Debian GNU/Linux 11 syzkaller ttyS0 Warning: Permanently added '[localhost]:47158' (ECDSA) to the list of known hosts. 2026/01/18 00:51:27 fuzzer started 2026/01/18 00:51:27 dialing manager at localhost:42157 syzkaller login: [ 44.542160] cgroup: Unknown subsys name 'net' [ 44.609443] cgroup: Unknown subsys name 'cpuset' [ 44.622591] cgroup: Unknown subsys name 'rlimit' 2026/01/18 00:51:39 syscalls: 223 2026/01/18 00:51:39 code coverage: enabled 2026/01/18 00:51:39 comparison tracing: enabled 2026/01/18 00:51:39 extra coverage: enabled 2026/01/18 00:51:39 setuid sandbox: enabled 2026/01/18 00:51:39 namespace sandbox: enabled 2026/01/18 00:51:39 Android sandbox: enabled 2026/01/18 00:51:39 fault injection: enabled 2026/01/18 00:51:39 leak checking: enabled 2026/01/18 00:51:39 net packet injection: enabled 2026/01/18 00:51:39 net device setup: enabled 2026/01/18 00:51:39 concurrency sanitizer: /sys/kernel/debug/kcsan does not exist 2026/01/18 00:51:39 devlink PCI setup: PCI device 0000:00:10.0 is not available 2026/01/18 00:51:39 USB emulation: enabled 2026/01/18 00:51:39 hci packet injection: enabled 2026/01/18 00:51:39 wifi device emulation: enabled 2026/01/18 00:51:39 802.15.4 emulation: enabled 2026/01/18 00:51:39 fetching corpus: 0, signal 0/0 (executing program) 2026/01/18 00:51:40 starting 8 fuzzer processes 00:51:40 executing program 1: r0 = openat$zero(0xffffffffffffff9c, &(0x7f0000000000), 0x400200, 0x0) ioctl$SECCOMP_IOCTL_NOTIF_ADDFD(r0, 0x40182103, &(0x7f0000000040)={0x0, 0x1, 0xffffffffffffffff, 0x80000000, 0x80000}) r1 = syz_genetlink_get_family_id$batadv(&(0x7f00000000c0), r0) sendmsg$BATADV_CMD_GET_TRANSTABLE_LOCAL(r0, &(0x7f00000001c0)={&(0x7f0000000080)={0x10, 0x0, 0x0, 0x80000}, 0xc, &(0x7f0000000180)={&(0x7f0000000100)={0x54, r1, 0x200, 0x70bd25, 0x25dfdbff, {}, [@BATADV_ATTR_THROUGHPUT_OVERRIDE={0x8, 0x3b, 0x89}, @BATADV_ATTR_THROUGHPUT_OVERRIDE={0x8, 0x3b, 0xffff}, @BATADV_ATTR_FRAGMENTATION_ENABLED={0x5}, @BATADV_ATTR_AGGREGATED_OGMS_ENABLED={0x5}, @BATADV_ATTR_MULTICAST_FORCEFLOOD_ENABLED={0x5}, @BATADV_ATTR_BRIDGE_LOOP_AVOIDANCE_ENABLED={0x5}, @BATADV_ATTR_HARD_IFINDEX={0x8}, @BATADV_ATTR_GW_MODE={0x5, 0x33, 0x1}]}, 0x54}, 0x1, 0x0, 0x0, 0x48041}, 0x4840) r2 = openat$procfs(0xffffffffffffff9c, &(0x7f0000000200)='/proc/cpuinfo\x00', 0x0, 0x0) sendmsg$BATADV_CMD_GET_GATEWAYS(r2, &(0x7f0000000340)={&(0x7f0000000240)={0x10, 0x0, 0x0, 0x1000000}, 0xc, &(0x7f0000000300)={&(0x7f0000000280)={0x50, r1, 0x400, 0x70bd26, 0x25dfdbfb, {}, [@BATADV_ATTR_BRIDGE_LOOP_AVOIDANCE_ENABLED={0x5, 0x2e, 0x1}, @BATADV_ATTR_ISOLATION_MARK={0x8, 0x2b, 0x3}, @BATADV_ATTR_BONDING_ENABLED={0x5}, @BATADV_ATTR_BRIDGE_LOOP_AVOIDANCE_ENABLED={0x5, 0x2e, 0x1}, @BATADV_ATTR_ORIG_ADDRESS={0xa, 0x9, @multicast}, @BATADV_ATTR_THROUGHPUT_OVERRIDE={0x8, 0x3b, 0x1}, @BATADV_ATTR_ISOLATION_MARK={0x8, 0x2b, 0x6}]}, 0x50}, 0x1, 0x0, 0x0, 0x20049800}, 0x80) r3 = syz_genetlink_get_family_id$batadv(&(0x7f00000003c0), r0) sendmsg$BATADV_CMD_SET_MESH(r0, &(0x7f0000000480)={&(0x7f0000000380)={0x10, 0x0, 0x0, 0x1000}, 0xc, &(0x7f0000000440)={&(0x7f0000000400)={0x34, r3, 0x400, 0x70bd2d, 0x25dfdbff, {}, [@BATADV_ATTR_GW_MODE={0x5}, @BATADV_ATTR_GW_BANDWIDTH_UP={0x8, 0x32, 0x8001}, @BATADV_ATTR_ORIG_INTERVAL={0x8, 0x39, 0x4}, @BATADV_ATTR_NETWORK_CODING_ENABLED={0x5, 0x38, 0x1}]}, 0x34}, 0x1, 0x0, 0x0, 0x4000000}, 0x18000) r4 = fsmount(r0, 0x1, 0x5) r5 = fsmount(r2, 0x1, 0x7a) epoll_ctl$EPOLL_CTL_ADD(r4, 0x1, r5, &(0x7f00000016c0)={0x80002000}) r6 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000001700), 0x111002, 0x0) epoll_ctl$EPOLL_CTL_MOD(r0, 0x3, r6, &(0x7f0000001740)) ioctl$SECCOMP_IOCTL_NOTIF_ID_VALID(r5, 0x40082102, &(0x7f0000001780)) rt_sigqueueinfo(0xffffffffffffffff, 0x2, &(0x7f00000017c0)={0x16, 0x5, 0x8}) ioctl$BINDER_SET_MAX_THREADS(r4, 0x40046205, &(0x7f0000001840)=0x4) r7 = syz_genetlink_get_family_id$ieee802154(&(0x7f00000018c0), 0xffffffffffffffff) sendmsg$IEEE802154_ASSOCIATE_RESP(0xffffffffffffffff, &(0x7f00000019c0)={&(0x7f0000001880)={0x10, 0x0, 0x0, 0x10}, 0xc, &(0x7f0000001980)={&(0x7f0000001900)={0x48, r7, 0x400, 0x70bd26, 0x25dfdbfc, {}, [@IEEE802154_ATTR_COORD_HW_ADDR={0xc, 0x9, {0x5555555555540004}}, @IEEE802154_ATTR_COORD_HW_ADDR={0xc, 0x9, {0xaaaaaaaaaaaa0302}}, @IEEE802154_ATTR_COORD_HW_ADDR={0xc, 0x9, {0xaaaaaaaaaaaa0002}}, @IEEE802154_ATTR_STATUS={0x5, 0x3, 0x88}, @IEEE802154_ATTR_STATUS={0x5, 0x3, 0x3}]}, 0x48}, 0x1, 0x0, 0x0, 0x800}, 0x810) ioctl$SECCOMP_IOCTL_NOTIF_ID_VALID(r0, 0x40082102, &(0x7f0000001a00)) sendmsg$SMC_PNETID_FLUSH(r5, &(0x7f0000001b80)={&(0x7f0000001a40)={0x10, 0x0, 0x0, 0x80000}, 0xc, &(0x7f0000001b40)={&(0x7f0000001ac0)={0x7c, 0x0, 0x8, 0x70bd2d, 0x25dfdbfb, {}, [@SMC_PNETID_IBPORT={0x5, 0x4, 0x2}, @SMC_PNETID_NAME={0x9, 0x1, 'syz2\x00'}, @SMC_PNETID_IBNAME={0x9, 0x3, 'syz0\x00'}, @SMC_PNETID_ETHNAME={0x14, 0x2, 'wg2\x00'}, @SMC_PNETID_NAME={0x9, 0x1, 'syz2\x00'}, @SMC_PNETID_ETHNAME={0x14, 0x2, 'veth1_macvtap\x00'}, @SMC_PNETID_IBPORT={0x5, 0x4, 0x2}, @SMC_PNETID_IBNAME={0x9, 0x3, 'syz0\x00'}]}, 0x7c}, 0x1, 0x0, 0x0, 0x20000040}, 0x20000800) 00:51:40 executing program 0: r0 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$ieee802154(&(0x7f0000000040), 0xffffffffffffffff) ioctl$sock_SIOCGIFINDEX_802154(0xffffffffffffffff, 0x8933, &(0x7f0000000080)={'wpan0\x00', 0x0}) sendmsg$IEEE802154_LLSEC_DEL_DEVKEY(r0, &(0x7f0000000140)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x2000000}, 0xc, &(0x7f0000000100)={&(0x7f00000000c0)={0x38, r1, 0x2, 0x70bd27, 0x25dfdbfb, {}, [@IEEE802154_ATTR_LLSEC_KEY_SOURCE_SHORT={0x8, 0x2c, 0xee0}, @IEEE802154_ATTR_PAN_ID={0x6, 0x6, 0xffff}, @IEEE802154_ATTR_DEV_INDEX={0x8, 0x2, r2}, @IEEE802154_ATTR_LLSEC_KEY_SOURCE_EXTENDED={0xc, 0x2d, {0xaaaaaaaaaaaa0002}}]}, 0x38}}, 0x4) r3 = syz_genetlink_get_family_id$ieee802154(&(0x7f00000001c0), r0) sendmsg$IEEE802154_LLSEC_ADD_KEY(r0, &(0x7f00000002c0)={&(0x7f0000000180)={0x10, 0x0, 0x0, 0x80}, 0xc, &(0x7f0000000280)={&(0x7f0000000200)={0x70, r3, 0x8dc3595b298c372b, 0x70bd2c, 0x25dfdbfd, {}, [@IEEE802154_ATTR_HW_ADDR={0xc, 0x5, {0xaaaaaaaaaaaa0302}}, @IEEE802154_ATTR_LLSEC_KEY_SOURCE_EXTENDED={0xc, 0x2d, {0xaaaaaaaaaaaa0202}}, @IEEE802154_ATTR_HW_ADDR={0xc, 0x5, {0xaaaaaaaaaaaa0002}}, @IEEE802154_ATTR_LLSEC_KEY_USAGE_FRAME_TYPES={0x5, 0x31, 0x81}, @IEEE802154_ATTR_DEV_NAME={0xa, 0x1, 'wpan1\x00'}, @IEEE802154_ATTR_LLSEC_KEY_USAGE_COMMANDS={0x24, 0x32, "c38d2be0aa0107a2b38f85915a757ba51ff3d89ac2e1c596dce3055b00418226"}]}, 0x70}, 0x1, 0x0, 0x0, 0x20004040}, 0x0) r4 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) sendmsg$IEEE802154_ASSOCIATE_RESP(r4, &(0x7f0000000400)={&(0x7f0000000300)={0x10, 0x0, 0x0, 0x2000000}, 0xc, &(0x7f00000003c0)={&(0x7f0000000340)={0x60, r3, 0x200, 0x70bd26, 0x25dfdbfd, {}, [@IEEE802154_ATTR_COORD_HW_ADDR={0xc}, @IEEE802154_ATTR_STATUS={0x5, 0x3, 0x40}, @IEEE802154_ATTR_STATUS={0x5, 0x3, 0x1}, @IEEE802154_ATTR_COORD_HW_ADDR={0xc, 0x9, {0x2c841fbeb2fffbec}}, @IEEE802154_ATTR_COORD_HW_ADDR={0xc, 0x9, {0xaaaaaaaaaaaa0202}}, @IEEE802154_ATTR_STATUS={0x5, 0x3, 0x6}, @IEEE802154_ATTR_STATUS={0x5, 0x3, 0x3f}, @IEEE802154_ATTR_COORD_SHORT_ADDR={0x6, 0x8, 0xffff}]}, 0x60}, 0x1, 0x0, 0x0, 0x20000000}, 0x20000080) ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, &(0x7f0000000540)={0xc, 0x0, &(0x7f0000000440)=[@dead_binder_done], 0xbf, 0x0, &(0x7f0000000480)="0537636f85beafebd2a00648fb042246bcbd2150d45e58acedd2718aaa529794fc45c87c914f2b69b82fedb220d6a94b2babd3f188631b48d025c32a8342250d69582838e7ee6d22fa335ce4315412805f50869d3f4bef11a5bb26ac3704b717f9416fc1f441d5dd77d4b3c1a283f3179a7daf20c0d30210361ea15f09fd38e2c2ac52383e1685a787783f4524fd7d784046605442e441fb76b236455574d7fe70d1885d924099864313d8d3d84c106a36d2ccc77c51d3cdaf3f716551fc0a"}) r5 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) syz_genetlink_get_family_id$ieee802154(&(0x7f0000000580), r5) sendmsg$IEEE802154_SET_MACPARAMS(r0, &(0x7f0000000680)={&(0x7f00000005c0)={0x10, 0x0, 0x0, 0x1000}, 0xc, &(0x7f0000000640)={&(0x7f0000000600)={0x2c, r3, 0x2, 0x70bd2d, 0x25dfdbfd, {}, [@IEEE802154_ATTR_CCA_ED_LEVEL={0x8, 0x24, 0x7fffffff}, @IEEE802154_ATTR_TXPOWER={0x5, 0x21, 0x3}, @IEEE802154_ATTR_CSMA_MAX_BE={0x5, 0x27, 0x4}]}, 0x2c}, 0x1, 0x0, 0x0, 0x40801}, 0x40840) r6 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) sendmsg$IEEE802154_LLSEC_DEL_SECLEVEL(r6, &(0x7f00000007c0)={&(0x7f00000006c0)={0x10, 0x0, 0x0, 0x40000000}, 0xc, &(0x7f0000000780)={&(0x7f0000000700)={0x44, r3, 0x300, 0x70bd2a, 0x25dfdbfb, {}, [@IEEE802154_ATTR_DEV_INDEX={0x8, 0x2, r2}, @IEEE802154_ATTR_LLSEC_FRAME_TYPE={0x5, 0x33, 0x1f}, @IEEE802154_ATTR_LLSEC_FRAME_TYPE={0x5, 0x33, 0x7}, @IEEE802154_ATTR_LLSEC_CMD_FRAME_ID={0x5, 0x34, 0xcb}, @IEEE802154_ATTR_LLSEC_DEV_OVERRIDE={0x5, 0x36, 0x1}, @IEEE802154_ATTR_LLSEC_CMD_FRAME_ID={0x5, 0x34, 0x1}]}, 0x44}, 0x1, 0x0, 0x0, 0x40000a1}, 0x4800) r7 = syz_genetlink_get_family_id$ieee802154(&(0x7f0000000840), r6) sendmsg$IEEE802154_LLSEC_DEL_DEV(r6, &(0x7f0000000940)={&(0x7f0000000800)={0x10, 0x0, 0x0, 0x2000}, 0xc, &(0x7f0000000900)={&(0x7f0000000880)={0x6c, r7, 0x100, 0x70bd26, 0x25dfdbfe, {}, [@IEEE802154_ATTR_HW_ADDR={0xc, 0x5, {0xaaaaaaaaaaaa0202}}, @IEEE802154_ATTR_HW_ADDR={0xc, 0x5, {0xaaaaaaaaaaaa0302}}, @IEEE802154_ATTR_DEV_INDEX={0x8, 0x2, r2}, @IEEE802154_ATTR_HW_ADDR={0xc}, @IEEE802154_ATTR_DEV_NAME={0xa, 0x1, 'wpan1\x00'}, @IEEE802154_ATTR_HW_ADDR={0xc, 0x5, {0xaaaaaaaaaaaa0302}}, @IEEE802154_ATTR_HW_ADDR={0xc}, @IEEE802154_ATTR_DEV_INDEX={0x8, 0x2, r2}]}, 0x6c}, 0x1, 0x0, 0x0, 0x41}, 0x20004040) ioctl$sock_SIOCGIFINDEX_802154(r5, 0x8933, &(0x7f00000009c0)={'wpan4\x00', 0x0}) ioctl$sock_SIOCGIFINDEX_802154(r5, 0x8933, &(0x7f0000000a00)={'wpan3\x00', 0x0}) sendmsg$IEEE802154_LLSEC_DEL_DEV(r0, &(0x7f0000000b00)={&(0x7f0000000980)={0x10, 0x0, 0x0, 0x1}, 0xc, &(0x7f0000000ac0)={&(0x7f0000000a40)={0x68, r7, 0x100, 0x70bd26, 0x25dfdbfd, {}, [@IEEE802154_ATTR_DEV_INDEX={0x8, 0x2, r8}, @IEEE802154_ATTR_DEV_INDEX={0x8}, @IEEE802154_ATTR_DEV_NAME={0xa, 0x1, 'wpan1\x00'}, @IEEE802154_ATTR_DEV_NAME={0xa, 0x1, 'wpan0\x00'}, @IEEE802154_ATTR_DEV_INDEX={0x8, 0x2, r9}, @IEEE802154_ATTR_HW_ADDR={0xc, 0x5, {0xaaaaaaaaaaaa0202}}, @IEEE802154_ATTR_DEV_INDEX={0x8, 0x2, r2}, @IEEE802154_ATTR_DEV_INDEX={0x8, 0x2, r2}, @IEEE802154_ATTR_DEV_INDEX={0x8, 0x2, r2}]}, 0x68}, 0x1, 0x0, 0x0, 0x20004880}, 0x50) sendmsg$IEEE802154_LLSEC_DEL_KEY(0xffffffffffffffff, &(0x7f0000000c80)={&(0x7f0000000b40)={0x10, 0x0, 0x0, 0x40000000}, 0xc, &(0x7f0000000c40)={&(0x7f0000000bc0)={0x58, 0x0, 0x402, 0x70bd2d, 0x25dfdbff, {}, [@IEEE802154_ATTR_LLSEC_KEY_MODE={0x5, 0x2b, 0x1}, @IEEE802154_ATTR_DEV_NAME={0xa, 0x1, 'wpan3\x00'}, @IEEE802154_ATTR_LLSEC_KEY_SOURCE_EXTENDED={0xc, 0x2d, {0xaaaaaaaaaaaa0302}}, @IEEE802154_ATTR_LLSEC_KEY_ID={0x5, 0x2e, 0x4}, @IEEE802154_ATTR_LLSEC_KEY_ID={0x5, 0x2e, 0x3}, @IEEE802154_ATTR_SHORT_ADDR={0x6, 0x4, 0xfffd}, @IEEE802154_ATTR_HW_ADDR={0xc}]}, 0x58}, 0x1, 0x0, 0x0, 0x40800}, 0x24040000) 00:51:40 executing program 2: r0 = fsmount(0xffffffffffffffff, 0x1, 0x2) r1 = fsmount(r0, 0x1, 0x7c) fsconfig$FSCONFIG_CMD_CREATE(r1, 0x6, 0x0, 0x0, 0x0) r2 = fsmount(r0, 0x0, 0x8) ioctl$CDROMREADCOOKED(r2, 0x5315, &(0x7f0000000000)) sendmsg$IPSET_CMD_HEADER(r0, &(0x7f0000000b40)={&(0x7f0000000a80)={0x10, 0x0, 0x0, 0x1000000}, 0xc, &(0x7f0000000b00)={&(0x7f0000000ac0)={0x28, 0xc, 0x6, 0x801, 0x0, 0x0, {0xf, 0x0, 0xa}, [@IPSET_ATTR_PROTOCOL={0x5}, @IPSET_ATTR_SETNAME={0x9, 0x2, 'syz2\x00'}]}, 0x28}, 0x1, 0x0, 0x0, 0x4000881}, 0x10) r3 = openat$zero(0xffffffffffffff9c, &(0x7f0000000b80), 0x0, 0x0) mmap$binder(&(0x7f0000fff000/0x1000)=nil, 0x1000, 0x1, 0x11, r3, 0x358f) ioctl$TIOCGICOUNT(r3, 0x545d, 0x0) ioctl$HIDIOCGPHYS(r2, 0x80404812, &(0x7f0000000bc0)) ioctl$CDROMVOLCTRL(r3, 0x530a, &(0x7f0000000c00)={0x1, 0xc0, 0x9, 0x40}) r4 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPSET_CMD_HEADER(r4, &(0x7f0000000d40)={&(0x7f0000000c40)={0x10, 0x0, 0x0, 0x80000}, 0xc, &(0x7f0000000d00)={&(0x7f0000000c80)={0x48, 0xc, 0x6, 0x101, 0x0, 0x0, {0x5, 0x0, 0x9}, [@IPSET_ATTR_PROTOCOL={0x5}, @IPSET_ATTR_PROTOCOL={0x5}, @IPSET_ATTR_SETNAME={0x9, 0x2, 'syz2\x00'}, @IPSET_ATTR_PROTOCOL={0x5}, @IPSET_ATTR_PROTOCOL={0x5}, @IPSET_ATTR_PROTOCOL={0x5}]}, 0x48}, 0x1, 0x0, 0x0, 0x10}, 0x0) openat$binderfs(0xffffffffffffff9c, &(0x7f0000000d80)='./binderfs2/custom0\x00', 0x1, 0x0) r5 = openat$procfs(0xffffffffffffff9c, &(0x7f0000000dc0)='/proc/cpuinfo\x00', 0x0, 0x0) fsmount(r5, 0x1, 0x2) ioctl$TIOCSERGETLSR(r1, 0x5459, &(0x7f0000000e00)) r6 = syz_open_dev$tty1(0xc, 0x4, 0x3) ioctl$TIOCGPTLCK(r6, 0x80045439, &(0x7f0000000e40)) openat$ttyS3(0xffffffffffffff9c, &(0x7f0000000e80), 0x4a80, 0x0) 00:51:40 executing program 3: clone(0x400, &(0x7f0000000000)="2f59adb4fe8bdd18e28d59f811fee00f6e", &(0x7f0000000040), &(0x7f0000000080), &(0x7f00000000c0)="ee4468595a6a9e17d313ddea1158c7520b4ce752e1feceb8bd763f38764fe32d5b11f9842e25fb3843f95d48bcbb676b94dc456e5f562cd49d08bd5ac38eb9d6acfc2fa3928b3de489313465b4bea18ac19b9efcb135738e957c5dfaa38b9755182fa0eb46bac360130ee66e2636e1d6aafb8e5918d6d0f8338603cd9bd3e0f3b5d106eae77f68fc50df9f58fd8061a03c31d04b3551c672a8334c0f3bd81aea189fc02f258c22a8b0dba2a60f9a458d6eff75d32cf215930f0bccd5f8ee1d8d33a86c5eda24ec311adc") ioctl$CDROMREADMODE1(0xffffffffffffffff, 0x530d, &(0x7f00000001c0)={0x8, 0x81, 0x4, 0x1, 0x1, 0x8}) ioctl$CDROMREADRAW(0xffffffffffffffff, 0x5314, &(0x7f0000000c40)={0x1, 0x5, 0x7, 0xe5, 0x2, 0x81}) r0 = openat$zero(0xffffffffffffff9c, &(0x7f00000016c0), 0x0, 0x0) ioctl$CDROMSTART(r0, 0x5308) rt_sigaction(0xf, &(0x7f0000001780)={&(0x7f0000001700)="66430f3a15df22c402d937a80e000000f347241ac44218f34ce000c4a2b528e8db5a2466440f38014fdb660f3810b006a50000c421fc295a0cdcf1", 0x80000004, &(0x7f0000001740)="642e41dde78f684ca2df01416dc463755c460b34f3460fa6c0c4c11b7cc7c442f1ad5b00f0430fab6b000f0f62f79af046f71c54", {[0xfffffffffffffffe]}}, &(0x7f0000001840)={&(0x7f00000017c0)="f240af66e20067363666460ffa6f5136360f974700c48165da31c422050c1ec4c17a6fbb2f000000c4027d2074f407f2430f1a39ff30", 0x0, &(0x7f0000001800)="c462394627defbc401f1d3cac46159de6e1fc4816c58a20700000066430faef2c4c16b7c9f0300000066400f6620f0ff0500000000c4e111d2f9"}, 0x8, &(0x7f0000001880)) timerfd_create(0x9, 0x800) prctl$PR_GET_FPEXC(0xb, &(0x7f00000018c0)) recvmmsg(r0, &(0x7f0000003c40)=[{{&(0x7f0000001900)=@pppol2tp={0x18, 0x1, {0x0, 0xffffffffffffffff, {0x2, 0x0, @empty}}}, 0x80, &(0x7f00000029c0)=[{&(0x7f0000001980)=""/39, 0x27}, {&(0x7f00000019c0)=""/4096, 0x1000}], 0x2, &(0x7f0000002a00)=""/18, 0x12}, 0x3f}, {{&(0x7f0000002a40)=@nfc, 0x80, &(0x7f0000002e80)=[{&(0x7f0000002ac0)=""/44, 0x2c}, {&(0x7f0000002b00)=""/65, 0x41}, {&(0x7f0000002b80)=""/107, 0x6b}, {&(0x7f0000002c00)=""/158, 0x9e}, {&(0x7f0000002cc0)=""/169, 0xa9}, {&(0x7f0000002d80)=""/57, 0x39}, {&(0x7f0000002dc0)=""/160, 0xa0}], 0x7}, 0x6}, {{&(0x7f0000002f00)=@x25={0x9, @remote}, 0x80, &(0x7f0000003100)=[{&(0x7f0000002f80)=""/101, 0x65}, {&(0x7f0000003000)}, {&(0x7f0000003040)=""/187, 0xbb}], 0x3, &(0x7f0000003140)=""/159, 0x9f}, 0xffffffff}, {{&(0x7f0000003200)=@ll={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @dev}, 0x80, &(0x7f0000003400)=[{&(0x7f0000003280)=""/29, 0x1d}, {&(0x7f00000032c0)=""/41, 0x29}, {&(0x7f0000003300)=""/219, 0xdb}], 0x3, &(0x7f0000003440)=""/204, 0xcc}, 0x2f62}, {{&(0x7f0000003540)=@hci, 0x80, &(0x7f0000003b80)=[{&(0x7f00000035c0)=""/168, 0xa8}, {&(0x7f0000003680)=""/128, 0x80}, {&(0x7f0000003700)=""/75, 0x4b}, {&(0x7f0000003780)=""/189, 0xbd}, {&(0x7f0000003840)=""/168, 0xa8}, {&(0x7f0000003900)=""/132, 0x84}, {&(0x7f00000039c0)=""/162, 0xa2}, {&(0x7f0000003a80)=""/198, 0xc6}], 0x8, &(0x7f0000003c00)=""/25, 0x19}, 0xfc00}], 0x5, 0x21, &(0x7f0000003d80)) r2 = socket$netlink(0x10, 0x3, 0xe) syz_genetlink_get_family_id$smc(&(0x7f0000003dc0), r2) timerfd_create(0x6, 0x800) ioctl$BINDER_THREAD_EXIT(r0, 0x40046208, 0x0) epoll_ctl$EPOLL_CTL_MOD(r0, 0x3, r1, &(0x7f0000003e00)={0xb0000000}) r3 = io_uring_setup(0x35ea, &(0x7f0000003e40)={0x0, 0x7cfa, 0x2, 0x0, 0x210, 0x0, r0}) io_uring_setup(0x106d, &(0x7f0000003ec0)={0x0, 0xb36, 0x1e, 0x1, 0xa7, 0x0, r3}) sendmsg$NBD_CMD_STATUS(0xffffffffffffffff, &(0x7f0000004040)={&(0x7f0000003f40)={0x10, 0x0, 0x0, 0x8}, 0xc, &(0x7f0000004000)={&(0x7f0000003f80)={0x6c, 0x0, 0x20, 0x70bd2a, 0x25dfdbff, {}, [@NBD_ATTR_DEAD_CONN_TIMEOUT={0xc, 0x8, 0x68b2}, @NBD_ATTR_SIZE_BYTES={0xc, 0x2, 0x1f}, @NBD_ATTR_SIZE_BYTES={0xc, 0x2, 0x8}, @NBD_ATTR_TIMEOUT={0xc, 0x4, 0x6}, @NBD_ATTR_DEAD_CONN_TIMEOUT={0xc, 0x8, 0x3}, @NBD_ATTR_CLIENT_FLAGS={0xc, 0x6, 0x1}, @NBD_ATTR_INDEX={0x8, 0x1, 0x0}, @NBD_ATTR_INDEX={0x8, 0x1, 0x0}]}, 0x6c}, 0x1, 0x0, 0x0, 0x40840}, 0x10) r4 = syz_genetlink_get_family_id$nbd(&(0x7f00000040c0), 0xffffffffffffffff) r5 = fsmount(r0, 0x0, 0xf0) sendmsg$NBD_CMD_RECONFIGURE(0xffffffffffffffff, &(0x7f00000041c0)={&(0x7f0000004080)={0x10, 0x0, 0x0, 0x2000}, 0xc, &(0x7f0000004180)={&(0x7f0000004140)={0x3c, r4, 0x100, 0x70bd29, 0x25dfdbfd, {}, [@NBD_ATTR_SOCKETS={0x14, 0x7, 0x0, 0x1, [{0x8, 0x1, r5}, {0x8}]}, @NBD_ATTR_INDEX={0x8, 0x1, 0x0}, @NBD_ATTR_SOCKETS={0xc, 0x7, 0x0, 0x1, [{0x8, 0x1, r0}]}]}, 0x3c}, 0x1, 0x0, 0x0, 0x810}, 0x40000) [ 55.569477] audit: type=1400 audit(1768697500.268:7): avc: denied { execmem } for pid=272 comm="syz-executor.0" scontext=system_u:system_r:kernel_t:s0 tcontext=system_u:system_r:kernel_t:s0 tclass=process permissive=1 00:51:40 executing program 4: r0 = openat$ttyS3(0xffffffffffffff9c, &(0x7f0000000000), 0xa2000, 0x0) ioctl$TIOCSETD(r0, 0x5423, &(0x7f0000000040)=0x13) r1 = fsmount(0xffffffffffffffff, 0x1, 0x76) ioctl$TCSETAF(r1, 0x5408, &(0x7f0000000080)={0x5, 0x8001, 0x4, 0x8001, 0x15, "b45da66f02087ca7"}) ioctl$TCSETAF(r1, 0x5408, &(0x7f00000000c0)={0x5, 0x22c1, 0x800, 0x8, 0x5, "2b8c058f839aaa67"}) connect$netlink(r1, &(0x7f0000000100)=@proc={0x10, 0x0, 0x25dfdbfd, 0x2}, 0xc) r2 = syz_open_dev$tty1(0xc, 0x4, 0x4) ioctl$TCSETSF(r2, 0x5404, &(0x7f0000000140)={0x6, 0x2, 0x2, 0x80000001, 0x1b, "c2331e6388ffeb48419d467a4b791ad4343a96"}) ioctl$TIOCMGET(r1, 0x5415, &(0x7f0000000180)) ioctl$TCSETAF(r2, 0x5408, &(0x7f00000001c0)={0x11, 0x0, 0xfff, 0x7, 0xd, "3ae59dd65d54337c"}) r3 = timerfd_create(0x7, 0x800) timerfd_settime(r3, 0x1, &(0x7f0000000200), &(0x7f0000000240)) ioctl$TCSETAF(r2, 0x5408, &(0x7f0000000280)={0x1, 0x1, 0x3d4c, 0x200, 0x0, "73a709364d80b6c1"}) ioctl$PIO_UNIMAPCLR(0xffffffffffffffff, 0x4b68, &(0x7f00000002c0)={0x73, 0x1fe0, 0x8b}) ioctl$TCSETSF2(r2, 0x402c542d, &(0x7f0000000300)={0xffffffff, 0x0, 0x80000000, 0x9, 0x6, "35157e2ff53385c0969535964d148320e065e8", 0x6}) ioctl$KDGKBMETA(0xffffffffffffffff, 0x4b62, &(0x7f0000000340)) ioctl$TIOCGICOUNT(r2, 0x545d, 0x0) socket(0x16, 0x1, 0x9) sendmsg$IEEE802154_LLSEC_DEL_KEY(0xffffffffffffffff, &(0x7f0000000440)={&(0x7f0000000380)={0x10, 0x0, 0x0, 0x10000}, 0xc, &(0x7f0000000400)={&(0x7f00000003c0)={0x38, 0x0, 0x10, 0x70bd2d, 0x25dfdbfe, {}, [@IEEE802154_ATTR_DEV_NAME={0xa, 0x1, 'wpan4\x00'}, @IEEE802154_ATTR_DEV_NAME={0xa, 0x1, 'wpan3\x00'}, @IEEE802154_ATTR_LLSEC_KEY_SOURCE_EXTENDED={0xc, 0x2d, {0xaaaaaaaaaaaa0302}}]}, 0x38}}, 0xc008) sendmsg$NL802154_CMD_SET_ACKREQ_DEFAULT(0xffffffffffffffff, &(0x7f0000000540)={&(0x7f0000000480)={0x10, 0x0, 0x0, 0x40}, 0xc, &(0x7f0000000500)={&(0x7f00000004c0)={0x28, 0x0, 0x800, 0x70bd28, 0x25dfdbfc, {}, [@NL802154_ATTR_WPAN_DEV={0xc, 0x6, 0x300000003}, @NL802154_ATTR_IFINDEX={0x8}]}, 0x28}, 0x1, 0x0, 0x0, 0x40}, 0x48080) 00:51:40 executing program 7: r0 = openat$procfs(0xffffffffffffff9c, &(0x7f0000000000)='/proc/mdstat\x00', 0x0, 0x0) mmap$IORING_OFF_CQ_RING(&(0x7f0000ffc000/0x2000)=nil, 0x2000, 0x8, 0x4010, r0, 0x8000000) r1 = openat$cdrom(0xffffffffffffff9c, &(0x7f0000000040), 0xb0840, 0x0) ioctl$CDROM_LOCKDOOR(r1, 0x5329, 0x1) r2 = openat$procfs(0xffffffffffffff9c, &(0x7f0000000080)='/proc/slabinfo\x00', 0x0, 0x0) epoll_ctl$EPOLL_CTL_DEL(r2, 0x2, r0) r3 = fsmount(r2, 0x0, 0x7f) ioctl$CDROMREADMODE1(r3, 0x530d, &(0x7f00000000c0)={0x7, 0x1f, 0x3, 0x81, 0xf3, 0x7b}) mprotect(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x1000008) mmap$IORING_OFF_CQ_RING(&(0x7f0000ffe000/0x1000)=nil, 0x1000, 0x2, 0x80010, r3, 0x8000000) socketpair$nbd(0x1, 0x1, 0x0, &(0x7f0000000d80)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$sock_SIOCGIFINDEX_80211(r5, 0x8933, &(0x7f0000000dc0)={'wlan1\x00'}) r6 = syz_genetlink_get_family_id$batadv(&(0x7f0000000e40), r0) sendmsg$BATADV_CMD_GET_ORIGINATORS(r3, &(0x7f0000000f00)={&(0x7f0000000e00)={0x10, 0x0, 0x0, 0x400000}, 0xc, &(0x7f0000000ec0)={&(0x7f0000000e80)={0x34, r6, 0x2, 0x70bd29, 0x25dfdbff, {}, [@BATADV_ATTR_THROUGHPUT_OVERRIDE={0x8, 0x3b, 0x8}, @BATADV_ATTR_BRIDGE_LOOP_AVOIDANCE_ENABLED={0x5, 0x2e, 0x1}, @BATADV_ATTR_FRAGMENTATION_ENABLED={0x5, 0x30, 0x1}, @BATADV_ATTR_TPMETER_TEST_TIME={0x8, 0xb, 0xfffffffb}]}, 0x34}, 0x1, 0x0, 0x0, 0x20000000}, 0x4000000) ioctl$CDROM_GET_CAPABILITY(0xffffffffffffffff, 0x5331) r7 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r8 = syz_genetlink_get_family_id$nbd(&(0x7f0000000f80), 0xffffffffffffffff) sendmsg$NBD_CMD_RECONFIGURE(r7, &(0x7f0000001040)={&(0x7f0000000f40)={0x10, 0x0, 0x0, 0x4000000}, 0xc, &(0x7f0000001000)={&(0x7f0000000fc0)={0x20, r8, 0x200, 0x70bd2b, 0x25dfdbfb, {}, [@NBD_ATTR_TIMEOUT={0xc, 0x4, 0x1f}]}, 0x20}, 0x1, 0x0, 0x0, 0x20000000}, 0x2004c000) ioctl$sock_SIOCGIFINDEX_80211(r4, 0x8933, &(0x7f0000001080)={'wlan1\x00'}) sendmsg$NBD_CMD_DISCONNECT(r7, &(0x7f00000011c0)={&(0x7f00000010c0)={0x10, 0x0, 0x0, 0x4000}, 0xc, &(0x7f0000001180)={&(0x7f0000001140)={0x20, 0x0, 0x20, 0x70bd25, 0x25dfdbfe, {}, [@NBD_ATTR_BLOCK_SIZE_BYTES={0xc, 0x3, 0x9de}]}, 0x20}, 0x1, 0x0, 0x0, 0x20004000}, 0x200000c5) 00:51:40 executing program 5: prctl$PR_GET_FPEXC(0xb, &(0x7f0000000000)) r0 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000040)='./binderfs/custom0\x00', 0x800, 0x0) ustat(0x800, &(0x7f0000000080)) ioctl$ifreq_SIOCGIFINDEX_batadv_mesh(0xffffffffffffffff, 0x8933, &(0x7f0000000100)={'batadv0\x00', 0x0}) ioctl$ifreq_SIOCGIFINDEX_batadv_hard(0xffffffffffffffff, 0x8933, &(0x7f0000000140)={'batadv_slave_0\x00', 0x0}) sendmsg$ETHTOOL_MSG_PAUSE_GET(0xffffffffffffffff, &(0x7f00000002c0)={&(0x7f00000000c0)={0x10, 0x0, 0x0, 0x10000}, 0xc, &(0x7f0000000280)={&(0x7f0000000180)={0xdc, 0x0, 0x8, 0x70bd27, 0x25dfdbfb, {}, [@HEADER={0x5c, 0x1, 0x0, 0x1, [@ETHTOOL_A_HEADER_DEV_INDEX={0x8, 0x1, r1}, @ETHTOOL_A_HEADER_FLAGS={0x8}, @ETHTOOL_A_HEADER_DEV_NAME={0x14, 0x2, 'veth0_vlan\x00'}, @ETHTOOL_A_HEADER_DEV_INDEX={0x8}, @ETHTOOL_A_HEADER_FLAGS={0x8, 0x3, 0x3}, @ETHTOOL_A_HEADER_FLAGS={0x8, 0x3, 0x2}, @ETHTOOL_A_HEADER_DEV_INDEX={0x8, 0x1, r2}, @ETHTOOL_A_HEADER_DEV_NAME={0x14, 0x2, 'macvlan0\x00'}]}, @HEADER={0x40, 0x1, 0x0, 0x1, [@ETHTOOL_A_HEADER_DEV_NAME={0x14, 0x2, 'veth0_to_bridge\x00'}, @ETHTOOL_A_HEADER_DEV_NAME={0x14, 0x2, 'veth0_to_bridge\x00'}, @ETHTOOL_A_HEADER_DEV_NAME={0x14, 0x2, 'netpci0\x00'}]}, @HEADER={0x2c, 0x1, 0x0, 0x1, [@ETHTOOL_A_HEADER_DEV_NAME={0x14, 0x2, 'bond_slave_1\x00'}, @ETHTOOL_A_HEADER_DEV_NAME={0x14, 0x2, 'ip_vti0\x00'}]}]}, 0xdc}, 0x1, 0x0, 0x0, 0x4000}, 0x24000000) sendmsg$NBD_CMD_STATUS(0xffffffffffffffff, &(0x7f0000000400)={&(0x7f0000000300)={0x10, 0x0, 0x0, 0x4}, 0xc, &(0x7f00000003c0)={&(0x7f0000000340)={0x44, 0x0, 0x20, 0x70bd2d, 0x25dfdbfc, {}, [@NBD_ATTR_SIZE_BYTES={0xc, 0x2, 0x4}, @NBD_ATTR_SOCKETS={0x24, 0x7, 0x0, 0x1, [{0x8}, {0x8}, {0x8}, {0x8}]}]}, 0x44}}, 0x4000) ioctl$BINDER_GET_NODE_DEBUG_INFO(r0, 0xc018620b, &(0x7f0000000440)={0x3}) syz_genetlink_get_family_id$batadv(&(0x7f0000000480), 0xffffffffffffffff) r3 = syz_open_dev$ttys(0xc, 0x2, 0x0) ioctl$TCSETAF(r3, 0x5408, &(0x7f00000004c0)={0x4, 0xb073, 0x1000, 0x1, 0x13, "b786e10fbdab60cc"}) openat$binderfs(0xffffffffffffff9c, &(0x7f0000000500)='./binderfs2/binder0\x00', 0x802, 0x0) sendmsg$BATADV_CMD_SET_VLAN(0xffffffffffffffff, &(0x7f0000000600)={&(0x7f0000000540)={0x10, 0x0, 0x0, 0x80000}, 0xc, &(0x7f00000005c0)={&(0x7f0000000580)={0x30, 0x0, 0x400, 0x70bd27, 0x25dfdbfb, {}, [@BATADV_ATTR_FRAGMENTATION_ENABLED={0x5, 0x30, 0x1}, @BATADV_ATTR_ORIG_ADDRESS={0xa, 0x9, @random="62836be88da6"}, @BATADV_ATTR_ISOLATION_MASK={0x8, 0x2c, 0x81}]}, 0x30}, 0x1, 0x0, 0x0, 0x8004}, 0x4c000) r4 = syz_open_dev$ttys(0xc, 0x2, 0x0) ioctl$TIOCEXCL(r4, 0x540c) r5 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) sendmsg$IEEE802154_LLSEC_GETPARAMS(r5, &(0x7f0000000740)={&(0x7f0000000640)={0x10, 0x0, 0x0, 0x8000000}, 0xc, &(0x7f0000000700)={&(0x7f0000000680)={0x48, 0x0, 0x4, 0x70bd28, 0x25dfdbfd, {}, [@IEEE802154_ATTR_DEV_INDEX={0x8}, @IEEE802154_ATTR_DEV_NAME={0xa, 0x1, 'wpan3\x00'}, @IEEE802154_ATTR_DEV_NAME={0xa, 0x1, 'wpan4\x00'}, @IEEE802154_ATTR_DEV_NAME={0xa, 0x1, 'wpan1\x00'}, @IEEE802154_ATTR_DEV_INDEX={0x8}]}, 0x48}, 0x1, 0x0, 0x0, 0x4000}, 0x20000080) sendmsg$IEEE802154_START_REQ(r5, &(0x7f0000000840)={&(0x7f0000000780)={0x10, 0x0, 0x0, 0x1000}, 0xc, &(0x7f0000000800)={&(0x7f00000007c0)={0x2c, 0x0, 0x400, 0x70bd2b, 0x25dfdbfb, {}, [@IEEE802154_ATTR_BAT_EXT={0x5, 0x1a, 0x94}, @IEEE802154_ATTR_PAGE={0x5, 0x1d, 0x13}, @IEEE802154_ATTR_COORD_SHORT_ADDR={0x6, 0x8, 0xaaa0}]}, 0x2c}, 0x1, 0x0, 0x0, 0x20000050}, 0x14) clone(0x28000800, &(0x7f0000000880)="b3f828035cfe9f8546c65ee8fffa58fb52d9bafabf363f0161cf01b4a2872006d34dcf860667a59d8c5631820a98c05b3989c5037ea89b5a58e8e9809cc008c7ae03db6bb845b2c189e79729a6d2c9a5440c276c7d0686adda809621c1d9723369157389ff141a56cbc54111ec7f92e8262b0c9ab88b9bffbb114333ab5a9711171c09e2589351fa4950d7af92bccf71585c21606994d6b4443d2cb6725d2c983a62f6f0", &(0x7f0000000940), &(0x7f0000000980), &(0x7f00000009c0)="073c516951c56a5fb1d10f1151ef77ee30e71fea92d34f29ddbe9265f84a8e761f6f56055bef1048f67ec1da822c677e9c34d5d52feb791c13c75661003151c2a956098cc6") sendmsg$ETHTOOL_MSG_LINKMODES_GET(0xffffffffffffffff, &(0x7f0000000c80)={&(0x7f0000000a40)={0x10, 0x0, 0x0, 0x100000}, 0xc, &(0x7f0000000c40)={&(0x7f0000000b40)={0xf4, 0x0, 0x8, 0x70bd25, 0x25dfdbfb, {}, [@HEADER={0x4c, 0x1, 0x0, 0x1, [@ETHTOOL_A_HEADER_FLAGS={0x8, 0x3, 0xdadbe43a496bc96b}, @ETHTOOL_A_HEADER_FLAGS={0x8, 0x3, 0x3}, @ETHTOOL_A_HEADER_DEV_INDEX={0x8}, @ETHTOOL_A_HEADER_FLAGS={0x8, 0x3, 0x2}, @ETHTOOL_A_HEADER_DEV_NAME={0x14, 0x2, 'sit0\x00'}, @ETHTOOL_A_HEADER_DEV_NAME={0x14, 0x2, 'erspan0\x00'}]}, @HEADER={0x2c, 0x1, 0x0, 0x1, [@ETHTOOL_A_HEADER_FLAGS={0x8, 0x3, 0x1}, @ETHTOOL_A_HEADER_FLAGS={0x8}, @ETHTOOL_A_HEADER_FLAGS={0x8, 0x3, 0x7}, @ETHTOOL_A_HEADER_FLAGS={0x8, 0x3, 0x3}, @ETHTOOL_A_HEADER_FLAGS={0x8}]}, @HEADER={0x68, 0x1, 0x0, 0x1, [@ETHTOOL_A_HEADER_FLAGS={0x8, 0x3, 0x3}, @ETHTOOL_A_HEADER_DEV_NAME={0x14, 0x2, 'vlan0\x00'}, @ETHTOOL_A_HEADER_DEV_NAME={0x14, 0x2, 'veth0_to_bond\x00'}, @ETHTOOL_A_HEADER_FLAGS={0x8}, @ETHTOOL_A_HEADER_FLAGS={0x8, 0x3, 0x2}, @ETHTOOL_A_HEADER_DEV_INDEX={0x8, 0x1, r2}, @ETHTOOL_A_HEADER_DEV_INDEX={0x8}, @ETHTOOL_A_HEADER_DEV_NAME={0x14, 0x2, 'bond_slave_1\x00'}]}]}, 0xf4}, 0x1, 0x0, 0x0, 0x4800}, 0x800) 00:51:40 executing program 6: ioctl$sock_SIOCGIFINDEX_802154(0xffffffffffffffff, 0x8933, &(0x7f0000000000)={'wpan1\x00', 0x0}) r1 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) ioctl$sock_SIOCGIFINDEX_802154(0xffffffffffffffff, 0x8933, &(0x7f0000000080)={'wpan3\x00', 0x0}) sendmsg$IEEE802154_LLSEC_ADD_SECLEVEL(r1, &(0x7f0000000140)={&(0x7f0000000040)={0x10, 0x0, 0x0, 0x800000}, 0xc, &(0x7f0000000100)={&(0x7f00000000c0)={0x2c, 0x0, 0x400, 0x70bd2a, 0x25dfdbfe, {}, [@IEEE802154_ATTR_DEV_INDEX={0x8, 0x2, r0}, @IEEE802154_ATTR_DEV_INDEX={0x8, 0x2, r0}, @IEEE802154_ATTR_DEV_INDEX={0x8, 0x2, r2}]}, 0x2c}, 0x1, 0x0, 0x0, 0x4004081}, 0x10) sendmsg$IEEE802154_LLSEC_DEL_KEY(r1, &(0x7f0000000240)={&(0x7f0000000180)={0x10, 0x0, 0x0, 0x1000000}, 0xc, &(0x7f0000000200)={&(0x7f00000001c0)={0x3c, 0x0, 0x30e, 0x70bd25, 0x25dfdbfd, {}, [@IEEE802154_ATTR_HW_ADDR={0xc, 0x5, {0xaaaaaaaaaaaa0102}}, @IEEE802154_ATTR_LLSEC_KEY_SOURCE_EXTENDED={0xc, 0x2d, {0xaaaaaaaaaaaa0102}}, @IEEE802154_ATTR_LLSEC_KEY_SOURCE_SHORT={0x8, 0x2c, 0x5}, @IEEE802154_ATTR_DEV_INDEX={0x8}]}, 0x3c}, 0x1, 0x0, 0x0, 0x24041000}, 0x44) socketpair$nbd(0x1, 0x1, 0x0, &(0x7f0000002280)={0xffffffffffffffff}) r4 = openat$procfs(0xffffffffffffff9c, &(0x7f00000022c0)='/proc/asound/seq/clients\x00', 0x0, 0x0) socketpair$nbd(0x1, 0x1, 0x0, &(0x7f0000002300)={0xffffffffffffffff}) r6 = socket(0x1d, 0x3, 0x6) r7 = openat$zero(0xffffffffffffff9c, &(0x7f0000002340), 0x2, 0x0) socketpair$nbd(0x1, 0x1, 0x0, &(0x7f0000002380)={0xffffffffffffffff}) sendmsg$NBD_CMD_DISCONNECT(r1, &(0x7f0000002480)={&(0x7f0000000280)={0x10, 0x0, 0x0, 0x80000}, 0xc, &(0x7f0000002440)={&(0x7f00000023c0)={0x6c, 0x0, 0x400, 0x70bd27, 0x25dfdbfb, {}, [@NBD_ATTR_TIMEOUT={0xc, 0x4, 0x100000001}, @NBD_ATTR_SOCKETS={0x4c, 0x7, 0x0, 0x1, [{0x8, 0x1, r3}, {0x8, 0x1, r4}, {0x8}, {0x8, 0x1, r5}, {0x8}, {0x8, 0x1, r6}, {0x8, 0x1, r7}, {0x8, 0x1, r8}, {0x8}]}]}, 0x6c}, 0x1, 0x0, 0x0, 0x20000000}, 0x4000020) r9 = syz_genetlink_get_family_id$ieee802154(&(0x7f0000002500), r1) sendmsg$IEEE802154_LLSEC_LIST_SECLEVEL(r1, &(0x7f00000025c0)={&(0x7f00000024c0)={0x10, 0x0, 0x0, 0x4}, 0xc, &(0x7f0000002580)={&(0x7f0000002540)={0x14, r9, 0x100, 0x70bd25, 0x25dfdbfd, {}, ["", "", "", "", "", ""]}, 0x14}, 0x1, 0x0, 0x0, 0x11}, 0x20000084) r10 = syz_genetlink_get_family_id$nbd(&(0x7f0000002640), r1) sendmsg$NBD_CMD_RECONFIGURE(r1, &(0x7f0000002700)={&(0x7f0000002600)={0x10, 0x0, 0x0, 0x800}, 0xc, &(0x7f00000026c0)={&(0x7f0000002680)={0x3c, r10, 0x800, 0x70bd2b, 0x25dfdbfe, {}, [@NBD_ATTR_DEAD_CONN_TIMEOUT={0xc, 0x8, 0x9}, @NBD_ATTR_SERVER_FLAGS={0xc, 0x5, 0x8}, @NBD_ATTR_INDEX={0x8, 0x1, 0x0}, @NBD_ATTR_INDEX={0x8, 0x1, 0x0}]}, 0x3c}, 0x1, 0x0, 0x0, 0x4000}, 0x40) r11 = fsmount(r7, 0x0, 0x80) r12 = ioctl$TIOCGPTPEER(r7, 0x5441, 0xe5) ioctl$BINDER_WRITE_READ(r11, 0xc0306201, &(0x7f0000002b40)={0xa8, 0x0, &(0x7f00000029c0)=[@dead_binder_done, @increfs={0x40046304, 0x3}, @exit_looper, @reply={0x40406301, {0x0, 0x0, 0x0, 0x0, 0x10, 0x0, 0x0, 0x60, 0x18, &(0x7f0000002800)={@fd={0x66642a85, 0x0, r12}, @ptr={0x70742a85, 0x1, &(0x7f0000002740)=""/143, 0x8f, 0x1, 0x27}, @fda={0x66646185, 0x6, 0x1, 0x1b}}, &(0x7f0000002880)={0x0, 0x18, 0x40}}}, @transaction={0x40406300, {0x569d, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x68, 0x18, &(0x7f0000002900)={@fda={0x66646185, 0x7, 0x2, 0x30}, @fda={0x66646185, 0x6, 0x1, 0x19}, @ptr={0x70742a85, 0x1, &(0x7f00000028c0)=""/44, 0x2c, 0x0, 0x1e}}, &(0x7f0000002980)={0x0, 0x20, 0x40}}}, @acquire={0x40046305, 0x2}], 0x82, 0x0, &(0x7f0000002a80)="4e9021c002cf1475e76bab6446fcfe48739f863d4b3d42d725bbbe6a107642ceb13288996f73ae1e30314fe22d00559f4252f19f81c3c54f52076ae0f7a10e882089527d696f376f1f742d3eef2232dfa2751900338ab2b2ddb91da97649b15d4a554a941614affc06f845c957db99fe301dad3d757caf42e2327c353388fc1e456f"}) sendmsg$NBD_CMD_CONNECT(r1, &(0x7f0000002cc0)={&(0x7f0000002b80)={0x10, 0x0, 0x0, 0x8}, 0xc, &(0x7f0000002c80)={&(0x7f0000002bc0)={0x88, r10, 0x100, 0x70bd27, 0x25dfdbfd, {}, [@NBD_ATTR_SERVER_FLAGS={0xc, 0x5, 0x104}, @NBD_ATTR_BLOCK_SIZE_BYTES={0xc, 0x3, 0x3}, @NBD_ATTR_SIZE_BYTES={0xc, 0x2, 0x6}, @NBD_ATTR_TIMEOUT={0xc, 0x4, 0x1ff}, @NBD_ATTR_SERVER_FLAGS={0xc, 0x5, 0x1}, @NBD_ATTR_SERVER_FLAGS={0xc, 0x5, 0x104}, @NBD_ATTR_SIZE_BYTES={0xc, 0x2, 0x3}, @NBD_ATTR_INDEX={0x8, 0x1, 0x0}, @NBD_ATTR_CLIENT_FLAGS={0xc, 0x6, 0x1}, @NBD_ATTR_SERVER_FLAGS={0xc, 0x5, 0x104}]}, 0x88}, 0x1, 0x0, 0x0, 0x800}, 0x40000c4) [ 56.759114] Bluetooth: hci0: unexpected cc 0x0c03 length: 249 > 1 [ 56.762477] Bluetooth: hci0: unexpected cc 0x1003 length: 249 > 9 [ 56.766447] Bluetooth: hci0: unexpected cc 0x1001 length: 249 > 9 [ 56.773229] Bluetooth: hci0: unexpected cc 0x0c23 length: 249 > 4 [ 56.777578] Bluetooth: hci0: unexpected cc 0x0c38 length: 249 > 2 [ 56.818993] Bluetooth: hci1: unexpected cc 0x0c03 length: 249 > 1 [ 56.823286] Bluetooth: hci2: unexpected cc 0x0c03 length: 249 > 1 [ 56.825837] Bluetooth: hci2: unexpected cc 0x1003 length: 249 > 9 [ 56.827974] Bluetooth: hci2: unexpected cc 0x1001 length: 249 > 9 [ 56.829458] Bluetooth: hci1: unexpected cc 0x1003 length: 249 > 9 [ 56.832122] Bluetooth: hci1: unexpected cc 0x1001 length: 249 > 9 [ 56.835915] Bluetooth: hci2: unexpected cc 0x0c23 length: 249 > 4 [ 56.839771] Bluetooth: hci2: unexpected cc 0x0c38 length: 249 > 2 [ 56.846495] Bluetooth: hci1: unexpected cc 0x0c23 length: 249 > 4 [ 56.859925] Bluetooth: hci1: unexpected cc 0x0c38 length: 249 > 2 [ 56.967771] Bluetooth: hci3: unexpected cc 0x0c03 length: 249 > 1 [ 56.971110] Bluetooth: hci3: unexpected cc 0x1003 length: 249 > 9 [ 56.976452] Bluetooth: hci3: unexpected cc 0x1001 length: 249 > 9 [ 56.984996] Bluetooth: hci3: unexpected cc 0x0c23 length: 249 > 4 [ 56.988746] Bluetooth: hci3: unexpected cc 0x0c38 length: 249 > 2 [ 57.020928] Bluetooth: hci4: unexpected cc 0x0c03 length: 249 > 1 [ 57.037242] Bluetooth: hci5: unexpected cc 0x0c03 length: 249 > 1 [ 57.040166] Bluetooth: hci4: unexpected cc 0x1003 length: 249 > 9 [ 57.044328] Bluetooth: hci4: unexpected cc 0x1001 length: 249 > 9 [ 57.046050] Bluetooth: hci6: unexpected cc 0x0c03 length: 249 > 1 [ 57.062089] Bluetooth: hci6: unexpected cc 0x1003 length: 249 > 9 [ 57.066040] Bluetooth: hci5: unexpected cc 0x1003 length: 249 > 9 [ 57.067304] Bluetooth: hci6: unexpected cc 0x1001 length: 249 > 9 [ 57.068457] Bluetooth: hci4: unexpected cc 0x0c23 length: 249 > 4 [ 57.071021] Bluetooth: hci4: unexpected cc 0x0c38 length: 249 > 2 [ 57.093444] Bluetooth: hci5: unexpected cc 0x1001 length: 249 > 9 [ 57.095523] Bluetooth: hci7: unexpected cc 0x0c03 length: 249 > 1 [ 57.100077] Bluetooth: hci6: unexpected cc 0x0c23 length: 249 > 4 [ 57.104047] Bluetooth: hci5: unexpected cc 0x0c23 length: 249 > 4 [ 57.106353] Bluetooth: hci6: unexpected cc 0x0c38 length: 249 > 2 [ 57.113026] Bluetooth: hci5: unexpected cc 0x0c38 length: 249 > 2 [ 57.139863] Bluetooth: hci7: unexpected cc 0x1003 length: 249 > 9 [ 57.156850] Bluetooth: hci7: unexpected cc 0x1001 length: 249 > 9 [ 57.181914] Bluetooth: hci7: unexpected cc 0x0c23 length: 249 > 4 [ 57.262987] Bluetooth: hci7: unexpected cc 0x0c38 length: 249 > 2 [ 58.848133] Bluetooth: hci0: command tx timeout [ 58.912734] Bluetooth: hci2: command tx timeout [ 58.913286] Bluetooth: hci1: command tx timeout [ 59.040698] Bluetooth: hci3: command tx timeout [ 59.232245] Bluetooth: hci4: command tx timeout [ 59.234928] Bluetooth: hci6: command tx timeout [ 59.235412] Bluetooth: hci5: command tx timeout [ 59.295710] Bluetooth: hci7: command tx timeout [ 60.896663] Bluetooth: hci0: command tx timeout [ 60.959726] Bluetooth: hci1: command tx timeout [ 60.960198] Bluetooth: hci2: command tx timeout [ 61.089279] Bluetooth: hci3: command tx timeout [ 61.281341] Bluetooth: hci5: command tx timeout [ 61.281868] Bluetooth: hci6: command tx timeout [ 61.281898] Bluetooth: hci4: command tx timeout [ 61.345720] Bluetooth: hci7: command tx timeout [ 62.943805] Bluetooth: hci0: command tx timeout [ 63.008667] Bluetooth: hci1: command tx timeout [ 63.008679] Bluetooth: hci2: command tx timeout [ 63.135874] Bluetooth: hci3: command tx timeout [ 63.328677] Bluetooth: hci4: command tx timeout [ 63.328723] Bluetooth: hci5: command tx timeout [ 63.329153] Bluetooth: hci6: command tx timeout [ 63.393399] Bluetooth: hci7: command tx timeout [ 64.991699] Bluetooth: hci0: command tx timeout [ 65.055690] Bluetooth: hci1: command tx timeout [ 65.056692] Bluetooth: hci2: command tx timeout [ 65.183718] Bluetooth: hci3: command tx timeout [ 65.375690] Bluetooth: hci4: command tx timeout [ 65.376675] Bluetooth: hci6: command tx timeout [ 65.376693] Bluetooth: hci5: command tx timeout [ 65.440709] Bluetooth: hci7: command tx timeout [ 90.005527] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 90.022529] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 91.063015] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 91.063659] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 91.141271] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 91.144715] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 91.371963] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 91.372554] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 91.466842] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 91.467419] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 91.606727] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 91.607342] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 91.948920] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 91.949553] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 92.103168] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 92.103865] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 92.211481] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 92.212199] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 92.256863] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 92.257530] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 92.298774] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 92.299409] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 92.367274] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 92.368481] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 92.466919] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 92.467548] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 92.504454] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 92.505631] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 92.560315] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 92.561044] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 92.672966] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 92.673912] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 00:52:28 executing program 4: r0 = openat$ttyS3(0xffffffffffffff9c, &(0x7f0000000000), 0xa2000, 0x0) ioctl$TIOCSETD(r0, 0x5423, &(0x7f0000000040)=0x13) r1 = fsmount(0xffffffffffffffff, 0x1, 0x76) ioctl$TCSETAF(r1, 0x5408, &(0x7f0000000080)={0x5, 0x8001, 0x4, 0x8001, 0x15, "b45da66f02087ca7"}) ioctl$TCSETAF(r1, 0x5408, &(0x7f00000000c0)={0x5, 0x22c1, 0x800, 0x8, 0x5, "2b8c058f839aaa67"}) connect$netlink(r1, &(0x7f0000000100)=@proc={0x10, 0x0, 0x25dfdbfd, 0x2}, 0xc) r2 = syz_open_dev$tty1(0xc, 0x4, 0x4) ioctl$TCSETSF(r2, 0x5404, &(0x7f0000000140)={0x6, 0x2, 0x2, 0x80000001, 0x1b, "c2331e6388ffeb48419d467a4b791ad4343a96"}) ioctl$TIOCMGET(r1, 0x5415, &(0x7f0000000180)) ioctl$TCSETAF(r2, 0x5408, &(0x7f00000001c0)={0x11, 0x0, 0xfff, 0x7, 0xd, "3ae59dd65d54337c"}) r3 = timerfd_create(0x7, 0x800) timerfd_settime(r3, 0x1, &(0x7f0000000200), &(0x7f0000000240)) ioctl$TCSETAF(r2, 0x5408, &(0x7f0000000280)={0x1, 0x1, 0x3d4c, 0x200, 0x0, "73a709364d80b6c1"}) ioctl$PIO_UNIMAPCLR(0xffffffffffffffff, 0x4b68, &(0x7f00000002c0)={0x73, 0x1fe0, 0x8b}) ioctl$TCSETSF2(r2, 0x402c542d, &(0x7f0000000300)={0xffffffff, 0x0, 0x80000000, 0x9, 0x6, "35157e2ff53385c0969535964d148320e065e8", 0x6}) ioctl$KDGKBMETA(0xffffffffffffffff, 0x4b62, &(0x7f0000000340)) ioctl$TIOCGICOUNT(r2, 0x545d, 0x0) socket(0x16, 0x1, 0x9) sendmsg$IEEE802154_LLSEC_DEL_KEY(0xffffffffffffffff, &(0x7f0000000440)={&(0x7f0000000380)={0x10, 0x0, 0x0, 0x10000}, 0xc, &(0x7f0000000400)={&(0x7f00000003c0)={0x38, 0x0, 0x10, 0x70bd2d, 0x25dfdbfe, {}, [@IEEE802154_ATTR_DEV_NAME={0xa, 0x1, 'wpan4\x00'}, @IEEE802154_ATTR_DEV_NAME={0xa, 0x1, 'wpan3\x00'}, @IEEE802154_ATTR_LLSEC_KEY_SOURCE_EXTENDED={0xc, 0x2d, {0xaaaaaaaaaaaa0302}}]}, 0x38}}, 0xc008) sendmsg$NL802154_CMD_SET_ACKREQ_DEFAULT(0xffffffffffffffff, &(0x7f0000000540)={&(0x7f0000000480)={0x10, 0x0, 0x0, 0x40}, 0xc, &(0x7f0000000500)={&(0x7f00000004c0)={0x28, 0x0, 0x800, 0x70bd28, 0x25dfdbfc, {}, [@NL802154_ATTR_WPAN_DEV={0xc, 0x6, 0x300000003}, @NL802154_ATTR_IFINDEX={0x8}]}, 0x28}, 0x1, 0x0, 0x0, 0x40}, 0x48080) 00:52:28 executing program 0: r0 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$ieee802154(&(0x7f0000000040), 0xffffffffffffffff) ioctl$sock_SIOCGIFINDEX_802154(0xffffffffffffffff, 0x8933, &(0x7f0000000080)={'wpan0\x00', 0x0}) sendmsg$IEEE802154_LLSEC_DEL_DEVKEY(r0, &(0x7f0000000140)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x2000000}, 0xc, &(0x7f0000000100)={&(0x7f00000000c0)={0x38, r1, 0x2, 0x70bd27, 0x25dfdbfb, {}, [@IEEE802154_ATTR_LLSEC_KEY_SOURCE_SHORT={0x8, 0x2c, 0xee0}, @IEEE802154_ATTR_PAN_ID={0x6, 0x6, 0xffff}, @IEEE802154_ATTR_DEV_INDEX={0x8, 0x2, r2}, @IEEE802154_ATTR_LLSEC_KEY_SOURCE_EXTENDED={0xc, 0x2d, {0xaaaaaaaaaaaa0002}}]}, 0x38}}, 0x4) r3 = syz_genetlink_get_family_id$ieee802154(&(0x7f00000001c0), r0) sendmsg$IEEE802154_LLSEC_ADD_KEY(r0, &(0x7f00000002c0)={&(0x7f0000000180)={0x10, 0x0, 0x0, 0x80}, 0xc, &(0x7f0000000280)={&(0x7f0000000200)={0x70, r3, 0x8dc3595b298c372b, 0x70bd2c, 0x25dfdbfd, {}, [@IEEE802154_ATTR_HW_ADDR={0xc, 0x5, {0xaaaaaaaaaaaa0302}}, @IEEE802154_ATTR_LLSEC_KEY_SOURCE_EXTENDED={0xc, 0x2d, {0xaaaaaaaaaaaa0202}}, @IEEE802154_ATTR_HW_ADDR={0xc, 0x5, {0xaaaaaaaaaaaa0002}}, @IEEE802154_ATTR_LLSEC_KEY_USAGE_FRAME_TYPES={0x5, 0x31, 0x81}, @IEEE802154_ATTR_DEV_NAME={0xa, 0x1, 'wpan1\x00'}, @IEEE802154_ATTR_LLSEC_KEY_USAGE_COMMANDS={0x24, 0x32, "c38d2be0aa0107a2b38f85915a757ba51ff3d89ac2e1c596dce3055b00418226"}]}, 0x70}, 0x1, 0x0, 0x0, 0x20004040}, 0x0) r4 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) sendmsg$IEEE802154_ASSOCIATE_RESP(r4, &(0x7f0000000400)={&(0x7f0000000300)={0x10, 0x0, 0x0, 0x2000000}, 0xc, &(0x7f00000003c0)={&(0x7f0000000340)={0x60, r3, 0x200, 0x70bd26, 0x25dfdbfd, {}, [@IEEE802154_ATTR_COORD_HW_ADDR={0xc}, @IEEE802154_ATTR_STATUS={0x5, 0x3, 0x40}, @IEEE802154_ATTR_STATUS={0x5, 0x3, 0x1}, @IEEE802154_ATTR_COORD_HW_ADDR={0xc, 0x9, {0x2c841fbeb2fffbec}}, @IEEE802154_ATTR_COORD_HW_ADDR={0xc, 0x9, {0xaaaaaaaaaaaa0202}}, @IEEE802154_ATTR_STATUS={0x5, 0x3, 0x6}, @IEEE802154_ATTR_STATUS={0x5, 0x3, 0x3f}, @IEEE802154_ATTR_COORD_SHORT_ADDR={0x6, 0x8, 0xffff}]}, 0x60}, 0x1, 0x0, 0x0, 0x20000000}, 0x20000080) ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, &(0x7f0000000540)={0xc, 0x0, &(0x7f0000000440)=[@dead_binder_done], 0xbf, 0x0, &(0x7f0000000480)="0537636f85beafebd2a00648fb042246bcbd2150d45e58acedd2718aaa529794fc45c87c914f2b69b82fedb220d6a94b2babd3f188631b48d025c32a8342250d69582838e7ee6d22fa335ce4315412805f50869d3f4bef11a5bb26ac3704b717f9416fc1f441d5dd77d4b3c1a283f3179a7daf20c0d30210361ea15f09fd38e2c2ac52383e1685a787783f4524fd7d784046605442e441fb76b236455574d7fe70d1885d924099864313d8d3d84c106a36d2ccc77c51d3cdaf3f716551fc0a"}) r5 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) syz_genetlink_get_family_id$ieee802154(&(0x7f0000000580), r5) sendmsg$IEEE802154_SET_MACPARAMS(r0, &(0x7f0000000680)={&(0x7f00000005c0)={0x10, 0x0, 0x0, 0x1000}, 0xc, &(0x7f0000000640)={&(0x7f0000000600)={0x2c, r3, 0x2, 0x70bd2d, 0x25dfdbfd, {}, [@IEEE802154_ATTR_CCA_ED_LEVEL={0x8, 0x24, 0x7fffffff}, @IEEE802154_ATTR_TXPOWER={0x5, 0x21, 0x3}, @IEEE802154_ATTR_CSMA_MAX_BE={0x5, 0x27, 0x4}]}, 0x2c}, 0x1, 0x0, 0x0, 0x40801}, 0x40840) r6 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) sendmsg$IEEE802154_LLSEC_DEL_SECLEVEL(r6, &(0x7f00000007c0)={&(0x7f00000006c0)={0x10, 0x0, 0x0, 0x40000000}, 0xc, &(0x7f0000000780)={&(0x7f0000000700)={0x44, r3, 0x300, 0x70bd2a, 0x25dfdbfb, {}, [@IEEE802154_ATTR_DEV_INDEX={0x8, 0x2, r2}, @IEEE802154_ATTR_LLSEC_FRAME_TYPE={0x5, 0x33, 0x1f}, @IEEE802154_ATTR_LLSEC_FRAME_TYPE={0x5, 0x33, 0x7}, @IEEE802154_ATTR_LLSEC_CMD_FRAME_ID={0x5, 0x34, 0xcb}, @IEEE802154_ATTR_LLSEC_DEV_OVERRIDE={0x5, 0x36, 0x1}, @IEEE802154_ATTR_LLSEC_CMD_FRAME_ID={0x5, 0x34, 0x1}]}, 0x44}, 0x1, 0x0, 0x0, 0x40000a1}, 0x4800) r7 = syz_genetlink_get_family_id$ieee802154(&(0x7f0000000840), r6) sendmsg$IEEE802154_LLSEC_DEL_DEV(r6, &(0x7f0000000940)={&(0x7f0000000800)={0x10, 0x0, 0x0, 0x2000}, 0xc, &(0x7f0000000900)={&(0x7f0000000880)={0x6c, r7, 0x100, 0x70bd26, 0x25dfdbfe, {}, [@IEEE802154_ATTR_HW_ADDR={0xc, 0x5, {0xaaaaaaaaaaaa0202}}, @IEEE802154_ATTR_HW_ADDR={0xc, 0x5, {0xaaaaaaaaaaaa0302}}, @IEEE802154_ATTR_DEV_INDEX={0x8, 0x2, r2}, @IEEE802154_ATTR_HW_ADDR={0xc}, @IEEE802154_ATTR_DEV_NAME={0xa, 0x1, 'wpan1\x00'}, @IEEE802154_ATTR_HW_ADDR={0xc, 0x5, {0xaaaaaaaaaaaa0302}}, @IEEE802154_ATTR_HW_ADDR={0xc}, @IEEE802154_ATTR_DEV_INDEX={0x8, 0x2, r2}]}, 0x6c}, 0x1, 0x0, 0x0, 0x41}, 0x20004040) ioctl$sock_SIOCGIFINDEX_802154(r5, 0x8933, &(0x7f00000009c0)={'wpan4\x00', 0x0}) ioctl$sock_SIOCGIFINDEX_802154(r5, 0x8933, &(0x7f0000000a00)={'wpan3\x00', 0x0}) sendmsg$IEEE802154_LLSEC_DEL_DEV(r0, &(0x7f0000000b00)={&(0x7f0000000980)={0x10, 0x0, 0x0, 0x1}, 0xc, &(0x7f0000000ac0)={&(0x7f0000000a40)={0x68, r7, 0x100, 0x70bd26, 0x25dfdbfd, {}, [@IEEE802154_ATTR_DEV_INDEX={0x8, 0x2, r8}, @IEEE802154_ATTR_DEV_INDEX={0x8}, @IEEE802154_ATTR_DEV_NAME={0xa, 0x1, 'wpan1\x00'}, @IEEE802154_ATTR_DEV_NAME={0xa, 0x1, 'wpan0\x00'}, @IEEE802154_ATTR_DEV_INDEX={0x8, 0x2, r9}, @IEEE802154_ATTR_HW_ADDR={0xc, 0x5, {0xaaaaaaaaaaaa0202}}, @IEEE802154_ATTR_DEV_INDEX={0x8, 0x2, r2}, @IEEE802154_ATTR_DEV_INDEX={0x8, 0x2, r2}, @IEEE802154_ATTR_DEV_INDEX={0x8, 0x2, r2}]}, 0x68}, 0x1, 0x0, 0x0, 0x20004880}, 0x50) sendmsg$IEEE802154_LLSEC_DEL_KEY(0xffffffffffffffff, &(0x7f0000000c80)={&(0x7f0000000b40)={0x10, 0x0, 0x0, 0x40000000}, 0xc, &(0x7f0000000c40)={&(0x7f0000000bc0)={0x58, 0x0, 0x402, 0x70bd2d, 0x25dfdbff, {}, [@IEEE802154_ATTR_LLSEC_KEY_MODE={0x5, 0x2b, 0x1}, @IEEE802154_ATTR_DEV_NAME={0xa, 0x1, 'wpan3\x00'}, @IEEE802154_ATTR_LLSEC_KEY_SOURCE_EXTENDED={0xc, 0x2d, {0xaaaaaaaaaaaa0302}}, @IEEE802154_ATTR_LLSEC_KEY_ID={0x5, 0x2e, 0x4}, @IEEE802154_ATTR_LLSEC_KEY_ID={0x5, 0x2e, 0x3}, @IEEE802154_ATTR_SHORT_ADDR={0x6, 0x4, 0xfffd}, @IEEE802154_ATTR_HW_ADDR={0xc}]}, 0x58}, 0x1, 0x0, 0x0, 0x40800}, 0x24040000) 00:52:28 executing program 1: r0 = openat$zero(0xffffffffffffff9c, &(0x7f0000000000), 0x400200, 0x0) ioctl$SECCOMP_IOCTL_NOTIF_ADDFD(r0, 0x40182103, &(0x7f0000000040)={0x0, 0x1, 0xffffffffffffffff, 0x80000000, 0x80000}) r1 = syz_genetlink_get_family_id$batadv(&(0x7f00000000c0), r0) sendmsg$BATADV_CMD_GET_TRANSTABLE_LOCAL(r0, &(0x7f00000001c0)={&(0x7f0000000080)={0x10, 0x0, 0x0, 0x80000}, 0xc, &(0x7f0000000180)={&(0x7f0000000100)={0x54, r1, 0x200, 0x70bd25, 0x25dfdbff, {}, [@BATADV_ATTR_THROUGHPUT_OVERRIDE={0x8, 0x3b, 0x89}, @BATADV_ATTR_THROUGHPUT_OVERRIDE={0x8, 0x3b, 0xffff}, @BATADV_ATTR_FRAGMENTATION_ENABLED={0x5}, @BATADV_ATTR_AGGREGATED_OGMS_ENABLED={0x5}, @BATADV_ATTR_MULTICAST_FORCEFLOOD_ENABLED={0x5}, @BATADV_ATTR_BRIDGE_LOOP_AVOIDANCE_ENABLED={0x5}, @BATADV_ATTR_HARD_IFINDEX={0x8}, @BATADV_ATTR_GW_MODE={0x5, 0x33, 0x1}]}, 0x54}, 0x1, 0x0, 0x0, 0x48041}, 0x4840) r2 = openat$procfs(0xffffffffffffff9c, &(0x7f0000000200)='/proc/cpuinfo\x00', 0x0, 0x0) sendmsg$BATADV_CMD_GET_GATEWAYS(r2, &(0x7f0000000340)={&(0x7f0000000240)={0x10, 0x0, 0x0, 0x1000000}, 0xc, &(0x7f0000000300)={&(0x7f0000000280)={0x50, r1, 0x400, 0x70bd26, 0x25dfdbfb, {}, [@BATADV_ATTR_BRIDGE_LOOP_AVOIDANCE_ENABLED={0x5, 0x2e, 0x1}, @BATADV_ATTR_ISOLATION_MARK={0x8, 0x2b, 0x3}, @BATADV_ATTR_BONDING_ENABLED={0x5}, @BATADV_ATTR_BRIDGE_LOOP_AVOIDANCE_ENABLED={0x5, 0x2e, 0x1}, @BATADV_ATTR_ORIG_ADDRESS={0xa, 0x9, @multicast}, @BATADV_ATTR_THROUGHPUT_OVERRIDE={0x8, 0x3b, 0x1}, @BATADV_ATTR_ISOLATION_MARK={0x8, 0x2b, 0x6}]}, 0x50}, 0x1, 0x0, 0x0, 0x20049800}, 0x80) r3 = syz_genetlink_get_family_id$batadv(&(0x7f00000003c0), r0) sendmsg$BATADV_CMD_SET_MESH(r0, &(0x7f0000000480)={&(0x7f0000000380)={0x10, 0x0, 0x0, 0x1000}, 0xc, &(0x7f0000000440)={&(0x7f0000000400)={0x34, r3, 0x400, 0x70bd2d, 0x25dfdbff, {}, [@BATADV_ATTR_GW_MODE={0x5}, @BATADV_ATTR_GW_BANDWIDTH_UP={0x8, 0x32, 0x8001}, @BATADV_ATTR_ORIG_INTERVAL={0x8, 0x39, 0x4}, @BATADV_ATTR_NETWORK_CODING_ENABLED={0x5, 0x38, 0x1}]}, 0x34}, 0x1, 0x0, 0x0, 0x4000000}, 0x18000) r4 = fsmount(r0, 0x1, 0x5) r5 = fsmount(r2, 0x1, 0x7a) epoll_ctl$EPOLL_CTL_ADD(r4, 0x1, r5, &(0x7f00000016c0)={0x80002000}) r6 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000001700), 0x111002, 0x0) epoll_ctl$EPOLL_CTL_MOD(r0, 0x3, r6, &(0x7f0000001740)) ioctl$SECCOMP_IOCTL_NOTIF_ID_VALID(r5, 0x40082102, &(0x7f0000001780)) rt_sigqueueinfo(0xffffffffffffffff, 0x2, &(0x7f00000017c0)={0x16, 0x5, 0x8}) ioctl$BINDER_SET_MAX_THREADS(r4, 0x40046205, &(0x7f0000001840)=0x4) r7 = syz_genetlink_get_family_id$ieee802154(&(0x7f00000018c0), 0xffffffffffffffff) sendmsg$IEEE802154_ASSOCIATE_RESP(0xffffffffffffffff, &(0x7f00000019c0)={&(0x7f0000001880)={0x10, 0x0, 0x0, 0x10}, 0xc, &(0x7f0000001980)={&(0x7f0000001900)={0x48, r7, 0x400, 0x70bd26, 0x25dfdbfc, {}, [@IEEE802154_ATTR_COORD_HW_ADDR={0xc, 0x9, {0x5555555555540004}}, @IEEE802154_ATTR_COORD_HW_ADDR={0xc, 0x9, {0xaaaaaaaaaaaa0302}}, @IEEE802154_ATTR_COORD_HW_ADDR={0xc, 0x9, {0xaaaaaaaaaaaa0002}}, @IEEE802154_ATTR_STATUS={0x5, 0x3, 0x88}, @IEEE802154_ATTR_STATUS={0x5, 0x3, 0x3}]}, 0x48}, 0x1, 0x0, 0x0, 0x800}, 0x810) ioctl$SECCOMP_IOCTL_NOTIF_ID_VALID(r0, 0x40082102, &(0x7f0000001a00)) sendmsg$SMC_PNETID_FLUSH(r5, &(0x7f0000001b80)={&(0x7f0000001a40)={0x10, 0x0, 0x0, 0x80000}, 0xc, &(0x7f0000001b40)={&(0x7f0000001ac0)={0x7c, 0x0, 0x8, 0x70bd2d, 0x25dfdbfb, {}, [@SMC_PNETID_IBPORT={0x5, 0x4, 0x2}, @SMC_PNETID_NAME={0x9, 0x1, 'syz2\x00'}, @SMC_PNETID_IBNAME={0x9, 0x3, 'syz0\x00'}, @SMC_PNETID_ETHNAME={0x14, 0x2, 'wg2\x00'}, @SMC_PNETID_NAME={0x9, 0x1, 'syz2\x00'}, @SMC_PNETID_ETHNAME={0x14, 0x2, 'veth1_macvtap\x00'}, @SMC_PNETID_IBPORT={0x5, 0x4, 0x2}, @SMC_PNETID_IBNAME={0x9, 0x3, 'syz0\x00'}]}, 0x7c}, 0x1, 0x0, 0x0, 0x20000040}, 0x20000800) 00:52:28 executing program 3: clone(0x400, &(0x7f0000000000)="2f59adb4fe8bdd18e28d59f811fee00f6e", &(0x7f0000000040), &(0x7f0000000080), &(0x7f00000000c0)="ee4468595a6a9e17d313ddea1158c7520b4ce752e1feceb8bd763f38764fe32d5b11f9842e25fb3843f95d48bcbb676b94dc456e5f562cd49d08bd5ac38eb9d6acfc2fa3928b3de489313465b4bea18ac19b9efcb135738e957c5dfaa38b9755182fa0eb46bac360130ee66e2636e1d6aafb8e5918d6d0f8338603cd9bd3e0f3b5d106eae77f68fc50df9f58fd8061a03c31d04b3551c672a8334c0f3bd81aea189fc02f258c22a8b0dba2a60f9a458d6eff75d32cf215930f0bccd5f8ee1d8d33a86c5eda24ec311adc") ioctl$CDROMREADMODE1(0xffffffffffffffff, 0x530d, &(0x7f00000001c0)={0x8, 0x81, 0x4, 0x1, 0x1, 0x8}) ioctl$CDROMREADRAW(0xffffffffffffffff, 0x5314, &(0x7f0000000c40)={0x1, 0x5, 0x7, 0xe5, 0x2, 0x81}) r0 = openat$zero(0xffffffffffffff9c, &(0x7f00000016c0), 0x0, 0x0) ioctl$CDROMSTART(r0, 0x5308) rt_sigaction(0xf, &(0x7f0000001780)={&(0x7f0000001700)="66430f3a15df22c402d937a80e000000f347241ac44218f34ce000c4a2b528e8db5a2466440f38014fdb660f3810b006a50000c421fc295a0cdcf1", 0x80000004, &(0x7f0000001740)="642e41dde78f684ca2df01416dc463755c460b34f3460fa6c0c4c11b7cc7c442f1ad5b00f0430fab6b000f0f62f79af046f71c54", {[0xfffffffffffffffe]}}, &(0x7f0000001840)={&(0x7f00000017c0)="f240af66e20067363666460ffa6f5136360f974700c48165da31c422050c1ec4c17a6fbb2f000000c4027d2074f407f2430f1a39ff30", 0x0, &(0x7f0000001800)="c462394627defbc401f1d3cac46159de6e1fc4816c58a20700000066430faef2c4c16b7c9f0300000066400f6620f0ff0500000000c4e111d2f9"}, 0x8, &(0x7f0000001880)) timerfd_create(0x9, 0x800) prctl$PR_GET_FPEXC(0xb, &(0x7f00000018c0)) recvmmsg(r0, &(0x7f0000003c40)=[{{&(0x7f0000001900)=@pppol2tp={0x18, 0x1, {0x0, 0xffffffffffffffff, {0x2, 0x0, @empty}}}, 0x80, &(0x7f00000029c0)=[{&(0x7f0000001980)=""/39, 0x27}, {&(0x7f00000019c0)=""/4096, 0x1000}], 0x2, &(0x7f0000002a00)=""/18, 0x12}, 0x3f}, {{&(0x7f0000002a40)=@nfc, 0x80, &(0x7f0000002e80)=[{&(0x7f0000002ac0)=""/44, 0x2c}, {&(0x7f0000002b00)=""/65, 0x41}, {&(0x7f0000002b80)=""/107, 0x6b}, {&(0x7f0000002c00)=""/158, 0x9e}, {&(0x7f0000002cc0)=""/169, 0xa9}, {&(0x7f0000002d80)=""/57, 0x39}, {&(0x7f0000002dc0)=""/160, 0xa0}], 0x7}, 0x6}, {{&(0x7f0000002f00)=@x25={0x9, @remote}, 0x80, &(0x7f0000003100)=[{&(0x7f0000002f80)=""/101, 0x65}, {&(0x7f0000003000)}, {&(0x7f0000003040)=""/187, 0xbb}], 0x3, &(0x7f0000003140)=""/159, 0x9f}, 0xffffffff}, {{&(0x7f0000003200)=@ll={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @dev}, 0x80, &(0x7f0000003400)=[{&(0x7f0000003280)=""/29, 0x1d}, {&(0x7f00000032c0)=""/41, 0x29}, {&(0x7f0000003300)=""/219, 0xdb}], 0x3, &(0x7f0000003440)=""/204, 0xcc}, 0x2f62}, {{&(0x7f0000003540)=@hci, 0x80, &(0x7f0000003b80)=[{&(0x7f00000035c0)=""/168, 0xa8}, {&(0x7f0000003680)=""/128, 0x80}, {&(0x7f0000003700)=""/75, 0x4b}, {&(0x7f0000003780)=""/189, 0xbd}, {&(0x7f0000003840)=""/168, 0xa8}, {&(0x7f0000003900)=""/132, 0x84}, {&(0x7f00000039c0)=""/162, 0xa2}, {&(0x7f0000003a80)=""/198, 0xc6}], 0x8, &(0x7f0000003c00)=""/25, 0x19}, 0xfc00}], 0x5, 0x21, &(0x7f0000003d80)) r2 = socket$netlink(0x10, 0x3, 0xe) syz_genetlink_get_family_id$smc(&(0x7f0000003dc0), r2) timerfd_create(0x6, 0x800) ioctl$BINDER_THREAD_EXIT(r0, 0x40046208, 0x0) epoll_ctl$EPOLL_CTL_MOD(r0, 0x3, r1, &(0x7f0000003e00)={0xb0000000}) r3 = io_uring_setup(0x35ea, &(0x7f0000003e40)={0x0, 0x7cfa, 0x2, 0x0, 0x210, 0x0, r0}) io_uring_setup(0x106d, &(0x7f0000003ec0)={0x0, 0xb36, 0x1e, 0x1, 0xa7, 0x0, r3}) sendmsg$NBD_CMD_STATUS(0xffffffffffffffff, &(0x7f0000004040)={&(0x7f0000003f40)={0x10, 0x0, 0x0, 0x8}, 0xc, &(0x7f0000004000)={&(0x7f0000003f80)={0x6c, 0x0, 0x20, 0x70bd2a, 0x25dfdbff, {}, [@NBD_ATTR_DEAD_CONN_TIMEOUT={0xc, 0x8, 0x68b2}, @NBD_ATTR_SIZE_BYTES={0xc, 0x2, 0x1f}, @NBD_ATTR_SIZE_BYTES={0xc, 0x2, 0x8}, @NBD_ATTR_TIMEOUT={0xc, 0x4, 0x6}, @NBD_ATTR_DEAD_CONN_TIMEOUT={0xc, 0x8, 0x3}, @NBD_ATTR_CLIENT_FLAGS={0xc, 0x6, 0x1}, @NBD_ATTR_INDEX={0x8, 0x1, 0x0}, @NBD_ATTR_INDEX={0x8, 0x1, 0x0}]}, 0x6c}, 0x1, 0x0, 0x0, 0x40840}, 0x10) r4 = syz_genetlink_get_family_id$nbd(&(0x7f00000040c0), 0xffffffffffffffff) r5 = fsmount(r0, 0x0, 0xf0) sendmsg$NBD_CMD_RECONFIGURE(0xffffffffffffffff, &(0x7f00000041c0)={&(0x7f0000004080)={0x10, 0x0, 0x0, 0x2000}, 0xc, &(0x7f0000004180)={&(0x7f0000004140)={0x3c, r4, 0x100, 0x70bd29, 0x25dfdbfd, {}, [@NBD_ATTR_SOCKETS={0x14, 0x7, 0x0, 0x1, [{0x8, 0x1, r5}, {0x8}]}, @NBD_ATTR_INDEX={0x8, 0x1, 0x0}, @NBD_ATTR_SOCKETS={0xc, 0x7, 0x0, 0x1, [{0x8, 0x1, r0}]}]}, 0x3c}, 0x1, 0x0, 0x0, 0x810}, 0x40000) 00:52:28 executing program 7: r0 = openat$procfs(0xffffffffffffff9c, &(0x7f0000000000)='/proc/mdstat\x00', 0x0, 0x0) mmap$IORING_OFF_CQ_RING(&(0x7f0000ffc000/0x2000)=nil, 0x2000, 0x8, 0x4010, r0, 0x8000000) r1 = openat$cdrom(0xffffffffffffff9c, &(0x7f0000000040), 0xb0840, 0x0) ioctl$CDROM_LOCKDOOR(r1, 0x5329, 0x1) r2 = openat$procfs(0xffffffffffffff9c, &(0x7f0000000080)='/proc/slabinfo\x00', 0x0, 0x0) epoll_ctl$EPOLL_CTL_DEL(r2, 0x2, r0) r3 = fsmount(r2, 0x0, 0x7f) ioctl$CDROMREADMODE1(r3, 0x530d, &(0x7f00000000c0)={0x7, 0x1f, 0x3, 0x81, 0xf3, 0x7b}) mprotect(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x1000008) mmap$IORING_OFF_CQ_RING(&(0x7f0000ffe000/0x1000)=nil, 0x1000, 0x2, 0x80010, r3, 0x8000000) socketpair$nbd(0x1, 0x1, 0x0, &(0x7f0000000d80)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$sock_SIOCGIFINDEX_80211(r5, 0x8933, &(0x7f0000000dc0)={'wlan1\x00'}) r6 = syz_genetlink_get_family_id$batadv(&(0x7f0000000e40), r0) sendmsg$BATADV_CMD_GET_ORIGINATORS(r3, &(0x7f0000000f00)={&(0x7f0000000e00)={0x10, 0x0, 0x0, 0x400000}, 0xc, &(0x7f0000000ec0)={&(0x7f0000000e80)={0x34, r6, 0x2, 0x70bd29, 0x25dfdbff, {}, [@BATADV_ATTR_THROUGHPUT_OVERRIDE={0x8, 0x3b, 0x8}, @BATADV_ATTR_BRIDGE_LOOP_AVOIDANCE_ENABLED={0x5, 0x2e, 0x1}, @BATADV_ATTR_FRAGMENTATION_ENABLED={0x5, 0x30, 0x1}, @BATADV_ATTR_TPMETER_TEST_TIME={0x8, 0xb, 0xfffffffb}]}, 0x34}, 0x1, 0x0, 0x0, 0x20000000}, 0x4000000) ioctl$CDROM_GET_CAPABILITY(0xffffffffffffffff, 0x5331) r7 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r8 = syz_genetlink_get_family_id$nbd(&(0x7f0000000f80), 0xffffffffffffffff) sendmsg$NBD_CMD_RECONFIGURE(r7, &(0x7f0000001040)={&(0x7f0000000f40)={0x10, 0x0, 0x0, 0x4000000}, 0xc, &(0x7f0000001000)={&(0x7f0000000fc0)={0x20, r8, 0x200, 0x70bd2b, 0x25dfdbfb, {}, [@NBD_ATTR_TIMEOUT={0xc, 0x4, 0x1f}]}, 0x20}, 0x1, 0x0, 0x0, 0x20000000}, 0x2004c000) ioctl$sock_SIOCGIFINDEX_80211(r4, 0x8933, &(0x7f0000001080)={'wlan1\x00'}) sendmsg$NBD_CMD_DISCONNECT(r7, &(0x7f00000011c0)={&(0x7f00000010c0)={0x10, 0x0, 0x0, 0x4000}, 0xc, &(0x7f0000001180)={&(0x7f0000001140)={0x20, 0x0, 0x20, 0x70bd25, 0x25dfdbfe, {}, [@NBD_ATTR_BLOCK_SIZE_BYTES={0xc, 0x3, 0x9de}]}, 0x20}, 0x1, 0x0, 0x0, 0x20004000}, 0x200000c5) 00:52:28 executing program 6: ioctl$sock_SIOCGIFINDEX_802154(0xffffffffffffffff, 0x8933, &(0x7f0000000000)={'wpan1\x00', 0x0}) r1 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) ioctl$sock_SIOCGIFINDEX_802154(0xffffffffffffffff, 0x8933, &(0x7f0000000080)={'wpan3\x00', 0x0}) sendmsg$IEEE802154_LLSEC_ADD_SECLEVEL(r1, &(0x7f0000000140)={&(0x7f0000000040)={0x10, 0x0, 0x0, 0x800000}, 0xc, &(0x7f0000000100)={&(0x7f00000000c0)={0x2c, 0x0, 0x400, 0x70bd2a, 0x25dfdbfe, {}, [@IEEE802154_ATTR_DEV_INDEX={0x8, 0x2, r0}, @IEEE802154_ATTR_DEV_INDEX={0x8, 0x2, r0}, @IEEE802154_ATTR_DEV_INDEX={0x8, 0x2, r2}]}, 0x2c}, 0x1, 0x0, 0x0, 0x4004081}, 0x10) sendmsg$IEEE802154_LLSEC_DEL_KEY(r1, &(0x7f0000000240)={&(0x7f0000000180)={0x10, 0x0, 0x0, 0x1000000}, 0xc, &(0x7f0000000200)={&(0x7f00000001c0)={0x3c, 0x0, 0x30e, 0x70bd25, 0x25dfdbfd, {}, [@IEEE802154_ATTR_HW_ADDR={0xc, 0x5, {0xaaaaaaaaaaaa0102}}, @IEEE802154_ATTR_LLSEC_KEY_SOURCE_EXTENDED={0xc, 0x2d, {0xaaaaaaaaaaaa0102}}, @IEEE802154_ATTR_LLSEC_KEY_SOURCE_SHORT={0x8, 0x2c, 0x5}, @IEEE802154_ATTR_DEV_INDEX={0x8}]}, 0x3c}, 0x1, 0x0, 0x0, 0x24041000}, 0x44) socketpair$nbd(0x1, 0x1, 0x0, &(0x7f0000002280)={0xffffffffffffffff}) r4 = openat$procfs(0xffffffffffffff9c, &(0x7f00000022c0)='/proc/asound/seq/clients\x00', 0x0, 0x0) socketpair$nbd(0x1, 0x1, 0x0, &(0x7f0000002300)={0xffffffffffffffff}) r6 = socket(0x1d, 0x3, 0x6) r7 = openat$zero(0xffffffffffffff9c, &(0x7f0000002340), 0x2, 0x0) socketpair$nbd(0x1, 0x1, 0x0, &(0x7f0000002380)={0xffffffffffffffff}) sendmsg$NBD_CMD_DISCONNECT(r1, &(0x7f0000002480)={&(0x7f0000000280)={0x10, 0x0, 0x0, 0x80000}, 0xc, &(0x7f0000002440)={&(0x7f00000023c0)={0x6c, 0x0, 0x400, 0x70bd27, 0x25dfdbfb, {}, [@NBD_ATTR_TIMEOUT={0xc, 0x4, 0x100000001}, @NBD_ATTR_SOCKETS={0x4c, 0x7, 0x0, 0x1, [{0x8, 0x1, r3}, {0x8, 0x1, r4}, {0x8}, {0x8, 0x1, r5}, {0x8}, {0x8, 0x1, r6}, {0x8, 0x1, r7}, {0x8, 0x1, r8}, {0x8}]}]}, 0x6c}, 0x1, 0x0, 0x0, 0x20000000}, 0x4000020) r9 = syz_genetlink_get_family_id$ieee802154(&(0x7f0000002500), r1) sendmsg$IEEE802154_LLSEC_LIST_SECLEVEL(r1, &(0x7f00000025c0)={&(0x7f00000024c0)={0x10, 0x0, 0x0, 0x4}, 0xc, &(0x7f0000002580)={&(0x7f0000002540)={0x14, r9, 0x100, 0x70bd25, 0x25dfdbfd, {}, ["", "", "", "", "", ""]}, 0x14}, 0x1, 0x0, 0x0, 0x11}, 0x20000084) r10 = syz_genetlink_get_family_id$nbd(&(0x7f0000002640), r1) sendmsg$NBD_CMD_RECONFIGURE(r1, &(0x7f0000002700)={&(0x7f0000002600)={0x10, 0x0, 0x0, 0x800}, 0xc, &(0x7f00000026c0)={&(0x7f0000002680)={0x3c, r10, 0x800, 0x70bd2b, 0x25dfdbfe, {}, [@NBD_ATTR_DEAD_CONN_TIMEOUT={0xc, 0x8, 0x9}, @NBD_ATTR_SERVER_FLAGS={0xc, 0x5, 0x8}, @NBD_ATTR_INDEX={0x8, 0x1, 0x0}, @NBD_ATTR_INDEX={0x8, 0x1, 0x0}]}, 0x3c}, 0x1, 0x0, 0x0, 0x4000}, 0x40) r11 = fsmount(r7, 0x0, 0x80) r12 = ioctl$TIOCGPTPEER(r7, 0x5441, 0xe5) ioctl$BINDER_WRITE_READ(r11, 0xc0306201, &(0x7f0000002b40)={0xa8, 0x0, &(0x7f00000029c0)=[@dead_binder_done, @increfs={0x40046304, 0x3}, @exit_looper, @reply={0x40406301, {0x0, 0x0, 0x0, 0x0, 0x10, 0x0, 0x0, 0x60, 0x18, &(0x7f0000002800)={@fd={0x66642a85, 0x0, r12}, @ptr={0x70742a85, 0x1, &(0x7f0000002740)=""/143, 0x8f, 0x1, 0x27}, @fda={0x66646185, 0x6, 0x1, 0x1b}}, &(0x7f0000002880)={0x0, 0x18, 0x40}}}, @transaction={0x40406300, {0x569d, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x68, 0x18, &(0x7f0000002900)={@fda={0x66646185, 0x7, 0x2, 0x30}, @fda={0x66646185, 0x6, 0x1, 0x19}, @ptr={0x70742a85, 0x1, &(0x7f00000028c0)=""/44, 0x2c, 0x0, 0x1e}}, &(0x7f0000002980)={0x0, 0x20, 0x40}}}, @acquire={0x40046305, 0x2}], 0x82, 0x0, &(0x7f0000002a80)="4e9021c002cf1475e76bab6446fcfe48739f863d4b3d42d725bbbe6a107642ceb13288996f73ae1e30314fe22d00559f4252f19f81c3c54f52076ae0f7a10e882089527d696f376f1f742d3eef2232dfa2751900338ab2b2ddb91da97649b15d4a554a941614affc06f845c957db99fe301dad3d757caf42e2327c353388fc1e456f"}) sendmsg$NBD_CMD_CONNECT(r1, &(0x7f0000002cc0)={&(0x7f0000002b80)={0x10, 0x0, 0x0, 0x8}, 0xc, &(0x7f0000002c80)={&(0x7f0000002bc0)={0x88, r10, 0x100, 0x70bd27, 0x25dfdbfd, {}, [@NBD_ATTR_SERVER_FLAGS={0xc, 0x5, 0x104}, @NBD_ATTR_BLOCK_SIZE_BYTES={0xc, 0x3, 0x3}, @NBD_ATTR_SIZE_BYTES={0xc, 0x2, 0x6}, @NBD_ATTR_TIMEOUT={0xc, 0x4, 0x1ff}, @NBD_ATTR_SERVER_FLAGS={0xc, 0x5, 0x1}, @NBD_ATTR_SERVER_FLAGS={0xc, 0x5, 0x104}, @NBD_ATTR_SIZE_BYTES={0xc, 0x2, 0x3}, @NBD_ATTR_INDEX={0x8, 0x1, 0x0}, @NBD_ATTR_CLIENT_FLAGS={0xc, 0x6, 0x1}, @NBD_ATTR_SERVER_FLAGS={0xc, 0x5, 0x104}]}, 0x88}, 0x1, 0x0, 0x0, 0x800}, 0x40000c4) 00:52:28 executing program 5: prctl$PR_GET_FPEXC(0xb, &(0x7f0000000000)) r0 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000040)='./binderfs/custom0\x00', 0x800, 0x0) ustat(0x800, &(0x7f0000000080)) ioctl$ifreq_SIOCGIFINDEX_batadv_mesh(0xffffffffffffffff, 0x8933, &(0x7f0000000100)={'batadv0\x00', 0x0}) ioctl$ifreq_SIOCGIFINDEX_batadv_hard(0xffffffffffffffff, 0x8933, &(0x7f0000000140)={'batadv_slave_0\x00', 0x0}) sendmsg$ETHTOOL_MSG_PAUSE_GET(0xffffffffffffffff, &(0x7f00000002c0)={&(0x7f00000000c0)={0x10, 0x0, 0x0, 0x10000}, 0xc, &(0x7f0000000280)={&(0x7f0000000180)={0xdc, 0x0, 0x8, 0x70bd27, 0x25dfdbfb, {}, [@HEADER={0x5c, 0x1, 0x0, 0x1, [@ETHTOOL_A_HEADER_DEV_INDEX={0x8, 0x1, r1}, @ETHTOOL_A_HEADER_FLAGS={0x8}, @ETHTOOL_A_HEADER_DEV_NAME={0x14, 0x2, 'veth0_vlan\x00'}, @ETHTOOL_A_HEADER_DEV_INDEX={0x8}, @ETHTOOL_A_HEADER_FLAGS={0x8, 0x3, 0x3}, @ETHTOOL_A_HEADER_FLAGS={0x8, 0x3, 0x2}, @ETHTOOL_A_HEADER_DEV_INDEX={0x8, 0x1, r2}, @ETHTOOL_A_HEADER_DEV_NAME={0x14, 0x2, 'macvlan0\x00'}]}, @HEADER={0x40, 0x1, 0x0, 0x1, [@ETHTOOL_A_HEADER_DEV_NAME={0x14, 0x2, 'veth0_to_bridge\x00'}, @ETHTOOL_A_HEADER_DEV_NAME={0x14, 0x2, 'veth0_to_bridge\x00'}, @ETHTOOL_A_HEADER_DEV_NAME={0x14, 0x2, 'netpci0\x00'}]}, @HEADER={0x2c, 0x1, 0x0, 0x1, [@ETHTOOL_A_HEADER_DEV_NAME={0x14, 0x2, 'bond_slave_1\x00'}, @ETHTOOL_A_HEADER_DEV_NAME={0x14, 0x2, 'ip_vti0\x00'}]}]}, 0xdc}, 0x1, 0x0, 0x0, 0x4000}, 0x24000000) sendmsg$NBD_CMD_STATUS(0xffffffffffffffff, &(0x7f0000000400)={&(0x7f0000000300)={0x10, 0x0, 0x0, 0x4}, 0xc, &(0x7f00000003c0)={&(0x7f0000000340)={0x44, 0x0, 0x20, 0x70bd2d, 0x25dfdbfc, {}, [@NBD_ATTR_SIZE_BYTES={0xc, 0x2, 0x4}, @NBD_ATTR_SOCKETS={0x24, 0x7, 0x0, 0x1, [{0x8}, {0x8}, {0x8}, {0x8}]}]}, 0x44}}, 0x4000) ioctl$BINDER_GET_NODE_DEBUG_INFO(r0, 0xc018620b, &(0x7f0000000440)={0x3}) syz_genetlink_get_family_id$batadv(&(0x7f0000000480), 0xffffffffffffffff) r3 = syz_open_dev$ttys(0xc, 0x2, 0x0) ioctl$TCSETAF(r3, 0x5408, &(0x7f00000004c0)={0x4, 0xb073, 0x1000, 0x1, 0x13, "b786e10fbdab60cc"}) openat$binderfs(0xffffffffffffff9c, &(0x7f0000000500)='./binderfs2/binder0\x00', 0x802, 0x0) sendmsg$BATADV_CMD_SET_VLAN(0xffffffffffffffff, &(0x7f0000000600)={&(0x7f0000000540)={0x10, 0x0, 0x0, 0x80000}, 0xc, &(0x7f00000005c0)={&(0x7f0000000580)={0x30, 0x0, 0x400, 0x70bd27, 0x25dfdbfb, {}, [@BATADV_ATTR_FRAGMENTATION_ENABLED={0x5, 0x30, 0x1}, @BATADV_ATTR_ORIG_ADDRESS={0xa, 0x9, @random="62836be88da6"}, @BATADV_ATTR_ISOLATION_MASK={0x8, 0x2c, 0x81}]}, 0x30}, 0x1, 0x0, 0x0, 0x8004}, 0x4c000) r4 = syz_open_dev$ttys(0xc, 0x2, 0x0) ioctl$TIOCEXCL(r4, 0x540c) r5 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) sendmsg$IEEE802154_LLSEC_GETPARAMS(r5, &(0x7f0000000740)={&(0x7f0000000640)={0x10, 0x0, 0x0, 0x8000000}, 0xc, &(0x7f0000000700)={&(0x7f0000000680)={0x48, 0x0, 0x4, 0x70bd28, 0x25dfdbfd, {}, [@IEEE802154_ATTR_DEV_INDEX={0x8}, @IEEE802154_ATTR_DEV_NAME={0xa, 0x1, 'wpan3\x00'}, @IEEE802154_ATTR_DEV_NAME={0xa, 0x1, 'wpan4\x00'}, @IEEE802154_ATTR_DEV_NAME={0xa, 0x1, 'wpan1\x00'}, @IEEE802154_ATTR_DEV_INDEX={0x8}]}, 0x48}, 0x1, 0x0, 0x0, 0x4000}, 0x20000080) sendmsg$IEEE802154_START_REQ(r5, &(0x7f0000000840)={&(0x7f0000000780)={0x10, 0x0, 0x0, 0x1000}, 0xc, &(0x7f0000000800)={&(0x7f00000007c0)={0x2c, 0x0, 0x400, 0x70bd2b, 0x25dfdbfb, {}, [@IEEE802154_ATTR_BAT_EXT={0x5, 0x1a, 0x94}, @IEEE802154_ATTR_PAGE={0x5, 0x1d, 0x13}, @IEEE802154_ATTR_COORD_SHORT_ADDR={0x6, 0x8, 0xaaa0}]}, 0x2c}, 0x1, 0x0, 0x0, 0x20000050}, 0x14) clone(0x28000800, &(0x7f0000000880)="b3f828035cfe9f8546c65ee8fffa58fb52d9bafabf363f0161cf01b4a2872006d34dcf860667a59d8c5631820a98c05b3989c5037ea89b5a58e8e9809cc008c7ae03db6bb845b2c189e79729a6d2c9a5440c276c7d0686adda809621c1d9723369157389ff141a56cbc54111ec7f92e8262b0c9ab88b9bffbb114333ab5a9711171c09e2589351fa4950d7af92bccf71585c21606994d6b4443d2cb6725d2c983a62f6f0", &(0x7f0000000940), &(0x7f0000000980), &(0x7f00000009c0)="073c516951c56a5fb1d10f1151ef77ee30e71fea92d34f29ddbe9265f84a8e761f6f56055bef1048f67ec1da822c677e9c34d5d52feb791c13c75661003151c2a956098cc6") sendmsg$ETHTOOL_MSG_LINKMODES_GET(0xffffffffffffffff, &(0x7f0000000c80)={&(0x7f0000000a40)={0x10, 0x0, 0x0, 0x100000}, 0xc, &(0x7f0000000c40)={&(0x7f0000000b40)={0xf4, 0x0, 0x8, 0x70bd25, 0x25dfdbfb, {}, [@HEADER={0x4c, 0x1, 0x0, 0x1, [@ETHTOOL_A_HEADER_FLAGS={0x8, 0x3, 0xdadbe43a496bc96b}, @ETHTOOL_A_HEADER_FLAGS={0x8, 0x3, 0x3}, @ETHTOOL_A_HEADER_DEV_INDEX={0x8}, @ETHTOOL_A_HEADER_FLAGS={0x8, 0x3, 0x2}, @ETHTOOL_A_HEADER_DEV_NAME={0x14, 0x2, 'sit0\x00'}, @ETHTOOL_A_HEADER_DEV_NAME={0x14, 0x2, 'erspan0\x00'}]}, @HEADER={0x2c, 0x1, 0x0, 0x1, [@ETHTOOL_A_HEADER_FLAGS={0x8, 0x3, 0x1}, @ETHTOOL_A_HEADER_FLAGS={0x8}, @ETHTOOL_A_HEADER_FLAGS={0x8, 0x3, 0x7}, @ETHTOOL_A_HEADER_FLAGS={0x8, 0x3, 0x3}, @ETHTOOL_A_HEADER_FLAGS={0x8}]}, @HEADER={0x68, 0x1, 0x0, 0x1, [@ETHTOOL_A_HEADER_FLAGS={0x8, 0x3, 0x3}, @ETHTOOL_A_HEADER_DEV_NAME={0x14, 0x2, 'vlan0\x00'}, @ETHTOOL_A_HEADER_DEV_NAME={0x14, 0x2, 'veth0_to_bond\x00'}, @ETHTOOL_A_HEADER_FLAGS={0x8}, @ETHTOOL_A_HEADER_FLAGS={0x8, 0x3, 0x2}, @ETHTOOL_A_HEADER_DEV_INDEX={0x8, 0x1, r2}, @ETHTOOL_A_HEADER_DEV_INDEX={0x8}, @ETHTOOL_A_HEADER_DEV_NAME={0x14, 0x2, 'bond_slave_1\x00'}]}]}, 0xf4}, 0x1, 0x0, 0x0, 0x4800}, 0x800) 00:52:28 executing program 2: r0 = fsmount(0xffffffffffffffff, 0x1, 0x2) r1 = fsmount(r0, 0x1, 0x7c) fsconfig$FSCONFIG_CMD_CREATE(r1, 0x6, 0x0, 0x0, 0x0) r2 = fsmount(r0, 0x0, 0x8) ioctl$CDROMREADCOOKED(r2, 0x5315, &(0x7f0000000000)) sendmsg$IPSET_CMD_HEADER(r0, &(0x7f0000000b40)={&(0x7f0000000a80)={0x10, 0x0, 0x0, 0x1000000}, 0xc, &(0x7f0000000b00)={&(0x7f0000000ac0)={0x28, 0xc, 0x6, 0x801, 0x0, 0x0, {0xf, 0x0, 0xa}, [@IPSET_ATTR_PROTOCOL={0x5}, @IPSET_ATTR_SETNAME={0x9, 0x2, 'syz2\x00'}]}, 0x28}, 0x1, 0x0, 0x0, 0x4000881}, 0x10) r3 = openat$zero(0xffffffffffffff9c, &(0x7f0000000b80), 0x0, 0x0) mmap$binder(&(0x7f0000fff000/0x1000)=nil, 0x1000, 0x1, 0x11, r3, 0x358f) ioctl$TIOCGICOUNT(r3, 0x545d, 0x0) ioctl$HIDIOCGPHYS(r2, 0x80404812, &(0x7f0000000bc0)) ioctl$CDROMVOLCTRL(r3, 0x530a, &(0x7f0000000c00)={0x1, 0xc0, 0x9, 0x40}) r4 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPSET_CMD_HEADER(r4, &(0x7f0000000d40)={&(0x7f0000000c40)={0x10, 0x0, 0x0, 0x80000}, 0xc, &(0x7f0000000d00)={&(0x7f0000000c80)={0x48, 0xc, 0x6, 0x101, 0x0, 0x0, {0x5, 0x0, 0x9}, [@IPSET_ATTR_PROTOCOL={0x5}, @IPSET_ATTR_PROTOCOL={0x5}, @IPSET_ATTR_SETNAME={0x9, 0x2, 'syz2\x00'}, @IPSET_ATTR_PROTOCOL={0x5}, @IPSET_ATTR_PROTOCOL={0x5}, @IPSET_ATTR_PROTOCOL={0x5}]}, 0x48}, 0x1, 0x0, 0x0, 0x10}, 0x0) openat$binderfs(0xffffffffffffff9c, &(0x7f0000000d80)='./binderfs2/custom0\x00', 0x1, 0x0) r5 = openat$procfs(0xffffffffffffff9c, &(0x7f0000000dc0)='/proc/cpuinfo\x00', 0x0, 0x0) fsmount(r5, 0x1, 0x2) ioctl$TIOCSERGETLSR(r1, 0x5459, &(0x7f0000000e00)) r6 = syz_open_dev$tty1(0xc, 0x4, 0x3) ioctl$TIOCGPTLCK(r6, 0x80045439, &(0x7f0000000e40)) openat$ttyS3(0xffffffffffffff9c, &(0x7f0000000e80), 0x4a80, 0x0) 00:52:28 executing program 7: r0 = openat$procfs(0xffffffffffffff9c, &(0x7f0000000000)='/proc/mdstat\x00', 0x0, 0x0) mmap$IORING_OFF_CQ_RING(&(0x7f0000ffc000/0x2000)=nil, 0x2000, 0x8, 0x4010, r0, 0x8000000) r1 = openat$cdrom(0xffffffffffffff9c, &(0x7f0000000040), 0xb0840, 0x0) ioctl$CDROM_LOCKDOOR(r1, 0x5329, 0x1) r2 = openat$procfs(0xffffffffffffff9c, &(0x7f0000000080)='/proc/slabinfo\x00', 0x0, 0x0) epoll_ctl$EPOLL_CTL_DEL(r2, 0x2, r0) r3 = fsmount(r2, 0x0, 0x7f) ioctl$CDROMREADMODE1(r3, 0x530d, &(0x7f00000000c0)={0x7, 0x1f, 0x3, 0x81, 0xf3, 0x7b}) mprotect(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x1000008) mmap$IORING_OFF_CQ_RING(&(0x7f0000ffe000/0x1000)=nil, 0x1000, 0x2, 0x80010, r3, 0x8000000) socketpair$nbd(0x1, 0x1, 0x0, &(0x7f0000000d80)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$sock_SIOCGIFINDEX_80211(r5, 0x8933, &(0x7f0000000dc0)={'wlan1\x00'}) r6 = syz_genetlink_get_family_id$batadv(&(0x7f0000000e40), r0) sendmsg$BATADV_CMD_GET_ORIGINATORS(r3, &(0x7f0000000f00)={&(0x7f0000000e00)={0x10, 0x0, 0x0, 0x400000}, 0xc, &(0x7f0000000ec0)={&(0x7f0000000e80)={0x34, r6, 0x2, 0x70bd29, 0x25dfdbff, {}, [@BATADV_ATTR_THROUGHPUT_OVERRIDE={0x8, 0x3b, 0x8}, @BATADV_ATTR_BRIDGE_LOOP_AVOIDANCE_ENABLED={0x5, 0x2e, 0x1}, @BATADV_ATTR_FRAGMENTATION_ENABLED={0x5, 0x30, 0x1}, @BATADV_ATTR_TPMETER_TEST_TIME={0x8, 0xb, 0xfffffffb}]}, 0x34}, 0x1, 0x0, 0x0, 0x20000000}, 0x4000000) ioctl$CDROM_GET_CAPABILITY(0xffffffffffffffff, 0x5331) r7 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r8 = syz_genetlink_get_family_id$nbd(&(0x7f0000000f80), 0xffffffffffffffff) sendmsg$NBD_CMD_RECONFIGURE(r7, &(0x7f0000001040)={&(0x7f0000000f40)={0x10, 0x0, 0x0, 0x4000000}, 0xc, &(0x7f0000001000)={&(0x7f0000000fc0)={0x20, r8, 0x200, 0x70bd2b, 0x25dfdbfb, {}, [@NBD_ATTR_TIMEOUT={0xc, 0x4, 0x1f}]}, 0x20}, 0x1, 0x0, 0x0, 0x20000000}, 0x2004c000) ioctl$sock_SIOCGIFINDEX_80211(r4, 0x8933, &(0x7f0000001080)={'wlan1\x00'}) sendmsg$NBD_CMD_DISCONNECT(r7, &(0x7f00000011c0)={&(0x7f00000010c0)={0x10, 0x0, 0x0, 0x4000}, 0xc, &(0x7f0000001180)={&(0x7f0000001140)={0x20, 0x0, 0x20, 0x70bd25, 0x25dfdbfe, {}, [@NBD_ATTR_BLOCK_SIZE_BYTES={0xc, 0x3, 0x9de}]}, 0x20}, 0x1, 0x0, 0x0, 0x20004000}, 0x200000c5) 00:52:28 executing program 2: r0 = fsmount(0xffffffffffffffff, 0x1, 0x2) r1 = fsmount(r0, 0x1, 0x7c) fsconfig$FSCONFIG_CMD_CREATE(r1, 0x6, 0x0, 0x0, 0x0) r2 = fsmount(r0, 0x0, 0x8) ioctl$CDROMREADCOOKED(r2, 0x5315, &(0x7f0000000000)) sendmsg$IPSET_CMD_HEADER(r0, &(0x7f0000000b40)={&(0x7f0000000a80)={0x10, 0x0, 0x0, 0x1000000}, 0xc, &(0x7f0000000b00)={&(0x7f0000000ac0)={0x28, 0xc, 0x6, 0x801, 0x0, 0x0, {0xf, 0x0, 0xa}, [@IPSET_ATTR_PROTOCOL={0x5}, @IPSET_ATTR_SETNAME={0x9, 0x2, 'syz2\x00'}]}, 0x28}, 0x1, 0x0, 0x0, 0x4000881}, 0x10) r3 = openat$zero(0xffffffffffffff9c, &(0x7f0000000b80), 0x0, 0x0) mmap$binder(&(0x7f0000fff000/0x1000)=nil, 0x1000, 0x1, 0x11, r3, 0x358f) ioctl$TIOCGICOUNT(r3, 0x545d, 0x0) ioctl$HIDIOCGPHYS(r2, 0x80404812, &(0x7f0000000bc0)) ioctl$CDROMVOLCTRL(r3, 0x530a, &(0x7f0000000c00)={0x1, 0xc0, 0x9, 0x40}) r4 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPSET_CMD_HEADER(r4, &(0x7f0000000d40)={&(0x7f0000000c40)={0x10, 0x0, 0x0, 0x80000}, 0xc, &(0x7f0000000d00)={&(0x7f0000000c80)={0x48, 0xc, 0x6, 0x101, 0x0, 0x0, {0x5, 0x0, 0x9}, [@IPSET_ATTR_PROTOCOL={0x5}, @IPSET_ATTR_PROTOCOL={0x5}, @IPSET_ATTR_SETNAME={0x9, 0x2, 'syz2\x00'}, @IPSET_ATTR_PROTOCOL={0x5}, @IPSET_ATTR_PROTOCOL={0x5}, @IPSET_ATTR_PROTOCOL={0x5}]}, 0x48}, 0x1, 0x0, 0x0, 0x10}, 0x0) openat$binderfs(0xffffffffffffff9c, &(0x7f0000000d80)='./binderfs2/custom0\x00', 0x1, 0x0) r5 = openat$procfs(0xffffffffffffff9c, &(0x7f0000000dc0)='/proc/cpuinfo\x00', 0x0, 0x0) fsmount(r5, 0x1, 0x2) ioctl$TIOCSERGETLSR(r1, 0x5459, &(0x7f0000000e00)) r6 = syz_open_dev$tty1(0xc, 0x4, 0x3) ioctl$TIOCGPTLCK(r6, 0x80045439, &(0x7f0000000e40)) openat$ttyS3(0xffffffffffffff9c, &(0x7f0000000e80), 0x4a80, 0x0) 00:52:28 executing program 5: prctl$PR_GET_FPEXC(0xb, &(0x7f0000000000)) r0 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000040)='./binderfs/custom0\x00', 0x800, 0x0) ustat(0x800, &(0x7f0000000080)) ioctl$ifreq_SIOCGIFINDEX_batadv_mesh(0xffffffffffffffff, 0x8933, &(0x7f0000000100)={'batadv0\x00', 0x0}) ioctl$ifreq_SIOCGIFINDEX_batadv_hard(0xffffffffffffffff, 0x8933, &(0x7f0000000140)={'batadv_slave_0\x00', 0x0}) sendmsg$ETHTOOL_MSG_PAUSE_GET(0xffffffffffffffff, &(0x7f00000002c0)={&(0x7f00000000c0)={0x10, 0x0, 0x0, 0x10000}, 0xc, &(0x7f0000000280)={&(0x7f0000000180)={0xdc, 0x0, 0x8, 0x70bd27, 0x25dfdbfb, {}, [@HEADER={0x5c, 0x1, 0x0, 0x1, [@ETHTOOL_A_HEADER_DEV_INDEX={0x8, 0x1, r1}, @ETHTOOL_A_HEADER_FLAGS={0x8}, @ETHTOOL_A_HEADER_DEV_NAME={0x14, 0x2, 'veth0_vlan\x00'}, @ETHTOOL_A_HEADER_DEV_INDEX={0x8}, @ETHTOOL_A_HEADER_FLAGS={0x8, 0x3, 0x3}, @ETHTOOL_A_HEADER_FLAGS={0x8, 0x3, 0x2}, @ETHTOOL_A_HEADER_DEV_INDEX={0x8, 0x1, r2}, @ETHTOOL_A_HEADER_DEV_NAME={0x14, 0x2, 'macvlan0\x00'}]}, @HEADER={0x40, 0x1, 0x0, 0x1, [@ETHTOOL_A_HEADER_DEV_NAME={0x14, 0x2, 'veth0_to_bridge\x00'}, @ETHTOOL_A_HEADER_DEV_NAME={0x14, 0x2, 'veth0_to_bridge\x00'}, @ETHTOOL_A_HEADER_DEV_NAME={0x14, 0x2, 'netpci0\x00'}]}, @HEADER={0x2c, 0x1, 0x0, 0x1, [@ETHTOOL_A_HEADER_DEV_NAME={0x14, 0x2, 'bond_slave_1\x00'}, @ETHTOOL_A_HEADER_DEV_NAME={0x14, 0x2, 'ip_vti0\x00'}]}]}, 0xdc}, 0x1, 0x0, 0x0, 0x4000}, 0x24000000) sendmsg$NBD_CMD_STATUS(0xffffffffffffffff, &(0x7f0000000400)={&(0x7f0000000300)={0x10, 0x0, 0x0, 0x4}, 0xc, &(0x7f00000003c0)={&(0x7f0000000340)={0x44, 0x0, 0x20, 0x70bd2d, 0x25dfdbfc, {}, [@NBD_ATTR_SIZE_BYTES={0xc, 0x2, 0x4}, @NBD_ATTR_SOCKETS={0x24, 0x7, 0x0, 0x1, [{0x8}, {0x8}, {0x8}, {0x8}]}]}, 0x44}}, 0x4000) ioctl$BINDER_GET_NODE_DEBUG_INFO(r0, 0xc018620b, &(0x7f0000000440)={0x3}) syz_genetlink_get_family_id$batadv(&(0x7f0000000480), 0xffffffffffffffff) r3 = syz_open_dev$ttys(0xc, 0x2, 0x0) ioctl$TCSETAF(r3, 0x5408, &(0x7f00000004c0)={0x4, 0xb073, 0x1000, 0x1, 0x13, "b786e10fbdab60cc"}) openat$binderfs(0xffffffffffffff9c, &(0x7f0000000500)='./binderfs2/binder0\x00', 0x802, 0x0) sendmsg$BATADV_CMD_SET_VLAN(0xffffffffffffffff, &(0x7f0000000600)={&(0x7f0000000540)={0x10, 0x0, 0x0, 0x80000}, 0xc, &(0x7f00000005c0)={&(0x7f0000000580)={0x30, 0x0, 0x400, 0x70bd27, 0x25dfdbfb, {}, [@BATADV_ATTR_FRAGMENTATION_ENABLED={0x5, 0x30, 0x1}, @BATADV_ATTR_ORIG_ADDRESS={0xa, 0x9, @random="62836be88da6"}, @BATADV_ATTR_ISOLATION_MASK={0x8, 0x2c, 0x81}]}, 0x30}, 0x1, 0x0, 0x0, 0x8004}, 0x4c000) r4 = syz_open_dev$ttys(0xc, 0x2, 0x0) ioctl$TIOCEXCL(r4, 0x540c) r5 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) sendmsg$IEEE802154_LLSEC_GETPARAMS(r5, &(0x7f0000000740)={&(0x7f0000000640)={0x10, 0x0, 0x0, 0x8000000}, 0xc, &(0x7f0000000700)={&(0x7f0000000680)={0x48, 0x0, 0x4, 0x70bd28, 0x25dfdbfd, {}, [@IEEE802154_ATTR_DEV_INDEX={0x8}, @IEEE802154_ATTR_DEV_NAME={0xa, 0x1, 'wpan3\x00'}, @IEEE802154_ATTR_DEV_NAME={0xa, 0x1, 'wpan4\x00'}, @IEEE802154_ATTR_DEV_NAME={0xa, 0x1, 'wpan1\x00'}, @IEEE802154_ATTR_DEV_INDEX={0x8}]}, 0x48}, 0x1, 0x0, 0x0, 0x4000}, 0x20000080) sendmsg$IEEE802154_START_REQ(r5, &(0x7f0000000840)={&(0x7f0000000780)={0x10, 0x0, 0x0, 0x1000}, 0xc, &(0x7f0000000800)={&(0x7f00000007c0)={0x2c, 0x0, 0x400, 0x70bd2b, 0x25dfdbfb, {}, [@IEEE802154_ATTR_BAT_EXT={0x5, 0x1a, 0x94}, @IEEE802154_ATTR_PAGE={0x5, 0x1d, 0x13}, @IEEE802154_ATTR_COORD_SHORT_ADDR={0x6, 0x8, 0xaaa0}]}, 0x2c}, 0x1, 0x0, 0x0, 0x20000050}, 0x14) clone(0x28000800, &(0x7f0000000880)="b3f828035cfe9f8546c65ee8fffa58fb52d9bafabf363f0161cf01b4a2872006d34dcf860667a59d8c5631820a98c05b3989c5037ea89b5a58e8e9809cc008c7ae03db6bb845b2c189e79729a6d2c9a5440c276c7d0686adda809621c1d9723369157389ff141a56cbc54111ec7f92e8262b0c9ab88b9bffbb114333ab5a9711171c09e2589351fa4950d7af92bccf71585c21606994d6b4443d2cb6725d2c983a62f6f0", &(0x7f0000000940), &(0x7f0000000980), &(0x7f00000009c0)="073c516951c56a5fb1d10f1151ef77ee30e71fea92d34f29ddbe9265f84a8e761f6f56055bef1048f67ec1da822c677e9c34d5d52feb791c13c75661003151c2a956098cc6") sendmsg$ETHTOOL_MSG_LINKMODES_GET(0xffffffffffffffff, &(0x7f0000000c80)={&(0x7f0000000a40)={0x10, 0x0, 0x0, 0x100000}, 0xc, &(0x7f0000000c40)={&(0x7f0000000b40)={0xf4, 0x0, 0x8, 0x70bd25, 0x25dfdbfb, {}, [@HEADER={0x4c, 0x1, 0x0, 0x1, [@ETHTOOL_A_HEADER_FLAGS={0x8, 0x3, 0xdadbe43a496bc96b}, @ETHTOOL_A_HEADER_FLAGS={0x8, 0x3, 0x3}, @ETHTOOL_A_HEADER_DEV_INDEX={0x8}, @ETHTOOL_A_HEADER_FLAGS={0x8, 0x3, 0x2}, @ETHTOOL_A_HEADER_DEV_NAME={0x14, 0x2, 'sit0\x00'}, @ETHTOOL_A_HEADER_DEV_NAME={0x14, 0x2, 'erspan0\x00'}]}, @HEADER={0x2c, 0x1, 0x0, 0x1, [@ETHTOOL_A_HEADER_FLAGS={0x8, 0x3, 0x1}, @ETHTOOL_A_HEADER_FLAGS={0x8}, @ETHTOOL_A_HEADER_FLAGS={0x8, 0x3, 0x7}, @ETHTOOL_A_HEADER_FLAGS={0x8, 0x3, 0x3}, @ETHTOOL_A_HEADER_FLAGS={0x8}]}, @HEADER={0x68, 0x1, 0x0, 0x1, [@ETHTOOL_A_HEADER_FLAGS={0x8, 0x3, 0x3}, @ETHTOOL_A_HEADER_DEV_NAME={0x14, 0x2, 'vlan0\x00'}, @ETHTOOL_A_HEADER_DEV_NAME={0x14, 0x2, 'veth0_to_bond\x00'}, @ETHTOOL_A_HEADER_FLAGS={0x8}, @ETHTOOL_A_HEADER_FLAGS={0x8, 0x3, 0x2}, @ETHTOOL_A_HEADER_DEV_INDEX={0x8, 0x1, r2}, @ETHTOOL_A_HEADER_DEV_INDEX={0x8}, @ETHTOOL_A_HEADER_DEV_NAME={0x14, 0x2, 'bond_slave_1\x00'}]}]}, 0xf4}, 0x1, 0x0, 0x0, 0x4800}, 0x800) 00:52:28 executing program 1: r0 = openat$zero(0xffffffffffffff9c, &(0x7f0000000000), 0x400200, 0x0) ioctl$SECCOMP_IOCTL_NOTIF_ADDFD(r0, 0x40182103, &(0x7f0000000040)={0x0, 0x1, 0xffffffffffffffff, 0x80000000, 0x80000}) r1 = syz_genetlink_get_family_id$batadv(&(0x7f00000000c0), r0) sendmsg$BATADV_CMD_GET_TRANSTABLE_LOCAL(r0, &(0x7f00000001c0)={&(0x7f0000000080)={0x10, 0x0, 0x0, 0x80000}, 0xc, &(0x7f0000000180)={&(0x7f0000000100)={0x54, r1, 0x200, 0x70bd25, 0x25dfdbff, {}, [@BATADV_ATTR_THROUGHPUT_OVERRIDE={0x8, 0x3b, 0x89}, @BATADV_ATTR_THROUGHPUT_OVERRIDE={0x8, 0x3b, 0xffff}, @BATADV_ATTR_FRAGMENTATION_ENABLED={0x5}, @BATADV_ATTR_AGGREGATED_OGMS_ENABLED={0x5}, @BATADV_ATTR_MULTICAST_FORCEFLOOD_ENABLED={0x5}, @BATADV_ATTR_BRIDGE_LOOP_AVOIDANCE_ENABLED={0x5}, @BATADV_ATTR_HARD_IFINDEX={0x8}, @BATADV_ATTR_GW_MODE={0x5, 0x33, 0x1}]}, 0x54}, 0x1, 0x0, 0x0, 0x48041}, 0x4840) r2 = openat$procfs(0xffffffffffffff9c, &(0x7f0000000200)='/proc/cpuinfo\x00', 0x0, 0x0) sendmsg$BATADV_CMD_GET_GATEWAYS(r2, &(0x7f0000000340)={&(0x7f0000000240)={0x10, 0x0, 0x0, 0x1000000}, 0xc, &(0x7f0000000300)={&(0x7f0000000280)={0x50, r1, 0x400, 0x70bd26, 0x25dfdbfb, {}, [@BATADV_ATTR_BRIDGE_LOOP_AVOIDANCE_ENABLED={0x5, 0x2e, 0x1}, @BATADV_ATTR_ISOLATION_MARK={0x8, 0x2b, 0x3}, @BATADV_ATTR_BONDING_ENABLED={0x5}, @BATADV_ATTR_BRIDGE_LOOP_AVOIDANCE_ENABLED={0x5, 0x2e, 0x1}, @BATADV_ATTR_ORIG_ADDRESS={0xa, 0x9, @multicast}, @BATADV_ATTR_THROUGHPUT_OVERRIDE={0x8, 0x3b, 0x1}, @BATADV_ATTR_ISOLATION_MARK={0x8, 0x2b, 0x6}]}, 0x50}, 0x1, 0x0, 0x0, 0x20049800}, 0x80) r3 = syz_genetlink_get_family_id$batadv(&(0x7f00000003c0), r0) sendmsg$BATADV_CMD_SET_MESH(r0, &(0x7f0000000480)={&(0x7f0000000380)={0x10, 0x0, 0x0, 0x1000}, 0xc, &(0x7f0000000440)={&(0x7f0000000400)={0x34, r3, 0x400, 0x70bd2d, 0x25dfdbff, {}, [@BATADV_ATTR_GW_MODE={0x5}, @BATADV_ATTR_GW_BANDWIDTH_UP={0x8, 0x32, 0x8001}, @BATADV_ATTR_ORIG_INTERVAL={0x8, 0x39, 0x4}, @BATADV_ATTR_NETWORK_CODING_ENABLED={0x5, 0x38, 0x1}]}, 0x34}, 0x1, 0x0, 0x0, 0x4000000}, 0x18000) r4 = fsmount(r0, 0x1, 0x5) r5 = fsmount(r2, 0x1, 0x7a) epoll_ctl$EPOLL_CTL_ADD(r4, 0x1, r5, &(0x7f00000016c0)={0x80002000}) r6 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000001700), 0x111002, 0x0) epoll_ctl$EPOLL_CTL_MOD(r0, 0x3, r6, &(0x7f0000001740)) ioctl$SECCOMP_IOCTL_NOTIF_ID_VALID(r5, 0x40082102, &(0x7f0000001780)) rt_sigqueueinfo(0xffffffffffffffff, 0x2, &(0x7f00000017c0)={0x16, 0x5, 0x8}) ioctl$BINDER_SET_MAX_THREADS(r4, 0x40046205, &(0x7f0000001840)=0x4) r7 = syz_genetlink_get_family_id$ieee802154(&(0x7f00000018c0), 0xffffffffffffffff) sendmsg$IEEE802154_ASSOCIATE_RESP(0xffffffffffffffff, &(0x7f00000019c0)={&(0x7f0000001880)={0x10, 0x0, 0x0, 0x10}, 0xc, &(0x7f0000001980)={&(0x7f0000001900)={0x48, r7, 0x400, 0x70bd26, 0x25dfdbfc, {}, [@IEEE802154_ATTR_COORD_HW_ADDR={0xc, 0x9, {0x5555555555540004}}, @IEEE802154_ATTR_COORD_HW_ADDR={0xc, 0x9, {0xaaaaaaaaaaaa0302}}, @IEEE802154_ATTR_COORD_HW_ADDR={0xc, 0x9, {0xaaaaaaaaaaaa0002}}, @IEEE802154_ATTR_STATUS={0x5, 0x3, 0x88}, @IEEE802154_ATTR_STATUS={0x5, 0x3, 0x3}]}, 0x48}, 0x1, 0x0, 0x0, 0x800}, 0x810) ioctl$SECCOMP_IOCTL_NOTIF_ID_VALID(r0, 0x40082102, &(0x7f0000001a00)) sendmsg$SMC_PNETID_FLUSH(r5, &(0x7f0000001b80)={&(0x7f0000001a40)={0x10, 0x0, 0x0, 0x80000}, 0xc, &(0x7f0000001b40)={&(0x7f0000001ac0)={0x7c, 0x0, 0x8, 0x70bd2d, 0x25dfdbfb, {}, [@SMC_PNETID_IBPORT={0x5, 0x4, 0x2}, @SMC_PNETID_NAME={0x9, 0x1, 'syz2\x00'}, @SMC_PNETID_IBNAME={0x9, 0x3, 'syz0\x00'}, @SMC_PNETID_ETHNAME={0x14, 0x2, 'wg2\x00'}, @SMC_PNETID_NAME={0x9, 0x1, 'syz2\x00'}, @SMC_PNETID_ETHNAME={0x14, 0x2, 'veth1_macvtap\x00'}, @SMC_PNETID_IBPORT={0x5, 0x4, 0x2}, @SMC_PNETID_IBNAME={0x9, 0x3, 'syz0\x00'}]}, 0x7c}, 0x1, 0x0, 0x0, 0x20000040}, 0x20000800) 00:52:28 executing program 4: r0 = openat$ttyS3(0xffffffffffffff9c, &(0x7f0000000000), 0xa2000, 0x0) ioctl$TIOCSETD(r0, 0x5423, &(0x7f0000000040)=0x13) r1 = fsmount(0xffffffffffffffff, 0x1, 0x76) ioctl$TCSETAF(r1, 0x5408, &(0x7f0000000080)={0x5, 0x8001, 0x4, 0x8001, 0x15, "b45da66f02087ca7"}) ioctl$TCSETAF(r1, 0x5408, &(0x7f00000000c0)={0x5, 0x22c1, 0x800, 0x8, 0x5, "2b8c058f839aaa67"}) connect$netlink(r1, &(0x7f0000000100)=@proc={0x10, 0x0, 0x25dfdbfd, 0x2}, 0xc) r2 = syz_open_dev$tty1(0xc, 0x4, 0x4) ioctl$TCSETSF(r2, 0x5404, &(0x7f0000000140)={0x6, 0x2, 0x2, 0x80000001, 0x1b, "c2331e6388ffeb48419d467a4b791ad4343a96"}) ioctl$TIOCMGET(r1, 0x5415, &(0x7f0000000180)) ioctl$TCSETAF(r2, 0x5408, &(0x7f00000001c0)={0x11, 0x0, 0xfff, 0x7, 0xd, "3ae59dd65d54337c"}) r3 = timerfd_create(0x7, 0x800) timerfd_settime(r3, 0x1, &(0x7f0000000200), &(0x7f0000000240)) ioctl$TCSETAF(r2, 0x5408, &(0x7f0000000280)={0x1, 0x1, 0x3d4c, 0x200, 0x0, "73a709364d80b6c1"}) ioctl$PIO_UNIMAPCLR(0xffffffffffffffff, 0x4b68, &(0x7f00000002c0)={0x73, 0x1fe0, 0x8b}) ioctl$TCSETSF2(r2, 0x402c542d, &(0x7f0000000300)={0xffffffff, 0x0, 0x80000000, 0x9, 0x6, "35157e2ff53385c0969535964d148320e065e8", 0x6}) ioctl$KDGKBMETA(0xffffffffffffffff, 0x4b62, &(0x7f0000000340)) ioctl$TIOCGICOUNT(r2, 0x545d, 0x0) socket(0x16, 0x1, 0x9) sendmsg$IEEE802154_LLSEC_DEL_KEY(0xffffffffffffffff, &(0x7f0000000440)={&(0x7f0000000380)={0x10, 0x0, 0x0, 0x10000}, 0xc, &(0x7f0000000400)={&(0x7f00000003c0)={0x38, 0x0, 0x10, 0x70bd2d, 0x25dfdbfe, {}, [@IEEE802154_ATTR_DEV_NAME={0xa, 0x1, 'wpan4\x00'}, @IEEE802154_ATTR_DEV_NAME={0xa, 0x1, 'wpan3\x00'}, @IEEE802154_ATTR_LLSEC_KEY_SOURCE_EXTENDED={0xc, 0x2d, {0xaaaaaaaaaaaa0302}}]}, 0x38}}, 0xc008) sendmsg$NL802154_CMD_SET_ACKREQ_DEFAULT(0xffffffffffffffff, &(0x7f0000000540)={&(0x7f0000000480)={0x10, 0x0, 0x0, 0x40}, 0xc, &(0x7f0000000500)={&(0x7f00000004c0)={0x28, 0x0, 0x800, 0x70bd28, 0x25dfdbfc, {}, [@NL802154_ATTR_WPAN_DEV={0xc, 0x6, 0x300000003}, @NL802154_ATTR_IFINDEX={0x8}]}, 0x28}, 0x1, 0x0, 0x0, 0x40}, 0x48080) 00:52:28 executing program 6: ioctl$sock_SIOCGIFINDEX_802154(0xffffffffffffffff, 0x8933, &(0x7f0000000000)={'wpan1\x00', 0x0}) r1 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) ioctl$sock_SIOCGIFINDEX_802154(0xffffffffffffffff, 0x8933, &(0x7f0000000080)={'wpan3\x00', 0x0}) sendmsg$IEEE802154_LLSEC_ADD_SECLEVEL(r1, &(0x7f0000000140)={&(0x7f0000000040)={0x10, 0x0, 0x0, 0x800000}, 0xc, &(0x7f0000000100)={&(0x7f00000000c0)={0x2c, 0x0, 0x400, 0x70bd2a, 0x25dfdbfe, {}, [@IEEE802154_ATTR_DEV_INDEX={0x8, 0x2, r0}, @IEEE802154_ATTR_DEV_INDEX={0x8, 0x2, r0}, @IEEE802154_ATTR_DEV_INDEX={0x8, 0x2, r2}]}, 0x2c}, 0x1, 0x0, 0x0, 0x4004081}, 0x10) sendmsg$IEEE802154_LLSEC_DEL_KEY(r1, &(0x7f0000000240)={&(0x7f0000000180)={0x10, 0x0, 0x0, 0x1000000}, 0xc, &(0x7f0000000200)={&(0x7f00000001c0)={0x3c, 0x0, 0x30e, 0x70bd25, 0x25dfdbfd, {}, [@IEEE802154_ATTR_HW_ADDR={0xc, 0x5, {0xaaaaaaaaaaaa0102}}, @IEEE802154_ATTR_LLSEC_KEY_SOURCE_EXTENDED={0xc, 0x2d, {0xaaaaaaaaaaaa0102}}, @IEEE802154_ATTR_LLSEC_KEY_SOURCE_SHORT={0x8, 0x2c, 0x5}, @IEEE802154_ATTR_DEV_INDEX={0x8}]}, 0x3c}, 0x1, 0x0, 0x0, 0x24041000}, 0x44) socketpair$nbd(0x1, 0x1, 0x0, &(0x7f0000002280)={0xffffffffffffffff}) r4 = openat$procfs(0xffffffffffffff9c, &(0x7f00000022c0)='/proc/asound/seq/clients\x00', 0x0, 0x0) socketpair$nbd(0x1, 0x1, 0x0, &(0x7f0000002300)={0xffffffffffffffff}) r6 = socket(0x1d, 0x3, 0x6) r7 = openat$zero(0xffffffffffffff9c, &(0x7f0000002340), 0x2, 0x0) socketpair$nbd(0x1, 0x1, 0x0, &(0x7f0000002380)={0xffffffffffffffff}) sendmsg$NBD_CMD_DISCONNECT(r1, &(0x7f0000002480)={&(0x7f0000000280)={0x10, 0x0, 0x0, 0x80000}, 0xc, &(0x7f0000002440)={&(0x7f00000023c0)={0x6c, 0x0, 0x400, 0x70bd27, 0x25dfdbfb, {}, [@NBD_ATTR_TIMEOUT={0xc, 0x4, 0x100000001}, @NBD_ATTR_SOCKETS={0x4c, 0x7, 0x0, 0x1, [{0x8, 0x1, r3}, {0x8, 0x1, r4}, {0x8}, {0x8, 0x1, r5}, {0x8}, {0x8, 0x1, r6}, {0x8, 0x1, r7}, {0x8, 0x1, r8}, {0x8}]}]}, 0x6c}, 0x1, 0x0, 0x0, 0x20000000}, 0x4000020) r9 = syz_genetlink_get_family_id$ieee802154(&(0x7f0000002500), r1) sendmsg$IEEE802154_LLSEC_LIST_SECLEVEL(r1, &(0x7f00000025c0)={&(0x7f00000024c0)={0x10, 0x0, 0x0, 0x4}, 0xc, &(0x7f0000002580)={&(0x7f0000002540)={0x14, r9, 0x100, 0x70bd25, 0x25dfdbfd, {}, ["", "", "", "", "", ""]}, 0x14}, 0x1, 0x0, 0x0, 0x11}, 0x20000084) r10 = syz_genetlink_get_family_id$nbd(&(0x7f0000002640), r1) sendmsg$NBD_CMD_RECONFIGURE(r1, &(0x7f0000002700)={&(0x7f0000002600)={0x10, 0x0, 0x0, 0x800}, 0xc, &(0x7f00000026c0)={&(0x7f0000002680)={0x3c, r10, 0x800, 0x70bd2b, 0x25dfdbfe, {}, [@NBD_ATTR_DEAD_CONN_TIMEOUT={0xc, 0x8, 0x9}, @NBD_ATTR_SERVER_FLAGS={0xc, 0x5, 0x8}, @NBD_ATTR_INDEX={0x8, 0x1, 0x0}, @NBD_ATTR_INDEX={0x8, 0x1, 0x0}]}, 0x3c}, 0x1, 0x0, 0x0, 0x4000}, 0x40) r11 = fsmount(r7, 0x0, 0x80) r12 = ioctl$TIOCGPTPEER(r7, 0x5441, 0xe5) ioctl$BINDER_WRITE_READ(r11, 0xc0306201, &(0x7f0000002b40)={0xa8, 0x0, &(0x7f00000029c0)=[@dead_binder_done, @increfs={0x40046304, 0x3}, @exit_looper, @reply={0x40406301, {0x0, 0x0, 0x0, 0x0, 0x10, 0x0, 0x0, 0x60, 0x18, &(0x7f0000002800)={@fd={0x66642a85, 0x0, r12}, @ptr={0x70742a85, 0x1, &(0x7f0000002740)=""/143, 0x8f, 0x1, 0x27}, @fda={0x66646185, 0x6, 0x1, 0x1b}}, &(0x7f0000002880)={0x0, 0x18, 0x40}}}, @transaction={0x40406300, {0x569d, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x68, 0x18, &(0x7f0000002900)={@fda={0x66646185, 0x7, 0x2, 0x30}, @fda={0x66646185, 0x6, 0x1, 0x19}, @ptr={0x70742a85, 0x1, &(0x7f00000028c0)=""/44, 0x2c, 0x0, 0x1e}}, &(0x7f0000002980)={0x0, 0x20, 0x40}}}, @acquire={0x40046305, 0x2}], 0x82, 0x0, &(0x7f0000002a80)="4e9021c002cf1475e76bab6446fcfe48739f863d4b3d42d725bbbe6a107642ceb13288996f73ae1e30314fe22d00559f4252f19f81c3c54f52076ae0f7a10e882089527d696f376f1f742d3eef2232dfa2751900338ab2b2ddb91da97649b15d4a554a941614affc06f845c957db99fe301dad3d757caf42e2327c353388fc1e456f"}) sendmsg$NBD_CMD_CONNECT(r1, &(0x7f0000002cc0)={&(0x7f0000002b80)={0x10, 0x0, 0x0, 0x8}, 0xc, &(0x7f0000002c80)={&(0x7f0000002bc0)={0x88, r10, 0x100, 0x70bd27, 0x25dfdbfd, {}, [@NBD_ATTR_SERVER_FLAGS={0xc, 0x5, 0x104}, @NBD_ATTR_BLOCK_SIZE_BYTES={0xc, 0x3, 0x3}, @NBD_ATTR_SIZE_BYTES={0xc, 0x2, 0x6}, @NBD_ATTR_TIMEOUT={0xc, 0x4, 0x1ff}, @NBD_ATTR_SERVER_FLAGS={0xc, 0x5, 0x1}, @NBD_ATTR_SERVER_FLAGS={0xc, 0x5, 0x104}, @NBD_ATTR_SIZE_BYTES={0xc, 0x2, 0x3}, @NBD_ATTR_INDEX={0x8, 0x1, 0x0}, @NBD_ATTR_CLIENT_FLAGS={0xc, 0x6, 0x1}, @NBD_ATTR_SERVER_FLAGS={0xc, 0x5, 0x104}]}, 0x88}, 0x1, 0x0, 0x0, 0x800}, 0x40000c4) 00:52:29 executing program 0: r0 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$ieee802154(&(0x7f0000000040), 0xffffffffffffffff) ioctl$sock_SIOCGIFINDEX_802154(0xffffffffffffffff, 0x8933, &(0x7f0000000080)={'wpan0\x00', 0x0}) sendmsg$IEEE802154_LLSEC_DEL_DEVKEY(r0, &(0x7f0000000140)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x2000000}, 0xc, &(0x7f0000000100)={&(0x7f00000000c0)={0x38, r1, 0x2, 0x70bd27, 0x25dfdbfb, {}, [@IEEE802154_ATTR_LLSEC_KEY_SOURCE_SHORT={0x8, 0x2c, 0xee0}, @IEEE802154_ATTR_PAN_ID={0x6, 0x6, 0xffff}, @IEEE802154_ATTR_DEV_INDEX={0x8, 0x2, r2}, @IEEE802154_ATTR_LLSEC_KEY_SOURCE_EXTENDED={0xc, 0x2d, {0xaaaaaaaaaaaa0002}}]}, 0x38}}, 0x4) r3 = syz_genetlink_get_family_id$ieee802154(&(0x7f00000001c0), r0) sendmsg$IEEE802154_LLSEC_ADD_KEY(r0, &(0x7f00000002c0)={&(0x7f0000000180)={0x10, 0x0, 0x0, 0x80}, 0xc, &(0x7f0000000280)={&(0x7f0000000200)={0x70, r3, 0x8dc3595b298c372b, 0x70bd2c, 0x25dfdbfd, {}, [@IEEE802154_ATTR_HW_ADDR={0xc, 0x5, {0xaaaaaaaaaaaa0302}}, @IEEE802154_ATTR_LLSEC_KEY_SOURCE_EXTENDED={0xc, 0x2d, {0xaaaaaaaaaaaa0202}}, @IEEE802154_ATTR_HW_ADDR={0xc, 0x5, {0xaaaaaaaaaaaa0002}}, @IEEE802154_ATTR_LLSEC_KEY_USAGE_FRAME_TYPES={0x5, 0x31, 0x81}, @IEEE802154_ATTR_DEV_NAME={0xa, 0x1, 'wpan1\x00'}, @IEEE802154_ATTR_LLSEC_KEY_USAGE_COMMANDS={0x24, 0x32, "c38d2be0aa0107a2b38f85915a757ba51ff3d89ac2e1c596dce3055b00418226"}]}, 0x70}, 0x1, 0x0, 0x0, 0x20004040}, 0x0) r4 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) sendmsg$IEEE802154_ASSOCIATE_RESP(r4, &(0x7f0000000400)={&(0x7f0000000300)={0x10, 0x0, 0x0, 0x2000000}, 0xc, &(0x7f00000003c0)={&(0x7f0000000340)={0x60, r3, 0x200, 0x70bd26, 0x25dfdbfd, {}, [@IEEE802154_ATTR_COORD_HW_ADDR={0xc}, @IEEE802154_ATTR_STATUS={0x5, 0x3, 0x40}, @IEEE802154_ATTR_STATUS={0x5, 0x3, 0x1}, @IEEE802154_ATTR_COORD_HW_ADDR={0xc, 0x9, {0x2c841fbeb2fffbec}}, @IEEE802154_ATTR_COORD_HW_ADDR={0xc, 0x9, {0xaaaaaaaaaaaa0202}}, @IEEE802154_ATTR_STATUS={0x5, 0x3, 0x6}, @IEEE802154_ATTR_STATUS={0x5, 0x3, 0x3f}, @IEEE802154_ATTR_COORD_SHORT_ADDR={0x6, 0x8, 0xffff}]}, 0x60}, 0x1, 0x0, 0x0, 0x20000000}, 0x20000080) ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, &(0x7f0000000540)={0xc, 0x0, &(0x7f0000000440)=[@dead_binder_done], 0xbf, 0x0, &(0x7f0000000480)="0537636f85beafebd2a00648fb042246bcbd2150d45e58acedd2718aaa529794fc45c87c914f2b69b82fedb220d6a94b2babd3f188631b48d025c32a8342250d69582838e7ee6d22fa335ce4315412805f50869d3f4bef11a5bb26ac3704b717f9416fc1f441d5dd77d4b3c1a283f3179a7daf20c0d30210361ea15f09fd38e2c2ac52383e1685a787783f4524fd7d784046605442e441fb76b236455574d7fe70d1885d924099864313d8d3d84c106a36d2ccc77c51d3cdaf3f716551fc0a"}) r5 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) syz_genetlink_get_family_id$ieee802154(&(0x7f0000000580), r5) sendmsg$IEEE802154_SET_MACPARAMS(r0, &(0x7f0000000680)={&(0x7f00000005c0)={0x10, 0x0, 0x0, 0x1000}, 0xc, &(0x7f0000000640)={&(0x7f0000000600)={0x2c, r3, 0x2, 0x70bd2d, 0x25dfdbfd, {}, [@IEEE802154_ATTR_CCA_ED_LEVEL={0x8, 0x24, 0x7fffffff}, @IEEE802154_ATTR_TXPOWER={0x5, 0x21, 0x3}, @IEEE802154_ATTR_CSMA_MAX_BE={0x5, 0x27, 0x4}]}, 0x2c}, 0x1, 0x0, 0x0, 0x40801}, 0x40840) r6 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) sendmsg$IEEE802154_LLSEC_DEL_SECLEVEL(r6, &(0x7f00000007c0)={&(0x7f00000006c0)={0x10, 0x0, 0x0, 0x40000000}, 0xc, &(0x7f0000000780)={&(0x7f0000000700)={0x44, r3, 0x300, 0x70bd2a, 0x25dfdbfb, {}, [@IEEE802154_ATTR_DEV_INDEX={0x8, 0x2, r2}, @IEEE802154_ATTR_LLSEC_FRAME_TYPE={0x5, 0x33, 0x1f}, @IEEE802154_ATTR_LLSEC_FRAME_TYPE={0x5, 0x33, 0x7}, @IEEE802154_ATTR_LLSEC_CMD_FRAME_ID={0x5, 0x34, 0xcb}, @IEEE802154_ATTR_LLSEC_DEV_OVERRIDE={0x5, 0x36, 0x1}, @IEEE802154_ATTR_LLSEC_CMD_FRAME_ID={0x5, 0x34, 0x1}]}, 0x44}, 0x1, 0x0, 0x0, 0x40000a1}, 0x4800) r7 = syz_genetlink_get_family_id$ieee802154(&(0x7f0000000840), r6) sendmsg$IEEE802154_LLSEC_DEL_DEV(r6, &(0x7f0000000940)={&(0x7f0000000800)={0x10, 0x0, 0x0, 0x2000}, 0xc, &(0x7f0000000900)={&(0x7f0000000880)={0x6c, r7, 0x100, 0x70bd26, 0x25dfdbfe, {}, [@IEEE802154_ATTR_HW_ADDR={0xc, 0x5, {0xaaaaaaaaaaaa0202}}, @IEEE802154_ATTR_HW_ADDR={0xc, 0x5, {0xaaaaaaaaaaaa0302}}, @IEEE802154_ATTR_DEV_INDEX={0x8, 0x2, r2}, @IEEE802154_ATTR_HW_ADDR={0xc}, @IEEE802154_ATTR_DEV_NAME={0xa, 0x1, 'wpan1\x00'}, @IEEE802154_ATTR_HW_ADDR={0xc, 0x5, {0xaaaaaaaaaaaa0302}}, @IEEE802154_ATTR_HW_ADDR={0xc}, @IEEE802154_ATTR_DEV_INDEX={0x8, 0x2, r2}]}, 0x6c}, 0x1, 0x0, 0x0, 0x41}, 0x20004040) ioctl$sock_SIOCGIFINDEX_802154(r5, 0x8933, &(0x7f00000009c0)={'wpan4\x00', 0x0}) ioctl$sock_SIOCGIFINDEX_802154(r5, 0x8933, &(0x7f0000000a00)={'wpan3\x00', 0x0}) sendmsg$IEEE802154_LLSEC_DEL_DEV(r0, &(0x7f0000000b00)={&(0x7f0000000980)={0x10, 0x0, 0x0, 0x1}, 0xc, &(0x7f0000000ac0)={&(0x7f0000000a40)={0x68, r7, 0x100, 0x70bd26, 0x25dfdbfd, {}, [@IEEE802154_ATTR_DEV_INDEX={0x8, 0x2, r8}, @IEEE802154_ATTR_DEV_INDEX={0x8}, @IEEE802154_ATTR_DEV_NAME={0xa, 0x1, 'wpan1\x00'}, @IEEE802154_ATTR_DEV_NAME={0xa, 0x1, 'wpan0\x00'}, @IEEE802154_ATTR_DEV_INDEX={0x8, 0x2, r9}, @IEEE802154_ATTR_HW_ADDR={0xc, 0x5, {0xaaaaaaaaaaaa0202}}, @IEEE802154_ATTR_DEV_INDEX={0x8, 0x2, r2}, @IEEE802154_ATTR_DEV_INDEX={0x8, 0x2, r2}, @IEEE802154_ATTR_DEV_INDEX={0x8, 0x2, r2}]}, 0x68}, 0x1, 0x0, 0x0, 0x20004880}, 0x50) sendmsg$IEEE802154_LLSEC_DEL_KEY(0xffffffffffffffff, &(0x7f0000000c80)={&(0x7f0000000b40)={0x10, 0x0, 0x0, 0x40000000}, 0xc, &(0x7f0000000c40)={&(0x7f0000000bc0)={0x58, 0x0, 0x402, 0x70bd2d, 0x25dfdbff, {}, [@IEEE802154_ATTR_LLSEC_KEY_MODE={0x5, 0x2b, 0x1}, @IEEE802154_ATTR_DEV_NAME={0xa, 0x1, 'wpan3\x00'}, @IEEE802154_ATTR_LLSEC_KEY_SOURCE_EXTENDED={0xc, 0x2d, {0xaaaaaaaaaaaa0302}}, @IEEE802154_ATTR_LLSEC_KEY_ID={0x5, 0x2e, 0x4}, @IEEE802154_ATTR_LLSEC_KEY_ID={0x5, 0x2e, 0x3}, @IEEE802154_ATTR_SHORT_ADDR={0x6, 0x4, 0xfffd}, @IEEE802154_ATTR_HW_ADDR={0xc}]}, 0x58}, 0x1, 0x0, 0x0, 0x40800}, 0x24040000) 00:52:37 executing program 7: r0 = openat$procfs(0xffffffffffffff9c, &(0x7f0000000000)='/proc/mdstat\x00', 0x0, 0x0) mmap$IORING_OFF_CQ_RING(&(0x7f0000ffc000/0x2000)=nil, 0x2000, 0x8, 0x4010, r0, 0x8000000) r1 = openat$cdrom(0xffffffffffffff9c, &(0x7f0000000040), 0xb0840, 0x0) ioctl$CDROM_LOCKDOOR(r1, 0x5329, 0x1) r2 = openat$procfs(0xffffffffffffff9c, &(0x7f0000000080)='/proc/slabinfo\x00', 0x0, 0x0) epoll_ctl$EPOLL_CTL_DEL(r2, 0x2, r0) r3 = fsmount(r2, 0x0, 0x7f) ioctl$CDROMREADMODE1(r3, 0x530d, &(0x7f00000000c0)={0x7, 0x1f, 0x3, 0x81, 0xf3, 0x7b}) mprotect(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x1000008) mmap$IORING_OFF_CQ_RING(&(0x7f0000ffe000/0x1000)=nil, 0x1000, 0x2, 0x80010, r3, 0x8000000) socketpair$nbd(0x1, 0x1, 0x0, &(0x7f0000000d80)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$sock_SIOCGIFINDEX_80211(r5, 0x8933, &(0x7f0000000dc0)={'wlan1\x00'}) r6 = syz_genetlink_get_family_id$batadv(&(0x7f0000000e40), r0) sendmsg$BATADV_CMD_GET_ORIGINATORS(r3, &(0x7f0000000f00)={&(0x7f0000000e00)={0x10, 0x0, 0x0, 0x400000}, 0xc, &(0x7f0000000ec0)={&(0x7f0000000e80)={0x34, r6, 0x2, 0x70bd29, 0x25dfdbff, {}, [@BATADV_ATTR_THROUGHPUT_OVERRIDE={0x8, 0x3b, 0x8}, @BATADV_ATTR_BRIDGE_LOOP_AVOIDANCE_ENABLED={0x5, 0x2e, 0x1}, @BATADV_ATTR_FRAGMENTATION_ENABLED={0x5, 0x30, 0x1}, @BATADV_ATTR_TPMETER_TEST_TIME={0x8, 0xb, 0xfffffffb}]}, 0x34}, 0x1, 0x0, 0x0, 0x20000000}, 0x4000000) ioctl$CDROM_GET_CAPABILITY(0xffffffffffffffff, 0x5331) r7 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r8 = syz_genetlink_get_family_id$nbd(&(0x7f0000000f80), 0xffffffffffffffff) sendmsg$NBD_CMD_RECONFIGURE(r7, &(0x7f0000001040)={&(0x7f0000000f40)={0x10, 0x0, 0x0, 0x4000000}, 0xc, &(0x7f0000001000)={&(0x7f0000000fc0)={0x20, r8, 0x200, 0x70bd2b, 0x25dfdbfb, {}, [@NBD_ATTR_TIMEOUT={0xc, 0x4, 0x1f}]}, 0x20}, 0x1, 0x0, 0x0, 0x20000000}, 0x2004c000) ioctl$sock_SIOCGIFINDEX_80211(r4, 0x8933, &(0x7f0000001080)={'wlan1\x00'}) sendmsg$NBD_CMD_DISCONNECT(r7, &(0x7f00000011c0)={&(0x7f00000010c0)={0x10, 0x0, 0x0, 0x4000}, 0xc, &(0x7f0000001180)={&(0x7f0000001140)={0x20, 0x0, 0x20, 0x70bd25, 0x25dfdbfe, {}, [@NBD_ATTR_BLOCK_SIZE_BYTES={0xc, 0x3, 0x9de}]}, 0x20}, 0x1, 0x0, 0x0, 0x20004000}, 0x200000c5) 00:52:37 executing program 6: ioctl$sock_SIOCGIFINDEX_802154(0xffffffffffffffff, 0x8933, &(0x7f0000000000)={'wpan1\x00', 0x0}) r1 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) ioctl$sock_SIOCGIFINDEX_802154(0xffffffffffffffff, 0x8933, &(0x7f0000000080)={'wpan3\x00', 0x0}) sendmsg$IEEE802154_LLSEC_ADD_SECLEVEL(r1, &(0x7f0000000140)={&(0x7f0000000040)={0x10, 0x0, 0x0, 0x800000}, 0xc, &(0x7f0000000100)={&(0x7f00000000c0)={0x2c, 0x0, 0x400, 0x70bd2a, 0x25dfdbfe, {}, [@IEEE802154_ATTR_DEV_INDEX={0x8, 0x2, r0}, @IEEE802154_ATTR_DEV_INDEX={0x8, 0x2, r0}, @IEEE802154_ATTR_DEV_INDEX={0x8, 0x2, r2}]}, 0x2c}, 0x1, 0x0, 0x0, 0x4004081}, 0x10) sendmsg$IEEE802154_LLSEC_DEL_KEY(r1, &(0x7f0000000240)={&(0x7f0000000180)={0x10, 0x0, 0x0, 0x1000000}, 0xc, &(0x7f0000000200)={&(0x7f00000001c0)={0x3c, 0x0, 0x30e, 0x70bd25, 0x25dfdbfd, {}, [@IEEE802154_ATTR_HW_ADDR={0xc, 0x5, {0xaaaaaaaaaaaa0102}}, @IEEE802154_ATTR_LLSEC_KEY_SOURCE_EXTENDED={0xc, 0x2d, {0xaaaaaaaaaaaa0102}}, @IEEE802154_ATTR_LLSEC_KEY_SOURCE_SHORT={0x8, 0x2c, 0x5}, @IEEE802154_ATTR_DEV_INDEX={0x8}]}, 0x3c}, 0x1, 0x0, 0x0, 0x24041000}, 0x44) socketpair$nbd(0x1, 0x1, 0x0, &(0x7f0000002280)={0xffffffffffffffff}) r4 = openat$procfs(0xffffffffffffff9c, &(0x7f00000022c0)='/proc/asound/seq/clients\x00', 0x0, 0x0) socketpair$nbd(0x1, 0x1, 0x0, &(0x7f0000002300)={0xffffffffffffffff}) r6 = socket(0x1d, 0x3, 0x6) r7 = openat$zero(0xffffffffffffff9c, &(0x7f0000002340), 0x2, 0x0) socketpair$nbd(0x1, 0x1, 0x0, &(0x7f0000002380)={0xffffffffffffffff}) sendmsg$NBD_CMD_DISCONNECT(r1, &(0x7f0000002480)={&(0x7f0000000280)={0x10, 0x0, 0x0, 0x80000}, 0xc, &(0x7f0000002440)={&(0x7f00000023c0)={0x6c, 0x0, 0x400, 0x70bd27, 0x25dfdbfb, {}, [@NBD_ATTR_TIMEOUT={0xc, 0x4, 0x100000001}, @NBD_ATTR_SOCKETS={0x4c, 0x7, 0x0, 0x1, [{0x8, 0x1, r3}, {0x8, 0x1, r4}, {0x8}, {0x8, 0x1, r5}, {0x8}, {0x8, 0x1, r6}, {0x8, 0x1, r7}, {0x8, 0x1, r8}, {0x8}]}]}, 0x6c}, 0x1, 0x0, 0x0, 0x20000000}, 0x4000020) r9 = syz_genetlink_get_family_id$ieee802154(&(0x7f0000002500), r1) sendmsg$IEEE802154_LLSEC_LIST_SECLEVEL(r1, &(0x7f00000025c0)={&(0x7f00000024c0)={0x10, 0x0, 0x0, 0x4}, 0xc, &(0x7f0000002580)={&(0x7f0000002540)={0x14, r9, 0x100, 0x70bd25, 0x25dfdbfd, {}, ["", "", "", "", "", ""]}, 0x14}, 0x1, 0x0, 0x0, 0x11}, 0x20000084) r10 = syz_genetlink_get_family_id$nbd(&(0x7f0000002640), r1) sendmsg$NBD_CMD_RECONFIGURE(r1, &(0x7f0000002700)={&(0x7f0000002600)={0x10, 0x0, 0x0, 0x800}, 0xc, &(0x7f00000026c0)={&(0x7f0000002680)={0x3c, r10, 0x800, 0x70bd2b, 0x25dfdbfe, {}, [@NBD_ATTR_DEAD_CONN_TIMEOUT={0xc, 0x8, 0x9}, @NBD_ATTR_SERVER_FLAGS={0xc, 0x5, 0x8}, @NBD_ATTR_INDEX={0x8, 0x1, 0x0}, @NBD_ATTR_INDEX={0x8, 0x1, 0x0}]}, 0x3c}, 0x1, 0x0, 0x0, 0x4000}, 0x40) r11 = fsmount(r7, 0x0, 0x80) r12 = ioctl$TIOCGPTPEER(r7, 0x5441, 0xe5) ioctl$BINDER_WRITE_READ(r11, 0xc0306201, &(0x7f0000002b40)={0xa8, 0x0, &(0x7f00000029c0)=[@dead_binder_done, @increfs={0x40046304, 0x3}, @exit_looper, @reply={0x40406301, {0x0, 0x0, 0x0, 0x0, 0x10, 0x0, 0x0, 0x60, 0x18, &(0x7f0000002800)={@fd={0x66642a85, 0x0, r12}, @ptr={0x70742a85, 0x1, &(0x7f0000002740)=""/143, 0x8f, 0x1, 0x27}, @fda={0x66646185, 0x6, 0x1, 0x1b}}, &(0x7f0000002880)={0x0, 0x18, 0x40}}}, @transaction={0x40406300, {0x569d, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x68, 0x18, &(0x7f0000002900)={@fda={0x66646185, 0x7, 0x2, 0x30}, @fda={0x66646185, 0x6, 0x1, 0x19}, @ptr={0x70742a85, 0x1, &(0x7f00000028c0)=""/44, 0x2c, 0x0, 0x1e}}, &(0x7f0000002980)={0x0, 0x20, 0x40}}}, @acquire={0x40046305, 0x2}], 0x82, 0x0, &(0x7f0000002a80)="4e9021c002cf1475e76bab6446fcfe48739f863d4b3d42d725bbbe6a107642ceb13288996f73ae1e30314fe22d00559f4252f19f81c3c54f52076ae0f7a10e882089527d696f376f1f742d3eef2232dfa2751900338ab2b2ddb91da97649b15d4a554a941614affc06f845c957db99fe301dad3d757caf42e2327c353388fc1e456f"}) sendmsg$NBD_CMD_CONNECT(r1, &(0x7f0000002cc0)={&(0x7f0000002b80)={0x10, 0x0, 0x0, 0x8}, 0xc, &(0x7f0000002c80)={&(0x7f0000002bc0)={0x88, r10, 0x100, 0x70bd27, 0x25dfdbfd, {}, [@NBD_ATTR_SERVER_FLAGS={0xc, 0x5, 0x104}, @NBD_ATTR_BLOCK_SIZE_BYTES={0xc, 0x3, 0x3}, @NBD_ATTR_SIZE_BYTES={0xc, 0x2, 0x6}, @NBD_ATTR_TIMEOUT={0xc, 0x4, 0x1ff}, @NBD_ATTR_SERVER_FLAGS={0xc, 0x5, 0x1}, @NBD_ATTR_SERVER_FLAGS={0xc, 0x5, 0x104}, @NBD_ATTR_SIZE_BYTES={0xc, 0x2, 0x3}, @NBD_ATTR_INDEX={0x8, 0x1, 0x0}, @NBD_ATTR_CLIENT_FLAGS={0xc, 0x6, 0x1}, @NBD_ATTR_SERVER_FLAGS={0xc, 0x5, 0x104}]}, 0x88}, 0x1, 0x0, 0x0, 0x800}, 0x40000c4) 00:52:37 executing program 3: clone(0x400, &(0x7f0000000000)="2f59adb4fe8bdd18e28d59f811fee00f6e", &(0x7f0000000040), &(0x7f0000000080), &(0x7f00000000c0)="ee4468595a6a9e17d313ddea1158c7520b4ce752e1feceb8bd763f38764fe32d5b11f9842e25fb3843f95d48bcbb676b94dc456e5f562cd49d08bd5ac38eb9d6acfc2fa3928b3de489313465b4bea18ac19b9efcb135738e957c5dfaa38b9755182fa0eb46bac360130ee66e2636e1d6aafb8e5918d6d0f8338603cd9bd3e0f3b5d106eae77f68fc50df9f58fd8061a03c31d04b3551c672a8334c0f3bd81aea189fc02f258c22a8b0dba2a60f9a458d6eff75d32cf215930f0bccd5f8ee1d8d33a86c5eda24ec311adc") ioctl$CDROMREADMODE1(0xffffffffffffffff, 0x530d, &(0x7f00000001c0)={0x8, 0x81, 0x4, 0x1, 0x1, 0x8}) ioctl$CDROMREADRAW(0xffffffffffffffff, 0x5314, &(0x7f0000000c40)={0x1, 0x5, 0x7, 0xe5, 0x2, 0x81}) r0 = openat$zero(0xffffffffffffff9c, &(0x7f00000016c0), 0x0, 0x0) ioctl$CDROMSTART(r0, 0x5308) rt_sigaction(0xf, &(0x7f0000001780)={&(0x7f0000001700)="66430f3a15df22c402d937a80e000000f347241ac44218f34ce000c4a2b528e8db5a2466440f38014fdb660f3810b006a50000c421fc295a0cdcf1", 0x80000004, &(0x7f0000001740)="642e41dde78f684ca2df01416dc463755c460b34f3460fa6c0c4c11b7cc7c442f1ad5b00f0430fab6b000f0f62f79af046f71c54", {[0xfffffffffffffffe]}}, &(0x7f0000001840)={&(0x7f00000017c0)="f240af66e20067363666460ffa6f5136360f974700c48165da31c422050c1ec4c17a6fbb2f000000c4027d2074f407f2430f1a39ff30", 0x0, &(0x7f0000001800)="c462394627defbc401f1d3cac46159de6e1fc4816c58a20700000066430faef2c4c16b7c9f0300000066400f6620f0ff0500000000c4e111d2f9"}, 0x8, &(0x7f0000001880)) timerfd_create(0x9, 0x800) prctl$PR_GET_FPEXC(0xb, &(0x7f00000018c0)) recvmmsg(r0, &(0x7f0000003c40)=[{{&(0x7f0000001900)=@pppol2tp={0x18, 0x1, {0x0, 0xffffffffffffffff, {0x2, 0x0, @empty}}}, 0x80, &(0x7f00000029c0)=[{&(0x7f0000001980)=""/39, 0x27}, {&(0x7f00000019c0)=""/4096, 0x1000}], 0x2, &(0x7f0000002a00)=""/18, 0x12}, 0x3f}, {{&(0x7f0000002a40)=@nfc, 0x80, &(0x7f0000002e80)=[{&(0x7f0000002ac0)=""/44, 0x2c}, {&(0x7f0000002b00)=""/65, 0x41}, {&(0x7f0000002b80)=""/107, 0x6b}, {&(0x7f0000002c00)=""/158, 0x9e}, {&(0x7f0000002cc0)=""/169, 0xa9}, {&(0x7f0000002d80)=""/57, 0x39}, {&(0x7f0000002dc0)=""/160, 0xa0}], 0x7}, 0x6}, {{&(0x7f0000002f00)=@x25={0x9, @remote}, 0x80, &(0x7f0000003100)=[{&(0x7f0000002f80)=""/101, 0x65}, {&(0x7f0000003000)}, {&(0x7f0000003040)=""/187, 0xbb}], 0x3, &(0x7f0000003140)=""/159, 0x9f}, 0xffffffff}, {{&(0x7f0000003200)=@ll={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @dev}, 0x80, &(0x7f0000003400)=[{&(0x7f0000003280)=""/29, 0x1d}, {&(0x7f00000032c0)=""/41, 0x29}, {&(0x7f0000003300)=""/219, 0xdb}], 0x3, &(0x7f0000003440)=""/204, 0xcc}, 0x2f62}, {{&(0x7f0000003540)=@hci, 0x80, &(0x7f0000003b80)=[{&(0x7f00000035c0)=""/168, 0xa8}, {&(0x7f0000003680)=""/128, 0x80}, {&(0x7f0000003700)=""/75, 0x4b}, {&(0x7f0000003780)=""/189, 0xbd}, {&(0x7f0000003840)=""/168, 0xa8}, {&(0x7f0000003900)=""/132, 0x84}, {&(0x7f00000039c0)=""/162, 0xa2}, {&(0x7f0000003a80)=""/198, 0xc6}], 0x8, &(0x7f0000003c00)=""/25, 0x19}, 0xfc00}], 0x5, 0x21, &(0x7f0000003d80)) r2 = socket$netlink(0x10, 0x3, 0xe) syz_genetlink_get_family_id$smc(&(0x7f0000003dc0), r2) timerfd_create(0x6, 0x800) ioctl$BINDER_THREAD_EXIT(r0, 0x40046208, 0x0) epoll_ctl$EPOLL_CTL_MOD(r0, 0x3, r1, &(0x7f0000003e00)={0xb0000000}) r3 = io_uring_setup(0x35ea, &(0x7f0000003e40)={0x0, 0x7cfa, 0x2, 0x0, 0x210, 0x0, r0}) io_uring_setup(0x106d, &(0x7f0000003ec0)={0x0, 0xb36, 0x1e, 0x1, 0xa7, 0x0, r3}) sendmsg$NBD_CMD_STATUS(0xffffffffffffffff, &(0x7f0000004040)={&(0x7f0000003f40)={0x10, 0x0, 0x0, 0x8}, 0xc, &(0x7f0000004000)={&(0x7f0000003f80)={0x6c, 0x0, 0x20, 0x70bd2a, 0x25dfdbff, {}, [@NBD_ATTR_DEAD_CONN_TIMEOUT={0xc, 0x8, 0x68b2}, @NBD_ATTR_SIZE_BYTES={0xc, 0x2, 0x1f}, @NBD_ATTR_SIZE_BYTES={0xc, 0x2, 0x8}, @NBD_ATTR_TIMEOUT={0xc, 0x4, 0x6}, @NBD_ATTR_DEAD_CONN_TIMEOUT={0xc, 0x8, 0x3}, @NBD_ATTR_CLIENT_FLAGS={0xc, 0x6, 0x1}, @NBD_ATTR_INDEX={0x8, 0x1, 0x0}, @NBD_ATTR_INDEX={0x8, 0x1, 0x0}]}, 0x6c}, 0x1, 0x0, 0x0, 0x40840}, 0x10) r4 = syz_genetlink_get_family_id$nbd(&(0x7f00000040c0), 0xffffffffffffffff) r5 = fsmount(r0, 0x0, 0xf0) sendmsg$NBD_CMD_RECONFIGURE(0xffffffffffffffff, &(0x7f00000041c0)={&(0x7f0000004080)={0x10, 0x0, 0x0, 0x2000}, 0xc, &(0x7f0000004180)={&(0x7f0000004140)={0x3c, r4, 0x100, 0x70bd29, 0x25dfdbfd, {}, [@NBD_ATTR_SOCKETS={0x14, 0x7, 0x0, 0x1, [{0x8, 0x1, r5}, {0x8}]}, @NBD_ATTR_INDEX={0x8, 0x1, 0x0}, @NBD_ATTR_SOCKETS={0xc, 0x7, 0x0, 0x1, [{0x8, 0x1, r0}]}]}, 0x3c}, 0x1, 0x0, 0x0, 0x810}, 0x40000) 00:52:37 executing program 5: prctl$PR_GET_FPEXC(0xb, &(0x7f0000000000)) r0 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000040)='./binderfs/custom0\x00', 0x800, 0x0) ustat(0x800, &(0x7f0000000080)) ioctl$ifreq_SIOCGIFINDEX_batadv_mesh(0xffffffffffffffff, 0x8933, &(0x7f0000000100)={'batadv0\x00', 0x0}) ioctl$ifreq_SIOCGIFINDEX_batadv_hard(0xffffffffffffffff, 0x8933, &(0x7f0000000140)={'batadv_slave_0\x00', 0x0}) sendmsg$ETHTOOL_MSG_PAUSE_GET(0xffffffffffffffff, &(0x7f00000002c0)={&(0x7f00000000c0)={0x10, 0x0, 0x0, 0x10000}, 0xc, &(0x7f0000000280)={&(0x7f0000000180)={0xdc, 0x0, 0x8, 0x70bd27, 0x25dfdbfb, {}, [@HEADER={0x5c, 0x1, 0x0, 0x1, [@ETHTOOL_A_HEADER_DEV_INDEX={0x8, 0x1, r1}, @ETHTOOL_A_HEADER_FLAGS={0x8}, @ETHTOOL_A_HEADER_DEV_NAME={0x14, 0x2, 'veth0_vlan\x00'}, @ETHTOOL_A_HEADER_DEV_INDEX={0x8}, @ETHTOOL_A_HEADER_FLAGS={0x8, 0x3, 0x3}, @ETHTOOL_A_HEADER_FLAGS={0x8, 0x3, 0x2}, @ETHTOOL_A_HEADER_DEV_INDEX={0x8, 0x1, r2}, @ETHTOOL_A_HEADER_DEV_NAME={0x14, 0x2, 'macvlan0\x00'}]}, @HEADER={0x40, 0x1, 0x0, 0x1, [@ETHTOOL_A_HEADER_DEV_NAME={0x14, 0x2, 'veth0_to_bridge\x00'}, @ETHTOOL_A_HEADER_DEV_NAME={0x14, 0x2, 'veth0_to_bridge\x00'}, @ETHTOOL_A_HEADER_DEV_NAME={0x14, 0x2, 'netpci0\x00'}]}, @HEADER={0x2c, 0x1, 0x0, 0x1, [@ETHTOOL_A_HEADER_DEV_NAME={0x14, 0x2, 'bond_slave_1\x00'}, @ETHTOOL_A_HEADER_DEV_NAME={0x14, 0x2, 'ip_vti0\x00'}]}]}, 0xdc}, 0x1, 0x0, 0x0, 0x4000}, 0x24000000) sendmsg$NBD_CMD_STATUS(0xffffffffffffffff, &(0x7f0000000400)={&(0x7f0000000300)={0x10, 0x0, 0x0, 0x4}, 0xc, &(0x7f00000003c0)={&(0x7f0000000340)={0x44, 0x0, 0x20, 0x70bd2d, 0x25dfdbfc, {}, [@NBD_ATTR_SIZE_BYTES={0xc, 0x2, 0x4}, @NBD_ATTR_SOCKETS={0x24, 0x7, 0x0, 0x1, [{0x8}, {0x8}, {0x8}, {0x8}]}]}, 0x44}}, 0x4000) ioctl$BINDER_GET_NODE_DEBUG_INFO(r0, 0xc018620b, &(0x7f0000000440)={0x3}) syz_genetlink_get_family_id$batadv(&(0x7f0000000480), 0xffffffffffffffff) r3 = syz_open_dev$ttys(0xc, 0x2, 0x0) ioctl$TCSETAF(r3, 0x5408, &(0x7f00000004c0)={0x4, 0xb073, 0x1000, 0x1, 0x13, "b786e10fbdab60cc"}) openat$binderfs(0xffffffffffffff9c, &(0x7f0000000500)='./binderfs2/binder0\x00', 0x802, 0x0) sendmsg$BATADV_CMD_SET_VLAN(0xffffffffffffffff, &(0x7f0000000600)={&(0x7f0000000540)={0x10, 0x0, 0x0, 0x80000}, 0xc, &(0x7f00000005c0)={&(0x7f0000000580)={0x30, 0x0, 0x400, 0x70bd27, 0x25dfdbfb, {}, [@BATADV_ATTR_FRAGMENTATION_ENABLED={0x5, 0x30, 0x1}, @BATADV_ATTR_ORIG_ADDRESS={0xa, 0x9, @random="62836be88da6"}, @BATADV_ATTR_ISOLATION_MASK={0x8, 0x2c, 0x81}]}, 0x30}, 0x1, 0x0, 0x0, 0x8004}, 0x4c000) r4 = syz_open_dev$ttys(0xc, 0x2, 0x0) ioctl$TIOCEXCL(r4, 0x540c) r5 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) sendmsg$IEEE802154_LLSEC_GETPARAMS(r5, &(0x7f0000000740)={&(0x7f0000000640)={0x10, 0x0, 0x0, 0x8000000}, 0xc, &(0x7f0000000700)={&(0x7f0000000680)={0x48, 0x0, 0x4, 0x70bd28, 0x25dfdbfd, {}, [@IEEE802154_ATTR_DEV_INDEX={0x8}, @IEEE802154_ATTR_DEV_NAME={0xa, 0x1, 'wpan3\x00'}, @IEEE802154_ATTR_DEV_NAME={0xa, 0x1, 'wpan4\x00'}, @IEEE802154_ATTR_DEV_NAME={0xa, 0x1, 'wpan1\x00'}, @IEEE802154_ATTR_DEV_INDEX={0x8}]}, 0x48}, 0x1, 0x0, 0x0, 0x4000}, 0x20000080) sendmsg$IEEE802154_START_REQ(r5, &(0x7f0000000840)={&(0x7f0000000780)={0x10, 0x0, 0x0, 0x1000}, 0xc, &(0x7f0000000800)={&(0x7f00000007c0)={0x2c, 0x0, 0x400, 0x70bd2b, 0x25dfdbfb, {}, [@IEEE802154_ATTR_BAT_EXT={0x5, 0x1a, 0x94}, @IEEE802154_ATTR_PAGE={0x5, 0x1d, 0x13}, @IEEE802154_ATTR_COORD_SHORT_ADDR={0x6, 0x8, 0xaaa0}]}, 0x2c}, 0x1, 0x0, 0x0, 0x20000050}, 0x14) clone(0x28000800, &(0x7f0000000880)="b3f828035cfe9f8546c65ee8fffa58fb52d9bafabf363f0161cf01b4a2872006d34dcf860667a59d8c5631820a98c05b3989c5037ea89b5a58e8e9809cc008c7ae03db6bb845b2c189e79729a6d2c9a5440c276c7d0686adda809621c1d9723369157389ff141a56cbc54111ec7f92e8262b0c9ab88b9bffbb114333ab5a9711171c09e2589351fa4950d7af92bccf71585c21606994d6b4443d2cb6725d2c983a62f6f0", &(0x7f0000000940), &(0x7f0000000980), &(0x7f00000009c0)="073c516951c56a5fb1d10f1151ef77ee30e71fea92d34f29ddbe9265f84a8e761f6f56055bef1048f67ec1da822c677e9c34d5d52feb791c13c75661003151c2a956098cc6") sendmsg$ETHTOOL_MSG_LINKMODES_GET(0xffffffffffffffff, &(0x7f0000000c80)={&(0x7f0000000a40)={0x10, 0x0, 0x0, 0x100000}, 0xc, &(0x7f0000000c40)={&(0x7f0000000b40)={0xf4, 0x0, 0x8, 0x70bd25, 0x25dfdbfb, {}, [@HEADER={0x4c, 0x1, 0x0, 0x1, [@ETHTOOL_A_HEADER_FLAGS={0x8, 0x3, 0xdadbe43a496bc96b}, @ETHTOOL_A_HEADER_FLAGS={0x8, 0x3, 0x3}, @ETHTOOL_A_HEADER_DEV_INDEX={0x8}, @ETHTOOL_A_HEADER_FLAGS={0x8, 0x3, 0x2}, @ETHTOOL_A_HEADER_DEV_NAME={0x14, 0x2, 'sit0\x00'}, @ETHTOOL_A_HEADER_DEV_NAME={0x14, 0x2, 'erspan0\x00'}]}, @HEADER={0x2c, 0x1, 0x0, 0x1, [@ETHTOOL_A_HEADER_FLAGS={0x8, 0x3, 0x1}, @ETHTOOL_A_HEADER_FLAGS={0x8}, @ETHTOOL_A_HEADER_FLAGS={0x8, 0x3, 0x7}, @ETHTOOL_A_HEADER_FLAGS={0x8, 0x3, 0x3}, @ETHTOOL_A_HEADER_FLAGS={0x8}]}, @HEADER={0x68, 0x1, 0x0, 0x1, [@ETHTOOL_A_HEADER_FLAGS={0x8, 0x3, 0x3}, @ETHTOOL_A_HEADER_DEV_NAME={0x14, 0x2, 'vlan0\x00'}, @ETHTOOL_A_HEADER_DEV_NAME={0x14, 0x2, 'veth0_to_bond\x00'}, @ETHTOOL_A_HEADER_FLAGS={0x8}, @ETHTOOL_A_HEADER_FLAGS={0x8, 0x3, 0x2}, @ETHTOOL_A_HEADER_DEV_INDEX={0x8, 0x1, r2}, @ETHTOOL_A_HEADER_DEV_INDEX={0x8}, @ETHTOOL_A_HEADER_DEV_NAME={0x14, 0x2, 'bond_slave_1\x00'}]}]}, 0xf4}, 0x1, 0x0, 0x0, 0x4800}, 0x800) 00:52:37 executing program 2: r0 = fsmount(0xffffffffffffffff, 0x1, 0x2) r1 = fsmount(r0, 0x1, 0x7c) fsconfig$FSCONFIG_CMD_CREATE(r1, 0x6, 0x0, 0x0, 0x0) r2 = fsmount(r0, 0x0, 0x8) ioctl$CDROMREADCOOKED(r2, 0x5315, &(0x7f0000000000)) sendmsg$IPSET_CMD_HEADER(r0, &(0x7f0000000b40)={&(0x7f0000000a80)={0x10, 0x0, 0x0, 0x1000000}, 0xc, &(0x7f0000000b00)={&(0x7f0000000ac0)={0x28, 0xc, 0x6, 0x801, 0x0, 0x0, {0xf, 0x0, 0xa}, [@IPSET_ATTR_PROTOCOL={0x5}, @IPSET_ATTR_SETNAME={0x9, 0x2, 'syz2\x00'}]}, 0x28}, 0x1, 0x0, 0x0, 0x4000881}, 0x10) r3 = openat$zero(0xffffffffffffff9c, &(0x7f0000000b80), 0x0, 0x0) mmap$binder(&(0x7f0000fff000/0x1000)=nil, 0x1000, 0x1, 0x11, r3, 0x358f) ioctl$TIOCGICOUNT(r3, 0x545d, 0x0) ioctl$HIDIOCGPHYS(r2, 0x80404812, &(0x7f0000000bc0)) ioctl$CDROMVOLCTRL(r3, 0x530a, &(0x7f0000000c00)={0x1, 0xc0, 0x9, 0x40}) r4 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPSET_CMD_HEADER(r4, &(0x7f0000000d40)={&(0x7f0000000c40)={0x10, 0x0, 0x0, 0x80000}, 0xc, &(0x7f0000000d00)={&(0x7f0000000c80)={0x48, 0xc, 0x6, 0x101, 0x0, 0x0, {0x5, 0x0, 0x9}, [@IPSET_ATTR_PROTOCOL={0x5}, @IPSET_ATTR_PROTOCOL={0x5}, @IPSET_ATTR_SETNAME={0x9, 0x2, 'syz2\x00'}, @IPSET_ATTR_PROTOCOL={0x5}, @IPSET_ATTR_PROTOCOL={0x5}, @IPSET_ATTR_PROTOCOL={0x5}]}, 0x48}, 0x1, 0x0, 0x0, 0x10}, 0x0) openat$binderfs(0xffffffffffffff9c, &(0x7f0000000d80)='./binderfs2/custom0\x00', 0x1, 0x0) r5 = openat$procfs(0xffffffffffffff9c, &(0x7f0000000dc0)='/proc/cpuinfo\x00', 0x0, 0x0) fsmount(r5, 0x1, 0x2) ioctl$TIOCSERGETLSR(r1, 0x5459, &(0x7f0000000e00)) r6 = syz_open_dev$tty1(0xc, 0x4, 0x3) ioctl$TIOCGPTLCK(r6, 0x80045439, &(0x7f0000000e40)) openat$ttyS3(0xffffffffffffff9c, &(0x7f0000000e80), 0x4a80, 0x0) 00:52:37 executing program 4: r0 = openat$ttyS3(0xffffffffffffff9c, &(0x7f0000000000), 0xa2000, 0x0) ioctl$TIOCSETD(r0, 0x5423, &(0x7f0000000040)=0x13) r1 = fsmount(0xffffffffffffffff, 0x1, 0x76) ioctl$TCSETAF(r1, 0x5408, &(0x7f0000000080)={0x5, 0x8001, 0x4, 0x8001, 0x15, "b45da66f02087ca7"}) ioctl$TCSETAF(r1, 0x5408, &(0x7f00000000c0)={0x5, 0x22c1, 0x800, 0x8, 0x5, "2b8c058f839aaa67"}) connect$netlink(r1, &(0x7f0000000100)=@proc={0x10, 0x0, 0x25dfdbfd, 0x2}, 0xc) r2 = syz_open_dev$tty1(0xc, 0x4, 0x4) ioctl$TCSETSF(r2, 0x5404, &(0x7f0000000140)={0x6, 0x2, 0x2, 0x80000001, 0x1b, "c2331e6388ffeb48419d467a4b791ad4343a96"}) ioctl$TIOCMGET(r1, 0x5415, &(0x7f0000000180)) ioctl$TCSETAF(r2, 0x5408, &(0x7f00000001c0)={0x11, 0x0, 0xfff, 0x7, 0xd, "3ae59dd65d54337c"}) r3 = timerfd_create(0x7, 0x800) timerfd_settime(r3, 0x1, &(0x7f0000000200), &(0x7f0000000240)) ioctl$TCSETAF(r2, 0x5408, &(0x7f0000000280)={0x1, 0x1, 0x3d4c, 0x200, 0x0, "73a709364d80b6c1"}) ioctl$PIO_UNIMAPCLR(0xffffffffffffffff, 0x4b68, &(0x7f00000002c0)={0x73, 0x1fe0, 0x8b}) ioctl$TCSETSF2(r2, 0x402c542d, &(0x7f0000000300)={0xffffffff, 0x0, 0x80000000, 0x9, 0x6, "35157e2ff53385c0969535964d148320e065e8", 0x6}) ioctl$KDGKBMETA(0xffffffffffffffff, 0x4b62, &(0x7f0000000340)) ioctl$TIOCGICOUNT(r2, 0x545d, 0x0) socket(0x16, 0x1, 0x9) sendmsg$IEEE802154_LLSEC_DEL_KEY(0xffffffffffffffff, &(0x7f0000000440)={&(0x7f0000000380)={0x10, 0x0, 0x0, 0x10000}, 0xc, &(0x7f0000000400)={&(0x7f00000003c0)={0x38, 0x0, 0x10, 0x70bd2d, 0x25dfdbfe, {}, [@IEEE802154_ATTR_DEV_NAME={0xa, 0x1, 'wpan4\x00'}, @IEEE802154_ATTR_DEV_NAME={0xa, 0x1, 'wpan3\x00'}, @IEEE802154_ATTR_LLSEC_KEY_SOURCE_EXTENDED={0xc, 0x2d, {0xaaaaaaaaaaaa0302}}]}, 0x38}}, 0xc008) sendmsg$NL802154_CMD_SET_ACKREQ_DEFAULT(0xffffffffffffffff, &(0x7f0000000540)={&(0x7f0000000480)={0x10, 0x0, 0x0, 0x40}, 0xc, &(0x7f0000000500)={&(0x7f00000004c0)={0x28, 0x0, 0x800, 0x70bd28, 0x25dfdbfc, {}, [@NL802154_ATTR_WPAN_DEV={0xc, 0x6, 0x300000003}, @NL802154_ATTR_IFINDEX={0x8}]}, 0x28}, 0x1, 0x0, 0x0, 0x40}, 0x48080) 00:52:37 executing program 1: r0 = openat$zero(0xffffffffffffff9c, &(0x7f0000000000), 0x400200, 0x0) ioctl$SECCOMP_IOCTL_NOTIF_ADDFD(r0, 0x40182103, &(0x7f0000000040)={0x0, 0x1, 0xffffffffffffffff, 0x80000000, 0x80000}) r1 = syz_genetlink_get_family_id$batadv(&(0x7f00000000c0), r0) sendmsg$BATADV_CMD_GET_TRANSTABLE_LOCAL(r0, &(0x7f00000001c0)={&(0x7f0000000080)={0x10, 0x0, 0x0, 0x80000}, 0xc, &(0x7f0000000180)={&(0x7f0000000100)={0x54, r1, 0x200, 0x70bd25, 0x25dfdbff, {}, [@BATADV_ATTR_THROUGHPUT_OVERRIDE={0x8, 0x3b, 0x89}, @BATADV_ATTR_THROUGHPUT_OVERRIDE={0x8, 0x3b, 0xffff}, @BATADV_ATTR_FRAGMENTATION_ENABLED={0x5}, @BATADV_ATTR_AGGREGATED_OGMS_ENABLED={0x5}, @BATADV_ATTR_MULTICAST_FORCEFLOOD_ENABLED={0x5}, @BATADV_ATTR_BRIDGE_LOOP_AVOIDANCE_ENABLED={0x5}, @BATADV_ATTR_HARD_IFINDEX={0x8}, @BATADV_ATTR_GW_MODE={0x5, 0x33, 0x1}]}, 0x54}, 0x1, 0x0, 0x0, 0x48041}, 0x4840) r2 = openat$procfs(0xffffffffffffff9c, &(0x7f0000000200)='/proc/cpuinfo\x00', 0x0, 0x0) sendmsg$BATADV_CMD_GET_GATEWAYS(r2, &(0x7f0000000340)={&(0x7f0000000240)={0x10, 0x0, 0x0, 0x1000000}, 0xc, &(0x7f0000000300)={&(0x7f0000000280)={0x50, r1, 0x400, 0x70bd26, 0x25dfdbfb, {}, [@BATADV_ATTR_BRIDGE_LOOP_AVOIDANCE_ENABLED={0x5, 0x2e, 0x1}, @BATADV_ATTR_ISOLATION_MARK={0x8, 0x2b, 0x3}, @BATADV_ATTR_BONDING_ENABLED={0x5}, @BATADV_ATTR_BRIDGE_LOOP_AVOIDANCE_ENABLED={0x5, 0x2e, 0x1}, @BATADV_ATTR_ORIG_ADDRESS={0xa, 0x9, @multicast}, @BATADV_ATTR_THROUGHPUT_OVERRIDE={0x8, 0x3b, 0x1}, @BATADV_ATTR_ISOLATION_MARK={0x8, 0x2b, 0x6}]}, 0x50}, 0x1, 0x0, 0x0, 0x20049800}, 0x80) r3 = syz_genetlink_get_family_id$batadv(&(0x7f00000003c0), r0) sendmsg$BATADV_CMD_SET_MESH(r0, &(0x7f0000000480)={&(0x7f0000000380)={0x10, 0x0, 0x0, 0x1000}, 0xc, &(0x7f0000000440)={&(0x7f0000000400)={0x34, r3, 0x400, 0x70bd2d, 0x25dfdbff, {}, [@BATADV_ATTR_GW_MODE={0x5}, @BATADV_ATTR_GW_BANDWIDTH_UP={0x8, 0x32, 0x8001}, @BATADV_ATTR_ORIG_INTERVAL={0x8, 0x39, 0x4}, @BATADV_ATTR_NETWORK_CODING_ENABLED={0x5, 0x38, 0x1}]}, 0x34}, 0x1, 0x0, 0x0, 0x4000000}, 0x18000) r4 = fsmount(r0, 0x1, 0x5) r5 = fsmount(r2, 0x1, 0x7a) epoll_ctl$EPOLL_CTL_ADD(r4, 0x1, r5, &(0x7f00000016c0)={0x80002000}) r6 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000001700), 0x111002, 0x0) epoll_ctl$EPOLL_CTL_MOD(r0, 0x3, r6, &(0x7f0000001740)) ioctl$SECCOMP_IOCTL_NOTIF_ID_VALID(r5, 0x40082102, &(0x7f0000001780)) rt_sigqueueinfo(0xffffffffffffffff, 0x2, &(0x7f00000017c0)={0x16, 0x5, 0x8}) ioctl$BINDER_SET_MAX_THREADS(r4, 0x40046205, &(0x7f0000001840)=0x4) r7 = syz_genetlink_get_family_id$ieee802154(&(0x7f00000018c0), 0xffffffffffffffff) sendmsg$IEEE802154_ASSOCIATE_RESP(0xffffffffffffffff, &(0x7f00000019c0)={&(0x7f0000001880)={0x10, 0x0, 0x0, 0x10}, 0xc, &(0x7f0000001980)={&(0x7f0000001900)={0x48, r7, 0x400, 0x70bd26, 0x25dfdbfc, {}, [@IEEE802154_ATTR_COORD_HW_ADDR={0xc, 0x9, {0x5555555555540004}}, @IEEE802154_ATTR_COORD_HW_ADDR={0xc, 0x9, {0xaaaaaaaaaaaa0302}}, @IEEE802154_ATTR_COORD_HW_ADDR={0xc, 0x9, {0xaaaaaaaaaaaa0002}}, @IEEE802154_ATTR_STATUS={0x5, 0x3, 0x88}, @IEEE802154_ATTR_STATUS={0x5, 0x3, 0x3}]}, 0x48}, 0x1, 0x0, 0x0, 0x800}, 0x810) ioctl$SECCOMP_IOCTL_NOTIF_ID_VALID(r0, 0x40082102, &(0x7f0000001a00)) sendmsg$SMC_PNETID_FLUSH(r5, &(0x7f0000001b80)={&(0x7f0000001a40)={0x10, 0x0, 0x0, 0x80000}, 0xc, &(0x7f0000001b40)={&(0x7f0000001ac0)={0x7c, 0x0, 0x8, 0x70bd2d, 0x25dfdbfb, {}, [@SMC_PNETID_IBPORT={0x5, 0x4, 0x2}, @SMC_PNETID_NAME={0x9, 0x1, 'syz2\x00'}, @SMC_PNETID_IBNAME={0x9, 0x3, 'syz0\x00'}, @SMC_PNETID_ETHNAME={0x14, 0x2, 'wg2\x00'}, @SMC_PNETID_NAME={0x9, 0x1, 'syz2\x00'}, @SMC_PNETID_ETHNAME={0x14, 0x2, 'veth1_macvtap\x00'}, @SMC_PNETID_IBPORT={0x5, 0x4, 0x2}, @SMC_PNETID_IBNAME={0x9, 0x3, 'syz0\x00'}]}, 0x7c}, 0x1, 0x0, 0x0, 0x20000040}, 0x20000800) 00:52:37 executing program 0: r0 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$ieee802154(&(0x7f0000000040), 0xffffffffffffffff) ioctl$sock_SIOCGIFINDEX_802154(0xffffffffffffffff, 0x8933, &(0x7f0000000080)={'wpan0\x00', 0x0}) sendmsg$IEEE802154_LLSEC_DEL_DEVKEY(r0, &(0x7f0000000140)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x2000000}, 0xc, &(0x7f0000000100)={&(0x7f00000000c0)={0x38, r1, 0x2, 0x70bd27, 0x25dfdbfb, {}, [@IEEE802154_ATTR_LLSEC_KEY_SOURCE_SHORT={0x8, 0x2c, 0xee0}, @IEEE802154_ATTR_PAN_ID={0x6, 0x6, 0xffff}, @IEEE802154_ATTR_DEV_INDEX={0x8, 0x2, r2}, @IEEE802154_ATTR_LLSEC_KEY_SOURCE_EXTENDED={0xc, 0x2d, {0xaaaaaaaaaaaa0002}}]}, 0x38}}, 0x4) r3 = syz_genetlink_get_family_id$ieee802154(&(0x7f00000001c0), r0) sendmsg$IEEE802154_LLSEC_ADD_KEY(r0, &(0x7f00000002c0)={&(0x7f0000000180)={0x10, 0x0, 0x0, 0x80}, 0xc, &(0x7f0000000280)={&(0x7f0000000200)={0x70, r3, 0x8dc3595b298c372b, 0x70bd2c, 0x25dfdbfd, {}, [@IEEE802154_ATTR_HW_ADDR={0xc, 0x5, {0xaaaaaaaaaaaa0302}}, @IEEE802154_ATTR_LLSEC_KEY_SOURCE_EXTENDED={0xc, 0x2d, {0xaaaaaaaaaaaa0202}}, @IEEE802154_ATTR_HW_ADDR={0xc, 0x5, {0xaaaaaaaaaaaa0002}}, @IEEE802154_ATTR_LLSEC_KEY_USAGE_FRAME_TYPES={0x5, 0x31, 0x81}, @IEEE802154_ATTR_DEV_NAME={0xa, 0x1, 'wpan1\x00'}, @IEEE802154_ATTR_LLSEC_KEY_USAGE_COMMANDS={0x24, 0x32, "c38d2be0aa0107a2b38f85915a757ba51ff3d89ac2e1c596dce3055b00418226"}]}, 0x70}, 0x1, 0x0, 0x0, 0x20004040}, 0x0) r4 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) sendmsg$IEEE802154_ASSOCIATE_RESP(r4, &(0x7f0000000400)={&(0x7f0000000300)={0x10, 0x0, 0x0, 0x2000000}, 0xc, &(0x7f00000003c0)={&(0x7f0000000340)={0x60, r3, 0x200, 0x70bd26, 0x25dfdbfd, {}, [@IEEE802154_ATTR_COORD_HW_ADDR={0xc}, @IEEE802154_ATTR_STATUS={0x5, 0x3, 0x40}, @IEEE802154_ATTR_STATUS={0x5, 0x3, 0x1}, @IEEE802154_ATTR_COORD_HW_ADDR={0xc, 0x9, {0x2c841fbeb2fffbec}}, @IEEE802154_ATTR_COORD_HW_ADDR={0xc, 0x9, {0xaaaaaaaaaaaa0202}}, @IEEE802154_ATTR_STATUS={0x5, 0x3, 0x6}, @IEEE802154_ATTR_STATUS={0x5, 0x3, 0x3f}, @IEEE802154_ATTR_COORD_SHORT_ADDR={0x6, 0x8, 0xffff}]}, 0x60}, 0x1, 0x0, 0x0, 0x20000000}, 0x20000080) ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, &(0x7f0000000540)={0xc, 0x0, &(0x7f0000000440)=[@dead_binder_done], 0xbf, 0x0, &(0x7f0000000480)="0537636f85beafebd2a00648fb042246bcbd2150d45e58acedd2718aaa529794fc45c87c914f2b69b82fedb220d6a94b2babd3f188631b48d025c32a8342250d69582838e7ee6d22fa335ce4315412805f50869d3f4bef11a5bb26ac3704b717f9416fc1f441d5dd77d4b3c1a283f3179a7daf20c0d30210361ea15f09fd38e2c2ac52383e1685a787783f4524fd7d784046605442e441fb76b236455574d7fe70d1885d924099864313d8d3d84c106a36d2ccc77c51d3cdaf3f716551fc0a"}) r5 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) syz_genetlink_get_family_id$ieee802154(&(0x7f0000000580), r5) sendmsg$IEEE802154_SET_MACPARAMS(r0, &(0x7f0000000680)={&(0x7f00000005c0)={0x10, 0x0, 0x0, 0x1000}, 0xc, &(0x7f0000000640)={&(0x7f0000000600)={0x2c, r3, 0x2, 0x70bd2d, 0x25dfdbfd, {}, [@IEEE802154_ATTR_CCA_ED_LEVEL={0x8, 0x24, 0x7fffffff}, @IEEE802154_ATTR_TXPOWER={0x5, 0x21, 0x3}, @IEEE802154_ATTR_CSMA_MAX_BE={0x5, 0x27, 0x4}]}, 0x2c}, 0x1, 0x0, 0x0, 0x40801}, 0x40840) r6 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) sendmsg$IEEE802154_LLSEC_DEL_SECLEVEL(r6, &(0x7f00000007c0)={&(0x7f00000006c0)={0x10, 0x0, 0x0, 0x40000000}, 0xc, &(0x7f0000000780)={&(0x7f0000000700)={0x44, r3, 0x300, 0x70bd2a, 0x25dfdbfb, {}, [@IEEE802154_ATTR_DEV_INDEX={0x8, 0x2, r2}, @IEEE802154_ATTR_LLSEC_FRAME_TYPE={0x5, 0x33, 0x1f}, @IEEE802154_ATTR_LLSEC_FRAME_TYPE={0x5, 0x33, 0x7}, @IEEE802154_ATTR_LLSEC_CMD_FRAME_ID={0x5, 0x34, 0xcb}, @IEEE802154_ATTR_LLSEC_DEV_OVERRIDE={0x5, 0x36, 0x1}, @IEEE802154_ATTR_LLSEC_CMD_FRAME_ID={0x5, 0x34, 0x1}]}, 0x44}, 0x1, 0x0, 0x0, 0x40000a1}, 0x4800) r7 = syz_genetlink_get_family_id$ieee802154(&(0x7f0000000840), r6) sendmsg$IEEE802154_LLSEC_DEL_DEV(r6, &(0x7f0000000940)={&(0x7f0000000800)={0x10, 0x0, 0x0, 0x2000}, 0xc, &(0x7f0000000900)={&(0x7f0000000880)={0x6c, r7, 0x100, 0x70bd26, 0x25dfdbfe, {}, [@IEEE802154_ATTR_HW_ADDR={0xc, 0x5, {0xaaaaaaaaaaaa0202}}, @IEEE802154_ATTR_HW_ADDR={0xc, 0x5, {0xaaaaaaaaaaaa0302}}, @IEEE802154_ATTR_DEV_INDEX={0x8, 0x2, r2}, @IEEE802154_ATTR_HW_ADDR={0xc}, @IEEE802154_ATTR_DEV_NAME={0xa, 0x1, 'wpan1\x00'}, @IEEE802154_ATTR_HW_ADDR={0xc, 0x5, {0xaaaaaaaaaaaa0302}}, @IEEE802154_ATTR_HW_ADDR={0xc}, @IEEE802154_ATTR_DEV_INDEX={0x8, 0x2, r2}]}, 0x6c}, 0x1, 0x0, 0x0, 0x41}, 0x20004040) ioctl$sock_SIOCGIFINDEX_802154(r5, 0x8933, &(0x7f00000009c0)={'wpan4\x00', 0x0}) ioctl$sock_SIOCGIFINDEX_802154(r5, 0x8933, &(0x7f0000000a00)={'wpan3\x00', 0x0}) sendmsg$IEEE802154_LLSEC_DEL_DEV(r0, &(0x7f0000000b00)={&(0x7f0000000980)={0x10, 0x0, 0x0, 0x1}, 0xc, &(0x7f0000000ac0)={&(0x7f0000000a40)={0x68, r7, 0x100, 0x70bd26, 0x25dfdbfd, {}, [@IEEE802154_ATTR_DEV_INDEX={0x8, 0x2, r8}, @IEEE802154_ATTR_DEV_INDEX={0x8}, @IEEE802154_ATTR_DEV_NAME={0xa, 0x1, 'wpan1\x00'}, @IEEE802154_ATTR_DEV_NAME={0xa, 0x1, 'wpan0\x00'}, @IEEE802154_ATTR_DEV_INDEX={0x8, 0x2, r9}, @IEEE802154_ATTR_HW_ADDR={0xc, 0x5, {0xaaaaaaaaaaaa0202}}, @IEEE802154_ATTR_DEV_INDEX={0x8, 0x2, r2}, @IEEE802154_ATTR_DEV_INDEX={0x8, 0x2, r2}, @IEEE802154_ATTR_DEV_INDEX={0x8, 0x2, r2}]}, 0x68}, 0x1, 0x0, 0x0, 0x20004880}, 0x50) sendmsg$IEEE802154_LLSEC_DEL_KEY(0xffffffffffffffff, &(0x7f0000000c80)={&(0x7f0000000b40)={0x10, 0x0, 0x0, 0x40000000}, 0xc, &(0x7f0000000c40)={&(0x7f0000000bc0)={0x58, 0x0, 0x402, 0x70bd2d, 0x25dfdbff, {}, [@IEEE802154_ATTR_LLSEC_KEY_MODE={0x5, 0x2b, 0x1}, @IEEE802154_ATTR_DEV_NAME={0xa, 0x1, 'wpan3\x00'}, @IEEE802154_ATTR_LLSEC_KEY_SOURCE_EXTENDED={0xc, 0x2d, {0xaaaaaaaaaaaa0302}}, @IEEE802154_ATTR_LLSEC_KEY_ID={0x5, 0x2e, 0x4}, @IEEE802154_ATTR_LLSEC_KEY_ID={0x5, 0x2e, 0x3}, @IEEE802154_ATTR_SHORT_ADDR={0x6, 0x4, 0xfffd}, @IEEE802154_ATTR_HW_ADDR={0xc}]}, 0x58}, 0x1, 0x0, 0x0, 0x40800}, 0x24040000) 00:52:37 executing program 5: prctl$PR_GET_FPEXC(0xb, &(0x7f0000000000)) r0 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000040)='./binderfs/custom0\x00', 0x800, 0x0) ustat(0x800, &(0x7f0000000080)) ioctl$ifreq_SIOCGIFINDEX_batadv_mesh(0xffffffffffffffff, 0x8933, &(0x7f0000000100)={'batadv0\x00', 0x0}) ioctl$ifreq_SIOCGIFINDEX_batadv_hard(0xffffffffffffffff, 0x8933, &(0x7f0000000140)={'batadv_slave_0\x00', 0x0}) sendmsg$ETHTOOL_MSG_PAUSE_GET(0xffffffffffffffff, &(0x7f00000002c0)={&(0x7f00000000c0)={0x10, 0x0, 0x0, 0x10000}, 0xc, &(0x7f0000000280)={&(0x7f0000000180)={0xdc, 0x0, 0x8, 0x70bd27, 0x25dfdbfb, {}, [@HEADER={0x5c, 0x1, 0x0, 0x1, [@ETHTOOL_A_HEADER_DEV_INDEX={0x8, 0x1, r1}, @ETHTOOL_A_HEADER_FLAGS={0x8}, @ETHTOOL_A_HEADER_DEV_NAME={0x14, 0x2, 'veth0_vlan\x00'}, @ETHTOOL_A_HEADER_DEV_INDEX={0x8}, @ETHTOOL_A_HEADER_FLAGS={0x8, 0x3, 0x3}, @ETHTOOL_A_HEADER_FLAGS={0x8, 0x3, 0x2}, @ETHTOOL_A_HEADER_DEV_INDEX={0x8, 0x1, r2}, @ETHTOOL_A_HEADER_DEV_NAME={0x14, 0x2, 'macvlan0\x00'}]}, @HEADER={0x40, 0x1, 0x0, 0x1, [@ETHTOOL_A_HEADER_DEV_NAME={0x14, 0x2, 'veth0_to_bridge\x00'}, @ETHTOOL_A_HEADER_DEV_NAME={0x14, 0x2, 'veth0_to_bridge\x00'}, @ETHTOOL_A_HEADER_DEV_NAME={0x14, 0x2, 'netpci0\x00'}]}, @HEADER={0x2c, 0x1, 0x0, 0x1, [@ETHTOOL_A_HEADER_DEV_NAME={0x14, 0x2, 'bond_slave_1\x00'}, @ETHTOOL_A_HEADER_DEV_NAME={0x14, 0x2, 'ip_vti0\x00'}]}]}, 0xdc}, 0x1, 0x0, 0x0, 0x4000}, 0x24000000) sendmsg$NBD_CMD_STATUS(0xffffffffffffffff, &(0x7f0000000400)={&(0x7f0000000300)={0x10, 0x0, 0x0, 0x4}, 0xc, &(0x7f00000003c0)={&(0x7f0000000340)={0x44, 0x0, 0x20, 0x70bd2d, 0x25dfdbfc, {}, [@NBD_ATTR_SIZE_BYTES={0xc, 0x2, 0x4}, @NBD_ATTR_SOCKETS={0x24, 0x7, 0x0, 0x1, [{0x8}, {0x8}, {0x8}, {0x8}]}]}, 0x44}}, 0x4000) ioctl$BINDER_GET_NODE_DEBUG_INFO(r0, 0xc018620b, &(0x7f0000000440)={0x3}) syz_genetlink_get_family_id$batadv(&(0x7f0000000480), 0xffffffffffffffff) r3 = syz_open_dev$ttys(0xc, 0x2, 0x0) ioctl$TCSETAF(r3, 0x5408, &(0x7f00000004c0)={0x4, 0xb073, 0x1000, 0x1, 0x13, "b786e10fbdab60cc"}) openat$binderfs(0xffffffffffffff9c, &(0x7f0000000500)='./binderfs2/binder0\x00', 0x802, 0x0) sendmsg$BATADV_CMD_SET_VLAN(0xffffffffffffffff, &(0x7f0000000600)={&(0x7f0000000540)={0x10, 0x0, 0x0, 0x80000}, 0xc, &(0x7f00000005c0)={&(0x7f0000000580)={0x30, 0x0, 0x400, 0x70bd27, 0x25dfdbfb, {}, [@BATADV_ATTR_FRAGMENTATION_ENABLED={0x5, 0x30, 0x1}, @BATADV_ATTR_ORIG_ADDRESS={0xa, 0x9, @random="62836be88da6"}, @BATADV_ATTR_ISOLATION_MASK={0x8, 0x2c, 0x81}]}, 0x30}, 0x1, 0x0, 0x0, 0x8004}, 0x4c000) r4 = syz_open_dev$ttys(0xc, 0x2, 0x0) ioctl$TIOCEXCL(r4, 0x540c) r5 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) sendmsg$IEEE802154_LLSEC_GETPARAMS(r5, &(0x7f0000000740)={&(0x7f0000000640)={0x10, 0x0, 0x0, 0x8000000}, 0xc, &(0x7f0000000700)={&(0x7f0000000680)={0x48, 0x0, 0x4, 0x70bd28, 0x25dfdbfd, {}, [@IEEE802154_ATTR_DEV_INDEX={0x8}, @IEEE802154_ATTR_DEV_NAME={0xa, 0x1, 'wpan3\x00'}, @IEEE802154_ATTR_DEV_NAME={0xa, 0x1, 'wpan4\x00'}, @IEEE802154_ATTR_DEV_NAME={0xa, 0x1, 'wpan1\x00'}, @IEEE802154_ATTR_DEV_INDEX={0x8}]}, 0x48}, 0x1, 0x0, 0x0, 0x4000}, 0x20000080) sendmsg$IEEE802154_START_REQ(r5, &(0x7f0000000840)={&(0x7f0000000780)={0x10, 0x0, 0x0, 0x1000}, 0xc, &(0x7f0000000800)={&(0x7f00000007c0)={0x2c, 0x0, 0x400, 0x70bd2b, 0x25dfdbfb, {}, [@IEEE802154_ATTR_BAT_EXT={0x5, 0x1a, 0x94}, @IEEE802154_ATTR_PAGE={0x5, 0x1d, 0x13}, @IEEE802154_ATTR_COORD_SHORT_ADDR={0x6, 0x8, 0xaaa0}]}, 0x2c}, 0x1, 0x0, 0x0, 0x20000050}, 0x14) clone(0x28000800, &(0x7f0000000880)="b3f828035cfe9f8546c65ee8fffa58fb52d9bafabf363f0161cf01b4a2872006d34dcf860667a59d8c5631820a98c05b3989c5037ea89b5a58e8e9809cc008c7ae03db6bb845b2c189e79729a6d2c9a5440c276c7d0686adda809621c1d9723369157389ff141a56cbc54111ec7f92e8262b0c9ab88b9bffbb114333ab5a9711171c09e2589351fa4950d7af92bccf71585c21606994d6b4443d2cb6725d2c983a62f6f0", &(0x7f0000000940), &(0x7f0000000980), &(0x7f00000009c0)="073c516951c56a5fb1d10f1151ef77ee30e71fea92d34f29ddbe9265f84a8e761f6f56055bef1048f67ec1da822c677e9c34d5d52feb791c13c75661003151c2a956098cc6") 00:52:37 executing program 2: r0 = fsmount(0xffffffffffffffff, 0x1, 0x2) r1 = fsmount(r0, 0x1, 0x7c) fsconfig$FSCONFIG_CMD_CREATE(r1, 0x6, 0x0, 0x0, 0x0) r2 = fsmount(r0, 0x0, 0x8) ioctl$CDROMREADCOOKED(r2, 0x5315, &(0x7f0000000000)) sendmsg$IPSET_CMD_HEADER(r0, &(0x7f0000000b40)={&(0x7f0000000a80)={0x10, 0x0, 0x0, 0x1000000}, 0xc, &(0x7f0000000b00)={&(0x7f0000000ac0)={0x28, 0xc, 0x6, 0x801, 0x0, 0x0, {0xf, 0x0, 0xa}, [@IPSET_ATTR_PROTOCOL={0x5}, @IPSET_ATTR_SETNAME={0x9, 0x2, 'syz2\x00'}]}, 0x28}, 0x1, 0x0, 0x0, 0x4000881}, 0x10) r3 = openat$zero(0xffffffffffffff9c, &(0x7f0000000b80), 0x0, 0x0) mmap$binder(&(0x7f0000fff000/0x1000)=nil, 0x1000, 0x1, 0x11, r3, 0x358f) ioctl$TIOCGICOUNT(r3, 0x545d, 0x0) ioctl$HIDIOCGPHYS(r2, 0x80404812, &(0x7f0000000bc0)) ioctl$CDROMVOLCTRL(r3, 0x530a, &(0x7f0000000c00)={0x1, 0xc0, 0x9, 0x40}) r4 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPSET_CMD_HEADER(r4, &(0x7f0000000d40)={&(0x7f0000000c40)={0x10, 0x0, 0x0, 0x80000}, 0xc, &(0x7f0000000d00)={&(0x7f0000000c80)={0x48, 0xc, 0x6, 0x101, 0x0, 0x0, {0x5, 0x0, 0x9}, [@IPSET_ATTR_PROTOCOL={0x5}, @IPSET_ATTR_PROTOCOL={0x5}, @IPSET_ATTR_SETNAME={0x9, 0x2, 'syz2\x00'}, @IPSET_ATTR_PROTOCOL={0x5}, @IPSET_ATTR_PROTOCOL={0x5}, @IPSET_ATTR_PROTOCOL={0x5}]}, 0x48}, 0x1, 0x0, 0x0, 0x10}, 0x0) openat$binderfs(0xffffffffffffff9c, &(0x7f0000000d80)='./binderfs2/custom0\x00', 0x1, 0x0) r5 = openat$procfs(0xffffffffffffff9c, &(0x7f0000000dc0)='/proc/cpuinfo\x00', 0x0, 0x0) fsmount(r5, 0x1, 0x2) ioctl$TIOCSERGETLSR(r1, 0x5459, &(0x7f0000000e00)) syz_open_dev$tty1(0xc, 0x4, 0x3) openat$ttyS3(0xffffffffffffff9c, &(0x7f0000000e80), 0x4a80, 0x0) 00:52:37 executing program 6: ioctl$sock_SIOCGIFINDEX_802154(0xffffffffffffffff, 0x8933, &(0x7f0000000000)={'wpan1\x00', 0x0}) r1 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) ioctl$sock_SIOCGIFINDEX_802154(0xffffffffffffffff, 0x8933, &(0x7f0000000080)={'wpan3\x00', 0x0}) sendmsg$IEEE802154_LLSEC_ADD_SECLEVEL(r1, &(0x7f0000000140)={&(0x7f0000000040)={0x10, 0x0, 0x0, 0x800000}, 0xc, &(0x7f0000000100)={&(0x7f00000000c0)={0x2c, 0x0, 0x400, 0x70bd2a, 0x25dfdbfe, {}, [@IEEE802154_ATTR_DEV_INDEX={0x8, 0x2, r0}, @IEEE802154_ATTR_DEV_INDEX={0x8, 0x2, r0}, @IEEE802154_ATTR_DEV_INDEX={0x8, 0x2, r2}]}, 0x2c}, 0x1, 0x0, 0x0, 0x4004081}, 0x10) sendmsg$IEEE802154_LLSEC_DEL_KEY(r1, &(0x7f0000000240)={&(0x7f0000000180)={0x10, 0x0, 0x0, 0x1000000}, 0xc, &(0x7f0000000200)={&(0x7f00000001c0)={0x3c, 0x0, 0x30e, 0x70bd25, 0x25dfdbfd, {}, [@IEEE802154_ATTR_HW_ADDR={0xc, 0x5, {0xaaaaaaaaaaaa0102}}, @IEEE802154_ATTR_LLSEC_KEY_SOURCE_EXTENDED={0xc, 0x2d, {0xaaaaaaaaaaaa0102}}, @IEEE802154_ATTR_LLSEC_KEY_SOURCE_SHORT={0x8, 0x2c, 0x5}, @IEEE802154_ATTR_DEV_INDEX={0x8}]}, 0x3c}, 0x1, 0x0, 0x0, 0x24041000}, 0x44) socketpair$nbd(0x1, 0x1, 0x0, &(0x7f0000002280)={0xffffffffffffffff}) r4 = openat$procfs(0xffffffffffffff9c, &(0x7f00000022c0)='/proc/asound/seq/clients\x00', 0x0, 0x0) socketpair$nbd(0x1, 0x1, 0x0, &(0x7f0000002300)={0xffffffffffffffff}) r6 = socket(0x1d, 0x3, 0x6) r7 = openat$zero(0xffffffffffffff9c, &(0x7f0000002340), 0x2, 0x0) socketpair$nbd(0x1, 0x1, 0x0, &(0x7f0000002380)={0xffffffffffffffff}) sendmsg$NBD_CMD_DISCONNECT(r1, &(0x7f0000002480)={&(0x7f0000000280)={0x10, 0x0, 0x0, 0x80000}, 0xc, &(0x7f0000002440)={&(0x7f00000023c0)={0x6c, 0x0, 0x400, 0x70bd27, 0x25dfdbfb, {}, [@NBD_ATTR_TIMEOUT={0xc, 0x4, 0x100000001}, @NBD_ATTR_SOCKETS={0x4c, 0x7, 0x0, 0x1, [{0x8, 0x1, r3}, {0x8, 0x1, r4}, {0x8}, {0x8, 0x1, r5}, {0x8}, {0x8, 0x1, r6}, {0x8, 0x1, r7}, {0x8, 0x1, r8}, {0x8}]}]}, 0x6c}, 0x1, 0x0, 0x0, 0x20000000}, 0x4000020) r9 = syz_genetlink_get_family_id$ieee802154(&(0x7f0000002500), r1) sendmsg$IEEE802154_LLSEC_LIST_SECLEVEL(r1, &(0x7f00000025c0)={&(0x7f00000024c0)={0x10, 0x0, 0x0, 0x4}, 0xc, &(0x7f0000002580)={&(0x7f0000002540)={0x14, r9, 0x100, 0x70bd25, 0x25dfdbfd, {}, ["", "", "", "", "", ""]}, 0x14}, 0x1, 0x0, 0x0, 0x11}, 0x20000084) r10 = syz_genetlink_get_family_id$nbd(&(0x7f0000002640), r1) sendmsg$NBD_CMD_RECONFIGURE(r1, &(0x7f0000002700)={&(0x7f0000002600)={0x10, 0x0, 0x0, 0x800}, 0xc, &(0x7f00000026c0)={&(0x7f0000002680)={0x3c, r10, 0x800, 0x70bd2b, 0x25dfdbfe, {}, [@NBD_ATTR_DEAD_CONN_TIMEOUT={0xc, 0x8, 0x9}, @NBD_ATTR_SERVER_FLAGS={0xc, 0x5, 0x8}, @NBD_ATTR_INDEX={0x8, 0x1, 0x0}, @NBD_ATTR_INDEX={0x8, 0x1, 0x0}]}, 0x3c}, 0x1, 0x0, 0x0, 0x4000}, 0x40) r11 = fsmount(r7, 0x0, 0x80) r12 = ioctl$TIOCGPTPEER(r7, 0x5441, 0xe5) ioctl$BINDER_WRITE_READ(r11, 0xc0306201, &(0x7f0000002b40)={0xa8, 0x0, &(0x7f00000029c0)=[@dead_binder_done, @increfs={0x40046304, 0x3}, @exit_looper, @reply={0x40406301, {0x0, 0x0, 0x0, 0x0, 0x10, 0x0, 0x0, 0x60, 0x18, &(0x7f0000002800)={@fd={0x66642a85, 0x0, r12}, @ptr={0x70742a85, 0x1, &(0x7f0000002740)=""/143, 0x8f, 0x1, 0x27}, @fda={0x66646185, 0x6, 0x1, 0x1b}}, &(0x7f0000002880)={0x0, 0x18, 0x40}}}, @transaction={0x40406300, {0x569d, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x68, 0x18, &(0x7f0000002900)={@fda={0x66646185, 0x7, 0x2, 0x30}, @fda={0x66646185, 0x6, 0x1, 0x19}, @ptr={0x70742a85, 0x1, &(0x7f00000028c0)=""/44, 0x2c, 0x0, 0x1e}}, &(0x7f0000002980)={0x0, 0x20, 0x40}}}, @acquire={0x40046305, 0x2}], 0x82, 0x0, &(0x7f0000002a80)="4e9021c002cf1475e76bab6446fcfe48739f863d4b3d42d725bbbe6a107642ceb13288996f73ae1e30314fe22d00559f4252f19f81c3c54f52076ae0f7a10e882089527d696f376f1f742d3eef2232dfa2751900338ab2b2ddb91da97649b15d4a554a941614affc06f845c957db99fe301dad3d757caf42e2327c353388fc1e456f"}) 00:52:37 executing program 4: r0 = openat$ttyS3(0xffffffffffffff9c, &(0x7f0000000000), 0xa2000, 0x0) ioctl$TIOCSETD(r0, 0x5423, &(0x7f0000000040)=0x13) r1 = fsmount(0xffffffffffffffff, 0x1, 0x76) ioctl$TCSETAF(r1, 0x5408, &(0x7f0000000080)={0x5, 0x8001, 0x4, 0x8001, 0x15, "b45da66f02087ca7"}) ioctl$TCSETAF(r1, 0x5408, &(0x7f00000000c0)={0x5, 0x22c1, 0x800, 0x8, 0x5, "2b8c058f839aaa67"}) connect$netlink(r1, &(0x7f0000000100)=@proc={0x10, 0x0, 0x25dfdbfd, 0x2}, 0xc) r2 = syz_open_dev$tty1(0xc, 0x4, 0x4) ioctl$TCSETSF(r2, 0x5404, &(0x7f0000000140)={0x6, 0x2, 0x2, 0x80000001, 0x1b, "c2331e6388ffeb48419d467a4b791ad4343a96"}) ioctl$TIOCMGET(r1, 0x5415, &(0x7f0000000180)) ioctl$TCSETAF(r2, 0x5408, &(0x7f00000001c0)={0x11, 0x0, 0xfff, 0x7, 0xd, "3ae59dd65d54337c"}) r3 = timerfd_create(0x7, 0x800) timerfd_settime(r3, 0x1, &(0x7f0000000200), &(0x7f0000000240)) ioctl$TCSETAF(r2, 0x5408, &(0x7f0000000280)={0x1, 0x1, 0x3d4c, 0x200, 0x0, "73a709364d80b6c1"}) ioctl$PIO_UNIMAPCLR(0xffffffffffffffff, 0x4b68, &(0x7f00000002c0)={0x73, 0x1fe0, 0x8b}) ioctl$TCSETSF2(r2, 0x402c542d, &(0x7f0000000300)={0xffffffff, 0x0, 0x80000000, 0x9, 0x6, "35157e2ff53385c0969535964d148320e065e8", 0x6}) ioctl$KDGKBMETA(0xffffffffffffffff, 0x4b62, &(0x7f0000000340)) ioctl$TIOCGICOUNT(r2, 0x545d, 0x0) socket(0x16, 0x1, 0x9) sendmsg$IEEE802154_LLSEC_DEL_KEY(0xffffffffffffffff, &(0x7f0000000440)={&(0x7f0000000380)={0x10, 0x0, 0x0, 0x10000}, 0xc, &(0x7f0000000400)={&(0x7f00000003c0)={0x38, 0x0, 0x10, 0x70bd2d, 0x25dfdbfe, {}, [@IEEE802154_ATTR_DEV_NAME={0xa, 0x1, 'wpan4\x00'}, @IEEE802154_ATTR_DEV_NAME={0xa, 0x1, 'wpan3\x00'}, @IEEE802154_ATTR_LLSEC_KEY_SOURCE_EXTENDED={0xc, 0x2d, {0xaaaaaaaaaaaa0302}}]}, 0x38}}, 0xc008) 00:52:37 executing program 7: r0 = openat$procfs(0xffffffffffffff9c, &(0x7f0000000000)='/proc/mdstat\x00', 0x0, 0x0) mmap$IORING_OFF_CQ_RING(&(0x7f0000ffc000/0x2000)=nil, 0x2000, 0x8, 0x4010, r0, 0x8000000) r1 = openat$cdrom(0xffffffffffffff9c, &(0x7f0000000040), 0xb0840, 0x0) ioctl$CDROM_LOCKDOOR(r1, 0x5329, 0x1) r2 = openat$procfs(0xffffffffffffff9c, &(0x7f0000000080)='/proc/slabinfo\x00', 0x0, 0x0) epoll_ctl$EPOLL_CTL_DEL(r2, 0x2, r0) r3 = fsmount(r2, 0x0, 0x7f) ioctl$CDROMREADMODE1(r3, 0x530d, &(0x7f00000000c0)={0x7, 0x1f, 0x3, 0x81, 0xf3, 0x7b}) mprotect(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x1000008) mmap$IORING_OFF_CQ_RING(&(0x7f0000ffe000/0x1000)=nil, 0x1000, 0x2, 0x80010, r3, 0x8000000) socketpair$nbd(0x1, 0x1, 0x0, &(0x7f0000000d80)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$sock_SIOCGIFINDEX_80211(r4, 0x8933, &(0x7f0000000dc0)={'wlan1\x00'}) r5 = syz_genetlink_get_family_id$batadv(&(0x7f0000000e40), r0) sendmsg$BATADV_CMD_GET_ORIGINATORS(r3, &(0x7f0000000f00)={&(0x7f0000000e00)={0x10, 0x0, 0x0, 0x400000}, 0xc, &(0x7f0000000ec0)={&(0x7f0000000e80)={0x34, r5, 0x2, 0x70bd29, 0x25dfdbff, {}, [@BATADV_ATTR_THROUGHPUT_OVERRIDE={0x8, 0x3b, 0x8}, @BATADV_ATTR_BRIDGE_LOOP_AVOIDANCE_ENABLED={0x5, 0x2e, 0x1}, @BATADV_ATTR_FRAGMENTATION_ENABLED={0x5, 0x30, 0x1}, @BATADV_ATTR_TPMETER_TEST_TIME={0x8, 0xb, 0xfffffffb}]}, 0x34}, 0x1, 0x0, 0x0, 0x20000000}, 0x4000000) ioctl$CDROM_GET_CAPABILITY(0xffffffffffffffff, 0x5331) r6 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r7 = syz_genetlink_get_family_id$nbd(&(0x7f0000000f80), 0xffffffffffffffff) sendmsg$NBD_CMD_RECONFIGURE(r6, &(0x7f0000001040)={&(0x7f0000000f40)={0x10, 0x0, 0x0, 0x4000000}, 0xc, &(0x7f0000001000)={&(0x7f0000000fc0)={0x20, r7, 0x200, 0x70bd2b, 0x25dfdbfb, {}, [@NBD_ATTR_TIMEOUT={0xc, 0x4, 0x1f}]}, 0x20}, 0x1, 0x0, 0x0, 0x20000000}, 0x2004c000) sendmsg$NBD_CMD_DISCONNECT(r6, &(0x7f00000011c0)={&(0x7f00000010c0)={0x10, 0x0, 0x0, 0x4000}, 0xc, &(0x7f0000001180)={&(0x7f0000001140)={0x20, 0x0, 0x20, 0x70bd25, 0x25dfdbfe, {}, [@NBD_ATTR_BLOCK_SIZE_BYTES={0xc, 0x3, 0x9de}]}, 0x20}, 0x1, 0x0, 0x0, 0x20004000}, 0x200000c5) 00:52:37 executing program 1: r0 = openat$zero(0xffffffffffffff9c, &(0x7f0000000000), 0x400200, 0x0) ioctl$SECCOMP_IOCTL_NOTIF_ADDFD(r0, 0x40182103, &(0x7f0000000040)={0x0, 0x1, 0xffffffffffffffff, 0x80000000, 0x80000}) r1 = syz_genetlink_get_family_id$batadv(&(0x7f00000000c0), r0) sendmsg$BATADV_CMD_GET_TRANSTABLE_LOCAL(r0, &(0x7f00000001c0)={&(0x7f0000000080)={0x10, 0x0, 0x0, 0x80000}, 0xc, &(0x7f0000000180)={&(0x7f0000000100)={0x54, r1, 0x200, 0x70bd25, 0x25dfdbff, {}, [@BATADV_ATTR_THROUGHPUT_OVERRIDE={0x8, 0x3b, 0x89}, @BATADV_ATTR_THROUGHPUT_OVERRIDE={0x8, 0x3b, 0xffff}, @BATADV_ATTR_FRAGMENTATION_ENABLED={0x5}, @BATADV_ATTR_AGGREGATED_OGMS_ENABLED={0x5}, @BATADV_ATTR_MULTICAST_FORCEFLOOD_ENABLED={0x5}, @BATADV_ATTR_BRIDGE_LOOP_AVOIDANCE_ENABLED={0x5}, @BATADV_ATTR_HARD_IFINDEX={0x8}, @BATADV_ATTR_GW_MODE={0x5, 0x33, 0x1}]}, 0x54}, 0x1, 0x0, 0x0, 0x48041}, 0x4840) r2 = openat$procfs(0xffffffffffffff9c, &(0x7f0000000200)='/proc/cpuinfo\x00', 0x0, 0x0) sendmsg$BATADV_CMD_GET_GATEWAYS(r2, &(0x7f0000000340)={&(0x7f0000000240)={0x10, 0x0, 0x0, 0x1000000}, 0xc, &(0x7f0000000300)={&(0x7f0000000280)={0x50, r1, 0x400, 0x70bd26, 0x25dfdbfb, {}, [@BATADV_ATTR_BRIDGE_LOOP_AVOIDANCE_ENABLED={0x5, 0x2e, 0x1}, @BATADV_ATTR_ISOLATION_MARK={0x8, 0x2b, 0x3}, @BATADV_ATTR_BONDING_ENABLED={0x5}, @BATADV_ATTR_BRIDGE_LOOP_AVOIDANCE_ENABLED={0x5, 0x2e, 0x1}, @BATADV_ATTR_ORIG_ADDRESS={0xa, 0x9, @multicast}, @BATADV_ATTR_THROUGHPUT_OVERRIDE={0x8, 0x3b, 0x1}, @BATADV_ATTR_ISOLATION_MARK={0x8, 0x2b, 0x6}]}, 0x50}, 0x1, 0x0, 0x0, 0x20049800}, 0x80) r3 = syz_genetlink_get_family_id$batadv(&(0x7f00000003c0), r0) sendmsg$BATADV_CMD_SET_MESH(r0, &(0x7f0000000480)={&(0x7f0000000380)={0x10, 0x0, 0x0, 0x1000}, 0xc, &(0x7f0000000440)={&(0x7f0000000400)={0x34, r3, 0x400, 0x70bd2d, 0x25dfdbff, {}, [@BATADV_ATTR_GW_MODE={0x5}, @BATADV_ATTR_GW_BANDWIDTH_UP={0x8, 0x32, 0x8001}, @BATADV_ATTR_ORIG_INTERVAL={0x8, 0x39, 0x4}, @BATADV_ATTR_NETWORK_CODING_ENABLED={0x5, 0x38, 0x1}]}, 0x34}, 0x1, 0x0, 0x0, 0x4000000}, 0x18000) r4 = fsmount(r0, 0x1, 0x5) r5 = fsmount(r2, 0x1, 0x7a) epoll_ctl$EPOLL_CTL_ADD(r4, 0x1, r5, &(0x7f00000016c0)={0x80002000}) r6 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000001700), 0x111002, 0x0) epoll_ctl$EPOLL_CTL_MOD(r0, 0x3, r6, &(0x7f0000001740)) ioctl$SECCOMP_IOCTL_NOTIF_ID_VALID(r5, 0x40082102, &(0x7f0000001780)) rt_sigqueueinfo(0xffffffffffffffff, 0x2, &(0x7f00000017c0)={0x16, 0x5, 0x8}) ioctl$BINDER_SET_MAX_THREADS(r4, 0x40046205, &(0x7f0000001840)=0x4) r7 = syz_genetlink_get_family_id$ieee802154(&(0x7f00000018c0), 0xffffffffffffffff) sendmsg$IEEE802154_ASSOCIATE_RESP(0xffffffffffffffff, &(0x7f00000019c0)={&(0x7f0000001880)={0x10, 0x0, 0x0, 0x10}, 0xc, &(0x7f0000001980)={&(0x7f0000001900)={0x48, r7, 0x400, 0x70bd26, 0x25dfdbfc, {}, [@IEEE802154_ATTR_COORD_HW_ADDR={0xc, 0x9, {0x5555555555540004}}, @IEEE802154_ATTR_COORD_HW_ADDR={0xc, 0x9, {0xaaaaaaaaaaaa0302}}, @IEEE802154_ATTR_COORD_HW_ADDR={0xc, 0x9, {0xaaaaaaaaaaaa0002}}, @IEEE802154_ATTR_STATUS={0x5, 0x3, 0x88}, @IEEE802154_ATTR_STATUS={0x5, 0x3, 0x3}]}, 0x48}, 0x1, 0x0, 0x0, 0x800}, 0x810) ioctl$SECCOMP_IOCTL_NOTIF_ID_VALID(r0, 0x40082102, &(0x7f0000001a00)) 00:52:38 executing program 0: r0 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$ieee802154(&(0x7f0000000040), 0xffffffffffffffff) ioctl$sock_SIOCGIFINDEX_802154(0xffffffffffffffff, 0x8933, &(0x7f0000000080)={'wpan0\x00', 0x0}) sendmsg$IEEE802154_LLSEC_DEL_DEVKEY(r0, &(0x7f0000000140)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x2000000}, 0xc, &(0x7f0000000100)={&(0x7f00000000c0)={0x38, r1, 0x2, 0x70bd27, 0x25dfdbfb, {}, [@IEEE802154_ATTR_LLSEC_KEY_SOURCE_SHORT={0x8, 0x2c, 0xee0}, @IEEE802154_ATTR_PAN_ID={0x6, 0x6, 0xffff}, @IEEE802154_ATTR_DEV_INDEX={0x8, 0x2, r2}, @IEEE802154_ATTR_LLSEC_KEY_SOURCE_EXTENDED={0xc, 0x2d, {0xaaaaaaaaaaaa0002}}]}, 0x38}}, 0x4) r3 = syz_genetlink_get_family_id$ieee802154(&(0x7f00000001c0), r0) sendmsg$IEEE802154_LLSEC_ADD_KEY(r0, &(0x7f00000002c0)={&(0x7f0000000180)={0x10, 0x0, 0x0, 0x80}, 0xc, &(0x7f0000000280)={&(0x7f0000000200)={0x70, r3, 0x8dc3595b298c372b, 0x70bd2c, 0x25dfdbfd, {}, [@IEEE802154_ATTR_HW_ADDR={0xc, 0x5, {0xaaaaaaaaaaaa0302}}, @IEEE802154_ATTR_LLSEC_KEY_SOURCE_EXTENDED={0xc, 0x2d, {0xaaaaaaaaaaaa0202}}, @IEEE802154_ATTR_HW_ADDR={0xc, 0x5, {0xaaaaaaaaaaaa0002}}, @IEEE802154_ATTR_LLSEC_KEY_USAGE_FRAME_TYPES={0x5, 0x31, 0x81}, @IEEE802154_ATTR_DEV_NAME={0xa, 0x1, 'wpan1\x00'}, @IEEE802154_ATTR_LLSEC_KEY_USAGE_COMMANDS={0x24, 0x32, "c38d2be0aa0107a2b38f85915a757ba51ff3d89ac2e1c596dce3055b00418226"}]}, 0x70}, 0x1, 0x0, 0x0, 0x20004040}, 0x0) r4 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) sendmsg$IEEE802154_ASSOCIATE_RESP(r4, &(0x7f0000000400)={&(0x7f0000000300)={0x10, 0x0, 0x0, 0x2000000}, 0xc, &(0x7f00000003c0)={&(0x7f0000000340)={0x60, r3, 0x200, 0x70bd26, 0x25dfdbfd, {}, [@IEEE802154_ATTR_COORD_HW_ADDR={0xc}, @IEEE802154_ATTR_STATUS={0x5, 0x3, 0x40}, @IEEE802154_ATTR_STATUS={0x5, 0x3, 0x1}, @IEEE802154_ATTR_COORD_HW_ADDR={0xc, 0x9, {0x2c841fbeb2fffbec}}, @IEEE802154_ATTR_COORD_HW_ADDR={0xc, 0x9, {0xaaaaaaaaaaaa0202}}, @IEEE802154_ATTR_STATUS={0x5, 0x3, 0x6}, @IEEE802154_ATTR_STATUS={0x5, 0x3, 0x3f}, @IEEE802154_ATTR_COORD_SHORT_ADDR={0x6, 0x8, 0xffff}]}, 0x60}, 0x1, 0x0, 0x0, 0x20000000}, 0x20000080) ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, &(0x7f0000000540)={0xc, 0x0, &(0x7f0000000440)=[@dead_binder_done], 0xbf, 0x0, &(0x7f0000000480)="0537636f85beafebd2a00648fb042246bcbd2150d45e58acedd2718aaa529794fc45c87c914f2b69b82fedb220d6a94b2babd3f188631b48d025c32a8342250d69582838e7ee6d22fa335ce4315412805f50869d3f4bef11a5bb26ac3704b717f9416fc1f441d5dd77d4b3c1a283f3179a7daf20c0d30210361ea15f09fd38e2c2ac52383e1685a787783f4524fd7d784046605442e441fb76b236455574d7fe70d1885d924099864313d8d3d84c106a36d2ccc77c51d3cdaf3f716551fc0a"}) r5 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) syz_genetlink_get_family_id$ieee802154(&(0x7f0000000580), r5) sendmsg$IEEE802154_SET_MACPARAMS(r0, &(0x7f0000000680)={&(0x7f00000005c0)={0x10, 0x0, 0x0, 0x1000}, 0xc, &(0x7f0000000640)={&(0x7f0000000600)={0x2c, r3, 0x2, 0x70bd2d, 0x25dfdbfd, {}, [@IEEE802154_ATTR_CCA_ED_LEVEL={0x8, 0x24, 0x7fffffff}, @IEEE802154_ATTR_TXPOWER={0x5, 0x21, 0x3}, @IEEE802154_ATTR_CSMA_MAX_BE={0x5, 0x27, 0x4}]}, 0x2c}, 0x1, 0x0, 0x0, 0x40801}, 0x40840) r6 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) sendmsg$IEEE802154_LLSEC_DEL_SECLEVEL(r6, &(0x7f00000007c0)={&(0x7f00000006c0)={0x10, 0x0, 0x0, 0x40000000}, 0xc, &(0x7f0000000780)={&(0x7f0000000700)={0x44, r3, 0x300, 0x70bd2a, 0x25dfdbfb, {}, [@IEEE802154_ATTR_DEV_INDEX={0x8, 0x2, r2}, @IEEE802154_ATTR_LLSEC_FRAME_TYPE={0x5, 0x33, 0x1f}, @IEEE802154_ATTR_LLSEC_FRAME_TYPE={0x5, 0x33, 0x7}, @IEEE802154_ATTR_LLSEC_CMD_FRAME_ID={0x5, 0x34, 0xcb}, @IEEE802154_ATTR_LLSEC_DEV_OVERRIDE={0x5, 0x36, 0x1}, @IEEE802154_ATTR_LLSEC_CMD_FRAME_ID={0x5, 0x34, 0x1}]}, 0x44}, 0x1, 0x0, 0x0, 0x40000a1}, 0x4800) r7 = syz_genetlink_get_family_id$ieee802154(&(0x7f0000000840), r6) sendmsg$IEEE802154_LLSEC_DEL_DEV(r6, &(0x7f0000000940)={&(0x7f0000000800)={0x10, 0x0, 0x0, 0x2000}, 0xc, &(0x7f0000000900)={&(0x7f0000000880)={0x6c, r7, 0x100, 0x70bd26, 0x25dfdbfe, {}, [@IEEE802154_ATTR_HW_ADDR={0xc, 0x5, {0xaaaaaaaaaaaa0202}}, @IEEE802154_ATTR_HW_ADDR={0xc, 0x5, {0xaaaaaaaaaaaa0302}}, @IEEE802154_ATTR_DEV_INDEX={0x8, 0x2, r2}, @IEEE802154_ATTR_HW_ADDR={0xc}, @IEEE802154_ATTR_DEV_NAME={0xa, 0x1, 'wpan1\x00'}, @IEEE802154_ATTR_HW_ADDR={0xc, 0x5, {0xaaaaaaaaaaaa0302}}, @IEEE802154_ATTR_HW_ADDR={0xc}, @IEEE802154_ATTR_DEV_INDEX={0x8, 0x2, r2}]}, 0x6c}, 0x1, 0x0, 0x0, 0x41}, 0x20004040) ioctl$sock_SIOCGIFINDEX_802154(r5, 0x8933, &(0x7f00000009c0)={'wpan4\x00'}) ioctl$sock_SIOCGIFINDEX_802154(r5, 0x8933, &(0x7f0000000a00)={'wpan3\x00'}) sendmsg$IEEE802154_LLSEC_DEL_KEY(0xffffffffffffffff, &(0x7f0000000c80)={&(0x7f0000000b40)={0x10, 0x0, 0x0, 0x40000000}, 0xc, &(0x7f0000000c40)={&(0x7f0000000bc0)={0x58, 0x0, 0x402, 0x70bd2d, 0x25dfdbff, {}, [@IEEE802154_ATTR_LLSEC_KEY_MODE={0x5, 0x2b, 0x1}, @IEEE802154_ATTR_DEV_NAME={0xa, 0x1, 'wpan3\x00'}, @IEEE802154_ATTR_LLSEC_KEY_SOURCE_EXTENDED={0xc, 0x2d, {0xaaaaaaaaaaaa0302}}, @IEEE802154_ATTR_LLSEC_KEY_ID={0x5, 0x2e, 0x4}, @IEEE802154_ATTR_LLSEC_KEY_ID={0x5, 0x2e, 0x3}, @IEEE802154_ATTR_SHORT_ADDR={0x6, 0x4, 0xfffd}, @IEEE802154_ATTR_HW_ADDR={0xc}]}, 0x58}, 0x1, 0x0, 0x0, 0x40800}, 0x24040000) 00:52:38 executing program 5: prctl$PR_GET_FPEXC(0xb, &(0x7f0000000000)) r0 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000040)='./binderfs/custom0\x00', 0x800, 0x0) ustat(0x800, &(0x7f0000000080)) ioctl$ifreq_SIOCGIFINDEX_batadv_mesh(0xffffffffffffffff, 0x8933, &(0x7f0000000100)={'batadv0\x00', 0x0}) ioctl$ifreq_SIOCGIFINDEX_batadv_hard(0xffffffffffffffff, 0x8933, &(0x7f0000000140)={'batadv_slave_0\x00', 0x0}) sendmsg$ETHTOOL_MSG_PAUSE_GET(0xffffffffffffffff, &(0x7f00000002c0)={&(0x7f00000000c0)={0x10, 0x0, 0x0, 0x10000}, 0xc, &(0x7f0000000280)={&(0x7f0000000180)={0xdc, 0x0, 0x8, 0x70bd27, 0x25dfdbfb, {}, [@HEADER={0x5c, 0x1, 0x0, 0x1, [@ETHTOOL_A_HEADER_DEV_INDEX={0x8, 0x1, r1}, @ETHTOOL_A_HEADER_FLAGS={0x8}, @ETHTOOL_A_HEADER_DEV_NAME={0x14, 0x2, 'veth0_vlan\x00'}, @ETHTOOL_A_HEADER_DEV_INDEX={0x8}, @ETHTOOL_A_HEADER_FLAGS={0x8, 0x3, 0x3}, @ETHTOOL_A_HEADER_FLAGS={0x8, 0x3, 0x2}, @ETHTOOL_A_HEADER_DEV_INDEX={0x8, 0x1, r2}, @ETHTOOL_A_HEADER_DEV_NAME={0x14, 0x2, 'macvlan0\x00'}]}, @HEADER={0x40, 0x1, 0x0, 0x1, [@ETHTOOL_A_HEADER_DEV_NAME={0x14, 0x2, 'veth0_to_bridge\x00'}, @ETHTOOL_A_HEADER_DEV_NAME={0x14, 0x2, 'veth0_to_bridge\x00'}, @ETHTOOL_A_HEADER_DEV_NAME={0x14, 0x2, 'netpci0\x00'}]}, @HEADER={0x2c, 0x1, 0x0, 0x1, [@ETHTOOL_A_HEADER_DEV_NAME={0x14, 0x2, 'bond_slave_1\x00'}, @ETHTOOL_A_HEADER_DEV_NAME={0x14, 0x2, 'ip_vti0\x00'}]}]}, 0xdc}, 0x1, 0x0, 0x0, 0x4000}, 0x24000000) sendmsg$NBD_CMD_STATUS(0xffffffffffffffff, &(0x7f0000000400)={&(0x7f0000000300)={0x10, 0x0, 0x0, 0x4}, 0xc, &(0x7f00000003c0)={&(0x7f0000000340)={0x44, 0x0, 0x20, 0x70bd2d, 0x25dfdbfc, {}, [@NBD_ATTR_SIZE_BYTES={0xc, 0x2, 0x4}, @NBD_ATTR_SOCKETS={0x24, 0x7, 0x0, 0x1, [{0x8}, {0x8}, {0x8}, {0x8}]}]}, 0x44}}, 0x4000) ioctl$BINDER_GET_NODE_DEBUG_INFO(r0, 0xc018620b, &(0x7f0000000440)={0x3}) syz_genetlink_get_family_id$batadv(&(0x7f0000000480), 0xffffffffffffffff) r3 = syz_open_dev$ttys(0xc, 0x2, 0x0) ioctl$TCSETAF(r3, 0x5408, &(0x7f00000004c0)={0x4, 0xb073, 0x1000, 0x1, 0x13, "b786e10fbdab60cc"}) openat$binderfs(0xffffffffffffff9c, &(0x7f0000000500)='./binderfs2/binder0\x00', 0x802, 0x0) sendmsg$BATADV_CMD_SET_VLAN(0xffffffffffffffff, &(0x7f0000000600)={&(0x7f0000000540)={0x10, 0x0, 0x0, 0x80000}, 0xc, &(0x7f00000005c0)={&(0x7f0000000580)={0x30, 0x0, 0x400, 0x70bd27, 0x25dfdbfb, {}, [@BATADV_ATTR_FRAGMENTATION_ENABLED={0x5, 0x30, 0x1}, @BATADV_ATTR_ORIG_ADDRESS={0xa, 0x9, @random="62836be88da6"}, @BATADV_ATTR_ISOLATION_MASK={0x8, 0x2c, 0x81}]}, 0x30}, 0x1, 0x0, 0x0, 0x8004}, 0x4c000) r4 = syz_open_dev$ttys(0xc, 0x2, 0x0) ioctl$TIOCEXCL(r4, 0x540c) r5 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) sendmsg$IEEE802154_LLSEC_GETPARAMS(r5, &(0x7f0000000740)={&(0x7f0000000640)={0x10, 0x0, 0x0, 0x8000000}, 0xc, &(0x7f0000000700)={&(0x7f0000000680)={0x48, 0x0, 0x4, 0x70bd28, 0x25dfdbfd, {}, [@IEEE802154_ATTR_DEV_INDEX={0x8}, @IEEE802154_ATTR_DEV_NAME={0xa, 0x1, 'wpan3\x00'}, @IEEE802154_ATTR_DEV_NAME={0xa, 0x1, 'wpan4\x00'}, @IEEE802154_ATTR_DEV_NAME={0xa, 0x1, 'wpan1\x00'}, @IEEE802154_ATTR_DEV_INDEX={0x8}]}, 0x48}, 0x1, 0x0, 0x0, 0x4000}, 0x20000080) clone(0x28000800, &(0x7f0000000880)="b3f828035cfe9f8546c65ee8fffa58fb52d9bafabf363f0161cf01b4a2872006d34dcf860667a59d8c5631820a98c05b3989c5037ea89b5a58e8e9809cc008c7ae03db6bb845b2c189e79729a6d2c9a5440c276c7d0686adda809621c1d9723369157389ff141a56cbc54111ec7f92e8262b0c9ab88b9bffbb114333ab5a9711171c09e2589351fa4950d7af92bccf71585c21606994d6b4443d2cb6725d2c983a62f6f0", &(0x7f0000000940), &(0x7f0000000980), &(0x7f00000009c0)="073c516951c56a5fb1d10f1151ef77ee30e71fea92d34f29ddbe9265f84a8e761f6f56055bef1048f67ec1da822c677e9c34d5d52feb791c13c75661003151c2a956098cc6") 00:52:38 executing program 3: clone(0x400, &(0x7f0000000000)="2f59adb4fe8bdd18e28d59f811fee00f6e", &(0x7f0000000040), &(0x7f0000000080), &(0x7f00000000c0)="ee4468595a6a9e17d313ddea1158c7520b4ce752e1feceb8bd763f38764fe32d5b11f9842e25fb3843f95d48bcbb676b94dc456e5f562cd49d08bd5ac38eb9d6acfc2fa3928b3de489313465b4bea18ac19b9efcb135738e957c5dfaa38b9755182fa0eb46bac360130ee66e2636e1d6aafb8e5918d6d0f8338603cd9bd3e0f3b5d106eae77f68fc50df9f58fd8061a03c31d04b3551c672a8334c0f3bd81aea189fc02f258c22a8b0dba2a60f9a458d6eff75d32cf215930f0bccd5f8ee1d8d33a86c5eda24ec311adc") ioctl$CDROMREADMODE1(0xffffffffffffffff, 0x530d, &(0x7f00000001c0)={0x8, 0x81, 0x4, 0x1, 0x1, 0x8}) ioctl$CDROMREADRAW(0xffffffffffffffff, 0x5314, &(0x7f0000000c40)={0x1, 0x5, 0x7, 0xe5, 0x2, 0x81}) r0 = openat$zero(0xffffffffffffff9c, &(0x7f00000016c0), 0x0, 0x0) ioctl$CDROMSTART(r0, 0x5308) rt_sigaction(0xf, &(0x7f0000001780)={&(0x7f0000001700)="66430f3a15df22c402d937a80e000000f347241ac44218f34ce000c4a2b528e8db5a2466440f38014fdb660f3810b006a50000c421fc295a0cdcf1", 0x80000004, &(0x7f0000001740)="642e41dde78f684ca2df01416dc463755c460b34f3460fa6c0c4c11b7cc7c442f1ad5b00f0430fab6b000f0f62f79af046f71c54", {[0xfffffffffffffffe]}}, &(0x7f0000001840)={&(0x7f00000017c0)="f240af66e20067363666460ffa6f5136360f974700c48165da31c422050c1ec4c17a6fbb2f000000c4027d2074f407f2430f1a39ff30", 0x0, &(0x7f0000001800)="c462394627defbc401f1d3cac46159de6e1fc4816c58a20700000066430faef2c4c16b7c9f0300000066400f6620f0ff0500000000c4e111d2f9"}, 0x8, &(0x7f0000001880)) timerfd_create(0x9, 0x800) prctl$PR_GET_FPEXC(0xb, &(0x7f00000018c0)) recvmmsg(r0, &(0x7f0000003c40)=[{{&(0x7f0000001900)=@pppol2tp={0x18, 0x1, {0x0, 0xffffffffffffffff, {0x2, 0x0, @empty}}}, 0x80, &(0x7f00000029c0)=[{&(0x7f0000001980)=""/39, 0x27}, {&(0x7f00000019c0)=""/4096, 0x1000}], 0x2, &(0x7f0000002a00)=""/18, 0x12}, 0x3f}, {{&(0x7f0000002a40)=@nfc, 0x80, &(0x7f0000002e80)=[{&(0x7f0000002ac0)=""/44, 0x2c}, {&(0x7f0000002b00)=""/65, 0x41}, {&(0x7f0000002b80)=""/107, 0x6b}, {&(0x7f0000002c00)=""/158, 0x9e}, {&(0x7f0000002cc0)=""/169, 0xa9}, {&(0x7f0000002d80)=""/57, 0x39}, {&(0x7f0000002dc0)=""/160, 0xa0}], 0x7}, 0x6}, {{&(0x7f0000002f00)=@x25={0x9, @remote}, 0x80, &(0x7f0000003100)=[{&(0x7f0000002f80)=""/101, 0x65}, {&(0x7f0000003000)}, {&(0x7f0000003040)=""/187, 0xbb}], 0x3, &(0x7f0000003140)=""/159, 0x9f}, 0xffffffff}, {{&(0x7f0000003200)=@ll={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @dev}, 0x80, &(0x7f0000003400)=[{&(0x7f0000003280)=""/29, 0x1d}, {&(0x7f00000032c0)=""/41, 0x29}, {&(0x7f0000003300)=""/219, 0xdb}], 0x3, &(0x7f0000003440)=""/204, 0xcc}, 0x2f62}, {{&(0x7f0000003540)=@hci, 0x80, &(0x7f0000003b80)=[{&(0x7f00000035c0)=""/168, 0xa8}, {&(0x7f0000003680)=""/128, 0x80}, {&(0x7f0000003700)=""/75, 0x4b}, {&(0x7f0000003780)=""/189, 0xbd}, {&(0x7f0000003840)=""/168, 0xa8}, {&(0x7f0000003900)=""/132, 0x84}, {&(0x7f00000039c0)=""/162, 0xa2}, {&(0x7f0000003a80)=""/198, 0xc6}], 0x8, &(0x7f0000003c00)=""/25, 0x19}, 0xfc00}], 0x5, 0x21, &(0x7f0000003d80)) r2 = socket$netlink(0x10, 0x3, 0xe) syz_genetlink_get_family_id$smc(&(0x7f0000003dc0), r2) timerfd_create(0x6, 0x800) ioctl$BINDER_THREAD_EXIT(r0, 0x40046208, 0x0) epoll_ctl$EPOLL_CTL_MOD(r0, 0x3, r1, &(0x7f0000003e00)={0xb0000000}) r3 = io_uring_setup(0x35ea, &(0x7f0000003e40)={0x0, 0x7cfa, 0x2, 0x0, 0x210, 0x0, r0}) io_uring_setup(0x106d, &(0x7f0000003ec0)={0x0, 0xb36, 0x1e, 0x1, 0xa7, 0x0, r3}) sendmsg$NBD_CMD_STATUS(0xffffffffffffffff, &(0x7f0000004040)={&(0x7f0000003f40)={0x10, 0x0, 0x0, 0x8}, 0xc, &(0x7f0000004000)={&(0x7f0000003f80)={0x6c, 0x0, 0x20, 0x70bd2a, 0x25dfdbff, {}, [@NBD_ATTR_DEAD_CONN_TIMEOUT={0xc, 0x8, 0x68b2}, @NBD_ATTR_SIZE_BYTES={0xc, 0x2, 0x1f}, @NBD_ATTR_SIZE_BYTES={0xc, 0x2, 0x8}, @NBD_ATTR_TIMEOUT={0xc, 0x4, 0x6}, @NBD_ATTR_DEAD_CONN_TIMEOUT={0xc, 0x8, 0x3}, @NBD_ATTR_CLIENT_FLAGS={0xc, 0x6, 0x1}, @NBD_ATTR_INDEX={0x8, 0x1, 0x0}, @NBD_ATTR_INDEX={0x8, 0x1, 0x0}]}, 0x6c}, 0x1, 0x0, 0x0, 0x40840}, 0x10) r4 = syz_genetlink_get_family_id$nbd(&(0x7f00000040c0), 0xffffffffffffffff) r5 = fsmount(r0, 0x0, 0xf0) sendmsg$NBD_CMD_RECONFIGURE(0xffffffffffffffff, &(0x7f00000041c0)={&(0x7f0000004080)={0x10, 0x0, 0x0, 0x2000}, 0xc, &(0x7f0000004180)={&(0x7f0000004140)={0x3c, r4, 0x100, 0x70bd29, 0x25dfdbfd, {}, [@NBD_ATTR_SOCKETS={0x14, 0x7, 0x0, 0x1, [{0x8, 0x1, r5}, {0x8}]}, @NBD_ATTR_INDEX={0x8, 0x1, 0x0}, @NBD_ATTR_SOCKETS={0xc, 0x7, 0x0, 0x1, [{0x8, 0x1, r0}]}]}, 0x3c}, 0x1, 0x0, 0x0, 0x810}, 0x40000) 00:52:46 executing program 4: r0 = openat$ttyS3(0xffffffffffffff9c, &(0x7f0000000000), 0xa2000, 0x0) ioctl$TIOCSETD(r0, 0x5423, &(0x7f0000000040)=0x13) r1 = fsmount(0xffffffffffffffff, 0x1, 0x76) ioctl$TCSETAF(r1, 0x5408, &(0x7f0000000080)={0x5, 0x8001, 0x4, 0x8001, 0x15, "b45da66f02087ca7"}) ioctl$TCSETAF(r1, 0x5408, &(0x7f00000000c0)={0x5, 0x22c1, 0x800, 0x8, 0x5, "2b8c058f839aaa67"}) connect$netlink(r1, &(0x7f0000000100)=@proc={0x10, 0x0, 0x25dfdbfd, 0x2}, 0xc) r2 = syz_open_dev$tty1(0xc, 0x4, 0x4) ioctl$TCSETSF(r2, 0x5404, &(0x7f0000000140)={0x6, 0x2, 0x2, 0x80000001, 0x1b, "c2331e6388ffeb48419d467a4b791ad4343a96"}) ioctl$TIOCMGET(r1, 0x5415, &(0x7f0000000180)) ioctl$TCSETAF(r2, 0x5408, &(0x7f00000001c0)={0x11, 0x0, 0xfff, 0x7, 0xd, "3ae59dd65d54337c"}) r3 = timerfd_create(0x7, 0x800) timerfd_settime(r3, 0x1, &(0x7f0000000200), &(0x7f0000000240)) ioctl$TCSETAF(r2, 0x5408, &(0x7f0000000280)={0x1, 0x1, 0x3d4c, 0x200, 0x0, "73a709364d80b6c1"}) ioctl$PIO_UNIMAPCLR(0xffffffffffffffff, 0x4b68, &(0x7f00000002c0)={0x73, 0x1fe0, 0x8b}) ioctl$TCSETSF2(r2, 0x402c542d, &(0x7f0000000300)={0xffffffff, 0x0, 0x80000000, 0x9, 0x6, "35157e2ff53385c0969535964d148320e065e8", 0x6}) ioctl$KDGKBMETA(0xffffffffffffffff, 0x4b62, &(0x7f0000000340)) ioctl$TIOCGICOUNT(r2, 0x545d, 0x0) socket(0x16, 0x1, 0x9) 00:52:46 executing program 2: r0 = fsmount(0xffffffffffffffff, 0x1, 0x2) r1 = fsmount(r0, 0x1, 0x7c) fsconfig$FSCONFIG_CMD_CREATE(r1, 0x6, 0x0, 0x0, 0x0) r2 = fsmount(r0, 0x0, 0x8) ioctl$CDROMREADCOOKED(r2, 0x5315, &(0x7f0000000000)) sendmsg$IPSET_CMD_HEADER(r0, &(0x7f0000000b40)={&(0x7f0000000a80)={0x10, 0x0, 0x0, 0x1000000}, 0xc, &(0x7f0000000b00)={&(0x7f0000000ac0)={0x28, 0xc, 0x6, 0x801, 0x0, 0x0, {0xf, 0x0, 0xa}, [@IPSET_ATTR_PROTOCOL={0x5}, @IPSET_ATTR_SETNAME={0x9, 0x2, 'syz2\x00'}]}, 0x28}, 0x1, 0x0, 0x0, 0x4000881}, 0x10) r3 = openat$zero(0xffffffffffffff9c, &(0x7f0000000b80), 0x0, 0x0) mmap$binder(&(0x7f0000fff000/0x1000)=nil, 0x1000, 0x1, 0x11, r3, 0x358f) ioctl$TIOCGICOUNT(r3, 0x545d, 0x0) ioctl$HIDIOCGPHYS(r2, 0x80404812, &(0x7f0000000bc0)) ioctl$CDROMVOLCTRL(r3, 0x530a, &(0x7f0000000c00)={0x1, 0xc0, 0x9, 0x40}) r4 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPSET_CMD_HEADER(r4, &(0x7f0000000d40)={&(0x7f0000000c40)={0x10, 0x0, 0x0, 0x80000}, 0xc, &(0x7f0000000d00)={&(0x7f0000000c80)={0x48, 0xc, 0x6, 0x101, 0x0, 0x0, {0x5, 0x0, 0x9}, [@IPSET_ATTR_PROTOCOL={0x5}, @IPSET_ATTR_PROTOCOL={0x5}, @IPSET_ATTR_SETNAME={0x9, 0x2, 'syz2\x00'}, @IPSET_ATTR_PROTOCOL={0x5}, @IPSET_ATTR_PROTOCOL={0x5}, @IPSET_ATTR_PROTOCOL={0x5}]}, 0x48}, 0x1, 0x0, 0x0, 0x10}, 0x0) openat$binderfs(0xffffffffffffff9c, &(0x7f0000000d80)='./binderfs2/custom0\x00', 0x1, 0x0) r5 = openat$procfs(0xffffffffffffff9c, &(0x7f0000000dc0)='/proc/cpuinfo\x00', 0x0, 0x0) fsmount(r5, 0x1, 0x2) ioctl$TIOCSERGETLSR(r1, 0x5459, &(0x7f0000000e00)) openat$ttyS3(0xffffffffffffff9c, &(0x7f0000000e80), 0x4a80, 0x0) 00:52:46 executing program 3: clone(0x400, &(0x7f0000000000)="2f59adb4fe8bdd18e28d59f811fee00f6e", &(0x7f0000000040), &(0x7f0000000080), &(0x7f00000000c0)="ee4468595a6a9e17d313ddea1158c7520b4ce752e1feceb8bd763f38764fe32d5b11f9842e25fb3843f95d48bcbb676b94dc456e5f562cd49d08bd5ac38eb9d6acfc2fa3928b3de489313465b4bea18ac19b9efcb135738e957c5dfaa38b9755182fa0eb46bac360130ee66e2636e1d6aafb8e5918d6d0f8338603cd9bd3e0f3b5d106eae77f68fc50df9f58fd8061a03c31d04b3551c672a8334c0f3bd81aea189fc02f258c22a8b0dba2a60f9a458d6eff75d32cf215930f0bccd5f8ee1d8d33a86c5eda24ec311adc") ioctl$CDROMREADMODE1(0xffffffffffffffff, 0x530d, &(0x7f00000001c0)={0x8, 0x81, 0x4, 0x1, 0x1, 0x8}) ioctl$CDROMREADRAW(0xffffffffffffffff, 0x5314, &(0x7f0000000c40)={0x1, 0x5, 0x7, 0xe5, 0x2, 0x81}) r0 = openat$zero(0xffffffffffffff9c, &(0x7f00000016c0), 0x0, 0x0) ioctl$CDROMSTART(r0, 0x5308) rt_sigaction(0xf, &(0x7f0000001780)={&(0x7f0000001700)="66430f3a15df22c402d937a80e000000f347241ac44218f34ce000c4a2b528e8db5a2466440f38014fdb660f3810b006a50000c421fc295a0cdcf1", 0x80000004, &(0x7f0000001740)="642e41dde78f684ca2df01416dc463755c460b34f3460fa6c0c4c11b7cc7c442f1ad5b00f0430fab6b000f0f62f79af046f71c54", {[0xfffffffffffffffe]}}, &(0x7f0000001840)={&(0x7f00000017c0)="f240af66e20067363666460ffa6f5136360f974700c48165da31c422050c1ec4c17a6fbb2f000000c4027d2074f407f2430f1a39ff30", 0x0, &(0x7f0000001800)="c462394627defbc401f1d3cac46159de6e1fc4816c58a20700000066430faef2c4c16b7c9f0300000066400f6620f0ff0500000000c4e111d2f9"}, 0x8, &(0x7f0000001880)) timerfd_create(0x9, 0x800) prctl$PR_GET_FPEXC(0xb, &(0x7f00000018c0)) recvmmsg(r0, &(0x7f0000003c40)=[{{&(0x7f0000001900)=@pppol2tp={0x18, 0x1, {0x0, 0xffffffffffffffff, {0x2, 0x0, @empty}}}, 0x80, &(0x7f00000029c0)=[{&(0x7f0000001980)=""/39, 0x27}, {&(0x7f00000019c0)=""/4096, 0x1000}], 0x2, &(0x7f0000002a00)=""/18, 0x12}, 0x3f}, {{&(0x7f0000002a40)=@nfc, 0x80, &(0x7f0000002e80)=[{&(0x7f0000002ac0)=""/44, 0x2c}, {&(0x7f0000002b00)=""/65, 0x41}, {&(0x7f0000002b80)=""/107, 0x6b}, {&(0x7f0000002c00)=""/158, 0x9e}, {&(0x7f0000002cc0)=""/169, 0xa9}, {&(0x7f0000002d80)=""/57, 0x39}, {&(0x7f0000002dc0)=""/160, 0xa0}], 0x7}, 0x6}, {{&(0x7f0000002f00)=@x25={0x9, @remote}, 0x80, &(0x7f0000003100)=[{&(0x7f0000002f80)=""/101, 0x65}, {&(0x7f0000003000)}, {&(0x7f0000003040)=""/187, 0xbb}], 0x3, &(0x7f0000003140)=""/159, 0x9f}, 0xffffffff}, {{&(0x7f0000003200)=@ll={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @dev}, 0x80, &(0x7f0000003400)=[{&(0x7f0000003280)=""/29, 0x1d}, {&(0x7f00000032c0)=""/41, 0x29}, {&(0x7f0000003300)=""/219, 0xdb}], 0x3, &(0x7f0000003440)=""/204, 0xcc}, 0x2f62}, {{&(0x7f0000003540)=@hci, 0x80, &(0x7f0000003b80)=[{&(0x7f00000035c0)=""/168, 0xa8}, {&(0x7f0000003680)=""/128, 0x80}, {&(0x7f0000003700)=""/75, 0x4b}, {&(0x7f0000003780)=""/189, 0xbd}, {&(0x7f0000003840)=""/168, 0xa8}, {&(0x7f0000003900)=""/132, 0x84}, {&(0x7f00000039c0)=""/162, 0xa2}, {&(0x7f0000003a80)=""/198, 0xc6}], 0x8, &(0x7f0000003c00)=""/25, 0x19}, 0xfc00}], 0x5, 0x21, &(0x7f0000003d80)) r2 = socket$netlink(0x10, 0x3, 0xe) syz_genetlink_get_family_id$smc(&(0x7f0000003dc0), r2) timerfd_create(0x6, 0x800) ioctl$BINDER_THREAD_EXIT(r0, 0x40046208, 0x0) epoll_ctl$EPOLL_CTL_MOD(r0, 0x3, r1, &(0x7f0000003e00)={0xb0000000}) r3 = io_uring_setup(0x35ea, &(0x7f0000003e40)={0x0, 0x7cfa, 0x2, 0x0, 0x210, 0x0, r0}) io_uring_setup(0x106d, &(0x7f0000003ec0)={0x0, 0xb36, 0x1e, 0x1, 0xa7, 0x0, r3}) sendmsg$NBD_CMD_STATUS(0xffffffffffffffff, &(0x7f0000004040)={&(0x7f0000003f40)={0x10, 0x0, 0x0, 0x8}, 0xc, &(0x7f0000004000)={&(0x7f0000003f80)={0x6c, 0x0, 0x20, 0x70bd2a, 0x25dfdbff, {}, [@NBD_ATTR_DEAD_CONN_TIMEOUT={0xc, 0x8, 0x68b2}, @NBD_ATTR_SIZE_BYTES={0xc, 0x2, 0x1f}, @NBD_ATTR_SIZE_BYTES={0xc, 0x2, 0x8}, @NBD_ATTR_TIMEOUT={0xc, 0x4, 0x6}, @NBD_ATTR_DEAD_CONN_TIMEOUT={0xc, 0x8, 0x3}, @NBD_ATTR_CLIENT_FLAGS={0xc, 0x6, 0x1}, @NBD_ATTR_INDEX={0x8, 0x1, 0x0}, @NBD_ATTR_INDEX={0x8, 0x1, 0x0}]}, 0x6c}, 0x1, 0x0, 0x0, 0x40840}, 0x10) syz_genetlink_get_family_id$nbd(&(0x7f00000040c0), 0xffffffffffffffff) fsmount(r0, 0x0, 0xf0) 00:52:46 executing program 0: r0 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$ieee802154(&(0x7f0000000040), 0xffffffffffffffff) ioctl$sock_SIOCGIFINDEX_802154(0xffffffffffffffff, 0x8933, &(0x7f0000000080)={'wpan0\x00', 0x0}) sendmsg$IEEE802154_LLSEC_DEL_DEVKEY(r0, &(0x7f0000000140)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x2000000}, 0xc, &(0x7f0000000100)={&(0x7f00000000c0)={0x38, r1, 0x2, 0x70bd27, 0x25dfdbfb, {}, [@IEEE802154_ATTR_LLSEC_KEY_SOURCE_SHORT={0x8, 0x2c, 0xee0}, @IEEE802154_ATTR_PAN_ID={0x6, 0x6, 0xffff}, @IEEE802154_ATTR_DEV_INDEX={0x8, 0x2, r2}, @IEEE802154_ATTR_LLSEC_KEY_SOURCE_EXTENDED={0xc, 0x2d, {0xaaaaaaaaaaaa0002}}]}, 0x38}}, 0x4) r3 = syz_genetlink_get_family_id$ieee802154(&(0x7f00000001c0), r0) sendmsg$IEEE802154_LLSEC_ADD_KEY(r0, &(0x7f00000002c0)={&(0x7f0000000180)={0x10, 0x0, 0x0, 0x80}, 0xc, &(0x7f0000000280)={&(0x7f0000000200)={0x70, r3, 0x8dc3595b298c372b, 0x70bd2c, 0x25dfdbfd, {}, [@IEEE802154_ATTR_HW_ADDR={0xc, 0x5, {0xaaaaaaaaaaaa0302}}, @IEEE802154_ATTR_LLSEC_KEY_SOURCE_EXTENDED={0xc, 0x2d, {0xaaaaaaaaaaaa0202}}, @IEEE802154_ATTR_HW_ADDR={0xc, 0x5, {0xaaaaaaaaaaaa0002}}, @IEEE802154_ATTR_LLSEC_KEY_USAGE_FRAME_TYPES={0x5, 0x31, 0x81}, @IEEE802154_ATTR_DEV_NAME={0xa, 0x1, 'wpan1\x00'}, @IEEE802154_ATTR_LLSEC_KEY_USAGE_COMMANDS={0x24, 0x32, "c38d2be0aa0107a2b38f85915a757ba51ff3d89ac2e1c596dce3055b00418226"}]}, 0x70}, 0x1, 0x0, 0x0, 0x20004040}, 0x0) r4 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) sendmsg$IEEE802154_ASSOCIATE_RESP(r4, &(0x7f0000000400)={&(0x7f0000000300)={0x10, 0x0, 0x0, 0x2000000}, 0xc, &(0x7f00000003c0)={&(0x7f0000000340)={0x60, r3, 0x200, 0x70bd26, 0x25dfdbfd, {}, [@IEEE802154_ATTR_COORD_HW_ADDR={0xc}, @IEEE802154_ATTR_STATUS={0x5, 0x3, 0x40}, @IEEE802154_ATTR_STATUS={0x5, 0x3, 0x1}, @IEEE802154_ATTR_COORD_HW_ADDR={0xc, 0x9, {0x2c841fbeb2fffbec}}, @IEEE802154_ATTR_COORD_HW_ADDR={0xc, 0x9, {0xaaaaaaaaaaaa0202}}, @IEEE802154_ATTR_STATUS={0x5, 0x3, 0x6}, @IEEE802154_ATTR_STATUS={0x5, 0x3, 0x3f}, @IEEE802154_ATTR_COORD_SHORT_ADDR={0x6, 0x8, 0xffff}]}, 0x60}, 0x1, 0x0, 0x0, 0x20000000}, 0x20000080) ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, &(0x7f0000000540)={0xc, 0x0, &(0x7f0000000440)=[@dead_binder_done], 0xbf, 0x0, &(0x7f0000000480)="0537636f85beafebd2a00648fb042246bcbd2150d45e58acedd2718aaa529794fc45c87c914f2b69b82fedb220d6a94b2babd3f188631b48d025c32a8342250d69582838e7ee6d22fa335ce4315412805f50869d3f4bef11a5bb26ac3704b717f9416fc1f441d5dd77d4b3c1a283f3179a7daf20c0d30210361ea15f09fd38e2c2ac52383e1685a787783f4524fd7d784046605442e441fb76b236455574d7fe70d1885d924099864313d8d3d84c106a36d2ccc77c51d3cdaf3f716551fc0a"}) r5 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) syz_genetlink_get_family_id$ieee802154(&(0x7f0000000580), r5) sendmsg$IEEE802154_SET_MACPARAMS(r0, &(0x7f0000000680)={&(0x7f00000005c0)={0x10, 0x0, 0x0, 0x1000}, 0xc, &(0x7f0000000640)={&(0x7f0000000600)={0x2c, r3, 0x2, 0x70bd2d, 0x25dfdbfd, {}, [@IEEE802154_ATTR_CCA_ED_LEVEL={0x8, 0x24, 0x7fffffff}, @IEEE802154_ATTR_TXPOWER={0x5, 0x21, 0x3}, @IEEE802154_ATTR_CSMA_MAX_BE={0x5, 0x27, 0x4}]}, 0x2c}, 0x1, 0x0, 0x0, 0x40801}, 0x40840) r6 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) sendmsg$IEEE802154_LLSEC_DEL_SECLEVEL(r6, &(0x7f00000007c0)={&(0x7f00000006c0)={0x10, 0x0, 0x0, 0x40000000}, 0xc, &(0x7f0000000780)={&(0x7f0000000700)={0x44, r3, 0x300, 0x70bd2a, 0x25dfdbfb, {}, [@IEEE802154_ATTR_DEV_INDEX={0x8, 0x2, r2}, @IEEE802154_ATTR_LLSEC_FRAME_TYPE={0x5, 0x33, 0x1f}, @IEEE802154_ATTR_LLSEC_FRAME_TYPE={0x5, 0x33, 0x7}, @IEEE802154_ATTR_LLSEC_CMD_FRAME_ID={0x5, 0x34, 0xcb}, @IEEE802154_ATTR_LLSEC_DEV_OVERRIDE={0x5, 0x36, 0x1}, @IEEE802154_ATTR_LLSEC_CMD_FRAME_ID={0x5, 0x34, 0x1}]}, 0x44}, 0x1, 0x0, 0x0, 0x40000a1}, 0x4800) r7 = syz_genetlink_get_family_id$ieee802154(&(0x7f0000000840), r6) sendmsg$IEEE802154_LLSEC_DEL_DEV(r6, &(0x7f0000000940)={&(0x7f0000000800)={0x10, 0x0, 0x0, 0x2000}, 0xc, &(0x7f0000000900)={&(0x7f0000000880)={0x6c, r7, 0x100, 0x70bd26, 0x25dfdbfe, {}, [@IEEE802154_ATTR_HW_ADDR={0xc, 0x5, {0xaaaaaaaaaaaa0202}}, @IEEE802154_ATTR_HW_ADDR={0xc, 0x5, {0xaaaaaaaaaaaa0302}}, @IEEE802154_ATTR_DEV_INDEX={0x8, 0x2, r2}, @IEEE802154_ATTR_HW_ADDR={0xc}, @IEEE802154_ATTR_DEV_NAME={0xa, 0x1, 'wpan1\x00'}, @IEEE802154_ATTR_HW_ADDR={0xc, 0x5, {0xaaaaaaaaaaaa0302}}, @IEEE802154_ATTR_HW_ADDR={0xc}, @IEEE802154_ATTR_DEV_INDEX={0x8, 0x2, r2}]}, 0x6c}, 0x1, 0x0, 0x0, 0x41}, 0x20004040) ioctl$sock_SIOCGIFINDEX_802154(r5, 0x8933, &(0x7f00000009c0)={'wpan4\x00'}) sendmsg$IEEE802154_LLSEC_DEL_KEY(0xffffffffffffffff, &(0x7f0000000c80)={&(0x7f0000000b40)={0x10, 0x0, 0x0, 0x40000000}, 0xc, &(0x7f0000000c40)={&(0x7f0000000bc0)={0x58, 0x0, 0x402, 0x70bd2d, 0x25dfdbff, {}, [@IEEE802154_ATTR_LLSEC_KEY_MODE={0x5, 0x2b, 0x1}, @IEEE802154_ATTR_DEV_NAME={0xa, 0x1, 'wpan3\x00'}, @IEEE802154_ATTR_LLSEC_KEY_SOURCE_EXTENDED={0xc, 0x2d, {0xaaaaaaaaaaaa0302}}, @IEEE802154_ATTR_LLSEC_KEY_ID={0x5, 0x2e, 0x4}, @IEEE802154_ATTR_LLSEC_KEY_ID={0x5, 0x2e, 0x3}, @IEEE802154_ATTR_SHORT_ADDR={0x6, 0x4, 0xfffd}, @IEEE802154_ATTR_HW_ADDR={0xc}]}, 0x58}, 0x1, 0x0, 0x0, 0x40800}, 0x24040000) 00:52:46 executing program 7: r0 = openat$procfs(0xffffffffffffff9c, &(0x7f0000000000)='/proc/mdstat\x00', 0x0, 0x0) mmap$IORING_OFF_CQ_RING(&(0x7f0000ffc000/0x2000)=nil, 0x2000, 0x8, 0x4010, r0, 0x8000000) r1 = openat$cdrom(0xffffffffffffff9c, &(0x7f0000000040), 0xb0840, 0x0) ioctl$CDROM_LOCKDOOR(r1, 0x5329, 0x1) r2 = openat$procfs(0xffffffffffffff9c, &(0x7f0000000080)='/proc/slabinfo\x00', 0x0, 0x0) epoll_ctl$EPOLL_CTL_DEL(r2, 0x2, r0) r3 = fsmount(r2, 0x0, 0x7f) ioctl$CDROMREADMODE1(r3, 0x530d, &(0x7f00000000c0)={0x7, 0x1f, 0x3, 0x81, 0xf3, 0x7b}) mprotect(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x1000008) mmap$IORING_OFF_CQ_RING(&(0x7f0000ffe000/0x1000)=nil, 0x1000, 0x2, 0x80010, r3, 0x8000000) socketpair$nbd(0x1, 0x1, 0x0, &(0x7f0000000d80)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$sock_SIOCGIFINDEX_80211(r4, 0x8933, &(0x7f0000000dc0)={'wlan1\x00'}) r5 = syz_genetlink_get_family_id$batadv(&(0x7f0000000e40), r0) sendmsg$BATADV_CMD_GET_ORIGINATORS(r3, &(0x7f0000000f00)={&(0x7f0000000e00)={0x10, 0x0, 0x0, 0x400000}, 0xc, &(0x7f0000000ec0)={&(0x7f0000000e80)={0x34, r5, 0x2, 0x70bd29, 0x25dfdbff, {}, [@BATADV_ATTR_THROUGHPUT_OVERRIDE={0x8, 0x3b, 0x8}, @BATADV_ATTR_BRIDGE_LOOP_AVOIDANCE_ENABLED={0x5, 0x2e, 0x1}, @BATADV_ATTR_FRAGMENTATION_ENABLED={0x5, 0x30, 0x1}, @BATADV_ATTR_TPMETER_TEST_TIME={0x8, 0xb, 0xfffffffb}]}, 0x34}, 0x1, 0x0, 0x0, 0x20000000}, 0x4000000) ioctl$CDROM_GET_CAPABILITY(0xffffffffffffffff, 0x5331) r6 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) syz_genetlink_get_family_id$nbd(&(0x7f0000000f80), 0xffffffffffffffff) sendmsg$NBD_CMD_DISCONNECT(r6, &(0x7f00000011c0)={&(0x7f00000010c0)={0x10, 0x0, 0x0, 0x4000}, 0xc, &(0x7f0000001180)={&(0x7f0000001140)={0x20, 0x0, 0x20, 0x70bd25, 0x25dfdbfe, {}, [@NBD_ATTR_BLOCK_SIZE_BYTES={0xc, 0x3, 0x9de}]}, 0x20}, 0x1, 0x0, 0x0, 0x20004000}, 0x200000c5) 00:52:46 executing program 1: r0 = openat$zero(0xffffffffffffff9c, &(0x7f0000000000), 0x400200, 0x0) ioctl$SECCOMP_IOCTL_NOTIF_ADDFD(r0, 0x40182103, &(0x7f0000000040)={0x0, 0x1, 0xffffffffffffffff, 0x80000000, 0x80000}) r1 = syz_genetlink_get_family_id$batadv(&(0x7f00000000c0), r0) sendmsg$BATADV_CMD_GET_TRANSTABLE_LOCAL(r0, &(0x7f00000001c0)={&(0x7f0000000080)={0x10, 0x0, 0x0, 0x80000}, 0xc, &(0x7f0000000180)={&(0x7f0000000100)={0x54, r1, 0x200, 0x70bd25, 0x25dfdbff, {}, [@BATADV_ATTR_THROUGHPUT_OVERRIDE={0x8, 0x3b, 0x89}, @BATADV_ATTR_THROUGHPUT_OVERRIDE={0x8, 0x3b, 0xffff}, @BATADV_ATTR_FRAGMENTATION_ENABLED={0x5}, @BATADV_ATTR_AGGREGATED_OGMS_ENABLED={0x5}, @BATADV_ATTR_MULTICAST_FORCEFLOOD_ENABLED={0x5}, @BATADV_ATTR_BRIDGE_LOOP_AVOIDANCE_ENABLED={0x5}, @BATADV_ATTR_HARD_IFINDEX={0x8}, @BATADV_ATTR_GW_MODE={0x5, 0x33, 0x1}]}, 0x54}, 0x1, 0x0, 0x0, 0x48041}, 0x4840) r2 = openat$procfs(0xffffffffffffff9c, &(0x7f0000000200)='/proc/cpuinfo\x00', 0x0, 0x0) sendmsg$BATADV_CMD_GET_GATEWAYS(r2, &(0x7f0000000340)={&(0x7f0000000240)={0x10, 0x0, 0x0, 0x1000000}, 0xc, &(0x7f0000000300)={&(0x7f0000000280)={0x50, r1, 0x400, 0x70bd26, 0x25dfdbfb, {}, [@BATADV_ATTR_BRIDGE_LOOP_AVOIDANCE_ENABLED={0x5, 0x2e, 0x1}, @BATADV_ATTR_ISOLATION_MARK={0x8, 0x2b, 0x3}, @BATADV_ATTR_BONDING_ENABLED={0x5}, @BATADV_ATTR_BRIDGE_LOOP_AVOIDANCE_ENABLED={0x5, 0x2e, 0x1}, @BATADV_ATTR_ORIG_ADDRESS={0xa, 0x9, @multicast}, @BATADV_ATTR_THROUGHPUT_OVERRIDE={0x8, 0x3b, 0x1}, @BATADV_ATTR_ISOLATION_MARK={0x8, 0x2b, 0x6}]}, 0x50}, 0x1, 0x0, 0x0, 0x20049800}, 0x80) r3 = syz_genetlink_get_family_id$batadv(&(0x7f00000003c0), r0) sendmsg$BATADV_CMD_SET_MESH(r0, &(0x7f0000000480)={&(0x7f0000000380)={0x10, 0x0, 0x0, 0x1000}, 0xc, &(0x7f0000000440)={&(0x7f0000000400)={0x34, r3, 0x400, 0x70bd2d, 0x25dfdbff, {}, [@BATADV_ATTR_GW_MODE={0x5}, @BATADV_ATTR_GW_BANDWIDTH_UP={0x8, 0x32, 0x8001}, @BATADV_ATTR_ORIG_INTERVAL={0x8, 0x39, 0x4}, @BATADV_ATTR_NETWORK_CODING_ENABLED={0x5, 0x38, 0x1}]}, 0x34}, 0x1, 0x0, 0x0, 0x4000000}, 0x18000) r4 = fsmount(r0, 0x1, 0x5) r5 = fsmount(r2, 0x1, 0x7a) epoll_ctl$EPOLL_CTL_ADD(r4, 0x1, r5, &(0x7f00000016c0)={0x80002000}) r6 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000001700), 0x111002, 0x0) epoll_ctl$EPOLL_CTL_MOD(r0, 0x3, r6, &(0x7f0000001740)) ioctl$SECCOMP_IOCTL_NOTIF_ID_VALID(r5, 0x40082102, &(0x7f0000001780)) rt_sigqueueinfo(0xffffffffffffffff, 0x2, &(0x7f00000017c0)={0x16, 0x5, 0x8}) ioctl$BINDER_SET_MAX_THREADS(r4, 0x40046205, &(0x7f0000001840)=0x4) r7 = syz_genetlink_get_family_id$ieee802154(&(0x7f00000018c0), 0xffffffffffffffff) sendmsg$IEEE802154_ASSOCIATE_RESP(0xffffffffffffffff, &(0x7f00000019c0)={&(0x7f0000001880)={0x10, 0x0, 0x0, 0x10}, 0xc, &(0x7f0000001980)={&(0x7f0000001900)={0x48, r7, 0x400, 0x70bd26, 0x25dfdbfc, {}, [@IEEE802154_ATTR_COORD_HW_ADDR={0xc, 0x9, {0x5555555555540004}}, @IEEE802154_ATTR_COORD_HW_ADDR={0xc, 0x9, {0xaaaaaaaaaaaa0302}}, @IEEE802154_ATTR_COORD_HW_ADDR={0xc, 0x9, {0xaaaaaaaaaaaa0002}}, @IEEE802154_ATTR_STATUS={0x5, 0x3, 0x88}, @IEEE802154_ATTR_STATUS={0x5, 0x3, 0x3}]}, 0x48}, 0x1, 0x0, 0x0, 0x800}, 0x810) 00:52:46 executing program 5: prctl$PR_GET_FPEXC(0xb, &(0x7f0000000000)) r0 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000040)='./binderfs/custom0\x00', 0x800, 0x0) ustat(0x800, &(0x7f0000000080)) ioctl$ifreq_SIOCGIFINDEX_batadv_mesh(0xffffffffffffffff, 0x8933, &(0x7f0000000100)={'batadv0\x00', 0x0}) ioctl$ifreq_SIOCGIFINDEX_batadv_hard(0xffffffffffffffff, 0x8933, &(0x7f0000000140)={'batadv_slave_0\x00', 0x0}) sendmsg$ETHTOOL_MSG_PAUSE_GET(0xffffffffffffffff, &(0x7f00000002c0)={&(0x7f00000000c0)={0x10, 0x0, 0x0, 0x10000}, 0xc, &(0x7f0000000280)={&(0x7f0000000180)={0xdc, 0x0, 0x8, 0x70bd27, 0x25dfdbfb, {}, [@HEADER={0x5c, 0x1, 0x0, 0x1, [@ETHTOOL_A_HEADER_DEV_INDEX={0x8, 0x1, r1}, @ETHTOOL_A_HEADER_FLAGS={0x8}, @ETHTOOL_A_HEADER_DEV_NAME={0x14, 0x2, 'veth0_vlan\x00'}, @ETHTOOL_A_HEADER_DEV_INDEX={0x8}, @ETHTOOL_A_HEADER_FLAGS={0x8, 0x3, 0x3}, @ETHTOOL_A_HEADER_FLAGS={0x8, 0x3, 0x2}, @ETHTOOL_A_HEADER_DEV_INDEX={0x8, 0x1, r2}, @ETHTOOL_A_HEADER_DEV_NAME={0x14, 0x2, 'macvlan0\x00'}]}, @HEADER={0x40, 0x1, 0x0, 0x1, [@ETHTOOL_A_HEADER_DEV_NAME={0x14, 0x2, 'veth0_to_bridge\x00'}, @ETHTOOL_A_HEADER_DEV_NAME={0x14, 0x2, 'veth0_to_bridge\x00'}, @ETHTOOL_A_HEADER_DEV_NAME={0x14, 0x2, 'netpci0\x00'}]}, @HEADER={0x2c, 0x1, 0x0, 0x1, [@ETHTOOL_A_HEADER_DEV_NAME={0x14, 0x2, 'bond_slave_1\x00'}, @ETHTOOL_A_HEADER_DEV_NAME={0x14, 0x2, 'ip_vti0\x00'}]}]}, 0xdc}, 0x1, 0x0, 0x0, 0x4000}, 0x24000000) sendmsg$NBD_CMD_STATUS(0xffffffffffffffff, &(0x7f0000000400)={&(0x7f0000000300)={0x10, 0x0, 0x0, 0x4}, 0xc, &(0x7f00000003c0)={&(0x7f0000000340)={0x44, 0x0, 0x20, 0x70bd2d, 0x25dfdbfc, {}, [@NBD_ATTR_SIZE_BYTES={0xc, 0x2, 0x4}, @NBD_ATTR_SOCKETS={0x24, 0x7, 0x0, 0x1, [{0x8}, {0x8}, {0x8}, {0x8}]}]}, 0x44}}, 0x4000) ioctl$BINDER_GET_NODE_DEBUG_INFO(r0, 0xc018620b, &(0x7f0000000440)={0x3}) syz_genetlink_get_family_id$batadv(&(0x7f0000000480), 0xffffffffffffffff) r3 = syz_open_dev$ttys(0xc, 0x2, 0x0) ioctl$TCSETAF(r3, 0x5408, &(0x7f00000004c0)={0x4, 0xb073, 0x1000, 0x1, 0x13, "b786e10fbdab60cc"}) openat$binderfs(0xffffffffffffff9c, &(0x7f0000000500)='./binderfs2/binder0\x00', 0x802, 0x0) sendmsg$BATADV_CMD_SET_VLAN(0xffffffffffffffff, &(0x7f0000000600)={&(0x7f0000000540)={0x10, 0x0, 0x0, 0x80000}, 0xc, &(0x7f00000005c0)={&(0x7f0000000580)={0x30, 0x0, 0x400, 0x70bd27, 0x25dfdbfb, {}, [@BATADV_ATTR_FRAGMENTATION_ENABLED={0x5, 0x30, 0x1}, @BATADV_ATTR_ORIG_ADDRESS={0xa, 0x9, @random="62836be88da6"}, @BATADV_ATTR_ISOLATION_MASK={0x8, 0x2c, 0x81}]}, 0x30}, 0x1, 0x0, 0x0, 0x8004}, 0x4c000) r4 = syz_open_dev$ttys(0xc, 0x2, 0x0) ioctl$TIOCEXCL(r4, 0x540c) syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) clone(0x28000800, &(0x7f0000000880)="b3f828035cfe9f8546c65ee8fffa58fb52d9bafabf363f0161cf01b4a2872006d34dcf860667a59d8c5631820a98c05b3989c5037ea89b5a58e8e9809cc008c7ae03db6bb845b2c189e79729a6d2c9a5440c276c7d0686adda809621c1d9723369157389ff141a56cbc54111ec7f92e8262b0c9ab88b9bffbb114333ab5a9711171c09e2589351fa4950d7af92bccf71585c21606994d6b4443d2cb6725d2c983a62f6f0", &(0x7f0000000940), &(0x7f0000000980), &(0x7f00000009c0)="073c516951c56a5fb1d10f1151ef77ee30e71fea92d34f29ddbe9265f84a8e761f6f56055bef1048f67ec1da822c677e9c34d5d52feb791c13c75661003151c2a956098cc6") 00:52:46 executing program 6: ioctl$sock_SIOCGIFINDEX_802154(0xffffffffffffffff, 0x8933, &(0x7f0000000000)={'wpan1\x00', 0x0}) r1 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) ioctl$sock_SIOCGIFINDEX_802154(0xffffffffffffffff, 0x8933, &(0x7f0000000080)={'wpan3\x00', 0x0}) sendmsg$IEEE802154_LLSEC_ADD_SECLEVEL(r1, &(0x7f0000000140)={&(0x7f0000000040)={0x10, 0x0, 0x0, 0x800000}, 0xc, &(0x7f0000000100)={&(0x7f00000000c0)={0x2c, 0x0, 0x400, 0x70bd2a, 0x25dfdbfe, {}, [@IEEE802154_ATTR_DEV_INDEX={0x8, 0x2, r0}, @IEEE802154_ATTR_DEV_INDEX={0x8, 0x2, r0}, @IEEE802154_ATTR_DEV_INDEX={0x8, 0x2, r2}]}, 0x2c}, 0x1, 0x0, 0x0, 0x4004081}, 0x10) sendmsg$IEEE802154_LLSEC_DEL_KEY(r1, &(0x7f0000000240)={&(0x7f0000000180)={0x10, 0x0, 0x0, 0x1000000}, 0xc, &(0x7f0000000200)={&(0x7f00000001c0)={0x3c, 0x0, 0x30e, 0x70bd25, 0x25dfdbfd, {}, [@IEEE802154_ATTR_HW_ADDR={0xc, 0x5, {0xaaaaaaaaaaaa0102}}, @IEEE802154_ATTR_LLSEC_KEY_SOURCE_EXTENDED={0xc, 0x2d, {0xaaaaaaaaaaaa0102}}, @IEEE802154_ATTR_LLSEC_KEY_SOURCE_SHORT={0x8, 0x2c, 0x5}, @IEEE802154_ATTR_DEV_INDEX={0x8}]}, 0x3c}, 0x1, 0x0, 0x0, 0x24041000}, 0x44) socketpair$nbd(0x1, 0x1, 0x0, &(0x7f0000002280)={0xffffffffffffffff}) r4 = openat$procfs(0xffffffffffffff9c, &(0x7f00000022c0)='/proc/asound/seq/clients\x00', 0x0, 0x0) socketpair$nbd(0x1, 0x1, 0x0, &(0x7f0000002300)={0xffffffffffffffff}) r6 = socket(0x1d, 0x3, 0x6) r7 = openat$zero(0xffffffffffffff9c, &(0x7f0000002340), 0x2, 0x0) socketpair$nbd(0x1, 0x1, 0x0, &(0x7f0000002380)={0xffffffffffffffff}) sendmsg$NBD_CMD_DISCONNECT(r1, &(0x7f0000002480)={&(0x7f0000000280)={0x10, 0x0, 0x0, 0x80000}, 0xc, &(0x7f0000002440)={&(0x7f00000023c0)={0x6c, 0x0, 0x400, 0x70bd27, 0x25dfdbfb, {}, [@NBD_ATTR_TIMEOUT={0xc, 0x4, 0x100000001}, @NBD_ATTR_SOCKETS={0x4c, 0x7, 0x0, 0x1, [{0x8, 0x1, r3}, {0x8, 0x1, r4}, {0x8}, {0x8, 0x1, r5}, {0x8}, {0x8, 0x1, r6}, {0x8, 0x1, r7}, {0x8, 0x1, r8}, {0x8}]}]}, 0x6c}, 0x1, 0x0, 0x0, 0x20000000}, 0x4000020) r9 = syz_genetlink_get_family_id$ieee802154(&(0x7f0000002500), r1) sendmsg$IEEE802154_LLSEC_LIST_SECLEVEL(r1, &(0x7f00000025c0)={&(0x7f00000024c0)={0x10, 0x0, 0x0, 0x4}, 0xc, &(0x7f0000002580)={&(0x7f0000002540)={0x14, r9, 0x100, 0x70bd25, 0x25dfdbfd, {}, ["", "", "", "", "", ""]}, 0x14}, 0x1, 0x0, 0x0, 0x11}, 0x20000084) r10 = syz_genetlink_get_family_id$nbd(&(0x7f0000002640), r1) sendmsg$NBD_CMD_RECONFIGURE(r1, &(0x7f0000002700)={&(0x7f0000002600)={0x10, 0x0, 0x0, 0x800}, 0xc, &(0x7f00000026c0)={&(0x7f0000002680)={0x3c, r10, 0x800, 0x70bd2b, 0x25dfdbfe, {}, [@NBD_ATTR_DEAD_CONN_TIMEOUT={0xc, 0x8, 0x9}, @NBD_ATTR_SERVER_FLAGS={0xc, 0x5, 0x8}, @NBD_ATTR_INDEX={0x8, 0x1, 0x0}, @NBD_ATTR_INDEX={0x8, 0x1, 0x0}]}, 0x3c}, 0x1, 0x0, 0x0, 0x4000}, 0x40) fsmount(r7, 0x0, 0x80) ioctl$TIOCGPTPEER(r7, 0x5441, 0xe5) 00:52:46 executing program 7: r0 = openat$procfs(0xffffffffffffff9c, &(0x7f0000000000)='/proc/mdstat\x00', 0x0, 0x0) mmap$IORING_OFF_CQ_RING(&(0x7f0000ffc000/0x2000)=nil, 0x2000, 0x8, 0x4010, r0, 0x8000000) r1 = openat$cdrom(0xffffffffffffff9c, &(0x7f0000000040), 0xb0840, 0x0) ioctl$CDROM_LOCKDOOR(r1, 0x5329, 0x1) r2 = openat$procfs(0xffffffffffffff9c, &(0x7f0000000080)='/proc/slabinfo\x00', 0x0, 0x0) epoll_ctl$EPOLL_CTL_DEL(r2, 0x2, r0) r3 = fsmount(r2, 0x0, 0x7f) ioctl$CDROMREADMODE1(r3, 0x530d, &(0x7f00000000c0)={0x7, 0x1f, 0x3, 0x81, 0xf3, 0x7b}) mprotect(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x1000008) mmap$IORING_OFF_CQ_RING(&(0x7f0000ffe000/0x1000)=nil, 0x1000, 0x2, 0x80010, r3, 0x8000000) socketpair$nbd(0x1, 0x1, 0x0, &(0x7f0000000d80)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$sock_SIOCGIFINDEX_80211(r4, 0x8933, &(0x7f0000000dc0)={'wlan1\x00'}) r5 = syz_genetlink_get_family_id$batadv(&(0x7f0000000e40), r0) sendmsg$BATADV_CMD_GET_ORIGINATORS(r3, &(0x7f0000000f00)={&(0x7f0000000e00)={0x10, 0x0, 0x0, 0x400000}, 0xc, &(0x7f0000000ec0)={&(0x7f0000000e80)={0x34, r5, 0x2, 0x70bd29, 0x25dfdbff, {}, [@BATADV_ATTR_THROUGHPUT_OVERRIDE={0x8, 0x3b, 0x8}, @BATADV_ATTR_BRIDGE_LOOP_AVOIDANCE_ENABLED={0x5, 0x2e, 0x1}, @BATADV_ATTR_FRAGMENTATION_ENABLED={0x5, 0x30, 0x1}, @BATADV_ATTR_TPMETER_TEST_TIME={0x8, 0xb, 0xfffffffb}]}, 0x34}, 0x1, 0x0, 0x0, 0x20000000}, 0x4000000) ioctl$CDROM_GET_CAPABILITY(0xffffffffffffffff, 0x5331) r6 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) sendmsg$NBD_CMD_DISCONNECT(r6, &(0x7f00000011c0)={&(0x7f00000010c0)={0x10, 0x0, 0x0, 0x4000}, 0xc, &(0x7f0000001180)={&(0x7f0000001140)={0x20, 0x0, 0x20, 0x70bd25, 0x25dfdbfe, {}, [@NBD_ATTR_BLOCK_SIZE_BYTES={0xc, 0x3, 0x9de}]}, 0x20}, 0x1, 0x0, 0x0, 0x20004000}, 0x200000c5) 00:52:54 executing program 0: r0 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$ieee802154(&(0x7f0000000040), 0xffffffffffffffff) ioctl$sock_SIOCGIFINDEX_802154(0xffffffffffffffff, 0x8933, &(0x7f0000000080)={'wpan0\x00', 0x0}) sendmsg$IEEE802154_LLSEC_DEL_DEVKEY(r0, &(0x7f0000000140)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x2000000}, 0xc, &(0x7f0000000100)={&(0x7f00000000c0)={0x38, r1, 0x2, 0x70bd27, 0x25dfdbfb, {}, [@IEEE802154_ATTR_LLSEC_KEY_SOURCE_SHORT={0x8, 0x2c, 0xee0}, @IEEE802154_ATTR_PAN_ID={0x6, 0x6, 0xffff}, @IEEE802154_ATTR_DEV_INDEX={0x8, 0x2, r2}, @IEEE802154_ATTR_LLSEC_KEY_SOURCE_EXTENDED={0xc, 0x2d, {0xaaaaaaaaaaaa0002}}]}, 0x38}}, 0x4) r3 = syz_genetlink_get_family_id$ieee802154(&(0x7f00000001c0), r0) sendmsg$IEEE802154_LLSEC_ADD_KEY(r0, &(0x7f00000002c0)={&(0x7f0000000180)={0x10, 0x0, 0x0, 0x80}, 0xc, &(0x7f0000000280)={&(0x7f0000000200)={0x70, r3, 0x8dc3595b298c372b, 0x70bd2c, 0x25dfdbfd, {}, [@IEEE802154_ATTR_HW_ADDR={0xc, 0x5, {0xaaaaaaaaaaaa0302}}, @IEEE802154_ATTR_LLSEC_KEY_SOURCE_EXTENDED={0xc, 0x2d, {0xaaaaaaaaaaaa0202}}, @IEEE802154_ATTR_HW_ADDR={0xc, 0x5, {0xaaaaaaaaaaaa0002}}, @IEEE802154_ATTR_LLSEC_KEY_USAGE_FRAME_TYPES={0x5, 0x31, 0x81}, @IEEE802154_ATTR_DEV_NAME={0xa, 0x1, 'wpan1\x00'}, @IEEE802154_ATTR_LLSEC_KEY_USAGE_COMMANDS={0x24, 0x32, "c38d2be0aa0107a2b38f85915a757ba51ff3d89ac2e1c596dce3055b00418226"}]}, 0x70}, 0x1, 0x0, 0x0, 0x20004040}, 0x0) r4 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) sendmsg$IEEE802154_ASSOCIATE_RESP(r4, &(0x7f0000000400)={&(0x7f0000000300)={0x10, 0x0, 0x0, 0x2000000}, 0xc, &(0x7f00000003c0)={&(0x7f0000000340)={0x60, r3, 0x200, 0x70bd26, 0x25dfdbfd, {}, [@IEEE802154_ATTR_COORD_HW_ADDR={0xc}, @IEEE802154_ATTR_STATUS={0x5, 0x3, 0x40}, @IEEE802154_ATTR_STATUS={0x5, 0x3, 0x1}, @IEEE802154_ATTR_COORD_HW_ADDR={0xc, 0x9, {0x2c841fbeb2fffbec}}, @IEEE802154_ATTR_COORD_HW_ADDR={0xc, 0x9, {0xaaaaaaaaaaaa0202}}, @IEEE802154_ATTR_STATUS={0x5, 0x3, 0x6}, @IEEE802154_ATTR_STATUS={0x5, 0x3, 0x3f}, @IEEE802154_ATTR_COORD_SHORT_ADDR={0x6, 0x8, 0xffff}]}, 0x60}, 0x1, 0x0, 0x0, 0x20000000}, 0x20000080) ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, &(0x7f0000000540)={0xc, 0x0, &(0x7f0000000440)=[@dead_binder_done], 0xbf, 0x0, &(0x7f0000000480)="0537636f85beafebd2a00648fb042246bcbd2150d45e58acedd2718aaa529794fc45c87c914f2b69b82fedb220d6a94b2babd3f188631b48d025c32a8342250d69582838e7ee6d22fa335ce4315412805f50869d3f4bef11a5bb26ac3704b717f9416fc1f441d5dd77d4b3c1a283f3179a7daf20c0d30210361ea15f09fd38e2c2ac52383e1685a787783f4524fd7d784046605442e441fb76b236455574d7fe70d1885d924099864313d8d3d84c106a36d2ccc77c51d3cdaf3f716551fc0a"}) r5 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) syz_genetlink_get_family_id$ieee802154(&(0x7f0000000580), r5) sendmsg$IEEE802154_SET_MACPARAMS(r0, &(0x7f0000000680)={&(0x7f00000005c0)={0x10, 0x0, 0x0, 0x1000}, 0xc, &(0x7f0000000640)={&(0x7f0000000600)={0x2c, r3, 0x2, 0x70bd2d, 0x25dfdbfd, {}, [@IEEE802154_ATTR_CCA_ED_LEVEL={0x8, 0x24, 0x7fffffff}, @IEEE802154_ATTR_TXPOWER={0x5, 0x21, 0x3}, @IEEE802154_ATTR_CSMA_MAX_BE={0x5, 0x27, 0x4}]}, 0x2c}, 0x1, 0x0, 0x0, 0x40801}, 0x40840) r6 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) sendmsg$IEEE802154_LLSEC_DEL_SECLEVEL(r6, &(0x7f00000007c0)={&(0x7f00000006c0)={0x10, 0x0, 0x0, 0x40000000}, 0xc, &(0x7f0000000780)={&(0x7f0000000700)={0x44, r3, 0x300, 0x70bd2a, 0x25dfdbfb, {}, [@IEEE802154_ATTR_DEV_INDEX={0x8, 0x2, r2}, @IEEE802154_ATTR_LLSEC_FRAME_TYPE={0x5, 0x33, 0x1f}, @IEEE802154_ATTR_LLSEC_FRAME_TYPE={0x5, 0x33, 0x7}, @IEEE802154_ATTR_LLSEC_CMD_FRAME_ID={0x5, 0x34, 0xcb}, @IEEE802154_ATTR_LLSEC_DEV_OVERRIDE={0x5, 0x36, 0x1}, @IEEE802154_ATTR_LLSEC_CMD_FRAME_ID={0x5, 0x34, 0x1}]}, 0x44}, 0x1, 0x0, 0x0, 0x40000a1}, 0x4800) r7 = syz_genetlink_get_family_id$ieee802154(&(0x7f0000000840), r6) sendmsg$IEEE802154_LLSEC_DEL_DEV(r6, &(0x7f0000000940)={&(0x7f0000000800)={0x10, 0x0, 0x0, 0x2000}, 0xc, &(0x7f0000000900)={&(0x7f0000000880)={0x6c, r7, 0x100, 0x70bd26, 0x25dfdbfe, {}, [@IEEE802154_ATTR_HW_ADDR={0xc, 0x5, {0xaaaaaaaaaaaa0202}}, @IEEE802154_ATTR_HW_ADDR={0xc, 0x5, {0xaaaaaaaaaaaa0302}}, @IEEE802154_ATTR_DEV_INDEX={0x8, 0x2, r2}, @IEEE802154_ATTR_HW_ADDR={0xc}, @IEEE802154_ATTR_DEV_NAME={0xa, 0x1, 'wpan1\x00'}, @IEEE802154_ATTR_HW_ADDR={0xc, 0x5, {0xaaaaaaaaaaaa0302}}, @IEEE802154_ATTR_HW_ADDR={0xc}, @IEEE802154_ATTR_DEV_INDEX={0x8, 0x2, r2}]}, 0x6c}, 0x1, 0x0, 0x0, 0x41}, 0x20004040) sendmsg$IEEE802154_LLSEC_DEL_KEY(0xffffffffffffffff, &(0x7f0000000c80)={&(0x7f0000000b40)={0x10, 0x0, 0x0, 0x40000000}, 0xc, &(0x7f0000000c40)={&(0x7f0000000bc0)={0x58, 0x0, 0x402, 0x70bd2d, 0x25dfdbff, {}, [@IEEE802154_ATTR_LLSEC_KEY_MODE={0x5, 0x2b, 0x1}, @IEEE802154_ATTR_DEV_NAME={0xa, 0x1, 'wpan3\x00'}, @IEEE802154_ATTR_LLSEC_KEY_SOURCE_EXTENDED={0xc, 0x2d, {0xaaaaaaaaaaaa0302}}, @IEEE802154_ATTR_LLSEC_KEY_ID={0x5, 0x2e, 0x4}, @IEEE802154_ATTR_LLSEC_KEY_ID={0x5, 0x2e, 0x3}, @IEEE802154_ATTR_SHORT_ADDR={0x6, 0x4, 0xfffd}, @IEEE802154_ATTR_HW_ADDR={0xc}]}, 0x58}, 0x1, 0x0, 0x0, 0x40800}, 0x24040000) 00:52:54 executing program 1: r0 = openat$zero(0xffffffffffffff9c, &(0x7f0000000000), 0x400200, 0x0) ioctl$SECCOMP_IOCTL_NOTIF_ADDFD(r0, 0x40182103, &(0x7f0000000040)={0x0, 0x1, 0xffffffffffffffff, 0x80000000, 0x80000}) r1 = syz_genetlink_get_family_id$batadv(&(0x7f00000000c0), r0) sendmsg$BATADV_CMD_GET_TRANSTABLE_LOCAL(r0, &(0x7f00000001c0)={&(0x7f0000000080)={0x10, 0x0, 0x0, 0x80000}, 0xc, &(0x7f0000000180)={&(0x7f0000000100)={0x54, r1, 0x200, 0x70bd25, 0x25dfdbff, {}, [@BATADV_ATTR_THROUGHPUT_OVERRIDE={0x8, 0x3b, 0x89}, @BATADV_ATTR_THROUGHPUT_OVERRIDE={0x8, 0x3b, 0xffff}, @BATADV_ATTR_FRAGMENTATION_ENABLED={0x5}, @BATADV_ATTR_AGGREGATED_OGMS_ENABLED={0x5}, @BATADV_ATTR_MULTICAST_FORCEFLOOD_ENABLED={0x5}, @BATADV_ATTR_BRIDGE_LOOP_AVOIDANCE_ENABLED={0x5}, @BATADV_ATTR_HARD_IFINDEX={0x8}, @BATADV_ATTR_GW_MODE={0x5, 0x33, 0x1}]}, 0x54}, 0x1, 0x0, 0x0, 0x48041}, 0x4840) r2 = openat$procfs(0xffffffffffffff9c, &(0x7f0000000200)='/proc/cpuinfo\x00', 0x0, 0x0) sendmsg$BATADV_CMD_GET_GATEWAYS(r2, &(0x7f0000000340)={&(0x7f0000000240)={0x10, 0x0, 0x0, 0x1000000}, 0xc, &(0x7f0000000300)={&(0x7f0000000280)={0x50, r1, 0x400, 0x70bd26, 0x25dfdbfb, {}, [@BATADV_ATTR_BRIDGE_LOOP_AVOIDANCE_ENABLED={0x5, 0x2e, 0x1}, @BATADV_ATTR_ISOLATION_MARK={0x8, 0x2b, 0x3}, @BATADV_ATTR_BONDING_ENABLED={0x5}, @BATADV_ATTR_BRIDGE_LOOP_AVOIDANCE_ENABLED={0x5, 0x2e, 0x1}, @BATADV_ATTR_ORIG_ADDRESS={0xa, 0x9, @multicast}, @BATADV_ATTR_THROUGHPUT_OVERRIDE={0x8, 0x3b, 0x1}, @BATADV_ATTR_ISOLATION_MARK={0x8, 0x2b, 0x6}]}, 0x50}, 0x1, 0x0, 0x0, 0x20049800}, 0x80) r3 = syz_genetlink_get_family_id$batadv(&(0x7f00000003c0), r0) sendmsg$BATADV_CMD_SET_MESH(r0, &(0x7f0000000480)={&(0x7f0000000380)={0x10, 0x0, 0x0, 0x1000}, 0xc, &(0x7f0000000440)={&(0x7f0000000400)={0x34, r3, 0x400, 0x70bd2d, 0x25dfdbff, {}, [@BATADV_ATTR_GW_MODE={0x5}, @BATADV_ATTR_GW_BANDWIDTH_UP={0x8, 0x32, 0x8001}, @BATADV_ATTR_ORIG_INTERVAL={0x8, 0x39, 0x4}, @BATADV_ATTR_NETWORK_CODING_ENABLED={0x5, 0x38, 0x1}]}, 0x34}, 0x1, 0x0, 0x0, 0x4000000}, 0x18000) r4 = fsmount(r0, 0x1, 0x5) r5 = fsmount(r2, 0x1, 0x7a) epoll_ctl$EPOLL_CTL_ADD(r4, 0x1, r5, &(0x7f00000016c0)={0x80002000}) r6 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000001700), 0x111002, 0x0) epoll_ctl$EPOLL_CTL_MOD(r0, 0x3, r6, &(0x7f0000001740)) ioctl$SECCOMP_IOCTL_NOTIF_ID_VALID(r5, 0x40082102, &(0x7f0000001780)) rt_sigqueueinfo(0xffffffffffffffff, 0x2, &(0x7f00000017c0)={0x16, 0x5, 0x8}) ioctl$BINDER_SET_MAX_THREADS(r4, 0x40046205, &(0x7f0000001840)=0x4) syz_genetlink_get_family_id$ieee802154(&(0x7f00000018c0), 0xffffffffffffffff) 00:52:54 executing program 3: clone(0x400, &(0x7f0000000000)="2f59adb4fe8bdd18e28d59f811fee00f6e", &(0x7f0000000040), &(0x7f0000000080), &(0x7f00000000c0)="ee4468595a6a9e17d313ddea1158c7520b4ce752e1feceb8bd763f38764fe32d5b11f9842e25fb3843f95d48bcbb676b94dc456e5f562cd49d08bd5ac38eb9d6acfc2fa3928b3de489313465b4bea18ac19b9efcb135738e957c5dfaa38b9755182fa0eb46bac360130ee66e2636e1d6aafb8e5918d6d0f8338603cd9bd3e0f3b5d106eae77f68fc50df9f58fd8061a03c31d04b3551c672a8334c0f3bd81aea189fc02f258c22a8b0dba2a60f9a458d6eff75d32cf215930f0bccd5f8ee1d8d33a86c5eda24ec311adc") ioctl$CDROMREADMODE1(0xffffffffffffffff, 0x530d, &(0x7f00000001c0)={0x8, 0x81, 0x4, 0x1, 0x1, 0x8}) ioctl$CDROMREADRAW(0xffffffffffffffff, 0x5314, &(0x7f0000000c40)={0x1, 0x5, 0x7, 0xe5, 0x2, 0x81}) r0 = openat$zero(0xffffffffffffff9c, &(0x7f00000016c0), 0x0, 0x0) ioctl$CDROMSTART(r0, 0x5308) rt_sigaction(0xf, &(0x7f0000001780)={&(0x7f0000001700)="66430f3a15df22c402d937a80e000000f347241ac44218f34ce000c4a2b528e8db5a2466440f38014fdb660f3810b006a50000c421fc295a0cdcf1", 0x80000004, &(0x7f0000001740)="642e41dde78f684ca2df01416dc463755c460b34f3460fa6c0c4c11b7cc7c442f1ad5b00f0430fab6b000f0f62f79af046f71c54", {[0xfffffffffffffffe]}}, &(0x7f0000001840)={&(0x7f00000017c0)="f240af66e20067363666460ffa6f5136360f974700c48165da31c422050c1ec4c17a6fbb2f000000c4027d2074f407f2430f1a39ff30", 0x0, &(0x7f0000001800)="c462394627defbc401f1d3cac46159de6e1fc4816c58a20700000066430faef2c4c16b7c9f0300000066400f6620f0ff0500000000c4e111d2f9"}, 0x8, &(0x7f0000001880)) timerfd_create(0x9, 0x800) prctl$PR_GET_FPEXC(0xb, &(0x7f00000018c0)) recvmmsg(r0, &(0x7f0000003c40)=[{{&(0x7f0000001900)=@pppol2tp={0x18, 0x1, {0x0, 0xffffffffffffffff, {0x2, 0x0, @empty}}}, 0x80, &(0x7f00000029c0)=[{&(0x7f0000001980)=""/39, 0x27}, {&(0x7f00000019c0)=""/4096, 0x1000}], 0x2, &(0x7f0000002a00)=""/18, 0x12}, 0x3f}, {{&(0x7f0000002a40)=@nfc, 0x80, &(0x7f0000002e80)=[{&(0x7f0000002ac0)=""/44, 0x2c}, {&(0x7f0000002b00)=""/65, 0x41}, {&(0x7f0000002b80)=""/107, 0x6b}, {&(0x7f0000002c00)=""/158, 0x9e}, {&(0x7f0000002cc0)=""/169, 0xa9}, {&(0x7f0000002d80)=""/57, 0x39}, {&(0x7f0000002dc0)=""/160, 0xa0}], 0x7}, 0x6}, {{&(0x7f0000002f00)=@x25={0x9, @remote}, 0x80, &(0x7f0000003100)=[{&(0x7f0000002f80)=""/101, 0x65}, {&(0x7f0000003000)}, {&(0x7f0000003040)=""/187, 0xbb}], 0x3, &(0x7f0000003140)=""/159, 0x9f}, 0xffffffff}, {{&(0x7f0000003200)=@ll={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @dev}, 0x80, &(0x7f0000003400)=[{&(0x7f0000003280)=""/29, 0x1d}, {&(0x7f00000032c0)=""/41, 0x29}, {&(0x7f0000003300)=""/219, 0xdb}], 0x3, &(0x7f0000003440)=""/204, 0xcc}, 0x2f62}, {{&(0x7f0000003540)=@hci, 0x80, &(0x7f0000003b80)=[{&(0x7f00000035c0)=""/168, 0xa8}, {&(0x7f0000003680)=""/128, 0x80}, {&(0x7f0000003700)=""/75, 0x4b}, {&(0x7f0000003780)=""/189, 0xbd}, {&(0x7f0000003840)=""/168, 0xa8}, {&(0x7f0000003900)=""/132, 0x84}, {&(0x7f00000039c0)=""/162, 0xa2}, {&(0x7f0000003a80)=""/198, 0xc6}], 0x8, &(0x7f0000003c00)=""/25, 0x19}, 0xfc00}], 0x5, 0x21, &(0x7f0000003d80)) r2 = socket$netlink(0x10, 0x3, 0xe) syz_genetlink_get_family_id$smc(&(0x7f0000003dc0), r2) timerfd_create(0x6, 0x800) ioctl$BINDER_THREAD_EXIT(r0, 0x40046208, 0x0) epoll_ctl$EPOLL_CTL_MOD(r0, 0x3, r1, &(0x7f0000003e00)={0xb0000000}) r3 = io_uring_setup(0x35ea, &(0x7f0000003e40)={0x0, 0x7cfa, 0x2, 0x0, 0x210, 0x0, r0}) io_uring_setup(0x106d, &(0x7f0000003ec0)={0x0, 0xb36, 0x1e, 0x1, 0xa7, 0x0, r3}) sendmsg$NBD_CMD_STATUS(0xffffffffffffffff, &(0x7f0000004040)={&(0x7f0000003f40)={0x10, 0x0, 0x0, 0x8}, 0xc, &(0x7f0000004000)={&(0x7f0000003f80)={0x6c, 0x0, 0x20, 0x70bd2a, 0x25dfdbff, {}, [@NBD_ATTR_DEAD_CONN_TIMEOUT={0xc, 0x8, 0x68b2}, @NBD_ATTR_SIZE_BYTES={0xc, 0x2, 0x1f}, @NBD_ATTR_SIZE_BYTES={0xc, 0x2, 0x8}, @NBD_ATTR_TIMEOUT={0xc, 0x4, 0x6}, @NBD_ATTR_DEAD_CONN_TIMEOUT={0xc, 0x8, 0x3}, @NBD_ATTR_CLIENT_FLAGS={0xc, 0x6, 0x1}, @NBD_ATTR_INDEX={0x8, 0x1, 0x0}, @NBD_ATTR_INDEX={0x8, 0x1, 0x0}]}, 0x6c}, 0x1, 0x0, 0x0, 0x40840}, 0x10) syz_genetlink_get_family_id$nbd(&(0x7f00000040c0), 0xffffffffffffffff) fsmount(r0, 0x0, 0xf0) 00:52:54 executing program 7: r0 = openat$procfs(0xffffffffffffff9c, &(0x7f0000000000)='/proc/mdstat\x00', 0x0, 0x0) mmap$IORING_OFF_CQ_RING(&(0x7f0000ffc000/0x2000)=nil, 0x2000, 0x8, 0x4010, r0, 0x8000000) r1 = openat$cdrom(0xffffffffffffff9c, &(0x7f0000000040), 0xb0840, 0x0) ioctl$CDROM_LOCKDOOR(r1, 0x5329, 0x1) r2 = openat$procfs(0xffffffffffffff9c, &(0x7f0000000080)='/proc/slabinfo\x00', 0x0, 0x0) epoll_ctl$EPOLL_CTL_DEL(r2, 0x2, r0) r3 = fsmount(r2, 0x0, 0x7f) ioctl$CDROMREADMODE1(r3, 0x530d, &(0x7f00000000c0)={0x7, 0x1f, 0x3, 0x81, 0xf3, 0x7b}) mprotect(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x1000008) mmap$IORING_OFF_CQ_RING(&(0x7f0000ffe000/0x1000)=nil, 0x1000, 0x2, 0x80010, r3, 0x8000000) socketpair$nbd(0x1, 0x1, 0x0, &(0x7f0000000d80)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$sock_SIOCGIFINDEX_80211(r4, 0x8933, &(0x7f0000000dc0)={'wlan1\x00'}) r5 = syz_genetlink_get_family_id$batadv(&(0x7f0000000e40), r0) sendmsg$BATADV_CMD_GET_ORIGINATORS(r3, &(0x7f0000000f00)={&(0x7f0000000e00)={0x10, 0x0, 0x0, 0x400000}, 0xc, &(0x7f0000000ec0)={&(0x7f0000000e80)={0x34, r5, 0x2, 0x70bd29, 0x25dfdbff, {}, [@BATADV_ATTR_THROUGHPUT_OVERRIDE={0x8, 0x3b, 0x8}, @BATADV_ATTR_BRIDGE_LOOP_AVOIDANCE_ENABLED={0x5, 0x2e, 0x1}, @BATADV_ATTR_FRAGMENTATION_ENABLED={0x5, 0x30, 0x1}, @BATADV_ATTR_TPMETER_TEST_TIME={0x8, 0xb, 0xfffffffb}]}, 0x34}, 0x1, 0x0, 0x0, 0x20000000}, 0x4000000) ioctl$CDROM_GET_CAPABILITY(0xffffffffffffffff, 0x5331) sendmsg$NBD_CMD_DISCONNECT(0xffffffffffffffff, &(0x7f00000011c0)={&(0x7f00000010c0)={0x10, 0x0, 0x0, 0x4000}, 0xc, &(0x7f0000001180)={&(0x7f0000001140)={0x20, 0x0, 0x20, 0x70bd25, 0x25dfdbfe, {}, [@NBD_ATTR_BLOCK_SIZE_BYTES={0xc, 0x3, 0x9de}]}, 0x20}, 0x1, 0x0, 0x0, 0x20004000}, 0x200000c5) 00:52:54 executing program 4: r0 = openat$ttyS3(0xffffffffffffff9c, &(0x7f0000000000), 0xa2000, 0x0) ioctl$TIOCSETD(r0, 0x5423, &(0x7f0000000040)=0x13) r1 = fsmount(0xffffffffffffffff, 0x1, 0x76) ioctl$TCSETAF(r1, 0x5408, &(0x7f0000000080)={0x5, 0x8001, 0x4, 0x8001, 0x15, "b45da66f02087ca7"}) ioctl$TCSETAF(r1, 0x5408, &(0x7f00000000c0)={0x5, 0x22c1, 0x800, 0x8, 0x5, "2b8c058f839aaa67"}) connect$netlink(r1, &(0x7f0000000100)=@proc={0x10, 0x0, 0x25dfdbfd, 0x2}, 0xc) r2 = syz_open_dev$tty1(0xc, 0x4, 0x4) ioctl$TCSETSF(r2, 0x5404, &(0x7f0000000140)={0x6, 0x2, 0x2, 0x80000001, 0x1b, "c2331e6388ffeb48419d467a4b791ad4343a96"}) ioctl$TIOCMGET(r1, 0x5415, &(0x7f0000000180)) ioctl$TCSETAF(r2, 0x5408, &(0x7f00000001c0)={0x11, 0x0, 0xfff, 0x7, 0xd, "3ae59dd65d54337c"}) r3 = timerfd_create(0x7, 0x800) timerfd_settime(r3, 0x1, &(0x7f0000000200), &(0x7f0000000240)) ioctl$TCSETAF(r2, 0x5408, &(0x7f0000000280)={0x1, 0x1, 0x3d4c, 0x200, 0x0, "73a709364d80b6c1"}) ioctl$PIO_UNIMAPCLR(0xffffffffffffffff, 0x4b68, &(0x7f00000002c0)={0x73, 0x1fe0, 0x8b}) ioctl$TCSETSF2(r2, 0x402c542d, &(0x7f0000000300)={0xffffffff, 0x0, 0x80000000, 0x9, 0x6, "35157e2ff53385c0969535964d148320e065e8", 0x6}) ioctl$KDGKBMETA(0xffffffffffffffff, 0x4b62, &(0x7f0000000340)) ioctl$TIOCGICOUNT(r2, 0x545d, 0x0) socket(0x16, 0x1, 0x9) 00:52:54 executing program 6: ioctl$sock_SIOCGIFINDEX_802154(0xffffffffffffffff, 0x8933, &(0x7f0000000000)={'wpan1\x00', 0x0}) r1 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) ioctl$sock_SIOCGIFINDEX_802154(0xffffffffffffffff, 0x8933, &(0x7f0000000080)={'wpan3\x00', 0x0}) sendmsg$IEEE802154_LLSEC_ADD_SECLEVEL(r1, &(0x7f0000000140)={&(0x7f0000000040)={0x10, 0x0, 0x0, 0x800000}, 0xc, &(0x7f0000000100)={&(0x7f00000000c0)={0x2c, 0x0, 0x400, 0x70bd2a, 0x25dfdbfe, {}, [@IEEE802154_ATTR_DEV_INDEX={0x8, 0x2, r0}, @IEEE802154_ATTR_DEV_INDEX={0x8, 0x2, r0}, @IEEE802154_ATTR_DEV_INDEX={0x8, 0x2, r2}]}, 0x2c}, 0x1, 0x0, 0x0, 0x4004081}, 0x10) sendmsg$IEEE802154_LLSEC_DEL_KEY(r1, &(0x7f0000000240)={&(0x7f0000000180)={0x10, 0x0, 0x0, 0x1000000}, 0xc, &(0x7f0000000200)={&(0x7f00000001c0)={0x3c, 0x0, 0x30e, 0x70bd25, 0x25dfdbfd, {}, [@IEEE802154_ATTR_HW_ADDR={0xc, 0x5, {0xaaaaaaaaaaaa0102}}, @IEEE802154_ATTR_LLSEC_KEY_SOURCE_EXTENDED={0xc, 0x2d, {0xaaaaaaaaaaaa0102}}, @IEEE802154_ATTR_LLSEC_KEY_SOURCE_SHORT={0x8, 0x2c, 0x5}, @IEEE802154_ATTR_DEV_INDEX={0x8}]}, 0x3c}, 0x1, 0x0, 0x0, 0x24041000}, 0x44) socketpair$nbd(0x1, 0x1, 0x0, &(0x7f0000002280)={0xffffffffffffffff}) r4 = openat$procfs(0xffffffffffffff9c, &(0x7f00000022c0)='/proc/asound/seq/clients\x00', 0x0, 0x0) socketpair$nbd(0x1, 0x1, 0x0, &(0x7f0000002300)={0xffffffffffffffff}) r6 = socket(0x1d, 0x3, 0x6) r7 = openat$zero(0xffffffffffffff9c, &(0x7f0000002340), 0x2, 0x0) socketpair$nbd(0x1, 0x1, 0x0, &(0x7f0000002380)={0xffffffffffffffff}) sendmsg$NBD_CMD_DISCONNECT(r1, &(0x7f0000002480)={&(0x7f0000000280)={0x10, 0x0, 0x0, 0x80000}, 0xc, &(0x7f0000002440)={&(0x7f00000023c0)={0x6c, 0x0, 0x400, 0x70bd27, 0x25dfdbfb, {}, [@NBD_ATTR_TIMEOUT={0xc, 0x4, 0x100000001}, @NBD_ATTR_SOCKETS={0x4c, 0x7, 0x0, 0x1, [{0x8, 0x1, r3}, {0x8, 0x1, r4}, {0x8}, {0x8, 0x1, r5}, {0x8}, {0x8, 0x1, r6}, {0x8, 0x1, r7}, {0x8, 0x1, r8}, {0x8}]}]}, 0x6c}, 0x1, 0x0, 0x0, 0x20000000}, 0x4000020) r9 = syz_genetlink_get_family_id$ieee802154(&(0x7f0000002500), r1) sendmsg$IEEE802154_LLSEC_LIST_SECLEVEL(r1, &(0x7f00000025c0)={&(0x7f00000024c0)={0x10, 0x0, 0x0, 0x4}, 0xc, &(0x7f0000002580)={&(0x7f0000002540)={0x14, r9, 0x100, 0x70bd25, 0x25dfdbfd, {}, ["", "", "", "", "", ""]}, 0x14}, 0x1, 0x0, 0x0, 0x11}, 0x20000084) r10 = syz_genetlink_get_family_id$nbd(&(0x7f0000002640), r1) sendmsg$NBD_CMD_RECONFIGURE(r1, &(0x7f0000002700)={&(0x7f0000002600)={0x10, 0x0, 0x0, 0x800}, 0xc, &(0x7f00000026c0)={&(0x7f0000002680)={0x3c, r10, 0x800, 0x70bd2b, 0x25dfdbfe, {}, [@NBD_ATTR_DEAD_CONN_TIMEOUT={0xc, 0x8, 0x9}, @NBD_ATTR_SERVER_FLAGS={0xc, 0x5, 0x8}, @NBD_ATTR_INDEX={0x8, 0x1, 0x0}, @NBD_ATTR_INDEX={0x8, 0x1, 0x0}]}, 0x3c}, 0x1, 0x0, 0x0, 0x4000}, 0x40) ioctl$TIOCGPTPEER(r7, 0x5441, 0xe5) 00:52:54 executing program 5: prctl$PR_GET_FPEXC(0xb, &(0x7f0000000000)) r0 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000040)='./binderfs/custom0\x00', 0x800, 0x0) ustat(0x800, &(0x7f0000000080)) ioctl$ifreq_SIOCGIFINDEX_batadv_mesh(0xffffffffffffffff, 0x8933, &(0x7f0000000100)={'batadv0\x00', 0x0}) ioctl$ifreq_SIOCGIFINDEX_batadv_hard(0xffffffffffffffff, 0x8933, &(0x7f0000000140)={'batadv_slave_0\x00', 0x0}) sendmsg$ETHTOOL_MSG_PAUSE_GET(0xffffffffffffffff, &(0x7f00000002c0)={&(0x7f00000000c0)={0x10, 0x0, 0x0, 0x10000}, 0xc, &(0x7f0000000280)={&(0x7f0000000180)={0xdc, 0x0, 0x8, 0x70bd27, 0x25dfdbfb, {}, [@HEADER={0x5c, 0x1, 0x0, 0x1, [@ETHTOOL_A_HEADER_DEV_INDEX={0x8, 0x1, r1}, @ETHTOOL_A_HEADER_FLAGS={0x8}, @ETHTOOL_A_HEADER_DEV_NAME={0x14, 0x2, 'veth0_vlan\x00'}, @ETHTOOL_A_HEADER_DEV_INDEX={0x8}, @ETHTOOL_A_HEADER_FLAGS={0x8, 0x3, 0x3}, @ETHTOOL_A_HEADER_FLAGS={0x8, 0x3, 0x2}, @ETHTOOL_A_HEADER_DEV_INDEX={0x8, 0x1, r2}, @ETHTOOL_A_HEADER_DEV_NAME={0x14, 0x2, 'macvlan0\x00'}]}, @HEADER={0x40, 0x1, 0x0, 0x1, [@ETHTOOL_A_HEADER_DEV_NAME={0x14, 0x2, 'veth0_to_bridge\x00'}, @ETHTOOL_A_HEADER_DEV_NAME={0x14, 0x2, 'veth0_to_bridge\x00'}, @ETHTOOL_A_HEADER_DEV_NAME={0x14, 0x2, 'netpci0\x00'}]}, @HEADER={0x2c, 0x1, 0x0, 0x1, [@ETHTOOL_A_HEADER_DEV_NAME={0x14, 0x2, 'bond_slave_1\x00'}, @ETHTOOL_A_HEADER_DEV_NAME={0x14, 0x2, 'ip_vti0\x00'}]}]}, 0xdc}, 0x1, 0x0, 0x0, 0x4000}, 0x24000000) sendmsg$NBD_CMD_STATUS(0xffffffffffffffff, &(0x7f0000000400)={&(0x7f0000000300)={0x10, 0x0, 0x0, 0x4}, 0xc, &(0x7f00000003c0)={&(0x7f0000000340)={0x44, 0x0, 0x20, 0x70bd2d, 0x25dfdbfc, {}, [@NBD_ATTR_SIZE_BYTES={0xc, 0x2, 0x4}, @NBD_ATTR_SOCKETS={0x24, 0x7, 0x0, 0x1, [{0x8}, {0x8}, {0x8}, {0x8}]}]}, 0x44}}, 0x4000) ioctl$BINDER_GET_NODE_DEBUG_INFO(r0, 0xc018620b, &(0x7f0000000440)={0x3}) syz_genetlink_get_family_id$batadv(&(0x7f0000000480), 0xffffffffffffffff) r3 = syz_open_dev$ttys(0xc, 0x2, 0x0) ioctl$TCSETAF(r3, 0x5408, &(0x7f00000004c0)={0x4, 0xb073, 0x1000, 0x1, 0x13, "b786e10fbdab60cc"}) openat$binderfs(0xffffffffffffff9c, &(0x7f0000000500)='./binderfs2/binder0\x00', 0x802, 0x0) sendmsg$BATADV_CMD_SET_VLAN(0xffffffffffffffff, &(0x7f0000000600)={&(0x7f0000000540)={0x10, 0x0, 0x0, 0x80000}, 0xc, &(0x7f00000005c0)={&(0x7f0000000580)={0x30, 0x0, 0x400, 0x70bd27, 0x25dfdbfb, {}, [@BATADV_ATTR_FRAGMENTATION_ENABLED={0x5, 0x30, 0x1}, @BATADV_ATTR_ORIG_ADDRESS={0xa, 0x9, @random="62836be88da6"}, @BATADV_ATTR_ISOLATION_MASK={0x8, 0x2c, 0x81}]}, 0x30}, 0x1, 0x0, 0x0, 0x8004}, 0x4c000) r4 = syz_open_dev$ttys(0xc, 0x2, 0x0) ioctl$TIOCEXCL(r4, 0x540c) clone(0x28000800, &(0x7f0000000880)="b3f828035cfe9f8546c65ee8fffa58fb52d9bafabf363f0161cf01b4a2872006d34dcf860667a59d8c5631820a98c05b3989c5037ea89b5a58e8e9809cc008c7ae03db6bb845b2c189e79729a6d2c9a5440c276c7d0686adda809621c1d9723369157389ff141a56cbc54111ec7f92e8262b0c9ab88b9bffbb114333ab5a9711171c09e2589351fa4950d7af92bccf71585c21606994d6b4443d2cb6725d2c983a62f6f0", &(0x7f0000000940), &(0x7f0000000980), &(0x7f00000009c0)="073c516951c56a5fb1d10f1151ef77ee30e71fea92d34f29ddbe9265f84a8e761f6f56055bef1048f67ec1da822c677e9c34d5d52feb791c13c75661003151c2a956098cc6") 00:52:54 executing program 2: r0 = fsmount(0xffffffffffffffff, 0x1, 0x2) r1 = fsmount(r0, 0x1, 0x7c) fsconfig$FSCONFIG_CMD_CREATE(r1, 0x6, 0x0, 0x0, 0x0) r2 = fsmount(r0, 0x0, 0x8) ioctl$CDROMREADCOOKED(r2, 0x5315, &(0x7f0000000000)) sendmsg$IPSET_CMD_HEADER(r0, &(0x7f0000000b40)={&(0x7f0000000a80)={0x10, 0x0, 0x0, 0x1000000}, 0xc, &(0x7f0000000b00)={&(0x7f0000000ac0)={0x28, 0xc, 0x6, 0x801, 0x0, 0x0, {0xf, 0x0, 0xa}, [@IPSET_ATTR_PROTOCOL={0x5}, @IPSET_ATTR_SETNAME={0x9, 0x2, 'syz2\x00'}]}, 0x28}, 0x1, 0x0, 0x0, 0x4000881}, 0x10) r3 = openat$zero(0xffffffffffffff9c, &(0x7f0000000b80), 0x0, 0x0) mmap$binder(&(0x7f0000fff000/0x1000)=nil, 0x1000, 0x1, 0x11, r3, 0x358f) ioctl$TIOCGICOUNT(r3, 0x545d, 0x0) ioctl$HIDIOCGPHYS(r2, 0x80404812, &(0x7f0000000bc0)) ioctl$CDROMVOLCTRL(r3, 0x530a, &(0x7f0000000c00)={0x1, 0xc0, 0x9, 0x40}) r4 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPSET_CMD_HEADER(r4, &(0x7f0000000d40)={&(0x7f0000000c40)={0x10, 0x0, 0x0, 0x80000}, 0xc, &(0x7f0000000d00)={&(0x7f0000000c80)={0x48, 0xc, 0x6, 0x101, 0x0, 0x0, {0x5, 0x0, 0x9}, [@IPSET_ATTR_PROTOCOL={0x5}, @IPSET_ATTR_PROTOCOL={0x5}, @IPSET_ATTR_SETNAME={0x9, 0x2, 'syz2\x00'}, @IPSET_ATTR_PROTOCOL={0x5}, @IPSET_ATTR_PROTOCOL={0x5}, @IPSET_ATTR_PROTOCOL={0x5}]}, 0x48}, 0x1, 0x0, 0x0, 0x10}, 0x0) openat$binderfs(0xffffffffffffff9c, &(0x7f0000000d80)='./binderfs2/custom0\x00', 0x1, 0x0) r5 = openat$procfs(0xffffffffffffff9c, &(0x7f0000000dc0)='/proc/cpuinfo\x00', 0x0, 0x0) fsmount(r5, 0x1, 0x2) openat$ttyS3(0xffffffffffffff9c, &(0x7f0000000e80), 0x4a80, 0x0) 00:52:54 executing program 7: r0 = openat$procfs(0xffffffffffffff9c, &(0x7f0000000000)='/proc/mdstat\x00', 0x0, 0x0) mmap$IORING_OFF_CQ_RING(&(0x7f0000ffc000/0x2000)=nil, 0x2000, 0x8, 0x4010, r0, 0x8000000) r1 = openat$cdrom(0xffffffffffffff9c, &(0x7f0000000040), 0xb0840, 0x0) ioctl$CDROM_LOCKDOOR(r1, 0x5329, 0x1) r2 = openat$procfs(0xffffffffffffff9c, &(0x7f0000000080)='/proc/slabinfo\x00', 0x0, 0x0) epoll_ctl$EPOLL_CTL_DEL(r2, 0x2, r0) r3 = fsmount(r2, 0x0, 0x7f) ioctl$CDROMREADMODE1(r3, 0x530d, &(0x7f00000000c0)={0x7, 0x1f, 0x3, 0x81, 0xf3, 0x7b}) mprotect(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x1000008) mmap$IORING_OFF_CQ_RING(&(0x7f0000ffe000/0x1000)=nil, 0x1000, 0x2, 0x80010, r3, 0x8000000) socketpair$nbd(0x1, 0x1, 0x0, &(0x7f0000000d80)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$sock_SIOCGIFINDEX_80211(r4, 0x8933, &(0x7f0000000dc0)={'wlan1\x00'}) r5 = syz_genetlink_get_family_id$batadv(&(0x7f0000000e40), r0) sendmsg$BATADV_CMD_GET_ORIGINATORS(r3, &(0x7f0000000f00)={&(0x7f0000000e00)={0x10, 0x0, 0x0, 0x400000}, 0xc, &(0x7f0000000ec0)={&(0x7f0000000e80)={0x34, r5, 0x2, 0x70bd29, 0x25dfdbff, {}, [@BATADV_ATTR_THROUGHPUT_OVERRIDE={0x8, 0x3b, 0x8}, @BATADV_ATTR_BRIDGE_LOOP_AVOIDANCE_ENABLED={0x5, 0x2e, 0x1}, @BATADV_ATTR_FRAGMENTATION_ENABLED={0x5, 0x30, 0x1}, @BATADV_ATTR_TPMETER_TEST_TIME={0x8, 0xb, 0xfffffffb}]}, 0x34}, 0x1, 0x0, 0x0, 0x20000000}, 0x4000000) ioctl$CDROM_GET_CAPABILITY(0xffffffffffffffff, 0x5331) sendmsg$NBD_CMD_DISCONNECT(0xffffffffffffffff, &(0x7f00000011c0)={&(0x7f00000010c0)={0x10, 0x0, 0x0, 0x4000}, 0xc, &(0x7f0000001180)={&(0x7f0000001140)={0x20, 0x0, 0x20, 0x70bd25, 0x25dfdbfe, {}, [@NBD_ATTR_BLOCK_SIZE_BYTES={0xc, 0x3, 0x9de}]}, 0x20}, 0x1, 0x0, 0x0, 0x20004000}, 0x200000c5) 00:52:54 executing program 1: r0 = openat$zero(0xffffffffffffff9c, &(0x7f0000000000), 0x400200, 0x0) ioctl$SECCOMP_IOCTL_NOTIF_ADDFD(r0, 0x40182103, &(0x7f0000000040)={0x0, 0x1, 0xffffffffffffffff, 0x80000000, 0x80000}) r1 = syz_genetlink_get_family_id$batadv(&(0x7f00000000c0), r0) sendmsg$BATADV_CMD_GET_TRANSTABLE_LOCAL(r0, &(0x7f00000001c0)={&(0x7f0000000080)={0x10, 0x0, 0x0, 0x80000}, 0xc, &(0x7f0000000180)={&(0x7f0000000100)={0x54, r1, 0x200, 0x70bd25, 0x25dfdbff, {}, [@BATADV_ATTR_THROUGHPUT_OVERRIDE={0x8, 0x3b, 0x89}, @BATADV_ATTR_THROUGHPUT_OVERRIDE={0x8, 0x3b, 0xffff}, @BATADV_ATTR_FRAGMENTATION_ENABLED={0x5}, @BATADV_ATTR_AGGREGATED_OGMS_ENABLED={0x5}, @BATADV_ATTR_MULTICAST_FORCEFLOOD_ENABLED={0x5}, @BATADV_ATTR_BRIDGE_LOOP_AVOIDANCE_ENABLED={0x5}, @BATADV_ATTR_HARD_IFINDEX={0x8}, @BATADV_ATTR_GW_MODE={0x5, 0x33, 0x1}]}, 0x54}, 0x1, 0x0, 0x0, 0x48041}, 0x4840) r2 = openat$procfs(0xffffffffffffff9c, &(0x7f0000000200)='/proc/cpuinfo\x00', 0x0, 0x0) sendmsg$BATADV_CMD_GET_GATEWAYS(r2, &(0x7f0000000340)={&(0x7f0000000240)={0x10, 0x0, 0x0, 0x1000000}, 0xc, &(0x7f0000000300)={&(0x7f0000000280)={0x50, r1, 0x400, 0x70bd26, 0x25dfdbfb, {}, [@BATADV_ATTR_BRIDGE_LOOP_AVOIDANCE_ENABLED={0x5, 0x2e, 0x1}, @BATADV_ATTR_ISOLATION_MARK={0x8, 0x2b, 0x3}, @BATADV_ATTR_BONDING_ENABLED={0x5}, @BATADV_ATTR_BRIDGE_LOOP_AVOIDANCE_ENABLED={0x5, 0x2e, 0x1}, @BATADV_ATTR_ORIG_ADDRESS={0xa, 0x9, @multicast}, @BATADV_ATTR_THROUGHPUT_OVERRIDE={0x8, 0x3b, 0x1}, @BATADV_ATTR_ISOLATION_MARK={0x8, 0x2b, 0x6}]}, 0x50}, 0x1, 0x0, 0x0, 0x20049800}, 0x80) r3 = syz_genetlink_get_family_id$batadv(&(0x7f00000003c0), r0) sendmsg$BATADV_CMD_SET_MESH(r0, &(0x7f0000000480)={&(0x7f0000000380)={0x10, 0x0, 0x0, 0x1000}, 0xc, &(0x7f0000000440)={&(0x7f0000000400)={0x34, r3, 0x400, 0x70bd2d, 0x25dfdbff, {}, [@BATADV_ATTR_GW_MODE={0x5}, @BATADV_ATTR_GW_BANDWIDTH_UP={0x8, 0x32, 0x8001}, @BATADV_ATTR_ORIG_INTERVAL={0x8, 0x39, 0x4}, @BATADV_ATTR_NETWORK_CODING_ENABLED={0x5, 0x38, 0x1}]}, 0x34}, 0x1, 0x0, 0x0, 0x4000000}, 0x18000) r4 = fsmount(r0, 0x1, 0x5) r5 = fsmount(r2, 0x1, 0x7a) epoll_ctl$EPOLL_CTL_ADD(r4, 0x1, r5, &(0x7f00000016c0)={0x80002000}) r6 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000001700), 0x111002, 0x0) epoll_ctl$EPOLL_CTL_MOD(r0, 0x3, r6, &(0x7f0000001740)) ioctl$SECCOMP_IOCTL_NOTIF_ID_VALID(r5, 0x40082102, &(0x7f0000001780)) rt_sigqueueinfo(0xffffffffffffffff, 0x2, &(0x7f00000017c0)={0x16, 0x5, 0x8}) ioctl$BINDER_SET_MAX_THREADS(r4, 0x40046205, &(0x7f0000001840)=0x4) 00:52:54 executing program 0: r0 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$ieee802154(&(0x7f0000000040), 0xffffffffffffffff) ioctl$sock_SIOCGIFINDEX_802154(0xffffffffffffffff, 0x8933, &(0x7f0000000080)={'wpan0\x00', 0x0}) sendmsg$IEEE802154_LLSEC_DEL_DEVKEY(r0, &(0x7f0000000140)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x2000000}, 0xc, &(0x7f0000000100)={&(0x7f00000000c0)={0x38, r1, 0x2, 0x70bd27, 0x25dfdbfb, {}, [@IEEE802154_ATTR_LLSEC_KEY_SOURCE_SHORT={0x8, 0x2c, 0xee0}, @IEEE802154_ATTR_PAN_ID={0x6, 0x6, 0xffff}, @IEEE802154_ATTR_DEV_INDEX={0x8, 0x2, r2}, @IEEE802154_ATTR_LLSEC_KEY_SOURCE_EXTENDED={0xc, 0x2d, {0xaaaaaaaaaaaa0002}}]}, 0x38}}, 0x4) r3 = syz_genetlink_get_family_id$ieee802154(&(0x7f00000001c0), r0) sendmsg$IEEE802154_LLSEC_ADD_KEY(r0, &(0x7f00000002c0)={&(0x7f0000000180)={0x10, 0x0, 0x0, 0x80}, 0xc, &(0x7f0000000280)={&(0x7f0000000200)={0x70, r3, 0x8dc3595b298c372b, 0x70bd2c, 0x25dfdbfd, {}, [@IEEE802154_ATTR_HW_ADDR={0xc, 0x5, {0xaaaaaaaaaaaa0302}}, @IEEE802154_ATTR_LLSEC_KEY_SOURCE_EXTENDED={0xc, 0x2d, {0xaaaaaaaaaaaa0202}}, @IEEE802154_ATTR_HW_ADDR={0xc, 0x5, {0xaaaaaaaaaaaa0002}}, @IEEE802154_ATTR_LLSEC_KEY_USAGE_FRAME_TYPES={0x5, 0x31, 0x81}, @IEEE802154_ATTR_DEV_NAME={0xa, 0x1, 'wpan1\x00'}, @IEEE802154_ATTR_LLSEC_KEY_USAGE_COMMANDS={0x24, 0x32, "c38d2be0aa0107a2b38f85915a757ba51ff3d89ac2e1c596dce3055b00418226"}]}, 0x70}, 0x1, 0x0, 0x0, 0x20004040}, 0x0) r4 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) sendmsg$IEEE802154_ASSOCIATE_RESP(r4, &(0x7f0000000400)={&(0x7f0000000300)={0x10, 0x0, 0x0, 0x2000000}, 0xc, &(0x7f00000003c0)={&(0x7f0000000340)={0x60, r3, 0x200, 0x70bd26, 0x25dfdbfd, {}, [@IEEE802154_ATTR_COORD_HW_ADDR={0xc}, @IEEE802154_ATTR_STATUS={0x5, 0x3, 0x40}, @IEEE802154_ATTR_STATUS={0x5, 0x3, 0x1}, @IEEE802154_ATTR_COORD_HW_ADDR={0xc, 0x9, {0x2c841fbeb2fffbec}}, @IEEE802154_ATTR_COORD_HW_ADDR={0xc, 0x9, {0xaaaaaaaaaaaa0202}}, @IEEE802154_ATTR_STATUS={0x5, 0x3, 0x6}, @IEEE802154_ATTR_STATUS={0x5, 0x3, 0x3f}, @IEEE802154_ATTR_COORD_SHORT_ADDR={0x6, 0x8, 0xffff}]}, 0x60}, 0x1, 0x0, 0x0, 0x20000000}, 0x20000080) ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, &(0x7f0000000540)={0xc, 0x0, &(0x7f0000000440)=[@dead_binder_done], 0xbf, 0x0, &(0x7f0000000480)="0537636f85beafebd2a00648fb042246bcbd2150d45e58acedd2718aaa529794fc45c87c914f2b69b82fedb220d6a94b2babd3f188631b48d025c32a8342250d69582838e7ee6d22fa335ce4315412805f50869d3f4bef11a5bb26ac3704b717f9416fc1f441d5dd77d4b3c1a283f3179a7daf20c0d30210361ea15f09fd38e2c2ac52383e1685a787783f4524fd7d784046605442e441fb76b236455574d7fe70d1885d924099864313d8d3d84c106a36d2ccc77c51d3cdaf3f716551fc0a"}) r5 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) syz_genetlink_get_family_id$ieee802154(&(0x7f0000000580), r5) sendmsg$IEEE802154_SET_MACPARAMS(r0, &(0x7f0000000680)={&(0x7f00000005c0)={0x10, 0x0, 0x0, 0x1000}, 0xc, &(0x7f0000000640)={&(0x7f0000000600)={0x2c, r3, 0x2, 0x70bd2d, 0x25dfdbfd, {}, [@IEEE802154_ATTR_CCA_ED_LEVEL={0x8, 0x24, 0x7fffffff}, @IEEE802154_ATTR_TXPOWER={0x5, 0x21, 0x3}, @IEEE802154_ATTR_CSMA_MAX_BE={0x5, 0x27, 0x4}]}, 0x2c}, 0x1, 0x0, 0x0, 0x40801}, 0x40840) r6 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) sendmsg$IEEE802154_LLSEC_DEL_SECLEVEL(r6, &(0x7f00000007c0)={&(0x7f00000006c0)={0x10, 0x0, 0x0, 0x40000000}, 0xc, &(0x7f0000000780)={&(0x7f0000000700)={0x44, r3, 0x300, 0x70bd2a, 0x25dfdbfb, {}, [@IEEE802154_ATTR_DEV_INDEX={0x8, 0x2, r2}, @IEEE802154_ATTR_LLSEC_FRAME_TYPE={0x5, 0x33, 0x1f}, @IEEE802154_ATTR_LLSEC_FRAME_TYPE={0x5, 0x33, 0x7}, @IEEE802154_ATTR_LLSEC_CMD_FRAME_ID={0x5, 0x34, 0xcb}, @IEEE802154_ATTR_LLSEC_DEV_OVERRIDE={0x5, 0x36, 0x1}, @IEEE802154_ATTR_LLSEC_CMD_FRAME_ID={0x5, 0x34, 0x1}]}, 0x44}, 0x1, 0x0, 0x0, 0x40000a1}, 0x4800) syz_genetlink_get_family_id$ieee802154(&(0x7f0000000840), r6) sendmsg$IEEE802154_LLSEC_DEL_KEY(0xffffffffffffffff, &(0x7f0000000c80)={&(0x7f0000000b40)={0x10, 0x0, 0x0, 0x40000000}, 0xc, &(0x7f0000000c40)={&(0x7f0000000bc0)={0x58, 0x0, 0x402, 0x70bd2d, 0x25dfdbff, {}, [@IEEE802154_ATTR_LLSEC_KEY_MODE={0x5, 0x2b, 0x1}, @IEEE802154_ATTR_DEV_NAME={0xa, 0x1, 'wpan3\x00'}, @IEEE802154_ATTR_LLSEC_KEY_SOURCE_EXTENDED={0xc, 0x2d, {0xaaaaaaaaaaaa0302}}, @IEEE802154_ATTR_LLSEC_KEY_ID={0x5, 0x2e, 0x4}, @IEEE802154_ATTR_LLSEC_KEY_ID={0x5, 0x2e, 0x3}, @IEEE802154_ATTR_SHORT_ADDR={0x6, 0x4, 0xfffd}, @IEEE802154_ATTR_HW_ADDR={0xc}]}, 0x58}, 0x1, 0x0, 0x0, 0x40800}, 0x24040000) 00:52:54 executing program 6: ioctl$sock_SIOCGIFINDEX_802154(0xffffffffffffffff, 0x8933, &(0x7f0000000000)={'wpan1\x00', 0x0}) r1 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) ioctl$sock_SIOCGIFINDEX_802154(0xffffffffffffffff, 0x8933, &(0x7f0000000080)={'wpan3\x00', 0x0}) sendmsg$IEEE802154_LLSEC_ADD_SECLEVEL(r1, &(0x7f0000000140)={&(0x7f0000000040)={0x10, 0x0, 0x0, 0x800000}, 0xc, &(0x7f0000000100)={&(0x7f00000000c0)={0x2c, 0x0, 0x400, 0x70bd2a, 0x25dfdbfe, {}, [@IEEE802154_ATTR_DEV_INDEX={0x8, 0x2, r0}, @IEEE802154_ATTR_DEV_INDEX={0x8, 0x2, r0}, @IEEE802154_ATTR_DEV_INDEX={0x8, 0x2, r2}]}, 0x2c}, 0x1, 0x0, 0x0, 0x4004081}, 0x10) sendmsg$IEEE802154_LLSEC_DEL_KEY(r1, &(0x7f0000000240)={&(0x7f0000000180)={0x10, 0x0, 0x0, 0x1000000}, 0xc, &(0x7f0000000200)={&(0x7f00000001c0)={0x3c, 0x0, 0x30e, 0x70bd25, 0x25dfdbfd, {}, [@IEEE802154_ATTR_HW_ADDR={0xc, 0x5, {0xaaaaaaaaaaaa0102}}, @IEEE802154_ATTR_LLSEC_KEY_SOURCE_EXTENDED={0xc, 0x2d, {0xaaaaaaaaaaaa0102}}, @IEEE802154_ATTR_LLSEC_KEY_SOURCE_SHORT={0x8, 0x2c, 0x5}, @IEEE802154_ATTR_DEV_INDEX={0x8}]}, 0x3c}, 0x1, 0x0, 0x0, 0x24041000}, 0x44) socketpair$nbd(0x1, 0x1, 0x0, &(0x7f0000002280)={0xffffffffffffffff}) r4 = openat$procfs(0xffffffffffffff9c, &(0x7f00000022c0)='/proc/asound/seq/clients\x00', 0x0, 0x0) socketpair$nbd(0x1, 0x1, 0x0, &(0x7f0000002300)={0xffffffffffffffff}) r6 = socket(0x1d, 0x3, 0x6) r7 = openat$zero(0xffffffffffffff9c, &(0x7f0000002340), 0x2, 0x0) socketpair$nbd(0x1, 0x1, 0x0, &(0x7f0000002380)={0xffffffffffffffff}) sendmsg$NBD_CMD_DISCONNECT(r1, &(0x7f0000002480)={&(0x7f0000000280)={0x10, 0x0, 0x0, 0x80000}, 0xc, &(0x7f0000002440)={&(0x7f00000023c0)={0x6c, 0x0, 0x400, 0x70bd27, 0x25dfdbfb, {}, [@NBD_ATTR_TIMEOUT={0xc, 0x4, 0x100000001}, @NBD_ATTR_SOCKETS={0x4c, 0x7, 0x0, 0x1, [{0x8, 0x1, r3}, {0x8, 0x1, r4}, {0x8}, {0x8, 0x1, r5}, {0x8}, {0x8, 0x1, r6}, {0x8, 0x1, r7}, {0x8, 0x1, r8}, {0x8}]}]}, 0x6c}, 0x1, 0x0, 0x0, 0x20000000}, 0x4000020) r9 = syz_genetlink_get_family_id$ieee802154(&(0x7f0000002500), r1) sendmsg$IEEE802154_LLSEC_LIST_SECLEVEL(r1, &(0x7f00000025c0)={&(0x7f00000024c0)={0x10, 0x0, 0x0, 0x4}, 0xc, &(0x7f0000002580)={&(0x7f0000002540)={0x14, r9, 0x100, 0x70bd25, 0x25dfdbfd, {}, ["", "", "", "", "", ""]}, 0x14}, 0x1, 0x0, 0x0, 0x11}, 0x20000084) syz_genetlink_get_family_id$nbd(&(0x7f0000002640), r1) ioctl$TIOCGPTPEER(r7, 0x5441, 0xe5) 00:52:54 executing program 2: r0 = fsmount(0xffffffffffffffff, 0x1, 0x2) r1 = fsmount(r0, 0x1, 0x7c) fsconfig$FSCONFIG_CMD_CREATE(r1, 0x6, 0x0, 0x0, 0x0) r2 = fsmount(r0, 0x0, 0x8) ioctl$CDROMREADCOOKED(r2, 0x5315, &(0x7f0000000000)) sendmsg$IPSET_CMD_HEADER(r0, &(0x7f0000000b40)={&(0x7f0000000a80)={0x10, 0x0, 0x0, 0x1000000}, 0xc, &(0x7f0000000b00)={&(0x7f0000000ac0)={0x28, 0xc, 0x6, 0x801, 0x0, 0x0, {0xf, 0x0, 0xa}, [@IPSET_ATTR_PROTOCOL={0x5}, @IPSET_ATTR_SETNAME={0x9, 0x2, 'syz2\x00'}]}, 0x28}, 0x1, 0x0, 0x0, 0x4000881}, 0x10) r3 = openat$zero(0xffffffffffffff9c, &(0x7f0000000b80), 0x0, 0x0) mmap$binder(&(0x7f0000fff000/0x1000)=nil, 0x1000, 0x1, 0x11, r3, 0x358f) ioctl$TIOCGICOUNT(r3, 0x545d, 0x0) ioctl$HIDIOCGPHYS(r2, 0x80404812, &(0x7f0000000bc0)) ioctl$CDROMVOLCTRL(r3, 0x530a, &(0x7f0000000c00)={0x1, 0xc0, 0x9, 0x40}) r4 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPSET_CMD_HEADER(r4, &(0x7f0000000d40)={&(0x7f0000000c40)={0x10, 0x0, 0x0, 0x80000}, 0xc, &(0x7f0000000d00)={&(0x7f0000000c80)={0x48, 0xc, 0x6, 0x101, 0x0, 0x0, {0x5, 0x0, 0x9}, [@IPSET_ATTR_PROTOCOL={0x5}, @IPSET_ATTR_PROTOCOL={0x5}, @IPSET_ATTR_SETNAME={0x9, 0x2, 'syz2\x00'}, @IPSET_ATTR_PROTOCOL={0x5}, @IPSET_ATTR_PROTOCOL={0x5}, @IPSET_ATTR_PROTOCOL={0x5}]}, 0x48}, 0x1, 0x0, 0x0, 0x10}, 0x0) openat$binderfs(0xffffffffffffff9c, &(0x7f0000000d80)='./binderfs2/custom0\x00', 0x1, 0x0) openat$procfs(0xffffffffffffff9c, &(0x7f0000000dc0)='/proc/cpuinfo\x00', 0x0, 0x0) openat$ttyS3(0xffffffffffffff9c, &(0x7f0000000e80), 0x4a80, 0x0) 00:52:54 executing program 5: prctl$PR_GET_FPEXC(0xb, &(0x7f0000000000)) r0 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000040)='./binderfs/custom0\x00', 0x800, 0x0) ustat(0x800, &(0x7f0000000080)) ioctl$ifreq_SIOCGIFINDEX_batadv_mesh(0xffffffffffffffff, 0x8933, &(0x7f0000000100)={'batadv0\x00', 0x0}) ioctl$ifreq_SIOCGIFINDEX_batadv_hard(0xffffffffffffffff, 0x8933, &(0x7f0000000140)={'batadv_slave_0\x00', 0x0}) sendmsg$ETHTOOL_MSG_PAUSE_GET(0xffffffffffffffff, &(0x7f00000002c0)={&(0x7f00000000c0)={0x10, 0x0, 0x0, 0x10000}, 0xc, &(0x7f0000000280)={&(0x7f0000000180)={0xdc, 0x0, 0x8, 0x70bd27, 0x25dfdbfb, {}, [@HEADER={0x5c, 0x1, 0x0, 0x1, [@ETHTOOL_A_HEADER_DEV_INDEX={0x8, 0x1, r1}, @ETHTOOL_A_HEADER_FLAGS={0x8}, @ETHTOOL_A_HEADER_DEV_NAME={0x14, 0x2, 'veth0_vlan\x00'}, @ETHTOOL_A_HEADER_DEV_INDEX={0x8}, @ETHTOOL_A_HEADER_FLAGS={0x8, 0x3, 0x3}, @ETHTOOL_A_HEADER_FLAGS={0x8, 0x3, 0x2}, @ETHTOOL_A_HEADER_DEV_INDEX={0x8, 0x1, r2}, @ETHTOOL_A_HEADER_DEV_NAME={0x14, 0x2, 'macvlan0\x00'}]}, @HEADER={0x40, 0x1, 0x0, 0x1, [@ETHTOOL_A_HEADER_DEV_NAME={0x14, 0x2, 'veth0_to_bridge\x00'}, @ETHTOOL_A_HEADER_DEV_NAME={0x14, 0x2, 'veth0_to_bridge\x00'}, @ETHTOOL_A_HEADER_DEV_NAME={0x14, 0x2, 'netpci0\x00'}]}, @HEADER={0x2c, 0x1, 0x0, 0x1, [@ETHTOOL_A_HEADER_DEV_NAME={0x14, 0x2, 'bond_slave_1\x00'}, @ETHTOOL_A_HEADER_DEV_NAME={0x14, 0x2, 'ip_vti0\x00'}]}]}, 0xdc}, 0x1, 0x0, 0x0, 0x4000}, 0x24000000) sendmsg$NBD_CMD_STATUS(0xffffffffffffffff, &(0x7f0000000400)={&(0x7f0000000300)={0x10, 0x0, 0x0, 0x4}, 0xc, &(0x7f00000003c0)={&(0x7f0000000340)={0x44, 0x0, 0x20, 0x70bd2d, 0x25dfdbfc, {}, [@NBD_ATTR_SIZE_BYTES={0xc, 0x2, 0x4}, @NBD_ATTR_SOCKETS={0x24, 0x7, 0x0, 0x1, [{0x8}, {0x8}, {0x8}, {0x8}]}]}, 0x44}}, 0x4000) ioctl$BINDER_GET_NODE_DEBUG_INFO(r0, 0xc018620b, &(0x7f0000000440)={0x3}) syz_genetlink_get_family_id$batadv(&(0x7f0000000480), 0xffffffffffffffff) r3 = syz_open_dev$ttys(0xc, 0x2, 0x0) ioctl$TCSETAF(r3, 0x5408, &(0x7f00000004c0)={0x4, 0xb073, 0x1000, 0x1, 0x13, "b786e10fbdab60cc"}) openat$binderfs(0xffffffffffffff9c, &(0x7f0000000500)='./binderfs2/binder0\x00', 0x802, 0x0) sendmsg$BATADV_CMD_SET_VLAN(0xffffffffffffffff, &(0x7f0000000600)={&(0x7f0000000540)={0x10, 0x0, 0x0, 0x80000}, 0xc, &(0x7f00000005c0)={&(0x7f0000000580)={0x30, 0x0, 0x400, 0x70bd27, 0x25dfdbfb, {}, [@BATADV_ATTR_FRAGMENTATION_ENABLED={0x5, 0x30, 0x1}, @BATADV_ATTR_ORIG_ADDRESS={0xa, 0x9, @random="62836be88da6"}, @BATADV_ATTR_ISOLATION_MASK={0x8, 0x2c, 0x81}]}, 0x30}, 0x1, 0x0, 0x0, 0x8004}, 0x4c000) syz_open_dev$ttys(0xc, 0x2, 0x0) clone(0x28000800, &(0x7f0000000880)="b3f828035cfe9f8546c65ee8fffa58fb52d9bafabf363f0161cf01b4a2872006d34dcf860667a59d8c5631820a98c05b3989c5037ea89b5a58e8e9809cc008c7ae03db6bb845b2c189e79729a6d2c9a5440c276c7d0686adda809621c1d9723369157389ff141a56cbc54111ec7f92e8262b0c9ab88b9bffbb114333ab5a9711171c09e2589351fa4950d7af92bccf71585c21606994d6b4443d2cb6725d2c983a62f6f0", &(0x7f0000000940), &(0x7f0000000980), &(0x7f00000009c0)="073c516951c56a5fb1d10f1151ef77ee30e71fea92d34f29ddbe9265f84a8e761f6f56055bef1048f67ec1da822c677e9c34d5d52feb791c13c75661003151c2a956098cc6") 00:52:54 executing program 3: clone(0x400, &(0x7f0000000000)="2f59adb4fe8bdd18e28d59f811fee00f6e", &(0x7f0000000040), &(0x7f0000000080), &(0x7f00000000c0)="ee4468595a6a9e17d313ddea1158c7520b4ce752e1feceb8bd763f38764fe32d5b11f9842e25fb3843f95d48bcbb676b94dc456e5f562cd49d08bd5ac38eb9d6acfc2fa3928b3de489313465b4bea18ac19b9efcb135738e957c5dfaa38b9755182fa0eb46bac360130ee66e2636e1d6aafb8e5918d6d0f8338603cd9bd3e0f3b5d106eae77f68fc50df9f58fd8061a03c31d04b3551c672a8334c0f3bd81aea189fc02f258c22a8b0dba2a60f9a458d6eff75d32cf215930f0bccd5f8ee1d8d33a86c5eda24ec311adc") ioctl$CDROMREADMODE1(0xffffffffffffffff, 0x530d, &(0x7f00000001c0)={0x8, 0x81, 0x4, 0x1, 0x1, 0x8}) ioctl$CDROMREADRAW(0xffffffffffffffff, 0x5314, &(0x7f0000000c40)={0x1, 0x5, 0x7, 0xe5, 0x2, 0x81}) r0 = openat$zero(0xffffffffffffff9c, &(0x7f00000016c0), 0x0, 0x0) ioctl$CDROMSTART(r0, 0x5308) rt_sigaction(0xf, &(0x7f0000001780)={&(0x7f0000001700)="66430f3a15df22c402d937a80e000000f347241ac44218f34ce000c4a2b528e8db5a2466440f38014fdb660f3810b006a50000c421fc295a0cdcf1", 0x80000004, &(0x7f0000001740)="642e41dde78f684ca2df01416dc463755c460b34f3460fa6c0c4c11b7cc7c442f1ad5b00f0430fab6b000f0f62f79af046f71c54", {[0xfffffffffffffffe]}}, &(0x7f0000001840)={&(0x7f00000017c0)="f240af66e20067363666460ffa6f5136360f974700c48165da31c422050c1ec4c17a6fbb2f000000c4027d2074f407f2430f1a39ff30", 0x0, &(0x7f0000001800)="c462394627defbc401f1d3cac46159de6e1fc4816c58a20700000066430faef2c4c16b7c9f0300000066400f6620f0ff0500000000c4e111d2f9"}, 0x8, &(0x7f0000001880)) timerfd_create(0x9, 0x800) prctl$PR_GET_FPEXC(0xb, &(0x7f00000018c0)) recvmmsg(r0, &(0x7f0000003c40)=[{{&(0x7f0000001900)=@pppol2tp={0x18, 0x1, {0x0, 0xffffffffffffffff, {0x2, 0x0, @empty}}}, 0x80, &(0x7f00000029c0)=[{&(0x7f0000001980)=""/39, 0x27}, {&(0x7f00000019c0)=""/4096, 0x1000}], 0x2, &(0x7f0000002a00)=""/18, 0x12}, 0x3f}, {{&(0x7f0000002a40)=@nfc, 0x80, &(0x7f0000002e80)=[{&(0x7f0000002ac0)=""/44, 0x2c}, {&(0x7f0000002b00)=""/65, 0x41}, {&(0x7f0000002b80)=""/107, 0x6b}, {&(0x7f0000002c00)=""/158, 0x9e}, {&(0x7f0000002cc0)=""/169, 0xa9}, {&(0x7f0000002d80)=""/57, 0x39}, {&(0x7f0000002dc0)=""/160, 0xa0}], 0x7}, 0x6}, {{&(0x7f0000002f00)=@x25={0x9, @remote}, 0x80, &(0x7f0000003100)=[{&(0x7f0000002f80)=""/101, 0x65}, {&(0x7f0000003000)}, {&(0x7f0000003040)=""/187, 0xbb}], 0x3, &(0x7f0000003140)=""/159, 0x9f}, 0xffffffff}, {{&(0x7f0000003200)=@ll={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @dev}, 0x80, &(0x7f0000003400)=[{&(0x7f0000003280)=""/29, 0x1d}, {&(0x7f00000032c0)=""/41, 0x29}, {&(0x7f0000003300)=""/219, 0xdb}], 0x3, &(0x7f0000003440)=""/204, 0xcc}, 0x2f62}, {{&(0x7f0000003540)=@hci, 0x80, &(0x7f0000003b80)=[{&(0x7f00000035c0)=""/168, 0xa8}, {&(0x7f0000003680)=""/128, 0x80}, {&(0x7f0000003700)=""/75, 0x4b}, {&(0x7f0000003780)=""/189, 0xbd}, {&(0x7f0000003840)=""/168, 0xa8}, {&(0x7f0000003900)=""/132, 0x84}, {&(0x7f00000039c0)=""/162, 0xa2}, {&(0x7f0000003a80)=""/198, 0xc6}], 0x8, &(0x7f0000003c00)=""/25, 0x19}, 0xfc00}], 0x5, 0x21, &(0x7f0000003d80)) r2 = socket$netlink(0x10, 0x3, 0xe) syz_genetlink_get_family_id$smc(&(0x7f0000003dc0), r2) timerfd_create(0x6, 0x800) ioctl$BINDER_THREAD_EXIT(r0, 0x40046208, 0x0) epoll_ctl$EPOLL_CTL_MOD(r0, 0x3, r1, &(0x7f0000003e00)={0xb0000000}) r3 = io_uring_setup(0x35ea, &(0x7f0000003e40)={0x0, 0x7cfa, 0x2, 0x0, 0x210, 0x0, r0}) io_uring_setup(0x106d, &(0x7f0000003ec0)={0x0, 0xb36, 0x1e, 0x1, 0xa7, 0x0, r3}) sendmsg$NBD_CMD_STATUS(0xffffffffffffffff, &(0x7f0000004040)={&(0x7f0000003f40)={0x10, 0x0, 0x0, 0x8}, 0xc, &(0x7f0000004000)={&(0x7f0000003f80)={0x6c, 0x0, 0x20, 0x70bd2a, 0x25dfdbff, {}, [@NBD_ATTR_DEAD_CONN_TIMEOUT={0xc, 0x8, 0x68b2}, @NBD_ATTR_SIZE_BYTES={0xc, 0x2, 0x1f}, @NBD_ATTR_SIZE_BYTES={0xc, 0x2, 0x8}, @NBD_ATTR_TIMEOUT={0xc, 0x4, 0x6}, @NBD_ATTR_DEAD_CONN_TIMEOUT={0xc, 0x8, 0x3}, @NBD_ATTR_CLIENT_FLAGS={0xc, 0x6, 0x1}, @NBD_ATTR_INDEX={0x8, 0x1, 0x0}, @NBD_ATTR_INDEX={0x8, 0x1, 0x0}]}, 0x6c}, 0x1, 0x0, 0x0, 0x40840}, 0x10) syz_genetlink_get_family_id$nbd(&(0x7f00000040c0), 0xffffffffffffffff) fsmount(r0, 0x0, 0xf0) 00:52:54 executing program 4: r0 = openat$ttyS3(0xffffffffffffff9c, &(0x7f0000000000), 0xa2000, 0x0) ioctl$TIOCSETD(r0, 0x5423, &(0x7f0000000040)=0x13) r1 = fsmount(0xffffffffffffffff, 0x1, 0x76) ioctl$TCSETAF(r1, 0x5408, &(0x7f0000000080)={0x5, 0x8001, 0x4, 0x8001, 0x15, "b45da66f02087ca7"}) ioctl$TCSETAF(r1, 0x5408, &(0x7f00000000c0)={0x5, 0x22c1, 0x800, 0x8, 0x5, "2b8c058f839aaa67"}) connect$netlink(r1, &(0x7f0000000100)=@proc={0x10, 0x0, 0x25dfdbfd, 0x2}, 0xc) r2 = syz_open_dev$tty1(0xc, 0x4, 0x4) ioctl$TCSETSF(r2, 0x5404, &(0x7f0000000140)={0x6, 0x2, 0x2, 0x80000001, 0x1b, "c2331e6388ffeb48419d467a4b791ad4343a96"}) ioctl$TIOCMGET(r1, 0x5415, &(0x7f0000000180)) ioctl$TCSETAF(r2, 0x5408, &(0x7f00000001c0)={0x11, 0x0, 0xfff, 0x7, 0xd, "3ae59dd65d54337c"}) r3 = timerfd_create(0x7, 0x800) timerfd_settime(r3, 0x1, &(0x7f0000000200), &(0x7f0000000240)) ioctl$TCSETAF(r2, 0x5408, &(0x7f0000000280)={0x1, 0x1, 0x3d4c, 0x200, 0x0, "73a709364d80b6c1"}) ioctl$PIO_UNIMAPCLR(0xffffffffffffffff, 0x4b68, &(0x7f00000002c0)={0x73, 0x1fe0, 0x8b}) ioctl$TCSETSF2(r2, 0x402c542d, &(0x7f0000000300)={0xffffffff, 0x0, 0x80000000, 0x9, 0x6, "35157e2ff53385c0969535964d148320e065e8", 0x6}) ioctl$KDGKBMETA(0xffffffffffffffff, 0x4b62, &(0x7f0000000340)) socket(0x16, 0x1, 0x9) 00:52:54 executing program 2: r0 = fsmount(0xffffffffffffffff, 0x1, 0x2) r1 = fsmount(r0, 0x1, 0x7c) fsconfig$FSCONFIG_CMD_CREATE(r1, 0x6, 0x0, 0x0, 0x0) r2 = fsmount(r0, 0x0, 0x8) ioctl$CDROMREADCOOKED(r2, 0x5315, &(0x7f0000000000)) sendmsg$IPSET_CMD_HEADER(r0, &(0x7f0000000b40)={&(0x7f0000000a80)={0x10, 0x0, 0x0, 0x1000000}, 0xc, &(0x7f0000000b00)={&(0x7f0000000ac0)={0x28, 0xc, 0x6, 0x801, 0x0, 0x0, {0xf, 0x0, 0xa}, [@IPSET_ATTR_PROTOCOL={0x5}, @IPSET_ATTR_SETNAME={0x9, 0x2, 'syz2\x00'}]}, 0x28}, 0x1, 0x0, 0x0, 0x4000881}, 0x10) r3 = openat$zero(0xffffffffffffff9c, &(0x7f0000000b80), 0x0, 0x0) mmap$binder(&(0x7f0000fff000/0x1000)=nil, 0x1000, 0x1, 0x11, r3, 0x358f) ioctl$TIOCGICOUNT(r3, 0x545d, 0x0) ioctl$HIDIOCGPHYS(r2, 0x80404812, &(0x7f0000000bc0)) ioctl$CDROMVOLCTRL(r3, 0x530a, &(0x7f0000000c00)={0x1, 0xc0, 0x9, 0x40}) r4 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPSET_CMD_HEADER(r4, &(0x7f0000000d40)={&(0x7f0000000c40)={0x10, 0x0, 0x0, 0x80000}, 0xc, &(0x7f0000000d00)={&(0x7f0000000c80)={0x48, 0xc, 0x6, 0x101, 0x0, 0x0, {0x5, 0x0, 0x9}, [@IPSET_ATTR_PROTOCOL={0x5}, @IPSET_ATTR_PROTOCOL={0x5}, @IPSET_ATTR_SETNAME={0x9, 0x2, 'syz2\x00'}, @IPSET_ATTR_PROTOCOL={0x5}, @IPSET_ATTR_PROTOCOL={0x5}, @IPSET_ATTR_PROTOCOL={0x5}]}, 0x48}, 0x1, 0x0, 0x0, 0x10}, 0x0) openat$binderfs(0xffffffffffffff9c, &(0x7f0000000d80)='./binderfs2/custom0\x00', 0x1, 0x0) openat$ttyS3(0xffffffffffffff9c, &(0x7f0000000e80), 0x4a80, 0x0) 00:52:54 executing program 7: r0 = openat$procfs(0xffffffffffffff9c, &(0x7f0000000000)='/proc/mdstat\x00', 0x0, 0x0) mmap$IORING_OFF_CQ_RING(&(0x7f0000ffc000/0x2000)=nil, 0x2000, 0x8, 0x4010, r0, 0x8000000) r1 = openat$cdrom(0xffffffffffffff9c, &(0x7f0000000040), 0xb0840, 0x0) ioctl$CDROM_LOCKDOOR(r1, 0x5329, 0x1) r2 = openat$procfs(0xffffffffffffff9c, &(0x7f0000000080)='/proc/slabinfo\x00', 0x0, 0x0) epoll_ctl$EPOLL_CTL_DEL(r2, 0x2, r0) r3 = fsmount(r2, 0x0, 0x7f) ioctl$CDROMREADMODE1(r3, 0x530d, &(0x7f00000000c0)={0x7, 0x1f, 0x3, 0x81, 0xf3, 0x7b}) mprotect(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x1000008) mmap$IORING_OFF_CQ_RING(&(0x7f0000ffe000/0x1000)=nil, 0x1000, 0x2, 0x80010, r3, 0x8000000) socketpair$nbd(0x1, 0x1, 0x0, &(0x7f0000000d80)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$sock_SIOCGIFINDEX_80211(r4, 0x8933, &(0x7f0000000dc0)={'wlan1\x00'}) r5 = syz_genetlink_get_family_id$batadv(&(0x7f0000000e40), r0) sendmsg$BATADV_CMD_GET_ORIGINATORS(r3, &(0x7f0000000f00)={&(0x7f0000000e00)={0x10, 0x0, 0x0, 0x400000}, 0xc, &(0x7f0000000ec0)={&(0x7f0000000e80)={0x34, r5, 0x2, 0x70bd29, 0x25dfdbff, {}, [@BATADV_ATTR_THROUGHPUT_OVERRIDE={0x8, 0x3b, 0x8}, @BATADV_ATTR_BRIDGE_LOOP_AVOIDANCE_ENABLED={0x5, 0x2e, 0x1}, @BATADV_ATTR_FRAGMENTATION_ENABLED={0x5, 0x30, 0x1}, @BATADV_ATTR_TPMETER_TEST_TIME={0x8, 0xb, 0xfffffffb}]}, 0x34}, 0x1, 0x0, 0x0, 0x20000000}, 0x4000000) ioctl$CDROM_GET_CAPABILITY(0xffffffffffffffff, 0x5331) sendmsg$NBD_CMD_DISCONNECT(0xffffffffffffffff, &(0x7f00000011c0)={&(0x7f00000010c0)={0x10, 0x0, 0x0, 0x4000}, 0xc, &(0x7f0000001180)={&(0x7f0000001140)={0x20, 0x0, 0x20, 0x70bd25, 0x25dfdbfe, {}, [@NBD_ATTR_BLOCK_SIZE_BYTES={0xc, 0x3, 0x9de}]}, 0x20}, 0x1, 0x0, 0x0, 0x20004000}, 0x200000c5) 00:52:54 executing program 0: r0 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$ieee802154(&(0x7f0000000040), 0xffffffffffffffff) ioctl$sock_SIOCGIFINDEX_802154(0xffffffffffffffff, 0x8933, &(0x7f0000000080)={'wpan0\x00', 0x0}) sendmsg$IEEE802154_LLSEC_DEL_DEVKEY(r0, &(0x7f0000000140)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x2000000}, 0xc, &(0x7f0000000100)={&(0x7f00000000c0)={0x38, r1, 0x2, 0x70bd27, 0x25dfdbfb, {}, [@IEEE802154_ATTR_LLSEC_KEY_SOURCE_SHORT={0x8, 0x2c, 0xee0}, @IEEE802154_ATTR_PAN_ID={0x6, 0x6, 0xffff}, @IEEE802154_ATTR_DEV_INDEX={0x8, 0x2, r2}, @IEEE802154_ATTR_LLSEC_KEY_SOURCE_EXTENDED={0xc, 0x2d, {0xaaaaaaaaaaaa0002}}]}, 0x38}}, 0x4) r3 = syz_genetlink_get_family_id$ieee802154(&(0x7f00000001c0), r0) sendmsg$IEEE802154_LLSEC_ADD_KEY(r0, &(0x7f00000002c0)={&(0x7f0000000180)={0x10, 0x0, 0x0, 0x80}, 0xc, &(0x7f0000000280)={&(0x7f0000000200)={0x70, r3, 0x8dc3595b298c372b, 0x70bd2c, 0x25dfdbfd, {}, [@IEEE802154_ATTR_HW_ADDR={0xc, 0x5, {0xaaaaaaaaaaaa0302}}, @IEEE802154_ATTR_LLSEC_KEY_SOURCE_EXTENDED={0xc, 0x2d, {0xaaaaaaaaaaaa0202}}, @IEEE802154_ATTR_HW_ADDR={0xc, 0x5, {0xaaaaaaaaaaaa0002}}, @IEEE802154_ATTR_LLSEC_KEY_USAGE_FRAME_TYPES={0x5, 0x31, 0x81}, @IEEE802154_ATTR_DEV_NAME={0xa, 0x1, 'wpan1\x00'}, @IEEE802154_ATTR_LLSEC_KEY_USAGE_COMMANDS={0x24, 0x32, "c38d2be0aa0107a2b38f85915a757ba51ff3d89ac2e1c596dce3055b00418226"}]}, 0x70}, 0x1, 0x0, 0x0, 0x20004040}, 0x0) r4 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) sendmsg$IEEE802154_ASSOCIATE_RESP(r4, &(0x7f0000000400)={&(0x7f0000000300)={0x10, 0x0, 0x0, 0x2000000}, 0xc, &(0x7f00000003c0)={&(0x7f0000000340)={0x60, r3, 0x200, 0x70bd26, 0x25dfdbfd, {}, [@IEEE802154_ATTR_COORD_HW_ADDR={0xc}, @IEEE802154_ATTR_STATUS={0x5, 0x3, 0x40}, @IEEE802154_ATTR_STATUS={0x5, 0x3, 0x1}, @IEEE802154_ATTR_COORD_HW_ADDR={0xc, 0x9, {0x2c841fbeb2fffbec}}, @IEEE802154_ATTR_COORD_HW_ADDR={0xc, 0x9, {0xaaaaaaaaaaaa0202}}, @IEEE802154_ATTR_STATUS={0x5, 0x3, 0x6}, @IEEE802154_ATTR_STATUS={0x5, 0x3, 0x3f}, @IEEE802154_ATTR_COORD_SHORT_ADDR={0x6, 0x8, 0xffff}]}, 0x60}, 0x1, 0x0, 0x0, 0x20000000}, 0x20000080) ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, &(0x7f0000000540)={0xc, 0x0, &(0x7f0000000440)=[@dead_binder_done], 0xbf, 0x0, &(0x7f0000000480)="0537636f85beafebd2a00648fb042246bcbd2150d45e58acedd2718aaa529794fc45c87c914f2b69b82fedb220d6a94b2babd3f188631b48d025c32a8342250d69582838e7ee6d22fa335ce4315412805f50869d3f4bef11a5bb26ac3704b717f9416fc1f441d5dd77d4b3c1a283f3179a7daf20c0d30210361ea15f09fd38e2c2ac52383e1685a787783f4524fd7d784046605442e441fb76b236455574d7fe70d1885d924099864313d8d3d84c106a36d2ccc77c51d3cdaf3f716551fc0a"}) r5 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) syz_genetlink_get_family_id$ieee802154(&(0x7f0000000580), r5) sendmsg$IEEE802154_SET_MACPARAMS(r0, &(0x7f0000000680)={&(0x7f00000005c0)={0x10, 0x0, 0x0, 0x1000}, 0xc, &(0x7f0000000640)={&(0x7f0000000600)={0x2c, r3, 0x2, 0x70bd2d, 0x25dfdbfd, {}, [@IEEE802154_ATTR_CCA_ED_LEVEL={0x8, 0x24, 0x7fffffff}, @IEEE802154_ATTR_TXPOWER={0x5, 0x21, 0x3}, @IEEE802154_ATTR_CSMA_MAX_BE={0x5, 0x27, 0x4}]}, 0x2c}, 0x1, 0x0, 0x0, 0x40801}, 0x40840) r6 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) sendmsg$IEEE802154_LLSEC_DEL_SECLEVEL(r6, &(0x7f00000007c0)={&(0x7f00000006c0)={0x10, 0x0, 0x0, 0x40000000}, 0xc, &(0x7f0000000780)={&(0x7f0000000700)={0x44, r3, 0x300, 0x70bd2a, 0x25dfdbfb, {}, [@IEEE802154_ATTR_DEV_INDEX={0x8, 0x2, r2}, @IEEE802154_ATTR_LLSEC_FRAME_TYPE={0x5, 0x33, 0x1f}, @IEEE802154_ATTR_LLSEC_FRAME_TYPE={0x5, 0x33, 0x7}, @IEEE802154_ATTR_LLSEC_CMD_FRAME_ID={0x5, 0x34, 0xcb}, @IEEE802154_ATTR_LLSEC_DEV_OVERRIDE={0x5, 0x36, 0x1}, @IEEE802154_ATTR_LLSEC_CMD_FRAME_ID={0x5, 0x34, 0x1}]}, 0x44}, 0x1, 0x0, 0x0, 0x40000a1}, 0x4800) sendmsg$IEEE802154_LLSEC_DEL_KEY(0xffffffffffffffff, &(0x7f0000000c80)={&(0x7f0000000b40)={0x10, 0x0, 0x0, 0x40000000}, 0xc, &(0x7f0000000c40)={&(0x7f0000000bc0)={0x58, 0x0, 0x402, 0x70bd2d, 0x25dfdbff, {}, [@IEEE802154_ATTR_LLSEC_KEY_MODE={0x5, 0x2b, 0x1}, @IEEE802154_ATTR_DEV_NAME={0xa, 0x1, 'wpan3\x00'}, @IEEE802154_ATTR_LLSEC_KEY_SOURCE_EXTENDED={0xc, 0x2d, {0xaaaaaaaaaaaa0302}}, @IEEE802154_ATTR_LLSEC_KEY_ID={0x5, 0x2e, 0x4}, @IEEE802154_ATTR_LLSEC_KEY_ID={0x5, 0x2e, 0x3}, @IEEE802154_ATTR_SHORT_ADDR={0x6, 0x4, 0xfffd}, @IEEE802154_ATTR_HW_ADDR={0xc}]}, 0x58}, 0x1, 0x0, 0x0, 0x40800}, 0x24040000) 00:53:02 executing program 7: r0 = openat$procfs(0xffffffffffffff9c, &(0x7f0000000000)='/proc/mdstat\x00', 0x0, 0x0) mmap$IORING_OFF_CQ_RING(&(0x7f0000ffc000/0x2000)=nil, 0x2000, 0x8, 0x4010, r0, 0x8000000) r1 = openat$cdrom(0xffffffffffffff9c, &(0x7f0000000040), 0xb0840, 0x0) ioctl$CDROM_LOCKDOOR(r1, 0x5329, 0x1) r2 = openat$procfs(0xffffffffffffff9c, &(0x7f0000000080)='/proc/slabinfo\x00', 0x0, 0x0) epoll_ctl$EPOLL_CTL_DEL(r2, 0x2, r0) r3 = fsmount(r2, 0x0, 0x7f) ioctl$CDROMREADMODE1(r3, 0x530d, &(0x7f00000000c0)={0x7, 0x1f, 0x3, 0x81, 0xf3, 0x7b}) mprotect(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x1000008) mmap$IORING_OFF_CQ_RING(&(0x7f0000ffe000/0x1000)=nil, 0x1000, 0x2, 0x80010, r3, 0x8000000) socketpair$nbd(0x1, 0x1, 0x0, &(0x7f0000000d80)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$sock_SIOCGIFINDEX_80211(r4, 0x8933, &(0x7f0000000dc0)={'wlan1\x00'}) r5 = syz_genetlink_get_family_id$batadv(&(0x7f0000000e40), r0) sendmsg$BATADV_CMD_GET_ORIGINATORS(r3, &(0x7f0000000f00)={&(0x7f0000000e00)={0x10, 0x0, 0x0, 0x400000}, 0xc, &(0x7f0000000ec0)={&(0x7f0000000e80)={0x34, r5, 0x2, 0x70bd29, 0x25dfdbff, {}, [@BATADV_ATTR_THROUGHPUT_OVERRIDE={0x8, 0x3b, 0x8}, @BATADV_ATTR_BRIDGE_LOOP_AVOIDANCE_ENABLED={0x5, 0x2e, 0x1}, @BATADV_ATTR_FRAGMENTATION_ENABLED={0x5, 0x30, 0x1}, @BATADV_ATTR_TPMETER_TEST_TIME={0x8, 0xb, 0xfffffffb}]}, 0x34}, 0x1, 0x0, 0x0, 0x20000000}, 0x4000000) r6 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) sendmsg$NBD_CMD_DISCONNECT(r6, &(0x7f00000011c0)={&(0x7f00000010c0)={0x10, 0x0, 0x0, 0x4000}, 0xc, &(0x7f0000001180)={&(0x7f0000001140)={0x20, 0x0, 0x20, 0x70bd25, 0x25dfdbfe, {}, [@NBD_ATTR_BLOCK_SIZE_BYTES={0xc, 0x3, 0x9de}]}, 0x20}, 0x1, 0x0, 0x0, 0x20004000}, 0x200000c5) 00:53:02 executing program 4: r0 = openat$ttyS3(0xffffffffffffff9c, &(0x7f0000000000), 0xa2000, 0x0) ioctl$TIOCSETD(r0, 0x5423, &(0x7f0000000040)=0x13) r1 = fsmount(0xffffffffffffffff, 0x1, 0x76) ioctl$TCSETAF(r1, 0x5408, &(0x7f0000000080)={0x5, 0x8001, 0x4, 0x8001, 0x15, "b45da66f02087ca7"}) ioctl$TCSETAF(r1, 0x5408, &(0x7f00000000c0)={0x5, 0x22c1, 0x800, 0x8, 0x5, "2b8c058f839aaa67"}) connect$netlink(r1, &(0x7f0000000100)=@proc={0x10, 0x0, 0x25dfdbfd, 0x2}, 0xc) r2 = syz_open_dev$tty1(0xc, 0x4, 0x4) ioctl$TCSETSF(r2, 0x5404, &(0x7f0000000140)={0x6, 0x2, 0x2, 0x80000001, 0x1b, "c2331e6388ffeb48419d467a4b791ad4343a96"}) ioctl$TIOCMGET(r1, 0x5415, &(0x7f0000000180)) ioctl$TCSETAF(r2, 0x5408, &(0x7f00000001c0)={0x11, 0x0, 0xfff, 0x7, 0xd, "3ae59dd65d54337c"}) r3 = timerfd_create(0x7, 0x800) timerfd_settime(r3, 0x1, &(0x7f0000000200), &(0x7f0000000240)) ioctl$TCSETAF(r2, 0x5408, &(0x7f0000000280)={0x1, 0x1, 0x3d4c, 0x200, 0x0, "73a709364d80b6c1"}) ioctl$PIO_UNIMAPCLR(0xffffffffffffffff, 0x4b68, &(0x7f00000002c0)={0x73, 0x1fe0, 0x8b}) ioctl$TCSETSF2(r2, 0x402c542d, &(0x7f0000000300)={0xffffffff, 0x0, 0x80000000, 0x9, 0x6, "35157e2ff53385c0969535964d148320e065e8", 0x6}) socket(0x16, 0x1, 0x9) 00:53:02 executing program 5: prctl$PR_GET_FPEXC(0xb, &(0x7f0000000000)) r0 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000040)='./binderfs/custom0\x00', 0x800, 0x0) ustat(0x800, &(0x7f0000000080)) ioctl$ifreq_SIOCGIFINDEX_batadv_mesh(0xffffffffffffffff, 0x8933, &(0x7f0000000100)={'batadv0\x00', 0x0}) ioctl$ifreq_SIOCGIFINDEX_batadv_hard(0xffffffffffffffff, 0x8933, &(0x7f0000000140)={'batadv_slave_0\x00', 0x0}) sendmsg$ETHTOOL_MSG_PAUSE_GET(0xffffffffffffffff, &(0x7f00000002c0)={&(0x7f00000000c0)={0x10, 0x0, 0x0, 0x10000}, 0xc, &(0x7f0000000280)={&(0x7f0000000180)={0xdc, 0x0, 0x8, 0x70bd27, 0x25dfdbfb, {}, [@HEADER={0x5c, 0x1, 0x0, 0x1, [@ETHTOOL_A_HEADER_DEV_INDEX={0x8, 0x1, r1}, @ETHTOOL_A_HEADER_FLAGS={0x8}, @ETHTOOL_A_HEADER_DEV_NAME={0x14, 0x2, 'veth0_vlan\x00'}, @ETHTOOL_A_HEADER_DEV_INDEX={0x8}, @ETHTOOL_A_HEADER_FLAGS={0x8, 0x3, 0x3}, @ETHTOOL_A_HEADER_FLAGS={0x8, 0x3, 0x2}, @ETHTOOL_A_HEADER_DEV_INDEX={0x8, 0x1, r2}, @ETHTOOL_A_HEADER_DEV_NAME={0x14, 0x2, 'macvlan0\x00'}]}, @HEADER={0x40, 0x1, 0x0, 0x1, [@ETHTOOL_A_HEADER_DEV_NAME={0x14, 0x2, 'veth0_to_bridge\x00'}, @ETHTOOL_A_HEADER_DEV_NAME={0x14, 0x2, 'veth0_to_bridge\x00'}, @ETHTOOL_A_HEADER_DEV_NAME={0x14, 0x2, 'netpci0\x00'}]}, @HEADER={0x2c, 0x1, 0x0, 0x1, [@ETHTOOL_A_HEADER_DEV_NAME={0x14, 0x2, 'bond_slave_1\x00'}, @ETHTOOL_A_HEADER_DEV_NAME={0x14, 0x2, 'ip_vti0\x00'}]}]}, 0xdc}, 0x1, 0x0, 0x0, 0x4000}, 0x24000000) sendmsg$NBD_CMD_STATUS(0xffffffffffffffff, &(0x7f0000000400)={&(0x7f0000000300)={0x10, 0x0, 0x0, 0x4}, 0xc, &(0x7f00000003c0)={&(0x7f0000000340)={0x44, 0x0, 0x20, 0x70bd2d, 0x25dfdbfc, {}, [@NBD_ATTR_SIZE_BYTES={0xc, 0x2, 0x4}, @NBD_ATTR_SOCKETS={0x24, 0x7, 0x0, 0x1, [{0x8}, {0x8}, {0x8}, {0x8}]}]}, 0x44}}, 0x4000) ioctl$BINDER_GET_NODE_DEBUG_INFO(r0, 0xc018620b, &(0x7f0000000440)={0x3}) syz_genetlink_get_family_id$batadv(&(0x7f0000000480), 0xffffffffffffffff) r3 = syz_open_dev$ttys(0xc, 0x2, 0x0) ioctl$TCSETAF(r3, 0x5408, &(0x7f00000004c0)={0x4, 0xb073, 0x1000, 0x1, 0x13, "b786e10fbdab60cc"}) openat$binderfs(0xffffffffffffff9c, &(0x7f0000000500)='./binderfs2/binder0\x00', 0x802, 0x0) sendmsg$BATADV_CMD_SET_VLAN(0xffffffffffffffff, &(0x7f0000000600)={&(0x7f0000000540)={0x10, 0x0, 0x0, 0x80000}, 0xc, &(0x7f00000005c0)={&(0x7f0000000580)={0x30, 0x0, 0x400, 0x70bd27, 0x25dfdbfb, {}, [@BATADV_ATTR_FRAGMENTATION_ENABLED={0x5, 0x30, 0x1}, @BATADV_ATTR_ORIG_ADDRESS={0xa, 0x9, @random="62836be88da6"}, @BATADV_ATTR_ISOLATION_MASK={0x8, 0x2c, 0x81}]}, 0x30}, 0x1, 0x0, 0x0, 0x8004}, 0x4c000) syz_open_dev$ttys(0xc, 0x2, 0x0) clone(0x28000800, &(0x7f0000000880)="b3f828035cfe9f8546c65ee8fffa58fb52d9bafabf363f0161cf01b4a2872006d34dcf860667a59d8c5631820a98c05b3989c5037ea89b5a58e8e9809cc008c7ae03db6bb845b2c189e79729a6d2c9a5440c276c7d0686adda809621c1d9723369157389ff141a56cbc54111ec7f92e8262b0c9ab88b9bffbb114333ab5a9711171c09e2589351fa4950d7af92bccf71585c21606994d6b4443d2cb6725d2c983a62f6f0", &(0x7f0000000940), &(0x7f0000000980), &(0x7f00000009c0)="073c516951c56a5fb1d10f1151ef77ee30e71fea92d34f29ddbe9265f84a8e761f6f56055bef1048f67ec1da822c677e9c34d5d52feb791c13c75661003151c2a956098cc6") 00:53:02 executing program 6: ioctl$sock_SIOCGIFINDEX_802154(0xffffffffffffffff, 0x8933, &(0x7f0000000000)={'wpan1\x00', 0x0}) r1 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) ioctl$sock_SIOCGIFINDEX_802154(0xffffffffffffffff, 0x8933, &(0x7f0000000080)={'wpan3\x00', 0x0}) sendmsg$IEEE802154_LLSEC_ADD_SECLEVEL(r1, &(0x7f0000000140)={&(0x7f0000000040)={0x10, 0x0, 0x0, 0x800000}, 0xc, &(0x7f0000000100)={&(0x7f00000000c0)={0x2c, 0x0, 0x400, 0x70bd2a, 0x25dfdbfe, {}, [@IEEE802154_ATTR_DEV_INDEX={0x8, 0x2, r0}, @IEEE802154_ATTR_DEV_INDEX={0x8, 0x2, r0}, @IEEE802154_ATTR_DEV_INDEX={0x8, 0x2, r2}]}, 0x2c}, 0x1, 0x0, 0x0, 0x4004081}, 0x10) sendmsg$IEEE802154_LLSEC_DEL_KEY(r1, &(0x7f0000000240)={&(0x7f0000000180)={0x10, 0x0, 0x0, 0x1000000}, 0xc, &(0x7f0000000200)={&(0x7f00000001c0)={0x3c, 0x0, 0x30e, 0x70bd25, 0x25dfdbfd, {}, [@IEEE802154_ATTR_HW_ADDR={0xc, 0x5, {0xaaaaaaaaaaaa0102}}, @IEEE802154_ATTR_LLSEC_KEY_SOURCE_EXTENDED={0xc, 0x2d, {0xaaaaaaaaaaaa0102}}, @IEEE802154_ATTR_LLSEC_KEY_SOURCE_SHORT={0x8, 0x2c, 0x5}, @IEEE802154_ATTR_DEV_INDEX={0x8}]}, 0x3c}, 0x1, 0x0, 0x0, 0x24041000}, 0x44) socketpair$nbd(0x1, 0x1, 0x0, &(0x7f0000002280)={0xffffffffffffffff}) r4 = openat$procfs(0xffffffffffffff9c, &(0x7f00000022c0)='/proc/asound/seq/clients\x00', 0x0, 0x0) socketpair$nbd(0x1, 0x1, 0x0, &(0x7f0000002300)={0xffffffffffffffff}) r6 = socket(0x1d, 0x3, 0x6) r7 = openat$zero(0xffffffffffffff9c, &(0x7f0000002340), 0x2, 0x0) socketpair$nbd(0x1, 0x1, 0x0, &(0x7f0000002380)={0xffffffffffffffff}) sendmsg$NBD_CMD_DISCONNECT(r1, &(0x7f0000002480)={&(0x7f0000000280)={0x10, 0x0, 0x0, 0x80000}, 0xc, &(0x7f0000002440)={&(0x7f00000023c0)={0x6c, 0x0, 0x400, 0x70bd27, 0x25dfdbfb, {}, [@NBD_ATTR_TIMEOUT={0xc, 0x4, 0x100000001}, @NBD_ATTR_SOCKETS={0x4c, 0x7, 0x0, 0x1, [{0x8, 0x1, r3}, {0x8, 0x1, r4}, {0x8}, {0x8, 0x1, r5}, {0x8}, {0x8, 0x1, r6}, {0x8, 0x1, r7}, {0x8, 0x1, r8}, {0x8}]}]}, 0x6c}, 0x1, 0x0, 0x0, 0x20000000}, 0x4000020) r9 = syz_genetlink_get_family_id$ieee802154(&(0x7f0000002500), r1) sendmsg$IEEE802154_LLSEC_LIST_SECLEVEL(r1, &(0x7f00000025c0)={&(0x7f00000024c0)={0x10, 0x0, 0x0, 0x4}, 0xc, &(0x7f0000002580)={&(0x7f0000002540)={0x14, r9, 0x100, 0x70bd25, 0x25dfdbfd, {}, ["", "", "", "", "", ""]}, 0x14}, 0x1, 0x0, 0x0, 0x11}, 0x20000084) ioctl$TIOCGPTPEER(r7, 0x5441, 0xe5) 00:53:02 executing program 1: r0 = openat$zero(0xffffffffffffff9c, &(0x7f0000000000), 0x400200, 0x0) ioctl$SECCOMP_IOCTL_NOTIF_ADDFD(r0, 0x40182103, &(0x7f0000000040)={0x0, 0x1, 0xffffffffffffffff, 0x80000000, 0x80000}) r1 = syz_genetlink_get_family_id$batadv(&(0x7f00000000c0), r0) sendmsg$BATADV_CMD_GET_TRANSTABLE_LOCAL(r0, &(0x7f00000001c0)={&(0x7f0000000080)={0x10, 0x0, 0x0, 0x80000}, 0xc, &(0x7f0000000180)={&(0x7f0000000100)={0x54, r1, 0x200, 0x70bd25, 0x25dfdbff, {}, [@BATADV_ATTR_THROUGHPUT_OVERRIDE={0x8, 0x3b, 0x89}, @BATADV_ATTR_THROUGHPUT_OVERRIDE={0x8, 0x3b, 0xffff}, @BATADV_ATTR_FRAGMENTATION_ENABLED={0x5}, @BATADV_ATTR_AGGREGATED_OGMS_ENABLED={0x5}, @BATADV_ATTR_MULTICAST_FORCEFLOOD_ENABLED={0x5}, @BATADV_ATTR_BRIDGE_LOOP_AVOIDANCE_ENABLED={0x5}, @BATADV_ATTR_HARD_IFINDEX={0x8}, @BATADV_ATTR_GW_MODE={0x5, 0x33, 0x1}]}, 0x54}, 0x1, 0x0, 0x0, 0x48041}, 0x4840) r2 = openat$procfs(0xffffffffffffff9c, &(0x7f0000000200)='/proc/cpuinfo\x00', 0x0, 0x0) sendmsg$BATADV_CMD_GET_GATEWAYS(r2, &(0x7f0000000340)={&(0x7f0000000240)={0x10, 0x0, 0x0, 0x1000000}, 0xc, &(0x7f0000000300)={&(0x7f0000000280)={0x50, r1, 0x400, 0x70bd26, 0x25dfdbfb, {}, [@BATADV_ATTR_BRIDGE_LOOP_AVOIDANCE_ENABLED={0x5, 0x2e, 0x1}, @BATADV_ATTR_ISOLATION_MARK={0x8, 0x2b, 0x3}, @BATADV_ATTR_BONDING_ENABLED={0x5}, @BATADV_ATTR_BRIDGE_LOOP_AVOIDANCE_ENABLED={0x5, 0x2e, 0x1}, @BATADV_ATTR_ORIG_ADDRESS={0xa, 0x9, @multicast}, @BATADV_ATTR_THROUGHPUT_OVERRIDE={0x8, 0x3b, 0x1}, @BATADV_ATTR_ISOLATION_MARK={0x8, 0x2b, 0x6}]}, 0x50}, 0x1, 0x0, 0x0, 0x20049800}, 0x80) r3 = syz_genetlink_get_family_id$batadv(&(0x7f00000003c0), r0) sendmsg$BATADV_CMD_SET_MESH(r0, &(0x7f0000000480)={&(0x7f0000000380)={0x10, 0x0, 0x0, 0x1000}, 0xc, &(0x7f0000000440)={&(0x7f0000000400)={0x34, r3, 0x400, 0x70bd2d, 0x25dfdbff, {}, [@BATADV_ATTR_GW_MODE={0x5}, @BATADV_ATTR_GW_BANDWIDTH_UP={0x8, 0x32, 0x8001}, @BATADV_ATTR_ORIG_INTERVAL={0x8, 0x39, 0x4}, @BATADV_ATTR_NETWORK_CODING_ENABLED={0x5, 0x38, 0x1}]}, 0x34}, 0x1, 0x0, 0x0, 0x4000000}, 0x18000) r4 = fsmount(r0, 0x1, 0x5) r5 = fsmount(r2, 0x1, 0x7a) epoll_ctl$EPOLL_CTL_ADD(r4, 0x1, r5, &(0x7f00000016c0)={0x80002000}) r6 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000001700), 0x111002, 0x0) epoll_ctl$EPOLL_CTL_MOD(r0, 0x3, r6, &(0x7f0000001740)) ioctl$SECCOMP_IOCTL_NOTIF_ID_VALID(r5, 0x40082102, &(0x7f0000001780)) rt_sigqueueinfo(0xffffffffffffffff, 0x2, &(0x7f00000017c0)={0x16, 0x5, 0x8}) 00:53:02 executing program 3: clone(0x400, &(0x7f0000000000)="2f59adb4fe8bdd18e28d59f811fee00f6e", &(0x7f0000000040), &(0x7f0000000080), &(0x7f00000000c0)="ee4468595a6a9e17d313ddea1158c7520b4ce752e1feceb8bd763f38764fe32d5b11f9842e25fb3843f95d48bcbb676b94dc456e5f562cd49d08bd5ac38eb9d6acfc2fa3928b3de489313465b4bea18ac19b9efcb135738e957c5dfaa38b9755182fa0eb46bac360130ee66e2636e1d6aafb8e5918d6d0f8338603cd9bd3e0f3b5d106eae77f68fc50df9f58fd8061a03c31d04b3551c672a8334c0f3bd81aea189fc02f258c22a8b0dba2a60f9a458d6eff75d32cf215930f0bccd5f8ee1d8d33a86c5eda24ec311adc") ioctl$CDROMREADMODE1(0xffffffffffffffff, 0x530d, &(0x7f00000001c0)={0x8, 0x81, 0x4, 0x1, 0x1, 0x8}) ioctl$CDROMREADRAW(0xffffffffffffffff, 0x5314, &(0x7f0000000c40)={0x1, 0x5, 0x7, 0xe5, 0x2, 0x81}) r0 = openat$zero(0xffffffffffffff9c, &(0x7f00000016c0), 0x0, 0x0) ioctl$CDROMSTART(r0, 0x5308) rt_sigaction(0xf, &(0x7f0000001780)={&(0x7f0000001700)="66430f3a15df22c402d937a80e000000f347241ac44218f34ce000c4a2b528e8db5a2466440f38014fdb660f3810b006a50000c421fc295a0cdcf1", 0x80000004, &(0x7f0000001740)="642e41dde78f684ca2df01416dc463755c460b34f3460fa6c0c4c11b7cc7c442f1ad5b00f0430fab6b000f0f62f79af046f71c54", {[0xfffffffffffffffe]}}, &(0x7f0000001840)={&(0x7f00000017c0)="f240af66e20067363666460ffa6f5136360f974700c48165da31c422050c1ec4c17a6fbb2f000000c4027d2074f407f2430f1a39ff30", 0x0, &(0x7f0000001800)="c462394627defbc401f1d3cac46159de6e1fc4816c58a20700000066430faef2c4c16b7c9f0300000066400f6620f0ff0500000000c4e111d2f9"}, 0x8, &(0x7f0000001880)) timerfd_create(0x9, 0x800) prctl$PR_GET_FPEXC(0xb, &(0x7f00000018c0)) recvmmsg(r0, &(0x7f0000003c40)=[{{&(0x7f0000001900)=@pppol2tp={0x18, 0x1, {0x0, 0xffffffffffffffff, {0x2, 0x0, @empty}}}, 0x80, &(0x7f00000029c0)=[{&(0x7f0000001980)=""/39, 0x27}, {&(0x7f00000019c0)=""/4096, 0x1000}], 0x2, &(0x7f0000002a00)=""/18, 0x12}, 0x3f}, {{&(0x7f0000002a40)=@nfc, 0x80, &(0x7f0000002e80)=[{&(0x7f0000002ac0)=""/44, 0x2c}, {&(0x7f0000002b00)=""/65, 0x41}, {&(0x7f0000002b80)=""/107, 0x6b}, {&(0x7f0000002c00)=""/158, 0x9e}, {&(0x7f0000002cc0)=""/169, 0xa9}, {&(0x7f0000002d80)=""/57, 0x39}, {&(0x7f0000002dc0)=""/160, 0xa0}], 0x7}, 0x6}, {{&(0x7f0000002f00)=@x25={0x9, @remote}, 0x80, &(0x7f0000003100)=[{&(0x7f0000002f80)=""/101, 0x65}, {&(0x7f0000003000)}, {&(0x7f0000003040)=""/187, 0xbb}], 0x3, &(0x7f0000003140)=""/159, 0x9f}, 0xffffffff}, {{&(0x7f0000003200)=@ll={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @dev}, 0x80, &(0x7f0000003400)=[{&(0x7f0000003280)=""/29, 0x1d}, {&(0x7f00000032c0)=""/41, 0x29}, {&(0x7f0000003300)=""/219, 0xdb}], 0x3, &(0x7f0000003440)=""/204, 0xcc}, 0x2f62}, {{&(0x7f0000003540)=@hci, 0x80, &(0x7f0000003b80)=[{&(0x7f00000035c0)=""/168, 0xa8}, {&(0x7f0000003680)=""/128, 0x80}, {&(0x7f0000003700)=""/75, 0x4b}, {&(0x7f0000003780)=""/189, 0xbd}, {&(0x7f0000003840)=""/168, 0xa8}, {&(0x7f0000003900)=""/132, 0x84}, {&(0x7f00000039c0)=""/162, 0xa2}, {&(0x7f0000003a80)=""/198, 0xc6}], 0x8, &(0x7f0000003c00)=""/25, 0x19}, 0xfc00}], 0x5, 0x21, &(0x7f0000003d80)) r2 = socket$netlink(0x10, 0x3, 0xe) syz_genetlink_get_family_id$smc(&(0x7f0000003dc0), r2) timerfd_create(0x6, 0x800) ioctl$BINDER_THREAD_EXIT(r0, 0x40046208, 0x0) epoll_ctl$EPOLL_CTL_MOD(r0, 0x3, r1, &(0x7f0000003e00)={0xb0000000}) r3 = io_uring_setup(0x35ea, &(0x7f0000003e40)={0x0, 0x7cfa, 0x2, 0x0, 0x210, 0x0, r0}) io_uring_setup(0x106d, &(0x7f0000003ec0)={0x0, 0xb36, 0x1e, 0x1, 0xa7, 0x0, r3}) sendmsg$NBD_CMD_STATUS(0xffffffffffffffff, &(0x7f0000004040)={&(0x7f0000003f40)={0x10, 0x0, 0x0, 0x8}, 0xc, &(0x7f0000004000)={&(0x7f0000003f80)={0x6c, 0x0, 0x20, 0x70bd2a, 0x25dfdbff, {}, [@NBD_ATTR_DEAD_CONN_TIMEOUT={0xc, 0x8, 0x68b2}, @NBD_ATTR_SIZE_BYTES={0xc, 0x2, 0x1f}, @NBD_ATTR_SIZE_BYTES={0xc, 0x2, 0x8}, @NBD_ATTR_TIMEOUT={0xc, 0x4, 0x6}, @NBD_ATTR_DEAD_CONN_TIMEOUT={0xc, 0x8, 0x3}, @NBD_ATTR_CLIENT_FLAGS={0xc, 0x6, 0x1}, @NBD_ATTR_INDEX={0x8, 0x1, 0x0}, @NBD_ATTR_INDEX={0x8, 0x1, 0x0}]}, 0x6c}, 0x1, 0x0, 0x0, 0x40840}, 0x10) r4 = syz_genetlink_get_family_id$nbd(&(0x7f00000040c0), 0xffffffffffffffff) sendmsg$NBD_CMD_RECONFIGURE(0xffffffffffffffff, &(0x7f00000041c0)={&(0x7f0000004080)={0x10, 0x0, 0x0, 0x2000}, 0xc, &(0x7f0000004180)={&(0x7f0000004140)={0x3c, r4, 0x100, 0x70bd29, 0x25dfdbfd, {}, [@NBD_ATTR_SOCKETS={0x14, 0x7, 0x0, 0x1, [{0x8}, {0x8}]}, @NBD_ATTR_INDEX={0x8, 0x1, 0x0}, @NBD_ATTR_SOCKETS={0xc, 0x7, 0x0, 0x1, [{0x8, 0x1, r0}]}]}, 0x3c}, 0x1, 0x0, 0x0, 0x810}, 0x40000) 00:53:02 executing program 2: r0 = fsmount(0xffffffffffffffff, 0x1, 0x2) r1 = fsmount(r0, 0x1, 0x7c) fsconfig$FSCONFIG_CMD_CREATE(r1, 0x6, 0x0, 0x0, 0x0) r2 = fsmount(r0, 0x0, 0x8) ioctl$CDROMREADCOOKED(r2, 0x5315, &(0x7f0000000000)) sendmsg$IPSET_CMD_HEADER(r0, &(0x7f0000000b40)={&(0x7f0000000a80)={0x10, 0x0, 0x0, 0x1000000}, 0xc, &(0x7f0000000b00)={&(0x7f0000000ac0)={0x28, 0xc, 0x6, 0x801, 0x0, 0x0, {0xf, 0x0, 0xa}, [@IPSET_ATTR_PROTOCOL={0x5}, @IPSET_ATTR_SETNAME={0x9, 0x2, 'syz2\x00'}]}, 0x28}, 0x1, 0x0, 0x0, 0x4000881}, 0x10) r3 = openat$zero(0xffffffffffffff9c, &(0x7f0000000b80), 0x0, 0x0) mmap$binder(&(0x7f0000fff000/0x1000)=nil, 0x1000, 0x1, 0x11, r3, 0x358f) ioctl$TIOCGICOUNT(r3, 0x545d, 0x0) ioctl$HIDIOCGPHYS(r2, 0x80404812, &(0x7f0000000bc0)) ioctl$CDROMVOLCTRL(r3, 0x530a, &(0x7f0000000c00)={0x1, 0xc0, 0x9, 0x40}) r4 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPSET_CMD_HEADER(r4, &(0x7f0000000d40)={&(0x7f0000000c40)={0x10, 0x0, 0x0, 0x80000}, 0xc, &(0x7f0000000d00)={&(0x7f0000000c80)={0x48, 0xc, 0x6, 0x101, 0x0, 0x0, {0x5, 0x0, 0x9}, [@IPSET_ATTR_PROTOCOL={0x5}, @IPSET_ATTR_PROTOCOL={0x5}, @IPSET_ATTR_SETNAME={0x9, 0x2, 'syz2\x00'}, @IPSET_ATTR_PROTOCOL={0x5}, @IPSET_ATTR_PROTOCOL={0x5}, @IPSET_ATTR_PROTOCOL={0x5}]}, 0x48}, 0x1, 0x0, 0x0, 0x10}, 0x0) openat$ttyS3(0xffffffffffffff9c, &(0x7f0000000e80), 0x4a80, 0x0) 00:53:02 executing program 0: r0 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$ieee802154(&(0x7f0000000040), 0xffffffffffffffff) ioctl$sock_SIOCGIFINDEX_802154(0xffffffffffffffff, 0x8933, &(0x7f0000000080)={'wpan0\x00', 0x0}) sendmsg$IEEE802154_LLSEC_DEL_DEVKEY(r0, &(0x7f0000000140)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x2000000}, 0xc, &(0x7f0000000100)={&(0x7f00000000c0)={0x38, r1, 0x2, 0x70bd27, 0x25dfdbfb, {}, [@IEEE802154_ATTR_LLSEC_KEY_SOURCE_SHORT={0x8, 0x2c, 0xee0}, @IEEE802154_ATTR_PAN_ID={0x6, 0x6, 0xffff}, @IEEE802154_ATTR_DEV_INDEX={0x8, 0x2, r2}, @IEEE802154_ATTR_LLSEC_KEY_SOURCE_EXTENDED={0xc, 0x2d, {0xaaaaaaaaaaaa0002}}]}, 0x38}}, 0x4) r3 = syz_genetlink_get_family_id$ieee802154(&(0x7f00000001c0), r0) sendmsg$IEEE802154_LLSEC_ADD_KEY(r0, &(0x7f00000002c0)={&(0x7f0000000180)={0x10, 0x0, 0x0, 0x80}, 0xc, &(0x7f0000000280)={&(0x7f0000000200)={0x70, r3, 0x8dc3595b298c372b, 0x70bd2c, 0x25dfdbfd, {}, [@IEEE802154_ATTR_HW_ADDR={0xc, 0x5, {0xaaaaaaaaaaaa0302}}, @IEEE802154_ATTR_LLSEC_KEY_SOURCE_EXTENDED={0xc, 0x2d, {0xaaaaaaaaaaaa0202}}, @IEEE802154_ATTR_HW_ADDR={0xc, 0x5, {0xaaaaaaaaaaaa0002}}, @IEEE802154_ATTR_LLSEC_KEY_USAGE_FRAME_TYPES={0x5, 0x31, 0x81}, @IEEE802154_ATTR_DEV_NAME={0xa, 0x1, 'wpan1\x00'}, @IEEE802154_ATTR_LLSEC_KEY_USAGE_COMMANDS={0x24, 0x32, "c38d2be0aa0107a2b38f85915a757ba51ff3d89ac2e1c596dce3055b00418226"}]}, 0x70}, 0x1, 0x0, 0x0, 0x20004040}, 0x0) r4 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) sendmsg$IEEE802154_ASSOCIATE_RESP(r4, &(0x7f0000000400)={&(0x7f0000000300)={0x10, 0x0, 0x0, 0x2000000}, 0xc, &(0x7f00000003c0)={&(0x7f0000000340)={0x60, r3, 0x200, 0x70bd26, 0x25dfdbfd, {}, [@IEEE802154_ATTR_COORD_HW_ADDR={0xc}, @IEEE802154_ATTR_STATUS={0x5, 0x3, 0x40}, @IEEE802154_ATTR_STATUS={0x5, 0x3, 0x1}, @IEEE802154_ATTR_COORD_HW_ADDR={0xc, 0x9, {0x2c841fbeb2fffbec}}, @IEEE802154_ATTR_COORD_HW_ADDR={0xc, 0x9, {0xaaaaaaaaaaaa0202}}, @IEEE802154_ATTR_STATUS={0x5, 0x3, 0x6}, @IEEE802154_ATTR_STATUS={0x5, 0x3, 0x3f}, @IEEE802154_ATTR_COORD_SHORT_ADDR={0x6, 0x8, 0xffff}]}, 0x60}, 0x1, 0x0, 0x0, 0x20000000}, 0x20000080) ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, &(0x7f0000000540)={0xc, 0x0, &(0x7f0000000440)=[@dead_binder_done], 0xbf, 0x0, &(0x7f0000000480)="0537636f85beafebd2a00648fb042246bcbd2150d45e58acedd2718aaa529794fc45c87c914f2b69b82fedb220d6a94b2babd3f188631b48d025c32a8342250d69582838e7ee6d22fa335ce4315412805f50869d3f4bef11a5bb26ac3704b717f9416fc1f441d5dd77d4b3c1a283f3179a7daf20c0d30210361ea15f09fd38e2c2ac52383e1685a787783f4524fd7d784046605442e441fb76b236455574d7fe70d1885d924099864313d8d3d84c106a36d2ccc77c51d3cdaf3f716551fc0a"}) r5 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) syz_genetlink_get_family_id$ieee802154(&(0x7f0000000580), r5) sendmsg$IEEE802154_SET_MACPARAMS(r0, &(0x7f0000000680)={&(0x7f00000005c0)={0x10, 0x0, 0x0, 0x1000}, 0xc, &(0x7f0000000640)={&(0x7f0000000600)={0x2c, r3, 0x2, 0x70bd2d, 0x25dfdbfd, {}, [@IEEE802154_ATTR_CCA_ED_LEVEL={0x8, 0x24, 0x7fffffff}, @IEEE802154_ATTR_TXPOWER={0x5, 0x21, 0x3}, @IEEE802154_ATTR_CSMA_MAX_BE={0x5, 0x27, 0x4}]}, 0x2c}, 0x1, 0x0, 0x0, 0x40801}, 0x40840) syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) sendmsg$IEEE802154_LLSEC_DEL_KEY(0xffffffffffffffff, &(0x7f0000000c80)={&(0x7f0000000b40)={0x10, 0x0, 0x0, 0x40000000}, 0xc, &(0x7f0000000c40)={&(0x7f0000000bc0)={0x58, 0x0, 0x402, 0x70bd2d, 0x25dfdbff, {}, [@IEEE802154_ATTR_LLSEC_KEY_MODE={0x5, 0x2b, 0x1}, @IEEE802154_ATTR_DEV_NAME={0xa, 0x1, 'wpan3\x00'}, @IEEE802154_ATTR_LLSEC_KEY_SOURCE_EXTENDED={0xc, 0x2d, {0xaaaaaaaaaaaa0302}}, @IEEE802154_ATTR_LLSEC_KEY_ID={0x5, 0x2e, 0x4}, @IEEE802154_ATTR_LLSEC_KEY_ID={0x5, 0x2e, 0x3}, @IEEE802154_ATTR_SHORT_ADDR={0x6, 0x4, 0xfffd}, @IEEE802154_ATTR_HW_ADDR={0xc}]}, 0x58}, 0x1, 0x0, 0x0, 0x40800}, 0x24040000) 00:53:02 executing program 2: r0 = fsmount(0xffffffffffffffff, 0x1, 0x2) r1 = fsmount(r0, 0x1, 0x7c) fsconfig$FSCONFIG_CMD_CREATE(r1, 0x6, 0x0, 0x0, 0x0) r2 = fsmount(r0, 0x0, 0x8) ioctl$CDROMREADCOOKED(r2, 0x5315, &(0x7f0000000000)) sendmsg$IPSET_CMD_HEADER(r0, &(0x7f0000000b40)={&(0x7f0000000a80)={0x10, 0x0, 0x0, 0x1000000}, 0xc, &(0x7f0000000b00)={&(0x7f0000000ac0)={0x28, 0xc, 0x6, 0x801, 0x0, 0x0, {0xf, 0x0, 0xa}, [@IPSET_ATTR_PROTOCOL={0x5}, @IPSET_ATTR_SETNAME={0x9, 0x2, 'syz2\x00'}]}, 0x28}, 0x1, 0x0, 0x0, 0x4000881}, 0x10) r3 = openat$zero(0xffffffffffffff9c, &(0x7f0000000b80), 0x0, 0x0) mmap$binder(&(0x7f0000fff000/0x1000)=nil, 0x1000, 0x1, 0x11, r3, 0x358f) ioctl$TIOCGICOUNT(r3, 0x545d, 0x0) ioctl$HIDIOCGPHYS(r2, 0x80404812, &(0x7f0000000bc0)) ioctl$CDROMVOLCTRL(r3, 0x530a, &(0x7f0000000c00)={0x1, 0xc0, 0x9, 0x40}) socket$nl_netfilter(0x10, 0x3, 0xc) openat$ttyS3(0xffffffffffffff9c, &(0x7f0000000e80), 0x4a80, 0x0) 00:53:02 executing program 7: r0 = openat$procfs(0xffffffffffffff9c, &(0x7f0000000000)='/proc/mdstat\x00', 0x0, 0x0) mmap$IORING_OFF_CQ_RING(&(0x7f0000ffc000/0x2000)=nil, 0x2000, 0x8, 0x4010, r0, 0x8000000) r1 = openat$cdrom(0xffffffffffffff9c, &(0x7f0000000040), 0xb0840, 0x0) ioctl$CDROM_LOCKDOOR(r1, 0x5329, 0x1) r2 = openat$procfs(0xffffffffffffff9c, &(0x7f0000000080)='/proc/slabinfo\x00', 0x0, 0x0) epoll_ctl$EPOLL_CTL_DEL(r2, 0x2, r0) r3 = fsmount(r2, 0x0, 0x7f) ioctl$CDROMREADMODE1(r3, 0x530d, &(0x7f00000000c0)={0x7, 0x1f, 0x3, 0x81, 0xf3, 0x7b}) mprotect(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x1000008) mmap$IORING_OFF_CQ_RING(&(0x7f0000ffe000/0x1000)=nil, 0x1000, 0x2, 0x80010, r3, 0x8000000) socketpair$nbd(0x1, 0x1, 0x0, &(0x7f0000000d80)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$sock_SIOCGIFINDEX_80211(r4, 0x8933, &(0x7f0000000dc0)={'wlan1\x00'}) syz_genetlink_get_family_id$batadv(&(0x7f0000000e40), r0) r5 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) sendmsg$NBD_CMD_DISCONNECT(r5, &(0x7f00000011c0)={&(0x7f00000010c0)={0x10, 0x0, 0x0, 0x4000}, 0xc, &(0x7f0000001180)={&(0x7f0000001140)={0x20, 0x0, 0x20, 0x70bd25, 0x25dfdbfe, {}, [@NBD_ATTR_BLOCK_SIZE_BYTES={0xc, 0x3, 0x9de}]}, 0x20}, 0x1, 0x0, 0x0, 0x20004000}, 0x200000c5) 00:53:02 executing program 0: r0 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$ieee802154(&(0x7f0000000040), 0xffffffffffffffff) ioctl$sock_SIOCGIFINDEX_802154(0xffffffffffffffff, 0x8933, &(0x7f0000000080)={'wpan0\x00', 0x0}) sendmsg$IEEE802154_LLSEC_DEL_DEVKEY(r0, &(0x7f0000000140)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x2000000}, 0xc, &(0x7f0000000100)={&(0x7f00000000c0)={0x38, r1, 0x2, 0x70bd27, 0x25dfdbfb, {}, [@IEEE802154_ATTR_LLSEC_KEY_SOURCE_SHORT={0x8, 0x2c, 0xee0}, @IEEE802154_ATTR_PAN_ID={0x6, 0x6, 0xffff}, @IEEE802154_ATTR_DEV_INDEX={0x8, 0x2, r2}, @IEEE802154_ATTR_LLSEC_KEY_SOURCE_EXTENDED={0xc, 0x2d, {0xaaaaaaaaaaaa0002}}]}, 0x38}}, 0x4) r3 = syz_genetlink_get_family_id$ieee802154(&(0x7f00000001c0), r0) sendmsg$IEEE802154_LLSEC_ADD_KEY(r0, &(0x7f00000002c0)={&(0x7f0000000180)={0x10, 0x0, 0x0, 0x80}, 0xc, &(0x7f0000000280)={&(0x7f0000000200)={0x70, r3, 0x8dc3595b298c372b, 0x70bd2c, 0x25dfdbfd, {}, [@IEEE802154_ATTR_HW_ADDR={0xc, 0x5, {0xaaaaaaaaaaaa0302}}, @IEEE802154_ATTR_LLSEC_KEY_SOURCE_EXTENDED={0xc, 0x2d, {0xaaaaaaaaaaaa0202}}, @IEEE802154_ATTR_HW_ADDR={0xc, 0x5, {0xaaaaaaaaaaaa0002}}, @IEEE802154_ATTR_LLSEC_KEY_USAGE_FRAME_TYPES={0x5, 0x31, 0x81}, @IEEE802154_ATTR_DEV_NAME={0xa, 0x1, 'wpan1\x00'}, @IEEE802154_ATTR_LLSEC_KEY_USAGE_COMMANDS={0x24, 0x32, "c38d2be0aa0107a2b38f85915a757ba51ff3d89ac2e1c596dce3055b00418226"}]}, 0x70}, 0x1, 0x0, 0x0, 0x20004040}, 0x0) r4 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) sendmsg$IEEE802154_ASSOCIATE_RESP(r4, &(0x7f0000000400)={&(0x7f0000000300)={0x10, 0x0, 0x0, 0x2000000}, 0xc, &(0x7f00000003c0)={&(0x7f0000000340)={0x60, r3, 0x200, 0x70bd26, 0x25dfdbfd, {}, [@IEEE802154_ATTR_COORD_HW_ADDR={0xc}, @IEEE802154_ATTR_STATUS={0x5, 0x3, 0x40}, @IEEE802154_ATTR_STATUS={0x5, 0x3, 0x1}, @IEEE802154_ATTR_COORD_HW_ADDR={0xc, 0x9, {0x2c841fbeb2fffbec}}, @IEEE802154_ATTR_COORD_HW_ADDR={0xc, 0x9, {0xaaaaaaaaaaaa0202}}, @IEEE802154_ATTR_STATUS={0x5, 0x3, 0x6}, @IEEE802154_ATTR_STATUS={0x5, 0x3, 0x3f}, @IEEE802154_ATTR_COORD_SHORT_ADDR={0x6, 0x8, 0xffff}]}, 0x60}, 0x1, 0x0, 0x0, 0x20000000}, 0x20000080) ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, &(0x7f0000000540)={0xc, 0x0, &(0x7f0000000440)=[@dead_binder_done], 0xbf, 0x0, &(0x7f0000000480)="0537636f85beafebd2a00648fb042246bcbd2150d45e58acedd2718aaa529794fc45c87c914f2b69b82fedb220d6a94b2babd3f188631b48d025c32a8342250d69582838e7ee6d22fa335ce4315412805f50869d3f4bef11a5bb26ac3704b717f9416fc1f441d5dd77d4b3c1a283f3179a7daf20c0d30210361ea15f09fd38e2c2ac52383e1685a787783f4524fd7d784046605442e441fb76b236455574d7fe70d1885d924099864313d8d3d84c106a36d2ccc77c51d3cdaf3f716551fc0a"}) r5 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) syz_genetlink_get_family_id$ieee802154(&(0x7f0000000580), r5) sendmsg$IEEE802154_SET_MACPARAMS(r0, &(0x7f0000000680)={&(0x7f00000005c0)={0x10, 0x0, 0x0, 0x1000}, 0xc, &(0x7f0000000640)={&(0x7f0000000600)={0x2c, r3, 0x2, 0x70bd2d, 0x25dfdbfd, {}, [@IEEE802154_ATTR_CCA_ED_LEVEL={0x8, 0x24, 0x7fffffff}, @IEEE802154_ATTR_TXPOWER={0x5, 0x21, 0x3}, @IEEE802154_ATTR_CSMA_MAX_BE={0x5, 0x27, 0x4}]}, 0x2c}, 0x1, 0x0, 0x0, 0x40801}, 0x40840) sendmsg$IEEE802154_LLSEC_DEL_KEY(0xffffffffffffffff, &(0x7f0000000c80)={&(0x7f0000000b40)={0x10, 0x0, 0x0, 0x40000000}, 0xc, &(0x7f0000000c40)={&(0x7f0000000bc0)={0x58, 0x0, 0x402, 0x70bd2d, 0x25dfdbff, {}, [@IEEE802154_ATTR_LLSEC_KEY_MODE={0x5, 0x2b, 0x1}, @IEEE802154_ATTR_DEV_NAME={0xa, 0x1, 'wpan3\x00'}, @IEEE802154_ATTR_LLSEC_KEY_SOURCE_EXTENDED={0xc, 0x2d, {0xaaaaaaaaaaaa0302}}, @IEEE802154_ATTR_LLSEC_KEY_ID={0x5, 0x2e, 0x4}, @IEEE802154_ATTR_LLSEC_KEY_ID={0x5, 0x2e, 0x3}, @IEEE802154_ATTR_SHORT_ADDR={0x6, 0x4, 0xfffd}, @IEEE802154_ATTR_HW_ADDR={0xc}]}, 0x58}, 0x1, 0x0, 0x0, 0x40800}, 0x24040000) 00:53:02 executing program 1: r0 = openat$zero(0xffffffffffffff9c, &(0x7f0000000000), 0x400200, 0x0) ioctl$SECCOMP_IOCTL_NOTIF_ADDFD(r0, 0x40182103, &(0x7f0000000040)={0x0, 0x1, 0xffffffffffffffff, 0x80000000, 0x80000}) r1 = syz_genetlink_get_family_id$batadv(&(0x7f00000000c0), r0) sendmsg$BATADV_CMD_GET_TRANSTABLE_LOCAL(r0, &(0x7f00000001c0)={&(0x7f0000000080)={0x10, 0x0, 0x0, 0x80000}, 0xc, &(0x7f0000000180)={&(0x7f0000000100)={0x54, r1, 0x200, 0x70bd25, 0x25dfdbff, {}, [@BATADV_ATTR_THROUGHPUT_OVERRIDE={0x8, 0x3b, 0x89}, @BATADV_ATTR_THROUGHPUT_OVERRIDE={0x8, 0x3b, 0xffff}, @BATADV_ATTR_FRAGMENTATION_ENABLED={0x5}, @BATADV_ATTR_AGGREGATED_OGMS_ENABLED={0x5}, @BATADV_ATTR_MULTICAST_FORCEFLOOD_ENABLED={0x5}, @BATADV_ATTR_BRIDGE_LOOP_AVOIDANCE_ENABLED={0x5}, @BATADV_ATTR_HARD_IFINDEX={0x8}, @BATADV_ATTR_GW_MODE={0x5, 0x33, 0x1}]}, 0x54}, 0x1, 0x0, 0x0, 0x48041}, 0x4840) r2 = openat$procfs(0xffffffffffffff9c, &(0x7f0000000200)='/proc/cpuinfo\x00', 0x0, 0x0) sendmsg$BATADV_CMD_GET_GATEWAYS(r2, &(0x7f0000000340)={&(0x7f0000000240)={0x10, 0x0, 0x0, 0x1000000}, 0xc, &(0x7f0000000300)={&(0x7f0000000280)={0x50, r1, 0x400, 0x70bd26, 0x25dfdbfb, {}, [@BATADV_ATTR_BRIDGE_LOOP_AVOIDANCE_ENABLED={0x5, 0x2e, 0x1}, @BATADV_ATTR_ISOLATION_MARK={0x8, 0x2b, 0x3}, @BATADV_ATTR_BONDING_ENABLED={0x5}, @BATADV_ATTR_BRIDGE_LOOP_AVOIDANCE_ENABLED={0x5, 0x2e, 0x1}, @BATADV_ATTR_ORIG_ADDRESS={0xa, 0x9, @multicast}, @BATADV_ATTR_THROUGHPUT_OVERRIDE={0x8, 0x3b, 0x1}, @BATADV_ATTR_ISOLATION_MARK={0x8, 0x2b, 0x6}]}, 0x50}, 0x1, 0x0, 0x0, 0x20049800}, 0x80) r3 = syz_genetlink_get_family_id$batadv(&(0x7f00000003c0), r0) sendmsg$BATADV_CMD_SET_MESH(r0, &(0x7f0000000480)={&(0x7f0000000380)={0x10, 0x0, 0x0, 0x1000}, 0xc, &(0x7f0000000440)={&(0x7f0000000400)={0x34, r3, 0x400, 0x70bd2d, 0x25dfdbff, {}, [@BATADV_ATTR_GW_MODE={0x5}, @BATADV_ATTR_GW_BANDWIDTH_UP={0x8, 0x32, 0x8001}, @BATADV_ATTR_ORIG_INTERVAL={0x8, 0x39, 0x4}, @BATADV_ATTR_NETWORK_CODING_ENABLED={0x5, 0x38, 0x1}]}, 0x34}, 0x1, 0x0, 0x0, 0x4000000}, 0x18000) r4 = fsmount(r0, 0x1, 0x5) r5 = fsmount(r2, 0x1, 0x7a) epoll_ctl$EPOLL_CTL_ADD(r4, 0x1, r5, &(0x7f00000016c0)={0x80002000}) r6 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000001700), 0x111002, 0x0) epoll_ctl$EPOLL_CTL_MOD(r0, 0x3, r6, &(0x7f0000001740)) rt_sigqueueinfo(0xffffffffffffffff, 0x2, &(0x7f00000017c0)={0x16, 0x5, 0x8}) 00:53:02 executing program 6: ioctl$sock_SIOCGIFINDEX_802154(0xffffffffffffffff, 0x8933, &(0x7f0000000000)={'wpan1\x00', 0x0}) r1 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) ioctl$sock_SIOCGIFINDEX_802154(0xffffffffffffffff, 0x8933, &(0x7f0000000080)={'wpan3\x00', 0x0}) sendmsg$IEEE802154_LLSEC_ADD_SECLEVEL(r1, &(0x7f0000000140)={&(0x7f0000000040)={0x10, 0x0, 0x0, 0x800000}, 0xc, &(0x7f0000000100)={&(0x7f00000000c0)={0x2c, 0x0, 0x400, 0x70bd2a, 0x25dfdbfe, {}, [@IEEE802154_ATTR_DEV_INDEX={0x8, 0x2, r0}, @IEEE802154_ATTR_DEV_INDEX={0x8, 0x2, r0}, @IEEE802154_ATTR_DEV_INDEX={0x8, 0x2, r2}]}, 0x2c}, 0x1, 0x0, 0x0, 0x4004081}, 0x10) sendmsg$IEEE802154_LLSEC_DEL_KEY(r1, &(0x7f0000000240)={&(0x7f0000000180)={0x10, 0x0, 0x0, 0x1000000}, 0xc, &(0x7f0000000200)={&(0x7f00000001c0)={0x3c, 0x0, 0x30e, 0x70bd25, 0x25dfdbfd, {}, [@IEEE802154_ATTR_HW_ADDR={0xc, 0x5, {0xaaaaaaaaaaaa0102}}, @IEEE802154_ATTR_LLSEC_KEY_SOURCE_EXTENDED={0xc, 0x2d, {0xaaaaaaaaaaaa0102}}, @IEEE802154_ATTR_LLSEC_KEY_SOURCE_SHORT={0x8, 0x2c, 0x5}, @IEEE802154_ATTR_DEV_INDEX={0x8}]}, 0x3c}, 0x1, 0x0, 0x0, 0x24041000}, 0x44) socketpair$nbd(0x1, 0x1, 0x0, &(0x7f0000002280)={0xffffffffffffffff}) r4 = openat$procfs(0xffffffffffffff9c, &(0x7f00000022c0)='/proc/asound/seq/clients\x00', 0x0, 0x0) socketpair$nbd(0x1, 0x1, 0x0, &(0x7f0000002300)={0xffffffffffffffff}) r6 = socket(0x1d, 0x3, 0x6) r7 = openat$zero(0xffffffffffffff9c, &(0x7f0000002340), 0x2, 0x0) socketpair$nbd(0x1, 0x1, 0x0, &(0x7f0000002380)={0xffffffffffffffff}) sendmsg$NBD_CMD_DISCONNECT(r1, &(0x7f0000002480)={&(0x7f0000000280)={0x10, 0x0, 0x0, 0x80000}, 0xc, &(0x7f0000002440)={&(0x7f00000023c0)={0x6c, 0x0, 0x400, 0x70bd27, 0x25dfdbfb, {}, [@NBD_ATTR_TIMEOUT={0xc, 0x4, 0x100000001}, @NBD_ATTR_SOCKETS={0x4c, 0x7, 0x0, 0x1, [{0x8, 0x1, r3}, {0x8, 0x1, r4}, {0x8}, {0x8, 0x1, r5}, {0x8}, {0x8, 0x1, r6}, {0x8, 0x1, r7}, {0x8, 0x1, r8}, {0x8}]}]}, 0x6c}, 0x1, 0x0, 0x0, 0x20000000}, 0x4000020) syz_genetlink_get_family_id$ieee802154(&(0x7f0000002500), r1) ioctl$TIOCGPTPEER(r7, 0x5441, 0xe5) 00:53:02 executing program 5: prctl$PR_GET_FPEXC(0xb, &(0x7f0000000000)) r0 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000040)='./binderfs/custom0\x00', 0x800, 0x0) ustat(0x800, &(0x7f0000000080)) ioctl$ifreq_SIOCGIFINDEX_batadv_mesh(0xffffffffffffffff, 0x8933, &(0x7f0000000100)={'batadv0\x00', 0x0}) ioctl$ifreq_SIOCGIFINDEX_batadv_hard(0xffffffffffffffff, 0x8933, &(0x7f0000000140)={'batadv_slave_0\x00', 0x0}) sendmsg$ETHTOOL_MSG_PAUSE_GET(0xffffffffffffffff, &(0x7f00000002c0)={&(0x7f00000000c0)={0x10, 0x0, 0x0, 0x10000}, 0xc, &(0x7f0000000280)={&(0x7f0000000180)={0xdc, 0x0, 0x8, 0x70bd27, 0x25dfdbfb, {}, [@HEADER={0x5c, 0x1, 0x0, 0x1, [@ETHTOOL_A_HEADER_DEV_INDEX={0x8, 0x1, r1}, @ETHTOOL_A_HEADER_FLAGS={0x8}, @ETHTOOL_A_HEADER_DEV_NAME={0x14, 0x2, 'veth0_vlan\x00'}, @ETHTOOL_A_HEADER_DEV_INDEX={0x8}, @ETHTOOL_A_HEADER_FLAGS={0x8, 0x3, 0x3}, @ETHTOOL_A_HEADER_FLAGS={0x8, 0x3, 0x2}, @ETHTOOL_A_HEADER_DEV_INDEX={0x8, 0x1, r2}, @ETHTOOL_A_HEADER_DEV_NAME={0x14, 0x2, 'macvlan0\x00'}]}, @HEADER={0x40, 0x1, 0x0, 0x1, [@ETHTOOL_A_HEADER_DEV_NAME={0x14, 0x2, 'veth0_to_bridge\x00'}, @ETHTOOL_A_HEADER_DEV_NAME={0x14, 0x2, 'veth0_to_bridge\x00'}, @ETHTOOL_A_HEADER_DEV_NAME={0x14, 0x2, 'netpci0\x00'}]}, @HEADER={0x2c, 0x1, 0x0, 0x1, [@ETHTOOL_A_HEADER_DEV_NAME={0x14, 0x2, 'bond_slave_1\x00'}, @ETHTOOL_A_HEADER_DEV_NAME={0x14, 0x2, 'ip_vti0\x00'}]}]}, 0xdc}, 0x1, 0x0, 0x0, 0x4000}, 0x24000000) sendmsg$NBD_CMD_STATUS(0xffffffffffffffff, &(0x7f0000000400)={&(0x7f0000000300)={0x10, 0x0, 0x0, 0x4}, 0xc, &(0x7f00000003c0)={&(0x7f0000000340)={0x44, 0x0, 0x20, 0x70bd2d, 0x25dfdbfc, {}, [@NBD_ATTR_SIZE_BYTES={0xc, 0x2, 0x4}, @NBD_ATTR_SOCKETS={0x24, 0x7, 0x0, 0x1, [{0x8}, {0x8}, {0x8}, {0x8}]}]}, 0x44}}, 0x4000) ioctl$BINDER_GET_NODE_DEBUG_INFO(r0, 0xc018620b, &(0x7f0000000440)={0x3}) syz_genetlink_get_family_id$batadv(&(0x7f0000000480), 0xffffffffffffffff) r3 = syz_open_dev$ttys(0xc, 0x2, 0x0) ioctl$TCSETAF(r3, 0x5408, &(0x7f00000004c0)={0x4, 0xb073, 0x1000, 0x1, 0x13, "b786e10fbdab60cc"}) openat$binderfs(0xffffffffffffff9c, &(0x7f0000000500)='./binderfs2/binder0\x00', 0x802, 0x0) sendmsg$BATADV_CMD_SET_VLAN(0xffffffffffffffff, &(0x7f0000000600)={&(0x7f0000000540)={0x10, 0x0, 0x0, 0x80000}, 0xc, &(0x7f00000005c0)={&(0x7f0000000580)={0x30, 0x0, 0x400, 0x70bd27, 0x25dfdbfb, {}, [@BATADV_ATTR_FRAGMENTATION_ENABLED={0x5, 0x30, 0x1}, @BATADV_ATTR_ORIG_ADDRESS={0xa, 0x9, @random="62836be88da6"}, @BATADV_ATTR_ISOLATION_MASK={0x8, 0x2c, 0x81}]}, 0x30}, 0x1, 0x0, 0x0, 0x8004}, 0x4c000) syz_open_dev$ttys(0xc, 0x2, 0x0) clone(0x28000800, &(0x7f0000000880)="b3f828035cfe9f8546c65ee8fffa58fb52d9bafabf363f0161cf01b4a2872006d34dcf860667a59d8c5631820a98c05b3989c5037ea89b5a58e8e9809cc008c7ae03db6bb845b2c189e79729a6d2c9a5440c276c7d0686adda809621c1d9723369157389ff141a56cbc54111ec7f92e8262b0c9ab88b9bffbb114333ab5a9711171c09e2589351fa4950d7af92bccf71585c21606994d6b4443d2cb6725d2c983a62f6f0", &(0x7f0000000940), &(0x7f0000000980), &(0x7f00000009c0)="073c516951c56a5fb1d10f1151ef77ee30e71fea92d34f29ddbe9265f84a8e761f6f56055bef1048f67ec1da822c677e9c34d5d52feb791c13c75661003151c2a956098cc6") 00:53:02 executing program 2: r0 = fsmount(0xffffffffffffffff, 0x1, 0x2) r1 = fsmount(r0, 0x1, 0x7c) fsconfig$FSCONFIG_CMD_CREATE(r1, 0x6, 0x0, 0x0, 0x0) r2 = fsmount(r0, 0x0, 0x8) ioctl$CDROMREADCOOKED(r2, 0x5315, &(0x7f0000000000)) sendmsg$IPSET_CMD_HEADER(r0, &(0x7f0000000b40)={&(0x7f0000000a80)={0x10, 0x0, 0x0, 0x1000000}, 0xc, &(0x7f0000000b00)={&(0x7f0000000ac0)={0x28, 0xc, 0x6, 0x801, 0x0, 0x0, {0xf, 0x0, 0xa}, [@IPSET_ATTR_PROTOCOL={0x5}, @IPSET_ATTR_SETNAME={0x9, 0x2, 'syz2\x00'}]}, 0x28}, 0x1, 0x0, 0x0, 0x4000881}, 0x10) r3 = openat$zero(0xffffffffffffff9c, &(0x7f0000000b80), 0x0, 0x0) mmap$binder(&(0x7f0000fff000/0x1000)=nil, 0x1000, 0x1, 0x11, r3, 0x358f) ioctl$TIOCGICOUNT(r3, 0x545d, 0x0) ioctl$HIDIOCGPHYS(r2, 0x80404812, &(0x7f0000000bc0)) ioctl$CDROMVOLCTRL(r3, 0x530a, &(0x7f0000000c00)={0x1, 0xc0, 0x9, 0x40}) openat$ttyS3(0xffffffffffffff9c, &(0x7f0000000e80), 0x4a80, 0x0) 00:53:02 executing program 0: r0 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$ieee802154(&(0x7f0000000040), 0xffffffffffffffff) ioctl$sock_SIOCGIFINDEX_802154(0xffffffffffffffff, 0x8933, &(0x7f0000000080)={'wpan0\x00', 0x0}) sendmsg$IEEE802154_LLSEC_DEL_DEVKEY(r0, &(0x7f0000000140)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x2000000}, 0xc, &(0x7f0000000100)={&(0x7f00000000c0)={0x38, r1, 0x2, 0x70bd27, 0x25dfdbfb, {}, [@IEEE802154_ATTR_LLSEC_KEY_SOURCE_SHORT={0x8, 0x2c, 0xee0}, @IEEE802154_ATTR_PAN_ID={0x6, 0x6, 0xffff}, @IEEE802154_ATTR_DEV_INDEX={0x8, 0x2, r2}, @IEEE802154_ATTR_LLSEC_KEY_SOURCE_EXTENDED={0xc, 0x2d, {0xaaaaaaaaaaaa0002}}]}, 0x38}}, 0x4) r3 = syz_genetlink_get_family_id$ieee802154(&(0x7f00000001c0), r0) sendmsg$IEEE802154_LLSEC_ADD_KEY(r0, &(0x7f00000002c0)={&(0x7f0000000180)={0x10, 0x0, 0x0, 0x80}, 0xc, &(0x7f0000000280)={&(0x7f0000000200)={0x70, r3, 0x8dc3595b298c372b, 0x70bd2c, 0x25dfdbfd, {}, [@IEEE802154_ATTR_HW_ADDR={0xc, 0x5, {0xaaaaaaaaaaaa0302}}, @IEEE802154_ATTR_LLSEC_KEY_SOURCE_EXTENDED={0xc, 0x2d, {0xaaaaaaaaaaaa0202}}, @IEEE802154_ATTR_HW_ADDR={0xc, 0x5, {0xaaaaaaaaaaaa0002}}, @IEEE802154_ATTR_LLSEC_KEY_USAGE_FRAME_TYPES={0x5, 0x31, 0x81}, @IEEE802154_ATTR_DEV_NAME={0xa, 0x1, 'wpan1\x00'}, @IEEE802154_ATTR_LLSEC_KEY_USAGE_COMMANDS={0x24, 0x32, "c38d2be0aa0107a2b38f85915a757ba51ff3d89ac2e1c596dce3055b00418226"}]}, 0x70}, 0x1, 0x0, 0x0, 0x20004040}, 0x0) r4 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) sendmsg$IEEE802154_ASSOCIATE_RESP(r4, &(0x7f0000000400)={&(0x7f0000000300)={0x10, 0x0, 0x0, 0x2000000}, 0xc, &(0x7f00000003c0)={&(0x7f0000000340)={0x60, r3, 0x200, 0x70bd26, 0x25dfdbfd, {}, [@IEEE802154_ATTR_COORD_HW_ADDR={0xc}, @IEEE802154_ATTR_STATUS={0x5, 0x3, 0x40}, @IEEE802154_ATTR_STATUS={0x5, 0x3, 0x1}, @IEEE802154_ATTR_COORD_HW_ADDR={0xc, 0x9, {0x2c841fbeb2fffbec}}, @IEEE802154_ATTR_COORD_HW_ADDR={0xc, 0x9, {0xaaaaaaaaaaaa0202}}, @IEEE802154_ATTR_STATUS={0x5, 0x3, 0x6}, @IEEE802154_ATTR_STATUS={0x5, 0x3, 0x3f}, @IEEE802154_ATTR_COORD_SHORT_ADDR={0x6, 0x8, 0xffff}]}, 0x60}, 0x1, 0x0, 0x0, 0x20000000}, 0x20000080) ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, &(0x7f0000000540)={0xc, 0x0, &(0x7f0000000440)=[@dead_binder_done], 0xbf, 0x0, &(0x7f0000000480)="0537636f85beafebd2a00648fb042246bcbd2150d45e58acedd2718aaa529794fc45c87c914f2b69b82fedb220d6a94b2babd3f188631b48d025c32a8342250d69582838e7ee6d22fa335ce4315412805f50869d3f4bef11a5bb26ac3704b717f9416fc1f441d5dd77d4b3c1a283f3179a7daf20c0d30210361ea15f09fd38e2c2ac52383e1685a787783f4524fd7d784046605442e441fb76b236455574d7fe70d1885d924099864313d8d3d84c106a36d2ccc77c51d3cdaf3f716551fc0a"}) r5 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) syz_genetlink_get_family_id$ieee802154(&(0x7f0000000580), r5) sendmsg$IEEE802154_LLSEC_DEL_KEY(0xffffffffffffffff, &(0x7f0000000c80)={&(0x7f0000000b40)={0x10, 0x0, 0x0, 0x40000000}, 0xc, &(0x7f0000000c40)={&(0x7f0000000bc0)={0x58, 0x0, 0x402, 0x70bd2d, 0x25dfdbff, {}, [@IEEE802154_ATTR_LLSEC_KEY_MODE={0x5, 0x2b, 0x1}, @IEEE802154_ATTR_DEV_NAME={0xa, 0x1, 'wpan3\x00'}, @IEEE802154_ATTR_LLSEC_KEY_SOURCE_EXTENDED={0xc, 0x2d, {0xaaaaaaaaaaaa0302}}, @IEEE802154_ATTR_LLSEC_KEY_ID={0x5, 0x2e, 0x4}, @IEEE802154_ATTR_LLSEC_KEY_ID={0x5, 0x2e, 0x3}, @IEEE802154_ATTR_SHORT_ADDR={0x6, 0x4, 0xfffd}, @IEEE802154_ATTR_HW_ADDR={0xc}]}, 0x58}, 0x1, 0x0, 0x0, 0x40800}, 0x24040000) 00:53:03 executing program 4: r0 = openat$ttyS3(0xffffffffffffff9c, &(0x7f0000000000), 0xa2000, 0x0) ioctl$TIOCSETD(r0, 0x5423, &(0x7f0000000040)=0x13) r1 = fsmount(0xffffffffffffffff, 0x1, 0x76) ioctl$TCSETAF(r1, 0x5408, &(0x7f0000000080)={0x5, 0x8001, 0x4, 0x8001, 0x15, "b45da66f02087ca7"}) ioctl$TCSETAF(r1, 0x5408, &(0x7f00000000c0)={0x5, 0x22c1, 0x800, 0x8, 0x5, "2b8c058f839aaa67"}) connect$netlink(r1, &(0x7f0000000100)=@proc={0x10, 0x0, 0x25dfdbfd, 0x2}, 0xc) r2 = syz_open_dev$tty1(0xc, 0x4, 0x4) ioctl$TCSETSF(r2, 0x5404, &(0x7f0000000140)={0x6, 0x2, 0x2, 0x80000001, 0x1b, "c2331e6388ffeb48419d467a4b791ad4343a96"}) ioctl$TIOCMGET(r1, 0x5415, &(0x7f0000000180)) ioctl$TCSETAF(r2, 0x5408, &(0x7f00000001c0)={0x11, 0x0, 0xfff, 0x7, 0xd, "3ae59dd65d54337c"}) r3 = timerfd_create(0x7, 0x800) timerfd_settime(r3, 0x1, &(0x7f0000000200), &(0x7f0000000240)) ioctl$TCSETAF(r2, 0x5408, &(0x7f0000000280)={0x1, 0x1, 0x3d4c, 0x200, 0x0, "73a709364d80b6c1"}) ioctl$PIO_UNIMAPCLR(0xffffffffffffffff, 0x4b68, &(0x7f00000002c0)={0x73, 0x1fe0, 0x8b}) socket(0x16, 0x1, 0x9) 00:53:03 executing program 7: r0 = openat$procfs(0xffffffffffffff9c, &(0x7f0000000000)='/proc/mdstat\x00', 0x0, 0x0) mmap$IORING_OFF_CQ_RING(&(0x7f0000ffc000/0x2000)=nil, 0x2000, 0x8, 0x4010, r0, 0x8000000) r1 = openat$cdrom(0xffffffffffffff9c, &(0x7f0000000040), 0xb0840, 0x0) ioctl$CDROM_LOCKDOOR(r1, 0x5329, 0x1) r2 = openat$procfs(0xffffffffffffff9c, &(0x7f0000000080)='/proc/slabinfo\x00', 0x0, 0x0) epoll_ctl$EPOLL_CTL_DEL(r2, 0x2, r0) r3 = fsmount(r2, 0x0, 0x7f) ioctl$CDROMREADMODE1(r3, 0x530d, &(0x7f00000000c0)={0x7, 0x1f, 0x3, 0x81, 0xf3, 0x7b}) mprotect(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x1000008) mmap$IORING_OFF_CQ_RING(&(0x7f0000ffe000/0x1000)=nil, 0x1000, 0x2, 0x80010, r3, 0x8000000) socketpair$nbd(0x1, 0x1, 0x0, &(0x7f0000000d80)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$sock_SIOCGIFINDEX_80211(r4, 0x8933, &(0x7f0000000dc0)={'wlan1\x00'}) r5 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) sendmsg$NBD_CMD_DISCONNECT(r5, &(0x7f00000011c0)={&(0x7f00000010c0)={0x10, 0x0, 0x0, 0x4000}, 0xc, &(0x7f0000001180)={&(0x7f0000001140)={0x20, 0x0, 0x20, 0x70bd25, 0x25dfdbfe, {}, [@NBD_ATTR_BLOCK_SIZE_BYTES={0xc, 0x3, 0x9de}]}, 0x20}, 0x1, 0x0, 0x0, 0x20004000}, 0x200000c5) 00:53:03 executing program 2: r0 = fsmount(0xffffffffffffffff, 0x1, 0x2) r1 = fsmount(r0, 0x1, 0x7c) fsconfig$FSCONFIG_CMD_CREATE(r1, 0x6, 0x0, 0x0, 0x0) r2 = fsmount(r0, 0x0, 0x8) ioctl$CDROMREADCOOKED(r2, 0x5315, &(0x7f0000000000)) sendmsg$IPSET_CMD_HEADER(r0, &(0x7f0000000b40)={&(0x7f0000000a80)={0x10, 0x0, 0x0, 0x1000000}, 0xc, &(0x7f0000000b00)={&(0x7f0000000ac0)={0x28, 0xc, 0x6, 0x801, 0x0, 0x0, {0xf, 0x0, 0xa}, [@IPSET_ATTR_PROTOCOL={0x5}, @IPSET_ATTR_SETNAME={0x9, 0x2, 'syz2\x00'}]}, 0x28}, 0x1, 0x0, 0x0, 0x4000881}, 0x10) r3 = openat$zero(0xffffffffffffff9c, &(0x7f0000000b80), 0x0, 0x0) mmap$binder(&(0x7f0000fff000/0x1000)=nil, 0x1000, 0x1, 0x11, r3, 0x358f) ioctl$TIOCGICOUNT(r3, 0x545d, 0x0) ioctl$HIDIOCGPHYS(r2, 0x80404812, &(0x7f0000000bc0)) openat$ttyS3(0xffffffffffffff9c, &(0x7f0000000e80), 0x4a80, 0x0) [ 138.410901] [ 138.411082] ===================================== [ 138.411458] WARNING: bad unlock balance detected! [ 138.411848] 6.19.0-rc5-next-20260116 #1 Not tainted [ 138.412242] ------------------------------------- [ 138.412612] syz-executor.2/276 is trying to release lock (rcu_read_lock) at: [ 138.413166] [] __wait_on_freeing_inode+0x105/0x350 [ 138.414003] but there are no more locks to release! [ 138.414908] [ 138.414908] other info that might help us debug this: [ 138.416420] 4 locks held by syz-executor.2/276: [ 138.417377] #0: ffff88800f6523f8 (sb_writers#3){.+.+}-{0:0}, at: filename_create+0xf7/0x400 [ 138.419466] #1: ffff88801bc1d9a8 (&type->i_mutex_dir_key#3/1){+.+.}-{4:4}, at: filename_create+0x1b1/0x400 [ 138.421420] #2: ffff88800f656950 (jbd2_handle){++++}-{0:0}, at: start_this_handle+0xe32/0x12d0 [ 138.422521] #3: ffffffff85c16898 (inode_hash_lock){+.+.}-{3:3}, at: insert_inode_locked+0xf9/0x890 [ 138.423256] [ 138.423256] stack backtrace: [ 138.423614] CPU: 1 UID: 0 PID: 276 Comm: syz-executor.2 Not tainted 6.19.0-rc5-next-20260116 #1 PREEMPT(lazy) [ 138.423628] Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.12.0-1 04/01/2014 [ 138.423635] Call Trace: [ 138.423639] [ 138.423644] dump_stack_lvl+0xca/0x120 [ 138.423673] ? __wait_on_freeing_inode+0x105/0x350 [ 138.423687] print_unlock_imbalance_bug+0x118/0x130 [ 138.423703] ? __wait_on_freeing_inode+0x105/0x350 [ 138.423717] lock_release+0x1ee/0x270 [ 138.423732] __wait_on_freeing_inode+0x10a/0x350 [ 138.423747] ? __pfx___wait_on_freeing_inode+0x10/0x10 [ 138.423763] ? __pfx_var_wake_function+0x10/0x10 [ 138.423781] ? lock_is_held_type+0x9e/0x120 [ 138.423792] insert_inode_locked+0x25f/0x890 [ 138.423809] __ext4_new_inode+0x223d/0x4cd0 [ 138.423827] ? __pfx___ext4_new_inode+0x10/0x10 [ 138.423840] ? __pfx_avc_has_perm+0x10/0x10 [ 138.423854] ? __pfx___dquot_initialize+0x10/0x10 [ 138.423875] ext4_mkdir+0x331/0xb30 [ 138.423894] ? __pfx_ext4_mkdir+0x10/0x10 [ 138.423909] ? security_inode_permission+0x72/0xe0 [ 138.423922] vfs_mkdir+0x6d8/0xc00 [ 138.423939] filename_mkdirat+0x118/0x430 [ 138.423952] ? __pfx_filename_mkdirat+0x10/0x10 [ 138.423964] ? strncpy_from_user+0x21b/0x2f0 [ 138.423981] __x64_sys_mkdir+0x6e/0xd0 [ 138.423993] do_syscall_64+0xbf/0x420 [ 138.424007] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 138.424019] RIP: 0033:0x7fc2b3fbfc27 [ 138.424028] Code: 73 01 c3 48 c7 c1 bc ff ff ff f7 d8 64 89 01 48 83 c8 ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 b8 53 00 00 00 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 bc ff ff ff f7 d8 64 89 01 48 [ 138.424039] RSP: 002b:00007ffc6a34e268 EFLAGS: 00000202 ORIG_RAX: 0000000000000053 [ 138.424049] RAX: ffffffffffffffda RBX: 00007ffc6a34e2f0 RCX: 00007fc2b3fbfc27 [ 138.424057] RDX: 0000000000000000 RSI: 00000000000001ff RDI: 00007ffc6a34e2f0 [ 138.424064] RBP: 00007ffc6a34e2cc R08: 0000000000000000 R09: 0000000000000004 [ 138.424071] R10: 00007ffc6a34e006 R11: 0000000000000202 R12: 0000000000000032 [ 138.424077] R13: 0000000000021c04 R14: 000000000000000c R15: 00007ffc6a34e330 [ 138.424088] [ 138.439341] ------------[ cut here ]------------ [ 138.439765] WARNING: kernel/rcu/tree_plugin.h:443 at __rcu_read_unlock+0x25f/0x5c0, CPU#1: syz-executor.2/276 [ 138.440667] Modules linked in: [ 138.440962] CPU: 1 UID: 0 PID: 276 Comm: syz-executor.2 Not tainted 6.19.0-rc5-next-20260116 #1 PREEMPT(lazy) [ 138.441797] Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.12.0-1 04/01/2014 [ 138.442448] RIP: 0010:__rcu_read_unlock+0x25f/0x5c0 [ 138.442956] Code: f2 02 00 00 c7 43 58 01 00 00 00 bf 09 00 00 00 e8 d6 b7 de ff 4d 85 f6 0f 84 73 fe ff ff e8 38 8a 20 00 fb e9 68 fe ff ff 90 <0f> 0b 90 5b 5d 41 5c 41 5d 41 5e e9 81 4d 74 03 e8 2c 5d 56 00 e9 [ 138.444463] RSP: 0018:ffff88801b3779e0 EFLAGS: 00010286 [ 138.444934] RAX: 00000000ffffffff RBX: ffff88800f24b700 RCX: ffffffff815660f7 [ 138.445504] RDX: 0000000000000000 RSI: ffffffff81566100 RDI: ffff88800f24bafc [ 138.446112] RBP: ffff88800f24b700 R08: 0000000000000000 R09: fffffbfff0ba7040 [ 138.446723] R10: 0000000000000000 R11: 0000000000000001 R12: ffff88800f24b700 [ 138.447288] R13: 0000000000000001 R14: ffffffff85c0e780 R15: ffff88801bfd2938 [ 138.447908] FS: 000055555d44d400(0000) GS:ffff8880e5442000(0000) knlGS:0000000000000000 [ 138.448549] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 138.449052] CR2: 00007ff5016583a4 CR3: 000000000a40f000 CR4: 0000000000350ef0 [ 138.449667] Call Trace: [ 138.449905] [ 138.450553] __wait_on_freeing_inode+0x10f/0x350 [ 138.451262] ? __pfx___wait_on_freeing_inode+0x10/0x10 [ 138.452351] ? __pfx_var_wake_function+0x10/0x10 [ 138.453570] ? lock_is_held_type+0x9e/0x120 [ 138.454706] insert_inode_locked+0x25f/0x890 [ 138.456298] __ext4_new_inode+0x223d/0x4cd0 [ 138.458779] ? __pfx___ext4_new_inode+0x10/0x10 [ 138.459720] ? __pfx_avc_has_perm+0x10/0x10 [ 138.460320] ? __pfx___dquot_initialize+0x10/0x10 [ 138.462492] ext4_mkdir+0x331/0xb30 [ 138.464428] ? __pfx_ext4_mkdir+0x10/0x10 [ 138.465060] ? security_inode_permission+0x72/0xe0 [ 138.466691] vfs_mkdir+0x6d8/0xc00 [ 138.468030] filename_mkdirat+0x118/0x430 [ 138.469055] ? __pfx_filename_mkdirat+0x10/0x10 [ 138.469808] ? strncpy_from_user+0x21b/0x2f0 [ 138.471678] __x64_sys_mkdir+0x6e/0xd0 [ 138.472274] do_syscall_64+0xbf/0x420 [ 138.473085] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 138.473587] RIP: 0033:0x7fc2b3fbfc27 [ 138.474009] Code: 73 01 c3 48 c7 c1 bc ff ff ff f7 d8 64 89 01 48 83 c8 ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 b8 53 00 00 00 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 bc ff ff ff f7 d8 64 89 01 48 [ 138.475489] RSP: 002b:00007ffc6a34e268 EFLAGS: 00000202 ORIG_RAX: 0000000000000053 [ 138.476130] RAX: ffffffffffffffda RBX: 00007ffc6a34e2f0 RCX: 00007fc2b3fbfc27 [ 138.476745] RDX: 0000000000000000 RSI: 00000000000001ff RDI: 00007ffc6a34e2f0 [ 138.477307] RBP: 00007ffc6a34e2cc R08: 0000000000000000 R09: 0000000000000004 [ 138.477913] R10: 00007ffc6a34e006 R11: 0000000000000202 R12: 0000000000000032 [ 138.478477] R13: 0000000000021c04 R14: 000000000000000c R15: 00007ffc6a34e330 [ 138.481074] [ 138.481271] irq event stamp: 196763 [ 138.481557] hardirqs last enabled at (196763): [] _raw_spin_unlock_irqrestore+0x2c/0x50 [ 138.482426] hardirqs last disabled at (196762): [] _raw_spin_lock_irqsave+0x53/0x60 [ 138.483257] softirqs last enabled at (196758): [] kernel_fpu_end+0x59/0x70 [ 138.484037] softirqs last disabled at (196756): [] kernel_fpu_begin_mask+0x1bb/0x300 [ 138.484887] ---[ end trace 0000000000000000 ]--- 00:53:03 executing program 0: r0 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$ieee802154(&(0x7f0000000040), 0xffffffffffffffff) ioctl$sock_SIOCGIFINDEX_802154(0xffffffffffffffff, 0x8933, &(0x7f0000000080)={'wpan0\x00', 0x0}) sendmsg$IEEE802154_LLSEC_DEL_DEVKEY(r0, &(0x7f0000000140)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x2000000}, 0xc, &(0x7f0000000100)={&(0x7f00000000c0)={0x38, r1, 0x2, 0x70bd27, 0x25dfdbfb, {}, [@IEEE802154_ATTR_LLSEC_KEY_SOURCE_SHORT={0x8, 0x2c, 0xee0}, @IEEE802154_ATTR_PAN_ID={0x6, 0x6, 0xffff}, @IEEE802154_ATTR_DEV_INDEX={0x8, 0x2, r2}, @IEEE802154_ATTR_LLSEC_KEY_SOURCE_EXTENDED={0xc, 0x2d, {0xaaaaaaaaaaaa0002}}]}, 0x38}}, 0x4) r3 = syz_genetlink_get_family_id$ieee802154(&(0x7f00000001c0), r0) sendmsg$IEEE802154_LLSEC_ADD_KEY(r0, &(0x7f00000002c0)={&(0x7f0000000180)={0x10, 0x0, 0x0, 0x80}, 0xc, &(0x7f0000000280)={&(0x7f0000000200)={0x70, r3, 0x8dc3595b298c372b, 0x70bd2c, 0x25dfdbfd, {}, [@IEEE802154_ATTR_HW_ADDR={0xc, 0x5, {0xaaaaaaaaaaaa0302}}, @IEEE802154_ATTR_LLSEC_KEY_SOURCE_EXTENDED={0xc, 0x2d, {0xaaaaaaaaaaaa0202}}, @IEEE802154_ATTR_HW_ADDR={0xc, 0x5, {0xaaaaaaaaaaaa0002}}, @IEEE802154_ATTR_LLSEC_KEY_USAGE_FRAME_TYPES={0x5, 0x31, 0x81}, @IEEE802154_ATTR_DEV_NAME={0xa, 0x1, 'wpan1\x00'}, @IEEE802154_ATTR_LLSEC_KEY_USAGE_COMMANDS={0x24, 0x32, "c38d2be0aa0107a2b38f85915a757ba51ff3d89ac2e1c596dce3055b00418226"}]}, 0x70}, 0x1, 0x0, 0x0, 0x20004040}, 0x0) r4 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) sendmsg$IEEE802154_ASSOCIATE_RESP(r4, &(0x7f0000000400)={&(0x7f0000000300)={0x10, 0x0, 0x0, 0x2000000}, 0xc, &(0x7f00000003c0)={&(0x7f0000000340)={0x60, r3, 0x200, 0x70bd26, 0x25dfdbfd, {}, [@IEEE802154_ATTR_COORD_HW_ADDR={0xc}, @IEEE802154_ATTR_STATUS={0x5, 0x3, 0x40}, @IEEE802154_ATTR_STATUS={0x5, 0x3, 0x1}, @IEEE802154_ATTR_COORD_HW_ADDR={0xc, 0x9, {0x2c841fbeb2fffbec}}, @IEEE802154_ATTR_COORD_HW_ADDR={0xc, 0x9, {0xaaaaaaaaaaaa0202}}, @IEEE802154_ATTR_STATUS={0x5, 0x3, 0x6}, @IEEE802154_ATTR_STATUS={0x5, 0x3, 0x3f}, @IEEE802154_ATTR_COORD_SHORT_ADDR={0x6, 0x8, 0xffff}]}, 0x60}, 0x1, 0x0, 0x0, 0x20000000}, 0x20000080) ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, &(0x7f0000000540)={0xc, 0x0, &(0x7f0000000440)=[@dead_binder_done], 0xbf, 0x0, &(0x7f0000000480)="0537636f85beafebd2a00648fb042246bcbd2150d45e58acedd2718aaa529794fc45c87c914f2b69b82fedb220d6a94b2babd3f188631b48d025c32a8342250d69582838e7ee6d22fa335ce4315412805f50869d3f4bef11a5bb26ac3704b717f9416fc1f441d5dd77d4b3c1a283f3179a7daf20c0d30210361ea15f09fd38e2c2ac52383e1685a787783f4524fd7d784046605442e441fb76b236455574d7fe70d1885d924099864313d8d3d84c106a36d2ccc77c51d3cdaf3f716551fc0a"}) syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) sendmsg$IEEE802154_LLSEC_DEL_KEY(0xffffffffffffffff, &(0x7f0000000c80)={&(0x7f0000000b40)={0x10, 0x0, 0x0, 0x40000000}, 0xc, &(0x7f0000000c40)={&(0x7f0000000bc0)={0x58, 0x0, 0x402, 0x70bd2d, 0x25dfdbff, {}, [@IEEE802154_ATTR_LLSEC_KEY_MODE={0x5, 0x2b, 0x1}, @IEEE802154_ATTR_DEV_NAME={0xa, 0x1, 'wpan3\x00'}, @IEEE802154_ATTR_LLSEC_KEY_SOURCE_EXTENDED={0xc, 0x2d, {0xaaaaaaaaaaaa0302}}, @IEEE802154_ATTR_LLSEC_KEY_ID={0x5, 0x2e, 0x4}, @IEEE802154_ATTR_LLSEC_KEY_ID={0x5, 0x2e, 0x3}, @IEEE802154_ATTR_SHORT_ADDR={0x6, 0x4, 0xfffd}, @IEEE802154_ATTR_HW_ADDR={0xc}]}, 0x58}, 0x1, 0x0, 0x0, 0x40800}, 0x24040000) 00:53:11 executing program 1: r0 = openat$zero(0xffffffffffffff9c, &(0x7f0000000000), 0x400200, 0x0) ioctl$SECCOMP_IOCTL_NOTIF_ADDFD(r0, 0x40182103, &(0x7f0000000040)={0x0, 0x1, 0xffffffffffffffff, 0x80000000, 0x80000}) r1 = syz_genetlink_get_family_id$batadv(&(0x7f00000000c0), r0) sendmsg$BATADV_CMD_GET_TRANSTABLE_LOCAL(r0, &(0x7f00000001c0)={&(0x7f0000000080)={0x10, 0x0, 0x0, 0x80000}, 0xc, &(0x7f0000000180)={&(0x7f0000000100)={0x54, r1, 0x200, 0x70bd25, 0x25dfdbff, {}, [@BATADV_ATTR_THROUGHPUT_OVERRIDE={0x8, 0x3b, 0x89}, @BATADV_ATTR_THROUGHPUT_OVERRIDE={0x8, 0x3b, 0xffff}, @BATADV_ATTR_FRAGMENTATION_ENABLED={0x5}, @BATADV_ATTR_AGGREGATED_OGMS_ENABLED={0x5}, @BATADV_ATTR_MULTICAST_FORCEFLOOD_ENABLED={0x5}, @BATADV_ATTR_BRIDGE_LOOP_AVOIDANCE_ENABLED={0x5}, @BATADV_ATTR_HARD_IFINDEX={0x8}, @BATADV_ATTR_GW_MODE={0x5, 0x33, 0x1}]}, 0x54}, 0x1, 0x0, 0x0, 0x48041}, 0x4840) r2 = openat$procfs(0xffffffffffffff9c, &(0x7f0000000200)='/proc/cpuinfo\x00', 0x0, 0x0) sendmsg$BATADV_CMD_GET_GATEWAYS(r2, &(0x7f0000000340)={&(0x7f0000000240)={0x10, 0x0, 0x0, 0x1000000}, 0xc, &(0x7f0000000300)={&(0x7f0000000280)={0x50, r1, 0x400, 0x70bd26, 0x25dfdbfb, {}, [@BATADV_ATTR_BRIDGE_LOOP_AVOIDANCE_ENABLED={0x5, 0x2e, 0x1}, @BATADV_ATTR_ISOLATION_MARK={0x8, 0x2b, 0x3}, @BATADV_ATTR_BONDING_ENABLED={0x5}, @BATADV_ATTR_BRIDGE_LOOP_AVOIDANCE_ENABLED={0x5, 0x2e, 0x1}, @BATADV_ATTR_ORIG_ADDRESS={0xa, 0x9, @multicast}, @BATADV_ATTR_THROUGHPUT_OVERRIDE={0x8, 0x3b, 0x1}, @BATADV_ATTR_ISOLATION_MARK={0x8, 0x2b, 0x6}]}, 0x50}, 0x1, 0x0, 0x0, 0x20049800}, 0x80) r3 = syz_genetlink_get_family_id$batadv(&(0x7f00000003c0), r0) sendmsg$BATADV_CMD_SET_MESH(r0, &(0x7f0000000480)={&(0x7f0000000380)={0x10, 0x0, 0x0, 0x1000}, 0xc, &(0x7f0000000440)={&(0x7f0000000400)={0x34, r3, 0x400, 0x70bd2d, 0x25dfdbff, {}, [@BATADV_ATTR_GW_MODE={0x5}, @BATADV_ATTR_GW_BANDWIDTH_UP={0x8, 0x32, 0x8001}, @BATADV_ATTR_ORIG_INTERVAL={0x8, 0x39, 0x4}, @BATADV_ATTR_NETWORK_CODING_ENABLED={0x5, 0x38, 0x1}]}, 0x34}, 0x1, 0x0, 0x0, 0x4000000}, 0x18000) r4 = fsmount(r0, 0x1, 0x5) r5 = fsmount(r2, 0x1, 0x7a) epoll_ctl$EPOLL_CTL_ADD(r4, 0x1, r5, &(0x7f00000016c0)={0x80002000}) openat$ptmx(0xffffffffffffff9c, &(0x7f0000001700), 0x111002, 0x0) rt_sigqueueinfo(0xffffffffffffffff, 0x2, &(0x7f00000017c0)={0x16, 0x5, 0x8}) 00:53:11 executing program 4: r0 = openat$ttyS3(0xffffffffffffff9c, &(0x7f0000000000), 0xa2000, 0x0) ioctl$TIOCSETD(r0, 0x5423, &(0x7f0000000040)=0x13) r1 = fsmount(0xffffffffffffffff, 0x1, 0x76) ioctl$TCSETAF(r1, 0x5408, &(0x7f0000000080)={0x5, 0x8001, 0x4, 0x8001, 0x15, "b45da66f02087ca7"}) ioctl$TCSETAF(r1, 0x5408, &(0x7f00000000c0)={0x5, 0x22c1, 0x800, 0x8, 0x5, "2b8c058f839aaa67"}) connect$netlink(r1, &(0x7f0000000100)=@proc={0x10, 0x0, 0x25dfdbfd, 0x2}, 0xc) r2 = syz_open_dev$tty1(0xc, 0x4, 0x4) ioctl$TCSETSF(r2, 0x5404, &(0x7f0000000140)={0x6, 0x2, 0x2, 0x80000001, 0x1b, "c2331e6388ffeb48419d467a4b791ad4343a96"}) ioctl$TIOCMGET(r1, 0x5415, &(0x7f0000000180)) ioctl$TCSETAF(r2, 0x5408, &(0x7f00000001c0)={0x11, 0x0, 0xfff, 0x7, 0xd, "3ae59dd65d54337c"}) r3 = timerfd_create(0x7, 0x800) timerfd_settime(r3, 0x1, &(0x7f0000000200), &(0x7f0000000240)) ioctl$TCSETAF(r2, 0x5408, &(0x7f0000000280)={0x1, 0x1, 0x3d4c, 0x200, 0x0, "73a709364d80b6c1"}) ioctl$PIO_UNIMAPCLR(0xffffffffffffffff, 0x4b68, &(0x7f00000002c0)={0x73, 0x1fe0, 0x8b}) socket(0x16, 0x1, 0x9) 00:53:11 executing program 0: r0 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$ieee802154(&(0x7f0000000040), 0xffffffffffffffff) ioctl$sock_SIOCGIFINDEX_802154(0xffffffffffffffff, 0x8933, &(0x7f0000000080)={'wpan0\x00', 0x0}) sendmsg$IEEE802154_LLSEC_DEL_DEVKEY(r0, &(0x7f0000000140)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x2000000}, 0xc, &(0x7f0000000100)={&(0x7f00000000c0)={0x38, r1, 0x2, 0x70bd27, 0x25dfdbfb, {}, [@IEEE802154_ATTR_LLSEC_KEY_SOURCE_SHORT={0x8, 0x2c, 0xee0}, @IEEE802154_ATTR_PAN_ID={0x6, 0x6, 0xffff}, @IEEE802154_ATTR_DEV_INDEX={0x8, 0x2, r2}, @IEEE802154_ATTR_LLSEC_KEY_SOURCE_EXTENDED={0xc, 0x2d, {0xaaaaaaaaaaaa0002}}]}, 0x38}}, 0x4) r3 = syz_genetlink_get_family_id$ieee802154(&(0x7f00000001c0), r0) sendmsg$IEEE802154_LLSEC_ADD_KEY(r0, &(0x7f00000002c0)={&(0x7f0000000180)={0x10, 0x0, 0x0, 0x80}, 0xc, &(0x7f0000000280)={&(0x7f0000000200)={0x70, r3, 0x8dc3595b298c372b, 0x70bd2c, 0x25dfdbfd, {}, [@IEEE802154_ATTR_HW_ADDR={0xc, 0x5, {0xaaaaaaaaaaaa0302}}, @IEEE802154_ATTR_LLSEC_KEY_SOURCE_EXTENDED={0xc, 0x2d, {0xaaaaaaaaaaaa0202}}, @IEEE802154_ATTR_HW_ADDR={0xc, 0x5, {0xaaaaaaaaaaaa0002}}, @IEEE802154_ATTR_LLSEC_KEY_USAGE_FRAME_TYPES={0x5, 0x31, 0x81}, @IEEE802154_ATTR_DEV_NAME={0xa, 0x1, 'wpan1\x00'}, @IEEE802154_ATTR_LLSEC_KEY_USAGE_COMMANDS={0x24, 0x32, "c38d2be0aa0107a2b38f85915a757ba51ff3d89ac2e1c596dce3055b00418226"}]}, 0x70}, 0x1, 0x0, 0x0, 0x20004040}, 0x0) r4 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) sendmsg$IEEE802154_ASSOCIATE_RESP(r4, &(0x7f0000000400)={&(0x7f0000000300)={0x10, 0x0, 0x0, 0x2000000}, 0xc, &(0x7f00000003c0)={&(0x7f0000000340)={0x60, r3, 0x200, 0x70bd26, 0x25dfdbfd, {}, [@IEEE802154_ATTR_COORD_HW_ADDR={0xc}, @IEEE802154_ATTR_STATUS={0x5, 0x3, 0x40}, @IEEE802154_ATTR_STATUS={0x5, 0x3, 0x1}, @IEEE802154_ATTR_COORD_HW_ADDR={0xc, 0x9, {0x2c841fbeb2fffbec}}, @IEEE802154_ATTR_COORD_HW_ADDR={0xc, 0x9, {0xaaaaaaaaaaaa0202}}, @IEEE802154_ATTR_STATUS={0x5, 0x3, 0x6}, @IEEE802154_ATTR_STATUS={0x5, 0x3, 0x3f}, @IEEE802154_ATTR_COORD_SHORT_ADDR={0x6, 0x8, 0xffff}]}, 0x60}, 0x1, 0x0, 0x0, 0x20000000}, 0x20000080) ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, &(0x7f0000000540)={0xc, 0x0, &(0x7f0000000440)=[@dead_binder_done], 0xbf, 0x0, &(0x7f0000000480)="0537636f85beafebd2a00648fb042246bcbd2150d45e58acedd2718aaa529794fc45c87c914f2b69b82fedb220d6a94b2babd3f188631b48d025c32a8342250d69582838e7ee6d22fa335ce4315412805f50869d3f4bef11a5bb26ac3704b717f9416fc1f441d5dd77d4b3c1a283f3179a7daf20c0d30210361ea15f09fd38e2c2ac52383e1685a787783f4524fd7d784046605442e441fb76b236455574d7fe70d1885d924099864313d8d3d84c106a36d2ccc77c51d3cdaf3f716551fc0a"}) sendmsg$IEEE802154_LLSEC_DEL_KEY(0xffffffffffffffff, &(0x7f0000000c80)={&(0x7f0000000b40)={0x10, 0x0, 0x0, 0x40000000}, 0xc, &(0x7f0000000c40)={&(0x7f0000000bc0)={0x58, 0x0, 0x402, 0x70bd2d, 0x25dfdbff, {}, [@IEEE802154_ATTR_LLSEC_KEY_MODE={0x5, 0x2b, 0x1}, @IEEE802154_ATTR_DEV_NAME={0xa, 0x1, 'wpan3\x00'}, @IEEE802154_ATTR_LLSEC_KEY_SOURCE_EXTENDED={0xc, 0x2d, {0xaaaaaaaaaaaa0302}}, @IEEE802154_ATTR_LLSEC_KEY_ID={0x5, 0x2e, 0x4}, @IEEE802154_ATTR_LLSEC_KEY_ID={0x5, 0x2e, 0x3}, @IEEE802154_ATTR_SHORT_ADDR={0x6, 0x4, 0xfffd}, @IEEE802154_ATTR_HW_ADDR={0xc}]}, 0x58}, 0x1, 0x0, 0x0, 0x40800}, 0x24040000) 00:53:11 executing program 3: clone(0x400, &(0x7f0000000000)="2f59adb4fe8bdd18e28d59f811fee00f6e", &(0x7f0000000040), &(0x7f0000000080), &(0x7f00000000c0)="ee4468595a6a9e17d313ddea1158c7520b4ce752e1feceb8bd763f38764fe32d5b11f9842e25fb3843f95d48bcbb676b94dc456e5f562cd49d08bd5ac38eb9d6acfc2fa3928b3de489313465b4bea18ac19b9efcb135738e957c5dfaa38b9755182fa0eb46bac360130ee66e2636e1d6aafb8e5918d6d0f8338603cd9bd3e0f3b5d106eae77f68fc50df9f58fd8061a03c31d04b3551c672a8334c0f3bd81aea189fc02f258c22a8b0dba2a60f9a458d6eff75d32cf215930f0bccd5f8ee1d8d33a86c5eda24ec311adc") ioctl$CDROMREADMODE1(0xffffffffffffffff, 0x530d, &(0x7f00000001c0)={0x8, 0x81, 0x4, 0x1, 0x1, 0x8}) ioctl$CDROMREADRAW(0xffffffffffffffff, 0x5314, &(0x7f0000000c40)={0x1, 0x5, 0x7, 0xe5, 0x2, 0x81}) r0 = openat$zero(0xffffffffffffff9c, &(0x7f00000016c0), 0x0, 0x0) ioctl$CDROMSTART(r0, 0x5308) rt_sigaction(0xf, &(0x7f0000001780)={&(0x7f0000001700)="66430f3a15df22c402d937a80e000000f347241ac44218f34ce000c4a2b528e8db5a2466440f38014fdb660f3810b006a50000c421fc295a0cdcf1", 0x80000004, &(0x7f0000001740)="642e41dde78f684ca2df01416dc463755c460b34f3460fa6c0c4c11b7cc7c442f1ad5b00f0430fab6b000f0f62f79af046f71c54", {[0xfffffffffffffffe]}}, &(0x7f0000001840)={&(0x7f00000017c0)="f240af66e20067363666460ffa6f5136360f974700c48165da31c422050c1ec4c17a6fbb2f000000c4027d2074f407f2430f1a39ff30", 0x0, &(0x7f0000001800)="c462394627defbc401f1d3cac46159de6e1fc4816c58a20700000066430faef2c4c16b7c9f0300000066400f6620f0ff0500000000c4e111d2f9"}, 0x8, &(0x7f0000001880)) timerfd_create(0x9, 0x800) prctl$PR_GET_FPEXC(0xb, &(0x7f00000018c0)) recvmmsg(r0, &(0x7f0000003c40)=[{{&(0x7f0000001900)=@pppol2tp={0x18, 0x1, {0x0, 0xffffffffffffffff, {0x2, 0x0, @empty}}}, 0x80, &(0x7f00000029c0)=[{&(0x7f0000001980)=""/39, 0x27}, {&(0x7f00000019c0)=""/4096, 0x1000}], 0x2, &(0x7f0000002a00)=""/18, 0x12}, 0x3f}, {{&(0x7f0000002a40)=@nfc, 0x80, &(0x7f0000002e80)=[{&(0x7f0000002ac0)=""/44, 0x2c}, {&(0x7f0000002b00)=""/65, 0x41}, {&(0x7f0000002b80)=""/107, 0x6b}, {&(0x7f0000002c00)=""/158, 0x9e}, {&(0x7f0000002cc0)=""/169, 0xa9}, {&(0x7f0000002d80)=""/57, 0x39}, {&(0x7f0000002dc0)=""/160, 0xa0}], 0x7}, 0x6}, {{&(0x7f0000002f00)=@x25={0x9, @remote}, 0x80, &(0x7f0000003100)=[{&(0x7f0000002f80)=""/101, 0x65}, {&(0x7f0000003000)}, {&(0x7f0000003040)=""/187, 0xbb}], 0x3, &(0x7f0000003140)=""/159, 0x9f}, 0xffffffff}, {{&(0x7f0000003200)=@ll={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @dev}, 0x80, &(0x7f0000003400)=[{&(0x7f0000003280)=""/29, 0x1d}, {&(0x7f00000032c0)=""/41, 0x29}, {&(0x7f0000003300)=""/219, 0xdb}], 0x3, &(0x7f0000003440)=""/204, 0xcc}, 0x2f62}, {{&(0x7f0000003540)=@hci, 0x80, &(0x7f0000003b80)=[{&(0x7f00000035c0)=""/168, 0xa8}, {&(0x7f0000003680)=""/128, 0x80}, {&(0x7f0000003700)=""/75, 0x4b}, {&(0x7f0000003780)=""/189, 0xbd}, {&(0x7f0000003840)=""/168, 0xa8}, {&(0x7f0000003900)=""/132, 0x84}, {&(0x7f00000039c0)=""/162, 0xa2}, {&(0x7f0000003a80)=""/198, 0xc6}], 0x8, &(0x7f0000003c00)=""/25, 0x19}, 0xfc00}], 0x5, 0x21, &(0x7f0000003d80)) r2 = socket$netlink(0x10, 0x3, 0xe) syz_genetlink_get_family_id$smc(&(0x7f0000003dc0), r2) timerfd_create(0x6, 0x800) ioctl$BINDER_THREAD_EXIT(r0, 0x40046208, 0x0) epoll_ctl$EPOLL_CTL_MOD(r0, 0x3, r1, &(0x7f0000003e00)={0xb0000000}) r3 = io_uring_setup(0x35ea, &(0x7f0000003e40)={0x0, 0x7cfa, 0x2, 0x0, 0x210, 0x0, r0}) io_uring_setup(0x106d, &(0x7f0000003ec0)={0x0, 0xb36, 0x1e, 0x1, 0xa7, 0x0, r3}) sendmsg$NBD_CMD_STATUS(0xffffffffffffffff, &(0x7f0000004040)={&(0x7f0000003f40)={0x10, 0x0, 0x0, 0x8}, 0xc, &(0x7f0000004000)={&(0x7f0000003f80)={0x6c, 0x0, 0x20, 0x70bd2a, 0x25dfdbff, {}, [@NBD_ATTR_DEAD_CONN_TIMEOUT={0xc, 0x8, 0x68b2}, @NBD_ATTR_SIZE_BYTES={0xc, 0x2, 0x1f}, @NBD_ATTR_SIZE_BYTES={0xc, 0x2, 0x8}, @NBD_ATTR_TIMEOUT={0xc, 0x4, 0x6}, @NBD_ATTR_DEAD_CONN_TIMEOUT={0xc, 0x8, 0x3}, @NBD_ATTR_CLIENT_FLAGS={0xc, 0x6, 0x1}, @NBD_ATTR_INDEX={0x8, 0x1, 0x0}, @NBD_ATTR_INDEX={0x8, 0x1, 0x0}]}, 0x6c}, 0x1, 0x0, 0x0, 0x40840}, 0x10) r4 = syz_genetlink_get_family_id$nbd(&(0x7f00000040c0), 0xffffffffffffffff) sendmsg$NBD_CMD_RECONFIGURE(0xffffffffffffffff, &(0x7f00000041c0)={&(0x7f0000004080)={0x10, 0x0, 0x0, 0x2000}, 0xc, &(0x7f0000004180)={&(0x7f0000004140)={0x3c, r4, 0x100, 0x70bd29, 0x25dfdbfd, {}, [@NBD_ATTR_SOCKETS={0x14, 0x7, 0x0, 0x1, [{0x8}, {0x8}]}, @NBD_ATTR_INDEX={0x8, 0x1, 0x0}, @NBD_ATTR_SOCKETS={0xc, 0x7, 0x0, 0x1, [{0x8, 0x1, r0}]}]}, 0x3c}, 0x1, 0x0, 0x0, 0x810}, 0x40000) 00:53:11 executing program 6: ioctl$sock_SIOCGIFINDEX_802154(0xffffffffffffffff, 0x8933, &(0x7f0000000000)={'wpan1\x00', 0x0}) r1 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) ioctl$sock_SIOCGIFINDEX_802154(0xffffffffffffffff, 0x8933, &(0x7f0000000080)={'wpan3\x00', 0x0}) sendmsg$IEEE802154_LLSEC_ADD_SECLEVEL(r1, &(0x7f0000000140)={&(0x7f0000000040)={0x10, 0x0, 0x0, 0x800000}, 0xc, &(0x7f0000000100)={&(0x7f00000000c0)={0x2c, 0x0, 0x400, 0x70bd2a, 0x25dfdbfe, {}, [@IEEE802154_ATTR_DEV_INDEX={0x8, 0x2, r0}, @IEEE802154_ATTR_DEV_INDEX={0x8, 0x2, r0}, @IEEE802154_ATTR_DEV_INDEX={0x8, 0x2, r2}]}, 0x2c}, 0x1, 0x0, 0x0, 0x4004081}, 0x10) sendmsg$IEEE802154_LLSEC_DEL_KEY(r1, &(0x7f0000000240)={&(0x7f0000000180)={0x10, 0x0, 0x0, 0x1000000}, 0xc, &(0x7f0000000200)={&(0x7f00000001c0)={0x3c, 0x0, 0x30e, 0x70bd25, 0x25dfdbfd, {}, [@IEEE802154_ATTR_HW_ADDR={0xc, 0x5, {0xaaaaaaaaaaaa0102}}, @IEEE802154_ATTR_LLSEC_KEY_SOURCE_EXTENDED={0xc, 0x2d, {0xaaaaaaaaaaaa0102}}, @IEEE802154_ATTR_LLSEC_KEY_SOURCE_SHORT={0x8, 0x2c, 0x5}, @IEEE802154_ATTR_DEV_INDEX={0x8}]}, 0x3c}, 0x1, 0x0, 0x0, 0x24041000}, 0x44) socketpair$nbd(0x1, 0x1, 0x0, &(0x7f0000002280)={0xffffffffffffffff}) r4 = openat$procfs(0xffffffffffffff9c, &(0x7f00000022c0)='/proc/asound/seq/clients\x00', 0x0, 0x0) socketpair$nbd(0x1, 0x1, 0x0, &(0x7f0000002300)={0xffffffffffffffff}) r6 = socket(0x1d, 0x3, 0x6) r7 = openat$zero(0xffffffffffffff9c, &(0x7f0000002340), 0x2, 0x0) socketpair$nbd(0x1, 0x1, 0x0, &(0x7f0000002380)={0xffffffffffffffff}) sendmsg$NBD_CMD_DISCONNECT(r1, &(0x7f0000002480)={&(0x7f0000000280)={0x10, 0x0, 0x0, 0x80000}, 0xc, &(0x7f0000002440)={&(0x7f00000023c0)={0x6c, 0x0, 0x400, 0x70bd27, 0x25dfdbfb, {}, [@NBD_ATTR_TIMEOUT={0xc, 0x4, 0x100000001}, @NBD_ATTR_SOCKETS={0x4c, 0x7, 0x0, 0x1, [{0x8, 0x1, r3}, {0x8, 0x1, r4}, {0x8}, {0x8, 0x1, r5}, {0x8}, {0x8, 0x1, r6}, {0x8, 0x1, r7}, {0x8, 0x1, r8}, {0x8}]}]}, 0x6c}, 0x1, 0x0, 0x0, 0x20000000}, 0x4000020) ioctl$TIOCGPTPEER(r7, 0x5441, 0xe5) 00:53:11 executing program 2: r0 = fsmount(0xffffffffffffffff, 0x1, 0x2) r1 = fsmount(r0, 0x1, 0x7c) fsconfig$FSCONFIG_CMD_CREATE(r1, 0x6, 0x0, 0x0, 0x0) r2 = fsmount(r0, 0x0, 0x8) ioctl$CDROMREADCOOKED(r2, 0x5315, &(0x7f0000000000)) sendmsg$IPSET_CMD_HEADER(r0, &(0x7f0000000b40)={&(0x7f0000000a80)={0x10, 0x0, 0x0, 0x1000000}, 0xc, &(0x7f0000000b00)={&(0x7f0000000ac0)={0x28, 0xc, 0x6, 0x801, 0x0, 0x0, {0xf, 0x0, 0xa}, [@IPSET_ATTR_PROTOCOL={0x5}, @IPSET_ATTR_SETNAME={0x9, 0x2, 'syz2\x00'}]}, 0x28}, 0x1, 0x0, 0x0, 0x4000881}, 0x10) r3 = openat$zero(0xffffffffffffff9c, &(0x7f0000000b80), 0x0, 0x0) mmap$binder(&(0x7f0000fff000/0x1000)=nil, 0x1000, 0x1, 0x11, r3, 0x358f) ioctl$TIOCGICOUNT(r3, 0x545d, 0x0) ioctl$HIDIOCGPHYS(r2, 0x80404812, &(0x7f0000000bc0)) openat$ttyS3(0xffffffffffffff9c, &(0x7f0000000e80), 0x4a80, 0x0) 00:53:11 executing program 7: r0 = openat$procfs(0xffffffffffffff9c, &(0x7f0000000000)='/proc/mdstat\x00', 0x0, 0x0) mmap$IORING_OFF_CQ_RING(&(0x7f0000ffc000/0x2000)=nil, 0x2000, 0x8, 0x4010, r0, 0x8000000) r1 = openat$cdrom(0xffffffffffffff9c, &(0x7f0000000040), 0xb0840, 0x0) ioctl$CDROM_LOCKDOOR(r1, 0x5329, 0x1) r2 = openat$procfs(0xffffffffffffff9c, &(0x7f0000000080)='/proc/slabinfo\x00', 0x0, 0x0) epoll_ctl$EPOLL_CTL_DEL(r2, 0x2, r0) r3 = fsmount(r2, 0x0, 0x7f) ioctl$CDROMREADMODE1(r3, 0x530d, &(0x7f00000000c0)={0x7, 0x1f, 0x3, 0x81, 0xf3, 0x7b}) mprotect(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x1000008) mmap$IORING_OFF_CQ_RING(&(0x7f0000ffe000/0x1000)=nil, 0x1000, 0x2, 0x80010, r3, 0x8000000) socketpair$nbd(0x1, 0x1, 0x0, &(0x7f0000000d80)) r4 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) sendmsg$NBD_CMD_DISCONNECT(r4, &(0x7f00000011c0)={&(0x7f00000010c0)={0x10, 0x0, 0x0, 0x4000}, 0xc, &(0x7f0000001180)={&(0x7f0000001140)={0x20, 0x0, 0x20, 0x70bd25, 0x25dfdbfe, {}, [@NBD_ATTR_BLOCK_SIZE_BYTES={0xc, 0x3, 0x9de}]}, 0x20}, 0x1, 0x0, 0x0, 0x20004000}, 0x200000c5) 00:53:11 executing program 5: prctl$PR_GET_FPEXC(0xb, &(0x7f0000000000)) r0 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000040)='./binderfs/custom0\x00', 0x800, 0x0) ustat(0x800, &(0x7f0000000080)) ioctl$ifreq_SIOCGIFINDEX_batadv_mesh(0xffffffffffffffff, 0x8933, &(0x7f0000000100)={'batadv0\x00', 0x0}) ioctl$ifreq_SIOCGIFINDEX_batadv_hard(0xffffffffffffffff, 0x8933, &(0x7f0000000140)={'batadv_slave_0\x00', 0x0}) sendmsg$ETHTOOL_MSG_PAUSE_GET(0xffffffffffffffff, &(0x7f00000002c0)={&(0x7f00000000c0)={0x10, 0x0, 0x0, 0x10000}, 0xc, &(0x7f0000000280)={&(0x7f0000000180)={0xdc, 0x0, 0x8, 0x70bd27, 0x25dfdbfb, {}, [@HEADER={0x5c, 0x1, 0x0, 0x1, [@ETHTOOL_A_HEADER_DEV_INDEX={0x8, 0x1, r1}, @ETHTOOL_A_HEADER_FLAGS={0x8}, @ETHTOOL_A_HEADER_DEV_NAME={0x14, 0x2, 'veth0_vlan\x00'}, @ETHTOOL_A_HEADER_DEV_INDEX={0x8}, @ETHTOOL_A_HEADER_FLAGS={0x8, 0x3, 0x3}, @ETHTOOL_A_HEADER_FLAGS={0x8, 0x3, 0x2}, @ETHTOOL_A_HEADER_DEV_INDEX={0x8, 0x1, r2}, @ETHTOOL_A_HEADER_DEV_NAME={0x14, 0x2, 'macvlan0\x00'}]}, @HEADER={0x40, 0x1, 0x0, 0x1, [@ETHTOOL_A_HEADER_DEV_NAME={0x14, 0x2, 'veth0_to_bridge\x00'}, @ETHTOOL_A_HEADER_DEV_NAME={0x14, 0x2, 'veth0_to_bridge\x00'}, @ETHTOOL_A_HEADER_DEV_NAME={0x14, 0x2, 'netpci0\x00'}]}, @HEADER={0x2c, 0x1, 0x0, 0x1, [@ETHTOOL_A_HEADER_DEV_NAME={0x14, 0x2, 'bond_slave_1\x00'}, @ETHTOOL_A_HEADER_DEV_NAME={0x14, 0x2, 'ip_vti0\x00'}]}]}, 0xdc}, 0x1, 0x0, 0x0, 0x4000}, 0x24000000) sendmsg$NBD_CMD_STATUS(0xffffffffffffffff, &(0x7f0000000400)={&(0x7f0000000300)={0x10, 0x0, 0x0, 0x4}, 0xc, &(0x7f00000003c0)={&(0x7f0000000340)={0x44, 0x0, 0x20, 0x70bd2d, 0x25dfdbfc, {}, [@NBD_ATTR_SIZE_BYTES={0xc, 0x2, 0x4}, @NBD_ATTR_SOCKETS={0x24, 0x7, 0x0, 0x1, [{0x8}, {0x8}, {0x8}, {0x8}]}]}, 0x44}}, 0x4000) ioctl$BINDER_GET_NODE_DEBUG_INFO(r0, 0xc018620b, &(0x7f0000000440)={0x3}) syz_genetlink_get_family_id$batadv(&(0x7f0000000480), 0xffffffffffffffff) r3 = syz_open_dev$ttys(0xc, 0x2, 0x0) ioctl$TCSETAF(r3, 0x5408, &(0x7f00000004c0)={0x4, 0xb073, 0x1000, 0x1, 0x13, "b786e10fbdab60cc"}) openat$binderfs(0xffffffffffffff9c, &(0x7f0000000500)='./binderfs2/binder0\x00', 0x802, 0x0) sendmsg$BATADV_CMD_SET_VLAN(0xffffffffffffffff, &(0x7f0000000600)={&(0x7f0000000540)={0x10, 0x0, 0x0, 0x80000}, 0xc, &(0x7f00000005c0)={&(0x7f0000000580)={0x30, 0x0, 0x400, 0x70bd27, 0x25dfdbfb, {}, [@BATADV_ATTR_FRAGMENTATION_ENABLED={0x5, 0x30, 0x1}, @BATADV_ATTR_ORIG_ADDRESS={0xa, 0x9, @random="62836be88da6"}, @BATADV_ATTR_ISOLATION_MASK={0x8, 0x2c, 0x81}]}, 0x30}, 0x1, 0x0, 0x0, 0x8004}, 0x4c000) clone(0x28000800, &(0x7f0000000880)="b3f828035cfe9f8546c65ee8fffa58fb52d9bafabf363f0161cf01b4a2872006d34dcf860667a59d8c5631820a98c05b3989c5037ea89b5a58e8e9809cc008c7ae03db6bb845b2c189e79729a6d2c9a5440c276c7d0686adda809621c1d9723369157389ff141a56cbc54111ec7f92e8262b0c9ab88b9bffbb114333ab5a9711171c09e2589351fa4950d7af92bccf71585c21606994d6b4443d2cb6725d2c983a62f6f0", &(0x7f0000000940), &(0x7f0000000980), &(0x7f00000009c0)="073c516951c56a5fb1d10f1151ef77ee30e71fea92d34f29ddbe9265f84a8e761f6f56055bef1048f67ec1da822c677e9c34d5d52feb791c13c75661003151c2a956098cc6") 00:53:11 executing program 7: r0 = openat$procfs(0xffffffffffffff9c, &(0x7f0000000000)='/proc/mdstat\x00', 0x0, 0x0) mmap$IORING_OFF_CQ_RING(&(0x7f0000ffc000/0x2000)=nil, 0x2000, 0x8, 0x4010, r0, 0x8000000) r1 = openat$cdrom(0xffffffffffffff9c, &(0x7f0000000040), 0xb0840, 0x0) ioctl$CDROM_LOCKDOOR(r1, 0x5329, 0x1) r2 = openat$procfs(0xffffffffffffff9c, &(0x7f0000000080)='/proc/slabinfo\x00', 0x0, 0x0) epoll_ctl$EPOLL_CTL_DEL(r2, 0x2, r0) r3 = fsmount(r2, 0x0, 0x7f) ioctl$CDROMREADMODE1(r3, 0x530d, &(0x7f00000000c0)={0x7, 0x1f, 0x3, 0x81, 0xf3, 0x7b}) mprotect(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x1000008) mmap$IORING_OFF_CQ_RING(&(0x7f0000ffe000/0x1000)=nil, 0x1000, 0x2, 0x80010, r3, 0x8000000) r4 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) sendmsg$NBD_CMD_DISCONNECT(r4, &(0x7f00000011c0)={&(0x7f00000010c0)={0x10, 0x0, 0x0, 0x4000}, 0xc, &(0x7f0000001180)={&(0x7f0000001140)={0x20, 0x0, 0x20, 0x70bd25, 0x25dfdbfe, {}, [@NBD_ATTR_BLOCK_SIZE_BYTES={0xc, 0x3, 0x9de}]}, 0x20}, 0x1, 0x0, 0x0, 0x20004000}, 0x200000c5) 00:53:11 executing program 2: r0 = fsmount(0xffffffffffffffff, 0x1, 0x2) r1 = fsmount(r0, 0x1, 0x7c) fsconfig$FSCONFIG_CMD_CREATE(r1, 0x6, 0x0, 0x0, 0x0) r2 = fsmount(r0, 0x0, 0x8) ioctl$CDROMREADCOOKED(r2, 0x5315, &(0x7f0000000000)) sendmsg$IPSET_CMD_HEADER(r0, &(0x7f0000000b40)={&(0x7f0000000a80)={0x10, 0x0, 0x0, 0x1000000}, 0xc, &(0x7f0000000b00)={&(0x7f0000000ac0)={0x28, 0xc, 0x6, 0x801, 0x0, 0x0, {0xf, 0x0, 0xa}, [@IPSET_ATTR_PROTOCOL={0x5}, @IPSET_ATTR_SETNAME={0x9, 0x2, 'syz2\x00'}]}, 0x28}, 0x1, 0x0, 0x0, 0x4000881}, 0x10) r3 = openat$zero(0xffffffffffffff9c, &(0x7f0000000b80), 0x0, 0x0) mmap$binder(&(0x7f0000fff000/0x1000)=nil, 0x1000, 0x1, 0x11, r3, 0x358f) ioctl$TIOCGICOUNT(r3, 0x545d, 0x0) ioctl$HIDIOCGPHYS(r2, 0x80404812, &(0x7f0000000bc0)) openat$ttyS3(0xffffffffffffff9c, &(0x7f0000000e80), 0x4a80, 0x0) 00:53:11 executing program 1: r0 = openat$zero(0xffffffffffffff9c, &(0x7f0000000000), 0x400200, 0x0) ioctl$SECCOMP_IOCTL_NOTIF_ADDFD(r0, 0x40182103, &(0x7f0000000040)={0x0, 0x1, 0xffffffffffffffff, 0x80000000, 0x80000}) r1 = syz_genetlink_get_family_id$batadv(&(0x7f00000000c0), r0) sendmsg$BATADV_CMD_GET_TRANSTABLE_LOCAL(r0, &(0x7f00000001c0)={&(0x7f0000000080)={0x10, 0x0, 0x0, 0x80000}, 0xc, &(0x7f0000000180)={&(0x7f0000000100)={0x54, r1, 0x200, 0x70bd25, 0x25dfdbff, {}, [@BATADV_ATTR_THROUGHPUT_OVERRIDE={0x8, 0x3b, 0x89}, @BATADV_ATTR_THROUGHPUT_OVERRIDE={0x8, 0x3b, 0xffff}, @BATADV_ATTR_FRAGMENTATION_ENABLED={0x5}, @BATADV_ATTR_AGGREGATED_OGMS_ENABLED={0x5}, @BATADV_ATTR_MULTICAST_FORCEFLOOD_ENABLED={0x5}, @BATADV_ATTR_BRIDGE_LOOP_AVOIDANCE_ENABLED={0x5}, @BATADV_ATTR_HARD_IFINDEX={0x8}, @BATADV_ATTR_GW_MODE={0x5, 0x33, 0x1}]}, 0x54}, 0x1, 0x0, 0x0, 0x48041}, 0x4840) r2 = openat$procfs(0xffffffffffffff9c, &(0x7f0000000200)='/proc/cpuinfo\x00', 0x0, 0x0) sendmsg$BATADV_CMD_GET_GATEWAYS(r2, &(0x7f0000000340)={&(0x7f0000000240)={0x10, 0x0, 0x0, 0x1000000}, 0xc, &(0x7f0000000300)={&(0x7f0000000280)={0x50, r1, 0x400, 0x70bd26, 0x25dfdbfb, {}, [@BATADV_ATTR_BRIDGE_LOOP_AVOIDANCE_ENABLED={0x5, 0x2e, 0x1}, @BATADV_ATTR_ISOLATION_MARK={0x8, 0x2b, 0x3}, @BATADV_ATTR_BONDING_ENABLED={0x5}, @BATADV_ATTR_BRIDGE_LOOP_AVOIDANCE_ENABLED={0x5, 0x2e, 0x1}, @BATADV_ATTR_ORIG_ADDRESS={0xa, 0x9, @multicast}, @BATADV_ATTR_THROUGHPUT_OVERRIDE={0x8, 0x3b, 0x1}, @BATADV_ATTR_ISOLATION_MARK={0x8, 0x2b, 0x6}]}, 0x50}, 0x1, 0x0, 0x0, 0x20049800}, 0x80) r3 = syz_genetlink_get_family_id$batadv(&(0x7f00000003c0), r0) sendmsg$BATADV_CMD_SET_MESH(r0, &(0x7f0000000480)={&(0x7f0000000380)={0x10, 0x0, 0x0, 0x1000}, 0xc, &(0x7f0000000440)={&(0x7f0000000400)={0x34, r3, 0x400, 0x70bd2d, 0x25dfdbff, {}, [@BATADV_ATTR_GW_MODE={0x5}, @BATADV_ATTR_GW_BANDWIDTH_UP={0x8, 0x32, 0x8001}, @BATADV_ATTR_ORIG_INTERVAL={0x8, 0x39, 0x4}, @BATADV_ATTR_NETWORK_CODING_ENABLED={0x5, 0x38, 0x1}]}, 0x34}, 0x1, 0x0, 0x0, 0x4000000}, 0x18000) r4 = fsmount(r0, 0x1, 0x5) r5 = fsmount(r2, 0x1, 0x7a) epoll_ctl$EPOLL_CTL_ADD(r4, 0x1, r5, &(0x7f00000016c0)={0x80002000}) rt_sigqueueinfo(0xffffffffffffffff, 0x2, &(0x7f00000017c0)={0x16, 0x5, 0x8}) VM DIAGNOSIS: 00:53:03 Registers: info registers vcpu 0 RAX=1ffff11003605f68 RBX=0000000000000003 RCX=0000000000000001 RDX=0000000000002800 RSI=0000000000000008 RDI=ffff88801b02fb40 RBP=dffffc0000000000 RSP=ffff88801b02fa98 R8 =0000000000000000 R9 =0000000000000000 R10=0000000000000000 R11=00000000000002f3 R12=0000000000000008 R13=0000000000002800 R14=ffff88801b02fb28 R15=0000000000000cc0 RIP=ffffffff8161daca RFL=00000246 [---Z-P-] CPL=0 II=0 A20=1 SMM=0 HLT=0 ES =0000 0000000000000000 00000000 00000000 CS =0010 0000000000000000 ffffffff 00a09b00 DPL=0 CS64 [-RA] SS =0000 0000000000000000 00000000 00000000 DS =0000 0000000000000000 00000000 00000000 FS =0000 00007f8cb71ff540 00000000 00000000 GS =0000 ffff8880e5342000 00000000 00000000 LDT=0000 fffffe4f00000000 00000000 00000000 TR =0040 fffffe0000003000 00004087 00008b00 DPL=0 TSS64-busy GDT= fffffe0000001000 0000007f IDT= fffffe0000000000 00000fff CR0=80050033 CR2=00007f8cb72273c0 CR3=000000004350d000 CR4=00350ef0 DR0=0000000000000000 DR1=0000000000000000 DR2=0000000000000000 DR3=0000000000000000 DR6=00000000ffff0ff0 DR7=0000000000000400 EFER=0000000000000d01 FCW=037f FSW=0000 [ST=0] FTW=00 MXCSR=00001f80 FPR0=0000000000000000 0000 FPR1=0000000000000000 0000 FPR2=0000000000000000 0000 FPR3=0000000000000000 0000 FPR4=0000000000000000 0000 FPR5=0000000000000000 0000 FPR6=0000000000000000 0000 FPR7=0000000000000000 0000 XMM00=ff00ffffffffffff0000000000000000 XMM01=0100010001000000ffffffffffffffff XMM02=0500050005000000455441564952505f XMM03=0000000000000000000000564952505f XMM04=00030005000500050005000000455441 XMM05=00000000000000000000000000000000 XMM06=00000000000000000000000000000000 XMM07=00000000000000000000000000000000 XMM08=00000000000000000000000000000000 XMM09=00000000000000000000000000000000 XMM10=00000000000000000000000000000000 XMM11=00000000000000000000000000000000 XMM12=00000000000000000000000000000000 XMM13=00000000000000000000000000000000 XMM14=00000000000000000000000000000000 XMM15=00000000000000000000000000000000 info registers vcpu 1 RAX=dffffc0000000005 RBX=00000000000003f9 RCX=0000000000000000 RDX=00000000000003f9 RSI=ffffffff829750a0 RDI=ffffffff889c19e0 RBP=ffffffff889c19a0 RSP=ffff88801b3774d0 R8 =0000000000000001 R9 =ffffed100366ee8b R10=0000000000000000 R11=666666203a322320 R12=0000000000000063 R13=ffffffff889c19f0 R14=ffffffff889c19a0 R15=ffffffff889c1c60 RIP=ffffffff829750f5 RFL=00000006 [-----P-] CPL=0 II=0 A20=1 SMM=0 HLT=0 ES =0000 0000000000000000 00000000 00000000 CS =0010 0000000000000000 ffffffff 00a09b00 DPL=0 CS64 [-RA] SS =0018 0000000000000000 ffffffff 00c09300 DPL=0 DS [-WA] DS =0000 0000000000000000 00000000 00000000 FS =0000 000055555d44d400 00000000 00000000 GS =0000 ffff8880e5442000 00000000 00000000 LDT=0000 fffffe6b00000000 00000000 00000000 TR =0040 fffffe000004a000 00004087 00008b00 DPL=0 TSS64-busy GDT= fffffe0000048000 0000007f IDT= fffffe0000000000 00000fff CR0=80050033 CR2=00007ff5016583a4 CR3=000000000a40f000 CR4=00350ef0 DR0=0000000000000000 DR1=0000000000000000 DR2=0000000000000000 DR3=0000000000000000 DR6=00000000ffff0ff0 DR7=0000000000000400 EFER=0000000000000d01 FCW=037f FSW=0000 [ST=0] FTW=00 MXCSR=00001f80 FPR0=0000000000000000 0000 FPR1=0000000000000000 0000 FPR2=0000000000000000 0000 FPR3=0000000000000000 0000 FPR4=0000000000000000 0000 FPR5=0000000000000000 0000 FPR6=0000000000000000 0000 FPR7=0000000000000000 0000 XMM00=00000000a60ce07b00000000cec3662e XMM01=000000000000000003515b82db34ca11 XMM02=0000000000000000333bebdfd0a6a21d XMM03=00000000000000000000000000000000 XMM04=000000000000000000000000000000ff XMM05=00000000000000000000000000000000 XMM06=00000000000000000000000000000000 XMM07=00000000000000000000000000000000 XMM08=00000000000000000000000000000000 XMM09=00000000000000000000000000000000 XMM10=00000000000000000000000000000000 XMM11=00000000000000000000000000000000 XMM12=00000000000000000000000000000000 XMM13=00000000000000000000000000000000 XMM14=00000000000000000000000000000000 XMM15=00000000000000000000000000000000