0x60, r1, 0x400, 0x70bd2b, 0x25dfdbff, {{}, {@val={0x8}, @void}}, [@NL80211_ATTR_KEY_TYPE={0x8, 0x37, 0x1}, @NL80211_ATTR_KEY_DEFAULT_MGMT={0x4}, @NL80211_ATTR_KEY={0x2c, 0x50, 0x0, 0x1, [@NL80211_KEY_DATA_WEP40={0x9, 0x1, "93f3c5ad5d"}, @NL80211_KEY_DEFAULT_TYPES={0x8, 0x8, 0x0, 0x1, [@NL80211_KEY_DEFAULT_TYPE_MULTICAST={0x4}]}, @NL80211_KEY_DATA_WEP104={0x11, 0x1, "8815558ac60368b42ebdf03bdb"}]}, @NL80211_ATTR_KEY_DATA_WEP40={0x9, 0x7, "74de692476"}]}, 0x60}, 0x1, 0x0, 0x0, 0x4000000}, 0x8000) r2 = openat$procfs(0xffffffffffffff9c, &(0x7f0000000200)='/proc/stat\x00', 0x0, 0x0) ioctl$SG_GET_TIMEOUT(r2, 0x2202, 0x0) ioctl$SG_SET_FORCE_PACK_ID(r0, 0x227b, &(0x7f0000000240)=0x1) ioctl$TUNGETIFF(r0, 0x800454d2, &(0x7f0000000280)={'vlan0\x00'}) sendmsg$NL80211_CMD_JOIN_MESH(r0, &(0x7f0000000400)={&(0x7f00000002c0)={0x10, 0x0, 0x0, 0x8}, 0xc, &(0x7f00000003c0)={&(0x7f0000000300)={0xc0, r1, 0x400, 0x70bd28, 0x25dfdbfc, {{}, {@void, @void}}, [@NL80211_ATTR_SOCKET_OWNER={0x4}, @NL80211_ATTR_MESH_SETUP={0xa8, 0x70, [@NL80211_MESH_SETUP_ENABLE_VENDOR_METRIC={0x5, 0x2, 0x1}, @NL80211_MESH_SETUP_IE={0x6b, 0x3, "432578a2646e5ab8df23d89ff57571f258fae075fd43855fb9486d9209824c25dbf24af1a18187d074463ff5b11350c72de592b494efe5b4f34cbc2a7a8a1160fd0a59dafb8fe7173e1b109dd23d0edf69c40605089d1c24278a427d497c415ba944a9a901d2b5"}, @NL80211_MESH_SETUP_USERSPACE_MPM={0x4}, @NL80211_MESH_SETUP_USERSPACE_AUTH={0x4}, @NL80211_MESH_SETUP_ENABLE_VENDOR_PATH_SEL={0x5, 0x1, 0x1}, @NL80211_MESH_SETUP_ENABLE_VENDOR_PATH_SEL={0x5, 0x1, 0x1}, @NL80211_MESH_SETUP_ENABLE_VENDOR_PATH_SEL={0x5, 0x1, 0x1}, @NL80211_MESH_SETUP_ENABLE_VENDOR_SYNC={0x5, 0x6, 0x1}, @NL80211_MESH_SETUP_USERSPACE_AUTH={0x4}, @NL80211_MESH_SETUP_USERSPACE_AMPE={0x4}]}]}, 0xc0}, 0x1, 0x0, 0x0, 0x10}, 0x4000001) ioctl$SCSI_IOCTL_DOORUNLOCK(r2, 0x5381) socketpair(0x0, 0x3, 0x6, &(0x7f0000000640)) r3 = openat$tcp_congestion(0xffffffffffffff9c, &(0x7f0000000800), 0x1, 0x0) write$tcp_congestion(r3, &(0x7f0000000840)='htcp\x00', 0x5) 21:14:48 executing program 0: r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000000), 0x521000, 0x0) ioctl$TUNSETPERSIST(r0, 0x400454cb, 0x1) ioctl$SIOCSIFHWADDR(0xffffffffffffffff, 0x8924, &(0x7f0000000040)={'erspan0\x00', @local}) getresuid(&(0x7f0000000340), &(0x7f0000000380), &(0x7f00000003c0)) 21:14:48 executing program 3: syz_open_dev$sg(&(0x7f0000000400), 0x0, 0x22000) 21:14:48 executing program 1: r0 = io_uring_setup(0x355e, &(0x7f0000000000)={0x0, 0x7682, 0x20, 0x1, 0x1be}) r1 = syz_io_uring_setup(0x8fe, &(0x7f0000000080)={0x0, 0x1830, 0x0, 0x0, 0x1b8, 0x0, r0}, &(0x7f0000ffb000/0x2000)=nil, &(0x7f0000ffb000/0x4000)=nil, &(0x7f0000000100), &(0x7f0000000140)=0x0) r3 = openat$hwrng(0xffffffffffffff9c, &(0x7f0000000180), 0x2, 0x0) r4 = syz_io_uring_setup(0x65dd, &(0x7f00000001c0)={0x0, 0xf46f, 0x20, 0x2, 0xdf}, &(0x7f0000ffe000/0x1000)=nil, &(0x7f0000ffd000/0x1000)=nil, &(0x7f0000000240), &(0x7f0000000280)) r5 = syz_genetlink_get_family_id$mptcp(&(0x7f0000000300), r3) sendmsg$MPTCP_PM_CMD_ADD_ADDR(r3, &(0x7f00000003c0)={&(0x7f00000002c0)={0x10, 0x0, 0x0, 0x10}, 0xc, &(0x7f0000000380)={&(0x7f0000000340)={0x24, r5, 0x300, 0x70bd26, 0x25dfdbfb, {}, [@MPTCP_PM_ATTR_SUBFLOWS={0x8, 0x3, 0x1}, @MPTCP_PM_ATTR_RCV_ADD_ADDRS={0x8, 0x2, 0x2}]}, 0x24}, 0x1, 0x0, 0x0, 0x20000004}, 0x8890) syz_io_uring_setup(0x20f8, &(0x7f0000000400)={0x0, 0x7677, 0x8, 0x3, 0x22f, 0x0, r4}, &(0x7f0000ffe000/0x2000)=nil, &(0x7f0000ffb000/0x2000)=nil, &(0x7f0000000480)=0x0, &(0x7f00000004c0)) r7 = openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000500)='./cgroup/syz1\x00', 0x200002, 0x0) syz_io_uring_submit(r6, r2, &(0x7f0000000580)=@IORING_OP_FILES_UPDATE={0x14, 0x4, 0x0, 0x0, 0x40, &(0x7f0000000540)=[r4, 0xffffffffffffffff, r7, r0, r1], 0x5}, 0x3) io_uring_setup(0x2812, &(0x7f00000005c0)={0x0, 0x5e1b, 0x2, 0x3, 0x12f, 0x0, r4}) getpeername(r3, &(0x7f0000000640)=@nfc, &(0x7f00000006c0)=0x80) socket$inet6_tcp(0xa, 0x1, 0x0) openat$procfs(0xffffffffffffff9c, &(0x7f00000010c0)='/proc/crypto\x00', 0x0, 0x0) io_uring_setup(0x7c8f, &(0x7f0000001140)={0x0, 0xc240, 0x10, 0x3, 0x1c7, 0x0, r4}) 21:14:48 executing program 6: keyctl$KEYCTL_PKEY_SIGN(0x1b, &(0x7f00000009c0)={0x0, 0x6c, 0x6d}, 0x0, &(0x7f0000000a80)="64824bc7426fe2f3e3c1e475569073ecff8ffb96e46626b91f3b9a2b2ac07610524644af1e29c43d27e1d513a86909a6ac4d9753ce88f3f3d0beb31db8dfdbcb65379a9cc111189465a0cd8a50f7c19f1579f44a95805d41c0c92de97999b1d961ee48d58cfddc3720b2cd20", &(0x7f0000000b00)=""/109) 21:14:48 executing program 0: r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000000), 0x521000, 0x0) ioctl$TUNSETPERSIST(r0, 0x400454cb, 0x1) getresuid(&(0x7f0000000340), &(0x7f0000000380), &(0x7f00000003c0)) 21:14:58 executing program 3: syz_open_dev$sg(&(0x7f0000000400), 0x0, 0x22000) 21:14:58 executing program 1: r0 = io_uring_setup(0x355e, &(0x7f0000000000)={0x0, 0x7682, 0x20, 0x1, 0x1be}) r1 = syz_io_uring_setup(0x8fe, &(0x7f0000000080)={0x0, 0x1830, 0x0, 0x0, 0x1b8, 0x0, r0}, &(0x7f0000ffb000/0x2000)=nil, &(0x7f0000ffb000/0x4000)=nil, &(0x7f0000000100), &(0x7f0000000140)=0x0) r3 = openat$hwrng(0xffffffffffffff9c, &(0x7f0000000180), 0x2, 0x0) r4 = syz_io_uring_setup(0x65dd, &(0x7f00000001c0)={0x0, 0xf46f, 0x20, 0x2, 0xdf}, &(0x7f0000ffe000/0x1000)=nil, &(0x7f0000ffd000/0x1000)=nil, &(0x7f0000000240), &(0x7f0000000280)) r5 = syz_genetlink_get_family_id$mptcp(&(0x7f0000000300), r3) sendmsg$MPTCP_PM_CMD_ADD_ADDR(r3, &(0x7f00000003c0)={&(0x7f00000002c0)={0x10, 0x0, 0x0, 0x10}, 0xc, &(0x7f0000000380)={&(0x7f0000000340)={0x24, r5, 0x300, 0x70bd26, 0x25dfdbfb, {}, [@MPTCP_PM_ATTR_SUBFLOWS={0x8, 0x3, 0x1}, @MPTCP_PM_ATTR_RCV_ADD_ADDRS={0x8, 0x2, 0x2}]}, 0x24}, 0x1, 0x0, 0x0, 0x20000004}, 0x8890) syz_io_uring_setup(0x20f8, &(0x7f0000000400)={0x0, 0x7677, 0x8, 0x3, 0x22f, 0x0, r4}, &(0x7f0000ffe000/0x2000)=nil, &(0x7f0000ffb000/0x2000)=nil, &(0x7f0000000480)=0x0, &(0x7f00000004c0)) r7 = openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000500)='./cgroup/syz1\x00', 0x200002, 0x0) syz_io_uring_submit(r6, r2, &(0x7f0000000580)=@IORING_OP_FILES_UPDATE={0x14, 0x4, 0x0, 0x0, 0x40, &(0x7f0000000540)=[r4, 0xffffffffffffffff, r7, r0, r1], 0x5}, 0x3) io_uring_setup(0x2812, &(0x7f00000005c0)={0x0, 0x5e1b, 0x2, 0x3, 0x12f, 0x0, r4}) socket$inet6_tcp(0xa, 0x1, 0x0) openat$procfs(0xffffffffffffff9c, &(0x7f00000010c0)='/proc/crypto\x00', 0x0, 0x0) io_uring_setup(0x7c8f, &(0x7f0000001140)={0x0, 0xc240, 0x10, 0x3, 0x1c7, 0x0, r4}) 21:14:58 executing program 7: write$P9_RSYMLINK(0xffffffffffffffff, &(0x7f0000000000)={0x14, 0x11, 0x2, {0x40, 0x3, 0x2}}, 0x14) ioctl$sock_ifreq(0xffffffffffffffff, 0x8935, &(0x7f0000000040)={'lo\x00', @ifru_addrs=@ethernet}) ioctl$sock_ifreq(0xffffffffffffffff, 0x8994, &(0x7f0000000080)={'ip6gretap0\x00', @ifru_flags}) sendmsg$IPSET_CMD_FLUSH(0xffffffffffffffff, &(0x7f0000000180)={&(0x7f00000000c0)={0x10, 0x0, 0x0, 0x10000}, 0xc, &(0x7f0000000140)={&(0x7f0000000100)={0x3c, 0x4, 0x6, 0x801, 0x0, 0x0, {0x3, 0x0, 0x4}, [@IPSET_ATTR_PROTOCOL={0x5}, @IPSET_ATTR_SETNAME={0x9, 0x2, 'syz0\x00'}, @IPSET_ATTR_SETNAME={0x9, 0x2, 'syz2\x00'}, @IPSET_ATTR_PROTOCOL={0x5}]}, 0x3c}}, 0x20000000) write$P9_RVERSION(0xffffffffffffffff, &(0x7f00000001c0)={0x13, 0x65, 0xffff, 0x3, 0x6, '9P2000'}, 0x13) pipe2$9p(&(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}, 0x0) write$P9_RSYMLINK(r0, &(0x7f0000000240)={0x14, 0x11, 0x1, {0x1, 0x3, 0x2}}, 0x14) add_key$fscrypt_v1(&(0x7f0000000280), &(0x7f00000002c0)={'fscrypt:', @desc2}, &(0x7f0000000300)={0x0, "ccf022eeb1aa5b4a9067674b5b7079352411c35248e190415959cbe4b7be99236abd831288583a8ed4db4b7b3f838c24d293f908bf3509b49f2c17852201f646", 0x19}, 0x48, 0xfffffffffffffffa) add_key$fscrypt_v1(&(0x7f0000000380), &(0x7f00000003c0)={'fscrypt:', @auto=[0x38, 0x65, 0x62, 0x61, 0x61, 0x62, 0x61, 0x64, 0x37, 0x32, 0x30, 0x61, 0x61, 0x50, 0x62, 0x62]}, &(0x7f0000000400)={0x0, "4916f745ecf1627b46363a6005d9ff599dde016c8b8d9d347624fd26c6e8bdbb7555714d1669e0e45bd9e03a462b54b255d728a05790d4698c32583ade59ecd8", 0x36}, 0x48, 0x0) syz_genetlink_get_family_id$mptcp(&(0x7f00000004c0), 0xffffffffffffffff) openat$vcsa(0xffffffffffffff9c, &(0x7f00000009c0), 0x14200, 0x0) syz_genetlink_get_family_id$mptcp(&(0x7f0000000a80), 0xffffffffffffffff) 21:14:58 executing program 0: openat$tun(0xffffffffffffff9c, &(0x7f0000000000), 0x521000, 0x0) getresuid(&(0x7f0000000340), &(0x7f0000000380), &(0x7f00000003c0)) 21:14:58 executing program 4: keyctl$KEYCTL_PKEY_SIGN(0x1b, &(0x7f00000009c0)={0x0, 0x6c, 0x6d}, 0x0, &(0x7f0000000a80)="64824bc7426fe2f3e3c1e475569073ecff8ffb96e46626b91f3b9a2b2ac07610524644af1e29c43d27e1d513a86909a6ac4d9753ce88f3f3d0beb31db8dfdbcb65379a9cc111189465a0cd8a50f7c19f1579f44a95805d41c0c92de97999b1d961ee48d58cfddc3720b2cd20", &(0x7f0000000b00)=""/109) 21:14:58 executing program 5: r0 = syz_open_dev$vcsa(&(0x7f0000000140), 0xb6, 0x101000) sendmsg$NL80211_CMD_ASSOCIATE(r0, &(0x7f0000000440)={&(0x7f0000000300)={0x10, 0x0, 0x0, 0x8000000}, 0xc, &(0x7f0000000400)={&(0x7f0000000380)={0x54, 0x0, 0x4, 0x70bd2c, 0x25dfdbff, {{}, {@val={0x8}, @val={0xc, 0x99, {0x0, 0x78}}}}, [@NL80211_ATTR_SSID={0xa, 0x34, @default_ap_ssid}, @NL80211_ATTR_HT_CAPABILITY={0x1e, 0x1f, {0x300, 0x1, 0x1, 0x0, {0x6, 0x4c, 0x0, 0x4, 0x0, 0x1, 0x0, 0x1, 0x1}, 0x400, 0x2, 0x6}}]}, 0x54}}, 0x0) 21:14:58 executing program 6: keyctl$KEYCTL_PKEY_SIGN(0x1b, &(0x7f00000009c0)={0x0, 0x6c, 0x6d}, 0x0, &(0x7f0000000a80)="64824bc7426fe2f3e3c1e475569073ecff8ffb96e46626b91f3b9a2b2ac07610524644af1e29c43d27e1d513a86909a6ac4d9753ce88f3f3d0beb31db8dfdbcb65379a9cc111189465a0cd8a50f7c19f1579f44a95805d41c0c92de97999b1d961ee48d58cfddc3720b2cd20", &(0x7f0000000b00)=""/109) 21:14:58 executing program 2: ioctl$SCSI_IOCTL_DOORUNLOCK(0xffffffffffffffff, 0x5381) r0 = syz_open_dev$mouse(&(0x7f0000000000), 0x578, 0x4000) ioctl$SG_GET_PACK_ID(r0, 0x227c, &(0x7f0000000040)) r1 = syz_genetlink_get_family_id$nl80211(&(0x7f00000000c0), r0) sendmsg$NL80211_CMD_NEW_KEY(r0, &(0x7f00000001c0)={&(0x7f0000000080)={0x10, 0x0, 0x0, 0x10}, 0xc, &(0x7f0000000180)={&(0x7f0000000100)={0x60, r1, 0x400, 0x70bd2b, 0x25dfdbff, {{}, {@val={0x8}, @void}}, [@NL80211_ATTR_KEY_TYPE={0x8, 0x37, 0x1}, @NL80211_ATTR_KEY_DEFAULT_MGMT={0x4}, @NL80211_ATTR_KEY={0x2c, 0x50, 0x0, 0x1, [@NL80211_KEY_DATA_WEP40={0x9, 0x1, "93f3c5ad5d"}, @NL80211_KEY_DEFAULT_TYPES={0x8, 0x8, 0x0, 0x1, [@NL80211_KEY_DEFAULT_TYPE_MULTICAST={0x4}]}, @NL80211_KEY_DATA_WEP104={0x11, 0x1, "8815558ac60368b42ebdf03bdb"}]}, @NL80211_ATTR_KEY_DATA_WEP40={0x9, 0x7, "74de692476"}]}, 0x60}, 0x1, 0x0, 0x0, 0x4000000}, 0x8000) r2 = openat$procfs(0xffffffffffffff9c, &(0x7f0000000200)='/proc/stat\x00', 0x0, 0x0) ioctl$SG_GET_TIMEOUT(r2, 0x2202, 0x0) ioctl$SG_SET_FORCE_PACK_ID(r0, 0x227b, &(0x7f0000000240)=0x1) ioctl$TUNGETIFF(r0, 0x800454d2, &(0x7f0000000280)={'vlan0\x00'}) sendmsg$NL80211_CMD_JOIN_MESH(r0, &(0x7f0000000400)={&(0x7f00000002c0)={0x10, 0x0, 0x0, 0x8}, 0xc, &(0x7f00000003c0)={&(0x7f0000000300)={0xc0, r1, 0x400, 0x70bd28, 0x25dfdbfc, {{}, {@void, @void}}, [@NL80211_ATTR_SOCKET_OWNER={0x4}, @NL80211_ATTR_MESH_SETUP={0xa8, 0x70, [@NL80211_MESH_SETUP_ENABLE_VENDOR_METRIC={0x5, 0x2, 0x1}, @NL80211_MESH_SETUP_IE={0x6b, 0x3, "432578a2646e5ab8df23d89ff57571f258fae075fd43855fb9486d9209824c25dbf24af1a18187d074463ff5b11350c72de592b494efe5b4f34cbc2a7a8a1160fd0a59dafb8fe7173e1b109dd23d0edf69c40605089d1c24278a427d497c415ba944a9a901d2b5"}, @NL80211_MESH_SETUP_USERSPACE_MPM={0x4}, @NL80211_MESH_SETUP_USERSPACE_AUTH={0x4}, @NL80211_MESH_SETUP_ENABLE_VENDOR_PATH_SEL={0x5, 0x1, 0x1}, @NL80211_MESH_SETUP_ENABLE_VENDOR_PATH_SEL={0x5, 0x1, 0x1}, @NL80211_MESH_SETUP_ENABLE_VENDOR_PATH_SEL={0x5, 0x1, 0x1}, @NL80211_MESH_SETUP_ENABLE_VENDOR_SYNC={0x5, 0x6, 0x1}, @NL80211_MESH_SETUP_USERSPACE_AUTH={0x4}, @NL80211_MESH_SETUP_USERSPACE_AMPE={0x4}]}]}, 0xc0}, 0x1, 0x0, 0x0, 0x10}, 0x4000001) syz_open_dev$vcsa(&(0x7f0000000440), 0x56, 0x4000) socketpair(0x0, 0x3, 0x6, &(0x7f0000000640)) r3 = openat$tcp_congestion(0xffffffffffffff9c, &(0x7f0000000800), 0x1, 0x0) write$tcp_congestion(r3, &(0x7f0000000840)='htcp\x00', 0x5) 21:14:58 executing program 4: keyctl$KEYCTL_PKEY_SIGN(0x1b, &(0x7f00000009c0)={0x0, 0x6c, 0x6d}, 0x0, &(0x7f0000000a80)="64824bc7426fe2f3e3c1e475569073ecff8ffb96e46626b91f3b9a2b2ac07610524644af1e29c43d27e1d513a86909a6ac4d9753ce88f3f3d0beb31db8dfdbcb65379a9cc111189465a0cd8a50f7c19f1579f44a95805d41c0c92de97999b1d961ee48d58cfddc3720b2cd20", &(0x7f0000000b00)=""/109) 21:14:58 executing program 6: keyctl$KEYCTL_PKEY_SIGN(0x1b, &(0x7f00000009c0)={0x0, 0x0, 0x6d}, &(0x7f0000000a00)={'enc=', 'pkcs1', ' hash=', {'nhpoly1305-generic\x00'}}, 0x0, &(0x7f0000000b00)=""/109) 21:14:58 executing program 5: r0 = syz_open_dev$vcsa(0x0, 0xb6, 0x101000) sendmsg$NL80211_CMD_ASSOCIATE(r0, &(0x7f0000000440)={&(0x7f0000000300)={0x10, 0x0, 0x0, 0x8000000}, 0xc, &(0x7f0000000400)={&(0x7f0000000380)={0x54, 0x0, 0x4, 0x70bd2c, 0x25dfdbff, {{}, {@val={0x8}, @val={0xc, 0x99, {0x0, 0x78}}}}, [@NL80211_ATTR_SSID={0xa, 0x34, @default_ap_ssid}, @NL80211_ATTR_HT_CAPABILITY={0x1e, 0x1f, {0x300, 0x1, 0x1, 0x0, {0x6, 0x4c, 0x0, 0x4, 0x0, 0x1, 0x0, 0x1, 0x1}, 0x400, 0x2, 0x6}}]}, 0x54}}, 0x0) 21:14:58 executing program 0: getresuid(&(0x7f0000000340), &(0x7f0000000380), &(0x7f00000003c0)) 21:14:58 executing program 3: syz_open_dev$sg(&(0x7f0000000400), 0x0, 0x22000) 21:14:58 executing program 5: r0 = syz_open_dev$vcsa(0x0, 0xb6, 0x101000) sendmsg$NL80211_CMD_ASSOCIATE(r0, &(0x7f0000000440)={&(0x7f0000000300)={0x10, 0x0, 0x0, 0x8000000}, 0xc, &(0x7f0000000400)={&(0x7f0000000380)={0x54, 0x0, 0x4, 0x70bd2c, 0x25dfdbff, {{}, {@val={0x8}, @val={0xc, 0x99, {0x0, 0x78}}}}, [@NL80211_ATTR_SSID={0xa, 0x34, @default_ap_ssid}, @NL80211_ATTR_HT_CAPABILITY={0x1e, 0x1f, {0x300, 0x1, 0x1, 0x0, {0x6, 0x4c, 0x0, 0x4, 0x0, 0x1, 0x0, 0x1, 0x1}, 0x400, 0x2, 0x6}}]}, 0x54}}, 0x0) 21:14:58 executing program 1: r0 = io_uring_setup(0x355e, &(0x7f0000000000)={0x0, 0x7682, 0x20, 0x1, 0x1be}) r1 = syz_io_uring_setup(0x8fe, &(0x7f0000000080)={0x0, 0x1830, 0x0, 0x0, 0x1b8, 0x0, r0}, &(0x7f0000ffb000/0x2000)=nil, &(0x7f0000ffb000/0x4000)=nil, &(0x7f0000000100), &(0x7f0000000140)=0x0) r3 = openat$hwrng(0xffffffffffffff9c, &(0x7f0000000180), 0x2, 0x0) r4 = syz_io_uring_setup(0x65dd, &(0x7f00000001c0)={0x0, 0xf46f, 0x20, 0x2, 0xdf}, &(0x7f0000ffe000/0x1000)=nil, &(0x7f0000ffd000/0x1000)=nil, &(0x7f0000000240), &(0x7f0000000280)) r5 = syz_genetlink_get_family_id$mptcp(&(0x7f0000000300), r3) sendmsg$MPTCP_PM_CMD_ADD_ADDR(r3, &(0x7f00000003c0)={&(0x7f00000002c0)={0x10, 0x0, 0x0, 0x10}, 0xc, &(0x7f0000000380)={&(0x7f0000000340)={0x24, r5, 0x300, 0x70bd26, 0x25dfdbfb, {}, [@MPTCP_PM_ATTR_SUBFLOWS={0x8, 0x3, 0x1}, @MPTCP_PM_ATTR_RCV_ADD_ADDRS={0x8, 0x2, 0x2}]}, 0x24}, 0x1, 0x0, 0x0, 0x20000004}, 0x8890) syz_io_uring_setup(0x20f8, &(0x7f0000000400)={0x0, 0x7677, 0x8, 0x3, 0x22f, 0x0, r4}, &(0x7f0000ffe000/0x2000)=nil, &(0x7f0000ffb000/0x2000)=nil, &(0x7f0000000480)=0x0, &(0x7f00000004c0)) r7 = openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000500)='./cgroup/syz1\x00', 0x200002, 0x0) syz_io_uring_submit(r6, r2, &(0x7f0000000580)=@IORING_OP_FILES_UPDATE={0x14, 0x4, 0x0, 0x0, 0x40, &(0x7f0000000540)=[r4, 0xffffffffffffffff, r7, r0, r1], 0x5}, 0x3) socket$inet6_tcp(0xa, 0x1, 0x0) openat$procfs(0xffffffffffffff9c, &(0x7f00000010c0)='/proc/crypto\x00', 0x0, 0x0) io_uring_setup(0x7c8f, &(0x7f0000001140)={0x0, 0xc240, 0x10, 0x3, 0x1c7, 0x0, r4}) 21:14:58 executing program 0: getresuid(&(0x7f0000000340), &(0x7f0000000380), &(0x7f00000003c0)) 21:14:58 executing program 4: keyctl$KEYCTL_PKEY_SIGN(0x1b, &(0x7f00000009c0)={0x0, 0x6c, 0x6d}, 0x0, &(0x7f0000000a80)="64824bc7426fe2f3e3c1e475569073ecff8ffb96e46626b91f3b9a2b2ac07610524644af1e29c43d27e1d513a86909a6ac4d9753ce88f3f3d0beb31db8dfdbcb65379a9cc111189465a0cd8a50f7c19f1579f44a95805d41c0c92de97999b1d961ee48d58cfddc3720b2cd20", &(0x7f0000000b00)=""/109) 21:14:58 executing program 7: write$P9_RSYMLINK(0xffffffffffffffff, &(0x7f0000000000)={0x14, 0x11, 0x2, {0x40, 0x3, 0x2}}, 0x14) ioctl$sock_ifreq(0xffffffffffffffff, 0x8935, &(0x7f0000000040)={'lo\x00', @ifru_addrs=@ethernet}) ioctl$sock_ifreq(0xffffffffffffffff, 0x8994, &(0x7f0000000080)={'ip6gretap0\x00', @ifru_flags}) sendmsg$IPSET_CMD_FLUSH(0xffffffffffffffff, &(0x7f0000000180)={&(0x7f00000000c0)={0x10, 0x0, 0x0, 0x10000}, 0xc, &(0x7f0000000140)={&(0x7f0000000100)={0x3c, 0x4, 0x6, 0x801, 0x0, 0x0, {0x3, 0x0, 0x4}, [@IPSET_ATTR_PROTOCOL={0x5}, @IPSET_ATTR_SETNAME={0x9, 0x2, 'syz0\x00'}, @IPSET_ATTR_SETNAME={0x9, 0x2, 'syz2\x00'}, @IPSET_ATTR_PROTOCOL={0x5}]}, 0x3c}}, 0x20000000) write$P9_RVERSION(0xffffffffffffffff, &(0x7f00000001c0)={0x13, 0x65, 0xffff, 0x3, 0x6, '9P2000'}, 0x13) pipe2$9p(&(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}, 0x0) write$P9_RSYMLINK(r0, &(0x7f0000000240)={0x14, 0x11, 0x1, {0x1, 0x3, 0x2}}, 0x14) add_key$fscrypt_v1(&(0x7f0000000280), &(0x7f00000002c0)={'fscrypt:', @desc2}, &(0x7f0000000300)={0x0, "ccf022eeb1aa5b4a9067674b5b7079352411c35248e190415959cbe4b7be99236abd831288583a8ed4db4b7b3f838c24d293f908bf3509b49f2c17852201f646", 0x19}, 0x48, 0xfffffffffffffffa) add_key$fscrypt_v1(&(0x7f0000000380), &(0x7f00000003c0)={'fscrypt:', @auto=[0x38, 0x65, 0x62, 0x61, 0x61, 0x62, 0x61, 0x64, 0x37, 0x32, 0x30, 0x61, 0x61, 0x50, 0x62, 0x62]}, &(0x7f0000000400)={0x0, "4916f745ecf1627b46363a6005d9ff599dde016c8b8d9d347624fd26c6e8bdbb7555714d1669e0e45bd9e03a462b54b255d728a05790d4698c32583ade59ecd8", 0x36}, 0x48, 0x0) syz_genetlink_get_family_id$mptcp(&(0x7f00000004c0), 0xffffffffffffffff) openat$vcsa(0xffffffffffffff9c, &(0x7f00000009c0), 0x14200, 0x0) syz_genetlink_get_family_id$mptcp(&(0x7f0000000a80), 0xffffffffffffffff) 21:14:58 executing program 2: ioctl$SCSI_IOCTL_DOORUNLOCK(0xffffffffffffffff, 0x5381) r0 = syz_open_dev$mouse(&(0x7f0000000000), 0x578, 0x4000) ioctl$SG_GET_PACK_ID(r0, 0x227c, &(0x7f0000000040)) r1 = syz_genetlink_get_family_id$nl80211(&(0x7f00000000c0), r0) sendmsg$NL80211_CMD_NEW_KEY(r0, &(0x7f00000001c0)={&(0x7f0000000080)={0x10, 0x0, 0x0, 0x10}, 0xc, &(0x7f0000000180)={&(0x7f0000000100)={0x60, r1, 0x400, 0x70bd2b, 0x25dfdbff, {{}, {@val={0x8}, @void}}, [@NL80211_ATTR_KEY_TYPE={0x8, 0x37, 0x1}, @NL80211_ATTR_KEY_DEFAULT_MGMT={0x4}, @NL80211_ATTR_KEY={0x2c, 0x50, 0x0, 0x1, [@NL80211_KEY_DATA_WEP40={0x9, 0x1, "93f3c5ad5d"}, @NL80211_KEY_DEFAULT_TYPES={0x8, 0x8, 0x0, 0x1, [@NL80211_KEY_DEFAULT_TYPE_MULTICAST={0x4}]}, @NL80211_KEY_DATA_WEP104={0x11, 0x1, "8815558ac60368b42ebdf03bdb"}]}, @NL80211_ATTR_KEY_DATA_WEP40={0x9, 0x7, "74de692476"}]}, 0x60}, 0x1, 0x0, 0x0, 0x4000000}, 0x8000) r2 = openat$procfs(0xffffffffffffff9c, &(0x7f0000000200)='/proc/stat\x00', 0x0, 0x0) ioctl$SG_GET_TIMEOUT(r2, 0x2202, 0x0) ioctl$SG_SET_FORCE_PACK_ID(r0, 0x227b, &(0x7f0000000240)=0x1) ioctl$TUNGETIFF(r0, 0x800454d2, &(0x7f0000000280)={'vlan0\x00'}) syz_open_dev$vcsa(&(0x7f0000000440), 0x56, 0x4000) socketpair(0x0, 0x3, 0x6, &(0x7f0000000640)) r3 = openat$tcp_congestion(0xffffffffffffff9c, &(0x7f0000000800), 0x1, 0x0) write$tcp_congestion(r3, &(0x7f0000000840)='htcp\x00', 0x5) 21:14:58 executing program 3: syz_open_dev$sg(&(0x7f0000000400), 0x494, 0x0) 21:14:58 executing program 6: keyctl$KEYCTL_PKEY_SIGN(0x1b, &(0x7f00000009c0), &(0x7f0000000a00)={'enc=', 'pkcs1', ' hash=', {'nhpoly1305-generic\x00'}}, 0x0, 0x0) 21:14:59 executing program 0: getresuid(&(0x7f0000000340), &(0x7f0000000380), &(0x7f00000003c0)) 21:15:07 executing program 0: openat$tun(0xffffffffffffff9c, 0x0, 0x521000, 0x0) getresuid(&(0x7f0000000340), &(0x7f0000000380), &(0x7f00000003c0)) 21:15:07 executing program 5: r0 = syz_open_dev$vcsa(0x0, 0xb6, 0x101000) sendmsg$NL80211_CMD_ASSOCIATE(r0, &(0x7f0000000440)={&(0x7f0000000300)={0x10, 0x0, 0x0, 0x8000000}, 0xc, &(0x7f0000000400)={&(0x7f0000000380)={0x54, 0x0, 0x4, 0x70bd2c, 0x25dfdbff, {{}, {@val={0x8}, @val={0xc, 0x99, {0x0, 0x78}}}}, [@NL80211_ATTR_SSID={0xa, 0x34, @default_ap_ssid}, @NL80211_ATTR_HT_CAPABILITY={0x1e, 0x1f, {0x300, 0x1, 0x1, 0x0, {0x6, 0x4c, 0x0, 0x4, 0x0, 0x1, 0x0, 0x1, 0x1}, 0x400, 0x2, 0x6}}]}, 0x54}}, 0x0) 21:15:07 executing program 2: ioctl$SCSI_IOCTL_DOORUNLOCK(0xffffffffffffffff, 0x5381) r0 = syz_open_dev$mouse(&(0x7f0000000000), 0x578, 0x4000) ioctl$SG_GET_PACK_ID(r0, 0x227c, &(0x7f0000000040)) r1 = syz_genetlink_get_family_id$nl80211(&(0x7f00000000c0), r0) sendmsg$NL80211_CMD_NEW_KEY(r0, &(0x7f00000001c0)={&(0x7f0000000080)={0x10, 0x0, 0x0, 0x10}, 0xc, &(0x7f0000000180)={&(0x7f0000000100)={0x60, r1, 0x400, 0x70bd2b, 0x25dfdbff, {{}, {@val={0x8}, @void}}, [@NL80211_ATTR_KEY_TYPE={0x8, 0x37, 0x1}, @NL80211_ATTR_KEY_DEFAULT_MGMT={0x4}, @NL80211_ATTR_KEY={0x2c, 0x50, 0x0, 0x1, [@NL80211_KEY_DATA_WEP40={0x9, 0x1, "93f3c5ad5d"}, @NL80211_KEY_DEFAULT_TYPES={0x8, 0x8, 0x0, 0x1, [@NL80211_KEY_DEFAULT_TYPE_MULTICAST={0x4}]}, @NL80211_KEY_DATA_WEP104={0x11, 0x1, "8815558ac60368b42ebdf03bdb"}]}, @NL80211_ATTR_KEY_DATA_WEP40={0x9, 0x7, "74de692476"}]}, 0x60}, 0x1, 0x0, 0x0, 0x4000000}, 0x8000) r2 = openat$procfs(0xffffffffffffff9c, &(0x7f0000000200)='/proc/stat\x00', 0x0, 0x0) ioctl$SG_GET_TIMEOUT(r2, 0x2202, 0x0) ioctl$SG_SET_FORCE_PACK_ID(r0, 0x227b, &(0x7f0000000240)=0x1) syz_open_dev$vcsa(&(0x7f0000000440), 0x56, 0x4000) socketpair(0x0, 0x3, 0x6, &(0x7f0000000640)) r3 = openat$tcp_congestion(0xffffffffffffff9c, &(0x7f0000000800), 0x1, 0x0) write$tcp_congestion(r3, &(0x7f0000000840)='htcp\x00', 0x5) 21:15:07 executing program 7: write$P9_RSYMLINK(0xffffffffffffffff, &(0x7f0000000000)={0x14, 0x11, 0x2, {0x40, 0x3, 0x2}}, 0x14) ioctl$sock_ifreq(0xffffffffffffffff, 0x8935, &(0x7f0000000040)={'lo\x00', @ifru_addrs=@ethernet}) ioctl$sock_ifreq(0xffffffffffffffff, 0x8994, &(0x7f0000000080)={'ip6gretap0\x00', @ifru_flags}) sendmsg$IPSET_CMD_FLUSH(0xffffffffffffffff, &(0x7f0000000180)={&(0x7f00000000c0)={0x10, 0x0, 0x0, 0x10000}, 0xc, &(0x7f0000000140)={&(0x7f0000000100)={0x3c, 0x4, 0x6, 0x801, 0x0, 0x0, {0x3, 0x0, 0x4}, [@IPSET_ATTR_PROTOCOL={0x5}, @IPSET_ATTR_SETNAME={0x9, 0x2, 'syz0\x00'}, @IPSET_ATTR_SETNAME={0x9, 0x2, 'syz2\x00'}, @IPSET_ATTR_PROTOCOL={0x5}]}, 0x3c}}, 0x20000000) write$P9_RVERSION(0xffffffffffffffff, &(0x7f00000001c0)={0x13, 0x65, 0xffff, 0x3, 0x6, '9P2000'}, 0x13) pipe2$9p(&(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}, 0x0) write$P9_RSYMLINK(r0, &(0x7f0000000240)={0x14, 0x11, 0x1, {0x1, 0x3, 0x2}}, 0x14) add_key$fscrypt_v1(&(0x7f0000000280), &(0x7f00000002c0)={'fscrypt:', @desc2}, &(0x7f0000000300)={0x0, "ccf022eeb1aa5b4a9067674b5b7079352411c35248e190415959cbe4b7be99236abd831288583a8ed4db4b7b3f838c24d293f908bf3509b49f2c17852201f646", 0x19}, 0x48, 0xfffffffffffffffa) add_key$fscrypt_v1(&(0x7f0000000380), &(0x7f00000003c0)={'fscrypt:', @auto=[0x38, 0x65, 0x62, 0x61, 0x61, 0x62, 0x61, 0x64, 0x37, 0x32, 0x30, 0x61, 0x61, 0x50, 0x62, 0x62]}, &(0x7f0000000400)={0x0, "4916f745ecf1627b46363a6005d9ff599dde016c8b8d9d347624fd26c6e8bdbb7555714d1669e0e45bd9e03a462b54b255d728a05790d4698c32583ade59ecd8", 0x36}, 0x48, 0x0) openat$vcsa(0xffffffffffffff9c, &(0x7f00000009c0), 0x14200, 0x0) syz_genetlink_get_family_id$mptcp(&(0x7f0000000a80), 0xffffffffffffffff) 21:15:07 executing program 4: keyctl$KEYCTL_PKEY_SIGN(0x1b, 0x0, 0x0, &(0x7f0000000a80)="64824bc7426fe2f3e3c1e475569073ecff8ffb96e46626b91f3b9a2b2ac07610524644af1e29c43d27e1d513a86909a6ac4d9753ce88f3f3d0beb31db8dfdbcb65379a9cc111189465a0cd8a50f7c19f1579f44a95805d41c0c92de97999b1d961ee48d58cfddc3720b2cd20", &(0x7f0000000b00)=""/109) 21:15:07 executing program 3: getresuid(&(0x7f0000000340), &(0x7f0000000380), &(0x7f00000003c0)) 21:15:07 executing program 1: r0 = io_uring_setup(0x355e, &(0x7f0000000000)={0x0, 0x7682, 0x20, 0x1, 0x1be}) r1 = syz_io_uring_setup(0x8fe, &(0x7f0000000080)={0x0, 0x1830, 0x0, 0x0, 0x1b8, 0x0, r0}, &(0x7f0000ffb000/0x2000)=nil, &(0x7f0000ffb000/0x4000)=nil, &(0x7f0000000100), &(0x7f0000000140)=0x0) r3 = openat$hwrng(0xffffffffffffff9c, &(0x7f0000000180), 0x2, 0x0) r4 = syz_io_uring_setup(0x65dd, &(0x7f00000001c0)={0x0, 0xf46f, 0x20, 0x2, 0xdf}, &(0x7f0000ffe000/0x1000)=nil, &(0x7f0000ffd000/0x1000)=nil, &(0x7f0000000240), &(0x7f0000000280)) r5 = syz_genetlink_get_family_id$mptcp(&(0x7f0000000300), r3) sendmsg$MPTCP_PM_CMD_ADD_ADDR(r3, &(0x7f00000003c0)={&(0x7f00000002c0)={0x10, 0x0, 0x0, 0x10}, 0xc, &(0x7f0000000380)={&(0x7f0000000340)={0x24, r5, 0x300, 0x70bd26, 0x25dfdbfb, {}, [@MPTCP_PM_ATTR_SUBFLOWS={0x8, 0x3, 0x1}, @MPTCP_PM_ATTR_RCV_ADD_ADDRS={0x8, 0x2, 0x2}]}, 0x24}, 0x1, 0x0, 0x0, 0x20000004}, 0x8890) syz_io_uring_setup(0x20f8, &(0x7f0000000400)={0x0, 0x7677, 0x8, 0x3, 0x22f, 0x0, r4}, &(0x7f0000ffe000/0x2000)=nil, &(0x7f0000ffb000/0x2000)=nil, &(0x7f0000000480)=0x0, &(0x7f00000004c0)) r7 = openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000500)='./cgroup/syz1\x00', 0x200002, 0x0) syz_io_uring_submit(r6, r2, &(0x7f0000000580)=@IORING_OP_FILES_UPDATE={0x14, 0x4, 0x0, 0x0, 0x40, &(0x7f0000000540)=[r4, 0xffffffffffffffff, r7, r0, r1], 0x5}, 0x3) socket$inet6_tcp(0xa, 0x1, 0x0) openat$procfs(0xffffffffffffff9c, &(0x7f00000010c0)='/proc/crypto\x00', 0x0, 0x0) io_uring_setup(0x7c8f, &(0x7f0000001140)={0x0, 0xc240, 0x10, 0x3, 0x1c7, 0x0, r4}) 21:15:07 executing program 6: r0 = io_uring_setup(0x355e, &(0x7f0000000000)={0x0, 0x7682, 0x20, 0x1, 0x1be}) r1 = syz_io_uring_setup(0x8fe, &(0x7f0000000080)={0x0, 0x1830, 0x0, 0x0, 0x1b8, 0x0, r0}, &(0x7f0000ffb000/0x2000)=nil, &(0x7f0000ffb000/0x4000)=nil, &(0x7f0000000100), &(0x7f0000000140)=0x0) r3 = openat$hwrng(0xffffffffffffff9c, &(0x7f0000000180), 0x2, 0x0) r4 = syz_io_uring_setup(0x65dd, &(0x7f00000001c0)={0x0, 0xf46f, 0x20, 0x2, 0xdf}, &(0x7f0000ffe000/0x1000)=nil, &(0x7f0000ffd000/0x1000)=nil, &(0x7f0000000240), &(0x7f0000000280)) r5 = syz_genetlink_get_family_id$mptcp(&(0x7f0000000300), r3) sendmsg$MPTCP_PM_CMD_ADD_ADDR(r3, &(0x7f00000003c0)={&(0x7f00000002c0)={0x10, 0x0, 0x0, 0x10}, 0xc, &(0x7f0000000380)={&(0x7f0000000340)={0x24, r5, 0x300, 0x70bd26, 0x25dfdbfb, {}, [@MPTCP_PM_ATTR_SUBFLOWS={0x8, 0x3, 0x1}, @MPTCP_PM_ATTR_RCV_ADD_ADDRS={0x8, 0x2, 0x2}]}, 0x24}, 0x1, 0x0, 0x0, 0x20000004}, 0x8890) syz_io_uring_setup(0x20f8, &(0x7f0000000400)={0x0, 0x7677, 0x8, 0x3, 0x22f, 0x0, r4}, &(0x7f0000ffe000/0x2000)=nil, &(0x7f0000ffb000/0x2000)=nil, &(0x7f0000000480)=0x0, &(0x7f00000004c0)) r7 = openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000500)='./cgroup/syz1\x00', 0x200002, 0x0) syz_io_uring_submit(r6, r2, &(0x7f0000000580)=@IORING_OP_FILES_UPDATE={0x14, 0x4, 0x0, 0x0, 0x40, &(0x7f0000000540)=[r4, 0xffffffffffffffff, r7, r0, r1], 0x5}, 0x3) socket$inet6_tcp(0xa, 0x1, 0x0) openat$procfs(0xffffffffffffff9c, &(0x7f00000010c0)='/proc/crypto\x00', 0x0, 0x0) io_uring_setup(0x7c8f, &(0x7f0000001140)={0x0, 0xc240, 0x10, 0x3, 0x1c7, 0x0, r4}) 21:15:07 executing program 3: getresuid(&(0x7f0000000340), &(0x7f0000000380), &(0x7f00000003c0)) 21:15:07 executing program 4: keyctl$KEYCTL_PKEY_SIGN(0x1b, 0x0, 0x0, &(0x7f0000000a80)="64824bc7426fe2f3e3c1e475569073ecff8ffb96e46626b91f3b9a2b2ac07610524644af1e29c43d27e1d513a86909a6ac4d9753ce88f3f3d0beb31db8dfdbcb65379a9cc111189465a0cd8a50f7c19f1579f44a95805d41c0c92de97999b1d961ee48d58cfddc3720b2cd20", &(0x7f0000000b00)=""/109) 21:15:07 executing program 1: r0 = io_uring_setup(0x355e, &(0x7f0000000000)={0x0, 0x7682, 0x20, 0x1, 0x1be}) r1 = syz_io_uring_setup(0x8fe, &(0x7f0000000080)={0x0, 0x1830, 0x0, 0x0, 0x1b8, 0x0, r0}, &(0x7f0000ffb000/0x2000)=nil, &(0x7f0000ffb000/0x4000)=nil, &(0x7f0000000100), &(0x7f0000000140)=0x0) r3 = openat$hwrng(0xffffffffffffff9c, &(0x7f0000000180), 0x2, 0x0) r4 = syz_io_uring_setup(0x65dd, &(0x7f00000001c0)={0x0, 0xf46f, 0x20, 0x2, 0xdf}, &(0x7f0000ffe000/0x1000)=nil, &(0x7f0000ffd000/0x1000)=nil, &(0x7f0000000240), &(0x7f0000000280)) r5 = syz_genetlink_get_family_id$mptcp(&(0x7f0000000300), r3) sendmsg$MPTCP_PM_CMD_ADD_ADDR(r3, &(0x7f00000003c0)={&(0x7f00000002c0)={0x10, 0x0, 0x0, 0x10}, 0xc, &(0x7f0000000380)={&(0x7f0000000340)={0x24, r5, 0x300, 0x70bd26, 0x25dfdbfb, {}, [@MPTCP_PM_ATTR_SUBFLOWS={0x8, 0x3, 0x1}, @MPTCP_PM_ATTR_RCV_ADD_ADDRS={0x8, 0x2, 0x2}]}, 0x24}, 0x1, 0x0, 0x0, 0x20000004}, 0x8890) syz_io_uring_setup(0x20f8, &(0x7f0000000400)={0x0, 0x7677, 0x8, 0x3, 0x22f, 0x0, r4}, &(0x7f0000ffe000/0x2000)=nil, &(0x7f0000ffb000/0x2000)=nil, &(0x7f0000000480)=0x0, &(0x7f00000004c0)) r7 = openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000500)='./cgroup/syz1\x00', 0x200002, 0x0) syz_io_uring_submit(r6, r2, &(0x7f0000000580)=@IORING_OP_FILES_UPDATE={0x14, 0x4, 0x0, 0x0, 0x40, &(0x7f0000000540)=[r4, 0xffffffffffffffff, r7, r0, r1], 0x5}, 0x3) socket$inet6_tcp(0xa, 0x1, 0x0) openat$procfs(0xffffffffffffff9c, &(0x7f00000010c0)='/proc/crypto\x00', 0x0, 0x0) io_uring_setup(0x7c8f, &(0x7f0000001140)={0x0, 0xc240, 0x10, 0x3, 0x1c7, 0x0, r4}) 21:15:07 executing program 0: openat$tun(0xffffffffffffff9c, 0x0, 0x521000, 0x0) getresuid(&(0x7f0000000340), &(0x7f0000000380), &(0x7f00000003c0)) 21:15:17 executing program 6: r0 = io_uring_setup(0x355e, &(0x7f0000000000)={0x0, 0x7682, 0x20, 0x1, 0x1be}) r1 = syz_io_uring_setup(0x8fe, &(0x7f0000000080)={0x0, 0x1830, 0x0, 0x0, 0x1b8, 0x0, r0}, &(0x7f0000ffb000/0x2000)=nil, &(0x7f0000ffb000/0x4000)=nil, &(0x7f0000000100), &(0x7f0000000140)=0x0) r3 = openat$hwrng(0xffffffffffffff9c, &(0x7f0000000180), 0x2, 0x0) r4 = syz_io_uring_setup(0x65dd, &(0x7f00000001c0)={0x0, 0xf46f, 0x20, 0x2, 0xdf}, &(0x7f0000ffe000/0x1000)=nil, &(0x7f0000ffd000/0x1000)=nil, &(0x7f0000000240), &(0x7f0000000280)) r5 = syz_genetlink_get_family_id$mptcp(&(0x7f0000000300), r3) sendmsg$MPTCP_PM_CMD_ADD_ADDR(r3, &(0x7f00000003c0)={&(0x7f00000002c0)={0x10, 0x0, 0x0, 0x10}, 0xc, &(0x7f0000000380)={&(0x7f0000000340)={0x24, r5, 0x300, 0x70bd26, 0x25dfdbfb, {}, [@MPTCP_PM_ATTR_SUBFLOWS={0x8, 0x3, 0x1}, @MPTCP_PM_ATTR_RCV_ADD_ADDRS={0x8, 0x2, 0x2}]}, 0x24}, 0x1, 0x0, 0x0, 0x20000004}, 0x8890) syz_io_uring_setup(0x20f8, &(0x7f0000000400)={0x0, 0x7677, 0x8, 0x3, 0x22f, 0x0, r4}, &(0x7f0000ffe000/0x2000)=nil, &(0x7f0000ffb000/0x2000)=nil, &(0x7f0000000480)=0x0, &(0x7f00000004c0)) r7 = openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000500)='./cgroup/syz1\x00', 0x200002, 0x0) syz_io_uring_submit(r6, r2, &(0x7f0000000580)=@IORING_OP_FILES_UPDATE={0x14, 0x4, 0x0, 0x0, 0x40, &(0x7f0000000540)=[r4, 0xffffffffffffffff, r7, r0, r1], 0x5}, 0x3) socket$inet6_tcp(0xa, 0x1, 0x0) openat$procfs(0xffffffffffffff9c, &(0x7f00000010c0)='/proc/crypto\x00', 0x0, 0x0) io_uring_setup(0x7c8f, &(0x7f0000001140)={0x0, 0xc240, 0x10, 0x3, 0x1c7, 0x0, r4}) 21:15:17 executing program 5: r0 = syz_open_dev$vcsa(&(0x7f0000000140), 0x0, 0x101000) sendmsg$NL80211_CMD_ASSOCIATE(r0, &(0x7f0000000440)={&(0x7f0000000300)={0x10, 0x0, 0x0, 0x8000000}, 0xc, &(0x7f0000000400)={&(0x7f0000000380)={0x54, 0x0, 0x4, 0x70bd2c, 0x25dfdbff, {{}, {@val={0x8}, @val={0xc, 0x99, {0x0, 0x78}}}}, [@NL80211_ATTR_SSID={0xa, 0x34, @default_ap_ssid}, @NL80211_ATTR_HT_CAPABILITY={0x1e, 0x1f, {0x300, 0x1, 0x1, 0x0, {0x6, 0x4c, 0x0, 0x4, 0x0, 0x1, 0x0, 0x1, 0x1}, 0x400, 0x2, 0x6}}]}, 0x54}}, 0x0) 21:15:17 executing program 4: keyctl$KEYCTL_PKEY_SIGN(0x1b, 0x0, 0x0, &(0x7f0000000a80)="64824bc7426fe2f3e3c1e475569073ecff8ffb96e46626b91f3b9a2b2ac07610524644af1e29c43d27e1d513a86909a6ac4d9753ce88f3f3d0beb31db8dfdbcb65379a9cc111189465a0cd8a50f7c19f1579f44a95805d41c0c92de97999b1d961ee48d58cfddc3720b2cd20", &(0x7f0000000b00)=""/109) 21:15:17 executing program 3: getresuid(&(0x7f0000000340), &(0x7f0000000380), &(0x7f00000003c0)) 21:15:17 executing program 1: r0 = io_uring_setup(0x355e, &(0x7f0000000000)={0x0, 0x7682, 0x20, 0x1, 0x1be}) syz_io_uring_setup(0x8fe, &(0x7f0000000080)={0x0, 0x1830, 0x0, 0x0, 0x1b8, 0x0, r0}, &(0x7f0000ffb000/0x2000)=nil, &(0x7f0000ffb000/0x4000)=nil, &(0x7f0000000100), &(0x7f0000000140)) r1 = openat$hwrng(0xffffffffffffff9c, &(0x7f0000000180), 0x2, 0x0) r2 = syz_io_uring_setup(0x65dd, &(0x7f00000001c0)={0x0, 0xf46f, 0x20, 0x2, 0xdf}, &(0x7f0000ffe000/0x1000)=nil, &(0x7f0000ffd000/0x1000)=nil, &(0x7f0000000240), &(0x7f0000000280)) r3 = syz_genetlink_get_family_id$mptcp(&(0x7f0000000300), r1) sendmsg$MPTCP_PM_CMD_ADD_ADDR(r1, &(0x7f00000003c0)={&(0x7f00000002c0)={0x10, 0x0, 0x0, 0x10}, 0xc, &(0x7f0000000380)={&(0x7f0000000340)={0x24, r3, 0x300, 0x70bd26, 0x25dfdbfb, {}, [@MPTCP_PM_ATTR_SUBFLOWS={0x8, 0x3, 0x1}, @MPTCP_PM_ATTR_RCV_ADD_ADDRS={0x8, 0x2, 0x2}]}, 0x24}, 0x1, 0x0, 0x0, 0x20000004}, 0x8890) syz_io_uring_setup(0x20f8, &(0x7f0000000400)={0x0, 0x7677, 0x8, 0x3, 0x22f, 0x0, r2}, &(0x7f0000ffe000/0x2000)=nil, &(0x7f0000ffb000/0x2000)=nil, &(0x7f0000000480), &(0x7f00000004c0)) openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000500)='./cgroup/syz1\x00', 0x200002, 0x0) io_uring_setup(0x2812, &(0x7f00000005c0)={0x0, 0x5e1b, 0x2, 0x3, 0x12f, 0x0, r2}) socket$inet6_tcp(0xa, 0x1, 0x0) openat$procfs(0xffffffffffffff9c, &(0x7f00000010c0)='/proc/crypto\x00', 0x0, 0x0) io_uring_setup(0x7c8f, &(0x7f0000001140)={0x0, 0xc240, 0x10, 0x3, 0x1c7, 0x0, r2}) 21:15:17 executing program 7: write$P9_RSYMLINK(0xffffffffffffffff, &(0x7f0000000000)={0x14, 0x11, 0x2, {0x40, 0x3, 0x2}}, 0x14) ioctl$sock_ifreq(0xffffffffffffffff, 0x8935, &(0x7f0000000040)={'lo\x00', @ifru_addrs=@ethernet}) ioctl$sock_ifreq(0xffffffffffffffff, 0x8994, &(0x7f0000000080)={'ip6gretap0\x00', @ifru_flags}) sendmsg$IPSET_CMD_FLUSH(0xffffffffffffffff, &(0x7f0000000180)={&(0x7f00000000c0)={0x10, 0x0, 0x0, 0x10000}, 0xc, &(0x7f0000000140)={&(0x7f0000000100)={0x3c, 0x4, 0x6, 0x801, 0x0, 0x0, {0x3, 0x0, 0x4}, [@IPSET_ATTR_PROTOCOL={0x5}, @IPSET_ATTR_SETNAME={0x9, 0x2, 'syz0\x00'}, @IPSET_ATTR_SETNAME={0x9, 0x2, 'syz2\x00'}, @IPSET_ATTR_PROTOCOL={0x5}]}, 0x3c}}, 0x20000000) write$P9_RVERSION(0xffffffffffffffff, &(0x7f00000001c0)={0x13, 0x65, 0xffff, 0x3, 0x6, '9P2000'}, 0x13) pipe2$9p(&(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}, 0x0) write$P9_RSYMLINK(r0, &(0x7f0000000240)={0x14, 0x11, 0x1, {0x1, 0x3, 0x2}}, 0x14) add_key$fscrypt_v1(&(0x7f0000000280), &(0x7f00000002c0)={'fscrypt:', @desc2}, &(0x7f0000000300)={0x0, "ccf022eeb1aa5b4a9067674b5b7079352411c35248e190415959cbe4b7be99236abd831288583a8ed4db4b7b3f838c24d293f908bf3509b49f2c17852201f646", 0x19}, 0x48, 0xfffffffffffffffa) add_key$fscrypt_v1(&(0x7f0000000380), &(0x7f00000003c0)={'fscrypt:', @auto=[0x38, 0x65, 0x62, 0x61, 0x61, 0x62, 0x61, 0x64, 0x37, 0x32, 0x30, 0x61, 0x61, 0x50, 0x62, 0x62]}, &(0x7f0000000400)={0x0, "4916f745ecf1627b46363a6005d9ff599dde016c8b8d9d347624fd26c6e8bdbb7555714d1669e0e45bd9e03a462b54b255d728a05790d4698c32583ade59ecd8", 0x36}, 0x48, 0x0) openat$vcsa(0xffffffffffffff9c, &(0x7f00000009c0), 0x14200, 0x0) syz_genetlink_get_family_id$mptcp(&(0x7f0000000a80), 0xffffffffffffffff) 21:15:17 executing program 2: ioctl$SCSI_IOCTL_DOORUNLOCK(0xffffffffffffffff, 0x5381) r0 = syz_open_dev$mouse(&(0x7f0000000000), 0x578, 0x4000) ioctl$SG_GET_PACK_ID(r0, 0x227c, &(0x7f0000000040)) r1 = syz_genetlink_get_family_id$nl80211(&(0x7f00000000c0), r0) sendmsg$NL80211_CMD_NEW_KEY(r0, &(0x7f00000001c0)={&(0x7f0000000080)={0x10, 0x0, 0x0, 0x10}, 0xc, &(0x7f0000000180)={&(0x7f0000000100)={0x60, r1, 0x400, 0x70bd2b, 0x25dfdbff, {{}, {@val={0x8}, @void}}, [@NL80211_ATTR_KEY_TYPE={0x8, 0x37, 0x1}, @NL80211_ATTR_KEY_DEFAULT_MGMT={0x4}, @NL80211_ATTR_KEY={0x2c, 0x50, 0x0, 0x1, [@NL80211_KEY_DATA_WEP40={0x9, 0x1, "93f3c5ad5d"}, @NL80211_KEY_DEFAULT_TYPES={0x8, 0x8, 0x0, 0x1, [@NL80211_KEY_DEFAULT_TYPE_MULTICAST={0x4}]}, @NL80211_KEY_DATA_WEP104={0x11, 0x1, "8815558ac60368b42ebdf03bdb"}]}, @NL80211_ATTR_KEY_DATA_WEP40={0x9, 0x7, "74de692476"}]}, 0x60}, 0x1, 0x0, 0x0, 0x4000000}, 0x8000) r2 = openat$procfs(0xffffffffffffff9c, &(0x7f0000000200)='/proc/stat\x00', 0x0, 0x0) ioctl$SG_GET_TIMEOUT(r2, 0x2202, 0x0) syz_open_dev$vcsa(&(0x7f0000000440), 0x56, 0x4000) socketpair(0x0, 0x3, 0x6, &(0x7f0000000640)) r3 = openat$tcp_congestion(0xffffffffffffff9c, &(0x7f0000000800), 0x1, 0x0) write$tcp_congestion(r3, &(0x7f0000000840)='htcp\x00', 0x5) 21:15:17 executing program 0: openat$tun(0xffffffffffffff9c, 0x0, 0x521000, 0x0) getresuid(&(0x7f0000000340), &(0x7f0000000380), &(0x7f00000003c0)) 21:15:17 executing program 0: openat$tun(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) getresuid(&(0x7f0000000340), &(0x7f0000000380), &(0x7f00000003c0)) 21:15:17 executing program 4: keyctl$KEYCTL_PKEY_SIGN(0x1b, &(0x7f00000009c0)={0x0, 0x0, 0x6d}, 0x0, 0x0, &(0x7f0000000b00)=""/109) 21:15:17 executing program 3: getresuid(0x0, &(0x7f0000000380), &(0x7f00000003c0)) 21:15:17 executing program 5: r0 = syz_open_dev$vcsa(&(0x7f0000000140), 0x0, 0x101000) sendmsg$NL80211_CMD_ASSOCIATE(r0, &(0x7f0000000440)={&(0x7f0000000300)={0x10, 0x0, 0x0, 0x8000000}, 0xc, &(0x7f0000000400)={&(0x7f0000000380)={0x54, 0x0, 0x4, 0x70bd2c, 0x25dfdbff, {{}, {@val={0x8}, @val={0xc, 0x99, {0x0, 0x78}}}}, [@NL80211_ATTR_SSID={0xa, 0x34, @default_ap_ssid}, @NL80211_ATTR_HT_CAPABILITY={0x1e, 0x1f, {0x300, 0x1, 0x1, 0x0, {0x6, 0x4c, 0x0, 0x4, 0x0, 0x1, 0x0, 0x1, 0x1}, 0x400, 0x2, 0x6}}]}, 0x54}}, 0x0) 21:15:17 executing program 7: write$P9_RSYMLINK(0xffffffffffffffff, &(0x7f0000000000)={0x14, 0x11, 0x2, {0x40, 0x3, 0x2}}, 0x14) ioctl$sock_ifreq(0xffffffffffffffff, 0x8935, &(0x7f0000000040)={'lo\x00', @ifru_addrs=@ethernet}) ioctl$sock_ifreq(0xffffffffffffffff, 0x8994, &(0x7f0000000080)={'ip6gretap0\x00', @ifru_flags}) sendmsg$IPSET_CMD_FLUSH(0xffffffffffffffff, &(0x7f0000000180)={&(0x7f00000000c0)={0x10, 0x0, 0x0, 0x10000}, 0xc, &(0x7f0000000140)={&(0x7f0000000100)={0x3c, 0x4, 0x6, 0x801, 0x0, 0x0, {0x3, 0x0, 0x4}, [@IPSET_ATTR_PROTOCOL={0x5}, @IPSET_ATTR_SETNAME={0x9, 0x2, 'syz0\x00'}, @IPSET_ATTR_SETNAME={0x9, 0x2, 'syz2\x00'}, @IPSET_ATTR_PROTOCOL={0x5}]}, 0x3c}}, 0x20000000) write$P9_RVERSION(0xffffffffffffffff, &(0x7f00000001c0)={0x13, 0x65, 0xffff, 0x3, 0x6, '9P2000'}, 0x13) pipe2$9p(&(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}, 0x0) write$P9_RSYMLINK(r0, &(0x7f0000000240)={0x14, 0x11, 0x1, {0x1, 0x3, 0x2}}, 0x14) add_key$fscrypt_v1(&(0x7f0000000280), &(0x7f00000002c0)={'fscrypt:', @desc2}, &(0x7f0000000300)={0x0, "ccf022eeb1aa5b4a9067674b5b7079352411c35248e190415959cbe4b7be99236abd831288583a8ed4db4b7b3f838c24d293f908bf3509b49f2c17852201f646", 0x19}, 0x48, 0xfffffffffffffffa) add_key$fscrypt_v1(&(0x7f0000000380), &(0x7f00000003c0)={'fscrypt:', @auto=[0x38, 0x65, 0x62, 0x61, 0x61, 0x62, 0x61, 0x64, 0x37, 0x32, 0x30, 0x61, 0x61, 0x50, 0x62, 0x62]}, &(0x7f0000000400)={0x0, "4916f745ecf1627b46363a6005d9ff599dde016c8b8d9d347624fd26c6e8bdbb7555714d1669e0e45bd9e03a462b54b255d728a05790d4698c32583ade59ecd8", 0x36}, 0x48, 0x0) openat$vcsa(0xffffffffffffff9c, &(0x7f00000009c0), 0x14200, 0x0) syz_genetlink_get_family_id$mptcp(&(0x7f0000000a80), 0xffffffffffffffff) 21:15:17 executing program 2: ioctl$SCSI_IOCTL_DOORUNLOCK(0xffffffffffffffff, 0x5381) r0 = syz_open_dev$mouse(&(0x7f0000000000), 0x578, 0x4000) ioctl$SG_GET_PACK_ID(r0, 0x227c, &(0x7f0000000040)) r1 = syz_genetlink_get_family_id$nl80211(&(0x7f00000000c0), r0) sendmsg$NL80211_CMD_NEW_KEY(r0, &(0x7f00000001c0)={&(0x7f0000000080)={0x10, 0x0, 0x0, 0x10}, 0xc, &(0x7f0000000180)={&(0x7f0000000100)={0x60, r1, 0x400, 0x70bd2b, 0x25dfdbff, {{}, {@val={0x8}, @void}}, [@NL80211_ATTR_KEY_TYPE={0x8, 0x37, 0x1}, @NL80211_ATTR_KEY_DEFAULT_MGMT={0x4}, @NL80211_ATTR_KEY={0x2c, 0x50, 0x0, 0x1, [@NL80211_KEY_DATA_WEP40={0x9, 0x1, "93f3c5ad5d"}, @NL80211_KEY_DEFAULT_TYPES={0x8, 0x8, 0x0, 0x1, [@NL80211_KEY_DEFAULT_TYPE_MULTICAST={0x4}]}, @NL80211_KEY_DATA_WEP104={0x11, 0x1, "8815558ac60368b42ebdf03bdb"}]}, @NL80211_ATTR_KEY_DATA_WEP40={0x9, 0x7, "74de692476"}]}, 0x60}, 0x1, 0x0, 0x0, 0x4000000}, 0x8000) openat$procfs(0xffffffffffffff9c, &(0x7f0000000200)='/proc/stat\x00', 0x0, 0x0) syz_open_dev$vcsa(&(0x7f0000000440), 0x56, 0x4000) socketpair(0x0, 0x3, 0x6, &(0x7f0000000640)) r2 = openat$tcp_congestion(0xffffffffffffff9c, &(0x7f0000000800), 0x1, 0x0) write$tcp_congestion(r2, &(0x7f0000000840)='htcp\x00', 0x5) 21:15:17 executing program 0: openat$tun(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) getresuid(0x0, &(0x7f0000000380), &(0x7f00000003c0)) 21:15:17 executing program 3: getresuid(0x0, &(0x7f0000000380), &(0x7f00000003c0)) 21:15:28 executing program 4: keyctl$KEYCTL_PKEY_SIGN(0x1b, &(0x7f00000009c0), 0x0, 0x0, 0x0) 21:15:28 executing program 2: ioctl$SCSI_IOCTL_DOORUNLOCK(0xffffffffffffffff, 0x5381) r0 = syz_open_dev$mouse(&(0x7f0000000000), 0x578, 0x4000) ioctl$SG_GET_PACK_ID(r0, 0x227c, &(0x7f0000000040)) r1 = syz_genetlink_get_family_id$nl80211(&(0x7f00000000c0), r0) sendmsg$NL80211_CMD_NEW_KEY(r0, &(0x7f00000001c0)={&(0x7f0000000080)={0x10, 0x0, 0x0, 0x10}, 0xc, &(0x7f0000000180)={&(0x7f0000000100)={0x60, r1, 0x400, 0x70bd2b, 0x25dfdbff, {{}, {@val={0x8}, @void}}, [@NL80211_ATTR_KEY_TYPE={0x8, 0x37, 0x1}, @NL80211_ATTR_KEY_DEFAULT_MGMT={0x4}, @NL80211_ATTR_KEY={0x2c, 0x50, 0x0, 0x1, [@NL80211_KEY_DATA_WEP40={0x9, 0x1, "93f3c5ad5d"}, @NL80211_KEY_DEFAULT_TYPES={0x8, 0x8, 0x0, 0x1, [@NL80211_KEY_DEFAULT_TYPE_MULTICAST={0x4}]}, @NL80211_KEY_DATA_WEP104={0x11, 0x1, "8815558ac60368b42ebdf03bdb"}]}, @NL80211_ATTR_KEY_DATA_WEP40={0x9, 0x7, "74de692476"}]}, 0x60}, 0x1, 0x0, 0x0, 0x4000000}, 0x8000) syz_open_dev$vcsa(&(0x7f0000000440), 0x56, 0x4000) socketpair(0x0, 0x3, 0x6, &(0x7f0000000640)) r2 = openat$tcp_congestion(0xffffffffffffff9c, &(0x7f0000000800), 0x1, 0x0) write$tcp_congestion(r2, &(0x7f0000000840)='htcp\x00', 0x5) 21:15:28 executing program 5: r0 = syz_open_dev$vcsa(&(0x7f0000000140), 0x0, 0x101000) sendmsg$NL80211_CMD_ASSOCIATE(r0, &(0x7f0000000440)={&(0x7f0000000300)={0x10, 0x0, 0x0, 0x8000000}, 0xc, &(0x7f0000000400)={&(0x7f0000000380)={0x54, 0x0, 0x4, 0x70bd2c, 0x25dfdbff, {{}, {@val={0x8}, @val={0xc, 0x99, {0x0, 0x78}}}}, [@NL80211_ATTR_SSID={0xa, 0x34, @default_ap_ssid}, @NL80211_ATTR_HT_CAPABILITY={0x1e, 0x1f, {0x300, 0x1, 0x1, 0x0, {0x6, 0x4c, 0x0, 0x4, 0x0, 0x1, 0x0, 0x1, 0x1}, 0x400, 0x2, 0x6}}]}, 0x54}}, 0x0) 21:15:28 executing program 1: r0 = io_uring_setup(0x355e, &(0x7f0000000000)={0x0, 0x7682, 0x20, 0x1, 0x1be}) syz_io_uring_setup(0x8fe, &(0x7f0000000080)={0x0, 0x1830, 0x0, 0x0, 0x1b8, 0x0, r0}, &(0x7f0000ffb000/0x2000)=nil, &(0x7f0000ffb000/0x4000)=nil, &(0x7f0000000100), &(0x7f0000000140)) r1 = openat$hwrng(0xffffffffffffff9c, &(0x7f0000000180), 0x2, 0x0) r2 = syz_io_uring_setup(0x65dd, &(0x7f00000001c0)={0x0, 0xf46f, 0x20, 0x2, 0xdf}, &(0x7f0000ffe000/0x1000)=nil, &(0x7f0000ffd000/0x1000)=nil, &(0x7f0000000240), &(0x7f0000000280)) r3 = syz_genetlink_get_family_id$mptcp(&(0x7f0000000300), r1) sendmsg$MPTCP_PM_CMD_ADD_ADDR(r1, &(0x7f00000003c0)={&(0x7f00000002c0)={0x10, 0x0, 0x0, 0x10}, 0xc, &(0x7f0000000380)={&(0x7f0000000340)={0x24, r3, 0x300, 0x70bd26, 0x25dfdbfb, {}, [@MPTCP_PM_ATTR_SUBFLOWS={0x8, 0x3, 0x1}, @MPTCP_PM_ATTR_RCV_ADD_ADDRS={0x8, 0x2, 0x2}]}, 0x24}, 0x1, 0x0, 0x0, 0x20000004}, 0x8890) syz_io_uring_setup(0x20f8, &(0x7f0000000400)={0x0, 0x7677, 0x8, 0x3, 0x22f, 0x0, r2}, &(0x7f0000ffe000/0x2000)=nil, &(0x7f0000ffb000/0x2000)=nil, &(0x7f0000000480), &(0x7f00000004c0)) openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000500)='./cgroup/syz1\x00', 0x200002, 0x0) io_uring_setup(0x2812, &(0x7f00000005c0)={0x0, 0x5e1b, 0x2, 0x3, 0x12f, 0x0, r2}) socket$inet6_tcp(0xa, 0x1, 0x0) openat$procfs(0xffffffffffffff9c, &(0x7f00000010c0)='/proc/crypto\x00', 0x0, 0x0) io_uring_setup(0x7c8f, &(0x7f0000001140)={0x0, 0xc240, 0x10, 0x3, 0x1c7, 0x0, r2}) 21:15:28 executing program 3: getresuid(0x0, &(0x7f0000000380), &(0x7f00000003c0)) 21:15:28 executing program 0: openat$tun(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) getresuid(0x0, &(0x7f0000000380), &(0x7f00000003c0)) 21:15:28 executing program 6: r0 = io_uring_setup(0x355e, &(0x7f0000000000)={0x0, 0x7682, 0x20, 0x1, 0x1be}) r1 = syz_io_uring_setup(0x8fe, &(0x7f0000000080)={0x0, 0x1830, 0x0, 0x0, 0x1b8, 0x0, r0}, &(0x7f0000ffb000/0x2000)=nil, &(0x7f0000ffb000/0x4000)=nil, &(0x7f0000000100), &(0x7f0000000140)=0x0) r3 = openat$hwrng(0xffffffffffffff9c, &(0x7f0000000180), 0x2, 0x0) r4 = syz_io_uring_setup(0x65dd, &(0x7f00000001c0)={0x0, 0xf46f, 0x20, 0x2, 0xdf}, &(0x7f0000ffe000/0x1000)=nil, &(0x7f0000ffd000/0x1000)=nil, &(0x7f0000000240), &(0x7f0000000280)) r5 = syz_genetlink_get_family_id$mptcp(&(0x7f0000000300), r3) sendmsg$MPTCP_PM_CMD_ADD_ADDR(r3, &(0x7f00000003c0)={&(0x7f00000002c0)={0x10, 0x0, 0x0, 0x10}, 0xc, &(0x7f0000000380)={&(0x7f0000000340)={0x24, r5, 0x300, 0x70bd26, 0x25dfdbfb, {}, [@MPTCP_PM_ATTR_SUBFLOWS={0x8, 0x3, 0x1}, @MPTCP_PM_ATTR_RCV_ADD_ADDRS={0x8, 0x2, 0x2}]}, 0x24}, 0x1, 0x0, 0x0, 0x20000004}, 0x8890) syz_io_uring_setup(0x20f8, &(0x7f0000000400)={0x0, 0x7677, 0x8, 0x3, 0x22f, 0x0, r4}, &(0x7f0000ffe000/0x2000)=nil, &(0x7f0000ffb000/0x2000)=nil, &(0x7f0000000480)=0x0, &(0x7f00000004c0)) r7 = openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000500)='./cgroup/syz1\x00', 0x200002, 0x0) syz_io_uring_submit(r6, r2, &(0x7f0000000580)=@IORING_OP_FILES_UPDATE={0x14, 0x4, 0x0, 0x0, 0x40, &(0x7f0000000540)=[r4, 0xffffffffffffffff, r7, r0, r1], 0x5}, 0x3) socket$inet6_tcp(0xa, 0x1, 0x0) openat$procfs(0xffffffffffffff9c, &(0x7f00000010c0)='/proc/crypto\x00', 0x0, 0x0) io_uring_setup(0x7c8f, &(0x7f0000001140)={0x0, 0xc240, 0x10, 0x3, 0x1c7, 0x0, r4}) 21:15:28 executing program 7: write$P9_RSYMLINK(0xffffffffffffffff, &(0x7f0000000000)={0x14, 0x11, 0x2, {0x40, 0x3, 0x2}}, 0x14) ioctl$sock_ifreq(0xffffffffffffffff, 0x8935, &(0x7f0000000040)={'lo\x00', @ifru_addrs=@ethernet}) ioctl$sock_ifreq(0xffffffffffffffff, 0x8994, &(0x7f0000000080)={'ip6gretap0\x00', @ifru_flags}) sendmsg$IPSET_CMD_FLUSH(0xffffffffffffffff, &(0x7f0000000180)={&(0x7f00000000c0)={0x10, 0x0, 0x0, 0x10000}, 0xc, &(0x7f0000000140)={&(0x7f0000000100)={0x3c, 0x4, 0x6, 0x801, 0x0, 0x0, {0x3, 0x0, 0x4}, [@IPSET_ATTR_PROTOCOL={0x5}, @IPSET_ATTR_SETNAME={0x9, 0x2, 'syz0\x00'}, @IPSET_ATTR_SETNAME={0x9, 0x2, 'syz2\x00'}, @IPSET_ATTR_PROTOCOL={0x5}]}, 0x3c}}, 0x20000000) write$P9_RVERSION(0xffffffffffffffff, &(0x7f00000001c0)={0x13, 0x65, 0xffff, 0x3, 0x6, '9P2000'}, 0x13) pipe2$9p(&(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}, 0x0) write$P9_RSYMLINK(r0, &(0x7f0000000240)={0x14, 0x11, 0x1, {0x1, 0x3, 0x2}}, 0x14) add_key$fscrypt_v1(&(0x7f0000000280), &(0x7f00000002c0)={'fscrypt:', @desc2}, &(0x7f0000000300)={0x0, "ccf022eeb1aa5b4a9067674b5b7079352411c35248e190415959cbe4b7be99236abd831288583a8ed4db4b7b3f838c24d293f908bf3509b49f2c17852201f646", 0x19}, 0x48, 0xfffffffffffffffa) syz_genetlink_get_family_id$mptcp(&(0x7f00000004c0), 0xffffffffffffffff) openat$vcsa(0xffffffffffffff9c, &(0x7f00000009c0), 0x14200, 0x0) syz_genetlink_get_family_id$mptcp(&(0x7f0000000a80), 0xffffffffffffffff) 21:15:28 executing program 3: getresuid(&(0x7f0000000340), 0x0, &(0x7f00000003c0)) 21:15:28 executing program 5: r0 = syz_open_dev$vcsa(&(0x7f0000000140), 0xb6, 0x0) sendmsg$NL80211_CMD_ASSOCIATE(r0, &(0x7f0000000440)={&(0x7f0000000300)={0x10, 0x0, 0x0, 0x8000000}, 0xc, &(0x7f0000000400)={&(0x7f0000000380)={0x54, 0x0, 0x4, 0x70bd2c, 0x25dfdbff, {{}, {@val={0x8}, @val={0xc, 0x99, {0x0, 0x78}}}}, [@NL80211_ATTR_SSID={0xa, 0x34, @default_ap_ssid}, @NL80211_ATTR_HT_CAPABILITY={0x1e, 0x1f, {0x300, 0x1, 0x1, 0x0, {0x6, 0x4c, 0x0, 0x4, 0x0, 0x1, 0x0, 0x1, 0x1}, 0x400, 0x2, 0x6}}]}, 0x54}}, 0x0) 21:15:28 executing program 0: openat$tun(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) getresuid(0x0, &(0x7f0000000380), &(0x7f00000003c0)) 21:15:28 executing program 6: r0 = io_uring_setup(0x355e, &(0x7f0000000000)={0x0, 0x7682, 0x20, 0x1, 0x1be}) r1 = syz_io_uring_setup(0x8fe, &(0x7f0000000080)={0x0, 0x1830, 0x0, 0x0, 0x1b8, 0x0, r0}, &(0x7f0000ffb000/0x2000)=nil, &(0x7f0000ffb000/0x4000)=nil, &(0x7f0000000100), &(0x7f0000000140)=0x0) r3 = openat$hwrng(0xffffffffffffff9c, &(0x7f0000000180), 0x2, 0x0) r4 = syz_io_uring_setup(0x65dd, &(0x7f00000001c0)={0x0, 0xf46f, 0x20, 0x2, 0xdf}, &(0x7f0000ffe000/0x1000)=nil, &(0x7f0000ffd000/0x1000)=nil, &(0x7f0000000240), &(0x7f0000000280)) r5 = syz_genetlink_get_family_id$mptcp(&(0x7f0000000300), r3) sendmsg$MPTCP_PM_CMD_ADD_ADDR(r3, &(0x7f00000003c0)={&(0x7f00000002c0)={0x10, 0x0, 0x0, 0x10}, 0xc, &(0x7f0000000380)={&(0x7f0000000340)={0x24, r5, 0x300, 0x70bd26, 0x25dfdbfb, {}, [@MPTCP_PM_ATTR_SUBFLOWS={0x8, 0x3, 0x1}, @MPTCP_PM_ATTR_RCV_ADD_ADDRS={0x8, 0x2, 0x2}]}, 0x24}, 0x1, 0x0, 0x0, 0x20000004}, 0x8890) syz_io_uring_setup(0x20f8, &(0x7f0000000400)={0x0, 0x7677, 0x8, 0x3, 0x22f, 0x0, r4}, &(0x7f0000ffe000/0x2000)=nil, &(0x7f0000ffb000/0x2000)=nil, &(0x7f0000000480)=0x0, &(0x7f00000004c0)) r7 = openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000500)='./cgroup/syz1\x00', 0x200002, 0x0) syz_io_uring_submit(r6, r2, &(0x7f0000000580)=@IORING_OP_FILES_UPDATE={0x14, 0x4, 0x0, 0x0, 0x40, &(0x7f0000000540)=[r4, 0xffffffffffffffff, r7, r0, r1], 0x5}, 0x3) socket$inet6_tcp(0xa, 0x1, 0x0) openat$procfs(0xffffffffffffff9c, &(0x7f00000010c0)='/proc/crypto\x00', 0x0, 0x0) 21:15:28 executing program 1: r0 = io_uring_setup(0x355e, &(0x7f0000000000)={0x0, 0x7682, 0x20, 0x1, 0x1be}) syz_io_uring_setup(0x8fe, &(0x7f0000000080)={0x0, 0x1830, 0x0, 0x0, 0x1b8, 0x0, r0}, &(0x7f0000ffb000/0x2000)=nil, &(0x7f0000ffb000/0x4000)=nil, &(0x7f0000000100), &(0x7f0000000140)) r1 = openat$hwrng(0xffffffffffffff9c, &(0x7f0000000180), 0x2, 0x0) r2 = syz_io_uring_setup(0x65dd, &(0x7f00000001c0)={0x0, 0xf46f, 0x20, 0x2, 0xdf}, &(0x7f0000ffe000/0x1000)=nil, &(0x7f0000ffd000/0x1000)=nil, &(0x7f0000000240), &(0x7f0000000280)) r3 = syz_genetlink_get_family_id$mptcp(&(0x7f0000000300), r1) sendmsg$MPTCP_PM_CMD_ADD_ADDR(r1, &(0x7f00000003c0)={&(0x7f00000002c0)={0x10, 0x0, 0x0, 0x10}, 0xc, &(0x7f0000000380)={&(0x7f0000000340)={0x24, r3, 0x300, 0x70bd26, 0x25dfdbfb, {}, [@MPTCP_PM_ATTR_SUBFLOWS={0x8, 0x3, 0x1}, @MPTCP_PM_ATTR_RCV_ADD_ADDRS={0x8, 0x2, 0x2}]}, 0x24}, 0x1, 0x0, 0x0, 0x20000004}, 0x8890) syz_io_uring_setup(0x20f8, &(0x7f0000000400)={0x0, 0x7677, 0x8, 0x3, 0x22f, 0x0, r2}, &(0x7f0000ffe000/0x2000)=nil, &(0x7f0000ffb000/0x2000)=nil, &(0x7f0000000480), &(0x7f00000004c0)) openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000500)='./cgroup/syz1\x00', 0x200002, 0x0) io_uring_setup(0x2812, &(0x7f00000005c0)={0x0, 0x5e1b, 0x2, 0x3, 0x12f, 0x0, r2}) socket$inet6_tcp(0xa, 0x1, 0x0) openat$procfs(0xffffffffffffff9c, &(0x7f00000010c0)='/proc/crypto\x00', 0x0, 0x0) io_uring_setup(0x7c8f, &(0x7f0000001140)={0x0, 0xc240, 0x10, 0x3, 0x1c7, 0x0, r2}) 21:15:28 executing program 4: ioctl$SCSI_IOCTL_DOORUNLOCK(0xffffffffffffffff, 0x5381) r0 = syz_open_dev$mouse(&(0x7f0000000000), 0x578, 0x4000) ioctl$SG_GET_PACK_ID(r0, 0x227c, &(0x7f0000000040)) r1 = syz_genetlink_get_family_id$nl80211(&(0x7f00000000c0), r0) sendmsg$NL80211_CMD_NEW_KEY(r0, &(0x7f00000001c0)={&(0x7f0000000080)={0x10, 0x0, 0x0, 0x10}, 0xc, &(0x7f0000000180)={&(0x7f0000000100)={0x60, r1, 0x400, 0x70bd2b, 0x25dfdbff, {{}, {@val={0x8}, @void}}, [@NL80211_ATTR_KEY_TYPE={0x8, 0x37, 0x1}, @NL80211_ATTR_KEY_DEFAULT_MGMT={0x4}, @NL80211_ATTR_KEY={0x2c, 0x50, 0x0, 0x1, [@NL80211_KEY_DATA_WEP40={0x9, 0x1, "93f3c5ad5d"}, @NL80211_KEY_DEFAULT_TYPES={0x8, 0x8, 0x0, 0x1, [@NL80211_KEY_DEFAULT_TYPE_MULTICAST={0x4}]}, @NL80211_KEY_DATA_WEP104={0x11, 0x1, "8815558ac60368b42ebdf03bdb"}]}, @NL80211_ATTR_KEY_DATA_WEP40={0x9, 0x7, "74de692476"}]}, 0x60}, 0x1, 0x0, 0x0, 0x4000000}, 0x8000) openat$procfs(0xffffffffffffff9c, &(0x7f0000000200)='/proc/stat\x00', 0x0, 0x0) syz_open_dev$vcsa(&(0x7f0000000440), 0x56, 0x4000) socketpair(0x0, 0x3, 0x6, &(0x7f0000000640)) r2 = openat$tcp_congestion(0xffffffffffffff9c, &(0x7f0000000800), 0x1, 0x0) write$tcp_congestion(r2, &(0x7f0000000840)='htcp\x00', 0x5) 21:15:28 executing program 5: syz_open_dev$vcsa(&(0x7f0000000140), 0xb6, 0x0) sendmsg$NL80211_CMD_ASSOCIATE(0xffffffffffffffff, &(0x7f0000000440)={&(0x7f0000000300)={0x10, 0x0, 0x0, 0x8000000}, 0xc, &(0x7f0000000400)={&(0x7f0000000380)={0x54, 0x0, 0x4, 0x70bd2c, 0x25dfdbff, {{}, {@val={0x8}, @val={0xc, 0x99, {0x0, 0x78}}}}, [@NL80211_ATTR_SSID={0xa, 0x34, @default_ap_ssid}, @NL80211_ATTR_HT_CAPABILITY={0x1e, 0x1f, {0x300, 0x1, 0x1, 0x0, {0x6, 0x4c, 0x0, 0x4, 0x0, 0x1, 0x0, 0x1, 0x1}, 0x400, 0x2, 0x6}}]}, 0x54}}, 0x0) 21:15:28 executing program 3: getresuid(&(0x7f0000000340), 0x0, &(0x7f00000003c0)) 21:15:28 executing program 7: write$P9_RSYMLINK(0xffffffffffffffff, &(0x7f0000000000)={0x14, 0x11, 0x2, {0x40, 0x3, 0x2}}, 0x14) ioctl$sock_ifreq(0xffffffffffffffff, 0x8935, &(0x7f0000000040)={'lo\x00', @ifru_addrs=@ethernet}) ioctl$sock_ifreq(0xffffffffffffffff, 0x8994, &(0x7f0000000080)={'ip6gretap0\x00', @ifru_flags}) sendmsg$IPSET_CMD_FLUSH(0xffffffffffffffff, &(0x7f0000000180)={&(0x7f00000000c0)={0x10, 0x0, 0x0, 0x10000}, 0xc, &(0x7f0000000140)={&(0x7f0000000100)={0x3c, 0x4, 0x6, 0x801, 0x0, 0x0, {0x3, 0x0, 0x4}, [@IPSET_ATTR_PROTOCOL={0x5}, @IPSET_ATTR_SETNAME={0x9, 0x2, 'syz0\x00'}, @IPSET_ATTR_SETNAME={0x9, 0x2, 'syz2\x00'}, @IPSET_ATTR_PROTOCOL={0x5}]}, 0x3c}}, 0x20000000) write$P9_RVERSION(0xffffffffffffffff, &(0x7f00000001c0)={0x13, 0x65, 0xffff, 0x3, 0x6, '9P2000'}, 0x13) pipe2$9p(&(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}, 0x0) write$P9_RSYMLINK(r0, &(0x7f0000000240)={0x14, 0x11, 0x1, {0x1, 0x3, 0x2}}, 0x14) add_key$fscrypt_v1(&(0x7f0000000280), &(0x7f00000002c0)={'fscrypt:', @desc2}, &(0x7f0000000300)={0x0, "ccf022eeb1aa5b4a9067674b5b7079352411c35248e190415959cbe4b7be99236abd831288583a8ed4db4b7b3f838c24d293f908bf3509b49f2c17852201f646", 0x19}, 0x48, 0xfffffffffffffffa) syz_genetlink_get_family_id$mptcp(&(0x7f00000004c0), 0xffffffffffffffff) openat$vcsa(0xffffffffffffff9c, &(0x7f00000009c0), 0x14200, 0x0) syz_genetlink_get_family_id$mptcp(&(0x7f0000000a80), 0xffffffffffffffff) 21:15:28 executing program 0: openat$tun(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) getresuid(&(0x7f0000000340), 0x0, &(0x7f00000003c0)) 21:15:28 executing program 1: r0 = io_uring_setup(0x355e, &(0x7f0000000000)={0x0, 0x7682, 0x20, 0x1, 0x1be}) r1 = syz_io_uring_setup(0x8fe, &(0x7f0000000080)={0x0, 0x1830, 0x0, 0x0, 0x1b8, 0x0, r0}, &(0x7f0000ffb000/0x2000)=nil, &(0x7f0000ffb000/0x4000)=nil, &(0x7f0000000100), &(0x7f0000000140)=0x0) r3 = openat$hwrng(0xffffffffffffff9c, &(0x7f0000000180), 0x2, 0x0) r4 = syz_io_uring_setup(0x65dd, &(0x7f00000001c0)={0x0, 0xf46f, 0x20, 0x2, 0xdf}, &(0x7f0000ffe000/0x1000)=nil, &(0x7f0000ffd000/0x1000)=nil, &(0x7f0000000240), &(0x7f0000000280)) r5 = syz_genetlink_get_family_id$mptcp(&(0x7f0000000300), r3) sendmsg$MPTCP_PM_CMD_ADD_ADDR(r3, &(0x7f00000003c0)={&(0x7f00000002c0)={0x10, 0x0, 0x0, 0x10}, 0xc, &(0x7f0000000380)={&(0x7f0000000340)={0x24, r5, 0x300, 0x70bd26, 0x25dfdbfb, {}, [@MPTCP_PM_ATTR_SUBFLOWS={0x8, 0x3, 0x1}, @MPTCP_PM_ATTR_RCV_ADD_ADDRS={0x8, 0x2, 0x2}]}, 0x24}, 0x1, 0x0, 0x0, 0x20000004}, 0x8890) syz_io_uring_setup(0x20f8, &(0x7f0000000400)={0x0, 0x7677, 0x8, 0x3, 0x22f, 0x0, r4}, &(0x7f0000ffe000/0x2000)=nil, &(0x7f0000ffb000/0x2000)=nil, &(0x7f0000000480)=0x0, &(0x7f00000004c0)) syz_io_uring_submit(r6, r2, &(0x7f0000000580)=@IORING_OP_FILES_UPDATE={0x14, 0x4, 0x0, 0x0, 0x40, &(0x7f0000000540)=[r4, 0xffffffffffffffff, 0xffffffffffffffff, r0, r1], 0x5}, 0x3) io_uring_setup(0x2812, &(0x7f00000005c0)={0x0, 0x5e1b, 0x2, 0x3, 0x12f, 0x0, r4}) socket$inet6_tcp(0xa, 0x1, 0x0) openat$procfs(0xffffffffffffff9c, &(0x7f00000010c0)='/proc/crypto\x00', 0x0, 0x0) io_uring_setup(0x7c8f, &(0x7f0000001140)={0x0, 0xc240, 0x10, 0x3, 0x1c7, 0x0, r4}) 21:15:28 executing program 2: ioctl$SCSI_IOCTL_DOORUNLOCK(0xffffffffffffffff, 0x5381) r0 = syz_open_dev$mouse(&(0x7f0000000000), 0x578, 0x4000) ioctl$SG_GET_PACK_ID(r0, 0x227c, &(0x7f0000000040)) syz_genetlink_get_family_id$nl80211(&(0x7f00000000c0), r0) syz_open_dev$vcsa(&(0x7f0000000440), 0x56, 0x4000) socketpair(0x0, 0x3, 0x6, &(0x7f0000000640)) r1 = openat$tcp_congestion(0xffffffffffffff9c, &(0x7f0000000800), 0x1, 0x0) write$tcp_congestion(r1, &(0x7f0000000840)='htcp\x00', 0x5) 21:15:38 executing program 6: r0 = io_uring_setup(0x355e, &(0x7f0000000000)={0x0, 0x7682, 0x20, 0x1, 0x1be}) r1 = syz_io_uring_setup(0x8fe, &(0x7f0000000080)={0x0, 0x1830, 0x0, 0x0, 0x1b8, 0x0, r0}, &(0x7f0000ffb000/0x2000)=nil, &(0x7f0000ffb000/0x4000)=nil, &(0x7f0000000100), &(0x7f0000000140)=0x0) r3 = openat$hwrng(0xffffffffffffff9c, &(0x7f0000000180), 0x2, 0x0) r4 = syz_io_uring_setup(0x65dd, &(0x7f00000001c0)={0x0, 0xf46f, 0x20, 0x2, 0xdf}, &(0x7f0000ffe000/0x1000)=nil, &(0x7f0000ffd000/0x1000)=nil, &(0x7f0000000240), &(0x7f0000000280)) r5 = syz_genetlink_get_family_id$mptcp(&(0x7f0000000300), r3) sendmsg$MPTCP_PM_CMD_ADD_ADDR(r3, &(0x7f00000003c0)={&(0x7f00000002c0)={0x10, 0x0, 0x0, 0x10}, 0xc, &(0x7f0000000380)={&(0x7f0000000340)={0x24, r5, 0x300, 0x70bd26, 0x25dfdbfb, {}, [@MPTCP_PM_ATTR_SUBFLOWS={0x8, 0x3, 0x1}, @MPTCP_PM_ATTR_RCV_ADD_ADDRS={0x8, 0x2, 0x2}]}, 0x24}, 0x1, 0x0, 0x0, 0x20000004}, 0x8890) syz_io_uring_setup(0x20f8, &(0x7f0000000400)={0x0, 0x7677, 0x8, 0x3, 0x22f, 0x0, r4}, &(0x7f0000ffe000/0x2000)=nil, &(0x7f0000ffb000/0x2000)=nil, &(0x7f0000000480)=0x0, &(0x7f00000004c0)) r7 = openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000500)='./cgroup/syz1\x00', 0x200002, 0x0) syz_io_uring_submit(r6, r2, &(0x7f0000000580)=@IORING_OP_FILES_UPDATE={0x14, 0x4, 0x0, 0x0, 0x40, &(0x7f0000000540)=[r4, 0xffffffffffffffff, r7, r0, r1], 0x5}, 0x3) socket$inet6_tcp(0xa, 0x1, 0x0) openat$procfs(0xffffffffffffff9c, &(0x7f00000010c0)='/proc/crypto\x00', 0x0, 0x0) 21:15:38 executing program 2: ioctl$SCSI_IOCTL_DOORUNLOCK(0xffffffffffffffff, 0x5381) r0 = syz_open_dev$mouse(&(0x7f0000000000), 0x578, 0x4000) ioctl$SG_GET_PACK_ID(r0, 0x227c, &(0x7f0000000040)) syz_open_dev$vcsa(&(0x7f0000000440), 0x56, 0x4000) socketpair(0x0, 0x3, 0x6, &(0x7f0000000640)) r1 = openat$tcp_congestion(0xffffffffffffff9c, &(0x7f0000000800), 0x1, 0x0) write$tcp_congestion(r1, &(0x7f0000000840)='htcp\x00', 0x5) 21:15:38 executing program 5: syz_open_dev$vcsa(&(0x7f0000000140), 0xb6, 0x0) sendmsg$NL80211_CMD_ASSOCIATE(0xffffffffffffffff, &(0x7f0000000440)={&(0x7f0000000300)={0x10, 0x0, 0x0, 0x8000000}, 0xc, &(0x7f0000000400)={&(0x7f0000000380)={0x54, 0x0, 0x4, 0x70bd2c, 0x25dfdbff, {{}, {@val={0x8}, @val={0xc, 0x99, {0x0, 0x78}}}}, [@NL80211_ATTR_SSID={0xa, 0x34, @default_ap_ssid}, @NL80211_ATTR_HT_CAPABILITY={0x1e, 0x1f, {0x300, 0x1, 0x1, 0x0, {0x6, 0x4c, 0x0, 0x4, 0x0, 0x1, 0x0, 0x1, 0x1}, 0x400, 0x2, 0x6}}]}, 0x54}}, 0x0) 21:15:38 executing program 7: write$P9_RSYMLINK(0xffffffffffffffff, &(0x7f0000000000)={0x14, 0x11, 0x2, {0x40, 0x3, 0x2}}, 0x14) ioctl$sock_ifreq(0xffffffffffffffff, 0x8935, &(0x7f0000000040)={'lo\x00', @ifru_addrs=@ethernet}) ioctl$sock_ifreq(0xffffffffffffffff, 0x8994, &(0x7f0000000080)={'ip6gretap0\x00', @ifru_flags}) sendmsg$IPSET_CMD_FLUSH(0xffffffffffffffff, &(0x7f0000000180)={&(0x7f00000000c0)={0x10, 0x0, 0x0, 0x10000}, 0xc, &(0x7f0000000140)={&(0x7f0000000100)={0x3c, 0x4, 0x6, 0x801, 0x0, 0x0, {0x3, 0x0, 0x4}, [@IPSET_ATTR_PROTOCOL={0x5}, @IPSET_ATTR_SETNAME={0x9, 0x2, 'syz0\x00'}, @IPSET_ATTR_SETNAME={0x9, 0x2, 'syz2\x00'}, @IPSET_ATTR_PROTOCOL={0x5}]}, 0x3c}}, 0x20000000) write$P9_RVERSION(0xffffffffffffffff, &(0x7f00000001c0)={0x13, 0x65, 0xffff, 0x3, 0x6, '9P2000'}, 0x13) pipe2$9p(&(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}, 0x0) write$P9_RSYMLINK(r0, &(0x7f0000000240)={0x14, 0x11, 0x1, {0x1, 0x3, 0x2}}, 0x14) syz_genetlink_get_family_id$mptcp(&(0x7f00000004c0), 0xffffffffffffffff) openat$vcsa(0xffffffffffffff9c, &(0x7f00000009c0), 0x14200, 0x0) syz_genetlink_get_family_id$mptcp(&(0x7f0000000a80), 0xffffffffffffffff) 21:15:38 executing program 1: r0 = io_uring_setup(0x355e, &(0x7f0000000000)={0x0, 0x7682, 0x20, 0x1, 0x1be}) r1 = syz_io_uring_setup(0x8fe, &(0x7f0000000080)={0x0, 0x1830, 0x0, 0x0, 0x1b8, 0x0, r0}, &(0x7f0000ffb000/0x2000)=nil, &(0x7f0000ffb000/0x4000)=nil, &(0x7f0000000100), &(0x7f0000000140)=0x0) r3 = openat$hwrng(0xffffffffffffff9c, &(0x7f0000000180), 0x2, 0x0) r4 = syz_io_uring_setup(0x65dd, &(0x7f00000001c0)={0x0, 0xf46f, 0x20, 0x2, 0xdf}, &(0x7f0000ffe000/0x1000)=nil, &(0x7f0000ffd000/0x1000)=nil, &(0x7f0000000240), &(0x7f0000000280)) r5 = syz_genetlink_get_family_id$mptcp(&(0x7f0000000300), r3) sendmsg$MPTCP_PM_CMD_ADD_ADDR(r3, &(0x7f00000003c0)={&(0x7f00000002c0)={0x10, 0x0, 0x0, 0x10}, 0xc, &(0x7f0000000380)={&(0x7f0000000340)={0x24, r5, 0x300, 0x70bd26, 0x25dfdbfb, {}, [@MPTCP_PM_ATTR_SUBFLOWS={0x8, 0x3, 0x1}, @MPTCP_PM_ATTR_RCV_ADD_ADDRS={0x8, 0x2, 0x2}]}, 0x24}, 0x1, 0x0, 0x0, 0x20000004}, 0x8890) syz_io_uring_setup(0x20f8, &(0x7f0000000400)={0x0, 0x7677, 0x8, 0x3, 0x22f, 0x0, r4}, &(0x7f0000ffe000/0x2000)=nil, &(0x7f0000ffb000/0x2000)=nil, &(0x7f0000000480)=0x0, &(0x7f00000004c0)) syz_io_uring_submit(r6, r2, &(0x7f0000000580)=@IORING_OP_FILES_UPDATE={0x14, 0x4, 0x0, 0x0, 0x40, &(0x7f0000000540)=[r4, 0xffffffffffffffff, 0xffffffffffffffff, r0, r1], 0x5}, 0x3) io_uring_setup(0x2812, &(0x7f00000005c0)={0x0, 0x5e1b, 0x2, 0x3, 0x12f, 0x0, r4}) socket$inet6_tcp(0xa, 0x1, 0x0) openat$procfs(0xffffffffffffff9c, &(0x7f00000010c0)='/proc/crypto\x00', 0x0, 0x0) io_uring_setup(0x7c8f, &(0x7f0000001140)={0x0, 0xc240, 0x10, 0x3, 0x1c7, 0x0, r4}) 21:15:38 executing program 4: ioctl$SCSI_IOCTL_DOORUNLOCK(0xffffffffffffffff, 0x5381) r0 = syz_open_dev$mouse(&(0x7f0000000000), 0x578, 0x4000) ioctl$SG_GET_PACK_ID(r0, 0x227c, &(0x7f0000000040)) r1 = syz_genetlink_get_family_id$nl80211(&(0x7f00000000c0), r0) sendmsg$NL80211_CMD_NEW_KEY(r0, &(0x7f00000001c0)={&(0x7f0000000080)={0x10, 0x0, 0x0, 0x10}, 0xc, &(0x7f0000000180)={&(0x7f0000000100)={0x60, r1, 0x400, 0x70bd2b, 0x25dfdbff, {{}, {@val={0x8}, @void}}, [@NL80211_ATTR_KEY_TYPE={0x8, 0x37, 0x1}, @NL80211_ATTR_KEY_DEFAULT_MGMT={0x4}, @NL80211_ATTR_KEY={0x2c, 0x50, 0x0, 0x1, [@NL80211_KEY_DATA_WEP40={0x9, 0x1, "93f3c5ad5d"}, @NL80211_KEY_DEFAULT_TYPES={0x8, 0x8, 0x0, 0x1, [@NL80211_KEY_DEFAULT_TYPE_MULTICAST={0x4}]}, @NL80211_KEY_DATA_WEP104={0x11, 0x1, "8815558ac60368b42ebdf03bdb"}]}, @NL80211_ATTR_KEY_DATA_WEP40={0x9, 0x7, "74de692476"}]}, 0x60}, 0x1, 0x0, 0x0, 0x4000000}, 0x8000) openat$procfs(0xffffffffffffff9c, &(0x7f0000000200)='/proc/stat\x00', 0x0, 0x0) syz_open_dev$vcsa(&(0x7f0000000440), 0x56, 0x4000) socketpair(0x0, 0x3, 0x6, &(0x7f0000000640)) r2 = openat$tcp_congestion(0xffffffffffffff9c, &(0x7f0000000800), 0x1, 0x0) write$tcp_congestion(r2, &(0x7f0000000840)='htcp\x00', 0x5) 21:15:38 executing program 0: openat$tun(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) getresuid(&(0x7f0000000340), 0x0, &(0x7f00000003c0)) 21:15:38 executing program 3: getresuid(&(0x7f0000000340), 0x0, &(0x7f00000003c0)) 21:15:38 executing program 5: syz_open_dev$vcsa(&(0x7f0000000140), 0xb6, 0x0) sendmsg$NL80211_CMD_ASSOCIATE(0xffffffffffffffff, &(0x7f0000000440)={&(0x7f0000000300)={0x10, 0x0, 0x0, 0x8000000}, 0xc, &(0x7f0000000400)={&(0x7f0000000380)={0x54, 0x0, 0x4, 0x70bd2c, 0x25dfdbff, {{}, {@val={0x8}, @val={0xc, 0x99, {0x0, 0x78}}}}, [@NL80211_ATTR_SSID={0xa, 0x34, @default_ap_ssid}, @NL80211_ATTR_HT_CAPABILITY={0x1e, 0x1f, {0x300, 0x1, 0x1, 0x0, {0x6, 0x4c, 0x0, 0x4, 0x0, 0x1, 0x0, 0x1, 0x1}, 0x400, 0x2, 0x6}}]}, 0x54}}, 0x0) 21:15:38 executing program 5: r0 = syz_open_dev$vcsa(&(0x7f0000000140), 0xb6, 0x0) sendmsg$NL80211_CMD_ASSOCIATE(r0, 0x0, 0x0) 21:15:46 executing program 3: getresuid(&(0x7f0000000340), &(0x7f0000000380), 0x0) 21:15:46 executing program 2: ioctl$SCSI_IOCTL_DOORUNLOCK(0xffffffffffffffff, 0x5381) r0 = syz_open_dev$mouse(&(0x7f0000000000), 0x578, 0x4000) ioctl$SG_GET_PACK_ID(r0, 0x227c, &(0x7f0000000040)) syz_open_dev$vcsa(&(0x7f0000000440), 0x56, 0x4000) socketpair(0x0, 0x3, 0x6, &(0x7f0000000640)) r1 = openat$tcp_congestion(0xffffffffffffff9c, &(0x7f0000000800), 0x1, 0x0) write$tcp_congestion(r1, &(0x7f0000000840)='htcp\x00', 0x5) 21:15:46 executing program 6: r0 = io_uring_setup(0x355e, &(0x7f0000000000)={0x0, 0x7682, 0x20, 0x1, 0x1be}) r1 = syz_io_uring_setup(0x8fe, &(0x7f0000000080)={0x0, 0x1830, 0x0, 0x0, 0x1b8, 0x0, r0}, &(0x7f0000ffb000/0x2000)=nil, &(0x7f0000ffb000/0x4000)=nil, &(0x7f0000000100), &(0x7f0000000140)=0x0) r3 = openat$hwrng(0xffffffffffffff9c, &(0x7f0000000180), 0x2, 0x0) r4 = syz_io_uring_setup(0x65dd, &(0x7f00000001c0)={0x0, 0xf46f, 0x20, 0x2, 0xdf}, &(0x7f0000ffe000/0x1000)=nil, &(0x7f0000ffd000/0x1000)=nil, &(0x7f0000000240), &(0x7f0000000280)) r5 = syz_genetlink_get_family_id$mptcp(&(0x7f0000000300), r3) sendmsg$MPTCP_PM_CMD_ADD_ADDR(r3, &(0x7f00000003c0)={&(0x7f00000002c0)={0x10, 0x0, 0x0, 0x10}, 0xc, &(0x7f0000000380)={&(0x7f0000000340)={0x24, r5, 0x300, 0x70bd26, 0x25dfdbfb, {}, [@MPTCP_PM_ATTR_SUBFLOWS={0x8, 0x3, 0x1}, @MPTCP_PM_ATTR_RCV_ADD_ADDRS={0x8, 0x2, 0x2}]}, 0x24}, 0x1, 0x0, 0x0, 0x20000004}, 0x8890) syz_io_uring_setup(0x20f8, &(0x7f0000000400)={0x0, 0x7677, 0x8, 0x3, 0x22f, 0x0, r4}, &(0x7f0000ffe000/0x2000)=nil, &(0x7f0000ffb000/0x2000)=nil, &(0x7f0000000480)=0x0, &(0x7f00000004c0)) r7 = openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000500)='./cgroup/syz1\x00', 0x200002, 0x0) syz_io_uring_submit(r6, r2, &(0x7f0000000580)=@IORING_OP_FILES_UPDATE={0x14, 0x4, 0x0, 0x0, 0x40, &(0x7f0000000540)=[r4, 0xffffffffffffffff, r7, r0, r1], 0x5}, 0x3) socket$inet6_tcp(0xa, 0x1, 0x0) openat$procfs(0xffffffffffffff9c, &(0x7f00000010c0)='/proc/crypto\x00', 0x0, 0x0) 21:15:46 executing program 1: r0 = io_uring_setup(0x355e, &(0x7f0000000000)={0x0, 0x7682, 0x20, 0x1, 0x1be}) r1 = syz_io_uring_setup(0x8fe, &(0x7f0000000080)={0x0, 0x1830, 0x0, 0x0, 0x1b8, 0x0, r0}, &(0x7f0000ffb000/0x2000)=nil, &(0x7f0000ffb000/0x4000)=nil, &(0x7f0000000100), &(0x7f0000000140)=0x0) r3 = openat$hwrng(0xffffffffffffff9c, &(0x7f0000000180), 0x2, 0x0) r4 = syz_io_uring_setup(0x65dd, &(0x7f00000001c0)={0x0, 0xf46f, 0x20, 0x2, 0xdf}, &(0x7f0000ffe000/0x1000)=nil, &(0x7f0000ffd000/0x1000)=nil, &(0x7f0000000240), &(0x7f0000000280)) r5 = syz_genetlink_get_family_id$mptcp(&(0x7f0000000300), r3) sendmsg$MPTCP_PM_CMD_ADD_ADDR(r3, &(0x7f00000003c0)={&(0x7f00000002c0)={0x10, 0x0, 0x0, 0x10}, 0xc, &(0x7f0000000380)={&(0x7f0000000340)={0x24, r5, 0x300, 0x70bd26, 0x25dfdbfb, {}, [@MPTCP_PM_ATTR_SUBFLOWS={0x8, 0x3, 0x1}, @MPTCP_PM_ATTR_RCV_ADD_ADDRS={0x8, 0x2, 0x2}]}, 0x24}, 0x1, 0x0, 0x0, 0x20000004}, 0x8890) syz_io_uring_setup(0x20f8, &(0x7f0000000400)={0x0, 0x7677, 0x8, 0x3, 0x22f, 0x0, r4}, &(0x7f0000ffe000/0x2000)=nil, &(0x7f0000ffb000/0x2000)=nil, &(0x7f0000000480)=0x0, &(0x7f00000004c0)) syz_io_uring_submit(r6, r2, &(0x7f0000000580)=@IORING_OP_FILES_UPDATE={0x14, 0x4, 0x0, 0x0, 0x40, &(0x7f0000000540)=[r4, 0xffffffffffffffff, 0xffffffffffffffff, r0, r1], 0x5}, 0x3) io_uring_setup(0x2812, &(0x7f00000005c0)={0x0, 0x5e1b, 0x2, 0x3, 0x12f, 0x0, r4}) socket$inet6_tcp(0xa, 0x1, 0x0) openat$procfs(0xffffffffffffff9c, &(0x7f00000010c0)='/proc/crypto\x00', 0x0, 0x0) io_uring_setup(0x7c8f, &(0x7f0000001140)={0x0, 0xc240, 0x10, 0x3, 0x1c7, 0x0, r4}) 21:15:46 executing program 7: write$P9_RSYMLINK(0xffffffffffffffff, &(0x7f0000000000)={0x14, 0x11, 0x2, {0x40, 0x3, 0x2}}, 0x14) ioctl$sock_ifreq(0xffffffffffffffff, 0x8935, &(0x7f0000000040)={'lo\x00', @ifru_addrs=@ethernet}) ioctl$sock_ifreq(0xffffffffffffffff, 0x8994, &(0x7f0000000080)={'ip6gretap0\x00', @ifru_flags}) sendmsg$IPSET_CMD_FLUSH(0xffffffffffffffff, &(0x7f0000000180)={&(0x7f00000000c0)={0x10, 0x0, 0x0, 0x10000}, 0xc, &(0x7f0000000140)={&(0x7f0000000100)={0x3c, 0x4, 0x6, 0x801, 0x0, 0x0, {0x3, 0x0, 0x4}, [@IPSET_ATTR_PROTOCOL={0x5}, @IPSET_ATTR_SETNAME={0x9, 0x2, 'syz0\x00'}, @IPSET_ATTR_SETNAME={0x9, 0x2, 'syz2\x00'}, @IPSET_ATTR_PROTOCOL={0x5}]}, 0x3c}}, 0x20000000) write$P9_RVERSION(0xffffffffffffffff, &(0x7f00000001c0)={0x13, 0x65, 0xffff, 0x3, 0x6, '9P2000'}, 0x13) pipe2$9p(&(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}, 0x0) write$P9_RSYMLINK(r0, &(0x7f0000000240)={0x14, 0x11, 0x1, {0x1, 0x3, 0x2}}, 0x14) syz_genetlink_get_family_id$mptcp(&(0x7f00000004c0), 0xffffffffffffffff) openat$vcsa(0xffffffffffffff9c, &(0x7f00000009c0), 0x14200, 0x0) syz_genetlink_get_family_id$mptcp(&(0x7f0000000a80), 0xffffffffffffffff) 21:15:46 executing program 5: r0 = io_uring_setup(0x355e, &(0x7f0000000000)={0x0, 0x7682, 0x20, 0x1, 0x1be}) r1 = syz_io_uring_setup(0x8fe, &(0x7f0000000080)={0x0, 0x1830, 0x0, 0x0, 0x1b8, 0x0, r0}, &(0x7f0000ffb000/0x2000)=nil, &(0x7f0000ffb000/0x4000)=nil, &(0x7f0000000100), &(0x7f0000000140)=0x0) r3 = openat$hwrng(0xffffffffffffff9c, &(0x7f0000000180), 0x2, 0x0) r4 = syz_io_uring_setup(0x65dd, &(0x7f00000001c0)={0x0, 0xf46f, 0x20, 0x2, 0xdf}, &(0x7f0000ffe000/0x1000)=nil, &(0x7f0000ffd000/0x1000)=nil, &(0x7f0000000240), &(0x7f0000000280)) r5 = syz_genetlink_get_family_id$mptcp(&(0x7f0000000300), r3) sendmsg$MPTCP_PM_CMD_ADD_ADDR(r3, &(0x7f00000003c0)={&(0x7f00000002c0)={0x10, 0x0, 0x0, 0x10}, 0xc, &(0x7f0000000380)={&(0x7f0000000340)={0x24, r5, 0x300, 0x70bd26, 0x25dfdbfb, {}, [@MPTCP_PM_ATTR_SUBFLOWS={0x8, 0x3, 0x1}, @MPTCP_PM_ATTR_RCV_ADD_ADDRS={0x8, 0x2, 0x2}]}, 0x24}, 0x1, 0x0, 0x0, 0x20000004}, 0x8890) syz_io_uring_setup(0x20f8, &(0x7f0000000400)={0x0, 0x7677, 0x8, 0x3, 0x22f, 0x0, r4}, &(0x7f0000ffe000/0x2000)=nil, &(0x7f0000ffb000/0x2000)=nil, &(0x7f0000000480)=0x0, &(0x7f00000004c0)) r7 = openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000500)='./cgroup/syz1\x00', 0x200002, 0x0) syz_io_uring_submit(r6, r2, &(0x7f0000000580)=@IORING_OP_FILES_UPDATE={0x14, 0x4, 0x0, 0x0, 0x40, &(0x7f0000000540)=[r4, 0xffffffffffffffff, r7, r0, r1], 0x5}, 0x3) socket$inet6_tcp(0xa, 0x1, 0x0) openat$procfs(0xffffffffffffff9c, &(0x7f00000010c0)='/proc/crypto\x00', 0x0, 0x0) 21:15:46 executing program 4: ioctl$SCSI_IOCTL_DOORUNLOCK(0xffffffffffffffff, 0x5381) r0 = syz_open_dev$mouse(&(0x7f0000000000), 0x578, 0x4000) ioctl$SG_GET_PACK_ID(r0, 0x227c, &(0x7f0000000040)) r1 = syz_genetlink_get_family_id$nl80211(&(0x7f00000000c0), r0) sendmsg$NL80211_CMD_NEW_KEY(r0, &(0x7f00000001c0)={&(0x7f0000000080)={0x10, 0x0, 0x0, 0x10}, 0xc, &(0x7f0000000180)={&(0x7f0000000100)={0x60, r1, 0x400, 0x70bd2b, 0x25dfdbff, {{}, {@val={0x8}, @void}}, [@NL80211_ATTR_KEY_TYPE={0x8, 0x37, 0x1}, @NL80211_ATTR_KEY_DEFAULT_MGMT={0x4}, @NL80211_ATTR_KEY={0x2c, 0x50, 0x0, 0x1, [@NL80211_KEY_DATA_WEP40={0x9, 0x1, "93f3c5ad5d"}, @NL80211_KEY_DEFAULT_TYPES={0x8, 0x8, 0x0, 0x1, [@NL80211_KEY_DEFAULT_TYPE_MULTICAST={0x4}]}, @NL80211_KEY_DATA_WEP104={0x11, 0x1, "8815558ac60368b42ebdf03bdb"}]}, @NL80211_ATTR_KEY_DATA_WEP40={0x9, 0x7, "74de692476"}]}, 0x60}, 0x1, 0x0, 0x0, 0x4000000}, 0x8000) openat$procfs(0xffffffffffffff9c, &(0x7f0000000200)='/proc/stat\x00', 0x0, 0x0) syz_open_dev$vcsa(&(0x7f0000000440), 0x56, 0x4000) socketpair(0x0, 0x3, 0x6, &(0x7f0000000640)) r2 = openat$tcp_congestion(0xffffffffffffff9c, &(0x7f0000000800), 0x1, 0x0) write$tcp_congestion(r2, &(0x7f0000000840)='htcp\x00', 0x5) 21:15:46 executing program 0: openat$tun(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) getresuid(&(0x7f0000000340), 0x0, &(0x7f00000003c0)) 21:15:46 executing program 4: ioctl$SCSI_IOCTL_DOORUNLOCK(0xffffffffffffffff, 0x5381) r0 = syz_open_dev$mouse(&(0x7f0000000000), 0x578, 0x4000) ioctl$SG_GET_PACK_ID(r0, 0x227c, &(0x7f0000000040)) r1 = syz_genetlink_get_family_id$nl80211(&(0x7f00000000c0), r0) sendmsg$NL80211_CMD_NEW_KEY(r0, &(0x7f00000001c0)={&(0x7f0000000080)={0x10, 0x0, 0x0, 0x10}, 0xc, &(0x7f0000000180)={&(0x7f0000000100)={0x60, r1, 0x400, 0x70bd2b, 0x25dfdbff, {{}, {@val={0x8}, @void}}, [@NL80211_ATTR_KEY_TYPE={0x8, 0x37, 0x1}, @NL80211_ATTR_KEY_DEFAULT_MGMT={0x4}, @NL80211_ATTR_KEY={0x2c, 0x50, 0x0, 0x1, [@NL80211_KEY_DATA_WEP40={0x9, 0x1, "93f3c5ad5d"}, @NL80211_KEY_DEFAULT_TYPES={0x8, 0x8, 0x0, 0x1, [@NL80211_KEY_DEFAULT_TYPE_MULTICAST={0x4}]}, @NL80211_KEY_DATA_WEP104={0x11, 0x1, "8815558ac60368b42ebdf03bdb"}]}, @NL80211_ATTR_KEY_DATA_WEP40={0x9, 0x7, "74de692476"}]}, 0x60}, 0x1, 0x0, 0x0, 0x4000000}, 0x8000) openat$procfs(0xffffffffffffff9c, &(0x7f0000000200)='/proc/stat\x00', 0x0, 0x0) syz_open_dev$vcsa(&(0x7f0000000440), 0x56, 0x4000) socketpair(0x0, 0x3, 0x6, &(0x7f0000000640)) openat$tcp_congestion(0xffffffffffffff9c, &(0x7f0000000800), 0x1, 0x0) 21:15:46 executing program 5: r0 = io_uring_setup(0x355e, &(0x7f0000000000)={0x0, 0x7682, 0x20, 0x1, 0x1be}) r1 = syz_io_uring_setup(0x8fe, &(0x7f0000000080)={0x0, 0x1830, 0x0, 0x0, 0x1b8, 0x0, r0}, &(0x7f0000ffb000/0x2000)=nil, &(0x7f0000ffb000/0x4000)=nil, &(0x7f0000000100), &(0x7f0000000140)=0x0) r3 = openat$hwrng(0xffffffffffffff9c, &(0x7f0000000180), 0x2, 0x0) r4 = syz_io_uring_setup(0x65dd, &(0x7f00000001c0)={0x0, 0xf46f, 0x20, 0x2, 0xdf}, &(0x7f0000ffe000/0x1000)=nil, &(0x7f0000ffd000/0x1000)=nil, &(0x7f0000000240), &(0x7f0000000280)) r5 = syz_genetlink_get_family_id$mptcp(&(0x7f0000000300), r3) sendmsg$MPTCP_PM_CMD_ADD_ADDR(r3, &(0x7f00000003c0)={&(0x7f00000002c0)={0x10, 0x0, 0x0, 0x10}, 0xc, &(0x7f0000000380)={&(0x7f0000000340)={0x24, r5, 0x300, 0x70bd26, 0x25dfdbfb, {}, [@MPTCP_PM_ATTR_SUBFLOWS={0x8, 0x3, 0x1}, @MPTCP_PM_ATTR_RCV_ADD_ADDRS={0x8, 0x2, 0x2}]}, 0x24}, 0x1, 0x0, 0x0, 0x20000004}, 0x8890) syz_io_uring_setup(0x20f8, &(0x7f0000000400)={0x0, 0x7677, 0x8, 0x3, 0x22f, 0x0, r4}, &(0x7f0000ffe000/0x2000)=nil, &(0x7f0000ffb000/0x2000)=nil, &(0x7f0000000480)=0x0, &(0x7f00000004c0)) r7 = openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000500)='./cgroup/syz1\x00', 0x200002, 0x0) syz_io_uring_submit(r6, r2, &(0x7f0000000580)=@IORING_OP_FILES_UPDATE={0x14, 0x4, 0x0, 0x0, 0x40, &(0x7f0000000540)=[r4, 0xffffffffffffffff, r7, r0, r1], 0x5}, 0x3) socket$inet6_tcp(0xa, 0x1, 0x0) openat$procfs(0xffffffffffffff9c, &(0x7f00000010c0)='/proc/crypto\x00', 0x0, 0x0) 21:15:46 executing program 3: getresuid(&(0x7f0000000340), &(0x7f0000000380), 0x0) 21:15:46 executing program 0: openat$tun(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) getresuid(&(0x7f0000000340), &(0x7f0000000380), 0x0) 21:15:46 executing program 1: r0 = io_uring_setup(0x355e, &(0x7f0000000000)={0x0, 0x7682, 0x20, 0x1, 0x1be}) r1 = syz_io_uring_setup(0x8fe, &(0x7f0000000080)={0x0, 0x1830, 0x0, 0x0, 0x1b8, 0x0, r0}, &(0x7f0000ffb000/0x2000)=nil, &(0x7f0000ffb000/0x4000)=nil, &(0x7f0000000100), &(0x7f0000000140)=0x0) r3 = openat$hwrng(0xffffffffffffff9c, &(0x7f0000000180), 0x2, 0x0) r4 = syz_io_uring_setup(0x65dd, &(0x7f00000001c0)={0x0, 0xf46f, 0x20, 0x2, 0xdf}, &(0x7f0000ffe000/0x1000)=nil, &(0x7f0000ffd000/0x1000)=nil, &(0x7f0000000240), &(0x7f0000000280)) r5 = syz_genetlink_get_family_id$mptcp(&(0x7f0000000300), r3) sendmsg$MPTCP_PM_CMD_ADD_ADDR(r3, &(0x7f00000003c0)={&(0x7f00000002c0)={0x10, 0x0, 0x0, 0x10}, 0xc, &(0x7f0000000380)={&(0x7f0000000340)={0x24, r5, 0x300, 0x70bd26, 0x25dfdbfb, {}, [@MPTCP_PM_ATTR_SUBFLOWS={0x8, 0x3, 0x1}, @MPTCP_PM_ATTR_RCV_ADD_ADDRS={0x8, 0x2, 0x2}]}, 0x24}, 0x1, 0x0, 0x0, 0x20000004}, 0x8890) r6 = openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000500)='./cgroup/syz1\x00', 0x200002, 0x0) syz_io_uring_submit(0x0, r2, &(0x7f0000000580)=@IORING_OP_FILES_UPDATE={0x14, 0x4, 0x0, 0x0, 0x40, &(0x7f0000000540)=[r4, 0xffffffffffffffff, r6, r0, r1], 0x5}, 0x3) io_uring_setup(0x2812, &(0x7f00000005c0)={0x0, 0x5e1b, 0x2, 0x3, 0x12f, 0x0, r4}) socket$inet6_tcp(0xa, 0x1, 0x0) openat$procfs(0xffffffffffffff9c, &(0x7f00000010c0)='/proc/crypto\x00', 0x0, 0x0) io_uring_setup(0x7c8f, &(0x7f0000001140)={0x0, 0xc240, 0x10, 0x3, 0x1c7, 0x0, r4}) 21:15:46 executing program 2: ioctl$SCSI_IOCTL_DOORUNLOCK(0xffffffffffffffff, 0x5381) r0 = syz_open_dev$mouse(&(0x7f0000000000), 0x578, 0x4000) ioctl$SG_GET_PACK_ID(r0, 0x227c, &(0x7f0000000040)) syz_open_dev$vcsa(&(0x7f0000000440), 0x56, 0x4000) socketpair(0x0, 0x3, 0x6, &(0x7f0000000640)) r1 = openat$tcp_congestion(0xffffffffffffff9c, &(0x7f0000000800), 0x1, 0x0) write$tcp_congestion(r1, &(0x7f0000000840)='htcp\x00', 0x5) 21:15:46 executing program 0: openat$tun(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) getresuid(&(0x7f0000000340), &(0x7f0000000380), 0x0) 21:15:46 executing program 7: write$P9_RSYMLINK(0xffffffffffffffff, &(0x7f0000000000)={0x14, 0x11, 0x2, {0x40, 0x3, 0x2}}, 0x14) ioctl$sock_ifreq(0xffffffffffffffff, 0x8935, &(0x7f0000000040)={'lo\x00', @ifru_addrs=@ethernet}) ioctl$sock_ifreq(0xffffffffffffffff, 0x8994, &(0x7f0000000080)={'ip6gretap0\x00', @ifru_flags}) sendmsg$IPSET_CMD_FLUSH(0xffffffffffffffff, &(0x7f0000000180)={&(0x7f00000000c0)={0x10, 0x0, 0x0, 0x10000}, 0xc, &(0x7f0000000140)={&(0x7f0000000100)={0x3c, 0x4, 0x6, 0x801, 0x0, 0x0, {0x3, 0x0, 0x4}, [@IPSET_ATTR_PROTOCOL={0x5}, @IPSET_ATTR_SETNAME={0x9, 0x2, 'syz0\x00'}, @IPSET_ATTR_SETNAME={0x9, 0x2, 'syz2\x00'}, @IPSET_ATTR_PROTOCOL={0x5}]}, 0x3c}}, 0x20000000) write$P9_RVERSION(0xffffffffffffffff, &(0x7f00000001c0)={0x13, 0x65, 0xffff, 0x3, 0x6, '9P2000'}, 0x13) pipe2$9p(&(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}, 0x0) write$P9_RSYMLINK(r0, &(0x7f0000000240)={0x14, 0x11, 0x1, {0x1, 0x3, 0x2}}, 0x14) syz_genetlink_get_family_id$mptcp(&(0x7f00000004c0), 0xffffffffffffffff) openat$vcsa(0xffffffffffffff9c, &(0x7f00000009c0), 0x14200, 0x0) syz_genetlink_get_family_id$mptcp(&(0x7f0000000a80), 0xffffffffffffffff) 21:15:46 executing program 6: r0 = io_uring_setup(0x355e, &(0x7f0000000000)={0x0, 0x7682, 0x20, 0x1, 0x1be}) r1 = syz_io_uring_setup(0x8fe, &(0x7f0000000080)={0x0, 0x1830, 0x0, 0x0, 0x1b8, 0x0, r0}, &(0x7f0000ffb000/0x2000)=nil, &(0x7f0000ffb000/0x4000)=nil, &(0x7f0000000100), &(0x7f0000000140)=0x0) r3 = openat$hwrng(0xffffffffffffff9c, &(0x7f0000000180), 0x2, 0x0) r4 = syz_io_uring_setup(0x65dd, &(0x7f00000001c0)={0x0, 0xf46f, 0x20, 0x2, 0xdf}, &(0x7f0000ffe000/0x1000)=nil, &(0x7f0000ffd000/0x1000)=nil, &(0x7f0000000240), &(0x7f0000000280)) r5 = syz_genetlink_get_family_id$mptcp(&(0x7f0000000300), r3) sendmsg$MPTCP_PM_CMD_ADD_ADDR(r3, &(0x7f00000003c0)={&(0x7f00000002c0)={0x10, 0x0, 0x0, 0x10}, 0xc, &(0x7f0000000380)={&(0x7f0000000340)={0x24, r5, 0x300, 0x70bd26, 0x25dfdbfb, {}, [@MPTCP_PM_ATTR_SUBFLOWS={0x8, 0x3, 0x1}, @MPTCP_PM_ATTR_RCV_ADD_ADDRS={0x8, 0x2, 0x2}]}, 0x24}, 0x1, 0x0, 0x0, 0x20000004}, 0x8890) syz_io_uring_setup(0x20f8, &(0x7f0000000400)={0x0, 0x7677, 0x8, 0x3, 0x22f, 0x0, r4}, &(0x7f0000ffe000/0x2000)=nil, &(0x7f0000ffb000/0x2000)=nil, &(0x7f0000000480)=0x0, &(0x7f00000004c0)) r7 = openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000500)='./cgroup/syz1\x00', 0x200002, 0x0) syz_io_uring_submit(r6, r2, &(0x7f0000000580)=@IORING_OP_FILES_UPDATE={0x14, 0x4, 0x0, 0x0, 0x40, &(0x7f0000000540)=[r4, 0xffffffffffffffff, r7, r0, r1], 0x5}, 0x3) socket$inet6_tcp(0xa, 0x1, 0x0) io_uring_setup(0x7c8f, &(0x7f0000001140)={0x0, 0xc240, 0x10, 0x3, 0x1c7, 0x0, r4}) 21:15:46 executing program 3: getresuid(&(0x7f0000000340), &(0x7f0000000380), 0x0) 21:15:46 executing program 0: openat$tun(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) getresuid(&(0x7f0000000340), &(0x7f0000000380), 0x0) 21:15:46 executing program 4: ioctl$SCSI_IOCTL_DOORUNLOCK(0xffffffffffffffff, 0x5381) r0 = syz_open_dev$mouse(&(0x7f0000000000), 0x578, 0x4000) ioctl$SG_GET_PACK_ID(r0, 0x227c, &(0x7f0000000040)) r1 = syz_genetlink_get_family_id$nl80211(&(0x7f00000000c0), r0) sendmsg$NL80211_CMD_NEW_KEY(r0, &(0x7f00000001c0)={&(0x7f0000000080)={0x10, 0x0, 0x0, 0x10}, 0xc, &(0x7f0000000180)={&(0x7f0000000100)={0x60, r1, 0x400, 0x70bd2b, 0x25dfdbff, {{}, {@val={0x8}, @void}}, [@NL80211_ATTR_KEY_TYPE={0x8, 0x37, 0x1}, @NL80211_ATTR_KEY_DEFAULT_MGMT={0x4}, @NL80211_ATTR_KEY={0x2c, 0x50, 0x0, 0x1, [@NL80211_KEY_DATA_WEP40={0x9, 0x1, "93f3c5ad5d"}, @NL80211_KEY_DEFAULT_TYPES={0x8, 0x8, 0x0, 0x1, [@NL80211_KEY_DEFAULT_TYPE_MULTICAST={0x4}]}, @NL80211_KEY_DATA_WEP104={0x11, 0x1, "8815558ac60368b42ebdf03bdb"}]}, @NL80211_ATTR_KEY_DATA_WEP40={0x9, 0x7, "74de692476"}]}, 0x60}, 0x1, 0x0, 0x0, 0x4000000}, 0x8000) openat$procfs(0xffffffffffffff9c, &(0x7f0000000200)='/proc/stat\x00', 0x0, 0x0) syz_open_dev$vcsa(&(0x7f0000000440), 0x56, 0x4000) socketpair(0x0, 0x3, 0x6, &(0x7f0000000640)) openat$tcp_congestion(0xffffffffffffff9c, &(0x7f0000000800), 0x1, 0x0) 21:15:47 executing program 7: write$P9_RSYMLINK(0xffffffffffffffff, &(0x7f0000000000)={0x14, 0x11, 0x2, {0x40, 0x3, 0x2}}, 0x14) ioctl$sock_ifreq(0xffffffffffffffff, 0x8935, &(0x7f0000000040)={'lo\x00', @ifru_addrs=@ethernet}) ioctl$sock_ifreq(0xffffffffffffffff, 0x8994, &(0x7f0000000080)={'ip6gretap0\x00', @ifru_flags}) sendmsg$IPSET_CMD_FLUSH(0xffffffffffffffff, &(0x7f0000000180)={&(0x7f00000000c0)={0x10, 0x0, 0x0, 0x10000}, 0xc, &(0x7f0000000140)={&(0x7f0000000100)={0x3c, 0x4, 0x6, 0x801, 0x0, 0x0, {0x3, 0x0, 0x4}, [@IPSET_ATTR_PROTOCOL={0x5}, @IPSET_ATTR_SETNAME={0x9, 0x2, 'syz0\x00'}, @IPSET_ATTR_SETNAME={0x9, 0x2, 'syz2\x00'}, @IPSET_ATTR_PROTOCOL={0x5}]}, 0x3c}}, 0x20000000) write$P9_RVERSION(0xffffffffffffffff, &(0x7f00000001c0)={0x13, 0x65, 0xffff, 0x3, 0x6, '9P2000'}, 0x13) pipe2$9p(&(0x7f0000000200), 0x0) add_key$fscrypt_v1(&(0x7f0000000280), &(0x7f00000002c0)={'fscrypt:', @desc2}, &(0x7f0000000300)={0x0, "ccf022eeb1aa5b4a9067674b5b7079352411c35248e190415959cbe4b7be99236abd831288583a8ed4db4b7b3f838c24d293f908bf3509b49f2c17852201f646", 0x19}, 0x48, 0xfffffffffffffffa) syz_genetlink_get_family_id$mptcp(&(0x7f00000004c0), 0xffffffffffffffff) openat$vcsa(0xffffffffffffff9c, &(0x7f00000009c0), 0x14200, 0x0) syz_genetlink_get_family_id$mptcp(&(0x7f0000000a80), 0xffffffffffffffff) 21:15:56 executing program 5: r0 = io_uring_setup(0x355e, &(0x7f0000000000)={0x0, 0x7682, 0x20, 0x1, 0x1be}) r1 = syz_io_uring_setup(0x8fe, &(0x7f0000000080)={0x0, 0x1830, 0x0, 0x0, 0x1b8, 0x0, r0}, &(0x7f0000ffb000/0x2000)=nil, &(0x7f0000ffb000/0x4000)=nil, &(0x7f0000000100), &(0x7f0000000140)=0x0) r3 = openat$hwrng(0xffffffffffffff9c, &(0x7f0000000180), 0x2, 0x0) r4 = syz_io_uring_setup(0x65dd, &(0x7f00000001c0)={0x0, 0xf46f, 0x20, 0x2, 0xdf}, &(0x7f0000ffe000/0x1000)=nil, &(0x7f0000ffd000/0x1000)=nil, &(0x7f0000000240), &(0x7f0000000280)) r5 = syz_genetlink_get_family_id$mptcp(&(0x7f0000000300), r3) sendmsg$MPTCP_PM_CMD_ADD_ADDR(r3, &(0x7f00000003c0)={&(0x7f00000002c0)={0x10, 0x0, 0x0, 0x10}, 0xc, &(0x7f0000000380)={&(0x7f0000000340)={0x24, r5, 0x300, 0x70bd26, 0x25dfdbfb, {}, [@MPTCP_PM_ATTR_SUBFLOWS={0x8, 0x3, 0x1}, @MPTCP_PM_ATTR_RCV_ADD_ADDRS={0x8, 0x2, 0x2}]}, 0x24}, 0x1, 0x0, 0x0, 0x20000004}, 0x8890) syz_io_uring_setup(0x20f8, &(0x7f0000000400)={0x0, 0x7677, 0x8, 0x3, 0x22f, 0x0, r4}, &(0x7f0000ffe000/0x2000)=nil, &(0x7f0000ffb000/0x2000)=nil, &(0x7f0000000480)=0x0, &(0x7f00000004c0)) r7 = openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000500)='./cgroup/syz1\x00', 0x200002, 0x0) syz_io_uring_submit(r6, r2, &(0x7f0000000580)=@IORING_OP_FILES_UPDATE={0x14, 0x4, 0x0, 0x0, 0x40, &(0x7f0000000540)=[r4, 0xffffffffffffffff, r7, r0, r1], 0x5}, 0x3) socket$inet6_tcp(0xa, 0x1, 0x0) openat$procfs(0xffffffffffffff9c, &(0x7f00000010c0)='/proc/crypto\x00', 0x0, 0x0) 21:15:56 executing program 2: ioctl$SCSI_IOCTL_DOORUNLOCK(0xffffffffffffffff, 0x5381) r0 = syz_open_dev$mouse(&(0x7f0000000000), 0x578, 0x4000) syz_genetlink_get_family_id$nl80211(&(0x7f00000000c0), r0) syz_open_dev$vcsa(&(0x7f0000000440), 0x56, 0x4000) socketpair(0x0, 0x3, 0x6, &(0x7f0000000640)) r1 = openat$tcp_congestion(0xffffffffffffff9c, &(0x7f0000000800), 0x1, 0x0) write$tcp_congestion(r1, &(0x7f0000000840)='htcp\x00', 0x5) 21:15:56 executing program 7: write$P9_RSYMLINK(0xffffffffffffffff, &(0x7f0000000000)={0x14, 0x11, 0x2, {0x40, 0x3, 0x2}}, 0x14) ioctl$sock_ifreq(0xffffffffffffffff, 0x8935, &(0x7f0000000040)={'lo\x00', @ifru_addrs=@ethernet}) ioctl$sock_ifreq(0xffffffffffffffff, 0x8994, &(0x7f0000000080)={'ip6gretap0\x00', @ifru_flags}) sendmsg$IPSET_CMD_FLUSH(0xffffffffffffffff, &(0x7f0000000180)={&(0x7f00000000c0)={0x10, 0x0, 0x0, 0x10000}, 0xc, &(0x7f0000000140)={&(0x7f0000000100)={0x3c, 0x4, 0x6, 0x801, 0x0, 0x0, {0x3, 0x0, 0x4}, [@IPSET_ATTR_PROTOCOL={0x5}, @IPSET_ATTR_SETNAME={0x9, 0x2, 'syz0\x00'}, @IPSET_ATTR_SETNAME={0x9, 0x2, 'syz2\x00'}, @IPSET_ATTR_PROTOCOL={0x5}]}, 0x3c}}, 0x20000000) write$P9_RVERSION(0xffffffffffffffff, &(0x7f00000001c0)={0x13, 0x65, 0xffff, 0x3, 0x6, '9P2000'}, 0x13) pipe2$9p(&(0x7f0000000200), 0x0) add_key$fscrypt_v1(&(0x7f0000000280), &(0x7f00000002c0)={'fscrypt:', @desc2}, &(0x7f0000000300)={0x0, "ccf022eeb1aa5b4a9067674b5b7079352411c35248e190415959cbe4b7be99236abd831288583a8ed4db4b7b3f838c24d293f908bf3509b49f2c17852201f646", 0x19}, 0x48, 0xfffffffffffffffa) syz_genetlink_get_family_id$mptcp(&(0x7f00000004c0), 0xffffffffffffffff) openat$vcsa(0xffffffffffffff9c, &(0x7f00000009c0), 0x14200, 0x0) syz_genetlink_get_family_id$mptcp(&(0x7f0000000a80), 0xffffffffffffffff) 21:15:56 executing program 4: ioctl$SCSI_IOCTL_DOORUNLOCK(0xffffffffffffffff, 0x5381) r0 = syz_open_dev$mouse(&(0x7f0000000000), 0x578, 0x4000) ioctl$SG_GET_PACK_ID(r0, 0x227c, &(0x7f0000000040)) r1 = syz_genetlink_get_family_id$nl80211(&(0x7f00000000c0), r0) sendmsg$NL80211_CMD_NEW_KEY(r0, &(0x7f00000001c0)={&(0x7f0000000080)={0x10, 0x0, 0x0, 0x10}, 0xc, &(0x7f0000000180)={&(0x7f0000000100)={0x60, r1, 0x400, 0x70bd2b, 0x25dfdbff, {{}, {@val={0x8}, @void}}, [@NL80211_ATTR_KEY_TYPE={0x8, 0x37, 0x1}, @NL80211_ATTR_KEY_DEFAULT_MGMT={0x4}, @NL80211_ATTR_KEY={0x2c, 0x50, 0x0, 0x1, [@NL80211_KEY_DATA_WEP40={0x9, 0x1, "93f3c5ad5d"}, @NL80211_KEY_DEFAULT_TYPES={0x8, 0x8, 0x0, 0x1, [@NL80211_KEY_DEFAULT_TYPE_MULTICAST={0x4}]}, @NL80211_KEY_DATA_WEP104={0x11, 0x1, "8815558ac60368b42ebdf03bdb"}]}, @NL80211_ATTR_KEY_DATA_WEP40={0x9, 0x7, "74de692476"}]}, 0x60}, 0x1, 0x0, 0x0, 0x4000000}, 0x8000) openat$procfs(0xffffffffffffff9c, &(0x7f0000000200)='/proc/stat\x00', 0x0, 0x0) syz_open_dev$vcsa(&(0x7f0000000440), 0x56, 0x4000) socketpair(0x0, 0x3, 0x6, &(0x7f0000000640)) openat$tcp_congestion(0xffffffffffffff9c, &(0x7f0000000800), 0x1, 0x0) 21:15:56 executing program 0: r0 = io_uring_setup(0x355e, &(0x7f0000000000)={0x0, 0x7682, 0x20, 0x1, 0x1be}) r1 = syz_io_uring_setup(0x8fe, &(0x7f0000000080)={0x0, 0x1830, 0x0, 0x0, 0x1b8, 0x0, r0}, &(0x7f0000ffb000/0x2000)=nil, &(0x7f0000ffb000/0x4000)=nil, &(0x7f0000000100), &(0x7f0000000140)=0x0) r3 = openat$hwrng(0xffffffffffffff9c, &(0x7f0000000180), 0x2, 0x0) r4 = syz_io_uring_setup(0x65dd, &(0x7f00000001c0)={0x0, 0xf46f, 0x20, 0x2, 0xdf}, &(0x7f0000ffe000/0x1000)=nil, &(0x7f0000ffd000/0x1000)=nil, &(0x7f0000000240), &(0x7f0000000280)) r5 = syz_genetlink_get_family_id$mptcp(&(0x7f0000000300), r3) sendmsg$MPTCP_PM_CMD_ADD_ADDR(r3, &(0x7f00000003c0)={&(0x7f00000002c0)={0x10, 0x0, 0x0, 0x10}, 0xc, &(0x7f0000000380)={&(0x7f0000000340)={0x24, r5, 0x300, 0x70bd26, 0x25dfdbfb, {}, [@MPTCP_PM_ATTR_SUBFLOWS={0x8, 0x3, 0x1}, @MPTCP_PM_ATTR_RCV_ADD_ADDRS={0x8, 0x2, 0x2}]}, 0x24}, 0x1, 0x0, 0x0, 0x20000004}, 0x8890) r6 = openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000500)='./cgroup/syz1\x00', 0x200002, 0x0) syz_io_uring_submit(0x0, r2, &(0x7f0000000580)=@IORING_OP_FILES_UPDATE={0x14, 0x4, 0x0, 0x0, 0x40, &(0x7f0000000540)=[r4, 0xffffffffffffffff, r6, r0, r1], 0x5}, 0x3) io_uring_setup(0x2812, &(0x7f00000005c0)={0x0, 0x5e1b, 0x2, 0x3, 0x12f, 0x0, r4}) socket$inet6_tcp(0xa, 0x1, 0x0) openat$procfs(0xffffffffffffff9c, &(0x7f00000010c0)='/proc/crypto\x00', 0x0, 0x0) io_uring_setup(0x7c8f, &(0x7f0000001140)={0x0, 0xc240, 0x10, 0x3, 0x1c7, 0x0, r4}) 21:15:56 executing program 3: r0 = io_uring_setup(0x355e, &(0x7f0000000000)={0x0, 0x7682, 0x20, 0x1, 0x1be}) r1 = syz_io_uring_setup(0x8fe, &(0x7f0000000080)={0x0, 0x1830, 0x0, 0x0, 0x1b8, 0x0, r0}, &(0x7f0000ffb000/0x2000)=nil, &(0x7f0000ffb000/0x4000)=nil, &(0x7f0000000100), &(0x7f0000000140)=0x0) r3 = openat$hwrng(0xffffffffffffff9c, &(0x7f0000000180), 0x2, 0x0) r4 = syz_io_uring_setup(0x65dd, &(0x7f00000001c0)={0x0, 0xf46f, 0x20, 0x2, 0xdf}, &(0x7f0000ffe000/0x1000)=nil, &(0x7f0000ffd000/0x1000)=nil, &(0x7f0000000240), &(0x7f0000000280)) r5 = syz_genetlink_get_family_id$mptcp(&(0x7f0000000300), r3) sendmsg$MPTCP_PM_CMD_ADD_ADDR(r3, &(0x7f00000003c0)={&(0x7f00000002c0)={0x10, 0x0, 0x0, 0x10}, 0xc, &(0x7f0000000380)={&(0x7f0000000340)={0x24, r5, 0x300, 0x70bd26, 0x25dfdbfb, {}, [@MPTCP_PM_ATTR_SUBFLOWS={0x8, 0x3, 0x1}, @MPTCP_PM_ATTR_RCV_ADD_ADDRS={0x8, 0x2, 0x2}]}, 0x24}, 0x1, 0x0, 0x0, 0x20000004}, 0x8890) r6 = openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000500)='./cgroup/syz1\x00', 0x200002, 0x0) syz_io_uring_submit(0x0, r2, &(0x7f0000000580)=@IORING_OP_FILES_UPDATE={0x14, 0x4, 0x0, 0x0, 0x40, &(0x7f0000000540)=[r4, 0xffffffffffffffff, r6, r0, r1], 0x5}, 0x3) io_uring_setup(0x2812, &(0x7f00000005c0)={0x0, 0x5e1b, 0x2, 0x3, 0x12f, 0x0, r4}) socket$inet6_tcp(0xa, 0x1, 0x0) openat$procfs(0xffffffffffffff9c, &(0x7f00000010c0)='/proc/crypto\x00', 0x0, 0x0) io_uring_setup(0x7c8f, &(0x7f0000001140)={0x0, 0xc240, 0x10, 0x3, 0x1c7, 0x0, r4}) 21:15:56 executing program 6: r0 = io_uring_setup(0x355e, &(0x7f0000000000)={0x0, 0x7682, 0x20, 0x1, 0x1be}) r1 = syz_io_uring_setup(0x8fe, &(0x7f0000000080)={0x0, 0x1830, 0x0, 0x0, 0x1b8, 0x0, r0}, &(0x7f0000ffb000/0x2000)=nil, &(0x7f0000ffb000/0x4000)=nil, &(0x7f0000000100), &(0x7f0000000140)=0x0) r3 = openat$hwrng(0xffffffffffffff9c, &(0x7f0000000180), 0x2, 0x0) r4 = syz_io_uring_setup(0x65dd, &(0x7f00000001c0)={0x0, 0xf46f, 0x20, 0x2, 0xdf}, &(0x7f0000ffe000/0x1000)=nil, &(0x7f0000ffd000/0x1000)=nil, &(0x7f0000000240), &(0x7f0000000280)) r5 = syz_genetlink_get_family_id$mptcp(&(0x7f0000000300), r3) sendmsg$MPTCP_PM_CMD_ADD_ADDR(r3, &(0x7f00000003c0)={&(0x7f00000002c0)={0x10, 0x0, 0x0, 0x10}, 0xc, &(0x7f0000000380)={&(0x7f0000000340)={0x24, r5, 0x300, 0x70bd26, 0x25dfdbfb, {}, [@MPTCP_PM_ATTR_SUBFLOWS={0x8, 0x3, 0x1}, @MPTCP_PM_ATTR_RCV_ADD_ADDRS={0x8, 0x2, 0x2}]}, 0x24}, 0x1, 0x0, 0x0, 0x20000004}, 0x8890) syz_io_uring_setup(0x20f8, &(0x7f0000000400)={0x0, 0x7677, 0x8, 0x3, 0x22f, 0x0, r4}, &(0x7f0000ffe000/0x2000)=nil, &(0x7f0000ffb000/0x2000)=nil, &(0x7f0000000480)=0x0, &(0x7f00000004c0)) r7 = openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000500)='./cgroup/syz1\x00', 0x200002, 0x0) syz_io_uring_submit(r6, r2, &(0x7f0000000580)=@IORING_OP_FILES_UPDATE={0x14, 0x4, 0x0, 0x0, 0x40, &(0x7f0000000540)=[r4, 0xffffffffffffffff, r7, r0, r1], 0x5}, 0x3) socket$inet6_tcp(0xa, 0x1, 0x0) io_uring_setup(0x7c8f, &(0x7f0000001140)={0x0, 0xc240, 0x10, 0x3, 0x1c7, 0x0, r4}) 21:15:56 executing program 1: r0 = io_uring_setup(0x355e, &(0x7f0000000000)={0x0, 0x7682, 0x20, 0x1, 0x1be}) r1 = syz_io_uring_setup(0x8fe, &(0x7f0000000080)={0x0, 0x1830, 0x0, 0x0, 0x1b8, 0x0, r0}, &(0x7f0000ffb000/0x2000)=nil, &(0x7f0000ffb000/0x4000)=nil, &(0x7f0000000100), &(0x7f0000000140)=0x0) r3 = openat$hwrng(0xffffffffffffff9c, &(0x7f0000000180), 0x2, 0x0) r4 = syz_io_uring_setup(0x65dd, &(0x7f00000001c0)={0x0, 0xf46f, 0x20, 0x2, 0xdf}, &(0x7f0000ffe000/0x1000)=nil, &(0x7f0000ffd000/0x1000)=nil, &(0x7f0000000240), &(0x7f0000000280)) r5 = syz_genetlink_get_family_id$mptcp(&(0x7f0000000300), r3) sendmsg$MPTCP_PM_CMD_ADD_ADDR(r3, &(0x7f00000003c0)={&(0x7f00000002c0)={0x10, 0x0, 0x0, 0x10}, 0xc, &(0x7f0000000380)={&(0x7f0000000340)={0x24, r5, 0x300, 0x70bd26, 0x25dfdbfb, {}, [@MPTCP_PM_ATTR_SUBFLOWS={0x8, 0x3, 0x1}, @MPTCP_PM_ATTR_RCV_ADD_ADDRS={0x8, 0x2, 0x2}]}, 0x24}, 0x1, 0x0, 0x0, 0x20000004}, 0x8890) r6 = openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000500)='./cgroup/syz1\x00', 0x200002, 0x0) syz_io_uring_submit(0x0, r2, &(0x7f0000000580)=@IORING_OP_FILES_UPDATE={0x14, 0x4, 0x0, 0x0, 0x40, &(0x7f0000000540)=[r4, 0xffffffffffffffff, r6, r0, r1], 0x5}, 0x3) io_uring_setup(0x2812, &(0x7f00000005c0)={0x0, 0x5e1b, 0x2, 0x3, 0x12f, 0x0, r4}) socket$inet6_tcp(0xa, 0x1, 0x0) openat$procfs(0xffffffffffffff9c, &(0x7f00000010c0)='/proc/crypto\x00', 0x0, 0x0) io_uring_setup(0x7c8f, &(0x7f0000001140)={0x0, 0xc240, 0x10, 0x3, 0x1c7, 0x0, r4}) 21:15:57 executing program 4: ioctl$SCSI_IOCTL_DOORUNLOCK(0xffffffffffffffff, 0x5381) r0 = syz_open_dev$mouse(&(0x7f0000000000), 0x578, 0x4000) ioctl$SG_GET_PACK_ID(r0, 0x227c, &(0x7f0000000040)) r1 = syz_genetlink_get_family_id$nl80211(&(0x7f00000000c0), r0) sendmsg$NL80211_CMD_NEW_KEY(r0, &(0x7f00000001c0)={&(0x7f0000000080)={0x10, 0x0, 0x0, 0x10}, 0xc, &(0x7f0000000180)={&(0x7f0000000100)={0x60, r1, 0x400, 0x70bd2b, 0x25dfdbff, {{}, {@val={0x8}, @void}}, [@NL80211_ATTR_KEY_TYPE={0x8, 0x37, 0x1}, @NL80211_ATTR_KEY_DEFAULT_MGMT={0x4}, @NL80211_ATTR_KEY={0x2c, 0x50, 0x0, 0x1, [@NL80211_KEY_DATA_WEP40={0x9, 0x1, "93f3c5ad5d"}, @NL80211_KEY_DEFAULT_TYPES={0x8, 0x8, 0x0, 0x1, [@NL80211_KEY_DEFAULT_TYPE_MULTICAST={0x4}]}, @NL80211_KEY_DATA_WEP104={0x11, 0x1, "8815558ac60368b42ebdf03bdb"}]}, @NL80211_ATTR_KEY_DATA_WEP40={0x9, 0x7, "74de692476"}]}, 0x60}, 0x1, 0x0, 0x0, 0x4000000}, 0x8000) openat$procfs(0xffffffffffffff9c, &(0x7f0000000200)='/proc/stat\x00', 0x0, 0x0) syz_open_dev$vcsa(&(0x7f0000000440), 0x56, 0x4000) socketpair(0x0, 0x3, 0x6, &(0x7f0000000640)) write$tcp_congestion(0xffffffffffffffff, &(0x7f0000000840)='htcp\x00', 0x5) 21:15:57 executing program 6: r0 = io_uring_setup(0x355e, &(0x7f0000000000)={0x0, 0x7682, 0x20, 0x1, 0x1be}) r1 = syz_io_uring_setup(0x8fe, &(0x7f0000000080)={0x0, 0x1830, 0x0, 0x0, 0x1b8, 0x0, r0}, &(0x7f0000ffb000/0x2000)=nil, &(0x7f0000ffb000/0x4000)=nil, &(0x7f0000000100), &(0x7f0000000140)=0x0) r3 = openat$hwrng(0xffffffffffffff9c, &(0x7f0000000180), 0x2, 0x0) r4 = syz_io_uring_setup(0x65dd, &(0x7f00000001c0)={0x0, 0xf46f, 0x20, 0x2, 0xdf}, &(0x7f0000ffe000/0x1000)=nil, &(0x7f0000ffd000/0x1000)=nil, &(0x7f0000000240), &(0x7f0000000280)) r5 = syz_genetlink_get_family_id$mptcp(&(0x7f0000000300), r3) sendmsg$MPTCP_PM_CMD_ADD_ADDR(r3, &(0x7f00000003c0)={&(0x7f00000002c0)={0x10, 0x0, 0x0, 0x10}, 0xc, &(0x7f0000000380)={&(0x7f0000000340)={0x24, r5, 0x300, 0x70bd26, 0x25dfdbfb, {}, [@MPTCP_PM_ATTR_SUBFLOWS={0x8, 0x3, 0x1}, @MPTCP_PM_ATTR_RCV_ADD_ADDRS={0x8, 0x2, 0x2}]}, 0x24}, 0x1, 0x0, 0x0, 0x20000004}, 0x8890) syz_io_uring_setup(0x20f8, &(0x7f0000000400)={0x0, 0x7677, 0x8, 0x3, 0x22f, 0x0, r4}, &(0x7f0000ffe000/0x2000)=nil, &(0x7f0000ffb000/0x2000)=nil, &(0x7f0000000480)=0x0, &(0x7f00000004c0)) r7 = openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000500)='./cgroup/syz1\x00', 0x200002, 0x0) syz_io_uring_submit(r6, r2, &(0x7f0000000580)=@IORING_OP_FILES_UPDATE={0x14, 0x4, 0x0, 0x0, 0x40, &(0x7f0000000540)=[r4, 0xffffffffffffffff, r7, r0, r1], 0x5}, 0x3) socket$inet6_tcp(0xa, 0x1, 0x0) io_uring_setup(0x7c8f, &(0x7f0000001140)={0x0, 0xc240, 0x10, 0x3, 0x1c7, 0x0, r4}) 21:15:57 executing program 2: ioctl$SCSI_IOCTL_DOORUNLOCK(0xffffffffffffffff, 0x5381) syz_genetlink_get_family_id$nl80211(&(0x7f00000000c0), 0xffffffffffffffff) syz_open_dev$vcsa(&(0x7f0000000440), 0x56, 0x4000) socketpair(0x0, 0x3, 0x6, &(0x7f0000000640)) r0 = openat$tcp_congestion(0xffffffffffffff9c, &(0x7f0000000800), 0x1, 0x0) write$tcp_congestion(r0, &(0x7f0000000840)='htcp\x00', 0x5) 21:15:57 executing program 1: r0 = io_uring_setup(0x355e, &(0x7f0000000000)={0x0, 0x7682, 0x20, 0x1, 0x1be}) r1 = syz_io_uring_setup(0x8fe, &(0x7f0000000080)={0x0, 0x1830, 0x0, 0x0, 0x1b8, 0x0, r0}, &(0x7f0000ffb000/0x2000)=nil, &(0x7f0000ffb000/0x4000)=nil, &(0x7f0000000100), &(0x7f0000000140)=0x0) r3 = openat$hwrng(0xffffffffffffff9c, &(0x7f0000000180), 0x2, 0x0) r4 = syz_io_uring_setup(0x65dd, &(0x7f00000001c0)={0x0, 0xf46f, 0x20, 0x2, 0xdf}, &(0x7f0000ffe000/0x1000)=nil, &(0x7f0000ffd000/0x1000)=nil, &(0x7f0000000240), &(0x7f0000000280)) r5 = syz_genetlink_get_family_id$mptcp(&(0x7f0000000300), r3) sendmsg$MPTCP_PM_CMD_ADD_ADDR(r3, &(0x7f00000003c0)={&(0x7f00000002c0)={0x10, 0x0, 0x0, 0x10}, 0xc, &(0x7f0000000380)={&(0x7f0000000340)={0x24, r5, 0x300, 0x70bd26, 0x25dfdbfb, {}, [@MPTCP_PM_ATTR_SUBFLOWS={0x8, 0x3, 0x1}, @MPTCP_PM_ATTR_RCV_ADD_ADDRS={0x8, 0x2, 0x2}]}, 0x24}, 0x1, 0x0, 0x0, 0x20000004}, 0x8890) r6 = openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000500)='./cgroup/syz1\x00', 0x200002, 0x0) syz_io_uring_submit(0x0, r2, &(0x7f0000000580)=@IORING_OP_FILES_UPDATE={0x14, 0x4, 0x0, 0x0, 0x40, &(0x7f0000000540)=[r4, 0xffffffffffffffff, r6, r0, r1], 0x5}, 0x3) io_uring_setup(0x2812, &(0x7f00000005c0)={0x0, 0x5e1b, 0x2, 0x3, 0x12f, 0x0, r4}) socket$inet6_tcp(0xa, 0x1, 0x0) openat$procfs(0xffffffffffffff9c, &(0x7f00000010c0)='/proc/crypto\x00', 0x0, 0x0) io_uring_setup(0x7c8f, &(0x7f0000001140)={0x0, 0xc240, 0x10, 0x3, 0x1c7, 0x0, r4}) 21:15:57 executing program 5: r0 = io_uring_setup(0x355e, &(0x7f0000000000)={0x0, 0x7682, 0x20, 0x1, 0x1be}) r1 = syz_io_uring_setup(0x8fe, &(0x7f0000000080)={0x0, 0x1830, 0x0, 0x0, 0x1b8, 0x0, r0}, &(0x7f0000ffb000/0x2000)=nil, &(0x7f0000ffb000/0x4000)=nil, &(0x7f0000000100), &(0x7f0000000140)=0x0) r3 = openat$hwrng(0xffffffffffffff9c, &(0x7f0000000180), 0x2, 0x0) r4 = syz_io_uring_setup(0x65dd, &(0x7f00000001c0)={0x0, 0xf46f, 0x20, 0x2, 0xdf}, &(0x7f0000ffe000/0x1000)=nil, &(0x7f0000ffd000/0x1000)=nil, &(0x7f0000000240), &(0x7f0000000280)) r5 = syz_genetlink_get_family_id$mptcp(&(0x7f0000000300), r3) sendmsg$MPTCP_PM_CMD_ADD_ADDR(r3, &(0x7f00000003c0)={&(0x7f00000002c0)={0x10, 0x0, 0x0, 0x10}, 0xc, &(0x7f0000000380)={&(0x7f0000000340)={0x24, r5, 0x300, 0x70bd26, 0x25dfdbfb, {}, [@MPTCP_PM_ATTR_SUBFLOWS={0x8, 0x3, 0x1}, @MPTCP_PM_ATTR_RCV_ADD_ADDRS={0x8, 0x2, 0x2}]}, 0x24}, 0x1, 0x0, 0x0, 0x20000004}, 0x8890) syz_io_uring_setup(0x20f8, &(0x7f0000000400)={0x0, 0x7677, 0x8, 0x3, 0x22f, 0x0, r4}, &(0x7f0000ffe000/0x2000)=nil, &(0x7f0000ffb000/0x2000)=nil, &(0x7f0000000480)=0x0, &(0x7f00000004c0)) r7 = openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000500)='./cgroup/syz1\x00', 0x200002, 0x0) syz_io_uring_submit(r6, r2, &(0x7f0000000580)=@IORING_OP_FILES_UPDATE={0x14, 0x4, 0x0, 0x0, 0x40, &(0x7f0000000540)=[r4, 0xffffffffffffffff, r7, r0, r1], 0x5}, 0x3) socket$inet6_tcp(0xa, 0x1, 0x0) 21:15:57 executing program 3: r0 = io_uring_setup(0x355e, &(0x7f0000000000)={0x0, 0x7682, 0x20, 0x1, 0x1be}) r1 = syz_io_uring_setup(0x8fe, &(0x7f0000000080)={0x0, 0x1830, 0x0, 0x0, 0x1b8, 0x0, r0}, &(0x7f0000ffb000/0x2000)=nil, &(0x7f0000ffb000/0x4000)=nil, &(0x7f0000000100), &(0x7f0000000140)=0x0) r3 = openat$hwrng(0xffffffffffffff9c, &(0x7f0000000180), 0x2, 0x0) r4 = syz_io_uring_setup(0x65dd, &(0x7f00000001c0)={0x0, 0xf46f, 0x20, 0x2, 0xdf}, &(0x7f0000ffe000/0x1000)=nil, &(0x7f0000ffd000/0x1000)=nil, &(0x7f0000000240), &(0x7f0000000280)) r5 = syz_genetlink_get_family_id$mptcp(&(0x7f0000000300), r3) sendmsg$MPTCP_PM_CMD_ADD_ADDR(r3, &(0x7f00000003c0)={&(0x7f00000002c0)={0x10, 0x0, 0x0, 0x10}, 0xc, &(0x7f0000000380)={&(0x7f0000000340)={0x24, r5, 0x300, 0x70bd26, 0x25dfdbfb, {}, [@MPTCP_PM_ATTR_SUBFLOWS={0x8, 0x3, 0x1}, @MPTCP_PM_ATTR_RCV_ADD_ADDRS={0x8, 0x2, 0x2}]}, 0x24}, 0x1, 0x0, 0x0, 0x20000004}, 0x8890) r6 = openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000500)='./cgroup/syz1\x00', 0x200002, 0x0) syz_io_uring_submit(0x0, r2, &(0x7f0000000580)=@IORING_OP_FILES_UPDATE={0x14, 0x4, 0x0, 0x0, 0x40, &(0x7f0000000540)=[r4, 0xffffffffffffffff, r6, r0, r1], 0x5}, 0x3) io_uring_setup(0x2812, &(0x7f00000005c0)={0x0, 0x5e1b, 0x2, 0x3, 0x12f, 0x0, r4}) socket$inet6_tcp(0xa, 0x1, 0x0) openat$procfs(0xffffffffffffff9c, &(0x7f00000010c0)='/proc/crypto\x00', 0x0, 0x0) io_uring_setup(0x7c8f, &(0x7f0000001140)={0x0, 0xc240, 0x10, 0x3, 0x1c7, 0x0, r4}) 21:15:57 executing program 7: write$P9_RSYMLINK(0xffffffffffffffff, &(0x7f0000000000)={0x14, 0x11, 0x2, {0x40, 0x3, 0x2}}, 0x14) ioctl$sock_ifreq(0xffffffffffffffff, 0x8935, &(0x7f0000000040)={'lo\x00', @ifru_addrs=@ethernet}) ioctl$sock_ifreq(0xffffffffffffffff, 0x8994, &(0x7f0000000080)={'ip6gretap0\x00', @ifru_flags}) sendmsg$IPSET_CMD_FLUSH(0xffffffffffffffff, &(0x7f0000000180)={&(0x7f00000000c0)={0x10, 0x0, 0x0, 0x10000}, 0xc, &(0x7f0000000140)={&(0x7f0000000100)={0x3c, 0x4, 0x6, 0x801, 0x0, 0x0, {0x3, 0x0, 0x4}, [@IPSET_ATTR_PROTOCOL={0x5}, @IPSET_ATTR_SETNAME={0x9, 0x2, 'syz0\x00'}, @IPSET_ATTR_SETNAME={0x9, 0x2, 'syz2\x00'}, @IPSET_ATTR_PROTOCOL={0x5}]}, 0x3c}}, 0x20000000) write$P9_RVERSION(0xffffffffffffffff, &(0x7f00000001c0)={0x13, 0x65, 0xffff, 0x3, 0x6, '9P2000'}, 0x13) pipe2$9p(&(0x7f0000000200), 0x0) add_key$fscrypt_v1(&(0x7f0000000280), &(0x7f00000002c0)={'fscrypt:', @desc2}, &(0x7f0000000300)={0x0, "ccf022eeb1aa5b4a9067674b5b7079352411c35248e190415959cbe4b7be99236abd831288583a8ed4db4b7b3f838c24d293f908bf3509b49f2c17852201f646", 0x19}, 0x48, 0xfffffffffffffffa) syz_genetlink_get_family_id$mptcp(&(0x7f00000004c0), 0xffffffffffffffff) openat$vcsa(0xffffffffffffff9c, &(0x7f00000009c0), 0x14200, 0x0) syz_genetlink_get_family_id$mptcp(&(0x7f0000000a80), 0xffffffffffffffff) 21:15:57 executing program 0: r0 = io_uring_setup(0x355e, &(0x7f0000000000)={0x0, 0x7682, 0x20, 0x1, 0x1be}) r1 = syz_io_uring_setup(0x8fe, &(0x7f0000000080)={0x0, 0x1830, 0x0, 0x0, 0x1b8, 0x0, r0}, &(0x7f0000ffb000/0x2000)=nil, &(0x7f0000ffb000/0x4000)=nil, &(0x7f0000000100), &(0x7f0000000140)=0x0) r3 = openat$hwrng(0xffffffffffffff9c, &(0x7f0000000180), 0x2, 0x0) r4 = syz_io_uring_setup(0x65dd, &(0x7f00000001c0)={0x0, 0xf46f, 0x20, 0x2, 0xdf}, &(0x7f0000ffe000/0x1000)=nil, &(0x7f0000ffd000/0x1000)=nil, &(0x7f0000000240), &(0x7f0000000280)) r5 = syz_genetlink_get_family_id$mptcp(&(0x7f0000000300), r3) sendmsg$MPTCP_PM_CMD_ADD_ADDR(r3, &(0x7f00000003c0)={&(0x7f00000002c0)={0x10, 0x0, 0x0, 0x10}, 0xc, &(0x7f0000000380)={&(0x7f0000000340)={0x24, r5, 0x300, 0x70bd26, 0x25dfdbfb, {}, [@MPTCP_PM_ATTR_SUBFLOWS={0x8, 0x3, 0x1}, @MPTCP_PM_ATTR_RCV_ADD_ADDRS={0x8, 0x2, 0x2}]}, 0x24}, 0x1, 0x0, 0x0, 0x20000004}, 0x8890) r6 = openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000500)='./cgroup/syz1\x00', 0x200002, 0x0) syz_io_uring_submit(0x0, r2, &(0x7f0000000580)=@IORING_OP_FILES_UPDATE={0x14, 0x4, 0x0, 0x0, 0x40, &(0x7f0000000540)=[r4, 0xffffffffffffffff, r6, r0, r1], 0x5}, 0x3) io_uring_setup(0x2812, &(0x7f00000005c0)={0x0, 0x5e1b, 0x2, 0x3, 0x12f, 0x0, r4}) socket$inet6_tcp(0xa, 0x1, 0x0) openat$procfs(0xffffffffffffff9c, &(0x7f00000010c0)='/proc/crypto\x00', 0x0, 0x0) io_uring_setup(0x7c8f, &(0x7f0000001140)={0x0, 0xc240, 0x10, 0x3, 0x1c7, 0x0, r4}) 21:15:57 executing program 6: r0 = io_uring_setup(0x355e, &(0x7f0000000000)={0x0, 0x7682, 0x20, 0x1, 0x1be}) r1 = syz_io_uring_setup(0x8fe, &(0x7f0000000080)={0x0, 0x1830, 0x0, 0x0, 0x1b8, 0x0, r0}, &(0x7f0000ffb000/0x2000)=nil, &(0x7f0000ffb000/0x4000)=nil, &(0x7f0000000100), &(0x7f0000000140)=0x0) r3 = openat$hwrng(0xffffffffffffff9c, &(0x7f0000000180), 0x2, 0x0) r4 = syz_io_uring_setup(0x65dd, &(0x7f00000001c0)={0x0, 0xf46f, 0x20, 0x2, 0xdf}, &(0x7f0000ffe000/0x1000)=nil, &(0x7f0000ffd000/0x1000)=nil, &(0x7f0000000240), &(0x7f0000000280)) r5 = syz_genetlink_get_family_id$mptcp(&(0x7f0000000300), r3) sendmsg$MPTCP_PM_CMD_ADD_ADDR(r3, &(0x7f00000003c0)={&(0x7f00000002c0)={0x10, 0x0, 0x0, 0x10}, 0xc, &(0x7f0000000380)={&(0x7f0000000340)={0x24, r5, 0x300, 0x70bd26, 0x25dfdbfb, {}, [@MPTCP_PM_ATTR_SUBFLOWS={0x8, 0x3, 0x1}, @MPTCP_PM_ATTR_RCV_ADD_ADDRS={0x8, 0x2, 0x2}]}, 0x24}, 0x1, 0x0, 0x0, 0x20000004}, 0x8890) syz_io_uring_setup(0x20f8, &(0x7f0000000400)={0x0, 0x7677, 0x8, 0x3, 0x22f, 0x0, r4}, &(0x7f0000ffe000/0x2000)=nil, &(0x7f0000ffb000/0x2000)=nil, &(0x7f0000000480)=0x0, &(0x7f00000004c0)) r7 = openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000500)='./cgroup/syz1\x00', 0x200002, 0x0) syz_io_uring_submit(r6, r2, &(0x7f0000000580)=@IORING_OP_FILES_UPDATE={0x14, 0x4, 0x0, 0x0, 0x40, &(0x7f0000000540)=[r4, 0xffffffffffffffff, r7, r0, r1], 0x5}, 0x3) openat$procfs(0xffffffffffffff9c, &(0x7f00000010c0)='/proc/crypto\x00', 0x0, 0x0) io_uring_setup(0x7c8f, &(0x7f0000001140)={0x0, 0xc240, 0x10, 0x3, 0x1c7, 0x0, r4}) 21:15:57 executing program 1: r0 = io_uring_setup(0x355e, &(0x7f0000000000)={0x0, 0x7682, 0x20, 0x1, 0x1be}) r1 = syz_io_uring_setup(0x8fe, &(0x7f0000000080)={0x0, 0x1830, 0x0, 0x0, 0x1b8, 0x0, r0}, &(0x7f0000ffb000/0x2000)=nil, &(0x7f0000ffb000/0x4000)=nil, &(0x7f0000000100), &(0x7f0000000140)=0x0) r3 = openat$hwrng(0xffffffffffffff9c, &(0x7f0000000180), 0x2, 0x0) r4 = syz_io_uring_setup(0x65dd, &(0x7f00000001c0)={0x0, 0xf46f, 0x20, 0x2, 0xdf}, &(0x7f0000ffe000/0x1000)=nil, &(0x7f0000ffd000/0x1000)=nil, &(0x7f0000000240), &(0x7f0000000280)) syz_genetlink_get_family_id$mptcp(&(0x7f0000000300), r3) syz_io_uring_setup(0x20f8, &(0x7f0000000400)={0x0, 0x7677, 0x8, 0x3, 0x22f, 0x0, r4}, &(0x7f0000ffe000/0x2000)=nil, &(0x7f0000ffb000/0x2000)=nil, &(0x7f0000000480)=0x0, &(0x7f00000004c0)) r6 = openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000500)='./cgroup/syz1\x00', 0x200002, 0x0) syz_io_uring_submit(r5, r2, &(0x7f0000000580)=@IORING_OP_FILES_UPDATE={0x14, 0x4, 0x0, 0x0, 0x40, &(0x7f0000000540)=[r4, 0xffffffffffffffff, r6, r0, r1], 0x5}, 0x3) io_uring_setup(0x2812, &(0x7f00000005c0)={0x0, 0x5e1b, 0x2, 0x3, 0x12f, 0x0, r4}) socket$inet6_tcp(0xa, 0x1, 0x0) openat$procfs(0xffffffffffffff9c, &(0x7f00000010c0)='/proc/crypto\x00', 0x0, 0x0) io_uring_setup(0x7c8f, &(0x7f0000001140)={0x0, 0xc240, 0x10, 0x3, 0x1c7, 0x0, r4}) [ 287.148731] kmemleak: Found object by alias at 0x607f1a6398ac [ 287.148771] CPU: 0 UID: 0 PID: 4942 Comm: syz-executor.3 Tainted: G W 6.17.0-rc3-next-20250829 #1 PREEMPT(voluntary) [ 287.148807] Tainted: [W]=WARN [ 287.148814] Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.12.0-1 04/01/2014 [ 287.148827] Call Trace: [ 287.148835] [ 287.148844] dump_stack_lvl+0xca/0x120 [ 287.148886] __lookup_object+0x94/0xb0 [ 287.148918] delete_object_full+0x27/0x70 [ 287.148949] free_percpu+0x30/0x1160 [ 287.148980] ? arch_uprobe_clear_state+0x16/0x140 [ 287.149018] futex_hash_free+0x38/0xc0 [ 287.149045] mmput+0x2d3/0x390 [ 287.149080] do_exit+0x79d/0x2970 [ 287.149106] ? signal_wake_up_state+0x85/0x120 [ 287.149136] ? zap_other_threads+0x2b9/0x3a0 [ 287.149167] ? __pfx_do_exit+0x10/0x10 [ 287.149193] ? do_group_exit+0x1c3/0x2a0 [ 287.149219] ? lock_release+0xc8/0x290 [ 287.149252] do_group_exit+0xd3/0x2a0 [ 287.149282] __x64_sys_exit_group+0x3e/0x50 [ 287.149309] x64_sys_call+0x18c5/0x18d0 [ 287.149339] do_syscall_64+0xbf/0x360 [ 287.149361] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 287.149384] RIP: 0033:0x7f1060a76b19 [ 287.149400] Code: Unable to access opcode bytes at 0x7f1060a76aef. [ 287.149410] RSP: 002b:00007ffed3f8b6d8 EFLAGS: 00000246 ORIG_RAX: 00000000000000e7 [ 287.149433] RAX: ffffffffffffffda RBX: 000000000000001e RCX: 00007f1060a76b19 [ 287.149447] RDX: 00007f1060a2972b RSI: ffffffffffffffbc RDI: 0000000000000000 [ 287.149462] RBP: 0000000000000000 R08: 0000001b2da2ce5c R09: 0000000000000000 [ 287.149475] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 287.149488] R13: 0000000000000000 R14: 0000000000000001 R15: 00007ffed3f8b7c0 [ 287.149519] [ 287.149527] kmemleak: Object (percpu) 0x607f1a6398a8 (size 8): [ 287.149540] kmemleak: comm "syz-executor.1", pid 4970, jiffies 4294953999 [ 287.149554] kmemleak: min_count = 1 [ 287.149561] kmemleak: count = 0 [ 287.149568] kmemleak: flags = 0x21 [ 287.149576] kmemleak: checksum = 0 [ 287.149583] kmemleak: backtrace: [ 287.149589] pcpu_alloc_noprof+0x87a/0x1170 [ 287.149619] percpu_ref_init+0x37/0x400 [ 287.149653] io_uring_setup+0x44c/0x2000 [ 287.149674] __x64_sys_io_uring_setup+0xc8/0x170 [ 287.149696] do_syscall_64+0xbf/0x360 [ 287.149713] entry_SYSCALL_64_after_hwframe+0x77/0x7f 21:16:06 executing program 5: r0 = io_uring_setup(0x355e, &(0x7f0000000000)={0x0, 0x7682, 0x20, 0x1, 0x1be}) r1 = syz_io_uring_setup(0x8fe, &(0x7f0000000080)={0x0, 0x1830, 0x0, 0x0, 0x1b8, 0x0, r0}, &(0x7f0000ffb000/0x2000)=nil, &(0x7f0000ffb000/0x4000)=nil, &(0x7f0000000100), &(0x7f0000000140)=0x0) r3 = openat$hwrng(0xffffffffffffff9c, &(0x7f0000000180), 0x2, 0x0) r4 = syz_io_uring_setup(0x65dd, &(0x7f00000001c0)={0x0, 0xf46f, 0x20, 0x2, 0xdf}, &(0x7f0000ffe000/0x1000)=nil, &(0x7f0000ffd000/0x1000)=nil, &(0x7f0000000240), &(0x7f0000000280)) r5 = syz_genetlink_get_family_id$mptcp(&(0x7f0000000300), r3) sendmsg$MPTCP_PM_CMD_ADD_ADDR(r3, &(0x7f00000003c0)={&(0x7f00000002c0)={0x10, 0x0, 0x0, 0x10}, 0xc, &(0x7f0000000380)={&(0x7f0000000340)={0x24, r5, 0x300, 0x70bd26, 0x25dfdbfb, {}, [@MPTCP_PM_ATTR_SUBFLOWS={0x8, 0x3, 0x1}, @MPTCP_PM_ATTR_RCV_ADD_ADDRS={0x8, 0x2, 0x2}]}, 0x24}, 0x1, 0x0, 0x0, 0x20000004}, 0x8890) syz_io_uring_setup(0x20f8, &(0x7f0000000400)={0x0, 0x7677, 0x8, 0x3, 0x22f, 0x0, r4}, &(0x7f0000ffe000/0x2000)=nil, &(0x7f0000ffb000/0x2000)=nil, &(0x7f0000000480)=0x0, &(0x7f00000004c0)) r7 = openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000500)='./cgroup/syz1\x00', 0x200002, 0x0) syz_io_uring_submit(r6, r2, &(0x7f0000000580)=@IORING_OP_FILES_UPDATE={0x14, 0x4, 0x0, 0x0, 0x40, &(0x7f0000000540)=[r4, 0xffffffffffffffff, r7, r0, r1], 0x5}, 0x3) socket$inet6_tcp(0xa, 0x1, 0x0) 21:16:06 executing program 4: ioctl$SCSI_IOCTL_DOORUNLOCK(0xffffffffffffffff, 0x5381) r0 = syz_open_dev$mouse(&(0x7f0000000000), 0x578, 0x4000) ioctl$SG_GET_PACK_ID(r0, 0x227c, &(0x7f0000000040)) r1 = syz_genetlink_get_family_id$nl80211(&(0x7f00000000c0), r0) sendmsg$NL80211_CMD_NEW_KEY(r0, &(0x7f00000001c0)={&(0x7f0000000080)={0x10, 0x0, 0x0, 0x10}, 0xc, &(0x7f0000000180)={&(0x7f0000000100)={0x60, r1, 0x400, 0x70bd2b, 0x25dfdbff, {{}, {@val={0x8}, @void}}, [@NL80211_ATTR_KEY_TYPE={0x8, 0x37, 0x1}, @NL80211_ATTR_KEY_DEFAULT_MGMT={0x4}, @NL80211_ATTR_KEY={0x2c, 0x50, 0x0, 0x1, [@NL80211_KEY_DATA_WEP40={0x9, 0x1, "93f3c5ad5d"}, @NL80211_KEY_DEFAULT_TYPES={0x8, 0x8, 0x0, 0x1, [@NL80211_KEY_DEFAULT_TYPE_MULTICAST={0x4}]}, @NL80211_KEY_DATA_WEP104={0x11, 0x1, "8815558ac60368b42ebdf03bdb"}]}, @NL80211_ATTR_KEY_DATA_WEP40={0x9, 0x7, "74de692476"}]}, 0x60}, 0x1, 0x0, 0x0, 0x4000000}, 0x8000) openat$procfs(0xffffffffffffff9c, &(0x7f0000000200)='/proc/stat\x00', 0x0, 0x0) syz_open_dev$vcsa(&(0x7f0000000440), 0x56, 0x4000) socketpair(0x0, 0x3, 0x6, &(0x7f0000000640)) write$tcp_congestion(0xffffffffffffffff, &(0x7f0000000840)='htcp\x00', 0x5) 21:16:06 executing program 1: r0 = io_uring_setup(0x355e, &(0x7f0000000000)={0x0, 0x7682, 0x20, 0x1, 0x1be}) r1 = syz_io_uring_setup(0x8fe, &(0x7f0000000080)={0x0, 0x1830, 0x0, 0x0, 0x1b8, 0x0, r0}, &(0x7f0000ffb000/0x2000)=nil, &(0x7f0000ffb000/0x4000)=nil, &(0x7f0000000100), &(0x7f0000000140)=0x0) r3 = openat$hwrng(0xffffffffffffff9c, &(0x7f0000000180), 0x2, 0x0) r4 = syz_io_uring_setup(0x65dd, &(0x7f00000001c0)={0x0, 0xf46f, 0x20, 0x2, 0xdf}, &(0x7f0000ffe000/0x1000)=nil, &(0x7f0000ffd000/0x1000)=nil, &(0x7f0000000240), &(0x7f0000000280)) syz_genetlink_get_family_id$mptcp(&(0x7f0000000300), r3) syz_io_uring_setup(0x20f8, &(0x7f0000000400)={0x0, 0x7677, 0x8, 0x3, 0x22f, 0x0, r4}, &(0x7f0000ffe000/0x2000)=nil, &(0x7f0000ffb000/0x2000)=nil, &(0x7f0000000480)=0x0, &(0x7f00000004c0)) r6 = openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000500)='./cgroup/syz1\x00', 0x200002, 0x0) syz_io_uring_submit(r5, r2, &(0x7f0000000580)=@IORING_OP_FILES_UPDATE={0x14, 0x4, 0x0, 0x0, 0x40, &(0x7f0000000540)=[r4, 0xffffffffffffffff, r6, r0, r1], 0x5}, 0x3) io_uring_setup(0x2812, &(0x7f00000005c0)={0x0, 0x5e1b, 0x2, 0x3, 0x12f, 0x0, r4}) socket$inet6_tcp(0xa, 0x1, 0x0) openat$procfs(0xffffffffffffff9c, &(0x7f00000010c0)='/proc/crypto\x00', 0x0, 0x0) io_uring_setup(0x7c8f, &(0x7f0000001140)={0x0, 0xc240, 0x10, 0x3, 0x1c7, 0x0, r4}) 21:16:06 executing program 6: r0 = io_uring_setup(0x355e, &(0x7f0000000000)={0x0, 0x7682, 0x20, 0x1, 0x1be}) r1 = syz_io_uring_setup(0x8fe, &(0x7f0000000080)={0x0, 0x1830, 0x0, 0x0, 0x1b8, 0x0, r0}, &(0x7f0000ffb000/0x2000)=nil, &(0x7f0000ffb000/0x4000)=nil, &(0x7f0000000100), &(0x7f0000000140)=0x0) r3 = openat$hwrng(0xffffffffffffff9c, &(0x7f0000000180), 0x2, 0x0) r4 = syz_io_uring_setup(0x65dd, &(0x7f00000001c0)={0x0, 0xf46f, 0x20, 0x2, 0xdf}, &(0x7f0000ffe000/0x1000)=nil, &(0x7f0000ffd000/0x1000)=nil, &(0x7f0000000240), &(0x7f0000000280)) r5 = syz_genetlink_get_family_id$mptcp(&(0x7f0000000300), r3) sendmsg$MPTCP_PM_CMD_ADD_ADDR(r3, &(0x7f00000003c0)={&(0x7f00000002c0)={0x10, 0x0, 0x0, 0x10}, 0xc, &(0x7f0000000380)={&(0x7f0000000340)={0x24, r5, 0x300, 0x70bd26, 0x25dfdbfb, {}, [@MPTCP_PM_ATTR_SUBFLOWS={0x8, 0x3, 0x1}, @MPTCP_PM_ATTR_RCV_ADD_ADDRS={0x8, 0x2, 0x2}]}, 0x24}, 0x1, 0x0, 0x0, 0x20000004}, 0x8890) syz_io_uring_setup(0x20f8, &(0x7f0000000400)={0x0, 0x7677, 0x8, 0x3, 0x22f, 0x0, r4}, &(0x7f0000ffe000/0x2000)=nil, &(0x7f0000ffb000/0x2000)=nil, &(0x7f0000000480)=0x0, &(0x7f00000004c0)) r7 = openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000500)='./cgroup/syz1\x00', 0x200002, 0x0) syz_io_uring_submit(r6, r2, &(0x7f0000000580)=@IORING_OP_FILES_UPDATE={0x14, 0x4, 0x0, 0x0, 0x40, &(0x7f0000000540)=[r4, 0xffffffffffffffff, r7, r0, r1], 0x5}, 0x3) openat$procfs(0xffffffffffffff9c, &(0x7f00000010c0)='/proc/crypto\x00', 0x0, 0x0) io_uring_setup(0x7c8f, &(0x7f0000001140)={0x0, 0xc240, 0x10, 0x3, 0x1c7, 0x0, r4}) 21:16:06 executing program 0: r0 = io_uring_setup(0x355e, &(0x7f0000000000)={0x0, 0x7682, 0x20, 0x1, 0x1be}) r1 = syz_io_uring_setup(0x8fe, &(0x7f0000000080)={0x0, 0x1830, 0x0, 0x0, 0x1b8, 0x0, r0}, &(0x7f0000ffb000/0x2000)=nil, &(0x7f0000ffb000/0x4000)=nil, &(0x7f0000000100), &(0x7f0000000140)=0x0) r3 = openat$hwrng(0xffffffffffffff9c, &(0x7f0000000180), 0x2, 0x0) r4 = syz_io_uring_setup(0x65dd, &(0x7f00000001c0)={0x0, 0xf46f, 0x20, 0x2, 0xdf}, &(0x7f0000ffe000/0x1000)=nil, &(0x7f0000ffd000/0x1000)=nil, &(0x7f0000000240), &(0x7f0000000280)) r5 = syz_genetlink_get_family_id$mptcp(&(0x7f0000000300), r3) sendmsg$MPTCP_PM_CMD_ADD_ADDR(r3, &(0x7f00000003c0)={&(0x7f00000002c0)={0x10, 0x0, 0x0, 0x10}, 0xc, &(0x7f0000000380)={&(0x7f0000000340)={0x24, r5, 0x300, 0x70bd26, 0x25dfdbfb, {}, [@MPTCP_PM_ATTR_SUBFLOWS={0x8, 0x3, 0x1}, @MPTCP_PM_ATTR_RCV_ADD_ADDRS={0x8, 0x2, 0x2}]}, 0x24}, 0x1, 0x0, 0x0, 0x20000004}, 0x8890) r6 = openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000500)='./cgroup/syz1\x00', 0x200002, 0x0) syz_io_uring_submit(0x0, r2, &(0x7f0000000580)=@IORING_OP_FILES_UPDATE={0x14, 0x4, 0x0, 0x0, 0x40, &(0x7f0000000540)=[r4, 0xffffffffffffffff, r6, r0, r1], 0x5}, 0x3) io_uring_setup(0x2812, &(0x7f00000005c0)={0x0, 0x5e1b, 0x2, 0x3, 0x12f, 0x0, r4}) socket$inet6_tcp(0xa, 0x1, 0x0) openat$procfs(0xffffffffffffff9c, &(0x7f00000010c0)='/proc/crypto\x00', 0x0, 0x0) io_uring_setup(0x7c8f, &(0x7f0000001140)={0x0, 0xc240, 0x10, 0x3, 0x1c7, 0x0, r4}) 21:16:06 executing program 3: r0 = io_uring_setup(0x355e, &(0x7f0000000000)={0x0, 0x7682, 0x20, 0x1, 0x1be}) r1 = syz_io_uring_setup(0x8fe, &(0x7f0000000080)={0x0, 0x1830, 0x0, 0x0, 0x1b8, 0x0, r0}, &(0x7f0000ffb000/0x2000)=nil, &(0x7f0000ffb000/0x4000)=nil, &(0x7f0000000100), &(0x7f0000000140)=0x0) r3 = openat$hwrng(0xffffffffffffff9c, &(0x7f0000000180), 0x2, 0x0) r4 = syz_io_uring_setup(0x65dd, &(0x7f00000001c0)={0x0, 0xf46f, 0x20, 0x2, 0xdf}, &(0x7f0000ffe000/0x1000)=nil, &(0x7f0000ffd000/0x1000)=nil, &(0x7f0000000240), &(0x7f0000000280)) r5 = syz_genetlink_get_family_id$mptcp(&(0x7f0000000300), r3) sendmsg$MPTCP_PM_CMD_ADD_ADDR(r3, &(0x7f00000003c0)={&(0x7f00000002c0)={0x10, 0x0, 0x0, 0x10}, 0xc, &(0x7f0000000380)={&(0x7f0000000340)={0x24, r5, 0x300, 0x70bd26, 0x25dfdbfb, {}, [@MPTCP_PM_ATTR_SUBFLOWS={0x8, 0x3, 0x1}, @MPTCP_PM_ATTR_RCV_ADD_ADDRS={0x8, 0x2, 0x2}]}, 0x24}, 0x1, 0x0, 0x0, 0x20000004}, 0x8890) r6 = openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000500)='./cgroup/syz1\x00', 0x200002, 0x0) syz_io_uring_submit(0x0, r2, &(0x7f0000000580)=@IORING_OP_FILES_UPDATE={0x14, 0x4, 0x0, 0x0, 0x40, &(0x7f0000000540)=[r4, 0xffffffffffffffff, r6, r0, r1], 0x5}, 0x3) io_uring_setup(0x2812, &(0x7f00000005c0)={0x0, 0x5e1b, 0x2, 0x3, 0x12f, 0x0, r4}) socket$inet6_tcp(0xa, 0x1, 0x0) openat$procfs(0xffffffffffffff9c, &(0x7f00000010c0)='/proc/crypto\x00', 0x0, 0x0) io_uring_setup(0x7c8f, &(0x7f0000001140)={0x0, 0xc240, 0x10, 0x3, 0x1c7, 0x0, r4}) 21:16:06 executing program 7: write$P9_RSYMLINK(0xffffffffffffffff, &(0x7f0000000000)={0x14, 0x11, 0x2, {0x40, 0x3, 0x2}}, 0x14) ioctl$sock_ifreq(0xffffffffffffffff, 0x8935, &(0x7f0000000040)={'lo\x00', @ifru_addrs=@ethernet}) ioctl$sock_ifreq(0xffffffffffffffff, 0x8994, &(0x7f0000000080)={'ip6gretap0\x00', @ifru_flags}) sendmsg$IPSET_CMD_FLUSH(0xffffffffffffffff, &(0x7f0000000180)={&(0x7f00000000c0)={0x10, 0x0, 0x0, 0x10000}, 0xc, &(0x7f0000000140)={&(0x7f0000000100)={0x3c, 0x4, 0x6, 0x801, 0x0, 0x0, {0x3, 0x0, 0x4}, [@IPSET_ATTR_PROTOCOL={0x5}, @IPSET_ATTR_SETNAME={0x9, 0x2, 'syz0\x00'}, @IPSET_ATTR_SETNAME={0x9, 0x2, 'syz2\x00'}, @IPSET_ATTR_PROTOCOL={0x5}]}, 0x3c}}, 0x20000000) write$P9_RVERSION(0xffffffffffffffff, &(0x7f00000001c0)={0x13, 0x65, 0xffff, 0x3, 0x6, '9P2000'}, 0x13) write$P9_RSYMLINK(0xffffffffffffffff, &(0x7f0000000240)={0x14, 0x11, 0x1, {0x1, 0x3, 0x2}}, 0x14) add_key$fscrypt_v1(&(0x7f0000000280), &(0x7f00000002c0)={'fscrypt:', @desc2}, &(0x7f0000000300)={0x0, "ccf022eeb1aa5b4a9067674b5b7079352411c35248e190415959cbe4b7be99236abd831288583a8ed4db4b7b3f838c24d293f908bf3509b49f2c17852201f646", 0x19}, 0x48, 0xfffffffffffffffa) syz_genetlink_get_family_id$mptcp(&(0x7f00000004c0), 0xffffffffffffffff) openat$vcsa(0xffffffffffffff9c, &(0x7f00000009c0), 0x14200, 0x0) syz_genetlink_get_family_id$mptcp(&(0x7f0000000a80), 0xffffffffffffffff) 21:16:06 executing program 2: syz_genetlink_get_family_id$nl80211(&(0x7f00000000c0), 0xffffffffffffffff) syz_open_dev$vcsa(&(0x7f0000000440), 0x56, 0x4000) socketpair(0x0, 0x3, 0x6, &(0x7f0000000640)) r0 = openat$tcp_congestion(0xffffffffffffff9c, &(0x7f0000000800), 0x1, 0x0) write$tcp_congestion(r0, &(0x7f0000000840)='htcp\x00', 0x5) 21:16:06 executing program 1: r0 = io_uring_setup(0x355e, &(0x7f0000000000)={0x0, 0x7682, 0x20, 0x1, 0x1be}) r1 = syz_io_uring_setup(0x8fe, &(0x7f0000000080)={0x0, 0x1830, 0x0, 0x0, 0x1b8, 0x0, r0}, &(0x7f0000ffb000/0x2000)=nil, &(0x7f0000ffb000/0x4000)=nil, &(0x7f0000000100), &(0x7f0000000140)=0x0) openat$hwrng(0xffffffffffffff9c, &(0x7f0000000180), 0x2, 0x0) r3 = syz_io_uring_setup(0x65dd, &(0x7f00000001c0)={0x0, 0xf46f, 0x20, 0x2, 0xdf}, &(0x7f0000ffe000/0x1000)=nil, &(0x7f0000ffd000/0x1000)=nil, &(0x7f0000000240), &(0x7f0000000280)) syz_io_uring_setup(0x20f8, &(0x7f0000000400)={0x0, 0x7677, 0x8, 0x3, 0x22f, 0x0, r3}, &(0x7f0000ffe000/0x2000)=nil, &(0x7f0000ffb000/0x2000)=nil, &(0x7f0000000480)=0x0, &(0x7f00000004c0)) r5 = openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000500)='./cgroup/syz1\x00', 0x200002, 0x0) syz_io_uring_submit(r4, r2, &(0x7f0000000580)=@IORING_OP_FILES_UPDATE={0x14, 0x4, 0x0, 0x0, 0x40, &(0x7f0000000540)=[r3, 0xffffffffffffffff, r5, r0, r1], 0x5}, 0x3) io_uring_setup(0x2812, &(0x7f00000005c0)={0x0, 0x5e1b, 0x2, 0x3, 0x12f, 0x0, r3}) socket$inet6_tcp(0xa, 0x1, 0x0) openat$procfs(0xffffffffffffff9c, &(0x7f00000010c0)='/proc/crypto\x00', 0x0, 0x0) io_uring_setup(0x7c8f, &(0x7f0000001140)={0x0, 0xc240, 0x10, 0x3, 0x1c7, 0x0, r3}) 21:16:06 executing program 5: r0 = io_uring_setup(0x355e, &(0x7f0000000000)={0x0, 0x7682, 0x20, 0x1, 0x1be}) r1 = syz_io_uring_setup(0x8fe, &(0x7f0000000080)={0x0, 0x1830, 0x0, 0x0, 0x1b8, 0x0, r0}, &(0x7f0000ffb000/0x2000)=nil, &(0x7f0000ffb000/0x4000)=nil, &(0x7f0000000100), &(0x7f0000000140)=0x0) r3 = openat$hwrng(0xffffffffffffff9c, &(0x7f0000000180), 0x2, 0x0) r4 = syz_io_uring_setup(0x65dd, &(0x7f00000001c0)={0x0, 0xf46f, 0x20, 0x2, 0xdf}, &(0x7f0000ffe000/0x1000)=nil, &(0x7f0000ffd000/0x1000)=nil, &(0x7f0000000240), &(0x7f0000000280)) r5 = syz_genetlink_get_family_id$mptcp(&(0x7f0000000300), r3) sendmsg$MPTCP_PM_CMD_ADD_ADDR(r3, &(0x7f00000003c0)={&(0x7f00000002c0)={0x10, 0x0, 0x0, 0x10}, 0xc, &(0x7f0000000380)={&(0x7f0000000340)={0x24, r5, 0x300, 0x70bd26, 0x25dfdbfb, {}, [@MPTCP_PM_ATTR_SUBFLOWS={0x8, 0x3, 0x1}, @MPTCP_PM_ATTR_RCV_ADD_ADDRS={0x8, 0x2, 0x2}]}, 0x24}, 0x1, 0x0, 0x0, 0x20000004}, 0x8890) syz_io_uring_setup(0x20f8, &(0x7f0000000400)={0x0, 0x7677, 0x8, 0x3, 0x22f, 0x0, r4}, &(0x7f0000ffe000/0x2000)=nil, &(0x7f0000ffb000/0x2000)=nil, &(0x7f0000000480)=0x0, &(0x7f00000004c0)) r7 = openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000500)='./cgroup/syz1\x00', 0x200002, 0x0) syz_io_uring_submit(r6, r2, &(0x7f0000000580)=@IORING_OP_FILES_UPDATE={0x14, 0x4, 0x0, 0x0, 0x40, &(0x7f0000000540)=[r4, 0xffffffffffffffff, r7, r0, r1], 0x5}, 0x3) socket$inet6_tcp(0xa, 0x1, 0x0) 21:16:06 executing program 1: r0 = io_uring_setup(0x355e, &(0x7f0000000000)={0x0, 0x7682, 0x20, 0x1, 0x1be}) r1 = syz_io_uring_setup(0x8fe, &(0x7f0000000080)={0x0, 0x1830, 0x0, 0x0, 0x1b8, 0x0, r0}, &(0x7f0000ffb000/0x2000)=nil, &(0x7f0000ffb000/0x4000)=nil, &(0x7f0000000100), &(0x7f0000000140)=0x0) openat$hwrng(0xffffffffffffff9c, &(0x7f0000000180), 0x2, 0x0) r3 = syz_io_uring_setup(0x65dd, &(0x7f00000001c0)={0x0, 0xf46f, 0x20, 0x2, 0xdf}, &(0x7f0000ffe000/0x1000)=nil, &(0x7f0000ffd000/0x1000)=nil, &(0x7f0000000240), &(0x7f0000000280)) syz_io_uring_setup(0x20f8, &(0x7f0000000400)={0x0, 0x7677, 0x8, 0x3, 0x22f, 0x0, r3}, &(0x7f0000ffe000/0x2000)=nil, &(0x7f0000ffb000/0x2000)=nil, &(0x7f0000000480)=0x0, &(0x7f00000004c0)) r5 = openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000500)='./cgroup/syz1\x00', 0x200002, 0x0) syz_io_uring_submit(r4, r2, &(0x7f0000000580)=@IORING_OP_FILES_UPDATE={0x14, 0x4, 0x0, 0x0, 0x40, &(0x7f0000000540)=[r3, 0xffffffffffffffff, r5, r0, r1], 0x5}, 0x3) io_uring_setup(0x2812, &(0x7f00000005c0)={0x0, 0x5e1b, 0x2, 0x3, 0x12f, 0x0, r3}) socket$inet6_tcp(0xa, 0x1, 0x0) openat$procfs(0xffffffffffffff9c, &(0x7f00000010c0)='/proc/crypto\x00', 0x0, 0x0) io_uring_setup(0x7c8f, &(0x7f0000001140)={0x0, 0xc240, 0x10, 0x3, 0x1c7, 0x0, r3}) 21:16:06 executing program 6: r0 = io_uring_setup(0x355e, &(0x7f0000000000)={0x0, 0x7682, 0x20, 0x1, 0x1be}) r1 = syz_io_uring_setup(0x8fe, &(0x7f0000000080)={0x0, 0x1830, 0x0, 0x0, 0x1b8, 0x0, r0}, &(0x7f0000ffb000/0x2000)=nil, &(0x7f0000ffb000/0x4000)=nil, &(0x7f0000000100), &(0x7f0000000140)=0x0) r3 = openat$hwrng(0xffffffffffffff9c, &(0x7f0000000180), 0x2, 0x0) r4 = syz_io_uring_setup(0x65dd, &(0x7f00000001c0)={0x0, 0xf46f, 0x20, 0x2, 0xdf}, &(0x7f0000ffe000/0x1000)=nil, &(0x7f0000ffd000/0x1000)=nil, &(0x7f0000000240), &(0x7f0000000280)) r5 = syz_genetlink_get_family_id$mptcp(&(0x7f0000000300), r3) sendmsg$MPTCP_PM_CMD_ADD_ADDR(r3, &(0x7f00000003c0)={&(0x7f00000002c0)={0x10, 0x0, 0x0, 0x10}, 0xc, &(0x7f0000000380)={&(0x7f0000000340)={0x24, r5, 0x300, 0x70bd26, 0x25dfdbfb, {}, [@MPTCP_PM_ATTR_SUBFLOWS={0x8, 0x3, 0x1}, @MPTCP_PM_ATTR_RCV_ADD_ADDRS={0x8, 0x2, 0x2}]}, 0x24}, 0x1, 0x0, 0x0, 0x20000004}, 0x8890) syz_io_uring_setup(0x20f8, &(0x7f0000000400)={0x0, 0x7677, 0x8, 0x3, 0x22f, 0x0, r4}, &(0x7f0000ffe000/0x2000)=nil, &(0x7f0000ffb000/0x2000)=nil, &(0x7f0000000480)=0x0, &(0x7f00000004c0)) r7 = openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000500)='./cgroup/syz1\x00', 0x200002, 0x0) syz_io_uring_submit(r6, r2, &(0x7f0000000580)=@IORING_OP_FILES_UPDATE={0x14, 0x4, 0x0, 0x0, 0x40, &(0x7f0000000540)=[r4, 0xffffffffffffffff, r7, r0, r1], 0x5}, 0x3) openat$procfs(0xffffffffffffff9c, &(0x7f00000010c0)='/proc/crypto\x00', 0x0, 0x0) io_uring_setup(0x7c8f, &(0x7f0000001140)={0x0, 0xc240, 0x10, 0x3, 0x1c7, 0x0, r4}) 21:16:06 executing program 3: r0 = io_uring_setup(0x355e, &(0x7f0000000000)={0x0, 0x7682, 0x20, 0x1, 0x1be}) r1 = syz_io_uring_setup(0x8fe, &(0x7f0000000080)={0x0, 0x1830, 0x0, 0x0, 0x1b8, 0x0, r0}, &(0x7f0000ffb000/0x2000)=nil, &(0x7f0000ffb000/0x4000)=nil, &(0x7f0000000100), &(0x7f0000000140)=0x0) r3 = openat$hwrng(0xffffffffffffff9c, &(0x7f0000000180), 0x2, 0x0) r4 = syz_io_uring_setup(0x65dd, &(0x7f00000001c0)={0x0, 0xf46f, 0x20, 0x2, 0xdf}, &(0x7f0000ffe000/0x1000)=nil, &(0x7f0000ffd000/0x1000)=nil, &(0x7f0000000240), &(0x7f0000000280)) r5 = syz_genetlink_get_family_id$mptcp(&(0x7f0000000300), r3) sendmsg$MPTCP_PM_CMD_ADD_ADDR(r3, &(0x7f00000003c0)={&(0x7f00000002c0)={0x10, 0x0, 0x0, 0x10}, 0xc, &(0x7f0000000380)={&(0x7f0000000340)={0x24, r5, 0x300, 0x70bd26, 0x25dfdbfb, {}, [@MPTCP_PM_ATTR_SUBFLOWS={0x8, 0x3, 0x1}, @MPTCP_PM_ATTR_RCV_ADD_ADDRS={0x8, 0x2, 0x2}]}, 0x24}, 0x1, 0x0, 0x0, 0x20000004}, 0x8890) r6 = openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000500)='./cgroup/syz1\x00', 0x200002, 0x0) syz_io_uring_submit(0x0, r2, &(0x7f0000000580)=@IORING_OP_FILES_UPDATE={0x14, 0x4, 0x0, 0x0, 0x40, &(0x7f0000000540)=[r4, 0xffffffffffffffff, r6, r0, r1], 0x5}, 0x3) io_uring_setup(0x2812, &(0x7f00000005c0)={0x0, 0x5e1b, 0x2, 0x3, 0x12f, 0x0, r4}) socket$inet6_tcp(0xa, 0x1, 0x0) openat$procfs(0xffffffffffffff9c, &(0x7f00000010c0)='/proc/crypto\x00', 0x0, 0x0) 21:16:06 executing program 0: r0 = io_uring_setup(0x355e, &(0x7f0000000000)={0x0, 0x7682, 0x20, 0x1, 0x1be}) r1 = syz_io_uring_setup(0x8fe, &(0x7f0000000080)={0x0, 0x1830, 0x0, 0x0, 0x1b8, 0x0, r0}, &(0x7f0000ffb000/0x2000)=nil, &(0x7f0000ffb000/0x4000)=nil, &(0x7f0000000100), &(0x7f0000000140)=0x0) r3 = openat$hwrng(0xffffffffffffff9c, &(0x7f0000000180), 0x2, 0x0) r4 = syz_io_uring_setup(0x65dd, &(0x7f00000001c0)={0x0, 0xf46f, 0x20, 0x2, 0xdf}, &(0x7f0000ffe000/0x1000)=nil, &(0x7f0000ffd000/0x1000)=nil, &(0x7f0000000240), &(0x7f0000000280)) r5 = syz_genetlink_get_family_id$mptcp(&(0x7f0000000300), r3) sendmsg$MPTCP_PM_CMD_ADD_ADDR(r3, &(0x7f00000003c0)={&(0x7f00000002c0)={0x10, 0x0, 0x0, 0x10}, 0xc, &(0x7f0000000380)={&(0x7f0000000340)={0x24, r5, 0x300, 0x70bd26, 0x25dfdbfb, {}, [@MPTCP_PM_ATTR_SUBFLOWS={0x8, 0x3, 0x1}, @MPTCP_PM_ATTR_RCV_ADD_ADDRS={0x8, 0x2, 0x2}]}, 0x24}, 0x1, 0x0, 0x0, 0x20000004}, 0x8890) r6 = openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000500)='./cgroup/syz1\x00', 0x200002, 0x0) syz_io_uring_submit(0x0, r2, &(0x7f0000000580)=@IORING_OP_FILES_UPDATE={0x14, 0x4, 0x0, 0x0, 0x40, &(0x7f0000000540)=[r4, 0xffffffffffffffff, r6, r0, r1], 0x5}, 0x3) io_uring_setup(0x2812, &(0x7f00000005c0)={0x0, 0x5e1b, 0x2, 0x3, 0x12f, 0x0, r4}) socket$inet6_tcp(0xa, 0x1, 0x0) openat$procfs(0xffffffffffffff9c, &(0x7f00000010c0)='/proc/crypto\x00', 0x0, 0x0) 21:16:06 executing program 4: ioctl$SCSI_IOCTL_DOORUNLOCK(0xffffffffffffffff, 0x5381) r0 = syz_open_dev$mouse(&(0x7f0000000000), 0x578, 0x4000) ioctl$SG_GET_PACK_ID(r0, 0x227c, &(0x7f0000000040)) r1 = syz_genetlink_get_family_id$nl80211(&(0x7f00000000c0), r0) sendmsg$NL80211_CMD_NEW_KEY(r0, &(0x7f00000001c0)={&(0x7f0000000080)={0x10, 0x0, 0x0, 0x10}, 0xc, &(0x7f0000000180)={&(0x7f0000000100)={0x60, r1, 0x400, 0x70bd2b, 0x25dfdbff, {{}, {@val={0x8}, @void}}, [@NL80211_ATTR_KEY_TYPE={0x8, 0x37, 0x1}, @NL80211_ATTR_KEY_DEFAULT_MGMT={0x4}, @NL80211_ATTR_KEY={0x2c, 0x50, 0x0, 0x1, [@NL80211_KEY_DATA_WEP40={0x9, 0x1, "93f3c5ad5d"}, @NL80211_KEY_DEFAULT_TYPES={0x8, 0x8, 0x0, 0x1, [@NL80211_KEY_DEFAULT_TYPE_MULTICAST={0x4}]}, @NL80211_KEY_DATA_WEP104={0x11, 0x1, "8815558ac60368b42ebdf03bdb"}]}, @NL80211_ATTR_KEY_DATA_WEP40={0x9, 0x7, "74de692476"}]}, 0x60}, 0x1, 0x0, 0x0, 0x4000000}, 0x8000) openat$procfs(0xffffffffffffff9c, &(0x7f0000000200)='/proc/stat\x00', 0x0, 0x0) syz_open_dev$vcsa(&(0x7f0000000440), 0x56, 0x4000) socketpair(0x0, 0x3, 0x6, &(0x7f0000000640)) write$tcp_congestion(0xffffffffffffffff, &(0x7f0000000840)='htcp\x00', 0x5) 21:16:06 executing program 2: syz_genetlink_get_family_id$nl80211(0x0, 0xffffffffffffffff) syz_open_dev$vcsa(&(0x7f0000000440), 0x56, 0x4000) socketpair(0x0, 0x3, 0x6, &(0x7f0000000640)) r0 = openat$tcp_congestion(0xffffffffffffff9c, &(0x7f0000000800), 0x1, 0x0) write$tcp_congestion(r0, &(0x7f0000000840)='htcp\x00', 0x5) 21:16:06 executing program 5: r0 = io_uring_setup(0x355e, &(0x7f0000000000)={0x0, 0x7682, 0x20, 0x1, 0x1be}) r1 = syz_io_uring_setup(0x8fe, &(0x7f0000000080)={0x0, 0x1830, 0x0, 0x0, 0x1b8, 0x0, r0}, &(0x7f0000ffb000/0x2000)=nil, &(0x7f0000ffb000/0x4000)=nil, &(0x7f0000000100), &(0x7f0000000140)=0x0) r3 = openat$hwrng(0xffffffffffffff9c, &(0x7f0000000180), 0x2, 0x0) r4 = syz_io_uring_setup(0x65dd, &(0x7f00000001c0)={0x0, 0xf46f, 0x20, 0x2, 0xdf}, &(0x7f0000ffe000/0x1000)=nil, &(0x7f0000ffd000/0x1000)=nil, &(0x7f0000000240), &(0x7f0000000280)) r5 = syz_genetlink_get_family_id$mptcp(&(0x7f0000000300), r3) sendmsg$MPTCP_PM_CMD_ADD_ADDR(r3, &(0x7f00000003c0)={&(0x7f00000002c0)={0x10, 0x0, 0x0, 0x10}, 0xc, &(0x7f0000000380)={&(0x7f0000000340)={0x24, r5, 0x300, 0x70bd26, 0x25dfdbfb, {}, [@MPTCP_PM_ATTR_SUBFLOWS={0x8, 0x3, 0x1}, @MPTCP_PM_ATTR_RCV_ADD_ADDRS={0x8, 0x2, 0x2}]}, 0x24}, 0x1, 0x0, 0x0, 0x20000004}, 0x8890) syz_io_uring_setup(0x20f8, &(0x7f0000000400)={0x0, 0x7677, 0x8, 0x3, 0x22f, 0x0, r4}, &(0x7f0000ffe000/0x2000)=nil, &(0x7f0000ffb000/0x2000)=nil, &(0x7f0000000480)=0x0, &(0x7f00000004c0)) r7 = openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000500)='./cgroup/syz1\x00', 0x200002, 0x0) syz_io_uring_submit(r6, r2, &(0x7f0000000580)=@IORING_OP_FILES_UPDATE={0x14, 0x4, 0x0, 0x0, 0x40, &(0x7f0000000540)=[r4, 0xffffffffffffffff, r7, r0, r1], 0x5}, 0x3) openat$procfs(0xffffffffffffff9c, &(0x7f00000010c0)='/proc/crypto\x00', 0x0, 0x0) 21:16:14 executing program 2: syz_genetlink_get_family_id$nl80211(0x0, 0xffffffffffffffff) syz_open_dev$vcsa(&(0x7f0000000440), 0x56, 0x4000) socketpair(0x0, 0x3, 0x6, &(0x7f0000000640)) r0 = openat$tcp_congestion(0xffffffffffffff9c, &(0x7f0000000800), 0x1, 0x0) write$tcp_congestion(r0, &(0x7f0000000840)='htcp\x00', 0x5) 21:16:14 executing program 7: write$P9_RSYMLINK(0xffffffffffffffff, &(0x7f0000000000)={0x14, 0x11, 0x2, {0x40, 0x3, 0x2}}, 0x14) ioctl$sock_ifreq(0xffffffffffffffff, 0x8935, &(0x7f0000000040)={'lo\x00', @ifru_addrs=@ethernet}) ioctl$sock_ifreq(0xffffffffffffffff, 0x8994, &(0x7f0000000080)={'ip6gretap0\x00', @ifru_flags}) sendmsg$IPSET_CMD_FLUSH(0xffffffffffffffff, &(0x7f0000000180)={&(0x7f00000000c0)={0x10, 0x0, 0x0, 0x10000}, 0xc, &(0x7f0000000140)={&(0x7f0000000100)={0x3c, 0x4, 0x6, 0x801, 0x0, 0x0, {0x3, 0x0, 0x4}, [@IPSET_ATTR_PROTOCOL={0x5}, @IPSET_ATTR_SETNAME={0x9, 0x2, 'syz0\x00'}, @IPSET_ATTR_SETNAME={0x9, 0x2, 'syz2\x00'}, @IPSET_ATTR_PROTOCOL={0x5}]}, 0x3c}}, 0x20000000) write$P9_RVERSION(0xffffffffffffffff, &(0x7f00000001c0)={0x13, 0x65, 0xffff, 0x3, 0x6, '9P2000'}, 0x13) write$P9_RSYMLINK(0xffffffffffffffff, &(0x7f0000000240)={0x14, 0x11, 0x1, {0x1, 0x3, 0x2}}, 0x14) add_key$fscrypt_v1(&(0x7f0000000280), &(0x7f00000002c0)={'fscrypt:', @desc2}, &(0x7f0000000300)={0x0, "ccf022eeb1aa5b4a9067674b5b7079352411c35248e190415959cbe4b7be99236abd831288583a8ed4db4b7b3f838c24d293f908bf3509b49f2c17852201f646", 0x19}, 0x48, 0xfffffffffffffffa) syz_genetlink_get_family_id$mptcp(&(0x7f00000004c0), 0xffffffffffffffff) openat$vcsa(0xffffffffffffff9c, &(0x7f00000009c0), 0x14200, 0x0) syz_genetlink_get_family_id$mptcp(&(0x7f0000000a80), 0xffffffffffffffff) 21:16:14 executing program 3: r0 = io_uring_setup(0x355e, &(0x7f0000000000)={0x0, 0x7682, 0x20, 0x1, 0x1be}) r1 = syz_io_uring_setup(0x8fe, &(0x7f0000000080)={0x0, 0x1830, 0x0, 0x0, 0x1b8, 0x0, r0}, &(0x7f0000ffb000/0x2000)=nil, &(0x7f0000ffb000/0x4000)=nil, &(0x7f0000000100), &(0x7f0000000140)=0x0) r3 = openat$hwrng(0xffffffffffffff9c, &(0x7f0000000180), 0x2, 0x0) r4 = syz_io_uring_setup(0x65dd, &(0x7f00000001c0)={0x0, 0xf46f, 0x20, 0x2, 0xdf}, &(0x7f0000ffe000/0x1000)=nil, &(0x7f0000ffd000/0x1000)=nil, &(0x7f0000000240), &(0x7f0000000280)) r5 = syz_genetlink_get_family_id$mptcp(&(0x7f0000000300), r3) sendmsg$MPTCP_PM_CMD_ADD_ADDR(r3, &(0x7f00000003c0)={&(0x7f00000002c0)={0x10, 0x0, 0x0, 0x10}, 0xc, &(0x7f0000000380)={&(0x7f0000000340)={0x24, r5, 0x300, 0x70bd26, 0x25dfdbfb, {}, [@MPTCP_PM_ATTR_SUBFLOWS={0x8, 0x3, 0x1}, @MPTCP_PM_ATTR_RCV_ADD_ADDRS={0x8, 0x2, 0x2}]}, 0x24}, 0x1, 0x0, 0x0, 0x20000004}, 0x8890) r6 = openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000500)='./cgroup/syz1\x00', 0x200002, 0x0) syz_io_uring_submit(0x0, r2, &(0x7f0000000580)=@IORING_OP_FILES_UPDATE={0x14, 0x4, 0x0, 0x0, 0x40, &(0x7f0000000540)=[r4, 0xffffffffffffffff, r6, r0, r1], 0x5}, 0x3) io_uring_setup(0x2812, &(0x7f00000005c0)={0x0, 0x5e1b, 0x2, 0x3, 0x12f, 0x0, r4}) socket$inet6_tcp(0xa, 0x1, 0x0) openat$procfs(0xffffffffffffff9c, &(0x7f00000010c0)='/proc/crypto\x00', 0x0, 0x0) 21:16:14 executing program 1: r0 = io_uring_setup(0x355e, &(0x7f0000000000)={0x0, 0x7682, 0x20, 0x1, 0x1be}) r1 = syz_io_uring_setup(0x8fe, &(0x7f0000000080)={0x0, 0x1830, 0x0, 0x0, 0x1b8, 0x0, r0}, &(0x7f0000ffb000/0x2000)=nil, &(0x7f0000ffb000/0x4000)=nil, &(0x7f0000000100), &(0x7f0000000140)=0x0) openat$hwrng(0xffffffffffffff9c, &(0x7f0000000180), 0x2, 0x0) r3 = syz_io_uring_setup(0x65dd, &(0x7f00000001c0)={0x0, 0xf46f, 0x20, 0x2, 0xdf}, &(0x7f0000ffe000/0x1000)=nil, &(0x7f0000ffd000/0x1000)=nil, &(0x7f0000000240), &(0x7f0000000280)) syz_io_uring_setup(0x20f8, &(0x7f0000000400)={0x0, 0x7677, 0x8, 0x3, 0x22f, 0x0, r3}, &(0x7f0000ffe000/0x2000)=nil, &(0x7f0000ffb000/0x2000)=nil, &(0x7f0000000480)=0x0, &(0x7f00000004c0)) r5 = openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000500)='./cgroup/syz1\x00', 0x200002, 0x0) syz_io_uring_submit(r4, r2, &(0x7f0000000580)=@IORING_OP_FILES_UPDATE={0x14, 0x4, 0x0, 0x0, 0x40, &(0x7f0000000540)=[r3, 0xffffffffffffffff, r5, r0, r1], 0x5}, 0x3) io_uring_setup(0x2812, &(0x7f00000005c0)={0x0, 0x5e1b, 0x2, 0x3, 0x12f, 0x0, r3}) socket$inet6_tcp(0xa, 0x1, 0x0) openat$procfs(0xffffffffffffff9c, &(0x7f00000010c0)='/proc/crypto\x00', 0x0, 0x0) io_uring_setup(0x7c8f, &(0x7f0000001140)={0x0, 0xc240, 0x10, 0x3, 0x1c7, 0x0, r3}) 21:16:14 executing program 6: r0 = io_uring_setup(0x355e, &(0x7f0000000000)={0x0, 0x7682, 0x20, 0x1, 0x1be}) syz_io_uring_setup(0x8fe, &(0x7f0000000080)={0x0, 0x1830, 0x0, 0x0, 0x1b8, 0x0, r0}, &(0x7f0000ffb000/0x2000)=nil, &(0x7f0000ffb000/0x4000)=nil, &(0x7f0000000100), &(0x7f0000000140)) r1 = openat$hwrng(0xffffffffffffff9c, &(0x7f0000000180), 0x2, 0x0) r2 = syz_io_uring_setup(0x65dd, &(0x7f00000001c0)={0x0, 0xf46f, 0x20, 0x2, 0xdf}, &(0x7f0000ffe000/0x1000)=nil, &(0x7f0000ffd000/0x1000)=nil, &(0x7f0000000240), &(0x7f0000000280)) r3 = syz_genetlink_get_family_id$mptcp(&(0x7f0000000300), r1) sendmsg$MPTCP_PM_CMD_ADD_ADDR(r1, &(0x7f00000003c0)={&(0x7f00000002c0)={0x10, 0x0, 0x0, 0x10}, 0xc, &(0x7f0000000380)={&(0x7f0000000340)={0x24, r3, 0x300, 0x70bd26, 0x25dfdbfb, {}, [@MPTCP_PM_ATTR_SUBFLOWS={0x8, 0x3, 0x1}, @MPTCP_PM_ATTR_RCV_ADD_ADDRS={0x8, 0x2, 0x2}]}, 0x24}, 0x1, 0x0, 0x0, 0x20000004}, 0x8890) syz_io_uring_setup(0x20f8, &(0x7f0000000400)={0x0, 0x7677, 0x8, 0x3, 0x22f, 0x0, r2}, &(0x7f0000ffe000/0x2000)=nil, &(0x7f0000ffb000/0x2000)=nil, &(0x7f0000000480), &(0x7f00000004c0)) openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000500)='./cgroup/syz1\x00', 0x200002, 0x0) socket$inet6_tcp(0xa, 0x1, 0x0) openat$procfs(0xffffffffffffff9c, &(0x7f00000010c0)='/proc/crypto\x00', 0x0, 0x0) io_uring_setup(0x7c8f, &(0x7f0000001140)={0x0, 0xc240, 0x10, 0x3, 0x1c7, 0x0, r2}) 21:16:14 executing program 5: r0 = io_uring_setup(0x355e, &(0x7f0000000000)={0x0, 0x7682, 0x20, 0x1, 0x1be}) r1 = syz_io_uring_setup(0x8fe, &(0x7f0000000080)={0x0, 0x1830, 0x0, 0x0, 0x1b8, 0x0, r0}, &(0x7f0000ffb000/0x2000)=nil, &(0x7f0000ffb000/0x4000)=nil, &(0x7f0000000100), &(0x7f0000000140)=0x0) r3 = openat$hwrng(0xffffffffffffff9c, &(0x7f0000000180), 0x2, 0x0) r4 = syz_io_uring_setup(0x65dd, &(0x7f00000001c0)={0x0, 0xf46f, 0x20, 0x2, 0xdf}, &(0x7f0000ffe000/0x1000)=nil, &(0x7f0000ffd000/0x1000)=nil, &(0x7f0000000240), &(0x7f0000000280)) r5 = syz_genetlink_get_family_id$mptcp(&(0x7f0000000300), r3) sendmsg$MPTCP_PM_CMD_ADD_ADDR(r3, &(0x7f00000003c0)={&(0x7f00000002c0)={0x10, 0x0, 0x0, 0x10}, 0xc, &(0x7f0000000380)={&(0x7f0000000340)={0x24, r5, 0x300, 0x70bd26, 0x25dfdbfb, {}, [@MPTCP_PM_ATTR_SUBFLOWS={0x8, 0x3, 0x1}, @MPTCP_PM_ATTR_RCV_ADD_ADDRS={0x8, 0x2, 0x2}]}, 0x24}, 0x1, 0x0, 0x0, 0x20000004}, 0x8890) syz_io_uring_setup(0x20f8, &(0x7f0000000400)={0x0, 0x7677, 0x8, 0x3, 0x22f, 0x0, r4}, &(0x7f0000ffe000/0x2000)=nil, &(0x7f0000ffb000/0x2000)=nil, &(0x7f0000000480)=0x0, &(0x7f00000004c0)) r7 = openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000500)='./cgroup/syz1\x00', 0x200002, 0x0) syz_io_uring_submit(r6, r2, &(0x7f0000000580)=@IORING_OP_FILES_UPDATE={0x14, 0x4, 0x0, 0x0, 0x40, &(0x7f0000000540)=[r4, 0xffffffffffffffff, r7, r0, r1], 0x5}, 0x3) openat$procfs(0xffffffffffffff9c, &(0x7f00000010c0)='/proc/crypto\x00', 0x0, 0x0) 21:16:14 executing program 4: ioctl$SCSI_IOCTL_DOORUNLOCK(0xffffffffffffffff, 0x5381) r0 = syz_open_dev$mouse(&(0x7f0000000000), 0x578, 0x4000) ioctl$SG_GET_PACK_ID(r0, 0x227c, &(0x7f0000000040)) r1 = syz_genetlink_get_family_id$nl80211(&(0x7f00000000c0), r0) sendmsg$NL80211_CMD_NEW_KEY(r0, &(0x7f00000001c0)={&(0x7f0000000080)={0x10, 0x0, 0x0, 0x10}, 0xc, &(0x7f0000000180)={&(0x7f0000000100)={0x60, r1, 0x400, 0x70bd2b, 0x25dfdbff, {{}, {@val={0x8}, @void}}, [@NL80211_ATTR_KEY_TYPE={0x8, 0x37, 0x1}, @NL80211_ATTR_KEY_DEFAULT_MGMT={0x4}, @NL80211_ATTR_KEY={0x2c, 0x50, 0x0, 0x1, [@NL80211_KEY_DATA_WEP40={0x9, 0x1, "93f3c5ad5d"}, @NL80211_KEY_DEFAULT_TYPES={0x8, 0x8, 0x0, 0x1, [@NL80211_KEY_DEFAULT_TYPE_MULTICAST={0x4}]}, @NL80211_KEY_DATA_WEP104={0x11, 0x1, "8815558ac60368b42ebdf03bdb"}]}, @NL80211_ATTR_KEY_DATA_WEP40={0x9, 0x7, "74de692476"}]}, 0x60}, 0x1, 0x0, 0x0, 0x4000000}, 0x8000) openat$procfs(0xffffffffffffff9c, &(0x7f0000000200)='/proc/stat\x00', 0x0, 0x0) socketpair(0x0, 0x3, 0x6, &(0x7f0000000640)) r2 = openat$tcp_congestion(0xffffffffffffff9c, &(0x7f0000000800), 0x1, 0x0) write$tcp_congestion(r2, &(0x7f0000000840)='htcp\x00', 0x5) 21:16:14 executing program 0: r0 = io_uring_setup(0x355e, &(0x7f0000000000)={0x0, 0x7682, 0x20, 0x1, 0x1be}) r1 = syz_io_uring_setup(0x8fe, &(0x7f0000000080)={0x0, 0x1830, 0x0, 0x0, 0x1b8, 0x0, r0}, &(0x7f0000ffb000/0x2000)=nil, &(0x7f0000ffb000/0x4000)=nil, &(0x7f0000000100), &(0x7f0000000140)=0x0) r3 = openat$hwrng(0xffffffffffffff9c, &(0x7f0000000180), 0x2, 0x0) r4 = syz_io_uring_setup(0x65dd, &(0x7f00000001c0)={0x0, 0xf46f, 0x20, 0x2, 0xdf}, &(0x7f0000ffe000/0x1000)=nil, &(0x7f0000ffd000/0x1000)=nil, &(0x7f0000000240), &(0x7f0000000280)) r5 = syz_genetlink_get_family_id$mptcp(&(0x7f0000000300), r3) sendmsg$MPTCP_PM_CMD_ADD_ADDR(r3, &(0x7f00000003c0)={&(0x7f00000002c0)={0x10, 0x0, 0x0, 0x10}, 0xc, &(0x7f0000000380)={&(0x7f0000000340)={0x24, r5, 0x300, 0x70bd26, 0x25dfdbfb, {}, [@MPTCP_PM_ATTR_SUBFLOWS={0x8, 0x3, 0x1}, @MPTCP_PM_ATTR_RCV_ADD_ADDRS={0x8, 0x2, 0x2}]}, 0x24}, 0x1, 0x0, 0x0, 0x20000004}, 0x8890) r6 = openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000500)='./cgroup/syz1\x00', 0x200002, 0x0) syz_io_uring_submit(0x0, r2, &(0x7f0000000580)=@IORING_OP_FILES_UPDATE={0x14, 0x4, 0x0, 0x0, 0x40, &(0x7f0000000540)=[r4, 0xffffffffffffffff, r6, r0, r1], 0x5}, 0x3) io_uring_setup(0x2812, &(0x7f00000005c0)={0x0, 0x5e1b, 0x2, 0x3, 0x12f, 0x0, r4}) socket$inet6_tcp(0xa, 0x1, 0x0) 21:16:15 executing program 3: r0 = io_uring_setup(0x355e, &(0x7f0000000000)={0x0, 0x7682, 0x20, 0x1, 0x1be}) r1 = syz_io_uring_setup(0x8fe, &(0x7f0000000080)={0x0, 0x1830, 0x0, 0x0, 0x1b8, 0x0, r0}, &(0x7f0000ffb000/0x2000)=nil, &(0x7f0000ffb000/0x4000)=nil, &(0x7f0000000100), &(0x7f0000000140)=0x0) r3 = openat$hwrng(0xffffffffffffff9c, &(0x7f0000000180), 0x2, 0x0) r4 = syz_io_uring_setup(0x65dd, &(0x7f00000001c0)={0x0, 0xf46f, 0x20, 0x2, 0xdf}, &(0x7f0000ffe000/0x1000)=nil, &(0x7f0000ffd000/0x1000)=nil, &(0x7f0000000240), &(0x7f0000000280)) r5 = syz_genetlink_get_family_id$mptcp(&(0x7f0000000300), r3) sendmsg$MPTCP_PM_CMD_ADD_ADDR(r3, &(0x7f00000003c0)={&(0x7f00000002c0)={0x10, 0x0, 0x0, 0x10}, 0xc, &(0x7f0000000380)={&(0x7f0000000340)={0x24, r5, 0x300, 0x70bd26, 0x25dfdbfb, {}, [@MPTCP_PM_ATTR_SUBFLOWS={0x8, 0x3, 0x1}, @MPTCP_PM_ATTR_RCV_ADD_ADDRS={0x8, 0x2, 0x2}]}, 0x24}, 0x1, 0x0, 0x0, 0x20000004}, 0x8890) r6 = openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000500)='./cgroup/syz1\x00', 0x200002, 0x0) syz_io_uring_submit(0x0, r2, &(0x7f0000000580)=@IORING_OP_FILES_UPDATE={0x14, 0x4, 0x0, 0x0, 0x40, &(0x7f0000000540)=[r4, 0xffffffffffffffff, r6, r0, r1], 0x5}, 0x3) io_uring_setup(0x2812, &(0x7f00000005c0)={0x0, 0x5e1b, 0x2, 0x3, 0x12f, 0x0, r4}) socket$inet6_tcp(0xa, 0x1, 0x0) openat$procfs(0xffffffffffffff9c, &(0x7f00000010c0)='/proc/crypto\x00', 0x0, 0x0) 21:16:15 executing program 7: write$P9_RSYMLINK(0xffffffffffffffff, &(0x7f0000000000)={0x14, 0x11, 0x2, {0x40, 0x3, 0x2}}, 0x14) ioctl$sock_ifreq(0xffffffffffffffff, 0x8935, &(0x7f0000000040)={'lo\x00', @ifru_addrs=@ethernet}) ioctl$sock_ifreq(0xffffffffffffffff, 0x8994, &(0x7f0000000080)={'ip6gretap0\x00', @ifru_flags}) sendmsg$IPSET_CMD_FLUSH(0xffffffffffffffff, &(0x7f0000000180)={&(0x7f00000000c0)={0x10, 0x0, 0x0, 0x10000}, 0xc, &(0x7f0000000140)={&(0x7f0000000100)={0x3c, 0x4, 0x6, 0x801, 0x0, 0x0, {0x3, 0x0, 0x4}, [@IPSET_ATTR_PROTOCOL={0x5}, @IPSET_ATTR_SETNAME={0x9, 0x2, 'syz0\x00'}, @IPSET_ATTR_SETNAME={0x9, 0x2, 'syz2\x00'}, @IPSET_ATTR_PROTOCOL={0x5}]}, 0x3c}}, 0x20000000) write$P9_RVERSION(0xffffffffffffffff, &(0x7f00000001c0)={0x13, 0x65, 0xffff, 0x3, 0x6, '9P2000'}, 0x13) write$P9_RSYMLINK(0xffffffffffffffff, &(0x7f0000000240)={0x14, 0x11, 0x1, {0x1, 0x3, 0x2}}, 0x14) add_key$fscrypt_v1(&(0x7f0000000280), &(0x7f00000002c0)={'fscrypt:', @desc2}, &(0x7f0000000300)={0x0, "ccf022eeb1aa5b4a9067674b5b7079352411c35248e190415959cbe4b7be99236abd831288583a8ed4db4b7b3f838c24d293f908bf3509b49f2c17852201f646", 0x19}, 0x48, 0xfffffffffffffffa) syz_genetlink_get_family_id$mptcp(&(0x7f00000004c0), 0xffffffffffffffff) openat$vcsa(0xffffffffffffff9c, &(0x7f00000009c0), 0x14200, 0x0) syz_genetlink_get_family_id$mptcp(&(0x7f0000000a80), 0xffffffffffffffff) 21:16:15 executing program 1: r0 = io_uring_setup(0x355e, &(0x7f0000000000)={0x0, 0x7682, 0x20, 0x1, 0x1be}) r1 = syz_io_uring_setup(0x8fe, &(0x7f0000000080)={0x0, 0x1830, 0x0, 0x0, 0x1b8, 0x0, r0}, &(0x7f0000ffb000/0x2000)=nil, &(0x7f0000ffb000/0x4000)=nil, &(0x7f0000000100), &(0x7f0000000140)=0x0) r3 = openat$hwrng(0xffffffffffffff9c, &(0x7f0000000180), 0x2, 0x0) syz_genetlink_get_family_id$mptcp(&(0x7f0000000300), r3) syz_io_uring_setup(0x20f8, &(0x7f0000000400)={0x0, 0x7677, 0x8, 0x3, 0x22f}, &(0x7f0000ffe000/0x2000)=nil, &(0x7f0000ffb000/0x2000)=nil, &(0x7f0000000480)=0x0, &(0x7f00000004c0)) r5 = openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000500)='./cgroup/syz1\x00', 0x200002, 0x0) syz_io_uring_submit(r4, r2, &(0x7f0000000580)=@IORING_OP_FILES_UPDATE={0x14, 0x4, 0x0, 0x0, 0x40, &(0x7f0000000540)=[0xffffffffffffffff, 0xffffffffffffffff, r5, r0, r1], 0x5}, 0x3) io_uring_setup(0x2812, &(0x7f00000005c0)={0x0, 0x5e1b, 0x2, 0x3, 0x12f}) socket$inet6_tcp(0xa, 0x1, 0x0) openat$procfs(0xffffffffffffff9c, &(0x7f00000010c0)='/proc/crypto\x00', 0x0, 0x0) io_uring_setup(0x7c8f, &(0x7f0000001140)={0x0, 0xc240, 0x10, 0x3, 0x1c7}) 21:16:24 executing program 5: r0 = io_uring_setup(0x355e, &(0x7f0000000000)={0x0, 0x7682, 0x20, 0x1, 0x1be}) r1 = syz_io_uring_setup(0x8fe, &(0x7f0000000080)={0x0, 0x1830, 0x0, 0x0, 0x1b8, 0x0, r0}, &(0x7f0000ffb000/0x2000)=nil, &(0x7f0000ffb000/0x4000)=nil, &(0x7f0000000100), &(0x7f0000000140)=0x0) r3 = openat$hwrng(0xffffffffffffff9c, &(0x7f0000000180), 0x2, 0x0) r4 = syz_io_uring_setup(0x65dd, &(0x7f00000001c0)={0x0, 0xf46f, 0x20, 0x2, 0xdf}, &(0x7f0000ffe000/0x1000)=nil, &(0x7f0000ffd000/0x1000)=nil, &(0x7f0000000240), &(0x7f0000000280)) r5 = syz_genetlink_get_family_id$mptcp(&(0x7f0000000300), r3) sendmsg$MPTCP_PM_CMD_ADD_ADDR(r3, &(0x7f00000003c0)={&(0x7f00000002c0)={0x10, 0x0, 0x0, 0x10}, 0xc, &(0x7f0000000380)={&(0x7f0000000340)={0x24, r5, 0x300, 0x70bd26, 0x25dfdbfb, {}, [@MPTCP_PM_ATTR_SUBFLOWS={0x8, 0x3, 0x1}, @MPTCP_PM_ATTR_RCV_ADD_ADDRS={0x8, 0x2, 0x2}]}, 0x24}, 0x1, 0x0, 0x0, 0x20000004}, 0x8890) syz_io_uring_setup(0x20f8, &(0x7f0000000400)={0x0, 0x7677, 0x8, 0x3, 0x22f, 0x0, r4}, &(0x7f0000ffe000/0x2000)=nil, &(0x7f0000ffb000/0x2000)=nil, &(0x7f0000000480)=0x0, &(0x7f00000004c0)) r7 = openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000500)='./cgroup/syz1\x00', 0x200002, 0x0) syz_io_uring_submit(r6, r2, &(0x7f0000000580)=@IORING_OP_FILES_UPDATE={0x14, 0x4, 0x0, 0x0, 0x40, &(0x7f0000000540)=[r4, 0xffffffffffffffff, r7, r0, r1], 0x5}, 0x3) openat$procfs(0xffffffffffffff9c, &(0x7f00000010c0)='/proc/crypto\x00', 0x0, 0x0) 21:16:24 executing program 6: r0 = io_uring_setup(0x355e, &(0x7f0000000000)={0x0, 0x7682, 0x20, 0x1, 0x1be}) syz_io_uring_setup(0x8fe, &(0x7f0000000080)={0x0, 0x1830, 0x0, 0x0, 0x1b8, 0x0, r0}, &(0x7f0000ffb000/0x2000)=nil, &(0x7f0000ffb000/0x4000)=nil, &(0x7f0000000100), &(0x7f0000000140)) r1 = openat$hwrng(0xffffffffffffff9c, &(0x7f0000000180), 0x2, 0x0) r2 = syz_io_uring_setup(0x65dd, &(0x7f00000001c0)={0x0, 0xf46f, 0x20, 0x2, 0xdf}, &(0x7f0000ffe000/0x1000)=nil, &(0x7f0000ffd000/0x1000)=nil, &(0x7f0000000240), &(0x7f0000000280)) r3 = syz_genetlink_get_family_id$mptcp(&(0x7f0000000300), r1) sendmsg$MPTCP_PM_CMD_ADD_ADDR(r1, &(0x7f00000003c0)={&(0x7f00000002c0)={0x10, 0x0, 0x0, 0x10}, 0xc, &(0x7f0000000380)={&(0x7f0000000340)={0x24, r3, 0x300, 0x70bd26, 0x25dfdbfb, {}, [@MPTCP_PM_ATTR_SUBFLOWS={0x8, 0x3, 0x1}, @MPTCP_PM_ATTR_RCV_ADD_ADDRS={0x8, 0x2, 0x2}]}, 0x24}, 0x1, 0x0, 0x0, 0x20000004}, 0x8890) syz_io_uring_setup(0x20f8, &(0x7f0000000400)={0x0, 0x7677, 0x8, 0x3, 0x22f, 0x0, r2}, &(0x7f0000ffe000/0x2000)=nil, &(0x7f0000ffb000/0x2000)=nil, &(0x7f0000000480), &(0x7f00000004c0)) openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000500)='./cgroup/syz1\x00', 0x200002, 0x0) socket$inet6_tcp(0xa, 0x1, 0x0) openat$procfs(0xffffffffffffff9c, &(0x7f00000010c0)='/proc/crypto\x00', 0x0, 0x0) io_uring_setup(0x7c8f, &(0x7f0000001140)={0x0, 0xc240, 0x10, 0x3, 0x1c7, 0x0, r2}) 21:16:24 executing program 3: r0 = io_uring_setup(0x355e, &(0x7f0000000000)={0x0, 0x7682, 0x20, 0x1, 0x1be}) r1 = syz_io_uring_setup(0x8fe, &(0x7f0000000080)={0x0, 0x1830, 0x0, 0x0, 0x1b8, 0x0, r0}, &(0x7f0000ffb000/0x2000)=nil, &(0x7f0000ffb000/0x4000)=nil, &(0x7f0000000100), &(0x7f0000000140)=0x0) r3 = openat$hwrng(0xffffffffffffff9c, &(0x7f0000000180), 0x2, 0x0) r4 = syz_io_uring_setup(0x65dd, &(0x7f00000001c0)={0x0, 0xf46f, 0x20, 0x2, 0xdf}, &(0x7f0000ffe000/0x1000)=nil, &(0x7f0000ffd000/0x1000)=nil, &(0x7f0000000240), &(0x7f0000000280)) r5 = syz_genetlink_get_family_id$mptcp(&(0x7f0000000300), r3) sendmsg$MPTCP_PM_CMD_ADD_ADDR(r3, &(0x7f00000003c0)={&(0x7f00000002c0)={0x10, 0x0, 0x0, 0x10}, 0xc, &(0x7f0000000380)={&(0x7f0000000340)={0x24, r5, 0x300, 0x70bd26, 0x25dfdbfb, {}, [@MPTCP_PM_ATTR_SUBFLOWS={0x8, 0x3, 0x1}, @MPTCP_PM_ATTR_RCV_ADD_ADDRS={0x8, 0x2, 0x2}]}, 0x24}, 0x1, 0x0, 0x0, 0x20000004}, 0x8890) r6 = openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000500)='./cgroup/syz1\x00', 0x200002, 0x0) syz_io_uring_submit(0x0, r2, &(0x7f0000000580)=@IORING_OP_FILES_UPDATE={0x14, 0x4, 0x0, 0x0, 0x40, &(0x7f0000000540)=[r4, 0xffffffffffffffff, r6, r0, r1], 0x5}, 0x3) io_uring_setup(0x2812, &(0x7f00000005c0)={0x0, 0x5e1b, 0x2, 0x3, 0x12f, 0x0, r4}) socket$inet6_tcp(0xa, 0x1, 0x0) io_uring_setup(0x7c8f, &(0x7f0000001140)={0x0, 0xc240, 0x10, 0x3, 0x1c7, 0x0, r4}) 21:16:24 executing program 1: r0 = io_uring_setup(0x355e, &(0x7f0000000000)={0x0, 0x7682, 0x20, 0x1, 0x1be}) r1 = syz_io_uring_setup(0x8fe, &(0x7f0000000080)={0x0, 0x1830, 0x0, 0x0, 0x1b8, 0x0, r0}, &(0x7f0000ffb000/0x2000)=nil, &(0x7f0000ffb000/0x4000)=nil, &(0x7f0000000100), &(0x7f0000000140)=0x0) r3 = openat$hwrng(0xffffffffffffff9c, &(0x7f0000000180), 0x2, 0x0) syz_genetlink_get_family_id$mptcp(&(0x7f0000000300), r3) syz_io_uring_setup(0x20f8, &(0x7f0000000400)={0x0, 0x7677, 0x8, 0x3, 0x22f}, &(0x7f0000ffe000/0x2000)=nil, &(0x7f0000ffb000/0x2000)=nil, &(0x7f0000000480)=0x0, &(0x7f00000004c0)) r5 = openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000500)='./cgroup/syz1\x00', 0x200002, 0x0) syz_io_uring_submit(r4, r2, &(0x7f0000000580)=@IORING_OP_FILES_UPDATE={0x14, 0x4, 0x0, 0x0, 0x40, &(0x7f0000000540)=[0xffffffffffffffff, 0xffffffffffffffff, r5, r0, r1], 0x5}, 0x3) io_uring_setup(0x2812, &(0x7f00000005c0)={0x0, 0x5e1b, 0x2, 0x3, 0x12f}) socket$inet6_tcp(0xa, 0x1, 0x0) openat$procfs(0xffffffffffffff9c, &(0x7f00000010c0)='/proc/crypto\x00', 0x0, 0x0) io_uring_setup(0x7c8f, &(0x7f0000001140)={0x0, 0xc240, 0x10, 0x3, 0x1c7}) 21:16:24 executing program 2: syz_genetlink_get_family_id$nl80211(0x0, 0xffffffffffffffff) syz_open_dev$vcsa(&(0x7f0000000440), 0x56, 0x4000) socketpair(0x0, 0x3, 0x6, &(0x7f0000000640)) r0 = openat$tcp_congestion(0xffffffffffffff9c, &(0x7f0000000800), 0x1, 0x0) write$tcp_congestion(r0, &(0x7f0000000840)='htcp\x00', 0x5) 21:16:24 executing program 7: write$P9_RSYMLINK(0xffffffffffffffff, &(0x7f0000000000)={0x14, 0x11, 0x2, {0x40, 0x3, 0x2}}, 0x14) ioctl$sock_ifreq(0xffffffffffffffff, 0x8935, &(0x7f0000000040)={'lo\x00', @ifru_addrs=@ethernet}) ioctl$sock_ifreq(0xffffffffffffffff, 0x8994, &(0x7f0000000080)={'ip6gretap0\x00', @ifru_flags}) sendmsg$IPSET_CMD_FLUSH(0xffffffffffffffff, &(0x7f0000000180)={&(0x7f00000000c0)={0x10, 0x0, 0x0, 0x10000}, 0xc, &(0x7f0000000140)={&(0x7f0000000100)={0x3c, 0x4, 0x6, 0x801, 0x0, 0x0, {0x3, 0x0, 0x4}, [@IPSET_ATTR_PROTOCOL={0x5}, @IPSET_ATTR_SETNAME={0x9, 0x2, 'syz0\x00'}, @IPSET_ATTR_SETNAME={0x9, 0x2, 'syz2\x00'}, @IPSET_ATTR_PROTOCOL={0x5}]}, 0x3c}}, 0x20000000) pipe2$9p(&(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}, 0x0) write$P9_RSYMLINK(r0, &(0x7f0000000240)={0x14, 0x11, 0x1, {0x1, 0x3, 0x2}}, 0x14) add_key$fscrypt_v1(&(0x7f0000000280), &(0x7f00000002c0)={'fscrypt:', @desc2}, &(0x7f0000000300)={0x0, "ccf022eeb1aa5b4a9067674b5b7079352411c35248e190415959cbe4b7be99236abd831288583a8ed4db4b7b3f838c24d293f908bf3509b49f2c17852201f646", 0x19}, 0x48, 0xfffffffffffffffa) syz_genetlink_get_family_id$mptcp(&(0x7f00000004c0), 0xffffffffffffffff) openat$vcsa(0xffffffffffffff9c, &(0x7f00000009c0), 0x14200, 0x0) syz_genetlink_get_family_id$mptcp(&(0x7f0000000a80), 0xffffffffffffffff) 21:16:24 executing program 4: ioctl$SCSI_IOCTL_DOORUNLOCK(0xffffffffffffffff, 0x5381) r0 = syz_open_dev$mouse(&(0x7f0000000000), 0x578, 0x4000) ioctl$SG_GET_PACK_ID(r0, 0x227c, &(0x7f0000000040)) r1 = syz_genetlink_get_family_id$nl80211(&(0x7f00000000c0), r0) sendmsg$NL80211_CMD_NEW_KEY(r0, &(0x7f00000001c0)={&(0x7f0000000080)={0x10, 0x0, 0x0, 0x10}, 0xc, &(0x7f0000000180)={&(0x7f0000000100)={0x60, r1, 0x400, 0x70bd2b, 0x25dfdbff, {{}, {@val={0x8}, @void}}, [@NL80211_ATTR_KEY_TYPE={0x8, 0x37, 0x1}, @NL80211_ATTR_KEY_DEFAULT_MGMT={0x4}, @NL80211_ATTR_KEY={0x2c, 0x50, 0x0, 0x1, [@NL80211_KEY_DATA_WEP40={0x9, 0x1, "93f3c5ad5d"}, @NL80211_KEY_DEFAULT_TYPES={0x8, 0x8, 0x0, 0x1, [@NL80211_KEY_DEFAULT_TYPE_MULTICAST={0x4}]}, @NL80211_KEY_DATA_WEP104={0x11, 0x1, "8815558ac60368b42ebdf03bdb"}]}, @NL80211_ATTR_KEY_DATA_WEP40={0x9, 0x7, "74de692476"}]}, 0x60}, 0x1, 0x0, 0x0, 0x4000000}, 0x8000) openat$procfs(0xffffffffffffff9c, &(0x7f0000000200)='/proc/stat\x00', 0x0, 0x0) socketpair(0x0, 0x3, 0x6, &(0x7f0000000640)) r2 = openat$tcp_congestion(0xffffffffffffff9c, &(0x7f0000000800), 0x1, 0x0) write$tcp_congestion(r2, &(0x7f0000000840)='htcp\x00', 0x5) 21:16:24 executing program 0: r0 = io_uring_setup(0x355e, &(0x7f0000000000)={0x0, 0x7682, 0x20, 0x1, 0x1be}) r1 = syz_io_uring_setup(0x8fe, &(0x7f0000000080)={0x0, 0x1830, 0x0, 0x0, 0x1b8, 0x0, r0}, &(0x7f0000ffb000/0x2000)=nil, &(0x7f0000ffb000/0x4000)=nil, &(0x7f0000000100), &(0x7f0000000140)=0x0) r3 = openat$hwrng(0xffffffffffffff9c, &(0x7f0000000180), 0x2, 0x0) r4 = syz_io_uring_setup(0x65dd, &(0x7f00000001c0)={0x0, 0xf46f, 0x20, 0x2, 0xdf}, &(0x7f0000ffe000/0x1000)=nil, &(0x7f0000ffd000/0x1000)=nil, &(0x7f0000000240), &(0x7f0000000280)) r5 = syz_genetlink_get_family_id$mptcp(&(0x7f0000000300), r3) sendmsg$MPTCP_PM_CMD_ADD_ADDR(r3, &(0x7f00000003c0)={&(0x7f00000002c0)={0x10, 0x0, 0x0, 0x10}, 0xc, &(0x7f0000000380)={&(0x7f0000000340)={0x24, r5, 0x300, 0x70bd26, 0x25dfdbfb, {}, [@MPTCP_PM_ATTR_SUBFLOWS={0x8, 0x3, 0x1}, @MPTCP_PM_ATTR_RCV_ADD_ADDRS={0x8, 0x2, 0x2}]}, 0x24}, 0x1, 0x0, 0x0, 0x20000004}, 0x8890) r6 = openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000500)='./cgroup/syz1\x00', 0x200002, 0x0) syz_io_uring_submit(0x0, r2, &(0x7f0000000580)=@IORING_OP_FILES_UPDATE={0x14, 0x4, 0x0, 0x0, 0x40, &(0x7f0000000540)=[r4, 0xffffffffffffffff, r6, r0, r1], 0x5}, 0x3) socket$inet6_tcp(0xa, 0x1, 0x0) 21:16:25 executing program 1: r0 = io_uring_setup(0x355e, &(0x7f0000000000)={0x0, 0x7682, 0x20, 0x1, 0x1be}) r1 = syz_io_uring_setup(0x8fe, &(0x7f0000000080)={0x0, 0x1830, 0x0, 0x0, 0x1b8, 0x0, r0}, &(0x7f0000ffb000/0x2000)=nil, &(0x7f0000ffb000/0x4000)=nil, &(0x7f0000000100), &(0x7f0000000140)=0x0) r3 = openat$hwrng(0xffffffffffffff9c, &(0x7f0000000180), 0x2, 0x0) syz_genetlink_get_family_id$mptcp(&(0x7f0000000300), r3) syz_io_uring_setup(0x20f8, &(0x7f0000000400)={0x0, 0x7677, 0x8, 0x3, 0x22f}, &(0x7f0000ffe000/0x2000)=nil, &(0x7f0000ffb000/0x2000)=nil, &(0x7f0000000480)=0x0, &(0x7f00000004c0)) r5 = openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000500)='./cgroup/syz1\x00', 0x200002, 0x0) syz_io_uring_submit(r4, r2, &(0x7f0000000580)=@IORING_OP_FILES_UPDATE={0x14, 0x4, 0x0, 0x0, 0x40, &(0x7f0000000540)=[0xffffffffffffffff, 0xffffffffffffffff, r5, r0, r1], 0x5}, 0x3) io_uring_setup(0x2812, &(0x7f00000005c0)={0x0, 0x5e1b, 0x2, 0x3, 0x12f}) socket$inet6_tcp(0xa, 0x1, 0x0) openat$procfs(0xffffffffffffff9c, &(0x7f00000010c0)='/proc/crypto\x00', 0x0, 0x0) io_uring_setup(0x7c8f, &(0x7f0000001140)={0x0, 0xc240, 0x10, 0x3, 0x1c7}) 21:16:25 executing program 6: r0 = io_uring_setup(0x355e, &(0x7f0000000000)={0x0, 0x7682, 0x20, 0x1, 0x1be}) syz_io_uring_setup(0x8fe, &(0x7f0000000080)={0x0, 0x1830, 0x0, 0x0, 0x1b8, 0x0, r0}, &(0x7f0000ffb000/0x2000)=nil, &(0x7f0000ffb000/0x4000)=nil, &(0x7f0000000100), &(0x7f0000000140)) r1 = openat$hwrng(0xffffffffffffff9c, &(0x7f0000000180), 0x2, 0x0) r2 = syz_io_uring_setup(0x65dd, &(0x7f00000001c0)={0x0, 0xf46f, 0x20, 0x2, 0xdf}, &(0x7f0000ffe000/0x1000)=nil, &(0x7f0000ffd000/0x1000)=nil, &(0x7f0000000240), &(0x7f0000000280)) r3 = syz_genetlink_get_family_id$mptcp(&(0x7f0000000300), r1) sendmsg$MPTCP_PM_CMD_ADD_ADDR(r1, &(0x7f00000003c0)={&(0x7f00000002c0)={0x10, 0x0, 0x0, 0x10}, 0xc, &(0x7f0000000380)={&(0x7f0000000340)={0x24, r3, 0x300, 0x70bd26, 0x25dfdbfb, {}, [@MPTCP_PM_ATTR_SUBFLOWS={0x8, 0x3, 0x1}, @MPTCP_PM_ATTR_RCV_ADD_ADDRS={0x8, 0x2, 0x2}]}, 0x24}, 0x1, 0x0, 0x0, 0x20000004}, 0x8890) syz_io_uring_setup(0x20f8, &(0x7f0000000400)={0x0, 0x7677, 0x8, 0x3, 0x22f, 0x0, r2}, &(0x7f0000ffe000/0x2000)=nil, &(0x7f0000ffb000/0x2000)=nil, &(0x7f0000000480), &(0x7f00000004c0)) openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000500)='./cgroup/syz1\x00', 0x200002, 0x0) socket$inet6_tcp(0xa, 0x1, 0x0) openat$procfs(0xffffffffffffff9c, &(0x7f00000010c0)='/proc/crypto\x00', 0x0, 0x0) io_uring_setup(0x7c8f, &(0x7f0000001140)={0x0, 0xc240, 0x10, 0x3, 0x1c7, 0x0, r2}) 21:16:25 executing program 4: ioctl$SCSI_IOCTL_DOORUNLOCK(0xffffffffffffffff, 0x5381) r0 = syz_open_dev$mouse(&(0x7f0000000000), 0x578, 0x4000) ioctl$SG_GET_PACK_ID(r0, 0x227c, &(0x7f0000000040)) r1 = syz_genetlink_get_family_id$nl80211(&(0x7f00000000c0), r0) sendmsg$NL80211_CMD_NEW_KEY(r0, &(0x7f00000001c0)={&(0x7f0000000080)={0x10, 0x0, 0x0, 0x10}, 0xc, &(0x7f0000000180)={&(0x7f0000000100)={0x60, r1, 0x400, 0x70bd2b, 0x25dfdbff, {{}, {@val={0x8}, @void}}, [@NL80211_ATTR_KEY_TYPE={0x8, 0x37, 0x1}, @NL80211_ATTR_KEY_DEFAULT_MGMT={0x4}, @NL80211_ATTR_KEY={0x2c, 0x50, 0x0, 0x1, [@NL80211_KEY_DATA_WEP40={0x9, 0x1, "93f3c5ad5d"}, @NL80211_KEY_DEFAULT_TYPES={0x8, 0x8, 0x0, 0x1, [@NL80211_KEY_DEFAULT_TYPE_MULTICAST={0x4}]}, @NL80211_KEY_DATA_WEP104={0x11, 0x1, "8815558ac60368b42ebdf03bdb"}]}, @NL80211_ATTR_KEY_DATA_WEP40={0x9, 0x7, "74de692476"}]}, 0x60}, 0x1, 0x0, 0x0, 0x4000000}, 0x8000) openat$procfs(0xffffffffffffff9c, &(0x7f0000000200)='/proc/stat\x00', 0x0, 0x0) socketpair(0x0, 0x3, 0x6, &(0x7f0000000640)) r2 = openat$tcp_congestion(0xffffffffffffff9c, &(0x7f0000000800), 0x1, 0x0) write$tcp_congestion(r2, &(0x7f0000000840)='htcp\x00', 0x5) 21:16:25 executing program 0: r0 = io_uring_setup(0x355e, &(0x7f0000000000)={0x0, 0x7682, 0x20, 0x1, 0x1be}) r1 = syz_io_uring_setup(0x8fe, &(0x7f0000000080)={0x0, 0x1830, 0x0, 0x0, 0x1b8, 0x0, r0}, &(0x7f0000ffb000/0x2000)=nil, &(0x7f0000ffb000/0x4000)=nil, &(0x7f0000000100), &(0x7f0000000140)=0x0) r3 = openat$hwrng(0xffffffffffffff9c, &(0x7f0000000180), 0x2, 0x0) r4 = syz_io_uring_setup(0x65dd, &(0x7f00000001c0)={0x0, 0xf46f, 0x20, 0x2, 0xdf}, &(0x7f0000ffe000/0x1000)=nil, &(0x7f0000ffd000/0x1000)=nil, &(0x7f0000000240), &(0x7f0000000280)) r5 = syz_genetlink_get_family_id$mptcp(&(0x7f0000000300), r3) sendmsg$MPTCP_PM_CMD_ADD_ADDR(r3, &(0x7f00000003c0)={&(0x7f00000002c0)={0x10, 0x0, 0x0, 0x10}, 0xc, &(0x7f0000000380)={&(0x7f0000000340)={0x24, r5, 0x300, 0x70bd26, 0x25dfdbfb, {}, [@MPTCP_PM_ATTR_SUBFLOWS={0x8, 0x3, 0x1}, @MPTCP_PM_ATTR_RCV_ADD_ADDRS={0x8, 0x2, 0x2}]}, 0x24}, 0x1, 0x0, 0x0, 0x20000004}, 0x8890) r6 = openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000500)='./cgroup/syz1\x00', 0x200002, 0x0) syz_io_uring_submit(0x0, r2, &(0x7f0000000580)=@IORING_OP_FILES_UPDATE={0x14, 0x4, 0x0, 0x0, 0x40, &(0x7f0000000540)=[r4, 0xffffffffffffffff, r6, r0, r1], 0x5}, 0x3) socket$inet6_tcp(0xa, 0x1, 0x0) 21:16:25 executing program 7: write$P9_RSYMLINK(0xffffffffffffffff, &(0x7f0000000000)={0x14, 0x11, 0x2, {0x40, 0x3, 0x2}}, 0x14) ioctl$sock_ifreq(0xffffffffffffffff, 0x8935, &(0x7f0000000040)={'lo\x00', @ifru_addrs=@ethernet}) ioctl$sock_ifreq(0xffffffffffffffff, 0x8994, &(0x7f0000000080)={'ip6gretap0\x00', @ifru_flags}) pipe2$9p(&(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}, 0x0) write$P9_RSYMLINK(r0, &(0x7f0000000240)={0x14, 0x11, 0x1, {0x1, 0x3, 0x2}}, 0x14) add_key$fscrypt_v1(&(0x7f0000000280), &(0x7f00000002c0)={'fscrypt:', @desc2}, &(0x7f0000000300)={0x0, "ccf022eeb1aa5b4a9067674b5b7079352411c35248e190415959cbe4b7be99236abd831288583a8ed4db4b7b3f838c24d293f908bf3509b49f2c17852201f646", 0x19}, 0x48, 0xfffffffffffffffa) syz_genetlink_get_family_id$mptcp(&(0x7f00000004c0), 0xffffffffffffffff) openat$vcsa(0xffffffffffffff9c, &(0x7f00000009c0), 0x14200, 0x0) syz_genetlink_get_family_id$mptcp(&(0x7f0000000a80), 0xffffffffffffffff) 21:16:25 executing program 5: r0 = io_uring_setup(0x355e, &(0x7f0000000000)={0x0, 0x7682, 0x20, 0x1, 0x1be}) syz_io_uring_setup(0x8fe, &(0x7f0000000080)={0x0, 0x1830, 0x0, 0x0, 0x1b8, 0x0, r0}, &(0x7f0000ffb000/0x2000)=nil, &(0x7f0000ffb000/0x4000)=nil, &(0x7f0000000100), &(0x7f0000000140)) r1 = openat$hwrng(0xffffffffffffff9c, &(0x7f0000000180), 0x2, 0x0) r2 = syz_io_uring_setup(0x65dd, &(0x7f00000001c0)={0x0, 0xf46f, 0x20, 0x2, 0xdf}, &(0x7f0000ffe000/0x1000)=nil, &(0x7f0000ffd000/0x1000)=nil, &(0x7f0000000240), &(0x7f0000000280)) r3 = syz_genetlink_get_family_id$mptcp(&(0x7f0000000300), r1) sendmsg$MPTCP_PM_CMD_ADD_ADDR(r1, &(0x7f00000003c0)={&(0x7f00000002c0)={0x10, 0x0, 0x0, 0x10}, 0xc, &(0x7f0000000380)={&(0x7f0000000340)={0x24, r3, 0x300, 0x70bd26, 0x25dfdbfb, {}, [@MPTCP_PM_ATTR_SUBFLOWS={0x8, 0x3, 0x1}, @MPTCP_PM_ATTR_RCV_ADD_ADDRS={0x8, 0x2, 0x2}]}, 0x24}, 0x1, 0x0, 0x0, 0x20000004}, 0x8890) syz_io_uring_setup(0x20f8, &(0x7f0000000400)={0x0, 0x7677, 0x8, 0x3, 0x22f, 0x0, r2}, &(0x7f0000ffe000/0x2000)=nil, &(0x7f0000ffb000/0x2000)=nil, &(0x7f0000000480), &(0x7f00000004c0)) openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000500)='./cgroup/syz1\x00', 0x200002, 0x0) socket$inet6_tcp(0xa, 0x1, 0x0) openat$procfs(0xffffffffffffff9c, &(0x7f00000010c0)='/proc/crypto\x00', 0x0, 0x0) 21:16:25 executing program 3: r0 = io_uring_setup(0x355e, &(0x7f0000000000)={0x0, 0x7682, 0x20, 0x1, 0x1be}) r1 = syz_io_uring_setup(0x8fe, &(0x7f0000000080)={0x0, 0x1830, 0x0, 0x0, 0x1b8, 0x0, r0}, &(0x7f0000ffb000/0x2000)=nil, &(0x7f0000ffb000/0x4000)=nil, &(0x7f0000000100), &(0x7f0000000140)=0x0) r3 = openat$hwrng(0xffffffffffffff9c, &(0x7f0000000180), 0x2, 0x0) r4 = syz_io_uring_setup(0x65dd, &(0x7f00000001c0)={0x0, 0xf46f, 0x20, 0x2, 0xdf}, &(0x7f0000ffe000/0x1000)=nil, &(0x7f0000ffd000/0x1000)=nil, &(0x7f0000000240), &(0x7f0000000280)) r5 = syz_genetlink_get_family_id$mptcp(&(0x7f0000000300), r3) sendmsg$MPTCP_PM_CMD_ADD_ADDR(r3, &(0x7f00000003c0)={&(0x7f00000002c0)={0x10, 0x0, 0x0, 0x10}, 0xc, &(0x7f0000000380)={&(0x7f0000000340)={0x24, r5, 0x300, 0x70bd26, 0x25dfdbfb, {}, [@MPTCP_PM_ATTR_SUBFLOWS={0x8, 0x3, 0x1}, @MPTCP_PM_ATTR_RCV_ADD_ADDRS={0x8, 0x2, 0x2}]}, 0x24}, 0x1, 0x0, 0x0, 0x20000004}, 0x8890) r6 = openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000500)='./cgroup/syz1\x00', 0x200002, 0x0) syz_io_uring_submit(0x0, r2, &(0x7f0000000580)=@IORING_OP_FILES_UPDATE={0x14, 0x4, 0x0, 0x0, 0x40, &(0x7f0000000540)=[r4, 0xffffffffffffffff, r6, r0, r1], 0x5}, 0x3) io_uring_setup(0x2812, &(0x7f00000005c0)={0x0, 0x5e1b, 0x2, 0x3, 0x12f, 0x0, r4}) io_uring_setup(0x7c8f, &(0x7f0000001140)={0x0, 0xc240, 0x10, 0x3, 0x1c7, 0x0, r4}) 21:16:25 executing program 2: syz_genetlink_get_family_id$nl80211(&(0x7f00000000c0), 0xffffffffffffffff) syz_open_dev$vcsa(0x0, 0x56, 0x4000) socketpair(0x0, 0x3, 0x6, &(0x7f0000000640)) r0 = openat$tcp_congestion(0xffffffffffffff9c, &(0x7f0000000800), 0x1, 0x0) write$tcp_congestion(r0, &(0x7f0000000840)='htcp\x00', 0x5) 21:16:25 executing program 1: r0 = io_uring_setup(0x355e, &(0x7f0000000000)={0x0, 0x7682, 0x20, 0x1, 0x1be}) r1 = syz_io_uring_setup(0x8fe, &(0x7f0000000080)={0x0, 0x1830, 0x0, 0x0, 0x1b8, 0x0, r0}, &(0x7f0000ffb000/0x2000)=nil, &(0x7f0000ffb000/0x4000)=nil, &(0x7f0000000100), &(0x7f0000000140)=0x0) r3 = syz_io_uring_setup(0x65dd, &(0x7f00000001c0)={0x0, 0xf46f, 0x20, 0x2, 0xdf}, &(0x7f0000ffe000/0x1000)=nil, &(0x7f0000ffd000/0x1000)=nil, &(0x7f0000000240), &(0x7f0000000280)) syz_genetlink_get_family_id$mptcp(&(0x7f0000000300), 0xffffffffffffffff) syz_io_uring_setup(0x20f8, &(0x7f0000000400)={0x0, 0x7677, 0x8, 0x3, 0x22f, 0x0, r3}, &(0x7f0000ffe000/0x2000)=nil, &(0x7f0000ffb000/0x2000)=nil, &(0x7f0000000480)=0x0, &(0x7f00000004c0)) r5 = openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000500)='./cgroup/syz1\x00', 0x200002, 0x0) syz_io_uring_submit(r4, r2, &(0x7f0000000580)=@IORING_OP_FILES_UPDATE={0x14, 0x4, 0x0, 0x0, 0x40, &(0x7f0000000540)=[r3, 0xffffffffffffffff, r5, r0, r1], 0x5}, 0x3) io_uring_setup(0x2812, &(0x7f00000005c0)={0x0, 0x5e1b, 0x2, 0x3, 0x12f, 0x0, r3}) socket$inet6_tcp(0xa, 0x1, 0x0) openat$procfs(0xffffffffffffff9c, &(0x7f00000010c0)='/proc/crypto\x00', 0x0, 0x0) io_uring_setup(0x7c8f, &(0x7f0000001140)={0x0, 0xc240, 0x10, 0x3, 0x1c7, 0x0, r3}) 21:16:25 executing program 7: write$P9_RSYMLINK(0xffffffffffffffff, &(0x7f0000000000)={0x14, 0x11, 0x2, {0x40, 0x3, 0x2}}, 0x14) ioctl$sock_ifreq(0xffffffffffffffff, 0x8935, &(0x7f0000000040)={'lo\x00', @ifru_addrs=@ethernet}) pipe2$9p(&(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}, 0x0) write$P9_RSYMLINK(r0, &(0x7f0000000240)={0x14, 0x11, 0x1, {0x1, 0x3, 0x2}}, 0x14) add_key$fscrypt_v1(&(0x7f0000000280), &(0x7f00000002c0)={'fscrypt:', @desc2}, &(0x7f0000000300)={0x0, "ccf022eeb1aa5b4a9067674b5b7079352411c35248e190415959cbe4b7be99236abd831288583a8ed4db4b7b3f838c24d293f908bf3509b49f2c17852201f646", 0x19}, 0x48, 0xfffffffffffffffa) syz_genetlink_get_family_id$mptcp(&(0x7f00000004c0), 0xffffffffffffffff) openat$vcsa(0xffffffffffffff9c, &(0x7f00000009c0), 0x14200, 0x0) syz_genetlink_get_family_id$mptcp(&(0x7f0000000a80), 0xffffffffffffffff) 21:16:25 executing program 6: r0 = io_uring_setup(0x355e, &(0x7f0000000000)={0x0, 0x7682, 0x20, 0x1, 0x1be}) r1 = syz_io_uring_setup(0x8fe, &(0x7f0000000080)={0x0, 0x1830, 0x0, 0x0, 0x1b8, 0x0, r0}, &(0x7f0000ffb000/0x2000)=nil, &(0x7f0000ffb000/0x4000)=nil, &(0x7f0000000100), &(0x7f0000000140)=0x0) r3 = openat$hwrng(0xffffffffffffff9c, &(0x7f0000000180), 0x2, 0x0) r4 = syz_io_uring_setup(0x65dd, &(0x7f00000001c0)={0x0, 0xf46f, 0x20, 0x2, 0xdf}, &(0x7f0000ffe000/0x1000)=nil, &(0x7f0000ffd000/0x1000)=nil, &(0x7f0000000240), &(0x7f0000000280)) r5 = syz_genetlink_get_family_id$mptcp(&(0x7f0000000300), r3) sendmsg$MPTCP_PM_CMD_ADD_ADDR(r3, &(0x7f00000003c0)={&(0x7f00000002c0)={0x10, 0x0, 0x0, 0x10}, 0xc, &(0x7f0000000380)={&(0x7f0000000340)={0x24, r5, 0x300, 0x70bd26, 0x25dfdbfb, {}, [@MPTCP_PM_ATTR_SUBFLOWS={0x8, 0x3, 0x1}, @MPTCP_PM_ATTR_RCV_ADD_ADDRS={0x8, 0x2, 0x2}]}, 0x24}, 0x1, 0x0, 0x0, 0x20000004}, 0x8890) syz_io_uring_setup(0x20f8, &(0x7f0000000400)={0x0, 0x7677, 0x8, 0x3, 0x22f, 0x0, r4}, &(0x7f0000ffe000/0x2000)=nil, &(0x7f0000ffb000/0x2000)=nil, &(0x7f0000000480)=0x0, &(0x7f00000004c0)) syz_io_uring_submit(r6, r2, &(0x7f0000000580)=@IORING_OP_FILES_UPDATE={0x14, 0x4, 0x0, 0x0, 0x40, &(0x7f0000000540)=[r4, 0xffffffffffffffff, 0xffffffffffffffff, r0, r1], 0x5}, 0x3) socket$inet6_tcp(0xa, 0x1, 0x0) openat$procfs(0xffffffffffffff9c, &(0x7f00000010c0)='/proc/crypto\x00', 0x0, 0x0) io_uring_setup(0x7c8f, &(0x7f0000001140)={0x0, 0xc240, 0x10, 0x3, 0x1c7, 0x0, r4}) 21:16:33 executing program 2: syz_genetlink_get_family_id$nl80211(&(0x7f00000000c0), 0xffffffffffffffff) syz_open_dev$vcsa(0x0, 0x56, 0x4000) socketpair(0x0, 0x3, 0x6, &(0x7f0000000640)) r0 = openat$tcp_congestion(0xffffffffffffff9c, &(0x7f0000000800), 0x1, 0x0) write$tcp_congestion(r0, &(0x7f0000000840)='htcp\x00', 0x5) 21:16:33 executing program 4: ioctl$SCSI_IOCTL_DOORUNLOCK(0xffffffffffffffff, 0x5381) r0 = syz_open_dev$mouse(&(0x7f0000000000), 0x578, 0x4000) ioctl$SG_GET_PACK_ID(r0, 0x227c, &(0x7f0000000040)) r1 = syz_genetlink_get_family_id$nl80211(&(0x7f00000000c0), r0) sendmsg$NL80211_CMD_NEW_KEY(r0, &(0x7f00000001c0)={&(0x7f0000000080)={0x10, 0x0, 0x0, 0x10}, 0xc, &(0x7f0000000180)={&(0x7f0000000100)={0x60, r1, 0x400, 0x70bd2b, 0x25dfdbff, {{}, {@val={0x8}, @void}}, [@NL80211_ATTR_KEY_TYPE={0x8, 0x37, 0x1}, @NL80211_ATTR_KEY_DEFAULT_MGMT={0x4}, @NL80211_ATTR_KEY={0x2c, 0x50, 0x0, 0x1, [@NL80211_KEY_DATA_WEP40={0x9, 0x1, "93f3c5ad5d"}, @NL80211_KEY_DEFAULT_TYPES={0x8, 0x8, 0x0, 0x1, [@NL80211_KEY_DEFAULT_TYPE_MULTICAST={0x4}]}, @NL80211_KEY_DATA_WEP104={0x11, 0x1, "8815558ac60368b42ebdf03bdb"}]}, @NL80211_ATTR_KEY_DATA_WEP40={0x9, 0x7, "74de692476"}]}, 0x60}, 0x1, 0x0, 0x0, 0x4000000}, 0x8000) syz_open_dev$vcsa(&(0x7f0000000440), 0x56, 0x4000) socketpair(0x0, 0x3, 0x6, &(0x7f0000000640)) r2 = openat$tcp_congestion(0xffffffffffffff9c, &(0x7f0000000800), 0x1, 0x0) write$tcp_congestion(r2, &(0x7f0000000840)='htcp\x00', 0x5) 21:16:33 executing program 6: r0 = io_uring_setup(0x355e, &(0x7f0000000000)={0x0, 0x7682, 0x20, 0x1, 0x1be}) r1 = syz_io_uring_setup(0x8fe, &(0x7f0000000080)={0x0, 0x1830, 0x0, 0x0, 0x1b8, 0x0, r0}, &(0x7f0000ffb000/0x2000)=nil, &(0x7f0000ffb000/0x4000)=nil, &(0x7f0000000100), &(0x7f0000000140)=0x0) r3 = openat$hwrng(0xffffffffffffff9c, &(0x7f0000000180), 0x2, 0x0) r4 = syz_io_uring_setup(0x65dd, &(0x7f00000001c0)={0x0, 0xf46f, 0x20, 0x2, 0xdf}, &(0x7f0000ffe000/0x1000)=nil, &(0x7f0000ffd000/0x1000)=nil, &(0x7f0000000240), &(0x7f0000000280)) r5 = syz_genetlink_get_family_id$mptcp(&(0x7f0000000300), r3) sendmsg$MPTCP_PM_CMD_ADD_ADDR(r3, &(0x7f00000003c0)={&(0x7f00000002c0)={0x10, 0x0, 0x0, 0x10}, 0xc, &(0x7f0000000380)={&(0x7f0000000340)={0x24, r5, 0x300, 0x70bd26, 0x25dfdbfb, {}, [@MPTCP_PM_ATTR_SUBFLOWS={0x8, 0x3, 0x1}, @MPTCP_PM_ATTR_RCV_ADD_ADDRS={0x8, 0x2, 0x2}]}, 0x24}, 0x1, 0x0, 0x0, 0x20000004}, 0x8890) syz_io_uring_setup(0x20f8, &(0x7f0000000400)={0x0, 0x7677, 0x8, 0x3, 0x22f, 0x0, r4}, &(0x7f0000ffe000/0x2000)=nil, &(0x7f0000ffb000/0x2000)=nil, &(0x7f0000000480)=0x0, &(0x7f00000004c0)) syz_io_uring_submit(r6, r2, &(0x7f0000000580)=@IORING_OP_FILES_UPDATE={0x14, 0x4, 0x0, 0x0, 0x40, &(0x7f0000000540)=[r4, 0xffffffffffffffff, 0xffffffffffffffff, r0, r1], 0x5}, 0x3) socket$inet6_tcp(0xa, 0x1, 0x0) openat$procfs(0xffffffffffffff9c, &(0x7f00000010c0)='/proc/crypto\x00', 0x0, 0x0) io_uring_setup(0x7c8f, &(0x7f0000001140)={0x0, 0xc240, 0x10, 0x3, 0x1c7, 0x0, r4}) 21:16:33 executing program 7: write$P9_RSYMLINK(0xffffffffffffffff, &(0x7f0000000000)={0x14, 0x11, 0x2, {0x40, 0x3, 0x2}}, 0x14) pipe2$9p(&(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}, 0x0) write$P9_RSYMLINK(r0, &(0x7f0000000240)={0x14, 0x11, 0x1, {0x1, 0x3, 0x2}}, 0x14) add_key$fscrypt_v1(&(0x7f0000000280), &(0x7f00000002c0)={'fscrypt:', @desc2}, &(0x7f0000000300)={0x0, "ccf022eeb1aa5b4a9067674b5b7079352411c35248e190415959cbe4b7be99236abd831288583a8ed4db4b7b3f838c24d293f908bf3509b49f2c17852201f646", 0x19}, 0x48, 0xfffffffffffffffa) syz_genetlink_get_family_id$mptcp(&(0x7f00000004c0), 0xffffffffffffffff) openat$vcsa(0xffffffffffffff9c, &(0x7f00000009c0), 0x14200, 0x0) syz_genetlink_get_family_id$mptcp(&(0x7f0000000a80), 0xffffffffffffffff) 21:16:33 executing program 3: r0 = io_uring_setup(0x355e, &(0x7f0000000000)={0x0, 0x7682, 0x20, 0x1, 0x1be}) r1 = syz_io_uring_setup(0x8fe, &(0x7f0000000080)={0x0, 0x1830, 0x0, 0x0, 0x1b8, 0x0, r0}, &(0x7f0000ffb000/0x2000)=nil, &(0x7f0000ffb000/0x4000)=nil, &(0x7f0000000100), &(0x7f0000000140)=0x0) r3 = openat$hwrng(0xffffffffffffff9c, &(0x7f0000000180), 0x2, 0x0) r4 = syz_io_uring_setup(0x65dd, &(0x7f00000001c0)={0x0, 0xf46f, 0x20, 0x2, 0xdf}, &(0x7f0000ffe000/0x1000)=nil, &(0x7f0000ffd000/0x1000)=nil, &(0x7f0000000240), &(0x7f0000000280)) r5 = syz_genetlink_get_family_id$mptcp(&(0x7f0000000300), r3) sendmsg$MPTCP_PM_CMD_ADD_ADDR(r3, &(0x7f00000003c0)={&(0x7f00000002c0)={0x10, 0x0, 0x0, 0x10}, 0xc, &(0x7f0000000380)={&(0x7f0000000340)={0x24, r5, 0x300, 0x70bd26, 0x25dfdbfb, {}, [@MPTCP_PM_ATTR_SUBFLOWS={0x8, 0x3, 0x1}, @MPTCP_PM_ATTR_RCV_ADD_ADDRS={0x8, 0x2, 0x2}]}, 0x24}, 0x1, 0x0, 0x0, 0x20000004}, 0x8890) r6 = openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000500)='./cgroup/syz1\x00', 0x200002, 0x0) syz_io_uring_submit(0x0, r2, &(0x7f0000000580)=@IORING_OP_FILES_UPDATE={0x14, 0x4, 0x0, 0x0, 0x40, &(0x7f0000000540)=[r4, 0xffffffffffffffff, r6, r0, r1], 0x5}, 0x3) io_uring_setup(0x2812, &(0x7f00000005c0)={0x0, 0x5e1b, 0x2, 0x3, 0x12f, 0x0, r4}) io_uring_setup(0x7c8f, &(0x7f0000001140)={0x0, 0xc240, 0x10, 0x3, 0x1c7, 0x0, r4}) 21:16:33 executing program 1: r0 = io_uring_setup(0x355e, &(0x7f0000000000)={0x0, 0x7682, 0x20, 0x1, 0x1be}) r1 = syz_io_uring_setup(0x8fe, &(0x7f0000000080)={0x0, 0x1830, 0x0, 0x0, 0x1b8, 0x0, r0}, &(0x7f0000ffb000/0x2000)=nil, &(0x7f0000ffb000/0x4000)=nil, &(0x7f0000000100), &(0x7f0000000140)=0x0) r3 = syz_io_uring_setup(0x65dd, &(0x7f00000001c0)={0x0, 0xf46f, 0x20, 0x2, 0xdf}, &(0x7f0000ffe000/0x1000)=nil, &(0x7f0000ffd000/0x1000)=nil, &(0x7f0000000240), &(0x7f0000000280)) syz_genetlink_get_family_id$mptcp(&(0x7f0000000300), 0xffffffffffffffff) syz_io_uring_setup(0x20f8, &(0x7f0000000400)={0x0, 0x7677, 0x8, 0x3, 0x22f, 0x0, r3}, &(0x7f0000ffe000/0x2000)=nil, &(0x7f0000ffb000/0x2000)=nil, &(0x7f0000000480)=0x0, &(0x7f00000004c0)) r5 = openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000500)='./cgroup/syz1\x00', 0x200002, 0x0) syz_io_uring_submit(r4, r2, &(0x7f0000000580)=@IORING_OP_FILES_UPDATE={0x14, 0x4, 0x0, 0x0, 0x40, &(0x7f0000000540)=[r3, 0xffffffffffffffff, r5, r0, r1], 0x5}, 0x3) io_uring_setup(0x2812, &(0x7f00000005c0)={0x0, 0x5e1b, 0x2, 0x3, 0x12f, 0x0, r3}) socket$inet6_tcp(0xa, 0x1, 0x0) openat$procfs(0xffffffffffffff9c, &(0x7f00000010c0)='/proc/crypto\x00', 0x0, 0x0) io_uring_setup(0x7c8f, &(0x7f0000001140)={0x0, 0xc240, 0x10, 0x3, 0x1c7, 0x0, r3}) 21:16:33 executing program 5: r0 = io_uring_setup(0x355e, &(0x7f0000000000)={0x0, 0x7682, 0x20, 0x1, 0x1be}) syz_io_uring_setup(0x8fe, &(0x7f0000000080)={0x0, 0x1830, 0x0, 0x0, 0x1b8, 0x0, r0}, &(0x7f0000ffb000/0x2000)=nil, &(0x7f0000ffb000/0x4000)=nil, &(0x7f0000000100), &(0x7f0000000140)) r1 = openat$hwrng(0xffffffffffffff9c, &(0x7f0000000180), 0x2, 0x0) r2 = syz_io_uring_setup(0x65dd, &(0x7f00000001c0)={0x0, 0xf46f, 0x20, 0x2, 0xdf}, &(0x7f0000ffe000/0x1000)=nil, &(0x7f0000ffd000/0x1000)=nil, &(0x7f0000000240), &(0x7f0000000280)) r3 = syz_genetlink_get_family_id$mptcp(&(0x7f0000000300), r1) sendmsg$MPTCP_PM_CMD_ADD_ADDR(r1, &(0x7f00000003c0)={&(0x7f00000002c0)={0x10, 0x0, 0x0, 0x10}, 0xc, &(0x7f0000000380)={&(0x7f0000000340)={0x24, r3, 0x300, 0x70bd26, 0x25dfdbfb, {}, [@MPTCP_PM_ATTR_SUBFLOWS={0x8, 0x3, 0x1}, @MPTCP_PM_ATTR_RCV_ADD_ADDRS={0x8, 0x2, 0x2}]}, 0x24}, 0x1, 0x0, 0x0, 0x20000004}, 0x8890) syz_io_uring_setup(0x20f8, &(0x7f0000000400)={0x0, 0x7677, 0x8, 0x3, 0x22f, 0x0, r2}, &(0x7f0000ffe000/0x2000)=nil, &(0x7f0000ffb000/0x2000)=nil, &(0x7f0000000480), &(0x7f00000004c0)) openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000500)='./cgroup/syz1\x00', 0x200002, 0x0) socket$inet6_tcp(0xa, 0x1, 0x0) openat$procfs(0xffffffffffffff9c, &(0x7f00000010c0)='/proc/crypto\x00', 0x0, 0x0) 21:16:33 executing program 0: r0 = io_uring_setup(0x355e, &(0x7f0000000000)={0x0, 0x7682, 0x20, 0x1, 0x1be}) r1 = syz_io_uring_setup(0x8fe, &(0x7f0000000080)={0x0, 0x1830, 0x0, 0x0, 0x1b8, 0x0, r0}, &(0x7f0000ffb000/0x2000)=nil, &(0x7f0000ffb000/0x4000)=nil, &(0x7f0000000100), &(0x7f0000000140)=0x0) r3 = openat$hwrng(0xffffffffffffff9c, &(0x7f0000000180), 0x2, 0x0) r4 = syz_io_uring_setup(0x65dd, &(0x7f00000001c0)={0x0, 0xf46f, 0x20, 0x2, 0xdf}, &(0x7f0000ffe000/0x1000)=nil, &(0x7f0000ffd000/0x1000)=nil, &(0x7f0000000240), &(0x7f0000000280)) r5 = syz_genetlink_get_family_id$mptcp(&(0x7f0000000300), r3) sendmsg$MPTCP_PM_CMD_ADD_ADDR(r3, &(0x7f00000003c0)={&(0x7f00000002c0)={0x10, 0x0, 0x0, 0x10}, 0xc, &(0x7f0000000380)={&(0x7f0000000340)={0x24, r5, 0x300, 0x70bd26, 0x25dfdbfb, {}, [@MPTCP_PM_ATTR_SUBFLOWS={0x8, 0x3, 0x1}, @MPTCP_PM_ATTR_RCV_ADD_ADDRS={0x8, 0x2, 0x2}]}, 0x24}, 0x1, 0x0, 0x0, 0x20000004}, 0x8890) r6 = openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000500)='./cgroup/syz1\x00', 0x200002, 0x0) syz_io_uring_submit(0x0, r2, &(0x7f0000000580)=@IORING_OP_FILES_UPDATE={0x14, 0x4, 0x0, 0x0, 0x40, &(0x7f0000000540)=[r4, 0xffffffffffffffff, r6, r0, r1], 0x5}, 0x3) socket$inet6_tcp(0xa, 0x1, 0x0) 21:16:34 executing program 3: r0 = io_uring_setup(0x355e, &(0x7f0000000000)={0x0, 0x7682, 0x20, 0x1, 0x1be}) r1 = syz_io_uring_setup(0x8fe, &(0x7f0000000080)={0x0, 0x1830, 0x0, 0x0, 0x1b8, 0x0, r0}, &(0x7f0000ffb000/0x2000)=nil, &(0x7f0000ffb000/0x4000)=nil, &(0x7f0000000100), &(0x7f0000000140)=0x0) r3 = openat$hwrng(0xffffffffffffff9c, &(0x7f0000000180), 0x2, 0x0) r4 = syz_io_uring_setup(0x65dd, &(0x7f00000001c0)={0x0, 0xf46f, 0x20, 0x2, 0xdf}, &(0x7f0000ffe000/0x1000)=nil, &(0x7f0000ffd000/0x1000)=nil, &(0x7f0000000240), &(0x7f0000000280)) r5 = syz_genetlink_get_family_id$mptcp(&(0x7f0000000300), r3) sendmsg$MPTCP_PM_CMD_ADD_ADDR(r3, &(0x7f00000003c0)={&(0x7f00000002c0)={0x10, 0x0, 0x0, 0x10}, 0xc, &(0x7f0000000380)={&(0x7f0000000340)={0x24, r5, 0x300, 0x70bd26, 0x25dfdbfb, {}, [@MPTCP_PM_ATTR_SUBFLOWS={0x8, 0x3, 0x1}, @MPTCP_PM_ATTR_RCV_ADD_ADDRS={0x8, 0x2, 0x2}]}, 0x24}, 0x1, 0x0, 0x0, 0x20000004}, 0x8890) r6 = openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000500)='./cgroup/syz1\x00', 0x200002, 0x0) syz_io_uring_submit(0x0, r2, &(0x7f0000000580)=@IORING_OP_FILES_UPDATE={0x14, 0x4, 0x0, 0x0, 0x40, &(0x7f0000000540)=[r4, 0xffffffffffffffff, r6, r0, r1], 0x5}, 0x3) io_uring_setup(0x2812, &(0x7f00000005c0)={0x0, 0x5e1b, 0x2, 0x3, 0x12f, 0x0, r4}) io_uring_setup(0x7c8f, &(0x7f0000001140)={0x0, 0xc240, 0x10, 0x3, 0x1c7, 0x0, r4}) 21:16:34 executing program 6: r0 = io_uring_setup(0x355e, &(0x7f0000000000)={0x0, 0x7682, 0x20, 0x1, 0x1be}) r1 = syz_io_uring_setup(0x8fe, &(0x7f0000000080)={0x0, 0x1830, 0x0, 0x0, 0x1b8, 0x0, r0}, &(0x7f0000ffb000/0x2000)=nil, &(0x7f0000ffb000/0x4000)=nil, &(0x7f0000000100), &(0x7f0000000140)=0x0) r3 = openat$hwrng(0xffffffffffffff9c, &(0x7f0000000180), 0x2, 0x0) r4 = syz_io_uring_setup(0x65dd, &(0x7f00000001c0)={0x0, 0xf46f, 0x20, 0x2, 0xdf}, &(0x7f0000ffe000/0x1000)=nil, &(0x7f0000ffd000/0x1000)=nil, &(0x7f0000000240), &(0x7f0000000280)) r5 = syz_genetlink_get_family_id$mptcp(&(0x7f0000000300), r3) sendmsg$MPTCP_PM_CMD_ADD_ADDR(r3, &(0x7f00000003c0)={&(0x7f00000002c0)={0x10, 0x0, 0x0, 0x10}, 0xc, &(0x7f0000000380)={&(0x7f0000000340)={0x24, r5, 0x300, 0x70bd26, 0x25dfdbfb, {}, [@MPTCP_PM_ATTR_SUBFLOWS={0x8, 0x3, 0x1}, @MPTCP_PM_ATTR_RCV_ADD_ADDRS={0x8, 0x2, 0x2}]}, 0x24}, 0x1, 0x0, 0x0, 0x20000004}, 0x8890) syz_io_uring_setup(0x20f8, &(0x7f0000000400)={0x0, 0x7677, 0x8, 0x3, 0x22f, 0x0, r4}, &(0x7f0000ffe000/0x2000)=nil, &(0x7f0000ffb000/0x2000)=nil, &(0x7f0000000480)=0x0, &(0x7f00000004c0)) syz_io_uring_submit(r6, r2, &(0x7f0000000580)=@IORING_OP_FILES_UPDATE={0x14, 0x4, 0x0, 0x0, 0x40, &(0x7f0000000540)=[r4, 0xffffffffffffffff, 0xffffffffffffffff, r0, r1], 0x5}, 0x3) socket$inet6_tcp(0xa, 0x1, 0x0) openat$procfs(0xffffffffffffff9c, &(0x7f00000010c0)='/proc/crypto\x00', 0x0, 0x0) io_uring_setup(0x7c8f, &(0x7f0000001140)={0x0, 0xc240, 0x10, 0x3, 0x1c7, 0x0, r4}) 21:16:34 executing program 4: ioctl$SCSI_IOCTL_DOORUNLOCK(0xffffffffffffffff, 0x5381) r0 = syz_open_dev$mouse(&(0x7f0000000000), 0x578, 0x4000) ioctl$SG_GET_PACK_ID(r0, 0x227c, &(0x7f0000000040)) r1 = syz_genetlink_get_family_id$nl80211(&(0x7f00000000c0), r0) sendmsg$NL80211_CMD_NEW_KEY(r0, &(0x7f00000001c0)={&(0x7f0000000080)={0x10, 0x0, 0x0, 0x10}, 0xc, &(0x7f0000000180)={&(0x7f0000000100)={0x60, r1, 0x400, 0x70bd2b, 0x25dfdbff, {{}, {@val={0x8}, @void}}, [@NL80211_ATTR_KEY_TYPE={0x8, 0x37, 0x1}, @NL80211_ATTR_KEY_DEFAULT_MGMT={0x4}, @NL80211_ATTR_KEY={0x2c, 0x50, 0x0, 0x1, [@NL80211_KEY_DATA_WEP40={0x9, 0x1, "93f3c5ad5d"}, @NL80211_KEY_DEFAULT_TYPES={0x8, 0x8, 0x0, 0x1, [@NL80211_KEY_DEFAULT_TYPE_MULTICAST={0x4}]}, @NL80211_KEY_DATA_WEP104={0x11, 0x1, "8815558ac60368b42ebdf03bdb"}]}, @NL80211_ATTR_KEY_DATA_WEP40={0x9, 0x7, "74de692476"}]}, 0x60}, 0x1, 0x0, 0x0, 0x4000000}, 0x8000) syz_open_dev$vcsa(&(0x7f0000000440), 0x56, 0x4000) socketpair(0x0, 0x3, 0x6, &(0x7f0000000640)) r2 = openat$tcp_congestion(0xffffffffffffff9c, &(0x7f0000000800), 0x1, 0x0) write$tcp_congestion(r2, &(0x7f0000000840)='htcp\x00', 0x5) 21:16:34 executing program 7: pipe2$9p(&(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}, 0x0) write$P9_RSYMLINK(r0, &(0x7f0000000240)={0x14, 0x11, 0x1, {0x1, 0x3, 0x2}}, 0x14) add_key$fscrypt_v1(&(0x7f0000000280), &(0x7f00000002c0)={'fscrypt:', @desc2}, &(0x7f0000000300)={0x0, "ccf022eeb1aa5b4a9067674b5b7079352411c35248e190415959cbe4b7be99236abd831288583a8ed4db4b7b3f838c24d293f908bf3509b49f2c17852201f646", 0x19}, 0x48, 0xfffffffffffffffa) syz_genetlink_get_family_id$mptcp(&(0x7f00000004c0), 0xffffffffffffffff) openat$vcsa(0xffffffffffffff9c, &(0x7f00000009c0), 0x14200, 0x0) syz_genetlink_get_family_id$mptcp(&(0x7f0000000a80), 0xffffffffffffffff) 21:16:34 executing program 1: r0 = io_uring_setup(0x355e, &(0x7f0000000000)={0x0, 0x7682, 0x20, 0x1, 0x1be}) r1 = syz_io_uring_setup(0x8fe, &(0x7f0000000080)={0x0, 0x1830, 0x0, 0x0, 0x1b8, 0x0, r0}, &(0x7f0000ffb000/0x2000)=nil, &(0x7f0000ffb000/0x4000)=nil, &(0x7f0000000100), &(0x7f0000000140)=0x0) r3 = syz_io_uring_setup(0x65dd, &(0x7f00000001c0)={0x0, 0xf46f, 0x20, 0x2, 0xdf}, &(0x7f0000ffe000/0x1000)=nil, &(0x7f0000ffd000/0x1000)=nil, &(0x7f0000000240), &(0x7f0000000280)) syz_genetlink_get_family_id$mptcp(&(0x7f0000000300), 0xffffffffffffffff) syz_io_uring_setup(0x20f8, &(0x7f0000000400)={0x0, 0x7677, 0x8, 0x3, 0x22f, 0x0, r3}, &(0x7f0000ffe000/0x2000)=nil, &(0x7f0000ffb000/0x2000)=nil, &(0x7f0000000480)=0x0, &(0x7f00000004c0)) r5 = openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000500)='./cgroup/syz1\x00', 0x200002, 0x0) syz_io_uring_submit(r4, r2, &(0x7f0000000580)=@IORING_OP_FILES_UPDATE={0x14, 0x4, 0x0, 0x0, 0x40, &(0x7f0000000540)=[r3, 0xffffffffffffffff, r5, r0, r1], 0x5}, 0x3) io_uring_setup(0x2812, &(0x7f00000005c0)={0x0, 0x5e1b, 0x2, 0x3, 0x12f, 0x0, r3}) socket$inet6_tcp(0xa, 0x1, 0x0) openat$procfs(0xffffffffffffff9c, &(0x7f00000010c0)='/proc/crypto\x00', 0x0, 0x0) io_uring_setup(0x7c8f, &(0x7f0000001140)={0x0, 0xc240, 0x10, 0x3, 0x1c7, 0x0, r3}) 21:16:34 executing program 0: r0 = io_uring_setup(0x355e, &(0x7f0000000000)={0x0, 0x7682, 0x20, 0x1, 0x1be}) syz_io_uring_setup(0x8fe, &(0x7f0000000080)={0x0, 0x1830, 0x0, 0x0, 0x1b8, 0x0, r0}, &(0x7f0000ffb000/0x2000)=nil, &(0x7f0000ffb000/0x4000)=nil, &(0x7f0000000100), &(0x7f0000000140)) r1 = openat$hwrng(0xffffffffffffff9c, &(0x7f0000000180), 0x2, 0x0) r2 = syz_io_uring_setup(0x65dd, &(0x7f00000001c0)={0x0, 0xf46f, 0x20, 0x2, 0xdf}, &(0x7f0000ffe000/0x1000)=nil, &(0x7f0000ffd000/0x1000)=nil, &(0x7f0000000240), &(0x7f0000000280)) r3 = syz_genetlink_get_family_id$mptcp(&(0x7f0000000300), r1) sendmsg$MPTCP_PM_CMD_ADD_ADDR(r1, &(0x7f00000003c0)={&(0x7f00000002c0)={0x10, 0x0, 0x0, 0x10}, 0xc, &(0x7f0000000380)={&(0x7f0000000340)={0x24, r3, 0x300, 0x70bd26, 0x25dfdbfb, {}, [@MPTCP_PM_ATTR_SUBFLOWS={0x8, 0x3, 0x1}, @MPTCP_PM_ATTR_RCV_ADD_ADDRS={0x8, 0x2, 0x2}]}, 0x24}, 0x1, 0x0, 0x0, 0x20000004}, 0x8890) openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000500)='./cgroup/syz1\x00', 0x200002, 0x0) io_uring_setup(0x2812, &(0x7f00000005c0)={0x0, 0x5e1b, 0x2, 0x3, 0x12f, 0x0, r2}) socket$inet6_tcp(0xa, 0x1, 0x0) 21:16:42 executing program 0: r0 = io_uring_setup(0x355e, &(0x7f0000000000)={0x0, 0x7682, 0x20, 0x1, 0x1be}) syz_io_uring_setup(0x8fe, &(0x7f0000000080)={0x0, 0x1830, 0x0, 0x0, 0x1b8, 0x0, r0}, &(0x7f0000ffb000/0x2000)=nil, &(0x7f0000ffb000/0x4000)=nil, &(0x7f0000000100), &(0x7f0000000140)) r1 = openat$hwrng(0xffffffffffffff9c, &(0x7f0000000180), 0x2, 0x0) r2 = syz_io_uring_setup(0x65dd, &(0x7f00000001c0)={0x0, 0xf46f, 0x20, 0x2, 0xdf}, &(0x7f0000ffe000/0x1000)=nil, &(0x7f0000ffd000/0x1000)=nil, &(0x7f0000000240), &(0x7f0000000280)) r3 = syz_genetlink_get_family_id$mptcp(&(0x7f0000000300), r1) sendmsg$MPTCP_PM_CMD_ADD_ADDR(r1, &(0x7f00000003c0)={&(0x7f00000002c0)={0x10, 0x0, 0x0, 0x10}, 0xc, &(0x7f0000000380)={&(0x7f0000000340)={0x24, r3, 0x300, 0x70bd26, 0x25dfdbfb, {}, [@MPTCP_PM_ATTR_SUBFLOWS={0x8, 0x3, 0x1}, @MPTCP_PM_ATTR_RCV_ADD_ADDRS={0x8, 0x2, 0x2}]}, 0x24}, 0x1, 0x0, 0x0, 0x20000004}, 0x8890) openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000500)='./cgroup/syz1\x00', 0x200002, 0x0) io_uring_setup(0x2812, &(0x7f00000005c0)={0x0, 0x5e1b, 0x2, 0x3, 0x12f, 0x0, r2}) socket$inet6_tcp(0xa, 0x1, 0x0) 21:16:42 executing program 7: pipe2$9p(0x0, 0x0) write$P9_RSYMLINK(0xffffffffffffffff, &(0x7f0000000240)={0x14, 0x11, 0x1, {0x1, 0x3, 0x2}}, 0x14) add_key$fscrypt_v1(&(0x7f0000000280), &(0x7f00000002c0)={'fscrypt:', @desc2}, &(0x7f0000000300)={0x0, "ccf022eeb1aa5b4a9067674b5b7079352411c35248e190415959cbe4b7be99236abd831288583a8ed4db4b7b3f838c24d293f908bf3509b49f2c17852201f646", 0x19}, 0x48, 0xfffffffffffffffa) syz_genetlink_get_family_id$mptcp(&(0x7f00000004c0), 0xffffffffffffffff) openat$vcsa(0xffffffffffffff9c, &(0x7f00000009c0), 0x14200, 0x0) syz_genetlink_get_family_id$mptcp(&(0x7f0000000a80), 0xffffffffffffffff) 21:16:42 executing program 5: r0 = io_uring_setup(0x355e, &(0x7f0000000000)={0x0, 0x7682, 0x20, 0x1, 0x1be}) syz_io_uring_setup(0x8fe, &(0x7f0000000080)={0x0, 0x1830, 0x0, 0x0, 0x1b8, 0x0, r0}, &(0x7f0000ffb000/0x2000)=nil, &(0x7f0000ffb000/0x4000)=nil, &(0x7f0000000100), &(0x7f0000000140)) r1 = openat$hwrng(0xffffffffffffff9c, &(0x7f0000000180), 0x2, 0x0) r2 = syz_io_uring_setup(0x65dd, &(0x7f00000001c0)={0x0, 0xf46f, 0x20, 0x2, 0xdf}, &(0x7f0000ffe000/0x1000)=nil, &(0x7f0000ffd000/0x1000)=nil, &(0x7f0000000240), &(0x7f0000000280)) r3 = syz_genetlink_get_family_id$mptcp(&(0x7f0000000300), r1) sendmsg$MPTCP_PM_CMD_ADD_ADDR(r1, &(0x7f00000003c0)={&(0x7f00000002c0)={0x10, 0x0, 0x0, 0x10}, 0xc, &(0x7f0000000380)={&(0x7f0000000340)={0x24, r3, 0x300, 0x70bd26, 0x25dfdbfb, {}, [@MPTCP_PM_ATTR_SUBFLOWS={0x8, 0x3, 0x1}, @MPTCP_PM_ATTR_RCV_ADD_ADDRS={0x8, 0x2, 0x2}]}, 0x24}, 0x1, 0x0, 0x0, 0x20000004}, 0x8890) syz_io_uring_setup(0x20f8, &(0x7f0000000400)={0x0, 0x7677, 0x8, 0x3, 0x22f, 0x0, r2}, &(0x7f0000ffe000/0x2000)=nil, &(0x7f0000ffb000/0x2000)=nil, &(0x7f0000000480), &(0x7f00000004c0)) openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000500)='./cgroup/syz1\x00', 0x200002, 0x0) socket$inet6_tcp(0xa, 0x1, 0x0) openat$procfs(0xffffffffffffff9c, &(0x7f00000010c0)='/proc/crypto\x00', 0x0, 0x0) 21:16:42 executing program 4: ioctl$SCSI_IOCTL_DOORUNLOCK(0xffffffffffffffff, 0x5381) r0 = syz_open_dev$mouse(&(0x7f0000000000), 0x578, 0x4000) ioctl$SG_GET_PACK_ID(r0, 0x227c, &(0x7f0000000040)) syz_genetlink_get_family_id$nl80211(&(0x7f00000000c0), r0) syz_open_dev$vcsa(&(0x7f0000000440), 0x56, 0x4000) socketpair(0x0, 0x3, 0x6, &(0x7f0000000640)) r1 = openat$tcp_congestion(0xffffffffffffff9c, &(0x7f0000000800), 0x1, 0x0) write$tcp_congestion(r1, &(0x7f0000000840)='htcp\x00', 0x5) 21:16:42 executing program 2: syz_genetlink_get_family_id$nl80211(&(0x7f00000000c0), 0xffffffffffffffff) syz_open_dev$vcsa(0x0, 0x56, 0x4000) socketpair(0x0, 0x3, 0x6, &(0x7f0000000640)) r0 = openat$tcp_congestion(0xffffffffffffff9c, &(0x7f0000000800), 0x1, 0x0) write$tcp_congestion(r0, &(0x7f0000000840)='htcp\x00', 0x5) 21:16:42 executing program 6: r0 = io_uring_setup(0x355e, &(0x7f0000000000)={0x0, 0x7682, 0x20, 0x1, 0x1be}) r1 = syz_io_uring_setup(0x8fe, &(0x7f0000000080)={0x0, 0x1830, 0x0, 0x0, 0x1b8, 0x0, r0}, &(0x7f0000ffb000/0x2000)=nil, &(0x7f0000ffb000/0x4000)=nil, &(0x7f0000000100), &(0x7f0000000140)=0x0) r3 = openat$hwrng(0xffffffffffffff9c, &(0x7f0000000180), 0x2, 0x0) r4 = syz_io_uring_setup(0x65dd, &(0x7f00000001c0)={0x0, 0xf46f, 0x20, 0x2, 0xdf}, &(0x7f0000ffe000/0x1000)=nil, &(0x7f0000ffd000/0x1000)=nil, &(0x7f0000000240), &(0x7f0000000280)) r5 = syz_genetlink_get_family_id$mptcp(&(0x7f0000000300), r3) sendmsg$MPTCP_PM_CMD_ADD_ADDR(r3, &(0x7f00000003c0)={&(0x7f00000002c0)={0x10, 0x0, 0x0, 0x10}, 0xc, &(0x7f0000000380)={&(0x7f0000000340)={0x24, r5, 0x300, 0x70bd26, 0x25dfdbfb, {}, [@MPTCP_PM_ATTR_SUBFLOWS={0x8, 0x3, 0x1}, @MPTCP_PM_ATTR_RCV_ADD_ADDRS={0x8, 0x2, 0x2}]}, 0x24}, 0x1, 0x0, 0x0, 0x20000004}, 0x8890) r6 = openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000500)='./cgroup/syz1\x00', 0x200002, 0x0) syz_io_uring_submit(0x0, r2, &(0x7f0000000580)=@IORING_OP_FILES_UPDATE={0x14, 0x4, 0x0, 0x0, 0x40, &(0x7f0000000540)=[r4, 0xffffffffffffffff, r6, r0, r1], 0x5}, 0x3) socket$inet6_tcp(0xa, 0x1, 0x0) openat$procfs(0xffffffffffffff9c, &(0x7f00000010c0)='/proc/crypto\x00', 0x0, 0x0) io_uring_setup(0x7c8f, &(0x7f0000001140)={0x0, 0xc240, 0x10, 0x3, 0x1c7, 0x0, r4}) 21:16:42 executing program 3: r0 = io_uring_setup(0x355e, &(0x7f0000000000)={0x0, 0x7682, 0x20, 0x1, 0x1be}) syz_io_uring_setup(0x8fe, &(0x7f0000000080)={0x0, 0x1830, 0x0, 0x0, 0x1b8, 0x0, r0}, &(0x7f0000ffb000/0x2000)=nil, &(0x7f0000ffb000/0x4000)=nil, &(0x7f0000000100), &(0x7f0000000140)) r1 = openat$hwrng(0xffffffffffffff9c, &(0x7f0000000180), 0x2, 0x0) r2 = syz_io_uring_setup(0x65dd, &(0x7f00000001c0)={0x0, 0xf46f, 0x20, 0x2, 0xdf}, &(0x7f0000ffe000/0x1000)=nil, &(0x7f0000ffd000/0x1000)=nil, &(0x7f0000000240), &(0x7f0000000280)) r3 = syz_genetlink_get_family_id$mptcp(&(0x7f0000000300), r1) sendmsg$MPTCP_PM_CMD_ADD_ADDR(r1, &(0x7f00000003c0)={&(0x7f00000002c0)={0x10, 0x0, 0x0, 0x10}, 0xc, &(0x7f0000000380)={&(0x7f0000000340)={0x24, r3, 0x300, 0x70bd26, 0x25dfdbfb, {}, [@MPTCP_PM_ATTR_SUBFLOWS={0x8, 0x3, 0x1}, @MPTCP_PM_ATTR_RCV_ADD_ADDRS={0x8, 0x2, 0x2}]}, 0x24}, 0x1, 0x0, 0x0, 0x20000004}, 0x8890) openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000500)='./cgroup/syz1\x00', 0x200002, 0x0) io_uring_setup(0x2812, &(0x7f00000005c0)={0x0, 0x5e1b, 0x2, 0x3, 0x12f, 0x0, r2}) socket$inet6_tcp(0xa, 0x1, 0x0) io_uring_setup(0x7c8f, &(0x7f0000001140)={0x0, 0xc240, 0x10, 0x3, 0x1c7, 0x0, r2}) 21:16:42 executing program 1: r0 = io_uring_setup(0x355e, &(0x7f0000000000)={0x0, 0x7682, 0x20, 0x1, 0x1be}) r1 = openat$hwrng(0xffffffffffffff9c, &(0x7f0000000180), 0x2, 0x0) r2 = syz_io_uring_setup(0x65dd, &(0x7f00000001c0)={0x0, 0xf46f, 0x20, 0x2, 0xdf}, &(0x7f0000ffe000/0x1000)=nil, &(0x7f0000ffd000/0x1000)=nil, &(0x7f0000000240), &(0x7f0000000280)) syz_genetlink_get_family_id$mptcp(&(0x7f0000000300), r1) syz_io_uring_setup(0x20f8, &(0x7f0000000400)={0x0, 0x7677, 0x8, 0x3, 0x22f, 0x0, r2}, &(0x7f0000ffe000/0x2000)=nil, &(0x7f0000ffb000/0x2000)=nil, &(0x7f0000000480)=0x0, &(0x7f00000004c0)) r4 = openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000500)='./cgroup/syz1\x00', 0x200002, 0x0) syz_io_uring_submit(r3, 0x0, &(0x7f0000000580)=@IORING_OP_FILES_UPDATE={0x14, 0x4, 0x0, 0x0, 0x40, &(0x7f0000000540)=[r2, 0xffffffffffffffff, r4, r0, 0xffffffffffffffff], 0x5}, 0x3) io_uring_setup(0x2812, &(0x7f00000005c0)={0x0, 0x5e1b, 0x2, 0x3, 0x12f, 0x0, r2}) socket$inet6_tcp(0xa, 0x1, 0x0) openat$procfs(0xffffffffffffff9c, &(0x7f00000010c0)='/proc/crypto\x00', 0x0, 0x0) io_uring_setup(0x7c8f, &(0x7f0000001140)={0x0, 0xc240, 0x10, 0x3, 0x1c7, 0x0, r2}) 21:16:42 executing program 3: r0 = io_uring_setup(0x355e, &(0x7f0000000000)={0x0, 0x7682, 0x20, 0x1, 0x1be}) syz_io_uring_setup(0x8fe, &(0x7f0000000080)={0x0, 0x1830, 0x0, 0x0, 0x1b8, 0x0, r0}, &(0x7f0000ffb000/0x2000)=nil, &(0x7f0000ffb000/0x4000)=nil, &(0x7f0000000100), &(0x7f0000000140)) r1 = openat$hwrng(0xffffffffffffff9c, &(0x7f0000000180), 0x2, 0x0) r2 = syz_io_uring_setup(0x65dd, &(0x7f00000001c0)={0x0, 0xf46f, 0x20, 0x2, 0xdf}, &(0x7f0000ffe000/0x1000)=nil, &(0x7f0000ffd000/0x1000)=nil, &(0x7f0000000240), &(0x7f0000000280)) r3 = syz_genetlink_get_family_id$mptcp(&(0x7f0000000300), r1) sendmsg$MPTCP_PM_CMD_ADD_ADDR(r1, &(0x7f00000003c0)={&(0x7f00000002c0)={0x10, 0x0, 0x0, 0x10}, 0xc, &(0x7f0000000380)={&(0x7f0000000340)={0x24, r3, 0x300, 0x70bd26, 0x25dfdbfb, {}, [@MPTCP_PM_ATTR_SUBFLOWS={0x8, 0x3, 0x1}, @MPTCP_PM_ATTR_RCV_ADD_ADDRS={0x8, 0x2, 0x2}]}, 0x24}, 0x1, 0x0, 0x0, 0x20000004}, 0x8890) openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000500)='./cgroup/syz1\x00', 0x200002, 0x0) io_uring_setup(0x2812, &(0x7f00000005c0)={0x0, 0x5e1b, 0x2, 0x3, 0x12f, 0x0, r2}) socket$inet6_tcp(0xa, 0x1, 0x0) io_uring_setup(0x7c8f, &(0x7f0000001140)={0x0, 0xc240, 0x10, 0x3, 0x1c7, 0x0, r2}) 21:16:42 executing program 4: ioctl$SCSI_IOCTL_DOORUNLOCK(0xffffffffffffffff, 0x5381) r0 = syz_open_dev$mouse(&(0x7f0000000000), 0x578, 0x4000) ioctl$SG_GET_PACK_ID(r0, 0x227c, &(0x7f0000000040)) syz_genetlink_get_family_id$nl80211(&(0x7f00000000c0), r0) syz_open_dev$vcsa(&(0x7f0000000440), 0x56, 0x4000) socketpair(0x0, 0x3, 0x6, &(0x7f0000000640)) r1 = openat$tcp_congestion(0xffffffffffffff9c, &(0x7f0000000800), 0x1, 0x0) write$tcp_congestion(r1, &(0x7f0000000840)='htcp\x00', 0x5) 21:16:42 executing program 0: r0 = io_uring_setup(0x355e, &(0x7f0000000000)={0x0, 0x7682, 0x20, 0x1, 0x1be}) syz_io_uring_setup(0x8fe, &(0x7f0000000080)={0x0, 0x1830, 0x0, 0x0, 0x1b8, 0x0, r0}, &(0x7f0000ffb000/0x2000)=nil, &(0x7f0000ffb000/0x4000)=nil, &(0x7f0000000100), &(0x7f0000000140)) r1 = openat$hwrng(0xffffffffffffff9c, &(0x7f0000000180), 0x2, 0x0) r2 = syz_io_uring_setup(0x65dd, &(0x7f00000001c0)={0x0, 0xf46f, 0x20, 0x2, 0xdf}, &(0x7f0000ffe000/0x1000)=nil, &(0x7f0000ffd000/0x1000)=nil, &(0x7f0000000240), &(0x7f0000000280)) r3 = syz_genetlink_get_family_id$mptcp(&(0x7f0000000300), r1) sendmsg$MPTCP_PM_CMD_ADD_ADDR(r1, &(0x7f00000003c0)={&(0x7f00000002c0)={0x10, 0x0, 0x0, 0x10}, 0xc, &(0x7f0000000380)={&(0x7f0000000340)={0x24, r3, 0x300, 0x70bd26, 0x25dfdbfb, {}, [@MPTCP_PM_ATTR_SUBFLOWS={0x8, 0x3, 0x1}, @MPTCP_PM_ATTR_RCV_ADD_ADDRS={0x8, 0x2, 0x2}]}, 0x24}, 0x1, 0x0, 0x0, 0x20000004}, 0x8890) openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000500)='./cgroup/syz1\x00', 0x200002, 0x0) io_uring_setup(0x2812, &(0x7f00000005c0)={0x0, 0x5e1b, 0x2, 0x3, 0x12f, 0x0, r2}) socket$inet6_tcp(0xa, 0x1, 0x0) 21:16:42 executing program 2: syz_genetlink_get_family_id$nl80211(&(0x7f00000000c0), 0xffffffffffffffff) syz_open_dev$vcsa(&(0x7f0000000440), 0x0, 0x4000) socketpair(0x0, 0x3, 0x6, &(0x7f0000000640)) r0 = openat$tcp_congestion(0xffffffffffffff9c, &(0x7f0000000800), 0x1, 0x0) write$tcp_congestion(r0, &(0x7f0000000840)='htcp\x00', 0x5) 21:16:42 executing program 7: pipe2$9p(0x0, 0x0) write$P9_RSYMLINK(0xffffffffffffffff, &(0x7f0000000240)={0x14, 0x11, 0x1, {0x1, 0x3, 0x2}}, 0x14) add_key$fscrypt_v1(&(0x7f0000000280), &(0x7f00000002c0)={'fscrypt:', @desc2}, &(0x7f0000000300)={0x0, "ccf022eeb1aa5b4a9067674b5b7079352411c35248e190415959cbe4b7be99236abd831288583a8ed4db4b7b3f838c24d293f908bf3509b49f2c17852201f646", 0x19}, 0x48, 0xfffffffffffffffa) syz_genetlink_get_family_id$mptcp(&(0x7f00000004c0), 0xffffffffffffffff) openat$vcsa(0xffffffffffffff9c, &(0x7f00000009c0), 0x14200, 0x0) syz_genetlink_get_family_id$mptcp(&(0x7f0000000a80), 0xffffffffffffffff) 21:16:42 executing program 6: r0 = io_uring_setup(0x355e, &(0x7f0000000000)={0x0, 0x7682, 0x20, 0x1, 0x1be}) r1 = syz_io_uring_setup(0x8fe, &(0x7f0000000080)={0x0, 0x1830, 0x0, 0x0, 0x1b8, 0x0, r0}, &(0x7f0000ffb000/0x2000)=nil, &(0x7f0000ffb000/0x4000)=nil, &(0x7f0000000100), &(0x7f0000000140)=0x0) r3 = openat$hwrng(0xffffffffffffff9c, &(0x7f0000000180), 0x2, 0x0) r4 = syz_io_uring_setup(0x65dd, &(0x7f00000001c0)={0x0, 0xf46f, 0x20, 0x2, 0xdf}, &(0x7f0000ffe000/0x1000)=nil, &(0x7f0000ffd000/0x1000)=nil, &(0x7f0000000240), &(0x7f0000000280)) r5 = syz_genetlink_get_family_id$mptcp(&(0x7f0000000300), r3) sendmsg$MPTCP_PM_CMD_ADD_ADDR(r3, &(0x7f00000003c0)={&(0x7f00000002c0)={0x10, 0x0, 0x0, 0x10}, 0xc, &(0x7f0000000380)={&(0x7f0000000340)={0x24, r5, 0x300, 0x70bd26, 0x25dfdbfb, {}, [@MPTCP_PM_ATTR_SUBFLOWS={0x8, 0x3, 0x1}, @MPTCP_PM_ATTR_RCV_ADD_ADDRS={0x8, 0x2, 0x2}]}, 0x24}, 0x1, 0x0, 0x0, 0x20000004}, 0x8890) r6 = openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000500)='./cgroup/syz1\x00', 0x200002, 0x0) syz_io_uring_submit(0x0, r2, &(0x7f0000000580)=@IORING_OP_FILES_UPDATE={0x14, 0x4, 0x0, 0x0, 0x40, &(0x7f0000000540)=[r4, 0xffffffffffffffff, r6, r0, r1], 0x5}, 0x3) socket$inet6_tcp(0xa, 0x1, 0x0) openat$procfs(0xffffffffffffff9c, &(0x7f00000010c0)='/proc/crypto\x00', 0x0, 0x0) io_uring_setup(0x7c8f, &(0x7f0000001140)={0x0, 0xc240, 0x10, 0x3, 0x1c7, 0x0, r4}) 21:16:42 executing program 1: r0 = io_uring_setup(0x355e, &(0x7f0000000000)={0x0, 0x7682, 0x20, 0x1, 0x1be}) r1 = openat$hwrng(0xffffffffffffff9c, &(0x7f0000000180), 0x2, 0x0) r2 = syz_io_uring_setup(0x65dd, &(0x7f00000001c0)={0x0, 0xf46f, 0x20, 0x2, 0xdf}, &(0x7f0000ffe000/0x1000)=nil, &(0x7f0000ffd000/0x1000)=nil, &(0x7f0000000240), &(0x7f0000000280)) syz_genetlink_get_family_id$mptcp(&(0x7f0000000300), r1) syz_io_uring_setup(0x20f8, &(0x7f0000000400)={0x0, 0x7677, 0x8, 0x3, 0x22f, 0x0, r2}, &(0x7f0000ffe000/0x2000)=nil, &(0x7f0000ffb000/0x2000)=nil, &(0x7f0000000480)=0x0, &(0x7f00000004c0)) r4 = openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000500)='./cgroup/syz1\x00', 0x200002, 0x0) syz_io_uring_submit(r3, 0x0, &(0x7f0000000580)=@IORING_OP_FILES_UPDATE={0x14, 0x4, 0x0, 0x0, 0x40, &(0x7f0000000540)=[r2, 0xffffffffffffffff, r4, r0, 0xffffffffffffffff], 0x5}, 0x3) io_uring_setup(0x2812, &(0x7f00000005c0)={0x0, 0x5e1b, 0x2, 0x3, 0x12f, 0x0, r2}) socket$inet6_tcp(0xa, 0x1, 0x0) openat$procfs(0xffffffffffffff9c, &(0x7f00000010c0)='/proc/crypto\x00', 0x0, 0x0) io_uring_setup(0x7c8f, &(0x7f0000001140)={0x0, 0xc240, 0x10, 0x3, 0x1c7, 0x0, r2}) 21:16:42 executing program 3: r0 = io_uring_setup(0x355e, &(0x7f0000000000)={0x0, 0x7682, 0x20, 0x1, 0x1be}) syz_io_uring_setup(0x8fe, &(0x7f0000000080)={0x0, 0x1830, 0x0, 0x0, 0x1b8, 0x0, r0}, &(0x7f0000ffb000/0x2000)=nil, &(0x7f0000ffb000/0x4000)=nil, &(0x7f0000000100), &(0x7f0000000140)) r1 = openat$hwrng(0xffffffffffffff9c, &(0x7f0000000180), 0x2, 0x0) r2 = syz_io_uring_setup(0x65dd, &(0x7f00000001c0)={0x0, 0xf46f, 0x20, 0x2, 0xdf}, &(0x7f0000ffe000/0x1000)=nil, &(0x7f0000ffd000/0x1000)=nil, &(0x7f0000000240), &(0x7f0000000280)) r3 = syz_genetlink_get_family_id$mptcp(&(0x7f0000000300), r1) sendmsg$MPTCP_PM_CMD_ADD_ADDR(r1, &(0x7f00000003c0)={&(0x7f00000002c0)={0x10, 0x0, 0x0, 0x10}, 0xc, &(0x7f0000000380)={&(0x7f0000000340)={0x24, r3, 0x300, 0x70bd26, 0x25dfdbfb, {}, [@MPTCP_PM_ATTR_SUBFLOWS={0x8, 0x3, 0x1}, @MPTCP_PM_ATTR_RCV_ADD_ADDRS={0x8, 0x2, 0x2}]}, 0x24}, 0x1, 0x0, 0x0, 0x20000004}, 0x8890) openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000500)='./cgroup/syz1\x00', 0x200002, 0x0) io_uring_setup(0x2812, &(0x7f00000005c0)={0x0, 0x5e1b, 0x2, 0x3, 0x12f, 0x0, r2}) socket$inet6_tcp(0xa, 0x1, 0x0) io_uring_setup(0x7c8f, &(0x7f0000001140)={0x0, 0xc240, 0x10, 0x3, 0x1c7, 0x0, r2}) 21:16:42 executing program 0: r0 = io_uring_setup(0x355e, &(0x7f0000000000)={0x0, 0x7682, 0x20, 0x1, 0x1be}) r1 = syz_io_uring_setup(0x8fe, &(0x7f0000000080)={0x0, 0x1830, 0x0, 0x0, 0x1b8, 0x0, r0}, &(0x7f0000ffb000/0x2000)=nil, &(0x7f0000ffb000/0x4000)=nil, &(0x7f0000000100), &(0x7f0000000140)=0x0) r3 = openat$hwrng(0xffffffffffffff9c, &(0x7f0000000180), 0x2, 0x0) r4 = syz_io_uring_setup(0x65dd, &(0x7f00000001c0)={0x0, 0xf46f, 0x20, 0x2, 0xdf}, &(0x7f0000ffe000/0x1000)=nil, &(0x7f0000ffd000/0x1000)=nil, &(0x7f0000000240), &(0x7f0000000280)) r5 = syz_genetlink_get_family_id$mptcp(&(0x7f0000000300), r3) sendmsg$MPTCP_PM_CMD_ADD_ADDR(r3, &(0x7f00000003c0)={&(0x7f00000002c0)={0x10, 0x0, 0x0, 0x10}, 0xc, &(0x7f0000000380)={&(0x7f0000000340)={0x24, r5, 0x300, 0x70bd26, 0x25dfdbfb, {}, [@MPTCP_PM_ATTR_SUBFLOWS={0x8, 0x3, 0x1}, @MPTCP_PM_ATTR_RCV_ADD_ADDRS={0x8, 0x2, 0x2}]}, 0x24}, 0x1, 0x0, 0x0, 0x20000004}, 0x8890) syz_io_uring_submit(0x0, r2, &(0x7f0000000580)=@IORING_OP_FILES_UPDATE={0x14, 0x4, 0x0, 0x0, 0x40, &(0x7f0000000540)=[r4, 0xffffffffffffffff, 0xffffffffffffffff, r0, r1], 0x5}, 0x3) io_uring_setup(0x2812, &(0x7f00000005c0)={0x0, 0x5e1b, 0x2, 0x3, 0x12f, 0x0, r4}) socket$inet6_tcp(0xa, 0x1, 0x0) 21:16:42 executing program 5: r0 = io_uring_setup(0x355e, &(0x7f0000000000)={0x0, 0x7682, 0x20, 0x1, 0x1be}) r1 = syz_io_uring_setup(0x8fe, &(0x7f0000000080)={0x0, 0x1830, 0x0, 0x0, 0x1b8, 0x0, r0}, &(0x7f0000ffb000/0x2000)=nil, &(0x7f0000ffb000/0x4000)=nil, &(0x7f0000000100), &(0x7f0000000140)=0x0) r3 = openat$hwrng(0xffffffffffffff9c, &(0x7f0000000180), 0x2, 0x0) r4 = syz_io_uring_setup(0x65dd, &(0x7f00000001c0)={0x0, 0xf46f, 0x20, 0x2, 0xdf}, &(0x7f0000ffe000/0x1000)=nil, &(0x7f0000ffd000/0x1000)=nil, &(0x7f0000000240), &(0x7f0000000280)) r5 = syz_genetlink_get_family_id$mptcp(&(0x7f0000000300), r3) sendmsg$MPTCP_PM_CMD_ADD_ADDR(r3, &(0x7f00000003c0)={&(0x7f00000002c0)={0x10, 0x0, 0x0, 0x10}, 0xc, &(0x7f0000000380)={&(0x7f0000000340)={0x24, r5, 0x300, 0x70bd26, 0x25dfdbfb, {}, [@MPTCP_PM_ATTR_SUBFLOWS={0x8, 0x3, 0x1}, @MPTCP_PM_ATTR_RCV_ADD_ADDRS={0x8, 0x2, 0x2}]}, 0x24}, 0x1, 0x0, 0x0, 0x20000004}, 0x8890) syz_io_uring_setup(0x20f8, &(0x7f0000000400)={0x0, 0x7677, 0x8, 0x3, 0x22f, 0x0, r4}, &(0x7f0000ffe000/0x2000)=nil, &(0x7f0000ffb000/0x2000)=nil, &(0x7f0000000480)=0x0, &(0x7f00000004c0)) syz_io_uring_submit(r6, r2, &(0x7f0000000580)=@IORING_OP_FILES_UPDATE={0x14, 0x4, 0x0, 0x0, 0x40, &(0x7f0000000540)=[r4, 0xffffffffffffffff, 0xffffffffffffffff, r0, r1], 0x5}, 0x3) socket$inet6_tcp(0xa, 0x1, 0x0) openat$procfs(0xffffffffffffff9c, &(0x7f00000010c0)='/proc/crypto\x00', 0x0, 0x0) 21:16:51 executing program 5: r0 = io_uring_setup(0x355e, &(0x7f0000000000)={0x0, 0x7682, 0x20, 0x1, 0x1be}) r1 = syz_io_uring_setup(0x8fe, &(0x7f0000000080)={0x0, 0x1830, 0x0, 0x0, 0x1b8, 0x0, r0}, &(0x7f0000ffb000/0x2000)=nil, &(0x7f0000ffb000/0x4000)=nil, &(0x7f0000000100), &(0x7f0000000140)=0x0) r3 = openat$hwrng(0xffffffffffffff9c, &(0x7f0000000180), 0x2, 0x0) r4 = syz_io_uring_setup(0x65dd, &(0x7f00000001c0)={0x0, 0xf46f, 0x20, 0x2, 0xdf}, &(0x7f0000ffe000/0x1000)=nil, &(0x7f0000ffd000/0x1000)=nil, &(0x7f0000000240), &(0x7f0000000280)) r5 = syz_genetlink_get_family_id$mptcp(&(0x7f0000000300), r3) sendmsg$MPTCP_PM_CMD_ADD_ADDR(r3, &(0x7f00000003c0)={&(0x7f00000002c0)={0x10, 0x0, 0x0, 0x10}, 0xc, &(0x7f0000000380)={&(0x7f0000000340)={0x24, r5, 0x300, 0x70bd26, 0x25dfdbfb, {}, [@MPTCP_PM_ATTR_SUBFLOWS={0x8, 0x3, 0x1}, @MPTCP_PM_ATTR_RCV_ADD_ADDRS={0x8, 0x2, 0x2}]}, 0x24}, 0x1, 0x0, 0x0, 0x20000004}, 0x8890) syz_io_uring_setup(0x20f8, &(0x7f0000000400)={0x0, 0x7677, 0x8, 0x3, 0x22f, 0x0, r4}, &(0x7f0000ffe000/0x2000)=nil, &(0x7f0000ffb000/0x2000)=nil, &(0x7f0000000480)=0x0, &(0x7f00000004c0)) syz_io_uring_submit(r6, r2, &(0x7f0000000580)=@IORING_OP_FILES_UPDATE={0x14, 0x4, 0x0, 0x0, 0x40, &(0x7f0000000540)=[r4, 0xffffffffffffffff, 0xffffffffffffffff, r0, r1], 0x5}, 0x3) socket$inet6_tcp(0xa, 0x1, 0x0) openat$procfs(0xffffffffffffff9c, &(0x7f00000010c0)='/proc/crypto\x00', 0x0, 0x0) 21:16:51 executing program 1: r0 = openat$hwrng(0xffffffffffffff9c, &(0x7f0000000180), 0x2, 0x0) r1 = syz_io_uring_setup(0x65dd, &(0x7f00000001c0)={0x0, 0xf46f, 0x20, 0x2, 0xdf}, &(0x7f0000ffe000/0x1000)=nil, &(0x7f0000ffd000/0x1000)=nil, &(0x7f0000000240), &(0x7f0000000280)) syz_genetlink_get_family_id$mptcp(&(0x7f0000000300), r0) syz_io_uring_setup(0x20f8, &(0x7f0000000400)={0x0, 0x7677, 0x8, 0x3, 0x22f, 0x0, r1}, &(0x7f0000ffe000/0x2000)=nil, &(0x7f0000ffb000/0x2000)=nil, &(0x7f0000000480)=0x0, &(0x7f00000004c0)) r3 = openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000500)='./cgroup/syz1\x00', 0x200002, 0x0) syz_io_uring_submit(r2, 0x0, &(0x7f0000000580)=@IORING_OP_FILES_UPDATE={0x14, 0x4, 0x0, 0x0, 0x40, &(0x7f0000000540)=[r1, 0xffffffffffffffff, r3, 0xffffffffffffffff, 0xffffffffffffffff], 0x5}, 0x3) io_uring_setup(0x2812, &(0x7f00000005c0)={0x0, 0x5e1b, 0x2, 0x3, 0x12f, 0x0, r1}) socket$inet6_tcp(0xa, 0x1, 0x0) openat$procfs(0xffffffffffffff9c, &(0x7f00000010c0)='/proc/crypto\x00', 0x0, 0x0) io_uring_setup(0x7c8f, &(0x7f0000001140)={0x0, 0xc240, 0x10, 0x3, 0x1c7, 0x0, r1}) 21:16:51 executing program 6: r0 = io_uring_setup(0x355e, &(0x7f0000000000)={0x0, 0x7682, 0x20, 0x1, 0x1be}) r1 = syz_io_uring_setup(0x8fe, &(0x7f0000000080)={0x0, 0x1830, 0x0, 0x0, 0x1b8, 0x0, r0}, &(0x7f0000ffb000/0x2000)=nil, &(0x7f0000ffb000/0x4000)=nil, &(0x7f0000000100), &(0x7f0000000140)=0x0) r3 = openat$hwrng(0xffffffffffffff9c, &(0x7f0000000180), 0x2, 0x0) r4 = syz_io_uring_setup(0x65dd, &(0x7f00000001c0)={0x0, 0xf46f, 0x20, 0x2, 0xdf}, &(0x7f0000ffe000/0x1000)=nil, &(0x7f0000ffd000/0x1000)=nil, &(0x7f0000000240), &(0x7f0000000280)) r5 = syz_genetlink_get_family_id$mptcp(&(0x7f0000000300), r3) sendmsg$MPTCP_PM_CMD_ADD_ADDR(r3, &(0x7f00000003c0)={&(0x7f00000002c0)={0x10, 0x0, 0x0, 0x10}, 0xc, &(0x7f0000000380)={&(0x7f0000000340)={0x24, r5, 0x300, 0x70bd26, 0x25dfdbfb, {}, [@MPTCP_PM_ATTR_SUBFLOWS={0x8, 0x3, 0x1}, @MPTCP_PM_ATTR_RCV_ADD_ADDRS={0x8, 0x2, 0x2}]}, 0x24}, 0x1, 0x0, 0x0, 0x20000004}, 0x8890) r6 = openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000500)='./cgroup/syz1\x00', 0x200002, 0x0) syz_io_uring_submit(0x0, r2, &(0x7f0000000580)=@IORING_OP_FILES_UPDATE={0x14, 0x4, 0x0, 0x0, 0x40, &(0x7f0000000540)=[r4, 0xffffffffffffffff, r6, r0, r1], 0x5}, 0x3) socket$inet6_tcp(0xa, 0x1, 0x0) openat$procfs(0xffffffffffffff9c, &(0x7f00000010c0)='/proc/crypto\x00', 0x0, 0x0) io_uring_setup(0x7c8f, &(0x7f0000001140)={0x0, 0xc240, 0x10, 0x3, 0x1c7, 0x0, r4}) 21:16:51 executing program 7: pipe2$9p(0x0, 0x0) write$P9_RSYMLINK(0xffffffffffffffff, &(0x7f0000000240)={0x14, 0x11, 0x1, {0x1, 0x3, 0x2}}, 0x14) add_key$fscrypt_v1(&(0x7f0000000280), &(0x7f00000002c0)={'fscrypt:', @desc2}, &(0x7f0000000300)={0x0, "ccf022eeb1aa5b4a9067674b5b7079352411c35248e190415959cbe4b7be99236abd831288583a8ed4db4b7b3f838c24d293f908bf3509b49f2c17852201f646", 0x19}, 0x48, 0xfffffffffffffffa) syz_genetlink_get_family_id$mptcp(&(0x7f00000004c0), 0xffffffffffffffff) openat$vcsa(0xffffffffffffff9c, &(0x7f00000009c0), 0x14200, 0x0) syz_genetlink_get_family_id$mptcp(&(0x7f0000000a80), 0xffffffffffffffff) 21:16:51 executing program 0: r0 = io_uring_setup(0x355e, &(0x7f0000000000)={0x0, 0x7682, 0x20, 0x1, 0x1be}) r1 = syz_io_uring_setup(0x8fe, &(0x7f0000000080)={0x0, 0x1830, 0x0, 0x0, 0x1b8, 0x0, r0}, &(0x7f0000ffb000/0x2000)=nil, &(0x7f0000ffb000/0x4000)=nil, &(0x7f0000000100), &(0x7f0000000140)=0x0) r3 = openat$hwrng(0xffffffffffffff9c, &(0x7f0000000180), 0x2, 0x0) r4 = syz_io_uring_setup(0x65dd, &(0x7f00000001c0)={0x0, 0xf46f, 0x20, 0x2, 0xdf}, &(0x7f0000ffe000/0x1000)=nil, &(0x7f0000ffd000/0x1000)=nil, &(0x7f0000000240), &(0x7f0000000280)) r5 = syz_genetlink_get_family_id$mptcp(&(0x7f0000000300), r3) sendmsg$MPTCP_PM_CMD_ADD_ADDR(r3, &(0x7f00000003c0)={&(0x7f00000002c0)={0x10, 0x0, 0x0, 0x10}, 0xc, &(0x7f0000000380)={&(0x7f0000000340)={0x24, r5, 0x300, 0x70bd26, 0x25dfdbfb, {}, [@MPTCP_PM_ATTR_SUBFLOWS={0x8, 0x3, 0x1}, @MPTCP_PM_ATTR_RCV_ADD_ADDRS={0x8, 0x2, 0x2}]}, 0x24}, 0x1, 0x0, 0x0, 0x20000004}, 0x8890) syz_io_uring_submit(0x0, r2, &(0x7f0000000580)=@IORING_OP_FILES_UPDATE={0x14, 0x4, 0x0, 0x0, 0x40, &(0x7f0000000540)=[r4, 0xffffffffffffffff, 0xffffffffffffffff, r0, r1], 0x5}, 0x3) io_uring_setup(0x2812, &(0x7f00000005c0)={0x0, 0x5e1b, 0x2, 0x3, 0x12f, 0x0, r4}) socket$inet6_tcp(0xa, 0x1, 0x0) 21:16:51 executing program 2: syz_genetlink_get_family_id$nl80211(&(0x7f00000000c0), 0xffffffffffffffff) syz_open_dev$vcsa(&(0x7f0000000440), 0x0, 0x4000) socketpair(0x0, 0x3, 0x6, &(0x7f0000000640)) r0 = openat$tcp_congestion(0xffffffffffffff9c, &(0x7f0000000800), 0x1, 0x0) write$tcp_congestion(r0, &(0x7f0000000840)='htcp\x00', 0x5) 21:16:51 executing program 3: r0 = io_uring_setup(0x355e, &(0x7f0000000000)={0x0, 0x7682, 0x20, 0x1, 0x1be}) r1 = syz_io_uring_setup(0x8fe, &(0x7f0000000080)={0x0, 0x1830, 0x0, 0x0, 0x1b8, 0x0, r0}, &(0x7f0000ffb000/0x2000)=nil, &(0x7f0000ffb000/0x4000)=nil, &(0x7f0000000100), &(0x7f0000000140)=0x0) r3 = openat$hwrng(0xffffffffffffff9c, &(0x7f0000000180), 0x2, 0x0) r4 = syz_io_uring_setup(0x65dd, &(0x7f00000001c0)={0x0, 0xf46f, 0x20, 0x2, 0xdf}, &(0x7f0000ffe000/0x1000)=nil, &(0x7f0000ffd000/0x1000)=nil, &(0x7f0000000240), &(0x7f0000000280)) r5 = syz_genetlink_get_family_id$mptcp(&(0x7f0000000300), r3) sendmsg$MPTCP_PM_CMD_ADD_ADDR(r3, &(0x7f00000003c0)={&(0x7f00000002c0)={0x10, 0x0, 0x0, 0x10}, 0xc, &(0x7f0000000380)={&(0x7f0000000340)={0x24, r5, 0x300, 0x70bd26, 0x25dfdbfb, {}, [@MPTCP_PM_ATTR_SUBFLOWS={0x8, 0x3, 0x1}, @MPTCP_PM_ATTR_RCV_ADD_ADDRS={0x8, 0x2, 0x2}]}, 0x24}, 0x1, 0x0, 0x0, 0x20000004}, 0x8890) syz_io_uring_submit(0x0, r2, &(0x7f0000000580)=@IORING_OP_FILES_UPDATE={0x14, 0x4, 0x0, 0x0, 0x40, &(0x7f0000000540)=[r4, 0xffffffffffffffff, 0xffffffffffffffff, r0, r1], 0x5}, 0x3) io_uring_setup(0x2812, &(0x7f00000005c0)={0x0, 0x5e1b, 0x2, 0x3, 0x12f, 0x0, r4}) socket$inet6_tcp(0xa, 0x1, 0x0) io_uring_setup(0x7c8f, &(0x7f0000001140)={0x0, 0xc240, 0x10, 0x3, 0x1c7, 0x0, r4}) 21:16:51 executing program 4: ioctl$SCSI_IOCTL_DOORUNLOCK(0xffffffffffffffff, 0x5381) r0 = syz_open_dev$mouse(&(0x7f0000000000), 0x578, 0x4000) ioctl$SG_GET_PACK_ID(r0, 0x227c, &(0x7f0000000040)) syz_genetlink_get_family_id$nl80211(&(0x7f00000000c0), r0) syz_open_dev$vcsa(&(0x7f0000000440), 0x56, 0x4000) socketpair(0x0, 0x3, 0x6, &(0x7f0000000640)) r1 = openat$tcp_congestion(0xffffffffffffff9c, &(0x7f0000000800), 0x1, 0x0) write$tcp_congestion(r1, &(0x7f0000000840)='htcp\x00', 0x5) 21:16:51 executing program 6: r0 = io_uring_setup(0x355e, &(0x7f0000000000)={0x0, 0x7682, 0x20, 0x1, 0x1be}) r1 = syz_io_uring_setup(0x8fe, &(0x7f0000000080)={0x0, 0x1830, 0x0, 0x0, 0x1b8, 0x0, r0}, &(0x7f0000ffb000/0x2000)=nil, &(0x7f0000ffb000/0x4000)=nil, &(0x7f0000000100), &(0x7f0000000140)=0x0) r3 = openat$hwrng(0xffffffffffffff9c, &(0x7f0000000180), 0x2, 0x0) r4 = syz_io_uring_setup(0x65dd, &(0x7f00000001c0)={0x0, 0xf46f, 0x20, 0x2, 0xdf}, &(0x7f0000ffe000/0x1000)=nil, &(0x7f0000ffd000/0x1000)=nil, &(0x7f0000000240), &(0x7f0000000280)) syz_genetlink_get_family_id$mptcp(&(0x7f0000000300), r3) syz_io_uring_setup(0x20f8, &(0x7f0000000400)={0x0, 0x7677, 0x8, 0x3, 0x22f, 0x0, r4}, &(0x7f0000ffe000/0x2000)=nil, &(0x7f0000ffb000/0x2000)=nil, &(0x7f0000000480)=0x0, &(0x7f00000004c0)) r6 = openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000500)='./cgroup/syz1\x00', 0x200002, 0x0) syz_io_uring_submit(r5, r2, &(0x7f0000000580)=@IORING_OP_FILES_UPDATE={0x14, 0x4, 0x0, 0x0, 0x40, &(0x7f0000000540)=[r4, 0xffffffffffffffff, r6, r0, r1], 0x5}, 0x3) socket$inet6_tcp(0xa, 0x1, 0x0) openat$procfs(0xffffffffffffff9c, &(0x7f00000010c0)='/proc/crypto\x00', 0x0, 0x0) io_uring_setup(0x7c8f, &(0x7f0000001140)={0x0, 0xc240, 0x10, 0x3, 0x1c7, 0x0, r4}) [ 341.153233] kmemleak: Found object by alias at 0x607f1a6398ac [ 341.153252] CPU: 1 UID: 0 PID: 5396 Comm: syz-executor.3 Tainted: G W 6.17.0-rc3-next-20250829 #1 PREEMPT(voluntary) [ 341.153270] Tainted: [W]=WARN [ 341.153274] Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.12.0-1 04/01/2014 [ 341.153281] Call Trace: [ 341.153285] [ 341.153290] dump_stack_lvl+0xca/0x120 [ 341.153315] __lookup_object+0x94/0xb0 [ 341.153332] delete_object_full+0x27/0x70 [ 341.153351] free_percpu+0x30/0x1160 [ 341.153369] ? arch_uprobe_clear_state+0x16/0x140 [ 341.153389] futex_hash_free+0x38/0xc0 [ 341.153403] mmput+0x2d3/0x390 [ 341.153422] do_exit+0x79d/0x2970 [ 341.153435] ? lock_release+0xc8/0x290 [ 341.153452] ? __pfx_do_exit+0x10/0x10 [ 341.153466] ? find_held_lock+0x2b/0x80 [ 341.153483] ? get_signal+0x835/0x2340 [ 341.153503] do_group_exit+0xd3/0x2a0 [ 341.153517] get_signal+0x2315/0x2340 [ 341.153537] ? __call_rcu_common.constprop.0+0x4c1/0x960 [ 341.153553] ? __pfx_get_signal+0x10/0x10 [ 341.153568] ? do_futex+0x135/0x370 [ 341.153582] ? __pfx_do_futex+0x10/0x10 [ 341.153597] arch_do_signal_or_restart+0x80/0x790 [ 341.153615] ? __pfx_arch_do_signal_or_restart+0x10/0x10 [ 341.153630] ? __x64_sys_futex+0x1c9/0x4d0 [ 341.153642] ? __x64_sys_futex+0x1d2/0x4d0 [ 341.153656] ? fput_close_sync+0x114/0x240 [ 341.153672] ? __pfx___x64_sys_futex+0x10/0x10 [ 341.153685] ? __pfx_fput_close_sync+0x10/0x10 [ 341.153699] ? dnotify_flush+0x79/0x4c0 [ 341.153715] exit_to_user_mode_loop+0x8b/0x110 [ 341.153728] do_syscall_64+0x2f7/0x360 [ 341.153740] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 341.153752] RIP: 0033:0x7f1060a76b19 [ 341.153761] Code: Unable to access opcode bytes at 0x7f1060a76aef. [ 341.153766] RSP: 002b:00007f105dfec218 EFLAGS: 00000246 ORIG_RAX: 00000000000000ca [ 341.153777] RAX: fffffffffffffe00 RBX: 00007f1060b89f68 RCX: 00007f1060a76b19 [ 341.153784] RDX: 0000000000000000 RSI: 0000000000000080 RDI: 00007f1060b89f68 [ 341.153791] RBP: 00007f1060b89f60 R08: 0000000000000000 R09: 0000000000000000 [ 341.153798] R10: 0000000000000000 R11: 0000000000000246 R12: 00007f1060b89f6c [ 341.153805] R13: 00007ffed3f8b4af R14: 00007f105dfec300 R15: 0000000000022000 [ 341.153821] [ 341.153825] kmemleak: Object (percpu) 0x607f1a6398a8 (size 8): [ 341.153831] kmemleak: comm "syz-executor.6", pid 5417, jiffies 4295007973 [ 341.153838] kmemleak: min_count = 1 [ 341.153841] kmemleak: count = 0 [ 341.153845] kmemleak: flags = 0x21 [ 341.153849] kmemleak: checksum = 0 [ 341.153852] kmemleak: backtrace: [ 341.153856] pcpu_alloc_noprof+0x87a/0x1170 [ 341.153870] percpu_ref_init+0x37/0x400 [ 341.153888] io_uring_setup+0x44c/0x2000 [ 341.153899] __x64_sys_io_uring_setup+0xc8/0x170 [ 341.153910] do_syscall_64+0xbf/0x360 [ 341.153918] entry_SYSCALL_64_after_hwframe+0x77/0x7f 21:17:00 executing program 3: r0 = io_uring_setup(0x355e, &(0x7f0000000000)={0x0, 0x7682, 0x20, 0x1, 0x1be}) r1 = syz_io_uring_setup(0x8fe, &(0x7f0000000080)={0x0, 0x1830, 0x0, 0x0, 0x1b8, 0x0, r0}, &(0x7f0000ffb000/0x2000)=nil, &(0x7f0000ffb000/0x4000)=nil, &(0x7f0000000100), &(0x7f0000000140)=0x0) r3 = openat$hwrng(0xffffffffffffff9c, &(0x7f0000000180), 0x2, 0x0) r4 = syz_io_uring_setup(0x65dd, &(0x7f00000001c0)={0x0, 0xf46f, 0x20, 0x2, 0xdf}, &(0x7f0000ffe000/0x1000)=nil, &(0x7f0000ffd000/0x1000)=nil, &(0x7f0000000240), &(0x7f0000000280)) r5 = syz_genetlink_get_family_id$mptcp(&(0x7f0000000300), r3) sendmsg$MPTCP_PM_CMD_ADD_ADDR(r3, &(0x7f00000003c0)={&(0x7f00000002c0)={0x10, 0x0, 0x0, 0x10}, 0xc, &(0x7f0000000380)={&(0x7f0000000340)={0x24, r5, 0x300, 0x70bd26, 0x25dfdbfb, {}, [@MPTCP_PM_ATTR_SUBFLOWS={0x8, 0x3, 0x1}, @MPTCP_PM_ATTR_RCV_ADD_ADDRS={0x8, 0x2, 0x2}]}, 0x24}, 0x1, 0x0, 0x0, 0x20000004}, 0x8890) syz_io_uring_submit(0x0, r2, &(0x7f0000000580)=@IORING_OP_FILES_UPDATE={0x14, 0x4, 0x0, 0x0, 0x40, &(0x7f0000000540)=[r4, 0xffffffffffffffff, 0xffffffffffffffff, r0, r1], 0x5}, 0x3) io_uring_setup(0x2812, &(0x7f00000005c0)={0x0, 0x5e1b, 0x2, 0x3, 0x12f, 0x0, r4}) socket$inet6_tcp(0xa, 0x1, 0x0) io_uring_setup(0x7c8f, &(0x7f0000001140)={0x0, 0xc240, 0x10, 0x3, 0x1c7, 0x0, r4}) 21:17:00 executing program 5: r0 = io_uring_setup(0x355e, &(0x7f0000000000)={0x0, 0x7682, 0x20, 0x1, 0x1be}) r1 = syz_io_uring_setup(0x8fe, &(0x7f0000000080)={0x0, 0x1830, 0x0, 0x0, 0x1b8, 0x0, r0}, &(0x7f0000ffb000/0x2000)=nil, &(0x7f0000ffb000/0x4000)=nil, &(0x7f0000000100), &(0x7f0000000140)=0x0) r3 = openat$hwrng(0xffffffffffffff9c, &(0x7f0000000180), 0x2, 0x0) r4 = syz_io_uring_setup(0x65dd, &(0x7f00000001c0)={0x0, 0xf46f, 0x20, 0x2, 0xdf}, &(0x7f0000ffe000/0x1000)=nil, &(0x7f0000ffd000/0x1000)=nil, &(0x7f0000000240), &(0x7f0000000280)) r5 = syz_genetlink_get_family_id$mptcp(&(0x7f0000000300), r3) sendmsg$MPTCP_PM_CMD_ADD_ADDR(r3, &(0x7f00000003c0)={&(0x7f00000002c0)={0x10, 0x0, 0x0, 0x10}, 0xc, &(0x7f0000000380)={&(0x7f0000000340)={0x24, r5, 0x300, 0x70bd26, 0x25dfdbfb, {}, [@MPTCP_PM_ATTR_SUBFLOWS={0x8, 0x3, 0x1}, @MPTCP_PM_ATTR_RCV_ADD_ADDRS={0x8, 0x2, 0x2}]}, 0x24}, 0x1, 0x0, 0x0, 0x20000004}, 0x8890) syz_io_uring_setup(0x20f8, &(0x7f0000000400)={0x0, 0x7677, 0x8, 0x3, 0x22f, 0x0, r4}, &(0x7f0000ffe000/0x2000)=nil, &(0x7f0000ffb000/0x2000)=nil, &(0x7f0000000480)=0x0, &(0x7f00000004c0)) syz_io_uring_submit(r6, r2, &(0x7f0000000580)=@IORING_OP_FILES_UPDATE={0x14, 0x4, 0x0, 0x0, 0x40, &(0x7f0000000540)=[r4, 0xffffffffffffffff, 0xffffffffffffffff, r0, r1], 0x5}, 0x3) socket$inet6_tcp(0xa, 0x1, 0x0) openat$procfs(0xffffffffffffff9c, &(0x7f00000010c0)='/proc/crypto\x00', 0x0, 0x0) 21:17:00 executing program 4: ioctl$SCSI_IOCTL_DOORUNLOCK(0xffffffffffffffff, 0x5381) r0 = syz_open_dev$mouse(&(0x7f0000000000), 0x578, 0x4000) ioctl$SG_GET_PACK_ID(r0, 0x227c, &(0x7f0000000040)) syz_open_dev$vcsa(&(0x7f0000000440), 0x56, 0x4000) socketpair(0x0, 0x3, 0x6, &(0x7f0000000640)) r1 = openat$tcp_congestion(0xffffffffffffff9c, &(0x7f0000000800), 0x1, 0x0) write$tcp_congestion(r1, &(0x7f0000000840)='htcp\x00', 0x5) 21:17:00 executing program 1: r0 = openat$hwrng(0xffffffffffffff9c, &(0x7f0000000180), 0x2, 0x0) r1 = syz_io_uring_setup(0x65dd, &(0x7f00000001c0)={0x0, 0xf46f, 0x20, 0x2, 0xdf}, &(0x7f0000ffe000/0x1000)=nil, &(0x7f0000ffd000/0x1000)=nil, &(0x7f0000000240), &(0x7f0000000280)) syz_genetlink_get_family_id$mptcp(&(0x7f0000000300), r0) syz_io_uring_setup(0x20f8, &(0x7f0000000400)={0x0, 0x7677, 0x8, 0x3, 0x22f, 0x0, r1}, &(0x7f0000ffe000/0x2000)=nil, &(0x7f0000ffb000/0x2000)=nil, &(0x7f0000000480)=0x0, &(0x7f00000004c0)) r3 = openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000500)='./cgroup/syz1\x00', 0x200002, 0x0) syz_io_uring_submit(r2, 0x0, &(0x7f0000000580)=@IORING_OP_FILES_UPDATE={0x14, 0x4, 0x0, 0x0, 0x40, &(0x7f0000000540)=[r1, 0xffffffffffffffff, r3, 0xffffffffffffffff, 0xffffffffffffffff], 0x5}, 0x3) io_uring_setup(0x2812, &(0x7f00000005c0)={0x0, 0x5e1b, 0x2, 0x3, 0x12f, 0x0, r1}) socket$inet6_tcp(0xa, 0x1, 0x0) openat$procfs(0xffffffffffffff9c, &(0x7f00000010c0)='/proc/crypto\x00', 0x0, 0x0) io_uring_setup(0x7c8f, &(0x7f0000001140)={0x0, 0xc240, 0x10, 0x3, 0x1c7, 0x0, r1}) 21:17:00 executing program 7: pipe2$9p(&(0x7f0000000200), 0x0) write$P9_RSYMLINK(0xffffffffffffffff, &(0x7f0000000240)={0x14, 0x11, 0x1, {0x1, 0x3, 0x2}}, 0x14) add_key$fscrypt_v1(&(0x7f0000000280), &(0x7f00000002c0)={'fscrypt:', @desc2}, &(0x7f0000000300)={0x0, "ccf022eeb1aa5b4a9067674b5b7079352411c35248e190415959cbe4b7be99236abd831288583a8ed4db4b7b3f838c24d293f908bf3509b49f2c17852201f646", 0x19}, 0x48, 0xfffffffffffffffa) syz_genetlink_get_family_id$mptcp(&(0x7f00000004c0), 0xffffffffffffffff) openat$vcsa(0xffffffffffffff9c, &(0x7f00000009c0), 0x14200, 0x0) syz_genetlink_get_family_id$mptcp(&(0x7f0000000a80), 0xffffffffffffffff) 21:17:00 executing program 6: r0 = io_uring_setup(0x355e, &(0x7f0000000000)={0x0, 0x7682, 0x20, 0x1, 0x1be}) r1 = syz_io_uring_setup(0x8fe, &(0x7f0000000080)={0x0, 0x1830, 0x0, 0x0, 0x1b8, 0x0, r0}, &(0x7f0000ffb000/0x2000)=nil, &(0x7f0000ffb000/0x4000)=nil, &(0x7f0000000100), &(0x7f0000000140)=0x0) r3 = openat$hwrng(0xffffffffffffff9c, &(0x7f0000000180), 0x2, 0x0) r4 = syz_io_uring_setup(0x65dd, &(0x7f00000001c0)={0x0, 0xf46f, 0x20, 0x2, 0xdf}, &(0x7f0000ffe000/0x1000)=nil, &(0x7f0000ffd000/0x1000)=nil, &(0x7f0000000240), &(0x7f0000000280)) syz_genetlink_get_family_id$mptcp(&(0x7f0000000300), r3) syz_io_uring_setup(0x20f8, &(0x7f0000000400)={0x0, 0x7677, 0x8, 0x3, 0x22f, 0x0, r4}, &(0x7f0000ffe000/0x2000)=nil, &(0x7f0000ffb000/0x2000)=nil, &(0x7f0000000480)=0x0, &(0x7f00000004c0)) r6 = openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000500)='./cgroup/syz1\x00', 0x200002, 0x0) syz_io_uring_submit(r5, r2, &(0x7f0000000580)=@IORING_OP_FILES_UPDATE={0x14, 0x4, 0x0, 0x0, 0x40, &(0x7f0000000540)=[r4, 0xffffffffffffffff, r6, r0, r1], 0x5}, 0x3) socket$inet6_tcp(0xa, 0x1, 0x0) openat$procfs(0xffffffffffffff9c, &(0x7f00000010c0)='/proc/crypto\x00', 0x0, 0x0) io_uring_setup(0x7c8f, &(0x7f0000001140)={0x0, 0xc240, 0x10, 0x3, 0x1c7, 0x0, r4}) 21:17:00 executing program 2: syz_genetlink_get_family_id$nl80211(&(0x7f00000000c0), 0xffffffffffffffff) syz_open_dev$vcsa(&(0x7f0000000440), 0x0, 0x4000) socketpair(0x0, 0x3, 0x6, &(0x7f0000000640)) r0 = openat$tcp_congestion(0xffffffffffffff9c, &(0x7f0000000800), 0x1, 0x0) write$tcp_congestion(r0, &(0x7f0000000840)='htcp\x00', 0x5) 21:17:00 executing program 0: r0 = io_uring_setup(0x355e, &(0x7f0000000000)={0x0, 0x7682, 0x20, 0x1, 0x1be}) r1 = syz_io_uring_setup(0x8fe, &(0x7f0000000080)={0x0, 0x1830, 0x0, 0x0, 0x1b8, 0x0, r0}, &(0x7f0000ffb000/0x2000)=nil, &(0x7f0000ffb000/0x4000)=nil, &(0x7f0000000100), &(0x7f0000000140)=0x0) r3 = openat$hwrng(0xffffffffffffff9c, &(0x7f0000000180), 0x2, 0x0) r4 = syz_io_uring_setup(0x65dd, &(0x7f00000001c0)={0x0, 0xf46f, 0x20, 0x2, 0xdf}, &(0x7f0000ffe000/0x1000)=nil, &(0x7f0000ffd000/0x1000)=nil, &(0x7f0000000240), &(0x7f0000000280)) r5 = syz_genetlink_get_family_id$mptcp(&(0x7f0000000300), r3) sendmsg$MPTCP_PM_CMD_ADD_ADDR(r3, &(0x7f00000003c0)={&(0x7f00000002c0)={0x10, 0x0, 0x0, 0x10}, 0xc, &(0x7f0000000380)={&(0x7f0000000340)={0x24, r5, 0x300, 0x70bd26, 0x25dfdbfb, {}, [@MPTCP_PM_ATTR_SUBFLOWS={0x8, 0x3, 0x1}, @MPTCP_PM_ATTR_RCV_ADD_ADDRS={0x8, 0x2, 0x2}]}, 0x24}, 0x1, 0x0, 0x0, 0x20000004}, 0x8890) syz_io_uring_submit(0x0, r2, &(0x7f0000000580)=@IORING_OP_FILES_UPDATE={0x14, 0x4, 0x0, 0x0, 0x40, &(0x7f0000000540)=[r4, 0xffffffffffffffff, 0xffffffffffffffff, r0, r1], 0x5}, 0x3) io_uring_setup(0x2812, &(0x7f00000005c0)={0x0, 0x5e1b, 0x2, 0x3, 0x12f, 0x0, r4}) socket$inet6_tcp(0xa, 0x1, 0x0) 21:17:00 executing program 6: r0 = io_uring_setup(0x355e, &(0x7f0000000000)={0x0, 0x7682, 0x20, 0x1, 0x1be}) r1 = syz_io_uring_setup(0x8fe, &(0x7f0000000080)={0x0, 0x1830, 0x0, 0x0, 0x1b8, 0x0, r0}, &(0x7f0000ffb000/0x2000)=nil, &(0x7f0000ffb000/0x4000)=nil, &(0x7f0000000100), &(0x7f0000000140)=0x0) r3 = openat$hwrng(0xffffffffffffff9c, &(0x7f0000000180), 0x2, 0x0) r4 = syz_io_uring_setup(0x65dd, &(0x7f00000001c0)={0x0, 0xf46f, 0x20, 0x2, 0xdf}, &(0x7f0000ffe000/0x1000)=nil, &(0x7f0000ffd000/0x1000)=nil, &(0x7f0000000240), &(0x7f0000000280)) syz_genetlink_get_family_id$mptcp(&(0x7f0000000300), r3) syz_io_uring_setup(0x20f8, &(0x7f0000000400)={0x0, 0x7677, 0x8, 0x3, 0x22f, 0x0, r4}, &(0x7f0000ffe000/0x2000)=nil, &(0x7f0000ffb000/0x2000)=nil, &(0x7f0000000480)=0x0, &(0x7f00000004c0)) r6 = openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000500)='./cgroup/syz1\x00', 0x200002, 0x0) syz_io_uring_submit(r5, r2, &(0x7f0000000580)=@IORING_OP_FILES_UPDATE={0x14, 0x4, 0x0, 0x0, 0x40, &(0x7f0000000540)=[r4, 0xffffffffffffffff, r6, r0, r1], 0x5}, 0x3) socket$inet6_tcp(0xa, 0x1, 0x0) openat$procfs(0xffffffffffffff9c, &(0x7f00000010c0)='/proc/crypto\x00', 0x0, 0x0) io_uring_setup(0x7c8f, &(0x7f0000001140)={0x0, 0xc240, 0x10, 0x3, 0x1c7, 0x0, r4}) 21:17:00 executing program 0: r0 = io_uring_setup(0x355e, &(0x7f0000000000)={0x0, 0x7682, 0x20, 0x1, 0x1be}) r1 = syz_io_uring_setup(0x8fe, &(0x7f0000000080)={0x0, 0x1830, 0x0, 0x0, 0x1b8, 0x0, r0}, &(0x7f0000ffb000/0x2000)=nil, &(0x7f0000ffb000/0x4000)=nil, &(0x7f0000000100), &(0x7f0000000140)=0x0) r3 = openat$hwrng(0xffffffffffffff9c, &(0x7f0000000180), 0x2, 0x0) r4 = syz_io_uring_setup(0x65dd, &(0x7f00000001c0)={0x0, 0xf46f, 0x20, 0x2, 0xdf}, &(0x7f0000ffe000/0x1000)=nil, &(0x7f0000ffd000/0x1000)=nil, &(0x7f0000000240), &(0x7f0000000280)) syz_genetlink_get_family_id$mptcp(&(0x7f0000000300), r3) r5 = openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000500)='./cgroup/syz1\x00', 0x200002, 0x0) syz_io_uring_submit(0x0, r2, &(0x7f0000000580)=@IORING_OP_FILES_UPDATE={0x14, 0x4, 0x0, 0x0, 0x40, &(0x7f0000000540)=[r4, 0xffffffffffffffff, r5, r0, r1], 0x5}, 0x3) io_uring_setup(0x2812, &(0x7f00000005c0)={0x0, 0x5e1b, 0x2, 0x3, 0x12f, 0x0, r4}) socket$inet6_tcp(0xa, 0x1, 0x0) [ 350.130659] kmemleak: Found object by alias at 0x607f1a6398ac [ 350.130689] CPU: 0 UID: 0 PID: 5460 Comm: iou-sqp-5454 Tainted: G W 6.17.0-rc3-next-20250829 #1 PREEMPT(voluntary) 21:17:00 executing program 4: ioctl$SCSI_IOCTL_DOORUNLOCK(0xffffffffffffffff, 0x5381) r0 = syz_open_dev$mouse(&(0x7f0000000000), 0x578, 0x4000) ioctl$SG_GET_PACK_ID(r0, 0x227c, &(0x7f0000000040)) syz_open_dev$vcsa(&(0x7f0000000440), 0x56, 0x4000) socketpair(0x0, 0x3, 0x6, &(0x7f0000000640)) r1 = openat$tcp_congestion(0xffffffffffffff9c, &(0x7f0000000800), 0x1, 0x0) write$tcp_congestion(r1, &(0x7f0000000840)='htcp\x00', 0x5) [ 350.130721] Tainted: [W]=WARN [ 350.130728] Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.12.0-1 04/01/2014 [ 350.130740] Call Trace: [ 350.130746] [ 350.130755] dump_stack_lvl+0xca/0x120 [ 350.130794] __lookup_object+0x94/0xb0 [ 350.130823] delete_object_full+0x27/0x70 [ 350.130852] free_percpu+0x30/0x1160 [ 350.130879] ? arch_uprobe_clear_state+0x16/0x140 [ 350.130914] futex_hash_free+0x38/0xc0 [ 350.130939] mmput+0x2d3/0x390 [ 350.130971] do_exit+0x79d/0x2970 [ 350.130998] ? __pfx_try_to_wake_up+0x10/0x10 [ 350.131032] ? __pfx_do_exit+0x10/0x10 [ 350.131053] ? io_sq_thread+0xfbd/0x1b00 [ 350.131082] ? lock_release+0xc8/0x290 [ 350.131112] io_sq_thread+0xfc9/0x1b00 [ 350.131150] ? __pfx_io_sq_thread+0x10/0x10 [ 350.131180] ? __lock_acquire+0xc65/0x1b70 [ 350.131204] ? __pfx_autoremove_wake_function+0x10/0x10 [ 350.131230] ? __lock_acquire+0xc65/0x1b70 [ 350.131267] ? do_raw_spin_lock+0x123/0x260 [ 350.131306] ? find_held_lock+0x2b/0x80 [ 350.131335] ? __pfx_io_sq_thread+0x10/0x10 [ 350.131368] ? lock_release+0xc8/0x290 [ 350.131392] ? __pfx_io_sq_thread+0x10/0x10 [ 350.131421] ret_from_fork+0x34b/0x430 [ 350.131452] ? __pfx_io_sq_thread+0x10/0x10 [ 350.131479] ret_from_fork_asm+0x1a/0x30 [ 350.131521] [ 350.131528] kmemleak: Object (percpu) 0x607f1a6398a8 (size 8): [ 350.131540] kmemleak: comm "syz-executor.1", pid 5459, jiffies 4295016809 [ 350.131553] kmemleak: min_count = 1 [ 350.131559] kmemleak: count = 0 [ 350.131566] kmemleak: flags = 0x21 [ 350.131573] kmemleak: checksum = 0 [ 350.131579] kmemleak: backtrace: [ 350.131585] pcpu_alloc_noprof+0x87a/0x1170 [ 350.131612] percpu_ref_init+0x37/0x400 [ 350.131642] io_uring_setup+0x44c/0x2000 [ 350.131661] __x64_sys_io_uring_setup+0xc8/0x170 [ 350.131681] do_syscall_64+0xbf/0x360 [ 350.131697] entry_SYSCALL_64_after_hwframe+0x77/0x7f 21:17:00 executing program 5: r0 = io_uring_setup(0x355e, &(0x7f0000000000)={0x0, 0x7682, 0x20, 0x1, 0x1be}) r1 = syz_io_uring_setup(0x8fe, &(0x7f0000000080)={0x0, 0x1830, 0x0, 0x0, 0x1b8, 0x0, r0}, &(0x7f0000ffb000/0x2000)=nil, &(0x7f0000ffb000/0x4000)=nil, &(0x7f0000000100), &(0x7f0000000140)=0x0) r3 = openat$hwrng(0xffffffffffffff9c, &(0x7f0000000180), 0x2, 0x0) r4 = syz_io_uring_setup(0x65dd, &(0x7f00000001c0)={0x0, 0xf46f, 0x20, 0x2, 0xdf}, &(0x7f0000ffe000/0x1000)=nil, &(0x7f0000ffd000/0x1000)=nil, &(0x7f0000000240), &(0x7f0000000280)) r5 = syz_genetlink_get_family_id$mptcp(&(0x7f0000000300), r3) sendmsg$MPTCP_PM_CMD_ADD_ADDR(r3, &(0x7f00000003c0)={&(0x7f00000002c0)={0x10, 0x0, 0x0, 0x10}, 0xc, &(0x7f0000000380)={&(0x7f0000000340)={0x24, r5, 0x300, 0x70bd26, 0x25dfdbfb, {}, [@MPTCP_PM_ATTR_SUBFLOWS={0x8, 0x3, 0x1}, @MPTCP_PM_ATTR_RCV_ADD_ADDRS={0x8, 0x2, 0x2}]}, 0x24}, 0x1, 0x0, 0x0, 0x20000004}, 0x8890) r6 = openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000500)='./cgroup/syz1\x00', 0x200002, 0x0) syz_io_uring_submit(0x0, r2, &(0x7f0000000580)=@IORING_OP_FILES_UPDATE={0x14, 0x4, 0x0, 0x0, 0x40, &(0x7f0000000540)=[r4, 0xffffffffffffffff, r6, r0, r1], 0x5}, 0x3) socket$inet6_tcp(0xa, 0x1, 0x0) openat$procfs(0xffffffffffffff9c, &(0x7f00000010c0)='/proc/crypto\x00', 0x0, 0x0) 21:17:00 executing program 2: syz_genetlink_get_family_id$nl80211(&(0x7f00000000c0), 0xffffffffffffffff) syz_open_dev$vcsa(&(0x7f0000000440), 0x56, 0x0) socketpair(0x0, 0x3, 0x6, &(0x7f0000000640)) r0 = openat$tcp_congestion(0xffffffffffffff9c, &(0x7f0000000800), 0x1, 0x0) write$tcp_congestion(r0, &(0x7f0000000840)='htcp\x00', 0x5) 21:17:00 executing program 3: r0 = io_uring_setup(0x355e, &(0x7f0000000000)={0x0, 0x7682, 0x20, 0x1, 0x1be}) r1 = syz_io_uring_setup(0x8fe, &(0x7f0000000080)={0x0, 0x1830, 0x0, 0x0, 0x1b8, 0x0, r0}, &(0x7f0000ffb000/0x2000)=nil, &(0x7f0000ffb000/0x4000)=nil, &(0x7f0000000100), &(0x7f0000000140)=0x0) r3 = openat$hwrng(0xffffffffffffff9c, &(0x7f0000000180), 0x2, 0x0) r4 = syz_io_uring_setup(0x65dd, &(0x7f00000001c0)={0x0, 0xf46f, 0x20, 0x2, 0xdf}, &(0x7f0000ffe000/0x1000)=nil, &(0x7f0000ffd000/0x1000)=nil, &(0x7f0000000240), &(0x7f0000000280)) r5 = syz_genetlink_get_family_id$mptcp(&(0x7f0000000300), r3) sendmsg$MPTCP_PM_CMD_ADD_ADDR(r3, &(0x7f00000003c0)={&(0x7f00000002c0)={0x10, 0x0, 0x0, 0x10}, 0xc, &(0x7f0000000380)={&(0x7f0000000340)={0x24, r5, 0x300, 0x70bd26, 0x25dfdbfb, {}, [@MPTCP_PM_ATTR_SUBFLOWS={0x8, 0x3, 0x1}, @MPTCP_PM_ATTR_RCV_ADD_ADDRS={0x8, 0x2, 0x2}]}, 0x24}, 0x1, 0x0, 0x0, 0x20000004}, 0x8890) syz_io_uring_submit(0x0, r2, &(0x7f0000000580)=@IORING_OP_FILES_UPDATE={0x14, 0x4, 0x0, 0x0, 0x40, &(0x7f0000000540)=[r4, 0xffffffffffffffff, 0xffffffffffffffff, r0, r1], 0x5}, 0x3) io_uring_setup(0x2812, &(0x7f00000005c0)={0x0, 0x5e1b, 0x2, 0x3, 0x12f, 0x0, r4}) socket$inet6_tcp(0xa, 0x1, 0x0) io_uring_setup(0x7c8f, &(0x7f0000001140)={0x0, 0xc240, 0x10, 0x3, 0x1c7, 0x0, r4}) 21:17:00 executing program 0: r0 = io_uring_setup(0x355e, &(0x7f0000000000)={0x0, 0x7682, 0x20, 0x1, 0x1be}) r1 = syz_io_uring_setup(0x8fe, &(0x7f0000000080)={0x0, 0x1830, 0x0, 0x0, 0x1b8, 0x0, r0}, &(0x7f0000ffb000/0x2000)=nil, &(0x7f0000ffb000/0x4000)=nil, &(0x7f0000000100), &(0x7f0000000140)=0x0) openat$hwrng(0xffffffffffffff9c, &(0x7f0000000180), 0x2, 0x0) r3 = syz_io_uring_setup(0x65dd, &(0x7f00000001c0)={0x0, 0xf46f, 0x20, 0x2, 0xdf}, &(0x7f0000ffe000/0x1000)=nil, &(0x7f0000ffd000/0x1000)=nil, &(0x7f0000000240), &(0x7f0000000280)) r4 = openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000500)='./cgroup/syz1\x00', 0x200002, 0x0) syz_io_uring_submit(0x0, r2, &(0x7f0000000580)=@IORING_OP_FILES_UPDATE={0x14, 0x4, 0x0, 0x0, 0x40, &(0x7f0000000540)=[r3, 0xffffffffffffffff, r4, r0, r1], 0x5}, 0x3) io_uring_setup(0x2812, &(0x7f00000005c0)={0x0, 0x5e1b, 0x2, 0x3, 0x12f, 0x0, r3}) socket$inet6_tcp(0xa, 0x1, 0x0) 21:17:00 executing program 6: r0 = io_uring_setup(0x355e, &(0x7f0000000000)={0x0, 0x7682, 0x20, 0x1, 0x1be}) r1 = syz_io_uring_setup(0x8fe, &(0x7f0000000080)={0x0, 0x1830, 0x0, 0x0, 0x1b8, 0x0, r0}, &(0x7f0000ffb000/0x2000)=nil, &(0x7f0000ffb000/0x4000)=nil, &(0x7f0000000100), &(0x7f0000000140)=0x0) r3 = openat$hwrng(0xffffffffffffff9c, &(0x7f0000000180), 0x2, 0x0) r4 = syz_genetlink_get_family_id$mptcp(&(0x7f0000000300), r3) sendmsg$MPTCP_PM_CMD_ADD_ADDR(r3, &(0x7f00000003c0)={&(0x7f00000002c0)={0x10, 0x0, 0x0, 0x10}, 0xc, &(0x7f0000000380)={&(0x7f0000000340)={0x24, r4, 0x300, 0x70bd26, 0x25dfdbfb, {}, [@MPTCP_PM_ATTR_SUBFLOWS={0x8, 0x3, 0x1}, @MPTCP_PM_ATTR_RCV_ADD_ADDRS={0x8, 0x2, 0x2}]}, 0x24}, 0x1, 0x0, 0x0, 0x20000004}, 0x8890) syz_io_uring_setup(0x20f8, &(0x7f0000000400)={0x0, 0x7677, 0x8, 0x3, 0x22f}, &(0x7f0000ffe000/0x2000)=nil, &(0x7f0000ffb000/0x2000)=nil, &(0x7f0000000480)=0x0, &(0x7f00000004c0)) r6 = openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000500)='./cgroup/syz1\x00', 0x200002, 0x0) syz_io_uring_submit(r5, r2, &(0x7f0000000580)=@IORING_OP_FILES_UPDATE={0x14, 0x4, 0x0, 0x0, 0x40, &(0x7f0000000540)=[0xffffffffffffffff, 0xffffffffffffffff, r6, r0, r1], 0x5}, 0x3) socket$inet6_tcp(0xa, 0x1, 0x0) openat$procfs(0xffffffffffffff9c, &(0x7f00000010c0)='/proc/crypto\x00', 0x0, 0x0) io_uring_setup(0x7c8f, &(0x7f0000001140)={0x0, 0xc240, 0x10, 0x3, 0x1c7}) 21:17:00 executing program 7: pipe2$9p(&(0x7f0000000200), 0x0) write$P9_RSYMLINK(0xffffffffffffffff, &(0x7f0000000240)={0x14, 0x11, 0x1, {0x1, 0x3, 0x2}}, 0x14) add_key$fscrypt_v1(&(0x7f0000000280), &(0x7f00000002c0)={'fscrypt:', @desc2}, &(0x7f0000000300)={0x0, "ccf022eeb1aa5b4a9067674b5b7079352411c35248e190415959cbe4b7be99236abd831288583a8ed4db4b7b3f838c24d293f908bf3509b49f2c17852201f646", 0x19}, 0x48, 0xfffffffffffffffa) syz_genetlink_get_family_id$mptcp(&(0x7f00000004c0), 0xffffffffffffffff) openat$vcsa(0xffffffffffffff9c, &(0x7f00000009c0), 0x14200, 0x0) syz_genetlink_get_family_id$mptcp(&(0x7f0000000a80), 0xffffffffffffffff) 21:17:00 executing program 1: r0 = openat$hwrng(0xffffffffffffff9c, &(0x7f0000000180), 0x2, 0x0) r1 = syz_io_uring_setup(0x65dd, &(0x7f00000001c0)={0x0, 0xf46f, 0x20, 0x2, 0xdf}, &(0x7f0000ffe000/0x1000)=nil, &(0x7f0000ffd000/0x1000)=nil, &(0x7f0000000240), &(0x7f0000000280)) syz_genetlink_get_family_id$mptcp(&(0x7f0000000300), r0) syz_io_uring_setup(0x20f8, &(0x7f0000000400)={0x0, 0x7677, 0x8, 0x3, 0x22f, 0x0, r1}, &(0x7f0000ffe000/0x2000)=nil, &(0x7f0000ffb000/0x2000)=nil, &(0x7f0000000480)=0x0, &(0x7f00000004c0)) r3 = openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000500)='./cgroup/syz1\x00', 0x200002, 0x0) syz_io_uring_submit(r2, 0x0, &(0x7f0000000580)=@IORING_OP_FILES_UPDATE={0x14, 0x4, 0x0, 0x0, 0x40, &(0x7f0000000540)=[r1, 0xffffffffffffffff, r3, 0xffffffffffffffff, 0xffffffffffffffff], 0x5}, 0x3) io_uring_setup(0x2812, &(0x7f00000005c0)={0x0, 0x5e1b, 0x2, 0x3, 0x12f, 0x0, r1}) socket$inet6_tcp(0xa, 0x1, 0x0) openat$procfs(0xffffffffffffff9c, &(0x7f00000010c0)='/proc/crypto\x00', 0x0, 0x0) io_uring_setup(0x7c8f, &(0x7f0000001140)={0x0, 0xc240, 0x10, 0x3, 0x1c7, 0x0, r1}) 21:17:00 executing program 4: ioctl$SCSI_IOCTL_DOORUNLOCK(0xffffffffffffffff, 0x5381) r0 = syz_open_dev$mouse(&(0x7f0000000000), 0x578, 0x4000) ioctl$SG_GET_PACK_ID(r0, 0x227c, &(0x7f0000000040)) syz_open_dev$vcsa(&(0x7f0000000440), 0x56, 0x4000) socketpair(0x0, 0x3, 0x6, &(0x7f0000000640)) r1 = openat$tcp_congestion(0xffffffffffffff9c, &(0x7f0000000800), 0x1, 0x0) write$tcp_congestion(r1, &(0x7f0000000840)='htcp\x00', 0x5) 21:17:00 executing program 0: r0 = io_uring_setup(0x355e, &(0x7f0000000000)={0x0, 0x7682, 0x20, 0x1, 0x1be}) r1 = syz_io_uring_setup(0x8fe, &(0x7f0000000080)={0x0, 0x1830, 0x0, 0x0, 0x1b8, 0x0, r0}, &(0x7f0000ffb000/0x2000)=nil, &(0x7f0000ffb000/0x4000)=nil, &(0x7f0000000100), &(0x7f0000000140)=0x0) openat$hwrng(0xffffffffffffff9c, &(0x7f0000000180), 0x2, 0x0) r3 = syz_io_uring_setup(0x65dd, &(0x7f00000001c0)={0x0, 0xf46f, 0x20, 0x2, 0xdf}, &(0x7f0000ffe000/0x1000)=nil, &(0x7f0000ffd000/0x1000)=nil, &(0x7f0000000240), &(0x7f0000000280)) r4 = openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000500)='./cgroup/syz1\x00', 0x200002, 0x0) syz_io_uring_submit(0x0, r2, &(0x7f0000000580)=@IORING_OP_FILES_UPDATE={0x14, 0x4, 0x0, 0x0, 0x40, &(0x7f0000000540)=[r3, 0xffffffffffffffff, r4, r0, r1], 0x5}, 0x3) io_uring_setup(0x2812, &(0x7f00000005c0)={0x0, 0x5e1b, 0x2, 0x3, 0x12f, 0x0, r3}) socket$inet6_tcp(0xa, 0x1, 0x0) 21:17:00 executing program 6: r0 = io_uring_setup(0x355e, &(0x7f0000000000)={0x0, 0x7682, 0x20, 0x1, 0x1be}) r1 = syz_io_uring_setup(0x8fe, &(0x7f0000000080)={0x0, 0x1830, 0x0, 0x0, 0x1b8, 0x0, r0}, &(0x7f0000ffb000/0x2000)=nil, &(0x7f0000ffb000/0x4000)=nil, &(0x7f0000000100), &(0x7f0000000140)=0x0) r3 = openat$hwrng(0xffffffffffffff9c, &(0x7f0000000180), 0x2, 0x0) r4 = syz_genetlink_get_family_id$mptcp(&(0x7f0000000300), r3) sendmsg$MPTCP_PM_CMD_ADD_ADDR(r3, &(0x7f00000003c0)={&(0x7f00000002c0)={0x10, 0x0, 0x0, 0x10}, 0xc, &(0x7f0000000380)={&(0x7f0000000340)={0x24, r4, 0x300, 0x70bd26, 0x25dfdbfb, {}, [@MPTCP_PM_ATTR_SUBFLOWS={0x8, 0x3, 0x1}, @MPTCP_PM_ATTR_RCV_ADD_ADDRS={0x8, 0x2, 0x2}]}, 0x24}, 0x1, 0x0, 0x0, 0x20000004}, 0x8890) syz_io_uring_setup(0x20f8, &(0x7f0000000400)={0x0, 0x7677, 0x8, 0x3, 0x22f}, &(0x7f0000ffe000/0x2000)=nil, &(0x7f0000ffb000/0x2000)=nil, &(0x7f0000000480)=0x0, &(0x7f00000004c0)) r6 = openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000500)='./cgroup/syz1\x00', 0x200002, 0x0) syz_io_uring_submit(r5, r2, &(0x7f0000000580)=@IORING_OP_FILES_UPDATE={0x14, 0x4, 0x0, 0x0, 0x40, &(0x7f0000000540)=[0xffffffffffffffff, 0xffffffffffffffff, r6, r0, r1], 0x5}, 0x3) socket$inet6_tcp(0xa, 0x1, 0x0) openat$procfs(0xffffffffffffff9c, &(0x7f00000010c0)='/proc/crypto\x00', 0x0, 0x0) io_uring_setup(0x7c8f, &(0x7f0000001140)={0x0, 0xc240, 0x10, 0x3, 0x1c7}) 21:17:01 executing program 5: r0 = io_uring_setup(0x355e, &(0x7f0000000000)={0x0, 0x7682, 0x20, 0x1, 0x1be}) r1 = syz_io_uring_setup(0x8fe, &(0x7f0000000080)={0x0, 0x1830, 0x0, 0x0, 0x1b8, 0x0, r0}, &(0x7f0000ffb000/0x2000)=nil, &(0x7f0000ffb000/0x4000)=nil, &(0x7f0000000100), &(0x7f0000000140)=0x0) r3 = openat$hwrng(0xffffffffffffff9c, &(0x7f0000000180), 0x2, 0x0) r4 = syz_io_uring_setup(0x65dd, &(0x7f00000001c0)={0x0, 0xf46f, 0x20, 0x2, 0xdf}, &(0x7f0000ffe000/0x1000)=nil, &(0x7f0000ffd000/0x1000)=nil, &(0x7f0000000240), &(0x7f0000000280)) r5 = syz_genetlink_get_family_id$mptcp(&(0x7f0000000300), r3) sendmsg$MPTCP_PM_CMD_ADD_ADDR(r3, &(0x7f00000003c0)={&(0x7f00000002c0)={0x10, 0x0, 0x0, 0x10}, 0xc, &(0x7f0000000380)={&(0x7f0000000340)={0x24, r5, 0x300, 0x70bd26, 0x25dfdbfb, {}, [@MPTCP_PM_ATTR_SUBFLOWS={0x8, 0x3, 0x1}, @MPTCP_PM_ATTR_RCV_ADD_ADDRS={0x8, 0x2, 0x2}]}, 0x24}, 0x1, 0x0, 0x0, 0x20000004}, 0x8890) r6 = openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000500)='./cgroup/syz1\x00', 0x200002, 0x0) syz_io_uring_submit(0x0, r2, &(0x7f0000000580)=@IORING_OP_FILES_UPDATE={0x14, 0x4, 0x0, 0x0, 0x40, &(0x7f0000000540)=[r4, 0xffffffffffffffff, r6, r0, r1], 0x5}, 0x3) socket$inet6_tcp(0xa, 0x1, 0x0) openat$procfs(0xffffffffffffff9c, &(0x7f00000010c0)='/proc/crypto\x00', 0x0, 0x0) 21:17:01 executing program 0: r0 = io_uring_setup(0x355e, &(0x7f0000000000)={0x0, 0x7682, 0x20, 0x1, 0x1be}) r1 = syz_io_uring_setup(0x8fe, &(0x7f0000000080)={0x0, 0x1830, 0x0, 0x0, 0x1b8, 0x0, r0}, &(0x7f0000ffb000/0x2000)=nil, &(0x7f0000ffb000/0x4000)=nil, &(0x7f0000000100), &(0x7f0000000140)=0x0) openat$hwrng(0xffffffffffffff9c, &(0x7f0000000180), 0x2, 0x0) r3 = openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000500)='./cgroup/syz1\x00', 0x200002, 0x0) syz_io_uring_submit(0x0, r2, &(0x7f0000000580)=@IORING_OP_FILES_UPDATE={0x14, 0x4, 0x0, 0x0, 0x40, &(0x7f0000000540)=[0xffffffffffffffff, 0xffffffffffffffff, r3, r0, r1], 0x5}, 0x3) io_uring_setup(0x2812, &(0x7f00000005c0)={0x0, 0x5e1b, 0x2, 0x3, 0x12f}) socket$inet6_tcp(0xa, 0x1, 0x0) 21:17:01 executing program 1: r0 = io_uring_setup(0x0, &(0x7f0000000000)={0x0, 0x7682, 0x20, 0x1, 0x1be}) r1 = openat$hwrng(0xffffffffffffff9c, &(0x7f0000000180), 0x2, 0x0) r2 = syz_io_uring_setup(0x65dd, &(0x7f00000001c0)={0x0, 0xf46f, 0x20, 0x2, 0xdf}, &(0x7f0000ffe000/0x1000)=nil, &(0x7f0000ffd000/0x1000)=nil, &(0x7f0000000240), &(0x7f0000000280)) syz_genetlink_get_family_id$mptcp(&(0x7f0000000300), r1) syz_io_uring_setup(0x20f8, &(0x7f0000000400)={0x0, 0x7677, 0x8, 0x3, 0x22f, 0x0, r2}, &(0x7f0000ffe000/0x2000)=nil, &(0x7f0000ffb000/0x2000)=nil, &(0x7f0000000480)=0x0, &(0x7f00000004c0)) r4 = openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000500)='./cgroup/syz1\x00', 0x200002, 0x0) syz_io_uring_submit(r3, 0x0, &(0x7f0000000580)=@IORING_OP_FILES_UPDATE={0x14, 0x4, 0x0, 0x0, 0x40, &(0x7f0000000540)=[r2, 0xffffffffffffffff, r4, r0, 0xffffffffffffffff], 0x5}, 0x3) io_uring_setup(0x2812, &(0x7f00000005c0)={0x0, 0x5e1b, 0x2, 0x3, 0x12f, 0x0, r2}) socket$inet6_tcp(0xa, 0x1, 0x0) openat$procfs(0xffffffffffffff9c, &(0x7f00000010c0)='/proc/crypto\x00', 0x0, 0x0) io_uring_setup(0x7c8f, &(0x7f0000001140)={0x0, 0xc240, 0x10, 0x3, 0x1c7, 0x0, r2}) 21:17:01 executing program 4: ioctl$SCSI_IOCTL_DOORUNLOCK(0xffffffffffffffff, 0x5381) r0 = syz_open_dev$mouse(&(0x7f0000000000), 0x578, 0x4000) syz_genetlink_get_family_id$nl80211(&(0x7f00000000c0), r0) syz_open_dev$vcsa(&(0x7f0000000440), 0x56, 0x4000) socketpair(0x0, 0x3, 0x6, &(0x7f0000000640)) r1 = openat$tcp_congestion(0xffffffffffffff9c, &(0x7f0000000800), 0x1, 0x0) write$tcp_congestion(r1, &(0x7f0000000840)='htcp\x00', 0x5) 21:17:01 executing program 3: r0 = io_uring_setup(0x355e, &(0x7f0000000000)={0x0, 0x7682, 0x20, 0x1, 0x1be}) r1 = syz_io_uring_setup(0x8fe, &(0x7f0000000080)={0x0, 0x1830, 0x0, 0x0, 0x1b8, 0x0, r0}, &(0x7f0000ffb000/0x2000)=nil, &(0x7f0000ffb000/0x4000)=nil, &(0x7f0000000100), &(0x7f0000000140)=0x0) r3 = openat$hwrng(0xffffffffffffff9c, &(0x7f0000000180), 0x2, 0x0) r4 = syz_io_uring_setup(0x65dd, &(0x7f00000001c0)={0x0, 0xf46f, 0x20, 0x2, 0xdf}, &(0x7f0000ffe000/0x1000)=nil, &(0x7f0000ffd000/0x1000)=nil, &(0x7f0000000240), &(0x7f0000000280)) syz_genetlink_get_family_id$mptcp(&(0x7f0000000300), r3) r5 = openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000500)='./cgroup/syz1\x00', 0x200002, 0x0) syz_io_uring_submit(0x0, r2, &(0x7f0000000580)=@IORING_OP_FILES_UPDATE={0x14, 0x4, 0x0, 0x0, 0x40, &(0x7f0000000540)=[r4, 0xffffffffffffffff, r5, r0, r1], 0x5}, 0x3) io_uring_setup(0x2812, &(0x7f00000005c0)={0x0, 0x5e1b, 0x2, 0x3, 0x12f, 0x0, r4}) socket$inet6_tcp(0xa, 0x1, 0x0) io_uring_setup(0x7c8f, &(0x7f0000001140)={0x0, 0xc240, 0x10, 0x3, 0x1c7, 0x0, r4}) 21:17:10 executing program 0: r0 = io_uring_setup(0x355e, &(0x7f0000000000)={0x0, 0x7682, 0x20, 0x1, 0x1be}) r1 = syz_io_uring_setup(0x8fe, &(0x7f0000000080)={0x0, 0x1830, 0x0, 0x0, 0x1b8, 0x0, r0}, &(0x7f0000ffb000/0x2000)=nil, &(0x7f0000ffb000/0x4000)=nil, &(0x7f0000000100), &(0x7f0000000140)=0x0) r3 = openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000500)='./cgroup/syz1\x00', 0x200002, 0x0) syz_io_uring_submit(0x0, r2, &(0x7f0000000580)=@IORING_OP_FILES_UPDATE={0x14, 0x4, 0x0, 0x0, 0x40, &(0x7f0000000540)=[0xffffffffffffffff, 0xffffffffffffffff, r3, r0, r1], 0x5}, 0x3) io_uring_setup(0x2812, &(0x7f00000005c0)={0x0, 0x5e1b, 0x2, 0x3, 0x12f}) socket$inet6_tcp(0xa, 0x1, 0x0) 21:17:10 executing program 3: r0 = io_uring_setup(0x355e, &(0x7f0000000000)={0x0, 0x7682, 0x20, 0x1, 0x1be}) r1 = syz_io_uring_setup(0x8fe, &(0x7f0000000080)={0x0, 0x1830, 0x0, 0x0, 0x1b8, 0x0, r0}, &(0x7f0000ffb000/0x2000)=nil, &(0x7f0000ffb000/0x4000)=nil, &(0x7f0000000100), &(0x7f0000000140)=0x0) openat$hwrng(0xffffffffffffff9c, &(0x7f0000000180), 0x2, 0x0) r3 = syz_io_uring_setup(0x65dd, &(0x7f00000001c0)={0x0, 0xf46f, 0x20, 0x2, 0xdf}, &(0x7f0000ffe000/0x1000)=nil, &(0x7f0000ffd000/0x1000)=nil, &(0x7f0000000240), &(0x7f0000000280)) r4 = openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000500)='./cgroup/syz1\x00', 0x200002, 0x0) syz_io_uring_submit(0x0, r2, &(0x7f0000000580)=@IORING_OP_FILES_UPDATE={0x14, 0x4, 0x0, 0x0, 0x40, &(0x7f0000000540)=[r3, 0xffffffffffffffff, r4, r0, r1], 0x5}, 0x3) io_uring_setup(0x2812, &(0x7f00000005c0)={0x0, 0x5e1b, 0x2, 0x3, 0x12f, 0x0, r3}) socket$inet6_tcp(0xa, 0x1, 0x0) io_uring_setup(0x7c8f, &(0x7f0000001140)={0x0, 0xc240, 0x10, 0x3, 0x1c7, 0x0, r3}) 21:17:10 executing program 5: r0 = io_uring_setup(0x355e, &(0x7f0000000000)={0x0, 0x7682, 0x20, 0x1, 0x1be}) r1 = syz_io_uring_setup(0x8fe, &(0x7f0000000080)={0x0, 0x1830, 0x0, 0x0, 0x1b8, 0x0, r0}, &(0x7f0000ffb000/0x2000)=nil, &(0x7f0000ffb000/0x4000)=nil, &(0x7f0000000100), &(0x7f0000000140)=0x0) r3 = openat$hwrng(0xffffffffffffff9c, &(0x7f0000000180), 0x2, 0x0) r4 = syz_io_uring_setup(0x65dd, &(0x7f00000001c0)={0x0, 0xf46f, 0x20, 0x2, 0xdf}, &(0x7f0000ffe000/0x1000)=nil, &(0x7f0000ffd000/0x1000)=nil, &(0x7f0000000240), &(0x7f0000000280)) syz_genetlink_get_family_id$mptcp(&(0x7f0000000300), r3) r5 = openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000500)='./cgroup/syz1\x00', 0x200002, 0x0) syz_io_uring_submit(0x0, r2, &(0x7f0000000580)=@IORING_OP_FILES_UPDATE={0x14, 0x4, 0x0, 0x0, 0x40, &(0x7f0000000540)=[r4, 0xffffffffffffffff, r5, r0, r1], 0x5}, 0x3) socket$inet6_tcp(0xa, 0x1, 0x0) openat$procfs(0xffffffffffffff9c, &(0x7f00000010c0)='/proc/crypto\x00', 0x0, 0x0) 21:17:10 executing program 6: r0 = io_uring_setup(0x355e, &(0x7f0000000000)={0x0, 0x7682, 0x20, 0x1, 0x1be}) r1 = syz_io_uring_setup(0x8fe, &(0x7f0000000080)={0x0, 0x1830, 0x0, 0x0, 0x1b8, 0x0, r0}, &(0x7f0000ffb000/0x2000)=nil, &(0x7f0000ffb000/0x4000)=nil, &(0x7f0000000100), &(0x7f0000000140)=0x0) r3 = syz_genetlink_get_family_id$mptcp(&(0x7f0000000300), 0xffffffffffffffff) sendmsg$MPTCP_PM_CMD_ADD_ADDR(0xffffffffffffffff, &(0x7f00000003c0)={&(0x7f00000002c0)={0x10, 0x0, 0x0, 0x10}, 0xc, &(0x7f0000000380)={&(0x7f0000000340)={0x24, r3, 0x300, 0x70bd26, 0x25dfdbfb, {}, [@MPTCP_PM_ATTR_SUBFLOWS={0x8, 0x3, 0x1}, @MPTCP_PM_ATTR_RCV_ADD_ADDRS={0x8, 0x2, 0x2}]}, 0x24}, 0x1, 0x0, 0x0, 0x20000004}, 0x8890) syz_io_uring_setup(0x20f8, &(0x7f0000000400)={0x0, 0x7677, 0x8, 0x3, 0x22f}, &(0x7f0000ffe000/0x2000)=nil, &(0x7f0000ffb000/0x2000)=nil, &(0x7f0000000480)=0x0, &(0x7f00000004c0)) r5 = openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000500)='./cgroup/syz1\x00', 0x200002, 0x0) syz_io_uring_submit(r4, r2, &(0x7f0000000580)=@IORING_OP_FILES_UPDATE={0x14, 0x4, 0x0, 0x0, 0x40, &(0x7f0000000540)=[0xffffffffffffffff, 0xffffffffffffffff, r5, r0, r1], 0x5}, 0x3) socket$inet6_tcp(0xa, 0x1, 0x0) openat$procfs(0xffffffffffffff9c, &(0x7f00000010c0)='/proc/crypto\x00', 0x0, 0x0) io_uring_setup(0x7c8f, &(0x7f0000001140)={0x0, 0xc240, 0x10, 0x3, 0x1c7}) 21:17:10 executing program 1: r0 = io_uring_setup(0x0, &(0x7f0000000000)={0x0, 0x7682, 0x20, 0x1, 0x1be}) r1 = openat$hwrng(0xffffffffffffff9c, &(0x7f0000000180), 0x2, 0x0) r2 = syz_io_uring_setup(0x65dd, &(0x7f00000001c0)={0x0, 0xf46f, 0x20, 0x2, 0xdf}, &(0x7f0000ffe000/0x1000)=nil, &(0x7f0000ffd000/0x1000)=nil, &(0x7f0000000240), &(0x7f0000000280)) syz_genetlink_get_family_id$mptcp(&(0x7f0000000300), r1) syz_io_uring_setup(0x20f8, &(0x7f0000000400)={0x0, 0x7677, 0x8, 0x3, 0x22f, 0x0, r2}, &(0x7f0000ffe000/0x2000)=nil, &(0x7f0000ffb000/0x2000)=nil, &(0x7f0000000480)=0x0, &(0x7f00000004c0)) r4 = openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000500)='./cgroup/syz1\x00', 0x200002, 0x0) syz_io_uring_submit(r3, 0x0, &(0x7f0000000580)=@IORING_OP_FILES_UPDATE={0x14, 0x4, 0x0, 0x0, 0x40, &(0x7f0000000540)=[r2, 0xffffffffffffffff, r4, r0, 0xffffffffffffffff], 0x5}, 0x3) io_uring_setup(0x2812, &(0x7f00000005c0)={0x0, 0x5e1b, 0x2, 0x3, 0x12f, 0x0, r2}) socket$inet6_tcp(0xa, 0x1, 0x0) openat$procfs(0xffffffffffffff9c, &(0x7f00000010c0)='/proc/crypto\x00', 0x0, 0x0) io_uring_setup(0x7c8f, &(0x7f0000001140)={0x0, 0xc240, 0x10, 0x3, 0x1c7, 0x0, r2}) 21:17:10 executing program 4: ioctl$SCSI_IOCTL_DOORUNLOCK(0xffffffffffffffff, 0x5381) r0 = syz_open_dev$mouse(&(0x7f0000000000), 0x578, 0x4000) syz_genetlink_get_family_id$nl80211(&(0x7f00000000c0), r0) syz_open_dev$vcsa(&(0x7f0000000440), 0x56, 0x4000) socketpair(0x0, 0x3, 0x6, &(0x7f0000000640)) r1 = openat$tcp_congestion(0xffffffffffffff9c, &(0x7f0000000800), 0x1, 0x0) write$tcp_congestion(r1, &(0x7f0000000840)='htcp\x00', 0x5) 21:17:10 executing program 2: syz_genetlink_get_family_id$nl80211(&(0x7f00000000c0), 0xffffffffffffffff) syz_open_dev$vcsa(&(0x7f0000000440), 0x56, 0x0) socketpair(0x0, 0x3, 0x6, &(0x7f0000000640)) r0 = openat$tcp_congestion(0xffffffffffffff9c, &(0x7f0000000800), 0x1, 0x0) write$tcp_congestion(r0, &(0x7f0000000840)='htcp\x00', 0x5) 21:17:10 executing program 7: pipe2$9p(&(0x7f0000000200), 0x0) write$P9_RSYMLINK(0xffffffffffffffff, &(0x7f0000000240)={0x14, 0x11, 0x1, {0x1, 0x3, 0x2}}, 0x14) add_key$fscrypt_v1(&(0x7f0000000280), &(0x7f00000002c0)={'fscrypt:', @desc2}, &(0x7f0000000300)={0x0, "ccf022eeb1aa5b4a9067674b5b7079352411c35248e190415959cbe4b7be99236abd831288583a8ed4db4b7b3f838c24d293f908bf3509b49f2c17852201f646", 0x19}, 0x48, 0xfffffffffffffffa) syz_genetlink_get_family_id$mptcp(&(0x7f00000004c0), 0xffffffffffffffff) openat$vcsa(0xffffffffffffff9c, &(0x7f00000009c0), 0x14200, 0x0) syz_genetlink_get_family_id$mptcp(&(0x7f0000000a80), 0xffffffffffffffff) [ 359.766260] kmemleak: Found object by alias at 0x607f1a6398ac [ 359.766280] CPU: 0 UID: 0 PID: 5553 Comm: syz-executor.3 Tainted: G W 6.17.0-rc3-next-20250829 #1 PREEMPT(voluntary) [ 359.766302] Tainted: [W]=WARN [ 359.766306] Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.12.0-1 04/01/2014 [ 359.766314] Call Trace: [ 359.766319] [ 359.766324] dump_stack_lvl+0xca/0x120 [ 359.766357] __lookup_object+0x94/0xb0 [ 359.766376] delete_object_full+0x27/0x70 [ 359.766395] free_percpu+0x30/0x1160 [ 359.766414] ? arch_uprobe_clear_state+0x16/0x140 [ 359.766438] futex_hash_free+0x38/0xc0 [ 359.766455] mmput+0x2d3/0x390 [ 359.766477] do_exit+0x79d/0x2970 [ 359.766493] ? signal_wake_up_state+0x85/0x120 [ 359.766511] ? zap_other_threads+0x2b9/0x3a0 [ 359.766530] ? __pfx_do_exit+0x10/0x10 [ 359.766545] ? do_group_exit+0x1c3/0x2a0 [ 359.766561] ? lock_release+0xc8/0x290 [ 359.766581] do_group_exit+0xd3/0x2a0 [ 359.766598] __x64_sys_exit_group+0x3e/0x50 [ 359.766614] x64_sys_call+0x18c5/0x18d0 [ 359.766633] do_syscall_64+0xbf/0x360 [ 359.766646] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 359.766659] RIP: 0033:0x7f1060a76b19 [ 359.766670] Code: Unable to access opcode bytes at 0x7f1060a76aef. [ 359.766676] RSP: 002b:00007ffed3f8b6d8 EFLAGS: 00000246 ORIG_RAX: 00000000000000e7 [ 359.766689] RAX: ffffffffffffffda RBX: 000000000000001e RCX: 00007f1060a76b19 [ 359.766698] RDX: 00007f1060a2972b RSI: ffffffffffffffbc RDI: 0000000000000000 [ 359.766706] RBP: 0000000000000000 R08: 0000001b2da24b38 R09: 0000000000000000 [ 359.766714] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 359.766721] R13: 0000000000000000 R14: 0000000000000001 R15: 00007ffed3f8b7c0 [ 359.766739] [ 359.766743] kmemleak: Object (percpu) 0x607f1a6398a8 (size 8): [ 359.766751] kmemleak: comm "syz-executor.0", pid 5568, jiffies 4295026603 [ 359.766759] kmemleak: min_count = 1 [ 359.766763] kmemleak: count = 0 [ 359.766768] kmemleak: flags = 0x21 [ 359.766772] kmemleak: checksum = 0 [ 359.766776] kmemleak: backtrace: [ 359.766781] pcpu_alloc_noprof+0x87a/0x1170 [ 359.766798] percpu_ref_init+0x37/0x400 [ 359.766819] io_uring_setup+0x44c/0x2000 [ 359.766832] __x64_sys_io_uring_setup+0xc8/0x170 [ 359.766845] do_syscall_64+0xbf/0x360 [ 359.766855] entry_SYSCALL_64_after_hwframe+0x77/0x7f 21:17:10 executing program 3: r0 = io_uring_setup(0x355e, &(0x7f0000000000)={0x0, 0x7682, 0x20, 0x1, 0x1be}) r1 = syz_io_uring_setup(0x8fe, &(0x7f0000000080)={0x0, 0x1830, 0x0, 0x0, 0x1b8, 0x0, r0}, &(0x7f0000ffb000/0x2000)=nil, &(0x7f0000ffb000/0x4000)=nil, &(0x7f0000000100), &(0x7f0000000140)=0x0) openat$hwrng(0xffffffffffffff9c, &(0x7f0000000180), 0x2, 0x0) r3 = syz_io_uring_setup(0x65dd, &(0x7f00000001c0)={0x0, 0xf46f, 0x20, 0x2, 0xdf}, &(0x7f0000ffe000/0x1000)=nil, &(0x7f0000ffd000/0x1000)=nil, &(0x7f0000000240), &(0x7f0000000280)) r4 = openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000500)='./cgroup/syz1\x00', 0x200002, 0x0) syz_io_uring_submit(0x0, r2, &(0x7f0000000580)=@IORING_OP_FILES_UPDATE={0x14, 0x4, 0x0, 0x0, 0x40, &(0x7f0000000540)=[r3, 0xffffffffffffffff, r4, r0, r1], 0x5}, 0x3) io_uring_setup(0x2812, &(0x7f00000005c0)={0x0, 0x5e1b, 0x2, 0x3, 0x12f, 0x0, r3}) socket$inet6_tcp(0xa, 0x1, 0x0) io_uring_setup(0x7c8f, &(0x7f0000001140)={0x0, 0xc240, 0x10, 0x3, 0x1c7, 0x0, r3}) 21:17:10 executing program 7: pipe2$9p(&(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}, 0x0) write$P9_RSYMLINK(r0, 0x0, 0x0) add_key$fscrypt_v1(&(0x7f0000000280), &(0x7f00000002c0)={'fscrypt:', @desc2}, &(0x7f0000000300)={0x0, "ccf022eeb1aa5b4a9067674b5b7079352411c35248e190415959cbe4b7be99236abd831288583a8ed4db4b7b3f838c24d293f908bf3509b49f2c17852201f646", 0x19}, 0x48, 0xfffffffffffffffa) syz_genetlink_get_family_id$mptcp(&(0x7f00000004c0), 0xffffffffffffffff) openat$vcsa(0xffffffffffffff9c, &(0x7f00000009c0), 0x14200, 0x0) syz_genetlink_get_family_id$mptcp(&(0x7f0000000a80), 0xffffffffffffffff) 21:17:10 executing program 0: r0 = io_uring_setup(0x355e, &(0x7f0000000000)={0x0, 0x7682, 0x20, 0x1, 0x1be}) r1 = syz_io_uring_setup(0x8fe, &(0x7f0000000080)={0x0, 0x1830, 0x0, 0x0, 0x1b8, 0x0, r0}, &(0x7f0000ffb000/0x2000)=nil, &(0x7f0000ffb000/0x4000)=nil, &(0x7f0000000100), &(0x7f0000000140)=0x0) r3 = openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000500)='./cgroup/syz1\x00', 0x200002, 0x0) syz_io_uring_submit(0x0, r2, &(0x7f0000000580)=@IORING_OP_FILES_UPDATE={0x14, 0x4, 0x0, 0x0, 0x40, &(0x7f0000000540)=[0xffffffffffffffff, 0xffffffffffffffff, r3, r0, r1], 0x5}, 0x3) io_uring_setup(0x2812, &(0x7f00000005c0)={0x0, 0x5e1b, 0x2, 0x3, 0x12f}) socket$inet6_tcp(0xa, 0x1, 0x0) 21:17:10 executing program 6: r0 = io_uring_setup(0x355e, &(0x7f0000000000)={0x0, 0x7682, 0x20, 0x1, 0x1be}) r1 = syz_io_uring_setup(0x8fe, &(0x7f0000000080)={0x0, 0x1830, 0x0, 0x0, 0x1b8, 0x0, r0}, &(0x7f0000ffb000/0x2000)=nil, &(0x7f0000ffb000/0x4000)=nil, &(0x7f0000000100), &(0x7f0000000140)=0x0) r3 = syz_genetlink_get_family_id$mptcp(&(0x7f0000000300), 0xffffffffffffffff) sendmsg$MPTCP_PM_CMD_ADD_ADDR(0xffffffffffffffff, &(0x7f00000003c0)={&(0x7f00000002c0)={0x10, 0x0, 0x0, 0x10}, 0xc, &(0x7f0000000380)={&(0x7f0000000340)={0x24, r3, 0x300, 0x70bd26, 0x25dfdbfb, {}, [@MPTCP_PM_ATTR_SUBFLOWS={0x8, 0x3, 0x1}, @MPTCP_PM_ATTR_RCV_ADD_ADDRS={0x8, 0x2, 0x2}]}, 0x24}, 0x1, 0x0, 0x0, 0x20000004}, 0x8890) syz_io_uring_setup(0x20f8, &(0x7f0000000400)={0x0, 0x7677, 0x8, 0x3, 0x22f}, &(0x7f0000ffe000/0x2000)=nil, &(0x7f0000ffb000/0x2000)=nil, &(0x7f0000000480)=0x0, &(0x7f00000004c0)) r5 = openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000500)='./cgroup/syz1\x00', 0x200002, 0x0) syz_io_uring_submit(r4, r2, &(0x7f0000000580)=@IORING_OP_FILES_UPDATE={0x14, 0x4, 0x0, 0x0, 0x40, &(0x7f0000000540)=[0xffffffffffffffff, 0xffffffffffffffff, r5, r0, r1], 0x5}, 0x3) socket$inet6_tcp(0xa, 0x1, 0x0) openat$procfs(0xffffffffffffff9c, &(0x7f00000010c0)='/proc/crypto\x00', 0x0, 0x0) io_uring_setup(0x7c8f, &(0x7f0000001140)={0x0, 0xc240, 0x10, 0x3, 0x1c7}) 21:17:10 executing program 2: syz_genetlink_get_family_id$nl80211(&(0x7f00000000c0), 0xffffffffffffffff) syz_open_dev$vcsa(&(0x7f0000000440), 0x56, 0x0) socketpair(0x0, 0x3, 0x6, &(0x7f0000000640)) r0 = openat$tcp_congestion(0xffffffffffffff9c, &(0x7f0000000800), 0x1, 0x0) write$tcp_congestion(r0, &(0x7f0000000840)='htcp\x00', 0x5) 21:17:18 executing program 4: ioctl$SCSI_IOCTL_DOORUNLOCK(0xffffffffffffffff, 0x5381) r0 = syz_open_dev$mouse(&(0x7f0000000000), 0x578, 0x4000) syz_genetlink_get_family_id$nl80211(&(0x7f00000000c0), r0) syz_open_dev$vcsa(&(0x7f0000000440), 0x56, 0x4000) socketpair(0x0, 0x3, 0x6, &(0x7f0000000640)) r1 = openat$tcp_congestion(0xffffffffffffff9c, &(0x7f0000000800), 0x1, 0x0) write$tcp_congestion(r1, &(0x7f0000000840)='htcp\x00', 0x5) 21:17:18 executing program 2: syz_genetlink_get_family_id$nl80211(&(0x7f00000000c0), 0xffffffffffffffff) syz_open_dev$vcsa(&(0x7f0000000440), 0x56, 0x4000) socketpair(0x0, 0x0, 0x6, &(0x7f0000000640)) r0 = openat$tcp_congestion(0xffffffffffffff9c, &(0x7f0000000800), 0x1, 0x0) write$tcp_congestion(r0, &(0x7f0000000840)='htcp\x00', 0x5) 21:17:18 executing program 6: r0 = io_uring_setup(0x355e, &(0x7f0000000000)={0x0, 0x7682, 0x20, 0x1, 0x1be}) r1 = syz_io_uring_setup(0x8fe, &(0x7f0000000080)={0x0, 0x1830, 0x0, 0x0, 0x1b8, 0x0, r0}, &(0x7f0000ffb000/0x2000)=nil, &(0x7f0000ffb000/0x4000)=nil, &(0x7f0000000100), &(0x7f0000000140)=0x0) r3 = syz_genetlink_get_family_id$mptcp(&(0x7f0000000300), 0xffffffffffffffff) sendmsg$MPTCP_PM_CMD_ADD_ADDR(0xffffffffffffffff, &(0x7f00000003c0)={&(0x7f00000002c0)={0x10, 0x0, 0x0, 0x10}, 0xc, &(0x7f0000000380)={&(0x7f0000000340)={0x24, r3, 0x300, 0x70bd26, 0x25dfdbfb, {}, [@MPTCP_PM_ATTR_SUBFLOWS={0x8, 0x3, 0x1}, @MPTCP_PM_ATTR_RCV_ADD_ADDRS={0x8, 0x2, 0x2}]}, 0x24}, 0x1, 0x0, 0x0, 0x20000004}, 0x8890) syz_io_uring_setup(0x20f8, &(0x7f0000000400)={0x0, 0x7677, 0x8, 0x3, 0x22f}, &(0x7f0000ffe000/0x2000)=nil, &(0x7f0000ffb000/0x2000)=nil, &(0x7f0000000480)=0x0, &(0x7f00000004c0)) r5 = openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000500)='./cgroup/syz1\x00', 0x200002, 0x0) syz_io_uring_submit(r4, r2, &(0x7f0000000580)=@IORING_OP_FILES_UPDATE={0x14, 0x4, 0x0, 0x0, 0x40, &(0x7f0000000540)=[0xffffffffffffffff, 0xffffffffffffffff, r5, r0, r1], 0x5}, 0x3) socket$inet6_tcp(0xa, 0x1, 0x0) openat$procfs(0xffffffffffffff9c, &(0x7f00000010c0)='/proc/crypto\x00', 0x0, 0x0) io_uring_setup(0x7c8f, &(0x7f0000001140)={0x0, 0xc240, 0x10, 0x3, 0x1c7}) 21:17:18 executing program 5: r0 = io_uring_setup(0x355e, &(0x7f0000000000)={0x0, 0x7682, 0x20, 0x1, 0x1be}) r1 = syz_io_uring_setup(0x8fe, &(0x7f0000000080)={0x0, 0x1830, 0x0, 0x0, 0x1b8, 0x0, r0}, &(0x7f0000ffb000/0x2000)=nil, &(0x7f0000ffb000/0x4000)=nil, &(0x7f0000000100), &(0x7f0000000140)=0x0) r3 = openat$hwrng(0xffffffffffffff9c, &(0x7f0000000180), 0x2, 0x0) r4 = syz_io_uring_setup(0x65dd, &(0x7f00000001c0)={0x0, 0xf46f, 0x20, 0x2, 0xdf}, &(0x7f0000ffe000/0x1000)=nil, &(0x7f0000ffd000/0x1000)=nil, &(0x7f0000000240), &(0x7f0000000280)) syz_genetlink_get_family_id$mptcp(&(0x7f0000000300), r3) r5 = openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000500)='./cgroup/syz1\x00', 0x200002, 0x0) syz_io_uring_submit(0x0, r2, &(0x7f0000000580)=@IORING_OP_FILES_UPDATE={0x14, 0x4, 0x0, 0x0, 0x40, &(0x7f0000000540)=[r4, 0xffffffffffffffff, r5, r0, r1], 0x5}, 0x3) socket$inet6_tcp(0xa, 0x1, 0x0) openat$procfs(0xffffffffffffff9c, &(0x7f00000010c0)='/proc/crypto\x00', 0x0, 0x0) 21:17:18 executing program 0: r0 = io_uring_setup(0x355e, &(0x7f0000000000)={0x0, 0x7682, 0x20, 0x1, 0x1be}) r1 = syz_io_uring_setup(0x8fe, &(0x7f0000000080)={0x0, 0x1830, 0x0, 0x0, 0x1b8, 0x0, r0}, &(0x7f0000ffb000/0x2000)=nil, &(0x7f0000ffb000/0x4000)=nil, &(0x7f0000000100), &(0x7f0000000140)=0x0) r3 = openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000500)='./cgroup/syz1\x00', 0x200002, 0x0) syz_io_uring_submit(0x0, r2, &(0x7f0000000580)=@IORING_OP_FILES_UPDATE={0x14, 0x4, 0x0, 0x0, 0x40, &(0x7f0000000540)=[0xffffffffffffffff, 0xffffffffffffffff, r3, r0, r1], 0x5}, 0x3) io_uring_setup(0x2812, &(0x7f00000005c0)={0x0, 0x5e1b, 0x2, 0x3, 0x12f}) socket$inet6_tcp(0xa, 0x1, 0x0) 21:17:18 executing program 3: r0 = io_uring_setup(0x355e, &(0x7f0000000000)={0x0, 0x7682, 0x20, 0x1, 0x1be}) r1 = syz_io_uring_setup(0x8fe, &(0x7f0000000080)={0x0, 0x1830, 0x0, 0x0, 0x1b8, 0x0, r0}, &(0x7f0000ffb000/0x2000)=nil, &(0x7f0000ffb000/0x4000)=nil, &(0x7f0000000100), &(0x7f0000000140)=0x0) openat$hwrng(0xffffffffffffff9c, &(0x7f0000000180), 0x2, 0x0) r3 = syz_io_uring_setup(0x65dd, &(0x7f00000001c0)={0x0, 0xf46f, 0x20, 0x2, 0xdf}, &(0x7f0000ffe000/0x1000)=nil, &(0x7f0000ffd000/0x1000)=nil, &(0x7f0000000240), &(0x7f0000000280)) r4 = openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000500)='./cgroup/syz1\x00', 0x200002, 0x0) syz_io_uring_submit(0x0, r2, &(0x7f0000000580)=@IORING_OP_FILES_UPDATE={0x14, 0x4, 0x0, 0x0, 0x40, &(0x7f0000000540)=[r3, 0xffffffffffffffff, r4, r0, r1], 0x5}, 0x3) io_uring_setup(0x2812, &(0x7f00000005c0)={0x0, 0x5e1b, 0x2, 0x3, 0x12f, 0x0, r3}) socket$inet6_tcp(0xa, 0x1, 0x0) io_uring_setup(0x7c8f, &(0x7f0000001140)={0x0, 0xc240, 0x10, 0x3, 0x1c7, 0x0, r3}) 21:17:18 executing program 7: pipe2$9p(&(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}, 0x0) write$P9_RSYMLINK(r0, 0x0, 0x0) add_key$fscrypt_v1(0x0, &(0x7f00000002c0)={'fscrypt:', @desc2}, &(0x7f0000000300)={0x0, "ccf022eeb1aa5b4a9067674b5b7079352411c35248e190415959cbe4b7be99236abd831288583a8ed4db4b7b3f838c24d293f908bf3509b49f2c17852201f646", 0x19}, 0x48, 0xfffffffffffffffa) syz_genetlink_get_family_id$mptcp(&(0x7f00000004c0), 0xffffffffffffffff) openat$vcsa(0xffffffffffffff9c, &(0x7f00000009c0), 0x14200, 0x0) syz_genetlink_get_family_id$mptcp(&(0x7f0000000a80), 0xffffffffffffffff) 21:17:18 executing program 1: r0 = io_uring_setup(0x0, &(0x7f0000000000)={0x0, 0x7682, 0x20, 0x1, 0x1be}) r1 = openat$hwrng(0xffffffffffffff9c, &(0x7f0000000180), 0x2, 0x0) r2 = syz_io_uring_setup(0x65dd, &(0x7f00000001c0)={0x0, 0xf46f, 0x20, 0x2, 0xdf}, &(0x7f0000ffe000/0x1000)=nil, &(0x7f0000ffd000/0x1000)=nil, &(0x7f0000000240), &(0x7f0000000280)) syz_genetlink_get_family_id$mptcp(&(0x7f0000000300), r1) syz_io_uring_setup(0x20f8, &(0x7f0000000400)={0x0, 0x7677, 0x8, 0x3, 0x22f, 0x0, r2}, &(0x7f0000ffe000/0x2000)=nil, &(0x7f0000ffb000/0x2000)=nil, &(0x7f0000000480)=0x0, &(0x7f00000004c0)) r4 = openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000500)='./cgroup/syz1\x00', 0x200002, 0x0) syz_io_uring_submit(r3, 0x0, &(0x7f0000000580)=@IORING_OP_FILES_UPDATE={0x14, 0x4, 0x0, 0x0, 0x40, &(0x7f0000000540)=[r2, 0xffffffffffffffff, r4, r0, 0xffffffffffffffff], 0x5}, 0x3) io_uring_setup(0x2812, &(0x7f00000005c0)={0x0, 0x5e1b, 0x2, 0x3, 0x12f, 0x0, r2}) socket$inet6_tcp(0xa, 0x1, 0x0) openat$procfs(0xffffffffffffff9c, &(0x7f00000010c0)='/proc/crypto\x00', 0x0, 0x0) io_uring_setup(0x7c8f, &(0x7f0000001140)={0x0, 0xc240, 0x10, 0x3, 0x1c7, 0x0, r2}) [ 368.284260] kmemleak: Found object by alias at 0x607f1a6398ac [ 368.284297] CPU: 0 UID: 0 PID: 5635 Comm: iou-sqp-5625 Tainted: G W 6.17.0-rc3-next-20250829 #1 PREEMPT(voluntary) [ 368.284329] Tainted: [W]=WARN [ 368.284336] Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.12.0-1 04/01/2014 [ 368.284354] Call Trace: [ 368.284361] [ 368.284369] dump_stack_lvl+0xca/0x120 [ 368.284409] __lookup_object+0x94/0xb0 [ 368.284438] delete_object_full+0x27/0x70 [ 368.284467] free_percpu+0x30/0x1160 [ 368.284496] ? arch_uprobe_clear_state+0x16/0x140 [ 368.284532] futex_hash_free+0x38/0xc0 [ 368.284557] mmput+0x2d3/0x390 [ 368.284590] do_exit+0x79d/0x2970 [ 368.284622] ? __pfx_do_exit+0x10/0x10 [ 368.284644] ? io_sq_thread+0xfbd/0x1b00 [ 368.284672] ? lock_release+0xc8/0x290 [ 368.284703] io_sq_thread+0xfc9/0x1b00 [ 368.284742] ? __pfx_io_sq_thread+0x10/0x10 [ 368.284773] ? __lock_acquire+0xc65/0x1b70 [ 368.284797] ? __pfx_autoremove_wake_function+0x10/0x10 [ 368.284824] ? __lock_acquire+0xc65/0x1b70 [ 368.284861] ? do_raw_spin_lock+0x123/0x260 [ 368.284890] ? find_held_lock+0x2b/0x80 [ 368.284919] ? __pfx_io_sq_thread+0x10/0x10 [ 368.284948] ? lock_release+0xc8/0x290 [ 368.284972] ? __pfx_io_sq_thread+0x10/0x10 [ 368.285001] ret_from_fork+0x34b/0x430 [ 368.285033] ? __pfx_io_sq_thread+0x10/0x10 [ 368.285061] ret_from_fork_asm+0x1a/0x30 [ 368.285104] [ 368.285111] kmemleak: Object (percpu) 0x607f1a6398a8 (size 8): [ 368.285123] kmemleak: comm "syz-executor.6", pid 5629, jiffies 4295035020 [ 368.285136] kmemleak: min_count = 1 [ 368.285143] kmemleak: count = 0 [ 368.285149] kmemleak: flags = 0x21 [ 368.285156] kmemleak: checksum = 0 [ 368.285163] kmemleak: backtrace: [ 368.285169] pcpu_alloc_noprof+0x87a/0x1170 [ 368.285196] percpu_ref_init+0x37/0x400 [ 368.285228] io_uring_setup+0x44c/0x2000 [ 368.285247] __x64_sys_io_uring_setup+0xc8/0x170 [ 368.285267] do_syscall_64+0xbf/0x360 [ 368.285283] entry_SYSCALL_64_after_hwframe+0x77/0x7f 21:17:18 executing program 0: r0 = io_uring_setup(0x355e, &(0x7f0000000000)={0x0, 0x7682, 0x20, 0x1, 0x1be}) openat$hwrng(0xffffffffffffff9c, &(0x7f0000000180), 0x2, 0x0) r1 = openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000500)='./cgroup/syz1\x00', 0x200002, 0x0) syz_io_uring_submit(0x0, 0x0, &(0x7f0000000580)=@IORING_OP_FILES_UPDATE={0x14, 0x4, 0x0, 0x0, 0x40, &(0x7f0000000540)=[0xffffffffffffffff, 0xffffffffffffffff, r1, r0, 0xffffffffffffffff], 0x5}, 0x3) io_uring_setup(0x2812, &(0x7f00000005c0)={0x0, 0x5e1b, 0x2, 0x3, 0x12f}) socket$inet6_tcp(0xa, 0x1, 0x0) 21:17:18 executing program 6: r0 = io_uring_setup(0x355e, &(0x7f0000000000)={0x0, 0x7682, 0x20, 0x1, 0x1be}) r1 = openat$hwrng(0xffffffffffffff9c, &(0x7f0000000180), 0x2, 0x0) r2 = syz_genetlink_get_family_id$mptcp(&(0x7f0000000300), r1) sendmsg$MPTCP_PM_CMD_ADD_ADDR(r1, &(0x7f00000003c0)={&(0x7f00000002c0)={0x10, 0x0, 0x0, 0x10}, 0xc, &(0x7f0000000380)={&(0x7f0000000340)={0x24, r2, 0x300, 0x70bd26, 0x25dfdbfb, {}, [@MPTCP_PM_ATTR_SUBFLOWS={0x8, 0x3, 0x1}, @MPTCP_PM_ATTR_RCV_ADD_ADDRS={0x8, 0x2, 0x2}]}, 0x24}, 0x1, 0x0, 0x0, 0x20000004}, 0x8890) syz_io_uring_setup(0x20f8, &(0x7f0000000400)={0x0, 0x7677, 0x8, 0x3, 0x22f}, &(0x7f0000ffe000/0x2000)=nil, &(0x7f0000ffb000/0x2000)=nil, &(0x7f0000000480)=0x0, &(0x7f00000004c0)) r4 = openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000500)='./cgroup/syz1\x00', 0x200002, 0x0) syz_io_uring_submit(r3, 0x0, &(0x7f0000000580)=@IORING_OP_FILES_UPDATE={0x14, 0x4, 0x0, 0x0, 0x40, &(0x7f0000000540)=[0xffffffffffffffff, 0xffffffffffffffff, r4, r0, 0xffffffffffffffff], 0x5}, 0x3) socket$inet6_tcp(0xa, 0x1, 0x0) openat$procfs(0xffffffffffffff9c, &(0x7f00000010c0)='/proc/crypto\x00', 0x0, 0x0) io_uring_setup(0x7c8f, &(0x7f0000001140)={0x0, 0xc240, 0x10, 0x3, 0x1c7}) 21:17:18 executing program 3: r0 = io_uring_setup(0x355e, &(0x7f0000000000)={0x0, 0x7682, 0x20, 0x1, 0x1be}) r1 = syz_io_uring_setup(0x8fe, &(0x7f0000000080)={0x0, 0x1830, 0x0, 0x0, 0x1b8, 0x0, r0}, &(0x7f0000ffb000/0x2000)=nil, &(0x7f0000ffb000/0x4000)=nil, &(0x7f0000000100), &(0x7f0000000140)=0x0) r3 = openat$hwrng(0xffffffffffffff9c, &(0x7f0000000180), 0x2, 0x0) syz_genetlink_get_family_id$mptcp(&(0x7f0000000300), r3) r4 = openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000500)='./cgroup/syz1\x00', 0x200002, 0x0) syz_io_uring_submit(0x0, r2, &(0x7f0000000580)=@IORING_OP_FILES_UPDATE={0x14, 0x4, 0x0, 0x0, 0x40, &(0x7f0000000540)=[0xffffffffffffffff, 0xffffffffffffffff, r4, r0, r1], 0x5}, 0x3) io_uring_setup(0x2812, &(0x7f00000005c0)={0x0, 0x5e1b, 0x2, 0x3, 0x12f}) socket$inet6_tcp(0xa, 0x1, 0x0) io_uring_setup(0x7c8f, &(0x7f0000001140)={0x0, 0xc240, 0x10, 0x3, 0x1c7}) 21:17:18 executing program 5: r0 = io_uring_setup(0x355e, &(0x7f0000000000)={0x0, 0x7682, 0x20, 0x1, 0x1be}) r1 = syz_io_uring_setup(0x8fe, &(0x7f0000000080)={0x0, 0x1830, 0x0, 0x0, 0x1b8, 0x0, r0}, &(0x7f0000ffb000/0x2000)=nil, &(0x7f0000ffb000/0x4000)=nil, &(0x7f0000000100), &(0x7f0000000140)=0x0) r3 = openat$hwrng(0xffffffffffffff9c, &(0x7f0000000180), 0x2, 0x0) r4 = syz_io_uring_setup(0x65dd, &(0x7f00000001c0)={0x0, 0xf46f, 0x20, 0x2, 0xdf}, &(0x7f0000ffe000/0x1000)=nil, &(0x7f0000ffd000/0x1000)=nil, &(0x7f0000000240), &(0x7f0000000280)) syz_genetlink_get_family_id$mptcp(&(0x7f0000000300), r3) r5 = openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000500)='./cgroup/syz1\x00', 0x200002, 0x0) syz_io_uring_submit(0x0, r2, &(0x7f0000000580)=@IORING_OP_FILES_UPDATE={0x14, 0x4, 0x0, 0x0, 0x40, &(0x7f0000000540)=[r4, 0xffffffffffffffff, r5, r0, r1], 0x5}, 0x3) socket$inet6_tcp(0xa, 0x1, 0x0) openat$procfs(0xffffffffffffff9c, &(0x7f00000010c0)='/proc/crypto\x00', 0x0, 0x0) 21:17:27 executing program 6: r0 = io_uring_setup(0x355e, &(0x7f0000000000)={0x0, 0x7682, 0x20, 0x1, 0x1be}) r1 = openat$hwrng(0xffffffffffffff9c, &(0x7f0000000180), 0x2, 0x0) r2 = syz_genetlink_get_family_id$mptcp(&(0x7f0000000300), r1) sendmsg$MPTCP_PM_CMD_ADD_ADDR(r1, &(0x7f00000003c0)={&(0x7f00000002c0)={0x10, 0x0, 0x0, 0x10}, 0xc, &(0x7f0000000380)={&(0x7f0000000340)={0x24, r2, 0x300, 0x70bd26, 0x25dfdbfb, {}, [@MPTCP_PM_ATTR_SUBFLOWS={0x8, 0x3, 0x1}, @MPTCP_PM_ATTR_RCV_ADD_ADDRS={0x8, 0x2, 0x2}]}, 0x24}, 0x1, 0x0, 0x0, 0x20000004}, 0x8890) syz_io_uring_setup(0x20f8, &(0x7f0000000400)={0x0, 0x7677, 0x8, 0x3, 0x22f}, &(0x7f0000ffe000/0x2000)=nil, &(0x7f0000ffb000/0x2000)=nil, &(0x7f0000000480)=0x0, &(0x7f00000004c0)) r4 = openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000500)='./cgroup/syz1\x00', 0x200002, 0x0) syz_io_uring_submit(r3, 0x0, &(0x7f0000000580)=@IORING_OP_FILES_UPDATE={0x14, 0x4, 0x0, 0x0, 0x40, &(0x7f0000000540)=[0xffffffffffffffff, 0xffffffffffffffff, r4, r0, 0xffffffffffffffff], 0x5}, 0x3) socket$inet6_tcp(0xa, 0x1, 0x0) openat$procfs(0xffffffffffffff9c, &(0x7f00000010c0)='/proc/crypto\x00', 0x0, 0x0) io_uring_setup(0x7c8f, &(0x7f0000001140)={0x0, 0xc240, 0x10, 0x3, 0x1c7}) 21:17:27 executing program 1: r0 = io_uring_setup(0x355e, 0x0) r1 = openat$hwrng(0xffffffffffffff9c, &(0x7f0000000180), 0x2, 0x0) r2 = syz_io_uring_setup(0x65dd, &(0x7f00000001c0)={0x0, 0xf46f, 0x20, 0x2, 0xdf}, &(0x7f0000ffe000/0x1000)=nil, &(0x7f0000ffd000/0x1000)=nil, &(0x7f0000000240), &(0x7f0000000280)) syz_genetlink_get_family_id$mptcp(&(0x7f0000000300), r1) syz_io_uring_setup(0x20f8, &(0x7f0000000400)={0x0, 0x7677, 0x8, 0x3, 0x22f, 0x0, r2}, &(0x7f0000ffe000/0x2000)=nil, &(0x7f0000ffb000/0x2000)=nil, &(0x7f0000000480)=0x0, &(0x7f00000004c0)) r4 = openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000500)='./cgroup/syz1\x00', 0x200002, 0x0) syz_io_uring_submit(r3, 0x0, &(0x7f0000000580)=@IORING_OP_FILES_UPDATE={0x14, 0x4, 0x0, 0x0, 0x40, &(0x7f0000000540)=[r2, 0xffffffffffffffff, r4, r0, 0xffffffffffffffff], 0x5}, 0x3) io_uring_setup(0x2812, &(0x7f00000005c0)={0x0, 0x5e1b, 0x2, 0x3, 0x12f, 0x0, r2}) socket$inet6_tcp(0xa, 0x1, 0x0) openat$procfs(0xffffffffffffff9c, &(0x7f00000010c0)='/proc/crypto\x00', 0x0, 0x0) io_uring_setup(0x7c8f, &(0x7f0000001140)={0x0, 0xc240, 0x10, 0x3, 0x1c7, 0x0, r2}) 21:17:27 executing program 5: r0 = io_uring_setup(0x355e, &(0x7f0000000000)={0x0, 0x7682, 0x20, 0x1, 0x1be}) r1 = syz_io_uring_setup(0x8fe, &(0x7f0000000080)={0x0, 0x1830, 0x0, 0x0, 0x1b8, 0x0, r0}, &(0x7f0000ffb000/0x2000)=nil, &(0x7f0000ffb000/0x4000)=nil, &(0x7f0000000100), &(0x7f0000000140)=0x0) r3 = openat$hwrng(0xffffffffffffff9c, &(0x7f0000000180), 0x2, 0x0) r4 = syz_genetlink_get_family_id$mptcp(&(0x7f0000000300), r3) sendmsg$MPTCP_PM_CMD_ADD_ADDR(r3, &(0x7f00000003c0)={&(0x7f00000002c0)={0x10, 0x0, 0x0, 0x10}, 0xc, &(0x7f0000000380)={&(0x7f0000000340)={0x24, r4, 0x300, 0x70bd26, 0x25dfdbfb, {}, [@MPTCP_PM_ATTR_SUBFLOWS={0x8, 0x3, 0x1}, @MPTCP_PM_ATTR_RCV_ADD_ADDRS={0x8, 0x2, 0x2}]}, 0x24}, 0x1, 0x0, 0x0, 0x20000004}, 0x8890) r5 = openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000500)='./cgroup/syz1\x00', 0x200002, 0x0) syz_io_uring_submit(0x0, r2, &(0x7f0000000580)=@IORING_OP_FILES_UPDATE={0x14, 0x4, 0x0, 0x0, 0x40, &(0x7f0000000540)=[0xffffffffffffffff, 0xffffffffffffffff, r5, r0, r1], 0x5}, 0x3) socket$inet6_tcp(0xa, 0x1, 0x0) openat$procfs(0xffffffffffffff9c, &(0x7f00000010c0)='/proc/crypto\x00', 0x0, 0x0) 21:17:27 executing program 3: r0 = io_uring_setup(0x355e, &(0x7f0000000000)={0x0, 0x7682, 0x20, 0x1, 0x1be}) r1 = syz_io_uring_setup(0x8fe, &(0x7f0000000080)={0x0, 0x1830, 0x0, 0x0, 0x1b8, 0x0, r0}, &(0x7f0000ffb000/0x2000)=nil, &(0x7f0000ffb000/0x4000)=nil, &(0x7f0000000100), &(0x7f0000000140)=0x0) syz_genetlink_get_family_id$mptcp(&(0x7f0000000300), 0xffffffffffffffff) r3 = openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000500)='./cgroup/syz1\x00', 0x200002, 0x0) syz_io_uring_submit(0x0, r2, &(0x7f0000000580)=@IORING_OP_FILES_UPDATE={0x14, 0x4, 0x0, 0x0, 0x40, &(0x7f0000000540)=[0xffffffffffffffff, 0xffffffffffffffff, r3, r0, r1], 0x5}, 0x3) io_uring_setup(0x2812, &(0x7f00000005c0)={0x0, 0x5e1b, 0x2, 0x3, 0x12f}) socket$inet6_tcp(0xa, 0x1, 0x0) io_uring_setup(0x7c8f, &(0x7f0000001140)={0x0, 0xc240, 0x10, 0x3, 0x1c7}) 21:17:27 executing program 7: pipe2$9p(&(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}, 0x0) write$P9_RSYMLINK(r0, 0x0, 0x0) add_key$fscrypt_v1(0x0, &(0x7f00000002c0)={'fscrypt:', @desc2}, &(0x7f0000000300)={0x0, "ccf022eeb1aa5b4a9067674b5b7079352411c35248e190415959cbe4b7be99236abd831288583a8ed4db4b7b3f838c24d293f908bf3509b49f2c17852201f646", 0x19}, 0x48, 0xfffffffffffffffa) syz_genetlink_get_family_id$mptcp(&(0x7f00000004c0), 0xffffffffffffffff) openat$vcsa(0xffffffffffffff9c, &(0x7f00000009c0), 0x14200, 0x0) syz_genetlink_get_family_id$mptcp(&(0x7f0000000a80), 0xffffffffffffffff) 21:17:27 executing program 4: ioctl$SCSI_IOCTL_DOORUNLOCK(0xffffffffffffffff, 0x5381) ioctl$SG_GET_PACK_ID(0xffffffffffffffff, 0x227c, &(0x7f0000000040)) syz_genetlink_get_family_id$nl80211(&(0x7f00000000c0), 0xffffffffffffffff) syz_open_dev$vcsa(&(0x7f0000000440), 0x56, 0x4000) socketpair(0x0, 0x3, 0x6, &(0x7f0000000640)) r0 = openat$tcp_congestion(0xffffffffffffff9c, &(0x7f0000000800), 0x1, 0x0) write$tcp_congestion(r0, &(0x7f0000000840)='htcp\x00', 0x5) 21:17:27 executing program 2: syz_genetlink_get_family_id$nl80211(&(0x7f00000000c0), 0xffffffffffffffff) syz_open_dev$vcsa(&(0x7f0000000440), 0x56, 0x4000) socketpair(0x0, 0x0, 0x0, &(0x7f0000000640)) r0 = openat$tcp_congestion(0xffffffffffffff9c, &(0x7f0000000800), 0x1, 0x0) write$tcp_congestion(r0, &(0x7f0000000840)='htcp\x00', 0x5) 21:17:27 executing program 0: r0 = io_uring_setup(0x355e, &(0x7f0000000000)={0x0, 0x7682, 0x20, 0x1, 0x1be}) openat$hwrng(0xffffffffffffff9c, &(0x7f0000000180), 0x2, 0x0) r1 = openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000500)='./cgroup/syz1\x00', 0x200002, 0x0) syz_io_uring_submit(0x0, 0x0, &(0x7f0000000580)=@IORING_OP_FILES_UPDATE={0x14, 0x4, 0x0, 0x0, 0x40, &(0x7f0000000540)=[0xffffffffffffffff, 0xffffffffffffffff, r1, r0, 0xffffffffffffffff], 0x5}, 0x3) io_uring_setup(0x2812, &(0x7f00000005c0)={0x0, 0x5e1b, 0x2, 0x3, 0x12f}) socket$inet6_tcp(0xa, 0x1, 0x0) 21:17:27 executing program 0: r0 = io_uring_setup(0x355e, &(0x7f0000000000)={0x0, 0x7682, 0x20, 0x1, 0x1be}) openat$hwrng(0xffffffffffffff9c, &(0x7f0000000180), 0x2, 0x0) r1 = openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000500)='./cgroup/syz1\x00', 0x200002, 0x0) syz_io_uring_submit(0x0, 0x0, &(0x7f0000000580)=@IORING_OP_FILES_UPDATE={0x14, 0x4, 0x0, 0x0, 0x40, &(0x7f0000000540)=[0xffffffffffffffff, 0xffffffffffffffff, r1, r0, 0xffffffffffffffff], 0x5}, 0x3) io_uring_setup(0x2812, &(0x7f00000005c0)={0x0, 0x5e1b, 0x2, 0x3, 0x12f}) socket$inet6_tcp(0xa, 0x1, 0x0) [ 377.449496] kmemleak: Found object by alias at 0x607f1a6398ac [ 377.449521] CPU: 1 UID: 0 PID: 5673 Comm: syz-executor.3 Tainted: G W 6.17.0-rc3-next-20250829 #1 PREEMPT(voluntary) [ 377.449539] Tainted: [W]=WARN [ 377.449542] Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.12.0-1 04/01/2014 [ 377.449550] Call Trace: [ 377.449554] [ 377.449558] dump_stack_lvl+0xca/0x120 [ 377.449583] __lookup_object+0x94/0xb0 [ 377.449600] delete_object_full+0x27/0x70 [ 377.449616] free_percpu+0x30/0x1160 [ 377.449632] ? arch_uprobe_clear_state+0x16/0x140 [ 377.449652] futex_hash_free+0x38/0xc0 [ 377.449667] mmput+0x2d3/0x390 [ 377.449689] do_exit+0x79d/0x2970 [ 377.449703] ? signal_wake_up_state+0x85/0x120 [ 377.449718] ? zap_other_threads+0x2b9/0x3a0 [ 377.449733] ? __pfx_do_exit+0x10/0x10 [ 377.449746] ? do_group_exit+0x1c3/0x2a0 [ 377.449759] ? lock_release+0xc8/0x290 [ 377.449775] do_group_exit+0xd3/0x2a0 [ 377.449790] __x64_sys_exit_group+0x3e/0x50 [ 377.449803] x64_sys_call+0x18c5/0x18d0 [ 377.449818] do_syscall_64+0xbf/0x360 [ 377.449830] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 377.449841] RIP: 0033:0x7f1060a76b19 [ 377.449849] Code: Unable to access opcode bytes at 0x7f1060a76aef. [ 377.449854] RSP: 002b:00007ffed3f8b6d8 EFLAGS: 00000246 ORIG_RAX: 00000000000000e7 [ 377.449866] RAX: ffffffffffffffda RBX: 000000000000001e RCX: 00007f1060a76b19 [ 377.449873] RDX: 00007f1060a2972b RSI: ffffffffffffffbc RDI: 0000000000000000 [ 377.449880] RBP: 0000000000000000 R08: 0000001b2da25bc0 R09: 0000000000000000 [ 377.449887] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 377.449893] R13: 0000000000000000 R14: 0000000000000001 R15: 00007ffed3f8b7c0 [ 377.449908] [ 377.449912] kmemleak: Object (percpu) 0x607f1a6398a8 (size 8): [ 377.449918] kmemleak: comm "syz-executor.1", pid 5702, jiffies 4295044267 [ 377.449925] kmemleak: min_count = 1 [ 377.449929] kmemleak: count = 0 [ 377.449932] kmemleak: flags = 0x21 [ 377.449936] kmemleak: checksum = 0 [ 377.449939] kmemleak: backtrace: [ 377.449943] pcpu_alloc_noprof+0x87a/0x1170 [ 377.449957] percpu_ref_init+0x37/0x400 [ 377.449975] io_uring_setup+0x44c/0x2000 [ 377.449986] __x64_sys_io_uring_setup+0xc8/0x170 [ 377.449997] do_syscall_64+0xbf/0x360 [ 377.450005] entry_SYSCALL_64_after_hwframe+0x77/0x7f 21:17:27 executing program 3: r0 = io_uring_setup(0x355e, &(0x7f0000000000)={0x0, 0x7682, 0x20, 0x1, 0x1be}) r1 = syz_io_uring_setup(0x8fe, &(0x7f0000000080)={0x0, 0x1830, 0x0, 0x0, 0x1b8, 0x0, r0}, &(0x7f0000ffb000/0x2000)=nil, &(0x7f0000ffb000/0x4000)=nil, &(0x7f0000000100), &(0x7f0000000140)=0x0) syz_genetlink_get_family_id$mptcp(&(0x7f0000000300), 0xffffffffffffffff) r3 = openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000500)='./cgroup/syz1\x00', 0x200002, 0x0) syz_io_uring_submit(0x0, r2, &(0x7f0000000580)=@IORING_OP_FILES_UPDATE={0x14, 0x4, 0x0, 0x0, 0x40, &(0x7f0000000540)=[0xffffffffffffffff, 0xffffffffffffffff, r3, r0, r1], 0x5}, 0x3) io_uring_setup(0x2812, &(0x7f00000005c0)={0x0, 0x5e1b, 0x2, 0x3, 0x12f}) socket$inet6_tcp(0xa, 0x1, 0x0) io_uring_setup(0x7c8f, &(0x7f0000001140)={0x0, 0xc240, 0x10, 0x3, 0x1c7}) 21:17:28 executing program 1: r0 = io_uring_setup(0x355e, 0x0) r1 = openat$hwrng(0xffffffffffffff9c, &(0x7f0000000180), 0x2, 0x0) r2 = syz_io_uring_setup(0x65dd, &(0x7f00000001c0)={0x0, 0xf46f, 0x20, 0x2, 0xdf}, &(0x7f0000ffe000/0x1000)=nil, &(0x7f0000ffd000/0x1000)=nil, &(0x7f0000000240), &(0x7f0000000280)) syz_genetlink_get_family_id$mptcp(&(0x7f0000000300), r1) syz_io_uring_setup(0x20f8, &(0x7f0000000400)={0x0, 0x7677, 0x8, 0x3, 0x22f, 0x0, r2}, &(0x7f0000ffe000/0x2000)=nil, &(0x7f0000ffb000/0x2000)=nil, &(0x7f0000000480)=0x0, &(0x7f00000004c0)) r4 = openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000500)='./cgroup/syz1\x00', 0x200002, 0x0) syz_io_uring_submit(r3, 0x0, &(0x7f0000000580)=@IORING_OP_FILES_UPDATE={0x14, 0x4, 0x0, 0x0, 0x40, &(0x7f0000000540)=[r2, 0xffffffffffffffff, r4, r0, 0xffffffffffffffff], 0x5}, 0x3) io_uring_setup(0x2812, &(0x7f00000005c0)={0x0, 0x5e1b, 0x2, 0x3, 0x12f, 0x0, r2}) socket$inet6_tcp(0xa, 0x1, 0x0) openat$procfs(0xffffffffffffff9c, &(0x7f00000010c0)='/proc/crypto\x00', 0x0, 0x0) io_uring_setup(0x7c8f, &(0x7f0000001140)={0x0, 0xc240, 0x10, 0x3, 0x1c7, 0x0, r2}) 21:17:28 executing program 0: r0 = syz_io_uring_setup(0x8fe, &(0x7f0000000080)={0x0, 0x1830, 0x0, 0x0, 0x1b8}, &(0x7f0000ffb000/0x2000)=nil, &(0x7f0000ffb000/0x4000)=nil, &(0x7f0000000100), &(0x7f0000000140)=0x0) openat$hwrng(0xffffffffffffff9c, &(0x7f0000000180), 0x2, 0x0) r2 = openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000500)='./cgroup/syz1\x00', 0x200002, 0x0) syz_io_uring_submit(0x0, r1, &(0x7f0000000580)=@IORING_OP_FILES_UPDATE={0x14, 0x4, 0x0, 0x0, 0x40, &(0x7f0000000540)=[0xffffffffffffffff, 0xffffffffffffffff, r2, 0xffffffffffffffff, r0], 0x5}, 0x3) io_uring_setup(0x2812, &(0x7f00000005c0)={0x0, 0x5e1b, 0x2, 0x3, 0x12f}) socket$inet6_tcp(0xa, 0x1, 0x0) 21:17:28 executing program 6: r0 = io_uring_setup(0x355e, &(0x7f0000000000)={0x0, 0x7682, 0x20, 0x1, 0x1be}) r1 = openat$hwrng(0xffffffffffffff9c, &(0x7f0000000180), 0x2, 0x0) r2 = syz_genetlink_get_family_id$mptcp(&(0x7f0000000300), r1) sendmsg$MPTCP_PM_CMD_ADD_ADDR(r1, &(0x7f00000003c0)={&(0x7f00000002c0)={0x10, 0x0, 0x0, 0x10}, 0xc, &(0x7f0000000380)={&(0x7f0000000340)={0x24, r2, 0x300, 0x70bd26, 0x25dfdbfb, {}, [@MPTCP_PM_ATTR_SUBFLOWS={0x8, 0x3, 0x1}, @MPTCP_PM_ATTR_RCV_ADD_ADDRS={0x8, 0x2, 0x2}]}, 0x24}, 0x1, 0x0, 0x0, 0x20000004}, 0x8890) syz_io_uring_setup(0x20f8, &(0x7f0000000400)={0x0, 0x7677, 0x8, 0x3, 0x22f}, &(0x7f0000ffe000/0x2000)=nil, &(0x7f0000ffb000/0x2000)=nil, &(0x7f0000000480)=0x0, &(0x7f00000004c0)) r4 = openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000500)='./cgroup/syz1\x00', 0x200002, 0x0) syz_io_uring_submit(r3, 0x0, &(0x7f0000000580)=@IORING_OP_FILES_UPDATE={0x14, 0x4, 0x0, 0x0, 0x40, &(0x7f0000000540)=[0xffffffffffffffff, 0xffffffffffffffff, r4, r0, 0xffffffffffffffff], 0x5}, 0x3) socket$inet6_tcp(0xa, 0x1, 0x0) openat$procfs(0xffffffffffffff9c, &(0x7f00000010c0)='/proc/crypto\x00', 0x0, 0x0) io_uring_setup(0x7c8f, &(0x7f0000001140)={0x0, 0xc240, 0x10, 0x3, 0x1c7}) 21:17:28 executing program 4: ioctl$SCSI_IOCTL_DOORUNLOCK(0xffffffffffffffff, 0x5381) ioctl$SG_GET_PACK_ID(0xffffffffffffffff, 0x227c, &(0x7f0000000040)) syz_genetlink_get_family_id$nl80211(&(0x7f00000000c0), 0xffffffffffffffff) syz_open_dev$vcsa(&(0x7f0000000440), 0x56, 0x4000) socketpair(0x0, 0x3, 0x6, &(0x7f0000000640)) r0 = openat$tcp_congestion(0xffffffffffffff9c, &(0x7f0000000800), 0x1, 0x0) write$tcp_congestion(r0, &(0x7f0000000840)='htcp\x00', 0x5) 21:17:28 executing program 7: pipe2$9p(&(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}, 0x0) write$P9_RSYMLINK(r0, 0x0, 0x0) add_key$fscrypt_v1(0x0, &(0x7f00000002c0)={'fscrypt:', @desc2}, &(0x7f0000000300)={0x0, "ccf022eeb1aa5b4a9067674b5b7079352411c35248e190415959cbe4b7be99236abd831288583a8ed4db4b7b3f838c24d293f908bf3509b49f2c17852201f646", 0x19}, 0x48, 0xfffffffffffffffa) syz_genetlink_get_family_id$mptcp(&(0x7f00000004c0), 0xffffffffffffffff) openat$vcsa(0xffffffffffffff9c, &(0x7f00000009c0), 0x14200, 0x0) syz_genetlink_get_family_id$mptcp(&(0x7f0000000a80), 0xffffffffffffffff) 21:17:28 executing program 5: r0 = io_uring_setup(0x355e, &(0x7f0000000000)={0x0, 0x7682, 0x20, 0x1, 0x1be}) r1 = syz_io_uring_setup(0x8fe, &(0x7f0000000080)={0x0, 0x1830, 0x0, 0x0, 0x1b8, 0x0, r0}, &(0x7f0000ffb000/0x2000)=nil, &(0x7f0000ffb000/0x4000)=nil, &(0x7f0000000100), &(0x7f0000000140)=0x0) r3 = openat$hwrng(0xffffffffffffff9c, &(0x7f0000000180), 0x2, 0x0) r4 = syz_genetlink_get_family_id$mptcp(&(0x7f0000000300), r3) sendmsg$MPTCP_PM_CMD_ADD_ADDR(r3, &(0x7f00000003c0)={&(0x7f00000002c0)={0x10, 0x0, 0x0, 0x10}, 0xc, &(0x7f0000000380)={&(0x7f0000000340)={0x24, r4, 0x300, 0x70bd26, 0x25dfdbfb, {}, [@MPTCP_PM_ATTR_SUBFLOWS={0x8, 0x3, 0x1}, @MPTCP_PM_ATTR_RCV_ADD_ADDRS={0x8, 0x2, 0x2}]}, 0x24}, 0x1, 0x0, 0x0, 0x20000004}, 0x8890) r5 = openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000500)='./cgroup/syz1\x00', 0x200002, 0x0) syz_io_uring_submit(0x0, r2, &(0x7f0000000580)=@IORING_OP_FILES_UPDATE={0x14, 0x4, 0x0, 0x0, 0x40, &(0x7f0000000540)=[0xffffffffffffffff, 0xffffffffffffffff, r5, r0, r1], 0x5}, 0x3) socket$inet6_tcp(0xa, 0x1, 0x0) openat$procfs(0xffffffffffffff9c, &(0x7f00000010c0)='/proc/crypto\x00', 0x0, 0x0) 21:17:36 executing program 0: r0 = syz_io_uring_setup(0x0, &(0x7f0000000080)={0x0, 0x1830, 0x0, 0x0, 0x1b8}, &(0x7f0000ffb000/0x2000)=nil, &(0x7f0000ffb000/0x4000)=nil, &(0x7f0000000100), &(0x7f0000000140)=0x0) openat$hwrng(0xffffffffffffff9c, &(0x7f0000000180), 0x2, 0x0) r2 = openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000500)='./cgroup/syz1\x00', 0x200002, 0x0) syz_io_uring_submit(0x0, r1, &(0x7f0000000580)=@IORING_OP_FILES_UPDATE={0x14, 0x4, 0x0, 0x0, 0x40, &(0x7f0000000540)=[0xffffffffffffffff, 0xffffffffffffffff, r2, 0xffffffffffffffff, r0], 0x5}, 0x3) io_uring_setup(0x2812, &(0x7f00000005c0)={0x0, 0x5e1b, 0x2, 0x3, 0x12f}) socket$inet6_tcp(0xa, 0x1, 0x0) 21:17:36 executing program 5: r0 = io_uring_setup(0x355e, &(0x7f0000000000)={0x0, 0x7682, 0x20, 0x1, 0x1be}) r1 = syz_io_uring_setup(0x8fe, &(0x7f0000000080)={0x0, 0x1830, 0x0, 0x0, 0x1b8, 0x0, r0}, &(0x7f0000ffb000/0x2000)=nil, &(0x7f0000ffb000/0x4000)=nil, &(0x7f0000000100), &(0x7f0000000140)=0x0) r3 = openat$hwrng(0xffffffffffffff9c, &(0x7f0000000180), 0x2, 0x0) r4 = syz_genetlink_get_family_id$mptcp(&(0x7f0000000300), r3) sendmsg$MPTCP_PM_CMD_ADD_ADDR(r3, &(0x7f00000003c0)={&(0x7f00000002c0)={0x10, 0x0, 0x0, 0x10}, 0xc, &(0x7f0000000380)={&(0x7f0000000340)={0x24, r4, 0x300, 0x70bd26, 0x25dfdbfb, {}, [@MPTCP_PM_ATTR_SUBFLOWS={0x8, 0x3, 0x1}, @MPTCP_PM_ATTR_RCV_ADD_ADDRS={0x8, 0x2, 0x2}]}, 0x24}, 0x1, 0x0, 0x0, 0x20000004}, 0x8890) r5 = openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000500)='./cgroup/syz1\x00', 0x200002, 0x0) syz_io_uring_submit(0x0, r2, &(0x7f0000000580)=@IORING_OP_FILES_UPDATE={0x14, 0x4, 0x0, 0x0, 0x40, &(0x7f0000000540)=[0xffffffffffffffff, 0xffffffffffffffff, r5, r0, r1], 0x5}, 0x3) socket$inet6_tcp(0xa, 0x1, 0x0) openat$procfs(0xffffffffffffff9c, &(0x7f00000010c0)='/proc/crypto\x00', 0x0, 0x0) 21:17:36 executing program 1: r0 = io_uring_setup(0x355e, 0x0) r1 = openat$hwrng(0xffffffffffffff9c, &(0x7f0000000180), 0x2, 0x0) r2 = syz_io_uring_setup(0x65dd, &(0x7f00000001c0)={0x0, 0xf46f, 0x20, 0x2, 0xdf}, &(0x7f0000ffe000/0x1000)=nil, &(0x7f0000ffd000/0x1000)=nil, &(0x7f0000000240), &(0x7f0000000280)) syz_genetlink_get_family_id$mptcp(&(0x7f0000000300), r1) syz_io_uring_setup(0x20f8, &(0x7f0000000400)={0x0, 0x7677, 0x8, 0x3, 0x22f, 0x0, r2}, &(0x7f0000ffe000/0x2000)=nil, &(0x7f0000ffb000/0x2000)=nil, &(0x7f0000000480)=0x0, &(0x7f00000004c0)) r4 = openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000500)='./cgroup/syz1\x00', 0x200002, 0x0) syz_io_uring_submit(r3, 0x0, &(0x7f0000000580)=@IORING_OP_FILES_UPDATE={0x14, 0x4, 0x0, 0x0, 0x40, &(0x7f0000000540)=[r2, 0xffffffffffffffff, r4, r0, 0xffffffffffffffff], 0x5}, 0x3) io_uring_setup(0x2812, &(0x7f00000005c0)={0x0, 0x5e1b, 0x2, 0x3, 0x12f, 0x0, r2}) socket$inet6_tcp(0xa, 0x1, 0x0) openat$procfs(0xffffffffffffff9c, &(0x7f00000010c0)='/proc/crypto\x00', 0x0, 0x0) io_uring_setup(0x7c8f, &(0x7f0000001140)={0x0, 0xc240, 0x10, 0x3, 0x1c7, 0x0, r2}) 21:17:36 executing program 6: r0 = syz_io_uring_setup(0x8fe, &(0x7f0000000080)={0x0, 0x1830, 0x0, 0x0, 0x1b8}, &(0x7f0000ffb000/0x2000)=nil, &(0x7f0000ffb000/0x4000)=nil, &(0x7f0000000100), &(0x7f0000000140)=0x0) r2 = openat$hwrng(0xffffffffffffff9c, &(0x7f0000000180), 0x2, 0x0) r3 = syz_genetlink_get_family_id$mptcp(&(0x7f0000000300), r2) sendmsg$MPTCP_PM_CMD_ADD_ADDR(r2, &(0x7f00000003c0)={&(0x7f00000002c0)={0x10, 0x0, 0x0, 0x10}, 0xc, &(0x7f0000000380)={&(0x7f0000000340)={0x24, r3, 0x300, 0x70bd26, 0x25dfdbfb, {}, [@MPTCP_PM_ATTR_SUBFLOWS={0x8, 0x3, 0x1}, @MPTCP_PM_ATTR_RCV_ADD_ADDRS={0x8, 0x2, 0x2}]}, 0x24}, 0x1, 0x0, 0x0, 0x20000004}, 0x8890) syz_io_uring_setup(0x20f8, &(0x7f0000000400)={0x0, 0x7677, 0x8, 0x3, 0x22f}, &(0x7f0000ffe000/0x2000)=nil, &(0x7f0000ffb000/0x2000)=nil, &(0x7f0000000480)=0x0, &(0x7f00000004c0)) r5 = openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000500)='./cgroup/syz1\x00', 0x200002, 0x0) syz_io_uring_submit(r4, r1, &(0x7f0000000580)=@IORING_OP_FILES_UPDATE={0x14, 0x4, 0x0, 0x0, 0x40, &(0x7f0000000540)=[0xffffffffffffffff, 0xffffffffffffffff, r5, 0xffffffffffffffff, r0], 0x5}, 0x3) socket$inet6_tcp(0xa, 0x1, 0x0) openat$procfs(0xffffffffffffff9c, &(0x7f00000010c0)='/proc/crypto\x00', 0x0, 0x0) io_uring_setup(0x7c8f, &(0x7f0000001140)={0x0, 0xc240, 0x10, 0x3, 0x1c7}) 21:17:36 executing program 2: syz_genetlink_get_family_id$nl80211(&(0x7f00000000c0), 0xffffffffffffffff) syz_open_dev$vcsa(&(0x7f0000000440), 0x56, 0x4000) socketpair(0x0, 0x0, 0x0, 0x0) r0 = openat$tcp_congestion(0xffffffffffffff9c, &(0x7f0000000800), 0x1, 0x0) write$tcp_congestion(r0, &(0x7f0000000840)='htcp\x00', 0x5) 21:17:36 executing program 3: r0 = io_uring_setup(0x355e, &(0x7f0000000000)={0x0, 0x7682, 0x20, 0x1, 0x1be}) r1 = syz_io_uring_setup(0x8fe, &(0x7f0000000080)={0x0, 0x1830, 0x0, 0x0, 0x1b8, 0x0, r0}, &(0x7f0000ffb000/0x2000)=nil, &(0x7f0000ffb000/0x4000)=nil, &(0x7f0000000100), &(0x7f0000000140)=0x0) syz_genetlink_get_family_id$mptcp(&(0x7f0000000300), 0xffffffffffffffff) r3 = openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000500)='./cgroup/syz1\x00', 0x200002, 0x0) syz_io_uring_submit(0x0, r2, &(0x7f0000000580)=@IORING_OP_FILES_UPDATE={0x14, 0x4, 0x0, 0x0, 0x40, &(0x7f0000000540)=[0xffffffffffffffff, 0xffffffffffffffff, r3, r0, r1], 0x5}, 0x3) io_uring_setup(0x2812, &(0x7f00000005c0)={0x0, 0x5e1b, 0x2, 0x3, 0x12f}) socket$inet6_tcp(0xa, 0x1, 0x0) io_uring_setup(0x7c8f, &(0x7f0000001140)={0x0, 0xc240, 0x10, 0x3, 0x1c7}) 21:17:36 executing program 4: ioctl$SCSI_IOCTL_DOORUNLOCK(0xffffffffffffffff, 0x5381) ioctl$SG_GET_PACK_ID(0xffffffffffffffff, 0x227c, &(0x7f0000000040)) syz_genetlink_get_family_id$nl80211(&(0x7f00000000c0), 0xffffffffffffffff) syz_open_dev$vcsa(&(0x7f0000000440), 0x56, 0x4000) socketpair(0x0, 0x3, 0x6, &(0x7f0000000640)) r0 = openat$tcp_congestion(0xffffffffffffff9c, &(0x7f0000000800), 0x1, 0x0) write$tcp_congestion(r0, &(0x7f0000000840)='htcp\x00', 0x5) 21:17:36 executing program 7: pipe2$9p(&(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}, 0x0) write$P9_RSYMLINK(r0, 0x0, 0x0) add_key$fscrypt_v1(&(0x7f0000000280), 0x0, &(0x7f0000000300)={0x0, "ccf022eeb1aa5b4a9067674b5b7079352411c35248e190415959cbe4b7be99236abd831288583a8ed4db4b7b3f838c24d293f908bf3509b49f2c17852201f646", 0x19}, 0x48, 0xfffffffffffffffa) syz_genetlink_get_family_id$mptcp(&(0x7f00000004c0), 0xffffffffffffffff) openat$vcsa(0xffffffffffffff9c, &(0x7f00000009c0), 0x14200, 0x0) syz_genetlink_get_family_id$mptcp(&(0x7f0000000a80), 0xffffffffffffffff) 21:17:37 executing program 2: syz_genetlink_get_family_id$nl80211(&(0x7f00000000c0), 0xffffffffffffffff) syz_open_dev$vcsa(&(0x7f0000000440), 0x56, 0x4000) socketpair(0x0, 0x0, 0x0, 0x0) r0 = openat$tcp_congestion(0xffffffffffffff9c, &(0x7f0000000800), 0x1, 0x0) write$tcp_congestion(r0, &(0x7f0000000840)='htcp\x00', 0x5) 21:17:37 executing program 0: r0 = syz_io_uring_setup(0x0, &(0x7f0000000080)={0x0, 0x1830, 0x0, 0x0, 0x1b8}, &(0x7f0000ffb000/0x2000)=nil, &(0x7f0000ffb000/0x4000)=nil, &(0x7f0000000100), &(0x7f0000000140)=0x0) openat$hwrng(0xffffffffffffff9c, &(0x7f0000000180), 0x2, 0x0) r2 = openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000500)='./cgroup/syz1\x00', 0x200002, 0x0) syz_io_uring_submit(0x0, r1, &(0x7f0000000580)=@IORING_OP_FILES_UPDATE={0x14, 0x4, 0x0, 0x0, 0x40, &(0x7f0000000540)=[0xffffffffffffffff, 0xffffffffffffffff, r2, 0xffffffffffffffff, r0], 0x5}, 0x3) io_uring_setup(0x2812, &(0x7f00000005c0)={0x0, 0x5e1b, 0x2, 0x3, 0x12f}) socket$inet6_tcp(0xa, 0x1, 0x0) 21:17:37 executing program 5: r0 = io_uring_setup(0x355e, &(0x7f0000000000)={0x0, 0x7682, 0x20, 0x1, 0x1be}) r1 = syz_io_uring_setup(0x8fe, &(0x7f0000000080)={0x0, 0x1830, 0x0, 0x0, 0x1b8, 0x0, r0}, &(0x7f0000ffb000/0x2000)=nil, &(0x7f0000ffb000/0x4000)=nil, &(0x7f0000000100), &(0x7f0000000140)=0x0) r3 = syz_io_uring_setup(0x65dd, &(0x7f00000001c0)={0x0, 0xf46f, 0x20, 0x2, 0xdf}, &(0x7f0000ffe000/0x1000)=nil, &(0x7f0000ffd000/0x1000)=nil, &(0x7f0000000240), &(0x7f0000000280)) r4 = syz_genetlink_get_family_id$mptcp(&(0x7f0000000300), 0xffffffffffffffff) sendmsg$MPTCP_PM_CMD_ADD_ADDR(0xffffffffffffffff, &(0x7f00000003c0)={&(0x7f00000002c0)={0x10, 0x0, 0x0, 0x10}, 0xc, &(0x7f0000000380)={&(0x7f0000000340)={0x24, r4, 0x300, 0x70bd26, 0x25dfdbfb, {}, [@MPTCP_PM_ATTR_SUBFLOWS={0x8, 0x3, 0x1}, @MPTCP_PM_ATTR_RCV_ADD_ADDRS={0x8, 0x2, 0x2}]}, 0x24}, 0x1, 0x0, 0x0, 0x20000004}, 0x8890) r5 = openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000500)='./cgroup/syz1\x00', 0x200002, 0x0) syz_io_uring_submit(0x0, r2, &(0x7f0000000580)=@IORING_OP_FILES_UPDATE={0x14, 0x4, 0x0, 0x0, 0x40, &(0x7f0000000540)=[r3, 0xffffffffffffffff, r5, r0, r1], 0x5}, 0x3) socket$inet6_tcp(0xa, 0x1, 0x0) openat$procfs(0xffffffffffffff9c, &(0x7f00000010c0)='/proc/crypto\x00', 0x0, 0x0) 21:17:37 executing program 3: r0 = io_uring_setup(0x355e, &(0x7f0000000000)={0x0, 0x7682, 0x20, 0x1, 0x1be}) r1 = openat$hwrng(0xffffffffffffff9c, &(0x7f0000000180), 0x2, 0x0) syz_genetlink_get_family_id$mptcp(&(0x7f0000000300), r1) r2 = openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000500)='./cgroup/syz1\x00', 0x200002, 0x0) syz_io_uring_submit(0x0, 0x0, &(0x7f0000000580)=@IORING_OP_FILES_UPDATE={0x14, 0x4, 0x0, 0x0, 0x40, &(0x7f0000000540)=[0xffffffffffffffff, 0xffffffffffffffff, r2, r0, 0xffffffffffffffff], 0x5}, 0x3) io_uring_setup(0x2812, &(0x7f00000005c0)={0x0, 0x5e1b, 0x2, 0x3, 0x12f}) socket$inet6_tcp(0xa, 0x1, 0x0) io_uring_setup(0x7c8f, &(0x7f0000001140)={0x0, 0xc240, 0x10, 0x3, 0x1c7}) 21:17:37 executing program 1: r0 = io_uring_setup(0x355e, &(0x7f0000000000)={0x0, 0x0, 0x20, 0x1, 0x1be}) r1 = openat$hwrng(0xffffffffffffff9c, &(0x7f0000000180), 0x2, 0x0) r2 = syz_io_uring_setup(0x65dd, &(0x7f00000001c0)={0x0, 0xf46f, 0x20, 0x2, 0xdf}, &(0x7f0000ffe000/0x1000)=nil, &(0x7f0000ffd000/0x1000)=nil, &(0x7f0000000240), &(0x7f0000000280)) syz_genetlink_get_family_id$mptcp(&(0x7f0000000300), r1) syz_io_uring_setup(0x20f8, &(0x7f0000000400)={0x0, 0x7677, 0x8, 0x3, 0x22f, 0x0, r2}, &(0x7f0000ffe000/0x2000)=nil, &(0x7f0000ffb000/0x2000)=nil, &(0x7f0000000480)=0x0, &(0x7f00000004c0)) r4 = openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000500)='./cgroup/syz1\x00', 0x200002, 0x0) syz_io_uring_submit(r3, 0x0, &(0x7f0000000580)=@IORING_OP_FILES_UPDATE={0x14, 0x4, 0x0, 0x0, 0x40, &(0x7f0000000540)=[r2, 0xffffffffffffffff, r4, r0, 0xffffffffffffffff], 0x5}, 0x3) io_uring_setup(0x2812, &(0x7f00000005c0)={0x0, 0x5e1b, 0x2, 0x3, 0x12f, 0x0, r2}) socket$inet6_tcp(0xa, 0x1, 0x0) openat$procfs(0xffffffffffffff9c, &(0x7f00000010c0)='/proc/crypto\x00', 0x0, 0x0) io_uring_setup(0x7c8f, &(0x7f0000001140)={0x0, 0xc240, 0x10, 0x3, 0x1c7, 0x0, r2}) 21:17:37 executing program 7: pipe2$9p(&(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}, 0x0) write$P9_RSYMLINK(r0, 0x0, 0x0) add_key$fscrypt_v1(&(0x7f0000000280), 0x0, &(0x7f0000000300)={0x0, "ccf022eeb1aa5b4a9067674b5b7079352411c35248e190415959cbe4b7be99236abd831288583a8ed4db4b7b3f838c24d293f908bf3509b49f2c17852201f646", 0x19}, 0x48, 0xfffffffffffffffa) syz_genetlink_get_family_id$mptcp(&(0x7f00000004c0), 0xffffffffffffffff) openat$vcsa(0xffffffffffffff9c, &(0x7f00000009c0), 0x14200, 0x0) syz_genetlink_get_family_id$mptcp(&(0x7f0000000a80), 0xffffffffffffffff) 21:17:37 executing program 4: r0 = syz_open_dev$mouse(&(0x7f0000000000), 0x578, 0x4000) ioctl$SG_GET_PACK_ID(r0, 0x227c, &(0x7f0000000040)) syz_genetlink_get_family_id$nl80211(&(0x7f00000000c0), r0) syz_open_dev$vcsa(&(0x7f0000000440), 0x56, 0x4000) socketpair(0x0, 0x3, 0x6, &(0x7f0000000640)) r1 = openat$tcp_congestion(0xffffffffffffff9c, &(0x7f0000000800), 0x1, 0x0) write$tcp_congestion(r1, &(0x7f0000000840)='htcp\x00', 0x5) 21:17:37 executing program 6: r0 = syz_io_uring_setup(0x8fe, &(0x7f0000000080)={0x0, 0x1830, 0x0, 0x0, 0x1b8}, &(0x7f0000ffb000/0x2000)=nil, &(0x7f0000ffb000/0x4000)=nil, &(0x7f0000000100), &(0x7f0000000140)=0x0) r2 = openat$hwrng(0xffffffffffffff9c, &(0x7f0000000180), 0x2, 0x0) r3 = syz_genetlink_get_family_id$mptcp(&(0x7f0000000300), r2) sendmsg$MPTCP_PM_CMD_ADD_ADDR(r2, &(0x7f00000003c0)={&(0x7f00000002c0)={0x10, 0x0, 0x0, 0x10}, 0xc, &(0x7f0000000380)={&(0x7f0000000340)={0x24, r3, 0x300, 0x70bd26, 0x25dfdbfb, {}, [@MPTCP_PM_ATTR_SUBFLOWS={0x8, 0x3, 0x1}, @MPTCP_PM_ATTR_RCV_ADD_ADDRS={0x8, 0x2, 0x2}]}, 0x24}, 0x1, 0x0, 0x0, 0x20000004}, 0x8890) syz_io_uring_setup(0x20f8, &(0x7f0000000400)={0x0, 0x7677, 0x8, 0x3, 0x22f}, &(0x7f0000ffe000/0x2000)=nil, &(0x7f0000ffb000/0x2000)=nil, &(0x7f0000000480)=0x0, &(0x7f00000004c0)) r5 = openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000500)='./cgroup/syz1\x00', 0x200002, 0x0) syz_io_uring_submit(r4, r1, &(0x7f0000000580)=@IORING_OP_FILES_UPDATE={0x14, 0x4, 0x0, 0x0, 0x40, &(0x7f0000000540)=[0xffffffffffffffff, 0xffffffffffffffff, r5, 0xffffffffffffffff, r0], 0x5}, 0x3) socket$inet6_tcp(0xa, 0x1, 0x0) openat$procfs(0xffffffffffffff9c, &(0x7f00000010c0)='/proc/crypto\x00', 0x0, 0x0) io_uring_setup(0x7c8f, &(0x7f0000001140)={0x0, 0xc240, 0x10, 0x3, 0x1c7}) 21:17:37 executing program 0: r0 = syz_io_uring_setup(0x0, &(0x7f0000000080)={0x0, 0x1830, 0x0, 0x0, 0x1b8}, &(0x7f0000ffb000/0x2000)=nil, &(0x7f0000ffb000/0x4000)=nil, &(0x7f0000000100), &(0x7f0000000140)=0x0) openat$hwrng(0xffffffffffffff9c, &(0x7f0000000180), 0x2, 0x0) r2 = openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000500)='./cgroup/syz1\x00', 0x200002, 0x0) syz_io_uring_submit(0x0, r1, &(0x7f0000000580)=@IORING_OP_FILES_UPDATE={0x14, 0x4, 0x0, 0x0, 0x40, &(0x7f0000000540)=[0xffffffffffffffff, 0xffffffffffffffff, r2, 0xffffffffffffffff, r0], 0x5}, 0x3) io_uring_setup(0x2812, &(0x7f00000005c0)={0x0, 0x5e1b, 0x2, 0x3, 0x12f}) socket$inet6_tcp(0xa, 0x1, 0x0) 21:17:45 executing program 7: pipe2$9p(&(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}, 0x0) write$P9_RSYMLINK(r0, 0x0, 0x0) add_key$fscrypt_v1(&(0x7f0000000280), 0x0, &(0x7f0000000300)={0x0, "ccf022eeb1aa5b4a9067674b5b7079352411c35248e190415959cbe4b7be99236abd831288583a8ed4db4b7b3f838c24d293f908bf3509b49f2c17852201f646", 0x19}, 0x48, 0xfffffffffffffffa) syz_genetlink_get_family_id$mptcp(&(0x7f00000004c0), 0xffffffffffffffff) openat$vcsa(0xffffffffffffff9c, &(0x7f00000009c0), 0x14200, 0x0) syz_genetlink_get_family_id$mptcp(&(0x7f0000000a80), 0xffffffffffffffff) 21:17:45 executing program 6: r0 = syz_io_uring_setup(0x8fe, &(0x7f0000000080)={0x0, 0x1830, 0x0, 0x0, 0x1b8}, &(0x7f0000ffb000/0x2000)=nil, &(0x7f0000ffb000/0x4000)=nil, &(0x7f0000000100), &(0x7f0000000140)=0x0) r2 = openat$hwrng(0xffffffffffffff9c, &(0x7f0000000180), 0x2, 0x0) r3 = syz_genetlink_get_family_id$mptcp(&(0x7f0000000300), r2) sendmsg$MPTCP_PM_CMD_ADD_ADDR(r2, &(0x7f00000003c0)={&(0x7f00000002c0)={0x10, 0x0, 0x0, 0x10}, 0xc, &(0x7f0000000380)={&(0x7f0000000340)={0x24, r3, 0x300, 0x70bd26, 0x25dfdbfb, {}, [@MPTCP_PM_ATTR_SUBFLOWS={0x8, 0x3, 0x1}, @MPTCP_PM_ATTR_RCV_ADD_ADDRS={0x8, 0x2, 0x2}]}, 0x24}, 0x1, 0x0, 0x0, 0x20000004}, 0x8890) syz_io_uring_setup(0x20f8, &(0x7f0000000400)={0x0, 0x7677, 0x8, 0x3, 0x22f}, &(0x7f0000ffe000/0x2000)=nil, &(0x7f0000ffb000/0x2000)=nil, &(0x7f0000000480)=0x0, &(0x7f00000004c0)) r5 = openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000500)='./cgroup/syz1\x00', 0x200002, 0x0) syz_io_uring_submit(r4, r1, &(0x7f0000000580)=@IORING_OP_FILES_UPDATE={0x14, 0x4, 0x0, 0x0, 0x40, &(0x7f0000000540)=[0xffffffffffffffff, 0xffffffffffffffff, r5, 0xffffffffffffffff, r0], 0x5}, 0x3) socket$inet6_tcp(0xa, 0x1, 0x0) openat$procfs(0xffffffffffffff9c, &(0x7f00000010c0)='/proc/crypto\x00', 0x0, 0x0) io_uring_setup(0x7c8f, &(0x7f0000001140)={0x0, 0xc240, 0x10, 0x3, 0x1c7}) 21:17:45 executing program 3: r0 = io_uring_setup(0x355e, &(0x7f0000000000)={0x0, 0x7682, 0x20, 0x1, 0x1be}) r1 = openat$hwrng(0xffffffffffffff9c, &(0x7f0000000180), 0x2, 0x0) syz_genetlink_get_family_id$mptcp(&(0x7f0000000300), r1) r2 = openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000500)='./cgroup/syz1\x00', 0x200002, 0x0) syz_io_uring_submit(0x0, 0x0, &(0x7f0000000580)=@IORING_OP_FILES_UPDATE={0x14, 0x4, 0x0, 0x0, 0x40, &(0x7f0000000540)=[0xffffffffffffffff, 0xffffffffffffffff, r2, r0, 0xffffffffffffffff], 0x5}, 0x3) io_uring_setup(0x2812, &(0x7f00000005c0)={0x0, 0x5e1b, 0x2, 0x3, 0x12f}) socket$inet6_tcp(0xa, 0x1, 0x0) io_uring_setup(0x7c8f, &(0x7f0000001140)={0x0, 0xc240, 0x10, 0x3, 0x1c7}) 21:17:45 executing program 4: r0 = syz_open_dev$mouse(&(0x7f0000000000), 0x578, 0x4000) ioctl$SG_GET_PACK_ID(r0, 0x227c, &(0x7f0000000040)) syz_genetlink_get_family_id$nl80211(&(0x7f00000000c0), r0) syz_open_dev$vcsa(&(0x7f0000000440), 0x56, 0x4000) socketpair(0x0, 0x3, 0x6, &(0x7f0000000640)) r1 = openat$tcp_congestion(0xffffffffffffff9c, &(0x7f0000000800), 0x1, 0x0) write$tcp_congestion(r1, &(0x7f0000000840)='htcp\x00', 0x5) 21:17:45 executing program 2: syz_genetlink_get_family_id$nl80211(&(0x7f00000000c0), 0xffffffffffffffff) syz_open_dev$vcsa(&(0x7f0000000440), 0x56, 0x4000) socketpair(0x0, 0x0, 0x0, 0x0) r0 = openat$tcp_congestion(0xffffffffffffff9c, &(0x7f0000000800), 0x1, 0x0) write$tcp_congestion(r0, &(0x7f0000000840)='htcp\x00', 0x5) 21:17:45 executing program 0: r0 = syz_io_uring_setup(0x8fe, 0x0, &(0x7f0000ffb000/0x2000)=nil, &(0x7f0000ffb000/0x4000)=nil, &(0x7f0000000100), &(0x7f0000000140)=0x0) openat$hwrng(0xffffffffffffff9c, &(0x7f0000000180), 0x2, 0x0) r2 = openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000500)='./cgroup/syz1\x00', 0x200002, 0x0) syz_io_uring_submit(0x0, r1, &(0x7f0000000580)=@IORING_OP_FILES_UPDATE={0x14, 0x4, 0x0, 0x0, 0x40, &(0x7f0000000540)=[0xffffffffffffffff, 0xffffffffffffffff, r2, 0xffffffffffffffff, r0], 0x5}, 0x3) io_uring_setup(0x2812, &(0x7f00000005c0)={0x0, 0x5e1b, 0x2, 0x3, 0x12f}) socket$inet6_tcp(0xa, 0x1, 0x0) 21:17:45 executing program 1: r0 = io_uring_setup(0x355e, &(0x7f0000000000)={0x0, 0x0, 0x0, 0x1, 0x1be}) r1 = openat$hwrng(0xffffffffffffff9c, &(0x7f0000000180), 0x2, 0x0) r2 = syz_io_uring_setup(0x65dd, &(0x7f00000001c0)={0x0, 0xf46f, 0x20, 0x2, 0xdf}, &(0x7f0000ffe000/0x1000)=nil, &(0x7f0000ffd000/0x1000)=nil, &(0x7f0000000240), &(0x7f0000000280)) syz_genetlink_get_family_id$mptcp(&(0x7f0000000300), r1) syz_io_uring_setup(0x20f8, &(0x7f0000000400)={0x0, 0x7677, 0x8, 0x3, 0x22f, 0x0, r2}, &(0x7f0000ffe000/0x2000)=nil, &(0x7f0000ffb000/0x2000)=nil, &(0x7f0000000480)=0x0, &(0x7f00000004c0)) r4 = openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000500)='./cgroup/syz1\x00', 0x200002, 0x0) syz_io_uring_submit(r3, 0x0, &(0x7f0000000580)=@IORING_OP_FILES_UPDATE={0x14, 0x4, 0x0, 0x0, 0x40, &(0x7f0000000540)=[r2, 0xffffffffffffffff, r4, r0, 0xffffffffffffffff], 0x5}, 0x3) io_uring_setup(0x2812, &(0x7f00000005c0)={0x0, 0x5e1b, 0x2, 0x3, 0x12f, 0x0, r2}) socket$inet6_tcp(0xa, 0x1, 0x0) openat$procfs(0xffffffffffffff9c, &(0x7f00000010c0)='/proc/crypto\x00', 0x0, 0x0) io_uring_setup(0x7c8f, &(0x7f0000001140)={0x0, 0xc240, 0x10, 0x3, 0x1c7, 0x0, r2}) 21:17:45 executing program 5: r0 = io_uring_setup(0x355e, &(0x7f0000000000)={0x0, 0x7682, 0x20, 0x1, 0x1be}) r1 = syz_io_uring_setup(0x8fe, &(0x7f0000000080)={0x0, 0x1830, 0x0, 0x0, 0x1b8, 0x0, r0}, &(0x7f0000ffb000/0x2000)=nil, &(0x7f0000ffb000/0x4000)=nil, &(0x7f0000000100), &(0x7f0000000140)=0x0) r3 = syz_io_uring_setup(0x65dd, &(0x7f00000001c0)={0x0, 0xf46f, 0x20, 0x2, 0xdf}, &(0x7f0000ffe000/0x1000)=nil, &(0x7f0000ffd000/0x1000)=nil, &(0x7f0000000240), &(0x7f0000000280)) r4 = syz_genetlink_get_family_id$mptcp(&(0x7f0000000300), 0xffffffffffffffff) sendmsg$MPTCP_PM_CMD_ADD_ADDR(0xffffffffffffffff, &(0x7f00000003c0)={&(0x7f00000002c0)={0x10, 0x0, 0x0, 0x10}, 0xc, &(0x7f0000000380)={&(0x7f0000000340)={0x24, r4, 0x300, 0x70bd26, 0x25dfdbfb, {}, [@MPTCP_PM_ATTR_SUBFLOWS={0x8, 0x3, 0x1}, @MPTCP_PM_ATTR_RCV_ADD_ADDRS={0x8, 0x2, 0x2}]}, 0x24}, 0x1, 0x0, 0x0, 0x20000004}, 0x8890) r5 = openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000500)='./cgroup/syz1\x00', 0x200002, 0x0) syz_io_uring_submit(0x0, r2, &(0x7f0000000580)=@IORING_OP_FILES_UPDATE={0x14, 0x4, 0x0, 0x0, 0x40, &(0x7f0000000540)=[r3, 0xffffffffffffffff, r5, r0, r1], 0x5}, 0x3) socket$inet6_tcp(0xa, 0x1, 0x0) openat$procfs(0xffffffffffffff9c, &(0x7f00000010c0)='/proc/crypto\x00', 0x0, 0x0) 21:17:45 executing program 0: r0 = syz_io_uring_setup(0x8fe, 0x0, &(0x7f0000ffb000/0x2000)=nil, &(0x7f0000ffb000/0x4000)=nil, &(0x7f0000000100), &(0x7f0000000140)=0x0) openat$hwrng(0xffffffffffffff9c, &(0x7f0000000180), 0x2, 0x0) r2 = openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000500)='./cgroup/syz1\x00', 0x200002, 0x0) syz_io_uring_submit(0x0, r1, &(0x7f0000000580)=@IORING_OP_FILES_UPDATE={0x14, 0x4, 0x0, 0x0, 0x40, &(0x7f0000000540)=[0xffffffffffffffff, 0xffffffffffffffff, r2, 0xffffffffffffffff, r0], 0x5}, 0x3) io_uring_setup(0x2812, &(0x7f00000005c0)={0x0, 0x5e1b, 0x2, 0x3, 0x12f}) socket$inet6_tcp(0xa, 0x1, 0x0) [ 394.744128] kmemleak: Found object by alias at 0x607f1a6398ac [ 394.744151] CPU: 1 UID: 0 PID: 5851 Comm: iou-sqp-5849 Tainted: G W 6.17.0-rc3-next-20250829 #1 PREEMPT(voluntary) [ 394.744169] Tainted: [W]=WARN [ 394.744172] Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.12.0-1 04/01/2014 [ 394.744180] Call Trace: [ 394.744183] [ 394.744188] dump_stack_lvl+0xca/0x120 [ 394.744214] __lookup_object+0x94/0xb0 [ 394.744231] delete_object_full+0x27/0x70 [ 394.744247] free_percpu+0x30/0x1160 [ 394.744263] ? arch_uprobe_clear_state+0x16/0x140 [ 394.744283] futex_hash_free+0x38/0xc0 [ 394.744297] mmput+0x2d3/0x390 [ 394.744315] do_exit+0x79d/0x2970 [ 394.744330] ? __pfx_try_to_wake_up+0x10/0x10 [ 394.744352] ? __pfx_do_exit+0x10/0x10 [ 394.744364] ? io_sq_thread+0xfbd/0x1b00 [ 394.744380] ? lock_release+0xc8/0x290 [ 394.744397] io_sq_thread+0xfc9/0x1b00 [ 394.744418] ? __pfx_io_sq_thread+0x10/0x10 [ 394.744434] ? __lock_acquire+0xc65/0x1b70 [ 394.744447] ? __pfx_autoremove_wake_function+0x10/0x10 [ 394.744461] ? __lock_acquire+0xc65/0x1b70 [ 394.744481] ? do_raw_spin_lock+0x123/0x260 [ 394.744497] ? find_held_lock+0x2b/0x80 [ 394.744512] ? __pfx_io_sq_thread+0x10/0x10 [ 394.744527] ? lock_release+0xc8/0x290 [ 394.744540] ? __pfx_io_sq_thread+0x10/0x10 [ 394.744556] ret_from_fork+0x34b/0x430 [ 394.744573] ? __pfx_io_sq_thread+0x10/0x10 [ 394.744587] ret_from_fork_asm+0x1a/0x30 [ 394.744610] [ 394.744614] kmemleak: Object (percpu) 0x607f1a6398a8 (size 8): [ 394.744621] kmemleak: comm "syz-executor.1", pid 5854, jiffies 4295061553 [ 394.744628] kmemleak: min_count = 1 [ 394.744631] kmemleak: count = 0 [ 394.744635] kmemleak: flags = 0x21 [ 394.744638] kmemleak: checksum = 0 [ 394.744642] kmemleak: backtrace: [ 394.744645] pcpu_alloc_noprof+0x87a/0x1170 [ 394.744660] percpu_ref_init+0x37/0x400 [ 394.744677] io_uring_setup+0x44c/0x2000 [ 394.744688] __x64_sys_io_uring_setup+0xc8/0x170 [ 394.744699] do_syscall_64+0xbf/0x360 [ 394.744708] entry_SYSCALL_64_after_hwframe+0x77/0x7f 21:17:45 executing program 3: r0 = io_uring_setup(0x355e, &(0x7f0000000000)={0x0, 0x7682, 0x20, 0x1, 0x1be}) r1 = openat$hwrng(0xffffffffffffff9c, &(0x7f0000000180), 0x2, 0x0) syz_genetlink_get_family_id$mptcp(&(0x7f0000000300), r1) r2 = openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000500)='./cgroup/syz1\x00', 0x200002, 0x0) syz_io_uring_submit(0x0, 0x0, &(0x7f0000000580)=@IORING_OP_FILES_UPDATE={0x14, 0x4, 0x0, 0x0, 0x40, &(0x7f0000000540)=[0xffffffffffffffff, 0xffffffffffffffff, r2, r0, 0xffffffffffffffff], 0x5}, 0x3) io_uring_setup(0x2812, &(0x7f00000005c0)={0x0, 0x5e1b, 0x2, 0x3, 0x12f}) socket$inet6_tcp(0xa, 0x1, 0x0) io_uring_setup(0x7c8f, &(0x7f0000001140)={0x0, 0xc240, 0x10, 0x3, 0x1c7}) 21:17:45 executing program 5: r0 = io_uring_setup(0x355e, &(0x7f0000000000)={0x0, 0x7682, 0x20, 0x1, 0x1be}) r1 = syz_io_uring_setup(0x8fe, &(0x7f0000000080)={0x0, 0x1830, 0x0, 0x0, 0x1b8, 0x0, r0}, &(0x7f0000ffb000/0x2000)=nil, &(0x7f0000ffb000/0x4000)=nil, &(0x7f0000000100), &(0x7f0000000140)=0x0) r3 = syz_io_uring_setup(0x65dd, &(0x7f00000001c0)={0x0, 0xf46f, 0x20, 0x2, 0xdf}, &(0x7f0000ffe000/0x1000)=nil, &(0x7f0000ffd000/0x1000)=nil, &(0x7f0000000240), &(0x7f0000000280)) r4 = syz_genetlink_get_family_id$mptcp(&(0x7f0000000300), 0xffffffffffffffff) sendmsg$MPTCP_PM_CMD_ADD_ADDR(0xffffffffffffffff, &(0x7f00000003c0)={&(0x7f00000002c0)={0x10, 0x0, 0x0, 0x10}, 0xc, &(0x7f0000000380)={&(0x7f0000000340)={0x24, r4, 0x300, 0x70bd26, 0x25dfdbfb, {}, [@MPTCP_PM_ATTR_SUBFLOWS={0x8, 0x3, 0x1}, @MPTCP_PM_ATTR_RCV_ADD_ADDRS={0x8, 0x2, 0x2}]}, 0x24}, 0x1, 0x0, 0x0, 0x20000004}, 0x8890) r5 = openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000500)='./cgroup/syz1\x00', 0x200002, 0x0) syz_io_uring_submit(0x0, r2, &(0x7f0000000580)=@IORING_OP_FILES_UPDATE={0x14, 0x4, 0x0, 0x0, 0x40, &(0x7f0000000540)=[r3, 0xffffffffffffffff, r5, r0, r1], 0x5}, 0x3) socket$inet6_tcp(0xa, 0x1, 0x0) openat$procfs(0xffffffffffffff9c, &(0x7f00000010c0)='/proc/crypto\x00', 0x0, 0x0) 21:17:45 executing program 7: pipe2$9p(&(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}, 0x0) write$P9_RSYMLINK(r0, 0x0, 0x0) add_key$fscrypt_v1(&(0x7f0000000280), &(0x7f00000002c0)={'fscrypt:', @desc2}, 0x0, 0x0, 0xfffffffffffffffa) syz_genetlink_get_family_id$mptcp(&(0x7f00000004c0), 0xffffffffffffffff) openat$vcsa(0xffffffffffffff9c, &(0x7f00000009c0), 0x14200, 0x0) syz_genetlink_get_family_id$mptcp(&(0x7f0000000a80), 0xffffffffffffffff) 21:17:45 executing program 0: r0 = syz_io_uring_setup(0x8fe, 0x0, &(0x7f0000ffb000/0x2000)=nil, &(0x7f0000ffb000/0x4000)=nil, &(0x7f0000000100), &(0x7f0000000140)=0x0) openat$hwrng(0xffffffffffffff9c, &(0x7f0000000180), 0x2, 0x0) r2 = openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000500)='./cgroup/syz1\x00', 0x200002, 0x0) syz_io_uring_submit(0x0, r1, &(0x7f0000000580)=@IORING_OP_FILES_UPDATE={0x14, 0x4, 0x0, 0x0, 0x40, &(0x7f0000000540)=[0xffffffffffffffff, 0xffffffffffffffff, r2, 0xffffffffffffffff, r0], 0x5}, 0x3) io_uring_setup(0x2812, &(0x7f00000005c0)={0x0, 0x5e1b, 0x2, 0x3, 0x12f}) socket$inet6_tcp(0xa, 0x1, 0x0) 21:17:45 executing program 4: r0 = syz_open_dev$mouse(&(0x7f0000000000), 0x578, 0x4000) ioctl$SG_GET_PACK_ID(r0, 0x227c, &(0x7f0000000040)) syz_genetlink_get_family_id$nl80211(&(0x7f00000000c0), r0) syz_open_dev$vcsa(&(0x7f0000000440), 0x56, 0x4000) socketpair(0x0, 0x3, 0x6, &(0x7f0000000640)) r1 = openat$tcp_congestion(0xffffffffffffff9c, &(0x7f0000000800), 0x1, 0x0) write$tcp_congestion(r1, &(0x7f0000000840)='htcp\x00', 0x5) 21:17:45 executing program 2: syz_genetlink_get_family_id$nl80211(&(0x7f00000000c0), 0xffffffffffffffff) syz_open_dev$vcsa(&(0x7f0000000440), 0x56, 0x4000) socketpair(0x0, 0x0, 0x0, &(0x7f0000000640)) r0 = openat$tcp_congestion(0xffffffffffffff9c, 0x0, 0x1, 0x0) write$tcp_congestion(r0, &(0x7f0000000840)='htcp\x00', 0x5) 21:17:45 executing program 1: r0 = io_uring_setup(0x355e, &(0x7f0000000000)={0x0, 0x0, 0x0, 0x1, 0x1be}) r1 = openat$hwrng(0xffffffffffffff9c, &(0x7f0000000180), 0x2, 0x0) r2 = syz_io_uring_setup(0x65dd, &(0x7f00000001c0)={0x0, 0xf46f, 0x20, 0x2, 0xdf}, &(0x7f0000ffe000/0x1000)=nil, &(0x7f0000ffd000/0x1000)=nil, &(0x7f0000000240), &(0x7f0000000280)) syz_genetlink_get_family_id$mptcp(&(0x7f0000000300), r1) syz_io_uring_setup(0x20f8, &(0x7f0000000400)={0x0, 0x7677, 0x8, 0x3, 0x22f, 0x0, r2}, &(0x7f0000ffe000/0x2000)=nil, &(0x7f0000ffb000/0x2000)=nil, &(0x7f0000000480)=0x0, &(0x7f00000004c0)) r4 = openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000500)='./cgroup/syz1\x00', 0x200002, 0x0) syz_io_uring_submit(r3, 0x0, &(0x7f0000000580)=@IORING_OP_FILES_UPDATE={0x14, 0x4, 0x0, 0x0, 0x40, &(0x7f0000000540)=[r2, 0xffffffffffffffff, r4, r0, 0xffffffffffffffff], 0x5}, 0x3) io_uring_setup(0x2812, &(0x7f00000005c0)={0x0, 0x5e1b, 0x2, 0x3, 0x12f, 0x0, r2}) socket$inet6_tcp(0xa, 0x1, 0x0) openat$procfs(0xffffffffffffff9c, &(0x7f00000010c0)='/proc/crypto\x00', 0x0, 0x0) io_uring_setup(0x7c8f, &(0x7f0000001140)={0x0, 0xc240, 0x10, 0x3, 0x1c7, 0x0, r2}) 21:17:45 executing program 6: r0 = io_uring_setup(0x0, &(0x7f0000000000)={0x0, 0x7682, 0x20, 0x1, 0x1be}) r1 = syz_io_uring_setup(0x8fe, &(0x7f0000000080)={0x0, 0x1830, 0x0, 0x0, 0x1b8, 0x0, r0}, &(0x7f0000ffb000/0x2000)=nil, &(0x7f0000ffb000/0x4000)=nil, &(0x7f0000000100), &(0x7f0000000140)=0x0) r3 = openat$hwrng(0xffffffffffffff9c, &(0x7f0000000180), 0x2, 0x0) r4 = syz_genetlink_get_family_id$mptcp(&(0x7f0000000300), r3) sendmsg$MPTCP_PM_CMD_ADD_ADDR(r3, &(0x7f00000003c0)={&(0x7f00000002c0)={0x10, 0x0, 0x0, 0x10}, 0xc, &(0x7f0000000380)={&(0x7f0000000340)={0x24, r4, 0x300, 0x70bd26, 0x25dfdbfb, {}, [@MPTCP_PM_ATTR_SUBFLOWS={0x8, 0x3, 0x1}, @MPTCP_PM_ATTR_RCV_ADD_ADDRS={0x8, 0x2, 0x2}]}, 0x24}, 0x1, 0x0, 0x0, 0x20000004}, 0x8890) syz_io_uring_setup(0x20f8, &(0x7f0000000400)={0x0, 0x7677, 0x8, 0x3, 0x22f}, &(0x7f0000ffe000/0x2000)=nil, &(0x7f0000ffb000/0x2000)=nil, &(0x7f0000000480)=0x0, &(0x7f00000004c0)) r6 = openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000500)='./cgroup/syz1\x00', 0x200002, 0x0) syz_io_uring_submit(r5, r2, &(0x7f0000000580)=@IORING_OP_FILES_UPDATE={0x14, 0x4, 0x0, 0x0, 0x40, &(0x7f0000000540)=[0xffffffffffffffff, 0xffffffffffffffff, r6, r0, r1], 0x5}, 0x3) socket$inet6_tcp(0xa, 0x1, 0x0) openat$procfs(0xffffffffffffff9c, &(0x7f00000010c0)='/proc/crypto\x00', 0x0, 0x0) io_uring_setup(0x7c8f, &(0x7f0000001140)={0x0, 0xc240, 0x10, 0x3, 0x1c7}) 21:17:45 executing program 3: r0 = syz_io_uring_setup(0x8fe, &(0x7f0000000080)={0x0, 0x1830, 0x0, 0x0, 0x1b8}, &(0x7f0000ffb000/0x2000)=nil, &(0x7f0000ffb000/0x4000)=nil, &(0x7f0000000100), &(0x7f0000000140)=0x0) r2 = openat$hwrng(0xffffffffffffff9c, &(0x7f0000000180), 0x2, 0x0) syz_genetlink_get_family_id$mptcp(&(0x7f0000000300), r2) r3 = openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000500)='./cgroup/syz1\x00', 0x200002, 0x0) syz_io_uring_submit(0x0, r1, &(0x7f0000000580)=@IORING_OP_FILES_UPDATE={0x14, 0x4, 0x0, 0x0, 0x40, &(0x7f0000000540)=[0xffffffffffffffff, 0xffffffffffffffff, r3, 0xffffffffffffffff, r0], 0x5}, 0x3) io_uring_setup(0x2812, &(0x7f00000005c0)={0x0, 0x5e1b, 0x2, 0x3, 0x12f}) socket$inet6_tcp(0xa, 0x1, 0x0) io_uring_setup(0x7c8f, &(0x7f0000001140)={0x0, 0xc240, 0x10, 0x3, 0x1c7}) 21:17:45 executing program 0: r0 = syz_io_uring_setup(0x8fe, &(0x7f0000000080)={0x0, 0x0, 0x0, 0x0, 0x1b8}, &(0x7f0000ffb000/0x2000)=nil, &(0x7f0000ffb000/0x4000)=nil, &(0x7f0000000100), &(0x7f0000000140)=0x0) openat$hwrng(0xffffffffffffff9c, &(0x7f0000000180), 0x2, 0x0) r2 = openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000500)='./cgroup/syz1\x00', 0x200002, 0x0) syz_io_uring_submit(0x0, r1, &(0x7f0000000580)=@IORING_OP_FILES_UPDATE={0x14, 0x4, 0x0, 0x0, 0x40, &(0x7f0000000540)=[0xffffffffffffffff, 0xffffffffffffffff, r2, 0xffffffffffffffff, r0], 0x5}, 0x3) io_uring_setup(0x2812, &(0x7f00000005c0)={0x0, 0x5e1b, 0x2, 0x3, 0x12f}) socket$inet6_tcp(0xa, 0x1, 0x0) 21:17:45 executing program 1: r0 = io_uring_setup(0x355e, &(0x7f0000000000)={0x0, 0x0, 0x0, 0x1, 0x1be}) r1 = openat$hwrng(0xffffffffffffff9c, &(0x7f0000000180), 0x2, 0x0) r2 = syz_io_uring_setup(0x65dd, &(0x7f00000001c0)={0x0, 0xf46f, 0x20, 0x2, 0xdf}, &(0x7f0000ffe000/0x1000)=nil, &(0x7f0000ffd000/0x1000)=nil, &(0x7f0000000240), &(0x7f0000000280)) syz_genetlink_get_family_id$mptcp(&(0x7f0000000300), r1) syz_io_uring_setup(0x20f8, &(0x7f0000000400)={0x0, 0x7677, 0x8, 0x3, 0x22f, 0x0, r2}, &(0x7f0000ffe000/0x2000)=nil, &(0x7f0000ffb000/0x2000)=nil, &(0x7f0000000480)=0x0, &(0x7f00000004c0)) r4 = openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000500)='./cgroup/syz1\x00', 0x200002, 0x0) syz_io_uring_submit(r3, 0x0, &(0x7f0000000580)=@IORING_OP_FILES_UPDATE={0x14, 0x4, 0x0, 0x0, 0x40, &(0x7f0000000540)=[r2, 0xffffffffffffffff, r4, r0, 0xffffffffffffffff], 0x5}, 0x3) io_uring_setup(0x2812, &(0x7f00000005c0)={0x0, 0x5e1b, 0x2, 0x3, 0x12f, 0x0, r2}) socket$inet6_tcp(0xa, 0x1, 0x0) openat$procfs(0xffffffffffffff9c, &(0x7f00000010c0)='/proc/crypto\x00', 0x0, 0x0) io_uring_setup(0x7c8f, &(0x7f0000001140)={0x0, 0xc240, 0x10, 0x3, 0x1c7, 0x0, r2}) 21:17:45 executing program 4: ioctl$SCSI_IOCTL_DOORUNLOCK(0xffffffffffffffff, 0x5381) r0 = syz_open_dev$mouse(0x0, 0x578, 0x4000) ioctl$SG_GET_PACK_ID(r0, 0x227c, &(0x7f0000000040)) syz_genetlink_get_family_id$nl80211(&(0x7f00000000c0), r0) syz_open_dev$vcsa(&(0x7f0000000440), 0x56, 0x4000) socketpair(0x0, 0x3, 0x6, &(0x7f0000000640)) r1 = openat$tcp_congestion(0xffffffffffffff9c, &(0x7f0000000800), 0x1, 0x0) write$tcp_congestion(r1, &(0x7f0000000840)='htcp\x00', 0x5) 21:17:45 executing program 3: r0 = syz_io_uring_setup(0x8fe, &(0x7f0000000080)={0x0, 0x1830, 0x0, 0x0, 0x1b8}, &(0x7f0000ffb000/0x2000)=nil, &(0x7f0000ffb000/0x4000)=nil, &(0x7f0000000100), &(0x7f0000000140)=0x0) r2 = openat$hwrng(0xffffffffffffff9c, &(0x7f0000000180), 0x2, 0x0) syz_genetlink_get_family_id$mptcp(&(0x7f0000000300), r2) r3 = openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000500)='./cgroup/syz1\x00', 0x200002, 0x0) syz_io_uring_submit(0x0, r1, &(0x7f0000000580)=@IORING_OP_FILES_UPDATE={0x14, 0x4, 0x0, 0x0, 0x40, &(0x7f0000000540)=[0xffffffffffffffff, 0xffffffffffffffff, r3, 0xffffffffffffffff, r0], 0x5}, 0x3) io_uring_setup(0x2812, &(0x7f00000005c0)={0x0, 0x5e1b, 0x2, 0x3, 0x12f}) socket$inet6_tcp(0xa, 0x1, 0x0) io_uring_setup(0x7c8f, &(0x7f0000001140)={0x0, 0xc240, 0x10, 0x3, 0x1c7}) 21:17:45 executing program 0: r0 = syz_io_uring_setup(0x8fe, &(0x7f0000000080), &(0x7f0000ffb000/0x2000)=nil, &(0x7f0000ffb000/0x4000)=nil, &(0x7f0000000100), &(0x7f0000000140)=0x0) openat$hwrng(0xffffffffffffff9c, &(0x7f0000000180), 0x2, 0x0) r2 = openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000500)='./cgroup/syz1\x00', 0x200002, 0x0) syz_io_uring_submit(0x0, r1, &(0x7f0000000580)=@IORING_OP_FILES_UPDATE={0x14, 0x4, 0x0, 0x0, 0x40, &(0x7f0000000540)=[0xffffffffffffffff, 0xffffffffffffffff, r2, 0xffffffffffffffff, r0], 0x5}, 0x3) io_uring_setup(0x2812, &(0x7f00000005c0)={0x0, 0x5e1b, 0x2, 0x3, 0x12f}) socket$inet6_tcp(0xa, 0x1, 0x0) 21:17:53 executing program 5: r0 = io_uring_setup(0x355e, &(0x7f0000000000)={0x0, 0x7682, 0x20, 0x1, 0x1be}) r1 = openat$hwrng(0xffffffffffffff9c, &(0x7f0000000180), 0x2, 0x0) r2 = syz_io_uring_setup(0x65dd, &(0x7f00000001c0)={0x0, 0xf46f, 0x20, 0x2, 0xdf}, &(0x7f0000ffe000/0x1000)=nil, &(0x7f0000ffd000/0x1000)=nil, &(0x7f0000000240), &(0x7f0000000280)) r3 = syz_genetlink_get_family_id$mptcp(&(0x7f0000000300), r1) sendmsg$MPTCP_PM_CMD_ADD_ADDR(r1, &(0x7f00000003c0)={&(0x7f00000002c0)={0x10, 0x0, 0x0, 0x10}, 0xc, &(0x7f0000000380)={&(0x7f0000000340)={0x24, r3, 0x300, 0x70bd26, 0x25dfdbfb, {}, [@MPTCP_PM_ATTR_SUBFLOWS={0x8, 0x3, 0x1}, @MPTCP_PM_ATTR_RCV_ADD_ADDRS={0x8, 0x2, 0x2}]}, 0x24}, 0x1, 0x0, 0x0, 0x20000004}, 0x8890) r4 = openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000500)='./cgroup/syz1\x00', 0x200002, 0x0) syz_io_uring_submit(0x0, 0x0, &(0x7f0000000580)=@IORING_OP_FILES_UPDATE={0x14, 0x4, 0x0, 0x0, 0x40, &(0x7f0000000540)=[r2, 0xffffffffffffffff, r4, r0, 0xffffffffffffffff], 0x5}, 0x3) socket$inet6_tcp(0xa, 0x1, 0x0) openat$procfs(0xffffffffffffff9c, &(0x7f00000010c0)='/proc/crypto\x00', 0x0, 0x0) 21:17:53 executing program 2: syz_genetlink_get_family_id$nl80211(&(0x7f00000000c0), 0xffffffffffffffff) syz_open_dev$vcsa(&(0x7f0000000440), 0x56, 0x4000) socketpair(0x0, 0x0, 0x0, &(0x7f0000000640)) r0 = openat$tcp_congestion(0xffffffffffffff9c, 0x0, 0x1, 0x0) write$tcp_congestion(r0, &(0x7f0000000840)='htcp\x00', 0x5) 21:17:53 executing program 3: r0 = syz_io_uring_setup(0x8fe, &(0x7f0000000080)={0x0, 0x1830, 0x0, 0x0, 0x1b8}, &(0x7f0000ffb000/0x2000)=nil, &(0x7f0000ffb000/0x4000)=nil, &(0x7f0000000100), &(0x7f0000000140)=0x0) r2 = openat$hwrng(0xffffffffffffff9c, &(0x7f0000000180), 0x2, 0x0) syz_genetlink_get_family_id$mptcp(&(0x7f0000000300), r2) r3 = openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000500)='./cgroup/syz1\x00', 0x200002, 0x0) syz_io_uring_submit(0x0, r1, &(0x7f0000000580)=@IORING_OP_FILES_UPDATE={0x14, 0x4, 0x0, 0x0, 0x40, &(0x7f0000000540)=[0xffffffffffffffff, 0xffffffffffffffff, r3, 0xffffffffffffffff, r0], 0x5}, 0x3) io_uring_setup(0x2812, &(0x7f00000005c0)={0x0, 0x5e1b, 0x2, 0x3, 0x12f}) socket$inet6_tcp(0xa, 0x1, 0x0) io_uring_setup(0x7c8f, &(0x7f0000001140)={0x0, 0xc240, 0x10, 0x3, 0x1c7}) 21:17:53 executing program 1: r0 = io_uring_setup(0x355e, &(0x7f0000000000)={0x0, 0x0, 0x20, 0x0, 0x1be}) r1 = openat$hwrng(0xffffffffffffff9c, &(0x7f0000000180), 0x2, 0x0) r2 = syz_io_uring_setup(0x65dd, &(0x7f00000001c0)={0x0, 0xf46f, 0x20, 0x2, 0xdf}, &(0x7f0000ffe000/0x1000)=nil, &(0x7f0000ffd000/0x1000)=nil, &(0x7f0000000240), &(0x7f0000000280)) syz_genetlink_get_family_id$mptcp(&(0x7f0000000300), r1) syz_io_uring_setup(0x20f8, &(0x7f0000000400)={0x0, 0x7677, 0x8, 0x3, 0x22f, 0x0, r2}, &(0x7f0000ffe000/0x2000)=nil, &(0x7f0000ffb000/0x2000)=nil, &(0x7f0000000480)=0x0, &(0x7f00000004c0)) r4 = openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000500)='./cgroup/syz1\x00', 0x200002, 0x0) syz_io_uring_submit(r3, 0x0, &(0x7f0000000580)=@IORING_OP_FILES_UPDATE={0x14, 0x4, 0x0, 0x0, 0x40, &(0x7f0000000540)=[r2, 0xffffffffffffffff, r4, r0, 0xffffffffffffffff], 0x5}, 0x3) io_uring_setup(0x2812, &(0x7f00000005c0)={0x0, 0x5e1b, 0x2, 0x3, 0x12f, 0x0, r2}) socket$inet6_tcp(0xa, 0x1, 0x0) openat$procfs(0xffffffffffffff9c, &(0x7f00000010c0)='/proc/crypto\x00', 0x0, 0x0) io_uring_setup(0x7c8f, &(0x7f0000001140)={0x0, 0xc240, 0x10, 0x3, 0x1c7, 0x0, r2}) 21:17:53 executing program 0: r0 = syz_io_uring_setup(0x8fe, &(0x7f0000000080), &(0x7f0000ffb000/0x2000)=nil, &(0x7f0000ffb000/0x4000)=nil, 0x0, &(0x7f0000000140)=0x0) openat$hwrng(0xffffffffffffff9c, &(0x7f0000000180), 0x2, 0x0) r2 = openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000500)='./cgroup/syz1\x00', 0x200002, 0x0) syz_io_uring_submit(0x0, r1, &(0x7f0000000580)=@IORING_OP_FILES_UPDATE={0x14, 0x4, 0x0, 0x0, 0x40, &(0x7f0000000540)=[0xffffffffffffffff, 0xffffffffffffffff, r2, 0xffffffffffffffff, r0], 0x5}, 0x3) io_uring_setup(0x2812, &(0x7f00000005c0)={0x0, 0x5e1b, 0x2, 0x3, 0x12f}) socket$inet6_tcp(0xa, 0x1, 0x0) 21:17:53 executing program 4: ioctl$SCSI_IOCTL_DOORUNLOCK(0xffffffffffffffff, 0x5381) r0 = syz_open_dev$mouse(0x0, 0x578, 0x4000) ioctl$SG_GET_PACK_ID(r0, 0x227c, &(0x7f0000000040)) syz_genetlink_get_family_id$nl80211(&(0x7f00000000c0), r0) syz_open_dev$vcsa(&(0x7f0000000440), 0x56, 0x4000) socketpair(0x0, 0x3, 0x6, &(0x7f0000000640)) r1 = openat$tcp_congestion(0xffffffffffffff9c, &(0x7f0000000800), 0x1, 0x0) write$tcp_congestion(r1, &(0x7f0000000840)='htcp\x00', 0x5) 21:17:53 executing program 7: pipe2$9p(&(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}, 0x0) write$P9_RSYMLINK(r0, 0x0, 0x0) add_key$fscrypt_v1(&(0x7f0000000280), &(0x7f00000002c0)={'fscrypt:', @desc2}, 0x0, 0x0, 0xfffffffffffffffa) syz_genetlink_get_family_id$mptcp(0x0, 0xffffffffffffffff) openat$vcsa(0xffffffffffffff9c, &(0x7f00000009c0), 0x14200, 0x0) syz_genetlink_get_family_id$mptcp(&(0x7f0000000a80), 0xffffffffffffffff) 21:17:53 executing program 6: r0 = io_uring_setup(0x0, &(0x7f0000000000)={0x0, 0x7682, 0x20, 0x1, 0x1be}) r1 = syz_io_uring_setup(0x8fe, &(0x7f0000000080)={0x0, 0x1830, 0x0, 0x0, 0x1b8, 0x0, r0}, &(0x7f0000ffb000/0x2000)=nil, &(0x7f0000ffb000/0x4000)=nil, &(0x7f0000000100), &(0x7f0000000140)=0x0) r3 = openat$hwrng(0xffffffffffffff9c, &(0x7f0000000180), 0x2, 0x0) r4 = syz_genetlink_get_family_id$mptcp(&(0x7f0000000300), r3) sendmsg$MPTCP_PM_CMD_ADD_ADDR(r3, &(0x7f00000003c0)={&(0x7f00000002c0)={0x10, 0x0, 0x0, 0x10}, 0xc, &(0x7f0000000380)={&(0x7f0000000340)={0x24, r4, 0x300, 0x70bd26, 0x25dfdbfb, {}, [@MPTCP_PM_ATTR_SUBFLOWS={0x8, 0x3, 0x1}, @MPTCP_PM_ATTR_RCV_ADD_ADDRS={0x8, 0x2, 0x2}]}, 0x24}, 0x1, 0x0, 0x0, 0x20000004}, 0x8890) syz_io_uring_setup(0x20f8, &(0x7f0000000400)={0x0, 0x7677, 0x8, 0x3, 0x22f}, &(0x7f0000ffe000/0x2000)=nil, &(0x7f0000ffb000/0x2000)=nil, &(0x7f0000000480)=0x0, &(0x7f00000004c0)) r6 = openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000500)='./cgroup/syz1\x00', 0x200002, 0x0) syz_io_uring_submit(r5, r2, &(0x7f0000000580)=@IORING_OP_FILES_UPDATE={0x14, 0x4, 0x0, 0x0, 0x40, &(0x7f0000000540)=[0xffffffffffffffff, 0xffffffffffffffff, r6, r0, r1], 0x5}, 0x3) socket$inet6_tcp(0xa, 0x1, 0x0) openat$procfs(0xffffffffffffff9c, &(0x7f00000010c0)='/proc/crypto\x00', 0x0, 0x0) io_uring_setup(0x7c8f, &(0x7f0000001140)={0x0, 0xc240, 0x10, 0x3, 0x1c7}) 21:17:53 executing program 0: r0 = syz_io_uring_setup(0x8fe, &(0x7f0000000080), &(0x7f0000ffb000/0x2000)=nil, &(0x7f0000ffb000/0x4000)=nil, 0x0, &(0x7f0000000140)=0x0) openat$hwrng(0xffffffffffffff9c, &(0x7f0000000180), 0x2, 0x0) r2 = openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000500)='./cgroup/syz1\x00', 0x200002, 0x0) syz_io_uring_submit(0x0, r1, &(0x7f0000000580)=@IORING_OP_FILES_UPDATE={0x14, 0x4, 0x0, 0x0, 0x40, &(0x7f0000000540)=[0xffffffffffffffff, 0xffffffffffffffff, r2, 0xffffffffffffffff, r0], 0x5}, 0x3) io_uring_setup(0x2812, &(0x7f00000005c0)={0x0, 0x5e1b, 0x2, 0x3, 0x12f}) socket$inet6_tcp(0xa, 0x1, 0x0) 21:17:53 executing program 2: syz_genetlink_get_family_id$nl80211(&(0x7f00000000c0), 0xffffffffffffffff) syz_open_dev$vcsa(&(0x7f0000000440), 0x56, 0x4000) socketpair(0x0, 0x0, 0x0, &(0x7f0000000640)) r0 = openat$tcp_congestion(0xffffffffffffff9c, 0x0, 0x1, 0x0) write$tcp_congestion(r0, &(0x7f0000000840)='htcp\x00', 0x5) 21:17:54 executing program 4: ioctl$SCSI_IOCTL_DOORUNLOCK(0xffffffffffffffff, 0x5381) r0 = syz_open_dev$mouse(0x0, 0x578, 0x4000) ioctl$SG_GET_PACK_ID(r0, 0x227c, &(0x7f0000000040)) syz_genetlink_get_family_id$nl80211(&(0x7f00000000c0), r0) syz_open_dev$vcsa(&(0x7f0000000440), 0x56, 0x4000) socketpair(0x0, 0x3, 0x6, &(0x7f0000000640)) r1 = openat$tcp_congestion(0xffffffffffffff9c, &(0x7f0000000800), 0x1, 0x0) write$tcp_congestion(r1, &(0x7f0000000840)='htcp\x00', 0x5) 21:17:54 executing program 5: r0 = io_uring_setup(0x355e, &(0x7f0000000000)={0x0, 0x7682, 0x20, 0x1, 0x1be}) r1 = openat$hwrng(0xffffffffffffff9c, &(0x7f0000000180), 0x2, 0x0) r2 = syz_io_uring_setup(0x65dd, &(0x7f00000001c0)={0x0, 0xf46f, 0x20, 0x2, 0xdf}, &(0x7f0000ffe000/0x1000)=nil, &(0x7f0000ffd000/0x1000)=nil, &(0x7f0000000240), &(0x7f0000000280)) r3 = syz_genetlink_get_family_id$mptcp(&(0x7f0000000300), r1) sendmsg$MPTCP_PM_CMD_ADD_ADDR(r1, &(0x7f00000003c0)={&(0x7f00000002c0)={0x10, 0x0, 0x0, 0x10}, 0xc, &(0x7f0000000380)={&(0x7f0000000340)={0x24, r3, 0x300, 0x70bd26, 0x25dfdbfb, {}, [@MPTCP_PM_ATTR_SUBFLOWS={0x8, 0x3, 0x1}, @MPTCP_PM_ATTR_RCV_ADD_ADDRS={0x8, 0x2, 0x2}]}, 0x24}, 0x1, 0x0, 0x0, 0x20000004}, 0x8890) r4 = openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000500)='./cgroup/syz1\x00', 0x200002, 0x0) syz_io_uring_submit(0x0, 0x0, &(0x7f0000000580)=@IORING_OP_FILES_UPDATE={0x14, 0x4, 0x0, 0x0, 0x40, &(0x7f0000000540)=[r2, 0xffffffffffffffff, r4, r0, 0xffffffffffffffff], 0x5}, 0x3) socket$inet6_tcp(0xa, 0x1, 0x0) openat$procfs(0xffffffffffffff9c, &(0x7f00000010c0)='/proc/crypto\x00', 0x0, 0x0) 21:17:54 executing program 0: r0 = syz_io_uring_setup(0x8fe, &(0x7f0000000080), &(0x7f0000ffb000/0x2000)=nil, &(0x7f0000ffb000/0x4000)=nil, 0x0, &(0x7f0000000140)=0x0) openat$hwrng(0xffffffffffffff9c, &(0x7f0000000180), 0x2, 0x0) r2 = openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000500)='./cgroup/syz1\x00', 0x200002, 0x0) syz_io_uring_submit(0x0, r1, &(0x7f0000000580)=@IORING_OP_FILES_UPDATE={0x14, 0x4, 0x0, 0x0, 0x40, &(0x7f0000000540)=[0xffffffffffffffff, 0xffffffffffffffff, r2, 0xffffffffffffffff, r0], 0x5}, 0x3) io_uring_setup(0x2812, &(0x7f00000005c0)={0x0, 0x5e1b, 0x2, 0x3, 0x12f}) socket$inet6_tcp(0xa, 0x1, 0x0) 21:17:54 executing program 3: r0 = io_uring_setup(0x0, &(0x7f0000000000)={0x0, 0x7682, 0x20, 0x1, 0x1be}) r1 = syz_io_uring_setup(0x8fe, &(0x7f0000000080)={0x0, 0x1830, 0x0, 0x0, 0x1b8, 0x0, r0}, &(0x7f0000ffb000/0x2000)=nil, &(0x7f0000ffb000/0x4000)=nil, &(0x7f0000000100), &(0x7f0000000140)=0x0) r3 = openat$hwrng(0xffffffffffffff9c, &(0x7f0000000180), 0x2, 0x0) syz_genetlink_get_family_id$mptcp(&(0x7f0000000300), r3) r4 = openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000500)='./cgroup/syz1\x00', 0x200002, 0x0) syz_io_uring_submit(0x0, r2, &(0x7f0000000580)=@IORING_OP_FILES_UPDATE={0x14, 0x4, 0x0, 0x0, 0x40, &(0x7f0000000540)=[0xffffffffffffffff, 0xffffffffffffffff, r4, r0, r1], 0x5}, 0x3) io_uring_setup(0x2812, &(0x7f00000005c0)={0x0, 0x5e1b, 0x2, 0x3, 0x12f}) socket$inet6_tcp(0xa, 0x1, 0x0) io_uring_setup(0x7c8f, &(0x7f0000001140)={0x0, 0xc240, 0x10, 0x3, 0x1c7}) 21:18:03 executing program 3: r0 = io_uring_setup(0x0, &(0x7f0000000000)={0x0, 0x7682, 0x20, 0x1, 0x1be}) r1 = syz_io_uring_setup(0x8fe, &(0x7f0000000080)={0x0, 0x1830, 0x0, 0x0, 0x1b8, 0x0, r0}, &(0x7f0000ffb000/0x2000)=nil, &(0x7f0000ffb000/0x4000)=nil, &(0x7f0000000100), &(0x7f0000000140)=0x0) r3 = openat$hwrng(0xffffffffffffff9c, &(0x7f0000000180), 0x2, 0x0) syz_genetlink_get_family_id$mptcp(&(0x7f0000000300), r3) r4 = openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000500)='./cgroup/syz1\x00', 0x200002, 0x0) syz_io_uring_submit(0x0, r2, &(0x7f0000000580)=@IORING_OP_FILES_UPDATE={0x14, 0x4, 0x0, 0x0, 0x40, &(0x7f0000000540)=[0xffffffffffffffff, 0xffffffffffffffff, r4, r0, r1], 0x5}, 0x3) io_uring_setup(0x2812, &(0x7f00000005c0)={0x0, 0x5e1b, 0x2, 0x3, 0x12f}) socket$inet6_tcp(0xa, 0x1, 0x0) io_uring_setup(0x7c8f, &(0x7f0000001140)={0x0, 0xc240, 0x10, 0x3, 0x1c7}) 21:18:03 executing program 0: r0 = syz_io_uring_setup(0x8fe, &(0x7f0000000080), &(0x7f0000ffb000/0x2000)=nil, &(0x7f0000ffb000/0x4000)=nil, &(0x7f0000000100), 0x0) openat$hwrng(0xffffffffffffff9c, &(0x7f0000000180), 0x2, 0x0) r1 = openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000500)='./cgroup/syz1\x00', 0x200002, 0x0) syz_io_uring_submit(0x0, 0x0, &(0x7f0000000580)=@IORING_OP_FILES_UPDATE={0x14, 0x4, 0x0, 0x0, 0x40, &(0x7f0000000540)=[0xffffffffffffffff, 0xffffffffffffffff, r1, 0xffffffffffffffff, r0], 0x5}, 0x3) io_uring_setup(0x2812, &(0x7f00000005c0)={0x0, 0x5e1b, 0x2, 0x3, 0x12f}) socket$inet6_tcp(0xa, 0x1, 0x0) 21:18:03 executing program 7: pipe2$9p(&(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}, 0x0) write$P9_RSYMLINK(r0, 0x0, 0x0) add_key$fscrypt_v1(&(0x7f0000000280), &(0x7f00000002c0)={'fscrypt:', @desc2}, 0x0, 0x0, 0xfffffffffffffffa) syz_genetlink_get_family_id$mptcp(0x0, 0xffffffffffffffff) openat$vcsa(0xffffffffffffff9c, &(0x7f00000009c0), 0x14200, 0x0) syz_genetlink_get_family_id$mptcp(&(0x7f0000000a80), 0xffffffffffffffff) 21:18:03 executing program 2: syz_genetlink_get_family_id$nl80211(&(0x7f00000000c0), 0xffffffffffffffff) syz_open_dev$vcsa(&(0x7f0000000440), 0x56, 0x4000) socketpair(0x0, 0x0, 0x0, &(0x7f0000000640)) openat$tcp_congestion(0xffffffffffffff9c, &(0x7f0000000800), 0x1, 0x0) write$tcp_congestion(0xffffffffffffffff, &(0x7f0000000840)='htcp\x00', 0x5) 21:18:03 executing program 6: r0 = io_uring_setup(0x0, &(0x7f0000000000)={0x0, 0x7682, 0x20, 0x1, 0x1be}) r1 = syz_io_uring_setup(0x8fe, &(0x7f0000000080)={0x0, 0x1830, 0x0, 0x0, 0x1b8, 0x0, r0}, &(0x7f0000ffb000/0x2000)=nil, &(0x7f0000ffb000/0x4000)=nil, &(0x7f0000000100), &(0x7f0000000140)=0x0) r3 = openat$hwrng(0xffffffffffffff9c, &(0x7f0000000180), 0x2, 0x0) r4 = syz_genetlink_get_family_id$mptcp(&(0x7f0000000300), r3) sendmsg$MPTCP_PM_CMD_ADD_ADDR(r3, &(0x7f00000003c0)={&(0x7f00000002c0)={0x10, 0x0, 0x0, 0x10}, 0xc, &(0x7f0000000380)={&(0x7f0000000340)={0x24, r4, 0x300, 0x70bd26, 0x25dfdbfb, {}, [@MPTCP_PM_ATTR_SUBFLOWS={0x8, 0x3, 0x1}, @MPTCP_PM_ATTR_RCV_ADD_ADDRS={0x8, 0x2, 0x2}]}, 0x24}, 0x1, 0x0, 0x0, 0x20000004}, 0x8890) syz_io_uring_setup(0x20f8, &(0x7f0000000400)={0x0, 0x7677, 0x8, 0x3, 0x22f}, &(0x7f0000ffe000/0x2000)=nil, &(0x7f0000ffb000/0x2000)=nil, &(0x7f0000000480)=0x0, &(0x7f00000004c0)) r6 = openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000500)='./cgroup/syz1\x00', 0x200002, 0x0) syz_io_uring_submit(r5, r2, &(0x7f0000000580)=@IORING_OP_FILES_UPDATE={0x14, 0x4, 0x0, 0x0, 0x40, &(0x7f0000000540)=[0xffffffffffffffff, 0xffffffffffffffff, r6, r0, r1], 0x5}, 0x3) socket$inet6_tcp(0xa, 0x1, 0x0) openat$procfs(0xffffffffffffff9c, &(0x7f00000010c0)='/proc/crypto\x00', 0x0, 0x0) io_uring_setup(0x7c8f, &(0x7f0000001140)={0x0, 0xc240, 0x10, 0x3, 0x1c7}) 21:18:03 executing program 5: r0 = io_uring_setup(0x355e, &(0x7f0000000000)={0x0, 0x7682, 0x20, 0x1, 0x1be}) r1 = openat$hwrng(0xffffffffffffff9c, &(0x7f0000000180), 0x2, 0x0) r2 = syz_io_uring_setup(0x65dd, &(0x7f00000001c0)={0x0, 0xf46f, 0x20, 0x2, 0xdf}, &(0x7f0000ffe000/0x1000)=nil, &(0x7f0000ffd000/0x1000)=nil, &(0x7f0000000240), &(0x7f0000000280)) r3 = syz_genetlink_get_family_id$mptcp(&(0x7f0000000300), r1) sendmsg$MPTCP_PM_CMD_ADD_ADDR(r1, &(0x7f00000003c0)={&(0x7f00000002c0)={0x10, 0x0, 0x0, 0x10}, 0xc, &(0x7f0000000380)={&(0x7f0000000340)={0x24, r3, 0x300, 0x70bd26, 0x25dfdbfb, {}, [@MPTCP_PM_ATTR_SUBFLOWS={0x8, 0x3, 0x1}, @MPTCP_PM_ATTR_RCV_ADD_ADDRS={0x8, 0x2, 0x2}]}, 0x24}, 0x1, 0x0, 0x0, 0x20000004}, 0x8890) r4 = openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000500)='./cgroup/syz1\x00', 0x200002, 0x0) syz_io_uring_submit(0x0, 0x0, &(0x7f0000000580)=@IORING_OP_FILES_UPDATE={0x14, 0x4, 0x0, 0x0, 0x40, &(0x7f0000000540)=[r2, 0xffffffffffffffff, r4, r0, 0xffffffffffffffff], 0x5}, 0x3) socket$inet6_tcp(0xa, 0x1, 0x0) openat$procfs(0xffffffffffffff9c, &(0x7f00000010c0)='/proc/crypto\x00', 0x0, 0x0) 21:18:03 executing program 1: r0 = io_uring_setup(0x355e, &(0x7f0000000000)={0x0, 0x0, 0x20, 0x0, 0x1be}) r1 = openat$hwrng(0xffffffffffffff9c, &(0x7f0000000180), 0x2, 0x0) r2 = syz_io_uring_setup(0x65dd, &(0x7f00000001c0)={0x0, 0xf46f, 0x20, 0x2, 0xdf}, &(0x7f0000ffe000/0x1000)=nil, &(0x7f0000ffd000/0x1000)=nil, &(0x7f0000000240), &(0x7f0000000280)) syz_genetlink_get_family_id$mptcp(&(0x7f0000000300), r1) syz_io_uring_setup(0x20f8, &(0x7f0000000400)={0x0, 0x7677, 0x8, 0x3, 0x22f, 0x0, r2}, &(0x7f0000ffe000/0x2000)=nil, &(0x7f0000ffb000/0x2000)=nil, &(0x7f0000000480)=0x0, &(0x7f00000004c0)) r4 = openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000500)='./cgroup/syz1\x00', 0x200002, 0x0) syz_io_uring_submit(r3, 0x0, &(0x7f0000000580)=@IORING_OP_FILES_UPDATE={0x14, 0x4, 0x0, 0x0, 0x40, &(0x7f0000000540)=[r2, 0xffffffffffffffff, r4, r0, 0xffffffffffffffff], 0x5}, 0x3) io_uring_setup(0x2812, &(0x7f00000005c0)={0x0, 0x5e1b, 0x2, 0x3, 0x12f, 0x0, r2}) socket$inet6_tcp(0xa, 0x1, 0x0) openat$procfs(0xffffffffffffff9c, &(0x7f00000010c0)='/proc/crypto\x00', 0x0, 0x0) io_uring_setup(0x7c8f, &(0x7f0000001140)={0x0, 0xc240, 0x10, 0x3, 0x1c7, 0x0, r2}) 21:18:03 executing program 4: ioctl$SCSI_IOCTL_DOORUNLOCK(0xffffffffffffffff, 0x5381) r0 = syz_open_dev$mouse(&(0x7f0000000000), 0x0, 0x4000) ioctl$SG_GET_PACK_ID(r0, 0x227c, &(0x7f0000000040)) syz_genetlink_get_family_id$nl80211(&(0x7f00000000c0), r0) syz_open_dev$vcsa(&(0x7f0000000440), 0x56, 0x4000) socketpair(0x0, 0x3, 0x6, &(0x7f0000000640)) r1 = openat$tcp_congestion(0xffffffffffffff9c, &(0x7f0000000800), 0x1, 0x0) write$tcp_congestion(r1, &(0x7f0000000840)='htcp\x00', 0x5) 21:18:03 executing program 0: r0 = syz_io_uring_setup(0x8fe, &(0x7f0000000080), &(0x7f0000ffb000/0x2000)=nil, &(0x7f0000ffb000/0x4000)=nil, &(0x7f0000000100), 0x0) openat$hwrng(0xffffffffffffff9c, &(0x7f0000000180), 0x2, 0x0) r1 = openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000500)='./cgroup/syz1\x00', 0x200002, 0x0) syz_io_uring_submit(0x0, 0x0, &(0x7f0000000580)=@IORING_OP_FILES_UPDATE={0x14, 0x4, 0x0, 0x0, 0x40, &(0x7f0000000540)=[0xffffffffffffffff, 0xffffffffffffffff, r1, 0xffffffffffffffff, r0], 0x5}, 0x3) io_uring_setup(0x2812, &(0x7f00000005c0)={0x0, 0x5e1b, 0x2, 0x3, 0x12f}) socket$inet6_tcp(0xa, 0x1, 0x0) 21:18:03 executing program 2: syz_genetlink_get_family_id$nl80211(&(0x7f00000000c0), 0xffffffffffffffff) syz_open_dev$vcsa(&(0x7f0000000440), 0x56, 0x4000) socketpair(0x0, 0x0, 0x0, &(0x7f0000000640)) openat$tcp_congestion(0xffffffffffffff9c, &(0x7f0000000800), 0x1, 0x0) write$tcp_congestion(0xffffffffffffffff, &(0x7f0000000840)='htcp\x00', 0x5) 21:18:04 executing program 6: r0 = io_uring_setup(0x355e, 0x0) r1 = syz_io_uring_setup(0x8fe, &(0x7f0000000080)={0x0, 0x1830, 0x0, 0x0, 0x1b8, 0x0, r0}, &(0x7f0000ffb000/0x2000)=nil, &(0x7f0000ffb000/0x4000)=nil, &(0x7f0000000100), &(0x7f0000000140)=0x0) r3 = openat$hwrng(0xffffffffffffff9c, &(0x7f0000000180), 0x2, 0x0) r4 = syz_genetlink_get_family_id$mptcp(&(0x7f0000000300), r3) sendmsg$MPTCP_PM_CMD_ADD_ADDR(r3, &(0x7f00000003c0)={&(0x7f00000002c0)={0x10, 0x0, 0x0, 0x10}, 0xc, &(0x7f0000000380)={&(0x7f0000000340)={0x24, r4, 0x300, 0x70bd26, 0x25dfdbfb, {}, [@MPTCP_PM_ATTR_SUBFLOWS={0x8, 0x3, 0x1}, @MPTCP_PM_ATTR_RCV_ADD_ADDRS={0x8, 0x2, 0x2}]}, 0x24}, 0x1, 0x0, 0x0, 0x20000004}, 0x8890) syz_io_uring_setup(0x20f8, &(0x7f0000000400)={0x0, 0x7677, 0x8, 0x3, 0x22f}, &(0x7f0000ffe000/0x2000)=nil, &(0x7f0000ffb000/0x2000)=nil, &(0x7f0000000480)=0x0, &(0x7f00000004c0)) r6 = openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000500)='./cgroup/syz1\x00', 0x200002, 0x0) syz_io_uring_submit(r5, r2, &(0x7f0000000580)=@IORING_OP_FILES_UPDATE={0x14, 0x4, 0x0, 0x0, 0x40, &(0x7f0000000540)=[0xffffffffffffffff, 0xffffffffffffffff, r6, r0, r1], 0x5}, 0x3) socket$inet6_tcp(0xa, 0x1, 0x0) openat$procfs(0xffffffffffffff9c, &(0x7f00000010c0)='/proc/crypto\x00', 0x0, 0x0) io_uring_setup(0x7c8f, &(0x7f0000001140)={0x0, 0xc240, 0x10, 0x3, 0x1c7}) 21:18:04 executing program 1: r0 = io_uring_setup(0x355e, &(0x7f0000000000)={0x0, 0x0, 0x20, 0x0, 0x1be}) r1 = openat$hwrng(0xffffffffffffff9c, &(0x7f0000000180), 0x2, 0x0) r2 = syz_io_uring_setup(0x65dd, &(0x7f00000001c0)={0x0, 0xf46f, 0x20, 0x2, 0xdf}, &(0x7f0000ffe000/0x1000)=nil, &(0x7f0000ffd000/0x1000)=nil, &(0x7f0000000240), &(0x7f0000000280)) syz_genetlink_get_family_id$mptcp(&(0x7f0000000300), r1) syz_io_uring_setup(0x20f8, &(0x7f0000000400)={0x0, 0x7677, 0x8, 0x3, 0x22f, 0x0, r2}, &(0x7f0000ffe000/0x2000)=nil, &(0x7f0000ffb000/0x2000)=nil, &(0x7f0000000480)=0x0, &(0x7f00000004c0)) r4 = openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000500)='./cgroup/syz1\x00', 0x200002, 0x0) syz_io_uring_submit(r3, 0x0, &(0x7f0000000580)=@IORING_OP_FILES_UPDATE={0x14, 0x4, 0x0, 0x0, 0x40, &(0x7f0000000540)=[r2, 0xffffffffffffffff, r4, r0, 0xffffffffffffffff], 0x5}, 0x3) io_uring_setup(0x2812, &(0x7f00000005c0)={0x0, 0x5e1b, 0x2, 0x3, 0x12f, 0x0, r2}) socket$inet6_tcp(0xa, 0x1, 0x0) openat$procfs(0xffffffffffffff9c, &(0x7f00000010c0)='/proc/crypto\x00', 0x0, 0x0) io_uring_setup(0x7c8f, &(0x7f0000001140)={0x0, 0xc240, 0x10, 0x3, 0x1c7, 0x0, r2}) 21:18:04 executing program 3: r0 = io_uring_setup(0x0, &(0x7f0000000000)={0x0, 0x7682, 0x20, 0x1, 0x1be}) r1 = syz_io_uring_setup(0x8fe, &(0x7f0000000080)={0x0, 0x1830, 0x0, 0x0, 0x1b8, 0x0, r0}, &(0x7f0000ffb000/0x2000)=nil, &(0x7f0000ffb000/0x4000)=nil, &(0x7f0000000100), &(0x7f0000000140)=0x0) r3 = openat$hwrng(0xffffffffffffff9c, &(0x7f0000000180), 0x2, 0x0) syz_genetlink_get_family_id$mptcp(&(0x7f0000000300), r3) r4 = openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000500)='./cgroup/syz1\x00', 0x200002, 0x0) syz_io_uring_submit(0x0, r2, &(0x7f0000000580)=@IORING_OP_FILES_UPDATE={0x14, 0x4, 0x0, 0x0, 0x40, &(0x7f0000000540)=[0xffffffffffffffff, 0xffffffffffffffff, r4, r0, r1], 0x5}, 0x3) io_uring_setup(0x2812, &(0x7f00000005c0)={0x0, 0x5e1b, 0x2, 0x3, 0x12f}) socket$inet6_tcp(0xa, 0x1, 0x0) io_uring_setup(0x7c8f, &(0x7f0000001140)={0x0, 0xc240, 0x10, 0x3, 0x1c7}) 21:18:04 executing program 7: pipe2$9p(&(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}, 0x0) write$P9_RSYMLINK(r0, 0x0, 0x0) add_key$fscrypt_v1(&(0x7f0000000280), &(0x7f00000002c0)={'fscrypt:', @desc2}, 0x0, 0x0, 0xfffffffffffffffa) syz_genetlink_get_family_id$mptcp(0x0, 0xffffffffffffffff) openat$vcsa(0xffffffffffffff9c, &(0x7f00000009c0), 0x14200, 0x0) syz_genetlink_get_family_id$mptcp(&(0x7f0000000a80), 0xffffffffffffffff) 21:18:14 executing program 4: ioctl$SCSI_IOCTL_DOORUNLOCK(0xffffffffffffffff, 0x5381) r0 = syz_open_dev$mouse(&(0x7f0000000000), 0x0, 0x4000) ioctl$SG_GET_PACK_ID(r0, 0x227c, &(0x7f0000000040)) syz_genetlink_get_family_id$nl80211(&(0x7f00000000c0), r0) syz_open_dev$vcsa(&(0x7f0000000440), 0x56, 0x4000) socketpair(0x0, 0x3, 0x6, &(0x7f0000000640)) r1 = openat$tcp_congestion(0xffffffffffffff9c, &(0x7f0000000800), 0x1, 0x0) write$tcp_congestion(r1, &(0x7f0000000840)='htcp\x00', 0x5) 21:18:14 executing program 3: r0 = io_uring_setup(0x355e, 0x0) r1 = syz_io_uring_setup(0x8fe, &(0x7f0000000080)={0x0, 0x1830, 0x0, 0x0, 0x1b8, 0x0, r0}, &(0x7f0000ffb000/0x2000)=nil, &(0x7f0000ffb000/0x4000)=nil, &(0x7f0000000100), &(0x7f0000000140)=0x0) r3 = openat$hwrng(0xffffffffffffff9c, &(0x7f0000000180), 0x2, 0x0) syz_genetlink_get_family_id$mptcp(&(0x7f0000000300), r3) r4 = openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000500)='./cgroup/syz1\x00', 0x200002, 0x0) syz_io_uring_submit(0x0, r2, &(0x7f0000000580)=@IORING_OP_FILES_UPDATE={0x14, 0x4, 0x0, 0x0, 0x40, &(0x7f0000000540)=[0xffffffffffffffff, 0xffffffffffffffff, r4, r0, r1], 0x5}, 0x3) io_uring_setup(0x2812, &(0x7f00000005c0)={0x0, 0x5e1b, 0x2, 0x3, 0x12f}) socket$inet6_tcp(0xa, 0x1, 0x0) io_uring_setup(0x7c8f, &(0x7f0000001140)={0x0, 0xc240, 0x10, 0x3, 0x1c7}) 21:18:14 executing program 7: pipe2$9p(&(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}, 0x0) write$P9_RSYMLINK(r0, 0x0, 0x0) add_key$fscrypt_v1(&(0x7f0000000280), &(0x7f00000002c0)={'fscrypt:', @desc2}, 0x0, 0x0, 0xfffffffffffffffa) syz_genetlink_get_family_id$mptcp(&(0x7f00000004c0), 0xffffffffffffffff) openat$vcsa(0xffffffffffffff9c, 0x0, 0x14200, 0x0) syz_genetlink_get_family_id$mptcp(&(0x7f0000000a80), 0xffffffffffffffff) 21:18:14 executing program 2: syz_genetlink_get_family_id$nl80211(&(0x7f00000000c0), 0xffffffffffffffff) syz_open_dev$vcsa(&(0x7f0000000440), 0x56, 0x4000) socketpair(0x0, 0x0, 0x0, &(0x7f0000000640)) openat$tcp_congestion(0xffffffffffffff9c, &(0x7f0000000800), 0x1, 0x0) write$tcp_congestion(0xffffffffffffffff, &(0x7f0000000840)='htcp\x00', 0x5) 21:18:14 executing program 6: r0 = io_uring_setup(0x355e, 0x0) r1 = syz_io_uring_setup(0x8fe, &(0x7f0000000080)={0x0, 0x1830, 0x0, 0x0, 0x1b8, 0x0, r0}, &(0x7f0000ffb000/0x2000)=nil, &(0x7f0000ffb000/0x4000)=nil, &(0x7f0000000100), &(0x7f0000000140)=0x0) r3 = openat$hwrng(0xffffffffffffff9c, &(0x7f0000000180), 0x2, 0x0) r4 = syz_genetlink_get_family_id$mptcp(&(0x7f0000000300), r3) sendmsg$MPTCP_PM_CMD_ADD_ADDR(r3, &(0x7f00000003c0)={&(0x7f00000002c0)={0x10, 0x0, 0x0, 0x10}, 0xc, &(0x7f0000000380)={&(0x7f0000000340)={0x24, r4, 0x300, 0x70bd26, 0x25dfdbfb, {}, [@MPTCP_PM_ATTR_SUBFLOWS={0x8, 0x3, 0x1}, @MPTCP_PM_ATTR_RCV_ADD_ADDRS={0x8, 0x2, 0x2}]}, 0x24}, 0x1, 0x0, 0x0, 0x20000004}, 0x8890) syz_io_uring_setup(0x20f8, &(0x7f0000000400)={0x0, 0x7677, 0x8, 0x3, 0x22f}, &(0x7f0000ffe000/0x2000)=nil, &(0x7f0000ffb000/0x2000)=nil, &(0x7f0000000480)=0x0, &(0x7f00000004c0)) r6 = openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000500)='./cgroup/syz1\x00', 0x200002, 0x0) syz_io_uring_submit(r5, r2, &(0x7f0000000580)=@IORING_OP_FILES_UPDATE={0x14, 0x4, 0x0, 0x0, 0x40, &(0x7f0000000540)=[0xffffffffffffffff, 0xffffffffffffffff, r6, r0, r1], 0x5}, 0x3) socket$inet6_tcp(0xa, 0x1, 0x0) openat$procfs(0xffffffffffffff9c, &(0x7f00000010c0)='/proc/crypto\x00', 0x0, 0x0) io_uring_setup(0x7c8f, &(0x7f0000001140)={0x0, 0xc240, 0x10, 0x3, 0x1c7}) 21:18:14 executing program 1: r0 = io_uring_setup(0x355e, &(0x7f0000000000)={0x0, 0x0, 0x20, 0x1}) r1 = openat$hwrng(0xffffffffffffff9c, &(0x7f0000000180), 0x2, 0x0) r2 = syz_io_uring_setup(0x65dd, &(0x7f00000001c0)={0x0, 0xf46f, 0x20, 0x2, 0xdf}, &(0x7f0000ffe000/0x1000)=nil, &(0x7f0000ffd000/0x1000)=nil, &(0x7f0000000240), &(0x7f0000000280)) syz_genetlink_get_family_id$mptcp(&(0x7f0000000300), r1) syz_io_uring_setup(0x20f8, &(0x7f0000000400)={0x0, 0x7677, 0x8, 0x3, 0x22f, 0x0, r2}, &(0x7f0000ffe000/0x2000)=nil, &(0x7f0000ffb000/0x2000)=nil, &(0x7f0000000480)=0x0, &(0x7f00000004c0)) r4 = openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000500)='./cgroup/syz1\x00', 0x200002, 0x0) syz_io_uring_submit(r3, 0x0, &(0x7f0000000580)=@IORING_OP_FILES_UPDATE={0x14, 0x4, 0x0, 0x0, 0x40, &(0x7f0000000540)=[r2, 0xffffffffffffffff, r4, r0, 0xffffffffffffffff], 0x5}, 0x3) io_uring_setup(0x2812, &(0x7f00000005c0)={0x0, 0x5e1b, 0x2, 0x3, 0x12f, 0x0, r2}) socket$inet6_tcp(0xa, 0x1, 0x0) openat$procfs(0xffffffffffffff9c, &(0x7f00000010c0)='/proc/crypto\x00', 0x0, 0x0) io_uring_setup(0x7c8f, &(0x7f0000001140)={0x0, 0xc240, 0x10, 0x3, 0x1c7, 0x0, r2}) 21:18:14 executing program 0: r0 = syz_io_uring_setup(0x8fe, &(0x7f0000000080), &(0x7f0000ffb000/0x2000)=nil, &(0x7f0000ffb000/0x4000)=nil, &(0x7f0000000100), 0x0) openat$hwrng(0xffffffffffffff9c, &(0x7f0000000180), 0x2, 0x0) r1 = openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000500)='./cgroup/syz1\x00', 0x200002, 0x0) syz_io_uring_submit(0x0, 0x0, &(0x7f0000000580)=@IORING_OP_FILES_UPDATE={0x14, 0x4, 0x0, 0x0, 0x40, &(0x7f0000000540)=[0xffffffffffffffff, 0xffffffffffffffff, r1, 0xffffffffffffffff, r0], 0x5}, 0x3) io_uring_setup(0x2812, &(0x7f00000005c0)={0x0, 0x5e1b, 0x2, 0x3, 0x12f}) socket$inet6_tcp(0xa, 0x1, 0x0) 21:18:14 executing program 5: r0 = syz_io_uring_setup(0x8fe, &(0x7f0000000080)={0x0, 0x1830, 0x0, 0x0, 0x1b8}, &(0x7f0000ffb000/0x2000)=nil, &(0x7f0000ffb000/0x4000)=nil, &(0x7f0000000100), &(0x7f0000000140)=0x0) r2 = openat$hwrng(0xffffffffffffff9c, &(0x7f0000000180), 0x2, 0x0) r3 = syz_io_uring_setup(0x65dd, &(0x7f00000001c0)={0x0, 0xf46f, 0x20, 0x2, 0xdf}, &(0x7f0000ffe000/0x1000)=nil, &(0x7f0000ffd000/0x1000)=nil, &(0x7f0000000240), &(0x7f0000000280)) r4 = syz_genetlink_get_family_id$mptcp(&(0x7f0000000300), r2) sendmsg$MPTCP_PM_CMD_ADD_ADDR(r2, &(0x7f00000003c0)={&(0x7f00000002c0)={0x10, 0x0, 0x0, 0x10}, 0xc, &(0x7f0000000380)={&(0x7f0000000340)={0x24, r4, 0x300, 0x70bd26, 0x25dfdbfb, {}, [@MPTCP_PM_ATTR_SUBFLOWS={0x8, 0x3, 0x1}, @MPTCP_PM_ATTR_RCV_ADD_ADDRS={0x8, 0x2, 0x2}]}, 0x24}, 0x1, 0x0, 0x0, 0x20000004}, 0x8890) r5 = openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000500)='./cgroup/syz1\x00', 0x200002, 0x0) syz_io_uring_submit(0x0, r1, &(0x7f0000000580)=@IORING_OP_FILES_UPDATE={0x14, 0x4, 0x0, 0x0, 0x40, &(0x7f0000000540)=[r3, 0xffffffffffffffff, r5, 0xffffffffffffffff, r0], 0x5}, 0x3) socket$inet6_tcp(0xa, 0x1, 0x0) openat$procfs(0xffffffffffffff9c, &(0x7f00000010c0)='/proc/crypto\x00', 0x0, 0x0) 21:18:14 executing program 0: r0 = syz_io_uring_setup(0x8fe, &(0x7f0000000080), &(0x7f0000ffb000/0x2000)=nil, &(0x7f0000ffb000/0x4000)=nil, &(0x7f0000000100), &(0x7f0000000140)=0x0) openat$hwrng(0xffffffffffffff9c, 0x0, 0x2, 0x0) r2 = openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000500)='./cgroup/syz1\x00', 0x200002, 0x0) syz_io_uring_submit(0x0, r1, &(0x7f0000000580)=@IORING_OP_FILES_UPDATE={0x14, 0x4, 0x0, 0x0, 0x40, &(0x7f0000000540)=[0xffffffffffffffff, 0xffffffffffffffff, r2, 0xffffffffffffffff, r0], 0x5}, 0x3) io_uring_setup(0x2812, &(0x7f00000005c0)={0x0, 0x5e1b, 0x2, 0x3, 0x12f}) socket$inet6_tcp(0xa, 0x1, 0x0) 21:18:14 executing program 6: r0 = io_uring_setup(0x355e, 0x0) r1 = syz_io_uring_setup(0x8fe, &(0x7f0000000080)={0x0, 0x1830, 0x0, 0x0, 0x1b8, 0x0, r0}, &(0x7f0000ffb000/0x2000)=nil, &(0x7f0000ffb000/0x4000)=nil, &(0x7f0000000100), &(0x7f0000000140)=0x0) r3 = openat$hwrng(0xffffffffffffff9c, &(0x7f0000000180), 0x2, 0x0) r4 = syz_genetlink_get_family_id$mptcp(&(0x7f0000000300), r3) sendmsg$MPTCP_PM_CMD_ADD_ADDR(r3, &(0x7f00000003c0)={&(0x7f00000002c0)={0x10, 0x0, 0x0, 0x10}, 0xc, &(0x7f0000000380)={&(0x7f0000000340)={0x24, r4, 0x300, 0x70bd26, 0x25dfdbfb, {}, [@MPTCP_PM_ATTR_SUBFLOWS={0x8, 0x3, 0x1}, @MPTCP_PM_ATTR_RCV_ADD_ADDRS={0x8, 0x2, 0x2}]}, 0x24}, 0x1, 0x0, 0x0, 0x20000004}, 0x8890) syz_io_uring_setup(0x20f8, &(0x7f0000000400)={0x0, 0x7677, 0x8, 0x3, 0x22f}, &(0x7f0000ffe000/0x2000)=nil, &(0x7f0000ffb000/0x2000)=nil, &(0x7f0000000480)=0x0, &(0x7f00000004c0)) r6 = openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000500)='./cgroup/syz1\x00', 0x200002, 0x0) syz_io_uring_submit(r5, r2, &(0x7f0000000580)=@IORING_OP_FILES_UPDATE={0x14, 0x4, 0x0, 0x0, 0x40, &(0x7f0000000540)=[0xffffffffffffffff, 0xffffffffffffffff, r6, r0, r1], 0x5}, 0x3) socket$inet6_tcp(0xa, 0x1, 0x0) openat$procfs(0xffffffffffffff9c, &(0x7f00000010c0)='/proc/crypto\x00', 0x0, 0x0) io_uring_setup(0x7c8f, &(0x7f0000001140)={0x0, 0xc240, 0x10, 0x3, 0x1c7}) 21:18:14 executing program 7: pipe2$9p(&(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}, 0x0) write$P9_RSYMLINK(r0, 0x0, 0x0) add_key$fscrypt_v1(&(0x7f0000000280), &(0x7f00000002c0)={'fscrypt:', @desc2}, 0x0, 0x0, 0xfffffffffffffffa) syz_genetlink_get_family_id$mptcp(&(0x7f00000004c0), 0xffffffffffffffff) openat$vcsa(0xffffffffffffff9c, 0x0, 0x14200, 0x0) syz_genetlink_get_family_id$mptcp(&(0x7f0000000a80), 0xffffffffffffffff) 21:18:14 executing program 0: r0 = syz_io_uring_setup(0x8fe, &(0x7f0000000080), &(0x7f0000ffb000/0x2000)=nil, &(0x7f0000ffb000/0x4000)=nil, &(0x7f0000000100), &(0x7f0000000140)=0x0) openat$hwrng(0xffffffffffffff9c, 0x0, 0x2, 0x0) r2 = openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000500)='./cgroup/syz1\x00', 0x200002, 0x0) syz_io_uring_submit(0x0, r1, &(0x7f0000000580)=@IORING_OP_FILES_UPDATE={0x14, 0x4, 0x0, 0x0, 0x40, &(0x7f0000000540)=[0xffffffffffffffff, 0xffffffffffffffff, r2, 0xffffffffffffffff, r0], 0x5}, 0x3) io_uring_setup(0x2812, &(0x7f00000005c0)={0x0, 0x5e1b, 0x2, 0x3, 0x12f}) socket$inet6_tcp(0xa, 0x1, 0x0) 21:18:14 executing program 2: syz_genetlink_get_family_id$nl80211(&(0x7f00000000c0), 0xffffffffffffffff) syz_open_dev$vcsa(&(0x7f0000000440), 0x56, 0x4000) socketpair(0x0, 0x0, 0x0, &(0x7f0000000640)) r0 = openat$tcp_congestion(0xffffffffffffff9c, &(0x7f0000000800), 0x1, 0x0) write$tcp_congestion(r0, 0x0, 0x0) 21:18:14 executing program 1: r0 = io_uring_setup(0x355e, &(0x7f0000000000)={0x0, 0x0, 0x20, 0x1}) r1 = openat$hwrng(0xffffffffffffff9c, &(0x7f0000000180), 0x2, 0x0) r2 = syz_io_uring_setup(0x65dd, &(0x7f00000001c0)={0x0, 0xf46f, 0x20, 0x2, 0xdf}, &(0x7f0000ffe000/0x1000)=nil, &(0x7f0000ffd000/0x1000)=nil, &(0x7f0000000240), &(0x7f0000000280)) syz_genetlink_get_family_id$mptcp(&(0x7f0000000300), r1) syz_io_uring_setup(0x20f8, &(0x7f0000000400)={0x0, 0x7677, 0x8, 0x3, 0x22f, 0x0, r2}, &(0x7f0000ffe000/0x2000)=nil, &(0x7f0000ffb000/0x2000)=nil, &(0x7f0000000480)=0x0, &(0x7f00000004c0)) r4 = openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000500)='./cgroup/syz1\x00', 0x200002, 0x0) syz_io_uring_submit(r3, 0x0, &(0x7f0000000580)=@IORING_OP_FILES_UPDATE={0x14, 0x4, 0x0, 0x0, 0x40, &(0x7f0000000540)=[r2, 0xffffffffffffffff, r4, r0, 0xffffffffffffffff], 0x5}, 0x3) io_uring_setup(0x2812, &(0x7f00000005c0)={0x0, 0x5e1b, 0x2, 0x3, 0x12f, 0x0, r2}) socket$inet6_tcp(0xa, 0x1, 0x0) openat$procfs(0xffffffffffffff9c, &(0x7f00000010c0)='/proc/crypto\x00', 0x0, 0x0) io_uring_setup(0x7c8f, &(0x7f0000001140)={0x0, 0xc240, 0x10, 0x3, 0x1c7, 0x0, r2}) 21:18:14 executing program 3: r0 = io_uring_setup(0x355e, 0x0) r1 = syz_io_uring_setup(0x8fe, &(0x7f0000000080)={0x0, 0x1830, 0x0, 0x0, 0x1b8, 0x0, r0}, &(0x7f0000ffb000/0x2000)=nil, &(0x7f0000ffb000/0x4000)=nil, &(0x7f0000000100), &(0x7f0000000140)=0x0) r3 = openat$hwrng(0xffffffffffffff9c, &(0x7f0000000180), 0x2, 0x0) syz_genetlink_get_family_id$mptcp(&(0x7f0000000300), r3) r4 = openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000500)='./cgroup/syz1\x00', 0x200002, 0x0) syz_io_uring_submit(0x0, r2, &(0x7f0000000580)=@IORING_OP_FILES_UPDATE={0x14, 0x4, 0x0, 0x0, 0x40, &(0x7f0000000540)=[0xffffffffffffffff, 0xffffffffffffffff, r4, r0, r1], 0x5}, 0x3) io_uring_setup(0x2812, &(0x7f00000005c0)={0x0, 0x5e1b, 0x2, 0x3, 0x12f}) socket$inet6_tcp(0xa, 0x1, 0x0) io_uring_setup(0x7c8f, &(0x7f0000001140)={0x0, 0xc240, 0x10, 0x3, 0x1c7}) 21:18:23 executing program 0: r0 = syz_io_uring_setup(0x8fe, &(0x7f0000000080), &(0x7f0000ffb000/0x2000)=nil, &(0x7f0000ffb000/0x4000)=nil, &(0x7f0000000100), &(0x7f0000000140)=0x0) openat$hwrng(0xffffffffffffff9c, 0x0, 0x2, 0x0) r2 = openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000500)='./cgroup/syz1\x00', 0x200002, 0x0) syz_io_uring_submit(0x0, r1, &(0x7f0000000580)=@IORING_OP_FILES_UPDATE={0x14, 0x4, 0x0, 0x0, 0x40, &(0x7f0000000540)=[0xffffffffffffffff, 0xffffffffffffffff, r2, 0xffffffffffffffff, r0], 0x5}, 0x3) io_uring_setup(0x2812, &(0x7f00000005c0)={0x0, 0x5e1b, 0x2, 0x3, 0x12f}) socket$inet6_tcp(0xa, 0x1, 0x0) 21:18:23 executing program 5: r0 = syz_io_uring_setup(0x8fe, &(0x7f0000000080)={0x0, 0x1830, 0x0, 0x0, 0x1b8}, &(0x7f0000ffb000/0x2000)=nil, &(0x7f0000ffb000/0x4000)=nil, &(0x7f0000000100), &(0x7f0000000140)=0x0) r2 = openat$hwrng(0xffffffffffffff9c, &(0x7f0000000180), 0x2, 0x0) r3 = syz_io_uring_setup(0x65dd, &(0x7f00000001c0)={0x0, 0xf46f, 0x20, 0x2, 0xdf}, &(0x7f0000ffe000/0x1000)=nil, &(0x7f0000ffd000/0x1000)=nil, &(0x7f0000000240), &(0x7f0000000280)) r4 = syz_genetlink_get_family_id$mptcp(&(0x7f0000000300), r2) sendmsg$MPTCP_PM_CMD_ADD_ADDR(r2, &(0x7f00000003c0)={&(0x7f00000002c0)={0x10, 0x0, 0x0, 0x10}, 0xc, &(0x7f0000000380)={&(0x7f0000000340)={0x24, r4, 0x300, 0x70bd26, 0x25dfdbfb, {}, [@MPTCP_PM_ATTR_SUBFLOWS={0x8, 0x3, 0x1}, @MPTCP_PM_ATTR_RCV_ADD_ADDRS={0x8, 0x2, 0x2}]}, 0x24}, 0x1, 0x0, 0x0, 0x20000004}, 0x8890) r5 = openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000500)='./cgroup/syz1\x00', 0x200002, 0x0) syz_io_uring_submit(0x0, r1, &(0x7f0000000580)=@IORING_OP_FILES_UPDATE={0x14, 0x4, 0x0, 0x0, 0x40, &(0x7f0000000540)=[r3, 0xffffffffffffffff, r5, 0xffffffffffffffff, r0], 0x5}, 0x3) socket$inet6_tcp(0xa, 0x1, 0x0) openat$procfs(0xffffffffffffff9c, &(0x7f00000010c0)='/proc/crypto\x00', 0x0, 0x0) 21:18:23 executing program 1: r0 = io_uring_setup(0x355e, &(0x7f0000000000)={0x0, 0x0, 0x20, 0x1}) r1 = openat$hwrng(0xffffffffffffff9c, &(0x7f0000000180), 0x2, 0x0) r2 = syz_io_uring_setup(0x65dd, &(0x7f00000001c0)={0x0, 0xf46f, 0x20, 0x2, 0xdf}, &(0x7f0000ffe000/0x1000)=nil, &(0x7f0000ffd000/0x1000)=nil, &(0x7f0000000240), &(0x7f0000000280)) syz_genetlink_get_family_id$mptcp(&(0x7f0000000300), r1) syz_io_uring_setup(0x20f8, &(0x7f0000000400)={0x0, 0x7677, 0x8, 0x3, 0x22f, 0x0, r2}, &(0x7f0000ffe000/0x2000)=nil, &(0x7f0000ffb000/0x2000)=nil, &(0x7f0000000480)=0x0, &(0x7f00000004c0)) r4 = openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000500)='./cgroup/syz1\x00', 0x200002, 0x0) syz_io_uring_submit(r3, 0x0, &(0x7f0000000580)=@IORING_OP_FILES_UPDATE={0x14, 0x4, 0x0, 0x0, 0x40, &(0x7f0000000540)=[r2, 0xffffffffffffffff, r4, r0, 0xffffffffffffffff], 0x5}, 0x3) io_uring_setup(0x2812, &(0x7f00000005c0)={0x0, 0x5e1b, 0x2, 0x3, 0x12f, 0x0, r2}) socket$inet6_tcp(0xa, 0x1, 0x0) openat$procfs(0xffffffffffffff9c, &(0x7f00000010c0)='/proc/crypto\x00', 0x0, 0x0) io_uring_setup(0x7c8f, &(0x7f0000001140)={0x0, 0xc240, 0x10, 0x3, 0x1c7, 0x0, r2}) 21:18:23 executing program 3: r0 = io_uring_setup(0x355e, 0x0) r1 = syz_io_uring_setup(0x8fe, &(0x7f0000000080)={0x0, 0x1830, 0x0, 0x0, 0x1b8, 0x0, r0}, &(0x7f0000ffb000/0x2000)=nil, &(0x7f0000ffb000/0x4000)=nil, &(0x7f0000000100), &(0x7f0000000140)=0x0) r3 = openat$hwrng(0xffffffffffffff9c, &(0x7f0000000180), 0x2, 0x0) syz_genetlink_get_family_id$mptcp(&(0x7f0000000300), r3) r4 = openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000500)='./cgroup/syz1\x00', 0x200002, 0x0) syz_io_uring_submit(0x0, r2, &(0x7f0000000580)=@IORING_OP_FILES_UPDATE={0x14, 0x4, 0x0, 0x0, 0x40, &(0x7f0000000540)=[0xffffffffffffffff, 0xffffffffffffffff, r4, r0, r1], 0x5}, 0x3) io_uring_setup(0x2812, &(0x7f00000005c0)={0x0, 0x5e1b, 0x2, 0x3, 0x12f}) socket$inet6_tcp(0xa, 0x1, 0x0) io_uring_setup(0x7c8f, &(0x7f0000001140)={0x0, 0xc240, 0x10, 0x3, 0x1c7}) 21:18:23 executing program 6: r0 = io_uring_setup(0x355e, &(0x7f0000000000)={0x0, 0x0, 0x20, 0x1, 0x1be}) r1 = syz_io_uring_setup(0x8fe, &(0x7f0000000080)={0x0, 0x1830, 0x0, 0x0, 0x1b8, 0x0, r0}, &(0x7f0000ffb000/0x2000)=nil, &(0x7f0000ffb000/0x4000)=nil, &(0x7f0000000100), &(0x7f0000000140)=0x0) r3 = openat$hwrng(0xffffffffffffff9c, &(0x7f0000000180), 0x2, 0x0) r4 = syz_genetlink_get_family_id$mptcp(&(0x7f0000000300), r3) sendmsg$MPTCP_PM_CMD_ADD_ADDR(r3, &(0x7f00000003c0)={&(0x7f00000002c0)={0x10, 0x0, 0x0, 0x10}, 0xc, &(0x7f0000000380)={&(0x7f0000000340)={0x24, r4, 0x300, 0x70bd26, 0x25dfdbfb, {}, [@MPTCP_PM_ATTR_SUBFLOWS={0x8, 0x3, 0x1}, @MPTCP_PM_ATTR_RCV_ADD_ADDRS={0x8, 0x2, 0x2}]}, 0x24}, 0x1, 0x0, 0x0, 0x20000004}, 0x8890) syz_io_uring_setup(0x20f8, &(0x7f0000000400)={0x0, 0x7677, 0x8, 0x3, 0x22f}, &(0x7f0000ffe000/0x2000)=nil, &(0x7f0000ffb000/0x2000)=nil, &(0x7f0000000480)=0x0, &(0x7f00000004c0)) r6 = openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000500)='./cgroup/syz1\x00', 0x200002, 0x0) syz_io_uring_submit(r5, r2, &(0x7f0000000580)=@IORING_OP_FILES_UPDATE={0x14, 0x4, 0x0, 0x0, 0x40, &(0x7f0000000540)=[0xffffffffffffffff, 0xffffffffffffffff, r6, r0, r1], 0x5}, 0x3) socket$inet6_tcp(0xa, 0x1, 0x0) openat$procfs(0xffffffffffffff9c, &(0x7f00000010c0)='/proc/crypto\x00', 0x0, 0x0) io_uring_setup(0x7c8f, &(0x7f0000001140)={0x0, 0xc240, 0x10, 0x3, 0x1c7}) 21:18:23 executing program 7: pipe2$9p(&(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}, 0x0) write$P9_RSYMLINK(r0, 0x0, 0x0) add_key$fscrypt_v1(&(0x7f0000000280), &(0x7f00000002c0)={'fscrypt:', @desc2}, 0x0, 0x0, 0xfffffffffffffffa) syz_genetlink_get_family_id$mptcp(&(0x7f00000004c0), 0xffffffffffffffff) openat$vcsa(0xffffffffffffff9c, 0x0, 0x14200, 0x0) syz_genetlink_get_family_id$mptcp(&(0x7f0000000a80), 0xffffffffffffffff) 21:18:23 executing program 2: syz_genetlink_get_family_id$nl80211(&(0x7f00000000c0), 0xffffffffffffffff) syz_open_dev$vcsa(&(0x7f0000000440), 0x56, 0x4000) socketpair(0x0, 0x0, 0x0, &(0x7f0000000640)) r0 = openat$tcp_congestion(0xffffffffffffff9c, &(0x7f0000000800), 0x1, 0x0) write$tcp_congestion(r0, 0x0, 0x0) 21:18:23 executing program 4: ioctl$SCSI_IOCTL_DOORUNLOCK(0xffffffffffffffff, 0x5381) r0 = syz_open_dev$mouse(&(0x7f0000000000), 0x0, 0x4000) ioctl$SG_GET_PACK_ID(r0, 0x227c, &(0x7f0000000040)) syz_genetlink_get_family_id$nl80211(&(0x7f00000000c0), r0) syz_open_dev$vcsa(&(0x7f0000000440), 0x56, 0x4000) socketpair(0x0, 0x3, 0x6, &(0x7f0000000640)) r1 = openat$tcp_congestion(0xffffffffffffff9c, &(0x7f0000000800), 0x1, 0x0) write$tcp_congestion(r1, &(0x7f0000000840)='htcp\x00', 0x5) 21:18:23 executing program 3: r0 = io_uring_setup(0x355e, &(0x7f0000000000)={0x0, 0x0, 0x20, 0x1, 0x1be}) r1 = syz_io_uring_setup(0x8fe, &(0x7f0000000080)={0x0, 0x1830, 0x0, 0x0, 0x1b8, 0x0, r0}, &(0x7f0000ffb000/0x2000)=nil, &(0x7f0000ffb000/0x4000)=nil, &(0x7f0000000100), &(0x7f0000000140)=0x0) r3 = openat$hwrng(0xffffffffffffff9c, &(0x7f0000000180), 0x2, 0x0) syz_genetlink_get_family_id$mptcp(&(0x7f0000000300), r3) r4 = openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000500)='./cgroup/syz1\x00', 0x200002, 0x0) syz_io_uring_submit(0x0, r2, &(0x7f0000000580)=@IORING_OP_FILES_UPDATE={0x14, 0x4, 0x0, 0x0, 0x40, &(0x7f0000000540)=[0xffffffffffffffff, 0xffffffffffffffff, r4, r0, r1], 0x5}, 0x3) io_uring_setup(0x2812, &(0x7f00000005c0)={0x0, 0x5e1b, 0x2, 0x3, 0x12f}) socket$inet6_tcp(0xa, 0x1, 0x0) io_uring_setup(0x7c8f, &(0x7f0000001140)={0x0, 0xc240, 0x10, 0x3, 0x1c7}) 21:18:23 executing program 0: r0 = syz_io_uring_setup(0x8fe, &(0x7f0000000080), &(0x7f0000ffb000/0x2000)=nil, &(0x7f0000ffb000/0x4000)=nil, &(0x7f0000000100), &(0x7f0000000140)=0x0) openat$hwrng(0xffffffffffffff9c, &(0x7f0000000180), 0x0, 0x0) r2 = openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000500)='./cgroup/syz1\x00', 0x200002, 0x0) syz_io_uring_submit(0x0, r1, &(0x7f0000000580)=@IORING_OP_FILES_UPDATE={0x14, 0x4, 0x0, 0x0, 0x40, &(0x7f0000000540)=[0xffffffffffffffff, 0xffffffffffffffff, r2, 0xffffffffffffffff, r0], 0x5}, 0x3) io_uring_setup(0x2812, &(0x7f00000005c0)={0x0, 0x5e1b, 0x2, 0x3, 0x12f}) socket$inet6_tcp(0xa, 0x1, 0x0) 21:18:23 executing program 5: r0 = syz_io_uring_setup(0x8fe, &(0x7f0000000080)={0x0, 0x1830, 0x0, 0x0, 0x1b8}, &(0x7f0000ffb000/0x2000)=nil, &(0x7f0000ffb000/0x4000)=nil, &(0x7f0000000100), &(0x7f0000000140)=0x0) r2 = openat$hwrng(0xffffffffffffff9c, &(0x7f0000000180), 0x2, 0x0) r3 = syz_io_uring_setup(0x65dd, &(0x7f00000001c0)={0x0, 0xf46f, 0x20, 0x2, 0xdf}, &(0x7f0000ffe000/0x1000)=nil, &(0x7f0000ffd000/0x1000)=nil, &(0x7f0000000240), &(0x7f0000000280)) r4 = syz_genetlink_get_family_id$mptcp(&(0x7f0000000300), r2) sendmsg$MPTCP_PM_CMD_ADD_ADDR(r2, &(0x7f00000003c0)={&(0x7f00000002c0)={0x10, 0x0, 0x0, 0x10}, 0xc, &(0x7f0000000380)={&(0x7f0000000340)={0x24, r4, 0x300, 0x70bd26, 0x25dfdbfb, {}, [@MPTCP_PM_ATTR_SUBFLOWS={0x8, 0x3, 0x1}, @MPTCP_PM_ATTR_RCV_ADD_ADDRS={0x8, 0x2, 0x2}]}, 0x24}, 0x1, 0x0, 0x0, 0x20000004}, 0x8890) r5 = openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000500)='./cgroup/syz1\x00', 0x200002, 0x0) syz_io_uring_submit(0x0, r1, &(0x7f0000000580)=@IORING_OP_FILES_UPDATE={0x14, 0x4, 0x0, 0x0, 0x40, &(0x7f0000000540)=[r3, 0xffffffffffffffff, r5, 0xffffffffffffffff, r0], 0x5}, 0x3) socket$inet6_tcp(0xa, 0x1, 0x0) openat$procfs(0xffffffffffffff9c, &(0x7f00000010c0)='/proc/crypto\x00', 0x0, 0x0) 21:18:23 executing program 6: r0 = io_uring_setup(0x355e, &(0x7f0000000000)={0x0, 0x0, 0x0, 0x1, 0x1be}) r1 = syz_io_uring_setup(0x8fe, &(0x7f0000000080)={0x0, 0x1830, 0x0, 0x0, 0x1b8, 0x0, r0}, &(0x7f0000ffb000/0x2000)=nil, &(0x7f0000ffb000/0x4000)=nil, &(0x7f0000000100), &(0x7f0000000140)=0x0) r3 = openat$hwrng(0xffffffffffffff9c, &(0x7f0000000180), 0x2, 0x0) r4 = syz_genetlink_get_family_id$mptcp(&(0x7f0000000300), r3) sendmsg$MPTCP_PM_CMD_ADD_ADDR(r3, &(0x7f00000003c0)={&(0x7f00000002c0)={0x10, 0x0, 0x0, 0x10}, 0xc, &(0x7f0000000380)={&(0x7f0000000340)={0x24, r4, 0x300, 0x70bd26, 0x25dfdbfb, {}, [@MPTCP_PM_ATTR_SUBFLOWS={0x8, 0x3, 0x1}, @MPTCP_PM_ATTR_RCV_ADD_ADDRS={0x8, 0x2, 0x2}]}, 0x24}, 0x1, 0x0, 0x0, 0x20000004}, 0x8890) syz_io_uring_setup(0x20f8, &(0x7f0000000400)={0x0, 0x7677, 0x8, 0x3, 0x22f}, &(0x7f0000ffe000/0x2000)=nil, &(0x7f0000ffb000/0x2000)=nil, &(0x7f0000000480)=0x0, &(0x7f00000004c0)) r6 = openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000500)='./cgroup/syz1\x00', 0x200002, 0x0) syz_io_uring_submit(r5, r2, &(0x7f0000000580)=@IORING_OP_FILES_UPDATE={0x14, 0x4, 0x0, 0x0, 0x40, &(0x7f0000000540)=[0xffffffffffffffff, 0xffffffffffffffff, r6, r0, r1], 0x5}, 0x3) socket$inet6_tcp(0xa, 0x1, 0x0) openat$procfs(0xffffffffffffff9c, &(0x7f00000010c0)='/proc/crypto\x00', 0x0, 0x0) io_uring_setup(0x7c8f, &(0x7f0000001140)={0x0, 0xc240, 0x10, 0x3, 0x1c7}) 21:18:23 executing program 7: pipe2$9p(&(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}, 0x0) write$P9_RSYMLINK(r0, 0x0, 0x0) add_key$fscrypt_v1(&(0x7f0000000280), &(0x7f00000002c0)={'fscrypt:', @desc2}, 0x0, 0x0, 0xfffffffffffffffa) syz_genetlink_get_family_id$mptcp(&(0x7f00000004c0), 0xffffffffffffffff) openat$vcsa(0xffffffffffffff9c, &(0x7f00000009c0), 0x0, 0x0) syz_genetlink_get_family_id$mptcp(&(0x7f0000000a80), 0xffffffffffffffff) 21:18:23 executing program 1: r0 = io_uring_setup(0x355e, &(0x7f0000000000)={0x0, 0x0, 0x20, 0x1, 0x1be}) r1 = openat$hwrng(0xffffffffffffff9c, 0x0, 0x2, 0x0) r2 = syz_io_uring_setup(0x65dd, &(0x7f00000001c0)={0x0, 0xf46f, 0x20, 0x2, 0xdf}, &(0x7f0000ffe000/0x1000)=nil, &(0x7f0000ffd000/0x1000)=nil, &(0x7f0000000240), &(0x7f0000000280)) syz_genetlink_get_family_id$mptcp(&(0x7f0000000300), r1) syz_io_uring_setup(0x20f8, &(0x7f0000000400)={0x0, 0x7677, 0x8, 0x3, 0x22f, 0x0, r2}, &(0x7f0000ffe000/0x2000)=nil, &(0x7f0000ffb000/0x2000)=nil, &(0x7f0000000480)=0x0, &(0x7f00000004c0)) r4 = openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000500)='./cgroup/syz1\x00', 0x200002, 0x0) syz_io_uring_submit(r3, 0x0, &(0x7f0000000580)=@IORING_OP_FILES_UPDATE={0x14, 0x4, 0x0, 0x0, 0x40, &(0x7f0000000540)=[r2, 0xffffffffffffffff, r4, r0, 0xffffffffffffffff], 0x5}, 0x3) io_uring_setup(0x2812, &(0x7f00000005c0)={0x0, 0x5e1b, 0x2, 0x3, 0x12f, 0x0, r2}) socket$inet6_tcp(0xa, 0x1, 0x0) openat$procfs(0xffffffffffffff9c, &(0x7f00000010c0)='/proc/crypto\x00', 0x0, 0x0) io_uring_setup(0x7c8f, &(0x7f0000001140)={0x0, 0xc240, 0x10, 0x3, 0x1c7, 0x0, r2}) 21:18:23 executing program 2: syz_genetlink_get_family_id$nl80211(&(0x7f00000000c0), 0xffffffffffffffff) syz_open_dev$vcsa(&(0x7f0000000440), 0x56, 0x4000) socketpair(0x0, 0x0, 0x0, &(0x7f0000000640)) r0 = openat$tcp_congestion(0xffffffffffffff9c, &(0x7f0000000800), 0x1, 0x0) write$tcp_congestion(r0, 0x0, 0x0) 21:18:23 executing program 0: r0 = syz_io_uring_setup(0x8fe, &(0x7f0000000080), &(0x7f0000ffb000/0x2000)=nil, &(0x7f0000ffb000/0x4000)=nil, &(0x7f0000000100), &(0x7f0000000140)=0x0) openat$hwrng(0xffffffffffffff9c, &(0x7f0000000180), 0x0, 0x0) r2 = openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000500)='./cgroup/syz1\x00', 0x200002, 0x0) syz_io_uring_submit(0x0, r1, &(0x7f0000000580)=@IORING_OP_FILES_UPDATE={0x14, 0x4, 0x0, 0x0, 0x40, &(0x7f0000000540)=[0xffffffffffffffff, 0xffffffffffffffff, r2, 0xffffffffffffffff, r0], 0x5}, 0x3) io_uring_setup(0x2812, &(0x7f00000005c0)={0x0, 0x5e1b, 0x2, 0x3, 0x12f}) socket$inet6_tcp(0xa, 0x1, 0x0) 21:18:23 executing program 4: ioctl$SCSI_IOCTL_DOORUNLOCK(0xffffffffffffffff, 0x5381) r0 = syz_open_dev$mouse(&(0x7f0000000000), 0x578, 0x0) ioctl$SG_GET_PACK_ID(r0, 0x227c, &(0x7f0000000040)) syz_genetlink_get_family_id$nl80211(&(0x7f00000000c0), r0) syz_open_dev$vcsa(&(0x7f0000000440), 0x56, 0x4000) socketpair(0x0, 0x3, 0x6, &(0x7f0000000640)) r1 = openat$tcp_congestion(0xffffffffffffff9c, &(0x7f0000000800), 0x1, 0x0) write$tcp_congestion(r1, &(0x7f0000000840)='htcp\x00', 0x5) 21:18:23 executing program 1: r0 = io_uring_setup(0x355e, &(0x7f0000000000)={0x0, 0x0, 0x20, 0x1, 0x1be}) r1 = openat$hwrng(0xffffffffffffff9c, 0x0, 0x2, 0x0) r2 = syz_io_uring_setup(0x65dd, &(0x7f00000001c0)={0x0, 0xf46f, 0x20, 0x2, 0xdf}, &(0x7f0000ffe000/0x1000)=nil, &(0x7f0000ffd000/0x1000)=nil, &(0x7f0000000240), &(0x7f0000000280)) syz_genetlink_get_family_id$mptcp(&(0x7f0000000300), r1) syz_io_uring_setup(0x20f8, &(0x7f0000000400)={0x0, 0x7677, 0x8, 0x3, 0x22f, 0x0, r2}, &(0x7f0000ffe000/0x2000)=nil, &(0x7f0000ffb000/0x2000)=nil, &(0x7f0000000480)=0x0, &(0x7f00000004c0)) r4 = openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000500)='./cgroup/syz1\x00', 0x200002, 0x0) syz_io_uring_submit(r3, 0x0, &(0x7f0000000580)=@IORING_OP_FILES_UPDATE={0x14, 0x4, 0x0, 0x0, 0x40, &(0x7f0000000540)=[r2, 0xffffffffffffffff, r4, r0, 0xffffffffffffffff], 0x5}, 0x3) io_uring_setup(0x2812, &(0x7f00000005c0)={0x0, 0x5e1b, 0x2, 0x3, 0x12f, 0x0, r2}) socket$inet6_tcp(0xa, 0x1, 0x0) openat$procfs(0xffffffffffffff9c, &(0x7f00000010c0)='/proc/crypto\x00', 0x0, 0x0) io_uring_setup(0x7c8f, &(0x7f0000001140)={0x0, 0xc240, 0x10, 0x3, 0x1c7, 0x0, r2}) 21:18:33 executing program 3: r0 = io_uring_setup(0x355e, &(0x7f0000000000)={0x0, 0x0, 0x0, 0x1, 0x1be}) r1 = syz_io_uring_setup(0x8fe, &(0x7f0000000080)={0x0, 0x1830, 0x0, 0x0, 0x1b8, 0x0, r0}, &(0x7f0000ffb000/0x2000)=nil, &(0x7f0000ffb000/0x4000)=nil, &(0x7f0000000100), &(0x7f0000000140)=0x0) r3 = openat$hwrng(0xffffffffffffff9c, &(0x7f0000000180), 0x2, 0x0) syz_genetlink_get_family_id$mptcp(&(0x7f0000000300), r3) r4 = openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000500)='./cgroup/syz1\x00', 0x200002, 0x0) syz_io_uring_submit(0x0, r2, &(0x7f0000000580)=@IORING_OP_FILES_UPDATE={0x14, 0x4, 0x0, 0x0, 0x40, &(0x7f0000000540)=[0xffffffffffffffff, 0xffffffffffffffff, r4, r0, r1], 0x5}, 0x3) io_uring_setup(0x2812, &(0x7f00000005c0)={0x0, 0x5e1b, 0x2, 0x3, 0x12f}) socket$inet6_tcp(0xa, 0x1, 0x0) io_uring_setup(0x7c8f, &(0x7f0000001140)={0x0, 0xc240, 0x10, 0x3, 0x1c7}) 21:18:33 executing program 1: r0 = io_uring_setup(0x355e, &(0x7f0000000000)={0x0, 0x0, 0x20, 0x1, 0x1be}) r1 = openat$hwrng(0xffffffffffffff9c, 0x0, 0x2, 0x0) r2 = syz_io_uring_setup(0x65dd, &(0x7f00000001c0)={0x0, 0xf46f, 0x20, 0x2, 0xdf}, &(0x7f0000ffe000/0x1000)=nil, &(0x7f0000ffd000/0x1000)=nil, &(0x7f0000000240), &(0x7f0000000280)) syz_genetlink_get_family_id$mptcp(&(0x7f0000000300), r1) syz_io_uring_setup(0x20f8, &(0x7f0000000400)={0x0, 0x7677, 0x8, 0x3, 0x22f, 0x0, r2}, &(0x7f0000ffe000/0x2000)=nil, &(0x7f0000ffb000/0x2000)=nil, &(0x7f0000000480)=0x0, &(0x7f00000004c0)) r4 = openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000500)='./cgroup/syz1\x00', 0x200002, 0x0) syz_io_uring_submit(r3, 0x0, &(0x7f0000000580)=@IORING_OP_FILES_UPDATE={0x14, 0x4, 0x0, 0x0, 0x40, &(0x7f0000000540)=[r2, 0xffffffffffffffff, r4, r0, 0xffffffffffffffff], 0x5}, 0x3) io_uring_setup(0x2812, &(0x7f00000005c0)={0x0, 0x5e1b, 0x2, 0x3, 0x12f, 0x0, r2}) socket$inet6_tcp(0xa, 0x1, 0x0) openat$procfs(0xffffffffffffff9c, &(0x7f00000010c0)='/proc/crypto\x00', 0x0, 0x0) io_uring_setup(0x7c8f, &(0x7f0000001140)={0x0, 0xc240, 0x10, 0x3, 0x1c7, 0x0, r2}) 21:18:33 executing program 2: r0 = syz_io_uring_setup(0x8fe, &(0x7f0000000080), &(0x7f0000ffb000/0x2000)=nil, &(0x7f0000ffb000/0x4000)=nil, &(0x7f0000000100), &(0x7f0000000140)=0x0) openat$hwrng(0xffffffffffffff9c, &(0x7f0000000180), 0x0, 0x0) r2 = openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000500)='./cgroup/syz1\x00', 0x200002, 0x0) syz_io_uring_submit(0x0, r1, &(0x7f0000000580)=@IORING_OP_FILES_UPDATE={0x14, 0x4, 0x0, 0x0, 0x40, &(0x7f0000000540)=[0xffffffffffffffff, 0xffffffffffffffff, r2, 0xffffffffffffffff, r0], 0x5}, 0x3) io_uring_setup(0x2812, &(0x7f00000005c0)={0x0, 0x5e1b, 0x2, 0x3, 0x12f}) socket$inet6_tcp(0xa, 0x1, 0x0) 21:18:33 executing program 6: r0 = io_uring_setup(0x355e, &(0x7f0000000000)={0x0, 0x0, 0x0, 0x1, 0x1be}) r1 = syz_io_uring_setup(0x8fe, &(0x7f0000000080)={0x0, 0x1830, 0x0, 0x0, 0x1b8, 0x0, r0}, &(0x7f0000ffb000/0x2000)=nil, &(0x7f0000ffb000/0x4000)=nil, &(0x7f0000000100), &(0x7f0000000140)=0x0) r3 = openat$hwrng(0xffffffffffffff9c, &(0x7f0000000180), 0x2, 0x0) r4 = syz_genetlink_get_family_id$mptcp(&(0x7f0000000300), r3) sendmsg$MPTCP_PM_CMD_ADD_ADDR(r3, &(0x7f00000003c0)={&(0x7f00000002c0)={0x10, 0x0, 0x0, 0x10}, 0xc, &(0x7f0000000380)={&(0x7f0000000340)={0x24, r4, 0x300, 0x70bd26, 0x25dfdbfb, {}, [@MPTCP_PM_ATTR_SUBFLOWS={0x8, 0x3, 0x1}, @MPTCP_PM_ATTR_RCV_ADD_ADDRS={0x8, 0x2, 0x2}]}, 0x24}, 0x1, 0x0, 0x0, 0x20000004}, 0x8890) syz_io_uring_setup(0x20f8, &(0x7f0000000400)={0x0, 0x7677, 0x8, 0x3, 0x22f}, &(0x7f0000ffe000/0x2000)=nil, &(0x7f0000ffb000/0x2000)=nil, &(0x7f0000000480)=0x0, &(0x7f00000004c0)) r6 = openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000500)='./cgroup/syz1\x00', 0x200002, 0x0) syz_io_uring_submit(r5, r2, &(0x7f0000000580)=@IORING_OP_FILES_UPDATE={0x14, 0x4, 0x0, 0x0, 0x40, &(0x7f0000000540)=[0xffffffffffffffff, 0xffffffffffffffff, r6, r0, r1], 0x5}, 0x3) socket$inet6_tcp(0xa, 0x1, 0x0) openat$procfs(0xffffffffffffff9c, &(0x7f00000010c0)='/proc/crypto\x00', 0x0, 0x0) io_uring_setup(0x7c8f, &(0x7f0000001140)={0x0, 0xc240, 0x10, 0x3, 0x1c7}) 21:18:33 executing program 0: r0 = syz_io_uring_setup(0x8fe, &(0x7f0000000080), &(0x7f0000ffb000/0x2000)=nil, &(0x7f0000ffb000/0x4000)=nil, &(0x7f0000000100), &(0x7f0000000140)=0x0) openat$hwrng(0xffffffffffffff9c, &(0x7f0000000180), 0x0, 0x0) r2 = openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000500)='./cgroup/syz1\x00', 0x200002, 0x0) syz_io_uring_submit(0x0, r1, &(0x7f0000000580)=@IORING_OP_FILES_UPDATE={0x14, 0x4, 0x0, 0x0, 0x40, &(0x7f0000000540)=[0xffffffffffffffff, 0xffffffffffffffff, r2, 0xffffffffffffffff, r0], 0x5}, 0x3) io_uring_setup(0x2812, &(0x7f00000005c0)={0x0, 0x5e1b, 0x2, 0x3, 0x12f}) socket$inet6_tcp(0xa, 0x1, 0x0) 21:18:33 executing program 4: ioctl$SCSI_IOCTL_DOORUNLOCK(0xffffffffffffffff, 0x5381) r0 = syz_open_dev$mouse(&(0x7f0000000000), 0x578, 0x0) ioctl$SG_GET_PACK_ID(r0, 0x227c, &(0x7f0000000040)) syz_genetlink_get_family_id$nl80211(&(0x7f00000000c0), r0) syz_open_dev$vcsa(&(0x7f0000000440), 0x56, 0x4000) socketpair(0x0, 0x3, 0x6, &(0x7f0000000640)) r1 = openat$tcp_congestion(0xffffffffffffff9c, &(0x7f0000000800), 0x1, 0x0) write$tcp_congestion(r1, &(0x7f0000000840)='htcp\x00', 0x5) 21:18:33 executing program 7: pipe2$9p(&(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}, 0x0) write$P9_RSYMLINK(r0, 0x0, 0x0) add_key$fscrypt_v1(&(0x7f0000000280), &(0x7f00000002c0)={'fscrypt:', @desc2}, 0x0, 0x0, 0xfffffffffffffffa) syz_genetlink_get_family_id$mptcp(&(0x7f00000004c0), 0xffffffffffffffff) openat$vcsa(0xffffffffffffff9c, &(0x7f00000009c0), 0x0, 0x0) syz_genetlink_get_family_id$mptcp(&(0x7f0000000a80), 0xffffffffffffffff) 21:18:33 executing program 5: r0 = io_uring_setup(0x0, &(0x7f0000000000)={0x0, 0x7682, 0x20, 0x1, 0x1be}) r1 = syz_io_uring_setup(0x8fe, &(0x7f0000000080)={0x0, 0x1830, 0x0, 0x0, 0x1b8, 0x0, r0}, &(0x7f0000ffb000/0x2000)=nil, &(0x7f0000ffb000/0x4000)=nil, &(0x7f0000000100), &(0x7f0000000140)=0x0) r3 = openat$hwrng(0xffffffffffffff9c, &(0x7f0000000180), 0x2, 0x0) r4 = syz_io_uring_setup(0x65dd, &(0x7f00000001c0)={0x0, 0xf46f, 0x20, 0x2, 0xdf}, &(0x7f0000ffe000/0x1000)=nil, &(0x7f0000ffd000/0x1000)=nil, &(0x7f0000000240), &(0x7f0000000280)) r5 = syz_genetlink_get_family_id$mptcp(&(0x7f0000000300), r3) sendmsg$MPTCP_PM_CMD_ADD_ADDR(r3, &(0x7f00000003c0)={&(0x7f00000002c0)={0x10, 0x0, 0x0, 0x10}, 0xc, &(0x7f0000000380)={&(0x7f0000000340)={0x24, r5, 0x300, 0x70bd26, 0x25dfdbfb, {}, [@MPTCP_PM_ATTR_SUBFLOWS={0x8, 0x3, 0x1}, @MPTCP_PM_ATTR_RCV_ADD_ADDRS={0x8, 0x2, 0x2}]}, 0x24}, 0x1, 0x0, 0x0, 0x20000004}, 0x8890) r6 = openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000500)='./cgroup/syz1\x00', 0x200002, 0x0) syz_io_uring_submit(0x0, r2, &(0x7f0000000580)=@IORING_OP_FILES_UPDATE={0x14, 0x4, 0x0, 0x0, 0x40, &(0x7f0000000540)=[r4, 0xffffffffffffffff, r6, r0, r1], 0x5}, 0x3) socket$inet6_tcp(0xa, 0x1, 0x0) openat$procfs(0xffffffffffffff9c, &(0x7f00000010c0)='/proc/crypto\x00', 0x0, 0x0) 21:18:33 executing program 0: r0 = syz_io_uring_setup(0x8fe, &(0x7f0000000080), &(0x7f0000ffb000/0x2000)=nil, &(0x7f0000ffb000/0x4000)=nil, &(0x7f0000000100), &(0x7f0000000140)=0x0) openat$hwrng(0xffffffffffffff9c, &(0x7f0000000180), 0x2, 0x0) r2 = openat$cgroup_root(0xffffffffffffff9c, 0x0, 0x200002, 0x0) syz_io_uring_submit(0x0, r1, &(0x7f0000000580)=@IORING_OP_FILES_UPDATE={0x14, 0x4, 0x0, 0x0, 0x40, &(0x7f0000000540)=[0xffffffffffffffff, 0xffffffffffffffff, r2, 0xffffffffffffffff, r0], 0x5}, 0x3) io_uring_setup(0x2812, &(0x7f00000005c0)={0x0, 0x5e1b, 0x2, 0x3, 0x12f}) socket$inet6_tcp(0xa, 0x1, 0x0) 21:18:33 executing program 2: r0 = syz_io_uring_setup(0x8fe, &(0x7f0000000080), &(0x7f0000ffb000/0x2000)=nil, &(0x7f0000ffb000/0x4000)=nil, &(0x7f0000000100), &(0x7f0000000140)=0x0) openat$hwrng(0xffffffffffffff9c, &(0x7f0000000180), 0x0, 0x0) r2 = openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000500)='./cgroup/syz1\x00', 0x200002, 0x0) syz_io_uring_submit(0x0, r1, &(0x7f0000000580)=@IORING_OP_FILES_UPDATE={0x14, 0x4, 0x0, 0x0, 0x40, &(0x7f0000000540)=[0xffffffffffffffff, 0xffffffffffffffff, r2, 0xffffffffffffffff, r0], 0x5}, 0x3) io_uring_setup(0x2812, &(0x7f00000005c0)={0x0, 0x5e1b, 0x2, 0x3, 0x12f}) socket$inet6_tcp(0xa, 0x1, 0x0) 21:18:33 executing program 7: pipe2$9p(&(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}, 0x0) write$P9_RSYMLINK(r0, 0x0, 0x0) add_key$fscrypt_v1(&(0x7f0000000280), &(0x7f00000002c0)={'fscrypt:', @desc2}, 0x0, 0x0, 0xfffffffffffffffa) syz_genetlink_get_family_id$mptcp(&(0x7f00000004c0), 0xffffffffffffffff) openat$vcsa(0xffffffffffffff9c, &(0x7f00000009c0), 0x0, 0x0) syz_genetlink_get_family_id$mptcp(0x0, 0xffffffffffffffff) 21:18:33 executing program 6: r0 = io_uring_setup(0x355e, &(0x7f0000000000)={0x0, 0x0, 0x0, 0x1, 0x1be}) r1 = syz_io_uring_setup(0x8fe, &(0x7f0000000080)={0x0, 0x1830, 0x0, 0x0, 0x1b8, 0x0, r0}, &(0x7f0000ffb000/0x2000)=nil, &(0x7f0000ffb000/0x4000)=nil, &(0x7f0000000100), &(0x7f0000000140)=0x0) r3 = openat$hwrng(0xffffffffffffff9c, &(0x7f0000000180), 0x2, 0x0) r4 = syz_genetlink_get_family_id$mptcp(&(0x7f0000000300), r3) sendmsg$MPTCP_PM_CMD_ADD_ADDR(r3, &(0x7f00000003c0)={&(0x7f00000002c0)={0x10, 0x0, 0x0, 0x10}, 0xc, &(0x7f0000000380)={&(0x7f0000000340)={0x24, r4, 0x300, 0x70bd26, 0x25dfdbfb, {}, [@MPTCP_PM_ATTR_SUBFLOWS={0x8, 0x3, 0x1}, @MPTCP_PM_ATTR_RCV_ADD_ADDRS={0x8, 0x2, 0x2}]}, 0x24}, 0x1, 0x0, 0x0, 0x20000004}, 0x8890) syz_io_uring_setup(0x20f8, &(0x7f0000000400)={0x0, 0x7677, 0x8, 0x3, 0x22f}, &(0x7f0000ffe000/0x2000)=nil, &(0x7f0000ffb000/0x2000)=nil, &(0x7f0000000480)=0x0, &(0x7f00000004c0)) r6 = openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000500)='./cgroup/syz1\x00', 0x200002, 0x0) syz_io_uring_submit(r5, r2, &(0x7f0000000580)=@IORING_OP_FILES_UPDATE={0x14, 0x4, 0x0, 0x0, 0x40, &(0x7f0000000540)=[0xffffffffffffffff, 0xffffffffffffffff, r6, r0, r1], 0x5}, 0x3) socket$inet6_tcp(0xa, 0x1, 0x0) openat$procfs(0xffffffffffffff9c, &(0x7f00000010c0)='/proc/crypto\x00', 0x0, 0x0) io_uring_setup(0x7c8f, &(0x7f0000001140)={0x0, 0xc240, 0x10, 0x3, 0x1c7}) 21:18:33 executing program 1: r0 = io_uring_setup(0x355e, &(0x7f0000000000)={0x0, 0x0, 0x20, 0x1, 0x1be}) r1 = openat$hwrng(0xffffffffffffff9c, &(0x7f0000000180), 0x0, 0x0) r2 = syz_io_uring_setup(0x65dd, &(0x7f00000001c0)={0x0, 0xf46f, 0x20, 0x2, 0xdf}, &(0x7f0000ffe000/0x1000)=nil, &(0x7f0000ffd000/0x1000)=nil, &(0x7f0000000240), &(0x7f0000000280)) syz_genetlink_get_family_id$mptcp(&(0x7f0000000300), r1) syz_io_uring_setup(0x20f8, &(0x7f0000000400)={0x0, 0x7677, 0x8, 0x3, 0x22f, 0x0, r2}, &(0x7f0000ffe000/0x2000)=nil, &(0x7f0000ffb000/0x2000)=nil, &(0x7f0000000480)=0x0, &(0x7f00000004c0)) r4 = openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000500)='./cgroup/syz1\x00', 0x200002, 0x0) syz_io_uring_submit(r3, 0x0, &(0x7f0000000580)=@IORING_OP_FILES_UPDATE={0x14, 0x4, 0x0, 0x0, 0x40, &(0x7f0000000540)=[r2, 0xffffffffffffffff, r4, r0, 0xffffffffffffffff], 0x5}, 0x3) io_uring_setup(0x2812, &(0x7f00000005c0)={0x0, 0x5e1b, 0x2, 0x3, 0x12f, 0x0, r2}) socket$inet6_tcp(0xa, 0x1, 0x0) openat$procfs(0xffffffffffffff9c, &(0x7f00000010c0)='/proc/crypto\x00', 0x0, 0x0) io_uring_setup(0x7c8f, &(0x7f0000001140)={0x0, 0xc240, 0x10, 0x3, 0x1c7, 0x0, r2}) 21:18:33 executing program 3: r0 = io_uring_setup(0x355e, &(0x7f0000000000)={0x0, 0x0, 0x0, 0x1, 0x1be}) r1 = syz_io_uring_setup(0x8fe, &(0x7f0000000080)={0x0, 0x1830, 0x0, 0x0, 0x1b8, 0x0, r0}, &(0x7f0000ffb000/0x2000)=nil, &(0x7f0000ffb000/0x4000)=nil, &(0x7f0000000100), &(0x7f0000000140)=0x0) r3 = openat$hwrng(0xffffffffffffff9c, &(0x7f0000000180), 0x2, 0x0) syz_genetlink_get_family_id$mptcp(&(0x7f0000000300), r3) r4 = openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000500)='./cgroup/syz1\x00', 0x200002, 0x0) syz_io_uring_submit(0x0, r2, &(0x7f0000000580)=@IORING_OP_FILES_UPDATE={0x14, 0x4, 0x0, 0x0, 0x40, &(0x7f0000000540)=[0xffffffffffffffff, 0xffffffffffffffff, r4, r0, r1], 0x5}, 0x3) io_uring_setup(0x2812, &(0x7f00000005c0)={0x0, 0x5e1b, 0x2, 0x3, 0x12f}) socket$inet6_tcp(0xa, 0x1, 0x0) io_uring_setup(0x7c8f, &(0x7f0000001140)={0x0, 0xc240, 0x10, 0x3, 0x1c7}) 21:18:33 executing program 2: r0 = syz_io_uring_setup(0x8fe, &(0x7f0000000080), &(0x7f0000ffb000/0x2000)=nil, &(0x7f0000ffb000/0x4000)=nil, &(0x7f0000000100), &(0x7f0000000140)=0x0) openat$hwrng(0xffffffffffffff9c, &(0x7f0000000180), 0x0, 0x0) r2 = openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000500)='./cgroup/syz1\x00', 0x200002, 0x0) syz_io_uring_submit(0x0, r1, &(0x7f0000000580)=@IORING_OP_FILES_UPDATE={0x14, 0x4, 0x0, 0x0, 0x40, &(0x7f0000000540)=[0xffffffffffffffff, 0xffffffffffffffff, r2, 0xffffffffffffffff, r0], 0x5}, 0x3) io_uring_setup(0x2812, &(0x7f00000005c0)={0x0, 0x5e1b, 0x2, 0x3, 0x12f}) socket$inet6_tcp(0xa, 0x1, 0x0) 21:18:33 executing program 0: r0 = syz_io_uring_setup(0x8fe, &(0x7f0000000080), &(0x7f0000ffb000/0x2000)=nil, &(0x7f0000ffb000/0x4000)=nil, &(0x7f0000000100), &(0x7f0000000140)=0x0) openat$hwrng(0xffffffffffffff9c, &(0x7f0000000180), 0x2, 0x0) r2 = openat$cgroup_root(0xffffffffffffff9c, 0x0, 0x200002, 0x0) syz_io_uring_submit(0x0, r1, &(0x7f0000000580)=@IORING_OP_FILES_UPDATE={0x14, 0x4, 0x0, 0x0, 0x40, &(0x7f0000000540)=[0xffffffffffffffff, 0xffffffffffffffff, r2, 0xffffffffffffffff, r0], 0x5}, 0x3) io_uring_setup(0x2812, &(0x7f00000005c0)={0x0, 0x5e1b, 0x2, 0x3, 0x12f}) socket$inet6_tcp(0xa, 0x1, 0x0) 21:18:43 executing program 1: r0 = io_uring_setup(0x355e, &(0x7f0000000000)={0x0, 0x0, 0x20, 0x1, 0x1be}) r1 = openat$hwrng(0xffffffffffffff9c, &(0x7f0000000180), 0x0, 0x0) r2 = syz_io_uring_setup(0x65dd, &(0x7f00000001c0)={0x0, 0xf46f, 0x20, 0x2, 0xdf}, &(0x7f0000ffe000/0x1000)=nil, &(0x7f0000ffd000/0x1000)=nil, &(0x7f0000000240), &(0x7f0000000280)) syz_genetlink_get_family_id$mptcp(&(0x7f0000000300), r1) syz_io_uring_setup(0x20f8, &(0x7f0000000400)={0x0, 0x7677, 0x8, 0x3, 0x22f, 0x0, r2}, &(0x7f0000ffe000/0x2000)=nil, &(0x7f0000ffb000/0x2000)=nil, &(0x7f0000000480)=0x0, &(0x7f00000004c0)) r4 = openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000500)='./cgroup/syz1\x00', 0x200002, 0x0) syz_io_uring_submit(r3, 0x0, &(0x7f0000000580)=@IORING_OP_FILES_UPDATE={0x14, 0x4, 0x0, 0x0, 0x40, &(0x7f0000000540)=[r2, 0xffffffffffffffff, r4, r0, 0xffffffffffffffff], 0x5}, 0x3) io_uring_setup(0x2812, &(0x7f00000005c0)={0x0, 0x5e1b, 0x2, 0x3, 0x12f, 0x0, r2}) socket$inet6_tcp(0xa, 0x1, 0x0) openat$procfs(0xffffffffffffff9c, &(0x7f00000010c0)='/proc/crypto\x00', 0x0, 0x0) io_uring_setup(0x7c8f, &(0x7f0000001140)={0x0, 0xc240, 0x10, 0x3, 0x1c7, 0x0, r2}) 21:18:43 executing program 7: pipe2$9p(&(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}, 0x0) write$P9_RSYMLINK(r0, 0x0, 0x0) add_key$fscrypt_v1(&(0x7f0000000280), &(0x7f00000002c0)={'fscrypt:', @desc2}, 0x0, 0x0, 0xfffffffffffffffa) syz_genetlink_get_family_id$mptcp(&(0x7f00000004c0), 0xffffffffffffffff) openat$vcsa(0xffffffffffffff9c, &(0x7f00000009c0), 0x0, 0x0) syz_genetlink_get_family_id$mptcp(0x0, 0xffffffffffffffff) 21:18:43 executing program 0: r0 = syz_io_uring_setup(0x8fe, &(0x7f0000000080), &(0x7f0000ffb000/0x2000)=nil, &(0x7f0000ffb000/0x4000)=nil, &(0x7f0000000100), &(0x7f0000000140)=0x0) openat$hwrng(0xffffffffffffff9c, &(0x7f0000000180), 0x2, 0x0) r2 = openat$cgroup_root(0xffffffffffffff9c, 0x0, 0x200002, 0x0) syz_io_uring_submit(0x0, r1, &(0x7f0000000580)=@IORING_OP_FILES_UPDATE={0x14, 0x4, 0x0, 0x0, 0x40, &(0x7f0000000540)=[0xffffffffffffffff, 0xffffffffffffffff, r2, 0xffffffffffffffff, r0], 0x5}, 0x3) io_uring_setup(0x2812, &(0x7f00000005c0)={0x0, 0x5e1b, 0x2, 0x3, 0x12f}) socket$inet6_tcp(0xa, 0x1, 0x0) 21:18:43 executing program 2: r0 = syz_io_uring_setup(0x8fe, &(0x7f0000000080), &(0x7f0000ffb000/0x2000)=nil, &(0x7f0000ffb000/0x4000)=nil, &(0x7f0000000100), &(0x7f0000000140)=0x0) openat$hwrng(0xffffffffffffff9c, &(0x7f0000000180), 0x0, 0x0) r2 = openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000500)='./cgroup/syz1\x00', 0x200002, 0x0) syz_io_uring_submit(0x0, r1, &(0x7f0000000580)=@IORING_OP_FILES_UPDATE={0x14, 0x4, 0x0, 0x0, 0x40, &(0x7f0000000540)=[0xffffffffffffffff, 0xffffffffffffffff, r2, 0xffffffffffffffff, r0], 0x5}, 0x3) io_uring_setup(0x2812, &(0x7f00000005c0)={0x0, 0x5e1b, 0x2, 0x3, 0x12f}) 21:18:43 executing program 6: r0 = io_uring_setup(0x355e, &(0x7f0000000000)={0x0, 0x0, 0x20, 0x0, 0x1be}) r1 = syz_io_uring_setup(0x8fe, &(0x7f0000000080)={0x0, 0x1830, 0x0, 0x0, 0x1b8, 0x0, r0}, &(0x7f0000ffb000/0x2000)=nil, &(0x7f0000ffb000/0x4000)=nil, &(0x7f0000000100), &(0x7f0000000140)=0x0) r3 = openat$hwrng(0xffffffffffffff9c, &(0x7f0000000180), 0x2, 0x0) r4 = syz_genetlink_get_family_id$mptcp(&(0x7f0000000300), r3) sendmsg$MPTCP_PM_CMD_ADD_ADDR(r3, &(0x7f00000003c0)={&(0x7f00000002c0)={0x10, 0x0, 0x0, 0x10}, 0xc, &(0x7f0000000380)={&(0x7f0000000340)={0x24, r4, 0x300, 0x70bd26, 0x25dfdbfb, {}, [@MPTCP_PM_ATTR_SUBFLOWS={0x8, 0x3, 0x1}, @MPTCP_PM_ATTR_RCV_ADD_ADDRS={0x8, 0x2, 0x2}]}, 0x24}, 0x1, 0x0, 0x0, 0x20000004}, 0x8890) syz_io_uring_setup(0x20f8, &(0x7f0000000400)={0x0, 0x7677, 0x8, 0x3, 0x22f}, &(0x7f0000ffe000/0x2000)=nil, &(0x7f0000ffb000/0x2000)=nil, &(0x7f0000000480)=0x0, &(0x7f00000004c0)) r6 = openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000500)='./cgroup/syz1\x00', 0x200002, 0x0) syz_io_uring_submit(r5, r2, &(0x7f0000000580)=@IORING_OP_FILES_UPDATE={0x14, 0x4, 0x0, 0x0, 0x40, &(0x7f0000000540)=[0xffffffffffffffff, 0xffffffffffffffff, r6, r0, r1], 0x5}, 0x3) socket$inet6_tcp(0xa, 0x1, 0x0) openat$procfs(0xffffffffffffff9c, &(0x7f00000010c0)='/proc/crypto\x00', 0x0, 0x0) io_uring_setup(0x7c8f, &(0x7f0000001140)={0x0, 0xc240, 0x10, 0x3, 0x1c7}) 21:18:43 executing program 5: r0 = io_uring_setup(0x0, &(0x7f0000000000)={0x0, 0x7682, 0x20, 0x1, 0x1be}) r1 = syz_io_uring_setup(0x8fe, &(0x7f0000000080)={0x0, 0x1830, 0x0, 0x0, 0x1b8, 0x0, r0}, &(0x7f0000ffb000/0x2000)=nil, &(0x7f0000ffb000/0x4000)=nil, &(0x7f0000000100), &(0x7f0000000140)=0x0) r3 = openat$hwrng(0xffffffffffffff9c, &(0x7f0000000180), 0x2, 0x0) r4 = syz_io_uring_setup(0x65dd, &(0x7f00000001c0)={0x0, 0xf46f, 0x20, 0x2, 0xdf}, &(0x7f0000ffe000/0x1000)=nil, &(0x7f0000ffd000/0x1000)=nil, &(0x7f0000000240), &(0x7f0000000280)) r5 = syz_genetlink_get_family_id$mptcp(&(0x7f0000000300), r3) sendmsg$MPTCP_PM_CMD_ADD_ADDR(r3, &(0x7f00000003c0)={&(0x7f00000002c0)={0x10, 0x0, 0x0, 0x10}, 0xc, &(0x7f0000000380)={&(0x7f0000000340)={0x24, r5, 0x300, 0x70bd26, 0x25dfdbfb, {}, [@MPTCP_PM_ATTR_SUBFLOWS={0x8, 0x3, 0x1}, @MPTCP_PM_ATTR_RCV_ADD_ADDRS={0x8, 0x2, 0x2}]}, 0x24}, 0x1, 0x0, 0x0, 0x20000004}, 0x8890) r6 = openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000500)='./cgroup/syz1\x00', 0x200002, 0x0) syz_io_uring_submit(0x0, r2, &(0x7f0000000580)=@IORING_OP_FILES_UPDATE={0x14, 0x4, 0x0, 0x0, 0x40, &(0x7f0000000540)=[r4, 0xffffffffffffffff, r6, r0, r1], 0x5}, 0x3) socket$inet6_tcp(0xa, 0x1, 0x0) openat$procfs(0xffffffffffffff9c, &(0x7f00000010c0)='/proc/crypto\x00', 0x0, 0x0) 21:18:43 executing program 4: ioctl$SCSI_IOCTL_DOORUNLOCK(0xffffffffffffffff, 0x5381) r0 = syz_open_dev$mouse(&(0x7f0000000000), 0x578, 0x0) ioctl$SG_GET_PACK_ID(r0, 0x227c, &(0x7f0000000040)) syz_genetlink_get_family_id$nl80211(&(0x7f00000000c0), r0) syz_open_dev$vcsa(&(0x7f0000000440), 0x56, 0x4000) socketpair(0x0, 0x3, 0x6, &(0x7f0000000640)) r1 = openat$tcp_congestion(0xffffffffffffff9c, &(0x7f0000000800), 0x1, 0x0) write$tcp_congestion(r1, &(0x7f0000000840)='htcp\x00', 0x5) 21:18:43 executing program 3: r0 = io_uring_setup(0x355e, &(0x7f0000000000)={0x0, 0x0, 0x0, 0x1, 0x1be}) r1 = syz_io_uring_setup(0x8fe, &(0x7f0000000080)={0x0, 0x1830, 0x0, 0x0, 0x1b8, 0x0, r0}, &(0x7f0000ffb000/0x2000)=nil, &(0x7f0000ffb000/0x4000)=nil, &(0x7f0000000100), &(0x7f0000000140)=0x0) r3 = openat$hwrng(0xffffffffffffff9c, &(0x7f0000000180), 0x2, 0x0) syz_genetlink_get_family_id$mptcp(&(0x7f0000000300), r3) r4 = openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000500)='./cgroup/syz1\x00', 0x200002, 0x0) syz_io_uring_submit(0x0, r2, &(0x7f0000000580)=@IORING_OP_FILES_UPDATE={0x14, 0x4, 0x0, 0x0, 0x40, &(0x7f0000000540)=[0xffffffffffffffff, 0xffffffffffffffff, r4, r0, r1], 0x5}, 0x3) io_uring_setup(0x2812, &(0x7f00000005c0)={0x0, 0x5e1b, 0x2, 0x3, 0x12f}) socket$inet6_tcp(0xa, 0x1, 0x0) io_uring_setup(0x7c8f, &(0x7f0000001140)={0x0, 0xc240, 0x10, 0x3, 0x1c7}) 21:18:43 executing program 0: r0 = syz_io_uring_setup(0x8fe, &(0x7f0000000080), &(0x7f0000ffb000/0x2000)=nil, &(0x7f0000ffb000/0x4000)=nil, &(0x7f0000000100), &(0x7f0000000140)) openat$hwrng(0xffffffffffffff9c, &(0x7f0000000180), 0x2, 0x0) r1 = openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000500)='./cgroup/syz1\x00', 0x200002, 0x0) syz_io_uring_submit(0x0, 0x0, &(0x7f0000000580)=@IORING_OP_FILES_UPDATE={0x14, 0x4, 0x0, 0x0, 0x40, &(0x7f0000000540)=[0xffffffffffffffff, 0xffffffffffffffff, r1, 0xffffffffffffffff, r0], 0x5}, 0x3) io_uring_setup(0x2812, &(0x7f00000005c0)={0x0, 0x5e1b, 0x2, 0x3, 0x12f}) socket$inet6_tcp(0xa, 0x1, 0x0) 21:18:43 executing program 7: pipe2$9p(&(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}, 0x0) write$P9_RSYMLINK(r0, 0x0, 0x0) add_key$fscrypt_v1(&(0x7f0000000280), &(0x7f00000002c0)={'fscrypt:', @desc2}, 0x0, 0x0, 0xfffffffffffffffa) syz_genetlink_get_family_id$mptcp(&(0x7f00000004c0), 0xffffffffffffffff) openat$vcsa(0xffffffffffffff9c, &(0x7f00000009c0), 0x0, 0x0) syz_genetlink_get_family_id$mptcp(0x0, 0xffffffffffffffff) 21:18:43 executing program 2: r0 = syz_io_uring_setup(0x8fe, &(0x7f0000000080), &(0x7f0000ffb000/0x2000)=nil, &(0x7f0000ffb000/0x4000)=nil, &(0x7f0000000100), &(0x7f0000000140)=0x0) openat$hwrng(0xffffffffffffff9c, &(0x7f0000000180), 0x0, 0x0) r2 = openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000500)='./cgroup/syz1\x00', 0x200002, 0x0) syz_io_uring_submit(0x0, r1, &(0x7f0000000580)=@IORING_OP_FILES_UPDATE={0x14, 0x4, 0x0, 0x0, 0x40, &(0x7f0000000540)=[0xffffffffffffffff, 0xffffffffffffffff, r2, 0xffffffffffffffff, r0], 0x5}, 0x3) io_uring_setup(0x2812, &(0x7f00000005c0)={0x0, 0x5e1b, 0x2, 0x3, 0x12f}) 21:18:43 executing program 0: r0 = syz_io_uring_setup(0x8fe, &(0x7f0000000080), &(0x7f0000ffb000/0x2000)=nil, &(0x7f0000ffb000/0x4000)=nil, &(0x7f0000000100), &(0x7f0000000140)) openat$hwrng(0xffffffffffffff9c, &(0x7f0000000180), 0x2, 0x0) r1 = openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000500)='./cgroup/syz1\x00', 0x200002, 0x0) syz_io_uring_submit(0x0, 0x0, &(0x7f0000000580)=@IORING_OP_FILES_UPDATE={0x14, 0x4, 0x0, 0x0, 0x40, &(0x7f0000000540)=[0xffffffffffffffff, 0xffffffffffffffff, r1, 0xffffffffffffffff, r0], 0x5}, 0x3) io_uring_setup(0x2812, &(0x7f00000005c0)={0x0, 0x5e1b, 0x2, 0x3, 0x12f}) socket$inet6_tcp(0xa, 0x1, 0x0) 21:18:43 executing program 1: r0 = io_uring_setup(0x355e, &(0x7f0000000000)={0x0, 0x0, 0x20, 0x1, 0x1be}) r1 = openat$hwrng(0xffffffffffffff9c, &(0x7f0000000180), 0x0, 0x0) r2 = syz_io_uring_setup(0x65dd, &(0x7f00000001c0)={0x0, 0xf46f, 0x20, 0x2, 0xdf}, &(0x7f0000ffe000/0x1000)=nil, &(0x7f0000ffd000/0x1000)=nil, &(0x7f0000000240), &(0x7f0000000280)) syz_genetlink_get_family_id$mptcp(&(0x7f0000000300), r1) syz_io_uring_setup(0x20f8, &(0x7f0000000400)={0x0, 0x7677, 0x8, 0x3, 0x22f, 0x0, r2}, &(0x7f0000ffe000/0x2000)=nil, &(0x7f0000ffb000/0x2000)=nil, &(0x7f0000000480)=0x0, &(0x7f00000004c0)) r4 = openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000500)='./cgroup/syz1\x00', 0x200002, 0x0) syz_io_uring_submit(r3, 0x0, &(0x7f0000000580)=@IORING_OP_FILES_UPDATE={0x14, 0x4, 0x0, 0x0, 0x40, &(0x7f0000000540)=[r2, 0xffffffffffffffff, r4, r0, 0xffffffffffffffff], 0x5}, 0x3) io_uring_setup(0x2812, &(0x7f00000005c0)={0x0, 0x5e1b, 0x2, 0x3, 0x12f, 0x0, r2}) socket$inet6_tcp(0xa, 0x1, 0x0) openat$procfs(0xffffffffffffff9c, &(0x7f00000010c0)='/proc/crypto\x00', 0x0, 0x0) io_uring_setup(0x7c8f, &(0x7f0000001140)={0x0, 0xc240, 0x10, 0x3, 0x1c7, 0x0, r2}) 21:18:52 executing program 0: syz_io_uring_setup(0x8fe, &(0x7f0000000080), &(0x7f0000ffb000/0x2000)=nil, &(0x7f0000ffb000/0x4000)=nil, &(0x7f0000000100), &(0x7f0000000140)) openat$hwrng(0xffffffffffffff9c, &(0x7f0000000180), 0x2, 0x0) openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000500)='./cgroup/syz1\x00', 0x200002, 0x0) syz_io_uring_submit(0x0, 0x0, 0x0, 0x3) io_uring_setup(0x2812, &(0x7f00000005c0)={0x0, 0x5e1b, 0x2, 0x3, 0x12f}) socket$inet6_tcp(0xa, 0x1, 0x0) 21:18:52 executing program 4: ioctl$SCSI_IOCTL_DOORUNLOCK(0xffffffffffffffff, 0x5381) r0 = syz_open_dev$mouse(&(0x7f0000000000), 0x578, 0x4000) ioctl$SG_GET_PACK_ID(0xffffffffffffffff, 0x227c, &(0x7f0000000040)) syz_genetlink_get_family_id$nl80211(&(0x7f00000000c0), r0) syz_open_dev$vcsa(&(0x7f0000000440), 0x56, 0x4000) socketpair(0x0, 0x3, 0x6, &(0x7f0000000640)) r1 = openat$tcp_congestion(0xffffffffffffff9c, &(0x7f0000000800), 0x1, 0x0) write$tcp_congestion(r1, &(0x7f0000000840)='htcp\x00', 0x5) 21:18:52 executing program 7: pipe2$9p(&(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}, 0x0) write$P9_RSYMLINK(r0, 0x0, 0x0) add_key$fscrypt_v1(&(0x7f0000000280), &(0x7f00000002c0)={'fscrypt:', @desc2}, 0x0, 0x0, 0xfffffffffffffffa) syz_genetlink_get_family_id$mptcp(&(0x7f00000004c0), 0xffffffffffffffff) openat$vcsa(0xffffffffffffff9c, &(0x7f00000009c0), 0x0, 0x0) syz_genetlink_get_family_id$mptcp(0x0, 0xffffffffffffffff) 21:18:52 executing program 3: r0 = io_uring_setup(0x355e, &(0x7f0000000000)={0x0, 0x0, 0x20, 0x0, 0x1be}) r1 = syz_io_uring_setup(0x8fe, &(0x7f0000000080)={0x0, 0x1830, 0x0, 0x0, 0x1b8, 0x0, r0}, &(0x7f0000ffb000/0x2000)=nil, &(0x7f0000ffb000/0x4000)=nil, &(0x7f0000000100), &(0x7f0000000140)=0x0) r3 = openat$hwrng(0xffffffffffffff9c, &(0x7f0000000180), 0x2, 0x0) syz_genetlink_get_family_id$mptcp(&(0x7f0000000300), r3) r4 = openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000500)='./cgroup/syz1\x00', 0x200002, 0x0) syz_io_uring_submit(0x0, r2, &(0x7f0000000580)=@IORING_OP_FILES_UPDATE={0x14, 0x4, 0x0, 0x0, 0x40, &(0x7f0000000540)=[0xffffffffffffffff, 0xffffffffffffffff, r4, r0, r1], 0x5}, 0x3) io_uring_setup(0x2812, &(0x7f00000005c0)={0x0, 0x5e1b, 0x2, 0x3, 0x12f}) socket$inet6_tcp(0xa, 0x1, 0x0) io_uring_setup(0x7c8f, &(0x7f0000001140)={0x0, 0xc240, 0x10, 0x3, 0x1c7}) 21:18:52 executing program 5: r0 = io_uring_setup(0x0, &(0x7f0000000000)={0x0, 0x7682, 0x20, 0x1, 0x1be}) r1 = syz_io_uring_setup(0x8fe, &(0x7f0000000080)={0x0, 0x1830, 0x0, 0x0, 0x1b8, 0x0, r0}, &(0x7f0000ffb000/0x2000)=nil, &(0x7f0000ffb000/0x4000)=nil, &(0x7f0000000100), &(0x7f0000000140)=0x0) r3 = openat$hwrng(0xffffffffffffff9c, &(0x7f0000000180), 0x2, 0x0) r4 = syz_io_uring_setup(0x65dd, &(0x7f00000001c0)={0x0, 0xf46f, 0x20, 0x2, 0xdf}, &(0x7f0000ffe000/0x1000)=nil, &(0x7f0000ffd000/0x1000)=nil, &(0x7f0000000240), &(0x7f0000000280)) r5 = syz_genetlink_get_family_id$mptcp(&(0x7f0000000300), r3) sendmsg$MPTCP_PM_CMD_ADD_ADDR(r3, &(0x7f00000003c0)={&(0x7f00000002c0)={0x10, 0x0, 0x0, 0x10}, 0xc, &(0x7f0000000380)={&(0x7f0000000340)={0x24, r5, 0x300, 0x70bd26, 0x25dfdbfb, {}, [@MPTCP_PM_ATTR_SUBFLOWS={0x8, 0x3, 0x1}, @MPTCP_PM_ATTR_RCV_ADD_ADDRS={0x8, 0x2, 0x2}]}, 0x24}, 0x1, 0x0, 0x0, 0x20000004}, 0x8890) r6 = openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000500)='./cgroup/syz1\x00', 0x200002, 0x0) syz_io_uring_submit(0x0, r2, &(0x7f0000000580)=@IORING_OP_FILES_UPDATE={0x14, 0x4, 0x0, 0x0, 0x40, &(0x7f0000000540)=[r4, 0xffffffffffffffff, r6, r0, r1], 0x5}, 0x3) socket$inet6_tcp(0xa, 0x1, 0x0) openat$procfs(0xffffffffffffff9c, &(0x7f00000010c0)='/proc/crypto\x00', 0x0, 0x0) 21:18:52 executing program 2: r0 = syz_io_uring_setup(0x8fe, &(0x7f0000000080), &(0x7f0000ffb000/0x2000)=nil, &(0x7f0000ffb000/0x4000)=nil, &(0x7f0000000100), &(0x7f0000000140)=0x0) openat$hwrng(0xffffffffffffff9c, &(0x7f0000000180), 0x0, 0x0) r2 = openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000500)='./cgroup/syz1\x00', 0x200002, 0x0) syz_io_uring_submit(0x0, r1, &(0x7f0000000580)=@IORING_OP_FILES_UPDATE={0x14, 0x4, 0x0, 0x0, 0x40, &(0x7f0000000540)=[0xffffffffffffffff, 0xffffffffffffffff, r2, 0xffffffffffffffff, r0], 0x5}, 0x3) io_uring_setup(0x2812, &(0x7f00000005c0)={0x0, 0x5e1b, 0x2, 0x3, 0x12f}) 21:18:52 executing program 1: r0 = io_uring_setup(0x355e, &(0x7f0000000000)={0x0, 0x0, 0x20, 0x1, 0x1be}) r1 = openat$hwrng(0xffffffffffffff9c, &(0x7f0000000180), 0x2, 0x0) r2 = syz_io_uring_setup(0x0, &(0x7f00000001c0)={0x0, 0xf46f, 0x20, 0x2, 0xdf}, &(0x7f0000ffe000/0x1000)=nil, &(0x7f0000ffd000/0x1000)=nil, &(0x7f0000000240), &(0x7f0000000280)) syz_genetlink_get_family_id$mptcp(&(0x7f0000000300), r1) syz_io_uring_setup(0x20f8, &(0x7f0000000400)={0x0, 0x7677, 0x8, 0x3, 0x22f, 0x0, r2}, &(0x7f0000ffe000/0x2000)=nil, &(0x7f0000ffb000/0x2000)=nil, &(0x7f0000000480)=0x0, &(0x7f00000004c0)) r4 = openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000500)='./cgroup/syz1\x00', 0x200002, 0x0) syz_io_uring_submit(r3, 0x0, &(0x7f0000000580)=@IORING_OP_FILES_UPDATE={0x14, 0x4, 0x0, 0x0, 0x40, &(0x7f0000000540)=[r2, 0xffffffffffffffff, r4, r0, 0xffffffffffffffff], 0x5}, 0x3) io_uring_setup(0x2812, &(0x7f00000005c0)={0x0, 0x5e1b, 0x2, 0x3, 0x12f, 0x0, r2}) socket$inet6_tcp(0xa, 0x1, 0x0) openat$procfs(0xffffffffffffff9c, &(0x7f00000010c0)='/proc/crypto\x00', 0x0, 0x0) io_uring_setup(0x7c8f, &(0x7f0000001140)={0x0, 0xc240, 0x10, 0x3, 0x1c7, 0x0, r2}) 21:18:52 executing program 6: r0 = io_uring_setup(0x355e, &(0x7f0000000000)={0x0, 0x0, 0x20}) r1 = syz_io_uring_setup(0x8fe, &(0x7f0000000080)={0x0, 0x1830, 0x0, 0x0, 0x1b8, 0x0, r0}, &(0x7f0000ffb000/0x2000)=nil, &(0x7f0000ffb000/0x4000)=nil, &(0x7f0000000100), &(0x7f0000000140)=0x0) r3 = openat$hwrng(0xffffffffffffff9c, &(0x7f0000000180), 0x2, 0x0) r4 = syz_genetlink_get_family_id$mptcp(&(0x7f0000000300), r3) sendmsg$MPTCP_PM_CMD_ADD_ADDR(r3, &(0x7f00000003c0)={&(0x7f00000002c0)={0x10, 0x0, 0x0, 0x10}, 0xc, &(0x7f0000000380)={&(0x7f0000000340)={0x24, r4, 0x300, 0x70bd26, 0x25dfdbfb, {}, [@MPTCP_PM_ATTR_SUBFLOWS={0x8, 0x3, 0x1}, @MPTCP_PM_ATTR_RCV_ADD_ADDRS={0x8, 0x2, 0x2}]}, 0x24}, 0x1, 0x0, 0x0, 0x20000004}, 0x8890) syz_io_uring_setup(0x20f8, &(0x7f0000000400)={0x0, 0x7677, 0x8, 0x3, 0x22f}, &(0x7f0000ffe000/0x2000)=nil, &(0x7f0000ffb000/0x2000)=nil, &(0x7f0000000480)=0x0, &(0x7f00000004c0)) r6 = openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000500)='./cgroup/syz1\x00', 0x200002, 0x0) syz_io_uring_submit(r5, r2, &(0x7f0000000580)=@IORING_OP_FILES_UPDATE={0x14, 0x4, 0x0, 0x0, 0x40, &(0x7f0000000540)=[0xffffffffffffffff, 0xffffffffffffffff, r6, r0, r1], 0x5}, 0x3) socket$inet6_tcp(0xa, 0x1, 0x0) openat$procfs(0xffffffffffffff9c, &(0x7f00000010c0)='/proc/crypto\x00', 0x0, 0x0) io_uring_setup(0x7c8f, &(0x7f0000001140)={0x0, 0xc240, 0x10, 0x3, 0x1c7}) 21:18:52 executing program 0: syz_io_uring_setup(0x8fe, &(0x7f0000000080), &(0x7f0000ffb000/0x2000)=nil, &(0x7f0000ffb000/0x4000)=nil, &(0x7f0000000100), &(0x7f0000000140)) openat$hwrng(0xffffffffffffff9c, &(0x7f0000000180), 0x2, 0x0) openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000500)='./cgroup/syz1\x00', 0x200002, 0x0) syz_io_uring_submit(0x0, 0x0, 0x0, 0x3) io_uring_setup(0x2812, &(0x7f00000005c0)={0x0, 0x5e1b, 0x2, 0x3, 0x12f}) socket$inet6_tcp(0xa, 0x1, 0x0) 21:18:52 executing program 2: syz_io_uring_setup(0x8fe, &(0x7f0000000080), &(0x7f0000ffb000/0x2000)=nil, &(0x7f0000ffb000/0x4000)=nil, &(0x7f0000000100), &(0x7f0000000140)) openat$hwrng(0xffffffffffffff9c, &(0x7f0000000180), 0x0, 0x0) openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000500)='./cgroup/syz1\x00', 0x200002, 0x0) io_uring_setup(0x2812, &(0x7f00000005c0)={0x0, 0x5e1b, 0x2, 0x3, 0x12f}) 21:18:52 executing program 7: pipe2$9p(&(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}, 0x0) write$P9_RSYMLINK(r0, 0x0, 0x0) add_key$fscrypt_v1(&(0x7f0000000280), &(0x7f00000002c0)={'fscrypt:', @desc2}, 0x0, 0x0, 0xfffffffffffffffa) syz_genetlink_get_family_id$mptcp(&(0x7f00000004c0), 0xffffffffffffffff) openat$vcsa(0xffffffffffffff9c, &(0x7f00000009c0), 0x0, 0x0) syz_genetlink_get_family_id$mptcp(0x0, 0xffffffffffffffff) 21:18:52 executing program 6: r0 = io_uring_setup(0x355e, &(0x7f0000000000)={0x0, 0x0, 0x20}) r1 = syz_io_uring_setup(0x8fe, &(0x7f0000000080)={0x0, 0x1830, 0x0, 0x0, 0x1b8, 0x0, r0}, &(0x7f0000ffb000/0x2000)=nil, &(0x7f0000ffb000/0x4000)=nil, &(0x7f0000000100), &(0x7f0000000140)=0x0) r3 = openat$hwrng(0xffffffffffffff9c, &(0x7f0000000180), 0x2, 0x0) r4 = syz_genetlink_get_family_id$mptcp(&(0x7f0000000300), r3) sendmsg$MPTCP_PM_CMD_ADD_ADDR(r3, &(0x7f00000003c0)={&(0x7f00000002c0)={0x10, 0x0, 0x0, 0x10}, 0xc, &(0x7f0000000380)={&(0x7f0000000340)={0x24, r4, 0x300, 0x70bd26, 0x25dfdbfb, {}, [@MPTCP_PM_ATTR_SUBFLOWS={0x8, 0x3, 0x1}, @MPTCP_PM_ATTR_RCV_ADD_ADDRS={0x8, 0x2, 0x2}]}, 0x24}, 0x1, 0x0, 0x0, 0x20000004}, 0x8890) syz_io_uring_setup(0x20f8, &(0x7f0000000400)={0x0, 0x7677, 0x8, 0x3, 0x22f}, &(0x7f0000ffe000/0x2000)=nil, &(0x7f0000ffb000/0x2000)=nil, &(0x7f0000000480)=0x0, &(0x7f00000004c0)) r6 = openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000500)='./cgroup/syz1\x00', 0x200002, 0x0) syz_io_uring_submit(r5, r2, &(0x7f0000000580)=@IORING_OP_FILES_UPDATE={0x14, 0x4, 0x0, 0x0, 0x40, &(0x7f0000000540)=[0xffffffffffffffff, 0xffffffffffffffff, r6, r0, r1], 0x5}, 0x3) socket$inet6_tcp(0xa, 0x1, 0x0) openat$procfs(0xffffffffffffff9c, &(0x7f00000010c0)='/proc/crypto\x00', 0x0, 0x0) io_uring_setup(0x7c8f, &(0x7f0000001140)={0x0, 0xc240, 0x10, 0x3, 0x1c7}) 21:18:52 executing program 3: r0 = io_uring_setup(0x355e, &(0x7f0000000000)={0x0, 0x0, 0x20, 0x0, 0x1be}) r1 = syz_io_uring_setup(0x8fe, &(0x7f0000000080)={0x0, 0x1830, 0x0, 0x0, 0x1b8, 0x0, r0}, &(0x7f0000ffb000/0x2000)=nil, &(0x7f0000ffb000/0x4000)=nil, &(0x7f0000000100), &(0x7f0000000140)=0x0) r3 = openat$hwrng(0xffffffffffffff9c, &(0x7f0000000180), 0x2, 0x0) syz_genetlink_get_family_id$mptcp(&(0x7f0000000300), r3) r4 = openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000500)='./cgroup/syz1\x00', 0x200002, 0x0) syz_io_uring_submit(0x0, r2, &(0x7f0000000580)=@IORING_OP_FILES_UPDATE={0x14, 0x4, 0x0, 0x0, 0x40, &(0x7f0000000540)=[0xffffffffffffffff, 0xffffffffffffffff, r4, r0, r1], 0x5}, 0x3) io_uring_setup(0x2812, &(0x7f00000005c0)={0x0, 0x5e1b, 0x2, 0x3, 0x12f}) socket$inet6_tcp(0xa, 0x1, 0x0) io_uring_setup(0x7c8f, &(0x7f0000001140)={0x0, 0xc240, 0x10, 0x3, 0x1c7}) 21:19:01 executing program 2: syz_io_uring_setup(0x8fe, &(0x7f0000000080), &(0x7f0000ffb000/0x2000)=nil, &(0x7f0000ffb000/0x4000)=nil, &(0x7f0000000100), &(0x7f0000000140)) openat$hwrng(0xffffffffffffff9c, &(0x7f0000000180), 0x0, 0x0) openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000500)='./cgroup/syz1\x00', 0x200002, 0x0) io_uring_setup(0x2812, &(0x7f00000005c0)={0x0, 0x5e1b, 0x2, 0x3, 0x12f}) 21:19:01 executing program 3: r0 = io_uring_setup(0x355e, &(0x7f0000000000)={0x0, 0x0, 0x20, 0x0, 0x1be}) r1 = syz_io_uring_setup(0x8fe, &(0x7f0000000080)={0x0, 0x1830, 0x0, 0x0, 0x1b8, 0x0, r0}, &(0x7f0000ffb000/0x2000)=nil, &(0x7f0000ffb000/0x4000)=nil, &(0x7f0000000100), &(0x7f0000000140)=0x0) r3 = openat$hwrng(0xffffffffffffff9c, &(0x7f0000000180), 0x2, 0x0) syz_genetlink_get_family_id$mptcp(&(0x7f0000000300), r3) r4 = openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000500)='./cgroup/syz1\x00', 0x200002, 0x0) syz_io_uring_submit(0x0, r2, &(0x7f0000000580)=@IORING_OP_FILES_UPDATE={0x14, 0x4, 0x0, 0x0, 0x40, &(0x7f0000000540)=[0xffffffffffffffff, 0xffffffffffffffff, r4, r0, r1], 0x5}, 0x3) io_uring_setup(0x2812, &(0x7f00000005c0)={0x0, 0x5e1b, 0x2, 0x3, 0x12f}) socket$inet6_tcp(0xa, 0x1, 0x0) io_uring_setup(0x7c8f, &(0x7f0000001140)={0x0, 0xc240, 0x10, 0x3, 0x1c7}) 21:19:01 executing program 6: r0 = io_uring_setup(0x355e, &(0x7f0000000000)={0x0, 0x0, 0x20}) r1 = syz_io_uring_setup(0x8fe, &(0x7f0000000080)={0x0, 0x1830, 0x0, 0x0, 0x1b8, 0x0, r0}, &(0x7f0000ffb000/0x2000)=nil, &(0x7f0000ffb000/0x4000)=nil, &(0x7f0000000100), &(0x7f0000000140)=0x0) r3 = openat$hwrng(0xffffffffffffff9c, &(0x7f0000000180), 0x2, 0x0) r4 = syz_genetlink_get_family_id$mptcp(&(0x7f0000000300), r3) sendmsg$MPTCP_PM_CMD_ADD_ADDR(r3, &(0x7f00000003c0)={&(0x7f00000002c0)={0x10, 0x0, 0x0, 0x10}, 0xc, &(0x7f0000000380)={&(0x7f0000000340)={0x24, r4, 0x300, 0x70bd26, 0x25dfdbfb, {}, [@MPTCP_PM_ATTR_SUBFLOWS={0x8, 0x3, 0x1}, @MPTCP_PM_ATTR_RCV_ADD_ADDRS={0x8, 0x2, 0x2}]}, 0x24}, 0x1, 0x0, 0x0, 0x20000004}, 0x8890) syz_io_uring_setup(0x20f8, &(0x7f0000000400)={0x0, 0x7677, 0x8, 0x3, 0x22f}, &(0x7f0000ffe000/0x2000)=nil, &(0x7f0000ffb000/0x2000)=nil, &(0x7f0000000480)=0x0, &(0x7f00000004c0)) r6 = openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000500)='./cgroup/syz1\x00', 0x200002, 0x0) syz_io_uring_submit(r5, r2, &(0x7f0000000580)=@IORING_OP_FILES_UPDATE={0x14, 0x4, 0x0, 0x0, 0x40, &(0x7f0000000540)=[0xffffffffffffffff, 0xffffffffffffffff, r6, r0, r1], 0x5}, 0x3) socket$inet6_tcp(0xa, 0x1, 0x0) openat$procfs(0xffffffffffffff9c, &(0x7f00000010c0)='/proc/crypto\x00', 0x0, 0x0) io_uring_setup(0x7c8f, &(0x7f0000001140)={0x0, 0xc240, 0x10, 0x3, 0x1c7}) 21:19:01 executing program 7: pipe2$9p(&(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}, 0x0) write$P9_RSYMLINK(r0, 0x0, 0x0) add_key$fscrypt_v1(&(0x7f0000000280), &(0x7f00000002c0)={'fscrypt:', @desc2}, 0x0, 0x0, 0xfffffffffffffffa) syz_genetlink_get_family_id$mptcp(&(0x7f00000004c0), 0xffffffffffffffff) openat$vcsa(0xffffffffffffff9c, &(0x7f00000009c0), 0x0, 0x0) syz_genetlink_get_family_id$mptcp(0x0, 0xffffffffffffffff) 21:19:01 executing program 1: r0 = io_uring_setup(0x355e, &(0x7f0000000000)={0x0, 0x0, 0x20, 0x1, 0x1be}) r1 = openat$hwrng(0xffffffffffffff9c, &(0x7f0000000180), 0x2, 0x0) r2 = syz_io_uring_setup(0x0, &(0x7f00000001c0)={0x0, 0xf46f, 0x20, 0x2, 0xdf}, &(0x7f0000ffe000/0x1000)=nil, &(0x7f0000ffd000/0x1000)=nil, &(0x7f0000000240), &(0x7f0000000280)) syz_genetlink_get_family_id$mptcp(&(0x7f0000000300), r1) syz_io_uring_setup(0x20f8, &(0x7f0000000400)={0x0, 0x7677, 0x8, 0x3, 0x22f, 0x0, r2}, &(0x7f0000ffe000/0x2000)=nil, &(0x7f0000ffb000/0x2000)=nil, &(0x7f0000000480)=0x0, &(0x7f00000004c0)) r4 = openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000500)='./cgroup/syz1\x00', 0x200002, 0x0) syz_io_uring_submit(r3, 0x0, &(0x7f0000000580)=@IORING_OP_FILES_UPDATE={0x14, 0x4, 0x0, 0x0, 0x40, &(0x7f0000000540)=[r2, 0xffffffffffffffff, r4, r0, 0xffffffffffffffff], 0x5}, 0x3) io_uring_setup(0x2812, &(0x7f00000005c0)={0x0, 0x5e1b, 0x2, 0x3, 0x12f, 0x0, r2}) socket$inet6_tcp(0xa, 0x1, 0x0) openat$procfs(0xffffffffffffff9c, &(0x7f00000010c0)='/proc/crypto\x00', 0x0, 0x0) io_uring_setup(0x7c8f, &(0x7f0000001140)={0x0, 0xc240, 0x10, 0x3, 0x1c7, 0x0, r2}) 21:19:01 executing program 5: r0 = io_uring_setup(0x355e, 0x0) r1 = syz_io_uring_setup(0x8fe, &(0x7f0000000080)={0x0, 0x1830, 0x0, 0x0, 0x1b8, 0x0, r0}, &(0x7f0000ffb000/0x2000)=nil, &(0x7f0000ffb000/0x4000)=nil, &(0x7f0000000100), &(0x7f0000000140)=0x0) r3 = openat$hwrng(0xffffffffffffff9c, &(0x7f0000000180), 0x2, 0x0) r4 = syz_io_uring_setup(0x65dd, &(0x7f00000001c0)={0x0, 0xf46f, 0x20, 0x2, 0xdf}, &(0x7f0000ffe000/0x1000)=nil, &(0x7f0000ffd000/0x1000)=nil, &(0x7f0000000240), &(0x7f0000000280)) r5 = syz_genetlink_get_family_id$mptcp(&(0x7f0000000300), r3) sendmsg$MPTCP_PM_CMD_ADD_ADDR(r3, &(0x7f00000003c0)={&(0x7f00000002c0)={0x10, 0x0, 0x0, 0x10}, 0xc, &(0x7f0000000380)={&(0x7f0000000340)={0x24, r5, 0x300, 0x70bd26, 0x25dfdbfb, {}, [@MPTCP_PM_ATTR_SUBFLOWS={0x8, 0x3, 0x1}, @MPTCP_PM_ATTR_RCV_ADD_ADDRS={0x8, 0x2, 0x2}]}, 0x24}, 0x1, 0x0, 0x0, 0x20000004}, 0x8890) r6 = openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000500)='./cgroup/syz1\x00', 0x200002, 0x0) syz_io_uring_submit(0x0, r2, &(0x7f0000000580)=@IORING_OP_FILES_UPDATE={0x14, 0x4, 0x0, 0x0, 0x40, &(0x7f0000000540)=[r4, 0xffffffffffffffff, r6, r0, r1], 0x5}, 0x3) socket$inet6_tcp(0xa, 0x1, 0x0) openat$procfs(0xffffffffffffff9c, &(0x7f00000010c0)='/proc/crypto\x00', 0x0, 0x0) 21:19:01 executing program 0: syz_io_uring_setup(0x8fe, &(0x7f0000000080), &(0x7f0000ffb000/0x2000)=nil, &(0x7f0000ffb000/0x4000)=nil, &(0x7f0000000100), &(0x7f0000000140)) openat$hwrng(0xffffffffffffff9c, &(0x7f0000000180), 0x2, 0x0) openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000500)='./cgroup/syz1\x00', 0x200002, 0x0) syz_io_uring_submit(0x0, 0x0, 0x0, 0x0) io_uring_setup(0x2812, &(0x7f00000005c0)={0x0, 0x5e1b, 0x2, 0x3, 0x12f}) socket$inet6_tcp(0xa, 0x1, 0x0) 21:19:01 executing program 4: ioctl$SCSI_IOCTL_DOORUNLOCK(0xffffffffffffffff, 0x5381) r0 = syz_open_dev$mouse(&(0x7f0000000000), 0x578, 0x4000) ioctl$SG_GET_PACK_ID(0xffffffffffffffff, 0x227c, &(0x7f0000000040)) syz_genetlink_get_family_id$nl80211(&(0x7f00000000c0), r0) syz_open_dev$vcsa(&(0x7f0000000440), 0x56, 0x4000) socketpair(0x0, 0x3, 0x6, &(0x7f0000000640)) r1 = openat$tcp_congestion(0xffffffffffffff9c, &(0x7f0000000800), 0x1, 0x0) write$tcp_congestion(r1, &(0x7f0000000840)='htcp\x00', 0x5) 21:19:01 executing program 5: r0 = io_uring_setup(0x355e, 0x0) r1 = syz_io_uring_setup(0x8fe, &(0x7f0000000080)={0x0, 0x1830, 0x0, 0x0, 0x1b8, 0x0, r0}, &(0x7f0000ffb000/0x2000)=nil, &(0x7f0000ffb000/0x4000)=nil, &(0x7f0000000100), &(0x7f0000000140)=0x0) r3 = openat$hwrng(0xffffffffffffff9c, &(0x7f0000000180), 0x2, 0x0) r4 = syz_io_uring_setup(0x65dd, &(0x7f00000001c0)={0x0, 0xf46f, 0x20, 0x2, 0xdf}, &(0x7f0000ffe000/0x1000)=nil, &(0x7f0000ffd000/0x1000)=nil, &(0x7f0000000240), &(0x7f0000000280)) r5 = syz_genetlink_get_family_id$mptcp(&(0x7f0000000300), r3) sendmsg$MPTCP_PM_CMD_ADD_ADDR(r3, &(0x7f00000003c0)={&(0x7f00000002c0)={0x10, 0x0, 0x0, 0x10}, 0xc, &(0x7f0000000380)={&(0x7f0000000340)={0x24, r5, 0x300, 0x70bd26, 0x25dfdbfb, {}, [@MPTCP_PM_ATTR_SUBFLOWS={0x8, 0x3, 0x1}, @MPTCP_PM_ATTR_RCV_ADD_ADDRS={0x8, 0x2, 0x2}]}, 0x24}, 0x1, 0x0, 0x0, 0x20000004}, 0x8890) r6 = openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000500)='./cgroup/syz1\x00', 0x200002, 0x0) syz_io_uring_submit(0x0, r2, &(0x7f0000000580)=@IORING_OP_FILES_UPDATE={0x14, 0x4, 0x0, 0x0, 0x40, &(0x7f0000000540)=[r4, 0xffffffffffffffff, r6, r0, r1], 0x5}, 0x3) socket$inet6_tcp(0xa, 0x1, 0x0) openat$procfs(0xffffffffffffff9c, &(0x7f00000010c0)='/proc/crypto\x00', 0x0, 0x0) 21:19:01 executing program 1: r0 = io_uring_setup(0x355e, &(0x7f0000000000)={0x0, 0x0, 0x20, 0x1, 0x1be}) r1 = openat$hwrng(0xffffffffffffff9c, &(0x7f0000000180), 0x2, 0x0) r2 = syz_io_uring_setup(0x0, &(0x7f00000001c0)={0x0, 0xf46f, 0x20, 0x2, 0xdf}, &(0x7f0000ffe000/0x1000)=nil, &(0x7f0000ffd000/0x1000)=nil, &(0x7f0000000240), &(0x7f0000000280)) syz_genetlink_get_family_id$mptcp(&(0x7f0000000300), r1) syz_io_uring_setup(0x20f8, &(0x7f0000000400)={0x0, 0x7677, 0x8, 0x3, 0x22f, 0x0, r2}, &(0x7f0000ffe000/0x2000)=nil, &(0x7f0000ffb000/0x2000)=nil, &(0x7f0000000480)=0x0, &(0x7f00000004c0)) r4 = openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000500)='./cgroup/syz1\x00', 0x200002, 0x0) syz_io_uring_submit(r3, 0x0, &(0x7f0000000580)=@IORING_OP_FILES_UPDATE={0x14, 0x4, 0x0, 0x0, 0x40, &(0x7f0000000540)=[r2, 0xffffffffffffffff, r4, r0, 0xffffffffffffffff], 0x5}, 0x3) io_uring_setup(0x2812, &(0x7f00000005c0)={0x0, 0x5e1b, 0x2, 0x3, 0x12f, 0x0, r2}) socket$inet6_tcp(0xa, 0x1, 0x0) openat$procfs(0xffffffffffffff9c, &(0x7f00000010c0)='/proc/crypto\x00', 0x0, 0x0) io_uring_setup(0x7c8f, &(0x7f0000001140)={0x0, 0xc240, 0x10, 0x3, 0x1c7, 0x0, r2}) 21:19:01 executing program 0: syz_io_uring_setup(0x8fe, &(0x7f0000000080), &(0x7f0000ffb000/0x2000)=nil, &(0x7f0000ffb000/0x4000)=nil, &(0x7f0000000100), &(0x7f0000000140)) openat$hwrng(0xffffffffffffff9c, &(0x7f0000000180), 0x2, 0x0) openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000500)='./cgroup/syz1\x00', 0x200002, 0x0) syz_io_uring_submit(0x0, 0x0, 0x0, 0x0) io_uring_setup(0x0, &(0x7f00000005c0)={0x0, 0x5e1b, 0x2, 0x3, 0x12f}) socket$inet6_tcp(0xa, 0x1, 0x0) 21:19:01 executing program 2: syz_io_uring_setup(0x8fe, &(0x7f0000000080), &(0x7f0000ffb000/0x2000)=nil, &(0x7f0000ffb000/0x4000)=nil, &(0x7f0000000100), &(0x7f0000000140)) openat$hwrng(0xffffffffffffff9c, &(0x7f0000000180), 0x0, 0x0) openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000500)='./cgroup/syz1\x00', 0x200002, 0x0) io_uring_setup(0x2812, &(0x7f00000005c0)={0x0, 0x5e1b, 0x2, 0x3, 0x12f}) 21:19:01 executing program 3: r0 = io_uring_setup(0x355e, &(0x7f0000000000)={0x0, 0x0, 0x20, 0x1}) r1 = syz_io_uring_setup(0x8fe, &(0x7f0000000080)={0x0, 0x1830, 0x0, 0x0, 0x1b8, 0x0, r0}, &(0x7f0000ffb000/0x2000)=nil, &(0x7f0000ffb000/0x4000)=nil, &(0x7f0000000100), &(0x7f0000000140)=0x0) r3 = openat$hwrng(0xffffffffffffff9c, &(0x7f0000000180), 0x2, 0x0) syz_genetlink_get_family_id$mptcp(&(0x7f0000000300), r3) r4 = openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000500)='./cgroup/syz1\x00', 0x200002, 0x0) syz_io_uring_submit(0x0, r2, &(0x7f0000000580)=@IORING_OP_FILES_UPDATE={0x14, 0x4, 0x0, 0x0, 0x40, &(0x7f0000000540)=[0xffffffffffffffff, 0xffffffffffffffff, r4, r0, r1], 0x5}, 0x3) io_uring_setup(0x2812, &(0x7f00000005c0)={0x0, 0x5e1b, 0x2, 0x3, 0x12f}) socket$inet6_tcp(0xa, 0x1, 0x0) io_uring_setup(0x7c8f, &(0x7f0000001140)={0x0, 0xc240, 0x10, 0x3, 0x1c7}) 21:19:01 executing program 4: ioctl$SCSI_IOCTL_DOORUNLOCK(0xffffffffffffffff, 0x5381) r0 = syz_open_dev$mouse(&(0x7f0000000000), 0x578, 0x4000) ioctl$SG_GET_PACK_ID(0xffffffffffffffff, 0x227c, &(0x7f0000000040)) syz_genetlink_get_family_id$nl80211(&(0x7f00000000c0), r0) syz_open_dev$vcsa(&(0x7f0000000440), 0x56, 0x4000) socketpair(0x0, 0x3, 0x6, &(0x7f0000000640)) r1 = openat$tcp_congestion(0xffffffffffffff9c, &(0x7f0000000800), 0x1, 0x0) write$tcp_congestion(r1, &(0x7f0000000840)='htcp\x00', 0x5) 21:19:01 executing program 0: syz_io_uring_setup(0x8fe, &(0x7f0000000080), &(0x7f0000ffb000/0x2000)=nil, &(0x7f0000ffb000/0x4000)=nil, &(0x7f0000000100), &(0x7f0000000140)) openat$hwrng(0xffffffffffffff9c, &(0x7f0000000180), 0x2, 0x0) openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000500)='./cgroup/syz1\x00', 0x200002, 0x0) syz_io_uring_submit(0x0, 0x0, 0x0, 0x0) io_uring_setup(0x0, &(0x7f00000005c0)={0x0, 0x5e1b, 0x2, 0x3, 0x12f}) socket$inet6_tcp(0xa, 0x1, 0x0) 21:19:01 executing program 7: pipe2$9p(&(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}, 0x0) write$P9_RSYMLINK(r0, 0x0, 0x0) add_key$fscrypt_v1(&(0x7f0000000280), &(0x7f00000002c0)={'fscrypt:', @desc2}, 0x0, 0x0, 0xfffffffffffffffa) syz_genetlink_get_family_id$mptcp(&(0x7f00000004c0), 0xffffffffffffffff) openat$vcsa(0xffffffffffffff9c, &(0x7f00000009c0), 0x0, 0x0) 21:19:01 executing program 1: r0 = io_uring_setup(0x355e, &(0x7f0000000000)={0x0, 0x0, 0x20, 0x1, 0x1be}) r1 = openat$hwrng(0xffffffffffffff9c, &(0x7f0000000180), 0x2, 0x0) r2 = syz_io_uring_setup(0x65dd, 0x0, &(0x7f0000ffe000/0x1000)=nil, &(0x7f0000ffd000/0x1000)=nil, &(0x7f0000000240), &(0x7f0000000280)) syz_genetlink_get_family_id$mptcp(&(0x7f0000000300), r1) syz_io_uring_setup(0x20f8, &(0x7f0000000400)={0x0, 0x7677, 0x8, 0x3, 0x22f, 0x0, r2}, &(0x7f0000ffe000/0x2000)=nil, &(0x7f0000ffb000/0x2000)=nil, &(0x7f0000000480)=0x0, &(0x7f00000004c0)) r4 = openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000500)='./cgroup/syz1\x00', 0x200002, 0x0) syz_io_uring_submit(r3, 0x0, &(0x7f0000000580)=@IORING_OP_FILES_UPDATE={0x14, 0x4, 0x0, 0x0, 0x40, &(0x7f0000000540)=[r2, 0xffffffffffffffff, r4, r0, 0xffffffffffffffff], 0x5}, 0x3) io_uring_setup(0x2812, &(0x7f00000005c0)={0x0, 0x5e1b, 0x2, 0x3, 0x12f, 0x0, r2}) socket$inet6_tcp(0xa, 0x1, 0x0) openat$procfs(0xffffffffffffff9c, &(0x7f00000010c0)='/proc/crypto\x00', 0x0, 0x0) io_uring_setup(0x7c8f, &(0x7f0000001140)={0x0, 0xc240, 0x10, 0x3, 0x1c7, 0x0, r2}) 21:19:01 executing program 6: r0 = io_uring_setup(0x355e, &(0x7f0000000000)={0x0, 0x0, 0x20, 0x0, 0x1be}) r1 = syz_io_uring_setup(0x0, &(0x7f0000000080)={0x0, 0x1830, 0x0, 0x0, 0x1b8, 0x0, r0}, &(0x7f0000ffb000/0x2000)=nil, &(0x7f0000ffb000/0x4000)=nil, &(0x7f0000000100), &(0x7f0000000140)=0x0) r3 = openat$hwrng(0xffffffffffffff9c, &(0x7f0000000180), 0x2, 0x0) r4 = syz_genetlink_get_family_id$mptcp(&(0x7f0000000300), r3) sendmsg$MPTCP_PM_CMD_ADD_ADDR(r3, &(0x7f00000003c0)={&(0x7f00000002c0)={0x10, 0x0, 0x0, 0x10}, 0xc, &(0x7f0000000380)={&(0x7f0000000340)={0x24, r4, 0x300, 0x70bd26, 0x25dfdbfb, {}, [@MPTCP_PM_ATTR_SUBFLOWS={0x8, 0x3, 0x1}, @MPTCP_PM_ATTR_RCV_ADD_ADDRS={0x8, 0x2, 0x2}]}, 0x24}, 0x1, 0x0, 0x0, 0x20000004}, 0x8890) syz_io_uring_setup(0x20f8, &(0x7f0000000400)={0x0, 0x7677, 0x8, 0x3, 0x22f}, &(0x7f0000ffe000/0x2000)=nil, &(0x7f0000ffb000/0x2000)=nil, &(0x7f0000000480)=0x0, &(0x7f00000004c0)) r6 = openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000500)='./cgroup/syz1\x00', 0x200002, 0x0) syz_io_uring_submit(r5, r2, &(0x7f0000000580)=@IORING_OP_FILES_UPDATE={0x14, 0x4, 0x0, 0x0, 0x40, &(0x7f0000000540)=[0xffffffffffffffff, 0xffffffffffffffff, r6, r0, r1], 0x5}, 0x3) socket$inet6_tcp(0xa, 0x1, 0x0) openat$procfs(0xffffffffffffff9c, &(0x7f00000010c0)='/proc/crypto\x00', 0x0, 0x0) io_uring_setup(0x7c8f, &(0x7f0000001140)={0x0, 0xc240, 0x10, 0x3, 0x1c7}) 21:19:01 executing program 0: syz_io_uring_setup(0x8fe, &(0x7f0000000080), &(0x7f0000ffb000/0x2000)=nil, &(0x7f0000ffb000/0x4000)=nil, &(0x7f0000000100), &(0x7f0000000140)) openat$hwrng(0xffffffffffffff9c, &(0x7f0000000180), 0x2, 0x0) openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000500)='./cgroup/syz1\x00', 0x200002, 0x0) syz_io_uring_submit(0x0, 0x0, 0x0, 0x0) io_uring_setup(0x0, &(0x7f00000005c0)={0x0, 0x5e1b, 0x2, 0x3, 0x12f}) socket$inet6_tcp(0xa, 0x1, 0x0) 21:19:01 executing program 5: r0 = io_uring_setup(0x355e, 0x0) r1 = syz_io_uring_setup(0x8fe, &(0x7f0000000080)={0x0, 0x1830, 0x0, 0x0, 0x1b8, 0x0, r0}, &(0x7f0000ffb000/0x2000)=nil, &(0x7f0000ffb000/0x4000)=nil, &(0x7f0000000100), &(0x7f0000000140)=0x0) r3 = openat$hwrng(0xffffffffffffff9c, &(0x7f0000000180), 0x2, 0x0) r4 = syz_io_uring_setup(0x65dd, &(0x7f00000001c0)={0x0, 0xf46f, 0x20, 0x2, 0xdf}, &(0x7f0000ffe000/0x1000)=nil, &(0x7f0000ffd000/0x1000)=nil, &(0x7f0000000240), &(0x7f0000000280)) r5 = syz_genetlink_get_family_id$mptcp(&(0x7f0000000300), r3) sendmsg$MPTCP_PM_CMD_ADD_ADDR(r3, &(0x7f00000003c0)={&(0x7f00000002c0)={0x10, 0x0, 0x0, 0x10}, 0xc, &(0x7f0000000380)={&(0x7f0000000340)={0x24, r5, 0x300, 0x70bd26, 0x25dfdbfb, {}, [@MPTCP_PM_ATTR_SUBFLOWS={0x8, 0x3, 0x1}, @MPTCP_PM_ATTR_RCV_ADD_ADDRS={0x8, 0x2, 0x2}]}, 0x24}, 0x1, 0x0, 0x0, 0x20000004}, 0x8890) r6 = openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000500)='./cgroup/syz1\x00', 0x200002, 0x0) syz_io_uring_submit(0x0, r2, &(0x7f0000000580)=@IORING_OP_FILES_UPDATE={0x14, 0x4, 0x0, 0x0, 0x40, &(0x7f0000000540)=[r4, 0xffffffffffffffff, r6, r0, r1], 0x5}, 0x3) socket$inet6_tcp(0xa, 0x1, 0x0) openat$procfs(0xffffffffffffff9c, &(0x7f00000010c0)='/proc/crypto\x00', 0x0, 0x0) 21:19:01 executing program 2: r0 = syz_io_uring_setup(0x8fe, &(0x7f0000000080), &(0x7f0000ffb000/0x2000)=nil, &(0x7f0000ffb000/0x4000)=nil, &(0x7f0000000100), &(0x7f0000000140)=0x0) openat$hwrng(0xffffffffffffff9c, &(0x7f0000000180), 0x0, 0x0) syz_io_uring_submit(0x0, r1, &(0x7f0000000580)=@IORING_OP_FILES_UPDATE={0x14, 0x4, 0x0, 0x0, 0x40, &(0x7f0000000540)=[0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, r0], 0x5}, 0x3) io_uring_setup(0x2812, &(0x7f00000005c0)={0x0, 0x5e1b, 0x2, 0x3, 0x12f}) 21:19:01 executing program 4: ioctl$SCSI_IOCTL_DOORUNLOCK(0xffffffffffffffff, 0x5381) r0 = syz_open_dev$mouse(&(0x7f0000000000), 0x578, 0x4000) ioctl$SG_GET_PACK_ID(r0, 0x227c, 0x0) syz_genetlink_get_family_id$nl80211(&(0x7f00000000c0), r0) syz_open_dev$vcsa(&(0x7f0000000440), 0x56, 0x4000) socketpair(0x0, 0x3, 0x6, &(0x7f0000000640)) r1 = openat$tcp_congestion(0xffffffffffffff9c, &(0x7f0000000800), 0x1, 0x0) write$tcp_congestion(r1, &(0x7f0000000840)='htcp\x00', 0x5) 21:19:01 executing program 7: pipe2$9p(&(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}, 0x0) write$P9_RSYMLINK(r0, 0x0, 0x0) add_key$fscrypt_v1(&(0x7f0000000280), &(0x7f00000002c0)={'fscrypt:', @desc2}, 0x0, 0x0, 0xfffffffffffffffa) syz_genetlink_get_family_id$mptcp(&(0x7f00000004c0), 0xffffffffffffffff) 21:19:01 executing program 0: syz_io_uring_setup(0x8fe, &(0x7f0000000080), &(0x7f0000ffb000/0x2000)=nil, &(0x7f0000ffb000/0x4000)=nil, &(0x7f0000000100), &(0x7f0000000140)) openat$hwrng(0xffffffffffffff9c, &(0x7f0000000180), 0x2, 0x0) openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000500)='./cgroup/syz1\x00', 0x200002, 0x0) syz_io_uring_submit(0x0, 0x0, 0x0, 0x0) io_uring_setup(0x2812, 0x0) socket$inet6_tcp(0xa, 0x1, 0x0) 21:19:01 executing program 1: r0 = io_uring_setup(0x355e, &(0x7f0000000000)={0x0, 0x0, 0x20, 0x1, 0x1be}) r1 = openat$hwrng(0xffffffffffffff9c, &(0x7f0000000180), 0x2, 0x0) r2 = syz_io_uring_setup(0x65dd, 0x0, &(0x7f0000ffe000/0x1000)=nil, &(0x7f0000ffd000/0x1000)=nil, &(0x7f0000000240), &(0x7f0000000280)) syz_genetlink_get_family_id$mptcp(&(0x7f0000000300), r1) syz_io_uring_setup(0x20f8, &(0x7f0000000400)={0x0, 0x7677, 0x8, 0x3, 0x22f, 0x0, r2}, &(0x7f0000ffe000/0x2000)=nil, &(0x7f0000ffb000/0x2000)=nil, &(0x7f0000000480)=0x0, &(0x7f00000004c0)) r4 = openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000500)='./cgroup/syz1\x00', 0x200002, 0x0) syz_io_uring_submit(r3, 0x0, &(0x7f0000000580)=@IORING_OP_FILES_UPDATE={0x14, 0x4, 0x0, 0x0, 0x40, &(0x7f0000000540)=[r2, 0xffffffffffffffff, r4, r0, 0xffffffffffffffff], 0x5}, 0x3) io_uring_setup(0x2812, &(0x7f00000005c0)={0x0, 0x5e1b, 0x2, 0x3, 0x12f, 0x0, r2}) socket$inet6_tcp(0xa, 0x1, 0x0) openat$procfs(0xffffffffffffff9c, &(0x7f00000010c0)='/proc/crypto\x00', 0x0, 0x0) io_uring_setup(0x7c8f, &(0x7f0000001140)={0x0, 0xc240, 0x10, 0x3, 0x1c7, 0x0, r2}) 21:19:01 executing program 5: r0 = io_uring_setup(0x355e, &(0x7f0000000000)={0x0, 0x0, 0x20, 0x1, 0x1be}) r1 = syz_io_uring_setup(0x8fe, &(0x7f0000000080)={0x0, 0x1830, 0x0, 0x0, 0x1b8, 0x0, r0}, &(0x7f0000ffb000/0x2000)=nil, &(0x7f0000ffb000/0x4000)=nil, &(0x7f0000000100), &(0x7f0000000140)=0x0) r3 = openat$hwrng(0xffffffffffffff9c, &(0x7f0000000180), 0x2, 0x0) r4 = syz_io_uring_setup(0x65dd, &(0x7f00000001c0)={0x0, 0xf46f, 0x20, 0x2, 0xdf}, &(0x7f0000ffe000/0x1000)=nil, &(0x7f0000ffd000/0x1000)=nil, &(0x7f0000000240), &(0x7f0000000280)) r5 = syz_genetlink_get_family_id$mptcp(&(0x7f0000000300), r3) sendmsg$MPTCP_PM_CMD_ADD_ADDR(r3, &(0x7f00000003c0)={&(0x7f00000002c0)={0x10, 0x0, 0x0, 0x10}, 0xc, &(0x7f0000000380)={&(0x7f0000000340)={0x24, r5, 0x300, 0x70bd26, 0x25dfdbfb, {}, [@MPTCP_PM_ATTR_SUBFLOWS={0x8, 0x3, 0x1}, @MPTCP_PM_ATTR_RCV_ADD_ADDRS={0x8, 0x2, 0x2}]}, 0x24}, 0x1, 0x0, 0x0, 0x20000004}, 0x8890) r6 = openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000500)='./cgroup/syz1\x00', 0x200002, 0x0) syz_io_uring_submit(0x0, r2, &(0x7f0000000580)=@IORING_OP_FILES_UPDATE={0x14, 0x4, 0x0, 0x0, 0x40, &(0x7f0000000540)=[r4, 0xffffffffffffffff, r6, r0, r1], 0x5}, 0x3) socket$inet6_tcp(0xa, 0x1, 0x0) openat$procfs(0xffffffffffffff9c, &(0x7f00000010c0)='/proc/crypto\x00', 0x0, 0x0) 21:19:01 executing program 0: syz_io_uring_setup(0x8fe, &(0x7f0000000080), &(0x7f0000ffb000/0x2000)=nil, &(0x7f0000ffb000/0x4000)=nil, &(0x7f0000000100), &(0x7f0000000140)) openat$hwrng(0xffffffffffffff9c, &(0x7f0000000180), 0x2, 0x0) openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000500)='./cgroup/syz1\x00', 0x200002, 0x0) syz_io_uring_submit(0x0, 0x0, 0x0, 0x0) io_uring_setup(0x2812, 0x0) socket$inet6_tcp(0xa, 0x1, 0x0) 21:19:01 executing program 4: ioctl$SCSI_IOCTL_DOORUNLOCK(0xffffffffffffffff, 0x5381) r0 = syz_open_dev$mouse(&(0x7f0000000000), 0x578, 0x4000) ioctl$SG_GET_PACK_ID(r0, 0x227c, 0x0) syz_genetlink_get_family_id$nl80211(&(0x7f00000000c0), r0) syz_open_dev$vcsa(&(0x7f0000000440), 0x56, 0x4000) socketpair(0x0, 0x3, 0x6, &(0x7f0000000640)) r1 = openat$tcp_congestion(0xffffffffffffff9c, &(0x7f0000000800), 0x1, 0x0) write$tcp_congestion(r1, &(0x7f0000000840)='htcp\x00', 0x5) 21:19:11 executing program 6: r0 = io_uring_setup(0x355e, &(0x7f0000000000)={0x0, 0x0, 0x20, 0x0, 0x1be}) r1 = syz_io_uring_setup(0x0, &(0x7f0000000080)={0x0, 0x1830, 0x0, 0x0, 0x1b8, 0x0, r0}, &(0x7f0000ffb000/0x2000)=nil, &(0x7f0000ffb000/0x4000)=nil, &(0x7f0000000100), &(0x7f0000000140)=0x0) r3 = openat$hwrng(0xffffffffffffff9c, &(0x7f0000000180), 0x2, 0x0) r4 = syz_genetlink_get_family_id$mptcp(&(0x7f0000000300), r3) sendmsg$MPTCP_PM_CMD_ADD_ADDR(r3, &(0x7f00000003c0)={&(0x7f00000002c0)={0x10, 0x0, 0x0, 0x10}, 0xc, &(0x7f0000000380)={&(0x7f0000000340)={0x24, r4, 0x300, 0x70bd26, 0x25dfdbfb, {}, [@MPTCP_PM_ATTR_SUBFLOWS={0x8, 0x3, 0x1}, @MPTCP_PM_ATTR_RCV_ADD_ADDRS={0x8, 0x2, 0x2}]}, 0x24}, 0x1, 0x0, 0x0, 0x20000004}, 0x8890) syz_io_uring_setup(0x20f8, &(0x7f0000000400)={0x0, 0x7677, 0x8, 0x3, 0x22f}, &(0x7f0000ffe000/0x2000)=nil, &(0x7f0000ffb000/0x2000)=nil, &(0x7f0000000480)=0x0, &(0x7f00000004c0)) r6 = openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000500)='./cgroup/syz1\x00', 0x200002, 0x0) syz_io_uring_submit(r5, r2, &(0x7f0000000580)=@IORING_OP_FILES_UPDATE={0x14, 0x4, 0x0, 0x0, 0x40, &(0x7f0000000540)=[0xffffffffffffffff, 0xffffffffffffffff, r6, r0, r1], 0x5}, 0x3) socket$inet6_tcp(0xa, 0x1, 0x0) openat$procfs(0xffffffffffffff9c, &(0x7f00000010c0)='/proc/crypto\x00', 0x0, 0x0) io_uring_setup(0x7c8f, &(0x7f0000001140)={0x0, 0xc240, 0x10, 0x3, 0x1c7}) 21:19:11 executing program 3: r0 = io_uring_setup(0x355e, &(0x7f0000000000)={0x0, 0x0, 0x20, 0x1}) r1 = syz_io_uring_setup(0x8fe, &(0x7f0000000080)={0x0, 0x1830, 0x0, 0x0, 0x1b8, 0x0, r0}, &(0x7f0000ffb000/0x2000)=nil, &(0x7f0000ffb000/0x4000)=nil, &(0x7f0000000100), &(0x7f0000000140)=0x0) r3 = openat$hwrng(0xffffffffffffff9c, &(0x7f0000000180), 0x2, 0x0) syz_genetlink_get_family_id$mptcp(&(0x7f0000000300), r3) r4 = openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000500)='./cgroup/syz1\x00', 0x200002, 0x0) syz_io_uring_submit(0x0, r2, &(0x7f0000000580)=@IORING_OP_FILES_UPDATE={0x14, 0x4, 0x0, 0x0, 0x40, &(0x7f0000000540)=[0xffffffffffffffff, 0xffffffffffffffff, r4, r0, r1], 0x5}, 0x3) io_uring_setup(0x2812, &(0x7f00000005c0)={0x0, 0x5e1b, 0x2, 0x3, 0x12f}) socket$inet6_tcp(0xa, 0x1, 0x0) io_uring_setup(0x7c8f, &(0x7f0000001140)={0x0, 0xc240, 0x10, 0x3, 0x1c7}) 21:19:11 executing program 4: ioctl$SCSI_IOCTL_DOORUNLOCK(0xffffffffffffffff, 0x5381) r0 = syz_open_dev$mouse(&(0x7f0000000000), 0x578, 0x4000) ioctl$SG_GET_PACK_ID(r0, 0x227c, 0x0) syz_genetlink_get_family_id$nl80211(&(0x7f00000000c0), r0) syz_open_dev$vcsa(&(0x7f0000000440), 0x56, 0x4000) socketpair(0x0, 0x3, 0x6, &(0x7f0000000640)) r1 = openat$tcp_congestion(0xffffffffffffff9c, &(0x7f0000000800), 0x1, 0x0) write$tcp_congestion(r1, &(0x7f0000000840)='htcp\x00', 0x5) 21:19:11 executing program 7: pipe2$9p(&(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}, 0x0) write$P9_RSYMLINK(r0, 0x0, 0x0) add_key$fscrypt_v1(&(0x7f0000000280), &(0x7f00000002c0)={'fscrypt:', @desc2}, 0x0, 0x0, 0xfffffffffffffffa) 21:19:11 executing program 0: syz_io_uring_setup(0x8fe, &(0x7f0000000080), &(0x7f0000ffb000/0x2000)=nil, &(0x7f0000ffb000/0x4000)=nil, &(0x7f0000000100), &(0x7f0000000140)) openat$hwrng(0xffffffffffffff9c, &(0x7f0000000180), 0x2, 0x0) openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000500)='./cgroup/syz1\x00', 0x200002, 0x0) syz_io_uring_submit(0x0, 0x0, 0x0, 0x0) io_uring_setup(0x2812, 0x0) socket$inet6_tcp(0xa, 0x1, 0x0) 21:19:11 executing program 1: r0 = io_uring_setup(0x355e, &(0x7f0000000000)={0x0, 0x0, 0x20, 0x1, 0x1be}) r1 = openat$hwrng(0xffffffffffffff9c, &(0x7f0000000180), 0x2, 0x0) r2 = syz_io_uring_setup(0x65dd, 0x0, &(0x7f0000ffe000/0x1000)=nil, &(0x7f0000ffd000/0x1000)=nil, &(0x7f0000000240), &(0x7f0000000280)) syz_genetlink_get_family_id$mptcp(&(0x7f0000000300), r1) syz_io_uring_setup(0x20f8, &(0x7f0000000400)={0x0, 0x7677, 0x8, 0x3, 0x22f, 0x0, r2}, &(0x7f0000ffe000/0x2000)=nil, &(0x7f0000ffb000/0x2000)=nil, &(0x7f0000000480)=0x0, &(0x7f00000004c0)) r4 = openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000500)='./cgroup/syz1\x00', 0x200002, 0x0) syz_io_uring_submit(r3, 0x0, &(0x7f0000000580)=@IORING_OP_FILES_UPDATE={0x14, 0x4, 0x0, 0x0, 0x40, &(0x7f0000000540)=[r2, 0xffffffffffffffff, r4, r0, 0xffffffffffffffff], 0x5}, 0x3) io_uring_setup(0x2812, &(0x7f00000005c0)={0x0, 0x5e1b, 0x2, 0x3, 0x12f, 0x0, r2}) socket$inet6_tcp(0xa, 0x1, 0x0) openat$procfs(0xffffffffffffff9c, &(0x7f00000010c0)='/proc/crypto\x00', 0x0, 0x0) io_uring_setup(0x7c8f, &(0x7f0000001140)={0x0, 0xc240, 0x10, 0x3, 0x1c7, 0x0, r2}) 21:19:11 executing program 5: r0 = io_uring_setup(0x355e, &(0x7f0000000000)={0x0, 0x0, 0x0, 0x1, 0x1be}) r1 = syz_io_uring_setup(0x8fe, &(0x7f0000000080)={0x0, 0x1830, 0x0, 0x0, 0x1b8, 0x0, r0}, &(0x7f0000ffb000/0x2000)=nil, &(0x7f0000ffb000/0x4000)=nil, &(0x7f0000000100), &(0x7f0000000140)=0x0) r3 = openat$hwrng(0xffffffffffffff9c, &(0x7f0000000180), 0x2, 0x0) r4 = syz_io_uring_setup(0x65dd, &(0x7f00000001c0)={0x0, 0xf46f, 0x20, 0x2, 0xdf}, &(0x7f0000ffe000/0x1000)=nil, &(0x7f0000ffd000/0x1000)=nil, &(0x7f0000000240), &(0x7f0000000280)) r5 = syz_genetlink_get_family_id$mptcp(&(0x7f0000000300), r3) sendmsg$MPTCP_PM_CMD_ADD_ADDR(r3, &(0x7f00000003c0)={&(0x7f00000002c0)={0x10, 0x0, 0x0, 0x10}, 0xc, &(0x7f0000000380)={&(0x7f0000000340)={0x24, r5, 0x300, 0x70bd26, 0x25dfdbfb, {}, [@MPTCP_PM_ATTR_SUBFLOWS={0x8, 0x3, 0x1}, @MPTCP_PM_ATTR_RCV_ADD_ADDRS={0x8, 0x2, 0x2}]}, 0x24}, 0x1, 0x0, 0x0, 0x20000004}, 0x8890) r6 = openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000500)='./cgroup/syz1\x00', 0x200002, 0x0) syz_io_uring_submit(0x0, r2, &(0x7f0000000580)=@IORING_OP_FILES_UPDATE={0x14, 0x4, 0x0, 0x0, 0x40, &(0x7f0000000540)=[r4, 0xffffffffffffffff, r6, r0, r1], 0x5}, 0x3) socket$inet6_tcp(0xa, 0x1, 0x0) openat$procfs(0xffffffffffffff9c, &(0x7f00000010c0)='/proc/crypto\x00', 0x0, 0x0) 21:19:11 executing program 2: r0 = syz_io_uring_setup(0x8fe, &(0x7f0000000080), &(0x7f0000ffb000/0x2000)=nil, &(0x7f0000ffb000/0x4000)=nil, &(0x7f0000000100), &(0x7f0000000140)=0x0) openat$hwrng(0xffffffffffffff9c, &(0x7f0000000180), 0x0, 0x0) syz_io_uring_submit(0x0, r1, &(0x7f0000000580)=@IORING_OP_FILES_UPDATE={0x14, 0x4, 0x0, 0x0, 0x40, &(0x7f0000000540)=[0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, r0], 0x5}, 0x3) io_uring_setup(0x2812, &(0x7f00000005c0)={0x0, 0x5e1b, 0x2, 0x3, 0x12f}) 21:19:11 executing program 7: pipe2$9p(&(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}, 0x0) write$P9_RSYMLINK(r0, 0x0, 0x0) 21:19:11 executing program 7: pipe2$9p(&(0x7f0000000200), 0x0) 21:19:11 executing program 7: pipe2$9p(0x0, 0x0) 21:19:11 executing program 7: pipe2$9p(0x0, 0x0) 21:19:11 executing program 2: r0 = syz_io_uring_setup(0x8fe, &(0x7f0000000080), &(0x7f0000ffb000/0x2000)=nil, &(0x7f0000ffb000/0x4000)=nil, &(0x7f0000000100), &(0x7f0000000140)=0x0) openat$hwrng(0xffffffffffffff9c, &(0x7f0000000180), 0x0, 0x0) syz_io_uring_submit(0x0, r1, &(0x7f0000000580)=@IORING_OP_FILES_UPDATE={0x14, 0x4, 0x0, 0x0, 0x40, &(0x7f0000000540)=[0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, r0], 0x5}, 0x3) io_uring_setup(0x2812, &(0x7f00000005c0)={0x0, 0x5e1b, 0x2, 0x3, 0x12f}) 21:19:11 executing program 0: syz_io_uring_setup(0x8fe, &(0x7f0000000080), &(0x7f0000ffb000/0x2000)=nil, &(0x7f0000ffb000/0x4000)=nil, &(0x7f0000000100), &(0x7f0000000140)) openat$hwrng(0xffffffffffffff9c, &(0x7f0000000180), 0x2, 0x0) openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000500)='./cgroup/syz1\x00', 0x200002, 0x0) syz_io_uring_submit(0x0, 0x0, 0x0, 0x0) io_uring_setup(0x2812, &(0x7f00000005c0)={0x0, 0x0, 0x2, 0x3, 0x12f}) socket$inet6_tcp(0xa, 0x1, 0x0) 21:19:19 executing program 3: r0 = io_uring_setup(0x355e, &(0x7f0000000000)={0x0, 0x0, 0x20, 0x1}) r1 = syz_io_uring_setup(0x8fe, &(0x7f0000000080)={0x0, 0x1830, 0x0, 0x0, 0x1b8, 0x0, r0}, &(0x7f0000ffb000/0x2000)=nil, &(0x7f0000ffb000/0x4000)=nil, &(0x7f0000000100), &(0x7f0000000140)=0x0) r3 = openat$hwrng(0xffffffffffffff9c, &(0x7f0000000180), 0x2, 0x0) syz_genetlink_get_family_id$mptcp(&(0x7f0000000300), r3) r4 = openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000500)='./cgroup/syz1\x00', 0x200002, 0x0) syz_io_uring_submit(0x0, r2, &(0x7f0000000580)=@IORING_OP_FILES_UPDATE={0x14, 0x4, 0x0, 0x0, 0x40, &(0x7f0000000540)=[0xffffffffffffffff, 0xffffffffffffffff, r4, r0, r1], 0x5}, 0x3) io_uring_setup(0x2812, &(0x7f00000005c0)={0x0, 0x5e1b, 0x2, 0x3, 0x12f}) socket$inet6_tcp(0xa, 0x1, 0x0) io_uring_setup(0x7c8f, &(0x7f0000001140)={0x0, 0xc240, 0x10, 0x3, 0x1c7}) 21:19:19 executing program 0: syz_io_uring_setup(0x8fe, &(0x7f0000000080), &(0x7f0000ffb000/0x2000)=nil, &(0x7f0000ffb000/0x4000)=nil, &(0x7f0000000100), &(0x7f0000000140)) openat$hwrng(0xffffffffffffff9c, &(0x7f0000000180), 0x2, 0x0) openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000500)='./cgroup/syz1\x00', 0x200002, 0x0) syz_io_uring_submit(0x0, 0x0, 0x0, 0x0) io_uring_setup(0x2812, &(0x7f00000005c0)={0x0, 0x0, 0x2, 0x3, 0x12f}) socket$inet6_tcp(0xa, 0x1, 0x0) 21:19:19 executing program 7: pipe2$9p(0x0, 0x0) 21:19:19 executing program 2: r0 = syz_io_uring_setup(0x8fe, &(0x7f0000000080), &(0x7f0000ffb000/0x2000)=nil, &(0x7f0000ffb000/0x4000)=nil, &(0x7f0000000100), &(0x7f0000000140)=0x0) r2 = openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000500)='./cgroup/syz1\x00', 0x200002, 0x0) syz_io_uring_submit(0x0, r1, &(0x7f0000000580)=@IORING_OP_FILES_UPDATE={0x14, 0x4, 0x0, 0x0, 0x40, &(0x7f0000000540)=[0xffffffffffffffff, 0xffffffffffffffff, r2, 0xffffffffffffffff, r0], 0x5}, 0x3) io_uring_setup(0x2812, &(0x7f00000005c0)={0x0, 0x5e1b, 0x2, 0x3, 0x12f}) 21:19:19 executing program 1: r0 = io_uring_setup(0x355e, &(0x7f0000000000)={0x0, 0x0, 0x20, 0x1, 0x1be}) r1 = openat$hwrng(0xffffffffffffff9c, &(0x7f0000000180), 0x2, 0x0) r2 = syz_io_uring_setup(0x65dd, &(0x7f00000001c0)={0x0, 0x0, 0x20, 0x2, 0xdf}, &(0x7f0000ffe000/0x1000)=nil, &(0x7f0000ffd000/0x1000)=nil, &(0x7f0000000240), &(0x7f0000000280)) syz_genetlink_get_family_id$mptcp(&(0x7f0000000300), r1) syz_io_uring_setup(0x20f8, &(0x7f0000000400)={0x0, 0x7677, 0x8, 0x3, 0x22f, 0x0, r2}, &(0x7f0000ffe000/0x2000)=nil, &(0x7f0000ffb000/0x2000)=nil, &(0x7f0000000480)=0x0, &(0x7f00000004c0)) r4 = openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000500)='./cgroup/syz1\x00', 0x200002, 0x0) syz_io_uring_submit(r3, 0x0, &(0x7f0000000580)=@IORING_OP_FILES_UPDATE={0x14, 0x4, 0x0, 0x0, 0x40, &(0x7f0000000540)=[r2, 0xffffffffffffffff, r4, r0, 0xffffffffffffffff], 0x5}, 0x3) io_uring_setup(0x2812, &(0x7f00000005c0)={0x0, 0x5e1b, 0x2, 0x3, 0x12f, 0x0, r2}) socket$inet6_tcp(0xa, 0x1, 0x0) openat$procfs(0xffffffffffffff9c, &(0x7f00000010c0)='/proc/crypto\x00', 0x0, 0x0) io_uring_setup(0x7c8f, &(0x7f0000001140)={0x0, 0xc240, 0x10, 0x3, 0x1c7, 0x0, r2}) 21:19:19 executing program 6: r0 = io_uring_setup(0x355e, &(0x7f0000000000)={0x0, 0x0, 0x20, 0x0, 0x1be}) r1 = syz_io_uring_setup(0x0, &(0x7f0000000080)={0x0, 0x1830, 0x0, 0x0, 0x1b8, 0x0, r0}, &(0x7f0000ffb000/0x2000)=nil, &(0x7f0000ffb000/0x4000)=nil, &(0x7f0000000100), &(0x7f0000000140)=0x0) r3 = openat$hwrng(0xffffffffffffff9c, &(0x7f0000000180), 0x2, 0x0) r4 = syz_genetlink_get_family_id$mptcp(&(0x7f0000000300), r3) sendmsg$MPTCP_PM_CMD_ADD_ADDR(r3, &(0x7f00000003c0)={&(0x7f00000002c0)={0x10, 0x0, 0x0, 0x10}, 0xc, &(0x7f0000000380)={&(0x7f0000000340)={0x24, r4, 0x300, 0x70bd26, 0x25dfdbfb, {}, [@MPTCP_PM_ATTR_SUBFLOWS={0x8, 0x3, 0x1}, @MPTCP_PM_ATTR_RCV_ADD_ADDRS={0x8, 0x2, 0x2}]}, 0x24}, 0x1, 0x0, 0x0, 0x20000004}, 0x8890) syz_io_uring_setup(0x20f8, &(0x7f0000000400)={0x0, 0x7677, 0x8, 0x3, 0x22f}, &(0x7f0000ffe000/0x2000)=nil, &(0x7f0000ffb000/0x2000)=nil, &(0x7f0000000480)=0x0, &(0x7f00000004c0)) r6 = openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000500)='./cgroup/syz1\x00', 0x200002, 0x0) syz_io_uring_submit(r5, r2, &(0x7f0000000580)=@IORING_OP_FILES_UPDATE={0x14, 0x4, 0x0, 0x0, 0x40, &(0x7f0000000540)=[0xffffffffffffffff, 0xffffffffffffffff, r6, r0, r1], 0x5}, 0x3) socket$inet6_tcp(0xa, 0x1, 0x0) openat$procfs(0xffffffffffffff9c, &(0x7f00000010c0)='/proc/crypto\x00', 0x0, 0x0) io_uring_setup(0x7c8f, &(0x7f0000001140)={0x0, 0xc240, 0x10, 0x3, 0x1c7}) 21:19:19 executing program 4: ioctl$SCSI_IOCTL_DOORUNLOCK(0xffffffffffffffff, 0x5381) r0 = syz_open_dev$mouse(&(0x7f0000000000), 0x578, 0x4000) ioctl$SG_GET_PACK_ID(r0, 0x227c, &(0x7f0000000040)) syz_genetlink_get_family_id$nl80211(0x0, r0) syz_open_dev$vcsa(&(0x7f0000000440), 0x56, 0x4000) socketpair(0x0, 0x3, 0x6, &(0x7f0000000640)) r1 = openat$tcp_congestion(0xffffffffffffff9c, &(0x7f0000000800), 0x1, 0x0) write$tcp_congestion(r1, &(0x7f0000000840)='htcp\x00', 0x5) 21:19:19 executing program 5: r0 = io_uring_setup(0x355e, &(0x7f0000000000)={0x0, 0x0, 0x0, 0x1, 0x1be}) r1 = syz_io_uring_setup(0x8fe, &(0x7f0000000080)={0x0, 0x1830, 0x0, 0x0, 0x1b8, 0x0, r0}, &(0x7f0000ffb000/0x2000)=nil, &(0x7f0000ffb000/0x4000)=nil, &(0x7f0000000100), &(0x7f0000000140)=0x0) r3 = openat$hwrng(0xffffffffffffff9c, &(0x7f0000000180), 0x2, 0x0) r4 = syz_io_uring_setup(0x65dd, &(0x7f00000001c0)={0x0, 0xf46f, 0x20, 0x2, 0xdf}, &(0x7f0000ffe000/0x1000)=nil, &(0x7f0000ffd000/0x1000)=nil, &(0x7f0000000240), &(0x7f0000000280)) r5 = syz_genetlink_get_family_id$mptcp(&(0x7f0000000300), r3) sendmsg$MPTCP_PM_CMD_ADD_ADDR(r3, &(0x7f00000003c0)={&(0x7f00000002c0)={0x10, 0x0, 0x0, 0x10}, 0xc, &(0x7f0000000380)={&(0x7f0000000340)={0x24, r5, 0x300, 0x70bd26, 0x25dfdbfb, {}, [@MPTCP_PM_ATTR_SUBFLOWS={0x8, 0x3, 0x1}, @MPTCP_PM_ATTR_RCV_ADD_ADDRS={0x8, 0x2, 0x2}]}, 0x24}, 0x1, 0x0, 0x0, 0x20000004}, 0x8890) r6 = openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000500)='./cgroup/syz1\x00', 0x200002, 0x0) syz_io_uring_submit(0x0, r2, &(0x7f0000000580)=@IORING_OP_FILES_UPDATE={0x14, 0x4, 0x0, 0x0, 0x40, &(0x7f0000000540)=[r4, 0xffffffffffffffff, r6, r0, r1], 0x5}, 0x3) socket$inet6_tcp(0xa, 0x1, 0x0) openat$procfs(0xffffffffffffff9c, &(0x7f00000010c0)='/proc/crypto\x00', 0x0, 0x0) [ 489.234339] kmemleak: Found object by alias at 0x607f1a6398ac [ 489.234360] CPU: 1 UID: 0 PID: 6557 Comm: syz-executor.3 Tainted: G W 6.17.0-rc3-next-20250829 #1 PREEMPT(voluntary) [ 489.234378] Tainted: [W]=WARN [ 489.234382] Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.12.0-1 04/01/2014 [ 489.234389] Call Trace: [ 489.234393] [ 489.234398] dump_stack_lvl+0xca/0x120 [ 489.234426] __lookup_object+0x94/0xb0 [ 489.234443] delete_object_full+0x27/0x70 [ 489.234459] free_percpu+0x30/0x1160 [ 489.234476] ? arch_uprobe_clear_state+0x16/0x140 [ 489.234496] futex_hash_free+0x38/0xc0 [ 489.234511] mmput+0x2d3/0x390 [ 489.234535] do_exit+0x79d/0x2970 [ 489.234552] ? __pfx_do_exit+0x10/0x10 [ 489.234566] ? find_held_lock+0x2b/0x80 [ 489.234585] ? get_signal+0x835/0x2340 [ 489.234605] do_group_exit+0xd3/0x2a0 [ 489.234620] get_signal+0x2315/0x2340 [ 489.234637] ? trace_irq_enable.constprop.0+0xc2/0x100 [ 489.234654] ? __pfx_get_signal+0x10/0x10 [ 489.234670] ? __schedule+0xe91/0x3590 [ 489.234691] arch_do_signal_or_restart+0x80/0x790 [ 489.234709] ? __pfx_arch_do_signal_or_restart+0x10/0x10 [ 489.234725] ? __x64_sys_futex+0x1c9/0x4d0 [ 489.234737] ? __x64_sys_futex+0x1d2/0x4d0 [ 489.234752] ? __pfx___x64_sys_futex+0x10/0x10 [ 489.234764] ? lock_mm_and_find_vma+0xaa/0x6f0 [ 489.234778] ? xfd_validate_state+0x55/0x180 [ 489.234800] exit_to_user_mode_loop+0x8b/0x110 [ 489.234813] do_syscall_64+0x2f7/0x360 [ 489.234825] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 489.234838] RIP: 0033:0x7f1060a76b19 [ 489.234846] Code: Unable to access opcode bytes at 0x7f1060a76aef. [ 489.234852] RSP: 002b:00007f105dfec218 EFLAGS: 00000246 ORIG_RAX: 00000000000000ca [ 489.234863] RAX: 0000000000000001 RBX: 00007f1060b89f68 RCX: 00007f1060a76b19 [ 489.234871] RDX: 00000000000f4240 RSI: 0000000000000081 RDI: 00007f1060b89f6c [ 489.234878] RBP: 00007f1060b89f60 R08: 000000000000000e R09: 0000000000000000 [ 489.234885] R10: 0000000000000006 R11: 0000000000000246 R12: 00007f1060b89f6c [ 489.234891] R13: 00007ffed3f8b4af R14: 00007f105dfec300 R15: 0000000000022000 [ 489.234907] [ 489.234911] kmemleak: Object (percpu) 0x607f1a6398a8 (size 8): [ 489.234917] kmemleak: comm "syz-executor.0", pid 6570, jiffies 4295156077 [ 489.234924] kmemleak: min_count = 1 [ 489.234928] kmemleak: count = 0 [ 489.234931] kmemleak: flags = 0x21 [ 489.234935] kmemleak: checksum = 0 [ 489.234939] kmemleak: backtrace: [ 489.234942] pcpu_alloc_noprof+0x87a/0x1170 [ 489.234957] percpu_ref_init+0x37/0x400 [ 489.234975] io_uring_setup+0x44c/0x2000 [ 489.234986] __x64_sys_io_uring_setup+0xc8/0x170 [ 489.234997] do_syscall_64+0xbf/0x360 [ 489.235005] entry_SYSCALL_64_after_hwframe+0x77/0x7f 21:19:19 executing program 1: r0 = io_uring_setup(0x355e, &(0x7f0000000000)={0x0, 0x0, 0x20, 0x1, 0x1be}) r1 = openat$hwrng(0xffffffffffffff9c, &(0x7f0000000180), 0x2, 0x0) r2 = syz_io_uring_setup(0x65dd, &(0x7f00000001c0)={0x0, 0x0, 0x20, 0x2, 0xdf}, &(0x7f0000ffe000/0x1000)=nil, &(0x7f0000ffd000/0x1000)=nil, &(0x7f0000000240), &(0x7f0000000280)) syz_genetlink_get_family_id$mptcp(&(0x7f0000000300), r1) syz_io_uring_setup(0x20f8, &(0x7f0000000400)={0x0, 0x7677, 0x8, 0x3, 0x22f, 0x0, r2}, &(0x7f0000ffe000/0x2000)=nil, &(0x7f0000ffb000/0x2000)=nil, &(0x7f0000000480)=0x0, &(0x7f00000004c0)) r4 = openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000500)='./cgroup/syz1\x00', 0x200002, 0x0) syz_io_uring_submit(r3, 0x0, &(0x7f0000000580)=@IORING_OP_FILES_UPDATE={0x14, 0x4, 0x0, 0x0, 0x40, &(0x7f0000000540)=[r2, 0xffffffffffffffff, r4, r0, 0xffffffffffffffff], 0x5}, 0x3) io_uring_setup(0x2812, &(0x7f00000005c0)={0x0, 0x5e1b, 0x2, 0x3, 0x12f, 0x0, r2}) socket$inet6_tcp(0xa, 0x1, 0x0) openat$procfs(0xffffffffffffff9c, &(0x7f00000010c0)='/proc/crypto\x00', 0x0, 0x0) io_uring_setup(0x7c8f, &(0x7f0000001140)={0x0, 0xc240, 0x10, 0x3, 0x1c7, 0x0, r2}) 21:19:29 executing program 2: r0 = syz_io_uring_setup(0x8fe, &(0x7f0000000080), &(0x7f0000ffb000/0x2000)=nil, &(0x7f0000ffb000/0x4000)=nil, &(0x7f0000000100), &(0x7f0000000140)=0x0) r2 = openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000500)='./cgroup/syz1\x00', 0x200002, 0x0) syz_io_uring_submit(0x0, r1, &(0x7f0000000580)=@IORING_OP_FILES_UPDATE={0x14, 0x4, 0x0, 0x0, 0x40, &(0x7f0000000540)=[0xffffffffffffffff, 0xffffffffffffffff, r2, 0xffffffffffffffff, r0], 0x5}, 0x3) io_uring_setup(0x2812, &(0x7f00000005c0)={0x0, 0x5e1b, 0x2, 0x3, 0x12f}) 21:19:29 executing program 4: ioctl$SCSI_IOCTL_DOORUNLOCK(0xffffffffffffffff, 0x5381) r0 = syz_open_dev$mouse(&(0x7f0000000000), 0x578, 0x4000) ioctl$SG_GET_PACK_ID(r0, 0x227c, &(0x7f0000000040)) syz_genetlink_get_family_id$nl80211(0x0, r0) syz_open_dev$vcsa(&(0x7f0000000440), 0x56, 0x4000) socketpair(0x0, 0x3, 0x6, &(0x7f0000000640)) r1 = openat$tcp_congestion(0xffffffffffffff9c, &(0x7f0000000800), 0x1, 0x0) write$tcp_congestion(r1, &(0x7f0000000840)='htcp\x00', 0x5) 21:19:29 executing program 5: r0 = io_uring_setup(0x355e, &(0x7f0000000000)={0x0, 0x0, 0x0, 0x1, 0x1be}) r1 = syz_io_uring_setup(0x8fe, &(0x7f0000000080)={0x0, 0x1830, 0x0, 0x0, 0x1b8, 0x0, r0}, &(0x7f0000ffb000/0x2000)=nil, &(0x7f0000ffb000/0x4000)=nil, &(0x7f0000000100), &(0x7f0000000140)=0x0) r3 = openat$hwrng(0xffffffffffffff9c, &(0x7f0000000180), 0x2, 0x0) r4 = syz_io_uring_setup(0x65dd, &(0x7f00000001c0)={0x0, 0xf46f, 0x20, 0x2, 0xdf}, &(0x7f0000ffe000/0x1000)=nil, &(0x7f0000ffd000/0x1000)=nil, &(0x7f0000000240), &(0x7f0000000280)) r5 = syz_genetlink_get_family_id$mptcp(&(0x7f0000000300), r3) sendmsg$MPTCP_PM_CMD_ADD_ADDR(r3, &(0x7f00000003c0)={&(0x7f00000002c0)={0x10, 0x0, 0x0, 0x10}, 0xc, &(0x7f0000000380)={&(0x7f0000000340)={0x24, r5, 0x300, 0x70bd26, 0x25dfdbfb, {}, [@MPTCP_PM_ATTR_SUBFLOWS={0x8, 0x3, 0x1}, @MPTCP_PM_ATTR_RCV_ADD_ADDRS={0x8, 0x2, 0x2}]}, 0x24}, 0x1, 0x0, 0x0, 0x20000004}, 0x8890) r6 = openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000500)='./cgroup/syz1\x00', 0x200002, 0x0) syz_io_uring_submit(0x0, r2, &(0x7f0000000580)=@IORING_OP_FILES_UPDATE={0x14, 0x4, 0x0, 0x0, 0x40, &(0x7f0000000540)=[r4, 0xffffffffffffffff, r6, r0, r1], 0x5}, 0x3) socket$inet6_tcp(0xa, 0x1, 0x0) openat$procfs(0xffffffffffffff9c, &(0x7f00000010c0)='/proc/crypto\x00', 0x0, 0x0) 21:19:29 executing program 0: syz_io_uring_setup(0x8fe, &(0x7f0000000080), &(0x7f0000ffb000/0x2000)=nil, &(0x7f0000ffb000/0x4000)=nil, &(0x7f0000000100), &(0x7f0000000140)) openat$hwrng(0xffffffffffffff9c, &(0x7f0000000180), 0x2, 0x0) openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000500)='./cgroup/syz1\x00', 0x200002, 0x0) syz_io_uring_submit(0x0, 0x0, 0x0, 0x0) io_uring_setup(0x2812, &(0x7f00000005c0)={0x0, 0x0, 0x0, 0x3, 0x12f}) socket$inet6_tcp(0xa, 0x1, 0x0) 21:19:29 executing program 3: r0 = io_uring_setup(0x355e, &(0x7f0000000000)={0x0, 0x0, 0x20, 0x1, 0x1be}) r1 = syz_io_uring_setup(0x0, &(0x7f0000000080)={0x0, 0x1830, 0x0, 0x0, 0x1b8, 0x0, r0}, &(0x7f0000ffb000/0x2000)=nil, &(0x7f0000ffb000/0x4000)=nil, &(0x7f0000000100), &(0x7f0000000140)=0x0) r3 = openat$hwrng(0xffffffffffffff9c, &(0x7f0000000180), 0x2, 0x0) syz_genetlink_get_family_id$mptcp(&(0x7f0000000300), r3) r4 = openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000500)='./cgroup/syz1\x00', 0x200002, 0x0) syz_io_uring_submit(0x0, r2, &(0x7f0000000580)=@IORING_OP_FILES_UPDATE={0x14, 0x4, 0x0, 0x0, 0x40, &(0x7f0000000540)=[0xffffffffffffffff, 0xffffffffffffffff, r4, r0, r1], 0x5}, 0x3) io_uring_setup(0x2812, &(0x7f00000005c0)={0x0, 0x5e1b, 0x2, 0x3, 0x12f}) socket$inet6_tcp(0xa, 0x1, 0x0) io_uring_setup(0x7c8f, &(0x7f0000001140)={0x0, 0xc240, 0x10, 0x3, 0x1c7}) 21:19:29 executing program 1: r0 = io_uring_setup(0x355e, &(0x7f0000000000)={0x0, 0x0, 0x20, 0x1, 0x1be}) r1 = openat$hwrng(0xffffffffffffff9c, &(0x7f0000000180), 0x2, 0x0) r2 = syz_io_uring_setup(0x65dd, &(0x7f00000001c0)={0x0, 0x0, 0x20, 0x2, 0xdf}, &(0x7f0000ffe000/0x1000)=nil, &(0x7f0000ffd000/0x1000)=nil, &(0x7f0000000240), &(0x7f0000000280)) syz_genetlink_get_family_id$mptcp(&(0x7f0000000300), r1) syz_io_uring_setup(0x20f8, &(0x7f0000000400)={0x0, 0x7677, 0x8, 0x3, 0x22f, 0x0, r2}, &(0x7f0000ffe000/0x2000)=nil, &(0x7f0000ffb000/0x2000)=nil, &(0x7f0000000480)=0x0, &(0x7f00000004c0)) r4 = openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000500)='./cgroup/syz1\x00', 0x200002, 0x0) syz_io_uring_submit(r3, 0x0, &(0x7f0000000580)=@IORING_OP_FILES_UPDATE={0x14, 0x4, 0x0, 0x0, 0x40, &(0x7f0000000540)=[r2, 0xffffffffffffffff, r4, r0, 0xffffffffffffffff], 0x5}, 0x3) io_uring_setup(0x2812, &(0x7f00000005c0)={0x0, 0x5e1b, 0x2, 0x3, 0x12f, 0x0, r2}) socket$inet6_tcp(0xa, 0x1, 0x0) openat$procfs(0xffffffffffffff9c, &(0x7f00000010c0)='/proc/crypto\x00', 0x0, 0x0) io_uring_setup(0x7c8f, &(0x7f0000001140)={0x0, 0xc240, 0x10, 0x3, 0x1c7, 0x0, r2}) 21:19:29 executing program 6: r0 = io_uring_setup(0x355e, &(0x7f0000000000)={0x0, 0x0, 0x20, 0x0, 0x1be}) r1 = syz_io_uring_setup(0x8fe, 0x0, &(0x7f0000ffb000/0x2000)=nil, &(0x7f0000ffb000/0x4000)=nil, &(0x7f0000000100), &(0x7f0000000140)=0x0) r3 = openat$hwrng(0xffffffffffffff9c, &(0x7f0000000180), 0x2, 0x0) r4 = syz_genetlink_get_family_id$mptcp(&(0x7f0000000300), r3) sendmsg$MPTCP_PM_CMD_ADD_ADDR(r3, &(0x7f00000003c0)={&(0x7f00000002c0)={0x10, 0x0, 0x0, 0x10}, 0xc, &(0x7f0000000380)={&(0x7f0000000340)={0x24, r4, 0x300, 0x70bd26, 0x25dfdbfb, {}, [@MPTCP_PM_ATTR_SUBFLOWS={0x8, 0x3, 0x1}, @MPTCP_PM_ATTR_RCV_ADD_ADDRS={0x8, 0x2, 0x2}]}, 0x24}, 0x1, 0x0, 0x0, 0x20000004}, 0x8890) syz_io_uring_setup(0x20f8, &(0x7f0000000400)={0x0, 0x7677, 0x8, 0x3, 0x22f}, &(0x7f0000ffe000/0x2000)=nil, &(0x7f0000ffb000/0x2000)=nil, &(0x7f0000000480)=0x0, &(0x7f00000004c0)) r6 = openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000500)='./cgroup/syz1\x00', 0x200002, 0x0) syz_io_uring_submit(r5, r2, &(0x7f0000000580)=@IORING_OP_FILES_UPDATE={0x14, 0x4, 0x0, 0x0, 0x40, &(0x7f0000000540)=[0xffffffffffffffff, 0xffffffffffffffff, r6, r0, r1], 0x5}, 0x3) socket$inet6_tcp(0xa, 0x1, 0x0) openat$procfs(0xffffffffffffff9c, &(0x7f00000010c0)='/proc/crypto\x00', 0x0, 0x0) io_uring_setup(0x7c8f, &(0x7f0000001140)={0x0, 0xc240, 0x10, 0x3, 0x1c7}) 21:19:29 executing program 7: pipe2$9p(0x0, 0x0) 21:19:29 executing program 2: r0 = syz_io_uring_setup(0x8fe, &(0x7f0000000080), &(0x7f0000ffb000/0x2000)=nil, &(0x7f0000ffb000/0x4000)=nil, &(0x7f0000000100), &(0x7f0000000140)=0x0) r2 = openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000500)='./cgroup/syz1\x00', 0x200002, 0x0) syz_io_uring_submit(0x0, r1, &(0x7f0000000580)=@IORING_OP_FILES_UPDATE={0x14, 0x4, 0x0, 0x0, 0x40, &(0x7f0000000540)=[0xffffffffffffffff, 0xffffffffffffffff, r2, 0xffffffffffffffff, r0], 0x5}, 0x3) io_uring_setup(0x2812, &(0x7f00000005c0)={0x0, 0x5e1b, 0x2, 0x3, 0x12f}) 21:19:29 executing program 0: syz_io_uring_setup(0x8fe, &(0x7f0000000080), &(0x7f0000ffb000/0x2000)=nil, &(0x7f0000ffb000/0x4000)=nil, &(0x7f0000000100), &(0x7f0000000140)) openat$hwrng(0xffffffffffffff9c, &(0x7f0000000180), 0x2, 0x0) openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000500)='./cgroup/syz1\x00', 0x200002, 0x0) syz_io_uring_submit(0x0, 0x0, 0x0, 0x0) io_uring_setup(0x2812, &(0x7f00000005c0)={0x0, 0x0, 0x0, 0x3, 0x12f}) socket$inet6_tcp(0xa, 0x1, 0x0) 21:19:29 executing program 7: pipe2$9p(0x0, 0x0) 21:19:30 executing program 1: r0 = io_uring_setup(0x355e, &(0x7f0000000000)={0x0, 0x0, 0x20, 0x1, 0x1be}) r1 = openat$hwrng(0xffffffffffffff9c, &(0x7f0000000180), 0x2, 0x0) r2 = syz_io_uring_setup(0x65dd, &(0x7f00000001c0)={0x0, 0x0, 0x0, 0x2, 0xdf}, &(0x7f0000ffe000/0x1000)=nil, &(0x7f0000ffd000/0x1000)=nil, &(0x7f0000000240), &(0x7f0000000280)) syz_genetlink_get_family_id$mptcp(&(0x7f0000000300), r1) syz_io_uring_setup(0x20f8, &(0x7f0000000400)={0x0, 0x7677, 0x8, 0x3, 0x22f, 0x0, r2}, &(0x7f0000ffe000/0x2000)=nil, &(0x7f0000ffb000/0x2000)=nil, &(0x7f0000000480)=0x0, &(0x7f00000004c0)) r4 = openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000500)='./cgroup/syz1\x00', 0x200002, 0x0) syz_io_uring_submit(r3, 0x0, &(0x7f0000000580)=@IORING_OP_FILES_UPDATE={0x14, 0x4, 0x0, 0x0, 0x40, &(0x7f0000000540)=[r2, 0xffffffffffffffff, r4, r0, 0xffffffffffffffff], 0x5}, 0x3) io_uring_setup(0x2812, &(0x7f00000005c0)={0x0, 0x5e1b, 0x2, 0x3, 0x12f, 0x0, r2}) socket$inet6_tcp(0xa, 0x1, 0x0) openat$procfs(0xffffffffffffff9c, &(0x7f00000010c0)='/proc/crypto\x00', 0x0, 0x0) io_uring_setup(0x7c8f, &(0x7f0000001140)={0x0, 0xc240, 0x10, 0x3, 0x1c7, 0x0, r2}) 21:19:30 executing program 6: r0 = io_uring_setup(0x355e, &(0x7f0000000000)={0x0, 0x0, 0x20, 0x0, 0x1be}) r1 = syz_io_uring_setup(0x8fe, 0x0, &(0x7f0000ffb000/0x2000)=nil, &(0x7f0000ffb000/0x4000)=nil, &(0x7f0000000100), &(0x7f0000000140)=0x0) r3 = openat$hwrng(0xffffffffffffff9c, &(0x7f0000000180), 0x2, 0x0) r4 = syz_genetlink_get_family_id$mptcp(&(0x7f0000000300), r3) sendmsg$MPTCP_PM_CMD_ADD_ADDR(r3, &(0x7f00000003c0)={&(0x7f00000002c0)={0x10, 0x0, 0x0, 0x10}, 0xc, &(0x7f0000000380)={&(0x7f0000000340)={0x24, r4, 0x300, 0x70bd26, 0x25dfdbfb, {}, [@MPTCP_PM_ATTR_SUBFLOWS={0x8, 0x3, 0x1}, @MPTCP_PM_ATTR_RCV_ADD_ADDRS={0x8, 0x2, 0x2}]}, 0x24}, 0x1, 0x0, 0x0, 0x20000004}, 0x8890) syz_io_uring_setup(0x20f8, &(0x7f0000000400)={0x0, 0x7677, 0x8, 0x3, 0x22f}, &(0x7f0000ffe000/0x2000)=nil, &(0x7f0000ffb000/0x2000)=nil, &(0x7f0000000480)=0x0, &(0x7f00000004c0)) r6 = openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000500)='./cgroup/syz1\x00', 0x200002, 0x0) syz_io_uring_submit(r5, r2, &(0x7f0000000580)=@IORING_OP_FILES_UPDATE={0x14, 0x4, 0x0, 0x0, 0x40, &(0x7f0000000540)=[0xffffffffffffffff, 0xffffffffffffffff, r6, r0, r1], 0x5}, 0x3) socket$inet6_tcp(0xa, 0x1, 0x0) openat$procfs(0xffffffffffffff9c, &(0x7f00000010c0)='/proc/crypto\x00', 0x0, 0x0) io_uring_setup(0x7c8f, &(0x7f0000001140)={0x0, 0xc240, 0x10, 0x3, 0x1c7}) 21:19:30 executing program 5: r0 = io_uring_setup(0x355e, &(0x7f0000000000)={0x0, 0x0, 0x20, 0x0, 0x1be}) r1 = syz_io_uring_setup(0x8fe, &(0x7f0000000080)={0x0, 0x1830, 0x0, 0x0, 0x1b8, 0x0, r0}, &(0x7f0000ffb000/0x2000)=nil, &(0x7f0000ffb000/0x4000)=nil, &(0x7f0000000100), &(0x7f0000000140)=0x0) r3 = openat$hwrng(0xffffffffffffff9c, &(0x7f0000000180), 0x2, 0x0) r4 = syz_io_uring_setup(0x65dd, &(0x7f00000001c0)={0x0, 0xf46f, 0x20, 0x2, 0xdf}, &(0x7f0000ffe000/0x1000)=nil, &(0x7f0000ffd000/0x1000)=nil, &(0x7f0000000240), &(0x7f0000000280)) r5 = syz_genetlink_get_family_id$mptcp(&(0x7f0000000300), r3) sendmsg$MPTCP_PM_CMD_ADD_ADDR(r3, &(0x7f00000003c0)={&(0x7f00000002c0)={0x10, 0x0, 0x0, 0x10}, 0xc, &(0x7f0000000380)={&(0x7f0000000340)={0x24, r5, 0x300, 0x70bd26, 0x25dfdbfb, {}, [@MPTCP_PM_ATTR_SUBFLOWS={0x8, 0x3, 0x1}, @MPTCP_PM_ATTR_RCV_ADD_ADDRS={0x8, 0x2, 0x2}]}, 0x24}, 0x1, 0x0, 0x0, 0x20000004}, 0x8890) r6 = openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000500)='./cgroup/syz1\x00', 0x200002, 0x0) syz_io_uring_submit(0x0, r2, &(0x7f0000000580)=@IORING_OP_FILES_UPDATE={0x14, 0x4, 0x0, 0x0, 0x40, &(0x7f0000000540)=[r4, 0xffffffffffffffff, r6, r0, r1], 0x5}, 0x3) socket$inet6_tcp(0xa, 0x1, 0x0) openat$procfs(0xffffffffffffff9c, &(0x7f00000010c0)='/proc/crypto\x00', 0x0, 0x0) 21:19:30 executing program 4: ioctl$SCSI_IOCTL_DOORUNLOCK(0xffffffffffffffff, 0x5381) r0 = syz_open_dev$mouse(&(0x7f0000000000), 0x578, 0x4000) ioctl$SG_GET_PACK_ID(r0, 0x227c, &(0x7f0000000040)) syz_genetlink_get_family_id$nl80211(0x0, r0) syz_open_dev$vcsa(&(0x7f0000000440), 0x56, 0x4000) socketpair(0x0, 0x3, 0x6, &(0x7f0000000640)) r1 = openat$tcp_congestion(0xffffffffffffff9c, &(0x7f0000000800), 0x1, 0x0) write$tcp_congestion(r1, &(0x7f0000000840)='htcp\x00', 0x5) 21:19:38 executing program 0: syz_io_uring_setup(0x8fe, &(0x7f0000000080), &(0x7f0000ffb000/0x2000)=nil, &(0x7f0000ffb000/0x4000)=nil, &(0x7f0000000100), &(0x7f0000000140)) openat$hwrng(0xffffffffffffff9c, &(0x7f0000000180), 0x2, 0x0) openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000500)='./cgroup/syz1\x00', 0x200002, 0x0) syz_io_uring_submit(0x0, 0x0, 0x0, 0x0) io_uring_setup(0x2812, &(0x7f00000005c0)={0x0, 0x0, 0x0, 0x3, 0x12f}) socket$inet6_tcp(0xa, 0x1, 0x0) 21:19:38 executing program 7: pipe2$9p(0x0, 0x0) 21:19:38 executing program 4: ioctl$SCSI_IOCTL_DOORUNLOCK(0xffffffffffffffff, 0x5381) r0 = syz_open_dev$mouse(&(0x7f0000000000), 0x578, 0x4000) ioctl$SG_GET_PACK_ID(r0, 0x227c, &(0x7f0000000040)) syz_genetlink_get_family_id$nl80211(&(0x7f00000000c0), 0xffffffffffffffff) syz_open_dev$vcsa(&(0x7f0000000440), 0x56, 0x4000) socketpair(0x0, 0x3, 0x6, &(0x7f0000000640)) r1 = openat$tcp_congestion(0xffffffffffffff9c, &(0x7f0000000800), 0x1, 0x0) write$tcp_congestion(r1, &(0x7f0000000840)='htcp\x00', 0x5) 21:19:38 executing program 1: r0 = io_uring_setup(0x355e, &(0x7f0000000000)={0x0, 0x0, 0x20, 0x1, 0x1be}) r1 = openat$hwrng(0xffffffffffffff9c, &(0x7f0000000180), 0x2, 0x0) r2 = syz_io_uring_setup(0x65dd, &(0x7f00000001c0)={0x0, 0x0, 0x0, 0x2, 0xdf}, &(0x7f0000ffe000/0x1000)=nil, &(0x7f0000ffd000/0x1000)=nil, &(0x7f0000000240), &(0x7f0000000280)) syz_genetlink_get_family_id$mptcp(&(0x7f0000000300), r1) syz_io_uring_setup(0x20f8, &(0x7f0000000400)={0x0, 0x7677, 0x8, 0x3, 0x22f, 0x0, r2}, &(0x7f0000ffe000/0x2000)=nil, &(0x7f0000ffb000/0x2000)=nil, &(0x7f0000000480)=0x0, &(0x7f00000004c0)) r4 = openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000500)='./cgroup/syz1\x00', 0x200002, 0x0) syz_io_uring_submit(r3, 0x0, &(0x7f0000000580)=@IORING_OP_FILES_UPDATE={0x14, 0x4, 0x0, 0x0, 0x40, &(0x7f0000000540)=[r2, 0xffffffffffffffff, r4, r0, 0xffffffffffffffff], 0x5}, 0x3) io_uring_setup(0x2812, &(0x7f00000005c0)={0x0, 0x5e1b, 0x2, 0x3, 0x12f, 0x0, r2}) socket$inet6_tcp(0xa, 0x1, 0x0) openat$procfs(0xffffffffffffff9c, &(0x7f00000010c0)='/proc/crypto\x00', 0x0, 0x0) io_uring_setup(0x7c8f, &(0x7f0000001140)={0x0, 0xc240, 0x10, 0x3, 0x1c7, 0x0, r2}) 21:19:38 executing program 3: r0 = io_uring_setup(0x355e, &(0x7f0000000000)={0x0, 0x0, 0x20, 0x1, 0x1be}) r1 = syz_io_uring_setup(0x0, &(0x7f0000000080)={0x0, 0x1830, 0x0, 0x0, 0x1b8, 0x0, r0}, &(0x7f0000ffb000/0x2000)=nil, &(0x7f0000ffb000/0x4000)=nil, &(0x7f0000000100), &(0x7f0000000140)=0x0) r3 = openat$hwrng(0xffffffffffffff9c, &(0x7f0000000180), 0x2, 0x0) syz_genetlink_get_family_id$mptcp(&(0x7f0000000300), r3) r4 = openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000500)='./cgroup/syz1\x00', 0x200002, 0x0) syz_io_uring_submit(0x0, r2, &(0x7f0000000580)=@IORING_OP_FILES_UPDATE={0x14, 0x4, 0x0, 0x0, 0x40, &(0x7f0000000540)=[0xffffffffffffffff, 0xffffffffffffffff, r4, r0, r1], 0x5}, 0x3) io_uring_setup(0x2812, &(0x7f00000005c0)={0x0, 0x5e1b, 0x2, 0x3, 0x12f}) socket$inet6_tcp(0xa, 0x1, 0x0) io_uring_setup(0x7c8f, &(0x7f0000001140)={0x0, 0xc240, 0x10, 0x3, 0x1c7}) 21:19:38 executing program 2: openat$hwrng(0xffffffffffffff9c, &(0x7f0000000180), 0x0, 0x0) r0 = openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000500)='./cgroup/syz1\x00', 0x200002, 0x0) syz_io_uring_submit(0x0, 0x0, &(0x7f0000000580)=@IORING_OP_FILES_UPDATE={0x14, 0x4, 0x0, 0x0, 0x40, &(0x7f0000000540)=[0xffffffffffffffff, 0xffffffffffffffff, r0, 0xffffffffffffffff, 0xffffffffffffffff], 0x5}, 0x3) io_uring_setup(0x2812, &(0x7f00000005c0)={0x0, 0x5e1b, 0x2, 0x3, 0x12f}) 21:19:38 executing program 6: r0 = io_uring_setup(0x355e, &(0x7f0000000000)={0x0, 0x0, 0x20, 0x0, 0x1be}) r1 = syz_io_uring_setup(0x8fe, 0x0, &(0x7f0000ffb000/0x2000)=nil, &(0x7f0000ffb000/0x4000)=nil, &(0x7f0000000100), &(0x7f0000000140)=0x0) r3 = openat$hwrng(0xffffffffffffff9c, &(0x7f0000000180), 0x2, 0x0) r4 = syz_genetlink_get_family_id$mptcp(&(0x7f0000000300), r3) sendmsg$MPTCP_PM_CMD_ADD_ADDR(r3, &(0x7f00000003c0)={&(0x7f00000002c0)={0x10, 0x0, 0x0, 0x10}, 0xc, &(0x7f0000000380)={&(0x7f0000000340)={0x24, r4, 0x300, 0x70bd26, 0x25dfdbfb, {}, [@MPTCP_PM_ATTR_SUBFLOWS={0x8, 0x3, 0x1}, @MPTCP_PM_ATTR_RCV_ADD_ADDRS={0x8, 0x2, 0x2}]}, 0x24}, 0x1, 0x0, 0x0, 0x20000004}, 0x8890) syz_io_uring_setup(0x20f8, &(0x7f0000000400)={0x0, 0x7677, 0x8, 0x3, 0x22f}, &(0x7f0000ffe000/0x2000)=nil, &(0x7f0000ffb000/0x2000)=nil, &(0x7f0000000480)=0x0, &(0x7f00000004c0)) r6 = openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000500)='./cgroup/syz1\x00', 0x200002, 0x0) syz_io_uring_submit(r5, r2, &(0x7f0000000580)=@IORING_OP_FILES_UPDATE={0x14, 0x4, 0x0, 0x0, 0x40, &(0x7f0000000540)=[0xffffffffffffffff, 0xffffffffffffffff, r6, r0, r1], 0x5}, 0x3) socket$inet6_tcp(0xa, 0x1, 0x0) openat$procfs(0xffffffffffffff9c, &(0x7f00000010c0)='/proc/crypto\x00', 0x0, 0x0) io_uring_setup(0x7c8f, &(0x7f0000001140)={0x0, 0xc240, 0x10, 0x3, 0x1c7}) 21:19:38 executing program 5: r0 = io_uring_setup(0x355e, &(0x7f0000000000)={0x0, 0x0, 0x20, 0x0, 0x1be}) r1 = syz_io_uring_setup(0x8fe, &(0x7f0000000080)={0x0, 0x1830, 0x0, 0x0, 0x1b8, 0x0, r0}, &(0x7f0000ffb000/0x2000)=nil, &(0x7f0000ffb000/0x4000)=nil, &(0x7f0000000100), &(0x7f0000000140)=0x0) r3 = openat$hwrng(0xffffffffffffff9c, &(0x7f0000000180), 0x2, 0x0) r4 = syz_io_uring_setup(0x65dd, &(0x7f00000001c0)={0x0, 0xf46f, 0x20, 0x2, 0xdf}, &(0x7f0000ffe000/0x1000)=nil, &(0x7f0000ffd000/0x1000)=nil, &(0x7f0000000240), &(0x7f0000000280)) r5 = syz_genetlink_get_family_id$mptcp(&(0x7f0000000300), r3) sendmsg$MPTCP_PM_CMD_ADD_ADDR(r3, &(0x7f00000003c0)={&(0x7f00000002c0)={0x10, 0x0, 0x0, 0x10}, 0xc, &(0x7f0000000380)={&(0x7f0000000340)={0x24, r5, 0x300, 0x70bd26, 0x25dfdbfb, {}, [@MPTCP_PM_ATTR_SUBFLOWS={0x8, 0x3, 0x1}, @MPTCP_PM_ATTR_RCV_ADD_ADDRS={0x8, 0x2, 0x2}]}, 0x24}, 0x1, 0x0, 0x0, 0x20000004}, 0x8890) r6 = openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000500)='./cgroup/syz1\x00', 0x200002, 0x0) syz_io_uring_submit(0x0, r2, &(0x7f0000000580)=@IORING_OP_FILES_UPDATE={0x14, 0x4, 0x0, 0x0, 0x40, &(0x7f0000000540)=[r4, 0xffffffffffffffff, r6, r0, r1], 0x5}, 0x3) socket$inet6_tcp(0xa, 0x1, 0x0) openat$procfs(0xffffffffffffff9c, &(0x7f00000010c0)='/proc/crypto\x00', 0x0, 0x0) 21:19:38 executing program 7: r0 = io_uring_setup(0x355e, &(0x7f0000000000)={0x0, 0x0, 0x20, 0x1, 0x1be}) r1 = openat$hwrng(0xffffffffffffff9c, &(0x7f0000000180), 0x2, 0x0) r2 = syz_io_uring_setup(0x65dd, &(0x7f00000001c0)={0x0, 0x0, 0x0, 0x2, 0xdf}, &(0x7f0000ffe000/0x1000)=nil, &(0x7f0000ffd000/0x1000)=nil, &(0x7f0000000240), &(0x7f0000000280)) syz_genetlink_get_family_id$mptcp(&(0x7f0000000300), r1) syz_io_uring_setup(0x20f8, &(0x7f0000000400)={0x0, 0x7677, 0x8, 0x3, 0x22f, 0x0, r2}, &(0x7f0000ffe000/0x2000)=nil, &(0x7f0000ffb000/0x2000)=nil, &(0x7f0000000480)=0x0, &(0x7f00000004c0)) r4 = openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000500)='./cgroup/syz1\x00', 0x200002, 0x0) syz_io_uring_submit(r3, 0x0, &(0x7f0000000580)=@IORING_OP_FILES_UPDATE={0x14, 0x4, 0x0, 0x0, 0x40, &(0x7f0000000540)=[r2, 0xffffffffffffffff, r4, r0, 0xffffffffffffffff], 0x5}, 0x3) io_uring_setup(0x2812, &(0x7f00000005c0)={0x0, 0x5e1b, 0x2, 0x3, 0x12f, 0x0, r2}) socket$inet6_tcp(0xa, 0x1, 0x0) openat$procfs(0xffffffffffffff9c, &(0x7f00000010c0)='/proc/crypto\x00', 0x0, 0x0) io_uring_setup(0x7c8f, &(0x7f0000001140)={0x0, 0xc240, 0x10, 0x3, 0x1c7, 0x0, r2}) 21:19:38 executing program 7: r0 = io_uring_setup(0x355e, &(0x7f0000000000)={0x0, 0x0, 0x20, 0x1, 0x1be}) r1 = openat$hwrng(0xffffffffffffff9c, &(0x7f0000000180), 0x2, 0x0) r2 = syz_io_uring_setup(0x65dd, &(0x7f00000001c0)={0x0, 0x0, 0x0, 0x2, 0xdf}, &(0x7f0000ffe000/0x1000)=nil, &(0x7f0000ffd000/0x1000)=nil, &(0x7f0000000240), &(0x7f0000000280)) syz_genetlink_get_family_id$mptcp(&(0x7f0000000300), r1) syz_io_uring_setup(0x20f8, &(0x7f0000000400)={0x0, 0x7677, 0x8, 0x3, 0x22f, 0x0, r2}, &(0x7f0000ffe000/0x2000)=nil, &(0x7f0000ffb000/0x2000)=nil, &(0x7f0000000480)=0x0, &(0x7f00000004c0)) r4 = openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000500)='./cgroup/syz1\x00', 0x200002, 0x0) syz_io_uring_submit(r3, 0x0, &(0x7f0000000580)=@IORING_OP_FILES_UPDATE={0x14, 0x4, 0x0, 0x0, 0x40, &(0x7f0000000540)=[r2, 0xffffffffffffffff, r4, r0, 0xffffffffffffffff], 0x5}, 0x3) io_uring_setup(0x2812, &(0x7f00000005c0)={0x0, 0x5e1b, 0x2, 0x3, 0x12f, 0x0, r2}) socket$inet6_tcp(0xa, 0x1, 0x0) openat$procfs(0xffffffffffffff9c, &(0x7f00000010c0)='/proc/crypto\x00', 0x0, 0x0) io_uring_setup(0x7c8f, &(0x7f0000001140)={0x0, 0xc240, 0x10, 0x3, 0x1c7, 0x0, r2}) 21:19:38 executing program 5: r0 = io_uring_setup(0x355e, &(0x7f0000000000)={0x0, 0x0, 0x20, 0x0, 0x1be}) r1 = syz_io_uring_setup(0x8fe, &(0x7f0000000080)={0x0, 0x1830, 0x0, 0x0, 0x1b8, 0x0, r0}, &(0x7f0000ffb000/0x2000)=nil, &(0x7f0000ffb000/0x4000)=nil, &(0x7f0000000100), &(0x7f0000000140)=0x0) r3 = openat$hwrng(0xffffffffffffff9c, &(0x7f0000000180), 0x2, 0x0) r4 = syz_io_uring_setup(0x65dd, &(0x7f00000001c0)={0x0, 0xf46f, 0x20, 0x2, 0xdf}, &(0x7f0000ffe000/0x1000)=nil, &(0x7f0000ffd000/0x1000)=nil, &(0x7f0000000240), &(0x7f0000000280)) r5 = syz_genetlink_get_family_id$mptcp(&(0x7f0000000300), r3) sendmsg$MPTCP_PM_CMD_ADD_ADDR(r3, &(0x7f00000003c0)={&(0x7f00000002c0)={0x10, 0x0, 0x0, 0x10}, 0xc, &(0x7f0000000380)={&(0x7f0000000340)={0x24, r5, 0x300, 0x70bd26, 0x25dfdbfb, {}, [@MPTCP_PM_ATTR_SUBFLOWS={0x8, 0x3, 0x1}, @MPTCP_PM_ATTR_RCV_ADD_ADDRS={0x8, 0x2, 0x2}]}, 0x24}, 0x1, 0x0, 0x0, 0x20000004}, 0x8890) r6 = openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000500)='./cgroup/syz1\x00', 0x200002, 0x0) syz_io_uring_submit(0x0, r2, &(0x7f0000000580)=@IORING_OP_FILES_UPDATE={0x14, 0x4, 0x0, 0x0, 0x40, &(0x7f0000000540)=[r4, 0xffffffffffffffff, r6, r0, r1], 0x5}, 0x3) socket$inet6_tcp(0xa, 0x1, 0x0) openat$procfs(0xffffffffffffff9c, &(0x7f00000010c0)='/proc/crypto\x00', 0x0, 0x0) 21:19:38 executing program 2: openat$hwrng(0xffffffffffffff9c, &(0x7f0000000180), 0x0, 0x0) r0 = openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000500)='./cgroup/syz1\x00', 0x200002, 0x0) syz_io_uring_submit(0x0, 0x0, &(0x7f0000000580)=@IORING_OP_FILES_UPDATE={0x14, 0x4, 0x0, 0x0, 0x40, &(0x7f0000000540)=[0xffffffffffffffff, 0xffffffffffffffff, r0, 0xffffffffffffffff, 0xffffffffffffffff], 0x5}, 0x3) io_uring_setup(0x2812, &(0x7f00000005c0)={0x0, 0x5e1b, 0x2, 0x3, 0x12f}) 21:19:38 executing program 0: syz_io_uring_setup(0x8fe, &(0x7f0000000080), &(0x7f0000ffb000/0x2000)=nil, &(0x7f0000ffb000/0x4000)=nil, &(0x7f0000000100), &(0x7f0000000140)) openat$hwrng(0xffffffffffffff9c, &(0x7f0000000180), 0x2, 0x0) openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000500)='./cgroup/syz1\x00', 0x200002, 0x0) syz_io_uring_submit(0x0, 0x0, 0x0, 0x0) io_uring_setup(0x2812, &(0x7f00000005c0)={0x0, 0x0, 0x2, 0x0, 0x12f}) socket$inet6_tcp(0xa, 0x1, 0x0) 21:19:38 executing program 6: r0 = io_uring_setup(0x355e, &(0x7f0000000000)={0x0, 0x0, 0x20, 0x0, 0x1be}) r1 = syz_io_uring_setup(0x8fe, &(0x7f0000000080)={0x0, 0x0, 0x0, 0x0, 0x1b8, 0x0, r0}, &(0x7f0000ffb000/0x2000)=nil, &(0x7f0000ffb000/0x4000)=nil, &(0x7f0000000100), &(0x7f0000000140)=0x0) r3 = openat$hwrng(0xffffffffffffff9c, &(0x7f0000000180), 0x2, 0x0) r4 = syz_genetlink_get_family_id$mptcp(&(0x7f0000000300), r3) sendmsg$MPTCP_PM_CMD_ADD_ADDR(r3, &(0x7f00000003c0)={&(0x7f00000002c0)={0x10, 0x0, 0x0, 0x10}, 0xc, &(0x7f0000000380)={&(0x7f0000000340)={0x24, r4, 0x300, 0x70bd26, 0x25dfdbfb, {}, [@MPTCP_PM_ATTR_SUBFLOWS={0x8, 0x3, 0x1}, @MPTCP_PM_ATTR_RCV_ADD_ADDRS={0x8, 0x2, 0x2}]}, 0x24}, 0x1, 0x0, 0x0, 0x20000004}, 0x8890) syz_io_uring_setup(0x20f8, &(0x7f0000000400)={0x0, 0x7677, 0x8, 0x3, 0x22f}, &(0x7f0000ffe000/0x2000)=nil, &(0x7f0000ffb000/0x2000)=nil, &(0x7f0000000480)=0x0, &(0x7f00000004c0)) r6 = openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000500)='./cgroup/syz1\x00', 0x200002, 0x0) syz_io_uring_submit(r5, r2, &(0x7f0000000580)=@IORING_OP_FILES_UPDATE={0x14, 0x4, 0x0, 0x0, 0x40, &(0x7f0000000540)=[0xffffffffffffffff, 0xffffffffffffffff, r6, r0, r1], 0x5}, 0x3) socket$inet6_tcp(0xa, 0x1, 0x0) openat$procfs(0xffffffffffffff9c, &(0x7f00000010c0)='/proc/crypto\x00', 0x0, 0x0) io_uring_setup(0x7c8f, &(0x7f0000001140)={0x0, 0xc240, 0x10, 0x3, 0x1c7}) [ 508.006567] kmemleak: Found object by alias at 0x607f1a6398ac [ 508.006599] CPU: 0 UID: 0 PID: 6675 Comm: syz-executor.3 Tainted: G W 6.17.0-rc3-next-20250829 #1 PREEMPT(voluntary) [ 508.006634] Tainted: [W]=WARN [ 508.006641] Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.12.0-1 04/01/2014 [ 508.006653] Call Trace: [ 508.006661] [ 508.006669] dump_stack_lvl+0xca/0x120 [ 508.006718] __lookup_object+0x94/0xb0 [ 508.006748] delete_object_full+0x27/0x70 [ 508.006779] free_percpu+0x30/0x1160 [ 508.006808] ? arch_uprobe_clear_state+0x16/0x140 [ 508.006845] futex_hash_free+0x38/0xc0 [ 508.006873] mmput+0x2d3/0x390 [ 508.006907] do_exit+0x79d/0x2970 [ 508.006937] ? lock_release+0xc8/0x290 [ 508.006983] ? __pfx_do_exit+0x10/0x10 [ 508.007024] ? find_held_lock+0x2b/0x80 [ 508.007060] ? get_signal+0x835/0x2340 [ 508.007097] do_group_exit+0xd3/0x2a0 [ 508.007126] get_signal+0x2315/0x2340 [ 508.007169] ? __pfx_get_signal+0x10/0x10 [ 508.007200] ? do_futex+0x135/0x370 [ 508.007225] ? __pfx_do_futex+0x10/0x10 [ 508.007254] arch_do_signal_or_restart+0x80/0x790 [ 508.007287] ? __pfx_arch_do_signal_or_restart+0x10/0x10 [ 508.007317] ? __x64_sys_futex+0x1c9/0x4d0 [ 508.007340] ? __x64_sys_futex+0x1d2/0x4d0 [ 508.007369] ? __pfx___x64_sys_futex+0x10/0x10 [ 508.007393] ? lock_mm_and_find_vma+0xaa/0x6f0 [ 508.007417] ? xfd_validate_state+0x55/0x180 [ 508.007456] exit_to_user_mode_loop+0x8b/0x110 [ 508.007479] do_syscall_64+0x2f7/0x360 [ 508.007502] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 508.007524] RIP: 0033:0x7f1060a76b19 [ 508.007541] Code: Unable to access opcode bytes at 0x7f1060a76aef. [ 508.007550] RSP: 002b:00007f105dfcb218 EFLAGS: 00000246 ORIG_RAX: 00000000000000ca [ 508.007572] RAX: fffffffffffffe00 RBX: 00007f1060b8a028 RCX: 00007f1060a76b19 [ 508.007586] RDX: 0000000000000000 RSI: 0000000000000080 RDI: 00007f1060b8a028 [ 508.007599] RBP: 00007f1060b8a020 R08: 0000000000000000 R09: 0000000000000000 [ 508.007612] R10: 0000000000000000 R11: 0000000000000246 R12: 00007f1060b8a02c [ 508.007625] R13: 00007ffed3f8b4af R14: 00007f105dfcb300 R15: 0000000000022000 [ 508.007656] [ 508.007663] kmemleak: Object (percpu) 0x607f1a6398a8 (size 8): [ 508.007675] kmemleak: comm "syz-executor.5", pid 6691, jiffies 4295174803 [ 508.007689] kmemleak: min_count = 1 [ 508.007696] kmemleak: count = 0 [ 508.007703] kmemleak: flags = 0x21 [ 508.007710] kmemleak: checksum = 0 [ 508.007717] kmemleak: backtrace: [ 508.007723] pcpu_alloc_noprof+0x87a/0x1170 [ 508.007752] percpu_ref_init+0x37/0x400 [ 508.007784] io_uring_setup+0x44c/0x2000 [ 508.007805] __x64_sys_io_uring_setup+0xc8/0x170 [ 508.007826] do_syscall_64+0xbf/0x360 [ 508.007842] entry_SYSCALL_64_after_hwframe+0x77/0x7f 21:19:38 executing program 3: r0 = io_uring_setup(0x355e, &(0x7f0000000000)={0x0, 0x0, 0x20, 0x1, 0x1be}) r1 = syz_io_uring_setup(0x0, &(0x7f0000000080)={0x0, 0x1830, 0x0, 0x0, 0x1b8, 0x0, r0}, &(0x7f0000ffb000/0x2000)=nil, &(0x7f0000ffb000/0x4000)=nil, &(0x7f0000000100), &(0x7f0000000140)=0x0) r3 = openat$hwrng(0xffffffffffffff9c, &(0x7f0000000180), 0x2, 0x0) syz_genetlink_get_family_id$mptcp(&(0x7f0000000300), r3) r4 = openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000500)='./cgroup/syz1\x00', 0x200002, 0x0) syz_io_uring_submit(0x0, r2, &(0x7f0000000580)=@IORING_OP_FILES_UPDATE={0x14, 0x4, 0x0, 0x0, 0x40, &(0x7f0000000540)=[0xffffffffffffffff, 0xffffffffffffffff, r4, r0, r1], 0x5}, 0x3) io_uring_setup(0x2812, &(0x7f00000005c0)={0x0, 0x5e1b, 0x2, 0x3, 0x12f}) socket$inet6_tcp(0xa, 0x1, 0x0) io_uring_setup(0x7c8f, &(0x7f0000001140)={0x0, 0xc240, 0x10, 0x3, 0x1c7}) 21:19:46 executing program 6: r0 = io_uring_setup(0x355e, &(0x7f0000000000)={0x0, 0x0, 0x20, 0x0, 0x1be}) r1 = syz_io_uring_setup(0x8fe, &(0x7f0000000080)={0x0, 0x0, 0x0, 0x0, 0x1b8, 0x0, r0}, &(0x7f0000ffb000/0x2000)=nil, &(0x7f0000ffb000/0x4000)=nil, &(0x7f0000000100), &(0x7f0000000140)=0x0) r3 = openat$hwrng(0xffffffffffffff9c, &(0x7f0000000180), 0x2, 0x0) r4 = syz_genetlink_get_family_id$mptcp(&(0x7f0000000300), r3) sendmsg$MPTCP_PM_CMD_ADD_ADDR(r3, &(0x7f00000003c0)={&(0x7f00000002c0)={0x10, 0x0, 0x0, 0x10}, 0xc, &(0x7f0000000380)={&(0x7f0000000340)={0x24, r4, 0x300, 0x70bd26, 0x25dfdbfb, {}, [@MPTCP_PM_ATTR_SUBFLOWS={0x8, 0x3, 0x1}, @MPTCP_PM_ATTR_RCV_ADD_ADDRS={0x8, 0x2, 0x2}]}, 0x24}, 0x1, 0x0, 0x0, 0x20000004}, 0x8890) syz_io_uring_setup(0x20f8, &(0x7f0000000400)={0x0, 0x7677, 0x8, 0x3, 0x22f}, &(0x7f0000ffe000/0x2000)=nil, &(0x7f0000ffb000/0x2000)=nil, &(0x7f0000000480)=0x0, &(0x7f00000004c0)) r6 = openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000500)='./cgroup/syz1\x00', 0x200002, 0x0) syz_io_uring_submit(r5, r2, &(0x7f0000000580)=@IORING_OP_FILES_UPDATE={0x14, 0x4, 0x0, 0x0, 0x40, &(0x7f0000000540)=[0xffffffffffffffff, 0xffffffffffffffff, r6, r0, r1], 0x5}, 0x3) socket$inet6_tcp(0xa, 0x1, 0x0) openat$procfs(0xffffffffffffff9c, &(0x7f00000010c0)='/proc/crypto\x00', 0x0, 0x0) io_uring_setup(0x7c8f, &(0x7f0000001140)={0x0, 0xc240, 0x10, 0x3, 0x1c7}) 21:19:46 executing program 5: r0 = io_uring_setup(0x355e, &(0x7f0000000000)={0x0, 0x0, 0x20}) r1 = syz_io_uring_setup(0x8fe, &(0x7f0000000080)={0x0, 0x1830, 0x0, 0x0, 0x1b8, 0x0, r0}, &(0x7f0000ffb000/0x2000)=nil, &(0x7f0000ffb000/0x4000)=nil, &(0x7f0000000100), &(0x7f0000000140)=0x0) r3 = openat$hwrng(0xffffffffffffff9c, &(0x7f0000000180), 0x2, 0x0) r4 = syz_io_uring_setup(0x65dd, &(0x7f00000001c0)={0x0, 0xf46f, 0x20, 0x2, 0xdf}, &(0x7f0000ffe000/0x1000)=nil, &(0x7f0000ffd000/0x1000)=nil, &(0x7f0000000240), &(0x7f0000000280)) r5 = syz_genetlink_get_family_id$mptcp(&(0x7f0000000300), r3) sendmsg$MPTCP_PM_CMD_ADD_ADDR(r3, &(0x7f00000003c0)={&(0x7f00000002c0)={0x10, 0x0, 0x0, 0x10}, 0xc, &(0x7f0000000380)={&(0x7f0000000340)={0x24, r5, 0x300, 0x70bd26, 0x25dfdbfb, {}, [@MPTCP_PM_ATTR_SUBFLOWS={0x8, 0x3, 0x1}, @MPTCP_PM_ATTR_RCV_ADD_ADDRS={0x8, 0x2, 0x2}]}, 0x24}, 0x1, 0x0, 0x0, 0x20000004}, 0x8890) r6 = openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000500)='./cgroup/syz1\x00', 0x200002, 0x0) syz_io_uring_submit(0x0, r2, &(0x7f0000000580)=@IORING_OP_FILES_UPDATE={0x14, 0x4, 0x0, 0x0, 0x40, &(0x7f0000000540)=[r4, 0xffffffffffffffff, r6, r0, r1], 0x5}, 0x3) socket$inet6_tcp(0xa, 0x1, 0x0) openat$procfs(0xffffffffffffff9c, &(0x7f00000010c0)='/proc/crypto\x00', 0x0, 0x0) 21:19:46 executing program 2: openat$hwrng(0xffffffffffffff9c, &(0x7f0000000180), 0x0, 0x0) r0 = openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000500)='./cgroup/syz1\x00', 0x200002, 0x0) syz_io_uring_submit(0x0, 0x0, &(0x7f0000000580)=@IORING_OP_FILES_UPDATE={0x14, 0x4, 0x0, 0x0, 0x40, &(0x7f0000000540)=[0xffffffffffffffff, 0xffffffffffffffff, r0, 0xffffffffffffffff, 0xffffffffffffffff], 0x5}, 0x3) io_uring_setup(0x2812, &(0x7f00000005c0)={0x0, 0x5e1b, 0x2, 0x3, 0x12f}) 21:19:46 executing program 1: r0 = io_uring_setup(0x355e, &(0x7f0000000000)={0x0, 0x0, 0x20, 0x1, 0x1be}) r1 = openat$hwrng(0xffffffffffffff9c, &(0x7f0000000180), 0x2, 0x0) r2 = syz_io_uring_setup(0x65dd, &(0x7f00000001c0)={0x0, 0x0, 0x0, 0x2, 0xdf}, &(0x7f0000ffe000/0x1000)=nil, &(0x7f0000ffd000/0x1000)=nil, &(0x7f0000000240), &(0x7f0000000280)) syz_genetlink_get_family_id$mptcp(&(0x7f0000000300), r1) syz_io_uring_setup(0x20f8, &(0x7f0000000400)={0x0, 0x7677, 0x8, 0x3, 0x22f, 0x0, r2}, &(0x7f0000ffe000/0x2000)=nil, &(0x7f0000ffb000/0x2000)=nil, &(0x7f0000000480)=0x0, &(0x7f00000004c0)) r4 = openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000500)='./cgroup/syz1\x00', 0x200002, 0x0) syz_io_uring_submit(r3, 0x0, &(0x7f0000000580)=@IORING_OP_FILES_UPDATE={0x14, 0x4, 0x0, 0x0, 0x40, &(0x7f0000000540)=[r2, 0xffffffffffffffff, r4, r0, 0xffffffffffffffff], 0x5}, 0x3) io_uring_setup(0x2812, &(0x7f00000005c0)={0x0, 0x5e1b, 0x2, 0x3, 0x12f, 0x0, r2}) socket$inet6_tcp(0xa, 0x1, 0x0) openat$procfs(0xffffffffffffff9c, &(0x7f00000010c0)='/proc/crypto\x00', 0x0, 0x0) io_uring_setup(0x7c8f, &(0x7f0000001140)={0x0, 0xc240, 0x10, 0x3, 0x1c7, 0x0, r2}) 21:19:46 executing program 7: r0 = io_uring_setup(0x355e, &(0x7f0000000000)={0x0, 0x0, 0x20, 0x1, 0x1be}) r1 = openat$hwrng(0xffffffffffffff9c, &(0x7f0000000180), 0x2, 0x0) r2 = syz_io_uring_setup(0x65dd, &(0x7f00000001c0)={0x0, 0x0, 0x0, 0x2, 0xdf}, &(0x7f0000ffe000/0x1000)=nil, &(0x7f0000ffd000/0x1000)=nil, &(0x7f0000000240), &(0x7f0000000280)) syz_genetlink_get_family_id$mptcp(&(0x7f0000000300), r1) syz_io_uring_setup(0x20f8, &(0x7f0000000400)={0x0, 0x7677, 0x8, 0x3, 0x22f, 0x0, r2}, &(0x7f0000ffe000/0x2000)=nil, &(0x7f0000ffb000/0x2000)=nil, &(0x7f0000000480)=0x0, &(0x7f00000004c0)) r4 = openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000500)='./cgroup/syz1\x00', 0x200002, 0x0) syz_io_uring_submit(r3, 0x0, &(0x7f0000000580)=@IORING_OP_FILES_UPDATE={0x14, 0x4, 0x0, 0x0, 0x40, &(0x7f0000000540)=[r2, 0xffffffffffffffff, r4, r0, 0xffffffffffffffff], 0x5}, 0x3) io_uring_setup(0x2812, &(0x7f00000005c0)={0x0, 0x5e1b, 0x2, 0x3, 0x12f, 0x0, r2}) socket$inet6_tcp(0xa, 0x1, 0x0) openat$procfs(0xffffffffffffff9c, &(0x7f00000010c0)='/proc/crypto\x00', 0x0, 0x0) io_uring_setup(0x7c8f, &(0x7f0000001140)={0x0, 0xc240, 0x10, 0x3, 0x1c7, 0x0, r2}) 21:19:46 executing program 4: ioctl$SCSI_IOCTL_DOORUNLOCK(0xffffffffffffffff, 0x5381) r0 = syz_open_dev$mouse(&(0x7f0000000000), 0x578, 0x4000) ioctl$SG_GET_PACK_ID(r0, 0x227c, &(0x7f0000000040)) syz_genetlink_get_family_id$nl80211(&(0x7f00000000c0), 0xffffffffffffffff) syz_open_dev$vcsa(&(0x7f0000000440), 0x56, 0x4000) socketpair(0x0, 0x3, 0x6, &(0x7f0000000640)) r1 = openat$tcp_congestion(0xffffffffffffff9c, &(0x7f0000000800), 0x1, 0x0) write$tcp_congestion(r1, &(0x7f0000000840)='htcp\x00', 0x5) 21:19:46 executing program 0: syz_io_uring_setup(0x8fe, &(0x7f0000000080), &(0x7f0000ffb000/0x2000)=nil, &(0x7f0000ffb000/0x4000)=nil, &(0x7f0000000100), &(0x7f0000000140)) openat$hwrng(0xffffffffffffff9c, &(0x7f0000000180), 0x2, 0x0) openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000500)='./cgroup/syz1\x00', 0x200002, 0x0) syz_io_uring_submit(0x0, 0x0, 0x0, 0x0) io_uring_setup(0x2812, &(0x7f00000005c0)={0x0, 0x0, 0x2}) socket$inet6_tcp(0xa, 0x1, 0x0) 21:19:46 executing program 3: r0 = io_uring_setup(0x355e, &(0x7f0000000000)={0x0, 0x0, 0x20, 0x1, 0x1be}) r1 = syz_io_uring_setup(0x8fe, 0x0, &(0x7f0000ffb000/0x2000)=nil, &(0x7f0000ffb000/0x4000)=nil, &(0x7f0000000100), &(0x7f0000000140)=0x0) r3 = openat$hwrng(0xffffffffffffff9c, &(0x7f0000000180), 0x2, 0x0) syz_genetlink_get_family_id$mptcp(&(0x7f0000000300), r3) r4 = openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000500)='./cgroup/syz1\x00', 0x200002, 0x0) syz_io_uring_submit(0x0, r2, &(0x7f0000000580)=@IORING_OP_FILES_UPDATE={0x14, 0x4, 0x0, 0x0, 0x40, &(0x7f0000000540)=[0xffffffffffffffff, 0xffffffffffffffff, r4, r0, r1], 0x5}, 0x3) io_uring_setup(0x2812, &(0x7f00000005c0)={0x0, 0x5e1b, 0x2, 0x3, 0x12f}) socket$inet6_tcp(0xa, 0x1, 0x0) io_uring_setup(0x7c8f, &(0x7f0000001140)={0x0, 0xc240, 0x10, 0x3, 0x1c7}) 21:19:47 executing program 0: syz_io_uring_setup(0x8fe, &(0x7f0000000080), &(0x7f0000ffb000/0x2000)=nil, &(0x7f0000ffb000/0x4000)=nil, &(0x7f0000000100), &(0x7f0000000140)) openat$hwrng(0xffffffffffffff9c, &(0x7f0000000180), 0x2, 0x0) openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000500)='./cgroup/syz1\x00', 0x200002, 0x0) syz_io_uring_submit(0x0, 0x0, 0x0, 0x0) io_uring_setup(0x2812, &(0x7f00000005c0)={0x0, 0x0, 0x2}) socket$inet6_tcp(0xa, 0x1, 0x0) 21:19:47 executing program 6: r0 = io_uring_setup(0x355e, &(0x7f0000000000)={0x0, 0x0, 0x20, 0x0, 0x1be}) r1 = syz_io_uring_setup(0x8fe, &(0x7f0000000080)={0x0, 0x0, 0x0, 0x0, 0x1b8, 0x0, r0}, &(0x7f0000ffb000/0x2000)=nil, &(0x7f0000ffb000/0x4000)=nil, &(0x7f0000000100), &(0x7f0000000140)=0x0) r3 = openat$hwrng(0xffffffffffffff9c, &(0x7f0000000180), 0x2, 0x0) r4 = syz_genetlink_get_family_id$mptcp(&(0x7f0000000300), r3) sendmsg$MPTCP_PM_CMD_ADD_ADDR(r3, &(0x7f00000003c0)={&(0x7f00000002c0)={0x10, 0x0, 0x0, 0x10}, 0xc, &(0x7f0000000380)={&(0x7f0000000340)={0x24, r4, 0x300, 0x70bd26, 0x25dfdbfb, {}, [@MPTCP_PM_ATTR_SUBFLOWS={0x8, 0x3, 0x1}, @MPTCP_PM_ATTR_RCV_ADD_ADDRS={0x8, 0x2, 0x2}]}, 0x24}, 0x1, 0x0, 0x0, 0x20000004}, 0x8890) syz_io_uring_setup(0x20f8, &(0x7f0000000400)={0x0, 0x7677, 0x8, 0x3, 0x22f}, &(0x7f0000ffe000/0x2000)=nil, &(0x7f0000ffb000/0x2000)=nil, &(0x7f0000000480)=0x0, &(0x7f00000004c0)) r6 = openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000500)='./cgroup/syz1\x00', 0x200002, 0x0) syz_io_uring_submit(r5, r2, &(0x7f0000000580)=@IORING_OP_FILES_UPDATE={0x14, 0x4, 0x0, 0x0, 0x40, &(0x7f0000000540)=[0xffffffffffffffff, 0xffffffffffffffff, r6, r0, r1], 0x5}, 0x3) socket$inet6_tcp(0xa, 0x1, 0x0) openat$procfs(0xffffffffffffff9c, &(0x7f00000010c0)='/proc/crypto\x00', 0x0, 0x0) io_uring_setup(0x7c8f, &(0x7f0000001140)={0x0, 0xc240, 0x10, 0x3, 0x1c7}) 21:19:47 executing program 5: r0 = io_uring_setup(0x355e, &(0x7f0000000000)={0x0, 0x0, 0x20}) r1 = syz_io_uring_setup(0x8fe, &(0x7f0000000080)={0x0, 0x1830, 0x0, 0x0, 0x1b8, 0x0, r0}, &(0x7f0000ffb000/0x2000)=nil, &(0x7f0000ffb000/0x4000)=nil, &(0x7f0000000100), &(0x7f0000000140)=0x0) r3 = openat$hwrng(0xffffffffffffff9c, &(0x7f0000000180), 0x2, 0x0) r4 = syz_io_uring_setup(0x65dd, &(0x7f00000001c0)={0x0, 0xf46f, 0x20, 0x2, 0xdf}, &(0x7f0000ffe000/0x1000)=nil, &(0x7f0000ffd000/0x1000)=nil, &(0x7f0000000240), &(0x7f0000000280)) r5 = syz_genetlink_get_family_id$mptcp(&(0x7f0000000300), r3) sendmsg$MPTCP_PM_CMD_ADD_ADDR(r3, &(0x7f00000003c0)={&(0x7f00000002c0)={0x10, 0x0, 0x0, 0x10}, 0xc, &(0x7f0000000380)={&(0x7f0000000340)={0x24, r5, 0x300, 0x70bd26, 0x25dfdbfb, {}, [@MPTCP_PM_ATTR_SUBFLOWS={0x8, 0x3, 0x1}, @MPTCP_PM_ATTR_RCV_ADD_ADDRS={0x8, 0x2, 0x2}]}, 0x24}, 0x1, 0x0, 0x0, 0x20000004}, 0x8890) r6 = openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000500)='./cgroup/syz1\x00', 0x200002, 0x0) syz_io_uring_submit(0x0, r2, &(0x7f0000000580)=@IORING_OP_FILES_UPDATE={0x14, 0x4, 0x0, 0x0, 0x40, &(0x7f0000000540)=[r4, 0xffffffffffffffff, r6, r0, r1], 0x5}, 0x3) socket$inet6_tcp(0xa, 0x1, 0x0) openat$procfs(0xffffffffffffff9c, &(0x7f00000010c0)='/proc/crypto\x00', 0x0, 0x0) 21:19:47 executing program 2: r0 = syz_io_uring_setup(0x0, &(0x7f0000000080), &(0x7f0000ffb000/0x2000)=nil, &(0x7f0000ffb000/0x4000)=nil, &(0x7f0000000100), &(0x7f0000000140)=0x0) openat$hwrng(0xffffffffffffff9c, &(0x7f0000000180), 0x0, 0x0) r2 = openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000500)='./cgroup/syz1\x00', 0x200002, 0x0) syz_io_uring_submit(0x0, r1, &(0x7f0000000580)=@IORING_OP_FILES_UPDATE={0x14, 0x4, 0x0, 0x0, 0x40, &(0x7f0000000540)=[0xffffffffffffffff, 0xffffffffffffffff, r2, 0xffffffffffffffff, r0], 0x5}, 0x3) io_uring_setup(0x2812, &(0x7f00000005c0)={0x0, 0x5e1b, 0x2, 0x3, 0x12f}) 21:19:47 executing program 0: syz_io_uring_setup(0x8fe, &(0x7f0000000080), &(0x7f0000ffb000/0x2000)=nil, &(0x7f0000ffb000/0x4000)=nil, &(0x7f0000000100), &(0x7f0000000140)) openat$hwrng(0xffffffffffffff9c, &(0x7f0000000180), 0x2, 0x0) openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000500)='./cgroup/syz1\x00', 0x200002, 0x0) syz_io_uring_submit(0x0, 0x0, 0x0, 0x0) io_uring_setup(0x2812, &(0x7f00000005c0)={0x0, 0x0, 0x2}) socket$inet6_tcp(0xa, 0x1, 0x0) 21:19:47 executing program 1: r0 = io_uring_setup(0x355e, &(0x7f0000000000)={0x0, 0x0, 0x20, 0x1, 0x1be}) r1 = openat$hwrng(0xffffffffffffff9c, &(0x7f0000000180), 0x2, 0x0) r2 = syz_io_uring_setup(0x65dd, &(0x7f00000001c0)={0x0, 0x0, 0x20, 0x0, 0xdf}, &(0x7f0000ffe000/0x1000)=nil, &(0x7f0000ffd000/0x1000)=nil, &(0x7f0000000240), &(0x7f0000000280)) syz_genetlink_get_family_id$mptcp(&(0x7f0000000300), r1) syz_io_uring_setup(0x20f8, &(0x7f0000000400)={0x0, 0x7677, 0x8, 0x3, 0x22f, 0x0, r2}, &(0x7f0000ffe000/0x2000)=nil, &(0x7f0000ffb000/0x2000)=nil, &(0x7f0000000480)=0x0, &(0x7f00000004c0)) r4 = openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000500)='./cgroup/syz1\x00', 0x200002, 0x0) syz_io_uring_submit(r3, 0x0, &(0x7f0000000580)=@IORING_OP_FILES_UPDATE={0x14, 0x4, 0x0, 0x0, 0x40, &(0x7f0000000540)=[r2, 0xffffffffffffffff, r4, r0, 0xffffffffffffffff], 0x5}, 0x3) io_uring_setup(0x2812, &(0x7f00000005c0)={0x0, 0x5e1b, 0x2, 0x3, 0x12f, 0x0, r2}) socket$inet6_tcp(0xa, 0x1, 0x0) openat$procfs(0xffffffffffffff9c, &(0x7f00000010c0)='/proc/crypto\x00', 0x0, 0x0) io_uring_setup(0x7c8f, &(0x7f0000001140)={0x0, 0xc240, 0x10, 0x3, 0x1c7, 0x0, r2}) 21:19:56 executing program 7: r0 = io_uring_setup(0x355e, &(0x7f0000000000)={0x0, 0x0, 0x20, 0x1, 0x1be}) r1 = openat$hwrng(0xffffffffffffff9c, &(0x7f0000000180), 0x2, 0x0) r2 = syz_io_uring_setup(0x65dd, &(0x7f00000001c0)={0x0, 0x0, 0x0, 0x2, 0xdf}, &(0x7f0000ffe000/0x1000)=nil, &(0x7f0000ffd000/0x1000)=nil, &(0x7f0000000240), &(0x7f0000000280)) syz_genetlink_get_family_id$mptcp(&(0x7f0000000300), r1) syz_io_uring_setup(0x20f8, &(0x7f0000000400)={0x0, 0x7677, 0x8, 0x3, 0x22f, 0x0, r2}, &(0x7f0000ffe000/0x2000)=nil, &(0x7f0000ffb000/0x2000)=nil, &(0x7f0000000480)=0x0, &(0x7f00000004c0)) r4 = openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000500)='./cgroup/syz1\x00', 0x200002, 0x0) syz_io_uring_submit(r3, 0x0, &(0x7f0000000580)=@IORING_OP_FILES_UPDATE={0x14, 0x4, 0x0, 0x0, 0x40, &(0x7f0000000540)=[r2, 0xffffffffffffffff, r4, r0, 0xffffffffffffffff], 0x5}, 0x3) io_uring_setup(0x2812, &(0x7f00000005c0)={0x0, 0x5e1b, 0x2, 0x3, 0x12f, 0x0, r2}) socket$inet6_tcp(0xa, 0x1, 0x0) openat$procfs(0xffffffffffffff9c, &(0x7f00000010c0)='/proc/crypto\x00', 0x0, 0x0) 21:19:56 executing program 6: r0 = io_uring_setup(0x355e, &(0x7f0000000000)={0x0, 0x0, 0x20, 0x0, 0x1be}) r1 = syz_io_uring_setup(0x8fe, &(0x7f0000000080)={0x0, 0x1830, 0x0, 0x0, 0x0, 0x0, r0}, &(0x7f0000ffb000/0x2000)=nil, &(0x7f0000ffb000/0x4000)=nil, &(0x7f0000000100), &(0x7f0000000140)=0x0) r3 = openat$hwrng(0xffffffffffffff9c, &(0x7f0000000180), 0x2, 0x0) r4 = syz_genetlink_get_family_id$mptcp(&(0x7f0000000300), r3) sendmsg$MPTCP_PM_CMD_ADD_ADDR(r3, &(0x7f00000003c0)={&(0x7f00000002c0)={0x10, 0x0, 0x0, 0x10}, 0xc, &(0x7f0000000380)={&(0x7f0000000340)={0x24, r4, 0x300, 0x70bd26, 0x25dfdbfb, {}, [@MPTCP_PM_ATTR_SUBFLOWS={0x8, 0x3, 0x1}, @MPTCP_PM_ATTR_RCV_ADD_ADDRS={0x8, 0x2, 0x2}]}, 0x24}, 0x1, 0x0, 0x0, 0x20000004}, 0x8890) syz_io_uring_setup(0x20f8, &(0x7f0000000400)={0x0, 0x7677, 0x8, 0x3, 0x22f}, &(0x7f0000ffe000/0x2000)=nil, &(0x7f0000ffb000/0x2000)=nil, &(0x7f0000000480)=0x0, &(0x7f00000004c0)) r6 = openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000500)='./cgroup/syz1\x00', 0x200002, 0x0) syz_io_uring_submit(r5, r2, &(0x7f0000000580)=@IORING_OP_FILES_UPDATE={0x14, 0x4, 0x0, 0x0, 0x40, &(0x7f0000000540)=[0xffffffffffffffff, 0xffffffffffffffff, r6, r0, r1], 0x5}, 0x3) socket$inet6_tcp(0xa, 0x1, 0x0) openat$procfs(0xffffffffffffff9c, &(0x7f00000010c0)='/proc/crypto\x00', 0x0, 0x0) io_uring_setup(0x7c8f, &(0x7f0000001140)={0x0, 0xc240, 0x10, 0x3, 0x1c7}) 21:19:56 executing program 4: ioctl$SCSI_IOCTL_DOORUNLOCK(0xffffffffffffffff, 0x5381) r0 = syz_open_dev$mouse(&(0x7f0000000000), 0x578, 0x4000) ioctl$SG_GET_PACK_ID(r0, 0x227c, &(0x7f0000000040)) syz_genetlink_get_family_id$nl80211(&(0x7f00000000c0), 0xffffffffffffffff) syz_open_dev$vcsa(0x0, 0x56, 0x4000) socketpair(0x0, 0x3, 0x6, &(0x7f0000000640)) r1 = openat$tcp_congestion(0xffffffffffffff9c, &(0x7f0000000800), 0x1, 0x0) write$tcp_congestion(r1, &(0x7f0000000840)='htcp\x00', 0x5) 21:19:56 executing program 5: r0 = io_uring_setup(0x355e, &(0x7f0000000000)={0x0, 0x0, 0x20}) r1 = syz_io_uring_setup(0x8fe, &(0x7f0000000080)={0x0, 0x1830, 0x0, 0x0, 0x1b8, 0x0, r0}, &(0x7f0000ffb000/0x2000)=nil, &(0x7f0000ffb000/0x4000)=nil, &(0x7f0000000100), &(0x7f0000000140)=0x0) r3 = openat$hwrng(0xffffffffffffff9c, &(0x7f0000000180), 0x2, 0x0) r4 = syz_io_uring_setup(0x65dd, &(0x7f00000001c0)={0x0, 0xf46f, 0x20, 0x2, 0xdf}, &(0x7f0000ffe000/0x1000)=nil, &(0x7f0000ffd000/0x1000)=nil, &(0x7f0000000240), &(0x7f0000000280)) r5 = syz_genetlink_get_family_id$mptcp(&(0x7f0000000300), r3) sendmsg$MPTCP_PM_CMD_ADD_ADDR(r3, &(0x7f00000003c0)={&(0x7f00000002c0)={0x10, 0x0, 0x0, 0x10}, 0xc, &(0x7f0000000380)={&(0x7f0000000340)={0x24, r5, 0x300, 0x70bd26, 0x25dfdbfb, {}, [@MPTCP_PM_ATTR_SUBFLOWS={0x8, 0x3, 0x1}, @MPTCP_PM_ATTR_RCV_ADD_ADDRS={0x8, 0x2, 0x2}]}, 0x24}, 0x1, 0x0, 0x0, 0x20000004}, 0x8890) r6 = openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000500)='./cgroup/syz1\x00', 0x200002, 0x0) syz_io_uring_submit(0x0, r2, &(0x7f0000000580)=@IORING_OP_FILES_UPDATE={0x14, 0x4, 0x0, 0x0, 0x40, &(0x7f0000000540)=[r4, 0xffffffffffffffff, r6, r0, r1], 0x5}, 0x3) socket$inet6_tcp(0xa, 0x1, 0x0) openat$procfs(0xffffffffffffff9c, &(0x7f00000010c0)='/proc/crypto\x00', 0x0, 0x0) 21:19:56 executing program 0: syz_io_uring_setup(0x8fe, &(0x7f0000000080), &(0x7f0000ffb000/0x2000)=nil, &(0x7f0000ffb000/0x4000)=nil, &(0x7f0000000100), &(0x7f0000000140)) openat$hwrng(0xffffffffffffff9c, &(0x7f0000000180), 0x2, 0x0) openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000500)='./cgroup/syz1\x00', 0x200002, 0x0) syz_io_uring_submit(0x0, 0x0, 0x0, 0x0) io_uring_setup(0x2812, &(0x7f00000005c0)={0x0, 0x0, 0x2}) socket$inet6_tcp(0xa, 0x1, 0x0) 21:19:56 executing program 3: r0 = io_uring_setup(0x355e, &(0x7f0000000000)={0x0, 0x0, 0x20, 0x1, 0x1be}) r1 = syz_io_uring_setup(0x8fe, 0x0, &(0x7f0000ffb000/0x2000)=nil, &(0x7f0000ffb000/0x4000)=nil, &(0x7f0000000100), &(0x7f0000000140)=0x0) r3 = openat$hwrng(0xffffffffffffff9c, &(0x7f0000000180), 0x2, 0x0) syz_genetlink_get_family_id$mptcp(&(0x7f0000000300), r3) r4 = openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000500)='./cgroup/syz1\x00', 0x200002, 0x0) syz_io_uring_submit(0x0, r2, &(0x7f0000000580)=@IORING_OP_FILES_UPDATE={0x14, 0x4, 0x0, 0x0, 0x40, &(0x7f0000000540)=[0xffffffffffffffff, 0xffffffffffffffff, r4, r0, r1], 0x5}, 0x3) io_uring_setup(0x2812, &(0x7f00000005c0)={0x0, 0x5e1b, 0x2, 0x3, 0x12f}) socket$inet6_tcp(0xa, 0x1, 0x0) io_uring_setup(0x7c8f, &(0x7f0000001140)={0x0, 0xc240, 0x10, 0x3, 0x1c7}) 21:19:56 executing program 2: r0 = syz_io_uring_setup(0x0, &(0x7f0000000080), &(0x7f0000ffb000/0x2000)=nil, &(0x7f0000ffb000/0x4000)=nil, &(0x7f0000000100), &(0x7f0000000140)=0x0) openat$hwrng(0xffffffffffffff9c, &(0x7f0000000180), 0x0, 0x0) r2 = openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000500)='./cgroup/syz1\x00', 0x200002, 0x0) syz_io_uring_submit(0x0, r1, &(0x7f0000000580)=@IORING_OP_FILES_UPDATE={0x14, 0x4, 0x0, 0x0, 0x40, &(0x7f0000000540)=[0xffffffffffffffff, 0xffffffffffffffff, r2, 0xffffffffffffffff, r0], 0x5}, 0x3) io_uring_setup(0x2812, &(0x7f00000005c0)={0x0, 0x5e1b, 0x2, 0x3, 0x12f}) 21:19:56 executing program 1: r0 = io_uring_setup(0x355e, &(0x7f0000000000)={0x0, 0x0, 0x20, 0x1, 0x1be}) r1 = openat$hwrng(0xffffffffffffff9c, &(0x7f0000000180), 0x2, 0x0) r2 = syz_io_uring_setup(0x65dd, &(0x7f00000001c0)={0x0, 0x0, 0x20, 0x0, 0xdf}, &(0x7f0000ffe000/0x1000)=nil, &(0x7f0000ffd000/0x1000)=nil, &(0x7f0000000240), &(0x7f0000000280)) syz_genetlink_get_family_id$mptcp(&(0x7f0000000300), r1) syz_io_uring_setup(0x20f8, &(0x7f0000000400)={0x0, 0x7677, 0x8, 0x3, 0x22f, 0x0, r2}, &(0x7f0000ffe000/0x2000)=nil, &(0x7f0000ffb000/0x2000)=nil, &(0x7f0000000480)=0x0, &(0x7f00000004c0)) r4 = openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000500)='./cgroup/syz1\x00', 0x200002, 0x0) syz_io_uring_submit(r3, 0x0, &(0x7f0000000580)=@IORING_OP_FILES_UPDATE={0x14, 0x4, 0x0, 0x0, 0x40, &(0x7f0000000540)=[r2, 0xffffffffffffffff, r4, r0, 0xffffffffffffffff], 0x5}, 0x3) io_uring_setup(0x2812, &(0x7f00000005c0)={0x0, 0x5e1b, 0x2, 0x3, 0x12f, 0x0, r2}) socket$inet6_tcp(0xa, 0x1, 0x0) openat$procfs(0xffffffffffffff9c, &(0x7f00000010c0)='/proc/crypto\x00', 0x0, 0x0) io_uring_setup(0x7c8f, &(0x7f0000001140)={0x0, 0xc240, 0x10, 0x3, 0x1c7, 0x0, r2}) 21:19:56 executing program 2: r0 = syz_io_uring_setup(0x0, &(0x7f0000000080), &(0x7f0000ffb000/0x2000)=nil, &(0x7f0000ffb000/0x4000)=nil, &(0x7f0000000100), &(0x7f0000000140)=0x0) openat$hwrng(0xffffffffffffff9c, &(0x7f0000000180), 0x0, 0x0) r2 = openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000500)='./cgroup/syz1\x00', 0x200002, 0x0) syz_io_uring_submit(0x0, r1, &(0x7f0000000580)=@IORING_OP_FILES_UPDATE={0x14, 0x4, 0x0, 0x0, 0x40, &(0x7f0000000540)=[0xffffffffffffffff, 0xffffffffffffffff, r2, 0xffffffffffffffff, r0], 0x5}, 0x3) io_uring_setup(0x2812, &(0x7f00000005c0)={0x0, 0x5e1b, 0x2, 0x3, 0x12f}) 21:19:56 executing program 0: syz_io_uring_setup(0x8fe, &(0x7f0000000080), &(0x7f0000ffb000/0x2000)=nil, &(0x7f0000ffb000/0x4000)=nil, &(0x7f0000000100), &(0x7f0000000140)) openat$hwrng(0xffffffffffffff9c, &(0x7f0000000180), 0x2, 0x0) openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000500)='./cgroup/syz1\x00', 0x200002, 0x0) syz_io_uring_submit(0x0, 0x0, 0x0, 0x0) io_uring_setup(0x2812, &(0x7f00000005c0)={0x0, 0x0, 0x2}) 21:19:56 executing program 3: r0 = io_uring_setup(0x355e, &(0x7f0000000000)={0x0, 0x0, 0x20, 0x1, 0x1be}) r1 = syz_io_uring_setup(0x8fe, 0x0, &(0x7f0000ffb000/0x2000)=nil, &(0x7f0000ffb000/0x4000)=nil, &(0x7f0000000100), &(0x7f0000000140)=0x0) r3 = openat$hwrng(0xffffffffffffff9c, &(0x7f0000000180), 0x2, 0x0) syz_genetlink_get_family_id$mptcp(&(0x7f0000000300), r3) r4 = openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000500)='./cgroup/syz1\x00', 0x200002, 0x0) syz_io_uring_submit(0x0, r2, &(0x7f0000000580)=@IORING_OP_FILES_UPDATE={0x14, 0x4, 0x0, 0x0, 0x40, &(0x7f0000000540)=[0xffffffffffffffff, 0xffffffffffffffff, r4, r0, r1], 0x5}, 0x3) io_uring_setup(0x2812, &(0x7f00000005c0)={0x0, 0x5e1b, 0x2, 0x3, 0x12f}) socket$inet6_tcp(0xa, 0x1, 0x0) io_uring_setup(0x7c8f, &(0x7f0000001140)={0x0, 0xc240, 0x10, 0x3, 0x1c7}) 21:19:56 executing program 6: r0 = io_uring_setup(0x355e, &(0x7f0000000000)={0x0, 0x0, 0x20, 0x0, 0x1be}) r1 = syz_io_uring_setup(0x8fe, &(0x7f0000000080)={0x0, 0x1830, 0x0, 0x0, 0x0, 0x0, r0}, &(0x7f0000ffb000/0x2000)=nil, &(0x7f0000ffb000/0x4000)=nil, &(0x7f0000000100), &(0x7f0000000140)=0x0) r3 = openat$hwrng(0xffffffffffffff9c, &(0x7f0000000180), 0x2, 0x0) r4 = syz_genetlink_get_family_id$mptcp(&(0x7f0000000300), r3) sendmsg$MPTCP_PM_CMD_ADD_ADDR(r3, &(0x7f00000003c0)={&(0x7f00000002c0)={0x10, 0x0, 0x0, 0x10}, 0xc, &(0x7f0000000380)={&(0x7f0000000340)={0x24, r4, 0x300, 0x70bd26, 0x25dfdbfb, {}, [@MPTCP_PM_ATTR_SUBFLOWS={0x8, 0x3, 0x1}, @MPTCP_PM_ATTR_RCV_ADD_ADDRS={0x8, 0x2, 0x2}]}, 0x24}, 0x1, 0x0, 0x0, 0x20000004}, 0x8890) syz_io_uring_setup(0x20f8, &(0x7f0000000400)={0x0, 0x7677, 0x8, 0x3, 0x22f}, &(0x7f0000ffe000/0x2000)=nil, &(0x7f0000ffb000/0x2000)=nil, &(0x7f0000000480)=0x0, &(0x7f00000004c0)) r6 = openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000500)='./cgroup/syz1\x00', 0x200002, 0x0) syz_io_uring_submit(r5, r2, &(0x7f0000000580)=@IORING_OP_FILES_UPDATE={0x14, 0x4, 0x0, 0x0, 0x40, &(0x7f0000000540)=[0xffffffffffffffff, 0xffffffffffffffff, r6, r0, r1], 0x5}, 0x3) socket$inet6_tcp(0xa, 0x1, 0x0) openat$procfs(0xffffffffffffff9c, &(0x7f00000010c0)='/proc/crypto\x00', 0x0, 0x0) io_uring_setup(0x7c8f, &(0x7f0000001140)={0x0, 0xc240, 0x10, 0x3, 0x1c7}) 21:19:56 executing program 7: r0 = io_uring_setup(0x355e, &(0x7f0000000000)={0x0, 0x0, 0x20, 0x1, 0x1be}) r1 = openat$hwrng(0xffffffffffffff9c, &(0x7f0000000180), 0x2, 0x0) r2 = syz_io_uring_setup(0x65dd, &(0x7f00000001c0)={0x0, 0x0, 0x0, 0x2, 0xdf}, &(0x7f0000ffe000/0x1000)=nil, &(0x7f0000ffd000/0x1000)=nil, &(0x7f0000000240), &(0x7f0000000280)) syz_genetlink_get_family_id$mptcp(&(0x7f0000000300), r1) syz_io_uring_setup(0x20f8, &(0x7f0000000400)={0x0, 0x7677, 0x8, 0x3, 0x22f, 0x0, r2}, &(0x7f0000ffe000/0x2000)=nil, &(0x7f0000ffb000/0x2000)=nil, &(0x7f0000000480)=0x0, &(0x7f00000004c0)) r4 = openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000500)='./cgroup/syz1\x00', 0x200002, 0x0) syz_io_uring_submit(r3, 0x0, &(0x7f0000000580)=@IORING_OP_FILES_UPDATE={0x14, 0x4, 0x0, 0x0, 0x40, &(0x7f0000000540)=[r2, 0xffffffffffffffff, r4, r0, 0xffffffffffffffff], 0x5}, 0x3) io_uring_setup(0x2812, &(0x7f00000005c0)={0x0, 0x5e1b, 0x2, 0x3, 0x12f, 0x0, r2}) socket$inet6_tcp(0xa, 0x1, 0x0) 21:19:56 executing program 4: ioctl$SCSI_IOCTL_DOORUNLOCK(0xffffffffffffffff, 0x5381) r0 = syz_open_dev$mouse(&(0x7f0000000000), 0x578, 0x4000) ioctl$SG_GET_PACK_ID(r0, 0x227c, &(0x7f0000000040)) syz_genetlink_get_family_id$nl80211(&(0x7f00000000c0), 0xffffffffffffffff) syz_open_dev$vcsa(0x0, 0x56, 0x4000) socketpair(0x0, 0x3, 0x6, &(0x7f0000000640)) r1 = openat$tcp_congestion(0xffffffffffffff9c, &(0x7f0000000800), 0x1, 0x0) write$tcp_congestion(r1, &(0x7f0000000840)='htcp\x00', 0x5) 21:19:56 executing program 5: r0 = io_uring_setup(0x355e, &(0x7f0000000000)={0x0, 0x0, 0x20, 0x0, 0x1be}) r1 = syz_io_uring_setup(0x0, &(0x7f0000000080)={0x0, 0x1830, 0x0, 0x0, 0x1b8, 0x0, r0}, &(0x7f0000ffb000/0x2000)=nil, &(0x7f0000ffb000/0x4000)=nil, &(0x7f0000000100), &(0x7f0000000140)=0x0) r3 = openat$hwrng(0xffffffffffffff9c, &(0x7f0000000180), 0x2, 0x0) r4 = syz_io_uring_setup(0x65dd, &(0x7f00000001c0)={0x0, 0xf46f, 0x20, 0x2, 0xdf}, &(0x7f0000ffe000/0x1000)=nil, &(0x7f0000ffd000/0x1000)=nil, &(0x7f0000000240), &(0x7f0000000280)) r5 = syz_genetlink_get_family_id$mptcp(&(0x7f0000000300), r3) sendmsg$MPTCP_PM_CMD_ADD_ADDR(r3, &(0x7f00000003c0)={&(0x7f00000002c0)={0x10, 0x0, 0x0, 0x10}, 0xc, &(0x7f0000000380)={&(0x7f0000000340)={0x24, r5, 0x300, 0x70bd26, 0x25dfdbfb, {}, [@MPTCP_PM_ATTR_SUBFLOWS={0x8, 0x3, 0x1}, @MPTCP_PM_ATTR_RCV_ADD_ADDRS={0x8, 0x2, 0x2}]}, 0x24}, 0x1, 0x0, 0x0, 0x20000004}, 0x8890) r6 = openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000500)='./cgroup/syz1\x00', 0x200002, 0x0) syz_io_uring_submit(0x0, r2, &(0x7f0000000580)=@IORING_OP_FILES_UPDATE={0x14, 0x4, 0x0, 0x0, 0x40, &(0x7f0000000540)=[r4, 0xffffffffffffffff, r6, r0, r1], 0x5}, 0x3) socket$inet6_tcp(0xa, 0x1, 0x0) openat$procfs(0xffffffffffffff9c, &(0x7f00000010c0)='/proc/crypto\x00', 0x0, 0x0) 21:19:56 executing program 1: r0 = io_uring_setup(0x355e, &(0x7f0000000000)={0x0, 0x0, 0x20, 0x1, 0x1be}) r1 = openat$hwrng(0xffffffffffffff9c, &(0x7f0000000180), 0x2, 0x0) r2 = syz_io_uring_setup(0x65dd, &(0x7f00000001c0)={0x0, 0x0, 0x20, 0x0, 0xdf}, &(0x7f0000ffe000/0x1000)=nil, &(0x7f0000ffd000/0x1000)=nil, &(0x7f0000000240), &(0x7f0000000280)) syz_genetlink_get_family_id$mptcp(&(0x7f0000000300), r1) syz_io_uring_setup(0x20f8, &(0x7f0000000400)={0x0, 0x7677, 0x8, 0x3, 0x22f, 0x0, r2}, &(0x7f0000ffe000/0x2000)=nil, &(0x7f0000ffb000/0x2000)=nil, &(0x7f0000000480)=0x0, &(0x7f00000004c0)) r4 = openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000500)='./cgroup/syz1\x00', 0x200002, 0x0) syz_io_uring_submit(r3, 0x0, &(0x7f0000000580)=@IORING_OP_FILES_UPDATE={0x14, 0x4, 0x0, 0x0, 0x40, &(0x7f0000000540)=[r2, 0xffffffffffffffff, r4, r0, 0xffffffffffffffff], 0x5}, 0x3) io_uring_setup(0x2812, &(0x7f00000005c0)={0x0, 0x5e1b, 0x2, 0x3, 0x12f, 0x0, r2}) socket$inet6_tcp(0xa, 0x1, 0x0) openat$procfs(0xffffffffffffff9c, &(0x7f00000010c0)='/proc/crypto\x00', 0x0, 0x0) io_uring_setup(0x7c8f, &(0x7f0000001140)={0x0, 0xc240, 0x10, 0x3, 0x1c7, 0x0, r2}) 21:19:56 executing program 2: r0 = syz_io_uring_setup(0x8fe, 0x0, &(0x7f0000ffb000/0x2000)=nil, &(0x7f0000ffb000/0x4000)=nil, &(0x7f0000000100), &(0x7f0000000140)=0x0) openat$hwrng(0xffffffffffffff9c, &(0x7f0000000180), 0x0, 0x0) r2 = openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000500)='./cgroup/syz1\x00', 0x200002, 0x0) syz_io_uring_submit(0x0, r1, &(0x7f0000000580)=@IORING_OP_FILES_UPDATE={0x14, 0x4, 0x0, 0x0, 0x40, &(0x7f0000000540)=[0xffffffffffffffff, 0xffffffffffffffff, r2, 0xffffffffffffffff, r0], 0x5}, 0x3) io_uring_setup(0x2812, &(0x7f00000005c0)={0x0, 0x5e1b, 0x2, 0x3, 0x12f}) 21:19:56 executing program 0: syz_io_uring_setup(0x8fe, &(0x7f0000000080), &(0x7f0000ffb000/0x2000)=nil, &(0x7f0000ffb000/0x4000)=nil, &(0x7f0000000100), &(0x7f0000000140)) openat$hwrng(0xffffffffffffff9c, &(0x7f0000000180), 0x2, 0x0) openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000500)='./cgroup/syz1\x00', 0x200002, 0x0) io_uring_setup(0x2812, &(0x7f00000005c0)={0x0, 0x0, 0x2}) [ 526.176825] kmemleak: Found object by alias at 0x607f1a6398ac [ 526.176850] CPU: 0 UID: 0 PID: 6821 Comm: syz-executor.3 Tainted: G W 6.17.0-rc3-next-20250829 #1 PREEMPT(voluntary) [ 526.176874] Tainted: [W]=WARN [ 526.176879] Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.12.0-1 04/01/2014 [ 526.176888] Call Trace: [ 526.176893] [ 526.176899] dump_stack_lvl+0xca/0x120 [ 526.176930] __lookup_object+0x94/0xb0 [ 526.176954] delete_object_full+0x27/0x70 [ 526.176983] free_percpu+0x30/0x1160 [ 526.177005] ? arch_uprobe_clear_state+0x16/0x140 [ 526.177031] futex_hash_free+0x38/0xc0 [ 526.177050] mmput+0x2d3/0x390 [ 526.177074] do_exit+0x79d/0x2970 [ 526.177092] ? signal_wake_up_state+0x85/0x120 [ 526.177112] ? zap_other_threads+0x2b9/0x3a0 [ 526.177133] ? __pfx_do_exit+0x10/0x10 [ 526.177150] ? do_group_exit+0x1c3/0x2a0 [ 526.177168] ? lock_release+0xc8/0x290 [ 526.177191] do_group_exit+0xd3/0x2a0 [ 526.177210] __x64_sys_exit_group+0x3e/0x50 [ 526.177235] x64_sys_call+0x18c5/0x18d0 [ 526.177263] do_syscall_64+0xbf/0x360 [ 526.177279] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 526.177294] RIP: 0033:0x7f1060a76b19 [ 526.177306] Code: Unable to access opcode bytes at 0x7f1060a76aef. [ 526.177312] RSP: 002b:00007ffed3f8b6d8 EFLAGS: 00000246 ORIG_RAX: 00000000000000e7 [ 526.177328] RAX: ffffffffffffffda RBX: 000000000000001e RCX: 00007f1060a76b19 [ 526.177338] RDX: 00007f1060a2972b RSI: ffffffffffffffbc RDI: 0000000000000000 [ 526.177347] RBP: 0000000000000000 R08: 0000001b2da244b4 R09: 0000000000000000 [ 526.177356] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 526.177365] R13: 0000000000000000 R14: 0000000000000001 R15: 00007ffed3f8b7c0 [ 526.177386] [ 526.177391] kmemleak: Object (percpu) 0x607f1a6398a8 (size 8): [ 526.177399] kmemleak: comm "syz-executor.7", pid 6831, jiffies 4295192891 [ 526.177409] kmemleak: min_count = 1 [ 526.177414] kmemleak: count = 0 [ 526.177419] kmemleak: flags = 0x21 [ 526.177423] kmemleak: checksum = 0 [ 526.177428] kmemleak: backtrace: [ 526.177433] pcpu_alloc_noprof+0x87a/0x1170 [ 526.177453] percpu_ref_init+0x37/0x400 [ 526.177476] io_uring_setup+0x44c/0x2000 [ 526.177490] __x64_sys_io_uring_setup+0xc8/0x170 [ 526.177505] do_syscall_64+0xbf/0x360 [ 526.177516] entry_SYSCALL_64_after_hwframe+0x77/0x7f 21:19:56 executing program 3: r0 = io_uring_setup(0x355e, &(0x7f0000000000)={0x0, 0x0, 0x20, 0x1, 0x1be}) r1 = syz_io_uring_setup(0x8fe, &(0x7f0000000080)={0x0, 0x0, 0x0, 0x0, 0x1b8, 0x0, r0}, &(0x7f0000ffb000/0x2000)=nil, &(0x7f0000ffb000/0x4000)=nil, &(0x7f0000000100), &(0x7f0000000140)=0x0) r3 = openat$hwrng(0xffffffffffffff9c, &(0x7f0000000180), 0x2, 0x0) syz_genetlink_get_family_id$mptcp(&(0x7f0000000300), r3) r4 = openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000500)='./cgroup/syz1\x00', 0x200002, 0x0) syz_io_uring_submit(0x0, r2, &(0x7f0000000580)=@IORING_OP_FILES_UPDATE={0x14, 0x4, 0x0, 0x0, 0x40, &(0x7f0000000540)=[0xffffffffffffffff, 0xffffffffffffffff, r4, r0, r1], 0x5}, 0x3) io_uring_setup(0x2812, &(0x7f00000005c0)={0x0, 0x5e1b, 0x2, 0x3, 0x12f}) socket$inet6_tcp(0xa, 0x1, 0x0) io_uring_setup(0x7c8f, &(0x7f0000001140)={0x0, 0xc240, 0x10, 0x3, 0x1c7}) 21:19:56 executing program 6: r0 = io_uring_setup(0x355e, &(0x7f0000000000)={0x0, 0x0, 0x20, 0x0, 0x1be}) r1 = syz_io_uring_setup(0x8fe, &(0x7f0000000080)={0x0, 0x1830, 0x0, 0x0, 0x0, 0x0, r0}, &(0x7f0000ffb000/0x2000)=nil, &(0x7f0000ffb000/0x4000)=nil, &(0x7f0000000100), &(0x7f0000000140)=0x0) r3 = openat$hwrng(0xffffffffffffff9c, &(0x7f0000000180), 0x2, 0x0) r4 = syz_genetlink_get_family_id$mptcp(&(0x7f0000000300), r3) sendmsg$MPTCP_PM_CMD_ADD_ADDR(r3, &(0x7f00000003c0)={&(0x7f00000002c0)={0x10, 0x0, 0x0, 0x10}, 0xc, &(0x7f0000000380)={&(0x7f0000000340)={0x24, r4, 0x300, 0x70bd26, 0x25dfdbfb, {}, [@MPTCP_PM_ATTR_SUBFLOWS={0x8, 0x3, 0x1}, @MPTCP_PM_ATTR_RCV_ADD_ADDRS={0x8, 0x2, 0x2}]}, 0x24}, 0x1, 0x0, 0x0, 0x20000004}, 0x8890) syz_io_uring_setup(0x20f8, &(0x7f0000000400)={0x0, 0x7677, 0x8, 0x3, 0x22f}, &(0x7f0000ffe000/0x2000)=nil, &(0x7f0000ffb000/0x2000)=nil, &(0x7f0000000480)=0x0, &(0x7f00000004c0)) r6 = openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000500)='./cgroup/syz1\x00', 0x200002, 0x0) syz_io_uring_submit(r5, r2, &(0x7f0000000580)=@IORING_OP_FILES_UPDATE={0x14, 0x4, 0x0, 0x0, 0x40, &(0x7f0000000540)=[0xffffffffffffffff, 0xffffffffffffffff, r6, r0, r1], 0x5}, 0x3) socket$inet6_tcp(0xa, 0x1, 0x0) openat$procfs(0xffffffffffffff9c, &(0x7f00000010c0)='/proc/crypto\x00', 0x0, 0x0) io_uring_setup(0x7c8f, &(0x7f0000001140)={0x0, 0xc240, 0x10, 0x3, 0x1c7}) 21:19:56 executing program 2: r0 = syz_io_uring_setup(0x8fe, 0x0, &(0x7f0000ffb000/0x2000)=nil, &(0x7f0000ffb000/0x4000)=nil, &(0x7f0000000100), &(0x7f0000000140)=0x0) openat$hwrng(0xffffffffffffff9c, &(0x7f0000000180), 0x0, 0x0) r2 = openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000500)='./cgroup/syz1\x00', 0x200002, 0x0) syz_io_uring_submit(0x0, r1, &(0x7f0000000580)=@IORING_OP_FILES_UPDATE={0x14, 0x4, 0x0, 0x0, 0x40, &(0x7f0000000540)=[0xffffffffffffffff, 0xffffffffffffffff, r2, 0xffffffffffffffff, r0], 0x5}, 0x3) io_uring_setup(0x2812, &(0x7f00000005c0)={0x0, 0x5e1b, 0x2, 0x3, 0x12f}) 21:20:04 executing program 4: ioctl$SCSI_IOCTL_DOORUNLOCK(0xffffffffffffffff, 0x5381) r0 = syz_open_dev$mouse(&(0x7f0000000000), 0x578, 0x4000) ioctl$SG_GET_PACK_ID(r0, 0x227c, &(0x7f0000000040)) syz_genetlink_get_family_id$nl80211(&(0x7f00000000c0), 0xffffffffffffffff) syz_open_dev$vcsa(0x0, 0x56, 0x4000) socketpair(0x0, 0x3, 0x6, &(0x7f0000000640)) r1 = openat$tcp_congestion(0xffffffffffffff9c, &(0x7f0000000800), 0x1, 0x0) write$tcp_congestion(r1, &(0x7f0000000840)='htcp\x00', 0x5) 21:20:04 executing program 5: r0 = io_uring_setup(0x355e, &(0x7f0000000000)={0x0, 0x0, 0x20, 0x0, 0x1be}) r1 = syz_io_uring_setup(0x0, &(0x7f0000000080)={0x0, 0x1830, 0x0, 0x0, 0x1b8, 0x0, r0}, &(0x7f0000ffb000/0x2000)=nil, &(0x7f0000ffb000/0x4000)=nil, &(0x7f0000000100), &(0x7f0000000140)=0x0) r3 = openat$hwrng(0xffffffffffffff9c, &(0x7f0000000180), 0x2, 0x0) r4 = syz_io_uring_setup(0x65dd, &(0x7f00000001c0)={0x0, 0xf46f, 0x20, 0x2, 0xdf}, &(0x7f0000ffe000/0x1000)=nil, &(0x7f0000ffd000/0x1000)=nil, &(0x7f0000000240), &(0x7f0000000280)) r5 = syz_genetlink_get_family_id$mptcp(&(0x7f0000000300), r3) sendmsg$MPTCP_PM_CMD_ADD_ADDR(r3, &(0x7f00000003c0)={&(0x7f00000002c0)={0x10, 0x0, 0x0, 0x10}, 0xc, &(0x7f0000000380)={&(0x7f0000000340)={0x24, r5, 0x300, 0x70bd26, 0x25dfdbfb, {}, [@MPTCP_PM_ATTR_SUBFLOWS={0x8, 0x3, 0x1}, @MPTCP_PM_ATTR_RCV_ADD_ADDRS={0x8, 0x2, 0x2}]}, 0x24}, 0x1, 0x0, 0x0, 0x20000004}, 0x8890) r6 = openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000500)='./cgroup/syz1\x00', 0x200002, 0x0) syz_io_uring_submit(0x0, r2, &(0x7f0000000580)=@IORING_OP_FILES_UPDATE={0x14, 0x4, 0x0, 0x0, 0x40, &(0x7f0000000540)=[r4, 0xffffffffffffffff, r6, r0, r1], 0x5}, 0x3) socket$inet6_tcp(0xa, 0x1, 0x0) openat$procfs(0xffffffffffffff9c, &(0x7f00000010c0)='/proc/crypto\x00', 0x0, 0x0) 21:20:04 executing program 6: r0 = io_uring_setup(0x355e, &(0x7f0000000000)={0x0, 0x0, 0x20, 0x0, 0x1be}) r1 = syz_io_uring_setup(0x8fe, &(0x7f0000000080)={0x0, 0x1830}, &(0x7f0000ffb000/0x2000)=nil, &(0x7f0000ffb000/0x4000)=nil, &(0x7f0000000100), &(0x7f0000000140)=0x0) r3 = openat$hwrng(0xffffffffffffff9c, &(0x7f0000000180), 0x2, 0x0) r4 = syz_genetlink_get_family_id$mptcp(&(0x7f0000000300), r3) sendmsg$MPTCP_PM_CMD_ADD_ADDR(r3, &(0x7f00000003c0)={&(0x7f00000002c0)={0x10, 0x0, 0x0, 0x10}, 0xc, &(0x7f0000000380)={&(0x7f0000000340)={0x24, r4, 0x300, 0x70bd26, 0x25dfdbfb, {}, [@MPTCP_PM_ATTR_SUBFLOWS={0x8, 0x3, 0x1}, @MPTCP_PM_ATTR_RCV_ADD_ADDRS={0x8, 0x2, 0x2}]}, 0x24}, 0x1, 0x0, 0x0, 0x20000004}, 0x8890) syz_io_uring_setup(0x20f8, &(0x7f0000000400)={0x0, 0x7677, 0x8, 0x3, 0x22f}, &(0x7f0000ffe000/0x2000)=nil, &(0x7f0000ffb000/0x2000)=nil, &(0x7f0000000480)=0x0, &(0x7f00000004c0)) r6 = openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000500)='./cgroup/syz1\x00', 0x200002, 0x0) syz_io_uring_submit(r5, r2, &(0x7f0000000580)=@IORING_OP_FILES_UPDATE={0x14, 0x4, 0x0, 0x0, 0x40, &(0x7f0000000540)=[0xffffffffffffffff, 0xffffffffffffffff, r6, r0, r1], 0x5}, 0x3) socket$inet6_tcp(0xa, 0x1, 0x0) openat$procfs(0xffffffffffffff9c, &(0x7f00000010c0)='/proc/crypto\x00', 0x0, 0x0) io_uring_setup(0x7c8f, &(0x7f0000001140)={0x0, 0xc240, 0x10, 0x3, 0x1c7}) 21:20:04 executing program 0: syz_io_uring_setup(0x8fe, &(0x7f0000000080), &(0x7f0000ffb000/0x2000)=nil, &(0x7f0000ffb000/0x4000)=nil, &(0x7f0000000100), &(0x7f0000000140)) openat$hwrng(0xffffffffffffff9c, &(0x7f0000000180), 0x2, 0x0) openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000500)='./cgroup/syz1\x00', 0x200002, 0x0) io_uring_setup(0x2812, &(0x7f00000005c0)={0x0, 0x0, 0x2}) 21:20:04 executing program 7: r0 = io_uring_setup(0x355e, &(0x7f0000000000)={0x0, 0x0, 0x20, 0x1, 0x1be}) r1 = openat$hwrng(0xffffffffffffff9c, &(0x7f0000000180), 0x2, 0x0) r2 = syz_io_uring_setup(0x65dd, &(0x7f00000001c0)={0x0, 0x0, 0x0, 0x2, 0xdf}, &(0x7f0000ffe000/0x1000)=nil, &(0x7f0000ffd000/0x1000)=nil, &(0x7f0000000240), &(0x7f0000000280)) syz_genetlink_get_family_id$mptcp(&(0x7f0000000300), r1) syz_io_uring_setup(0x20f8, &(0x7f0000000400)={0x0, 0x7677, 0x8, 0x3, 0x22f, 0x0, r2}, &(0x7f0000ffe000/0x2000)=nil, &(0x7f0000ffb000/0x2000)=nil, &(0x7f0000000480)=0x0, &(0x7f00000004c0)) r4 = openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000500)='./cgroup/syz1\x00', 0x200002, 0x0) syz_io_uring_submit(r3, 0x0, &(0x7f0000000580)=@IORING_OP_FILES_UPDATE={0x14, 0x4, 0x0, 0x0, 0x40, &(0x7f0000000540)=[r2, 0xffffffffffffffff, r4, r0, 0xffffffffffffffff], 0x5}, 0x3) io_uring_setup(0x2812, &(0x7f00000005c0)={0x0, 0x5e1b, 0x2, 0x3, 0x12f, 0x0, r2}) socket$inet6_tcp(0xa, 0x1, 0x0) 21:20:04 executing program 3: r0 = io_uring_setup(0x355e, &(0x7f0000000000)={0x0, 0x0, 0x20, 0x1, 0x1be}) r1 = syz_io_uring_setup(0x8fe, &(0x7f0000000080)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, r0}, &(0x7f0000ffb000/0x2000)=nil, &(0x7f0000ffb000/0x4000)=nil, &(0x7f0000000100), &(0x7f0000000140)=0x0) r3 = openat$hwrng(0xffffffffffffff9c, &(0x7f0000000180), 0x2, 0x0) syz_genetlink_get_family_id$mptcp(&(0x7f0000000300), r3) r4 = openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000500)='./cgroup/syz1\x00', 0x200002, 0x0) syz_io_uring_submit(0x0, r2, &(0x7f0000000580)=@IORING_OP_FILES_UPDATE={0x14, 0x4, 0x0, 0x0, 0x40, &(0x7f0000000540)=[0xffffffffffffffff, 0xffffffffffffffff, r4, r0, r1], 0x5}, 0x3) io_uring_setup(0x2812, &(0x7f00000005c0)={0x0, 0x5e1b, 0x2, 0x3, 0x12f}) socket$inet6_tcp(0xa, 0x1, 0x0) io_uring_setup(0x7c8f, &(0x7f0000001140)={0x0, 0xc240, 0x10, 0x3, 0x1c7}) 21:20:04 executing program 1: r0 = io_uring_setup(0x355e, &(0x7f0000000000)={0x0, 0x0, 0x20, 0x1, 0x1be}) r1 = openat$hwrng(0xffffffffffffff9c, &(0x7f0000000180), 0x2, 0x0) r2 = syz_io_uring_setup(0x65dd, &(0x7f00000001c0)={0x0, 0x0, 0x20, 0x2}, &(0x7f0000ffe000/0x1000)=nil, &(0x7f0000ffd000/0x1000)=nil, &(0x7f0000000240), &(0x7f0000000280)) syz_genetlink_get_family_id$mptcp(&(0x7f0000000300), r1) syz_io_uring_setup(0x20f8, &(0x7f0000000400)={0x0, 0x7677, 0x8, 0x3, 0x22f, 0x0, r2}, &(0x7f0000ffe000/0x2000)=nil, &(0x7f0000ffb000/0x2000)=nil, &(0x7f0000000480)=0x0, &(0x7f00000004c0)) r4 = openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000500)='./cgroup/syz1\x00', 0x200002, 0x0) syz_io_uring_submit(r3, 0x0, &(0x7f0000000580)=@IORING_OP_FILES_UPDATE={0x14, 0x4, 0x0, 0x0, 0x40, &(0x7f0000000540)=[r2, 0xffffffffffffffff, r4, r0, 0xffffffffffffffff], 0x5}, 0x3) io_uring_setup(0x2812, &(0x7f00000005c0)={0x0, 0x5e1b, 0x2, 0x3, 0x12f, 0x0, r2}) socket$inet6_tcp(0xa, 0x1, 0x0) openat$procfs(0xffffffffffffff9c, &(0x7f00000010c0)='/proc/crypto\x00', 0x0, 0x0) io_uring_setup(0x7c8f, &(0x7f0000001140)={0x0, 0xc240, 0x10, 0x3, 0x1c7, 0x0, r2}) 21:20:04 executing program 2: r0 = syz_io_uring_setup(0x8fe, 0x0, &(0x7f0000ffb000/0x2000)=nil, &(0x7f0000ffb000/0x4000)=nil, &(0x7f0000000100), &(0x7f0000000140)=0x0) openat$hwrng(0xffffffffffffff9c, &(0x7f0000000180), 0x0, 0x0) r2 = openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000500)='./cgroup/syz1\x00', 0x200002, 0x0) syz_io_uring_submit(0x0, r1, &(0x7f0000000580)=@IORING_OP_FILES_UPDATE={0x14, 0x4, 0x0, 0x0, 0x40, &(0x7f0000000540)=[0xffffffffffffffff, 0xffffffffffffffff, r2, 0xffffffffffffffff, r0], 0x5}, 0x3) io_uring_setup(0x2812, &(0x7f00000005c0)={0x0, 0x5e1b, 0x2, 0x3, 0x12f}) 21:20:05 executing program 3: r0 = io_uring_setup(0x355e, &(0x7f0000000000)={0x0, 0x0, 0x20, 0x1, 0x1be}) r1 = syz_io_uring_setup(0x8fe, &(0x7f0000000080)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, r0}, &(0x7f0000ffb000/0x2000)=nil, &(0x7f0000ffb000/0x4000)=nil, &(0x7f0000000100), &(0x7f0000000140)=0x0) r3 = openat$hwrng(0xffffffffffffff9c, &(0x7f0000000180), 0x2, 0x0) syz_genetlink_get_family_id$mptcp(&(0x7f0000000300), r3) r4 = openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000500)='./cgroup/syz1\x00', 0x200002, 0x0) syz_io_uring_submit(0x0, r2, &(0x7f0000000580)=@IORING_OP_FILES_UPDATE={0x14, 0x4, 0x0, 0x0, 0x40, &(0x7f0000000540)=[0xffffffffffffffff, 0xffffffffffffffff, r4, r0, r1], 0x5}, 0x3) io_uring_setup(0x2812, &(0x7f00000005c0)={0x0, 0x5e1b, 0x2, 0x3, 0x12f}) socket$inet6_tcp(0xa, 0x1, 0x0) io_uring_setup(0x7c8f, &(0x7f0000001140)={0x0, 0xc240, 0x10, 0x3, 0x1c7}) 21:20:05 executing program 2: r0 = syz_io_uring_setup(0x8fe, &(0x7f0000000080), &(0x7f0000ffb000/0x2000)=nil, &(0x7f0000ffb000/0x4000)=nil, 0x0, &(0x7f0000000140)=0x0) openat$hwrng(0xffffffffffffff9c, &(0x7f0000000180), 0x0, 0x0) r2 = openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000500)='./cgroup/syz1\x00', 0x200002, 0x0) syz_io_uring_submit(0x0, r1, &(0x7f0000000580)=@IORING_OP_FILES_UPDATE={0x14, 0x4, 0x0, 0x0, 0x40, &(0x7f0000000540)=[0xffffffffffffffff, 0xffffffffffffffff, r2, 0xffffffffffffffff, r0], 0x5}, 0x3) io_uring_setup(0x2812, &(0x7f00000005c0)={0x0, 0x5e1b, 0x2, 0x3, 0x12f}) 21:20:05 executing program 0: syz_io_uring_setup(0x8fe, &(0x7f0000000080), &(0x7f0000ffb000/0x2000)=nil, &(0x7f0000ffb000/0x4000)=nil, &(0x7f0000000100), &(0x7f0000000140)) openat$hwrng(0xffffffffffffff9c, &(0x7f0000000180), 0x2, 0x0) openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000500)='./cgroup/syz1\x00', 0x200002, 0x0) io_uring_setup(0x2812, &(0x7f00000005c0)={0x0, 0x0, 0x2}) 21:20:05 executing program 1: r0 = io_uring_setup(0x355e, &(0x7f0000000000)={0x0, 0x0, 0x20, 0x1, 0x1be}) r1 = openat$hwrng(0xffffffffffffff9c, &(0x7f0000000180), 0x2, 0x0) r2 = syz_io_uring_setup(0x65dd, &(0x7f00000001c0)={0x0, 0x0, 0x20, 0x2}, &(0x7f0000ffe000/0x1000)=nil, &(0x7f0000ffd000/0x1000)=nil, &(0x7f0000000240), &(0x7f0000000280)) syz_genetlink_get_family_id$mptcp(&(0x7f0000000300), r1) syz_io_uring_setup(0x20f8, &(0x7f0000000400)={0x0, 0x7677, 0x8, 0x3, 0x22f, 0x0, r2}, &(0x7f0000ffe000/0x2000)=nil, &(0x7f0000ffb000/0x2000)=nil, &(0x7f0000000480)=0x0, &(0x7f00000004c0)) r4 = openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000500)='./cgroup/syz1\x00', 0x200002, 0x0) syz_io_uring_submit(r3, 0x0, &(0x7f0000000580)=@IORING_OP_FILES_UPDATE={0x14, 0x4, 0x0, 0x0, 0x40, &(0x7f0000000540)=[r2, 0xffffffffffffffff, r4, r0, 0xffffffffffffffff], 0x5}, 0x3) io_uring_setup(0x2812, &(0x7f00000005c0)={0x0, 0x5e1b, 0x2, 0x3, 0x12f, 0x0, r2}) socket$inet6_tcp(0xa, 0x1, 0x0) openat$procfs(0xffffffffffffff9c, &(0x7f00000010c0)='/proc/crypto\x00', 0x0, 0x0) io_uring_setup(0x7c8f, &(0x7f0000001140)={0x0, 0xc240, 0x10, 0x3, 0x1c7, 0x0, r2}) 21:20:05 executing program 7: r0 = io_uring_setup(0x355e, &(0x7f0000000000)={0x0, 0x0, 0x20, 0x1, 0x1be}) r1 = openat$hwrng(0xffffffffffffff9c, &(0x7f0000000180), 0x2, 0x0) r2 = syz_io_uring_setup(0x65dd, &(0x7f00000001c0)={0x0, 0x0, 0x0, 0x2, 0xdf}, &(0x7f0000ffe000/0x1000)=nil, &(0x7f0000ffd000/0x1000)=nil, &(0x7f0000000240), &(0x7f0000000280)) syz_genetlink_get_family_id$mptcp(&(0x7f0000000300), r1) syz_io_uring_setup(0x20f8, &(0x7f0000000400)={0x0, 0x7677, 0x8, 0x3, 0x22f, 0x0, r2}, &(0x7f0000ffe000/0x2000)=nil, &(0x7f0000ffb000/0x2000)=nil, &(0x7f0000000480)=0x0, &(0x7f00000004c0)) r4 = openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000500)='./cgroup/syz1\x00', 0x200002, 0x0) syz_io_uring_submit(r3, 0x0, &(0x7f0000000580)=@IORING_OP_FILES_UPDATE={0x14, 0x4, 0x0, 0x0, 0x40, &(0x7f0000000540)=[r2, 0xffffffffffffffff, r4, r0, 0xffffffffffffffff], 0x5}, 0x3) io_uring_setup(0x2812, &(0x7f00000005c0)={0x0, 0x5e1b, 0x2, 0x3, 0x12f, 0x0, r2}) 21:20:05 executing program 2: r0 = syz_io_uring_setup(0x8fe, &(0x7f0000000080), &(0x7f0000ffb000/0x2000)=nil, &(0x7f0000ffb000/0x4000)=nil, 0x0, &(0x7f0000000140)=0x0) openat$hwrng(0xffffffffffffff9c, &(0x7f0000000180), 0x0, 0x0) r2 = openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000500)='./cgroup/syz1\x00', 0x200002, 0x0) syz_io_uring_submit(0x0, r1, &(0x7f0000000580)=@IORING_OP_FILES_UPDATE={0x14, 0x4, 0x0, 0x0, 0x40, &(0x7f0000000540)=[0xffffffffffffffff, 0xffffffffffffffff, r2, 0xffffffffffffffff, r0], 0x5}, 0x3) io_uring_setup(0x2812, &(0x7f00000005c0)={0x0, 0x5e1b, 0x2, 0x3, 0x12f}) 21:20:05 executing program 5: r0 = io_uring_setup(0x355e, &(0x7f0000000000)={0x0, 0x0, 0x20, 0x0, 0x1be}) r1 = syz_io_uring_setup(0x0, &(0x7f0000000080)={0x0, 0x1830, 0x0, 0x0, 0x1b8, 0x0, r0}, &(0x7f0000ffb000/0x2000)=nil, &(0x7f0000ffb000/0x4000)=nil, &(0x7f0000000100), &(0x7f0000000140)=0x0) r3 = openat$hwrng(0xffffffffffffff9c, &(0x7f0000000180), 0x2, 0x0) r4 = syz_io_uring_setup(0x65dd, &(0x7f00000001c0)={0x0, 0xf46f, 0x20, 0x2, 0xdf}, &(0x7f0000ffe000/0x1000)=nil, &(0x7f0000ffd000/0x1000)=nil, &(0x7f0000000240), &(0x7f0000000280)) r5 = syz_genetlink_get_family_id$mptcp(&(0x7f0000000300), r3) sendmsg$MPTCP_PM_CMD_ADD_ADDR(r3, &(0x7f00000003c0)={&(0x7f00000002c0)={0x10, 0x0, 0x0, 0x10}, 0xc, &(0x7f0000000380)={&(0x7f0000000340)={0x24, r5, 0x300, 0x70bd26, 0x25dfdbfb, {}, [@MPTCP_PM_ATTR_SUBFLOWS={0x8, 0x3, 0x1}, @MPTCP_PM_ATTR_RCV_ADD_ADDRS={0x8, 0x2, 0x2}]}, 0x24}, 0x1, 0x0, 0x0, 0x20000004}, 0x8890) r6 = openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000500)='./cgroup/syz1\x00', 0x200002, 0x0) syz_io_uring_submit(0x0, r2, &(0x7f0000000580)=@IORING_OP_FILES_UPDATE={0x14, 0x4, 0x0, 0x0, 0x40, &(0x7f0000000540)=[r4, 0xffffffffffffffff, r6, r0, r1], 0x5}, 0x3) socket$inet6_tcp(0xa, 0x1, 0x0) openat$procfs(0xffffffffffffff9c, &(0x7f00000010c0)='/proc/crypto\x00', 0x0, 0x0) 21:20:05 executing program 6: r0 = io_uring_setup(0x355e, &(0x7f0000000000)={0x0, 0x0, 0x20, 0x0, 0x1be}) r1 = syz_io_uring_setup(0x8fe, &(0x7f0000000080)={0x0, 0x1830}, &(0x7f0000ffb000/0x2000)=nil, &(0x7f0000ffb000/0x4000)=nil, &(0x7f0000000100), &(0x7f0000000140)=0x0) r3 = openat$hwrng(0xffffffffffffff9c, &(0x7f0000000180), 0x2, 0x0) r4 = syz_genetlink_get_family_id$mptcp(&(0x7f0000000300), r3) sendmsg$MPTCP_PM_CMD_ADD_ADDR(r3, &(0x7f00000003c0)={&(0x7f00000002c0)={0x10, 0x0, 0x0, 0x10}, 0xc, &(0x7f0000000380)={&(0x7f0000000340)={0x24, r4, 0x300, 0x70bd26, 0x25dfdbfb, {}, [@MPTCP_PM_ATTR_SUBFLOWS={0x8, 0x3, 0x1}, @MPTCP_PM_ATTR_RCV_ADD_ADDRS={0x8, 0x2, 0x2}]}, 0x24}, 0x1, 0x0, 0x0, 0x20000004}, 0x8890) syz_io_uring_setup(0x20f8, &(0x7f0000000400)={0x0, 0x7677, 0x8, 0x3, 0x22f}, &(0x7f0000ffe000/0x2000)=nil, &(0x7f0000ffb000/0x2000)=nil, &(0x7f0000000480)=0x0, &(0x7f00000004c0)) r6 = openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000500)='./cgroup/syz1\x00', 0x200002, 0x0) syz_io_uring_submit(r5, r2, &(0x7f0000000580)=@IORING_OP_FILES_UPDATE={0x14, 0x4, 0x0, 0x0, 0x40, &(0x7f0000000540)=[0xffffffffffffffff, 0xffffffffffffffff, r6, r0, r1], 0x5}, 0x3) socket$inet6_tcp(0xa, 0x1, 0x0) openat$procfs(0xffffffffffffff9c, &(0x7f00000010c0)='/proc/crypto\x00', 0x0, 0x0) io_uring_setup(0x7c8f, &(0x7f0000001140)={0x0, 0xc240, 0x10, 0x3, 0x1c7}) 21:20:14 executing program 7: r0 = io_uring_setup(0x355e, &(0x7f0000000000)={0x0, 0x0, 0x20, 0x1, 0x1be}) r1 = openat$hwrng(0xffffffffffffff9c, &(0x7f0000000180), 0x2, 0x0) r2 = syz_io_uring_setup(0x65dd, &(0x7f00000001c0)={0x0, 0x0, 0x0, 0x2, 0xdf}, &(0x7f0000ffe000/0x1000)=nil, &(0x7f0000ffd000/0x1000)=nil, &(0x7f0000000240), &(0x7f0000000280)) syz_genetlink_get_family_id$mptcp(&(0x7f0000000300), r1) syz_io_uring_setup(0x20f8, &(0x7f0000000400)={0x0, 0x7677, 0x8, 0x3, 0x22f, 0x0, r2}, &(0x7f0000ffe000/0x2000)=nil, &(0x7f0000ffb000/0x2000)=nil, &(0x7f0000000480)=0x0, &(0x7f00000004c0)) r4 = openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000500)='./cgroup/syz1\x00', 0x200002, 0x0) syz_io_uring_submit(r3, 0x0, &(0x7f0000000580)=@IORING_OP_FILES_UPDATE={0x14, 0x4, 0x0, 0x0, 0x40, &(0x7f0000000540)=[r2, 0xffffffffffffffff, r4, r0, 0xffffffffffffffff], 0x5}, 0x3) io_uring_setup(0x2812, &(0x7f00000005c0)={0x0, 0x5e1b, 0x2, 0x3, 0x12f, 0x0, r2}) 21:20:14 executing program 6: r0 = io_uring_setup(0x355e, &(0x7f0000000000)={0x0, 0x0, 0x20, 0x0, 0x1be}) r1 = syz_io_uring_setup(0x8fe, &(0x7f0000000080)={0x0, 0x1830}, &(0x7f0000ffb000/0x2000)=nil, &(0x7f0000ffb000/0x4000)=nil, &(0x7f0000000100), &(0x7f0000000140)=0x0) r3 = openat$hwrng(0xffffffffffffff9c, &(0x7f0000000180), 0x2, 0x0) r4 = syz_genetlink_get_family_id$mptcp(&(0x7f0000000300), r3) sendmsg$MPTCP_PM_CMD_ADD_ADDR(r3, &(0x7f00000003c0)={&(0x7f00000002c0)={0x10, 0x0, 0x0, 0x10}, 0xc, &(0x7f0000000380)={&(0x7f0000000340)={0x24, r4, 0x300, 0x70bd26, 0x25dfdbfb, {}, [@MPTCP_PM_ATTR_SUBFLOWS={0x8, 0x3, 0x1}, @MPTCP_PM_ATTR_RCV_ADD_ADDRS={0x8, 0x2, 0x2}]}, 0x24}, 0x1, 0x0, 0x0, 0x20000004}, 0x8890) syz_io_uring_setup(0x20f8, &(0x7f0000000400)={0x0, 0x7677, 0x8, 0x3, 0x22f}, &(0x7f0000ffe000/0x2000)=nil, &(0x7f0000ffb000/0x2000)=nil, &(0x7f0000000480)=0x0, &(0x7f00000004c0)) r6 = openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000500)='./cgroup/syz1\x00', 0x200002, 0x0) syz_io_uring_submit(r5, r2, &(0x7f0000000580)=@IORING_OP_FILES_UPDATE={0x14, 0x4, 0x0, 0x0, 0x40, &(0x7f0000000540)=[0xffffffffffffffff, 0xffffffffffffffff, r6, r0, r1], 0x5}, 0x3) socket$inet6_tcp(0xa, 0x1, 0x0) openat$procfs(0xffffffffffffff9c, &(0x7f00000010c0)='/proc/crypto\x00', 0x0, 0x0) io_uring_setup(0x7c8f, &(0x7f0000001140)={0x0, 0xc240, 0x10, 0x3, 0x1c7}) 21:20:14 executing program 5: r0 = io_uring_setup(0x355e, &(0x7f0000000000)={0x0, 0x0, 0x20, 0x0, 0x1be}) r1 = syz_io_uring_setup(0x8fe, 0x0, &(0x7f0000ffb000/0x2000)=nil, &(0x7f0000ffb000/0x4000)=nil, &(0x7f0000000100), &(0x7f0000000140)=0x0) r3 = openat$hwrng(0xffffffffffffff9c, &(0x7f0000000180), 0x2, 0x0) r4 = syz_io_uring_setup(0x65dd, &(0x7f00000001c0)={0x0, 0xf46f, 0x20, 0x2, 0xdf}, &(0x7f0000ffe000/0x1000)=nil, &(0x7f0000ffd000/0x1000)=nil, &(0x7f0000000240), &(0x7f0000000280)) r5 = syz_genetlink_get_family_id$mptcp(&(0x7f0000000300), r3) sendmsg$MPTCP_PM_CMD_ADD_ADDR(r3, &(0x7f00000003c0)={&(0x7f00000002c0)={0x10, 0x0, 0x0, 0x10}, 0xc, &(0x7f0000000380)={&(0x7f0000000340)={0x24, r5, 0x300, 0x70bd26, 0x25dfdbfb, {}, [@MPTCP_PM_ATTR_SUBFLOWS={0x8, 0x3, 0x1}, @MPTCP_PM_ATTR_RCV_ADD_ADDRS={0x8, 0x2, 0x2}]}, 0x24}, 0x1, 0x0, 0x0, 0x20000004}, 0x8890) r6 = openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000500)='./cgroup/syz1\x00', 0x200002, 0x0) syz_io_uring_submit(0x0, r2, &(0x7f0000000580)=@IORING_OP_FILES_UPDATE={0x14, 0x4, 0x0, 0x0, 0x40, &(0x7f0000000540)=[r4, 0xffffffffffffffff, r6, r0, r1], 0x5}, 0x3) socket$inet6_tcp(0xa, 0x1, 0x0) openat$procfs(0xffffffffffffff9c, &(0x7f00000010c0)='/proc/crypto\x00', 0x0, 0x0) 21:20:14 executing program 4: ioctl$SCSI_IOCTL_DOORUNLOCK(0xffffffffffffffff, 0x5381) r0 = syz_open_dev$mouse(&(0x7f0000000000), 0x578, 0x4000) ioctl$SG_GET_PACK_ID(r0, 0x227c, &(0x7f0000000040)) syz_genetlink_get_family_id$nl80211(&(0x7f00000000c0), 0xffffffffffffffff) syz_open_dev$vcsa(&(0x7f0000000440), 0x0, 0x4000) socketpair(0x0, 0x3, 0x6, &(0x7f0000000640)) r1 = openat$tcp_congestion(0xffffffffffffff9c, &(0x7f0000000800), 0x1, 0x0) write$tcp_congestion(r1, &(0x7f0000000840)='htcp\x00', 0x5) 21:20:14 executing program 0: syz_io_uring_setup(0x8fe, &(0x7f0000000080), &(0x7f0000ffb000/0x2000)=nil, &(0x7f0000ffb000/0x4000)=nil, &(0x7f0000000100), &(0x7f0000000140)) openat$hwrng(0xffffffffffffff9c, &(0x7f0000000180), 0x2, 0x0) syz_io_uring_submit(0x0, 0x0, 0x0, 0x0) io_uring_setup(0x2812, &(0x7f00000005c0)={0x0, 0x0, 0x2}) 21:20:14 executing program 2: r0 = syz_io_uring_setup(0x8fe, &(0x7f0000000080), &(0x7f0000ffb000/0x2000)=nil, &(0x7f0000ffb000/0x4000)=nil, 0x0, &(0x7f0000000140)=0x0) openat$hwrng(0xffffffffffffff9c, &(0x7f0000000180), 0x0, 0x0) r2 = openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000500)='./cgroup/syz1\x00', 0x200002, 0x0) syz_io_uring_submit(0x0, r1, &(0x7f0000000580)=@IORING_OP_FILES_UPDATE={0x14, 0x4, 0x0, 0x0, 0x40, &(0x7f0000000540)=[0xffffffffffffffff, 0xffffffffffffffff, r2, 0xffffffffffffffff, r0], 0x5}, 0x3) io_uring_setup(0x2812, &(0x7f00000005c0)={0x0, 0x5e1b, 0x2, 0x3, 0x12f}) 21:20:14 executing program 1: r0 = io_uring_setup(0x355e, &(0x7f0000000000)={0x0, 0x0, 0x20, 0x1, 0x1be}) r1 = openat$hwrng(0xffffffffffffff9c, &(0x7f0000000180), 0x2, 0x0) r2 = syz_io_uring_setup(0x65dd, &(0x7f00000001c0)={0x0, 0x0, 0x20, 0x2}, &(0x7f0000ffe000/0x1000)=nil, &(0x7f0000ffd000/0x1000)=nil, 0x0, &(0x7f0000000280)) syz_genetlink_get_family_id$mptcp(&(0x7f0000000300), r1) syz_io_uring_setup(0x20f8, &(0x7f0000000400)={0x0, 0x7677, 0x8, 0x3, 0x22f, 0x0, r2}, &(0x7f0000ffe000/0x2000)=nil, &(0x7f0000ffb000/0x2000)=nil, &(0x7f0000000480)=0x0, &(0x7f00000004c0)) r4 = openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000500)='./cgroup/syz1\x00', 0x200002, 0x0) syz_io_uring_submit(r3, 0x0, &(0x7f0000000580)=@IORING_OP_FILES_UPDATE={0x14, 0x4, 0x0, 0x0, 0x40, &(0x7f0000000540)=[r2, 0xffffffffffffffff, r4, r0, 0xffffffffffffffff], 0x5}, 0x3) io_uring_setup(0x2812, &(0x7f00000005c0)={0x0, 0x5e1b, 0x2, 0x3, 0x12f, 0x0, r2}) socket$inet6_tcp(0xa, 0x1, 0x0) openat$procfs(0xffffffffffffff9c, &(0x7f00000010c0)='/proc/crypto\x00', 0x0, 0x0) io_uring_setup(0x7c8f, &(0x7f0000001140)={0x0, 0xc240, 0x10, 0x3, 0x1c7, 0x0, r2}) 21:20:14 executing program 3: r0 = io_uring_setup(0x355e, &(0x7f0000000000)={0x0, 0x0, 0x20, 0x1, 0x1be}) r1 = syz_io_uring_setup(0x8fe, &(0x7f0000000080)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, r0}, &(0x7f0000ffb000/0x2000)=nil, &(0x7f0000ffb000/0x4000)=nil, &(0x7f0000000100), &(0x7f0000000140)=0x0) r3 = openat$hwrng(0xffffffffffffff9c, &(0x7f0000000180), 0x2, 0x0) syz_genetlink_get_family_id$mptcp(&(0x7f0000000300), r3) r4 = openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000500)='./cgroup/syz1\x00', 0x200002, 0x0) syz_io_uring_submit(0x0, r2, &(0x7f0000000580)=@IORING_OP_FILES_UPDATE={0x14, 0x4, 0x0, 0x0, 0x40, &(0x7f0000000540)=[0xffffffffffffffff, 0xffffffffffffffff, r4, r0, r1], 0x5}, 0x3) io_uring_setup(0x2812, &(0x7f00000005c0)={0x0, 0x5e1b, 0x2, 0x3, 0x12f}) socket$inet6_tcp(0xa, 0x1, 0x0) io_uring_setup(0x7c8f, &(0x7f0000001140)={0x0, 0xc240, 0x10, 0x3, 0x1c7}) 21:20:14 executing program 0: syz_io_uring_setup(0x8fe, &(0x7f0000000080), &(0x7f0000ffb000/0x2000)=nil, &(0x7f0000ffb000/0x4000)=nil, &(0x7f0000000100), &(0x7f0000000140)) openat$hwrng(0xffffffffffffff9c, &(0x7f0000000180), 0x2, 0x0) syz_io_uring_submit(0x0, 0x0, 0x0, 0x0) io_uring_setup(0x2812, &(0x7f00000005c0)={0x0, 0x0, 0x2}) 21:20:14 executing program 1: r0 = io_uring_setup(0x355e, &(0x7f0000000000)={0x0, 0x0, 0x20, 0x1, 0x1be}) r1 = openat$hwrng(0xffffffffffffff9c, &(0x7f0000000180), 0x2, 0x0) r2 = syz_io_uring_setup(0x65dd, &(0x7f00000001c0)={0x0, 0x0, 0x20, 0x2}, &(0x7f0000ffe000/0x1000)=nil, &(0x7f0000ffd000/0x1000)=nil, 0x0, &(0x7f0000000280)) syz_genetlink_get_family_id$mptcp(&(0x7f0000000300), r1) syz_io_uring_setup(0x20f8, &(0x7f0000000400)={0x0, 0x7677, 0x8, 0x3, 0x22f, 0x0, r2}, &(0x7f0000ffe000/0x2000)=nil, &(0x7f0000ffb000/0x2000)=nil, &(0x7f0000000480)=0x0, &(0x7f00000004c0)) r4 = openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000500)='./cgroup/syz1\x00', 0x200002, 0x0) syz_io_uring_submit(r3, 0x0, &(0x7f0000000580)=@IORING_OP_FILES_UPDATE={0x14, 0x4, 0x0, 0x0, 0x40, &(0x7f0000000540)=[r2, 0xffffffffffffffff, r4, r0, 0xffffffffffffffff], 0x5}, 0x3) io_uring_setup(0x2812, &(0x7f00000005c0)={0x0, 0x5e1b, 0x2, 0x3, 0x12f, 0x0, r2}) socket$inet6_tcp(0xa, 0x1, 0x0) openat$procfs(0xffffffffffffff9c, &(0x7f00000010c0)='/proc/crypto\x00', 0x0, 0x0) io_uring_setup(0x7c8f, &(0x7f0000001140)={0x0, 0xc240, 0x10, 0x3, 0x1c7, 0x0, r2}) 21:20:14 executing program 2: r0 = syz_io_uring_setup(0x8fe, &(0x7f0000000080), &(0x7f0000ffb000/0x2000)=nil, &(0x7f0000ffb000/0x4000)=nil, &(0x7f0000000100), 0x0) openat$hwrng(0xffffffffffffff9c, &(0x7f0000000180), 0x0, 0x0) r1 = openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000500)='./cgroup/syz1\x00', 0x200002, 0x0) syz_io_uring_submit(0x0, 0x0, &(0x7f0000000580)=@IORING_OP_FILES_UPDATE={0x14, 0x4, 0x0, 0x0, 0x40, &(0x7f0000000540)=[0xffffffffffffffff, 0xffffffffffffffff, r1, 0xffffffffffffffff, r0], 0x5}, 0x3) io_uring_setup(0x2812, &(0x7f00000005c0)={0x0, 0x5e1b, 0x2, 0x3, 0x12f}) 21:20:14 executing program 6: r0 = io_uring_setup(0x355e, &(0x7f0000000000)={0x0, 0x0, 0x20, 0x0, 0x1be}) r1 = syz_io_uring_setup(0x8fe, &(0x7f0000000080)={0x0, 0x1830, 0x0, 0x0, 0x0, 0x0, r0}, &(0x7f0000ffb000/0x2000)=nil, &(0x7f0000ffb000/0x4000)=nil, 0x0, &(0x7f0000000140)=0x0) r3 = openat$hwrng(0xffffffffffffff9c, &(0x7f0000000180), 0x2, 0x0) r4 = syz_genetlink_get_family_id$mptcp(&(0x7f0000000300), r3) sendmsg$MPTCP_PM_CMD_ADD_ADDR(r3, &(0x7f00000003c0)={&(0x7f00000002c0)={0x10, 0x0, 0x0, 0x10}, 0xc, &(0x7f0000000380)={&(0x7f0000000340)={0x24, r4, 0x300, 0x70bd26, 0x25dfdbfb, {}, [@MPTCP_PM_ATTR_SUBFLOWS={0x8, 0x3, 0x1}, @MPTCP_PM_ATTR_RCV_ADD_ADDRS={0x8, 0x2, 0x2}]}, 0x24}, 0x1, 0x0, 0x0, 0x20000004}, 0x8890) syz_io_uring_setup(0x20f8, &(0x7f0000000400)={0x0, 0x7677, 0x8, 0x3, 0x22f}, &(0x7f0000ffe000/0x2000)=nil, &(0x7f0000ffb000/0x2000)=nil, &(0x7f0000000480)=0x0, &(0x7f00000004c0)) r6 = openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000500)='./cgroup/syz1\x00', 0x200002, 0x0) syz_io_uring_submit(r5, r2, &(0x7f0000000580)=@IORING_OP_FILES_UPDATE={0x14, 0x4, 0x0, 0x0, 0x40, &(0x7f0000000540)=[0xffffffffffffffff, 0xffffffffffffffff, r6, r0, r1], 0x5}, 0x3) socket$inet6_tcp(0xa, 0x1, 0x0) openat$procfs(0xffffffffffffff9c, &(0x7f00000010c0)='/proc/crypto\x00', 0x0, 0x0) io_uring_setup(0x7c8f, &(0x7f0000001140)={0x0, 0xc240, 0x10, 0x3, 0x1c7}) 21:20:14 executing program 5: r0 = io_uring_setup(0x355e, &(0x7f0000000000)={0x0, 0x0, 0x20, 0x0, 0x1be}) r1 = syz_io_uring_setup(0x8fe, 0x0, &(0x7f0000ffb000/0x2000)=nil, &(0x7f0000ffb000/0x4000)=nil, &(0x7f0000000100), &(0x7f0000000140)=0x0) r3 = openat$hwrng(0xffffffffffffff9c, &(0x7f0000000180), 0x2, 0x0) r4 = syz_io_uring_setup(0x65dd, &(0x7f00000001c0)={0x0, 0xf46f, 0x20, 0x2, 0xdf}, &(0x7f0000ffe000/0x1000)=nil, &(0x7f0000ffd000/0x1000)=nil, &(0x7f0000000240), &(0x7f0000000280)) r5 = syz_genetlink_get_family_id$mptcp(&(0x7f0000000300), r3) sendmsg$MPTCP_PM_CMD_ADD_ADDR(r3, &(0x7f00000003c0)={&(0x7f00000002c0)={0x10, 0x0, 0x0, 0x10}, 0xc, &(0x7f0000000380)={&(0x7f0000000340)={0x24, r5, 0x300, 0x70bd26, 0x25dfdbfb, {}, [@MPTCP_PM_ATTR_SUBFLOWS={0x8, 0x3, 0x1}, @MPTCP_PM_ATTR_RCV_ADD_ADDRS={0x8, 0x2, 0x2}]}, 0x24}, 0x1, 0x0, 0x0, 0x20000004}, 0x8890) r6 = openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000500)='./cgroup/syz1\x00', 0x200002, 0x0) syz_io_uring_submit(0x0, r2, &(0x7f0000000580)=@IORING_OP_FILES_UPDATE={0x14, 0x4, 0x0, 0x0, 0x40, &(0x7f0000000540)=[r4, 0xffffffffffffffff, r6, r0, r1], 0x5}, 0x3) socket$inet6_tcp(0xa, 0x1, 0x0) openat$procfs(0xffffffffffffff9c, &(0x7f00000010c0)='/proc/crypto\x00', 0x0, 0x0) 21:20:23 executing program 0: syz_io_uring_setup(0x8fe, &(0x7f0000000080), &(0x7f0000ffb000/0x2000)=nil, &(0x7f0000ffb000/0x4000)=nil, &(0x7f0000000100), &(0x7f0000000140)) openat$hwrng(0xffffffffffffff9c, &(0x7f0000000180), 0x2, 0x0) syz_io_uring_submit(0x0, 0x0, 0x0, 0x0) io_uring_setup(0x2812, &(0x7f00000005c0)={0x0, 0x0, 0x2}) 21:20:23 executing program 6: r0 = io_uring_setup(0x355e, &(0x7f0000000000)={0x0, 0x0, 0x20, 0x0, 0x1be}) r1 = syz_io_uring_setup(0x8fe, &(0x7f0000000080)={0x0, 0x1830, 0x0, 0x0, 0x0, 0x0, r0}, &(0x7f0000ffb000/0x2000)=nil, &(0x7f0000ffb000/0x4000)=nil, 0x0, &(0x7f0000000140)=0x0) r3 = openat$hwrng(0xffffffffffffff9c, &(0x7f0000000180), 0x2, 0x0) r4 = syz_genetlink_get_family_id$mptcp(&(0x7f0000000300), r3) sendmsg$MPTCP_PM_CMD_ADD_ADDR(r3, &(0x7f00000003c0)={&(0x7f00000002c0)={0x10, 0x0, 0x0, 0x10}, 0xc, &(0x7f0000000380)={&(0x7f0000000340)={0x24, r4, 0x300, 0x70bd26, 0x25dfdbfb, {}, [@MPTCP_PM_ATTR_SUBFLOWS={0x8, 0x3, 0x1}, @MPTCP_PM_ATTR_RCV_ADD_ADDRS={0x8, 0x2, 0x2}]}, 0x24}, 0x1, 0x0, 0x0, 0x20000004}, 0x8890) syz_io_uring_setup(0x20f8, &(0x7f0000000400)={0x0, 0x7677, 0x8, 0x3, 0x22f}, &(0x7f0000ffe000/0x2000)=nil, &(0x7f0000ffb000/0x2000)=nil, &(0x7f0000000480)=0x0, &(0x7f00000004c0)) r6 = openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000500)='./cgroup/syz1\x00', 0x200002, 0x0) syz_io_uring_submit(r5, r2, &(0x7f0000000580)=@IORING_OP_FILES_UPDATE={0x14, 0x4, 0x0, 0x0, 0x40, &(0x7f0000000540)=[0xffffffffffffffff, 0xffffffffffffffff, r6, r0, r1], 0x5}, 0x3) socket$inet6_tcp(0xa, 0x1, 0x0) openat$procfs(0xffffffffffffff9c, &(0x7f00000010c0)='/proc/crypto\x00', 0x0, 0x0) io_uring_setup(0x7c8f, &(0x7f0000001140)={0x0, 0xc240, 0x10, 0x3, 0x1c7}) 21:20:23 executing program 5: r0 = io_uring_setup(0x355e, &(0x7f0000000000)={0x0, 0x0, 0x20, 0x0, 0x1be}) r1 = syz_io_uring_setup(0x8fe, 0x0, &(0x7f0000ffb000/0x2000)=nil, &(0x7f0000ffb000/0x4000)=nil, &(0x7f0000000100), &(0x7f0000000140)=0x0) r3 = openat$hwrng(0xffffffffffffff9c, &(0x7f0000000180), 0x2, 0x0) r4 = syz_io_uring_setup(0x65dd, &(0x7f00000001c0)={0x0, 0xf46f, 0x20, 0x2, 0xdf}, &(0x7f0000ffe000/0x1000)=nil, &(0x7f0000ffd000/0x1000)=nil, &(0x7f0000000240), &(0x7f0000000280)) r5 = syz_genetlink_get_family_id$mptcp(&(0x7f0000000300), r3) sendmsg$MPTCP_PM_CMD_ADD_ADDR(r3, &(0x7f00000003c0)={&(0x7f00000002c0)={0x10, 0x0, 0x0, 0x10}, 0xc, &(0x7f0000000380)={&(0x7f0000000340)={0x24, r5, 0x300, 0x70bd26, 0x25dfdbfb, {}, [@MPTCP_PM_ATTR_SUBFLOWS={0x8, 0x3, 0x1}, @MPTCP_PM_ATTR_RCV_ADD_ADDRS={0x8, 0x2, 0x2}]}, 0x24}, 0x1, 0x0, 0x0, 0x20000004}, 0x8890) r6 = openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000500)='./cgroup/syz1\x00', 0x200002, 0x0) syz_io_uring_submit(0x0, r2, &(0x7f0000000580)=@IORING_OP_FILES_UPDATE={0x14, 0x4, 0x0, 0x0, 0x40, &(0x7f0000000540)=[r4, 0xffffffffffffffff, r6, r0, r1], 0x5}, 0x3) socket$inet6_tcp(0xa, 0x1, 0x0) openat$procfs(0xffffffffffffff9c, &(0x7f00000010c0)='/proc/crypto\x00', 0x0, 0x0) 21:20:23 executing program 2: r0 = syz_io_uring_setup(0x8fe, &(0x7f0000000080), &(0x7f0000ffb000/0x2000)=nil, &(0x7f0000ffb000/0x4000)=nil, &(0x7f0000000100), 0x0) openat$hwrng(0xffffffffffffff9c, &(0x7f0000000180), 0x0, 0x0) r1 = openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000500)='./cgroup/syz1\x00', 0x200002, 0x0) syz_io_uring_submit(0x0, 0x0, &(0x7f0000000580)=@IORING_OP_FILES_UPDATE={0x14, 0x4, 0x0, 0x0, 0x40, &(0x7f0000000540)=[0xffffffffffffffff, 0xffffffffffffffff, r1, 0xffffffffffffffff, r0], 0x5}, 0x3) io_uring_setup(0x2812, &(0x7f00000005c0)={0x0, 0x5e1b, 0x2, 0x3, 0x12f}) 21:20:23 executing program 7: r0 = io_uring_setup(0x355e, &(0x7f0000000000)={0x0, 0x0, 0x20, 0x1, 0x1be}) r1 = openat$hwrng(0xffffffffffffff9c, &(0x7f0000000180), 0x2, 0x0) r2 = syz_io_uring_setup(0x65dd, &(0x7f00000001c0)={0x0, 0x0, 0x0, 0x2, 0xdf}, &(0x7f0000ffe000/0x1000)=nil, &(0x7f0000ffd000/0x1000)=nil, &(0x7f0000000240), &(0x7f0000000280)) syz_genetlink_get_family_id$mptcp(&(0x7f0000000300), r1) syz_io_uring_setup(0x20f8, &(0x7f0000000400)={0x0, 0x7677, 0x8, 0x3, 0x22f, 0x0, r2}, &(0x7f0000ffe000/0x2000)=nil, &(0x7f0000ffb000/0x2000)=nil, &(0x7f0000000480)=0x0, &(0x7f00000004c0)) r4 = openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000500)='./cgroup/syz1\x00', 0x200002, 0x0) syz_io_uring_submit(r3, 0x0, &(0x7f0000000580)=@IORING_OP_FILES_UPDATE={0x14, 0x4, 0x0, 0x0, 0x40, &(0x7f0000000540)=[r2, 0xffffffffffffffff, r4, r0, 0xffffffffffffffff], 0x5}, 0x3) io_uring_setup(0x2812, &(0x7f00000005c0)={0x0, 0x5e1b, 0x2, 0x3, 0x12f, 0x0, r2}) 21:20:23 executing program 1: r0 = io_uring_setup(0x355e, &(0x7f0000000000)={0x0, 0x0, 0x20, 0x1, 0x1be}) r1 = openat$hwrng(0xffffffffffffff9c, &(0x7f0000000180), 0x2, 0x0) r2 = syz_io_uring_setup(0x65dd, &(0x7f00000001c0)={0x0, 0x0, 0x20, 0x2}, &(0x7f0000ffe000/0x1000)=nil, &(0x7f0000ffd000/0x1000)=nil, 0x0, &(0x7f0000000280)) syz_genetlink_get_family_id$mptcp(&(0x7f0000000300), r1) syz_io_uring_setup(0x20f8, &(0x7f0000000400)={0x0, 0x7677, 0x8, 0x3, 0x22f, 0x0, r2}, &(0x7f0000ffe000/0x2000)=nil, &(0x7f0000ffb000/0x2000)=nil, &(0x7f0000000480)=0x0, &(0x7f00000004c0)) r4 = openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000500)='./cgroup/syz1\x00', 0x200002, 0x0) syz_io_uring_submit(r3, 0x0, &(0x7f0000000580)=@IORING_OP_FILES_UPDATE={0x14, 0x4, 0x0, 0x0, 0x40, &(0x7f0000000540)=[r2, 0xffffffffffffffff, r4, r0, 0xffffffffffffffff], 0x5}, 0x3) io_uring_setup(0x2812, &(0x7f00000005c0)={0x0, 0x5e1b, 0x2, 0x3, 0x12f, 0x0, r2}) socket$inet6_tcp(0xa, 0x1, 0x0) openat$procfs(0xffffffffffffff9c, &(0x7f00000010c0)='/proc/crypto\x00', 0x0, 0x0) io_uring_setup(0x7c8f, &(0x7f0000001140)={0x0, 0xc240, 0x10, 0x3, 0x1c7, 0x0, r2}) 21:20:23 executing program 3: r0 = io_uring_setup(0x355e, &(0x7f0000000000)={0x0, 0x0, 0x20, 0x1, 0x1be}) r1 = syz_io_uring_setup(0x8fe, &(0x7f0000000080), &(0x7f0000ffb000/0x2000)=nil, &(0x7f0000ffb000/0x4000)=nil, &(0x7f0000000100), &(0x7f0000000140)=0x0) r3 = openat$hwrng(0xffffffffffffff9c, &(0x7f0000000180), 0x2, 0x0) syz_genetlink_get_family_id$mptcp(&(0x7f0000000300), r3) r4 = openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000500)='./cgroup/syz1\x00', 0x200002, 0x0) syz_io_uring_submit(0x0, r2, &(0x7f0000000580)=@IORING_OP_FILES_UPDATE={0x14, 0x4, 0x0, 0x0, 0x40, &(0x7f0000000540)=[0xffffffffffffffff, 0xffffffffffffffff, r4, r0, r1], 0x5}, 0x3) io_uring_setup(0x2812, &(0x7f00000005c0)={0x0, 0x5e1b, 0x2, 0x3, 0x12f}) socket$inet6_tcp(0xa, 0x1, 0x0) io_uring_setup(0x7c8f, &(0x7f0000001140)={0x0, 0xc240, 0x10, 0x3, 0x1c7}) 21:20:23 executing program 4: ioctl$SCSI_IOCTL_DOORUNLOCK(0xffffffffffffffff, 0x5381) r0 = syz_open_dev$mouse(&(0x7f0000000000), 0x578, 0x4000) ioctl$SG_GET_PACK_ID(r0, 0x227c, &(0x7f0000000040)) syz_genetlink_get_family_id$nl80211(&(0x7f00000000c0), 0xffffffffffffffff) syz_open_dev$vcsa(&(0x7f0000000440), 0x0, 0x4000) socketpair(0x0, 0x3, 0x6, &(0x7f0000000640)) r1 = openat$tcp_congestion(0xffffffffffffff9c, &(0x7f0000000800), 0x1, 0x0) write$tcp_congestion(r1, &(0x7f0000000840)='htcp\x00', 0x5) 21:20:23 executing program 1: r0 = io_uring_setup(0x355e, &(0x7f0000000000)={0x0, 0x0, 0x20, 0x1, 0x1be}) r1 = openat$hwrng(0xffffffffffffff9c, &(0x7f0000000180), 0x2, 0x0) r2 = syz_io_uring_setup(0x65dd, &(0x7f00000001c0)={0x0, 0x0, 0x20, 0x2}, &(0x7f0000ffe000/0x1000)=nil, &(0x7f0000ffd000/0x1000)=nil, &(0x7f0000000240), 0x0) syz_genetlink_get_family_id$mptcp(&(0x7f0000000300), r1) syz_io_uring_setup(0x20f8, &(0x7f0000000400)={0x0, 0x7677, 0x8, 0x3, 0x22f, 0x0, r2}, &(0x7f0000ffe000/0x2000)=nil, &(0x7f0000ffb000/0x2000)=nil, &(0x7f0000000480)=0x0, &(0x7f00000004c0)) r4 = openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000500)='./cgroup/syz1\x00', 0x200002, 0x0) syz_io_uring_submit(r3, 0x0, &(0x7f0000000580)=@IORING_OP_FILES_UPDATE={0x14, 0x4, 0x0, 0x0, 0x40, &(0x7f0000000540)=[r2, 0xffffffffffffffff, r4, r0, 0xffffffffffffffff], 0x5}, 0x3) io_uring_setup(0x2812, &(0x7f00000005c0)={0x0, 0x5e1b, 0x2, 0x3, 0x12f, 0x0, r2}) socket$inet6_tcp(0xa, 0x1, 0x0) openat$procfs(0xffffffffffffff9c, &(0x7f00000010c0)='/proc/crypto\x00', 0x0, 0x0) io_uring_setup(0x7c8f, &(0x7f0000001140)={0x0, 0xc240, 0x10, 0x3, 0x1c7, 0x0, r2}) 21:20:23 executing program 4: ioctl$SCSI_IOCTL_DOORUNLOCK(0xffffffffffffffff, 0x5381) r0 = syz_open_dev$mouse(&(0x7f0000000000), 0x578, 0x4000) ioctl$SG_GET_PACK_ID(r0, 0x227c, &(0x7f0000000040)) syz_genetlink_get_family_id$nl80211(&(0x7f00000000c0), 0xffffffffffffffff) syz_open_dev$vcsa(&(0x7f0000000440), 0x0, 0x4000) socketpair(0x0, 0x3, 0x6, &(0x7f0000000640)) r1 = openat$tcp_congestion(0xffffffffffffff9c, &(0x7f0000000800), 0x1, 0x0) write$tcp_congestion(r1, &(0x7f0000000840)='htcp\x00', 0x5) 21:20:23 executing program 0: syz_io_uring_setup(0x8fe, &(0x7f0000000080), &(0x7f0000ffb000/0x2000)=nil, &(0x7f0000ffb000/0x4000)=nil, &(0x7f0000000100), &(0x7f0000000140)) openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000500)='./cgroup/syz1\x00', 0x200002, 0x0) syz_io_uring_submit(0x0, 0x0, 0x0, 0x0) io_uring_setup(0x2812, &(0x7f00000005c0)={0x0, 0x0, 0x2}) 21:20:23 executing program 2: r0 = syz_io_uring_setup(0x8fe, &(0x7f0000000080), &(0x7f0000ffb000/0x2000)=nil, &(0x7f0000ffb000/0x4000)=nil, &(0x7f0000000100), 0x0) openat$hwrng(0xffffffffffffff9c, &(0x7f0000000180), 0x0, 0x0) r1 = openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000500)='./cgroup/syz1\x00', 0x200002, 0x0) syz_io_uring_submit(0x0, 0x0, &(0x7f0000000580)=@IORING_OP_FILES_UPDATE={0x14, 0x4, 0x0, 0x0, 0x40, &(0x7f0000000540)=[0xffffffffffffffff, 0xffffffffffffffff, r1, 0xffffffffffffffff, r0], 0x5}, 0x3) io_uring_setup(0x2812, &(0x7f00000005c0)={0x0, 0x5e1b, 0x2, 0x3, 0x12f}) 21:20:23 executing program 7: r0 = io_uring_setup(0x355e, &(0x7f0000000000)={0x0, 0x0, 0x20, 0x1, 0x1be}) r1 = openat$hwrng(0xffffffffffffff9c, &(0x7f0000000180), 0x2, 0x0) r2 = syz_io_uring_setup(0x65dd, &(0x7f00000001c0)={0x0, 0x0, 0x0, 0x2, 0xdf}, &(0x7f0000ffe000/0x1000)=nil, &(0x7f0000ffd000/0x1000)=nil, &(0x7f0000000240), &(0x7f0000000280)) syz_genetlink_get_family_id$mptcp(&(0x7f0000000300), r1) syz_io_uring_setup(0x20f8, &(0x7f0000000400)={0x0, 0x7677, 0x8, 0x3, 0x22f, 0x0, r2}, &(0x7f0000ffe000/0x2000)=nil, &(0x7f0000ffb000/0x2000)=nil, &(0x7f0000000480)=0x0, &(0x7f00000004c0)) r4 = openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000500)='./cgroup/syz1\x00', 0x200002, 0x0) syz_io_uring_submit(r3, 0x0, &(0x7f0000000580)=@IORING_OP_FILES_UPDATE={0x14, 0x4, 0x0, 0x0, 0x40, &(0x7f0000000540)=[r2, 0xffffffffffffffff, r4, r0, 0xffffffffffffffff], 0x5}, 0x3) 21:20:32 executing program 5: r0 = io_uring_setup(0x355e, &(0x7f0000000000)={0x0, 0x0, 0x20, 0x0, 0x1be}) r1 = syz_io_uring_setup(0x8fe, &(0x7f0000000080)={0x0, 0x0, 0x0, 0x0, 0x1b8, 0x0, r0}, &(0x7f0000ffb000/0x2000)=nil, &(0x7f0000ffb000/0x4000)=nil, &(0x7f0000000100), &(0x7f0000000140)=0x0) r3 = openat$hwrng(0xffffffffffffff9c, &(0x7f0000000180), 0x2, 0x0) r4 = syz_io_uring_setup(0x65dd, &(0x7f00000001c0)={0x0, 0xf46f, 0x20, 0x2, 0xdf}, &(0x7f0000ffe000/0x1000)=nil, &(0x7f0000ffd000/0x1000)=nil, &(0x7f0000000240), &(0x7f0000000280)) r5 = syz_genetlink_get_family_id$mptcp(&(0x7f0000000300), r3) sendmsg$MPTCP_PM_CMD_ADD_ADDR(r3, &(0x7f00000003c0)={&(0x7f00000002c0)={0x10, 0x0, 0x0, 0x10}, 0xc, &(0x7f0000000380)={&(0x7f0000000340)={0x24, r5, 0x300, 0x70bd26, 0x25dfdbfb, {}, [@MPTCP_PM_ATTR_SUBFLOWS={0x8, 0x3, 0x1}, @MPTCP_PM_ATTR_RCV_ADD_ADDRS={0x8, 0x2, 0x2}]}, 0x24}, 0x1, 0x0, 0x0, 0x20000004}, 0x8890) r6 = openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000500)='./cgroup/syz1\x00', 0x200002, 0x0) syz_io_uring_submit(0x0, r2, &(0x7f0000000580)=@IORING_OP_FILES_UPDATE={0x14, 0x4, 0x0, 0x0, 0x40, &(0x7f0000000540)=[r4, 0xffffffffffffffff, r6, r0, r1], 0x5}, 0x3) socket$inet6_tcp(0xa, 0x1, 0x0) openat$procfs(0xffffffffffffff9c, &(0x7f00000010c0)='/proc/crypto\x00', 0x0, 0x0) 21:20:32 executing program 4: ioctl$SCSI_IOCTL_DOORUNLOCK(0xffffffffffffffff, 0x5381) r0 = syz_open_dev$mouse(&(0x7f0000000000), 0x578, 0x4000) ioctl$SG_GET_PACK_ID(r0, 0x227c, &(0x7f0000000040)) syz_genetlink_get_family_id$nl80211(&(0x7f00000000c0), 0xffffffffffffffff) syz_open_dev$vcsa(&(0x7f0000000440), 0x56, 0x0) socketpair(0x0, 0x3, 0x6, &(0x7f0000000640)) r1 = openat$tcp_congestion(0xffffffffffffff9c, &(0x7f0000000800), 0x1, 0x0) write$tcp_congestion(r1, &(0x7f0000000840)='htcp\x00', 0x5) 21:20:32 executing program 7: r0 = io_uring_setup(0x355e, &(0x7f0000000000)={0x0, 0x0, 0x20, 0x1, 0x1be}) r1 = openat$hwrng(0xffffffffffffff9c, &(0x7f0000000180), 0x2, 0x0) r2 = syz_io_uring_setup(0x65dd, &(0x7f00000001c0)={0x0, 0x0, 0x0, 0x2, 0xdf}, &(0x7f0000ffe000/0x1000)=nil, &(0x7f0000ffd000/0x1000)=nil, &(0x7f0000000240), &(0x7f0000000280)) syz_genetlink_get_family_id$mptcp(&(0x7f0000000300), r1) syz_io_uring_setup(0x20f8, &(0x7f0000000400)={0x0, 0x7677, 0x8, 0x3, 0x22f, 0x0, r2}, &(0x7f0000ffe000/0x2000)=nil, &(0x7f0000ffb000/0x2000)=nil, &(0x7f0000000480)=0x0, &(0x7f00000004c0)) r4 = openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000500)='./cgroup/syz1\x00', 0x200002, 0x0) syz_io_uring_submit(r3, 0x0, &(0x7f0000000580)=@IORING_OP_FILES_UPDATE={0x14, 0x4, 0x0, 0x0, 0x40, &(0x7f0000000540)=[r2, 0xffffffffffffffff, r4, r0, 0xffffffffffffffff], 0x5}, 0x3) 21:20:32 executing program 0: syz_io_uring_setup(0x8fe, &(0x7f0000000080), &(0x7f0000ffb000/0x2000)=nil, &(0x7f0000ffb000/0x4000)=nil, &(0x7f0000000100), &(0x7f0000000140)) openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000500)='./cgroup/syz1\x00', 0x200002, 0x0) syz_io_uring_submit(0x0, 0x0, 0x0, 0x0) io_uring_setup(0x2812, &(0x7f00000005c0)={0x0, 0x0, 0x2}) 21:20:32 executing program 1: r0 = io_uring_setup(0x355e, &(0x7f0000000000)={0x0, 0x0, 0x20, 0x1, 0x1be}) r1 = openat$hwrng(0xffffffffffffff9c, &(0x7f0000000180), 0x2, 0x0) r2 = syz_io_uring_setup(0x65dd, &(0x7f00000001c0)={0x0, 0x0, 0x20, 0x2}, &(0x7f0000ffe000/0x1000)=nil, &(0x7f0000ffd000/0x1000)=nil, &(0x7f0000000240), 0x0) syz_genetlink_get_family_id$mptcp(&(0x7f0000000300), r1) syz_io_uring_setup(0x20f8, &(0x7f0000000400)={0x0, 0x7677, 0x8, 0x3, 0x22f, 0x0, r2}, &(0x7f0000ffe000/0x2000)=nil, &(0x7f0000ffb000/0x2000)=nil, &(0x7f0000000480)=0x0, &(0x7f00000004c0)) r4 = openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000500)='./cgroup/syz1\x00', 0x200002, 0x0) syz_io_uring_submit(r3, 0x0, &(0x7f0000000580)=@IORING_OP_FILES_UPDATE={0x14, 0x4, 0x0, 0x0, 0x40, &(0x7f0000000540)=[r2, 0xffffffffffffffff, r4, r0, 0xffffffffffffffff], 0x5}, 0x3) io_uring_setup(0x2812, &(0x7f00000005c0)={0x0, 0x5e1b, 0x2, 0x3, 0x12f, 0x0, r2}) socket$inet6_tcp(0xa, 0x1, 0x0) openat$procfs(0xffffffffffffff9c, &(0x7f00000010c0)='/proc/crypto\x00', 0x0, 0x0) io_uring_setup(0x7c8f, &(0x7f0000001140)={0x0, 0xc240, 0x10, 0x3, 0x1c7, 0x0, r2}) 21:20:32 executing program 2: r0 = syz_io_uring_setup(0x8fe, &(0x7f0000000080), &(0x7f0000ffb000/0x2000)=nil, &(0x7f0000ffb000/0x4000)=nil, &(0x7f0000000100), &(0x7f0000000140)=0x0) openat$hwrng(0xffffffffffffff9c, 0x0, 0x0, 0x0) r2 = openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000500)='./cgroup/syz1\x00', 0x200002, 0x0) syz_io_uring_submit(0x0, r1, &(0x7f0000000580)=@IORING_OP_FILES_UPDATE={0x14, 0x4, 0x0, 0x0, 0x40, &(0x7f0000000540)=[0xffffffffffffffff, 0xffffffffffffffff, r2, 0xffffffffffffffff, r0], 0x5}, 0x3) io_uring_setup(0x2812, &(0x7f00000005c0)={0x0, 0x5e1b, 0x2, 0x3, 0x12f}) 21:20:32 executing program 3: r0 = io_uring_setup(0x355e, &(0x7f0000000000)={0x0, 0x0, 0x20, 0x1, 0x1be}) r1 = syz_io_uring_setup(0x8fe, &(0x7f0000000080), &(0x7f0000ffb000/0x2000)=nil, &(0x7f0000ffb000/0x4000)=nil, 0x0, &(0x7f0000000140)=0x0) r3 = openat$hwrng(0xffffffffffffff9c, &(0x7f0000000180), 0x2, 0x0) syz_genetlink_get_family_id$mptcp(&(0x7f0000000300), r3) r4 = openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000500)='./cgroup/syz1\x00', 0x200002, 0x0) syz_io_uring_submit(0x0, r2, &(0x7f0000000580)=@IORING_OP_FILES_UPDATE={0x14, 0x4, 0x0, 0x0, 0x40, &(0x7f0000000540)=[0xffffffffffffffff, 0xffffffffffffffff, r4, r0, r1], 0x5}, 0x3) io_uring_setup(0x2812, &(0x7f00000005c0)={0x0, 0x5e1b, 0x2, 0x3, 0x12f}) socket$inet6_tcp(0xa, 0x1, 0x0) io_uring_setup(0x7c8f, &(0x7f0000001140)={0x0, 0xc240, 0x10, 0x3, 0x1c7}) 21:20:32 executing program 6: r0 = io_uring_setup(0x355e, &(0x7f0000000000)={0x0, 0x0, 0x20, 0x0, 0x1be}) r1 = syz_io_uring_setup(0x8fe, &(0x7f0000000080)={0x0, 0x1830, 0x0, 0x0, 0x0, 0x0, r0}, &(0x7f0000ffb000/0x2000)=nil, &(0x7f0000ffb000/0x4000)=nil, 0x0, &(0x7f0000000140)=0x0) r3 = openat$hwrng(0xffffffffffffff9c, &(0x7f0000000180), 0x2, 0x0) r4 = syz_genetlink_get_family_id$mptcp(&(0x7f0000000300), r3) sendmsg$MPTCP_PM_CMD_ADD_ADDR(r3, &(0x7f00000003c0)={&(0x7f00000002c0)={0x10, 0x0, 0x0, 0x10}, 0xc, &(0x7f0000000380)={&(0x7f0000000340)={0x24, r4, 0x300, 0x70bd26, 0x25dfdbfb, {}, [@MPTCP_PM_ATTR_SUBFLOWS={0x8, 0x3, 0x1}, @MPTCP_PM_ATTR_RCV_ADD_ADDRS={0x8, 0x2, 0x2}]}, 0x24}, 0x1, 0x0, 0x0, 0x20000004}, 0x8890) syz_io_uring_setup(0x20f8, &(0x7f0000000400)={0x0, 0x7677, 0x8, 0x3, 0x22f}, &(0x7f0000ffe000/0x2000)=nil, &(0x7f0000ffb000/0x2000)=nil, &(0x7f0000000480)=0x0, &(0x7f00000004c0)) r6 = openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000500)='./cgroup/syz1\x00', 0x200002, 0x0) syz_io_uring_submit(r5, r2, &(0x7f0000000580)=@IORING_OP_FILES_UPDATE={0x14, 0x4, 0x0, 0x0, 0x40, &(0x7f0000000540)=[0xffffffffffffffff, 0xffffffffffffffff, r6, r0, r1], 0x5}, 0x3) socket$inet6_tcp(0xa, 0x1, 0x0) openat$procfs(0xffffffffffffff9c, &(0x7f00000010c0)='/proc/crypto\x00', 0x0, 0x0) io_uring_setup(0x7c8f, &(0x7f0000001140)={0x0, 0xc240, 0x10, 0x3, 0x1c7}) 21:20:32 executing program 2: r0 = syz_io_uring_setup(0x8fe, &(0x7f0000000080), &(0x7f0000ffb000/0x2000)=nil, &(0x7f0000ffb000/0x4000)=nil, &(0x7f0000000100), &(0x7f0000000140)=0x0) openat$hwrng(0xffffffffffffff9c, 0x0, 0x0, 0x0) r2 = openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000500)='./cgroup/syz1\x00', 0x200002, 0x0) syz_io_uring_submit(0x0, r1, &(0x7f0000000580)=@IORING_OP_FILES_UPDATE={0x14, 0x4, 0x0, 0x0, 0x40, &(0x7f0000000540)=[0xffffffffffffffff, 0xffffffffffffffff, r2, 0xffffffffffffffff, r0], 0x5}, 0x3) io_uring_setup(0x2812, &(0x7f00000005c0)={0x0, 0x5e1b, 0x2, 0x3, 0x12f}) 21:20:32 executing program 0: syz_io_uring_setup(0x8fe, &(0x7f0000000080), &(0x7f0000ffb000/0x2000)=nil, &(0x7f0000ffb000/0x4000)=nil, &(0x7f0000000100), &(0x7f0000000140)) openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000500)='./cgroup/syz1\x00', 0x200002, 0x0) syz_io_uring_submit(0x0, 0x0, 0x0, 0x0) io_uring_setup(0x2812, &(0x7f00000005c0)={0x0, 0x0, 0x2}) 21:20:32 executing program 2: r0 = syz_io_uring_setup(0x8fe, &(0x7f0000000080), &(0x7f0000ffb000/0x2000)=nil, &(0x7f0000ffb000/0x4000)=nil, &(0x7f0000000100), &(0x7f0000000140)=0x0) openat$hwrng(0xffffffffffffff9c, 0x0, 0x0, 0x0) r2 = openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000500)='./cgroup/syz1\x00', 0x200002, 0x0) syz_io_uring_submit(0x0, r1, &(0x7f0000000580)=@IORING_OP_FILES_UPDATE={0x14, 0x4, 0x0, 0x0, 0x40, &(0x7f0000000540)=[0xffffffffffffffff, 0xffffffffffffffff, r2, 0xffffffffffffffff, r0], 0x5}, 0x3) io_uring_setup(0x2812, &(0x7f00000005c0)={0x0, 0x5e1b, 0x2, 0x3, 0x12f}) 21:20:32 executing program 5: r0 = io_uring_setup(0x355e, &(0x7f0000000000)={0x0, 0x0, 0x20, 0x0, 0x1be}) r1 = syz_io_uring_setup(0x8fe, &(0x7f0000000080)={0x0, 0x0, 0x0, 0x0, 0x1b8, 0x0, r0}, &(0x7f0000ffb000/0x2000)=nil, &(0x7f0000ffb000/0x4000)=nil, &(0x7f0000000100), &(0x7f0000000140)=0x0) r3 = openat$hwrng(0xffffffffffffff9c, &(0x7f0000000180), 0x2, 0x0) r4 = syz_io_uring_setup(0x65dd, &(0x7f00000001c0)={0x0, 0xf46f, 0x20, 0x2, 0xdf}, &(0x7f0000ffe000/0x1000)=nil, &(0x7f0000ffd000/0x1000)=nil, &(0x7f0000000240), &(0x7f0000000280)) r5 = syz_genetlink_get_family_id$mptcp(&(0x7f0000000300), r3) sendmsg$MPTCP_PM_CMD_ADD_ADDR(r3, &(0x7f00000003c0)={&(0x7f00000002c0)={0x10, 0x0, 0x0, 0x10}, 0xc, &(0x7f0000000380)={&(0x7f0000000340)={0x24, r5, 0x300, 0x70bd26, 0x25dfdbfb, {}, [@MPTCP_PM_ATTR_SUBFLOWS={0x8, 0x3, 0x1}, @MPTCP_PM_ATTR_RCV_ADD_ADDRS={0x8, 0x2, 0x2}]}, 0x24}, 0x1, 0x0, 0x0, 0x20000004}, 0x8890) r6 = openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000500)='./cgroup/syz1\x00', 0x200002, 0x0) syz_io_uring_submit(0x0, r2, &(0x7f0000000580)=@IORING_OP_FILES_UPDATE={0x14, 0x4, 0x0, 0x0, 0x40, &(0x7f0000000540)=[r4, 0xffffffffffffffff, r6, r0, r1], 0x5}, 0x3) socket$inet6_tcp(0xa, 0x1, 0x0) openat$procfs(0xffffffffffffff9c, &(0x7f00000010c0)='/proc/crypto\x00', 0x0, 0x0) 21:20:32 executing program 6: r0 = io_uring_setup(0x355e, &(0x7f0000000000)={0x0, 0x0, 0x20, 0x0, 0x1be}) r1 = syz_io_uring_setup(0x8fe, &(0x7f0000000080)={0x0, 0x1830, 0x0, 0x0, 0x0, 0x0, r0}, &(0x7f0000ffb000/0x2000)=nil, &(0x7f0000ffb000/0x4000)=nil, &(0x7f0000000100), 0x0) r2 = openat$hwrng(0xffffffffffffff9c, &(0x7f0000000180), 0x2, 0x0) r3 = syz_genetlink_get_family_id$mptcp(&(0x7f0000000300), r2) sendmsg$MPTCP_PM_CMD_ADD_ADDR(r2, &(0x7f00000003c0)={&(0x7f00000002c0)={0x10, 0x0, 0x0, 0x10}, 0xc, &(0x7f0000000380)={&(0x7f0000000340)={0x24, r3, 0x300, 0x70bd26, 0x25dfdbfb, {}, [@MPTCP_PM_ATTR_SUBFLOWS={0x8, 0x3, 0x1}, @MPTCP_PM_ATTR_RCV_ADD_ADDRS={0x8, 0x2, 0x2}]}, 0x24}, 0x1, 0x0, 0x0, 0x20000004}, 0x8890) syz_io_uring_setup(0x20f8, &(0x7f0000000400)={0x0, 0x7677, 0x8, 0x3, 0x22f}, &(0x7f0000ffe000/0x2000)=nil, &(0x7f0000ffb000/0x2000)=nil, &(0x7f0000000480)=0x0, &(0x7f00000004c0)) r5 = openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000500)='./cgroup/syz1\x00', 0x200002, 0x0) syz_io_uring_submit(r4, 0x0, &(0x7f0000000580)=@IORING_OP_FILES_UPDATE={0x14, 0x4, 0x0, 0x0, 0x40, &(0x7f0000000540)=[0xffffffffffffffff, 0xffffffffffffffff, r5, r0, r1], 0x5}, 0x3) socket$inet6_tcp(0xa, 0x1, 0x0) openat$procfs(0xffffffffffffff9c, &(0x7f00000010c0)='/proc/crypto\x00', 0x0, 0x0) io_uring_setup(0x7c8f, &(0x7f0000001140)={0x0, 0xc240, 0x10, 0x3, 0x1c7}) 21:20:33 executing program 7: io_uring_setup(0x355e, &(0x7f0000000000)={0x0, 0x0, 0x20, 0x1, 0x1be}) r0 = openat$hwrng(0xffffffffffffff9c, &(0x7f0000000180), 0x2, 0x0) r1 = syz_io_uring_setup(0x65dd, &(0x7f00000001c0)={0x0, 0x0, 0x0, 0x2, 0xdf}, &(0x7f0000ffe000/0x1000)=nil, &(0x7f0000ffd000/0x1000)=nil, &(0x7f0000000240), &(0x7f0000000280)) syz_genetlink_get_family_id$mptcp(&(0x7f0000000300), r0) syz_io_uring_setup(0x20f8, &(0x7f0000000400)={0x0, 0x7677, 0x8, 0x3, 0x22f, 0x0, r1}, &(0x7f0000ffe000/0x2000)=nil, &(0x7f0000ffb000/0x2000)=nil, &(0x7f0000000480), &(0x7f00000004c0)) openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000500)='./cgroup/syz1\x00', 0x200002, 0x0) 21:20:33 executing program 3: r0 = io_uring_setup(0x355e, &(0x7f0000000000)={0x0, 0x0, 0x20, 0x1, 0x1be}) r1 = syz_io_uring_setup(0x8fe, &(0x7f0000000080), &(0x7f0000ffb000/0x2000)=nil, &(0x7f0000ffb000/0x4000)=nil, 0x0, &(0x7f0000000140)=0x0) r3 = openat$hwrng(0xffffffffffffff9c, &(0x7f0000000180), 0x2, 0x0) syz_genetlink_get_family_id$mptcp(&(0x7f0000000300), r3) r4 = openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000500)='./cgroup/syz1\x00', 0x200002, 0x0) syz_io_uring_submit(0x0, r2, &(0x7f0000000580)=@IORING_OP_FILES_UPDATE={0x14, 0x4, 0x0, 0x0, 0x40, &(0x7f0000000540)=[0xffffffffffffffff, 0xffffffffffffffff, r4, r0, r1], 0x5}, 0x3) io_uring_setup(0x2812, &(0x7f00000005c0)={0x0, 0x5e1b, 0x2, 0x3, 0x12f}) socket$inet6_tcp(0xa, 0x1, 0x0) io_uring_setup(0x7c8f, &(0x7f0000001140)={0x0, 0xc240, 0x10, 0x3, 0x1c7}) 21:20:33 executing program 1: r0 = io_uring_setup(0x355e, &(0x7f0000000000)={0x0, 0x0, 0x20, 0x1, 0x1be}) r1 = openat$hwrng(0xffffffffffffff9c, &(0x7f0000000180), 0x2, 0x0) r2 = syz_io_uring_setup(0x65dd, &(0x7f00000001c0)={0x0, 0x0, 0x20, 0x2}, &(0x7f0000ffe000/0x1000)=nil, &(0x7f0000ffd000/0x1000)=nil, &(0x7f0000000240), 0x0) syz_genetlink_get_family_id$mptcp(&(0x7f0000000300), r1) syz_io_uring_setup(0x20f8, &(0x7f0000000400)={0x0, 0x7677, 0x8, 0x3, 0x22f, 0x0, r2}, &(0x7f0000ffe000/0x2000)=nil, &(0x7f0000ffb000/0x2000)=nil, &(0x7f0000000480)=0x0, &(0x7f00000004c0)) r4 = openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000500)='./cgroup/syz1\x00', 0x200002, 0x0) syz_io_uring_submit(r3, 0x0, &(0x7f0000000580)=@IORING_OP_FILES_UPDATE={0x14, 0x4, 0x0, 0x0, 0x40, &(0x7f0000000540)=[r2, 0xffffffffffffffff, r4, r0, 0xffffffffffffffff], 0x5}, 0x3) io_uring_setup(0x2812, &(0x7f00000005c0)={0x0, 0x5e1b, 0x2, 0x3, 0x12f, 0x0, r2}) socket$inet6_tcp(0xa, 0x1, 0x0) openat$procfs(0xffffffffffffff9c, &(0x7f00000010c0)='/proc/crypto\x00', 0x0, 0x0) io_uring_setup(0x7c8f, &(0x7f0000001140)={0x0, 0xc240, 0x10, 0x3, 0x1c7, 0x0, r2}) 21:20:33 executing program 4: ioctl$SCSI_IOCTL_DOORUNLOCK(0xffffffffffffffff, 0x5381) r0 = syz_open_dev$mouse(&(0x7f0000000000), 0x578, 0x4000) ioctl$SG_GET_PACK_ID(r0, 0x227c, &(0x7f0000000040)) syz_genetlink_get_family_id$nl80211(&(0x7f00000000c0), 0xffffffffffffffff) syz_open_dev$vcsa(&(0x7f0000000440), 0x56, 0x0) socketpair(0x0, 0x3, 0x6, &(0x7f0000000640)) r1 = openat$tcp_congestion(0xffffffffffffff9c, &(0x7f0000000800), 0x1, 0x0) write$tcp_congestion(r1, &(0x7f0000000840)='htcp\x00', 0x5) 21:20:33 executing program 0: openat$hwrng(0xffffffffffffff9c, &(0x7f0000000180), 0x2, 0x0) openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000500)='./cgroup/syz1\x00', 0x200002, 0x0) syz_io_uring_submit(0x0, 0x0, 0x0, 0x0) io_uring_setup(0x2812, &(0x7f00000005c0)={0x0, 0x0, 0x2}) 21:20:33 executing program 2: r0 = syz_io_uring_setup(0x8fe, &(0x7f0000000080), &(0x7f0000ffb000/0x2000)=nil, &(0x7f0000ffb000/0x4000)=nil, &(0x7f0000000100), &(0x7f0000000140)=0x0) openat$hwrng(0xffffffffffffff9c, &(0x7f0000000180), 0x0, 0x0) r2 = openat$cgroup_root(0xffffffffffffff9c, 0x0, 0x200002, 0x0) syz_io_uring_submit(0x0, r1, &(0x7f0000000580)=@IORING_OP_FILES_UPDATE={0x14, 0x4, 0x0, 0x0, 0x40, &(0x7f0000000540)=[0xffffffffffffffff, 0xffffffffffffffff, r2, 0xffffffffffffffff, r0], 0x5}, 0x3) io_uring_setup(0x2812, &(0x7f00000005c0)={0x0, 0x5e1b, 0x2, 0x3, 0x12f}) 21:20:33 executing program 2: r0 = syz_io_uring_setup(0x8fe, &(0x7f0000000080), &(0x7f0000ffb000/0x2000)=nil, &(0x7f0000ffb000/0x4000)=nil, &(0x7f0000000100), &(0x7f0000000140)=0x0) openat$hwrng(0xffffffffffffff9c, &(0x7f0000000180), 0x0, 0x0) r2 = openat$cgroup_root(0xffffffffffffff9c, 0x0, 0x200002, 0x0) syz_io_uring_submit(0x0, r1, &(0x7f0000000580)=@IORING_OP_FILES_UPDATE={0x14, 0x4, 0x0, 0x0, 0x40, &(0x7f0000000540)=[0xffffffffffffffff, 0xffffffffffffffff, r2, 0xffffffffffffffff, r0], 0x5}, 0x3) io_uring_setup(0x2812, &(0x7f00000005c0)={0x0, 0x5e1b, 0x2, 0x3, 0x12f}) 21:20:33 executing program 6: r0 = io_uring_setup(0x355e, &(0x7f0000000000)={0x0, 0x0, 0x20, 0x0, 0x1be}) r1 = syz_io_uring_setup(0x8fe, &(0x7f0000000080)={0x0, 0x1830, 0x0, 0x0, 0x0, 0x0, r0}, &(0x7f0000ffb000/0x2000)=nil, &(0x7f0000ffb000/0x4000)=nil, &(0x7f0000000100), 0x0) r2 = openat$hwrng(0xffffffffffffff9c, &(0x7f0000000180), 0x2, 0x0) r3 = syz_genetlink_get_family_id$mptcp(&(0x7f0000000300), r2) sendmsg$MPTCP_PM_CMD_ADD_ADDR(r2, &(0x7f00000003c0)={&(0x7f00000002c0)={0x10, 0x0, 0x0, 0x10}, 0xc, &(0x7f0000000380)={&(0x7f0000000340)={0x24, r3, 0x300, 0x70bd26, 0x25dfdbfb, {}, [@MPTCP_PM_ATTR_SUBFLOWS={0x8, 0x3, 0x1}, @MPTCP_PM_ATTR_RCV_ADD_ADDRS={0x8, 0x2, 0x2}]}, 0x24}, 0x1, 0x0, 0x0, 0x20000004}, 0x8890) syz_io_uring_setup(0x20f8, &(0x7f0000000400)={0x0, 0x7677, 0x8, 0x3, 0x22f}, &(0x7f0000ffe000/0x2000)=nil, &(0x7f0000ffb000/0x2000)=nil, &(0x7f0000000480)=0x0, &(0x7f00000004c0)) r5 = openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000500)='./cgroup/syz1\x00', 0x200002, 0x0) syz_io_uring_submit(r4, 0x0, &(0x7f0000000580)=@IORING_OP_FILES_UPDATE={0x14, 0x4, 0x0, 0x0, 0x40, &(0x7f0000000540)=[0xffffffffffffffff, 0xffffffffffffffff, r5, r0, r1], 0x5}, 0x3) socket$inet6_tcp(0xa, 0x1, 0x0) openat$procfs(0xffffffffffffff9c, &(0x7f00000010c0)='/proc/crypto\x00', 0x0, 0x0) io_uring_setup(0x7c8f, &(0x7f0000001140)={0x0, 0xc240, 0x10, 0x3, 0x1c7}) 21:20:33 executing program 5: r0 = io_uring_setup(0x355e, &(0x7f0000000000)={0x0, 0x0, 0x20, 0x0, 0x1be}) r1 = syz_io_uring_setup(0x8fe, &(0x7f0000000080)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, r0}, &(0x7f0000ffb000/0x2000)=nil, &(0x7f0000ffb000/0x4000)=nil, &(0x7f0000000100), &(0x7f0000000140)=0x0) r3 = openat$hwrng(0xffffffffffffff9c, &(0x7f0000000180), 0x2, 0x0) r4 = syz_io_uring_setup(0x65dd, &(0x7f00000001c0)={0x0, 0xf46f, 0x20, 0x2, 0xdf}, &(0x7f0000ffe000/0x1000)=nil, &(0x7f0000ffd000/0x1000)=nil, &(0x7f0000000240), &(0x7f0000000280)) r5 = syz_genetlink_get_family_id$mptcp(&(0x7f0000000300), r3) sendmsg$MPTCP_PM_CMD_ADD_ADDR(r3, &(0x7f00000003c0)={&(0x7f00000002c0)={0x10, 0x0, 0x0, 0x10}, 0xc, &(0x7f0000000380)={&(0x7f0000000340)={0x24, r5, 0x300, 0x70bd26, 0x25dfdbfb, {}, [@MPTCP_PM_ATTR_SUBFLOWS={0x8, 0x3, 0x1}, @MPTCP_PM_ATTR_RCV_ADD_ADDRS={0x8, 0x2, 0x2}]}, 0x24}, 0x1, 0x0, 0x0, 0x20000004}, 0x8890) r6 = openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000500)='./cgroup/syz1\x00', 0x200002, 0x0) syz_io_uring_submit(0x0, r2, &(0x7f0000000580)=@IORING_OP_FILES_UPDATE={0x14, 0x4, 0x0, 0x0, 0x40, &(0x7f0000000540)=[r4, 0xffffffffffffffff, r6, r0, r1], 0x5}, 0x3) socket$inet6_tcp(0xa, 0x1, 0x0) openat$procfs(0xffffffffffffff9c, &(0x7f00000010c0)='/proc/crypto\x00', 0x0, 0x0) 21:20:33 executing program 0: openat$hwrng(0xffffffffffffff9c, &(0x7f0000000180), 0x2, 0x0) openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000500)='./cgroup/syz1\x00', 0x200002, 0x0) syz_io_uring_submit(0x0, 0x0, 0x0, 0x0) io_uring_setup(0x2812, &(0x7f00000005c0)={0x0, 0x0, 0x2}) 21:20:42 executing program 3: r0 = io_uring_setup(0x355e, &(0x7f0000000000)={0x0, 0x0, 0x20, 0x1, 0x1be}) r1 = syz_io_uring_setup(0x8fe, &(0x7f0000000080), &(0x7f0000ffb000/0x2000)=nil, &(0x7f0000ffb000/0x4000)=nil, 0x0, &(0x7f0000000140)=0x0) r3 = openat$hwrng(0xffffffffffffff9c, &(0x7f0000000180), 0x2, 0x0) syz_genetlink_get_family_id$mptcp(&(0x7f0000000300), r3) r4 = openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000500)='./cgroup/syz1\x00', 0x200002, 0x0) syz_io_uring_submit(0x0, r2, &(0x7f0000000580)=@IORING_OP_FILES_UPDATE={0x14, 0x4, 0x0, 0x0, 0x40, &(0x7f0000000540)=[0xffffffffffffffff, 0xffffffffffffffff, r4, r0, r1], 0x5}, 0x3) io_uring_setup(0x2812, &(0x7f00000005c0)={0x0, 0x5e1b, 0x2, 0x3, 0x12f}) socket$inet6_tcp(0xa, 0x1, 0x0) io_uring_setup(0x7c8f, &(0x7f0000001140)={0x0, 0xc240, 0x10, 0x3, 0x1c7}) 21:20:42 executing program 5: r0 = io_uring_setup(0x355e, &(0x7f0000000000)={0x0, 0x0, 0x20, 0x0, 0x1be}) r1 = syz_io_uring_setup(0x8fe, &(0x7f0000000080)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, r0}, &(0x7f0000ffb000/0x2000)=nil, &(0x7f0000ffb000/0x4000)=nil, &(0x7f0000000100), &(0x7f0000000140)=0x0) r3 = openat$hwrng(0xffffffffffffff9c, &(0x7f0000000180), 0x2, 0x0) r4 = syz_io_uring_setup(0x65dd, &(0x7f00000001c0)={0x0, 0xf46f, 0x20, 0x2, 0xdf}, &(0x7f0000ffe000/0x1000)=nil, &(0x7f0000ffd000/0x1000)=nil, &(0x7f0000000240), &(0x7f0000000280)) r5 = syz_genetlink_get_family_id$mptcp(&(0x7f0000000300), r3) sendmsg$MPTCP_PM_CMD_ADD_ADDR(r3, &(0x7f00000003c0)={&(0x7f00000002c0)={0x10, 0x0, 0x0, 0x10}, 0xc, &(0x7f0000000380)={&(0x7f0000000340)={0x24, r5, 0x300, 0x70bd26, 0x25dfdbfb, {}, [@MPTCP_PM_ATTR_SUBFLOWS={0x8, 0x3, 0x1}, @MPTCP_PM_ATTR_RCV_ADD_ADDRS={0x8, 0x2, 0x2}]}, 0x24}, 0x1, 0x0, 0x0, 0x20000004}, 0x8890) r6 = openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000500)='./cgroup/syz1\x00', 0x200002, 0x0) syz_io_uring_submit(0x0, r2, &(0x7f0000000580)=@IORING_OP_FILES_UPDATE={0x14, 0x4, 0x0, 0x0, 0x40, &(0x7f0000000540)=[r4, 0xffffffffffffffff, r6, r0, r1], 0x5}, 0x3) socket$inet6_tcp(0xa, 0x1, 0x0) openat$procfs(0xffffffffffffff9c, &(0x7f00000010c0)='/proc/crypto\x00', 0x0, 0x0) 21:20:42 executing program 2: r0 = syz_io_uring_setup(0x8fe, &(0x7f0000000080), &(0x7f0000ffb000/0x2000)=nil, &(0x7f0000ffb000/0x4000)=nil, &(0x7f0000000100), &(0x7f0000000140)=0x0) openat$hwrng(0xffffffffffffff9c, &(0x7f0000000180), 0x0, 0x0) r2 = openat$cgroup_root(0xffffffffffffff9c, 0x0, 0x200002, 0x0) syz_io_uring_submit(0x0, r1, &(0x7f0000000580)=@IORING_OP_FILES_UPDATE={0x14, 0x4, 0x0, 0x0, 0x40, &(0x7f0000000540)=[0xffffffffffffffff, 0xffffffffffffffff, r2, 0xffffffffffffffff, r0], 0x5}, 0x3) io_uring_setup(0x2812, &(0x7f00000005c0)={0x0, 0x5e1b, 0x2, 0x3, 0x12f}) 21:20:42 executing program 0: openat$hwrng(0xffffffffffffff9c, &(0x7f0000000180), 0x2, 0x0) openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000500)='./cgroup/syz1\x00', 0x200002, 0x0) syz_io_uring_submit(0x0, 0x0, 0x0, 0x0) io_uring_setup(0x2812, &(0x7f00000005c0)={0x0, 0x0, 0x2}) 21:20:42 executing program 7: io_uring_setup(0x355e, &(0x7f0000000000)={0x0, 0x0, 0x20, 0x1, 0x1be}) r0 = openat$hwrng(0xffffffffffffff9c, &(0x7f0000000180), 0x2, 0x0) syz_io_uring_setup(0x65dd, &(0x7f00000001c0)={0x0, 0x0, 0x0, 0x2, 0xdf}, &(0x7f0000ffe000/0x1000)=nil, &(0x7f0000ffd000/0x1000)=nil, &(0x7f0000000240), &(0x7f0000000280)) syz_genetlink_get_family_id$mptcp(&(0x7f0000000300), r0) openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000500)='./cgroup/syz1\x00', 0x200002, 0x0) 21:20:42 executing program 4: ioctl$SCSI_IOCTL_DOORUNLOCK(0xffffffffffffffff, 0x5381) r0 = syz_open_dev$mouse(&(0x7f0000000000), 0x578, 0x4000) ioctl$SG_GET_PACK_ID(r0, 0x227c, &(0x7f0000000040)) syz_genetlink_get_family_id$nl80211(&(0x7f00000000c0), 0xffffffffffffffff) syz_open_dev$vcsa(&(0x7f0000000440), 0x56, 0x0) socketpair(0x0, 0x3, 0x6, &(0x7f0000000640)) r1 = openat$tcp_congestion(0xffffffffffffff9c, &(0x7f0000000800), 0x1, 0x0) write$tcp_congestion(r1, &(0x7f0000000840)='htcp\x00', 0x5) 21:20:42 executing program 1: r0 = io_uring_setup(0x355e, &(0x7f0000000000)={0x0, 0x0, 0x20, 0x1, 0x1be}) r1 = openat$hwrng(0xffffffffffffff9c, &(0x7f0000000180), 0x2, 0x0) r2 = syz_io_uring_setup(0x65dd, &(0x7f00000001c0)={0x0, 0x0, 0x20, 0x2}, &(0x7f0000ffe000/0x1000)=nil, &(0x7f0000ffd000/0x1000)=nil, &(0x7f0000000240), &(0x7f0000000280)) syz_genetlink_get_family_id$mptcp(0x0, r1) syz_io_uring_setup(0x20f8, &(0x7f0000000400)={0x0, 0x7677, 0x8, 0x3, 0x22f, 0x0, r2}, &(0x7f0000ffe000/0x2000)=nil, &(0x7f0000ffb000/0x2000)=nil, &(0x7f0000000480)=0x0, &(0x7f00000004c0)) r4 = openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000500)='./cgroup/syz1\x00', 0x200002, 0x0) syz_io_uring_submit(r3, 0x0, &(0x7f0000000580)=@IORING_OP_FILES_UPDATE={0x14, 0x4, 0x0, 0x0, 0x40, &(0x7f0000000540)=[r2, 0xffffffffffffffff, r4, r0, 0xffffffffffffffff], 0x5}, 0x3) io_uring_setup(0x2812, &(0x7f00000005c0)={0x0, 0x5e1b, 0x2, 0x3, 0x12f, 0x0, r2}) socket$inet6_tcp(0xa, 0x1, 0x0) openat$procfs(0xffffffffffffff9c, &(0x7f00000010c0)='/proc/crypto\x00', 0x0, 0x0) io_uring_setup(0x7c8f, &(0x7f0000001140)={0x0, 0xc240, 0x10, 0x3, 0x1c7, 0x0, r2}) 21:20:42 executing program 6: r0 = io_uring_setup(0x355e, &(0x7f0000000000)={0x0, 0x0, 0x20, 0x0, 0x1be}) r1 = syz_io_uring_setup(0x8fe, &(0x7f0000000080)={0x0, 0x1830, 0x0, 0x0, 0x0, 0x0, r0}, &(0x7f0000ffb000/0x2000)=nil, &(0x7f0000ffb000/0x4000)=nil, &(0x7f0000000100), 0x0) r2 = openat$hwrng(0xffffffffffffff9c, &(0x7f0000000180), 0x2, 0x0) r3 = syz_genetlink_get_family_id$mptcp(&(0x7f0000000300), r2) sendmsg$MPTCP_PM_CMD_ADD_ADDR(r2, &(0x7f00000003c0)={&(0x7f00000002c0)={0x10, 0x0, 0x0, 0x10}, 0xc, &(0x7f0000000380)={&(0x7f0000000340)={0x24, r3, 0x300, 0x70bd26, 0x25dfdbfb, {}, [@MPTCP_PM_ATTR_SUBFLOWS={0x8, 0x3, 0x1}, @MPTCP_PM_ATTR_RCV_ADD_ADDRS={0x8, 0x2, 0x2}]}, 0x24}, 0x1, 0x0, 0x0, 0x20000004}, 0x8890) syz_io_uring_setup(0x20f8, &(0x7f0000000400)={0x0, 0x7677, 0x8, 0x3, 0x22f}, &(0x7f0000ffe000/0x2000)=nil, &(0x7f0000ffb000/0x2000)=nil, &(0x7f0000000480)=0x0, &(0x7f00000004c0)) r5 = openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000500)='./cgroup/syz1\x00', 0x200002, 0x0) syz_io_uring_submit(r4, 0x0, &(0x7f0000000580)=@IORING_OP_FILES_UPDATE={0x14, 0x4, 0x0, 0x0, 0x40, &(0x7f0000000540)=[0xffffffffffffffff, 0xffffffffffffffff, r5, r0, r1], 0x5}, 0x3) socket$inet6_tcp(0xa, 0x1, 0x0) openat$procfs(0xffffffffffffff9c, &(0x7f00000010c0)='/proc/crypto\x00', 0x0, 0x0) io_uring_setup(0x7c8f, &(0x7f0000001140)={0x0, 0xc240, 0x10, 0x3, 0x1c7}) 21:20:42 executing program 0: syz_io_uring_setup(0x0, &(0x7f0000000080), &(0x7f0000ffb000/0x2000)=nil, &(0x7f0000ffb000/0x4000)=nil, &(0x7f0000000100), &(0x7f0000000140)) openat$hwrng(0xffffffffffffff9c, &(0x7f0000000180), 0x2, 0x0) openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000500)='./cgroup/syz1\x00', 0x200002, 0x0) syz_io_uring_submit(0x0, 0x0, 0x0, 0x0) io_uring_setup(0x2812, &(0x7f00000005c0)={0x0, 0x0, 0x2}) 21:20:42 executing program 2: r0 = syz_io_uring_setup(0x8fe, &(0x7f0000000080), &(0x7f0000ffb000/0x2000)=nil, &(0x7f0000ffb000/0x4000)=nil, &(0x7f0000000100), &(0x7f0000000140)) openat$hwrng(0xffffffffffffff9c, &(0x7f0000000180), 0x0, 0x0) r1 = openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000500)='./cgroup/syz1\x00', 0x200002, 0x0) syz_io_uring_submit(0x0, 0x0, &(0x7f0000000580)=@IORING_OP_FILES_UPDATE={0x14, 0x4, 0x0, 0x0, 0x40, &(0x7f0000000540)=[0xffffffffffffffff, 0xffffffffffffffff, r1, 0xffffffffffffffff, r0], 0x5}, 0x3) io_uring_setup(0x2812, &(0x7f00000005c0)={0x0, 0x5e1b, 0x2, 0x3, 0x12f}) 21:20:42 executing program 0: syz_io_uring_setup(0x0, &(0x7f0000000080), &(0x7f0000ffb000/0x2000)=nil, &(0x7f0000ffb000/0x4000)=nil, &(0x7f0000000100), &(0x7f0000000140)) openat$hwrng(0xffffffffffffff9c, &(0x7f0000000180), 0x2, 0x0) openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000500)='./cgroup/syz1\x00', 0x200002, 0x0) syz_io_uring_submit(0x0, 0x0, 0x0, 0x0) io_uring_setup(0x2812, &(0x7f00000005c0)={0x0, 0x0, 0x2}) 21:20:52 executing program 2: r0 = syz_io_uring_setup(0x8fe, &(0x7f0000000080), &(0x7f0000ffb000/0x2000)=nil, &(0x7f0000ffb000/0x4000)=nil, &(0x7f0000000100), &(0x7f0000000140)) openat$hwrng(0xffffffffffffff9c, &(0x7f0000000180), 0x0, 0x0) r1 = openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000500)='./cgroup/syz1\x00', 0x200002, 0x0) syz_io_uring_submit(0x0, 0x0, &(0x7f0000000580)=@IORING_OP_FILES_UPDATE={0x14, 0x4, 0x0, 0x0, 0x40, &(0x7f0000000540)=[0xffffffffffffffff, 0xffffffffffffffff, r1, 0xffffffffffffffff, r0], 0x5}, 0x3) io_uring_setup(0x2812, &(0x7f00000005c0)={0x0, 0x5e1b, 0x2, 0x3, 0x12f}) 21:20:52 executing program 0: syz_io_uring_setup(0x0, &(0x7f0000000080), &(0x7f0000ffb000/0x2000)=nil, &(0x7f0000ffb000/0x4000)=nil, &(0x7f0000000100), &(0x7f0000000140)) openat$hwrng(0xffffffffffffff9c, &(0x7f0000000180), 0x2, 0x0) openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000500)='./cgroup/syz1\x00', 0x200002, 0x0) syz_io_uring_submit(0x0, 0x0, 0x0, 0x0) io_uring_setup(0x2812, &(0x7f00000005c0)={0x0, 0x0, 0x2}) 21:20:52 executing program 4: ioctl$SCSI_IOCTL_DOORUNLOCK(0xffffffffffffffff, 0x5381) r0 = syz_open_dev$mouse(&(0x7f0000000000), 0x578, 0x4000) ioctl$SG_GET_PACK_ID(r0, 0x227c, &(0x7f0000000040)) syz_genetlink_get_family_id$nl80211(&(0x7f00000000c0), 0xffffffffffffffff) syz_open_dev$vcsa(&(0x7f0000000440), 0x56, 0x4000) socketpair(0x0, 0x0, 0x6, &(0x7f0000000640)) r1 = openat$tcp_congestion(0xffffffffffffff9c, &(0x7f0000000800), 0x1, 0x0) write$tcp_congestion(r1, &(0x7f0000000840)='htcp\x00', 0x5) 21:20:52 executing program 7: io_uring_setup(0x355e, &(0x7f0000000000)={0x0, 0x0, 0x20, 0x1, 0x1be}) openat$hwrng(0xffffffffffffff9c, &(0x7f0000000180), 0x2, 0x0) syz_io_uring_setup(0x65dd, &(0x7f00000001c0)={0x0, 0x0, 0x0, 0x2, 0xdf}, &(0x7f0000ffe000/0x1000)=nil, &(0x7f0000ffd000/0x1000)=nil, &(0x7f0000000240), &(0x7f0000000280)) openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000500)='./cgroup/syz1\x00', 0x200002, 0x0) 21:20:52 executing program 1: r0 = io_uring_setup(0x355e, &(0x7f0000000000)={0x0, 0x0, 0x20, 0x1, 0x1be}) r1 = openat$hwrng(0xffffffffffffff9c, &(0x7f0000000180), 0x2, 0x0) r2 = syz_io_uring_setup(0x65dd, &(0x7f00000001c0)={0x0, 0x0, 0x20, 0x2}, &(0x7f0000ffe000/0x1000)=nil, &(0x7f0000ffd000/0x1000)=nil, &(0x7f0000000240), &(0x7f0000000280)) syz_genetlink_get_family_id$mptcp(0x0, r1) syz_io_uring_setup(0x20f8, &(0x7f0000000400)={0x0, 0x7677, 0x8, 0x3, 0x22f, 0x0, r2}, &(0x7f0000ffe000/0x2000)=nil, &(0x7f0000ffb000/0x2000)=nil, &(0x7f0000000480)=0x0, &(0x7f00000004c0)) r4 = openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000500)='./cgroup/syz1\x00', 0x200002, 0x0) syz_io_uring_submit(r3, 0x0, &(0x7f0000000580)=@IORING_OP_FILES_UPDATE={0x14, 0x4, 0x0, 0x0, 0x40, &(0x7f0000000540)=[r2, 0xffffffffffffffff, r4, r0, 0xffffffffffffffff], 0x5}, 0x3) io_uring_setup(0x2812, &(0x7f00000005c0)={0x0, 0x5e1b, 0x2, 0x3, 0x12f, 0x0, r2}) socket$inet6_tcp(0xa, 0x1, 0x0) openat$procfs(0xffffffffffffff9c, &(0x7f00000010c0)='/proc/crypto\x00', 0x0, 0x0) io_uring_setup(0x7c8f, &(0x7f0000001140)={0x0, 0xc240, 0x10, 0x3, 0x1c7, 0x0, r2}) 21:20:52 executing program 5: r0 = io_uring_setup(0x355e, &(0x7f0000000000)={0x0, 0x0, 0x20, 0x0, 0x1be}) r1 = syz_io_uring_setup(0x8fe, &(0x7f0000000080)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, r0}, &(0x7f0000ffb000/0x2000)=nil, &(0x7f0000ffb000/0x4000)=nil, &(0x7f0000000100), &(0x7f0000000140)=0x0) r3 = openat$hwrng(0xffffffffffffff9c, &(0x7f0000000180), 0x2, 0x0) r4 = syz_io_uring_setup(0x65dd, &(0x7f00000001c0)={0x0, 0xf46f, 0x20, 0x2, 0xdf}, &(0x7f0000ffe000/0x1000)=nil, &(0x7f0000ffd000/0x1000)=nil, &(0x7f0000000240), &(0x7f0000000280)) r5 = syz_genetlink_get_family_id$mptcp(&(0x7f0000000300), r3) sendmsg$MPTCP_PM_CMD_ADD_ADDR(r3, &(0x7f00000003c0)={&(0x7f00000002c0)={0x10, 0x0, 0x0, 0x10}, 0xc, &(0x7f0000000380)={&(0x7f0000000340)={0x24, r5, 0x300, 0x70bd26, 0x25dfdbfb, {}, [@MPTCP_PM_ATTR_SUBFLOWS={0x8, 0x3, 0x1}, @MPTCP_PM_ATTR_RCV_ADD_ADDRS={0x8, 0x2, 0x2}]}, 0x24}, 0x1, 0x0, 0x0, 0x20000004}, 0x8890) r6 = openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000500)='./cgroup/syz1\x00', 0x200002, 0x0) syz_io_uring_submit(0x0, r2, &(0x7f0000000580)=@IORING_OP_FILES_UPDATE={0x14, 0x4, 0x0, 0x0, 0x40, &(0x7f0000000540)=[r4, 0xffffffffffffffff, r6, r0, r1], 0x5}, 0x3) socket$inet6_tcp(0xa, 0x1, 0x0) openat$procfs(0xffffffffffffff9c, &(0x7f00000010c0)='/proc/crypto\x00', 0x0, 0x0) 21:20:52 executing program 3: r0 = io_uring_setup(0x355e, &(0x7f0000000000)={0x0, 0x0, 0x20, 0x1, 0x1be}) r1 = syz_io_uring_setup(0x8fe, &(0x7f0000000080), &(0x7f0000ffb000/0x2000)=nil, &(0x7f0000ffb000/0x4000)=nil, &(0x7f0000000100), 0x0) r2 = openat$hwrng(0xffffffffffffff9c, &(0x7f0000000180), 0x2, 0x0) syz_genetlink_get_family_id$mptcp(&(0x7f0000000300), r2) r3 = openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000500)='./cgroup/syz1\x00', 0x200002, 0x0) syz_io_uring_submit(0x0, 0x0, &(0x7f0000000580)=@IORING_OP_FILES_UPDATE={0x14, 0x4, 0x0, 0x0, 0x40, &(0x7f0000000540)=[0xffffffffffffffff, 0xffffffffffffffff, r3, r0, r1], 0x5}, 0x3) io_uring_setup(0x2812, &(0x7f00000005c0)={0x0, 0x5e1b, 0x2, 0x3, 0x12f}) socket$inet6_tcp(0xa, 0x1, 0x0) io_uring_setup(0x7c8f, &(0x7f0000001140)={0x0, 0xc240, 0x10, 0x3, 0x1c7}) 21:20:52 executing program 6: r0 = io_uring_setup(0x355e, &(0x7f0000000000)={0x0, 0x0, 0x20, 0x0, 0x1be}) r1 = syz_io_uring_setup(0x8fe, &(0x7f0000000080)={0x0, 0x1830, 0x0, 0x0, 0x0, 0x0, r0}, &(0x7f0000ffb000/0x2000)=nil, &(0x7f0000ffb000/0x4000)=nil, &(0x7f0000000100), &(0x7f0000000140)=0x0) r3 = openat$hwrng(0xffffffffffffff9c, 0x0, 0x2, 0x0) r4 = syz_genetlink_get_family_id$mptcp(&(0x7f0000000300), r3) sendmsg$MPTCP_PM_CMD_ADD_ADDR(r3, &(0x7f00000003c0)={&(0x7f00000002c0)={0x10, 0x0, 0x0, 0x10}, 0xc, &(0x7f0000000380)={&(0x7f0000000340)={0x24, r4, 0x300, 0x70bd26, 0x25dfdbfb, {}, [@MPTCP_PM_ATTR_SUBFLOWS={0x8, 0x3, 0x1}, @MPTCP_PM_ATTR_RCV_ADD_ADDRS={0x8, 0x2, 0x2}]}, 0x24}, 0x1, 0x0, 0x0, 0x20000004}, 0x8890) syz_io_uring_setup(0x20f8, &(0x7f0000000400)={0x0, 0x7677, 0x8, 0x3, 0x22f}, &(0x7f0000ffe000/0x2000)=nil, &(0x7f0000ffb000/0x2000)=nil, &(0x7f0000000480)=0x0, &(0x7f00000004c0)) r6 = openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000500)='./cgroup/syz1\x00', 0x200002, 0x0) syz_io_uring_submit(r5, r2, &(0x7f0000000580)=@IORING_OP_FILES_UPDATE={0x14, 0x4, 0x0, 0x0, 0x40, &(0x7f0000000540)=[0xffffffffffffffff, 0xffffffffffffffff, r6, r0, r1], 0x5}, 0x3) socket$inet6_tcp(0xa, 0x1, 0x0) openat$procfs(0xffffffffffffff9c, &(0x7f00000010c0)='/proc/crypto\x00', 0x0, 0x0) io_uring_setup(0x7c8f, &(0x7f0000001140)={0x0, 0xc240, 0x10, 0x3, 0x1c7}) 21:20:52 executing program 7: io_uring_setup(0x355e, &(0x7f0000000000)={0x0, 0x0, 0x20, 0x1, 0x1be}) openat$hwrng(0xffffffffffffff9c, &(0x7f0000000180), 0x2, 0x0) openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000500)='./cgroup/syz1\x00', 0x200002, 0x0) 21:20:52 executing program 2: r0 = syz_io_uring_setup(0x8fe, &(0x7f0000000080), &(0x7f0000ffb000/0x2000)=nil, &(0x7f0000ffb000/0x4000)=nil, &(0x7f0000000100), &(0x7f0000000140)) openat$hwrng(0xffffffffffffff9c, &(0x7f0000000180), 0x0, 0x0) r1 = openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000500)='./cgroup/syz1\x00', 0x200002, 0x0) syz_io_uring_submit(0x0, 0x0, &(0x7f0000000580)=@IORING_OP_FILES_UPDATE={0x14, 0x4, 0x0, 0x0, 0x40, &(0x7f0000000540)=[0xffffffffffffffff, 0xffffffffffffffff, r1, 0xffffffffffffffff, r0], 0x5}, 0x3) io_uring_setup(0x2812, &(0x7f00000005c0)={0x0, 0x5e1b, 0x2, 0x3, 0x12f}) 21:20:52 executing program 0: syz_io_uring_setup(0x8fe, 0x0, &(0x7f0000ffb000/0x2000)=nil, &(0x7f0000ffb000/0x4000)=nil, &(0x7f0000000100), &(0x7f0000000140)) openat$hwrng(0xffffffffffffff9c, &(0x7f0000000180), 0x2, 0x0) openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000500)='./cgroup/syz1\x00', 0x200002, 0x0) syz_io_uring_submit(0x0, 0x0, 0x0, 0x0) io_uring_setup(0x2812, &(0x7f00000005c0)={0x0, 0x0, 0x2}) [ 582.050012] kmemleak: Found object by alias at 0x607f1a6398ac [ 582.050037] CPU: 1 UID: 0 PID: 7220 Comm: iou-sqp-7218 Tainted: G W 6.17.0-rc3-next-20250829 #1 PREEMPT(voluntary) [ 582.050059] Tainted: [W]=WARN [ 582.050064] Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.12.0-1 04/01/2014 [ 582.050073] Call Trace: [ 582.050078] [ 582.050084] dump_stack_lvl+0xca/0x120 [ 582.050122] __lookup_object+0x94/0xb0 [ 582.050144] delete_object_full+0x27/0x70 [ 582.050164] free_percpu+0x30/0x1160 [ 582.050184] ? arch_uprobe_clear_state+0x16/0x140 [ 582.050209] futex_hash_free+0x38/0xc0 [ 582.050227] mmput+0x2d3/0x390 [ 582.050250] do_exit+0x79d/0x2970 [ 582.050269] ? __pfx_try_to_wake_up+0x10/0x10 [ 582.050292] ? __pfx_do_exit+0x10/0x10 [ 582.050307] ? io_sq_thread+0xfbd/0x1b00 [ 582.050328] ? lock_release+0xc8/0x290 [ 582.050349] io_sq_thread+0xfc9/0x1b00 [ 582.050375] ? __pfx_io_sq_thread+0x10/0x10 [ 582.050396] ? __lock_acquire+0xc65/0x1b70 [ 582.050412] ? __pfx_autoremove_wake_function+0x10/0x10 [ 582.050431] ? __lock_acquire+0xc65/0x1b70 [ 582.050456] ? do_raw_spin_lock+0x123/0x260 [ 582.050476] ? find_held_lock+0x2b/0x80 [ 582.050496] ? __pfx_io_sq_thread+0x10/0x10 [ 582.050515] ? lock_release+0xc8/0x290 [ 582.050531] ? __pfx_io_sq_thread+0x10/0x10 [ 582.050551] ret_from_fork+0x34b/0x430 [ 582.050573] ? __pfx_io_sq_thread+0x10/0x10 [ 582.050592] ret_from_fork_asm+0x1a/0x30 [ 582.050621] [ 582.050626] kmemleak: Object (percpu) 0x607f1a6398a8 (size 8): [ 582.050634] kmemleak: comm "syz-executor.2", pid 7230, jiffies 4295248900 [ 582.050643] kmemleak: min_count = 1 [ 582.050648] kmemleak: count = 0 [ 582.050653] kmemleak: flags = 0x21 [ 582.050658] kmemleak: checksum = 0 [ 582.050662] kmemleak: backtrace: [ 582.050667] pcpu_alloc_noprof+0x87a/0x1170 [ 582.050685] percpu_ref_init+0x37/0x400 [ 582.050707] io_uring_setup+0x44c/0x2000 [ 582.050721] __x64_sys_io_uring_setup+0xc8/0x170 [ 582.050735] do_syscall_64+0xbf/0x360 [ 582.050747] entry_SYSCALL_64_after_hwframe+0x77/0x7f 21:20:52 executing program 1: r0 = io_uring_setup(0x355e, &(0x7f0000000000)={0x0, 0x0, 0x20, 0x1, 0x1be}) r1 = openat$hwrng(0xffffffffffffff9c, &(0x7f0000000180), 0x2, 0x0) r2 = syz_io_uring_setup(0x65dd, &(0x7f00000001c0)={0x0, 0x0, 0x20, 0x2}, &(0x7f0000ffe000/0x1000)=nil, &(0x7f0000ffd000/0x1000)=nil, &(0x7f0000000240), &(0x7f0000000280)) syz_genetlink_get_family_id$mptcp(0x0, r1) syz_io_uring_setup(0x20f8, &(0x7f0000000400)={0x0, 0x7677, 0x8, 0x3, 0x22f, 0x0, r2}, &(0x7f0000ffe000/0x2000)=nil, &(0x7f0000ffb000/0x2000)=nil, &(0x7f0000000480)=0x0, &(0x7f00000004c0)) r4 = openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000500)='./cgroup/syz1\x00', 0x200002, 0x0) syz_io_uring_submit(r3, 0x0, &(0x7f0000000580)=@IORING_OP_FILES_UPDATE={0x14, 0x4, 0x0, 0x0, 0x40, &(0x7f0000000540)=[r2, 0xffffffffffffffff, r4, r0, 0xffffffffffffffff], 0x5}, 0x3) io_uring_setup(0x2812, &(0x7f00000005c0)={0x0, 0x5e1b, 0x2, 0x3, 0x12f, 0x0, r2}) socket$inet6_tcp(0xa, 0x1, 0x0) openat$procfs(0xffffffffffffff9c, &(0x7f00000010c0)='/proc/crypto\x00', 0x0, 0x0) io_uring_setup(0x7c8f, &(0x7f0000001140)={0x0, 0xc240, 0x10, 0x3, 0x1c7, 0x0, r2}) 21:20:52 executing program 2: syz_io_uring_setup(0x8fe, &(0x7f0000000080), &(0x7f0000ffb000/0x2000)=nil, &(0x7f0000ffb000/0x4000)=nil, &(0x7f0000000100), &(0x7f0000000140)) openat$hwrng(0xffffffffffffff9c, &(0x7f0000000180), 0x0, 0x0) openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000500)='./cgroup/syz1\x00', 0x200002, 0x0) syz_io_uring_submit(0x0, 0x0, 0x0, 0x3) io_uring_setup(0x2812, &(0x7f00000005c0)={0x0, 0x5e1b, 0x2, 0x3, 0x12f}) 21:20:52 executing program 3: r0 = io_uring_setup(0x355e, &(0x7f0000000000)={0x0, 0x0, 0x20, 0x1, 0x1be}) r1 = syz_io_uring_setup(0x8fe, &(0x7f0000000080), &(0x7f0000ffb000/0x2000)=nil, &(0x7f0000ffb000/0x4000)=nil, &(0x7f0000000100), 0x0) r2 = openat$hwrng(0xffffffffffffff9c, &(0x7f0000000180), 0x2, 0x0) syz_genetlink_get_family_id$mptcp(&(0x7f0000000300), r2) r3 = openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000500)='./cgroup/syz1\x00', 0x200002, 0x0) syz_io_uring_submit(0x0, 0x0, &(0x7f0000000580)=@IORING_OP_FILES_UPDATE={0x14, 0x4, 0x0, 0x0, 0x40, &(0x7f0000000540)=[0xffffffffffffffff, 0xffffffffffffffff, r3, r0, r1], 0x5}, 0x3) io_uring_setup(0x2812, &(0x7f00000005c0)={0x0, 0x5e1b, 0x2, 0x3, 0x12f}) socket$inet6_tcp(0xa, 0x1, 0x0) io_uring_setup(0x7c8f, &(0x7f0000001140)={0x0, 0xc240, 0x10, 0x3, 0x1c7}) 21:20:52 executing program 7: io_uring_setup(0x355e, &(0x7f0000000000)={0x0, 0x0, 0x20, 0x1, 0x1be}) openat$hwrng(0xffffffffffffff9c, &(0x7f0000000180), 0x2, 0x0) openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000500)='./cgroup/syz1\x00', 0x200002, 0x0) 21:20:52 executing program 4: ioctl$SCSI_IOCTL_DOORUNLOCK(0xffffffffffffffff, 0x5381) r0 = syz_open_dev$mouse(&(0x7f0000000000), 0x578, 0x4000) ioctl$SG_GET_PACK_ID(r0, 0x227c, &(0x7f0000000040)) syz_genetlink_get_family_id$nl80211(&(0x7f00000000c0), 0xffffffffffffffff) syz_open_dev$vcsa(&(0x7f0000000440), 0x56, 0x4000) socketpair(0x0, 0x0, 0x6, &(0x7f0000000640)) r1 = openat$tcp_congestion(0xffffffffffffff9c, &(0x7f0000000800), 0x1, 0x0) write$tcp_congestion(r1, &(0x7f0000000840)='htcp\x00', 0x5) 21:20:52 executing program 5: r0 = io_uring_setup(0x355e, &(0x7f0000000000)={0x0, 0x0, 0x20, 0x0, 0x1be}) r1 = syz_io_uring_setup(0x8fe, &(0x7f0000000080)={0x0, 0x0, 0x0, 0x0, 0x1b8}, &(0x7f0000ffb000/0x2000)=nil, &(0x7f0000ffb000/0x4000)=nil, &(0x7f0000000100), &(0x7f0000000140)=0x0) r3 = openat$hwrng(0xffffffffffffff9c, &(0x7f0000000180), 0x2, 0x0) r4 = syz_io_uring_setup(0x65dd, &(0x7f00000001c0)={0x0, 0xf46f, 0x20, 0x2, 0xdf}, &(0x7f0000ffe000/0x1000)=nil, &(0x7f0000ffd000/0x1000)=nil, &(0x7f0000000240), &(0x7f0000000280)) r5 = syz_genetlink_get_family_id$mptcp(&(0x7f0000000300), r3) sendmsg$MPTCP_PM_CMD_ADD_ADDR(r3, &(0x7f00000003c0)={&(0x7f00000002c0)={0x10, 0x0, 0x0, 0x10}, 0xc, &(0x7f0000000380)={&(0x7f0000000340)={0x24, r5, 0x300, 0x70bd26, 0x25dfdbfb, {}, [@MPTCP_PM_ATTR_SUBFLOWS={0x8, 0x3, 0x1}, @MPTCP_PM_ATTR_RCV_ADD_ADDRS={0x8, 0x2, 0x2}]}, 0x24}, 0x1, 0x0, 0x0, 0x20000004}, 0x8890) r6 = openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000500)='./cgroup/syz1\x00', 0x200002, 0x0) syz_io_uring_submit(0x0, r2, &(0x7f0000000580)=@IORING_OP_FILES_UPDATE={0x14, 0x4, 0x0, 0x0, 0x40, &(0x7f0000000540)=[r4, 0xffffffffffffffff, r6, r0, r1], 0x5}, 0x3) socket$inet6_tcp(0xa, 0x1, 0x0) openat$procfs(0xffffffffffffff9c, &(0x7f00000010c0)='/proc/crypto\x00', 0x0, 0x0) 21:21:02 executing program 7: io_uring_setup(0x355e, &(0x7f0000000000)={0x0, 0x0, 0x20, 0x1, 0x1be}) openat$hwrng(0xffffffffffffff9c, &(0x7f0000000180), 0x2, 0x0) openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000500)='./cgroup/syz1\x00', 0x200002, 0x0) 21:21:02 executing program 2: syz_io_uring_setup(0x8fe, &(0x7f0000000080), &(0x7f0000ffb000/0x2000)=nil, &(0x7f0000ffb000/0x4000)=nil, &(0x7f0000000100), &(0x7f0000000140)) openat$hwrng(0xffffffffffffff9c, &(0x7f0000000180), 0x0, 0x0) openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000500)='./cgroup/syz1\x00', 0x200002, 0x0) syz_io_uring_submit(0x0, 0x0, 0x0, 0x3) io_uring_setup(0x2812, &(0x7f00000005c0)={0x0, 0x5e1b, 0x2, 0x3, 0x12f}) 21:21:02 executing program 4: ioctl$SCSI_IOCTL_DOORUNLOCK(0xffffffffffffffff, 0x5381) r0 = syz_open_dev$mouse(&(0x7f0000000000), 0x578, 0x4000) ioctl$SG_GET_PACK_ID(r0, 0x227c, &(0x7f0000000040)) syz_genetlink_get_family_id$nl80211(&(0x7f00000000c0), 0xffffffffffffffff) syz_open_dev$vcsa(&(0x7f0000000440), 0x56, 0x4000) socketpair(0x0, 0x0, 0x6, &(0x7f0000000640)) r1 = openat$tcp_congestion(0xffffffffffffff9c, &(0x7f0000000800), 0x1, 0x0) write$tcp_congestion(r1, &(0x7f0000000840)='htcp\x00', 0x5) 21:21:02 executing program 3: r0 = io_uring_setup(0x355e, &(0x7f0000000000)={0x0, 0x0, 0x20, 0x1, 0x1be}) r1 = syz_io_uring_setup(0x8fe, &(0x7f0000000080), &(0x7f0000ffb000/0x2000)=nil, &(0x7f0000ffb000/0x4000)=nil, &(0x7f0000000100), 0x0) r2 = openat$hwrng(0xffffffffffffff9c, &(0x7f0000000180), 0x2, 0x0) syz_genetlink_get_family_id$mptcp(&(0x7f0000000300), r2) r3 = openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000500)='./cgroup/syz1\x00', 0x200002, 0x0) syz_io_uring_submit(0x0, 0x0, &(0x7f0000000580)=@IORING_OP_FILES_UPDATE={0x14, 0x4, 0x0, 0x0, 0x40, &(0x7f0000000540)=[0xffffffffffffffff, 0xffffffffffffffff, r3, r0, r1], 0x5}, 0x3) io_uring_setup(0x2812, &(0x7f00000005c0)={0x0, 0x5e1b, 0x2, 0x3, 0x12f}) socket$inet6_tcp(0xa, 0x1, 0x0) io_uring_setup(0x7c8f, &(0x7f0000001140)={0x0, 0xc240, 0x10, 0x3, 0x1c7}) 21:21:02 executing program 0: syz_io_uring_setup(0x8fe, 0x0, &(0x7f0000ffb000/0x2000)=nil, &(0x7f0000ffb000/0x4000)=nil, &(0x7f0000000100), &(0x7f0000000140)) openat$hwrng(0xffffffffffffff9c, &(0x7f0000000180), 0x2, 0x0) openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000500)='./cgroup/syz1\x00', 0x200002, 0x0) syz_io_uring_submit(0x0, 0x0, 0x0, 0x0) io_uring_setup(0x2812, &(0x7f00000005c0)={0x0, 0x0, 0x2}) 21:21:02 executing program 5: r0 = io_uring_setup(0x355e, &(0x7f0000000000)={0x0, 0x0, 0x20, 0x0, 0x1be}) r1 = syz_io_uring_setup(0x8fe, &(0x7f0000000080)={0x0, 0x0, 0x0, 0x0, 0x1b8}, &(0x7f0000ffb000/0x2000)=nil, &(0x7f0000ffb000/0x4000)=nil, &(0x7f0000000100), &(0x7f0000000140)=0x0) r3 = openat$hwrng(0xffffffffffffff9c, &(0x7f0000000180), 0x2, 0x0) r4 = syz_io_uring_setup(0x65dd, &(0x7f00000001c0)={0x0, 0xf46f, 0x20, 0x2, 0xdf}, &(0x7f0000ffe000/0x1000)=nil, &(0x7f0000ffd000/0x1000)=nil, &(0x7f0000000240), &(0x7f0000000280)) r5 = syz_genetlink_get_family_id$mptcp(&(0x7f0000000300), r3) sendmsg$MPTCP_PM_CMD_ADD_ADDR(r3, &(0x7f00000003c0)={&(0x7f00000002c0)={0x10, 0x0, 0x0, 0x10}, 0xc, &(0x7f0000000380)={&(0x7f0000000340)={0x24, r5, 0x300, 0x70bd26, 0x25dfdbfb, {}, [@MPTCP_PM_ATTR_SUBFLOWS={0x8, 0x3, 0x1}, @MPTCP_PM_ATTR_RCV_ADD_ADDRS={0x8, 0x2, 0x2}]}, 0x24}, 0x1, 0x0, 0x0, 0x20000004}, 0x8890) r6 = openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000500)='./cgroup/syz1\x00', 0x200002, 0x0) syz_io_uring_submit(0x0, r2, &(0x7f0000000580)=@IORING_OP_FILES_UPDATE={0x14, 0x4, 0x0, 0x0, 0x40, &(0x7f0000000540)=[r4, 0xffffffffffffffff, r6, r0, r1], 0x5}, 0x3) socket$inet6_tcp(0xa, 0x1, 0x0) openat$procfs(0xffffffffffffff9c, &(0x7f00000010c0)='/proc/crypto\x00', 0x0, 0x0) 21:21:02 executing program 1: r0 = io_uring_setup(0x355e, &(0x7f0000000000)={0x0, 0x0, 0x20, 0x1, 0x1be}) openat$hwrng(0xffffffffffffff9c, &(0x7f0000000180), 0x2, 0x0) r1 = syz_io_uring_setup(0x65dd, &(0x7f00000001c0)={0x0, 0x0, 0x20, 0x2}, &(0x7f0000ffe000/0x1000)=nil, &(0x7f0000ffd000/0x1000)=nil, &(0x7f0000000240), &(0x7f0000000280)) syz_genetlink_get_family_id$mptcp(&(0x7f0000000300), 0xffffffffffffffff) syz_io_uring_setup(0x20f8, &(0x7f0000000400)={0x0, 0x7677, 0x8, 0x3, 0x22f, 0x0, r1}, &(0x7f0000ffe000/0x2000)=nil, &(0x7f0000ffb000/0x2000)=nil, &(0x7f0000000480)=0x0, &(0x7f00000004c0)) r3 = openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000500)='./cgroup/syz1\x00', 0x200002, 0x0) syz_io_uring_submit(r2, 0x0, &(0x7f0000000580)=@IORING_OP_FILES_UPDATE={0x14, 0x4, 0x0, 0x0, 0x40, &(0x7f0000000540)=[r1, 0xffffffffffffffff, r3, r0, 0xffffffffffffffff], 0x5}, 0x3) io_uring_setup(0x2812, &(0x7f00000005c0)={0x0, 0x5e1b, 0x2, 0x3, 0x12f, 0x0, r1}) socket$inet6_tcp(0xa, 0x1, 0x0) openat$procfs(0xffffffffffffff9c, &(0x7f00000010c0)='/proc/crypto\x00', 0x0, 0x0) io_uring_setup(0x7c8f, &(0x7f0000001140)={0x0, 0xc240, 0x10, 0x3, 0x1c7, 0x0, r1}) 21:21:02 executing program 6: r0 = io_uring_setup(0x355e, &(0x7f0000000000)={0x0, 0x0, 0x20, 0x0, 0x1be}) r1 = syz_io_uring_setup(0x8fe, &(0x7f0000000080)={0x0, 0x1830, 0x0, 0x0, 0x0, 0x0, r0}, &(0x7f0000ffb000/0x2000)=nil, &(0x7f0000ffb000/0x4000)=nil, &(0x7f0000000100), &(0x7f0000000140)=0x0) r3 = openat$hwrng(0xffffffffffffff9c, 0x0, 0x2, 0x0) r4 = syz_genetlink_get_family_id$mptcp(&(0x7f0000000300), r3) sendmsg$MPTCP_PM_CMD_ADD_ADDR(r3, &(0x7f00000003c0)={&(0x7f00000002c0)={0x10, 0x0, 0x0, 0x10}, 0xc, &(0x7f0000000380)={&(0x7f0000000340)={0x24, r4, 0x300, 0x70bd26, 0x25dfdbfb, {}, [@MPTCP_PM_ATTR_SUBFLOWS={0x8, 0x3, 0x1}, @MPTCP_PM_ATTR_RCV_ADD_ADDRS={0x8, 0x2, 0x2}]}, 0x24}, 0x1, 0x0, 0x0, 0x20000004}, 0x8890) syz_io_uring_setup(0x20f8, &(0x7f0000000400)={0x0, 0x7677, 0x8, 0x3, 0x22f}, &(0x7f0000ffe000/0x2000)=nil, &(0x7f0000ffb000/0x2000)=nil, &(0x7f0000000480)=0x0, &(0x7f00000004c0)) r6 = openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000500)='./cgroup/syz1\x00', 0x200002, 0x0) syz_io_uring_submit(r5, r2, &(0x7f0000000580)=@IORING_OP_FILES_UPDATE={0x14, 0x4, 0x0, 0x0, 0x40, &(0x7f0000000540)=[0xffffffffffffffff, 0xffffffffffffffff, r6, r0, r1], 0x5}, 0x3) socket$inet6_tcp(0xa, 0x1, 0x0) openat$procfs(0xffffffffffffff9c, &(0x7f00000010c0)='/proc/crypto\x00', 0x0, 0x0) io_uring_setup(0x7c8f, &(0x7f0000001140)={0x0, 0xc240, 0x10, 0x3, 0x1c7}) 21:21:02 executing program 2: syz_io_uring_setup(0x8fe, &(0x7f0000000080), &(0x7f0000ffb000/0x2000)=nil, &(0x7f0000ffb000/0x4000)=nil, &(0x7f0000000100), &(0x7f0000000140)) openat$hwrng(0xffffffffffffff9c, &(0x7f0000000180), 0x0, 0x0) openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000500)='./cgroup/syz1\x00', 0x200002, 0x0) syz_io_uring_submit(0x0, 0x0, 0x0, 0x3) io_uring_setup(0x2812, &(0x7f00000005c0)={0x0, 0x5e1b, 0x2, 0x3, 0x12f}) 21:21:02 executing program 0: syz_io_uring_setup(0x8fe, 0x0, &(0x7f0000ffb000/0x2000)=nil, &(0x7f0000ffb000/0x4000)=nil, &(0x7f0000000100), &(0x7f0000000140)) openat$hwrng(0xffffffffffffff9c, &(0x7f0000000180), 0x2, 0x0) openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000500)='./cgroup/syz1\x00', 0x200002, 0x0) syz_io_uring_submit(0x0, 0x0, 0x0, 0x0) io_uring_setup(0x2812, &(0x7f00000005c0)={0x0, 0x0, 0x2}) 21:21:02 executing program 7: io_uring_setup(0x355e, &(0x7f0000000000)={0x0, 0x0, 0x20, 0x1, 0x1be}) openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000500)='./cgroup/syz1\x00', 0x200002, 0x0) 21:21:02 executing program 3: r0 = io_uring_setup(0x355e, &(0x7f0000000000)={0x0, 0x0, 0x20, 0x1, 0x1be}) r1 = syz_io_uring_setup(0x8fe, &(0x7f0000000080), &(0x7f0000ffb000/0x2000)=nil, &(0x7f0000ffb000/0x4000)=nil, &(0x7f0000000100), &(0x7f0000000140)=0x0) r3 = openat$hwrng(0xffffffffffffff9c, 0x0, 0x2, 0x0) syz_genetlink_get_family_id$mptcp(&(0x7f0000000300), r3) r4 = openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000500)='./cgroup/syz1\x00', 0x200002, 0x0) syz_io_uring_submit(0x0, r2, &(0x7f0000000580)=@IORING_OP_FILES_UPDATE={0x14, 0x4, 0x0, 0x0, 0x40, &(0x7f0000000540)=[0xffffffffffffffff, 0xffffffffffffffff, r4, r0, r1], 0x5}, 0x3) io_uring_setup(0x2812, &(0x7f00000005c0)={0x0, 0x5e1b, 0x2, 0x3, 0x12f}) socket$inet6_tcp(0xa, 0x1, 0x0) io_uring_setup(0x7c8f, &(0x7f0000001140)={0x0, 0xc240, 0x10, 0x3, 0x1c7}) 21:21:02 executing program 6: r0 = io_uring_setup(0x355e, &(0x7f0000000000)={0x0, 0x0, 0x20, 0x0, 0x1be}) r1 = syz_io_uring_setup(0x8fe, &(0x7f0000000080)={0x0, 0x1830, 0x0, 0x0, 0x0, 0x0, r0}, &(0x7f0000ffb000/0x2000)=nil, &(0x7f0000ffb000/0x4000)=nil, &(0x7f0000000100), &(0x7f0000000140)=0x0) r3 = openat$hwrng(0xffffffffffffff9c, 0x0, 0x2, 0x0) r4 = syz_genetlink_get_family_id$mptcp(&(0x7f0000000300), r3) sendmsg$MPTCP_PM_CMD_ADD_ADDR(r3, &(0x7f00000003c0)={&(0x7f00000002c0)={0x10, 0x0, 0x0, 0x10}, 0xc, &(0x7f0000000380)={&(0x7f0000000340)={0x24, r4, 0x300, 0x70bd26, 0x25dfdbfb, {}, [@MPTCP_PM_ATTR_SUBFLOWS={0x8, 0x3, 0x1}, @MPTCP_PM_ATTR_RCV_ADD_ADDRS={0x8, 0x2, 0x2}]}, 0x24}, 0x1, 0x0, 0x0, 0x20000004}, 0x8890) syz_io_uring_setup(0x20f8, &(0x7f0000000400)={0x0, 0x7677, 0x8, 0x3, 0x22f}, &(0x7f0000ffe000/0x2000)=nil, &(0x7f0000ffb000/0x2000)=nil, &(0x7f0000000480)=0x0, &(0x7f00000004c0)) r6 = openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000500)='./cgroup/syz1\x00', 0x200002, 0x0) syz_io_uring_submit(r5, r2, &(0x7f0000000580)=@IORING_OP_FILES_UPDATE={0x14, 0x4, 0x0, 0x0, 0x40, &(0x7f0000000540)=[0xffffffffffffffff, 0xffffffffffffffff, r6, r0, r1], 0x5}, 0x3) socket$inet6_tcp(0xa, 0x1, 0x0) openat$procfs(0xffffffffffffff9c, &(0x7f00000010c0)='/proc/crypto\x00', 0x0, 0x0) io_uring_setup(0x7c8f, &(0x7f0000001140)={0x0, 0xc240, 0x10, 0x3, 0x1c7}) 21:21:02 executing program 2: r0 = syz_io_uring_setup(0x8fe, &(0x7f0000000080), &(0x7f0000ffb000/0x2000)=nil, &(0x7f0000ffb000/0x4000)=nil, &(0x7f0000000100), &(0x7f0000000140)) openat$hwrng(0xffffffffffffff9c, &(0x7f0000000180), 0x0, 0x0) r1 = openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000500)='./cgroup/syz1\x00', 0x200002, 0x0) syz_io_uring_submit(0x0, 0x0, &(0x7f0000000580)=@IORING_OP_FILES_UPDATE={0x14, 0x0, 0x0, 0x0, 0x40, &(0x7f0000000540)=[0xffffffffffffffff, 0xffffffffffffffff, r1, 0xffffffffffffffff, r0], 0x5}, 0x3) io_uring_setup(0x2812, &(0x7f00000005c0)={0x0, 0x5e1b, 0x2, 0x3, 0x12f}) 21:21:02 executing program 7: openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000500)='./cgroup/syz1\x00', 0x200002, 0x0) 21:21:02 executing program 1: r0 = io_uring_setup(0x355e, &(0x7f0000000000)={0x0, 0x0, 0x20, 0x1, 0x1be}) openat$hwrng(0xffffffffffffff9c, &(0x7f0000000180), 0x2, 0x0) r1 = syz_io_uring_setup(0x65dd, &(0x7f00000001c0)={0x0, 0x0, 0x20, 0x2}, &(0x7f0000ffe000/0x1000)=nil, &(0x7f0000ffd000/0x1000)=nil, &(0x7f0000000240), &(0x7f0000000280)) syz_genetlink_get_family_id$mptcp(&(0x7f0000000300), 0xffffffffffffffff) syz_io_uring_setup(0x20f8, &(0x7f0000000400)={0x0, 0x7677, 0x8, 0x3, 0x22f, 0x0, r1}, &(0x7f0000ffe000/0x2000)=nil, &(0x7f0000ffb000/0x2000)=nil, &(0x7f0000000480)=0x0, &(0x7f00000004c0)) r3 = openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000500)='./cgroup/syz1\x00', 0x200002, 0x0) syz_io_uring_submit(r2, 0x0, &(0x7f0000000580)=@IORING_OP_FILES_UPDATE={0x14, 0x4, 0x0, 0x0, 0x40, &(0x7f0000000540)=[r1, 0xffffffffffffffff, r3, r0, 0xffffffffffffffff], 0x5}, 0x3) io_uring_setup(0x2812, &(0x7f00000005c0)={0x0, 0x5e1b, 0x2, 0x3, 0x12f, 0x0, r1}) socket$inet6_tcp(0xa, 0x1, 0x0) openat$procfs(0xffffffffffffff9c, &(0x7f00000010c0)='/proc/crypto\x00', 0x0, 0x0) io_uring_setup(0x7c8f, &(0x7f0000001140)={0x0, 0xc240, 0x10, 0x3, 0x1c7, 0x0, r1}) 21:21:02 executing program 4: ioctl$SCSI_IOCTL_DOORUNLOCK(0xffffffffffffffff, 0x5381) r0 = syz_open_dev$mouse(&(0x7f0000000000), 0x578, 0x4000) ioctl$SG_GET_PACK_ID(r0, 0x227c, &(0x7f0000000040)) syz_genetlink_get_family_id$nl80211(&(0x7f00000000c0), 0xffffffffffffffff) syz_open_dev$vcsa(&(0x7f0000000440), 0x56, 0x4000) socketpair(0x0, 0x3, 0x0, &(0x7f0000000640)) r1 = openat$tcp_congestion(0xffffffffffffff9c, &(0x7f0000000800), 0x1, 0x0) write$tcp_congestion(r1, &(0x7f0000000840)='htcp\x00', 0x5) 21:21:02 executing program 0: syz_io_uring_setup(0x8fe, &(0x7f0000000080), &(0x7f0000ffb000/0x2000)=nil, &(0x7f0000ffb000/0x4000)=nil, 0x0, &(0x7f0000000140)) openat$hwrng(0xffffffffffffff9c, &(0x7f0000000180), 0x2, 0x0) openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000500)='./cgroup/syz1\x00', 0x200002, 0x0) syz_io_uring_submit(0x0, 0x0, 0x0, 0x0) io_uring_setup(0x2812, &(0x7f00000005c0)={0x0, 0x0, 0x2}) 21:21:02 executing program 5: r0 = io_uring_setup(0x355e, &(0x7f0000000000)={0x0, 0x0, 0x20, 0x0, 0x1be}) r1 = syz_io_uring_setup(0x8fe, &(0x7f0000000080)={0x0, 0x0, 0x0, 0x0, 0x1b8}, &(0x7f0000ffb000/0x2000)=nil, &(0x7f0000ffb000/0x4000)=nil, 0x0, &(0x7f0000000140)=0x0) r3 = openat$hwrng(0xffffffffffffff9c, &(0x7f0000000180), 0x2, 0x0) r4 = syz_io_uring_setup(0x65dd, &(0x7f00000001c0)={0x0, 0xf46f, 0x20, 0x2, 0xdf}, &(0x7f0000ffe000/0x1000)=nil, &(0x7f0000ffd000/0x1000)=nil, &(0x7f0000000240), &(0x7f0000000280)) r5 = syz_genetlink_get_family_id$mptcp(&(0x7f0000000300), r3) sendmsg$MPTCP_PM_CMD_ADD_ADDR(r3, &(0x7f00000003c0)={&(0x7f00000002c0)={0x10, 0x0, 0x0, 0x10}, 0xc, &(0x7f0000000380)={&(0x7f0000000340)={0x24, r5, 0x300, 0x70bd26, 0x25dfdbfb, {}, [@MPTCP_PM_ATTR_SUBFLOWS={0x8, 0x3, 0x1}, @MPTCP_PM_ATTR_RCV_ADD_ADDRS={0x8, 0x2, 0x2}]}, 0x24}, 0x1, 0x0, 0x0, 0x20000004}, 0x8890) r6 = openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000500)='./cgroup/syz1\x00', 0x200002, 0x0) syz_io_uring_submit(0x0, r2, &(0x7f0000000580)=@IORING_OP_FILES_UPDATE={0x14, 0x4, 0x0, 0x0, 0x40, &(0x7f0000000540)=[r4, 0xffffffffffffffff, r6, r0, r1], 0x5}, 0x3) socket$inet6_tcp(0xa, 0x1, 0x0) openat$procfs(0xffffffffffffff9c, &(0x7f00000010c0)='/proc/crypto\x00', 0x0, 0x0) 21:21:02 executing program 7: openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000500)='./cgroup/syz1\x00', 0x200002, 0x0) 21:21:02 executing program 2: r0 = syz_io_uring_setup(0x8fe, &(0x7f0000000080), &(0x7f0000ffb000/0x2000)=nil, &(0x7f0000ffb000/0x4000)=nil, &(0x7f0000000100), &(0x7f0000000140)) openat$hwrng(0xffffffffffffff9c, &(0x7f0000000180), 0x0, 0x0) r1 = openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000500)='./cgroup/syz1\x00', 0x200002, 0x0) syz_io_uring_submit(0x0, 0x0, &(0x7f0000000580)=@IORING_OP_FILES_UPDATE={0x14, 0x0, 0x0, 0x0, 0x0, &(0x7f0000000540)=[0xffffffffffffffff, 0xffffffffffffffff, r1, 0xffffffffffffffff, r0], 0x5}, 0x3) io_uring_setup(0x2812, &(0x7f00000005c0)={0x0, 0x5e1b, 0x2, 0x3, 0x12f}) 21:21:02 executing program 7: openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000500)='./cgroup/syz1\x00', 0x200002, 0x0) 21:21:02 executing program 6: r0 = io_uring_setup(0x355e, &(0x7f0000000000)={0x0, 0x0, 0x20, 0x0, 0x1be}) r1 = syz_io_uring_setup(0x8fe, &(0x7f0000000080)={0x0, 0x1830, 0x0, 0x0, 0x0, 0x0, r0}, &(0x7f0000ffb000/0x2000)=nil, &(0x7f0000ffb000/0x4000)=nil, &(0x7f0000000100), &(0x7f0000000140)=0x0) r3 = openat$hwrng(0xffffffffffffff9c, &(0x7f0000000180), 0x0, 0x0) r4 = syz_genetlink_get_family_id$mptcp(&(0x7f0000000300), r3) sendmsg$MPTCP_PM_CMD_ADD_ADDR(r3, &(0x7f00000003c0)={&(0x7f00000002c0)={0x10, 0x0, 0x0, 0x10}, 0xc, &(0x7f0000000380)={&(0x7f0000000340)={0x24, r4, 0x300, 0x70bd26, 0x25dfdbfb, {}, [@MPTCP_PM_ATTR_SUBFLOWS={0x8, 0x3, 0x1}, @MPTCP_PM_ATTR_RCV_ADD_ADDRS={0x8, 0x2, 0x2}]}, 0x24}, 0x1, 0x0, 0x0, 0x20000004}, 0x8890) syz_io_uring_setup(0x20f8, &(0x7f0000000400)={0x0, 0x7677, 0x8, 0x3, 0x22f}, &(0x7f0000ffe000/0x2000)=nil, &(0x7f0000ffb000/0x2000)=nil, &(0x7f0000000480)=0x0, &(0x7f00000004c0)) r6 = openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000500)='./cgroup/syz1\x00', 0x200002, 0x0) syz_io_uring_submit(r5, r2, &(0x7f0000000580)=@IORING_OP_FILES_UPDATE={0x14, 0x4, 0x0, 0x0, 0x40, &(0x7f0000000540)=[0xffffffffffffffff, 0xffffffffffffffff, r6, r0, r1], 0x5}, 0x3) socket$inet6_tcp(0xa, 0x1, 0x0) openat$procfs(0xffffffffffffff9c, &(0x7f00000010c0)='/proc/crypto\x00', 0x0, 0x0) io_uring_setup(0x7c8f, &(0x7f0000001140)={0x0, 0xc240, 0x10, 0x3, 0x1c7}) 21:21:02 executing program 0: syz_io_uring_setup(0x8fe, &(0x7f0000000080), &(0x7f0000ffb000/0x2000)=nil, &(0x7f0000ffb000/0x4000)=nil, 0x0, &(0x7f0000000140)) openat$hwrng(0xffffffffffffff9c, &(0x7f0000000180), 0x2, 0x0) openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000500)='./cgroup/syz1\x00', 0x200002, 0x0) syz_io_uring_submit(0x0, 0x0, 0x0, 0x0) io_uring_setup(0x2812, &(0x7f00000005c0)={0x0, 0x0, 0x2}) 21:21:02 executing program 5: r0 = io_uring_setup(0x355e, &(0x7f0000000000)={0x0, 0x0, 0x20, 0x0, 0x1be}) r1 = syz_io_uring_setup(0x8fe, &(0x7f0000000080)={0x0, 0x0, 0x0, 0x0, 0x1b8}, &(0x7f0000ffb000/0x2000)=nil, &(0x7f0000ffb000/0x4000)=nil, 0x0, &(0x7f0000000140)=0x0) r3 = openat$hwrng(0xffffffffffffff9c, &(0x7f0000000180), 0x2, 0x0) r4 = syz_io_uring_setup(0x65dd, &(0x7f00000001c0)={0x0, 0xf46f, 0x20, 0x2, 0xdf}, &(0x7f0000ffe000/0x1000)=nil, &(0x7f0000ffd000/0x1000)=nil, &(0x7f0000000240), &(0x7f0000000280)) r5 = syz_genetlink_get_family_id$mptcp(&(0x7f0000000300), r3) sendmsg$MPTCP_PM_CMD_ADD_ADDR(r3, &(0x7f00000003c0)={&(0x7f00000002c0)={0x10, 0x0, 0x0, 0x10}, 0xc, &(0x7f0000000380)={&(0x7f0000000340)={0x24, r5, 0x300, 0x70bd26, 0x25dfdbfb, {}, [@MPTCP_PM_ATTR_SUBFLOWS={0x8, 0x3, 0x1}, @MPTCP_PM_ATTR_RCV_ADD_ADDRS={0x8, 0x2, 0x2}]}, 0x24}, 0x1, 0x0, 0x0, 0x20000004}, 0x8890) r6 = openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000500)='./cgroup/syz1\x00', 0x200002, 0x0) syz_io_uring_submit(0x0, r2, &(0x7f0000000580)=@IORING_OP_FILES_UPDATE={0x14, 0x4, 0x0, 0x0, 0x40, &(0x7f0000000540)=[r4, 0xffffffffffffffff, r6, r0, r1], 0x5}, 0x3) socket$inet6_tcp(0xa, 0x1, 0x0) openat$procfs(0xffffffffffffff9c, &(0x7f00000010c0)='/proc/crypto\x00', 0x0, 0x0) 21:21:02 executing program 2: r0 = syz_io_uring_setup(0x8fe, &(0x7f0000000080), &(0x7f0000ffb000/0x2000)=nil, &(0x7f0000ffb000/0x4000)=nil, &(0x7f0000000100), &(0x7f0000000140)) openat$hwrng(0xffffffffffffff9c, &(0x7f0000000180), 0x0, 0x0) r1 = openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000500)='./cgroup/syz1\x00', 0x200002, 0x0) syz_io_uring_submit(0x0, 0x0, &(0x7f0000000580)=@IORING_OP_FILES_UPDATE={0x14, 0x0, 0x0, 0x0, 0x0, &(0x7f0000000540)=[0xffffffffffffffff, 0xffffffffffffffff, r1, 0xffffffffffffffff, r0], 0x5}, 0x3) io_uring_setup(0x2812, &(0x7f00000005c0)={0x0, 0x5e1b, 0x2, 0x3, 0x12f}) 21:21:11 executing program 1: r0 = io_uring_setup(0x355e, &(0x7f0000000000)={0x0, 0x0, 0x20, 0x1, 0x1be}) openat$hwrng(0xffffffffffffff9c, &(0x7f0000000180), 0x2, 0x0) r1 = syz_io_uring_setup(0x65dd, &(0x7f00000001c0)={0x0, 0x0, 0x20, 0x2}, &(0x7f0000ffe000/0x1000)=nil, &(0x7f0000ffd000/0x1000)=nil, &(0x7f0000000240), &(0x7f0000000280)) syz_genetlink_get_family_id$mptcp(&(0x7f0000000300), 0xffffffffffffffff) syz_io_uring_setup(0x20f8, &(0x7f0000000400)={0x0, 0x7677, 0x8, 0x3, 0x22f, 0x0, r1}, &(0x7f0000ffe000/0x2000)=nil, &(0x7f0000ffb000/0x2000)=nil, &(0x7f0000000480)=0x0, &(0x7f00000004c0)) r3 = openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000500)='./cgroup/syz1\x00', 0x200002, 0x0) syz_io_uring_submit(r2, 0x0, &(0x7f0000000580)=@IORING_OP_FILES_UPDATE={0x14, 0x4, 0x0, 0x0, 0x40, &(0x7f0000000540)=[r1, 0xffffffffffffffff, r3, r0, 0xffffffffffffffff], 0x5}, 0x3) io_uring_setup(0x2812, &(0x7f00000005c0)={0x0, 0x5e1b, 0x2, 0x3, 0x12f, 0x0, r1}) socket$inet6_tcp(0xa, 0x1, 0x0) openat$procfs(0xffffffffffffff9c, &(0x7f00000010c0)='/proc/crypto\x00', 0x0, 0x0) io_uring_setup(0x7c8f, &(0x7f0000001140)={0x0, 0xc240, 0x10, 0x3, 0x1c7, 0x0, r1}) 21:21:11 executing program 6: r0 = io_uring_setup(0x355e, &(0x7f0000000000)={0x0, 0x0, 0x20, 0x0, 0x1be}) r1 = syz_io_uring_setup(0x8fe, &(0x7f0000000080)={0x0, 0x1830, 0x0, 0x0, 0x0, 0x0, r0}, &(0x7f0000ffb000/0x2000)=nil, &(0x7f0000ffb000/0x4000)=nil, &(0x7f0000000100), &(0x7f0000000140)=0x0) r3 = openat$hwrng(0xffffffffffffff9c, &(0x7f0000000180), 0x0, 0x0) r4 = syz_genetlink_get_family_id$mptcp(&(0x7f0000000300), r3) sendmsg$MPTCP_PM_CMD_ADD_ADDR(r3, &(0x7f00000003c0)={&(0x7f00000002c0)={0x10, 0x0, 0x0, 0x10}, 0xc, &(0x7f0000000380)={&(0x7f0000000340)={0x24, r4, 0x300, 0x70bd26, 0x25dfdbfb, {}, [@MPTCP_PM_ATTR_SUBFLOWS={0x8, 0x3, 0x1}, @MPTCP_PM_ATTR_RCV_ADD_ADDRS={0x8, 0x2, 0x2}]}, 0x24}, 0x1, 0x0, 0x0, 0x20000004}, 0x8890) syz_io_uring_setup(0x20f8, &(0x7f0000000400)={0x0, 0x7677, 0x8, 0x3, 0x22f}, &(0x7f0000ffe000/0x2000)=nil, &(0x7f0000ffb000/0x2000)=nil, &(0x7f0000000480)=0x0, &(0x7f00000004c0)) r6 = openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000500)='./cgroup/syz1\x00', 0x200002, 0x0) syz_io_uring_submit(r5, r2, &(0x7f0000000580)=@IORING_OP_FILES_UPDATE={0x14, 0x4, 0x0, 0x0, 0x40, &(0x7f0000000540)=[0xffffffffffffffff, 0xffffffffffffffff, r6, r0, r1], 0x5}, 0x3) socket$inet6_tcp(0xa, 0x1, 0x0) openat$procfs(0xffffffffffffff9c, &(0x7f00000010c0)='/proc/crypto\x00', 0x0, 0x0) io_uring_setup(0x7c8f, &(0x7f0000001140)={0x0, 0xc240, 0x10, 0x3, 0x1c7}) 21:21:11 executing program 2: r0 = syz_io_uring_setup(0x8fe, &(0x7f0000000080), &(0x7f0000ffb000/0x2000)=nil, &(0x7f0000ffb000/0x4000)=nil, &(0x7f0000000100), &(0x7f0000000140)) openat$hwrng(0xffffffffffffff9c, &(0x7f0000000180), 0x0, 0x0) r1 = openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000500)='./cgroup/syz1\x00', 0x200002, 0x0) syz_io_uring_submit(0x0, 0x0, &(0x7f0000000580)=@IORING_OP_FILES_UPDATE={0x14, 0x0, 0x0, 0x0, 0x0, &(0x7f0000000540)=[0xffffffffffffffff, 0xffffffffffffffff, r1, 0xffffffffffffffff, r0], 0x5}, 0x3) io_uring_setup(0x2812, &(0x7f00000005c0)={0x0, 0x5e1b, 0x2, 0x3, 0x12f}) 21:21:11 executing program 0: syz_io_uring_setup(0x8fe, &(0x7f0000000080), &(0x7f0000ffb000/0x2000)=nil, &(0x7f0000ffb000/0x4000)=nil, 0x0, &(0x7f0000000140)) openat$hwrng(0xffffffffffffff9c, &(0x7f0000000180), 0x2, 0x0) openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000500)='./cgroup/syz1\x00', 0x200002, 0x0) syz_io_uring_submit(0x0, 0x0, 0x0, 0x0) io_uring_setup(0x2812, &(0x7f00000005c0)={0x0, 0x0, 0x2}) 21:21:11 executing program 4: ioctl$SCSI_IOCTL_DOORUNLOCK(0xffffffffffffffff, 0x5381) r0 = syz_open_dev$mouse(&(0x7f0000000000), 0x578, 0x4000) ioctl$SG_GET_PACK_ID(r0, 0x227c, &(0x7f0000000040)) syz_genetlink_get_family_id$nl80211(&(0x7f00000000c0), 0xffffffffffffffff) syz_open_dev$vcsa(&(0x7f0000000440), 0x56, 0x4000) socketpair(0x0, 0x3, 0x0, &(0x7f0000000640)) r1 = openat$tcp_congestion(0xffffffffffffff9c, &(0x7f0000000800), 0x1, 0x0) write$tcp_congestion(r1, &(0x7f0000000840)='htcp\x00', 0x5) 21:21:11 executing program 5: r0 = io_uring_setup(0x355e, &(0x7f0000000000)={0x0, 0x0, 0x20, 0x0, 0x1be}) r1 = syz_io_uring_setup(0x8fe, &(0x7f0000000080)={0x0, 0x0, 0x0, 0x0, 0x1b8}, &(0x7f0000ffb000/0x2000)=nil, &(0x7f0000ffb000/0x4000)=nil, 0x0, &(0x7f0000000140)=0x0) r3 = openat$hwrng(0xffffffffffffff9c, &(0x7f0000000180), 0x2, 0x0) r4 = syz_io_uring_setup(0x65dd, &(0x7f00000001c0)={0x0, 0xf46f, 0x20, 0x2, 0xdf}, &(0x7f0000ffe000/0x1000)=nil, &(0x7f0000ffd000/0x1000)=nil, &(0x7f0000000240), &(0x7f0000000280)) r5 = syz_genetlink_get_family_id$mptcp(&(0x7f0000000300), r3) sendmsg$MPTCP_PM_CMD_ADD_ADDR(r3, &(0x7f00000003c0)={&(0x7f00000002c0)={0x10, 0x0, 0x0, 0x10}, 0xc, &(0x7f0000000380)={&(0x7f0000000340)={0x24, r5, 0x300, 0x70bd26, 0x25dfdbfb, {}, [@MPTCP_PM_ATTR_SUBFLOWS={0x8, 0x3, 0x1}, @MPTCP_PM_ATTR_RCV_ADD_ADDRS={0x8, 0x2, 0x2}]}, 0x24}, 0x1, 0x0, 0x0, 0x20000004}, 0x8890) r6 = openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000500)='./cgroup/syz1\x00', 0x200002, 0x0) syz_io_uring_submit(0x0, r2, &(0x7f0000000580)=@IORING_OP_FILES_UPDATE={0x14, 0x4, 0x0, 0x0, 0x40, &(0x7f0000000540)=[r4, 0xffffffffffffffff, r6, r0, r1], 0x5}, 0x3) socket$inet6_tcp(0xa, 0x1, 0x0) openat$procfs(0xffffffffffffff9c, &(0x7f00000010c0)='/proc/crypto\x00', 0x0, 0x0) 21:21:11 executing program 7: io_uring_setup(0x0, &(0x7f0000000000)={0x0, 0x0, 0x20, 0x1, 0x1be}) openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000500)='./cgroup/syz1\x00', 0x200002, 0x0) 21:21:11 executing program 3: r0 = io_uring_setup(0x355e, &(0x7f0000000000)={0x0, 0x0, 0x20, 0x1, 0x1be}) r1 = syz_io_uring_setup(0x8fe, &(0x7f0000000080), &(0x7f0000ffb000/0x2000)=nil, &(0x7f0000ffb000/0x4000)=nil, &(0x7f0000000100), &(0x7f0000000140)=0x0) r3 = openat$hwrng(0xffffffffffffff9c, 0x0, 0x2, 0x0) syz_genetlink_get_family_id$mptcp(&(0x7f0000000300), r3) r4 = openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000500)='./cgroup/syz1\x00', 0x200002, 0x0) syz_io_uring_submit(0x0, r2, &(0x7f0000000580)=@IORING_OP_FILES_UPDATE={0x14, 0x4, 0x0, 0x0, 0x40, &(0x7f0000000540)=[0xffffffffffffffff, 0xffffffffffffffff, r4, r0, r1], 0x5}, 0x3) io_uring_setup(0x2812, &(0x7f00000005c0)={0x0, 0x5e1b, 0x2, 0x3, 0x12f}) socket$inet6_tcp(0xa, 0x1, 0x0) io_uring_setup(0x7c8f, &(0x7f0000001140)={0x0, 0xc240, 0x10, 0x3, 0x1c7}) 21:21:11 executing program 4: ioctl$SCSI_IOCTL_DOORUNLOCK(0xffffffffffffffff, 0x5381) r0 = syz_open_dev$mouse(&(0x7f0000000000), 0x578, 0x4000) ioctl$SG_GET_PACK_ID(r0, 0x227c, &(0x7f0000000040)) syz_genetlink_get_family_id$nl80211(&(0x7f00000000c0), 0xffffffffffffffff) syz_open_dev$vcsa(&(0x7f0000000440), 0x56, 0x4000) socketpair(0x0, 0x3, 0x0, &(0x7f0000000640)) r1 = openat$tcp_congestion(0xffffffffffffff9c, &(0x7f0000000800), 0x1, 0x0) write$tcp_congestion(r1, &(0x7f0000000840)='htcp\x00', 0x5) 21:21:11 executing program 3: r0 = io_uring_setup(0x355e, &(0x7f0000000000)={0x0, 0x0, 0x20, 0x1, 0x1be}) r1 = syz_io_uring_setup(0x8fe, &(0x7f0000000080), &(0x7f0000ffb000/0x2000)=nil, &(0x7f0000ffb000/0x4000)=nil, &(0x7f0000000100), &(0x7f0000000140)=0x0) r3 = openat$hwrng(0xffffffffffffff9c, 0x0, 0x2, 0x0) syz_genetlink_get_family_id$mptcp(&(0x7f0000000300), r3) r4 = openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000500)='./cgroup/syz1\x00', 0x200002, 0x0) syz_io_uring_submit(0x0, r2, &(0x7f0000000580)=@IORING_OP_FILES_UPDATE={0x14, 0x4, 0x0, 0x0, 0x40, &(0x7f0000000540)=[0xffffffffffffffff, 0xffffffffffffffff, r4, r0, r1], 0x5}, 0x3) io_uring_setup(0x2812, &(0x7f00000005c0)={0x0, 0x5e1b, 0x2, 0x3, 0x12f}) socket$inet6_tcp(0xa, 0x1, 0x0) io_uring_setup(0x7c8f, &(0x7f0000001140)={0x0, 0xc240, 0x10, 0x3, 0x1c7}) 21:21:11 executing program 1: r0 = io_uring_setup(0x355e, &(0x7f0000000000)={0x0, 0x0, 0x20, 0x1, 0x1be}) r1 = openat$hwrng(0xffffffffffffff9c, &(0x7f0000000180), 0x2, 0x0) r2 = syz_io_uring_setup(0x65dd, &(0x7f00000001c0)={0x0, 0x0, 0x20, 0x2}, &(0x7f0000ffe000/0x1000)=nil, &(0x7f0000ffd000/0x1000)=nil, &(0x7f0000000240), &(0x7f0000000280)) syz_genetlink_get_family_id$mptcp(&(0x7f0000000300), r1) syz_io_uring_setup(0x0, &(0x7f0000000400)={0x0, 0x7677, 0x8, 0x3, 0x22f, 0x0, r2}, &(0x7f0000ffe000/0x2000)=nil, &(0x7f0000ffb000/0x2000)=nil, &(0x7f0000000480)=0x0, &(0x7f00000004c0)) r4 = openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000500)='./cgroup/syz1\x00', 0x200002, 0x0) syz_io_uring_submit(r3, 0x0, &(0x7f0000000580)=@IORING_OP_FILES_UPDATE={0x14, 0x4, 0x0, 0x0, 0x40, &(0x7f0000000540)=[r2, 0xffffffffffffffff, r4, r0, 0xffffffffffffffff], 0x5}, 0x3) io_uring_setup(0x2812, &(0x7f00000005c0)={0x0, 0x5e1b, 0x2, 0x3, 0x12f, 0x0, r2}) socket$inet6_tcp(0xa, 0x1, 0x0) openat$procfs(0xffffffffffffff9c, &(0x7f00000010c0)='/proc/crypto\x00', 0x0, 0x0) io_uring_setup(0x7c8f, &(0x7f0000001140)={0x0, 0xc240, 0x10, 0x3, 0x1c7, 0x0, r2}) 21:21:11 executing program 7: io_uring_setup(0x0, &(0x7f0000000000)={0x0, 0x0, 0x20, 0x1, 0x1be}) openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000500)='./cgroup/syz1\x00', 0x200002, 0x0) 21:21:11 executing program 0: syz_io_uring_setup(0x8fe, &(0x7f0000000080), &(0x7f0000ffb000/0x2000)=nil, &(0x7f0000ffb000/0x4000)=nil, &(0x7f0000000100), 0x0) openat$hwrng(0xffffffffffffff9c, &(0x7f0000000180), 0x2, 0x0) openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000500)='./cgroup/syz1\x00', 0x200002, 0x0) syz_io_uring_submit(0x0, 0x0, 0x0, 0x0) io_uring_setup(0x2812, &(0x7f00000005c0)={0x0, 0x0, 0x2}) 21:21:11 executing program 2: syz_io_uring_setup(0x8fe, &(0x7f0000000080), &(0x7f0000ffb000/0x2000)=nil, &(0x7f0000ffb000/0x4000)=nil, &(0x7f0000000100), &(0x7f0000000140)) openat$hwrng(0xffffffffffffff9c, &(0x7f0000000180), 0x0, 0x0) openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000500)='./cgroup/syz1\x00', 0x200002, 0x0) syz_io_uring_submit(0x0, 0x0, &(0x7f0000000580)=@IORING_OP_FILES_UPDATE={0x14, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x3) io_uring_setup(0x2812, &(0x7f00000005c0)={0x0, 0x5e1b, 0x2, 0x3, 0x12f}) 21:21:19 executing program 3: r0 = io_uring_setup(0x355e, &(0x7f0000000000)={0x0, 0x0, 0x20, 0x1, 0x1be}) r1 = syz_io_uring_setup(0x8fe, &(0x7f0000000080), &(0x7f0000ffb000/0x2000)=nil, &(0x7f0000ffb000/0x4000)=nil, &(0x7f0000000100), &(0x7f0000000140)=0x0) r3 = openat$hwrng(0xffffffffffffff9c, &(0x7f0000000180), 0x0, 0x0) syz_genetlink_get_family_id$mptcp(&(0x7f0000000300), r3) r4 = openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000500)='./cgroup/syz1\x00', 0x200002, 0x0) syz_io_uring_submit(0x0, r2, &(0x7f0000000580)=@IORING_OP_FILES_UPDATE={0x14, 0x4, 0x0, 0x0, 0x40, &(0x7f0000000540)=[0xffffffffffffffff, 0xffffffffffffffff, r4, r0, r1], 0x5}, 0x3) io_uring_setup(0x2812, &(0x7f00000005c0)={0x0, 0x5e1b, 0x2, 0x3, 0x12f}) socket$inet6_tcp(0xa, 0x1, 0x0) io_uring_setup(0x7c8f, &(0x7f0000001140)={0x0, 0xc240, 0x10, 0x3, 0x1c7}) 21:21:19 executing program 4: ioctl$SCSI_IOCTL_DOORUNLOCK(0xffffffffffffffff, 0x5381) r0 = syz_open_dev$mouse(&(0x7f0000000000), 0x578, 0x4000) ioctl$SG_GET_PACK_ID(r0, 0x227c, &(0x7f0000000040)) syz_genetlink_get_family_id$nl80211(&(0x7f00000000c0), 0xffffffffffffffff) syz_open_dev$vcsa(&(0x7f0000000440), 0x56, 0x4000) socketpair(0x0, 0x3, 0x6, 0x0) r1 = openat$tcp_congestion(0xffffffffffffff9c, &(0x7f0000000800), 0x1, 0x0) write$tcp_congestion(r1, &(0x7f0000000840)='htcp\x00', 0x5) 21:21:19 executing program 6: r0 = io_uring_setup(0x355e, &(0x7f0000000000)={0x0, 0x0, 0x20, 0x0, 0x1be}) r1 = syz_io_uring_setup(0x8fe, &(0x7f0000000080)={0x0, 0x1830, 0x0, 0x0, 0x0, 0x0, r0}, &(0x7f0000ffb000/0x2000)=nil, &(0x7f0000ffb000/0x4000)=nil, &(0x7f0000000100), &(0x7f0000000140)=0x0) r3 = openat$hwrng(0xffffffffffffff9c, &(0x7f0000000180), 0x0, 0x0) r4 = syz_genetlink_get_family_id$mptcp(&(0x7f0000000300), r3) sendmsg$MPTCP_PM_CMD_ADD_ADDR(r3, &(0x7f00000003c0)={&(0x7f00000002c0)={0x10, 0x0, 0x0, 0x10}, 0xc, &(0x7f0000000380)={&(0x7f0000000340)={0x24, r4, 0x300, 0x70bd26, 0x25dfdbfb, {}, [@MPTCP_PM_ATTR_SUBFLOWS={0x8, 0x3, 0x1}, @MPTCP_PM_ATTR_RCV_ADD_ADDRS={0x8, 0x2, 0x2}]}, 0x24}, 0x1, 0x0, 0x0, 0x20000004}, 0x8890) syz_io_uring_setup(0x20f8, &(0x7f0000000400)={0x0, 0x7677, 0x8, 0x3, 0x22f}, &(0x7f0000ffe000/0x2000)=nil, &(0x7f0000ffb000/0x2000)=nil, &(0x7f0000000480)=0x0, &(0x7f00000004c0)) r6 = openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000500)='./cgroup/syz1\x00', 0x200002, 0x0) syz_io_uring_submit(r5, r2, &(0x7f0000000580)=@IORING_OP_FILES_UPDATE={0x14, 0x4, 0x0, 0x0, 0x40, &(0x7f0000000540)=[0xffffffffffffffff, 0xffffffffffffffff, r6, r0, r1], 0x5}, 0x3) socket$inet6_tcp(0xa, 0x1, 0x0) openat$procfs(0xffffffffffffff9c, &(0x7f00000010c0)='/proc/crypto\x00', 0x0, 0x0) io_uring_setup(0x7c8f, &(0x7f0000001140)={0x0, 0xc240, 0x10, 0x3, 0x1c7}) 21:21:19 executing program 7: io_uring_setup(0x0, &(0x7f0000000000)={0x0, 0x0, 0x20, 0x1, 0x1be}) openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000500)='./cgroup/syz1\x00', 0x200002, 0x0) 21:21:19 executing program 1: r0 = io_uring_setup(0x355e, &(0x7f0000000000)={0x0, 0x0, 0x20, 0x1, 0x1be}) r1 = openat$hwrng(0xffffffffffffff9c, &(0x7f0000000180), 0x2, 0x0) r2 = syz_io_uring_setup(0x65dd, &(0x7f00000001c0)={0x0, 0x0, 0x20, 0x2}, &(0x7f0000ffe000/0x1000)=nil, &(0x7f0000ffd000/0x1000)=nil, &(0x7f0000000240), &(0x7f0000000280)) syz_genetlink_get_family_id$mptcp(&(0x7f0000000300), r1) syz_io_uring_setup(0x0, &(0x7f0000000400)={0x0, 0x7677, 0x8, 0x3, 0x22f, 0x0, r2}, &(0x7f0000ffe000/0x2000)=nil, &(0x7f0000ffb000/0x2000)=nil, &(0x7f0000000480)=0x0, &(0x7f00000004c0)) r4 = openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000500)='./cgroup/syz1\x00', 0x200002, 0x0) syz_io_uring_submit(r3, 0x0, &(0x7f0000000580)=@IORING_OP_FILES_UPDATE={0x14, 0x4, 0x0, 0x0, 0x40, &(0x7f0000000540)=[r2, 0xffffffffffffffff, r4, r0, 0xffffffffffffffff], 0x5}, 0x3) io_uring_setup(0x2812, &(0x7f00000005c0)={0x0, 0x5e1b, 0x2, 0x3, 0x12f, 0x0, r2}) socket$inet6_tcp(0xa, 0x1, 0x0) openat$procfs(0xffffffffffffff9c, &(0x7f00000010c0)='/proc/crypto\x00', 0x0, 0x0) io_uring_setup(0x7c8f, &(0x7f0000001140)={0x0, 0xc240, 0x10, 0x3, 0x1c7, 0x0, r2}) 21:21:19 executing program 2: syz_io_uring_setup(0x8fe, &(0x7f0000000080), &(0x7f0000ffb000/0x2000)=nil, &(0x7f0000ffb000/0x4000)=nil, &(0x7f0000000100), &(0x7f0000000140)) openat$hwrng(0xffffffffffffff9c, &(0x7f0000000180), 0x0, 0x0) openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000500)='./cgroup/syz1\x00', 0x200002, 0x0) syz_io_uring_submit(0x0, 0x0, &(0x7f0000000580)=@IORING_OP_FILES_UPDATE={0x14, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x3) io_uring_setup(0x2812, &(0x7f00000005c0)={0x0, 0x5e1b, 0x2, 0x3, 0x12f}) 21:21:19 executing program 0: syz_io_uring_setup(0x8fe, &(0x7f0000000080), &(0x7f0000ffb000/0x2000)=nil, &(0x7f0000ffb000/0x4000)=nil, &(0x7f0000000100), 0x0) openat$hwrng(0xffffffffffffff9c, &(0x7f0000000180), 0x2, 0x0) openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000500)='./cgroup/syz1\x00', 0x200002, 0x0) syz_io_uring_submit(0x0, 0x0, 0x0, 0x0) io_uring_setup(0x2812, &(0x7f00000005c0)={0x0, 0x0, 0x2}) 21:21:19 executing program 5: r0 = io_uring_setup(0x355e, &(0x7f0000000000)={0x0, 0x0, 0x20, 0x0, 0x1be}) r1 = syz_io_uring_setup(0x8fe, &(0x7f0000000080)={0x0, 0x0, 0x0, 0x0, 0x1b8}, &(0x7f0000ffb000/0x2000)=nil, &(0x7f0000ffb000/0x4000)=nil, &(0x7f0000000100), 0x0) r2 = openat$hwrng(0xffffffffffffff9c, &(0x7f0000000180), 0x2, 0x0) r3 = syz_io_uring_setup(0x65dd, &(0x7f00000001c0)={0x0, 0xf46f, 0x20, 0x2, 0xdf}, &(0x7f0000ffe000/0x1000)=nil, &(0x7f0000ffd000/0x1000)=nil, &(0x7f0000000240), &(0x7f0000000280)) r4 = syz_genetlink_get_family_id$mptcp(&(0x7f0000000300), r2) sendmsg$MPTCP_PM_CMD_ADD_ADDR(r2, &(0x7f00000003c0)={&(0x7f00000002c0)={0x10, 0x0, 0x0, 0x10}, 0xc, &(0x7f0000000380)={&(0x7f0000000340)={0x24, r4, 0x300, 0x70bd26, 0x25dfdbfb, {}, [@MPTCP_PM_ATTR_SUBFLOWS={0x8, 0x3, 0x1}, @MPTCP_PM_ATTR_RCV_ADD_ADDRS={0x8, 0x2, 0x2}]}, 0x24}, 0x1, 0x0, 0x0, 0x20000004}, 0x8890) r5 = openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000500)='./cgroup/syz1\x00', 0x200002, 0x0) syz_io_uring_submit(0x0, 0x0, &(0x7f0000000580)=@IORING_OP_FILES_UPDATE={0x14, 0x4, 0x0, 0x0, 0x40, &(0x7f0000000540)=[r3, 0xffffffffffffffff, r5, r0, r1], 0x5}, 0x3) socket$inet6_tcp(0xa, 0x1, 0x0) openat$procfs(0xffffffffffffff9c, &(0x7f00000010c0)='/proc/crypto\x00', 0x0, 0x0) 21:21:19 executing program 0: syz_io_uring_setup(0x8fe, &(0x7f0000000080), &(0x7f0000ffb000/0x2000)=nil, &(0x7f0000ffb000/0x4000)=nil, &(0x7f0000000100), 0x0) openat$hwrng(0xffffffffffffff9c, &(0x7f0000000180), 0x2, 0x0) openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000500)='./cgroup/syz1\x00', 0x200002, 0x0) syz_io_uring_submit(0x0, 0x0, 0x0, 0x0) io_uring_setup(0x2812, &(0x7f00000005c0)={0x0, 0x0, 0x2}) 21:21:19 executing program 7: io_uring_setup(0x0, 0x0) openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000500)='./cgroup/syz1\x00', 0x200002, 0x0) 21:21:19 executing program 6: r0 = io_uring_setup(0x355e, &(0x7f0000000000)={0x0, 0x0, 0x20, 0x0, 0x1be}) r1 = syz_io_uring_setup(0x8fe, &(0x7f0000000080)={0x0, 0x1830, 0x0, 0x0, 0x0, 0x0, r0}, &(0x7f0000ffb000/0x2000)=nil, &(0x7f0000ffb000/0x4000)=nil, &(0x7f0000000100), &(0x7f0000000140)=0x0) r3 = openat$hwrng(0xffffffffffffff9c, &(0x7f0000000180), 0x2, 0x0) r4 = syz_genetlink_get_family_id$mptcp(0x0, r3) sendmsg$MPTCP_PM_CMD_ADD_ADDR(r3, &(0x7f00000003c0)={&(0x7f00000002c0)={0x10, 0x0, 0x0, 0x10}, 0xc, &(0x7f0000000380)={&(0x7f0000000340)={0x24, r4, 0x300, 0x70bd26, 0x25dfdbfb, {}, [@MPTCP_PM_ATTR_SUBFLOWS={0x8, 0x3, 0x1}, @MPTCP_PM_ATTR_RCV_ADD_ADDRS={0x8, 0x2, 0x2}]}, 0x24}, 0x1, 0x0, 0x0, 0x20000004}, 0x8890) syz_io_uring_setup(0x20f8, &(0x7f0000000400)={0x0, 0x7677, 0x8, 0x3, 0x22f}, &(0x7f0000ffe000/0x2000)=nil, &(0x7f0000ffb000/0x2000)=nil, &(0x7f0000000480)=0x0, &(0x7f00000004c0)) r6 = openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000500)='./cgroup/syz1\x00', 0x200002, 0x0) syz_io_uring_submit(r5, r2, &(0x7f0000000580)=@IORING_OP_FILES_UPDATE={0x14, 0x4, 0x0, 0x0, 0x40, &(0x7f0000000540)=[0xffffffffffffffff, 0xffffffffffffffff, r6, r0, r1], 0x5}, 0x3) socket$inet6_tcp(0xa, 0x1, 0x0) openat$procfs(0xffffffffffffff9c, &(0x7f00000010c0)='/proc/crypto\x00', 0x0, 0x0) io_uring_setup(0x7c8f, &(0x7f0000001140)={0x0, 0xc240, 0x10, 0x3, 0x1c7}) 21:21:19 executing program 2: syz_io_uring_setup(0x8fe, &(0x7f0000000080), &(0x7f0000ffb000/0x2000)=nil, &(0x7f0000ffb000/0x4000)=nil, &(0x7f0000000100), &(0x7f0000000140)) openat$hwrng(0xffffffffffffff9c, &(0x7f0000000180), 0x0, 0x0) openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000500)='./cgroup/syz1\x00', 0x200002, 0x0) syz_io_uring_submit(0x0, 0x0, &(0x7f0000000580)=@IORING_OP_FILES_UPDATE={0x14, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x3) io_uring_setup(0x2812, &(0x7f00000005c0)={0x0, 0x5e1b, 0x2, 0x3, 0x12f}) 21:21:29 executing program 5: r0 = io_uring_setup(0x355e, &(0x7f0000000000)={0x0, 0x0, 0x20, 0x0, 0x1be}) r1 = syz_io_uring_setup(0x8fe, &(0x7f0000000080)={0x0, 0x0, 0x0, 0x0, 0x1b8}, &(0x7f0000ffb000/0x2000)=nil, &(0x7f0000ffb000/0x4000)=nil, &(0x7f0000000100), 0x0) r2 = openat$hwrng(0xffffffffffffff9c, &(0x7f0000000180), 0x2, 0x0) r3 = syz_io_uring_setup(0x65dd, &(0x7f00000001c0)={0x0, 0xf46f, 0x20, 0x2, 0xdf}, &(0x7f0000ffe000/0x1000)=nil, &(0x7f0000ffd000/0x1000)=nil, &(0x7f0000000240), &(0x7f0000000280)) r4 = syz_genetlink_get_family_id$mptcp(&(0x7f0000000300), r2) sendmsg$MPTCP_PM_CMD_ADD_ADDR(r2, &(0x7f00000003c0)={&(0x7f00000002c0)={0x10, 0x0, 0x0, 0x10}, 0xc, &(0x7f0000000380)={&(0x7f0000000340)={0x24, r4, 0x300, 0x70bd26, 0x25dfdbfb, {}, [@MPTCP_PM_ATTR_SUBFLOWS={0x8, 0x3, 0x1}, @MPTCP_PM_ATTR_RCV_ADD_ADDRS={0x8, 0x2, 0x2}]}, 0x24}, 0x1, 0x0, 0x0, 0x20000004}, 0x8890) r5 = openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000500)='./cgroup/syz1\x00', 0x200002, 0x0) syz_io_uring_submit(0x0, 0x0, &(0x7f0000000580)=@IORING_OP_FILES_UPDATE={0x14, 0x4, 0x0, 0x0, 0x40, &(0x7f0000000540)=[r3, 0xffffffffffffffff, r5, r0, r1], 0x5}, 0x3) socket$inet6_tcp(0xa, 0x1, 0x0) openat$procfs(0xffffffffffffff9c, &(0x7f00000010c0)='/proc/crypto\x00', 0x0, 0x0) 21:21:29 executing program 6: r0 = io_uring_setup(0x355e, &(0x7f0000000000)={0x0, 0x0, 0x20, 0x0, 0x1be}) r1 = syz_io_uring_setup(0x8fe, &(0x7f0000000080)={0x0, 0x1830, 0x0, 0x0, 0x0, 0x0, r0}, &(0x7f0000ffb000/0x2000)=nil, &(0x7f0000ffb000/0x4000)=nil, &(0x7f0000000100), &(0x7f0000000140)=0x0) r3 = openat$hwrng(0xffffffffffffff9c, &(0x7f0000000180), 0x2, 0x0) r4 = syz_genetlink_get_family_id$mptcp(0x0, r3) sendmsg$MPTCP_PM_CMD_ADD_ADDR(r3, &(0x7f00000003c0)={&(0x7f00000002c0)={0x10, 0x0, 0x0, 0x10}, 0xc, &(0x7f0000000380)={&(0x7f0000000340)={0x24, r4, 0x300, 0x70bd26, 0x25dfdbfb, {}, [@MPTCP_PM_ATTR_SUBFLOWS={0x8, 0x3, 0x1}, @MPTCP_PM_ATTR_RCV_ADD_ADDRS={0x8, 0x2, 0x2}]}, 0x24}, 0x1, 0x0, 0x0, 0x20000004}, 0x8890) syz_io_uring_setup(0x20f8, &(0x7f0000000400)={0x0, 0x7677, 0x8, 0x3, 0x22f}, &(0x7f0000ffe000/0x2000)=nil, &(0x7f0000ffb000/0x2000)=nil, &(0x7f0000000480)=0x0, &(0x7f00000004c0)) r6 = openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000500)='./cgroup/syz1\x00', 0x200002, 0x0) syz_io_uring_submit(r5, r2, &(0x7f0000000580)=@IORING_OP_FILES_UPDATE={0x14, 0x4, 0x0, 0x0, 0x40, &(0x7f0000000540)=[0xffffffffffffffff, 0xffffffffffffffff, r6, r0, r1], 0x5}, 0x3) socket$inet6_tcp(0xa, 0x1, 0x0) openat$procfs(0xffffffffffffff9c, &(0x7f00000010c0)='/proc/crypto\x00', 0x0, 0x0) io_uring_setup(0x7c8f, &(0x7f0000001140)={0x0, 0xc240, 0x10, 0x3, 0x1c7}) 21:21:29 executing program 2: syz_io_uring_setup(0x8fe, &(0x7f0000000080), &(0x7f0000ffb000/0x2000)=nil, &(0x7f0000ffb000/0x4000)=nil, &(0x7f0000000100), &(0x7f0000000140)) openat$hwrng(0xffffffffffffff9c, &(0x7f0000000180), 0x0, 0x0) r0 = openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000500)='./cgroup/syz1\x00', 0x200002, 0x0) syz_io_uring_submit(0x0, 0x0, &(0x7f0000000580)=@IORING_OP_FILES_UPDATE={0x14, 0x0, 0x0, 0x0, 0x0, &(0x7f0000000540)=[0xffffffffffffffff, 0xffffffffffffffff, r0, 0xffffffffffffffff], 0x4}, 0x3) io_uring_setup(0x2812, &(0x7f00000005c0)={0x0, 0x5e1b, 0x2, 0x3, 0x12f}) 21:21:29 executing program 4: ioctl$SCSI_IOCTL_DOORUNLOCK(0xffffffffffffffff, 0x5381) r0 = syz_open_dev$mouse(&(0x7f0000000000), 0x578, 0x4000) ioctl$SG_GET_PACK_ID(r0, 0x227c, &(0x7f0000000040)) syz_genetlink_get_family_id$nl80211(&(0x7f00000000c0), 0xffffffffffffffff) syz_open_dev$vcsa(&(0x7f0000000440), 0x56, 0x4000) socketpair(0x0, 0x3, 0x6, 0x0) r1 = openat$tcp_congestion(0xffffffffffffff9c, &(0x7f0000000800), 0x1, 0x0) write$tcp_congestion(r1, &(0x7f0000000840)='htcp\x00', 0x5) 21:21:29 executing program 3: r0 = io_uring_setup(0x355e, &(0x7f0000000000)={0x0, 0x0, 0x20, 0x1, 0x1be}) r1 = syz_io_uring_setup(0x8fe, &(0x7f0000000080), &(0x7f0000ffb000/0x2000)=nil, &(0x7f0000ffb000/0x4000)=nil, &(0x7f0000000100), &(0x7f0000000140)=0x0) r3 = openat$hwrng(0xffffffffffffff9c, &(0x7f0000000180), 0x0, 0x0) syz_genetlink_get_family_id$mptcp(&(0x7f0000000300), r3) r4 = openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000500)='./cgroup/syz1\x00', 0x200002, 0x0) syz_io_uring_submit(0x0, r2, &(0x7f0000000580)=@IORING_OP_FILES_UPDATE={0x14, 0x4, 0x0, 0x0, 0x40, &(0x7f0000000540)=[0xffffffffffffffff, 0xffffffffffffffff, r4, r0, r1], 0x5}, 0x3) io_uring_setup(0x2812, &(0x7f00000005c0)={0x0, 0x5e1b, 0x2, 0x3, 0x12f}) socket$inet6_tcp(0xa, 0x1, 0x0) io_uring_setup(0x7c8f, &(0x7f0000001140)={0x0, 0xc240, 0x10, 0x3, 0x1c7}) 21:21:29 executing program 0: syz_io_uring_setup(0x8fe, &(0x7f0000000080), &(0x7f0000ffb000/0x2000)=nil, &(0x7f0000ffb000/0x4000)=nil, &(0x7f0000000100), &(0x7f0000000140)) openat$hwrng(0xffffffffffffff9c, 0x0, 0x2, 0x0) openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000500)='./cgroup/syz1\x00', 0x200002, 0x0) syz_io_uring_submit(0x0, 0x0, 0x0, 0x0) io_uring_setup(0x2812, &(0x7f00000005c0)={0x0, 0x0, 0x2}) 21:21:29 executing program 1: r0 = io_uring_setup(0x355e, &(0x7f0000000000)={0x0, 0x0, 0x20, 0x1, 0x1be}) r1 = openat$hwrng(0xffffffffffffff9c, &(0x7f0000000180), 0x2, 0x0) r2 = syz_io_uring_setup(0x65dd, &(0x7f00000001c0)={0x0, 0x0, 0x20, 0x2}, &(0x7f0000ffe000/0x1000)=nil, &(0x7f0000ffd000/0x1000)=nil, &(0x7f0000000240), &(0x7f0000000280)) syz_genetlink_get_family_id$mptcp(&(0x7f0000000300), r1) syz_io_uring_setup(0x0, &(0x7f0000000400)={0x0, 0x7677, 0x8, 0x3, 0x22f, 0x0, r2}, &(0x7f0000ffe000/0x2000)=nil, &(0x7f0000ffb000/0x2000)=nil, &(0x7f0000000480)=0x0, &(0x7f00000004c0)) r4 = openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000500)='./cgroup/syz1\x00', 0x200002, 0x0) syz_io_uring_submit(r3, 0x0, &(0x7f0000000580)=@IORING_OP_FILES_UPDATE={0x14, 0x4, 0x0, 0x0, 0x40, &(0x7f0000000540)=[r2, 0xffffffffffffffff, r4, r0, 0xffffffffffffffff], 0x5}, 0x3) io_uring_setup(0x2812, &(0x7f00000005c0)={0x0, 0x5e1b, 0x2, 0x3, 0x12f, 0x0, r2}) socket$inet6_tcp(0xa, 0x1, 0x0) openat$procfs(0xffffffffffffff9c, &(0x7f00000010c0)='/proc/crypto\x00', 0x0, 0x0) io_uring_setup(0x7c8f, &(0x7f0000001140)={0x0, 0xc240, 0x10, 0x3, 0x1c7, 0x0, r2}) 21:21:29 executing program 7: io_uring_setup(0x0, 0x0) openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000500)='./cgroup/syz1\x00', 0x200002, 0x0) 21:21:37 executing program 2: syz_io_uring_setup(0x8fe, &(0x7f0000000080), &(0x7f0000ffb000/0x2000)=nil, &(0x7f0000ffb000/0x4000)=nil, &(0x7f0000000100), &(0x7f0000000140)) openat$hwrng(0xffffffffffffff9c, &(0x7f0000000180), 0x0, 0x0) r0 = openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000500)='./cgroup/syz1\x00', 0x200002, 0x0) syz_io_uring_submit(0x0, 0x0, &(0x7f0000000580)=@IORING_OP_FILES_UPDATE={0x14, 0x0, 0x0, 0x0, 0x0, &(0x7f0000000540)=[0xffffffffffffffff, 0xffffffffffffffff, r0, 0xffffffffffffffff], 0x4}, 0x3) io_uring_setup(0x2812, &(0x7f00000005c0)={0x0, 0x5e1b, 0x2, 0x3, 0x12f}) 21:21:37 executing program 7: io_uring_setup(0x0, 0x0) openat$cgroup_root(0xffffffffffffff9c, 0x0, 0x200002, 0x0) 21:21:37 executing program 0: syz_io_uring_setup(0x8fe, &(0x7f0000000080), &(0x7f0000ffb000/0x2000)=nil, &(0x7f0000ffb000/0x4000)=nil, &(0x7f0000000100), &(0x7f0000000140)) openat$hwrng(0xffffffffffffff9c, 0x0, 0x2, 0x0) openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000500)='./cgroup/syz1\x00', 0x200002, 0x0) syz_io_uring_submit(0x0, 0x0, 0x0, 0x0) io_uring_setup(0x2812, &(0x7f00000005c0)={0x0, 0x0, 0x2}) 21:21:37 executing program 6: r0 = io_uring_setup(0x355e, &(0x7f0000000000)={0x0, 0x0, 0x20, 0x0, 0x1be}) r1 = syz_io_uring_setup(0x8fe, &(0x7f0000000080)={0x0, 0x1830, 0x0, 0x0, 0x0, 0x0, r0}, &(0x7f0000ffb000/0x2000)=nil, &(0x7f0000ffb000/0x4000)=nil, &(0x7f0000000100), &(0x7f0000000140)=0x0) r3 = openat$hwrng(0xffffffffffffff9c, &(0x7f0000000180), 0x2, 0x0) r4 = syz_genetlink_get_family_id$mptcp(0x0, r3) sendmsg$MPTCP_PM_CMD_ADD_ADDR(r3, &(0x7f00000003c0)={&(0x7f00000002c0)={0x10, 0x0, 0x0, 0x10}, 0xc, &(0x7f0000000380)={&(0x7f0000000340)={0x24, r4, 0x300, 0x70bd26, 0x25dfdbfb, {}, [@MPTCP_PM_ATTR_SUBFLOWS={0x8, 0x3, 0x1}, @MPTCP_PM_ATTR_RCV_ADD_ADDRS={0x8, 0x2, 0x2}]}, 0x24}, 0x1, 0x0, 0x0, 0x20000004}, 0x8890) syz_io_uring_setup(0x20f8, &(0x7f0000000400)={0x0, 0x7677, 0x8, 0x3, 0x22f}, &(0x7f0000ffe000/0x2000)=nil, &(0x7f0000ffb000/0x2000)=nil, &(0x7f0000000480)=0x0, &(0x7f00000004c0)) r6 = openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000500)='./cgroup/syz1\x00', 0x200002, 0x0) syz_io_uring_submit(r5, r2, &(0x7f0000000580)=@IORING_OP_FILES_UPDATE={0x14, 0x4, 0x0, 0x0, 0x40, &(0x7f0000000540)=[0xffffffffffffffff, 0xffffffffffffffff, r6, r0, r1], 0x5}, 0x3) socket$inet6_tcp(0xa, 0x1, 0x0) openat$procfs(0xffffffffffffff9c, &(0x7f00000010c0)='/proc/crypto\x00', 0x0, 0x0) io_uring_setup(0x7c8f, &(0x7f0000001140)={0x0, 0xc240, 0x10, 0x3, 0x1c7}) 21:21:37 executing program 3: r0 = io_uring_setup(0x355e, &(0x7f0000000000)={0x0, 0x0, 0x20, 0x1, 0x1be}) r1 = syz_io_uring_setup(0x8fe, &(0x7f0000000080), &(0x7f0000ffb000/0x2000)=nil, &(0x7f0000ffb000/0x4000)=nil, &(0x7f0000000100), &(0x7f0000000140)=0x0) r3 = openat$hwrng(0xffffffffffffff9c, &(0x7f0000000180), 0x0, 0x0) syz_genetlink_get_family_id$mptcp(&(0x7f0000000300), r3) r4 = openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000500)='./cgroup/syz1\x00', 0x200002, 0x0) syz_io_uring_submit(0x0, r2, &(0x7f0000000580)=@IORING_OP_FILES_UPDATE={0x14, 0x4, 0x0, 0x0, 0x40, &(0x7f0000000540)=[0xffffffffffffffff, 0xffffffffffffffff, r4, r0, r1], 0x5}, 0x3) io_uring_setup(0x2812, &(0x7f00000005c0)={0x0, 0x5e1b, 0x2, 0x3, 0x12f}) socket$inet6_tcp(0xa, 0x1, 0x0) io_uring_setup(0x7c8f, &(0x7f0000001140)={0x0, 0xc240, 0x10, 0x3, 0x1c7}) 21:21:37 executing program 4: ioctl$SCSI_IOCTL_DOORUNLOCK(0xffffffffffffffff, 0x5381) r0 = syz_open_dev$mouse(&(0x7f0000000000), 0x578, 0x4000) ioctl$SG_GET_PACK_ID(r0, 0x227c, &(0x7f0000000040)) syz_genetlink_get_family_id$nl80211(&(0x7f00000000c0), 0xffffffffffffffff) syz_open_dev$vcsa(&(0x7f0000000440), 0x56, 0x4000) socketpair(0x0, 0x3, 0x6, 0x0) r1 = openat$tcp_congestion(0xffffffffffffff9c, &(0x7f0000000800), 0x1, 0x0) write$tcp_congestion(r1, &(0x7f0000000840)='htcp\x00', 0x5) 21:21:37 executing program 1: r0 = io_uring_setup(0x355e, &(0x7f0000000000)={0x0, 0x0, 0x20, 0x1, 0x1be}) r1 = openat$hwrng(0xffffffffffffff9c, &(0x7f0000000180), 0x2, 0x0) r2 = syz_io_uring_setup(0x65dd, &(0x7f00000001c0)={0x0, 0x0, 0x20, 0x2}, &(0x7f0000ffe000/0x1000)=nil, &(0x7f0000ffd000/0x1000)=nil, &(0x7f0000000240), &(0x7f0000000280)) syz_genetlink_get_family_id$mptcp(&(0x7f0000000300), r1) syz_io_uring_setup(0x20f8, 0x0, &(0x7f0000ffe000/0x2000)=nil, &(0x7f0000ffb000/0x2000)=nil, &(0x7f0000000480)=0x0, &(0x7f00000004c0)) r4 = openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000500)='./cgroup/syz1\x00', 0x200002, 0x0) syz_io_uring_submit(r3, 0x0, &(0x7f0000000580)=@IORING_OP_FILES_UPDATE={0x14, 0x4, 0x0, 0x0, 0x40, &(0x7f0000000540)=[r2, 0xffffffffffffffff, r4, r0, 0xffffffffffffffff], 0x5}, 0x3) io_uring_setup(0x2812, &(0x7f00000005c0)={0x0, 0x5e1b, 0x2, 0x3, 0x12f, 0x0, r2}) socket$inet6_tcp(0xa, 0x1, 0x0) openat$procfs(0xffffffffffffff9c, &(0x7f00000010c0)='/proc/crypto\x00', 0x0, 0x0) io_uring_setup(0x7c8f, &(0x7f0000001140)={0x0, 0xc240, 0x10, 0x3, 0x1c7, 0x0, r2}) 21:21:37 executing program 5: r0 = io_uring_setup(0x355e, &(0x7f0000000000)={0x0, 0x0, 0x20, 0x0, 0x1be}) r1 = syz_io_uring_setup(0x8fe, &(0x7f0000000080)={0x0, 0x0, 0x0, 0x0, 0x1b8}, &(0x7f0000ffb000/0x2000)=nil, &(0x7f0000ffb000/0x4000)=nil, &(0x7f0000000100), 0x0) r2 = openat$hwrng(0xffffffffffffff9c, &(0x7f0000000180), 0x2, 0x0) r3 = syz_io_uring_setup(0x65dd, &(0x7f00000001c0)={0x0, 0xf46f, 0x20, 0x2, 0xdf}, &(0x7f0000ffe000/0x1000)=nil, &(0x7f0000ffd000/0x1000)=nil, &(0x7f0000000240), &(0x7f0000000280)) r4 = syz_genetlink_get_family_id$mptcp(&(0x7f0000000300), r2) sendmsg$MPTCP_PM_CMD_ADD_ADDR(r2, &(0x7f00000003c0)={&(0x7f00000002c0)={0x10, 0x0, 0x0, 0x10}, 0xc, &(0x7f0000000380)={&(0x7f0000000340)={0x24, r4, 0x300, 0x70bd26, 0x25dfdbfb, {}, [@MPTCP_PM_ATTR_SUBFLOWS={0x8, 0x3, 0x1}, @MPTCP_PM_ATTR_RCV_ADD_ADDRS={0x8, 0x2, 0x2}]}, 0x24}, 0x1, 0x0, 0x0, 0x20000004}, 0x8890) r5 = openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000500)='./cgroup/syz1\x00', 0x200002, 0x0) syz_io_uring_submit(0x0, 0x0, &(0x7f0000000580)=@IORING_OP_FILES_UPDATE={0x14, 0x4, 0x0, 0x0, 0x40, &(0x7f0000000540)=[r3, 0xffffffffffffffff, r5, r0, r1], 0x5}, 0x3) socket$inet6_tcp(0xa, 0x1, 0x0) openat$procfs(0xffffffffffffff9c, &(0x7f00000010c0)='/proc/crypto\x00', 0x0, 0x0) 21:21:37 executing program 0: syz_io_uring_setup(0x8fe, &(0x7f0000000080), &(0x7f0000ffb000/0x2000)=nil, &(0x7f0000ffb000/0x4000)=nil, &(0x7f0000000100), &(0x7f0000000140)) openat$hwrng(0xffffffffffffff9c, 0x0, 0x2, 0x0) openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000500)='./cgroup/syz1\x00', 0x200002, 0x0) syz_io_uring_submit(0x0, 0x0, 0x0, 0x0) io_uring_setup(0x2812, &(0x7f00000005c0)={0x0, 0x0, 0x2}) [ 626.950010] kmemleak: Found object by alias at 0x607f1a6398ac [ 626.950030] CPU: 1 UID: 0 PID: 7491 Comm: iou-sqp-7490 Tainted: G W 6.17.0-rc3-next-20250829 #1 PREEMPT(voluntary) [ 626.950048] Tainted: [W]=WARN [ 626.950052] Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.12.0-1 04/01/2014 [ 626.950059] Call Trace: [ 626.950063] [ 626.950069] dump_stack_lvl+0xca/0x120 [ 626.950094] __lookup_object+0x94/0xb0 [ 626.950110] delete_object_full+0x27/0x70 [ 626.950126] free_percpu+0x30/0x1160 [ 626.950142] ? arch_uprobe_clear_state+0x16/0x140 [ 626.950162] futex_hash_free+0x38/0xc0 [ 626.950176] mmput+0x2d3/0x390 [ 626.950194] do_exit+0x79d/0x2970 [ 626.950208] ? __pfx_try_to_wake_up+0x10/0x10 [ 626.950227] ? __pfx_do_exit+0x10/0x10 [ 626.950238] ? io_sq_thread+0xfbd/0x1b00 [ 626.950254] ? lock_release+0xc8/0x290 [ 626.950272] io_sq_thread+0xfc9/0x1b00 [ 626.950292] ? __pfx_io_sq_thread+0x10/0x10 [ 626.950309] ? __lock_acquire+0xc65/0x1b70 [ 626.950325] ? __pfx_autoremove_wake_function+0x10/0x10 [ 626.950341] ? __lock_acquire+0xc65/0x1b70 [ 626.950361] ? do_raw_spin_lock+0x123/0x260 [ 626.950376] ? find_held_lock+0x2b/0x80 [ 626.950403] ? __pfx_io_sq_thread+0x10/0x10 [ 626.950418] ? lock_release+0xc8/0x290 [ 626.950431] ? __pfx_io_sq_thread+0x10/0x10 [ 626.950446] ret_from_fork+0x34b/0x430 [ 626.950464] ? __pfx_io_sq_thread+0x10/0x10 [ 626.950478] ret_from_fork_asm+0x1a/0x30 [ 626.950501] [ 626.950505] kmemleak: Object (percpu) 0x607f1a6398a8 (size 8): [ 626.950512] kmemleak: comm "syz-executor.5", pid 7503, jiffies 4295293792 [ 626.950519] kmemleak: min_count = 1 [ 626.950523] kmemleak: count = 0 [ 626.950526] kmemleak: flags = 0x21 [ 626.950530] kmemleak: checksum = 0 [ 626.950533] kmemleak: backtrace: [ 626.950537] pcpu_alloc_noprof+0x87a/0x1170 [ 626.950551] percpu_ref_init+0x37/0x400 [ 626.950568] io_uring_setup+0x44c/0x2000 [ 626.950580] __x64_sys_io_uring_setup+0xc8/0x170 [ 626.950590] do_syscall_64+0xbf/0x360 [ 626.950599] entry_SYSCALL_64_after_hwframe+0x77/0x7f 21:21:37 executing program 0: syz_io_uring_setup(0x8fe, &(0x7f0000000080), &(0x7f0000ffb000/0x2000)=nil, &(0x7f0000ffb000/0x4000)=nil, &(0x7f0000000100), &(0x7f0000000140)) openat$hwrng(0xffffffffffffff9c, &(0x7f0000000180), 0x0, 0x0) openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000500)='./cgroup/syz1\x00', 0x200002, 0x0) syz_io_uring_submit(0x0, 0x0, 0x0, 0x0) io_uring_setup(0x2812, &(0x7f00000005c0)={0x0, 0x0, 0x2}) 21:21:37 executing program 7: io_uring_setup(0x0, 0x0) openat$cgroup_root(0xffffffffffffff9c, 0x0, 0x200002, 0x0) 21:21:37 executing program 3: r0 = io_uring_setup(0x355e, &(0x7f0000000000)={0x0, 0x0, 0x20, 0x1, 0x1be}) r1 = syz_io_uring_setup(0x8fe, &(0x7f0000000080), &(0x7f0000ffb000/0x2000)=nil, &(0x7f0000ffb000/0x4000)=nil, &(0x7f0000000100), &(0x7f0000000140)=0x0) r3 = openat$hwrng(0xffffffffffffff9c, &(0x7f0000000180), 0x2, 0x0) syz_genetlink_get_family_id$mptcp(0x0, r3) r4 = openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000500)='./cgroup/syz1\x00', 0x200002, 0x0) syz_io_uring_submit(0x0, r2, &(0x7f0000000580)=@IORING_OP_FILES_UPDATE={0x14, 0x4, 0x0, 0x0, 0x40, &(0x7f0000000540)=[0xffffffffffffffff, 0xffffffffffffffff, r4, r0, r1], 0x5}, 0x3) io_uring_setup(0x2812, &(0x7f00000005c0)={0x0, 0x5e1b, 0x2, 0x3, 0x12f}) socket$inet6_tcp(0xa, 0x1, 0x0) io_uring_setup(0x7c8f, &(0x7f0000001140)={0x0, 0xc240, 0x10, 0x3, 0x1c7}) 21:21:37 executing program 2: syz_io_uring_setup(0x8fe, &(0x7f0000000080), &(0x7f0000ffb000/0x2000)=nil, &(0x7f0000ffb000/0x4000)=nil, &(0x7f0000000100), &(0x7f0000000140)) openat$hwrng(0xffffffffffffff9c, &(0x7f0000000180), 0x0, 0x0) r0 = openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000500)='./cgroup/syz1\x00', 0x200002, 0x0) syz_io_uring_submit(0x0, 0x0, &(0x7f0000000580)=@IORING_OP_FILES_UPDATE={0x14, 0x0, 0x0, 0x0, 0x0, &(0x7f0000000540)=[0xffffffffffffffff, 0xffffffffffffffff, r0, 0xffffffffffffffff], 0x4}, 0x3) io_uring_setup(0x2812, &(0x7f00000005c0)={0x0, 0x5e1b, 0x2, 0x3, 0x12f}) 21:21:37 executing program 6: r0 = io_uring_setup(0x355e, &(0x7f0000000000)={0x0, 0x0, 0x20, 0x0, 0x1be}) r1 = syz_io_uring_setup(0x8fe, &(0x7f0000000080)={0x0, 0x1830, 0x0, 0x0, 0x0, 0x0, r0}, &(0x7f0000ffb000/0x2000)=nil, &(0x7f0000ffb000/0x4000)=nil, &(0x7f0000000100), &(0x7f0000000140)=0x0) r3 = openat$hwrng(0xffffffffffffff9c, &(0x7f0000000180), 0x2, 0x0) r4 = syz_genetlink_get_family_id$mptcp(&(0x7f0000000300), 0xffffffffffffffff) sendmsg$MPTCP_PM_CMD_ADD_ADDR(r3, &(0x7f00000003c0)={&(0x7f00000002c0)={0x10, 0x0, 0x0, 0x10}, 0xc, &(0x7f0000000380)={&(0x7f0000000340)={0x24, r4, 0x300, 0x70bd26, 0x25dfdbfb, {}, [@MPTCP_PM_ATTR_SUBFLOWS={0x8, 0x3, 0x1}, @MPTCP_PM_ATTR_RCV_ADD_ADDRS={0x8, 0x2, 0x2}]}, 0x24}, 0x1, 0x0, 0x0, 0x20000004}, 0x8890) syz_io_uring_setup(0x20f8, &(0x7f0000000400)={0x0, 0x7677, 0x8, 0x3, 0x22f}, &(0x7f0000ffe000/0x2000)=nil, &(0x7f0000ffb000/0x2000)=nil, &(0x7f0000000480)=0x0, &(0x7f00000004c0)) r6 = openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000500)='./cgroup/syz1\x00', 0x200002, 0x0) syz_io_uring_submit(r5, r2, &(0x7f0000000580)=@IORING_OP_FILES_UPDATE={0x14, 0x4, 0x0, 0x0, 0x40, &(0x7f0000000540)=[0xffffffffffffffff, 0xffffffffffffffff, r6, r0, r1], 0x5}, 0x3) socket$inet6_tcp(0xa, 0x1, 0x0) openat$procfs(0xffffffffffffff9c, &(0x7f00000010c0)='/proc/crypto\x00', 0x0, 0x0) io_uring_setup(0x7c8f, &(0x7f0000001140)={0x0, 0xc240, 0x10, 0x3, 0x1c7}) 21:21:37 executing program 1: r0 = io_uring_setup(0x355e, &(0x7f0000000000)={0x0, 0x0, 0x20, 0x1, 0x1be}) r1 = openat$hwrng(0xffffffffffffff9c, &(0x7f0000000180), 0x2, 0x0) r2 = syz_io_uring_setup(0x65dd, &(0x7f00000001c0)={0x0, 0x0, 0x20, 0x2}, &(0x7f0000ffe000/0x1000)=nil, &(0x7f0000ffd000/0x1000)=nil, &(0x7f0000000240), &(0x7f0000000280)) syz_genetlink_get_family_id$mptcp(&(0x7f0000000300), r1) syz_io_uring_setup(0x20f8, 0x0, &(0x7f0000ffe000/0x2000)=nil, &(0x7f0000ffb000/0x2000)=nil, &(0x7f0000000480)=0x0, &(0x7f00000004c0)) r4 = openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000500)='./cgroup/syz1\x00', 0x200002, 0x0) syz_io_uring_submit(r3, 0x0, &(0x7f0000000580)=@IORING_OP_FILES_UPDATE={0x14, 0x4, 0x0, 0x0, 0x40, &(0x7f0000000540)=[r2, 0xffffffffffffffff, r4, r0, 0xffffffffffffffff], 0x5}, 0x3) io_uring_setup(0x2812, &(0x7f00000005c0)={0x0, 0x5e1b, 0x2, 0x3, 0x12f, 0x0, r2}) socket$inet6_tcp(0xa, 0x1, 0x0) openat$procfs(0xffffffffffffff9c, &(0x7f00000010c0)='/proc/crypto\x00', 0x0, 0x0) io_uring_setup(0x7c8f, &(0x7f0000001140)={0x0, 0xc240, 0x10, 0x3, 0x1c7, 0x0, r2}) 21:21:37 executing program 0: syz_io_uring_setup(0x8fe, &(0x7f0000000080), &(0x7f0000ffb000/0x2000)=nil, &(0x7f0000ffb000/0x4000)=nil, &(0x7f0000000100), &(0x7f0000000140)) openat$hwrng(0xffffffffffffff9c, &(0x7f0000000180), 0x0, 0x0) openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000500)='./cgroup/syz1\x00', 0x200002, 0x0) syz_io_uring_submit(0x0, 0x0, 0x0, 0x0) io_uring_setup(0x2812, &(0x7f00000005c0)={0x0, 0x0, 0x2}) 21:21:37 executing program 7: io_uring_setup(0x0, 0x0) openat$cgroup_root(0xffffffffffffff9c, 0x0, 0x200002, 0x0) 21:21:37 executing program 4: ioctl$SCSI_IOCTL_DOORUNLOCK(0xffffffffffffffff, 0x5381) r0 = syz_open_dev$mouse(&(0x7f0000000000), 0x578, 0x4000) ioctl$SG_GET_PACK_ID(r0, 0x227c, &(0x7f0000000040)) syz_genetlink_get_family_id$nl80211(&(0x7f00000000c0), 0xffffffffffffffff) syz_open_dev$vcsa(&(0x7f0000000440), 0x56, 0x4000) socketpair(0x0, 0x3, 0x6, &(0x7f0000000640)) r1 = openat$tcp_congestion(0xffffffffffffff9c, 0x0, 0x1, 0x0) write$tcp_congestion(r1, &(0x7f0000000840)='htcp\x00', 0x5) 21:21:37 executing program 5: r0 = io_uring_setup(0x355e, &(0x7f0000000000)={0x0, 0x0, 0x20, 0x0, 0x1be}) r1 = syz_io_uring_setup(0x8fe, &(0x7f0000000080)={0x0, 0x0, 0x0, 0x0, 0x1b8}, &(0x7f0000ffb000/0x2000)=nil, &(0x7f0000ffb000/0x4000)=nil, &(0x7f0000000100), &(0x7f0000000140)=0x0) r3 = openat$hwrng(0xffffffffffffff9c, 0x0, 0x2, 0x0) r4 = syz_io_uring_setup(0x65dd, &(0x7f00000001c0)={0x0, 0xf46f, 0x20, 0x2, 0xdf}, &(0x7f0000ffe000/0x1000)=nil, &(0x7f0000ffd000/0x1000)=nil, &(0x7f0000000240), &(0x7f0000000280)) r5 = syz_genetlink_get_family_id$mptcp(&(0x7f0000000300), r3) sendmsg$MPTCP_PM_CMD_ADD_ADDR(r3, &(0x7f00000003c0)={&(0x7f00000002c0)={0x10, 0x0, 0x0, 0x10}, 0xc, &(0x7f0000000380)={&(0x7f0000000340)={0x24, r5, 0x300, 0x70bd26, 0x25dfdbfb, {}, [@MPTCP_PM_ATTR_SUBFLOWS={0x8, 0x3, 0x1}, @MPTCP_PM_ATTR_RCV_ADD_ADDRS={0x8, 0x2, 0x2}]}, 0x24}, 0x1, 0x0, 0x0, 0x20000004}, 0x8890) r6 = openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000500)='./cgroup/syz1\x00', 0x200002, 0x0) syz_io_uring_submit(0x0, r2, &(0x7f0000000580)=@IORING_OP_FILES_UPDATE={0x14, 0x4, 0x0, 0x0, 0x40, &(0x7f0000000540)=[r4, 0xffffffffffffffff, r6, r0, r1], 0x5}, 0x3) socket$inet6_tcp(0xa, 0x1, 0x0) openat$procfs(0xffffffffffffff9c, &(0x7f00000010c0)='/proc/crypto\x00', 0x0, 0x0) 21:21:37 executing program 2: syz_io_uring_setup(0x8fe, &(0x7f0000000080), &(0x7f0000ffb000/0x2000)=nil, &(0x7f0000ffb000/0x4000)=nil, &(0x7f0000000100), &(0x7f0000000140)) openat$hwrng(0xffffffffffffff9c, &(0x7f0000000180), 0x0, 0x0) r0 = openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000500)='./cgroup/syz1\x00', 0x200002, 0x0) syz_io_uring_submit(0x0, 0x0, &(0x7f0000000580)=@IORING_OP_FILES_UPDATE={0x14, 0x0, 0x0, 0x0, 0x0, &(0x7f0000000540)=[0xffffffffffffffff, 0xffffffffffffffff, r0], 0x3}, 0x3) io_uring_setup(0x2812, &(0x7f00000005c0)={0x0, 0x5e1b, 0x2, 0x3, 0x12f}) 21:21:37 executing program 3: r0 = io_uring_setup(0x355e, &(0x7f0000000000)={0x0, 0x0, 0x20, 0x1, 0x1be}) r1 = syz_io_uring_setup(0x8fe, &(0x7f0000000080), &(0x7f0000ffb000/0x2000)=nil, &(0x7f0000ffb000/0x4000)=nil, &(0x7f0000000100), &(0x7f0000000140)=0x0) r3 = openat$hwrng(0xffffffffffffff9c, &(0x7f0000000180), 0x2, 0x0) syz_genetlink_get_family_id$mptcp(0x0, r3) r4 = openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000500)='./cgroup/syz1\x00', 0x200002, 0x0) syz_io_uring_submit(0x0, r2, &(0x7f0000000580)=@IORING_OP_FILES_UPDATE={0x14, 0x4, 0x0, 0x0, 0x40, &(0x7f0000000540)=[0xffffffffffffffff, 0xffffffffffffffff, r4, r0, r1], 0x5}, 0x3) io_uring_setup(0x2812, &(0x7f00000005c0)={0x0, 0x5e1b, 0x2, 0x3, 0x12f}) socket$inet6_tcp(0xa, 0x1, 0x0) io_uring_setup(0x7c8f, &(0x7f0000001140)={0x0, 0xc240, 0x10, 0x3, 0x1c7}) [ 628.122226] kworker/u10:8 (363) used greatest stack depth: 24400 bytes left 21:21:45 executing program 4: ioctl$SCSI_IOCTL_DOORUNLOCK(0xffffffffffffffff, 0x5381) r0 = syz_open_dev$mouse(&(0x7f0000000000), 0x578, 0x4000) ioctl$SG_GET_PACK_ID(r0, 0x227c, &(0x7f0000000040)) syz_genetlink_get_family_id$nl80211(&(0x7f00000000c0), 0xffffffffffffffff) syz_open_dev$vcsa(&(0x7f0000000440), 0x56, 0x4000) socketpair(0x0, 0x3, 0x6, &(0x7f0000000640)) r1 = openat$tcp_congestion(0xffffffffffffff9c, 0x0, 0x1, 0x0) write$tcp_congestion(r1, &(0x7f0000000840)='htcp\x00', 0x5) 21:21:45 executing program 1: r0 = io_uring_setup(0x355e, &(0x7f0000000000)={0x0, 0x0, 0x20, 0x1, 0x1be}) r1 = openat$hwrng(0xffffffffffffff9c, &(0x7f0000000180), 0x2, 0x0) r2 = syz_io_uring_setup(0x65dd, &(0x7f00000001c0)={0x0, 0x0, 0x20, 0x2}, &(0x7f0000ffe000/0x1000)=nil, &(0x7f0000ffd000/0x1000)=nil, &(0x7f0000000240), &(0x7f0000000280)) syz_genetlink_get_family_id$mptcp(&(0x7f0000000300), r1) syz_io_uring_setup(0x20f8, 0x0, &(0x7f0000ffe000/0x2000)=nil, &(0x7f0000ffb000/0x2000)=nil, &(0x7f0000000480)=0x0, &(0x7f00000004c0)) r4 = openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000500)='./cgroup/syz1\x00', 0x200002, 0x0) syz_io_uring_submit(r3, 0x0, &(0x7f0000000580)=@IORING_OP_FILES_UPDATE={0x14, 0x4, 0x0, 0x0, 0x40, &(0x7f0000000540)=[r2, 0xffffffffffffffff, r4, r0, 0xffffffffffffffff], 0x5}, 0x3) io_uring_setup(0x2812, &(0x7f00000005c0)={0x0, 0x5e1b, 0x2, 0x3, 0x12f, 0x0, r2}) socket$inet6_tcp(0xa, 0x1, 0x0) openat$procfs(0xffffffffffffff9c, &(0x7f00000010c0)='/proc/crypto\x00', 0x0, 0x0) io_uring_setup(0x7c8f, &(0x7f0000001140)={0x0, 0xc240, 0x10, 0x3, 0x1c7, 0x0, r2}) 21:21:45 executing program 3: r0 = io_uring_setup(0x355e, &(0x7f0000000000)={0x0, 0x0, 0x20, 0x1, 0x1be}) r1 = syz_io_uring_setup(0x8fe, &(0x7f0000000080), &(0x7f0000ffb000/0x2000)=nil, &(0x7f0000ffb000/0x4000)=nil, &(0x7f0000000100), &(0x7f0000000140)=0x0) r3 = openat$hwrng(0xffffffffffffff9c, &(0x7f0000000180), 0x2, 0x0) syz_genetlink_get_family_id$mptcp(0x0, r3) r4 = openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000500)='./cgroup/syz1\x00', 0x200002, 0x0) syz_io_uring_submit(0x0, r2, &(0x7f0000000580)=@IORING_OP_FILES_UPDATE={0x14, 0x4, 0x0, 0x0, 0x40, &(0x7f0000000540)=[0xffffffffffffffff, 0xffffffffffffffff, r4, r0, r1], 0x5}, 0x3) io_uring_setup(0x2812, &(0x7f00000005c0)={0x0, 0x5e1b, 0x2, 0x3, 0x12f}) socket$inet6_tcp(0xa, 0x1, 0x0) io_uring_setup(0x7c8f, &(0x7f0000001140)={0x0, 0xc240, 0x10, 0x3, 0x1c7}) 21:21:45 executing program 2: syz_io_uring_setup(0x8fe, &(0x7f0000000080), &(0x7f0000ffb000/0x2000)=nil, &(0x7f0000ffb000/0x4000)=nil, &(0x7f0000000100), &(0x7f0000000140)) openat$hwrng(0xffffffffffffff9c, &(0x7f0000000180), 0x0, 0x0) openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000500)='./cgroup/syz1\x00', 0x200002, 0x0) syz_io_uring_submit(0x0, 0x0, &(0x7f0000000580)=@IORING_OP_FILES_UPDATE={0x14, 0x0, 0x0, 0x0, 0x0, &(0x7f0000000540)=[0xffffffffffffffff, 0xffffffffffffffff], 0x2}, 0x3) io_uring_setup(0x2812, &(0x7f00000005c0)={0x0, 0x5e1b, 0x2, 0x3, 0x12f}) 21:21:45 executing program 7: r0 = io_uring_setup(0x355e, &(0x7f0000000000)={0x0, 0x0, 0x20, 0x0, 0x1be}) r1 = syz_io_uring_setup(0x8fe, &(0x7f0000000080)={0x0, 0x1830, 0x0, 0x0, 0x0, 0x0, r0}, &(0x7f0000ffb000/0x2000)=nil, &(0x7f0000ffb000/0x4000)=nil, &(0x7f0000000100), &(0x7f0000000140)=0x0) r3 = openat$hwrng(0xffffffffffffff9c, &(0x7f0000000180), 0x2, 0x0) r4 = syz_genetlink_get_family_id$mptcp(&(0x7f0000000300), 0xffffffffffffffff) sendmsg$MPTCP_PM_CMD_ADD_ADDR(r3, &(0x7f00000003c0)={&(0x7f00000002c0)={0x10, 0x0, 0x0, 0x10}, 0xc, &(0x7f0000000380)={&(0x7f0000000340)={0x24, r4, 0x300, 0x70bd26, 0x25dfdbfb, {}, [@MPTCP_PM_ATTR_SUBFLOWS={0x8, 0x3, 0x1}, @MPTCP_PM_ATTR_RCV_ADD_ADDRS={0x8, 0x2, 0x2}]}, 0x24}, 0x1, 0x0, 0x0, 0x20000004}, 0x8890) syz_io_uring_setup(0x20f8, &(0x7f0000000400)={0x0, 0x7677, 0x8, 0x3, 0x22f}, &(0x7f0000ffe000/0x2000)=nil, &(0x7f0000ffb000/0x2000)=nil, &(0x7f0000000480)=0x0, &(0x7f00000004c0)) r6 = openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000500)='./cgroup/syz1\x00', 0x200002, 0x0) syz_io_uring_submit(r5, r2, &(0x7f0000000580)=@IORING_OP_FILES_UPDATE={0x14, 0x4, 0x0, 0x0, 0x40, &(0x7f0000000540)=[0xffffffffffffffff, 0xffffffffffffffff, r6, r0, r1], 0x5}, 0x3) socket$inet6_tcp(0xa, 0x1, 0x0) openat$procfs(0xffffffffffffff9c, &(0x7f00000010c0)='/proc/crypto\x00', 0x0, 0x0) io_uring_setup(0x7c8f, &(0x7f0000001140)={0x0, 0xc240, 0x10, 0x3, 0x1c7}) 21:21:45 executing program 5: r0 = io_uring_setup(0x355e, &(0x7f0000000000)={0x0, 0x0, 0x20, 0x0, 0x1be}) r1 = syz_io_uring_setup(0x8fe, &(0x7f0000000080)={0x0, 0x0, 0x0, 0x0, 0x1b8}, &(0x7f0000ffb000/0x2000)=nil, &(0x7f0000ffb000/0x4000)=nil, &(0x7f0000000100), &(0x7f0000000140)=0x0) r3 = openat$hwrng(0xffffffffffffff9c, 0x0, 0x2, 0x0) r4 = syz_io_uring_setup(0x65dd, &(0x7f00000001c0)={0x0, 0xf46f, 0x20, 0x2, 0xdf}, &(0x7f0000ffe000/0x1000)=nil, &(0x7f0000ffd000/0x1000)=nil, &(0x7f0000000240), &(0x7f0000000280)) r5 = syz_genetlink_get_family_id$mptcp(&(0x7f0000000300), r3) sendmsg$MPTCP_PM_CMD_ADD_ADDR(r3, &(0x7f00000003c0)={&(0x7f00000002c0)={0x10, 0x0, 0x0, 0x10}, 0xc, &(0x7f0000000380)={&(0x7f0000000340)={0x24, r5, 0x300, 0x70bd26, 0x25dfdbfb, {}, [@MPTCP_PM_ATTR_SUBFLOWS={0x8, 0x3, 0x1}, @MPTCP_PM_ATTR_RCV_ADD_ADDRS={0x8, 0x2, 0x2}]}, 0x24}, 0x1, 0x0, 0x0, 0x20000004}, 0x8890) r6 = openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000500)='./cgroup/syz1\x00', 0x200002, 0x0) syz_io_uring_submit(0x0, r2, &(0x7f0000000580)=@IORING_OP_FILES_UPDATE={0x14, 0x4, 0x0, 0x0, 0x40, &(0x7f0000000540)=[r4, 0xffffffffffffffff, r6, r0, r1], 0x5}, 0x3) socket$inet6_tcp(0xa, 0x1, 0x0) openat$procfs(0xffffffffffffff9c, &(0x7f00000010c0)='/proc/crypto\x00', 0x0, 0x0) 21:21:45 executing program 6: r0 = io_uring_setup(0x355e, &(0x7f0000000000)={0x0, 0x0, 0x20, 0x0, 0x1be}) r1 = syz_io_uring_setup(0x8fe, &(0x7f0000000080)={0x0, 0x1830, 0x0, 0x0, 0x0, 0x0, r0}, &(0x7f0000ffb000/0x2000)=nil, &(0x7f0000ffb000/0x4000)=nil, &(0x7f0000000100), &(0x7f0000000140)=0x0) r3 = openat$hwrng(0xffffffffffffff9c, &(0x7f0000000180), 0x2, 0x0) r4 = syz_genetlink_get_family_id$mptcp(&(0x7f0000000300), 0xffffffffffffffff) sendmsg$MPTCP_PM_CMD_ADD_ADDR(r3, &(0x7f00000003c0)={&(0x7f00000002c0)={0x10, 0x0, 0x0, 0x10}, 0xc, &(0x7f0000000380)={&(0x7f0000000340)={0x24, r4, 0x300, 0x70bd26, 0x25dfdbfb, {}, [@MPTCP_PM_ATTR_SUBFLOWS={0x8, 0x3, 0x1}, @MPTCP_PM_ATTR_RCV_ADD_ADDRS={0x8, 0x2, 0x2}]}, 0x24}, 0x1, 0x0, 0x0, 0x20000004}, 0x8890) syz_io_uring_setup(0x20f8, &(0x7f0000000400)={0x0, 0x7677, 0x8, 0x3, 0x22f}, &(0x7f0000ffe000/0x2000)=nil, &(0x7f0000ffb000/0x2000)=nil, &(0x7f0000000480)=0x0, &(0x7f00000004c0)) r6 = openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000500)='./cgroup/syz1\x00', 0x200002, 0x0) syz_io_uring_submit(r5, r2, &(0x7f0000000580)=@IORING_OP_FILES_UPDATE={0x14, 0x4, 0x0, 0x0, 0x40, &(0x7f0000000540)=[0xffffffffffffffff, 0xffffffffffffffff, r6, r0, r1], 0x5}, 0x3) socket$inet6_tcp(0xa, 0x1, 0x0) openat$procfs(0xffffffffffffff9c, &(0x7f00000010c0)='/proc/crypto\x00', 0x0, 0x0) io_uring_setup(0x7c8f, &(0x7f0000001140)={0x0, 0xc240, 0x10, 0x3, 0x1c7}) 21:21:45 executing program 0: syz_io_uring_setup(0x8fe, &(0x7f0000000080), &(0x7f0000ffb000/0x2000)=nil, &(0x7f0000ffb000/0x4000)=nil, &(0x7f0000000100), &(0x7f0000000140)) openat$hwrng(0xffffffffffffff9c, &(0x7f0000000180), 0x0, 0x0) openat$cgroup_root(0xffffffffffffff9c, 0x0, 0x200002, 0x0) syz_io_uring_submit(0x0, 0x0, 0x0, 0x0) io_uring_setup(0x2812, &(0x7f00000005c0)={0x0, 0x0, 0x2}) 21:21:46 executing program 0: syz_io_uring_setup(0x8fe, &(0x7f0000000080), &(0x7f0000ffb000/0x2000)=nil, &(0x7f0000ffb000/0x4000)=nil, &(0x7f0000000100), &(0x7f0000000140)) openat$hwrng(0xffffffffffffff9c, &(0x7f0000000180), 0x0, 0x0) openat$cgroup_root(0xffffffffffffff9c, 0x0, 0x200002, 0x0) syz_io_uring_submit(0x0, 0x0, 0x0, 0x0) io_uring_setup(0x2812, &(0x7f00000005c0)={0x0, 0x0, 0x2}) 21:21:46 executing program 6: r0 = io_uring_setup(0x355e, &(0x7f0000000000)={0x0, 0x0, 0x20, 0x0, 0x1be}) r1 = syz_io_uring_setup(0x8fe, &(0x7f0000000080)={0x0, 0x1830, 0x0, 0x0, 0x0, 0x0, r0}, &(0x7f0000ffb000/0x2000)=nil, &(0x7f0000ffb000/0x4000)=nil, &(0x7f0000000100), &(0x7f0000000140)=0x0) r3 = openat$hwrng(0xffffffffffffff9c, &(0x7f0000000180), 0x2, 0x0) r4 = syz_genetlink_get_family_id$mptcp(&(0x7f0000000300), 0xffffffffffffffff) sendmsg$MPTCP_PM_CMD_ADD_ADDR(r3, &(0x7f00000003c0)={&(0x7f00000002c0)={0x10, 0x0, 0x0, 0x10}, 0xc, &(0x7f0000000380)={&(0x7f0000000340)={0x24, r4, 0x300, 0x70bd26, 0x25dfdbfb, {}, [@MPTCP_PM_ATTR_SUBFLOWS={0x8, 0x3, 0x1}, @MPTCP_PM_ATTR_RCV_ADD_ADDRS={0x8, 0x2, 0x2}]}, 0x24}, 0x1, 0x0, 0x0, 0x20000004}, 0x8890) syz_io_uring_setup(0x20f8, &(0x7f0000000400)={0x0, 0x7677, 0x8, 0x3, 0x22f}, &(0x7f0000ffe000/0x2000)=nil, &(0x7f0000ffb000/0x2000)=nil, &(0x7f0000000480)=0x0, &(0x7f00000004c0)) r6 = openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000500)='./cgroup/syz1\x00', 0x200002, 0x0) syz_io_uring_submit(r5, r2, &(0x7f0000000580)=@IORING_OP_FILES_UPDATE={0x14, 0x4, 0x0, 0x0, 0x40, &(0x7f0000000540)=[0xffffffffffffffff, 0xffffffffffffffff, r6, r0, r1], 0x5}, 0x3) socket$inet6_tcp(0xa, 0x1, 0x0) openat$procfs(0xffffffffffffff9c, &(0x7f00000010c0)='/proc/crypto\x00', 0x0, 0x0) io_uring_setup(0x7c8f, &(0x7f0000001140)={0x0, 0xc240, 0x10, 0x3, 0x1c7}) 21:21:46 executing program 2: syz_io_uring_setup(0x8fe, &(0x7f0000000080), &(0x7f0000ffb000/0x2000)=nil, &(0x7f0000ffb000/0x4000)=nil, &(0x7f0000000100), &(0x7f0000000140)) openat$hwrng(0xffffffffffffff9c, &(0x7f0000000180), 0x0, 0x0) openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000500)='./cgroup/syz1\x00', 0x200002, 0x0) syz_io_uring_submit(0x0, 0x0, &(0x7f0000000580)=@IORING_OP_FILES_UPDATE={0x14, 0x0, 0x0, 0x0, 0x0, &(0x7f0000000540)=[0xffffffffffffffff], 0x1}, 0x3) io_uring_setup(0x2812, &(0x7f00000005c0)={0x0, 0x5e1b, 0x2, 0x3, 0x12f}) 21:21:46 executing program 0: syz_io_uring_setup(0x8fe, &(0x7f0000000080), &(0x7f0000ffb000/0x2000)=nil, &(0x7f0000ffb000/0x4000)=nil, &(0x7f0000000100), &(0x7f0000000140)) openat$hwrng(0xffffffffffffff9c, &(0x7f0000000180), 0x0, 0x0) openat$cgroup_root(0xffffffffffffff9c, 0x0, 0x200002, 0x0) syz_io_uring_submit(0x0, 0x0, 0x0, 0x0) io_uring_setup(0x2812, &(0x7f00000005c0)={0x0, 0x0, 0x2}) 21:21:46 executing program 7: r0 = io_uring_setup(0x355e, &(0x7f0000000000)={0x0, 0x0, 0x20, 0x0, 0x1be}) r1 = syz_io_uring_setup(0x8fe, &(0x7f0000000080)={0x0, 0x1830, 0x0, 0x0, 0x0, 0x0, r0}, &(0x7f0000ffb000/0x2000)=nil, &(0x7f0000ffb000/0x4000)=nil, &(0x7f0000000100), &(0x7f0000000140)=0x0) r3 = openat$hwrng(0xffffffffffffff9c, &(0x7f0000000180), 0x2, 0x0) r4 = syz_genetlink_get_family_id$mptcp(&(0x7f0000000300), 0xffffffffffffffff) sendmsg$MPTCP_PM_CMD_ADD_ADDR(r3, &(0x7f00000003c0)={&(0x7f00000002c0)={0x10, 0x0, 0x0, 0x10}, 0xc, &(0x7f0000000380)={&(0x7f0000000340)={0x24, r4, 0x300, 0x70bd26, 0x25dfdbfb, {}, [@MPTCP_PM_ATTR_SUBFLOWS={0x8, 0x3, 0x1}, @MPTCP_PM_ATTR_RCV_ADD_ADDRS={0x8, 0x2, 0x2}]}, 0x24}, 0x1, 0x0, 0x0, 0x20000004}, 0x8890) syz_io_uring_setup(0x20f8, &(0x7f0000000400)={0x0, 0x7677, 0x8, 0x3, 0x22f}, &(0x7f0000ffe000/0x2000)=nil, &(0x7f0000ffb000/0x2000)=nil, &(0x7f0000000480)=0x0, &(0x7f00000004c0)) r6 = openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000500)='./cgroup/syz1\x00', 0x200002, 0x0) syz_io_uring_submit(r5, r2, &(0x7f0000000580)=@IORING_OP_FILES_UPDATE={0x14, 0x4, 0x0, 0x0, 0x40, &(0x7f0000000540)=[0xffffffffffffffff, 0xffffffffffffffff, r6, r0, r1], 0x5}, 0x3) socket$inet6_tcp(0xa, 0x1, 0x0) openat$procfs(0xffffffffffffff9c, &(0x7f00000010c0)='/proc/crypto\x00', 0x0, 0x0) io_uring_setup(0x7c8f, &(0x7f0000001140)={0x0, 0xc240, 0x10, 0x3, 0x1c7}) [ 635.682393] kmemleak: Found object by alias at 0x607f1a6398ac [ 635.682410] CPU: 1 UID: 0 PID: 7589 Comm: iou-sqp-7583 Tainted: G W 6.17.0-rc3-next-20250829 #1 PREEMPT(voluntary) [ 635.682427] Tainted: [W]=WARN [ 635.682431] Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.12.0-1 04/01/2014 [ 635.682437] Call Trace: [ 635.682441] [ 635.682446] dump_stack_lvl+0xca/0x120 [ 635.682467] __lookup_object+0x94/0xb0 [ 635.682483] delete_object_full+0x27/0x70 [ 635.682509] free_percpu+0x30/0x1160 [ 635.682530] ? arch_uprobe_clear_state+0x16/0x140 [ 635.682553] futex_hash_free+0x38/0xc0 [ 635.682566] mmput+0x2d3/0x390 [ 635.682584] do_exit+0x79d/0x2970 [ 635.682598] ? __pfx_try_to_wake_up+0x10/0x10 [ 635.682620] ? __pfx_do_exit+0x10/0x10 [ 635.682631] ? io_sq_thread+0xfbd/0x1b00 [ 635.682646] ? lock_release+0xc8/0x290 [ 635.682662] io_sq_thread+0xfc9/0x1b00 [ 635.682683] ? __pfx_io_sq_thread+0x10/0x10 [ 635.682699] ? __lock_acquire+0xc65/0x1b70 [ 635.682712] ? __pfx_autoremove_wake_function+0x10/0x10 [ 635.682726] ? __lock_acquire+0xc65/0x1b70 [ 635.682746] ? do_raw_spin_lock+0x123/0x260 [ 635.682761] ? find_held_lock+0x2b/0x80 [ 635.682776] ? __pfx_io_sq_thread+0x10/0x10 [ 635.682791] ? lock_release+0xc8/0x290 [ 635.682804] ? __pfx_io_sq_thread+0x10/0x10 [ 635.682819] ret_from_fork+0x34b/0x430 [ 635.682836] ? __pfx_io_sq_thread+0x10/0x10 [ 635.682851] ret_from_fork_asm+0x1a/0x30 [ 635.682873] [ 635.682877] kmemleak: Object (percpu) 0x607f1a6398a8 (size 8): [ 635.682884] kmemleak: comm "syz-executor.6", pid 7597, jiffies 4295302525 [ 635.682890] kmemleak: min_count = 1 [ 635.682894] kmemleak: count = 0 [ 635.682898] kmemleak: flags = 0x21 [ 635.682901] kmemleak: checksum = 0 [ 635.682905] kmemleak: backtrace: [ 635.682908] pcpu_alloc_noprof+0x87a/0x1170 [ 635.682922] percpu_ref_init+0x37/0x400 [ 635.682938] io_uring_setup+0x44c/0x2000 [ 635.682949] __x64_sys_io_uring_setup+0xc8/0x170 [ 635.682959] do_syscall_64+0xbf/0x360 [ 635.682968] entry_SYSCALL_64_after_hwframe+0x77/0x7f 21:21:46 executing program 3: r0 = io_uring_setup(0x355e, &(0x7f0000000000)={0x0, 0x0, 0x20, 0x1, 0x1be}) r1 = syz_io_uring_setup(0x8fe, &(0x7f0000000080), &(0x7f0000ffb000/0x2000)=nil, &(0x7f0000ffb000/0x4000)=nil, &(0x7f0000000100), &(0x7f0000000140)=0x0) openat$hwrng(0xffffffffffffff9c, &(0x7f0000000180), 0x2, 0x0) syz_genetlink_get_family_id$mptcp(&(0x7f0000000300), 0xffffffffffffffff) r3 = openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000500)='./cgroup/syz1\x00', 0x200002, 0x0) syz_io_uring_submit(0x0, r2, &(0x7f0000000580)=@IORING_OP_FILES_UPDATE={0x14, 0x4, 0x0, 0x0, 0x40, &(0x7f0000000540)=[0xffffffffffffffff, 0xffffffffffffffff, r3, r0, r1], 0x5}, 0x3) io_uring_setup(0x2812, &(0x7f00000005c0)={0x0, 0x5e1b, 0x2, 0x3, 0x12f}) socket$inet6_tcp(0xa, 0x1, 0x0) io_uring_setup(0x7c8f, &(0x7f0000001140)={0x0, 0xc240, 0x10, 0x3, 0x1c7}) 21:21:46 executing program 1: r0 = io_uring_setup(0x355e, &(0x7f0000000000)={0x0, 0x0, 0x20, 0x1, 0x1be}) r1 = openat$hwrng(0xffffffffffffff9c, &(0x7f0000000180), 0x2, 0x0) r2 = syz_io_uring_setup(0x65dd, &(0x7f00000001c0)={0x0, 0x0, 0x20, 0x2}, &(0x7f0000ffe000/0x1000)=nil, &(0x7f0000ffd000/0x1000)=nil, &(0x7f0000000240), &(0x7f0000000280)) syz_genetlink_get_family_id$mptcp(&(0x7f0000000300), r1) syz_io_uring_setup(0x20f8, &(0x7f0000000400)={0x0, 0x0, 0x8, 0x3, 0x22f, 0x0, r2}, &(0x7f0000ffe000/0x2000)=nil, &(0x7f0000ffb000/0x2000)=nil, &(0x7f0000000480)=0x0, &(0x7f00000004c0)) r4 = openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000500)='./cgroup/syz1\x00', 0x200002, 0x0) syz_io_uring_submit(r3, 0x0, &(0x7f0000000580)=@IORING_OP_FILES_UPDATE={0x14, 0x4, 0x0, 0x0, 0x40, &(0x7f0000000540)=[r2, 0xffffffffffffffff, r4, r0, 0xffffffffffffffff], 0x5}, 0x3) io_uring_setup(0x2812, &(0x7f00000005c0)={0x0, 0x5e1b, 0x2, 0x3, 0x12f, 0x0, r2}) socket$inet6_tcp(0xa, 0x1, 0x0) openat$procfs(0xffffffffffffff9c, &(0x7f00000010c0)='/proc/crypto\x00', 0x0, 0x0) io_uring_setup(0x7c8f, &(0x7f0000001140)={0x0, 0xc240, 0x10, 0x3, 0x1c7, 0x0, r2}) 21:21:46 executing program 0: syz_io_uring_setup(0x8fe, &(0x7f0000000080), &(0x7f0000ffb000/0x2000)=nil, &(0x7f0000ffb000/0x4000)=nil, &(0x7f0000000100), &(0x7f0000000140)) openat$hwrng(0xffffffffffffff9c, &(0x7f0000000180), 0x0, 0x0) openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000500)='./cgroup/syz1\x00', 0x200002, 0x0) syz_io_uring_submit(0x0, 0x0, 0x0, 0x0) io_uring_setup(0x0, &(0x7f00000005c0)={0x0, 0x0, 0x2}) 21:21:46 executing program 6: r0 = io_uring_setup(0x355e, &(0x7f0000000000)={0x0, 0x0, 0x20, 0x0, 0x1be}) r1 = syz_io_uring_setup(0x8fe, &(0x7f0000000080)={0x0, 0x1830, 0x0, 0x0, 0x0, 0x0, r0}, &(0x7f0000ffb000/0x2000)=nil, &(0x7f0000ffb000/0x4000)=nil, &(0x7f0000000100), &(0x7f0000000140)=0x0) r3 = openat$hwrng(0xffffffffffffff9c, &(0x7f0000000180), 0x2, 0x0) r4 = syz_genetlink_get_family_id$mptcp(&(0x7f0000000300), r3) sendmsg$MPTCP_PM_CMD_ADD_ADDR(0xffffffffffffffff, &(0x7f00000003c0)={&(0x7f00000002c0)={0x10, 0x0, 0x0, 0x10}, 0xc, &(0x7f0000000380)={&(0x7f0000000340)={0x24, r4, 0x300, 0x70bd26, 0x25dfdbfb, {}, [@MPTCP_PM_ATTR_SUBFLOWS={0x8, 0x3, 0x1}, @MPTCP_PM_ATTR_RCV_ADD_ADDRS={0x8, 0x2, 0x2}]}, 0x24}, 0x1, 0x0, 0x0, 0x20000004}, 0x8890) syz_io_uring_setup(0x20f8, &(0x7f0000000400)={0x0, 0x7677, 0x8, 0x3, 0x22f}, &(0x7f0000ffe000/0x2000)=nil, &(0x7f0000ffb000/0x2000)=nil, &(0x7f0000000480)=0x0, &(0x7f00000004c0)) r6 = openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000500)='./cgroup/syz1\x00', 0x200002, 0x0) syz_io_uring_submit(r5, r2, &(0x7f0000000580)=@IORING_OP_FILES_UPDATE={0x14, 0x4, 0x0, 0x0, 0x40, &(0x7f0000000540)=[0xffffffffffffffff, 0xffffffffffffffff, r6, r0, r1], 0x5}, 0x3) socket$inet6_tcp(0xa, 0x1, 0x0) openat$procfs(0xffffffffffffff9c, &(0x7f00000010c0)='/proc/crypto\x00', 0x0, 0x0) io_uring_setup(0x7c8f, &(0x7f0000001140)={0x0, 0xc240, 0x10, 0x3, 0x1c7}) 21:21:46 executing program 4: ioctl$SCSI_IOCTL_DOORUNLOCK(0xffffffffffffffff, 0x5381) r0 = syz_open_dev$mouse(&(0x7f0000000000), 0x578, 0x4000) ioctl$SG_GET_PACK_ID(r0, 0x227c, &(0x7f0000000040)) syz_genetlink_get_family_id$nl80211(&(0x7f00000000c0), 0xffffffffffffffff) syz_open_dev$vcsa(&(0x7f0000000440), 0x56, 0x4000) socketpair(0x0, 0x3, 0x6, &(0x7f0000000640)) r1 = openat$tcp_congestion(0xffffffffffffff9c, 0x0, 0x1, 0x0) write$tcp_congestion(r1, &(0x7f0000000840)='htcp\x00', 0x5) 21:21:46 executing program 5: r0 = io_uring_setup(0x355e, &(0x7f0000000000)={0x0, 0x0, 0x20, 0x0, 0x1be}) r1 = syz_io_uring_setup(0x8fe, &(0x7f0000000080)={0x0, 0x0, 0x0, 0x0, 0x1b8}, &(0x7f0000ffb000/0x2000)=nil, &(0x7f0000ffb000/0x4000)=nil, &(0x7f0000000100), &(0x7f0000000140)=0x0) r3 = openat$hwrng(0xffffffffffffff9c, 0x0, 0x2, 0x0) r4 = syz_io_uring_setup(0x65dd, &(0x7f00000001c0)={0x0, 0xf46f, 0x20, 0x2, 0xdf}, &(0x7f0000ffe000/0x1000)=nil, &(0x7f0000ffd000/0x1000)=nil, &(0x7f0000000240), &(0x7f0000000280)) r5 = syz_genetlink_get_family_id$mptcp(&(0x7f0000000300), r3) sendmsg$MPTCP_PM_CMD_ADD_ADDR(r3, &(0x7f00000003c0)={&(0x7f00000002c0)={0x10, 0x0, 0x0, 0x10}, 0xc, &(0x7f0000000380)={&(0x7f0000000340)={0x24, r5, 0x300, 0x70bd26, 0x25dfdbfb, {}, [@MPTCP_PM_ATTR_SUBFLOWS={0x8, 0x3, 0x1}, @MPTCP_PM_ATTR_RCV_ADD_ADDRS={0x8, 0x2, 0x2}]}, 0x24}, 0x1, 0x0, 0x0, 0x20000004}, 0x8890) r6 = openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000500)='./cgroup/syz1\x00', 0x200002, 0x0) syz_io_uring_submit(0x0, r2, &(0x7f0000000580)=@IORING_OP_FILES_UPDATE={0x14, 0x4, 0x0, 0x0, 0x40, &(0x7f0000000540)=[r4, 0xffffffffffffffff, r6, r0, r1], 0x5}, 0x3) socket$inet6_tcp(0xa, 0x1, 0x0) openat$procfs(0xffffffffffffff9c, &(0x7f00000010c0)='/proc/crypto\x00', 0x0, 0x0) 21:21:46 executing program 7: r0 = io_uring_setup(0x355e, &(0x7f0000000000)={0x0, 0x0, 0x20, 0x0, 0x1be}) r1 = syz_io_uring_setup(0x8fe, &(0x7f0000000080)={0x0, 0x1830, 0x0, 0x0, 0x0, 0x0, r0}, &(0x7f0000ffb000/0x2000)=nil, &(0x7f0000ffb000/0x4000)=nil, &(0x7f0000000100), &(0x7f0000000140)=0x0) r3 = openat$hwrng(0xffffffffffffff9c, &(0x7f0000000180), 0x2, 0x0) r4 = syz_genetlink_get_family_id$mptcp(&(0x7f0000000300), 0xffffffffffffffff) sendmsg$MPTCP_PM_CMD_ADD_ADDR(r3, &(0x7f00000003c0)={&(0x7f00000002c0)={0x10, 0x0, 0x0, 0x10}, 0xc, &(0x7f0000000380)={&(0x7f0000000340)={0x24, r4, 0x300, 0x70bd26, 0x25dfdbfb, {}, [@MPTCP_PM_ATTR_SUBFLOWS={0x8, 0x3, 0x1}, @MPTCP_PM_ATTR_RCV_ADD_ADDRS={0x8, 0x2, 0x2}]}, 0x24}, 0x1, 0x0, 0x0, 0x20000004}, 0x8890) syz_io_uring_setup(0x20f8, &(0x7f0000000400)={0x0, 0x7677, 0x8, 0x3, 0x22f}, &(0x7f0000ffe000/0x2000)=nil, &(0x7f0000ffb000/0x2000)=nil, &(0x7f0000000480)=0x0, &(0x7f00000004c0)) r6 = openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000500)='./cgroup/syz1\x00', 0x200002, 0x0) syz_io_uring_submit(r5, r2, &(0x7f0000000580)=@IORING_OP_FILES_UPDATE={0x14, 0x4, 0x0, 0x0, 0x40, &(0x7f0000000540)=[0xffffffffffffffff, 0xffffffffffffffff, r6, r0, r1], 0x5}, 0x3) socket$inet6_tcp(0xa, 0x1, 0x0) openat$procfs(0xffffffffffffff9c, &(0x7f00000010c0)='/proc/crypto\x00', 0x0, 0x0) io_uring_setup(0x7c8f, &(0x7f0000001140)={0x0, 0xc240, 0x10, 0x3, 0x1c7}) 21:21:55 executing program 2: syz_io_uring_setup(0x8fe, &(0x7f0000000080), &(0x7f0000ffb000/0x2000)=nil, &(0x7f0000ffb000/0x4000)=nil, &(0x7f0000000100), &(0x7f0000000140)) openat$hwrng(0xffffffffffffff9c, &(0x7f0000000180), 0x0, 0x0) openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000500)='./cgroup/syz1\x00', 0x200002, 0x0) syz_io_uring_submit(0x0, 0x0, &(0x7f0000000580)=@IORING_OP_FILES_UPDATE={0x14, 0x0, 0x0, 0x0, 0x0, &(0x7f0000000540)}, 0x3) io_uring_setup(0x2812, &(0x7f00000005c0)={0x0, 0x5e1b, 0x2, 0x3, 0x12f}) 21:21:55 executing program 0: syz_io_uring_setup(0x8fe, &(0x7f0000000080), &(0x7f0000ffb000/0x2000)=nil, &(0x7f0000ffb000/0x4000)=nil, &(0x7f0000000100), &(0x7f0000000140)) openat$hwrng(0xffffffffffffff9c, &(0x7f0000000180), 0x0, 0x0) openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000500)='./cgroup/syz1\x00', 0x200002, 0x0) syz_io_uring_submit(0x0, 0x0, 0x0, 0x0) io_uring_setup(0x0, &(0x7f00000005c0)={0x0, 0x0, 0x2}) 21:21:55 executing program 4: ioctl$SCSI_IOCTL_DOORUNLOCK(0xffffffffffffffff, 0x5381) r0 = syz_open_dev$mouse(&(0x7f0000000000), 0x578, 0x4000) ioctl$SG_GET_PACK_ID(r0, 0x227c, &(0x7f0000000040)) syz_genetlink_get_family_id$nl80211(&(0x7f00000000c0), 0xffffffffffffffff) syz_open_dev$vcsa(&(0x7f0000000440), 0x56, 0x4000) socketpair(0x0, 0x3, 0x6, &(0x7f0000000640)) openat$tcp_congestion(0xffffffffffffff9c, &(0x7f0000000800), 0x1, 0x0) write$tcp_congestion(0xffffffffffffffff, &(0x7f0000000840)='htcp\x00', 0x5) 21:21:55 executing program 6: r0 = io_uring_setup(0x355e, &(0x7f0000000000)={0x0, 0x0, 0x20, 0x0, 0x1be}) r1 = syz_io_uring_setup(0x8fe, &(0x7f0000000080)={0x0, 0x1830, 0x0, 0x0, 0x0, 0x0, r0}, &(0x7f0000ffb000/0x2000)=nil, &(0x7f0000ffb000/0x4000)=nil, &(0x7f0000000100), &(0x7f0000000140)=0x0) r3 = openat$hwrng(0xffffffffffffff9c, &(0x7f0000000180), 0x2, 0x0) r4 = syz_genetlink_get_family_id$mptcp(&(0x7f0000000300), r3) sendmsg$MPTCP_PM_CMD_ADD_ADDR(0xffffffffffffffff, &(0x7f00000003c0)={&(0x7f00000002c0)={0x10, 0x0, 0x0, 0x10}, 0xc, &(0x7f0000000380)={&(0x7f0000000340)={0x24, r4, 0x300, 0x70bd26, 0x25dfdbfb, {}, [@MPTCP_PM_ATTR_SUBFLOWS={0x8, 0x3, 0x1}, @MPTCP_PM_ATTR_RCV_ADD_ADDRS={0x8, 0x2, 0x2}]}, 0x24}, 0x1, 0x0, 0x0, 0x20000004}, 0x8890) syz_io_uring_setup(0x20f8, &(0x7f0000000400)={0x0, 0x7677, 0x8, 0x3, 0x22f}, &(0x7f0000ffe000/0x2000)=nil, &(0x7f0000ffb000/0x2000)=nil, &(0x7f0000000480)=0x0, &(0x7f00000004c0)) r6 = openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000500)='./cgroup/syz1\x00', 0x200002, 0x0) syz_io_uring_submit(r5, r2, &(0x7f0000000580)=@IORING_OP_FILES_UPDATE={0x14, 0x4, 0x0, 0x0, 0x40, &(0x7f0000000540)=[0xffffffffffffffff, 0xffffffffffffffff, r6, r0, r1], 0x5}, 0x3) socket$inet6_tcp(0xa, 0x1, 0x0) openat$procfs(0xffffffffffffff9c, &(0x7f00000010c0)='/proc/crypto\x00', 0x0, 0x0) io_uring_setup(0x7c8f, &(0x7f0000001140)={0x0, 0xc240, 0x10, 0x3, 0x1c7}) 21:21:55 executing program 3: r0 = io_uring_setup(0x355e, &(0x7f0000000000)={0x0, 0x0, 0x20, 0x1, 0x1be}) r1 = syz_io_uring_setup(0x8fe, &(0x7f0000000080), &(0x7f0000ffb000/0x2000)=nil, &(0x7f0000ffb000/0x4000)=nil, &(0x7f0000000100), &(0x7f0000000140)=0x0) openat$hwrng(0xffffffffffffff9c, &(0x7f0000000180), 0x2, 0x0) syz_genetlink_get_family_id$mptcp(&(0x7f0000000300), 0xffffffffffffffff) r3 = openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000500)='./cgroup/syz1\x00', 0x200002, 0x0) syz_io_uring_submit(0x0, r2, &(0x7f0000000580)=@IORING_OP_FILES_UPDATE={0x14, 0x4, 0x0, 0x0, 0x40, &(0x7f0000000540)=[0xffffffffffffffff, 0xffffffffffffffff, r3, r0, r1], 0x5}, 0x3) io_uring_setup(0x2812, &(0x7f00000005c0)={0x0, 0x5e1b, 0x2, 0x3, 0x12f}) socket$inet6_tcp(0xa, 0x1, 0x0) io_uring_setup(0x7c8f, &(0x7f0000001140)={0x0, 0xc240, 0x10, 0x3, 0x1c7}) 21:21:55 executing program 5: r0 = io_uring_setup(0x355e, &(0x7f0000000000)={0x0, 0x0, 0x20, 0x0, 0x1be}) r1 = syz_io_uring_setup(0x8fe, &(0x7f0000000080)={0x0, 0x0, 0x0, 0x0, 0x1b8}, &(0x7f0000ffb000/0x2000)=nil, &(0x7f0000ffb000/0x4000)=nil, &(0x7f0000000100), &(0x7f0000000140)=0x0) r3 = openat$hwrng(0xffffffffffffff9c, &(0x7f0000000180), 0x0, 0x0) r4 = syz_io_uring_setup(0x65dd, &(0x7f00000001c0)={0x0, 0xf46f, 0x20, 0x2, 0xdf}, &(0x7f0000ffe000/0x1000)=nil, &(0x7f0000ffd000/0x1000)=nil, &(0x7f0000000240), &(0x7f0000000280)) r5 = syz_genetlink_get_family_id$mptcp(&(0x7f0000000300), r3) sendmsg$MPTCP_PM_CMD_ADD_ADDR(r3, &(0x7f00000003c0)={&(0x7f00000002c0)={0x10, 0x0, 0x0, 0x10}, 0xc, &(0x7f0000000380)={&(0x7f0000000340)={0x24, r5, 0x300, 0x70bd26, 0x25dfdbfb, {}, [@MPTCP_PM_ATTR_SUBFLOWS={0x8, 0x3, 0x1}, @MPTCP_PM_ATTR_RCV_ADD_ADDRS={0x8, 0x2, 0x2}]}, 0x24}, 0x1, 0x0, 0x0, 0x20000004}, 0x8890) r6 = openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000500)='./cgroup/syz1\x00', 0x200002, 0x0) syz_io_uring_submit(0x0, r2, &(0x7f0000000580)=@IORING_OP_FILES_UPDATE={0x14, 0x4, 0x0, 0x0, 0x40, &(0x7f0000000540)=[r4, 0xffffffffffffffff, r6, r0, r1], 0x5}, 0x3) socket$inet6_tcp(0xa, 0x1, 0x0) openat$procfs(0xffffffffffffff9c, &(0x7f00000010c0)='/proc/crypto\x00', 0x0, 0x0) 21:21:55 executing program 7: r0 = io_uring_setup(0x355e, &(0x7f0000000000)={0x0, 0x0, 0x20, 0x0, 0x1be}) r1 = syz_io_uring_setup(0x8fe, &(0x7f0000000080)={0x0, 0x1830, 0x0, 0x0, 0x0, 0x0, r0}, &(0x7f0000ffb000/0x2000)=nil, &(0x7f0000ffb000/0x4000)=nil, &(0x7f0000000100), &(0x7f0000000140)=0x0) r3 = openat$hwrng(0xffffffffffffff9c, &(0x7f0000000180), 0x2, 0x0) r4 = syz_genetlink_get_family_id$mptcp(&(0x7f0000000300), 0xffffffffffffffff) sendmsg$MPTCP_PM_CMD_ADD_ADDR(r3, &(0x7f00000003c0)={&(0x7f00000002c0)={0x10, 0x0, 0x0, 0x10}, 0xc, &(0x7f0000000380)={&(0x7f0000000340)={0x24, r4, 0x300, 0x70bd26, 0x25dfdbfb, {}, [@MPTCP_PM_ATTR_SUBFLOWS={0x8, 0x3, 0x1}, @MPTCP_PM_ATTR_RCV_ADD_ADDRS={0x8, 0x2, 0x2}]}, 0x24}, 0x1, 0x0, 0x0, 0x20000004}, 0x8890) syz_io_uring_setup(0x20f8, &(0x7f0000000400)={0x0, 0x7677, 0x8, 0x3, 0x22f}, &(0x7f0000ffe000/0x2000)=nil, &(0x7f0000ffb000/0x2000)=nil, &(0x7f0000000480)=0x0, &(0x7f00000004c0)) r6 = openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000500)='./cgroup/syz1\x00', 0x200002, 0x0) syz_io_uring_submit(r5, r2, &(0x7f0000000580)=@IORING_OP_FILES_UPDATE={0x14, 0x4, 0x0, 0x0, 0x40, &(0x7f0000000540)=[0xffffffffffffffff, 0xffffffffffffffff, r6, r0, r1], 0x5}, 0x3) socket$inet6_tcp(0xa, 0x1, 0x0) openat$procfs(0xffffffffffffff9c, &(0x7f00000010c0)='/proc/crypto\x00', 0x0, 0x0) 21:21:55 executing program 1: r0 = io_uring_setup(0x355e, &(0x7f0000000000)={0x0, 0x0, 0x20, 0x1, 0x1be}) r1 = openat$hwrng(0xffffffffffffff9c, &(0x7f0000000180), 0x2, 0x0) r2 = syz_io_uring_setup(0x65dd, &(0x7f00000001c0)={0x0, 0x0, 0x20, 0x2}, &(0x7f0000ffe000/0x1000)=nil, &(0x7f0000ffd000/0x1000)=nil, &(0x7f0000000240), &(0x7f0000000280)) syz_genetlink_get_family_id$mptcp(&(0x7f0000000300), r1) syz_io_uring_setup(0x20f8, &(0x7f0000000400)={0x0, 0x0, 0x8, 0x3, 0x22f, 0x0, r2}, &(0x7f0000ffe000/0x2000)=nil, &(0x7f0000ffb000/0x2000)=nil, &(0x7f0000000480)=0x0, &(0x7f00000004c0)) r4 = openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000500)='./cgroup/syz1\x00', 0x200002, 0x0) syz_io_uring_submit(r3, 0x0, &(0x7f0000000580)=@IORING_OP_FILES_UPDATE={0x14, 0x4, 0x0, 0x0, 0x40, &(0x7f0000000540)=[r2, 0xffffffffffffffff, r4, r0, 0xffffffffffffffff], 0x5}, 0x3) io_uring_setup(0x2812, &(0x7f00000005c0)={0x0, 0x5e1b, 0x2, 0x3, 0x12f, 0x0, r2}) socket$inet6_tcp(0xa, 0x1, 0x0) openat$procfs(0xffffffffffffff9c, &(0x7f00000010c0)='/proc/crypto\x00', 0x0, 0x0) io_uring_setup(0x7c8f, &(0x7f0000001140)={0x0, 0xc240, 0x10, 0x3, 0x1c7, 0x0, r2}) 21:21:55 executing program 0: syz_io_uring_setup(0x8fe, &(0x7f0000000080), &(0x7f0000ffb000/0x2000)=nil, &(0x7f0000ffb000/0x4000)=nil, &(0x7f0000000100), &(0x7f0000000140)) openat$hwrng(0xffffffffffffff9c, &(0x7f0000000180), 0x0, 0x0) openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000500)='./cgroup/syz1\x00', 0x200002, 0x0) syz_io_uring_submit(0x0, 0x0, 0x0, 0x0) io_uring_setup(0x0, &(0x7f00000005c0)={0x0, 0x0, 0x2}) 21:21:55 executing program 5: r0 = io_uring_setup(0x355e, &(0x7f0000000000)={0x0, 0x0, 0x20, 0x0, 0x1be}) r1 = syz_io_uring_setup(0x8fe, &(0x7f0000000080)={0x0, 0x0, 0x0, 0x0, 0x1b8}, &(0x7f0000ffb000/0x2000)=nil, &(0x7f0000ffb000/0x4000)=nil, &(0x7f0000000100), &(0x7f0000000140)=0x0) r3 = openat$hwrng(0xffffffffffffff9c, &(0x7f0000000180), 0x0, 0x0) r4 = syz_io_uring_setup(0x65dd, &(0x7f00000001c0)={0x0, 0xf46f, 0x20, 0x2, 0xdf}, &(0x7f0000ffe000/0x1000)=nil, &(0x7f0000ffd000/0x1000)=nil, &(0x7f0000000240), &(0x7f0000000280)) r5 = syz_genetlink_get_family_id$mptcp(&(0x7f0000000300), r3) sendmsg$MPTCP_PM_CMD_ADD_ADDR(r3, &(0x7f00000003c0)={&(0x7f00000002c0)={0x10, 0x0, 0x0, 0x10}, 0xc, &(0x7f0000000380)={&(0x7f0000000340)={0x24, r5, 0x300, 0x70bd26, 0x25dfdbfb, {}, [@MPTCP_PM_ATTR_SUBFLOWS={0x8, 0x3, 0x1}, @MPTCP_PM_ATTR_RCV_ADD_ADDRS={0x8, 0x2, 0x2}]}, 0x24}, 0x1, 0x0, 0x0, 0x20000004}, 0x8890) r6 = openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000500)='./cgroup/syz1\x00', 0x200002, 0x0) syz_io_uring_submit(0x0, r2, &(0x7f0000000580)=@IORING_OP_FILES_UPDATE={0x14, 0x4, 0x0, 0x0, 0x40, &(0x7f0000000540)=[r4, 0xffffffffffffffff, r6, r0, r1], 0x5}, 0x3) socket$inet6_tcp(0xa, 0x1, 0x0) openat$procfs(0xffffffffffffff9c, &(0x7f00000010c0)='/proc/crypto\x00', 0x0, 0x0) 21:22:04 executing program 0: syz_io_uring_setup(0x8fe, &(0x7f0000000080), &(0x7f0000ffb000/0x2000)=nil, &(0x7f0000ffb000/0x4000)=nil, &(0x7f0000000100), &(0x7f0000000140)) openat$hwrng(0xffffffffffffff9c, &(0x7f0000000180), 0x0, 0x0) openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000500)='./cgroup/syz1\x00', 0x200002, 0x0) syz_io_uring_submit(0x0, 0x0, 0x0, 0x0) io_uring_setup(0x2812, 0x0) 21:22:04 executing program 7: r0 = io_uring_setup(0x355e, &(0x7f0000000000)={0x0, 0x0, 0x20, 0x0, 0x1be}) r1 = syz_io_uring_setup(0x8fe, &(0x7f0000000080)={0x0, 0x1830, 0x0, 0x0, 0x0, 0x0, r0}, &(0x7f0000ffb000/0x2000)=nil, &(0x7f0000ffb000/0x4000)=nil, &(0x7f0000000100), &(0x7f0000000140)=0x0) r3 = openat$hwrng(0xffffffffffffff9c, &(0x7f0000000180), 0x2, 0x0) r4 = syz_genetlink_get_family_id$mptcp(&(0x7f0000000300), 0xffffffffffffffff) sendmsg$MPTCP_PM_CMD_ADD_ADDR(r3, &(0x7f00000003c0)={&(0x7f00000002c0)={0x10, 0x0, 0x0, 0x10}, 0xc, &(0x7f0000000380)={&(0x7f0000000340)={0x24, r4, 0x300, 0x70bd26, 0x25dfdbfb, {}, [@MPTCP_PM_ATTR_SUBFLOWS={0x8, 0x3, 0x1}, @MPTCP_PM_ATTR_RCV_ADD_ADDRS={0x8, 0x2, 0x2}]}, 0x24}, 0x1, 0x0, 0x0, 0x20000004}, 0x8890) syz_io_uring_setup(0x20f8, &(0x7f0000000400)={0x0, 0x7677, 0x8, 0x3, 0x22f}, &(0x7f0000ffe000/0x2000)=nil, &(0x7f0000ffb000/0x2000)=nil, &(0x7f0000000480)=0x0, &(0x7f00000004c0)) r6 = openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000500)='./cgroup/syz1\x00', 0x200002, 0x0) syz_io_uring_submit(r5, r2, &(0x7f0000000580)=@IORING_OP_FILES_UPDATE={0x14, 0x4, 0x0, 0x0, 0x40, &(0x7f0000000540)=[0xffffffffffffffff, 0xffffffffffffffff, r6, r0, r1], 0x5}, 0x3) socket$inet6_tcp(0xa, 0x1, 0x0) 21:22:04 executing program 1: r0 = io_uring_setup(0x355e, &(0x7f0000000000)={0x0, 0x0, 0x20, 0x1, 0x1be}) r1 = openat$hwrng(0xffffffffffffff9c, &(0x7f0000000180), 0x2, 0x0) r2 = syz_io_uring_setup(0x65dd, &(0x7f00000001c0)={0x0, 0x0, 0x20, 0x2}, &(0x7f0000ffe000/0x1000)=nil, &(0x7f0000ffd000/0x1000)=nil, &(0x7f0000000240), &(0x7f0000000280)) syz_genetlink_get_family_id$mptcp(&(0x7f0000000300), r1) syz_io_uring_setup(0x20f8, &(0x7f0000000400)={0x0, 0x0, 0x8, 0x3, 0x22f, 0x0, r2}, &(0x7f0000ffe000/0x2000)=nil, &(0x7f0000ffb000/0x2000)=nil, &(0x7f0000000480)=0x0, &(0x7f00000004c0)) r4 = openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000500)='./cgroup/syz1\x00', 0x200002, 0x0) syz_io_uring_submit(r3, 0x0, &(0x7f0000000580)=@IORING_OP_FILES_UPDATE={0x14, 0x4, 0x0, 0x0, 0x40, &(0x7f0000000540)=[r2, 0xffffffffffffffff, r4, r0, 0xffffffffffffffff], 0x5}, 0x3) io_uring_setup(0x2812, &(0x7f00000005c0)={0x0, 0x5e1b, 0x2, 0x3, 0x12f, 0x0, r2}) socket$inet6_tcp(0xa, 0x1, 0x0) openat$procfs(0xffffffffffffff9c, &(0x7f00000010c0)='/proc/crypto\x00', 0x0, 0x0) io_uring_setup(0x7c8f, &(0x7f0000001140)={0x0, 0xc240, 0x10, 0x3, 0x1c7, 0x0, r2}) 21:22:04 executing program 4: ioctl$SCSI_IOCTL_DOORUNLOCK(0xffffffffffffffff, 0x5381) r0 = syz_open_dev$mouse(&(0x7f0000000000), 0x578, 0x4000) ioctl$SG_GET_PACK_ID(r0, 0x227c, &(0x7f0000000040)) syz_genetlink_get_family_id$nl80211(&(0x7f00000000c0), 0xffffffffffffffff) syz_open_dev$vcsa(&(0x7f0000000440), 0x56, 0x4000) socketpair(0x0, 0x3, 0x6, &(0x7f0000000640)) openat$tcp_congestion(0xffffffffffffff9c, &(0x7f0000000800), 0x1, 0x0) write$tcp_congestion(0xffffffffffffffff, &(0x7f0000000840)='htcp\x00', 0x5) 21:22:04 executing program 5: r0 = io_uring_setup(0x355e, &(0x7f0000000000)={0x0, 0x0, 0x20, 0x0, 0x1be}) r1 = syz_io_uring_setup(0x8fe, &(0x7f0000000080)={0x0, 0x0, 0x0, 0x0, 0x1b8}, &(0x7f0000ffb000/0x2000)=nil, &(0x7f0000ffb000/0x4000)=nil, &(0x7f0000000100), &(0x7f0000000140)=0x0) r3 = openat$hwrng(0xffffffffffffff9c, &(0x7f0000000180), 0x0, 0x0) r4 = syz_io_uring_setup(0x65dd, &(0x7f00000001c0)={0x0, 0xf46f, 0x20, 0x2, 0xdf}, &(0x7f0000ffe000/0x1000)=nil, &(0x7f0000ffd000/0x1000)=nil, &(0x7f0000000240), &(0x7f0000000280)) r5 = syz_genetlink_get_family_id$mptcp(&(0x7f0000000300), r3) sendmsg$MPTCP_PM_CMD_ADD_ADDR(r3, &(0x7f00000003c0)={&(0x7f00000002c0)={0x10, 0x0, 0x0, 0x10}, 0xc, &(0x7f0000000380)={&(0x7f0000000340)={0x24, r5, 0x300, 0x70bd26, 0x25dfdbfb, {}, [@MPTCP_PM_ATTR_SUBFLOWS={0x8, 0x3, 0x1}, @MPTCP_PM_ATTR_RCV_ADD_ADDRS={0x8, 0x2, 0x2}]}, 0x24}, 0x1, 0x0, 0x0, 0x20000004}, 0x8890) r6 = openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000500)='./cgroup/syz1\x00', 0x200002, 0x0) syz_io_uring_submit(0x0, r2, &(0x7f0000000580)=@IORING_OP_FILES_UPDATE={0x14, 0x4, 0x0, 0x0, 0x40, &(0x7f0000000540)=[r4, 0xffffffffffffffff, r6, r0, r1], 0x5}, 0x3) socket$inet6_tcp(0xa, 0x1, 0x0) openat$procfs(0xffffffffffffff9c, &(0x7f00000010c0)='/proc/crypto\x00', 0x0, 0x0) 21:22:04 executing program 3: r0 = io_uring_setup(0x355e, &(0x7f0000000000)={0x0, 0x0, 0x20, 0x1, 0x1be}) r1 = syz_io_uring_setup(0x8fe, &(0x7f0000000080), &(0x7f0000ffb000/0x2000)=nil, &(0x7f0000ffb000/0x4000)=nil, &(0x7f0000000100), &(0x7f0000000140)=0x0) openat$hwrng(0xffffffffffffff9c, &(0x7f0000000180), 0x2, 0x0) syz_genetlink_get_family_id$mptcp(&(0x7f0000000300), 0xffffffffffffffff) r3 = openat$cgroup_root(0xffffffffffffff9c, 0x0, 0x200002, 0x0) syz_io_uring_submit(0x0, r2, &(0x7f0000000580)=@IORING_OP_FILES_UPDATE={0x14, 0x4, 0x0, 0x0, 0x40, &(0x7f0000000540)=[0xffffffffffffffff, 0xffffffffffffffff, r3, r0, r1], 0x5}, 0x3) io_uring_setup(0x2812, &(0x7f00000005c0)={0x0, 0x5e1b, 0x2, 0x3, 0x12f}) socket$inet6_tcp(0xa, 0x1, 0x0) io_uring_setup(0x7c8f, &(0x7f0000001140)={0x0, 0xc240, 0x10, 0x3, 0x1c7}) 21:22:04 executing program 6: r0 = io_uring_setup(0x355e, &(0x7f0000000000)={0x0, 0x0, 0x20, 0x0, 0x1be}) r1 = syz_io_uring_setup(0x8fe, &(0x7f0000000080)={0x0, 0x1830, 0x0, 0x0, 0x0, 0x0, r0}, &(0x7f0000ffb000/0x2000)=nil, &(0x7f0000ffb000/0x4000)=nil, &(0x7f0000000100), &(0x7f0000000140)=0x0) r3 = openat$hwrng(0xffffffffffffff9c, &(0x7f0000000180), 0x2, 0x0) r4 = syz_genetlink_get_family_id$mptcp(&(0x7f0000000300), r3) sendmsg$MPTCP_PM_CMD_ADD_ADDR(0xffffffffffffffff, &(0x7f00000003c0)={&(0x7f00000002c0)={0x10, 0x0, 0x0, 0x10}, 0xc, &(0x7f0000000380)={&(0x7f0000000340)={0x24, r4, 0x300, 0x70bd26, 0x25dfdbfb, {}, [@MPTCP_PM_ATTR_SUBFLOWS={0x8, 0x3, 0x1}, @MPTCP_PM_ATTR_RCV_ADD_ADDRS={0x8, 0x2, 0x2}]}, 0x24}, 0x1, 0x0, 0x0, 0x20000004}, 0x8890) syz_io_uring_setup(0x20f8, &(0x7f0000000400)={0x0, 0x7677, 0x8, 0x3, 0x22f}, &(0x7f0000ffe000/0x2000)=nil, &(0x7f0000ffb000/0x2000)=nil, &(0x7f0000000480)=0x0, &(0x7f00000004c0)) r6 = openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000500)='./cgroup/syz1\x00', 0x200002, 0x0) syz_io_uring_submit(r5, r2, &(0x7f0000000580)=@IORING_OP_FILES_UPDATE={0x14, 0x4, 0x0, 0x0, 0x40, &(0x7f0000000540)=[0xffffffffffffffff, 0xffffffffffffffff, r6, r0, r1], 0x5}, 0x3) socket$inet6_tcp(0xa, 0x1, 0x0) openat$procfs(0xffffffffffffff9c, &(0x7f00000010c0)='/proc/crypto\x00', 0x0, 0x0) io_uring_setup(0x7c8f, &(0x7f0000001140)={0x0, 0xc240, 0x10, 0x3, 0x1c7}) 21:22:04 executing program 2: syz_io_uring_setup(0x8fe, &(0x7f0000000080), &(0x7f0000ffb000/0x2000)=nil, &(0x7f0000ffb000/0x4000)=nil, &(0x7f0000000100), &(0x7f0000000140)) openat$hwrng(0xffffffffffffff9c, &(0x7f0000000180), 0x0, 0x0) openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000500)='./cgroup/syz1\x00', 0x200002, 0x0) syz_io_uring_submit(0x0, 0x0, &(0x7f0000000580)=@IORING_OP_FILES_UPDATE={0x14, 0x0, 0x0, 0x0, 0x0, &(0x7f0000000540)}, 0x0) io_uring_setup(0x2812, &(0x7f00000005c0)={0x0, 0x5e1b, 0x2, 0x3, 0x12f}) 21:22:04 executing program 3: r0 = io_uring_setup(0x355e, &(0x7f0000000000)={0x0, 0x0, 0x20, 0x1, 0x1be}) r1 = syz_io_uring_setup(0x8fe, &(0x7f0000000080), &(0x7f0000ffb000/0x2000)=nil, &(0x7f0000ffb000/0x4000)=nil, &(0x7f0000000100), &(0x7f0000000140)=0x0) openat$hwrng(0xffffffffffffff9c, &(0x7f0000000180), 0x2, 0x0) syz_genetlink_get_family_id$mptcp(&(0x7f0000000300), 0xffffffffffffffff) r3 = openat$cgroup_root(0xffffffffffffff9c, 0x0, 0x200002, 0x0) syz_io_uring_submit(0x0, r2, &(0x7f0000000580)=@IORING_OP_FILES_UPDATE={0x14, 0x4, 0x0, 0x0, 0x40, &(0x7f0000000540)=[0xffffffffffffffff, 0xffffffffffffffff, r3, r0, r1], 0x5}, 0x3) io_uring_setup(0x2812, &(0x7f00000005c0)={0x0, 0x5e1b, 0x2, 0x3, 0x12f}) socket$inet6_tcp(0xa, 0x1, 0x0) io_uring_setup(0x7c8f, &(0x7f0000001140)={0x0, 0xc240, 0x10, 0x3, 0x1c7}) 21:22:04 executing program 5: r0 = io_uring_setup(0x355e, &(0x7f0000000000)={0x0, 0x0, 0x20, 0x0, 0x1be}) r1 = syz_io_uring_setup(0x8fe, &(0x7f0000000080)={0x0, 0x0, 0x0, 0x0, 0x1b8}, &(0x7f0000ffb000/0x2000)=nil, &(0x7f0000ffb000/0x4000)=nil, &(0x7f0000000100), &(0x7f0000000140)=0x0) r3 = openat$hwrng(0xffffffffffffff9c, &(0x7f0000000180), 0x2, 0x0) r4 = syz_io_uring_setup(0x0, &(0x7f00000001c0)={0x0, 0xf46f, 0x20, 0x2, 0xdf}, &(0x7f0000ffe000/0x1000)=nil, &(0x7f0000ffd000/0x1000)=nil, &(0x7f0000000240), &(0x7f0000000280)) r5 = syz_genetlink_get_family_id$mptcp(&(0x7f0000000300), r3) sendmsg$MPTCP_PM_CMD_ADD_ADDR(r3, &(0x7f00000003c0)={&(0x7f00000002c0)={0x10, 0x0, 0x0, 0x10}, 0xc, &(0x7f0000000380)={&(0x7f0000000340)={0x24, r5, 0x300, 0x70bd26, 0x25dfdbfb, {}, [@MPTCP_PM_ATTR_SUBFLOWS={0x8, 0x3, 0x1}, @MPTCP_PM_ATTR_RCV_ADD_ADDRS={0x8, 0x2, 0x2}]}, 0x24}, 0x1, 0x0, 0x0, 0x20000004}, 0x8890) r6 = openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000500)='./cgroup/syz1\x00', 0x200002, 0x0) syz_io_uring_submit(0x0, r2, &(0x7f0000000580)=@IORING_OP_FILES_UPDATE={0x14, 0x4, 0x0, 0x0, 0x40, &(0x7f0000000540)=[r4, 0xffffffffffffffff, r6, r0, r1], 0x5}, 0x3) socket$inet6_tcp(0xa, 0x1, 0x0) openat$procfs(0xffffffffffffff9c, &(0x7f00000010c0)='/proc/crypto\x00', 0x0, 0x0) 21:22:04 executing program 2: syz_io_uring_setup(0x8fe, &(0x7f0000000080), &(0x7f0000ffb000/0x2000)=nil, &(0x7f0000ffb000/0x4000)=nil, &(0x7f0000000100), &(0x7f0000000140)) openat$hwrng(0xffffffffffffff9c, &(0x7f0000000180), 0x0, 0x0) openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000500)='./cgroup/syz1\x00', 0x200002, 0x0) syz_io_uring_submit(0x0, 0x0, &(0x7f0000000580)=@IORING_OP_FILES_UPDATE={0x14, 0x0, 0x0, 0x0, 0x0, &(0x7f0000000540)}, 0x0) io_uring_setup(0x2812, &(0x7f00000005c0)={0x0, 0x5e1b, 0x2, 0x3, 0x12f}) 21:22:04 executing program 0: syz_io_uring_setup(0x8fe, &(0x7f0000000080), &(0x7f0000ffb000/0x2000)=nil, &(0x7f0000ffb000/0x4000)=nil, &(0x7f0000000100), &(0x7f0000000140)) openat$hwrng(0xffffffffffffff9c, &(0x7f0000000180), 0x0, 0x0) openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000500)='./cgroup/syz1\x00', 0x200002, 0x0) syz_io_uring_submit(0x0, 0x0, 0x0, 0x0) io_uring_setup(0x2812, 0x0) 21:22:04 executing program 7: r0 = io_uring_setup(0x355e, &(0x7f0000000000)={0x0, 0x0, 0x20, 0x0, 0x1be}) syz_io_uring_setup(0x8fe, &(0x7f0000000080)={0x0, 0x1830, 0x0, 0x0, 0x0, 0x0, r0}, &(0x7f0000ffb000/0x2000)=nil, &(0x7f0000ffb000/0x4000)=nil, &(0x7f0000000100), &(0x7f0000000140)) r1 = openat$hwrng(0xffffffffffffff9c, &(0x7f0000000180), 0x2, 0x0) r2 = syz_genetlink_get_family_id$mptcp(&(0x7f0000000300), 0xffffffffffffffff) sendmsg$MPTCP_PM_CMD_ADD_ADDR(r1, &(0x7f00000003c0)={&(0x7f00000002c0)={0x10, 0x0, 0x0, 0x10}, 0xc, &(0x7f0000000380)={&(0x7f0000000340)={0x24, r2, 0x300, 0x70bd26, 0x25dfdbfb, {}, [@MPTCP_PM_ATTR_SUBFLOWS={0x8, 0x3, 0x1}, @MPTCP_PM_ATTR_RCV_ADD_ADDRS={0x8, 0x2, 0x2}]}, 0x24}, 0x1, 0x0, 0x0, 0x20000004}, 0x8890) syz_io_uring_setup(0x20f8, &(0x7f0000000400)={0x0, 0x7677, 0x8, 0x3, 0x22f}, &(0x7f0000ffe000/0x2000)=nil, &(0x7f0000ffb000/0x2000)=nil, &(0x7f0000000480), &(0x7f00000004c0)) openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000500)='./cgroup/syz1\x00', 0x200002, 0x0) socket$inet6_tcp(0xa, 0x1, 0x0) 21:22:04 executing program 4: ioctl$SCSI_IOCTL_DOORUNLOCK(0xffffffffffffffff, 0x5381) r0 = syz_open_dev$mouse(&(0x7f0000000000), 0x578, 0x4000) ioctl$SG_GET_PACK_ID(r0, 0x227c, &(0x7f0000000040)) syz_genetlink_get_family_id$nl80211(&(0x7f00000000c0), 0xffffffffffffffff) syz_open_dev$vcsa(&(0x7f0000000440), 0x56, 0x4000) socketpair(0x0, 0x3, 0x6, &(0x7f0000000640)) openat$tcp_congestion(0xffffffffffffff9c, &(0x7f0000000800), 0x1, 0x0) write$tcp_congestion(0xffffffffffffffff, &(0x7f0000000840)='htcp\x00', 0x5) 21:22:04 executing program 5: r0 = io_uring_setup(0x355e, &(0x7f0000000000)={0x0, 0x0, 0x20, 0x0, 0x1be}) r1 = syz_io_uring_setup(0x8fe, &(0x7f0000000080)={0x0, 0x0, 0x0, 0x0, 0x1b8}, &(0x7f0000ffb000/0x2000)=nil, &(0x7f0000ffb000/0x4000)=nil, &(0x7f0000000100), &(0x7f0000000140)=0x0) r3 = openat$hwrng(0xffffffffffffff9c, &(0x7f0000000180), 0x2, 0x0) r4 = syz_io_uring_setup(0x0, &(0x7f00000001c0)={0x0, 0xf46f, 0x20, 0x2, 0xdf}, &(0x7f0000ffe000/0x1000)=nil, &(0x7f0000ffd000/0x1000)=nil, &(0x7f0000000240), &(0x7f0000000280)) r5 = syz_genetlink_get_family_id$mptcp(&(0x7f0000000300), r3) sendmsg$MPTCP_PM_CMD_ADD_ADDR(r3, &(0x7f00000003c0)={&(0x7f00000002c0)={0x10, 0x0, 0x0, 0x10}, 0xc, &(0x7f0000000380)={&(0x7f0000000340)={0x24, r5, 0x300, 0x70bd26, 0x25dfdbfb, {}, [@MPTCP_PM_ATTR_SUBFLOWS={0x8, 0x3, 0x1}, @MPTCP_PM_ATTR_RCV_ADD_ADDRS={0x8, 0x2, 0x2}]}, 0x24}, 0x1, 0x0, 0x0, 0x20000004}, 0x8890) r6 = openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000500)='./cgroup/syz1\x00', 0x200002, 0x0) syz_io_uring_submit(0x0, r2, &(0x7f0000000580)=@IORING_OP_FILES_UPDATE={0x14, 0x4, 0x0, 0x0, 0x40, &(0x7f0000000540)=[r4, 0xffffffffffffffff, r6, r0, r1], 0x5}, 0x3) socket$inet6_tcp(0xa, 0x1, 0x0) openat$procfs(0xffffffffffffff9c, &(0x7f00000010c0)='/proc/crypto\x00', 0x0, 0x0) 21:22:04 executing program 1: r0 = io_uring_setup(0x355e, &(0x7f0000000000)={0x0, 0x0, 0x20, 0x1, 0x1be}) r1 = openat$hwrng(0xffffffffffffff9c, &(0x7f0000000180), 0x2, 0x0) r2 = syz_io_uring_setup(0x65dd, &(0x7f00000001c0)={0x0, 0x0, 0x20, 0x2}, &(0x7f0000ffe000/0x1000)=nil, &(0x7f0000ffd000/0x1000)=nil, &(0x7f0000000240), &(0x7f0000000280)) syz_genetlink_get_family_id$mptcp(&(0x7f0000000300), r1) syz_io_uring_setup(0x20f8, &(0x7f0000000400)={0x0, 0x7677, 0x0, 0x3, 0x22f, 0x0, r2}, &(0x7f0000ffe000/0x2000)=nil, &(0x7f0000ffb000/0x2000)=nil, &(0x7f0000000480)=0x0, &(0x7f00000004c0)) r4 = openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000500)='./cgroup/syz1\x00', 0x200002, 0x0) syz_io_uring_submit(r3, 0x0, &(0x7f0000000580)=@IORING_OP_FILES_UPDATE={0x14, 0x4, 0x0, 0x0, 0x40, &(0x7f0000000540)=[r2, 0xffffffffffffffff, r4, r0, 0xffffffffffffffff], 0x5}, 0x3) io_uring_setup(0x2812, &(0x7f00000005c0)={0x0, 0x5e1b, 0x2, 0x3, 0x12f, 0x0, r2}) socket$inet6_tcp(0xa, 0x1, 0x0) openat$procfs(0xffffffffffffff9c, &(0x7f00000010c0)='/proc/crypto\x00', 0x0, 0x0) io_uring_setup(0x7c8f, &(0x7f0000001140)={0x0, 0xc240, 0x10, 0x3, 0x1c7, 0x0, r2}) 21:22:04 executing program 6: r0 = io_uring_setup(0x355e, &(0x7f0000000000)={0x0, 0x0, 0x20, 0x0, 0x1be}) r1 = syz_io_uring_setup(0x8fe, &(0x7f0000000080)={0x0, 0x1830, 0x0, 0x0, 0x0, 0x0, r0}, &(0x7f0000ffb000/0x2000)=nil, &(0x7f0000ffb000/0x4000)=nil, &(0x7f0000000100), &(0x7f0000000140)=0x0) r3 = openat$hwrng(0xffffffffffffff9c, &(0x7f0000000180), 0x2, 0x0) syz_genetlink_get_family_id$mptcp(&(0x7f0000000300), r3) sendmsg$MPTCP_PM_CMD_ADD_ADDR(r3, 0x0, 0x8890) syz_io_uring_setup(0x20f8, &(0x7f0000000400)={0x0, 0x7677, 0x8, 0x3, 0x22f}, &(0x7f0000ffe000/0x2000)=nil, &(0x7f0000ffb000/0x2000)=nil, &(0x7f0000000480)=0x0, &(0x7f00000004c0)) r5 = openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000500)='./cgroup/syz1\x00', 0x200002, 0x0) syz_io_uring_submit(r4, r2, &(0x7f0000000580)=@IORING_OP_FILES_UPDATE={0x14, 0x4, 0x0, 0x0, 0x40, &(0x7f0000000540)=[0xffffffffffffffff, 0xffffffffffffffff, r5, r0, r1], 0x5}, 0x3) socket$inet6_tcp(0xa, 0x1, 0x0) openat$procfs(0xffffffffffffff9c, &(0x7f00000010c0)='/proc/crypto\x00', 0x0, 0x0) io_uring_setup(0x7c8f, &(0x7f0000001140)={0x0, 0xc240, 0x10, 0x3, 0x1c7}) 21:22:04 executing program 0: syz_io_uring_setup(0x8fe, &(0x7f0000000080), &(0x7f0000ffb000/0x2000)=nil, &(0x7f0000ffb000/0x4000)=nil, &(0x7f0000000100), &(0x7f0000000140)) openat$hwrng(0xffffffffffffff9c, &(0x7f0000000180), 0x0, 0x0) openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000500)='./cgroup/syz1\x00', 0x200002, 0x0) syz_io_uring_submit(0x0, 0x0, 0x0, 0x0) io_uring_setup(0x2812, 0x0) 21:22:04 executing program 3: r0 = io_uring_setup(0x355e, &(0x7f0000000000)={0x0, 0x0, 0x20, 0x1, 0x1be}) r1 = syz_io_uring_setup(0x8fe, &(0x7f0000000080), &(0x7f0000ffb000/0x2000)=nil, &(0x7f0000ffb000/0x4000)=nil, &(0x7f0000000100), &(0x7f0000000140)=0x0) openat$hwrng(0xffffffffffffff9c, &(0x7f0000000180), 0x2, 0x0) syz_genetlink_get_family_id$mptcp(&(0x7f0000000300), 0xffffffffffffffff) r3 = openat$cgroup_root(0xffffffffffffff9c, 0x0, 0x200002, 0x0) syz_io_uring_submit(0x0, r2, &(0x7f0000000580)=@IORING_OP_FILES_UPDATE={0x14, 0x4, 0x0, 0x0, 0x40, &(0x7f0000000540)=[0xffffffffffffffff, 0xffffffffffffffff, r3, r0, r1], 0x5}, 0x3) io_uring_setup(0x2812, &(0x7f00000005c0)={0x0, 0x5e1b, 0x2, 0x3, 0x12f}) socket$inet6_tcp(0xa, 0x1, 0x0) io_uring_setup(0x7c8f, &(0x7f0000001140)={0x0, 0xc240, 0x10, 0x3, 0x1c7}) 21:22:04 executing program 2: syz_io_uring_setup(0x8fe, &(0x7f0000000080), &(0x7f0000ffb000/0x2000)=nil, &(0x7f0000ffb000/0x4000)=nil, &(0x7f0000000100), &(0x7f0000000140)) openat$hwrng(0xffffffffffffff9c, &(0x7f0000000180), 0x0, 0x0) openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000500)='./cgroup/syz1\x00', 0x200002, 0x0) syz_io_uring_submit(0x0, 0x0, &(0x7f0000000580)=@IORING_OP_FILES_UPDATE={0x14, 0x0, 0x0, 0x0, 0x0, &(0x7f0000000540)}, 0x0) io_uring_setup(0x2812, &(0x7f00000005c0)={0x0, 0x5e1b, 0x2, 0x3, 0x12f}) 21:22:04 executing program 0: syz_io_uring_setup(0x8fe, &(0x7f0000000080), &(0x7f0000ffb000/0x2000)=nil, &(0x7f0000ffb000/0x4000)=nil, &(0x7f0000000100), &(0x7f0000000140)) openat$hwrng(0xffffffffffffff9c, &(0x7f0000000180), 0x0, 0x0) openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000500)='./cgroup/syz1\x00', 0x200002, 0x0) syz_io_uring_submit(0x0, 0x0, 0x0, 0x0) io_uring_setup(0x2812, &(0x7f00000005c0)) 21:22:04 executing program 2: syz_io_uring_setup(0x8fe, &(0x7f0000000080), &(0x7f0000ffb000/0x2000)=nil, &(0x7f0000ffb000/0x4000)=nil, &(0x7f0000000100), &(0x7f0000000140)) openat$hwrng(0xffffffffffffff9c, &(0x7f0000000180), 0x0, 0x0) openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000500)='./cgroup/syz1\x00', 0x200002, 0x0) syz_io_uring_submit(0x0, 0x0, &(0x7f0000000580)=@IORING_OP_FILES_UPDATE={0x14, 0x0, 0x0, 0x0, 0x0, &(0x7f0000000540)}, 0x3) io_uring_setup(0x0, &(0x7f00000005c0)={0x0, 0x5e1b, 0x2, 0x3, 0x12f}) 21:22:14 executing program 0: syz_io_uring_setup(0x8fe, &(0x7f0000000080), &(0x7f0000ffb000/0x2000)=nil, &(0x7f0000ffb000/0x4000)=nil, &(0x7f0000000100), &(0x7f0000000140)) openat$hwrng(0xffffffffffffff9c, &(0x7f0000000180), 0x0, 0x0) openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000500)='./cgroup/syz1\x00', 0x200002, 0x0) syz_io_uring_submit(0x0, 0x0, 0x0, 0x0) io_uring_setup(0x2812, &(0x7f00000005c0)) 21:22:14 executing program 2: syz_io_uring_setup(0x8fe, &(0x7f0000000080), &(0x7f0000ffb000/0x2000)=nil, &(0x7f0000ffb000/0x4000)=nil, &(0x7f0000000100), &(0x7f0000000140)) openat$hwrng(0xffffffffffffff9c, &(0x7f0000000180), 0x0, 0x0) openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000500)='./cgroup/syz1\x00', 0x200002, 0x0) syz_io_uring_submit(0x0, 0x0, &(0x7f0000000580)=@IORING_OP_FILES_UPDATE={0x14, 0x0, 0x0, 0x0, 0x0, &(0x7f0000000540)}, 0x3) io_uring_setup(0x0, &(0x7f00000005c0)={0x0, 0x5e1b, 0x2, 0x3, 0x12f}) 21:22:14 executing program 6: r0 = io_uring_setup(0x355e, &(0x7f0000000000)={0x0, 0x0, 0x20, 0x0, 0x1be}) r1 = syz_io_uring_setup(0x8fe, &(0x7f0000000080)={0x0, 0x1830, 0x0, 0x0, 0x0, 0x0, r0}, &(0x7f0000ffb000/0x2000)=nil, &(0x7f0000ffb000/0x4000)=nil, &(0x7f0000000100), &(0x7f0000000140)=0x0) r3 = openat$hwrng(0xffffffffffffff9c, &(0x7f0000000180), 0x2, 0x0) syz_genetlink_get_family_id$mptcp(&(0x7f0000000300), r3) sendmsg$MPTCP_PM_CMD_ADD_ADDR(r3, 0x0, 0x8890) syz_io_uring_setup(0x20f8, &(0x7f0000000400)={0x0, 0x7677, 0x8, 0x3, 0x22f}, &(0x7f0000ffe000/0x2000)=nil, &(0x7f0000ffb000/0x2000)=nil, &(0x7f0000000480)=0x0, &(0x7f00000004c0)) r5 = openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000500)='./cgroup/syz1\x00', 0x200002, 0x0) syz_io_uring_submit(r4, r2, &(0x7f0000000580)=@IORING_OP_FILES_UPDATE={0x14, 0x4, 0x0, 0x0, 0x40, &(0x7f0000000540)=[0xffffffffffffffff, 0xffffffffffffffff, r5, r0, r1], 0x5}, 0x3) socket$inet6_tcp(0xa, 0x1, 0x0) openat$procfs(0xffffffffffffff9c, &(0x7f00000010c0)='/proc/crypto\x00', 0x0, 0x0) io_uring_setup(0x7c8f, &(0x7f0000001140)={0x0, 0xc240, 0x10, 0x3, 0x1c7}) 21:22:14 executing program 3: r0 = io_uring_setup(0x355e, &(0x7f0000000000)={0x0, 0x0, 0x20, 0x1, 0x1be}) r1 = syz_io_uring_setup(0x8fe, &(0x7f0000000080), &(0x7f0000ffb000/0x2000)=nil, &(0x7f0000ffb000/0x4000)=nil, &(0x7f0000000100), &(0x7f0000000140)) openat$hwrng(0xffffffffffffff9c, &(0x7f0000000180), 0x2, 0x0) syz_genetlink_get_family_id$mptcp(&(0x7f0000000300), 0xffffffffffffffff) r2 = openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000500)='./cgroup/syz1\x00', 0x200002, 0x0) syz_io_uring_submit(0x0, 0x0, &(0x7f0000000580)=@IORING_OP_FILES_UPDATE={0x14, 0x4, 0x0, 0x0, 0x40, &(0x7f0000000540)=[0xffffffffffffffff, 0xffffffffffffffff, r2, r0, r1], 0x5}, 0x3) io_uring_setup(0x2812, &(0x7f00000005c0)={0x0, 0x5e1b, 0x2, 0x3, 0x12f}) socket$inet6_tcp(0xa, 0x1, 0x0) io_uring_setup(0x7c8f, &(0x7f0000001140)={0x0, 0xc240, 0x10, 0x3, 0x1c7}) 21:22:14 executing program 1: r0 = io_uring_setup(0x355e, &(0x7f0000000000)={0x0, 0x0, 0x20, 0x1, 0x1be}) r1 = openat$hwrng(0xffffffffffffff9c, &(0x7f0000000180), 0x2, 0x0) r2 = syz_io_uring_setup(0x65dd, &(0x7f00000001c0)={0x0, 0x0, 0x20, 0x2}, &(0x7f0000ffe000/0x1000)=nil, &(0x7f0000ffd000/0x1000)=nil, &(0x7f0000000240), &(0x7f0000000280)) syz_genetlink_get_family_id$mptcp(&(0x7f0000000300), r1) syz_io_uring_setup(0x20f8, &(0x7f0000000400)={0x0, 0x7677, 0x0, 0x3, 0x22f, 0x0, r2}, &(0x7f0000ffe000/0x2000)=nil, &(0x7f0000ffb000/0x2000)=nil, &(0x7f0000000480)=0x0, &(0x7f00000004c0)) r4 = openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000500)='./cgroup/syz1\x00', 0x200002, 0x0) syz_io_uring_submit(r3, 0x0, &(0x7f0000000580)=@IORING_OP_FILES_UPDATE={0x14, 0x4, 0x0, 0x0, 0x40, &(0x7f0000000540)=[r2, 0xffffffffffffffff, r4, r0, 0xffffffffffffffff], 0x5}, 0x3) io_uring_setup(0x2812, &(0x7f00000005c0)={0x0, 0x5e1b, 0x2, 0x3, 0x12f, 0x0, r2}) socket$inet6_tcp(0xa, 0x1, 0x0) openat$procfs(0xffffffffffffff9c, &(0x7f00000010c0)='/proc/crypto\x00', 0x0, 0x0) io_uring_setup(0x7c8f, &(0x7f0000001140)={0x0, 0xc240, 0x10, 0x3, 0x1c7, 0x0, r2}) 21:22:14 executing program 4: ioctl$SCSI_IOCTL_DOORUNLOCK(0xffffffffffffffff, 0x5381) r0 = syz_open_dev$mouse(&(0x7f0000000000), 0x578, 0x4000) ioctl$SG_GET_PACK_ID(r0, 0x227c, &(0x7f0000000040)) syz_genetlink_get_family_id$nl80211(&(0x7f00000000c0), 0xffffffffffffffff) syz_open_dev$vcsa(&(0x7f0000000440), 0x56, 0x4000) socketpair(0x0, 0x3, 0x6, &(0x7f0000000640)) r1 = openat$tcp_congestion(0xffffffffffffff9c, &(0x7f0000000800), 0x1, 0x0) write$tcp_congestion(r1, 0x0, 0x0) 21:22:14 executing program 5: r0 = io_uring_setup(0x355e, &(0x7f0000000000)={0x0, 0x0, 0x20, 0x0, 0x1be}) r1 = syz_io_uring_setup(0x8fe, &(0x7f0000000080)={0x0, 0x0, 0x0, 0x0, 0x1b8}, &(0x7f0000ffb000/0x2000)=nil, &(0x7f0000ffb000/0x4000)=nil, &(0x7f0000000100), &(0x7f0000000140)=0x0) r3 = openat$hwrng(0xffffffffffffff9c, &(0x7f0000000180), 0x2, 0x0) r4 = syz_io_uring_setup(0x0, &(0x7f00000001c0)={0x0, 0xf46f, 0x20, 0x2, 0xdf}, &(0x7f0000ffe000/0x1000)=nil, &(0x7f0000ffd000/0x1000)=nil, &(0x7f0000000240), &(0x7f0000000280)) r5 = syz_genetlink_get_family_id$mptcp(&(0x7f0000000300), r3) sendmsg$MPTCP_PM_CMD_ADD_ADDR(r3, &(0x7f00000003c0)={&(0x7f00000002c0)={0x10, 0x0, 0x0, 0x10}, 0xc, &(0x7f0000000380)={&(0x7f0000000340)={0x24, r5, 0x300, 0x70bd26, 0x25dfdbfb, {}, [@MPTCP_PM_ATTR_SUBFLOWS={0x8, 0x3, 0x1}, @MPTCP_PM_ATTR_RCV_ADD_ADDRS={0x8, 0x2, 0x2}]}, 0x24}, 0x1, 0x0, 0x0, 0x20000004}, 0x8890) r6 = openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000500)='./cgroup/syz1\x00', 0x200002, 0x0) syz_io_uring_submit(0x0, r2, &(0x7f0000000580)=@IORING_OP_FILES_UPDATE={0x14, 0x4, 0x0, 0x0, 0x40, &(0x7f0000000540)=[r4, 0xffffffffffffffff, r6, r0, r1], 0x5}, 0x3) socket$inet6_tcp(0xa, 0x1, 0x0) openat$procfs(0xffffffffffffff9c, &(0x7f00000010c0)='/proc/crypto\x00', 0x0, 0x0) 21:22:14 executing program 7: r0 = io_uring_setup(0x355e, &(0x7f0000000000)={0x0, 0x0, 0x20, 0x0, 0x1be}) syz_io_uring_setup(0x8fe, &(0x7f0000000080)={0x0, 0x1830, 0x0, 0x0, 0x0, 0x0, r0}, &(0x7f0000ffb000/0x2000)=nil, &(0x7f0000ffb000/0x4000)=nil, &(0x7f0000000100), &(0x7f0000000140)) r1 = openat$hwrng(0xffffffffffffff9c, &(0x7f0000000180), 0x2, 0x0) r2 = syz_genetlink_get_family_id$mptcp(&(0x7f0000000300), 0xffffffffffffffff) sendmsg$MPTCP_PM_CMD_ADD_ADDR(r1, &(0x7f00000003c0)={&(0x7f00000002c0)={0x10, 0x0, 0x0, 0x10}, 0xc, &(0x7f0000000380)={&(0x7f0000000340)={0x24, r2, 0x300, 0x70bd26, 0x25dfdbfb, {}, [@MPTCP_PM_ATTR_SUBFLOWS={0x8, 0x3, 0x1}, @MPTCP_PM_ATTR_RCV_ADD_ADDRS={0x8, 0x2, 0x2}]}, 0x24}, 0x1, 0x0, 0x0, 0x20000004}, 0x8890) syz_io_uring_setup(0x20f8, &(0x7f0000000400)={0x0, 0x7677, 0x8, 0x3, 0x22f}, &(0x7f0000ffe000/0x2000)=nil, &(0x7f0000ffb000/0x2000)=nil, &(0x7f0000000480), &(0x7f00000004c0)) openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000500)='./cgroup/syz1\x00', 0x200002, 0x0) socket$inet6_tcp(0xa, 0x1, 0x0) 21:22:14 executing program 2: syz_io_uring_setup(0x8fe, &(0x7f0000000080), &(0x7f0000ffb000/0x2000)=nil, &(0x7f0000ffb000/0x4000)=nil, &(0x7f0000000100), &(0x7f0000000140)) openat$hwrng(0xffffffffffffff9c, &(0x7f0000000180), 0x0, 0x0) openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000500)='./cgroup/syz1\x00', 0x200002, 0x0) syz_io_uring_submit(0x0, 0x0, &(0x7f0000000580)=@IORING_OP_FILES_UPDATE={0x14, 0x0, 0x0, 0x0, 0x0, &(0x7f0000000540)}, 0x3) io_uring_setup(0x0, &(0x7f00000005c0)={0x0, 0x5e1b, 0x2, 0x3, 0x12f}) 21:22:14 executing program 0: syz_io_uring_setup(0x8fe, &(0x7f0000000080), &(0x7f0000ffb000/0x2000)=nil, &(0x7f0000ffb000/0x4000)=nil, &(0x7f0000000100), &(0x7f0000000140)) openat$hwrng(0xffffffffffffff9c, &(0x7f0000000180), 0x0, 0x0) openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000500)='./cgroup/syz1\x00', 0x200002, 0x0) syz_io_uring_submit(0x0, 0x0, 0x0, 0x0) io_uring_setup(0x2812, &(0x7f00000005c0)) 21:22:14 executing program 6: r0 = io_uring_setup(0x355e, &(0x7f0000000000)={0x0, 0x0, 0x20, 0x0, 0x1be}) r1 = syz_io_uring_setup(0x8fe, &(0x7f0000000080)={0x0, 0x1830, 0x0, 0x0, 0x0, 0x0, r0}, &(0x7f0000ffb000/0x2000)=nil, &(0x7f0000ffb000/0x4000)=nil, &(0x7f0000000100), &(0x7f0000000140)=0x0) r3 = openat$hwrng(0xffffffffffffff9c, &(0x7f0000000180), 0x2, 0x0) syz_genetlink_get_family_id$mptcp(&(0x7f0000000300), r3) sendmsg$MPTCP_PM_CMD_ADD_ADDR(r3, 0x0, 0x8890) syz_io_uring_setup(0x20f8, &(0x7f0000000400)={0x0, 0x7677, 0x8, 0x3, 0x22f}, &(0x7f0000ffe000/0x2000)=nil, &(0x7f0000ffb000/0x2000)=nil, &(0x7f0000000480)=0x0, &(0x7f00000004c0)) r5 = openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000500)='./cgroup/syz1\x00', 0x200002, 0x0) syz_io_uring_submit(r4, r2, &(0x7f0000000580)=@IORING_OP_FILES_UPDATE={0x14, 0x4, 0x0, 0x0, 0x40, &(0x7f0000000540)=[0xffffffffffffffff, 0xffffffffffffffff, r5, r0, r1], 0x5}, 0x3) socket$inet6_tcp(0xa, 0x1, 0x0) openat$procfs(0xffffffffffffff9c, &(0x7f00000010c0)='/proc/crypto\x00', 0x0, 0x0) io_uring_setup(0x7c8f, &(0x7f0000001140)={0x0, 0xc240, 0x10, 0x3, 0x1c7}) 21:22:14 executing program 7: r0 = io_uring_setup(0x355e, &(0x7f0000000000)={0x0, 0x0, 0x20, 0x0, 0x1be}) syz_io_uring_setup(0x8fe, &(0x7f0000000080)={0x0, 0x1830, 0x0, 0x0, 0x0, 0x0, r0}, &(0x7f0000ffb000/0x2000)=nil, &(0x7f0000ffb000/0x4000)=nil, &(0x7f0000000100), &(0x7f0000000140)) r1 = openat$hwrng(0xffffffffffffff9c, &(0x7f0000000180), 0x2, 0x0) r2 = syz_genetlink_get_family_id$mptcp(&(0x7f0000000300), 0xffffffffffffffff) sendmsg$MPTCP_PM_CMD_ADD_ADDR(r1, &(0x7f00000003c0)={&(0x7f00000002c0)={0x10, 0x0, 0x0, 0x10}, 0xc, &(0x7f0000000380)={&(0x7f0000000340)={0x24, r2, 0x300, 0x70bd26, 0x25dfdbfb, {}, [@MPTCP_PM_ATTR_SUBFLOWS={0x8, 0x3, 0x1}, @MPTCP_PM_ATTR_RCV_ADD_ADDRS={0x8, 0x2, 0x2}]}, 0x24}, 0x1, 0x0, 0x0, 0x20000004}, 0x8890) syz_io_uring_setup(0x20f8, &(0x7f0000000400)={0x0, 0x7677, 0x8, 0x3, 0x22f}, &(0x7f0000ffe000/0x2000)=nil, &(0x7f0000ffb000/0x2000)=nil, &(0x7f0000000480), &(0x7f00000004c0)) openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000500)='./cgroup/syz1\x00', 0x200002, 0x0) socket$inet6_tcp(0xa, 0x1, 0x0) 21:22:14 executing program 3: io_uring_setup(0x355e, &(0x7f0000000000)={0x0, 0x0, 0x20, 0x1, 0x1be}) syz_io_uring_setup(0x8fe, &(0x7f0000000080), &(0x7f0000ffb000/0x2000)=nil, &(0x7f0000ffb000/0x4000)=nil, &(0x7f0000000100), &(0x7f0000000140)) openat$hwrng(0xffffffffffffff9c, &(0x7f0000000180), 0x2, 0x0) syz_genetlink_get_family_id$mptcp(&(0x7f0000000300), 0xffffffffffffffff) openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000500)='./cgroup/syz1\x00', 0x200002, 0x0) syz_io_uring_submit(0x0, 0x0, 0x0, 0x3) io_uring_setup(0x2812, &(0x7f00000005c0)={0x0, 0x5e1b, 0x2, 0x3, 0x12f}) socket$inet6_tcp(0xa, 0x1, 0x0) io_uring_setup(0x7c8f, &(0x7f0000001140)={0x0, 0xc240, 0x10, 0x3, 0x1c7}) 21:22:23 executing program 3: io_uring_setup(0x355e, &(0x7f0000000000)={0x0, 0x0, 0x20, 0x1, 0x1be}) syz_io_uring_setup(0x8fe, &(0x7f0000000080), &(0x7f0000ffb000/0x2000)=nil, &(0x7f0000ffb000/0x4000)=nil, &(0x7f0000000100), &(0x7f0000000140)) openat$hwrng(0xffffffffffffff9c, &(0x7f0000000180), 0x2, 0x0) syz_genetlink_get_family_id$mptcp(&(0x7f0000000300), 0xffffffffffffffff) openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000500)='./cgroup/syz1\x00', 0x200002, 0x0) syz_io_uring_submit(0x0, 0x0, 0x0, 0x0) io_uring_setup(0x2812, &(0x7f00000005c0)={0x0, 0x5e1b, 0x2, 0x3, 0x12f}) socket$inet6_tcp(0xa, 0x1, 0x0) io_uring_setup(0x7c8f, &(0x7f0000001140)={0x0, 0xc240, 0x10, 0x3, 0x1c7}) 21:22:23 executing program 6: r0 = io_uring_setup(0x355e, &(0x7f0000000000)={0x0, 0x0, 0x20, 0x0, 0x1be}) r1 = syz_io_uring_setup(0x8fe, &(0x7f0000000080)={0x0, 0x1830, 0x0, 0x0, 0x0, 0x0, r0}, &(0x7f0000ffb000/0x2000)=nil, &(0x7f0000ffb000/0x4000)=nil, &(0x7f0000000100), &(0x7f0000000140)=0x0) r3 = openat$hwrng(0xffffffffffffff9c, &(0x7f0000000180), 0x2, 0x0) r4 = syz_genetlink_get_family_id$mptcp(&(0x7f0000000300), r3) sendmsg$MPTCP_PM_CMD_ADD_ADDR(r3, &(0x7f00000003c0)={0x0, 0x0, &(0x7f0000000380)={&(0x7f0000000340)={0x24, r4, 0x300, 0x70bd26, 0x25dfdbfb, {}, [@MPTCP_PM_ATTR_SUBFLOWS={0x8, 0x3, 0x1}, @MPTCP_PM_ATTR_RCV_ADD_ADDRS={0x8, 0x2, 0x2}]}, 0x24}, 0x1, 0x0, 0x0, 0x20000004}, 0x8890) syz_io_uring_setup(0x20f8, &(0x7f0000000400)={0x0, 0x7677, 0x8, 0x3, 0x22f}, &(0x7f0000ffe000/0x2000)=nil, &(0x7f0000ffb000/0x2000)=nil, &(0x7f0000000480)=0x0, &(0x7f00000004c0)) r6 = openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000500)='./cgroup/syz1\x00', 0x200002, 0x0) syz_io_uring_submit(r5, r2, &(0x7f0000000580)=@IORING_OP_FILES_UPDATE={0x14, 0x4, 0x0, 0x0, 0x40, &(0x7f0000000540)=[0xffffffffffffffff, 0xffffffffffffffff, r6, r0, r1], 0x5}, 0x3) socket$inet6_tcp(0xa, 0x1, 0x0) openat$procfs(0xffffffffffffff9c, &(0x7f00000010c0)='/proc/crypto\x00', 0x0, 0x0) io_uring_setup(0x7c8f, &(0x7f0000001140)={0x0, 0xc240, 0x10, 0x3, 0x1c7}) 21:22:23 executing program 2: syz_io_uring_setup(0x8fe, &(0x7f0000000080), &(0x7f0000ffb000/0x2000)=nil, &(0x7f0000ffb000/0x4000)=nil, &(0x7f0000000100), &(0x7f0000000140)) openat$hwrng(0xffffffffffffff9c, &(0x7f0000000180), 0x0, 0x0) openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000500)='./cgroup/syz1\x00', 0x200002, 0x0) syz_io_uring_submit(0x0, 0x0, &(0x7f0000000580)=@IORING_OP_FILES_UPDATE={0x14, 0x0, 0x0, 0x0, 0x0, &(0x7f0000000540)}, 0x3) io_uring_setup(0x2812, 0x0) 21:22:23 executing program 4: ioctl$SCSI_IOCTL_DOORUNLOCK(0xffffffffffffffff, 0x5381) r0 = syz_open_dev$mouse(&(0x7f0000000000), 0x578, 0x4000) ioctl$SG_GET_PACK_ID(r0, 0x227c, &(0x7f0000000040)) syz_genetlink_get_family_id$nl80211(&(0x7f00000000c0), 0xffffffffffffffff) syz_open_dev$vcsa(&(0x7f0000000440), 0x56, 0x4000) socketpair(0x0, 0x3, 0x6, &(0x7f0000000640)) r1 = openat$tcp_congestion(0xffffffffffffff9c, &(0x7f0000000800), 0x1, 0x0) write$tcp_congestion(r1, 0x0, 0x0) 21:22:23 executing program 1: r0 = io_uring_setup(0x355e, &(0x7f0000000000)={0x0, 0x0, 0x20, 0x1, 0x1be}) r1 = openat$hwrng(0xffffffffffffff9c, &(0x7f0000000180), 0x2, 0x0) r2 = syz_io_uring_setup(0x65dd, &(0x7f00000001c0)={0x0, 0x0, 0x20, 0x2}, &(0x7f0000ffe000/0x1000)=nil, &(0x7f0000ffd000/0x1000)=nil, &(0x7f0000000240), &(0x7f0000000280)) syz_genetlink_get_family_id$mptcp(&(0x7f0000000300), r1) syz_io_uring_setup(0x20f8, &(0x7f0000000400)={0x0, 0x7677, 0x0, 0x3, 0x22f, 0x0, r2}, &(0x7f0000ffe000/0x2000)=nil, &(0x7f0000ffb000/0x2000)=nil, &(0x7f0000000480)=0x0, &(0x7f00000004c0)) r4 = openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000500)='./cgroup/syz1\x00', 0x200002, 0x0) syz_io_uring_submit(r3, 0x0, &(0x7f0000000580)=@IORING_OP_FILES_UPDATE={0x14, 0x4, 0x0, 0x0, 0x40, &(0x7f0000000540)=[r2, 0xffffffffffffffff, r4, r0, 0xffffffffffffffff], 0x5}, 0x3) io_uring_setup(0x2812, &(0x7f00000005c0)={0x0, 0x5e1b, 0x2, 0x3, 0x12f, 0x0, r2}) socket$inet6_tcp(0xa, 0x1, 0x0) openat$procfs(0xffffffffffffff9c, &(0x7f00000010c0)='/proc/crypto\x00', 0x0, 0x0) io_uring_setup(0x7c8f, &(0x7f0000001140)={0x0, 0xc240, 0x10, 0x3, 0x1c7, 0x0, r2}) 21:22:23 executing program 0: r0 = io_uring_setup(0x355e, &(0x7f0000000000)={0x0, 0x0, 0x20, 0x0, 0x1be}) r1 = syz_io_uring_setup(0x8fe, &(0x7f0000000080)={0x0, 0x1830, 0x0, 0x0, 0x0, 0x0, r0}, &(0x7f0000ffb000/0x2000)=nil, &(0x7f0000ffb000/0x4000)=nil, &(0x7f0000000100), &(0x7f0000000140)=0x0) r3 = openat$hwrng(0xffffffffffffff9c, &(0x7f0000000180), 0x2, 0x0) syz_genetlink_get_family_id$mptcp(&(0x7f0000000300), r3) sendmsg$MPTCP_PM_CMD_ADD_ADDR(r3, 0x0, 0x8890) syz_io_uring_setup(0x20f8, &(0x7f0000000400)={0x0, 0x7677, 0x8, 0x3, 0x22f}, &(0x7f0000ffe000/0x2000)=nil, &(0x7f0000ffb000/0x2000)=nil, &(0x7f0000000480)=0x0, &(0x7f00000004c0)) r5 = openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000500)='./cgroup/syz1\x00', 0x200002, 0x0) syz_io_uring_submit(r4, r2, &(0x7f0000000580)=@IORING_OP_FILES_UPDATE={0x14, 0x4, 0x0, 0x0, 0x40, &(0x7f0000000540)=[0xffffffffffffffff, 0xffffffffffffffff, r5, r0, r1], 0x5}, 0x3) socket$inet6_tcp(0xa, 0x1, 0x0) openat$procfs(0xffffffffffffff9c, &(0x7f00000010c0)='/proc/crypto\x00', 0x0, 0x0) io_uring_setup(0x7c8f, &(0x7f0000001140)={0x0, 0xc240, 0x10, 0x3, 0x1c7}) 21:22:23 executing program 7: r0 = io_uring_setup(0x355e, &(0x7f0000000000)={0x0, 0x0, 0x20, 0x0, 0x1be}) r1 = syz_io_uring_setup(0x8fe, &(0x7f0000000080)={0x0, 0x1830, 0x0, 0x0, 0x0, 0x0, r0}, &(0x7f0000ffb000/0x2000)=nil, &(0x7f0000ffb000/0x4000)=nil, &(0x7f0000000100), &(0x7f0000000140)=0x0) r3 = openat$hwrng(0xffffffffffffff9c, &(0x7f0000000180), 0x2, 0x0) r4 = syz_genetlink_get_family_id$mptcp(&(0x7f0000000300), 0xffffffffffffffff) sendmsg$MPTCP_PM_CMD_ADD_ADDR(r3, &(0x7f00000003c0)={&(0x7f00000002c0)={0x10, 0x0, 0x0, 0x10}, 0xc, &(0x7f0000000380)={&(0x7f0000000340)={0x24, r4, 0x300, 0x70bd26, 0x25dfdbfb, {}, [@MPTCP_PM_ATTR_SUBFLOWS={0x8, 0x3, 0x1}, @MPTCP_PM_ATTR_RCV_ADD_ADDRS={0x8, 0x2, 0x2}]}, 0x24}, 0x1, 0x0, 0x0, 0x20000004}, 0x8890) syz_io_uring_setup(0x20f8, &(0x7f0000000400)={0x0, 0x7677, 0x8, 0x3, 0x22f}, &(0x7f0000ffe000/0x2000)=nil, &(0x7f0000ffb000/0x2000)=nil, &(0x7f0000000480)=0x0, &(0x7f00000004c0)) syz_io_uring_submit(r5, r2, &(0x7f0000000580)=@IORING_OP_FILES_UPDATE={0x14, 0x4, 0x0, 0x0, 0x40, &(0x7f0000000540)=[0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, r0, r1], 0x5}, 0x3) socket$inet6_tcp(0xa, 0x1, 0x0) 21:22:23 executing program 5: r0 = io_uring_setup(0x355e, &(0x7f0000000000)={0x0, 0x0, 0x20, 0x0, 0x1be}) r1 = syz_io_uring_setup(0x8fe, &(0x7f0000000080)={0x0, 0x0, 0x0, 0x0, 0x1b8}, &(0x7f0000ffb000/0x2000)=nil, &(0x7f0000ffb000/0x4000)=nil, &(0x7f0000000100), &(0x7f0000000140)=0x0) r3 = openat$hwrng(0xffffffffffffff9c, &(0x7f0000000180), 0x2, 0x0) r4 = syz_io_uring_setup(0x65dd, 0x0, &(0x7f0000ffe000/0x1000)=nil, &(0x7f0000ffd000/0x1000)=nil, &(0x7f0000000240), &(0x7f0000000280)) r5 = syz_genetlink_get_family_id$mptcp(&(0x7f0000000300), r3) sendmsg$MPTCP_PM_CMD_ADD_ADDR(r3, &(0x7f00000003c0)={&(0x7f00000002c0)={0x10, 0x0, 0x0, 0x10}, 0xc, &(0x7f0000000380)={&(0x7f0000000340)={0x24, r5, 0x300, 0x70bd26, 0x25dfdbfb, {}, [@MPTCP_PM_ATTR_SUBFLOWS={0x8, 0x3, 0x1}, @MPTCP_PM_ATTR_RCV_ADD_ADDRS={0x8, 0x2, 0x2}]}, 0x24}, 0x1, 0x0, 0x0, 0x20000004}, 0x8890) r6 = openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000500)='./cgroup/syz1\x00', 0x200002, 0x0) syz_io_uring_submit(0x0, r2, &(0x7f0000000580)=@IORING_OP_FILES_UPDATE={0x14, 0x4, 0x0, 0x0, 0x40, &(0x7f0000000540)=[r4, 0xffffffffffffffff, r6, r0, r1], 0x5}, 0x3) socket$inet6_tcp(0xa, 0x1, 0x0) openat$procfs(0xffffffffffffff9c, &(0x7f00000010c0)='/proc/crypto\x00', 0x0, 0x0) 21:22:23 executing program 7: r0 = io_uring_setup(0x355e, &(0x7f0000000000)={0x0, 0x0, 0x20, 0x0, 0x1be}) r1 = syz_io_uring_setup(0x8fe, &(0x7f0000000080)={0x0, 0x1830, 0x0, 0x0, 0x0, 0x0, r0}, &(0x7f0000ffb000/0x2000)=nil, &(0x7f0000ffb000/0x4000)=nil, &(0x7f0000000100), &(0x7f0000000140)=0x0) r3 = openat$hwrng(0xffffffffffffff9c, &(0x7f0000000180), 0x2, 0x0) r4 = syz_genetlink_get_family_id$mptcp(&(0x7f0000000300), 0xffffffffffffffff) sendmsg$MPTCP_PM_CMD_ADD_ADDR(r3, &(0x7f00000003c0)={&(0x7f00000002c0)={0x10, 0x0, 0x0, 0x10}, 0xc, &(0x7f0000000380)={&(0x7f0000000340)={0x24, r4, 0x300, 0x70bd26, 0x25dfdbfb, {}, [@MPTCP_PM_ATTR_SUBFLOWS={0x8, 0x3, 0x1}, @MPTCP_PM_ATTR_RCV_ADD_ADDRS={0x8, 0x2, 0x2}]}, 0x24}, 0x1, 0x0, 0x0, 0x20000004}, 0x8890) syz_io_uring_setup(0x20f8, &(0x7f0000000400)={0x0, 0x7677, 0x8, 0x3, 0x22f}, &(0x7f0000ffe000/0x2000)=nil, &(0x7f0000ffb000/0x2000)=nil, &(0x7f0000000480)=0x0, &(0x7f00000004c0)) syz_io_uring_submit(r5, r2, &(0x7f0000000580)=@IORING_OP_FILES_UPDATE={0x14, 0x4, 0x0, 0x0, 0x40, &(0x7f0000000540)=[0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, r0, r1], 0x5}, 0x3) socket$inet6_tcp(0xa, 0x1, 0x0) 21:22:23 executing program 0: r0 = io_uring_setup(0x355e, &(0x7f0000000000)={0x0, 0x0, 0x20, 0x0, 0x1be}) r1 = syz_io_uring_setup(0x8fe, &(0x7f0000000080)={0x0, 0x1830, 0x0, 0x0, 0x0, 0x0, r0}, &(0x7f0000ffb000/0x2000)=nil, &(0x7f0000ffb000/0x4000)=nil, &(0x7f0000000100), &(0x7f0000000140)=0x0) r3 = openat$hwrng(0xffffffffffffff9c, &(0x7f0000000180), 0x2, 0x0) syz_genetlink_get_family_id$mptcp(&(0x7f0000000300), r3) sendmsg$MPTCP_PM_CMD_ADD_ADDR(r3, 0x0, 0x8890) syz_io_uring_setup(0x20f8, &(0x7f0000000400)={0x0, 0x7677, 0x8, 0x3, 0x22f}, &(0x7f0000ffe000/0x2000)=nil, &(0x7f0000ffb000/0x2000)=nil, &(0x7f0000000480)=0x0, &(0x7f00000004c0)) r5 = openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000500)='./cgroup/syz1\x00', 0x200002, 0x0) syz_io_uring_submit(r4, r2, &(0x7f0000000580)=@IORING_OP_FILES_UPDATE={0x14, 0x4, 0x0, 0x0, 0x40, &(0x7f0000000540)=[0xffffffffffffffff, 0xffffffffffffffff, r5, r0, r1], 0x5}, 0x3) socket$inet6_tcp(0xa, 0x1, 0x0) openat$procfs(0xffffffffffffff9c, &(0x7f00000010c0)='/proc/crypto\x00', 0x0, 0x0) io_uring_setup(0x7c8f, &(0x7f0000001140)={0x0, 0xc240, 0x10, 0x3, 0x1c7}) 21:22:23 executing program 2: syz_io_uring_setup(0x8fe, &(0x7f0000000080), &(0x7f0000ffb000/0x2000)=nil, &(0x7f0000ffb000/0x4000)=nil, &(0x7f0000000100), &(0x7f0000000140)) openat$hwrng(0xffffffffffffff9c, &(0x7f0000000180), 0x0, 0x0) openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000500)='./cgroup/syz1\x00', 0x200002, 0x0) syz_io_uring_submit(0x0, 0x0, &(0x7f0000000580)=@IORING_OP_FILES_UPDATE={0x14, 0x0, 0x0, 0x0, 0x0, &(0x7f0000000540)}, 0x3) io_uring_setup(0x2812, 0x0) 21:22:23 executing program 4: ioctl$SCSI_IOCTL_DOORUNLOCK(0xffffffffffffffff, 0x5381) r0 = syz_open_dev$mouse(&(0x7f0000000000), 0x578, 0x4000) ioctl$SG_GET_PACK_ID(r0, 0x227c, &(0x7f0000000040)) syz_genetlink_get_family_id$nl80211(&(0x7f00000000c0), 0xffffffffffffffff) syz_open_dev$vcsa(&(0x7f0000000440), 0x56, 0x4000) socketpair(0x0, 0x3, 0x6, &(0x7f0000000640)) r1 = openat$tcp_congestion(0xffffffffffffff9c, &(0x7f0000000800), 0x1, 0x0) write$tcp_congestion(r1, 0x0, 0x0) [ 673.124261] kmemleak: Found object by alias at 0x607f1a6398ac [ 673.124288] CPU: 1 UID: 0 PID: 7836 Comm: syz-executor.3 Tainted: G W 6.17.0-rc3-next-20250829 #1 PREEMPT(voluntary) [ 673.124306] Tainted: [W]=WARN [ 673.124310] Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.12.0-1 04/01/2014 [ 673.124316] Call Trace: [ 673.124320] [ 673.124325] dump_stack_lvl+0xca/0x120 [ 673.124351] __lookup_object+0x94/0xb0 [ 673.124367] delete_object_full+0x27/0x70 [ 673.124382] free_percpu+0x30/0x1160 [ 673.124398] ? arch_uprobe_clear_state+0x16/0x140 [ 673.124418] futex_hash_free+0x38/0xc0 [ 673.124432] mmput+0x2d3/0x390 [ 673.124450] do_exit+0x79d/0x2970 [ 673.124467] ? __pfx_do_exit+0x10/0x10 [ 673.124481] ? find_held_lock+0x2b/0x80 [ 673.124499] ? get_signal+0x835/0x2340 [ 673.124518] do_group_exit+0xd3/0x2a0 [ 673.124532] get_signal+0x2315/0x2340 [ 673.124549] ? trace_irq_enable.constprop.0+0xc2/0x100 [ 673.124566] ? __pfx_get_signal+0x10/0x10 [ 673.124581] ? do_futex+0x135/0x370 [ 673.124595] ? __pfx_do_futex+0x10/0x10 [ 673.124609] arch_do_signal_or_restart+0x80/0x790 [ 673.124626] ? __pfx_arch_do_signal_or_restart+0x10/0x10 [ 673.124642] ? __x64_sys_futex+0x1c9/0x4d0 [ 673.124653] ? __x64_sys_futex+0x1d2/0x4d0 [ 673.124667] ? fput_close_sync+0x114/0x240 [ 673.124683] ? __pfx___x64_sys_futex+0x10/0x10 [ 673.124695] ? __pfx_fput_close_sync+0x10/0x10 [ 673.124709] ? dnotify_flush+0x79/0x4c0 [ 673.124719] ? xfd_validate_state+0x55/0x180 [ 673.124740] exit_to_user_mode_loop+0x8b/0x110 [ 673.124752] do_syscall_64+0x2f7/0x360 [ 673.124765] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 673.124776] RIP: 0033:0x7f1060a76b19 [ 673.124785] Code: Unable to access opcode bytes at 0x7f1060a76aef. [ 673.124790] RSP: 002b:00007f105dfec218 EFLAGS: 00000246 ORIG_RAX: 00000000000000ca [ 673.124801] RAX: fffffffffffffe00 RBX: 00007f1060b89f68 RCX: 00007f1060a76b19 [ 673.124809] RDX: 0000000000000000 RSI: 0000000000000080 RDI: 00007f1060b89f68 [ 673.124816] RBP: 00007f1060b89f60 R08: 0000000000000000 R09: 0000000000000000 [ 673.124822] R10: 0000000000000000 R11: 0000000000000246 R12: 00007f1060b89f6c [ 673.124829] R13: 00007ffed3f8b4af R14: 00007f105dfec300 R15: 0000000000022000 [ 673.124844] [ 673.124848] kmemleak: Object (percpu) 0x607f1a6398a8 (size 8): [ 673.124855] kmemleak: comm "syz-executor.0", pid 7854, jiffies 4295339964 [ 673.124861] kmemleak: min_count = 1 [ 673.124865] kmemleak: count = 0 [ 673.124868] kmemleak: flags = 0x21 [ 673.124872] kmemleak: checksum = 0 [ 673.124875] kmemleak: backtrace: [ 673.124879] pcpu_alloc_noprof+0x87a/0x1170 [ 673.124894] percpu_ref_init+0x37/0x400 [ 673.124911] io_uring_setup+0x44c/0x2000 [ 673.124922] __x64_sys_io_uring_setup+0xc8/0x170 [ 673.124933] do_syscall_64+0xbf/0x360 [ 673.124941] entry_SYSCALL_64_after_hwframe+0x77/0x7f 21:22:23 executing program 5: r0 = io_uring_setup(0x355e, &(0x7f0000000000)={0x0, 0x0, 0x20, 0x0, 0x1be}) r1 = syz_io_uring_setup(0x8fe, &(0x7f0000000080)={0x0, 0x0, 0x0, 0x0, 0x1b8}, &(0x7f0000ffb000/0x2000)=nil, &(0x7f0000ffb000/0x4000)=nil, &(0x7f0000000100), &(0x7f0000000140)=0x0) r3 = openat$hwrng(0xffffffffffffff9c, &(0x7f0000000180), 0x2, 0x0) r4 = syz_io_uring_setup(0x65dd, 0x0, &(0x7f0000ffe000/0x1000)=nil, &(0x7f0000ffd000/0x1000)=nil, &(0x7f0000000240), &(0x7f0000000280)) r5 = syz_genetlink_get_family_id$mptcp(&(0x7f0000000300), r3) sendmsg$MPTCP_PM_CMD_ADD_ADDR(r3, &(0x7f00000003c0)={&(0x7f00000002c0)={0x10, 0x0, 0x0, 0x10}, 0xc, &(0x7f0000000380)={&(0x7f0000000340)={0x24, r5, 0x300, 0x70bd26, 0x25dfdbfb, {}, [@MPTCP_PM_ATTR_SUBFLOWS={0x8, 0x3, 0x1}, @MPTCP_PM_ATTR_RCV_ADD_ADDRS={0x8, 0x2, 0x2}]}, 0x24}, 0x1, 0x0, 0x0, 0x20000004}, 0x8890) r6 = openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000500)='./cgroup/syz1\x00', 0x200002, 0x0) syz_io_uring_submit(0x0, r2, &(0x7f0000000580)=@IORING_OP_FILES_UPDATE={0x14, 0x4, 0x0, 0x0, 0x40, &(0x7f0000000540)=[r4, 0xffffffffffffffff, r6, r0, r1], 0x5}, 0x3) socket$inet6_tcp(0xa, 0x1, 0x0) openat$procfs(0xffffffffffffff9c, &(0x7f00000010c0)='/proc/crypto\x00', 0x0, 0x0) 21:22:23 executing program 1: r0 = io_uring_setup(0x355e, &(0x7f0000000000)={0x0, 0x0, 0x20, 0x1, 0x1be}) r1 = openat$hwrng(0xffffffffffffff9c, &(0x7f0000000180), 0x2, 0x0) r2 = syz_io_uring_setup(0x65dd, &(0x7f00000001c0)={0x0, 0x0, 0x20, 0x2}, &(0x7f0000ffe000/0x1000)=nil, &(0x7f0000ffd000/0x1000)=nil, &(0x7f0000000240), &(0x7f0000000280)) syz_genetlink_get_family_id$mptcp(&(0x7f0000000300), r1) syz_io_uring_setup(0x20f8, &(0x7f0000000400)={0x0, 0x7677, 0x8, 0x0, 0x22f, 0x0, r2}, &(0x7f0000ffe000/0x2000)=nil, &(0x7f0000ffb000/0x2000)=nil, &(0x7f0000000480)=0x0, &(0x7f00000004c0)) r4 = openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000500)='./cgroup/syz1\x00', 0x200002, 0x0) syz_io_uring_submit(r3, 0x0, &(0x7f0000000580)=@IORING_OP_FILES_UPDATE={0x14, 0x4, 0x0, 0x0, 0x40, &(0x7f0000000540)=[r2, 0xffffffffffffffff, r4, r0, 0xffffffffffffffff], 0x5}, 0x3) io_uring_setup(0x2812, &(0x7f00000005c0)={0x0, 0x5e1b, 0x2, 0x3, 0x12f, 0x0, r2}) socket$inet6_tcp(0xa, 0x1, 0x0) openat$procfs(0xffffffffffffff9c, &(0x7f00000010c0)='/proc/crypto\x00', 0x0, 0x0) io_uring_setup(0x7c8f, &(0x7f0000001140)={0x0, 0xc240, 0x10, 0x3, 0x1c7, 0x0, r2}) 21:22:23 executing program 2: syz_io_uring_setup(0x8fe, &(0x7f0000000080), &(0x7f0000ffb000/0x2000)=nil, &(0x7f0000ffb000/0x4000)=nil, &(0x7f0000000100), &(0x7f0000000140)) openat$hwrng(0xffffffffffffff9c, &(0x7f0000000180), 0x0, 0x0) openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000500)='./cgroup/syz1\x00', 0x200002, 0x0) syz_io_uring_submit(0x0, 0x0, &(0x7f0000000580)=@IORING_OP_FILES_UPDATE={0x14, 0x0, 0x0, 0x0, 0x0, &(0x7f0000000540)}, 0x3) io_uring_setup(0x2812, 0x0) 21:22:23 executing program 3: io_uring_setup(0x355e, &(0x7f0000000000)={0x0, 0x0, 0x20, 0x1, 0x1be}) syz_io_uring_setup(0x8fe, &(0x7f0000000080), &(0x7f0000ffb000/0x2000)=nil, &(0x7f0000ffb000/0x4000)=nil, &(0x7f0000000100), &(0x7f0000000140)) openat$hwrng(0xffffffffffffff9c, &(0x7f0000000180), 0x2, 0x0) syz_genetlink_get_family_id$mptcp(&(0x7f0000000300), 0xffffffffffffffff) openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000500)='./cgroup/syz1\x00', 0x200002, 0x0) syz_io_uring_submit(0x0, 0x0, 0x0, 0x0) io_uring_setup(0x2812, &(0x7f00000005c0)={0x0, 0x5e1b, 0x2, 0x3, 0x12f}) socket$inet6_tcp(0xa, 0x1, 0x0) io_uring_setup(0x7c8f, &(0x7f0000001140)={0x0, 0xc240, 0x10, 0x3, 0x1c7}) 21:22:23 executing program 6: r0 = io_uring_setup(0x355e, &(0x7f0000000000)={0x0, 0x0, 0x20, 0x0, 0x1be}) r1 = syz_io_uring_setup(0x8fe, &(0x7f0000000080)={0x0, 0x1830, 0x0, 0x0, 0x0, 0x0, r0}, &(0x7f0000ffb000/0x2000)=nil, &(0x7f0000ffb000/0x4000)=nil, &(0x7f0000000100), &(0x7f0000000140)=0x0) r3 = openat$hwrng(0xffffffffffffff9c, &(0x7f0000000180), 0x2, 0x0) r4 = syz_genetlink_get_family_id$mptcp(&(0x7f0000000300), r3) sendmsg$MPTCP_PM_CMD_ADD_ADDR(r3, &(0x7f00000003c0)={0x0, 0x0, &(0x7f0000000380)={&(0x7f0000000340)={0x24, r4, 0x300, 0x70bd26, 0x25dfdbfb, {}, [@MPTCP_PM_ATTR_SUBFLOWS={0x8, 0x3, 0x1}, @MPTCP_PM_ATTR_RCV_ADD_ADDRS={0x8, 0x2, 0x2}]}, 0x24}, 0x1, 0x0, 0x0, 0x20000004}, 0x8890) syz_io_uring_setup(0x20f8, &(0x7f0000000400)={0x0, 0x7677, 0x8, 0x3, 0x22f}, &(0x7f0000ffe000/0x2000)=nil, &(0x7f0000ffb000/0x2000)=nil, &(0x7f0000000480)=0x0, &(0x7f00000004c0)) r6 = openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000500)='./cgroup/syz1\x00', 0x200002, 0x0) syz_io_uring_submit(r5, r2, &(0x7f0000000580)=@IORING_OP_FILES_UPDATE={0x14, 0x4, 0x0, 0x0, 0x40, &(0x7f0000000540)=[0xffffffffffffffff, 0xffffffffffffffff, r6, r0, r1], 0x5}, 0x3) socket$inet6_tcp(0xa, 0x1, 0x0) openat$procfs(0xffffffffffffff9c, &(0x7f00000010c0)='/proc/crypto\x00', 0x0, 0x0) io_uring_setup(0x7c8f, &(0x7f0000001140)={0x0, 0xc240, 0x10, 0x3, 0x1c7}) 21:22:23 executing program 7: r0 = io_uring_setup(0x355e, &(0x7f0000000000)={0x0, 0x0, 0x20, 0x0, 0x1be}) r1 = syz_io_uring_setup(0x8fe, &(0x7f0000000080)={0x0, 0x1830, 0x0, 0x0, 0x0, 0x0, r0}, &(0x7f0000ffb000/0x2000)=nil, &(0x7f0000ffb000/0x4000)=nil, &(0x7f0000000100), &(0x7f0000000140)=0x0) r3 = openat$hwrng(0xffffffffffffff9c, &(0x7f0000000180), 0x2, 0x0) r4 = syz_genetlink_get_family_id$mptcp(&(0x7f0000000300), 0xffffffffffffffff) sendmsg$MPTCP_PM_CMD_ADD_ADDR(r3, &(0x7f00000003c0)={&(0x7f00000002c0)={0x10, 0x0, 0x0, 0x10}, 0xc, &(0x7f0000000380)={&(0x7f0000000340)={0x24, r4, 0x300, 0x70bd26, 0x25dfdbfb, {}, [@MPTCP_PM_ATTR_SUBFLOWS={0x8, 0x3, 0x1}, @MPTCP_PM_ATTR_RCV_ADD_ADDRS={0x8, 0x2, 0x2}]}, 0x24}, 0x1, 0x0, 0x0, 0x20000004}, 0x8890) syz_io_uring_setup(0x20f8, &(0x7f0000000400)={0x0, 0x7677, 0x8, 0x3, 0x22f}, &(0x7f0000ffe000/0x2000)=nil, &(0x7f0000ffb000/0x2000)=nil, &(0x7f0000000480)=0x0, &(0x7f00000004c0)) syz_io_uring_submit(r5, r2, &(0x7f0000000580)=@IORING_OP_FILES_UPDATE={0x14, 0x4, 0x0, 0x0, 0x40, &(0x7f0000000540)=[0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, r0, r1], 0x5}, 0x3) socket$inet6_tcp(0xa, 0x1, 0x0) 21:22:32 executing program 4: io_uring_setup(0x355e, &(0x7f0000000000)={0x0, 0x0, 0x20, 0x1, 0x1be}) syz_io_uring_setup(0x8fe, &(0x7f0000000080), &(0x7f0000ffb000/0x2000)=nil, &(0x7f0000ffb000/0x4000)=nil, &(0x7f0000000100), &(0x7f0000000140)) openat$hwrng(0xffffffffffffff9c, &(0x7f0000000180), 0x2, 0x0) syz_genetlink_get_family_id$mptcp(&(0x7f0000000300), 0xffffffffffffffff) openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000500)='./cgroup/syz1\x00', 0x200002, 0x0) syz_io_uring_submit(0x0, 0x0, 0x0, 0x0) io_uring_setup(0x2812, &(0x7f00000005c0)={0x0, 0x5e1b, 0x2, 0x3, 0x12f}) socket$inet6_tcp(0xa, 0x1, 0x0) io_uring_setup(0x7c8f, &(0x7f0000001140)={0x0, 0xc240, 0x10, 0x3, 0x1c7}) 21:22:32 executing program 0: r0 = io_uring_setup(0x355e, &(0x7f0000000000)={0x0, 0x0, 0x20, 0x0, 0x1be}) r1 = syz_io_uring_setup(0x8fe, &(0x7f0000000080)={0x0, 0x1830, 0x0, 0x0, 0x0, 0x0, r0}, &(0x7f0000ffb000/0x2000)=nil, &(0x7f0000ffb000/0x4000)=nil, &(0x7f0000000100), &(0x7f0000000140)=0x0) r3 = openat$hwrng(0xffffffffffffff9c, &(0x7f0000000180), 0x2, 0x0) syz_genetlink_get_family_id$mptcp(&(0x7f0000000300), r3) sendmsg$MPTCP_PM_CMD_ADD_ADDR(r3, 0x0, 0x8890) syz_io_uring_setup(0x20f8, &(0x7f0000000400)={0x0, 0x7677, 0x8, 0x3, 0x22f}, &(0x7f0000ffe000/0x2000)=nil, &(0x7f0000ffb000/0x2000)=nil, &(0x7f0000000480)=0x0, &(0x7f00000004c0)) r5 = openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000500)='./cgroup/syz1\x00', 0x200002, 0x0) syz_io_uring_submit(r4, r2, &(0x7f0000000580)=@IORING_OP_FILES_UPDATE={0x14, 0x4, 0x0, 0x0, 0x40, &(0x7f0000000540)=[0xffffffffffffffff, 0xffffffffffffffff, r5, r0, r1], 0x5}, 0x3) socket$inet6_tcp(0xa, 0x1, 0x0) openat$procfs(0xffffffffffffff9c, &(0x7f00000010c0)='/proc/crypto\x00', 0x0, 0x0) io_uring_setup(0x7c8f, &(0x7f0000001140)={0x0, 0xc240, 0x10, 0x3, 0x1c7}) 21:22:32 executing program 3: io_uring_setup(0x355e, &(0x7f0000000000)={0x0, 0x0, 0x20, 0x1, 0x1be}) syz_io_uring_setup(0x8fe, &(0x7f0000000080), &(0x7f0000ffb000/0x2000)=nil, &(0x7f0000ffb000/0x4000)=nil, &(0x7f0000000100), &(0x7f0000000140)) openat$hwrng(0xffffffffffffff9c, &(0x7f0000000180), 0x2, 0x0) syz_genetlink_get_family_id$mptcp(&(0x7f0000000300), 0xffffffffffffffff) openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000500)='./cgroup/syz1\x00', 0x200002, 0x0) syz_io_uring_submit(0x0, 0x0, 0x0, 0x0) io_uring_setup(0x2812, &(0x7f00000005c0)={0x0, 0x5e1b, 0x2, 0x3, 0x12f}) socket$inet6_tcp(0xa, 0x1, 0x0) io_uring_setup(0x7c8f, &(0x7f0000001140)={0x0, 0xc240, 0x10, 0x3, 0x1c7}) 21:22:32 executing program 6: r0 = io_uring_setup(0x355e, &(0x7f0000000000)={0x0, 0x0, 0x20, 0x0, 0x1be}) r1 = syz_io_uring_setup(0x8fe, &(0x7f0000000080)={0x0, 0x1830, 0x0, 0x0, 0x0, 0x0, r0}, &(0x7f0000ffb000/0x2000)=nil, &(0x7f0000ffb000/0x4000)=nil, &(0x7f0000000100), &(0x7f0000000140)=0x0) r3 = openat$hwrng(0xffffffffffffff9c, &(0x7f0000000180), 0x2, 0x0) r4 = syz_genetlink_get_family_id$mptcp(&(0x7f0000000300), r3) sendmsg$MPTCP_PM_CMD_ADD_ADDR(r3, &(0x7f00000003c0)={0x0, 0x0, &(0x7f0000000380)={&(0x7f0000000340)={0x24, r4, 0x300, 0x70bd26, 0x25dfdbfb, {}, [@MPTCP_PM_ATTR_SUBFLOWS={0x8, 0x3, 0x1}, @MPTCP_PM_ATTR_RCV_ADD_ADDRS={0x8, 0x2, 0x2}]}, 0x24}, 0x1, 0x0, 0x0, 0x20000004}, 0x8890) syz_io_uring_setup(0x20f8, &(0x7f0000000400)={0x0, 0x7677, 0x8, 0x3, 0x22f}, &(0x7f0000ffe000/0x2000)=nil, &(0x7f0000ffb000/0x2000)=nil, &(0x7f0000000480)=0x0, &(0x7f00000004c0)) r6 = openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000500)='./cgroup/syz1\x00', 0x200002, 0x0) syz_io_uring_submit(r5, r2, &(0x7f0000000580)=@IORING_OP_FILES_UPDATE={0x14, 0x4, 0x0, 0x0, 0x40, &(0x7f0000000540)=[0xffffffffffffffff, 0xffffffffffffffff, r6, r0, r1], 0x5}, 0x3) socket$inet6_tcp(0xa, 0x1, 0x0) openat$procfs(0xffffffffffffff9c, &(0x7f00000010c0)='/proc/crypto\x00', 0x0, 0x0) io_uring_setup(0x7c8f, &(0x7f0000001140)={0x0, 0xc240, 0x10, 0x3, 0x1c7}) 21:22:32 executing program 7: r0 = io_uring_setup(0x355e, &(0x7f0000000000)={0x0, 0x0, 0x20, 0x0, 0x1be}) r1 = syz_io_uring_setup(0x8fe, &(0x7f0000000080)={0x0, 0x1830, 0x0, 0x0, 0x0, 0x0, r0}, &(0x7f0000ffb000/0x2000)=nil, &(0x7f0000ffb000/0x4000)=nil, &(0x7f0000000100), &(0x7f0000000140)=0x0) r3 = openat$hwrng(0xffffffffffffff9c, &(0x7f0000000180), 0x2, 0x0) r4 = syz_genetlink_get_family_id$mptcp(&(0x7f0000000300), 0xffffffffffffffff) sendmsg$MPTCP_PM_CMD_ADD_ADDR(r3, &(0x7f00000003c0)={&(0x7f00000002c0)={0x10, 0x0, 0x0, 0x10}, 0xc, &(0x7f0000000380)={&(0x7f0000000340)={0x24, r4, 0x300, 0x70bd26, 0x25dfdbfb, {}, [@MPTCP_PM_ATTR_SUBFLOWS={0x8, 0x3, 0x1}, @MPTCP_PM_ATTR_RCV_ADD_ADDRS={0x8, 0x2, 0x2}]}, 0x24}, 0x1, 0x0, 0x0, 0x20000004}, 0x8890) r5 = openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000500)='./cgroup/syz1\x00', 0x200002, 0x0) syz_io_uring_submit(0x0, r2, &(0x7f0000000580)=@IORING_OP_FILES_UPDATE={0x14, 0x4, 0x0, 0x0, 0x40, &(0x7f0000000540)=[0xffffffffffffffff, 0xffffffffffffffff, r5, r0, r1], 0x5}, 0x3) socket$inet6_tcp(0xa, 0x1, 0x0) 21:22:32 executing program 5: r0 = io_uring_setup(0x355e, &(0x7f0000000000)={0x0, 0x0, 0x20, 0x0, 0x1be}) r1 = syz_io_uring_setup(0x8fe, &(0x7f0000000080)={0x0, 0x0, 0x0, 0x0, 0x1b8}, &(0x7f0000ffb000/0x2000)=nil, &(0x7f0000ffb000/0x4000)=nil, &(0x7f0000000100), &(0x7f0000000140)=0x0) r3 = openat$hwrng(0xffffffffffffff9c, &(0x7f0000000180), 0x2, 0x0) r4 = syz_io_uring_setup(0x65dd, 0x0, &(0x7f0000ffe000/0x1000)=nil, &(0x7f0000ffd000/0x1000)=nil, &(0x7f0000000240), &(0x7f0000000280)) r5 = syz_genetlink_get_family_id$mptcp(&(0x7f0000000300), r3) sendmsg$MPTCP_PM_CMD_ADD_ADDR(r3, &(0x7f00000003c0)={&(0x7f00000002c0)={0x10, 0x0, 0x0, 0x10}, 0xc, &(0x7f0000000380)={&(0x7f0000000340)={0x24, r5, 0x300, 0x70bd26, 0x25dfdbfb, {}, [@MPTCP_PM_ATTR_SUBFLOWS={0x8, 0x3, 0x1}, @MPTCP_PM_ATTR_RCV_ADD_ADDRS={0x8, 0x2, 0x2}]}, 0x24}, 0x1, 0x0, 0x0, 0x20000004}, 0x8890) r6 = openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000500)='./cgroup/syz1\x00', 0x200002, 0x0) syz_io_uring_submit(0x0, r2, &(0x7f0000000580)=@IORING_OP_FILES_UPDATE={0x14, 0x4, 0x0, 0x0, 0x40, &(0x7f0000000540)=[r4, 0xffffffffffffffff, r6, r0, r1], 0x5}, 0x3) socket$inet6_tcp(0xa, 0x1, 0x0) openat$procfs(0xffffffffffffff9c, &(0x7f00000010c0)='/proc/crypto\x00', 0x0, 0x0) 21:22:32 executing program 1: r0 = io_uring_setup(0x355e, &(0x7f0000000000)={0x0, 0x0, 0x20, 0x1, 0x1be}) r1 = openat$hwrng(0xffffffffffffff9c, &(0x7f0000000180), 0x2, 0x0) r2 = syz_io_uring_setup(0x65dd, &(0x7f00000001c0)={0x0, 0x0, 0x20, 0x2}, &(0x7f0000ffe000/0x1000)=nil, &(0x7f0000ffd000/0x1000)=nil, &(0x7f0000000240), &(0x7f0000000280)) syz_genetlink_get_family_id$mptcp(&(0x7f0000000300), r1) syz_io_uring_setup(0x20f8, &(0x7f0000000400)={0x0, 0x7677, 0x8, 0x0, 0x22f, 0x0, r2}, &(0x7f0000ffe000/0x2000)=nil, &(0x7f0000ffb000/0x2000)=nil, &(0x7f0000000480)=0x0, &(0x7f00000004c0)) r4 = openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000500)='./cgroup/syz1\x00', 0x200002, 0x0) syz_io_uring_submit(r3, 0x0, &(0x7f0000000580)=@IORING_OP_FILES_UPDATE={0x14, 0x4, 0x0, 0x0, 0x40, &(0x7f0000000540)=[r2, 0xffffffffffffffff, r4, r0, 0xffffffffffffffff], 0x5}, 0x3) io_uring_setup(0x2812, &(0x7f00000005c0)={0x0, 0x5e1b, 0x2, 0x3, 0x12f, 0x0, r2}) socket$inet6_tcp(0xa, 0x1, 0x0) openat$procfs(0xffffffffffffff9c, &(0x7f00000010c0)='/proc/crypto\x00', 0x0, 0x0) io_uring_setup(0x7c8f, &(0x7f0000001140)={0x0, 0xc240, 0x10, 0x3, 0x1c7, 0x0, r2}) 21:22:32 executing program 2: syz_io_uring_setup(0x8fe, &(0x7f0000000080), &(0x7f0000ffb000/0x2000)=nil, &(0x7f0000ffb000/0x4000)=nil, &(0x7f0000000100), &(0x7f0000000140)) openat$hwrng(0xffffffffffffff9c, &(0x7f0000000180), 0x0, 0x0) openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000500)='./cgroup/syz1\x00', 0x200002, 0x0) syz_io_uring_submit(0x0, 0x0, &(0x7f0000000580)=@IORING_OP_FILES_UPDATE={0x14, 0x0, 0x0, 0x0, 0x0, &(0x7f0000000540)}, 0x3) io_uring_setup(0x2812, &(0x7f00000005c0)={0x0, 0x0, 0x2, 0x3, 0x12f}) 21:22:32 executing program 7: r0 = io_uring_setup(0x355e, &(0x7f0000000000)={0x0, 0x0, 0x20, 0x0, 0x1be}) r1 = syz_io_uring_setup(0x8fe, &(0x7f0000000080)={0x0, 0x1830, 0x0, 0x0, 0x0, 0x0, r0}, &(0x7f0000ffb000/0x2000)=nil, &(0x7f0000ffb000/0x4000)=nil, &(0x7f0000000100), &(0x7f0000000140)=0x0) r3 = openat$hwrng(0xffffffffffffff9c, &(0x7f0000000180), 0x2, 0x0) r4 = syz_genetlink_get_family_id$mptcp(&(0x7f0000000300), 0xffffffffffffffff) sendmsg$MPTCP_PM_CMD_ADD_ADDR(r3, &(0x7f00000003c0)={&(0x7f00000002c0)={0x10, 0x0, 0x0, 0x10}, 0xc, &(0x7f0000000380)={&(0x7f0000000340)={0x24, r4, 0x300, 0x70bd26, 0x25dfdbfb, {}, [@MPTCP_PM_ATTR_SUBFLOWS={0x8, 0x3, 0x1}, @MPTCP_PM_ATTR_RCV_ADD_ADDRS={0x8, 0x2, 0x2}]}, 0x24}, 0x1, 0x0, 0x0, 0x20000004}, 0x8890) r5 = openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000500)='./cgroup/syz1\x00', 0x200002, 0x0) syz_io_uring_submit(0x0, r2, &(0x7f0000000580)=@IORING_OP_FILES_UPDATE={0x14, 0x4, 0x0, 0x0, 0x40, &(0x7f0000000540)=[0xffffffffffffffff, 0xffffffffffffffff, r5, r0, r1], 0x5}, 0x3) socket$inet6_tcp(0xa, 0x1, 0x0) 21:22:40 executing program 5: r0 = io_uring_setup(0x355e, &(0x7f0000000000)={0x0, 0x0, 0x20, 0x0, 0x1be}) r1 = syz_io_uring_setup(0x8fe, &(0x7f0000000080)={0x0, 0x0, 0x0, 0x0, 0x1b8}, &(0x7f0000ffb000/0x2000)=nil, &(0x7f0000ffb000/0x4000)=nil, &(0x7f0000000100), &(0x7f0000000140)=0x0) r3 = openat$hwrng(0xffffffffffffff9c, &(0x7f0000000180), 0x2, 0x0) r4 = syz_io_uring_setup(0x65dd, &(0x7f00000001c0)={0x0, 0x0, 0x20, 0x2, 0xdf}, &(0x7f0000ffe000/0x1000)=nil, &(0x7f0000ffd000/0x1000)=nil, &(0x7f0000000240), &(0x7f0000000280)) r5 = syz_genetlink_get_family_id$mptcp(&(0x7f0000000300), r3) sendmsg$MPTCP_PM_CMD_ADD_ADDR(r3, &(0x7f00000003c0)={&(0x7f00000002c0)={0x10, 0x0, 0x0, 0x10}, 0xc, &(0x7f0000000380)={&(0x7f0000000340)={0x24, r5, 0x300, 0x70bd26, 0x25dfdbfb, {}, [@MPTCP_PM_ATTR_SUBFLOWS={0x8, 0x3, 0x1}, @MPTCP_PM_ATTR_RCV_ADD_ADDRS={0x8, 0x2, 0x2}]}, 0x24}, 0x1, 0x0, 0x0, 0x20000004}, 0x8890) r6 = openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000500)='./cgroup/syz1\x00', 0x200002, 0x0) syz_io_uring_submit(0x0, r2, &(0x7f0000000580)=@IORING_OP_FILES_UPDATE={0x14, 0x4, 0x0, 0x0, 0x40, &(0x7f0000000540)=[r4, 0xffffffffffffffff, r6, r0, r1], 0x5}, 0x3) socket$inet6_tcp(0xa, 0x1, 0x0) openat$procfs(0xffffffffffffff9c, &(0x7f00000010c0)='/proc/crypto\x00', 0x0, 0x0) 21:22:40 executing program 2: syz_io_uring_setup(0x8fe, &(0x7f0000000080), &(0x7f0000ffb000/0x2000)=nil, &(0x7f0000ffb000/0x4000)=nil, &(0x7f0000000100), &(0x7f0000000140)) openat$hwrng(0xffffffffffffff9c, &(0x7f0000000180), 0x0, 0x0) openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000500)='./cgroup/syz1\x00', 0x200002, 0x0) syz_io_uring_submit(0x0, 0x0, &(0x7f0000000580)=@IORING_OP_FILES_UPDATE={0x14, 0x0, 0x0, 0x0, 0x0, &(0x7f0000000540)}, 0x3) io_uring_setup(0x2812, &(0x7f00000005c0)={0x0, 0x0, 0x0, 0x3, 0x12f}) 21:22:40 executing program 4: io_uring_setup(0x355e, &(0x7f0000000000)={0x0, 0x0, 0x20, 0x1, 0x1be}) syz_io_uring_setup(0x8fe, &(0x7f0000000080), &(0x7f0000ffb000/0x2000)=nil, &(0x7f0000ffb000/0x4000)=nil, &(0x7f0000000100), &(0x7f0000000140)) openat$hwrng(0xffffffffffffff9c, &(0x7f0000000180), 0x2, 0x0) syz_genetlink_get_family_id$mptcp(&(0x7f0000000300), 0xffffffffffffffff) openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000500)='./cgroup/syz1\x00', 0x200002, 0x0) syz_io_uring_submit(0x0, 0x0, 0x0, 0x0) io_uring_setup(0x2812, &(0x7f00000005c0)={0x0, 0x5e1b, 0x2, 0x3, 0x12f}) socket$inet6_tcp(0xa, 0x1, 0x0) io_uring_setup(0x7c8f, &(0x7f0000001140)={0x0, 0xc240, 0x10, 0x3, 0x1c7}) 21:22:40 executing program 6: r0 = io_uring_setup(0x355e, &(0x7f0000000000)={0x0, 0x0, 0x20, 0x0, 0x1be}) r1 = syz_io_uring_setup(0x8fe, &(0x7f0000000080)={0x0, 0x1830, 0x0, 0x0, 0x0, 0x0, r0}, &(0x7f0000ffb000/0x2000)=nil, &(0x7f0000ffb000/0x4000)=nil, &(0x7f0000000100), &(0x7f0000000140)=0x0) r3 = openat$hwrng(0xffffffffffffff9c, &(0x7f0000000180), 0x2, 0x0) r4 = syz_genetlink_get_family_id$mptcp(&(0x7f0000000300), r3) sendmsg$MPTCP_PM_CMD_ADD_ADDR(r3, &(0x7f00000003c0)={&(0x7f00000002c0), 0xc, &(0x7f0000000380)={&(0x7f0000000340)={0x24, r4, 0x300, 0x70bd26, 0x25dfdbfb, {}, [@MPTCP_PM_ATTR_SUBFLOWS={0x8, 0x3, 0x1}, @MPTCP_PM_ATTR_RCV_ADD_ADDRS={0x8, 0x2, 0x2}]}, 0x24}, 0x1, 0x0, 0x0, 0x20000004}, 0x8890) syz_io_uring_setup(0x20f8, &(0x7f0000000400)={0x0, 0x7677, 0x8, 0x3, 0x22f}, &(0x7f0000ffe000/0x2000)=nil, &(0x7f0000ffb000/0x2000)=nil, &(0x7f0000000480)=0x0, &(0x7f00000004c0)) r6 = openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000500)='./cgroup/syz1\x00', 0x200002, 0x0) syz_io_uring_submit(r5, r2, &(0x7f0000000580)=@IORING_OP_FILES_UPDATE={0x14, 0x4, 0x0, 0x0, 0x40, &(0x7f0000000540)=[0xffffffffffffffff, 0xffffffffffffffff, r6, r0, r1], 0x5}, 0x3) socket$inet6_tcp(0xa, 0x1, 0x0) openat$procfs(0xffffffffffffff9c, &(0x7f00000010c0)='/proc/crypto\x00', 0x0, 0x0) io_uring_setup(0x7c8f, &(0x7f0000001140)={0x0, 0xc240, 0x10, 0x3, 0x1c7}) 21:22:40 executing program 3: io_uring_setup(0x355e, &(0x7f0000000000)={0x0, 0x0, 0x20, 0x1, 0x1be}) syz_io_uring_setup(0x8fe, &(0x7f0000000080), &(0x7f0000ffb000/0x2000)=nil, &(0x7f0000ffb000/0x4000)=nil, &(0x7f0000000100), &(0x7f0000000140)) openat$hwrng(0xffffffffffffff9c, &(0x7f0000000180), 0x2, 0x0) syz_genetlink_get_family_id$mptcp(&(0x7f0000000300), 0xffffffffffffffff) openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000500)='./cgroup/syz1\x00', 0x200002, 0x0) syz_io_uring_submit(0x0, 0x0, 0x0, 0x3) io_uring_setup(0x0, &(0x7f00000005c0)={0x0, 0x5e1b, 0x2, 0x3, 0x12f}) socket$inet6_tcp(0xa, 0x1, 0x0) io_uring_setup(0x7c8f, &(0x7f0000001140)={0x0, 0xc240, 0x10, 0x3, 0x1c7}) 21:22:40 executing program 0: r0 = io_uring_setup(0x355e, &(0x7f0000000000)={0x0, 0x0, 0x20, 0x0, 0x1be}) r1 = syz_io_uring_setup(0x8fe, &(0x7f0000000080)={0x0, 0x1830, 0x0, 0x0, 0x0, 0x0, r0}, &(0x7f0000ffb000/0x2000)=nil, &(0x7f0000ffb000/0x4000)=nil, &(0x7f0000000100), &(0x7f0000000140)=0x0) r3 = openat$hwrng(0xffffffffffffff9c, &(0x7f0000000180), 0x2, 0x0) syz_genetlink_get_family_id$mptcp(&(0x7f0000000300), r3) sendmsg$MPTCP_PM_CMD_ADD_ADDR(r3, 0x0, 0x8890) syz_io_uring_setup(0x20f8, &(0x7f0000000400)={0x0, 0x7677, 0x8, 0x3, 0x22f}, &(0x7f0000ffe000/0x2000)=nil, &(0x7f0000ffb000/0x2000)=nil, &(0x7f0000000480)=0x0, &(0x7f00000004c0)) r5 = openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000500)='./cgroup/syz1\x00', 0x200002, 0x0) syz_io_uring_submit(r4, r2, &(0x7f0000000580)=@IORING_OP_FILES_UPDATE={0x14, 0x4, 0x0, 0x0, 0x40, &(0x7f0000000540)=[0xffffffffffffffff, 0xffffffffffffffff, r5, r0, r1], 0x5}, 0x3) socket$inet6_tcp(0xa, 0x1, 0x0) io_uring_setup(0x7c8f, &(0x7f0000001140)={0x0, 0xc240, 0x10, 0x3, 0x1c7}) 21:22:40 executing program 1: r0 = io_uring_setup(0x355e, &(0x7f0000000000)={0x0, 0x0, 0x20, 0x1, 0x1be}) r1 = openat$hwrng(0xffffffffffffff9c, &(0x7f0000000180), 0x2, 0x0) r2 = syz_io_uring_setup(0x65dd, &(0x7f00000001c0)={0x0, 0x0, 0x20, 0x2}, &(0x7f0000ffe000/0x1000)=nil, &(0x7f0000ffd000/0x1000)=nil, &(0x7f0000000240), &(0x7f0000000280)) syz_genetlink_get_family_id$mptcp(&(0x7f0000000300), r1) syz_io_uring_setup(0x20f8, &(0x7f0000000400)={0x0, 0x7677, 0x8, 0x0, 0x22f, 0x0, r2}, &(0x7f0000ffe000/0x2000)=nil, &(0x7f0000ffb000/0x2000)=nil, &(0x7f0000000480)=0x0, &(0x7f00000004c0)) r4 = openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000500)='./cgroup/syz1\x00', 0x200002, 0x0) syz_io_uring_submit(r3, 0x0, &(0x7f0000000580)=@IORING_OP_FILES_UPDATE={0x14, 0x4, 0x0, 0x0, 0x40, &(0x7f0000000540)=[r2, 0xffffffffffffffff, r4, r0, 0xffffffffffffffff], 0x5}, 0x3) io_uring_setup(0x2812, &(0x7f00000005c0)={0x0, 0x5e1b, 0x2, 0x3, 0x12f, 0x0, r2}) socket$inet6_tcp(0xa, 0x1, 0x0) openat$procfs(0xffffffffffffff9c, &(0x7f00000010c0)='/proc/crypto\x00', 0x0, 0x0) io_uring_setup(0x7c8f, &(0x7f0000001140)={0x0, 0xc240, 0x10, 0x3, 0x1c7, 0x0, r2}) 21:22:40 executing program 7: r0 = io_uring_setup(0x355e, &(0x7f0000000000)={0x0, 0x0, 0x20, 0x0, 0x1be}) r1 = syz_io_uring_setup(0x8fe, &(0x7f0000000080)={0x0, 0x1830, 0x0, 0x0, 0x0, 0x0, r0}, &(0x7f0000ffb000/0x2000)=nil, &(0x7f0000ffb000/0x4000)=nil, &(0x7f0000000100), &(0x7f0000000140)=0x0) r3 = openat$hwrng(0xffffffffffffff9c, &(0x7f0000000180), 0x2, 0x0) r4 = syz_genetlink_get_family_id$mptcp(&(0x7f0000000300), 0xffffffffffffffff) sendmsg$MPTCP_PM_CMD_ADD_ADDR(r3, &(0x7f00000003c0)={&(0x7f00000002c0)={0x10, 0x0, 0x0, 0x10}, 0xc, &(0x7f0000000380)={&(0x7f0000000340)={0x24, r4, 0x300, 0x70bd26, 0x25dfdbfb, {}, [@MPTCP_PM_ATTR_SUBFLOWS={0x8, 0x3, 0x1}, @MPTCP_PM_ATTR_RCV_ADD_ADDRS={0x8, 0x2, 0x2}]}, 0x24}, 0x1, 0x0, 0x0, 0x20000004}, 0x8890) r5 = openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000500)='./cgroup/syz1\x00', 0x200002, 0x0) syz_io_uring_submit(0x0, r2, &(0x7f0000000580)=@IORING_OP_FILES_UPDATE={0x14, 0x4, 0x0, 0x0, 0x40, &(0x7f0000000540)=[0xffffffffffffffff, 0xffffffffffffffff, r5, r0, r1], 0x5}, 0x3) socket$inet6_tcp(0xa, 0x1, 0x0) 21:22:40 executing program 2: syz_io_uring_setup(0x8fe, &(0x7f0000000080), &(0x7f0000ffb000/0x2000)=nil, &(0x7f0000ffb000/0x4000)=nil, &(0x7f0000000100), &(0x7f0000000140)) openat$hwrng(0xffffffffffffff9c, &(0x7f0000000180), 0x0, 0x0) openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000500)='./cgroup/syz1\x00', 0x200002, 0x0) syz_io_uring_submit(0x0, 0x0, &(0x7f0000000580)=@IORING_OP_FILES_UPDATE={0x14, 0x0, 0x0, 0x0, 0x0, &(0x7f0000000540)}, 0x3) io_uring_setup(0x2812, &(0x7f00000005c0)={0x0, 0x0, 0x0, 0x3, 0x12f}) [ 690.452661] kmemleak: Found object by alias at 0x607f1a6398ac [ 690.452682] CPU: 1 UID: 0 PID: 7954 Comm: syz-executor.3 Tainted: G W 6.17.0-rc3-next-20250829 #1 PREEMPT(voluntary) [ 690.452701] Tainted: [W]=WARN [ 690.452704] Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.12.0-1 04/01/2014 [ 690.452712] Call Trace: [ 690.452716] [ 690.452721] dump_stack_lvl+0xca/0x120 [ 690.452747] __lookup_object+0x94/0xb0 [ 690.452764] delete_object_full+0x27/0x70 [ 690.452779] free_percpu+0x30/0x1160 [ 690.452796] ? arch_uprobe_clear_state+0x16/0x140 [ 690.452816] futex_hash_free+0x38/0xc0 [ 690.452830] mmput+0x2d3/0x390 [ 690.452850] do_exit+0x79d/0x2970 [ 690.452863] ? lock_release+0xc8/0x290 [ 690.452880] ? __pfx_do_exit+0x10/0x10 [ 690.452894] ? find_held_lock+0x2b/0x80 [ 690.452910] ? get_signal+0x835/0x2340 [ 690.452930] do_group_exit+0xd3/0x2a0 [ 690.452944] get_signal+0x2315/0x2340 [ 690.452966] ? __pfx_get_signal+0x10/0x10 [ 690.452982] ? do_futex+0x135/0x370 [ 690.452995] ? __pfx_do_futex+0x10/0x10 [ 690.453010] arch_do_signal_or_restart+0x80/0x790 [ 690.453028] ? __pfx_arch_do_signal_or_restart+0x10/0x10 [ 690.453044] ? __x64_sys_futex+0x1c9/0x4d0 [ 690.453056] ? __x64_sys_futex+0x1d2/0x4d0 [ 690.453069] ? __sys_socket+0x9f/0x260 [ 690.453084] ? __pfx___x64_sys_futex+0x10/0x10 [ 690.453096] ? lock_mm_and_find_vma+0xaa/0x6f0 [ 690.453110] ? xfd_validate_state+0x55/0x180 [ 690.453131] exit_to_user_mode_loop+0x8b/0x110 [ 690.453144] do_syscall_64+0x2f7/0x360 [ 690.453156] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 690.453168] RIP: 0033:0x7f1060a76b19 [ 690.453177] Code: Unable to access opcode bytes at 0x7f1060a76aef. [ 690.453187] RSP: 002b:00007f105dfcb218 EFLAGS: 00000246 ORIG_RAX: 00000000000000ca [ 690.453199] RAX: fffffffffffffe00 RBX: 00007f1060b8a028 RCX: 00007f1060a76b19 [ 690.453206] RDX: 0000000000000000 RSI: 0000000000000080 RDI: 00007f1060b8a028 [ 690.453213] RBP: 00007f1060b8a020 R08: 0000000000000000 R09: 0000000000000000 [ 690.453220] R10: 0000000000000000 R11: 0000000000000246 R12: 00007f1060b8a02c [ 690.453227] R13: 00007ffed3f8b4af R14: 00007f105dfcb300 R15: 0000000000022000 [ 690.453243] [ 690.453246] kmemleak: Object (percpu) 0x607f1a6398a8 (size 8): [ 690.453253] kmemleak: comm "syz-executor.5", pid 7956, jiffies 4295357268 [ 690.453260] kmemleak: min_count = 1 [ 690.453264] kmemleak: count = 0 [ 690.453267] kmemleak: flags = 0x21 [ 690.453271] kmemleak: checksum = 0 [ 690.453275] kmemleak: backtrace: [ 690.453278] pcpu_alloc_noprof+0x87a/0x1170 [ 690.453293] percpu_ref_init+0x37/0x400 [ 690.453312] io_uring_setup+0x44c/0x2000 [ 690.453323] __x64_sys_io_uring_setup+0xc8/0x170 [ 690.453334] do_syscall_64+0xbf/0x360 [ 690.453342] entry_SYSCALL_64_after_hwframe+0x77/0x7f 21:22:41 executing program 2: syz_io_uring_setup(0x8fe, &(0x7f0000000080), &(0x7f0000ffb000/0x2000)=nil, &(0x7f0000ffb000/0x4000)=nil, &(0x7f0000000100), &(0x7f0000000140)) openat$hwrng(0xffffffffffffff9c, &(0x7f0000000180), 0x0, 0x0) openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000500)='./cgroup/syz1\x00', 0x200002, 0x0) syz_io_uring_submit(0x0, 0x0, &(0x7f0000000580)=@IORING_OP_FILES_UPDATE={0x14, 0x0, 0x0, 0x0, 0x0, &(0x7f0000000540)}, 0x3) io_uring_setup(0x2812, &(0x7f00000005c0)={0x0, 0x0, 0x0, 0x3, 0x12f}) 21:22:41 executing program 7: r0 = io_uring_setup(0x355e, &(0x7f0000000000)={0x0, 0x0, 0x20, 0x0, 0x1be}) r1 = syz_io_uring_setup(0x8fe, &(0x7f0000000080)={0x0, 0x1830, 0x0, 0x0, 0x0, 0x0, r0}, &(0x7f0000ffb000/0x2000)=nil, &(0x7f0000ffb000/0x4000)=nil, &(0x7f0000000100), &(0x7f0000000140)=0x0) openat$hwrng(0xffffffffffffff9c, &(0x7f0000000180), 0x2, 0x0) syz_genetlink_get_family_id$mptcp(&(0x7f0000000300), 0xffffffffffffffff) r3 = openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000500)='./cgroup/syz1\x00', 0x200002, 0x0) syz_io_uring_submit(0x0, r2, &(0x7f0000000580)=@IORING_OP_FILES_UPDATE={0x14, 0x4, 0x0, 0x0, 0x40, &(0x7f0000000540)=[0xffffffffffffffff, 0xffffffffffffffff, r3, r0, r1], 0x5}, 0x3) socket$inet6_tcp(0xa, 0x1, 0x0) 21:22:41 executing program 3: io_uring_setup(0x355e, &(0x7f0000000000)={0x0, 0x0, 0x20, 0x1, 0x1be}) syz_io_uring_setup(0x8fe, &(0x7f0000000080), &(0x7f0000ffb000/0x2000)=nil, &(0x7f0000ffb000/0x4000)=nil, &(0x7f0000000100), &(0x7f0000000140)) openat$hwrng(0xffffffffffffff9c, &(0x7f0000000180), 0x2, 0x0) syz_genetlink_get_family_id$mptcp(&(0x7f0000000300), 0xffffffffffffffff) openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000500)='./cgroup/syz1\x00', 0x200002, 0x0) syz_io_uring_submit(0x0, 0x0, 0x0, 0x3) io_uring_setup(0x0, &(0x7f00000005c0)={0x0, 0x5e1b, 0x2, 0x3, 0x12f}) socket$inet6_tcp(0xa, 0x1, 0x0) io_uring_setup(0x7c8f, &(0x7f0000001140)={0x0, 0xc240, 0x10, 0x3, 0x1c7}) 21:22:41 executing program 2: syz_io_uring_setup(0x8fe, &(0x7f0000000080), &(0x7f0000ffb000/0x2000)=nil, &(0x7f0000ffb000/0x4000)=nil, &(0x7f0000000100), &(0x7f0000000140)) openat$hwrng(0xffffffffffffff9c, &(0x7f0000000180), 0x0, 0x0) openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000500)='./cgroup/syz1\x00', 0x200002, 0x0) syz_io_uring_submit(0x0, 0x0, &(0x7f0000000580)=@IORING_OP_FILES_UPDATE={0x14, 0x0, 0x0, 0x0, 0x0, &(0x7f0000000540)}, 0x3) io_uring_setup(0x2812, &(0x7f00000005c0)={0x0, 0x0, 0x2, 0x0, 0x12f}) 21:22:41 executing program 4: io_uring_setup(0x355e, &(0x7f0000000000)={0x0, 0x0, 0x20, 0x1, 0x1be}) syz_io_uring_setup(0x8fe, &(0x7f0000000080), &(0x7f0000ffb000/0x2000)=nil, &(0x7f0000ffb000/0x4000)=nil, &(0x7f0000000100), &(0x7f0000000140)) openat$hwrng(0xffffffffffffff9c, &(0x7f0000000180), 0x2, 0x0) syz_genetlink_get_family_id$mptcp(&(0x7f0000000300), 0xffffffffffffffff) openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000500)='./cgroup/syz1\x00', 0x200002, 0x0) syz_io_uring_submit(0x0, 0x0, 0x0, 0x0) io_uring_setup(0x2812, &(0x7f00000005c0)={0x0, 0x5e1b, 0x2, 0x3, 0x12f}) socket$inet6_tcp(0xa, 0x1, 0x0) io_uring_setup(0x7c8f, &(0x7f0000001140)={0x0, 0xc240, 0x10, 0x3, 0x1c7}) 21:22:41 executing program 7: r0 = io_uring_setup(0x355e, &(0x7f0000000000)={0x0, 0x0, 0x20, 0x0, 0x1be}) r1 = syz_io_uring_setup(0x8fe, &(0x7f0000000080)={0x0, 0x1830, 0x0, 0x0, 0x0, 0x0, r0}, &(0x7f0000ffb000/0x2000)=nil, &(0x7f0000ffb000/0x4000)=nil, &(0x7f0000000100), &(0x7f0000000140)=0x0) openat$hwrng(0xffffffffffffff9c, &(0x7f0000000180), 0x2, 0x0) r3 = openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000500)='./cgroup/syz1\x00', 0x200002, 0x0) syz_io_uring_submit(0x0, r2, &(0x7f0000000580)=@IORING_OP_FILES_UPDATE={0x14, 0x4, 0x0, 0x0, 0x40, &(0x7f0000000540)=[0xffffffffffffffff, 0xffffffffffffffff, r3, r0, r1], 0x5}, 0x3) socket$inet6_tcp(0xa, 0x1, 0x0) 21:22:41 executing program 1: r0 = io_uring_setup(0x355e, &(0x7f0000000000)={0x0, 0x0, 0x20, 0x1, 0x1be}) r1 = openat$hwrng(0xffffffffffffff9c, &(0x7f0000000180), 0x2, 0x0) r2 = syz_io_uring_setup(0x65dd, &(0x7f00000001c0)={0x0, 0x0, 0x20, 0x2}, &(0x7f0000ffe000/0x1000)=nil, &(0x7f0000ffd000/0x1000)=nil, &(0x7f0000000240), &(0x7f0000000280)) syz_genetlink_get_family_id$mptcp(&(0x7f0000000300), r1) syz_io_uring_setup(0x20f8, &(0x7f0000000400)={0x0, 0x7677, 0x8, 0x3, 0x0, 0x0, r2}, &(0x7f0000ffe000/0x2000)=nil, &(0x7f0000ffb000/0x2000)=nil, &(0x7f0000000480)=0x0, &(0x7f00000004c0)) r4 = openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000500)='./cgroup/syz1\x00', 0x200002, 0x0) syz_io_uring_submit(r3, 0x0, &(0x7f0000000580)=@IORING_OP_FILES_UPDATE={0x14, 0x4, 0x0, 0x0, 0x40, &(0x7f0000000540)=[r2, 0xffffffffffffffff, r4, r0, 0xffffffffffffffff], 0x5}, 0x3) io_uring_setup(0x2812, &(0x7f00000005c0)={0x0, 0x5e1b, 0x2, 0x3, 0x12f, 0x0, r2}) socket$inet6_tcp(0xa, 0x1, 0x0) openat$procfs(0xffffffffffffff9c, &(0x7f00000010c0)='/proc/crypto\x00', 0x0, 0x0) io_uring_setup(0x7c8f, &(0x7f0000001140)={0x0, 0xc240, 0x10, 0x3, 0x1c7, 0x0, r2}) 21:22:41 executing program 0: r0 = io_uring_setup(0x355e, &(0x7f0000000000)={0x0, 0x0, 0x20, 0x0, 0x1be}) r1 = syz_io_uring_setup(0x8fe, &(0x7f0000000080)={0x0, 0x1830, 0x0, 0x0, 0x0, 0x0, r0}, &(0x7f0000ffb000/0x2000)=nil, &(0x7f0000ffb000/0x4000)=nil, &(0x7f0000000100), &(0x7f0000000140)=0x0) r3 = openat$hwrng(0xffffffffffffff9c, &(0x7f0000000180), 0x2, 0x0) syz_genetlink_get_family_id$mptcp(&(0x7f0000000300), r3) sendmsg$MPTCP_PM_CMD_ADD_ADDR(r3, 0x0, 0x8890) syz_io_uring_setup(0x20f8, &(0x7f0000000400)={0x0, 0x7677, 0x8, 0x3, 0x22f}, &(0x7f0000ffe000/0x2000)=nil, &(0x7f0000ffb000/0x2000)=nil, &(0x7f0000000480)=0x0, &(0x7f00000004c0)) r5 = openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000500)='./cgroup/syz1\x00', 0x200002, 0x0) syz_io_uring_submit(r4, r2, &(0x7f0000000580)=@IORING_OP_FILES_UPDATE={0x14, 0x4, 0x0, 0x0, 0x40, &(0x7f0000000540)=[0xffffffffffffffff, 0xffffffffffffffff, r5, r0, r1], 0x5}, 0x3) io_uring_setup(0x7c8f, &(0x7f0000001140)={0x0, 0xc240, 0x10, 0x3, 0x1c7}) 21:22:41 executing program 5: r0 = io_uring_setup(0x355e, &(0x7f0000000000)={0x0, 0x0, 0x20, 0x0, 0x1be}) r1 = syz_io_uring_setup(0x8fe, &(0x7f0000000080)={0x0, 0x0, 0x0, 0x0, 0x1b8}, &(0x7f0000ffb000/0x2000)=nil, &(0x7f0000ffb000/0x4000)=nil, &(0x7f0000000100), &(0x7f0000000140)=0x0) r3 = openat$hwrng(0xffffffffffffff9c, &(0x7f0000000180), 0x2, 0x0) r4 = syz_io_uring_setup(0x65dd, &(0x7f00000001c0)={0x0, 0x0, 0x0, 0x2, 0xdf}, &(0x7f0000ffe000/0x1000)=nil, &(0x7f0000ffd000/0x1000)=nil, &(0x7f0000000240), &(0x7f0000000280)) r5 = syz_genetlink_get_family_id$mptcp(&(0x7f0000000300), r3) sendmsg$MPTCP_PM_CMD_ADD_ADDR(r3, &(0x7f00000003c0)={&(0x7f00000002c0)={0x10, 0x0, 0x0, 0x10}, 0xc, &(0x7f0000000380)={&(0x7f0000000340)={0x24, r5, 0x300, 0x70bd26, 0x25dfdbfb, {}, [@MPTCP_PM_ATTR_SUBFLOWS={0x8, 0x3, 0x1}, @MPTCP_PM_ATTR_RCV_ADD_ADDRS={0x8, 0x2, 0x2}]}, 0x24}, 0x1, 0x0, 0x0, 0x20000004}, 0x8890) r6 = openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000500)='./cgroup/syz1\x00', 0x200002, 0x0) syz_io_uring_submit(0x0, r2, &(0x7f0000000580)=@IORING_OP_FILES_UPDATE={0x14, 0x4, 0x0, 0x0, 0x40, &(0x7f0000000540)=[r4, 0xffffffffffffffff, r6, r0, r1], 0x5}, 0x3) socket$inet6_tcp(0xa, 0x1, 0x0) openat$procfs(0xffffffffffffff9c, &(0x7f00000010c0)='/proc/crypto\x00', 0x0, 0x0) 21:22:41 executing program 6: r0 = io_uring_setup(0x355e, &(0x7f0000000000)={0x0, 0x0, 0x20, 0x0, 0x1be}) r1 = syz_io_uring_setup(0x8fe, &(0x7f0000000080)={0x0, 0x1830, 0x0, 0x0, 0x0, 0x0, r0}, &(0x7f0000ffb000/0x2000)=nil, &(0x7f0000ffb000/0x4000)=nil, &(0x7f0000000100), &(0x7f0000000140)=0x0) r3 = openat$hwrng(0xffffffffffffff9c, &(0x7f0000000180), 0x2, 0x0) syz_genetlink_get_family_id$mptcp(&(0x7f0000000300), r3) sendmsg$MPTCP_PM_CMD_ADD_ADDR(r3, &(0x7f00000003c0)={&(0x7f00000002c0), 0xc, 0x0, 0x1, 0x0, 0x0, 0x20000004}, 0x8890) syz_io_uring_setup(0x20f8, &(0x7f0000000400)={0x0, 0x7677, 0x8, 0x3, 0x22f}, &(0x7f0000ffe000/0x2000)=nil, &(0x7f0000ffb000/0x2000)=nil, &(0x7f0000000480)=0x0, &(0x7f00000004c0)) r5 = openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000500)='./cgroup/syz1\x00', 0x200002, 0x0) syz_io_uring_submit(r4, r2, &(0x7f0000000580)=@IORING_OP_FILES_UPDATE={0x14, 0x4, 0x0, 0x0, 0x40, &(0x7f0000000540)=[0xffffffffffffffff, 0xffffffffffffffff, r5, r0, r1], 0x5}, 0x3) socket$inet6_tcp(0xa, 0x1, 0x0) openat$procfs(0xffffffffffffff9c, &(0x7f00000010c0)='/proc/crypto\x00', 0x0, 0x0) io_uring_setup(0x7c8f, &(0x7f0000001140)={0x0, 0xc240, 0x10, 0x3, 0x1c7}) 21:22:41 executing program 2: syz_io_uring_setup(0x8fe, &(0x7f0000000080), &(0x7f0000ffb000/0x2000)=nil, &(0x7f0000ffb000/0x4000)=nil, &(0x7f0000000100), &(0x7f0000000140)) openat$hwrng(0xffffffffffffff9c, &(0x7f0000000180), 0x0, 0x0) openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000500)='./cgroup/syz1\x00', 0x200002, 0x0) syz_io_uring_submit(0x0, 0x0, &(0x7f0000000580)=@IORING_OP_FILES_UPDATE={0x14, 0x0, 0x0, 0x0, 0x0, &(0x7f0000000540)}, 0x3) io_uring_setup(0x2812, &(0x7f00000005c0)={0x0, 0x0, 0x2, 0x0, 0x12f}) 21:22:50 executing program 2: syz_io_uring_setup(0x8fe, &(0x7f0000000080), &(0x7f0000ffb000/0x2000)=nil, &(0x7f0000ffb000/0x4000)=nil, &(0x7f0000000100), &(0x7f0000000140)) openat$hwrng(0xffffffffffffff9c, &(0x7f0000000180), 0x0, 0x0) openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000500)='./cgroup/syz1\x00', 0x200002, 0x0) syz_io_uring_submit(0x0, 0x0, &(0x7f0000000580)=@IORING_OP_FILES_UPDATE={0x14, 0x0, 0x0, 0x0, 0x0, &(0x7f0000000540)}, 0x3) io_uring_setup(0x2812, &(0x7f00000005c0)={0x0, 0x0, 0x2}) 21:22:50 executing program 7: r0 = io_uring_setup(0x355e, &(0x7f0000000000)={0x0, 0x0, 0x20, 0x0, 0x1be}) r1 = syz_io_uring_setup(0x8fe, &(0x7f0000000080)={0x0, 0x1830, 0x0, 0x0, 0x0, 0x0, r0}, &(0x7f0000ffb000/0x2000)=nil, &(0x7f0000ffb000/0x4000)=nil, &(0x7f0000000100), &(0x7f0000000140)=0x0) r3 = openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000500)='./cgroup/syz1\x00', 0x200002, 0x0) syz_io_uring_submit(0x0, r2, &(0x7f0000000580)=@IORING_OP_FILES_UPDATE={0x14, 0x4, 0x0, 0x0, 0x40, &(0x7f0000000540)=[0xffffffffffffffff, 0xffffffffffffffff, r3, r0, r1], 0x5}, 0x3) socket$inet6_tcp(0xa, 0x1, 0x0) 21:22:50 executing program 1: r0 = io_uring_setup(0x355e, &(0x7f0000000000)={0x0, 0x0, 0x20, 0x1, 0x1be}) r1 = openat$hwrng(0xffffffffffffff9c, &(0x7f0000000180), 0x2, 0x0) r2 = syz_io_uring_setup(0x65dd, &(0x7f00000001c0)={0x0, 0x0, 0x20, 0x2}, &(0x7f0000ffe000/0x1000)=nil, &(0x7f0000ffd000/0x1000)=nil, &(0x7f0000000240), &(0x7f0000000280)) syz_genetlink_get_family_id$mptcp(&(0x7f0000000300), r1) syz_io_uring_setup(0x20f8, &(0x7f0000000400)={0x0, 0x7677, 0x8, 0x3, 0x0, 0x0, r2}, &(0x7f0000ffe000/0x2000)=nil, &(0x7f0000ffb000/0x2000)=nil, &(0x7f0000000480)=0x0, &(0x7f00000004c0)) r4 = openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000500)='./cgroup/syz1\x00', 0x200002, 0x0) syz_io_uring_submit(r3, 0x0, &(0x7f0000000580)=@IORING_OP_FILES_UPDATE={0x14, 0x4, 0x0, 0x0, 0x40, &(0x7f0000000540)=[r2, 0xffffffffffffffff, r4, r0, 0xffffffffffffffff], 0x5}, 0x3) io_uring_setup(0x2812, &(0x7f00000005c0)={0x0, 0x5e1b, 0x2, 0x3, 0x12f, 0x0, r2}) socket$inet6_tcp(0xa, 0x1, 0x0) openat$procfs(0xffffffffffffff9c, &(0x7f00000010c0)='/proc/crypto\x00', 0x0, 0x0) io_uring_setup(0x7c8f, &(0x7f0000001140)={0x0, 0xc240, 0x10, 0x3, 0x1c7, 0x0, r2}) 21:22:50 executing program 4: io_uring_setup(0x355e, &(0x7f0000000000)={0x0, 0x0, 0x20, 0x1, 0x1be}) syz_io_uring_setup(0x8fe, &(0x7f0000000080), &(0x7f0000ffb000/0x2000)=nil, &(0x7f0000ffb000/0x4000)=nil, &(0x7f0000000100), &(0x7f0000000140)) openat$hwrng(0xffffffffffffff9c, &(0x7f0000000180), 0x2, 0x0) syz_genetlink_get_family_id$mptcp(&(0x7f0000000300), 0xffffffffffffffff) openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000500)='./cgroup/syz1\x00', 0x200002, 0x0) syz_io_uring_submit(0x0, 0x0, 0x0, 0x0) io_uring_setup(0x2812, &(0x7f00000005c0)={0x0, 0x5e1b, 0x2, 0x3, 0x12f}) io_uring_setup(0x7c8f, &(0x7f0000001140)={0x0, 0xc240, 0x10, 0x3, 0x1c7}) 21:22:50 executing program 0: r0 = io_uring_setup(0x355e, &(0x7f0000000000)={0x0, 0x0, 0x20, 0x0, 0x1be}) r1 = syz_io_uring_setup(0x8fe, &(0x7f0000000080)={0x0, 0x1830, 0x0, 0x0, 0x0, 0x0, r0}, &(0x7f0000ffb000/0x2000)=nil, &(0x7f0000ffb000/0x4000)=nil, &(0x7f0000000100), &(0x7f0000000140)=0x0) r3 = openat$hwrng(0xffffffffffffff9c, &(0x7f0000000180), 0x2, 0x0) syz_genetlink_get_family_id$mptcp(&(0x7f0000000300), r3) sendmsg$MPTCP_PM_CMD_ADD_ADDR(r3, 0x0, 0x8890) syz_io_uring_setup(0x20f8, &(0x7f0000000400)={0x0, 0x7677, 0x8, 0x3, 0x22f}, &(0x7f0000ffe000/0x2000)=nil, &(0x7f0000ffb000/0x2000)=nil, &(0x7f0000000480)=0x0, &(0x7f00000004c0)) r5 = openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000500)='./cgroup/syz1\x00', 0x200002, 0x0) syz_io_uring_submit(r4, r2, &(0x7f0000000580)=@IORING_OP_FILES_UPDATE={0x14, 0x4, 0x0, 0x0, 0x40, &(0x7f0000000540)=[0xffffffffffffffff, 0xffffffffffffffff, r5, r0, r1], 0x5}, 0x3) io_uring_setup(0x7c8f, &(0x7f0000001140)={0x0, 0xc240, 0x10, 0x3, 0x1c7}) 21:22:50 executing program 6: r0 = io_uring_setup(0x355e, &(0x7f0000000000)={0x0, 0x0, 0x20, 0x0, 0x1be}) r1 = syz_io_uring_setup(0x8fe, &(0x7f0000000080)={0x0, 0x1830, 0x0, 0x0, 0x0, 0x0, r0}, &(0x7f0000ffb000/0x2000)=nil, &(0x7f0000ffb000/0x4000)=nil, &(0x7f0000000100), &(0x7f0000000140)=0x0) r3 = openat$hwrng(0xffffffffffffff9c, &(0x7f0000000180), 0x2, 0x0) syz_genetlink_get_family_id$mptcp(&(0x7f0000000300), r3) sendmsg$MPTCP_PM_CMD_ADD_ADDR(r3, &(0x7f00000003c0)={&(0x7f00000002c0), 0xc, 0x0, 0x1, 0x0, 0x0, 0x20000004}, 0x8890) syz_io_uring_setup(0x20f8, &(0x7f0000000400)={0x0, 0x7677, 0x8, 0x3, 0x22f}, &(0x7f0000ffe000/0x2000)=nil, &(0x7f0000ffb000/0x2000)=nil, &(0x7f0000000480)=0x0, &(0x7f00000004c0)) r5 = openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000500)='./cgroup/syz1\x00', 0x200002, 0x0) syz_io_uring_submit(r4, r2, &(0x7f0000000580)=@IORING_OP_FILES_UPDATE={0x14, 0x4, 0x0, 0x0, 0x40, &(0x7f0000000540)=[0xffffffffffffffff, 0xffffffffffffffff, r5, r0, r1], 0x5}, 0x3) socket$inet6_tcp(0xa, 0x1, 0x0) openat$procfs(0xffffffffffffff9c, &(0x7f00000010c0)='/proc/crypto\x00', 0x0, 0x0) io_uring_setup(0x7c8f, &(0x7f0000001140)={0x0, 0xc240, 0x10, 0x3, 0x1c7}) 21:22:50 executing program 5: r0 = io_uring_setup(0x355e, &(0x7f0000000000)={0x0, 0x0, 0x20, 0x0, 0x1be}) r1 = syz_io_uring_setup(0x8fe, &(0x7f0000000080)={0x0, 0x0, 0x0, 0x0, 0x1b8}, &(0x7f0000ffb000/0x2000)=nil, &(0x7f0000ffb000/0x4000)=nil, &(0x7f0000000100), &(0x7f0000000140)=0x0) r3 = openat$hwrng(0xffffffffffffff9c, &(0x7f0000000180), 0x2, 0x0) r4 = syz_io_uring_setup(0x65dd, &(0x7f00000001c0)={0x0, 0x0, 0x0, 0x2, 0xdf}, &(0x7f0000ffe000/0x1000)=nil, &(0x7f0000ffd000/0x1000)=nil, &(0x7f0000000240), &(0x7f0000000280)) r5 = syz_genetlink_get_family_id$mptcp(&(0x7f0000000300), r3) sendmsg$MPTCP_PM_CMD_ADD_ADDR(r3, &(0x7f00000003c0)={&(0x7f00000002c0)={0x10, 0x0, 0x0, 0x10}, 0xc, &(0x7f0000000380)={&(0x7f0000000340)={0x24, r5, 0x300, 0x70bd26, 0x25dfdbfb, {}, [@MPTCP_PM_ATTR_SUBFLOWS={0x8, 0x3, 0x1}, @MPTCP_PM_ATTR_RCV_ADD_ADDRS={0x8, 0x2, 0x2}]}, 0x24}, 0x1, 0x0, 0x0, 0x20000004}, 0x8890) r6 = openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000500)='./cgroup/syz1\x00', 0x200002, 0x0) syz_io_uring_submit(0x0, r2, &(0x7f0000000580)=@IORING_OP_FILES_UPDATE={0x14, 0x4, 0x0, 0x0, 0x40, &(0x7f0000000540)=[r4, 0xffffffffffffffff, r6, r0, r1], 0x5}, 0x3) socket$inet6_tcp(0xa, 0x1, 0x0) openat$procfs(0xffffffffffffff9c, &(0x7f00000010c0)='/proc/crypto\x00', 0x0, 0x0) 21:22:50 executing program 3: io_uring_setup(0x355e, &(0x7f0000000000)={0x0, 0x0, 0x20, 0x1, 0x1be}) syz_io_uring_setup(0x8fe, &(0x7f0000000080), &(0x7f0000ffb000/0x2000)=nil, &(0x7f0000ffb000/0x4000)=nil, &(0x7f0000000100), &(0x7f0000000140)) openat$hwrng(0xffffffffffffff9c, &(0x7f0000000180), 0x2, 0x0) syz_genetlink_get_family_id$mptcp(&(0x7f0000000300), 0xffffffffffffffff) openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000500)='./cgroup/syz1\x00', 0x200002, 0x0) syz_io_uring_submit(0x0, 0x0, 0x0, 0x3) io_uring_setup(0x0, &(0x7f00000005c0)={0x0, 0x5e1b, 0x2, 0x3, 0x12f}) socket$inet6_tcp(0xa, 0x1, 0x0) io_uring_setup(0x7c8f, &(0x7f0000001140)={0x0, 0xc240, 0x10, 0x3, 0x1c7}) 21:22:50 executing program 1: r0 = io_uring_setup(0x355e, &(0x7f0000000000)={0x0, 0x0, 0x20, 0x1, 0x1be}) r1 = openat$hwrng(0xffffffffffffff9c, &(0x7f0000000180), 0x2, 0x0) r2 = syz_io_uring_setup(0x65dd, &(0x7f00000001c0)={0x0, 0x0, 0x20, 0x2}, &(0x7f0000ffe000/0x1000)=nil, &(0x7f0000ffd000/0x1000)=nil, &(0x7f0000000240), &(0x7f0000000280)) syz_genetlink_get_family_id$mptcp(&(0x7f0000000300), r1) syz_io_uring_setup(0x20f8, &(0x7f0000000400)={0x0, 0x7677, 0x8, 0x3, 0x0, 0x0, r2}, &(0x7f0000ffe000/0x2000)=nil, &(0x7f0000ffb000/0x2000)=nil, &(0x7f0000000480)=0x0, &(0x7f00000004c0)) r4 = openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000500)='./cgroup/syz1\x00', 0x200002, 0x0) syz_io_uring_submit(r3, 0x0, &(0x7f0000000580)=@IORING_OP_FILES_UPDATE={0x14, 0x4, 0x0, 0x0, 0x40, &(0x7f0000000540)=[r2, 0xffffffffffffffff, r4, r0, 0xffffffffffffffff], 0x5}, 0x3) io_uring_setup(0x2812, &(0x7f00000005c0)={0x0, 0x5e1b, 0x2, 0x3, 0x12f, 0x0, r2}) socket$inet6_tcp(0xa, 0x1, 0x0) openat$procfs(0xffffffffffffff9c, &(0x7f00000010c0)='/proc/crypto\x00', 0x0, 0x0) io_uring_setup(0x7c8f, &(0x7f0000001140)={0x0, 0xc240, 0x10, 0x3, 0x1c7, 0x0, r2}) 21:22:50 executing program 6: r0 = io_uring_setup(0x355e, &(0x7f0000000000)={0x0, 0x0, 0x20, 0x0, 0x1be}) r1 = syz_io_uring_setup(0x8fe, &(0x7f0000000080)={0x0, 0x1830, 0x0, 0x0, 0x0, 0x0, r0}, &(0x7f0000ffb000/0x2000)=nil, &(0x7f0000ffb000/0x4000)=nil, &(0x7f0000000100), &(0x7f0000000140)=0x0) r3 = openat$hwrng(0xffffffffffffff9c, &(0x7f0000000180), 0x2, 0x0) syz_genetlink_get_family_id$mptcp(&(0x7f0000000300), r3) sendmsg$MPTCP_PM_CMD_ADD_ADDR(r3, &(0x7f00000003c0)={&(0x7f00000002c0), 0xc, 0x0, 0x1, 0x0, 0x0, 0x20000004}, 0x8890) syz_io_uring_setup(0x20f8, &(0x7f0000000400)={0x0, 0x7677, 0x8, 0x3, 0x22f}, &(0x7f0000ffe000/0x2000)=nil, &(0x7f0000ffb000/0x2000)=nil, &(0x7f0000000480)=0x0, &(0x7f00000004c0)) r5 = openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000500)='./cgroup/syz1\x00', 0x200002, 0x0) syz_io_uring_submit(r4, r2, &(0x7f0000000580)=@IORING_OP_FILES_UPDATE={0x14, 0x4, 0x0, 0x0, 0x40, &(0x7f0000000540)=[0xffffffffffffffff, 0xffffffffffffffff, r5, r0, r1], 0x5}, 0x3) socket$inet6_tcp(0xa, 0x1, 0x0) openat$procfs(0xffffffffffffff9c, &(0x7f00000010c0)='/proc/crypto\x00', 0x0, 0x0) io_uring_setup(0x7c8f, &(0x7f0000001140)={0x0, 0xc240, 0x10, 0x3, 0x1c7}) 21:22:50 executing program 7: r0 = io_uring_setup(0x355e, &(0x7f0000000000)={0x0, 0x0, 0x20, 0x0, 0x1be}) r1 = syz_io_uring_setup(0x8fe, &(0x7f0000000080)={0x0, 0x1830, 0x0, 0x0, 0x0, 0x0, r0}, &(0x7f0000ffb000/0x2000)=nil, &(0x7f0000ffb000/0x4000)=nil, &(0x7f0000000100), &(0x7f0000000140)=0x0) r3 = openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000500)='./cgroup/syz1\x00', 0x200002, 0x0) syz_io_uring_submit(0x0, r2, &(0x7f0000000580)=@IORING_OP_FILES_UPDATE={0x14, 0x4, 0x0, 0x0, 0x40, &(0x7f0000000540)=[0xffffffffffffffff, 0xffffffffffffffff, r3, r0, r1], 0x5}, 0x3) socket$inet6_tcp(0xa, 0x1, 0x0) 21:22:50 executing program 2: syz_io_uring_setup(0x8fe, &(0x7f0000000080), &(0x7f0000ffb000/0x2000)=nil, &(0x7f0000ffb000/0x4000)=nil, &(0x7f0000000100), &(0x7f0000000140)) openat$hwrng(0xffffffffffffff9c, &(0x7f0000000180), 0x0, 0x0) openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000500)='./cgroup/syz1\x00', 0x200002, 0x0) syz_io_uring_submit(0x0, 0x0, &(0x7f0000000580)=@IORING_OP_FILES_UPDATE={0x14, 0x0, 0x0, 0x0, 0x0, &(0x7f0000000540)}, 0x3) io_uring_setup(0x2812, &(0x7f00000005c0)={0x0, 0x0, 0x2}) 21:22:50 executing program 0: r0 = io_uring_setup(0x355e, &(0x7f0000000000)={0x0, 0x0, 0x20, 0x0, 0x1be}) r1 = syz_io_uring_setup(0x8fe, &(0x7f0000000080)={0x0, 0x1830, 0x0, 0x0, 0x0, 0x0, r0}, &(0x7f0000ffb000/0x2000)=nil, &(0x7f0000ffb000/0x4000)=nil, &(0x7f0000000100), &(0x7f0000000140)=0x0) r3 = openat$hwrng(0xffffffffffffff9c, &(0x7f0000000180), 0x2, 0x0) syz_genetlink_get_family_id$mptcp(&(0x7f0000000300), r3) sendmsg$MPTCP_PM_CMD_ADD_ADDR(r3, 0x0, 0x8890) syz_io_uring_setup(0x20f8, &(0x7f0000000400)={0x0, 0x7677, 0x8, 0x3, 0x22f}, &(0x7f0000ffe000/0x2000)=nil, &(0x7f0000ffb000/0x2000)=nil, &(0x7f0000000480)=0x0, &(0x7f00000004c0)) r5 = openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000500)='./cgroup/syz1\x00', 0x200002, 0x0) syz_io_uring_submit(r4, r2, &(0x7f0000000580)=@IORING_OP_FILES_UPDATE={0x14, 0x4, 0x0, 0x0, 0x40, &(0x7f0000000540)=[0xffffffffffffffff, 0xffffffffffffffff, r5, r0, r1], 0x5}, 0x3) io_uring_setup(0x7c8f, &(0x7f0000001140)={0x0, 0xc240, 0x10, 0x3, 0x1c7}) 21:22:50 executing program 4: io_uring_setup(0x355e, &(0x7f0000000000)={0x0, 0x0, 0x20, 0x1, 0x1be}) syz_io_uring_setup(0x8fe, &(0x7f0000000080), &(0x7f0000ffb000/0x2000)=nil, &(0x7f0000ffb000/0x4000)=nil, &(0x7f0000000100), &(0x7f0000000140)) openat$hwrng(0xffffffffffffff9c, &(0x7f0000000180), 0x2, 0x0) syz_genetlink_get_family_id$mptcp(&(0x7f0000000300), 0xffffffffffffffff) openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000500)='./cgroup/syz1\x00', 0x200002, 0x0) syz_io_uring_submit(0x0, 0x0, 0x0, 0x0) io_uring_setup(0x2812, &(0x7f00000005c0)={0x0, 0x5e1b, 0x2, 0x3, 0x12f}) io_uring_setup(0x7c8f, &(0x7f0000001140)={0x0, 0xc240, 0x10, 0x3, 0x1c7}) 21:22:51 executing program 5: r0 = io_uring_setup(0x355e, &(0x7f0000000000)={0x0, 0x0, 0x20, 0x0, 0x1be}) r1 = syz_io_uring_setup(0x8fe, &(0x7f0000000080)={0x0, 0x0, 0x0, 0x0, 0x1b8}, &(0x7f0000ffb000/0x2000)=nil, &(0x7f0000ffb000/0x4000)=nil, &(0x7f0000000100), &(0x7f0000000140)=0x0) r3 = openat$hwrng(0xffffffffffffff9c, &(0x7f0000000180), 0x2, 0x0) r4 = syz_io_uring_setup(0x65dd, &(0x7f00000001c0)={0x0, 0x0, 0x0, 0x0, 0xdf}, &(0x7f0000ffe000/0x1000)=nil, &(0x7f0000ffd000/0x1000)=nil, &(0x7f0000000240), &(0x7f0000000280)) r5 = syz_genetlink_get_family_id$mptcp(&(0x7f0000000300), r3) sendmsg$MPTCP_PM_CMD_ADD_ADDR(r3, &(0x7f00000003c0)={&(0x7f00000002c0)={0x10, 0x0, 0x0, 0x10}, 0xc, &(0x7f0000000380)={&(0x7f0000000340)={0x24, r5, 0x300, 0x70bd26, 0x25dfdbfb, {}, [@MPTCP_PM_ATTR_SUBFLOWS={0x8, 0x3, 0x1}, @MPTCP_PM_ATTR_RCV_ADD_ADDRS={0x8, 0x2, 0x2}]}, 0x24}, 0x1, 0x0, 0x0, 0x20000004}, 0x8890) r6 = openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000500)='./cgroup/syz1\x00', 0x200002, 0x0) syz_io_uring_submit(0x0, r2, &(0x7f0000000580)=@IORING_OP_FILES_UPDATE={0x14, 0x4, 0x0, 0x0, 0x40, &(0x7f0000000540)=[r4, 0xffffffffffffffff, r6, r0, r1], 0x5}, 0x3) socket$inet6_tcp(0xa, 0x1, 0x0) openat$procfs(0xffffffffffffff9c, &(0x7f00000010c0)='/proc/crypto\x00', 0x0, 0x0) [ 700.544454] kmemleak: Found object by alias at 0x607f1a6398ac [ 700.544490] CPU: 0 UID: 0 PID: 8042 Comm: syz-executor.3 Tainted: G W 6.17.0-rc3-next-20250829 #1 PREEMPT(voluntary) [ 700.544525] Tainted: [W]=WARN [ 700.544532] Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.12.0-1 04/01/2014 [ 700.544545] Call Trace: [ 700.544552] [ 700.544561] dump_stack_lvl+0xca/0x120 [ 700.544604] __lookup_object+0x94/0xb0 [ 700.544635] delete_object_full+0x27/0x70 [ 700.544666] free_percpu+0x30/0x1160 [ 700.544697] ? arch_uprobe_clear_state+0x16/0x140 [ 700.544734] futex_hash_free+0x38/0xc0 [ 700.544760] mmput+0x2d3/0x390 [ 700.544796] do_exit+0x79d/0x2970 [ 700.544829] ? __pfx_do_exit+0x10/0x10 [ 700.544856] ? find_held_lock+0x2b/0x80 [ 700.544889] ? get_signal+0x835/0x2340 [ 700.544927] do_group_exit+0xd3/0x2a0 [ 700.544956] get_signal+0x2315/0x2340 [ 700.544990] ? trace_irq_enable.constprop.0+0xc2/0x100 [ 700.545021] ? __pfx_get_signal+0x10/0x10 [ 700.545052] ? do_futex+0x135/0x370 [ 700.545078] ? __pfx_do_futex+0x10/0x10 [ 700.545108] arch_do_signal_or_restart+0x80/0x790 [ 700.545140] ? __pfx_arch_do_signal_or_restart+0x10/0x10 [ 700.545172] ? __x64_sys_futex+0x1c9/0x4d0 [ 700.545195] ? __x64_sys_futex+0x1d2/0x4d0 [ 700.545224] ? __pfx___x64_sys_futex+0x10/0x10 [ 700.545249] ? lock_mm_and_find_vma+0xaa/0x6f0 [ 700.545274] ? xfd_validate_state+0x55/0x180 [ 700.545313] exit_to_user_mode_loop+0x8b/0x110 [ 700.545344] do_syscall_64+0x2f7/0x360 [ 700.545366] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 700.545389] RIP: 0033:0x7f1060a76b19 [ 700.545406] Code: Unable to access opcode bytes at 0x7f1060a76aef. [ 700.545416] RSP: 002b:00007f105dfcb218 EFLAGS: 00000246 ORIG_RAX: 00000000000000ca [ 700.545437] RAX: fffffffffffffe00 RBX: 00007f1060b8a028 RCX: 00007f1060a76b19 [ 700.545452] RDX: 0000000000000000 RSI: 0000000000000080 RDI: 00007f1060b8a028 [ 700.545466] RBP: 00007f1060b8a020 R08: 0000000000000000 R09: 0000000000000000 [ 700.545479] R10: 0000000000000000 R11: 0000000000000246 R12: 00007f1060b8a02c [ 700.545492] R13: 00007ffed3f8b4af R14: 00007f105dfcb300 R15: 0000000000022000 [ 700.545523] [ 700.545530] kmemleak: Object (percpu) 0x607f1a6398a8 (size 8): [ 700.545543] kmemleak: comm "syz-executor.0", pid 8064, jiffies 4295367397 [ 700.545557] kmemleak: min_count = 1 [ 700.545564] kmemleak: count = 0 [ 700.545571] kmemleak: flags = 0x21 [ 700.545578] kmemleak: checksum = 0 [ 700.545586] kmemleak: backtrace: [ 700.545592] pcpu_alloc_noprof+0x87a/0x1170 [ 700.545621] percpu_ref_init+0x37/0x400 [ 700.545654] io_uring_setup+0x44c/0x2000 [ 700.545675] __x64_sys_io_uring_setup+0xc8/0x170 [ 700.545696] do_syscall_64+0xbf/0x360 [ 700.545713] entry_SYSCALL_64_after_hwframe+0x77/0x7f 21:22:59 executing program 0: r0 = io_uring_setup(0x355e, &(0x7f0000000000)={0x0, 0x0, 0x20, 0x0, 0x1be}) syz_io_uring_setup(0x8fe, &(0x7f0000000080)={0x0, 0x1830, 0x0, 0x0, 0x0, 0x0, r0}, &(0x7f0000ffb000/0x2000)=nil, &(0x7f0000ffb000/0x4000)=nil, &(0x7f0000000100), &(0x7f0000000140)) r1 = openat$hwrng(0xffffffffffffff9c, &(0x7f0000000180), 0x2, 0x0) syz_genetlink_get_family_id$mptcp(&(0x7f0000000300), r1) sendmsg$MPTCP_PM_CMD_ADD_ADDR(r1, 0x0, 0x8890) syz_io_uring_setup(0x20f8, &(0x7f0000000400)={0x0, 0x7677, 0x8, 0x3, 0x22f}, &(0x7f0000ffe000/0x2000)=nil, &(0x7f0000ffb000/0x2000)=nil, &(0x7f0000000480), &(0x7f00000004c0)) openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000500)='./cgroup/syz1\x00', 0x200002, 0x0) socket$inet6_tcp(0xa, 0x1, 0x0) io_uring_setup(0x7c8f, &(0x7f0000001140)={0x0, 0xc240, 0x10, 0x3, 0x1c7}) 21:22:59 executing program 4: io_uring_setup(0x355e, &(0x7f0000000000)={0x0, 0x0, 0x20, 0x1, 0x1be}) syz_io_uring_setup(0x8fe, &(0x7f0000000080), &(0x7f0000ffb000/0x2000)=nil, &(0x7f0000ffb000/0x4000)=nil, &(0x7f0000000100), &(0x7f0000000140)) openat$hwrng(0xffffffffffffff9c, &(0x7f0000000180), 0x2, 0x0) syz_genetlink_get_family_id$mptcp(&(0x7f0000000300), 0xffffffffffffffff) openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000500)='./cgroup/syz1\x00', 0x200002, 0x0) syz_io_uring_submit(0x0, 0x0, 0x0, 0x0) io_uring_setup(0x2812, &(0x7f00000005c0)={0x0, 0x5e1b, 0x2, 0x3, 0x12f}) io_uring_setup(0x7c8f, &(0x7f0000001140)={0x0, 0xc240, 0x10, 0x3, 0x1c7}) 21:22:59 executing program 7: r0 = io_uring_setup(0x355e, &(0x7f0000000000)={0x0, 0x0, 0x20, 0x0, 0x1be}) r1 = syz_io_uring_setup(0x8fe, &(0x7f0000000080)={0x0, 0x1830, 0x0, 0x0, 0x0, 0x0, r0}, &(0x7f0000ffb000/0x2000)=nil, &(0x7f0000ffb000/0x4000)=nil, &(0x7f0000000100), &(0x7f0000000140)=0x0) r3 = openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000500)='./cgroup/syz1\x00', 0x200002, 0x0) syz_io_uring_submit(0x0, r2, &(0x7f0000000580)=@IORING_OP_FILES_UPDATE={0x14, 0x4, 0x0, 0x0, 0x40, &(0x7f0000000540)=[0xffffffffffffffff, 0xffffffffffffffff, r3, r0, r1], 0x5}, 0x3) socket$inet6_tcp(0xa, 0x1, 0x0) 21:22:59 executing program 1: r0 = io_uring_setup(0x355e, &(0x7f0000000000)={0x0, 0x0, 0x20, 0x1, 0x1be}) r1 = openat$hwrng(0xffffffffffffff9c, &(0x7f0000000180), 0x2, 0x0) r2 = syz_io_uring_setup(0x65dd, &(0x7f00000001c0)={0x0, 0x0, 0x20, 0x2}, &(0x7f0000ffe000/0x1000)=nil, &(0x7f0000ffd000/0x1000)=nil, &(0x7f0000000240), &(0x7f0000000280)) syz_genetlink_get_family_id$mptcp(&(0x7f0000000300), r1) syz_io_uring_setup(0x20f8, &(0x7f0000000400)={0x0, 0x7677, 0x8, 0x3, 0x22f}, &(0x7f0000ffe000/0x2000)=nil, &(0x7f0000ffb000/0x2000)=nil, &(0x7f0000000480)=0x0, &(0x7f00000004c0)) r4 = openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000500)='./cgroup/syz1\x00', 0x200002, 0x0) syz_io_uring_submit(r3, 0x0, &(0x7f0000000580)=@IORING_OP_FILES_UPDATE={0x14, 0x4, 0x0, 0x0, 0x40, &(0x7f0000000540)=[r2, 0xffffffffffffffff, r4, r0, 0xffffffffffffffff], 0x5}, 0x3) io_uring_setup(0x2812, &(0x7f00000005c0)={0x0, 0x5e1b, 0x2, 0x3, 0x12f, 0x0, r2}) socket$inet6_tcp(0xa, 0x1, 0x0) openat$procfs(0xffffffffffffff9c, &(0x7f00000010c0)='/proc/crypto\x00', 0x0, 0x0) io_uring_setup(0x7c8f, &(0x7f0000001140)={0x0, 0xc240, 0x10, 0x3, 0x1c7, 0x0, r2}) 21:22:59 executing program 3: io_uring_setup(0x355e, &(0x7f0000000000)={0x0, 0x0, 0x20, 0x1, 0x1be}) syz_io_uring_setup(0x8fe, &(0x7f0000000080), &(0x7f0000ffb000/0x2000)=nil, &(0x7f0000ffb000/0x4000)=nil, &(0x7f0000000100), &(0x7f0000000140)) openat$hwrng(0xffffffffffffff9c, &(0x7f0000000180), 0x2, 0x0) syz_genetlink_get_family_id$mptcp(&(0x7f0000000300), 0xffffffffffffffff) openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000500)='./cgroup/syz1\x00', 0x200002, 0x0) syz_io_uring_submit(0x0, 0x0, 0x0, 0x3) io_uring_setup(0x2812, 0x0) socket$inet6_tcp(0xa, 0x1, 0x0) io_uring_setup(0x7c8f, &(0x7f0000001140)={0x0, 0xc240, 0x10, 0x3, 0x1c7}) 21:22:59 executing program 5: r0 = io_uring_setup(0x355e, &(0x7f0000000000)={0x0, 0x0, 0x20, 0x0, 0x1be}) r1 = syz_io_uring_setup(0x8fe, &(0x7f0000000080)={0x0, 0x0, 0x0, 0x0, 0x1b8}, &(0x7f0000ffb000/0x2000)=nil, &(0x7f0000ffb000/0x4000)=nil, &(0x7f0000000100), &(0x7f0000000140)=0x0) r3 = openat$hwrng(0xffffffffffffff9c, &(0x7f0000000180), 0x2, 0x0) r4 = syz_io_uring_setup(0x65dd, &(0x7f00000001c0)={0x0, 0x0, 0x0, 0x0, 0xdf}, &(0x7f0000ffe000/0x1000)=nil, &(0x7f0000ffd000/0x1000)=nil, &(0x7f0000000240), &(0x7f0000000280)) r5 = syz_genetlink_get_family_id$mptcp(&(0x7f0000000300), r3) sendmsg$MPTCP_PM_CMD_ADD_ADDR(r3, &(0x7f00000003c0)={&(0x7f00000002c0)={0x10, 0x0, 0x0, 0x10}, 0xc, &(0x7f0000000380)={&(0x7f0000000340)={0x24, r5, 0x300, 0x70bd26, 0x25dfdbfb, {}, [@MPTCP_PM_ATTR_SUBFLOWS={0x8, 0x3, 0x1}, @MPTCP_PM_ATTR_RCV_ADD_ADDRS={0x8, 0x2, 0x2}]}, 0x24}, 0x1, 0x0, 0x0, 0x20000004}, 0x8890) r6 = openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000500)='./cgroup/syz1\x00', 0x200002, 0x0) syz_io_uring_submit(0x0, r2, &(0x7f0000000580)=@IORING_OP_FILES_UPDATE={0x14, 0x4, 0x0, 0x0, 0x40, &(0x7f0000000540)=[r4, 0xffffffffffffffff, r6, r0, r1], 0x5}, 0x3) socket$inet6_tcp(0xa, 0x1, 0x0) openat$procfs(0xffffffffffffff9c, &(0x7f00000010c0)='/proc/crypto\x00', 0x0, 0x0) 21:22:59 executing program 6: r0 = io_uring_setup(0x355e, &(0x7f0000000000)={0x0, 0x0, 0x20, 0x0, 0x1be}) r1 = syz_io_uring_setup(0x8fe, &(0x7f0000000080)={0x0, 0x1830, 0x0, 0x0, 0x0, 0x0, r0}, &(0x7f0000ffb000/0x2000)=nil, &(0x7f0000ffb000/0x4000)=nil, &(0x7f0000000100), &(0x7f0000000140)=0x0) r3 = openat$hwrng(0xffffffffffffff9c, &(0x7f0000000180), 0x2, 0x0) syz_genetlink_get_family_id$mptcp(&(0x7f0000000300), r3) sendmsg$MPTCP_PM_CMD_ADD_ADDR(r3, &(0x7f00000003c0)={&(0x7f00000002c0), 0xc, &(0x7f0000000380)={0x0}, 0x1, 0x0, 0x0, 0x20000004}, 0x8890) syz_io_uring_setup(0x20f8, &(0x7f0000000400)={0x0, 0x7677, 0x8, 0x3, 0x22f}, &(0x7f0000ffe000/0x2000)=nil, &(0x7f0000ffb000/0x2000)=nil, &(0x7f0000000480)=0x0, &(0x7f00000004c0)) r5 = openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000500)='./cgroup/syz1\x00', 0x200002, 0x0) syz_io_uring_submit(r4, r2, &(0x7f0000000580)=@IORING_OP_FILES_UPDATE={0x14, 0x4, 0x0, 0x0, 0x40, &(0x7f0000000540)=[0xffffffffffffffff, 0xffffffffffffffff, r5, r0, r1], 0x5}, 0x3) socket$inet6_tcp(0xa, 0x1, 0x0) openat$procfs(0xffffffffffffff9c, &(0x7f00000010c0)='/proc/crypto\x00', 0x0, 0x0) io_uring_setup(0x7c8f, &(0x7f0000001140)={0x0, 0xc240, 0x10, 0x3, 0x1c7}) 21:22:59 executing program 2: syz_io_uring_setup(0x8fe, &(0x7f0000000080), &(0x7f0000ffb000/0x2000)=nil, &(0x7f0000ffb000/0x4000)=nil, &(0x7f0000000100), &(0x7f0000000140)) openat$hwrng(0xffffffffffffff9c, &(0x7f0000000180), 0x0, 0x0) openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000500)='./cgroup/syz1\x00', 0x200002, 0x0) syz_io_uring_submit(0x0, 0x0, &(0x7f0000000580)=@IORING_OP_FILES_UPDATE={0x14, 0x0, 0x0, 0x0, 0x0, &(0x7f0000000540)}, 0x3) io_uring_setup(0x2812, &(0x7f00000005c0)={0x0, 0x0, 0x2}) 21:22:59 executing program 7: r0 = io_uring_setup(0x355e, &(0x7f0000000000)={0x0, 0x0, 0x20, 0x0, 0x1be}) openat$hwrng(0xffffffffffffff9c, &(0x7f0000000180), 0x2, 0x0) r1 = openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000500)='./cgroup/syz1\x00', 0x200002, 0x0) syz_io_uring_submit(0x0, 0x0, &(0x7f0000000580)=@IORING_OP_FILES_UPDATE={0x14, 0x4, 0x0, 0x0, 0x40, &(0x7f0000000540)=[0xffffffffffffffff, 0xffffffffffffffff, r1, r0, 0xffffffffffffffff], 0x5}, 0x3) socket$inet6_tcp(0xa, 0x1, 0x0) 21:22:59 executing program 1: r0 = io_uring_setup(0x355e, &(0x7f0000000000)={0x0, 0x0, 0x20, 0x1, 0x1be}) r1 = openat$hwrng(0xffffffffffffff9c, &(0x7f0000000180), 0x2, 0x0) r2 = syz_io_uring_setup(0x65dd, &(0x7f00000001c0)={0x0, 0x0, 0x20, 0x2}, &(0x7f0000ffe000/0x1000)=nil, &(0x7f0000ffd000/0x1000)=nil, &(0x7f0000000240), &(0x7f0000000280)) syz_genetlink_get_family_id$mptcp(&(0x7f0000000300), r1) syz_io_uring_setup(0x20f8, &(0x7f0000000400)={0x0, 0x7677, 0x8, 0x3, 0x22f}, &(0x7f0000ffe000/0x2000)=nil, &(0x7f0000ffb000/0x2000)=nil, &(0x7f0000000480)=0x0, &(0x7f00000004c0)) r4 = openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000500)='./cgroup/syz1\x00', 0x200002, 0x0) syz_io_uring_submit(r3, 0x0, &(0x7f0000000580)=@IORING_OP_FILES_UPDATE={0x14, 0x4, 0x0, 0x0, 0x40, &(0x7f0000000540)=[r2, 0xffffffffffffffff, r4, r0, 0xffffffffffffffff], 0x5}, 0x3) io_uring_setup(0x2812, &(0x7f00000005c0)={0x0, 0x5e1b, 0x2, 0x3, 0x12f, 0x0, r2}) socket$inet6_tcp(0xa, 0x1, 0x0) openat$procfs(0xffffffffffffff9c, &(0x7f00000010c0)='/proc/crypto\x00', 0x0, 0x0) io_uring_setup(0x7c8f, &(0x7f0000001140)={0x0, 0xc240, 0x10, 0x3, 0x1c7, 0x0, r2}) 21:22:59 executing program 5: r0 = io_uring_setup(0x355e, &(0x7f0000000000)={0x0, 0x0, 0x20, 0x0, 0x1be}) r1 = syz_io_uring_setup(0x8fe, &(0x7f0000000080)={0x0, 0x0, 0x0, 0x0, 0x1b8}, &(0x7f0000ffb000/0x2000)=nil, &(0x7f0000ffb000/0x4000)=nil, &(0x7f0000000100), &(0x7f0000000140)=0x0) r3 = openat$hwrng(0xffffffffffffff9c, &(0x7f0000000180), 0x2, 0x0) r4 = syz_io_uring_setup(0x65dd, &(0x7f00000001c0)={0x0, 0x0, 0x0, 0x0, 0xdf}, &(0x7f0000ffe000/0x1000)=nil, &(0x7f0000ffd000/0x1000)=nil, &(0x7f0000000240), &(0x7f0000000280)) r5 = syz_genetlink_get_family_id$mptcp(&(0x7f0000000300), r3) sendmsg$MPTCP_PM_CMD_ADD_ADDR(r3, &(0x7f00000003c0)={&(0x7f00000002c0)={0x10, 0x0, 0x0, 0x10}, 0xc, &(0x7f0000000380)={&(0x7f0000000340)={0x24, r5, 0x300, 0x70bd26, 0x25dfdbfb, {}, [@MPTCP_PM_ATTR_SUBFLOWS={0x8, 0x3, 0x1}, @MPTCP_PM_ATTR_RCV_ADD_ADDRS={0x8, 0x2, 0x2}]}, 0x24}, 0x1, 0x0, 0x0, 0x20000004}, 0x8890) r6 = openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000500)='./cgroup/syz1\x00', 0x200002, 0x0) syz_io_uring_submit(0x0, r2, &(0x7f0000000580)=@IORING_OP_FILES_UPDATE={0x14, 0x4, 0x0, 0x0, 0x40, &(0x7f0000000540)=[r4, 0xffffffffffffffff, r6, r0, r1], 0x5}, 0x3) socket$inet6_tcp(0xa, 0x1, 0x0) openat$procfs(0xffffffffffffff9c, &(0x7f00000010c0)='/proc/crypto\x00', 0x0, 0x0) 21:22:59 executing program 7: openat$hwrng(0xffffffffffffff9c, &(0x7f0000000180), 0x2, 0x0) r0 = openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000500)='./cgroup/syz1\x00', 0x200002, 0x0) syz_io_uring_submit(0x0, 0x0, &(0x7f0000000580)=@IORING_OP_FILES_UPDATE={0x14, 0x4, 0x0, 0x0, 0x40, &(0x7f0000000540)=[0xffffffffffffffff, 0xffffffffffffffff, r0, 0xffffffffffffffff, 0xffffffffffffffff], 0x5}, 0x3) socket$inet6_tcp(0xa, 0x1, 0x0) 21:22:59 executing program 3: io_uring_setup(0x355e, &(0x7f0000000000)={0x0, 0x0, 0x20, 0x1, 0x1be}) syz_io_uring_setup(0x8fe, &(0x7f0000000080), &(0x7f0000ffb000/0x2000)=nil, &(0x7f0000ffb000/0x4000)=nil, &(0x7f0000000100), &(0x7f0000000140)) openat$hwrng(0xffffffffffffff9c, &(0x7f0000000180), 0x2, 0x0) syz_genetlink_get_family_id$mptcp(&(0x7f0000000300), 0xffffffffffffffff) openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000500)='./cgroup/syz1\x00', 0x200002, 0x0) syz_io_uring_submit(0x0, 0x0, 0x0, 0x3) io_uring_setup(0x2812, 0x0) socket$inet6_tcp(0xa, 0x1, 0x0) io_uring_setup(0x7c8f, &(0x7f0000001140)={0x0, 0xc240, 0x10, 0x3, 0x1c7}) 21:22:59 executing program 6: r0 = io_uring_setup(0x355e, &(0x7f0000000000)={0x0, 0x0, 0x20, 0x0, 0x1be}) r1 = syz_io_uring_setup(0x8fe, &(0x7f0000000080)={0x0, 0x1830, 0x0, 0x0, 0x0, 0x0, r0}, &(0x7f0000ffb000/0x2000)=nil, &(0x7f0000ffb000/0x4000)=nil, &(0x7f0000000100), &(0x7f0000000140)=0x0) r3 = openat$hwrng(0xffffffffffffff9c, &(0x7f0000000180), 0x2, 0x0) syz_genetlink_get_family_id$mptcp(&(0x7f0000000300), r3) sendmsg$MPTCP_PM_CMD_ADD_ADDR(r3, &(0x7f00000003c0)={&(0x7f00000002c0), 0xc, &(0x7f0000000380)={0x0}, 0x1, 0x0, 0x0, 0x20000004}, 0x8890) syz_io_uring_setup(0x20f8, &(0x7f0000000400)={0x0, 0x7677, 0x8, 0x3, 0x22f}, &(0x7f0000ffe000/0x2000)=nil, &(0x7f0000ffb000/0x2000)=nil, &(0x7f0000000480)=0x0, &(0x7f00000004c0)) r5 = openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000500)='./cgroup/syz1\x00', 0x200002, 0x0) syz_io_uring_submit(r4, r2, &(0x7f0000000580)=@IORING_OP_FILES_UPDATE={0x14, 0x4, 0x0, 0x0, 0x40, &(0x7f0000000540)=[0xffffffffffffffff, 0xffffffffffffffff, r5, r0, r1], 0x5}, 0x3) socket$inet6_tcp(0xa, 0x1, 0x0) openat$procfs(0xffffffffffffff9c, &(0x7f00000010c0)='/proc/crypto\x00', 0x0, 0x0) io_uring_setup(0x7c8f, &(0x7f0000001140)={0x0, 0xc240, 0x10, 0x3, 0x1c7}) 21:22:59 executing program 4: io_uring_setup(0x355e, &(0x7f0000000000)={0x0, 0x0, 0x20, 0x1, 0x1be}) syz_io_uring_setup(0x8fe, &(0x7f0000000080), &(0x7f0000ffb000/0x2000)=nil, &(0x7f0000ffb000/0x4000)=nil, &(0x7f0000000100), &(0x7f0000000140)) openat$hwrng(0xffffffffffffff9c, &(0x7f0000000180), 0x2, 0x0) syz_genetlink_get_family_id$mptcp(&(0x7f0000000300), 0xffffffffffffffff) openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000500)='./cgroup/syz1\x00', 0x200002, 0x0) syz_io_uring_submit(0x0, 0x0, 0x0, 0x0) socket$inet6_tcp(0xa, 0x1, 0x0) io_uring_setup(0x7c8f, &(0x7f0000001140)={0x0, 0xc240, 0x10, 0x3, 0x1c7}) 21:22:59 executing program 0: r0 = io_uring_setup(0x355e, &(0x7f0000000000)={0x0, 0x0, 0x20, 0x0, 0x1be}) syz_io_uring_setup(0x8fe, &(0x7f0000000080)={0x0, 0x1830, 0x0, 0x0, 0x0, 0x0, r0}, &(0x7f0000ffb000/0x2000)=nil, &(0x7f0000ffb000/0x4000)=nil, &(0x7f0000000100), &(0x7f0000000140)) r1 = openat$hwrng(0xffffffffffffff9c, &(0x7f0000000180), 0x2, 0x0) syz_genetlink_get_family_id$mptcp(&(0x7f0000000300), r1) sendmsg$MPTCP_PM_CMD_ADD_ADDR(r1, 0x0, 0x8890) syz_io_uring_setup(0x20f8, &(0x7f0000000400)={0x0, 0x7677, 0x8, 0x3, 0x22f}, &(0x7f0000ffe000/0x2000)=nil, &(0x7f0000ffb000/0x2000)=nil, &(0x7f0000000480), &(0x7f00000004c0)) openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000500)='./cgroup/syz1\x00', 0x200002, 0x0) socket$inet6_tcp(0xa, 0x1, 0x0) io_uring_setup(0x7c8f, &(0x7f0000001140)={0x0, 0xc240, 0x10, 0x3, 0x1c7}) 21:23:00 executing program 5: r0 = io_uring_setup(0x355e, &(0x7f0000000000)={0x0, 0x0, 0x20, 0x0, 0x1be}) r1 = syz_io_uring_setup(0x8fe, &(0x7f0000000080)={0x0, 0x0, 0x0, 0x0, 0x1b8}, &(0x7f0000ffb000/0x2000)=nil, &(0x7f0000ffb000/0x4000)=nil, &(0x7f0000000100), &(0x7f0000000140)=0x0) r3 = openat$hwrng(0xffffffffffffff9c, &(0x7f0000000180), 0x2, 0x0) r4 = syz_io_uring_setup(0x65dd, &(0x7f00000001c0)={0x0, 0x0, 0x0, 0x2}, &(0x7f0000ffe000/0x1000)=nil, &(0x7f0000ffd000/0x1000)=nil, &(0x7f0000000240), &(0x7f0000000280)) r5 = syz_genetlink_get_family_id$mptcp(&(0x7f0000000300), r3) sendmsg$MPTCP_PM_CMD_ADD_ADDR(r3, &(0x7f00000003c0)={&(0x7f00000002c0)={0x10, 0x0, 0x0, 0x10}, 0xc, &(0x7f0000000380)={&(0x7f0000000340)={0x24, r5, 0x300, 0x70bd26, 0x25dfdbfb, {}, [@MPTCP_PM_ATTR_SUBFLOWS={0x8, 0x3, 0x1}, @MPTCP_PM_ATTR_RCV_ADD_ADDRS={0x8, 0x2, 0x2}]}, 0x24}, 0x1, 0x0, 0x0, 0x20000004}, 0x8890) r6 = openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000500)='./cgroup/syz1\x00', 0x200002, 0x0) syz_io_uring_submit(0x0, r2, &(0x7f0000000580)=@IORING_OP_FILES_UPDATE={0x14, 0x4, 0x0, 0x0, 0x40, &(0x7f0000000540)=[r4, 0xffffffffffffffff, r6, r0, r1], 0x5}, 0x3) socket$inet6_tcp(0xa, 0x1, 0x0) openat$procfs(0xffffffffffffff9c, &(0x7f00000010c0)='/proc/crypto\x00', 0x0, 0x0) 21:23:00 executing program 2: r0 = io_uring_setup(0x355e, &(0x7f0000000000)={0x0, 0x0, 0x20, 0x0, 0x1be}) r1 = syz_io_uring_setup(0x8fe, &(0x7f0000000080)={0x0, 0x1830, 0x0, 0x0, 0x0, 0x0, r0}, &(0x7f0000ffb000/0x2000)=nil, &(0x7f0000ffb000/0x4000)=nil, &(0x7f0000000100), &(0x7f0000000140)=0x0) r3 = openat$hwrng(0xffffffffffffff9c, &(0x7f0000000180), 0x2, 0x0) syz_genetlink_get_family_id$mptcp(&(0x7f0000000300), r3) sendmsg$MPTCP_PM_CMD_ADD_ADDR(r3, &(0x7f00000003c0)={&(0x7f00000002c0), 0xc, &(0x7f0000000380)={0x0}, 0x1, 0x0, 0x0, 0x20000004}, 0x8890) syz_io_uring_setup(0x20f8, &(0x7f0000000400)={0x0, 0x7677, 0x8, 0x3, 0x22f}, &(0x7f0000ffe000/0x2000)=nil, &(0x7f0000ffb000/0x2000)=nil, &(0x7f0000000480)=0x0, &(0x7f00000004c0)) r5 = openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000500)='./cgroup/syz1\x00', 0x200002, 0x0) syz_io_uring_submit(r4, r2, &(0x7f0000000580)=@IORING_OP_FILES_UPDATE={0x14, 0x4, 0x0, 0x0, 0x40, &(0x7f0000000540)=[0xffffffffffffffff, 0xffffffffffffffff, r5, r0, r1], 0x5}, 0x3) socket$inet6_tcp(0xa, 0x1, 0x0) openat$procfs(0xffffffffffffff9c, &(0x7f00000010c0)='/proc/crypto\x00', 0x0, 0x0) io_uring_setup(0x7c8f, &(0x7f0000001140)={0x0, 0xc240, 0x10, 0x3, 0x1c7}) [ 709.634022] kmemleak: Found object by alias at 0x607f1a6398ac [ 709.634056] CPU: 0 UID: 0 PID: 8128 Comm: syz-executor.3 Tainted: G W 6.17.0-rc3-next-20250829 #1 PREEMPT(voluntary) [ 709.634088] Tainted: [W]=WARN [ 709.634095] Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.12.0-1 04/01/2014 [ 709.634107] Call Trace: [ 709.634114] [ 709.634122] dump_stack_lvl+0xca/0x120 [ 709.634160] __lookup_object+0x94/0xb0 [ 709.634188] delete_object_full+0x27/0x70 [ 709.634217] free_percpu+0x30/0x1160 [ 709.634245] ? arch_uprobe_clear_state+0x16/0x140 [ 709.634280] futex_hash_free+0x38/0xc0 [ 709.634303] mmput+0x2d3/0x390 [ 709.634336] do_exit+0x79d/0x2970 [ 709.634360] ? lock_release+0xc8/0x290 [ 709.634389] ? __pfx_do_exit+0x10/0x10 [ 709.634414] ? find_held_lock+0x2b/0x80 [ 709.634445] ? get_signal+0x835/0x2340 [ 709.634480] do_group_exit+0xd3/0x2a0 [ 709.634507] get_signal+0x2315/0x2340 [ 709.634547] ? __pfx_get_signal+0x10/0x10 [ 709.634576] ? do_futex+0x135/0x370 [ 709.634601] ? __pfx_do_futex+0x10/0x10 [ 709.634628] arch_do_signal_or_restart+0x80/0x790 [ 709.634659] ? __pfx_arch_do_signal_or_restart+0x10/0x10 [ 709.634688] ? __x64_sys_futex+0x1c9/0x4d0 [ 709.634710] ? __x64_sys_futex+0x1d2/0x4d0 [ 709.634737] ? __pfx___x64_sys_futex+0x10/0x10 [ 709.634759] ? lock_mm_and_find_vma+0xaa/0x6f0 [ 709.634782] ? xfd_validate_state+0x55/0x180 [ 709.634819] exit_to_user_mode_loop+0x8b/0x110 [ 709.634842] do_syscall_64+0x2f7/0x360 [ 709.634863] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 709.634883] RIP: 0033:0x7f1060a76b19 [ 709.634899] Code: Unable to access opcode bytes at 0x7f1060a76aef. [ 709.634908] RSP: 002b:00007f105dfec218 EFLAGS: 00000246 ORIG_RAX: 00000000000000ca [ 709.634928] RAX: fffffffffffffe00 RBX: 00007f1060b89f68 RCX: 00007f1060a76b19 [ 709.634942] RDX: 0000000000000000 RSI: 0000000000000080 RDI: 00007f1060b89f68 [ 709.634955] RBP: 00007f1060b89f60 R08: 0000000000000000 R09: 0000000000000000 [ 709.634967] R10: 0000000000000000 R11: 0000000000000246 R12: 00007f1060b89f6c [ 709.634980] R13: 00007ffed3f8b4af R14: 00007f105dfec300 R15: 0000000000022000 [ 709.635009] [ 709.635015] kmemleak: Object (percpu) 0x607f1a6398a8 (size 8): [ 709.635027] kmemleak: comm "syz-executor.5", pid 8141, jiffies 4295376486 [ 709.635039] kmemleak: min_count = 1 [ 709.635046] kmemleak: count = 0 [ 709.635053] kmemleak: flags = 0x21 [ 709.635059] kmemleak: checksum = 0 [ 709.635066] kmemleak: backtrace: [ 709.635072] pcpu_alloc_noprof+0x87a/0x1170 [ 709.635099] percpu_ref_init+0x37/0x400 [ 709.635129] io_uring_setup+0x44c/0x2000 [ 709.635148] __x64_sys_io_uring_setup+0xc8/0x170 [ 709.635168] do_syscall_64+0xbf/0x360 [ 709.635183] entry_SYSCALL_64_after_hwframe+0x77/0x7f 21:23:09 executing program 6: r0 = io_uring_setup(0x355e, &(0x7f0000000000)={0x0, 0x0, 0x20, 0x0, 0x1be}) r1 = syz_io_uring_setup(0x8fe, &(0x7f0000000080)={0x0, 0x1830, 0x0, 0x0, 0x0, 0x0, r0}, &(0x7f0000ffb000/0x2000)=nil, &(0x7f0000ffb000/0x4000)=nil, &(0x7f0000000100), &(0x7f0000000140)=0x0) r3 = openat$hwrng(0xffffffffffffff9c, &(0x7f0000000180), 0x2, 0x0) syz_genetlink_get_family_id$mptcp(&(0x7f0000000300), r3) sendmsg$MPTCP_PM_CMD_ADD_ADDR(r3, &(0x7f00000003c0)={&(0x7f00000002c0), 0xc, &(0x7f0000000380)={0x0}, 0x1, 0x0, 0x0, 0x20000004}, 0x8890) syz_io_uring_setup(0x20f8, &(0x7f0000000400)={0x0, 0x7677, 0x8, 0x3, 0x22f}, &(0x7f0000ffe000/0x2000)=nil, &(0x7f0000ffb000/0x2000)=nil, &(0x7f0000000480)=0x0, &(0x7f00000004c0)) r5 = openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000500)='./cgroup/syz1\x00', 0x200002, 0x0) syz_io_uring_submit(r4, r2, &(0x7f0000000580)=@IORING_OP_FILES_UPDATE={0x14, 0x4, 0x0, 0x0, 0x40, &(0x7f0000000540)=[0xffffffffffffffff, 0xffffffffffffffff, r5, r0, r1], 0x5}, 0x3) socket$inet6_tcp(0xa, 0x1, 0x0) openat$procfs(0xffffffffffffff9c, &(0x7f00000010c0)='/proc/crypto\x00', 0x0, 0x0) io_uring_setup(0x7c8f, &(0x7f0000001140)={0x0, 0xc240, 0x10, 0x3, 0x1c7}) 21:23:09 executing program 7: openat$hwrng(0xffffffffffffff9c, 0x0, 0x2, 0x0) r0 = openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000500)='./cgroup/syz1\x00', 0x200002, 0x0) syz_io_uring_submit(0x0, 0x0, &(0x7f0000000580)=@IORING_OP_FILES_UPDATE={0x14, 0x4, 0x0, 0x0, 0x40, &(0x7f0000000540)=[0xffffffffffffffff, 0xffffffffffffffff, r0, 0xffffffffffffffff, 0xffffffffffffffff], 0x5}, 0x3) socket$inet6_tcp(0xa, 0x1, 0x0) 21:23:09 executing program 5: r0 = io_uring_setup(0x355e, &(0x7f0000000000)={0x0, 0x0, 0x20, 0x0, 0x1be}) r1 = syz_io_uring_setup(0x8fe, &(0x7f0000000080)={0x0, 0x0, 0x0, 0x0, 0x1b8}, &(0x7f0000ffb000/0x2000)=nil, &(0x7f0000ffb000/0x4000)=nil, &(0x7f0000000100), &(0x7f0000000140)=0x0) r3 = openat$hwrng(0xffffffffffffff9c, &(0x7f0000000180), 0x2, 0x0) r4 = syz_io_uring_setup(0x65dd, &(0x7f00000001c0)={0x0, 0x0, 0x0, 0x2}, &(0x7f0000ffe000/0x1000)=nil, &(0x7f0000ffd000/0x1000)=nil, &(0x7f0000000240), &(0x7f0000000280)) r5 = syz_genetlink_get_family_id$mptcp(&(0x7f0000000300), r3) sendmsg$MPTCP_PM_CMD_ADD_ADDR(r3, &(0x7f00000003c0)={&(0x7f00000002c0)={0x10, 0x0, 0x0, 0x10}, 0xc, &(0x7f0000000380)={&(0x7f0000000340)={0x24, r5, 0x300, 0x70bd26, 0x25dfdbfb, {}, [@MPTCP_PM_ATTR_SUBFLOWS={0x8, 0x3, 0x1}, @MPTCP_PM_ATTR_RCV_ADD_ADDRS={0x8, 0x2, 0x2}]}, 0x24}, 0x1, 0x0, 0x0, 0x20000004}, 0x8890) r6 = openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000500)='./cgroup/syz1\x00', 0x200002, 0x0) syz_io_uring_submit(0x0, r2, &(0x7f0000000580)=@IORING_OP_FILES_UPDATE={0x14, 0x4, 0x0, 0x0, 0x40, &(0x7f0000000540)=[r4, 0xffffffffffffffff, r6, r0, r1], 0x5}, 0x3) socket$inet6_tcp(0xa, 0x1, 0x0) openat$procfs(0xffffffffffffff9c, &(0x7f00000010c0)='/proc/crypto\x00', 0x0, 0x0) 21:23:09 executing program 0: r0 = io_uring_setup(0x355e, &(0x7f0000000000)={0x0, 0x0, 0x20, 0x0, 0x1be}) syz_io_uring_setup(0x8fe, &(0x7f0000000080)={0x0, 0x1830, 0x0, 0x0, 0x0, 0x0, r0}, &(0x7f0000ffb000/0x2000)=nil, &(0x7f0000ffb000/0x4000)=nil, &(0x7f0000000100), &(0x7f0000000140)) r1 = openat$hwrng(0xffffffffffffff9c, &(0x7f0000000180), 0x2, 0x0) syz_genetlink_get_family_id$mptcp(&(0x7f0000000300), r1) sendmsg$MPTCP_PM_CMD_ADD_ADDR(r1, 0x0, 0x8890) syz_io_uring_setup(0x20f8, &(0x7f0000000400)={0x0, 0x7677, 0x8, 0x3, 0x22f}, &(0x7f0000ffe000/0x2000)=nil, &(0x7f0000ffb000/0x2000)=nil, &(0x7f0000000480), &(0x7f00000004c0)) openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000500)='./cgroup/syz1\x00', 0x200002, 0x0) socket$inet6_tcp(0xa, 0x1, 0x0) io_uring_setup(0x7c8f, &(0x7f0000001140)={0x0, 0xc240, 0x10, 0x3, 0x1c7}) 21:23:09 executing program 4: io_uring_setup(0x355e, &(0x7f0000000000)={0x0, 0x0, 0x20, 0x1, 0x1be}) syz_io_uring_setup(0x8fe, &(0x7f0000000080), &(0x7f0000ffb000/0x2000)=nil, &(0x7f0000ffb000/0x4000)=nil, &(0x7f0000000100), &(0x7f0000000140)) openat$hwrng(0xffffffffffffff9c, &(0x7f0000000180), 0x2, 0x0) syz_genetlink_get_family_id$mptcp(&(0x7f0000000300), 0xffffffffffffffff) openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000500)='./cgroup/syz1\x00', 0x200002, 0x0) syz_io_uring_submit(0x0, 0x0, 0x0, 0x0) socket$inet6_tcp(0xa, 0x1, 0x0) io_uring_setup(0x7c8f, &(0x7f0000001140)={0x0, 0xc240, 0x10, 0x3, 0x1c7}) 21:23:09 executing program 3: io_uring_setup(0x355e, &(0x7f0000000000)={0x0, 0x0, 0x20, 0x1, 0x1be}) syz_io_uring_setup(0x8fe, &(0x7f0000000080), &(0x7f0000ffb000/0x2000)=nil, &(0x7f0000ffb000/0x4000)=nil, &(0x7f0000000100), &(0x7f0000000140)) openat$hwrng(0xffffffffffffff9c, &(0x7f0000000180), 0x2, 0x0) syz_genetlink_get_family_id$mptcp(&(0x7f0000000300), 0xffffffffffffffff) openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000500)='./cgroup/syz1\x00', 0x200002, 0x0) syz_io_uring_submit(0x0, 0x0, 0x0, 0x3) io_uring_setup(0x2812, 0x0) socket$inet6_tcp(0xa, 0x1, 0x0) io_uring_setup(0x7c8f, &(0x7f0000001140)={0x0, 0xc240, 0x10, 0x3, 0x1c7}) 21:23:09 executing program 1: r0 = io_uring_setup(0x355e, &(0x7f0000000000)={0x0, 0x0, 0x20, 0x1, 0x1be}) r1 = openat$hwrng(0xffffffffffffff9c, &(0x7f0000000180), 0x2, 0x0) r2 = syz_io_uring_setup(0x65dd, &(0x7f00000001c0)={0x0, 0x0, 0x20, 0x2}, &(0x7f0000ffe000/0x1000)=nil, &(0x7f0000ffd000/0x1000)=nil, &(0x7f0000000240), &(0x7f0000000280)) syz_genetlink_get_family_id$mptcp(&(0x7f0000000300), r1) syz_io_uring_setup(0x20f8, &(0x7f0000000400)={0x0, 0x7677, 0x8, 0x3, 0x22f}, &(0x7f0000ffe000/0x2000)=nil, &(0x7f0000ffb000/0x2000)=nil, &(0x7f0000000480)=0x0, &(0x7f00000004c0)) r4 = openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000500)='./cgroup/syz1\x00', 0x200002, 0x0) syz_io_uring_submit(r3, 0x0, &(0x7f0000000580)=@IORING_OP_FILES_UPDATE={0x14, 0x4, 0x0, 0x0, 0x40, &(0x7f0000000540)=[r2, 0xffffffffffffffff, r4, r0, 0xffffffffffffffff], 0x5}, 0x3) io_uring_setup(0x2812, &(0x7f00000005c0)={0x0, 0x5e1b, 0x2, 0x3, 0x12f, 0x0, r2}) socket$inet6_tcp(0xa, 0x1, 0x0) openat$procfs(0xffffffffffffff9c, &(0x7f00000010c0)='/proc/crypto\x00', 0x0, 0x0) io_uring_setup(0x7c8f, &(0x7f0000001140)={0x0, 0xc240, 0x10, 0x3, 0x1c7, 0x0, r2}) 21:23:09 executing program 2: r0 = io_uring_setup(0x355e, &(0x7f0000000000)={0x0, 0x0, 0x20, 0x0, 0x1be}) r1 = syz_io_uring_setup(0x8fe, &(0x7f0000000080)={0x0, 0x1830, 0x0, 0x0, 0x0, 0x0, r0}, &(0x7f0000ffb000/0x2000)=nil, &(0x7f0000ffb000/0x4000)=nil, &(0x7f0000000100), &(0x7f0000000140)=0x0) r3 = openat$hwrng(0xffffffffffffff9c, &(0x7f0000000180), 0x2, 0x0) syz_genetlink_get_family_id$mptcp(&(0x7f0000000300), r3) sendmsg$MPTCP_PM_CMD_ADD_ADDR(r3, &(0x7f00000003c0)={&(0x7f00000002c0), 0xc, &(0x7f0000000380)={0x0}, 0x1, 0x0, 0x0, 0x20000004}, 0x8890) syz_io_uring_setup(0x20f8, &(0x7f0000000400)={0x0, 0x7677, 0x8, 0x3, 0x22f}, &(0x7f0000ffe000/0x2000)=nil, &(0x7f0000ffb000/0x2000)=nil, &(0x7f0000000480)=0x0, &(0x7f00000004c0)) r5 = openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000500)='./cgroup/syz1\x00', 0x200002, 0x0) syz_io_uring_submit(r4, r2, &(0x7f0000000580)=@IORING_OP_FILES_UPDATE={0x14, 0x4, 0x0, 0x0, 0x40, &(0x7f0000000540)=[0xffffffffffffffff, 0xffffffffffffffff, r5, r0, r1], 0x5}, 0x3) socket$inet6_tcp(0xa, 0x1, 0x0) openat$procfs(0xffffffffffffff9c, &(0x7f00000010c0)='/proc/crypto\x00', 0x0, 0x0) io_uring_setup(0x7c8f, &(0x7f0000001140)={0x0, 0xc240, 0x10, 0x3, 0x1c7}) 21:23:10 executing program 7: openat$hwrng(0xffffffffffffff9c, 0x0, 0x0, 0x0) r0 = openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000500)='./cgroup/syz1\x00', 0x200002, 0x0) syz_io_uring_submit(0x0, 0x0, &(0x7f0000000580)=@IORING_OP_FILES_UPDATE={0x14, 0x4, 0x0, 0x0, 0x40, &(0x7f0000000540)=[0xffffffffffffffff, 0xffffffffffffffff, r0, 0xffffffffffffffff, 0xffffffffffffffff], 0x5}, 0x3) socket$inet6_tcp(0xa, 0x1, 0x0) 21:23:10 executing program 0: r0 = io_uring_setup(0x355e, &(0x7f0000000000)={0x0, 0x0, 0x20, 0x0, 0x1be}) r1 = syz_io_uring_setup(0x8fe, &(0x7f0000000080)={0x0, 0x1830, 0x0, 0x0, 0x0, 0x0, r0}, &(0x7f0000ffb000/0x2000)=nil, &(0x7f0000ffb000/0x4000)=nil, &(0x7f0000000100), &(0x7f0000000140)=0x0) r3 = openat$hwrng(0xffffffffffffff9c, &(0x7f0000000180), 0x2, 0x0) syz_genetlink_get_family_id$mptcp(&(0x7f0000000300), r3) sendmsg$MPTCP_PM_CMD_ADD_ADDR(r3, 0x0, 0x8890) syz_io_uring_setup(0x20f8, &(0x7f0000000400)={0x0, 0x7677, 0x8, 0x3, 0x22f}, &(0x7f0000ffe000/0x2000)=nil, &(0x7f0000ffb000/0x2000)=nil, &(0x7f0000000480)=0x0, &(0x7f00000004c0)) syz_io_uring_submit(r4, r2, &(0x7f0000000580)=@IORING_OP_FILES_UPDATE={0x14, 0x4, 0x0, 0x0, 0x40, &(0x7f0000000540)=[0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, r0, r1], 0x5}, 0x3) socket$inet6_tcp(0xa, 0x1, 0x0) io_uring_setup(0x7c8f, &(0x7f0000001140)={0x0, 0xc240, 0x10, 0x3, 0x1c7}) 21:23:10 executing program 2: r0 = io_uring_setup(0x355e, &(0x7f0000000000)={0x0, 0x0, 0x20, 0x0, 0x1be}) r1 = syz_io_uring_setup(0x8fe, &(0x7f0000000080)={0x0, 0x1830, 0x0, 0x0, 0x0, 0x0, r0}, &(0x7f0000ffb000/0x2000)=nil, &(0x7f0000ffb000/0x4000)=nil, &(0x7f0000000100), &(0x7f0000000140)=0x0) r3 = openat$hwrng(0xffffffffffffff9c, &(0x7f0000000180), 0x2, 0x0) syz_genetlink_get_family_id$mptcp(&(0x7f0000000300), r3) sendmsg$MPTCP_PM_CMD_ADD_ADDR(r3, &(0x7f00000003c0)={&(0x7f00000002c0), 0xc, &(0x7f0000000380)={0x0}, 0x1, 0x0, 0x0, 0x20000004}, 0x8890) syz_io_uring_setup(0x20f8, &(0x7f0000000400)={0x0, 0x7677, 0x8, 0x3, 0x22f}, &(0x7f0000ffe000/0x2000)=nil, &(0x7f0000ffb000/0x2000)=nil, &(0x7f0000000480)=0x0, &(0x7f00000004c0)) r5 = openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000500)='./cgroup/syz1\x00', 0x200002, 0x0) syz_io_uring_submit(r4, r2, &(0x7f0000000580)=@IORING_OP_FILES_UPDATE={0x14, 0x4, 0x0, 0x0, 0x40, &(0x7f0000000540)=[0xffffffffffffffff, 0xffffffffffffffff, r5, r0, r1], 0x5}, 0x3) socket$inet6_tcp(0xa, 0x1, 0x0) openat$procfs(0xffffffffffffff9c, &(0x7f00000010c0)='/proc/crypto\x00', 0x0, 0x0) io_uring_setup(0x7c8f, &(0x7f0000001140)={0x0, 0xc240, 0x10, 0x3, 0x1c7}) 21:23:10 executing program 5: r0 = io_uring_setup(0x355e, &(0x7f0000000000)={0x0, 0x0, 0x20, 0x0, 0x1be}) r1 = syz_io_uring_setup(0x8fe, &(0x7f0000000080)={0x0, 0x0, 0x0, 0x0, 0x1b8}, &(0x7f0000ffb000/0x2000)=nil, &(0x7f0000ffb000/0x4000)=nil, &(0x7f0000000100), &(0x7f0000000140)=0x0) r3 = openat$hwrng(0xffffffffffffff9c, &(0x7f0000000180), 0x2, 0x0) r4 = syz_io_uring_setup(0x65dd, &(0x7f00000001c0)={0x0, 0x0, 0x0, 0x2}, &(0x7f0000ffe000/0x1000)=nil, &(0x7f0000ffd000/0x1000)=nil, &(0x7f0000000240), &(0x7f0000000280)) r5 = syz_genetlink_get_family_id$mptcp(&(0x7f0000000300), r3) sendmsg$MPTCP_PM_CMD_ADD_ADDR(r3, &(0x7f00000003c0)={&(0x7f00000002c0)={0x10, 0x0, 0x0, 0x10}, 0xc, &(0x7f0000000380)={&(0x7f0000000340)={0x24, r5, 0x300, 0x70bd26, 0x25dfdbfb, {}, [@MPTCP_PM_ATTR_SUBFLOWS={0x8, 0x3, 0x1}, @MPTCP_PM_ATTR_RCV_ADD_ADDRS={0x8, 0x2, 0x2}]}, 0x24}, 0x1, 0x0, 0x0, 0x20000004}, 0x8890) r6 = openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000500)='./cgroup/syz1\x00', 0x200002, 0x0) syz_io_uring_submit(0x0, r2, &(0x7f0000000580)=@IORING_OP_FILES_UPDATE={0x14, 0x4, 0x0, 0x0, 0x40, &(0x7f0000000540)=[r4, 0xffffffffffffffff, r6, r0, r1], 0x5}, 0x3) socket$inet6_tcp(0xa, 0x1, 0x0) openat$procfs(0xffffffffffffff9c, &(0x7f00000010c0)='/proc/crypto\x00', 0x0, 0x0) 21:23:10 executing program 6: r0 = io_uring_setup(0x355e, &(0x7f0000000000)={0x0, 0x0, 0x20, 0x0, 0x1be}) r1 = syz_io_uring_setup(0x8fe, &(0x7f0000000080)={0x0, 0x1830, 0x0, 0x0, 0x0, 0x0, r0}, &(0x7f0000ffb000/0x2000)=nil, &(0x7f0000ffb000/0x4000)=nil, &(0x7f0000000100), &(0x7f0000000140)=0x0) r3 = openat$hwrng(0xffffffffffffff9c, &(0x7f0000000180), 0x2, 0x0) syz_genetlink_get_family_id$mptcp(&(0x7f0000000300), r3) sendmsg$MPTCP_PM_CMD_ADD_ADDR(r3, &(0x7f00000003c0)={&(0x7f00000002c0), 0xc, &(0x7f0000000380)={&(0x7f0000000340)={0x24, 0x0, 0x300, 0x70bd26, 0x25dfdbfb, {}, [@MPTCP_PM_ATTR_SUBFLOWS={0x8, 0x3, 0x1}, @MPTCP_PM_ATTR_RCV_ADD_ADDRS={0x8, 0x2, 0x2}]}, 0x24}, 0x1, 0x0, 0x0, 0x20000004}, 0x8890) syz_io_uring_setup(0x20f8, &(0x7f0000000400)={0x0, 0x7677, 0x8, 0x3, 0x22f}, &(0x7f0000ffe000/0x2000)=nil, &(0x7f0000ffb000/0x2000)=nil, &(0x7f0000000480)=0x0, &(0x7f00000004c0)) r5 = openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000500)='./cgroup/syz1\x00', 0x200002, 0x0) syz_io_uring_submit(r4, r2, &(0x7f0000000580)=@IORING_OP_FILES_UPDATE={0x14, 0x4, 0x0, 0x0, 0x40, &(0x7f0000000540)=[0xffffffffffffffff, 0xffffffffffffffff, r5, r0, r1], 0x5}, 0x3) socket$inet6_tcp(0xa, 0x1, 0x0) openat$procfs(0xffffffffffffff9c, &(0x7f00000010c0)='/proc/crypto\x00', 0x0, 0x0) io_uring_setup(0x7c8f, &(0x7f0000001140)={0x0, 0xc240, 0x10, 0x3, 0x1c7}) 21:23:10 executing program 1: r0 = io_uring_setup(0x355e, &(0x7f0000000000)={0x0, 0x0, 0x20, 0x1, 0x1be}) r1 = openat$hwrng(0xffffffffffffff9c, &(0x7f0000000180), 0x2, 0x0) r2 = syz_io_uring_setup(0x65dd, &(0x7f00000001c0)={0x0, 0x0, 0x20, 0x2}, &(0x7f0000ffe000/0x1000)=nil, &(0x7f0000ffd000/0x1000)=nil, &(0x7f0000000240), &(0x7f0000000280)) syz_genetlink_get_family_id$mptcp(&(0x7f0000000300), r1) syz_io_uring_setup(0x20f8, &(0x7f0000000400)={0x0, 0x7677, 0x8, 0x3, 0x22f, 0x0, r2}, &(0x7f0000ffe000/0x2000)=nil, &(0x7f0000ffb000/0x2000)=nil, 0x0, &(0x7f00000004c0)) r3 = openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000500)='./cgroup/syz1\x00', 0x200002, 0x0) syz_io_uring_submit(0x0, 0x0, &(0x7f0000000580)=@IORING_OP_FILES_UPDATE={0x14, 0x4, 0x0, 0x0, 0x40, &(0x7f0000000540)=[r2, 0xffffffffffffffff, r3, r0, 0xffffffffffffffff], 0x5}, 0x3) io_uring_setup(0x2812, &(0x7f00000005c0)={0x0, 0x5e1b, 0x2, 0x3, 0x12f, 0x0, r2}) socket$inet6_tcp(0xa, 0x1, 0x0) openat$procfs(0xffffffffffffff9c, &(0x7f00000010c0)='/proc/crypto\x00', 0x0, 0x0) io_uring_setup(0x7c8f, &(0x7f0000001140)={0x0, 0xc240, 0x10, 0x3, 0x1c7, 0x0, r2}) 21:23:10 executing program 4: io_uring_setup(0x355e, &(0x7f0000000000)={0x0, 0x0, 0x20, 0x1, 0x1be}) syz_io_uring_setup(0x8fe, &(0x7f0000000080), &(0x7f0000ffb000/0x2000)=nil, &(0x7f0000ffb000/0x4000)=nil, &(0x7f0000000100), &(0x7f0000000140)) openat$hwrng(0xffffffffffffff9c, &(0x7f0000000180), 0x2, 0x0) syz_genetlink_get_family_id$mptcp(&(0x7f0000000300), 0xffffffffffffffff) openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000500)='./cgroup/syz1\x00', 0x200002, 0x0) syz_io_uring_submit(0x0, 0x0, 0x0, 0x0) socket$inet6_tcp(0xa, 0x1, 0x0) io_uring_setup(0x7c8f, &(0x7f0000001140)={0x0, 0xc240, 0x10, 0x3, 0x1c7}) 21:23:10 executing program 3: io_uring_setup(0x355e, &(0x7f0000000000)={0x0, 0x0, 0x20, 0x1, 0x1be}) syz_io_uring_setup(0x8fe, &(0x7f0000000080), &(0x7f0000ffb000/0x2000)=nil, &(0x7f0000ffb000/0x4000)=nil, &(0x7f0000000100), &(0x7f0000000140)) openat$hwrng(0xffffffffffffff9c, &(0x7f0000000180), 0x2, 0x0) syz_genetlink_get_family_id$mptcp(&(0x7f0000000300), 0xffffffffffffffff) openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000500)='./cgroup/syz1\x00', 0x200002, 0x0) syz_io_uring_submit(0x0, 0x0, 0x0, 0x3) io_uring_setup(0x2812, &(0x7f00000005c0)={0x0, 0x0, 0x2, 0x3, 0x12f}) socket$inet6_tcp(0xa, 0x1, 0x0) io_uring_setup(0x7c8f, &(0x7f0000001140)={0x0, 0xc240, 0x10, 0x3, 0x1c7}) 21:23:10 executing program 7: openat$hwrng(0xffffffffffffff9c, 0x0, 0x0, 0x0) r0 = openat$cgroup_root(0xffffffffffffff9c, 0x0, 0x200002, 0x0) syz_io_uring_submit(0x0, 0x0, &(0x7f0000000580)=@IORING_OP_FILES_UPDATE={0x14, 0x4, 0x0, 0x0, 0x40, &(0x7f0000000540)=[0xffffffffffffffff, 0xffffffffffffffff, r0, 0xffffffffffffffff, 0xffffffffffffffff], 0x5}, 0x3) socket$inet6_tcp(0xa, 0x1, 0x0) 21:23:10 executing program 7: openat$hwrng(0xffffffffffffff9c, 0x0, 0x0, 0x0) openat$cgroup_root(0xffffffffffffff9c, 0x0, 0x200002, 0x0) syz_io_uring_submit(0x0, 0x0, 0x0, 0x3) socket$inet6_tcp(0xa, 0x1, 0x0) 21:23:10 executing program 2: r0 = io_uring_setup(0x355e, &(0x7f0000000000)={0x0, 0x0, 0x20, 0x0, 0x1be}) r1 = syz_io_uring_setup(0x8fe, &(0x7f0000000080)={0x0, 0x1830, 0x0, 0x0, 0x0, 0x0, r0}, &(0x7f0000ffb000/0x2000)=nil, &(0x7f0000ffb000/0x4000)=nil, &(0x7f0000000100), &(0x7f0000000140)=0x0) r3 = openat$hwrng(0xffffffffffffff9c, &(0x7f0000000180), 0x2, 0x0) syz_genetlink_get_family_id$mptcp(&(0x7f0000000300), r3) sendmsg$MPTCP_PM_CMD_ADD_ADDR(r3, &(0x7f00000003c0)={&(0x7f00000002c0), 0xc, &(0x7f0000000380)={0x0}, 0x1, 0x0, 0x0, 0x20000004}, 0x8890) syz_io_uring_setup(0x20f8, &(0x7f0000000400)={0x0, 0x7677, 0x8, 0x3, 0x22f}, &(0x7f0000ffe000/0x2000)=nil, &(0x7f0000ffb000/0x2000)=nil, &(0x7f0000000480)=0x0, &(0x7f00000004c0)) r5 = openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000500)='./cgroup/syz1\x00', 0x200002, 0x0) syz_io_uring_submit(r4, r2, &(0x7f0000000580)=@IORING_OP_FILES_UPDATE={0x14, 0x4, 0x0, 0x0, 0x40, &(0x7f0000000540)=[0xffffffffffffffff, 0xffffffffffffffff, r5, r0, r1], 0x5}, 0x3) socket$inet6_tcp(0xa, 0x1, 0x0) openat$procfs(0xffffffffffffff9c, &(0x7f00000010c0)='/proc/crypto\x00', 0x0, 0x0) 21:23:26 executing program 4: io_uring_setup(0x355e, &(0x7f0000000000)={0x0, 0x0, 0x20, 0x1, 0x1be}) syz_io_uring_setup(0x8fe, &(0x7f0000000080), &(0x7f0000ffb000/0x2000)=nil, &(0x7f0000ffb000/0x4000)=nil, &(0x7f0000000100), &(0x7f0000000140)) openat$hwrng(0xffffffffffffff9c, &(0x7f0000000180), 0x2, 0x0) syz_genetlink_get_family_id$mptcp(&(0x7f0000000300), 0xffffffffffffffff) openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000500)='./cgroup/syz1\x00', 0x200002, 0x0) io_uring_setup(0x2812, &(0x7f00000005c0)={0x0, 0x5e1b, 0x2, 0x3, 0x12f}) socket$inet6_tcp(0xa, 0x1, 0x0) io_uring_setup(0x7c8f, &(0x7f0000001140)={0x0, 0xc240, 0x10, 0x3, 0x1c7}) 21:23:26 executing program 2: r0 = io_uring_setup(0x355e, &(0x7f0000000000)={0x0, 0x0, 0x20, 0x0, 0x1be}) r1 = syz_io_uring_setup(0x8fe, &(0x7f0000000080)={0x0, 0x1830, 0x0, 0x0, 0x0, 0x0, r0}, &(0x7f0000ffb000/0x2000)=nil, &(0x7f0000ffb000/0x4000)=nil, &(0x7f0000000100), &(0x7f0000000140)=0x0) r3 = openat$hwrng(0xffffffffffffff9c, &(0x7f0000000180), 0x2, 0x0) syz_genetlink_get_family_id$mptcp(&(0x7f0000000300), r3) sendmsg$MPTCP_PM_CMD_ADD_ADDR(r3, &(0x7f00000003c0)={&(0x7f00000002c0), 0xc, &(0x7f0000000380)={0x0}, 0x1, 0x0, 0x0, 0x20000004}, 0x8890) syz_io_uring_setup(0x20f8, &(0x7f0000000400)={0x0, 0x7677, 0x8, 0x3, 0x22f}, &(0x7f0000ffe000/0x2000)=nil, &(0x7f0000ffb000/0x2000)=nil, &(0x7f0000000480)=0x0, &(0x7f00000004c0)) r5 = openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000500)='./cgroup/syz1\x00', 0x200002, 0x0) syz_io_uring_submit(r4, r2, &(0x7f0000000580)=@IORING_OP_FILES_UPDATE={0x14, 0x4, 0x0, 0x0, 0x40, &(0x7f0000000540)=[0xffffffffffffffff, 0xffffffffffffffff, r5, r0, r1], 0x5}, 0x3) socket$inet6_tcp(0xa, 0x1, 0x0) openat$procfs(0xffffffffffffff9c, &(0x7f00000010c0)='/proc/crypto\x00', 0x0, 0x0) 21:23:26 executing program 3: io_uring_setup(0x355e, &(0x7f0000000000)={0x0, 0x0, 0x20, 0x1, 0x1be}) syz_io_uring_setup(0x8fe, &(0x7f0000000080), &(0x7f0000ffb000/0x2000)=nil, &(0x7f0000ffb000/0x4000)=nil, &(0x7f0000000100), &(0x7f0000000140)) openat$hwrng(0xffffffffffffff9c, &(0x7f0000000180), 0x2, 0x0) syz_genetlink_get_family_id$mptcp(&(0x7f0000000300), 0xffffffffffffffff) openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000500)='./cgroup/syz1\x00', 0x200002, 0x0) syz_io_uring_submit(0x0, 0x0, 0x0, 0x3) io_uring_setup(0x2812, &(0x7f00000005c0)={0x0, 0x0, 0x2, 0x3, 0x12f}) socket$inet6_tcp(0xa, 0x1, 0x0) io_uring_setup(0x7c8f, &(0x7f0000001140)={0x0, 0xc240, 0x10, 0x3, 0x1c7}) 21:23:26 executing program 0: r0 = io_uring_setup(0x355e, &(0x7f0000000000)={0x0, 0x0, 0x20, 0x0, 0x1be}) r1 = syz_io_uring_setup(0x8fe, &(0x7f0000000080)={0x0, 0x1830, 0x0, 0x0, 0x0, 0x0, r0}, &(0x7f0000ffb000/0x2000)=nil, &(0x7f0000ffb000/0x4000)=nil, &(0x7f0000000100), &(0x7f0000000140)=0x0) r3 = openat$hwrng(0xffffffffffffff9c, &(0x7f0000000180), 0x2, 0x0) syz_genetlink_get_family_id$mptcp(&(0x7f0000000300), r3) sendmsg$MPTCP_PM_CMD_ADD_ADDR(r3, 0x0, 0x8890) syz_io_uring_submit(0x0, r2, &(0x7f0000000580)=@IORING_OP_FILES_UPDATE={0x14, 0x4, 0x0, 0x0, 0x40, &(0x7f0000000540)=[0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, r0, r1], 0x5}, 0x3) socket$inet6_tcp(0xa, 0x1, 0x0) io_uring_setup(0x7c8f, &(0x7f0000001140)={0x0, 0xc240, 0x10, 0x3, 0x1c7}) 21:23:26 executing program 6: r0 = io_uring_setup(0x355e, &(0x7f0000000000)={0x0, 0x0, 0x20, 0x0, 0x1be}) r1 = syz_io_uring_setup(0x8fe, &(0x7f0000000080)={0x0, 0x1830, 0x0, 0x0, 0x0, 0x0, r0}, &(0x7f0000ffb000/0x2000)=nil, &(0x7f0000ffb000/0x4000)=nil, &(0x7f0000000100), &(0x7f0000000140)=0x0) r3 = openat$hwrng(0xffffffffffffff9c, &(0x7f0000000180), 0x2, 0x0) syz_genetlink_get_family_id$mptcp(&(0x7f0000000300), r3) sendmsg$MPTCP_PM_CMD_ADD_ADDR(r3, &(0x7f00000003c0)={&(0x7f00000002c0), 0xc, &(0x7f0000000380)={&(0x7f0000000340)={0x24, 0x0, 0x300, 0x70bd26, 0x25dfdbfb, {}, [@MPTCP_PM_ATTR_SUBFLOWS={0x8, 0x3, 0x1}, @MPTCP_PM_ATTR_RCV_ADD_ADDRS={0x8, 0x2, 0x2}]}, 0x24}, 0x1, 0x0, 0x0, 0x20000004}, 0x8890) syz_io_uring_setup(0x20f8, &(0x7f0000000400)={0x0, 0x7677, 0x8, 0x3, 0x22f}, &(0x7f0000ffe000/0x2000)=nil, &(0x7f0000ffb000/0x2000)=nil, &(0x7f0000000480)=0x0, &(0x7f00000004c0)) r5 = openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000500)='./cgroup/syz1\x00', 0x200002, 0x0) syz_io_uring_submit(r4, r2, &(0x7f0000000580)=@IORING_OP_FILES_UPDATE={0x14, 0x4, 0x0, 0x0, 0x40, &(0x7f0000000540)=[0xffffffffffffffff, 0xffffffffffffffff, r5, r0, r1], 0x5}, 0x3) socket$inet6_tcp(0xa, 0x1, 0x0) openat$procfs(0xffffffffffffff9c, &(0x7f00000010c0)='/proc/crypto\x00', 0x0, 0x0) io_uring_setup(0x7c8f, &(0x7f0000001140)={0x0, 0xc240, 0x10, 0x3, 0x1c7}) 21:23:26 executing program 1: r0 = io_uring_setup(0x355e, &(0x7f0000000000)={0x0, 0x0, 0x20, 0x1, 0x1be}) r1 = openat$hwrng(0xffffffffffffff9c, &(0x7f0000000180), 0x2, 0x0) r2 = syz_io_uring_setup(0x65dd, &(0x7f00000001c0)={0x0, 0x0, 0x20, 0x2}, &(0x7f0000ffe000/0x1000)=nil, &(0x7f0000ffd000/0x1000)=nil, &(0x7f0000000240), &(0x7f0000000280)) syz_genetlink_get_family_id$mptcp(&(0x7f0000000300), r1) syz_io_uring_setup(0x20f8, &(0x7f0000000400)={0x0, 0x7677, 0x8, 0x3, 0x22f, 0x0, r2}, &(0x7f0000ffe000/0x2000)=nil, &(0x7f0000ffb000/0x2000)=nil, 0x0, &(0x7f00000004c0)) r3 = openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000500)='./cgroup/syz1\x00', 0x200002, 0x0) syz_io_uring_submit(0x0, 0x0, &(0x7f0000000580)=@IORING_OP_FILES_UPDATE={0x14, 0x4, 0x0, 0x0, 0x40, &(0x7f0000000540)=[r2, 0xffffffffffffffff, r3, r0, 0xffffffffffffffff], 0x5}, 0x3) io_uring_setup(0x2812, &(0x7f00000005c0)={0x0, 0x5e1b, 0x2, 0x3, 0x12f, 0x0, r2}) socket$inet6_tcp(0xa, 0x1, 0x0) openat$procfs(0xffffffffffffff9c, &(0x7f00000010c0)='/proc/crypto\x00', 0x0, 0x0) io_uring_setup(0x7c8f, &(0x7f0000001140)={0x0, 0xc240, 0x10, 0x3, 0x1c7, 0x0, r2}) 21:23:26 executing program 7: openat$hwrng(0xffffffffffffff9c, 0x0, 0x0, 0x0) openat$cgroup_root(0xffffffffffffff9c, 0x0, 0x200002, 0x0) syz_io_uring_submit(0x0, 0x0, 0x0, 0x0) socket$inet6_tcp(0xa, 0x1, 0x0) 21:23:26 executing program 5: r0 = io_uring_setup(0x355e, &(0x7f0000000000)={0x0, 0x0, 0x20, 0x0, 0x1be}) r1 = syz_io_uring_setup(0x8fe, &(0x7f0000000080)={0x0, 0x0, 0x0, 0x0, 0x1b8}, &(0x7f0000ffb000/0x2000)=nil, &(0x7f0000ffb000/0x4000)=nil, &(0x7f0000000100), &(0x7f0000000140)=0x0) r3 = openat$hwrng(0xffffffffffffff9c, &(0x7f0000000180), 0x2, 0x0) r4 = syz_io_uring_setup(0x65dd, &(0x7f00000001c0)={0x0, 0x0, 0x0, 0x2, 0xdf}, &(0x7f0000ffe000/0x1000)=nil, &(0x7f0000ffd000/0x1000)=nil, 0x0, &(0x7f0000000280)) r5 = syz_genetlink_get_family_id$mptcp(&(0x7f0000000300), r3) sendmsg$MPTCP_PM_CMD_ADD_ADDR(r3, &(0x7f00000003c0)={&(0x7f00000002c0)={0x10, 0x0, 0x0, 0x10}, 0xc, &(0x7f0000000380)={&(0x7f0000000340)={0x24, r5, 0x300, 0x70bd26, 0x25dfdbfb, {}, [@MPTCP_PM_ATTR_SUBFLOWS={0x8, 0x3, 0x1}, @MPTCP_PM_ATTR_RCV_ADD_ADDRS={0x8, 0x2, 0x2}]}, 0x24}, 0x1, 0x0, 0x0, 0x20000004}, 0x8890) r6 = openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000500)='./cgroup/syz1\x00', 0x200002, 0x0) syz_io_uring_submit(0x0, r2, &(0x7f0000000580)=@IORING_OP_FILES_UPDATE={0x14, 0x4, 0x0, 0x0, 0x40, &(0x7f0000000540)=[r4, 0xffffffffffffffff, r6, r0, r1], 0x5}, 0x3) socket$inet6_tcp(0xa, 0x1, 0x0) openat$procfs(0xffffffffffffff9c, &(0x7f00000010c0)='/proc/crypto\x00', 0x0, 0x0) 21:23:36 executing program 5: r0 = io_uring_setup(0x355e, &(0x7f0000000000)={0x0, 0x0, 0x20, 0x0, 0x1be}) r1 = syz_io_uring_setup(0x8fe, &(0x7f0000000080)={0x0, 0x0, 0x0, 0x0, 0x1b8}, &(0x7f0000ffb000/0x2000)=nil, &(0x7f0000ffb000/0x4000)=nil, &(0x7f0000000100), &(0x7f0000000140)=0x0) r3 = openat$hwrng(0xffffffffffffff9c, &(0x7f0000000180), 0x2, 0x0) r4 = syz_io_uring_setup(0x65dd, &(0x7f00000001c0)={0x0, 0x0, 0x0, 0x2, 0xdf}, &(0x7f0000ffe000/0x1000)=nil, &(0x7f0000ffd000/0x1000)=nil, 0x0, &(0x7f0000000280)) r5 = syz_genetlink_get_family_id$mptcp(&(0x7f0000000300), r3) sendmsg$MPTCP_PM_CMD_ADD_ADDR(r3, &(0x7f00000003c0)={&(0x7f00000002c0)={0x10, 0x0, 0x0, 0x10}, 0xc, &(0x7f0000000380)={&(0x7f0000000340)={0x24, r5, 0x300, 0x70bd26, 0x25dfdbfb, {}, [@MPTCP_PM_ATTR_SUBFLOWS={0x8, 0x3, 0x1}, @MPTCP_PM_ATTR_RCV_ADD_ADDRS={0x8, 0x2, 0x2}]}, 0x24}, 0x1, 0x0, 0x0, 0x20000004}, 0x8890) r6 = openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000500)='./cgroup/syz1\x00', 0x200002, 0x0) syz_io_uring_submit(0x0, r2, &(0x7f0000000580)=@IORING_OP_FILES_UPDATE={0x14, 0x4, 0x0, 0x0, 0x40, &(0x7f0000000540)=[r4, 0xffffffffffffffff, r6, r0, r1], 0x5}, 0x3) socket$inet6_tcp(0xa, 0x1, 0x0) openat$procfs(0xffffffffffffff9c, &(0x7f00000010c0)='/proc/crypto\x00', 0x0, 0x0) 21:23:36 executing program 2: r0 = io_uring_setup(0x355e, &(0x7f0000000000)={0x0, 0x0, 0x20, 0x0, 0x1be}) r1 = syz_io_uring_setup(0x8fe, &(0x7f0000000080)={0x0, 0x1830, 0x0, 0x0, 0x0, 0x0, r0}, &(0x7f0000ffb000/0x2000)=nil, &(0x7f0000ffb000/0x4000)=nil, &(0x7f0000000100), &(0x7f0000000140)=0x0) r3 = openat$hwrng(0xffffffffffffff9c, &(0x7f0000000180), 0x2, 0x0) syz_genetlink_get_family_id$mptcp(&(0x7f0000000300), r3) sendmsg$MPTCP_PM_CMD_ADD_ADDR(r3, &(0x7f00000003c0)={&(0x7f00000002c0), 0xc, &(0x7f0000000380)={0x0}, 0x1, 0x0, 0x0, 0x20000004}, 0x8890) syz_io_uring_setup(0x20f8, &(0x7f0000000400)={0x0, 0x7677, 0x8, 0x3, 0x22f}, &(0x7f0000ffe000/0x2000)=nil, &(0x7f0000ffb000/0x2000)=nil, &(0x7f0000000480)=0x0, &(0x7f00000004c0)) r5 = openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000500)='./cgroup/syz1\x00', 0x200002, 0x0) syz_io_uring_submit(r4, r2, &(0x7f0000000580)=@IORING_OP_FILES_UPDATE={0x14, 0x4, 0x0, 0x0, 0x40, &(0x7f0000000540)=[0xffffffffffffffff, 0xffffffffffffffff, r5, r0, r1], 0x5}, 0x3) socket$inet6_tcp(0xa, 0x1, 0x0) 21:23:36 executing program 3: io_uring_setup(0x355e, &(0x7f0000000000)={0x0, 0x0, 0x20, 0x1, 0x1be}) syz_io_uring_setup(0x8fe, &(0x7f0000000080), &(0x7f0000ffb000/0x2000)=nil, &(0x7f0000ffb000/0x4000)=nil, &(0x7f0000000100), &(0x7f0000000140)) openat$hwrng(0xffffffffffffff9c, &(0x7f0000000180), 0x2, 0x0) syz_genetlink_get_family_id$mptcp(&(0x7f0000000300), 0xffffffffffffffff) openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000500)='./cgroup/syz1\x00', 0x200002, 0x0) syz_io_uring_submit(0x0, 0x0, 0x0, 0x3) io_uring_setup(0x2812, &(0x7f00000005c0)={0x0, 0x0, 0x0, 0x3, 0x12f}) socket$inet6_tcp(0xa, 0x1, 0x0) io_uring_setup(0x7c8f, &(0x7f0000001140)={0x0, 0xc240, 0x10, 0x3, 0x1c7}) 21:23:36 executing program 4: io_uring_setup(0x355e, &(0x7f0000000000)={0x0, 0x0, 0x20, 0x1, 0x1be}) syz_io_uring_setup(0x8fe, &(0x7f0000000080), &(0x7f0000ffb000/0x2000)=nil, &(0x7f0000ffb000/0x4000)=nil, &(0x7f0000000100), &(0x7f0000000140)) openat$hwrng(0xffffffffffffff9c, &(0x7f0000000180), 0x2, 0x0) syz_genetlink_get_family_id$mptcp(&(0x7f0000000300), 0xffffffffffffffff) openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000500)='./cgroup/syz1\x00', 0x200002, 0x0) io_uring_setup(0x2812, &(0x7f00000005c0)={0x0, 0x5e1b, 0x2, 0x3, 0x12f}) socket$inet6_tcp(0xa, 0x1, 0x0) io_uring_setup(0x7c8f, &(0x7f0000001140)={0x0, 0xc240, 0x10, 0x3, 0x1c7}) 21:23:36 executing program 0: r0 = io_uring_setup(0x355e, &(0x7f0000000000)={0x0, 0x0, 0x20, 0x0, 0x1be}) r1 = syz_io_uring_setup(0x8fe, &(0x7f0000000080)={0x0, 0x1830, 0x0, 0x0, 0x0, 0x0, r0}, &(0x7f0000ffb000/0x2000)=nil, &(0x7f0000ffb000/0x4000)=nil, &(0x7f0000000100), &(0x7f0000000140)=0x0) r3 = openat$hwrng(0xffffffffffffff9c, &(0x7f0000000180), 0x2, 0x0) syz_genetlink_get_family_id$mptcp(&(0x7f0000000300), r3) syz_io_uring_submit(0x0, r2, &(0x7f0000000580)=@IORING_OP_FILES_UPDATE={0x14, 0x4, 0x0, 0x0, 0x40, &(0x7f0000000540)=[0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, r0, r1], 0x5}, 0x3) socket$inet6_tcp(0xa, 0x1, 0x0) io_uring_setup(0x7c8f, &(0x7f0000001140)={0x0, 0xc240, 0x10, 0x3, 0x1c7}) 21:23:36 executing program 1: r0 = io_uring_setup(0x355e, &(0x7f0000000000)={0x0, 0x0, 0x20, 0x1, 0x1be}) r1 = openat$hwrng(0xffffffffffffff9c, &(0x7f0000000180), 0x2, 0x0) r2 = syz_io_uring_setup(0x65dd, &(0x7f00000001c0)={0x0, 0x0, 0x20, 0x2}, &(0x7f0000ffe000/0x1000)=nil, &(0x7f0000ffd000/0x1000)=nil, &(0x7f0000000240), &(0x7f0000000280)) syz_genetlink_get_family_id$mptcp(&(0x7f0000000300), r1) syz_io_uring_setup(0x20f8, &(0x7f0000000400)={0x0, 0x7677, 0x8, 0x3, 0x22f, 0x0, r2}, &(0x7f0000ffe000/0x2000)=nil, &(0x7f0000ffb000/0x2000)=nil, 0x0, &(0x7f00000004c0)) r3 = openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000500)='./cgroup/syz1\x00', 0x200002, 0x0) syz_io_uring_submit(0x0, 0x0, &(0x7f0000000580)=@IORING_OP_FILES_UPDATE={0x14, 0x4, 0x0, 0x0, 0x40, &(0x7f0000000540)=[r2, 0xffffffffffffffff, r3, r0, 0xffffffffffffffff], 0x5}, 0x3) io_uring_setup(0x2812, &(0x7f00000005c0)={0x0, 0x5e1b, 0x2, 0x3, 0x12f, 0x0, r2}) socket$inet6_tcp(0xa, 0x1, 0x0) openat$procfs(0xffffffffffffff9c, &(0x7f00000010c0)='/proc/crypto\x00', 0x0, 0x0) io_uring_setup(0x7c8f, &(0x7f0000001140)={0x0, 0xc240, 0x10, 0x3, 0x1c7, 0x0, r2}) 21:23:36 executing program 6: r0 = io_uring_setup(0x355e, &(0x7f0000000000)={0x0, 0x0, 0x20, 0x0, 0x1be}) r1 = syz_io_uring_setup(0x8fe, &(0x7f0000000080)={0x0, 0x1830, 0x0, 0x0, 0x0, 0x0, r0}, &(0x7f0000ffb000/0x2000)=nil, &(0x7f0000ffb000/0x4000)=nil, &(0x7f0000000100), &(0x7f0000000140)=0x0) r3 = openat$hwrng(0xffffffffffffff9c, &(0x7f0000000180), 0x2, 0x0) syz_genetlink_get_family_id$mptcp(&(0x7f0000000300), r3) sendmsg$MPTCP_PM_CMD_ADD_ADDR(r3, &(0x7f00000003c0)={&(0x7f00000002c0), 0xc, &(0x7f0000000380)={&(0x7f0000000340)={0x24, 0x0, 0x300, 0x70bd26, 0x25dfdbfb, {}, [@MPTCP_PM_ATTR_SUBFLOWS={0x8, 0x3, 0x1}, @MPTCP_PM_ATTR_RCV_ADD_ADDRS={0x8, 0x2, 0x2}]}, 0x24}, 0x1, 0x0, 0x0, 0x20000004}, 0x8890) syz_io_uring_setup(0x20f8, &(0x7f0000000400)={0x0, 0x7677, 0x8, 0x3, 0x22f}, &(0x7f0000ffe000/0x2000)=nil, &(0x7f0000ffb000/0x2000)=nil, &(0x7f0000000480)=0x0, &(0x7f00000004c0)) r5 = openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000500)='./cgroup/syz1\x00', 0x200002, 0x0) syz_io_uring_submit(r4, r2, &(0x7f0000000580)=@IORING_OP_FILES_UPDATE={0x14, 0x4, 0x0, 0x0, 0x40, &(0x7f0000000540)=[0xffffffffffffffff, 0xffffffffffffffff, r5, r0, r1], 0x5}, 0x3) socket$inet6_tcp(0xa, 0x1, 0x0) openat$procfs(0xffffffffffffff9c, &(0x7f00000010c0)='/proc/crypto\x00', 0x0, 0x0) io_uring_setup(0x7c8f, &(0x7f0000001140)={0x0, 0xc240, 0x10, 0x3, 0x1c7}) 21:23:36 executing program 7: r0 = io_uring_setup(0x355e, &(0x7f0000000000)={0x0, 0x0, 0x20, 0x0, 0x1be}) r1 = syz_io_uring_setup(0x8fe, &(0x7f0000000080)={0x0, 0x0, 0x0, 0x0, 0x1b8}, &(0x7f0000ffb000/0x2000)=nil, &(0x7f0000ffb000/0x4000)=nil, &(0x7f0000000100), &(0x7f0000000140)=0x0) r3 = openat$hwrng(0xffffffffffffff9c, &(0x7f0000000180), 0x2, 0x0) r4 = syz_io_uring_setup(0x65dd, &(0x7f00000001c0)={0x0, 0x0, 0x0, 0x0, 0xdf}, &(0x7f0000ffe000/0x1000)=nil, &(0x7f0000ffd000/0x1000)=nil, &(0x7f0000000240), &(0x7f0000000280)) r5 = syz_genetlink_get_family_id$mptcp(&(0x7f0000000300), r3) sendmsg$MPTCP_PM_CMD_ADD_ADDR(r3, &(0x7f00000003c0)={&(0x7f00000002c0)={0x10, 0x0, 0x0, 0x10}, 0xc, &(0x7f0000000380)={&(0x7f0000000340)={0x24, r5, 0x300, 0x70bd26, 0x25dfdbfb, {}, [@MPTCP_PM_ATTR_SUBFLOWS={0x8, 0x3, 0x1}, @MPTCP_PM_ATTR_RCV_ADD_ADDRS={0x8, 0x2, 0x2}]}, 0x24}, 0x1, 0x0, 0x0, 0x20000004}, 0x8890) r6 = openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000500)='./cgroup/syz1\x00', 0x200002, 0x0) syz_io_uring_submit(0x0, r2, &(0x7f0000000580)=@IORING_OP_FILES_UPDATE={0x14, 0x4, 0x0, 0x0, 0x40, &(0x7f0000000540)=[r4, 0xffffffffffffffff, r6, r0, r1], 0x5}, 0x3) socket$inet6_tcp(0xa, 0x1, 0x0) openat$procfs(0xffffffffffffff9c, &(0x7f00000010c0)='/proc/crypto\x00', 0x0, 0x0) 21:23:36 executing program 1: r0 = io_uring_setup(0x355e, &(0x7f0000000000)={0x0, 0x0, 0x20, 0x1, 0x1be}) r1 = openat$hwrng(0xffffffffffffff9c, &(0x7f0000000180), 0x2, 0x0) r2 = syz_io_uring_setup(0x65dd, &(0x7f00000001c0)={0x0, 0x0, 0x20, 0x2}, &(0x7f0000ffe000/0x1000)=nil, &(0x7f0000ffd000/0x1000)=nil, &(0x7f0000000240), &(0x7f0000000280)) syz_genetlink_get_family_id$mptcp(&(0x7f0000000300), r1) syz_io_uring_setup(0x20f8, &(0x7f0000000400)={0x0, 0x7677, 0x8, 0x3, 0x22f, 0x0, r2}, &(0x7f0000ffe000/0x2000)=nil, &(0x7f0000ffb000/0x2000)=nil, &(0x7f0000000480)=0x0, 0x0) r4 = openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000500)='./cgroup/syz1\x00', 0x200002, 0x0) syz_io_uring_submit(r3, 0x0, &(0x7f0000000580)=@IORING_OP_FILES_UPDATE={0x14, 0x4, 0x0, 0x0, 0x40, &(0x7f0000000540)=[r2, 0xffffffffffffffff, r4, r0, 0xffffffffffffffff], 0x5}, 0x3) io_uring_setup(0x2812, &(0x7f00000005c0)={0x0, 0x5e1b, 0x2, 0x3, 0x12f, 0x0, r2}) socket$inet6_tcp(0xa, 0x1, 0x0) openat$procfs(0xffffffffffffff9c, &(0x7f00000010c0)='/proc/crypto\x00', 0x0, 0x0) io_uring_setup(0x7c8f, &(0x7f0000001140)={0x0, 0xc240, 0x10, 0x3, 0x1c7, 0x0, r2}) 21:23:36 executing program 3: io_uring_setup(0x355e, &(0x7f0000000000)={0x0, 0x0, 0x20, 0x1, 0x1be}) syz_io_uring_setup(0x8fe, &(0x7f0000000080), &(0x7f0000ffb000/0x2000)=nil, &(0x7f0000ffb000/0x4000)=nil, &(0x7f0000000100), &(0x7f0000000140)) openat$hwrng(0xffffffffffffff9c, &(0x7f0000000180), 0x2, 0x0) syz_genetlink_get_family_id$mptcp(&(0x7f0000000300), 0xffffffffffffffff) openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000500)='./cgroup/syz1\x00', 0x200002, 0x0) syz_io_uring_submit(0x0, 0x0, 0x0, 0x3) io_uring_setup(0x2812, &(0x7f00000005c0)={0x0, 0x0, 0x0, 0x3, 0x12f}) socket$inet6_tcp(0xa, 0x1, 0x0) io_uring_setup(0x7c8f, &(0x7f0000001140)={0x0, 0xc240, 0x10, 0x3, 0x1c7}) 21:23:36 executing program 5: r0 = io_uring_setup(0x355e, &(0x7f0000000000)={0x0, 0x0, 0x20, 0x0, 0x1be}) r1 = syz_io_uring_setup(0x8fe, &(0x7f0000000080)={0x0, 0x0, 0x0, 0x0, 0x1b8}, &(0x7f0000ffb000/0x2000)=nil, &(0x7f0000ffb000/0x4000)=nil, &(0x7f0000000100), &(0x7f0000000140)=0x0) r3 = openat$hwrng(0xffffffffffffff9c, &(0x7f0000000180), 0x2, 0x0) r4 = syz_io_uring_setup(0x65dd, &(0x7f00000001c0)={0x0, 0x0, 0x0, 0x2, 0xdf}, &(0x7f0000ffe000/0x1000)=nil, &(0x7f0000ffd000/0x1000)=nil, 0x0, &(0x7f0000000280)) r5 = syz_genetlink_get_family_id$mptcp(&(0x7f0000000300), r3) sendmsg$MPTCP_PM_CMD_ADD_ADDR(r3, &(0x7f00000003c0)={&(0x7f00000002c0)={0x10, 0x0, 0x0, 0x10}, 0xc, &(0x7f0000000380)={&(0x7f0000000340)={0x24, r5, 0x300, 0x70bd26, 0x25dfdbfb, {}, [@MPTCP_PM_ATTR_SUBFLOWS={0x8, 0x3, 0x1}, @MPTCP_PM_ATTR_RCV_ADD_ADDRS={0x8, 0x2, 0x2}]}, 0x24}, 0x1, 0x0, 0x0, 0x20000004}, 0x8890) r6 = openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000500)='./cgroup/syz1\x00', 0x200002, 0x0) syz_io_uring_submit(0x0, r2, &(0x7f0000000580)=@IORING_OP_FILES_UPDATE={0x14, 0x4, 0x0, 0x0, 0x40, &(0x7f0000000540)=[r4, 0xffffffffffffffff, r6, r0, r1], 0x5}, 0x3) socket$inet6_tcp(0xa, 0x1, 0x0) openat$procfs(0xffffffffffffff9c, &(0x7f00000010c0)='/proc/crypto\x00', 0x0, 0x0) 21:23:36 executing program 0: r0 = io_uring_setup(0x355e, &(0x7f0000000000)={0x0, 0x0, 0x20, 0x0, 0x1be}) r1 = syz_io_uring_setup(0x8fe, &(0x7f0000000080)={0x0, 0x1830, 0x0, 0x0, 0x0, 0x0, r0}, &(0x7f0000ffb000/0x2000)=nil, &(0x7f0000ffb000/0x4000)=nil, &(0x7f0000000100), &(0x7f0000000140)=0x0) openat$hwrng(0xffffffffffffff9c, &(0x7f0000000180), 0x2, 0x0) syz_io_uring_submit(0x0, r2, &(0x7f0000000580)=@IORING_OP_FILES_UPDATE={0x14, 0x4, 0x0, 0x0, 0x40, &(0x7f0000000540)=[0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, r0, r1], 0x5}, 0x3) socket$inet6_tcp(0xa, 0x1, 0x0) io_uring_setup(0x7c8f, &(0x7f0000001140)={0x0, 0xc240, 0x10, 0x3, 0x1c7}) 21:23:36 executing program 2: r0 = io_uring_setup(0x355e, &(0x7f0000000000)={0x0, 0x0, 0x20, 0x0, 0x1be}) r1 = syz_io_uring_setup(0x8fe, &(0x7f0000000080)={0x0, 0x1830, 0x0, 0x0, 0x0, 0x0, r0}, &(0x7f0000ffb000/0x2000)=nil, &(0x7f0000ffb000/0x4000)=nil, &(0x7f0000000100), &(0x7f0000000140)=0x0) r3 = openat$hwrng(0xffffffffffffff9c, &(0x7f0000000180), 0x2, 0x0) syz_genetlink_get_family_id$mptcp(&(0x7f0000000300), r3) sendmsg$MPTCP_PM_CMD_ADD_ADDR(r3, &(0x7f00000003c0)={&(0x7f00000002c0), 0xc, &(0x7f0000000380)={0x0}, 0x1, 0x0, 0x0, 0x20000004}, 0x8890) syz_io_uring_setup(0x20f8, &(0x7f0000000400)={0x0, 0x7677, 0x8, 0x3, 0x22f}, &(0x7f0000ffe000/0x2000)=nil, &(0x7f0000ffb000/0x2000)=nil, &(0x7f0000000480)=0x0, &(0x7f00000004c0)) r5 = openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000500)='./cgroup/syz1\x00', 0x200002, 0x0) syz_io_uring_submit(r4, r2, &(0x7f0000000580)=@IORING_OP_FILES_UPDATE={0x14, 0x4, 0x0, 0x0, 0x40, &(0x7f0000000540)=[0xffffffffffffffff, 0xffffffffffffffff, r5, r0, r1], 0x5}, 0x3) 21:23:36 executing program 6: r0 = io_uring_setup(0x355e, &(0x7f0000000000)={0x0, 0x0, 0x20, 0x0, 0x1be}) r1 = syz_io_uring_setup(0x8fe, &(0x7f0000000080)={0x0, 0x1830, 0x0, 0x0, 0x0, 0x0, r0}, &(0x7f0000ffb000/0x2000)=nil, &(0x7f0000ffb000/0x4000)=nil, &(0x7f0000000100), &(0x7f0000000140)=0x0) r3 = openat$hwrng(0xffffffffffffff9c, &(0x7f0000000180), 0x2, 0x0) r4 = syz_genetlink_get_family_id$mptcp(&(0x7f0000000300), r3) sendmsg$MPTCP_PM_CMD_ADD_ADDR(r3, &(0x7f00000003c0)={&(0x7f00000002c0), 0xc, &(0x7f0000000380)={&(0x7f0000000340)={0x24, r4, 0x0, 0x70bd26, 0x25dfdbfb, {}, [@MPTCP_PM_ATTR_SUBFLOWS={0x8, 0x3, 0x1}, @MPTCP_PM_ATTR_RCV_ADD_ADDRS={0x8, 0x2, 0x2}]}, 0x24}, 0x1, 0x0, 0x0, 0x20000004}, 0x8890) syz_io_uring_setup(0x20f8, &(0x7f0000000400)={0x0, 0x7677, 0x8, 0x3, 0x22f}, &(0x7f0000ffe000/0x2000)=nil, &(0x7f0000ffb000/0x2000)=nil, &(0x7f0000000480)=0x0, &(0x7f00000004c0)) r6 = openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000500)='./cgroup/syz1\x00', 0x200002, 0x0) syz_io_uring_submit(r5, r2, &(0x7f0000000580)=@IORING_OP_FILES_UPDATE={0x14, 0x4, 0x0, 0x0, 0x40, &(0x7f0000000540)=[0xffffffffffffffff, 0xffffffffffffffff, r6, r0, r1], 0x5}, 0x3) socket$inet6_tcp(0xa, 0x1, 0x0) openat$procfs(0xffffffffffffff9c, &(0x7f00000010c0)='/proc/crypto\x00', 0x0, 0x0) io_uring_setup(0x7c8f, &(0x7f0000001140)={0x0, 0xc240, 0x10, 0x3, 0x1c7}) 21:23:36 executing program 4: io_uring_setup(0x355e, &(0x7f0000000000)={0x0, 0x0, 0x20, 0x1, 0x1be}) syz_io_uring_setup(0x8fe, &(0x7f0000000080), &(0x7f0000ffb000/0x2000)=nil, &(0x7f0000ffb000/0x4000)=nil, &(0x7f0000000100), &(0x7f0000000140)) openat$hwrng(0xffffffffffffff9c, &(0x7f0000000180), 0x2, 0x0) syz_genetlink_get_family_id$mptcp(&(0x7f0000000300), 0xffffffffffffffff) openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000500)='./cgroup/syz1\x00', 0x200002, 0x0) io_uring_setup(0x2812, &(0x7f00000005c0)={0x0, 0x5e1b, 0x2, 0x3, 0x12f}) socket$inet6_tcp(0xa, 0x1, 0x0) io_uring_setup(0x7c8f, &(0x7f0000001140)={0x0, 0xc240, 0x10, 0x3, 0x1c7}) 21:23:36 executing program 7: r0 = io_uring_setup(0x355e, &(0x7f0000000000)={0x0, 0x0, 0x20, 0x0, 0x1be}) r1 = syz_io_uring_setup(0x8fe, &(0x7f0000000080)={0x0, 0x0, 0x0, 0x0, 0x1b8}, &(0x7f0000ffb000/0x2000)=nil, &(0x7f0000ffb000/0x4000)=nil, &(0x7f0000000100), &(0x7f0000000140)=0x0) r3 = openat$hwrng(0xffffffffffffff9c, &(0x7f0000000180), 0x2, 0x0) r4 = syz_io_uring_setup(0x65dd, &(0x7f00000001c0)={0x0, 0x0, 0x0, 0x0, 0xdf}, &(0x7f0000ffe000/0x1000)=nil, &(0x7f0000ffd000/0x1000)=nil, &(0x7f0000000240), &(0x7f0000000280)) r5 = syz_genetlink_get_family_id$mptcp(&(0x7f0000000300), r3) sendmsg$MPTCP_PM_CMD_ADD_ADDR(r3, &(0x7f00000003c0)={&(0x7f00000002c0)={0x10, 0x0, 0x0, 0x10}, 0xc, &(0x7f0000000380)={&(0x7f0000000340)={0x24, r5, 0x300, 0x70bd26, 0x25dfdbfb, {}, [@MPTCP_PM_ATTR_SUBFLOWS={0x8, 0x3, 0x1}, @MPTCP_PM_ATTR_RCV_ADD_ADDRS={0x8, 0x2, 0x2}]}, 0x24}, 0x1, 0x0, 0x0, 0x20000004}, 0x8890) r6 = openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000500)='./cgroup/syz1\x00', 0x200002, 0x0) syz_io_uring_submit(0x0, r2, &(0x7f0000000580)=@IORING_OP_FILES_UPDATE={0x14, 0x4, 0x0, 0x0, 0x40, &(0x7f0000000540)=[r4, 0xffffffffffffffff, r6, r0, r1], 0x5}, 0x3) socket$inet6_tcp(0xa, 0x1, 0x0) openat$procfs(0xffffffffffffff9c, &(0x7f00000010c0)='/proc/crypto\x00', 0x0, 0x0) 21:23:36 executing program 0: r0 = io_uring_setup(0x355e, &(0x7f0000000000)={0x0, 0x0, 0x20, 0x0, 0x1be}) r1 = syz_io_uring_setup(0x8fe, &(0x7f0000000080)={0x0, 0x1830, 0x0, 0x0, 0x0, 0x0, r0}, &(0x7f0000ffb000/0x2000)=nil, &(0x7f0000ffb000/0x4000)=nil, &(0x7f0000000100), &(0x7f0000000140)=0x0) syz_io_uring_submit(0x0, r2, &(0x7f0000000580)=@IORING_OP_FILES_UPDATE={0x14, 0x4, 0x0, 0x0, 0x40, &(0x7f0000000540)=[0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, r0, r1], 0x5}, 0x3) socket$inet6_tcp(0xa, 0x1, 0x0) io_uring_setup(0x7c8f, &(0x7f0000001140)={0x0, 0xc240, 0x10, 0x3, 0x1c7}) 21:23:37 executing program 5: r0 = io_uring_setup(0x355e, &(0x7f0000000000)={0x0, 0x0, 0x20, 0x0, 0x1be}) r1 = syz_io_uring_setup(0x8fe, &(0x7f0000000080)={0x0, 0x0, 0x0, 0x0, 0x1b8}, &(0x7f0000ffb000/0x2000)=nil, &(0x7f0000ffb000/0x4000)=nil, &(0x7f0000000100), &(0x7f0000000140)=0x0) r3 = openat$hwrng(0xffffffffffffff9c, &(0x7f0000000180), 0x2, 0x0) r4 = syz_io_uring_setup(0x65dd, &(0x7f00000001c0)={0x0, 0x0, 0x0, 0x2, 0xdf}, &(0x7f0000ffe000/0x1000)=nil, &(0x7f0000ffd000/0x1000)=nil, &(0x7f0000000240), 0x0) r5 = syz_genetlink_get_family_id$mptcp(&(0x7f0000000300), r3) sendmsg$MPTCP_PM_CMD_ADD_ADDR(r3, &(0x7f00000003c0)={&(0x7f00000002c0)={0x10, 0x0, 0x0, 0x10}, 0xc, &(0x7f0000000380)={&(0x7f0000000340)={0x24, r5, 0x300, 0x70bd26, 0x25dfdbfb, {}, [@MPTCP_PM_ATTR_SUBFLOWS={0x8, 0x3, 0x1}, @MPTCP_PM_ATTR_RCV_ADD_ADDRS={0x8, 0x2, 0x2}]}, 0x24}, 0x1, 0x0, 0x0, 0x20000004}, 0x8890) r6 = openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000500)='./cgroup/syz1\x00', 0x200002, 0x0) syz_io_uring_submit(0x0, r2, &(0x7f0000000580)=@IORING_OP_FILES_UPDATE={0x14, 0x4, 0x0, 0x0, 0x40, &(0x7f0000000540)=[r4, 0xffffffffffffffff, r6, r0, r1], 0x5}, 0x3) socket$inet6_tcp(0xa, 0x1, 0x0) openat$procfs(0xffffffffffffff9c, &(0x7f00000010c0)='/proc/crypto\x00', 0x0, 0x0) 21:23:37 executing program 1: r0 = io_uring_setup(0x355e, &(0x7f0000000000)={0x0, 0x0, 0x20, 0x1, 0x1be}) r1 = openat$hwrng(0xffffffffffffff9c, &(0x7f0000000180), 0x2, 0x0) r2 = syz_io_uring_setup(0x65dd, &(0x7f00000001c0)={0x0, 0x0, 0x20, 0x2}, &(0x7f0000ffe000/0x1000)=nil, &(0x7f0000ffd000/0x1000)=nil, &(0x7f0000000240), &(0x7f0000000280)) syz_genetlink_get_family_id$mptcp(&(0x7f0000000300), r1) syz_io_uring_setup(0x20f8, &(0x7f0000000400)={0x0, 0x7677, 0x8, 0x3, 0x22f, 0x0, r2}, &(0x7f0000ffe000/0x2000)=nil, &(0x7f0000ffb000/0x2000)=nil, &(0x7f0000000480)=0x0, 0x0) r4 = openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000500)='./cgroup/syz1\x00', 0x200002, 0x0) syz_io_uring_submit(r3, 0x0, &(0x7f0000000580)=@IORING_OP_FILES_UPDATE={0x14, 0x4, 0x0, 0x0, 0x40, &(0x7f0000000540)=[r2, 0xffffffffffffffff, r4, r0, 0xffffffffffffffff], 0x5}, 0x3) io_uring_setup(0x2812, &(0x7f00000005c0)={0x0, 0x5e1b, 0x2, 0x3, 0x12f, 0x0, r2}) socket$inet6_tcp(0xa, 0x1, 0x0) openat$procfs(0xffffffffffffff9c, &(0x7f00000010c0)='/proc/crypto\x00', 0x0, 0x0) io_uring_setup(0x7c8f, &(0x7f0000001140)={0x0, 0xc240, 0x10, 0x3, 0x1c7, 0x0, r2}) 21:23:37 executing program 0: r0 = io_uring_setup(0x355e, &(0x7f0000000000)={0x0, 0x0, 0x20, 0x0, 0x1be}) r1 = syz_io_uring_setup(0x8fe, &(0x7f0000000080)={0x0, 0x1830, 0x0, 0x0, 0x0, 0x0, r0}, &(0x7f0000ffb000/0x2000)=nil, &(0x7f0000ffb000/0x4000)=nil, &(0x7f0000000100), &(0x7f0000000140)=0x0) syz_io_uring_submit(0x0, r2, &(0x7f0000000580)=@IORING_OP_FILES_UPDATE={0x14, 0x4, 0x0, 0x0, 0x40, &(0x7f0000000540)=[0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, r0, r1], 0x5}, 0x3) socket$inet6_tcp(0xa, 0x1, 0x0) io_uring_setup(0x7c8f, &(0x7f0000001140)={0x0, 0xc240, 0x10, 0x3, 0x1c7}) 21:23:46 executing program 5: r0 = io_uring_setup(0x355e, &(0x7f0000000000)={0x0, 0x0, 0x20, 0x0, 0x1be}) r1 = syz_io_uring_setup(0x8fe, &(0x7f0000000080)={0x0, 0x0, 0x0, 0x0, 0x1b8}, &(0x7f0000ffb000/0x2000)=nil, &(0x7f0000ffb000/0x4000)=nil, &(0x7f0000000100), &(0x7f0000000140)=0x0) r3 = openat$hwrng(0xffffffffffffff9c, &(0x7f0000000180), 0x2, 0x0) r4 = syz_io_uring_setup(0x65dd, &(0x7f00000001c0)={0x0, 0x0, 0x0, 0x2, 0xdf}, &(0x7f0000ffe000/0x1000)=nil, &(0x7f0000ffd000/0x1000)=nil, &(0x7f0000000240), 0x0) r5 = syz_genetlink_get_family_id$mptcp(&(0x7f0000000300), r3) sendmsg$MPTCP_PM_CMD_ADD_ADDR(r3, &(0x7f00000003c0)={&(0x7f00000002c0)={0x10, 0x0, 0x0, 0x10}, 0xc, &(0x7f0000000380)={&(0x7f0000000340)={0x24, r5, 0x300, 0x70bd26, 0x25dfdbfb, {}, [@MPTCP_PM_ATTR_SUBFLOWS={0x8, 0x3, 0x1}, @MPTCP_PM_ATTR_RCV_ADD_ADDRS={0x8, 0x2, 0x2}]}, 0x24}, 0x1, 0x0, 0x0, 0x20000004}, 0x8890) r6 = openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000500)='./cgroup/syz1\x00', 0x200002, 0x0) syz_io_uring_submit(0x0, r2, &(0x7f0000000580)=@IORING_OP_FILES_UPDATE={0x14, 0x4, 0x0, 0x0, 0x40, &(0x7f0000000540)=[r4, 0xffffffffffffffff, r6, r0, r1], 0x5}, 0x3) socket$inet6_tcp(0xa, 0x1, 0x0) openat$procfs(0xffffffffffffff9c, &(0x7f00000010c0)='/proc/crypto\x00', 0x0, 0x0) 21:23:46 executing program 1: r0 = io_uring_setup(0x355e, &(0x7f0000000000)={0x0, 0x0, 0x20, 0x1, 0x1be}) r1 = openat$hwrng(0xffffffffffffff9c, &(0x7f0000000180), 0x2, 0x0) r2 = syz_io_uring_setup(0x65dd, &(0x7f00000001c0)={0x0, 0x0, 0x20, 0x2}, &(0x7f0000ffe000/0x1000)=nil, &(0x7f0000ffd000/0x1000)=nil, &(0x7f0000000240), &(0x7f0000000280)) syz_genetlink_get_family_id$mptcp(&(0x7f0000000300), r1) syz_io_uring_setup(0x20f8, &(0x7f0000000400)={0x0, 0x7677, 0x8, 0x3, 0x22f, 0x0, r2}, &(0x7f0000ffe000/0x2000)=nil, &(0x7f0000ffb000/0x2000)=nil, &(0x7f0000000480)=0x0, 0x0) r4 = openat$cgroup_root(0xffffffffffffff9c, 0x0, 0x200002, 0x0) syz_io_uring_submit(r3, 0x0, &(0x7f0000000580)=@IORING_OP_FILES_UPDATE={0x14, 0x4, 0x0, 0x0, 0x40, &(0x7f0000000540)=[r2, 0xffffffffffffffff, r4, r0, 0xffffffffffffffff], 0x5}, 0x3) io_uring_setup(0x2812, &(0x7f00000005c0)={0x0, 0x5e1b, 0x2, 0x3, 0x12f, 0x0, r2}) socket$inet6_tcp(0xa, 0x1, 0x0) openat$procfs(0xffffffffffffff9c, &(0x7f00000010c0)='/proc/crypto\x00', 0x0, 0x0) io_uring_setup(0x7c8f, &(0x7f0000001140)={0x0, 0xc240, 0x10, 0x3, 0x1c7, 0x0, r2}) 21:23:46 executing program 4: io_uring_setup(0x355e, &(0x7f0000000000)={0x0, 0x0, 0x20, 0x1, 0x1be}) syz_io_uring_setup(0x8fe, &(0x7f0000000080), &(0x7f0000ffb000/0x2000)=nil, &(0x7f0000ffb000/0x4000)=nil, &(0x7f0000000100), &(0x7f0000000140)) openat$hwrng(0xffffffffffffff9c, &(0x7f0000000180), 0x2, 0x0) syz_genetlink_get_family_id$mptcp(&(0x7f0000000300), 0xffffffffffffffff) syz_io_uring_submit(0x0, 0x0, 0x0, 0x0) io_uring_setup(0x2812, &(0x7f00000005c0)={0x0, 0x5e1b, 0x2, 0x3, 0x12f}) socket$inet6_tcp(0xa, 0x1, 0x0) io_uring_setup(0x7c8f, &(0x7f0000001140)={0x0, 0xc240, 0x10, 0x3, 0x1c7}) 21:23:46 executing program 3: io_uring_setup(0x355e, &(0x7f0000000000)={0x0, 0x0, 0x20, 0x1, 0x1be}) syz_io_uring_setup(0x8fe, &(0x7f0000000080), &(0x7f0000ffb000/0x2000)=nil, &(0x7f0000ffb000/0x4000)=nil, &(0x7f0000000100), &(0x7f0000000140)) openat$hwrng(0xffffffffffffff9c, &(0x7f0000000180), 0x2, 0x0) syz_genetlink_get_family_id$mptcp(&(0x7f0000000300), 0xffffffffffffffff) openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000500)='./cgroup/syz1\x00', 0x200002, 0x0) syz_io_uring_submit(0x0, 0x0, 0x0, 0x3) io_uring_setup(0x2812, &(0x7f00000005c0)={0x0, 0x0, 0x0, 0x3, 0x12f}) socket$inet6_tcp(0xa, 0x1, 0x0) io_uring_setup(0x7c8f, &(0x7f0000001140)={0x0, 0xc240, 0x10, 0x3, 0x1c7}) 21:23:46 executing program 2: r0 = io_uring_setup(0x355e, &(0x7f0000000000)={0x0, 0x0, 0x20, 0x0, 0x1be}) r1 = syz_io_uring_setup(0x8fe, &(0x7f0000000080)={0x0, 0x1830, 0x0, 0x0, 0x0, 0x0, r0}, &(0x7f0000ffb000/0x2000)=nil, &(0x7f0000ffb000/0x4000)=nil, &(0x7f0000000100), &(0x7f0000000140)=0x0) r3 = openat$hwrng(0xffffffffffffff9c, &(0x7f0000000180), 0x2, 0x0) syz_genetlink_get_family_id$mptcp(&(0x7f0000000300), r3) sendmsg$MPTCP_PM_CMD_ADD_ADDR(r3, &(0x7f00000003c0)={&(0x7f00000002c0), 0xc, &(0x7f0000000380)={0x0}, 0x1, 0x0, 0x0, 0x20000004}, 0x8890) syz_io_uring_setup(0x20f8, &(0x7f0000000400)={0x0, 0x7677, 0x8, 0x3, 0x22f}, &(0x7f0000ffe000/0x2000)=nil, &(0x7f0000ffb000/0x2000)=nil, &(0x7f0000000480)=0x0, &(0x7f00000004c0)) r5 = openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000500)='./cgroup/syz1\x00', 0x200002, 0x0) syz_io_uring_submit(r4, r2, &(0x7f0000000580)=@IORING_OP_FILES_UPDATE={0x14, 0x4, 0x0, 0x0, 0x40, &(0x7f0000000540)=[0xffffffffffffffff, 0xffffffffffffffff, r5, r0, r1], 0x5}, 0x3) 21:23:46 executing program 6: r0 = io_uring_setup(0x355e, &(0x7f0000000000)={0x0, 0x0, 0x20, 0x0, 0x1be}) r1 = syz_io_uring_setup(0x8fe, &(0x7f0000000080)={0x0, 0x1830, 0x0, 0x0, 0x0, 0x0, r0}, &(0x7f0000ffb000/0x2000)=nil, &(0x7f0000ffb000/0x4000)=nil, &(0x7f0000000100), &(0x7f0000000140)=0x0) r3 = openat$hwrng(0xffffffffffffff9c, &(0x7f0000000180), 0x2, 0x0) r4 = syz_genetlink_get_family_id$mptcp(&(0x7f0000000300), r3) sendmsg$MPTCP_PM_CMD_ADD_ADDR(r3, &(0x7f00000003c0)={&(0x7f00000002c0), 0xc, &(0x7f0000000380)={&(0x7f0000000340)={0x24, r4, 0x0, 0x70bd26, 0x25dfdbfb, {}, [@MPTCP_PM_ATTR_SUBFLOWS={0x8, 0x3, 0x1}, @MPTCP_PM_ATTR_RCV_ADD_ADDRS={0x8, 0x2, 0x2}]}, 0x24}, 0x1, 0x0, 0x0, 0x20000004}, 0x8890) syz_io_uring_setup(0x20f8, &(0x7f0000000400)={0x0, 0x7677, 0x8, 0x3, 0x22f}, &(0x7f0000ffe000/0x2000)=nil, &(0x7f0000ffb000/0x2000)=nil, &(0x7f0000000480)=0x0, &(0x7f00000004c0)) r6 = openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000500)='./cgroup/syz1\x00', 0x200002, 0x0) syz_io_uring_submit(r5, r2, &(0x7f0000000580)=@IORING_OP_FILES_UPDATE={0x14, 0x4, 0x0, 0x0, 0x40, &(0x7f0000000540)=[0xffffffffffffffff, 0xffffffffffffffff, r6, r0, r1], 0x5}, 0x3) socket$inet6_tcp(0xa, 0x1, 0x0) openat$procfs(0xffffffffffffff9c, &(0x7f00000010c0)='/proc/crypto\x00', 0x0, 0x0) io_uring_setup(0x7c8f, &(0x7f0000001140)={0x0, 0xc240, 0x10, 0x3, 0x1c7}) 21:23:46 executing program 7: r0 = io_uring_setup(0x355e, &(0x7f0000000000)={0x0, 0x0, 0x20, 0x0, 0x1be}) r1 = syz_io_uring_setup(0x8fe, &(0x7f0000000080)={0x0, 0x0, 0x0, 0x0, 0x1b8}, &(0x7f0000ffb000/0x2000)=nil, &(0x7f0000ffb000/0x4000)=nil, &(0x7f0000000100), &(0x7f0000000140)=0x0) r3 = openat$hwrng(0xffffffffffffff9c, &(0x7f0000000180), 0x2, 0x0) r4 = syz_io_uring_setup(0x65dd, &(0x7f00000001c0)={0x0, 0x0, 0x0, 0x0, 0xdf}, &(0x7f0000ffe000/0x1000)=nil, &(0x7f0000ffd000/0x1000)=nil, &(0x7f0000000240), &(0x7f0000000280)) r5 = syz_genetlink_get_family_id$mptcp(&(0x7f0000000300), r3) sendmsg$MPTCP_PM_CMD_ADD_ADDR(r3, &(0x7f00000003c0)={&(0x7f00000002c0)={0x10, 0x0, 0x0, 0x10}, 0xc, &(0x7f0000000380)={&(0x7f0000000340)={0x24, r5, 0x300, 0x70bd26, 0x25dfdbfb, {}, [@MPTCP_PM_ATTR_SUBFLOWS={0x8, 0x3, 0x1}, @MPTCP_PM_ATTR_RCV_ADD_ADDRS={0x8, 0x2, 0x2}]}, 0x24}, 0x1, 0x0, 0x0, 0x20000004}, 0x8890) r6 = openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000500)='./cgroup/syz1\x00', 0x200002, 0x0) syz_io_uring_submit(0x0, r2, &(0x7f0000000580)=@IORING_OP_FILES_UPDATE={0x14, 0x4, 0x0, 0x0, 0x40, &(0x7f0000000540)=[r4, 0xffffffffffffffff, r6, r0, r1], 0x5}, 0x3) socket$inet6_tcp(0xa, 0x1, 0x0) openat$procfs(0xffffffffffffff9c, &(0x7f00000010c0)='/proc/crypto\x00', 0x0, 0x0) 21:23:46 executing program 0: r0 = io_uring_setup(0x355e, &(0x7f0000000000)={0x0, 0x0, 0x20, 0x0, 0x1be}) r1 = syz_io_uring_setup(0x8fe, &(0x7f0000000080)={0x0, 0x1830, 0x0, 0x0, 0x0, 0x0, r0}, &(0x7f0000ffb000/0x2000)=nil, &(0x7f0000ffb000/0x4000)=nil, &(0x7f0000000100), &(0x7f0000000140)=0x0) syz_io_uring_submit(0x0, r2, &(0x7f0000000580)=@IORING_OP_FILES_UPDATE={0x14, 0x4, 0x0, 0x0, 0x40, &(0x7f0000000540)=[0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, r0, r1], 0x5}, 0x3) socket$inet6_tcp(0xa, 0x1, 0x0) io_uring_setup(0x7c8f, &(0x7f0000001140)={0x0, 0xc240, 0x10, 0x3, 0x1c7}) 21:23:46 executing program 5: r0 = io_uring_setup(0x355e, &(0x7f0000000000)={0x0, 0x0, 0x20, 0x0, 0x1be}) r1 = syz_io_uring_setup(0x8fe, &(0x7f0000000080)={0x0, 0x0, 0x0, 0x0, 0x1b8}, &(0x7f0000ffb000/0x2000)=nil, &(0x7f0000ffb000/0x4000)=nil, &(0x7f0000000100), &(0x7f0000000140)=0x0) r3 = openat$hwrng(0xffffffffffffff9c, &(0x7f0000000180), 0x2, 0x0) r4 = syz_io_uring_setup(0x65dd, &(0x7f00000001c0)={0x0, 0x0, 0x0, 0x2, 0xdf}, &(0x7f0000ffe000/0x1000)=nil, &(0x7f0000ffd000/0x1000)=nil, &(0x7f0000000240), 0x0) r5 = syz_genetlink_get_family_id$mptcp(&(0x7f0000000300), r3) sendmsg$MPTCP_PM_CMD_ADD_ADDR(r3, &(0x7f00000003c0)={&(0x7f00000002c0)={0x10, 0x0, 0x0, 0x10}, 0xc, &(0x7f0000000380)={&(0x7f0000000340)={0x24, r5, 0x300, 0x70bd26, 0x25dfdbfb, {}, [@MPTCP_PM_ATTR_SUBFLOWS={0x8, 0x3, 0x1}, @MPTCP_PM_ATTR_RCV_ADD_ADDRS={0x8, 0x2, 0x2}]}, 0x24}, 0x1, 0x0, 0x0, 0x20000004}, 0x8890) r6 = openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000500)='./cgroup/syz1\x00', 0x200002, 0x0) syz_io_uring_submit(0x0, r2, &(0x7f0000000580)=@IORING_OP_FILES_UPDATE={0x14, 0x4, 0x0, 0x0, 0x40, &(0x7f0000000540)=[r4, 0xffffffffffffffff, r6, r0, r1], 0x5}, 0x3) socket$inet6_tcp(0xa, 0x1, 0x0) openat$procfs(0xffffffffffffff9c, &(0x7f00000010c0)='/proc/crypto\x00', 0x0, 0x0) 21:23:46 executing program 0: r0 = io_uring_setup(0x355e, &(0x7f0000000000)={0x0, 0x0, 0x20, 0x0, 0x1be}) openat$hwrng(0xffffffffffffff9c, &(0x7f0000000180), 0x2, 0x0) syz_io_uring_submit(0x0, 0x0, &(0x7f0000000580)=@IORING_OP_FILES_UPDATE={0x14, 0x4, 0x0, 0x0, 0x40, &(0x7f0000000540)=[0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, r0, 0xffffffffffffffff], 0x5}, 0x3) socket$inet6_tcp(0xa, 0x1, 0x0) io_uring_setup(0x7c8f, &(0x7f0000001140)={0x0, 0xc240, 0x10, 0x3, 0x1c7}) 21:23:46 executing program 7: r0 = io_uring_setup(0x355e, &(0x7f0000000000)={0x0, 0x0, 0x20, 0x0, 0x1be}) r1 = syz_io_uring_setup(0x8fe, &(0x7f0000000080)={0x0, 0x0, 0x0, 0x0, 0x1b8}, &(0x7f0000ffb000/0x2000)=nil, &(0x7f0000ffb000/0x4000)=nil, &(0x7f0000000100), &(0x7f0000000140)=0x0) r3 = openat$hwrng(0xffffffffffffff9c, &(0x7f0000000180), 0x2, 0x0) r4 = syz_io_uring_setup(0x65dd, &(0x7f00000001c0)={0x0, 0x0, 0x0, 0x0, 0xdf}, &(0x7f0000ffe000/0x1000)=nil, &(0x7f0000ffd000/0x1000)=nil, &(0x7f0000000240), &(0x7f0000000280)) r5 = syz_genetlink_get_family_id$mptcp(&(0x7f0000000300), r3) sendmsg$MPTCP_PM_CMD_ADD_ADDR(r3, &(0x7f00000003c0)={&(0x7f00000002c0)={0x10, 0x0, 0x0, 0x10}, 0xc, &(0x7f0000000380)={&(0x7f0000000340)={0x24, r5, 0x300, 0x70bd26, 0x25dfdbfb, {}, [@MPTCP_PM_ATTR_SUBFLOWS={0x8, 0x3, 0x1}, @MPTCP_PM_ATTR_RCV_ADD_ADDRS={0x8, 0x2, 0x2}]}, 0x24}, 0x1, 0x0, 0x0, 0x20000004}, 0x8890) r6 = openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000500)='./cgroup/syz1\x00', 0x200002, 0x0) syz_io_uring_submit(0x0, r2, &(0x7f0000000580)=@IORING_OP_FILES_UPDATE={0x14, 0x4, 0x0, 0x0, 0x40, &(0x7f0000000540)=[r4, 0xffffffffffffffff, r6, r0, r1], 0x5}, 0x3) socket$inet6_tcp(0xa, 0x1, 0x0) 21:23:46 executing program 4: io_uring_setup(0x355e, &(0x7f0000000000)={0x0, 0x0, 0x20, 0x1, 0x1be}) syz_io_uring_setup(0x8fe, &(0x7f0000000080), &(0x7f0000ffb000/0x2000)=nil, &(0x7f0000ffb000/0x4000)=nil, &(0x7f0000000100), &(0x7f0000000140)) openat$hwrng(0xffffffffffffff9c, &(0x7f0000000180), 0x2, 0x0) syz_genetlink_get_family_id$mptcp(&(0x7f0000000300), 0xffffffffffffffff) syz_io_uring_submit(0x0, 0x0, 0x0, 0x0) io_uring_setup(0x2812, &(0x7f00000005c0)={0x0, 0x5e1b, 0x2, 0x3, 0x12f}) socket$inet6_tcp(0xa, 0x1, 0x0) io_uring_setup(0x7c8f, &(0x7f0000001140)={0x0, 0xc240, 0x10, 0x3, 0x1c7}) 21:23:46 executing program 1: r0 = io_uring_setup(0x355e, &(0x7f0000000000)={0x0, 0x0, 0x20, 0x1, 0x1be}) r1 = openat$hwrng(0xffffffffffffff9c, &(0x7f0000000180), 0x2, 0x0) r2 = syz_io_uring_setup(0x65dd, &(0x7f00000001c0)={0x0, 0x0, 0x20, 0x2}, &(0x7f0000ffe000/0x1000)=nil, &(0x7f0000ffd000/0x1000)=nil, &(0x7f0000000240), &(0x7f0000000280)) syz_genetlink_get_family_id$mptcp(&(0x7f0000000300), r1) syz_io_uring_setup(0x20f8, &(0x7f0000000400)={0x0, 0x7677, 0x8, 0x3, 0x22f, 0x0, r2}, &(0x7f0000ffe000/0x2000)=nil, &(0x7f0000ffb000/0x2000)=nil, &(0x7f0000000480)=0x0, 0x0) r4 = openat$cgroup_root(0xffffffffffffff9c, 0x0, 0x200002, 0x0) syz_io_uring_submit(r3, 0x0, &(0x7f0000000580)=@IORING_OP_FILES_UPDATE={0x14, 0x4, 0x0, 0x0, 0x40, &(0x7f0000000540)=[r2, 0xffffffffffffffff, r4, r0, 0xffffffffffffffff], 0x5}, 0x3) io_uring_setup(0x2812, &(0x7f00000005c0)={0x0, 0x5e1b, 0x2, 0x3, 0x12f, 0x0, r2}) socket$inet6_tcp(0xa, 0x1, 0x0) openat$procfs(0xffffffffffffff9c, &(0x7f00000010c0)='/proc/crypto\x00', 0x0, 0x0) io_uring_setup(0x7c8f, &(0x7f0000001140)={0x0, 0xc240, 0x10, 0x3, 0x1c7, 0x0, r2}) 21:23:46 executing program 2: r0 = io_uring_setup(0x355e, &(0x7f0000000000)={0x0, 0x0, 0x20, 0x0, 0x1be}) r1 = syz_io_uring_setup(0x8fe, &(0x7f0000000080)={0x0, 0x1830, 0x0, 0x0, 0x0, 0x0, r0}, &(0x7f0000ffb000/0x2000)=nil, &(0x7f0000ffb000/0x4000)=nil, &(0x7f0000000100), &(0x7f0000000140)=0x0) r3 = openat$hwrng(0xffffffffffffff9c, &(0x7f0000000180), 0x2, 0x0) syz_genetlink_get_family_id$mptcp(&(0x7f0000000300), r3) sendmsg$MPTCP_PM_CMD_ADD_ADDR(r3, &(0x7f00000003c0)={&(0x7f00000002c0), 0xc, &(0x7f0000000380)={0x0}, 0x1, 0x0, 0x0, 0x20000004}, 0x8890) syz_io_uring_setup(0x20f8, &(0x7f0000000400)={0x0, 0x7677, 0x8, 0x3, 0x22f}, &(0x7f0000ffe000/0x2000)=nil, &(0x7f0000ffb000/0x2000)=nil, &(0x7f0000000480)=0x0, &(0x7f00000004c0)) r5 = openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000500)='./cgroup/syz1\x00', 0x200002, 0x0) syz_io_uring_submit(r4, r2, &(0x7f0000000580)=@IORING_OP_FILES_UPDATE={0x14, 0x4, 0x0, 0x0, 0x40, &(0x7f0000000540)=[0xffffffffffffffff, 0xffffffffffffffff, r5, r0, r1], 0x5}, 0x3) 21:23:46 executing program 6: r0 = io_uring_setup(0x355e, &(0x7f0000000000)={0x0, 0x0, 0x20, 0x0, 0x1be}) r1 = syz_io_uring_setup(0x8fe, &(0x7f0000000080)={0x0, 0x1830, 0x0, 0x0, 0x0, 0x0, r0}, &(0x7f0000ffb000/0x2000)=nil, &(0x7f0000ffb000/0x4000)=nil, &(0x7f0000000100), &(0x7f0000000140)=0x0) r3 = openat$hwrng(0xffffffffffffff9c, &(0x7f0000000180), 0x2, 0x0) r4 = syz_genetlink_get_family_id$mptcp(&(0x7f0000000300), r3) sendmsg$MPTCP_PM_CMD_ADD_ADDR(r3, &(0x7f00000003c0)={&(0x7f00000002c0), 0xc, &(0x7f0000000380)={&(0x7f0000000340)={0x24, r4, 0x0, 0x70bd26, 0x25dfdbfb, {}, [@MPTCP_PM_ATTR_SUBFLOWS={0x8, 0x3, 0x1}, @MPTCP_PM_ATTR_RCV_ADD_ADDRS={0x8, 0x2, 0x2}]}, 0x24}, 0x1, 0x0, 0x0, 0x20000004}, 0x8890) syz_io_uring_setup(0x20f8, &(0x7f0000000400)={0x0, 0x7677, 0x8, 0x3, 0x22f}, &(0x7f0000ffe000/0x2000)=nil, &(0x7f0000ffb000/0x2000)=nil, &(0x7f0000000480)=0x0, &(0x7f00000004c0)) r6 = openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000500)='./cgroup/syz1\x00', 0x200002, 0x0) syz_io_uring_submit(r5, r2, &(0x7f0000000580)=@IORING_OP_FILES_UPDATE={0x14, 0x4, 0x0, 0x0, 0x40, &(0x7f0000000540)=[0xffffffffffffffff, 0xffffffffffffffff, r6, r0, r1], 0x5}, 0x3) socket$inet6_tcp(0xa, 0x1, 0x0) openat$procfs(0xffffffffffffff9c, &(0x7f00000010c0)='/proc/crypto\x00', 0x0, 0x0) io_uring_setup(0x7c8f, &(0x7f0000001140)={0x0, 0xc240, 0x10, 0x3, 0x1c7}) 21:23:46 executing program 3: io_uring_setup(0x355e, &(0x7f0000000000)={0x0, 0x0, 0x20, 0x1, 0x1be}) syz_io_uring_setup(0x8fe, &(0x7f0000000080), &(0x7f0000ffb000/0x2000)=nil, &(0x7f0000ffb000/0x4000)=nil, &(0x7f0000000100), &(0x7f0000000140)) openat$hwrng(0xffffffffffffff9c, &(0x7f0000000180), 0x2, 0x0) syz_genetlink_get_family_id$mptcp(&(0x7f0000000300), 0xffffffffffffffff) openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000500)='./cgroup/syz1\x00', 0x200002, 0x0) syz_io_uring_submit(0x0, 0x0, 0x0, 0x3) io_uring_setup(0x2812, &(0x7f00000005c0)={0x0, 0x0, 0x2, 0x0, 0x12f}) socket$inet6_tcp(0xa, 0x1, 0x0) io_uring_setup(0x7c8f, &(0x7f0000001140)={0x0, 0xc240, 0x10, 0x3, 0x1c7}) 21:23:54 executing program 7: r0 = io_uring_setup(0x355e, &(0x7f0000000000)={0x0, 0x0, 0x20, 0x0, 0x1be}) r1 = syz_io_uring_setup(0x8fe, &(0x7f0000000080)={0x0, 0x0, 0x0, 0x0, 0x1b8}, &(0x7f0000ffb000/0x2000)=nil, &(0x7f0000ffb000/0x4000)=nil, &(0x7f0000000100), &(0x7f0000000140)=0x0) r3 = openat$hwrng(0xffffffffffffff9c, &(0x7f0000000180), 0x2, 0x0) r4 = syz_io_uring_setup(0x65dd, &(0x7f00000001c0)={0x0, 0x0, 0x0, 0x0, 0xdf}, &(0x7f0000ffe000/0x1000)=nil, &(0x7f0000ffd000/0x1000)=nil, &(0x7f0000000240), &(0x7f0000000280)) r5 = syz_genetlink_get_family_id$mptcp(&(0x7f0000000300), r3) sendmsg$MPTCP_PM_CMD_ADD_ADDR(r3, &(0x7f00000003c0)={&(0x7f00000002c0)={0x10, 0x0, 0x0, 0x10}, 0xc, &(0x7f0000000380)={&(0x7f0000000340)={0x24, r5, 0x300, 0x70bd26, 0x25dfdbfb, {}, [@MPTCP_PM_ATTR_SUBFLOWS={0x8, 0x3, 0x1}, @MPTCP_PM_ATTR_RCV_ADD_ADDRS={0x8, 0x2, 0x2}]}, 0x24}, 0x1, 0x0, 0x0, 0x20000004}, 0x8890) r6 = openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000500)='./cgroup/syz1\x00', 0x200002, 0x0) syz_io_uring_submit(0x0, r2, &(0x7f0000000580)=@IORING_OP_FILES_UPDATE={0x14, 0x4, 0x0, 0x0, 0x40, &(0x7f0000000540)=[r4, 0xffffffffffffffff, r6, r0, r1], 0x5}, 0x3) 21:23:54 executing program 3: io_uring_setup(0x355e, &(0x7f0000000000)={0x0, 0x0, 0x20, 0x1, 0x1be}) syz_io_uring_setup(0x8fe, &(0x7f0000000080), &(0x7f0000ffb000/0x2000)=nil, &(0x7f0000ffb000/0x4000)=nil, &(0x7f0000000100), &(0x7f0000000140)) openat$hwrng(0xffffffffffffff9c, &(0x7f0000000180), 0x2, 0x0) syz_genetlink_get_family_id$mptcp(&(0x7f0000000300), 0xffffffffffffffff) openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000500)='./cgroup/syz1\x00', 0x200002, 0x0) syz_io_uring_submit(0x0, 0x0, 0x0, 0x3) io_uring_setup(0x2812, &(0x7f00000005c0)={0x0, 0x0, 0x2, 0x0, 0x12f}) socket$inet6_tcp(0xa, 0x1, 0x0) io_uring_setup(0x7c8f, &(0x7f0000001140)={0x0, 0xc240, 0x10, 0x3, 0x1c7}) 21:23:54 executing program 5: r0 = io_uring_setup(0x355e, &(0x7f0000000000)={0x0, 0x0, 0x20, 0x0, 0x1be}) r1 = syz_io_uring_setup(0x8fe, &(0x7f0000000080)={0x0, 0x0, 0x0, 0x0, 0x1b8}, &(0x7f0000ffb000/0x2000)=nil, &(0x7f0000ffb000/0x4000)=nil, &(0x7f0000000100), &(0x7f0000000140)=0x0) r3 = openat$hwrng(0xffffffffffffff9c, &(0x7f0000000180), 0x2, 0x0) r4 = syz_io_uring_setup(0x65dd, &(0x7f00000001c0)={0x0, 0x0, 0x0, 0x2, 0xdf}, &(0x7f0000ffe000/0x1000)=nil, &(0x7f0000ffd000/0x1000)=nil, &(0x7f0000000240), &(0x7f0000000280)) r5 = syz_genetlink_get_family_id$mptcp(0x0, r3) sendmsg$MPTCP_PM_CMD_ADD_ADDR(r3, &(0x7f00000003c0)={&(0x7f00000002c0)={0x10, 0x0, 0x0, 0x10}, 0xc, &(0x7f0000000380)={&(0x7f0000000340)={0x24, r5, 0x300, 0x70bd26, 0x25dfdbfb, {}, [@MPTCP_PM_ATTR_SUBFLOWS={0x8, 0x3, 0x1}, @MPTCP_PM_ATTR_RCV_ADD_ADDRS={0x8, 0x2, 0x2}]}, 0x24}, 0x1, 0x0, 0x0, 0x20000004}, 0x8890) r6 = openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000500)='./cgroup/syz1\x00', 0x200002, 0x0) syz_io_uring_submit(0x0, r2, &(0x7f0000000580)=@IORING_OP_FILES_UPDATE={0x14, 0x4, 0x0, 0x0, 0x40, &(0x7f0000000540)=[r4, 0xffffffffffffffff, r6, r0, r1], 0x5}, 0x3) socket$inet6_tcp(0xa, 0x1, 0x0) openat$procfs(0xffffffffffffff9c, &(0x7f00000010c0)='/proc/crypto\x00', 0x0, 0x0) 21:23:54 executing program 0: r0 = io_uring_setup(0x355e, &(0x7f0000000000)={0x0, 0x0, 0x20, 0x0, 0x1be}) openat$hwrng(0xffffffffffffff9c, &(0x7f0000000180), 0x2, 0x0) syz_io_uring_submit(0x0, 0x0, &(0x7f0000000580)=@IORING_OP_FILES_UPDATE={0x14, 0x4, 0x0, 0x0, 0x40, &(0x7f0000000540)=[0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, r0, 0xffffffffffffffff], 0x5}, 0x3) socket$inet6_tcp(0xa, 0x1, 0x0) io_uring_setup(0x7c8f, &(0x7f0000001140)={0x0, 0xc240, 0x10, 0x3, 0x1c7}) 21:23:54 executing program 4: io_uring_setup(0x355e, &(0x7f0000000000)={0x0, 0x0, 0x20, 0x1, 0x1be}) syz_io_uring_setup(0x8fe, &(0x7f0000000080), &(0x7f0000ffb000/0x2000)=nil, &(0x7f0000ffb000/0x4000)=nil, &(0x7f0000000100), &(0x7f0000000140)) openat$hwrng(0xffffffffffffff9c, &(0x7f0000000180), 0x2, 0x0) syz_genetlink_get_family_id$mptcp(&(0x7f0000000300), 0xffffffffffffffff) syz_io_uring_submit(0x0, 0x0, 0x0, 0x0) io_uring_setup(0x2812, &(0x7f00000005c0)={0x0, 0x5e1b, 0x2, 0x3, 0x12f}) socket$inet6_tcp(0xa, 0x1, 0x0) io_uring_setup(0x7c8f, &(0x7f0000001140)={0x0, 0xc240, 0x10, 0x3, 0x1c7}) 21:23:54 executing program 6: r0 = io_uring_setup(0x355e, &(0x7f0000000000)={0x0, 0x0, 0x20, 0x0, 0x1be}) r1 = syz_io_uring_setup(0x8fe, &(0x7f0000000080)={0x0, 0x1830, 0x0, 0x0, 0x0, 0x0, r0}, &(0x7f0000ffb000/0x2000)=nil, &(0x7f0000ffb000/0x4000)=nil, &(0x7f0000000100), &(0x7f0000000140)=0x0) r3 = openat$hwrng(0xffffffffffffff9c, &(0x7f0000000180), 0x2, 0x0) r4 = syz_genetlink_get_family_id$mptcp(&(0x7f0000000300), r3) sendmsg$MPTCP_PM_CMD_ADD_ADDR(r3, &(0x7f00000003c0)={&(0x7f00000002c0), 0xc, &(0x7f0000000380)={&(0x7f0000000340)={0x24, r4, 0x300, 0x0, 0x25dfdbfb, {}, [@MPTCP_PM_ATTR_SUBFLOWS={0x8, 0x3, 0x1}, @MPTCP_PM_ATTR_RCV_ADD_ADDRS={0x8, 0x2, 0x2}]}, 0x24}, 0x1, 0x0, 0x0, 0x20000004}, 0x8890) syz_io_uring_setup(0x20f8, &(0x7f0000000400)={0x0, 0x7677, 0x8, 0x3, 0x22f}, &(0x7f0000ffe000/0x2000)=nil, &(0x7f0000ffb000/0x2000)=nil, &(0x7f0000000480)=0x0, &(0x7f00000004c0)) r6 = openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000500)='./cgroup/syz1\x00', 0x200002, 0x0) syz_io_uring_submit(r5, r2, &(0x7f0000000580)=@IORING_OP_FILES_UPDATE={0x14, 0x4, 0x0, 0x0, 0x40, &(0x7f0000000540)=[0xffffffffffffffff, 0xffffffffffffffff, r6, r0, r1], 0x5}, 0x3) socket$inet6_tcp(0xa, 0x1, 0x0) openat$procfs(0xffffffffffffff9c, &(0x7f00000010c0)='/proc/crypto\x00', 0x0, 0x0) io_uring_setup(0x7c8f, &(0x7f0000001140)={0x0, 0xc240, 0x10, 0x3, 0x1c7}) 21:23:54 executing program 2: r0 = io_uring_setup(0x355e, &(0x7f0000000000)={0x0, 0x0, 0x20, 0x0, 0x1be}) syz_io_uring_setup(0x8fe, &(0x7f0000000080)={0x0, 0x1830, 0x0, 0x0, 0x0, 0x0, r0}, &(0x7f0000ffb000/0x2000)=nil, &(0x7f0000ffb000/0x4000)=nil, &(0x7f0000000100), &(0x7f0000000140)) r1 = openat$hwrng(0xffffffffffffff9c, &(0x7f0000000180), 0x2, 0x0) syz_genetlink_get_family_id$mptcp(&(0x7f0000000300), r1) sendmsg$MPTCP_PM_CMD_ADD_ADDR(r1, &(0x7f00000003c0)={&(0x7f00000002c0), 0xc, &(0x7f0000000380)={0x0}, 0x1, 0x0, 0x0, 0x20000004}, 0x8890) syz_io_uring_setup(0x20f8, &(0x7f0000000400)={0x0, 0x7677, 0x8, 0x3, 0x22f}, &(0x7f0000ffe000/0x2000)=nil, &(0x7f0000ffb000/0x2000)=nil, &(0x7f0000000480), &(0x7f00000004c0)) openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000500)='./cgroup/syz1\x00', 0x200002, 0x0) socket$inet6_tcp(0xa, 0x1, 0x0) 21:23:54 executing program 1: r0 = io_uring_setup(0x355e, &(0x7f0000000000)={0x0, 0x0, 0x20, 0x1, 0x1be}) r1 = openat$hwrng(0xffffffffffffff9c, &(0x7f0000000180), 0x2, 0x0) r2 = syz_io_uring_setup(0x65dd, &(0x7f00000001c0)={0x0, 0x0, 0x20, 0x2}, &(0x7f0000ffe000/0x1000)=nil, &(0x7f0000ffd000/0x1000)=nil, &(0x7f0000000240), &(0x7f0000000280)) syz_genetlink_get_family_id$mptcp(&(0x7f0000000300), r1) syz_io_uring_setup(0x20f8, &(0x7f0000000400)={0x0, 0x7677, 0x8, 0x3, 0x22f, 0x0, r2}, &(0x7f0000ffe000/0x2000)=nil, &(0x7f0000ffb000/0x2000)=nil, &(0x7f0000000480)=0x0, 0x0) r4 = openat$cgroup_root(0xffffffffffffff9c, 0x0, 0x200002, 0x0) syz_io_uring_submit(r3, 0x0, &(0x7f0000000580)=@IORING_OP_FILES_UPDATE={0x14, 0x4, 0x0, 0x0, 0x40, &(0x7f0000000540)=[r2, 0xffffffffffffffff, r4, r0, 0xffffffffffffffff], 0x5}, 0x3) io_uring_setup(0x2812, &(0x7f00000005c0)={0x0, 0x5e1b, 0x2, 0x3, 0x12f, 0x0, r2}) socket$inet6_tcp(0xa, 0x1, 0x0) openat$procfs(0xffffffffffffff9c, &(0x7f00000010c0)='/proc/crypto\x00', 0x0, 0x0) io_uring_setup(0x7c8f, &(0x7f0000001140)={0x0, 0xc240, 0x10, 0x3, 0x1c7, 0x0, r2}) [ 763.698627] kmemleak: Found object by alias at 0x607f1a6398ac [ 763.698649] CPU: 1 UID: 0 PID: 8439 Comm: iou-sqp-8430 Tainted: G W 6.17.0-rc3-next-20250829 #1 PREEMPT(voluntary) [ 763.698667] Tainted: [W]=WARN [ 763.698671] Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.12.0-1 04/01/2014 [ 763.698678] Call Trace: [ 763.698682] [ 763.698688] dump_stack_lvl+0xca/0x120 [ 763.698714] __lookup_object+0x94/0xb0 [ 763.698732] delete_object_full+0x27/0x70 [ 763.698748] free_percpu+0x30/0x1160 [ 763.698764] ? arch_uprobe_clear_state+0x16/0x140 [ 763.698785] futex_hash_free+0x38/0xc0 [ 763.698799] mmput+0x2d3/0x390 [ 763.698818] do_exit+0x79d/0x2970 [ 763.698834] ? __pfx_try_to_wake_up+0x10/0x10 [ 763.698852] ? __pfx_do_exit+0x10/0x10 [ 763.698864] ? io_sq_thread+0xfbd/0x1b00 [ 763.698881] ? lock_release+0xc8/0x290 [ 763.698898] io_sq_thread+0xfc9/0x1b00 [ 763.698920] ? __pfx_io_sq_thread+0x10/0x10 [ 763.698936] ? __lock_acquire+0xc65/0x1b70 [ 763.698949] ? __pfx_autoremove_wake_function+0x10/0x10 [ 763.698964] ? __lock_acquire+0xc65/0x1b70 [ 763.698984] ? do_raw_spin_lock+0x123/0x260 [ 763.699000] ? find_held_lock+0x2b/0x80 [ 763.699016] ? __pfx_io_sq_thread+0x10/0x10 [ 763.699031] ? lock_release+0xc8/0x290 [ 763.699044] ? __pfx_io_sq_thread+0x10/0x10 [ 763.699060] ret_from_fork+0x34b/0x430 [ 763.699078] ? __pfx_io_sq_thread+0x10/0x10 [ 763.699093] ret_from_fork_asm+0x1a/0x30 [ 763.699117] [ 763.699120] kmemleak: Object (percpu) 0x607f1a6398a8 (size 8): [ 763.699127] kmemleak: comm "syz-executor.7", pid 8447, jiffies 4295430530 [ 763.699135] kmemleak: min_count = 1 [ 763.699138] kmemleak: count = 0 [ 763.699142] kmemleak: flags = 0x21 [ 763.699146] kmemleak: checksum = 0 [ 763.699149] kmemleak: backtrace: [ 763.699153] pcpu_alloc_noprof+0x87a/0x1170 [ 763.699167] percpu_ref_init+0x37/0x400 [ 763.699186] io_uring_setup+0x44c/0x2000 [ 763.699197] __x64_sys_io_uring_setup+0xc8/0x170 [ 763.699208] do_syscall_64+0xbf/0x360 [ 763.699218] entry_SYSCALL_64_after_hwframe+0x77/0x7f 21:23:54 executing program 4: io_uring_setup(0x355e, &(0x7f0000000000)={0x0, 0x0, 0x20, 0x1, 0x1be}) syz_io_uring_setup(0x8fe, &(0x7f0000000080), &(0x7f0000ffb000/0x2000)=nil, &(0x7f0000ffb000/0x4000)=nil, &(0x7f0000000100), &(0x7f0000000140)) openat$hwrng(0xffffffffffffff9c, &(0x7f0000000180), 0x2, 0x0) openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000500)='./cgroup/syz1\x00', 0x200002, 0x0) syz_io_uring_submit(0x0, 0x0, 0x0, 0x0) io_uring_setup(0x2812, &(0x7f00000005c0)={0x0, 0x5e1b, 0x2, 0x3, 0x12f}) socket$inet6_tcp(0xa, 0x1, 0x0) io_uring_setup(0x7c8f, &(0x7f0000001140)={0x0, 0xc240, 0x10, 0x3, 0x1c7}) 21:23:54 executing program 0: r0 = io_uring_setup(0x355e, &(0x7f0000000000)={0x0, 0x0, 0x20, 0x0, 0x1be}) openat$hwrng(0xffffffffffffff9c, &(0x7f0000000180), 0x2, 0x0) syz_io_uring_submit(0x0, 0x0, &(0x7f0000000580)=@IORING_OP_FILES_UPDATE={0x14, 0x4, 0x0, 0x0, 0x40, &(0x7f0000000540)=[0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, r0, 0xffffffffffffffff], 0x5}, 0x3) socket$inet6_tcp(0xa, 0x1, 0x0) io_uring_setup(0x7c8f, &(0x7f0000001140)={0x0, 0xc240, 0x10, 0x3, 0x1c7}) 21:23:54 executing program 3: io_uring_setup(0x355e, &(0x7f0000000000)={0x0, 0x0, 0x20, 0x1, 0x1be}) syz_io_uring_setup(0x8fe, &(0x7f0000000080), &(0x7f0000ffb000/0x2000)=nil, &(0x7f0000ffb000/0x4000)=nil, &(0x7f0000000100), &(0x7f0000000140)) openat$hwrng(0xffffffffffffff9c, &(0x7f0000000180), 0x2, 0x0) syz_genetlink_get_family_id$mptcp(&(0x7f0000000300), 0xffffffffffffffff) openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000500)='./cgroup/syz1\x00', 0x200002, 0x0) syz_io_uring_submit(0x0, 0x0, 0x0, 0x3) io_uring_setup(0x2812, &(0x7f00000005c0)={0x0, 0x0, 0x2, 0x0, 0x12f}) socket$inet6_tcp(0xa, 0x1, 0x0) io_uring_setup(0x7c8f, &(0x7f0000001140)={0x0, 0xc240, 0x10, 0x3, 0x1c7}) 21:23:54 executing program 5: r0 = io_uring_setup(0x355e, &(0x7f0000000000)={0x0, 0x0, 0x20, 0x0, 0x1be}) r1 = syz_io_uring_setup(0x8fe, &(0x7f0000000080)={0x0, 0x0, 0x0, 0x0, 0x1b8}, &(0x7f0000ffb000/0x2000)=nil, &(0x7f0000ffb000/0x4000)=nil, &(0x7f0000000100), &(0x7f0000000140)=0x0) r3 = openat$hwrng(0xffffffffffffff9c, &(0x7f0000000180), 0x2, 0x0) r4 = syz_io_uring_setup(0x65dd, &(0x7f00000001c0)={0x0, 0x0, 0x0, 0x2, 0xdf}, &(0x7f0000ffe000/0x1000)=nil, &(0x7f0000ffd000/0x1000)=nil, &(0x7f0000000240), &(0x7f0000000280)) r5 = syz_genetlink_get_family_id$mptcp(0x0, r3) sendmsg$MPTCP_PM_CMD_ADD_ADDR(r3, &(0x7f00000003c0)={&(0x7f00000002c0)={0x10, 0x0, 0x0, 0x10}, 0xc, &(0x7f0000000380)={&(0x7f0000000340)={0x24, r5, 0x300, 0x70bd26, 0x25dfdbfb, {}, [@MPTCP_PM_ATTR_SUBFLOWS={0x8, 0x3, 0x1}, @MPTCP_PM_ATTR_RCV_ADD_ADDRS={0x8, 0x2, 0x2}]}, 0x24}, 0x1, 0x0, 0x0, 0x20000004}, 0x8890) r6 = openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000500)='./cgroup/syz1\x00', 0x200002, 0x0) syz_io_uring_submit(0x0, r2, &(0x7f0000000580)=@IORING_OP_FILES_UPDATE={0x14, 0x4, 0x0, 0x0, 0x40, &(0x7f0000000540)=[r4, 0xffffffffffffffff, r6, r0, r1], 0x5}, 0x3) socket$inet6_tcp(0xa, 0x1, 0x0) openat$procfs(0xffffffffffffff9c, &(0x7f00000010c0)='/proc/crypto\x00', 0x0, 0x0) 21:23:54 executing program 2: r0 = io_uring_setup(0x355e, &(0x7f0000000000)={0x0, 0x0, 0x20, 0x0, 0x1be}) syz_io_uring_setup(0x8fe, &(0x7f0000000080)={0x0, 0x1830, 0x0, 0x0, 0x0, 0x0, r0}, &(0x7f0000ffb000/0x2000)=nil, &(0x7f0000ffb000/0x4000)=nil, &(0x7f0000000100), &(0x7f0000000140)) r1 = openat$hwrng(0xffffffffffffff9c, &(0x7f0000000180), 0x2, 0x0) syz_genetlink_get_family_id$mptcp(&(0x7f0000000300), r1) sendmsg$MPTCP_PM_CMD_ADD_ADDR(r1, &(0x7f00000003c0)={&(0x7f00000002c0), 0xc, &(0x7f0000000380)={0x0}, 0x1, 0x0, 0x0, 0x20000004}, 0x8890) syz_io_uring_setup(0x20f8, &(0x7f0000000400)={0x0, 0x7677, 0x8, 0x3, 0x22f}, &(0x7f0000ffe000/0x2000)=nil, &(0x7f0000ffb000/0x2000)=nil, &(0x7f0000000480), &(0x7f00000004c0)) openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000500)='./cgroup/syz1\x00', 0x200002, 0x0) socket$inet6_tcp(0xa, 0x1, 0x0) 21:23:54 executing program 4: io_uring_setup(0x355e, &(0x7f0000000000)={0x0, 0x0, 0x20, 0x1, 0x1be}) syz_io_uring_setup(0x8fe, &(0x7f0000000080), &(0x7f0000ffb000/0x2000)=nil, &(0x7f0000ffb000/0x4000)=nil, &(0x7f0000000100), &(0x7f0000000140)) openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000500)='./cgroup/syz1\x00', 0x200002, 0x0) syz_io_uring_submit(0x0, 0x0, 0x0, 0x0) io_uring_setup(0x2812, &(0x7f00000005c0)={0x0, 0x5e1b, 0x2, 0x3, 0x12f}) socket$inet6_tcp(0xa, 0x1, 0x0) io_uring_setup(0x7c8f, &(0x7f0000001140)={0x0, 0xc240, 0x10, 0x3, 0x1c7}) 21:23:54 executing program 6: r0 = io_uring_setup(0x355e, &(0x7f0000000000)={0x0, 0x0, 0x20, 0x0, 0x1be}) r1 = syz_io_uring_setup(0x8fe, &(0x7f0000000080)={0x0, 0x1830, 0x0, 0x0, 0x0, 0x0, r0}, &(0x7f0000ffb000/0x2000)=nil, &(0x7f0000ffb000/0x4000)=nil, &(0x7f0000000100), &(0x7f0000000140)=0x0) r3 = openat$hwrng(0xffffffffffffff9c, &(0x7f0000000180), 0x2, 0x0) r4 = syz_genetlink_get_family_id$mptcp(&(0x7f0000000300), r3) sendmsg$MPTCP_PM_CMD_ADD_ADDR(r3, &(0x7f00000003c0)={&(0x7f00000002c0), 0xc, &(0x7f0000000380)={&(0x7f0000000340)={0x24, r4, 0x300, 0x0, 0x25dfdbfb, {}, [@MPTCP_PM_ATTR_SUBFLOWS={0x8, 0x3, 0x1}, @MPTCP_PM_ATTR_RCV_ADD_ADDRS={0x8, 0x2, 0x2}]}, 0x24}, 0x1, 0x0, 0x0, 0x20000004}, 0x8890) syz_io_uring_setup(0x20f8, &(0x7f0000000400)={0x0, 0x7677, 0x8, 0x3, 0x22f}, &(0x7f0000ffe000/0x2000)=nil, &(0x7f0000ffb000/0x2000)=nil, &(0x7f0000000480)=0x0, &(0x7f00000004c0)) r6 = openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000500)='./cgroup/syz1\x00', 0x200002, 0x0) syz_io_uring_submit(r5, r2, &(0x7f0000000580)=@IORING_OP_FILES_UPDATE={0x14, 0x4, 0x0, 0x0, 0x40, &(0x7f0000000540)=[0xffffffffffffffff, 0xffffffffffffffff, r6, r0, r1], 0x5}, 0x3) socket$inet6_tcp(0xa, 0x1, 0x0) openat$procfs(0xffffffffffffff9c, &(0x7f00000010c0)='/proc/crypto\x00', 0x0, 0x0) io_uring_setup(0x7c8f, &(0x7f0000001140)={0x0, 0xc240, 0x10, 0x3, 0x1c7}) 21:23:54 executing program 0: r0 = syz_io_uring_setup(0x8fe, &(0x7f0000000080)={0x0, 0x1830}, &(0x7f0000ffb000/0x2000)=nil, &(0x7f0000ffb000/0x4000)=nil, &(0x7f0000000100), &(0x7f0000000140)=0x0) openat$hwrng(0xffffffffffffff9c, &(0x7f0000000180), 0x2, 0x0) syz_io_uring_submit(0x0, r1, &(0x7f0000000580)=@IORING_OP_FILES_UPDATE={0x14, 0x4, 0x0, 0x0, 0x40, &(0x7f0000000540)=[0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, r0], 0x5}, 0x3) socket$inet6_tcp(0xa, 0x1, 0x0) io_uring_setup(0x7c8f, &(0x7f0000001140)={0x0, 0xc240, 0x10, 0x3, 0x1c7}) 21:23:54 executing program 7: io_uring_setup(0x355e, &(0x7f0000000000)={0x0, 0x0, 0x20, 0x0, 0x1be}) syz_io_uring_setup(0x8fe, &(0x7f0000000080)={0x0, 0x0, 0x0, 0x0, 0x1b8}, &(0x7f0000ffb000/0x2000)=nil, &(0x7f0000ffb000/0x4000)=nil, &(0x7f0000000100), &(0x7f0000000140)) r0 = openat$hwrng(0xffffffffffffff9c, &(0x7f0000000180), 0x2, 0x0) syz_io_uring_setup(0x65dd, &(0x7f00000001c0)={0x0, 0x0, 0x0, 0x0, 0xdf}, &(0x7f0000ffe000/0x1000)=nil, &(0x7f0000ffd000/0x1000)=nil, &(0x7f0000000240), &(0x7f0000000280)) r1 = syz_genetlink_get_family_id$mptcp(&(0x7f0000000300), r0) sendmsg$MPTCP_PM_CMD_ADD_ADDR(r0, &(0x7f00000003c0)={&(0x7f00000002c0)={0x10, 0x0, 0x0, 0x10}, 0xc, &(0x7f0000000380)={&(0x7f0000000340)={0x24, r1, 0x300, 0x70bd26, 0x25dfdbfb, {}, [@MPTCP_PM_ATTR_SUBFLOWS={0x8, 0x3, 0x1}, @MPTCP_PM_ATTR_RCV_ADD_ADDRS={0x8, 0x2, 0x2}]}, 0x24}, 0x1, 0x0, 0x0, 0x20000004}, 0x8890) openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000500)='./cgroup/syz1\x00', 0x200002, 0x0) 21:23:54 executing program 1: r0 = io_uring_setup(0x355e, &(0x7f0000000000)={0x0, 0x0, 0x20, 0x1, 0x1be}) r1 = openat$hwrng(0xffffffffffffff9c, &(0x7f0000000180), 0x2, 0x0) r2 = syz_io_uring_setup(0x65dd, &(0x7f00000001c0)={0x0, 0x0, 0x20, 0x2}, &(0x7f0000ffe000/0x1000)=nil, &(0x7f0000ffd000/0x1000)=nil, &(0x7f0000000240), &(0x7f0000000280)) syz_genetlink_get_family_id$mptcp(&(0x7f0000000300), r1) syz_io_uring_setup(0x20f8, &(0x7f0000000400)={0x0, 0x7677, 0x8, 0x3, 0x22f, 0x0, r2}, &(0x7f0000ffe000/0x2000)=nil, &(0x7f0000ffb000/0x2000)=nil, &(0x7f0000000480), 0x0) r3 = openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000500)='./cgroup/syz1\x00', 0x200002, 0x0) syz_io_uring_submit(0x0, 0x0, &(0x7f0000000580)=@IORING_OP_FILES_UPDATE={0x14, 0x4, 0x0, 0x0, 0x40, &(0x7f0000000540)=[r2, 0xffffffffffffffff, r3, r0, 0xffffffffffffffff], 0x5}, 0x3) io_uring_setup(0x2812, &(0x7f00000005c0)={0x0, 0x5e1b, 0x2, 0x3, 0x12f, 0x0, r2}) socket$inet6_tcp(0xa, 0x1, 0x0) openat$procfs(0xffffffffffffff9c, &(0x7f00000010c0)='/proc/crypto\x00', 0x0, 0x0) io_uring_setup(0x7c8f, &(0x7f0000001140)={0x0, 0xc240, 0x10, 0x3, 0x1c7, 0x0, r2}) 21:23:54 executing program 4: io_uring_setup(0x355e, &(0x7f0000000000)={0x0, 0x0, 0x20, 0x1, 0x1be}) openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000500)='./cgroup/syz1\x00', 0x200002, 0x0) syz_io_uring_submit(0x0, 0x0, 0x0, 0x0) io_uring_setup(0x2812, &(0x7f00000005c0)={0x0, 0x5e1b, 0x2, 0x3, 0x12f}) socket$inet6_tcp(0xa, 0x1, 0x0) io_uring_setup(0x7c8f, &(0x7f0000001140)={0x0, 0xc240, 0x10, 0x3, 0x1c7}) 21:23:54 executing program 2: r0 = io_uring_setup(0x355e, &(0x7f0000000000)={0x0, 0x0, 0x20, 0x0, 0x1be}) syz_io_uring_setup(0x8fe, &(0x7f0000000080)={0x0, 0x1830, 0x0, 0x0, 0x0, 0x0, r0}, &(0x7f0000ffb000/0x2000)=nil, &(0x7f0000ffb000/0x4000)=nil, &(0x7f0000000100), &(0x7f0000000140)) r1 = openat$hwrng(0xffffffffffffff9c, &(0x7f0000000180), 0x2, 0x0) syz_genetlink_get_family_id$mptcp(&(0x7f0000000300), r1) sendmsg$MPTCP_PM_CMD_ADD_ADDR(r1, &(0x7f00000003c0)={&(0x7f00000002c0), 0xc, &(0x7f0000000380)={0x0}, 0x1, 0x0, 0x0, 0x20000004}, 0x8890) syz_io_uring_setup(0x20f8, &(0x7f0000000400)={0x0, 0x7677, 0x8, 0x3, 0x22f}, &(0x7f0000ffe000/0x2000)=nil, &(0x7f0000ffb000/0x2000)=nil, &(0x7f0000000480), &(0x7f00000004c0)) openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000500)='./cgroup/syz1\x00', 0x200002, 0x0) socket$inet6_tcp(0xa, 0x1, 0x0) 21:23:54 executing program 5: r0 = io_uring_setup(0x355e, &(0x7f0000000000)={0x0, 0x0, 0x20, 0x0, 0x1be}) r1 = syz_io_uring_setup(0x8fe, &(0x7f0000000080)={0x0, 0x0, 0x0, 0x0, 0x1b8}, &(0x7f0000ffb000/0x2000)=nil, &(0x7f0000ffb000/0x4000)=nil, &(0x7f0000000100), &(0x7f0000000140)=0x0) r3 = openat$hwrng(0xffffffffffffff9c, &(0x7f0000000180), 0x2, 0x0) r4 = syz_io_uring_setup(0x65dd, &(0x7f00000001c0)={0x0, 0x0, 0x0, 0x2, 0xdf}, &(0x7f0000ffe000/0x1000)=nil, &(0x7f0000ffd000/0x1000)=nil, &(0x7f0000000240), &(0x7f0000000280)) r5 = syz_genetlink_get_family_id$mptcp(0x0, r3) sendmsg$MPTCP_PM_CMD_ADD_ADDR(r3, &(0x7f00000003c0)={&(0x7f00000002c0)={0x10, 0x0, 0x0, 0x10}, 0xc, &(0x7f0000000380)={&(0x7f0000000340)={0x24, r5, 0x300, 0x70bd26, 0x25dfdbfb, {}, [@MPTCP_PM_ATTR_SUBFLOWS={0x8, 0x3, 0x1}, @MPTCP_PM_ATTR_RCV_ADD_ADDRS={0x8, 0x2, 0x2}]}, 0x24}, 0x1, 0x0, 0x0, 0x20000004}, 0x8890) r6 = openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000500)='./cgroup/syz1\x00', 0x200002, 0x0) syz_io_uring_submit(0x0, r2, &(0x7f0000000580)=@IORING_OP_FILES_UPDATE={0x14, 0x4, 0x0, 0x0, 0x40, &(0x7f0000000540)=[r4, 0xffffffffffffffff, r6, r0, r1], 0x5}, 0x3) socket$inet6_tcp(0xa, 0x1, 0x0) openat$procfs(0xffffffffffffff9c, &(0x7f00000010c0)='/proc/crypto\x00', 0x0, 0x0) 21:23:54 executing program 0: r0 = syz_io_uring_setup(0x0, &(0x7f0000000080)={0x0, 0x1830}, &(0x7f0000ffb000/0x2000)=nil, &(0x7f0000ffb000/0x4000)=nil, &(0x7f0000000100), &(0x7f0000000140)=0x0) openat$hwrng(0xffffffffffffff9c, &(0x7f0000000180), 0x2, 0x0) syz_io_uring_submit(0x0, r1, &(0x7f0000000580)=@IORING_OP_FILES_UPDATE={0x14, 0x4, 0x0, 0x0, 0x40, &(0x7f0000000540)=[0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, r0], 0x5}, 0x3) socket$inet6_tcp(0xa, 0x1, 0x0) io_uring_setup(0x7c8f, &(0x7f0000001140)={0x0, 0xc240, 0x10, 0x3, 0x1c7}) 21:23:54 executing program 4: io_uring_setup(0x355e, &(0x7f0000000000)={0x0, 0x0, 0x20, 0x1, 0x1be}) openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000500)='./cgroup/syz1\x00', 0x200002, 0x0) syz_io_uring_submit(0x0, 0x0, 0x0, 0x0) io_uring_setup(0x2812, &(0x7f00000005c0)={0x0, 0x5e1b, 0x2, 0x3, 0x12f}) socket$inet6_tcp(0xa, 0x1, 0x0) io_uring_setup(0x7c8f, &(0x7f0000001140)={0x0, 0xc240, 0x10, 0x3, 0x1c7}) [ 764.146259] kmemleak: Found object by alias at 0x607f1a6398ac [ 764.146285] CPU: 0 UID: 0 PID: 8476 Comm: iou-sqp-8461 Tainted: G W 6.17.0-rc3-next-20250829 #1 PREEMPT(voluntary) [ 764.146316] Tainted: [W]=WARN [ 764.146328] Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.12.0-1 04/01/2014 [ 764.146340] Call Trace: [ 764.146347] [ 764.146354] dump_stack_lvl+0xca/0x120 [ 764.146391] __lookup_object+0x94/0xb0 [ 764.146419] delete_object_full+0x27/0x70 [ 764.146447] free_percpu+0x30/0x1160 [ 764.146475] ? arch_uprobe_clear_state+0x16/0x140 [ 764.146510] futex_hash_free+0x38/0xc0 [ 764.146534] mmput+0x2d3/0x390 [ 764.146566] do_exit+0x79d/0x2970 [ 764.146593] ? __pfx_try_to_wake_up+0x10/0x10 [ 764.146626] ? __pfx_do_exit+0x10/0x10 [ 764.146648] ? io_sq_thread+0xfbd/0x1b00 [ 764.146675] ? lock_release+0xc8/0x290 [ 764.146705] io_sq_thread+0xfc9/0x1b00 [ 764.146743] ? __pfx_io_sq_thread+0x10/0x10 [ 764.146773] ? __lock_acquire+0xc65/0x1b70 [ 764.146797] ? __pfx_autoremove_wake_function+0x10/0x10 [ 764.146823] ? __lock_acquire+0xc65/0x1b70 [ 764.146860] ? do_raw_spin_lock+0x123/0x260 [ 764.146888] ? find_held_lock+0x2b/0x80 [ 764.146917] ? __pfx_io_sq_thread+0x10/0x10 [ 764.146944] ? lock_release+0xc8/0x290 [ 764.146969] ? __pfx_io_sq_thread+0x10/0x10 [ 764.146997] ret_from_fork+0x34b/0x430 [ 764.147028] ? __pfx_io_sq_thread+0x10/0x10 [ 764.147055] ret_from_fork_asm+0x1a/0x30 [ 764.147097] [ 764.147103] kmemleak: Object (percpu) 0x607f1a6398a8 (size 8): [ 764.147115] kmemleak: comm "syz-executor.7", pid 8485, jiffies 4295430909 [ 764.147128] kmemleak: min_count = 1 [ 764.147135] kmemleak: count = 0 [ 764.147141] kmemleak: flags = 0x21 [ 764.147148] kmemleak: checksum = 0 [ 764.147155] kmemleak: backtrace: [ 764.147160] pcpu_alloc_noprof+0x87a/0x1170 [ 764.147187] percpu_ref_init+0x37/0x400 [ 764.147217] io_uring_setup+0x44c/0x2000 [ 764.147236] __x64_sys_io_uring_setup+0xc8/0x170 [ 764.147256] do_syscall_64+0xbf/0x360 [ 764.147272] entry_SYSCALL_64_after_hwframe+0x77/0x7f 21:23:54 executing program 0: r0 = syz_io_uring_setup(0x0, 0x0, &(0x7f0000ffb000/0x2000)=nil, &(0x7f0000ffb000/0x4000)=nil, &(0x7f0000000100), &(0x7f0000000140)=0x0) openat$hwrng(0xffffffffffffff9c, &(0x7f0000000180), 0x2, 0x0) syz_io_uring_submit(0x0, r1, &(0x7f0000000580)=@IORING_OP_FILES_UPDATE={0x14, 0x4, 0x0, 0x0, 0x40, &(0x7f0000000540)=[0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, r0], 0x5}, 0x3) socket$inet6_tcp(0xa, 0x1, 0x0) io_uring_setup(0x7c8f, &(0x7f0000001140)={0x0, 0xc240, 0x10, 0x3, 0x1c7}) 21:24:03 executing program 3: io_uring_setup(0x355e, &(0x7f0000000000)={0x0, 0x0, 0x20, 0x1, 0x1be}) syz_io_uring_setup(0x8fe, &(0x7f0000000080), &(0x7f0000ffb000/0x2000)=nil, &(0x7f0000ffb000/0x4000)=nil, &(0x7f0000000100), &(0x7f0000000140)) openat$hwrng(0xffffffffffffff9c, &(0x7f0000000180), 0x2, 0x0) syz_genetlink_get_family_id$mptcp(&(0x7f0000000300), 0xffffffffffffffff) openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000500)='./cgroup/syz1\x00', 0x200002, 0x0) syz_io_uring_submit(0x0, 0x0, 0x0, 0x3) io_uring_setup(0x2812, &(0x7f00000005c0)={0x0, 0x0, 0x2, 0x3}) socket$inet6_tcp(0xa, 0x1, 0x0) io_uring_setup(0x7c8f, &(0x7f0000001140)={0x0, 0xc240, 0x10, 0x3, 0x1c7}) 21:24:03 executing program 2: r0 = io_uring_setup(0x355e, &(0x7f0000000000)={0x0, 0x0, 0x20, 0x0, 0x1be}) syz_io_uring_setup(0x8fe, &(0x7f0000000080)={0x0, 0x1830, 0x0, 0x0, 0x0, 0x0, r0}, &(0x7f0000ffb000/0x2000)=nil, &(0x7f0000ffb000/0x4000)=nil, &(0x7f0000000100), &(0x7f0000000140)) r1 = openat$hwrng(0xffffffffffffff9c, &(0x7f0000000180), 0x2, 0x0) syz_genetlink_get_family_id$mptcp(&(0x7f0000000300), r1) sendmsg$MPTCP_PM_CMD_ADD_ADDR(r1, &(0x7f00000003c0)={&(0x7f00000002c0), 0xc, &(0x7f0000000380)={0x0}, 0x1, 0x0, 0x0, 0x20000004}, 0x8890) syz_io_uring_setup(0x20f8, &(0x7f0000000400)={0x0, 0x7677, 0x8, 0x3, 0x22f}, &(0x7f0000ffe000/0x2000)=nil, &(0x7f0000ffb000/0x2000)=nil, &(0x7f0000000480), &(0x7f00000004c0)) socket$inet6_tcp(0xa, 0x1, 0x0) 21:24:03 executing program 7: io_uring_setup(0x355e, &(0x7f0000000000)={0x0, 0x0, 0x20, 0x0, 0x1be}) syz_io_uring_setup(0x8fe, &(0x7f0000000080)={0x0, 0x0, 0x0, 0x0, 0x1b8}, &(0x7f0000ffb000/0x2000)=nil, &(0x7f0000ffb000/0x4000)=nil, &(0x7f0000000100), &(0x7f0000000140)) r0 = openat$hwrng(0xffffffffffffff9c, &(0x7f0000000180), 0x2, 0x0) syz_io_uring_setup(0x65dd, &(0x7f00000001c0)={0x0, 0x0, 0x0, 0x0, 0xdf}, &(0x7f0000ffe000/0x1000)=nil, &(0x7f0000ffd000/0x1000)=nil, &(0x7f0000000240), &(0x7f0000000280)) syz_genetlink_get_family_id$mptcp(&(0x7f0000000300), r0) openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000500)='./cgroup/syz1\x00', 0x200002, 0x0) 21:24:03 executing program 6: r0 = io_uring_setup(0x355e, &(0x7f0000000000)={0x0, 0x0, 0x20, 0x0, 0x1be}) r1 = syz_io_uring_setup(0x8fe, &(0x7f0000000080)={0x0, 0x1830, 0x0, 0x0, 0x0, 0x0, r0}, &(0x7f0000ffb000/0x2000)=nil, &(0x7f0000ffb000/0x4000)=nil, &(0x7f0000000100), &(0x7f0000000140)=0x0) r3 = openat$hwrng(0xffffffffffffff9c, &(0x7f0000000180), 0x2, 0x0) r4 = syz_genetlink_get_family_id$mptcp(&(0x7f0000000300), r3) sendmsg$MPTCP_PM_CMD_ADD_ADDR(r3, &(0x7f00000003c0)={&(0x7f00000002c0), 0xc, &(0x7f0000000380)={&(0x7f0000000340)={0x24, r4, 0x300, 0x0, 0x25dfdbfb, {}, [@MPTCP_PM_ATTR_SUBFLOWS={0x8, 0x3, 0x1}, @MPTCP_PM_ATTR_RCV_ADD_ADDRS={0x8, 0x2, 0x2}]}, 0x24}, 0x1, 0x0, 0x0, 0x20000004}, 0x8890) syz_io_uring_setup(0x20f8, &(0x7f0000000400)={0x0, 0x7677, 0x8, 0x3, 0x22f}, &(0x7f0000ffe000/0x2000)=nil, &(0x7f0000ffb000/0x2000)=nil, &(0x7f0000000480)=0x0, &(0x7f00000004c0)) r6 = openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000500)='./cgroup/syz1\x00', 0x200002, 0x0) syz_io_uring_submit(r5, r2, &(0x7f0000000580)=@IORING_OP_FILES_UPDATE={0x14, 0x4, 0x0, 0x0, 0x40, &(0x7f0000000540)=[0xffffffffffffffff, 0xffffffffffffffff, r6, r0, r1], 0x5}, 0x3) socket$inet6_tcp(0xa, 0x1, 0x0) openat$procfs(0xffffffffffffff9c, &(0x7f00000010c0)='/proc/crypto\x00', 0x0, 0x0) io_uring_setup(0x7c8f, &(0x7f0000001140)={0x0, 0xc240, 0x10, 0x3, 0x1c7}) 21:24:03 executing program 4: io_uring_setup(0x355e, &(0x7f0000000000)={0x0, 0x0, 0x20, 0x1, 0x1be}) openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000500)='./cgroup/syz1\x00', 0x200002, 0x0) syz_io_uring_submit(0x0, 0x0, 0x0, 0x0) io_uring_setup(0x2812, &(0x7f00000005c0)={0x0, 0x5e1b, 0x2, 0x3, 0x12f}) socket$inet6_tcp(0xa, 0x1, 0x0) io_uring_setup(0x7c8f, &(0x7f0000001140)={0x0, 0xc240, 0x10, 0x3, 0x1c7}) 21:24:03 executing program 5: r0 = io_uring_setup(0x355e, &(0x7f0000000000)={0x0, 0x0, 0x20, 0x0, 0x1be}) r1 = syz_io_uring_setup(0x8fe, &(0x7f0000000080)={0x0, 0x0, 0x0, 0x0, 0x1b8}, &(0x7f0000ffb000/0x2000)=nil, &(0x7f0000ffb000/0x4000)=nil, &(0x7f0000000100), &(0x7f0000000140)=0x0) r3 = openat$hwrng(0xffffffffffffff9c, &(0x7f0000000180), 0x2, 0x0) r4 = syz_io_uring_setup(0x65dd, &(0x7f00000001c0)={0x0, 0x0, 0x0, 0x2, 0xdf}, &(0x7f0000ffe000/0x1000)=nil, &(0x7f0000ffd000/0x1000)=nil, &(0x7f0000000240), &(0x7f0000000280)) r5 = syz_genetlink_get_family_id$mptcp(&(0x7f0000000300), 0xffffffffffffffff) sendmsg$MPTCP_PM_CMD_ADD_ADDR(r3, &(0x7f00000003c0)={&(0x7f00000002c0)={0x10, 0x0, 0x0, 0x10}, 0xc, &(0x7f0000000380)={&(0x7f0000000340)={0x24, r5, 0x300, 0x70bd26, 0x25dfdbfb, {}, [@MPTCP_PM_ATTR_SUBFLOWS={0x8, 0x3, 0x1}, @MPTCP_PM_ATTR_RCV_ADD_ADDRS={0x8, 0x2, 0x2}]}, 0x24}, 0x1, 0x0, 0x0, 0x20000004}, 0x8890) r6 = openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000500)='./cgroup/syz1\x00', 0x200002, 0x0) syz_io_uring_submit(0x0, r2, &(0x7f0000000580)=@IORING_OP_FILES_UPDATE={0x14, 0x4, 0x0, 0x0, 0x40, &(0x7f0000000540)=[r4, 0xffffffffffffffff, r6, r0, r1], 0x5}, 0x3) socket$inet6_tcp(0xa, 0x1, 0x0) openat$procfs(0xffffffffffffff9c, &(0x7f00000010c0)='/proc/crypto\x00', 0x0, 0x0) 21:24:03 executing program 0: r0 = syz_io_uring_setup(0x0, 0x0, &(0x7f0000ffb000/0x2000)=nil, &(0x7f0000ffb000/0x4000)=nil, 0x0, &(0x7f0000000140)=0x0) openat$hwrng(0xffffffffffffff9c, &(0x7f0000000180), 0x2, 0x0) syz_io_uring_submit(0x0, r1, &(0x7f0000000580)=@IORING_OP_FILES_UPDATE={0x14, 0x4, 0x0, 0x0, 0x40, &(0x7f0000000540)=[0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, r0], 0x5}, 0x3) socket$inet6_tcp(0xa, 0x1, 0x0) io_uring_setup(0x7c8f, &(0x7f0000001140)={0x0, 0xc240, 0x10, 0x3, 0x1c7}) 21:24:03 executing program 1: r0 = io_uring_setup(0x355e, &(0x7f0000000000)={0x0, 0x0, 0x20, 0x1, 0x1be}) r1 = openat$hwrng(0xffffffffffffff9c, &(0x7f0000000180), 0x2, 0x0) r2 = syz_io_uring_setup(0x65dd, &(0x7f00000001c0)={0x0, 0x0, 0x20, 0x2}, &(0x7f0000ffe000/0x1000)=nil, &(0x7f0000ffd000/0x1000)=nil, &(0x7f0000000240), &(0x7f0000000280)) syz_genetlink_get_family_id$mptcp(&(0x7f0000000300), r1) syz_io_uring_setup(0x20f8, &(0x7f0000000400)={0x0, 0x7677, 0x8, 0x3, 0x22f, 0x0, r2}, &(0x7f0000ffe000/0x2000)=nil, &(0x7f0000ffb000/0x2000)=nil, &(0x7f0000000480), 0x0) r3 = openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000500)='./cgroup/syz1\x00', 0x200002, 0x0) syz_io_uring_submit(0x0, 0x0, &(0x7f0000000580)=@IORING_OP_FILES_UPDATE={0x14, 0x4, 0x0, 0x0, 0x40, &(0x7f0000000540)=[r2, 0xffffffffffffffff, r3, r0, 0xffffffffffffffff], 0x5}, 0x3) io_uring_setup(0x2812, &(0x7f00000005c0)={0x0, 0x5e1b, 0x2, 0x3, 0x12f, 0x0, r2}) socket$inet6_tcp(0xa, 0x1, 0x0) openat$procfs(0xffffffffffffff9c, &(0x7f00000010c0)='/proc/crypto\x00', 0x0, 0x0) io_uring_setup(0x7c8f, &(0x7f0000001140)={0x0, 0xc240, 0x10, 0x3, 0x1c7, 0x0, r2}) 21:24:03 executing program 0: r0 = syz_io_uring_setup(0x0, 0x0, &(0x7f0000ffb000/0x2000)=nil, &(0x7f0000ffb000/0x4000)=nil, 0x0, 0x0) openat$hwrng(0xffffffffffffff9c, &(0x7f0000000180), 0x2, 0x0) syz_io_uring_submit(0x0, 0x0, &(0x7f0000000580)=@IORING_OP_FILES_UPDATE={0x14, 0x4, 0x0, 0x0, 0x40, &(0x7f0000000540)=[0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, r0], 0x5}, 0x3) socket$inet6_tcp(0xa, 0x1, 0x0) io_uring_setup(0x7c8f, &(0x7f0000001140)={0x0, 0xc240, 0x10, 0x3, 0x1c7}) 21:24:03 executing program 4: syz_io_uring_setup(0x8fe, &(0x7f0000000080), &(0x7f0000ffb000/0x2000)=nil, &(0x7f0000ffb000/0x4000)=nil, &(0x7f0000000100), &(0x7f0000000140)) openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000500)='./cgroup/syz1\x00', 0x200002, 0x0) syz_io_uring_submit(0x0, 0x0, 0x0, 0x0) io_uring_setup(0x2812, &(0x7f00000005c0)={0x0, 0x5e1b, 0x2, 0x3, 0x12f}) socket$inet6_tcp(0xa, 0x1, 0x0) io_uring_setup(0x7c8f, &(0x7f0000001140)={0x0, 0xc240, 0x10, 0x3, 0x1c7}) [ 773.129122] kmemleak: Found object by alias at 0x607f1a6398ac [ 773.129146] CPU: 1 UID: 0 PID: 8520 Comm: syz-executor.3 Tainted: G W 6.17.0-rc3-next-20250829 #1 PREEMPT(voluntary) [ 773.129165] Tainted: [W]=WARN [ 773.129169] Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.12.0-1 04/01/2014 [ 773.129177] Call Trace: [ 773.129181] [ 773.129186] dump_stack_lvl+0xca/0x120 [ 773.129215] __lookup_object+0x94/0xb0 [ 773.129233] delete_object_full+0x27/0x70 [ 773.129249] free_percpu+0x30/0x1160 [ 773.129266] ? arch_uprobe_clear_state+0x16/0x140 [ 773.129286] futex_hash_free+0x38/0xc0 [ 773.129300] mmput+0x2d3/0x390 [ 773.129322] do_exit+0x79d/0x2970 [ 773.129342] ? __pfx_do_exit+0x10/0x10 [ 773.129356] ? find_held_lock+0x2b/0x80 [ 773.129375] ? get_signal+0x835/0x2340 [ 773.129395] do_group_exit+0xd3/0x2a0 [ 773.129410] get_signal+0x2315/0x2340 [ 773.129427] ? trace_irq_enable.constprop.0+0xc2/0x100 [ 773.129444] ? __pfx_get_signal+0x10/0x10 [ 773.129460] ? do_futex+0x135/0x370 [ 773.129473] ? __pfx_do_futex+0x10/0x10 [ 773.129488] arch_do_signal_or_restart+0x80/0x790 [ 773.129506] ? __pfx_arch_do_signal_or_restart+0x10/0x10 [ 773.129522] ? __x64_sys_futex+0x1c9/0x4d0 [ 773.129534] ? __x64_sys_futex+0x1d2/0x4d0 [ 773.129548] ? __pfx___x64_sys_futex+0x10/0x10 [ 773.129561] ? __pfx_fput_close_sync+0x10/0x10 [ 773.129577] ? xfd_validate_state+0x55/0x180 [ 773.129598] exit_to_user_mode_loop+0x8b/0x110 [ 773.129612] do_syscall_64+0x2f7/0x360 [ 773.129624] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 773.129636] RIP: 0033:0x7f1060a76b19 [ 773.129646] Code: Unable to access opcode bytes at 0x7f1060a76aef. [ 773.129651] RSP: 002b:00007f105dfec218 EFLAGS: 00000246 ORIG_RAX: 00000000000000ca [ 773.129663] RAX: fffffffffffffe00 RBX: 00007f1060b89f68 RCX: 00007f1060a76b19 [ 773.129670] RDX: 0000000000000000 RSI: 0000000000000080 RDI: 00007f1060b89f68 [ 773.129678] RBP: 00007f1060b89f60 R08: 0000000000000000 R09: 0000000000000000 [ 773.129685] R10: 0000000000000000 R11: 0000000000000246 R12: 00007f1060b89f6c [ 773.129692] R13: 00007ffed3f8b4af R14: 00007f105dfec300 R15: 0000000000022000 [ 773.129708] [ 773.129712] kmemleak: Object (percpu) 0x607f1a6398a8 (size 8): [ 773.129718] kmemleak: comm "syz-executor.1", pid 8546, jiffies 4295439976 [ 773.129726] kmemleak: min_count = 1 [ 773.129729] kmemleak: count = 0 [ 773.129733] kmemleak: flags = 0x21 [ 773.129737] kmemleak: checksum = 0 [ 773.129741] kmemleak: backtrace: [ 773.129745] pcpu_alloc_noprof+0x87a/0x1170 [ 773.129759] percpu_ref_init+0x37/0x400 [ 773.129777] io_uring_setup+0x44c/0x2000 [ 773.129789] __x64_sys_io_uring_setup+0xc8/0x170 [ 773.129800] do_syscall_64+0xbf/0x360 [ 773.129808] entry_SYSCALL_64_after_hwframe+0x77/0x7f 21:24:12 executing program 0: r0 = syz_io_uring_setup(0x0, 0x0, &(0x7f0000ffb000/0x2000)=nil, &(0x7f0000ffb000/0x4000)=nil, 0x0, 0x0) openat$hwrng(0xffffffffffffff9c, 0x0, 0x2, 0x0) syz_io_uring_submit(0x0, 0x0, &(0x7f0000000580)=@IORING_OP_FILES_UPDATE={0x14, 0x4, 0x0, 0x0, 0x40, &(0x7f0000000540)=[0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, r0], 0x5}, 0x3) socket$inet6_tcp(0xa, 0x1, 0x0) io_uring_setup(0x7c8f, &(0x7f0000001140)={0x0, 0xc240, 0x10, 0x3, 0x1c7}) 21:24:12 executing program 7: io_uring_setup(0x355e, &(0x7f0000000000)={0x0, 0x0, 0x20, 0x0, 0x1be}) syz_io_uring_setup(0x8fe, &(0x7f0000000080)={0x0, 0x0, 0x0, 0x0, 0x1b8}, &(0x7f0000ffb000/0x2000)=nil, &(0x7f0000ffb000/0x4000)=nil, &(0x7f0000000100), &(0x7f0000000140)) openat$hwrng(0xffffffffffffff9c, &(0x7f0000000180), 0x2, 0x0) syz_io_uring_setup(0x65dd, &(0x7f00000001c0)={0x0, 0x0, 0x0, 0x0, 0xdf}, &(0x7f0000ffe000/0x1000)=nil, &(0x7f0000ffd000/0x1000)=nil, &(0x7f0000000240), &(0x7f0000000280)) openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000500)='./cgroup/syz1\x00', 0x200002, 0x0) 21:24:12 executing program 1: r0 = io_uring_setup(0x355e, &(0x7f0000000000)={0x0, 0x0, 0x20, 0x1, 0x1be}) r1 = openat$hwrng(0xffffffffffffff9c, &(0x7f0000000180), 0x2, 0x0) r2 = syz_io_uring_setup(0x65dd, &(0x7f00000001c0)={0x0, 0x0, 0x20, 0x2}, &(0x7f0000ffe000/0x1000)=nil, &(0x7f0000ffd000/0x1000)=nil, &(0x7f0000000240), &(0x7f0000000280)) syz_genetlink_get_family_id$mptcp(&(0x7f0000000300), r1) syz_io_uring_setup(0x20f8, &(0x7f0000000400)={0x0, 0x7677, 0x8, 0x3, 0x22f, 0x0, r2}, &(0x7f0000ffe000/0x2000)=nil, &(0x7f0000ffb000/0x2000)=nil, &(0x7f0000000480), 0x0) r3 = openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000500)='./cgroup/syz1\x00', 0x200002, 0x0) syz_io_uring_submit(0x0, 0x0, &(0x7f0000000580)=@IORING_OP_FILES_UPDATE={0x14, 0x4, 0x0, 0x0, 0x40, &(0x7f0000000540)=[r2, 0xffffffffffffffff, r3, r0, 0xffffffffffffffff], 0x5}, 0x3) io_uring_setup(0x2812, &(0x7f00000005c0)={0x0, 0x5e1b, 0x2, 0x3, 0x12f, 0x0, r2}) socket$inet6_tcp(0xa, 0x1, 0x0) openat$procfs(0xffffffffffffff9c, &(0x7f00000010c0)='/proc/crypto\x00', 0x0, 0x0) io_uring_setup(0x7c8f, &(0x7f0000001140)={0x0, 0xc240, 0x10, 0x3, 0x1c7, 0x0, r2}) 21:24:12 executing program 5: r0 = io_uring_setup(0x355e, &(0x7f0000000000)={0x0, 0x0, 0x20, 0x0, 0x1be}) r1 = syz_io_uring_setup(0x8fe, &(0x7f0000000080)={0x0, 0x0, 0x0, 0x0, 0x1b8}, &(0x7f0000ffb000/0x2000)=nil, &(0x7f0000ffb000/0x4000)=nil, &(0x7f0000000100), &(0x7f0000000140)=0x0) openat$hwrng(0xffffffffffffff9c, &(0x7f0000000180), 0x2, 0x0) r3 = syz_io_uring_setup(0x65dd, &(0x7f00000001c0)={0x0, 0x0, 0x0, 0x2, 0xdf}, &(0x7f0000ffe000/0x1000)=nil, &(0x7f0000ffd000/0x1000)=nil, &(0x7f0000000240), &(0x7f0000000280)) r4 = syz_genetlink_get_family_id$mptcp(&(0x7f0000000300), 0xffffffffffffffff) sendmsg$MPTCP_PM_CMD_ADD_ADDR(0xffffffffffffffff, &(0x7f00000003c0)={&(0x7f00000002c0)={0x10, 0x0, 0x0, 0x10}, 0xc, &(0x7f0000000380)={&(0x7f0000000340)={0x24, r4, 0x300, 0x70bd26, 0x25dfdbfb, {}, [@MPTCP_PM_ATTR_SUBFLOWS={0x8, 0x3, 0x1}, @MPTCP_PM_ATTR_RCV_ADD_ADDRS={0x8, 0x2, 0x2}]}, 0x24}, 0x1, 0x0, 0x0, 0x20000004}, 0x8890) r5 = openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000500)='./cgroup/syz1\x00', 0x200002, 0x0) syz_io_uring_submit(0x0, r2, &(0x7f0000000580)=@IORING_OP_FILES_UPDATE={0x14, 0x4, 0x0, 0x0, 0x40, &(0x7f0000000540)=[r3, 0xffffffffffffffff, r5, r0, r1], 0x5}, 0x3) socket$inet6_tcp(0xa, 0x1, 0x0) openat$procfs(0xffffffffffffff9c, &(0x7f00000010c0)='/proc/crypto\x00', 0x0, 0x0) 21:24:12 executing program 3: io_uring_setup(0x355e, &(0x7f0000000000)={0x0, 0x0, 0x20, 0x1, 0x1be}) syz_io_uring_setup(0x8fe, &(0x7f0000000080), &(0x7f0000ffb000/0x2000)=nil, &(0x7f0000ffb000/0x4000)=nil, &(0x7f0000000100), &(0x7f0000000140)) openat$hwrng(0xffffffffffffff9c, &(0x7f0000000180), 0x2, 0x0) syz_genetlink_get_family_id$mptcp(&(0x7f0000000300), 0xffffffffffffffff) openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000500)='./cgroup/syz1\x00', 0x200002, 0x0) syz_io_uring_submit(0x0, 0x0, 0x0, 0x3) io_uring_setup(0x2812, &(0x7f00000005c0)={0x0, 0x0, 0x2, 0x3}) socket$inet6_tcp(0xa, 0x1, 0x0) io_uring_setup(0x7c8f, &(0x7f0000001140)={0x0, 0xc240, 0x10, 0x3, 0x1c7}) 21:24:12 executing program 4: syz_io_uring_setup(0x8fe, &(0x7f0000000080), &(0x7f0000ffb000/0x2000)=nil, &(0x7f0000ffb000/0x4000)=nil, &(0x7f0000000100), &(0x7f0000000140)) openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000500)='./cgroup/syz1\x00', 0x200002, 0x0) syz_io_uring_submit(0x0, 0x0, 0x0, 0x0) io_uring_setup(0x2812, &(0x7f00000005c0)={0x0, 0x5e1b, 0x2, 0x3, 0x12f}) socket$inet6_tcp(0xa, 0x1, 0x0) io_uring_setup(0x7c8f, &(0x7f0000001140)={0x0, 0xc240, 0x10, 0x3, 0x1c7}) 21:24:12 executing program 6: r0 = io_uring_setup(0x355e, &(0x7f0000000000)={0x0, 0x0, 0x20, 0x0, 0x1be}) r1 = syz_io_uring_setup(0x8fe, &(0x7f0000000080)={0x0, 0x1830, 0x0, 0x0, 0x0, 0x0, r0}, &(0x7f0000ffb000/0x2000)=nil, &(0x7f0000ffb000/0x4000)=nil, &(0x7f0000000100), &(0x7f0000000140)=0x0) r3 = openat$hwrng(0xffffffffffffff9c, &(0x7f0000000180), 0x2, 0x0) r4 = syz_genetlink_get_family_id$mptcp(&(0x7f0000000300), r3) sendmsg$MPTCP_PM_CMD_ADD_ADDR(r3, &(0x7f00000003c0)={&(0x7f00000002c0), 0xc, &(0x7f0000000380)={&(0x7f0000000340)={0x24, r4, 0x300, 0x70bd26, 0x0, {}, [@MPTCP_PM_ATTR_SUBFLOWS={0x8, 0x3, 0x1}, @MPTCP_PM_ATTR_RCV_ADD_ADDRS={0x8, 0x2, 0x2}]}, 0x24}, 0x1, 0x0, 0x0, 0x20000004}, 0x8890) syz_io_uring_setup(0x20f8, &(0x7f0000000400)={0x0, 0x7677, 0x8, 0x3, 0x22f}, &(0x7f0000ffe000/0x2000)=nil, &(0x7f0000ffb000/0x2000)=nil, &(0x7f0000000480)=0x0, &(0x7f00000004c0)) r6 = openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000500)='./cgroup/syz1\x00', 0x200002, 0x0) syz_io_uring_submit(r5, r2, &(0x7f0000000580)=@IORING_OP_FILES_UPDATE={0x14, 0x4, 0x0, 0x0, 0x40, &(0x7f0000000540)=[0xffffffffffffffff, 0xffffffffffffffff, r6, r0, r1], 0x5}, 0x3) socket$inet6_tcp(0xa, 0x1, 0x0) openat$procfs(0xffffffffffffff9c, &(0x7f00000010c0)='/proc/crypto\x00', 0x0, 0x0) io_uring_setup(0x7c8f, &(0x7f0000001140)={0x0, 0xc240, 0x10, 0x3, 0x1c7}) 21:24:12 executing program 2: r0 = io_uring_setup(0x355e, &(0x7f0000000000)={0x0, 0x0, 0x20, 0x0, 0x1be}) syz_io_uring_setup(0x8fe, &(0x7f0000000080)={0x0, 0x1830, 0x0, 0x0, 0x0, 0x0, r0}, &(0x7f0000ffb000/0x2000)=nil, &(0x7f0000ffb000/0x4000)=nil, &(0x7f0000000100), &(0x7f0000000140)) r1 = openat$hwrng(0xffffffffffffff9c, &(0x7f0000000180), 0x2, 0x0) syz_genetlink_get_family_id$mptcp(&(0x7f0000000300), r1) sendmsg$MPTCP_PM_CMD_ADD_ADDR(r1, &(0x7f00000003c0)={&(0x7f00000002c0), 0xc, &(0x7f0000000380)={0x0}, 0x1, 0x0, 0x0, 0x20000004}, 0x8890) syz_io_uring_setup(0x20f8, &(0x7f0000000400)={0x0, 0x7677, 0x8, 0x3, 0x22f}, &(0x7f0000ffe000/0x2000)=nil, &(0x7f0000ffb000/0x2000)=nil, &(0x7f0000000480), &(0x7f00000004c0)) socket$inet6_tcp(0xa, 0x1, 0x0) 21:24:12 executing program 7: io_uring_setup(0x355e, &(0x7f0000000000)={0x0, 0x0, 0x20, 0x0, 0x1be}) syz_io_uring_setup(0x8fe, &(0x7f0000000080)={0x0, 0x0, 0x0, 0x0, 0x1b8}, &(0x7f0000ffb000/0x2000)=nil, &(0x7f0000ffb000/0x4000)=nil, &(0x7f0000000100), &(0x7f0000000140)) openat$hwrng(0xffffffffffffff9c, &(0x7f0000000180), 0x2, 0x0) openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000500)='./cgroup/syz1\x00', 0x200002, 0x0) 21:24:12 executing program 5: r0 = io_uring_setup(0x355e, &(0x7f0000000000)={0x0, 0x0, 0x20, 0x0, 0x1be}) r1 = syz_io_uring_setup(0x8fe, &(0x7f0000000080)={0x0, 0x0, 0x0, 0x0, 0x1b8}, &(0x7f0000ffb000/0x2000)=nil, &(0x7f0000ffb000/0x4000)=nil, &(0x7f0000000100), &(0x7f0000000140)=0x0) openat$hwrng(0xffffffffffffff9c, &(0x7f0000000180), 0x2, 0x0) r3 = syz_io_uring_setup(0x65dd, &(0x7f00000001c0)={0x0, 0x0, 0x0, 0x2, 0xdf}, &(0x7f0000ffe000/0x1000)=nil, &(0x7f0000ffd000/0x1000)=nil, &(0x7f0000000240), &(0x7f0000000280)) syz_genetlink_get_family_id$mptcp(&(0x7f0000000300), 0xffffffffffffffff) sendmsg$MPTCP_PM_CMD_ADD_ADDR(0xffffffffffffffff, 0x0, 0x8890) r4 = openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000500)='./cgroup/syz1\x00', 0x200002, 0x0) syz_io_uring_submit(0x0, r2, &(0x7f0000000580)=@IORING_OP_FILES_UPDATE={0x14, 0x4, 0x0, 0x0, 0x40, &(0x7f0000000540)=[r3, 0xffffffffffffffff, r4, r0, r1], 0x5}, 0x3) socket$inet6_tcp(0xa, 0x1, 0x0) openat$procfs(0xffffffffffffff9c, &(0x7f00000010c0)='/proc/crypto\x00', 0x0, 0x0) 21:24:12 executing program 0: r0 = syz_io_uring_setup(0x0, 0x0, &(0x7f0000ffb000/0x2000)=nil, &(0x7f0000ffb000/0x4000)=nil, 0x0, 0x0) openat$hwrng(0xffffffffffffff9c, 0x0, 0x0, 0x0) syz_io_uring_submit(0x0, 0x0, &(0x7f0000000580)=@IORING_OP_FILES_UPDATE={0x14, 0x4, 0x0, 0x0, 0x40, &(0x7f0000000540)=[0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, r0], 0x5}, 0x3) socket$inet6_tcp(0xa, 0x1, 0x0) io_uring_setup(0x7c8f, &(0x7f0000001140)={0x0, 0xc240, 0x10, 0x3, 0x1c7}) 21:24:12 executing program 6: r0 = io_uring_setup(0x355e, &(0x7f0000000000)={0x0, 0x0, 0x20, 0x0, 0x1be}) r1 = syz_io_uring_setup(0x8fe, &(0x7f0000000080)={0x0, 0x1830, 0x0, 0x0, 0x0, 0x0, r0}, &(0x7f0000ffb000/0x2000)=nil, &(0x7f0000ffb000/0x4000)=nil, &(0x7f0000000100), &(0x7f0000000140)=0x0) r3 = openat$hwrng(0xffffffffffffff9c, &(0x7f0000000180), 0x2, 0x0) r4 = syz_genetlink_get_family_id$mptcp(&(0x7f0000000300), r3) sendmsg$MPTCP_PM_CMD_ADD_ADDR(r3, &(0x7f00000003c0)={&(0x7f00000002c0), 0xc, &(0x7f0000000380)={&(0x7f0000000340)={0x1c, r4, 0x300, 0x70bd26, 0x0, {}, [@MPTCP_PM_ATTR_SUBFLOWS={0x8, 0x3, 0x1}]}, 0x1c}, 0x1, 0x0, 0x0, 0x20000004}, 0x8890) syz_io_uring_setup(0x20f8, &(0x7f0000000400)={0x0, 0x7677, 0x8, 0x3, 0x22f}, &(0x7f0000ffe000/0x2000)=nil, &(0x7f0000ffb000/0x2000)=nil, &(0x7f0000000480)=0x0, &(0x7f00000004c0)) r6 = openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000500)='./cgroup/syz1\x00', 0x200002, 0x0) syz_io_uring_submit(r5, r2, &(0x7f0000000580)=@IORING_OP_FILES_UPDATE={0x14, 0x4, 0x0, 0x0, 0x40, &(0x7f0000000540)=[0xffffffffffffffff, 0xffffffffffffffff, r6, r0, r1], 0x5}, 0x3) socket$inet6_tcp(0xa, 0x1, 0x0) openat$procfs(0xffffffffffffff9c, &(0x7f00000010c0)='/proc/crypto\x00', 0x0, 0x0) io_uring_setup(0x7c8f, &(0x7f0000001140)={0x0, 0xc240, 0x10, 0x3, 0x1c7}) 21:24:22 executing program 1: io_uring_setup(0x355e, &(0x7f0000000000)={0x0, 0x0, 0x20, 0x1, 0x1be}) r0 = openat$hwrng(0xffffffffffffff9c, &(0x7f0000000180), 0x2, 0x0) r1 = syz_io_uring_setup(0x65dd, &(0x7f00000001c0)={0x0, 0x0, 0x20, 0x2}, &(0x7f0000ffe000/0x1000)=nil, &(0x7f0000ffd000/0x1000)=nil, &(0x7f0000000240), &(0x7f0000000280)) syz_genetlink_get_family_id$mptcp(&(0x7f0000000300), r0) syz_io_uring_setup(0x20f8, &(0x7f0000000400)={0x0, 0x7677, 0x8, 0x3, 0x22f, 0x0, r1}, &(0x7f0000ffe000/0x2000)=nil, &(0x7f0000ffb000/0x2000)=nil, &(0x7f0000000480), 0x0) openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000500)='./cgroup/syz1\x00', 0x200002, 0x0) syz_io_uring_submit(0x0, 0x0, 0x0, 0x3) io_uring_setup(0x2812, &(0x7f00000005c0)={0x0, 0x5e1b, 0x2, 0x3, 0x12f, 0x0, r1}) socket$inet6_tcp(0xa, 0x1, 0x0) openat$procfs(0xffffffffffffff9c, &(0x7f00000010c0)='/proc/crypto\x00', 0x0, 0x0) io_uring_setup(0x7c8f, &(0x7f0000001140)={0x0, 0xc240, 0x10, 0x3, 0x1c7, 0x0, r1}) 21:24:22 executing program 7: io_uring_setup(0x355e, &(0x7f0000000000)={0x0, 0x0, 0x20, 0x0, 0x1be}) syz_io_uring_setup(0x8fe, &(0x7f0000000080)={0x0, 0x0, 0x0, 0x0, 0x1b8}, &(0x7f0000ffb000/0x2000)=nil, &(0x7f0000ffb000/0x4000)=nil, &(0x7f0000000100), &(0x7f0000000140)) openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000500)='./cgroup/syz1\x00', 0x200002, 0x0) 21:24:22 executing program 6: r0 = io_uring_setup(0x355e, &(0x7f0000000000)={0x0, 0x0, 0x20, 0x0, 0x1be}) r1 = syz_io_uring_setup(0x8fe, &(0x7f0000000080)={0x0, 0x1830, 0x0, 0x0, 0x0, 0x0, r0}, &(0x7f0000ffb000/0x2000)=nil, &(0x7f0000ffb000/0x4000)=nil, &(0x7f0000000100), &(0x7f0000000140)=0x0) r3 = openat$hwrng(0xffffffffffffff9c, &(0x7f0000000180), 0x2, 0x0) r4 = syz_genetlink_get_family_id$mptcp(&(0x7f0000000300), r3) sendmsg$MPTCP_PM_CMD_ADD_ADDR(r3, &(0x7f00000003c0)={&(0x7f00000002c0), 0xc, &(0x7f0000000380)={&(0x7f0000000340)={0x1c, r4, 0x300, 0x70bd26, 0x0, {}, [@MPTCP_PM_ATTR_SUBFLOWS={0x8, 0x3, 0x1}]}, 0x1c}, 0x1, 0x0, 0x0, 0x20000004}, 0x8890) syz_io_uring_setup(0x20f8, &(0x7f0000000400)={0x0, 0x7677, 0x8, 0x3, 0x22f}, &(0x7f0000ffe000/0x2000)=nil, &(0x7f0000ffb000/0x2000)=nil, &(0x7f0000000480)=0x0, &(0x7f00000004c0)) r6 = openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000500)='./cgroup/syz1\x00', 0x200002, 0x0) syz_io_uring_submit(r5, r2, &(0x7f0000000580)=@IORING_OP_FILES_UPDATE={0x14, 0x4, 0x0, 0x0, 0x40, &(0x7f0000000540)=[0xffffffffffffffff, 0xffffffffffffffff, r6, r0, r1], 0x5}, 0x3) socket$inet6_tcp(0xa, 0x1, 0x0) openat$procfs(0xffffffffffffff9c, &(0x7f00000010c0)='/proc/crypto\x00', 0x0, 0x0) io_uring_setup(0x7c8f, &(0x7f0000001140)={0x0, 0xc240, 0x10, 0x3, 0x1c7}) 21:24:22 executing program 3: io_uring_setup(0x355e, &(0x7f0000000000)={0x0, 0x0, 0x20, 0x1, 0x1be}) syz_io_uring_setup(0x8fe, &(0x7f0000000080), &(0x7f0000ffb000/0x2000)=nil, &(0x7f0000ffb000/0x4000)=nil, &(0x7f0000000100), &(0x7f0000000140)) openat$hwrng(0xffffffffffffff9c, &(0x7f0000000180), 0x2, 0x0) syz_genetlink_get_family_id$mptcp(&(0x7f0000000300), 0xffffffffffffffff) openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000500)='./cgroup/syz1\x00', 0x200002, 0x0) syz_io_uring_submit(0x0, 0x0, 0x0, 0x3) io_uring_setup(0x2812, &(0x7f00000005c0)={0x0, 0x0, 0x2, 0x3}) socket$inet6_tcp(0xa, 0x1, 0x0) io_uring_setup(0x7c8f, &(0x7f0000001140)={0x0, 0xc240, 0x10, 0x3, 0x1c7}) 21:24:22 executing program 5: r0 = io_uring_setup(0x355e, &(0x7f0000000000)={0x0, 0x0, 0x20, 0x0, 0x1be}) r1 = syz_io_uring_setup(0x8fe, &(0x7f0000000080)={0x0, 0x0, 0x0, 0x0, 0x1b8}, &(0x7f0000ffb000/0x2000)=nil, &(0x7f0000ffb000/0x4000)=nil, &(0x7f0000000100), &(0x7f0000000140)=0x0) openat$hwrng(0xffffffffffffff9c, &(0x7f0000000180), 0x2, 0x0) r3 = syz_io_uring_setup(0x65dd, &(0x7f00000001c0)={0x0, 0x0, 0x0, 0x2, 0xdf}, &(0x7f0000ffe000/0x1000)=nil, &(0x7f0000ffd000/0x1000)=nil, &(0x7f0000000240), &(0x7f0000000280)) syz_genetlink_get_family_id$mptcp(&(0x7f0000000300), 0xffffffffffffffff) sendmsg$MPTCP_PM_CMD_ADD_ADDR(0xffffffffffffffff, 0x0, 0x8890) r4 = openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000500)='./cgroup/syz1\x00', 0x200002, 0x0) syz_io_uring_submit(0x0, r2, &(0x7f0000000580)=@IORING_OP_FILES_UPDATE={0x14, 0x4, 0x0, 0x0, 0x40, &(0x7f0000000540)=[r3, 0xffffffffffffffff, r4, r0, r1], 0x5}, 0x3) socket$inet6_tcp(0xa, 0x1, 0x0) openat$procfs(0xffffffffffffff9c, &(0x7f00000010c0)='/proc/crypto\x00', 0x0, 0x0) 21:24:22 executing program 2: r0 = io_uring_setup(0x355e, &(0x7f0000000000)={0x0, 0x0, 0x20, 0x0, 0x1be}) syz_io_uring_setup(0x8fe, &(0x7f0000000080)={0x0, 0x1830, 0x0, 0x0, 0x0, 0x0, r0}, &(0x7f0000ffb000/0x2000)=nil, &(0x7f0000ffb000/0x4000)=nil, &(0x7f0000000100), &(0x7f0000000140)) r1 = openat$hwrng(0xffffffffffffff9c, &(0x7f0000000180), 0x2, 0x0) syz_genetlink_get_family_id$mptcp(&(0x7f0000000300), r1) sendmsg$MPTCP_PM_CMD_ADD_ADDR(r1, &(0x7f00000003c0)={&(0x7f00000002c0), 0xc, &(0x7f0000000380)={0x0}, 0x1, 0x0, 0x0, 0x20000004}, 0x8890) socket$inet6_tcp(0xa, 0x1, 0x0) 21:24:22 executing program 0: syz_io_uring_setup(0x0, 0x0, &(0x7f0000ffb000/0x2000)=nil, &(0x7f0000ffb000/0x4000)=nil, 0x0, 0x0) openat$hwrng(0xffffffffffffff9c, 0x0, 0x0, 0x0) syz_io_uring_submit(0x0, 0x0, 0x0, 0x3) socket$inet6_tcp(0xa, 0x1, 0x0) io_uring_setup(0x7c8f, &(0x7f0000001140)={0x0, 0xc240, 0x10, 0x3, 0x1c7}) 21:24:22 executing program 4: syz_io_uring_setup(0x8fe, &(0x7f0000000080), &(0x7f0000ffb000/0x2000)=nil, &(0x7f0000ffb000/0x4000)=nil, &(0x7f0000000100), &(0x7f0000000140)) openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000500)='./cgroup/syz1\x00', 0x200002, 0x0) syz_io_uring_submit(0x0, 0x0, 0x0, 0x0) io_uring_setup(0x2812, &(0x7f00000005c0)={0x0, 0x5e1b, 0x2, 0x3, 0x12f}) socket$inet6_tcp(0xa, 0x1, 0x0) io_uring_setup(0x7c8f, &(0x7f0000001140)={0x0, 0xc240, 0x10, 0x3, 0x1c7}) 21:24:22 executing program 0: syz_io_uring_setup(0x0, 0x0, &(0x7f0000ffb000/0x2000)=nil, &(0x7f0000ffb000/0x4000)=nil, 0x0, 0x0) openat$hwrng(0xffffffffffffff9c, 0x0, 0x0, 0x0) syz_io_uring_submit(0x0, 0x0, 0x0, 0x0) socket$inet6_tcp(0xa, 0x1, 0x0) io_uring_setup(0x7c8f, &(0x7f0000001140)={0x0, 0xc240, 0x10, 0x3, 0x1c7}) 21:24:22 executing program 7: io_uring_setup(0x355e, &(0x7f0000000000)={0x0, 0x0, 0x20, 0x0, 0x1be}) openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000500)='./cgroup/syz1\x00', 0x200002, 0x0) 21:24:22 executing program 4: io_uring_setup(0x0, &(0x7f0000000000)={0x0, 0x0, 0x20, 0x1, 0x1be}) syz_io_uring_setup(0x8fe, &(0x7f0000000080), &(0x7f0000ffb000/0x2000)=nil, &(0x7f0000ffb000/0x4000)=nil, &(0x7f0000000100), &(0x7f0000000140)) openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000500)='./cgroup/syz1\x00', 0x200002, 0x0) syz_io_uring_submit(0x0, 0x0, 0x0, 0x0) io_uring_setup(0x2812, &(0x7f00000005c0)={0x0, 0x5e1b, 0x2, 0x3, 0x12f}) socket$inet6_tcp(0xa, 0x1, 0x0) io_uring_setup(0x7c8f, &(0x7f0000001140)={0x0, 0xc240, 0x10, 0x3, 0x1c7}) 21:24:22 executing program 1: io_uring_setup(0x355e, &(0x7f0000000000)={0x0, 0x0, 0x20, 0x1, 0x1be}) r0 = openat$hwrng(0xffffffffffffff9c, &(0x7f0000000180), 0x2, 0x0) r1 = syz_io_uring_setup(0x65dd, &(0x7f00000001c0)={0x0, 0x0, 0x20, 0x2}, &(0x7f0000ffe000/0x1000)=nil, &(0x7f0000ffd000/0x1000)=nil, &(0x7f0000000240), &(0x7f0000000280)) syz_genetlink_get_family_id$mptcp(&(0x7f0000000300), r0) syz_io_uring_setup(0x20f8, &(0x7f0000000400)={0x0, 0x7677, 0x8, 0x3, 0x22f, 0x0, r1}, &(0x7f0000ffe000/0x2000)=nil, &(0x7f0000ffb000/0x2000)=nil, &(0x7f0000000480), 0x0) openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000500)='./cgroup/syz1\x00', 0x200002, 0x0) syz_io_uring_submit(0x0, 0x0, 0x0, 0x0) io_uring_setup(0x2812, &(0x7f00000005c0)={0x0, 0x5e1b, 0x2, 0x3, 0x12f, 0x0, r1}) socket$inet6_tcp(0xa, 0x1, 0x0) openat$procfs(0xffffffffffffff9c, &(0x7f00000010c0)='/proc/crypto\x00', 0x0, 0x0) io_uring_setup(0x7c8f, &(0x7f0000001140)={0x0, 0xc240, 0x10, 0x3, 0x1c7, 0x0, r1}) 21:24:22 executing program 6: r0 = io_uring_setup(0x355e, &(0x7f0000000000)={0x0, 0x0, 0x20, 0x0, 0x1be}) r1 = syz_io_uring_setup(0x8fe, &(0x7f0000000080)={0x0, 0x1830, 0x0, 0x0, 0x0, 0x0, r0}, &(0x7f0000ffb000/0x2000)=nil, &(0x7f0000ffb000/0x4000)=nil, &(0x7f0000000100), &(0x7f0000000140)=0x0) r3 = openat$hwrng(0xffffffffffffff9c, &(0x7f0000000180), 0x2, 0x0) r4 = syz_genetlink_get_family_id$mptcp(&(0x7f0000000300), r3) sendmsg$MPTCP_PM_CMD_ADD_ADDR(r3, &(0x7f00000003c0)={&(0x7f00000002c0), 0xc, &(0x7f0000000380)={&(0x7f0000000340)={0x1c, r4, 0x300, 0x70bd26, 0x0, {}, [@MPTCP_PM_ATTR_SUBFLOWS={0x8, 0x3, 0x1}]}, 0x1c}, 0x1, 0x0, 0x0, 0x20000004}, 0x8890) syz_io_uring_setup(0x20f8, &(0x7f0000000400)={0x0, 0x7677, 0x8, 0x3, 0x22f}, &(0x7f0000ffe000/0x2000)=nil, &(0x7f0000ffb000/0x2000)=nil, &(0x7f0000000480)=0x0, &(0x7f00000004c0)) r6 = openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000500)='./cgroup/syz1\x00', 0x200002, 0x0) syz_io_uring_submit(r5, r2, &(0x7f0000000580)=@IORING_OP_FILES_UPDATE={0x14, 0x4, 0x0, 0x0, 0x40, &(0x7f0000000540)=[0xffffffffffffffff, 0xffffffffffffffff, r6, r0, r1], 0x5}, 0x3) socket$inet6_tcp(0xa, 0x1, 0x0) openat$procfs(0xffffffffffffff9c, &(0x7f00000010c0)='/proc/crypto\x00', 0x0, 0x0) io_uring_setup(0x7c8f, &(0x7f0000001140)={0x0, 0xc240, 0x10, 0x3, 0x1c7}) 21:24:22 executing program 5: r0 = io_uring_setup(0x355e, &(0x7f0000000000)={0x0, 0x0, 0x20, 0x0, 0x1be}) r1 = syz_io_uring_setup(0x8fe, &(0x7f0000000080)={0x0, 0x0, 0x0, 0x0, 0x1b8}, &(0x7f0000ffb000/0x2000)=nil, &(0x7f0000ffb000/0x4000)=nil, &(0x7f0000000100), &(0x7f0000000140)=0x0) openat$hwrng(0xffffffffffffff9c, &(0x7f0000000180), 0x2, 0x0) r3 = syz_io_uring_setup(0x65dd, &(0x7f00000001c0)={0x0, 0x0, 0x0, 0x2, 0xdf}, &(0x7f0000ffe000/0x1000)=nil, &(0x7f0000ffd000/0x1000)=nil, &(0x7f0000000240), &(0x7f0000000280)) syz_genetlink_get_family_id$mptcp(&(0x7f0000000300), 0xffffffffffffffff) sendmsg$MPTCP_PM_CMD_ADD_ADDR(0xffffffffffffffff, 0x0, 0x8890) r4 = openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000500)='./cgroup/syz1\x00', 0x200002, 0x0) syz_io_uring_submit(0x0, r2, &(0x7f0000000580)=@IORING_OP_FILES_UPDATE={0x14, 0x4, 0x0, 0x0, 0x40, &(0x7f0000000540)=[r3, 0xffffffffffffffff, r4, r0, r1], 0x5}, 0x3) socket$inet6_tcp(0xa, 0x1, 0x0) openat$procfs(0xffffffffffffff9c, &(0x7f00000010c0)='/proc/crypto\x00', 0x0, 0x0) 21:24:22 executing program 3: io_uring_setup(0x355e, &(0x7f0000000000)={0x0, 0x0, 0x20, 0x1, 0x1be}) syz_io_uring_setup(0x8fe, &(0x7f0000000080), &(0x7f0000ffb000/0x2000)=nil, &(0x7f0000ffb000/0x4000)=nil, &(0x7f0000000100), &(0x7f0000000140)) openat$hwrng(0xffffffffffffff9c, &(0x7f0000000180), 0x2, 0x0) syz_genetlink_get_family_id$mptcp(&(0x7f0000000300), 0xffffffffffffffff) openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000500)='./cgroup/syz1\x00', 0x200002, 0x0) syz_io_uring_submit(0x0, 0x0, 0x0, 0x3) io_uring_setup(0x2812, &(0x7f00000005c0)={0x0, 0x0, 0x2, 0x3, 0x12f}) socket$inet6_tcp(0xa, 0x1, 0x0) io_uring_setup(0x0, &(0x7f0000001140)={0x0, 0xc240, 0x10, 0x3, 0x1c7}) 21:24:22 executing program 7: openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000500)='./cgroup/syz1\x00', 0x200002, 0x0) 21:24:22 executing program 2: r0 = io_uring_setup(0x355e, &(0x7f0000000000)={0x0, 0x0, 0x20, 0x0, 0x1be}) syz_io_uring_setup(0x8fe, &(0x7f0000000080)={0x0, 0x1830, 0x0, 0x0, 0x0, 0x0, r0}, &(0x7f0000ffb000/0x2000)=nil, &(0x7f0000ffb000/0x4000)=nil, &(0x7f0000000100), &(0x7f0000000140)) r1 = openat$hwrng(0xffffffffffffff9c, &(0x7f0000000180), 0x2, 0x0) syz_genetlink_get_family_id$mptcp(&(0x7f0000000300), r1) sendmsg$MPTCP_PM_CMD_ADD_ADDR(r1, &(0x7f00000003c0)={&(0x7f00000002c0), 0xc, &(0x7f0000000380)={0x0}, 0x1, 0x0, 0x0, 0x20000004}, 0x8890) socket$inet6_tcp(0xa, 0x1, 0x0) 21:24:22 executing program 0: syz_io_uring_setup(0x0, 0x0, &(0x7f0000ffb000/0x2000)=nil, &(0x7f0000ffb000/0x4000)=nil, 0x0, 0x0) openat$hwrng(0xffffffffffffff9c, 0x0, 0x0, 0x0) syz_io_uring_submit(0x0, 0x0, 0x0, 0x0) socket$inet6_tcp(0xa, 0x1, 0x0) io_uring_setup(0x0, &(0x7f0000001140)={0x0, 0xc240, 0x10, 0x3, 0x1c7}) 21:24:22 executing program 4: io_uring_setup(0x0, &(0x7f0000000000)={0x0, 0x0, 0x20, 0x1, 0x1be}) syz_io_uring_setup(0x8fe, &(0x7f0000000080), &(0x7f0000ffb000/0x2000)=nil, &(0x7f0000ffb000/0x4000)=nil, &(0x7f0000000100), &(0x7f0000000140)) openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000500)='./cgroup/syz1\x00', 0x200002, 0x0) syz_io_uring_submit(0x0, 0x0, 0x0, 0x0) io_uring_setup(0x2812, &(0x7f00000005c0)={0x0, 0x5e1b, 0x2, 0x3, 0x12f}) socket$inet6_tcp(0xa, 0x1, 0x0) io_uring_setup(0x7c8f, &(0x7f0000001140)={0x0, 0xc240, 0x10, 0x3, 0x1c7}) 21:24:22 executing program 7: openat$cgroup_root(0xffffffffffffff9c, 0x0, 0x200002, 0x0) 21:24:22 executing program 0: syz_io_uring_setup(0x0, 0x0, &(0x7f0000ffb000/0x2000)=nil, &(0x7f0000ffb000/0x4000)=nil, 0x0, 0x0) openat$hwrng(0xffffffffffffff9c, 0x0, 0x0, 0x0) syz_io_uring_submit(0x0, 0x0, 0x0, 0x0) socket$inet6_tcp(0xa, 0x1, 0x0) io_uring_setup(0x0, &(0x7f0000001140)={0x0, 0xc240, 0x10, 0x3, 0x1c7}) 21:24:22 executing program 4: io_uring_setup(0x0, &(0x7f0000000000)={0x0, 0x0, 0x20, 0x1, 0x1be}) syz_io_uring_setup(0x8fe, &(0x7f0000000080), &(0x7f0000ffb000/0x2000)=nil, &(0x7f0000ffb000/0x4000)=nil, &(0x7f0000000100), &(0x7f0000000140)) openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000500)='./cgroup/syz1\x00', 0x200002, 0x0) syz_io_uring_submit(0x0, 0x0, 0x0, 0x0) io_uring_setup(0x2812, &(0x7f00000005c0)={0x0, 0x5e1b, 0x2, 0x3, 0x12f}) socket$inet6_tcp(0xa, 0x1, 0x0) io_uring_setup(0x7c8f, &(0x7f0000001140)={0x0, 0xc240, 0x10, 0x3, 0x1c7}) 21:24:32 executing program 4: io_uring_setup(0x355e, 0x0) syz_io_uring_setup(0x8fe, &(0x7f0000000080), &(0x7f0000ffb000/0x2000)=nil, &(0x7f0000ffb000/0x4000)=nil, &(0x7f0000000100), &(0x7f0000000140)) openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000500)='./cgroup/syz1\x00', 0x200002, 0x0) syz_io_uring_submit(0x0, 0x0, 0x0, 0x0) io_uring_setup(0x2812, &(0x7f00000005c0)={0x0, 0x5e1b, 0x2, 0x3, 0x12f}) socket$inet6_tcp(0xa, 0x1, 0x0) io_uring_setup(0x7c8f, &(0x7f0000001140)={0x0, 0xc240, 0x10, 0x3, 0x1c7}) 21:24:32 executing program 0: syz_io_uring_setup(0x0, 0x0, &(0x7f0000ffb000/0x2000)=nil, &(0x7f0000ffb000/0x4000)=nil, 0x0, 0x0) openat$hwrng(0xffffffffffffff9c, 0x0, 0x0, 0x0) syz_io_uring_submit(0x0, 0x0, 0x0, 0x0) socket$inet6_tcp(0xa, 0x1, 0x0) io_uring_setup(0x0, &(0x7f0000001140)={0x0, 0xc240, 0x10, 0x3, 0x1c7}) 21:24:32 executing program 3: io_uring_setup(0x355e, &(0x7f0000000000)={0x0, 0x0, 0x20, 0x1, 0x1be}) syz_io_uring_setup(0x8fe, &(0x7f0000000080), &(0x7f0000ffb000/0x2000)=nil, &(0x7f0000ffb000/0x4000)=nil, &(0x7f0000000100), &(0x7f0000000140)) openat$hwrng(0xffffffffffffff9c, &(0x7f0000000180), 0x2, 0x0) syz_genetlink_get_family_id$mptcp(&(0x7f0000000300), 0xffffffffffffffff) openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000500)='./cgroup/syz1\x00', 0x200002, 0x0) syz_io_uring_submit(0x0, 0x0, 0x0, 0x3) io_uring_setup(0x2812, &(0x7f00000005c0)={0x0, 0x0, 0x2, 0x3, 0x12f}) socket$inet6_tcp(0xa, 0x1, 0x0) io_uring_setup(0x0, &(0x7f0000001140)={0x0, 0xc240, 0x10, 0x3, 0x1c7}) 21:24:32 executing program 1: io_uring_setup(0x355e, &(0x7f0000000000)={0x0, 0x0, 0x20, 0x1, 0x1be}) r0 = openat$hwrng(0xffffffffffffff9c, &(0x7f0000000180), 0x2, 0x0) r1 = syz_io_uring_setup(0x65dd, &(0x7f00000001c0)={0x0, 0x0, 0x20, 0x2}, &(0x7f0000ffe000/0x1000)=nil, &(0x7f0000ffd000/0x1000)=nil, &(0x7f0000000240), &(0x7f0000000280)) syz_genetlink_get_family_id$mptcp(&(0x7f0000000300), r0) syz_io_uring_setup(0x20f8, &(0x7f0000000400)={0x0, 0x7677, 0x8, 0x3, 0x22f, 0x0, r1}, &(0x7f0000ffe000/0x2000)=nil, &(0x7f0000ffb000/0x2000)=nil, &(0x7f0000000480), 0x0) openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000500)='./cgroup/syz1\x00', 0x200002, 0x0) syz_io_uring_submit(0x0, 0x0, 0x0, 0x0) io_uring_setup(0x2812, &(0x7f00000005c0)={0x0, 0x5e1b, 0x2, 0x3, 0x12f, 0x0, r1}) socket$inet6_tcp(0xa, 0x1, 0x0) openat$procfs(0xffffffffffffff9c, &(0x7f00000010c0)='/proc/crypto\x00', 0x0, 0x0) io_uring_setup(0x7c8f, &(0x7f0000001140)={0x0, 0xc240, 0x10, 0x3, 0x1c7, 0x0, r1}) 21:24:32 executing program 5: r0 = io_uring_setup(0x355e, &(0x7f0000000000)={0x0, 0x0, 0x20, 0x0, 0x1be}) r1 = syz_io_uring_setup(0x8fe, &(0x7f0000000080)={0x0, 0x0, 0x0, 0x0, 0x1b8}, &(0x7f0000ffb000/0x2000)=nil, &(0x7f0000ffb000/0x4000)=nil, &(0x7f0000000100), &(0x7f0000000140)=0x0) openat$hwrng(0xffffffffffffff9c, &(0x7f0000000180), 0x2, 0x0) r3 = syz_io_uring_setup(0x65dd, &(0x7f00000001c0)={0x0, 0x0, 0x0, 0x2, 0xdf}, &(0x7f0000ffe000/0x1000)=nil, &(0x7f0000ffd000/0x1000)=nil, &(0x7f0000000240), &(0x7f0000000280)) r4 = syz_genetlink_get_family_id$mptcp(&(0x7f0000000300), 0xffffffffffffffff) sendmsg$MPTCP_PM_CMD_ADD_ADDR(0xffffffffffffffff, &(0x7f00000003c0)={0x0, 0x0, &(0x7f0000000380)={&(0x7f0000000340)={0x24, r4, 0x300, 0x70bd26, 0x25dfdbfb, {}, [@MPTCP_PM_ATTR_SUBFLOWS={0x8, 0x3, 0x1}, @MPTCP_PM_ATTR_RCV_ADD_ADDRS={0x8, 0x2, 0x2}]}, 0x24}, 0x1, 0x0, 0x0, 0x20000004}, 0x8890) r5 = openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000500)='./cgroup/syz1\x00', 0x200002, 0x0) syz_io_uring_submit(0x0, r2, &(0x7f0000000580)=@IORING_OP_FILES_UPDATE={0x14, 0x4, 0x0, 0x0, 0x40, &(0x7f0000000540)=[r3, 0xffffffffffffffff, r5, r0, r1], 0x5}, 0x3) socket$inet6_tcp(0xa, 0x1, 0x0) openat$procfs(0xffffffffffffff9c, &(0x7f00000010c0)='/proc/crypto\x00', 0x0, 0x0) 21:24:32 executing program 2: r0 = io_uring_setup(0x355e, &(0x7f0000000000)={0x0, 0x0, 0x20, 0x0, 0x1be}) syz_io_uring_setup(0x8fe, &(0x7f0000000080)={0x0, 0x1830, 0x0, 0x0, 0x0, 0x0, r0}, &(0x7f0000ffb000/0x2000)=nil, &(0x7f0000ffb000/0x4000)=nil, &(0x7f0000000100), &(0x7f0000000140)) r1 = openat$hwrng(0xffffffffffffff9c, &(0x7f0000000180), 0x2, 0x0) syz_genetlink_get_family_id$mptcp(&(0x7f0000000300), r1) sendmsg$MPTCP_PM_CMD_ADD_ADDR(r1, &(0x7f00000003c0)={&(0x7f00000002c0), 0xc, &(0x7f0000000380)={0x0}, 0x1, 0x0, 0x0, 0x20000004}, 0x8890) socket$inet6_tcp(0xa, 0x1, 0x0) 21:24:32 executing program 7: openat$cgroup_root(0xffffffffffffff9c, 0x0, 0x200002, 0x0) 21:24:32 executing program 6: r0 = io_uring_setup(0x355e, &(0x7f0000000000)={0x0, 0x0, 0x20, 0x0, 0x1be}) r1 = syz_io_uring_setup(0x8fe, &(0x7f0000000080)={0x0, 0x1830, 0x0, 0x0, 0x0, 0x0, r0}, &(0x7f0000ffb000/0x2000)=nil, &(0x7f0000ffb000/0x4000)=nil, &(0x7f0000000100), &(0x7f0000000140)=0x0) r3 = openat$hwrng(0xffffffffffffff9c, &(0x7f0000000180), 0x2, 0x0) r4 = syz_genetlink_get_family_id$mptcp(&(0x7f0000000300), r3) sendmsg$MPTCP_PM_CMD_ADD_ADDR(r3, &(0x7f00000003c0)={&(0x7f00000002c0), 0xc, &(0x7f0000000380)={&(0x7f0000000340)={0x24, r4, 0x300, 0x70bd26, 0x0, {}, [@MPTCP_PM_ATTR_SUBFLOWS={0x8, 0x3, 0x1}, @MPTCP_PM_ATTR_RCV_ADD_ADDRS={0x8}]}, 0x24}, 0x1, 0x0, 0x0, 0x20000004}, 0x8890) syz_io_uring_setup(0x20f8, &(0x7f0000000400)={0x0, 0x7677, 0x8, 0x3, 0x22f}, &(0x7f0000ffe000/0x2000)=nil, &(0x7f0000ffb000/0x2000)=nil, &(0x7f0000000480)=0x0, &(0x7f00000004c0)) r6 = openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000500)='./cgroup/syz1\x00', 0x200002, 0x0) syz_io_uring_submit(r5, r2, &(0x7f0000000580)=@IORING_OP_FILES_UPDATE={0x14, 0x4, 0x0, 0x0, 0x40, &(0x7f0000000540)=[0xffffffffffffffff, 0xffffffffffffffff, r6, r0, r1], 0x5}, 0x3) socket$inet6_tcp(0xa, 0x1, 0x0) openat$procfs(0xffffffffffffff9c, &(0x7f00000010c0)='/proc/crypto\x00', 0x0, 0x0) io_uring_setup(0x7c8f, &(0x7f0000001140)={0x0, 0xc240, 0x10, 0x3, 0x1c7}) 21:24:42 executing program 7: openat$cgroup_root(0xffffffffffffff9c, 0x0, 0x200002, 0x0) 21:24:42 executing program 6: r0 = io_uring_setup(0x355e, &(0x7f0000000000)={0x0, 0x0, 0x20, 0x0, 0x1be}) r1 = syz_io_uring_setup(0x8fe, &(0x7f0000000080)={0x0, 0x1830, 0x0, 0x0, 0x0, 0x0, r0}, &(0x7f0000ffb000/0x2000)=nil, &(0x7f0000ffb000/0x4000)=nil, &(0x7f0000000100), &(0x7f0000000140)=0x0) r3 = openat$hwrng(0xffffffffffffff9c, &(0x7f0000000180), 0x2, 0x0) r4 = syz_genetlink_get_family_id$mptcp(&(0x7f0000000300), r3) sendmsg$MPTCP_PM_CMD_ADD_ADDR(r3, &(0x7f00000003c0)={&(0x7f00000002c0), 0xc, &(0x7f0000000380)={&(0x7f0000000340)={0x24, r4, 0x300, 0x70bd26, 0x0, {}, [@MPTCP_PM_ATTR_SUBFLOWS={0x8, 0x3, 0x1}, @MPTCP_PM_ATTR_RCV_ADD_ADDRS={0x8}]}, 0x24}, 0x1, 0x0, 0x0, 0x20000004}, 0x8890) syz_io_uring_setup(0x20f8, &(0x7f0000000400)={0x0, 0x7677, 0x8, 0x3, 0x22f}, &(0x7f0000ffe000/0x2000)=nil, &(0x7f0000ffb000/0x2000)=nil, &(0x7f0000000480)=0x0, &(0x7f00000004c0)) r6 = openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000500)='./cgroup/syz1\x00', 0x200002, 0x0) syz_io_uring_submit(r5, r2, &(0x7f0000000580)=@IORING_OP_FILES_UPDATE={0x14, 0x4, 0x0, 0x0, 0x40, &(0x7f0000000540)=[0xffffffffffffffff, 0xffffffffffffffff, r6, r0, r1], 0x5}, 0x3) socket$inet6_tcp(0xa, 0x1, 0x0) openat$procfs(0xffffffffffffff9c, &(0x7f00000010c0)='/proc/crypto\x00', 0x0, 0x0) io_uring_setup(0x7c8f, &(0x7f0000001140)={0x0, 0xc240, 0x10, 0x3, 0x1c7}) 21:24:42 executing program 1: io_uring_setup(0x355e, &(0x7f0000000000)={0x0, 0x0, 0x20, 0x1, 0x1be}) r0 = openat$hwrng(0xffffffffffffff9c, &(0x7f0000000180), 0x2, 0x0) r1 = syz_io_uring_setup(0x65dd, &(0x7f00000001c0)={0x0, 0x0, 0x20, 0x2}, &(0x7f0000ffe000/0x1000)=nil, &(0x7f0000ffd000/0x1000)=nil, &(0x7f0000000240), &(0x7f0000000280)) syz_genetlink_get_family_id$mptcp(&(0x7f0000000300), r0) syz_io_uring_setup(0x20f8, &(0x7f0000000400)={0x0, 0x7677, 0x8, 0x3, 0x22f, 0x0, r1}, &(0x7f0000ffe000/0x2000)=nil, &(0x7f0000ffb000/0x2000)=nil, &(0x7f0000000480), 0x0) openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000500)='./cgroup/syz1\x00', 0x200002, 0x0) syz_io_uring_submit(0x0, 0x0, 0x0, 0x0) io_uring_setup(0x2812, &(0x7f00000005c0)={0x0, 0x5e1b, 0x2, 0x3, 0x12f, 0x0, r1}) socket$inet6_tcp(0xa, 0x1, 0x0) openat$procfs(0xffffffffffffff9c, &(0x7f00000010c0)='/proc/crypto\x00', 0x0, 0x0) io_uring_setup(0x7c8f, &(0x7f0000001140)={0x0, 0xc240, 0x10, 0x3, 0x1c7, 0x0, r1}) 21:24:42 executing program 3: io_uring_setup(0x355e, &(0x7f0000000000)={0x0, 0x0, 0x20, 0x1, 0x1be}) syz_io_uring_setup(0x8fe, &(0x7f0000000080), &(0x7f0000ffb000/0x2000)=nil, &(0x7f0000ffb000/0x4000)=nil, &(0x7f0000000100), &(0x7f0000000140)) openat$hwrng(0xffffffffffffff9c, &(0x7f0000000180), 0x2, 0x0) syz_genetlink_get_family_id$mptcp(&(0x7f0000000300), 0xffffffffffffffff) openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000500)='./cgroup/syz1\x00', 0x200002, 0x0) syz_io_uring_submit(0x0, 0x0, 0x0, 0x3) io_uring_setup(0x2812, &(0x7f00000005c0)={0x0, 0x0, 0x2, 0x3, 0x12f}) socket$inet6_tcp(0xa, 0x1, 0x0) io_uring_setup(0x0, &(0x7f0000001140)={0x0, 0xc240, 0x10, 0x3, 0x1c7}) 21:24:42 executing program 4: io_uring_setup(0x355e, 0x0) syz_io_uring_setup(0x8fe, &(0x7f0000000080), &(0x7f0000ffb000/0x2000)=nil, &(0x7f0000ffb000/0x4000)=nil, &(0x7f0000000100), &(0x7f0000000140)) openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000500)='./cgroup/syz1\x00', 0x200002, 0x0) syz_io_uring_submit(0x0, 0x0, 0x0, 0x0) io_uring_setup(0x2812, &(0x7f00000005c0)={0x0, 0x5e1b, 0x2, 0x3, 0x12f}) socket$inet6_tcp(0xa, 0x1, 0x0) io_uring_setup(0x7c8f, &(0x7f0000001140)={0x0, 0xc240, 0x10, 0x3, 0x1c7}) 21:24:42 executing program 5: r0 = io_uring_setup(0x355e, &(0x7f0000000000)={0x0, 0x0, 0x20, 0x0, 0x1be}) r1 = syz_io_uring_setup(0x8fe, &(0x7f0000000080)={0x0, 0x0, 0x0, 0x0, 0x1b8}, &(0x7f0000ffb000/0x2000)=nil, &(0x7f0000ffb000/0x4000)=nil, &(0x7f0000000100), &(0x7f0000000140)=0x0) openat$hwrng(0xffffffffffffff9c, &(0x7f0000000180), 0x2, 0x0) r3 = syz_io_uring_setup(0x65dd, &(0x7f00000001c0)={0x0, 0x0, 0x0, 0x2, 0xdf}, &(0x7f0000ffe000/0x1000)=nil, &(0x7f0000ffd000/0x1000)=nil, &(0x7f0000000240), &(0x7f0000000280)) r4 = syz_genetlink_get_family_id$mptcp(&(0x7f0000000300), 0xffffffffffffffff) sendmsg$MPTCP_PM_CMD_ADD_ADDR(0xffffffffffffffff, &(0x7f00000003c0)={0x0, 0x0, &(0x7f0000000380)={&(0x7f0000000340)={0x24, r4, 0x300, 0x70bd26, 0x25dfdbfb, {}, [@MPTCP_PM_ATTR_SUBFLOWS={0x8, 0x3, 0x1}, @MPTCP_PM_ATTR_RCV_ADD_ADDRS={0x8, 0x2, 0x2}]}, 0x24}, 0x1, 0x0, 0x0, 0x20000004}, 0x8890) r5 = openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000500)='./cgroup/syz1\x00', 0x200002, 0x0) syz_io_uring_submit(0x0, r2, &(0x7f0000000580)=@IORING_OP_FILES_UPDATE={0x14, 0x4, 0x0, 0x0, 0x40, &(0x7f0000000540)=[r3, 0xffffffffffffffff, r5, r0, r1], 0x5}, 0x3) socket$inet6_tcp(0xa, 0x1, 0x0) openat$procfs(0xffffffffffffff9c, &(0x7f00000010c0)='/proc/crypto\x00', 0x0, 0x0) 21:24:42 executing program 2: r0 = io_uring_setup(0x355e, &(0x7f0000000000)={0x0, 0x0, 0x20, 0x0, 0x1be}) syz_io_uring_setup(0x8fe, &(0x7f0000000080)={0x0, 0x1830, 0x0, 0x0, 0x0, 0x0, r0}, &(0x7f0000ffb000/0x2000)=nil, &(0x7f0000ffb000/0x4000)=nil, &(0x7f0000000100), &(0x7f0000000140)) r1 = openat$hwrng(0xffffffffffffff9c, &(0x7f0000000180), 0x2, 0x0) syz_genetlink_get_family_id$mptcp(&(0x7f0000000300), r1) syz_io_uring_setup(0x20f8, &(0x7f0000000400)={0x0, 0x7677, 0x8, 0x3, 0x22f}, &(0x7f0000ffe000/0x2000)=nil, &(0x7f0000ffb000/0x2000)=nil, &(0x7f0000000480), &(0x7f00000004c0)) socket$inet6_tcp(0xa, 0x1, 0x0) 21:24:42 executing program 0: syz_io_uring_setup(0x0, 0x0, &(0x7f0000ffb000/0x2000)=nil, &(0x7f0000ffb000/0x4000)=nil, 0x0, 0x0) openat$hwrng(0xffffffffffffff9c, 0x0, 0x0, 0x0) syz_io_uring_submit(0x0, 0x0, 0x0, 0x0) socket$inet6_tcp(0xa, 0x1, 0x0) io_uring_setup(0x7c8f, 0x0) 21:24:42 executing program 7: io_uring_setup(0x355e, &(0x7f0000000000)={0x0, 0x0, 0x20, 0x1, 0x1be}) syz_io_uring_setup(0x8fe, &(0x7f0000000080), &(0x7f0000ffb000/0x2000)=nil, &(0x7f0000ffb000/0x4000)=nil, &(0x7f0000000100), &(0x7f0000000140)) openat$hwrng(0xffffffffffffff9c, &(0x7f0000000180), 0x2, 0x0) syz_genetlink_get_family_id$mptcp(&(0x7f0000000300), 0xffffffffffffffff) openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000500)='./cgroup/syz1\x00', 0x200002, 0x0) syz_io_uring_submit(0x0, 0x0, 0x0, 0x3) io_uring_setup(0x2812, &(0x7f00000005c0)={0x0, 0x0, 0x2, 0x3, 0x12f}) socket$inet6_tcp(0xa, 0x1, 0x0) io_uring_setup(0x0, &(0x7f0000001140)={0x0, 0xc240, 0x10, 0x3, 0x1c7}) 21:24:42 executing program 4: io_uring_setup(0x355e, 0x0) syz_io_uring_setup(0x8fe, &(0x7f0000000080), &(0x7f0000ffb000/0x2000)=nil, &(0x7f0000ffb000/0x4000)=nil, &(0x7f0000000100), &(0x7f0000000140)) openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000500)='./cgroup/syz1\x00', 0x200002, 0x0) syz_io_uring_submit(0x0, 0x0, 0x0, 0x0) io_uring_setup(0x2812, &(0x7f00000005c0)={0x0, 0x5e1b, 0x2, 0x3, 0x12f}) socket$inet6_tcp(0xa, 0x1, 0x0) io_uring_setup(0x7c8f, &(0x7f0000001140)={0x0, 0xc240, 0x10, 0x3, 0x1c7}) 21:24:42 executing program 0: syz_io_uring_setup(0x0, 0x0, &(0x7f0000ffb000/0x2000)=nil, &(0x7f0000ffb000/0x4000)=nil, 0x0, 0x0) openat$hwrng(0xffffffffffffff9c, 0x0, 0x0, 0x0) syz_io_uring_submit(0x0, 0x0, 0x0, 0x0) socket$inet6_tcp(0xa, 0x1, 0x0) io_uring_setup(0x7c8f, 0x0) 21:24:42 executing program 1: io_uring_setup(0x355e, &(0x7f0000000000)={0x0, 0x0, 0x20, 0x1, 0x1be}) r0 = openat$hwrng(0xffffffffffffff9c, &(0x7f0000000180), 0x2, 0x0) r1 = syz_io_uring_setup(0x65dd, &(0x7f00000001c0)={0x0, 0x0, 0x20, 0x2}, &(0x7f0000ffe000/0x1000)=nil, &(0x7f0000ffd000/0x1000)=nil, &(0x7f0000000240), &(0x7f0000000280)) syz_genetlink_get_family_id$mptcp(&(0x7f0000000300), r0) syz_io_uring_setup(0x20f8, &(0x7f0000000400)={0x0, 0x7677, 0x8, 0x3, 0x22f, 0x0, r1}, &(0x7f0000ffe000/0x2000)=nil, &(0x7f0000ffb000/0x2000)=nil, &(0x7f0000000480), 0x0) openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000500)='./cgroup/syz1\x00', 0x200002, 0x0) syz_io_uring_submit(0x0, 0x0, 0x0, 0x0) io_uring_setup(0x0, &(0x7f00000005c0)={0x0, 0x5e1b, 0x2, 0x3, 0x12f, 0x0, r1}) socket$inet6_tcp(0xa, 0x1, 0x0) openat$procfs(0xffffffffffffff9c, &(0x7f00000010c0)='/proc/crypto\x00', 0x0, 0x0) io_uring_setup(0x7c8f, &(0x7f0000001140)={0x0, 0xc240, 0x10, 0x3, 0x1c7, 0x0, r1}) 21:24:42 executing program 5: r0 = io_uring_setup(0x355e, &(0x7f0000000000)={0x0, 0x0, 0x20, 0x0, 0x1be}) r1 = syz_io_uring_setup(0x8fe, &(0x7f0000000080)={0x0, 0x0, 0x0, 0x0, 0x1b8}, &(0x7f0000ffb000/0x2000)=nil, &(0x7f0000ffb000/0x4000)=nil, &(0x7f0000000100), &(0x7f0000000140)=0x0) openat$hwrng(0xffffffffffffff9c, &(0x7f0000000180), 0x2, 0x0) r3 = syz_io_uring_setup(0x65dd, &(0x7f00000001c0)={0x0, 0x0, 0x0, 0x2, 0xdf}, &(0x7f0000ffe000/0x1000)=nil, &(0x7f0000ffd000/0x1000)=nil, &(0x7f0000000240), &(0x7f0000000280)) r4 = syz_genetlink_get_family_id$mptcp(&(0x7f0000000300), 0xffffffffffffffff) sendmsg$MPTCP_PM_CMD_ADD_ADDR(0xffffffffffffffff, &(0x7f00000003c0)={0x0, 0x0, &(0x7f0000000380)={&(0x7f0000000340)={0x24, r4, 0x300, 0x70bd26, 0x25dfdbfb, {}, [@MPTCP_PM_ATTR_SUBFLOWS={0x8, 0x3, 0x1}, @MPTCP_PM_ATTR_RCV_ADD_ADDRS={0x8, 0x2, 0x2}]}, 0x24}, 0x1, 0x0, 0x0, 0x20000004}, 0x8890) r5 = openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000500)='./cgroup/syz1\x00', 0x200002, 0x0) syz_io_uring_submit(0x0, r2, &(0x7f0000000580)=@IORING_OP_FILES_UPDATE={0x14, 0x4, 0x0, 0x0, 0x40, &(0x7f0000000540)=[r3, 0xffffffffffffffff, r5, r0, r1], 0x5}, 0x3) socket$inet6_tcp(0xa, 0x1, 0x0) openat$procfs(0xffffffffffffff9c, &(0x7f00000010c0)='/proc/crypto\x00', 0x0, 0x0) 21:24:42 executing program 6: r0 = io_uring_setup(0x355e, &(0x7f0000000000)={0x0, 0x0, 0x20, 0x0, 0x1be}) r1 = syz_io_uring_setup(0x8fe, &(0x7f0000000080)={0x0, 0x1830, 0x0, 0x0, 0x0, 0x0, r0}, &(0x7f0000ffb000/0x2000)=nil, &(0x7f0000ffb000/0x4000)=nil, &(0x7f0000000100), &(0x7f0000000140)=0x0) r3 = openat$hwrng(0xffffffffffffff9c, &(0x7f0000000180), 0x2, 0x0) r4 = syz_genetlink_get_family_id$mptcp(&(0x7f0000000300), r3) sendmsg$MPTCP_PM_CMD_ADD_ADDR(r3, &(0x7f00000003c0)={&(0x7f00000002c0), 0xc, &(0x7f0000000380)={&(0x7f0000000340)={0x24, r4, 0x300, 0x70bd26, 0x0, {}, [@MPTCP_PM_ATTR_SUBFLOWS={0x8, 0x3, 0x1}, @MPTCP_PM_ATTR_RCV_ADD_ADDRS={0x8}]}, 0x24}, 0x1, 0x0, 0x0, 0x20000004}, 0x8890) syz_io_uring_setup(0x20f8, &(0x7f0000000400)={0x0, 0x7677, 0x8, 0x3, 0x22f}, &(0x7f0000ffe000/0x2000)=nil, &(0x7f0000ffb000/0x2000)=nil, &(0x7f0000000480)=0x0, &(0x7f00000004c0)) r6 = openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000500)='./cgroup/syz1\x00', 0x200002, 0x0) syz_io_uring_submit(r5, r2, &(0x7f0000000580)=@IORING_OP_FILES_UPDATE={0x14, 0x4, 0x0, 0x0, 0x40, &(0x7f0000000540)=[0xffffffffffffffff, 0xffffffffffffffff, r6, r0, r1], 0x5}, 0x3) socket$inet6_tcp(0xa, 0x1, 0x0) openat$procfs(0xffffffffffffff9c, &(0x7f00000010c0)='/proc/crypto\x00', 0x0, 0x0) io_uring_setup(0x7c8f, &(0x7f0000001140)={0x0, 0xc240, 0x10, 0x3, 0x1c7}) 21:24:42 executing program 3: io_uring_setup(0x355e, &(0x7f0000000000)={0x0, 0x0, 0x20, 0x1, 0x1be}) syz_io_uring_setup(0x8fe, &(0x7f0000000080), &(0x7f0000ffb000/0x2000)=nil, &(0x7f0000ffb000/0x4000)=nil, &(0x7f0000000100), &(0x7f0000000140)) openat$hwrng(0xffffffffffffff9c, &(0x7f0000000180), 0x2, 0x0) syz_genetlink_get_family_id$mptcp(&(0x7f0000000300), 0xffffffffffffffff) openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000500)='./cgroup/syz1\x00', 0x200002, 0x0) syz_io_uring_submit(0x0, 0x0, 0x0, 0x3) io_uring_setup(0x2812, &(0x7f00000005c0)={0x0, 0x0, 0x2, 0x3, 0x12f}) socket$inet6_tcp(0xa, 0x1, 0x0) io_uring_setup(0x0, 0x0) 21:24:42 executing program 0: syz_io_uring_setup(0x0, 0x0, &(0x7f0000ffb000/0x2000)=nil, &(0x7f0000ffb000/0x4000)=nil, 0x0, 0x0) openat$hwrng(0xffffffffffffff9c, 0x0, 0x0, 0x0) syz_io_uring_submit(0x0, 0x0, 0x0, 0x0) socket$inet6_tcp(0xa, 0x1, 0x0) io_uring_setup(0x7c8f, 0x0) 21:24:42 executing program 2: r0 = io_uring_setup(0x355e, &(0x7f0000000000)={0x0, 0x0, 0x20, 0x0, 0x1be}) syz_io_uring_setup(0x8fe, &(0x7f0000000080)={0x0, 0x1830, 0x0, 0x0, 0x0, 0x0, r0}, &(0x7f0000ffb000/0x2000)=nil, &(0x7f0000ffb000/0x4000)=nil, &(0x7f0000000100), &(0x7f0000000140)) syz_genetlink_get_family_id$mptcp(&(0x7f0000000300), 0xffffffffffffffff) syz_io_uring_setup(0x20f8, &(0x7f0000000400)={0x0, 0x7677, 0x8, 0x3, 0x22f}, &(0x7f0000ffe000/0x2000)=nil, &(0x7f0000ffb000/0x2000)=nil, &(0x7f0000000480), &(0x7f00000004c0)) socket$inet6_tcp(0xa, 0x1, 0x0) 21:24:42 executing program 4: io_uring_setup(0x355e, &(0x7f0000000000)={0x0, 0x0, 0x0, 0x1, 0x1be}) syz_io_uring_setup(0x8fe, &(0x7f0000000080), &(0x7f0000ffb000/0x2000)=nil, &(0x7f0000ffb000/0x4000)=nil, &(0x7f0000000100), &(0x7f0000000140)) openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000500)='./cgroup/syz1\x00', 0x200002, 0x0) syz_io_uring_submit(0x0, 0x0, 0x0, 0x0) io_uring_setup(0x2812, &(0x7f00000005c0)={0x0, 0x5e1b, 0x2, 0x3, 0x12f}) socket$inet6_tcp(0xa, 0x1, 0x0) io_uring_setup(0x7c8f, &(0x7f0000001140)={0x0, 0xc240, 0x10, 0x3, 0x1c7}) 21:24:42 executing program 7: io_uring_setup(0x355e, &(0x7f0000000000)={0x0, 0x0, 0x20, 0x1, 0x1be}) syz_io_uring_setup(0x8fe, &(0x7f0000000080), &(0x7f0000ffb000/0x2000)=nil, &(0x7f0000ffb000/0x4000)=nil, &(0x7f0000000100), &(0x7f0000000140)) openat$hwrng(0xffffffffffffff9c, &(0x7f0000000180), 0x2, 0x0) syz_genetlink_get_family_id$mptcp(&(0x7f0000000300), 0xffffffffffffffff) openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000500)='./cgroup/syz1\x00', 0x200002, 0x0) syz_io_uring_submit(0x0, 0x0, 0x0, 0x3) io_uring_setup(0x2812, &(0x7f00000005c0)={0x0, 0x0, 0x2, 0x3, 0x12f}) socket$inet6_tcp(0xa, 0x1, 0x0) io_uring_setup(0x0, &(0x7f0000001140)={0x0, 0xc240, 0x10, 0x3, 0x1c7}) 21:24:42 executing program 1: io_uring_setup(0x355e, &(0x7f0000000000)={0x0, 0x0, 0x20, 0x1, 0x1be}) r0 = openat$hwrng(0xffffffffffffff9c, &(0x7f0000000180), 0x2, 0x0) r1 = syz_io_uring_setup(0x65dd, &(0x7f00000001c0)={0x0, 0x0, 0x20, 0x2}, &(0x7f0000ffe000/0x1000)=nil, &(0x7f0000ffd000/0x1000)=nil, &(0x7f0000000240), &(0x7f0000000280)) syz_genetlink_get_family_id$mptcp(&(0x7f0000000300), r0) syz_io_uring_setup(0x20f8, &(0x7f0000000400)={0x0, 0x7677, 0x8, 0x3, 0x22f, 0x0, r1}, &(0x7f0000ffe000/0x2000)=nil, &(0x7f0000ffb000/0x2000)=nil, &(0x7f0000000480), 0x0) openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000500)='./cgroup/syz1\x00', 0x200002, 0x0) syz_io_uring_submit(0x0, 0x0, 0x0, 0x0) io_uring_setup(0x0, &(0x7f00000005c0)={0x0, 0x5e1b, 0x2, 0x3, 0x12f, 0x0, r1}) socket$inet6_tcp(0xa, 0x1, 0x0) openat$procfs(0xffffffffffffff9c, &(0x7f00000010c0)='/proc/crypto\x00', 0x0, 0x0) io_uring_setup(0x7c8f, &(0x7f0000001140)={0x0, 0xc240, 0x10, 0x3, 0x1c7, 0x0, r1}) 21:24:42 executing program 0: syz_io_uring_setup(0x0, 0x0, &(0x7f0000ffb000/0x2000)=nil, &(0x7f0000ffb000/0x4000)=nil, 0x0, 0x0) openat$hwrng(0xffffffffffffff9c, 0x0, 0x0, 0x0) syz_io_uring_submit(0x0, 0x0, 0x0, 0x0) socket$inet6_tcp(0xa, 0x1, 0x0) io_uring_setup(0x7c8f, &(0x7f0000001140)={0x0, 0x0, 0x10, 0x3, 0x1c7}) 21:24:42 executing program 4: io_uring_setup(0x355e, &(0x7f0000000000)={0x0, 0x0, 0x0, 0x1, 0x1be}) syz_io_uring_setup(0x8fe, &(0x7f0000000080), &(0x7f0000ffb000/0x2000)=nil, &(0x7f0000ffb000/0x4000)=nil, &(0x7f0000000100), &(0x7f0000000140)) openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000500)='./cgroup/syz1\x00', 0x200002, 0x0) syz_io_uring_submit(0x0, 0x0, 0x0, 0x0) io_uring_setup(0x2812, &(0x7f00000005c0)={0x0, 0x5e1b, 0x2, 0x3, 0x12f}) socket$inet6_tcp(0xa, 0x1, 0x0) io_uring_setup(0x7c8f, &(0x7f0000001140)={0x0, 0xc240, 0x10, 0x3, 0x1c7}) 21:24:42 executing program 6: r0 = io_uring_setup(0x355e, &(0x7f0000000000)={0x0, 0x0, 0x20, 0x0, 0x1be}) r1 = syz_io_uring_setup(0x8fe, &(0x7f0000000080)={0x0, 0x1830, 0x0, 0x0, 0x0, 0x0, r0}, &(0x7f0000ffb000/0x2000)=nil, &(0x7f0000ffb000/0x4000)=nil, &(0x7f0000000100), &(0x7f0000000140)=0x0) r3 = openat$hwrng(0xffffffffffffff9c, &(0x7f0000000180), 0x2, 0x0) r4 = syz_genetlink_get_family_id$mptcp(&(0x7f0000000300), r3) sendmsg$MPTCP_PM_CMD_ADD_ADDR(r3, &(0x7f00000003c0)={&(0x7f00000002c0), 0xc, &(0x7f0000000380)={&(0x7f0000000340)={0x1c, r4, 0x300, 0x70bd26, 0x0, {}, [@MPTCP_PM_ATTR_RCV_ADD_ADDRS={0x8, 0x2, 0x2}]}, 0x1c}, 0x1, 0x0, 0x0, 0x20000004}, 0x8890) syz_io_uring_setup(0x20f8, &(0x7f0000000400)={0x0, 0x7677, 0x8, 0x3, 0x22f}, &(0x7f0000ffe000/0x2000)=nil, &(0x7f0000ffb000/0x2000)=nil, &(0x7f0000000480)=0x0, &(0x7f00000004c0)) r6 = openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000500)='./cgroup/syz1\x00', 0x200002, 0x0) syz_io_uring_submit(r5, r2, &(0x7f0000000580)=@IORING_OP_FILES_UPDATE={0x14, 0x4, 0x0, 0x0, 0x40, &(0x7f0000000540)=[0xffffffffffffffff, 0xffffffffffffffff, r6, r0, r1], 0x5}, 0x3) socket$inet6_tcp(0xa, 0x1, 0x0) openat$procfs(0xffffffffffffff9c, &(0x7f00000010c0)='/proc/crypto\x00', 0x0, 0x0) io_uring_setup(0x7c8f, &(0x7f0000001140)={0x0, 0xc240, 0x10, 0x3, 0x1c7}) 21:24:42 executing program 2: r0 = io_uring_setup(0x355e, &(0x7f0000000000)={0x0, 0x0, 0x20, 0x0, 0x1be}) syz_io_uring_setup(0x8fe, &(0x7f0000000080)={0x0, 0x1830, 0x0, 0x0, 0x0, 0x0, r0}, &(0x7f0000ffb000/0x2000)=nil, &(0x7f0000ffb000/0x4000)=nil, &(0x7f0000000100), &(0x7f0000000140)) syz_genetlink_get_family_id$mptcp(&(0x7f0000000300), 0xffffffffffffffff) syz_io_uring_setup(0x20f8, &(0x7f0000000400)={0x0, 0x7677, 0x8, 0x3, 0x22f}, &(0x7f0000ffe000/0x2000)=nil, &(0x7f0000ffb000/0x2000)=nil, &(0x7f0000000480), &(0x7f00000004c0)) socket$inet6_tcp(0xa, 0x1, 0x0) 21:24:42 executing program 0: syz_io_uring_setup(0x0, 0x0, &(0x7f0000ffb000/0x2000)=nil, &(0x7f0000ffb000/0x4000)=nil, 0x0, 0x0) openat$hwrng(0xffffffffffffff9c, 0x0, 0x0, 0x0) syz_io_uring_submit(0x0, 0x0, 0x0, 0x0) socket$inet6_tcp(0xa, 0x1, 0x0) io_uring_setup(0x7c8f, &(0x7f0000001140)={0x0, 0x0, 0x0, 0x3, 0x1c7}) 21:24:42 executing program 5: r0 = io_uring_setup(0x355e, &(0x7f0000000000)={0x0, 0x0, 0x20, 0x0, 0x1be}) r1 = syz_io_uring_setup(0x8fe, &(0x7f0000000080)={0x0, 0x0, 0x0, 0x0, 0x1b8}, &(0x7f0000ffb000/0x2000)=nil, &(0x7f0000ffb000/0x4000)=nil, &(0x7f0000000100), &(0x7f0000000140)=0x0) openat$hwrng(0xffffffffffffff9c, &(0x7f0000000180), 0x2, 0x0) r3 = syz_io_uring_setup(0x65dd, &(0x7f00000001c0)={0x0, 0x0, 0x0, 0x2, 0xdf}, &(0x7f0000ffe000/0x1000)=nil, &(0x7f0000ffd000/0x1000)=nil, &(0x7f0000000240), &(0x7f0000000280)) r4 = syz_genetlink_get_family_id$mptcp(&(0x7f0000000300), 0xffffffffffffffff) sendmsg$MPTCP_PM_CMD_ADD_ADDR(0xffffffffffffffff, &(0x7f00000003c0)={&(0x7f00000002c0), 0xc, &(0x7f0000000380)={&(0x7f0000000340)={0x24, r4, 0x300, 0x70bd26, 0x25dfdbfb, {}, [@MPTCP_PM_ATTR_SUBFLOWS={0x8, 0x3, 0x1}, @MPTCP_PM_ATTR_RCV_ADD_ADDRS={0x8, 0x2, 0x2}]}, 0x24}, 0x1, 0x0, 0x0, 0x20000004}, 0x8890) r5 = openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000500)='./cgroup/syz1\x00', 0x200002, 0x0) syz_io_uring_submit(0x0, r2, &(0x7f0000000580)=@IORING_OP_FILES_UPDATE={0x14, 0x4, 0x0, 0x0, 0x40, &(0x7f0000000540)=[r3, 0xffffffffffffffff, r5, r0, r1], 0x5}, 0x3) socket$inet6_tcp(0xa, 0x1, 0x0) openat$procfs(0xffffffffffffff9c, &(0x7f00000010c0)='/proc/crypto\x00', 0x0, 0x0) 21:24:52 executing program 7: io_uring_setup(0x355e, &(0x7f0000000000)={0x0, 0x0, 0x20, 0x1, 0x1be}) syz_io_uring_setup(0x8fe, &(0x7f0000000080), &(0x7f0000ffb000/0x2000)=nil, &(0x7f0000ffb000/0x4000)=nil, &(0x7f0000000100), &(0x7f0000000140)) openat$hwrng(0xffffffffffffff9c, &(0x7f0000000180), 0x2, 0x0) syz_genetlink_get_family_id$mptcp(&(0x7f0000000300), 0xffffffffffffffff) openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000500)='./cgroup/syz1\x00', 0x200002, 0x0) syz_io_uring_submit(0x0, 0x0, 0x0, 0x3) io_uring_setup(0x2812, &(0x7f00000005c0)={0x0, 0x0, 0x2, 0x3, 0x12f}) socket$inet6_tcp(0xa, 0x1, 0x0) io_uring_setup(0x0, &(0x7f0000001140)={0x0, 0xc240, 0x10, 0x3, 0x1c7}) 21:24:52 executing program 5: r0 = io_uring_setup(0x355e, &(0x7f0000000000)={0x0, 0x0, 0x20, 0x0, 0x1be}) r1 = syz_io_uring_setup(0x8fe, &(0x7f0000000080)={0x0, 0x0, 0x0, 0x0, 0x1b8}, &(0x7f0000ffb000/0x2000)=nil, &(0x7f0000ffb000/0x4000)=nil, &(0x7f0000000100), &(0x7f0000000140)=0x0) openat$hwrng(0xffffffffffffff9c, &(0x7f0000000180), 0x2, 0x0) r3 = syz_io_uring_setup(0x65dd, &(0x7f00000001c0)={0x0, 0x0, 0x0, 0x2, 0xdf}, &(0x7f0000ffe000/0x1000)=nil, &(0x7f0000ffd000/0x1000)=nil, &(0x7f0000000240), &(0x7f0000000280)) r4 = syz_genetlink_get_family_id$mptcp(&(0x7f0000000300), 0xffffffffffffffff) sendmsg$MPTCP_PM_CMD_ADD_ADDR(0xffffffffffffffff, &(0x7f00000003c0)={&(0x7f00000002c0), 0xc, &(0x7f0000000380)={&(0x7f0000000340)={0x24, r4, 0x300, 0x70bd26, 0x25dfdbfb, {}, [@MPTCP_PM_ATTR_SUBFLOWS={0x8, 0x3, 0x1}, @MPTCP_PM_ATTR_RCV_ADD_ADDRS={0x8, 0x2, 0x2}]}, 0x24}, 0x1, 0x0, 0x0, 0x20000004}, 0x8890) r5 = openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000500)='./cgroup/syz1\x00', 0x200002, 0x0) syz_io_uring_submit(0x0, r2, &(0x7f0000000580)=@IORING_OP_FILES_UPDATE={0x14, 0x4, 0x0, 0x0, 0x40, &(0x7f0000000540)=[r3, 0xffffffffffffffff, r5, r0, r1], 0x5}, 0x3) socket$inet6_tcp(0xa, 0x1, 0x0) openat$procfs(0xffffffffffffff9c, &(0x7f00000010c0)='/proc/crypto\x00', 0x0, 0x0) 21:24:52 executing program 2: r0 = io_uring_setup(0x355e, &(0x7f0000000000)={0x0, 0x0, 0x20, 0x0, 0x1be}) syz_io_uring_setup(0x8fe, &(0x7f0000000080)={0x0, 0x1830, 0x0, 0x0, 0x0, 0x0, r0}, &(0x7f0000ffb000/0x2000)=nil, &(0x7f0000ffb000/0x4000)=nil, &(0x7f0000000100), &(0x7f0000000140)) syz_genetlink_get_family_id$mptcp(&(0x7f0000000300), 0xffffffffffffffff) syz_io_uring_setup(0x20f8, &(0x7f0000000400)={0x0, 0x7677, 0x8, 0x3, 0x22f}, &(0x7f0000ffe000/0x2000)=nil, &(0x7f0000ffb000/0x2000)=nil, &(0x7f0000000480), &(0x7f00000004c0)) socket$inet6_tcp(0xa, 0x1, 0x0) 21:24:52 executing program 3: io_uring_setup(0x355e, &(0x7f0000000000)={0x0, 0x0, 0x20, 0x1, 0x1be}) syz_io_uring_setup(0x8fe, &(0x7f0000000080), &(0x7f0000ffb000/0x2000)=nil, &(0x7f0000ffb000/0x4000)=nil, &(0x7f0000000100), &(0x7f0000000140)) openat$hwrng(0xffffffffffffff9c, &(0x7f0000000180), 0x2, 0x0) syz_genetlink_get_family_id$mptcp(&(0x7f0000000300), 0xffffffffffffffff) openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000500)='./cgroup/syz1\x00', 0x200002, 0x0) syz_io_uring_submit(0x0, 0x0, 0x0, 0x3) io_uring_setup(0x2812, &(0x7f00000005c0)={0x0, 0x0, 0x2, 0x3, 0x12f}) socket$inet6_tcp(0xa, 0x1, 0x0) io_uring_setup(0x0, 0x0) 21:24:52 executing program 4: io_uring_setup(0x355e, &(0x7f0000000000)={0x0, 0x0, 0x0, 0x1, 0x1be}) syz_io_uring_setup(0x8fe, &(0x7f0000000080), &(0x7f0000ffb000/0x2000)=nil, &(0x7f0000ffb000/0x4000)=nil, &(0x7f0000000100), &(0x7f0000000140)) openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000500)='./cgroup/syz1\x00', 0x200002, 0x0) syz_io_uring_submit(0x0, 0x0, 0x0, 0x0) io_uring_setup(0x2812, &(0x7f00000005c0)={0x0, 0x5e1b, 0x2, 0x3, 0x12f}) socket$inet6_tcp(0xa, 0x1, 0x0) io_uring_setup(0x7c8f, &(0x7f0000001140)={0x0, 0xc240, 0x10, 0x3, 0x1c7}) 21:24:52 executing program 0: syz_io_uring_setup(0x0, 0x0, &(0x7f0000ffb000/0x2000)=nil, &(0x7f0000ffb000/0x4000)=nil, 0x0, 0x0) openat$hwrng(0xffffffffffffff9c, 0x0, 0x0, 0x0) syz_io_uring_submit(0x0, 0x0, 0x0, 0x0) socket$inet6_tcp(0xa, 0x1, 0x0) io_uring_setup(0x7c8f, &(0x7f0000001140)={0x0, 0x0, 0x0, 0x0, 0x1c7}) 21:24:52 executing program 6: r0 = io_uring_setup(0x355e, &(0x7f0000000000)={0x0, 0x0, 0x20, 0x0, 0x1be}) r1 = syz_io_uring_setup(0x8fe, &(0x7f0000000080)={0x0, 0x1830, 0x0, 0x0, 0x0, 0x0, r0}, &(0x7f0000ffb000/0x2000)=nil, &(0x7f0000ffb000/0x4000)=nil, &(0x7f0000000100), &(0x7f0000000140)=0x0) r3 = openat$hwrng(0xffffffffffffff9c, &(0x7f0000000180), 0x2, 0x0) r4 = syz_genetlink_get_family_id$mptcp(&(0x7f0000000300), r3) sendmsg$MPTCP_PM_CMD_ADD_ADDR(r3, &(0x7f00000003c0)={&(0x7f00000002c0), 0xc, &(0x7f0000000380)={&(0x7f0000000340)={0x1c, r4, 0x300, 0x70bd26, 0x0, {}, [@MPTCP_PM_ATTR_RCV_ADD_ADDRS={0x8}]}, 0x1c}, 0x1, 0x0, 0x0, 0x20000004}, 0x8890) syz_io_uring_setup(0x20f8, &(0x7f0000000400)={0x0, 0x7677, 0x8, 0x3, 0x22f}, &(0x7f0000ffe000/0x2000)=nil, &(0x7f0000ffb000/0x2000)=nil, &(0x7f0000000480)=0x0, &(0x7f00000004c0)) r6 = openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000500)='./cgroup/syz1\x00', 0x200002, 0x0) syz_io_uring_submit(r5, r2, &(0x7f0000000580)=@IORING_OP_FILES_UPDATE={0x14, 0x4, 0x0, 0x0, 0x40, &(0x7f0000000540)=[0xffffffffffffffff, 0xffffffffffffffff, r6, r0, r1], 0x5}, 0x3) socket$inet6_tcp(0xa, 0x1, 0x0) openat$procfs(0xffffffffffffff9c, &(0x7f00000010c0)='/proc/crypto\x00', 0x0, 0x0) io_uring_setup(0x7c8f, &(0x7f0000001140)={0x0, 0xc240, 0x10, 0x3, 0x1c7}) 21:24:52 executing program 1: io_uring_setup(0x355e, &(0x7f0000000000)={0x0, 0x0, 0x20, 0x1, 0x1be}) r0 = openat$hwrng(0xffffffffffffff9c, &(0x7f0000000180), 0x2, 0x0) r1 = syz_io_uring_setup(0x65dd, &(0x7f00000001c0)={0x0, 0x0, 0x20, 0x2}, &(0x7f0000ffe000/0x1000)=nil, &(0x7f0000ffd000/0x1000)=nil, &(0x7f0000000240), &(0x7f0000000280)) syz_genetlink_get_family_id$mptcp(&(0x7f0000000300), r0) syz_io_uring_setup(0x20f8, &(0x7f0000000400)={0x0, 0x7677, 0x8, 0x3, 0x22f, 0x0, r1}, &(0x7f0000ffe000/0x2000)=nil, &(0x7f0000ffb000/0x2000)=nil, &(0x7f0000000480), 0x0) openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000500)='./cgroup/syz1\x00', 0x200002, 0x0) syz_io_uring_submit(0x0, 0x0, 0x0, 0x0) io_uring_setup(0x0, &(0x7f00000005c0)={0x0, 0x5e1b, 0x2, 0x3, 0x12f, 0x0, r1}) socket$inet6_tcp(0xa, 0x1, 0x0) openat$procfs(0xffffffffffffff9c, &(0x7f00000010c0)='/proc/crypto\x00', 0x0, 0x0) io_uring_setup(0x7c8f, &(0x7f0000001140)={0x0, 0xc240, 0x10, 0x3, 0x1c7, 0x0, r1}) 21:24:52 executing program 4: io_uring_setup(0x355e, &(0x7f0000000000)={0x0, 0x0, 0x20, 0x0, 0x1be}) syz_io_uring_setup(0x8fe, &(0x7f0000000080), &(0x7f0000ffb000/0x2000)=nil, &(0x7f0000ffb000/0x4000)=nil, &(0x7f0000000100), &(0x7f0000000140)) openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000500)='./cgroup/syz1\x00', 0x200002, 0x0) syz_io_uring_submit(0x0, 0x0, 0x0, 0x0) io_uring_setup(0x2812, &(0x7f00000005c0)={0x0, 0x5e1b, 0x2, 0x3, 0x12f}) socket$inet6_tcp(0xa, 0x1, 0x0) io_uring_setup(0x7c8f, &(0x7f0000001140)={0x0, 0xc240, 0x10, 0x3, 0x1c7}) [ 822.365890] kmemleak: Found object by alias at 0x607f1a6398ac [ 822.365914] CPU: 1 UID: 0 PID: 8817 Comm: syz-executor.3 Tainted: G W 6.17.0-rc3-next-20250829 #1 PREEMPT(voluntary) [ 822.365939] Tainted: [W]=WARN [ 822.365945] Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.12.0-1 04/01/2014 [ 822.365954] Call Trace: [ 822.365959] [ 822.365966] dump_stack_lvl+0xca/0x120 [ 822.366000] __lookup_object+0x94/0xb0 [ 822.366023] delete_object_full+0x27/0x70 [ 822.366045] free_percpu+0x30/0x1160 [ 822.366066] ? arch_uprobe_clear_state+0x16/0x140 [ 822.366093] futex_hash_free+0x38/0xc0 [ 822.366112] mmput+0x2d3/0x390 [ 822.366137] do_exit+0x79d/0x2970 [ 822.366161] ? __pfx_do_exit+0x10/0x10 [ 822.366180] ? find_held_lock+0x2b/0x80 [ 822.366204] ? get_signal+0x835/0x2340 [ 822.366231] do_group_exit+0xd3/0x2a0 [ 822.366251] get_signal+0x2315/0x2340 [ 822.366275] ? trace_irq_enable.constprop.0+0xc2/0x100 [ 822.366297] ? __pfx_get_signal+0x10/0x10 [ 822.366325] ? do_futex+0x135/0x370 [ 822.366344] ? __pfx_do_futex+0x10/0x10 [ 822.366364] arch_do_signal_or_restart+0x80/0x790 [ 822.366388] ? __pfx_arch_do_signal_or_restart+0x10/0x10 [ 822.366410] ? __x64_sys_futex+0x1c9/0x4d0 [ 822.366427] ? __x64_sys_futex+0x1d2/0x4d0 [ 822.366447] ? __pfx___x64_sys_futex+0x10/0x10 [ 822.366464] ? lock_mm_and_find_vma+0xaa/0x6f0 [ 822.366482] ? xfd_validate_state+0x55/0x180 [ 822.366511] exit_to_user_mode_loop+0x8b/0x110 [ 822.366528] do_syscall_64+0x2f7/0x360 [ 822.366544] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 822.366562] RIP: 0033:0x7f1060a76b19 [ 822.366575] Code: Unable to access opcode bytes at 0x7f1060a76aef. [ 822.366581] RSP: 002b:00007f105dfec218 EFLAGS: 00000246 ORIG_RAX: 00000000000000ca [ 822.366597] RAX: fffffffffffffe00 RBX: 00007f1060b89f68 RCX: 00007f1060a76b19 [ 822.366607] RDX: 0000000000000000 RSI: 0000000000000080 RDI: 00007f1060b89f68 [ 822.366617] RBP: 00007f1060b89f60 R08: 0000000000000000 R09: 0000000000000000 [ 822.366626] R10: 0000000000000000 R11: 0000000000000246 R12: 00007f1060b89f6c [ 822.366636] R13: 00007ffed3f8b4af R14: 00007f105dfec300 R15: 0000000000022000 [ 822.366657] [ 822.366662] kmemleak: Object (percpu) 0x607f1a6398a8 (size 8): [ 822.366672] kmemleak: comm "syz-executor.2", pid 8838, jiffies 4295489197 [ 822.366681] kmemleak: min_count = 1 [ 822.366686] kmemleak: count = 0 [ 822.366691] kmemleak: flags = 0x21 [ 822.366696] kmemleak: checksum = 0 [ 822.366701] kmemleak: backtrace: [ 822.366706] pcpu_alloc_noprof+0x87a/0x1170 [ 822.366726] percpu_ref_init+0x37/0x400 [ 822.366749] io_uring_setup+0x44c/0x2000 [ 822.366764] __x64_sys_io_uring_setup+0xc8/0x170 [ 822.366779] do_syscall_64+0xbf/0x360 [ 822.366790] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 822.423941] kmemleak: Cannot insert 0x607f1a6398ac into the object search tree (overlaps existing) [ 822.423980] CPU: 0 UID: 0 PID: 8845 Comm: syz-executor.2 Tainted: G W 6.17.0-rc3-next-20250829 #1 PREEMPT(voluntary) [ 822.424020] Tainted: [W]=WARN [ 822.424028] Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.12.0-1 04/01/2014 [ 822.424043] Call Trace: [ 822.424052] [ 822.424062] dump_stack_lvl+0xca/0x120 [ 822.424110] __link_object+0x190/0x210 [ 822.424147] __create_object+0x48/0x80 [ 822.424186] pcpu_alloc_noprof+0x87a/0x1170 [ 822.424237] __percpu_counter_init_many+0x44/0x360 [ 822.424269] ? kasan_save_track+0x14/0x30 [ 822.424305] io_uring_alloc_task_context+0xce/0x650 [ 822.424352] ? file_init_path+0x506/0x770 [ 822.424388] ? __pfx_io_uring_alloc_task_context+0x10/0x10 [ 822.424428] ? alloc_file_pseudo+0x1a9/0x220 [ 822.424469] __io_uring_add_tctx_node+0x291/0x4c0 [ 822.424507] ? __pfx___io_uring_add_tctx_node+0x10/0x10 [ 822.424550] ? __anon_inode_getfile+0x177/0x280 [ 822.424606] io_uring_setup+0x1527/0x2000 [ 822.424637] ? __pfx_io_uring_setup+0x10/0x10 [ 822.424694] ? kcov_ioctl+0x386/0x6c0 [ 822.424731] __x64_sys_io_uring_setup+0xc8/0x170 [ 822.424762] do_syscall_64+0xbf/0x360 [ 822.424787] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 822.424813] RIP: 0033:0x7fd8de54eb19 [ 822.424833] Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 bc ff ff ff f7 d8 64 89 01 48 [ 822.424858] RSP: 002b:00007fd8dbaa3108 EFLAGS: 00000202 ORIG_RAX: 00000000000001a9 [ 822.424883] RAX: ffffffffffffffda RBX: 00007fd8de662020 RCX: 00007fd8de54eb19 [ 822.424900] RDX: 0000000020ffb000 RSI: 0000000020000400 RDI: 00000000000020f8 [ 822.424916] RBP: 0000000020000400 R08: 00000000200004c0 R09: 00000000200004c0 [ 822.424932] R10: 0000000020000480 R11: 0000000000000202 R12: 00000000200004c0 [ 822.424948] R13: 0000000020ffb000 R14: 0000000020000480 R15: 0000000020ffe000 [ 822.424982] [ 822.425882] kmemleak: Kernel memory leak detector disabled [ 822.425891] kmemleak: Object (percpu) 0x607f1a6398a8 (size 8): [ 822.425906] kmemleak: comm "syz-executor.2", pid 8838, jiffies 4295489197 [ 822.425922] kmemleak: min_count = 1 [ 822.425930] kmemleak: count = 0 [ 822.425938] kmemleak: flags = 0x21 [ 822.425946] kmemleak: checksum = 0 [ 822.425954] kmemleak: backtrace: [ 822.425961] pcpu_alloc_noprof+0x87a/0x1170 [ 822.425995] percpu_ref_init+0x37/0x400 [ 822.426032] io_uring_setup+0x44c/0x2000 [ 822.426055] __x64_sys_io_uring_setup+0xc8/0x170 [ 822.426080] do_syscall_64+0xbf/0x360 [ 822.426099] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 822.512409] kmemleak: Automatic memory scanning thread ended SYZFAIL: failed to write(kmemleak, "scan") (errno 1: Operation not permitted) BUG: leak checking failed VM DIAGNOSIS: 21:24:53 Registers: info registers vcpu 0 RAX=dffffc0000000000 RBX=ffff888016dffdd8 RCX=ffff888016dff804 RDX=0000000000000000 RSI=ffffffff85c1c760 RDI=ffff88801749567c RBP=ffff888017495280 RSP=ffff888016dff810 R8 =0000000000000001 R9 =ffff888016dff8f0 R10=000000000003be53 R11=000000000000a283 R12=ffff888016dff901 R13=ffff888016dff8f8 R14=ffff888016dffda8 R15=ffff888016dff8b0 RIP=ffffffff815bead0 RFL=00000217 [----APC] CPL=0 II=0 A20=1 SMM=0 HLT=0 ES =0000 0000000000000000 00000000 00000000 CS =0010 0000000000000000 ffffffff 00a09b00 DPL=0 CS64 [-RA] SS =0018 0000000000000000 ffffffff 00c09300 DPL=0 DS [-WA] DS =0000 0000000000000000 00000000 00000000 FS =0000 0000000000000000 00000000 00000000 GS =0000 ffff8880e55dd000 00000000 00000000 LDT=0000 fffffe2800000000 00000000 00000000 TR =0040 fffffe0000003000 00004087 00008b00 DPL=0 TSS64-busy GDT= fffffe0000001000 0000007f IDT= fffffe0000000000 00000fff CR0=80050033 CR2=00007ffeeb1a5ff8 CR3=000000003a1a1000 CR4=00350ef0 DR0=0000000000000000 DR1=0000000000000000 DR2=0000000000000000 DR3=0000000000000000 DR6=00000000ffff0ff0 DR7=0000000000000400 EFER=0000000000000d01 FCW=037f FSW=0000 [ST=0] FTW=00 MXCSR=00001f80 FPR0=0000000000000000 0000 FPR1=0000000000000000 0000 FPR2=0000000000000000 0000 FPR3=0000000000000000 0000 FPR4=0000000000000000 0000 FPR5=0000000000000000 0000 FPR6=0000000000000000 0000 FPR7=0000000000000000 0000 XMM00=ff00000000ff000000000000000000ff XMM01=25252525252525252525252525252525 XMM02=00000000000000000000000000000000 XMM03=00000000000000000000000000000000 XMM04=000000000000000000000000000000ff XMM05=00000000000000000000000000000000 XMM06=00000000000000000000000000000000 XMM07=00000000000000000000000000000000 XMM08=00000000000000000000000000000000 XMM09=00000000000000000000000000000000 XMM10=00000000000000000000000000000000 XMM11=00000000000000000000000000000000 XMM12=00000000000000000000000000000000 XMM13=00000000000000000000000000000000 XMM14=00000000000000000000000000000000 XMM15=00000000000000000000000000000000 info registers vcpu 1 RAX=ffffffff81358409 RBX=0000000000000001 RCX=0000000000000002 RDX=0000000000000000 RSI=0000000000000000 RDI=ffffffff85c1c760 RBP=ffff888017037a50 RSP=ffff888017037968 R8 =0000000000000000 R9 =0000000000000000 R10=000000000003be53 R11=0000000000024ac7 R12=0000000000000000 R13=ffff888017037a40 R14=ffff8880166a5280 R15=ffff8880170379f8 RIP=ffffffff8151dc18 RFL=00000246 [---Z-P-] CPL=0 II=0 A20=1 SMM=0 HLT=0 ES =0000 0000000000000000 00000000 00000000 CS =0010 0000000000000000 ffffffff 00a09b00 DPL=0 CS64 [-RA] SS =0018 0000000000000000 ffffffff 00c09300 DPL=0 DS [-WA] DS =0000 0000000000000000 00000000 00000000 FS =0000 00007f6cc7e418c0 00000000 00000000 GS =0000 ffff8880e56dd000 00000000 00000000 LDT=0000 fffffe3d00000000 00000000 00000000 TR =0040 fffffe000004a000 00004087 00008b00 DPL=0 TSS64-busy GDT= fffffe0000048000 0000007f IDT= fffffe0000000000 00000fff CR0=80050033 CR2=00007fff5e88c8e8 CR3=000000000e795000 CR4=00350ef0 DR0=0000000000000000 DR1=0000000000000000 DR2=0000000000000000 DR3=0000000000000000 DR6=00000000ffff0ff0 DR7=0000000000000400 EFER=0000000000000d01 FCW=037f FSW=0000 [ST=0] FTW=00 MXCSR=00001f80 FPR0=0000000000000000 0000 FPR1=0000000000000000 0000 FPR2=0000000000000000 0000 FPR3=0000000000000000 0000 FPR4=0000000000000000 0000 FPR5=0000000000000000 0000 FPR6=0000000000000000 0000 FPR7=0000000000000000 0000 XMM00=00000000000000000000000000000000 XMM01=ffffffffffffffff0000000000000000 XMM02=00005567152900100000556715b02620 XMM03=00000000000000006c6175747269762f XMM04=2f2f2f2f2f2f2f2f2f2f2f2f2f2f2f2f XMM05=0000556715afa8f00000556715afce30 XMM06=0000556715aff4b00000000300000000 XMM07=00000000000000000000000000000000 XMM08=2f63697361622f6372732f2e2e000d0a XMM09=00000000000000000000000000000000 XMM10=00000000000000000000000000000000 XMM11=00000000000000000000000000000000 XMM12=00000000000000000000000000000000 XMM13=00000000000000000000000000000000 XMM14=00000000000000000000000000000000 XMM15=00000000000000000000000000000000