Warning: Permanently added '[localhost]:23606' (ECDSA) to the list of known hosts. 2026/01/17 08:20:01 fuzzer started 2026/01/17 08:20:01 dialing manager at localhost:42157 syzkaller login: [ 52.084303] cgroup: Unknown subsys name 'net' [ 52.154100] cgroup: Unknown subsys name 'cpuset' [ 52.175190] cgroup: Unknown subsys name 'rlimit' 2026/01/17 08:20:13 syscalls: 212 2026/01/17 08:20:13 code coverage: enabled 2026/01/17 08:20:13 comparison tracing: enabled 2026/01/17 08:20:13 extra coverage: enabled 2026/01/17 08:20:13 setuid sandbox: enabled 2026/01/17 08:20:13 namespace sandbox: enabled 2026/01/17 08:20:13 Android sandbox: enabled 2026/01/17 08:20:13 fault injection: enabled 2026/01/17 08:20:13 leak checking: enabled 2026/01/17 08:20:13 net packet injection: enabled 2026/01/17 08:20:13 net device setup: enabled 2026/01/17 08:20:13 concurrency sanitizer: /sys/kernel/debug/kcsan does not exist 2026/01/17 08:20:13 devlink PCI setup: PCI device 0000:00:10.0 is not available 2026/01/17 08:20:13 USB emulation: enabled 2026/01/17 08:20:13 hci packet injection: enabled 2026/01/17 08:20:13 wifi device emulation: enabled 2026/01/17 08:20:13 802.15.4 emulation: enabled 2026/01/17 08:20:13 fetching corpus: 0, signal 0/0 (executing program) 2026/01/17 08:20:14 starting 8 fuzzer processes 08:20:14 executing program 0: r0 = syz_open_dev$tty20(0xc, 0x4, 0x0) ioctl$TIOCGSID(r0, 0x5429, &(0x7f0000000000)) r1 = syz_open_dev$tty1(0xc, 0x4, 0x2) ioctl$TIOCSRS485(r1, 0x542f, &(0x7f0000000040)={0x7, 0x8, 0x8a9}) ioctl$TIOCSPTLCK(r1, 0x40045431, &(0x7f0000000080)=0x1) r2 = ioctl$TIOCGPTPEER(r1, 0x5441, 0x2) ioctl$KDGETMODE(r2, 0x4b3b, &(0x7f00000000c0)) r3 = fsmount(0xffffffffffffffff, 0x1, 0x84) ioctl$TIOCGSID(r3, 0x5429, &(0x7f0000000100)) ioctl$TIOCSWINSZ(r3, 0x5414, &(0x7f0000000140)={0xc1, 0x5, 0x7ff, 0x7}) r4 = openat$ttyS3(0xffffffffffffff9c, &(0x7f0000000180), 0x1, 0x0) ioctl$GIO_UNISCRNMAP(r4, 0x4b69, &(0x7f00000001c0)=""/131) r5 = epoll_create1(0x0) epoll_ctl$EPOLL_CTL_MOD(r5, 0x3, 0xffffffffffffffff, &(0x7f0000000280)={0x10}) r6 = openat$null(0xffffffffffffff9c, &(0x7f00000002c0), 0x800, 0x0) syz_io_uring_submit(0x0, 0x0, &(0x7f00000003c0)=@IORING_OP_ACCEPT={0xd, 0x1, 0x0, r6, &(0x7f0000000300)=0x80, &(0x7f0000000340)=@ethernet={0x0, @multicast}}, 0x40) ioctl$TIOCSRS485(r3, 0x542f, &(0x7f0000000400)={0x0, 0x80000000, 0xff}) ioctl$TIOCL_GETMOUSEREPORTING(0xffffffffffffffff, 0x541c, &(0x7f0000000440)) ioctl$KDGETMODE(r4, 0x4b3b, &(0x7f0000000480)) ioctl$GIO_UNISCRNMAP(r3, 0x4b69, &(0x7f00000004c0)=""/104) 08:20:14 executing program 1: r0 = socket(0x1d, 0x4, 0x3) epoll_ctl$EPOLL_CTL_ADD(0xffffffffffffffff, 0x1, r0, &(0x7f0000000000)={0x8}) r1 = socket(0x23, 0x2, 0x6) sendmsg$BATADV_CMD_GET_BLA_BACKBONE(r0, &(0x7f0000000140)={&(0x7f0000000040)={0x10, 0x0, 0x0, 0x200000}, 0xc, &(0x7f0000000100)={&(0x7f0000000080)={0x54, 0x0, 0x8, 0x70bd2d, 0x25dfdbfb, {}, [@BATADV_ATTR_THROUGHPUT_OVERRIDE={0x8, 0x3b, 0x4000}, @BATADV_ATTR_ORIG_ADDRESS={0xa, 0x9, @broadcast}, @BATADV_ATTR_ORIG_ADDRESS={0xa, 0x9, @remote}, @BATADV_ATTR_DISTRIBUTED_ARP_TABLE_ENABLED={0x5, 0x2f, 0x1}, @BATADV_ATTR_AP_ISOLATION_ENABLED={0x5, 0x2a, 0x1}, @BATADV_ATTR_AGGREGATED_OGMS_ENABLED={0x5}, @BATADV_ATTR_GW_SEL_CLASS={0x8, 0x34, 0x4}]}, 0x54}, 0x1, 0x0, 0x0, 0x800}, 0x22008003) ioctl$ifreq_SIOCGIFINDEX_batadv_mesh(r0, 0x8933, &(0x7f0000000180)={'batadv0\x00', 0x0}) ioctl$sock_ipv6_tunnel_SIOCDELTUNNEL(r1, 0x89f2, &(0x7f0000000240)={'ip6_vti0\x00', &(0x7f00000001c0)={'syztnl2\x00', r2, 0x2f, 0xf7, 0x1, 0x3ff, 0x1, @remote, @ipv4={'\x00', '\xff\xff', @dev={0xac, 0x14, 0x14, 0x19}}, 0x7, 0x700, 0x7fff, 0x1}}) ioctl$sock_ipv4_tunnel_SIOCGETTUNNEL(r1, 0x89f0, &(0x7f0000000380)={'syztnl0\x00', &(0x7f00000002c0)={'syztnl2\x00', r3, 0x8, 0x7, 0x1f, 0x8, {{0x19, 0x4, 0x1, 0x12, 0x64, 0x64, 0x0, 0x1, 0x2f, 0x0, @empty, @remote, {[@ra={0x94, 0x4, 0x1}, @timestamp_addr={0x44, 0xc, 0xc0, 0x1, 0xe, [{@dev={0xac, 0x14, 0x14, 0x11}, 0x9}]}, @cipso={0x86, 0x1b, 0x1, [{0x7, 0x3, "ee"}, {0x0, 0x12, "773efae1457b4b2a2bc243d7a1b87b1a"}]}, @ra={0x94, 0x4}, @lsrr={0x83, 0x3, 0xc9}, @rr={0x7, 0x13, 0x70, [@remote, @rand_addr=0x64010101, @remote, @loopback]}, @ra={0x94, 0x4}, @ra={0x94, 0x4, 0x1}]}}}}}) sendmsg$BATADV_CMD_GET_GATEWAYS(r1, &(0x7f0000000440)={&(0x7f0000000280)={0x10, 0x0, 0x0, 0x1000}, 0xc, &(0x7f0000000400)={&(0x7f00000003c0)={0x24, 0x0, 0x8, 0x70bd2c, 0x25dfdbfc, {}, [@BATADV_ATTR_HARD_IFINDEX={0x8, 0x6, r4}, @BATADV_ATTR_ELP_INTERVAL={0x8, 0x3a, 0x7}]}, 0x24}, 0x1, 0x0, 0x0, 0x800}, 0x24044001) epoll_ctl$EPOLL_CTL_ADD(0xffffffffffffffff, 0x1, r1, &(0x7f0000000480)={0x14}) setsockopt$inet_tcp_TCP_REPAIR(r1, 0x6, 0x13, &(0x7f00000004c0)=0x1, 0x4) r5 = syz_genetlink_get_family_id$batadv(&(0x7f0000000540), r1) sendmsg$BATADV_CMD_SET_MESH(r1, &(0x7f0000000600)={&(0x7f0000000500)={0x10, 0x0, 0x0, 0x10000000}, 0xc, &(0x7f00000005c0)={&(0x7f0000000580)={0x24, r5, 0x10, 0x70bd2b, 0x25dfdbfe, {}, [@BATADV_ATTR_ORIG_INTERVAL={0x8, 0x39, 0x200}, @BATADV_ATTR_ISOLATION_MASK={0x8}]}, 0x24}, 0x1, 0x0, 0x0, 0x4000000}, 0x24000000) r6 = openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000640)='./cgroup.cpu/syz0\x00', 0x200002, 0x0) epoll_ctl$EPOLL_CTL_ADD(0xffffffffffffffff, 0x1, r6, &(0x7f0000000680)={0x80000010}) syz_io_uring_setup(0x68d8, &(0x7f00000006c0)={0x0, 0x816b, 0x4, 0x3, 0xd3}, &(0x7f0000ffe000/0x1000)=nil, &(0x7f0000ffa000/0x4000)=nil, &(0x7f0000000740), &(0x7f0000000780)=0x0) syz_io_uring_submit(0x0, r7, &(0x7f00000007c0)=@IORING_OP_READ_FIXED={0x4, 0x4, 0x6000, @fd_index=0x7, 0x9, 0x6, 0x8000, 0x4, 0x0, {0x1}}, 0x7ff) sendmsg$BATADV_CMD_GET_DAT_CACHE(r0, &(0x7f00000008c0)={&(0x7f0000000800)={0x10, 0x0, 0x0, 0x10000}, 0xc, &(0x7f0000000880)={&(0x7f0000000840)={0x3c, r5, 0x2, 0x70bd2c, 0x25dfdbfd, {}, [@BATADV_ATTR_ORIG_INTERVAL={0x8, 0x39, 0x1}, @BATADV_ATTR_HOP_PENALTY={0x5, 0x35, 0x4}, @BATADV_ATTR_THROUGHPUT_OVERRIDE={0x8, 0x3b, 0x200}, @BATADV_ATTR_DISTRIBUTED_ARP_TABLE_ENABLED={0x5}, @BATADV_ATTR_GW_BANDWIDTH_UP={0x8, 0x32, 0xc5}]}, 0x3c}, 0x1, 0x0, 0x0, 0x20008000}, 0x4000000) ioctl$TCSETSF(0xffffffffffffffff, 0x5404, &(0x7f0000000900)={0x20, 0xffffffff, 0xfffffffc, 0x6, 0x17, "a9356d56911aecafa41c6efd030447fa097f76"}) setsockopt$inet_tcp_TCP_ULP(r0, 0x6, 0x1f, &(0x7f0000000940), 0x4) ptrace$getsig(0x4202, 0x0, 0x20, &(0x7f0000000980)) 08:20:14 executing program 3: getresgid(&(0x7f0000000000), &(0x7f0000000040)=0x0, &(0x7f0000000080)=0x0) getresgid(&(0x7f00000000c0), &(0x7f0000000100)=0x0, &(0x7f0000000140)) setregid(r1, r2) sendmsg$BATADV_CMD_GET_MESH(0xffffffffffffffff, &(0x7f0000000280)={&(0x7f0000000180), 0xc, &(0x7f0000000240)={&(0x7f00000001c0)={0x68, 0x0, 0x4, 0x70bd2b, 0x25dfdbfd, {}, [@BATADV_ATTR_ISOLATION_MARK={0x8, 0x2b, 0x61c}, @BATADV_ATTR_NETWORK_CODING_ENABLED={0x5, 0x38, 0x1}, @BATADV_ATTR_ELP_INTERVAL={0x8, 0x3a, 0xfffffffb}, @BATADV_ATTR_VLANID={0x6, 0x28, 0x2}, @BATADV_ATTR_BONDING_ENABLED={0x5, 0x2d, 0x1}, @BATADV_ATTR_BONDING_ENABLED={0x5}, @BATADV_ATTR_GW_BANDWIDTH_DOWN={0x8, 0x31, 0x8}, @BATADV_ATTR_GW_BANDWIDTH_UP={0x8, 0x32, 0x7}, @BATADV_ATTR_ELP_INTERVAL={0x8, 0x3a, 0x7f}, @BATADV_ATTR_ORIG_ADDRESS={0xa, 0x9, @multicast}]}, 0x68}, 0x1, 0x0, 0x0, 0x880}, 0x1) getresgid(&(0x7f0000000300)=0x0, &(0x7f0000000340), &(0x7f0000000380)) setregid(r0, r3) getresgid(&(0x7f00000003c0)=0x0, &(0x7f0000000400), &(0x7f0000000440)) setgid(r4) getresuid(&(0x7f0000000580), &(0x7f00000005c0), &(0x7f0000000600)=0x0) mount$9p_fd(0x0, &(0x7f0000000480)='./file0\x00', &(0x7f00000004c0), 0x2, &(0x7f0000000640)={'trans=fd,', {}, 0x2c, {}, 0x2c, {[{@afid={'afid', 0x3d, 0x6}}], [{@uid_lt={'uid<', r5}}, {@subj_role}, {@fsuuid={'fsuuid', 0x3d, {[0x64, 0x61, 0x32, 0x32, 0x36, 0x31, 0x64, 0x64], 0x2d, [0x36, 0x39, 0x64, 0x33], 0x2d, [0x65, 0x38, 0x61, 0x33], 0x2d, [0x39, 0x62, 0x62, 0x66], 0x2d, [0x64, 0x36, 0x37, 0x39, 0x31, 0x39, 0x38, 0x34]}}}, {@seclabel}, {@context={'context', 0x3d, 'root'}}, {@smackfsfloor={'smackfsfloor', 0x3d, '\xbb\xbb\xbb\xbb\xbb\xbb'}}, {@smackfsfloor={'smackfsfloor', 0x3d, '\xbb\xbb\xbb\xbb\xbb\xbb'}}, {@audit}, {@smackfsdef={'smackfsdef', 0x3d, '\xbb\xbb\xbb\xbb\xbb\xbb'}}, {@context={'context', 0x3d, 'system_u'}}]}}) r6 = io_uring_setup(0x595b, &(0x7f0000000780)={0x0, 0xd16a, 0x0, 0x3, 0x10c}) pipe2$9p(&(0x7f0000000880)={0xffffffffffffffff}, 0x6800) r8 = geteuid() mount$9p_fd(0x0, &(0x7f0000000800)='./file0\x00', &(0x7f0000000840), 0x100c10, &(0x7f00000008c0)={'trans=fd,', {'rfdno', 0x3d, r7}, 0x2c, {'wfdno', 0x3d, r6}, 0x2c, {[{@debug={'debug', 0x3d, 0x8}}, {@access_client}, {@version_9p2000}, {@fscache}], [{@dont_measure}, {@dont_appraise}, {@obj_type={'obj_type', 0x3d, 'root'}}, {@fsuuid={'fsuuid', 0x3d, {[0x36, 0x31, 0x64, 0x32, 0x32, 0x31, 0x61, 0x38], 0x2d, [0x63, 0x61, 0x36, 0x32], 0x2d, [0x37, 0x65, 0x39, 0x38], 0x2d, [0x37, 0x65, 0x33], 0x2d, [0x57, 0x66, 0x65, 0x42, 0x30, 0x66, 0x31, 0x30]}}}, {@smackfstransmute={'smackfstransmute', 0x3d, '9p\x00'}}, {@fowner_lt={'fowner<', r8}}, {@seclabel}, {@audit}]}}) ioctl$PTP_PEROUT_REQUEST(0xffffffffffffffff, 0x40383d03, &(0x7f0000000a00)={{0x2}, {0x6, 0x8}, 0x81}) r9 = openat$null(0xffffffffffffff9c, &(0x7f0000000ac0), 0x40000, 0x0) mount$9p_fd(0x0, &(0x7f0000000a40)='./file0\x00', &(0x7f0000000a80), 0x2000, &(0x7f0000000b00)={'trans=fd,', {'rfdno', 0x3d, r7}, 0x2c, {'wfdno', 0x3d, r9}, 0x2c, {[{@privport}, {@access_user}, {@version_u}, {@noextend}, {@cache_fscache}, {@version_u}], [{@smackfshat={'smackfshat', 0x3d, '\x12'}}, {@subj_type={'subj_type', 0x3d, '#\xad*.'}}, {@smackfsroot={'smackfsroot', 0x3d, 'fsuuid'}}, {@fsuuid={'fsuuid', 0x3d, {[0x38, 0x61, 0x61, 0x32, 0x35, 0x39, 0x63, 0x39], 0x2d, [0x34, 0x39, 0x64, 0x66], 0x2d, [0x65, 0x64, 0x64, 0x66], 0x2d, [0x38, 0x31, 0x37, 0x36], 0x2d, [0x62, 0x39, 0x39, 0x33, 0x39, 0x64, 0x38, 0x36]}}}]}}) r10 = fsmount(r9, 0x0, 0x6b) ioctl$TIOCSPGRP(r10, 0x5410, &(0x7f0000000c00)=0xffffffffffffffff) setgid(r3) 08:20:14 executing program 2: mmap$IORING_OFF_SQ_RING(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x1000000, 0x20010, 0xffffffffffffffff, 0x0) ioctl$TIOCL_SCROLLCONSOLE(0xffffffffffffffff, 0x541c, &(0x7f0000000000)={0xd, 0x8e5}) r0 = perf_event_open$cgroup(&(0x7f0000000080)={0x2, 0x80, 0x20, 0x7, 0x5e, 0x5, 0x0, 0x40, 0x200, 0x8, 0x0, 0x1, 0x1, 0x1, 0x1, 0x0, 0x1, 0x1, 0x1, 0x0, 0x0, 0x1, 0x0, 0x1, 0x1, 0x3, 0x1, 0x0, 0x1, 0x1, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x1, 0x0, 0x1, 0x0, 0x0, 0x0, 0x200, 0x1, @perf_bp={&(0x7f0000000040), 0x2}, 0x4060, 0xffffffffffffff00, 0xfffffff7, 0x0, 0x5, 0x5, 0x0, 0x0, 0x6, 0x0, 0x30}, 0xffffffffffffffff, 0x10, 0xffffffffffffffff, 0x8) ioctl$PERF_EVENT_IOC_QUERY_BPF(r0, 0xc008240a, &(0x7f0000000100)={0x8, 0x0, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0]}) sendmsg$BATADV_CMD_GET_VLAN(0xffffffffffffffff, &(0x7f0000000240)={&(0x7f0000000140)={0x10, 0x0, 0x0, 0x20}, 0xc, &(0x7f0000000200)={&(0x7f0000000180)={0x4c, 0x0, 0x200, 0x70bd2b, 0x25dfdbfc, {}, [@BATADV_ATTR_ELP_INTERVAL={0x8, 0x3a, 0x1}, @BATADV_ATTR_ISOLATION_MASK={0x8, 0x2c, 0x1}, @BATADV_ATTR_ISOLATION_MASK={0x8, 0x2c, 0x80000001}, @BATADV_ATTR_MESH_IFINDEX={0x8}, @BATADV_ATTR_BRIDGE_LOOP_AVOIDANCE_ENABLED={0x5}, @BATADV_ATTR_ISOLATION_MASK={0x8, 0x2c, 0x1}, @BATADV_ATTR_ISOLATION_MASK={0x8, 0x2c, 0x81}]}, 0x4c}, 0x1, 0x0, 0x0, 0x4000000}, 0x200008d0) r1 = openat$ptp0(0xffffffffffffff9c, &(0x7f0000000280), 0x102002, 0x0) ioctl$PTP_SYS_OFFSET_PRECISE(r1, 0xc0403d08, &(0x7f00000002c0)) sendmsg$BATADV_CMD_GET_TRANSTABLE_GLOBAL(0xffffffffffffffff, &(0x7f0000000400)={&(0x7f0000000300)={0x10, 0x0, 0x0, 0x2}, 0xc, &(0x7f00000003c0)={&(0x7f0000000340)={0x50, 0x0, 0x2, 0x70bd26, 0x25dfdbfc, {}, [@BATADV_ATTR_ELP_INTERVAL={0x8, 0x3a, 0x9}, @BATADV_ATTR_DISTRIBUTED_ARP_TABLE_ENABLED={0x5, 0x2f, 0x1}, @BATADV_ATTR_ISOLATION_MARK={0x8, 0x2b, 0x20}, @BATADV_ATTR_THROUGHPUT_OVERRIDE={0x8, 0x3b, 0x20}, @BATADV_ATTR_ORIG_ADDRESS={0xa}, @BATADV_ATTR_MESH_IFINDEX={0x8}, @BATADV_ATTR_ORIG_INTERVAL={0x8, 0x39, 0x1}]}, 0x50}}, 0x20004800) r2 = openat$null(0xffffffffffffff9c, &(0x7f0000000440), 0x440, 0x0) ioctl$PERF_EVENT_IOC_SET_OUTPUT(r0, 0x2405, r2) epoll_ctl$EPOLL_CTL_DEL(0xffffffffffffffff, 0x2, r1) io_uring_setup(0x39ad, &(0x7f0000000480)={0x0, 0x5964, 0x8, 0x3, 0x10, 0x0, r2}) ioctl$PERF_EVENT_IOC_DISABLE(r2, 0x2401, 0x2) fsconfig$FSCONFIG_SET_FD(r2, 0x5, &(0x7f0000000500)='/dev/ptp0\x00', 0x0, 0xffffffffffffffff) r3 = perf_event_open$cgroup(&(0x7f0000000580)={0x4, 0x80, 0x4, 0x5, 0xf0, 0x3f, 0x0, 0x20, 0x4040, 0xc, 0x0, 0x1, 0x1, 0x1, 0x0, 0x1, 0x0, 0x1, 0x1, 0x1, 0x0, 0x1, 0x0, 0x1, 0x1, 0x2, 0x1, 0x0, 0x1, 0x1, 0x1, 0x1, 0x0, 0x1, 0x1, 0x0, 0x1, 0x1, 0x1, 0x1, 0x1, 0x1, 0x1, 0x0, 0x1, 0x0, 0x0, 0x0, 0x80000000, 0x2, @perf_bp={&(0x7f0000000540), 0x7}, 0x204, 0x1, 0x6, 0x6, 0x5d9, 0x0, 0x5, 0x0, 0x4, 0x0, 0x9}, r2, 0x2, 0xffffffffffffffff, 0x0) ioctl$PERF_EVENT_IOC_PAUSE_OUTPUT(r3, 0x40042409, 0x0) r4 = io_uring_setup(0xfbf, &(0x7f0000000600)={0x0, 0xc8b, 0x4, 0x2, 0x1f3, 0x0, r2}) mmap$IORING_OFF_SQ_RING(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x9, 0x11, r4, 0x0) ioctl$PTP_CLOCK_GETCAPS(r2, 0x80503d01, &(0x7f0000000680)) fsopen(&(0x7f0000000700)='ecryptfs\x00', 0x1) 08:20:14 executing program 4: r0 = io_uring_setup(0x64cf, &(0x7f0000000000)={0x0, 0x97b7, 0x20, 0x3, 0x3b7}) r1 = fsmount(0xffffffffffffffff, 0x0, 0x0) r2 = syz_io_uring_setup(0x354a, &(0x7f0000000080)={0x0, 0x44c0, 0x10, 0x1, 0x373, 0x0, r1}, &(0x7f0000ffa000/0x4000)=nil, &(0x7f0000ffa000/0x4000)=nil, &(0x7f0000000100), &(0x7f0000000140)) ioctl$SNAPSHOT_ATOMIC_RESTORE(r1, 0x3304) r3 = fsmount(r1, 0x1, 0x70) setsockopt$inet_tcp_TCP_CONGESTION(r1, 0x6, 0xd, &(0x7f0000000180)='bic\x00', 0x4) setsockopt$inet_tcp_TCP_QUEUE_SEQ(r1, 0x6, 0x15, &(0x7f00000001c0)=0x4583bca4, 0x4) ioctl$TIOCSSOFTCAR(r3, 0x541a, &(0x7f0000000200)=0x6) ioctl$sock_ipv6_tunnel_SIOCDEL6RD(r3, 0x89fa, &(0x7f00000002c0)={'ip6_vti0\x00', &(0x7f0000000240)={'sit0\x00', 0x0, 0x29, 0x1, 0x9, 0x100, 0x11, @private2, @empty, 0x80, 0x8, 0xc6e, 0x1}}) ioctl$sock_ipv6_tunnel_SIOCDELTUNNEL(r1, 0x89f2, &(0x7f0000000380)={'syztnl1\x00', &(0x7f0000000300)={'ip6gre0\x00', r4, 0x4, 0x1, 0x80, 0xd5bd, 0x12, @rand_addr=' \x01\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x02', @private2={0xfc, 0x2, '\x00', 0x1}, 0x8000, 0x1, 0x3, 0x34ff}}) r5 = fsmount(r3, 0x1, 0x8c) ioctl$ifreq_SIOCGIFINDEX_batadv_mesh(r3, 0x8933, &(0x7f00000003c0)={'batadv0\x00', 0x0}) ioctl$sock_ipv6_tunnel_SIOCDELTUNNEL(r5, 0x89f2, &(0x7f0000000480)={'ip6tnl0\x00', &(0x7f0000000400)={'syztnl2\x00', r6, 0x2f, 0x40, 0x9, 0x80000000, 0x10, @private0={0xfc, 0x0, '\x00', 0x1}, @dev={0xfe, 0x80, '\x00', 0x16}, 0x8, 0x7, 0x8}}) mmap$IORING_OFF_SQ_RING(&(0x7f0000ffa000/0x1000)=nil, 0x1000, 0xd, 0x40010, r0, 0x0) r7 = fsmount(r3, 0x0, 0x75) mmap$IORING_OFF_SQ_RING(&(0x7f0000ffc000/0x4000)=nil, 0x4000, 0x2000000, 0x10010, r2, 0x0) r8 = openat$null(0xffffffffffffff9c, &(0x7f0000000540), 0xc000, 0x0) fsconfig$FSCONFIG_SET_PATH(0xffffffffffffffff, 0x3, &(0x7f00000004c0)=' \x01\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x02', &(0x7f0000000500)='./file0\x00', r8) ioctl$TIOCGSID(r7, 0x5429, &(0x7f0000000580)=0x0) kcmp$KCMP_EPOLL_TFD(r9, 0x0, 0x7, 0xffffffffffffffff, &(0x7f00000005c0)={0xffffffffffffffff, r3}) [ 63.793607] audit: type=1400 audit(1768638014.969:7): avc: denied { execmem } for pid=273 comm="syz-executor.0" scontext=system_u:system_r:kernel_t:s0 tcontext=system_u:system_r:kernel_t:s0 tclass=process permissive=1 08:20:15 executing program 5: r0 = ioctl$TIOCGPTPEER(0xffffffffffffffff, 0x5441, 0xfffffffffffffff7) ioctl$PIO_FONTRESET(r0, 0x4b6d, 0x0) ioctl$KDGETMODE(r0, 0x4b3b, &(0x7f0000000000)) ioctl$VT_RESIZEX(r0, 0x560a, &(0x7f0000000040)={0x401, 0x4, 0x0, 0x7, 0x1, 0x6}) r1 = epoll_create1(0x80000) r2 = openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000080)='./cgroup/syz0\x00', 0x200002, 0x0) epoll_ctl$EPOLL_CTL_ADD(r1, 0x1, r2, &(0x7f00000000c0)={0x20000001}) ioctl$TIOCSPTLCK(r0, 0x40045431, &(0x7f0000000100)) ioctl$TIOCSPTLCK(r0, 0x40045431, &(0x7f0000000140)) r3 = openat$ttyS3(0xffffffffffffff9c, &(0x7f0000000180), 0x422800, 0x0) ioctl$TIOCSPGRP(r3, 0x5410, &(0x7f00000001c0)) r4 = syz_open_dev$ttys(0xc, 0x2, 0x1) ioctl$VT_RESIZEX(r4, 0x560a, &(0x7f0000000200)={0x40, 0x5, 0x1, 0x8001, 0x800, 0xfffa}) ioctl$TIOCGPTPEER(r4, 0x5441, 0x910000000000) r5 = fork() ptrace$getsig(0x4202, r5, 0x9, &(0x7f0000000240)) syz_open_dev$tty1(0xc, 0x4, 0x4) r6 = socket$nl_generic(0x10, 0x3, 0x10) mount$9p_fd(0x0, &(0x7f00000002c0)='./file0\x00', &(0x7f0000000300), 0x1040404, &(0x7f0000000340)={'trans=fd,', {}, 0x2c, {'wfdno', 0x3d, r6}, 0x2c, {[{@dfltuid={'dfltuid', 0x3d, 0xffffffffffffffff}}, {@cache_loose}, {@cache_fscache}, {@mmap}, {@cache_fscache}, {@dfltgid}], [{@obj_type={'obj_type', 0x3d, '/dev/ttyS3\x00'}}, {@subj_user={'subj_user', 0x3d, '!'}}]}}) ioctl$VT_RESIZEX(r4, 0x560a, &(0x7f0000000400)={0x7, 0x5, 0xfff, 0x9, 0xfffd, 0x5}) 08:20:15 executing program 6: iopl(0x1) ioctl$TIOCSSOFTCAR(0xffffffffffffffff, 0x541a, &(0x7f0000000000)=0x800) ioctl$CDROM_MEDIA_CHANGED(0xffffffffffffffff, 0x5325, 0x6) r0 = openat$null(0xffffffffffffff9c, &(0x7f0000000040), 0x10000, 0x0) ioctl$PTP_PIN_GETFUNC2(r0, 0xc0603d0f, &(0x7f0000000080)={'\x00', 0x2, 0x3, 0x507}) r1 = openat$ptp0(0xffffffffffffff9c, &(0x7f0000000100), 0x200000, 0x0) ioctl$PTP_PIN_SETFUNC2(r1, 0x40603d10, &(0x7f0000000140)={'\x00', 0x4, 0x3, 0x8}) openat$ptp0(0xffffffffffffff9c, &(0x7f00000001c0), 0x0, 0x0) r2 = fsmount(r0, 0x1, 0x48) r3 = syz_open_dev$vcsn(&(0x7f0000000200), 0x8, 0x81) mmap$IORING_OFF_SQ_RING(&(0x7f0000ffb000/0x4000)=nil, 0x4000, 0x0, 0x4000010, r3, 0x0) sendmsg$BATADV_CMD_GET_HARDIF(r2, &(0x7f0000000300)={&(0x7f0000000240)={0x10, 0x0, 0x0, 0x200}, 0xc, &(0x7f00000002c0)={&(0x7f0000000280)={0x2c, 0x0, 0x8, 0x70bd2b, 0x25dfdbff, {}, [@BATADV_ATTR_TPMETER_TEST_TIME={0x8, 0xb, 0x7}, @BATADV_ATTR_HOP_PENALTY={0x5, 0x35, 0x6}, @BATADV_ATTR_NETWORK_CODING_ENABLED={0x5}]}, 0x2c}, 0x1, 0x0, 0x0, 0xc010}, 0x20004000) r4 = openat$null(0xffffffffffffff9c, &(0x7f0000000340), 0x1, 0x0) ioctl$CDROM_GET_CAPABILITY(r4, 0x5331) r5 = socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$inet_tcp_TCP_FASTOPEN_KEY(r5, 0x6, 0x21, &(0x7f0000000380)="194ae7bad6611104d3bf8e081b4df75f", 0x10) r6 = openat$null(0xffffffffffffff9c, &(0x7f00000003c0), 0x3a1141, 0x0) ioctl$TIOCSPGRP(r6, 0x5410, &(0x7f0000000400)) ioctl$VT_RESIZEX(r4, 0x560a, &(0x7f0000000440)={0x20, 0x4, 0x7, 0xc1, 0x3}) ioctl$sock_inet_tcp_SIOCOUTQNSD(r0, 0x894b, &(0x7f0000000480)) 08:20:15 executing program 7: setsockopt$inet_tcp_TCP_CONGESTION(0xffffffffffffffff, 0x6, 0xd, &(0x7f0000000000)='dctcp\x00', 0x6) setsockopt$inet_tcp_int(0xffffffffffffffff, 0x6, 0x10, &(0x7f0000000040)=0x7, 0x4) r0 = syz_open_dev$vcsn(&(0x7f0000000080), 0xfffffffffffffffe, 0x6fc802) ioctl$sock_inet_tcp_SIOCATMARK(r0, 0x8905, &(0x7f00000000c0)) ioctl$GIO_UNISCRNMAP(0xffffffffffffffff, 0x4b69, &(0x7f0000000100)=""/252) ioctl$SNAPSHOT_S2RAM(r0, 0x330b) setsockopt$inet_tcp_int(r0, 0x6, 0x9, &(0x7f0000000200)=0x7, 0x4) r1 = getpgid(0x0) ioctl$TIOCGSID(r0, 0x5429, &(0x7f0000000240)=0x0) r3 = syz_open_pts(0xffffffffffffffff, 0x4000) kcmp$KCMP_EPOLL_TFD(r1, r2, 0x7, r0, &(0x7f0000000280)={r0, r3, 0x80000001}) r4 = fsmount(r0, 0x0, 0x2) ioctl$sock_inet_tcp_SIOCOUTQ(r4, 0x5411, &(0x7f00000002c0)) r5 = socket(0x9, 0x80000, 0x6) fsconfig$FSCONFIG_SET_FD(r0, 0x5, &(0x7f0000000300)='\x00', 0x0, r5) r6 = epoll_create1(0x0) epoll_ctl$EPOLL_CTL_DEL(0xffffffffffffffff, 0x2, r6) r7 = ioctl$TIOCGPTPEER(r3, 0x5441, 0x1ff) ioctl$PIO_FONTRESET(r7, 0x4b6d, 0x0) setsockopt$inet_tcp_TCP_CONGESTION(r5, 0x6, 0xd, &(0x7f0000000340)='scalable\x00', 0x9) [ 64.898604] Bluetooth: hci0: unexpected cc 0x0c03 length: 249 > 1 [ 64.903007] Bluetooth: hci0: unexpected cc 0x1003 length: 249 > 9 [ 64.905361] Bluetooth: hci0: unexpected cc 0x1001 length: 249 > 9 [ 64.910989] Bluetooth: hci0: unexpected cc 0x0c23 length: 249 > 4 [ 64.914007] Bluetooth: hci0: unexpected cc 0x0c38 length: 249 > 2 [ 65.090356] Bluetooth: hci2: unexpected cc 0x0c03 length: 249 > 1 [ 65.093007] Bluetooth: hci2: unexpected cc 0x1003 length: 249 > 9 [ 65.094646] Bluetooth: hci1: unexpected cc 0x0c03 length: 249 > 1 [ 65.102327] Bluetooth: hci2: unexpected cc 0x1001 length: 249 > 9 [ 65.105599] Bluetooth: hci1: unexpected cc 0x1003 length: 249 > 9 [ 65.105688] Bluetooth: hci3: unexpected cc 0x0c03 length: 249 > 1 [ 65.111133] Bluetooth: hci1: unexpected cc 0x1001 length: 249 > 9 [ 65.112215] Bluetooth: hci3: unexpected cc 0x1003 length: 249 > 9 [ 65.117990] Bluetooth: hci4: unexpected cc 0x0c03 length: 249 > 1 [ 65.120174] Bluetooth: hci3: unexpected cc 0x1001 length: 249 > 9 [ 65.121255] Bluetooth: hci2: unexpected cc 0x0c23 length: 249 > 4 [ 65.124035] Bluetooth: hci4: unexpected cc 0x1003 length: 249 > 9 [ 65.125241] Bluetooth: hci2: unexpected cc 0x0c38 length: 249 > 2 [ 65.125756] Bluetooth: hci1: unexpected cc 0x0c23 length: 249 > 4 [ 65.129228] Bluetooth: hci4: unexpected cc 0x1001 length: 249 > 9 [ 65.133793] Bluetooth: hci3: unexpected cc 0x0c23 length: 249 > 4 [ 65.135738] Bluetooth: hci1: unexpected cc 0x0c38 length: 249 > 2 [ 65.151189] Bluetooth: hci3: unexpected cc 0x0c38 length: 249 > 2 [ 65.155333] Bluetooth: hci5: unexpected cc 0x0c03 length: 249 > 1 [ 65.157438] Bluetooth: hci4: unexpected cc 0x0c23 length: 249 > 4 [ 65.174200] Bluetooth: hci4: unexpected cc 0x0c38 length: 249 > 2 [ 65.180884] Bluetooth: hci5: unexpected cc 0x1003 length: 249 > 9 [ 65.187204] Bluetooth: hci5: unexpected cc 0x1001 length: 249 > 9 [ 65.195129] Bluetooth: hci5: unexpected cc 0x0c23 length: 249 > 4 [ 65.197087] Bluetooth: hci5: unexpected cc 0x0c38 length: 249 > 2 [ 65.209123] Bluetooth: hci6: unexpected cc 0x0c03 length: 249 > 1 [ 65.218105] Bluetooth: hci7: unexpected cc 0x0c03 length: 249 > 1 [ 65.223196] Bluetooth: hci6: unexpected cc 0x1003 length: 249 > 9 [ 65.228773] Bluetooth: hci7: unexpected cc 0x1003 length: 249 > 9 [ 65.229960] Bluetooth: hci6: unexpected cc 0x1001 length: 249 > 9 [ 65.233278] Bluetooth: hci7: unexpected cc 0x1001 length: 249 > 9 [ 65.239190] Bluetooth: hci6: unexpected cc 0x0c23 length: 249 > 4 [ 65.241192] Bluetooth: hci7: unexpected cc 0x0c23 length: 249 > 4 [ 65.248055] Bluetooth: hci7: unexpected cc 0x0c38 length: 249 > 2 [ 65.249381] Bluetooth: hci6: unexpected cc 0x0c38 length: 249 > 2 [ 66.994078] Bluetooth: hci0: command tx timeout [ 67.185540] Bluetooth: hci2: command tx timeout [ 67.186543] Bluetooth: hci1: command tx timeout [ 67.247941] Bluetooth: hci5: command tx timeout [ 67.249128] Bluetooth: hci3: command tx timeout [ 67.249240] Bluetooth: hci4: command tx timeout [ 67.315101] Bluetooth: hci6: command tx timeout [ 67.315311] Bluetooth: hci7: command tx timeout [ 69.040600] Bluetooth: hci0: command tx timeout [ 69.232928] Bluetooth: hci2: command tx timeout [ 69.233101] Bluetooth: hci1: command tx timeout [ 69.295902] Bluetooth: hci5: command tx timeout [ 69.296042] Bluetooth: hci3: command tx timeout [ 69.296874] Bluetooth: hci4: command tx timeout [ 69.359983] Bluetooth: hci7: command tx timeout [ 69.361259] Bluetooth: hci6: command tx timeout [ 71.088883] Bluetooth: hci0: command tx timeout [ 71.281027] Bluetooth: hci2: command tx timeout [ 71.281572] Bluetooth: hci1: command tx timeout [ 71.345703] Bluetooth: hci4: command tx timeout [ 71.345868] Bluetooth: hci5: command tx timeout [ 71.346932] Bluetooth: hci3: command tx timeout [ 71.408378] Bluetooth: hci6: command tx timeout [ 71.408816] Bluetooth: hci7: command tx timeout [ 73.136895] Bluetooth: hci0: command tx timeout [ 73.328125] Bluetooth: hci2: command tx timeout [ 73.328949] Bluetooth: hci1: command tx timeout [ 73.392883] Bluetooth: hci4: command tx timeout [ 73.393641] Bluetooth: hci5: command tx timeout [ 73.394935] Bluetooth: hci3: command tx timeout [ 73.456883] Bluetooth: hci7: command tx timeout [ 73.457639] Bluetooth: hci6: command tx timeout [ 103.391353] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 103.392025] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 103.804573] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 103.805210] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 104.225741] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 104.226392] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 08:20:55 executing program 7: setsockopt$inet_tcp_TCP_CONGESTION(0xffffffffffffffff, 0x6, 0xd, &(0x7f0000000000)='dctcp\x00', 0x6) setsockopt$inet_tcp_int(0xffffffffffffffff, 0x6, 0x10, &(0x7f0000000040)=0x7, 0x4) r0 = syz_open_dev$vcsn(&(0x7f0000000080), 0xfffffffffffffffe, 0x6fc802) ioctl$sock_inet_tcp_SIOCATMARK(r0, 0x8905, &(0x7f00000000c0)) ioctl$GIO_UNISCRNMAP(0xffffffffffffffff, 0x4b69, &(0x7f0000000100)=""/252) ioctl$SNAPSHOT_S2RAM(r0, 0x330b) setsockopt$inet_tcp_int(r0, 0x6, 0x9, &(0x7f0000000200)=0x7, 0x4) r1 = getpgid(0x0) ioctl$TIOCGSID(r0, 0x5429, &(0x7f0000000240)=0x0) r3 = syz_open_pts(0xffffffffffffffff, 0x4000) kcmp$KCMP_EPOLL_TFD(r1, r2, 0x7, r0, &(0x7f0000000280)={r0, r3, 0x80000001}) r4 = fsmount(r0, 0x0, 0x2) ioctl$sock_inet_tcp_SIOCOUTQ(r4, 0x5411, &(0x7f00000002c0)) r5 = socket(0x9, 0x80000, 0x6) fsconfig$FSCONFIG_SET_FD(r0, 0x5, &(0x7f0000000300)='\x00', 0x0, r5) r6 = epoll_create1(0x0) epoll_ctl$EPOLL_CTL_DEL(0xffffffffffffffff, 0x2, r6) r7 = ioctl$TIOCGPTPEER(r3, 0x5441, 0x1ff) ioctl$PIO_FONTRESET(r7, 0x4b6d, 0x0) setsockopt$inet_tcp_TCP_CONGESTION(r5, 0x6, 0xd, &(0x7f0000000340)='scalable\x00', 0x9) [ 104.500001] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 104.500612] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 08:20:55 executing program 7: setsockopt$inet_tcp_TCP_CONGESTION(0xffffffffffffffff, 0x6, 0xd, &(0x7f0000000000)='dctcp\x00', 0x6) setsockopt$inet_tcp_int(0xffffffffffffffff, 0x6, 0x10, &(0x7f0000000040)=0x7, 0x4) r0 = syz_open_dev$vcsn(&(0x7f0000000080), 0xfffffffffffffffe, 0x6fc802) ioctl$sock_inet_tcp_SIOCATMARK(r0, 0x8905, &(0x7f00000000c0)) ioctl$GIO_UNISCRNMAP(0xffffffffffffffff, 0x4b69, &(0x7f0000000100)=""/252) ioctl$SNAPSHOT_S2RAM(r0, 0x330b) setsockopt$inet_tcp_int(r0, 0x6, 0x9, &(0x7f0000000200)=0x7, 0x4) r1 = getpgid(0x0) ioctl$TIOCGSID(r0, 0x5429, &(0x7f0000000240)=0x0) r3 = syz_open_pts(0xffffffffffffffff, 0x4000) kcmp$KCMP_EPOLL_TFD(r1, r2, 0x7, r0, &(0x7f0000000280)={r0, r3, 0x80000001}) r4 = fsmount(r0, 0x0, 0x2) ioctl$sock_inet_tcp_SIOCOUTQ(r4, 0x5411, &(0x7f00000002c0)) r5 = socket(0x9, 0x80000, 0x6) fsconfig$FSCONFIG_SET_FD(r0, 0x5, &(0x7f0000000300)='\x00', 0x0, r5) r6 = epoll_create1(0x0) epoll_ctl$EPOLL_CTL_DEL(0xffffffffffffffff, 0x2, r6) r7 = ioctl$TIOCGPTPEER(r3, 0x5441, 0x1ff) ioctl$PIO_FONTRESET(r7, 0x4b6d, 0x0) setsockopt$inet_tcp_TCP_CONGESTION(r5, 0x6, 0xd, &(0x7f0000000340)='scalable\x00', 0x9) [ 104.672165] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 104.672777] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 08:20:55 executing program 7: setsockopt$inet_tcp_TCP_CONGESTION(0xffffffffffffffff, 0x6, 0xd, &(0x7f0000000000)='dctcp\x00', 0x6) setsockopt$inet_tcp_int(0xffffffffffffffff, 0x6, 0x10, &(0x7f0000000040)=0x7, 0x4) r0 = syz_open_dev$vcsn(&(0x7f0000000080), 0xfffffffffffffffe, 0x6fc802) ioctl$sock_inet_tcp_SIOCATMARK(r0, 0x8905, &(0x7f00000000c0)) ioctl$GIO_UNISCRNMAP(0xffffffffffffffff, 0x4b69, &(0x7f0000000100)=""/252) ioctl$SNAPSHOT_S2RAM(r0, 0x330b) setsockopt$inet_tcp_int(r0, 0x6, 0x9, &(0x7f0000000200)=0x7, 0x4) r1 = getpgid(0x0) ioctl$TIOCGSID(r0, 0x5429, &(0x7f0000000240)=0x0) r3 = syz_open_pts(0xffffffffffffffff, 0x4000) kcmp$KCMP_EPOLL_TFD(r1, r2, 0x7, r0, &(0x7f0000000280)={r0, r3, 0x80000001}) r4 = fsmount(r0, 0x0, 0x2) ioctl$sock_inet_tcp_SIOCOUTQ(r4, 0x5411, &(0x7f00000002c0)) r5 = socket(0x9, 0x80000, 0x6) fsconfig$FSCONFIG_SET_FD(r0, 0x5, &(0x7f0000000300)='\x00', 0x0, r5) r6 = epoll_create1(0x0) epoll_ctl$EPOLL_CTL_DEL(0xffffffffffffffff, 0x2, r6) r7 = ioctl$TIOCGPTPEER(r3, 0x5441, 0x1ff) ioctl$PIO_FONTRESET(r7, 0x4b6d, 0x0) setsockopt$inet_tcp_TCP_CONGESTION(r5, 0x6, 0xd, &(0x7f0000000340)='scalable\x00', 0x9) 08:20:56 executing program 7: setsockopt$inet_tcp_TCP_CONGESTION(0xffffffffffffffff, 0x6, 0xd, &(0x7f0000000000)='dctcp\x00', 0x6) setsockopt$inet_tcp_int(0xffffffffffffffff, 0x6, 0x10, &(0x7f0000000040)=0x7, 0x4) r0 = syz_open_dev$vcsn(&(0x7f0000000080), 0xfffffffffffffffe, 0x6fc802) ioctl$sock_inet_tcp_SIOCATMARK(r0, 0x8905, &(0x7f00000000c0)) ioctl$GIO_UNISCRNMAP(0xffffffffffffffff, 0x4b69, &(0x7f0000000100)=""/252) ioctl$SNAPSHOT_S2RAM(r0, 0x330b) setsockopt$inet_tcp_int(r0, 0x6, 0x9, &(0x7f0000000200)=0x7, 0x4) r1 = getpgid(0x0) ioctl$TIOCGSID(r0, 0x5429, &(0x7f0000000240)=0x0) r3 = syz_open_pts(0xffffffffffffffff, 0x4000) kcmp$KCMP_EPOLL_TFD(r1, r2, 0x7, r0, &(0x7f0000000280)={r0, r3, 0x80000001}) r4 = fsmount(r0, 0x0, 0x2) ioctl$sock_inet_tcp_SIOCOUTQ(r4, 0x5411, &(0x7f00000002c0)) r5 = socket(0x9, 0x80000, 0x6) fsconfig$FSCONFIG_SET_FD(r0, 0x5, &(0x7f0000000300)='\x00', 0x0, r5) r6 = epoll_create1(0x0) epoll_ctl$EPOLL_CTL_DEL(0xffffffffffffffff, 0x2, r6) r7 = ioctl$TIOCGPTPEER(r3, 0x5441, 0x1ff) ioctl$PIO_FONTRESET(r7, 0x4b6d, 0x0) [ 104.989498] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 104.990134] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 08:20:56 executing program 7: setsockopt$inet_tcp_TCP_CONGESTION(0xffffffffffffffff, 0x6, 0xd, &(0x7f0000000000)='dctcp\x00', 0x6) setsockopt$inet_tcp_int(0xffffffffffffffff, 0x6, 0x10, &(0x7f0000000040)=0x7, 0x4) r0 = syz_open_dev$vcsn(&(0x7f0000000080), 0xfffffffffffffffe, 0x6fc802) ioctl$sock_inet_tcp_SIOCATMARK(r0, 0x8905, &(0x7f00000000c0)) ioctl$GIO_UNISCRNMAP(0xffffffffffffffff, 0x4b69, &(0x7f0000000100)=""/252) ioctl$SNAPSHOT_S2RAM(r0, 0x330b) setsockopt$inet_tcp_int(r0, 0x6, 0x9, &(0x7f0000000200)=0x7, 0x4) r1 = getpgid(0x0) ioctl$TIOCGSID(r0, 0x5429, &(0x7f0000000240)=0x0) r3 = syz_open_pts(0xffffffffffffffff, 0x4000) kcmp$KCMP_EPOLL_TFD(r1, r2, 0x7, r0, &(0x7f0000000280)={r0, r3, 0x80000001}) r4 = fsmount(r0, 0x0, 0x2) ioctl$sock_inet_tcp_SIOCOUTQ(r4, 0x5411, &(0x7f00000002c0)) r5 = socket(0x9, 0x80000, 0x6) fsconfig$FSCONFIG_SET_FD(r0, 0x5, &(0x7f0000000300)='\x00', 0x0, r5) r6 = epoll_create1(0x0) epoll_ctl$EPOLL_CTL_DEL(0xffffffffffffffff, 0x2, r6) ioctl$TIOCGPTPEER(r3, 0x5441, 0x1ff) [ 105.071267] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 105.072744] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 08:20:56 executing program 7: setsockopt$inet_tcp_TCP_CONGESTION(0xffffffffffffffff, 0x6, 0xd, &(0x7f0000000000)='dctcp\x00', 0x6) setsockopt$inet_tcp_int(0xffffffffffffffff, 0x6, 0x10, &(0x7f0000000040)=0x7, 0x4) r0 = syz_open_dev$vcsn(&(0x7f0000000080), 0xfffffffffffffffe, 0x6fc802) ioctl$sock_inet_tcp_SIOCATMARK(r0, 0x8905, &(0x7f00000000c0)) ioctl$GIO_UNISCRNMAP(0xffffffffffffffff, 0x4b69, &(0x7f0000000100)=""/252) ioctl$SNAPSHOT_S2RAM(r0, 0x330b) setsockopt$inet_tcp_int(r0, 0x6, 0x9, &(0x7f0000000200)=0x7, 0x4) r1 = getpgid(0x0) ioctl$TIOCGSID(r0, 0x5429, &(0x7f0000000240)=0x0) r3 = syz_open_pts(0xffffffffffffffff, 0x4000) kcmp$KCMP_EPOLL_TFD(r1, r2, 0x7, r0, &(0x7f0000000280)={r0, r3, 0x80000001}) r4 = fsmount(r0, 0x0, 0x2) ioctl$sock_inet_tcp_SIOCOUTQ(r4, 0x5411, &(0x7f00000002c0)) r5 = socket(0x9, 0x80000, 0x6) fsconfig$FSCONFIG_SET_FD(r0, 0x5, &(0x7f0000000300)='\x00', 0x0, r5) r6 = epoll_create1(0x0) epoll_ctl$EPOLL_CTL_DEL(0xffffffffffffffff, 0x2, r6) 08:20:56 executing program 5: r0 = ioctl$TIOCGPTPEER(0xffffffffffffffff, 0x5441, 0xfffffffffffffff7) ioctl$PIO_FONTRESET(r0, 0x4b6d, 0x0) ioctl$KDGETMODE(r0, 0x4b3b, &(0x7f0000000000)) ioctl$VT_RESIZEX(r0, 0x560a, &(0x7f0000000040)={0x401, 0x4, 0x0, 0x7, 0x1, 0x6}) r1 = epoll_create1(0x80000) r2 = openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000080)='./cgroup/syz0\x00', 0x200002, 0x0) epoll_ctl$EPOLL_CTL_ADD(r1, 0x1, r2, &(0x7f00000000c0)={0x20000001}) ioctl$TIOCSPTLCK(r0, 0x40045431, &(0x7f0000000100)) ioctl$TIOCSPTLCK(r0, 0x40045431, &(0x7f0000000140)) r3 = openat$ttyS3(0xffffffffffffff9c, &(0x7f0000000180), 0x422800, 0x0) ioctl$TIOCSPGRP(r3, 0x5410, &(0x7f00000001c0)) r4 = syz_open_dev$ttys(0xc, 0x2, 0x1) ioctl$VT_RESIZEX(r4, 0x560a, &(0x7f0000000200)={0x40, 0x5, 0x1, 0x8001, 0x800, 0xfffa}) ioctl$TIOCGPTPEER(r4, 0x5441, 0x910000000000) r5 = fork() ptrace$getsig(0x4202, r5, 0x9, &(0x7f0000000240)) syz_open_dev$tty1(0xc, 0x4, 0x4) r6 = socket$nl_generic(0x10, 0x3, 0x10) mount$9p_fd(0x0, &(0x7f00000002c0)='./file0\x00', &(0x7f0000000300), 0x1040404, &(0x7f0000000340)={'trans=fd,', {}, 0x2c, {'wfdno', 0x3d, r6}, 0x2c, {[{@dfltuid={'dfltuid', 0x3d, 0xffffffffffffffff}}, {@cache_loose}, {@cache_fscache}, {@mmap}, {@cache_fscache}, {@dfltgid}], [{@obj_type={'obj_type', 0x3d, '/dev/ttyS3\x00'}}, {@subj_user={'subj_user', 0x3d, '!'}}]}}) ioctl$VT_RESIZEX(r4, 0x560a, &(0x7f0000000400)={0x7, 0x5, 0xfff, 0x9, 0xfffd, 0x5}) 08:20:56 executing program 7: setsockopt$inet_tcp_TCP_CONGESTION(0xffffffffffffffff, 0x6, 0xd, &(0x7f0000000000)='dctcp\x00', 0x6) setsockopt$inet_tcp_int(0xffffffffffffffff, 0x6, 0x10, &(0x7f0000000040)=0x7, 0x4) r0 = syz_open_dev$vcsn(&(0x7f0000000080), 0xfffffffffffffffe, 0x6fc802) ioctl$sock_inet_tcp_SIOCATMARK(r0, 0x8905, &(0x7f00000000c0)) ioctl$GIO_UNISCRNMAP(0xffffffffffffffff, 0x4b69, &(0x7f0000000100)=""/252) ioctl$SNAPSHOT_S2RAM(r0, 0x330b) setsockopt$inet_tcp_int(r0, 0x6, 0x9, &(0x7f0000000200)=0x7, 0x4) r1 = getpgid(0x0) ioctl$TIOCGSID(r0, 0x5429, &(0x7f0000000240)=0x0) r3 = syz_open_pts(0xffffffffffffffff, 0x4000) kcmp$KCMP_EPOLL_TFD(r1, r2, 0x7, r0, &(0x7f0000000280)={r0, r3, 0x80000001}) r4 = fsmount(r0, 0x0, 0x2) ioctl$sock_inet_tcp_SIOCOUTQ(r4, 0x5411, &(0x7f00000002c0)) r5 = socket(0x9, 0x80000, 0x6) fsconfig$FSCONFIG_SET_FD(r0, 0x5, &(0x7f0000000300)='\x00', 0x0, r5) epoll_ctl$EPOLL_CTL_DEL(0xffffffffffffffff, 0x2, 0xffffffffffffffff) [ 105.255713] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 105.256325] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 105.326650] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 105.327286] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 105.385973] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 105.386595] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 105.393816] audit: type=1400 audit(1768638056.569:8): avc: denied { open } for pid=3883 comm="syz-executor.2" scontext=system_u:system_r:kernel_t:s0 tcontext=system_u:system_r:kernel_t:s0 tclass=perf_event permissive=1 [ 105.395487] audit: type=1400 audit(1768638056.569:9): avc: denied { kernel } for pid=3883 comm="syz-executor.2" scontext=system_u:system_r:kernel_t:s0 tcontext=system_u:system_r:kernel_t:s0 tclass=perf_event permissive=1 [ 105.468853] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 105.469472] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 105.563551] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 105.564209] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 105.629621] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 105.630268] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 105.746468] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 105.747133] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 106.285880] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 106.286510] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 106.322197] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 106.322811] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 08:21:08 executing program 7: setsockopt$inet_tcp_TCP_CONGESTION(0xffffffffffffffff, 0x6, 0xd, &(0x7f0000000000)='dctcp\x00', 0x6) setsockopt$inet_tcp_int(0xffffffffffffffff, 0x6, 0x10, &(0x7f0000000040)=0x7, 0x4) r0 = syz_open_dev$vcsn(&(0x7f0000000080), 0xfffffffffffffffe, 0x6fc802) ioctl$sock_inet_tcp_SIOCATMARK(r0, 0x8905, &(0x7f00000000c0)) ioctl$GIO_UNISCRNMAP(0xffffffffffffffff, 0x4b69, &(0x7f0000000100)=""/252) ioctl$SNAPSHOT_S2RAM(r0, 0x330b) setsockopt$inet_tcp_int(r0, 0x6, 0x9, &(0x7f0000000200)=0x7, 0x4) r1 = getpgid(0x0) ioctl$TIOCGSID(r0, 0x5429, &(0x7f0000000240)=0x0) r3 = syz_open_pts(0xffffffffffffffff, 0x4000) kcmp$KCMP_EPOLL_TFD(r1, r2, 0x7, r0, &(0x7f0000000280)={r0, r3, 0x80000001}) r4 = fsmount(r0, 0x0, 0x2) ioctl$sock_inet_tcp_SIOCOUTQ(r4, 0x5411, &(0x7f00000002c0)) socket(0x9, 0x80000, 0x6) epoll_ctl$EPOLL_CTL_DEL(0xffffffffffffffff, 0x2, 0xffffffffffffffff) 08:21:08 executing program 0: r0 = syz_open_dev$tty20(0xc, 0x4, 0x0) ioctl$TIOCGSID(r0, 0x5429, &(0x7f0000000000)) r1 = syz_open_dev$tty1(0xc, 0x4, 0x2) ioctl$TIOCSRS485(r1, 0x542f, &(0x7f0000000040)={0x7, 0x8, 0x8a9}) ioctl$TIOCSPTLCK(r1, 0x40045431, &(0x7f0000000080)=0x1) r2 = ioctl$TIOCGPTPEER(r1, 0x5441, 0x2) ioctl$KDGETMODE(r2, 0x4b3b, &(0x7f00000000c0)) r3 = fsmount(0xffffffffffffffff, 0x1, 0x84) ioctl$TIOCGSID(r3, 0x5429, &(0x7f0000000100)) ioctl$TIOCSWINSZ(r3, 0x5414, &(0x7f0000000140)={0xc1, 0x5, 0x7ff, 0x7}) r4 = openat$ttyS3(0xffffffffffffff9c, &(0x7f0000000180), 0x1, 0x0) ioctl$GIO_UNISCRNMAP(r4, 0x4b69, &(0x7f00000001c0)=""/131) r5 = epoll_create1(0x0) epoll_ctl$EPOLL_CTL_MOD(r5, 0x3, 0xffffffffffffffff, &(0x7f0000000280)={0x10}) r6 = openat$null(0xffffffffffffff9c, &(0x7f00000002c0), 0x800, 0x0) syz_io_uring_submit(0x0, 0x0, &(0x7f00000003c0)=@IORING_OP_ACCEPT={0xd, 0x1, 0x0, r6, &(0x7f0000000300)=0x80, &(0x7f0000000340)=@ethernet={0x0, @multicast}}, 0x40) ioctl$TIOCSRS485(r3, 0x542f, &(0x7f0000000400)={0x0, 0x80000000, 0xff}) ioctl$TIOCL_GETMOUSEREPORTING(0xffffffffffffffff, 0x541c, &(0x7f0000000440)) ioctl$KDGETMODE(r4, 0x4b3b, &(0x7f0000000480)) ioctl$GIO_UNISCRNMAP(r3, 0x4b69, &(0x7f00000004c0)=""/104) 08:21:08 executing program 2: mmap$IORING_OFF_SQ_RING(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x1000000, 0x20010, 0xffffffffffffffff, 0x0) ioctl$TIOCL_SCROLLCONSOLE(0xffffffffffffffff, 0x541c, &(0x7f0000000000)={0xd, 0x8e5}) r0 = perf_event_open$cgroup(&(0x7f0000000080)={0x2, 0x80, 0x20, 0x7, 0x5e, 0x5, 0x0, 0x40, 0x200, 0x8, 0x0, 0x1, 0x1, 0x1, 0x1, 0x0, 0x1, 0x1, 0x1, 0x0, 0x0, 0x1, 0x0, 0x1, 0x1, 0x3, 0x1, 0x0, 0x1, 0x1, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x1, 0x0, 0x1, 0x0, 0x0, 0x0, 0x200, 0x1, @perf_bp={&(0x7f0000000040), 0x2}, 0x4060, 0xffffffffffffff00, 0xfffffff7, 0x0, 0x5, 0x5, 0x0, 0x0, 0x6, 0x0, 0x30}, 0xffffffffffffffff, 0x10, 0xffffffffffffffff, 0x8) ioctl$PERF_EVENT_IOC_QUERY_BPF(r0, 0xc008240a, &(0x7f0000000100)={0x8, 0x0, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0]}) sendmsg$BATADV_CMD_GET_VLAN(0xffffffffffffffff, &(0x7f0000000240)={&(0x7f0000000140)={0x10, 0x0, 0x0, 0x20}, 0xc, &(0x7f0000000200)={&(0x7f0000000180)={0x4c, 0x0, 0x200, 0x70bd2b, 0x25dfdbfc, {}, [@BATADV_ATTR_ELP_INTERVAL={0x8, 0x3a, 0x1}, @BATADV_ATTR_ISOLATION_MASK={0x8, 0x2c, 0x1}, @BATADV_ATTR_ISOLATION_MASK={0x8, 0x2c, 0x80000001}, @BATADV_ATTR_MESH_IFINDEX={0x8}, @BATADV_ATTR_BRIDGE_LOOP_AVOIDANCE_ENABLED={0x5}, @BATADV_ATTR_ISOLATION_MASK={0x8, 0x2c, 0x1}, @BATADV_ATTR_ISOLATION_MASK={0x8, 0x2c, 0x81}]}, 0x4c}, 0x1, 0x0, 0x0, 0x4000000}, 0x200008d0) r1 = openat$ptp0(0xffffffffffffff9c, &(0x7f0000000280), 0x102002, 0x0) ioctl$PTP_SYS_OFFSET_PRECISE(r1, 0xc0403d08, &(0x7f00000002c0)) sendmsg$BATADV_CMD_GET_TRANSTABLE_GLOBAL(0xffffffffffffffff, &(0x7f0000000400)={&(0x7f0000000300)={0x10, 0x0, 0x0, 0x2}, 0xc, &(0x7f00000003c0)={&(0x7f0000000340)={0x50, 0x0, 0x2, 0x70bd26, 0x25dfdbfc, {}, [@BATADV_ATTR_ELP_INTERVAL={0x8, 0x3a, 0x9}, @BATADV_ATTR_DISTRIBUTED_ARP_TABLE_ENABLED={0x5, 0x2f, 0x1}, @BATADV_ATTR_ISOLATION_MARK={0x8, 0x2b, 0x20}, @BATADV_ATTR_THROUGHPUT_OVERRIDE={0x8, 0x3b, 0x20}, @BATADV_ATTR_ORIG_ADDRESS={0xa}, @BATADV_ATTR_MESH_IFINDEX={0x8}, @BATADV_ATTR_ORIG_INTERVAL={0x8, 0x39, 0x1}]}, 0x50}}, 0x20004800) r2 = openat$null(0xffffffffffffff9c, &(0x7f0000000440), 0x440, 0x0) ioctl$PERF_EVENT_IOC_SET_OUTPUT(r0, 0x2405, r2) epoll_ctl$EPOLL_CTL_DEL(0xffffffffffffffff, 0x2, r1) io_uring_setup(0x39ad, &(0x7f0000000480)={0x0, 0x5964, 0x8, 0x3, 0x10, 0x0, r2}) ioctl$PERF_EVENT_IOC_DISABLE(r2, 0x2401, 0x2) fsconfig$FSCONFIG_SET_FD(r2, 0x5, &(0x7f0000000500)='/dev/ptp0\x00', 0x0, 0xffffffffffffffff) r3 = perf_event_open$cgroup(&(0x7f0000000580)={0x4, 0x80, 0x4, 0x5, 0xf0, 0x3f, 0x0, 0x20, 0x4040, 0xc, 0x0, 0x1, 0x1, 0x1, 0x0, 0x1, 0x0, 0x1, 0x1, 0x1, 0x0, 0x1, 0x0, 0x1, 0x1, 0x2, 0x1, 0x0, 0x1, 0x1, 0x1, 0x1, 0x0, 0x1, 0x1, 0x0, 0x1, 0x1, 0x1, 0x1, 0x1, 0x1, 0x1, 0x0, 0x1, 0x0, 0x0, 0x0, 0x80000000, 0x2, @perf_bp={&(0x7f0000000540), 0x7}, 0x204, 0x1, 0x6, 0x6, 0x5d9, 0x0, 0x5, 0x0, 0x4, 0x0, 0x9}, r2, 0x2, 0xffffffffffffffff, 0x0) ioctl$PERF_EVENT_IOC_PAUSE_OUTPUT(r3, 0x40042409, 0x0) r4 = io_uring_setup(0xfbf, &(0x7f0000000600)={0x0, 0xc8b, 0x4, 0x2, 0x1f3, 0x0, r2}) mmap$IORING_OFF_SQ_RING(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x9, 0x11, r4, 0x0) ioctl$PTP_CLOCK_GETCAPS(r2, 0x80503d01, &(0x7f0000000680)) fsopen(&(0x7f0000000700)='ecryptfs\x00', 0x1) 08:21:08 executing program 5: r0 = ioctl$TIOCGPTPEER(0xffffffffffffffff, 0x5441, 0xfffffffffffffff7) ioctl$PIO_FONTRESET(r0, 0x4b6d, 0x0) ioctl$KDGETMODE(r0, 0x4b3b, &(0x7f0000000000)) ioctl$VT_RESIZEX(r0, 0x560a, &(0x7f0000000040)={0x401, 0x4, 0x0, 0x7, 0x1, 0x6}) r1 = epoll_create1(0x80000) r2 = openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000080)='./cgroup/syz0\x00', 0x200002, 0x0) epoll_ctl$EPOLL_CTL_ADD(r1, 0x1, r2, &(0x7f00000000c0)={0x20000001}) ioctl$TIOCSPTLCK(r0, 0x40045431, &(0x7f0000000100)) ioctl$TIOCSPTLCK(r0, 0x40045431, &(0x7f0000000140)) r3 = openat$ttyS3(0xffffffffffffff9c, &(0x7f0000000180), 0x422800, 0x0) ioctl$TIOCSPGRP(r3, 0x5410, &(0x7f00000001c0)) r4 = syz_open_dev$ttys(0xc, 0x2, 0x1) ioctl$VT_RESIZEX(r4, 0x560a, &(0x7f0000000200)={0x40, 0x5, 0x1, 0x8001, 0x800, 0xfffa}) ioctl$TIOCGPTPEER(r4, 0x5441, 0x910000000000) r5 = fork() ptrace$getsig(0x4202, r5, 0x9, &(0x7f0000000240)) syz_open_dev$tty1(0xc, 0x4, 0x4) r6 = socket$nl_generic(0x10, 0x3, 0x10) mount$9p_fd(0x0, &(0x7f00000002c0)='./file0\x00', &(0x7f0000000300), 0x1040404, &(0x7f0000000340)={'trans=fd,', {}, 0x2c, {'wfdno', 0x3d, r6}, 0x2c, {[{@dfltuid={'dfltuid', 0x3d, 0xffffffffffffffff}}, {@cache_loose}, {@cache_fscache}, {@mmap}, {@cache_fscache}, {@dfltgid}], [{@obj_type={'obj_type', 0x3d, '/dev/ttyS3\x00'}}, {@subj_user={'subj_user', 0x3d, '!'}}]}}) ioctl$VT_RESIZEX(r4, 0x560a, &(0x7f0000000400)={0x7, 0x5, 0xfff, 0x9, 0xfffd, 0x5}) 08:21:08 executing program 4: r0 = io_uring_setup(0x64cf, &(0x7f0000000000)={0x0, 0x97b7, 0x20, 0x3, 0x3b7}) r1 = fsmount(0xffffffffffffffff, 0x0, 0x0) r2 = syz_io_uring_setup(0x354a, &(0x7f0000000080)={0x0, 0x44c0, 0x10, 0x1, 0x373, 0x0, r1}, &(0x7f0000ffa000/0x4000)=nil, &(0x7f0000ffa000/0x4000)=nil, &(0x7f0000000100), &(0x7f0000000140)) ioctl$SNAPSHOT_ATOMIC_RESTORE(r1, 0x3304) r3 = fsmount(r1, 0x1, 0x70) setsockopt$inet_tcp_TCP_CONGESTION(r1, 0x6, 0xd, &(0x7f0000000180)='bic\x00', 0x4) setsockopt$inet_tcp_TCP_QUEUE_SEQ(r1, 0x6, 0x15, &(0x7f00000001c0)=0x4583bca4, 0x4) ioctl$TIOCSSOFTCAR(r3, 0x541a, &(0x7f0000000200)=0x6) ioctl$sock_ipv6_tunnel_SIOCDEL6RD(r3, 0x89fa, &(0x7f00000002c0)={'ip6_vti0\x00', &(0x7f0000000240)={'sit0\x00', 0x0, 0x29, 0x1, 0x9, 0x100, 0x11, @private2, @empty, 0x80, 0x8, 0xc6e, 0x1}}) ioctl$sock_ipv6_tunnel_SIOCDELTUNNEL(r1, 0x89f2, &(0x7f0000000380)={'syztnl1\x00', &(0x7f0000000300)={'ip6gre0\x00', r4, 0x4, 0x1, 0x80, 0xd5bd, 0x12, @rand_addr=' \x01\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x02', @private2={0xfc, 0x2, '\x00', 0x1}, 0x8000, 0x1, 0x3, 0x34ff}}) r5 = fsmount(r3, 0x1, 0x8c) ioctl$ifreq_SIOCGIFINDEX_batadv_mesh(r3, 0x8933, &(0x7f00000003c0)={'batadv0\x00', 0x0}) ioctl$sock_ipv6_tunnel_SIOCDELTUNNEL(r5, 0x89f2, &(0x7f0000000480)={'ip6tnl0\x00', &(0x7f0000000400)={'syztnl2\x00', r6, 0x2f, 0x40, 0x9, 0x80000000, 0x10, @private0={0xfc, 0x0, '\x00', 0x1}, @dev={0xfe, 0x80, '\x00', 0x16}, 0x8, 0x7, 0x8}}) mmap$IORING_OFF_SQ_RING(&(0x7f0000ffa000/0x1000)=nil, 0x1000, 0xd, 0x40010, r0, 0x0) r7 = fsmount(r3, 0x0, 0x75) mmap$IORING_OFF_SQ_RING(&(0x7f0000ffc000/0x4000)=nil, 0x4000, 0x2000000, 0x10010, r2, 0x0) r8 = openat$null(0xffffffffffffff9c, &(0x7f0000000540), 0xc000, 0x0) fsconfig$FSCONFIG_SET_PATH(0xffffffffffffffff, 0x3, &(0x7f00000004c0)=' \x01\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x02', &(0x7f0000000500)='./file0\x00', r8) ioctl$TIOCGSID(r7, 0x5429, &(0x7f0000000580)=0x0) kcmp$KCMP_EPOLL_TFD(r9, 0x0, 0x7, 0xffffffffffffffff, &(0x7f00000005c0)={0xffffffffffffffff, r3}) 08:21:08 executing program 6: iopl(0x1) ioctl$TIOCSSOFTCAR(0xffffffffffffffff, 0x541a, &(0x7f0000000000)=0x800) ioctl$CDROM_MEDIA_CHANGED(0xffffffffffffffff, 0x5325, 0x6) r0 = openat$null(0xffffffffffffff9c, &(0x7f0000000040), 0x10000, 0x0) ioctl$PTP_PIN_GETFUNC2(r0, 0xc0603d0f, &(0x7f0000000080)={'\x00', 0x2, 0x3, 0x507}) r1 = openat$ptp0(0xffffffffffffff9c, &(0x7f0000000100), 0x200000, 0x0) ioctl$PTP_PIN_SETFUNC2(r1, 0x40603d10, &(0x7f0000000140)={'\x00', 0x4, 0x3, 0x8}) openat$ptp0(0xffffffffffffff9c, &(0x7f00000001c0), 0x0, 0x0) r2 = fsmount(r0, 0x1, 0x48) r3 = syz_open_dev$vcsn(&(0x7f0000000200), 0x8, 0x81) mmap$IORING_OFF_SQ_RING(&(0x7f0000ffb000/0x4000)=nil, 0x4000, 0x0, 0x4000010, r3, 0x0) sendmsg$BATADV_CMD_GET_HARDIF(r2, &(0x7f0000000300)={&(0x7f0000000240)={0x10, 0x0, 0x0, 0x200}, 0xc, &(0x7f00000002c0)={&(0x7f0000000280)={0x2c, 0x0, 0x8, 0x70bd2b, 0x25dfdbff, {}, [@BATADV_ATTR_TPMETER_TEST_TIME={0x8, 0xb, 0x7}, @BATADV_ATTR_HOP_PENALTY={0x5, 0x35, 0x6}, @BATADV_ATTR_NETWORK_CODING_ENABLED={0x5}]}, 0x2c}, 0x1, 0x0, 0x0, 0xc010}, 0x20004000) r4 = openat$null(0xffffffffffffff9c, &(0x7f0000000340), 0x1, 0x0) ioctl$CDROM_GET_CAPABILITY(r4, 0x5331) r5 = socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$inet_tcp_TCP_FASTOPEN_KEY(r5, 0x6, 0x21, &(0x7f0000000380)="194ae7bad6611104d3bf8e081b4df75f", 0x10) r6 = openat$null(0xffffffffffffff9c, &(0x7f00000003c0), 0x3a1141, 0x0) ioctl$TIOCSPGRP(r6, 0x5410, &(0x7f0000000400)) ioctl$VT_RESIZEX(r4, 0x560a, &(0x7f0000000440)={0x20, 0x4, 0x7, 0xc1, 0x3}) ioctl$sock_inet_tcp_SIOCOUTQNSD(r0, 0x894b, &(0x7f0000000480)) 08:21:08 executing program 1: r0 = socket(0x1d, 0x4, 0x3) epoll_ctl$EPOLL_CTL_ADD(0xffffffffffffffff, 0x1, r0, &(0x7f0000000000)={0x8}) r1 = socket(0x23, 0x2, 0x6) sendmsg$BATADV_CMD_GET_BLA_BACKBONE(r0, &(0x7f0000000140)={&(0x7f0000000040)={0x10, 0x0, 0x0, 0x200000}, 0xc, &(0x7f0000000100)={&(0x7f0000000080)={0x54, 0x0, 0x8, 0x70bd2d, 0x25dfdbfb, {}, [@BATADV_ATTR_THROUGHPUT_OVERRIDE={0x8, 0x3b, 0x4000}, @BATADV_ATTR_ORIG_ADDRESS={0xa, 0x9, @broadcast}, @BATADV_ATTR_ORIG_ADDRESS={0xa, 0x9, @remote}, @BATADV_ATTR_DISTRIBUTED_ARP_TABLE_ENABLED={0x5, 0x2f, 0x1}, @BATADV_ATTR_AP_ISOLATION_ENABLED={0x5, 0x2a, 0x1}, @BATADV_ATTR_AGGREGATED_OGMS_ENABLED={0x5}, @BATADV_ATTR_GW_SEL_CLASS={0x8, 0x34, 0x4}]}, 0x54}, 0x1, 0x0, 0x0, 0x800}, 0x22008003) ioctl$ifreq_SIOCGIFINDEX_batadv_mesh(r0, 0x8933, &(0x7f0000000180)={'batadv0\x00', 0x0}) ioctl$sock_ipv6_tunnel_SIOCDELTUNNEL(r1, 0x89f2, &(0x7f0000000240)={'ip6_vti0\x00', &(0x7f00000001c0)={'syztnl2\x00', r2, 0x2f, 0xf7, 0x1, 0x3ff, 0x1, @remote, @ipv4={'\x00', '\xff\xff', @dev={0xac, 0x14, 0x14, 0x19}}, 0x7, 0x700, 0x7fff, 0x1}}) ioctl$sock_ipv4_tunnel_SIOCGETTUNNEL(r1, 0x89f0, &(0x7f0000000380)={'syztnl0\x00', &(0x7f00000002c0)={'syztnl2\x00', r3, 0x8, 0x7, 0x1f, 0x8, {{0x19, 0x4, 0x1, 0x12, 0x64, 0x64, 0x0, 0x1, 0x2f, 0x0, @empty, @remote, {[@ra={0x94, 0x4, 0x1}, @timestamp_addr={0x44, 0xc, 0xc0, 0x1, 0xe, [{@dev={0xac, 0x14, 0x14, 0x11}, 0x9}]}, @cipso={0x86, 0x1b, 0x1, [{0x7, 0x3, "ee"}, {0x0, 0x12, "773efae1457b4b2a2bc243d7a1b87b1a"}]}, @ra={0x94, 0x4}, @lsrr={0x83, 0x3, 0xc9}, @rr={0x7, 0x13, 0x70, [@remote, @rand_addr=0x64010101, @remote, @loopback]}, @ra={0x94, 0x4}, @ra={0x94, 0x4, 0x1}]}}}}}) sendmsg$BATADV_CMD_GET_GATEWAYS(r1, &(0x7f0000000440)={&(0x7f0000000280)={0x10, 0x0, 0x0, 0x1000}, 0xc, &(0x7f0000000400)={&(0x7f00000003c0)={0x24, 0x0, 0x8, 0x70bd2c, 0x25dfdbfc, {}, [@BATADV_ATTR_HARD_IFINDEX={0x8, 0x6, r4}, @BATADV_ATTR_ELP_INTERVAL={0x8, 0x3a, 0x7}]}, 0x24}, 0x1, 0x0, 0x0, 0x800}, 0x24044001) epoll_ctl$EPOLL_CTL_ADD(0xffffffffffffffff, 0x1, r1, &(0x7f0000000480)={0x14}) setsockopt$inet_tcp_TCP_REPAIR(r1, 0x6, 0x13, &(0x7f00000004c0)=0x1, 0x4) r5 = syz_genetlink_get_family_id$batadv(&(0x7f0000000540), r1) sendmsg$BATADV_CMD_SET_MESH(r1, &(0x7f0000000600)={&(0x7f0000000500)={0x10, 0x0, 0x0, 0x10000000}, 0xc, &(0x7f00000005c0)={&(0x7f0000000580)={0x24, r5, 0x10, 0x70bd2b, 0x25dfdbfe, {}, [@BATADV_ATTR_ORIG_INTERVAL={0x8, 0x39, 0x200}, @BATADV_ATTR_ISOLATION_MASK={0x8}]}, 0x24}, 0x1, 0x0, 0x0, 0x4000000}, 0x24000000) r6 = openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000640)='./cgroup.cpu/syz0\x00', 0x200002, 0x0) epoll_ctl$EPOLL_CTL_ADD(0xffffffffffffffff, 0x1, r6, &(0x7f0000000680)={0x80000010}) syz_io_uring_setup(0x68d8, &(0x7f00000006c0)={0x0, 0x816b, 0x4, 0x3, 0xd3}, &(0x7f0000ffe000/0x1000)=nil, &(0x7f0000ffa000/0x4000)=nil, &(0x7f0000000740), &(0x7f0000000780)=0x0) syz_io_uring_submit(0x0, r7, &(0x7f00000007c0)=@IORING_OP_READ_FIXED={0x4, 0x4, 0x6000, @fd_index=0x7, 0x9, 0x6, 0x8000, 0x4, 0x0, {0x1}}, 0x7ff) sendmsg$BATADV_CMD_GET_DAT_CACHE(r0, &(0x7f00000008c0)={&(0x7f0000000800)={0x10, 0x0, 0x0, 0x10000}, 0xc, &(0x7f0000000880)={&(0x7f0000000840)={0x3c, r5, 0x2, 0x70bd2c, 0x25dfdbfd, {}, [@BATADV_ATTR_ORIG_INTERVAL={0x8, 0x39, 0x1}, @BATADV_ATTR_HOP_PENALTY={0x5, 0x35, 0x4}, @BATADV_ATTR_THROUGHPUT_OVERRIDE={0x8, 0x3b, 0x200}, @BATADV_ATTR_DISTRIBUTED_ARP_TABLE_ENABLED={0x5}, @BATADV_ATTR_GW_BANDWIDTH_UP={0x8, 0x32, 0xc5}]}, 0x3c}, 0x1, 0x0, 0x0, 0x20008000}, 0x4000000) ioctl$TCSETSF(0xffffffffffffffff, 0x5404, &(0x7f0000000900)={0x20, 0xffffffff, 0xfffffffc, 0x6, 0x17, "a9356d56911aecafa41c6efd030447fa097f76"}) setsockopt$inet_tcp_TCP_ULP(r0, 0x6, 0x1f, &(0x7f0000000940), 0x4) ptrace$getsig(0x4202, 0x0, 0x20, &(0x7f0000000980)) 08:21:08 executing program 3: getresgid(&(0x7f0000000000), &(0x7f0000000040)=0x0, &(0x7f0000000080)=0x0) getresgid(&(0x7f00000000c0), &(0x7f0000000100)=0x0, &(0x7f0000000140)) setregid(r1, r2) sendmsg$BATADV_CMD_GET_MESH(0xffffffffffffffff, &(0x7f0000000280)={&(0x7f0000000180), 0xc, &(0x7f0000000240)={&(0x7f00000001c0)={0x68, 0x0, 0x4, 0x70bd2b, 0x25dfdbfd, {}, [@BATADV_ATTR_ISOLATION_MARK={0x8, 0x2b, 0x61c}, @BATADV_ATTR_NETWORK_CODING_ENABLED={0x5, 0x38, 0x1}, @BATADV_ATTR_ELP_INTERVAL={0x8, 0x3a, 0xfffffffb}, @BATADV_ATTR_VLANID={0x6, 0x28, 0x2}, @BATADV_ATTR_BONDING_ENABLED={0x5, 0x2d, 0x1}, @BATADV_ATTR_BONDING_ENABLED={0x5}, @BATADV_ATTR_GW_BANDWIDTH_DOWN={0x8, 0x31, 0x8}, @BATADV_ATTR_GW_BANDWIDTH_UP={0x8, 0x32, 0x7}, @BATADV_ATTR_ELP_INTERVAL={0x8, 0x3a, 0x7f}, @BATADV_ATTR_ORIG_ADDRESS={0xa, 0x9, @multicast}]}, 0x68}, 0x1, 0x0, 0x0, 0x880}, 0x1) getresgid(&(0x7f0000000300)=0x0, &(0x7f0000000340), &(0x7f0000000380)) setregid(r0, r3) getresgid(&(0x7f00000003c0)=0x0, &(0x7f0000000400), &(0x7f0000000440)) setgid(r4) getresuid(&(0x7f0000000580), &(0x7f00000005c0), &(0x7f0000000600)=0x0) mount$9p_fd(0x0, &(0x7f0000000480)='./file0\x00', &(0x7f00000004c0), 0x2, &(0x7f0000000640)={'trans=fd,', {}, 0x2c, {}, 0x2c, {[{@afid={'afid', 0x3d, 0x6}}], [{@uid_lt={'uid<', r5}}, {@subj_role}, {@fsuuid={'fsuuid', 0x3d, {[0x64, 0x61, 0x32, 0x32, 0x36, 0x31, 0x64, 0x64], 0x2d, [0x36, 0x39, 0x64, 0x33], 0x2d, [0x65, 0x38, 0x61, 0x33], 0x2d, [0x39, 0x62, 0x62, 0x66], 0x2d, [0x64, 0x36, 0x37, 0x39, 0x31, 0x39, 0x38, 0x34]}}}, {@seclabel}, {@context={'context', 0x3d, 'root'}}, {@smackfsfloor={'smackfsfloor', 0x3d, '\xbb\xbb\xbb\xbb\xbb\xbb'}}, {@smackfsfloor={'smackfsfloor', 0x3d, '\xbb\xbb\xbb\xbb\xbb\xbb'}}, {@audit}, {@smackfsdef={'smackfsdef', 0x3d, '\xbb\xbb\xbb\xbb\xbb\xbb'}}, {@context={'context', 0x3d, 'system_u'}}]}}) r6 = io_uring_setup(0x595b, &(0x7f0000000780)={0x0, 0xd16a, 0x0, 0x3, 0x10c}) pipe2$9p(&(0x7f0000000880)={0xffffffffffffffff}, 0x6800) r8 = geteuid() mount$9p_fd(0x0, &(0x7f0000000800)='./file0\x00', &(0x7f0000000840), 0x100c10, &(0x7f00000008c0)={'trans=fd,', {'rfdno', 0x3d, r7}, 0x2c, {'wfdno', 0x3d, r6}, 0x2c, {[{@debug={'debug', 0x3d, 0x8}}, {@access_client}, {@version_9p2000}, {@fscache}], [{@dont_measure}, {@dont_appraise}, {@obj_type={'obj_type', 0x3d, 'root'}}, {@fsuuid={'fsuuid', 0x3d, {[0x36, 0x31, 0x64, 0x32, 0x32, 0x31, 0x61, 0x38], 0x2d, [0x63, 0x61, 0x36, 0x32], 0x2d, [0x37, 0x65, 0x39, 0x38], 0x2d, [0x37, 0x65, 0x33], 0x2d, [0x57, 0x66, 0x65, 0x42, 0x30, 0x66, 0x31, 0x30]}}}, {@smackfstransmute={'smackfstransmute', 0x3d, '9p\x00'}}, {@fowner_lt={'fowner<', r8}}, {@seclabel}, {@audit}]}}) ioctl$PTP_PEROUT_REQUEST(0xffffffffffffffff, 0x40383d03, &(0x7f0000000a00)={{0x2}, {0x6, 0x8}, 0x81}) r9 = openat$null(0xffffffffffffff9c, &(0x7f0000000ac0), 0x40000, 0x0) mount$9p_fd(0x0, &(0x7f0000000a40)='./file0\x00', &(0x7f0000000a80), 0x2000, &(0x7f0000000b00)={'trans=fd,', {'rfdno', 0x3d, r7}, 0x2c, {'wfdno', 0x3d, r9}, 0x2c, {[{@privport}, {@access_user}, {@version_u}, {@noextend}, {@cache_fscache}, {@version_u}], [{@smackfshat={'smackfshat', 0x3d, '\x12'}}, {@subj_type={'subj_type', 0x3d, '#\xad*.'}}, {@smackfsroot={'smackfsroot', 0x3d, 'fsuuid'}}, {@fsuuid={'fsuuid', 0x3d, {[0x38, 0x61, 0x61, 0x32, 0x35, 0x39, 0x63, 0x39], 0x2d, [0x34, 0x39, 0x64, 0x66], 0x2d, [0x65, 0x64, 0x64, 0x66], 0x2d, [0x38, 0x31, 0x37, 0x36], 0x2d, [0x62, 0x39, 0x39, 0x33, 0x39, 0x64, 0x38, 0x36]}}}]}}) r10 = fsmount(r9, 0x0, 0x6b) ioctl$TIOCSPGRP(r10, 0x5410, &(0x7f0000000c00)=0xffffffffffffffff) setgid(r3) 08:21:09 executing program 4: r0 = io_uring_setup(0x64cf, &(0x7f0000000000)={0x0, 0x97b7, 0x20, 0x3, 0x3b7}) r1 = fsmount(0xffffffffffffffff, 0x0, 0x0) r2 = syz_io_uring_setup(0x354a, &(0x7f0000000080)={0x0, 0x44c0, 0x10, 0x1, 0x373, 0x0, r1}, &(0x7f0000ffa000/0x4000)=nil, &(0x7f0000ffa000/0x4000)=nil, &(0x7f0000000100), &(0x7f0000000140)) ioctl$SNAPSHOT_ATOMIC_RESTORE(r1, 0x3304) r3 = fsmount(r1, 0x1, 0x70) setsockopt$inet_tcp_TCP_CONGESTION(r1, 0x6, 0xd, &(0x7f0000000180)='bic\x00', 0x4) setsockopt$inet_tcp_TCP_QUEUE_SEQ(r1, 0x6, 0x15, &(0x7f00000001c0)=0x4583bca4, 0x4) ioctl$TIOCSSOFTCAR(r3, 0x541a, &(0x7f0000000200)=0x6) ioctl$sock_ipv6_tunnel_SIOCDEL6RD(r3, 0x89fa, &(0x7f00000002c0)={'ip6_vti0\x00', &(0x7f0000000240)={'sit0\x00', 0x0, 0x29, 0x1, 0x9, 0x100, 0x11, @private2, @empty, 0x80, 0x8, 0xc6e, 0x1}}) ioctl$sock_ipv6_tunnel_SIOCDELTUNNEL(r1, 0x89f2, &(0x7f0000000380)={'syztnl1\x00', &(0x7f0000000300)={'ip6gre0\x00', r4, 0x4, 0x1, 0x80, 0xd5bd, 0x12, @rand_addr=' \x01\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x02', @private2={0xfc, 0x2, '\x00', 0x1}, 0x8000, 0x1, 0x3, 0x34ff}}) r5 = fsmount(r3, 0x1, 0x8c) ioctl$ifreq_SIOCGIFINDEX_batadv_mesh(r3, 0x8933, &(0x7f00000003c0)={'batadv0\x00', 0x0}) ioctl$sock_ipv6_tunnel_SIOCDELTUNNEL(r5, 0x89f2, &(0x7f0000000480)={'ip6tnl0\x00', &(0x7f0000000400)={'syztnl2\x00', r6, 0x2f, 0x40, 0x9, 0x80000000, 0x10, @private0={0xfc, 0x0, '\x00', 0x1}, @dev={0xfe, 0x80, '\x00', 0x16}, 0x8, 0x7, 0x8}}) mmap$IORING_OFF_SQ_RING(&(0x7f0000ffa000/0x1000)=nil, 0x1000, 0xd, 0x40010, r0, 0x0) r7 = fsmount(r3, 0x0, 0x75) mmap$IORING_OFF_SQ_RING(&(0x7f0000ffc000/0x4000)=nil, 0x4000, 0x2000000, 0x10010, r2, 0x0) r8 = openat$null(0xffffffffffffff9c, &(0x7f0000000540), 0xc000, 0x0) fsconfig$FSCONFIG_SET_PATH(0xffffffffffffffff, 0x3, &(0x7f00000004c0)=' \x01\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x02', &(0x7f0000000500)='./file0\x00', r8) ioctl$TIOCGSID(r7, 0x5429, &(0x7f0000000580)=0x0) kcmp$KCMP_EPOLL_TFD(r9, 0x0, 0x7, 0xffffffffffffffff, &(0x7f00000005c0)={0xffffffffffffffff, r3}) 08:21:09 executing program 6: iopl(0x1) ioctl$TIOCSSOFTCAR(0xffffffffffffffff, 0x541a, &(0x7f0000000000)=0x800) ioctl$CDROM_MEDIA_CHANGED(0xffffffffffffffff, 0x5325, 0x6) r0 = openat$null(0xffffffffffffff9c, &(0x7f0000000040), 0x10000, 0x0) ioctl$PTP_PIN_GETFUNC2(r0, 0xc0603d0f, &(0x7f0000000080)={'\x00', 0x2, 0x3, 0x507}) r1 = openat$ptp0(0xffffffffffffff9c, &(0x7f0000000100), 0x200000, 0x0) ioctl$PTP_PIN_SETFUNC2(r1, 0x40603d10, &(0x7f0000000140)={'\x00', 0x4, 0x3, 0x8}) openat$ptp0(0xffffffffffffff9c, &(0x7f00000001c0), 0x0, 0x0) r2 = fsmount(r0, 0x1, 0x48) r3 = syz_open_dev$vcsn(&(0x7f0000000200), 0x8, 0x81) mmap$IORING_OFF_SQ_RING(&(0x7f0000ffb000/0x4000)=nil, 0x4000, 0x0, 0x4000010, r3, 0x0) sendmsg$BATADV_CMD_GET_HARDIF(r2, &(0x7f0000000300)={&(0x7f0000000240)={0x10, 0x0, 0x0, 0x200}, 0xc, &(0x7f00000002c0)={&(0x7f0000000280)={0x2c, 0x0, 0x8, 0x70bd2b, 0x25dfdbff, {}, [@BATADV_ATTR_TPMETER_TEST_TIME={0x8, 0xb, 0x7}, @BATADV_ATTR_HOP_PENALTY={0x5, 0x35, 0x6}, @BATADV_ATTR_NETWORK_CODING_ENABLED={0x5}]}, 0x2c}, 0x1, 0x0, 0x0, 0xc010}, 0x20004000) r4 = openat$null(0xffffffffffffff9c, &(0x7f0000000340), 0x1, 0x0) ioctl$CDROM_GET_CAPABILITY(r4, 0x5331) r5 = socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$inet_tcp_TCP_FASTOPEN_KEY(r5, 0x6, 0x21, &(0x7f0000000380)="194ae7bad6611104d3bf8e081b4df75f", 0x10) r6 = openat$null(0xffffffffffffff9c, &(0x7f00000003c0), 0x3a1141, 0x0) ioctl$TIOCSPGRP(r6, 0x5410, &(0x7f0000000400)) ioctl$VT_RESIZEX(r4, 0x560a, &(0x7f0000000440)={0x20, 0x4, 0x7, 0xc1, 0x3}) ioctl$sock_inet_tcp_SIOCOUTQNSD(r0, 0x894b, &(0x7f0000000480)) 08:21:09 executing program 3: getresgid(&(0x7f0000000000), &(0x7f0000000040)=0x0, &(0x7f0000000080)=0x0) getresgid(&(0x7f00000000c0), &(0x7f0000000100)=0x0, &(0x7f0000000140)) setregid(r1, r2) sendmsg$BATADV_CMD_GET_MESH(0xffffffffffffffff, &(0x7f0000000280)={&(0x7f0000000180), 0xc, &(0x7f0000000240)={&(0x7f00000001c0)={0x68, 0x0, 0x4, 0x70bd2b, 0x25dfdbfd, {}, [@BATADV_ATTR_ISOLATION_MARK={0x8, 0x2b, 0x61c}, @BATADV_ATTR_NETWORK_CODING_ENABLED={0x5, 0x38, 0x1}, @BATADV_ATTR_ELP_INTERVAL={0x8, 0x3a, 0xfffffffb}, @BATADV_ATTR_VLANID={0x6, 0x28, 0x2}, @BATADV_ATTR_BONDING_ENABLED={0x5, 0x2d, 0x1}, @BATADV_ATTR_BONDING_ENABLED={0x5}, @BATADV_ATTR_GW_BANDWIDTH_DOWN={0x8, 0x31, 0x8}, @BATADV_ATTR_GW_BANDWIDTH_UP={0x8, 0x32, 0x7}, @BATADV_ATTR_ELP_INTERVAL={0x8, 0x3a, 0x7f}, @BATADV_ATTR_ORIG_ADDRESS={0xa, 0x9, @multicast}]}, 0x68}, 0x1, 0x0, 0x0, 0x880}, 0x1) getresgid(&(0x7f0000000300)=0x0, &(0x7f0000000340), &(0x7f0000000380)) setregid(r0, r3) getresgid(&(0x7f00000003c0)=0x0, &(0x7f0000000400), &(0x7f0000000440)) setgid(r4) getresuid(&(0x7f0000000580), &(0x7f00000005c0), &(0x7f0000000600)=0x0) mount$9p_fd(0x0, &(0x7f0000000480)='./file0\x00', &(0x7f00000004c0), 0x2, &(0x7f0000000640)={'trans=fd,', {}, 0x2c, {}, 0x2c, {[{@afid={'afid', 0x3d, 0x6}}], [{@uid_lt={'uid<', r5}}, {@subj_role}, {@fsuuid={'fsuuid', 0x3d, {[0x64, 0x61, 0x32, 0x32, 0x36, 0x31, 0x64, 0x64], 0x2d, [0x36, 0x39, 0x64, 0x33], 0x2d, [0x65, 0x38, 0x61, 0x33], 0x2d, [0x39, 0x62, 0x62, 0x66], 0x2d, [0x64, 0x36, 0x37, 0x39, 0x31, 0x39, 0x38, 0x34]}}}, {@seclabel}, {@context={'context', 0x3d, 'root'}}, {@smackfsfloor={'smackfsfloor', 0x3d, '\xbb\xbb\xbb\xbb\xbb\xbb'}}, {@smackfsfloor={'smackfsfloor', 0x3d, '\xbb\xbb\xbb\xbb\xbb\xbb'}}, {@audit}, {@smackfsdef={'smackfsdef', 0x3d, '\xbb\xbb\xbb\xbb\xbb\xbb'}}, {@context={'context', 0x3d, 'system_u'}}]}}) r6 = io_uring_setup(0x595b, &(0x7f0000000780)={0x0, 0xd16a, 0x0, 0x3, 0x10c}) pipe2$9p(&(0x7f0000000880)={0xffffffffffffffff}, 0x6800) r8 = geteuid() mount$9p_fd(0x0, &(0x7f0000000800)='./file0\x00', &(0x7f0000000840), 0x100c10, &(0x7f00000008c0)={'trans=fd,', {'rfdno', 0x3d, r7}, 0x2c, {'wfdno', 0x3d, r6}, 0x2c, {[{@debug={'debug', 0x3d, 0x8}}, {@access_client}, {@version_9p2000}, {@fscache}], [{@dont_measure}, {@dont_appraise}, {@obj_type={'obj_type', 0x3d, 'root'}}, {@fsuuid={'fsuuid', 0x3d, {[0x36, 0x31, 0x64, 0x32, 0x32, 0x31, 0x61, 0x38], 0x2d, [0x63, 0x61, 0x36, 0x32], 0x2d, [0x37, 0x65, 0x39, 0x38], 0x2d, [0x37, 0x65, 0x33], 0x2d, [0x57, 0x66, 0x65, 0x42, 0x30, 0x66, 0x31, 0x30]}}}, {@smackfstransmute={'smackfstransmute', 0x3d, '9p\x00'}}, {@fowner_lt={'fowner<', r8}}, {@seclabel}, {@audit}]}}) ioctl$PTP_PEROUT_REQUEST(0xffffffffffffffff, 0x40383d03, &(0x7f0000000a00)={{0x2}, {0x6, 0x8}, 0x81}) r9 = openat$null(0xffffffffffffff9c, &(0x7f0000000ac0), 0x40000, 0x0) mount$9p_fd(0x0, &(0x7f0000000a40)='./file0\x00', &(0x7f0000000a80), 0x2000, &(0x7f0000000b00)={'trans=fd,', {'rfdno', 0x3d, r7}, 0x2c, {'wfdno', 0x3d, r9}, 0x2c, {[{@privport}, {@access_user}, {@version_u}, {@noextend}, {@cache_fscache}, {@version_u}], [{@smackfshat={'smackfshat', 0x3d, '\x12'}}, {@subj_type={'subj_type', 0x3d, '#\xad*.'}}, {@smackfsroot={'smackfsroot', 0x3d, 'fsuuid'}}, {@fsuuid={'fsuuid', 0x3d, {[0x38, 0x61, 0x61, 0x32, 0x35, 0x39, 0x63, 0x39], 0x2d, [0x34, 0x39, 0x64, 0x66], 0x2d, [0x65, 0x64, 0x64, 0x66], 0x2d, [0x38, 0x31, 0x37, 0x36], 0x2d, [0x62, 0x39, 0x39, 0x33, 0x39, 0x64, 0x38, 0x36]}}}]}}) r10 = fsmount(r9, 0x0, 0x6b) ioctl$TIOCSPGRP(r10, 0x5410, &(0x7f0000000c00)=0xffffffffffffffff) setgid(r3) 08:21:09 executing program 0: r0 = syz_open_dev$tty20(0xc, 0x4, 0x0) ioctl$TIOCGSID(r0, 0x5429, &(0x7f0000000000)) r1 = syz_open_dev$tty1(0xc, 0x4, 0x2) ioctl$TIOCSRS485(r1, 0x542f, &(0x7f0000000040)={0x7, 0x8, 0x8a9}) ioctl$TIOCSPTLCK(r1, 0x40045431, &(0x7f0000000080)=0x1) r2 = ioctl$TIOCGPTPEER(r1, 0x5441, 0x2) ioctl$KDGETMODE(r2, 0x4b3b, &(0x7f00000000c0)) r3 = fsmount(0xffffffffffffffff, 0x1, 0x84) ioctl$TIOCGSID(r3, 0x5429, &(0x7f0000000100)) ioctl$TIOCSWINSZ(r3, 0x5414, &(0x7f0000000140)={0xc1, 0x5, 0x7ff, 0x7}) r4 = openat$ttyS3(0xffffffffffffff9c, &(0x7f0000000180), 0x1, 0x0) ioctl$GIO_UNISCRNMAP(r4, 0x4b69, &(0x7f00000001c0)=""/131) r5 = epoll_create1(0x0) epoll_ctl$EPOLL_CTL_MOD(r5, 0x3, 0xffffffffffffffff, &(0x7f0000000280)={0x10}) r6 = openat$null(0xffffffffffffff9c, &(0x7f00000002c0), 0x800, 0x0) syz_io_uring_submit(0x0, 0x0, &(0x7f00000003c0)=@IORING_OP_ACCEPT={0xd, 0x1, 0x0, r6, &(0x7f0000000300)=0x80, &(0x7f0000000340)=@ethernet={0x0, @multicast}}, 0x40) ioctl$TIOCSRS485(r3, 0x542f, &(0x7f0000000400)={0x0, 0x80000000, 0xff}) ioctl$TIOCL_GETMOUSEREPORTING(0xffffffffffffffff, 0x541c, &(0x7f0000000440)) ioctl$KDGETMODE(r4, 0x4b3b, &(0x7f0000000480)) ioctl$GIO_UNISCRNMAP(r3, 0x4b69, &(0x7f00000004c0)=""/104) 08:21:09 executing program 5: r0 = ioctl$TIOCGPTPEER(0xffffffffffffffff, 0x5441, 0xfffffffffffffff7) ioctl$PIO_FONTRESET(r0, 0x4b6d, 0x0) ioctl$KDGETMODE(r0, 0x4b3b, &(0x7f0000000000)) ioctl$VT_RESIZEX(r0, 0x560a, &(0x7f0000000040)={0x401, 0x4, 0x0, 0x7, 0x1, 0x6}) r1 = epoll_create1(0x80000) r2 = openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000080)='./cgroup/syz0\x00', 0x200002, 0x0) epoll_ctl$EPOLL_CTL_ADD(r1, 0x1, r2, &(0x7f00000000c0)={0x20000001}) ioctl$TIOCSPTLCK(r0, 0x40045431, &(0x7f0000000100)) ioctl$TIOCSPTLCK(r0, 0x40045431, &(0x7f0000000140)) r3 = openat$ttyS3(0xffffffffffffff9c, &(0x7f0000000180), 0x422800, 0x0) ioctl$TIOCSPGRP(r3, 0x5410, &(0x7f00000001c0)) r4 = syz_open_dev$ttys(0xc, 0x2, 0x1) ioctl$VT_RESIZEX(r4, 0x560a, &(0x7f0000000200)={0x40, 0x5, 0x1, 0x8001, 0x800, 0xfffa}) ioctl$TIOCGPTPEER(r4, 0x5441, 0x910000000000) r5 = fork() ptrace$getsig(0x4202, r5, 0x9, &(0x7f0000000240)) syz_open_dev$tty1(0xc, 0x4, 0x4) r6 = socket$nl_generic(0x10, 0x3, 0x10) mount$9p_fd(0x0, &(0x7f00000002c0)='./file0\x00', &(0x7f0000000300), 0x1040404, &(0x7f0000000340)={'trans=fd,', {}, 0x2c, {'wfdno', 0x3d, r6}, 0x2c, {[{@dfltuid={'dfltuid', 0x3d, 0xffffffffffffffff}}, {@cache_loose}, {@cache_fscache}, {@mmap}, {@cache_fscache}, {@dfltgid}], [{@obj_type={'obj_type', 0x3d, '/dev/ttyS3\x00'}}, {@subj_user={'subj_user', 0x3d, '!'}}]}}) ioctl$VT_RESIZEX(r4, 0x560a, &(0x7f0000000400)={0x7, 0x5, 0xfff, 0x9, 0xfffd, 0x5}) [ 118.132406] [ 118.132756] ===================================== [ 118.133462] WARNING: bad unlock balance detected! [ 118.134171] 6.19.0-rc5-next-20260116 #1 Not tainted [ 118.134903] ------------------------------------- [ 118.136339] syz-executor.0/3989 is trying to release lock (rcu_read_lock) at: [ 118.139228] [] __wait_on_freeing_inode+0x105/0x350 [ 118.141833] but there are no more locks to release! [ 118.144127] [ 118.144127] other info that might help us debug this: [ 118.145078] 4 locks held by syz-executor.0/3989: [ 118.145771] #0: ffff88800f64c3f8 (sb_writers#3){.+.+}-{0:0}, at: filename_create+0xf7/0x400 [ 118.147069] #1: ffff88801fc003e0 (&type->i_mutex_dir_key#3/1){+.+.}-{4:4}, at: filename_create+0x1b1/0x400 [ 118.148540] #2: ffff88800f5f8950 (jbd2_handle){++++}-{0:0}, at: start_this_handle+0xe32/0x12d0 [ 118.149847] #3: ffffffff85c16898 (inode_hash_lock){+.+.}-{3:3}, at: insert_inode_locked+0xf9/0x890 [ 118.151216] [ 118.151216] stack backtrace: [ 118.151872] CPU: 0 UID: 0 PID: 3989 Comm: syz-executor.0 Not tainted 6.19.0-rc5-next-20260116 #1 PREEMPT(lazy) [ 118.151899] Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.12.0-1 04/01/2014 [ 118.151911] Call Trace: [ 118.151919] [ 118.151926] dump_stack_lvl+0xca/0x120 [ 118.151970] ? __wait_on_freeing_inode+0x105/0x350 [ 118.151996] print_unlock_imbalance_bug+0x118/0x130 [ 118.152023] ? __wait_on_freeing_inode+0x105/0x350 [ 118.152049] lock_release+0x1ee/0x270 [ 118.152075] __wait_on_freeing_inode+0x10a/0x350 [ 118.152102] ? __pfx___wait_on_freeing_inode+0x10/0x10 [ 118.152130] ? __pfx_var_wake_function+0x10/0x10 [ 118.152161] ? lock_is_held_type+0x9e/0x120 [ 118.152182] insert_inode_locked+0x25f/0x890 [ 118.152212] __ext4_new_inode+0x223d/0x4cd0 [ 118.152243] ? __pfx___ext4_new_inode+0x10/0x10 [ 118.152269] ? __pfx___dquot_initialize+0x10/0x10 [ 118.152301] ? __pfx_avc_has_perm+0x10/0x10 [ 118.152328] ext4_symlink+0x623/0xb40 [ 118.152361] ? __pfx_ext4_symlink+0x10/0x10 [ 118.152389] ? security_inode_permission+0x72/0xe0 [ 118.152412] vfs_symlink+0x44b/0x840 [ 118.152442] filename_symlinkat+0x158/0x440 [ 118.152467] ? __pfx_filename_symlinkat+0x10/0x10 [ 118.152492] ? strncpy_from_user+0x21b/0x2f0 [ 118.152522] __x64_sys_symlink+0x82/0x110 [ 118.152546] do_syscall_64+0xbf/0x420 [ 118.152569] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 118.152592] RIP: 0033:0x7fd8640b4427 [ 118.152608] Code: 73 01 c3 48 c7 c1 bc ff ff ff f7 d8 64 89 01 48 83 c8 ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 b8 58 00 00 00 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 bc ff ff ff f7 d8 64 89 01 48 [ 118.152627] RSP: 002b:00007ffd349fcfc8 EFLAGS: 00000202 ORIG_RAX: 0000000000000058 [ 118.152647] RAX: ffffffffffffffda RBX: 0000000000000000 RCX: 00007fd8640b4427 [ 118.152660] RDX: 00007ffd349fd0a7 RSI: 00007fd86410f019 RDI: 00007ffd349fd090 [ 118.152674] RBP: 0000000000000000 R08: 0000000000000000 R09: 00007ffd349fce60 [ 118.152687] R10: 00007ffd349fcd17 R11: 0000000000000202 R12: 0000000000000001 [ 118.152699] R13: 0000000000000000 R14: 0000000000000001 R15: 00007ffd349fd090 [ 118.152718] [ 118.182577] ------------[ cut here ]------------ [ 118.184972] WARNING: kernel/rcu/tree_plugin.h:443 at __rcu_read_unlock+0x25f/0x5c0, CPU#0: syz-executor.0/3989 [ 118.186656] Modules linked in: [ 118.187224] CPU: 0 UID: 0 PID: 3989 Comm: syz-executor.0 Not tainted 6.19.0-rc5-next-20260116 #1 PREEMPT(lazy) [ 118.188765] Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.12.0-1 04/01/2014 [ 118.190057] RIP: 0010:__rcu_read_unlock+0x25f/0x5c0 [ 118.190997] Code: f2 02 00 00 c7 43 58 01 00 00 00 bf 09 00 00 00 e8 d6 b7 de ff 4d 85 f6 0f 84 73 fe ff ff e8 38 8a 20 00 fb e9 68 fe ff ff 90 <0f> 0b 90 5b 5d 41 5c 41 5d 41 5e e9 81 4d 74 03 e8 2c 5d 56 00 e9 [ 118.193984] RSP: 0018:ffff8880437779a0 EFLAGS: 00010286 [ 118.194783] RAX: 00000000ffffffff RBX: ffff88801464b700 RCX: ffffffff815660f7 [ 118.195912] RDX: 0000000000000000 RSI: ffffffff81566100 RDI: ffff88801464bafc [ 118.197046] RBP: ffff88801464b700 R08: 0000000000000000 R09: fffffbfff0ba7040 [ 118.198178] R10: 0000000000000000 R11: 0000000000000001 R12: ffff88801464b700 [ 118.199306] R13: 0000000000000001 R14: ffffffff85c0fb30 R15: ffff88801bfdd8e0 [ 118.200427] FS: 00005555710e2400(0000) GS:ffff8880e5342000(0000) knlGS:0000000000000000 [ 118.201689] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 118.202638] CR2: 00007fd864134540 CR3: 000000001d666000 CR4: 0000000000350ef0 [ 118.203770] Call Trace: [ 118.204294] [ 118.205549] __wait_on_freeing_inode+0x10f/0x350 [ 118.206940] ? __pfx___wait_on_freeing_inode+0x10/0x10 [ 118.209010] ? __pfx_var_wake_function+0x10/0x10 [ 118.211355] ? lock_is_held_type+0x9e/0x120 [ 118.213450] insert_inode_locked+0x25f/0x890 [ 118.216542] __ext4_new_inode+0x223d/0x4cd0 [ 118.221271] ? __pfx___ext4_new_inode+0x10/0x10 [ 118.223608] ? __pfx___dquot_initialize+0x10/0x10 [ 118.225109] ? __pfx_avc_has_perm+0x10/0x10 [ 118.228464] ext4_symlink+0x623/0xb40 [ 118.232723] ? __pfx_ext4_symlink+0x10/0x10 [ 118.234664] ? security_inode_permission+0x72/0xe0 [ 118.237762] vfs_symlink+0x44b/0x840 [ 118.240262] filename_symlinkat+0x158/0x440 [ 118.242433] ? __pfx_filename_symlinkat+0x10/0x10 [ 118.244014] ? strncpy_from_user+0x21b/0x2f0 [ 118.247558] __x64_sys_symlink+0x82/0x110 [ 118.249024] do_syscall_64+0xbf/0x420 [ 118.250529] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 118.251554] RIP: 0033:0x7fd8640b4427 [ 118.252308] Code: 73 01 c3 48 c7 c1 bc ff ff ff f7 d8 64 89 01 48 83 c8 ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 b8 58 00 00 00 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 bc ff ff ff f7 d8 64 89 01 48 [ 118.255074] RSP: 002b:00007ffd349fcfc8 EFLAGS: 00000202 ORIG_RAX: 0000000000000058 [ 118.256273] RAX: ffffffffffffffda RBX: 0000000000000000 RCX: 00007fd8640b4427 [ 118.257411] RDX: 00007ffd349fd0a7 RSI: 00007fd86410f019 RDI: 00007ffd349fd090 [ 118.258546] RBP: 0000000000000000 R08: 0000000000000000 R09: 00007ffd349fce60 [ 118.259679] R10: 00007ffd349fcd17 R11: 0000000000000202 R12: 0000000000000001 [ 118.260807] R13: 0000000000000000 R14: 0000000000000001 R15: 00007ffd349fd090 [ 118.265917] [ 118.266284] irq event stamp: 473 [ 118.266791] hardirqs last enabled at (473): [] irqentry_exit+0x17b/0x650 [ 118.268292] hardirqs last disabled at (472): [] sysvec_apic_timer_interrupt+0xf/0x80 [ 118.269924] softirqs last enabled at (466): [] kernel_fpu_end+0x59/0x70 [ 118.271330] softirqs last disabled at (464): [] kernel_fpu_begin_mask+0x1bb/0x300 [ 118.272919] ---[ end trace 0000000000000000 ]--- 08:21:16 executing program 0: r0 = syz_open_dev$tty20(0xc, 0x4, 0x0) ioctl$TIOCGSID(r0, 0x5429, &(0x7f0000000000)) r1 = syz_open_dev$tty1(0xc, 0x4, 0x2) ioctl$TIOCSRS485(r1, 0x542f, &(0x7f0000000040)={0x7, 0x8, 0x8a9}) ioctl$TIOCSPTLCK(r1, 0x40045431, &(0x7f0000000080)=0x1) r2 = ioctl$TIOCGPTPEER(r1, 0x5441, 0x2) ioctl$KDGETMODE(r2, 0x4b3b, &(0x7f00000000c0)) r3 = fsmount(0xffffffffffffffff, 0x1, 0x84) ioctl$TIOCGSID(r3, 0x5429, &(0x7f0000000100)) ioctl$TIOCSWINSZ(r3, 0x5414, &(0x7f0000000140)={0xc1, 0x5, 0x7ff, 0x7}) r4 = openat$ttyS3(0xffffffffffffff9c, &(0x7f0000000180), 0x1, 0x0) ioctl$GIO_UNISCRNMAP(r4, 0x4b69, &(0x7f00000001c0)=""/131) r5 = epoll_create1(0x0) epoll_ctl$EPOLL_CTL_MOD(r5, 0x3, 0xffffffffffffffff, &(0x7f0000000280)={0x10}) r6 = openat$null(0xffffffffffffff9c, &(0x7f00000002c0), 0x800, 0x0) syz_io_uring_submit(0x0, 0x0, &(0x7f00000003c0)=@IORING_OP_ACCEPT={0xd, 0x1, 0x0, r6, &(0x7f0000000300)=0x80, &(0x7f0000000340)=@ethernet={0x0, @multicast}}, 0x40) ioctl$TIOCSRS485(r3, 0x542f, &(0x7f0000000400)={0x0, 0x80000000, 0xff}) ioctl$TIOCL_GETMOUSEREPORTING(0xffffffffffffffff, 0x541c, &(0x7f0000000440)) ioctl$KDGETMODE(r4, 0x4b3b, &(0x7f0000000480)) ioctl$GIO_UNISCRNMAP(r3, 0x4b69, &(0x7f00000004c0)=""/104) 08:21:16 executing program 5: r0 = ioctl$TIOCGPTPEER(0xffffffffffffffff, 0x5441, 0xfffffffffffffff7) ioctl$PIO_FONTRESET(r0, 0x4b6d, 0x0) ioctl$KDGETMODE(r0, 0x4b3b, &(0x7f0000000000)) ioctl$VT_RESIZEX(r0, 0x560a, &(0x7f0000000040)={0x401, 0x4, 0x0, 0x7, 0x1, 0x6}) r1 = epoll_create1(0x80000) r2 = openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000080)='./cgroup/syz0\x00', 0x200002, 0x0) epoll_ctl$EPOLL_CTL_ADD(r1, 0x1, r2, &(0x7f00000000c0)={0x20000001}) ioctl$TIOCSPTLCK(r0, 0x40045431, &(0x7f0000000100)) ioctl$TIOCSPTLCK(r0, 0x40045431, &(0x7f0000000140)) r3 = openat$ttyS3(0xffffffffffffff9c, &(0x7f0000000180), 0x422800, 0x0) ioctl$TIOCSPGRP(r3, 0x5410, &(0x7f00000001c0)) r4 = syz_open_dev$ttys(0xc, 0x2, 0x1) ioctl$VT_RESIZEX(r4, 0x560a, &(0x7f0000000200)={0x40, 0x5, 0x1, 0x8001, 0x800, 0xfffa}) ioctl$TIOCGPTPEER(r4, 0x5441, 0x910000000000) r5 = fork() ptrace$getsig(0x4202, r5, 0x9, &(0x7f0000000240)) syz_open_dev$tty1(0xc, 0x4, 0x4) r6 = socket$nl_generic(0x10, 0x3, 0x10) mount$9p_fd(0x0, &(0x7f00000002c0)='./file0\x00', &(0x7f0000000300), 0x1040404, &(0x7f0000000340)={'trans=fd,', {}, 0x2c, {'wfdno', 0x3d, r6}, 0x2c, {[{@dfltuid={'dfltuid', 0x3d, 0xffffffffffffffff}}, {@cache_loose}, {@cache_fscache}, {@mmap}, {@cache_fscache}, {@dfltgid}], [{@obj_type={'obj_type', 0x3d, '/dev/ttyS3\x00'}}, {@subj_user={'subj_user', 0x3d, '!'}}]}}) 08:21:16 executing program 2: mmap$IORING_OFF_SQ_RING(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x1000000, 0x20010, 0xffffffffffffffff, 0x0) ioctl$TIOCL_SCROLLCONSOLE(0xffffffffffffffff, 0x541c, &(0x7f0000000000)={0xd, 0x8e5}) r0 = perf_event_open$cgroup(&(0x7f0000000080)={0x2, 0x80, 0x20, 0x7, 0x5e, 0x5, 0x0, 0x40, 0x200, 0x8, 0x0, 0x1, 0x1, 0x1, 0x1, 0x0, 0x1, 0x1, 0x1, 0x0, 0x0, 0x1, 0x0, 0x1, 0x1, 0x3, 0x1, 0x0, 0x1, 0x1, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x1, 0x0, 0x1, 0x0, 0x0, 0x0, 0x200, 0x1, @perf_bp={&(0x7f0000000040), 0x2}, 0x4060, 0xffffffffffffff00, 0xfffffff7, 0x0, 0x5, 0x5, 0x0, 0x0, 0x6, 0x0, 0x30}, 0xffffffffffffffff, 0x10, 0xffffffffffffffff, 0x8) ioctl$PERF_EVENT_IOC_QUERY_BPF(r0, 0xc008240a, &(0x7f0000000100)={0x8, 0x0, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0]}) sendmsg$BATADV_CMD_GET_VLAN(0xffffffffffffffff, &(0x7f0000000240)={&(0x7f0000000140)={0x10, 0x0, 0x0, 0x20}, 0xc, &(0x7f0000000200)={&(0x7f0000000180)={0x4c, 0x0, 0x200, 0x70bd2b, 0x25dfdbfc, {}, [@BATADV_ATTR_ELP_INTERVAL={0x8, 0x3a, 0x1}, @BATADV_ATTR_ISOLATION_MASK={0x8, 0x2c, 0x1}, @BATADV_ATTR_ISOLATION_MASK={0x8, 0x2c, 0x80000001}, @BATADV_ATTR_MESH_IFINDEX={0x8}, @BATADV_ATTR_BRIDGE_LOOP_AVOIDANCE_ENABLED={0x5}, @BATADV_ATTR_ISOLATION_MASK={0x8, 0x2c, 0x1}, @BATADV_ATTR_ISOLATION_MASK={0x8, 0x2c, 0x81}]}, 0x4c}, 0x1, 0x0, 0x0, 0x4000000}, 0x200008d0) r1 = openat$ptp0(0xffffffffffffff9c, &(0x7f0000000280), 0x102002, 0x0) ioctl$PTP_SYS_OFFSET_PRECISE(r1, 0xc0403d08, &(0x7f00000002c0)) sendmsg$BATADV_CMD_GET_TRANSTABLE_GLOBAL(0xffffffffffffffff, &(0x7f0000000400)={&(0x7f0000000300)={0x10, 0x0, 0x0, 0x2}, 0xc, &(0x7f00000003c0)={&(0x7f0000000340)={0x50, 0x0, 0x2, 0x70bd26, 0x25dfdbfc, {}, [@BATADV_ATTR_ELP_INTERVAL={0x8, 0x3a, 0x9}, @BATADV_ATTR_DISTRIBUTED_ARP_TABLE_ENABLED={0x5, 0x2f, 0x1}, @BATADV_ATTR_ISOLATION_MARK={0x8, 0x2b, 0x20}, @BATADV_ATTR_THROUGHPUT_OVERRIDE={0x8, 0x3b, 0x20}, @BATADV_ATTR_ORIG_ADDRESS={0xa}, @BATADV_ATTR_MESH_IFINDEX={0x8}, @BATADV_ATTR_ORIG_INTERVAL={0x8, 0x39, 0x1}]}, 0x50}}, 0x20004800) r2 = openat$null(0xffffffffffffff9c, &(0x7f0000000440), 0x440, 0x0) ioctl$PERF_EVENT_IOC_SET_OUTPUT(r0, 0x2405, r2) epoll_ctl$EPOLL_CTL_DEL(0xffffffffffffffff, 0x2, r1) io_uring_setup(0x39ad, &(0x7f0000000480)={0x0, 0x5964, 0x8, 0x3, 0x10, 0x0, r2}) ioctl$PERF_EVENT_IOC_DISABLE(r2, 0x2401, 0x2) fsconfig$FSCONFIG_SET_FD(r2, 0x5, &(0x7f0000000500)='/dev/ptp0\x00', 0x0, 0xffffffffffffffff) r3 = perf_event_open$cgroup(&(0x7f0000000580)={0x4, 0x80, 0x4, 0x5, 0xf0, 0x3f, 0x0, 0x20, 0x4040, 0xc, 0x0, 0x1, 0x1, 0x1, 0x0, 0x1, 0x0, 0x1, 0x1, 0x1, 0x0, 0x1, 0x0, 0x1, 0x1, 0x2, 0x1, 0x0, 0x1, 0x1, 0x1, 0x1, 0x0, 0x1, 0x1, 0x0, 0x1, 0x1, 0x1, 0x1, 0x1, 0x1, 0x1, 0x0, 0x1, 0x0, 0x0, 0x0, 0x80000000, 0x2, @perf_bp={&(0x7f0000000540), 0x7}, 0x204, 0x1, 0x6, 0x6, 0x5d9, 0x0, 0x5, 0x0, 0x4, 0x0, 0x9}, r2, 0x2, 0xffffffffffffffff, 0x0) ioctl$PERF_EVENT_IOC_PAUSE_OUTPUT(r3, 0x40042409, 0x0) r4 = io_uring_setup(0xfbf, &(0x7f0000000600)={0x0, 0xc8b, 0x4, 0x2, 0x1f3, 0x0, r2}) mmap$IORING_OFF_SQ_RING(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x9, 0x11, r4, 0x0) ioctl$PTP_CLOCK_GETCAPS(r2, 0x80503d01, &(0x7f0000000680)) fsopen(&(0x7f0000000700)='ecryptfs\x00', 0x1) 08:21:16 executing program 6: iopl(0x1) ioctl$TIOCSSOFTCAR(0xffffffffffffffff, 0x541a, &(0x7f0000000000)=0x800) ioctl$CDROM_MEDIA_CHANGED(0xffffffffffffffff, 0x5325, 0x6) r0 = openat$null(0xffffffffffffff9c, &(0x7f0000000040), 0x10000, 0x0) ioctl$PTP_PIN_GETFUNC2(r0, 0xc0603d0f, &(0x7f0000000080)={'\x00', 0x2, 0x3, 0x507}) r1 = openat$ptp0(0xffffffffffffff9c, &(0x7f0000000100), 0x200000, 0x0) ioctl$PTP_PIN_SETFUNC2(r1, 0x40603d10, &(0x7f0000000140)={'\x00', 0x4, 0x3, 0x8}) openat$ptp0(0xffffffffffffff9c, &(0x7f00000001c0), 0x0, 0x0) r2 = fsmount(r0, 0x1, 0x48) r3 = syz_open_dev$vcsn(&(0x7f0000000200), 0x8, 0x81) mmap$IORING_OFF_SQ_RING(&(0x7f0000ffb000/0x4000)=nil, 0x4000, 0x0, 0x4000010, r3, 0x0) sendmsg$BATADV_CMD_GET_HARDIF(r2, &(0x7f0000000300)={&(0x7f0000000240)={0x10, 0x0, 0x0, 0x200}, 0xc, &(0x7f00000002c0)={&(0x7f0000000280)={0x2c, 0x0, 0x8, 0x70bd2b, 0x25dfdbff, {}, [@BATADV_ATTR_TPMETER_TEST_TIME={0x8, 0xb, 0x7}, @BATADV_ATTR_HOP_PENALTY={0x5, 0x35, 0x6}, @BATADV_ATTR_NETWORK_CODING_ENABLED={0x5}]}, 0x2c}, 0x1, 0x0, 0x0, 0xc010}, 0x20004000) r4 = openat$null(0xffffffffffffff9c, &(0x7f0000000340), 0x1, 0x0) ioctl$CDROM_GET_CAPABILITY(r4, 0x5331) r5 = socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$inet_tcp_TCP_FASTOPEN_KEY(r5, 0x6, 0x21, &(0x7f0000000380)="194ae7bad6611104d3bf8e081b4df75f", 0x10) r6 = openat$null(0xffffffffffffff9c, &(0x7f00000003c0), 0x3a1141, 0x0) ioctl$TIOCSPGRP(r6, 0x5410, &(0x7f0000000400)) ioctl$VT_RESIZEX(r4, 0x560a, &(0x7f0000000440)={0x20, 0x4, 0x7, 0xc1, 0x3}) ioctl$sock_inet_tcp_SIOCOUTQNSD(r0, 0x894b, &(0x7f0000000480)) 08:21:16 executing program 3: getresgid(&(0x7f0000000000), &(0x7f0000000040)=0x0, &(0x7f0000000080)=0x0) getresgid(&(0x7f00000000c0), &(0x7f0000000100)=0x0, &(0x7f0000000140)) setregid(r1, r2) sendmsg$BATADV_CMD_GET_MESH(0xffffffffffffffff, &(0x7f0000000280)={&(0x7f0000000180), 0xc, &(0x7f0000000240)={&(0x7f00000001c0)={0x68, 0x0, 0x4, 0x70bd2b, 0x25dfdbfd, {}, [@BATADV_ATTR_ISOLATION_MARK={0x8, 0x2b, 0x61c}, @BATADV_ATTR_NETWORK_CODING_ENABLED={0x5, 0x38, 0x1}, @BATADV_ATTR_ELP_INTERVAL={0x8, 0x3a, 0xfffffffb}, @BATADV_ATTR_VLANID={0x6, 0x28, 0x2}, @BATADV_ATTR_BONDING_ENABLED={0x5, 0x2d, 0x1}, @BATADV_ATTR_BONDING_ENABLED={0x5}, @BATADV_ATTR_GW_BANDWIDTH_DOWN={0x8, 0x31, 0x8}, @BATADV_ATTR_GW_BANDWIDTH_UP={0x8, 0x32, 0x7}, @BATADV_ATTR_ELP_INTERVAL={0x8, 0x3a, 0x7f}, @BATADV_ATTR_ORIG_ADDRESS={0xa, 0x9, @multicast}]}, 0x68}, 0x1, 0x0, 0x0, 0x880}, 0x1) getresgid(&(0x7f0000000300)=0x0, &(0x7f0000000340), &(0x7f0000000380)) setregid(r0, r3) getresgid(&(0x7f00000003c0)=0x0, &(0x7f0000000400), &(0x7f0000000440)) setgid(r4) getresuid(&(0x7f0000000580), &(0x7f00000005c0), &(0x7f0000000600)=0x0) mount$9p_fd(0x0, &(0x7f0000000480)='./file0\x00', &(0x7f00000004c0), 0x2, &(0x7f0000000640)={'trans=fd,', {}, 0x2c, {}, 0x2c, {[{@afid={'afid', 0x3d, 0x6}}], [{@uid_lt={'uid<', r5}}, {@subj_role}, {@fsuuid={'fsuuid', 0x3d, {[0x64, 0x61, 0x32, 0x32, 0x36, 0x31, 0x64, 0x64], 0x2d, [0x36, 0x39, 0x64, 0x33], 0x2d, [0x65, 0x38, 0x61, 0x33], 0x2d, [0x39, 0x62, 0x62, 0x66], 0x2d, [0x64, 0x36, 0x37, 0x39, 0x31, 0x39, 0x38, 0x34]}}}, {@seclabel}, {@context={'context', 0x3d, 'root'}}, {@smackfsfloor={'smackfsfloor', 0x3d, '\xbb\xbb\xbb\xbb\xbb\xbb'}}, {@smackfsfloor={'smackfsfloor', 0x3d, '\xbb\xbb\xbb\xbb\xbb\xbb'}}, {@audit}, {@smackfsdef={'smackfsdef', 0x3d, '\xbb\xbb\xbb\xbb\xbb\xbb'}}, {@context={'context', 0x3d, 'system_u'}}]}}) r6 = io_uring_setup(0x595b, &(0x7f0000000780)={0x0, 0xd16a, 0x0, 0x3, 0x10c}) pipe2$9p(&(0x7f0000000880)={0xffffffffffffffff}, 0x6800) r8 = geteuid() mount$9p_fd(0x0, &(0x7f0000000800)='./file0\x00', &(0x7f0000000840), 0x100c10, &(0x7f00000008c0)={'trans=fd,', {'rfdno', 0x3d, r7}, 0x2c, {'wfdno', 0x3d, r6}, 0x2c, {[{@debug={'debug', 0x3d, 0x8}}, {@access_client}, {@version_9p2000}, {@fscache}], [{@dont_measure}, {@dont_appraise}, {@obj_type={'obj_type', 0x3d, 'root'}}, {@fsuuid={'fsuuid', 0x3d, {[0x36, 0x31, 0x64, 0x32, 0x32, 0x31, 0x61, 0x38], 0x2d, [0x63, 0x61, 0x36, 0x32], 0x2d, [0x37, 0x65, 0x39, 0x38], 0x2d, [0x37, 0x65, 0x33], 0x2d, [0x57, 0x66, 0x65, 0x42, 0x30, 0x66, 0x31, 0x30]}}}, {@smackfstransmute={'smackfstransmute', 0x3d, '9p\x00'}}, {@fowner_lt={'fowner<', r8}}, {@seclabel}, {@audit}]}}) ioctl$PTP_PEROUT_REQUEST(0xffffffffffffffff, 0x40383d03, &(0x7f0000000a00)={{0x2}, {0x6, 0x8}, 0x81}) r9 = openat$null(0xffffffffffffff9c, &(0x7f0000000ac0), 0x40000, 0x0) mount$9p_fd(0x0, &(0x7f0000000a40)='./file0\x00', &(0x7f0000000a80), 0x2000, &(0x7f0000000b00)={'trans=fd,', {'rfdno', 0x3d, r7}, 0x2c, {'wfdno', 0x3d, r9}, 0x2c, {[{@privport}, {@access_user}, {@version_u}, {@noextend}, {@cache_fscache}, {@version_u}], [{@smackfshat={'smackfshat', 0x3d, '\x12'}}, {@subj_type={'subj_type', 0x3d, '#\xad*.'}}, {@smackfsroot={'smackfsroot', 0x3d, 'fsuuid'}}, {@fsuuid={'fsuuid', 0x3d, {[0x38, 0x61, 0x61, 0x32, 0x35, 0x39, 0x63, 0x39], 0x2d, [0x34, 0x39, 0x64, 0x66], 0x2d, [0x65, 0x64, 0x64, 0x66], 0x2d, [0x38, 0x31, 0x37, 0x36], 0x2d, [0x62, 0x39, 0x39, 0x33, 0x39, 0x64, 0x38, 0x36]}}}]}}) r10 = fsmount(r9, 0x0, 0x6b) ioctl$TIOCSPGRP(r10, 0x5410, &(0x7f0000000c00)=0xffffffffffffffff) setgid(r3) 08:21:16 executing program 4: r0 = io_uring_setup(0x64cf, &(0x7f0000000000)={0x0, 0x97b7, 0x20, 0x3, 0x3b7}) r1 = fsmount(0xffffffffffffffff, 0x0, 0x0) r2 = syz_io_uring_setup(0x354a, &(0x7f0000000080)={0x0, 0x44c0, 0x10, 0x1, 0x373, 0x0, r1}, &(0x7f0000ffa000/0x4000)=nil, &(0x7f0000ffa000/0x4000)=nil, &(0x7f0000000100), &(0x7f0000000140)) ioctl$SNAPSHOT_ATOMIC_RESTORE(r1, 0x3304) r3 = fsmount(r1, 0x1, 0x70) setsockopt$inet_tcp_TCP_CONGESTION(r1, 0x6, 0xd, &(0x7f0000000180)='bic\x00', 0x4) setsockopt$inet_tcp_TCP_QUEUE_SEQ(r1, 0x6, 0x15, &(0x7f00000001c0)=0x4583bca4, 0x4) ioctl$TIOCSSOFTCAR(r3, 0x541a, &(0x7f0000000200)=0x6) ioctl$sock_ipv6_tunnel_SIOCDEL6RD(r3, 0x89fa, &(0x7f00000002c0)={'ip6_vti0\x00', &(0x7f0000000240)={'sit0\x00', 0x0, 0x29, 0x1, 0x9, 0x100, 0x11, @private2, @empty, 0x80, 0x8, 0xc6e, 0x1}}) ioctl$sock_ipv6_tunnel_SIOCDELTUNNEL(r1, 0x89f2, &(0x7f0000000380)={'syztnl1\x00', &(0x7f0000000300)={'ip6gre0\x00', r4, 0x4, 0x1, 0x80, 0xd5bd, 0x12, @rand_addr=' \x01\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x02', @private2={0xfc, 0x2, '\x00', 0x1}, 0x8000, 0x1, 0x3, 0x34ff}}) r5 = fsmount(r3, 0x1, 0x8c) ioctl$ifreq_SIOCGIFINDEX_batadv_mesh(r3, 0x8933, &(0x7f00000003c0)={'batadv0\x00', 0x0}) ioctl$sock_ipv6_tunnel_SIOCDELTUNNEL(r5, 0x89f2, &(0x7f0000000480)={'ip6tnl0\x00', &(0x7f0000000400)={'syztnl2\x00', r6, 0x2f, 0x40, 0x9, 0x80000000, 0x10, @private0={0xfc, 0x0, '\x00', 0x1}, @dev={0xfe, 0x80, '\x00', 0x16}, 0x8, 0x7, 0x8}}) mmap$IORING_OFF_SQ_RING(&(0x7f0000ffa000/0x1000)=nil, 0x1000, 0xd, 0x40010, r0, 0x0) r7 = fsmount(r3, 0x0, 0x75) mmap$IORING_OFF_SQ_RING(&(0x7f0000ffc000/0x4000)=nil, 0x4000, 0x2000000, 0x10010, r2, 0x0) r8 = openat$null(0xffffffffffffff9c, &(0x7f0000000540), 0xc000, 0x0) fsconfig$FSCONFIG_SET_PATH(0xffffffffffffffff, 0x3, &(0x7f00000004c0)=' \x01\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x02', &(0x7f0000000500)='./file0\x00', r8) ioctl$TIOCGSID(r7, 0x5429, &(0x7f0000000580)=0x0) kcmp$KCMP_EPOLL_TFD(r9, 0x0, 0x7, 0xffffffffffffffff, &(0x7f00000005c0)={0xffffffffffffffff, r3}) 08:21:16 executing program 7: setsockopt$inet_tcp_TCP_CONGESTION(0xffffffffffffffff, 0x6, 0xd, &(0x7f0000000000)='dctcp\x00', 0x6) setsockopt$inet_tcp_int(0xffffffffffffffff, 0x6, 0x10, &(0x7f0000000040)=0x7, 0x4) r0 = syz_open_dev$vcsn(&(0x7f0000000080), 0xfffffffffffffffe, 0x6fc802) ioctl$sock_inet_tcp_SIOCATMARK(r0, 0x8905, &(0x7f00000000c0)) ioctl$GIO_UNISCRNMAP(0xffffffffffffffff, 0x4b69, &(0x7f0000000100)=""/252) ioctl$SNAPSHOT_S2RAM(r0, 0x330b) setsockopt$inet_tcp_int(r0, 0x6, 0x9, &(0x7f0000000200)=0x7, 0x4) r1 = getpgid(0x0) ioctl$TIOCGSID(r0, 0x5429, &(0x7f0000000240)=0x0) r3 = syz_open_pts(0xffffffffffffffff, 0x4000) kcmp$KCMP_EPOLL_TFD(r1, r2, 0x7, r0, &(0x7f0000000280)={r0, r3, 0x80000001}) r4 = fsmount(r0, 0x0, 0x2) ioctl$sock_inet_tcp_SIOCOUTQ(r4, 0x5411, &(0x7f00000002c0)) epoll_ctl$EPOLL_CTL_DEL(0xffffffffffffffff, 0x2, 0xffffffffffffffff) 08:21:16 executing program 1: r0 = socket(0x1d, 0x4, 0x3) epoll_ctl$EPOLL_CTL_ADD(0xffffffffffffffff, 0x1, r0, &(0x7f0000000000)={0x8}) r1 = socket(0x23, 0x2, 0x6) sendmsg$BATADV_CMD_GET_BLA_BACKBONE(r0, &(0x7f0000000140)={&(0x7f0000000040)={0x10, 0x0, 0x0, 0x200000}, 0xc, &(0x7f0000000100)={&(0x7f0000000080)={0x54, 0x0, 0x8, 0x70bd2d, 0x25dfdbfb, {}, [@BATADV_ATTR_THROUGHPUT_OVERRIDE={0x8, 0x3b, 0x4000}, @BATADV_ATTR_ORIG_ADDRESS={0xa, 0x9, @broadcast}, @BATADV_ATTR_ORIG_ADDRESS={0xa, 0x9, @remote}, @BATADV_ATTR_DISTRIBUTED_ARP_TABLE_ENABLED={0x5, 0x2f, 0x1}, @BATADV_ATTR_AP_ISOLATION_ENABLED={0x5, 0x2a, 0x1}, @BATADV_ATTR_AGGREGATED_OGMS_ENABLED={0x5}, @BATADV_ATTR_GW_SEL_CLASS={0x8, 0x34, 0x4}]}, 0x54}, 0x1, 0x0, 0x0, 0x800}, 0x22008003) ioctl$ifreq_SIOCGIFINDEX_batadv_mesh(r0, 0x8933, &(0x7f0000000180)={'batadv0\x00', 0x0}) ioctl$sock_ipv6_tunnel_SIOCDELTUNNEL(r1, 0x89f2, &(0x7f0000000240)={'ip6_vti0\x00', &(0x7f00000001c0)={'syztnl2\x00', r2, 0x2f, 0xf7, 0x1, 0x3ff, 0x1, @remote, @ipv4={'\x00', '\xff\xff', @dev={0xac, 0x14, 0x14, 0x19}}, 0x7, 0x700, 0x7fff, 0x1}}) ioctl$sock_ipv4_tunnel_SIOCGETTUNNEL(r1, 0x89f0, &(0x7f0000000380)={'syztnl0\x00', &(0x7f00000002c0)={'syztnl2\x00', r3, 0x8, 0x7, 0x1f, 0x8, {{0x19, 0x4, 0x1, 0x12, 0x64, 0x64, 0x0, 0x1, 0x2f, 0x0, @empty, @remote, {[@ra={0x94, 0x4, 0x1}, @timestamp_addr={0x44, 0xc, 0xc0, 0x1, 0xe, [{@dev={0xac, 0x14, 0x14, 0x11}, 0x9}]}, @cipso={0x86, 0x1b, 0x1, [{0x7, 0x3, "ee"}, {0x0, 0x12, "773efae1457b4b2a2bc243d7a1b87b1a"}]}, @ra={0x94, 0x4}, @lsrr={0x83, 0x3, 0xc9}, @rr={0x7, 0x13, 0x70, [@remote, @rand_addr=0x64010101, @remote, @loopback]}, @ra={0x94, 0x4}, @ra={0x94, 0x4, 0x1}]}}}}}) sendmsg$BATADV_CMD_GET_GATEWAYS(r1, &(0x7f0000000440)={&(0x7f0000000280)={0x10, 0x0, 0x0, 0x1000}, 0xc, &(0x7f0000000400)={&(0x7f00000003c0)={0x24, 0x0, 0x8, 0x70bd2c, 0x25dfdbfc, {}, [@BATADV_ATTR_HARD_IFINDEX={0x8, 0x6, r4}, @BATADV_ATTR_ELP_INTERVAL={0x8, 0x3a, 0x7}]}, 0x24}, 0x1, 0x0, 0x0, 0x800}, 0x24044001) epoll_ctl$EPOLL_CTL_ADD(0xffffffffffffffff, 0x1, r1, &(0x7f0000000480)={0x14}) setsockopt$inet_tcp_TCP_REPAIR(r1, 0x6, 0x13, &(0x7f00000004c0)=0x1, 0x4) r5 = syz_genetlink_get_family_id$batadv(&(0x7f0000000540), r1) sendmsg$BATADV_CMD_SET_MESH(r1, &(0x7f0000000600)={&(0x7f0000000500)={0x10, 0x0, 0x0, 0x10000000}, 0xc, &(0x7f00000005c0)={&(0x7f0000000580)={0x24, r5, 0x10, 0x70bd2b, 0x25dfdbfe, {}, [@BATADV_ATTR_ORIG_INTERVAL={0x8, 0x39, 0x200}, @BATADV_ATTR_ISOLATION_MASK={0x8}]}, 0x24}, 0x1, 0x0, 0x0, 0x4000000}, 0x24000000) r6 = openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000640)='./cgroup.cpu/syz0\x00', 0x200002, 0x0) epoll_ctl$EPOLL_CTL_ADD(0xffffffffffffffff, 0x1, r6, &(0x7f0000000680)={0x80000010}) syz_io_uring_setup(0x68d8, &(0x7f00000006c0)={0x0, 0x816b, 0x4, 0x3, 0xd3}, &(0x7f0000ffe000/0x1000)=nil, &(0x7f0000ffa000/0x4000)=nil, &(0x7f0000000740), &(0x7f0000000780)=0x0) syz_io_uring_submit(0x0, r7, &(0x7f00000007c0)=@IORING_OP_READ_FIXED={0x4, 0x4, 0x6000, @fd_index=0x7, 0x9, 0x6, 0x8000, 0x4, 0x0, {0x1}}, 0x7ff) sendmsg$BATADV_CMD_GET_DAT_CACHE(r0, &(0x7f00000008c0)={&(0x7f0000000800)={0x10, 0x0, 0x0, 0x10000}, 0xc, &(0x7f0000000880)={&(0x7f0000000840)={0x3c, r5, 0x2, 0x70bd2c, 0x25dfdbfd, {}, [@BATADV_ATTR_ORIG_INTERVAL={0x8, 0x39, 0x1}, @BATADV_ATTR_HOP_PENALTY={0x5, 0x35, 0x4}, @BATADV_ATTR_THROUGHPUT_OVERRIDE={0x8, 0x3b, 0x200}, @BATADV_ATTR_DISTRIBUTED_ARP_TABLE_ENABLED={0x5}, @BATADV_ATTR_GW_BANDWIDTH_UP={0x8, 0x32, 0xc5}]}, 0x3c}, 0x1, 0x0, 0x0, 0x20008000}, 0x4000000) ioctl$TCSETSF(0xffffffffffffffff, 0x5404, &(0x7f0000000900)={0x20, 0xffffffff, 0xfffffffc, 0x6, 0x17, "a9356d56911aecafa41c6efd030447fa097f76"}) setsockopt$inet_tcp_TCP_ULP(r0, 0x6, 0x1f, &(0x7f0000000940), 0x4) ptrace$getsig(0x4202, 0x0, 0x20, &(0x7f0000000980)) 08:21:16 executing program 0: r0 = syz_open_dev$tty20(0xc, 0x4, 0x0) ioctl$TIOCGSID(r0, 0x5429, &(0x7f0000000000)) r1 = syz_open_dev$tty1(0xc, 0x4, 0x2) ioctl$TIOCSRS485(r1, 0x542f, &(0x7f0000000040)={0x7, 0x8, 0x8a9}) ioctl$TIOCSPTLCK(r1, 0x40045431, &(0x7f0000000080)=0x1) r2 = ioctl$TIOCGPTPEER(r1, 0x5441, 0x2) ioctl$KDGETMODE(r2, 0x4b3b, &(0x7f00000000c0)) r3 = fsmount(0xffffffffffffffff, 0x1, 0x84) ioctl$TIOCGSID(r3, 0x5429, &(0x7f0000000100)) ioctl$TIOCSWINSZ(r3, 0x5414, &(0x7f0000000140)={0xc1, 0x5, 0x7ff, 0x7}) r4 = openat$ttyS3(0xffffffffffffff9c, &(0x7f0000000180), 0x1, 0x0) ioctl$GIO_UNISCRNMAP(r4, 0x4b69, &(0x7f00000001c0)=""/131) r5 = epoll_create1(0x0) epoll_ctl$EPOLL_CTL_MOD(r5, 0x3, 0xffffffffffffffff, &(0x7f0000000280)={0x10}) r6 = openat$null(0xffffffffffffff9c, &(0x7f00000002c0), 0x800, 0x0) syz_io_uring_submit(0x0, 0x0, &(0x7f00000003c0)=@IORING_OP_ACCEPT={0xd, 0x1, 0x0, r6, &(0x7f0000000300)=0x80, &(0x7f0000000340)=@ethernet={0x0, @multicast}}, 0x40) ioctl$TIOCSRS485(r3, 0x542f, &(0x7f0000000400)={0x0, 0x80000000, 0xff}) ioctl$TIOCL_GETMOUSEREPORTING(0xffffffffffffffff, 0x541c, &(0x7f0000000440)) ioctl$KDGETMODE(r4, 0x4b3b, &(0x7f0000000480)) 08:21:16 executing program 2: mmap$IORING_OFF_SQ_RING(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x1000000, 0x20010, 0xffffffffffffffff, 0x0) ioctl$TIOCL_SCROLLCONSOLE(0xffffffffffffffff, 0x541c, &(0x7f0000000000)={0xd, 0x8e5}) r0 = perf_event_open$cgroup(&(0x7f0000000080)={0x2, 0x80, 0x20, 0x7, 0x5e, 0x5, 0x0, 0x40, 0x200, 0x8, 0x0, 0x1, 0x1, 0x1, 0x1, 0x0, 0x1, 0x1, 0x1, 0x0, 0x0, 0x1, 0x0, 0x1, 0x1, 0x3, 0x1, 0x0, 0x1, 0x1, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x1, 0x0, 0x1, 0x0, 0x0, 0x0, 0x200, 0x1, @perf_bp={&(0x7f0000000040), 0x2}, 0x4060, 0xffffffffffffff00, 0xfffffff7, 0x0, 0x5, 0x5, 0x0, 0x0, 0x6, 0x0, 0x30}, 0xffffffffffffffff, 0x10, 0xffffffffffffffff, 0x8) ioctl$PERF_EVENT_IOC_QUERY_BPF(r0, 0xc008240a, &(0x7f0000000100)={0x8, 0x0, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0]}) sendmsg$BATADV_CMD_GET_VLAN(0xffffffffffffffff, &(0x7f0000000240)={&(0x7f0000000140)={0x10, 0x0, 0x0, 0x20}, 0xc, &(0x7f0000000200)={&(0x7f0000000180)={0x4c, 0x0, 0x200, 0x70bd2b, 0x25dfdbfc, {}, [@BATADV_ATTR_ELP_INTERVAL={0x8, 0x3a, 0x1}, @BATADV_ATTR_ISOLATION_MASK={0x8, 0x2c, 0x1}, @BATADV_ATTR_ISOLATION_MASK={0x8, 0x2c, 0x80000001}, @BATADV_ATTR_MESH_IFINDEX={0x8}, @BATADV_ATTR_BRIDGE_LOOP_AVOIDANCE_ENABLED={0x5}, @BATADV_ATTR_ISOLATION_MASK={0x8, 0x2c, 0x1}, @BATADV_ATTR_ISOLATION_MASK={0x8, 0x2c, 0x81}]}, 0x4c}, 0x1, 0x0, 0x0, 0x4000000}, 0x200008d0) r1 = openat$ptp0(0xffffffffffffff9c, &(0x7f0000000280), 0x102002, 0x0) ioctl$PTP_SYS_OFFSET_PRECISE(r1, 0xc0403d08, &(0x7f00000002c0)) sendmsg$BATADV_CMD_GET_TRANSTABLE_GLOBAL(0xffffffffffffffff, &(0x7f0000000400)={&(0x7f0000000300)={0x10, 0x0, 0x0, 0x2}, 0xc, &(0x7f00000003c0)={&(0x7f0000000340)={0x50, 0x0, 0x2, 0x70bd26, 0x25dfdbfc, {}, [@BATADV_ATTR_ELP_INTERVAL={0x8, 0x3a, 0x9}, @BATADV_ATTR_DISTRIBUTED_ARP_TABLE_ENABLED={0x5, 0x2f, 0x1}, @BATADV_ATTR_ISOLATION_MARK={0x8, 0x2b, 0x20}, @BATADV_ATTR_THROUGHPUT_OVERRIDE={0x8, 0x3b, 0x20}, @BATADV_ATTR_ORIG_ADDRESS={0xa}, @BATADV_ATTR_MESH_IFINDEX={0x8}, @BATADV_ATTR_ORIG_INTERVAL={0x8, 0x39, 0x1}]}, 0x50}}, 0x20004800) r2 = openat$null(0xffffffffffffff9c, &(0x7f0000000440), 0x440, 0x0) ioctl$PERF_EVENT_IOC_SET_OUTPUT(r0, 0x2405, r2) epoll_ctl$EPOLL_CTL_DEL(0xffffffffffffffff, 0x2, r1) io_uring_setup(0x39ad, &(0x7f0000000480)={0x0, 0x5964, 0x8, 0x3, 0x10, 0x0, r2}) ioctl$PERF_EVENT_IOC_DISABLE(r2, 0x2401, 0x2) fsconfig$FSCONFIG_SET_FD(r2, 0x5, &(0x7f0000000500)='/dev/ptp0\x00', 0x0, 0xffffffffffffffff) r3 = perf_event_open$cgroup(&(0x7f0000000580)={0x4, 0x80, 0x4, 0x5, 0xf0, 0x3f, 0x0, 0x20, 0x4040, 0xc, 0x0, 0x1, 0x1, 0x1, 0x0, 0x1, 0x0, 0x1, 0x1, 0x1, 0x0, 0x1, 0x0, 0x1, 0x1, 0x2, 0x1, 0x0, 0x1, 0x1, 0x1, 0x1, 0x0, 0x1, 0x1, 0x0, 0x1, 0x1, 0x1, 0x1, 0x1, 0x1, 0x1, 0x0, 0x1, 0x0, 0x0, 0x0, 0x80000000, 0x2, @perf_bp={&(0x7f0000000540), 0x7}, 0x204, 0x1, 0x6, 0x6, 0x5d9, 0x0, 0x5, 0x0, 0x4, 0x0, 0x9}, r2, 0x2, 0xffffffffffffffff, 0x0) ioctl$PERF_EVENT_IOC_PAUSE_OUTPUT(r3, 0x40042409, 0x0) r4 = io_uring_setup(0xfbf, &(0x7f0000000600)={0x0, 0xc8b, 0x4, 0x2, 0x1f3, 0x0, r2}) mmap$IORING_OFF_SQ_RING(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x9, 0x11, r4, 0x0) ioctl$PTP_CLOCK_GETCAPS(r2, 0x80503d01, &(0x7f0000000680)) fsopen(&(0x7f0000000700)='ecryptfs\x00', 0x1) 08:21:16 executing program 4: r0 = io_uring_setup(0x64cf, &(0x7f0000000000)={0x0, 0x97b7, 0x20, 0x3, 0x3b7}) r1 = fsmount(0xffffffffffffffff, 0x0, 0x0) r2 = syz_io_uring_setup(0x354a, &(0x7f0000000080)={0x0, 0x44c0, 0x10, 0x1, 0x373, 0x0, r1}, &(0x7f0000ffa000/0x4000)=nil, &(0x7f0000ffa000/0x4000)=nil, &(0x7f0000000100), &(0x7f0000000140)) ioctl$SNAPSHOT_ATOMIC_RESTORE(r1, 0x3304) r3 = fsmount(r1, 0x1, 0x70) setsockopt$inet_tcp_TCP_CONGESTION(r1, 0x6, 0xd, &(0x7f0000000180)='bic\x00', 0x4) setsockopt$inet_tcp_TCP_QUEUE_SEQ(r1, 0x6, 0x15, &(0x7f00000001c0)=0x4583bca4, 0x4) ioctl$TIOCSSOFTCAR(r3, 0x541a, &(0x7f0000000200)=0x6) ioctl$sock_ipv6_tunnel_SIOCDEL6RD(r3, 0x89fa, &(0x7f00000002c0)={'ip6_vti0\x00', &(0x7f0000000240)={'sit0\x00', 0x0, 0x29, 0x1, 0x9, 0x100, 0x11, @private2, @empty, 0x80, 0x8, 0xc6e, 0x1}}) ioctl$sock_ipv6_tunnel_SIOCDELTUNNEL(r1, 0x89f2, &(0x7f0000000380)={'syztnl1\x00', &(0x7f0000000300)={'ip6gre0\x00', r4, 0x4, 0x1, 0x80, 0xd5bd, 0x12, @rand_addr=' \x01\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x02', @private2={0xfc, 0x2, '\x00', 0x1}, 0x8000, 0x1, 0x3, 0x34ff}}) r5 = fsmount(r3, 0x1, 0x8c) ioctl$ifreq_SIOCGIFINDEX_batadv_mesh(r3, 0x8933, &(0x7f00000003c0)={'batadv0\x00', 0x0}) ioctl$sock_ipv6_tunnel_SIOCDELTUNNEL(r5, 0x89f2, &(0x7f0000000480)={'ip6tnl0\x00', &(0x7f0000000400)={'syztnl2\x00', r6, 0x2f, 0x40, 0x9, 0x80000000, 0x10, @private0={0xfc, 0x0, '\x00', 0x1}, @dev={0xfe, 0x80, '\x00', 0x16}, 0x8, 0x7, 0x8}}) mmap$IORING_OFF_SQ_RING(&(0x7f0000ffa000/0x1000)=nil, 0x1000, 0xd, 0x40010, r0, 0x0) fsmount(r3, 0x0, 0x75) mmap$IORING_OFF_SQ_RING(&(0x7f0000ffc000/0x4000)=nil, 0x4000, 0x2000000, 0x10010, r2, 0x0) r7 = openat$null(0xffffffffffffff9c, &(0x7f0000000540), 0xc000, 0x0) fsconfig$FSCONFIG_SET_PATH(0xffffffffffffffff, 0x3, &(0x7f00000004c0)=' \x01\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x02', &(0x7f0000000500)='./file0\x00', r7) kcmp$KCMP_EPOLL_TFD(0x0, 0x0, 0x7, 0xffffffffffffffff, &(0x7f00000005c0)={0xffffffffffffffff, r3}) VM DIAGNOSIS: 08:21:09 Registers: info registers vcpu 0 RAX=000000000000003c RBX=00000000000003f8 RCX=0000000000000000 RDX=00000000000003f8 RSI=ffffffff82975135 RDI=ffffffff889c19e0 RBP=ffffffff889c19a0 RSP=ffff8880437774a8 R8 =0000000000000000 R9 =ffffed100169d046 R10=000000000000003c R11=6666666666663c5b R12=000000000000003c R13=0000000000000010 R14=ffffffff889c19a0 R15=ffffffff82975120 RIP=ffffffff8297518d RFL=00000002 [-------] CPL=0 II=0 A20=1 SMM=0 HLT=0 ES =0000 0000000000000000 00000000 00000000 CS =0010 0000000000000000 ffffffff 00a09b00 DPL=0 CS64 [-RA] SS =0018 0000000000000000 ffffffff 00c09300 DPL=0 DS [-WA] DS =0000 0000000000000000 00000000 00000000 FS =0000 00005555710e2400 00000000 00000000 GS =0000 ffff8880e5342000 00000000 00000000 LDT=0000 fffffe1600000000 00000000 00000000 TR =0040 fffffe0000003000 00004087 00008b00 DPL=0 TSS64-busy GDT= fffffe0000001000 0000007f IDT= fffffe0000000000 00000fff CR0=80050033 CR2=00007fd864134540 CR3=000000001d666000 CR4=00350ef0 DR0=0000000000000000 DR1=0000000000000000 DR2=0000000000000000 DR3=0000000000000000 DR6=00000000ffff0ff0 DR7=0000000000000400 EFER=0000000000000d01 FCW=037f FSW=0000 [ST=0] FTW=00 MXCSR=00001f80 FPR0=0000000000000000 0000 FPR1=0000000000000000 0000 FPR2=0000000000000000 0000 FPR3=0000000000000000 0000 FPR4=0000000000000000 0000 FPR5=0000000000000000 0000 FPR6=0000000000000000 0000 FPR7=0000000000000000 0000 XMM00=00000000a60ce07b00000000cec3662e XMM01=000000000000000003515b82db34ca11 XMM02=0000000000000000333bebdfd0a6a21d XMM03=00000000000000000000000000000000 XMM04=000000ff0000000000000000000000ff XMM05=00000000000000000000000000000000 XMM06=00000000000000000000000000000000 XMM07=00000000000000000000000000000000 XMM08=00000000000000000000000000000000 XMM09=00000000000000000000000000000000 XMM10=00000000000000000000000000000000 XMM11=00000000000000000000000000000000 XMM12=00000000000000000000000000000000 XMM13=00000000000000000000000000000000 XMM14=00000000000000000000000000000000 XMM15=00000000000000000000000000000000 info registers vcpu 1 RAX=0000000000000001 RBX=0000000000000001 RCX=ffffffff84d1a2ce RDX=fffffbfff0b82d11 RSI=0000000000000004 RDI=ffffffff85c16880 RBP=ffffffff85c16880 RSP=ffff88801b02fb40 R8 =0000000000000000 R9 =fffffbfff0b82d10 R10=ffffffff85c16883 R11=0000000000000000 R12=1ffff11003605f69 R13=0000000000000003 R14=fffffbfff0b82d10 R15=ffff88801b02fb78 RIP=ffffffff84d1a460 RFL=00000202 [-------] CPL=0 II=0 A20=1 SMM=0 HLT=0 ES =0000 0000000000000000 00000000 00000000 CS =0010 0000000000000000 ffffffff 00a09b00 DPL=0 CS64 [-RA] SS =0018 0000000000000000 ffffffff 00c09300 DPL=0 DS [-WA] DS =0000 0000000000000000 00000000 00000000 FS =0000 00005555753cc400 00000000 00000000 GS =0000 ffff8880e5442000 00000000 00000000 LDT=0000 fffffe5800000000 00000000 00000000 TR =0040 fffffe000004a000 00004087 00008b00 DPL=0 TSS64-busy GDT= fffffe0000048000 0000007f IDT= fffffe0000000000 00000fff CR0=80050033 CR2=00005555753d5c58 CR3=0000000013329000 CR4=00350ef0 DR0=0000000000000000 DR1=0000000000000000 DR2=0000000000000000 DR3=0000000000000000 DR6=00000000ffff0ff0 DR7=0000000000000400 EFER=0000000000000d01 FCW=037f FSW=0000 [ST=0] FTW=00 MXCSR=00001f80 FPR0=0000000000000000 0000 FPR1=0000000000000000 0000 FPR2=0000000000000000 0000 FPR3=0000000000000000 0000 FPR4=0000000000000000 0000 FPR5=0000000000000000 0000 FPR6=0000000000000000 0000 FPR7=0000000000000000 0000 XMM00=00000000a60ce07b00000000cec3662e XMM01=000000000000000003515b82db34ca11 XMM02=0000000000000000333bebdfd0a6a21d XMM03=00000000000000000000000000000000 XMM04=000000000000000000000000000000ff XMM05=00000000000000000000000000000000 XMM06=00000000000000000000000000000000 XMM07=00000000000000000000000000000000 XMM08=00000000000000000000000000000000 XMM09=00000000000000000000000000000000 XMM10=00000000000000000000000000000000 XMM11=00000000000000000000000000000000 XMM12=00000000000000000000000000000000 XMM13=00000000000000000000000000000000 XMM14=00000000000000000000000000000000 XMM15=00000000000000000000000000000000