Warning: Permanently added '[localhost]:12300' (ECDSA) to the list of known hosts. 2026/01/13 11:48:05 fuzzer started 2026/01/13 11:48:05 dialing manager at localhost:38155 syzkaller login: [ 44.332911] cgroup: Unknown subsys name 'net' [ 44.399148] cgroup: Unknown subsys name 'cpuset' [ 44.416530] cgroup: Unknown subsys name 'rlimit' 2026/01/13 11:48:17 syscalls: 206 2026/01/13 11:48:17 code coverage: enabled 2026/01/13 11:48:17 comparison tracing: enabled 2026/01/13 11:48:17 extra coverage: enabled 2026/01/13 11:48:17 setuid sandbox: enabled 2026/01/13 11:48:17 namespace sandbox: enabled 2026/01/13 11:48:17 Android sandbox: enabled 2026/01/13 11:48:17 fault injection: enabled 2026/01/13 11:48:17 leak checking: enabled 2026/01/13 11:48:17 net packet injection: enabled 2026/01/13 11:48:17 net device setup: enabled 2026/01/13 11:48:17 concurrency sanitizer: /sys/kernel/debug/kcsan does not exist 2026/01/13 11:48:17 devlink PCI setup: PCI device 0000:00:10.0 is not available 2026/01/13 11:48:17 USB emulation: enabled 2026/01/13 11:48:17 hci packet injection: enabled 2026/01/13 11:48:17 wifi device emulation: enabled 2026/01/13 11:48:17 802.15.4 emulation: enabled 2026/01/13 11:48:17 fetching corpus: 0, signal 0/0 (executing program) 2026/01/13 11:48:18 starting 8 fuzzer processes 11:48:18 executing program 0: syz_io_uring_submit(0x0, 0x0, &(0x7f0000000000)=@IORING_OP_NOP={0x0, 0x1}, 0x6) ioctl$sock_SIOCGIFINDEX_802154(0xffffffffffffffff, 0x8933, &(0x7f0000000080)={'wpan4\x00', 0x0}) sendmsg$IEEE802154_LLSEC_GETPARAMS(0xffffffffffffffff, &(0x7f0000000140)={&(0x7f0000000040)={0x10, 0x0, 0x0, 0x40000000}, 0xc, &(0x7f0000000100)={&(0x7f00000000c0)={0x38, 0x0, 0x20, 0x70bd2a, 0x25dfdbff, {}, [@IEEE802154_ATTR_DEV_INDEX={0x8, 0x2, r0}, @IEEE802154_ATTR_DEV_NAME={0xa, 0x1, 'wpan1\x00'}, @IEEE802154_ATTR_DEV_INDEX={0x8}, @IEEE802154_ATTR_DEV_INDEX={0x8}]}, 0x38}, 0x1, 0x0, 0x0, 0x4000090}, 0x20008010) r1 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) sendmsg$NL802154_CMD_NEW_SEC_DEVKEY(r1, &(0x7f0000000240)={&(0x7f0000000180)={0x10, 0x0, 0x0, 0x10000}, 0xc, &(0x7f0000000200)={&(0x7f00000001c0)={0x2c, 0x0, 0x1, 0x70bd2b, 0x25dfdbfd, {}, [@NL802154_ATTR_SEC_DEVKEY={0x10, 0x24, 0x0, 0x1, [@NL802154_DEVKEY_ATTR_ID={0xc, 0x3, 0x0, 0x1, [@NL802154_KEY_ID_ATTR_INDEX={0x5, 0x2, 0x2}]}]}, @NL802154_ATTR_IFINDEX={0x8, 0x3, r0}]}, 0x2c}}, 0x4040080) r2 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) ioctl$sock_SIOCGIFINDEX_802154(r1, 0x8933, &(0x7f00000002c0)={'wpan4\x00', 0x0}) ioctl$sock_SIOCGIFINDEX_802154(r1, 0x8933, &(0x7f0000000300)={'wpan0\x00', 0x0}) ioctl$sock_SIOCGIFINDEX_802154(r1, 0x8933, &(0x7f0000000340)={'wpan0\x00', 0x0}) sendmsg$IEEE802154_LLSEC_GETPARAMS(r2, &(0x7f0000000440)={&(0x7f0000000280)={0x10, 0x0, 0x0, 0x8000}, 0xc, &(0x7f0000000400)={&(0x7f0000000380)={0x5c, 0x0, 0x504, 0x70bd2b, 0x25dfdbfb, {}, [@IEEE802154_ATTR_DEV_INDEX={0x8, 0x2, r3}, @IEEE802154_ATTR_DEV_NAME={0xa, 0x1, 'wpan1\x00'}, @IEEE802154_ATTR_DEV_INDEX={0x8, 0x2, r0}, @IEEE802154_ATTR_DEV_INDEX={0x8, 0x2, r0}, @IEEE802154_ATTR_DEV_INDEX={0x8, 0x2, r4}, @IEEE802154_ATTR_DEV_INDEX={0x8, 0x2, r5}, @IEEE802154_ATTR_DEV_NAME={0xa, 0x1, 'wpan1\x00'}, @IEEE802154_ATTR_DEV_INDEX={0x8, 0x2, r0}]}, 0x5c}, 0x1, 0x0, 0x0, 0x24040080}, 0x4004014) r6 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000480)='./binderfs/custom0\x00', 0x802, 0x0) mmap$binder(&(0x7f0000ffd000/0x2000)=nil, 0x2000, 0x1, 0x11, r6, 0x10001) syz_genetlink_get_family_id$nbd(&(0x7f00000004c0), r2) syz_genetlink_get_family_id$netlbl_mgmt(&(0x7f0000000500), r1) getpid() sendmsg$IEEE802154_LLSEC_DEL_DEVKEY(r1, &(0x7f0000000640)={&(0x7f0000000540)={0x10, 0x0, 0x0, 0x2000}, 0xc, &(0x7f0000000600)={&(0x7f0000000580)={0x44, 0x0, 0x20, 0x70bd25, 0x25dfdbfd, {}, [@IEEE802154_ATTR_LLSEC_KEY_SOURCE_EXTENDED={0xc, 0x2d, {0xaaaaaaaaaaaa0002}}, @IEEE802154_ATTR_LLSEC_KEY_ID={0x5, 0x2e, 0x1f}, @IEEE802154_ATTR_LLSEC_KEY_SOURCE_SHORT={0x8, 0x2c, 0x4}, @IEEE802154_ATTR_LLSEC_KEY_MODE={0x5, 0x2b, 0x2}, @IEEE802154_ATTR_LLSEC_KEY_SOURCE_EXTENDED={0xc, 0x2d, {0xaaaaaaaaaaaa0202}}]}, 0x44}, 0x1, 0x0, 0x0, 0x1}, 0x400c084) ioctl$PERF_EVENT_IOC_PAUSE_OUTPUT(0xffffffffffffffff, 0x40042409, 0x1) r7 = syz_genetlink_get_family_id$nl802154(&(0x7f00000006c0), r2) ioctl$sock_SIOCGIFINDEX_802154(r2, 0x8933, &(0x7f0000000700)={'wpan0\x00', 0x0}) sendmsg$NL802154_CMD_NEW_SEC_DEV(r1, &(0x7f0000000800)={&(0x7f0000000680)={0x10, 0x0, 0x0, 0x400000}, 0xc, &(0x7f00000007c0)={&(0x7f0000000740)={0x44, r7, 0x400, 0x70bd2d, 0x25dfdbff, {}, [@NL802154_ATTR_IFINDEX={0x8}, @NL802154_ATTR_WPAN_DEV={0xc, 0x6, 0x300000001}, @NL802154_ATTR_IFINDEX={0x8, 0x3, r8}, @NL802154_ATTR_WPAN_DEV={0xc, 0x6, 0x300000003}, @NL802154_ATTR_IFINDEX={0x8, 0x3, r0}]}, 0x44}, 0x1, 0x0, 0x0, 0x8001}, 0x4000000) 11:48:18 executing program 1: eventfd(0xfffffff9) ioctl$CDROMREADTOCENTRY(0xffffffffffffffff, 0x5306, &(0x7f0000000000)={0x5, 0x4, 0x2, 0x3, @lba=0x8000, 0x4}) ioctl$CDROMSETSPINDOWN(0xffffffffffffffff, 0x531e, &(0x7f0000000040)=0x8) ioctl$CDROMREADCOOKED(0xffffffffffffffff, 0x5315, &(0x7f0000000080)) ioctl$CDROMVOLREAD(0xffffffffffffffff, 0x5313, &(0x7f0000000b00)) syz_open_dev$sg(&(0x7f0000000b40), 0x3ff, 0x80000) r0 = openat$hwrng(0xffffffffffffff9c, &(0x7f0000000b80), 0x800, 0x0) ioctl$CDROMCLOSETRAY(r0, 0x5319) ioctl$CDROM_TIMED_MEDIA_CHANGE(r0, 0x5396, &(0x7f0000000bc0)={0x8, 0x1}) ioctl$CDROMREADAUDIO(r0, 0x530e, &(0x7f0000000c40)={@lba=0x23c, 0x5, 0x12, &(0x7f0000000c00)=""/18}) openat$cgroup_type(r0, &(0x7f0000000c80), 0x2, 0x0) r1 = openat$hwrng(0xffffffffffffff9c, &(0x7f0000000cc0), 0x220000, 0x0) ioctl$CDROMREADTOCHDR(r1, 0x5305, &(0x7f0000000d00)={0x7f, 0x1}) r2 = openat$hwrng(0xffffffffffffff9c, &(0x7f0000000d40), 0x10400, 0x0) write$cgroup_type(r2, &(0x7f0000000d80), 0x9) r3 = openat$cdrom(0xffffffffffffff9c, &(0x7f0000000dc0), 0x0, 0x0) ioctl$CDROMMULTISESSION(r3, 0x5310, &(0x7f0000000e00)={@lba=0xf, 0x1}) r4 = openat$cdrom(0xffffffffffffff9c, &(0x7f0000000e40), 0x240, 0x0) ioctl$CDROMREADTOCENTRY(r4, 0x5306, &(0x7f0000000e80)={0x1f, 0x6, 0x9, 0x0, @lba=0x6, 0x4}) ioctl$CDROMREADCOOKED(r3, 0x5315, &(0x7f0000000ec0)) 11:48:18 executing program 2: ioctl$SCSI_IOCTL_DOORLOCK(0xffffffffffffffff, 0x5380) r0 = syz_open_dev$sg(&(0x7f0000000000), 0x9, 0x200) ioctl$SCSI_IOCTL_SYNC(r0, 0x4) ioctl$SG_GET_SG_TABLESIZE(r0, 0x227f, &(0x7f0000000040)) r1 = openat$cdrom(0xffffffffffffff9c, &(0x7f0000000080), 0x331200, 0x0) ioctl$CDROMRESET(r1, 0x5312) r2 = openat$cgroup(0xffffffffffffffff, &(0x7f00000000c0)='syz0\x00', 0x200002, 0x0) openat$cgroup_netprio_ifpriomap(r2, &(0x7f0000000100), 0x2, 0x0) ioctl$SG_GET_SG_TABLESIZE(r0, 0x227f, &(0x7f0000000140)) r3 = openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000180)='./cgroup.net/syz1\x00', 0x200002, 0x0) r4 = openat$cgroup(r2, &(0x7f00000001c0)='syz0\x00', 0x200002, 0x0) openat$cgroup_pressure(r4, &(0x7f0000000200)='memory.pressure\x00', 0x2, 0x0) ioctl$CDROMSETSPINDOWN(r1, 0x531e, &(0x7f0000000240)=0x6) ioctl$CDROMREADCOOKED(r1, 0x5315, &(0x7f0000000280)) openat$vga_arbiter(0xffffffffffffff9c, &(0x7f0000000d00), 0x200080, 0x0) r5 = openat$hwrng(0xffffffffffffff9c, &(0x7f0000000d40), 0x200000, 0x0) write$tcp_congestion(r5, &(0x7f0000000d80)='westwood\x00', 0x9) ioctl$CDROM_NEXT_WRITABLE(r5, 0x5394, &(0x7f0000000dc0)) openat$cgroup_subtree(r3, &(0x7f0000000e00), 0x2, 0x0) ioctl$CDROMVOLCTRL(0xffffffffffffffff, 0x530a, &(0x7f0000000e40)={0x7f, 0x81, 0x8}) 11:48:18 executing program 6: r0 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) syz_genetlink_get_family_id$nbd(&(0x7f0000000000), r0) sendmsg$NL802154_CMD_NEW_SEC_LEVEL(r0, &(0x7f0000000140)={&(0x7f0000000040)={0x10, 0x0, 0x0, 0x2}, 0xc, &(0x7f0000000100)={&(0x7f0000000080)={0x4c, 0x0, 0x10, 0x70bd26, 0x25dfdbfd, {}, [@NL802154_ATTR_SEC_LEVEL={0x1c, 0x22, 0x0, 0x1, [@NL802154_SECLEVEL_ATTR_DEV_OVERRIDE={0x5, 0x4, 0x1}, @NL802154_SECLEVEL_ATTR_DEV_OVERRIDE={0x5}, @NL802154_SECLEVEL_ATTR_LEVELS={0x5, 0x1, 0x9}]}, @NL802154_ATTR_SEC_LEVEL={0x1c, 0x22, 0x0, 0x1, [@NL802154_SECLEVEL_ATTR_CMD_FRAME={0x8, 0x3, 0x3}, @NL802154_SECLEVEL_ATTR_DEV_OVERRIDE={0x5}, @NL802154_SECLEVEL_ATTR_CMD_FRAME={0x8, 0x3, 0x9}]}]}, 0x4c}, 0x1, 0x0, 0x0, 0x8091}, 0x80) sendmsg$NLBL_MGMT_C_REMOVE(r0, &(0x7f0000000240)={&(0x7f0000000180)={0x10, 0x0, 0x0, 0x10000000}, 0xc, &(0x7f0000000200)={&(0x7f00000001c0)={0x34, 0x0, 0x400, 0x70bd2d, 0x25dfdbfc, {}, [@NLBL_MGMT_A_IPV4ADDR={0x8, 0x7, @multicast2}, @NLBL_MGMT_A_IPV4ADDR={0x8, 0x7, @loopback}, @NLBL_MGMT_A_IPV4ADDR={0x8, 0x7, @remote}, @NLBL_MGMT_A_CLPDOI={0x8}]}, 0x34}, 0x1, 0x0, 0x0, 0x8000}, 0x800) ioctl$sock_SIOCGIFINDEX_802154(r0, 0x8933, &(0x7f0000000280)={'wpan4\x00', 0x0}) sendmsg$NL802154_CMD_NEW_SEC_DEVKEY(r0, &(0x7f0000000500)={&(0x7f00000002c0)={0x10, 0x0, 0x0, 0x41000089}, 0xc, &(0x7f00000004c0)={&(0x7f0000000300)={0x190, 0x0, 0x400, 0x70bd2d, 0x25dfdbfc, {}, [@NL802154_ATTR_SEC_DEVKEY={0x8c, 0x24, 0x0, 0x1, [@NL802154_DEVKEY_ATTR_FRAME_COUNTER={0x8, 0x1, 0x8}, @NL802154_DEVKEY_ATTR_ID={0x6c, 0x3, 0x0, 0x1, [@NL802154_KEY_ID_ATTR_IMPLICIT={0x44, 0x3, 0x0, 0x1, [@NL802154_DEV_ADDR_ATTR_SHORT={0x6, 0x3, 0xaaa0}, @NL802154_DEV_ADDR_ATTR_SHORT={0x6, 0x3, 0xaaa0}, @NL802154_DEV_ADDR_ATTR_PAN_ID={0x6, 0x1, 0x2}, @NL802154_DEV_ADDR_ATTR_PAN_ID={0x6, 0x1, 0x1}, @NL802154_DEV_ADDR_ATTR_EXTENDED={0xc, 0x4, {0xaaaaaaaaaaaa0102}}, @NL802154_DEV_ADDR_ATTR_MODE={0x8, 0x2, 0x2}, @NL802154_DEV_ADDR_ATTR_EXTENDED={0xc, 0x4, {0xaaaaaaaaaaaa0202}}]}, @NL802154_KEY_ID_ATTR_MODE={0x8, 0x1, 0x2}, @NL802154_KEY_ID_ATTR_IMPLICIT={0x1c, 0x3, 0x0, 0x1, [@NL802154_DEV_ADDR_ATTR_SHORT={0x6, 0x3, 0xaaa1}, @NL802154_DEV_ADDR_ATTR_PAN_ID={0x6}, @NL802154_DEV_ADDR_ATTR_PAN_ID={0x6}]}]}, @NL802154_DEVKEY_ATTR_FRAME_COUNTER={0x8, 0x1, 0xdc0e}, @NL802154_DEVKEY_ATTR_EXTENDED_ADDR={0xc}]}, @NL802154_ATTR_SEC_DEVKEY={0x78, 0x24, 0x0, 0x1, [@NL802154_DEVKEY_ATTR_EXTENDED_ADDR={0xc, 0x2, {0xaaaaaaaaaaaa0302}}, @NL802154_DEVKEY_ATTR_ID={0x5c, 0x3, 0x0, 0x1, [@NL802154_KEY_ID_ATTR_SOURCE_SHORT={0x8, 0x4, 0x5}, @NL802154_KEY_ID_ATTR_MODE={0x8, 0x1, 0x2}, @NL802154_KEY_ID_ATTR_INDEX={0x5, 0x2, 0x1}, @NL802154_KEY_ID_ATTR_IMPLICIT={0x38, 0x3, 0x0, 0x1, [@NL802154_DEV_ADDR_ATTR_SHORT={0x6, 0x3, 0xaaa1}, @NL802154_DEV_ADDR_ATTR_SHORT={0x6, 0x3, 0xaaa2}, @NL802154_DEV_ADDR_ATTR_SHORT={0x6, 0x3, 0xaaa1}, @NL802154_DEV_ADDR_ATTR_PAN_ID={0x6, 0x1, 0xffff}, @NL802154_DEV_ADDR_ATTR_PAN_ID={0x6, 0x1, 0x1}, @NL802154_DEV_ADDR_ATTR_EXTENDED={0xc, 0x4, {0xaaaaaaaaaaaa0102}}]}, @NL802154_KEY_ID_ATTR_INDEX={0x5, 0x2, 0x2}]}, @NL802154_DEVKEY_ATTR_EXTENDED_ADDR={0xc, 0x2, {0x300}}]}, @NL802154_ATTR_WPAN_DEV={0xc, 0x6, 0x2}, @NL802154_ATTR_WPAN_DEV={0xc, 0x6, 0x2}, @NL802154_ATTR_SEC_DEVKEY={0x4c, 0x24, 0x0, 0x1, [@NL802154_DEVKEY_ATTR_FRAME_COUNTER={0x8, 0x1, 0x8175}, @NL802154_DEVKEY_ATTR_EXTENDED_ADDR={0xc, 0x2, {0xaaaaaaaaaaaa0102}}, @NL802154_DEVKEY_ATTR_FRAME_COUNTER={0x8, 0x1, 0x5}, @NL802154_DEVKEY_ATTR_EXTENDED_ADDR={0xc, 0x2, {0xaaaaaaaaaaaa0302}}, @NL802154_DEVKEY_ATTR_ID={0x14, 0x3, 0x0, 0x1, [@NL802154_KEY_ID_ATTR_MODE={0x8, 0x1, 0x3}, @NL802154_KEY_ID_ATTR_MODE={0x8, 0x1, 0x1}]}, @NL802154_DEVKEY_ATTR_EXTENDED_ADDR={0xc, 0x2, {0xaaaaaaaaaaaa0102}}]}, @NL802154_ATTR_IFINDEX={0x8}, @NL802154_ATTR_WPAN_DEV={0xc, 0x6, 0x200000002}]}, 0x190}, 0x1, 0x0, 0x0, 0x20000084}, 0x80) sendmsg$IEEE802154_LLSEC_DEL_DEVKEY(r0, &(0x7f0000000600)={&(0x7f0000000540)={0x10, 0x0, 0x0, 0x100}, 0xc, &(0x7f00000005c0)={&(0x7f0000000580)={0x1c, 0x0, 0x100, 0x70bd2c, 0x25dfdbfb, {}, [@IEEE802154_ATTR_LLSEC_KEY_MODE={0x5}]}, 0x1c}, 0x1, 0x0, 0x0, 0x8040}, 0x1) ioctl$sock_SIOCGIFINDEX_802154(r0, 0x8933, &(0x7f0000000680)={'wpan4\x00', 0x0}) sendmsg$NL802154_CMD_NEW_SEC_LEVEL(r0, &(0x7f0000000780)={&(0x7f0000000640)={0x10, 0x0, 0x0, 0x100}, 0xc, &(0x7f0000000740)={&(0x7f00000006c0)={0x60, 0x0, 0x4, 0x70bd2d, 0x25dfdbfe, {}, [@NL802154_ATTR_WPAN_DEV={0xc, 0x6, 0x300000003}, @NL802154_ATTR_SEC_LEVEL={0xc, 0x22, 0x0, 0x1, [@NL802154_SECLEVEL_ATTR_CMD_FRAME={0x8, 0x3, 0x8}]}, @NL802154_ATTR_SEC_LEVEL={0x14, 0x22, 0x0, 0x1, [@NL802154_SECLEVEL_ATTR_FRAME={0x8, 0x2, 0x2}, @NL802154_SECLEVEL_ATTR_FRAME={0x8, 0x2, 0x2}]}, @NL802154_ATTR_WPAN_DEV={0xc, 0x6, 0x200000002}, @NL802154_ATTR_WPAN_DEV={0xc}, @NL802154_ATTR_IFINDEX={0x8, 0x3, r2}]}, 0x60}, 0x1, 0x0, 0x0, 0x24040800}, 0xc000) r3 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r4 = syz_genetlink_get_family_id$nbd(&(0x7f0000000800), r0) sendmsg$NBD_CMD_RECONFIGURE(r3, &(0x7f0000000900)={&(0x7f00000007c0)={0x10, 0x0, 0x0, 0x800}, 0xc, &(0x7f00000008c0)={&(0x7f0000000840)={0x58, r4, 0x100, 0x70bd29, 0x25dfdbfe, {}, [@NBD_ATTR_DEAD_CONN_TIMEOUT={0xc, 0x8, 0x1a5}, @NBD_ATTR_DEAD_CONN_TIMEOUT={0xc, 0x8, 0x8}, @NBD_ATTR_SERVER_FLAGS={0xc}, @NBD_ATTR_INDEX={0x8, 0x1, 0x0}, @NBD_ATTR_BLOCK_SIZE_BYTES={0xc}, @NBD_ATTR_SIZE_BYTES={0xc, 0x2, 0x6}]}, 0x58}, 0x1, 0x0, 0x0, 0x85}, 0x24008000) r5 = syz_genetlink_get_family_id$nl802154(&(0x7f0000000980), r0) ioctl$sock_SIOCGIFINDEX_802154(r3, 0x8933, &(0x7f00000009c0)={'wpan1\x00', 0x0}) sendmsg$NL802154_CMD_NEW_SEC_LEVEL(r0, &(0x7f0000000ac0)={&(0x7f0000000940)={0x10, 0x0, 0x0, 0x8}, 0xc, &(0x7f0000000a80)={&(0x7f0000000a00)={0x64, r5, 0x604, 0x70bd25, 0x7e5, {}, [@NL802154_ATTR_WPAN_DEV={0xc, 0x6, 0x3}, @NL802154_ATTR_SEC_LEVEL={0x14, 0x22, 0x0, 0x1, [@NL802154_SECLEVEL_ATTR_FRAME={0x8, 0x2, 0x2}, @NL802154_SECLEVEL_ATTR_DEV_OVERRIDE={0x5}]}, @NL802154_ATTR_IFINDEX={0x8, 0x3, r6}, @NL802154_ATTR_IFINDEX={0x8, 0x3, r1}, @NL802154_ATTR_SEC_LEVEL={0x14, 0x22, 0x0, 0x1, [@NL802154_SECLEVEL_ATTR_FRAME={0x8, 0x2, 0x1}, @NL802154_SECLEVEL_ATTR_LEVELS={0x5, 0x1, 0x5}]}, @NL802154_ATTR_WPAN_DEV={0xc, 0x6, 0x200000002}]}, 0x64}}, 0x8050) r7 = syz_genetlink_get_family_id$nl802154(&(0x7f0000000b40), r3) ioctl$sock_SIOCGIFINDEX_802154(r0, 0x8933, &(0x7f0000000b80)={'wpan1\x00', 0x0}) sendmsg$NL802154_CMD_GET_SEC_DEVKEY(r3, &(0x7f0000000c80)={&(0x7f0000000b00)={0x10, 0x0, 0x0, 0x10000}, 0xc, &(0x7f0000000c40)={&(0x7f0000000bc0)={0x64, r7, 0x800, 0x70bd26, 0x25dfdbff, {}, [@NL802154_ATTR_WPAN_DEV={0xc}, @NL802154_ATTR_WPAN_DEV={0xc}, @NL802154_ATTR_IFINDEX={0x8, 0x3, r2}, @NL802154_ATTR_IFINDEX={0x8, 0x3, r8}, @NL802154_ATTR_IFINDEX={0x8, 0x3, r6}, @NL802154_ATTR_WPAN_DEV={0xc}, @NL802154_ATTR_IFINDEX={0x8, 0x3, r2}, @NL802154_ATTR_WPAN_DEV={0xc, 0x6, 0x3}]}, 0x64}, 0x1, 0x0, 0x0, 0x4000844}, 0x4000) r9 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) sendmsg$NLBL_MGMT_C_REMOVEDEF(r9, &(0x7f0000000d80)={&(0x7f0000000cc0)={0x10, 0x0, 0x0, 0x10000000}, 0xc, &(0x7f0000000d40)={&(0x7f0000000d00)={0x1c, 0x0, 0x1, 0x70bd28, 0x25dfdbfe, {}, [@NLBL_MGMT_A_PROTOCOL={0x8, 0x2, 0x3}]}, 0x1c}, 0x1, 0x0, 0x0, 0x800}, 0x4000) 11:48:18 executing program 3: r0 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000000)='./binderfs2/custom0\x00', 0x0, 0x0) r1 = perf_event_open(&(0x7f00000007c0)={0x0, 0x80, 0x2, 0x4, 0x1c, 0xff, 0x0, 0xe4, 0x8, 0x7, 0x1, 0x1, 0x1, 0x1, 0x1, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x1, 0x0, 0x1, 0x1, 0x0, 0x0, 0x1, 0x0, 0x1, 0x1, 0x1, 0x1, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x1, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffff1cd, 0x1, @perf_bp={&(0x7f0000000780), 0x4}, 0x4173, 0x1, 0x2, 0x4, 0x1, 0x2, 0x7, 0x0, 0xffffff7f, 0x0, 0x68c4}, 0x0, 0x5, 0xffffffffffffffff, 0x0) r2 = openat$cgroup_type(0xffffffffffffffff, &(0x7f0000000840), 0x2, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000ac0)={0xa0, 0x0, &(0x7f0000000940)=[@increfs_done={0x40106308, 0x2}, @acquire, @dead_binder_done, @register_looper, @dead_binder_done, @increfs_done={0x40106308, 0x3}, @request_death={0x400c630e, 0x1}, @reply={0x40406301, {0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x48, 0x18, &(0x7f0000000880)={@fd={0x66642a85, 0x0, r1}, @flat=@weak_binder={0x77622a85, 0x0, 0x1}, @fd={0x66642a85, 0x0, r2}}, &(0x7f0000000900)={0x0, 0x18, 0x30}}}], 0xba, 0x0, &(0x7f0000000a00)="300c964b99b0fc8bc041eed901596dcc00c49ae50e7d50ab2181ebd3ced1dedd5b95801b47942df87fa0193d45616e7abcb521e4b3031cf0f6ce86d01e78fd249c0a368369dcbb588cf079a014940599b7b6d4397e0d176e2576874ae05c2c5cb611bc0a2d765cd1223396d58aed4be672d29a0400a0b3f8ce7a4a03028b890b0f5a8be682791ee67fd5956810a83a83ae92d2e89345cd2f5ecebe5e98f11d0642b6624d047bf7127114786a300db84bfe332fe8533489aad8be"}) r3 = mmap$IORING_OFF_CQ_RING(&(0x7f0000ffe000/0x2000)=nil, 0x2000, 0x2000001, 0x4000010, 0xffffffffffffffff, 0x8000000) r4 = mmap$IORING_OFF_SQES(&(0x7f0000ffe000/0x2000)=nil, 0x2000, 0x1000008, 0x4010, 0xffffffffffffffff, 0x10000000) r5 = io_uring_register$IORING_REGISTER_PERSONALITY(0xffffffffffffffff, 0x9, 0x0, 0x0) r6 = openat$cgroup_pressure(0xffffffffffffffff, &(0x7f0000000b00)='io.pressure\x00', 0x2, 0x0) syz_io_uring_submit(r3, r4, &(0x7f0000000b40)=@IORING_OP_TEE={0x21, 0x5, 0x0, @fd_index=0x9, 0x0, 0x0, 0x6, 0x7, 0x1, {0x0, r5, r6}}, 0x5) rt_sigaction(0x15, &(0x7f0000000c40)={&(0x7f0000000b80)="f2a6c4e2252c9eec000000666666420f3a14a9020000000dc4e279185556c4e2ed2981060000008fe9d801cbdd15ddac000066450f3a14913223333300c4e17a6f54d28dc4a261ba5682", 0x80000002, &(0x7f0000000c00)="c4c2c5ab07c4e1fd60fbc461ff2d6dcd3e0f1b1e0f0d3ec4e2e9af1c430fff57000f419f47200000c4a2f920cd450a8000000000", {[0x1]}}, &(0x7f0000000d40)={&(0x7f0000000c80)="e353c442f8f35266c401f928dff30fa7c0653e2e2e64a564410f0ffca0c481196907c401015de4dbd1c4019172e508", 0x0, &(0x7f0000000cc0)="c4e141f123c4a27bf79482a9e77544c422cd3c8204000000660fc5c881c441c173dd00c483fd01309dc462559c71472e260f4694aa0a000000c4e228f31dfeefffff140f"}, 0x8, &(0x7f0000000d80)) ioctl$CDROM_MEDIA_CHANGED(0xffffffffffffffff, 0x5325, 0x7) openat$binderfs(0xffffffffffffff9c, &(0x7f0000000dc0)='./binderfs2/binder1\x00', 0x800, 0x0) r7 = syz_io_uring_setup(0x783a, &(0x7f0000000e00)={0x0, 0xe533, 0x8, 0x3, 0x3a0}, &(0x7f0000ffc000/0x1000)=nil, &(0x7f0000ffc000/0x3000)=nil, &(0x7f0000000e80), &(0x7f0000000ec0)) mmap$IORING_OFF_SQ_RING(&(0x7f0000ffc000/0x4000)=nil, 0x4000, 0x2000000, 0x12, r7, 0x0) msgctl$IPC_RMID(0xffffffffffffffff, 0x0) r8 = openat$hwrng(0xffffffffffffff9c, &(0x7f0000000f00), 0x1000, 0x0) mmap$IORING_OFF_SQES(&(0x7f0000ffe000/0x1000)=nil, 0x1000, 0x1000000, 0x11, r8, 0x10000000) r9 = syz_io_uring_setup(0x7870, &(0x7f0000000f40)={0x0, 0x5d7e, 0x10, 0x1, 0x304, 0x0, r8}, &(0x7f0000ffe000/0x2000)=nil, &(0x7f0000ffa000/0x3000)=nil, &(0x7f0000000fc0), &(0x7f0000001000)) io_uring_register$IORING_REGISTER_PERSONALITY(r9, 0x9, 0x0, 0x0) semget(0x1, 0x3, 0x511) 11:48:18 executing program 7: openat$vga_arbiter(0xffffffffffffff9c, &(0x7f0000000000), 0x28081, 0x0) r0 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r1 = openat$cgroup_ro(0xffffffffffffffff, &(0x7f0000000280)='hugetlb.1GB.usage_in_bytes\x00', 0x0, 0x0) sendmsg$NBD_CMD_DISCONNECT(r0, &(0x7f0000000340)={&(0x7f0000000040)={0x10, 0x0, 0x0, 0x400}, 0xc, &(0x7f0000000300)={&(0x7f00000002c0)={0x38, 0x0, 0x800, 0x70bd27, 0x25dfdbfe, {}, [@NBD_ATTR_SOCKETS={0x24, 0x7, 0x0, 0x1, [{0x8}, {0x8, 0x1, r1}, {0x8}, {0x8}]}]}, 0x38}, 0x1, 0x0, 0x0, 0x20000005}, 0x24000000) sendmsg$NL802154_CMD_SET_SHORT_ADDR(r0, &(0x7f0000000480)={&(0x7f0000000380)={0x10, 0x0, 0x0, 0x8000}, 0xc, &(0x7f0000000440)={&(0x7f00000003c0)={0x44, 0x0, 0x100, 0x70bd2b, 0x25dfdbfb, {}, [@NL802154_ATTR_SHORT_ADDR={0x6}, @NL802154_ATTR_WPAN_DEV={0xc}, @NL802154_ATTR_WPAN_DEV={0xc, 0x6, 0x300000003}, @NL802154_ATTR_IFINDEX={0x8}, @NL802154_ATTR_IFINDEX={0x8}]}, 0x44}, 0x1, 0x0, 0x0, 0x400}, 0x80) openat$cgroup_netprio_ifpriomap(r1, &(0x7f00000004c0), 0x2, 0x0) r2 = openat$hwrng(0xffffffffffffff9c, &(0x7f0000000500), 0x20000, 0x0) getsockopt$inet6_mreq(r2, 0x29, 0x15, &(0x7f0000000540)={@mcast1}, &(0x7f0000000580)=0x14) getsockopt$inet6_mreq(r2, 0x29, 0x15, &(0x7f00000005c0)={@ipv4={""/10, ""/2, @initdev}}, &(0x7f0000000600)=0x14) r3 = io_uring_setup(0x5c38, &(0x7f0000000640)={0x0, 0x5b7f, 0x10, 0x2, 0x214, 0x0, r2}) io_uring_register$IORING_REGISTER_PERSONALITY(r3, 0x9, 0x0, 0x0) r4 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) sendmsg$NLBL_MGMT_C_REMOVEDEF(r4, &(0x7f0000000800)={&(0x7f00000006c0)={0x10, 0x0, 0x0, 0x4}, 0xc, &(0x7f00000007c0)={&(0x7f0000000700)={0x90, 0x0, 0x500, 0x70bd26, 0x25dfdbfe, {}, [@NLBL_MGMT_A_IPV6MASK={0x14, 0x6, @local}, @NLBL_MGMT_A_PROTOCOL={0x8, 0x2, 0x3}, @NLBL_MGMT_A_CLPDOI={0x8, 0xc, 0x2}, @NLBL_MGMT_A_IPV6ADDR={0x14, 0x5, @empty}, @NLBL_MGMT_A_IPV6MASK={0x14, 0x6, @private0={0xfc, 0x0, '\x00', 0x1}}, @NLBL_MGMT_A_IPV6MASK={0x14, 0x6, @private1}, @NLBL_MGMT_A_IPV6ADDR={0x14, 0x5, @rand_addr=' \x01\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x02'}, @NLBL_MGMT_A_FAMILY={0x6, 0xb, 0x2b}]}, 0x90}, 0x1, 0x0, 0x0, 0x80}, 0x90) sendmsg$IEEE802154_LLSEC_GETPARAMS(r4, &(0x7f0000000900)={&(0x7f0000000840)={0x10, 0x0, 0x0, 0x2000000}, 0xc, &(0x7f00000008c0)={&(0x7f0000000880)={0x28, 0x0, 0x20, 0x70bd29, 0x25dfdbfe, {}, [@IEEE802154_ATTR_DEV_INDEX={0x8}, @IEEE802154_ATTR_DEV_NAME={0xa, 0x1, 'wpan1\x00'}]}, 0x28}, 0x1, 0x0, 0x0, 0x24000001}, 0x100) ioctl$PERF_EVENT_IOC_SET_FILTER(0xffffffffffffffff, 0x40082406, &(0x7f0000000940)='/dev/hwrng\x00') ioctl$CDROM_SELECT_DISK(r1, 0x5322, 0xfff) openat$cgroup_ro(r1, &(0x7f0000000980)='hugetlb.1GB.usage_in_bytes\x00', 0x0, 0x0) ioctl$sock_SIOCGIFINDEX_802154(0xffffffffffffffff, 0x8933, &(0x7f0000000a00)={'wpan0\x00', 0x0}) ioctl$sock_SIOCGIFINDEX_802154(r4, 0x8933, &(0x7f0000000a40)={'wpan0\x00', 0x0}) sendmsg$IEEE802154_LLSEC_DEL_DEVKEY(r4, &(0x7f0000000b40)={&(0x7f00000009c0)={0x10, 0x0, 0x0, 0x200}, 0xc, &(0x7f0000000b00)={&(0x7f0000000a80)={0x58, 0x0, 0x400, 0x70bd27, 0x25dfdbfb, {}, [@IEEE802154_ATTR_LLSEC_KEY_MODE={0x5, 0x2b, 0x3}, @IEEE802154_ATTR_LLSEC_KEY_SOURCE_SHORT={0x8, 0x2c, 0xbcd4e33}, @IEEE802154_ATTR_DEV_NAME={0xa, 0x1, 'wpan0\x00'}, @IEEE802154_ATTR_DEV_INDEX={0x8, 0x2, r5}, @IEEE802154_ATTR_DEV_INDEX={0x8}, @IEEE802154_ATTR_DEV_INDEX={0x8, 0x2, r6}, @IEEE802154_ATTR_SHORT_ADDR={0x6, 0x4, 0xaaa0}, @IEEE802154_ATTR_SHORT_ADDR={0x6, 0x4, 0xfffe}]}, 0x58}, 0x1, 0x0, 0x0, 0x4080}, 0x8000) 11:48:18 executing program 4: syz_extract_tcp_res$synack(&(0x7f0000000000), 0x1, 0x0) syz_extract_tcp_res$synack(&(0x7f0000000040), 0x1, 0x0) rt_sigaction(0xd, &(0x7f0000000140)={&(0x7f0000000080)="c4e3c178b5d8c4634d29c4817d518000000080c482fd346000673e0062fa660f38f571012e0ffc689bc461296480e6e3000065430f002b460febbf61d4d0d445cf", 0x1, &(0x7f0000000100)="470f0d16432996917500008fe9e001f40f1553f0c0e200c441f8ae12e00e0fff6100f346acc40379087b0000"}, &(0x7f0000000200)={&(0x7f0000000180)="3c9d6467660f3825af84dff5c36666460f2f99f9a6000044c0120967de8a50000000660f72e64c0f0f65f4aed80c0500000000660fdd700ac4e13dc6cb28", 0x0, &(0x7f00000001c0)="c463097e11000f8b0600000022f3c4e27d395c7500c443c92122088f89b09a08c4a2f923680666450f285d0cdb8d8b0000008f297c800f"}, 0x8, &(0x7f0000000240)) syz_extract_tcp_res(&(0x7f0000000280), 0x6, 0xa70) syz_extract_tcp_res$synack(&(0x7f00000002c0), 0x1, 0x0) ioctl$SCSI_IOCTL_DOORLOCK(0xffffffffffffffff, 0x5380) syz_emit_ethernet(0x1e, &(0x7f0000000300)={@broadcast, @dev={'\xaa\xaa\xaa\xaa\xaa', 0xd}, @void, {@can={0xc, {{0x3}, 0x2, 0x1, 0x0, 0x0, "6bfba1406a479fb2"}}}}, &(0x7f0000000340)={0x0, 0x0, [0x8b9, 0x6db, 0xffffffff, 0x984]}) syz_extract_tcp_res(&(0x7f0000000380), 0x1000, 0x40) r0 = epoll_create1(0x0) io_submit(0x0, 0x1, &(0x7f00000004c0)=[&(0x7f0000000480)={0x0, 0x0, 0x0, 0x6, 0x7, r0, &(0x7f00000003c0)="00b733efbc7a452b4c4974d0325c47c0cd7f228aedb7a964d6bebc8a41c698f8da99a12d83c1ee10ea1f0dafe385bbbf36aecccb67651345b4e70c690533fe0b0a36153fd3e0bc203ea66e295a109d2d881d412f4d7d7c3f5f1b42d41bd6b54432553390cacac0db10b825d9644eb2f6d85dde1b647d6159751d0b58f05f5d7ddfeb112c8647d5fa3821e9c28cefd06eb682c57b78c4dfef355dae2253a329de2a92a4c2952289570e459255c5d7b67e451e7893b2", 0xb5, 0x6, 0x0, 0x2}]) syz_emit_ethernet(0xf1, &(0x7f0000000500)={@empty, @broadcast, @void, {@llc_tr={0x11, {@llc={0xf0, 0x8e, "a7e2", "4438090c86455279887b27f5d9c7d1e053ac06be6bf50fc3e0cf9c8b7b18e76f80416f8ef3e8972b1d818e6dab216e4b279799936725c3220d6412b05e66a7a986d09d63798706c5a0209f2123b5e99cc1fc63557c5df124dd742e490d749ba501a82736674c26938bb7c8259bd9c6255105d039b36e07ce39315565bef1c3f0ae998dfa8b4feca55b701a7d908e7834a875d8a6bff23736bc379bd69d4149d619bd3e95466c31cc8fe67bf24e665b9dc826e4cb1749350dfbef9909bd11e6f924191d538bb2aeaa40199e976ce9597674a26345eb67b818e6f191bddabb90"}}}}}, &(0x7f0000000600)={0x0, 0x2, [0x6bb, 0xf50, 0xa3e, 0x5ed]}) r1 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r2 = syz_genetlink_get_family_id$nbd(&(0x7f0000000680), 0xffffffffffffffff) sendmsg$NBD_CMD_RECONFIGURE(r1, &(0x7f0000000740)={&(0x7f0000000640), 0xc, &(0x7f0000000700)={&(0x7f00000006c0)={0x20, r2, 0x500, 0x70bd29, 0x25dfdbfc, {}, [@NBD_ATTR_BLOCK_SIZE_BYTES={0xc, 0x3, 0x3f}]}, 0x20}, 0x1, 0x0, 0x0, 0x84}, 0x20000850) getgroups(0x1, &(0x7f0000000780)=[0x0]) r3 = openat$cgroup_type(0xffffffffffffffff, &(0x7f00000007c0), 0x2, 0x0) write$cgroup_type(r3, &(0x7f0000000800), 0x9) r4 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r5 = syz_genetlink_get_family_id$nl802154(&(0x7f0000000880), r1) sendmsg$NL802154_CMD_SET_TX_POWER(r4, &(0x7f0000000940)={&(0x7f0000000840)={0x10, 0x0, 0x0, 0x40}, 0xc, &(0x7f0000000900)={&(0x7f00000008c0)={0x38, r5, 0x8, 0x70bd27, 0x25dfdbfb, {}, [@NL802154_ATTR_WPAN_DEV={0xc}, @NL802154_ATTR_TX_POWER={0x8, 0xb, 0x80}, @NL802154_ATTR_WPAN_PHY={0x8, 0x1, 0x2}, @NL802154_ATTR_TX_POWER={0x8, 0xb, 0x7fff}]}, 0x38}, 0x1, 0x0, 0x0, 0x20044880}, 0x40001) 11:48:18 executing program 5: setitimer(0x0, &(0x7f0000000000)={{}, {0x0, 0xea60}}, &(0x7f0000000040)) getitimer(0x0, &(0x7f0000000080)) r0 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$netlbl_mgmt(&(0x7f0000000100), 0xffffffffffffffff) sendmsg$NLBL_MGMT_C_ADDDEF(r0, &(0x7f00000001c0)={&(0x7f00000000c0)={0x10, 0x0, 0x0, 0x1}, 0xc, &(0x7f0000000180)={&(0x7f0000000140)={0x1c, r1, 0x4, 0x70bd2a, 0x25dfdbff, {}, [@NLBL_MGMT_A_CLPDOI={0x8}]}, 0x1c}, 0x1, 0x0, 0x0, 0x4000000}, 0x40000) geteuid() syz_usb_connect$cdc_ecm(0x4, 0x10d, &(0x7f0000000200)={{0x12, 0x1, 0x720, 0x2, 0x0, 0x0, 0x10, 0x525, 0xa4a1, 0x40, 0x1, 0x2, 0x3, 0x1, [{{0x9, 0x2, 0xfb, 0x1, 0x1, 0xba, 0x50, 0xff, [{{0x9, 0x4, 0x0, 0x7, 0x2, 0x2, 0x6, 0x0, 0x7c, {{0x8, 0x24, 0x6, 0x0, 0x0, "fbf211"}, {0x5, 0x24, 0x0, 0x8}, {0xd, 0x24, 0xf, 0x1, 0x1, 0x3f, 0x3, 0x40}, [@mdlm_detail={0x99, 0x24, 0x13, 0x3, "48c1a1b655094616df62fff6017defd0bdac4f2617618052fc22350170d4b41a1affe05826274c5d93aa871d89455559c068d877251368c5b00552322da12b5958d76e60294d79d6bd527055bb53f40402ca669ba20042da00554f68b1b12b345fc2bb35f09aac73eb5ac2fcd8634e5e7252075c0d8ce0ad3e8dda63c3c27a6db1be131aa7525a018859895d6e885540b704d1f7dc"}, @country_functional={0xc, 0x24, 0x7, 0x90, 0x6, [0x4, 0x9, 0xe77]}, @obex={0x5, 0x24, 0x15, 0x8}, @acm={0x4, 0x24, 0x2, 0xd}, @ncm={0x6, 0x24, 0x1a, 0x7, 0x26}]}, {[{{0x9, 0x5, 0x81, 0x3, 0x1df, 0x81, 0x32, 0x1}}], {{0x9, 0x5, 0x82, 0x2, 0x3ff, 0x2, 0x6, 0x5}}, {{0x9, 0x5, 0x3, 0x2, 0x8, 0x1, 0x4, 0xff}}}}}]}}]}}, &(0x7f0000000640)={0xa, &(0x7f0000000340)={0xa, 0x6, 0x110, 0x3, 0xae, 0x8, 0xff, 0x1f}, 0x5, &(0x7f0000000380)={0x5, 0xf, 0x5}, 0x7, [{0x14, &(0x7f00000003c0)=@string={0x14, 0x3, "fd058c95bdf599f8e5f073eae7235e49a442"}}, {0x4, &(0x7f0000000400)=@lang_id={0x4, 0x3, 0x380a}}, {0x4, &(0x7f0000000440)=@lang_id={0x4, 0x3, 0x445}}, {0x4, &(0x7f0000000480)=@lang_id={0x4, 0x3, 0x2c0a}}, {0x4, &(0x7f00000004c0)=@lang_id={0x4, 0x3, 0x1001}}, {0x4, &(0x7f0000000500)=@lang_id={0x4, 0x3, 0x42a}}, {0xf1, &(0x7f0000000540)=@string={0xf1, 0x3, "84d5b48356934b18c11ca618df7ef64b6c011395cc6829bdeedd71e659bc7545af1fffa2149c42cd8da15a92d7564b65a135a440b298e19eddd0415c86d7b42e1c9641793180d54dedbc008eeb526d3540368aed104e9c9220a6d3e7f635e585d6e7f55ecaab0cf2111887b6e16bfe4c3f94f53b49e421698825847fc65ef965c3007893b9e33ccdbdb39b38af85a0863c618f0d2135ee175361a7f77a56730d8ae5c677510cf17584b6302361fc90e77b8e50675a5756fd20d5f4bc211f04b21de401616a64c3d1a1398527dca0fd098e082f7533b65e1f4626cc5cbfa742eac63bb0d848f069eb64132f065192e5"}}]}) r2 = syz_genetlink_get_family_id$nl802154(&(0x7f0000000700), r0) ioctl$sock_SIOCGIFINDEX_802154(r0, 0x8933, &(0x7f0000000740)={'wpan1\x00', 0x0}) ioctl$sock_SIOCGIFINDEX_802154(r0, 0x8933, &(0x7f0000000780)={'wpan3\x00', 0x0}) sendmsg$NL802154_CMD_NEW_SEC_LEVEL(r0, &(0x7f0000000840)={&(0x7f00000006c0)={0x10, 0x0, 0x0, 0x8000000}, 0xc, &(0x7f0000000800)={&(0x7f00000007c0)={0x38, r2, 0x1, 0x70bd2a, 0x25dfdbff, {}, [@NL802154_ATTR_IFINDEX={0x8, 0x3, r3}, @NL802154_ATTR_IFINDEX={0x8, 0x3, r4}, @NL802154_ATTR_WPAN_DEV={0xc, 0x6, 0x100000001}, @NL802154_ATTR_IFINDEX={0x8}]}, 0x38}, 0x1, 0x0, 0x0, 0x1}, 0x0) ioctl$CDROMREADAUDIO(0xffffffffffffffff, 0x530e, &(0x7f00000008c0)={@lba, 0x2, 0x3b, &(0x7f0000000880)=""/59}) ioctl$CDROMREADAUDIO(0xffffffffffffffff, 0x530e, &(0x7f0000000940)={@lba=0x7, 0x1, 0x24, &(0x7f0000000900)=""/36}) sendmsg$NLBL_MGMT_C_REMOVEDEF(r0, &(0x7f0000000a40)={&(0x7f0000000980)={0x10, 0x0, 0x0, 0x20000}, 0xc, &(0x7f0000000a00)={&(0x7f00000009c0)={0x34, r1, 0x100, 0x70bd2c, 0x25dfdbfd, {}, [@NLBL_MGMT_A_IPV4MASK={0x8, 0x8, @local}, @NLBL_MGMT_A_CV4DOI={0x8, 0x4, 0xffffffffffffffff}, @NLBL_MGMT_A_IPV4MASK={0x8, 0x8, @dev={0xac, 0x14, 0x14, 0x39}}, @NLBL_MGMT_A_IPV4ADDR={0x8, 0x7, @private=0xa010102}]}, 0x34}, 0x1, 0x0, 0x0, 0x40}, 0x8011) ioctl$sock_SIOCGIFINDEX_802154(r0, 0x8933, &(0x7f0000000ac0)={'wpan1\x00', 0x0}) ioctl$sock_SIOCGIFINDEX_802154(0xffffffffffffffff, 0x8933, &(0x7f0000000b00)={'wpan1\x00', 0x0}) sendmsg$NL802154_CMD_GET_SEC_KEY(r0, &(0x7f0000000c00)={&(0x7f0000000a80)={0x10, 0x0, 0x0, 0x400000}, 0xc, &(0x7f0000000bc0)={&(0x7f0000000b40)={0x4c, r2, 0x410, 0x70bd29, 0x25dfdbff, {}, [@NL802154_ATTR_IFINDEX={0x8, 0x3, r3}, @NL802154_ATTR_IFINDEX={0x8, 0x3, r5}, @NL802154_ATTR_WPAN_DEV={0xc, 0x6, 0x300000003}, @NL802154_ATTR_IFINDEX={0x8, 0x3, r6}, @NL802154_ATTR_IFINDEX={0x8, 0x3, r3}, @NL802154_ATTR_WPAN_DEV={0xc}]}, 0x4c}, 0x1, 0x0, 0x0, 0xd4}, 0x801) r7 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) syz_genetlink_get_family_id$ieee802154(&(0x7f0000000c40), r7) sendmsg$NL802154_CMD_SET_ACKREQ_DEFAULT(0xffffffffffffffff, &(0x7f0000000d40)={&(0x7f0000000c80)={0x10, 0x0, 0x0, 0x10000}, 0xc, &(0x7f0000000d00)={&(0x7f0000000cc0)={0x20, r2, 0x800, 0x70bd29, 0x25dfdbfb, {}, [@NL802154_ATTR_WPAN_DEV={0xc, 0x6, 0x2}]}, 0x20}, 0x1, 0x0, 0x0, 0x1}, 0x8080) [ 56.037236] audit: type=1400 audit(1768304898.922:7): avc: denied { execmem } for pid=272 comm="syz-executor.1" scontext=system_u:system_r:kernel_t:s0 tcontext=system_u:system_r:kernel_t:s0 tclass=process permissive=1 [ 57.230444] Bluetooth: hci0: unexpected cc 0x0c03 length: 249 > 1 [ 57.235951] Bluetooth: hci0: unexpected cc 0x1003 length: 249 > 9 [ 57.239194] Bluetooth: hci0: unexpected cc 0x1001 length: 249 > 9 [ 57.248147] Bluetooth: hci0: unexpected cc 0x0c23 length: 249 > 4 [ 57.251368] Bluetooth: hci0: unexpected cc 0x0c38 length: 249 > 2 [ 57.292444] Bluetooth: hci2: unexpected cc 0x0c03 length: 249 > 1 [ 57.295462] Bluetooth: hci1: unexpected cc 0x0c03 length: 249 > 1 [ 57.298255] Bluetooth: hci2: unexpected cc 0x1003 length: 249 > 9 [ 57.301253] Bluetooth: hci1: unexpected cc 0x1003 length: 249 > 9 [ 57.303391] Bluetooth: hci2: unexpected cc 0x1001 length: 249 > 9 [ 57.306097] Bluetooth: hci1: unexpected cc 0x1001 length: 249 > 9 [ 57.310890] Bluetooth: hci1: unexpected cc 0x0c23 length: 249 > 4 [ 57.317254] Bluetooth: hci1: unexpected cc 0x0c38 length: 249 > 2 [ 57.323873] Bluetooth: hci2: unexpected cc 0x0c23 length: 249 > 4 [ 57.327218] Bluetooth: hci2: unexpected cc 0x0c38 length: 249 > 2 [ 57.370943] Bluetooth: hci3: unexpected cc 0x0c03 length: 249 > 1 [ 57.377923] Bluetooth: hci3: unexpected cc 0x1003 length: 249 > 9 [ 57.402592] Bluetooth: hci4: unexpected cc 0x0c03 length: 249 > 1 [ 57.409142] Bluetooth: hci4: unexpected cc 0x1003 length: 249 > 9 [ 57.411525] Bluetooth: hci7: unexpected cc 0x0c03 length: 249 > 1 [ 57.413220] Bluetooth: hci4: unexpected cc 0x1001 length: 249 > 9 [ 57.416771] Bluetooth: hci7: unexpected cc 0x1003 length: 249 > 9 [ 57.420769] Bluetooth: hci7: unexpected cc 0x1001 length: 249 > 9 [ 57.425230] Bluetooth: hci3: unexpected cc 0x1001 length: 249 > 9 [ 57.426976] Bluetooth: hci7: unexpected cc 0x0c23 length: 249 > 4 [ 57.432764] Bluetooth: hci7: unexpected cc 0x0c38 length: 249 > 2 [ 57.435346] Bluetooth: hci3: unexpected cc 0x0c23 length: 249 > 4 [ 57.441445] Bluetooth: hci3: unexpected cc 0x0c38 length: 249 > 2 [ 57.446861] Bluetooth: hci5: unexpected cc 0x0c03 length: 249 > 1 [ 57.455734] Bluetooth: hci6: unexpected cc 0x0c03 length: 249 > 1 [ 57.455892] Bluetooth: hci5: unexpected cc 0x1003 length: 249 > 9 [ 57.458966] Bluetooth: hci4: unexpected cc 0x0c23 length: 249 > 4 [ 57.460436] Bluetooth: hci5: unexpected cc 0x1001 length: 249 > 9 [ 57.465087] Bluetooth: hci6: unexpected cc 0x1003 length: 249 > 9 [ 57.466020] Bluetooth: hci4: unexpected cc 0x0c38 length: 249 > 2 [ 57.484372] Bluetooth: hci5: unexpected cc 0x0c23 length: 249 > 4 [ 57.499660] Bluetooth: hci6: unexpected cc 0x1001 length: 249 > 9 [ 57.510880] Bluetooth: hci5: unexpected cc 0x0c38 length: 249 > 2 [ 57.526971] Bluetooth: hci6: unexpected cc 0x0c23 length: 249 > 4 [ 57.563280] Bluetooth: hci6: unexpected cc 0x0c38 length: 249 > 2 [ 59.322554] Bluetooth: hci0: command tx timeout [ 59.386745] Bluetooth: hci1: command tx timeout [ 59.386955] Bluetooth: hci2: command tx timeout [ 59.450799] Bluetooth: hci7: command tx timeout [ 59.513829] Bluetooth: hci4: command tx timeout [ 59.513844] Bluetooth: hci3: command tx timeout [ 59.641834] Bluetooth: hci5: command tx timeout [ 59.642664] Bluetooth: hci6: command tx timeout [ 61.370371] Bluetooth: hci0: command tx timeout [ 61.433667] Bluetooth: hci1: command tx timeout [ 61.434664] Bluetooth: hci2: command tx timeout [ 61.498744] Bluetooth: hci7: command tx timeout [ 61.561693] Bluetooth: hci3: command tx timeout [ 61.561724] Bluetooth: hci4: command tx timeout [ 61.689727] Bluetooth: hci5: command tx timeout [ 61.689745] Bluetooth: hci6: command tx timeout [ 63.418759] Bluetooth: hci0: command tx timeout [ 63.481718] Bluetooth: hci2: command tx timeout [ 63.482119] Bluetooth: hci1: command tx timeout [ 63.545675] Bluetooth: hci7: command tx timeout [ 63.609686] Bluetooth: hci3: command tx timeout [ 63.609833] Bluetooth: hci4: command tx timeout [ 63.738658] Bluetooth: hci6: command tx timeout [ 63.739115] Bluetooth: hci5: command tx timeout [ 65.465865] Bluetooth: hci0: command tx timeout [ 65.530355] Bluetooth: hci1: command tx timeout [ 65.531418] Bluetooth: hci2: command tx timeout [ 65.594670] Bluetooth: hci7: command tx timeout [ 65.657684] Bluetooth: hci3: command tx timeout [ 65.657729] Bluetooth: hci4: command tx timeout [ 65.787182] Bluetooth: hci5: command tx timeout [ 65.787269] Bluetooth: hci6: command tx timeout [ 89.752583] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 89.753238] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 90.856018] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 90.856657] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 11:48:54 executing program 6: r0 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) syz_genetlink_get_family_id$nbd(&(0x7f0000000000), r0) sendmsg$NL802154_CMD_NEW_SEC_LEVEL(r0, &(0x7f0000000140)={&(0x7f0000000040)={0x10, 0x0, 0x0, 0x2}, 0xc, &(0x7f0000000100)={&(0x7f0000000080)={0x4c, 0x0, 0x10, 0x70bd26, 0x25dfdbfd, {}, [@NL802154_ATTR_SEC_LEVEL={0x1c, 0x22, 0x0, 0x1, [@NL802154_SECLEVEL_ATTR_DEV_OVERRIDE={0x5, 0x4, 0x1}, @NL802154_SECLEVEL_ATTR_DEV_OVERRIDE={0x5}, @NL802154_SECLEVEL_ATTR_LEVELS={0x5, 0x1, 0x9}]}, @NL802154_ATTR_SEC_LEVEL={0x1c, 0x22, 0x0, 0x1, [@NL802154_SECLEVEL_ATTR_CMD_FRAME={0x8, 0x3, 0x3}, @NL802154_SECLEVEL_ATTR_DEV_OVERRIDE={0x5}, @NL802154_SECLEVEL_ATTR_CMD_FRAME={0x8, 0x3, 0x9}]}]}, 0x4c}, 0x1, 0x0, 0x0, 0x8091}, 0x80) sendmsg$NLBL_MGMT_C_REMOVE(r0, &(0x7f0000000240)={&(0x7f0000000180)={0x10, 0x0, 0x0, 0x10000000}, 0xc, &(0x7f0000000200)={&(0x7f00000001c0)={0x34, 0x0, 0x400, 0x70bd2d, 0x25dfdbfc, {}, [@NLBL_MGMT_A_IPV4ADDR={0x8, 0x7, @multicast2}, @NLBL_MGMT_A_IPV4ADDR={0x8, 0x7, @loopback}, @NLBL_MGMT_A_IPV4ADDR={0x8, 0x7, @remote}, @NLBL_MGMT_A_CLPDOI={0x8}]}, 0x34}, 0x1, 0x0, 0x0, 0x8000}, 0x800) ioctl$sock_SIOCGIFINDEX_802154(r0, 0x8933, &(0x7f0000000280)={'wpan4\x00', 0x0}) sendmsg$NL802154_CMD_NEW_SEC_DEVKEY(r0, &(0x7f0000000500)={&(0x7f00000002c0)={0x10, 0x0, 0x0, 0x41000089}, 0xc, &(0x7f00000004c0)={&(0x7f0000000300)={0x190, 0x0, 0x400, 0x70bd2d, 0x25dfdbfc, {}, [@NL802154_ATTR_SEC_DEVKEY={0x8c, 0x24, 0x0, 0x1, [@NL802154_DEVKEY_ATTR_FRAME_COUNTER={0x8, 0x1, 0x8}, @NL802154_DEVKEY_ATTR_ID={0x6c, 0x3, 0x0, 0x1, [@NL802154_KEY_ID_ATTR_IMPLICIT={0x44, 0x3, 0x0, 0x1, [@NL802154_DEV_ADDR_ATTR_SHORT={0x6, 0x3, 0xaaa0}, @NL802154_DEV_ADDR_ATTR_SHORT={0x6, 0x3, 0xaaa0}, @NL802154_DEV_ADDR_ATTR_PAN_ID={0x6, 0x1, 0x2}, @NL802154_DEV_ADDR_ATTR_PAN_ID={0x6, 0x1, 0x1}, @NL802154_DEV_ADDR_ATTR_EXTENDED={0xc, 0x4, {0xaaaaaaaaaaaa0102}}, @NL802154_DEV_ADDR_ATTR_MODE={0x8, 0x2, 0x2}, @NL802154_DEV_ADDR_ATTR_EXTENDED={0xc, 0x4, {0xaaaaaaaaaaaa0202}}]}, @NL802154_KEY_ID_ATTR_MODE={0x8, 0x1, 0x2}, @NL802154_KEY_ID_ATTR_IMPLICIT={0x1c, 0x3, 0x0, 0x1, [@NL802154_DEV_ADDR_ATTR_SHORT={0x6, 0x3, 0xaaa1}, @NL802154_DEV_ADDR_ATTR_PAN_ID={0x6}, @NL802154_DEV_ADDR_ATTR_PAN_ID={0x6}]}]}, @NL802154_DEVKEY_ATTR_FRAME_COUNTER={0x8, 0x1, 0xdc0e}, @NL802154_DEVKEY_ATTR_EXTENDED_ADDR={0xc}]}, @NL802154_ATTR_SEC_DEVKEY={0x78, 0x24, 0x0, 0x1, [@NL802154_DEVKEY_ATTR_EXTENDED_ADDR={0xc, 0x2, {0xaaaaaaaaaaaa0302}}, @NL802154_DEVKEY_ATTR_ID={0x5c, 0x3, 0x0, 0x1, [@NL802154_KEY_ID_ATTR_SOURCE_SHORT={0x8, 0x4, 0x5}, @NL802154_KEY_ID_ATTR_MODE={0x8, 0x1, 0x2}, @NL802154_KEY_ID_ATTR_INDEX={0x5, 0x2, 0x1}, @NL802154_KEY_ID_ATTR_IMPLICIT={0x38, 0x3, 0x0, 0x1, [@NL802154_DEV_ADDR_ATTR_SHORT={0x6, 0x3, 0xaaa1}, @NL802154_DEV_ADDR_ATTR_SHORT={0x6, 0x3, 0xaaa2}, @NL802154_DEV_ADDR_ATTR_SHORT={0x6, 0x3, 0xaaa1}, @NL802154_DEV_ADDR_ATTR_PAN_ID={0x6, 0x1, 0xffff}, @NL802154_DEV_ADDR_ATTR_PAN_ID={0x6, 0x1, 0x1}, @NL802154_DEV_ADDR_ATTR_EXTENDED={0xc, 0x4, {0xaaaaaaaaaaaa0102}}]}, @NL802154_KEY_ID_ATTR_INDEX={0x5, 0x2, 0x2}]}, @NL802154_DEVKEY_ATTR_EXTENDED_ADDR={0xc, 0x2, {0x300}}]}, @NL802154_ATTR_WPAN_DEV={0xc, 0x6, 0x2}, @NL802154_ATTR_WPAN_DEV={0xc, 0x6, 0x2}, @NL802154_ATTR_SEC_DEVKEY={0x4c, 0x24, 0x0, 0x1, [@NL802154_DEVKEY_ATTR_FRAME_COUNTER={0x8, 0x1, 0x8175}, @NL802154_DEVKEY_ATTR_EXTENDED_ADDR={0xc, 0x2, {0xaaaaaaaaaaaa0102}}, @NL802154_DEVKEY_ATTR_FRAME_COUNTER={0x8, 0x1, 0x5}, @NL802154_DEVKEY_ATTR_EXTENDED_ADDR={0xc, 0x2, {0xaaaaaaaaaaaa0302}}, @NL802154_DEVKEY_ATTR_ID={0x14, 0x3, 0x0, 0x1, [@NL802154_KEY_ID_ATTR_MODE={0x8, 0x1, 0x3}, @NL802154_KEY_ID_ATTR_MODE={0x8, 0x1, 0x1}]}, @NL802154_DEVKEY_ATTR_EXTENDED_ADDR={0xc, 0x2, {0xaaaaaaaaaaaa0102}}]}, @NL802154_ATTR_IFINDEX={0x8}, @NL802154_ATTR_WPAN_DEV={0xc, 0x6, 0x200000002}]}, 0x190}, 0x1, 0x0, 0x0, 0x20000084}, 0x80) sendmsg$IEEE802154_LLSEC_DEL_DEVKEY(r0, &(0x7f0000000600)={&(0x7f0000000540)={0x10, 0x0, 0x0, 0x100}, 0xc, &(0x7f00000005c0)={&(0x7f0000000580)={0x1c, 0x0, 0x100, 0x70bd2c, 0x25dfdbfb, {}, [@IEEE802154_ATTR_LLSEC_KEY_MODE={0x5}]}, 0x1c}, 0x1, 0x0, 0x0, 0x8040}, 0x1) ioctl$sock_SIOCGIFINDEX_802154(r0, 0x8933, &(0x7f0000000680)={'wpan4\x00', 0x0}) sendmsg$NL802154_CMD_NEW_SEC_LEVEL(r0, &(0x7f0000000780)={&(0x7f0000000640)={0x10, 0x0, 0x0, 0x100}, 0xc, &(0x7f0000000740)={&(0x7f00000006c0)={0x60, 0x0, 0x4, 0x70bd2d, 0x25dfdbfe, {}, [@NL802154_ATTR_WPAN_DEV={0xc, 0x6, 0x300000003}, @NL802154_ATTR_SEC_LEVEL={0xc, 0x22, 0x0, 0x1, [@NL802154_SECLEVEL_ATTR_CMD_FRAME={0x8, 0x3, 0x8}]}, @NL802154_ATTR_SEC_LEVEL={0x14, 0x22, 0x0, 0x1, [@NL802154_SECLEVEL_ATTR_FRAME={0x8, 0x2, 0x2}, @NL802154_SECLEVEL_ATTR_FRAME={0x8, 0x2, 0x2}]}, @NL802154_ATTR_WPAN_DEV={0xc, 0x6, 0x200000002}, @NL802154_ATTR_WPAN_DEV={0xc}, @NL802154_ATTR_IFINDEX={0x8, 0x3, r2}]}, 0x60}, 0x1, 0x0, 0x0, 0x24040800}, 0xc000) r3 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r4 = syz_genetlink_get_family_id$nbd(&(0x7f0000000800), r0) sendmsg$NBD_CMD_RECONFIGURE(r3, &(0x7f0000000900)={&(0x7f00000007c0)={0x10, 0x0, 0x0, 0x800}, 0xc, &(0x7f00000008c0)={&(0x7f0000000840)={0x58, r4, 0x100, 0x70bd29, 0x25dfdbfe, {}, [@NBD_ATTR_DEAD_CONN_TIMEOUT={0xc, 0x8, 0x1a5}, @NBD_ATTR_DEAD_CONN_TIMEOUT={0xc, 0x8, 0x8}, @NBD_ATTR_SERVER_FLAGS={0xc}, @NBD_ATTR_INDEX={0x8, 0x1, 0x0}, @NBD_ATTR_BLOCK_SIZE_BYTES={0xc}, @NBD_ATTR_SIZE_BYTES={0xc, 0x2, 0x6}]}, 0x58}, 0x1, 0x0, 0x0, 0x85}, 0x24008000) r5 = syz_genetlink_get_family_id$nl802154(&(0x7f0000000980), r0) ioctl$sock_SIOCGIFINDEX_802154(r3, 0x8933, &(0x7f00000009c0)={'wpan1\x00', 0x0}) sendmsg$NL802154_CMD_NEW_SEC_LEVEL(r0, &(0x7f0000000ac0)={&(0x7f0000000940)={0x10, 0x0, 0x0, 0x8}, 0xc, &(0x7f0000000a80)={&(0x7f0000000a00)={0x64, r5, 0x604, 0x70bd25, 0x7e5, {}, [@NL802154_ATTR_WPAN_DEV={0xc, 0x6, 0x3}, @NL802154_ATTR_SEC_LEVEL={0x14, 0x22, 0x0, 0x1, [@NL802154_SECLEVEL_ATTR_FRAME={0x8, 0x2, 0x2}, @NL802154_SECLEVEL_ATTR_DEV_OVERRIDE={0x5}]}, @NL802154_ATTR_IFINDEX={0x8, 0x3, r6}, @NL802154_ATTR_IFINDEX={0x8, 0x3, r1}, @NL802154_ATTR_SEC_LEVEL={0x14, 0x22, 0x0, 0x1, [@NL802154_SECLEVEL_ATTR_FRAME={0x8, 0x2, 0x1}, @NL802154_SECLEVEL_ATTR_LEVELS={0x5, 0x1, 0x5}]}, @NL802154_ATTR_WPAN_DEV={0xc, 0x6, 0x200000002}]}, 0x64}}, 0x8050) r7 = syz_genetlink_get_family_id$nl802154(&(0x7f0000000b40), r3) ioctl$sock_SIOCGIFINDEX_802154(r0, 0x8933, &(0x7f0000000b80)={'wpan1\x00', 0x0}) sendmsg$NL802154_CMD_GET_SEC_DEVKEY(r3, &(0x7f0000000c80)={&(0x7f0000000b00)={0x10, 0x0, 0x0, 0x10000}, 0xc, &(0x7f0000000c40)={&(0x7f0000000bc0)={0x64, r7, 0x800, 0x70bd26, 0x25dfdbff, {}, [@NL802154_ATTR_WPAN_DEV={0xc}, @NL802154_ATTR_WPAN_DEV={0xc}, @NL802154_ATTR_IFINDEX={0x8, 0x3, r2}, @NL802154_ATTR_IFINDEX={0x8, 0x3, r8}, @NL802154_ATTR_IFINDEX={0x8, 0x3, r6}, @NL802154_ATTR_WPAN_DEV={0xc}, @NL802154_ATTR_IFINDEX={0x8, 0x3, r2}, @NL802154_ATTR_WPAN_DEV={0xc, 0x6, 0x3}]}, 0x64}, 0x1, 0x0, 0x0, 0x4000844}, 0x4000) r9 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) sendmsg$NLBL_MGMT_C_REMOVEDEF(r9, &(0x7f0000000d80)={&(0x7f0000000cc0)={0x10, 0x0, 0x0, 0x10000000}, 0xc, &(0x7f0000000d40)={&(0x7f0000000d00)={0x1c, 0x0, 0x1, 0x70bd28, 0x25dfdbfe, {}, [@NLBL_MGMT_A_PROTOCOL={0x8, 0x2, 0x3}]}, 0x1c}, 0x1, 0x0, 0x0, 0x800}, 0x4000) [ 92.542043] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 92.548079] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 92.720934] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 92.722483] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 92.739151] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 92.739932] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 92.818596] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 92.819197] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 11:48:55 executing program 6: r0 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) syz_genetlink_get_family_id$nbd(&(0x7f0000000000), r0) sendmsg$NL802154_CMD_NEW_SEC_LEVEL(r0, &(0x7f0000000140)={&(0x7f0000000040)={0x10, 0x0, 0x0, 0x2}, 0xc, &(0x7f0000000100)={&(0x7f0000000080)={0x4c, 0x0, 0x10, 0x70bd26, 0x25dfdbfd, {}, [@NL802154_ATTR_SEC_LEVEL={0x1c, 0x22, 0x0, 0x1, [@NL802154_SECLEVEL_ATTR_DEV_OVERRIDE={0x5, 0x4, 0x1}, @NL802154_SECLEVEL_ATTR_DEV_OVERRIDE={0x5}, @NL802154_SECLEVEL_ATTR_LEVELS={0x5, 0x1, 0x9}]}, @NL802154_ATTR_SEC_LEVEL={0x1c, 0x22, 0x0, 0x1, [@NL802154_SECLEVEL_ATTR_CMD_FRAME={0x8, 0x3, 0x3}, @NL802154_SECLEVEL_ATTR_DEV_OVERRIDE={0x5}, @NL802154_SECLEVEL_ATTR_CMD_FRAME={0x8, 0x3, 0x9}]}]}, 0x4c}, 0x1, 0x0, 0x0, 0x8091}, 0x80) sendmsg$NLBL_MGMT_C_REMOVE(r0, &(0x7f0000000240)={&(0x7f0000000180)={0x10, 0x0, 0x0, 0x10000000}, 0xc, &(0x7f0000000200)={&(0x7f00000001c0)={0x34, 0x0, 0x400, 0x70bd2d, 0x25dfdbfc, {}, [@NLBL_MGMT_A_IPV4ADDR={0x8, 0x7, @multicast2}, @NLBL_MGMT_A_IPV4ADDR={0x8, 0x7, @loopback}, @NLBL_MGMT_A_IPV4ADDR={0x8, 0x7, @remote}, @NLBL_MGMT_A_CLPDOI={0x8}]}, 0x34}, 0x1, 0x0, 0x0, 0x8000}, 0x800) ioctl$sock_SIOCGIFINDEX_802154(r0, 0x8933, &(0x7f0000000280)={'wpan4\x00', 0x0}) sendmsg$NL802154_CMD_NEW_SEC_DEVKEY(r0, &(0x7f0000000500)={&(0x7f00000002c0)={0x10, 0x0, 0x0, 0x41000089}, 0xc, &(0x7f00000004c0)={&(0x7f0000000300)={0x190, 0x0, 0x400, 0x70bd2d, 0x25dfdbfc, {}, [@NL802154_ATTR_SEC_DEVKEY={0x8c, 0x24, 0x0, 0x1, [@NL802154_DEVKEY_ATTR_FRAME_COUNTER={0x8, 0x1, 0x8}, @NL802154_DEVKEY_ATTR_ID={0x6c, 0x3, 0x0, 0x1, [@NL802154_KEY_ID_ATTR_IMPLICIT={0x44, 0x3, 0x0, 0x1, [@NL802154_DEV_ADDR_ATTR_SHORT={0x6, 0x3, 0xaaa0}, @NL802154_DEV_ADDR_ATTR_SHORT={0x6, 0x3, 0xaaa0}, @NL802154_DEV_ADDR_ATTR_PAN_ID={0x6, 0x1, 0x2}, @NL802154_DEV_ADDR_ATTR_PAN_ID={0x6, 0x1, 0x1}, @NL802154_DEV_ADDR_ATTR_EXTENDED={0xc, 0x4, {0xaaaaaaaaaaaa0102}}, @NL802154_DEV_ADDR_ATTR_MODE={0x8, 0x2, 0x2}, @NL802154_DEV_ADDR_ATTR_EXTENDED={0xc, 0x4, {0xaaaaaaaaaaaa0202}}]}, @NL802154_KEY_ID_ATTR_MODE={0x8, 0x1, 0x2}, @NL802154_KEY_ID_ATTR_IMPLICIT={0x1c, 0x3, 0x0, 0x1, [@NL802154_DEV_ADDR_ATTR_SHORT={0x6, 0x3, 0xaaa1}, @NL802154_DEV_ADDR_ATTR_PAN_ID={0x6}, @NL802154_DEV_ADDR_ATTR_PAN_ID={0x6}]}]}, @NL802154_DEVKEY_ATTR_FRAME_COUNTER={0x8, 0x1, 0xdc0e}, @NL802154_DEVKEY_ATTR_EXTENDED_ADDR={0xc}]}, @NL802154_ATTR_SEC_DEVKEY={0x78, 0x24, 0x0, 0x1, [@NL802154_DEVKEY_ATTR_EXTENDED_ADDR={0xc, 0x2, {0xaaaaaaaaaaaa0302}}, @NL802154_DEVKEY_ATTR_ID={0x5c, 0x3, 0x0, 0x1, [@NL802154_KEY_ID_ATTR_SOURCE_SHORT={0x8, 0x4, 0x5}, @NL802154_KEY_ID_ATTR_MODE={0x8, 0x1, 0x2}, @NL802154_KEY_ID_ATTR_INDEX={0x5, 0x2, 0x1}, @NL802154_KEY_ID_ATTR_IMPLICIT={0x38, 0x3, 0x0, 0x1, [@NL802154_DEV_ADDR_ATTR_SHORT={0x6, 0x3, 0xaaa1}, @NL802154_DEV_ADDR_ATTR_SHORT={0x6, 0x3, 0xaaa2}, @NL802154_DEV_ADDR_ATTR_SHORT={0x6, 0x3, 0xaaa1}, @NL802154_DEV_ADDR_ATTR_PAN_ID={0x6, 0x1, 0xffff}, @NL802154_DEV_ADDR_ATTR_PAN_ID={0x6, 0x1, 0x1}, @NL802154_DEV_ADDR_ATTR_EXTENDED={0xc, 0x4, {0xaaaaaaaaaaaa0102}}]}, @NL802154_KEY_ID_ATTR_INDEX={0x5, 0x2, 0x2}]}, @NL802154_DEVKEY_ATTR_EXTENDED_ADDR={0xc, 0x2, {0x300}}]}, @NL802154_ATTR_WPAN_DEV={0xc, 0x6, 0x2}, @NL802154_ATTR_WPAN_DEV={0xc, 0x6, 0x2}, @NL802154_ATTR_SEC_DEVKEY={0x4c, 0x24, 0x0, 0x1, [@NL802154_DEVKEY_ATTR_FRAME_COUNTER={0x8, 0x1, 0x8175}, @NL802154_DEVKEY_ATTR_EXTENDED_ADDR={0xc, 0x2, {0xaaaaaaaaaaaa0102}}, @NL802154_DEVKEY_ATTR_FRAME_COUNTER={0x8, 0x1, 0x5}, @NL802154_DEVKEY_ATTR_EXTENDED_ADDR={0xc, 0x2, {0xaaaaaaaaaaaa0302}}, @NL802154_DEVKEY_ATTR_ID={0x14, 0x3, 0x0, 0x1, [@NL802154_KEY_ID_ATTR_MODE={0x8, 0x1, 0x3}, @NL802154_KEY_ID_ATTR_MODE={0x8, 0x1, 0x1}]}, @NL802154_DEVKEY_ATTR_EXTENDED_ADDR={0xc, 0x2, {0xaaaaaaaaaaaa0102}}]}, @NL802154_ATTR_IFINDEX={0x8}, @NL802154_ATTR_WPAN_DEV={0xc, 0x6, 0x200000002}]}, 0x190}, 0x1, 0x0, 0x0, 0x20000084}, 0x80) sendmsg$IEEE802154_LLSEC_DEL_DEVKEY(r0, &(0x7f0000000600)={&(0x7f0000000540)={0x10, 0x0, 0x0, 0x100}, 0xc, &(0x7f00000005c0)={&(0x7f0000000580)={0x1c, 0x0, 0x100, 0x70bd2c, 0x25dfdbfb, {}, [@IEEE802154_ATTR_LLSEC_KEY_MODE={0x5}]}, 0x1c}, 0x1, 0x0, 0x0, 0x8040}, 0x1) ioctl$sock_SIOCGIFINDEX_802154(r0, 0x8933, &(0x7f0000000680)={'wpan4\x00', 0x0}) sendmsg$NL802154_CMD_NEW_SEC_LEVEL(r0, &(0x7f0000000780)={&(0x7f0000000640)={0x10, 0x0, 0x0, 0x100}, 0xc, &(0x7f0000000740)={&(0x7f00000006c0)={0x60, 0x0, 0x4, 0x70bd2d, 0x25dfdbfe, {}, [@NL802154_ATTR_WPAN_DEV={0xc, 0x6, 0x300000003}, @NL802154_ATTR_SEC_LEVEL={0xc, 0x22, 0x0, 0x1, [@NL802154_SECLEVEL_ATTR_CMD_FRAME={0x8, 0x3, 0x8}]}, @NL802154_ATTR_SEC_LEVEL={0x14, 0x22, 0x0, 0x1, [@NL802154_SECLEVEL_ATTR_FRAME={0x8, 0x2, 0x2}, @NL802154_SECLEVEL_ATTR_FRAME={0x8, 0x2, 0x2}]}, @NL802154_ATTR_WPAN_DEV={0xc, 0x6, 0x200000002}, @NL802154_ATTR_WPAN_DEV={0xc}, @NL802154_ATTR_IFINDEX={0x8, 0x3, r2}]}, 0x60}, 0x1, 0x0, 0x0, 0x24040800}, 0xc000) r3 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r4 = syz_genetlink_get_family_id$nbd(&(0x7f0000000800), r0) sendmsg$NBD_CMD_RECONFIGURE(r3, &(0x7f0000000900)={&(0x7f00000007c0)={0x10, 0x0, 0x0, 0x800}, 0xc, &(0x7f00000008c0)={&(0x7f0000000840)={0x58, r4, 0x100, 0x70bd29, 0x25dfdbfe, {}, [@NBD_ATTR_DEAD_CONN_TIMEOUT={0xc, 0x8, 0x1a5}, @NBD_ATTR_DEAD_CONN_TIMEOUT={0xc, 0x8, 0x8}, @NBD_ATTR_SERVER_FLAGS={0xc}, @NBD_ATTR_INDEX={0x8, 0x1, 0x0}, @NBD_ATTR_BLOCK_SIZE_BYTES={0xc}, @NBD_ATTR_SIZE_BYTES={0xc, 0x2, 0x6}]}, 0x58}, 0x1, 0x0, 0x0, 0x85}, 0x24008000) r5 = syz_genetlink_get_family_id$nl802154(&(0x7f0000000980), r0) ioctl$sock_SIOCGIFINDEX_802154(r3, 0x8933, &(0x7f00000009c0)={'wpan1\x00', 0x0}) sendmsg$NL802154_CMD_NEW_SEC_LEVEL(r0, &(0x7f0000000ac0)={&(0x7f0000000940)={0x10, 0x0, 0x0, 0x8}, 0xc, &(0x7f0000000a80)={&(0x7f0000000a00)={0x64, r5, 0x604, 0x70bd25, 0x7e5, {}, [@NL802154_ATTR_WPAN_DEV={0xc, 0x6, 0x3}, @NL802154_ATTR_SEC_LEVEL={0x14, 0x22, 0x0, 0x1, [@NL802154_SECLEVEL_ATTR_FRAME={0x8, 0x2, 0x2}, @NL802154_SECLEVEL_ATTR_DEV_OVERRIDE={0x5}]}, @NL802154_ATTR_IFINDEX={0x8, 0x3, r6}, @NL802154_ATTR_IFINDEX={0x8, 0x3, r1}, @NL802154_ATTR_SEC_LEVEL={0x14, 0x22, 0x0, 0x1, [@NL802154_SECLEVEL_ATTR_FRAME={0x8, 0x2, 0x1}, @NL802154_SECLEVEL_ATTR_LEVELS={0x5, 0x1, 0x5}]}, @NL802154_ATTR_WPAN_DEV={0xc, 0x6, 0x200000002}]}, 0x64}}, 0x8050) r7 = syz_genetlink_get_family_id$nl802154(&(0x7f0000000b40), r3) ioctl$sock_SIOCGIFINDEX_802154(r0, 0x8933, &(0x7f0000000b80)={'wpan1\x00', 0x0}) sendmsg$NL802154_CMD_GET_SEC_DEVKEY(r3, &(0x7f0000000c80)={&(0x7f0000000b00)={0x10, 0x0, 0x0, 0x10000}, 0xc, &(0x7f0000000c40)={&(0x7f0000000bc0)={0x64, r7, 0x800, 0x70bd26, 0x25dfdbff, {}, [@NL802154_ATTR_WPAN_DEV={0xc}, @NL802154_ATTR_WPAN_DEV={0xc}, @NL802154_ATTR_IFINDEX={0x8, 0x3, r2}, @NL802154_ATTR_IFINDEX={0x8, 0x3, r8}, @NL802154_ATTR_IFINDEX={0x8, 0x3, r6}, @NL802154_ATTR_WPAN_DEV={0xc}, @NL802154_ATTR_IFINDEX={0x8, 0x3, r2}, @NL802154_ATTR_WPAN_DEV={0xc, 0x6, 0x3}]}, 0x64}, 0x1, 0x0, 0x0, 0x4000844}, 0x4000) r9 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) sendmsg$NLBL_MGMT_C_REMOVEDEF(r9, &(0x7f0000000d80)={&(0x7f0000000cc0)={0x10, 0x0, 0x0, 0x10000000}, 0xc, &(0x7f0000000d40)={&(0x7f0000000d00)={0x1c, 0x0, 0x1, 0x70bd28, 0x25dfdbfe, {}, [@NLBL_MGMT_A_PROTOCOL={0x8, 0x2, 0x3}]}, 0x1c}, 0x1, 0x0, 0x0, 0x800}, 0x4000) [ 92.975585] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 92.977687] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 93.127322] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 93.127954] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 93.195718] audit: type=1400 audit(1768304936.081:8): avc: denied { open } for pid=3895 comm="syz-executor.3" scontext=system_u:system_r:kernel_t:s0 tcontext=system_u:system_r:kernel_t:s0 tclass=perf_event permissive=1 [ 93.198436] audit: type=1400 audit(1768304936.084:9): avc: denied { kernel } for pid=3895 comm="syz-executor.3" scontext=system_u:system_r:kernel_t:s0 tcontext=system_u:system_r:kernel_t:s0 tclass=perf_event permissive=1 11:48:56 executing program 3: r0 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000000)='./binderfs2/custom0\x00', 0x0, 0x0) r1 = perf_event_open(&(0x7f00000007c0)={0x0, 0x80, 0x2, 0x4, 0x1c, 0xff, 0x0, 0xe4, 0x8, 0x7, 0x1, 0x1, 0x1, 0x1, 0x1, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x1, 0x0, 0x1, 0x1, 0x0, 0x0, 0x1, 0x0, 0x1, 0x1, 0x1, 0x1, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x1, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffff1cd, 0x1, @perf_bp={&(0x7f0000000780), 0x4}, 0x4173, 0x1, 0x2, 0x4, 0x1, 0x2, 0x7, 0x0, 0xffffff7f, 0x0, 0x68c4}, 0x0, 0x5, 0xffffffffffffffff, 0x0) r2 = openat$cgroup_type(0xffffffffffffffff, &(0x7f0000000840), 0x2, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000ac0)={0xa0, 0x0, &(0x7f0000000940)=[@increfs_done={0x40106308, 0x2}, @acquire, @dead_binder_done, @register_looper, @dead_binder_done, @increfs_done={0x40106308, 0x3}, @request_death={0x400c630e, 0x1}, @reply={0x40406301, {0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x48, 0x18, &(0x7f0000000880)={@fd={0x66642a85, 0x0, r1}, @flat=@weak_binder={0x77622a85, 0x0, 0x1}, @fd={0x66642a85, 0x0, r2}}, &(0x7f0000000900)={0x0, 0x18, 0x30}}}], 0xba, 0x0, &(0x7f0000000a00)="300c964b99b0fc8bc041eed901596dcc00c49ae50e7d50ab2181ebd3ced1dedd5b95801b47942df87fa0193d45616e7abcb521e4b3031cf0f6ce86d01e78fd249c0a368369dcbb588cf079a014940599b7b6d4397e0d176e2576874ae05c2c5cb611bc0a2d765cd1223396d58aed4be672d29a0400a0b3f8ce7a4a03028b890b0f5a8be682791ee67fd5956810a83a83ae92d2e89345cd2f5ecebe5e98f11d0642b6624d047bf7127114786a300db84bfe332fe8533489aad8be"}) r3 = mmap$IORING_OFF_CQ_RING(&(0x7f0000ffe000/0x2000)=nil, 0x2000, 0x2000001, 0x4000010, 0xffffffffffffffff, 0x8000000) r4 = mmap$IORING_OFF_SQES(&(0x7f0000ffe000/0x2000)=nil, 0x2000, 0x1000008, 0x4010, 0xffffffffffffffff, 0x10000000) r5 = io_uring_register$IORING_REGISTER_PERSONALITY(0xffffffffffffffff, 0x9, 0x0, 0x0) r6 = openat$cgroup_pressure(0xffffffffffffffff, &(0x7f0000000b00)='io.pressure\x00', 0x2, 0x0) syz_io_uring_submit(r3, r4, &(0x7f0000000b40)=@IORING_OP_TEE={0x21, 0x5, 0x0, @fd_index=0x9, 0x0, 0x0, 0x6, 0x7, 0x1, {0x0, r5, r6}}, 0x5) rt_sigaction(0x15, &(0x7f0000000c40)={&(0x7f0000000b80)="f2a6c4e2252c9eec000000666666420f3a14a9020000000dc4e279185556c4e2ed2981060000008fe9d801cbdd15ddac000066450f3a14913223333300c4e17a6f54d28dc4a261ba5682", 0x80000002, &(0x7f0000000c00)="c4c2c5ab07c4e1fd60fbc461ff2d6dcd3e0f1b1e0f0d3ec4e2e9af1c430fff57000f419f47200000c4a2f920cd450a8000000000", {[0x1]}}, &(0x7f0000000d40)={&(0x7f0000000c80)="e353c442f8f35266c401f928dff30fa7c0653e2e2e64a564410f0ffca0c481196907c401015de4dbd1c4019172e508", 0x0, &(0x7f0000000cc0)="c4e141f123c4a27bf79482a9e77544c422cd3c8204000000660fc5c881c441c173dd00c483fd01309dc462559c71472e260f4694aa0a000000c4e228f31dfeefffff140f"}, 0x8, &(0x7f0000000d80)) ioctl$CDROM_MEDIA_CHANGED(0xffffffffffffffff, 0x5325, 0x7) openat$binderfs(0xffffffffffffff9c, &(0x7f0000000dc0)='./binderfs2/binder1\x00', 0x800, 0x0) r7 = syz_io_uring_setup(0x783a, &(0x7f0000000e00)={0x0, 0xe533, 0x8, 0x3, 0x3a0}, &(0x7f0000ffc000/0x1000)=nil, &(0x7f0000ffc000/0x3000)=nil, &(0x7f0000000e80), &(0x7f0000000ec0)) mmap$IORING_OFF_SQ_RING(&(0x7f0000ffc000/0x4000)=nil, 0x4000, 0x2000000, 0x12, r7, 0x0) msgctl$IPC_RMID(0xffffffffffffffff, 0x0) r8 = openat$hwrng(0xffffffffffffff9c, &(0x7f0000000f00), 0x1000, 0x0) mmap$IORING_OFF_SQES(&(0x7f0000ffe000/0x1000)=nil, 0x1000, 0x1000000, 0x11, r8, 0x10000000) r9 = syz_io_uring_setup(0x7870, &(0x7f0000000f40)={0x0, 0x5d7e, 0x10, 0x1, 0x304, 0x0, r8}, &(0x7f0000ffe000/0x2000)=nil, &(0x7f0000ffa000/0x3000)=nil, &(0x7f0000000fc0), &(0x7f0000001000)) io_uring_register$IORING_REGISTER_PERSONALITY(r9, 0x9, 0x0, 0x0) semget(0x1, 0x3, 0x511) [ 93.314977] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 93.315610] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 11:48:56 executing program 3: r0 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000000)='./binderfs2/custom0\x00', 0x0, 0x0) r1 = perf_event_open(&(0x7f00000007c0)={0x0, 0x80, 0x2, 0x4, 0x1c, 0xff, 0x0, 0xe4, 0x8, 0x7, 0x1, 0x1, 0x1, 0x1, 0x1, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x1, 0x0, 0x1, 0x1, 0x0, 0x0, 0x1, 0x0, 0x1, 0x1, 0x1, 0x1, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x1, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffff1cd, 0x1, @perf_bp={&(0x7f0000000780), 0x4}, 0x4173, 0x1, 0x2, 0x4, 0x1, 0x2, 0x7, 0x0, 0xffffff7f, 0x0, 0x68c4}, 0x0, 0x5, 0xffffffffffffffff, 0x0) r2 = openat$cgroup_type(0xffffffffffffffff, &(0x7f0000000840), 0x2, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000ac0)={0xa0, 0x0, &(0x7f0000000940)=[@increfs_done={0x40106308, 0x2}, @acquire, @dead_binder_done, @register_looper, @dead_binder_done, @increfs_done={0x40106308, 0x3}, @request_death={0x400c630e, 0x1}, @reply={0x40406301, {0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x48, 0x18, &(0x7f0000000880)={@fd={0x66642a85, 0x0, r1}, @flat=@weak_binder={0x77622a85, 0x0, 0x1}, @fd={0x66642a85, 0x0, r2}}, &(0x7f0000000900)={0x0, 0x18, 0x30}}}], 0xba, 0x0, &(0x7f0000000a00)="300c964b99b0fc8bc041eed901596dcc00c49ae50e7d50ab2181ebd3ced1dedd5b95801b47942df87fa0193d45616e7abcb521e4b3031cf0f6ce86d01e78fd249c0a368369dcbb588cf079a014940599b7b6d4397e0d176e2576874ae05c2c5cb611bc0a2d765cd1223396d58aed4be672d29a0400a0b3f8ce7a4a03028b890b0f5a8be682791ee67fd5956810a83a83ae92d2e89345cd2f5ecebe5e98f11d0642b6624d047bf7127114786a300db84bfe332fe8533489aad8be"}) r3 = mmap$IORING_OFF_CQ_RING(&(0x7f0000ffe000/0x2000)=nil, 0x2000, 0x2000001, 0x4000010, 0xffffffffffffffff, 0x8000000) r4 = mmap$IORING_OFF_SQES(&(0x7f0000ffe000/0x2000)=nil, 0x2000, 0x1000008, 0x4010, 0xffffffffffffffff, 0x10000000) r5 = io_uring_register$IORING_REGISTER_PERSONALITY(0xffffffffffffffff, 0x9, 0x0, 0x0) r6 = openat$cgroup_pressure(0xffffffffffffffff, &(0x7f0000000b00)='io.pressure\x00', 0x2, 0x0) syz_io_uring_submit(r3, r4, &(0x7f0000000b40)=@IORING_OP_TEE={0x21, 0x5, 0x0, @fd_index=0x9, 0x0, 0x0, 0x6, 0x7, 0x1, {0x0, r5, r6}}, 0x5) rt_sigaction(0x15, &(0x7f0000000c40)={&(0x7f0000000b80)="f2a6c4e2252c9eec000000666666420f3a14a9020000000dc4e279185556c4e2ed2981060000008fe9d801cbdd15ddac000066450f3a14913223333300c4e17a6f54d28dc4a261ba5682", 0x80000002, &(0x7f0000000c00)="c4c2c5ab07c4e1fd60fbc461ff2d6dcd3e0f1b1e0f0d3ec4e2e9af1c430fff57000f419f47200000c4a2f920cd450a8000000000", {[0x1]}}, &(0x7f0000000d40)={&(0x7f0000000c80)="e353c442f8f35266c401f928dff30fa7c0653e2e2e64a564410f0ffca0c481196907c401015de4dbd1c4019172e508", 0x0, &(0x7f0000000cc0)="c4e141f123c4a27bf79482a9e77544c422cd3c8204000000660fc5c881c441c173dd00c483fd01309dc462559c71472e260f4694aa0a000000c4e228f31dfeefffff140f"}, 0x8, &(0x7f0000000d80)) ioctl$CDROM_MEDIA_CHANGED(0xffffffffffffffff, 0x5325, 0x7) openat$binderfs(0xffffffffffffff9c, &(0x7f0000000dc0)='./binderfs2/binder1\x00', 0x800, 0x0) r7 = syz_io_uring_setup(0x783a, &(0x7f0000000e00)={0x0, 0xe533, 0x8, 0x3, 0x3a0}, &(0x7f0000ffc000/0x1000)=nil, &(0x7f0000ffc000/0x3000)=nil, &(0x7f0000000e80), &(0x7f0000000ec0)) mmap$IORING_OFF_SQ_RING(&(0x7f0000ffc000/0x4000)=nil, 0x4000, 0x2000000, 0x12, r7, 0x0) msgctl$IPC_RMID(0xffffffffffffffff, 0x0) r8 = openat$hwrng(0xffffffffffffff9c, &(0x7f0000000f00), 0x1000, 0x0) mmap$IORING_OFF_SQES(&(0x7f0000ffe000/0x1000)=nil, 0x1000, 0x1000000, 0x11, r8, 0x10000000) r9 = syz_io_uring_setup(0x7870, &(0x7f0000000f40)={0x0, 0x5d7e, 0x10, 0x1, 0x304, 0x0, r8}, &(0x7f0000ffe000/0x2000)=nil, &(0x7f0000ffa000/0x3000)=nil, &(0x7f0000000fc0), &(0x7f0000001000)) io_uring_register$IORING_REGISTER_PERSONALITY(r9, 0x9, 0x0, 0x0) semget(0x1, 0x3, 0x511) 11:48:56 executing program 3: r0 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000000)='./binderfs2/custom0\x00', 0x0, 0x0) r1 = perf_event_open(&(0x7f00000007c0)={0x0, 0x80, 0x2, 0x4, 0x1c, 0xff, 0x0, 0xe4, 0x8, 0x7, 0x1, 0x1, 0x1, 0x1, 0x1, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x1, 0x0, 0x1, 0x1, 0x0, 0x0, 0x1, 0x0, 0x1, 0x1, 0x1, 0x1, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x1, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffff1cd, 0x1, @perf_bp={&(0x7f0000000780), 0x4}, 0x4173, 0x1, 0x2, 0x4, 0x1, 0x2, 0x7, 0x0, 0xffffff7f, 0x0, 0x68c4}, 0x0, 0x5, 0xffffffffffffffff, 0x0) r2 = openat$cgroup_type(0xffffffffffffffff, &(0x7f0000000840), 0x2, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000ac0)={0xa0, 0x0, &(0x7f0000000940)=[@increfs_done={0x40106308, 0x2}, @acquire, @dead_binder_done, @register_looper, @dead_binder_done, @increfs_done={0x40106308, 0x3}, @request_death={0x400c630e, 0x1}, @reply={0x40406301, {0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x48, 0x18, &(0x7f0000000880)={@fd={0x66642a85, 0x0, r1}, @flat=@weak_binder={0x77622a85, 0x0, 0x1}, @fd={0x66642a85, 0x0, r2}}, &(0x7f0000000900)={0x0, 0x18, 0x30}}}], 0xba, 0x0, &(0x7f0000000a00)="300c964b99b0fc8bc041eed901596dcc00c49ae50e7d50ab2181ebd3ced1dedd5b95801b47942df87fa0193d45616e7abcb521e4b3031cf0f6ce86d01e78fd249c0a368369dcbb588cf079a014940599b7b6d4397e0d176e2576874ae05c2c5cb611bc0a2d765cd1223396d58aed4be672d29a0400a0b3f8ce7a4a03028b890b0f5a8be682791ee67fd5956810a83a83ae92d2e89345cd2f5ecebe5e98f11d0642b6624d047bf7127114786a300db84bfe332fe8533489aad8be"}) r3 = mmap$IORING_OFF_CQ_RING(&(0x7f0000ffe000/0x2000)=nil, 0x2000, 0x2000001, 0x4000010, 0xffffffffffffffff, 0x8000000) r4 = mmap$IORING_OFF_SQES(&(0x7f0000ffe000/0x2000)=nil, 0x2000, 0x1000008, 0x4010, 0xffffffffffffffff, 0x10000000) r5 = io_uring_register$IORING_REGISTER_PERSONALITY(0xffffffffffffffff, 0x9, 0x0, 0x0) r6 = openat$cgroup_pressure(0xffffffffffffffff, &(0x7f0000000b00)='io.pressure\x00', 0x2, 0x0) syz_io_uring_submit(r3, r4, &(0x7f0000000b40)=@IORING_OP_TEE={0x21, 0x5, 0x0, @fd_index=0x9, 0x0, 0x0, 0x6, 0x7, 0x1, {0x0, r5, r6}}, 0x5) rt_sigaction(0x15, &(0x7f0000000c40)={&(0x7f0000000b80)="f2a6c4e2252c9eec000000666666420f3a14a9020000000dc4e279185556c4e2ed2981060000008fe9d801cbdd15ddac000066450f3a14913223333300c4e17a6f54d28dc4a261ba5682", 0x80000002, &(0x7f0000000c00)="c4c2c5ab07c4e1fd60fbc461ff2d6dcd3e0f1b1e0f0d3ec4e2e9af1c430fff57000f419f47200000c4a2f920cd450a8000000000", {[0x1]}}, &(0x7f0000000d40)={&(0x7f0000000c80)="e353c442f8f35266c401f928dff30fa7c0653e2e2e64a564410f0ffca0c481196907c401015de4dbd1c4019172e508", 0x0, &(0x7f0000000cc0)="c4e141f123c4a27bf79482a9e77544c422cd3c8204000000660fc5c881c441c173dd00c483fd01309dc462559c71472e260f4694aa0a000000c4e228f31dfeefffff140f"}, 0x8, &(0x7f0000000d80)) ioctl$CDROM_MEDIA_CHANGED(0xffffffffffffffff, 0x5325, 0x7) openat$binderfs(0xffffffffffffff9c, &(0x7f0000000dc0)='./binderfs2/binder1\x00', 0x800, 0x0) r7 = syz_io_uring_setup(0x783a, &(0x7f0000000e00)={0x0, 0xe533, 0x8, 0x3, 0x3a0}, &(0x7f0000ffc000/0x1000)=nil, &(0x7f0000ffc000/0x3000)=nil, &(0x7f0000000e80), &(0x7f0000000ec0)) mmap$IORING_OFF_SQ_RING(&(0x7f0000ffc000/0x4000)=nil, 0x4000, 0x2000000, 0x12, r7, 0x0) msgctl$IPC_RMID(0xffffffffffffffff, 0x0) r8 = openat$hwrng(0xffffffffffffff9c, &(0x7f0000000f00), 0x1000, 0x0) mmap$IORING_OFF_SQES(&(0x7f0000ffe000/0x1000)=nil, 0x1000, 0x1000000, 0x11, r8, 0x10000000) r9 = syz_io_uring_setup(0x7870, &(0x7f0000000f40)={0x0, 0x5d7e, 0x10, 0x1, 0x304, 0x0, r8}, &(0x7f0000ffe000/0x2000)=nil, &(0x7f0000ffa000/0x3000)=nil, &(0x7f0000000fc0), &(0x7f0000001000)) io_uring_register$IORING_REGISTER_PERSONALITY(r9, 0x9, 0x0, 0x0) semget(0x1, 0x3, 0x511) 11:48:56 executing program 3: r0 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000000)='./binderfs2/custom0\x00', 0x0, 0x0) r1 = perf_event_open(&(0x7f00000007c0)={0x0, 0x80, 0x2, 0x4, 0x1c, 0xff, 0x0, 0xe4, 0x8, 0x7, 0x1, 0x1, 0x1, 0x1, 0x1, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x1, 0x0, 0x1, 0x1, 0x0, 0x0, 0x1, 0x0, 0x1, 0x1, 0x1, 0x1, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x1, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffff1cd, 0x1, @perf_bp={&(0x7f0000000780), 0x4}, 0x4173, 0x1, 0x2, 0x4, 0x1, 0x2, 0x7, 0x0, 0xffffff7f, 0x0, 0x68c4}, 0x0, 0x5, 0xffffffffffffffff, 0x0) r2 = openat$cgroup_type(0xffffffffffffffff, &(0x7f0000000840), 0x2, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000ac0)={0xa0, 0x0, &(0x7f0000000940)=[@increfs_done={0x40106308, 0x2}, @acquire, @dead_binder_done, @register_looper, @dead_binder_done, @increfs_done={0x40106308, 0x3}, @request_death={0x400c630e, 0x1}, @reply={0x40406301, {0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x48, 0x18, &(0x7f0000000880)={@fd={0x66642a85, 0x0, r1}, @flat=@weak_binder={0x77622a85, 0x0, 0x1}, @fd={0x66642a85, 0x0, r2}}, &(0x7f0000000900)={0x0, 0x18, 0x30}}}], 0xba, 0x0, &(0x7f0000000a00)="300c964b99b0fc8bc041eed901596dcc00c49ae50e7d50ab2181ebd3ced1dedd5b95801b47942df87fa0193d45616e7abcb521e4b3031cf0f6ce86d01e78fd249c0a368369dcbb588cf079a014940599b7b6d4397e0d176e2576874ae05c2c5cb611bc0a2d765cd1223396d58aed4be672d29a0400a0b3f8ce7a4a03028b890b0f5a8be682791ee67fd5956810a83a83ae92d2e89345cd2f5ecebe5e98f11d0642b6624d047bf7127114786a300db84bfe332fe8533489aad8be"}) r3 = mmap$IORING_OFF_CQ_RING(&(0x7f0000ffe000/0x2000)=nil, 0x2000, 0x2000001, 0x4000010, 0xffffffffffffffff, 0x8000000) r4 = mmap$IORING_OFF_SQES(&(0x7f0000ffe000/0x2000)=nil, 0x2000, 0x1000008, 0x4010, 0xffffffffffffffff, 0x10000000) r5 = io_uring_register$IORING_REGISTER_PERSONALITY(0xffffffffffffffff, 0x9, 0x0, 0x0) r6 = openat$cgroup_pressure(0xffffffffffffffff, &(0x7f0000000b00)='io.pressure\x00', 0x2, 0x0) syz_io_uring_submit(r3, r4, &(0x7f0000000b40)=@IORING_OP_TEE={0x21, 0x5, 0x0, @fd_index=0x9, 0x0, 0x0, 0x6, 0x7, 0x1, {0x0, r5, r6}}, 0x5) rt_sigaction(0x15, &(0x7f0000000c40)={&(0x7f0000000b80)="f2a6c4e2252c9eec000000666666420f3a14a9020000000dc4e279185556c4e2ed2981060000008fe9d801cbdd15ddac000066450f3a14913223333300c4e17a6f54d28dc4a261ba5682", 0x80000002, &(0x7f0000000c00)="c4c2c5ab07c4e1fd60fbc461ff2d6dcd3e0f1b1e0f0d3ec4e2e9af1c430fff57000f419f47200000c4a2f920cd450a8000000000", {[0x1]}}, &(0x7f0000000d40)={&(0x7f0000000c80)="e353c442f8f35266c401f928dff30fa7c0653e2e2e64a564410f0ffca0c481196907c401015de4dbd1c4019172e508", 0x0, &(0x7f0000000cc0)="c4e141f123c4a27bf79482a9e77544c422cd3c8204000000660fc5c881c441c173dd00c483fd01309dc462559c71472e260f4694aa0a000000c4e228f31dfeefffff140f"}, 0x8, &(0x7f0000000d80)) ioctl$CDROM_MEDIA_CHANGED(0xffffffffffffffff, 0x5325, 0x7) openat$binderfs(0xffffffffffffff9c, &(0x7f0000000dc0)='./binderfs2/binder1\x00', 0x800, 0x0) r7 = syz_io_uring_setup(0x783a, &(0x7f0000000e00)={0x0, 0xe533, 0x8, 0x3, 0x3a0}, &(0x7f0000ffc000/0x1000)=nil, &(0x7f0000ffc000/0x3000)=nil, &(0x7f0000000e80), &(0x7f0000000ec0)) mmap$IORING_OFF_SQ_RING(&(0x7f0000ffc000/0x4000)=nil, 0x4000, 0x2000000, 0x12, r7, 0x0) msgctl$IPC_RMID(0xffffffffffffffff, 0x0) r8 = openat$hwrng(0xffffffffffffff9c, &(0x7f0000000f00), 0x1000, 0x0) mmap$IORING_OFF_SQES(&(0x7f0000ffe000/0x1000)=nil, 0x1000, 0x1000000, 0x11, r8, 0x10000000) syz_io_uring_setup(0x7870, &(0x7f0000000f40)={0x0, 0x5d7e, 0x10, 0x1, 0x304, 0x0, r8}, &(0x7f0000ffe000/0x2000)=nil, &(0x7f0000ffa000/0x3000)=nil, &(0x7f0000000fc0), &(0x7f0000001000)) semget(0x1, 0x3, 0x511) [ 93.490727] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 93.491467] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 11:48:56 executing program 3: r0 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000000)='./binderfs2/custom0\x00', 0x0, 0x0) r1 = perf_event_open(&(0x7f00000007c0)={0x0, 0x80, 0x2, 0x4, 0x1c, 0xff, 0x0, 0xe4, 0x8, 0x7, 0x1, 0x1, 0x1, 0x1, 0x1, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x1, 0x0, 0x1, 0x1, 0x0, 0x0, 0x1, 0x0, 0x1, 0x1, 0x1, 0x1, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x1, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffff1cd, 0x1, @perf_bp={&(0x7f0000000780), 0x4}, 0x4173, 0x1, 0x2, 0x4, 0x1, 0x2, 0x7, 0x0, 0xffffff7f, 0x0, 0x68c4}, 0x0, 0x5, 0xffffffffffffffff, 0x0) r2 = openat$cgroup_type(0xffffffffffffffff, &(0x7f0000000840), 0x2, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000ac0)={0xa0, 0x0, &(0x7f0000000940)=[@increfs_done={0x40106308, 0x2}, @acquire, @dead_binder_done, @register_looper, @dead_binder_done, @increfs_done={0x40106308, 0x3}, @request_death={0x400c630e, 0x1}, @reply={0x40406301, {0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x48, 0x18, &(0x7f0000000880)={@fd={0x66642a85, 0x0, r1}, @flat=@weak_binder={0x77622a85, 0x0, 0x1}, @fd={0x66642a85, 0x0, r2}}, &(0x7f0000000900)={0x0, 0x18, 0x30}}}], 0xba, 0x0, &(0x7f0000000a00)="300c964b99b0fc8bc041eed901596dcc00c49ae50e7d50ab2181ebd3ced1dedd5b95801b47942df87fa0193d45616e7abcb521e4b3031cf0f6ce86d01e78fd249c0a368369dcbb588cf079a014940599b7b6d4397e0d176e2576874ae05c2c5cb611bc0a2d765cd1223396d58aed4be672d29a0400a0b3f8ce7a4a03028b890b0f5a8be682791ee67fd5956810a83a83ae92d2e89345cd2f5ecebe5e98f11d0642b6624d047bf7127114786a300db84bfe332fe8533489aad8be"}) r3 = mmap$IORING_OFF_CQ_RING(&(0x7f0000ffe000/0x2000)=nil, 0x2000, 0x2000001, 0x4000010, 0xffffffffffffffff, 0x8000000) r4 = mmap$IORING_OFF_SQES(&(0x7f0000ffe000/0x2000)=nil, 0x2000, 0x1000008, 0x4010, 0xffffffffffffffff, 0x10000000) r5 = io_uring_register$IORING_REGISTER_PERSONALITY(0xffffffffffffffff, 0x9, 0x0, 0x0) r6 = openat$cgroup_pressure(0xffffffffffffffff, &(0x7f0000000b00)='io.pressure\x00', 0x2, 0x0) syz_io_uring_submit(r3, r4, &(0x7f0000000b40)=@IORING_OP_TEE={0x21, 0x5, 0x0, @fd_index=0x9, 0x0, 0x0, 0x6, 0x7, 0x1, {0x0, r5, r6}}, 0x5) rt_sigaction(0x15, &(0x7f0000000c40)={&(0x7f0000000b80)="f2a6c4e2252c9eec000000666666420f3a14a9020000000dc4e279185556c4e2ed2981060000008fe9d801cbdd15ddac000066450f3a14913223333300c4e17a6f54d28dc4a261ba5682", 0x80000002, &(0x7f0000000c00)="c4c2c5ab07c4e1fd60fbc461ff2d6dcd3e0f1b1e0f0d3ec4e2e9af1c430fff57000f419f47200000c4a2f920cd450a8000000000", {[0x1]}}, &(0x7f0000000d40)={&(0x7f0000000c80)="e353c442f8f35266c401f928dff30fa7c0653e2e2e64a564410f0ffca0c481196907c401015de4dbd1c4019172e508", 0x0, &(0x7f0000000cc0)="c4e141f123c4a27bf79482a9e77544c422cd3c8204000000660fc5c881c441c173dd00c483fd01309dc462559c71472e260f4694aa0a000000c4e228f31dfeefffff140f"}, 0x8, &(0x7f0000000d80)) ioctl$CDROM_MEDIA_CHANGED(0xffffffffffffffff, 0x5325, 0x7) openat$binderfs(0xffffffffffffff9c, &(0x7f0000000dc0)='./binderfs2/binder1\x00', 0x800, 0x0) r7 = syz_io_uring_setup(0x783a, &(0x7f0000000e00)={0x0, 0xe533, 0x8, 0x3, 0x3a0}, &(0x7f0000ffc000/0x1000)=nil, &(0x7f0000ffc000/0x3000)=nil, &(0x7f0000000e80), &(0x7f0000000ec0)) mmap$IORING_OFF_SQ_RING(&(0x7f0000ffc000/0x4000)=nil, 0x4000, 0x2000000, 0x12, r7, 0x0) msgctl$IPC_RMID(0xffffffffffffffff, 0x0) r8 = openat$hwrng(0xffffffffffffff9c, &(0x7f0000000f00), 0x1000, 0x0) mmap$IORING_OFF_SQES(&(0x7f0000ffe000/0x1000)=nil, 0x1000, 0x1000000, 0x11, r8, 0x10000000) semget(0x1, 0x3, 0x511) 11:48:56 executing program 2: ioctl$SCSI_IOCTL_DOORLOCK(0xffffffffffffffff, 0x5380) r0 = syz_open_dev$sg(&(0x7f0000000000), 0x9, 0x200) ioctl$SCSI_IOCTL_SYNC(r0, 0x4) ioctl$SG_GET_SG_TABLESIZE(r0, 0x227f, &(0x7f0000000040)) r1 = openat$cdrom(0xffffffffffffff9c, &(0x7f0000000080), 0x331200, 0x0) ioctl$CDROMRESET(r1, 0x5312) r2 = openat$cgroup(0xffffffffffffffff, &(0x7f00000000c0)='syz0\x00', 0x200002, 0x0) openat$cgroup_netprio_ifpriomap(r2, &(0x7f0000000100), 0x2, 0x0) ioctl$SG_GET_SG_TABLESIZE(r0, 0x227f, &(0x7f0000000140)) r3 = openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000180)='./cgroup.net/syz1\x00', 0x200002, 0x0) r4 = openat$cgroup(r2, &(0x7f00000001c0)='syz0\x00', 0x200002, 0x0) openat$cgroup_pressure(r4, &(0x7f0000000200)='memory.pressure\x00', 0x2, 0x0) ioctl$CDROMSETSPINDOWN(r1, 0x531e, &(0x7f0000000240)=0x6) ioctl$CDROMREADCOOKED(r1, 0x5315, &(0x7f0000000280)) openat$vga_arbiter(0xffffffffffffff9c, &(0x7f0000000d00), 0x200080, 0x0) r5 = openat$hwrng(0xffffffffffffff9c, &(0x7f0000000d40), 0x200000, 0x0) write$tcp_congestion(r5, &(0x7f0000000d80)='westwood\x00', 0x9) ioctl$CDROM_NEXT_WRITABLE(r5, 0x5394, &(0x7f0000000dc0)) openat$cgroup_subtree(r3, &(0x7f0000000e00), 0x2, 0x0) ioctl$CDROMVOLCTRL(0xffffffffffffffff, 0x530a, &(0x7f0000000e40)={0x7f, 0x81, 0x8}) [ 93.585599] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 93.586270] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 93.628514] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 93.629161] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 93.722875] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 93.723507] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 93.738100] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 93.738721] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 93.841849] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 93.842470] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 93.900935] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 93.901559] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 11:49:08 executing program 6: r0 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) syz_genetlink_get_family_id$nbd(&(0x7f0000000000), r0) sendmsg$NL802154_CMD_NEW_SEC_LEVEL(r0, &(0x7f0000000140)={&(0x7f0000000040)={0x10, 0x0, 0x0, 0x2}, 0xc, &(0x7f0000000100)={&(0x7f0000000080)={0x4c, 0x0, 0x10, 0x70bd26, 0x25dfdbfd, {}, [@NL802154_ATTR_SEC_LEVEL={0x1c, 0x22, 0x0, 0x1, [@NL802154_SECLEVEL_ATTR_DEV_OVERRIDE={0x5, 0x4, 0x1}, @NL802154_SECLEVEL_ATTR_DEV_OVERRIDE={0x5}, @NL802154_SECLEVEL_ATTR_LEVELS={0x5, 0x1, 0x9}]}, @NL802154_ATTR_SEC_LEVEL={0x1c, 0x22, 0x0, 0x1, [@NL802154_SECLEVEL_ATTR_CMD_FRAME={0x8, 0x3, 0x3}, @NL802154_SECLEVEL_ATTR_DEV_OVERRIDE={0x5}, @NL802154_SECLEVEL_ATTR_CMD_FRAME={0x8, 0x3, 0x9}]}]}, 0x4c}, 0x1, 0x0, 0x0, 0x8091}, 0x80) sendmsg$NLBL_MGMT_C_REMOVE(r0, &(0x7f0000000240)={&(0x7f0000000180)={0x10, 0x0, 0x0, 0x10000000}, 0xc, &(0x7f0000000200)={&(0x7f00000001c0)={0x34, 0x0, 0x400, 0x70bd2d, 0x25dfdbfc, {}, [@NLBL_MGMT_A_IPV4ADDR={0x8, 0x7, @multicast2}, @NLBL_MGMT_A_IPV4ADDR={0x8, 0x7, @loopback}, @NLBL_MGMT_A_IPV4ADDR={0x8, 0x7, @remote}, @NLBL_MGMT_A_CLPDOI={0x8}]}, 0x34}, 0x1, 0x0, 0x0, 0x8000}, 0x800) ioctl$sock_SIOCGIFINDEX_802154(r0, 0x8933, &(0x7f0000000280)={'wpan4\x00', 0x0}) sendmsg$NL802154_CMD_NEW_SEC_DEVKEY(r0, &(0x7f0000000500)={&(0x7f00000002c0)={0x10, 0x0, 0x0, 0x41000089}, 0xc, &(0x7f00000004c0)={&(0x7f0000000300)={0x190, 0x0, 0x400, 0x70bd2d, 0x25dfdbfc, {}, [@NL802154_ATTR_SEC_DEVKEY={0x8c, 0x24, 0x0, 0x1, [@NL802154_DEVKEY_ATTR_FRAME_COUNTER={0x8, 0x1, 0x8}, @NL802154_DEVKEY_ATTR_ID={0x6c, 0x3, 0x0, 0x1, [@NL802154_KEY_ID_ATTR_IMPLICIT={0x44, 0x3, 0x0, 0x1, [@NL802154_DEV_ADDR_ATTR_SHORT={0x6, 0x3, 0xaaa0}, @NL802154_DEV_ADDR_ATTR_SHORT={0x6, 0x3, 0xaaa0}, @NL802154_DEV_ADDR_ATTR_PAN_ID={0x6, 0x1, 0x2}, @NL802154_DEV_ADDR_ATTR_PAN_ID={0x6, 0x1, 0x1}, @NL802154_DEV_ADDR_ATTR_EXTENDED={0xc, 0x4, {0xaaaaaaaaaaaa0102}}, @NL802154_DEV_ADDR_ATTR_MODE={0x8, 0x2, 0x2}, @NL802154_DEV_ADDR_ATTR_EXTENDED={0xc, 0x4, {0xaaaaaaaaaaaa0202}}]}, @NL802154_KEY_ID_ATTR_MODE={0x8, 0x1, 0x2}, @NL802154_KEY_ID_ATTR_IMPLICIT={0x1c, 0x3, 0x0, 0x1, [@NL802154_DEV_ADDR_ATTR_SHORT={0x6, 0x3, 0xaaa1}, @NL802154_DEV_ADDR_ATTR_PAN_ID={0x6}, @NL802154_DEV_ADDR_ATTR_PAN_ID={0x6}]}]}, @NL802154_DEVKEY_ATTR_FRAME_COUNTER={0x8, 0x1, 0xdc0e}, @NL802154_DEVKEY_ATTR_EXTENDED_ADDR={0xc}]}, @NL802154_ATTR_SEC_DEVKEY={0x78, 0x24, 0x0, 0x1, [@NL802154_DEVKEY_ATTR_EXTENDED_ADDR={0xc, 0x2, {0xaaaaaaaaaaaa0302}}, @NL802154_DEVKEY_ATTR_ID={0x5c, 0x3, 0x0, 0x1, [@NL802154_KEY_ID_ATTR_SOURCE_SHORT={0x8, 0x4, 0x5}, @NL802154_KEY_ID_ATTR_MODE={0x8, 0x1, 0x2}, @NL802154_KEY_ID_ATTR_INDEX={0x5, 0x2, 0x1}, @NL802154_KEY_ID_ATTR_IMPLICIT={0x38, 0x3, 0x0, 0x1, [@NL802154_DEV_ADDR_ATTR_SHORT={0x6, 0x3, 0xaaa1}, @NL802154_DEV_ADDR_ATTR_SHORT={0x6, 0x3, 0xaaa2}, @NL802154_DEV_ADDR_ATTR_SHORT={0x6, 0x3, 0xaaa1}, @NL802154_DEV_ADDR_ATTR_PAN_ID={0x6, 0x1, 0xffff}, @NL802154_DEV_ADDR_ATTR_PAN_ID={0x6, 0x1, 0x1}, @NL802154_DEV_ADDR_ATTR_EXTENDED={0xc, 0x4, {0xaaaaaaaaaaaa0102}}]}, @NL802154_KEY_ID_ATTR_INDEX={0x5, 0x2, 0x2}]}, @NL802154_DEVKEY_ATTR_EXTENDED_ADDR={0xc, 0x2, {0x300}}]}, @NL802154_ATTR_WPAN_DEV={0xc, 0x6, 0x2}, @NL802154_ATTR_WPAN_DEV={0xc, 0x6, 0x2}, @NL802154_ATTR_SEC_DEVKEY={0x4c, 0x24, 0x0, 0x1, [@NL802154_DEVKEY_ATTR_FRAME_COUNTER={0x8, 0x1, 0x8175}, @NL802154_DEVKEY_ATTR_EXTENDED_ADDR={0xc, 0x2, {0xaaaaaaaaaaaa0102}}, @NL802154_DEVKEY_ATTR_FRAME_COUNTER={0x8, 0x1, 0x5}, @NL802154_DEVKEY_ATTR_EXTENDED_ADDR={0xc, 0x2, {0xaaaaaaaaaaaa0302}}, @NL802154_DEVKEY_ATTR_ID={0x14, 0x3, 0x0, 0x1, [@NL802154_KEY_ID_ATTR_MODE={0x8, 0x1, 0x3}, @NL802154_KEY_ID_ATTR_MODE={0x8, 0x1, 0x1}]}, @NL802154_DEVKEY_ATTR_EXTENDED_ADDR={0xc, 0x2, {0xaaaaaaaaaaaa0102}}]}, @NL802154_ATTR_IFINDEX={0x8}, @NL802154_ATTR_WPAN_DEV={0xc, 0x6, 0x200000002}]}, 0x190}, 0x1, 0x0, 0x0, 0x20000084}, 0x80) sendmsg$IEEE802154_LLSEC_DEL_DEVKEY(r0, &(0x7f0000000600)={&(0x7f0000000540)={0x10, 0x0, 0x0, 0x100}, 0xc, &(0x7f00000005c0)={&(0x7f0000000580)={0x1c, 0x0, 0x100, 0x70bd2c, 0x25dfdbfb, {}, [@IEEE802154_ATTR_LLSEC_KEY_MODE={0x5}]}, 0x1c}, 0x1, 0x0, 0x0, 0x8040}, 0x1) ioctl$sock_SIOCGIFINDEX_802154(r0, 0x8933, &(0x7f0000000680)={'wpan4\x00', 0x0}) sendmsg$NL802154_CMD_NEW_SEC_LEVEL(r0, &(0x7f0000000780)={&(0x7f0000000640)={0x10, 0x0, 0x0, 0x100}, 0xc, &(0x7f0000000740)={&(0x7f00000006c0)={0x60, 0x0, 0x4, 0x70bd2d, 0x25dfdbfe, {}, [@NL802154_ATTR_WPAN_DEV={0xc, 0x6, 0x300000003}, @NL802154_ATTR_SEC_LEVEL={0xc, 0x22, 0x0, 0x1, [@NL802154_SECLEVEL_ATTR_CMD_FRAME={0x8, 0x3, 0x8}]}, @NL802154_ATTR_SEC_LEVEL={0x14, 0x22, 0x0, 0x1, [@NL802154_SECLEVEL_ATTR_FRAME={0x8, 0x2, 0x2}, @NL802154_SECLEVEL_ATTR_FRAME={0x8, 0x2, 0x2}]}, @NL802154_ATTR_WPAN_DEV={0xc, 0x6, 0x200000002}, @NL802154_ATTR_WPAN_DEV={0xc}, @NL802154_ATTR_IFINDEX={0x8, 0x3, r2}]}, 0x60}, 0x1, 0x0, 0x0, 0x24040800}, 0xc000) r3 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r4 = syz_genetlink_get_family_id$nbd(&(0x7f0000000800), r0) sendmsg$NBD_CMD_RECONFIGURE(r3, &(0x7f0000000900)={&(0x7f00000007c0)={0x10, 0x0, 0x0, 0x800}, 0xc, &(0x7f00000008c0)={&(0x7f0000000840)={0x58, r4, 0x100, 0x70bd29, 0x25dfdbfe, {}, [@NBD_ATTR_DEAD_CONN_TIMEOUT={0xc, 0x8, 0x1a5}, @NBD_ATTR_DEAD_CONN_TIMEOUT={0xc, 0x8, 0x8}, @NBD_ATTR_SERVER_FLAGS={0xc}, @NBD_ATTR_INDEX={0x8, 0x1, 0x0}, @NBD_ATTR_BLOCK_SIZE_BYTES={0xc}, @NBD_ATTR_SIZE_BYTES={0xc, 0x2, 0x6}]}, 0x58}, 0x1, 0x0, 0x0, 0x85}, 0x24008000) r5 = syz_genetlink_get_family_id$nl802154(&(0x7f0000000980), r0) ioctl$sock_SIOCGIFINDEX_802154(r3, 0x8933, &(0x7f00000009c0)={'wpan1\x00', 0x0}) sendmsg$NL802154_CMD_NEW_SEC_LEVEL(r0, &(0x7f0000000ac0)={&(0x7f0000000940)={0x10, 0x0, 0x0, 0x8}, 0xc, &(0x7f0000000a80)={&(0x7f0000000a00)={0x64, r5, 0x604, 0x70bd25, 0x7e5, {}, [@NL802154_ATTR_WPAN_DEV={0xc, 0x6, 0x3}, @NL802154_ATTR_SEC_LEVEL={0x14, 0x22, 0x0, 0x1, [@NL802154_SECLEVEL_ATTR_FRAME={0x8, 0x2, 0x2}, @NL802154_SECLEVEL_ATTR_DEV_OVERRIDE={0x5}]}, @NL802154_ATTR_IFINDEX={0x8, 0x3, r6}, @NL802154_ATTR_IFINDEX={0x8, 0x3, r1}, @NL802154_ATTR_SEC_LEVEL={0x14, 0x22, 0x0, 0x1, [@NL802154_SECLEVEL_ATTR_FRAME={0x8, 0x2, 0x1}, @NL802154_SECLEVEL_ATTR_LEVELS={0x5, 0x1, 0x5}]}, @NL802154_ATTR_WPAN_DEV={0xc, 0x6, 0x200000002}]}, 0x64}}, 0x8050) r7 = syz_genetlink_get_family_id$nl802154(&(0x7f0000000b40), r3) ioctl$sock_SIOCGIFINDEX_802154(r0, 0x8933, &(0x7f0000000b80)={'wpan1\x00', 0x0}) sendmsg$NL802154_CMD_GET_SEC_DEVKEY(r3, &(0x7f0000000c80)={&(0x7f0000000b00)={0x10, 0x0, 0x0, 0x10000}, 0xc, &(0x7f0000000c40)={&(0x7f0000000bc0)={0x64, r7, 0x800, 0x70bd26, 0x25dfdbff, {}, [@NL802154_ATTR_WPAN_DEV={0xc}, @NL802154_ATTR_WPAN_DEV={0xc}, @NL802154_ATTR_IFINDEX={0x8, 0x3, r2}, @NL802154_ATTR_IFINDEX={0x8, 0x3, r8}, @NL802154_ATTR_IFINDEX={0x8, 0x3, r6}, @NL802154_ATTR_WPAN_DEV={0xc}, @NL802154_ATTR_IFINDEX={0x8, 0x3, r2}, @NL802154_ATTR_WPAN_DEV={0xc, 0x6, 0x3}]}, 0x64}, 0x1, 0x0, 0x0, 0x4000844}, 0x4000) r9 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) sendmsg$NLBL_MGMT_C_REMOVEDEF(r9, &(0x7f0000000d80)={&(0x7f0000000cc0)={0x10, 0x0, 0x0, 0x10000000}, 0xc, &(0x7f0000000d40)={&(0x7f0000000d00)={0x1c, 0x0, 0x1, 0x70bd28, 0x25dfdbfe, {}, [@NLBL_MGMT_A_PROTOCOL={0x8, 0x2, 0x3}]}, 0x1c}, 0x1, 0x0, 0x0, 0x800}, 0x4000) 11:49:08 executing program 0: syz_io_uring_submit(0x0, 0x0, &(0x7f0000000000)=@IORING_OP_NOP={0x0, 0x1}, 0x6) ioctl$sock_SIOCGIFINDEX_802154(0xffffffffffffffff, 0x8933, &(0x7f0000000080)={'wpan4\x00', 0x0}) sendmsg$IEEE802154_LLSEC_GETPARAMS(0xffffffffffffffff, &(0x7f0000000140)={&(0x7f0000000040)={0x10, 0x0, 0x0, 0x40000000}, 0xc, &(0x7f0000000100)={&(0x7f00000000c0)={0x38, 0x0, 0x20, 0x70bd2a, 0x25dfdbff, {}, [@IEEE802154_ATTR_DEV_INDEX={0x8, 0x2, r0}, @IEEE802154_ATTR_DEV_NAME={0xa, 0x1, 'wpan1\x00'}, @IEEE802154_ATTR_DEV_INDEX={0x8}, @IEEE802154_ATTR_DEV_INDEX={0x8}]}, 0x38}, 0x1, 0x0, 0x0, 0x4000090}, 0x20008010) r1 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) sendmsg$NL802154_CMD_NEW_SEC_DEVKEY(r1, &(0x7f0000000240)={&(0x7f0000000180)={0x10, 0x0, 0x0, 0x10000}, 0xc, &(0x7f0000000200)={&(0x7f00000001c0)={0x2c, 0x0, 0x1, 0x70bd2b, 0x25dfdbfd, {}, [@NL802154_ATTR_SEC_DEVKEY={0x10, 0x24, 0x0, 0x1, [@NL802154_DEVKEY_ATTR_ID={0xc, 0x3, 0x0, 0x1, [@NL802154_KEY_ID_ATTR_INDEX={0x5, 0x2, 0x2}]}]}, @NL802154_ATTR_IFINDEX={0x8, 0x3, r0}]}, 0x2c}}, 0x4040080) r2 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) ioctl$sock_SIOCGIFINDEX_802154(r1, 0x8933, &(0x7f00000002c0)={'wpan4\x00', 0x0}) ioctl$sock_SIOCGIFINDEX_802154(r1, 0x8933, &(0x7f0000000300)={'wpan0\x00', 0x0}) ioctl$sock_SIOCGIFINDEX_802154(r1, 0x8933, &(0x7f0000000340)={'wpan0\x00', 0x0}) sendmsg$IEEE802154_LLSEC_GETPARAMS(r2, &(0x7f0000000440)={&(0x7f0000000280)={0x10, 0x0, 0x0, 0x8000}, 0xc, &(0x7f0000000400)={&(0x7f0000000380)={0x5c, 0x0, 0x504, 0x70bd2b, 0x25dfdbfb, {}, [@IEEE802154_ATTR_DEV_INDEX={0x8, 0x2, r3}, @IEEE802154_ATTR_DEV_NAME={0xa, 0x1, 'wpan1\x00'}, @IEEE802154_ATTR_DEV_INDEX={0x8, 0x2, r0}, @IEEE802154_ATTR_DEV_INDEX={0x8, 0x2, r0}, @IEEE802154_ATTR_DEV_INDEX={0x8, 0x2, r4}, @IEEE802154_ATTR_DEV_INDEX={0x8, 0x2, r5}, @IEEE802154_ATTR_DEV_NAME={0xa, 0x1, 'wpan1\x00'}, @IEEE802154_ATTR_DEV_INDEX={0x8, 0x2, r0}]}, 0x5c}, 0x1, 0x0, 0x0, 0x24040080}, 0x4004014) r6 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000480)='./binderfs/custom0\x00', 0x802, 0x0) mmap$binder(&(0x7f0000ffd000/0x2000)=nil, 0x2000, 0x1, 0x11, r6, 0x10001) syz_genetlink_get_family_id$nbd(&(0x7f00000004c0), r2) syz_genetlink_get_family_id$netlbl_mgmt(&(0x7f0000000500), r1) getpid() sendmsg$IEEE802154_LLSEC_DEL_DEVKEY(r1, &(0x7f0000000640)={&(0x7f0000000540)={0x10, 0x0, 0x0, 0x2000}, 0xc, &(0x7f0000000600)={&(0x7f0000000580)={0x44, 0x0, 0x20, 0x70bd25, 0x25dfdbfd, {}, [@IEEE802154_ATTR_LLSEC_KEY_SOURCE_EXTENDED={0xc, 0x2d, {0xaaaaaaaaaaaa0002}}, @IEEE802154_ATTR_LLSEC_KEY_ID={0x5, 0x2e, 0x1f}, @IEEE802154_ATTR_LLSEC_KEY_SOURCE_SHORT={0x8, 0x2c, 0x4}, @IEEE802154_ATTR_LLSEC_KEY_MODE={0x5, 0x2b, 0x2}, @IEEE802154_ATTR_LLSEC_KEY_SOURCE_EXTENDED={0xc, 0x2d, {0xaaaaaaaaaaaa0202}}]}, 0x44}, 0x1, 0x0, 0x0, 0x1}, 0x400c084) ioctl$PERF_EVENT_IOC_PAUSE_OUTPUT(0xffffffffffffffff, 0x40042409, 0x1) r7 = syz_genetlink_get_family_id$nl802154(&(0x7f00000006c0), r2) ioctl$sock_SIOCGIFINDEX_802154(r2, 0x8933, &(0x7f0000000700)={'wpan0\x00', 0x0}) sendmsg$NL802154_CMD_NEW_SEC_DEV(r1, &(0x7f0000000800)={&(0x7f0000000680)={0x10, 0x0, 0x0, 0x400000}, 0xc, &(0x7f00000007c0)={&(0x7f0000000740)={0x44, r7, 0x400, 0x70bd2d, 0x25dfdbff, {}, [@NL802154_ATTR_IFINDEX={0x8}, @NL802154_ATTR_WPAN_DEV={0xc, 0x6, 0x300000001}, @NL802154_ATTR_IFINDEX={0x8, 0x3, r8}, @NL802154_ATTR_WPAN_DEV={0xc, 0x6, 0x300000003}, @NL802154_ATTR_IFINDEX={0x8, 0x3, r0}]}, 0x44}, 0x1, 0x0, 0x0, 0x8001}, 0x4000000) 11:49:08 executing program 4: syz_extract_tcp_res$synack(&(0x7f0000000000), 0x1, 0x0) syz_extract_tcp_res$synack(&(0x7f0000000040), 0x1, 0x0) rt_sigaction(0xd, &(0x7f0000000140)={&(0x7f0000000080)="c4e3c178b5d8c4634d29c4817d518000000080c482fd346000673e0062fa660f38f571012e0ffc689bc461296480e6e3000065430f002b460febbf61d4d0d445cf", 0x1, &(0x7f0000000100)="470f0d16432996917500008fe9e001f40f1553f0c0e200c441f8ae12e00e0fff6100f346acc40379087b0000"}, &(0x7f0000000200)={&(0x7f0000000180)="3c9d6467660f3825af84dff5c36666460f2f99f9a6000044c0120967de8a50000000660f72e64c0f0f65f4aed80c0500000000660fdd700ac4e13dc6cb28", 0x0, &(0x7f00000001c0)="c463097e11000f8b0600000022f3c4e27d395c7500c443c92122088f89b09a08c4a2f923680666450f285d0cdb8d8b0000008f297c800f"}, 0x8, &(0x7f0000000240)) syz_extract_tcp_res(&(0x7f0000000280), 0x6, 0xa70) syz_extract_tcp_res$synack(&(0x7f00000002c0), 0x1, 0x0) ioctl$SCSI_IOCTL_DOORLOCK(0xffffffffffffffff, 0x5380) syz_emit_ethernet(0x1e, &(0x7f0000000300)={@broadcast, @dev={'\xaa\xaa\xaa\xaa\xaa', 0xd}, @void, {@can={0xc, {{0x3}, 0x2, 0x1, 0x0, 0x0, "6bfba1406a479fb2"}}}}, &(0x7f0000000340)={0x0, 0x0, [0x8b9, 0x6db, 0xffffffff, 0x984]}) syz_extract_tcp_res(&(0x7f0000000380), 0x1000, 0x40) r0 = epoll_create1(0x0) io_submit(0x0, 0x1, &(0x7f00000004c0)=[&(0x7f0000000480)={0x0, 0x0, 0x0, 0x6, 0x7, r0, &(0x7f00000003c0)="00b733efbc7a452b4c4974d0325c47c0cd7f228aedb7a964d6bebc8a41c698f8da99a12d83c1ee10ea1f0dafe385bbbf36aecccb67651345b4e70c690533fe0b0a36153fd3e0bc203ea66e295a109d2d881d412f4d7d7c3f5f1b42d41bd6b54432553390cacac0db10b825d9644eb2f6d85dde1b647d6159751d0b58f05f5d7ddfeb112c8647d5fa3821e9c28cefd06eb682c57b78c4dfef355dae2253a329de2a92a4c2952289570e459255c5d7b67e451e7893b2", 0xb5, 0x6, 0x0, 0x2}]) syz_emit_ethernet(0xf1, &(0x7f0000000500)={@empty, @broadcast, @void, {@llc_tr={0x11, {@llc={0xf0, 0x8e, "a7e2", "4438090c86455279887b27f5d9c7d1e053ac06be6bf50fc3e0cf9c8b7b18e76f80416f8ef3e8972b1d818e6dab216e4b279799936725c3220d6412b05e66a7a986d09d63798706c5a0209f2123b5e99cc1fc63557c5df124dd742e490d749ba501a82736674c26938bb7c8259bd9c6255105d039b36e07ce39315565bef1c3f0ae998dfa8b4feca55b701a7d908e7834a875d8a6bff23736bc379bd69d4149d619bd3e95466c31cc8fe67bf24e665b9dc826e4cb1749350dfbef9909bd11e6f924191d538bb2aeaa40199e976ce9597674a26345eb67b818e6f191bddabb90"}}}}}, &(0x7f0000000600)={0x0, 0x2, [0x6bb, 0xf50, 0xa3e, 0x5ed]}) r1 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r2 = syz_genetlink_get_family_id$nbd(&(0x7f0000000680), 0xffffffffffffffff) sendmsg$NBD_CMD_RECONFIGURE(r1, &(0x7f0000000740)={&(0x7f0000000640), 0xc, &(0x7f0000000700)={&(0x7f00000006c0)={0x20, r2, 0x500, 0x70bd29, 0x25dfdbfc, {}, [@NBD_ATTR_BLOCK_SIZE_BYTES={0xc, 0x3, 0x3f}]}, 0x20}, 0x1, 0x0, 0x0, 0x84}, 0x20000850) getgroups(0x1, &(0x7f0000000780)=[0x0]) r3 = openat$cgroup_type(0xffffffffffffffff, &(0x7f00000007c0), 0x2, 0x0) write$cgroup_type(r3, &(0x7f0000000800), 0x9) r4 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r5 = syz_genetlink_get_family_id$nl802154(&(0x7f0000000880), r1) sendmsg$NL802154_CMD_SET_TX_POWER(r4, &(0x7f0000000940)={&(0x7f0000000840)={0x10, 0x0, 0x0, 0x40}, 0xc, &(0x7f0000000900)={&(0x7f00000008c0)={0x38, r5, 0x8, 0x70bd27, 0x25dfdbfb, {}, [@NL802154_ATTR_WPAN_DEV={0xc}, @NL802154_ATTR_TX_POWER={0x8, 0xb, 0x80}, @NL802154_ATTR_WPAN_PHY={0x8, 0x1, 0x2}, @NL802154_ATTR_TX_POWER={0x8, 0xb, 0x7fff}]}, 0x38}, 0x1, 0x0, 0x0, 0x20044880}, 0x40001) 11:49:08 executing program 1: eventfd(0xfffffff9) ioctl$CDROMREADTOCENTRY(0xffffffffffffffff, 0x5306, &(0x7f0000000000)={0x5, 0x4, 0x2, 0x3, @lba=0x8000, 0x4}) ioctl$CDROMSETSPINDOWN(0xffffffffffffffff, 0x531e, &(0x7f0000000040)=0x8) ioctl$CDROMREADCOOKED(0xffffffffffffffff, 0x5315, &(0x7f0000000080)) ioctl$CDROMVOLREAD(0xffffffffffffffff, 0x5313, &(0x7f0000000b00)) syz_open_dev$sg(&(0x7f0000000b40), 0x3ff, 0x80000) r0 = openat$hwrng(0xffffffffffffff9c, &(0x7f0000000b80), 0x800, 0x0) ioctl$CDROMCLOSETRAY(r0, 0x5319) ioctl$CDROM_TIMED_MEDIA_CHANGE(r0, 0x5396, &(0x7f0000000bc0)={0x8, 0x1}) ioctl$CDROMREADAUDIO(r0, 0x530e, &(0x7f0000000c40)={@lba=0x23c, 0x5, 0x12, &(0x7f0000000c00)=""/18}) openat$cgroup_type(r0, &(0x7f0000000c80), 0x2, 0x0) r1 = openat$hwrng(0xffffffffffffff9c, &(0x7f0000000cc0), 0x220000, 0x0) ioctl$CDROMREADTOCHDR(r1, 0x5305, &(0x7f0000000d00)={0x7f, 0x1}) r2 = openat$hwrng(0xffffffffffffff9c, &(0x7f0000000d40), 0x10400, 0x0) write$cgroup_type(r2, &(0x7f0000000d80), 0x9) r3 = openat$cdrom(0xffffffffffffff9c, &(0x7f0000000dc0), 0x0, 0x0) ioctl$CDROMMULTISESSION(r3, 0x5310, &(0x7f0000000e00)={@lba=0xf, 0x1}) r4 = openat$cdrom(0xffffffffffffff9c, &(0x7f0000000e40), 0x240, 0x0) ioctl$CDROMREADTOCENTRY(r4, 0x5306, &(0x7f0000000e80)={0x1f, 0x6, 0x9, 0x0, @lba=0x6, 0x4}) ioctl$CDROMREADCOOKED(r3, 0x5315, &(0x7f0000000ec0)) 11:49:08 executing program 5: setitimer(0x0, &(0x7f0000000000)={{}, {0x0, 0xea60}}, &(0x7f0000000040)) getitimer(0x0, &(0x7f0000000080)) r0 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$netlbl_mgmt(&(0x7f0000000100), 0xffffffffffffffff) sendmsg$NLBL_MGMT_C_ADDDEF(r0, &(0x7f00000001c0)={&(0x7f00000000c0)={0x10, 0x0, 0x0, 0x1}, 0xc, &(0x7f0000000180)={&(0x7f0000000140)={0x1c, r1, 0x4, 0x70bd2a, 0x25dfdbff, {}, [@NLBL_MGMT_A_CLPDOI={0x8}]}, 0x1c}, 0x1, 0x0, 0x0, 0x4000000}, 0x40000) geteuid() syz_usb_connect$cdc_ecm(0x4, 0x10d, &(0x7f0000000200)={{0x12, 0x1, 0x720, 0x2, 0x0, 0x0, 0x10, 0x525, 0xa4a1, 0x40, 0x1, 0x2, 0x3, 0x1, [{{0x9, 0x2, 0xfb, 0x1, 0x1, 0xba, 0x50, 0xff, [{{0x9, 0x4, 0x0, 0x7, 0x2, 0x2, 0x6, 0x0, 0x7c, {{0x8, 0x24, 0x6, 0x0, 0x0, "fbf211"}, {0x5, 0x24, 0x0, 0x8}, {0xd, 0x24, 0xf, 0x1, 0x1, 0x3f, 0x3, 0x40}, [@mdlm_detail={0x99, 0x24, 0x13, 0x3, "48c1a1b655094616df62fff6017defd0bdac4f2617618052fc22350170d4b41a1affe05826274c5d93aa871d89455559c068d877251368c5b00552322da12b5958d76e60294d79d6bd527055bb53f40402ca669ba20042da00554f68b1b12b345fc2bb35f09aac73eb5ac2fcd8634e5e7252075c0d8ce0ad3e8dda63c3c27a6db1be131aa7525a018859895d6e885540b704d1f7dc"}, @country_functional={0xc, 0x24, 0x7, 0x90, 0x6, [0x4, 0x9, 0xe77]}, @obex={0x5, 0x24, 0x15, 0x8}, @acm={0x4, 0x24, 0x2, 0xd}, @ncm={0x6, 0x24, 0x1a, 0x7, 0x26}]}, {[{{0x9, 0x5, 0x81, 0x3, 0x1df, 0x81, 0x32, 0x1}}], {{0x9, 0x5, 0x82, 0x2, 0x3ff, 0x2, 0x6, 0x5}}, {{0x9, 0x5, 0x3, 0x2, 0x8, 0x1, 0x4, 0xff}}}}}]}}]}}, &(0x7f0000000640)={0xa, &(0x7f0000000340)={0xa, 0x6, 0x110, 0x3, 0xae, 0x8, 0xff, 0x1f}, 0x5, &(0x7f0000000380)={0x5, 0xf, 0x5}, 0x7, [{0x14, &(0x7f00000003c0)=@string={0x14, 0x3, "fd058c95bdf599f8e5f073eae7235e49a442"}}, {0x4, &(0x7f0000000400)=@lang_id={0x4, 0x3, 0x380a}}, {0x4, &(0x7f0000000440)=@lang_id={0x4, 0x3, 0x445}}, {0x4, &(0x7f0000000480)=@lang_id={0x4, 0x3, 0x2c0a}}, {0x4, &(0x7f00000004c0)=@lang_id={0x4, 0x3, 0x1001}}, {0x4, &(0x7f0000000500)=@lang_id={0x4, 0x3, 0x42a}}, {0xf1, &(0x7f0000000540)=@string={0xf1, 0x3, "84d5b48356934b18c11ca618df7ef64b6c011395cc6829bdeedd71e659bc7545af1fffa2149c42cd8da15a92d7564b65a135a440b298e19eddd0415c86d7b42e1c9641793180d54dedbc008eeb526d3540368aed104e9c9220a6d3e7f635e585d6e7f55ecaab0cf2111887b6e16bfe4c3f94f53b49e421698825847fc65ef965c3007893b9e33ccdbdb39b38af85a0863c618f0d2135ee175361a7f77a56730d8ae5c677510cf17584b6302361fc90e77b8e50675a5756fd20d5f4bc211f04b21de401616a64c3d1a1398527dca0fd098e082f7533b65e1f4626cc5cbfa742eac63bb0d848f069eb64132f065192e5"}}]}) r2 = syz_genetlink_get_family_id$nl802154(&(0x7f0000000700), r0) ioctl$sock_SIOCGIFINDEX_802154(r0, 0x8933, &(0x7f0000000740)={'wpan1\x00', 0x0}) ioctl$sock_SIOCGIFINDEX_802154(r0, 0x8933, &(0x7f0000000780)={'wpan3\x00', 0x0}) sendmsg$NL802154_CMD_NEW_SEC_LEVEL(r0, &(0x7f0000000840)={&(0x7f00000006c0)={0x10, 0x0, 0x0, 0x8000000}, 0xc, &(0x7f0000000800)={&(0x7f00000007c0)={0x38, r2, 0x1, 0x70bd2a, 0x25dfdbff, {}, [@NL802154_ATTR_IFINDEX={0x8, 0x3, r3}, @NL802154_ATTR_IFINDEX={0x8, 0x3, r4}, @NL802154_ATTR_WPAN_DEV={0xc, 0x6, 0x100000001}, @NL802154_ATTR_IFINDEX={0x8}]}, 0x38}, 0x1, 0x0, 0x0, 0x1}, 0x0) ioctl$CDROMREADAUDIO(0xffffffffffffffff, 0x530e, &(0x7f00000008c0)={@lba, 0x2, 0x3b, &(0x7f0000000880)=""/59}) ioctl$CDROMREADAUDIO(0xffffffffffffffff, 0x530e, &(0x7f0000000940)={@lba=0x7, 0x1, 0x24, &(0x7f0000000900)=""/36}) sendmsg$NLBL_MGMT_C_REMOVEDEF(r0, &(0x7f0000000a40)={&(0x7f0000000980)={0x10, 0x0, 0x0, 0x20000}, 0xc, &(0x7f0000000a00)={&(0x7f00000009c0)={0x34, r1, 0x100, 0x70bd2c, 0x25dfdbfd, {}, [@NLBL_MGMT_A_IPV4MASK={0x8, 0x8, @local}, @NLBL_MGMT_A_CV4DOI={0x8, 0x4, 0xffffffffffffffff}, @NLBL_MGMT_A_IPV4MASK={0x8, 0x8, @dev={0xac, 0x14, 0x14, 0x39}}, @NLBL_MGMT_A_IPV4ADDR={0x8, 0x7, @private=0xa010102}]}, 0x34}, 0x1, 0x0, 0x0, 0x40}, 0x8011) ioctl$sock_SIOCGIFINDEX_802154(r0, 0x8933, &(0x7f0000000ac0)={'wpan1\x00', 0x0}) ioctl$sock_SIOCGIFINDEX_802154(0xffffffffffffffff, 0x8933, &(0x7f0000000b00)={'wpan1\x00', 0x0}) sendmsg$NL802154_CMD_GET_SEC_KEY(r0, &(0x7f0000000c00)={&(0x7f0000000a80)={0x10, 0x0, 0x0, 0x400000}, 0xc, &(0x7f0000000bc0)={&(0x7f0000000b40)={0x4c, r2, 0x410, 0x70bd29, 0x25dfdbff, {}, [@NL802154_ATTR_IFINDEX={0x8, 0x3, r3}, @NL802154_ATTR_IFINDEX={0x8, 0x3, r5}, @NL802154_ATTR_WPAN_DEV={0xc, 0x6, 0x300000003}, @NL802154_ATTR_IFINDEX={0x8, 0x3, r6}, @NL802154_ATTR_IFINDEX={0x8, 0x3, r3}, @NL802154_ATTR_WPAN_DEV={0xc}]}, 0x4c}, 0x1, 0x0, 0x0, 0xd4}, 0x801) r7 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) syz_genetlink_get_family_id$ieee802154(&(0x7f0000000c40), r7) sendmsg$NL802154_CMD_SET_ACKREQ_DEFAULT(0xffffffffffffffff, &(0x7f0000000d40)={&(0x7f0000000c80)={0x10, 0x0, 0x0, 0x10000}, 0xc, &(0x7f0000000d00)={&(0x7f0000000cc0)={0x20, r2, 0x800, 0x70bd29, 0x25dfdbfb, {}, [@NL802154_ATTR_WPAN_DEV={0xc, 0x6, 0x2}]}, 0x20}, 0x1, 0x0, 0x0, 0x1}, 0x8080) 11:49:08 executing program 3: r0 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000000)='./binderfs2/custom0\x00', 0x0, 0x0) r1 = perf_event_open(&(0x7f00000007c0)={0x0, 0x80, 0x2, 0x4, 0x1c, 0xff, 0x0, 0xe4, 0x8, 0x7, 0x1, 0x1, 0x1, 0x1, 0x1, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x1, 0x0, 0x1, 0x1, 0x0, 0x0, 0x1, 0x0, 0x1, 0x1, 0x1, 0x1, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x1, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffff1cd, 0x1, @perf_bp={&(0x7f0000000780), 0x4}, 0x4173, 0x1, 0x2, 0x4, 0x1, 0x2, 0x7, 0x0, 0xffffff7f, 0x0, 0x68c4}, 0x0, 0x5, 0xffffffffffffffff, 0x0) r2 = openat$cgroup_type(0xffffffffffffffff, &(0x7f0000000840), 0x2, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000ac0)={0xa0, 0x0, &(0x7f0000000940)=[@increfs_done={0x40106308, 0x2}, @acquire, @dead_binder_done, @register_looper, @dead_binder_done, @increfs_done={0x40106308, 0x3}, @request_death={0x400c630e, 0x1}, @reply={0x40406301, {0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x48, 0x18, &(0x7f0000000880)={@fd={0x66642a85, 0x0, r1}, @flat=@weak_binder={0x77622a85, 0x0, 0x1}, @fd={0x66642a85, 0x0, r2}}, &(0x7f0000000900)={0x0, 0x18, 0x30}}}], 0xba, 0x0, &(0x7f0000000a00)="300c964b99b0fc8bc041eed901596dcc00c49ae50e7d50ab2181ebd3ced1dedd5b95801b47942df87fa0193d45616e7abcb521e4b3031cf0f6ce86d01e78fd249c0a368369dcbb588cf079a014940599b7b6d4397e0d176e2576874ae05c2c5cb611bc0a2d765cd1223396d58aed4be672d29a0400a0b3f8ce7a4a03028b890b0f5a8be682791ee67fd5956810a83a83ae92d2e89345cd2f5ecebe5e98f11d0642b6624d047bf7127114786a300db84bfe332fe8533489aad8be"}) r3 = mmap$IORING_OFF_CQ_RING(&(0x7f0000ffe000/0x2000)=nil, 0x2000, 0x2000001, 0x4000010, 0xffffffffffffffff, 0x8000000) r4 = mmap$IORING_OFF_SQES(&(0x7f0000ffe000/0x2000)=nil, 0x2000, 0x1000008, 0x4010, 0xffffffffffffffff, 0x10000000) r5 = io_uring_register$IORING_REGISTER_PERSONALITY(0xffffffffffffffff, 0x9, 0x0, 0x0) r6 = openat$cgroup_pressure(0xffffffffffffffff, &(0x7f0000000b00)='io.pressure\x00', 0x2, 0x0) syz_io_uring_submit(r3, r4, &(0x7f0000000b40)=@IORING_OP_TEE={0x21, 0x5, 0x0, @fd_index=0x9, 0x0, 0x0, 0x6, 0x7, 0x1, {0x0, r5, r6}}, 0x5) rt_sigaction(0x15, &(0x7f0000000c40)={&(0x7f0000000b80)="f2a6c4e2252c9eec000000666666420f3a14a9020000000dc4e279185556c4e2ed2981060000008fe9d801cbdd15ddac000066450f3a14913223333300c4e17a6f54d28dc4a261ba5682", 0x80000002, &(0x7f0000000c00)="c4c2c5ab07c4e1fd60fbc461ff2d6dcd3e0f1b1e0f0d3ec4e2e9af1c430fff57000f419f47200000c4a2f920cd450a8000000000", {[0x1]}}, &(0x7f0000000d40)={&(0x7f0000000c80)="e353c442f8f35266c401f928dff30fa7c0653e2e2e64a564410f0ffca0c481196907c401015de4dbd1c4019172e508", 0x0, &(0x7f0000000cc0)="c4e141f123c4a27bf79482a9e77544c422cd3c8204000000660fc5c881c441c173dd00c483fd01309dc462559c71472e260f4694aa0a000000c4e228f31dfeefffff140f"}, 0x8, &(0x7f0000000d80)) ioctl$CDROM_MEDIA_CHANGED(0xffffffffffffffff, 0x5325, 0x7) openat$binderfs(0xffffffffffffff9c, &(0x7f0000000dc0)='./binderfs2/binder1\x00', 0x800, 0x0) r7 = syz_io_uring_setup(0x783a, &(0x7f0000000e00)={0x0, 0xe533, 0x8, 0x3, 0x3a0}, &(0x7f0000ffc000/0x1000)=nil, &(0x7f0000ffc000/0x3000)=nil, &(0x7f0000000e80), &(0x7f0000000ec0)) mmap$IORING_OFF_SQ_RING(&(0x7f0000ffc000/0x4000)=nil, 0x4000, 0x2000000, 0x12, r7, 0x0) msgctl$IPC_RMID(0xffffffffffffffff, 0x0) openat$hwrng(0xffffffffffffff9c, &(0x7f0000000f00), 0x1000, 0x0) semget(0x1, 0x3, 0x511) 11:49:08 executing program 7: openat$vga_arbiter(0xffffffffffffff9c, &(0x7f0000000000), 0x28081, 0x0) r0 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r1 = openat$cgroup_ro(0xffffffffffffffff, &(0x7f0000000280)='hugetlb.1GB.usage_in_bytes\x00', 0x0, 0x0) sendmsg$NBD_CMD_DISCONNECT(r0, &(0x7f0000000340)={&(0x7f0000000040)={0x10, 0x0, 0x0, 0x400}, 0xc, &(0x7f0000000300)={&(0x7f00000002c0)={0x38, 0x0, 0x800, 0x70bd27, 0x25dfdbfe, {}, [@NBD_ATTR_SOCKETS={0x24, 0x7, 0x0, 0x1, [{0x8}, {0x8, 0x1, r1}, {0x8}, {0x8}]}]}, 0x38}, 0x1, 0x0, 0x0, 0x20000005}, 0x24000000) sendmsg$NL802154_CMD_SET_SHORT_ADDR(r0, &(0x7f0000000480)={&(0x7f0000000380)={0x10, 0x0, 0x0, 0x8000}, 0xc, &(0x7f0000000440)={&(0x7f00000003c0)={0x44, 0x0, 0x100, 0x70bd2b, 0x25dfdbfb, {}, [@NL802154_ATTR_SHORT_ADDR={0x6}, @NL802154_ATTR_WPAN_DEV={0xc}, @NL802154_ATTR_WPAN_DEV={0xc, 0x6, 0x300000003}, @NL802154_ATTR_IFINDEX={0x8}, @NL802154_ATTR_IFINDEX={0x8}]}, 0x44}, 0x1, 0x0, 0x0, 0x400}, 0x80) openat$cgroup_netprio_ifpriomap(r1, &(0x7f00000004c0), 0x2, 0x0) r2 = openat$hwrng(0xffffffffffffff9c, &(0x7f0000000500), 0x20000, 0x0) getsockopt$inet6_mreq(r2, 0x29, 0x15, &(0x7f0000000540)={@mcast1}, &(0x7f0000000580)=0x14) getsockopt$inet6_mreq(r2, 0x29, 0x15, &(0x7f00000005c0)={@ipv4={""/10, ""/2, @initdev}}, &(0x7f0000000600)=0x14) r3 = io_uring_setup(0x5c38, &(0x7f0000000640)={0x0, 0x5b7f, 0x10, 0x2, 0x214, 0x0, r2}) io_uring_register$IORING_REGISTER_PERSONALITY(r3, 0x9, 0x0, 0x0) r4 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) sendmsg$NLBL_MGMT_C_REMOVEDEF(r4, &(0x7f0000000800)={&(0x7f00000006c0)={0x10, 0x0, 0x0, 0x4}, 0xc, &(0x7f00000007c0)={&(0x7f0000000700)={0x90, 0x0, 0x500, 0x70bd26, 0x25dfdbfe, {}, [@NLBL_MGMT_A_IPV6MASK={0x14, 0x6, @local}, @NLBL_MGMT_A_PROTOCOL={0x8, 0x2, 0x3}, @NLBL_MGMT_A_CLPDOI={0x8, 0xc, 0x2}, @NLBL_MGMT_A_IPV6ADDR={0x14, 0x5, @empty}, @NLBL_MGMT_A_IPV6MASK={0x14, 0x6, @private0={0xfc, 0x0, '\x00', 0x1}}, @NLBL_MGMT_A_IPV6MASK={0x14, 0x6, @private1}, @NLBL_MGMT_A_IPV6ADDR={0x14, 0x5, @rand_addr=' \x01\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x02'}, @NLBL_MGMT_A_FAMILY={0x6, 0xb, 0x2b}]}, 0x90}, 0x1, 0x0, 0x0, 0x80}, 0x90) sendmsg$IEEE802154_LLSEC_GETPARAMS(r4, &(0x7f0000000900)={&(0x7f0000000840)={0x10, 0x0, 0x0, 0x2000000}, 0xc, &(0x7f00000008c0)={&(0x7f0000000880)={0x28, 0x0, 0x20, 0x70bd29, 0x25dfdbfe, {}, [@IEEE802154_ATTR_DEV_INDEX={0x8}, @IEEE802154_ATTR_DEV_NAME={0xa, 0x1, 'wpan1\x00'}]}, 0x28}, 0x1, 0x0, 0x0, 0x24000001}, 0x100) ioctl$PERF_EVENT_IOC_SET_FILTER(0xffffffffffffffff, 0x40082406, &(0x7f0000000940)='/dev/hwrng\x00') ioctl$CDROM_SELECT_DISK(r1, 0x5322, 0xfff) openat$cgroup_ro(r1, &(0x7f0000000980)='hugetlb.1GB.usage_in_bytes\x00', 0x0, 0x0) ioctl$sock_SIOCGIFINDEX_802154(0xffffffffffffffff, 0x8933, &(0x7f0000000a00)={'wpan0\x00', 0x0}) ioctl$sock_SIOCGIFINDEX_802154(r4, 0x8933, &(0x7f0000000a40)={'wpan0\x00', 0x0}) sendmsg$IEEE802154_LLSEC_DEL_DEVKEY(r4, &(0x7f0000000b40)={&(0x7f00000009c0)={0x10, 0x0, 0x0, 0x200}, 0xc, &(0x7f0000000b00)={&(0x7f0000000a80)={0x58, 0x0, 0x400, 0x70bd27, 0x25dfdbfb, {}, [@IEEE802154_ATTR_LLSEC_KEY_MODE={0x5, 0x2b, 0x3}, @IEEE802154_ATTR_LLSEC_KEY_SOURCE_SHORT={0x8, 0x2c, 0xbcd4e33}, @IEEE802154_ATTR_DEV_NAME={0xa, 0x1, 'wpan0\x00'}, @IEEE802154_ATTR_DEV_INDEX={0x8, 0x2, r5}, @IEEE802154_ATTR_DEV_INDEX={0x8}, @IEEE802154_ATTR_DEV_INDEX={0x8, 0x2, r6}, @IEEE802154_ATTR_SHORT_ADDR={0x6, 0x4, 0xaaa0}, @IEEE802154_ATTR_SHORT_ADDR={0x6, 0x4, 0xfffe}]}, 0x58}, 0x1, 0x0, 0x0, 0x4080}, 0x8000) 11:49:08 executing program 2: ioctl$SCSI_IOCTL_DOORLOCK(0xffffffffffffffff, 0x5380) r0 = syz_open_dev$sg(&(0x7f0000000000), 0x9, 0x200) ioctl$SCSI_IOCTL_SYNC(r0, 0x4) ioctl$SG_GET_SG_TABLESIZE(r0, 0x227f, &(0x7f0000000040)) r1 = openat$cdrom(0xffffffffffffff9c, &(0x7f0000000080), 0x331200, 0x0) ioctl$CDROMRESET(r1, 0x5312) r2 = openat$cgroup(0xffffffffffffffff, &(0x7f00000000c0)='syz0\x00', 0x200002, 0x0) openat$cgroup_netprio_ifpriomap(r2, &(0x7f0000000100), 0x2, 0x0) ioctl$SG_GET_SG_TABLESIZE(r0, 0x227f, &(0x7f0000000140)) r3 = openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000180)='./cgroup.net/syz1\x00', 0x200002, 0x0) r4 = openat$cgroup(r2, &(0x7f00000001c0)='syz0\x00', 0x200002, 0x0) openat$cgroup_pressure(r4, &(0x7f0000000200)='memory.pressure\x00', 0x2, 0x0) ioctl$CDROMSETSPINDOWN(r1, 0x531e, &(0x7f0000000240)=0x6) ioctl$CDROMREADCOOKED(r1, 0x5315, &(0x7f0000000280)) openat$vga_arbiter(0xffffffffffffff9c, &(0x7f0000000d00), 0x200080, 0x0) r5 = openat$hwrng(0xffffffffffffff9c, &(0x7f0000000d40), 0x200000, 0x0) write$tcp_congestion(r5, &(0x7f0000000d80)='westwood\x00', 0x9) ioctl$CDROM_NEXT_WRITABLE(r5, 0x5394, &(0x7f0000000dc0)) openat$cgroup_subtree(r3, &(0x7f0000000e00), 0x2, 0x0) ioctl$CDROMVOLCTRL(0xffffffffffffffff, 0x530a, &(0x7f0000000e40)={0x7f, 0x81, 0x8}) 11:49:08 executing program 3: r0 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000000)='./binderfs2/custom0\x00', 0x0, 0x0) r1 = perf_event_open(&(0x7f00000007c0)={0x0, 0x80, 0x2, 0x4, 0x1c, 0xff, 0x0, 0xe4, 0x8, 0x7, 0x1, 0x1, 0x1, 0x1, 0x1, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x1, 0x0, 0x1, 0x1, 0x0, 0x0, 0x1, 0x0, 0x1, 0x1, 0x1, 0x1, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x1, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffff1cd, 0x1, @perf_bp={&(0x7f0000000780), 0x4}, 0x4173, 0x1, 0x2, 0x4, 0x1, 0x2, 0x7, 0x0, 0xffffff7f, 0x0, 0x68c4}, 0x0, 0x5, 0xffffffffffffffff, 0x0) r2 = openat$cgroup_type(0xffffffffffffffff, &(0x7f0000000840), 0x2, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000ac0)={0xa0, 0x0, &(0x7f0000000940)=[@increfs_done={0x40106308, 0x2}, @acquire, @dead_binder_done, @register_looper, @dead_binder_done, @increfs_done={0x40106308, 0x3}, @request_death={0x400c630e, 0x1}, @reply={0x40406301, {0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x48, 0x18, &(0x7f0000000880)={@fd={0x66642a85, 0x0, r1}, @flat=@weak_binder={0x77622a85, 0x0, 0x1}, @fd={0x66642a85, 0x0, r2}}, &(0x7f0000000900)={0x0, 0x18, 0x30}}}], 0xba, 0x0, &(0x7f0000000a00)="300c964b99b0fc8bc041eed901596dcc00c49ae50e7d50ab2181ebd3ced1dedd5b95801b47942df87fa0193d45616e7abcb521e4b3031cf0f6ce86d01e78fd249c0a368369dcbb588cf079a014940599b7b6d4397e0d176e2576874ae05c2c5cb611bc0a2d765cd1223396d58aed4be672d29a0400a0b3f8ce7a4a03028b890b0f5a8be682791ee67fd5956810a83a83ae92d2e89345cd2f5ecebe5e98f11d0642b6624d047bf7127114786a300db84bfe332fe8533489aad8be"}) r3 = mmap$IORING_OFF_CQ_RING(&(0x7f0000ffe000/0x2000)=nil, 0x2000, 0x2000001, 0x4000010, 0xffffffffffffffff, 0x8000000) r4 = mmap$IORING_OFF_SQES(&(0x7f0000ffe000/0x2000)=nil, 0x2000, 0x1000008, 0x4010, 0xffffffffffffffff, 0x10000000) r5 = io_uring_register$IORING_REGISTER_PERSONALITY(0xffffffffffffffff, 0x9, 0x0, 0x0) r6 = openat$cgroup_pressure(0xffffffffffffffff, &(0x7f0000000b00)='io.pressure\x00', 0x2, 0x0) syz_io_uring_submit(r3, r4, &(0x7f0000000b40)=@IORING_OP_TEE={0x21, 0x5, 0x0, @fd_index=0x9, 0x0, 0x0, 0x6, 0x7, 0x1, {0x0, r5, r6}}, 0x5) rt_sigaction(0x15, &(0x7f0000000c40)={&(0x7f0000000b80)="f2a6c4e2252c9eec000000666666420f3a14a9020000000dc4e279185556c4e2ed2981060000008fe9d801cbdd15ddac000066450f3a14913223333300c4e17a6f54d28dc4a261ba5682", 0x80000002, &(0x7f0000000c00)="c4c2c5ab07c4e1fd60fbc461ff2d6dcd3e0f1b1e0f0d3ec4e2e9af1c430fff57000f419f47200000c4a2f920cd450a8000000000", {[0x1]}}, &(0x7f0000000d40)={&(0x7f0000000c80)="e353c442f8f35266c401f928dff30fa7c0653e2e2e64a564410f0ffca0c481196907c401015de4dbd1c4019172e508", 0x0, &(0x7f0000000cc0)="c4e141f123c4a27bf79482a9e77544c422cd3c8204000000660fc5c881c441c173dd00c483fd01309dc462559c71472e260f4694aa0a000000c4e228f31dfeefffff140f"}, 0x8, &(0x7f0000000d80)) ioctl$CDROM_MEDIA_CHANGED(0xffffffffffffffff, 0x5325, 0x7) openat$binderfs(0xffffffffffffff9c, &(0x7f0000000dc0)='./binderfs2/binder1\x00', 0x800, 0x0) r7 = syz_io_uring_setup(0x783a, &(0x7f0000000e00)={0x0, 0xe533, 0x8, 0x3, 0x3a0}, &(0x7f0000ffc000/0x1000)=nil, &(0x7f0000ffc000/0x3000)=nil, &(0x7f0000000e80), &(0x7f0000000ec0)) mmap$IORING_OFF_SQ_RING(&(0x7f0000ffc000/0x4000)=nil, 0x4000, 0x2000000, 0x12, r7, 0x0) msgctl$IPC_RMID(0xffffffffffffffff, 0x0) semget(0x1, 0x3, 0x511) 11:49:08 executing program 5: setitimer(0x0, &(0x7f0000000000)={{}, {0x0, 0xea60}}, &(0x7f0000000040)) getitimer(0x0, &(0x7f0000000080)) r0 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$netlbl_mgmt(&(0x7f0000000100), 0xffffffffffffffff) sendmsg$NLBL_MGMT_C_ADDDEF(r0, &(0x7f00000001c0)={&(0x7f00000000c0)={0x10, 0x0, 0x0, 0x1}, 0xc, &(0x7f0000000180)={&(0x7f0000000140)={0x1c, r1, 0x4, 0x70bd2a, 0x25dfdbff, {}, [@NLBL_MGMT_A_CLPDOI={0x8}]}, 0x1c}, 0x1, 0x0, 0x0, 0x4000000}, 0x40000) geteuid() syz_usb_connect$cdc_ecm(0x4, 0x10d, &(0x7f0000000200)={{0x12, 0x1, 0x720, 0x2, 0x0, 0x0, 0x10, 0x525, 0xa4a1, 0x40, 0x1, 0x2, 0x3, 0x1, [{{0x9, 0x2, 0xfb, 0x1, 0x1, 0xba, 0x50, 0xff, [{{0x9, 0x4, 0x0, 0x7, 0x2, 0x2, 0x6, 0x0, 0x7c, {{0x8, 0x24, 0x6, 0x0, 0x0, "fbf211"}, {0x5, 0x24, 0x0, 0x8}, {0xd, 0x24, 0xf, 0x1, 0x1, 0x3f, 0x3, 0x40}, [@mdlm_detail={0x99, 0x24, 0x13, 0x3, "48c1a1b655094616df62fff6017defd0bdac4f2617618052fc22350170d4b41a1affe05826274c5d93aa871d89455559c068d877251368c5b00552322da12b5958d76e60294d79d6bd527055bb53f40402ca669ba20042da00554f68b1b12b345fc2bb35f09aac73eb5ac2fcd8634e5e7252075c0d8ce0ad3e8dda63c3c27a6db1be131aa7525a018859895d6e885540b704d1f7dc"}, @country_functional={0xc, 0x24, 0x7, 0x90, 0x6, [0x4, 0x9, 0xe77]}, @obex={0x5, 0x24, 0x15, 0x8}, @acm={0x4, 0x24, 0x2, 0xd}, @ncm={0x6, 0x24, 0x1a, 0x7, 0x26}]}, {[{{0x9, 0x5, 0x81, 0x3, 0x1df, 0x81, 0x32, 0x1}}], {{0x9, 0x5, 0x82, 0x2, 0x3ff, 0x2, 0x6, 0x5}}, {{0x9, 0x5, 0x3, 0x2, 0x8, 0x1, 0x4, 0xff}}}}}]}}]}}, &(0x7f0000000640)={0xa, &(0x7f0000000340)={0xa, 0x6, 0x110, 0x3, 0xae, 0x8, 0xff, 0x1f}, 0x5, &(0x7f0000000380)={0x5, 0xf, 0x5}, 0x7, [{0x14, &(0x7f00000003c0)=@string={0x14, 0x3, "fd058c95bdf599f8e5f073eae7235e49a442"}}, {0x4, &(0x7f0000000400)=@lang_id={0x4, 0x3, 0x380a}}, {0x4, &(0x7f0000000440)=@lang_id={0x4, 0x3, 0x445}}, {0x4, &(0x7f0000000480)=@lang_id={0x4, 0x3, 0x2c0a}}, {0x4, &(0x7f00000004c0)=@lang_id={0x4, 0x3, 0x1001}}, {0x4, &(0x7f0000000500)=@lang_id={0x4, 0x3, 0x42a}}, {0xf1, &(0x7f0000000540)=@string={0xf1, 0x3, "84d5b48356934b18c11ca618df7ef64b6c011395cc6829bdeedd71e659bc7545af1fffa2149c42cd8da15a92d7564b65a135a440b298e19eddd0415c86d7b42e1c9641793180d54dedbc008eeb526d3540368aed104e9c9220a6d3e7f635e585d6e7f55ecaab0cf2111887b6e16bfe4c3f94f53b49e421698825847fc65ef965c3007893b9e33ccdbdb39b38af85a0863c618f0d2135ee175361a7f77a56730d8ae5c677510cf17584b6302361fc90e77b8e50675a5756fd20d5f4bc211f04b21de401616a64c3d1a1398527dca0fd098e082f7533b65e1f4626cc5cbfa742eac63bb0d848f069eb64132f065192e5"}}]}) r2 = syz_genetlink_get_family_id$nl802154(&(0x7f0000000700), r0) ioctl$sock_SIOCGIFINDEX_802154(r0, 0x8933, &(0x7f0000000740)={'wpan1\x00', 0x0}) ioctl$sock_SIOCGIFINDEX_802154(r0, 0x8933, &(0x7f0000000780)={'wpan3\x00', 0x0}) sendmsg$NL802154_CMD_NEW_SEC_LEVEL(r0, &(0x7f0000000840)={&(0x7f00000006c0)={0x10, 0x0, 0x0, 0x8000000}, 0xc, &(0x7f0000000800)={&(0x7f00000007c0)={0x38, r2, 0x1, 0x70bd2a, 0x25dfdbff, {}, [@NL802154_ATTR_IFINDEX={0x8, 0x3, r3}, @NL802154_ATTR_IFINDEX={0x8, 0x3, r4}, @NL802154_ATTR_WPAN_DEV={0xc, 0x6, 0x100000001}, @NL802154_ATTR_IFINDEX={0x8}]}, 0x38}, 0x1, 0x0, 0x0, 0x1}, 0x0) ioctl$CDROMREADAUDIO(0xffffffffffffffff, 0x530e, &(0x7f00000008c0)={@lba, 0x2, 0x3b, &(0x7f0000000880)=""/59}) ioctl$CDROMREADAUDIO(0xffffffffffffffff, 0x530e, &(0x7f0000000940)={@lba=0x7, 0x1, 0x24, &(0x7f0000000900)=""/36}) sendmsg$NLBL_MGMT_C_REMOVEDEF(r0, &(0x7f0000000a40)={&(0x7f0000000980)={0x10, 0x0, 0x0, 0x20000}, 0xc, &(0x7f0000000a00)={&(0x7f00000009c0)={0x34, r1, 0x100, 0x70bd2c, 0x25dfdbfd, {}, [@NLBL_MGMT_A_IPV4MASK={0x8, 0x8, @local}, @NLBL_MGMT_A_CV4DOI={0x8, 0x4, 0xffffffffffffffff}, @NLBL_MGMT_A_IPV4MASK={0x8, 0x8, @dev={0xac, 0x14, 0x14, 0x39}}, @NLBL_MGMT_A_IPV4ADDR={0x8, 0x7, @private=0xa010102}]}, 0x34}, 0x1, 0x0, 0x0, 0x40}, 0x8011) ioctl$sock_SIOCGIFINDEX_802154(r0, 0x8933, &(0x7f0000000ac0)={'wpan1\x00', 0x0}) ioctl$sock_SIOCGIFINDEX_802154(0xffffffffffffffff, 0x8933, &(0x7f0000000b00)={'wpan1\x00', 0x0}) sendmsg$NL802154_CMD_GET_SEC_KEY(r0, &(0x7f0000000c00)={&(0x7f0000000a80)={0x10, 0x0, 0x0, 0x400000}, 0xc, &(0x7f0000000bc0)={&(0x7f0000000b40)={0x4c, r2, 0x410, 0x70bd29, 0x25dfdbff, {}, [@NL802154_ATTR_IFINDEX={0x8, 0x3, r3}, @NL802154_ATTR_IFINDEX={0x8, 0x3, r5}, @NL802154_ATTR_WPAN_DEV={0xc, 0x6, 0x300000003}, @NL802154_ATTR_IFINDEX={0x8, 0x3, r6}, @NL802154_ATTR_IFINDEX={0x8, 0x3, r3}, @NL802154_ATTR_WPAN_DEV={0xc}]}, 0x4c}, 0x1, 0x0, 0x0, 0xd4}, 0x801) r7 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) syz_genetlink_get_family_id$ieee802154(&(0x7f0000000c40), r7) sendmsg$NL802154_CMD_SET_ACKREQ_DEFAULT(0xffffffffffffffff, &(0x7f0000000d40)={&(0x7f0000000c80)={0x10, 0x0, 0x0, 0x10000}, 0xc, &(0x7f0000000d00)={&(0x7f0000000cc0)={0x20, r2, 0x800, 0x70bd29, 0x25dfdbfb, {}, [@NL802154_ATTR_WPAN_DEV={0xc, 0x6, 0x2}]}, 0x20}, 0x1, 0x0, 0x0, 0x1}, 0x8080) 11:49:08 executing program 2: ioctl$SCSI_IOCTL_DOORLOCK(0xffffffffffffffff, 0x5380) r0 = syz_open_dev$sg(&(0x7f0000000000), 0x9, 0x200) ioctl$SCSI_IOCTL_SYNC(r0, 0x4) ioctl$SG_GET_SG_TABLESIZE(r0, 0x227f, &(0x7f0000000040)) r1 = openat$cdrom(0xffffffffffffff9c, &(0x7f0000000080), 0x331200, 0x0) ioctl$CDROMRESET(r1, 0x5312) r2 = openat$cgroup(0xffffffffffffffff, &(0x7f00000000c0)='syz0\x00', 0x200002, 0x0) openat$cgroup_netprio_ifpriomap(r2, &(0x7f0000000100), 0x2, 0x0) ioctl$SG_GET_SG_TABLESIZE(r0, 0x227f, &(0x7f0000000140)) r3 = openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000180)='./cgroup.net/syz1\x00', 0x200002, 0x0) r4 = openat$cgroup(r2, &(0x7f00000001c0)='syz0\x00', 0x200002, 0x0) openat$cgroup_pressure(r4, &(0x7f0000000200)='memory.pressure\x00', 0x2, 0x0) ioctl$CDROMSETSPINDOWN(r1, 0x531e, &(0x7f0000000240)=0x6) ioctl$CDROMREADCOOKED(r1, 0x5315, &(0x7f0000000280)) openat$vga_arbiter(0xffffffffffffff9c, &(0x7f0000000d00), 0x200080, 0x0) r5 = openat$hwrng(0xffffffffffffff9c, &(0x7f0000000d40), 0x200000, 0x0) write$tcp_congestion(r5, &(0x7f0000000d80)='westwood\x00', 0x9) ioctl$CDROM_NEXT_WRITABLE(r5, 0x5394, &(0x7f0000000dc0)) openat$cgroup_subtree(r3, &(0x7f0000000e00), 0x2, 0x0) ioctl$CDROMVOLCTRL(0xffffffffffffffff, 0x530a, &(0x7f0000000e40)={0x7f, 0x81, 0x8}) 11:49:08 executing program 4: syz_extract_tcp_res$synack(&(0x7f0000000000), 0x1, 0x0) syz_extract_tcp_res$synack(&(0x7f0000000040), 0x1, 0x0) rt_sigaction(0xd, &(0x7f0000000140)={&(0x7f0000000080)="c4e3c178b5d8c4634d29c4817d518000000080c482fd346000673e0062fa660f38f571012e0ffc689bc461296480e6e3000065430f002b460febbf61d4d0d445cf", 0x1, &(0x7f0000000100)="470f0d16432996917500008fe9e001f40f1553f0c0e200c441f8ae12e00e0fff6100f346acc40379087b0000"}, &(0x7f0000000200)={&(0x7f0000000180)="3c9d6467660f3825af84dff5c36666460f2f99f9a6000044c0120967de8a50000000660f72e64c0f0f65f4aed80c0500000000660fdd700ac4e13dc6cb28", 0x0, &(0x7f00000001c0)="c463097e11000f8b0600000022f3c4e27d395c7500c443c92122088f89b09a08c4a2f923680666450f285d0cdb8d8b0000008f297c800f"}, 0x8, &(0x7f0000000240)) syz_extract_tcp_res(&(0x7f0000000280), 0x6, 0xa70) syz_extract_tcp_res$synack(&(0x7f00000002c0), 0x1, 0x0) ioctl$SCSI_IOCTL_DOORLOCK(0xffffffffffffffff, 0x5380) syz_emit_ethernet(0x1e, &(0x7f0000000300)={@broadcast, @dev={'\xaa\xaa\xaa\xaa\xaa', 0xd}, @void, {@can={0xc, {{0x3}, 0x2, 0x1, 0x0, 0x0, "6bfba1406a479fb2"}}}}, &(0x7f0000000340)={0x0, 0x0, [0x8b9, 0x6db, 0xffffffff, 0x984]}) syz_extract_tcp_res(&(0x7f0000000380), 0x1000, 0x40) r0 = epoll_create1(0x0) io_submit(0x0, 0x1, &(0x7f00000004c0)=[&(0x7f0000000480)={0x0, 0x0, 0x0, 0x6, 0x7, r0, &(0x7f00000003c0)="00b733efbc7a452b4c4974d0325c47c0cd7f228aedb7a964d6bebc8a41c698f8da99a12d83c1ee10ea1f0dafe385bbbf36aecccb67651345b4e70c690533fe0b0a36153fd3e0bc203ea66e295a109d2d881d412f4d7d7c3f5f1b42d41bd6b54432553390cacac0db10b825d9644eb2f6d85dde1b647d6159751d0b58f05f5d7ddfeb112c8647d5fa3821e9c28cefd06eb682c57b78c4dfef355dae2253a329de2a92a4c2952289570e459255c5d7b67e451e7893b2", 0xb5, 0x6, 0x0, 0x2}]) syz_emit_ethernet(0xf1, &(0x7f0000000500)={@empty, @broadcast, @void, {@llc_tr={0x11, {@llc={0xf0, 0x8e, "a7e2", "4438090c86455279887b27f5d9c7d1e053ac06be6bf50fc3e0cf9c8b7b18e76f80416f8ef3e8972b1d818e6dab216e4b279799936725c3220d6412b05e66a7a986d09d63798706c5a0209f2123b5e99cc1fc63557c5df124dd742e490d749ba501a82736674c26938bb7c8259bd9c6255105d039b36e07ce39315565bef1c3f0ae998dfa8b4feca55b701a7d908e7834a875d8a6bff23736bc379bd69d4149d619bd3e95466c31cc8fe67bf24e665b9dc826e4cb1749350dfbef9909bd11e6f924191d538bb2aeaa40199e976ce9597674a26345eb67b818e6f191bddabb90"}}}}}, &(0x7f0000000600)={0x0, 0x2, [0x6bb, 0xf50, 0xa3e, 0x5ed]}) r1 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r2 = syz_genetlink_get_family_id$nbd(&(0x7f0000000680), 0xffffffffffffffff) sendmsg$NBD_CMD_RECONFIGURE(r1, &(0x7f0000000740)={&(0x7f0000000640), 0xc, &(0x7f0000000700)={&(0x7f00000006c0)={0x20, r2, 0x500, 0x70bd29, 0x25dfdbfc, {}, [@NBD_ATTR_BLOCK_SIZE_BYTES={0xc, 0x3, 0x3f}]}, 0x20}, 0x1, 0x0, 0x0, 0x84}, 0x20000850) getgroups(0x1, &(0x7f0000000780)=[0x0]) r3 = openat$cgroup_type(0xffffffffffffffff, &(0x7f00000007c0), 0x2, 0x0) write$cgroup_type(r3, &(0x7f0000000800), 0x9) r4 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r5 = syz_genetlink_get_family_id$nl802154(&(0x7f0000000880), r1) sendmsg$NL802154_CMD_SET_TX_POWER(r4, &(0x7f0000000940)={&(0x7f0000000840)={0x10, 0x0, 0x0, 0x40}, 0xc, &(0x7f0000000900)={&(0x7f00000008c0)={0x38, r5, 0x8, 0x70bd27, 0x25dfdbfb, {}, [@NL802154_ATTR_WPAN_DEV={0xc}, @NL802154_ATTR_TX_POWER={0x8, 0xb, 0x80}, @NL802154_ATTR_WPAN_PHY={0x8, 0x1, 0x2}, @NL802154_ATTR_TX_POWER={0x8, 0xb, 0x7fff}]}, 0x38}, 0x1, 0x0, 0x0, 0x20044880}, 0x40001) 11:49:08 executing program 7: openat$vga_arbiter(0xffffffffffffff9c, &(0x7f0000000000), 0x28081, 0x0) r0 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r1 = openat$cgroup_ro(0xffffffffffffffff, &(0x7f0000000280)='hugetlb.1GB.usage_in_bytes\x00', 0x0, 0x0) sendmsg$NBD_CMD_DISCONNECT(r0, &(0x7f0000000340)={&(0x7f0000000040)={0x10, 0x0, 0x0, 0x400}, 0xc, &(0x7f0000000300)={&(0x7f00000002c0)={0x38, 0x0, 0x800, 0x70bd27, 0x25dfdbfe, {}, [@NBD_ATTR_SOCKETS={0x24, 0x7, 0x0, 0x1, [{0x8}, {0x8, 0x1, r1}, {0x8}, {0x8}]}]}, 0x38}, 0x1, 0x0, 0x0, 0x20000005}, 0x24000000) sendmsg$NL802154_CMD_SET_SHORT_ADDR(r0, &(0x7f0000000480)={&(0x7f0000000380)={0x10, 0x0, 0x0, 0x8000}, 0xc, &(0x7f0000000440)={&(0x7f00000003c0)={0x44, 0x0, 0x100, 0x70bd2b, 0x25dfdbfb, {}, [@NL802154_ATTR_SHORT_ADDR={0x6}, @NL802154_ATTR_WPAN_DEV={0xc}, @NL802154_ATTR_WPAN_DEV={0xc, 0x6, 0x300000003}, @NL802154_ATTR_IFINDEX={0x8}, @NL802154_ATTR_IFINDEX={0x8}]}, 0x44}, 0x1, 0x0, 0x0, 0x400}, 0x80) openat$cgroup_netprio_ifpriomap(r1, &(0x7f00000004c0), 0x2, 0x0) r2 = openat$hwrng(0xffffffffffffff9c, &(0x7f0000000500), 0x20000, 0x0) getsockopt$inet6_mreq(r2, 0x29, 0x15, &(0x7f0000000540)={@mcast1}, &(0x7f0000000580)=0x14) getsockopt$inet6_mreq(r2, 0x29, 0x15, &(0x7f00000005c0)={@ipv4={""/10, ""/2, @initdev}}, &(0x7f0000000600)=0x14) r3 = io_uring_setup(0x5c38, &(0x7f0000000640)={0x0, 0x5b7f, 0x10, 0x2, 0x214, 0x0, r2}) io_uring_register$IORING_REGISTER_PERSONALITY(r3, 0x9, 0x0, 0x0) r4 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) sendmsg$NLBL_MGMT_C_REMOVEDEF(r4, &(0x7f0000000800)={&(0x7f00000006c0)={0x10, 0x0, 0x0, 0x4}, 0xc, &(0x7f00000007c0)={&(0x7f0000000700)={0x90, 0x0, 0x500, 0x70bd26, 0x25dfdbfe, {}, [@NLBL_MGMT_A_IPV6MASK={0x14, 0x6, @local}, @NLBL_MGMT_A_PROTOCOL={0x8, 0x2, 0x3}, @NLBL_MGMT_A_CLPDOI={0x8, 0xc, 0x2}, @NLBL_MGMT_A_IPV6ADDR={0x14, 0x5, @empty}, @NLBL_MGMT_A_IPV6MASK={0x14, 0x6, @private0={0xfc, 0x0, '\x00', 0x1}}, @NLBL_MGMT_A_IPV6MASK={0x14, 0x6, @private1}, @NLBL_MGMT_A_IPV6ADDR={0x14, 0x5, @rand_addr=' \x01\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x02'}, @NLBL_MGMT_A_FAMILY={0x6, 0xb, 0x2b}]}, 0x90}, 0x1, 0x0, 0x0, 0x80}, 0x90) sendmsg$IEEE802154_LLSEC_GETPARAMS(r4, &(0x7f0000000900)={&(0x7f0000000840)={0x10, 0x0, 0x0, 0x2000000}, 0xc, &(0x7f00000008c0)={&(0x7f0000000880)={0x28, 0x0, 0x20, 0x70bd29, 0x25dfdbfe, {}, [@IEEE802154_ATTR_DEV_INDEX={0x8}, @IEEE802154_ATTR_DEV_NAME={0xa, 0x1, 'wpan1\x00'}]}, 0x28}, 0x1, 0x0, 0x0, 0x24000001}, 0x100) ioctl$PERF_EVENT_IOC_SET_FILTER(0xffffffffffffffff, 0x40082406, &(0x7f0000000940)='/dev/hwrng\x00') ioctl$CDROM_SELECT_DISK(r1, 0x5322, 0xfff) openat$cgroup_ro(r1, &(0x7f0000000980)='hugetlb.1GB.usage_in_bytes\x00', 0x0, 0x0) ioctl$sock_SIOCGIFINDEX_802154(0xffffffffffffffff, 0x8933, &(0x7f0000000a00)={'wpan0\x00', 0x0}) ioctl$sock_SIOCGIFINDEX_802154(r4, 0x8933, &(0x7f0000000a40)={'wpan0\x00', 0x0}) sendmsg$IEEE802154_LLSEC_DEL_DEVKEY(r4, &(0x7f0000000b40)={&(0x7f00000009c0)={0x10, 0x0, 0x0, 0x200}, 0xc, &(0x7f0000000b00)={&(0x7f0000000a80)={0x58, 0x0, 0x400, 0x70bd27, 0x25dfdbfb, {}, [@IEEE802154_ATTR_LLSEC_KEY_MODE={0x5, 0x2b, 0x3}, @IEEE802154_ATTR_LLSEC_KEY_SOURCE_SHORT={0x8, 0x2c, 0xbcd4e33}, @IEEE802154_ATTR_DEV_NAME={0xa, 0x1, 'wpan0\x00'}, @IEEE802154_ATTR_DEV_INDEX={0x8, 0x2, r5}, @IEEE802154_ATTR_DEV_INDEX={0x8}, @IEEE802154_ATTR_DEV_INDEX={0x8, 0x2, r6}, @IEEE802154_ATTR_SHORT_ADDR={0x6, 0x4, 0xaaa0}, @IEEE802154_ATTR_SHORT_ADDR={0x6, 0x4, 0xfffe}]}, 0x58}, 0x1, 0x0, 0x0, 0x4080}, 0x8000) 11:49:08 executing program 5: setitimer(0x0, &(0x7f0000000000)={{}, {0x0, 0xea60}}, &(0x7f0000000040)) getitimer(0x0, &(0x7f0000000080)) r0 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$netlbl_mgmt(&(0x7f0000000100), 0xffffffffffffffff) sendmsg$NLBL_MGMT_C_ADDDEF(r0, &(0x7f00000001c0)={&(0x7f00000000c0)={0x10, 0x0, 0x0, 0x1}, 0xc, &(0x7f0000000180)={&(0x7f0000000140)={0x1c, r1, 0x4, 0x70bd2a, 0x25dfdbff, {}, [@NLBL_MGMT_A_CLPDOI={0x8}]}, 0x1c}, 0x1, 0x0, 0x0, 0x4000000}, 0x40000) geteuid() syz_usb_connect$cdc_ecm(0x4, 0x10d, &(0x7f0000000200)={{0x12, 0x1, 0x720, 0x2, 0x0, 0x0, 0x10, 0x525, 0xa4a1, 0x40, 0x1, 0x2, 0x3, 0x1, [{{0x9, 0x2, 0xfb, 0x1, 0x1, 0xba, 0x50, 0xff, [{{0x9, 0x4, 0x0, 0x7, 0x2, 0x2, 0x6, 0x0, 0x7c, {{0x8, 0x24, 0x6, 0x0, 0x0, "fbf211"}, {0x5, 0x24, 0x0, 0x8}, {0xd, 0x24, 0xf, 0x1, 0x1, 0x3f, 0x3, 0x40}, [@mdlm_detail={0x99, 0x24, 0x13, 0x3, "48c1a1b655094616df62fff6017defd0bdac4f2617618052fc22350170d4b41a1affe05826274c5d93aa871d89455559c068d877251368c5b00552322da12b5958d76e60294d79d6bd527055bb53f40402ca669ba20042da00554f68b1b12b345fc2bb35f09aac73eb5ac2fcd8634e5e7252075c0d8ce0ad3e8dda63c3c27a6db1be131aa7525a018859895d6e885540b704d1f7dc"}, @country_functional={0xc, 0x24, 0x7, 0x90, 0x6, [0x4, 0x9, 0xe77]}, @obex={0x5, 0x24, 0x15, 0x8}, @acm={0x4, 0x24, 0x2, 0xd}, @ncm={0x6, 0x24, 0x1a, 0x7, 0x26}]}, {[{{0x9, 0x5, 0x81, 0x3, 0x1df, 0x81, 0x32, 0x1}}], {{0x9, 0x5, 0x82, 0x2, 0x3ff, 0x2, 0x6, 0x5}}, {{0x9, 0x5, 0x3, 0x2, 0x8, 0x1, 0x4, 0xff}}}}}]}}]}}, &(0x7f0000000640)={0xa, &(0x7f0000000340)={0xa, 0x6, 0x110, 0x3, 0xae, 0x8, 0xff, 0x1f}, 0x5, &(0x7f0000000380)={0x5, 0xf, 0x5}, 0x7, [{0x14, &(0x7f00000003c0)=@string={0x14, 0x3, "fd058c95bdf599f8e5f073eae7235e49a442"}}, {0x4, &(0x7f0000000400)=@lang_id={0x4, 0x3, 0x380a}}, {0x4, &(0x7f0000000440)=@lang_id={0x4, 0x3, 0x445}}, {0x4, &(0x7f0000000480)=@lang_id={0x4, 0x3, 0x2c0a}}, {0x4, &(0x7f00000004c0)=@lang_id={0x4, 0x3, 0x1001}}, {0x4, &(0x7f0000000500)=@lang_id={0x4, 0x3, 0x42a}}, {0xf1, &(0x7f0000000540)=@string={0xf1, 0x3, "84d5b48356934b18c11ca618df7ef64b6c011395cc6829bdeedd71e659bc7545af1fffa2149c42cd8da15a92d7564b65a135a440b298e19eddd0415c86d7b42e1c9641793180d54dedbc008eeb526d3540368aed104e9c9220a6d3e7f635e585d6e7f55ecaab0cf2111887b6e16bfe4c3f94f53b49e421698825847fc65ef965c3007893b9e33ccdbdb39b38af85a0863c618f0d2135ee175361a7f77a56730d8ae5c677510cf17584b6302361fc90e77b8e50675a5756fd20d5f4bc211f04b21de401616a64c3d1a1398527dca0fd098e082f7533b65e1f4626cc5cbfa742eac63bb0d848f069eb64132f065192e5"}}]}) r2 = syz_genetlink_get_family_id$nl802154(&(0x7f0000000700), r0) ioctl$sock_SIOCGIFINDEX_802154(r0, 0x8933, &(0x7f0000000740)={'wpan1\x00', 0x0}) ioctl$sock_SIOCGIFINDEX_802154(r0, 0x8933, &(0x7f0000000780)={'wpan3\x00', 0x0}) sendmsg$NL802154_CMD_NEW_SEC_LEVEL(r0, &(0x7f0000000840)={&(0x7f00000006c0)={0x10, 0x0, 0x0, 0x8000000}, 0xc, &(0x7f0000000800)={&(0x7f00000007c0)={0x38, r2, 0x1, 0x70bd2a, 0x25dfdbff, {}, [@NL802154_ATTR_IFINDEX={0x8, 0x3, r3}, @NL802154_ATTR_IFINDEX={0x8, 0x3, r4}, @NL802154_ATTR_WPAN_DEV={0xc, 0x6, 0x100000001}, @NL802154_ATTR_IFINDEX={0x8}]}, 0x38}, 0x1, 0x0, 0x0, 0x1}, 0x0) ioctl$CDROMREADAUDIO(0xffffffffffffffff, 0x530e, &(0x7f00000008c0)={@lba, 0x2, 0x3b, &(0x7f0000000880)=""/59}) ioctl$CDROMREADAUDIO(0xffffffffffffffff, 0x530e, &(0x7f0000000940)={@lba=0x7, 0x1, 0x24, &(0x7f0000000900)=""/36}) sendmsg$NLBL_MGMT_C_REMOVEDEF(r0, &(0x7f0000000a40)={&(0x7f0000000980)={0x10, 0x0, 0x0, 0x20000}, 0xc, &(0x7f0000000a00)={&(0x7f00000009c0)={0x34, r1, 0x100, 0x70bd2c, 0x25dfdbfd, {}, [@NLBL_MGMT_A_IPV4MASK={0x8, 0x8, @local}, @NLBL_MGMT_A_CV4DOI={0x8, 0x4, 0xffffffffffffffff}, @NLBL_MGMT_A_IPV4MASK={0x8, 0x8, @dev={0xac, 0x14, 0x14, 0x39}}, @NLBL_MGMT_A_IPV4ADDR={0x8, 0x7, @private=0xa010102}]}, 0x34}, 0x1, 0x0, 0x0, 0x40}, 0x8011) ioctl$sock_SIOCGIFINDEX_802154(r0, 0x8933, &(0x7f0000000ac0)={'wpan1\x00', 0x0}) ioctl$sock_SIOCGIFINDEX_802154(0xffffffffffffffff, 0x8933, &(0x7f0000000b00)={'wpan1\x00', 0x0}) sendmsg$NL802154_CMD_GET_SEC_KEY(r0, &(0x7f0000000c00)={&(0x7f0000000a80)={0x10, 0x0, 0x0, 0x400000}, 0xc, &(0x7f0000000bc0)={&(0x7f0000000b40)={0x4c, r2, 0x410, 0x70bd29, 0x25dfdbff, {}, [@NL802154_ATTR_IFINDEX={0x8, 0x3, r3}, @NL802154_ATTR_IFINDEX={0x8, 0x3, r5}, @NL802154_ATTR_WPAN_DEV={0xc, 0x6, 0x300000003}, @NL802154_ATTR_IFINDEX={0x8, 0x3, r6}, @NL802154_ATTR_IFINDEX={0x8, 0x3, r3}, @NL802154_ATTR_WPAN_DEV={0xc}]}, 0x4c}, 0x1, 0x0, 0x0, 0xd4}, 0x801) r7 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) syz_genetlink_get_family_id$ieee802154(&(0x7f0000000c40), r7) sendmsg$NL802154_CMD_SET_ACKREQ_DEFAULT(0xffffffffffffffff, &(0x7f0000000d40)={&(0x7f0000000c80)={0x10, 0x0, 0x0, 0x10000}, 0xc, &(0x7f0000000d00)={&(0x7f0000000cc0)={0x20, r2, 0x800, 0x70bd29, 0x25dfdbfb, {}, [@NL802154_ATTR_WPAN_DEV={0xc, 0x6, 0x2}]}, 0x20}, 0x1, 0x0, 0x0, 0x1}, 0x8080) 11:49:08 executing program 3: r0 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000000)='./binderfs2/custom0\x00', 0x0, 0x0) r1 = perf_event_open(&(0x7f00000007c0)={0x0, 0x80, 0x2, 0x4, 0x1c, 0xff, 0x0, 0xe4, 0x8, 0x7, 0x1, 0x1, 0x1, 0x1, 0x1, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x1, 0x0, 0x1, 0x1, 0x0, 0x0, 0x1, 0x0, 0x1, 0x1, 0x1, 0x1, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x1, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffff1cd, 0x1, @perf_bp={&(0x7f0000000780), 0x4}, 0x4173, 0x1, 0x2, 0x4, 0x1, 0x2, 0x7, 0x0, 0xffffff7f, 0x0, 0x68c4}, 0x0, 0x5, 0xffffffffffffffff, 0x0) r2 = openat$cgroup_type(0xffffffffffffffff, &(0x7f0000000840), 0x2, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000ac0)={0xa0, 0x0, &(0x7f0000000940)=[@increfs_done={0x40106308, 0x2}, @acquire, @dead_binder_done, @register_looper, @dead_binder_done, @increfs_done={0x40106308, 0x3}, @request_death={0x400c630e, 0x1}, @reply={0x40406301, {0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x48, 0x18, &(0x7f0000000880)={@fd={0x66642a85, 0x0, r1}, @flat=@weak_binder={0x77622a85, 0x0, 0x1}, @fd={0x66642a85, 0x0, r2}}, &(0x7f0000000900)={0x0, 0x18, 0x30}}}], 0xba, 0x0, &(0x7f0000000a00)="300c964b99b0fc8bc041eed901596dcc00c49ae50e7d50ab2181ebd3ced1dedd5b95801b47942df87fa0193d45616e7abcb521e4b3031cf0f6ce86d01e78fd249c0a368369dcbb588cf079a014940599b7b6d4397e0d176e2576874ae05c2c5cb611bc0a2d765cd1223396d58aed4be672d29a0400a0b3f8ce7a4a03028b890b0f5a8be682791ee67fd5956810a83a83ae92d2e89345cd2f5ecebe5e98f11d0642b6624d047bf7127114786a300db84bfe332fe8533489aad8be"}) r3 = mmap$IORING_OFF_CQ_RING(&(0x7f0000ffe000/0x2000)=nil, 0x2000, 0x2000001, 0x4000010, 0xffffffffffffffff, 0x8000000) r4 = mmap$IORING_OFF_SQES(&(0x7f0000ffe000/0x2000)=nil, 0x2000, 0x1000008, 0x4010, 0xffffffffffffffff, 0x10000000) r5 = io_uring_register$IORING_REGISTER_PERSONALITY(0xffffffffffffffff, 0x9, 0x0, 0x0) r6 = openat$cgroup_pressure(0xffffffffffffffff, &(0x7f0000000b00)='io.pressure\x00', 0x2, 0x0) syz_io_uring_submit(r3, r4, &(0x7f0000000b40)=@IORING_OP_TEE={0x21, 0x5, 0x0, @fd_index=0x9, 0x0, 0x0, 0x6, 0x7, 0x1, {0x0, r5, r6}}, 0x5) rt_sigaction(0x15, &(0x7f0000000c40)={&(0x7f0000000b80)="f2a6c4e2252c9eec000000666666420f3a14a9020000000dc4e279185556c4e2ed2981060000008fe9d801cbdd15ddac000066450f3a14913223333300c4e17a6f54d28dc4a261ba5682", 0x80000002, &(0x7f0000000c00)="c4c2c5ab07c4e1fd60fbc461ff2d6dcd3e0f1b1e0f0d3ec4e2e9af1c430fff57000f419f47200000c4a2f920cd450a8000000000", {[0x1]}}, &(0x7f0000000d40)={&(0x7f0000000c80)="e353c442f8f35266c401f928dff30fa7c0653e2e2e64a564410f0ffca0c481196907c401015de4dbd1c4019172e508", 0x0, &(0x7f0000000cc0)="c4e141f123c4a27bf79482a9e77544c422cd3c8204000000660fc5c881c441c173dd00c483fd01309dc462559c71472e260f4694aa0a000000c4e228f31dfeefffff140f"}, 0x8, &(0x7f0000000d80)) ioctl$CDROM_MEDIA_CHANGED(0xffffffffffffffff, 0x5325, 0x7) openat$binderfs(0xffffffffffffff9c, &(0x7f0000000dc0)='./binderfs2/binder1\x00', 0x800, 0x0) r7 = syz_io_uring_setup(0x783a, &(0x7f0000000e00)={0x0, 0xe533, 0x8, 0x3, 0x3a0}, &(0x7f0000ffc000/0x1000)=nil, &(0x7f0000ffc000/0x3000)=nil, &(0x7f0000000e80), &(0x7f0000000ec0)) mmap$IORING_OFF_SQ_RING(&(0x7f0000ffc000/0x4000)=nil, 0x4000, 0x2000000, 0x12, r7, 0x0) semget(0x1, 0x3, 0x511) [ 105.689402] [ 105.689579] ===================================== [ 105.689975] WARNING: bad unlock balance detected! [ 105.690356] 6.19.0-rc5-next-20260113 #1 Not tainted [ 105.690745] ------------------------------------- [ 105.691120] syz-executor.2/4021 is trying to release lock (rcu_read_lock) at: [ 105.691687] [] __wait_on_freeing_inode+0x105/0x350 [ 105.692209] but there are no more locks to release! [ 105.693182] [ 105.693182] other info that might help us debug this: [ 105.694237] 4 locks held by syz-executor.2/4021: [ 105.695109] #0: ffff88800fdc83f8 (sb_writers#3){.+.+}-{0:0}, at: filename_create+0xf7/0x400 [ 105.696510] #1: ffff88801b166330 (&type->i_mutex_dir_key#3/1){+.+.}-{4:4}, at: filename_create+0x1b1/0x400 [ 105.697949] #2: ffff88800fdcc950 (jbd2_handle){++++}-{0:0}, at: start_this_handle+0xe32/0x12d0 [ 105.699277] #3: ffffffff85c16898 (inode_hash_lock){+.+.}-{3:3}, at: insert_inode_locked+0xf9/0x890 [ 105.701104] [ 105.701104] stack backtrace: [ 105.701893] CPU: 0 UID: 0 PID: 4021 Comm: syz-executor.2 Not tainted 6.19.0-rc5-next-20260113 #1 PREEMPT(lazy) [ 105.701908] Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.12.0-1 04/01/2014 [ 105.701915] Call Trace: [ 105.701919] [ 105.701924] dump_stack_lvl+0xca/0x120 [ 105.701955] ? __wait_on_freeing_inode+0x105/0x350 [ 105.701969] print_unlock_imbalance_bug+0x118/0x130 [ 105.701985] ? __wait_on_freeing_inode+0x105/0x350 [ 105.702000] lock_release+0x1ee/0x270 [ 105.702015] __wait_on_freeing_inode+0x10a/0x350 [ 105.702030] ? __pfx___wait_on_freeing_inode+0x10/0x10 [ 105.702046] ? __pfx_var_wake_function+0x10/0x10 [ 105.702064] ? lock_is_held_type+0x9e/0x120 [ 105.702076] insert_inode_locked+0x25f/0x890 [ 105.702094] __ext4_new_inode+0x223d/0x4cd0 [ 105.702112] ? __pfx___ext4_new_inode+0x10/0x10 [ 105.702126] ? __pfx___dquot_initialize+0x10/0x10 [ 105.702146] ? __pfx_avc_has_perm+0x10/0x10 [ 105.702163] ext4_symlink+0x406/0xb40 [ 105.702183] ? __pfx_ext4_symlink+0x10/0x10 [ 105.702199] ? security_inode_permission+0x72/0xe0 [ 105.702212] vfs_symlink+0x44b/0x840 [ 105.702229] do_symlinkat+0x153/0x440 [ 105.702243] ? __pfx_do_symlinkat+0x10/0x10 [ 105.702257] ? strncpy_from_user+0x21b/0x2f0 [ 105.702275] __x64_sys_symlink+0x79/0xa0 [ 105.702289] do_syscall_64+0xbf/0x420 [ 105.702302] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 105.702315] RIP: 0033:0x7ff6f1ba5427 [ 105.702324] Code: 73 01 c3 48 c7 c1 bc ff ff ff f7 d8 64 89 01 48 83 c8 ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 b8 58 00 00 00 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 bc ff ff ff f7 d8 64 89 01 48 [ 105.702335] RSP: 002b:00007fff9b3e1b78 EFLAGS: 00000202 ORIG_RAX: 0000000000000058 [ 105.702346] RAX: ffffffffffffffda RBX: 0000000000000000 RCX: 00007ff6f1ba5427 [ 105.702353] RDX: ffffffffffffffbc RSI: 00007ff6f1c0000e RDI: 00007ff6f1bff1dd [ 105.702361] RBP: 0000000000000000 R08: 0000000000000000 R09: 00007fff9b3e15f0 [ 105.702367] R10: 0000000000000000 R11: 0000000000000202 R12: 0000000000000001 [ 105.702374] R13: 0000000000000000 R14: 0000000000000001 R15: 00007fff9b3e1c40 [ 105.702384] [ 105.719121] ------------[ cut here ]------------ [ 105.719502] WARNING: kernel/rcu/tree_plugin.h:443 at __rcu_read_unlock+0x25f/0x5c0, CPU#0: syz-executor.2/4021 [ 105.733526] Modules linked in: [ 105.733902] CPU: 0 UID: 0 PID: 4021 Comm: syz-executor.2 Not tainted 6.19.0-rc5-next-20260113 #1 PREEMPT(lazy) [ 105.748519] Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.12.0-1 04/01/2014 [ 105.763822] RIP: 0010:__rcu_read_unlock+0x25f/0x5c0 [ 105.764293] Code: f2 02 00 00 c7 43 58 01 00 00 00 bf 09 00 00 00 e8 a6 bb de ff 4d 85 f6 0f 84 73 fe ff ff e8 38 89 20 00 fb e9 68 fe ff ff 90 <0f> 0b 90 5b 5d 41 5c 41 5d 41 5e e9 61 f9 73 03 e8 0c 88 56 00 e9 [ 105.780960] RSP: 0018:ffff8880422e79a0 EFLAGS: 00010286 [ 105.781397] RAX: 00000000ffffffff RBX: ffff88800fcdd280 RCX: ffffffff815664c7 [ 105.795846] RDX: 0000000000000000 RSI: ffffffff815664d0 RDI: ffff88800fcdd67c [ 105.796416] RBP: ffff88800fcdd280 R08: 0000000000000000 R09: fffffbfff0ba6ff4 [ 105.810850] R10: 0000000000000000 R11: 0000000000000001 R12: ffff88800fcdd280 [ 105.811417] R13: 0000000000000001 R14: ffffffff85c0d470 R15: ffff88801b3c3c48 [ 105.814802] FS: 0000555560b81400(0000) GS:ffff8880e5342000(0000) knlGS:0000000000000000 [ 105.815443] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 105.815981] CR2: 00007fff9b3e0f88 CR3: 0000000042be4000 CR4: 0000000000350ef0 [ 105.816551] Call Trace: [ 105.816829] [ 105.817442] __wait_on_freeing_inode+0x10f/0x350 [ 105.818131] ? __pfx___wait_on_freeing_inode+0x10/0x10 [ 105.819163] ? __pfx_var_wake_function+0x10/0x10 [ 105.820341] ? lock_is_held_type+0x9e/0x120 [ 105.821380] insert_inode_locked+0x25f/0x890 [ 105.822937] __ext4_new_inode+0x223d/0x4cd0 [ 105.825249] ? __pfx___ext4_new_inode+0x10/0x10 [ 105.826418] ? __pfx___dquot_initialize+0x10/0x10 [ 105.827171] ? __pfx_avc_has_perm+0x10/0x10 [ 105.828861] ext4_symlink+0x406/0xb40 [ 105.830969] ? __pfx_ext4_symlink+0x10/0x10 [ 105.831942] ? security_inode_permission+0x72/0xe0 [ 105.833457] vfs_symlink+0x44b/0x840 [ 105.834710] do_symlinkat+0x153/0x440 [ 105.835749] ? __pfx_do_symlinkat+0x10/0x10 [ 105.836412] ? strncpy_from_user+0x21b/0x2f0 [ 105.838178] __x64_sys_symlink+0x79/0xa0 [ 105.838900] do_syscall_64+0xbf/0x420 [ 105.839687] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 105.840187] RIP: 0033:0x7ff6f1ba5427 [ 105.840547] Code: 73 01 c3 48 c7 c1 bc ff ff ff f7 d8 64 89 01 48 83 c8 ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 b8 58 00 00 00 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 bc ff ff ff f7 d8 64 89 01 48 [ 105.842037] RSP: 002b:00007fff9b3e1b78 EFLAGS: 00000202 ORIG_RAX: 0000000000000058 [ 105.842687] RAX: ffffffffffffffda RBX: 0000000000000000 RCX: 00007ff6f1ba5427 [ 105.843258] RDX: ffffffffffffffbc RSI: 00007ff6f1c0000e RDI: 00007ff6f1bff1dd [ 105.843864] RBP: 0000000000000000 R08: 0000000000000000 R09: 00007fff9b3e15f0 [ 105.844436] R10: 0000000000000000 R11: 0000000000000202 R12: 0000000000000001 [ 105.845042] R13: 0000000000000000 R14: 0000000000000001 R15: 00007fff9b3e1c40 [ 105.847496] [ 105.847738] irq event stamp: 1109 [ 105.848018] hardirqs last enabled at (1109): [] _raw_spin_unlock_irqrestore+0x2c/0x50 [ 105.849692] hardirqs last disabled at (1108): [] _raw_spin_lock_irqsave+0x53/0x60 [ 105.850485] softirqs last enabled at (1104): [] kernel_fpu_end+0x59/0x70 [ 105.860227] softirqs last disabled at (1102): [] kernel_fpu_begin_mask+0x1bb/0x300 [ 105.861069] ---[ end trace 0000000000000000 ]--- 11:49:08 executing program 4: syz_extract_tcp_res$synack(&(0x7f0000000000), 0x1, 0x0) syz_extract_tcp_res$synack(&(0x7f0000000040), 0x1, 0x0) rt_sigaction(0xd, &(0x7f0000000140)={&(0x7f0000000080)="c4e3c178b5d8c4634d29c4817d518000000080c482fd346000673e0062fa660f38f571012e0ffc689bc461296480e6e3000065430f002b460febbf61d4d0d445cf", 0x1, &(0x7f0000000100)="470f0d16432996917500008fe9e001f40f1553f0c0e200c441f8ae12e00e0fff6100f346acc40379087b0000"}, &(0x7f0000000200)={&(0x7f0000000180)="3c9d6467660f3825af84dff5c36666460f2f99f9a6000044c0120967de8a50000000660f72e64c0f0f65f4aed80c0500000000660fdd700ac4e13dc6cb28", 0x0, &(0x7f00000001c0)="c463097e11000f8b0600000022f3c4e27d395c7500c443c92122088f89b09a08c4a2f923680666450f285d0cdb8d8b0000008f297c800f"}, 0x8, &(0x7f0000000240)) syz_extract_tcp_res(&(0x7f0000000280), 0x6, 0xa70) syz_extract_tcp_res$synack(&(0x7f00000002c0), 0x1, 0x0) ioctl$SCSI_IOCTL_DOORLOCK(0xffffffffffffffff, 0x5380) syz_emit_ethernet(0x1e, &(0x7f0000000300)={@broadcast, @dev={'\xaa\xaa\xaa\xaa\xaa', 0xd}, @void, {@can={0xc, {{0x3}, 0x2, 0x1, 0x0, 0x0, "6bfba1406a479fb2"}}}}, &(0x7f0000000340)={0x0, 0x0, [0x8b9, 0x6db, 0xffffffff, 0x984]}) syz_extract_tcp_res(&(0x7f0000000380), 0x1000, 0x40) r0 = epoll_create1(0x0) io_submit(0x0, 0x1, &(0x7f00000004c0)=[&(0x7f0000000480)={0x0, 0x0, 0x0, 0x6, 0x7, r0, &(0x7f00000003c0)="00b733efbc7a452b4c4974d0325c47c0cd7f228aedb7a964d6bebc8a41c698f8da99a12d83c1ee10ea1f0dafe385bbbf36aecccb67651345b4e70c690533fe0b0a36153fd3e0bc203ea66e295a109d2d881d412f4d7d7c3f5f1b42d41bd6b54432553390cacac0db10b825d9644eb2f6d85dde1b647d6159751d0b58f05f5d7ddfeb112c8647d5fa3821e9c28cefd06eb682c57b78c4dfef355dae2253a329de2a92a4c2952289570e459255c5d7b67e451e7893b2", 0xb5, 0x6, 0x0, 0x2}]) syz_emit_ethernet(0xf1, &(0x7f0000000500)={@empty, @broadcast, @void, {@llc_tr={0x11, {@llc={0xf0, 0x8e, "a7e2", "4438090c86455279887b27f5d9c7d1e053ac06be6bf50fc3e0cf9c8b7b18e76f80416f8ef3e8972b1d818e6dab216e4b279799936725c3220d6412b05e66a7a986d09d63798706c5a0209f2123b5e99cc1fc63557c5df124dd742e490d749ba501a82736674c26938bb7c8259bd9c6255105d039b36e07ce39315565bef1c3f0ae998dfa8b4feca55b701a7d908e7834a875d8a6bff23736bc379bd69d4149d619bd3e95466c31cc8fe67bf24e665b9dc826e4cb1749350dfbef9909bd11e6f924191d538bb2aeaa40199e976ce9597674a26345eb67b818e6f191bddabb90"}}}}}, &(0x7f0000000600)={0x0, 0x2, [0x6bb, 0xf50, 0xa3e, 0x5ed]}) r1 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r2 = syz_genetlink_get_family_id$nbd(&(0x7f0000000680), 0xffffffffffffffff) sendmsg$NBD_CMD_RECONFIGURE(r1, &(0x7f0000000740)={&(0x7f0000000640), 0xc, &(0x7f0000000700)={&(0x7f00000006c0)={0x20, r2, 0x500, 0x70bd29, 0x25dfdbfc, {}, [@NBD_ATTR_BLOCK_SIZE_BYTES={0xc, 0x3, 0x3f}]}, 0x20}, 0x1, 0x0, 0x0, 0x84}, 0x20000850) getgroups(0x1, &(0x7f0000000780)=[0x0]) r3 = openat$cgroup_type(0xffffffffffffffff, &(0x7f00000007c0), 0x2, 0x0) write$cgroup_type(r3, &(0x7f0000000800), 0x9) r4 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r5 = syz_genetlink_get_family_id$nl802154(&(0x7f0000000880), r1) sendmsg$NL802154_CMD_SET_TX_POWER(r4, &(0x7f0000000940)={&(0x7f0000000840)={0x10, 0x0, 0x0, 0x40}, 0xc, &(0x7f0000000900)={&(0x7f00000008c0)={0x38, r5, 0x8, 0x70bd27, 0x25dfdbfb, {}, [@NL802154_ATTR_WPAN_DEV={0xc}, @NL802154_ATTR_TX_POWER={0x8, 0xb, 0x80}, @NL802154_ATTR_WPAN_PHY={0x8, 0x1, 0x2}, @NL802154_ATTR_TX_POWER={0x8, 0xb, 0x7fff}]}, 0x38}, 0x1, 0x0, 0x0, 0x20044880}, 0x40001) 11:49:16 executing program 4: syz_extract_tcp_res$synack(&(0x7f0000000000), 0x1, 0x0) syz_extract_tcp_res$synack(&(0x7f0000000040), 0x1, 0x0) rt_sigaction(0xd, &(0x7f0000000140)={&(0x7f0000000080)="c4e3c178b5d8c4634d29c4817d518000000080c482fd346000673e0062fa660f38f571012e0ffc689bc461296480e6e3000065430f002b460febbf61d4d0d445cf", 0x1, &(0x7f0000000100)="470f0d16432996917500008fe9e001f40f1553f0c0e200c441f8ae12e00e0fff6100f346acc40379087b0000"}, &(0x7f0000000200)={&(0x7f0000000180)="3c9d6467660f3825af84dff5c36666460f2f99f9a6000044c0120967de8a50000000660f72e64c0f0f65f4aed80c0500000000660fdd700ac4e13dc6cb28", 0x0, &(0x7f00000001c0)="c463097e11000f8b0600000022f3c4e27d395c7500c443c92122088f89b09a08c4a2f923680666450f285d0cdb8d8b0000008f297c800f"}, 0x8, &(0x7f0000000240)) syz_extract_tcp_res(&(0x7f0000000280), 0x6, 0xa70) syz_extract_tcp_res$synack(&(0x7f00000002c0), 0x1, 0x0) ioctl$SCSI_IOCTL_DOORLOCK(0xffffffffffffffff, 0x5380) syz_emit_ethernet(0x1e, &(0x7f0000000300)={@broadcast, @dev={'\xaa\xaa\xaa\xaa\xaa', 0xd}, @void, {@can={0xc, {{0x3}, 0x2, 0x1, 0x0, 0x0, "6bfba1406a479fb2"}}}}, &(0x7f0000000340)={0x0, 0x0, [0x8b9, 0x6db, 0xffffffff, 0x984]}) syz_extract_tcp_res(&(0x7f0000000380), 0x1000, 0x40) r0 = epoll_create1(0x0) io_submit(0x0, 0x1, &(0x7f00000004c0)=[&(0x7f0000000480)={0x0, 0x0, 0x0, 0x6, 0x7, r0, &(0x7f00000003c0)="00b733efbc7a452b4c4974d0325c47c0cd7f228aedb7a964d6bebc8a41c698f8da99a12d83c1ee10ea1f0dafe385bbbf36aecccb67651345b4e70c690533fe0b0a36153fd3e0bc203ea66e295a109d2d881d412f4d7d7c3f5f1b42d41bd6b54432553390cacac0db10b825d9644eb2f6d85dde1b647d6159751d0b58f05f5d7ddfeb112c8647d5fa3821e9c28cefd06eb682c57b78c4dfef355dae2253a329de2a92a4c2952289570e459255c5d7b67e451e7893b2", 0xb5, 0x6, 0x0, 0x2}]) syz_emit_ethernet(0xf1, &(0x7f0000000500)={@empty, @broadcast, @void, {@llc_tr={0x11, {@llc={0xf0, 0x8e, "a7e2", "4438090c86455279887b27f5d9c7d1e053ac06be6bf50fc3e0cf9c8b7b18e76f80416f8ef3e8972b1d818e6dab216e4b279799936725c3220d6412b05e66a7a986d09d63798706c5a0209f2123b5e99cc1fc63557c5df124dd742e490d749ba501a82736674c26938bb7c8259bd9c6255105d039b36e07ce39315565bef1c3f0ae998dfa8b4feca55b701a7d908e7834a875d8a6bff23736bc379bd69d4149d619bd3e95466c31cc8fe67bf24e665b9dc826e4cb1749350dfbef9909bd11e6f924191d538bb2aeaa40199e976ce9597674a26345eb67b818e6f191bddabb90"}}}}}, &(0x7f0000000600)={0x0, 0x2, [0x6bb, 0xf50, 0xa3e, 0x5ed]}) r1 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r2 = syz_genetlink_get_family_id$nbd(&(0x7f0000000680), 0xffffffffffffffff) sendmsg$NBD_CMD_RECONFIGURE(r1, &(0x7f0000000740)={&(0x7f0000000640), 0xc, &(0x7f0000000700)={&(0x7f00000006c0)={0x20, r2, 0x500, 0x70bd29, 0x25dfdbfc, {}, [@NBD_ATTR_BLOCK_SIZE_BYTES={0xc, 0x3, 0x3f}]}, 0x20}, 0x1, 0x0, 0x0, 0x84}, 0x20000850) getgroups(0x1, &(0x7f0000000780)=[0x0]) r3 = openat$cgroup_type(0xffffffffffffffff, &(0x7f00000007c0), 0x2, 0x0) write$cgroup_type(r3, &(0x7f0000000800), 0x9) syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) syz_genetlink_get_family_id$nl802154(&(0x7f0000000880), r1) 11:49:16 executing program 6: r0 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) syz_genetlink_get_family_id$nbd(&(0x7f0000000000), r0) sendmsg$NL802154_CMD_NEW_SEC_LEVEL(r0, &(0x7f0000000140)={&(0x7f0000000040)={0x10, 0x0, 0x0, 0x2}, 0xc, &(0x7f0000000100)={&(0x7f0000000080)={0x4c, 0x0, 0x10, 0x70bd26, 0x25dfdbfd, {}, [@NL802154_ATTR_SEC_LEVEL={0x1c, 0x22, 0x0, 0x1, [@NL802154_SECLEVEL_ATTR_DEV_OVERRIDE={0x5, 0x4, 0x1}, @NL802154_SECLEVEL_ATTR_DEV_OVERRIDE={0x5}, @NL802154_SECLEVEL_ATTR_LEVELS={0x5, 0x1, 0x9}]}, @NL802154_ATTR_SEC_LEVEL={0x1c, 0x22, 0x0, 0x1, [@NL802154_SECLEVEL_ATTR_CMD_FRAME={0x8, 0x3, 0x3}, @NL802154_SECLEVEL_ATTR_DEV_OVERRIDE={0x5}, @NL802154_SECLEVEL_ATTR_CMD_FRAME={0x8, 0x3, 0x9}]}]}, 0x4c}, 0x1, 0x0, 0x0, 0x8091}, 0x80) sendmsg$NLBL_MGMT_C_REMOVE(r0, &(0x7f0000000240)={&(0x7f0000000180)={0x10, 0x0, 0x0, 0x10000000}, 0xc, &(0x7f0000000200)={&(0x7f00000001c0)={0x34, 0x0, 0x400, 0x70bd2d, 0x25dfdbfc, {}, [@NLBL_MGMT_A_IPV4ADDR={0x8, 0x7, @multicast2}, @NLBL_MGMT_A_IPV4ADDR={0x8, 0x7, @loopback}, @NLBL_MGMT_A_IPV4ADDR={0x8, 0x7, @remote}, @NLBL_MGMT_A_CLPDOI={0x8}]}, 0x34}, 0x1, 0x0, 0x0, 0x8000}, 0x800) ioctl$sock_SIOCGIFINDEX_802154(r0, 0x8933, &(0x7f0000000280)={'wpan4\x00', 0x0}) sendmsg$NL802154_CMD_NEW_SEC_DEVKEY(r0, &(0x7f0000000500)={&(0x7f00000002c0)={0x10, 0x0, 0x0, 0x41000089}, 0xc, &(0x7f00000004c0)={&(0x7f0000000300)={0x190, 0x0, 0x400, 0x70bd2d, 0x25dfdbfc, {}, [@NL802154_ATTR_SEC_DEVKEY={0x8c, 0x24, 0x0, 0x1, [@NL802154_DEVKEY_ATTR_FRAME_COUNTER={0x8, 0x1, 0x8}, @NL802154_DEVKEY_ATTR_ID={0x6c, 0x3, 0x0, 0x1, [@NL802154_KEY_ID_ATTR_IMPLICIT={0x44, 0x3, 0x0, 0x1, [@NL802154_DEV_ADDR_ATTR_SHORT={0x6, 0x3, 0xaaa0}, @NL802154_DEV_ADDR_ATTR_SHORT={0x6, 0x3, 0xaaa0}, @NL802154_DEV_ADDR_ATTR_PAN_ID={0x6, 0x1, 0x2}, @NL802154_DEV_ADDR_ATTR_PAN_ID={0x6, 0x1, 0x1}, @NL802154_DEV_ADDR_ATTR_EXTENDED={0xc, 0x4, {0xaaaaaaaaaaaa0102}}, @NL802154_DEV_ADDR_ATTR_MODE={0x8, 0x2, 0x2}, @NL802154_DEV_ADDR_ATTR_EXTENDED={0xc, 0x4, {0xaaaaaaaaaaaa0202}}]}, @NL802154_KEY_ID_ATTR_MODE={0x8, 0x1, 0x2}, @NL802154_KEY_ID_ATTR_IMPLICIT={0x1c, 0x3, 0x0, 0x1, [@NL802154_DEV_ADDR_ATTR_SHORT={0x6, 0x3, 0xaaa1}, @NL802154_DEV_ADDR_ATTR_PAN_ID={0x6}, @NL802154_DEV_ADDR_ATTR_PAN_ID={0x6}]}]}, @NL802154_DEVKEY_ATTR_FRAME_COUNTER={0x8, 0x1, 0xdc0e}, @NL802154_DEVKEY_ATTR_EXTENDED_ADDR={0xc}]}, @NL802154_ATTR_SEC_DEVKEY={0x78, 0x24, 0x0, 0x1, [@NL802154_DEVKEY_ATTR_EXTENDED_ADDR={0xc, 0x2, {0xaaaaaaaaaaaa0302}}, @NL802154_DEVKEY_ATTR_ID={0x5c, 0x3, 0x0, 0x1, [@NL802154_KEY_ID_ATTR_SOURCE_SHORT={0x8, 0x4, 0x5}, @NL802154_KEY_ID_ATTR_MODE={0x8, 0x1, 0x2}, @NL802154_KEY_ID_ATTR_INDEX={0x5, 0x2, 0x1}, @NL802154_KEY_ID_ATTR_IMPLICIT={0x38, 0x3, 0x0, 0x1, [@NL802154_DEV_ADDR_ATTR_SHORT={0x6, 0x3, 0xaaa1}, @NL802154_DEV_ADDR_ATTR_SHORT={0x6, 0x3, 0xaaa2}, @NL802154_DEV_ADDR_ATTR_SHORT={0x6, 0x3, 0xaaa1}, @NL802154_DEV_ADDR_ATTR_PAN_ID={0x6, 0x1, 0xffff}, @NL802154_DEV_ADDR_ATTR_PAN_ID={0x6, 0x1, 0x1}, @NL802154_DEV_ADDR_ATTR_EXTENDED={0xc, 0x4, {0xaaaaaaaaaaaa0102}}]}, @NL802154_KEY_ID_ATTR_INDEX={0x5, 0x2, 0x2}]}, @NL802154_DEVKEY_ATTR_EXTENDED_ADDR={0xc, 0x2, {0x300}}]}, @NL802154_ATTR_WPAN_DEV={0xc, 0x6, 0x2}, @NL802154_ATTR_WPAN_DEV={0xc, 0x6, 0x2}, @NL802154_ATTR_SEC_DEVKEY={0x4c, 0x24, 0x0, 0x1, [@NL802154_DEVKEY_ATTR_FRAME_COUNTER={0x8, 0x1, 0x8175}, @NL802154_DEVKEY_ATTR_EXTENDED_ADDR={0xc, 0x2, {0xaaaaaaaaaaaa0102}}, @NL802154_DEVKEY_ATTR_FRAME_COUNTER={0x8, 0x1, 0x5}, @NL802154_DEVKEY_ATTR_EXTENDED_ADDR={0xc, 0x2, {0xaaaaaaaaaaaa0302}}, @NL802154_DEVKEY_ATTR_ID={0x14, 0x3, 0x0, 0x1, [@NL802154_KEY_ID_ATTR_MODE={0x8, 0x1, 0x3}, @NL802154_KEY_ID_ATTR_MODE={0x8, 0x1, 0x1}]}, @NL802154_DEVKEY_ATTR_EXTENDED_ADDR={0xc, 0x2, {0xaaaaaaaaaaaa0102}}]}, @NL802154_ATTR_IFINDEX={0x8}, @NL802154_ATTR_WPAN_DEV={0xc, 0x6, 0x200000002}]}, 0x190}, 0x1, 0x0, 0x0, 0x20000084}, 0x80) sendmsg$IEEE802154_LLSEC_DEL_DEVKEY(r0, &(0x7f0000000600)={&(0x7f0000000540)={0x10, 0x0, 0x0, 0x100}, 0xc, &(0x7f00000005c0)={&(0x7f0000000580)={0x1c, 0x0, 0x100, 0x70bd2c, 0x25dfdbfb, {}, [@IEEE802154_ATTR_LLSEC_KEY_MODE={0x5}]}, 0x1c}, 0x1, 0x0, 0x0, 0x8040}, 0x1) ioctl$sock_SIOCGIFINDEX_802154(r0, 0x8933, &(0x7f0000000680)={'wpan4\x00', 0x0}) sendmsg$NL802154_CMD_NEW_SEC_LEVEL(r0, &(0x7f0000000780)={&(0x7f0000000640)={0x10, 0x0, 0x0, 0x100}, 0xc, &(0x7f0000000740)={&(0x7f00000006c0)={0x60, 0x0, 0x4, 0x70bd2d, 0x25dfdbfe, {}, [@NL802154_ATTR_WPAN_DEV={0xc, 0x6, 0x300000003}, @NL802154_ATTR_SEC_LEVEL={0xc, 0x22, 0x0, 0x1, [@NL802154_SECLEVEL_ATTR_CMD_FRAME={0x8, 0x3, 0x8}]}, @NL802154_ATTR_SEC_LEVEL={0x14, 0x22, 0x0, 0x1, [@NL802154_SECLEVEL_ATTR_FRAME={0x8, 0x2, 0x2}, @NL802154_SECLEVEL_ATTR_FRAME={0x8, 0x2, 0x2}]}, @NL802154_ATTR_WPAN_DEV={0xc, 0x6, 0x200000002}, @NL802154_ATTR_WPAN_DEV={0xc}, @NL802154_ATTR_IFINDEX={0x8, 0x3, r2}]}, 0x60}, 0x1, 0x0, 0x0, 0x24040800}, 0xc000) r3 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r4 = syz_genetlink_get_family_id$nbd(&(0x7f0000000800), r0) sendmsg$NBD_CMD_RECONFIGURE(r3, &(0x7f0000000900)={&(0x7f00000007c0)={0x10, 0x0, 0x0, 0x800}, 0xc, &(0x7f00000008c0)={&(0x7f0000000840)={0x58, r4, 0x100, 0x70bd29, 0x25dfdbfe, {}, [@NBD_ATTR_DEAD_CONN_TIMEOUT={0xc, 0x8, 0x1a5}, @NBD_ATTR_DEAD_CONN_TIMEOUT={0xc, 0x8, 0x8}, @NBD_ATTR_SERVER_FLAGS={0xc}, @NBD_ATTR_INDEX={0x8, 0x1, 0x0}, @NBD_ATTR_BLOCK_SIZE_BYTES={0xc}, @NBD_ATTR_SIZE_BYTES={0xc, 0x2, 0x6}]}, 0x58}, 0x1, 0x0, 0x0, 0x85}, 0x24008000) r5 = syz_genetlink_get_family_id$nl802154(&(0x7f0000000980), r0) ioctl$sock_SIOCGIFINDEX_802154(r3, 0x8933, &(0x7f00000009c0)={'wpan1\x00', 0x0}) sendmsg$NL802154_CMD_NEW_SEC_LEVEL(r0, &(0x7f0000000ac0)={&(0x7f0000000940)={0x10, 0x0, 0x0, 0x8}, 0xc, &(0x7f0000000a80)={&(0x7f0000000a00)={0x64, r5, 0x604, 0x70bd25, 0x7e5, {}, [@NL802154_ATTR_WPAN_DEV={0xc, 0x6, 0x3}, @NL802154_ATTR_SEC_LEVEL={0x14, 0x22, 0x0, 0x1, [@NL802154_SECLEVEL_ATTR_FRAME={0x8, 0x2, 0x2}, @NL802154_SECLEVEL_ATTR_DEV_OVERRIDE={0x5}]}, @NL802154_ATTR_IFINDEX={0x8, 0x3, r6}, @NL802154_ATTR_IFINDEX={0x8, 0x3, r1}, @NL802154_ATTR_SEC_LEVEL={0x14, 0x22, 0x0, 0x1, [@NL802154_SECLEVEL_ATTR_FRAME={0x8, 0x2, 0x1}, @NL802154_SECLEVEL_ATTR_LEVELS={0x5, 0x1, 0x5}]}, @NL802154_ATTR_WPAN_DEV={0xc, 0x6, 0x200000002}]}, 0x64}}, 0x8050) r7 = syz_genetlink_get_family_id$nl802154(&(0x7f0000000b40), r3) ioctl$sock_SIOCGIFINDEX_802154(r0, 0x8933, &(0x7f0000000b80)={'wpan1\x00', 0x0}) sendmsg$NL802154_CMD_GET_SEC_DEVKEY(r3, &(0x7f0000000c80)={&(0x7f0000000b00)={0x10, 0x0, 0x0, 0x10000}, 0xc, &(0x7f0000000c40)={&(0x7f0000000bc0)={0x64, r7, 0x800, 0x70bd26, 0x25dfdbff, {}, [@NL802154_ATTR_WPAN_DEV={0xc}, @NL802154_ATTR_WPAN_DEV={0xc}, @NL802154_ATTR_IFINDEX={0x8, 0x3, r2}, @NL802154_ATTR_IFINDEX={0x8, 0x3, r8}, @NL802154_ATTR_IFINDEX={0x8, 0x3, r6}, @NL802154_ATTR_WPAN_DEV={0xc}, @NL802154_ATTR_IFINDEX={0x8, 0x3, r2}, @NL802154_ATTR_WPAN_DEV={0xc, 0x6, 0x3}]}, 0x64}, 0x1, 0x0, 0x0, 0x4000844}, 0x4000) sendmsg$NLBL_MGMT_C_REMOVEDEF(0xffffffffffffffff, &(0x7f0000000d80)={&(0x7f0000000cc0)={0x10, 0x0, 0x0, 0x10000000}, 0xc, &(0x7f0000000d40)={&(0x7f0000000d00)={0x1c, 0x0, 0x1, 0x70bd28, 0x25dfdbfe, {}, [@NLBL_MGMT_A_PROTOCOL={0x8, 0x2, 0x3}]}, 0x1c}, 0x1, 0x0, 0x0, 0x800}, 0x4000) 11:49:16 executing program 3: r0 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000000)='./binderfs2/custom0\x00', 0x0, 0x0) r1 = perf_event_open(&(0x7f00000007c0)={0x0, 0x80, 0x2, 0x4, 0x1c, 0xff, 0x0, 0xe4, 0x8, 0x7, 0x1, 0x1, 0x1, 0x1, 0x1, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x1, 0x0, 0x1, 0x1, 0x0, 0x0, 0x1, 0x0, 0x1, 0x1, 0x1, 0x1, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x1, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffff1cd, 0x1, @perf_bp={&(0x7f0000000780), 0x4}, 0x4173, 0x1, 0x2, 0x4, 0x1, 0x2, 0x7, 0x0, 0xffffff7f, 0x0, 0x68c4}, 0x0, 0x5, 0xffffffffffffffff, 0x0) r2 = openat$cgroup_type(0xffffffffffffffff, &(0x7f0000000840), 0x2, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000ac0)={0xa0, 0x0, &(0x7f0000000940)=[@increfs_done={0x40106308, 0x2}, @acquire, @dead_binder_done, @register_looper, @dead_binder_done, @increfs_done={0x40106308, 0x3}, @request_death={0x400c630e, 0x1}, @reply={0x40406301, {0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x48, 0x18, &(0x7f0000000880)={@fd={0x66642a85, 0x0, r1}, @flat=@weak_binder={0x77622a85, 0x0, 0x1}, @fd={0x66642a85, 0x0, r2}}, &(0x7f0000000900)={0x0, 0x18, 0x30}}}], 0xba, 0x0, &(0x7f0000000a00)="300c964b99b0fc8bc041eed901596dcc00c49ae50e7d50ab2181ebd3ced1dedd5b95801b47942df87fa0193d45616e7abcb521e4b3031cf0f6ce86d01e78fd249c0a368369dcbb588cf079a014940599b7b6d4397e0d176e2576874ae05c2c5cb611bc0a2d765cd1223396d58aed4be672d29a0400a0b3f8ce7a4a03028b890b0f5a8be682791ee67fd5956810a83a83ae92d2e89345cd2f5ecebe5e98f11d0642b6624d047bf7127114786a300db84bfe332fe8533489aad8be"}) r3 = mmap$IORING_OFF_CQ_RING(&(0x7f0000ffe000/0x2000)=nil, 0x2000, 0x2000001, 0x4000010, 0xffffffffffffffff, 0x8000000) r4 = mmap$IORING_OFF_SQES(&(0x7f0000ffe000/0x2000)=nil, 0x2000, 0x1000008, 0x4010, 0xffffffffffffffff, 0x10000000) r5 = io_uring_register$IORING_REGISTER_PERSONALITY(0xffffffffffffffff, 0x9, 0x0, 0x0) r6 = openat$cgroup_pressure(0xffffffffffffffff, &(0x7f0000000b00)='io.pressure\x00', 0x2, 0x0) syz_io_uring_submit(r3, r4, &(0x7f0000000b40)=@IORING_OP_TEE={0x21, 0x5, 0x0, @fd_index=0x9, 0x0, 0x0, 0x6, 0x7, 0x1, {0x0, r5, r6}}, 0x5) rt_sigaction(0x15, &(0x7f0000000c40)={&(0x7f0000000b80)="f2a6c4e2252c9eec000000666666420f3a14a9020000000dc4e279185556c4e2ed2981060000008fe9d801cbdd15ddac000066450f3a14913223333300c4e17a6f54d28dc4a261ba5682", 0x80000002, &(0x7f0000000c00)="c4c2c5ab07c4e1fd60fbc461ff2d6dcd3e0f1b1e0f0d3ec4e2e9af1c430fff57000f419f47200000c4a2f920cd450a8000000000", {[0x1]}}, &(0x7f0000000d40)={&(0x7f0000000c80)="e353c442f8f35266c401f928dff30fa7c0653e2e2e64a564410f0ffca0c481196907c401015de4dbd1c4019172e508", 0x0, &(0x7f0000000cc0)="c4e141f123c4a27bf79482a9e77544c422cd3c8204000000660fc5c881c441c173dd00c483fd01309dc462559c71472e260f4694aa0a000000c4e228f31dfeefffff140f"}, 0x8, &(0x7f0000000d80)) ioctl$CDROM_MEDIA_CHANGED(0xffffffffffffffff, 0x5325, 0x7) openat$binderfs(0xffffffffffffff9c, &(0x7f0000000dc0)='./binderfs2/binder1\x00', 0x800, 0x0) r7 = syz_io_uring_setup(0x783a, &(0x7f0000000e00)={0x0, 0xe533, 0x8, 0x3, 0x3a0}, &(0x7f0000ffc000/0x1000)=nil, &(0x7f0000ffc000/0x3000)=nil, &(0x7f0000000e80), &(0x7f0000000ec0)) mmap$IORING_OFF_SQ_RING(&(0x7f0000ffc000/0x4000)=nil, 0x4000, 0x2000000, 0x12, r7, 0x0) semget(0x1, 0x3, 0x511) 11:49:16 executing program 0: syz_io_uring_submit(0x0, 0x0, &(0x7f0000000000)=@IORING_OP_NOP={0x0, 0x1}, 0x6) ioctl$sock_SIOCGIFINDEX_802154(0xffffffffffffffff, 0x8933, &(0x7f0000000080)={'wpan4\x00', 0x0}) sendmsg$IEEE802154_LLSEC_GETPARAMS(0xffffffffffffffff, &(0x7f0000000140)={&(0x7f0000000040)={0x10, 0x0, 0x0, 0x40000000}, 0xc, &(0x7f0000000100)={&(0x7f00000000c0)={0x38, 0x0, 0x20, 0x70bd2a, 0x25dfdbff, {}, [@IEEE802154_ATTR_DEV_INDEX={0x8, 0x2, r0}, @IEEE802154_ATTR_DEV_NAME={0xa, 0x1, 'wpan1\x00'}, @IEEE802154_ATTR_DEV_INDEX={0x8}, @IEEE802154_ATTR_DEV_INDEX={0x8}]}, 0x38}, 0x1, 0x0, 0x0, 0x4000090}, 0x20008010) r1 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) sendmsg$NL802154_CMD_NEW_SEC_DEVKEY(r1, &(0x7f0000000240)={&(0x7f0000000180)={0x10, 0x0, 0x0, 0x10000}, 0xc, &(0x7f0000000200)={&(0x7f00000001c0)={0x2c, 0x0, 0x1, 0x70bd2b, 0x25dfdbfd, {}, [@NL802154_ATTR_SEC_DEVKEY={0x10, 0x24, 0x0, 0x1, [@NL802154_DEVKEY_ATTR_ID={0xc, 0x3, 0x0, 0x1, [@NL802154_KEY_ID_ATTR_INDEX={0x5, 0x2, 0x2}]}]}, @NL802154_ATTR_IFINDEX={0x8, 0x3, r0}]}, 0x2c}}, 0x4040080) r2 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) ioctl$sock_SIOCGIFINDEX_802154(r1, 0x8933, &(0x7f00000002c0)={'wpan4\x00', 0x0}) ioctl$sock_SIOCGIFINDEX_802154(r1, 0x8933, &(0x7f0000000300)={'wpan0\x00', 0x0}) ioctl$sock_SIOCGIFINDEX_802154(r1, 0x8933, &(0x7f0000000340)={'wpan0\x00', 0x0}) sendmsg$IEEE802154_LLSEC_GETPARAMS(r2, &(0x7f0000000440)={&(0x7f0000000280)={0x10, 0x0, 0x0, 0x8000}, 0xc, &(0x7f0000000400)={&(0x7f0000000380)={0x5c, 0x0, 0x504, 0x70bd2b, 0x25dfdbfb, {}, [@IEEE802154_ATTR_DEV_INDEX={0x8, 0x2, r3}, @IEEE802154_ATTR_DEV_NAME={0xa, 0x1, 'wpan1\x00'}, @IEEE802154_ATTR_DEV_INDEX={0x8, 0x2, r0}, @IEEE802154_ATTR_DEV_INDEX={0x8, 0x2, r0}, @IEEE802154_ATTR_DEV_INDEX={0x8, 0x2, r4}, @IEEE802154_ATTR_DEV_INDEX={0x8, 0x2, r5}, @IEEE802154_ATTR_DEV_NAME={0xa, 0x1, 'wpan1\x00'}, @IEEE802154_ATTR_DEV_INDEX={0x8, 0x2, r0}]}, 0x5c}, 0x1, 0x0, 0x0, 0x24040080}, 0x4004014) r6 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000480)='./binderfs/custom0\x00', 0x802, 0x0) mmap$binder(&(0x7f0000ffd000/0x2000)=nil, 0x2000, 0x1, 0x11, r6, 0x10001) syz_genetlink_get_family_id$nbd(&(0x7f00000004c0), r2) syz_genetlink_get_family_id$netlbl_mgmt(&(0x7f0000000500), r1) getpid() sendmsg$IEEE802154_LLSEC_DEL_DEVKEY(r1, &(0x7f0000000640)={&(0x7f0000000540)={0x10, 0x0, 0x0, 0x2000}, 0xc, &(0x7f0000000600)={&(0x7f0000000580)={0x44, 0x0, 0x20, 0x70bd25, 0x25dfdbfd, {}, [@IEEE802154_ATTR_LLSEC_KEY_SOURCE_EXTENDED={0xc, 0x2d, {0xaaaaaaaaaaaa0002}}, @IEEE802154_ATTR_LLSEC_KEY_ID={0x5, 0x2e, 0x1f}, @IEEE802154_ATTR_LLSEC_KEY_SOURCE_SHORT={0x8, 0x2c, 0x4}, @IEEE802154_ATTR_LLSEC_KEY_MODE={0x5, 0x2b, 0x2}, @IEEE802154_ATTR_LLSEC_KEY_SOURCE_EXTENDED={0xc, 0x2d, {0xaaaaaaaaaaaa0202}}]}, 0x44}, 0x1, 0x0, 0x0, 0x1}, 0x400c084) ioctl$PERF_EVENT_IOC_PAUSE_OUTPUT(0xffffffffffffffff, 0x40042409, 0x1) r7 = syz_genetlink_get_family_id$nl802154(&(0x7f00000006c0), r2) ioctl$sock_SIOCGIFINDEX_802154(r2, 0x8933, &(0x7f0000000700)={'wpan0\x00', 0x0}) sendmsg$NL802154_CMD_NEW_SEC_DEV(r1, &(0x7f0000000800)={&(0x7f0000000680)={0x10, 0x0, 0x0, 0x400000}, 0xc, &(0x7f00000007c0)={&(0x7f0000000740)={0x44, r7, 0x400, 0x70bd2d, 0x25dfdbff, {}, [@NL802154_ATTR_IFINDEX={0x8}, @NL802154_ATTR_WPAN_DEV={0xc, 0x6, 0x300000001}, @NL802154_ATTR_IFINDEX={0x8, 0x3, r8}, @NL802154_ATTR_WPAN_DEV={0xc, 0x6, 0x300000003}, @NL802154_ATTR_IFINDEX={0x8, 0x3, r0}]}, 0x44}, 0x1, 0x0, 0x0, 0x8001}, 0x4000000) 11:49:16 executing program 5: setitimer(0x0, &(0x7f0000000000)={{}, {0x0, 0xea60}}, &(0x7f0000000040)) getitimer(0x0, &(0x7f0000000080)) r0 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$netlbl_mgmt(&(0x7f0000000100), 0xffffffffffffffff) sendmsg$NLBL_MGMT_C_ADDDEF(r0, &(0x7f00000001c0)={&(0x7f00000000c0)={0x10, 0x0, 0x0, 0x1}, 0xc, &(0x7f0000000180)={&(0x7f0000000140)={0x1c, r1, 0x4, 0x70bd2a, 0x25dfdbff, {}, [@NLBL_MGMT_A_CLPDOI={0x8}]}, 0x1c}, 0x1, 0x0, 0x0, 0x4000000}, 0x40000) geteuid() syz_usb_connect$cdc_ecm(0x4, 0x10d, &(0x7f0000000200)={{0x12, 0x1, 0x720, 0x2, 0x0, 0x0, 0x10, 0x525, 0xa4a1, 0x40, 0x1, 0x2, 0x3, 0x1, [{{0x9, 0x2, 0xfb, 0x1, 0x1, 0xba, 0x50, 0xff, [{{0x9, 0x4, 0x0, 0x7, 0x2, 0x2, 0x6, 0x0, 0x7c, {{0x8, 0x24, 0x6, 0x0, 0x0, "fbf211"}, {0x5, 0x24, 0x0, 0x8}, {0xd, 0x24, 0xf, 0x1, 0x1, 0x3f, 0x3, 0x40}, [@mdlm_detail={0x99, 0x24, 0x13, 0x3, "48c1a1b655094616df62fff6017defd0bdac4f2617618052fc22350170d4b41a1affe05826274c5d93aa871d89455559c068d877251368c5b00552322da12b5958d76e60294d79d6bd527055bb53f40402ca669ba20042da00554f68b1b12b345fc2bb35f09aac73eb5ac2fcd8634e5e7252075c0d8ce0ad3e8dda63c3c27a6db1be131aa7525a018859895d6e885540b704d1f7dc"}, @country_functional={0xc, 0x24, 0x7, 0x90, 0x6, [0x4, 0x9, 0xe77]}, @obex={0x5, 0x24, 0x15, 0x8}, @acm={0x4, 0x24, 0x2, 0xd}, @ncm={0x6, 0x24, 0x1a, 0x7, 0x26}]}, {[{{0x9, 0x5, 0x81, 0x3, 0x1df, 0x81, 0x32, 0x1}}], {{0x9, 0x5, 0x82, 0x2, 0x3ff, 0x2, 0x6, 0x5}}, {{0x9, 0x5, 0x3, 0x2, 0x8, 0x1, 0x4, 0xff}}}}}]}}]}}, &(0x7f0000000640)={0xa, &(0x7f0000000340)={0xa, 0x6, 0x110, 0x3, 0xae, 0x8, 0xff, 0x1f}, 0x5, &(0x7f0000000380)={0x5, 0xf, 0x5}, 0x7, [{0x14, &(0x7f00000003c0)=@string={0x14, 0x3, "fd058c95bdf599f8e5f073eae7235e49a442"}}, {0x4, &(0x7f0000000400)=@lang_id={0x4, 0x3, 0x380a}}, {0x4, &(0x7f0000000440)=@lang_id={0x4, 0x3, 0x445}}, {0x4, &(0x7f0000000480)=@lang_id={0x4, 0x3, 0x2c0a}}, {0x4, &(0x7f00000004c0)=@lang_id={0x4, 0x3, 0x1001}}, {0x4, &(0x7f0000000500)=@lang_id={0x4, 0x3, 0x42a}}, {0xf1, &(0x7f0000000540)=@string={0xf1, 0x3, "84d5b48356934b18c11ca618df7ef64b6c011395cc6829bdeedd71e659bc7545af1fffa2149c42cd8da15a92d7564b65a135a440b298e19eddd0415c86d7b42e1c9641793180d54dedbc008eeb526d3540368aed104e9c9220a6d3e7f635e585d6e7f55ecaab0cf2111887b6e16bfe4c3f94f53b49e421698825847fc65ef965c3007893b9e33ccdbdb39b38af85a0863c618f0d2135ee175361a7f77a56730d8ae5c677510cf17584b6302361fc90e77b8e50675a5756fd20d5f4bc211f04b21de401616a64c3d1a1398527dca0fd098e082f7533b65e1f4626cc5cbfa742eac63bb0d848f069eb64132f065192e5"}}]}) r2 = syz_genetlink_get_family_id$nl802154(&(0x7f0000000700), r0) ioctl$sock_SIOCGIFINDEX_802154(r0, 0x8933, &(0x7f0000000740)={'wpan1\x00', 0x0}) ioctl$sock_SIOCGIFINDEX_802154(r0, 0x8933, &(0x7f0000000780)={'wpan3\x00', 0x0}) sendmsg$NL802154_CMD_NEW_SEC_LEVEL(r0, &(0x7f0000000840)={&(0x7f00000006c0)={0x10, 0x0, 0x0, 0x8000000}, 0xc, &(0x7f0000000800)={&(0x7f00000007c0)={0x38, r2, 0x1, 0x70bd2a, 0x25dfdbff, {}, [@NL802154_ATTR_IFINDEX={0x8, 0x3, r3}, @NL802154_ATTR_IFINDEX={0x8, 0x3, r4}, @NL802154_ATTR_WPAN_DEV={0xc, 0x6, 0x100000001}, @NL802154_ATTR_IFINDEX={0x8}]}, 0x38}, 0x1, 0x0, 0x0, 0x1}, 0x0) ioctl$CDROMREADAUDIO(0xffffffffffffffff, 0x530e, &(0x7f00000008c0)={@lba, 0x2, 0x3b, &(0x7f0000000880)=""/59}) ioctl$CDROMREADAUDIO(0xffffffffffffffff, 0x530e, &(0x7f0000000940)={@lba=0x7, 0x1, 0x24, &(0x7f0000000900)=""/36}) sendmsg$NLBL_MGMT_C_REMOVEDEF(r0, &(0x7f0000000a40)={&(0x7f0000000980)={0x10, 0x0, 0x0, 0x20000}, 0xc, &(0x7f0000000a00)={&(0x7f00000009c0)={0x34, r1, 0x100, 0x70bd2c, 0x25dfdbfd, {}, [@NLBL_MGMT_A_IPV4MASK={0x8, 0x8, @local}, @NLBL_MGMT_A_CV4DOI={0x8, 0x4, 0xffffffffffffffff}, @NLBL_MGMT_A_IPV4MASK={0x8, 0x8, @dev={0xac, 0x14, 0x14, 0x39}}, @NLBL_MGMT_A_IPV4ADDR={0x8, 0x7, @private=0xa010102}]}, 0x34}, 0x1, 0x0, 0x0, 0x40}, 0x8011) ioctl$sock_SIOCGIFINDEX_802154(r0, 0x8933, &(0x7f0000000ac0)={'wpan1\x00', 0x0}) ioctl$sock_SIOCGIFINDEX_802154(0xffffffffffffffff, 0x8933, &(0x7f0000000b00)={'wpan1\x00', 0x0}) sendmsg$NL802154_CMD_GET_SEC_KEY(r0, &(0x7f0000000c00)={&(0x7f0000000a80)={0x10, 0x0, 0x0, 0x400000}, 0xc, &(0x7f0000000bc0)={&(0x7f0000000b40)={0x4c, r2, 0x410, 0x70bd29, 0x25dfdbff, {}, [@NL802154_ATTR_IFINDEX={0x8, 0x3, r3}, @NL802154_ATTR_IFINDEX={0x8, 0x3, r5}, @NL802154_ATTR_WPAN_DEV={0xc, 0x6, 0x300000003}, @NL802154_ATTR_IFINDEX={0x8, 0x3, r6}, @NL802154_ATTR_IFINDEX={0x8, 0x3, r3}, @NL802154_ATTR_WPAN_DEV={0xc}]}, 0x4c}, 0x1, 0x0, 0x0, 0xd4}, 0x801) syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) sendmsg$NL802154_CMD_SET_ACKREQ_DEFAULT(0xffffffffffffffff, &(0x7f0000000d40)={&(0x7f0000000c80)={0x10, 0x0, 0x0, 0x10000}, 0xc, &(0x7f0000000d00)={&(0x7f0000000cc0)={0x20, r2, 0x800, 0x70bd29, 0x25dfdbfb, {}, [@NL802154_ATTR_WPAN_DEV={0xc, 0x6, 0x2}]}, 0x20}, 0x1, 0x0, 0x0, 0x1}, 0x8080) 11:49:16 executing program 2: ioctl$SCSI_IOCTL_DOORLOCK(0xffffffffffffffff, 0x5380) r0 = syz_open_dev$sg(&(0x7f0000000000), 0x9, 0x200) ioctl$SCSI_IOCTL_SYNC(r0, 0x4) ioctl$SG_GET_SG_TABLESIZE(r0, 0x227f, &(0x7f0000000040)) r1 = openat$cdrom(0xffffffffffffff9c, &(0x7f0000000080), 0x331200, 0x0) ioctl$CDROMRESET(r1, 0x5312) r2 = openat$cgroup(0xffffffffffffffff, &(0x7f00000000c0)='syz0\x00', 0x200002, 0x0) openat$cgroup_netprio_ifpriomap(r2, &(0x7f0000000100), 0x2, 0x0) ioctl$SG_GET_SG_TABLESIZE(r0, 0x227f, &(0x7f0000000140)) r3 = openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000180)='./cgroup.net/syz1\x00', 0x200002, 0x0) r4 = openat$cgroup(r2, &(0x7f00000001c0)='syz0\x00', 0x200002, 0x0) openat$cgroup_pressure(r4, &(0x7f0000000200)='memory.pressure\x00', 0x2, 0x0) ioctl$CDROMSETSPINDOWN(r1, 0x531e, &(0x7f0000000240)=0x6) ioctl$CDROMREADCOOKED(r1, 0x5315, &(0x7f0000000280)) openat$vga_arbiter(0xffffffffffffff9c, &(0x7f0000000d00), 0x200080, 0x0) r5 = openat$hwrng(0xffffffffffffff9c, &(0x7f0000000d40), 0x200000, 0x0) write$tcp_congestion(r5, &(0x7f0000000d80)='westwood\x00', 0x9) ioctl$CDROM_NEXT_WRITABLE(r5, 0x5394, &(0x7f0000000dc0)) openat$cgroup_subtree(r3, &(0x7f0000000e00), 0x2, 0x0) 11:49:16 executing program 7: openat$vga_arbiter(0xffffffffffffff9c, &(0x7f0000000000), 0x28081, 0x0) r0 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r1 = openat$cgroup_ro(0xffffffffffffffff, &(0x7f0000000280)='hugetlb.1GB.usage_in_bytes\x00', 0x0, 0x0) sendmsg$NBD_CMD_DISCONNECT(r0, &(0x7f0000000340)={&(0x7f0000000040)={0x10, 0x0, 0x0, 0x400}, 0xc, &(0x7f0000000300)={&(0x7f00000002c0)={0x38, 0x0, 0x800, 0x70bd27, 0x25dfdbfe, {}, [@NBD_ATTR_SOCKETS={0x24, 0x7, 0x0, 0x1, [{0x8}, {0x8, 0x1, r1}, {0x8}, {0x8}]}]}, 0x38}, 0x1, 0x0, 0x0, 0x20000005}, 0x24000000) sendmsg$NL802154_CMD_SET_SHORT_ADDR(r0, &(0x7f0000000480)={&(0x7f0000000380)={0x10, 0x0, 0x0, 0x8000}, 0xc, &(0x7f0000000440)={&(0x7f00000003c0)={0x44, 0x0, 0x100, 0x70bd2b, 0x25dfdbfb, {}, [@NL802154_ATTR_SHORT_ADDR={0x6}, @NL802154_ATTR_WPAN_DEV={0xc}, @NL802154_ATTR_WPAN_DEV={0xc, 0x6, 0x300000003}, @NL802154_ATTR_IFINDEX={0x8}, @NL802154_ATTR_IFINDEX={0x8}]}, 0x44}, 0x1, 0x0, 0x0, 0x400}, 0x80) openat$cgroup_netprio_ifpriomap(r1, &(0x7f00000004c0), 0x2, 0x0) r2 = openat$hwrng(0xffffffffffffff9c, &(0x7f0000000500), 0x20000, 0x0) getsockopt$inet6_mreq(r2, 0x29, 0x15, &(0x7f0000000540)={@mcast1}, &(0x7f0000000580)=0x14) getsockopt$inet6_mreq(r2, 0x29, 0x15, &(0x7f00000005c0)={@ipv4={""/10, ""/2, @initdev}}, &(0x7f0000000600)=0x14) r3 = io_uring_setup(0x5c38, &(0x7f0000000640)={0x0, 0x5b7f, 0x10, 0x2, 0x214, 0x0, r2}) io_uring_register$IORING_REGISTER_PERSONALITY(r3, 0x9, 0x0, 0x0) r4 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) sendmsg$NLBL_MGMT_C_REMOVEDEF(r4, &(0x7f0000000800)={&(0x7f00000006c0)={0x10, 0x0, 0x0, 0x4}, 0xc, &(0x7f00000007c0)={&(0x7f0000000700)={0x90, 0x0, 0x500, 0x70bd26, 0x25dfdbfe, {}, [@NLBL_MGMT_A_IPV6MASK={0x14, 0x6, @local}, @NLBL_MGMT_A_PROTOCOL={0x8, 0x2, 0x3}, @NLBL_MGMT_A_CLPDOI={0x8, 0xc, 0x2}, @NLBL_MGMT_A_IPV6ADDR={0x14, 0x5, @empty}, @NLBL_MGMT_A_IPV6MASK={0x14, 0x6, @private0={0xfc, 0x0, '\x00', 0x1}}, @NLBL_MGMT_A_IPV6MASK={0x14, 0x6, @private1}, @NLBL_MGMT_A_IPV6ADDR={0x14, 0x5, @rand_addr=' \x01\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x02'}, @NLBL_MGMT_A_FAMILY={0x6, 0xb, 0x2b}]}, 0x90}, 0x1, 0x0, 0x0, 0x80}, 0x90) sendmsg$IEEE802154_LLSEC_GETPARAMS(r4, &(0x7f0000000900)={&(0x7f0000000840)={0x10, 0x0, 0x0, 0x2000000}, 0xc, &(0x7f00000008c0)={&(0x7f0000000880)={0x28, 0x0, 0x20, 0x70bd29, 0x25dfdbfe, {}, [@IEEE802154_ATTR_DEV_INDEX={0x8}, @IEEE802154_ATTR_DEV_NAME={0xa, 0x1, 'wpan1\x00'}]}, 0x28}, 0x1, 0x0, 0x0, 0x24000001}, 0x100) ioctl$PERF_EVENT_IOC_SET_FILTER(0xffffffffffffffff, 0x40082406, &(0x7f0000000940)='/dev/hwrng\x00') ioctl$CDROM_SELECT_DISK(r1, 0x5322, 0xfff) openat$cgroup_ro(r1, &(0x7f0000000980)='hugetlb.1GB.usage_in_bytes\x00', 0x0, 0x0) ioctl$sock_SIOCGIFINDEX_802154(0xffffffffffffffff, 0x8933, &(0x7f0000000a00)={'wpan0\x00', 0x0}) ioctl$sock_SIOCGIFINDEX_802154(r4, 0x8933, &(0x7f0000000a40)={'wpan0\x00', 0x0}) sendmsg$IEEE802154_LLSEC_DEL_DEVKEY(r4, &(0x7f0000000b40)={&(0x7f00000009c0)={0x10, 0x0, 0x0, 0x200}, 0xc, &(0x7f0000000b00)={&(0x7f0000000a80)={0x58, 0x0, 0x400, 0x70bd27, 0x25dfdbfb, {}, [@IEEE802154_ATTR_LLSEC_KEY_MODE={0x5, 0x2b, 0x3}, @IEEE802154_ATTR_LLSEC_KEY_SOURCE_SHORT={0x8, 0x2c, 0xbcd4e33}, @IEEE802154_ATTR_DEV_NAME={0xa, 0x1, 'wpan0\x00'}, @IEEE802154_ATTR_DEV_INDEX={0x8, 0x2, r5}, @IEEE802154_ATTR_DEV_INDEX={0x8}, @IEEE802154_ATTR_DEV_INDEX={0x8, 0x2, r6}, @IEEE802154_ATTR_SHORT_ADDR={0x6, 0x4, 0xaaa0}, @IEEE802154_ATTR_SHORT_ADDR={0x6, 0x4, 0xfffe}]}, 0x58}, 0x1, 0x0, 0x0, 0x4080}, 0x8000) 11:49:16 executing program 1: eventfd(0xfffffff9) ioctl$CDROMREADTOCENTRY(0xffffffffffffffff, 0x5306, &(0x7f0000000000)={0x5, 0x4, 0x2, 0x3, @lba=0x8000, 0x4}) ioctl$CDROMSETSPINDOWN(0xffffffffffffffff, 0x531e, &(0x7f0000000040)=0x8) ioctl$CDROMREADCOOKED(0xffffffffffffffff, 0x5315, &(0x7f0000000080)) ioctl$CDROMVOLREAD(0xffffffffffffffff, 0x5313, &(0x7f0000000b00)) syz_open_dev$sg(&(0x7f0000000b40), 0x3ff, 0x80000) r0 = openat$hwrng(0xffffffffffffff9c, &(0x7f0000000b80), 0x800, 0x0) ioctl$CDROMCLOSETRAY(r0, 0x5319) ioctl$CDROM_TIMED_MEDIA_CHANGE(r0, 0x5396, &(0x7f0000000bc0)={0x8, 0x1}) ioctl$CDROMREADAUDIO(r0, 0x530e, &(0x7f0000000c40)={@lba=0x23c, 0x5, 0x12, &(0x7f0000000c00)=""/18}) openat$cgroup_type(r0, &(0x7f0000000c80), 0x2, 0x0) r1 = openat$hwrng(0xffffffffffffff9c, &(0x7f0000000cc0), 0x220000, 0x0) ioctl$CDROMREADTOCHDR(r1, 0x5305, &(0x7f0000000d00)={0x7f, 0x1}) r2 = openat$hwrng(0xffffffffffffff9c, &(0x7f0000000d40), 0x10400, 0x0) write$cgroup_type(r2, &(0x7f0000000d80), 0x9) r3 = openat$cdrom(0xffffffffffffff9c, &(0x7f0000000dc0), 0x0, 0x0) ioctl$CDROMMULTISESSION(r3, 0x5310, &(0x7f0000000e00)={@lba=0xf, 0x1}) r4 = openat$cdrom(0xffffffffffffff9c, &(0x7f0000000e40), 0x240, 0x0) ioctl$CDROMREADTOCENTRY(r4, 0x5306, &(0x7f0000000e80)={0x1f, 0x6, 0x9, 0x0, @lba=0x6, 0x4}) ioctl$CDROMREADCOOKED(r3, 0x5315, &(0x7f0000000ec0)) 11:49:17 executing program 2: ioctl$SCSI_IOCTL_DOORLOCK(0xffffffffffffffff, 0x5380) r0 = syz_open_dev$sg(&(0x7f0000000000), 0x9, 0x200) ioctl$SCSI_IOCTL_SYNC(r0, 0x4) ioctl$SG_GET_SG_TABLESIZE(r0, 0x227f, &(0x7f0000000040)) r1 = openat$cdrom(0xffffffffffffff9c, &(0x7f0000000080), 0x331200, 0x0) ioctl$CDROMRESET(r1, 0x5312) r2 = openat$cgroup(0xffffffffffffffff, &(0x7f00000000c0)='syz0\x00', 0x200002, 0x0) openat$cgroup_netprio_ifpriomap(r2, &(0x7f0000000100), 0x2, 0x0) ioctl$SG_GET_SG_TABLESIZE(r0, 0x227f, &(0x7f0000000140)) openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000180)='./cgroup.net/syz1\x00', 0x200002, 0x0) r3 = openat$cgroup(r2, &(0x7f00000001c0)='syz0\x00', 0x200002, 0x0) openat$cgroup_pressure(r3, &(0x7f0000000200)='memory.pressure\x00', 0x2, 0x0) ioctl$CDROMSETSPINDOWN(r1, 0x531e, &(0x7f0000000240)=0x6) ioctl$CDROMREADCOOKED(r1, 0x5315, &(0x7f0000000280)) openat$vga_arbiter(0xffffffffffffff9c, &(0x7f0000000d00), 0x200080, 0x0) r4 = openat$hwrng(0xffffffffffffff9c, &(0x7f0000000d40), 0x200000, 0x0) write$tcp_congestion(r4, &(0x7f0000000d80)='westwood\x00', 0x9) ioctl$CDROM_NEXT_WRITABLE(r4, 0x5394, &(0x7f0000000dc0)) 11:49:17 executing program 3: r0 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000000)='./binderfs2/custom0\x00', 0x0, 0x0) r1 = perf_event_open(&(0x7f00000007c0)={0x0, 0x80, 0x2, 0x4, 0x1c, 0xff, 0x0, 0xe4, 0x8, 0x7, 0x1, 0x1, 0x1, 0x1, 0x1, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x1, 0x0, 0x1, 0x1, 0x0, 0x0, 0x1, 0x0, 0x1, 0x1, 0x1, 0x1, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x1, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffff1cd, 0x1, @perf_bp={&(0x7f0000000780), 0x4}, 0x4173, 0x1, 0x2, 0x4, 0x1, 0x2, 0x7, 0x0, 0xffffff7f, 0x0, 0x68c4}, 0x0, 0x5, 0xffffffffffffffff, 0x0) r2 = openat$cgroup_type(0xffffffffffffffff, &(0x7f0000000840), 0x2, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000ac0)={0xa0, 0x0, &(0x7f0000000940)=[@increfs_done={0x40106308, 0x2}, @acquire, @dead_binder_done, @register_looper, @dead_binder_done, @increfs_done={0x40106308, 0x3}, @request_death={0x400c630e, 0x1}, @reply={0x40406301, {0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x48, 0x18, &(0x7f0000000880)={@fd={0x66642a85, 0x0, r1}, @flat=@weak_binder={0x77622a85, 0x0, 0x1}, @fd={0x66642a85, 0x0, r2}}, &(0x7f0000000900)={0x0, 0x18, 0x30}}}], 0xba, 0x0, &(0x7f0000000a00)="300c964b99b0fc8bc041eed901596dcc00c49ae50e7d50ab2181ebd3ced1dedd5b95801b47942df87fa0193d45616e7abcb521e4b3031cf0f6ce86d01e78fd249c0a368369dcbb588cf079a014940599b7b6d4397e0d176e2576874ae05c2c5cb611bc0a2d765cd1223396d58aed4be672d29a0400a0b3f8ce7a4a03028b890b0f5a8be682791ee67fd5956810a83a83ae92d2e89345cd2f5ecebe5e98f11d0642b6624d047bf7127114786a300db84bfe332fe8533489aad8be"}) r3 = mmap$IORING_OFF_CQ_RING(&(0x7f0000ffe000/0x2000)=nil, 0x2000, 0x2000001, 0x4000010, 0xffffffffffffffff, 0x8000000) r4 = mmap$IORING_OFF_SQES(&(0x7f0000ffe000/0x2000)=nil, 0x2000, 0x1000008, 0x4010, 0xffffffffffffffff, 0x10000000) r5 = io_uring_register$IORING_REGISTER_PERSONALITY(0xffffffffffffffff, 0x9, 0x0, 0x0) r6 = openat$cgroup_pressure(0xffffffffffffffff, &(0x7f0000000b00)='io.pressure\x00', 0x2, 0x0) syz_io_uring_submit(r3, r4, &(0x7f0000000b40)=@IORING_OP_TEE={0x21, 0x5, 0x0, @fd_index=0x9, 0x0, 0x0, 0x6, 0x7, 0x1, {0x0, r5, r6}}, 0x5) rt_sigaction(0x15, &(0x7f0000000c40)={&(0x7f0000000b80)="f2a6c4e2252c9eec000000666666420f3a14a9020000000dc4e279185556c4e2ed2981060000008fe9d801cbdd15ddac000066450f3a14913223333300c4e17a6f54d28dc4a261ba5682", 0x80000002, &(0x7f0000000c00)="c4c2c5ab07c4e1fd60fbc461ff2d6dcd3e0f1b1e0f0d3ec4e2e9af1c430fff57000f419f47200000c4a2f920cd450a8000000000", {[0x1]}}, &(0x7f0000000d40)={&(0x7f0000000c80)="e353c442f8f35266c401f928dff30fa7c0653e2e2e64a564410f0ffca0c481196907c401015de4dbd1c4019172e508", 0x0, &(0x7f0000000cc0)="c4e141f123c4a27bf79482a9e77544c422cd3c8204000000660fc5c881c441c173dd00c483fd01309dc462559c71472e260f4694aa0a000000c4e228f31dfeefffff140f"}, 0x8, &(0x7f0000000d80)) ioctl$CDROM_MEDIA_CHANGED(0xffffffffffffffff, 0x5325, 0x7) openat$binderfs(0xffffffffffffff9c, &(0x7f0000000dc0)='./binderfs2/binder1\x00', 0x800, 0x0) r7 = syz_io_uring_setup(0x783a, &(0x7f0000000e00)={0x0, 0xe533, 0x8, 0x3, 0x3a0}, &(0x7f0000ffc000/0x1000)=nil, &(0x7f0000ffc000/0x3000)=nil, &(0x7f0000000e80), &(0x7f0000000ec0)) mmap$IORING_OFF_SQ_RING(&(0x7f0000ffc000/0x4000)=nil, 0x4000, 0x2000000, 0x12, r7, 0x0) semget(0x1, 0x3, 0x511) 11:49:17 executing program 7: openat$vga_arbiter(0xffffffffffffff9c, &(0x7f0000000000), 0x28081, 0x0) r0 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r1 = openat$cgroup_ro(0xffffffffffffffff, &(0x7f0000000280)='hugetlb.1GB.usage_in_bytes\x00', 0x0, 0x0) sendmsg$NBD_CMD_DISCONNECT(r0, &(0x7f0000000340)={&(0x7f0000000040)={0x10, 0x0, 0x0, 0x400}, 0xc, &(0x7f0000000300)={&(0x7f00000002c0)={0x38, 0x0, 0x800, 0x70bd27, 0x25dfdbfe, {}, [@NBD_ATTR_SOCKETS={0x24, 0x7, 0x0, 0x1, [{0x8}, {0x8, 0x1, r1}, {0x8}, {0x8}]}]}, 0x38}, 0x1, 0x0, 0x0, 0x20000005}, 0x24000000) sendmsg$NL802154_CMD_SET_SHORT_ADDR(r0, &(0x7f0000000480)={&(0x7f0000000380)={0x10, 0x0, 0x0, 0x8000}, 0xc, &(0x7f0000000440)={&(0x7f00000003c0)={0x44, 0x0, 0x100, 0x70bd2b, 0x25dfdbfb, {}, [@NL802154_ATTR_SHORT_ADDR={0x6}, @NL802154_ATTR_WPAN_DEV={0xc}, @NL802154_ATTR_WPAN_DEV={0xc, 0x6, 0x300000003}, @NL802154_ATTR_IFINDEX={0x8}, @NL802154_ATTR_IFINDEX={0x8}]}, 0x44}, 0x1, 0x0, 0x0, 0x400}, 0x80) openat$cgroup_netprio_ifpriomap(r1, &(0x7f00000004c0), 0x2, 0x0) r2 = openat$hwrng(0xffffffffffffff9c, &(0x7f0000000500), 0x20000, 0x0) getsockopt$inet6_mreq(r2, 0x29, 0x15, &(0x7f0000000540)={@mcast1}, &(0x7f0000000580)=0x14) getsockopt$inet6_mreq(r2, 0x29, 0x15, &(0x7f00000005c0)={@ipv4={""/10, ""/2, @initdev}}, &(0x7f0000000600)=0x14) r3 = io_uring_setup(0x5c38, &(0x7f0000000640)={0x0, 0x5b7f, 0x10, 0x2, 0x214, 0x0, r2}) io_uring_register$IORING_REGISTER_PERSONALITY(r3, 0x9, 0x0, 0x0) r4 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) sendmsg$NLBL_MGMT_C_REMOVEDEF(r4, &(0x7f0000000800)={&(0x7f00000006c0)={0x10, 0x0, 0x0, 0x4}, 0xc, &(0x7f00000007c0)={&(0x7f0000000700)={0x90, 0x0, 0x500, 0x70bd26, 0x25dfdbfe, {}, [@NLBL_MGMT_A_IPV6MASK={0x14, 0x6, @local}, @NLBL_MGMT_A_PROTOCOL={0x8, 0x2, 0x3}, @NLBL_MGMT_A_CLPDOI={0x8, 0xc, 0x2}, @NLBL_MGMT_A_IPV6ADDR={0x14, 0x5, @empty}, @NLBL_MGMT_A_IPV6MASK={0x14, 0x6, @private0={0xfc, 0x0, '\x00', 0x1}}, @NLBL_MGMT_A_IPV6MASK={0x14, 0x6, @private1}, @NLBL_MGMT_A_IPV6ADDR={0x14, 0x5, @rand_addr=' \x01\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x02'}, @NLBL_MGMT_A_FAMILY={0x6, 0xb, 0x2b}]}, 0x90}, 0x1, 0x0, 0x0, 0x80}, 0x90) sendmsg$IEEE802154_LLSEC_GETPARAMS(r4, &(0x7f0000000900)={&(0x7f0000000840)={0x10, 0x0, 0x0, 0x2000000}, 0xc, &(0x7f00000008c0)={&(0x7f0000000880)={0x28, 0x0, 0x20, 0x70bd29, 0x25dfdbfe, {}, [@IEEE802154_ATTR_DEV_INDEX={0x8}, @IEEE802154_ATTR_DEV_NAME={0xa, 0x1, 'wpan1\x00'}]}, 0x28}, 0x1, 0x0, 0x0, 0x24000001}, 0x100) ioctl$PERF_EVENT_IOC_SET_FILTER(0xffffffffffffffff, 0x40082406, &(0x7f0000000940)='/dev/hwrng\x00') ioctl$CDROM_SELECT_DISK(r1, 0x5322, 0xfff) openat$cgroup_ro(r1, &(0x7f0000000980)='hugetlb.1GB.usage_in_bytes\x00', 0x0, 0x0) ioctl$sock_SIOCGIFINDEX_802154(0xffffffffffffffff, 0x8933, &(0x7f0000000a00)={'wpan0\x00'}) ioctl$sock_SIOCGIFINDEX_802154(r4, 0x8933, &(0x7f0000000a40)={'wpan0\x00'}) 11:49:17 executing program 5: setitimer(0x0, &(0x7f0000000000)={{}, {0x0, 0xea60}}, &(0x7f0000000040)) getitimer(0x0, &(0x7f0000000080)) r0 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$netlbl_mgmt(&(0x7f0000000100), 0xffffffffffffffff) sendmsg$NLBL_MGMT_C_ADDDEF(r0, &(0x7f00000001c0)={&(0x7f00000000c0)={0x10, 0x0, 0x0, 0x1}, 0xc, &(0x7f0000000180)={&(0x7f0000000140)={0x1c, r1, 0x4, 0x70bd2a, 0x25dfdbff, {}, [@NLBL_MGMT_A_CLPDOI={0x8}]}, 0x1c}, 0x1, 0x0, 0x0, 0x4000000}, 0x40000) geteuid() syz_usb_connect$cdc_ecm(0x4, 0x10d, &(0x7f0000000200)={{0x12, 0x1, 0x720, 0x2, 0x0, 0x0, 0x10, 0x525, 0xa4a1, 0x40, 0x1, 0x2, 0x3, 0x1, [{{0x9, 0x2, 0xfb, 0x1, 0x1, 0xba, 0x50, 0xff, [{{0x9, 0x4, 0x0, 0x7, 0x2, 0x2, 0x6, 0x0, 0x7c, {{0x8, 0x24, 0x6, 0x0, 0x0, "fbf211"}, {0x5, 0x24, 0x0, 0x8}, {0xd, 0x24, 0xf, 0x1, 0x1, 0x3f, 0x3, 0x40}, [@mdlm_detail={0x99, 0x24, 0x13, 0x3, "48c1a1b655094616df62fff6017defd0bdac4f2617618052fc22350170d4b41a1affe05826274c5d93aa871d89455559c068d877251368c5b00552322da12b5958d76e60294d79d6bd527055bb53f40402ca669ba20042da00554f68b1b12b345fc2bb35f09aac73eb5ac2fcd8634e5e7252075c0d8ce0ad3e8dda63c3c27a6db1be131aa7525a018859895d6e885540b704d1f7dc"}, @country_functional={0xc, 0x24, 0x7, 0x90, 0x6, [0x4, 0x9, 0xe77]}, @obex={0x5, 0x24, 0x15, 0x8}, @acm={0x4, 0x24, 0x2, 0xd}, @ncm={0x6, 0x24, 0x1a, 0x7, 0x26}]}, {[{{0x9, 0x5, 0x81, 0x3, 0x1df, 0x81, 0x32, 0x1}}], {{0x9, 0x5, 0x82, 0x2, 0x3ff, 0x2, 0x6, 0x5}}, {{0x9, 0x5, 0x3, 0x2, 0x8, 0x1, 0x4, 0xff}}}}}]}}]}}, &(0x7f0000000640)={0xa, &(0x7f0000000340)={0xa, 0x6, 0x110, 0x3, 0xae, 0x8, 0xff, 0x1f}, 0x5, &(0x7f0000000380)={0x5, 0xf, 0x5}, 0x7, [{0x14, &(0x7f00000003c0)=@string={0x14, 0x3, "fd058c95bdf599f8e5f073eae7235e49a442"}}, {0x4, &(0x7f0000000400)=@lang_id={0x4, 0x3, 0x380a}}, {0x4, &(0x7f0000000440)=@lang_id={0x4, 0x3, 0x445}}, {0x4, &(0x7f0000000480)=@lang_id={0x4, 0x3, 0x2c0a}}, {0x4, &(0x7f00000004c0)=@lang_id={0x4, 0x3, 0x1001}}, {0x4, &(0x7f0000000500)=@lang_id={0x4, 0x3, 0x42a}}, {0xf1, &(0x7f0000000540)=@string={0xf1, 0x3, "84d5b48356934b18c11ca618df7ef64b6c011395cc6829bdeedd71e659bc7545af1fffa2149c42cd8da15a92d7564b65a135a440b298e19eddd0415c86d7b42e1c9641793180d54dedbc008eeb526d3540368aed104e9c9220a6d3e7f635e585d6e7f55ecaab0cf2111887b6e16bfe4c3f94f53b49e421698825847fc65ef965c3007893b9e33ccdbdb39b38af85a0863c618f0d2135ee175361a7f77a56730d8ae5c677510cf17584b6302361fc90e77b8e50675a5756fd20d5f4bc211f04b21de401616a64c3d1a1398527dca0fd098e082f7533b65e1f4626cc5cbfa742eac63bb0d848f069eb64132f065192e5"}}]}) r2 = syz_genetlink_get_family_id$nl802154(&(0x7f0000000700), r0) ioctl$sock_SIOCGIFINDEX_802154(r0, 0x8933, &(0x7f0000000740)={'wpan1\x00', 0x0}) ioctl$sock_SIOCGIFINDEX_802154(r0, 0x8933, &(0x7f0000000780)={'wpan3\x00', 0x0}) sendmsg$NL802154_CMD_NEW_SEC_LEVEL(r0, &(0x7f0000000840)={&(0x7f00000006c0)={0x10, 0x0, 0x0, 0x8000000}, 0xc, &(0x7f0000000800)={&(0x7f00000007c0)={0x38, r2, 0x1, 0x70bd2a, 0x25dfdbff, {}, [@NL802154_ATTR_IFINDEX={0x8, 0x3, r3}, @NL802154_ATTR_IFINDEX={0x8, 0x3, r4}, @NL802154_ATTR_WPAN_DEV={0xc, 0x6, 0x100000001}, @NL802154_ATTR_IFINDEX={0x8}]}, 0x38}, 0x1, 0x0, 0x0, 0x1}, 0x0) ioctl$CDROMREADAUDIO(0xffffffffffffffff, 0x530e, &(0x7f00000008c0)={@lba, 0x2, 0x3b, &(0x7f0000000880)=""/59}) ioctl$CDROMREADAUDIO(0xffffffffffffffff, 0x530e, &(0x7f0000000940)={@lba=0x7, 0x1, 0x24, &(0x7f0000000900)=""/36}) sendmsg$NLBL_MGMT_C_REMOVEDEF(r0, &(0x7f0000000a40)={&(0x7f0000000980)={0x10, 0x0, 0x0, 0x20000}, 0xc, &(0x7f0000000a00)={&(0x7f00000009c0)={0x34, r1, 0x100, 0x70bd2c, 0x25dfdbfd, {}, [@NLBL_MGMT_A_IPV4MASK={0x8, 0x8, @local}, @NLBL_MGMT_A_CV4DOI={0x8, 0x4, 0xffffffffffffffff}, @NLBL_MGMT_A_IPV4MASK={0x8, 0x8, @dev={0xac, 0x14, 0x14, 0x39}}, @NLBL_MGMT_A_IPV4ADDR={0x8, 0x7, @private=0xa010102}]}, 0x34}, 0x1, 0x0, 0x0, 0x40}, 0x8011) ioctl$sock_SIOCGIFINDEX_802154(r0, 0x8933, &(0x7f0000000ac0)={'wpan1\x00', 0x0}) ioctl$sock_SIOCGIFINDEX_802154(0xffffffffffffffff, 0x8933, &(0x7f0000000b00)={'wpan1\x00', 0x0}) sendmsg$NL802154_CMD_GET_SEC_KEY(r0, &(0x7f0000000c00)={&(0x7f0000000a80)={0x10, 0x0, 0x0, 0x400000}, 0xc, &(0x7f0000000bc0)={&(0x7f0000000b40)={0x4c, r2, 0x410, 0x70bd29, 0x25dfdbff, {}, [@NL802154_ATTR_IFINDEX={0x8, 0x3, r3}, @NL802154_ATTR_IFINDEX={0x8, 0x3, r5}, @NL802154_ATTR_WPAN_DEV={0xc, 0x6, 0x300000003}, @NL802154_ATTR_IFINDEX={0x8, 0x3, r6}, @NL802154_ATTR_IFINDEX={0x8, 0x3, r3}, @NL802154_ATTR_WPAN_DEV={0xc}]}, 0x4c}, 0x1, 0x0, 0x0, 0xd4}, 0x801) syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) sendmsg$NL802154_CMD_SET_ACKREQ_DEFAULT(0xffffffffffffffff, &(0x7f0000000d40)={&(0x7f0000000c80)={0x10, 0x0, 0x0, 0x10000}, 0xc, &(0x7f0000000d00)={&(0x7f0000000cc0)={0x20, r2, 0x800, 0x70bd29, 0x25dfdbfb, {}, [@NL802154_ATTR_WPAN_DEV={0xc, 0x6, 0x2}]}, 0x20}, 0x1, 0x0, 0x0, 0x1}, 0x8080) VM DIAGNOSIS: 11:49:08 Registers: info registers vcpu 0 RAX=dffffc0000000005 RBX=00000000000003f9 RCX=0000000000000000 RDX=00000000000003f9 RSI=ffffffff82977eb0 RDI=ffffffff889c1a00 RBP=ffffffff889c19c0 RSP=ffff8880422e7490 R8 =0000000000000001 R9 =ffffed100845ce83 R10=0000000000000000 R11=666666203a332320 R12=0000000000000067 R13=ffffffff889c1a10 R14=ffffffff889c19c0 R15=ffffffff889c1c80 RIP=ffffffff82977f05 RFL=00000006 [-----P-] CPL=0 II=0 A20=1 SMM=0 HLT=0 ES =0000 0000000000000000 00000000 00000000 CS =0010 0000000000000000 ffffffff 00a09b00 DPL=0 CS64 [-RA] SS =0018 0000000000000000 ffffffff 00c09300 DPL=0 DS [-WA] DS =0000 0000000000000000 00000000 00000000 FS =0000 0000555560b81400 00000000 00000000 GS =0000 ffff8880e5342000 00000000 00000000 LDT=0000 fffffe4f00000000 00000000 00000000 TR =0040 fffffe0000003000 00004087 00008b00 DPL=0 TSS64-busy GDT= fffffe0000001000 0000007f IDT= fffffe0000000000 00000fff CR0=80050033 CR2=00007fff9b3e0f88 CR3=0000000042be4000 CR4=00350ef0 DR0=0000000000000000 DR1=0000000000000000 DR2=0000000000000000 DR3=0000000000000000 DR6=00000000ffff0ff0 DR7=0000000000000400 EFER=0000000000000d01 FCW=037f FSW=0000 [ST=0] FTW=00 MXCSR=00001f80 FPR0=0000000000000000 0000 FPR1=0000000000000000 0000 FPR2=0000000000000000 0000 FPR3=0000000000000000 0000 FPR4=0000000000000000 0000 FPR5=0000000000000000 0000 FPR6=0000000000000000 0000 FPR7=0000000000000000 0000 XMM00=00000000a60ce07b00000000cec3662e XMM01=000000000000000003515b82db34ca11 XMM02=0000000000000000333bebdfd0a6a21d XMM03=00000000000000000000000000000000 XMM04=ffffffff0000ff00000000ff00000000 XMM05=00000000000000000000000000000000 XMM06=00000000000000000000000000000000 XMM07=00000000000000000000000000000000 XMM08=00000000000000000000000000000000 XMM09=00000000000000000000000000000000 XMM10=00000000000000000000000000000000 XMM11=00000000000000000000000000000000 XMM12=00000000000000000000000000000000 XMM13=00000000000000000000000000000000 XMM14=00000000000000000000000000000000 XMM15=00000000000000000000000000000000 info registers vcpu 1 RAX=0000000000000000 RBX=0000000000000033 RCX=ffffffff819ea834 RDX=1ffff110015316cd RSI=0000000000000033 RDI=0000000000000033 RBP=ffff88800a98b640 RSP=ffff8880436d7710 R8 =0000000000000001 R9 =ffffed10012ab6bc R10=0000000000000000 R11=00007f84fa800fff R12=0000000000000033 R13=0000000000000000 R14=0000000000000000 R15=ffff88800a98b660 RIP=ffffffff81757c20 RFL=00000246 [---Z-P-] CPL=0 II=0 A20=1 SMM=0 HLT=0 ES =0000 0000000000000000 00000000 00000000 CS =0010 0000000000000000 ffffffff 00a09b00 DPL=0 CS64 [-RA] SS =0018 0000000000000000 ffffffff 00c09300 DPL=0 DS [-WA] DS =0000 0000000000000000 00000000 00000000 FS =0000 0000000000000000 00000000 00000000 GS =0000 ffff8880e5442000 00000000 00000000 LDT=0000 fffffe4500000000 00000000 00000000 TR =0040 fffffe000004a000 00004087 00008b00 DPL=0 TSS64-busy GDT= fffffe0000048000 0000007f IDT= fffffe0000000000 00000fff CR0=80050033 CR2=00007f84fa7e6260 CR3=0000000042330000 CR4=00350ef0 DR0=0000000000000000 DR1=0000000000000000 DR2=0000000000000000 DR3=0000000000000000 DR6=00000000ffff0ff0 DR7=0000000000000400 EFER=0000000000000d01 FCW=037f FSW=0000 [ST=0] FTW=00 MXCSR=00001f80 FPR0=0000000000000000 0000 FPR1=0000000000000000 0000 FPR2=0000000000000000 0000 FPR3=0000000000000000 0000 FPR4=0000000000000000 0000 FPR5=0000000000000000 0000 FPR6=0000000000000000 0000 FPR7=0000000000000000 0000 XMM00=756e696c2d34365f3638782f62696c2f XMM01=2e6f747079726362696c2f756e672d78 XMM02=00312e312e6f732e6f74707972636269 XMM03=6c2f756e672d78756e696c2d34365f36 XMM04=00000000000000000000000000000000 XMM05=00000000000000000000000000000000 XMM06=00000000000000000000000000000000 XMM07=00000000000000000000000000000000 XMM08=00000000000000000000000000000000 XMM09=00000000000000000000000000000000 XMM10=00000000000000000000000000000000 XMM11=00000000000000000000000000000000 XMM12=00000000000000000000000000000000 XMM13=00000000000000000000000000000000 XMM14=00000000000000000000000000000000 XMM15=00000000000000000000000000000000