Warning: Permanently added '[localhost]:21885' (ECDSA) to the list of known hosts. 2026/01/18 11:39:16 fuzzer started 2026/01/18 11:39:16 dialing manager at localhost:42157 syzkaller login: [ 51.322221] cgroup: Unknown subsys name 'net' [ 51.389894] cgroup: Unknown subsys name 'cpuset' [ 51.404292] cgroup: Unknown subsys name 'rlimit' 2026/01/18 11:39:28 syscalls: 203 2026/01/18 11:39:28 code coverage: enabled 2026/01/18 11:39:28 comparison tracing: enabled 2026/01/18 11:39:28 extra coverage: enabled 2026/01/18 11:39:28 setuid sandbox: enabled 2026/01/18 11:39:28 namespace sandbox: enabled 2026/01/18 11:39:28 Android sandbox: enabled 2026/01/18 11:39:28 fault injection: enabled 2026/01/18 11:39:28 leak checking: enabled 2026/01/18 11:39:28 net packet injection: enabled 2026/01/18 11:39:28 net device setup: enabled 2026/01/18 11:39:28 concurrency sanitizer: /sys/kernel/debug/kcsan does not exist 2026/01/18 11:39:28 devlink PCI setup: PCI device 0000:00:10.0 is not available 2026/01/18 11:39:28 USB emulation: enabled 2026/01/18 11:39:28 hci packet injection: enabled 2026/01/18 11:39:28 wifi device emulation: enabled 2026/01/18 11:39:28 802.15.4 emulation: enabled 2026/01/18 11:39:28 fetching corpus: 0, signal 0/0 (executing program) 2026/01/18 11:39:30 starting 8 fuzzer processes 11:39:30 executing program 0: r0 = openat$vcsa(0xffffffffffffff9c, &(0x7f0000000000), 0x40000, 0x0) ioctl$SG_GET_PACK_ID(r0, 0x227c, &(0x7f0000000040)) r1 = openat$sr(0xffffffffffffff9c, &(0x7f0000000080), 0x454082, 0x0) ioctl$SG_SET_DEBUG(r1, 0x227e, &(0x7f00000000c0)=0x1) r2 = syz_open_dev$sg(&(0x7f0000000100), 0x8, 0x280102) ioctl$SG_GET_RESERVED_SIZE(r2, 0x2272, &(0x7f0000000140)) ioctl$SG_GET_REQUEST_TABLE(r1, 0x2286, &(0x7f0000000180)) r3 = syz_open_dev$sg(&(0x7f0000000300), 0x100000000, 0x408903) ioctl$SG_SET_RESERVED_SIZE(r3, 0x2275, &(0x7f0000000340)=0x80000000) ioctl$SG_GET_KEEP_ORPHAN(0xffffffffffffffff, 0x2288, &(0x7f0000000380)) ioctl$SG_GET_PACK_ID(r1, 0x227c, &(0x7f00000003c0)) ioctl$SG_SET_RESERVED_SIZE(r2, 0x2275, &(0x7f0000000400)=0x4cbd) ioctl$SG_EMULATED_HOST(0xffffffffffffffff, 0x2203, &(0x7f0000000440)) shmctl$IPC_STAT(0xffffffffffffffff, 0x2, &(0x7f0000000480)=""/83) ioctl$SCSI_IOCTL_PROBE_HOST(r0, 0x5385, &(0x7f0000000500)={0x1d, ""/29}) r4 = syz_open_dev$sg(&(0x7f0000000540), 0x8, 0x8100) ioctl$SG_GET_RESERVED_SIZE(r4, 0x2272, &(0x7f0000000580)) ioctl$SG_GET_KEEP_ORPHAN(0xffffffffffffffff, 0x2288, &(0x7f00000005c0)) ioctl$SG_SET_DEBUG(r3, 0x227e, &(0x7f0000000600)=0x1) sendmsg$MPTCP_PM_CMD_DEL_ADDR(r1, &(0x7f0000000740)={&(0x7f0000000640)={0x10, 0x0, 0x0, 0x40}, 0xc, &(0x7f0000000700)={&(0x7f0000000680)={0x64, 0x0, 0x10, 0x70bd2c, 0x25dfdbff, {}, [@MPTCP_PM_ATTR_RCV_ADD_ADDRS={0x8, 0x2, 0x1}, @MPTCP_PM_ATTR_ADDR={0x4}, @MPTCP_PM_ATTR_ADDR={0x24, 0x1, 0x0, 0x1, [@MPTCP_PM_ADDR_ATTR_IF_IDX={0x8}, @MPTCP_PM_ADDR_ATTR_PORT={0x6, 0x5, 0x4e24}, @MPTCP_PM_ADDR_ATTR_IF_IDX={0x8}, @MPTCP_PM_ADDR_ATTR_PORT={0x6, 0x5, 0x4e22}]}, @MPTCP_PM_ATTR_SUBFLOWS={0x8, 0x3, 0x3}, @MPTCP_PM_ATTR_SUBFLOWS={0x8, 0x3, 0x7}, @MPTCP_PM_ATTR_RCV_ADD_ADDRS={0x8, 0x2, 0x6}, @MPTCP_PM_ATTR_RCV_ADD_ADDRS={0x8, 0x2, 0x2}]}, 0x64}, 0x1, 0x0, 0x0, 0x4008010}, 0x4800) 11:39:30 executing program 1: r0 = shmget(0x2, 0x3000, 0x100, &(0x7f0000ffb000/0x3000)=nil) shmat(r0, &(0x7f0000ffa000/0x3000)=nil, 0x2000) shmat(r0, &(0x7f0000ffa000/0x4000)=nil, 0x3000) r1 = shmget(0x3, 0x1000, 0x100, &(0x7f0000ffd000/0x1000)=nil) r2 = syz_genetlink_get_family_id$netlbl_mgmt(&(0x7f0000000040), 0xffffffffffffffff) sendmsg$NLBL_MGMT_C_REMOVEDEF(0xffffffffffffffff, &(0x7f0000000100)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x8}, 0xc, &(0x7f00000000c0)={&(0x7f0000000080)={0x3c, r2, 0x20, 0x70bd29, 0x25dfdbff, {}, [@NLBL_MGMT_A_FAMILY={0x6, 0xb, 0x5}, @NLBL_MGMT_A_PROTOCOL={0x8, 0x2, 0x3}, @NLBL_MGMT_A_IPV4MASK={0x8, 0x8, @multicast1}, @NLBL_MGMT_A_CLPDOI={0x8}, @NLBL_MGMT_A_IPV4ADDR={0x8, 0x7, @local}]}, 0x3c}, 0x1, 0x0, 0x0, 0x4048820}, 0x40000) shmat(0xffffffffffffffff, &(0x7f0000ffb000/0x4000)=nil, 0x2000) r3 = shmget(0x0, 0xf000, 0x100, &(0x7f0000ff1000/0xf000)=nil) shmctl$IPC_RMID(r3, 0x0) r4 = mmap$IORING_OFF_SQ_RING(&(0x7f0000ffd000/0x1000)=nil, 0x1000, 0x2000006, 0x40010, 0xffffffffffffffff, 0x0) syz_io_uring_submit(r4, 0x0, &(0x7f00000001c0)=@IORING_OP_PROVIDE_BUFFERS={0x1f, 0x1, 0x0, 0x8, 0x2, &(0x7f0000000140)="10e8e6d73f8e97a04564912d4b0bee6921be05ed083e4d741dabdbce8c94949f57a5c9d9da73d0e5ad668714159e31498f181aad79547c645eefb456a7b8c4be765eb156b77cba8a752b90d7729b2c285893a10c3633d2485f48f30d247214c5e28a", 0x7, 0x0, 0x1, {0x1}}, 0x100) r5 = socket(0x2c, 0x5, 0x1) accept4$packet(0xffffffffffffffff, &(0x7f0000000280)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @random}, &(0x7f00000002c0)=0x14, 0x40000) recvfrom$packet(r5, &(0x7f0000000200)=""/108, 0x6c, 0x2000, &(0x7f0000000300)={0x11, 0x16, r6, 0x1, 0x8, 0x6, @local}, 0x14) r7 = syz_genetlink_get_family_id$netlbl_mgmt(&(0x7f0000000380), 0xffffffffffffffff) sendmsg$NLBL_MGMT_C_REMOVEDEF(0xffffffffffffffff, &(0x7f0000000440)={&(0x7f0000000340)={0x10, 0x0, 0x0, 0x4}, 0xc, &(0x7f0000000400)={&(0x7f00000003c0)={0x24, r7, 0x400, 0x70bd26, 0x25dfdbfc, {}, [@NLBL_MGMT_A_FAMILY={0x6, 0xb, 0x18}, @NLBL_MGMT_A_PROTOCOL={0x8, 0x2, 0x3}]}, 0x24}, 0x1, 0x0, 0x0, 0x48084}, 0x8040) io_uring_setup(0x14ab, &(0x7f0000000480)={0x0, 0x5191, 0x20, 0x1, 0x3ba}) shmctl$IPC_INFO(r1, 0x3, &(0x7f0000000500)=""/203) recvmsg(r5, &(0x7f0000002b40)={&(0x7f0000000600)=@pptp={0x18, 0x2, {0x0, @private}}, 0x80, &(0x7f00000029c0)=[{&(0x7f0000000680)=""/252, 0xfc}, {&(0x7f0000000780)=""/122, 0x7a}, {&(0x7f0000000800)=""/178, 0xb2}, {&(0x7f00000008c0)=""/151, 0x97}, {&(0x7f0000000980)=""/4096, 0x1000}, {&(0x7f0000001980)=""/3, 0x3}, {&(0x7f00000019c0)=""/4096, 0x1000}], 0x7, &(0x7f0000002a40)=""/219, 0xdb}, 0x123) shmget$private(0x0, 0x2000, 0x10, &(0x7f0000ffc000/0x2000)=nil) 11:39:30 executing program 2: clock_nanosleep(0x7, 0x0, &(0x7f0000000000)={0x77359400}, &(0x7f0000000040)) getsockopt$inet6_IPV6_XFRM_POLICY(0xffffffffffffffff, 0x29, 0x23, &(0x7f0000000080)={{{@in6, @in6=@remote, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, {{@in6=@dev}, 0x0, @in=@initdev}}, &(0x7f0000000180)=0xe8) setsockopt$packet_add_memb(0xffffffffffffffff, 0x107, 0x1, &(0x7f00000001c0)={r0, 0x1, 0x6, @broadcast}, 0x10) getpeername$packet(0xffffffffffffffff, &(0x7f0000000200)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @dev}, &(0x7f0000000240)=0x14) recvmsg(0xffffffffffffffff, &(0x7f00000027c0)={&(0x7f0000000280)=@xdp={0x2c, 0x0, 0x0}, 0x80, &(0x7f0000002640)=[{&(0x7f0000000300)=""/227, 0xe3}, {&(0x7f0000000400)=""/4096, 0x1000}, {&(0x7f0000001400)=""/92, 0x5c}, {&(0x7f0000001480)=""/93, 0x5d}, {&(0x7f0000001500)=""/4096, 0x1000}, {&(0x7f0000002500)=""/87, 0x57}, {&(0x7f0000002580)=""/189, 0xbd}], 0x7, &(0x7f00000026c0)=""/199, 0xc7}, 0x140) bind$packet(0xffffffffffffffff, &(0x7f0000002800)={0x11, 0x1b, r2, 0x1, 0x5}, 0x14) getresgid(&(0x7f0000002840), &(0x7f0000002880), &(0x7f00000028c0)) r3 = accept4$packet(0xffffffffffffffff, &(0x7f0000002900)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @multicast}, &(0x7f0000002940)=0x14, 0x80000) recvfrom$packet(r3, &(0x7f0000002980)=""/4096, 0x1000, 0x0, &(0x7f0000003980)={0x11, 0x17, r2, 0x1, 0x5, 0x6, @multicast}, 0x14) r4 = socket$inet6_udp(0xa, 0x2, 0x0) getsockopt$inet6_IPV6_XFRM_POLICY(r4, 0x29, 0x23, &(0x7f00000039c0)={{{@in6=@ipv4, @in6=@private0}}, {{@in=@private}, 0x0, @in6=@remote}}, &(0x7f0000003ac0)=0xe8) r5 = openat$sr(0xffffffffffffff9c, &(0x7f0000003b00), 0x200000, 0x0) recvfrom$packet(r5, &(0x7f0000003b40)=""/161, 0xa1, 0x140, &(0x7f0000003c00)={0x11, 0x2, r1, 0x1, 0x9a, 0x6, @local}, 0x14) r6 = openat$vcsa(0xffffffffffffff9c, &(0x7f0000003c40), 0x500, 0x0) write$bt_hci(r6, &(0x7f0000003c80)={0x1, @write_current_iac_lap={{0xc3a, 0x7}, {0x6, "30a9a39c10c4"}}}, 0xb) prctl$PR_SET_MM_MAP_SIZE(0x23, 0xf, &(0x7f0000003cc0)) accept4$packet(r6, &(0x7f00000053c0)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @local}, &(0x7f0000005400)=0x14, 0x80000) bind$packet(r3, &(0x7f0000005440)={0x11, 0x1b, r7, 0x1, 0x8, 0x6, @local}, 0x14) openat$sr(0xffffffffffffff9c, &(0x7f0000005480), 0x428802, 0x0) sendmsg$MPTCP_PM_CMD_FLUSH_ADDRS(r6, &(0x7f00000055c0)={&(0x7f00000054c0)={0x10, 0x0, 0x0, 0x4}, 0xc, &(0x7f0000005580)={&(0x7f0000005540)={0x30, 0x0, 0x4, 0x70bd2b, 0x25dfdbfd, {}, [@MPTCP_PM_ATTR_SUBFLOWS={0x8, 0x3, 0x8}, @MPTCP_PM_ATTR_SUBFLOWS={0x8, 0x3, 0x4}, @MPTCP_PM_ATTR_ADDR={0xc, 0x1, 0x0, 0x1, [@MPTCP_PM_ADDR_ATTR_IF_IDX={0x8, 0x7, r7}]}]}, 0x30}, 0x1, 0x0, 0x0, 0x4004084}, 0x4040080) 11:39:30 executing program 3: ioctl$SG_SET_FORCE_PACK_ID(0xffffffffffffffff, 0x227b, &(0x7f0000000000)=0x1) ioctl$SG_SET_FORCE_PACK_ID(0xffffffffffffffff, 0x227b, &(0x7f0000000040)) ioctl$SG_GET_RESERVED_SIZE(0xffffffffffffffff, 0x2272, &(0x7f0000000080)) r0 = openat$vcsa(0xffffffffffffff9c, &(0x7f00000000c0), 0x4200, 0x0) ioctl$SCSI_IOCTL_SEND_COMMAND(r0, 0x1, &(0x7f0000000100)={0x17, 0x3, 0x1c00, "af36a59fb168d324fd8eaf833aeb82f60d75e8700d81d9"}) ioctl$SG_SET_TIMEOUT(r0, 0x2201, &(0x7f0000000140)=0x4) ioctl$SG_GET_VERSION_NUM(r0, 0x2282, &(0x7f0000000180)) ioctl$SG_GET_REQUEST_TABLE(r0, 0x2286, &(0x7f00000001c0)) ioctl$SG_GET_TIMEOUT(r0, 0x2202, 0x0) r1 = syz_open_dev$sg(&(0x7f0000000340), 0x7fff, 0x40) ioctl$SG_EMULATED_HOST(r1, 0x2203, &(0x7f0000000380)) r2 = openat$vcsa(0xffffffffffffff9c, &(0x7f00000003c0), 0x8103, 0x0) ioctl$SG_GET_COMMAND_Q(r2, 0x2270, &(0x7f0000000400)) r3 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$inet6_tcp_TCP_CONGESTION(r3, 0x6, 0xd, &(0x7f0000000440)='scalable\x00', 0x9) ioctl$SCSI_IOCTL_GET_IDLUN(r2, 0x5382, &(0x7f0000000480)) ioctl$SECCOMP_IOCTL_NOTIF_ADDFD(r2, 0x40182103, &(0x7f00000004c0)={0x0, 0x0, r0, 0x7}) ioctl$sock_ipv6_tunnel_SIOCDELTUNNEL(r0, 0x89f2, &(0x7f0000000580)={'ip6_vti0\x00', &(0x7f0000000500)={'ip6tnl0\x00', 0x0, 0x29, 0x4, 0x3f, 0x4, 0x2a, @dev={0xfe, 0x80, '\x00', 0x43}, @dev={0xfe, 0x80, '\x00', 0x17}, 0x1, 0x8, 0x27f, 0x401}}) ioctl$SG_IO(r2, 0x2285, &(0x7f0000002700)={0x53, 0xfffffffffffffffe, 0x39, 0xff, @scatter={0x2, 0x0, &(0x7f0000001640)=[{&(0x7f00000005c0)=""/81, 0x51}, {&(0x7f0000000640)=""/4096, 0x1000}]}, &(0x7f0000001680)="66d8d4ce99afb99683a288d8dc8d4ce2e2cffbe86bec5cc6d5612637f1ff758e1b371dc9a2f86a424b4795e1059aa6604bf3c27f2f56f25c66", &(0x7f00000016c0)=""/4096, 0xff, 0x10000, 0x2, &(0x7f00000026c0)}) ioctl$SNAPSHOT_PREF_IMAGE_SIZE(r0, 0x3312, 0x8) 11:39:30 executing program 4: setsockopt$inet_tcp_TCP_QUEUE_SEQ(0xffffffffffffffff, 0x6, 0x15, &(0x7f0000000000), 0x4) r0 = openat$vcsa(0xffffffffffffff9c, &(0x7f0000000040), 0x81, 0x0) setsockopt$packet_tx_ring(r0, 0x107, 0xd, &(0x7f0000000080)=@req={0x4, 0xffffffff, 0xd5, 0x5}, 0x10) setsockopt$inet_tcp_TCP_REPAIR_WINDOW(r0, 0x6, 0x1d, &(0x7f00000000c0)={0xfffffff9, 0x1, 0x7fffffff, 0x6, 0x1}, 0x14) ioctl$SCSI_IOCTL_SYNC(r0, 0x4) r1 = accept(r0, &(0x7f0000000100)=@rc={0x1f, @fixed}, &(0x7f0000000180)=0x80) setsockopt$inet_tcp_TCP_FASTOPEN_KEY(r1, 0x6, 0x21, &(0x7f00000001c0)="2a6eddb47c1ebcb5002df4f95b6a3218", 0x10) socket$inet_tcp(0x2, 0x1, 0x0) ioctl$SG_GET_VERSION_NUM(r0, 0x2282, &(0x7f0000000200)) ioctl$SCSI_IOCTL_STOP_UNIT(r0, 0x6) ioctl$sock_SIOCADDRT(r1, 0x890b, &(0x7f0000000280)={0x0, @ax25={0x3, @remote={0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0x1}, 0x3}, @can={0x1d, 0x0}, @l2={0x1f, 0x20, @any, 0x81}, 0x81, 0x0, 0x0, 0x0, 0x3, &(0x7f0000000240)='veth1_to_bond\x00', 0x1, 0x9, 0x81}) sendto$packet(r0, &(0x7f0000000300)="ef239bcbf699ea49248d932bd7a123b6dc9273af2c6c1771bbfca4377cfca4cfc8d7a0ed5b9cec2ccbbb66f69d40c744edd53168a1bdf7d412632799b3df3b80bb5e766fd2e2b373e553a501f4d1997e0a3d387642b483dca2a2bee261552bc0ec0162efa75aa5e9f1a18f050fc5d5fbaa7dceca8e90ed87643278338e74fb16fecf749ace8174d85c2b85721c1097077921541caaf6d322510105ad87d2a427ffd1689b31d399985823b2bb0abd928963c7", 0xb2, 0x4004, &(0x7f00000003c0)={0x11, 0x16, r2, 0x1, 0x6, 0x6, @local}, 0x14) r3 = syz_genetlink_get_family_id$netlbl_mgmt(&(0x7f0000000440), 0xffffffffffffffff) sendmsg$NLBL_MGMT_C_PROTOCOLS(0xffffffffffffffff, &(0x7f0000000500)={&(0x7f0000000400)={0x10, 0x0, 0x0, 0x8}, 0xc, &(0x7f00000004c0)={&(0x7f0000000480)={0x1c, r3, 0x20, 0x70bd25, 0x25dfdbfe, {}, [@NLBL_MGMT_A_CLPDOI={0x8}]}, 0x1c}, 0x1, 0x0, 0x0, 0x4084}, 0x80) r4 = syz_genetlink_get_family_id$netlbl_mgmt(&(0x7f0000000580), 0xffffffffffffffff) sendmsg$NLBL_MGMT_C_VERSION(0xffffffffffffffff, &(0x7f0000000680)={&(0x7f0000000540)={0x10, 0x0, 0x0, 0x8000205}, 0xc, &(0x7f0000000640)={&(0x7f00000005c0)={0x5c, r4, 0x8, 0x1ff, 0x25dfdbfe, {}, [@NLBL_MGMT_A_DOMAIN={0xe, 0x1, 'NLBL_MGMT\x00'}, @NLBL_MGMT_A_IPV6ADDR={0x14, 0x5, @local}, @NLBL_MGMT_A_DOMAIN={0x8, 0x1, '@@,\x00'}, @NLBL_MGMT_A_IPV6ADDR={0x14, 0x5, @loopback}, @NLBL_MGMT_A_IPV4ADDR={0x8, 0x7, @private=0xa010102}]}, 0x5c}, 0x1, 0x0, 0x0, 0x24000810}, 0x8400) ioctl$ifreq_SIOCGIFINDEX_batadv_hard(r0, 0x8933, &(0x7f00000006c0)={'batadv_slave_1\x00'}) r5 = syz_genetlink_get_family_id$netlbl_mgmt(&(0x7f0000000740), 0xffffffffffffffff) sendmsg$NLBL_MGMT_C_REMOVEDEF(0xffffffffffffffff, &(0x7f0000000840)={&(0x7f0000000700)={0x10, 0x0, 0x0, 0x8}, 0xc, &(0x7f0000000800)={&(0x7f0000000780)={0x60, r5, 0x100, 0x70bd2c, 0x25dfdbfc, {}, [@NLBL_MGMT_A_IPV6ADDR={0x14, 0x5, @loopback}, @NLBL_MGMT_A_FAMILY={0x6, 0xb, 0x29}, @NLBL_MGMT_A_IPV4ADDR={0x8, 0x7, @multicast1}, @NLBL_MGMT_A_IPV6ADDR={0x14, 0x5, @remote}, @NLBL_MGMT_A_IPV6MASK={0x14, 0x6, @mcast1}]}, 0x60}, 0x1, 0x0, 0x0, 0x11}, 0x80c1) ioctl$sock_inet_tcp_SIOCINQ(0xffffffffffffffff, 0x541b, &(0x7f0000000a80)) [ 63.186033] audit: type=1400 audit(1768736370.309:7): avc: denied { execmem } for pid=272 comm="syz-executor.1" scontext=system_u:system_r:kernel_t:s0 tcontext=system_u:system_r:kernel_t:s0 tclass=process permissive=1 11:39:30 executing program 5: getpeername$packet(0xffffffffffffffff, &(0x7f0000000000)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @dev}, &(0x7f0000000040)=0x14) ioctl$sock_SIOCADDRT(0xffffffffffffffff, 0x890b, &(0x7f0000000080)={0x0, @phonet={0x23, 0xfe, 0x0, 0x2f}, @hci={0x1f, 0xffffffffffffffff, 0x3}, @rc={0x1f, @any, 0x2}, 0x5, 0x0, 0x0, 0x0, 0x7ff, 0x0, 0x0, 0x4, 0x4}) r0 = mmap$IORING_OFF_SQES(&(0x7f0000ffa000/0x4000)=nil, 0x4000, 0x1000004, 0x810, 0xffffffffffffffff, 0x10000000) syz_io_uring_submit(0x0, r0, &(0x7f0000000100)=@IORING_OP_MADVISE={0x19, 0x3, 0x0, 0x0, 0x0, &(0x7f0000ffa000/0x2000)=nil, 0x2000, 0xb, 0x1}, 0x8) r1 = syz_genetlink_get_family_id$mptcp(&(0x7f0000000180), 0xffffffffffffffff) sendmsg$MPTCP_PM_CMD_ADD_ADDR(0xffffffffffffffff, &(0x7f0000000240)={&(0x7f0000000140)={0x10, 0x0, 0x0, 0x10000}, 0xc, &(0x7f0000000200)={&(0x7f00000001c0)={0x24, r1, 0x800, 0x70bd27, 0x25dfdbfd, {}, [@MPTCP_PM_ATTR_RCV_ADD_ADDRS={0x8, 0x2, 0x8}, @MPTCP_PM_ATTR_RCV_ADD_ADDRS={0x8, 0x2, 0x6}]}, 0x24}, 0x1, 0x0, 0x0, 0x2400c096}, 0x80) sendmsg$MPTCP_PM_CMD_FLUSH_ADDRS(0xffffffffffffffff, &(0x7f00000003c0)={&(0x7f0000000280)={0x10, 0x0, 0x0, 0x40}, 0xc, &(0x7f0000000380)={&(0x7f00000002c0)={0xa4, r1, 0x200, 0x70bd25, 0x25dfdbff, {}, [@MPTCP_PM_ATTR_RCV_ADD_ADDRS={0x8, 0x2, 0x3}, @MPTCP_PM_ATTR_ADDR={0x30, 0x1, 0x0, 0x1, [@MPTCP_PM_ADDR_ATTR_ADDR6={0x14, 0x4, @initdev={0xfe, 0x88, '\x00', 0x0, 0x0}}, @MPTCP_PM_ADDR_ATTR_ADDR4={0x8, 0x3, @local}, @MPTCP_PM_ADDR_ATTR_FLAGS={0x8, 0x6, 0x2}, @MPTCP_PM_ADDR_ATTR_FAMILY={0x6, 0x1, 0xa}]}, @MPTCP_PM_ATTR_ADDR={0x2c, 0x1, 0x0, 0x1, [@MPTCP_PM_ADDR_ATTR_ID={0x5, 0x2, 0x81}, @MPTCP_PM_ADDR_ATTR_PORT={0x6, 0x5, 0x4e22}, @MPTCP_PM_ADDR_ATTR_FAMILY={0x6, 0x1, 0xa}, @MPTCP_PM_ADDR_ATTR_FLAGS={0x8}, @MPTCP_PM_ADDR_ATTR_ID={0x5, 0x2, 0x40}]}, @MPTCP_PM_ATTR_SUBFLOWS={0x8, 0x3, 0x5}, @MPTCP_PM_ATTR_SUBFLOWS={0x8, 0x3, 0x5}, @MPTCP_PM_ATTR_ADDR={0x14, 0x1, 0x0, 0x1, [@MPTCP_PM_ADDR_ATTR_PORT={0x6, 0x5, 0x4e23}, @MPTCP_PM_ADDR_ATTR_PORT={0x6, 0x5, 0x4e21}]}, @MPTCP_PM_ATTR_SUBFLOWS={0x8, 0x3, 0x2}]}, 0xa4}, 0x1, 0x0, 0x0, 0x40}, 0x90) r2 = syz_open_dev$sg(&(0x7f0000000400), 0x4, 0x38040) ioctl$SCSI_IOCTL_DOORUNLOCK(r2, 0x5381) r3 = accept$packet(0xffffffffffffffff, &(0x7f0000000440), &(0x7f0000000480)=0x14) syz_io_uring_submit(0x0, r0, &(0x7f00000004c0)=@IORING_OP_ASYNC_CANCEL={0xe, 0x1, 0x0, 0x0, 0x0, 0x23456}, 0x5) accept4$packet(r3, &(0x7f0000000500), &(0x7f0000000540)=0x14, 0x800) r4 = openat$vcsa(0xffffffffffffff9c, &(0x7f0000000580), 0x121080, 0x0) ioctl$SG_SET_FORCE_PACK_ID(r4, 0x227b, &(0x7f00000005c0)) sendmsg$MPTCP_PM_CMD_GET_ADDR(r4, &(0x7f0000000740)={&(0x7f0000000600)={0x10, 0x0, 0x0, 0x40000000}, 0xc, &(0x7f0000000700)={&(0x7f0000000640)={0xa8, r1, 0x4, 0x70bd2a, 0x25dfdbfe, {}, [@MPTCP_PM_ATTR_ADDR={0x44, 0x1, 0x0, 0x1, [@MPTCP_PM_ADDR_ATTR_ID={0x5, 0x2, 0x6}, @MPTCP_PM_ADDR_ATTR_ID={0x5, 0x2, 0x2}, @MPTCP_PM_ADDR_ATTR_ADDR6={0x14, 0x4, @dev={0xfe, 0x80, '\x00', 0x17}}, @MPTCP_PM_ADDR_ATTR_ADDR6={0x14, 0x4, @remote}, @MPTCP_PM_ADDR_ATTR_FLAGS={0x8, 0x6, 0x2}]}, @MPTCP_PM_ATTR_SUBFLOWS={0x8, 0x3, 0x7}, @MPTCP_PM_ATTR_ADDR={0x14, 0x1, 0x0, 0x1, [@MPTCP_PM_ADDR_ATTR_FAMILY={0x6, 0x1, 0x2}, @MPTCP_PM_ADDR_ATTR_FAMILY={0x6, 0x1, 0x2}]}, @MPTCP_PM_ATTR_RCV_ADD_ADDRS={0x8, 0x2, 0x3}, @MPTCP_PM_ATTR_RCV_ADD_ADDRS={0x8, 0x2, 0x6}, @MPTCP_PM_ATTR_RCV_ADD_ADDRS={0x8, 0x2, 0x1}, @MPTCP_PM_ATTR_ADDR={0xc, 0x1, 0x0, 0x1, [@MPTCP_PM_ADDR_ATTR_FLAGS={0x8, 0x6, 0x3}]}, @MPTCP_PM_ATTR_RCV_ADD_ADDRS={0x8, 0x2, 0x5}, @MPTCP_PM_ATTR_SUBFLOWS={0x8, 0x3, 0x1}]}, 0xa8}, 0x1, 0x0, 0x0, 0x804}, 0x408c1) setsockopt$inet6_tcp_TCP_QUEUE_SEQ(r4, 0x6, 0x15, &(0x7f0000000780)=0x400, 0x4) sendmsg$MPTCP_PM_CMD_FLUSH_ADDRS(r4, &(0x7f00000008c0)={&(0x7f00000007c0)={0x10, 0x0, 0x0, 0x800}, 0xc, &(0x7f0000000880)={&(0x7f0000000800)={0x44, r1, 0x200, 0x70bd25, 0x25dfdbff, {}, [@MPTCP_PM_ATTR_SUBFLOWS={0x8, 0x3, 0x4}, @MPTCP_PM_ATTR_RCV_ADD_ADDRS={0x8, 0x2, 0x5}, @MPTCP_PM_ATTR_SUBFLOWS={0x8, 0x3, 0x5}, @MPTCP_PM_ATTR_RCV_ADD_ADDRS={0x8, 0x2, 0x5}, @MPTCP_PM_ATTR_SUBFLOWS={0x8, 0x3, 0x1}, @MPTCP_PM_ATTR_RCV_ADD_ADDRS={0x8, 0x2, 0x7}]}, 0x44}, 0x1, 0x0, 0x0, 0x8006}, 0x40000) sendmsg$NLBL_UNLABEL_C_STATICLIST(0xffffffffffffffff, &(0x7f0000000a00)={&(0x7f0000000900)={0x10, 0x0, 0x0, 0x4}, 0xc, &(0x7f00000009c0)={&(0x7f0000000940)={0x6c, 0x0, 0x800, 0x70bd2c, 0x25dfdbff, {}, [@NLBL_UNLABEL_A_IPV4MASK={0x8, 0x5, @multicast1}, @NLBL_UNLABEL_A_IPV6ADDR={0x14, 0x2, @private2}, @NLBL_UNLABEL_A_SECCTX={0x27, 0x7, 'system_u:object_r:dhcpc_state_t:s0\x00'}, @NLBL_UNLABEL_A_IPV6ADDR={0x14, 0x2, @private0}]}, 0x6c}, 0x1, 0x0, 0x0, 0x90}, 0x0) ioctl$SG_SET_COMMAND_Q(r4, 0x2271, &(0x7f0000000a40)) ioctl$SG_NEXT_CMD_LEN(r4, 0x2283, &(0x7f0000000a80)=0x58) 11:39:30 executing program 6: ioprio_set$uid(0x0, 0xee01, 0x4004) syz_mount_image$msdos(&(0x7f0000000000), &(0x7f0000000040)='./file0\x00', 0x200, 0x1, &(0x7f00000000c0)=[{&(0x7f0000000080)="7c74c7bc99e778a0c971e6f50fbdd2b70fa0b038d18c7d5ac685833434d89dce684239293aa5d8b6f11bc5c4a033ad1dc68319fad36a1101aad751fd6f4f10", 0x3f, 0x7f}], 0x42000, &(0x7f0000000100)={[{@dots}], [{@obj_user}, {@dont_appraise}, {@uid_lt}, {@hash}, {@seclabel}]}) getsockopt$inet6_IPV6_XFRM_POLICY(0xffffffffffffffff, 0x29, 0x23, &(0x7f0000000240)={{{@in=@loopback, @in6=@empty, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, {{@in6=@local}, 0x0, @in6=@mcast1}}, &(0x7f0000000340)=0xe8) mount$9p_xen(&(0x7f0000000180), &(0x7f00000001c0)='./file0\x00', &(0x7f0000000200), 0x1121061, &(0x7f0000000380)={'trans=xen,', {[{@msize={'msize', 0x3d, 0xf6b3}}, {@debug={'debug', 0x3d, 0x7ff}}, {@posixacl}, {@aname={'aname', 0x3d, '*$-&'}}, {@uname={'uname', 0x3d, 'msdos\x00'}}], [{@seclabel}, {@euid_eq={'euid', 0x3d, r1}}, {@permit_directio}, {@appraise_type}]}}) r2 = syz_io_uring_setup(0x1d4a, &(0x7f0000000440)={0x0, 0xfa85, 0x0, 0x0, 0x285}, &(0x7f0000ffd000/0x1000)=nil, &(0x7f0000ffd000/0x2000)=nil, &(0x7f00000004c0)=0x0, &(0x7f0000000500)) syz_io_uring_setup(0x3e5e, &(0x7f0000000540)={0x0, 0x5c61, 0x8, 0x2, 0x72}, &(0x7f0000ffd000/0x3000)=nil, &(0x7f0000ffc000/0x3000)=nil, &(0x7f00000005c0), &(0x7f0000000600)=0x0) syz_io_uring_submit(r3, r4, &(0x7f0000000740)=@IORING_OP_READ=@pass_buffer={0x16, 0x1, 0x2004, @fd_index=0xa, 0x7, &(0x7f0000000640)=""/227, 0xe3, 0xc, 0x1}, 0x9) ioctl$SECCOMP_IOCTL_NOTIF_ADDFD(0xffffffffffffffff, 0x40182103, &(0x7f0000000780)={0x0, 0x4, r2, 0x9, 0x80000}) openat$cgroup_devices(0xffffffffffffffff, &(0x7f00000007c0)='devices.allow\x00', 0x2, 0x0) syz_mount_image$nfs4(&(0x7f0000000800), &(0x7f0000000840)='./file0/file0\x00', 0xffffffffffffff01, 0x1, &(0x7f0000000900)=[{&(0x7f0000000880)="f19bd7cfef39dd2070dcb194f7bd90ce305e2a9644b9fb91cc1e75bca69ed6bbdd7636452963af395ea61189cce718ef43420310b6ff8db9f4a606d67217b1aa7bf6e1435682323aef92ef40d036c48fa3fc363c6ad63229bb37cd76a6db9879a39f", 0x62, 0x6}], 0x8400, &(0x7f0000000940)={[{'*+\\['}]}) r5 = accept(0xffffffffffffffff, 0x0, &(0x7f0000000980)) sendmsg$MPTCP_PM_CMD_GET_LIMITS(r5, &(0x7f0000000ac0)={&(0x7f00000009c0)={0x10, 0x0, 0x0, 0x200}, 0xc, &(0x7f0000000a80)={&(0x7f0000000a00)={0x74, 0x0, 0x200, 0x70bd27, 0x25dfdbfd, {}, [@MPTCP_PM_ATTR_RCV_ADD_ADDRS={0x8, 0x2, 0x8}, @MPTCP_PM_ATTR_RCV_ADD_ADDRS={0x8, 0x2, 0x2}, @MPTCP_PM_ATTR_SUBFLOWS={0x8, 0x3, 0x6}, @MPTCP_PM_ATTR_ADDR={0x3c, 0x1, 0x0, 0x1, [@MPTCP_PM_ADDR_ATTR_PORT={0x6, 0x5, 0x4e20}, @MPTCP_PM_ADDR_ATTR_ID={0x5, 0x2, 0x5}, @MPTCP_PM_ADDR_ATTR_FLAGS={0x8, 0x6, 0x3}, @MPTCP_PM_ADDR_ATTR_PORT={0x6, 0x5, 0x4e23}, @MPTCP_PM_ADDR_ATTR_FAMILY={0x6}, @MPTCP_PM_ADDR_ATTR_FAMILY={0x6, 0x1, 0xa}, @MPTCP_PM_ADDR_ATTR_FAMILY={0x6, 0x1, 0xa}]}, @MPTCP_PM_ATTR_ADDR={0x4}, @MPTCP_PM_ATTR_SUBFLOWS={0x8}]}, 0x74}, 0x1, 0x0, 0x0, 0x11}, 0x80) sendmsg$IEEE802154_LLSEC_DEL_SECLEVEL(0xffffffffffffffff, &(0x7f0000000bc0)={&(0x7f0000000b00)={0x10, 0x0, 0x0, 0x800000}, 0xc, &(0x7f0000000b80)={&(0x7f0000000b40)={0x2c, 0x0, 0x800, 0x70bd27, 0x25dfdbff, {}, [@IEEE802154_ATTR_DEV_INDEX={0x8}, @IEEE802154_ATTR_LLSEC_FRAME_TYPE={0x5, 0x33, 0x81}, @IEEE802154_ATTR_DEV_INDEX={0x8}]}, 0x2c}, 0x1, 0x0, 0x0, 0x4}, 0x2) socketpair(0x15, 0x1, 0x10001, &(0x7f0000000c00)={0xffffffffffffffff, 0xffffffffffffffff}) sendmsg$BATADV_CMD_TP_METER_CANCEL(r6, &(0x7f0000000d00)={&(0x7f0000000c40)={0x10, 0x0, 0x0, 0x8}, 0xc, &(0x7f0000000cc0)={&(0x7f0000000c80)={0x3c, 0x0, 0x1, 0x70bd2b, 0x25dfdbfc, {}, [@BATADV_ATTR_GW_BANDWIDTH_DOWN={0x8, 0x31, 0x4}, @BATADV_ATTR_ORIG_INTERVAL={0x8, 0x39, 0x5}, @BATADV_ATTR_ISOLATION_MASK={0x8, 0x2c, 0x80000}, @BATADV_ATTR_ISOLATION_MASK={0x8, 0x2c, 0x9}, @BATADV_ATTR_GW_MODE={0x5, 0x33, 0x1}]}, 0x3c}, 0x1, 0x0, 0x0, 0x4080}, 0x40000) socketpair(0xf, 0x6, 0x2, &(0x7f0000000d40)={0xffffffffffffffff}) r9 = accept(r7, &(0x7f0000000d80)=@ax25={{0x3, @default}, [@netrom, @rose, @netrom, @bcast, @bcast, @rose, @default, @bcast]}, &(0x7f0000000e00)=0x80) accept4$packet(r8, &(0x7f0000000e80)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @link_local}, &(0x7f0000000ec0)=0x14, 0x80000) sendmsg$MPTCP_PM_CMD_GET_ADDR(r9, &(0x7f0000001000)={&(0x7f0000000e40)={0x10, 0x0, 0x0, 0x2000}, 0xc, &(0x7f0000000fc0)={&(0x7f0000000f00)={0xb8, 0x0, 0x8, 0x70bd2c, 0x25dfdbfe, {}, [@MPTCP_PM_ATTR_ADDR={0x1c, 0x1, 0x0, 0x1, [@MPTCP_PM_ADDR_ATTR_ID={0x5, 0x2, 0x4}, @MPTCP_PM_ADDR_ATTR_IF_IDX={0x8, 0x7, r10}, @MPTCP_PM_ADDR_ATTR_IF_IDX={0x8, 0x7, r0}]}, @MPTCP_PM_ATTR_ADDR={0x4}, @MPTCP_PM_ATTR_RCV_ADD_ADDRS={0x8, 0x2, 0x2}, @MPTCP_PM_ATTR_ADDR={0x14, 0x1, 0x0, 0x1, [@MPTCP_PM_ADDR_ATTR_FAMILY={0x6, 0x1, 0x2}, @MPTCP_PM_ADDR_ATTR_ID={0x5, 0x2, 0x5}]}, @MPTCP_PM_ATTR_ADDR={0xc, 0x1, 0x0, 0x1, [@MPTCP_PM_ADDR_ATTR_ADDR4={0x8, 0x3, @private=0xa010101}]}, @MPTCP_PM_ATTR_ADDR={0x54, 0x1, 0x0, 0x1, [@MPTCP_PM_ADDR_ATTR_ADDR6={0x14, 0x4, @private0={0xfc, 0x0, '\x00', 0x1}}, @MPTCP_PM_ADDR_ATTR_IF_IDX={0x8, 0x7, r0}, @MPTCP_PM_ADDR_ATTR_FLAGS={0x8, 0x6, 0x4}, @MPTCP_PM_ADDR_ATTR_PORT={0x6, 0x5, 0x4e22}, @MPTCP_PM_ADDR_ATTR_ADDR6={0x14, 0x4, @mcast2}, @MPTCP_PM_ADDR_ATTR_ID={0x5, 0x2, 0x1}, @MPTCP_PM_ADDR_ATTR_FLAGS={0x8, 0x6, 0x6}]}, @MPTCP_PM_ATTR_RCV_ADD_ADDRS={0x8, 0x2, 0x6}]}, 0xb8}, 0x1, 0x0, 0x0, 0x80}, 0x40) mount$9p_rdma(&(0x7f0000001040), &(0x7f0000001080)='./file0\x00', &(0x7f00000010c0), 0xa00800, &(0x7f0000001100)={'trans=rdma,', {'port', 0x3d, 0x4e20}, 0x2c, {[{@common=@aname={'aname', 0x3d, 'permit_directio'}}, {@sq={'sq', 0x3d, 0xffff}}], [{@fscontext={'fscontext', 0x3d, 'staff_u'}}]}}) 11:39:30 executing program 7: r0 = syz_open_dev$sg(&(0x7f0000000000), 0x1, 0x10000) ioctl$SG_GET_PACK_ID(r0, 0x227c, &(0x7f0000000040)) ioctl$SCSI_IOCTL_DOORLOCK(r0, 0x5380) ioctl$SG_SET_KEEP_ORPHAN(r0, 0x2287, &(0x7f0000000080)=0x7) ioctl$SCSI_IOCTL_BENCHMARK_COMMAND(r0, 0x3) ioctl$SCSI_IOCTL_SYNC(r0, 0x4) ioctl$SG_SET_DEBUG(r0, 0x227e, &(0x7f00000000c0)=0x1) setsockopt$packet_add_memb(0xffffffffffffffff, 0x107, 0x1, &(0x7f0000000100)={0x0, 0x1, 0x6}, 0x10) ioctl$SG_NEXT_CMD_LEN(r0, 0x2283, &(0x7f0000000140)=0x74) ioctl$SG_GET_VERSION_NUM(r0, 0x2282, &(0x7f0000000180)) socketpair(0x1f, 0x1, 0x5, &(0x7f00000001c0)={0xffffffffffffffff, 0xffffffffffffffff}) syz_genetlink_get_family_id$batadv(&(0x7f0000000200), r2) ioctl$SCSI_IOCTL_STOP_UNIT(r0, 0x6) ioctl$sock_SIOCADDRT(r1, 0x890b, &(0x7f0000000280)={0x0, @nfc={0x27, 0x0, 0x1, 0x6}, @isdn={0x22, 0x50, 0x5, 0x7, 0x5}, @sco, 0x3, 0x0, 0x0, 0x0, 0x1, &(0x7f0000000240)='virt_wifi0\x00', 0x7fffffff, 0x7f28, 0x4}) ioctl$SG_EMULATED_HOST(0xffffffffffffffff, 0x2203, &(0x7f0000000300)) ioctl$SG_GET_PACK_ID(r0, 0x227c, &(0x7f0000000340)) r3 = accept4$packet(r1, 0x0, &(0x7f0000000380), 0x80400) setsockopt$packet_add_memb(r3, 0x107, 0x1, &(0x7f00000003c0)={0x0, 0x1, 0x6, @remote}, 0x10) ioctl$SG_SET_RESERVED_SIZE(r0, 0x2275, &(0x7f0000000400)=0x6) openat$vcsa(0xffffffffffffff9c, &(0x7f0000000440), 0x10480, 0x0) [ 64.467737] Bluetooth: hci2: unexpected cc 0x0c03 length: 249 > 1 [ 64.469446] Bluetooth: hci0: unexpected cc 0x0c03 length: 249 > 1 [ 64.473654] Bluetooth: hci0: unexpected cc 0x1003 length: 249 > 9 [ 64.474727] Bluetooth: hci2: unexpected cc 0x1003 length: 249 > 9 [ 64.478587] Bluetooth: hci0: unexpected cc 0x1001 length: 249 > 9 [ 64.478619] Bluetooth: hci1: unexpected cc 0x0c03 length: 249 > 1 [ 64.480028] Bluetooth: hci2: unexpected cc 0x1001 length: 249 > 9 [ 64.483184] Bluetooth: hci1: unexpected cc 0x1003 length: 249 > 9 [ 64.485791] Bluetooth: hci1: unexpected cc 0x1001 length: 249 > 9 [ 64.491270] Bluetooth: hci2: unexpected cc 0x0c23 length: 249 > 4 [ 64.493993] Bluetooth: hci1: unexpected cc 0x0c23 length: 249 > 4 [ 64.496696] Bluetooth: hci0: unexpected cc 0x0c23 length: 249 > 4 [ 64.500171] Bluetooth: hci1: unexpected cc 0x0c38 length: 249 > 2 [ 64.502063] Bluetooth: hci2: unexpected cc 0x0c38 length: 249 > 2 [ 64.527626] Bluetooth: hci0: unexpected cc 0x0c38 length: 249 > 2 [ 64.618923] Bluetooth: hci3: unexpected cc 0x0c03 length: 249 > 1 [ 64.622686] Bluetooth: hci3: unexpected cc 0x1003 length: 249 > 9 [ 64.628773] Bluetooth: hci3: unexpected cc 0x1001 length: 249 > 9 [ 64.632194] Bluetooth: hci3: unexpected cc 0x0c23 length: 249 > 4 [ 64.635806] Bluetooth: hci5: unexpected cc 0x0c03 length: 249 > 1 [ 64.637624] Bluetooth: hci3: unexpected cc 0x0c38 length: 249 > 2 [ 64.641597] Bluetooth: hci5: unexpected cc 0x1003 length: 249 > 9 [ 64.643719] Bluetooth: hci5: unexpected cc 0x1001 length: 249 > 9 [ 64.646521] Bluetooth: hci6: unexpected cc 0x0c03 length: 249 > 1 [ 64.650040] Bluetooth: hci6: unexpected cc 0x1003 length: 249 > 9 [ 64.651395] Bluetooth: hci6: unexpected cc 0x1001 length: 249 > 9 [ 64.655491] Bluetooth: hci5: unexpected cc 0x0c23 length: 249 > 4 [ 64.660621] Bluetooth: hci6: unexpected cc 0x0c23 length: 249 > 4 [ 64.676621] Bluetooth: hci5: unexpected cc 0x0c38 length: 249 > 2 [ 64.682953] Bluetooth: hci4: unexpected cc 0x0c03 length: 249 > 1 [ 64.686598] Bluetooth: hci6: unexpected cc 0x0c38 length: 249 > 2 [ 64.686972] Bluetooth: hci7: unexpected cc 0x0c03 length: 249 > 1 [ 64.699621] Bluetooth: hci7: unexpected cc 0x1003 length: 249 > 9 [ 64.700905] Bluetooth: hci4: unexpected cc 0x1003 length: 249 > 9 [ 64.712759] Bluetooth: hci4: unexpected cc 0x1001 length: 249 > 9 [ 64.715555] Bluetooth: hci4: unexpected cc 0x0c23 length: 249 > 4 [ 64.717259] Bluetooth: hci4: unexpected cc 0x0c38 length: 249 > 2 [ 64.721483] Bluetooth: hci7: unexpected cc 0x1001 length: 249 > 9 [ 64.724032] Bluetooth: hci7: unexpected cc 0x0c23 length: 249 > 4 [ 64.725757] Bluetooth: hci7: unexpected cc 0x0c38 length: 249 > 2 [ 66.531888] Bluetooth: hci2: command tx timeout [ 66.532418] Bluetooth: hci1: command tx timeout [ 66.595375] Bluetooth: hci0: command tx timeout [ 66.723379] Bluetooth: hci6: command tx timeout [ 66.724026] Bluetooth: hci3: command tx timeout [ 66.787400] Bluetooth: hci5: command tx timeout [ 66.851901] Bluetooth: hci7: command tx timeout [ 66.852770] Bluetooth: hci4: command tx timeout [ 68.579722] Bluetooth: hci2: command tx timeout [ 68.580638] Bluetooth: hci1: command tx timeout [ 68.643426] Bluetooth: hci0: command tx timeout [ 68.771403] Bluetooth: hci3: command tx timeout [ 68.772065] Bluetooth: hci6: command tx timeout [ 68.836123] Bluetooth: hci5: command tx timeout [ 68.899436] Bluetooth: hci7: command tx timeout [ 68.900039] Bluetooth: hci4: command tx timeout [ 70.627494] Bluetooth: hci1: command tx timeout [ 70.627950] Bluetooth: hci2: command tx timeout [ 70.692391] Bluetooth: hci0: command tx timeout [ 70.820978] Bluetooth: hci6: command tx timeout [ 70.821456] Bluetooth: hci3: command tx timeout [ 70.883441] Bluetooth: hci5: command tx timeout [ 70.947359] Bluetooth: hci4: command tx timeout [ 70.947828] Bluetooth: hci7: command tx timeout [ 72.675390] Bluetooth: hci2: command tx timeout [ 72.676111] Bluetooth: hci1: command tx timeout [ 72.739412] Bluetooth: hci0: command tx timeout [ 72.867655] Bluetooth: hci6: command tx timeout [ 72.868404] Bluetooth: hci3: command tx timeout [ 72.931765] Bluetooth: hci5: command tx timeout [ 72.996444] Bluetooth: hci7: command tx timeout [ 72.997045] Bluetooth: hci4: command tx timeout [ 101.201988] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 101.202659] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 101.373615] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 101.374228] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 102.602960] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 102.603608] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 102.736238] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 102.737026] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 103.824439] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 103.825063] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 103.837292] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 103.837893] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 104.497616] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 104.498200] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 104.597643] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 104.598236] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 104.922560] loop6: detected capacity change from 0 to 1 [ 104.960488] ======================================================= [ 104.960488] WARNING: The mand mount option has been deprecated and [ 104.960488] and is ignored by this kernel. Remove the mand [ 104.960488] option from the mount to silence this warning. [ 104.960488] ======================================================= [ 104.985975] loop6: detected capacity change from 0 to 264192 [ 104.997801] nfs4: Unknown parameter '*+\[' [ 105.105020] SELinux: security_context_str_to_sid (staff_u) failed with errno=-22 [ 105.107178] loop6: detected capacity change from 0 to 1 [ 105.113580] SELinux: security_context_str_to_sid (staff_u) failed with errno=-22 [ 105.216964] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 105.218116] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 105.351627] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 105.352263] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 105.862917] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 105.864035] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 105.925688] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 105.926335] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 105.986452] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 105.987028] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 106.026665] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 106.027234] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 106.480953] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 106.481942] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 106.523154] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 106.524101] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 11:40:23 executing program 1: r0 = shmget(0x2, 0x3000, 0x100, &(0x7f0000ffb000/0x3000)=nil) shmat(r0, &(0x7f0000ffa000/0x3000)=nil, 0x2000) shmat(r0, &(0x7f0000ffa000/0x4000)=nil, 0x3000) r1 = shmget(0x3, 0x1000, 0x100, &(0x7f0000ffd000/0x1000)=nil) r2 = syz_genetlink_get_family_id$netlbl_mgmt(&(0x7f0000000040), 0xffffffffffffffff) sendmsg$NLBL_MGMT_C_REMOVEDEF(0xffffffffffffffff, &(0x7f0000000100)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x8}, 0xc, &(0x7f00000000c0)={&(0x7f0000000080)={0x3c, r2, 0x20, 0x70bd29, 0x25dfdbff, {}, [@NLBL_MGMT_A_FAMILY={0x6, 0xb, 0x5}, @NLBL_MGMT_A_PROTOCOL={0x8, 0x2, 0x3}, @NLBL_MGMT_A_IPV4MASK={0x8, 0x8, @multicast1}, @NLBL_MGMT_A_CLPDOI={0x8}, @NLBL_MGMT_A_IPV4ADDR={0x8, 0x7, @local}]}, 0x3c}, 0x1, 0x0, 0x0, 0x4048820}, 0x40000) shmat(0xffffffffffffffff, &(0x7f0000ffb000/0x4000)=nil, 0x2000) r3 = shmget(0x0, 0xf000, 0x100, &(0x7f0000ff1000/0xf000)=nil) shmctl$IPC_RMID(r3, 0x0) r4 = mmap$IORING_OFF_SQ_RING(&(0x7f0000ffd000/0x1000)=nil, 0x1000, 0x2000006, 0x40010, 0xffffffffffffffff, 0x0) syz_io_uring_submit(r4, 0x0, &(0x7f00000001c0)=@IORING_OP_PROVIDE_BUFFERS={0x1f, 0x1, 0x0, 0x8, 0x2, &(0x7f0000000140)="10e8e6d73f8e97a04564912d4b0bee6921be05ed083e4d741dabdbce8c94949f57a5c9d9da73d0e5ad668714159e31498f181aad79547c645eefb456a7b8c4be765eb156b77cba8a752b90d7729b2c285893a10c3633d2485f48f30d247214c5e28a", 0x7, 0x0, 0x1, {0x1}}, 0x100) r5 = socket(0x2c, 0x5, 0x1) accept4$packet(0xffffffffffffffff, &(0x7f0000000280)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @random}, &(0x7f00000002c0)=0x14, 0x40000) recvfrom$packet(r5, &(0x7f0000000200)=""/108, 0x6c, 0x2000, &(0x7f0000000300)={0x11, 0x16, r6, 0x1, 0x8, 0x6, @local}, 0x14) r7 = syz_genetlink_get_family_id$netlbl_mgmt(&(0x7f0000000380), 0xffffffffffffffff) sendmsg$NLBL_MGMT_C_REMOVEDEF(0xffffffffffffffff, &(0x7f0000000440)={&(0x7f0000000340)={0x10, 0x0, 0x0, 0x4}, 0xc, &(0x7f0000000400)={&(0x7f00000003c0)={0x24, r7, 0x400, 0x70bd26, 0x25dfdbfc, {}, [@NLBL_MGMT_A_FAMILY={0x6, 0xb, 0x18}, @NLBL_MGMT_A_PROTOCOL={0x8, 0x2, 0x3}]}, 0x24}, 0x1, 0x0, 0x0, 0x48084}, 0x8040) io_uring_setup(0x14ab, &(0x7f0000000480)={0x0, 0x5191, 0x20, 0x1, 0x3ba}) shmctl$IPC_INFO(r1, 0x3, &(0x7f0000000500)=""/203) recvmsg(r5, &(0x7f0000002b40)={&(0x7f0000000600)=@pptp={0x18, 0x2, {0x0, @private}}, 0x80, &(0x7f00000029c0)=[{&(0x7f0000000680)=""/252, 0xfc}, {&(0x7f0000000780)=""/122, 0x7a}, {&(0x7f0000000800)=""/178, 0xb2}, {&(0x7f00000008c0)=""/151, 0x97}, {&(0x7f0000000980)=""/4096, 0x1000}, {&(0x7f0000001980)=""/3, 0x3}, {&(0x7f00000019c0)=""/4096, 0x1000}], 0x7, &(0x7f0000002a40)=""/219, 0xdb}, 0x123) shmget$private(0x0, 0x2000, 0x10, &(0x7f0000ffc000/0x2000)=nil) 11:40:23 executing program 0: r0 = openat$vcsa(0xffffffffffffff9c, &(0x7f0000000000), 0x40000, 0x0) ioctl$SG_GET_PACK_ID(r0, 0x227c, &(0x7f0000000040)) r1 = openat$sr(0xffffffffffffff9c, &(0x7f0000000080), 0x454082, 0x0) ioctl$SG_SET_DEBUG(r1, 0x227e, &(0x7f00000000c0)=0x1) r2 = syz_open_dev$sg(&(0x7f0000000100), 0x8, 0x280102) ioctl$SG_GET_RESERVED_SIZE(r2, 0x2272, &(0x7f0000000140)) ioctl$SG_GET_REQUEST_TABLE(r1, 0x2286, &(0x7f0000000180)) r3 = syz_open_dev$sg(&(0x7f0000000300), 0x100000000, 0x408903) ioctl$SG_SET_RESERVED_SIZE(r3, 0x2275, &(0x7f0000000340)=0x80000000) ioctl$SG_GET_KEEP_ORPHAN(0xffffffffffffffff, 0x2288, &(0x7f0000000380)) ioctl$SG_GET_PACK_ID(r1, 0x227c, &(0x7f00000003c0)) ioctl$SG_SET_RESERVED_SIZE(r2, 0x2275, &(0x7f0000000400)=0x4cbd) ioctl$SG_EMULATED_HOST(0xffffffffffffffff, 0x2203, &(0x7f0000000440)) shmctl$IPC_STAT(0xffffffffffffffff, 0x2, &(0x7f0000000480)=""/83) ioctl$SCSI_IOCTL_PROBE_HOST(r0, 0x5385, &(0x7f0000000500)={0x1d, ""/29}) r4 = syz_open_dev$sg(&(0x7f0000000540), 0x8, 0x8100) ioctl$SG_GET_RESERVED_SIZE(r4, 0x2272, &(0x7f0000000580)) ioctl$SG_GET_KEEP_ORPHAN(0xffffffffffffffff, 0x2288, &(0x7f00000005c0)) ioctl$SG_SET_DEBUG(r3, 0x227e, &(0x7f0000000600)=0x1) sendmsg$MPTCP_PM_CMD_DEL_ADDR(r1, &(0x7f0000000740)={&(0x7f0000000640)={0x10, 0x0, 0x0, 0x40}, 0xc, &(0x7f0000000700)={&(0x7f0000000680)={0x64, 0x0, 0x10, 0x70bd2c, 0x25dfdbff, {}, [@MPTCP_PM_ATTR_RCV_ADD_ADDRS={0x8, 0x2, 0x1}, @MPTCP_PM_ATTR_ADDR={0x4}, @MPTCP_PM_ATTR_ADDR={0x24, 0x1, 0x0, 0x1, [@MPTCP_PM_ADDR_ATTR_IF_IDX={0x8}, @MPTCP_PM_ADDR_ATTR_PORT={0x6, 0x5, 0x4e24}, @MPTCP_PM_ADDR_ATTR_IF_IDX={0x8}, @MPTCP_PM_ADDR_ATTR_PORT={0x6, 0x5, 0x4e22}]}, @MPTCP_PM_ATTR_SUBFLOWS={0x8, 0x3, 0x3}, @MPTCP_PM_ATTR_SUBFLOWS={0x8, 0x3, 0x7}, @MPTCP_PM_ATTR_RCV_ADD_ADDRS={0x8, 0x2, 0x6}, @MPTCP_PM_ATTR_RCV_ADD_ADDRS={0x8, 0x2, 0x2}]}, 0x64}, 0x1, 0x0, 0x0, 0x4008010}, 0x4800) 11:40:23 executing program 5: getpeername$packet(0xffffffffffffffff, &(0x7f0000000000)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @dev}, &(0x7f0000000040)=0x14) ioctl$sock_SIOCADDRT(0xffffffffffffffff, 0x890b, &(0x7f0000000080)={0x0, @phonet={0x23, 0xfe, 0x0, 0x2f}, @hci={0x1f, 0xffffffffffffffff, 0x3}, @rc={0x1f, @any, 0x2}, 0x5, 0x0, 0x0, 0x0, 0x7ff, 0x0, 0x0, 0x4, 0x4}) r0 = mmap$IORING_OFF_SQES(&(0x7f0000ffa000/0x4000)=nil, 0x4000, 0x1000004, 0x810, 0xffffffffffffffff, 0x10000000) syz_io_uring_submit(0x0, r0, &(0x7f0000000100)=@IORING_OP_MADVISE={0x19, 0x3, 0x0, 0x0, 0x0, &(0x7f0000ffa000/0x2000)=nil, 0x2000, 0xb, 0x1}, 0x8) r1 = syz_genetlink_get_family_id$mptcp(&(0x7f0000000180), 0xffffffffffffffff) sendmsg$MPTCP_PM_CMD_ADD_ADDR(0xffffffffffffffff, &(0x7f0000000240)={&(0x7f0000000140)={0x10, 0x0, 0x0, 0x10000}, 0xc, &(0x7f0000000200)={&(0x7f00000001c0)={0x24, r1, 0x800, 0x70bd27, 0x25dfdbfd, {}, [@MPTCP_PM_ATTR_RCV_ADD_ADDRS={0x8, 0x2, 0x8}, @MPTCP_PM_ATTR_RCV_ADD_ADDRS={0x8, 0x2, 0x6}]}, 0x24}, 0x1, 0x0, 0x0, 0x2400c096}, 0x80) sendmsg$MPTCP_PM_CMD_FLUSH_ADDRS(0xffffffffffffffff, &(0x7f00000003c0)={&(0x7f0000000280)={0x10, 0x0, 0x0, 0x40}, 0xc, &(0x7f0000000380)={&(0x7f00000002c0)={0xa4, r1, 0x200, 0x70bd25, 0x25dfdbff, {}, [@MPTCP_PM_ATTR_RCV_ADD_ADDRS={0x8, 0x2, 0x3}, @MPTCP_PM_ATTR_ADDR={0x30, 0x1, 0x0, 0x1, [@MPTCP_PM_ADDR_ATTR_ADDR6={0x14, 0x4, @initdev={0xfe, 0x88, '\x00', 0x0, 0x0}}, @MPTCP_PM_ADDR_ATTR_ADDR4={0x8, 0x3, @local}, @MPTCP_PM_ADDR_ATTR_FLAGS={0x8, 0x6, 0x2}, @MPTCP_PM_ADDR_ATTR_FAMILY={0x6, 0x1, 0xa}]}, @MPTCP_PM_ATTR_ADDR={0x2c, 0x1, 0x0, 0x1, [@MPTCP_PM_ADDR_ATTR_ID={0x5, 0x2, 0x81}, @MPTCP_PM_ADDR_ATTR_PORT={0x6, 0x5, 0x4e22}, @MPTCP_PM_ADDR_ATTR_FAMILY={0x6, 0x1, 0xa}, @MPTCP_PM_ADDR_ATTR_FLAGS={0x8}, @MPTCP_PM_ADDR_ATTR_ID={0x5, 0x2, 0x40}]}, @MPTCP_PM_ATTR_SUBFLOWS={0x8, 0x3, 0x5}, @MPTCP_PM_ATTR_SUBFLOWS={0x8, 0x3, 0x5}, @MPTCP_PM_ATTR_ADDR={0x14, 0x1, 0x0, 0x1, [@MPTCP_PM_ADDR_ATTR_PORT={0x6, 0x5, 0x4e23}, @MPTCP_PM_ADDR_ATTR_PORT={0x6, 0x5, 0x4e21}]}, @MPTCP_PM_ATTR_SUBFLOWS={0x8, 0x3, 0x2}]}, 0xa4}, 0x1, 0x0, 0x0, 0x40}, 0x90) r2 = syz_open_dev$sg(&(0x7f0000000400), 0x4, 0x38040) ioctl$SCSI_IOCTL_DOORUNLOCK(r2, 0x5381) r3 = accept$packet(0xffffffffffffffff, &(0x7f0000000440), &(0x7f0000000480)=0x14) syz_io_uring_submit(0x0, r0, &(0x7f00000004c0)=@IORING_OP_ASYNC_CANCEL={0xe, 0x1, 0x0, 0x0, 0x0, 0x23456}, 0x5) accept4$packet(r3, &(0x7f0000000500), &(0x7f0000000540)=0x14, 0x800) r4 = openat$vcsa(0xffffffffffffff9c, &(0x7f0000000580), 0x121080, 0x0) ioctl$SG_SET_FORCE_PACK_ID(r4, 0x227b, &(0x7f00000005c0)) sendmsg$MPTCP_PM_CMD_GET_ADDR(r4, &(0x7f0000000740)={&(0x7f0000000600)={0x10, 0x0, 0x0, 0x40000000}, 0xc, &(0x7f0000000700)={&(0x7f0000000640)={0xa8, r1, 0x4, 0x70bd2a, 0x25dfdbfe, {}, [@MPTCP_PM_ATTR_ADDR={0x44, 0x1, 0x0, 0x1, [@MPTCP_PM_ADDR_ATTR_ID={0x5, 0x2, 0x6}, @MPTCP_PM_ADDR_ATTR_ID={0x5, 0x2, 0x2}, @MPTCP_PM_ADDR_ATTR_ADDR6={0x14, 0x4, @dev={0xfe, 0x80, '\x00', 0x17}}, @MPTCP_PM_ADDR_ATTR_ADDR6={0x14, 0x4, @remote}, @MPTCP_PM_ADDR_ATTR_FLAGS={0x8, 0x6, 0x2}]}, @MPTCP_PM_ATTR_SUBFLOWS={0x8, 0x3, 0x7}, @MPTCP_PM_ATTR_ADDR={0x14, 0x1, 0x0, 0x1, [@MPTCP_PM_ADDR_ATTR_FAMILY={0x6, 0x1, 0x2}, @MPTCP_PM_ADDR_ATTR_FAMILY={0x6, 0x1, 0x2}]}, @MPTCP_PM_ATTR_RCV_ADD_ADDRS={0x8, 0x2, 0x3}, @MPTCP_PM_ATTR_RCV_ADD_ADDRS={0x8, 0x2, 0x6}, @MPTCP_PM_ATTR_RCV_ADD_ADDRS={0x8, 0x2, 0x1}, @MPTCP_PM_ATTR_ADDR={0xc, 0x1, 0x0, 0x1, [@MPTCP_PM_ADDR_ATTR_FLAGS={0x8, 0x6, 0x3}]}, @MPTCP_PM_ATTR_RCV_ADD_ADDRS={0x8, 0x2, 0x5}, @MPTCP_PM_ATTR_SUBFLOWS={0x8, 0x3, 0x1}]}, 0xa8}, 0x1, 0x0, 0x0, 0x804}, 0x408c1) setsockopt$inet6_tcp_TCP_QUEUE_SEQ(r4, 0x6, 0x15, &(0x7f0000000780)=0x400, 0x4) sendmsg$MPTCP_PM_CMD_FLUSH_ADDRS(r4, &(0x7f00000008c0)={&(0x7f00000007c0)={0x10, 0x0, 0x0, 0x800}, 0xc, &(0x7f0000000880)={&(0x7f0000000800)={0x44, r1, 0x200, 0x70bd25, 0x25dfdbff, {}, [@MPTCP_PM_ATTR_SUBFLOWS={0x8, 0x3, 0x4}, @MPTCP_PM_ATTR_RCV_ADD_ADDRS={0x8, 0x2, 0x5}, @MPTCP_PM_ATTR_SUBFLOWS={0x8, 0x3, 0x5}, @MPTCP_PM_ATTR_RCV_ADD_ADDRS={0x8, 0x2, 0x5}, @MPTCP_PM_ATTR_SUBFLOWS={0x8, 0x3, 0x1}, @MPTCP_PM_ATTR_RCV_ADD_ADDRS={0x8, 0x2, 0x7}]}, 0x44}, 0x1, 0x0, 0x0, 0x8006}, 0x40000) sendmsg$NLBL_UNLABEL_C_STATICLIST(0xffffffffffffffff, &(0x7f0000000a00)={&(0x7f0000000900)={0x10, 0x0, 0x0, 0x4}, 0xc, &(0x7f00000009c0)={&(0x7f0000000940)={0x6c, 0x0, 0x800, 0x70bd2c, 0x25dfdbff, {}, [@NLBL_UNLABEL_A_IPV4MASK={0x8, 0x5, @multicast1}, @NLBL_UNLABEL_A_IPV6ADDR={0x14, 0x2, @private2}, @NLBL_UNLABEL_A_SECCTX={0x27, 0x7, 'system_u:object_r:dhcpc_state_t:s0\x00'}, @NLBL_UNLABEL_A_IPV6ADDR={0x14, 0x2, @private0}]}, 0x6c}, 0x1, 0x0, 0x0, 0x90}, 0x0) ioctl$SG_SET_COMMAND_Q(r4, 0x2271, &(0x7f0000000a40)) ioctl$SG_NEXT_CMD_LEN(r4, 0x2283, &(0x7f0000000a80)=0x58) 11:40:23 executing program 3: ioctl$SG_SET_FORCE_PACK_ID(0xffffffffffffffff, 0x227b, &(0x7f0000000000)=0x1) ioctl$SG_SET_FORCE_PACK_ID(0xffffffffffffffff, 0x227b, &(0x7f0000000040)) ioctl$SG_GET_RESERVED_SIZE(0xffffffffffffffff, 0x2272, &(0x7f0000000080)) r0 = openat$vcsa(0xffffffffffffff9c, &(0x7f00000000c0), 0x4200, 0x0) ioctl$SCSI_IOCTL_SEND_COMMAND(r0, 0x1, &(0x7f0000000100)={0x17, 0x3, 0x1c00, "af36a59fb168d324fd8eaf833aeb82f60d75e8700d81d9"}) ioctl$SG_SET_TIMEOUT(r0, 0x2201, &(0x7f0000000140)=0x4) ioctl$SG_GET_VERSION_NUM(r0, 0x2282, &(0x7f0000000180)) ioctl$SG_GET_REQUEST_TABLE(r0, 0x2286, &(0x7f00000001c0)) ioctl$SG_GET_TIMEOUT(r0, 0x2202, 0x0) r1 = syz_open_dev$sg(&(0x7f0000000340), 0x7fff, 0x40) ioctl$SG_EMULATED_HOST(r1, 0x2203, &(0x7f0000000380)) r2 = openat$vcsa(0xffffffffffffff9c, &(0x7f00000003c0), 0x8103, 0x0) ioctl$SG_GET_COMMAND_Q(r2, 0x2270, &(0x7f0000000400)) r3 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$inet6_tcp_TCP_CONGESTION(r3, 0x6, 0xd, &(0x7f0000000440)='scalable\x00', 0x9) ioctl$SCSI_IOCTL_GET_IDLUN(r2, 0x5382, &(0x7f0000000480)) ioctl$SECCOMP_IOCTL_NOTIF_ADDFD(r2, 0x40182103, &(0x7f00000004c0)={0x0, 0x0, r0, 0x7}) ioctl$sock_ipv6_tunnel_SIOCDELTUNNEL(r0, 0x89f2, &(0x7f0000000580)={'ip6_vti0\x00', &(0x7f0000000500)={'ip6tnl0\x00', 0x0, 0x29, 0x4, 0x3f, 0x4, 0x2a, @dev={0xfe, 0x80, '\x00', 0x43}, @dev={0xfe, 0x80, '\x00', 0x17}, 0x1, 0x8, 0x27f, 0x401}}) ioctl$SG_IO(r2, 0x2285, &(0x7f0000002700)={0x53, 0xfffffffffffffffe, 0x39, 0xff, @scatter={0x2, 0x0, &(0x7f0000001640)=[{&(0x7f00000005c0)=""/81, 0x51}, {&(0x7f0000000640)=""/4096, 0x1000}]}, &(0x7f0000001680)="66d8d4ce99afb99683a288d8dc8d4ce2e2cffbe86bec5cc6d5612637f1ff758e1b371dc9a2f86a424b4795e1059aa6604bf3c27f2f56f25c66", &(0x7f00000016c0)=""/4096, 0xff, 0x10000, 0x2, &(0x7f00000026c0)}) ioctl$SNAPSHOT_PREF_IMAGE_SIZE(r0, 0x3312, 0x8) 11:40:23 executing program 6: ioprio_set$uid(0x0, 0xee01, 0x4004) syz_mount_image$msdos(&(0x7f0000000000), &(0x7f0000000040)='./file0\x00', 0x200, 0x1, &(0x7f00000000c0)=[{&(0x7f0000000080)="7c74c7bc99e778a0c971e6f50fbdd2b70fa0b038d18c7d5ac685833434d89dce684239293aa5d8b6f11bc5c4a033ad1dc68319fad36a1101aad751fd6f4f10", 0x3f, 0x7f}], 0x42000, &(0x7f0000000100)={[{@dots}], [{@obj_user}, {@dont_appraise}, {@uid_lt}, {@hash}, {@seclabel}]}) getsockopt$inet6_IPV6_XFRM_POLICY(0xffffffffffffffff, 0x29, 0x23, &(0x7f0000000240)={{{@in=@loopback, @in6=@empty, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, {{@in6=@local}, 0x0, @in6=@mcast1}}, &(0x7f0000000340)=0xe8) mount$9p_xen(&(0x7f0000000180), &(0x7f00000001c0)='./file0\x00', &(0x7f0000000200), 0x1121061, &(0x7f0000000380)={'trans=xen,', {[{@msize={'msize', 0x3d, 0xf6b3}}, {@debug={'debug', 0x3d, 0x7ff}}, {@posixacl}, {@aname={'aname', 0x3d, '*$-&'}}, {@uname={'uname', 0x3d, 'msdos\x00'}}], [{@seclabel}, {@euid_eq={'euid', 0x3d, r1}}, {@permit_directio}, {@appraise_type}]}}) r2 = syz_io_uring_setup(0x1d4a, &(0x7f0000000440)={0x0, 0xfa85, 0x0, 0x0, 0x285}, &(0x7f0000ffd000/0x1000)=nil, &(0x7f0000ffd000/0x2000)=nil, &(0x7f00000004c0)=0x0, &(0x7f0000000500)) syz_io_uring_setup(0x3e5e, &(0x7f0000000540)={0x0, 0x5c61, 0x8, 0x2, 0x72}, &(0x7f0000ffd000/0x3000)=nil, &(0x7f0000ffc000/0x3000)=nil, &(0x7f00000005c0), &(0x7f0000000600)=0x0) syz_io_uring_submit(r3, r4, &(0x7f0000000740)=@IORING_OP_READ=@pass_buffer={0x16, 0x1, 0x2004, @fd_index=0xa, 0x7, &(0x7f0000000640)=""/227, 0xe3, 0xc, 0x1}, 0x9) ioctl$SECCOMP_IOCTL_NOTIF_ADDFD(0xffffffffffffffff, 0x40182103, &(0x7f0000000780)={0x0, 0x4, r2, 0x9, 0x80000}) openat$cgroup_devices(0xffffffffffffffff, &(0x7f00000007c0)='devices.allow\x00', 0x2, 0x0) syz_mount_image$nfs4(&(0x7f0000000800), &(0x7f0000000840)='./file0/file0\x00', 0xffffffffffffff01, 0x1, &(0x7f0000000900)=[{&(0x7f0000000880)="f19bd7cfef39dd2070dcb194f7bd90ce305e2a9644b9fb91cc1e75bca69ed6bbdd7636452963af395ea61189cce718ef43420310b6ff8db9f4a606d67217b1aa7bf6e1435682323aef92ef40d036c48fa3fc363c6ad63229bb37cd76a6db9879a39f", 0x62, 0x6}], 0x8400, &(0x7f0000000940)={[{'*+\\['}]}) r5 = accept(0xffffffffffffffff, 0x0, &(0x7f0000000980)) sendmsg$MPTCP_PM_CMD_GET_LIMITS(r5, &(0x7f0000000ac0)={&(0x7f00000009c0)={0x10, 0x0, 0x0, 0x200}, 0xc, &(0x7f0000000a80)={&(0x7f0000000a00)={0x74, 0x0, 0x200, 0x70bd27, 0x25dfdbfd, {}, [@MPTCP_PM_ATTR_RCV_ADD_ADDRS={0x8, 0x2, 0x8}, @MPTCP_PM_ATTR_RCV_ADD_ADDRS={0x8, 0x2, 0x2}, @MPTCP_PM_ATTR_SUBFLOWS={0x8, 0x3, 0x6}, @MPTCP_PM_ATTR_ADDR={0x3c, 0x1, 0x0, 0x1, [@MPTCP_PM_ADDR_ATTR_PORT={0x6, 0x5, 0x4e20}, @MPTCP_PM_ADDR_ATTR_ID={0x5, 0x2, 0x5}, @MPTCP_PM_ADDR_ATTR_FLAGS={0x8, 0x6, 0x3}, @MPTCP_PM_ADDR_ATTR_PORT={0x6, 0x5, 0x4e23}, @MPTCP_PM_ADDR_ATTR_FAMILY={0x6}, @MPTCP_PM_ADDR_ATTR_FAMILY={0x6, 0x1, 0xa}, @MPTCP_PM_ADDR_ATTR_FAMILY={0x6, 0x1, 0xa}]}, @MPTCP_PM_ATTR_ADDR={0x4}, @MPTCP_PM_ATTR_SUBFLOWS={0x8}]}, 0x74}, 0x1, 0x0, 0x0, 0x11}, 0x80) sendmsg$IEEE802154_LLSEC_DEL_SECLEVEL(0xffffffffffffffff, &(0x7f0000000bc0)={&(0x7f0000000b00)={0x10, 0x0, 0x0, 0x800000}, 0xc, &(0x7f0000000b80)={&(0x7f0000000b40)={0x2c, 0x0, 0x800, 0x70bd27, 0x25dfdbff, {}, [@IEEE802154_ATTR_DEV_INDEX={0x8}, @IEEE802154_ATTR_LLSEC_FRAME_TYPE={0x5, 0x33, 0x81}, @IEEE802154_ATTR_DEV_INDEX={0x8}]}, 0x2c}, 0x1, 0x0, 0x0, 0x4}, 0x2) socketpair(0x15, 0x1, 0x10001, &(0x7f0000000c00)={0xffffffffffffffff, 0xffffffffffffffff}) sendmsg$BATADV_CMD_TP_METER_CANCEL(r6, &(0x7f0000000d00)={&(0x7f0000000c40)={0x10, 0x0, 0x0, 0x8}, 0xc, &(0x7f0000000cc0)={&(0x7f0000000c80)={0x3c, 0x0, 0x1, 0x70bd2b, 0x25dfdbfc, {}, [@BATADV_ATTR_GW_BANDWIDTH_DOWN={0x8, 0x31, 0x4}, @BATADV_ATTR_ORIG_INTERVAL={0x8, 0x39, 0x5}, @BATADV_ATTR_ISOLATION_MASK={0x8, 0x2c, 0x80000}, @BATADV_ATTR_ISOLATION_MASK={0x8, 0x2c, 0x9}, @BATADV_ATTR_GW_MODE={0x5, 0x33, 0x1}]}, 0x3c}, 0x1, 0x0, 0x0, 0x4080}, 0x40000) socketpair(0xf, 0x6, 0x2, &(0x7f0000000d40)={0xffffffffffffffff}) r9 = accept(r7, &(0x7f0000000d80)=@ax25={{0x3, @default}, [@netrom, @rose, @netrom, @bcast, @bcast, @rose, @default, @bcast]}, &(0x7f0000000e00)=0x80) accept4$packet(r8, &(0x7f0000000e80)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @link_local}, &(0x7f0000000ec0)=0x14, 0x80000) sendmsg$MPTCP_PM_CMD_GET_ADDR(r9, &(0x7f0000001000)={&(0x7f0000000e40)={0x10, 0x0, 0x0, 0x2000}, 0xc, &(0x7f0000000fc0)={&(0x7f0000000f00)={0xb8, 0x0, 0x8, 0x70bd2c, 0x25dfdbfe, {}, [@MPTCP_PM_ATTR_ADDR={0x1c, 0x1, 0x0, 0x1, [@MPTCP_PM_ADDR_ATTR_ID={0x5, 0x2, 0x4}, @MPTCP_PM_ADDR_ATTR_IF_IDX={0x8, 0x7, r10}, @MPTCP_PM_ADDR_ATTR_IF_IDX={0x8, 0x7, r0}]}, @MPTCP_PM_ATTR_ADDR={0x4}, @MPTCP_PM_ATTR_RCV_ADD_ADDRS={0x8, 0x2, 0x2}, @MPTCP_PM_ATTR_ADDR={0x14, 0x1, 0x0, 0x1, [@MPTCP_PM_ADDR_ATTR_FAMILY={0x6, 0x1, 0x2}, @MPTCP_PM_ADDR_ATTR_ID={0x5, 0x2, 0x5}]}, @MPTCP_PM_ATTR_ADDR={0xc, 0x1, 0x0, 0x1, [@MPTCP_PM_ADDR_ATTR_ADDR4={0x8, 0x3, @private=0xa010101}]}, @MPTCP_PM_ATTR_ADDR={0x54, 0x1, 0x0, 0x1, [@MPTCP_PM_ADDR_ATTR_ADDR6={0x14, 0x4, @private0={0xfc, 0x0, '\x00', 0x1}}, @MPTCP_PM_ADDR_ATTR_IF_IDX={0x8, 0x7, r0}, @MPTCP_PM_ADDR_ATTR_FLAGS={0x8, 0x6, 0x4}, @MPTCP_PM_ADDR_ATTR_PORT={0x6, 0x5, 0x4e22}, @MPTCP_PM_ADDR_ATTR_ADDR6={0x14, 0x4, @mcast2}, @MPTCP_PM_ADDR_ATTR_ID={0x5, 0x2, 0x1}, @MPTCP_PM_ADDR_ATTR_FLAGS={0x8, 0x6, 0x6}]}, @MPTCP_PM_ATTR_RCV_ADD_ADDRS={0x8, 0x2, 0x6}]}, 0xb8}, 0x1, 0x0, 0x0, 0x80}, 0x40) mount$9p_rdma(&(0x7f0000001040), &(0x7f0000001080)='./file0\x00', &(0x7f00000010c0), 0xa00800, &(0x7f0000001100)={'trans=rdma,', {'port', 0x3d, 0x4e20}, 0x2c, {[{@common=@aname={'aname', 0x3d, 'permit_directio'}}, {@sq={'sq', 0x3d, 0xffff}}], [{@fscontext={'fscontext', 0x3d, 'staff_u'}}]}}) 11:40:23 executing program 7: r0 = syz_open_dev$sg(&(0x7f0000000000), 0x1, 0x10000) ioctl$SG_GET_PACK_ID(r0, 0x227c, &(0x7f0000000040)) ioctl$SCSI_IOCTL_DOORLOCK(r0, 0x5380) ioctl$SG_SET_KEEP_ORPHAN(r0, 0x2287, &(0x7f0000000080)=0x7) ioctl$SCSI_IOCTL_BENCHMARK_COMMAND(r0, 0x3) ioctl$SCSI_IOCTL_SYNC(r0, 0x4) ioctl$SG_SET_DEBUG(r0, 0x227e, &(0x7f00000000c0)=0x1) setsockopt$packet_add_memb(0xffffffffffffffff, 0x107, 0x1, &(0x7f0000000100)={0x0, 0x1, 0x6}, 0x10) ioctl$SG_NEXT_CMD_LEN(r0, 0x2283, &(0x7f0000000140)=0x74) ioctl$SG_GET_VERSION_NUM(r0, 0x2282, &(0x7f0000000180)) socketpair(0x1f, 0x1, 0x5, &(0x7f00000001c0)={0xffffffffffffffff, 0xffffffffffffffff}) syz_genetlink_get_family_id$batadv(&(0x7f0000000200), r2) ioctl$SCSI_IOCTL_STOP_UNIT(r0, 0x6) ioctl$sock_SIOCADDRT(r1, 0x890b, &(0x7f0000000280)={0x0, @nfc={0x27, 0x0, 0x1, 0x6}, @isdn={0x22, 0x50, 0x5, 0x7, 0x5}, @sco, 0x3, 0x0, 0x0, 0x0, 0x1, &(0x7f0000000240)='virt_wifi0\x00', 0x7fffffff, 0x7f28, 0x4}) ioctl$SG_EMULATED_HOST(0xffffffffffffffff, 0x2203, &(0x7f0000000300)) ioctl$SG_GET_PACK_ID(r0, 0x227c, &(0x7f0000000340)) r3 = accept4$packet(r1, 0x0, &(0x7f0000000380), 0x80400) setsockopt$packet_add_memb(r3, 0x107, 0x1, &(0x7f00000003c0)={0x0, 0x1, 0x6, @remote}, 0x10) ioctl$SG_SET_RESERVED_SIZE(r0, 0x2275, &(0x7f0000000400)=0x6) openat$vcsa(0xffffffffffffff9c, &(0x7f0000000440), 0x10480, 0x0) 11:40:23 executing program 4: setsockopt$inet_tcp_TCP_QUEUE_SEQ(0xffffffffffffffff, 0x6, 0x15, &(0x7f0000000000), 0x4) r0 = openat$vcsa(0xffffffffffffff9c, &(0x7f0000000040), 0x81, 0x0) setsockopt$packet_tx_ring(r0, 0x107, 0xd, &(0x7f0000000080)=@req={0x4, 0xffffffff, 0xd5, 0x5}, 0x10) setsockopt$inet_tcp_TCP_REPAIR_WINDOW(r0, 0x6, 0x1d, &(0x7f00000000c0)={0xfffffff9, 0x1, 0x7fffffff, 0x6, 0x1}, 0x14) ioctl$SCSI_IOCTL_SYNC(r0, 0x4) r1 = accept(r0, &(0x7f0000000100)=@rc={0x1f, @fixed}, &(0x7f0000000180)=0x80) setsockopt$inet_tcp_TCP_FASTOPEN_KEY(r1, 0x6, 0x21, &(0x7f00000001c0)="2a6eddb47c1ebcb5002df4f95b6a3218", 0x10) socket$inet_tcp(0x2, 0x1, 0x0) ioctl$SG_GET_VERSION_NUM(r0, 0x2282, &(0x7f0000000200)) ioctl$SCSI_IOCTL_STOP_UNIT(r0, 0x6) ioctl$sock_SIOCADDRT(r1, 0x890b, &(0x7f0000000280)={0x0, @ax25={0x3, @remote={0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0x1}, 0x3}, @can={0x1d, 0x0}, @l2={0x1f, 0x20, @any, 0x81}, 0x81, 0x0, 0x0, 0x0, 0x3, &(0x7f0000000240)='veth1_to_bond\x00', 0x1, 0x9, 0x81}) sendto$packet(r0, &(0x7f0000000300)="ef239bcbf699ea49248d932bd7a123b6dc9273af2c6c1771bbfca4377cfca4cfc8d7a0ed5b9cec2ccbbb66f69d40c744edd53168a1bdf7d412632799b3df3b80bb5e766fd2e2b373e553a501f4d1997e0a3d387642b483dca2a2bee261552bc0ec0162efa75aa5e9f1a18f050fc5d5fbaa7dceca8e90ed87643278338e74fb16fecf749ace8174d85c2b85721c1097077921541caaf6d322510105ad87d2a427ffd1689b31d399985823b2bb0abd928963c7", 0xb2, 0x4004, &(0x7f00000003c0)={0x11, 0x16, r2, 0x1, 0x6, 0x6, @local}, 0x14) r3 = syz_genetlink_get_family_id$netlbl_mgmt(&(0x7f0000000440), 0xffffffffffffffff) sendmsg$NLBL_MGMT_C_PROTOCOLS(0xffffffffffffffff, &(0x7f0000000500)={&(0x7f0000000400)={0x10, 0x0, 0x0, 0x8}, 0xc, &(0x7f00000004c0)={&(0x7f0000000480)={0x1c, r3, 0x20, 0x70bd25, 0x25dfdbfe, {}, [@NLBL_MGMT_A_CLPDOI={0x8}]}, 0x1c}, 0x1, 0x0, 0x0, 0x4084}, 0x80) r4 = syz_genetlink_get_family_id$netlbl_mgmt(&(0x7f0000000580), 0xffffffffffffffff) sendmsg$NLBL_MGMT_C_VERSION(0xffffffffffffffff, &(0x7f0000000680)={&(0x7f0000000540)={0x10, 0x0, 0x0, 0x8000205}, 0xc, &(0x7f0000000640)={&(0x7f00000005c0)={0x5c, r4, 0x8, 0x1ff, 0x25dfdbfe, {}, [@NLBL_MGMT_A_DOMAIN={0xe, 0x1, 'NLBL_MGMT\x00'}, @NLBL_MGMT_A_IPV6ADDR={0x14, 0x5, @local}, @NLBL_MGMT_A_DOMAIN={0x8, 0x1, '@@,\x00'}, @NLBL_MGMT_A_IPV6ADDR={0x14, 0x5, @loopback}, @NLBL_MGMT_A_IPV4ADDR={0x8, 0x7, @private=0xa010102}]}, 0x5c}, 0x1, 0x0, 0x0, 0x24000810}, 0x8400) ioctl$ifreq_SIOCGIFINDEX_batadv_hard(r0, 0x8933, &(0x7f00000006c0)={'batadv_slave_1\x00'}) r5 = syz_genetlink_get_family_id$netlbl_mgmt(&(0x7f0000000740), 0xffffffffffffffff) sendmsg$NLBL_MGMT_C_REMOVEDEF(0xffffffffffffffff, &(0x7f0000000840)={&(0x7f0000000700)={0x10, 0x0, 0x0, 0x8}, 0xc, &(0x7f0000000800)={&(0x7f0000000780)={0x60, r5, 0x100, 0x70bd2c, 0x25dfdbfc, {}, [@NLBL_MGMT_A_IPV6ADDR={0x14, 0x5, @loopback}, @NLBL_MGMT_A_FAMILY={0x6, 0xb, 0x29}, @NLBL_MGMT_A_IPV4ADDR={0x8, 0x7, @multicast1}, @NLBL_MGMT_A_IPV6ADDR={0x14, 0x5, @remote}, @NLBL_MGMT_A_IPV6MASK={0x14, 0x6, @mcast1}]}, 0x60}, 0x1, 0x0, 0x0, 0x11}, 0x80c1) ioctl$sock_inet_tcp_SIOCINQ(0xffffffffffffffff, 0x541b, &(0x7f0000000a80)) 11:40:23 executing program 2: clock_nanosleep(0x7, 0x0, &(0x7f0000000000)={0x77359400}, &(0x7f0000000040)) getsockopt$inet6_IPV6_XFRM_POLICY(0xffffffffffffffff, 0x29, 0x23, &(0x7f0000000080)={{{@in6, @in6=@remote, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, {{@in6=@dev}, 0x0, @in=@initdev}}, &(0x7f0000000180)=0xe8) setsockopt$packet_add_memb(0xffffffffffffffff, 0x107, 0x1, &(0x7f00000001c0)={r0, 0x1, 0x6, @broadcast}, 0x10) getpeername$packet(0xffffffffffffffff, &(0x7f0000000200)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @dev}, &(0x7f0000000240)=0x14) recvmsg(0xffffffffffffffff, &(0x7f00000027c0)={&(0x7f0000000280)=@xdp={0x2c, 0x0, 0x0}, 0x80, &(0x7f0000002640)=[{&(0x7f0000000300)=""/227, 0xe3}, {&(0x7f0000000400)=""/4096, 0x1000}, {&(0x7f0000001400)=""/92, 0x5c}, {&(0x7f0000001480)=""/93, 0x5d}, {&(0x7f0000001500)=""/4096, 0x1000}, {&(0x7f0000002500)=""/87, 0x57}, {&(0x7f0000002580)=""/189, 0xbd}], 0x7, &(0x7f00000026c0)=""/199, 0xc7}, 0x140) bind$packet(0xffffffffffffffff, &(0x7f0000002800)={0x11, 0x1b, r2, 0x1, 0x5}, 0x14) getresgid(&(0x7f0000002840), &(0x7f0000002880), &(0x7f00000028c0)) r3 = accept4$packet(0xffffffffffffffff, &(0x7f0000002900)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @multicast}, &(0x7f0000002940)=0x14, 0x80000) recvfrom$packet(r3, &(0x7f0000002980)=""/4096, 0x1000, 0x0, &(0x7f0000003980)={0x11, 0x17, r2, 0x1, 0x5, 0x6, @multicast}, 0x14) r4 = socket$inet6_udp(0xa, 0x2, 0x0) getsockopt$inet6_IPV6_XFRM_POLICY(r4, 0x29, 0x23, &(0x7f00000039c0)={{{@in6=@ipv4, @in6=@private0}}, {{@in=@private}, 0x0, @in6=@remote}}, &(0x7f0000003ac0)=0xe8) r5 = openat$sr(0xffffffffffffff9c, &(0x7f0000003b00), 0x200000, 0x0) recvfrom$packet(r5, &(0x7f0000003b40)=""/161, 0xa1, 0x140, &(0x7f0000003c00)={0x11, 0x2, r1, 0x1, 0x9a, 0x6, @local}, 0x14) r6 = openat$vcsa(0xffffffffffffff9c, &(0x7f0000003c40), 0x500, 0x0) write$bt_hci(r6, &(0x7f0000003c80)={0x1, @write_current_iac_lap={{0xc3a, 0x7}, {0x6, "30a9a39c10c4"}}}, 0xb) prctl$PR_SET_MM_MAP_SIZE(0x23, 0xf, &(0x7f0000003cc0)) accept4$packet(r6, &(0x7f00000053c0)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @local}, &(0x7f0000005400)=0x14, 0x80000) bind$packet(r3, &(0x7f0000005440)={0x11, 0x1b, r7, 0x1, 0x8, 0x6, @local}, 0x14) openat$sr(0xffffffffffffff9c, &(0x7f0000005480), 0x428802, 0x0) sendmsg$MPTCP_PM_CMD_FLUSH_ADDRS(r6, &(0x7f00000055c0)={&(0x7f00000054c0)={0x10, 0x0, 0x0, 0x4}, 0xc, &(0x7f0000005580)={&(0x7f0000005540)={0x30, 0x0, 0x4, 0x70bd2b, 0x25dfdbfd, {}, [@MPTCP_PM_ATTR_SUBFLOWS={0x8, 0x3, 0x8}, @MPTCP_PM_ATTR_SUBFLOWS={0x8, 0x3, 0x4}, @MPTCP_PM_ATTR_ADDR={0xc, 0x1, 0x0, 0x1, [@MPTCP_PM_ADDR_ATTR_IF_IDX={0x8, 0x7, r7}]}]}, 0x30}, 0x1, 0x0, 0x0, 0x4004084}, 0x4040080) [ 116.171736] loop6: detected capacity change from 0 to 1 [ 116.212837] loop6: detected capacity change from 0 to 264192 [ 116.228517] nfs4: Unknown parameter '*+\[' 11:40:23 executing program 0: r0 = openat$vcsa(0xffffffffffffff9c, &(0x7f0000000000), 0x40000, 0x0) ioctl$SG_GET_PACK_ID(r0, 0x227c, &(0x7f0000000040)) r1 = openat$sr(0xffffffffffffff9c, &(0x7f0000000080), 0x454082, 0x0) ioctl$SG_SET_DEBUG(r1, 0x227e, &(0x7f00000000c0)=0x1) r2 = syz_open_dev$sg(&(0x7f0000000100), 0x8, 0x280102) ioctl$SG_GET_RESERVED_SIZE(r2, 0x2272, &(0x7f0000000140)) ioctl$SG_GET_REQUEST_TABLE(r1, 0x2286, &(0x7f0000000180)) r3 = syz_open_dev$sg(&(0x7f0000000300), 0x100000000, 0x408903) ioctl$SG_SET_RESERVED_SIZE(r3, 0x2275, &(0x7f0000000340)=0x80000000) ioctl$SG_GET_KEEP_ORPHAN(0xffffffffffffffff, 0x2288, &(0x7f0000000380)) ioctl$SG_GET_PACK_ID(r1, 0x227c, &(0x7f00000003c0)) ioctl$SG_SET_RESERVED_SIZE(r2, 0x2275, &(0x7f0000000400)=0x4cbd) ioctl$SG_EMULATED_HOST(0xffffffffffffffff, 0x2203, &(0x7f0000000440)) shmctl$IPC_STAT(0xffffffffffffffff, 0x2, &(0x7f0000000480)=""/83) ioctl$SCSI_IOCTL_PROBE_HOST(r0, 0x5385, &(0x7f0000000500)={0x1d, ""/29}) r4 = syz_open_dev$sg(&(0x7f0000000540), 0x8, 0x8100) ioctl$SG_GET_RESERVED_SIZE(r4, 0x2272, &(0x7f0000000580)) ioctl$SG_GET_KEEP_ORPHAN(0xffffffffffffffff, 0x2288, &(0x7f00000005c0)) ioctl$SG_SET_DEBUG(r3, 0x227e, &(0x7f0000000600)=0x1) sendmsg$MPTCP_PM_CMD_DEL_ADDR(r1, &(0x7f0000000740)={&(0x7f0000000640)={0x10, 0x0, 0x0, 0x40}, 0xc, &(0x7f0000000700)={&(0x7f0000000680)={0x64, 0x0, 0x10, 0x70bd2c, 0x25dfdbff, {}, [@MPTCP_PM_ATTR_RCV_ADD_ADDRS={0x8, 0x2, 0x1}, @MPTCP_PM_ATTR_ADDR={0x4}, @MPTCP_PM_ATTR_ADDR={0x24, 0x1, 0x0, 0x1, [@MPTCP_PM_ADDR_ATTR_IF_IDX={0x8}, @MPTCP_PM_ADDR_ATTR_PORT={0x6, 0x5, 0x4e24}, @MPTCP_PM_ADDR_ATTR_IF_IDX={0x8}, @MPTCP_PM_ADDR_ATTR_PORT={0x6, 0x5, 0x4e22}]}, @MPTCP_PM_ATTR_SUBFLOWS={0x8, 0x3, 0x3}, @MPTCP_PM_ATTR_SUBFLOWS={0x8, 0x3, 0x7}, @MPTCP_PM_ATTR_RCV_ADD_ADDRS={0x8, 0x2, 0x6}, @MPTCP_PM_ATTR_RCV_ADD_ADDRS={0x8, 0x2, 0x2}]}, 0x64}, 0x1, 0x0, 0x0, 0x4008010}, 0x4800) 11:40:23 executing program 4: setsockopt$inet_tcp_TCP_QUEUE_SEQ(0xffffffffffffffff, 0x6, 0x15, &(0x7f0000000000), 0x4) r0 = openat$vcsa(0xffffffffffffff9c, &(0x7f0000000040), 0x81, 0x0) setsockopt$packet_tx_ring(r0, 0x107, 0xd, &(0x7f0000000080)=@req={0x4, 0xffffffff, 0xd5, 0x5}, 0x10) setsockopt$inet_tcp_TCP_REPAIR_WINDOW(r0, 0x6, 0x1d, &(0x7f00000000c0)={0xfffffff9, 0x1, 0x7fffffff, 0x6, 0x1}, 0x14) ioctl$SCSI_IOCTL_SYNC(r0, 0x4) r1 = accept(r0, &(0x7f0000000100)=@rc={0x1f, @fixed}, &(0x7f0000000180)=0x80) setsockopt$inet_tcp_TCP_FASTOPEN_KEY(r1, 0x6, 0x21, &(0x7f00000001c0)="2a6eddb47c1ebcb5002df4f95b6a3218", 0x10) socket$inet_tcp(0x2, 0x1, 0x0) ioctl$SG_GET_VERSION_NUM(r0, 0x2282, &(0x7f0000000200)) ioctl$SCSI_IOCTL_STOP_UNIT(r0, 0x6) ioctl$sock_SIOCADDRT(r1, 0x890b, &(0x7f0000000280)={0x0, @ax25={0x3, @remote={0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0x1}, 0x3}, @can={0x1d, 0x0}, @l2={0x1f, 0x20, @any, 0x81}, 0x81, 0x0, 0x0, 0x0, 0x3, &(0x7f0000000240)='veth1_to_bond\x00', 0x1, 0x9, 0x81}) sendto$packet(r0, &(0x7f0000000300)="ef239bcbf699ea49248d932bd7a123b6dc9273af2c6c1771bbfca4377cfca4cfc8d7a0ed5b9cec2ccbbb66f69d40c744edd53168a1bdf7d412632799b3df3b80bb5e766fd2e2b373e553a501f4d1997e0a3d387642b483dca2a2bee261552bc0ec0162efa75aa5e9f1a18f050fc5d5fbaa7dceca8e90ed87643278338e74fb16fecf749ace8174d85c2b85721c1097077921541caaf6d322510105ad87d2a427ffd1689b31d399985823b2bb0abd928963c7", 0xb2, 0x4004, &(0x7f00000003c0)={0x11, 0x16, r2, 0x1, 0x6, 0x6, @local}, 0x14) r3 = syz_genetlink_get_family_id$netlbl_mgmt(&(0x7f0000000440), 0xffffffffffffffff) sendmsg$NLBL_MGMT_C_PROTOCOLS(0xffffffffffffffff, &(0x7f0000000500)={&(0x7f0000000400)={0x10, 0x0, 0x0, 0x8}, 0xc, &(0x7f00000004c0)={&(0x7f0000000480)={0x1c, r3, 0x20, 0x70bd25, 0x25dfdbfe, {}, [@NLBL_MGMT_A_CLPDOI={0x8}]}, 0x1c}, 0x1, 0x0, 0x0, 0x4084}, 0x80) r4 = syz_genetlink_get_family_id$netlbl_mgmt(&(0x7f0000000580), 0xffffffffffffffff) sendmsg$NLBL_MGMT_C_VERSION(0xffffffffffffffff, &(0x7f0000000680)={&(0x7f0000000540)={0x10, 0x0, 0x0, 0x8000205}, 0xc, &(0x7f0000000640)={&(0x7f00000005c0)={0x5c, r4, 0x8, 0x1ff, 0x25dfdbfe, {}, [@NLBL_MGMT_A_DOMAIN={0xe, 0x1, 'NLBL_MGMT\x00'}, @NLBL_MGMT_A_IPV6ADDR={0x14, 0x5, @local}, @NLBL_MGMT_A_DOMAIN={0x8, 0x1, '@@,\x00'}, @NLBL_MGMT_A_IPV6ADDR={0x14, 0x5, @loopback}, @NLBL_MGMT_A_IPV4ADDR={0x8, 0x7, @private=0xa010102}]}, 0x5c}, 0x1, 0x0, 0x0, 0x24000810}, 0x8400) ioctl$ifreq_SIOCGIFINDEX_batadv_hard(r0, 0x8933, &(0x7f00000006c0)={'batadv_slave_1\x00'}) r5 = syz_genetlink_get_family_id$netlbl_mgmt(&(0x7f0000000740), 0xffffffffffffffff) sendmsg$NLBL_MGMT_C_REMOVEDEF(0xffffffffffffffff, &(0x7f0000000840)={&(0x7f0000000700)={0x10, 0x0, 0x0, 0x8}, 0xc, &(0x7f0000000800)={&(0x7f0000000780)={0x60, r5, 0x100, 0x70bd2c, 0x25dfdbfc, {}, [@NLBL_MGMT_A_IPV6ADDR={0x14, 0x5, @loopback}, @NLBL_MGMT_A_FAMILY={0x6, 0xb, 0x29}, @NLBL_MGMT_A_IPV4ADDR={0x8, 0x7, @multicast1}, @NLBL_MGMT_A_IPV6ADDR={0x14, 0x5, @remote}, @NLBL_MGMT_A_IPV6MASK={0x14, 0x6, @mcast1}]}, 0x60}, 0x1, 0x0, 0x0, 0x11}, 0x80c1) ioctl$sock_inet_tcp_SIOCINQ(0xffffffffffffffff, 0x541b, &(0x7f0000000a80)) [ 116.353279] SELinux: security_context_str_to_sid (staff_u) failed with errno=-22 11:40:23 executing program 3: ioctl$SG_SET_FORCE_PACK_ID(0xffffffffffffffff, 0x227b, &(0x7f0000000000)=0x1) ioctl$SG_SET_FORCE_PACK_ID(0xffffffffffffffff, 0x227b, &(0x7f0000000040)) ioctl$SG_GET_RESERVED_SIZE(0xffffffffffffffff, 0x2272, &(0x7f0000000080)) r0 = openat$vcsa(0xffffffffffffff9c, &(0x7f00000000c0), 0x4200, 0x0) ioctl$SCSI_IOCTL_SEND_COMMAND(r0, 0x1, &(0x7f0000000100)={0x17, 0x3, 0x1c00, "af36a59fb168d324fd8eaf833aeb82f60d75e8700d81d9"}) ioctl$SG_SET_TIMEOUT(r0, 0x2201, &(0x7f0000000140)=0x4) ioctl$SG_GET_VERSION_NUM(r0, 0x2282, &(0x7f0000000180)) ioctl$SG_GET_REQUEST_TABLE(r0, 0x2286, &(0x7f00000001c0)) ioctl$SG_GET_TIMEOUT(r0, 0x2202, 0x0) r1 = syz_open_dev$sg(&(0x7f0000000340), 0x7fff, 0x40) ioctl$SG_EMULATED_HOST(r1, 0x2203, &(0x7f0000000380)) r2 = openat$vcsa(0xffffffffffffff9c, &(0x7f00000003c0), 0x8103, 0x0) ioctl$SG_GET_COMMAND_Q(r2, 0x2270, &(0x7f0000000400)) r3 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$inet6_tcp_TCP_CONGESTION(r3, 0x6, 0xd, &(0x7f0000000440)='scalable\x00', 0x9) ioctl$SCSI_IOCTL_GET_IDLUN(r2, 0x5382, &(0x7f0000000480)) ioctl$SECCOMP_IOCTL_NOTIF_ADDFD(r2, 0x40182103, &(0x7f00000004c0)={0x0, 0x0, r0, 0x7}) ioctl$sock_ipv6_tunnel_SIOCDELTUNNEL(r0, 0x89f2, &(0x7f0000000580)={'ip6_vti0\x00', &(0x7f0000000500)={'ip6tnl0\x00', 0x0, 0x29, 0x4, 0x3f, 0x4, 0x2a, @dev={0xfe, 0x80, '\x00', 0x43}, @dev={0xfe, 0x80, '\x00', 0x17}, 0x1, 0x8, 0x27f, 0x401}}) ioctl$SG_IO(r2, 0x2285, &(0x7f0000002700)={0x53, 0xfffffffffffffffe, 0x39, 0xff, @scatter={0x2, 0x0, &(0x7f0000001640)=[{&(0x7f00000005c0)=""/81, 0x51}, {&(0x7f0000000640)=""/4096, 0x1000}]}, &(0x7f0000001680)="66d8d4ce99afb99683a288d8dc8d4ce2e2cffbe86bec5cc6d5612637f1ff758e1b371dc9a2f86a424b4795e1059aa6604bf3c27f2f56f25c66", &(0x7f00000016c0)=""/4096, 0xff, 0x10000, 0x2, &(0x7f00000026c0)}) ioctl$SNAPSHOT_PREF_IMAGE_SIZE(r0, 0x3312, 0x8) 11:40:23 executing program 7: r0 = syz_open_dev$sg(&(0x7f0000000000), 0x1, 0x10000) ioctl$SG_GET_PACK_ID(r0, 0x227c, &(0x7f0000000040)) ioctl$SCSI_IOCTL_DOORLOCK(r0, 0x5380) ioctl$SG_SET_KEEP_ORPHAN(r0, 0x2287, &(0x7f0000000080)=0x7) ioctl$SCSI_IOCTL_BENCHMARK_COMMAND(r0, 0x3) ioctl$SCSI_IOCTL_SYNC(r0, 0x4) ioctl$SG_SET_DEBUG(r0, 0x227e, &(0x7f00000000c0)=0x1) setsockopt$packet_add_memb(0xffffffffffffffff, 0x107, 0x1, &(0x7f0000000100)={0x0, 0x1, 0x6}, 0x10) ioctl$SG_NEXT_CMD_LEN(r0, 0x2283, &(0x7f0000000140)=0x74) ioctl$SG_GET_VERSION_NUM(r0, 0x2282, &(0x7f0000000180)) socketpair(0x1f, 0x1, 0x5, &(0x7f00000001c0)={0xffffffffffffffff, 0xffffffffffffffff}) syz_genetlink_get_family_id$batadv(&(0x7f0000000200), r2) ioctl$SCSI_IOCTL_STOP_UNIT(r0, 0x6) ioctl$sock_SIOCADDRT(r1, 0x890b, &(0x7f0000000280)={0x0, @nfc={0x27, 0x0, 0x1, 0x6}, @isdn={0x22, 0x50, 0x5, 0x7, 0x5}, @sco, 0x3, 0x0, 0x0, 0x0, 0x1, &(0x7f0000000240)='virt_wifi0\x00', 0x7fffffff, 0x7f28, 0x4}) ioctl$SG_EMULATED_HOST(0xffffffffffffffff, 0x2203, &(0x7f0000000300)) ioctl$SG_GET_PACK_ID(r0, 0x227c, &(0x7f0000000340)) r3 = accept4$packet(r1, 0x0, &(0x7f0000000380), 0x80400) setsockopt$packet_add_memb(r3, 0x107, 0x1, &(0x7f00000003c0)={0x0, 0x1, 0x6, @remote}, 0x10) ioctl$SG_SET_RESERVED_SIZE(r0, 0x2275, &(0x7f0000000400)=0x6) openat$vcsa(0xffffffffffffff9c, &(0x7f0000000440), 0x10480, 0x0) 11:40:23 executing program 5: getpeername$packet(0xffffffffffffffff, &(0x7f0000000000)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @dev}, &(0x7f0000000040)=0x14) ioctl$sock_SIOCADDRT(0xffffffffffffffff, 0x890b, &(0x7f0000000080)={0x0, @phonet={0x23, 0xfe, 0x0, 0x2f}, @hci={0x1f, 0xffffffffffffffff, 0x3}, @rc={0x1f, @any, 0x2}, 0x5, 0x0, 0x0, 0x0, 0x7ff, 0x0, 0x0, 0x4, 0x4}) r0 = mmap$IORING_OFF_SQES(&(0x7f0000ffa000/0x4000)=nil, 0x4000, 0x1000004, 0x810, 0xffffffffffffffff, 0x10000000) syz_io_uring_submit(0x0, r0, &(0x7f0000000100)=@IORING_OP_MADVISE={0x19, 0x3, 0x0, 0x0, 0x0, &(0x7f0000ffa000/0x2000)=nil, 0x2000, 0xb, 0x1}, 0x8) r1 = syz_genetlink_get_family_id$mptcp(&(0x7f0000000180), 0xffffffffffffffff) sendmsg$MPTCP_PM_CMD_ADD_ADDR(0xffffffffffffffff, &(0x7f0000000240)={&(0x7f0000000140)={0x10, 0x0, 0x0, 0x10000}, 0xc, &(0x7f0000000200)={&(0x7f00000001c0)={0x24, r1, 0x800, 0x70bd27, 0x25dfdbfd, {}, [@MPTCP_PM_ATTR_RCV_ADD_ADDRS={0x8, 0x2, 0x8}, @MPTCP_PM_ATTR_RCV_ADD_ADDRS={0x8, 0x2, 0x6}]}, 0x24}, 0x1, 0x0, 0x0, 0x2400c096}, 0x80) sendmsg$MPTCP_PM_CMD_FLUSH_ADDRS(0xffffffffffffffff, &(0x7f00000003c0)={&(0x7f0000000280)={0x10, 0x0, 0x0, 0x40}, 0xc, &(0x7f0000000380)={&(0x7f00000002c0)={0xa4, r1, 0x200, 0x70bd25, 0x25dfdbff, {}, [@MPTCP_PM_ATTR_RCV_ADD_ADDRS={0x8, 0x2, 0x3}, @MPTCP_PM_ATTR_ADDR={0x30, 0x1, 0x0, 0x1, [@MPTCP_PM_ADDR_ATTR_ADDR6={0x14, 0x4, @initdev={0xfe, 0x88, '\x00', 0x0, 0x0}}, @MPTCP_PM_ADDR_ATTR_ADDR4={0x8, 0x3, @local}, @MPTCP_PM_ADDR_ATTR_FLAGS={0x8, 0x6, 0x2}, @MPTCP_PM_ADDR_ATTR_FAMILY={0x6, 0x1, 0xa}]}, @MPTCP_PM_ATTR_ADDR={0x2c, 0x1, 0x0, 0x1, [@MPTCP_PM_ADDR_ATTR_ID={0x5, 0x2, 0x81}, @MPTCP_PM_ADDR_ATTR_PORT={0x6, 0x5, 0x4e22}, @MPTCP_PM_ADDR_ATTR_FAMILY={0x6, 0x1, 0xa}, @MPTCP_PM_ADDR_ATTR_FLAGS={0x8}, @MPTCP_PM_ADDR_ATTR_ID={0x5, 0x2, 0x40}]}, @MPTCP_PM_ATTR_SUBFLOWS={0x8, 0x3, 0x5}, @MPTCP_PM_ATTR_SUBFLOWS={0x8, 0x3, 0x5}, @MPTCP_PM_ATTR_ADDR={0x14, 0x1, 0x0, 0x1, [@MPTCP_PM_ADDR_ATTR_PORT={0x6, 0x5, 0x4e23}, @MPTCP_PM_ADDR_ATTR_PORT={0x6, 0x5, 0x4e21}]}, @MPTCP_PM_ATTR_SUBFLOWS={0x8, 0x3, 0x2}]}, 0xa4}, 0x1, 0x0, 0x0, 0x40}, 0x90) r2 = syz_open_dev$sg(&(0x7f0000000400), 0x4, 0x38040) ioctl$SCSI_IOCTL_DOORUNLOCK(r2, 0x5381) r3 = accept$packet(0xffffffffffffffff, &(0x7f0000000440), &(0x7f0000000480)=0x14) syz_io_uring_submit(0x0, r0, &(0x7f00000004c0)=@IORING_OP_ASYNC_CANCEL={0xe, 0x1, 0x0, 0x0, 0x0, 0x23456}, 0x5) accept4$packet(r3, &(0x7f0000000500), &(0x7f0000000540)=0x14, 0x800) r4 = openat$vcsa(0xffffffffffffff9c, &(0x7f0000000580), 0x121080, 0x0) ioctl$SG_SET_FORCE_PACK_ID(r4, 0x227b, &(0x7f00000005c0)) sendmsg$MPTCP_PM_CMD_GET_ADDR(r4, &(0x7f0000000740)={&(0x7f0000000600)={0x10, 0x0, 0x0, 0x40000000}, 0xc, &(0x7f0000000700)={&(0x7f0000000640)={0xa8, r1, 0x4, 0x70bd2a, 0x25dfdbfe, {}, [@MPTCP_PM_ATTR_ADDR={0x44, 0x1, 0x0, 0x1, [@MPTCP_PM_ADDR_ATTR_ID={0x5, 0x2, 0x6}, @MPTCP_PM_ADDR_ATTR_ID={0x5, 0x2, 0x2}, @MPTCP_PM_ADDR_ATTR_ADDR6={0x14, 0x4, @dev={0xfe, 0x80, '\x00', 0x17}}, @MPTCP_PM_ADDR_ATTR_ADDR6={0x14, 0x4, @remote}, @MPTCP_PM_ADDR_ATTR_FLAGS={0x8, 0x6, 0x2}]}, @MPTCP_PM_ATTR_SUBFLOWS={0x8, 0x3, 0x7}, @MPTCP_PM_ATTR_ADDR={0x14, 0x1, 0x0, 0x1, [@MPTCP_PM_ADDR_ATTR_FAMILY={0x6, 0x1, 0x2}, @MPTCP_PM_ADDR_ATTR_FAMILY={0x6, 0x1, 0x2}]}, @MPTCP_PM_ATTR_RCV_ADD_ADDRS={0x8, 0x2, 0x3}, @MPTCP_PM_ATTR_RCV_ADD_ADDRS={0x8, 0x2, 0x6}, @MPTCP_PM_ATTR_RCV_ADD_ADDRS={0x8, 0x2, 0x1}, @MPTCP_PM_ATTR_ADDR={0xc, 0x1, 0x0, 0x1, [@MPTCP_PM_ADDR_ATTR_FLAGS={0x8, 0x6, 0x3}]}, @MPTCP_PM_ATTR_RCV_ADD_ADDRS={0x8, 0x2, 0x5}, @MPTCP_PM_ATTR_SUBFLOWS={0x8, 0x3, 0x1}]}, 0xa8}, 0x1, 0x0, 0x0, 0x804}, 0x408c1) setsockopt$inet6_tcp_TCP_QUEUE_SEQ(r4, 0x6, 0x15, &(0x7f0000000780)=0x400, 0x4) sendmsg$MPTCP_PM_CMD_FLUSH_ADDRS(r4, &(0x7f00000008c0)={&(0x7f00000007c0)={0x10, 0x0, 0x0, 0x800}, 0xc, &(0x7f0000000880)={&(0x7f0000000800)={0x44, r1, 0x200, 0x70bd25, 0x25dfdbff, {}, [@MPTCP_PM_ATTR_SUBFLOWS={0x8, 0x3, 0x4}, @MPTCP_PM_ATTR_RCV_ADD_ADDRS={0x8, 0x2, 0x5}, @MPTCP_PM_ATTR_SUBFLOWS={0x8, 0x3, 0x5}, @MPTCP_PM_ATTR_RCV_ADD_ADDRS={0x8, 0x2, 0x5}, @MPTCP_PM_ATTR_SUBFLOWS={0x8, 0x3, 0x1}, @MPTCP_PM_ATTR_RCV_ADD_ADDRS={0x8, 0x2, 0x7}]}, 0x44}, 0x1, 0x0, 0x0, 0x8006}, 0x40000) sendmsg$NLBL_UNLABEL_C_STATICLIST(0xffffffffffffffff, &(0x7f0000000a00)={&(0x7f0000000900)={0x10, 0x0, 0x0, 0x4}, 0xc, &(0x7f00000009c0)={&(0x7f0000000940)={0x6c, 0x0, 0x800, 0x70bd2c, 0x25dfdbff, {}, [@NLBL_UNLABEL_A_IPV4MASK={0x8, 0x5, @multicast1}, @NLBL_UNLABEL_A_IPV6ADDR={0x14, 0x2, @private2}, @NLBL_UNLABEL_A_SECCTX={0x27, 0x7, 'system_u:object_r:dhcpc_state_t:s0\x00'}, @NLBL_UNLABEL_A_IPV6ADDR={0x14, 0x2, @private0}]}, 0x6c}, 0x1, 0x0, 0x0, 0x90}, 0x0) ioctl$SG_SET_COMMAND_Q(r4, 0x2271, &(0x7f0000000a40)) ioctl$SG_NEXT_CMD_LEN(r4, 0x2283, &(0x7f0000000a80)=0x58) 11:40:23 executing program 1: r0 = shmget(0x2, 0x3000, 0x100, &(0x7f0000ffb000/0x3000)=nil) shmat(r0, &(0x7f0000ffa000/0x3000)=nil, 0x2000) shmat(r0, &(0x7f0000ffa000/0x4000)=nil, 0x3000) r1 = shmget(0x3, 0x1000, 0x100, &(0x7f0000ffd000/0x1000)=nil) r2 = syz_genetlink_get_family_id$netlbl_mgmt(&(0x7f0000000040), 0xffffffffffffffff) sendmsg$NLBL_MGMT_C_REMOVEDEF(0xffffffffffffffff, &(0x7f0000000100)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x8}, 0xc, &(0x7f00000000c0)={&(0x7f0000000080)={0x3c, r2, 0x20, 0x70bd29, 0x25dfdbff, {}, [@NLBL_MGMT_A_FAMILY={0x6, 0xb, 0x5}, @NLBL_MGMT_A_PROTOCOL={0x8, 0x2, 0x3}, @NLBL_MGMT_A_IPV4MASK={0x8, 0x8, @multicast1}, @NLBL_MGMT_A_CLPDOI={0x8}, @NLBL_MGMT_A_IPV4ADDR={0x8, 0x7, @local}]}, 0x3c}, 0x1, 0x0, 0x0, 0x4048820}, 0x40000) shmat(0xffffffffffffffff, &(0x7f0000ffb000/0x4000)=nil, 0x2000) r3 = shmget(0x0, 0xf000, 0x100, &(0x7f0000ff1000/0xf000)=nil) shmctl$IPC_RMID(r3, 0x0) r4 = mmap$IORING_OFF_SQ_RING(&(0x7f0000ffd000/0x1000)=nil, 0x1000, 0x2000006, 0x40010, 0xffffffffffffffff, 0x0) syz_io_uring_submit(r4, 0x0, &(0x7f00000001c0)=@IORING_OP_PROVIDE_BUFFERS={0x1f, 0x1, 0x0, 0x8, 0x2, &(0x7f0000000140)="10e8e6d73f8e97a04564912d4b0bee6921be05ed083e4d741dabdbce8c94949f57a5c9d9da73d0e5ad668714159e31498f181aad79547c645eefb456a7b8c4be765eb156b77cba8a752b90d7729b2c285893a10c3633d2485f48f30d247214c5e28a", 0x7, 0x0, 0x1, {0x1}}, 0x100) r5 = socket(0x2c, 0x5, 0x1) accept4$packet(0xffffffffffffffff, &(0x7f0000000280)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @random}, &(0x7f00000002c0)=0x14, 0x40000) recvfrom$packet(r5, &(0x7f0000000200)=""/108, 0x6c, 0x2000, &(0x7f0000000300)={0x11, 0x16, r6, 0x1, 0x8, 0x6, @local}, 0x14) r7 = syz_genetlink_get_family_id$netlbl_mgmt(&(0x7f0000000380), 0xffffffffffffffff) sendmsg$NLBL_MGMT_C_REMOVEDEF(0xffffffffffffffff, &(0x7f0000000440)={&(0x7f0000000340)={0x10, 0x0, 0x0, 0x4}, 0xc, &(0x7f0000000400)={&(0x7f00000003c0)={0x24, r7, 0x400, 0x70bd26, 0x25dfdbfc, {}, [@NLBL_MGMT_A_FAMILY={0x6, 0xb, 0x18}, @NLBL_MGMT_A_PROTOCOL={0x8, 0x2, 0x3}]}, 0x24}, 0x1, 0x0, 0x0, 0x48084}, 0x8040) io_uring_setup(0x14ab, &(0x7f0000000480)={0x0, 0x5191, 0x20, 0x1, 0x3ba}) shmctl$IPC_INFO(r1, 0x3, &(0x7f0000000500)=""/203) recvmsg(r5, &(0x7f0000002b40)={&(0x7f0000000600)=@pptp={0x18, 0x2, {0x0, @private}}, 0x80, &(0x7f00000029c0)=[{&(0x7f0000000680)=""/252, 0xfc}, {&(0x7f0000000780)=""/122, 0x7a}, {&(0x7f0000000800)=""/178, 0xb2}, {&(0x7f00000008c0)=""/151, 0x97}, {&(0x7f0000000980)=""/4096, 0x1000}, {&(0x7f0000001980)=""/3, 0x3}, {&(0x7f00000019c0)=""/4096, 0x1000}], 0x7, &(0x7f0000002a40)=""/219, 0xdb}, 0x123) shmget$private(0x0, 0x2000, 0x10, &(0x7f0000ffc000/0x2000)=nil) 11:40:23 executing program 4: setsockopt$inet_tcp_TCP_QUEUE_SEQ(0xffffffffffffffff, 0x6, 0x15, &(0x7f0000000000), 0x4) r0 = openat$vcsa(0xffffffffffffff9c, &(0x7f0000000040), 0x81, 0x0) setsockopt$packet_tx_ring(r0, 0x107, 0xd, &(0x7f0000000080)=@req={0x4, 0xffffffff, 0xd5, 0x5}, 0x10) setsockopt$inet_tcp_TCP_REPAIR_WINDOW(r0, 0x6, 0x1d, &(0x7f00000000c0)={0xfffffff9, 0x1, 0x7fffffff, 0x6, 0x1}, 0x14) ioctl$SCSI_IOCTL_SYNC(r0, 0x4) r1 = accept(r0, &(0x7f0000000100)=@rc={0x1f, @fixed}, &(0x7f0000000180)=0x80) setsockopt$inet_tcp_TCP_FASTOPEN_KEY(r1, 0x6, 0x21, &(0x7f00000001c0)="2a6eddb47c1ebcb5002df4f95b6a3218", 0x10) socket$inet_tcp(0x2, 0x1, 0x0) ioctl$SG_GET_VERSION_NUM(r0, 0x2282, &(0x7f0000000200)) ioctl$SCSI_IOCTL_STOP_UNIT(r0, 0x6) ioctl$sock_SIOCADDRT(r1, 0x890b, &(0x7f0000000280)={0x0, @ax25={0x3, @remote={0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0x1}, 0x3}, @can={0x1d, 0x0}, @l2={0x1f, 0x20, @any, 0x81}, 0x81, 0x0, 0x0, 0x0, 0x3, &(0x7f0000000240)='veth1_to_bond\x00', 0x1, 0x9, 0x81}) sendto$packet(r0, &(0x7f0000000300)="ef239bcbf699ea49248d932bd7a123b6dc9273af2c6c1771bbfca4377cfca4cfc8d7a0ed5b9cec2ccbbb66f69d40c744edd53168a1bdf7d412632799b3df3b80bb5e766fd2e2b373e553a501f4d1997e0a3d387642b483dca2a2bee261552bc0ec0162efa75aa5e9f1a18f050fc5d5fbaa7dceca8e90ed87643278338e74fb16fecf749ace8174d85c2b85721c1097077921541caaf6d322510105ad87d2a427ffd1689b31d399985823b2bb0abd928963c7", 0xb2, 0x4004, &(0x7f00000003c0)={0x11, 0x16, r2, 0x1, 0x6, 0x6, @local}, 0x14) r3 = syz_genetlink_get_family_id$netlbl_mgmt(&(0x7f0000000440), 0xffffffffffffffff) sendmsg$NLBL_MGMT_C_PROTOCOLS(0xffffffffffffffff, &(0x7f0000000500)={&(0x7f0000000400)={0x10, 0x0, 0x0, 0x8}, 0xc, &(0x7f00000004c0)={&(0x7f0000000480)={0x1c, r3, 0x20, 0x70bd25, 0x25dfdbfe, {}, [@NLBL_MGMT_A_CLPDOI={0x8}]}, 0x1c}, 0x1, 0x0, 0x0, 0x4084}, 0x80) r4 = syz_genetlink_get_family_id$netlbl_mgmt(&(0x7f0000000580), 0xffffffffffffffff) sendmsg$NLBL_MGMT_C_VERSION(0xffffffffffffffff, &(0x7f0000000680)={&(0x7f0000000540)={0x10, 0x0, 0x0, 0x8000205}, 0xc, &(0x7f0000000640)={&(0x7f00000005c0)={0x5c, r4, 0x8, 0x1ff, 0x25dfdbfe, {}, [@NLBL_MGMT_A_DOMAIN={0xe, 0x1, 'NLBL_MGMT\x00'}, @NLBL_MGMT_A_IPV6ADDR={0x14, 0x5, @local}, @NLBL_MGMT_A_DOMAIN={0x8, 0x1, '@@,\x00'}, @NLBL_MGMT_A_IPV6ADDR={0x14, 0x5, @loopback}, @NLBL_MGMT_A_IPV4ADDR={0x8, 0x7, @private=0xa010102}]}, 0x5c}, 0x1, 0x0, 0x0, 0x24000810}, 0x8400) ioctl$ifreq_SIOCGIFINDEX_batadv_hard(r0, 0x8933, &(0x7f00000006c0)={'batadv_slave_1\x00'}) r5 = syz_genetlink_get_family_id$netlbl_mgmt(&(0x7f0000000740), 0xffffffffffffffff) sendmsg$NLBL_MGMT_C_REMOVEDEF(0xffffffffffffffff, &(0x7f0000000840)={&(0x7f0000000700)={0x10, 0x0, 0x0, 0x8}, 0xc, &(0x7f0000000800)={&(0x7f0000000780)={0x60, r5, 0x100, 0x70bd2c, 0x25dfdbfc, {}, [@NLBL_MGMT_A_IPV6ADDR={0x14, 0x5, @loopback}, @NLBL_MGMT_A_FAMILY={0x6, 0xb, 0x29}, @NLBL_MGMT_A_IPV4ADDR={0x8, 0x7, @multicast1}, @NLBL_MGMT_A_IPV6ADDR={0x14, 0x5, @remote}, @NLBL_MGMT_A_IPV6MASK={0x14, 0x6, @mcast1}]}, 0x60}, 0x1, 0x0, 0x0, 0x11}, 0x80c1) ioctl$sock_inet_tcp_SIOCINQ(0xffffffffffffffff, 0x541b, &(0x7f0000000a80)) 11:40:23 executing program 6: ioprio_set$uid(0x0, 0xee01, 0x4004) syz_mount_image$msdos(&(0x7f0000000000), &(0x7f0000000040)='./file0\x00', 0x200, 0x1, &(0x7f00000000c0)=[{&(0x7f0000000080)="7c74c7bc99e778a0c971e6f50fbdd2b70fa0b038d18c7d5ac685833434d89dce684239293aa5d8b6f11bc5c4a033ad1dc68319fad36a1101aad751fd6f4f10", 0x3f, 0x7f}], 0x42000, &(0x7f0000000100)={[{@dots}], [{@obj_user}, {@dont_appraise}, {@uid_lt}, {@hash}, {@seclabel}]}) getsockopt$inet6_IPV6_XFRM_POLICY(0xffffffffffffffff, 0x29, 0x23, &(0x7f0000000240)={{{@in=@loopback, @in6=@empty, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, {{@in6=@local}, 0x0, @in6=@mcast1}}, &(0x7f0000000340)=0xe8) mount$9p_xen(&(0x7f0000000180), &(0x7f00000001c0)='./file0\x00', &(0x7f0000000200), 0x1121061, &(0x7f0000000380)={'trans=xen,', {[{@msize={'msize', 0x3d, 0xf6b3}}, {@debug={'debug', 0x3d, 0x7ff}}, {@posixacl}, {@aname={'aname', 0x3d, '*$-&'}}, {@uname={'uname', 0x3d, 'msdos\x00'}}], [{@seclabel}, {@euid_eq={'euid', 0x3d, r1}}, {@permit_directio}, {@appraise_type}]}}) r2 = syz_io_uring_setup(0x1d4a, &(0x7f0000000440)={0x0, 0xfa85, 0x0, 0x0, 0x285}, &(0x7f0000ffd000/0x1000)=nil, &(0x7f0000ffd000/0x2000)=nil, &(0x7f00000004c0)=0x0, &(0x7f0000000500)) syz_io_uring_setup(0x3e5e, &(0x7f0000000540)={0x0, 0x5c61, 0x8, 0x2, 0x72}, &(0x7f0000ffd000/0x3000)=nil, &(0x7f0000ffc000/0x3000)=nil, &(0x7f00000005c0), &(0x7f0000000600)=0x0) syz_io_uring_submit(r3, r4, &(0x7f0000000740)=@IORING_OP_READ=@pass_buffer={0x16, 0x1, 0x2004, @fd_index=0xa, 0x7, &(0x7f0000000640)=""/227, 0xe3, 0xc, 0x1}, 0x9) ioctl$SECCOMP_IOCTL_NOTIF_ADDFD(0xffffffffffffffff, 0x40182103, &(0x7f0000000780)={0x0, 0x4, r2, 0x9, 0x80000}) openat$cgroup_devices(0xffffffffffffffff, &(0x7f00000007c0)='devices.allow\x00', 0x2, 0x0) syz_mount_image$nfs4(&(0x7f0000000800), &(0x7f0000000840)='./file0/file0\x00', 0xffffffffffffff01, 0x1, &(0x7f0000000900)=[{&(0x7f0000000880)="f19bd7cfef39dd2070dcb194f7bd90ce305e2a9644b9fb91cc1e75bca69ed6bbdd7636452963af395ea61189cce718ef43420310b6ff8db9f4a606d67217b1aa7bf6e1435682323aef92ef40d036c48fa3fc363c6ad63229bb37cd76a6db9879a39f", 0x62, 0x6}], 0x8400, &(0x7f0000000940)={[{'*+\\['}]}) r5 = accept(0xffffffffffffffff, 0x0, &(0x7f0000000980)) sendmsg$MPTCP_PM_CMD_GET_LIMITS(r5, &(0x7f0000000ac0)={&(0x7f00000009c0)={0x10, 0x0, 0x0, 0x200}, 0xc, &(0x7f0000000a80)={&(0x7f0000000a00)={0x74, 0x0, 0x200, 0x70bd27, 0x25dfdbfd, {}, [@MPTCP_PM_ATTR_RCV_ADD_ADDRS={0x8, 0x2, 0x8}, @MPTCP_PM_ATTR_RCV_ADD_ADDRS={0x8, 0x2, 0x2}, @MPTCP_PM_ATTR_SUBFLOWS={0x8, 0x3, 0x6}, @MPTCP_PM_ATTR_ADDR={0x3c, 0x1, 0x0, 0x1, [@MPTCP_PM_ADDR_ATTR_PORT={0x6, 0x5, 0x4e20}, @MPTCP_PM_ADDR_ATTR_ID={0x5, 0x2, 0x5}, @MPTCP_PM_ADDR_ATTR_FLAGS={0x8, 0x6, 0x3}, @MPTCP_PM_ADDR_ATTR_PORT={0x6, 0x5, 0x4e23}, @MPTCP_PM_ADDR_ATTR_FAMILY={0x6}, @MPTCP_PM_ADDR_ATTR_FAMILY={0x6, 0x1, 0xa}, @MPTCP_PM_ADDR_ATTR_FAMILY={0x6, 0x1, 0xa}]}, @MPTCP_PM_ATTR_ADDR={0x4}, @MPTCP_PM_ATTR_SUBFLOWS={0x8}]}, 0x74}, 0x1, 0x0, 0x0, 0x11}, 0x80) sendmsg$IEEE802154_LLSEC_DEL_SECLEVEL(0xffffffffffffffff, &(0x7f0000000bc0)={&(0x7f0000000b00)={0x10, 0x0, 0x0, 0x800000}, 0xc, &(0x7f0000000b80)={&(0x7f0000000b40)={0x2c, 0x0, 0x800, 0x70bd27, 0x25dfdbff, {}, [@IEEE802154_ATTR_DEV_INDEX={0x8}, @IEEE802154_ATTR_LLSEC_FRAME_TYPE={0x5, 0x33, 0x81}, @IEEE802154_ATTR_DEV_INDEX={0x8}]}, 0x2c}, 0x1, 0x0, 0x0, 0x4}, 0x2) socketpair(0x15, 0x1, 0x10001, &(0x7f0000000c00)={0xffffffffffffffff, 0xffffffffffffffff}) sendmsg$BATADV_CMD_TP_METER_CANCEL(r6, &(0x7f0000000d00)={&(0x7f0000000c40)={0x10, 0x0, 0x0, 0x8}, 0xc, &(0x7f0000000cc0)={&(0x7f0000000c80)={0x3c, 0x0, 0x1, 0x70bd2b, 0x25dfdbfc, {}, [@BATADV_ATTR_GW_BANDWIDTH_DOWN={0x8, 0x31, 0x4}, @BATADV_ATTR_ORIG_INTERVAL={0x8, 0x39, 0x5}, @BATADV_ATTR_ISOLATION_MASK={0x8, 0x2c, 0x80000}, @BATADV_ATTR_ISOLATION_MASK={0x8, 0x2c, 0x9}, @BATADV_ATTR_GW_MODE={0x5, 0x33, 0x1}]}, 0x3c}, 0x1, 0x0, 0x0, 0x4080}, 0x40000) socketpair(0xf, 0x6, 0x2, &(0x7f0000000d40)={0xffffffffffffffff}) r9 = accept(r7, &(0x7f0000000d80)=@ax25={{0x3, @default}, [@netrom, @rose, @netrom, @bcast, @bcast, @rose, @default, @bcast]}, &(0x7f0000000e00)=0x80) accept4$packet(r8, &(0x7f0000000e80)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @link_local}, &(0x7f0000000ec0)=0x14, 0x80000) sendmsg$MPTCP_PM_CMD_GET_ADDR(r9, &(0x7f0000001000)={&(0x7f0000000e40)={0x10, 0x0, 0x0, 0x2000}, 0xc, &(0x7f0000000fc0)={&(0x7f0000000f00)={0xb8, 0x0, 0x8, 0x70bd2c, 0x25dfdbfe, {}, [@MPTCP_PM_ATTR_ADDR={0x1c, 0x1, 0x0, 0x1, [@MPTCP_PM_ADDR_ATTR_ID={0x5, 0x2, 0x4}, @MPTCP_PM_ADDR_ATTR_IF_IDX={0x8, 0x7, r10}, @MPTCP_PM_ADDR_ATTR_IF_IDX={0x8, 0x7, r0}]}, @MPTCP_PM_ATTR_ADDR={0x4}, @MPTCP_PM_ATTR_RCV_ADD_ADDRS={0x8, 0x2, 0x2}, @MPTCP_PM_ATTR_ADDR={0x14, 0x1, 0x0, 0x1, [@MPTCP_PM_ADDR_ATTR_FAMILY={0x6, 0x1, 0x2}, @MPTCP_PM_ADDR_ATTR_ID={0x5, 0x2, 0x5}]}, @MPTCP_PM_ATTR_ADDR={0xc, 0x1, 0x0, 0x1, [@MPTCP_PM_ADDR_ATTR_ADDR4={0x8, 0x3, @private=0xa010101}]}, @MPTCP_PM_ATTR_ADDR={0x54, 0x1, 0x0, 0x1, [@MPTCP_PM_ADDR_ATTR_ADDR6={0x14, 0x4, @private0={0xfc, 0x0, '\x00', 0x1}}, @MPTCP_PM_ADDR_ATTR_IF_IDX={0x8, 0x7, r0}, @MPTCP_PM_ADDR_ATTR_FLAGS={0x8, 0x6, 0x4}, @MPTCP_PM_ADDR_ATTR_PORT={0x6, 0x5, 0x4e22}, @MPTCP_PM_ADDR_ATTR_ADDR6={0x14, 0x4, @mcast2}, @MPTCP_PM_ADDR_ATTR_ID={0x5, 0x2, 0x1}, @MPTCP_PM_ADDR_ATTR_FLAGS={0x8, 0x6, 0x6}]}, @MPTCP_PM_ATTR_RCV_ADD_ADDRS={0x8, 0x2, 0x6}]}, 0xb8}, 0x1, 0x0, 0x0, 0x80}, 0x40) mount$9p_rdma(&(0x7f0000001040), &(0x7f0000001080)='./file0\x00', &(0x7f00000010c0), 0xa00800, &(0x7f0000001100)={'trans=rdma,', {'port', 0x3d, 0x4e20}, 0x2c, {[{@common=@aname={'aname', 0x3d, 'permit_directio'}}, {@sq={'sq', 0x3d, 0xffff}}], [{@fscontext={'fscontext', 0x3d, 'staff_u'}}]}}) [ 116.679001] loop6: detected capacity change from 0 to 1 [ 116.744559] loop6: detected capacity change from 0 to 264192 [ 116.748637] nfs4: Unknown parameter '*+\[' [ 116.826599] SELinux: security_context_str_to_sid (staff_u) failed with errno=-22 11:40:31 executing program 2: clock_nanosleep(0x7, 0x0, &(0x7f0000000000)={0x77359400}, &(0x7f0000000040)) getsockopt$inet6_IPV6_XFRM_POLICY(0xffffffffffffffff, 0x29, 0x23, &(0x7f0000000080)={{{@in6, @in6=@remote, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, {{@in6=@dev}, 0x0, @in=@initdev}}, &(0x7f0000000180)=0xe8) setsockopt$packet_add_memb(0xffffffffffffffff, 0x107, 0x1, &(0x7f00000001c0)={r0, 0x1, 0x6, @broadcast}, 0x10) getpeername$packet(0xffffffffffffffff, &(0x7f0000000200)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @dev}, &(0x7f0000000240)=0x14) recvmsg(0xffffffffffffffff, &(0x7f00000027c0)={&(0x7f0000000280)=@xdp={0x2c, 0x0, 0x0}, 0x80, &(0x7f0000002640)=[{&(0x7f0000000300)=""/227, 0xe3}, {&(0x7f0000000400)=""/4096, 0x1000}, {&(0x7f0000001400)=""/92, 0x5c}, {&(0x7f0000001480)=""/93, 0x5d}, {&(0x7f0000001500)=""/4096, 0x1000}, {&(0x7f0000002500)=""/87, 0x57}, {&(0x7f0000002580)=""/189, 0xbd}], 0x7, &(0x7f00000026c0)=""/199, 0xc7}, 0x140) bind$packet(0xffffffffffffffff, &(0x7f0000002800)={0x11, 0x1b, r2, 0x1, 0x5}, 0x14) getresgid(&(0x7f0000002840), &(0x7f0000002880), &(0x7f00000028c0)) r3 = accept4$packet(0xffffffffffffffff, &(0x7f0000002900)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @multicast}, &(0x7f0000002940)=0x14, 0x80000) recvfrom$packet(r3, &(0x7f0000002980)=""/4096, 0x1000, 0x0, &(0x7f0000003980)={0x11, 0x17, r2, 0x1, 0x5, 0x6, @multicast}, 0x14) r4 = socket$inet6_udp(0xa, 0x2, 0x0) getsockopt$inet6_IPV6_XFRM_POLICY(r4, 0x29, 0x23, &(0x7f00000039c0)={{{@in6=@ipv4, @in6=@private0}}, {{@in=@private}, 0x0, @in6=@remote}}, &(0x7f0000003ac0)=0xe8) r5 = openat$sr(0xffffffffffffff9c, &(0x7f0000003b00), 0x200000, 0x0) recvfrom$packet(r5, &(0x7f0000003b40)=""/161, 0xa1, 0x140, &(0x7f0000003c00)={0x11, 0x2, r1, 0x1, 0x9a, 0x6, @local}, 0x14) r6 = openat$vcsa(0xffffffffffffff9c, &(0x7f0000003c40), 0x500, 0x0) write$bt_hci(r6, &(0x7f0000003c80)={0x1, @write_current_iac_lap={{0xc3a, 0x7}, {0x6, "30a9a39c10c4"}}}, 0xb) prctl$PR_SET_MM_MAP_SIZE(0x23, 0xf, &(0x7f0000003cc0)) accept4$packet(r6, &(0x7f00000053c0)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @local}, &(0x7f0000005400)=0x14, 0x80000) bind$packet(r3, &(0x7f0000005440)={0x11, 0x1b, r7, 0x1, 0x8, 0x6, @local}, 0x14) openat$sr(0xffffffffffffff9c, &(0x7f0000005480), 0x428802, 0x0) sendmsg$MPTCP_PM_CMD_FLUSH_ADDRS(r6, &(0x7f00000055c0)={&(0x7f00000054c0)={0x10, 0x0, 0x0, 0x4}, 0xc, &(0x7f0000005580)={&(0x7f0000005540)={0x30, 0x0, 0x4, 0x70bd2b, 0x25dfdbfd, {}, [@MPTCP_PM_ATTR_SUBFLOWS={0x8, 0x3, 0x8}, @MPTCP_PM_ATTR_SUBFLOWS={0x8, 0x3, 0x4}, @MPTCP_PM_ATTR_ADDR={0xc, 0x1, 0x0, 0x1, [@MPTCP_PM_ADDR_ATTR_IF_IDX={0x8, 0x7, r7}]}]}, 0x30}, 0x1, 0x0, 0x0, 0x4004084}, 0x4040080) 11:40:31 executing program 0: r0 = openat$vcsa(0xffffffffffffff9c, &(0x7f0000000000), 0x40000, 0x0) ioctl$SG_GET_PACK_ID(r0, 0x227c, &(0x7f0000000040)) r1 = openat$sr(0xffffffffffffff9c, &(0x7f0000000080), 0x454082, 0x0) ioctl$SG_SET_DEBUG(r1, 0x227e, &(0x7f00000000c0)=0x1) r2 = syz_open_dev$sg(&(0x7f0000000100), 0x8, 0x280102) ioctl$SG_GET_RESERVED_SIZE(r2, 0x2272, &(0x7f0000000140)) ioctl$SG_GET_REQUEST_TABLE(r1, 0x2286, &(0x7f0000000180)) r3 = syz_open_dev$sg(&(0x7f0000000300), 0x100000000, 0x408903) ioctl$SG_SET_RESERVED_SIZE(r3, 0x2275, &(0x7f0000000340)=0x80000000) ioctl$SG_GET_KEEP_ORPHAN(0xffffffffffffffff, 0x2288, &(0x7f0000000380)) ioctl$SG_GET_PACK_ID(r1, 0x227c, &(0x7f00000003c0)) ioctl$SG_SET_RESERVED_SIZE(r2, 0x2275, &(0x7f0000000400)=0x4cbd) ioctl$SG_EMULATED_HOST(0xffffffffffffffff, 0x2203, &(0x7f0000000440)) shmctl$IPC_STAT(0xffffffffffffffff, 0x2, &(0x7f0000000480)=""/83) ioctl$SCSI_IOCTL_PROBE_HOST(r0, 0x5385, &(0x7f0000000500)={0x1d, ""/29}) r4 = syz_open_dev$sg(&(0x7f0000000540), 0x8, 0x8100) ioctl$SG_GET_RESERVED_SIZE(r4, 0x2272, &(0x7f0000000580)) ioctl$SG_GET_KEEP_ORPHAN(0xffffffffffffffff, 0x2288, &(0x7f00000005c0)) ioctl$SG_SET_DEBUG(r3, 0x227e, &(0x7f0000000600)=0x1) sendmsg$MPTCP_PM_CMD_DEL_ADDR(r1, &(0x7f0000000740)={&(0x7f0000000640)={0x10, 0x0, 0x0, 0x40}, 0xc, &(0x7f0000000700)={&(0x7f0000000680)={0x64, 0x0, 0x10, 0x70bd2c, 0x25dfdbff, {}, [@MPTCP_PM_ATTR_RCV_ADD_ADDRS={0x8, 0x2, 0x1}, @MPTCP_PM_ATTR_ADDR={0x4}, @MPTCP_PM_ATTR_ADDR={0x24, 0x1, 0x0, 0x1, [@MPTCP_PM_ADDR_ATTR_IF_IDX={0x8}, @MPTCP_PM_ADDR_ATTR_PORT={0x6, 0x5, 0x4e24}, @MPTCP_PM_ADDR_ATTR_IF_IDX={0x8}, @MPTCP_PM_ADDR_ATTR_PORT={0x6, 0x5, 0x4e22}]}, @MPTCP_PM_ATTR_SUBFLOWS={0x8, 0x3, 0x3}, @MPTCP_PM_ATTR_SUBFLOWS={0x8, 0x3, 0x7}, @MPTCP_PM_ATTR_RCV_ADD_ADDRS={0x8, 0x2, 0x6}, @MPTCP_PM_ATTR_RCV_ADD_ADDRS={0x8, 0x2, 0x2}]}, 0x64}, 0x1, 0x0, 0x0, 0x4008010}, 0x4800) 11:40:31 executing program 4: setsockopt$inet_tcp_TCP_QUEUE_SEQ(0xffffffffffffffff, 0x6, 0x15, &(0x7f0000000000), 0x4) r0 = openat$vcsa(0xffffffffffffff9c, &(0x7f0000000040), 0x81, 0x0) setsockopt$packet_tx_ring(r0, 0x107, 0xd, &(0x7f0000000080)=@req={0x4, 0xffffffff, 0xd5, 0x5}, 0x10) setsockopt$inet_tcp_TCP_REPAIR_WINDOW(r0, 0x6, 0x1d, &(0x7f00000000c0)={0xfffffff9, 0x1, 0x7fffffff, 0x6, 0x1}, 0x14) ioctl$SCSI_IOCTL_SYNC(r0, 0x4) r1 = accept(r0, &(0x7f0000000100)=@rc={0x1f, @fixed}, &(0x7f0000000180)=0x80) setsockopt$inet_tcp_TCP_FASTOPEN_KEY(r1, 0x6, 0x21, &(0x7f00000001c0)="2a6eddb47c1ebcb5002df4f95b6a3218", 0x10) socket$inet_tcp(0x2, 0x1, 0x0) ioctl$SG_GET_VERSION_NUM(r0, 0x2282, &(0x7f0000000200)) ioctl$SCSI_IOCTL_STOP_UNIT(r0, 0x6) ioctl$sock_SIOCADDRT(r1, 0x890b, &(0x7f0000000280)={0x0, @ax25={0x3, @remote={0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0x1}, 0x3}, @can={0x1d, 0x0}, @l2={0x1f, 0x20, @any, 0x81}, 0x81, 0x0, 0x0, 0x0, 0x3, &(0x7f0000000240)='veth1_to_bond\x00', 0x1, 0x9, 0x81}) sendto$packet(r0, &(0x7f0000000300)="ef239bcbf699ea49248d932bd7a123b6dc9273af2c6c1771bbfca4377cfca4cfc8d7a0ed5b9cec2ccbbb66f69d40c744edd53168a1bdf7d412632799b3df3b80bb5e766fd2e2b373e553a501f4d1997e0a3d387642b483dca2a2bee261552bc0ec0162efa75aa5e9f1a18f050fc5d5fbaa7dceca8e90ed87643278338e74fb16fecf749ace8174d85c2b85721c1097077921541caaf6d322510105ad87d2a427ffd1689b31d399985823b2bb0abd928963c7", 0xb2, 0x4004, &(0x7f00000003c0)={0x11, 0x16, r2, 0x1, 0x6, 0x6, @local}, 0x14) r3 = syz_genetlink_get_family_id$netlbl_mgmt(&(0x7f0000000440), 0xffffffffffffffff) sendmsg$NLBL_MGMT_C_PROTOCOLS(0xffffffffffffffff, &(0x7f0000000500)={&(0x7f0000000400)={0x10, 0x0, 0x0, 0x8}, 0xc, &(0x7f00000004c0)={&(0x7f0000000480)={0x1c, r3, 0x20, 0x70bd25, 0x25dfdbfe, {}, [@NLBL_MGMT_A_CLPDOI={0x8}]}, 0x1c}, 0x1, 0x0, 0x0, 0x4084}, 0x80) r4 = syz_genetlink_get_family_id$netlbl_mgmt(&(0x7f0000000580), 0xffffffffffffffff) sendmsg$NLBL_MGMT_C_VERSION(0xffffffffffffffff, &(0x7f0000000680)={&(0x7f0000000540)={0x10, 0x0, 0x0, 0x8000205}, 0xc, &(0x7f0000000640)={&(0x7f00000005c0)={0x5c, r4, 0x8, 0x1ff, 0x25dfdbfe, {}, [@NLBL_MGMT_A_DOMAIN={0xe, 0x1, 'NLBL_MGMT\x00'}, @NLBL_MGMT_A_IPV6ADDR={0x14, 0x5, @local}, @NLBL_MGMT_A_DOMAIN={0x8, 0x1, '@@,\x00'}, @NLBL_MGMT_A_IPV6ADDR={0x14, 0x5, @loopback}, @NLBL_MGMT_A_IPV4ADDR={0x8, 0x7, @private=0xa010102}]}, 0x5c}, 0x1, 0x0, 0x0, 0x24000810}, 0x8400) ioctl$ifreq_SIOCGIFINDEX_batadv_hard(r0, 0x8933, &(0x7f00000006c0)={'batadv_slave_1\x00'}) r5 = syz_genetlink_get_family_id$netlbl_mgmt(&(0x7f0000000740), 0xffffffffffffffff) sendmsg$NLBL_MGMT_C_REMOVEDEF(0xffffffffffffffff, &(0x7f0000000840)={&(0x7f0000000700)={0x10, 0x0, 0x0, 0x8}, 0xc, &(0x7f0000000800)={&(0x7f0000000780)={0x60, r5, 0x100, 0x70bd2c, 0x25dfdbfc, {}, [@NLBL_MGMT_A_IPV6ADDR={0x14, 0x5, @loopback}, @NLBL_MGMT_A_FAMILY={0x6, 0xb, 0x29}, @NLBL_MGMT_A_IPV4ADDR={0x8, 0x7, @multicast1}, @NLBL_MGMT_A_IPV6ADDR={0x14, 0x5, @remote}, @NLBL_MGMT_A_IPV6MASK={0x14, 0x6, @mcast1}]}, 0x60}, 0x1, 0x0, 0x0, 0x11}, 0x80c1) 11:40:31 executing program 7: r0 = syz_open_dev$sg(&(0x7f0000000000), 0x1, 0x10000) ioctl$SG_GET_PACK_ID(r0, 0x227c, &(0x7f0000000040)) ioctl$SCSI_IOCTL_DOORLOCK(r0, 0x5380) ioctl$SG_SET_KEEP_ORPHAN(r0, 0x2287, &(0x7f0000000080)=0x7) ioctl$SCSI_IOCTL_BENCHMARK_COMMAND(r0, 0x3) ioctl$SCSI_IOCTL_SYNC(r0, 0x4) ioctl$SG_SET_DEBUG(r0, 0x227e, &(0x7f00000000c0)=0x1) setsockopt$packet_add_memb(0xffffffffffffffff, 0x107, 0x1, &(0x7f0000000100)={0x0, 0x1, 0x6}, 0x10) ioctl$SG_NEXT_CMD_LEN(r0, 0x2283, &(0x7f0000000140)=0x74) ioctl$SG_GET_VERSION_NUM(r0, 0x2282, &(0x7f0000000180)) socketpair(0x1f, 0x1, 0x5, &(0x7f00000001c0)={0xffffffffffffffff, 0xffffffffffffffff}) syz_genetlink_get_family_id$batadv(&(0x7f0000000200), r2) ioctl$SCSI_IOCTL_STOP_UNIT(r0, 0x6) ioctl$sock_SIOCADDRT(r1, 0x890b, &(0x7f0000000280)={0x0, @nfc={0x27, 0x0, 0x1, 0x6}, @isdn={0x22, 0x50, 0x5, 0x7, 0x5}, @sco, 0x3, 0x0, 0x0, 0x0, 0x1, &(0x7f0000000240)='virt_wifi0\x00', 0x7fffffff, 0x7f28, 0x4}) ioctl$SG_EMULATED_HOST(0xffffffffffffffff, 0x2203, &(0x7f0000000300)) ioctl$SG_GET_PACK_ID(r0, 0x227c, &(0x7f0000000340)) r3 = accept4$packet(r1, 0x0, &(0x7f0000000380), 0x80400) setsockopt$packet_add_memb(r3, 0x107, 0x1, &(0x7f00000003c0)={0x0, 0x1, 0x6, @remote}, 0x10) ioctl$SG_SET_RESERVED_SIZE(r0, 0x2275, &(0x7f0000000400)=0x6) openat$vcsa(0xffffffffffffff9c, &(0x7f0000000440), 0x10480, 0x0) 11:40:31 executing program 6: ioprio_set$uid(0x0, 0xee01, 0x4004) syz_mount_image$msdos(&(0x7f0000000000), &(0x7f0000000040)='./file0\x00', 0x200, 0x1, &(0x7f00000000c0)=[{&(0x7f0000000080)="7c74c7bc99e778a0c971e6f50fbdd2b70fa0b038d18c7d5ac685833434d89dce684239293aa5d8b6f11bc5c4a033ad1dc68319fad36a1101aad751fd6f4f10", 0x3f, 0x7f}], 0x42000, &(0x7f0000000100)={[{@dots}], [{@obj_user}, {@dont_appraise}, {@uid_lt}, {@hash}, {@seclabel}]}) getsockopt$inet6_IPV6_XFRM_POLICY(0xffffffffffffffff, 0x29, 0x23, &(0x7f0000000240)={{{@in=@loopback, @in6=@empty, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, {{@in6=@local}, 0x0, @in6=@mcast1}}, &(0x7f0000000340)=0xe8) mount$9p_xen(&(0x7f0000000180), &(0x7f00000001c0)='./file0\x00', &(0x7f0000000200), 0x1121061, &(0x7f0000000380)={'trans=xen,', {[{@msize={'msize', 0x3d, 0xf6b3}}, {@debug={'debug', 0x3d, 0x7ff}}, {@posixacl}, {@aname={'aname', 0x3d, '*$-&'}}, {@uname={'uname', 0x3d, 'msdos\x00'}}], [{@seclabel}, {@euid_eq={'euid', 0x3d, r1}}, {@permit_directio}, {@appraise_type}]}}) r2 = syz_io_uring_setup(0x1d4a, &(0x7f0000000440)={0x0, 0xfa85, 0x0, 0x0, 0x285}, &(0x7f0000ffd000/0x1000)=nil, &(0x7f0000ffd000/0x2000)=nil, &(0x7f00000004c0)=0x0, &(0x7f0000000500)) syz_io_uring_setup(0x3e5e, &(0x7f0000000540)={0x0, 0x5c61, 0x8, 0x2, 0x72}, &(0x7f0000ffd000/0x3000)=nil, &(0x7f0000ffc000/0x3000)=nil, &(0x7f00000005c0), &(0x7f0000000600)=0x0) syz_io_uring_submit(r3, r4, &(0x7f0000000740)=@IORING_OP_READ=@pass_buffer={0x16, 0x1, 0x2004, @fd_index=0xa, 0x7, &(0x7f0000000640)=""/227, 0xe3, 0xc, 0x1}, 0x9) ioctl$SECCOMP_IOCTL_NOTIF_ADDFD(0xffffffffffffffff, 0x40182103, &(0x7f0000000780)={0x0, 0x4, r2, 0x9, 0x80000}) openat$cgroup_devices(0xffffffffffffffff, &(0x7f00000007c0)='devices.allow\x00', 0x2, 0x0) syz_mount_image$nfs4(&(0x7f0000000800), &(0x7f0000000840)='./file0/file0\x00', 0xffffffffffffff01, 0x1, &(0x7f0000000900)=[{&(0x7f0000000880)="f19bd7cfef39dd2070dcb194f7bd90ce305e2a9644b9fb91cc1e75bca69ed6bbdd7636452963af395ea61189cce718ef43420310b6ff8db9f4a606d67217b1aa7bf6e1435682323aef92ef40d036c48fa3fc363c6ad63229bb37cd76a6db9879a39f", 0x62, 0x6}], 0x8400, &(0x7f0000000940)={[{'*+\\['}]}) r5 = accept(0xffffffffffffffff, 0x0, &(0x7f0000000980)) sendmsg$MPTCP_PM_CMD_GET_LIMITS(r5, &(0x7f0000000ac0)={&(0x7f00000009c0)={0x10, 0x0, 0x0, 0x200}, 0xc, &(0x7f0000000a80)={&(0x7f0000000a00)={0x74, 0x0, 0x200, 0x70bd27, 0x25dfdbfd, {}, [@MPTCP_PM_ATTR_RCV_ADD_ADDRS={0x8, 0x2, 0x8}, @MPTCP_PM_ATTR_RCV_ADD_ADDRS={0x8, 0x2, 0x2}, @MPTCP_PM_ATTR_SUBFLOWS={0x8, 0x3, 0x6}, @MPTCP_PM_ATTR_ADDR={0x3c, 0x1, 0x0, 0x1, [@MPTCP_PM_ADDR_ATTR_PORT={0x6, 0x5, 0x4e20}, @MPTCP_PM_ADDR_ATTR_ID={0x5, 0x2, 0x5}, @MPTCP_PM_ADDR_ATTR_FLAGS={0x8, 0x6, 0x3}, @MPTCP_PM_ADDR_ATTR_PORT={0x6, 0x5, 0x4e23}, @MPTCP_PM_ADDR_ATTR_FAMILY={0x6}, @MPTCP_PM_ADDR_ATTR_FAMILY={0x6, 0x1, 0xa}, @MPTCP_PM_ADDR_ATTR_FAMILY={0x6, 0x1, 0xa}]}, @MPTCP_PM_ATTR_ADDR={0x4}, @MPTCP_PM_ATTR_SUBFLOWS={0x8}]}, 0x74}, 0x1, 0x0, 0x0, 0x11}, 0x80) sendmsg$IEEE802154_LLSEC_DEL_SECLEVEL(0xffffffffffffffff, &(0x7f0000000bc0)={&(0x7f0000000b00)={0x10, 0x0, 0x0, 0x800000}, 0xc, &(0x7f0000000b80)={&(0x7f0000000b40)={0x2c, 0x0, 0x800, 0x70bd27, 0x25dfdbff, {}, [@IEEE802154_ATTR_DEV_INDEX={0x8}, @IEEE802154_ATTR_LLSEC_FRAME_TYPE={0x5, 0x33, 0x81}, @IEEE802154_ATTR_DEV_INDEX={0x8}]}, 0x2c}, 0x1, 0x0, 0x0, 0x4}, 0x2) socketpair(0x15, 0x1, 0x10001, &(0x7f0000000c00)={0xffffffffffffffff, 0xffffffffffffffff}) sendmsg$BATADV_CMD_TP_METER_CANCEL(r6, &(0x7f0000000d00)={&(0x7f0000000c40)={0x10, 0x0, 0x0, 0x8}, 0xc, &(0x7f0000000cc0)={&(0x7f0000000c80)={0x3c, 0x0, 0x1, 0x70bd2b, 0x25dfdbfc, {}, [@BATADV_ATTR_GW_BANDWIDTH_DOWN={0x8, 0x31, 0x4}, @BATADV_ATTR_ORIG_INTERVAL={0x8, 0x39, 0x5}, @BATADV_ATTR_ISOLATION_MASK={0x8, 0x2c, 0x80000}, @BATADV_ATTR_ISOLATION_MASK={0x8, 0x2c, 0x9}, @BATADV_ATTR_GW_MODE={0x5, 0x33, 0x1}]}, 0x3c}, 0x1, 0x0, 0x0, 0x4080}, 0x40000) socketpair(0xf, 0x6, 0x2, &(0x7f0000000d40)={0xffffffffffffffff}) r9 = accept(r7, &(0x7f0000000d80)=@ax25={{0x3, @default}, [@netrom, @rose, @netrom, @bcast, @bcast, @rose, @default, @bcast]}, &(0x7f0000000e00)=0x80) accept4$packet(r8, &(0x7f0000000e80)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @link_local}, &(0x7f0000000ec0)=0x14, 0x80000) sendmsg$MPTCP_PM_CMD_GET_ADDR(r9, &(0x7f0000001000)={&(0x7f0000000e40)={0x10, 0x0, 0x0, 0x2000}, 0xc, &(0x7f0000000fc0)={&(0x7f0000000f00)={0xb8, 0x0, 0x8, 0x70bd2c, 0x25dfdbfe, {}, [@MPTCP_PM_ATTR_ADDR={0x1c, 0x1, 0x0, 0x1, [@MPTCP_PM_ADDR_ATTR_ID={0x5, 0x2, 0x4}, @MPTCP_PM_ADDR_ATTR_IF_IDX={0x8, 0x7, r10}, @MPTCP_PM_ADDR_ATTR_IF_IDX={0x8, 0x7, r0}]}, @MPTCP_PM_ATTR_ADDR={0x4}, @MPTCP_PM_ATTR_RCV_ADD_ADDRS={0x8, 0x2, 0x2}, @MPTCP_PM_ATTR_ADDR={0x14, 0x1, 0x0, 0x1, [@MPTCP_PM_ADDR_ATTR_FAMILY={0x6, 0x1, 0x2}, @MPTCP_PM_ADDR_ATTR_ID={0x5, 0x2, 0x5}]}, @MPTCP_PM_ATTR_ADDR={0xc, 0x1, 0x0, 0x1, [@MPTCP_PM_ADDR_ATTR_ADDR4={0x8, 0x3, @private=0xa010101}]}, @MPTCP_PM_ATTR_ADDR={0x54, 0x1, 0x0, 0x1, [@MPTCP_PM_ADDR_ATTR_ADDR6={0x14, 0x4, @private0={0xfc, 0x0, '\x00', 0x1}}, @MPTCP_PM_ADDR_ATTR_IF_IDX={0x8, 0x7, r0}, @MPTCP_PM_ADDR_ATTR_FLAGS={0x8, 0x6, 0x4}, @MPTCP_PM_ADDR_ATTR_PORT={0x6, 0x5, 0x4e22}, @MPTCP_PM_ADDR_ATTR_ADDR6={0x14, 0x4, @mcast2}, @MPTCP_PM_ADDR_ATTR_ID={0x5, 0x2, 0x1}, @MPTCP_PM_ADDR_ATTR_FLAGS={0x8, 0x6, 0x6}]}, @MPTCP_PM_ATTR_RCV_ADD_ADDRS={0x8, 0x2, 0x6}]}, 0xb8}, 0x1, 0x0, 0x0, 0x80}, 0x40) mount$9p_rdma(&(0x7f0000001040), &(0x7f0000001080)='./file0\x00', &(0x7f00000010c0), 0xa00800, &(0x7f0000001100)={'trans=rdma,', {'port', 0x3d, 0x4e20}, 0x2c, {[{@common=@aname={'aname', 0x3d, 'permit_directio'}}, {@sq={'sq', 0x3d, 0xffff}}], [{@fscontext={'fscontext', 0x3d, 'staff_u'}}]}}) 11:40:31 executing program 3: ioctl$SG_SET_FORCE_PACK_ID(0xffffffffffffffff, 0x227b, &(0x7f0000000000)=0x1) ioctl$SG_SET_FORCE_PACK_ID(0xffffffffffffffff, 0x227b, &(0x7f0000000040)) ioctl$SG_GET_RESERVED_SIZE(0xffffffffffffffff, 0x2272, &(0x7f0000000080)) r0 = openat$vcsa(0xffffffffffffff9c, &(0x7f00000000c0), 0x4200, 0x0) ioctl$SCSI_IOCTL_SEND_COMMAND(r0, 0x1, &(0x7f0000000100)={0x17, 0x3, 0x1c00, "af36a59fb168d324fd8eaf833aeb82f60d75e8700d81d9"}) ioctl$SG_SET_TIMEOUT(r0, 0x2201, &(0x7f0000000140)=0x4) ioctl$SG_GET_VERSION_NUM(r0, 0x2282, &(0x7f0000000180)) ioctl$SG_GET_REQUEST_TABLE(r0, 0x2286, &(0x7f00000001c0)) ioctl$SG_GET_TIMEOUT(r0, 0x2202, 0x0) r1 = syz_open_dev$sg(&(0x7f0000000340), 0x7fff, 0x40) ioctl$SG_EMULATED_HOST(r1, 0x2203, &(0x7f0000000380)) r2 = openat$vcsa(0xffffffffffffff9c, &(0x7f00000003c0), 0x8103, 0x0) ioctl$SG_GET_COMMAND_Q(r2, 0x2270, &(0x7f0000000400)) r3 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$inet6_tcp_TCP_CONGESTION(r3, 0x6, 0xd, &(0x7f0000000440)='scalable\x00', 0x9) ioctl$SCSI_IOCTL_GET_IDLUN(r2, 0x5382, &(0x7f0000000480)) ioctl$SECCOMP_IOCTL_NOTIF_ADDFD(r2, 0x40182103, &(0x7f00000004c0)={0x0, 0x0, r0, 0x7}) ioctl$sock_ipv6_tunnel_SIOCDELTUNNEL(r0, 0x89f2, &(0x7f0000000580)={'ip6_vti0\x00', &(0x7f0000000500)={'ip6tnl0\x00', 0x0, 0x29, 0x4, 0x3f, 0x4, 0x2a, @dev={0xfe, 0x80, '\x00', 0x43}, @dev={0xfe, 0x80, '\x00', 0x17}, 0x1, 0x8, 0x27f, 0x401}}) ioctl$SG_IO(r2, 0x2285, &(0x7f0000002700)={0x53, 0xfffffffffffffffe, 0x39, 0xff, @scatter={0x2, 0x0, &(0x7f0000001640)=[{&(0x7f00000005c0)=""/81, 0x51}, {&(0x7f0000000640)=""/4096, 0x1000}]}, &(0x7f0000001680)="66d8d4ce99afb99683a288d8dc8d4ce2e2cffbe86bec5cc6d5612637f1ff758e1b371dc9a2f86a424b4795e1059aa6604bf3c27f2f56f25c66", &(0x7f00000016c0)=""/4096, 0xff, 0x10000, 0x2, &(0x7f00000026c0)}) ioctl$SNAPSHOT_PREF_IMAGE_SIZE(r0, 0x3312, 0x8) 11:40:31 executing program 5: getpeername$packet(0xffffffffffffffff, &(0x7f0000000000)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @dev}, &(0x7f0000000040)=0x14) ioctl$sock_SIOCADDRT(0xffffffffffffffff, 0x890b, &(0x7f0000000080)={0x0, @phonet={0x23, 0xfe, 0x0, 0x2f}, @hci={0x1f, 0xffffffffffffffff, 0x3}, @rc={0x1f, @any, 0x2}, 0x5, 0x0, 0x0, 0x0, 0x7ff, 0x0, 0x0, 0x4, 0x4}) r0 = mmap$IORING_OFF_SQES(&(0x7f0000ffa000/0x4000)=nil, 0x4000, 0x1000004, 0x810, 0xffffffffffffffff, 0x10000000) syz_io_uring_submit(0x0, r0, &(0x7f0000000100)=@IORING_OP_MADVISE={0x19, 0x3, 0x0, 0x0, 0x0, &(0x7f0000ffa000/0x2000)=nil, 0x2000, 0xb, 0x1}, 0x8) r1 = syz_genetlink_get_family_id$mptcp(&(0x7f0000000180), 0xffffffffffffffff) sendmsg$MPTCP_PM_CMD_ADD_ADDR(0xffffffffffffffff, &(0x7f0000000240)={&(0x7f0000000140)={0x10, 0x0, 0x0, 0x10000}, 0xc, &(0x7f0000000200)={&(0x7f00000001c0)={0x24, r1, 0x800, 0x70bd27, 0x25dfdbfd, {}, [@MPTCP_PM_ATTR_RCV_ADD_ADDRS={0x8, 0x2, 0x8}, @MPTCP_PM_ATTR_RCV_ADD_ADDRS={0x8, 0x2, 0x6}]}, 0x24}, 0x1, 0x0, 0x0, 0x2400c096}, 0x80) sendmsg$MPTCP_PM_CMD_FLUSH_ADDRS(0xffffffffffffffff, &(0x7f00000003c0)={&(0x7f0000000280)={0x10, 0x0, 0x0, 0x40}, 0xc, &(0x7f0000000380)={&(0x7f00000002c0)={0xa4, r1, 0x200, 0x70bd25, 0x25dfdbff, {}, [@MPTCP_PM_ATTR_RCV_ADD_ADDRS={0x8, 0x2, 0x3}, @MPTCP_PM_ATTR_ADDR={0x30, 0x1, 0x0, 0x1, [@MPTCP_PM_ADDR_ATTR_ADDR6={0x14, 0x4, @initdev={0xfe, 0x88, '\x00', 0x0, 0x0}}, @MPTCP_PM_ADDR_ATTR_ADDR4={0x8, 0x3, @local}, @MPTCP_PM_ADDR_ATTR_FLAGS={0x8, 0x6, 0x2}, @MPTCP_PM_ADDR_ATTR_FAMILY={0x6, 0x1, 0xa}]}, @MPTCP_PM_ATTR_ADDR={0x2c, 0x1, 0x0, 0x1, [@MPTCP_PM_ADDR_ATTR_ID={0x5, 0x2, 0x81}, @MPTCP_PM_ADDR_ATTR_PORT={0x6, 0x5, 0x4e22}, @MPTCP_PM_ADDR_ATTR_FAMILY={0x6, 0x1, 0xa}, @MPTCP_PM_ADDR_ATTR_FLAGS={0x8}, @MPTCP_PM_ADDR_ATTR_ID={0x5, 0x2, 0x40}]}, @MPTCP_PM_ATTR_SUBFLOWS={0x8, 0x3, 0x5}, @MPTCP_PM_ATTR_SUBFLOWS={0x8, 0x3, 0x5}, @MPTCP_PM_ATTR_ADDR={0x14, 0x1, 0x0, 0x1, [@MPTCP_PM_ADDR_ATTR_PORT={0x6, 0x5, 0x4e23}, @MPTCP_PM_ADDR_ATTR_PORT={0x6, 0x5, 0x4e21}]}, @MPTCP_PM_ATTR_SUBFLOWS={0x8, 0x3, 0x2}]}, 0xa4}, 0x1, 0x0, 0x0, 0x40}, 0x90) r2 = syz_open_dev$sg(&(0x7f0000000400), 0x4, 0x38040) ioctl$SCSI_IOCTL_DOORUNLOCK(r2, 0x5381) r3 = accept$packet(0xffffffffffffffff, &(0x7f0000000440), &(0x7f0000000480)=0x14) syz_io_uring_submit(0x0, r0, &(0x7f00000004c0)=@IORING_OP_ASYNC_CANCEL={0xe, 0x1, 0x0, 0x0, 0x0, 0x23456}, 0x5) accept4$packet(r3, &(0x7f0000000500), &(0x7f0000000540)=0x14, 0x800) r4 = openat$vcsa(0xffffffffffffff9c, &(0x7f0000000580), 0x121080, 0x0) ioctl$SG_SET_FORCE_PACK_ID(r4, 0x227b, &(0x7f00000005c0)) sendmsg$MPTCP_PM_CMD_GET_ADDR(r4, &(0x7f0000000740)={&(0x7f0000000600)={0x10, 0x0, 0x0, 0x40000000}, 0xc, &(0x7f0000000700)={&(0x7f0000000640)={0xa8, r1, 0x4, 0x70bd2a, 0x25dfdbfe, {}, [@MPTCP_PM_ATTR_ADDR={0x44, 0x1, 0x0, 0x1, [@MPTCP_PM_ADDR_ATTR_ID={0x5, 0x2, 0x6}, @MPTCP_PM_ADDR_ATTR_ID={0x5, 0x2, 0x2}, @MPTCP_PM_ADDR_ATTR_ADDR6={0x14, 0x4, @dev={0xfe, 0x80, '\x00', 0x17}}, @MPTCP_PM_ADDR_ATTR_ADDR6={0x14, 0x4, @remote}, @MPTCP_PM_ADDR_ATTR_FLAGS={0x8, 0x6, 0x2}]}, @MPTCP_PM_ATTR_SUBFLOWS={0x8, 0x3, 0x7}, @MPTCP_PM_ATTR_ADDR={0x14, 0x1, 0x0, 0x1, [@MPTCP_PM_ADDR_ATTR_FAMILY={0x6, 0x1, 0x2}, @MPTCP_PM_ADDR_ATTR_FAMILY={0x6, 0x1, 0x2}]}, @MPTCP_PM_ATTR_RCV_ADD_ADDRS={0x8, 0x2, 0x3}, @MPTCP_PM_ATTR_RCV_ADD_ADDRS={0x8, 0x2, 0x6}, @MPTCP_PM_ATTR_RCV_ADD_ADDRS={0x8, 0x2, 0x1}, @MPTCP_PM_ATTR_ADDR={0xc, 0x1, 0x0, 0x1, [@MPTCP_PM_ADDR_ATTR_FLAGS={0x8, 0x6, 0x3}]}, @MPTCP_PM_ATTR_RCV_ADD_ADDRS={0x8, 0x2, 0x5}, @MPTCP_PM_ATTR_SUBFLOWS={0x8, 0x3, 0x1}]}, 0xa8}, 0x1, 0x0, 0x0, 0x804}, 0x408c1) setsockopt$inet6_tcp_TCP_QUEUE_SEQ(r4, 0x6, 0x15, &(0x7f0000000780)=0x400, 0x4) sendmsg$MPTCP_PM_CMD_FLUSH_ADDRS(r4, &(0x7f00000008c0)={&(0x7f00000007c0)={0x10, 0x0, 0x0, 0x800}, 0xc, &(0x7f0000000880)={&(0x7f0000000800)={0x44, r1, 0x200, 0x70bd25, 0x25dfdbff, {}, [@MPTCP_PM_ATTR_SUBFLOWS={0x8, 0x3, 0x4}, @MPTCP_PM_ATTR_RCV_ADD_ADDRS={0x8, 0x2, 0x5}, @MPTCP_PM_ATTR_SUBFLOWS={0x8, 0x3, 0x5}, @MPTCP_PM_ATTR_RCV_ADD_ADDRS={0x8, 0x2, 0x5}, @MPTCP_PM_ATTR_SUBFLOWS={0x8, 0x3, 0x1}, @MPTCP_PM_ATTR_RCV_ADD_ADDRS={0x8, 0x2, 0x7}]}, 0x44}, 0x1, 0x0, 0x0, 0x8006}, 0x40000) sendmsg$NLBL_UNLABEL_C_STATICLIST(0xffffffffffffffff, &(0x7f0000000a00)={&(0x7f0000000900)={0x10, 0x0, 0x0, 0x4}, 0xc, &(0x7f00000009c0)={&(0x7f0000000940)={0x6c, 0x0, 0x800, 0x70bd2c, 0x25dfdbff, {}, [@NLBL_UNLABEL_A_IPV4MASK={0x8, 0x5, @multicast1}, @NLBL_UNLABEL_A_IPV6ADDR={0x14, 0x2, @private2}, @NLBL_UNLABEL_A_SECCTX={0x27, 0x7, 'system_u:object_r:dhcpc_state_t:s0\x00'}, @NLBL_UNLABEL_A_IPV6ADDR={0x14, 0x2, @private0}]}, 0x6c}, 0x1, 0x0, 0x0, 0x90}, 0x0) ioctl$SG_SET_COMMAND_Q(r4, 0x2271, &(0x7f0000000a40)) ioctl$SG_NEXT_CMD_LEN(r4, 0x2283, &(0x7f0000000a80)=0x58) 11:40:31 executing program 1: r0 = shmget(0x2, 0x3000, 0x100, &(0x7f0000ffb000/0x3000)=nil) shmat(r0, &(0x7f0000ffa000/0x3000)=nil, 0x2000) shmat(r0, &(0x7f0000ffa000/0x4000)=nil, 0x3000) r1 = shmget(0x3, 0x1000, 0x100, &(0x7f0000ffd000/0x1000)=nil) r2 = syz_genetlink_get_family_id$netlbl_mgmt(&(0x7f0000000040), 0xffffffffffffffff) sendmsg$NLBL_MGMT_C_REMOVEDEF(0xffffffffffffffff, &(0x7f0000000100)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x8}, 0xc, &(0x7f00000000c0)={&(0x7f0000000080)={0x3c, r2, 0x20, 0x70bd29, 0x25dfdbff, {}, [@NLBL_MGMT_A_FAMILY={0x6, 0xb, 0x5}, @NLBL_MGMT_A_PROTOCOL={0x8, 0x2, 0x3}, @NLBL_MGMT_A_IPV4MASK={0x8, 0x8, @multicast1}, @NLBL_MGMT_A_CLPDOI={0x8}, @NLBL_MGMT_A_IPV4ADDR={0x8, 0x7, @local}]}, 0x3c}, 0x1, 0x0, 0x0, 0x4048820}, 0x40000) shmat(0xffffffffffffffff, &(0x7f0000ffb000/0x4000)=nil, 0x2000) r3 = shmget(0x0, 0xf000, 0x100, &(0x7f0000ff1000/0xf000)=nil) shmctl$IPC_RMID(r3, 0x0) r4 = mmap$IORING_OFF_SQ_RING(&(0x7f0000ffd000/0x1000)=nil, 0x1000, 0x2000006, 0x40010, 0xffffffffffffffff, 0x0) syz_io_uring_submit(r4, 0x0, &(0x7f00000001c0)=@IORING_OP_PROVIDE_BUFFERS={0x1f, 0x1, 0x0, 0x8, 0x2, &(0x7f0000000140)="10e8e6d73f8e97a04564912d4b0bee6921be05ed083e4d741dabdbce8c94949f57a5c9d9da73d0e5ad668714159e31498f181aad79547c645eefb456a7b8c4be765eb156b77cba8a752b90d7729b2c285893a10c3633d2485f48f30d247214c5e28a", 0x7, 0x0, 0x1, {0x1}}, 0x100) r5 = socket(0x2c, 0x5, 0x1) accept4$packet(0xffffffffffffffff, &(0x7f0000000280)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @random}, &(0x7f00000002c0)=0x14, 0x40000) recvfrom$packet(r5, &(0x7f0000000200)=""/108, 0x6c, 0x2000, &(0x7f0000000300)={0x11, 0x16, r6, 0x1, 0x8, 0x6, @local}, 0x14) r7 = syz_genetlink_get_family_id$netlbl_mgmt(&(0x7f0000000380), 0xffffffffffffffff) sendmsg$NLBL_MGMT_C_REMOVEDEF(0xffffffffffffffff, &(0x7f0000000440)={&(0x7f0000000340)={0x10, 0x0, 0x0, 0x4}, 0xc, &(0x7f0000000400)={&(0x7f00000003c0)={0x24, r7, 0x400, 0x70bd26, 0x25dfdbfc, {}, [@NLBL_MGMT_A_FAMILY={0x6, 0xb, 0x18}, @NLBL_MGMT_A_PROTOCOL={0x8, 0x2, 0x3}]}, 0x24}, 0x1, 0x0, 0x0, 0x48084}, 0x8040) io_uring_setup(0x14ab, &(0x7f0000000480)={0x0, 0x5191, 0x20, 0x1, 0x3ba}) shmctl$IPC_INFO(r1, 0x3, &(0x7f0000000500)=""/203) recvmsg(r5, &(0x7f0000002b40)={&(0x7f0000000600)=@pptp={0x18, 0x2, {0x0, @private}}, 0x80, &(0x7f00000029c0)=[{&(0x7f0000000680)=""/252, 0xfc}, {&(0x7f0000000780)=""/122, 0x7a}, {&(0x7f0000000800)=""/178, 0xb2}, {&(0x7f00000008c0)=""/151, 0x97}, {&(0x7f0000000980)=""/4096, 0x1000}, {&(0x7f0000001980)=""/3, 0x3}, {&(0x7f00000019c0)=""/4096, 0x1000}], 0x7, &(0x7f0000002a40)=""/219, 0xdb}, 0x123) shmget$private(0x0, 0x2000, 0x10, &(0x7f0000ffc000/0x2000)=nil) [ 124.503410] loop6: detected capacity change from 0 to 1 [ 124.526697] loop6: detected capacity change from 0 to 264192 [ 124.531008] nfs4: Unknown parameter '*+\[' 11:40:31 executing program 4: setsockopt$inet_tcp_TCP_QUEUE_SEQ(0xffffffffffffffff, 0x6, 0x15, &(0x7f0000000000), 0x4) r0 = openat$vcsa(0xffffffffffffff9c, &(0x7f0000000040), 0x81, 0x0) setsockopt$packet_tx_ring(r0, 0x107, 0xd, &(0x7f0000000080)=@req={0x4, 0xffffffff, 0xd5, 0x5}, 0x10) setsockopt$inet_tcp_TCP_REPAIR_WINDOW(r0, 0x6, 0x1d, &(0x7f00000000c0)={0xfffffff9, 0x1, 0x7fffffff, 0x6, 0x1}, 0x14) ioctl$SCSI_IOCTL_SYNC(r0, 0x4) r1 = accept(r0, &(0x7f0000000100)=@rc={0x1f, @fixed}, &(0x7f0000000180)=0x80) setsockopt$inet_tcp_TCP_FASTOPEN_KEY(r1, 0x6, 0x21, &(0x7f00000001c0)="2a6eddb47c1ebcb5002df4f95b6a3218", 0x10) socket$inet_tcp(0x2, 0x1, 0x0) ioctl$SG_GET_VERSION_NUM(r0, 0x2282, &(0x7f0000000200)) ioctl$SCSI_IOCTL_STOP_UNIT(r0, 0x6) ioctl$sock_SIOCADDRT(r1, 0x890b, &(0x7f0000000280)={0x0, @ax25={0x3, @remote={0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0x1}, 0x3}, @can={0x1d, 0x0}, @l2={0x1f, 0x20, @any, 0x81}, 0x81, 0x0, 0x0, 0x0, 0x3, &(0x7f0000000240)='veth1_to_bond\x00', 0x1, 0x9, 0x81}) sendto$packet(r0, &(0x7f0000000300)="ef239bcbf699ea49248d932bd7a123b6dc9273af2c6c1771bbfca4377cfca4cfc8d7a0ed5b9cec2ccbbb66f69d40c744edd53168a1bdf7d412632799b3df3b80bb5e766fd2e2b373e553a501f4d1997e0a3d387642b483dca2a2bee261552bc0ec0162efa75aa5e9f1a18f050fc5d5fbaa7dceca8e90ed87643278338e74fb16fecf749ace8174d85c2b85721c1097077921541caaf6d322510105ad87d2a427ffd1689b31d399985823b2bb0abd928963c7", 0xb2, 0x4004, &(0x7f00000003c0)={0x11, 0x16, r2, 0x1, 0x6, 0x6, @local}, 0x14) r3 = syz_genetlink_get_family_id$netlbl_mgmt(&(0x7f0000000440), 0xffffffffffffffff) sendmsg$NLBL_MGMT_C_PROTOCOLS(0xffffffffffffffff, &(0x7f0000000500)={&(0x7f0000000400)={0x10, 0x0, 0x0, 0x8}, 0xc, &(0x7f00000004c0)={&(0x7f0000000480)={0x1c, r3, 0x20, 0x70bd25, 0x25dfdbfe, {}, [@NLBL_MGMT_A_CLPDOI={0x8}]}, 0x1c}, 0x1, 0x0, 0x0, 0x4084}, 0x80) r4 = syz_genetlink_get_family_id$netlbl_mgmt(&(0x7f0000000580), 0xffffffffffffffff) sendmsg$NLBL_MGMT_C_VERSION(0xffffffffffffffff, &(0x7f0000000680)={&(0x7f0000000540)={0x10, 0x0, 0x0, 0x8000205}, 0xc, &(0x7f0000000640)={&(0x7f00000005c0)={0x5c, r4, 0x8, 0x1ff, 0x25dfdbfe, {}, [@NLBL_MGMT_A_DOMAIN={0xe, 0x1, 'NLBL_MGMT\x00'}, @NLBL_MGMT_A_IPV6ADDR={0x14, 0x5, @local}, @NLBL_MGMT_A_DOMAIN={0x8, 0x1, '@@,\x00'}, @NLBL_MGMT_A_IPV6ADDR={0x14, 0x5, @loopback}, @NLBL_MGMT_A_IPV4ADDR={0x8, 0x7, @private=0xa010102}]}, 0x5c}, 0x1, 0x0, 0x0, 0x24000810}, 0x8400) ioctl$ifreq_SIOCGIFINDEX_batadv_hard(r0, 0x8933, &(0x7f00000006c0)={'batadv_slave_1\x00'}) r5 = syz_genetlink_get_family_id$netlbl_mgmt(&(0x7f0000000740), 0xffffffffffffffff) sendmsg$NLBL_MGMT_C_REMOVEDEF(0xffffffffffffffff, &(0x7f0000000840)={&(0x7f0000000700)={0x10, 0x0, 0x0, 0x8}, 0xc, &(0x7f0000000800)={&(0x7f0000000780)={0x60, r5, 0x100, 0x70bd2c, 0x25dfdbfc, {}, [@NLBL_MGMT_A_IPV6ADDR={0x14, 0x5, @loopback}, @NLBL_MGMT_A_FAMILY={0x6, 0xb, 0x29}, @NLBL_MGMT_A_IPV4ADDR={0x8, 0x7, @multicast1}, @NLBL_MGMT_A_IPV6ADDR={0x14, 0x5, @remote}, @NLBL_MGMT_A_IPV6MASK={0x14, 0x6, @mcast1}]}, 0x60}, 0x1, 0x0, 0x0, 0x11}, 0x80c1) 11:40:31 executing program 5: getpeername$packet(0xffffffffffffffff, &(0x7f0000000000)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @dev}, &(0x7f0000000040)=0x14) ioctl$sock_SIOCADDRT(0xffffffffffffffff, 0x890b, &(0x7f0000000080)={0x0, @phonet={0x23, 0xfe, 0x0, 0x2f}, @hci={0x1f, 0xffffffffffffffff, 0x3}, @rc={0x1f, @any, 0x2}, 0x5, 0x0, 0x0, 0x0, 0x7ff, 0x0, 0x0, 0x4, 0x4}) r0 = mmap$IORING_OFF_SQES(&(0x7f0000ffa000/0x4000)=nil, 0x4000, 0x1000004, 0x810, 0xffffffffffffffff, 0x10000000) syz_io_uring_submit(0x0, r0, &(0x7f0000000100)=@IORING_OP_MADVISE={0x19, 0x3, 0x0, 0x0, 0x0, &(0x7f0000ffa000/0x2000)=nil, 0x2000, 0xb, 0x1}, 0x8) r1 = syz_genetlink_get_family_id$mptcp(&(0x7f0000000180), 0xffffffffffffffff) sendmsg$MPTCP_PM_CMD_ADD_ADDR(0xffffffffffffffff, &(0x7f0000000240)={&(0x7f0000000140)={0x10, 0x0, 0x0, 0x10000}, 0xc, &(0x7f0000000200)={&(0x7f00000001c0)={0x24, r1, 0x800, 0x70bd27, 0x25dfdbfd, {}, [@MPTCP_PM_ATTR_RCV_ADD_ADDRS={0x8, 0x2, 0x8}, @MPTCP_PM_ATTR_RCV_ADD_ADDRS={0x8, 0x2, 0x6}]}, 0x24}, 0x1, 0x0, 0x0, 0x2400c096}, 0x80) sendmsg$MPTCP_PM_CMD_FLUSH_ADDRS(0xffffffffffffffff, &(0x7f00000003c0)={&(0x7f0000000280)={0x10, 0x0, 0x0, 0x40}, 0xc, &(0x7f0000000380)={&(0x7f00000002c0)={0xa4, r1, 0x200, 0x70bd25, 0x25dfdbff, {}, [@MPTCP_PM_ATTR_RCV_ADD_ADDRS={0x8, 0x2, 0x3}, @MPTCP_PM_ATTR_ADDR={0x30, 0x1, 0x0, 0x1, [@MPTCP_PM_ADDR_ATTR_ADDR6={0x14, 0x4, @initdev={0xfe, 0x88, '\x00', 0x0, 0x0}}, @MPTCP_PM_ADDR_ATTR_ADDR4={0x8, 0x3, @local}, @MPTCP_PM_ADDR_ATTR_FLAGS={0x8, 0x6, 0x2}, @MPTCP_PM_ADDR_ATTR_FAMILY={0x6, 0x1, 0xa}]}, @MPTCP_PM_ATTR_ADDR={0x2c, 0x1, 0x0, 0x1, [@MPTCP_PM_ADDR_ATTR_ID={0x5, 0x2, 0x81}, @MPTCP_PM_ADDR_ATTR_PORT={0x6, 0x5, 0x4e22}, @MPTCP_PM_ADDR_ATTR_FAMILY={0x6, 0x1, 0xa}, @MPTCP_PM_ADDR_ATTR_FLAGS={0x8}, @MPTCP_PM_ADDR_ATTR_ID={0x5, 0x2, 0x40}]}, @MPTCP_PM_ATTR_SUBFLOWS={0x8, 0x3, 0x5}, @MPTCP_PM_ATTR_SUBFLOWS={0x8, 0x3, 0x5}, @MPTCP_PM_ATTR_ADDR={0x14, 0x1, 0x0, 0x1, [@MPTCP_PM_ADDR_ATTR_PORT={0x6, 0x5, 0x4e23}, @MPTCP_PM_ADDR_ATTR_PORT={0x6, 0x5, 0x4e21}]}, @MPTCP_PM_ATTR_SUBFLOWS={0x8, 0x3, 0x2}]}, 0xa4}, 0x1, 0x0, 0x0, 0x40}, 0x90) r2 = syz_open_dev$sg(&(0x7f0000000400), 0x4, 0x38040) ioctl$SCSI_IOCTL_DOORUNLOCK(r2, 0x5381) r3 = accept$packet(0xffffffffffffffff, &(0x7f0000000440), &(0x7f0000000480)=0x14) syz_io_uring_submit(0x0, r0, &(0x7f00000004c0)=@IORING_OP_ASYNC_CANCEL={0xe, 0x1, 0x0, 0x0, 0x0, 0x23456}, 0x5) accept4$packet(r3, &(0x7f0000000500), &(0x7f0000000540)=0x14, 0x800) r4 = openat$vcsa(0xffffffffffffff9c, &(0x7f0000000580), 0x121080, 0x0) ioctl$SG_SET_FORCE_PACK_ID(r4, 0x227b, &(0x7f00000005c0)) sendmsg$MPTCP_PM_CMD_GET_ADDR(r4, &(0x7f0000000740)={&(0x7f0000000600)={0x10, 0x0, 0x0, 0x40000000}, 0xc, &(0x7f0000000700)={&(0x7f0000000640)={0xa8, r1, 0x4, 0x70bd2a, 0x25dfdbfe, {}, [@MPTCP_PM_ATTR_ADDR={0x44, 0x1, 0x0, 0x1, [@MPTCP_PM_ADDR_ATTR_ID={0x5, 0x2, 0x6}, @MPTCP_PM_ADDR_ATTR_ID={0x5, 0x2, 0x2}, @MPTCP_PM_ADDR_ATTR_ADDR6={0x14, 0x4, @dev={0xfe, 0x80, '\x00', 0x17}}, @MPTCP_PM_ADDR_ATTR_ADDR6={0x14, 0x4, @remote}, @MPTCP_PM_ADDR_ATTR_FLAGS={0x8, 0x6, 0x2}]}, @MPTCP_PM_ATTR_SUBFLOWS={0x8, 0x3, 0x7}, @MPTCP_PM_ATTR_ADDR={0x14, 0x1, 0x0, 0x1, [@MPTCP_PM_ADDR_ATTR_FAMILY={0x6, 0x1, 0x2}, @MPTCP_PM_ADDR_ATTR_FAMILY={0x6, 0x1, 0x2}]}, @MPTCP_PM_ATTR_RCV_ADD_ADDRS={0x8, 0x2, 0x3}, @MPTCP_PM_ATTR_RCV_ADD_ADDRS={0x8, 0x2, 0x6}, @MPTCP_PM_ATTR_RCV_ADD_ADDRS={0x8, 0x2, 0x1}, @MPTCP_PM_ATTR_ADDR={0xc, 0x1, 0x0, 0x1, [@MPTCP_PM_ADDR_ATTR_FLAGS={0x8, 0x6, 0x3}]}, @MPTCP_PM_ATTR_RCV_ADD_ADDRS={0x8, 0x2, 0x5}, @MPTCP_PM_ATTR_SUBFLOWS={0x8, 0x3, 0x1}]}, 0xa8}, 0x1, 0x0, 0x0, 0x804}, 0x408c1) setsockopt$inet6_tcp_TCP_QUEUE_SEQ(r4, 0x6, 0x15, &(0x7f0000000780)=0x400, 0x4) sendmsg$MPTCP_PM_CMD_FLUSH_ADDRS(r4, &(0x7f00000008c0)={&(0x7f00000007c0)={0x10, 0x0, 0x0, 0x800}, 0xc, &(0x7f0000000880)={&(0x7f0000000800)={0x44, r1, 0x200, 0x70bd25, 0x25dfdbff, {}, [@MPTCP_PM_ATTR_SUBFLOWS={0x8, 0x3, 0x4}, @MPTCP_PM_ATTR_RCV_ADD_ADDRS={0x8, 0x2, 0x5}, @MPTCP_PM_ATTR_SUBFLOWS={0x8, 0x3, 0x5}, @MPTCP_PM_ATTR_RCV_ADD_ADDRS={0x8, 0x2, 0x5}, @MPTCP_PM_ATTR_SUBFLOWS={0x8, 0x3, 0x1}, @MPTCP_PM_ATTR_RCV_ADD_ADDRS={0x8, 0x2, 0x7}]}, 0x44}, 0x1, 0x0, 0x0, 0x8006}, 0x40000) sendmsg$NLBL_UNLABEL_C_STATICLIST(0xffffffffffffffff, &(0x7f0000000a00)={&(0x7f0000000900)={0x10, 0x0, 0x0, 0x4}, 0xc, &(0x7f00000009c0)={&(0x7f0000000940)={0x6c, 0x0, 0x800, 0x70bd2c, 0x25dfdbff, {}, [@NLBL_UNLABEL_A_IPV4MASK={0x8, 0x5, @multicast1}, @NLBL_UNLABEL_A_IPV6ADDR={0x14, 0x2, @private2}, @NLBL_UNLABEL_A_SECCTX={0x27, 0x7, 'system_u:object_r:dhcpc_state_t:s0\x00'}, @NLBL_UNLABEL_A_IPV6ADDR={0x14, 0x2, @private0}]}, 0x6c}, 0x1, 0x0, 0x0, 0x90}, 0x0) ioctl$SG_SET_COMMAND_Q(r4, 0x2271, &(0x7f0000000a40)) 11:40:31 executing program 0: r0 = openat$vcsa(0xffffffffffffff9c, &(0x7f0000000000), 0x40000, 0x0) ioctl$SG_GET_PACK_ID(r0, 0x227c, &(0x7f0000000040)) r1 = openat$sr(0xffffffffffffff9c, &(0x7f0000000080), 0x454082, 0x0) ioctl$SG_SET_DEBUG(r1, 0x227e, &(0x7f00000000c0)=0x1) r2 = syz_open_dev$sg(&(0x7f0000000100), 0x8, 0x280102) ioctl$SG_GET_RESERVED_SIZE(r2, 0x2272, &(0x7f0000000140)) ioctl$SG_GET_REQUEST_TABLE(r1, 0x2286, &(0x7f0000000180)) r3 = syz_open_dev$sg(&(0x7f0000000300), 0x100000000, 0x408903) ioctl$SG_SET_RESERVED_SIZE(r3, 0x2275, &(0x7f0000000340)=0x80000000) ioctl$SG_GET_KEEP_ORPHAN(0xffffffffffffffff, 0x2288, &(0x7f0000000380)) ioctl$SG_GET_PACK_ID(r1, 0x227c, &(0x7f00000003c0)) ioctl$SG_SET_RESERVED_SIZE(r2, 0x2275, &(0x7f0000000400)=0x4cbd) ioctl$SG_EMULATED_HOST(0xffffffffffffffff, 0x2203, &(0x7f0000000440)) shmctl$IPC_STAT(0xffffffffffffffff, 0x2, &(0x7f0000000480)=""/83) ioctl$SCSI_IOCTL_PROBE_HOST(r0, 0x5385, &(0x7f0000000500)={0x1d, ""/29}) r4 = syz_open_dev$sg(&(0x7f0000000540), 0x8, 0x8100) ioctl$SG_GET_RESERVED_SIZE(r4, 0x2272, &(0x7f0000000580)) ioctl$SG_GET_KEEP_ORPHAN(0xffffffffffffffff, 0x2288, &(0x7f00000005c0)) ioctl$SG_SET_DEBUG(r3, 0x227e, &(0x7f0000000600)=0x1) [ 124.644249] SELinux: security_context_str_to_sid (staff_u) failed with errno=-22 11:40:41 executing program 2: clock_nanosleep(0x7, 0x0, &(0x7f0000000000)={0x77359400}, &(0x7f0000000040)) getsockopt$inet6_IPV6_XFRM_POLICY(0xffffffffffffffff, 0x29, 0x23, &(0x7f0000000080)={{{@in6, @in6=@remote, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, {{@in6=@dev}, 0x0, @in=@initdev}}, &(0x7f0000000180)=0xe8) setsockopt$packet_add_memb(0xffffffffffffffff, 0x107, 0x1, &(0x7f00000001c0)={r0, 0x1, 0x6, @broadcast}, 0x10) getpeername$packet(0xffffffffffffffff, &(0x7f0000000200)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @dev}, &(0x7f0000000240)=0x14) recvmsg(0xffffffffffffffff, &(0x7f00000027c0)={&(0x7f0000000280)=@xdp={0x2c, 0x0, 0x0}, 0x80, &(0x7f0000002640)=[{&(0x7f0000000300)=""/227, 0xe3}, {&(0x7f0000000400)=""/4096, 0x1000}, {&(0x7f0000001400)=""/92, 0x5c}, {&(0x7f0000001480)=""/93, 0x5d}, {&(0x7f0000001500)=""/4096, 0x1000}, {&(0x7f0000002500)=""/87, 0x57}, {&(0x7f0000002580)=""/189, 0xbd}], 0x7, &(0x7f00000026c0)=""/199, 0xc7}, 0x140) bind$packet(0xffffffffffffffff, &(0x7f0000002800)={0x11, 0x1b, r2, 0x1, 0x5}, 0x14) getresgid(&(0x7f0000002840), &(0x7f0000002880), &(0x7f00000028c0)) r3 = accept4$packet(0xffffffffffffffff, &(0x7f0000002900)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @multicast}, &(0x7f0000002940)=0x14, 0x80000) recvfrom$packet(r3, &(0x7f0000002980)=""/4096, 0x1000, 0x0, &(0x7f0000003980)={0x11, 0x17, r2, 0x1, 0x5, 0x6, @multicast}, 0x14) r4 = socket$inet6_udp(0xa, 0x2, 0x0) getsockopt$inet6_IPV6_XFRM_POLICY(r4, 0x29, 0x23, &(0x7f00000039c0)={{{@in6=@ipv4, @in6=@private0}}, {{@in=@private}, 0x0, @in6=@remote}}, &(0x7f0000003ac0)=0xe8) r5 = openat$sr(0xffffffffffffff9c, &(0x7f0000003b00), 0x200000, 0x0) recvfrom$packet(r5, &(0x7f0000003b40)=""/161, 0xa1, 0x140, &(0x7f0000003c00)={0x11, 0x2, r1, 0x1, 0x9a, 0x6, @local}, 0x14) r6 = openat$vcsa(0xffffffffffffff9c, &(0x7f0000003c40), 0x500, 0x0) write$bt_hci(r6, &(0x7f0000003c80)={0x1, @write_current_iac_lap={{0xc3a, 0x7}, {0x6, "30a9a39c10c4"}}}, 0xb) prctl$PR_SET_MM_MAP_SIZE(0x23, 0xf, &(0x7f0000003cc0)) accept4$packet(r6, &(0x7f00000053c0)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @local}, &(0x7f0000005400)=0x14, 0x80000) bind$packet(r3, &(0x7f0000005440)={0x11, 0x1b, r7, 0x1, 0x8, 0x6, @local}, 0x14) openat$sr(0xffffffffffffff9c, &(0x7f0000005480), 0x428802, 0x0) sendmsg$MPTCP_PM_CMD_FLUSH_ADDRS(r6, &(0x7f00000055c0)={&(0x7f00000054c0)={0x10, 0x0, 0x0, 0x4}, 0xc, &(0x7f0000005580)={&(0x7f0000005540)={0x30, 0x0, 0x4, 0x70bd2b, 0x25dfdbfd, {}, [@MPTCP_PM_ATTR_SUBFLOWS={0x8, 0x3, 0x8}, @MPTCP_PM_ATTR_SUBFLOWS={0x8, 0x3, 0x4}, @MPTCP_PM_ATTR_ADDR={0xc, 0x1, 0x0, 0x1, [@MPTCP_PM_ADDR_ATTR_IF_IDX={0x8, 0x7, r7}]}]}, 0x30}, 0x1, 0x0, 0x0, 0x4004084}, 0x4040080) 11:40:41 executing program 4: setsockopt$inet_tcp_TCP_QUEUE_SEQ(0xffffffffffffffff, 0x6, 0x15, &(0x7f0000000000), 0x4) r0 = openat$vcsa(0xffffffffffffff9c, &(0x7f0000000040), 0x81, 0x0) setsockopt$packet_tx_ring(r0, 0x107, 0xd, &(0x7f0000000080)=@req={0x4, 0xffffffff, 0xd5, 0x5}, 0x10) setsockopt$inet_tcp_TCP_REPAIR_WINDOW(r0, 0x6, 0x1d, &(0x7f00000000c0)={0xfffffff9, 0x1, 0x7fffffff, 0x6, 0x1}, 0x14) ioctl$SCSI_IOCTL_SYNC(r0, 0x4) r1 = accept(r0, &(0x7f0000000100)=@rc={0x1f, @fixed}, &(0x7f0000000180)=0x80) setsockopt$inet_tcp_TCP_FASTOPEN_KEY(r1, 0x6, 0x21, &(0x7f00000001c0)="2a6eddb47c1ebcb5002df4f95b6a3218", 0x10) socket$inet_tcp(0x2, 0x1, 0x0) ioctl$SG_GET_VERSION_NUM(r0, 0x2282, &(0x7f0000000200)) ioctl$SCSI_IOCTL_STOP_UNIT(r0, 0x6) ioctl$sock_SIOCADDRT(r1, 0x890b, &(0x7f0000000280)={0x0, @ax25={0x3, @remote={0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0x1}, 0x3}, @can={0x1d, 0x0}, @l2={0x1f, 0x20, @any, 0x81}, 0x81, 0x0, 0x0, 0x0, 0x3, &(0x7f0000000240)='veth1_to_bond\x00', 0x1, 0x9, 0x81}) sendto$packet(r0, &(0x7f0000000300)="ef239bcbf699ea49248d932bd7a123b6dc9273af2c6c1771bbfca4377cfca4cfc8d7a0ed5b9cec2ccbbb66f69d40c744edd53168a1bdf7d412632799b3df3b80bb5e766fd2e2b373e553a501f4d1997e0a3d387642b483dca2a2bee261552bc0ec0162efa75aa5e9f1a18f050fc5d5fbaa7dceca8e90ed87643278338e74fb16fecf749ace8174d85c2b85721c1097077921541caaf6d322510105ad87d2a427ffd1689b31d399985823b2bb0abd928963c7", 0xb2, 0x4004, &(0x7f00000003c0)={0x11, 0x16, r2, 0x1, 0x6, 0x6, @local}, 0x14) r3 = syz_genetlink_get_family_id$netlbl_mgmt(&(0x7f0000000440), 0xffffffffffffffff) sendmsg$NLBL_MGMT_C_PROTOCOLS(0xffffffffffffffff, &(0x7f0000000500)={&(0x7f0000000400)={0x10, 0x0, 0x0, 0x8}, 0xc, &(0x7f00000004c0)={&(0x7f0000000480)={0x1c, r3, 0x20, 0x70bd25, 0x25dfdbfe, {}, [@NLBL_MGMT_A_CLPDOI={0x8}]}, 0x1c}, 0x1, 0x0, 0x0, 0x4084}, 0x80) r4 = syz_genetlink_get_family_id$netlbl_mgmt(&(0x7f0000000580), 0xffffffffffffffff) sendmsg$NLBL_MGMT_C_VERSION(0xffffffffffffffff, &(0x7f0000000680)={&(0x7f0000000540)={0x10, 0x0, 0x0, 0x8000205}, 0xc, &(0x7f0000000640)={&(0x7f00000005c0)={0x5c, r4, 0x8, 0x1ff, 0x25dfdbfe, {}, [@NLBL_MGMT_A_DOMAIN={0xe, 0x1, 'NLBL_MGMT\x00'}, @NLBL_MGMT_A_IPV6ADDR={0x14, 0x5, @local}, @NLBL_MGMT_A_DOMAIN={0x8, 0x1, '@@,\x00'}, @NLBL_MGMT_A_IPV6ADDR={0x14, 0x5, @loopback}, @NLBL_MGMT_A_IPV4ADDR={0x8, 0x7, @private=0xa010102}]}, 0x5c}, 0x1, 0x0, 0x0, 0x24000810}, 0x8400) ioctl$ifreq_SIOCGIFINDEX_batadv_hard(r0, 0x8933, &(0x7f00000006c0)={'batadv_slave_1\x00'}) r5 = syz_genetlink_get_family_id$netlbl_mgmt(&(0x7f0000000740), 0xffffffffffffffff) sendmsg$NLBL_MGMT_C_REMOVEDEF(0xffffffffffffffff, &(0x7f0000000840)={&(0x7f0000000700)={0x10, 0x0, 0x0, 0x8}, 0xc, &(0x7f0000000800)={&(0x7f0000000780)={0x60, r5, 0x100, 0x70bd2c, 0x25dfdbfc, {}, [@NLBL_MGMT_A_IPV6ADDR={0x14, 0x5, @loopback}, @NLBL_MGMT_A_FAMILY={0x6, 0xb, 0x29}, @NLBL_MGMT_A_IPV4ADDR={0x8, 0x7, @multicast1}, @NLBL_MGMT_A_IPV6ADDR={0x14, 0x5, @remote}, @NLBL_MGMT_A_IPV6MASK={0x14, 0x6, @mcast1}]}, 0x60}, 0x1, 0x0, 0x0, 0x11}, 0x80c1) 11:40:41 executing program 0: r0 = openat$vcsa(0xffffffffffffff9c, &(0x7f0000000000), 0x40000, 0x0) ioctl$SG_GET_PACK_ID(r0, 0x227c, &(0x7f0000000040)) r1 = openat$sr(0xffffffffffffff9c, &(0x7f0000000080), 0x454082, 0x0) ioctl$SG_SET_DEBUG(r1, 0x227e, &(0x7f00000000c0)=0x1) r2 = syz_open_dev$sg(&(0x7f0000000100), 0x8, 0x280102) ioctl$SG_GET_RESERVED_SIZE(r2, 0x2272, &(0x7f0000000140)) ioctl$SG_GET_REQUEST_TABLE(r1, 0x2286, &(0x7f0000000180)) r3 = syz_open_dev$sg(&(0x7f0000000300), 0x100000000, 0x408903) ioctl$SG_SET_RESERVED_SIZE(r3, 0x2275, &(0x7f0000000340)=0x80000000) ioctl$SG_GET_KEEP_ORPHAN(0xffffffffffffffff, 0x2288, &(0x7f0000000380)) ioctl$SG_GET_PACK_ID(r1, 0x227c, &(0x7f00000003c0)) ioctl$SG_SET_RESERVED_SIZE(r2, 0x2275, &(0x7f0000000400)=0x4cbd) ioctl$SG_EMULATED_HOST(0xffffffffffffffff, 0x2203, &(0x7f0000000440)) shmctl$IPC_STAT(0xffffffffffffffff, 0x2, &(0x7f0000000480)=""/83) ioctl$SCSI_IOCTL_PROBE_HOST(r0, 0x5385, &(0x7f0000000500)={0x1d, ""/29}) r4 = syz_open_dev$sg(&(0x7f0000000540), 0x8, 0x8100) ioctl$SG_GET_RESERVED_SIZE(r4, 0x2272, &(0x7f0000000580)) ioctl$SG_GET_KEEP_ORPHAN(0xffffffffffffffff, 0x2288, &(0x7f00000005c0)) 11:40:41 executing program 5: getpeername$packet(0xffffffffffffffff, &(0x7f0000000000)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @dev}, &(0x7f0000000040)=0x14) ioctl$sock_SIOCADDRT(0xffffffffffffffff, 0x890b, &(0x7f0000000080)={0x0, @phonet={0x23, 0xfe, 0x0, 0x2f}, @hci={0x1f, 0xffffffffffffffff, 0x3}, @rc={0x1f, @any, 0x2}, 0x5, 0x0, 0x0, 0x0, 0x7ff, 0x0, 0x0, 0x4, 0x4}) r0 = mmap$IORING_OFF_SQES(&(0x7f0000ffa000/0x4000)=nil, 0x4000, 0x1000004, 0x810, 0xffffffffffffffff, 0x10000000) syz_io_uring_submit(0x0, r0, &(0x7f0000000100)=@IORING_OP_MADVISE={0x19, 0x3, 0x0, 0x0, 0x0, &(0x7f0000ffa000/0x2000)=nil, 0x2000, 0xb, 0x1}, 0x8) r1 = syz_genetlink_get_family_id$mptcp(&(0x7f0000000180), 0xffffffffffffffff) sendmsg$MPTCP_PM_CMD_ADD_ADDR(0xffffffffffffffff, &(0x7f0000000240)={&(0x7f0000000140)={0x10, 0x0, 0x0, 0x10000}, 0xc, &(0x7f0000000200)={&(0x7f00000001c0)={0x24, r1, 0x800, 0x70bd27, 0x25dfdbfd, {}, [@MPTCP_PM_ATTR_RCV_ADD_ADDRS={0x8, 0x2, 0x8}, @MPTCP_PM_ATTR_RCV_ADD_ADDRS={0x8, 0x2, 0x6}]}, 0x24}, 0x1, 0x0, 0x0, 0x2400c096}, 0x80) sendmsg$MPTCP_PM_CMD_FLUSH_ADDRS(0xffffffffffffffff, &(0x7f00000003c0)={&(0x7f0000000280)={0x10, 0x0, 0x0, 0x40}, 0xc, &(0x7f0000000380)={&(0x7f00000002c0)={0xa4, r1, 0x200, 0x70bd25, 0x25dfdbff, {}, [@MPTCP_PM_ATTR_RCV_ADD_ADDRS={0x8, 0x2, 0x3}, @MPTCP_PM_ATTR_ADDR={0x30, 0x1, 0x0, 0x1, [@MPTCP_PM_ADDR_ATTR_ADDR6={0x14, 0x4, @initdev={0xfe, 0x88, '\x00', 0x0, 0x0}}, @MPTCP_PM_ADDR_ATTR_ADDR4={0x8, 0x3, @local}, @MPTCP_PM_ADDR_ATTR_FLAGS={0x8, 0x6, 0x2}, @MPTCP_PM_ADDR_ATTR_FAMILY={0x6, 0x1, 0xa}]}, @MPTCP_PM_ATTR_ADDR={0x2c, 0x1, 0x0, 0x1, [@MPTCP_PM_ADDR_ATTR_ID={0x5, 0x2, 0x81}, @MPTCP_PM_ADDR_ATTR_PORT={0x6, 0x5, 0x4e22}, @MPTCP_PM_ADDR_ATTR_FAMILY={0x6, 0x1, 0xa}, @MPTCP_PM_ADDR_ATTR_FLAGS={0x8}, @MPTCP_PM_ADDR_ATTR_ID={0x5, 0x2, 0x40}]}, @MPTCP_PM_ATTR_SUBFLOWS={0x8, 0x3, 0x5}, @MPTCP_PM_ATTR_SUBFLOWS={0x8, 0x3, 0x5}, @MPTCP_PM_ATTR_ADDR={0x14, 0x1, 0x0, 0x1, [@MPTCP_PM_ADDR_ATTR_PORT={0x6, 0x5, 0x4e23}, @MPTCP_PM_ADDR_ATTR_PORT={0x6, 0x5, 0x4e21}]}, @MPTCP_PM_ATTR_SUBFLOWS={0x8, 0x3, 0x2}]}, 0xa4}, 0x1, 0x0, 0x0, 0x40}, 0x90) r2 = syz_open_dev$sg(&(0x7f0000000400), 0x4, 0x38040) ioctl$SCSI_IOCTL_DOORUNLOCK(r2, 0x5381) r3 = accept$packet(0xffffffffffffffff, &(0x7f0000000440), &(0x7f0000000480)=0x14) syz_io_uring_submit(0x0, r0, &(0x7f00000004c0)=@IORING_OP_ASYNC_CANCEL={0xe, 0x1, 0x0, 0x0, 0x0, 0x23456}, 0x5) accept4$packet(r3, &(0x7f0000000500), &(0x7f0000000540)=0x14, 0x800) r4 = openat$vcsa(0xffffffffffffff9c, &(0x7f0000000580), 0x121080, 0x0) ioctl$SG_SET_FORCE_PACK_ID(r4, 0x227b, &(0x7f00000005c0)) sendmsg$MPTCP_PM_CMD_GET_ADDR(r4, &(0x7f0000000740)={&(0x7f0000000600)={0x10, 0x0, 0x0, 0x40000000}, 0xc, &(0x7f0000000700)={&(0x7f0000000640)={0xa8, r1, 0x4, 0x70bd2a, 0x25dfdbfe, {}, [@MPTCP_PM_ATTR_ADDR={0x44, 0x1, 0x0, 0x1, [@MPTCP_PM_ADDR_ATTR_ID={0x5, 0x2, 0x6}, @MPTCP_PM_ADDR_ATTR_ID={0x5, 0x2, 0x2}, @MPTCP_PM_ADDR_ATTR_ADDR6={0x14, 0x4, @dev={0xfe, 0x80, '\x00', 0x17}}, @MPTCP_PM_ADDR_ATTR_ADDR6={0x14, 0x4, @remote}, @MPTCP_PM_ADDR_ATTR_FLAGS={0x8, 0x6, 0x2}]}, @MPTCP_PM_ATTR_SUBFLOWS={0x8, 0x3, 0x7}, @MPTCP_PM_ATTR_ADDR={0x14, 0x1, 0x0, 0x1, [@MPTCP_PM_ADDR_ATTR_FAMILY={0x6, 0x1, 0x2}, @MPTCP_PM_ADDR_ATTR_FAMILY={0x6, 0x1, 0x2}]}, @MPTCP_PM_ATTR_RCV_ADD_ADDRS={0x8, 0x2, 0x3}, @MPTCP_PM_ATTR_RCV_ADD_ADDRS={0x8, 0x2, 0x6}, @MPTCP_PM_ATTR_RCV_ADD_ADDRS={0x8, 0x2, 0x1}, @MPTCP_PM_ATTR_ADDR={0xc, 0x1, 0x0, 0x1, [@MPTCP_PM_ADDR_ATTR_FLAGS={0x8, 0x6, 0x3}]}, @MPTCP_PM_ATTR_RCV_ADD_ADDRS={0x8, 0x2, 0x5}, @MPTCP_PM_ATTR_SUBFLOWS={0x8, 0x3, 0x1}]}, 0xa8}, 0x1, 0x0, 0x0, 0x804}, 0x408c1) setsockopt$inet6_tcp_TCP_QUEUE_SEQ(r4, 0x6, 0x15, &(0x7f0000000780)=0x400, 0x4) sendmsg$MPTCP_PM_CMD_FLUSH_ADDRS(r4, &(0x7f00000008c0)={&(0x7f00000007c0)={0x10, 0x0, 0x0, 0x800}, 0xc, &(0x7f0000000880)={&(0x7f0000000800)={0x44, r1, 0x200, 0x70bd25, 0x25dfdbff, {}, [@MPTCP_PM_ATTR_SUBFLOWS={0x8, 0x3, 0x4}, @MPTCP_PM_ATTR_RCV_ADD_ADDRS={0x8, 0x2, 0x5}, @MPTCP_PM_ATTR_SUBFLOWS={0x8, 0x3, 0x5}, @MPTCP_PM_ATTR_RCV_ADD_ADDRS={0x8, 0x2, 0x5}, @MPTCP_PM_ATTR_SUBFLOWS={0x8, 0x3, 0x1}, @MPTCP_PM_ATTR_RCV_ADD_ADDRS={0x8, 0x2, 0x7}]}, 0x44}, 0x1, 0x0, 0x0, 0x8006}, 0x40000) sendmsg$NLBL_UNLABEL_C_STATICLIST(0xffffffffffffffff, &(0x7f0000000a00)={&(0x7f0000000900)={0x10, 0x0, 0x0, 0x4}, 0xc, &(0x7f00000009c0)={&(0x7f0000000940)={0x6c, 0x0, 0x800, 0x70bd2c, 0x25dfdbff, {}, [@NLBL_UNLABEL_A_IPV4MASK={0x8, 0x5, @multicast1}, @NLBL_UNLABEL_A_IPV6ADDR={0x14, 0x2, @private2}, @NLBL_UNLABEL_A_SECCTX={0x27, 0x7, 'system_u:object_r:dhcpc_state_t:s0\x00'}, @NLBL_UNLABEL_A_IPV6ADDR={0x14, 0x2, @private0}]}, 0x6c}, 0x1, 0x0, 0x0, 0x90}, 0x0) 11:40:41 executing program 3: ioctl$SG_SET_FORCE_PACK_ID(0xffffffffffffffff, 0x227b, &(0x7f0000000000)=0x1) ioctl$SG_SET_FORCE_PACK_ID(0xffffffffffffffff, 0x227b, &(0x7f0000000040)) ioctl$SG_GET_RESERVED_SIZE(0xffffffffffffffff, 0x2272, &(0x7f0000000080)) r0 = openat$vcsa(0xffffffffffffff9c, &(0x7f00000000c0), 0x4200, 0x0) ioctl$SCSI_IOCTL_SEND_COMMAND(r0, 0x1, &(0x7f0000000100)={0x17, 0x3, 0x1c00, "af36a59fb168d324fd8eaf833aeb82f60d75e8700d81d9"}) ioctl$SG_SET_TIMEOUT(r0, 0x2201, &(0x7f0000000140)=0x4) ioctl$SG_GET_VERSION_NUM(r0, 0x2282, &(0x7f0000000180)) ioctl$SG_GET_REQUEST_TABLE(r0, 0x2286, &(0x7f00000001c0)) ioctl$SG_GET_TIMEOUT(r0, 0x2202, 0x0) r1 = syz_open_dev$sg(&(0x7f0000000340), 0x7fff, 0x40) ioctl$SG_EMULATED_HOST(r1, 0x2203, &(0x7f0000000380)) r2 = openat$vcsa(0xffffffffffffff9c, &(0x7f00000003c0), 0x8103, 0x0) ioctl$SG_GET_COMMAND_Q(r2, 0x2270, &(0x7f0000000400)) r3 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$inet6_tcp_TCP_CONGESTION(r3, 0x6, 0xd, &(0x7f0000000440)='scalable\x00', 0x9) ioctl$SCSI_IOCTL_GET_IDLUN(r2, 0x5382, &(0x7f0000000480)) ioctl$SECCOMP_IOCTL_NOTIF_ADDFD(r2, 0x40182103, &(0x7f00000004c0)={0x0, 0x0, r0, 0x7}) ioctl$sock_ipv6_tunnel_SIOCDELTUNNEL(r0, 0x89f2, &(0x7f0000000580)={'ip6_vti0\x00', &(0x7f0000000500)={'ip6tnl0\x00', 0x0, 0x29, 0x4, 0x3f, 0x4, 0x2a, @dev={0xfe, 0x80, '\x00', 0x43}, @dev={0xfe, 0x80, '\x00', 0x17}, 0x1, 0x8, 0x27f, 0x401}}) ioctl$SG_IO(r2, 0x2285, &(0x7f0000002700)={0x53, 0xfffffffffffffffe, 0x39, 0xff, @scatter={0x2, 0x0, &(0x7f0000001640)=[{&(0x7f00000005c0)=""/81, 0x51}, {&(0x7f0000000640)=""/4096, 0x1000}]}, &(0x7f0000001680)="66d8d4ce99afb99683a288d8dc8d4ce2e2cffbe86bec5cc6d5612637f1ff758e1b371dc9a2f86a424b4795e1059aa6604bf3c27f2f56f25c66", &(0x7f00000016c0)=""/4096, 0xff, 0x10000, 0x2, &(0x7f00000026c0)}) 11:40:41 executing program 1: r0 = shmget(0x2, 0x3000, 0x100, &(0x7f0000ffb000/0x3000)=nil) shmat(r0, &(0x7f0000ffa000/0x3000)=nil, 0x2000) shmat(r0, &(0x7f0000ffa000/0x4000)=nil, 0x3000) r1 = shmget(0x3, 0x1000, 0x100, &(0x7f0000ffd000/0x1000)=nil) r2 = syz_genetlink_get_family_id$netlbl_mgmt(&(0x7f0000000040), 0xffffffffffffffff) sendmsg$NLBL_MGMT_C_REMOVEDEF(0xffffffffffffffff, &(0x7f0000000100)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x8}, 0xc, &(0x7f00000000c0)={&(0x7f0000000080)={0x3c, r2, 0x20, 0x70bd29, 0x25dfdbff, {}, [@NLBL_MGMT_A_FAMILY={0x6, 0xb, 0x5}, @NLBL_MGMT_A_PROTOCOL={0x8, 0x2, 0x3}, @NLBL_MGMT_A_IPV4MASK={0x8, 0x8, @multicast1}, @NLBL_MGMT_A_CLPDOI={0x8}, @NLBL_MGMT_A_IPV4ADDR={0x8, 0x7, @local}]}, 0x3c}, 0x1, 0x0, 0x0, 0x4048820}, 0x40000) shmat(0xffffffffffffffff, &(0x7f0000ffb000/0x4000)=nil, 0x2000) r3 = shmget(0x0, 0xf000, 0x100, &(0x7f0000ff1000/0xf000)=nil) shmctl$IPC_RMID(r3, 0x0) r4 = mmap$IORING_OFF_SQ_RING(&(0x7f0000ffd000/0x1000)=nil, 0x1000, 0x2000006, 0x40010, 0xffffffffffffffff, 0x0) syz_io_uring_submit(r4, 0x0, &(0x7f00000001c0)=@IORING_OP_PROVIDE_BUFFERS={0x1f, 0x1, 0x0, 0x8, 0x2, &(0x7f0000000140)="10e8e6d73f8e97a04564912d4b0bee6921be05ed083e4d741dabdbce8c94949f57a5c9d9da73d0e5ad668714159e31498f181aad79547c645eefb456a7b8c4be765eb156b77cba8a752b90d7729b2c285893a10c3633d2485f48f30d247214c5e28a", 0x7, 0x0, 0x1, {0x1}}, 0x100) r5 = socket(0x2c, 0x5, 0x1) accept4$packet(0xffffffffffffffff, &(0x7f0000000280)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @random}, &(0x7f00000002c0)=0x14, 0x40000) recvfrom$packet(r5, &(0x7f0000000200)=""/108, 0x6c, 0x2000, &(0x7f0000000300)={0x11, 0x16, r6, 0x1, 0x8, 0x6, @local}, 0x14) r7 = syz_genetlink_get_family_id$netlbl_mgmt(&(0x7f0000000380), 0xffffffffffffffff) sendmsg$NLBL_MGMT_C_REMOVEDEF(0xffffffffffffffff, &(0x7f0000000440)={&(0x7f0000000340)={0x10, 0x0, 0x0, 0x4}, 0xc, &(0x7f0000000400)={&(0x7f00000003c0)={0x24, r7, 0x400, 0x70bd26, 0x25dfdbfc, {}, [@NLBL_MGMT_A_FAMILY={0x6, 0xb, 0x18}, @NLBL_MGMT_A_PROTOCOL={0x8, 0x2, 0x3}]}, 0x24}, 0x1, 0x0, 0x0, 0x48084}, 0x8040) io_uring_setup(0x14ab, &(0x7f0000000480)={0x0, 0x5191, 0x20, 0x1, 0x3ba}) shmctl$IPC_INFO(r1, 0x3, &(0x7f0000000500)=""/203) shmget$private(0x0, 0x2000, 0x10, &(0x7f0000ffc000/0x2000)=nil) 11:40:41 executing program 7: r0 = syz_open_dev$sg(&(0x7f0000000000), 0x1, 0x10000) ioctl$SG_GET_PACK_ID(r0, 0x227c, &(0x7f0000000040)) ioctl$SCSI_IOCTL_DOORLOCK(r0, 0x5380) ioctl$SG_SET_KEEP_ORPHAN(r0, 0x2287, &(0x7f0000000080)=0x7) ioctl$SCSI_IOCTL_BENCHMARK_COMMAND(r0, 0x3) ioctl$SCSI_IOCTL_SYNC(r0, 0x4) ioctl$SG_SET_DEBUG(r0, 0x227e, &(0x7f00000000c0)=0x1) setsockopt$packet_add_memb(0xffffffffffffffff, 0x107, 0x1, &(0x7f0000000100)={0x0, 0x1, 0x6}, 0x10) ioctl$SG_NEXT_CMD_LEN(r0, 0x2283, &(0x7f0000000140)=0x74) ioctl$SG_GET_VERSION_NUM(r0, 0x2282, &(0x7f0000000180)) socketpair(0x1f, 0x1, 0x5, &(0x7f00000001c0)={0xffffffffffffffff, 0xffffffffffffffff}) syz_genetlink_get_family_id$batadv(&(0x7f0000000200), r2) ioctl$SCSI_IOCTL_STOP_UNIT(r0, 0x6) ioctl$sock_SIOCADDRT(r1, 0x890b, &(0x7f0000000280)={0x0, @nfc={0x27, 0x0, 0x1, 0x6}, @isdn={0x22, 0x50, 0x5, 0x7, 0x5}, @sco, 0x3, 0x0, 0x0, 0x0, 0x1, &(0x7f0000000240)='virt_wifi0\x00', 0x7fffffff, 0x7f28, 0x4}) ioctl$SG_EMULATED_HOST(0xffffffffffffffff, 0x2203, &(0x7f0000000300)) ioctl$SG_GET_PACK_ID(r0, 0x227c, &(0x7f0000000340)) r3 = accept4$packet(r1, 0x0, &(0x7f0000000380), 0x80400) setsockopt$packet_add_memb(r3, 0x107, 0x1, &(0x7f00000003c0)={0x0, 0x1, 0x6, @remote}, 0x10) openat$vcsa(0xffffffffffffff9c, &(0x7f0000000440), 0x10480, 0x0) 11:40:41 executing program 6: ioprio_set$uid(0x0, 0xee01, 0x4004) syz_mount_image$msdos(&(0x7f0000000000), &(0x7f0000000040)='./file0\x00', 0x200, 0x1, &(0x7f00000000c0)=[{&(0x7f0000000080)="7c74c7bc99e778a0c971e6f50fbdd2b70fa0b038d18c7d5ac685833434d89dce684239293aa5d8b6f11bc5c4a033ad1dc68319fad36a1101aad751fd6f4f10", 0x3f, 0x7f}], 0x42000, &(0x7f0000000100)={[{@dots}], [{@obj_user}, {@dont_appraise}, {@uid_lt}, {@hash}, {@seclabel}]}) getsockopt$inet6_IPV6_XFRM_POLICY(0xffffffffffffffff, 0x29, 0x23, &(0x7f0000000240)={{{@in=@loopback, @in6=@empty, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, {{@in6=@local}, 0x0, @in6=@mcast1}}, &(0x7f0000000340)=0xe8) mount$9p_xen(&(0x7f0000000180), &(0x7f00000001c0)='./file0\x00', &(0x7f0000000200), 0x1121061, &(0x7f0000000380)={'trans=xen,', {[{@msize={'msize', 0x3d, 0xf6b3}}, {@debug={'debug', 0x3d, 0x7ff}}, {@posixacl}, {@aname={'aname', 0x3d, '*$-&'}}, {@uname={'uname', 0x3d, 'msdos\x00'}}], [{@seclabel}, {@euid_eq={'euid', 0x3d, r0}}, {@permit_directio}, {@appraise_type}]}}) r1 = syz_io_uring_setup(0x1d4a, &(0x7f0000000440)={0x0, 0xfa85, 0x0, 0x0, 0x285}, &(0x7f0000ffd000/0x1000)=nil, &(0x7f0000ffd000/0x2000)=nil, &(0x7f00000004c0)=0x0, &(0x7f0000000500)) syz_io_uring_setup(0x3e5e, &(0x7f0000000540)={0x0, 0x5c61, 0x8, 0x2, 0x72}, &(0x7f0000ffd000/0x3000)=nil, &(0x7f0000ffc000/0x3000)=nil, &(0x7f00000005c0), &(0x7f0000000600)=0x0) syz_io_uring_submit(r2, r3, &(0x7f0000000740)=@IORING_OP_READ=@pass_buffer={0x16, 0x1, 0x2004, @fd_index=0xa, 0x7, &(0x7f0000000640)=""/227, 0xe3, 0xc, 0x1}, 0x9) ioctl$SECCOMP_IOCTL_NOTIF_ADDFD(0xffffffffffffffff, 0x40182103, &(0x7f0000000780)={0x0, 0x4, r1, 0x9, 0x80000}) openat$cgroup_devices(0xffffffffffffffff, &(0x7f00000007c0)='devices.allow\x00', 0x2, 0x0) syz_mount_image$nfs4(&(0x7f0000000800), &(0x7f0000000840)='./file0/file0\x00', 0xffffffffffffff01, 0x1, &(0x7f0000000900)=[{&(0x7f0000000880)="f19bd7cfef39dd2070dcb194f7bd90ce305e2a9644b9fb91cc1e75bca69ed6bbdd7636452963af395ea61189cce718ef43420310b6ff8db9f4a606d67217b1aa7bf6e1435682323aef92ef40d036c48fa3fc363c6ad63229bb37cd76a6db9879a39f", 0x62, 0x6}], 0x8400, &(0x7f0000000940)={[{'*+\\['}]}) r4 = accept(0xffffffffffffffff, 0x0, &(0x7f0000000980)) sendmsg$MPTCP_PM_CMD_GET_LIMITS(r4, &(0x7f0000000ac0)={&(0x7f00000009c0)={0x10, 0x0, 0x0, 0x200}, 0xc, &(0x7f0000000a80)={&(0x7f0000000a00)={0x74, 0x0, 0x200, 0x70bd27, 0x25dfdbfd, {}, [@MPTCP_PM_ATTR_RCV_ADD_ADDRS={0x8, 0x2, 0x8}, @MPTCP_PM_ATTR_RCV_ADD_ADDRS={0x8, 0x2, 0x2}, @MPTCP_PM_ATTR_SUBFLOWS={0x8, 0x3, 0x6}, @MPTCP_PM_ATTR_ADDR={0x3c, 0x1, 0x0, 0x1, [@MPTCP_PM_ADDR_ATTR_PORT={0x6, 0x5, 0x4e20}, @MPTCP_PM_ADDR_ATTR_ID={0x5, 0x2, 0x5}, @MPTCP_PM_ADDR_ATTR_FLAGS={0x8, 0x6, 0x3}, @MPTCP_PM_ADDR_ATTR_PORT={0x6, 0x5, 0x4e23}, @MPTCP_PM_ADDR_ATTR_FAMILY={0x6}, @MPTCP_PM_ADDR_ATTR_FAMILY={0x6, 0x1, 0xa}, @MPTCP_PM_ADDR_ATTR_FAMILY={0x6, 0x1, 0xa}]}, @MPTCP_PM_ATTR_ADDR={0x4}, @MPTCP_PM_ATTR_SUBFLOWS={0x8}]}, 0x74}, 0x1, 0x0, 0x0, 0x11}, 0x80) sendmsg$IEEE802154_LLSEC_DEL_SECLEVEL(0xffffffffffffffff, &(0x7f0000000bc0)={&(0x7f0000000b00)={0x10, 0x0, 0x0, 0x800000}, 0xc, &(0x7f0000000b80)={&(0x7f0000000b40)={0x2c, 0x0, 0x800, 0x70bd27, 0x25dfdbff, {}, [@IEEE802154_ATTR_DEV_INDEX={0x8}, @IEEE802154_ATTR_LLSEC_FRAME_TYPE={0x5, 0x33, 0x81}, @IEEE802154_ATTR_DEV_INDEX={0x8}]}, 0x2c}, 0x1, 0x0, 0x0, 0x4}, 0x2) socketpair(0x15, 0x1, 0x10001, &(0x7f0000000c00)={0xffffffffffffffff, 0xffffffffffffffff}) sendmsg$BATADV_CMD_TP_METER_CANCEL(r5, &(0x7f0000000d00)={&(0x7f0000000c40)={0x10, 0x0, 0x0, 0x8}, 0xc, &(0x7f0000000cc0)={&(0x7f0000000c80)={0x3c, 0x0, 0x1, 0x70bd2b, 0x25dfdbfc, {}, [@BATADV_ATTR_GW_BANDWIDTH_DOWN={0x8, 0x31, 0x4}, @BATADV_ATTR_ORIG_INTERVAL={0x8, 0x39, 0x5}, @BATADV_ATTR_ISOLATION_MASK={0x8, 0x2c, 0x80000}, @BATADV_ATTR_ISOLATION_MASK={0x8, 0x2c, 0x9}, @BATADV_ATTR_GW_MODE={0x5, 0x33, 0x1}]}, 0x3c}, 0x1, 0x0, 0x0, 0x4080}, 0x40000) socketpair(0xf, 0x6, 0x2, &(0x7f0000000d40)={0xffffffffffffffff}) accept(r6, &(0x7f0000000d80)=@ax25={{0x3, @default}, [@netrom, @rose, @netrom, @bcast, @bcast, @rose, @default, @bcast]}, &(0x7f0000000e00)=0x80) accept4$packet(r7, &(0x7f0000000e80)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @link_local}, &(0x7f0000000ec0)=0x14, 0x80000) mount$9p_rdma(&(0x7f0000001040), &(0x7f0000001080)='./file0\x00', &(0x7f00000010c0), 0xa00800, &(0x7f0000001100)={'trans=rdma,', {'port', 0x3d, 0x4e20}, 0x2c, {[{@common=@aname={'aname', 0x3d, 'permit_directio'}}, {@sq={'sq', 0x3d, 0xffff}}], [{@fscontext={'fscontext', 0x3d, 'staff_u'}}]}}) [ 134.167766] loop6: detected capacity change from 0 to 1 11:40:41 executing program 4: setsockopt$inet_tcp_TCP_QUEUE_SEQ(0xffffffffffffffff, 0x6, 0x15, &(0x7f0000000000), 0x4) r0 = openat$vcsa(0xffffffffffffff9c, &(0x7f0000000040), 0x81, 0x0) setsockopt$packet_tx_ring(r0, 0x107, 0xd, &(0x7f0000000080)=@req={0x4, 0xffffffff, 0xd5, 0x5}, 0x10) setsockopt$inet_tcp_TCP_REPAIR_WINDOW(r0, 0x6, 0x1d, &(0x7f00000000c0)={0xfffffff9, 0x1, 0x7fffffff, 0x6, 0x1}, 0x14) ioctl$SCSI_IOCTL_SYNC(r0, 0x4) r1 = accept(r0, &(0x7f0000000100)=@rc={0x1f, @fixed}, &(0x7f0000000180)=0x80) setsockopt$inet_tcp_TCP_FASTOPEN_KEY(r1, 0x6, 0x21, &(0x7f00000001c0)="2a6eddb47c1ebcb5002df4f95b6a3218", 0x10) socket$inet_tcp(0x2, 0x1, 0x0) ioctl$SG_GET_VERSION_NUM(r0, 0x2282, &(0x7f0000000200)) ioctl$SCSI_IOCTL_STOP_UNIT(r0, 0x6) ioctl$sock_SIOCADDRT(r1, 0x890b, &(0x7f0000000280)={0x0, @ax25={0x3, @remote={0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0x1}, 0x3}, @can={0x1d, 0x0}, @l2={0x1f, 0x20, @any, 0x81}, 0x81, 0x0, 0x0, 0x0, 0x3, &(0x7f0000000240)='veth1_to_bond\x00', 0x1, 0x9, 0x81}) sendto$packet(r0, &(0x7f0000000300)="ef239bcbf699ea49248d932bd7a123b6dc9273af2c6c1771bbfca4377cfca4cfc8d7a0ed5b9cec2ccbbb66f69d40c744edd53168a1bdf7d412632799b3df3b80bb5e766fd2e2b373e553a501f4d1997e0a3d387642b483dca2a2bee261552bc0ec0162efa75aa5e9f1a18f050fc5d5fbaa7dceca8e90ed87643278338e74fb16fecf749ace8174d85c2b85721c1097077921541caaf6d322510105ad87d2a427ffd1689b31d399985823b2bb0abd928963c7", 0xb2, 0x4004, &(0x7f00000003c0)={0x11, 0x16, r2, 0x1, 0x6, 0x6, @local}, 0x14) r3 = syz_genetlink_get_family_id$netlbl_mgmt(&(0x7f0000000440), 0xffffffffffffffff) sendmsg$NLBL_MGMT_C_PROTOCOLS(0xffffffffffffffff, &(0x7f0000000500)={&(0x7f0000000400)={0x10, 0x0, 0x0, 0x8}, 0xc, &(0x7f00000004c0)={&(0x7f0000000480)={0x1c, r3, 0x20, 0x70bd25, 0x25dfdbfe, {}, [@NLBL_MGMT_A_CLPDOI={0x8}]}, 0x1c}, 0x1, 0x0, 0x0, 0x4084}, 0x80) r4 = syz_genetlink_get_family_id$netlbl_mgmt(&(0x7f0000000580), 0xffffffffffffffff) sendmsg$NLBL_MGMT_C_VERSION(0xffffffffffffffff, &(0x7f0000000680)={&(0x7f0000000540)={0x10, 0x0, 0x0, 0x8000205}, 0xc, &(0x7f0000000640)={&(0x7f00000005c0)={0x5c, r4, 0x8, 0x1ff, 0x25dfdbfe, {}, [@NLBL_MGMT_A_DOMAIN={0xe, 0x1, 'NLBL_MGMT\x00'}, @NLBL_MGMT_A_IPV6ADDR={0x14, 0x5, @local}, @NLBL_MGMT_A_DOMAIN={0x8, 0x1, '@@,\x00'}, @NLBL_MGMT_A_IPV6ADDR={0x14, 0x5, @loopback}, @NLBL_MGMT_A_IPV4ADDR={0x8, 0x7, @private=0xa010102}]}, 0x5c}, 0x1, 0x0, 0x0, 0x24000810}, 0x8400) ioctl$ifreq_SIOCGIFINDEX_batadv_hard(r0, 0x8933, &(0x7f00000006c0)={'batadv_slave_1\x00'}) syz_genetlink_get_family_id$netlbl_mgmt(&(0x7f0000000740), 0xffffffffffffffff) [ 134.237227] loop6: detected capacity change from 0 to 264192 11:40:41 executing program 0: r0 = openat$vcsa(0xffffffffffffff9c, &(0x7f0000000000), 0x40000, 0x0) ioctl$SG_GET_PACK_ID(r0, 0x227c, &(0x7f0000000040)) r1 = openat$sr(0xffffffffffffff9c, &(0x7f0000000080), 0x454082, 0x0) ioctl$SG_SET_DEBUG(r1, 0x227e, &(0x7f00000000c0)=0x1) r2 = syz_open_dev$sg(&(0x7f0000000100), 0x8, 0x280102) ioctl$SG_GET_RESERVED_SIZE(r2, 0x2272, &(0x7f0000000140)) ioctl$SG_GET_REQUEST_TABLE(r1, 0x2286, &(0x7f0000000180)) r3 = syz_open_dev$sg(&(0x7f0000000300), 0x100000000, 0x408903) ioctl$SG_SET_RESERVED_SIZE(r3, 0x2275, &(0x7f0000000340)=0x80000000) ioctl$SG_GET_KEEP_ORPHAN(0xffffffffffffffff, 0x2288, &(0x7f0000000380)) ioctl$SG_GET_PACK_ID(r1, 0x227c, &(0x7f00000003c0)) ioctl$SG_SET_RESERVED_SIZE(r2, 0x2275, &(0x7f0000000400)=0x4cbd) ioctl$SG_EMULATED_HOST(0xffffffffffffffff, 0x2203, &(0x7f0000000440)) shmctl$IPC_STAT(0xffffffffffffffff, 0x2, &(0x7f0000000480)=""/83) ioctl$SCSI_IOCTL_PROBE_HOST(r0, 0x5385, &(0x7f0000000500)={0x1d, ""/29}) r4 = syz_open_dev$sg(&(0x7f0000000540), 0x8, 0x8100) ioctl$SG_GET_RESERVED_SIZE(r4, 0x2272, &(0x7f0000000580)) [ 134.246669] nfs4: Unknown parameter '*+\[' 11:40:41 executing program 1: r0 = shmget(0x2, 0x3000, 0x100, &(0x7f0000ffb000/0x3000)=nil) shmat(r0, &(0x7f0000ffa000/0x3000)=nil, 0x2000) shmat(r0, &(0x7f0000ffa000/0x4000)=nil, 0x3000) r1 = shmget(0x3, 0x1000, 0x100, &(0x7f0000ffd000/0x1000)=nil) r2 = syz_genetlink_get_family_id$netlbl_mgmt(&(0x7f0000000040), 0xffffffffffffffff) sendmsg$NLBL_MGMT_C_REMOVEDEF(0xffffffffffffffff, &(0x7f0000000100)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x8}, 0xc, &(0x7f00000000c0)={&(0x7f0000000080)={0x3c, r2, 0x20, 0x70bd29, 0x25dfdbff, {}, [@NLBL_MGMT_A_FAMILY={0x6, 0xb, 0x5}, @NLBL_MGMT_A_PROTOCOL={0x8, 0x2, 0x3}, @NLBL_MGMT_A_IPV4MASK={0x8, 0x8, @multicast1}, @NLBL_MGMT_A_CLPDOI={0x8}, @NLBL_MGMT_A_IPV4ADDR={0x8, 0x7, @local}]}, 0x3c}, 0x1, 0x0, 0x0, 0x4048820}, 0x40000) shmat(0xffffffffffffffff, &(0x7f0000ffb000/0x4000)=nil, 0x2000) r3 = shmget(0x0, 0xf000, 0x100, &(0x7f0000ff1000/0xf000)=nil) shmctl$IPC_RMID(r3, 0x0) r4 = mmap$IORING_OFF_SQ_RING(&(0x7f0000ffd000/0x1000)=nil, 0x1000, 0x2000006, 0x40010, 0xffffffffffffffff, 0x0) syz_io_uring_submit(r4, 0x0, &(0x7f00000001c0)=@IORING_OP_PROVIDE_BUFFERS={0x1f, 0x1, 0x0, 0x8, 0x2, &(0x7f0000000140)="10e8e6d73f8e97a04564912d4b0bee6921be05ed083e4d741dabdbce8c94949f57a5c9d9da73d0e5ad668714159e31498f181aad79547c645eefb456a7b8c4be765eb156b77cba8a752b90d7729b2c285893a10c3633d2485f48f30d247214c5e28a", 0x7, 0x0, 0x1, {0x1}}, 0x100) r5 = socket(0x2c, 0x5, 0x1) accept4$packet(0xffffffffffffffff, &(0x7f0000000280)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @random}, &(0x7f00000002c0)=0x14, 0x40000) recvfrom$packet(r5, &(0x7f0000000200)=""/108, 0x6c, 0x2000, &(0x7f0000000300)={0x11, 0x16, r6, 0x1, 0x8, 0x6, @local}, 0x14) r7 = syz_genetlink_get_family_id$netlbl_mgmt(&(0x7f0000000380), 0xffffffffffffffff) sendmsg$NLBL_MGMT_C_REMOVEDEF(0xffffffffffffffff, &(0x7f0000000440)={&(0x7f0000000340)={0x10, 0x0, 0x0, 0x4}, 0xc, &(0x7f0000000400)={&(0x7f00000003c0)={0x24, r7, 0x400, 0x70bd26, 0x25dfdbfc, {}, [@NLBL_MGMT_A_FAMILY={0x6, 0xb, 0x18}, @NLBL_MGMT_A_PROTOCOL={0x8, 0x2, 0x3}]}, 0x24}, 0x1, 0x0, 0x0, 0x48084}, 0x8040) io_uring_setup(0x14ab, &(0x7f0000000480)={0x0, 0x5191, 0x20, 0x1, 0x3ba}) shmctl$IPC_INFO(r1, 0x3, &(0x7f0000000500)=""/203) shmget$private(0x0, 0x2000, 0x10, &(0x7f0000ffc000/0x2000)=nil) 11:40:41 executing program 5: getpeername$packet(0xffffffffffffffff, &(0x7f0000000000)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @dev}, &(0x7f0000000040)=0x14) ioctl$sock_SIOCADDRT(0xffffffffffffffff, 0x890b, &(0x7f0000000080)={0x0, @phonet={0x23, 0xfe, 0x0, 0x2f}, @hci={0x1f, 0xffffffffffffffff, 0x3}, @rc={0x1f, @any, 0x2}, 0x5, 0x0, 0x0, 0x0, 0x7ff, 0x0, 0x0, 0x4, 0x4}) r0 = mmap$IORING_OFF_SQES(&(0x7f0000ffa000/0x4000)=nil, 0x4000, 0x1000004, 0x810, 0xffffffffffffffff, 0x10000000) syz_io_uring_submit(0x0, r0, &(0x7f0000000100)=@IORING_OP_MADVISE={0x19, 0x3, 0x0, 0x0, 0x0, &(0x7f0000ffa000/0x2000)=nil, 0x2000, 0xb, 0x1}, 0x8) r1 = syz_genetlink_get_family_id$mptcp(&(0x7f0000000180), 0xffffffffffffffff) sendmsg$MPTCP_PM_CMD_ADD_ADDR(0xffffffffffffffff, &(0x7f0000000240)={&(0x7f0000000140)={0x10, 0x0, 0x0, 0x10000}, 0xc, &(0x7f0000000200)={&(0x7f00000001c0)={0x24, r1, 0x800, 0x70bd27, 0x25dfdbfd, {}, [@MPTCP_PM_ATTR_RCV_ADD_ADDRS={0x8, 0x2, 0x8}, @MPTCP_PM_ATTR_RCV_ADD_ADDRS={0x8, 0x2, 0x6}]}, 0x24}, 0x1, 0x0, 0x0, 0x2400c096}, 0x80) sendmsg$MPTCP_PM_CMD_FLUSH_ADDRS(0xffffffffffffffff, &(0x7f00000003c0)={&(0x7f0000000280)={0x10, 0x0, 0x0, 0x40}, 0xc, &(0x7f0000000380)={&(0x7f00000002c0)={0xa4, r1, 0x200, 0x70bd25, 0x25dfdbff, {}, [@MPTCP_PM_ATTR_RCV_ADD_ADDRS={0x8, 0x2, 0x3}, @MPTCP_PM_ATTR_ADDR={0x30, 0x1, 0x0, 0x1, [@MPTCP_PM_ADDR_ATTR_ADDR6={0x14, 0x4, @initdev={0xfe, 0x88, '\x00', 0x0, 0x0}}, @MPTCP_PM_ADDR_ATTR_ADDR4={0x8, 0x3, @local}, @MPTCP_PM_ADDR_ATTR_FLAGS={0x8, 0x6, 0x2}, @MPTCP_PM_ADDR_ATTR_FAMILY={0x6, 0x1, 0xa}]}, @MPTCP_PM_ATTR_ADDR={0x2c, 0x1, 0x0, 0x1, [@MPTCP_PM_ADDR_ATTR_ID={0x5, 0x2, 0x81}, @MPTCP_PM_ADDR_ATTR_PORT={0x6, 0x5, 0x4e22}, @MPTCP_PM_ADDR_ATTR_FAMILY={0x6, 0x1, 0xa}, @MPTCP_PM_ADDR_ATTR_FLAGS={0x8}, @MPTCP_PM_ADDR_ATTR_ID={0x5, 0x2, 0x40}]}, @MPTCP_PM_ATTR_SUBFLOWS={0x8, 0x3, 0x5}, @MPTCP_PM_ATTR_SUBFLOWS={0x8, 0x3, 0x5}, @MPTCP_PM_ATTR_ADDR={0x14, 0x1, 0x0, 0x1, [@MPTCP_PM_ADDR_ATTR_PORT={0x6, 0x5, 0x4e23}, @MPTCP_PM_ADDR_ATTR_PORT={0x6, 0x5, 0x4e21}]}, @MPTCP_PM_ATTR_SUBFLOWS={0x8, 0x3, 0x2}]}, 0xa4}, 0x1, 0x0, 0x0, 0x40}, 0x90) r2 = syz_open_dev$sg(&(0x7f0000000400), 0x4, 0x38040) ioctl$SCSI_IOCTL_DOORUNLOCK(r2, 0x5381) r3 = accept$packet(0xffffffffffffffff, &(0x7f0000000440), &(0x7f0000000480)=0x14) syz_io_uring_submit(0x0, r0, &(0x7f00000004c0)=@IORING_OP_ASYNC_CANCEL={0xe, 0x1, 0x0, 0x0, 0x0, 0x23456}, 0x5) accept4$packet(r3, &(0x7f0000000500), &(0x7f0000000540)=0x14, 0x800) r4 = openat$vcsa(0xffffffffffffff9c, &(0x7f0000000580), 0x121080, 0x0) ioctl$SG_SET_FORCE_PACK_ID(r4, 0x227b, &(0x7f00000005c0)) sendmsg$MPTCP_PM_CMD_GET_ADDR(r4, &(0x7f0000000740)={&(0x7f0000000600)={0x10, 0x0, 0x0, 0x40000000}, 0xc, &(0x7f0000000700)={&(0x7f0000000640)={0xa8, r1, 0x4, 0x70bd2a, 0x25dfdbfe, {}, [@MPTCP_PM_ATTR_ADDR={0x44, 0x1, 0x0, 0x1, [@MPTCP_PM_ADDR_ATTR_ID={0x5, 0x2, 0x6}, @MPTCP_PM_ADDR_ATTR_ID={0x5, 0x2, 0x2}, @MPTCP_PM_ADDR_ATTR_ADDR6={0x14, 0x4, @dev={0xfe, 0x80, '\x00', 0x17}}, @MPTCP_PM_ADDR_ATTR_ADDR6={0x14, 0x4, @remote}, @MPTCP_PM_ADDR_ATTR_FLAGS={0x8, 0x6, 0x2}]}, @MPTCP_PM_ATTR_SUBFLOWS={0x8, 0x3, 0x7}, @MPTCP_PM_ATTR_ADDR={0x14, 0x1, 0x0, 0x1, [@MPTCP_PM_ADDR_ATTR_FAMILY={0x6, 0x1, 0x2}, @MPTCP_PM_ADDR_ATTR_FAMILY={0x6, 0x1, 0x2}]}, @MPTCP_PM_ATTR_RCV_ADD_ADDRS={0x8, 0x2, 0x3}, @MPTCP_PM_ATTR_RCV_ADD_ADDRS={0x8, 0x2, 0x6}, @MPTCP_PM_ATTR_RCV_ADD_ADDRS={0x8, 0x2, 0x1}, @MPTCP_PM_ATTR_ADDR={0xc, 0x1, 0x0, 0x1, [@MPTCP_PM_ADDR_ATTR_FLAGS={0x8, 0x6, 0x3}]}, @MPTCP_PM_ATTR_RCV_ADD_ADDRS={0x8, 0x2, 0x5}, @MPTCP_PM_ATTR_SUBFLOWS={0x8, 0x3, 0x1}]}, 0xa8}, 0x1, 0x0, 0x0, 0x804}, 0x408c1) setsockopt$inet6_tcp_TCP_QUEUE_SEQ(r4, 0x6, 0x15, &(0x7f0000000780)=0x400, 0x4) sendmsg$MPTCP_PM_CMD_FLUSH_ADDRS(r4, &(0x7f00000008c0)={&(0x7f00000007c0)={0x10, 0x0, 0x0, 0x800}, 0xc, &(0x7f0000000880)={&(0x7f0000000800)={0x44, r1, 0x200, 0x70bd25, 0x25dfdbff, {}, [@MPTCP_PM_ATTR_SUBFLOWS={0x8, 0x3, 0x4}, @MPTCP_PM_ATTR_RCV_ADD_ADDRS={0x8, 0x2, 0x5}, @MPTCP_PM_ATTR_SUBFLOWS={0x8, 0x3, 0x5}, @MPTCP_PM_ATTR_RCV_ADD_ADDRS={0x8, 0x2, 0x5}, @MPTCP_PM_ATTR_SUBFLOWS={0x8, 0x3, 0x1}, @MPTCP_PM_ATTR_RCV_ADD_ADDRS={0x8, 0x2, 0x7}]}, 0x44}, 0x1, 0x0, 0x0, 0x8006}, 0x40000) [ 134.395839] SELinux: security_context_str_to_sid (staff_u) failed with errno=-22 11:40:41 executing program 3: ioctl$SG_SET_FORCE_PACK_ID(0xffffffffffffffff, 0x227b, &(0x7f0000000000)=0x1) ioctl$SG_SET_FORCE_PACK_ID(0xffffffffffffffff, 0x227b, &(0x7f0000000040)) ioctl$SG_GET_RESERVED_SIZE(0xffffffffffffffff, 0x2272, &(0x7f0000000080)) r0 = openat$vcsa(0xffffffffffffff9c, &(0x7f00000000c0), 0x4200, 0x0) ioctl$SCSI_IOCTL_SEND_COMMAND(r0, 0x1, &(0x7f0000000100)={0x17, 0x3, 0x1c00, "af36a59fb168d324fd8eaf833aeb82f60d75e8700d81d9"}) ioctl$SG_SET_TIMEOUT(r0, 0x2201, &(0x7f0000000140)=0x4) ioctl$SG_GET_VERSION_NUM(r0, 0x2282, &(0x7f0000000180)) ioctl$SG_GET_REQUEST_TABLE(r0, 0x2286, &(0x7f00000001c0)) ioctl$SG_GET_TIMEOUT(r0, 0x2202, 0x0) r1 = syz_open_dev$sg(&(0x7f0000000340), 0x7fff, 0x40) ioctl$SG_EMULATED_HOST(r1, 0x2203, &(0x7f0000000380)) r2 = openat$vcsa(0xffffffffffffff9c, &(0x7f00000003c0), 0x8103, 0x0) ioctl$SG_GET_COMMAND_Q(r2, 0x2270, &(0x7f0000000400)) r3 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$inet6_tcp_TCP_CONGESTION(r3, 0x6, 0xd, &(0x7f0000000440)='scalable\x00', 0x9) ioctl$SCSI_IOCTL_GET_IDLUN(r2, 0x5382, &(0x7f0000000480)) ioctl$SECCOMP_IOCTL_NOTIF_ADDFD(r2, 0x40182103, &(0x7f00000004c0)={0x0, 0x0, r0, 0x7}) ioctl$sock_ipv6_tunnel_SIOCDELTUNNEL(r0, 0x89f2, &(0x7f0000000580)={'ip6_vti0\x00', &(0x7f0000000500)={'ip6tnl0\x00', 0x0, 0x29, 0x4, 0x3f, 0x4, 0x2a, @dev={0xfe, 0x80, '\x00', 0x43}, @dev={0xfe, 0x80, '\x00', 0x17}, 0x1, 0x8, 0x27f, 0x401}}) 11:40:41 executing program 0: r0 = openat$vcsa(0xffffffffffffff9c, &(0x7f0000000000), 0x40000, 0x0) ioctl$SG_GET_PACK_ID(r0, 0x227c, &(0x7f0000000040)) r1 = openat$sr(0xffffffffffffff9c, &(0x7f0000000080), 0x454082, 0x0) ioctl$SG_SET_DEBUG(r1, 0x227e, &(0x7f00000000c0)=0x1) r2 = syz_open_dev$sg(&(0x7f0000000100), 0x8, 0x280102) ioctl$SG_GET_RESERVED_SIZE(r2, 0x2272, &(0x7f0000000140)) ioctl$SG_GET_REQUEST_TABLE(r1, 0x2286, &(0x7f0000000180)) r3 = syz_open_dev$sg(&(0x7f0000000300), 0x100000000, 0x408903) ioctl$SG_SET_RESERVED_SIZE(r3, 0x2275, &(0x7f0000000340)=0x80000000) ioctl$SG_GET_KEEP_ORPHAN(0xffffffffffffffff, 0x2288, &(0x7f0000000380)) ioctl$SG_GET_PACK_ID(r1, 0x227c, &(0x7f00000003c0)) ioctl$SG_SET_RESERVED_SIZE(r2, 0x2275, &(0x7f0000000400)=0x4cbd) ioctl$SG_EMULATED_HOST(0xffffffffffffffff, 0x2203, &(0x7f0000000440)) shmctl$IPC_STAT(0xffffffffffffffff, 0x2, &(0x7f0000000480)=""/83) ioctl$SCSI_IOCTL_PROBE_HOST(r0, 0x5385, &(0x7f0000000500)={0x1d, ""/29}) syz_open_dev$sg(&(0x7f0000000540), 0x8, 0x8100) 11:40:41 executing program 4: setsockopt$inet_tcp_TCP_QUEUE_SEQ(0xffffffffffffffff, 0x6, 0x15, &(0x7f0000000000), 0x4) r0 = openat$vcsa(0xffffffffffffff9c, &(0x7f0000000040), 0x81, 0x0) setsockopt$packet_tx_ring(r0, 0x107, 0xd, &(0x7f0000000080)=@req={0x4, 0xffffffff, 0xd5, 0x5}, 0x10) setsockopt$inet_tcp_TCP_REPAIR_WINDOW(r0, 0x6, 0x1d, &(0x7f00000000c0)={0xfffffff9, 0x1, 0x7fffffff, 0x6, 0x1}, 0x14) ioctl$SCSI_IOCTL_SYNC(r0, 0x4) r1 = accept(r0, &(0x7f0000000100)=@rc={0x1f, @fixed}, &(0x7f0000000180)=0x80) setsockopt$inet_tcp_TCP_FASTOPEN_KEY(r1, 0x6, 0x21, &(0x7f00000001c0)="2a6eddb47c1ebcb5002df4f95b6a3218", 0x10) socket$inet_tcp(0x2, 0x1, 0x0) ioctl$SG_GET_VERSION_NUM(r0, 0x2282, &(0x7f0000000200)) ioctl$SCSI_IOCTL_STOP_UNIT(r0, 0x6) ioctl$sock_SIOCADDRT(r1, 0x890b, &(0x7f0000000280)={0x0, @ax25={0x3, @remote={0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0x1}, 0x3}, @can={0x1d, 0x0}, @l2={0x1f, 0x20, @any, 0x81}, 0x81, 0x0, 0x0, 0x0, 0x3, &(0x7f0000000240)='veth1_to_bond\x00', 0x1, 0x9, 0x81}) sendto$packet(r0, &(0x7f0000000300)="ef239bcbf699ea49248d932bd7a123b6dc9273af2c6c1771bbfca4377cfca4cfc8d7a0ed5b9cec2ccbbb66f69d40c744edd53168a1bdf7d412632799b3df3b80bb5e766fd2e2b373e553a501f4d1997e0a3d387642b483dca2a2bee261552bc0ec0162efa75aa5e9f1a18f050fc5d5fbaa7dceca8e90ed87643278338e74fb16fecf749ace8174d85c2b85721c1097077921541caaf6d322510105ad87d2a427ffd1689b31d399985823b2bb0abd928963c7", 0xb2, 0x4004, &(0x7f00000003c0)={0x11, 0x16, r2, 0x1, 0x6, 0x6, @local}, 0x14) r3 = syz_genetlink_get_family_id$netlbl_mgmt(&(0x7f0000000440), 0xffffffffffffffff) sendmsg$NLBL_MGMT_C_PROTOCOLS(0xffffffffffffffff, &(0x7f0000000500)={&(0x7f0000000400)={0x10, 0x0, 0x0, 0x8}, 0xc, &(0x7f00000004c0)={&(0x7f0000000480)={0x1c, r3, 0x20, 0x70bd25, 0x25dfdbfe, {}, [@NLBL_MGMT_A_CLPDOI={0x8}]}, 0x1c}, 0x1, 0x0, 0x0, 0x4084}, 0x80) r4 = syz_genetlink_get_family_id$netlbl_mgmt(&(0x7f0000000580), 0xffffffffffffffff) sendmsg$NLBL_MGMT_C_VERSION(0xffffffffffffffff, &(0x7f0000000680)={&(0x7f0000000540)={0x10, 0x0, 0x0, 0x8000205}, 0xc, &(0x7f0000000640)={&(0x7f00000005c0)={0x5c, r4, 0x8, 0x1ff, 0x25dfdbfe, {}, [@NLBL_MGMT_A_DOMAIN={0xe, 0x1, 'NLBL_MGMT\x00'}, @NLBL_MGMT_A_IPV6ADDR={0x14, 0x5, @local}, @NLBL_MGMT_A_DOMAIN={0x8, 0x1, '@@,\x00'}, @NLBL_MGMT_A_IPV6ADDR={0x14, 0x5, @loopback}, @NLBL_MGMT_A_IPV4ADDR={0x8, 0x7, @private=0xa010102}]}, 0x5c}, 0x1, 0x0, 0x0, 0x24000810}, 0x8400) syz_genetlink_get_family_id$netlbl_mgmt(&(0x7f0000000740), 0xffffffffffffffff) 11:40:41 executing program 7: r0 = syz_open_dev$sg(&(0x7f0000000000), 0x1, 0x10000) ioctl$SG_GET_PACK_ID(r0, 0x227c, &(0x7f0000000040)) ioctl$SCSI_IOCTL_DOORLOCK(r0, 0x5380) ioctl$SG_SET_KEEP_ORPHAN(r0, 0x2287, &(0x7f0000000080)=0x7) ioctl$SCSI_IOCTL_BENCHMARK_COMMAND(r0, 0x3) ioctl$SCSI_IOCTL_SYNC(r0, 0x4) ioctl$SG_SET_DEBUG(r0, 0x227e, &(0x7f00000000c0)=0x1) setsockopt$packet_add_memb(0xffffffffffffffff, 0x107, 0x1, &(0x7f0000000100)={0x0, 0x1, 0x6}, 0x10) ioctl$SG_NEXT_CMD_LEN(r0, 0x2283, &(0x7f0000000140)=0x74) ioctl$SG_GET_VERSION_NUM(r0, 0x2282, &(0x7f0000000180)) socketpair(0x1f, 0x1, 0x5, &(0x7f00000001c0)={0xffffffffffffffff, 0xffffffffffffffff}) syz_genetlink_get_family_id$batadv(&(0x7f0000000200), r2) ioctl$SCSI_IOCTL_STOP_UNIT(r0, 0x6) ioctl$sock_SIOCADDRT(r1, 0x890b, &(0x7f0000000280)={0x0, @nfc={0x27, 0x0, 0x1, 0x6}, @isdn={0x22, 0x50, 0x5, 0x7, 0x5}, @sco, 0x3, 0x0, 0x0, 0x0, 0x1, &(0x7f0000000240)='virt_wifi0\x00', 0x7fffffff, 0x7f28, 0x4}) ioctl$SG_EMULATED_HOST(0xffffffffffffffff, 0x2203, &(0x7f0000000300)) ioctl$SG_GET_PACK_ID(r0, 0x227c, &(0x7f0000000340)) accept4$packet(r1, 0x0, &(0x7f0000000380), 0x80400) openat$vcsa(0xffffffffffffff9c, &(0x7f0000000440), 0x10480, 0x0) 11:40:50 executing program 2: clock_nanosleep(0x7, 0x0, &(0x7f0000000000)={0x77359400}, &(0x7f0000000040)) getsockopt$inet6_IPV6_XFRM_POLICY(0xffffffffffffffff, 0x29, 0x23, &(0x7f0000000080)={{{@in6, @in6=@remote, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, {{@in6=@dev}, 0x0, @in=@initdev}}, &(0x7f0000000180)=0xe8) setsockopt$packet_add_memb(0xffffffffffffffff, 0x107, 0x1, &(0x7f00000001c0)={r0, 0x1, 0x6, @broadcast}, 0x10) getpeername$packet(0xffffffffffffffff, &(0x7f0000000200)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @dev}, &(0x7f0000000240)=0x14) recvmsg(0xffffffffffffffff, &(0x7f00000027c0)={&(0x7f0000000280)=@xdp={0x2c, 0x0, 0x0}, 0x80, &(0x7f0000002640)=[{&(0x7f0000000300)=""/227, 0xe3}, {&(0x7f0000000400)=""/4096, 0x1000}, {&(0x7f0000001400)=""/92, 0x5c}, {&(0x7f0000001480)=""/93, 0x5d}, {&(0x7f0000001500)=""/4096, 0x1000}, {&(0x7f0000002500)=""/87, 0x57}, {&(0x7f0000002580)=""/189, 0xbd}], 0x7, &(0x7f00000026c0)=""/199, 0xc7}, 0x140) bind$packet(0xffffffffffffffff, &(0x7f0000002800)={0x11, 0x1b, r2, 0x1, 0x5}, 0x14) getresgid(&(0x7f0000002840), &(0x7f0000002880), &(0x7f00000028c0)) r3 = accept4$packet(0xffffffffffffffff, &(0x7f0000002900)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @multicast}, &(0x7f0000002940)=0x14, 0x80000) recvfrom$packet(r3, &(0x7f0000002980)=""/4096, 0x1000, 0x0, &(0x7f0000003980)={0x11, 0x17, r2, 0x1, 0x5, 0x6, @multicast}, 0x14) r4 = socket$inet6_udp(0xa, 0x2, 0x0) getsockopt$inet6_IPV6_XFRM_POLICY(r4, 0x29, 0x23, &(0x7f00000039c0)={{{@in6=@ipv4, @in6=@private0}}, {{@in=@private}, 0x0, @in6=@remote}}, &(0x7f0000003ac0)=0xe8) r5 = openat$sr(0xffffffffffffff9c, &(0x7f0000003b00), 0x200000, 0x0) recvfrom$packet(r5, &(0x7f0000003b40)=""/161, 0xa1, 0x140, &(0x7f0000003c00)={0x11, 0x2, r1, 0x1, 0x9a, 0x6, @local}, 0x14) r6 = openat$vcsa(0xffffffffffffff9c, &(0x7f0000003c40), 0x500, 0x0) write$bt_hci(r6, &(0x7f0000003c80)={0x1, @write_current_iac_lap={{0xc3a, 0x7}, {0x6, "30a9a39c10c4"}}}, 0xb) prctl$PR_SET_MM_MAP_SIZE(0x23, 0xf, &(0x7f0000003cc0)) accept4$packet(r6, &(0x7f00000053c0)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @local}, &(0x7f0000005400)=0x14, 0x80000) bind$packet(r3, &(0x7f0000005440)={0x11, 0x1b, r7, 0x1, 0x8, 0x6, @local}, 0x14) openat$sr(0xffffffffffffff9c, &(0x7f0000005480), 0x428802, 0x0) 11:40:50 executing program 0: r0 = openat$vcsa(0xffffffffffffff9c, &(0x7f0000000000), 0x40000, 0x0) ioctl$SG_GET_PACK_ID(r0, 0x227c, &(0x7f0000000040)) r1 = openat$sr(0xffffffffffffff9c, &(0x7f0000000080), 0x454082, 0x0) ioctl$SG_SET_DEBUG(r1, 0x227e, &(0x7f00000000c0)=0x1) r2 = syz_open_dev$sg(&(0x7f0000000100), 0x8, 0x280102) ioctl$SG_GET_RESERVED_SIZE(r2, 0x2272, &(0x7f0000000140)) ioctl$SG_GET_REQUEST_TABLE(r1, 0x2286, &(0x7f0000000180)) r3 = syz_open_dev$sg(&(0x7f0000000300), 0x100000000, 0x408903) ioctl$SG_SET_RESERVED_SIZE(r3, 0x2275, &(0x7f0000000340)=0x80000000) ioctl$SG_GET_KEEP_ORPHAN(0xffffffffffffffff, 0x2288, &(0x7f0000000380)) ioctl$SG_GET_PACK_ID(r1, 0x227c, &(0x7f00000003c0)) ioctl$SG_SET_RESERVED_SIZE(r2, 0x2275, &(0x7f0000000400)=0x4cbd) ioctl$SG_EMULATED_HOST(0xffffffffffffffff, 0x2203, &(0x7f0000000440)) shmctl$IPC_STAT(0xffffffffffffffff, 0x2, &(0x7f0000000480)=""/83) syz_open_dev$sg(&(0x7f0000000540), 0x8, 0x8100) 11:40:50 executing program 7: r0 = syz_open_dev$sg(&(0x7f0000000000), 0x1, 0x10000) ioctl$SG_GET_PACK_ID(r0, 0x227c, &(0x7f0000000040)) ioctl$SCSI_IOCTL_DOORLOCK(r0, 0x5380) ioctl$SG_SET_KEEP_ORPHAN(r0, 0x2287, &(0x7f0000000080)=0x7) ioctl$SCSI_IOCTL_BENCHMARK_COMMAND(r0, 0x3) ioctl$SCSI_IOCTL_SYNC(r0, 0x4) ioctl$SG_SET_DEBUG(r0, 0x227e, &(0x7f00000000c0)=0x1) setsockopt$packet_add_memb(0xffffffffffffffff, 0x107, 0x1, &(0x7f0000000100)={0x0, 0x1, 0x6}, 0x10) ioctl$SG_NEXT_CMD_LEN(r0, 0x2283, &(0x7f0000000140)=0x74) ioctl$SG_GET_VERSION_NUM(r0, 0x2282, &(0x7f0000000180)) socketpair(0x1f, 0x1, 0x5, &(0x7f00000001c0)={0xffffffffffffffff, 0xffffffffffffffff}) syz_genetlink_get_family_id$batadv(&(0x7f0000000200), r2) ioctl$SCSI_IOCTL_STOP_UNIT(r0, 0x6) ioctl$sock_SIOCADDRT(r1, 0x890b, &(0x7f0000000280)={0x0, @nfc={0x27, 0x0, 0x1, 0x6}, @isdn={0x22, 0x50, 0x5, 0x7, 0x5}, @sco, 0x3, 0x0, 0x0, 0x0, 0x1, &(0x7f0000000240)='virt_wifi0\x00', 0x7fffffff, 0x7f28, 0x4}) ioctl$SG_EMULATED_HOST(0xffffffffffffffff, 0x2203, &(0x7f0000000300)) ioctl$SG_GET_PACK_ID(r0, 0x227c, &(0x7f0000000340)) openat$vcsa(0xffffffffffffff9c, &(0x7f0000000440), 0x10480, 0x0) 11:40:50 executing program 5: getpeername$packet(0xffffffffffffffff, &(0x7f0000000000)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @dev}, &(0x7f0000000040)=0x14) ioctl$sock_SIOCADDRT(0xffffffffffffffff, 0x890b, &(0x7f0000000080)={0x0, @phonet={0x23, 0xfe, 0x0, 0x2f}, @hci={0x1f, 0xffffffffffffffff, 0x3}, @rc={0x1f, @any, 0x2}, 0x5, 0x0, 0x0, 0x0, 0x7ff, 0x0, 0x0, 0x4, 0x4}) r0 = mmap$IORING_OFF_SQES(&(0x7f0000ffa000/0x4000)=nil, 0x4000, 0x1000004, 0x810, 0xffffffffffffffff, 0x10000000) syz_io_uring_submit(0x0, r0, &(0x7f0000000100)=@IORING_OP_MADVISE={0x19, 0x3, 0x0, 0x0, 0x0, &(0x7f0000ffa000/0x2000)=nil, 0x2000, 0xb, 0x1}, 0x8) r1 = syz_genetlink_get_family_id$mptcp(&(0x7f0000000180), 0xffffffffffffffff) sendmsg$MPTCP_PM_CMD_ADD_ADDR(0xffffffffffffffff, &(0x7f0000000240)={&(0x7f0000000140)={0x10, 0x0, 0x0, 0x10000}, 0xc, &(0x7f0000000200)={&(0x7f00000001c0)={0x24, r1, 0x800, 0x70bd27, 0x25dfdbfd, {}, [@MPTCP_PM_ATTR_RCV_ADD_ADDRS={0x8, 0x2, 0x8}, @MPTCP_PM_ATTR_RCV_ADD_ADDRS={0x8, 0x2, 0x6}]}, 0x24}, 0x1, 0x0, 0x0, 0x2400c096}, 0x80) sendmsg$MPTCP_PM_CMD_FLUSH_ADDRS(0xffffffffffffffff, &(0x7f00000003c0)={&(0x7f0000000280)={0x10, 0x0, 0x0, 0x40}, 0xc, &(0x7f0000000380)={&(0x7f00000002c0)={0xa4, r1, 0x200, 0x70bd25, 0x25dfdbff, {}, [@MPTCP_PM_ATTR_RCV_ADD_ADDRS={0x8, 0x2, 0x3}, @MPTCP_PM_ATTR_ADDR={0x30, 0x1, 0x0, 0x1, [@MPTCP_PM_ADDR_ATTR_ADDR6={0x14, 0x4, @initdev={0xfe, 0x88, '\x00', 0x0, 0x0}}, @MPTCP_PM_ADDR_ATTR_ADDR4={0x8, 0x3, @local}, @MPTCP_PM_ADDR_ATTR_FLAGS={0x8, 0x6, 0x2}, @MPTCP_PM_ADDR_ATTR_FAMILY={0x6, 0x1, 0xa}]}, @MPTCP_PM_ATTR_ADDR={0x2c, 0x1, 0x0, 0x1, [@MPTCP_PM_ADDR_ATTR_ID={0x5, 0x2, 0x81}, @MPTCP_PM_ADDR_ATTR_PORT={0x6, 0x5, 0x4e22}, @MPTCP_PM_ADDR_ATTR_FAMILY={0x6, 0x1, 0xa}, @MPTCP_PM_ADDR_ATTR_FLAGS={0x8}, @MPTCP_PM_ADDR_ATTR_ID={0x5, 0x2, 0x40}]}, @MPTCP_PM_ATTR_SUBFLOWS={0x8, 0x3, 0x5}, @MPTCP_PM_ATTR_SUBFLOWS={0x8, 0x3, 0x5}, @MPTCP_PM_ATTR_ADDR={0x14, 0x1, 0x0, 0x1, [@MPTCP_PM_ADDR_ATTR_PORT={0x6, 0x5, 0x4e23}, @MPTCP_PM_ADDR_ATTR_PORT={0x6, 0x5, 0x4e21}]}, @MPTCP_PM_ATTR_SUBFLOWS={0x8, 0x3, 0x2}]}, 0xa4}, 0x1, 0x0, 0x0, 0x40}, 0x90) r2 = syz_open_dev$sg(&(0x7f0000000400), 0x4, 0x38040) ioctl$SCSI_IOCTL_DOORUNLOCK(r2, 0x5381) r3 = accept$packet(0xffffffffffffffff, &(0x7f0000000440), &(0x7f0000000480)=0x14) syz_io_uring_submit(0x0, r0, &(0x7f00000004c0)=@IORING_OP_ASYNC_CANCEL={0xe, 0x1, 0x0, 0x0, 0x0, 0x23456}, 0x5) accept4$packet(r3, &(0x7f0000000500), &(0x7f0000000540)=0x14, 0x800) r4 = openat$vcsa(0xffffffffffffff9c, &(0x7f0000000580), 0x121080, 0x0) ioctl$SG_SET_FORCE_PACK_ID(r4, 0x227b, &(0x7f00000005c0)) sendmsg$MPTCP_PM_CMD_GET_ADDR(r4, &(0x7f0000000740)={&(0x7f0000000600)={0x10, 0x0, 0x0, 0x40000000}, 0xc, &(0x7f0000000700)={&(0x7f0000000640)={0xa8, r1, 0x4, 0x70bd2a, 0x25dfdbfe, {}, [@MPTCP_PM_ATTR_ADDR={0x44, 0x1, 0x0, 0x1, [@MPTCP_PM_ADDR_ATTR_ID={0x5, 0x2, 0x6}, @MPTCP_PM_ADDR_ATTR_ID={0x5, 0x2, 0x2}, @MPTCP_PM_ADDR_ATTR_ADDR6={0x14, 0x4, @dev={0xfe, 0x80, '\x00', 0x17}}, @MPTCP_PM_ADDR_ATTR_ADDR6={0x14, 0x4, @remote}, @MPTCP_PM_ADDR_ATTR_FLAGS={0x8, 0x6, 0x2}]}, @MPTCP_PM_ATTR_SUBFLOWS={0x8, 0x3, 0x7}, @MPTCP_PM_ATTR_ADDR={0x14, 0x1, 0x0, 0x1, [@MPTCP_PM_ADDR_ATTR_FAMILY={0x6, 0x1, 0x2}, @MPTCP_PM_ADDR_ATTR_FAMILY={0x6, 0x1, 0x2}]}, @MPTCP_PM_ATTR_RCV_ADD_ADDRS={0x8, 0x2, 0x3}, @MPTCP_PM_ATTR_RCV_ADD_ADDRS={0x8, 0x2, 0x6}, @MPTCP_PM_ATTR_RCV_ADD_ADDRS={0x8, 0x2, 0x1}, @MPTCP_PM_ATTR_ADDR={0xc, 0x1, 0x0, 0x1, [@MPTCP_PM_ADDR_ATTR_FLAGS={0x8, 0x6, 0x3}]}, @MPTCP_PM_ATTR_RCV_ADD_ADDRS={0x8, 0x2, 0x5}, @MPTCP_PM_ATTR_SUBFLOWS={0x8, 0x3, 0x1}]}, 0xa8}, 0x1, 0x0, 0x0, 0x804}, 0x408c1) setsockopt$inet6_tcp_TCP_QUEUE_SEQ(r4, 0x6, 0x15, &(0x7f0000000780)=0x400, 0x4) 11:40:50 executing program 4: setsockopt$inet_tcp_TCP_QUEUE_SEQ(0xffffffffffffffff, 0x6, 0x15, &(0x7f0000000000), 0x4) r0 = openat$vcsa(0xffffffffffffff9c, &(0x7f0000000040), 0x81, 0x0) setsockopt$packet_tx_ring(r0, 0x107, 0xd, &(0x7f0000000080)=@req={0x4, 0xffffffff, 0xd5, 0x5}, 0x10) setsockopt$inet_tcp_TCP_REPAIR_WINDOW(r0, 0x6, 0x1d, &(0x7f00000000c0)={0xfffffff9, 0x1, 0x7fffffff, 0x6, 0x1}, 0x14) ioctl$SCSI_IOCTL_SYNC(r0, 0x4) r1 = accept(r0, &(0x7f0000000100)=@rc={0x1f, @fixed}, &(0x7f0000000180)=0x80) setsockopt$inet_tcp_TCP_FASTOPEN_KEY(r1, 0x6, 0x21, &(0x7f00000001c0)="2a6eddb47c1ebcb5002df4f95b6a3218", 0x10) socket$inet_tcp(0x2, 0x1, 0x0) ioctl$SG_GET_VERSION_NUM(r0, 0x2282, &(0x7f0000000200)) ioctl$SCSI_IOCTL_STOP_UNIT(r0, 0x6) ioctl$sock_SIOCADDRT(r1, 0x890b, &(0x7f0000000280)={0x0, @ax25={0x3, @remote={0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0x1}, 0x3}, @can={0x1d, 0x0}, @l2={0x1f, 0x20, @any, 0x81}, 0x81, 0x0, 0x0, 0x0, 0x3, &(0x7f0000000240)='veth1_to_bond\x00', 0x1, 0x9, 0x81}) sendto$packet(r0, &(0x7f0000000300)="ef239bcbf699ea49248d932bd7a123b6dc9273af2c6c1771bbfca4377cfca4cfc8d7a0ed5b9cec2ccbbb66f69d40c744edd53168a1bdf7d412632799b3df3b80bb5e766fd2e2b373e553a501f4d1997e0a3d387642b483dca2a2bee261552bc0ec0162efa75aa5e9f1a18f050fc5d5fbaa7dceca8e90ed87643278338e74fb16fecf749ace8174d85c2b85721c1097077921541caaf6d322510105ad87d2a427ffd1689b31d399985823b2bb0abd928963c7", 0xb2, 0x4004, &(0x7f00000003c0)={0x11, 0x16, r2, 0x1, 0x6, 0x6, @local}, 0x14) r3 = syz_genetlink_get_family_id$netlbl_mgmt(&(0x7f0000000440), 0xffffffffffffffff) sendmsg$NLBL_MGMT_C_PROTOCOLS(0xffffffffffffffff, &(0x7f0000000500)={&(0x7f0000000400)={0x10, 0x0, 0x0, 0x8}, 0xc, &(0x7f00000004c0)={&(0x7f0000000480)={0x1c, r3, 0x20, 0x70bd25, 0x25dfdbfe, {}, [@NLBL_MGMT_A_CLPDOI={0x8}]}, 0x1c}, 0x1, 0x0, 0x0, 0x4084}, 0x80) syz_genetlink_get_family_id$netlbl_mgmt(&(0x7f0000000580), 0xffffffffffffffff) syz_genetlink_get_family_id$netlbl_mgmt(&(0x7f0000000740), 0xffffffffffffffff) 11:40:50 executing program 3: ioctl$SG_SET_FORCE_PACK_ID(0xffffffffffffffff, 0x227b, &(0x7f0000000000)=0x1) ioctl$SG_SET_FORCE_PACK_ID(0xffffffffffffffff, 0x227b, &(0x7f0000000040)) ioctl$SG_GET_RESERVED_SIZE(0xffffffffffffffff, 0x2272, &(0x7f0000000080)) r0 = openat$vcsa(0xffffffffffffff9c, &(0x7f00000000c0), 0x4200, 0x0) ioctl$SCSI_IOCTL_SEND_COMMAND(r0, 0x1, &(0x7f0000000100)={0x17, 0x3, 0x1c00, "af36a59fb168d324fd8eaf833aeb82f60d75e8700d81d9"}) ioctl$SG_SET_TIMEOUT(r0, 0x2201, &(0x7f0000000140)=0x4) ioctl$SG_GET_VERSION_NUM(r0, 0x2282, &(0x7f0000000180)) ioctl$SG_GET_REQUEST_TABLE(r0, 0x2286, &(0x7f00000001c0)) ioctl$SG_GET_TIMEOUT(r0, 0x2202, 0x0) r1 = syz_open_dev$sg(&(0x7f0000000340), 0x7fff, 0x40) ioctl$SG_EMULATED_HOST(r1, 0x2203, &(0x7f0000000380)) r2 = openat$vcsa(0xffffffffffffff9c, &(0x7f00000003c0), 0x8103, 0x0) ioctl$SG_GET_COMMAND_Q(r2, 0x2270, &(0x7f0000000400)) r3 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$inet6_tcp_TCP_CONGESTION(r3, 0x6, 0xd, &(0x7f0000000440)='scalable\x00', 0x9) ioctl$SCSI_IOCTL_GET_IDLUN(r2, 0x5382, &(0x7f0000000480)) ioctl$SECCOMP_IOCTL_NOTIF_ADDFD(r2, 0x40182103, &(0x7f00000004c0)={0x0, 0x0, r0, 0x7}) 11:40:50 executing program 1: r0 = shmget(0x2, 0x3000, 0x100, &(0x7f0000ffb000/0x3000)=nil) shmat(r0, &(0x7f0000ffa000/0x3000)=nil, 0x2000) shmat(r0, &(0x7f0000ffa000/0x4000)=nil, 0x3000) r1 = shmget(0x3, 0x1000, 0x100, &(0x7f0000ffd000/0x1000)=nil) r2 = syz_genetlink_get_family_id$netlbl_mgmt(&(0x7f0000000040), 0xffffffffffffffff) sendmsg$NLBL_MGMT_C_REMOVEDEF(0xffffffffffffffff, &(0x7f0000000100)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x8}, 0xc, &(0x7f00000000c0)={&(0x7f0000000080)={0x3c, r2, 0x20, 0x70bd29, 0x25dfdbff, {}, [@NLBL_MGMT_A_FAMILY={0x6, 0xb, 0x5}, @NLBL_MGMT_A_PROTOCOL={0x8, 0x2, 0x3}, @NLBL_MGMT_A_IPV4MASK={0x8, 0x8, @multicast1}, @NLBL_MGMT_A_CLPDOI={0x8}, @NLBL_MGMT_A_IPV4ADDR={0x8, 0x7, @local}]}, 0x3c}, 0x1, 0x0, 0x0, 0x4048820}, 0x40000) shmat(0xffffffffffffffff, &(0x7f0000ffb000/0x4000)=nil, 0x2000) r3 = shmget(0x0, 0xf000, 0x100, &(0x7f0000ff1000/0xf000)=nil) shmctl$IPC_RMID(r3, 0x0) r4 = mmap$IORING_OFF_SQ_RING(&(0x7f0000ffd000/0x1000)=nil, 0x1000, 0x2000006, 0x40010, 0xffffffffffffffff, 0x0) syz_io_uring_submit(r4, 0x0, &(0x7f00000001c0)=@IORING_OP_PROVIDE_BUFFERS={0x1f, 0x1, 0x0, 0x8, 0x2, &(0x7f0000000140)="10e8e6d73f8e97a04564912d4b0bee6921be05ed083e4d741dabdbce8c94949f57a5c9d9da73d0e5ad668714159e31498f181aad79547c645eefb456a7b8c4be765eb156b77cba8a752b90d7729b2c285893a10c3633d2485f48f30d247214c5e28a", 0x7, 0x0, 0x1, {0x1}}, 0x100) r5 = socket(0x2c, 0x5, 0x1) accept4$packet(0xffffffffffffffff, &(0x7f0000000280)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @random}, &(0x7f00000002c0)=0x14, 0x40000) recvfrom$packet(r5, &(0x7f0000000200)=""/108, 0x6c, 0x2000, &(0x7f0000000300)={0x11, 0x16, r6, 0x1, 0x8, 0x6, @local}, 0x14) r7 = syz_genetlink_get_family_id$netlbl_mgmt(&(0x7f0000000380), 0xffffffffffffffff) sendmsg$NLBL_MGMT_C_REMOVEDEF(0xffffffffffffffff, &(0x7f0000000440)={&(0x7f0000000340)={0x10, 0x0, 0x0, 0x4}, 0xc, &(0x7f0000000400)={&(0x7f00000003c0)={0x24, r7, 0x400, 0x70bd26, 0x25dfdbfc, {}, [@NLBL_MGMT_A_FAMILY={0x6, 0xb, 0x18}, @NLBL_MGMT_A_PROTOCOL={0x8, 0x2, 0x3}]}, 0x24}, 0x1, 0x0, 0x0, 0x48084}, 0x8040) io_uring_setup(0x14ab, &(0x7f0000000480)={0x0, 0x5191, 0x20, 0x1, 0x3ba}) shmctl$IPC_INFO(r1, 0x3, &(0x7f0000000500)=""/203) shmget$private(0x0, 0x2000, 0x10, &(0x7f0000ffc000/0x2000)=nil) 11:40:50 executing program 6: ioprio_set$uid(0x0, 0xee01, 0x4004) syz_mount_image$msdos(&(0x7f0000000000), &(0x7f0000000040)='./file0\x00', 0x200, 0x1, &(0x7f00000000c0)=[{&(0x7f0000000080)="7c74c7bc99e778a0c971e6f50fbdd2b70fa0b038d18c7d5ac685833434d89dce684239293aa5d8b6f11bc5c4a033ad1dc68319fad36a1101aad751fd6f4f10", 0x3f, 0x7f}], 0x42000, &(0x7f0000000100)={[{@dots}], [{@obj_user}, {@dont_appraise}, {@uid_lt}, {@hash}, {@seclabel}]}) getsockopt$inet6_IPV6_XFRM_POLICY(0xffffffffffffffff, 0x29, 0x23, &(0x7f0000000240)={{{@in=@loopback, @in6=@empty, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, {{@in6=@local}, 0x0, @in6=@mcast1}}, &(0x7f0000000340)=0xe8) mount$9p_xen(&(0x7f0000000180), &(0x7f00000001c0)='./file0\x00', &(0x7f0000000200), 0x1121061, &(0x7f0000000380)={'trans=xen,', {[{@msize={'msize', 0x3d, 0xf6b3}}, {@debug={'debug', 0x3d, 0x7ff}}, {@posixacl}, {@aname={'aname', 0x3d, '*$-&'}}, {@uname={'uname', 0x3d, 'msdos\x00'}}], [{@seclabel}, {@euid_eq={'euid', 0x3d, r0}}, {@permit_directio}, {@appraise_type}]}}) r1 = syz_io_uring_setup(0x1d4a, &(0x7f0000000440)={0x0, 0xfa85, 0x0, 0x0, 0x285}, &(0x7f0000ffd000/0x1000)=nil, &(0x7f0000ffd000/0x2000)=nil, &(0x7f00000004c0)=0x0, &(0x7f0000000500)) syz_io_uring_setup(0x3e5e, &(0x7f0000000540)={0x0, 0x5c61, 0x8, 0x2, 0x72}, &(0x7f0000ffd000/0x3000)=nil, &(0x7f0000ffc000/0x3000)=nil, &(0x7f00000005c0), &(0x7f0000000600)=0x0) syz_io_uring_submit(r2, r3, &(0x7f0000000740)=@IORING_OP_READ=@pass_buffer={0x16, 0x1, 0x2004, @fd_index=0xa, 0x7, &(0x7f0000000640)=""/227, 0xe3, 0xc, 0x1}, 0x9) ioctl$SECCOMP_IOCTL_NOTIF_ADDFD(0xffffffffffffffff, 0x40182103, &(0x7f0000000780)={0x0, 0x4, r1, 0x9, 0x80000}) openat$cgroup_devices(0xffffffffffffffff, &(0x7f00000007c0)='devices.allow\x00', 0x2, 0x0) syz_mount_image$nfs4(&(0x7f0000000800), &(0x7f0000000840)='./file0/file0\x00', 0xffffffffffffff01, 0x1, &(0x7f0000000900)=[{&(0x7f0000000880)="f19bd7cfef39dd2070dcb194f7bd90ce305e2a9644b9fb91cc1e75bca69ed6bbdd7636452963af395ea61189cce718ef43420310b6ff8db9f4a606d67217b1aa7bf6e1435682323aef92ef40d036c48fa3fc363c6ad63229bb37cd76a6db9879a39f", 0x62, 0x6}], 0x8400, &(0x7f0000000940)={[{'*+\\['}]}) r4 = accept(0xffffffffffffffff, 0x0, &(0x7f0000000980)) sendmsg$MPTCP_PM_CMD_GET_LIMITS(r4, &(0x7f0000000ac0)={&(0x7f00000009c0)={0x10, 0x0, 0x0, 0x200}, 0xc, &(0x7f0000000a80)={&(0x7f0000000a00)={0x74, 0x0, 0x200, 0x70bd27, 0x25dfdbfd, {}, [@MPTCP_PM_ATTR_RCV_ADD_ADDRS={0x8, 0x2, 0x8}, @MPTCP_PM_ATTR_RCV_ADD_ADDRS={0x8, 0x2, 0x2}, @MPTCP_PM_ATTR_SUBFLOWS={0x8, 0x3, 0x6}, @MPTCP_PM_ATTR_ADDR={0x3c, 0x1, 0x0, 0x1, [@MPTCP_PM_ADDR_ATTR_PORT={0x6, 0x5, 0x4e20}, @MPTCP_PM_ADDR_ATTR_ID={0x5, 0x2, 0x5}, @MPTCP_PM_ADDR_ATTR_FLAGS={0x8, 0x6, 0x3}, @MPTCP_PM_ADDR_ATTR_PORT={0x6, 0x5, 0x4e23}, @MPTCP_PM_ADDR_ATTR_FAMILY={0x6}, @MPTCP_PM_ADDR_ATTR_FAMILY={0x6, 0x1, 0xa}, @MPTCP_PM_ADDR_ATTR_FAMILY={0x6, 0x1, 0xa}]}, @MPTCP_PM_ATTR_ADDR={0x4}, @MPTCP_PM_ATTR_SUBFLOWS={0x8}]}, 0x74}, 0x1, 0x0, 0x0, 0x11}, 0x80) sendmsg$IEEE802154_LLSEC_DEL_SECLEVEL(0xffffffffffffffff, &(0x7f0000000bc0)={&(0x7f0000000b00)={0x10, 0x0, 0x0, 0x800000}, 0xc, &(0x7f0000000b80)={&(0x7f0000000b40)={0x2c, 0x0, 0x800, 0x70bd27, 0x25dfdbff, {}, [@IEEE802154_ATTR_DEV_INDEX={0x8}, @IEEE802154_ATTR_LLSEC_FRAME_TYPE={0x5, 0x33, 0x81}, @IEEE802154_ATTR_DEV_INDEX={0x8}]}, 0x2c}, 0x1, 0x0, 0x0, 0x4}, 0x2) socketpair(0x15, 0x1, 0x10001, &(0x7f0000000c00)={0xffffffffffffffff, 0xffffffffffffffff}) sendmsg$BATADV_CMD_TP_METER_CANCEL(r5, &(0x7f0000000d00)={&(0x7f0000000c40)={0x10, 0x0, 0x0, 0x8}, 0xc, &(0x7f0000000cc0)={&(0x7f0000000c80)={0x3c, 0x0, 0x1, 0x70bd2b, 0x25dfdbfc, {}, [@BATADV_ATTR_GW_BANDWIDTH_DOWN={0x8, 0x31, 0x4}, @BATADV_ATTR_ORIG_INTERVAL={0x8, 0x39, 0x5}, @BATADV_ATTR_ISOLATION_MASK={0x8, 0x2c, 0x80000}, @BATADV_ATTR_ISOLATION_MASK={0x8, 0x2c, 0x9}, @BATADV_ATTR_GW_MODE={0x5, 0x33, 0x1}]}, 0x3c}, 0x1, 0x0, 0x0, 0x4080}, 0x40000) socketpair(0xf, 0x6, 0x2, &(0x7f0000000d40)) accept(r6, &(0x7f0000000d80)=@ax25={{0x3, @default}, [@netrom, @rose, @netrom, @bcast, @bcast, @rose, @default, @bcast]}, &(0x7f0000000e00)=0x80) mount$9p_rdma(&(0x7f0000001040), &(0x7f0000001080)='./file0\x00', &(0x7f00000010c0), 0xa00800, &(0x7f0000001100)={'trans=rdma,', {'port', 0x3d, 0x4e20}, 0x2c, {[{@common=@aname={'aname', 0x3d, 'permit_directio'}}, {@sq={'sq', 0x3d, 0xffff}}], [{@fscontext={'fscontext', 0x3d, 'staff_u'}}]}}) [ 143.179686] loop6: detected capacity change from 0 to 1 [ 143.240868] loop6: detected capacity change from 0 to 264192 [ 143.257196] nfs4: Unknown parameter '*+\[' 11:40:50 executing program 0: r0 = openat$vcsa(0xffffffffffffff9c, &(0x7f0000000000), 0x40000, 0x0) ioctl$SG_GET_PACK_ID(r0, 0x227c, &(0x7f0000000040)) r1 = openat$sr(0xffffffffffffff9c, &(0x7f0000000080), 0x454082, 0x0) ioctl$SG_SET_DEBUG(r1, 0x227e, &(0x7f00000000c0)=0x1) r2 = syz_open_dev$sg(&(0x7f0000000100), 0x8, 0x280102) ioctl$SG_GET_RESERVED_SIZE(r2, 0x2272, &(0x7f0000000140)) ioctl$SG_GET_REQUEST_TABLE(r1, 0x2286, &(0x7f0000000180)) r3 = syz_open_dev$sg(&(0x7f0000000300), 0x100000000, 0x408903) ioctl$SG_SET_RESERVED_SIZE(r3, 0x2275, &(0x7f0000000340)=0x80000000) ioctl$SG_GET_KEEP_ORPHAN(0xffffffffffffffff, 0x2288, &(0x7f0000000380)) ioctl$SG_GET_PACK_ID(r1, 0x227c, &(0x7f00000003c0)) ioctl$SG_SET_RESERVED_SIZE(r2, 0x2275, &(0x7f0000000400)=0x4cbd) ioctl$SG_EMULATED_HOST(0xffffffffffffffff, 0x2203, &(0x7f0000000440)) syz_open_dev$sg(&(0x7f0000000540), 0x8, 0x8100) 11:40:50 executing program 4: setsockopt$inet_tcp_TCP_QUEUE_SEQ(0xffffffffffffffff, 0x6, 0x15, &(0x7f0000000000), 0x4) r0 = openat$vcsa(0xffffffffffffff9c, &(0x7f0000000040), 0x81, 0x0) setsockopt$packet_tx_ring(r0, 0x107, 0xd, &(0x7f0000000080)=@req={0x4, 0xffffffff, 0xd5, 0x5}, 0x10) setsockopt$inet_tcp_TCP_REPAIR_WINDOW(r0, 0x6, 0x1d, &(0x7f00000000c0)={0xfffffff9, 0x1, 0x7fffffff, 0x6, 0x1}, 0x14) ioctl$SCSI_IOCTL_SYNC(r0, 0x4) r1 = accept(r0, &(0x7f0000000100)=@rc={0x1f, @fixed}, &(0x7f0000000180)=0x80) setsockopt$inet_tcp_TCP_FASTOPEN_KEY(r1, 0x6, 0x21, &(0x7f00000001c0)="2a6eddb47c1ebcb5002df4f95b6a3218", 0x10) socket$inet_tcp(0x2, 0x1, 0x0) ioctl$SG_GET_VERSION_NUM(r0, 0x2282, &(0x7f0000000200)) ioctl$SCSI_IOCTL_STOP_UNIT(r0, 0x6) ioctl$sock_SIOCADDRT(r1, 0x890b, &(0x7f0000000280)={0x0, @ax25={0x3, @remote={0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0x1}, 0x3}, @can={0x1d, 0x0}, @l2={0x1f, 0x20, @any, 0x81}, 0x81, 0x0, 0x0, 0x0, 0x3, &(0x7f0000000240)='veth1_to_bond\x00', 0x1, 0x9, 0x81}) sendto$packet(r0, &(0x7f0000000300)="ef239bcbf699ea49248d932bd7a123b6dc9273af2c6c1771bbfca4377cfca4cfc8d7a0ed5b9cec2ccbbb66f69d40c744edd53168a1bdf7d412632799b3df3b80bb5e766fd2e2b373e553a501f4d1997e0a3d387642b483dca2a2bee261552bc0ec0162efa75aa5e9f1a18f050fc5d5fbaa7dceca8e90ed87643278338e74fb16fecf749ace8174d85c2b85721c1097077921541caaf6d322510105ad87d2a427ffd1689b31d399985823b2bb0abd928963c7", 0xb2, 0x4004, &(0x7f00000003c0)={0x11, 0x16, r2, 0x1, 0x6, 0x6, @local}, 0x14) r3 = syz_genetlink_get_family_id$netlbl_mgmt(&(0x7f0000000440), 0xffffffffffffffff) sendmsg$NLBL_MGMT_C_PROTOCOLS(0xffffffffffffffff, &(0x7f0000000500)={&(0x7f0000000400)={0x10, 0x0, 0x0, 0x8}, 0xc, &(0x7f00000004c0)={&(0x7f0000000480)={0x1c, r3, 0x20, 0x70bd25, 0x25dfdbfe, {}, [@NLBL_MGMT_A_CLPDOI={0x8}]}, 0x1c}, 0x1, 0x0, 0x0, 0x4084}, 0x80) syz_genetlink_get_family_id$netlbl_mgmt(&(0x7f0000000740), 0xffffffffffffffff) 11:40:50 executing program 5: getpeername$packet(0xffffffffffffffff, &(0x7f0000000000)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @dev}, &(0x7f0000000040)=0x14) ioctl$sock_SIOCADDRT(0xffffffffffffffff, 0x890b, &(0x7f0000000080)={0x0, @phonet={0x23, 0xfe, 0x0, 0x2f}, @hci={0x1f, 0xffffffffffffffff, 0x3}, @rc={0x1f, @any, 0x2}, 0x5, 0x0, 0x0, 0x0, 0x7ff, 0x0, 0x0, 0x4, 0x4}) r0 = mmap$IORING_OFF_SQES(&(0x7f0000ffa000/0x4000)=nil, 0x4000, 0x1000004, 0x810, 0xffffffffffffffff, 0x10000000) syz_io_uring_submit(0x0, r0, &(0x7f0000000100)=@IORING_OP_MADVISE={0x19, 0x3, 0x0, 0x0, 0x0, &(0x7f0000ffa000/0x2000)=nil, 0x2000, 0xb, 0x1}, 0x8) r1 = syz_genetlink_get_family_id$mptcp(&(0x7f0000000180), 0xffffffffffffffff) sendmsg$MPTCP_PM_CMD_ADD_ADDR(0xffffffffffffffff, &(0x7f0000000240)={&(0x7f0000000140)={0x10, 0x0, 0x0, 0x10000}, 0xc, &(0x7f0000000200)={&(0x7f00000001c0)={0x24, r1, 0x800, 0x70bd27, 0x25dfdbfd, {}, [@MPTCP_PM_ATTR_RCV_ADD_ADDRS={0x8, 0x2, 0x8}, @MPTCP_PM_ATTR_RCV_ADD_ADDRS={0x8, 0x2, 0x6}]}, 0x24}, 0x1, 0x0, 0x0, 0x2400c096}, 0x80) sendmsg$MPTCP_PM_CMD_FLUSH_ADDRS(0xffffffffffffffff, &(0x7f00000003c0)={&(0x7f0000000280)={0x10, 0x0, 0x0, 0x40}, 0xc, &(0x7f0000000380)={&(0x7f00000002c0)={0xa4, r1, 0x200, 0x70bd25, 0x25dfdbff, {}, [@MPTCP_PM_ATTR_RCV_ADD_ADDRS={0x8, 0x2, 0x3}, @MPTCP_PM_ATTR_ADDR={0x30, 0x1, 0x0, 0x1, [@MPTCP_PM_ADDR_ATTR_ADDR6={0x14, 0x4, @initdev={0xfe, 0x88, '\x00', 0x0, 0x0}}, @MPTCP_PM_ADDR_ATTR_ADDR4={0x8, 0x3, @local}, @MPTCP_PM_ADDR_ATTR_FLAGS={0x8, 0x6, 0x2}, @MPTCP_PM_ADDR_ATTR_FAMILY={0x6, 0x1, 0xa}]}, @MPTCP_PM_ATTR_ADDR={0x2c, 0x1, 0x0, 0x1, [@MPTCP_PM_ADDR_ATTR_ID={0x5, 0x2, 0x81}, @MPTCP_PM_ADDR_ATTR_PORT={0x6, 0x5, 0x4e22}, @MPTCP_PM_ADDR_ATTR_FAMILY={0x6, 0x1, 0xa}, @MPTCP_PM_ADDR_ATTR_FLAGS={0x8}, @MPTCP_PM_ADDR_ATTR_ID={0x5, 0x2, 0x40}]}, @MPTCP_PM_ATTR_SUBFLOWS={0x8, 0x3, 0x5}, @MPTCP_PM_ATTR_SUBFLOWS={0x8, 0x3, 0x5}, @MPTCP_PM_ATTR_ADDR={0x14, 0x1, 0x0, 0x1, [@MPTCP_PM_ADDR_ATTR_PORT={0x6, 0x5, 0x4e23}, @MPTCP_PM_ADDR_ATTR_PORT={0x6, 0x5, 0x4e21}]}, @MPTCP_PM_ATTR_SUBFLOWS={0x8, 0x3, 0x2}]}, 0xa4}, 0x1, 0x0, 0x0, 0x40}, 0x90) r2 = syz_open_dev$sg(&(0x7f0000000400), 0x4, 0x38040) ioctl$SCSI_IOCTL_DOORUNLOCK(r2, 0x5381) r3 = accept$packet(0xffffffffffffffff, &(0x7f0000000440), &(0x7f0000000480)=0x14) syz_io_uring_submit(0x0, r0, &(0x7f00000004c0)=@IORING_OP_ASYNC_CANCEL={0xe, 0x1, 0x0, 0x0, 0x0, 0x23456}, 0x5) accept4$packet(r3, &(0x7f0000000500), &(0x7f0000000540)=0x14, 0x800) r4 = openat$vcsa(0xffffffffffffff9c, &(0x7f0000000580), 0x121080, 0x0) ioctl$SG_SET_FORCE_PACK_ID(r4, 0x227b, &(0x7f00000005c0)) setsockopt$inet6_tcp_TCP_QUEUE_SEQ(r4, 0x6, 0x15, &(0x7f0000000780)=0x400, 0x4) [ 143.377507] SELinux: security_context_str_to_sid (staff_u) failed with errno=-22 11:40:50 executing program 7: r0 = syz_open_dev$sg(&(0x7f0000000000), 0x1, 0x10000) ioctl$SG_GET_PACK_ID(r0, 0x227c, &(0x7f0000000040)) ioctl$SCSI_IOCTL_DOORLOCK(r0, 0x5380) ioctl$SG_SET_KEEP_ORPHAN(r0, 0x2287, &(0x7f0000000080)=0x7) ioctl$SCSI_IOCTL_BENCHMARK_COMMAND(r0, 0x3) ioctl$SCSI_IOCTL_SYNC(r0, 0x4) ioctl$SG_SET_DEBUG(r0, 0x227e, &(0x7f00000000c0)=0x1) setsockopt$packet_add_memb(0xffffffffffffffff, 0x107, 0x1, &(0x7f0000000100)={0x0, 0x1, 0x6}, 0x10) ioctl$SG_NEXT_CMD_LEN(r0, 0x2283, &(0x7f0000000140)=0x74) ioctl$SG_GET_VERSION_NUM(r0, 0x2282, &(0x7f0000000180)) socketpair(0x1f, 0x1, 0x5, &(0x7f00000001c0)={0xffffffffffffffff, 0xffffffffffffffff}) syz_genetlink_get_family_id$batadv(&(0x7f0000000200), r2) ioctl$SCSI_IOCTL_STOP_UNIT(r0, 0x6) ioctl$sock_SIOCADDRT(r1, 0x890b, &(0x7f0000000280)={0x0, @nfc={0x27, 0x0, 0x1, 0x6}, @isdn={0x22, 0x50, 0x5, 0x7, 0x5}, @sco, 0x3, 0x0, 0x0, 0x0, 0x1, &(0x7f0000000240)='virt_wifi0\x00', 0x7fffffff, 0x7f28, 0x4}) ioctl$SG_EMULATED_HOST(0xffffffffffffffff, 0x2203, &(0x7f0000000300)) openat$vcsa(0xffffffffffffff9c, &(0x7f0000000440), 0x10480, 0x0) 11:40:50 executing program 3: ioctl$SG_SET_FORCE_PACK_ID(0xffffffffffffffff, 0x227b, &(0x7f0000000000)=0x1) ioctl$SG_SET_FORCE_PACK_ID(0xffffffffffffffff, 0x227b, &(0x7f0000000040)) ioctl$SG_GET_RESERVED_SIZE(0xffffffffffffffff, 0x2272, &(0x7f0000000080)) r0 = openat$vcsa(0xffffffffffffff9c, &(0x7f00000000c0), 0x4200, 0x0) ioctl$SCSI_IOCTL_SEND_COMMAND(r0, 0x1, &(0x7f0000000100)={0x17, 0x3, 0x1c00, "af36a59fb168d324fd8eaf833aeb82f60d75e8700d81d9"}) ioctl$SG_SET_TIMEOUT(r0, 0x2201, &(0x7f0000000140)=0x4) ioctl$SG_GET_VERSION_NUM(r0, 0x2282, &(0x7f0000000180)) ioctl$SG_GET_REQUEST_TABLE(r0, 0x2286, &(0x7f00000001c0)) ioctl$SG_GET_TIMEOUT(r0, 0x2202, 0x0) r1 = syz_open_dev$sg(&(0x7f0000000340), 0x7fff, 0x40) ioctl$SG_EMULATED_HOST(r1, 0x2203, &(0x7f0000000380)) r2 = openat$vcsa(0xffffffffffffff9c, &(0x7f00000003c0), 0x8103, 0x0) ioctl$SG_GET_COMMAND_Q(r2, 0x2270, &(0x7f0000000400)) r3 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$inet6_tcp_TCP_CONGESTION(r3, 0x6, 0xd, &(0x7f0000000440)='scalable\x00', 0x9) ioctl$SCSI_IOCTL_GET_IDLUN(r2, 0x5382, &(0x7f0000000480)) 11:40:50 executing program 1: r0 = shmget(0x2, 0x3000, 0x100, &(0x7f0000ffb000/0x3000)=nil) shmat(r0, &(0x7f0000ffa000/0x3000)=nil, 0x2000) shmat(r0, &(0x7f0000ffa000/0x4000)=nil, 0x3000) shmget(0x3, 0x1000, 0x100, &(0x7f0000ffd000/0x1000)=nil) r1 = syz_genetlink_get_family_id$netlbl_mgmt(&(0x7f0000000040), 0xffffffffffffffff) sendmsg$NLBL_MGMT_C_REMOVEDEF(0xffffffffffffffff, &(0x7f0000000100)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x8}, 0xc, &(0x7f00000000c0)={&(0x7f0000000080)={0x3c, r1, 0x20, 0x70bd29, 0x25dfdbff, {}, [@NLBL_MGMT_A_FAMILY={0x6, 0xb, 0x5}, @NLBL_MGMT_A_PROTOCOL={0x8, 0x2, 0x3}, @NLBL_MGMT_A_IPV4MASK={0x8, 0x8, @multicast1}, @NLBL_MGMT_A_CLPDOI={0x8}, @NLBL_MGMT_A_IPV4ADDR={0x8, 0x7, @local}]}, 0x3c}, 0x1, 0x0, 0x0, 0x4048820}, 0x40000) shmat(0xffffffffffffffff, &(0x7f0000ffb000/0x4000)=nil, 0x2000) r2 = shmget(0x0, 0xf000, 0x100, &(0x7f0000ff1000/0xf000)=nil) shmctl$IPC_RMID(r2, 0x0) r3 = mmap$IORING_OFF_SQ_RING(&(0x7f0000ffd000/0x1000)=nil, 0x1000, 0x2000006, 0x40010, 0xffffffffffffffff, 0x0) syz_io_uring_submit(r3, 0x0, &(0x7f00000001c0)=@IORING_OP_PROVIDE_BUFFERS={0x1f, 0x1, 0x0, 0x8, 0x2, &(0x7f0000000140)="10e8e6d73f8e97a04564912d4b0bee6921be05ed083e4d741dabdbce8c94949f57a5c9d9da73d0e5ad668714159e31498f181aad79547c645eefb456a7b8c4be765eb156b77cba8a752b90d7729b2c285893a10c3633d2485f48f30d247214c5e28a", 0x7, 0x0, 0x1, {0x1}}, 0x100) r4 = socket(0x2c, 0x5, 0x1) accept4$packet(0xffffffffffffffff, &(0x7f0000000280)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @random}, &(0x7f00000002c0)=0x14, 0x40000) recvfrom$packet(r4, &(0x7f0000000200)=""/108, 0x6c, 0x2000, &(0x7f0000000300)={0x11, 0x16, r5, 0x1, 0x8, 0x6, @local}, 0x14) r6 = syz_genetlink_get_family_id$netlbl_mgmt(&(0x7f0000000380), 0xffffffffffffffff) sendmsg$NLBL_MGMT_C_REMOVEDEF(0xffffffffffffffff, &(0x7f0000000440)={&(0x7f0000000340)={0x10, 0x0, 0x0, 0x4}, 0xc, &(0x7f0000000400)={&(0x7f00000003c0)={0x24, r6, 0x400, 0x70bd26, 0x25dfdbfc, {}, [@NLBL_MGMT_A_FAMILY={0x6, 0xb, 0x18}, @NLBL_MGMT_A_PROTOCOL={0x8, 0x2, 0x3}]}, 0x24}, 0x1, 0x0, 0x0, 0x48084}, 0x8040) io_uring_setup(0x14ab, &(0x7f0000000480)={0x0, 0x5191, 0x20, 0x1, 0x3ba}) shmget$private(0x0, 0x2000, 0x10, &(0x7f0000ffc000/0x2000)=nil) 11:40:50 executing program 0: r0 = openat$vcsa(0xffffffffffffff9c, &(0x7f0000000000), 0x40000, 0x0) ioctl$SG_GET_PACK_ID(r0, 0x227c, &(0x7f0000000040)) r1 = openat$sr(0xffffffffffffff9c, &(0x7f0000000080), 0x454082, 0x0) ioctl$SG_SET_DEBUG(r1, 0x227e, &(0x7f00000000c0)=0x1) r2 = syz_open_dev$sg(&(0x7f0000000100), 0x8, 0x280102) ioctl$SG_GET_RESERVED_SIZE(r2, 0x2272, &(0x7f0000000140)) ioctl$SG_GET_REQUEST_TABLE(r1, 0x2286, &(0x7f0000000180)) r3 = syz_open_dev$sg(&(0x7f0000000300), 0x100000000, 0x408903) ioctl$SG_SET_RESERVED_SIZE(r3, 0x2275, &(0x7f0000000340)=0x80000000) ioctl$SG_GET_KEEP_ORPHAN(0xffffffffffffffff, 0x2288, &(0x7f0000000380)) ioctl$SG_GET_PACK_ID(r1, 0x227c, &(0x7f00000003c0)) ioctl$SG_SET_RESERVED_SIZE(r2, 0x2275, &(0x7f0000000400)=0x4cbd) syz_open_dev$sg(&(0x7f0000000540), 0x8, 0x8100) 11:40:50 executing program 4: setsockopt$inet_tcp_TCP_QUEUE_SEQ(0xffffffffffffffff, 0x6, 0x15, &(0x7f0000000000), 0x4) r0 = openat$vcsa(0xffffffffffffff9c, &(0x7f0000000040), 0x81, 0x0) setsockopt$packet_tx_ring(r0, 0x107, 0xd, &(0x7f0000000080)=@req={0x4, 0xffffffff, 0xd5, 0x5}, 0x10) setsockopt$inet_tcp_TCP_REPAIR_WINDOW(r0, 0x6, 0x1d, &(0x7f00000000c0)={0xfffffff9, 0x1, 0x7fffffff, 0x6, 0x1}, 0x14) ioctl$SCSI_IOCTL_SYNC(r0, 0x4) r1 = accept(r0, &(0x7f0000000100)=@rc={0x1f, @fixed}, &(0x7f0000000180)=0x80) setsockopt$inet_tcp_TCP_FASTOPEN_KEY(r1, 0x6, 0x21, &(0x7f00000001c0)="2a6eddb47c1ebcb5002df4f95b6a3218", 0x10) socket$inet_tcp(0x2, 0x1, 0x0) ioctl$SG_GET_VERSION_NUM(r0, 0x2282, &(0x7f0000000200)) ioctl$SCSI_IOCTL_STOP_UNIT(r0, 0x6) ioctl$sock_SIOCADDRT(r1, 0x890b, &(0x7f0000000280)={0x0, @ax25={0x3, @remote={0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0x1}, 0x3}, @can={0x1d, 0x0}, @l2={0x1f, 0x20, @any, 0x81}, 0x81, 0x0, 0x0, 0x0, 0x3, &(0x7f0000000240)='veth1_to_bond\x00', 0x1, 0x9, 0x81}) sendto$packet(r0, &(0x7f0000000300)="ef239bcbf699ea49248d932bd7a123b6dc9273af2c6c1771bbfca4377cfca4cfc8d7a0ed5b9cec2ccbbb66f69d40c744edd53168a1bdf7d412632799b3df3b80bb5e766fd2e2b373e553a501f4d1997e0a3d387642b483dca2a2bee261552bc0ec0162efa75aa5e9f1a18f050fc5d5fbaa7dceca8e90ed87643278338e74fb16fecf749ace8174d85c2b85721c1097077921541caaf6d322510105ad87d2a427ffd1689b31d399985823b2bb0abd928963c7", 0xb2, 0x4004, &(0x7f00000003c0)={0x11, 0x16, r2, 0x1, 0x6, 0x6, @local}, 0x14) syz_genetlink_get_family_id$netlbl_mgmt(&(0x7f0000000440), 0xffffffffffffffff) syz_genetlink_get_family_id$netlbl_mgmt(&(0x7f0000000740), 0xffffffffffffffff) 11:40:58 executing program 2: clock_nanosleep(0x7, 0x0, &(0x7f0000000000)={0x77359400}, &(0x7f0000000040)) getsockopt$inet6_IPV6_XFRM_POLICY(0xffffffffffffffff, 0x29, 0x23, &(0x7f0000000080)={{{@in6, @in6=@remote, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, {{@in6=@dev}, 0x0, @in=@initdev}}, &(0x7f0000000180)=0xe8) setsockopt$packet_add_memb(0xffffffffffffffff, 0x107, 0x1, &(0x7f00000001c0)={r0, 0x1, 0x6, @broadcast}, 0x10) getpeername$packet(0xffffffffffffffff, &(0x7f0000000200)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @dev}, &(0x7f0000000240)=0x14) recvmsg(0xffffffffffffffff, &(0x7f00000027c0)={&(0x7f0000000280)=@xdp={0x2c, 0x0, 0x0}, 0x80, &(0x7f0000002640)=[{&(0x7f0000000300)=""/227, 0xe3}, {&(0x7f0000000400)=""/4096, 0x1000}, {&(0x7f0000001400)=""/92, 0x5c}, {&(0x7f0000001480)=""/93, 0x5d}, {&(0x7f0000001500)=""/4096, 0x1000}, {&(0x7f0000002500)=""/87, 0x57}, {&(0x7f0000002580)=""/189, 0xbd}], 0x7, &(0x7f00000026c0)=""/199, 0xc7}, 0x140) bind$packet(0xffffffffffffffff, &(0x7f0000002800)={0x11, 0x1b, r2, 0x1, 0x5}, 0x14) getresgid(&(0x7f0000002840), &(0x7f0000002880), &(0x7f00000028c0)) r3 = accept4$packet(0xffffffffffffffff, &(0x7f0000002900)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @multicast}, &(0x7f0000002940)=0x14, 0x80000) recvfrom$packet(r3, &(0x7f0000002980)=""/4096, 0x1000, 0x0, &(0x7f0000003980)={0x11, 0x17, r2, 0x1, 0x5, 0x6, @multicast}, 0x14) r4 = socket$inet6_udp(0xa, 0x2, 0x0) getsockopt$inet6_IPV6_XFRM_POLICY(r4, 0x29, 0x23, &(0x7f00000039c0)={{{@in6=@ipv4, @in6=@private0}}, {{@in=@private}, 0x0, @in6=@remote}}, &(0x7f0000003ac0)=0xe8) r5 = openat$sr(0xffffffffffffff9c, &(0x7f0000003b00), 0x200000, 0x0) recvfrom$packet(r5, &(0x7f0000003b40)=""/161, 0xa1, 0x140, &(0x7f0000003c00)={0x11, 0x2, r1, 0x1, 0x9a, 0x6, @local}, 0x14) r6 = openat$vcsa(0xffffffffffffff9c, &(0x7f0000003c40), 0x500, 0x0) write$bt_hci(r6, &(0x7f0000003c80)={0x1, @write_current_iac_lap={{0xc3a, 0x7}, {0x6, "30a9a39c10c4"}}}, 0xb) prctl$PR_SET_MM_MAP_SIZE(0x23, 0xf, &(0x7f0000003cc0)) accept4$packet(r6, &(0x7f00000053c0)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @local}, &(0x7f0000005400)=0x14, 0x80000) openat$sr(0xffffffffffffff9c, &(0x7f0000005480), 0x428802, 0x0) 11:40:58 executing program 1: r0 = shmget(0x2, 0x3000, 0x100, &(0x7f0000ffb000/0x3000)=nil) shmat(r0, &(0x7f0000ffa000/0x3000)=nil, 0x2000) shmat(r0, &(0x7f0000ffa000/0x4000)=nil, 0x3000) shmget(0x3, 0x1000, 0x100, &(0x7f0000ffd000/0x1000)=nil) r1 = syz_genetlink_get_family_id$netlbl_mgmt(&(0x7f0000000040), 0xffffffffffffffff) sendmsg$NLBL_MGMT_C_REMOVEDEF(0xffffffffffffffff, &(0x7f0000000100)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x8}, 0xc, &(0x7f00000000c0)={&(0x7f0000000080)={0x3c, r1, 0x20, 0x70bd29, 0x25dfdbff, {}, [@NLBL_MGMT_A_FAMILY={0x6, 0xb, 0x5}, @NLBL_MGMT_A_PROTOCOL={0x8, 0x2, 0x3}, @NLBL_MGMT_A_IPV4MASK={0x8, 0x8, @multicast1}, @NLBL_MGMT_A_CLPDOI={0x8}, @NLBL_MGMT_A_IPV4ADDR={0x8, 0x7, @local}]}, 0x3c}, 0x1, 0x0, 0x0, 0x4048820}, 0x40000) shmat(0xffffffffffffffff, &(0x7f0000ffb000/0x4000)=nil, 0x2000) r2 = shmget(0x0, 0xf000, 0x100, &(0x7f0000ff1000/0xf000)=nil) shmctl$IPC_RMID(r2, 0x0) r3 = mmap$IORING_OFF_SQ_RING(&(0x7f0000ffd000/0x1000)=nil, 0x1000, 0x2000006, 0x40010, 0xffffffffffffffff, 0x0) syz_io_uring_submit(r3, 0x0, &(0x7f00000001c0)=@IORING_OP_PROVIDE_BUFFERS={0x1f, 0x1, 0x0, 0x8, 0x2, &(0x7f0000000140)="10e8e6d73f8e97a04564912d4b0bee6921be05ed083e4d741dabdbce8c94949f57a5c9d9da73d0e5ad668714159e31498f181aad79547c645eefb456a7b8c4be765eb156b77cba8a752b90d7729b2c285893a10c3633d2485f48f30d247214c5e28a", 0x7, 0x0, 0x1, {0x1}}, 0x100) r4 = socket(0x2c, 0x5, 0x1) accept4$packet(0xffffffffffffffff, &(0x7f0000000280)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @random}, &(0x7f00000002c0)=0x14, 0x40000) recvfrom$packet(r4, &(0x7f0000000200)=""/108, 0x6c, 0x2000, &(0x7f0000000300)={0x11, 0x16, r5, 0x1, 0x8, 0x6, @local}, 0x14) r6 = syz_genetlink_get_family_id$netlbl_mgmt(&(0x7f0000000380), 0xffffffffffffffff) sendmsg$NLBL_MGMT_C_REMOVEDEF(0xffffffffffffffff, &(0x7f0000000440)={&(0x7f0000000340)={0x10, 0x0, 0x0, 0x4}, 0xc, &(0x7f0000000400)={&(0x7f00000003c0)={0x24, r6, 0x400, 0x70bd26, 0x25dfdbfc, {}, [@NLBL_MGMT_A_FAMILY={0x6, 0xb, 0x18}, @NLBL_MGMT_A_PROTOCOL={0x8, 0x2, 0x3}]}, 0x24}, 0x1, 0x0, 0x0, 0x48084}, 0x8040) shmget$private(0x0, 0x2000, 0x10, &(0x7f0000ffc000/0x2000)=nil) 11:40:58 executing program 6: ioprio_set$uid(0x0, 0xee01, 0x4004) syz_mount_image$msdos(&(0x7f0000000000), &(0x7f0000000040)='./file0\x00', 0x200, 0x1, &(0x7f00000000c0)=[{&(0x7f0000000080)="7c74c7bc99e778a0c971e6f50fbdd2b70fa0b038d18c7d5ac685833434d89dce684239293aa5d8b6f11bc5c4a033ad1dc68319fad36a1101aad751fd6f4f10", 0x3f, 0x7f}], 0x42000, &(0x7f0000000100)={[{@dots}], [{@obj_user}, {@dont_appraise}, {@uid_lt}, {@hash}, {@seclabel}]}) getsockopt$inet6_IPV6_XFRM_POLICY(0xffffffffffffffff, 0x29, 0x23, &(0x7f0000000240)={{{@in=@loopback, @in6=@empty, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, {{@in6=@local}, 0x0, @in6=@mcast1}}, &(0x7f0000000340)=0xe8) mount$9p_xen(&(0x7f0000000180), &(0x7f00000001c0)='./file0\x00', &(0x7f0000000200), 0x1121061, &(0x7f0000000380)={'trans=xen,', {[{@msize={'msize', 0x3d, 0xf6b3}}, {@debug={'debug', 0x3d, 0x7ff}}, {@posixacl}, {@aname={'aname', 0x3d, '*$-&'}}, {@uname={'uname', 0x3d, 'msdos\x00'}}], [{@seclabel}, {@euid_eq={'euid', 0x3d, r0}}, {@permit_directio}, {@appraise_type}]}}) r1 = syz_io_uring_setup(0x1d4a, &(0x7f0000000440)={0x0, 0xfa85, 0x0, 0x0, 0x285}, &(0x7f0000ffd000/0x1000)=nil, &(0x7f0000ffd000/0x2000)=nil, &(0x7f00000004c0)=0x0, &(0x7f0000000500)) syz_io_uring_setup(0x3e5e, &(0x7f0000000540)={0x0, 0x5c61, 0x8, 0x2, 0x72}, &(0x7f0000ffd000/0x3000)=nil, &(0x7f0000ffc000/0x3000)=nil, &(0x7f00000005c0), &(0x7f0000000600)=0x0) syz_io_uring_submit(r2, r3, &(0x7f0000000740)=@IORING_OP_READ=@pass_buffer={0x16, 0x1, 0x2004, @fd_index=0xa, 0x7, &(0x7f0000000640)=""/227, 0xe3, 0xc, 0x1}, 0x9) ioctl$SECCOMP_IOCTL_NOTIF_ADDFD(0xffffffffffffffff, 0x40182103, &(0x7f0000000780)={0x0, 0x4, r1, 0x9, 0x80000}) openat$cgroup_devices(0xffffffffffffffff, &(0x7f00000007c0)='devices.allow\x00', 0x2, 0x0) syz_mount_image$nfs4(&(0x7f0000000800), &(0x7f0000000840)='./file0/file0\x00', 0xffffffffffffff01, 0x1, &(0x7f0000000900)=[{&(0x7f0000000880)="f19bd7cfef39dd2070dcb194f7bd90ce305e2a9644b9fb91cc1e75bca69ed6bbdd7636452963af395ea61189cce718ef43420310b6ff8db9f4a606d67217b1aa7bf6e1435682323aef92ef40d036c48fa3fc363c6ad63229bb37cd76a6db9879a39f", 0x62, 0x6}], 0x8400, &(0x7f0000000940)={[{'*+\\['}]}) r4 = accept(0xffffffffffffffff, 0x0, &(0x7f0000000980)) sendmsg$MPTCP_PM_CMD_GET_LIMITS(r4, &(0x7f0000000ac0)={&(0x7f00000009c0)={0x10, 0x0, 0x0, 0x200}, 0xc, &(0x7f0000000a80)={&(0x7f0000000a00)={0x74, 0x0, 0x200, 0x70bd27, 0x25dfdbfd, {}, [@MPTCP_PM_ATTR_RCV_ADD_ADDRS={0x8, 0x2, 0x8}, @MPTCP_PM_ATTR_RCV_ADD_ADDRS={0x8, 0x2, 0x2}, @MPTCP_PM_ATTR_SUBFLOWS={0x8, 0x3, 0x6}, @MPTCP_PM_ATTR_ADDR={0x3c, 0x1, 0x0, 0x1, [@MPTCP_PM_ADDR_ATTR_PORT={0x6, 0x5, 0x4e20}, @MPTCP_PM_ADDR_ATTR_ID={0x5, 0x2, 0x5}, @MPTCP_PM_ADDR_ATTR_FLAGS={0x8, 0x6, 0x3}, @MPTCP_PM_ADDR_ATTR_PORT={0x6, 0x5, 0x4e23}, @MPTCP_PM_ADDR_ATTR_FAMILY={0x6}, @MPTCP_PM_ADDR_ATTR_FAMILY={0x6, 0x1, 0xa}, @MPTCP_PM_ADDR_ATTR_FAMILY={0x6, 0x1, 0xa}]}, @MPTCP_PM_ATTR_ADDR={0x4}, @MPTCP_PM_ATTR_SUBFLOWS={0x8}]}, 0x74}, 0x1, 0x0, 0x0, 0x11}, 0x80) sendmsg$IEEE802154_LLSEC_DEL_SECLEVEL(0xffffffffffffffff, &(0x7f0000000bc0)={&(0x7f0000000b00)={0x10, 0x0, 0x0, 0x800000}, 0xc, &(0x7f0000000b80)={&(0x7f0000000b40)={0x2c, 0x0, 0x800, 0x70bd27, 0x25dfdbff, {}, [@IEEE802154_ATTR_DEV_INDEX={0x8}, @IEEE802154_ATTR_LLSEC_FRAME_TYPE={0x5, 0x33, 0x81}, @IEEE802154_ATTR_DEV_INDEX={0x8}]}, 0x2c}, 0x1, 0x0, 0x0, 0x4}, 0x2) socketpair(0x15, 0x1, 0x10001, &(0x7f0000000c00)={0xffffffffffffffff}) sendmsg$BATADV_CMD_TP_METER_CANCEL(r5, &(0x7f0000000d00)={&(0x7f0000000c40)={0x10, 0x0, 0x0, 0x8}, 0xc, &(0x7f0000000cc0)={&(0x7f0000000c80)={0x3c, 0x0, 0x1, 0x70bd2b, 0x25dfdbfc, {}, [@BATADV_ATTR_GW_BANDWIDTH_DOWN={0x8, 0x31, 0x4}, @BATADV_ATTR_ORIG_INTERVAL={0x8, 0x39, 0x5}, @BATADV_ATTR_ISOLATION_MASK={0x8, 0x2c, 0x80000}, @BATADV_ATTR_ISOLATION_MASK={0x8, 0x2c, 0x9}, @BATADV_ATTR_GW_MODE={0x5, 0x33, 0x1}]}, 0x3c}, 0x1, 0x0, 0x0, 0x4080}, 0x40000) socketpair(0xf, 0x6, 0x2, &(0x7f0000000d40)) mount$9p_rdma(&(0x7f0000001040), &(0x7f0000001080)='./file0\x00', &(0x7f00000010c0), 0xa00800, &(0x7f0000001100)={'trans=rdma,', {'port', 0x3d, 0x4e20}, 0x2c, {[{@common=@aname={'aname', 0x3d, 'permit_directio'}}, {@sq={'sq', 0x3d, 0xffff}}], [{@fscontext={'fscontext', 0x3d, 'staff_u'}}]}}) 11:40:58 executing program 5: getpeername$packet(0xffffffffffffffff, &(0x7f0000000000)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @dev}, &(0x7f0000000040)=0x14) ioctl$sock_SIOCADDRT(0xffffffffffffffff, 0x890b, &(0x7f0000000080)={0x0, @phonet={0x23, 0xfe, 0x0, 0x2f}, @hci={0x1f, 0xffffffffffffffff, 0x3}, @rc={0x1f, @any, 0x2}, 0x5, 0x0, 0x0, 0x0, 0x7ff, 0x0, 0x0, 0x4, 0x4}) r0 = mmap$IORING_OFF_SQES(&(0x7f0000ffa000/0x4000)=nil, 0x4000, 0x1000004, 0x810, 0xffffffffffffffff, 0x10000000) syz_io_uring_submit(0x0, r0, &(0x7f0000000100)=@IORING_OP_MADVISE={0x19, 0x3, 0x0, 0x0, 0x0, &(0x7f0000ffa000/0x2000)=nil, 0x2000, 0xb, 0x1}, 0x8) r1 = syz_genetlink_get_family_id$mptcp(&(0x7f0000000180), 0xffffffffffffffff) sendmsg$MPTCP_PM_CMD_ADD_ADDR(0xffffffffffffffff, &(0x7f0000000240)={&(0x7f0000000140)={0x10, 0x0, 0x0, 0x10000}, 0xc, &(0x7f0000000200)={&(0x7f00000001c0)={0x24, r1, 0x800, 0x70bd27, 0x25dfdbfd, {}, [@MPTCP_PM_ATTR_RCV_ADD_ADDRS={0x8, 0x2, 0x8}, @MPTCP_PM_ATTR_RCV_ADD_ADDRS={0x8, 0x2, 0x6}]}, 0x24}, 0x1, 0x0, 0x0, 0x2400c096}, 0x80) sendmsg$MPTCP_PM_CMD_FLUSH_ADDRS(0xffffffffffffffff, &(0x7f00000003c0)={&(0x7f0000000280)={0x10, 0x0, 0x0, 0x40}, 0xc, &(0x7f0000000380)={&(0x7f00000002c0)={0xa4, r1, 0x200, 0x70bd25, 0x25dfdbff, {}, [@MPTCP_PM_ATTR_RCV_ADD_ADDRS={0x8, 0x2, 0x3}, @MPTCP_PM_ATTR_ADDR={0x30, 0x1, 0x0, 0x1, [@MPTCP_PM_ADDR_ATTR_ADDR6={0x14, 0x4, @initdev={0xfe, 0x88, '\x00', 0x0, 0x0}}, @MPTCP_PM_ADDR_ATTR_ADDR4={0x8, 0x3, @local}, @MPTCP_PM_ADDR_ATTR_FLAGS={0x8, 0x6, 0x2}, @MPTCP_PM_ADDR_ATTR_FAMILY={0x6, 0x1, 0xa}]}, @MPTCP_PM_ATTR_ADDR={0x2c, 0x1, 0x0, 0x1, [@MPTCP_PM_ADDR_ATTR_ID={0x5, 0x2, 0x81}, @MPTCP_PM_ADDR_ATTR_PORT={0x6, 0x5, 0x4e22}, @MPTCP_PM_ADDR_ATTR_FAMILY={0x6, 0x1, 0xa}, @MPTCP_PM_ADDR_ATTR_FLAGS={0x8}, @MPTCP_PM_ADDR_ATTR_ID={0x5, 0x2, 0x40}]}, @MPTCP_PM_ATTR_SUBFLOWS={0x8, 0x3, 0x5}, @MPTCP_PM_ATTR_SUBFLOWS={0x8, 0x3, 0x5}, @MPTCP_PM_ATTR_ADDR={0x14, 0x1, 0x0, 0x1, [@MPTCP_PM_ADDR_ATTR_PORT={0x6, 0x5, 0x4e23}, @MPTCP_PM_ADDR_ATTR_PORT={0x6, 0x5, 0x4e21}]}, @MPTCP_PM_ATTR_SUBFLOWS={0x8, 0x3, 0x2}]}, 0xa4}, 0x1, 0x0, 0x0, 0x40}, 0x90) r2 = syz_open_dev$sg(&(0x7f0000000400), 0x4, 0x38040) ioctl$SCSI_IOCTL_DOORUNLOCK(r2, 0x5381) r3 = accept$packet(0xffffffffffffffff, &(0x7f0000000440), &(0x7f0000000480)=0x14) syz_io_uring_submit(0x0, r0, &(0x7f00000004c0)=@IORING_OP_ASYNC_CANCEL={0xe, 0x1, 0x0, 0x0, 0x0, 0x23456}, 0x5) accept4$packet(r3, &(0x7f0000000500), &(0x7f0000000540)=0x14, 0x800) r4 = openat$vcsa(0xffffffffffffff9c, &(0x7f0000000580), 0x121080, 0x0) setsockopt$inet6_tcp_TCP_QUEUE_SEQ(r4, 0x6, 0x15, &(0x7f0000000780)=0x400, 0x4) 11:40:58 executing program 0: r0 = openat$vcsa(0xffffffffffffff9c, &(0x7f0000000000), 0x40000, 0x0) ioctl$SG_GET_PACK_ID(r0, 0x227c, &(0x7f0000000040)) r1 = openat$sr(0xffffffffffffff9c, &(0x7f0000000080), 0x454082, 0x0) ioctl$SG_SET_DEBUG(r1, 0x227e, &(0x7f00000000c0)=0x1) r2 = syz_open_dev$sg(&(0x7f0000000100), 0x8, 0x280102) ioctl$SG_GET_RESERVED_SIZE(r2, 0x2272, &(0x7f0000000140)) ioctl$SG_GET_REQUEST_TABLE(r1, 0x2286, &(0x7f0000000180)) r3 = syz_open_dev$sg(&(0x7f0000000300), 0x100000000, 0x408903) ioctl$SG_SET_RESERVED_SIZE(r3, 0x2275, &(0x7f0000000340)=0x80000000) ioctl$SG_GET_KEEP_ORPHAN(0xffffffffffffffff, 0x2288, &(0x7f0000000380)) ioctl$SG_GET_PACK_ID(r1, 0x227c, &(0x7f00000003c0)) syz_open_dev$sg(&(0x7f0000000540), 0x8, 0x8100) 11:40:58 executing program 7: r0 = syz_open_dev$sg(&(0x7f0000000000), 0x1, 0x10000) ioctl$SG_GET_PACK_ID(r0, 0x227c, &(0x7f0000000040)) ioctl$SCSI_IOCTL_DOORLOCK(r0, 0x5380) ioctl$SG_SET_KEEP_ORPHAN(r0, 0x2287, &(0x7f0000000080)=0x7) ioctl$SCSI_IOCTL_BENCHMARK_COMMAND(r0, 0x3) ioctl$SCSI_IOCTL_SYNC(r0, 0x4) ioctl$SG_SET_DEBUG(r0, 0x227e, &(0x7f00000000c0)=0x1) setsockopt$packet_add_memb(0xffffffffffffffff, 0x107, 0x1, &(0x7f0000000100)={0x0, 0x1, 0x6}, 0x10) ioctl$SG_NEXT_CMD_LEN(r0, 0x2283, &(0x7f0000000140)=0x74) ioctl$SG_GET_VERSION_NUM(r0, 0x2282, &(0x7f0000000180)) socketpair(0x1f, 0x1, 0x5, &(0x7f00000001c0)={0xffffffffffffffff, 0xffffffffffffffff}) syz_genetlink_get_family_id$batadv(&(0x7f0000000200), r2) ioctl$SCSI_IOCTL_STOP_UNIT(r0, 0x6) ioctl$sock_SIOCADDRT(r1, 0x890b, &(0x7f0000000280)={0x0, @nfc={0x27, 0x0, 0x1, 0x6}, @isdn={0x22, 0x50, 0x5, 0x7, 0x5}, @sco, 0x3, 0x0, 0x0, 0x0, 0x1, &(0x7f0000000240)='virt_wifi0\x00', 0x7fffffff, 0x7f28, 0x4}) openat$vcsa(0xffffffffffffff9c, &(0x7f0000000440), 0x10480, 0x0) 11:40:58 executing program 3: ioctl$SG_SET_FORCE_PACK_ID(0xffffffffffffffff, 0x227b, &(0x7f0000000000)=0x1) ioctl$SG_SET_FORCE_PACK_ID(0xffffffffffffffff, 0x227b, &(0x7f0000000040)) ioctl$SG_GET_RESERVED_SIZE(0xffffffffffffffff, 0x2272, &(0x7f0000000080)) r0 = openat$vcsa(0xffffffffffffff9c, &(0x7f00000000c0), 0x4200, 0x0) ioctl$SCSI_IOCTL_SEND_COMMAND(r0, 0x1, &(0x7f0000000100)={0x17, 0x3, 0x1c00, "af36a59fb168d324fd8eaf833aeb82f60d75e8700d81d9"}) ioctl$SG_SET_TIMEOUT(r0, 0x2201, &(0x7f0000000140)=0x4) ioctl$SG_GET_VERSION_NUM(r0, 0x2282, &(0x7f0000000180)) ioctl$SG_GET_REQUEST_TABLE(r0, 0x2286, &(0x7f00000001c0)) ioctl$SG_GET_TIMEOUT(r0, 0x2202, 0x0) r1 = syz_open_dev$sg(&(0x7f0000000340), 0x7fff, 0x40) ioctl$SG_EMULATED_HOST(r1, 0x2203, &(0x7f0000000380)) r2 = openat$vcsa(0xffffffffffffff9c, &(0x7f00000003c0), 0x8103, 0x0) ioctl$SG_GET_COMMAND_Q(r2, 0x2270, &(0x7f0000000400)) r3 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$inet6_tcp_TCP_CONGESTION(r3, 0x6, 0xd, &(0x7f0000000440)='scalable\x00', 0x9) 11:40:58 executing program 4: setsockopt$inet_tcp_TCP_QUEUE_SEQ(0xffffffffffffffff, 0x6, 0x15, &(0x7f0000000000), 0x4) r0 = openat$vcsa(0xffffffffffffff9c, &(0x7f0000000040), 0x81, 0x0) setsockopt$packet_tx_ring(r0, 0x107, 0xd, &(0x7f0000000080)=@req={0x4, 0xffffffff, 0xd5, 0x5}, 0x10) setsockopt$inet_tcp_TCP_REPAIR_WINDOW(r0, 0x6, 0x1d, &(0x7f00000000c0)={0xfffffff9, 0x1, 0x7fffffff, 0x6, 0x1}, 0x14) ioctl$SCSI_IOCTL_SYNC(r0, 0x4) r1 = accept(r0, &(0x7f0000000100)=@rc={0x1f, @fixed}, &(0x7f0000000180)=0x80) setsockopt$inet_tcp_TCP_FASTOPEN_KEY(r1, 0x6, 0x21, &(0x7f00000001c0)="2a6eddb47c1ebcb5002df4f95b6a3218", 0x10) socket$inet_tcp(0x2, 0x1, 0x0) ioctl$SG_GET_VERSION_NUM(r0, 0x2282, &(0x7f0000000200)) ioctl$SCSI_IOCTL_STOP_UNIT(r0, 0x6) ioctl$sock_SIOCADDRT(r1, 0x890b, &(0x7f0000000280)={0x0, @ax25={0x3, @remote={0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0x1}, 0x3}, @can={0x1d, 0x0}, @l2={0x1f, 0x20, @any, 0x81}, 0x81, 0x0, 0x0, 0x0, 0x3, &(0x7f0000000240)='veth1_to_bond\x00', 0x1, 0x9, 0x81}) sendto$packet(r0, &(0x7f0000000300)="ef239bcbf699ea49248d932bd7a123b6dc9273af2c6c1771bbfca4377cfca4cfc8d7a0ed5b9cec2ccbbb66f69d40c744edd53168a1bdf7d412632799b3df3b80bb5e766fd2e2b373e553a501f4d1997e0a3d387642b483dca2a2bee261552bc0ec0162efa75aa5e9f1a18f050fc5d5fbaa7dceca8e90ed87643278338e74fb16fecf749ace8174d85c2b85721c1097077921541caaf6d322510105ad87d2a427ffd1689b31d399985823b2bb0abd928963c7", 0xb2, 0x4004, &(0x7f00000003c0)={0x11, 0x16, r2, 0x1, 0x6, 0x6, @local}, 0x14) syz_genetlink_get_family_id$netlbl_mgmt(&(0x7f0000000740), 0xffffffffffffffff) [ 151.800403] loop6: detected capacity change from 0 to 1 [ 151.826774] loop6: detected capacity change from 0 to 264192 [ 151.829888] nfs4: Unknown parameter '*+\[' 11:40:58 executing program 0: r0 = openat$vcsa(0xffffffffffffff9c, &(0x7f0000000000), 0x40000, 0x0) ioctl$SG_GET_PACK_ID(r0, 0x227c, &(0x7f0000000040)) r1 = openat$sr(0xffffffffffffff9c, &(0x7f0000000080), 0x454082, 0x0) ioctl$SG_SET_DEBUG(r1, 0x227e, &(0x7f00000000c0)=0x1) r2 = syz_open_dev$sg(&(0x7f0000000100), 0x8, 0x280102) ioctl$SG_GET_RESERVED_SIZE(r2, 0x2272, &(0x7f0000000140)) ioctl$SG_GET_REQUEST_TABLE(r1, 0x2286, &(0x7f0000000180)) r3 = syz_open_dev$sg(&(0x7f0000000300), 0x100000000, 0x408903) ioctl$SG_SET_RESERVED_SIZE(r3, 0x2275, &(0x7f0000000340)=0x80000000) ioctl$SG_GET_KEEP_ORPHAN(0xffffffffffffffff, 0x2288, &(0x7f0000000380)) syz_open_dev$sg(&(0x7f0000000540), 0x8, 0x8100) 11:40:59 executing program 4: setsockopt$inet_tcp_TCP_QUEUE_SEQ(0xffffffffffffffff, 0x6, 0x15, &(0x7f0000000000), 0x4) r0 = openat$vcsa(0xffffffffffffff9c, &(0x7f0000000040), 0x81, 0x0) setsockopt$packet_tx_ring(r0, 0x107, 0xd, &(0x7f0000000080)=@req={0x4, 0xffffffff, 0xd5, 0x5}, 0x10) setsockopt$inet_tcp_TCP_REPAIR_WINDOW(r0, 0x6, 0x1d, &(0x7f00000000c0)={0xfffffff9, 0x1, 0x7fffffff, 0x6, 0x1}, 0x14) ioctl$SCSI_IOCTL_SYNC(r0, 0x4) r1 = accept(r0, &(0x7f0000000100)=@rc={0x1f, @fixed}, &(0x7f0000000180)=0x80) setsockopt$inet_tcp_TCP_FASTOPEN_KEY(r1, 0x6, 0x21, &(0x7f00000001c0)="2a6eddb47c1ebcb5002df4f95b6a3218", 0x10) socket$inet_tcp(0x2, 0x1, 0x0) ioctl$SG_GET_VERSION_NUM(r0, 0x2282, &(0x7f0000000200)) ioctl$SCSI_IOCTL_STOP_UNIT(r0, 0x6) ioctl$sock_SIOCADDRT(r1, 0x890b, &(0x7f0000000280)={0x0, @ax25={0x3, @remote={0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0x1}, 0x3}, @can={0x1d, 0x0}, @l2={0x1f, 0x20, @any, 0x81}, 0x81, 0x0, 0x0, 0x0, 0x3, &(0x7f0000000240)='veth1_to_bond\x00', 0x1, 0x9, 0x81}) sendto$packet(r0, &(0x7f0000000300)="ef239bcbf699ea49248d932bd7a123b6dc9273af2c6c1771bbfca4377cfca4cfc8d7a0ed5b9cec2ccbbb66f69d40c744edd53168a1bdf7d412632799b3df3b80bb5e766fd2e2b373e553a501f4d1997e0a3d387642b483dca2a2bee261552bc0ec0162efa75aa5e9f1a18f050fc5d5fbaa7dceca8e90ed87643278338e74fb16fecf749ace8174d85c2b85721c1097077921541caaf6d322510105ad87d2a427ffd1689b31d399985823b2bb0abd928963c7", 0xb2, 0x4004, &(0x7f00000003c0)={0x11, 0x16, r2, 0x1, 0x6, 0x6, @local}, 0x14) syz_genetlink_get_family_id$netlbl_mgmt(&(0x7f0000000740), 0xffffffffffffffff) [ 151.940645] SELinux: security_context_str_to_sid (staff_u) failed with errno=-22 11:40:59 executing program 0: r0 = openat$vcsa(0xffffffffffffff9c, &(0x7f0000000000), 0x40000, 0x0) ioctl$SG_GET_PACK_ID(r0, 0x227c, &(0x7f0000000040)) r1 = openat$sr(0xffffffffffffff9c, &(0x7f0000000080), 0x454082, 0x0) ioctl$SG_SET_DEBUG(r1, 0x227e, &(0x7f00000000c0)=0x1) r2 = syz_open_dev$sg(&(0x7f0000000100), 0x8, 0x280102) ioctl$SG_GET_RESERVED_SIZE(r2, 0x2272, &(0x7f0000000140)) ioctl$SG_GET_REQUEST_TABLE(r1, 0x2286, &(0x7f0000000180)) r3 = syz_open_dev$sg(&(0x7f0000000300), 0x100000000, 0x408903) ioctl$SG_SET_RESERVED_SIZE(r3, 0x2275, &(0x7f0000000340)=0x80000000) syz_open_dev$sg(&(0x7f0000000540), 0x8, 0x8100) 11:40:59 executing program 5: getpeername$packet(0xffffffffffffffff, &(0x7f0000000000)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @dev}, &(0x7f0000000040)=0x14) ioctl$sock_SIOCADDRT(0xffffffffffffffff, 0x890b, &(0x7f0000000080)={0x0, @phonet={0x23, 0xfe, 0x0, 0x2f}, @hci={0x1f, 0xffffffffffffffff, 0x3}, @rc={0x1f, @any, 0x2}, 0x5, 0x0, 0x0, 0x0, 0x7ff, 0x0, 0x0, 0x4, 0x4}) r0 = mmap$IORING_OFF_SQES(&(0x7f0000ffa000/0x4000)=nil, 0x4000, 0x1000004, 0x810, 0xffffffffffffffff, 0x10000000) syz_io_uring_submit(0x0, r0, &(0x7f0000000100)=@IORING_OP_MADVISE={0x19, 0x3, 0x0, 0x0, 0x0, &(0x7f0000ffa000/0x2000)=nil, 0x2000, 0xb, 0x1}, 0x8) r1 = syz_genetlink_get_family_id$mptcp(&(0x7f0000000180), 0xffffffffffffffff) sendmsg$MPTCP_PM_CMD_ADD_ADDR(0xffffffffffffffff, &(0x7f0000000240)={&(0x7f0000000140)={0x10, 0x0, 0x0, 0x10000}, 0xc, &(0x7f0000000200)={&(0x7f00000001c0)={0x24, r1, 0x800, 0x70bd27, 0x25dfdbfd, {}, [@MPTCP_PM_ATTR_RCV_ADD_ADDRS={0x8, 0x2, 0x8}, @MPTCP_PM_ATTR_RCV_ADD_ADDRS={0x8, 0x2, 0x6}]}, 0x24}, 0x1, 0x0, 0x0, 0x2400c096}, 0x80) sendmsg$MPTCP_PM_CMD_FLUSH_ADDRS(0xffffffffffffffff, &(0x7f00000003c0)={&(0x7f0000000280)={0x10, 0x0, 0x0, 0x40}, 0xc, &(0x7f0000000380)={&(0x7f00000002c0)={0xa4, r1, 0x200, 0x70bd25, 0x25dfdbff, {}, [@MPTCP_PM_ATTR_RCV_ADD_ADDRS={0x8, 0x2, 0x3}, @MPTCP_PM_ATTR_ADDR={0x30, 0x1, 0x0, 0x1, [@MPTCP_PM_ADDR_ATTR_ADDR6={0x14, 0x4, @initdev={0xfe, 0x88, '\x00', 0x0, 0x0}}, @MPTCP_PM_ADDR_ATTR_ADDR4={0x8, 0x3, @local}, @MPTCP_PM_ADDR_ATTR_FLAGS={0x8, 0x6, 0x2}, @MPTCP_PM_ADDR_ATTR_FAMILY={0x6, 0x1, 0xa}]}, @MPTCP_PM_ATTR_ADDR={0x2c, 0x1, 0x0, 0x1, [@MPTCP_PM_ADDR_ATTR_ID={0x5, 0x2, 0x81}, @MPTCP_PM_ADDR_ATTR_PORT={0x6, 0x5, 0x4e22}, @MPTCP_PM_ADDR_ATTR_FAMILY={0x6, 0x1, 0xa}, @MPTCP_PM_ADDR_ATTR_FLAGS={0x8}, @MPTCP_PM_ADDR_ATTR_ID={0x5, 0x2, 0x40}]}, @MPTCP_PM_ATTR_SUBFLOWS={0x8, 0x3, 0x5}, @MPTCP_PM_ATTR_SUBFLOWS={0x8, 0x3, 0x5}, @MPTCP_PM_ATTR_ADDR={0x14, 0x1, 0x0, 0x1, [@MPTCP_PM_ADDR_ATTR_PORT={0x6, 0x5, 0x4e23}, @MPTCP_PM_ADDR_ATTR_PORT={0x6, 0x5, 0x4e21}]}, @MPTCP_PM_ATTR_SUBFLOWS={0x8, 0x3, 0x2}]}, 0xa4}, 0x1, 0x0, 0x0, 0x40}, 0x90) r2 = syz_open_dev$sg(&(0x7f0000000400), 0x4, 0x38040) ioctl$SCSI_IOCTL_DOORUNLOCK(r2, 0x5381) r3 = accept$packet(0xffffffffffffffff, &(0x7f0000000440), &(0x7f0000000480)=0x14) syz_io_uring_submit(0x0, r0, &(0x7f00000004c0)=@IORING_OP_ASYNC_CANCEL={0xe, 0x1, 0x0, 0x0, 0x0, 0x23456}, 0x5) accept4$packet(r3, &(0x7f0000000500), &(0x7f0000000540)=0x14, 0x800) setsockopt$inet6_tcp_TCP_QUEUE_SEQ(0xffffffffffffffff, 0x6, 0x15, &(0x7f0000000780)=0x400, 0x4) 11:40:59 executing program 6: ioprio_set$uid(0x0, 0xee01, 0x4004) syz_mount_image$msdos(&(0x7f0000000000), &(0x7f0000000040)='./file0\x00', 0x200, 0x1, &(0x7f00000000c0)=[{&(0x7f0000000080)="7c74c7bc99e778a0c971e6f50fbdd2b70fa0b038d18c7d5ac685833434d89dce684239293aa5d8b6f11bc5c4a033ad1dc68319fad36a1101aad751fd6f4f10", 0x3f, 0x7f}], 0x42000, &(0x7f0000000100)={[{@dots}], [{@obj_user}, {@dont_appraise}, {@uid_lt}, {@hash}, {@seclabel}]}) getsockopt$inet6_IPV6_XFRM_POLICY(0xffffffffffffffff, 0x29, 0x23, &(0x7f0000000240)={{{@in=@loopback, @in6=@empty, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, {{@in6=@local}, 0x0, @in6=@mcast1}}, &(0x7f0000000340)=0xe8) mount$9p_xen(&(0x7f0000000180), &(0x7f00000001c0)='./file0\x00', &(0x7f0000000200), 0x1121061, &(0x7f0000000380)={'trans=xen,', {[{@msize={'msize', 0x3d, 0xf6b3}}, {@debug={'debug', 0x3d, 0x7ff}}, {@posixacl}, {@aname={'aname', 0x3d, '*$-&'}}, {@uname={'uname', 0x3d, 'msdos\x00'}}], [{@seclabel}, {@euid_eq={'euid', 0x3d, r0}}, {@permit_directio}, {@appraise_type}]}}) r1 = syz_io_uring_setup(0x1d4a, &(0x7f0000000440)={0x0, 0xfa85, 0x0, 0x0, 0x285}, &(0x7f0000ffd000/0x1000)=nil, &(0x7f0000ffd000/0x2000)=nil, &(0x7f00000004c0)=0x0, &(0x7f0000000500)) syz_io_uring_setup(0x3e5e, &(0x7f0000000540)={0x0, 0x5c61, 0x8, 0x2, 0x72}, &(0x7f0000ffd000/0x3000)=nil, &(0x7f0000ffc000/0x3000)=nil, &(0x7f00000005c0), &(0x7f0000000600)=0x0) syz_io_uring_submit(r2, r3, &(0x7f0000000740)=@IORING_OP_READ=@pass_buffer={0x16, 0x1, 0x2004, @fd_index=0xa, 0x7, &(0x7f0000000640)=""/227, 0xe3, 0xc, 0x1}, 0x9) ioctl$SECCOMP_IOCTL_NOTIF_ADDFD(0xffffffffffffffff, 0x40182103, &(0x7f0000000780)={0x0, 0x4, r1, 0x9, 0x80000}) openat$cgroup_devices(0xffffffffffffffff, &(0x7f00000007c0)='devices.allow\x00', 0x2, 0x0) syz_mount_image$nfs4(&(0x7f0000000800), &(0x7f0000000840)='./file0/file0\x00', 0xffffffffffffff01, 0x1, &(0x7f0000000900)=[{&(0x7f0000000880)="f19bd7cfef39dd2070dcb194f7bd90ce305e2a9644b9fb91cc1e75bca69ed6bbdd7636452963af395ea61189cce718ef43420310b6ff8db9f4a606d67217b1aa7bf6e1435682323aef92ef40d036c48fa3fc363c6ad63229bb37cd76a6db9879a39f", 0x62, 0x6}], 0x8400, &(0x7f0000000940)={[{'*+\\['}]}) r4 = accept(0xffffffffffffffff, 0x0, &(0x7f0000000980)) sendmsg$MPTCP_PM_CMD_GET_LIMITS(r4, &(0x7f0000000ac0)={&(0x7f00000009c0)={0x10, 0x0, 0x0, 0x200}, 0xc, &(0x7f0000000a80)={&(0x7f0000000a00)={0x74, 0x0, 0x200, 0x70bd27, 0x25dfdbfd, {}, [@MPTCP_PM_ATTR_RCV_ADD_ADDRS={0x8, 0x2, 0x8}, @MPTCP_PM_ATTR_RCV_ADD_ADDRS={0x8, 0x2, 0x2}, @MPTCP_PM_ATTR_SUBFLOWS={0x8, 0x3, 0x6}, @MPTCP_PM_ATTR_ADDR={0x3c, 0x1, 0x0, 0x1, [@MPTCP_PM_ADDR_ATTR_PORT={0x6, 0x5, 0x4e20}, @MPTCP_PM_ADDR_ATTR_ID={0x5, 0x2, 0x5}, @MPTCP_PM_ADDR_ATTR_FLAGS={0x8, 0x6, 0x3}, @MPTCP_PM_ADDR_ATTR_PORT={0x6, 0x5, 0x4e23}, @MPTCP_PM_ADDR_ATTR_FAMILY={0x6}, @MPTCP_PM_ADDR_ATTR_FAMILY={0x6, 0x1, 0xa}, @MPTCP_PM_ADDR_ATTR_FAMILY={0x6, 0x1, 0xa}]}, @MPTCP_PM_ATTR_ADDR={0x4}, @MPTCP_PM_ATTR_SUBFLOWS={0x8}]}, 0x74}, 0x1, 0x0, 0x0, 0x11}, 0x80) sendmsg$IEEE802154_LLSEC_DEL_SECLEVEL(0xffffffffffffffff, &(0x7f0000000bc0)={&(0x7f0000000b00)={0x10, 0x0, 0x0, 0x800000}, 0xc, &(0x7f0000000b80)={&(0x7f0000000b40)={0x2c, 0x0, 0x800, 0x70bd27, 0x25dfdbff, {}, [@IEEE802154_ATTR_DEV_INDEX={0x8}, @IEEE802154_ATTR_LLSEC_FRAME_TYPE={0x5, 0x33, 0x81}, @IEEE802154_ATTR_DEV_INDEX={0x8}]}, 0x2c}, 0x1, 0x0, 0x0, 0x4}, 0x2) socketpair(0x15, 0x1, 0x10001, &(0x7f0000000c00)={0xffffffffffffffff}) sendmsg$BATADV_CMD_TP_METER_CANCEL(r5, &(0x7f0000000d00)={&(0x7f0000000c40)={0x10, 0x0, 0x0, 0x8}, 0xc, &(0x7f0000000cc0)={&(0x7f0000000c80)={0x3c, 0x0, 0x1, 0x70bd2b, 0x25dfdbfc, {}, [@BATADV_ATTR_GW_BANDWIDTH_DOWN={0x8, 0x31, 0x4}, @BATADV_ATTR_ORIG_INTERVAL={0x8, 0x39, 0x5}, @BATADV_ATTR_ISOLATION_MASK={0x8, 0x2c, 0x80000}, @BATADV_ATTR_ISOLATION_MASK={0x8, 0x2c, 0x9}, @BATADV_ATTR_GW_MODE={0x5, 0x33, 0x1}]}, 0x3c}, 0x1, 0x0, 0x0, 0x4080}, 0x40000) mount$9p_rdma(&(0x7f0000001040), &(0x7f0000001080)='./file0\x00', &(0x7f00000010c0), 0xa00800, &(0x7f0000001100)={'trans=rdma,', {'port', 0x3d, 0x4e20}, 0x2c, {[{@common=@aname={'aname', 0x3d, 'permit_directio'}}, {@sq={'sq', 0x3d, 0xffff}}], [{@fscontext={'fscontext', 0x3d, 'staff_u'}}]}}) 11:40:59 executing program 3: ioctl$SG_SET_FORCE_PACK_ID(0xffffffffffffffff, 0x227b, &(0x7f0000000000)=0x1) ioctl$SG_SET_FORCE_PACK_ID(0xffffffffffffffff, 0x227b, &(0x7f0000000040)) ioctl$SG_GET_RESERVED_SIZE(0xffffffffffffffff, 0x2272, &(0x7f0000000080)) r0 = openat$vcsa(0xffffffffffffff9c, &(0x7f00000000c0), 0x4200, 0x0) ioctl$SCSI_IOCTL_SEND_COMMAND(r0, 0x1, &(0x7f0000000100)={0x17, 0x3, 0x1c00, "af36a59fb168d324fd8eaf833aeb82f60d75e8700d81d9"}) ioctl$SG_SET_TIMEOUT(r0, 0x2201, &(0x7f0000000140)=0x4) ioctl$SG_GET_VERSION_NUM(r0, 0x2282, &(0x7f0000000180)) ioctl$SG_GET_REQUEST_TABLE(r0, 0x2286, &(0x7f00000001c0)) ioctl$SG_GET_TIMEOUT(r0, 0x2202, 0x0) r1 = syz_open_dev$sg(&(0x7f0000000340), 0x7fff, 0x40) ioctl$SG_EMULATED_HOST(r1, 0x2203, &(0x7f0000000380)) r2 = openat$vcsa(0xffffffffffffff9c, &(0x7f00000003c0), 0x8103, 0x0) ioctl$SG_GET_COMMAND_Q(r2, 0x2270, &(0x7f0000000400)) r3 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$inet6_tcp_TCP_CONGESTION(r3, 0x6, 0xd, &(0x7f0000000440)='scalable\x00', 0x9) 11:40:59 executing program 7: r0 = syz_open_dev$sg(&(0x7f0000000000), 0x1, 0x10000) ioctl$SG_GET_PACK_ID(r0, 0x227c, &(0x7f0000000040)) ioctl$SCSI_IOCTL_DOORLOCK(r0, 0x5380) ioctl$SG_SET_KEEP_ORPHAN(r0, 0x2287, &(0x7f0000000080)=0x7) ioctl$SCSI_IOCTL_BENCHMARK_COMMAND(r0, 0x3) ioctl$SCSI_IOCTL_SYNC(r0, 0x4) ioctl$SG_SET_DEBUG(r0, 0x227e, &(0x7f00000000c0)=0x1) setsockopt$packet_add_memb(0xffffffffffffffff, 0x107, 0x1, &(0x7f0000000100)={0x0, 0x1, 0x6}, 0x10) ioctl$SG_NEXT_CMD_LEN(r0, 0x2283, &(0x7f0000000140)=0x74) ioctl$SG_GET_VERSION_NUM(r0, 0x2282, &(0x7f0000000180)) socketpair(0x1f, 0x1, 0x5, &(0x7f00000001c0)={0xffffffffffffffff, 0xffffffffffffffff}) syz_genetlink_get_family_id$batadv(&(0x7f0000000200), r1) ioctl$SCSI_IOCTL_STOP_UNIT(r0, 0x6) openat$vcsa(0xffffffffffffff9c, &(0x7f0000000440), 0x10480, 0x0) 11:40:59 executing program 1: r0 = shmget(0x2, 0x3000, 0x100, &(0x7f0000ffb000/0x3000)=nil) shmat(r0, &(0x7f0000ffa000/0x3000)=nil, 0x2000) shmat(r0, &(0x7f0000ffa000/0x4000)=nil, 0x3000) shmget(0x3, 0x1000, 0x100, &(0x7f0000ffd000/0x1000)=nil) r1 = syz_genetlink_get_family_id$netlbl_mgmt(&(0x7f0000000040), 0xffffffffffffffff) sendmsg$NLBL_MGMT_C_REMOVEDEF(0xffffffffffffffff, &(0x7f0000000100)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x8}, 0xc, &(0x7f00000000c0)={&(0x7f0000000080)={0x3c, r1, 0x20, 0x70bd29, 0x25dfdbff, {}, [@NLBL_MGMT_A_FAMILY={0x6, 0xb, 0x5}, @NLBL_MGMT_A_PROTOCOL={0x8, 0x2, 0x3}, @NLBL_MGMT_A_IPV4MASK={0x8, 0x8, @multicast1}, @NLBL_MGMT_A_CLPDOI={0x8}, @NLBL_MGMT_A_IPV4ADDR={0x8, 0x7, @local}]}, 0x3c}, 0x1, 0x0, 0x0, 0x4048820}, 0x40000) shmat(0xffffffffffffffff, &(0x7f0000ffb000/0x4000)=nil, 0x2000) r2 = shmget(0x0, 0xf000, 0x100, &(0x7f0000ff1000/0xf000)=nil) shmctl$IPC_RMID(r2, 0x0) r3 = mmap$IORING_OFF_SQ_RING(&(0x7f0000ffd000/0x1000)=nil, 0x1000, 0x2000006, 0x40010, 0xffffffffffffffff, 0x0) syz_io_uring_submit(r3, 0x0, &(0x7f00000001c0)=@IORING_OP_PROVIDE_BUFFERS={0x1f, 0x1, 0x0, 0x8, 0x2, &(0x7f0000000140)="10e8e6d73f8e97a04564912d4b0bee6921be05ed083e4d741dabdbce8c94949f57a5c9d9da73d0e5ad668714159e31498f181aad79547c645eefb456a7b8c4be765eb156b77cba8a752b90d7729b2c285893a10c3633d2485f48f30d247214c5e28a", 0x7, 0x0, 0x1, {0x1}}, 0x100) r4 = socket(0x2c, 0x5, 0x1) accept4$packet(0xffffffffffffffff, &(0x7f0000000280)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @random}, &(0x7f00000002c0)=0x14, 0x40000) recvfrom$packet(r4, &(0x7f0000000200)=""/108, 0x6c, 0x2000, &(0x7f0000000300)={0x11, 0x16, r5, 0x1, 0x8, 0x6, @local}, 0x14) r6 = syz_genetlink_get_family_id$netlbl_mgmt(&(0x7f0000000380), 0xffffffffffffffff) sendmsg$NLBL_MGMT_C_REMOVEDEF(0xffffffffffffffff, &(0x7f0000000440)={&(0x7f0000000340)={0x10, 0x0, 0x0, 0x4}, 0xc, &(0x7f0000000400)={&(0x7f00000003c0)={0x24, r6, 0x400, 0x70bd26, 0x25dfdbfc, {}, [@NLBL_MGMT_A_FAMILY={0x6, 0xb, 0x18}, @NLBL_MGMT_A_PROTOCOL={0x8, 0x2, 0x3}]}, 0x24}, 0x1, 0x0, 0x0, 0x48084}, 0x8040) shmget$private(0x0, 0x2000, 0x10, &(0x7f0000ffc000/0x2000)=nil) 11:41:07 executing program 5: getpeername$packet(0xffffffffffffffff, &(0x7f0000000000)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @dev}, &(0x7f0000000040)=0x14) ioctl$sock_SIOCADDRT(0xffffffffffffffff, 0x890b, &(0x7f0000000080)={0x0, @phonet={0x23, 0xfe, 0x0, 0x2f}, @hci={0x1f, 0xffffffffffffffff, 0x3}, @rc={0x1f, @any, 0x2}, 0x5, 0x0, 0x0, 0x0, 0x7ff, 0x0, 0x0, 0x4, 0x4}) r0 = mmap$IORING_OFF_SQES(&(0x7f0000ffa000/0x4000)=nil, 0x4000, 0x1000004, 0x810, 0xffffffffffffffff, 0x10000000) syz_io_uring_submit(0x0, r0, &(0x7f0000000100)=@IORING_OP_MADVISE={0x19, 0x3, 0x0, 0x0, 0x0, &(0x7f0000ffa000/0x2000)=nil, 0x2000, 0xb, 0x1}, 0x8) r1 = syz_genetlink_get_family_id$mptcp(&(0x7f0000000180), 0xffffffffffffffff) sendmsg$MPTCP_PM_CMD_ADD_ADDR(0xffffffffffffffff, &(0x7f0000000240)={&(0x7f0000000140)={0x10, 0x0, 0x0, 0x10000}, 0xc, &(0x7f0000000200)={&(0x7f00000001c0)={0x24, r1, 0x800, 0x70bd27, 0x25dfdbfd, {}, [@MPTCP_PM_ATTR_RCV_ADD_ADDRS={0x8, 0x2, 0x8}, @MPTCP_PM_ATTR_RCV_ADD_ADDRS={0x8, 0x2, 0x6}]}, 0x24}, 0x1, 0x0, 0x0, 0x2400c096}, 0x80) sendmsg$MPTCP_PM_CMD_FLUSH_ADDRS(0xffffffffffffffff, &(0x7f00000003c0)={&(0x7f0000000280)={0x10, 0x0, 0x0, 0x40}, 0xc, &(0x7f0000000380)={&(0x7f00000002c0)={0xa4, r1, 0x200, 0x70bd25, 0x25dfdbff, {}, [@MPTCP_PM_ATTR_RCV_ADD_ADDRS={0x8, 0x2, 0x3}, @MPTCP_PM_ATTR_ADDR={0x30, 0x1, 0x0, 0x1, [@MPTCP_PM_ADDR_ATTR_ADDR6={0x14, 0x4, @initdev={0xfe, 0x88, '\x00', 0x0, 0x0}}, @MPTCP_PM_ADDR_ATTR_ADDR4={0x8, 0x3, @local}, @MPTCP_PM_ADDR_ATTR_FLAGS={0x8, 0x6, 0x2}, @MPTCP_PM_ADDR_ATTR_FAMILY={0x6, 0x1, 0xa}]}, @MPTCP_PM_ATTR_ADDR={0x2c, 0x1, 0x0, 0x1, [@MPTCP_PM_ADDR_ATTR_ID={0x5, 0x2, 0x81}, @MPTCP_PM_ADDR_ATTR_PORT={0x6, 0x5, 0x4e22}, @MPTCP_PM_ADDR_ATTR_FAMILY={0x6, 0x1, 0xa}, @MPTCP_PM_ADDR_ATTR_FLAGS={0x8}, @MPTCP_PM_ADDR_ATTR_ID={0x5, 0x2, 0x40}]}, @MPTCP_PM_ATTR_SUBFLOWS={0x8, 0x3, 0x5}, @MPTCP_PM_ATTR_SUBFLOWS={0x8, 0x3, 0x5}, @MPTCP_PM_ATTR_ADDR={0x14, 0x1, 0x0, 0x1, [@MPTCP_PM_ADDR_ATTR_PORT={0x6, 0x5, 0x4e23}, @MPTCP_PM_ADDR_ATTR_PORT={0x6, 0x5, 0x4e21}]}, @MPTCP_PM_ATTR_SUBFLOWS={0x8, 0x3, 0x2}]}, 0xa4}, 0x1, 0x0, 0x0, 0x40}, 0x90) r2 = syz_open_dev$sg(&(0x7f0000000400), 0x4, 0x38040) ioctl$SCSI_IOCTL_DOORUNLOCK(r2, 0x5381) r3 = accept$packet(0xffffffffffffffff, &(0x7f0000000440), &(0x7f0000000480)=0x14) syz_io_uring_submit(0x0, r0, &(0x7f00000004c0)=@IORING_OP_ASYNC_CANCEL={0xe, 0x1, 0x0, 0x0, 0x0, 0x23456}, 0x5) accept4$packet(r3, &(0x7f0000000500), &(0x7f0000000540)=0x14, 0x800) setsockopt$inet6_tcp_TCP_QUEUE_SEQ(0xffffffffffffffff, 0x6, 0x15, &(0x7f0000000780)=0x400, 0x4) 11:41:07 executing program 0: r0 = openat$vcsa(0xffffffffffffff9c, &(0x7f0000000000), 0x40000, 0x0) ioctl$SG_GET_PACK_ID(r0, 0x227c, &(0x7f0000000040)) r1 = openat$sr(0xffffffffffffff9c, &(0x7f0000000080), 0x454082, 0x0) ioctl$SG_SET_DEBUG(r1, 0x227e, &(0x7f00000000c0)=0x1) r2 = syz_open_dev$sg(&(0x7f0000000100), 0x8, 0x280102) ioctl$SG_GET_RESERVED_SIZE(r2, 0x2272, &(0x7f0000000140)) ioctl$SG_GET_REQUEST_TABLE(r1, 0x2286, &(0x7f0000000180)) syz_open_dev$sg(&(0x7f0000000300), 0x100000000, 0x408903) syz_open_dev$sg(&(0x7f0000000540), 0x8, 0x8100) 11:41:07 executing program 1: r0 = shmget(0x2, 0x3000, 0x100, &(0x7f0000ffb000/0x3000)=nil) shmat(r0, &(0x7f0000ffa000/0x3000)=nil, 0x2000) shmat(r0, &(0x7f0000ffa000/0x4000)=nil, 0x3000) shmget(0x3, 0x1000, 0x100, &(0x7f0000ffd000/0x1000)=nil) r1 = syz_genetlink_get_family_id$netlbl_mgmt(&(0x7f0000000040), 0xffffffffffffffff) sendmsg$NLBL_MGMT_C_REMOVEDEF(0xffffffffffffffff, &(0x7f0000000100)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x8}, 0xc, &(0x7f00000000c0)={&(0x7f0000000080)={0x3c, r1, 0x20, 0x70bd29, 0x25dfdbff, {}, [@NLBL_MGMT_A_FAMILY={0x6, 0xb, 0x5}, @NLBL_MGMT_A_PROTOCOL={0x8, 0x2, 0x3}, @NLBL_MGMT_A_IPV4MASK={0x8, 0x8, @multicast1}, @NLBL_MGMT_A_CLPDOI={0x8}, @NLBL_MGMT_A_IPV4ADDR={0x8, 0x7, @local}]}, 0x3c}, 0x1, 0x0, 0x0, 0x4048820}, 0x40000) shmat(0xffffffffffffffff, &(0x7f0000ffb000/0x4000)=nil, 0x2000) r2 = shmget(0x0, 0xf000, 0x100, &(0x7f0000ff1000/0xf000)=nil) shmctl$IPC_RMID(r2, 0x0) r3 = mmap$IORING_OFF_SQ_RING(&(0x7f0000ffd000/0x1000)=nil, 0x1000, 0x2000006, 0x40010, 0xffffffffffffffff, 0x0) syz_io_uring_submit(r3, 0x0, &(0x7f00000001c0)=@IORING_OP_PROVIDE_BUFFERS={0x1f, 0x1, 0x0, 0x8, 0x2, &(0x7f0000000140)="10e8e6d73f8e97a04564912d4b0bee6921be05ed083e4d741dabdbce8c94949f57a5c9d9da73d0e5ad668714159e31498f181aad79547c645eefb456a7b8c4be765eb156b77cba8a752b90d7729b2c285893a10c3633d2485f48f30d247214c5e28a", 0x7, 0x0, 0x1, {0x1}}, 0x100) r4 = socket(0x2c, 0x5, 0x1) accept4$packet(0xffffffffffffffff, &(0x7f0000000280)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @random}, &(0x7f00000002c0)=0x14, 0x40000) recvfrom$packet(r4, &(0x7f0000000200)=""/108, 0x6c, 0x2000, &(0x7f0000000300)={0x11, 0x16, r5, 0x1, 0x8, 0x6, @local}, 0x14) r6 = syz_genetlink_get_family_id$netlbl_mgmt(&(0x7f0000000380), 0xffffffffffffffff) sendmsg$NLBL_MGMT_C_REMOVEDEF(0xffffffffffffffff, &(0x7f0000000440)={&(0x7f0000000340)={0x10, 0x0, 0x0, 0x4}, 0xc, &(0x7f0000000400)={&(0x7f00000003c0)={0x24, r6, 0x400, 0x70bd26, 0x25dfdbfc, {}, [@NLBL_MGMT_A_FAMILY={0x6, 0xb, 0x18}, @NLBL_MGMT_A_PROTOCOL={0x8, 0x2, 0x3}]}, 0x24}, 0x1, 0x0, 0x0, 0x48084}, 0x8040) shmget$private(0x0, 0x2000, 0x10, &(0x7f0000ffc000/0x2000)=nil) 11:41:07 executing program 4: setsockopt$inet_tcp_TCP_QUEUE_SEQ(0xffffffffffffffff, 0x6, 0x15, &(0x7f0000000000), 0x4) r0 = openat$vcsa(0xffffffffffffff9c, &(0x7f0000000040), 0x81, 0x0) setsockopt$packet_tx_ring(r0, 0x107, 0xd, &(0x7f0000000080)=@req={0x4, 0xffffffff, 0xd5, 0x5}, 0x10) setsockopt$inet_tcp_TCP_REPAIR_WINDOW(r0, 0x6, 0x1d, &(0x7f00000000c0)={0xfffffff9, 0x1, 0x7fffffff, 0x6, 0x1}, 0x14) ioctl$SCSI_IOCTL_SYNC(r0, 0x4) r1 = accept(r0, &(0x7f0000000100)=@rc={0x1f, @fixed}, &(0x7f0000000180)=0x80) setsockopt$inet_tcp_TCP_FASTOPEN_KEY(r1, 0x6, 0x21, &(0x7f00000001c0)="2a6eddb47c1ebcb5002df4f95b6a3218", 0x10) socket$inet_tcp(0x2, 0x1, 0x0) ioctl$SG_GET_VERSION_NUM(r0, 0x2282, &(0x7f0000000200)) ioctl$SCSI_IOCTL_STOP_UNIT(r0, 0x6) ioctl$sock_SIOCADDRT(r1, 0x890b, &(0x7f0000000280)={0x0, @ax25={0x3, @remote={0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0x1}, 0x3}, @can={0x1d, 0x0}, @l2={0x1f, 0x20, @any, 0x81}, 0x81, 0x0, 0x0, 0x0, 0x3, &(0x7f0000000240)='veth1_to_bond\x00', 0x1, 0x9, 0x81}) sendto$packet(r0, &(0x7f0000000300)="ef239bcbf699ea49248d932bd7a123b6dc9273af2c6c1771bbfca4377cfca4cfc8d7a0ed5b9cec2ccbbb66f69d40c744edd53168a1bdf7d412632799b3df3b80bb5e766fd2e2b373e553a501f4d1997e0a3d387642b483dca2a2bee261552bc0ec0162efa75aa5e9f1a18f050fc5d5fbaa7dceca8e90ed87643278338e74fb16fecf749ace8174d85c2b85721c1097077921541caaf6d322510105ad87d2a427ffd1689b31d399985823b2bb0abd928963c7", 0xb2, 0x4004, &(0x7f00000003c0)={0x11, 0x16, r2, 0x1, 0x6, 0x6, @local}, 0x14) syz_genetlink_get_family_id$netlbl_mgmt(&(0x7f0000000740), 0xffffffffffffffff) 11:41:07 executing program 6: ioprio_set$uid(0x0, 0xee01, 0x4004) syz_mount_image$msdos(&(0x7f0000000000), &(0x7f0000000040)='./file0\x00', 0x200, 0x1, &(0x7f00000000c0)=[{&(0x7f0000000080)="7c74c7bc99e778a0c971e6f50fbdd2b70fa0b038d18c7d5ac685833434d89dce684239293aa5d8b6f11bc5c4a033ad1dc68319fad36a1101aad751fd6f4f10", 0x3f, 0x7f}], 0x42000, &(0x7f0000000100)={[{@dots}], [{@obj_user}, {@dont_appraise}, {@uid_lt}, {@hash}, {@seclabel}]}) getsockopt$inet6_IPV6_XFRM_POLICY(0xffffffffffffffff, 0x29, 0x23, &(0x7f0000000240)={{{@in=@loopback, @in6=@empty, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, {{@in6=@local}, 0x0, @in6=@mcast1}}, &(0x7f0000000340)=0xe8) mount$9p_xen(&(0x7f0000000180), &(0x7f00000001c0)='./file0\x00', &(0x7f0000000200), 0x1121061, &(0x7f0000000380)={'trans=xen,', {[{@msize={'msize', 0x3d, 0xf6b3}}, {@debug={'debug', 0x3d, 0x7ff}}, {@posixacl}, {@aname={'aname', 0x3d, '*$-&'}}, {@uname={'uname', 0x3d, 'msdos\x00'}}], [{@seclabel}, {@euid_eq={'euid', 0x3d, r0}}, {@permit_directio}, {@appraise_type}]}}) r1 = syz_io_uring_setup(0x1d4a, &(0x7f0000000440)={0x0, 0xfa85, 0x0, 0x0, 0x285}, &(0x7f0000ffd000/0x1000)=nil, &(0x7f0000ffd000/0x2000)=nil, &(0x7f00000004c0)=0x0, &(0x7f0000000500)) syz_io_uring_setup(0x3e5e, &(0x7f0000000540)={0x0, 0x5c61, 0x8, 0x2, 0x72}, &(0x7f0000ffd000/0x3000)=nil, &(0x7f0000ffc000/0x3000)=nil, &(0x7f00000005c0), &(0x7f0000000600)=0x0) syz_io_uring_submit(r2, r3, &(0x7f0000000740)=@IORING_OP_READ=@pass_buffer={0x16, 0x1, 0x2004, @fd_index=0xa, 0x7, &(0x7f0000000640)=""/227, 0xe3, 0xc, 0x1}, 0x9) ioctl$SECCOMP_IOCTL_NOTIF_ADDFD(0xffffffffffffffff, 0x40182103, &(0x7f0000000780)={0x0, 0x4, r1, 0x9, 0x80000}) openat$cgroup_devices(0xffffffffffffffff, &(0x7f00000007c0)='devices.allow\x00', 0x2, 0x0) syz_mount_image$nfs4(&(0x7f0000000800), &(0x7f0000000840)='./file0/file0\x00', 0xffffffffffffff01, 0x1, &(0x7f0000000900)=[{&(0x7f0000000880)="f19bd7cfef39dd2070dcb194f7bd90ce305e2a9644b9fb91cc1e75bca69ed6bbdd7636452963af395ea61189cce718ef43420310b6ff8db9f4a606d67217b1aa7bf6e1435682323aef92ef40d036c48fa3fc363c6ad63229bb37cd76a6db9879a39f", 0x62, 0x6}], 0x8400, &(0x7f0000000940)={[{'*+\\['}]}) r4 = accept(0xffffffffffffffff, 0x0, &(0x7f0000000980)) sendmsg$MPTCP_PM_CMD_GET_LIMITS(r4, &(0x7f0000000ac0)={&(0x7f00000009c0)={0x10, 0x0, 0x0, 0x200}, 0xc, &(0x7f0000000a80)={&(0x7f0000000a00)={0x74, 0x0, 0x200, 0x70bd27, 0x25dfdbfd, {}, [@MPTCP_PM_ATTR_RCV_ADD_ADDRS={0x8, 0x2, 0x8}, @MPTCP_PM_ATTR_RCV_ADD_ADDRS={0x8, 0x2, 0x2}, @MPTCP_PM_ATTR_SUBFLOWS={0x8, 0x3, 0x6}, @MPTCP_PM_ATTR_ADDR={0x3c, 0x1, 0x0, 0x1, [@MPTCP_PM_ADDR_ATTR_PORT={0x6, 0x5, 0x4e20}, @MPTCP_PM_ADDR_ATTR_ID={0x5, 0x2, 0x5}, @MPTCP_PM_ADDR_ATTR_FLAGS={0x8, 0x6, 0x3}, @MPTCP_PM_ADDR_ATTR_PORT={0x6, 0x5, 0x4e23}, @MPTCP_PM_ADDR_ATTR_FAMILY={0x6}, @MPTCP_PM_ADDR_ATTR_FAMILY={0x6, 0x1, 0xa}, @MPTCP_PM_ADDR_ATTR_FAMILY={0x6, 0x1, 0xa}]}, @MPTCP_PM_ATTR_ADDR={0x4}, @MPTCP_PM_ATTR_SUBFLOWS={0x8}]}, 0x74}, 0x1, 0x0, 0x0, 0x11}, 0x80) sendmsg$IEEE802154_LLSEC_DEL_SECLEVEL(0xffffffffffffffff, &(0x7f0000000bc0)={&(0x7f0000000b00)={0x10, 0x0, 0x0, 0x800000}, 0xc, &(0x7f0000000b80)={&(0x7f0000000b40)={0x2c, 0x0, 0x800, 0x70bd27, 0x25dfdbff, {}, [@IEEE802154_ATTR_DEV_INDEX={0x8}, @IEEE802154_ATTR_LLSEC_FRAME_TYPE={0x5, 0x33, 0x81}, @IEEE802154_ATTR_DEV_INDEX={0x8}]}, 0x2c}, 0x1, 0x0, 0x0, 0x4}, 0x2) socketpair(0x15, 0x1, 0x10001, &(0x7f0000000c00)={0xffffffffffffffff}) sendmsg$BATADV_CMD_TP_METER_CANCEL(r5, &(0x7f0000000d00)={&(0x7f0000000c40)={0x10, 0x0, 0x0, 0x8}, 0xc, &(0x7f0000000cc0)={&(0x7f0000000c80)={0x3c, 0x0, 0x1, 0x70bd2b, 0x25dfdbfc, {}, [@BATADV_ATTR_GW_BANDWIDTH_DOWN={0x8, 0x31, 0x4}, @BATADV_ATTR_ORIG_INTERVAL={0x8, 0x39, 0x5}, @BATADV_ATTR_ISOLATION_MASK={0x8, 0x2c, 0x80000}, @BATADV_ATTR_ISOLATION_MASK={0x8, 0x2c, 0x9}, @BATADV_ATTR_GW_MODE={0x5, 0x33, 0x1}]}, 0x3c}, 0x1, 0x0, 0x0, 0x4080}, 0x40000) mount$9p_rdma(&(0x7f0000001040), &(0x7f0000001080)='./file0\x00', &(0x7f00000010c0), 0xa00800, &(0x7f0000001100)={'trans=rdma,', {'port', 0x3d, 0x4e20}, 0x2c, {[{@common=@aname={'aname', 0x3d, 'permit_directio'}}, {@sq={'sq', 0x3d, 0xffff}}], [{@fscontext={'fscontext', 0x3d, 'staff_u'}}]}}) 11:41:07 executing program 2: clock_nanosleep(0x7, 0x0, &(0x7f0000000000)={0x77359400}, &(0x7f0000000040)) getsockopt$inet6_IPV6_XFRM_POLICY(0xffffffffffffffff, 0x29, 0x23, &(0x7f0000000080)={{{@in6, @in6=@remote, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, {{@in6=@dev}, 0x0, @in=@initdev}}, &(0x7f0000000180)=0xe8) setsockopt$packet_add_memb(0xffffffffffffffff, 0x107, 0x1, &(0x7f00000001c0)={r0, 0x1, 0x6, @broadcast}, 0x10) getpeername$packet(0xffffffffffffffff, &(0x7f0000000200)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @dev}, &(0x7f0000000240)=0x14) recvmsg(0xffffffffffffffff, &(0x7f00000027c0)={&(0x7f0000000280)=@xdp={0x2c, 0x0, 0x0}, 0x80, &(0x7f0000002640)=[{&(0x7f0000000300)=""/227, 0xe3}, {&(0x7f0000000400)=""/4096, 0x1000}, {&(0x7f0000001400)=""/92, 0x5c}, {&(0x7f0000001480)=""/93, 0x5d}, {&(0x7f0000001500)=""/4096, 0x1000}, {&(0x7f0000002500)=""/87, 0x57}, {&(0x7f0000002580)=""/189, 0xbd}], 0x7, &(0x7f00000026c0)=""/199, 0xc7}, 0x140) bind$packet(0xffffffffffffffff, &(0x7f0000002800)={0x11, 0x1b, r2, 0x1, 0x5}, 0x14) getresgid(&(0x7f0000002840), &(0x7f0000002880), &(0x7f00000028c0)) r3 = accept4$packet(0xffffffffffffffff, &(0x7f0000002900)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @multicast}, &(0x7f0000002940)=0x14, 0x80000) recvfrom$packet(r3, &(0x7f0000002980)=""/4096, 0x1000, 0x0, &(0x7f0000003980)={0x11, 0x17, r2, 0x1, 0x5, 0x6, @multicast}, 0x14) r4 = socket$inet6_udp(0xa, 0x2, 0x0) getsockopt$inet6_IPV6_XFRM_POLICY(r4, 0x29, 0x23, &(0x7f00000039c0)={{{@in6=@ipv4, @in6=@private0}}, {{@in=@private}, 0x0, @in6=@remote}}, &(0x7f0000003ac0)=0xe8) r5 = openat$sr(0xffffffffffffff9c, &(0x7f0000003b00), 0x200000, 0x0) recvfrom$packet(r5, &(0x7f0000003b40)=""/161, 0xa1, 0x140, &(0x7f0000003c00)={0x11, 0x2, r1, 0x1, 0x9a, 0x6, @local}, 0x14) r6 = openat$vcsa(0xffffffffffffff9c, &(0x7f0000003c40), 0x500, 0x0) write$bt_hci(r6, &(0x7f0000003c80)={0x1, @write_current_iac_lap={{0xc3a, 0x7}, {0x6, "30a9a39c10c4"}}}, 0xb) prctl$PR_SET_MM_MAP_SIZE(0x23, 0xf, &(0x7f0000003cc0)) openat$sr(0xffffffffffffff9c, &(0x7f0000005480), 0x428802, 0x0) 11:41:07 executing program 7: r0 = syz_open_dev$sg(&(0x7f0000000000), 0x1, 0x10000) ioctl$SG_GET_PACK_ID(r0, 0x227c, &(0x7f0000000040)) ioctl$SCSI_IOCTL_DOORLOCK(r0, 0x5380) ioctl$SG_SET_KEEP_ORPHAN(r0, 0x2287, &(0x7f0000000080)=0x7) ioctl$SCSI_IOCTL_BENCHMARK_COMMAND(r0, 0x3) ioctl$SCSI_IOCTL_SYNC(r0, 0x4) ioctl$SG_SET_DEBUG(r0, 0x227e, &(0x7f00000000c0)=0x1) setsockopt$packet_add_memb(0xffffffffffffffff, 0x107, 0x1, &(0x7f0000000100)={0x0, 0x1, 0x6}, 0x10) ioctl$SG_NEXT_CMD_LEN(r0, 0x2283, &(0x7f0000000140)=0x74) ioctl$SG_GET_VERSION_NUM(r0, 0x2282, &(0x7f0000000180)) socketpair(0x1f, 0x1, 0x5, &(0x7f00000001c0)={0xffffffffffffffff, 0xffffffffffffffff}) syz_genetlink_get_family_id$batadv(&(0x7f0000000200), r1) openat$vcsa(0xffffffffffffff9c, &(0x7f0000000440), 0x10480, 0x0) 11:41:07 executing program 3: ioctl$SG_SET_FORCE_PACK_ID(0xffffffffffffffff, 0x227b, &(0x7f0000000000)=0x1) ioctl$SG_SET_FORCE_PACK_ID(0xffffffffffffffff, 0x227b, &(0x7f0000000040)) ioctl$SG_GET_RESERVED_SIZE(0xffffffffffffffff, 0x2272, &(0x7f0000000080)) r0 = openat$vcsa(0xffffffffffffff9c, &(0x7f00000000c0), 0x4200, 0x0) ioctl$SCSI_IOCTL_SEND_COMMAND(r0, 0x1, &(0x7f0000000100)={0x17, 0x3, 0x1c00, "af36a59fb168d324fd8eaf833aeb82f60d75e8700d81d9"}) ioctl$SG_SET_TIMEOUT(r0, 0x2201, &(0x7f0000000140)=0x4) ioctl$SG_GET_VERSION_NUM(r0, 0x2282, &(0x7f0000000180)) ioctl$SG_GET_REQUEST_TABLE(r0, 0x2286, &(0x7f00000001c0)) ioctl$SG_GET_TIMEOUT(r0, 0x2202, 0x0) r1 = syz_open_dev$sg(&(0x7f0000000340), 0x7fff, 0x40) ioctl$SG_EMULATED_HOST(r1, 0x2203, &(0x7f0000000380)) r2 = openat$vcsa(0xffffffffffffff9c, &(0x7f00000003c0), 0x8103, 0x0) ioctl$SG_GET_COMMAND_Q(r2, 0x2270, &(0x7f0000000400)) setsockopt$inet6_tcp_TCP_CONGESTION(0xffffffffffffffff, 0x6, 0xd, &(0x7f0000000440)='scalable\x00', 0x9) [ 160.326909] loop6: detected capacity change from 0 to 1 [ 160.359963] loop6: detected capacity change from 0 to 264192 [ 160.377921] nfs4: Unknown parameter '*+\[' 11:41:07 executing program 0: r0 = openat$vcsa(0xffffffffffffff9c, &(0x7f0000000000), 0x40000, 0x0) ioctl$SG_GET_PACK_ID(r0, 0x227c, &(0x7f0000000040)) r1 = openat$sr(0xffffffffffffff9c, &(0x7f0000000080), 0x454082, 0x0) ioctl$SG_SET_DEBUG(r1, 0x227e, &(0x7f00000000c0)=0x1) r2 = syz_open_dev$sg(&(0x7f0000000100), 0x8, 0x280102) ioctl$SG_GET_RESERVED_SIZE(r2, 0x2272, &(0x7f0000000140)) ioctl$SG_GET_REQUEST_TABLE(r1, 0x2286, &(0x7f0000000180)) syz_open_dev$sg(&(0x7f0000000540), 0x8, 0x8100) 11:41:07 executing program 3: ioctl$SG_SET_FORCE_PACK_ID(0xffffffffffffffff, 0x227b, &(0x7f0000000000)=0x1) ioctl$SG_SET_FORCE_PACK_ID(0xffffffffffffffff, 0x227b, &(0x7f0000000040)) ioctl$SG_GET_RESERVED_SIZE(0xffffffffffffffff, 0x2272, &(0x7f0000000080)) r0 = openat$vcsa(0xffffffffffffff9c, &(0x7f00000000c0), 0x4200, 0x0) ioctl$SCSI_IOCTL_SEND_COMMAND(r0, 0x1, &(0x7f0000000100)={0x17, 0x3, 0x1c00, "af36a59fb168d324fd8eaf833aeb82f60d75e8700d81d9"}) ioctl$SG_SET_TIMEOUT(r0, 0x2201, &(0x7f0000000140)=0x4) ioctl$SG_GET_VERSION_NUM(r0, 0x2282, &(0x7f0000000180)) ioctl$SG_GET_REQUEST_TABLE(r0, 0x2286, &(0x7f00000001c0)) ioctl$SG_GET_TIMEOUT(r0, 0x2202, 0x0) r1 = syz_open_dev$sg(&(0x7f0000000340), 0x7fff, 0x40) ioctl$SG_EMULATED_HOST(r1, 0x2203, &(0x7f0000000380)) r2 = openat$vcsa(0xffffffffffffff9c, &(0x7f00000003c0), 0x8103, 0x0) ioctl$SG_GET_COMMAND_Q(r2, 0x2270, &(0x7f0000000400)) setsockopt$inet6_tcp_TCP_CONGESTION(0xffffffffffffffff, 0x6, 0xd, &(0x7f0000000440)='scalable\x00', 0x9) [ 160.446911] SELinux: security_context_str_to_sid (staff_u) failed with errno=-22 11:41:07 executing program 4: setsockopt$inet_tcp_TCP_QUEUE_SEQ(0xffffffffffffffff, 0x6, 0x15, &(0x7f0000000000), 0x4) r0 = openat$vcsa(0xffffffffffffff9c, &(0x7f0000000040), 0x81, 0x0) setsockopt$packet_tx_ring(r0, 0x107, 0xd, &(0x7f0000000080)=@req={0x4, 0xffffffff, 0xd5, 0x5}, 0x10) setsockopt$inet_tcp_TCP_REPAIR_WINDOW(r0, 0x6, 0x1d, &(0x7f00000000c0)={0xfffffff9, 0x1, 0x7fffffff, 0x6, 0x1}, 0x14) ioctl$SCSI_IOCTL_SYNC(r0, 0x4) r1 = accept(r0, &(0x7f0000000100)=@rc={0x1f, @fixed}, &(0x7f0000000180)=0x80) setsockopt$inet_tcp_TCP_FASTOPEN_KEY(r1, 0x6, 0x21, &(0x7f00000001c0)="2a6eddb47c1ebcb5002df4f95b6a3218", 0x10) socket$inet_tcp(0x2, 0x1, 0x0) ioctl$SG_GET_VERSION_NUM(r0, 0x2282, &(0x7f0000000200)) ioctl$SCSI_IOCTL_STOP_UNIT(r0, 0x6) ioctl$sock_SIOCADDRT(r1, 0x890b, &(0x7f0000000280)={0x0, @ax25={0x3, @remote={0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0x1}, 0x3}, @can, @l2={0x1f, 0x20, @any, 0x81}, 0x81, 0x0, 0x0, 0x0, 0x3, &(0x7f0000000240)='veth1_to_bond\x00', 0x1, 0x9, 0x81}) syz_genetlink_get_family_id$netlbl_mgmt(&(0x7f0000000440), 0xffffffffffffffff) syz_genetlink_get_family_id$netlbl_mgmt(&(0x7f0000000740), 0xffffffffffffffff) 11:41:07 executing program 0: r0 = openat$vcsa(0xffffffffffffff9c, &(0x7f0000000000), 0x40000, 0x0) ioctl$SG_GET_PACK_ID(r0, 0x227c, &(0x7f0000000040)) r1 = openat$sr(0xffffffffffffff9c, &(0x7f0000000080), 0x454082, 0x0) ioctl$SG_SET_DEBUG(r1, 0x227e, &(0x7f00000000c0)=0x1) r2 = syz_open_dev$sg(&(0x7f0000000100), 0x8, 0x280102) ioctl$SG_GET_RESERVED_SIZE(r2, 0x2272, &(0x7f0000000140)) syz_open_dev$sg(&(0x7f0000000540), 0x8, 0x8100) 11:41:07 executing program 1: r0 = shmget(0x2, 0x3000, 0x100, &(0x7f0000ffb000/0x3000)=nil) shmat(r0, &(0x7f0000ffa000/0x3000)=nil, 0x2000) shmat(r0, &(0x7f0000ffa000/0x4000)=nil, 0x3000) shmget(0x3, 0x1000, 0x100, &(0x7f0000ffd000/0x1000)=nil) r1 = syz_genetlink_get_family_id$netlbl_mgmt(&(0x7f0000000040), 0xffffffffffffffff) sendmsg$NLBL_MGMT_C_REMOVEDEF(0xffffffffffffffff, &(0x7f0000000100)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x8}, 0xc, &(0x7f00000000c0)={&(0x7f0000000080)={0x3c, r1, 0x20, 0x70bd29, 0x25dfdbff, {}, [@NLBL_MGMT_A_FAMILY={0x6, 0xb, 0x5}, @NLBL_MGMT_A_PROTOCOL={0x8, 0x2, 0x3}, @NLBL_MGMT_A_IPV4MASK={0x8, 0x8, @multicast1}, @NLBL_MGMT_A_CLPDOI={0x8}, @NLBL_MGMT_A_IPV4ADDR={0x8, 0x7, @local}]}, 0x3c}, 0x1, 0x0, 0x0, 0x4048820}, 0x40000) shmat(0xffffffffffffffff, &(0x7f0000ffb000/0x4000)=nil, 0x2000) r2 = shmget(0x0, 0xf000, 0x100, &(0x7f0000ff1000/0xf000)=nil) shmctl$IPC_RMID(r2, 0x0) r3 = mmap$IORING_OFF_SQ_RING(&(0x7f0000ffd000/0x1000)=nil, 0x1000, 0x2000006, 0x40010, 0xffffffffffffffff, 0x0) syz_io_uring_submit(r3, 0x0, &(0x7f00000001c0)=@IORING_OP_PROVIDE_BUFFERS={0x1f, 0x1, 0x0, 0x8, 0x2, &(0x7f0000000140)="10e8e6d73f8e97a04564912d4b0bee6921be05ed083e4d741dabdbce8c94949f57a5c9d9da73d0e5ad668714159e31498f181aad79547c645eefb456a7b8c4be765eb156b77cba8a752b90d7729b2c285893a10c3633d2485f48f30d247214c5e28a", 0x7, 0x0, 0x1, {0x1}}, 0x100) r4 = socket(0x2c, 0x5, 0x1) accept4$packet(0xffffffffffffffff, &(0x7f0000000280)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @random}, &(0x7f00000002c0)=0x14, 0x40000) recvfrom$packet(r4, &(0x7f0000000200)=""/108, 0x6c, 0x2000, &(0x7f0000000300)={0x11, 0x16, r5, 0x1, 0x8, 0x6, @local}, 0x14) syz_genetlink_get_family_id$netlbl_mgmt(&(0x7f0000000380), 0xffffffffffffffff) io_uring_setup(0x14ab, &(0x7f0000000480)={0x0, 0x5191, 0x20, 0x1, 0x3ba}) shmget$private(0x0, 0x2000, 0x10, &(0x7f0000ffc000/0x2000)=nil) 11:41:07 executing program 7: r0 = syz_open_dev$sg(&(0x7f0000000000), 0x1, 0x10000) ioctl$SG_GET_PACK_ID(r0, 0x227c, &(0x7f0000000040)) ioctl$SCSI_IOCTL_DOORLOCK(r0, 0x5380) ioctl$SG_SET_KEEP_ORPHAN(r0, 0x2287, &(0x7f0000000080)=0x7) ioctl$SCSI_IOCTL_BENCHMARK_COMMAND(r0, 0x3) ioctl$SCSI_IOCTL_SYNC(r0, 0x4) ioctl$SG_SET_DEBUG(r0, 0x227e, &(0x7f00000000c0)=0x1) setsockopt$packet_add_memb(0xffffffffffffffff, 0x107, 0x1, &(0x7f0000000100)={0x0, 0x1, 0x6}, 0x10) ioctl$SG_NEXT_CMD_LEN(r0, 0x2283, &(0x7f0000000140)=0x74) ioctl$SG_GET_VERSION_NUM(r0, 0x2282, &(0x7f0000000180)) socketpair(0x1f, 0x1, 0x5, &(0x7f00000001c0)) openat$vcsa(0xffffffffffffff9c, &(0x7f0000000440), 0x10480, 0x0) 11:41:07 executing program 5: getpeername$packet(0xffffffffffffffff, &(0x7f0000000000)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @dev}, &(0x7f0000000040)=0x14) ioctl$sock_SIOCADDRT(0xffffffffffffffff, 0x890b, &(0x7f0000000080)={0x0, @phonet={0x23, 0xfe, 0x0, 0x2f}, @hci={0x1f, 0xffffffffffffffff, 0x3}, @rc={0x1f, @any, 0x2}, 0x5, 0x0, 0x0, 0x0, 0x7ff, 0x0, 0x0, 0x4, 0x4}) r0 = mmap$IORING_OFF_SQES(&(0x7f0000ffa000/0x4000)=nil, 0x4000, 0x1000004, 0x810, 0xffffffffffffffff, 0x10000000) syz_io_uring_submit(0x0, r0, &(0x7f0000000100)=@IORING_OP_MADVISE={0x19, 0x3, 0x0, 0x0, 0x0, &(0x7f0000ffa000/0x2000)=nil, 0x2000, 0xb, 0x1}, 0x8) r1 = syz_genetlink_get_family_id$mptcp(&(0x7f0000000180), 0xffffffffffffffff) sendmsg$MPTCP_PM_CMD_ADD_ADDR(0xffffffffffffffff, &(0x7f0000000240)={&(0x7f0000000140)={0x10, 0x0, 0x0, 0x10000}, 0xc, &(0x7f0000000200)={&(0x7f00000001c0)={0x24, r1, 0x800, 0x70bd27, 0x25dfdbfd, {}, [@MPTCP_PM_ATTR_RCV_ADD_ADDRS={0x8, 0x2, 0x8}, @MPTCP_PM_ATTR_RCV_ADD_ADDRS={0x8, 0x2, 0x6}]}, 0x24}, 0x1, 0x0, 0x0, 0x2400c096}, 0x80) sendmsg$MPTCP_PM_CMD_FLUSH_ADDRS(0xffffffffffffffff, &(0x7f00000003c0)={&(0x7f0000000280)={0x10, 0x0, 0x0, 0x40}, 0xc, &(0x7f0000000380)={&(0x7f00000002c0)={0xa4, r1, 0x200, 0x70bd25, 0x25dfdbff, {}, [@MPTCP_PM_ATTR_RCV_ADD_ADDRS={0x8, 0x2, 0x3}, @MPTCP_PM_ATTR_ADDR={0x30, 0x1, 0x0, 0x1, [@MPTCP_PM_ADDR_ATTR_ADDR6={0x14, 0x4, @initdev={0xfe, 0x88, '\x00', 0x0, 0x0}}, @MPTCP_PM_ADDR_ATTR_ADDR4={0x8, 0x3, @local}, @MPTCP_PM_ADDR_ATTR_FLAGS={0x8, 0x6, 0x2}, @MPTCP_PM_ADDR_ATTR_FAMILY={0x6, 0x1, 0xa}]}, @MPTCP_PM_ATTR_ADDR={0x2c, 0x1, 0x0, 0x1, [@MPTCP_PM_ADDR_ATTR_ID={0x5, 0x2, 0x81}, @MPTCP_PM_ADDR_ATTR_PORT={0x6, 0x5, 0x4e22}, @MPTCP_PM_ADDR_ATTR_FAMILY={0x6, 0x1, 0xa}, @MPTCP_PM_ADDR_ATTR_FLAGS={0x8}, @MPTCP_PM_ADDR_ATTR_ID={0x5, 0x2, 0x40}]}, @MPTCP_PM_ATTR_SUBFLOWS={0x8, 0x3, 0x5}, @MPTCP_PM_ATTR_SUBFLOWS={0x8, 0x3, 0x5}, @MPTCP_PM_ATTR_ADDR={0x14, 0x1, 0x0, 0x1, [@MPTCP_PM_ADDR_ATTR_PORT={0x6, 0x5, 0x4e23}, @MPTCP_PM_ADDR_ATTR_PORT={0x6, 0x5, 0x4e21}]}, @MPTCP_PM_ATTR_SUBFLOWS={0x8, 0x3, 0x2}]}, 0xa4}, 0x1, 0x0, 0x0, 0x40}, 0x90) r2 = syz_open_dev$sg(&(0x7f0000000400), 0x4, 0x38040) ioctl$SCSI_IOCTL_DOORUNLOCK(r2, 0x5381) r3 = accept$packet(0xffffffffffffffff, &(0x7f0000000440), &(0x7f0000000480)=0x14) syz_io_uring_submit(0x0, r0, &(0x7f00000004c0)=@IORING_OP_ASYNC_CANCEL={0xe, 0x1, 0x0, 0x0, 0x0, 0x23456}, 0x5) accept4$packet(r3, &(0x7f0000000500), &(0x7f0000000540)=0x14, 0x800) setsockopt$inet6_tcp_TCP_QUEUE_SEQ(0xffffffffffffffff, 0x6, 0x15, &(0x7f0000000780)=0x400, 0x4) 11:41:07 executing program 3: ioctl$SG_SET_FORCE_PACK_ID(0xffffffffffffffff, 0x227b, &(0x7f0000000000)=0x1) ioctl$SG_SET_FORCE_PACK_ID(0xffffffffffffffff, 0x227b, &(0x7f0000000040)) ioctl$SG_GET_RESERVED_SIZE(0xffffffffffffffff, 0x2272, &(0x7f0000000080)) r0 = openat$vcsa(0xffffffffffffff9c, &(0x7f00000000c0), 0x4200, 0x0) ioctl$SCSI_IOCTL_SEND_COMMAND(r0, 0x1, &(0x7f0000000100)={0x17, 0x3, 0x1c00, "af36a59fb168d324fd8eaf833aeb82f60d75e8700d81d9"}) ioctl$SG_SET_TIMEOUT(r0, 0x2201, &(0x7f0000000140)=0x4) ioctl$SG_GET_VERSION_NUM(r0, 0x2282, &(0x7f0000000180)) ioctl$SG_GET_REQUEST_TABLE(r0, 0x2286, &(0x7f00000001c0)) ioctl$SG_GET_TIMEOUT(r0, 0x2202, 0x0) r1 = syz_open_dev$sg(&(0x7f0000000340), 0x7fff, 0x40) ioctl$SG_EMULATED_HOST(r1, 0x2203, &(0x7f0000000380)) r2 = openat$vcsa(0xffffffffffffff9c, &(0x7f00000003c0), 0x8103, 0x0) ioctl$SG_GET_COMMAND_Q(r2, 0x2270, &(0x7f0000000400)) setsockopt$inet6_tcp_TCP_CONGESTION(0xffffffffffffffff, 0x6, 0xd, &(0x7f0000000440)='scalable\x00', 0x9) 11:41:07 executing program 6: ioprio_set$uid(0x0, 0xee01, 0x4004) syz_mount_image$msdos(&(0x7f0000000000), &(0x7f0000000040)='./file0\x00', 0x200, 0x1, &(0x7f00000000c0)=[{&(0x7f0000000080)="7c74c7bc99e778a0c971e6f50fbdd2b70fa0b038d18c7d5ac685833434d89dce684239293aa5d8b6f11bc5c4a033ad1dc68319fad36a1101aad751fd6f4f10", 0x3f, 0x7f}], 0x42000, &(0x7f0000000100)={[{@dots}], [{@obj_user}, {@dont_appraise}, {@uid_lt}, {@hash}, {@seclabel}]}) getsockopt$inet6_IPV6_XFRM_POLICY(0xffffffffffffffff, 0x29, 0x23, &(0x7f0000000240)={{{@in=@loopback, @in6=@empty, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, {{@in6=@local}, 0x0, @in6=@mcast1}}, &(0x7f0000000340)=0xe8) mount$9p_xen(&(0x7f0000000180), &(0x7f00000001c0)='./file0\x00', &(0x7f0000000200), 0x1121061, &(0x7f0000000380)={'trans=xen,', {[{@msize={'msize', 0x3d, 0xf6b3}}, {@debug={'debug', 0x3d, 0x7ff}}, {@posixacl}, {@aname={'aname', 0x3d, '*$-&'}}, {@uname={'uname', 0x3d, 'msdos\x00'}}], [{@seclabel}, {@euid_eq={'euid', 0x3d, r0}}, {@permit_directio}, {@appraise_type}]}}) r1 = syz_io_uring_setup(0x1d4a, &(0x7f0000000440)={0x0, 0xfa85, 0x0, 0x0, 0x285}, &(0x7f0000ffd000/0x1000)=nil, &(0x7f0000ffd000/0x2000)=nil, &(0x7f00000004c0)=0x0, &(0x7f0000000500)) syz_io_uring_setup(0x3e5e, &(0x7f0000000540)={0x0, 0x5c61, 0x8, 0x2, 0x72}, &(0x7f0000ffd000/0x3000)=nil, &(0x7f0000ffc000/0x3000)=nil, &(0x7f00000005c0), &(0x7f0000000600)=0x0) syz_io_uring_submit(r2, r3, &(0x7f0000000740)=@IORING_OP_READ=@pass_buffer={0x16, 0x1, 0x2004, @fd_index=0xa, 0x7, &(0x7f0000000640)=""/227, 0xe3, 0xc, 0x1}, 0x9) ioctl$SECCOMP_IOCTL_NOTIF_ADDFD(0xffffffffffffffff, 0x40182103, &(0x7f0000000780)={0x0, 0x4, r1, 0x9, 0x80000}) openat$cgroup_devices(0xffffffffffffffff, &(0x7f00000007c0)='devices.allow\x00', 0x2, 0x0) syz_mount_image$nfs4(&(0x7f0000000800), &(0x7f0000000840)='./file0/file0\x00', 0xffffffffffffff01, 0x1, &(0x7f0000000900)=[{&(0x7f0000000880)="f19bd7cfef39dd2070dcb194f7bd90ce305e2a9644b9fb91cc1e75bca69ed6bbdd7636452963af395ea61189cce718ef43420310b6ff8db9f4a606d67217b1aa7bf6e1435682323aef92ef40d036c48fa3fc363c6ad63229bb37cd76a6db9879a39f", 0x62, 0x6}], 0x8400, &(0x7f0000000940)={[{'*+\\['}]}) r4 = accept(0xffffffffffffffff, 0x0, &(0x7f0000000980)) sendmsg$MPTCP_PM_CMD_GET_LIMITS(r4, &(0x7f0000000ac0)={&(0x7f00000009c0)={0x10, 0x0, 0x0, 0x200}, 0xc, &(0x7f0000000a80)={&(0x7f0000000a00)={0x74, 0x0, 0x200, 0x70bd27, 0x25dfdbfd, {}, [@MPTCP_PM_ATTR_RCV_ADD_ADDRS={0x8, 0x2, 0x8}, @MPTCP_PM_ATTR_RCV_ADD_ADDRS={0x8, 0x2, 0x2}, @MPTCP_PM_ATTR_SUBFLOWS={0x8, 0x3, 0x6}, @MPTCP_PM_ATTR_ADDR={0x3c, 0x1, 0x0, 0x1, [@MPTCP_PM_ADDR_ATTR_PORT={0x6, 0x5, 0x4e20}, @MPTCP_PM_ADDR_ATTR_ID={0x5, 0x2, 0x5}, @MPTCP_PM_ADDR_ATTR_FLAGS={0x8, 0x6, 0x3}, @MPTCP_PM_ADDR_ATTR_PORT={0x6, 0x5, 0x4e23}, @MPTCP_PM_ADDR_ATTR_FAMILY={0x6}, @MPTCP_PM_ADDR_ATTR_FAMILY={0x6, 0x1, 0xa}, @MPTCP_PM_ADDR_ATTR_FAMILY={0x6, 0x1, 0xa}]}, @MPTCP_PM_ATTR_ADDR={0x4}, @MPTCP_PM_ATTR_SUBFLOWS={0x8}]}, 0x74}, 0x1, 0x0, 0x0, 0x11}, 0x80) sendmsg$IEEE802154_LLSEC_DEL_SECLEVEL(0xffffffffffffffff, &(0x7f0000000bc0)={&(0x7f0000000b00)={0x10, 0x0, 0x0, 0x800000}, 0xc, &(0x7f0000000b80)={&(0x7f0000000b40)={0x2c, 0x0, 0x800, 0x70bd27, 0x25dfdbff, {}, [@IEEE802154_ATTR_DEV_INDEX={0x8}, @IEEE802154_ATTR_LLSEC_FRAME_TYPE={0x5, 0x33, 0x81}, @IEEE802154_ATTR_DEV_INDEX={0x8}]}, 0x2c}, 0x1, 0x0, 0x0, 0x4}, 0x2) socketpair(0x15, 0x1, 0x10001, &(0x7f0000000c00)) mount$9p_rdma(&(0x7f0000001040), &(0x7f0000001080)='./file0\x00', &(0x7f00000010c0), 0xa00800, &(0x7f0000001100)={'trans=rdma,', {'port', 0x3d, 0x4e20}, 0x2c, {[{@common=@aname={'aname', 0x3d, 'permit_directio'}}, {@sq={'sq', 0x3d, 0xffff}}], [{@fscontext={'fscontext', 0x3d, 'staff_u'}}]}}) 11:41:07 executing program 4: setsockopt$inet_tcp_TCP_QUEUE_SEQ(0xffffffffffffffff, 0x6, 0x15, &(0x7f0000000000), 0x4) r0 = openat$vcsa(0xffffffffffffff9c, &(0x7f0000000040), 0x81, 0x0) setsockopt$packet_tx_ring(r0, 0x107, 0xd, &(0x7f0000000080)=@req={0x4, 0xffffffff, 0xd5, 0x5}, 0x10) setsockopt$inet_tcp_TCP_REPAIR_WINDOW(r0, 0x6, 0x1d, &(0x7f00000000c0)={0xfffffff9, 0x1, 0x7fffffff, 0x6, 0x1}, 0x14) ioctl$SCSI_IOCTL_SYNC(r0, 0x4) r1 = accept(r0, &(0x7f0000000100)=@rc={0x1f, @fixed}, &(0x7f0000000180)=0x80) setsockopt$inet_tcp_TCP_FASTOPEN_KEY(r1, 0x6, 0x21, &(0x7f00000001c0)="2a6eddb47c1ebcb5002df4f95b6a3218", 0x10) socket$inet_tcp(0x2, 0x1, 0x0) ioctl$SG_GET_VERSION_NUM(r0, 0x2282, &(0x7f0000000200)) ioctl$SCSI_IOCTL_STOP_UNIT(r0, 0x6) syz_genetlink_get_family_id$netlbl_mgmt(&(0x7f0000000440), 0xffffffffffffffff) syz_genetlink_get_family_id$netlbl_mgmt(&(0x7f0000000740), 0xffffffffffffffff) 11:41:07 executing program 0: r0 = openat$vcsa(0xffffffffffffff9c, &(0x7f0000000000), 0x40000, 0x0) ioctl$SG_GET_PACK_ID(r0, 0x227c, &(0x7f0000000040)) r1 = openat$sr(0xffffffffffffff9c, &(0x7f0000000080), 0x454082, 0x0) ioctl$SG_SET_DEBUG(r1, 0x227e, &(0x7f00000000c0)=0x1) syz_open_dev$sg(&(0x7f0000000100), 0x8, 0x280102) syz_open_dev$sg(&(0x7f0000000540), 0x8, 0x8100) [ 160.796956] loop6: detected capacity change from 0 to 1 [ 160.831555] loop6: detected capacity change from 0 to 264192 [ 160.857062] nfs4: Unknown parameter '*+\[' [ 160.915652] SELinux: security_context_str_to_sid (staff_u) failed with errno=-22 11:41:15 executing program 7: r0 = syz_open_dev$sg(&(0x7f0000000000), 0x1, 0x10000) ioctl$SG_GET_PACK_ID(r0, 0x227c, &(0x7f0000000040)) ioctl$SCSI_IOCTL_DOORLOCK(r0, 0x5380) ioctl$SG_SET_KEEP_ORPHAN(r0, 0x2287, &(0x7f0000000080)=0x7) ioctl$SCSI_IOCTL_BENCHMARK_COMMAND(r0, 0x3) ioctl$SCSI_IOCTL_SYNC(r0, 0x4) ioctl$SG_SET_DEBUG(r0, 0x227e, &(0x7f00000000c0)=0x1) setsockopt$packet_add_memb(0xffffffffffffffff, 0x107, 0x1, &(0x7f0000000100)={0x0, 0x1, 0x6}, 0x10) ioctl$SG_NEXT_CMD_LEN(r0, 0x2283, &(0x7f0000000140)=0x74) ioctl$SG_GET_VERSION_NUM(r0, 0x2282, &(0x7f0000000180)) openat$vcsa(0xffffffffffffff9c, &(0x7f0000000440), 0x10480, 0x0) 11:41:15 executing program 2: clock_nanosleep(0x7, 0x0, &(0x7f0000000000)={0x77359400}, &(0x7f0000000040)) getsockopt$inet6_IPV6_XFRM_POLICY(0xffffffffffffffff, 0x29, 0x23, &(0x7f0000000080)={{{@in6, @in6=@remote, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, {{@in6=@dev}, 0x0, @in=@initdev}}, &(0x7f0000000180)=0xe8) setsockopt$packet_add_memb(0xffffffffffffffff, 0x107, 0x1, &(0x7f00000001c0)={r0, 0x1, 0x6, @broadcast}, 0x10) getpeername$packet(0xffffffffffffffff, &(0x7f0000000200)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @dev}, &(0x7f0000000240)=0x14) recvmsg(0xffffffffffffffff, &(0x7f00000027c0)={&(0x7f0000000280)=@xdp={0x2c, 0x0, 0x0}, 0x80, &(0x7f0000002640)=[{&(0x7f0000000300)=""/227, 0xe3}, {&(0x7f0000000400)=""/4096, 0x1000}, {&(0x7f0000001400)=""/92, 0x5c}, {&(0x7f0000001480)=""/93, 0x5d}, {&(0x7f0000001500)=""/4096, 0x1000}, {&(0x7f0000002500)=""/87, 0x57}, {&(0x7f0000002580)=""/189, 0xbd}], 0x7, &(0x7f00000026c0)=""/199, 0xc7}, 0x140) bind$packet(0xffffffffffffffff, &(0x7f0000002800)={0x11, 0x1b, r2, 0x1, 0x5}, 0x14) getresgid(&(0x7f0000002840), &(0x7f0000002880), &(0x7f00000028c0)) r3 = accept4$packet(0xffffffffffffffff, &(0x7f0000002900)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @multicast}, &(0x7f0000002940)=0x14, 0x80000) recvfrom$packet(r3, &(0x7f0000002980)=""/4096, 0x1000, 0x0, &(0x7f0000003980)={0x11, 0x17, r2, 0x1, 0x5, 0x6, @multicast}, 0x14) r4 = socket$inet6_udp(0xa, 0x2, 0x0) getsockopt$inet6_IPV6_XFRM_POLICY(r4, 0x29, 0x23, &(0x7f00000039c0)={{{@in6=@ipv4, @in6=@private0}}, {{@in=@private}, 0x0, @in6=@remote}}, &(0x7f0000003ac0)=0xe8) r5 = openat$sr(0xffffffffffffff9c, &(0x7f0000003b00), 0x200000, 0x0) recvfrom$packet(r5, &(0x7f0000003b40)=""/161, 0xa1, 0x140, &(0x7f0000003c00)={0x11, 0x2, r1, 0x1, 0x9a, 0x6, @local}, 0x14) r6 = openat$vcsa(0xffffffffffffff9c, &(0x7f0000003c40), 0x500, 0x0) write$bt_hci(r6, &(0x7f0000003c80)={0x1, @write_current_iac_lap={{0xc3a, 0x7}, {0x6, "30a9a39c10c4"}}}, 0xb) openat$sr(0xffffffffffffff9c, &(0x7f0000005480), 0x428802, 0x0) 11:41:15 executing program 6: ioprio_set$uid(0x0, 0xee01, 0x4004) syz_mount_image$msdos(&(0x7f0000000000), &(0x7f0000000040)='./file0\x00', 0x200, 0x1, &(0x7f00000000c0)=[{&(0x7f0000000080)="7c74c7bc99e778a0c971e6f50fbdd2b70fa0b038d18c7d5ac685833434d89dce684239293aa5d8b6f11bc5c4a033ad1dc68319fad36a1101aad751fd6f4f10", 0x3f, 0x7f}], 0x42000, &(0x7f0000000100)={[{@dots}], [{@obj_user}, {@dont_appraise}, {@uid_lt}, {@hash}, {@seclabel}]}) getsockopt$inet6_IPV6_XFRM_POLICY(0xffffffffffffffff, 0x29, 0x23, &(0x7f0000000240)={{{@in=@loopback, @in6=@empty, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, {{@in6=@local}, 0x0, @in6=@mcast1}}, &(0x7f0000000340)=0xe8) mount$9p_xen(&(0x7f0000000180), &(0x7f00000001c0)='./file0\x00', &(0x7f0000000200), 0x1121061, &(0x7f0000000380)={'trans=xen,', {[{@msize={'msize', 0x3d, 0xf6b3}}, {@debug={'debug', 0x3d, 0x7ff}}, {@posixacl}, {@aname={'aname', 0x3d, '*$-&'}}, {@uname={'uname', 0x3d, 'msdos\x00'}}], [{@seclabel}, {@euid_eq={'euid', 0x3d, r0}}, {@permit_directio}, {@appraise_type}]}}) r1 = syz_io_uring_setup(0x1d4a, &(0x7f0000000440)={0x0, 0xfa85, 0x0, 0x0, 0x285}, &(0x7f0000ffd000/0x1000)=nil, &(0x7f0000ffd000/0x2000)=nil, &(0x7f00000004c0)=0x0, &(0x7f0000000500)) syz_io_uring_setup(0x3e5e, &(0x7f0000000540)={0x0, 0x5c61, 0x8, 0x2, 0x72}, &(0x7f0000ffd000/0x3000)=nil, &(0x7f0000ffc000/0x3000)=nil, &(0x7f00000005c0), &(0x7f0000000600)=0x0) syz_io_uring_submit(r2, r3, &(0x7f0000000740)=@IORING_OP_READ=@pass_buffer={0x16, 0x1, 0x2004, @fd_index=0xa, 0x7, &(0x7f0000000640)=""/227, 0xe3, 0xc, 0x1}, 0x9) ioctl$SECCOMP_IOCTL_NOTIF_ADDFD(0xffffffffffffffff, 0x40182103, &(0x7f0000000780)={0x0, 0x4, r1, 0x9, 0x80000}) openat$cgroup_devices(0xffffffffffffffff, &(0x7f00000007c0)='devices.allow\x00', 0x2, 0x0) syz_mount_image$nfs4(&(0x7f0000000800), &(0x7f0000000840)='./file0/file0\x00', 0xffffffffffffff01, 0x1, &(0x7f0000000900)=[{&(0x7f0000000880)="f19bd7cfef39dd2070dcb194f7bd90ce305e2a9644b9fb91cc1e75bca69ed6bbdd7636452963af395ea61189cce718ef43420310b6ff8db9f4a606d67217b1aa7bf6e1435682323aef92ef40d036c48fa3fc363c6ad63229bb37cd76a6db9879a39f", 0x62, 0x6}], 0x8400, &(0x7f0000000940)={[{'*+\\['}]}) r4 = accept(0xffffffffffffffff, 0x0, &(0x7f0000000980)) sendmsg$MPTCP_PM_CMD_GET_LIMITS(r4, &(0x7f0000000ac0)={&(0x7f00000009c0)={0x10, 0x0, 0x0, 0x200}, 0xc, &(0x7f0000000a80)={&(0x7f0000000a00)={0x74, 0x0, 0x200, 0x70bd27, 0x25dfdbfd, {}, [@MPTCP_PM_ATTR_RCV_ADD_ADDRS={0x8, 0x2, 0x8}, @MPTCP_PM_ATTR_RCV_ADD_ADDRS={0x8, 0x2, 0x2}, @MPTCP_PM_ATTR_SUBFLOWS={0x8, 0x3, 0x6}, @MPTCP_PM_ATTR_ADDR={0x3c, 0x1, 0x0, 0x1, [@MPTCP_PM_ADDR_ATTR_PORT={0x6, 0x5, 0x4e20}, @MPTCP_PM_ADDR_ATTR_ID={0x5, 0x2, 0x5}, @MPTCP_PM_ADDR_ATTR_FLAGS={0x8, 0x6, 0x3}, @MPTCP_PM_ADDR_ATTR_PORT={0x6, 0x5, 0x4e23}, @MPTCP_PM_ADDR_ATTR_FAMILY={0x6}, @MPTCP_PM_ADDR_ATTR_FAMILY={0x6, 0x1, 0xa}, @MPTCP_PM_ADDR_ATTR_FAMILY={0x6, 0x1, 0xa}]}, @MPTCP_PM_ATTR_ADDR={0x4}, @MPTCP_PM_ATTR_SUBFLOWS={0x8}]}, 0x74}, 0x1, 0x0, 0x0, 0x11}, 0x80) sendmsg$IEEE802154_LLSEC_DEL_SECLEVEL(0xffffffffffffffff, &(0x7f0000000bc0)={&(0x7f0000000b00)={0x10, 0x0, 0x0, 0x800000}, 0xc, &(0x7f0000000b80)={&(0x7f0000000b40)={0x2c, 0x0, 0x800, 0x70bd27, 0x25dfdbff, {}, [@IEEE802154_ATTR_DEV_INDEX={0x8}, @IEEE802154_ATTR_LLSEC_FRAME_TYPE={0x5, 0x33, 0x81}, @IEEE802154_ATTR_DEV_INDEX={0x8}]}, 0x2c}, 0x1, 0x0, 0x0, 0x4}, 0x2) socketpair(0x15, 0x1, 0x10001, &(0x7f0000000c00)) mount$9p_rdma(&(0x7f0000001040), &(0x7f0000001080)='./file0\x00', &(0x7f00000010c0), 0xa00800, &(0x7f0000001100)={'trans=rdma,', {'port', 0x3d, 0x4e20}, 0x2c, {[{@common=@aname={'aname', 0x3d, 'permit_directio'}}, {@sq={'sq', 0x3d, 0xffff}}], [{@fscontext={'fscontext', 0x3d, 'staff_u'}}]}}) 11:41:15 executing program 4: setsockopt$inet_tcp_TCP_QUEUE_SEQ(0xffffffffffffffff, 0x6, 0x15, &(0x7f0000000000), 0x4) r0 = openat$vcsa(0xffffffffffffff9c, &(0x7f0000000040), 0x81, 0x0) setsockopt$packet_tx_ring(r0, 0x107, 0xd, &(0x7f0000000080)=@req={0x4, 0xffffffff, 0xd5, 0x5}, 0x10) setsockopt$inet_tcp_TCP_REPAIR_WINDOW(r0, 0x6, 0x1d, &(0x7f00000000c0)={0xfffffff9, 0x1, 0x7fffffff, 0x6, 0x1}, 0x14) ioctl$SCSI_IOCTL_SYNC(r0, 0x4) r1 = accept(r0, &(0x7f0000000100)=@rc={0x1f, @fixed}, &(0x7f0000000180)=0x80) setsockopt$inet_tcp_TCP_FASTOPEN_KEY(r1, 0x6, 0x21, &(0x7f00000001c0)="2a6eddb47c1ebcb5002df4f95b6a3218", 0x10) socket$inet_tcp(0x2, 0x1, 0x0) ioctl$SG_GET_VERSION_NUM(r0, 0x2282, &(0x7f0000000200)) ioctl$SCSI_IOCTL_STOP_UNIT(r0, 0x6) syz_genetlink_get_family_id$netlbl_mgmt(&(0x7f0000000440), 0xffffffffffffffff) syz_genetlink_get_family_id$netlbl_mgmt(&(0x7f0000000740), 0xffffffffffffffff) 11:41:15 executing program 1: r0 = shmget(0x2, 0x3000, 0x100, &(0x7f0000ffb000/0x3000)=nil) shmat(r0, &(0x7f0000ffa000/0x3000)=nil, 0x2000) shmat(r0, &(0x7f0000ffa000/0x4000)=nil, 0x3000) shmget(0x3, 0x1000, 0x100, &(0x7f0000ffd000/0x1000)=nil) r1 = syz_genetlink_get_family_id$netlbl_mgmt(&(0x7f0000000040), 0xffffffffffffffff) sendmsg$NLBL_MGMT_C_REMOVEDEF(0xffffffffffffffff, &(0x7f0000000100)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x8}, 0xc, &(0x7f00000000c0)={&(0x7f0000000080)={0x3c, r1, 0x20, 0x70bd29, 0x25dfdbff, {}, [@NLBL_MGMT_A_FAMILY={0x6, 0xb, 0x5}, @NLBL_MGMT_A_PROTOCOL={0x8, 0x2, 0x3}, @NLBL_MGMT_A_IPV4MASK={0x8, 0x8, @multicast1}, @NLBL_MGMT_A_CLPDOI={0x8}, @NLBL_MGMT_A_IPV4ADDR={0x8, 0x7, @local}]}, 0x3c}, 0x1, 0x0, 0x0, 0x4048820}, 0x40000) shmat(0xffffffffffffffff, &(0x7f0000ffb000/0x4000)=nil, 0x2000) r2 = shmget(0x0, 0xf000, 0x100, &(0x7f0000ff1000/0xf000)=nil) shmctl$IPC_RMID(r2, 0x0) r3 = mmap$IORING_OFF_SQ_RING(&(0x7f0000ffd000/0x1000)=nil, 0x1000, 0x2000006, 0x40010, 0xffffffffffffffff, 0x0) syz_io_uring_submit(r3, 0x0, &(0x7f00000001c0)=@IORING_OP_PROVIDE_BUFFERS={0x1f, 0x1, 0x0, 0x8, 0x2, &(0x7f0000000140)="10e8e6d73f8e97a04564912d4b0bee6921be05ed083e4d741dabdbce8c94949f57a5c9d9da73d0e5ad668714159e31498f181aad79547c645eefb456a7b8c4be765eb156b77cba8a752b90d7729b2c285893a10c3633d2485f48f30d247214c5e28a", 0x7, 0x0, 0x1, {0x1}}, 0x100) r4 = socket(0x2c, 0x5, 0x1) accept4$packet(0xffffffffffffffff, &(0x7f0000000280)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @random}, &(0x7f00000002c0)=0x14, 0x40000) recvfrom$packet(r4, &(0x7f0000000200)=""/108, 0x6c, 0x2000, &(0x7f0000000300)={0x11, 0x16, r5, 0x1, 0x8, 0x6, @local}, 0x14) io_uring_setup(0x14ab, &(0x7f0000000480)={0x0, 0x5191, 0x20, 0x1, 0x3ba}) shmget$private(0x0, 0x2000, 0x10, &(0x7f0000ffc000/0x2000)=nil) 11:41:15 executing program 0: r0 = openat$vcsa(0xffffffffffffff9c, &(0x7f0000000000), 0x40000, 0x0) ioctl$SG_GET_PACK_ID(r0, 0x227c, &(0x7f0000000040)) r1 = openat$sr(0xffffffffffffff9c, &(0x7f0000000080), 0x454082, 0x0) ioctl$SG_SET_DEBUG(r1, 0x227e, &(0x7f00000000c0)=0x1) syz_open_dev$sg(&(0x7f0000000540), 0x8, 0x8100) 11:41:15 executing program 3: ioctl$SG_SET_FORCE_PACK_ID(0xffffffffffffffff, 0x227b, &(0x7f0000000000)=0x1) ioctl$SG_SET_FORCE_PACK_ID(0xffffffffffffffff, 0x227b, &(0x7f0000000040)) ioctl$SG_GET_RESERVED_SIZE(0xffffffffffffffff, 0x2272, &(0x7f0000000080)) r0 = openat$vcsa(0xffffffffffffff9c, &(0x7f00000000c0), 0x4200, 0x0) ioctl$SCSI_IOCTL_SEND_COMMAND(r0, 0x1, &(0x7f0000000100)={0x17, 0x3, 0x1c00, "af36a59fb168d324fd8eaf833aeb82f60d75e8700d81d9"}) ioctl$SG_SET_TIMEOUT(r0, 0x2201, &(0x7f0000000140)=0x4) ioctl$SG_GET_VERSION_NUM(r0, 0x2282, &(0x7f0000000180)) ioctl$SG_GET_REQUEST_TABLE(r0, 0x2286, &(0x7f00000001c0)) ioctl$SG_GET_TIMEOUT(r0, 0x2202, 0x0) r1 = syz_open_dev$sg(&(0x7f0000000340), 0x7fff, 0x40) ioctl$SG_EMULATED_HOST(r1, 0x2203, &(0x7f0000000380)) openat$vcsa(0xffffffffffffff9c, &(0x7f00000003c0), 0x8103, 0x0) r2 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$inet6_tcp_TCP_CONGESTION(r2, 0x6, 0xd, &(0x7f0000000440)='scalable\x00', 0x9) 11:41:15 executing program 5: getpeername$packet(0xffffffffffffffff, &(0x7f0000000000)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @dev}, &(0x7f0000000040)=0x14) ioctl$sock_SIOCADDRT(0xffffffffffffffff, 0x890b, &(0x7f0000000080)={0x0, @phonet={0x23, 0xfe, 0x0, 0x2f}, @hci={0x1f, 0xffffffffffffffff, 0x3}, @rc={0x1f, @any, 0x2}, 0x5, 0x0, 0x0, 0x0, 0x7ff, 0x0, 0x0, 0x4, 0x4}) r0 = mmap$IORING_OFF_SQES(&(0x7f0000ffa000/0x4000)=nil, 0x4000, 0x1000004, 0x810, 0xffffffffffffffff, 0x10000000) syz_io_uring_submit(0x0, r0, &(0x7f0000000100)=@IORING_OP_MADVISE={0x19, 0x3, 0x0, 0x0, 0x0, &(0x7f0000ffa000/0x2000)=nil, 0x2000, 0xb, 0x1}, 0x8) r1 = syz_genetlink_get_family_id$mptcp(&(0x7f0000000180), 0xffffffffffffffff) sendmsg$MPTCP_PM_CMD_ADD_ADDR(0xffffffffffffffff, &(0x7f0000000240)={&(0x7f0000000140)={0x10, 0x0, 0x0, 0x10000}, 0xc, &(0x7f0000000200)={&(0x7f00000001c0)={0x24, r1, 0x800, 0x70bd27, 0x25dfdbfd, {}, [@MPTCP_PM_ATTR_RCV_ADD_ADDRS={0x8, 0x2, 0x8}, @MPTCP_PM_ATTR_RCV_ADD_ADDRS={0x8, 0x2, 0x6}]}, 0x24}, 0x1, 0x0, 0x0, 0x2400c096}, 0x80) sendmsg$MPTCP_PM_CMD_FLUSH_ADDRS(0xffffffffffffffff, &(0x7f00000003c0)={&(0x7f0000000280)={0x10, 0x0, 0x0, 0x40}, 0xc, &(0x7f0000000380)={&(0x7f00000002c0)={0xa4, r1, 0x200, 0x70bd25, 0x25dfdbff, {}, [@MPTCP_PM_ATTR_RCV_ADD_ADDRS={0x8, 0x2, 0x3}, @MPTCP_PM_ATTR_ADDR={0x30, 0x1, 0x0, 0x1, [@MPTCP_PM_ADDR_ATTR_ADDR6={0x14, 0x4, @initdev={0xfe, 0x88, '\x00', 0x0, 0x0}}, @MPTCP_PM_ADDR_ATTR_ADDR4={0x8, 0x3, @local}, @MPTCP_PM_ADDR_ATTR_FLAGS={0x8, 0x6, 0x2}, @MPTCP_PM_ADDR_ATTR_FAMILY={0x6, 0x1, 0xa}]}, @MPTCP_PM_ATTR_ADDR={0x2c, 0x1, 0x0, 0x1, [@MPTCP_PM_ADDR_ATTR_ID={0x5, 0x2, 0x81}, @MPTCP_PM_ADDR_ATTR_PORT={0x6, 0x5, 0x4e22}, @MPTCP_PM_ADDR_ATTR_FAMILY={0x6, 0x1, 0xa}, @MPTCP_PM_ADDR_ATTR_FLAGS={0x8}, @MPTCP_PM_ADDR_ATTR_ID={0x5, 0x2, 0x40}]}, @MPTCP_PM_ATTR_SUBFLOWS={0x8, 0x3, 0x5}, @MPTCP_PM_ATTR_SUBFLOWS={0x8, 0x3, 0x5}, @MPTCP_PM_ATTR_ADDR={0x14, 0x1, 0x0, 0x1, [@MPTCP_PM_ADDR_ATTR_PORT={0x6, 0x5, 0x4e23}, @MPTCP_PM_ADDR_ATTR_PORT={0x6, 0x5, 0x4e21}]}, @MPTCP_PM_ATTR_SUBFLOWS={0x8, 0x3, 0x2}]}, 0xa4}, 0x1, 0x0, 0x0, 0x40}, 0x90) r2 = syz_open_dev$sg(&(0x7f0000000400), 0x4, 0x38040) ioctl$SCSI_IOCTL_DOORUNLOCK(r2, 0x5381) accept$packet(0xffffffffffffffff, &(0x7f0000000440), &(0x7f0000000480)=0x14) syz_io_uring_submit(0x0, r0, &(0x7f00000004c0)=@IORING_OP_ASYNC_CANCEL={0xe, 0x1, 0x0, 0x0, 0x0, 0x23456}, 0x5) r3 = openat$vcsa(0xffffffffffffff9c, &(0x7f0000000580), 0x121080, 0x0) setsockopt$inet6_tcp_TCP_QUEUE_SEQ(r3, 0x6, 0x15, &(0x7f0000000780)=0x400, 0x4) [ 168.665237] loop6: detected capacity change from 0 to 1 [ 168.682132] loop6: detected capacity change from 0 to 264192 [ 168.689854] nfs4: Unknown parameter '*+\[' 11:41:15 executing program 0: r0 = openat$vcsa(0xffffffffffffff9c, &(0x7f0000000000), 0x40000, 0x0) ioctl$SG_GET_PACK_ID(r0, 0x227c, &(0x7f0000000040)) openat$sr(0xffffffffffffff9c, &(0x7f0000000080), 0x454082, 0x0) syz_open_dev$sg(&(0x7f0000000540), 0x8, 0x8100) [ 168.747977] SELinux: security_context_str_to_sid (staff_u) failed with errno=-22 11:41:15 executing program 7: r0 = syz_open_dev$sg(&(0x7f0000000000), 0x1, 0x10000) ioctl$SG_GET_PACK_ID(r0, 0x227c, &(0x7f0000000040)) ioctl$SCSI_IOCTL_DOORLOCK(r0, 0x5380) ioctl$SG_SET_KEEP_ORPHAN(r0, 0x2287, &(0x7f0000000080)=0x7) ioctl$SCSI_IOCTL_BENCHMARK_COMMAND(r0, 0x3) ioctl$SCSI_IOCTL_SYNC(r0, 0x4) ioctl$SG_SET_DEBUG(r0, 0x227e, &(0x7f00000000c0)=0x1) setsockopt$packet_add_memb(0xffffffffffffffff, 0x107, 0x1, &(0x7f0000000100)={0x0, 0x1, 0x6}, 0x10) ioctl$SG_NEXT_CMD_LEN(r0, 0x2283, &(0x7f0000000140)=0x74) openat$vcsa(0xffffffffffffff9c, &(0x7f0000000440), 0x10480, 0x0) 11:41:15 executing program 4: setsockopt$inet_tcp_TCP_QUEUE_SEQ(0xffffffffffffffff, 0x6, 0x15, &(0x7f0000000000), 0x4) r0 = openat$vcsa(0xffffffffffffff9c, &(0x7f0000000040), 0x81, 0x0) setsockopt$packet_tx_ring(r0, 0x107, 0xd, &(0x7f0000000080)=@req={0x4, 0xffffffff, 0xd5, 0x5}, 0x10) setsockopt$inet_tcp_TCP_REPAIR_WINDOW(r0, 0x6, 0x1d, &(0x7f00000000c0)={0xfffffff9, 0x1, 0x7fffffff, 0x6, 0x1}, 0x14) ioctl$SCSI_IOCTL_SYNC(r0, 0x4) r1 = accept(r0, &(0x7f0000000100)=@rc={0x1f, @fixed}, &(0x7f0000000180)=0x80) setsockopt$inet_tcp_TCP_FASTOPEN_KEY(r1, 0x6, 0x21, &(0x7f00000001c0)="2a6eddb47c1ebcb5002df4f95b6a3218", 0x10) socket$inet_tcp(0x2, 0x1, 0x0) ioctl$SG_GET_VERSION_NUM(r0, 0x2282, &(0x7f0000000200)) ioctl$SCSI_IOCTL_STOP_UNIT(r0, 0x6) syz_genetlink_get_family_id$netlbl_mgmt(&(0x7f0000000440), 0xffffffffffffffff) syz_genetlink_get_family_id$netlbl_mgmt(&(0x7f0000000740), 0xffffffffffffffff) 11:41:15 executing program 5: getpeername$packet(0xffffffffffffffff, &(0x7f0000000000)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @dev}, &(0x7f0000000040)=0x14) ioctl$sock_SIOCADDRT(0xffffffffffffffff, 0x890b, &(0x7f0000000080)={0x0, @phonet={0x23, 0xfe, 0x0, 0x2f}, @hci={0x1f, 0xffffffffffffffff, 0x3}, @rc={0x1f, @any, 0x2}, 0x5, 0x0, 0x0, 0x0, 0x7ff, 0x0, 0x0, 0x4, 0x4}) r0 = mmap$IORING_OFF_SQES(&(0x7f0000ffa000/0x4000)=nil, 0x4000, 0x1000004, 0x810, 0xffffffffffffffff, 0x10000000) syz_io_uring_submit(0x0, r0, &(0x7f0000000100)=@IORING_OP_MADVISE={0x19, 0x3, 0x0, 0x0, 0x0, &(0x7f0000ffa000/0x2000)=nil, 0x2000, 0xb, 0x1}, 0x8) r1 = syz_genetlink_get_family_id$mptcp(&(0x7f0000000180), 0xffffffffffffffff) sendmsg$MPTCP_PM_CMD_ADD_ADDR(0xffffffffffffffff, &(0x7f0000000240)={&(0x7f0000000140)={0x10, 0x0, 0x0, 0x10000}, 0xc, &(0x7f0000000200)={&(0x7f00000001c0)={0x24, r1, 0x800, 0x70bd27, 0x25dfdbfd, {}, [@MPTCP_PM_ATTR_RCV_ADD_ADDRS={0x8, 0x2, 0x8}, @MPTCP_PM_ATTR_RCV_ADD_ADDRS={0x8, 0x2, 0x6}]}, 0x24}, 0x1, 0x0, 0x0, 0x2400c096}, 0x80) sendmsg$MPTCP_PM_CMD_FLUSH_ADDRS(0xffffffffffffffff, &(0x7f00000003c0)={&(0x7f0000000280)={0x10, 0x0, 0x0, 0x40}, 0xc, &(0x7f0000000380)={&(0x7f00000002c0)={0xa4, r1, 0x200, 0x70bd25, 0x25dfdbff, {}, [@MPTCP_PM_ATTR_RCV_ADD_ADDRS={0x8, 0x2, 0x3}, @MPTCP_PM_ATTR_ADDR={0x30, 0x1, 0x0, 0x1, [@MPTCP_PM_ADDR_ATTR_ADDR6={0x14, 0x4, @initdev={0xfe, 0x88, '\x00', 0x0, 0x0}}, @MPTCP_PM_ADDR_ATTR_ADDR4={0x8, 0x3, @local}, @MPTCP_PM_ADDR_ATTR_FLAGS={0x8, 0x6, 0x2}, @MPTCP_PM_ADDR_ATTR_FAMILY={0x6, 0x1, 0xa}]}, @MPTCP_PM_ATTR_ADDR={0x2c, 0x1, 0x0, 0x1, [@MPTCP_PM_ADDR_ATTR_ID={0x5, 0x2, 0x81}, @MPTCP_PM_ADDR_ATTR_PORT={0x6, 0x5, 0x4e22}, @MPTCP_PM_ADDR_ATTR_FAMILY={0x6, 0x1, 0xa}, @MPTCP_PM_ADDR_ATTR_FLAGS={0x8}, @MPTCP_PM_ADDR_ATTR_ID={0x5, 0x2, 0x40}]}, @MPTCP_PM_ATTR_SUBFLOWS={0x8, 0x3, 0x5}, @MPTCP_PM_ATTR_SUBFLOWS={0x8, 0x3, 0x5}, @MPTCP_PM_ATTR_ADDR={0x14, 0x1, 0x0, 0x1, [@MPTCP_PM_ADDR_ATTR_PORT={0x6, 0x5, 0x4e23}, @MPTCP_PM_ADDR_ATTR_PORT={0x6, 0x5, 0x4e21}]}, @MPTCP_PM_ATTR_SUBFLOWS={0x8, 0x3, 0x2}]}, 0xa4}, 0x1, 0x0, 0x0, 0x40}, 0x90) r2 = syz_open_dev$sg(&(0x7f0000000400), 0x4, 0x38040) ioctl$SCSI_IOCTL_DOORUNLOCK(r2, 0x5381) accept$packet(0xffffffffffffffff, &(0x7f0000000440), &(0x7f0000000480)=0x14) r3 = openat$vcsa(0xffffffffffffff9c, &(0x7f0000000580), 0x121080, 0x0) setsockopt$inet6_tcp_TCP_QUEUE_SEQ(r3, 0x6, 0x15, &(0x7f0000000780)=0x400, 0x4) 11:41:15 executing program 6: ioprio_set$uid(0x0, 0xee01, 0x4004) syz_mount_image$msdos(&(0x7f0000000000), &(0x7f0000000040)='./file0\x00', 0x200, 0x1, &(0x7f00000000c0)=[{&(0x7f0000000080)="7c74c7bc99e778a0c971e6f50fbdd2b70fa0b038d18c7d5ac685833434d89dce684239293aa5d8b6f11bc5c4a033ad1dc68319fad36a1101aad751fd6f4f10", 0x3f, 0x7f}], 0x42000, &(0x7f0000000100)={[{@dots}], [{@obj_user}, {@dont_appraise}, {@uid_lt}, {@hash}, {@seclabel}]}) getsockopt$inet6_IPV6_XFRM_POLICY(0xffffffffffffffff, 0x29, 0x23, &(0x7f0000000240)={{{@in=@loopback, @in6=@empty, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, {{@in6=@local}, 0x0, @in6=@mcast1}}, &(0x7f0000000340)=0xe8) mount$9p_xen(&(0x7f0000000180), &(0x7f00000001c0)='./file0\x00', &(0x7f0000000200), 0x1121061, &(0x7f0000000380)={'trans=xen,', {[{@msize={'msize', 0x3d, 0xf6b3}}, {@debug={'debug', 0x3d, 0x7ff}}, {@posixacl}, {@aname={'aname', 0x3d, '*$-&'}}, {@uname={'uname', 0x3d, 'msdos\x00'}}], [{@seclabel}, {@euid_eq={'euid', 0x3d, r0}}, {@permit_directio}, {@appraise_type}]}}) r1 = syz_io_uring_setup(0x1d4a, &(0x7f0000000440)={0x0, 0xfa85, 0x0, 0x0, 0x285}, &(0x7f0000ffd000/0x1000)=nil, &(0x7f0000ffd000/0x2000)=nil, &(0x7f00000004c0)=0x0, &(0x7f0000000500)) syz_io_uring_setup(0x3e5e, &(0x7f0000000540)={0x0, 0x5c61, 0x8, 0x2, 0x72}, &(0x7f0000ffd000/0x3000)=nil, &(0x7f0000ffc000/0x3000)=nil, &(0x7f00000005c0), &(0x7f0000000600)=0x0) syz_io_uring_submit(r2, r3, &(0x7f0000000740)=@IORING_OP_READ=@pass_buffer={0x16, 0x1, 0x2004, @fd_index=0xa, 0x7, &(0x7f0000000640)=""/227, 0xe3, 0xc, 0x1}, 0x9) ioctl$SECCOMP_IOCTL_NOTIF_ADDFD(0xffffffffffffffff, 0x40182103, &(0x7f0000000780)={0x0, 0x4, r1, 0x9, 0x80000}) openat$cgroup_devices(0xffffffffffffffff, &(0x7f00000007c0)='devices.allow\x00', 0x2, 0x0) syz_mount_image$nfs4(&(0x7f0000000800), &(0x7f0000000840)='./file0/file0\x00', 0xffffffffffffff01, 0x1, &(0x7f0000000900)=[{&(0x7f0000000880)="f19bd7cfef39dd2070dcb194f7bd90ce305e2a9644b9fb91cc1e75bca69ed6bbdd7636452963af395ea61189cce718ef43420310b6ff8db9f4a606d67217b1aa7bf6e1435682323aef92ef40d036c48fa3fc363c6ad63229bb37cd76a6db9879a39f", 0x62, 0x6}], 0x8400, &(0x7f0000000940)={[{'*+\\['}]}) r4 = accept(0xffffffffffffffff, 0x0, &(0x7f0000000980)) sendmsg$MPTCP_PM_CMD_GET_LIMITS(r4, &(0x7f0000000ac0)={&(0x7f00000009c0)={0x10, 0x0, 0x0, 0x200}, 0xc, &(0x7f0000000a80)={&(0x7f0000000a00)={0x74, 0x0, 0x200, 0x70bd27, 0x25dfdbfd, {}, [@MPTCP_PM_ATTR_RCV_ADD_ADDRS={0x8, 0x2, 0x8}, @MPTCP_PM_ATTR_RCV_ADD_ADDRS={0x8, 0x2, 0x2}, @MPTCP_PM_ATTR_SUBFLOWS={0x8, 0x3, 0x6}, @MPTCP_PM_ATTR_ADDR={0x3c, 0x1, 0x0, 0x1, [@MPTCP_PM_ADDR_ATTR_PORT={0x6, 0x5, 0x4e20}, @MPTCP_PM_ADDR_ATTR_ID={0x5, 0x2, 0x5}, @MPTCP_PM_ADDR_ATTR_FLAGS={0x8, 0x6, 0x3}, @MPTCP_PM_ADDR_ATTR_PORT={0x6, 0x5, 0x4e23}, @MPTCP_PM_ADDR_ATTR_FAMILY={0x6}, @MPTCP_PM_ADDR_ATTR_FAMILY={0x6, 0x1, 0xa}, @MPTCP_PM_ADDR_ATTR_FAMILY={0x6, 0x1, 0xa}]}, @MPTCP_PM_ATTR_ADDR={0x4}, @MPTCP_PM_ATTR_SUBFLOWS={0x8}]}, 0x74}, 0x1, 0x0, 0x0, 0x11}, 0x80) sendmsg$IEEE802154_LLSEC_DEL_SECLEVEL(0xffffffffffffffff, &(0x7f0000000bc0)={&(0x7f0000000b00)={0x10, 0x0, 0x0, 0x800000}, 0xc, &(0x7f0000000b80)={&(0x7f0000000b40)={0x2c, 0x0, 0x800, 0x70bd27, 0x25dfdbff, {}, [@IEEE802154_ATTR_DEV_INDEX={0x8}, @IEEE802154_ATTR_LLSEC_FRAME_TYPE={0x5, 0x33, 0x81}, @IEEE802154_ATTR_DEV_INDEX={0x8}]}, 0x2c}, 0x1, 0x0, 0x0, 0x4}, 0x2) mount$9p_rdma(&(0x7f0000001040), &(0x7f0000001080)='./file0\x00', &(0x7f00000010c0), 0xa00800, &(0x7f0000001100)={'trans=rdma,', {'port', 0x3d, 0x4e20}, 0x2c, {[{@common=@aname={'aname', 0x3d, 'permit_directio'}}, {@sq={'sq', 0x3d, 0xffff}}], [{@fscontext={'fscontext', 0x3d, 'staff_u'}}]}}) 11:41:15 executing program 0: r0 = openat$vcsa(0xffffffffffffff9c, &(0x7f0000000000), 0x40000, 0x0) ioctl$SG_GET_PACK_ID(r0, 0x227c, &(0x7f0000000040)) syz_open_dev$sg(&(0x7f0000000540), 0x8, 0x8100) 11:41:15 executing program 3: ioctl$SG_SET_FORCE_PACK_ID(0xffffffffffffffff, 0x227b, &(0x7f0000000000)=0x1) ioctl$SG_SET_FORCE_PACK_ID(0xffffffffffffffff, 0x227b, &(0x7f0000000040)) ioctl$SG_GET_RESERVED_SIZE(0xffffffffffffffff, 0x2272, &(0x7f0000000080)) r0 = openat$vcsa(0xffffffffffffff9c, &(0x7f00000000c0), 0x4200, 0x0) ioctl$SCSI_IOCTL_SEND_COMMAND(r0, 0x1, &(0x7f0000000100)={0x17, 0x3, 0x1c00, "af36a59fb168d324fd8eaf833aeb82f60d75e8700d81d9"}) ioctl$SG_SET_TIMEOUT(r0, 0x2201, &(0x7f0000000140)=0x4) ioctl$SG_GET_VERSION_NUM(r0, 0x2282, &(0x7f0000000180)) ioctl$SG_GET_REQUEST_TABLE(r0, 0x2286, &(0x7f00000001c0)) ioctl$SG_GET_TIMEOUT(r0, 0x2202, 0x0) r1 = syz_open_dev$sg(&(0x7f0000000340), 0x7fff, 0x40) ioctl$SG_EMULATED_HOST(r1, 0x2203, &(0x7f0000000380)) openat$vcsa(0xffffffffffffff9c, &(0x7f00000003c0), 0x8103, 0x0) r2 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$inet6_tcp_TCP_CONGESTION(r2, 0x6, 0xd, &(0x7f0000000440)='scalable\x00', 0x9) 11:41:16 executing program 1: r0 = shmget(0x2, 0x3000, 0x100, &(0x7f0000ffb000/0x3000)=nil) shmat(r0, &(0x7f0000ffa000/0x3000)=nil, 0x2000) shmat(r0, &(0x7f0000ffa000/0x4000)=nil, 0x3000) shmget(0x3, 0x1000, 0x100, &(0x7f0000ffd000/0x1000)=nil) r1 = syz_genetlink_get_family_id$netlbl_mgmt(&(0x7f0000000040), 0xffffffffffffffff) sendmsg$NLBL_MGMT_C_REMOVEDEF(0xffffffffffffffff, &(0x7f0000000100)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x8}, 0xc, &(0x7f00000000c0)={&(0x7f0000000080)={0x3c, r1, 0x20, 0x70bd29, 0x25dfdbff, {}, [@NLBL_MGMT_A_FAMILY={0x6, 0xb, 0x5}, @NLBL_MGMT_A_PROTOCOL={0x8, 0x2, 0x3}, @NLBL_MGMT_A_IPV4MASK={0x8, 0x8, @multicast1}, @NLBL_MGMT_A_CLPDOI={0x8}, @NLBL_MGMT_A_IPV4ADDR={0x8, 0x7, @local}]}, 0x3c}, 0x1, 0x0, 0x0, 0x4048820}, 0x40000) shmat(0xffffffffffffffff, &(0x7f0000ffb000/0x4000)=nil, 0x2000) r2 = shmget(0x0, 0xf000, 0x100, &(0x7f0000ff1000/0xf000)=nil) shmctl$IPC_RMID(r2, 0x0) r3 = mmap$IORING_OFF_SQ_RING(&(0x7f0000ffd000/0x1000)=nil, 0x1000, 0x2000006, 0x40010, 0xffffffffffffffff, 0x0) syz_io_uring_submit(r3, 0x0, &(0x7f00000001c0)=@IORING_OP_PROVIDE_BUFFERS={0x1f, 0x1, 0x0, 0x8, 0x2, &(0x7f0000000140)="10e8e6d73f8e97a04564912d4b0bee6921be05ed083e4d741dabdbce8c94949f57a5c9d9da73d0e5ad668714159e31498f181aad79547c645eefb456a7b8c4be765eb156b77cba8a752b90d7729b2c285893a10c3633d2485f48f30d247214c5e28a", 0x7, 0x0, 0x1, {0x1}}, 0x100) socket(0x2c, 0x5, 0x1) accept4$packet(0xffffffffffffffff, &(0x7f0000000280)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @random}, &(0x7f00000002c0)=0x14, 0x40000) io_uring_setup(0x14ab, &(0x7f0000000480)={0x0, 0x5191, 0x20, 0x1, 0x3ba}) shmget$private(0x0, 0x2000, 0x10, &(0x7f0000ffc000/0x2000)=nil) 11:41:16 executing program 7: r0 = syz_open_dev$sg(&(0x7f0000000000), 0x1, 0x10000) ioctl$SG_GET_PACK_ID(r0, 0x227c, &(0x7f0000000040)) ioctl$SCSI_IOCTL_DOORLOCK(r0, 0x5380) ioctl$SG_SET_KEEP_ORPHAN(r0, 0x2287, &(0x7f0000000080)=0x7) ioctl$SCSI_IOCTL_BENCHMARK_COMMAND(r0, 0x3) ioctl$SCSI_IOCTL_SYNC(r0, 0x4) ioctl$SG_SET_DEBUG(r0, 0x227e, &(0x7f00000000c0)=0x1) setsockopt$packet_add_memb(0xffffffffffffffff, 0x107, 0x1, &(0x7f0000000100)={0x0, 0x1, 0x6}, 0x10) openat$vcsa(0xffffffffffffff9c, &(0x7f0000000440), 0x10480, 0x0) [ 168.889977] loop6: detected capacity change from 0 to 1 [ 168.910016] SELinux: security_context_str_to_sid (staff_u) failed with errno=-22 11:41:24 executing program 6: ioprio_set$uid(0x0, 0xee01, 0x4004) syz_mount_image$msdos(&(0x7f0000000000), &(0x7f0000000040)='./file0\x00', 0x200, 0x1, &(0x7f00000000c0)=[{&(0x7f0000000080)="7c74c7bc99e778a0c971e6f50fbdd2b70fa0b038d18c7d5ac685833434d89dce684239293aa5d8b6f11bc5c4a033ad1dc68319fad36a1101aad751fd6f4f10", 0x3f, 0x7f}], 0x42000, &(0x7f0000000100)={[{@dots}], [{@obj_user}, {@dont_appraise}, {@uid_lt}, {@hash}, {@seclabel}]}) getsockopt$inet6_IPV6_XFRM_POLICY(0xffffffffffffffff, 0x29, 0x23, &(0x7f0000000240)={{{@in=@loopback, @in6=@empty, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, {{@in6=@local}, 0x0, @in6=@mcast1}}, &(0x7f0000000340)=0xe8) mount$9p_xen(&(0x7f0000000180), &(0x7f00000001c0)='./file0\x00', &(0x7f0000000200), 0x1121061, &(0x7f0000000380)={'trans=xen,', {[{@msize={'msize', 0x3d, 0xf6b3}}, {@debug={'debug', 0x3d, 0x7ff}}, {@posixacl}, {@aname={'aname', 0x3d, '*$-&'}}, {@uname={'uname', 0x3d, 'msdos\x00'}}], [{@seclabel}, {@euid_eq={'euid', 0x3d, r0}}, {@permit_directio}, {@appraise_type}]}}) r1 = syz_io_uring_setup(0x1d4a, &(0x7f0000000440)={0x0, 0xfa85, 0x0, 0x0, 0x285}, &(0x7f0000ffd000/0x1000)=nil, &(0x7f0000ffd000/0x2000)=nil, &(0x7f00000004c0)=0x0, &(0x7f0000000500)) syz_io_uring_setup(0x3e5e, &(0x7f0000000540)={0x0, 0x5c61, 0x8, 0x2, 0x72}, &(0x7f0000ffd000/0x3000)=nil, &(0x7f0000ffc000/0x3000)=nil, &(0x7f00000005c0), &(0x7f0000000600)=0x0) syz_io_uring_submit(r2, r3, &(0x7f0000000740)=@IORING_OP_READ=@pass_buffer={0x16, 0x1, 0x2004, @fd_index=0xa, 0x7, &(0x7f0000000640)=""/227, 0xe3, 0xc, 0x1}, 0x9) ioctl$SECCOMP_IOCTL_NOTIF_ADDFD(0xffffffffffffffff, 0x40182103, &(0x7f0000000780)={0x0, 0x4, r1, 0x9, 0x80000}) openat$cgroup_devices(0xffffffffffffffff, &(0x7f00000007c0)='devices.allow\x00', 0x2, 0x0) syz_mount_image$nfs4(&(0x7f0000000800), &(0x7f0000000840)='./file0/file0\x00', 0xffffffffffffff01, 0x1, &(0x7f0000000900)=[{&(0x7f0000000880)="f19bd7cfef39dd2070dcb194f7bd90ce305e2a9644b9fb91cc1e75bca69ed6bbdd7636452963af395ea61189cce718ef43420310b6ff8db9f4a606d67217b1aa7bf6e1435682323aef92ef40d036c48fa3fc363c6ad63229bb37cd76a6db9879a39f", 0x62, 0x6}], 0x8400, &(0x7f0000000940)={[{'*+\\['}]}) r4 = accept(0xffffffffffffffff, 0x0, &(0x7f0000000980)) sendmsg$MPTCP_PM_CMD_GET_LIMITS(r4, &(0x7f0000000ac0)={&(0x7f00000009c0)={0x10, 0x0, 0x0, 0x200}, 0xc, &(0x7f0000000a80)={&(0x7f0000000a00)={0x74, 0x0, 0x200, 0x70bd27, 0x25dfdbfd, {}, [@MPTCP_PM_ATTR_RCV_ADD_ADDRS={0x8, 0x2, 0x8}, @MPTCP_PM_ATTR_RCV_ADD_ADDRS={0x8, 0x2, 0x2}, @MPTCP_PM_ATTR_SUBFLOWS={0x8, 0x3, 0x6}, @MPTCP_PM_ATTR_ADDR={0x3c, 0x1, 0x0, 0x1, [@MPTCP_PM_ADDR_ATTR_PORT={0x6, 0x5, 0x4e20}, @MPTCP_PM_ADDR_ATTR_ID={0x5, 0x2, 0x5}, @MPTCP_PM_ADDR_ATTR_FLAGS={0x8, 0x6, 0x3}, @MPTCP_PM_ADDR_ATTR_PORT={0x6, 0x5, 0x4e23}, @MPTCP_PM_ADDR_ATTR_FAMILY={0x6}, @MPTCP_PM_ADDR_ATTR_FAMILY={0x6, 0x1, 0xa}, @MPTCP_PM_ADDR_ATTR_FAMILY={0x6, 0x1, 0xa}]}, @MPTCP_PM_ATTR_ADDR={0x4}, @MPTCP_PM_ATTR_SUBFLOWS={0x8}]}, 0x74}, 0x1, 0x0, 0x0, 0x11}, 0x80) sendmsg$IEEE802154_LLSEC_DEL_SECLEVEL(0xffffffffffffffff, &(0x7f0000000bc0)={&(0x7f0000000b00)={0x10, 0x0, 0x0, 0x800000}, 0xc, &(0x7f0000000b80)={&(0x7f0000000b40)={0x2c, 0x0, 0x800, 0x70bd27, 0x25dfdbff, {}, [@IEEE802154_ATTR_DEV_INDEX={0x8}, @IEEE802154_ATTR_LLSEC_FRAME_TYPE={0x5, 0x33, 0x81}, @IEEE802154_ATTR_DEV_INDEX={0x8}]}, 0x2c}, 0x1, 0x0, 0x0, 0x4}, 0x2) mount$9p_rdma(&(0x7f0000001040), &(0x7f0000001080)='./file0\x00', &(0x7f00000010c0), 0xa00800, &(0x7f0000001100)={'trans=rdma,', {'port', 0x3d, 0x4e20}, 0x2c, {[{@common=@aname={'aname', 0x3d, 'permit_directio'}}, {@sq={'sq', 0x3d, 0xffff}}], [{@fscontext={'fscontext', 0x3d, 'staff_u'}}]}}) 11:41:24 executing program 4: setsockopt$inet_tcp_TCP_QUEUE_SEQ(0xffffffffffffffff, 0x6, 0x15, &(0x7f0000000000), 0x4) r0 = openat$vcsa(0xffffffffffffff9c, &(0x7f0000000040), 0x81, 0x0) setsockopt$packet_tx_ring(r0, 0x107, 0xd, &(0x7f0000000080)=@req={0x4, 0xffffffff, 0xd5, 0x5}, 0x10) setsockopt$inet_tcp_TCP_REPAIR_WINDOW(r0, 0x6, 0x1d, &(0x7f00000000c0)={0xfffffff9, 0x1, 0x7fffffff, 0x6, 0x1}, 0x14) ioctl$SCSI_IOCTL_SYNC(r0, 0x4) r1 = accept(r0, &(0x7f0000000100)=@rc={0x1f, @fixed}, &(0x7f0000000180)=0x80) setsockopt$inet_tcp_TCP_FASTOPEN_KEY(r1, 0x6, 0x21, &(0x7f00000001c0)="2a6eddb47c1ebcb5002df4f95b6a3218", 0x10) socket$inet_tcp(0x2, 0x1, 0x0) ioctl$SG_GET_VERSION_NUM(r0, 0x2282, &(0x7f0000000200)) syz_genetlink_get_family_id$netlbl_mgmt(&(0x7f0000000440), 0xffffffffffffffff) syz_genetlink_get_family_id$netlbl_mgmt(&(0x7f0000000740), 0xffffffffffffffff) 11:41:24 executing program 3: ioctl$SG_SET_FORCE_PACK_ID(0xffffffffffffffff, 0x227b, &(0x7f0000000000)=0x1) ioctl$SG_SET_FORCE_PACK_ID(0xffffffffffffffff, 0x227b, &(0x7f0000000040)) ioctl$SG_GET_RESERVED_SIZE(0xffffffffffffffff, 0x2272, &(0x7f0000000080)) r0 = openat$vcsa(0xffffffffffffff9c, &(0x7f00000000c0), 0x4200, 0x0) ioctl$SCSI_IOCTL_SEND_COMMAND(r0, 0x1, &(0x7f0000000100)={0x17, 0x3, 0x1c00, "af36a59fb168d324fd8eaf833aeb82f60d75e8700d81d9"}) ioctl$SG_SET_TIMEOUT(r0, 0x2201, &(0x7f0000000140)=0x4) ioctl$SG_GET_VERSION_NUM(r0, 0x2282, &(0x7f0000000180)) ioctl$SG_GET_REQUEST_TABLE(r0, 0x2286, &(0x7f00000001c0)) ioctl$SG_GET_TIMEOUT(r0, 0x2202, 0x0) r1 = syz_open_dev$sg(&(0x7f0000000340), 0x7fff, 0x40) ioctl$SG_EMULATED_HOST(r1, 0x2203, &(0x7f0000000380)) openat$vcsa(0xffffffffffffff9c, &(0x7f00000003c0), 0x8103, 0x0) r2 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$inet6_tcp_TCP_CONGESTION(r2, 0x6, 0xd, &(0x7f0000000440)='scalable\x00', 0x9) 11:41:24 executing program 2: clock_nanosleep(0x7, 0x0, &(0x7f0000000000)={0x77359400}, &(0x7f0000000040)) getsockopt$inet6_IPV6_XFRM_POLICY(0xffffffffffffffff, 0x29, 0x23, &(0x7f0000000080)={{{@in6, @in6=@remote, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, {{@in6=@dev}, 0x0, @in=@initdev}}, &(0x7f0000000180)=0xe8) setsockopt$packet_add_memb(0xffffffffffffffff, 0x107, 0x1, &(0x7f00000001c0)={r0, 0x1, 0x6, @broadcast}, 0x10) getpeername$packet(0xffffffffffffffff, &(0x7f0000000200)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @dev}, &(0x7f0000000240)=0x14) recvmsg(0xffffffffffffffff, &(0x7f00000027c0)={&(0x7f0000000280)=@xdp={0x2c, 0x0, 0x0}, 0x80, &(0x7f0000002640)=[{&(0x7f0000000300)=""/227, 0xe3}, {&(0x7f0000000400)=""/4096, 0x1000}, {&(0x7f0000001400)=""/92, 0x5c}, {&(0x7f0000001480)=""/93, 0x5d}, {&(0x7f0000001500)=""/4096, 0x1000}, {&(0x7f0000002500)=""/87, 0x57}, {&(0x7f0000002580)=""/189, 0xbd}], 0x7, &(0x7f00000026c0)=""/199, 0xc7}, 0x140) bind$packet(0xffffffffffffffff, &(0x7f0000002800)={0x11, 0x1b, r2, 0x1, 0x5}, 0x14) getresgid(&(0x7f0000002840), &(0x7f0000002880), &(0x7f00000028c0)) r3 = accept4$packet(0xffffffffffffffff, &(0x7f0000002900)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @multicast}, &(0x7f0000002940)=0x14, 0x80000) recvfrom$packet(r3, &(0x7f0000002980)=""/4096, 0x1000, 0x0, &(0x7f0000003980)={0x11, 0x17, r2, 0x1, 0x5, 0x6, @multicast}, 0x14) r4 = socket$inet6_udp(0xa, 0x2, 0x0) getsockopt$inet6_IPV6_XFRM_POLICY(r4, 0x29, 0x23, &(0x7f00000039c0)={{{@in6=@ipv4, @in6=@private0}}, {{@in=@private}, 0x0, @in6=@remote}}, &(0x7f0000003ac0)=0xe8) r5 = openat$sr(0xffffffffffffff9c, &(0x7f0000003b00), 0x200000, 0x0) recvfrom$packet(r5, &(0x7f0000003b40)=""/161, 0xa1, 0x140, &(0x7f0000003c00)={0x11, 0x2, r1, 0x1, 0x9a, 0x6, @local}, 0x14) openat$vcsa(0xffffffffffffff9c, &(0x7f0000003c40), 0x500, 0x0) openat$sr(0xffffffffffffff9c, &(0x7f0000005480), 0x428802, 0x0) 11:41:24 executing program 7: r0 = syz_open_dev$sg(&(0x7f0000000000), 0x1, 0x10000) ioctl$SG_GET_PACK_ID(r0, 0x227c, &(0x7f0000000040)) ioctl$SCSI_IOCTL_DOORLOCK(r0, 0x5380) ioctl$SG_SET_KEEP_ORPHAN(r0, 0x2287, &(0x7f0000000080)=0x7) ioctl$SCSI_IOCTL_BENCHMARK_COMMAND(r0, 0x3) ioctl$SCSI_IOCTL_SYNC(r0, 0x4) ioctl$SG_SET_DEBUG(r0, 0x227e, &(0x7f00000000c0)=0x1) openat$vcsa(0xffffffffffffff9c, &(0x7f0000000440), 0x10480, 0x0) 11:41:24 executing program 5: getpeername$packet(0xffffffffffffffff, &(0x7f0000000000)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @dev}, &(0x7f0000000040)=0x14) ioctl$sock_SIOCADDRT(0xffffffffffffffff, 0x890b, &(0x7f0000000080)={0x0, @phonet={0x23, 0xfe, 0x0, 0x2f}, @hci={0x1f, 0xffffffffffffffff, 0x3}, @rc={0x1f, @any, 0x2}, 0x5, 0x0, 0x0, 0x0, 0x7ff, 0x0, 0x0, 0x4, 0x4}) r0 = mmap$IORING_OFF_SQES(&(0x7f0000ffa000/0x4000)=nil, 0x4000, 0x1000004, 0x810, 0xffffffffffffffff, 0x10000000) syz_io_uring_submit(0x0, r0, &(0x7f0000000100)=@IORING_OP_MADVISE={0x19, 0x3, 0x0, 0x0, 0x0, &(0x7f0000ffa000/0x2000)=nil, 0x2000, 0xb, 0x1}, 0x8) r1 = syz_genetlink_get_family_id$mptcp(&(0x7f0000000180), 0xffffffffffffffff) sendmsg$MPTCP_PM_CMD_ADD_ADDR(0xffffffffffffffff, &(0x7f0000000240)={&(0x7f0000000140)={0x10, 0x0, 0x0, 0x10000}, 0xc, &(0x7f0000000200)={&(0x7f00000001c0)={0x24, r1, 0x800, 0x70bd27, 0x25dfdbfd, {}, [@MPTCP_PM_ATTR_RCV_ADD_ADDRS={0x8, 0x2, 0x8}, @MPTCP_PM_ATTR_RCV_ADD_ADDRS={0x8, 0x2, 0x6}]}, 0x24}, 0x1, 0x0, 0x0, 0x2400c096}, 0x80) sendmsg$MPTCP_PM_CMD_FLUSH_ADDRS(0xffffffffffffffff, &(0x7f00000003c0)={&(0x7f0000000280)={0x10, 0x0, 0x0, 0x40}, 0xc, &(0x7f0000000380)={&(0x7f00000002c0)={0xa4, r1, 0x200, 0x70bd25, 0x25dfdbff, {}, [@MPTCP_PM_ATTR_RCV_ADD_ADDRS={0x8, 0x2, 0x3}, @MPTCP_PM_ATTR_ADDR={0x30, 0x1, 0x0, 0x1, [@MPTCP_PM_ADDR_ATTR_ADDR6={0x14, 0x4, @initdev={0xfe, 0x88, '\x00', 0x0, 0x0}}, @MPTCP_PM_ADDR_ATTR_ADDR4={0x8, 0x3, @local}, @MPTCP_PM_ADDR_ATTR_FLAGS={0x8, 0x6, 0x2}, @MPTCP_PM_ADDR_ATTR_FAMILY={0x6, 0x1, 0xa}]}, @MPTCP_PM_ATTR_ADDR={0x2c, 0x1, 0x0, 0x1, [@MPTCP_PM_ADDR_ATTR_ID={0x5, 0x2, 0x81}, @MPTCP_PM_ADDR_ATTR_PORT={0x6, 0x5, 0x4e22}, @MPTCP_PM_ADDR_ATTR_FAMILY={0x6, 0x1, 0xa}, @MPTCP_PM_ADDR_ATTR_FLAGS={0x8}, @MPTCP_PM_ADDR_ATTR_ID={0x5, 0x2, 0x40}]}, @MPTCP_PM_ATTR_SUBFLOWS={0x8, 0x3, 0x5}, @MPTCP_PM_ATTR_SUBFLOWS={0x8, 0x3, 0x5}, @MPTCP_PM_ATTR_ADDR={0x14, 0x1, 0x0, 0x1, [@MPTCP_PM_ADDR_ATTR_PORT={0x6, 0x5, 0x4e23}, @MPTCP_PM_ADDR_ATTR_PORT={0x6, 0x5, 0x4e21}]}, @MPTCP_PM_ATTR_SUBFLOWS={0x8, 0x3, 0x2}]}, 0xa4}, 0x1, 0x0, 0x0, 0x40}, 0x90) r2 = syz_open_dev$sg(&(0x7f0000000400), 0x4, 0x38040) ioctl$SCSI_IOCTL_DOORUNLOCK(r2, 0x5381) r3 = openat$vcsa(0xffffffffffffff9c, &(0x7f0000000580), 0x121080, 0x0) setsockopt$inet6_tcp_TCP_QUEUE_SEQ(r3, 0x6, 0x15, &(0x7f0000000780)=0x400, 0x4) 11:41:24 executing program 1: r0 = shmget(0x2, 0x3000, 0x100, &(0x7f0000ffb000/0x3000)=nil) shmat(r0, &(0x7f0000ffa000/0x3000)=nil, 0x2000) shmat(r0, &(0x7f0000ffa000/0x4000)=nil, 0x3000) shmget(0x3, 0x1000, 0x100, &(0x7f0000ffd000/0x1000)=nil) r1 = syz_genetlink_get_family_id$netlbl_mgmt(&(0x7f0000000040), 0xffffffffffffffff) sendmsg$NLBL_MGMT_C_REMOVEDEF(0xffffffffffffffff, &(0x7f0000000100)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x8}, 0xc, &(0x7f00000000c0)={&(0x7f0000000080)={0x3c, r1, 0x20, 0x70bd29, 0x25dfdbff, {}, [@NLBL_MGMT_A_FAMILY={0x6, 0xb, 0x5}, @NLBL_MGMT_A_PROTOCOL={0x8, 0x2, 0x3}, @NLBL_MGMT_A_IPV4MASK={0x8, 0x8, @multicast1}, @NLBL_MGMT_A_CLPDOI={0x8}, @NLBL_MGMT_A_IPV4ADDR={0x8, 0x7, @local}]}, 0x3c}, 0x1, 0x0, 0x0, 0x4048820}, 0x40000) shmat(0xffffffffffffffff, &(0x7f0000ffb000/0x4000)=nil, 0x2000) r2 = shmget(0x0, 0xf000, 0x100, &(0x7f0000ff1000/0xf000)=nil) shmctl$IPC_RMID(r2, 0x0) r3 = mmap$IORING_OFF_SQ_RING(&(0x7f0000ffd000/0x1000)=nil, 0x1000, 0x2000006, 0x40010, 0xffffffffffffffff, 0x0) syz_io_uring_submit(r3, 0x0, &(0x7f00000001c0)=@IORING_OP_PROVIDE_BUFFERS={0x1f, 0x1, 0x0, 0x8, 0x2, &(0x7f0000000140)="10e8e6d73f8e97a04564912d4b0bee6921be05ed083e4d741dabdbce8c94949f57a5c9d9da73d0e5ad668714159e31498f181aad79547c645eefb456a7b8c4be765eb156b77cba8a752b90d7729b2c285893a10c3633d2485f48f30d247214c5e28a", 0x7, 0x0, 0x1, {0x1}}, 0x100) socket(0x2c, 0x5, 0x1) accept4$packet(0xffffffffffffffff, &(0x7f0000000280)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @random}, &(0x7f00000002c0)=0x14, 0x40000) io_uring_setup(0x14ab, &(0x7f0000000480)={0x0, 0x5191, 0x20, 0x1, 0x3ba}) shmget$private(0x0, 0x2000, 0x10, &(0x7f0000ffc000/0x2000)=nil) 11:41:24 executing program 0: openat$vcsa(0xffffffffffffff9c, &(0x7f0000000000), 0x40000, 0x0) syz_open_dev$sg(&(0x7f0000000540), 0x8, 0x8100) [ 177.017647] loop6: detected capacity change from 0 to 1 [ 177.035111] loop6: detected capacity change from 0 to 264192 [ 177.038646] nfs4: Unknown parameter '*+\[' [ 177.042339] SELinux: security_context_str_to_sid (staff_u) failed with errno=-22 11:41:24 executing program 0: syz_open_dev$sg(&(0x7f0000000540), 0x8, 0x8100) 11:41:24 executing program 4: setsockopt$inet_tcp_TCP_QUEUE_SEQ(0xffffffffffffffff, 0x6, 0x15, &(0x7f0000000000), 0x4) r0 = openat$vcsa(0xffffffffffffff9c, &(0x7f0000000040), 0x81, 0x0) setsockopt$packet_tx_ring(r0, 0x107, 0xd, &(0x7f0000000080)=@req={0x4, 0xffffffff, 0xd5, 0x5}, 0x10) setsockopt$inet_tcp_TCP_REPAIR_WINDOW(r0, 0x6, 0x1d, &(0x7f00000000c0)={0xfffffff9, 0x1, 0x7fffffff, 0x6, 0x1}, 0x14) ioctl$SCSI_IOCTL_SYNC(r0, 0x4) r1 = accept(r0, &(0x7f0000000100)=@rc={0x1f, @fixed}, &(0x7f0000000180)=0x80) setsockopt$inet_tcp_TCP_FASTOPEN_KEY(r1, 0x6, 0x21, &(0x7f00000001c0)="2a6eddb47c1ebcb5002df4f95b6a3218", 0x10) socket$inet_tcp(0x2, 0x1, 0x0) ioctl$SG_GET_VERSION_NUM(r0, 0x2282, &(0x7f0000000200)) syz_genetlink_get_family_id$netlbl_mgmt(&(0x7f0000000440), 0xffffffffffffffff) syz_genetlink_get_family_id$netlbl_mgmt(&(0x7f0000000740), 0xffffffffffffffff) 11:41:24 executing program 6: ioprio_set$uid(0x0, 0xee01, 0x4004) syz_mount_image$msdos(&(0x7f0000000000), &(0x7f0000000040)='./file0\x00', 0x200, 0x1, &(0x7f00000000c0)=[{&(0x7f0000000080)="7c74c7bc99e778a0c971e6f50fbdd2b70fa0b038d18c7d5ac685833434d89dce684239293aa5d8b6f11bc5c4a033ad1dc68319fad36a1101aad751fd6f4f10", 0x3f, 0x7f}], 0x42000, &(0x7f0000000100)={[{@dots}], [{@obj_user}, {@dont_appraise}, {@uid_lt}, {@hash}, {@seclabel}]}) getsockopt$inet6_IPV6_XFRM_POLICY(0xffffffffffffffff, 0x29, 0x23, &(0x7f0000000240)={{{@in=@loopback, @in6=@empty, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, {{@in6=@local}, 0x0, @in6=@mcast1}}, &(0x7f0000000340)=0xe8) mount$9p_xen(&(0x7f0000000180), &(0x7f00000001c0)='./file0\x00', &(0x7f0000000200), 0x1121061, &(0x7f0000000380)={'trans=xen,', {[{@msize={'msize', 0x3d, 0xf6b3}}, {@debug={'debug', 0x3d, 0x7ff}}, {@posixacl}, {@aname={'aname', 0x3d, '*$-&'}}, {@uname={'uname', 0x3d, 'msdos\x00'}}], [{@seclabel}, {@euid_eq={'euid', 0x3d, r0}}, {@permit_directio}, {@appraise_type}]}}) r1 = syz_io_uring_setup(0x1d4a, &(0x7f0000000440)={0x0, 0xfa85, 0x0, 0x0, 0x285}, &(0x7f0000ffd000/0x1000)=nil, &(0x7f0000ffd000/0x2000)=nil, &(0x7f00000004c0)=0x0, &(0x7f0000000500)) syz_io_uring_setup(0x3e5e, &(0x7f0000000540)={0x0, 0x5c61, 0x8, 0x2, 0x72}, &(0x7f0000ffd000/0x3000)=nil, &(0x7f0000ffc000/0x3000)=nil, &(0x7f00000005c0), &(0x7f0000000600)=0x0) syz_io_uring_submit(r2, r3, &(0x7f0000000740)=@IORING_OP_READ=@pass_buffer={0x16, 0x1, 0x2004, @fd_index=0xa, 0x7, &(0x7f0000000640)=""/227, 0xe3, 0xc, 0x1}, 0x9) ioctl$SECCOMP_IOCTL_NOTIF_ADDFD(0xffffffffffffffff, 0x40182103, &(0x7f0000000780)={0x0, 0x4, r1, 0x9, 0x80000}) openat$cgroup_devices(0xffffffffffffffff, &(0x7f00000007c0)='devices.allow\x00', 0x2, 0x0) syz_mount_image$nfs4(&(0x7f0000000800), &(0x7f0000000840)='./file0/file0\x00', 0xffffffffffffff01, 0x1, &(0x7f0000000900)=[{&(0x7f0000000880)="f19bd7cfef39dd2070dcb194f7bd90ce305e2a9644b9fb91cc1e75bca69ed6bbdd7636452963af395ea61189cce718ef43420310b6ff8db9f4a606d67217b1aa7bf6e1435682323aef92ef40d036c48fa3fc363c6ad63229bb37cd76a6db9879a39f", 0x62, 0x6}], 0x8400, &(0x7f0000000940)={[{'*+\\['}]}) r4 = accept(0xffffffffffffffff, 0x0, &(0x7f0000000980)) sendmsg$MPTCP_PM_CMD_GET_LIMITS(r4, &(0x7f0000000ac0)={&(0x7f00000009c0)={0x10, 0x0, 0x0, 0x200}, 0xc, &(0x7f0000000a80)={&(0x7f0000000a00)={0x74, 0x0, 0x200, 0x70bd27, 0x25dfdbfd, {}, [@MPTCP_PM_ATTR_RCV_ADD_ADDRS={0x8, 0x2, 0x8}, @MPTCP_PM_ATTR_RCV_ADD_ADDRS={0x8, 0x2, 0x2}, @MPTCP_PM_ATTR_SUBFLOWS={0x8, 0x3, 0x6}, @MPTCP_PM_ATTR_ADDR={0x3c, 0x1, 0x0, 0x1, [@MPTCP_PM_ADDR_ATTR_PORT={0x6, 0x5, 0x4e20}, @MPTCP_PM_ADDR_ATTR_ID={0x5, 0x2, 0x5}, @MPTCP_PM_ADDR_ATTR_FLAGS={0x8, 0x6, 0x3}, @MPTCP_PM_ADDR_ATTR_PORT={0x6, 0x5, 0x4e23}, @MPTCP_PM_ADDR_ATTR_FAMILY={0x6}, @MPTCP_PM_ADDR_ATTR_FAMILY={0x6, 0x1, 0xa}, @MPTCP_PM_ADDR_ATTR_FAMILY={0x6, 0x1, 0xa}]}, @MPTCP_PM_ATTR_ADDR={0x4}, @MPTCP_PM_ATTR_SUBFLOWS={0x8}]}, 0x74}, 0x1, 0x0, 0x0, 0x11}, 0x80) mount$9p_rdma(&(0x7f0000001040), &(0x7f0000001080)='./file0\x00', &(0x7f00000010c0), 0xa00800, &(0x7f0000001100)={'trans=rdma,', {'port', 0x3d, 0x4e20}, 0x2c, {[{@common=@aname={'aname', 0x3d, 'permit_directio'}}, {@sq={'sq', 0x3d, 0xffff}}], [{@fscontext={'fscontext', 0x3d, 'staff_u'}}]}}) [ 177.141043] loop6: detected capacity change from 0 to 1 11:41:24 executing program 7: r0 = syz_open_dev$sg(&(0x7f0000000000), 0x1, 0x10000) ioctl$SG_GET_PACK_ID(r0, 0x227c, &(0x7f0000000040)) ioctl$SCSI_IOCTL_DOORLOCK(r0, 0x5380) ioctl$SG_SET_KEEP_ORPHAN(r0, 0x2287, &(0x7f0000000080)=0x7) ioctl$SCSI_IOCTL_BENCHMARK_COMMAND(r0, 0x3) ioctl$SCSI_IOCTL_SYNC(r0, 0x4) openat$vcsa(0xffffffffffffff9c, &(0x7f0000000440), 0x10480, 0x0) [ 177.162870] SELinux: security_context_str_to_sid (staff_u) failed with errno=-22 11:41:33 executing program 4: setsockopt$inet_tcp_TCP_QUEUE_SEQ(0xffffffffffffffff, 0x6, 0x15, &(0x7f0000000000), 0x4) r0 = openat$vcsa(0xffffffffffffff9c, &(0x7f0000000040), 0x81, 0x0) setsockopt$packet_tx_ring(r0, 0x107, 0xd, &(0x7f0000000080)=@req={0x4, 0xffffffff, 0xd5, 0x5}, 0x10) setsockopt$inet_tcp_TCP_REPAIR_WINDOW(r0, 0x6, 0x1d, &(0x7f00000000c0)={0xfffffff9, 0x1, 0x7fffffff, 0x6, 0x1}, 0x14) ioctl$SCSI_IOCTL_SYNC(r0, 0x4) r1 = accept(r0, &(0x7f0000000100)=@rc={0x1f, @fixed}, &(0x7f0000000180)=0x80) setsockopt$inet_tcp_TCP_FASTOPEN_KEY(r1, 0x6, 0x21, &(0x7f00000001c0)="2a6eddb47c1ebcb5002df4f95b6a3218", 0x10) socket$inet_tcp(0x2, 0x1, 0x0) syz_genetlink_get_family_id$netlbl_mgmt(&(0x7f0000000440), 0xffffffffffffffff) syz_genetlink_get_family_id$netlbl_mgmt(&(0x7f0000000740), 0xffffffffffffffff) 11:41:33 executing program 3: ioctl$SG_SET_FORCE_PACK_ID(0xffffffffffffffff, 0x227b, &(0x7f0000000000)=0x1) ioctl$SG_SET_FORCE_PACK_ID(0xffffffffffffffff, 0x227b, &(0x7f0000000040)) ioctl$SG_GET_RESERVED_SIZE(0xffffffffffffffff, 0x2272, &(0x7f0000000080)) r0 = openat$vcsa(0xffffffffffffff9c, &(0x7f00000000c0), 0x4200, 0x0) ioctl$SCSI_IOCTL_SEND_COMMAND(r0, 0x1, &(0x7f0000000100)={0x17, 0x3, 0x1c00, "af36a59fb168d324fd8eaf833aeb82f60d75e8700d81d9"}) ioctl$SG_SET_TIMEOUT(r0, 0x2201, &(0x7f0000000140)=0x4) ioctl$SG_GET_VERSION_NUM(r0, 0x2282, &(0x7f0000000180)) ioctl$SG_GET_REQUEST_TABLE(r0, 0x2286, &(0x7f00000001c0)) ioctl$SG_GET_TIMEOUT(r0, 0x2202, 0x0) r1 = syz_open_dev$sg(&(0x7f0000000340), 0x7fff, 0x40) ioctl$SG_EMULATED_HOST(r1, 0x2203, &(0x7f0000000380)) r2 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$inet6_tcp_TCP_CONGESTION(r2, 0x6, 0xd, &(0x7f0000000440)='scalable\x00', 0x9) 11:41:33 executing program 0: syz_open_dev$sg(0x0, 0x8, 0x8100) 11:41:33 executing program 1: r0 = shmget(0x2, 0x3000, 0x100, &(0x7f0000ffb000/0x3000)=nil) shmat(r0, &(0x7f0000ffa000/0x3000)=nil, 0x2000) shmat(r0, &(0x7f0000ffa000/0x4000)=nil, 0x3000) shmget(0x3, 0x1000, 0x100, &(0x7f0000ffd000/0x1000)=nil) r1 = syz_genetlink_get_family_id$netlbl_mgmt(&(0x7f0000000040), 0xffffffffffffffff) sendmsg$NLBL_MGMT_C_REMOVEDEF(0xffffffffffffffff, &(0x7f0000000100)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x8}, 0xc, &(0x7f00000000c0)={&(0x7f0000000080)={0x3c, r1, 0x20, 0x70bd29, 0x25dfdbff, {}, [@NLBL_MGMT_A_FAMILY={0x6, 0xb, 0x5}, @NLBL_MGMT_A_PROTOCOL={0x8, 0x2, 0x3}, @NLBL_MGMT_A_IPV4MASK={0x8, 0x8, @multicast1}, @NLBL_MGMT_A_CLPDOI={0x8}, @NLBL_MGMT_A_IPV4ADDR={0x8, 0x7, @local}]}, 0x3c}, 0x1, 0x0, 0x0, 0x4048820}, 0x40000) shmat(0xffffffffffffffff, &(0x7f0000ffb000/0x4000)=nil, 0x2000) r2 = shmget(0x0, 0xf000, 0x100, &(0x7f0000ff1000/0xf000)=nil) shmctl$IPC_RMID(r2, 0x0) r3 = mmap$IORING_OFF_SQ_RING(&(0x7f0000ffd000/0x1000)=nil, 0x1000, 0x2000006, 0x40010, 0xffffffffffffffff, 0x0) syz_io_uring_submit(r3, 0x0, &(0x7f00000001c0)=@IORING_OP_PROVIDE_BUFFERS={0x1f, 0x1, 0x0, 0x8, 0x2, &(0x7f0000000140)="10e8e6d73f8e97a04564912d4b0bee6921be05ed083e4d741dabdbce8c94949f57a5c9d9da73d0e5ad668714159e31498f181aad79547c645eefb456a7b8c4be765eb156b77cba8a752b90d7729b2c285893a10c3633d2485f48f30d247214c5e28a", 0x7, 0x0, 0x1, {0x1}}, 0x100) socket(0x2c, 0x5, 0x1) accept4$packet(0xffffffffffffffff, &(0x7f0000000280)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @random}, &(0x7f00000002c0)=0x14, 0x40000) io_uring_setup(0x14ab, &(0x7f0000000480)={0x0, 0x5191, 0x20, 0x1, 0x3ba}) shmget$private(0x0, 0x2000, 0x10, &(0x7f0000ffc000/0x2000)=nil) 11:41:33 executing program 6: ioprio_set$uid(0x0, 0xee01, 0x4004) syz_mount_image$msdos(&(0x7f0000000000), &(0x7f0000000040)='./file0\x00', 0x200, 0x1, &(0x7f00000000c0)=[{&(0x7f0000000080)="7c74c7bc99e778a0c971e6f50fbdd2b70fa0b038d18c7d5ac685833434d89dce684239293aa5d8b6f11bc5c4a033ad1dc68319fad36a1101aad751fd6f4f10", 0x3f, 0x7f}], 0x42000, &(0x7f0000000100)={[{@dots}], [{@obj_user}, {@dont_appraise}, {@uid_lt}, {@hash}, {@seclabel}]}) getsockopt$inet6_IPV6_XFRM_POLICY(0xffffffffffffffff, 0x29, 0x23, &(0x7f0000000240)={{{@in=@loopback, @in6=@empty, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, {{@in6=@local}, 0x0, @in6=@mcast1}}, &(0x7f0000000340)=0xe8) mount$9p_xen(&(0x7f0000000180), &(0x7f00000001c0)='./file0\x00', &(0x7f0000000200), 0x1121061, &(0x7f0000000380)={'trans=xen,', {[{@msize={'msize', 0x3d, 0xf6b3}}, {@debug={'debug', 0x3d, 0x7ff}}, {@posixacl}, {@aname={'aname', 0x3d, '*$-&'}}, {@uname={'uname', 0x3d, 'msdos\x00'}}], [{@seclabel}, {@euid_eq={'euid', 0x3d, r0}}, {@permit_directio}, {@appraise_type}]}}) r1 = syz_io_uring_setup(0x1d4a, &(0x7f0000000440)={0x0, 0xfa85, 0x0, 0x0, 0x285}, &(0x7f0000ffd000/0x1000)=nil, &(0x7f0000ffd000/0x2000)=nil, &(0x7f00000004c0)=0x0, &(0x7f0000000500)) syz_io_uring_setup(0x3e5e, &(0x7f0000000540)={0x0, 0x5c61, 0x8, 0x2, 0x72}, &(0x7f0000ffd000/0x3000)=nil, &(0x7f0000ffc000/0x3000)=nil, &(0x7f00000005c0), &(0x7f0000000600)=0x0) syz_io_uring_submit(r2, r3, &(0x7f0000000740)=@IORING_OP_READ=@pass_buffer={0x16, 0x1, 0x2004, @fd_index=0xa, 0x7, &(0x7f0000000640)=""/227, 0xe3, 0xc, 0x1}, 0x9) ioctl$SECCOMP_IOCTL_NOTIF_ADDFD(0xffffffffffffffff, 0x40182103, &(0x7f0000000780)={0x0, 0x4, r1, 0x9, 0x80000}) openat$cgroup_devices(0xffffffffffffffff, &(0x7f00000007c0)='devices.allow\x00', 0x2, 0x0) syz_mount_image$nfs4(&(0x7f0000000800), &(0x7f0000000840)='./file0/file0\x00', 0xffffffffffffff01, 0x1, &(0x7f0000000900)=[{&(0x7f0000000880)="f19bd7cfef39dd2070dcb194f7bd90ce305e2a9644b9fb91cc1e75bca69ed6bbdd7636452963af395ea61189cce718ef43420310b6ff8db9f4a606d67217b1aa7bf6e1435682323aef92ef40d036c48fa3fc363c6ad63229bb37cd76a6db9879a39f", 0x62, 0x6}], 0x8400, &(0x7f0000000940)={[{'*+\\['}]}) r4 = accept(0xffffffffffffffff, 0x0, &(0x7f0000000980)) sendmsg$MPTCP_PM_CMD_GET_LIMITS(r4, &(0x7f0000000ac0)={&(0x7f00000009c0)={0x10, 0x0, 0x0, 0x200}, 0xc, &(0x7f0000000a80)={&(0x7f0000000a00)={0x74, 0x0, 0x200, 0x70bd27, 0x25dfdbfd, {}, [@MPTCP_PM_ATTR_RCV_ADD_ADDRS={0x8, 0x2, 0x8}, @MPTCP_PM_ATTR_RCV_ADD_ADDRS={0x8, 0x2, 0x2}, @MPTCP_PM_ATTR_SUBFLOWS={0x8, 0x3, 0x6}, @MPTCP_PM_ATTR_ADDR={0x3c, 0x1, 0x0, 0x1, [@MPTCP_PM_ADDR_ATTR_PORT={0x6, 0x5, 0x4e20}, @MPTCP_PM_ADDR_ATTR_ID={0x5, 0x2, 0x5}, @MPTCP_PM_ADDR_ATTR_FLAGS={0x8, 0x6, 0x3}, @MPTCP_PM_ADDR_ATTR_PORT={0x6, 0x5, 0x4e23}, @MPTCP_PM_ADDR_ATTR_FAMILY={0x6}, @MPTCP_PM_ADDR_ATTR_FAMILY={0x6, 0x1, 0xa}, @MPTCP_PM_ADDR_ATTR_FAMILY={0x6, 0x1, 0xa}]}, @MPTCP_PM_ATTR_ADDR={0x4}, @MPTCP_PM_ATTR_SUBFLOWS={0x8}]}, 0x74}, 0x1, 0x0, 0x0, 0x11}, 0x80) mount$9p_rdma(&(0x7f0000001040), &(0x7f0000001080)='./file0\x00', &(0x7f00000010c0), 0xa00800, &(0x7f0000001100)={'trans=rdma,', {'port', 0x3d, 0x4e20}, 0x2c, {[{@common=@aname={'aname', 0x3d, 'permit_directio'}}, {@sq={'sq', 0x3d, 0xffff}}], [{@fscontext={'fscontext', 0x3d, 'staff_u'}}]}}) 11:41:33 executing program 5: getpeername$packet(0xffffffffffffffff, &(0x7f0000000000)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @dev}, &(0x7f0000000040)=0x14) ioctl$sock_SIOCADDRT(0xffffffffffffffff, 0x890b, &(0x7f0000000080)={0x0, @phonet={0x23, 0xfe, 0x0, 0x2f}, @hci={0x1f, 0xffffffffffffffff, 0x3}, @rc={0x1f, @any, 0x2}, 0x5, 0x0, 0x0, 0x0, 0x7ff, 0x0, 0x0, 0x4, 0x4}) r0 = mmap$IORING_OFF_SQES(&(0x7f0000ffa000/0x4000)=nil, 0x4000, 0x1000004, 0x810, 0xffffffffffffffff, 0x10000000) syz_io_uring_submit(0x0, r0, &(0x7f0000000100)=@IORING_OP_MADVISE={0x19, 0x3, 0x0, 0x0, 0x0, &(0x7f0000ffa000/0x2000)=nil, 0x2000, 0xb, 0x1}, 0x8) r1 = syz_genetlink_get_family_id$mptcp(&(0x7f0000000180), 0xffffffffffffffff) sendmsg$MPTCP_PM_CMD_ADD_ADDR(0xffffffffffffffff, &(0x7f0000000240)={&(0x7f0000000140)={0x10, 0x0, 0x0, 0x10000}, 0xc, &(0x7f0000000200)={&(0x7f00000001c0)={0x24, r1, 0x800, 0x70bd27, 0x25dfdbfd, {}, [@MPTCP_PM_ATTR_RCV_ADD_ADDRS={0x8, 0x2, 0x8}, @MPTCP_PM_ATTR_RCV_ADD_ADDRS={0x8, 0x2, 0x6}]}, 0x24}, 0x1, 0x0, 0x0, 0x2400c096}, 0x80) sendmsg$MPTCP_PM_CMD_FLUSH_ADDRS(0xffffffffffffffff, &(0x7f00000003c0)={&(0x7f0000000280)={0x10, 0x0, 0x0, 0x40}, 0xc, &(0x7f0000000380)={&(0x7f00000002c0)={0xa4, r1, 0x200, 0x70bd25, 0x25dfdbff, {}, [@MPTCP_PM_ATTR_RCV_ADD_ADDRS={0x8, 0x2, 0x3}, @MPTCP_PM_ATTR_ADDR={0x30, 0x1, 0x0, 0x1, [@MPTCP_PM_ADDR_ATTR_ADDR6={0x14, 0x4, @initdev={0xfe, 0x88, '\x00', 0x0, 0x0}}, @MPTCP_PM_ADDR_ATTR_ADDR4={0x8, 0x3, @local}, @MPTCP_PM_ADDR_ATTR_FLAGS={0x8, 0x6, 0x2}, @MPTCP_PM_ADDR_ATTR_FAMILY={0x6, 0x1, 0xa}]}, @MPTCP_PM_ATTR_ADDR={0x2c, 0x1, 0x0, 0x1, [@MPTCP_PM_ADDR_ATTR_ID={0x5, 0x2, 0x81}, @MPTCP_PM_ADDR_ATTR_PORT={0x6, 0x5, 0x4e22}, @MPTCP_PM_ADDR_ATTR_FAMILY={0x6, 0x1, 0xa}, @MPTCP_PM_ADDR_ATTR_FLAGS={0x8}, @MPTCP_PM_ADDR_ATTR_ID={0x5, 0x2, 0x40}]}, @MPTCP_PM_ATTR_SUBFLOWS={0x8, 0x3, 0x5}, @MPTCP_PM_ATTR_SUBFLOWS={0x8, 0x3, 0x5}, @MPTCP_PM_ATTR_ADDR={0x14, 0x1, 0x0, 0x1, [@MPTCP_PM_ADDR_ATTR_PORT={0x6, 0x5, 0x4e23}, @MPTCP_PM_ADDR_ATTR_PORT={0x6, 0x5, 0x4e21}]}, @MPTCP_PM_ATTR_SUBFLOWS={0x8, 0x3, 0x2}]}, 0xa4}, 0x1, 0x0, 0x0, 0x40}, 0x90) syz_open_dev$sg(&(0x7f0000000400), 0x4, 0x38040) r2 = openat$vcsa(0xffffffffffffff9c, &(0x7f0000000580), 0x121080, 0x0) setsockopt$inet6_tcp_TCP_QUEUE_SEQ(r2, 0x6, 0x15, &(0x7f0000000780)=0x400, 0x4) 11:41:33 executing program 2: clock_nanosleep(0x7, 0x0, &(0x7f0000000000)={0x77359400}, &(0x7f0000000040)) getsockopt$inet6_IPV6_XFRM_POLICY(0xffffffffffffffff, 0x29, 0x23, &(0x7f0000000080)={{{@in6, @in6=@remote, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, {{@in6=@dev}, 0x0, @in=@initdev}}, &(0x7f0000000180)=0xe8) setsockopt$packet_add_memb(0xffffffffffffffff, 0x107, 0x1, &(0x7f00000001c0)={r0, 0x1, 0x6, @broadcast}, 0x10) getpeername$packet(0xffffffffffffffff, &(0x7f0000000200)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @dev}, &(0x7f0000000240)=0x14) recvmsg(0xffffffffffffffff, &(0x7f00000027c0)={&(0x7f0000000280)=@xdp={0x2c, 0x0, 0x0}, 0x80, &(0x7f0000002640)=[{&(0x7f0000000300)=""/227, 0xe3}, {&(0x7f0000000400)=""/4096, 0x1000}, {&(0x7f0000001400)=""/92, 0x5c}, {&(0x7f0000001480)=""/93, 0x5d}, {&(0x7f0000001500)=""/4096, 0x1000}, {&(0x7f0000002500)=""/87, 0x57}, {&(0x7f0000002580)=""/189, 0xbd}], 0x7, &(0x7f00000026c0)=""/199, 0xc7}, 0x140) bind$packet(0xffffffffffffffff, &(0x7f0000002800)={0x11, 0x1b, r2, 0x1, 0x5}, 0x14) getresgid(&(0x7f0000002840), &(0x7f0000002880), &(0x7f00000028c0)) r3 = accept4$packet(0xffffffffffffffff, &(0x7f0000002900)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @multicast}, &(0x7f0000002940)=0x14, 0x80000) recvfrom$packet(r3, &(0x7f0000002980)=""/4096, 0x1000, 0x0, &(0x7f0000003980)={0x11, 0x17, r2, 0x1, 0x5, 0x6, @multicast}, 0x14) r4 = socket$inet6_udp(0xa, 0x2, 0x0) getsockopt$inet6_IPV6_XFRM_POLICY(r4, 0x29, 0x23, &(0x7f00000039c0)={{{@in6=@ipv4, @in6=@private0}}, {{@in=@private}, 0x0, @in6=@remote}}, &(0x7f0000003ac0)=0xe8) r5 = openat$sr(0xffffffffffffff9c, &(0x7f0000003b00), 0x200000, 0x0) recvfrom$packet(r5, &(0x7f0000003b40)=""/161, 0xa1, 0x140, &(0x7f0000003c00)={0x11, 0x2, r1, 0x1, 0x9a, 0x6, @local}, 0x14) openat$sr(0xffffffffffffff9c, &(0x7f0000005480), 0x428802, 0x0) 11:41:33 executing program 7: r0 = syz_open_dev$sg(&(0x7f0000000000), 0x1, 0x10000) ioctl$SG_GET_PACK_ID(r0, 0x227c, &(0x7f0000000040)) ioctl$SCSI_IOCTL_DOORLOCK(r0, 0x5380) ioctl$SG_SET_KEEP_ORPHAN(r0, 0x2287, &(0x7f0000000080)=0x7) ioctl$SCSI_IOCTL_BENCHMARK_COMMAND(r0, 0x3) openat$vcsa(0xffffffffffffff9c, &(0x7f0000000440), 0x10480, 0x0) [ 186.628735] loop6: detected capacity change from 0 to 1 [ 186.676294] loop6: detected capacity change from 0 to 264192 [ 186.692138] nfs4: Unknown parameter '*+\[' 11:41:33 executing program 0: syz_open_dev$sg(0x0, 0x8, 0x8100) 11:41:33 executing program 4: setsockopt$inet_tcp_TCP_QUEUE_SEQ(0xffffffffffffffff, 0x6, 0x15, &(0x7f0000000000), 0x4) r0 = openat$vcsa(0xffffffffffffff9c, &(0x7f0000000040), 0x81, 0x0) setsockopt$packet_tx_ring(r0, 0x107, 0xd, &(0x7f0000000080)=@req={0x4, 0xffffffff, 0xd5, 0x5}, 0x10) setsockopt$inet_tcp_TCP_REPAIR_WINDOW(r0, 0x6, 0x1d, &(0x7f00000000c0)={0xfffffff9, 0x1, 0x7fffffff, 0x6, 0x1}, 0x14) ioctl$SCSI_IOCTL_SYNC(r0, 0x4) r1 = accept(r0, &(0x7f0000000100)=@rc={0x1f, @fixed}, &(0x7f0000000180)=0x80) setsockopt$inet_tcp_TCP_FASTOPEN_KEY(r1, 0x6, 0x21, &(0x7f00000001c0)="2a6eddb47c1ebcb5002df4f95b6a3218", 0x10) socket$inet_tcp(0x2, 0x1, 0x0) syz_genetlink_get_family_id$netlbl_mgmt(&(0x7f0000000440), 0xffffffffffffffff) syz_genetlink_get_family_id$netlbl_mgmt(&(0x7f0000000740), 0xffffffffffffffff) [ 186.714870] SELinux: security_context_str_to_sid (staff_u) failed with errno=-22 11:41:33 executing program 7: r0 = syz_open_dev$sg(&(0x7f0000000000), 0x1, 0x10000) ioctl$SG_GET_PACK_ID(r0, 0x227c, &(0x7f0000000040)) ioctl$SCSI_IOCTL_DOORLOCK(r0, 0x5380) ioctl$SG_SET_KEEP_ORPHAN(r0, 0x2287, &(0x7f0000000080)=0x7) openat$vcsa(0xffffffffffffff9c, &(0x7f0000000440), 0x10480, 0x0) 11:41:33 executing program 6: ioprio_set$uid(0x0, 0xee01, 0x4004) syz_mount_image$msdos(&(0x7f0000000000), &(0x7f0000000040)='./file0\x00', 0x200, 0x1, &(0x7f00000000c0)=[{&(0x7f0000000080)="7c74c7bc99e778a0c971e6f50fbdd2b70fa0b038d18c7d5ac685833434d89dce684239293aa5d8b6f11bc5c4a033ad1dc68319fad36a1101aad751fd6f4f10", 0x3f, 0x7f}], 0x42000, &(0x7f0000000100)={[{@dots}], [{@obj_user}, {@dont_appraise}, {@uid_lt}, {@hash}, {@seclabel}]}) getsockopt$inet6_IPV6_XFRM_POLICY(0xffffffffffffffff, 0x29, 0x23, &(0x7f0000000240)={{{@in=@loopback, @in6=@empty, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, {{@in6=@local}, 0x0, @in6=@mcast1}}, &(0x7f0000000340)=0xe8) mount$9p_xen(&(0x7f0000000180), &(0x7f00000001c0)='./file0\x00', &(0x7f0000000200), 0x1121061, &(0x7f0000000380)={'trans=xen,', {[{@msize={'msize', 0x3d, 0xf6b3}}, {@debug={'debug', 0x3d, 0x7ff}}, {@posixacl}, {@aname={'aname', 0x3d, '*$-&'}}, {@uname={'uname', 0x3d, 'msdos\x00'}}], [{@seclabel}, {@euid_eq={'euid', 0x3d, r0}}, {@permit_directio}, {@appraise_type}]}}) r1 = syz_io_uring_setup(0x1d4a, &(0x7f0000000440)={0x0, 0xfa85, 0x0, 0x0, 0x285}, &(0x7f0000ffd000/0x1000)=nil, &(0x7f0000ffd000/0x2000)=nil, &(0x7f00000004c0)=0x0, &(0x7f0000000500)) syz_io_uring_setup(0x3e5e, &(0x7f0000000540)={0x0, 0x5c61, 0x8, 0x2, 0x72}, &(0x7f0000ffd000/0x3000)=nil, &(0x7f0000ffc000/0x3000)=nil, &(0x7f00000005c0), &(0x7f0000000600)=0x0) syz_io_uring_submit(r2, r3, &(0x7f0000000740)=@IORING_OP_READ=@pass_buffer={0x16, 0x1, 0x2004, @fd_index=0xa, 0x7, &(0x7f0000000640)=""/227, 0xe3, 0xc, 0x1}, 0x9) ioctl$SECCOMP_IOCTL_NOTIF_ADDFD(0xffffffffffffffff, 0x40182103, &(0x7f0000000780)={0x0, 0x4, r1, 0x9, 0x80000}) openat$cgroup_devices(0xffffffffffffffff, &(0x7f00000007c0)='devices.allow\x00', 0x2, 0x0) syz_mount_image$nfs4(&(0x7f0000000800), &(0x7f0000000840)='./file0/file0\x00', 0xffffffffffffff01, 0x1, &(0x7f0000000900)=[{&(0x7f0000000880)="f19bd7cfef39dd2070dcb194f7bd90ce305e2a9644b9fb91cc1e75bca69ed6bbdd7636452963af395ea61189cce718ef43420310b6ff8db9f4a606d67217b1aa7bf6e1435682323aef92ef40d036c48fa3fc363c6ad63229bb37cd76a6db9879a39f", 0x62, 0x6}], 0x8400, &(0x7f0000000940)={[{'*+\\['}]}) accept(0xffffffffffffffff, 0x0, &(0x7f0000000980)) mount$9p_rdma(&(0x7f0000001040), &(0x7f0000001080)='./file0\x00', &(0x7f00000010c0), 0xa00800, &(0x7f0000001100)={'trans=rdma,', {'port', 0x3d, 0x4e20}, 0x2c, {[{@common=@aname={'aname', 0x3d, 'permit_directio'}}, {@sq={'sq', 0x3d, 0xffff}}], [{@fscontext={'fscontext', 0x3d, 'staff_u'}}]}}) 11:41:33 executing program 3: ioctl$SG_SET_FORCE_PACK_ID(0xffffffffffffffff, 0x227b, &(0x7f0000000000)=0x1) ioctl$SG_SET_FORCE_PACK_ID(0xffffffffffffffff, 0x227b, &(0x7f0000000040)) ioctl$SG_GET_RESERVED_SIZE(0xffffffffffffffff, 0x2272, &(0x7f0000000080)) r0 = openat$vcsa(0xffffffffffffff9c, &(0x7f00000000c0), 0x4200, 0x0) ioctl$SCSI_IOCTL_SEND_COMMAND(r0, 0x1, &(0x7f0000000100)={0x17, 0x3, 0x1c00, "af36a59fb168d324fd8eaf833aeb82f60d75e8700d81d9"}) ioctl$SG_SET_TIMEOUT(r0, 0x2201, &(0x7f0000000140)=0x4) ioctl$SG_GET_VERSION_NUM(r0, 0x2282, &(0x7f0000000180)) ioctl$SG_GET_REQUEST_TABLE(r0, 0x2286, &(0x7f00000001c0)) ioctl$SG_GET_TIMEOUT(r0, 0x2202, 0x0) r1 = syz_open_dev$sg(&(0x7f0000000340), 0x7fff, 0x40) ioctl$SG_EMULATED_HOST(r1, 0x2203, &(0x7f0000000380)) r2 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$inet6_tcp_TCP_CONGESTION(r2, 0x6, 0xd, &(0x7f0000000440)='scalable\x00', 0x9) [ 186.883939] loop6: detected capacity change from 0 to 1 11:41:34 executing program 1: r0 = shmget(0x2, 0x3000, 0x100, &(0x7f0000ffb000/0x3000)=nil) shmat(r0, &(0x7f0000ffa000/0x3000)=nil, 0x2000) shmat(r0, &(0x7f0000ffa000/0x4000)=nil, 0x3000) shmget(0x3, 0x1000, 0x100, &(0x7f0000ffd000/0x1000)=nil) r1 = syz_genetlink_get_family_id$netlbl_mgmt(&(0x7f0000000040), 0xffffffffffffffff) sendmsg$NLBL_MGMT_C_REMOVEDEF(0xffffffffffffffff, &(0x7f0000000100)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x8}, 0xc, &(0x7f00000000c0)={&(0x7f0000000080)={0x3c, r1, 0x20, 0x70bd29, 0x25dfdbff, {}, [@NLBL_MGMT_A_FAMILY={0x6, 0xb, 0x5}, @NLBL_MGMT_A_PROTOCOL={0x8, 0x2, 0x3}, @NLBL_MGMT_A_IPV4MASK={0x8, 0x8, @multicast1}, @NLBL_MGMT_A_CLPDOI={0x8}, @NLBL_MGMT_A_IPV4ADDR={0x8, 0x7, @local}]}, 0x3c}, 0x1, 0x0, 0x0, 0x4048820}, 0x40000) shmat(0xffffffffffffffff, &(0x7f0000ffb000/0x4000)=nil, 0x2000) r2 = shmget(0x0, 0xf000, 0x100, &(0x7f0000ff1000/0xf000)=nil) shmctl$IPC_RMID(r2, 0x0) r3 = mmap$IORING_OFF_SQ_RING(&(0x7f0000ffd000/0x1000)=nil, 0x1000, 0x2000006, 0x40010, 0xffffffffffffffff, 0x0) syz_io_uring_submit(r3, 0x0, &(0x7f00000001c0)=@IORING_OP_PROVIDE_BUFFERS={0x1f, 0x1, 0x0, 0x8, 0x2, &(0x7f0000000140)="10e8e6d73f8e97a04564912d4b0bee6921be05ed083e4d741dabdbce8c94949f57a5c9d9da73d0e5ad668714159e31498f181aad79547c645eefb456a7b8c4be765eb156b77cba8a752b90d7729b2c285893a10c3633d2485f48f30d247214c5e28a", 0x7, 0x0, 0x1, {0x1}}, 0x100) r4 = socket(0x2c, 0x5, 0x1) recvfrom$packet(r4, &(0x7f0000000200)=""/108, 0x6c, 0x2000, &(0x7f0000000300)={0x11, 0x16, 0x0, 0x1, 0x8, 0x6, @local}, 0x14) io_uring_setup(0x14ab, &(0x7f0000000480)={0x0, 0x5191, 0x20, 0x1, 0x3ba}) shmget$private(0x0, 0x2000, 0x10, &(0x7f0000ffc000/0x2000)=nil) 11:41:34 executing program 0: syz_open_dev$sg(0x0, 0x8, 0x8100) 11:41:34 executing program 5: getpeername$packet(0xffffffffffffffff, &(0x7f0000000000)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @dev}, &(0x7f0000000040)=0x14) ioctl$sock_SIOCADDRT(0xffffffffffffffff, 0x890b, &(0x7f0000000080)={0x0, @phonet={0x23, 0xfe, 0x0, 0x2f}, @hci={0x1f, 0xffffffffffffffff, 0x3}, @rc={0x1f, @any, 0x2}, 0x5, 0x0, 0x0, 0x0, 0x7ff, 0x0, 0x0, 0x4, 0x4}) r0 = mmap$IORING_OFF_SQES(&(0x7f0000ffa000/0x4000)=nil, 0x4000, 0x1000004, 0x810, 0xffffffffffffffff, 0x10000000) syz_io_uring_submit(0x0, r0, &(0x7f0000000100)=@IORING_OP_MADVISE={0x19, 0x3, 0x0, 0x0, 0x0, &(0x7f0000ffa000/0x2000)=nil, 0x2000, 0xb, 0x1}, 0x8) r1 = syz_genetlink_get_family_id$mptcp(&(0x7f0000000180), 0xffffffffffffffff) sendmsg$MPTCP_PM_CMD_ADD_ADDR(0xffffffffffffffff, &(0x7f0000000240)={&(0x7f0000000140)={0x10, 0x0, 0x0, 0x10000}, 0xc, &(0x7f0000000200)={&(0x7f00000001c0)={0x24, r1, 0x800, 0x70bd27, 0x25dfdbfd, {}, [@MPTCP_PM_ATTR_RCV_ADD_ADDRS={0x8, 0x2, 0x8}, @MPTCP_PM_ATTR_RCV_ADD_ADDRS={0x8, 0x2, 0x6}]}, 0x24}, 0x1, 0x0, 0x0, 0x2400c096}, 0x80) sendmsg$MPTCP_PM_CMD_FLUSH_ADDRS(0xffffffffffffffff, &(0x7f00000003c0)={&(0x7f0000000280)={0x10, 0x0, 0x0, 0x40}, 0xc, &(0x7f0000000380)={&(0x7f00000002c0)={0xa4, r1, 0x200, 0x70bd25, 0x25dfdbff, {}, [@MPTCP_PM_ATTR_RCV_ADD_ADDRS={0x8, 0x2, 0x3}, @MPTCP_PM_ATTR_ADDR={0x30, 0x1, 0x0, 0x1, [@MPTCP_PM_ADDR_ATTR_ADDR6={0x14, 0x4, @initdev={0xfe, 0x88, '\x00', 0x0, 0x0}}, @MPTCP_PM_ADDR_ATTR_ADDR4={0x8, 0x3, @local}, @MPTCP_PM_ADDR_ATTR_FLAGS={0x8, 0x6, 0x2}, @MPTCP_PM_ADDR_ATTR_FAMILY={0x6, 0x1, 0xa}]}, @MPTCP_PM_ATTR_ADDR={0x2c, 0x1, 0x0, 0x1, [@MPTCP_PM_ADDR_ATTR_ID={0x5, 0x2, 0x81}, @MPTCP_PM_ADDR_ATTR_PORT={0x6, 0x5, 0x4e22}, @MPTCP_PM_ADDR_ATTR_FAMILY={0x6, 0x1, 0xa}, @MPTCP_PM_ADDR_ATTR_FLAGS={0x8}, @MPTCP_PM_ADDR_ATTR_ID={0x5, 0x2, 0x40}]}, @MPTCP_PM_ATTR_SUBFLOWS={0x8, 0x3, 0x5}, @MPTCP_PM_ATTR_SUBFLOWS={0x8, 0x3, 0x5}, @MPTCP_PM_ATTR_ADDR={0x14, 0x1, 0x0, 0x1, [@MPTCP_PM_ADDR_ATTR_PORT={0x6, 0x5, 0x4e23}, @MPTCP_PM_ADDR_ATTR_PORT={0x6, 0x5, 0x4e21}]}, @MPTCP_PM_ATTR_SUBFLOWS={0x8, 0x3, 0x2}]}, 0xa4}, 0x1, 0x0, 0x0, 0x40}, 0x90) r2 = openat$vcsa(0xffffffffffffff9c, &(0x7f0000000580), 0x121080, 0x0) setsockopt$inet6_tcp_TCP_QUEUE_SEQ(r2, 0x6, 0x15, &(0x7f0000000780)=0x400, 0x4) 11:41:34 executing program 7: r0 = syz_open_dev$sg(&(0x7f0000000000), 0x1, 0x10000) ioctl$SG_GET_PACK_ID(r0, 0x227c, &(0x7f0000000040)) ioctl$SCSI_IOCTL_DOORLOCK(r0, 0x5380) openat$vcsa(0xffffffffffffff9c, &(0x7f0000000440), 0x10480, 0x0) [ 186.923957] SELinux: security_context_str_to_sid (staff_u) failed with errno=-22 11:41:34 executing program 4: setsockopt$inet_tcp_TCP_QUEUE_SEQ(0xffffffffffffffff, 0x6, 0x15, &(0x7f0000000000), 0x4) r0 = openat$vcsa(0xffffffffffffff9c, &(0x7f0000000040), 0x81, 0x0) setsockopt$packet_tx_ring(r0, 0x107, 0xd, &(0x7f0000000080)=@req={0x4, 0xffffffff, 0xd5, 0x5}, 0x10) setsockopt$inet_tcp_TCP_REPAIR_WINDOW(r0, 0x6, 0x1d, &(0x7f00000000c0)={0xfffffff9, 0x1, 0x7fffffff, 0x6, 0x1}, 0x14) ioctl$SCSI_IOCTL_SYNC(r0, 0x4) r1 = accept(r0, &(0x7f0000000100)=@rc={0x1f, @fixed}, &(0x7f0000000180)=0x80) setsockopt$inet_tcp_TCP_FASTOPEN_KEY(r1, 0x6, 0x21, &(0x7f00000001c0)="2a6eddb47c1ebcb5002df4f95b6a3218", 0x10) syz_genetlink_get_family_id$netlbl_mgmt(&(0x7f0000000440), 0xffffffffffffffff) syz_genetlink_get_family_id$netlbl_mgmt(&(0x7f0000000740), 0xffffffffffffffff) 11:41:34 executing program 6: ioprio_set$uid(0x0, 0xee01, 0x4004) syz_mount_image$msdos(&(0x7f0000000000), &(0x7f0000000040)='./file0\x00', 0x200, 0x1, &(0x7f00000000c0)=[{&(0x7f0000000080)="7c74c7bc99e778a0c971e6f50fbdd2b70fa0b038d18c7d5ac685833434d89dce684239293aa5d8b6f11bc5c4a033ad1dc68319fad36a1101aad751fd6f4f10", 0x3f, 0x7f}], 0x42000, &(0x7f0000000100)={[{@dots}], [{@obj_user}, {@dont_appraise}, {@uid_lt}, {@hash}, {@seclabel}]}) getsockopt$inet6_IPV6_XFRM_POLICY(0xffffffffffffffff, 0x29, 0x23, &(0x7f0000000240)={{{@in=@loopback, @in6=@empty, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, {{@in6=@local}, 0x0, @in6=@mcast1}}, &(0x7f0000000340)=0xe8) mount$9p_xen(&(0x7f0000000180), &(0x7f00000001c0)='./file0\x00', &(0x7f0000000200), 0x1121061, &(0x7f0000000380)={'trans=xen,', {[{@msize={'msize', 0x3d, 0xf6b3}}, {@debug={'debug', 0x3d, 0x7ff}}, {@posixacl}, {@aname={'aname', 0x3d, '*$-&'}}, {@uname={'uname', 0x3d, 'msdos\x00'}}], [{@seclabel}, {@euid_eq={'euid', 0x3d, r0}}, {@permit_directio}, {@appraise_type}]}}) r1 = syz_io_uring_setup(0x1d4a, &(0x7f0000000440)={0x0, 0xfa85, 0x0, 0x0, 0x285}, &(0x7f0000ffd000/0x1000)=nil, &(0x7f0000ffd000/0x2000)=nil, &(0x7f00000004c0)=0x0, &(0x7f0000000500)) syz_io_uring_setup(0x3e5e, &(0x7f0000000540)={0x0, 0x5c61, 0x8, 0x2, 0x72}, &(0x7f0000ffd000/0x3000)=nil, &(0x7f0000ffc000/0x3000)=nil, &(0x7f00000005c0), &(0x7f0000000600)=0x0) syz_io_uring_submit(r2, r3, &(0x7f0000000740)=@IORING_OP_READ=@pass_buffer={0x16, 0x1, 0x2004, @fd_index=0xa, 0x7, &(0x7f0000000640)=""/227, 0xe3, 0xc, 0x1}, 0x9) ioctl$SECCOMP_IOCTL_NOTIF_ADDFD(0xffffffffffffffff, 0x40182103, &(0x7f0000000780)={0x0, 0x4, r1, 0x9, 0x80000}) openat$cgroup_devices(0xffffffffffffffff, &(0x7f00000007c0)='devices.allow\x00', 0x2, 0x0) syz_mount_image$nfs4(&(0x7f0000000800), &(0x7f0000000840)='./file0/file0\x00', 0xffffffffffffff01, 0x1, &(0x7f0000000900)=[{&(0x7f0000000880)="f19bd7cfef39dd2070dcb194f7bd90ce305e2a9644b9fb91cc1e75bca69ed6bbdd7636452963af395ea61189cce718ef43420310b6ff8db9f4a606d67217b1aa7bf6e1435682323aef92ef40d036c48fa3fc363c6ad63229bb37cd76a6db9879a39f", 0x62, 0x6}], 0x8400, &(0x7f0000000940)={[{'*+\\['}]}) accept(0xffffffffffffffff, 0x0, &(0x7f0000000980)) mount$9p_rdma(&(0x7f0000001040), &(0x7f0000001080)='./file0\x00', &(0x7f00000010c0), 0xa00800, &(0x7f0000001100)={'trans=rdma,', {'port', 0x3d, 0x4e20}, 0x2c, {[{@common=@aname={'aname', 0x3d, 'permit_directio'}}, {@sq={'sq', 0x3d, 0xffff}}], [{@fscontext={'fscontext', 0x3d, 'staff_u'}}]}}) 11:41:34 executing program 0: syz_open_dev$sg(&(0x7f0000000540), 0x0, 0x8100) [ 187.114729] loop6: detected capacity change from 0 to 1 [ 187.142653] SELinux: security_context_str_to_sid (staff_u) failed with errno=-22 11:41:34 executing program 3: ioctl$SG_SET_FORCE_PACK_ID(0xffffffffffffffff, 0x227b, &(0x7f0000000000)=0x1) ioctl$SG_SET_FORCE_PACK_ID(0xffffffffffffffff, 0x227b, &(0x7f0000000040)) ioctl$SG_GET_RESERVED_SIZE(0xffffffffffffffff, 0x2272, &(0x7f0000000080)) r0 = openat$vcsa(0xffffffffffffff9c, &(0x7f00000000c0), 0x4200, 0x0) ioctl$SCSI_IOCTL_SEND_COMMAND(r0, 0x1, &(0x7f0000000100)={0x17, 0x3, 0x1c00, "af36a59fb168d324fd8eaf833aeb82f60d75e8700d81d9"}) ioctl$SG_SET_TIMEOUT(r0, 0x2201, &(0x7f0000000140)=0x4) ioctl$SG_GET_VERSION_NUM(r0, 0x2282, &(0x7f0000000180)) ioctl$SG_GET_REQUEST_TABLE(r0, 0x2286, &(0x7f00000001c0)) ioctl$SG_GET_TIMEOUT(r0, 0x2202, 0x0) syz_open_dev$sg(&(0x7f0000000340), 0x7fff, 0x40) r1 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$inet6_tcp_TCP_CONGESTION(r1, 0x6, 0xd, &(0x7f0000000440)='scalable\x00', 0x9) 11:41:34 executing program 7: r0 = syz_open_dev$sg(&(0x7f0000000000), 0x1, 0x10000) ioctl$SG_GET_PACK_ID(r0, 0x227c, &(0x7f0000000040)) openat$vcsa(0xffffffffffffff9c, &(0x7f0000000440), 0x10480, 0x0) [ 188.003392] Bluetooth: hci2: command 0x0406 tx timeout [ 188.004256] Bluetooth: hci4: command 0x0406 tx timeout [ 188.006738] Bluetooth: hci3: command 0x0406 tx timeout [ 188.007653] Bluetooth: hci0: command 0x0406 tx timeout [ 188.008540] Bluetooth: hci5: command 0x0406 tx timeout [ 188.010384] Bluetooth: hci1: command 0x0406 tx timeout [ 188.011192] Bluetooth: hci7: command 0x0406 tx timeout [ 188.012057] Bluetooth: hci6: command 0x0406 tx timeout 11:41:42 executing program 0: syz_open_dev$sg(&(0x7f0000000540), 0x0, 0x8100) 11:41:42 executing program 4: setsockopt$inet_tcp_TCP_QUEUE_SEQ(0xffffffffffffffff, 0x6, 0x15, &(0x7f0000000000), 0x4) r0 = openat$vcsa(0xffffffffffffff9c, &(0x7f0000000040), 0x81, 0x0) setsockopt$packet_tx_ring(r0, 0x107, 0xd, &(0x7f0000000080)=@req={0x4, 0xffffffff, 0xd5, 0x5}, 0x10) setsockopt$inet_tcp_TCP_REPAIR_WINDOW(r0, 0x6, 0x1d, &(0x7f00000000c0)={0xfffffff9, 0x1, 0x7fffffff, 0x6, 0x1}, 0x14) ioctl$SCSI_IOCTL_SYNC(r0, 0x4) r1 = accept(r0, &(0x7f0000000100)=@rc={0x1f, @fixed}, &(0x7f0000000180)=0x80) setsockopt$inet_tcp_TCP_FASTOPEN_KEY(r1, 0x6, 0x21, &(0x7f00000001c0)="2a6eddb47c1ebcb5002df4f95b6a3218", 0x10) syz_genetlink_get_family_id$netlbl_mgmt(&(0x7f0000000440), 0xffffffffffffffff) syz_genetlink_get_family_id$netlbl_mgmt(&(0x7f0000000740), 0xffffffffffffffff) 11:41:42 executing program 5: getpeername$packet(0xffffffffffffffff, &(0x7f0000000000)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @dev}, &(0x7f0000000040)=0x14) ioctl$sock_SIOCADDRT(0xffffffffffffffff, 0x890b, &(0x7f0000000080)={0x0, @phonet={0x23, 0xfe, 0x0, 0x2f}, @hci={0x1f, 0xffffffffffffffff, 0x3}, @rc={0x1f, @any, 0x2}, 0x5, 0x0, 0x0, 0x0, 0x7ff, 0x0, 0x0, 0x4, 0x4}) r0 = mmap$IORING_OFF_SQES(&(0x7f0000ffa000/0x4000)=nil, 0x4000, 0x1000004, 0x810, 0xffffffffffffffff, 0x10000000) syz_io_uring_submit(0x0, r0, &(0x7f0000000100)=@IORING_OP_MADVISE={0x19, 0x3, 0x0, 0x0, 0x0, &(0x7f0000ffa000/0x2000)=nil, 0x2000, 0xb, 0x1}, 0x8) r1 = syz_genetlink_get_family_id$mptcp(&(0x7f0000000180), 0xffffffffffffffff) sendmsg$MPTCP_PM_CMD_ADD_ADDR(0xffffffffffffffff, &(0x7f0000000240)={&(0x7f0000000140)={0x10, 0x0, 0x0, 0x10000}, 0xc, &(0x7f0000000200)={&(0x7f00000001c0)={0x24, r1, 0x800, 0x70bd27, 0x25dfdbfd, {}, [@MPTCP_PM_ATTR_RCV_ADD_ADDRS={0x8, 0x2, 0x8}, @MPTCP_PM_ATTR_RCV_ADD_ADDRS={0x8, 0x2, 0x6}]}, 0x24}, 0x1, 0x0, 0x0, 0x2400c096}, 0x80) r2 = openat$vcsa(0xffffffffffffff9c, &(0x7f0000000580), 0x121080, 0x0) setsockopt$inet6_tcp_TCP_QUEUE_SEQ(r2, 0x6, 0x15, &(0x7f0000000780)=0x400, 0x4) 11:41:42 executing program 2: clock_nanosleep(0x7, 0x0, &(0x7f0000000000)={0x77359400}, &(0x7f0000000040)) getsockopt$inet6_IPV6_XFRM_POLICY(0xffffffffffffffff, 0x29, 0x23, &(0x7f0000000080)={{{@in6, @in6=@remote, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, {{@in6=@dev}, 0x0, @in=@initdev}}, &(0x7f0000000180)=0xe8) setsockopt$packet_add_memb(0xffffffffffffffff, 0x107, 0x1, &(0x7f00000001c0)={r0, 0x1, 0x6, @broadcast}, 0x10) getpeername$packet(0xffffffffffffffff, &(0x7f0000000200)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @dev}, &(0x7f0000000240)=0x14) recvmsg(0xffffffffffffffff, &(0x7f00000027c0)={&(0x7f0000000280)=@xdp={0x2c, 0x0, 0x0}, 0x80, &(0x7f0000002640)=[{&(0x7f0000000300)=""/227, 0xe3}, {&(0x7f0000000400)=""/4096, 0x1000}, {&(0x7f0000001400)=""/92, 0x5c}, {&(0x7f0000001480)=""/93, 0x5d}, {&(0x7f0000001500)=""/4096, 0x1000}, {&(0x7f0000002500)=""/87, 0x57}, {&(0x7f0000002580)=""/189, 0xbd}], 0x7, &(0x7f00000026c0)=""/199, 0xc7}, 0x140) bind$packet(0xffffffffffffffff, &(0x7f0000002800)={0x11, 0x1b, r1, 0x1, 0x5}, 0x14) getresgid(&(0x7f0000002840), &(0x7f0000002880), &(0x7f00000028c0)) r2 = accept4$packet(0xffffffffffffffff, &(0x7f0000002900)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @multicast}, &(0x7f0000002940)=0x14, 0x80000) recvfrom$packet(r2, &(0x7f0000002980)=""/4096, 0x1000, 0x0, &(0x7f0000003980)={0x11, 0x17, r1, 0x1, 0x5, 0x6, @multicast}, 0x14) r3 = socket$inet6_udp(0xa, 0x2, 0x0) getsockopt$inet6_IPV6_XFRM_POLICY(r3, 0x29, 0x23, &(0x7f00000039c0)={{{@in6=@ipv4, @in6=@private0}}, {{@in=@private}, 0x0, @in6=@remote}}, &(0x7f0000003ac0)=0xe8) openat$sr(0xffffffffffffff9c, &(0x7f0000003b00), 0x200000, 0x0) openat$sr(0xffffffffffffff9c, &(0x7f0000005480), 0x428802, 0x0) 11:41:42 executing program 3: ioctl$SG_SET_FORCE_PACK_ID(0xffffffffffffffff, 0x227b, &(0x7f0000000000)=0x1) ioctl$SG_SET_FORCE_PACK_ID(0xffffffffffffffff, 0x227b, &(0x7f0000000040)) ioctl$SG_GET_RESERVED_SIZE(0xffffffffffffffff, 0x2272, &(0x7f0000000080)) r0 = openat$vcsa(0xffffffffffffff9c, &(0x7f00000000c0), 0x4200, 0x0) ioctl$SCSI_IOCTL_SEND_COMMAND(r0, 0x1, &(0x7f0000000100)={0x17, 0x3, 0x1c00, "af36a59fb168d324fd8eaf833aeb82f60d75e8700d81d9"}) ioctl$SG_SET_TIMEOUT(r0, 0x2201, &(0x7f0000000140)=0x4) ioctl$SG_GET_VERSION_NUM(r0, 0x2282, &(0x7f0000000180)) ioctl$SG_GET_REQUEST_TABLE(r0, 0x2286, &(0x7f00000001c0)) ioctl$SG_GET_TIMEOUT(r0, 0x2202, 0x0) syz_open_dev$sg(&(0x7f0000000340), 0x7fff, 0x40) r1 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$inet6_tcp_TCP_CONGESTION(r1, 0x6, 0xd, &(0x7f0000000440)='scalable\x00', 0x9) 11:41:42 executing program 7: syz_open_dev$sg(&(0x7f0000000000), 0x1, 0x10000) openat$vcsa(0xffffffffffffff9c, &(0x7f0000000440), 0x10480, 0x0) 11:41:42 executing program 6: ioprio_set$uid(0x0, 0xee01, 0x4004) syz_mount_image$msdos(&(0x7f0000000000), &(0x7f0000000040)='./file0\x00', 0x200, 0x1, &(0x7f00000000c0)=[{&(0x7f0000000080)="7c74c7bc99e778a0c971e6f50fbdd2b70fa0b038d18c7d5ac685833434d89dce684239293aa5d8b6f11bc5c4a033ad1dc68319fad36a1101aad751fd6f4f10", 0x3f, 0x7f}], 0x42000, &(0x7f0000000100)={[{@dots}], [{@obj_user}, {@dont_appraise}, {@uid_lt}, {@hash}, {@seclabel}]}) getsockopt$inet6_IPV6_XFRM_POLICY(0xffffffffffffffff, 0x29, 0x23, &(0x7f0000000240)={{{@in=@loopback, @in6=@empty, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, {{@in6=@local}, 0x0, @in6=@mcast1}}, &(0x7f0000000340)=0xe8) mount$9p_xen(&(0x7f0000000180), &(0x7f00000001c0)='./file0\x00', &(0x7f0000000200), 0x1121061, &(0x7f0000000380)={'trans=xen,', {[{@msize={'msize', 0x3d, 0xf6b3}}, {@debug={'debug', 0x3d, 0x7ff}}, {@posixacl}, {@aname={'aname', 0x3d, '*$-&'}}, {@uname={'uname', 0x3d, 'msdos\x00'}}], [{@seclabel}, {@euid_eq={'euid', 0x3d, r0}}, {@permit_directio}, {@appraise_type}]}}) r1 = syz_io_uring_setup(0x1d4a, &(0x7f0000000440)={0x0, 0xfa85, 0x0, 0x0, 0x285}, &(0x7f0000ffd000/0x1000)=nil, &(0x7f0000ffd000/0x2000)=nil, &(0x7f00000004c0)=0x0, &(0x7f0000000500)) syz_io_uring_setup(0x3e5e, &(0x7f0000000540)={0x0, 0x5c61, 0x8, 0x2, 0x72}, &(0x7f0000ffd000/0x3000)=nil, &(0x7f0000ffc000/0x3000)=nil, &(0x7f00000005c0), &(0x7f0000000600)=0x0) syz_io_uring_submit(r2, r3, &(0x7f0000000740)=@IORING_OP_READ=@pass_buffer={0x16, 0x1, 0x2004, @fd_index=0xa, 0x7, &(0x7f0000000640)=""/227, 0xe3, 0xc, 0x1}, 0x9) ioctl$SECCOMP_IOCTL_NOTIF_ADDFD(0xffffffffffffffff, 0x40182103, &(0x7f0000000780)={0x0, 0x4, r1, 0x9, 0x80000}) openat$cgroup_devices(0xffffffffffffffff, &(0x7f00000007c0)='devices.allow\x00', 0x2, 0x0) syz_mount_image$nfs4(&(0x7f0000000800), &(0x7f0000000840)='./file0/file0\x00', 0xffffffffffffff01, 0x1, &(0x7f0000000900)=[{&(0x7f0000000880)="f19bd7cfef39dd2070dcb194f7bd90ce305e2a9644b9fb91cc1e75bca69ed6bbdd7636452963af395ea61189cce718ef43420310b6ff8db9f4a606d67217b1aa7bf6e1435682323aef92ef40d036c48fa3fc363c6ad63229bb37cd76a6db9879a39f", 0x62, 0x6}], 0x8400, &(0x7f0000000940)={[{'*+\\['}]}) accept(0xffffffffffffffff, 0x0, &(0x7f0000000980)) mount$9p_rdma(&(0x7f0000001040), &(0x7f0000001080)='./file0\x00', &(0x7f00000010c0), 0xa00800, &(0x7f0000001100)={'trans=rdma,', {'port', 0x3d, 0x4e20}, 0x2c, {[{@common=@aname={'aname', 0x3d, 'permit_directio'}}, {@sq={'sq', 0x3d, 0xffff}}], [{@fscontext={'fscontext', 0x3d, 'staff_u'}}]}}) 11:41:42 executing program 1: r0 = shmget(0x2, 0x3000, 0x100, &(0x7f0000ffb000/0x3000)=nil) shmat(r0, &(0x7f0000ffa000/0x3000)=nil, 0x2000) shmat(r0, &(0x7f0000ffa000/0x4000)=nil, 0x3000) shmget(0x3, 0x1000, 0x100, &(0x7f0000ffd000/0x1000)=nil) r1 = syz_genetlink_get_family_id$netlbl_mgmt(&(0x7f0000000040), 0xffffffffffffffff) sendmsg$NLBL_MGMT_C_REMOVEDEF(0xffffffffffffffff, &(0x7f0000000100)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x8}, 0xc, &(0x7f00000000c0)={&(0x7f0000000080)={0x3c, r1, 0x20, 0x70bd29, 0x25dfdbff, {}, [@NLBL_MGMT_A_FAMILY={0x6, 0xb, 0x5}, @NLBL_MGMT_A_PROTOCOL={0x8, 0x2, 0x3}, @NLBL_MGMT_A_IPV4MASK={0x8, 0x8, @multicast1}, @NLBL_MGMT_A_CLPDOI={0x8}, @NLBL_MGMT_A_IPV4ADDR={0x8, 0x7, @local}]}, 0x3c}, 0x1, 0x0, 0x0, 0x4048820}, 0x40000) shmat(0xffffffffffffffff, &(0x7f0000ffb000/0x4000)=nil, 0x2000) r2 = shmget(0x0, 0xf000, 0x100, &(0x7f0000ff1000/0xf000)=nil) shmctl$IPC_RMID(r2, 0x0) r3 = mmap$IORING_OFF_SQ_RING(&(0x7f0000ffd000/0x1000)=nil, 0x1000, 0x2000006, 0x40010, 0xffffffffffffffff, 0x0) syz_io_uring_submit(r3, 0x0, &(0x7f00000001c0)=@IORING_OP_PROVIDE_BUFFERS={0x1f, 0x1, 0x0, 0x8, 0x2, &(0x7f0000000140)="10e8e6d73f8e97a04564912d4b0bee6921be05ed083e4d741dabdbce8c94949f57a5c9d9da73d0e5ad668714159e31498f181aad79547c645eefb456a7b8c4be765eb156b77cba8a752b90d7729b2c285893a10c3633d2485f48f30d247214c5e28a", 0x7, 0x0, 0x1, {0x1}}, 0x100) recvfrom$packet(0xffffffffffffffff, &(0x7f0000000200)=""/108, 0x6c, 0x2000, &(0x7f0000000300)={0x11, 0x16, 0x0, 0x1, 0x8, 0x6, @local}, 0x14) io_uring_setup(0x14ab, &(0x7f0000000480)={0x0, 0x5191, 0x20, 0x1, 0x3ba}) shmget$private(0x0, 0x2000, 0x10, &(0x7f0000ffc000/0x2000)=nil) [ 195.872463] loop6: detected capacity change from 0 to 1 [ 195.901397] loop6: detected capacity change from 0 to 264192 [ 195.906132] nfs4: Unknown parameter '*+\[' 11:41:43 executing program 0: syz_open_dev$sg(&(0x7f0000000540), 0x0, 0x8100) [ 195.913908] SELinux: security_context_str_to_sid (staff_u) failed with errno=-22 11:41:51 executing program 1: r0 = shmget(0x2, 0x3000, 0x100, &(0x7f0000ffb000/0x3000)=nil) shmat(r0, &(0x7f0000ffa000/0x3000)=nil, 0x2000) shmat(r0, &(0x7f0000ffa000/0x4000)=nil, 0x3000) shmget(0x3, 0x1000, 0x100, &(0x7f0000ffd000/0x1000)=nil) r1 = syz_genetlink_get_family_id$netlbl_mgmt(&(0x7f0000000040), 0xffffffffffffffff) sendmsg$NLBL_MGMT_C_REMOVEDEF(0xffffffffffffffff, &(0x7f0000000100)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x8}, 0xc, &(0x7f00000000c0)={&(0x7f0000000080)={0x3c, r1, 0x20, 0x70bd29, 0x25dfdbff, {}, [@NLBL_MGMT_A_FAMILY={0x6, 0xb, 0x5}, @NLBL_MGMT_A_PROTOCOL={0x8, 0x2, 0x3}, @NLBL_MGMT_A_IPV4MASK={0x8, 0x8, @multicast1}, @NLBL_MGMT_A_CLPDOI={0x8}, @NLBL_MGMT_A_IPV4ADDR={0x8, 0x7, @local}]}, 0x3c}, 0x1, 0x0, 0x0, 0x4048820}, 0x40000) shmat(0xffffffffffffffff, &(0x7f0000ffb000/0x4000)=nil, 0x2000) r2 = shmget(0x0, 0xf000, 0x100, &(0x7f0000ff1000/0xf000)=nil) shmctl$IPC_RMID(r2, 0x0) mmap$IORING_OFF_SQ_RING(&(0x7f0000ffd000/0x1000)=nil, 0x1000, 0x2000006, 0x40010, 0xffffffffffffffff, 0x0) recvfrom$packet(0xffffffffffffffff, &(0x7f0000000200)=""/108, 0x6c, 0x2000, &(0x7f0000000300)={0x11, 0x16, 0x0, 0x1, 0x8, 0x6, @local}, 0x14) io_uring_setup(0x14ab, &(0x7f0000000480)={0x0, 0x5191, 0x20, 0x1, 0x3ba}) shmget$private(0x0, 0x2000, 0x10, &(0x7f0000ffc000/0x2000)=nil) 11:41:51 executing program 7: openat$vcsa(0xffffffffffffff9c, &(0x7f0000000440), 0x10480, 0x0) 11:41:51 executing program 3: ioctl$SG_SET_FORCE_PACK_ID(0xffffffffffffffff, 0x227b, &(0x7f0000000000)=0x1) ioctl$SG_SET_FORCE_PACK_ID(0xffffffffffffffff, 0x227b, &(0x7f0000000040)) ioctl$SG_GET_RESERVED_SIZE(0xffffffffffffffff, 0x2272, &(0x7f0000000080)) r0 = openat$vcsa(0xffffffffffffff9c, &(0x7f00000000c0), 0x4200, 0x0) ioctl$SCSI_IOCTL_SEND_COMMAND(r0, 0x1, &(0x7f0000000100)={0x17, 0x3, 0x1c00, "af36a59fb168d324fd8eaf833aeb82f60d75e8700d81d9"}) ioctl$SG_SET_TIMEOUT(r0, 0x2201, &(0x7f0000000140)=0x4) ioctl$SG_GET_VERSION_NUM(r0, 0x2282, &(0x7f0000000180)) ioctl$SG_GET_REQUEST_TABLE(r0, 0x2286, &(0x7f00000001c0)) ioctl$SG_GET_TIMEOUT(r0, 0x2202, 0x0) syz_open_dev$sg(&(0x7f0000000340), 0x7fff, 0x40) r1 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$inet6_tcp_TCP_CONGESTION(r1, 0x6, 0xd, &(0x7f0000000440)='scalable\x00', 0x9) 11:41:51 executing program 4: setsockopt$inet_tcp_TCP_QUEUE_SEQ(0xffffffffffffffff, 0x6, 0x15, &(0x7f0000000000), 0x4) r0 = openat$vcsa(0xffffffffffffff9c, &(0x7f0000000040), 0x81, 0x0) setsockopt$packet_tx_ring(r0, 0x107, 0xd, &(0x7f0000000080)=@req={0x4, 0xffffffff, 0xd5, 0x5}, 0x10) setsockopt$inet_tcp_TCP_REPAIR_WINDOW(r0, 0x6, 0x1d, &(0x7f00000000c0)={0xfffffff9, 0x1, 0x7fffffff, 0x6, 0x1}, 0x14) ioctl$SCSI_IOCTL_SYNC(r0, 0x4) r1 = accept(r0, &(0x7f0000000100)=@rc={0x1f, @fixed}, &(0x7f0000000180)=0x80) setsockopt$inet_tcp_TCP_FASTOPEN_KEY(r1, 0x6, 0x21, &(0x7f00000001c0)="2a6eddb47c1ebcb5002df4f95b6a3218", 0x10) syz_genetlink_get_family_id$netlbl_mgmt(&(0x7f0000000440), 0xffffffffffffffff) syz_genetlink_get_family_id$netlbl_mgmt(&(0x7f0000000740), 0xffffffffffffffff) 11:41:51 executing program 5: getpeername$packet(0xffffffffffffffff, &(0x7f0000000000)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @dev}, &(0x7f0000000040)=0x14) ioctl$sock_SIOCADDRT(0xffffffffffffffff, 0x890b, &(0x7f0000000080)={0x0, @phonet={0x23, 0xfe, 0x0, 0x2f}, @hci={0x1f, 0xffffffffffffffff, 0x3}, @rc={0x1f, @any, 0x2}, 0x5, 0x0, 0x0, 0x0, 0x7ff, 0x0, 0x0, 0x4, 0x4}) r0 = mmap$IORING_OFF_SQES(&(0x7f0000ffa000/0x4000)=nil, 0x4000, 0x1000004, 0x810, 0xffffffffffffffff, 0x10000000) syz_io_uring_submit(0x0, r0, &(0x7f0000000100)=@IORING_OP_MADVISE={0x19, 0x3, 0x0, 0x0, 0x0, &(0x7f0000ffa000/0x2000)=nil, 0x2000, 0xb, 0x1}, 0x8) syz_genetlink_get_family_id$mptcp(&(0x7f0000000180), 0xffffffffffffffff) r1 = openat$vcsa(0xffffffffffffff9c, &(0x7f0000000580), 0x121080, 0x0) setsockopt$inet6_tcp_TCP_QUEUE_SEQ(r1, 0x6, 0x15, &(0x7f0000000780)=0x400, 0x4) 11:41:51 executing program 0: syz_open_dev$sg(&(0x7f0000000540), 0x8, 0x0) 11:41:51 executing program 6: ioprio_set$uid(0x0, 0xee01, 0x4004) syz_mount_image$msdos(&(0x7f0000000000), &(0x7f0000000040)='./file0\x00', 0x200, 0x1, &(0x7f00000000c0)=[{&(0x7f0000000080)="7c74c7bc99e778a0c971e6f50fbdd2b70fa0b038d18c7d5ac685833434d89dce684239293aa5d8b6f11bc5c4a033ad1dc68319fad36a1101aad751fd6f4f10", 0x3f, 0x7f}], 0x42000, &(0x7f0000000100)={[{@dots}], [{@obj_user}, {@dont_appraise}, {@uid_lt}, {@hash}, {@seclabel}]}) getsockopt$inet6_IPV6_XFRM_POLICY(0xffffffffffffffff, 0x29, 0x23, &(0x7f0000000240)={{{@in=@loopback, @in6=@empty, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, {{@in6=@local}, 0x0, @in6=@mcast1}}, &(0x7f0000000340)=0xe8) mount$9p_xen(&(0x7f0000000180), &(0x7f00000001c0)='./file0\x00', &(0x7f0000000200), 0x1121061, &(0x7f0000000380)={'trans=xen,', {[{@msize={'msize', 0x3d, 0xf6b3}}, {@debug={'debug', 0x3d, 0x7ff}}, {@posixacl}, {@aname={'aname', 0x3d, '*$-&'}}, {@uname={'uname', 0x3d, 'msdos\x00'}}], [{@seclabel}, {@euid_eq={'euid', 0x3d, r0}}, {@permit_directio}, {@appraise_type}]}}) r1 = syz_io_uring_setup(0x1d4a, &(0x7f0000000440)={0x0, 0xfa85, 0x0, 0x0, 0x285}, &(0x7f0000ffd000/0x1000)=nil, &(0x7f0000ffd000/0x2000)=nil, &(0x7f00000004c0)=0x0, &(0x7f0000000500)) syz_io_uring_setup(0x3e5e, &(0x7f0000000540)={0x0, 0x5c61, 0x8, 0x2, 0x72}, &(0x7f0000ffd000/0x3000)=nil, &(0x7f0000ffc000/0x3000)=nil, &(0x7f00000005c0), &(0x7f0000000600)=0x0) syz_io_uring_submit(r2, r3, &(0x7f0000000740)=@IORING_OP_READ=@pass_buffer={0x16, 0x1, 0x2004, @fd_index=0xa, 0x7, &(0x7f0000000640)=""/227, 0xe3, 0xc, 0x1}, 0x9) ioctl$SECCOMP_IOCTL_NOTIF_ADDFD(0xffffffffffffffff, 0x40182103, &(0x7f0000000780)={0x0, 0x4, r1, 0x9, 0x80000}) openat$cgroup_devices(0xffffffffffffffff, &(0x7f00000007c0)='devices.allow\x00', 0x2, 0x0) syz_mount_image$nfs4(&(0x7f0000000800), &(0x7f0000000840)='./file0/file0\x00', 0xffffffffffffff01, 0x1, &(0x7f0000000900)=[{&(0x7f0000000880)="f19bd7cfef39dd2070dcb194f7bd90ce305e2a9644b9fb91cc1e75bca69ed6bbdd7636452963af395ea61189cce718ef43420310b6ff8db9f4a606d67217b1aa7bf6e1435682323aef92ef40d036c48fa3fc363c6ad63229bb37cd76a6db9879a39f", 0x62, 0x6}], 0x8400, &(0x7f0000000940)={[{'*+\\['}]}) mount$9p_rdma(&(0x7f0000001040), &(0x7f0000001080)='./file0\x00', &(0x7f00000010c0), 0xa00800, &(0x7f0000001100)={'trans=rdma,', {'port', 0x3d, 0x4e20}, 0x2c, {[{@common=@aname={'aname', 0x3d, 'permit_directio'}}, {@sq={'sq', 0x3d, 0xffff}}], [{@fscontext={'fscontext', 0x3d, 'staff_u'}}]}}) 11:41:51 executing program 2: clock_nanosleep(0x7, 0x0, &(0x7f0000000000)={0x77359400}, &(0x7f0000000040)) getsockopt$inet6_IPV6_XFRM_POLICY(0xffffffffffffffff, 0x29, 0x23, &(0x7f0000000080)={{{@in6, @in6=@remote, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, {{@in6=@dev}, 0x0, @in=@initdev}}, &(0x7f0000000180)=0xe8) setsockopt$packet_add_memb(0xffffffffffffffff, 0x107, 0x1, &(0x7f00000001c0)={r0, 0x1, 0x6, @broadcast}, 0x10) getpeername$packet(0xffffffffffffffff, &(0x7f0000000200)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @dev}, &(0x7f0000000240)=0x14) recvmsg(0xffffffffffffffff, &(0x7f00000027c0)={&(0x7f0000000280)=@xdp={0x2c, 0x0, 0x0}, 0x80, &(0x7f0000002640)=[{&(0x7f0000000300)=""/227, 0xe3}, {&(0x7f0000000400)=""/4096, 0x1000}, {&(0x7f0000001400)=""/92, 0x5c}, {&(0x7f0000001480)=""/93, 0x5d}, {&(0x7f0000001500)=""/4096, 0x1000}, {&(0x7f0000002500)=""/87, 0x57}, {&(0x7f0000002580)=""/189, 0xbd}], 0x7, &(0x7f00000026c0)=""/199, 0xc7}, 0x140) bind$packet(0xffffffffffffffff, &(0x7f0000002800)={0x11, 0x1b, r1, 0x1, 0x5}, 0x14) getresgid(&(0x7f0000002840), &(0x7f0000002880), &(0x7f00000028c0)) r2 = accept4$packet(0xffffffffffffffff, &(0x7f0000002900)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @multicast}, &(0x7f0000002940)=0x14, 0x80000) recvfrom$packet(r2, &(0x7f0000002980)=""/4096, 0x1000, 0x0, &(0x7f0000003980)={0x11, 0x17, r1, 0x1, 0x5, 0x6, @multicast}, 0x14) r3 = socket$inet6_udp(0xa, 0x2, 0x0) getsockopt$inet6_IPV6_XFRM_POLICY(r3, 0x29, 0x23, &(0x7f00000039c0)={{{@in6=@ipv4, @in6=@private0}}, {{@in=@private}, 0x0, @in6=@remote}}, &(0x7f0000003ac0)=0xe8) openat$sr(0xffffffffffffff9c, &(0x7f0000005480), 0x428802, 0x0) [ 204.076718] loop6: detected capacity change from 0 to 1 11:41:51 executing program 3: ioctl$SG_SET_FORCE_PACK_ID(0xffffffffffffffff, 0x227b, &(0x7f0000000000)=0x1) ioctl$SG_SET_FORCE_PACK_ID(0xffffffffffffffff, 0x227b, &(0x7f0000000040)) ioctl$SG_GET_RESERVED_SIZE(0xffffffffffffffff, 0x2272, &(0x7f0000000080)) r0 = openat$vcsa(0xffffffffffffff9c, &(0x7f00000000c0), 0x4200, 0x0) ioctl$SCSI_IOCTL_SEND_COMMAND(r0, 0x1, &(0x7f0000000100)={0x17, 0x3, 0x1c00, "af36a59fb168d324fd8eaf833aeb82f60d75e8700d81d9"}) ioctl$SG_SET_TIMEOUT(r0, 0x2201, &(0x7f0000000140)=0x4) ioctl$SG_GET_VERSION_NUM(r0, 0x2282, &(0x7f0000000180)) ioctl$SG_GET_REQUEST_TABLE(r0, 0x2286, &(0x7f00000001c0)) ioctl$SG_GET_TIMEOUT(r0, 0x2202, 0x0) ioctl$SG_EMULATED_HOST(0xffffffffffffffff, 0x2203, &(0x7f0000000380)) r1 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$inet6_tcp_TCP_CONGESTION(r1, 0x6, 0xd, &(0x7f0000000440)='scalable\x00', 0x9) 11:41:51 executing program 0: getpeername$packet(0xffffffffffffffff, &(0x7f0000000000)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @dev}, &(0x7f0000000040)=0x14) ioctl$sock_SIOCADDRT(0xffffffffffffffff, 0x890b, &(0x7f0000000080)={0x0, @phonet={0x23, 0xfe, 0x0, 0x2f}, @hci={0x1f, 0xffffffffffffffff, 0x3}, @rc={0x1f, @any, 0x2}, 0x5, 0x0, 0x0, 0x0, 0x7ff, 0x0, 0x0, 0x4, 0x4}) r0 = mmap$IORING_OFF_SQES(&(0x7f0000ffa000/0x4000)=nil, 0x4000, 0x1000004, 0x810, 0xffffffffffffffff, 0x10000000) syz_io_uring_submit(0x0, r0, &(0x7f0000000100)=@IORING_OP_MADVISE={0x19, 0x3, 0x0, 0x0, 0x0, &(0x7f0000ffa000/0x2000)=nil, 0x2000, 0xb, 0x1}, 0x8) r1 = syz_genetlink_get_family_id$mptcp(&(0x7f0000000180), 0xffffffffffffffff) sendmsg$MPTCP_PM_CMD_ADD_ADDR(0xffffffffffffffff, &(0x7f0000000240)={&(0x7f0000000140)={0x10, 0x0, 0x0, 0x10000}, 0xc, &(0x7f0000000200)={&(0x7f00000001c0)={0x24, r1, 0x800, 0x70bd27, 0x25dfdbfd, {}, [@MPTCP_PM_ATTR_RCV_ADD_ADDRS={0x8, 0x2, 0x8}, @MPTCP_PM_ATTR_RCV_ADD_ADDRS={0x8, 0x2, 0x6}]}, 0x24}, 0x1, 0x0, 0x0, 0x2400c096}, 0x80) r2 = openat$vcsa(0xffffffffffffff9c, &(0x7f0000000580), 0x121080, 0x0) setsockopt$inet6_tcp_TCP_QUEUE_SEQ(r2, 0x6, 0x15, &(0x7f0000000780)=0x400, 0x4) [ 204.139902] loop6: detected capacity change from 0 to 264192 11:41:51 executing program 7: openat$vcsa(0xffffffffffffff9c, 0x0, 0x10480, 0x0) [ 204.165515] nfs4: Unknown parameter '*+\[' 11:41:51 executing program 5: getpeername$packet(0xffffffffffffffff, &(0x7f0000000000)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @dev}, &(0x7f0000000040)=0x14) ioctl$sock_SIOCADDRT(0xffffffffffffffff, 0x890b, &(0x7f0000000080)={0x0, @phonet={0x23, 0xfe, 0x0, 0x2f}, @hci={0x1f, 0xffffffffffffffff, 0x3}, @rc={0x1f, @any, 0x2}, 0x5, 0x0, 0x0, 0x0, 0x7ff, 0x0, 0x0, 0x4, 0x4}) r0 = mmap$IORING_OFF_SQES(&(0x7f0000ffa000/0x4000)=nil, 0x4000, 0x1000004, 0x810, 0xffffffffffffffff, 0x10000000) syz_io_uring_submit(0x0, r0, &(0x7f0000000100)=@IORING_OP_MADVISE={0x19, 0x3, 0x0, 0x0, 0x0, &(0x7f0000ffa000/0x2000)=nil, 0x2000, 0xb, 0x1}, 0x8) r1 = openat$vcsa(0xffffffffffffff9c, &(0x7f0000000580), 0x121080, 0x0) setsockopt$inet6_tcp_TCP_QUEUE_SEQ(r1, 0x6, 0x15, &(0x7f0000000780)=0x400, 0x4) [ 204.180296] SELinux: security_context_str_to_sid (staff_u) failed with errno=-22 11:41:51 executing program 4: setsockopt$inet_tcp_TCP_QUEUE_SEQ(0xffffffffffffffff, 0x6, 0x15, &(0x7f0000000000), 0x4) r0 = openat$vcsa(0xffffffffffffff9c, &(0x7f0000000040), 0x81, 0x0) setsockopt$packet_tx_ring(r0, 0x107, 0xd, &(0x7f0000000080)=@req={0x4, 0xffffffff, 0xd5, 0x5}, 0x10) setsockopt$inet_tcp_TCP_REPAIR_WINDOW(r0, 0x6, 0x1d, &(0x7f00000000c0)={0xfffffff9, 0x1, 0x7fffffff, 0x6, 0x1}, 0x14) ioctl$SCSI_IOCTL_SYNC(r0, 0x4) accept(r0, &(0x7f0000000100)=@rc={0x1f, @fixed}, &(0x7f0000000180)=0x80) socket$inet_tcp(0x2, 0x1, 0x0) syz_genetlink_get_family_id$netlbl_mgmt(&(0x7f0000000440), 0xffffffffffffffff) syz_genetlink_get_family_id$netlbl_mgmt(&(0x7f0000000740), 0xffffffffffffffff) 11:41:51 executing program 1: r0 = shmget(0x2, 0x3000, 0x100, &(0x7f0000ffb000/0x3000)=nil) shmat(r0, &(0x7f0000ffa000/0x3000)=nil, 0x2000) shmat(r0, &(0x7f0000ffa000/0x4000)=nil, 0x3000) shmget(0x3, 0x1000, 0x100, &(0x7f0000ffd000/0x1000)=nil) r1 = syz_genetlink_get_family_id$netlbl_mgmt(&(0x7f0000000040), 0xffffffffffffffff) sendmsg$NLBL_MGMT_C_REMOVEDEF(0xffffffffffffffff, &(0x7f0000000100)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x8}, 0xc, &(0x7f00000000c0)={&(0x7f0000000080)={0x3c, r1, 0x20, 0x70bd29, 0x25dfdbff, {}, [@NLBL_MGMT_A_FAMILY={0x6, 0xb, 0x5}, @NLBL_MGMT_A_PROTOCOL={0x8, 0x2, 0x3}, @NLBL_MGMT_A_IPV4MASK={0x8, 0x8, @multicast1}, @NLBL_MGMT_A_CLPDOI={0x8}, @NLBL_MGMT_A_IPV4ADDR={0x8, 0x7, @local}]}, 0x3c}, 0x1, 0x0, 0x0, 0x4048820}, 0x40000) shmat(0xffffffffffffffff, &(0x7f0000ffb000/0x4000)=nil, 0x2000) r2 = shmget(0x0, 0xf000, 0x100, &(0x7f0000ff1000/0xf000)=nil) shmctl$IPC_RMID(r2, 0x0) mmap$IORING_OFF_SQ_RING(&(0x7f0000ffd000/0x1000)=nil, 0x1000, 0x2000006, 0x40010, 0xffffffffffffffff, 0x0) recvfrom$packet(0xffffffffffffffff, &(0x7f0000000200)=""/108, 0x6c, 0x2000, &(0x7f0000000300)={0x11, 0x16, 0x0, 0x1, 0x8, 0x6, @local}, 0x14) io_uring_setup(0x14ab, &(0x7f0000000480)={0x0, 0x5191, 0x20, 0x1, 0x3ba}) shmget$private(0x0, 0x2000, 0x10, &(0x7f0000ffc000/0x2000)=nil) 11:41:51 executing program 0: getpeername$packet(0xffffffffffffffff, &(0x7f0000000000)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @dev}, &(0x7f0000000040)=0x14) ioctl$sock_SIOCADDRT(0xffffffffffffffff, 0x890b, &(0x7f0000000080)={0x0, @phonet={0x23, 0xfe, 0x0, 0x2f}, @hci={0x1f, 0xffffffffffffffff, 0x3}, @rc={0x1f, @any, 0x2}, 0x5, 0x0, 0x0, 0x0, 0x7ff, 0x0, 0x0, 0x4, 0x4}) r0 = mmap$IORING_OFF_SQES(&(0x7f0000ffa000/0x4000)=nil, 0x4000, 0x1000004, 0x810, 0xffffffffffffffff, 0x10000000) syz_io_uring_submit(0x0, r0, &(0x7f0000000100)=@IORING_OP_MADVISE={0x19, 0x3, 0x0, 0x0, 0x0, &(0x7f0000ffa000/0x2000)=nil, 0x2000, 0xb, 0x1}, 0x8) r1 = syz_genetlink_get_family_id$mptcp(&(0x7f0000000180), 0xffffffffffffffff) sendmsg$MPTCP_PM_CMD_ADD_ADDR(0xffffffffffffffff, &(0x7f0000000240)={&(0x7f0000000140)={0x10, 0x0, 0x0, 0x10000}, 0xc, &(0x7f0000000200)={&(0x7f00000001c0)={0x24, r1, 0x800, 0x70bd27, 0x25dfdbfd, {}, [@MPTCP_PM_ATTR_RCV_ADD_ADDRS={0x8, 0x2, 0x8}, @MPTCP_PM_ATTR_RCV_ADD_ADDRS={0x8, 0x2, 0x6}]}, 0x24}, 0x1, 0x0, 0x0, 0x2400c096}, 0x80) r2 = openat$vcsa(0xffffffffffffff9c, &(0x7f0000000580), 0x121080, 0x0) setsockopt$inet6_tcp_TCP_QUEUE_SEQ(r2, 0x6, 0x15, &(0x7f0000000780)=0x400, 0x4) 11:41:51 executing program 6: ioprio_set$uid(0x0, 0xee01, 0x4004) syz_mount_image$msdos(&(0x7f0000000000), &(0x7f0000000040)='./file0\x00', 0x200, 0x1, &(0x7f00000000c0)=[{&(0x7f0000000080)="7c74c7bc99e778a0c971e6f50fbdd2b70fa0b038d18c7d5ac685833434d89dce684239293aa5d8b6f11bc5c4a033ad1dc68319fad36a1101aad751fd6f4f10", 0x3f, 0x7f}], 0x42000, &(0x7f0000000100)={[{@dots}], [{@obj_user}, {@dont_appraise}, {@uid_lt}, {@hash}, {@seclabel}]}) getsockopt$inet6_IPV6_XFRM_POLICY(0xffffffffffffffff, 0x29, 0x23, &(0x7f0000000240)={{{@in=@loopback, @in6=@empty, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, {{@in6=@local}, 0x0, @in6=@mcast1}}, &(0x7f0000000340)=0xe8) mount$9p_xen(&(0x7f0000000180), &(0x7f00000001c0)='./file0\x00', &(0x7f0000000200), 0x1121061, &(0x7f0000000380)={'trans=xen,', {[{@msize={'msize', 0x3d, 0xf6b3}}, {@debug={'debug', 0x3d, 0x7ff}}, {@posixacl}, {@aname={'aname', 0x3d, '*$-&'}}, {@uname={'uname', 0x3d, 'msdos\x00'}}], [{@seclabel}, {@euid_eq={'euid', 0x3d, r0}}, {@permit_directio}, {@appraise_type}]}}) r1 = syz_io_uring_setup(0x1d4a, &(0x7f0000000440)={0x0, 0xfa85, 0x0, 0x0, 0x285}, &(0x7f0000ffd000/0x1000)=nil, &(0x7f0000ffd000/0x2000)=nil, &(0x7f00000004c0)=0x0, &(0x7f0000000500)) syz_io_uring_setup(0x3e5e, &(0x7f0000000540)={0x0, 0x5c61, 0x8, 0x2, 0x72}, &(0x7f0000ffd000/0x3000)=nil, &(0x7f0000ffc000/0x3000)=nil, &(0x7f00000005c0), &(0x7f0000000600)=0x0) syz_io_uring_submit(r2, r3, &(0x7f0000000740)=@IORING_OP_READ=@pass_buffer={0x16, 0x1, 0x2004, @fd_index=0xa, 0x7, &(0x7f0000000640)=""/227, 0xe3, 0xc, 0x1}, 0x9) ioctl$SECCOMP_IOCTL_NOTIF_ADDFD(0xffffffffffffffff, 0x40182103, &(0x7f0000000780)={0x0, 0x4, r1, 0x9, 0x80000}) openat$cgroup_devices(0xffffffffffffffff, &(0x7f00000007c0)='devices.allow\x00', 0x2, 0x0) syz_mount_image$nfs4(&(0x7f0000000800), &(0x7f0000000840)='./file0/file0\x00', 0xffffffffffffff01, 0x1, &(0x7f0000000900)=[{&(0x7f0000000880)="f19bd7cfef39dd2070dcb194f7bd90ce305e2a9644b9fb91cc1e75bca69ed6bbdd7636452963af395ea61189cce718ef43420310b6ff8db9f4a606d67217b1aa7bf6e1435682323aef92ef40d036c48fa3fc363c6ad63229bb37cd76a6db9879a39f", 0x62, 0x6}], 0x8400, &(0x7f0000000940)={[{'*+\\['}]}) mount$9p_rdma(&(0x7f0000001040), &(0x7f0000001080)='./file0\x00', &(0x7f00000010c0), 0xa00800, &(0x7f0000001100)={'trans=rdma,', {'port', 0x3d, 0x4e20}, 0x2c, {[{@common=@aname={'aname', 0x3d, 'permit_directio'}}, {@sq={'sq', 0x3d, 0xffff}}], [{@fscontext={'fscontext', 0x3d, 'staff_u'}}]}}) 11:41:51 executing program 1: r0 = shmget(0x2, 0x3000, 0x100, &(0x7f0000ffb000/0x3000)=nil) shmat(r0, &(0x7f0000ffa000/0x3000)=nil, 0x2000) shmat(r0, &(0x7f0000ffa000/0x4000)=nil, 0x3000) shmget(0x3, 0x1000, 0x100, &(0x7f0000ffd000/0x1000)=nil) r1 = syz_genetlink_get_family_id$netlbl_mgmt(&(0x7f0000000040), 0xffffffffffffffff) sendmsg$NLBL_MGMT_C_REMOVEDEF(0xffffffffffffffff, &(0x7f0000000100)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x8}, 0xc, &(0x7f00000000c0)={&(0x7f0000000080)={0x3c, r1, 0x20, 0x70bd29, 0x25dfdbff, {}, [@NLBL_MGMT_A_FAMILY={0x6, 0xb, 0x5}, @NLBL_MGMT_A_PROTOCOL={0x8, 0x2, 0x3}, @NLBL_MGMT_A_IPV4MASK={0x8, 0x8, @multicast1}, @NLBL_MGMT_A_CLPDOI={0x8}, @NLBL_MGMT_A_IPV4ADDR={0x8, 0x7, @local}]}, 0x3c}, 0x1, 0x0, 0x0, 0x4048820}, 0x40000) shmat(0xffffffffffffffff, &(0x7f0000ffb000/0x4000)=nil, 0x2000) r2 = shmget(0x0, 0xf000, 0x100, &(0x7f0000ff1000/0xf000)=nil) shmctl$IPC_RMID(r2, 0x0) mmap$IORING_OFF_SQ_RING(&(0x7f0000ffd000/0x1000)=nil, 0x1000, 0x2000006, 0x40010, 0xffffffffffffffff, 0x0) recvfrom$packet(0xffffffffffffffff, &(0x7f0000000200)=""/108, 0x6c, 0x2000, &(0x7f0000000300)={0x11, 0x16, 0x0, 0x1, 0x8, 0x6, @local}, 0x14) io_uring_setup(0x14ab, &(0x7f0000000480)={0x0, 0x5191, 0x20, 0x1, 0x3ba}) shmget$private(0x0, 0x2000, 0x10, &(0x7f0000ffc000/0x2000)=nil) [ 204.395191] loop6: detected capacity change from 0 to 1 [ 204.415041] loop6: detected capacity change from 0 to 264192 [ 204.420920] nfs4: Unknown parameter '*+\[' [ 204.425446] SELinux: security_context_str_to_sid (staff_u) failed with errno=-22 11:41:59 executing program 5: getpeername$packet(0xffffffffffffffff, &(0x7f0000000000)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @dev}, &(0x7f0000000040)=0x14) ioctl$sock_SIOCADDRT(0xffffffffffffffff, 0x890b, &(0x7f0000000080)={0x0, @phonet={0x23, 0xfe, 0x0, 0x2f}, @hci={0x1f, 0xffffffffffffffff, 0x3}, @rc={0x1f, @any, 0x2}, 0x5, 0x0, 0x0, 0x0, 0x7ff, 0x0, 0x0, 0x4, 0x4}) mmap$IORING_OFF_SQES(&(0x7f0000ffa000/0x4000)=nil, 0x4000, 0x1000004, 0x810, 0xffffffffffffffff, 0x10000000) r0 = openat$vcsa(0xffffffffffffff9c, &(0x7f0000000580), 0x121080, 0x0) setsockopt$inet6_tcp_TCP_QUEUE_SEQ(r0, 0x6, 0x15, &(0x7f0000000780)=0x400, 0x4) 11:41:59 executing program 0: getpeername$packet(0xffffffffffffffff, &(0x7f0000000000)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @dev}, &(0x7f0000000040)=0x14) ioctl$sock_SIOCADDRT(0xffffffffffffffff, 0x890b, &(0x7f0000000080)={0x0, @phonet={0x23, 0xfe, 0x0, 0x2f}, @hci={0x1f, 0xffffffffffffffff, 0x3}, @rc={0x1f, @any, 0x2}, 0x5, 0x0, 0x0, 0x0, 0x7ff, 0x0, 0x0, 0x4, 0x4}) r0 = mmap$IORING_OFF_SQES(&(0x7f0000ffa000/0x4000)=nil, 0x4000, 0x1000004, 0x810, 0xffffffffffffffff, 0x10000000) syz_io_uring_submit(0x0, r0, &(0x7f0000000100)=@IORING_OP_MADVISE={0x19, 0x3, 0x0, 0x0, 0x0, &(0x7f0000ffa000/0x2000)=nil, 0x2000, 0xb, 0x1}, 0x8) r1 = syz_genetlink_get_family_id$mptcp(&(0x7f0000000180), 0xffffffffffffffff) sendmsg$MPTCP_PM_CMD_ADD_ADDR(0xffffffffffffffff, &(0x7f0000000240)={&(0x7f0000000140)={0x10, 0x0, 0x0, 0x10000}, 0xc, &(0x7f0000000200)={&(0x7f00000001c0)={0x24, r1, 0x800, 0x70bd27, 0x25dfdbfd, {}, [@MPTCP_PM_ATTR_RCV_ADD_ADDRS={0x8, 0x2, 0x8}, @MPTCP_PM_ATTR_RCV_ADD_ADDRS={0x8, 0x2, 0x6}]}, 0x24}, 0x1, 0x0, 0x0, 0x2400c096}, 0x80) r2 = openat$vcsa(0xffffffffffffff9c, &(0x7f0000000580), 0x121080, 0x0) setsockopt$inet6_tcp_TCP_QUEUE_SEQ(r2, 0x6, 0x15, &(0x7f0000000780)=0x400, 0x4) 11:41:59 executing program 7: openat$vcsa(0xffffffffffffff9c, 0x0, 0x10480, 0x0) 11:41:59 executing program 4: setsockopt$inet_tcp_TCP_QUEUE_SEQ(0xffffffffffffffff, 0x6, 0x15, &(0x7f0000000000), 0x4) r0 = openat$vcsa(0xffffffffffffff9c, &(0x7f0000000040), 0x81, 0x0) setsockopt$packet_tx_ring(r0, 0x107, 0xd, &(0x7f0000000080)=@req={0x4, 0xffffffff, 0xd5, 0x5}, 0x10) setsockopt$inet_tcp_TCP_REPAIR_WINDOW(r0, 0x6, 0x1d, &(0x7f00000000c0)={0xfffffff9, 0x1, 0x7fffffff, 0x6, 0x1}, 0x14) ioctl$SCSI_IOCTL_SYNC(r0, 0x4) socket$inet_tcp(0x2, 0x1, 0x0) syz_genetlink_get_family_id$netlbl_mgmt(&(0x7f0000000440), 0xffffffffffffffff) syz_genetlink_get_family_id$netlbl_mgmt(&(0x7f0000000740), 0xffffffffffffffff) 11:41:59 executing program 3: ioctl$SG_SET_FORCE_PACK_ID(0xffffffffffffffff, 0x227b, &(0x7f0000000000)=0x1) ioctl$SG_SET_FORCE_PACK_ID(0xffffffffffffffff, 0x227b, &(0x7f0000000040)) ioctl$SG_GET_RESERVED_SIZE(0xffffffffffffffff, 0x2272, &(0x7f0000000080)) r0 = openat$vcsa(0xffffffffffffff9c, &(0x7f00000000c0), 0x4200, 0x0) ioctl$SCSI_IOCTL_SEND_COMMAND(r0, 0x1, &(0x7f0000000100)={0x17, 0x3, 0x1c00, "af36a59fb168d324fd8eaf833aeb82f60d75e8700d81d9"}) ioctl$SG_SET_TIMEOUT(r0, 0x2201, &(0x7f0000000140)=0x4) ioctl$SG_GET_VERSION_NUM(r0, 0x2282, &(0x7f0000000180)) ioctl$SG_GET_REQUEST_TABLE(r0, 0x2286, &(0x7f00000001c0)) ioctl$SG_GET_TIMEOUT(r0, 0x2202, 0x0) ioctl$SG_EMULATED_HOST(0xffffffffffffffff, 0x2203, &(0x7f0000000380)) r1 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$inet6_tcp_TCP_CONGESTION(r1, 0x6, 0xd, &(0x7f0000000440)='scalable\x00', 0x9) 11:41:59 executing program 1: r0 = shmget(0x2, 0x3000, 0x100, &(0x7f0000ffb000/0x3000)=nil) shmat(r0, &(0x7f0000ffa000/0x3000)=nil, 0x2000) shmat(r0, &(0x7f0000ffa000/0x4000)=nil, 0x3000) shmget(0x3, 0x1000, 0x100, &(0x7f0000ffd000/0x1000)=nil) r1 = syz_genetlink_get_family_id$netlbl_mgmt(&(0x7f0000000040), 0xffffffffffffffff) sendmsg$NLBL_MGMT_C_REMOVEDEF(0xffffffffffffffff, &(0x7f0000000100)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x8}, 0xc, &(0x7f00000000c0)={&(0x7f0000000080)={0x3c, r1, 0x20, 0x70bd29, 0x25dfdbff, {}, [@NLBL_MGMT_A_FAMILY={0x6, 0xb, 0x5}, @NLBL_MGMT_A_PROTOCOL={0x8, 0x2, 0x3}, @NLBL_MGMT_A_IPV4MASK={0x8, 0x8, @multicast1}, @NLBL_MGMT_A_CLPDOI={0x8}, @NLBL_MGMT_A_IPV4ADDR={0x8, 0x7, @local}]}, 0x3c}, 0x1, 0x0, 0x0, 0x4048820}, 0x40000) shmat(0xffffffffffffffff, &(0x7f0000ffb000/0x4000)=nil, 0x2000) r2 = shmget(0x0, 0xf000, 0x100, &(0x7f0000ff1000/0xf000)=nil) shmctl$IPC_RMID(r2, 0x0) syz_io_uring_submit(0x0, 0x0, &(0x7f00000001c0)=@IORING_OP_PROVIDE_BUFFERS={0x1f, 0x1, 0x0, 0x8, 0x2, &(0x7f0000000140)="10e8e6d73f8e97a04564912d4b0bee6921be05ed083e4d741dabdbce8c94949f57a5c9d9da73d0e5ad668714159e31498f181aad79547c645eefb456a7b8c4be765eb156b77cba8a752b90d7729b2c285893a10c3633d2485f48f30d247214c5e28a", 0x7, 0x0, 0x1, {0x1}}, 0x100) recvfrom$packet(0xffffffffffffffff, &(0x7f0000000200)=""/108, 0x6c, 0x2000, &(0x7f0000000300)={0x11, 0x16, 0x0, 0x1, 0x8, 0x6, @local}, 0x14) io_uring_setup(0x14ab, &(0x7f0000000480)={0x0, 0x5191, 0x20, 0x1, 0x3ba}) shmget$private(0x0, 0x2000, 0x10, &(0x7f0000ffc000/0x2000)=nil) 11:41:59 executing program 6: ioprio_set$uid(0x0, 0xee01, 0x4004) syz_mount_image$msdos(&(0x7f0000000000), &(0x7f0000000040)='./file0\x00', 0x200, 0x1, &(0x7f00000000c0)=[{&(0x7f0000000080)="7c74c7bc99e778a0c971e6f50fbdd2b70fa0b038d18c7d5ac685833434d89dce684239293aa5d8b6f11bc5c4a033ad1dc68319fad36a1101aad751fd6f4f10", 0x3f, 0x7f}], 0x42000, &(0x7f0000000100)={[{@dots}], [{@obj_user}, {@dont_appraise}, {@uid_lt}, {@hash}, {@seclabel}]}) getsockopt$inet6_IPV6_XFRM_POLICY(0xffffffffffffffff, 0x29, 0x23, &(0x7f0000000240)={{{@in=@loopback, @in6=@empty, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, {{@in6=@local}, 0x0, @in6=@mcast1}}, &(0x7f0000000340)=0xe8) mount$9p_xen(&(0x7f0000000180), &(0x7f00000001c0)='./file0\x00', &(0x7f0000000200), 0x1121061, &(0x7f0000000380)={'trans=xen,', {[{@msize={'msize', 0x3d, 0xf6b3}}, {@debug={'debug', 0x3d, 0x7ff}}, {@posixacl}, {@aname={'aname', 0x3d, '*$-&'}}, {@uname={'uname', 0x3d, 'msdos\x00'}}], [{@seclabel}, {@euid_eq={'euid', 0x3d, r0}}, {@permit_directio}, {@appraise_type}]}}) r1 = syz_io_uring_setup(0x1d4a, &(0x7f0000000440)={0x0, 0xfa85, 0x0, 0x0, 0x285}, &(0x7f0000ffd000/0x1000)=nil, &(0x7f0000ffd000/0x2000)=nil, &(0x7f00000004c0)=0x0, &(0x7f0000000500)) syz_io_uring_setup(0x3e5e, &(0x7f0000000540)={0x0, 0x5c61, 0x8, 0x2, 0x72}, &(0x7f0000ffd000/0x3000)=nil, &(0x7f0000ffc000/0x3000)=nil, &(0x7f00000005c0), &(0x7f0000000600)=0x0) syz_io_uring_submit(r2, r3, &(0x7f0000000740)=@IORING_OP_READ=@pass_buffer={0x16, 0x1, 0x2004, @fd_index=0xa, 0x7, &(0x7f0000000640)=""/227, 0xe3, 0xc, 0x1}, 0x9) ioctl$SECCOMP_IOCTL_NOTIF_ADDFD(0xffffffffffffffff, 0x40182103, &(0x7f0000000780)={0x0, 0x4, r1, 0x9, 0x80000}) openat$cgroup_devices(0xffffffffffffffff, &(0x7f00000007c0)='devices.allow\x00', 0x2, 0x0) syz_mount_image$nfs4(&(0x7f0000000800), &(0x7f0000000840)='./file0/file0\x00', 0xffffffffffffff01, 0x1, &(0x7f0000000900)=[{&(0x7f0000000880)="f19bd7cfef39dd2070dcb194f7bd90ce305e2a9644b9fb91cc1e75bca69ed6bbdd7636452963af395ea61189cce718ef43420310b6ff8db9f4a606d67217b1aa7bf6e1435682323aef92ef40d036c48fa3fc363c6ad63229bb37cd76a6db9879a39f", 0x62, 0x6}], 0x8400, &(0x7f0000000940)={[{'*+\\['}]}) mount$9p_rdma(&(0x7f0000001040), &(0x7f0000001080)='./file0\x00', &(0x7f00000010c0), 0xa00800, &(0x7f0000001100)={'trans=rdma,', {'port', 0x3d, 0x4e20}, 0x2c, {[{@common=@aname={'aname', 0x3d, 'permit_directio'}}, {@sq={'sq', 0x3d, 0xffff}}], [{@fscontext={'fscontext', 0x3d, 'staff_u'}}]}}) 11:41:59 executing program 2: clock_nanosleep(0x7, 0x0, &(0x7f0000000000)={0x77359400}, &(0x7f0000000040)) getsockopt$inet6_IPV6_XFRM_POLICY(0xffffffffffffffff, 0x29, 0x23, &(0x7f0000000080)={{{@in6, @in6=@remote, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, {{@in6=@dev}, 0x0, @in=@initdev}}, &(0x7f0000000180)=0xe8) setsockopt$packet_add_memb(0xffffffffffffffff, 0x107, 0x1, &(0x7f00000001c0)={r0, 0x1, 0x6, @broadcast}, 0x10) getpeername$packet(0xffffffffffffffff, &(0x7f0000000200)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @dev}, &(0x7f0000000240)=0x14) recvmsg(0xffffffffffffffff, &(0x7f00000027c0)={&(0x7f0000000280)=@xdp={0x2c, 0x0, 0x0}, 0x80, &(0x7f0000002640)=[{&(0x7f0000000300)=""/227, 0xe3}, {&(0x7f0000000400)=""/4096, 0x1000}, {&(0x7f0000001400)=""/92, 0x5c}, {&(0x7f0000001480)=""/93, 0x5d}, {&(0x7f0000001500)=""/4096, 0x1000}, {&(0x7f0000002500)=""/87, 0x57}, {&(0x7f0000002580)=""/189, 0xbd}], 0x7, &(0x7f00000026c0)=""/199, 0xc7}, 0x140) bind$packet(0xffffffffffffffff, &(0x7f0000002800)={0x11, 0x1b, r1, 0x1, 0x5}, 0x14) getresgid(&(0x7f0000002840), &(0x7f0000002880), &(0x7f00000028c0)) r2 = accept4$packet(0xffffffffffffffff, &(0x7f0000002900)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @multicast}, &(0x7f0000002940)=0x14, 0x80000) recvfrom$packet(r2, &(0x7f0000002980)=""/4096, 0x1000, 0x0, &(0x7f0000003980)={0x11, 0x17, r1, 0x1, 0x5, 0x6, @multicast}, 0x14) socket$inet6_udp(0xa, 0x2, 0x0) openat$sr(0xffffffffffffff9c, &(0x7f0000005480), 0x428802, 0x0) 11:41:59 executing program 5: getpeername$packet(0xffffffffffffffff, &(0x7f0000000000)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @dev}, &(0x7f0000000040)=0x14) ioctl$sock_SIOCADDRT(0xffffffffffffffff, 0x890b, &(0x7f0000000080)={0x0, @phonet={0x23, 0xfe, 0x0, 0x2f}, @hci={0x1f, 0xffffffffffffffff, 0x3}, @rc={0x1f, @any, 0x2}, 0x5, 0x0, 0x0, 0x0, 0x7ff, 0x0, 0x0, 0x4, 0x4}) r0 = openat$vcsa(0xffffffffffffff9c, &(0x7f0000000580), 0x121080, 0x0) setsockopt$inet6_tcp_TCP_QUEUE_SEQ(r0, 0x6, 0x15, &(0x7f0000000780)=0x400, 0x4) [ 212.715172] loop6: detected capacity change from 0 to 1 11:41:59 executing program 4: setsockopt$inet_tcp_TCP_QUEUE_SEQ(0xffffffffffffffff, 0x6, 0x15, &(0x7f0000000000), 0x4) r0 = openat$vcsa(0xffffffffffffff9c, &(0x7f0000000040), 0x81, 0x0) setsockopt$packet_tx_ring(r0, 0x107, 0xd, &(0x7f0000000080)=@req={0x4, 0xffffffff, 0xd5, 0x5}, 0x10) setsockopt$inet_tcp_TCP_REPAIR_WINDOW(r0, 0x6, 0x1d, &(0x7f00000000c0)={0xfffffff9, 0x1, 0x7fffffff, 0x6, 0x1}, 0x14) socket$inet_tcp(0x2, 0x1, 0x0) syz_genetlink_get_family_id$netlbl_mgmt(&(0x7f0000000440), 0xffffffffffffffff) syz_genetlink_get_family_id$netlbl_mgmt(&(0x7f0000000740), 0xffffffffffffffff) 11:41:59 executing program 7: openat$vcsa(0xffffffffffffff9c, 0x0, 0x10480, 0x0) [ 212.776411] loop6: detected capacity change from 0 to 264192 11:41:59 executing program 0: getpeername$packet(0xffffffffffffffff, &(0x7f0000000000)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @dev}, &(0x7f0000000040)=0x14) ioctl$sock_SIOCADDRT(0xffffffffffffffff, 0x890b, &(0x7f0000000080)={0x0, @phonet={0x23, 0xfe, 0x0, 0x2f}, @hci={0x1f, 0xffffffffffffffff, 0x3}, @rc={0x1f, @any, 0x2}, 0x5, 0x0, 0x0, 0x0, 0x7ff, 0x0, 0x0, 0x4, 0x4}) r0 = mmap$IORING_OFF_SQES(&(0x7f0000ffa000/0x4000)=nil, 0x4000, 0x1000004, 0x810, 0xffffffffffffffff, 0x10000000) syz_io_uring_submit(0x0, r0, &(0x7f0000000100)=@IORING_OP_MADVISE={0x19, 0x3, 0x0, 0x0, 0x0, &(0x7f0000ffa000/0x2000)=nil, 0x2000, 0xb, 0x1}, 0x8) r1 = syz_genetlink_get_family_id$mptcp(&(0x7f0000000180), 0xffffffffffffffff) sendmsg$MPTCP_PM_CMD_ADD_ADDR(0xffffffffffffffff, &(0x7f0000000240)={&(0x7f0000000140)={0x10, 0x0, 0x0, 0x10000}, 0xc, &(0x7f0000000200)={&(0x7f00000001c0)={0x24, r1, 0x800, 0x70bd27, 0x25dfdbfd, {}, [@MPTCP_PM_ATTR_RCV_ADD_ADDRS={0x8, 0x2, 0x8}, @MPTCP_PM_ATTR_RCV_ADD_ADDRS={0x8, 0x2, 0x6}]}, 0x24}, 0x1, 0x0, 0x0, 0x2400c096}, 0x80) openat$vcsa(0xffffffffffffff9c, &(0x7f0000000580), 0x121080, 0x0) 11:41:59 executing program 5: getpeername$packet(0xffffffffffffffff, &(0x7f0000000000)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @dev}, &(0x7f0000000040)=0x14) r0 = openat$vcsa(0xffffffffffffff9c, &(0x7f0000000580), 0x121080, 0x0) setsockopt$inet6_tcp_TCP_QUEUE_SEQ(r0, 0x6, 0x15, &(0x7f0000000780)=0x400, 0x4) [ 212.794944] nfs4: Unknown parameter '*+\[' 11:41:59 executing program 1: r0 = shmget(0x2, 0x3000, 0x100, &(0x7f0000ffb000/0x3000)=nil) shmat(r0, &(0x7f0000ffa000/0x3000)=nil, 0x2000) shmat(r0, &(0x7f0000ffa000/0x4000)=nil, 0x3000) shmget(0x3, 0x1000, 0x100, &(0x7f0000ffd000/0x1000)=nil) r1 = syz_genetlink_get_family_id$netlbl_mgmt(&(0x7f0000000040), 0xffffffffffffffff) sendmsg$NLBL_MGMT_C_REMOVEDEF(0xffffffffffffffff, &(0x7f0000000100)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x8}, 0xc, &(0x7f00000000c0)={&(0x7f0000000080)={0x3c, r1, 0x20, 0x70bd29, 0x25dfdbff, {}, [@NLBL_MGMT_A_FAMILY={0x6, 0xb, 0x5}, @NLBL_MGMT_A_PROTOCOL={0x8, 0x2, 0x3}, @NLBL_MGMT_A_IPV4MASK={0x8, 0x8, @multicast1}, @NLBL_MGMT_A_CLPDOI={0x8}, @NLBL_MGMT_A_IPV4ADDR={0x8, 0x7, @local}]}, 0x3c}, 0x1, 0x0, 0x0, 0x4048820}, 0x40000) shmat(0xffffffffffffffff, &(0x7f0000ffb000/0x4000)=nil, 0x2000) r2 = shmget(0x0, 0xf000, 0x100, &(0x7f0000ff1000/0xf000)=nil) shmctl$IPC_RMID(r2, 0x0) syz_io_uring_submit(0x0, 0x0, &(0x7f00000001c0)=@IORING_OP_PROVIDE_BUFFERS={0x1f, 0x1, 0x0, 0x8, 0x2, &(0x7f0000000140)="10e8e6d73f8e97a04564912d4b0bee6921be05ed083e4d741dabdbce8c94949f57a5c9d9da73d0e5ad668714159e31498f181aad79547c645eefb456a7b8c4be765eb156b77cba8a752b90d7729b2c285893a10c3633d2485f48f30d247214c5e28a", 0x7, 0x0, 0x1, {0x1}}, 0x100) recvfrom$packet(0xffffffffffffffff, &(0x7f0000000200)=""/108, 0x6c, 0x2000, &(0x7f0000000300)={0x11, 0x16, 0x0, 0x1, 0x8, 0x6, @local}, 0x14) io_uring_setup(0x14ab, &(0x7f0000000480)={0x0, 0x5191, 0x20, 0x1, 0x3ba}) shmget$private(0x0, 0x2000, 0x10, &(0x7f0000ffc000/0x2000)=nil) [ 212.814094] SELinux: security_context_str_to_sid (staff_u) failed with errno=-22 11:41:59 executing program 4: setsockopt$inet_tcp_TCP_QUEUE_SEQ(0xffffffffffffffff, 0x6, 0x15, &(0x7f0000000000), 0x4) r0 = openat$vcsa(0xffffffffffffff9c, &(0x7f0000000040), 0x81, 0x0) setsockopt$packet_tx_ring(r0, 0x107, 0xd, &(0x7f0000000080)=@req={0x4, 0xffffffff, 0xd5, 0x5}, 0x10) setsockopt$inet_tcp_TCP_REPAIR_WINDOW(r0, 0x6, 0x1d, &(0x7f00000000c0)={0xfffffff9, 0x1, 0x7fffffff, 0x6, 0x1}, 0x14) socket$inet_tcp(0x2, 0x1, 0x0) syz_genetlink_get_family_id$netlbl_mgmt(&(0x7f0000000440), 0xffffffffffffffff) syz_genetlink_get_family_id$netlbl_mgmt(&(0x7f0000000740), 0xffffffffffffffff) 11:41:59 executing program 5: r0 = openat$vcsa(0xffffffffffffff9c, &(0x7f0000000580), 0x121080, 0x0) setsockopt$inet6_tcp_TCP_QUEUE_SEQ(r0, 0x6, 0x15, &(0x7f0000000780)=0x400, 0x4) 11:42:00 executing program 0: getpeername$packet(0xffffffffffffffff, &(0x7f0000000000)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @dev}, &(0x7f0000000040)=0x14) ioctl$sock_SIOCADDRT(0xffffffffffffffff, 0x890b, &(0x7f0000000080)={0x0, @phonet={0x23, 0xfe, 0x0, 0x2f}, @hci={0x1f, 0xffffffffffffffff, 0x3}, @rc={0x1f, @any, 0x2}, 0x5, 0x0, 0x0, 0x0, 0x7ff, 0x0, 0x0, 0x4, 0x4}) r0 = mmap$IORING_OFF_SQES(&(0x7f0000ffa000/0x4000)=nil, 0x4000, 0x1000004, 0x810, 0xffffffffffffffff, 0x10000000) syz_io_uring_submit(0x0, r0, &(0x7f0000000100)=@IORING_OP_MADVISE={0x19, 0x3, 0x0, 0x0, 0x0, &(0x7f0000ffa000/0x2000)=nil, 0x2000, 0xb, 0x1}, 0x8) r1 = syz_genetlink_get_family_id$mptcp(&(0x7f0000000180), 0xffffffffffffffff) sendmsg$MPTCP_PM_CMD_ADD_ADDR(0xffffffffffffffff, &(0x7f0000000240)={&(0x7f0000000140)={0x10, 0x0, 0x0, 0x10000}, 0xc, &(0x7f0000000200)={&(0x7f00000001c0)={0x24, r1, 0x800, 0x70bd27, 0x25dfdbfd, {}, [@MPTCP_PM_ATTR_RCV_ADD_ADDRS={0x8, 0x2, 0x8}, @MPTCP_PM_ATTR_RCV_ADD_ADDRS={0x8, 0x2, 0x6}]}, 0x24}, 0x1, 0x0, 0x0, 0x2400c096}, 0x80) 11:42:00 executing program 7: openat$vcsa(0xffffffffffffff9c, &(0x7f0000000440), 0x0, 0x0) 11:42:00 executing program 3: ioctl$SG_SET_FORCE_PACK_ID(0xffffffffffffffff, 0x227b, &(0x7f0000000000)=0x1) ioctl$SG_SET_FORCE_PACK_ID(0xffffffffffffffff, 0x227b, &(0x7f0000000040)) ioctl$SG_GET_RESERVED_SIZE(0xffffffffffffffff, 0x2272, &(0x7f0000000080)) r0 = openat$vcsa(0xffffffffffffff9c, &(0x7f00000000c0), 0x4200, 0x0) ioctl$SCSI_IOCTL_SEND_COMMAND(r0, 0x1, &(0x7f0000000100)={0x17, 0x3, 0x1c00, "af36a59fb168d324fd8eaf833aeb82f60d75e8700d81d9"}) ioctl$SG_SET_TIMEOUT(r0, 0x2201, &(0x7f0000000140)=0x4) ioctl$SG_GET_VERSION_NUM(r0, 0x2282, &(0x7f0000000180)) ioctl$SG_GET_REQUEST_TABLE(r0, 0x2286, &(0x7f00000001c0)) ioctl$SG_GET_TIMEOUT(r0, 0x2202, 0x0) ioctl$SG_EMULATED_HOST(0xffffffffffffffff, 0x2203, &(0x7f0000000380)) r1 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$inet6_tcp_TCP_CONGESTION(r1, 0x6, 0xd, &(0x7f0000000440)='scalable\x00', 0x9) 11:42:00 executing program 6: ioprio_set$uid(0x0, 0xee01, 0x4004) syz_mount_image$msdos(&(0x7f0000000000), &(0x7f0000000040)='./file0\x00', 0x200, 0x1, &(0x7f00000000c0)=[{&(0x7f0000000080)="7c74c7bc99e778a0c971e6f50fbdd2b70fa0b038d18c7d5ac685833434d89dce684239293aa5d8b6f11bc5c4a033ad1dc68319fad36a1101aad751fd6f4f10", 0x3f, 0x7f}], 0x42000, &(0x7f0000000100)={[{@dots}], [{@obj_user}, {@dont_appraise}, {@uid_lt}, {@hash}, {@seclabel}]}) getsockopt$inet6_IPV6_XFRM_POLICY(0xffffffffffffffff, 0x29, 0x23, &(0x7f0000000240)={{{@in=@loopback, @in6=@empty, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, {{@in6=@local}, 0x0, @in6=@mcast1}}, &(0x7f0000000340)=0xe8) mount$9p_xen(&(0x7f0000000180), &(0x7f00000001c0)='./file0\x00', &(0x7f0000000200), 0x1121061, &(0x7f0000000380)={'trans=xen,', {[{@msize={'msize', 0x3d, 0xf6b3}}, {@debug={'debug', 0x3d, 0x7ff}}, {@posixacl}, {@aname={'aname', 0x3d, '*$-&'}}, {@uname={'uname', 0x3d, 'msdos\x00'}}], [{@seclabel}, {@euid_eq={'euid', 0x3d, r0}}, {@permit_directio}, {@appraise_type}]}}) r1 = syz_io_uring_setup(0x1d4a, &(0x7f0000000440)={0x0, 0xfa85, 0x0, 0x0, 0x285}, &(0x7f0000ffd000/0x1000)=nil, &(0x7f0000ffd000/0x2000)=nil, &(0x7f00000004c0)=0x0, &(0x7f0000000500)) syz_io_uring_setup(0x3e5e, &(0x7f0000000540)={0x0, 0x5c61, 0x8, 0x2, 0x72}, &(0x7f0000ffd000/0x3000)=nil, &(0x7f0000ffc000/0x3000)=nil, &(0x7f00000005c0), &(0x7f0000000600)=0x0) syz_io_uring_submit(r2, r3, &(0x7f0000000740)=@IORING_OP_READ=@pass_buffer={0x16, 0x1, 0x2004, @fd_index=0xa, 0x7, &(0x7f0000000640)=""/227, 0xe3, 0xc, 0x1}, 0x9) ioctl$SECCOMP_IOCTL_NOTIF_ADDFD(0xffffffffffffffff, 0x40182103, &(0x7f0000000780)={0x0, 0x4, r1, 0x9, 0x80000}) openat$cgroup_devices(0xffffffffffffffff, &(0x7f00000007c0)='devices.allow\x00', 0x2, 0x0) accept(0xffffffffffffffff, 0x0, &(0x7f0000000980)) mount$9p_rdma(&(0x7f0000001040), &(0x7f0000001080)='./file0\x00', &(0x7f00000010c0), 0xa00800, &(0x7f0000001100)={'trans=rdma,', {'port', 0x3d, 0x4e20}, 0x2c, {[{@common=@aname={'aname', 0x3d, 'permit_directio'}}, {@sq={'sq', 0x3d, 0xffff}}], [{@fscontext={'fscontext', 0x3d, 'staff_u'}}]}}) 11:42:00 executing program 5: r0 = openat$vcsa(0xffffffffffffff9c, 0x0, 0x121080, 0x0) setsockopt$inet6_tcp_TCP_QUEUE_SEQ(r0, 0x6, 0x15, &(0x7f0000000780)=0x400, 0x4) 11:42:00 executing program 4: setsockopt$inet_tcp_TCP_QUEUE_SEQ(0xffffffffffffffff, 0x6, 0x15, &(0x7f0000000000), 0x4) r0 = openat$vcsa(0xffffffffffffff9c, &(0x7f0000000040), 0x81, 0x0) setsockopt$packet_tx_ring(r0, 0x107, 0xd, &(0x7f0000000080)=@req={0x4, 0xffffffff, 0xd5, 0x5}, 0x10) setsockopt$inet_tcp_TCP_REPAIR_WINDOW(r0, 0x6, 0x1d, &(0x7f00000000c0)={0xfffffff9, 0x1, 0x7fffffff, 0x6, 0x1}, 0x14) socket$inet_tcp(0x2, 0x1, 0x0) syz_genetlink_get_family_id$netlbl_mgmt(&(0x7f0000000440), 0xffffffffffffffff) syz_genetlink_get_family_id$netlbl_mgmt(&(0x7f0000000740), 0xffffffffffffffff) [ 212.994917] loop6: detected capacity change from 0 to 1 [ 213.009604] SELinux: security_context_str_to_sid (staff_u) failed with errno=-22 11:42:07 executing program 7: openat$vcsa(0xffffffffffffff9c, &(0x7f0000000440), 0x0, 0x0) 11:42:07 executing program 0: getpeername$packet(0xffffffffffffffff, &(0x7f0000000000)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @dev}, &(0x7f0000000040)=0x14) ioctl$sock_SIOCADDRT(0xffffffffffffffff, 0x890b, &(0x7f0000000080)={0x0, @phonet={0x23, 0xfe, 0x0, 0x2f}, @hci={0x1f, 0xffffffffffffffff, 0x3}, @rc={0x1f, @any, 0x2}, 0x5, 0x0, 0x0, 0x0, 0x7ff, 0x0, 0x0, 0x4, 0x4}) r0 = mmap$IORING_OFF_SQES(&(0x7f0000ffa000/0x4000)=nil, 0x4000, 0x1000004, 0x810, 0xffffffffffffffff, 0x10000000) syz_io_uring_submit(0x0, r0, &(0x7f0000000100)=@IORING_OP_MADVISE={0x19, 0x3, 0x0, 0x0, 0x0, &(0x7f0000ffa000/0x2000)=nil, 0x2000, 0xb, 0x1}, 0x8) syz_genetlink_get_family_id$mptcp(&(0x7f0000000180), 0xffffffffffffffff) 11:42:07 executing program 3: ioctl$SG_SET_FORCE_PACK_ID(0xffffffffffffffff, 0x227b, &(0x7f0000000000)=0x1) ioctl$SG_SET_FORCE_PACK_ID(0xffffffffffffffff, 0x227b, &(0x7f0000000040)) ioctl$SG_GET_RESERVED_SIZE(0xffffffffffffffff, 0x2272, &(0x7f0000000080)) r0 = openat$vcsa(0xffffffffffffff9c, &(0x7f00000000c0), 0x4200, 0x0) ioctl$SCSI_IOCTL_SEND_COMMAND(r0, 0x1, &(0x7f0000000100)={0x17, 0x3, 0x1c00, "af36a59fb168d324fd8eaf833aeb82f60d75e8700d81d9"}) ioctl$SG_SET_TIMEOUT(r0, 0x2201, &(0x7f0000000140)=0x4) ioctl$SG_GET_VERSION_NUM(r0, 0x2282, &(0x7f0000000180)) ioctl$SG_GET_REQUEST_TABLE(r0, 0x2286, &(0x7f00000001c0)) r1 = syz_open_dev$sg(&(0x7f0000000340), 0x7fff, 0x40) ioctl$SG_EMULATED_HOST(r1, 0x2203, &(0x7f0000000380)) r2 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$inet6_tcp_TCP_CONGESTION(r2, 0x6, 0xd, &(0x7f0000000440)='scalable\x00', 0x9) 11:42:07 executing program 5: r0 = openat$vcsa(0xffffffffffffff9c, 0x0, 0x121080, 0x0) setsockopt$inet6_tcp_TCP_QUEUE_SEQ(r0, 0x6, 0x15, &(0x7f0000000780)=0x400, 0x4) 11:42:07 executing program 1: r0 = shmget(0x2, 0x3000, 0x100, &(0x7f0000ffb000/0x3000)=nil) shmat(r0, &(0x7f0000ffa000/0x3000)=nil, 0x2000) shmat(r0, &(0x7f0000ffa000/0x4000)=nil, 0x3000) shmget(0x3, 0x1000, 0x100, &(0x7f0000ffd000/0x1000)=nil) r1 = syz_genetlink_get_family_id$netlbl_mgmt(&(0x7f0000000040), 0xffffffffffffffff) sendmsg$NLBL_MGMT_C_REMOVEDEF(0xffffffffffffffff, &(0x7f0000000100)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x8}, 0xc, &(0x7f00000000c0)={&(0x7f0000000080)={0x3c, r1, 0x20, 0x70bd29, 0x25dfdbff, {}, [@NLBL_MGMT_A_FAMILY={0x6, 0xb, 0x5}, @NLBL_MGMT_A_PROTOCOL={0x8, 0x2, 0x3}, @NLBL_MGMT_A_IPV4MASK={0x8, 0x8, @multicast1}, @NLBL_MGMT_A_CLPDOI={0x8}, @NLBL_MGMT_A_IPV4ADDR={0x8, 0x7, @local}]}, 0x3c}, 0x1, 0x0, 0x0, 0x4048820}, 0x40000) shmat(0xffffffffffffffff, &(0x7f0000ffb000/0x4000)=nil, 0x2000) r2 = shmget(0x0, 0xf000, 0x100, &(0x7f0000ff1000/0xf000)=nil) shmctl$IPC_RMID(r2, 0x0) syz_io_uring_submit(0x0, 0x0, &(0x7f00000001c0)=@IORING_OP_PROVIDE_BUFFERS={0x1f, 0x1, 0x0, 0x8, 0x2, &(0x7f0000000140)="10e8e6d73f8e97a04564912d4b0bee6921be05ed083e4d741dabdbce8c94949f57a5c9d9da73d0e5ad668714159e31498f181aad79547c645eefb456a7b8c4be765eb156b77cba8a752b90d7729b2c285893a10c3633d2485f48f30d247214c5e28a", 0x7, 0x0, 0x1, {0x1}}, 0x100) recvfrom$packet(0xffffffffffffffff, &(0x7f0000000200)=""/108, 0x6c, 0x2000, &(0x7f0000000300)={0x11, 0x16, 0x0, 0x1, 0x8, 0x6, @local}, 0x14) io_uring_setup(0x14ab, &(0x7f0000000480)={0x0, 0x5191, 0x20, 0x1, 0x3ba}) shmget$private(0x0, 0x2000, 0x10, &(0x7f0000ffc000/0x2000)=nil) 11:42:07 executing program 4: setsockopt$inet_tcp_TCP_QUEUE_SEQ(0xffffffffffffffff, 0x6, 0x15, &(0x7f0000000000), 0x4) r0 = openat$vcsa(0xffffffffffffff9c, &(0x7f0000000040), 0x81, 0x0) setsockopt$packet_tx_ring(r0, 0x107, 0xd, &(0x7f0000000080)=@req={0x4, 0xffffffff, 0xd5, 0x5}, 0x10) socket$inet_tcp(0x2, 0x1, 0x0) syz_genetlink_get_family_id$netlbl_mgmt(&(0x7f0000000440), 0xffffffffffffffff) syz_genetlink_get_family_id$netlbl_mgmt(&(0x7f0000000740), 0xffffffffffffffff) 11:42:07 executing program 6: ioprio_set$uid(0x0, 0xee01, 0x4004) syz_mount_image$msdos(&(0x7f0000000000), &(0x7f0000000040)='./file0\x00', 0x200, 0x1, &(0x7f00000000c0)=[{&(0x7f0000000080)="7c74c7bc99e778a0c971e6f50fbdd2b70fa0b038d18c7d5ac685833434d89dce684239293aa5d8b6f11bc5c4a033ad1dc68319fad36a1101aad751fd6f4f10", 0x3f, 0x7f}], 0x42000, &(0x7f0000000100)={[{@dots}], [{@obj_user}, {@dont_appraise}, {@uid_lt}, {@hash}, {@seclabel}]}) getsockopt$inet6_IPV6_XFRM_POLICY(0xffffffffffffffff, 0x29, 0x23, &(0x7f0000000240)={{{@in=@loopback, @in6=@empty, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, {{@in6=@local}, 0x0, @in6=@mcast1}}, &(0x7f0000000340)=0xe8) mount$9p_xen(&(0x7f0000000180), &(0x7f00000001c0)='./file0\x00', &(0x7f0000000200), 0x1121061, &(0x7f0000000380)={'trans=xen,', {[{@msize={'msize', 0x3d, 0xf6b3}}, {@debug={'debug', 0x3d, 0x7ff}}, {@posixacl}, {@aname={'aname', 0x3d, '*$-&'}}, {@uname={'uname', 0x3d, 'msdos\x00'}}], [{@seclabel}, {@euid_eq={'euid', 0x3d, r0}}, {@permit_directio}, {@appraise_type}]}}) r1 = syz_io_uring_setup(0x1d4a, &(0x7f0000000440)={0x0, 0xfa85, 0x0, 0x0, 0x285}, &(0x7f0000ffd000/0x1000)=nil, &(0x7f0000ffd000/0x2000)=nil, &(0x7f00000004c0)=0x0, &(0x7f0000000500)) syz_io_uring_setup(0x3e5e, &(0x7f0000000540)={0x0, 0x5c61, 0x8, 0x2, 0x72}, &(0x7f0000ffd000/0x3000)=nil, &(0x7f0000ffc000/0x3000)=nil, &(0x7f00000005c0), &(0x7f0000000600)=0x0) syz_io_uring_submit(r2, r3, &(0x7f0000000740)=@IORING_OP_READ=@pass_buffer={0x16, 0x1, 0x2004, @fd_index=0xa, 0x7, &(0x7f0000000640)=""/227, 0xe3, 0xc, 0x1}, 0x9) ioctl$SECCOMP_IOCTL_NOTIF_ADDFD(0xffffffffffffffff, 0x40182103, &(0x7f0000000780)={0x0, 0x4, r1, 0x9, 0x80000}) openat$cgroup_devices(0xffffffffffffffff, &(0x7f00000007c0)='devices.allow\x00', 0x2, 0x0) accept(0xffffffffffffffff, 0x0, &(0x7f0000000980)) mount$9p_rdma(&(0x7f0000001040), &(0x7f0000001080)='./file0\x00', &(0x7f00000010c0), 0xa00800, &(0x7f0000001100)={'trans=rdma,', {'port', 0x3d, 0x4e20}, 0x2c, {[{@common=@aname={'aname', 0x3d, 'permit_directio'}}, {@sq={'sq', 0x3d, 0xffff}}], [{@fscontext={'fscontext', 0x3d, 'staff_u'}}]}}) 11:42:07 executing program 2: clock_nanosleep(0x7, 0x0, &(0x7f0000000000)={0x77359400}, &(0x7f0000000040)) getsockopt$inet6_IPV6_XFRM_POLICY(0xffffffffffffffff, 0x29, 0x23, &(0x7f0000000080)={{{@in6, @in6=@remote, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, {{@in6=@dev}, 0x0, @in=@initdev}}, &(0x7f0000000180)=0xe8) setsockopt$packet_add_memb(0xffffffffffffffff, 0x107, 0x1, &(0x7f00000001c0)={r0, 0x1, 0x6, @broadcast}, 0x10) getpeername$packet(0xffffffffffffffff, &(0x7f0000000200)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @dev}, &(0x7f0000000240)=0x14) recvmsg(0xffffffffffffffff, &(0x7f00000027c0)={&(0x7f0000000280)=@xdp={0x2c, 0x0, 0x0}, 0x80, &(0x7f0000002640)=[{&(0x7f0000000300)=""/227, 0xe3}, {&(0x7f0000000400)=""/4096, 0x1000}, {&(0x7f0000001400)=""/92, 0x5c}, {&(0x7f0000001480)=""/93, 0x5d}, {&(0x7f0000001500)=""/4096, 0x1000}, {&(0x7f0000002500)=""/87, 0x57}, {&(0x7f0000002580)=""/189, 0xbd}], 0x7, &(0x7f00000026c0)=""/199, 0xc7}, 0x140) bind$packet(0xffffffffffffffff, &(0x7f0000002800)={0x11, 0x1b, r1, 0x1, 0x5}, 0x14) getresgid(&(0x7f0000002840), &(0x7f0000002880), &(0x7f00000028c0)) r2 = accept4$packet(0xffffffffffffffff, &(0x7f0000002900)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @multicast}, &(0x7f0000002940)=0x14, 0x80000) recvfrom$packet(r2, &(0x7f0000002980)=""/4096, 0x1000, 0x0, &(0x7f0000003980)={0x11, 0x17, r1, 0x1, 0x5, 0x6, @multicast}, 0x14) openat$sr(0xffffffffffffff9c, &(0x7f0000005480), 0x428802, 0x0) 11:42:07 executing program 5: r0 = openat$vcsa(0xffffffffffffff9c, 0x0, 0x121080, 0x0) setsockopt$inet6_tcp_TCP_QUEUE_SEQ(r0, 0x6, 0x15, &(0x7f0000000780)=0x400, 0x4) [ 220.884510] loop6: detected capacity change from 0 to 1 11:42:08 executing program 4: setsockopt$inet_tcp_TCP_QUEUE_SEQ(0xffffffffffffffff, 0x6, 0x15, &(0x7f0000000000), 0x4) r0 = openat$vcsa(0xffffffffffffff9c, &(0x7f0000000040), 0x81, 0x0) setsockopt$packet_tx_ring(r0, 0x107, 0xd, &(0x7f0000000080)=@req={0x4, 0xffffffff, 0xd5, 0x5}, 0x10) socket$inet_tcp(0x2, 0x1, 0x0) syz_genetlink_get_family_id$netlbl_mgmt(&(0x7f0000000440), 0xffffffffffffffff) syz_genetlink_get_family_id$netlbl_mgmt(&(0x7f0000000740), 0xffffffffffffffff) [ 220.915051] SELinux: security_context_str_to_sid (staff_u) failed with errno=-22 11:42:08 executing program 7: openat$vcsa(0xffffffffffffff9c, &(0x7f0000000440), 0x0, 0x0) 11:42:08 executing program 0: getpeername$packet(0xffffffffffffffff, &(0x7f0000000000)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @dev}, &(0x7f0000000040)=0x14) ioctl$sock_SIOCADDRT(0xffffffffffffffff, 0x890b, &(0x7f0000000080)={0x0, @phonet={0x23, 0xfe, 0x0, 0x2f}, @hci={0x1f, 0xffffffffffffffff, 0x3}, @rc={0x1f, @any, 0x2}, 0x5, 0x0, 0x0, 0x0, 0x7ff, 0x0, 0x0, 0x4, 0x4}) r0 = mmap$IORING_OFF_SQES(&(0x7f0000ffa000/0x4000)=nil, 0x4000, 0x1000004, 0x810, 0xffffffffffffffff, 0x10000000) syz_io_uring_submit(0x0, r0, &(0x7f0000000100)=@IORING_OP_MADVISE={0x19, 0x3, 0x0, 0x0, 0x0, &(0x7f0000ffa000/0x2000)=nil, 0x2000, 0xb, 0x1}, 0x8) 11:42:08 executing program 1: r0 = shmget(0x2, 0x3000, 0x100, &(0x7f0000ffb000/0x3000)=nil) shmat(r0, &(0x7f0000ffa000/0x3000)=nil, 0x2000) shmat(r0, &(0x7f0000ffa000/0x4000)=nil, 0x3000) shmget(0x3, 0x1000, 0x100, &(0x7f0000ffd000/0x1000)=nil) r1 = syz_genetlink_get_family_id$netlbl_mgmt(&(0x7f0000000040), 0xffffffffffffffff) sendmsg$NLBL_MGMT_C_REMOVEDEF(0xffffffffffffffff, &(0x7f0000000100)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x8}, 0xc, &(0x7f00000000c0)={&(0x7f0000000080)={0x3c, r1, 0x20, 0x70bd29, 0x25dfdbff, {}, [@NLBL_MGMT_A_FAMILY={0x6, 0xb, 0x5}, @NLBL_MGMT_A_PROTOCOL={0x8, 0x2, 0x3}, @NLBL_MGMT_A_IPV4MASK={0x8, 0x8, @multicast1}, @NLBL_MGMT_A_CLPDOI={0x8}, @NLBL_MGMT_A_IPV4ADDR={0x8, 0x7, @local}]}, 0x3c}, 0x1, 0x0, 0x0, 0x4048820}, 0x40000) shmat(0xffffffffffffffff, &(0x7f0000ffb000/0x4000)=nil, 0x2000) shmget(0x0, 0xf000, 0x100, &(0x7f0000ff1000/0xf000)=nil) r2 = mmap$IORING_OFF_SQ_RING(&(0x7f0000ffd000/0x1000)=nil, 0x1000, 0x2000006, 0x40010, 0xffffffffffffffff, 0x0) syz_io_uring_submit(r2, 0x0, &(0x7f00000001c0)=@IORING_OP_PROVIDE_BUFFERS={0x1f, 0x1, 0x0, 0x8, 0x2, &(0x7f0000000140)="10e8e6d73f8e97a04564912d4b0bee6921be05ed083e4d741dabdbce8c94949f57a5c9d9da73d0e5ad668714159e31498f181aad79547c645eefb456a7b8c4be765eb156b77cba8a752b90d7729b2c285893a10c3633d2485f48f30d247214c5e28a", 0x7, 0x0, 0x1, {0x1}}, 0x100) recvfrom$packet(0xffffffffffffffff, &(0x7f0000000200)=""/108, 0x6c, 0x2000, &(0x7f0000000300)={0x11, 0x16, 0x0, 0x1, 0x8, 0x6, @local}, 0x14) io_uring_setup(0x14ab, &(0x7f0000000480)={0x0, 0x5191, 0x20, 0x1, 0x3ba}) shmget$private(0x0, 0x2000, 0x10, &(0x7f0000ffc000/0x2000)=nil) 11:42:08 executing program 6: ioprio_set$uid(0x0, 0xee01, 0x4004) syz_mount_image$msdos(&(0x7f0000000000), &(0x7f0000000040)='./file0\x00', 0x200, 0x1, &(0x7f00000000c0)=[{&(0x7f0000000080)="7c74c7bc99e778a0c971e6f50fbdd2b70fa0b038d18c7d5ac685833434d89dce684239293aa5d8b6f11bc5c4a033ad1dc68319fad36a1101aad751fd6f4f10", 0x3f, 0x7f}], 0x42000, &(0x7f0000000100)={[{@dots}], [{@obj_user}, {@dont_appraise}, {@uid_lt}, {@hash}, {@seclabel}]}) getsockopt$inet6_IPV6_XFRM_POLICY(0xffffffffffffffff, 0x29, 0x23, &(0x7f0000000240)={{{@in=@loopback, @in6=@empty, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, {{@in6=@local}, 0x0, @in6=@mcast1}}, &(0x7f0000000340)=0xe8) mount$9p_xen(&(0x7f0000000180), &(0x7f00000001c0)='./file0\x00', &(0x7f0000000200), 0x1121061, &(0x7f0000000380)={'trans=xen,', {[{@msize={'msize', 0x3d, 0xf6b3}}, {@debug={'debug', 0x3d, 0x7ff}}, {@posixacl}, {@aname={'aname', 0x3d, '*$-&'}}, {@uname={'uname', 0x3d, 'msdos\x00'}}], [{@seclabel}, {@euid_eq={'euid', 0x3d, r0}}, {@permit_directio}, {@appraise_type}]}}) r1 = syz_io_uring_setup(0x1d4a, &(0x7f0000000440)={0x0, 0xfa85, 0x0, 0x0, 0x285}, &(0x7f0000ffd000/0x1000)=nil, &(0x7f0000ffd000/0x2000)=nil, &(0x7f00000004c0)=0x0, &(0x7f0000000500)) syz_io_uring_setup(0x3e5e, &(0x7f0000000540)={0x0, 0x5c61, 0x8, 0x2, 0x72}, &(0x7f0000ffd000/0x3000)=nil, &(0x7f0000ffc000/0x3000)=nil, &(0x7f00000005c0), &(0x7f0000000600)=0x0) syz_io_uring_submit(r2, r3, &(0x7f0000000740)=@IORING_OP_READ=@pass_buffer={0x16, 0x1, 0x2004, @fd_index=0xa, 0x7, &(0x7f0000000640)=""/227, 0xe3, 0xc, 0x1}, 0x9) ioctl$SECCOMP_IOCTL_NOTIF_ADDFD(0xffffffffffffffff, 0x40182103, &(0x7f0000000780)={0x0, 0x4, r1, 0x9, 0x80000}) openat$cgroup_devices(0xffffffffffffffff, &(0x7f00000007c0)='devices.allow\x00', 0x2, 0x0) accept(0xffffffffffffffff, 0x0, &(0x7f0000000980)) mount$9p_rdma(&(0x7f0000001040), &(0x7f0000001080)='./file0\x00', &(0x7f00000010c0), 0xa00800, &(0x7f0000001100)={'trans=rdma,', {'port', 0x3d, 0x4e20}, 0x2c, {[{@common=@aname={'aname', 0x3d, 'permit_directio'}}, {@sq={'sq', 0x3d, 0xffff}}], [{@fscontext={'fscontext', 0x3d, 'staff_u'}}]}}) 11:42:08 executing program 5: r0 = openat$vcsa(0xffffffffffffff9c, &(0x7f0000000580), 0x0, 0x0) setsockopt$inet6_tcp_TCP_QUEUE_SEQ(r0, 0x6, 0x15, &(0x7f0000000780)=0x400, 0x4) [ 221.035979] loop6: detected capacity change from 0 to 1 11:42:08 executing program 4: setsockopt$inet_tcp_TCP_QUEUE_SEQ(0xffffffffffffffff, 0x6, 0x15, &(0x7f0000000000), 0x4) openat$vcsa(0xffffffffffffff9c, &(0x7f0000000040), 0x81, 0x0) socket$inet_tcp(0x2, 0x1, 0x0) syz_genetlink_get_family_id$netlbl_mgmt(&(0x7f0000000440), 0xffffffffffffffff) syz_genetlink_get_family_id$netlbl_mgmt(&(0x7f0000000740), 0xffffffffffffffff) 11:42:08 executing program 3: ioctl$SG_SET_FORCE_PACK_ID(0xffffffffffffffff, 0x227b, &(0x7f0000000000)=0x1) ioctl$SG_SET_FORCE_PACK_ID(0xffffffffffffffff, 0x227b, &(0x7f0000000040)) ioctl$SG_GET_RESERVED_SIZE(0xffffffffffffffff, 0x2272, &(0x7f0000000080)) r0 = openat$vcsa(0xffffffffffffff9c, &(0x7f00000000c0), 0x4200, 0x0) ioctl$SCSI_IOCTL_SEND_COMMAND(r0, 0x1, &(0x7f0000000100)={0x17, 0x3, 0x1c00, "af36a59fb168d324fd8eaf833aeb82f60d75e8700d81d9"}) ioctl$SG_SET_TIMEOUT(r0, 0x2201, &(0x7f0000000140)=0x4) ioctl$SG_GET_VERSION_NUM(r0, 0x2282, &(0x7f0000000180)) ioctl$SG_GET_REQUEST_TABLE(r0, 0x2286, &(0x7f00000001c0)) r1 = syz_open_dev$sg(&(0x7f0000000340), 0x7fff, 0x40) ioctl$SG_EMULATED_HOST(r1, 0x2203, &(0x7f0000000380)) r2 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$inet6_tcp_TCP_CONGESTION(r2, 0x6, 0xd, &(0x7f0000000440)='scalable\x00', 0x9) 11:42:08 executing program 1: r0 = shmget(0x2, 0x3000, 0x100, &(0x7f0000ffb000/0x3000)=nil) shmat(r0, &(0x7f0000ffa000/0x3000)=nil, 0x2000) shmat(r0, &(0x7f0000ffa000/0x4000)=nil, 0x3000) shmget(0x3, 0x1000, 0x100, &(0x7f0000ffd000/0x1000)=nil) r1 = syz_genetlink_get_family_id$netlbl_mgmt(&(0x7f0000000040), 0xffffffffffffffff) sendmsg$NLBL_MGMT_C_REMOVEDEF(0xffffffffffffffff, &(0x7f0000000100)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x8}, 0xc, &(0x7f00000000c0)={&(0x7f0000000080)={0x3c, r1, 0x20, 0x70bd29, 0x25dfdbff, {}, [@NLBL_MGMT_A_FAMILY={0x6, 0xb, 0x5}, @NLBL_MGMT_A_PROTOCOL={0x8, 0x2, 0x3}, @NLBL_MGMT_A_IPV4MASK={0x8, 0x8, @multicast1}, @NLBL_MGMT_A_CLPDOI={0x8}, @NLBL_MGMT_A_IPV4ADDR={0x8, 0x7, @local}]}, 0x3c}, 0x1, 0x0, 0x0, 0x4048820}, 0x40000) shmat(0xffffffffffffffff, &(0x7f0000ffb000/0x4000)=nil, 0x2000) r2 = mmap$IORING_OFF_SQ_RING(&(0x7f0000ffd000/0x1000)=nil, 0x1000, 0x2000006, 0x40010, 0xffffffffffffffff, 0x0) syz_io_uring_submit(r2, 0x0, &(0x7f00000001c0)=@IORING_OP_PROVIDE_BUFFERS={0x1f, 0x1, 0x0, 0x8, 0x2, &(0x7f0000000140)="10e8e6d73f8e97a04564912d4b0bee6921be05ed083e4d741dabdbce8c94949f57a5c9d9da73d0e5ad668714159e31498f181aad79547c645eefb456a7b8c4be765eb156b77cba8a752b90d7729b2c285893a10c3633d2485f48f30d247214c5e28a", 0x7, 0x0, 0x1, {0x1}}, 0x100) recvfrom$packet(0xffffffffffffffff, &(0x7f0000000200)=""/108, 0x6c, 0x2000, &(0x7f0000000300)={0x11, 0x16, 0x0, 0x1, 0x8, 0x6, @local}, 0x14) io_uring_setup(0x14ab, &(0x7f0000000480)={0x0, 0x5191, 0x20, 0x1, 0x3ba}) shmget$private(0x0, 0x2000, 0x10, &(0x7f0000ffc000/0x2000)=nil) [ 221.066584] SELinux: security_context_str_to_sid (staff_u) failed with errno=-22 11:42:08 executing program 5: openat$vcsa(0xffffffffffffff9c, &(0x7f0000000580), 0x0, 0x0) setsockopt$inet6_tcp_TCP_QUEUE_SEQ(0xffffffffffffffff, 0x6, 0x15, &(0x7f0000000780)=0x400, 0x4) 11:42:08 executing program 6: ioprio_set$uid(0x0, 0xee01, 0x4004) syz_mount_image$msdos(&(0x7f0000000000), &(0x7f0000000040)='./file0\x00', 0x200, 0x1, &(0x7f00000000c0)=[{&(0x7f0000000080)="7c74c7bc99e778a0c971e6f50fbdd2b70fa0b038d18c7d5ac685833434d89dce684239293aa5d8b6f11bc5c4a033ad1dc68319fad36a1101aad751fd6f4f10", 0x3f, 0x7f}], 0x42000, &(0x7f0000000100)={[{@dots}], [{@obj_user}, {@dont_appraise}, {@uid_lt}, {@hash}, {@seclabel}]}) getsockopt$inet6_IPV6_XFRM_POLICY(0xffffffffffffffff, 0x29, 0x23, &(0x7f0000000240)={{{@in=@loopback, @in6=@empty, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, {{@in6=@local}, 0x0, @in6=@mcast1}}, &(0x7f0000000340)=0xe8) mount$9p_xen(&(0x7f0000000180), &(0x7f00000001c0)='./file0\x00', &(0x7f0000000200), 0x1121061, &(0x7f0000000380)={'trans=xen,', {[{@msize={'msize', 0x3d, 0xf6b3}}, {@debug={'debug', 0x3d, 0x7ff}}, {@posixacl}, {@aname={'aname', 0x3d, '*$-&'}}, {@uname={'uname', 0x3d, 'msdos\x00'}}], [{@seclabel}, {@euid_eq={'euid', 0x3d, r0}}, {@permit_directio}, {@appraise_type}]}}) r1 = syz_io_uring_setup(0x1d4a, &(0x7f0000000440)={0x0, 0xfa85, 0x0, 0x0, 0x285}, &(0x7f0000ffd000/0x1000)=nil, &(0x7f0000ffd000/0x2000)=nil, &(0x7f00000004c0)=0x0, &(0x7f0000000500)) syz_io_uring_setup(0x3e5e, &(0x7f0000000540)={0x0, 0x5c61, 0x8, 0x2, 0x72}, &(0x7f0000ffd000/0x3000)=nil, &(0x7f0000ffc000/0x3000)=nil, &(0x7f00000005c0), &(0x7f0000000600)=0x0) syz_io_uring_submit(r2, r3, &(0x7f0000000740)=@IORING_OP_READ=@pass_buffer={0x16, 0x1, 0x2004, @fd_index=0xa, 0x7, &(0x7f0000000640)=""/227, 0xe3, 0xc, 0x1}, 0x9) ioctl$SECCOMP_IOCTL_NOTIF_ADDFD(0xffffffffffffffff, 0x40182103, &(0x7f0000000780)={0x0, 0x4, r1, 0x9, 0x80000}) syz_mount_image$nfs4(&(0x7f0000000800), &(0x7f0000000840)='./file0/file0\x00', 0xffffffffffffff01, 0x1, &(0x7f0000000900)=[{&(0x7f0000000880)="f19bd7cfef39dd2070dcb194f7bd90ce305e2a9644b9fb91cc1e75bca69ed6bbdd7636452963af395ea61189cce718ef43420310b6ff8db9f4a606d67217b1aa7bf6e1435682323aef92ef40d036c48fa3fc363c6ad63229bb37cd76a6db9879a39f", 0x62, 0x6}], 0x8400, &(0x7f0000000940)={[{'*+\\['}]}) accept(0xffffffffffffffff, 0x0, &(0x7f0000000980)) mount$9p_rdma(&(0x7f0000001040), &(0x7f0000001080)='./file0\x00', &(0x7f00000010c0), 0xa00800, &(0x7f0000001100)={'trans=rdma,', {'port', 0x3d, 0x4e20}, 0x2c, {[{@common=@aname={'aname', 0x3d, 'permit_directio'}}, {@sq={'sq', 0x3d, 0xffff}}], [{@fscontext={'fscontext', 0x3d, 'staff_u'}}]}}) 11:42:08 executing program 7: ioprio_set$uid(0x0, 0xee01, 0x4004) syz_mount_image$msdos(&(0x7f0000000000), &(0x7f0000000040)='./file0\x00', 0x200, 0x1, &(0x7f00000000c0)=[{&(0x7f0000000080)="7c74c7bc99e778a0c971e6f50fbdd2b70fa0b038d18c7d5ac685833434d89dce684239293aa5d8b6f11bc5c4a033ad1dc68319fad36a1101aad751fd6f4f10", 0x3f, 0x7f}], 0x42000, &(0x7f0000000100)={[{@dots}], [{@obj_user}, {@dont_appraise}, {@uid_lt}, {@hash}, {@seclabel}]}) getsockopt$inet6_IPV6_XFRM_POLICY(0xffffffffffffffff, 0x29, 0x23, &(0x7f0000000240)={{{@in=@loopback, @in6=@empty, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, {{@in6=@local}, 0x0, @in6=@mcast1}}, &(0x7f0000000340)=0xe8) mount$9p_xen(&(0x7f0000000180), &(0x7f00000001c0)='./file0\x00', &(0x7f0000000200), 0x1121061, &(0x7f0000000380)={'trans=xen,', {[{@msize={'msize', 0x3d, 0xf6b3}}, {@debug={'debug', 0x3d, 0x7ff}}, {@posixacl}, {@aname={'aname', 0x3d, '*$-&'}}, {@uname={'uname', 0x3d, 'msdos\x00'}}], [{@seclabel}, {@euid_eq={'euid', 0x3d, r0}}, {@permit_directio}, {@appraise_type}]}}) r1 = syz_io_uring_setup(0x1d4a, &(0x7f0000000440)={0x0, 0xfa85, 0x0, 0x0, 0x285}, &(0x7f0000ffd000/0x1000)=nil, &(0x7f0000ffd000/0x2000)=nil, &(0x7f00000004c0)=0x0, &(0x7f0000000500)) syz_io_uring_setup(0x3e5e, &(0x7f0000000540)={0x0, 0x5c61, 0x8, 0x2, 0x72}, &(0x7f0000ffd000/0x3000)=nil, &(0x7f0000ffc000/0x3000)=nil, &(0x7f00000005c0), &(0x7f0000000600)=0x0) syz_io_uring_submit(r2, r3, &(0x7f0000000740)=@IORING_OP_READ=@pass_buffer={0x16, 0x1, 0x2004, @fd_index=0xa, 0x7, &(0x7f0000000640)=""/227, 0xe3, 0xc, 0x1}, 0x9) ioctl$SECCOMP_IOCTL_NOTIF_ADDFD(0xffffffffffffffff, 0x40182103, &(0x7f0000000780)={0x0, 0x4, r1, 0x9, 0x80000}) openat$cgroup_devices(0xffffffffffffffff, &(0x7f00000007c0)='devices.allow\x00', 0x2, 0x0) accept(0xffffffffffffffff, 0x0, &(0x7f0000000980)) mount$9p_rdma(&(0x7f0000001040), &(0x7f0000001080)='./file0\x00', &(0x7f00000010c0), 0xa00800, &(0x7f0000001100)={'trans=rdma,', {'port', 0x3d, 0x4e20}, 0x2c, {[{@common=@aname={'aname', 0x3d, 'permit_directio'}}, {@sq={'sq', 0x3d, 0xffff}}], [{@fscontext={'fscontext', 0x3d, 'staff_u'}}]}}) 11:42:08 executing program 0: getpeername$packet(0xffffffffffffffff, &(0x7f0000000000)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @dev}, &(0x7f0000000040)=0x14) ioctl$sock_SIOCADDRT(0xffffffffffffffff, 0x890b, &(0x7f0000000080)={0x0, @phonet={0x23, 0xfe, 0x0, 0x2f}, @hci={0x1f, 0xffffffffffffffff, 0x3}, @rc={0x1f, @any, 0x2}, 0x5, 0x0, 0x0, 0x0, 0x7ff, 0x0, 0x0, 0x4, 0x4}) syz_io_uring_submit(0x0, 0x0, &(0x7f0000000100)=@IORING_OP_MADVISE={0x19, 0x3, 0x0, 0x0, 0x0, &(0x7f0000ffa000/0x2000)=nil, 0x2000, 0xb, 0x1}, 0x8) 11:42:08 executing program 1: r0 = shmget(0x2, 0x3000, 0x100, &(0x7f0000ffb000/0x3000)=nil) shmat(r0, &(0x7f0000ffa000/0x3000)=nil, 0x2000) shmat(r0, &(0x7f0000ffa000/0x4000)=nil, 0x3000) shmget(0x3, 0x1000, 0x100, &(0x7f0000ffd000/0x1000)=nil) r1 = syz_genetlink_get_family_id$netlbl_mgmt(&(0x7f0000000040), 0xffffffffffffffff) sendmsg$NLBL_MGMT_C_REMOVEDEF(0xffffffffffffffff, &(0x7f0000000100)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x8}, 0xc, &(0x7f00000000c0)={&(0x7f0000000080)={0x3c, r1, 0x20, 0x70bd29, 0x25dfdbff, {}, [@NLBL_MGMT_A_FAMILY={0x6, 0xb, 0x5}, @NLBL_MGMT_A_PROTOCOL={0x8, 0x2, 0x3}, @NLBL_MGMT_A_IPV4MASK={0x8, 0x8, @multicast1}, @NLBL_MGMT_A_CLPDOI={0x8}, @NLBL_MGMT_A_IPV4ADDR={0x8, 0x7, @local}]}, 0x3c}, 0x1, 0x0, 0x0, 0x4048820}, 0x40000) r2 = mmap$IORING_OFF_SQ_RING(&(0x7f0000ffd000/0x1000)=nil, 0x1000, 0x2000006, 0x40010, 0xffffffffffffffff, 0x0) syz_io_uring_submit(r2, 0x0, &(0x7f00000001c0)=@IORING_OP_PROVIDE_BUFFERS={0x1f, 0x1, 0x0, 0x8, 0x2, &(0x7f0000000140)="10e8e6d73f8e97a04564912d4b0bee6921be05ed083e4d741dabdbce8c94949f57a5c9d9da73d0e5ad668714159e31498f181aad79547c645eefb456a7b8c4be765eb156b77cba8a752b90d7729b2c285893a10c3633d2485f48f30d247214c5e28a", 0x7, 0x0, 0x1, {0x1}}, 0x100) recvfrom$packet(0xffffffffffffffff, &(0x7f0000000200)=""/108, 0x6c, 0x2000, &(0x7f0000000300)={0x11, 0x16, 0x0, 0x1, 0x8, 0x6, @local}, 0x14) io_uring_setup(0x14ab, &(0x7f0000000480)={0x0, 0x5191, 0x20, 0x1, 0x3ba}) shmget$private(0x0, 0x2000, 0x10, &(0x7f0000ffc000/0x2000)=nil) [ 221.179953] loop6: detected capacity change from 0 to 1 [ 221.196245] loop6: detected capacity change from 0 to 264192 [ 221.198144] nfs4: Unknown parameter '*+\[' [ 221.212217] SELinux: security_context_str_to_sid (staff_u) failed with errno=-22 [ 221.246778] loop7: detected capacity change from 0 to 1 [ 221.271110] SELinux: security_context_str_to_sid (staff_u) failed with errno=-22 11:42:16 executing program 2: clock_nanosleep(0x7, 0x0, &(0x7f0000000000)={0x77359400}, &(0x7f0000000040)) getsockopt$inet6_IPV6_XFRM_POLICY(0xffffffffffffffff, 0x29, 0x23, &(0x7f0000000080)={{{@in6, @in6=@remote, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, {{@in6=@dev}, 0x0, @in=@initdev}}, &(0x7f0000000180)=0xe8) setsockopt$packet_add_memb(0xffffffffffffffff, 0x107, 0x1, &(0x7f00000001c0)={r0, 0x1, 0x6, @broadcast}, 0x10) getpeername$packet(0xffffffffffffffff, &(0x7f0000000200)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @dev}, &(0x7f0000000240)=0x14) recvmsg(0xffffffffffffffff, &(0x7f00000027c0)={&(0x7f0000000280)=@xdp={0x2c, 0x0, 0x0}, 0x80, &(0x7f0000002640)=[{&(0x7f0000000300)=""/227, 0xe3}, {&(0x7f0000000400)=""/4096, 0x1000}, {&(0x7f0000001400)=""/92, 0x5c}, {&(0x7f0000001480)=""/93, 0x5d}, {&(0x7f0000001500)=""/4096, 0x1000}, {&(0x7f0000002500)=""/87, 0x57}, {&(0x7f0000002580)=""/189, 0xbd}], 0x7, &(0x7f00000026c0)=""/199, 0xc7}, 0x140) bind$packet(0xffffffffffffffff, &(0x7f0000002800)={0x11, 0x1b, r1, 0x1, 0x5}, 0x14) getresgid(&(0x7f0000002840), &(0x7f0000002880), &(0x7f00000028c0)) accept4$packet(0xffffffffffffffff, &(0x7f0000002900)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @multicast}, &(0x7f0000002940)=0x14, 0x80000) openat$sr(0xffffffffffffff9c, &(0x7f0000005480), 0x428802, 0x0) 11:42:16 executing program 0: getpeername$packet(0xffffffffffffffff, &(0x7f0000000000)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @dev}, &(0x7f0000000040)=0x14) syz_io_uring_submit(0x0, 0x0, &(0x7f0000000100)=@IORING_OP_MADVISE={0x19, 0x3, 0x0, 0x0, 0x0, &(0x7f0000ffa000/0x2000)=nil, 0x2000, 0xb, 0x1}, 0x8) 11:42:16 executing program 6: ioprio_set$uid(0x0, 0xee01, 0x4004) syz_mount_image$msdos(&(0x7f0000000000), &(0x7f0000000040)='./file0\x00', 0x200, 0x1, &(0x7f00000000c0)=[{&(0x7f0000000080)="7c74c7bc99e778a0c971e6f50fbdd2b70fa0b038d18c7d5ac685833434d89dce684239293aa5d8b6f11bc5c4a033ad1dc68319fad36a1101aad751fd6f4f10", 0x3f, 0x7f}], 0x42000, &(0x7f0000000100)={[{@dots}], [{@obj_user}, {@dont_appraise}, {@uid_lt}, {@hash}, {@seclabel}]}) getsockopt$inet6_IPV6_XFRM_POLICY(0xffffffffffffffff, 0x29, 0x23, &(0x7f0000000240)={{{@in=@loopback, @in6=@empty, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, {{@in6=@local}, 0x0, @in6=@mcast1}}, &(0x7f0000000340)=0xe8) mount$9p_xen(&(0x7f0000000180), &(0x7f00000001c0)='./file0\x00', &(0x7f0000000200), 0x1121061, &(0x7f0000000380)={'trans=xen,', {[{@msize={'msize', 0x3d, 0xf6b3}}, {@debug={'debug', 0x3d, 0x7ff}}, {@posixacl}, {@aname={'aname', 0x3d, '*$-&'}}, {@uname={'uname', 0x3d, 'msdos\x00'}}], [{@seclabel}, {@euid_eq={'euid', 0x3d, r0}}, {@permit_directio}, {@appraise_type}]}}) r1 = syz_io_uring_setup(0x1d4a, &(0x7f0000000440)={0x0, 0xfa85, 0x0, 0x0, 0x285}, &(0x7f0000ffd000/0x1000)=nil, &(0x7f0000ffd000/0x2000)=nil, &(0x7f00000004c0)=0x0, &(0x7f0000000500)) syz_io_uring_setup(0x3e5e, &(0x7f0000000540)={0x0, 0x5c61, 0x8, 0x2, 0x72}, &(0x7f0000ffd000/0x3000)=nil, &(0x7f0000ffc000/0x3000)=nil, &(0x7f00000005c0), &(0x7f0000000600)=0x0) syz_io_uring_submit(r2, r3, &(0x7f0000000740)=@IORING_OP_READ=@pass_buffer={0x16, 0x1, 0x2004, @fd_index=0xa, 0x7, &(0x7f0000000640)=""/227, 0xe3, 0xc, 0x1}, 0x9) ioctl$SECCOMP_IOCTL_NOTIF_ADDFD(0xffffffffffffffff, 0x40182103, &(0x7f0000000780)={0x0, 0x4, r1, 0x9, 0x80000}) syz_mount_image$nfs4(&(0x7f0000000800), &(0x7f0000000840)='./file0/file0\x00', 0xffffffffffffff01, 0x1, &(0x7f0000000900)=[{&(0x7f0000000880)="f19bd7cfef39dd2070dcb194f7bd90ce305e2a9644b9fb91cc1e75bca69ed6bbdd7636452963af395ea61189cce718ef43420310b6ff8db9f4a606d67217b1aa7bf6e1435682323aef92ef40d036c48fa3fc363c6ad63229bb37cd76a6db9879a39f", 0x62, 0x6}], 0x8400, &(0x7f0000000940)={[{'*+\\['}]}) accept(0xffffffffffffffff, 0x0, &(0x7f0000000980)) mount$9p_rdma(&(0x7f0000001040), &(0x7f0000001080)='./file0\x00', &(0x7f00000010c0), 0xa00800, &(0x7f0000001100)={'trans=rdma,', {'port', 0x3d, 0x4e20}, 0x2c, {[{@common=@aname={'aname', 0x3d, 'permit_directio'}}, {@sq={'sq', 0x3d, 0xffff}}], [{@fscontext={'fscontext', 0x3d, 'staff_u'}}]}}) 11:42:16 executing program 4: setsockopt$inet_tcp_TCP_QUEUE_SEQ(0xffffffffffffffff, 0x6, 0x15, &(0x7f0000000000), 0x4) socket$inet_tcp(0x2, 0x1, 0x0) syz_genetlink_get_family_id$netlbl_mgmt(&(0x7f0000000440), 0xffffffffffffffff) syz_genetlink_get_family_id$netlbl_mgmt(&(0x7f0000000740), 0xffffffffffffffff) 11:42:16 executing program 7: ioprio_set$uid(0x0, 0xee01, 0x4004) syz_mount_image$msdos(&(0x7f0000000000), &(0x7f0000000040)='./file0\x00', 0x200, 0x1, &(0x7f00000000c0)=[{&(0x7f0000000080)="7c74c7bc99e778a0c971e6f50fbdd2b70fa0b038d18c7d5ac685833434d89dce684239293aa5d8b6f11bc5c4a033ad1dc68319fad36a1101aad751fd6f4f10", 0x3f, 0x7f}], 0x42000, &(0x7f0000000100)={[{@dots}], [{@obj_user}, {@dont_appraise}, {@uid_lt}, {@hash}, {@seclabel}]}) getsockopt$inet6_IPV6_XFRM_POLICY(0xffffffffffffffff, 0x29, 0x23, &(0x7f0000000240)={{{@in=@loopback, @in6=@empty, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, {{@in6=@local}, 0x0, @in6=@mcast1}}, &(0x7f0000000340)=0xe8) mount$9p_xen(&(0x7f0000000180), &(0x7f00000001c0)='./file0\x00', &(0x7f0000000200), 0x1121061, &(0x7f0000000380)={'trans=xen,', {[{@msize={'msize', 0x3d, 0xf6b3}}, {@debug={'debug', 0x3d, 0x7ff}}, {@posixacl}, {@aname={'aname', 0x3d, '*$-&'}}, {@uname={'uname', 0x3d, 'msdos\x00'}}], [{@seclabel}, {@euid_eq={'euid', 0x3d, r0}}, {@permit_directio}, {@appraise_type}]}}) r1 = syz_io_uring_setup(0x1d4a, &(0x7f0000000440)={0x0, 0xfa85, 0x0, 0x0, 0x285}, &(0x7f0000ffd000/0x1000)=nil, &(0x7f0000ffd000/0x2000)=nil, &(0x7f00000004c0)=0x0, &(0x7f0000000500)) syz_io_uring_setup(0x3e5e, &(0x7f0000000540)={0x0, 0x5c61, 0x8, 0x2, 0x72}, &(0x7f0000ffd000/0x3000)=nil, &(0x7f0000ffc000/0x3000)=nil, &(0x7f00000005c0), &(0x7f0000000600)=0x0) syz_io_uring_submit(r2, r3, &(0x7f0000000740)=@IORING_OP_READ=@pass_buffer={0x16, 0x1, 0x2004, @fd_index=0xa, 0x7, &(0x7f0000000640)=""/227, 0xe3, 0xc, 0x1}, 0x9) ioctl$SECCOMP_IOCTL_NOTIF_ADDFD(0xffffffffffffffff, 0x40182103, &(0x7f0000000780)={0x0, 0x4, r1, 0x9, 0x80000}) openat$cgroup_devices(0xffffffffffffffff, &(0x7f00000007c0)='devices.allow\x00', 0x2, 0x0) accept(0xffffffffffffffff, 0x0, &(0x7f0000000980)) mount$9p_rdma(&(0x7f0000001040), &(0x7f0000001080)='./file0\x00', &(0x7f00000010c0), 0xa00800, &(0x7f0000001100)={'trans=rdma,', {'port', 0x3d, 0x4e20}, 0x2c, {[{@common=@aname={'aname', 0x3d, 'permit_directio'}}, {@sq={'sq', 0x3d, 0xffff}}], [{@fscontext={'fscontext', 0x3d, 'staff_u'}}]}}) 11:42:16 executing program 1: r0 = shmget(0x2, 0x3000, 0x100, &(0x7f0000ffb000/0x3000)=nil) shmat(r0, &(0x7f0000ffa000/0x3000)=nil, 0x2000) shmat(r0, &(0x7f0000ffa000/0x4000)=nil, 0x3000) shmget(0x3, 0x1000, 0x100, &(0x7f0000ffd000/0x1000)=nil) syz_genetlink_get_family_id$netlbl_mgmt(&(0x7f0000000040), 0xffffffffffffffff) r1 = mmap$IORING_OFF_SQ_RING(&(0x7f0000ffd000/0x1000)=nil, 0x1000, 0x2000006, 0x40010, 0xffffffffffffffff, 0x0) syz_io_uring_submit(r1, 0x0, &(0x7f00000001c0)=@IORING_OP_PROVIDE_BUFFERS={0x1f, 0x1, 0x0, 0x8, 0x2, &(0x7f0000000140)="10e8e6d73f8e97a04564912d4b0bee6921be05ed083e4d741dabdbce8c94949f57a5c9d9da73d0e5ad668714159e31498f181aad79547c645eefb456a7b8c4be765eb156b77cba8a752b90d7729b2c285893a10c3633d2485f48f30d247214c5e28a", 0x7, 0x0, 0x1, {0x1}}, 0x100) recvfrom$packet(0xffffffffffffffff, &(0x7f0000000200)=""/108, 0x6c, 0x2000, &(0x7f0000000300)={0x11, 0x16, 0x0, 0x1, 0x8, 0x6, @local}, 0x14) io_uring_setup(0x14ab, &(0x7f0000000480)={0x0, 0x5191, 0x20, 0x1, 0x3ba}) shmget$private(0x0, 0x2000, 0x10, &(0x7f0000ffc000/0x2000)=nil) 11:42:16 executing program 3: ioctl$SG_SET_FORCE_PACK_ID(0xffffffffffffffff, 0x227b, &(0x7f0000000000)=0x1) ioctl$SG_SET_FORCE_PACK_ID(0xffffffffffffffff, 0x227b, &(0x7f0000000040)) ioctl$SG_GET_RESERVED_SIZE(0xffffffffffffffff, 0x2272, &(0x7f0000000080)) r0 = openat$vcsa(0xffffffffffffff9c, &(0x7f00000000c0), 0x4200, 0x0) ioctl$SCSI_IOCTL_SEND_COMMAND(r0, 0x1, &(0x7f0000000100)={0x17, 0x3, 0x1c00, "af36a59fb168d324fd8eaf833aeb82f60d75e8700d81d9"}) ioctl$SG_SET_TIMEOUT(r0, 0x2201, &(0x7f0000000140)=0x4) ioctl$SG_GET_VERSION_NUM(r0, 0x2282, &(0x7f0000000180)) ioctl$SG_GET_REQUEST_TABLE(r0, 0x2286, &(0x7f00000001c0)) r1 = syz_open_dev$sg(&(0x7f0000000340), 0x7fff, 0x40) ioctl$SG_EMULATED_HOST(r1, 0x2203, &(0x7f0000000380)) r2 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$inet6_tcp_TCP_CONGESTION(r2, 0x6, 0xd, &(0x7f0000000440)='scalable\x00', 0x9) 11:42:16 executing program 5: openat$vcsa(0xffffffffffffff9c, &(0x7f0000000580), 0x0, 0x0) setsockopt$inet6_tcp_TCP_QUEUE_SEQ(0xffffffffffffffff, 0x6, 0x15, &(0x7f0000000780)=0x400, 0x4) [ 229.300250] loop6: detected capacity change from 0 to 1 [ 229.316338] loop6: detected capacity change from 0 to 264192 [ 229.320276] nfs4: Unknown parameter '*+\[' [ 229.323725] loop7: detected capacity change from 0 to 1 11:42:16 executing program 5: openat$vcsa(0xffffffffffffff9c, &(0x7f0000000580), 0x0, 0x0) setsockopt$inet6_tcp_TCP_QUEUE_SEQ(0xffffffffffffffff, 0x6, 0x15, &(0x7f0000000780)=0x400, 0x4) [ 229.335836] SELinux: security_context_str_to_sid (staff_u) failed with errno=-22 [ 229.346893] SELinux: security_context_str_to_sid (staff_u) failed with errno=-22 11:42:16 executing program 6: ioprio_set$uid(0x0, 0xee01, 0x4004) syz_mount_image$msdos(&(0x7f0000000000), &(0x7f0000000040)='./file0\x00', 0x200, 0x1, &(0x7f00000000c0)=[{&(0x7f0000000080)="7c74c7bc99e778a0c971e6f50fbdd2b70fa0b038d18c7d5ac685833434d89dce684239293aa5d8b6f11bc5c4a033ad1dc68319fad36a1101aad751fd6f4f10", 0x3f, 0x7f}], 0x42000, &(0x7f0000000100)={[{@dots}], [{@obj_user}, {@dont_appraise}, {@uid_lt}, {@hash}, {@seclabel}]}) getsockopt$inet6_IPV6_XFRM_POLICY(0xffffffffffffffff, 0x29, 0x23, &(0x7f0000000240)={{{@in=@loopback, @in6=@empty, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, {{@in6=@local}, 0x0, @in6=@mcast1}}, &(0x7f0000000340)=0xe8) mount$9p_xen(&(0x7f0000000180), &(0x7f00000001c0)='./file0\x00', &(0x7f0000000200), 0x1121061, &(0x7f0000000380)={'trans=xen,', {[{@msize={'msize', 0x3d, 0xf6b3}}, {@debug={'debug', 0x3d, 0x7ff}}, {@posixacl}, {@aname={'aname', 0x3d, '*$-&'}}, {@uname={'uname', 0x3d, 'msdos\x00'}}], [{@seclabel}, {@euid_eq={'euid', 0x3d, r0}}, {@permit_directio}, {@appraise_type}]}}) r1 = syz_io_uring_setup(0x1d4a, &(0x7f0000000440)={0x0, 0xfa85, 0x0, 0x0, 0x285}, &(0x7f0000ffd000/0x1000)=nil, &(0x7f0000ffd000/0x2000)=nil, &(0x7f00000004c0)=0x0, &(0x7f0000000500)) syz_io_uring_setup(0x3e5e, &(0x7f0000000540)={0x0, 0x5c61, 0x8, 0x2, 0x72}, &(0x7f0000ffd000/0x3000)=nil, &(0x7f0000ffc000/0x3000)=nil, &(0x7f00000005c0), &(0x7f0000000600)=0x0) syz_io_uring_submit(r2, r3, &(0x7f0000000740)=@IORING_OP_READ=@pass_buffer={0x16, 0x1, 0x2004, @fd_index=0xa, 0x7, &(0x7f0000000640)=""/227, 0xe3, 0xc, 0x1}, 0x9) ioctl$SECCOMP_IOCTL_NOTIF_ADDFD(0xffffffffffffffff, 0x40182103, &(0x7f0000000780)={0x0, 0x4, r1, 0x9, 0x80000}) syz_mount_image$nfs4(&(0x7f0000000800), &(0x7f0000000840)='./file0/file0\x00', 0xffffffffffffff01, 0x1, &(0x7f0000000900)=[{&(0x7f0000000880)="f19bd7cfef39dd2070dcb194f7bd90ce305e2a9644b9fb91cc1e75bca69ed6bbdd7636452963af395ea61189cce718ef43420310b6ff8db9f4a606d67217b1aa7bf6e1435682323aef92ef40d036c48fa3fc363c6ad63229bb37cd76a6db9879a39f", 0x62, 0x6}], 0x8400, &(0x7f0000000940)={[{'*+\\['}]}) accept(0xffffffffffffffff, 0x0, &(0x7f0000000980)) mount$9p_rdma(&(0x7f0000001040), &(0x7f0000001080)='./file0\x00', &(0x7f00000010c0), 0xa00800, &(0x7f0000001100)={'trans=rdma,', {'port', 0x3d, 0x4e20}, 0x2c, {[{@common=@aname={'aname', 0x3d, 'permit_directio'}}, {@sq={'sq', 0x3d, 0xffff}}], [{@fscontext={'fscontext', 0x3d, 'staff_u'}}]}}) 11:42:16 executing program 0: syz_io_uring_submit(0x0, 0x0, &(0x7f0000000100)=@IORING_OP_MADVISE={0x19, 0x3, 0x0, 0x0, 0x0, &(0x7f0000ffa000/0x2000)=nil, 0x2000, 0xb, 0x1}, 0x8) [ 229.443983] loop6: detected capacity change from 0 to 1 [ 229.481756] loop6: detected capacity change from 0 to 264192 [ 229.483365] nfs4: Unknown parameter '*+\[' [ 229.487584] SELinux: security_context_str_to_sid (staff_u) failed with errno=-22 11:42:25 executing program 4: setsockopt$inet_tcp_TCP_QUEUE_SEQ(0xffffffffffffffff, 0x6, 0x15, &(0x7f0000000000), 0x4) socket$inet_tcp(0x2, 0x1, 0x0) syz_genetlink_get_family_id$netlbl_mgmt(&(0x7f0000000440), 0xffffffffffffffff) syz_genetlink_get_family_id$netlbl_mgmt(&(0x7f0000000740), 0xffffffffffffffff) 11:42:25 executing program 5: r0 = openat$vcsa(0xffffffffffffff9c, &(0x7f0000000580), 0x0, 0x0) setsockopt$inet6_tcp_TCP_QUEUE_SEQ(r0, 0x6, 0x15, 0x0, 0x0) 11:42:25 executing program 0: syz_io_uring_submit(0x0, 0x0, 0x0, 0x8) 11:42:25 executing program 7: ioprio_set$uid(0x0, 0xee01, 0x4004) syz_mount_image$msdos(&(0x7f0000000000), &(0x7f0000000040)='./file0\x00', 0x200, 0x1, &(0x7f00000000c0)=[{&(0x7f0000000080)="7c74c7bc99e778a0c971e6f50fbdd2b70fa0b038d18c7d5ac685833434d89dce684239293aa5d8b6f11bc5c4a033ad1dc68319fad36a1101aad751fd6f4f10", 0x3f, 0x7f}], 0x42000, &(0x7f0000000100)={[{@dots}], [{@obj_user}, {@dont_appraise}, {@uid_lt}, {@hash}, {@seclabel}]}) getsockopt$inet6_IPV6_XFRM_POLICY(0xffffffffffffffff, 0x29, 0x23, &(0x7f0000000240)={{{@in=@loopback, @in6=@empty, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, {{@in6=@local}, 0x0, @in6=@mcast1}}, &(0x7f0000000340)=0xe8) mount$9p_xen(&(0x7f0000000180), &(0x7f00000001c0)='./file0\x00', &(0x7f0000000200), 0x1121061, &(0x7f0000000380)={'trans=xen,', {[{@msize={'msize', 0x3d, 0xf6b3}}, {@debug={'debug', 0x3d, 0x7ff}}, {@posixacl}, {@aname={'aname', 0x3d, '*$-&'}}, {@uname={'uname', 0x3d, 'msdos\x00'}}], [{@seclabel}, {@euid_eq={'euid', 0x3d, r0}}, {@permit_directio}, {@appraise_type}]}}) r1 = syz_io_uring_setup(0x1d4a, &(0x7f0000000440)={0x0, 0xfa85, 0x0, 0x0, 0x285}, &(0x7f0000ffd000/0x1000)=nil, &(0x7f0000ffd000/0x2000)=nil, &(0x7f00000004c0)=0x0, &(0x7f0000000500)) syz_io_uring_setup(0x3e5e, &(0x7f0000000540)={0x0, 0x5c61, 0x8, 0x2, 0x72}, &(0x7f0000ffd000/0x3000)=nil, &(0x7f0000ffc000/0x3000)=nil, &(0x7f00000005c0), &(0x7f0000000600)=0x0) syz_io_uring_submit(r2, r3, &(0x7f0000000740)=@IORING_OP_READ=@pass_buffer={0x16, 0x1, 0x2004, @fd_index=0xa, 0x7, &(0x7f0000000640)=""/227, 0xe3, 0xc, 0x1}, 0x9) ioctl$SECCOMP_IOCTL_NOTIF_ADDFD(0xffffffffffffffff, 0x40182103, &(0x7f0000000780)={0x0, 0x4, r1, 0x9, 0x80000}) openat$cgroup_devices(0xffffffffffffffff, &(0x7f00000007c0)='devices.allow\x00', 0x2, 0x0) accept(0xffffffffffffffff, 0x0, &(0x7f0000000980)) mount$9p_rdma(&(0x7f0000001040), &(0x7f0000001080)='./file0\x00', &(0x7f00000010c0), 0xa00800, &(0x7f0000001100)={'trans=rdma,', {'port', 0x3d, 0x4e20}, 0x2c, {[{@common=@aname={'aname', 0x3d, 'permit_directio'}}, {@sq={'sq', 0x3d, 0xffff}}], [{@fscontext={'fscontext', 0x3d, 'staff_u'}}]}}) 11:42:25 executing program 3: ioctl$SG_SET_FORCE_PACK_ID(0xffffffffffffffff, 0x227b, &(0x7f0000000000)=0x1) ioctl$SG_SET_FORCE_PACK_ID(0xffffffffffffffff, 0x227b, &(0x7f0000000040)) ioctl$SG_GET_RESERVED_SIZE(0xffffffffffffffff, 0x2272, &(0x7f0000000080)) r0 = openat$vcsa(0xffffffffffffff9c, &(0x7f00000000c0), 0x4200, 0x0) ioctl$SCSI_IOCTL_SEND_COMMAND(r0, 0x1, &(0x7f0000000100)={0x17, 0x3, 0x1c00, "af36a59fb168d324fd8eaf833aeb82f60d75e8700d81d9"}) ioctl$SG_SET_TIMEOUT(r0, 0x2201, &(0x7f0000000140)=0x4) ioctl$SG_GET_VERSION_NUM(r0, 0x2282, &(0x7f0000000180)) ioctl$SG_GET_TIMEOUT(r0, 0x2202, 0x0) r1 = syz_open_dev$sg(&(0x7f0000000340), 0x7fff, 0x40) ioctl$SG_EMULATED_HOST(r1, 0x2203, &(0x7f0000000380)) r2 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$inet6_tcp_TCP_CONGESTION(r2, 0x6, 0xd, &(0x7f0000000440)='scalable\x00', 0x9) 11:42:25 executing program 6: ioprio_set$uid(0x0, 0xee01, 0x4004) syz_mount_image$msdos(&(0x7f0000000000), &(0x7f0000000040)='./file0\x00', 0x200, 0x1, &(0x7f00000000c0)=[{&(0x7f0000000080)="7c74c7bc99e778a0c971e6f50fbdd2b70fa0b038d18c7d5ac685833434d89dce684239293aa5d8b6f11bc5c4a033ad1dc68319fad36a1101aad751fd6f4f10", 0x3f, 0x7f}], 0x42000, &(0x7f0000000100)={[{@dots}], [{@obj_user}, {@dont_appraise}, {@uid_lt}, {@hash}, {@seclabel}]}) getsockopt$inet6_IPV6_XFRM_POLICY(0xffffffffffffffff, 0x29, 0x23, &(0x7f0000000240)={{{@in=@loopback, @in6=@empty, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, {{@in6=@local}, 0x0, @in6=@mcast1}}, &(0x7f0000000340)=0xe8) mount$9p_xen(&(0x7f0000000180), &(0x7f00000001c0)='./file0\x00', &(0x7f0000000200), 0x1121061, &(0x7f0000000380)={'trans=xen,', {[{@msize={'msize', 0x3d, 0xf6b3}}, {@debug={'debug', 0x3d, 0x7ff}}, {@posixacl}, {@aname={'aname', 0x3d, '*$-&'}}, {@uname={'uname', 0x3d, 'msdos\x00'}}], [{@seclabel}, {@euid_eq={'euid', 0x3d, r0}}, {@permit_directio}, {@appraise_type}]}}) syz_io_uring_setup(0x1d4a, &(0x7f0000000440)={0x0, 0xfa85, 0x0, 0x0, 0x285}, &(0x7f0000ffd000/0x1000)=nil, &(0x7f0000ffd000/0x2000)=nil, &(0x7f00000004c0)=0x0, &(0x7f0000000500)) syz_io_uring_setup(0x3e5e, &(0x7f0000000540)={0x0, 0x5c61, 0x8, 0x2, 0x72}, &(0x7f0000ffd000/0x3000)=nil, &(0x7f0000ffc000/0x3000)=nil, &(0x7f00000005c0), &(0x7f0000000600)=0x0) syz_io_uring_submit(r1, r2, &(0x7f0000000740)=@IORING_OP_READ=@pass_buffer={0x16, 0x1, 0x2004, @fd_index=0xa, 0x7, &(0x7f0000000640)=""/227, 0xe3, 0xc, 0x1}, 0x9) openat$cgroup_devices(0xffffffffffffffff, &(0x7f00000007c0)='devices.allow\x00', 0x2, 0x0) syz_mount_image$nfs4(&(0x7f0000000800), &(0x7f0000000840)='./file0/file0\x00', 0xffffffffffffff01, 0x1, &(0x7f0000000900)=[{&(0x7f0000000880)="f19bd7cfef39dd2070dcb194f7bd90ce305e2a9644b9fb91cc1e75bca69ed6bbdd7636452963af395ea61189cce718ef43420310b6ff8db9f4a606d67217b1aa7bf6e1435682323aef92ef40d036c48fa3fc363c6ad63229bb37cd76a6db9879a39f", 0x62, 0x6}], 0x8400, &(0x7f0000000940)={[{'*+\\['}]}) accept(0xffffffffffffffff, 0x0, &(0x7f0000000980)) mount$9p_rdma(&(0x7f0000001040), &(0x7f0000001080)='./file0\x00', &(0x7f00000010c0), 0xa00800, &(0x7f0000001100)={'trans=rdma,', {'port', 0x3d, 0x4e20}, 0x2c, {[{@common=@aname={'aname', 0x3d, 'permit_directio'}}, {@sq={'sq', 0x3d, 0xffff}}], [{@fscontext={'fscontext', 0x3d, 'staff_u'}}]}}) 11:42:25 executing program 2: clock_nanosleep(0x7, 0x0, &(0x7f0000000000)={0x77359400}, &(0x7f0000000040)) getsockopt$inet6_IPV6_XFRM_POLICY(0xffffffffffffffff, 0x29, 0x23, &(0x7f0000000080)={{{@in6, @in6=@remote, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, {{@in6=@dev}, 0x0, @in=@initdev}}, &(0x7f0000000180)=0xe8) setsockopt$packet_add_memb(0xffffffffffffffff, 0x107, 0x1, &(0x7f00000001c0)={r0, 0x1, 0x6, @broadcast}, 0x10) getpeername$packet(0xffffffffffffffff, &(0x7f0000000200)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @dev}, &(0x7f0000000240)=0x14) recvmsg(0xffffffffffffffff, &(0x7f00000027c0)={&(0x7f0000000280)=@xdp={0x2c, 0x0, 0x0}, 0x80, &(0x7f0000002640)=[{&(0x7f0000000300)=""/227, 0xe3}, {&(0x7f0000000400)=""/4096, 0x1000}, {&(0x7f0000001400)=""/92, 0x5c}, {&(0x7f0000001480)=""/93, 0x5d}, {&(0x7f0000001500)=""/4096, 0x1000}, {&(0x7f0000002500)=""/87, 0x57}, {&(0x7f0000002580)=""/189, 0xbd}], 0x7, &(0x7f00000026c0)=""/199, 0xc7}, 0x140) bind$packet(0xffffffffffffffff, &(0x7f0000002800)={0x11, 0x1b, r1, 0x1, 0x5}, 0x14) getresgid(&(0x7f0000002840), &(0x7f0000002880), &(0x7f00000028c0)) openat$sr(0xffffffffffffff9c, &(0x7f0000005480), 0x428802, 0x0) 11:42:25 executing program 1: r0 = shmget(0x2, 0x3000, 0x100, &(0x7f0000ffb000/0x3000)=nil) shmat(r0, &(0x7f0000ffa000/0x3000)=nil, 0x2000) shmat(r0, &(0x7f0000ffa000/0x4000)=nil, 0x3000) shmget(0x3, 0x1000, 0x100, &(0x7f0000ffd000/0x1000)=nil) r1 = mmap$IORING_OFF_SQ_RING(&(0x7f0000ffd000/0x1000)=nil, 0x1000, 0x2000006, 0x40010, 0xffffffffffffffff, 0x0) syz_io_uring_submit(r1, 0x0, &(0x7f00000001c0)=@IORING_OP_PROVIDE_BUFFERS={0x1f, 0x1, 0x0, 0x8, 0x2, &(0x7f0000000140)="10e8e6d73f8e97a04564912d4b0bee6921be05ed083e4d741dabdbce8c94949f57a5c9d9da73d0e5ad668714159e31498f181aad79547c645eefb456a7b8c4be765eb156b77cba8a752b90d7729b2c285893a10c3633d2485f48f30d247214c5e28a", 0x7, 0x0, 0x1, {0x1}}, 0x100) recvfrom$packet(0xffffffffffffffff, &(0x7f0000000200)=""/108, 0x6c, 0x2000, &(0x7f0000000300)={0x11, 0x16, 0x0, 0x1, 0x8, 0x6, @local}, 0x14) io_uring_setup(0x14ab, &(0x7f0000000480)={0x0, 0x5191, 0x20, 0x1, 0x3ba}) shmget$private(0x0, 0x2000, 0x10, &(0x7f0000ffc000/0x2000)=nil) [ 238.310508] loop6: detected capacity change from 0 to 1 [ 238.328619] loop6: detected capacity change from 0 to 264192 [ 238.332183] nfs4: Unknown parameter '*+\[' [ 238.335024] SELinux: security_context_str_to_sid (staff_u) failed with errno=-22 [ 238.365539] loop7: detected capacity change from 0 to 1 11:42:25 executing program 5: r0 = shmget(0x2, 0x3000, 0x100, &(0x7f0000ffb000/0x3000)=nil) shmat(r0, &(0x7f0000ffa000/0x3000)=nil, 0x2000) shmat(r0, &(0x7f0000ffa000/0x4000)=nil, 0x3000) shmget(0x3, 0x1000, 0x100, &(0x7f0000ffd000/0x1000)=nil) syz_genetlink_get_family_id$netlbl_mgmt(&(0x7f0000000040), 0xffffffffffffffff) r1 = mmap$IORING_OFF_SQ_RING(&(0x7f0000ffd000/0x1000)=nil, 0x1000, 0x2000006, 0x40010, 0xffffffffffffffff, 0x0) syz_io_uring_submit(r1, 0x0, &(0x7f00000001c0)=@IORING_OP_PROVIDE_BUFFERS={0x1f, 0x1, 0x0, 0x8, 0x2, &(0x7f0000000140)="10e8e6d73f8e97a04564912d4b0bee6921be05ed083e4d741dabdbce8c94949f57a5c9d9da73d0e5ad668714159e31498f181aad79547c645eefb456a7b8c4be765eb156b77cba8a752b90d7729b2c285893a10c3633d2485f48f30d247214c5e28a", 0x7, 0x0, 0x1, {0x1}}, 0x100) recvfrom$packet(0xffffffffffffffff, &(0x7f0000000200)=""/108, 0x6c, 0x2000, &(0x7f0000000300)={0x11, 0x16, 0x0, 0x1, 0x8, 0x6, @local}, 0x14) io_uring_setup(0x14ab, &(0x7f0000000480)={0x0, 0x5191, 0x20, 0x1, 0x3ba}) shmget$private(0x0, 0x2000, 0x10, &(0x7f0000ffc000/0x2000)=nil) [ 238.406276] SELinux: security_context_str_to_sid (staff_u) failed with errno=-22 11:42:34 executing program 5: r0 = shmget(0x2, 0x3000, 0x100, &(0x7f0000ffb000/0x3000)=nil) shmat(r0, &(0x7f0000ffa000/0x3000)=nil, 0x2000) shmat(r0, &(0x7f0000ffa000/0x4000)=nil, 0x3000) shmget(0x3, 0x1000, 0x100, &(0x7f0000ffd000/0x1000)=nil) syz_genetlink_get_family_id$netlbl_mgmt(&(0x7f0000000040), 0xffffffffffffffff) r1 = mmap$IORING_OFF_SQ_RING(&(0x7f0000ffd000/0x1000)=nil, 0x1000, 0x2000006, 0x40010, 0xffffffffffffffff, 0x0) syz_io_uring_submit(r1, 0x0, &(0x7f00000001c0)=@IORING_OP_PROVIDE_BUFFERS={0x1f, 0x1, 0x0, 0x8, 0x2, &(0x7f0000000140)="10e8e6d73f8e97a04564912d4b0bee6921be05ed083e4d741dabdbce8c94949f57a5c9d9da73d0e5ad668714159e31498f181aad79547c645eefb456a7b8c4be765eb156b77cba8a752b90d7729b2c285893a10c3633d2485f48f30d247214c5e28a", 0x7, 0x0, 0x1, {0x1}}, 0x100) recvfrom$packet(0xffffffffffffffff, &(0x7f0000000200)=""/108, 0x6c, 0x2000, &(0x7f0000000300)={0x11, 0x16, 0x0, 0x1, 0x8, 0x6, @local}, 0x14) io_uring_setup(0x14ab, &(0x7f0000000480)={0x0, 0x5191, 0x20, 0x1, 0x3ba}) shmget$private(0x0, 0x2000, 0x10, &(0x7f0000ffc000/0x2000)=nil) 11:42:34 executing program 2: clock_nanosleep(0x7, 0x0, &(0x7f0000000000)={0x77359400}, &(0x7f0000000040)) getsockopt$inet6_IPV6_XFRM_POLICY(0xffffffffffffffff, 0x29, 0x23, &(0x7f0000000080)={{{@in6, @in6=@remote, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, {{@in6=@dev}, 0x0, @in=@initdev}}, &(0x7f0000000180)=0xe8) setsockopt$packet_add_memb(0xffffffffffffffff, 0x107, 0x1, &(0x7f00000001c0)={r0, 0x1, 0x6, @broadcast}, 0x10) getpeername$packet(0xffffffffffffffff, &(0x7f0000000200)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @dev}, &(0x7f0000000240)=0x14) recvmsg(0xffffffffffffffff, &(0x7f00000027c0)={&(0x7f0000000280)=@xdp={0x2c, 0x0, 0x0}, 0x80, &(0x7f0000002640)=[{&(0x7f0000000300)=""/227, 0xe3}, {&(0x7f0000000400)=""/4096, 0x1000}, {&(0x7f0000001400)=""/92, 0x5c}, {&(0x7f0000001480)=""/93, 0x5d}, {&(0x7f0000001500)=""/4096, 0x1000}, {&(0x7f0000002500)=""/87, 0x57}, {&(0x7f0000002580)=""/189, 0xbd}], 0x7, &(0x7f00000026c0)=""/199, 0xc7}, 0x140) bind$packet(0xffffffffffffffff, &(0x7f0000002800)={0x11, 0x1b, r1, 0x1, 0x5}, 0x14) openat$sr(0xffffffffffffff9c, &(0x7f0000005480), 0x428802, 0x0) 11:42:34 executing program 3: ioctl$SG_SET_FORCE_PACK_ID(0xffffffffffffffff, 0x227b, &(0x7f0000000000)=0x1) ioctl$SG_SET_FORCE_PACK_ID(0xffffffffffffffff, 0x227b, &(0x7f0000000040)) ioctl$SG_GET_RESERVED_SIZE(0xffffffffffffffff, 0x2272, &(0x7f0000000080)) r0 = openat$vcsa(0xffffffffffffff9c, &(0x7f00000000c0), 0x4200, 0x0) ioctl$SCSI_IOCTL_SEND_COMMAND(r0, 0x1, &(0x7f0000000100)={0x17, 0x3, 0x1c00, "af36a59fb168d324fd8eaf833aeb82f60d75e8700d81d9"}) ioctl$SG_SET_TIMEOUT(r0, 0x2201, &(0x7f0000000140)=0x4) ioctl$SG_GET_VERSION_NUM(r0, 0x2282, &(0x7f0000000180)) ioctl$SG_GET_TIMEOUT(r0, 0x2202, 0x0) r1 = syz_open_dev$sg(&(0x7f0000000340), 0x7fff, 0x40) ioctl$SG_EMULATED_HOST(r1, 0x2203, &(0x7f0000000380)) r2 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$inet6_tcp_TCP_CONGESTION(r2, 0x6, 0xd, &(0x7f0000000440)='scalable\x00', 0x9) 11:42:34 executing program 7: ioprio_set$uid(0x0, 0xee01, 0x4004) syz_mount_image$msdos(&(0x7f0000000000), &(0x7f0000000040)='./file0\x00', 0x200, 0x1, &(0x7f00000000c0)=[{&(0x7f0000000080)="7c74c7bc99e778a0c971e6f50fbdd2b70fa0b038d18c7d5ac685833434d89dce684239293aa5d8b6f11bc5c4a033ad1dc68319fad36a1101aad751fd6f4f10", 0x3f, 0x7f}], 0x42000, &(0x7f0000000100)={[{@dots}], [{@obj_user}, {@dont_appraise}, {@uid_lt}, {@hash}, {@seclabel}]}) getsockopt$inet6_IPV6_XFRM_POLICY(0xffffffffffffffff, 0x29, 0x23, &(0x7f0000000240)={{{@in=@loopback, @in6=@empty, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, {{@in6=@local}, 0x0, @in6=@mcast1}}, &(0x7f0000000340)=0xe8) mount$9p_xen(&(0x7f0000000180), &(0x7f00000001c0)='./file0\x00', &(0x7f0000000200), 0x1121061, &(0x7f0000000380)={'trans=xen,', {[{@msize={'msize', 0x3d, 0xf6b3}}, {@debug={'debug', 0x3d, 0x7ff}}, {@posixacl}, {@aname={'aname', 0x3d, '*$-&'}}, {@uname={'uname', 0x3d, 'msdos\x00'}}], [{@seclabel}, {@euid_eq={'euid', 0x3d, r0}}, {@permit_directio}, {@appraise_type}]}}) r1 = syz_io_uring_setup(0x1d4a, &(0x7f0000000440)={0x0, 0xfa85, 0x0, 0x0, 0x285}, &(0x7f0000ffd000/0x1000)=nil, &(0x7f0000ffd000/0x2000)=nil, &(0x7f00000004c0)=0x0, &(0x7f0000000500)) syz_io_uring_setup(0x3e5e, &(0x7f0000000540)={0x0, 0x5c61, 0x8, 0x2, 0x72}, &(0x7f0000ffd000/0x3000)=nil, &(0x7f0000ffc000/0x3000)=nil, &(0x7f00000005c0), &(0x7f0000000600)=0x0) syz_io_uring_submit(r2, r3, &(0x7f0000000740)=@IORING_OP_READ=@pass_buffer={0x16, 0x1, 0x2004, @fd_index=0xa, 0x7, &(0x7f0000000640)=""/227, 0xe3, 0xc, 0x1}, 0x9) ioctl$SECCOMP_IOCTL_NOTIF_ADDFD(0xffffffffffffffff, 0x40182103, &(0x7f0000000780)={0x0, 0x4, r1, 0x9, 0x80000}) openat$cgroup_devices(0xffffffffffffffff, &(0x7f00000007c0)='devices.allow\x00', 0x2, 0x0) mount$9p_rdma(&(0x7f0000001040), &(0x7f0000001080)='./file0\x00', &(0x7f00000010c0), 0xa00800, &(0x7f0000001100)={'trans=rdma,', {'port', 0x3d, 0x4e20}, 0x2c, {[{@common=@aname={'aname', 0x3d, 'permit_directio'}}, {@sq={'sq', 0x3d, 0xffff}}], [{@fscontext={'fscontext', 0x3d, 'staff_u'}}]}}) 11:42:34 executing program 4: setsockopt$inet_tcp_TCP_QUEUE_SEQ(0xffffffffffffffff, 0x6, 0x15, &(0x7f0000000000), 0x4) socket$inet_tcp(0x2, 0x1, 0x0) syz_genetlink_get_family_id$netlbl_mgmt(&(0x7f0000000440), 0xffffffffffffffff) syz_genetlink_get_family_id$netlbl_mgmt(&(0x7f0000000740), 0xffffffffffffffff) 11:42:34 executing program 1: r0 = shmget(0x2, 0x3000, 0x100, &(0x7f0000ffb000/0x3000)=nil) shmat(r0, &(0x7f0000ffa000/0x3000)=nil, 0x2000) shmat(r0, &(0x7f0000ffa000/0x4000)=nil, 0x3000) r1 = mmap$IORING_OFF_SQ_RING(&(0x7f0000ffd000/0x1000)=nil, 0x1000, 0x2000006, 0x40010, 0xffffffffffffffff, 0x0) syz_io_uring_submit(r1, 0x0, &(0x7f00000001c0)=@IORING_OP_PROVIDE_BUFFERS={0x1f, 0x1, 0x0, 0x8, 0x2, &(0x7f0000000140)="10e8e6d73f8e97a04564912d4b0bee6921be05ed083e4d741dabdbce8c94949f57a5c9d9da73d0e5ad668714159e31498f181aad79547c645eefb456a7b8c4be765eb156b77cba8a752b90d7729b2c285893a10c3633d2485f48f30d247214c5e28a", 0x7, 0x0, 0x1, {0x1}}, 0x100) recvfrom$packet(0xffffffffffffffff, &(0x7f0000000200)=""/108, 0x6c, 0x2000, &(0x7f0000000300)={0x11, 0x16, 0x0, 0x1, 0x8, 0x6, @local}, 0x14) io_uring_setup(0x14ab, &(0x7f0000000480)={0x0, 0x5191, 0x20, 0x1, 0x3ba}) shmget$private(0x0, 0x2000, 0x10, &(0x7f0000ffc000/0x2000)=nil) 11:42:34 executing program 0: syz_io_uring_submit(0x0, 0x0, 0x0, 0x0) 11:42:34 executing program 6: ioprio_set$uid(0x0, 0xee01, 0x4004) syz_mount_image$msdos(&(0x7f0000000000), &(0x7f0000000040)='./file0\x00', 0x200, 0x1, &(0x7f00000000c0)=[{&(0x7f0000000080)="7c74c7bc99e778a0c971e6f50fbdd2b70fa0b038d18c7d5ac685833434d89dce684239293aa5d8b6f11bc5c4a033ad1dc68319fad36a1101aad751fd6f4f10", 0x3f, 0x7f}], 0x42000, &(0x7f0000000100)={[{@dots}], [{@obj_user}, {@dont_appraise}, {@uid_lt}, {@hash}, {@seclabel}]}) getsockopt$inet6_IPV6_XFRM_POLICY(0xffffffffffffffff, 0x29, 0x23, &(0x7f0000000240)={{{@in=@loopback, @in6=@empty, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, {{@in6=@local}, 0x0, @in6=@mcast1}}, &(0x7f0000000340)=0xe8) mount$9p_xen(&(0x7f0000000180), &(0x7f00000001c0)='./file0\x00', &(0x7f0000000200), 0x1121061, &(0x7f0000000380)={'trans=xen,', {[{@msize={'msize', 0x3d, 0xf6b3}}, {@debug={'debug', 0x3d, 0x7ff}}, {@posixacl}, {@aname={'aname', 0x3d, '*$-&'}}, {@uname={'uname', 0x3d, 'msdos\x00'}}], [{@seclabel}, {@euid_eq={'euid', 0x3d, r0}}, {@permit_directio}, {@appraise_type}]}}) syz_io_uring_setup(0x1d4a, &(0x7f0000000440)={0x0, 0xfa85, 0x0, 0x0, 0x285}, &(0x7f0000ffd000/0x1000)=nil, &(0x7f0000ffd000/0x2000)=nil, &(0x7f00000004c0), &(0x7f0000000500)) syz_io_uring_setup(0x3e5e, &(0x7f0000000540)={0x0, 0x5c61, 0x8, 0x2, 0x72}, &(0x7f0000ffd000/0x3000)=nil, &(0x7f0000ffc000/0x3000)=nil, &(0x7f00000005c0), &(0x7f0000000600)) openat$cgroup_devices(0xffffffffffffffff, &(0x7f00000007c0)='devices.allow\x00', 0x2, 0x0) syz_mount_image$nfs4(&(0x7f0000000800), &(0x7f0000000840)='./file0/file0\x00', 0xffffffffffffff01, 0x1, &(0x7f0000000900)=[{&(0x7f0000000880)="f19bd7cfef39dd2070dcb194f7bd90ce305e2a9644b9fb91cc1e75bca69ed6bbdd7636452963af395ea61189cce718ef43420310b6ff8db9f4a606d67217b1aa7bf6e1435682323aef92ef40d036c48fa3fc363c6ad63229bb37cd76a6db9879a39f", 0x62, 0x6}], 0x8400, &(0x7f0000000940)={[{'*+\\['}]}) accept(0xffffffffffffffff, 0x0, &(0x7f0000000980)) mount$9p_rdma(&(0x7f0000001040), &(0x7f0000001080)='./file0\x00', &(0x7f00000010c0), 0xa00800, &(0x7f0000001100)={'trans=rdma,', {'port', 0x3d, 0x4e20}, 0x2c, {[{@common=@aname={'aname', 0x3d, 'permit_directio'}}, {@sq={'sq', 0x3d, 0xffff}}], [{@fscontext={'fscontext', 0x3d, 'staff_u'}}]}}) [ 247.499892] loop6: detected capacity change from 0 to 1 [ 247.519055] loop6: detected capacity change from 0 to 264192 [ 247.525976] nfs4: Unknown parameter '*+\[' [ 247.530071] loop7: detected capacity change from 0 to 1 [ 247.531812] SELinux: security_context_str_to_sid (staff_u) failed with errno=-22 11:42:34 executing program 1: r0 = shmget(0x2, 0x3000, 0x100, &(0x7f0000ffb000/0x3000)=nil) shmat(r0, &(0x7f0000ffa000/0x3000)=nil, 0x2000) r1 = mmap$IORING_OFF_SQ_RING(&(0x7f0000ffd000/0x1000)=nil, 0x1000, 0x2000006, 0x40010, 0xffffffffffffffff, 0x0) syz_io_uring_submit(r1, 0x0, &(0x7f00000001c0)=@IORING_OP_PROVIDE_BUFFERS={0x1f, 0x1, 0x0, 0x8, 0x2, &(0x7f0000000140)="10e8e6d73f8e97a04564912d4b0bee6921be05ed083e4d741dabdbce8c94949f57a5c9d9da73d0e5ad668714159e31498f181aad79547c645eefb456a7b8c4be765eb156b77cba8a752b90d7729b2c285893a10c3633d2485f48f30d247214c5e28a", 0x7, 0x0, 0x1, {0x1}}, 0x100) recvfrom$packet(0xffffffffffffffff, &(0x7f0000000200)=""/108, 0x6c, 0x2000, &(0x7f0000000300)={0x11, 0x16, 0x0, 0x1, 0x8, 0x6, @local}, 0x14) io_uring_setup(0x14ab, &(0x7f0000000480)={0x0, 0x5191, 0x20, 0x1, 0x3ba}) shmget$private(0x0, 0x2000, 0x10, &(0x7f0000ffc000/0x2000)=nil) [ 247.556024] SELinux: security_context_str_to_sid (staff_u) failed with errno=-22 11:42:34 executing program 6: ioprio_set$uid(0x0, 0xee01, 0x4004) syz_mount_image$msdos(&(0x7f0000000000), &(0x7f0000000040)='./file0\x00', 0x200, 0x1, &(0x7f00000000c0)=[{&(0x7f0000000080)="7c74c7bc99e778a0c971e6f50fbdd2b70fa0b038d18c7d5ac685833434d89dce684239293aa5d8b6f11bc5c4a033ad1dc68319fad36a1101aad751fd6f4f10", 0x3f, 0x7f}], 0x42000, &(0x7f0000000100)={[{@dots}], [{@obj_user}, {@dont_appraise}, {@uid_lt}, {@hash}, {@seclabel}]}) getsockopt$inet6_IPV6_XFRM_POLICY(0xffffffffffffffff, 0x29, 0x23, &(0x7f0000000240)={{{@in=@loopback, @in6=@empty, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, {{@in6=@local}, 0x0, @in6=@mcast1}}, &(0x7f0000000340)=0xe8) mount$9p_xen(&(0x7f0000000180), &(0x7f00000001c0)='./file0\x00', &(0x7f0000000200), 0x1121061, &(0x7f0000000380)={'trans=xen,', {[{@msize={'msize', 0x3d, 0xf6b3}}, {@debug={'debug', 0x3d, 0x7ff}}, {@posixacl}, {@aname={'aname', 0x3d, '*$-&'}}, {@uname={'uname', 0x3d, 'msdos\x00'}}], [{@seclabel}, {@euid_eq={'euid', 0x3d, r0}}, {@permit_directio}, {@appraise_type}]}}) syz_io_uring_setup(0x1d4a, &(0x7f0000000440)={0x0, 0xfa85, 0x0, 0x0, 0x285}, &(0x7f0000ffd000/0x1000)=nil, &(0x7f0000ffd000/0x2000)=nil, &(0x7f00000004c0), &(0x7f0000000500)) syz_io_uring_setup(0x3e5e, &(0x7f0000000540)={0x0, 0x5c61, 0x8, 0x2, 0x72}, &(0x7f0000ffd000/0x3000)=nil, &(0x7f0000ffc000/0x3000)=nil, &(0x7f00000005c0), &(0x7f0000000600)) openat$cgroup_devices(0xffffffffffffffff, &(0x7f00000007c0)='devices.allow\x00', 0x2, 0x0) syz_mount_image$nfs4(&(0x7f0000000800), &(0x7f0000000840)='./file0/file0\x00', 0xffffffffffffff01, 0x1, &(0x7f0000000900)=[{&(0x7f0000000880)="f19bd7cfef39dd2070dcb194f7bd90ce305e2a9644b9fb91cc1e75bca69ed6bbdd7636452963af395ea61189cce718ef43420310b6ff8db9f4a606d67217b1aa7bf6e1435682323aef92ef40d036c48fa3fc363c6ad63229bb37cd76a6db9879a39f", 0x62, 0x6}], 0x8400, &(0x7f0000000940)={[{'*+\\['}]}) accept(0xffffffffffffffff, 0x0, &(0x7f0000000980)) mount$9p_rdma(&(0x7f0000001040), &(0x7f0000001080)='./file0\x00', &(0x7f00000010c0), 0xa00800, &(0x7f0000001100)={'trans=rdma,', {'port', 0x3d, 0x4e20}, 0x2c, {[{@common=@aname={'aname', 0x3d, 'permit_directio'}}, {@sq={'sq', 0x3d, 0xffff}}], [{@fscontext={'fscontext', 0x3d, 'staff_u'}}]}}) 11:42:34 executing program 4: openat$vcsa(0xffffffffffffff9c, &(0x7f0000000040), 0x81, 0x0) socket$inet_tcp(0x2, 0x1, 0x0) syz_genetlink_get_family_id$netlbl_mgmt(&(0x7f0000000440), 0xffffffffffffffff) syz_genetlink_get_family_id$netlbl_mgmt(&(0x7f0000000740), 0xffffffffffffffff) 11:42:34 executing program 3: ioctl$SG_SET_FORCE_PACK_ID(0xffffffffffffffff, 0x227b, &(0x7f0000000000)=0x1) ioctl$SG_SET_FORCE_PACK_ID(0xffffffffffffffff, 0x227b, &(0x7f0000000040)) ioctl$SG_GET_RESERVED_SIZE(0xffffffffffffffff, 0x2272, &(0x7f0000000080)) r0 = openat$vcsa(0xffffffffffffff9c, &(0x7f00000000c0), 0x4200, 0x0) ioctl$SCSI_IOCTL_SEND_COMMAND(r0, 0x1, &(0x7f0000000100)={0x17, 0x3, 0x1c00, "af36a59fb168d324fd8eaf833aeb82f60d75e8700d81d9"}) ioctl$SG_SET_TIMEOUT(r0, 0x2201, &(0x7f0000000140)=0x4) ioctl$SG_GET_VERSION_NUM(r0, 0x2282, &(0x7f0000000180)) ioctl$SG_GET_TIMEOUT(r0, 0x2202, 0x0) r1 = syz_open_dev$sg(&(0x7f0000000340), 0x7fff, 0x40) ioctl$SG_EMULATED_HOST(r1, 0x2203, &(0x7f0000000380)) r2 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$inet6_tcp_TCP_CONGESTION(r2, 0x6, 0xd, &(0x7f0000000440)='scalable\x00', 0x9) 11:42:34 executing program 5: r0 = shmget(0x2, 0x3000, 0x100, &(0x7f0000ffb000/0x3000)=nil) shmat(r0, &(0x7f0000ffa000/0x3000)=nil, 0x2000) shmat(r0, &(0x7f0000ffa000/0x4000)=nil, 0x3000) shmget(0x3, 0x1000, 0x100, &(0x7f0000ffd000/0x1000)=nil) syz_genetlink_get_family_id$netlbl_mgmt(&(0x7f0000000040), 0xffffffffffffffff) r1 = mmap$IORING_OFF_SQ_RING(&(0x7f0000ffd000/0x1000)=nil, 0x1000, 0x2000006, 0x40010, 0xffffffffffffffff, 0x0) syz_io_uring_submit(r1, 0x0, &(0x7f00000001c0)=@IORING_OP_PROVIDE_BUFFERS={0x1f, 0x1, 0x0, 0x8, 0x2, &(0x7f0000000140)="10e8e6d73f8e97a04564912d4b0bee6921be05ed083e4d741dabdbce8c94949f57a5c9d9da73d0e5ad668714159e31498f181aad79547c645eefb456a7b8c4be765eb156b77cba8a752b90d7729b2c285893a10c3633d2485f48f30d247214c5e28a", 0x7, 0x0, 0x1, {0x1}}, 0x100) recvfrom$packet(0xffffffffffffffff, &(0x7f0000000200)=""/108, 0x6c, 0x2000, &(0x7f0000000300)={0x11, 0x16, 0x0, 0x1, 0x8, 0x6, @local}, 0x14) io_uring_setup(0x14ab, &(0x7f0000000480)={0x0, 0x5191, 0x20, 0x1, 0x3ba}) shmget$private(0x0, 0x2000, 0x10, &(0x7f0000ffc000/0x2000)=nil) 11:42:34 executing program 7: ioprio_set$uid(0x0, 0xee01, 0x4004) syz_mount_image$msdos(&(0x7f0000000000), &(0x7f0000000040)='./file0\x00', 0x200, 0x1, &(0x7f00000000c0)=[{&(0x7f0000000080)="7c74c7bc99e778a0c971e6f50fbdd2b70fa0b038d18c7d5ac685833434d89dce684239293aa5d8b6f11bc5c4a033ad1dc68319fad36a1101aad751fd6f4f10", 0x3f, 0x7f}], 0x42000, &(0x7f0000000100)={[{@dots}], [{@obj_user}, {@dont_appraise}, {@uid_lt}, {@hash}, {@seclabel}]}) getsockopt$inet6_IPV6_XFRM_POLICY(0xffffffffffffffff, 0x29, 0x23, &(0x7f0000000240)={{{@in=@loopback, @in6=@empty, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, {{@in6=@local}, 0x0, @in6=@mcast1}}, &(0x7f0000000340)=0xe8) mount$9p_xen(&(0x7f0000000180), &(0x7f00000001c0)='./file0\x00', &(0x7f0000000200), 0x1121061, &(0x7f0000000380)={'trans=xen,', {[{@msize={'msize', 0x3d, 0xf6b3}}, {@debug={'debug', 0x3d, 0x7ff}}, {@posixacl}, {@aname={'aname', 0x3d, '*$-&'}}, {@uname={'uname', 0x3d, 'msdos\x00'}}], [{@seclabel}, {@euid_eq={'euid', 0x3d, r0}}, {@permit_directio}, {@appraise_type}]}}) r1 = syz_io_uring_setup(0x1d4a, &(0x7f0000000440)={0x0, 0xfa85, 0x0, 0x0, 0x285}, &(0x7f0000ffd000/0x1000)=nil, &(0x7f0000ffd000/0x2000)=nil, &(0x7f00000004c0)=0x0, &(0x7f0000000500)) syz_io_uring_setup(0x3e5e, &(0x7f0000000540)={0x0, 0x5c61, 0x8, 0x2, 0x72}, &(0x7f0000ffd000/0x3000)=nil, &(0x7f0000ffc000/0x3000)=nil, &(0x7f00000005c0), &(0x7f0000000600)=0x0) syz_io_uring_submit(r2, r3, &(0x7f0000000740)=@IORING_OP_READ=@pass_buffer={0x16, 0x1, 0x2004, @fd_index=0xa, 0x7, &(0x7f0000000640)=""/227, 0xe3, 0xc, 0x1}, 0x9) ioctl$SECCOMP_IOCTL_NOTIF_ADDFD(0xffffffffffffffff, 0x40182103, &(0x7f0000000780)={0x0, 0x4, r1, 0x9, 0x80000}) mount$9p_rdma(&(0x7f0000001040), &(0x7f0000001080)='./file0\x00', &(0x7f00000010c0), 0xa00800, &(0x7f0000001100)={'trans=rdma,', {'port', 0x3d, 0x4e20}, 0x2c, {[{@common=@aname={'aname', 0x3d, 'permit_directio'}}, {@sq={'sq', 0x3d, 0xffff}}], [{@fscontext={'fscontext', 0x3d, 'staff_u'}}]}}) [ 247.620238] loop6: detected capacity change from 0 to 1 11:42:34 executing program 1: shmget(0x2, 0x3000, 0x100, &(0x7f0000ffb000/0x3000)=nil) r0 = mmap$IORING_OFF_SQ_RING(&(0x7f0000ffd000/0x1000)=nil, 0x1000, 0x2000006, 0x40010, 0xffffffffffffffff, 0x0) syz_io_uring_submit(r0, 0x0, &(0x7f00000001c0)=@IORING_OP_PROVIDE_BUFFERS={0x1f, 0x1, 0x0, 0x8, 0x2, &(0x7f0000000140)="10e8e6d73f8e97a04564912d4b0bee6921be05ed083e4d741dabdbce8c94949f57a5c9d9da73d0e5ad668714159e31498f181aad79547c645eefb456a7b8c4be765eb156b77cba8a752b90d7729b2c285893a10c3633d2485f48f30d247214c5e28a", 0x7, 0x0, 0x1, {0x1}}, 0x100) recvfrom$packet(0xffffffffffffffff, &(0x7f0000000200)=""/108, 0x6c, 0x2000, &(0x7f0000000300)={0x11, 0x16, 0x0, 0x1, 0x8, 0x6, @local}, 0x14) io_uring_setup(0x14ab, &(0x7f0000000480)={0x0, 0x5191, 0x20, 0x1, 0x3ba}) shmget$private(0x0, 0x2000, 0x10, &(0x7f0000ffc000/0x2000)=nil) 11:42:34 executing program 0: setsockopt$inet_tcp_TCP_QUEUE_SEQ(0xffffffffffffffff, 0x6, 0x15, &(0x7f0000000000), 0x4) socket$inet_tcp(0x2, 0x1, 0x0) syz_genetlink_get_family_id$netlbl_mgmt(&(0x7f0000000440), 0xffffffffffffffff) syz_genetlink_get_family_id$netlbl_mgmt(&(0x7f0000000740), 0xffffffffffffffff) [ 247.665523] SELinux: security_context_str_to_sid (staff_u) failed with errno=-22 [ 247.668379] loop7: detected capacity change from 0 to 1 11:42:34 executing program 6: ioprio_set$uid(0x0, 0xee01, 0x4004) syz_mount_image$msdos(&(0x7f0000000000), &(0x7f0000000040)='./file0\x00', 0x200, 0x1, &(0x7f00000000c0)=[{&(0x7f0000000080)="7c74c7bc99e778a0c971e6f50fbdd2b70fa0b038d18c7d5ac685833434d89dce684239293aa5d8b6f11bc5c4a033ad1dc68319fad36a1101aad751fd6f4f10", 0x3f, 0x7f}], 0x42000, &(0x7f0000000100)={[{@dots}], [{@obj_user}, {@dont_appraise}, {@uid_lt}, {@hash}, {@seclabel}]}) getsockopt$inet6_IPV6_XFRM_POLICY(0xffffffffffffffff, 0x29, 0x23, &(0x7f0000000240)={{{@in=@loopback, @in6=@empty, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, {{@in6=@local}, 0x0, @in6=@mcast1}}, &(0x7f0000000340)=0xe8) mount$9p_xen(&(0x7f0000000180), &(0x7f00000001c0)='./file0\x00', &(0x7f0000000200), 0x1121061, &(0x7f0000000380)={'trans=xen,', {[{@msize={'msize', 0x3d, 0xf6b3}}, {@debug={'debug', 0x3d, 0x7ff}}, {@posixacl}, {@aname={'aname', 0x3d, '*$-&'}}, {@uname={'uname', 0x3d, 'msdos\x00'}}], [{@seclabel}, {@euid_eq={'euid', 0x3d, r0}}, {@permit_directio}, {@appraise_type}]}}) syz_io_uring_setup(0x1d4a, &(0x7f0000000440)={0x0, 0xfa85, 0x0, 0x0, 0x285}, &(0x7f0000ffd000/0x1000)=nil, &(0x7f0000ffd000/0x2000)=nil, &(0x7f00000004c0), &(0x7f0000000500)) syz_io_uring_setup(0x3e5e, &(0x7f0000000540)={0x0, 0x5c61, 0x8, 0x2, 0x72}, &(0x7f0000ffd000/0x3000)=nil, &(0x7f0000ffc000/0x3000)=nil, &(0x7f00000005c0), &(0x7f0000000600)) openat$cgroup_devices(0xffffffffffffffff, &(0x7f00000007c0)='devices.allow\x00', 0x2, 0x0) syz_mount_image$nfs4(&(0x7f0000000800), &(0x7f0000000840)='./file0/file0\x00', 0xffffffffffffff01, 0x1, &(0x7f0000000900)=[{&(0x7f0000000880)="f19bd7cfef39dd2070dcb194f7bd90ce305e2a9644b9fb91cc1e75bca69ed6bbdd7636452963af395ea61189cce718ef43420310b6ff8db9f4a606d67217b1aa7bf6e1435682323aef92ef40d036c48fa3fc363c6ad63229bb37cd76a6db9879a39f", 0x62, 0x6}], 0x8400, &(0x7f0000000940)={[{'*+\\['}]}) accept(0xffffffffffffffff, 0x0, &(0x7f0000000980)) mount$9p_rdma(&(0x7f0000001040), &(0x7f0000001080)='./file0\x00', &(0x7f00000010c0), 0xa00800, &(0x7f0000001100)={'trans=rdma,', {'port', 0x3d, 0x4e20}, 0x2c, {[{@common=@aname={'aname', 0x3d, 'permit_directio'}}, {@sq={'sq', 0x3d, 0xffff}}], [{@fscontext={'fscontext', 0x3d, 'staff_u'}}]}}) [ 247.718355] SELinux: security_context_str_to_sid (staff_u) failed with errno=-22 [ 247.773872] loop6: detected capacity change from 0 to 1 [ 247.793604] loop6: detected capacity change from 0 to 264192 [ 247.795442] nfs4: Unknown parameter '*+\[' [ 247.797961] SELinux: security_context_str_to_sid (staff_u) failed with errno=-22 11:42:43 executing program 2: clock_nanosleep(0x7, 0x0, &(0x7f0000000000)={0x77359400}, &(0x7f0000000040)) getsockopt$inet6_IPV6_XFRM_POLICY(0xffffffffffffffff, 0x29, 0x23, &(0x7f0000000080)={{{@in6, @in6=@remote, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, {{@in6=@dev}, 0x0, @in=@initdev}}, &(0x7f0000000180)=0xe8) setsockopt$packet_add_memb(0xffffffffffffffff, 0x107, 0x1, &(0x7f00000001c0)={r0, 0x1, 0x6, @broadcast}, 0x10) getpeername$packet(0xffffffffffffffff, &(0x7f0000000200)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @dev}, &(0x7f0000000240)=0x14) recvmsg(0xffffffffffffffff, &(0x7f00000027c0)={&(0x7f0000000280)=@xdp, 0x80, &(0x7f0000002640)=[{&(0x7f0000000300)=""/227, 0xe3}, {&(0x7f0000000400)=""/4096, 0x1000}, {&(0x7f0000001400)=""/92, 0x5c}, {&(0x7f0000001480)=""/93, 0x5d}, {&(0x7f0000001500)=""/4096, 0x1000}, {&(0x7f0000002500)=""/87, 0x57}, {&(0x7f0000002580)=""/189, 0xbd}], 0x7, &(0x7f00000026c0)=""/199, 0xc7}, 0x140) openat$sr(0xffffffffffffff9c, &(0x7f0000005480), 0x428802, 0x0) 11:42:43 executing program 5: r0 = shmget(0x2, 0x3000, 0x100, &(0x7f0000ffb000/0x3000)=nil) shmat(r0, &(0x7f0000ffa000/0x3000)=nil, 0x2000) shmat(r0, &(0x7f0000ffa000/0x4000)=nil, 0x3000) shmget(0x3, 0x1000, 0x100, &(0x7f0000ffd000/0x1000)=nil) syz_genetlink_get_family_id$netlbl_mgmt(&(0x7f0000000040), 0xffffffffffffffff) r1 = mmap$IORING_OFF_SQ_RING(&(0x7f0000ffd000/0x1000)=nil, 0x1000, 0x2000006, 0x40010, 0xffffffffffffffff, 0x0) syz_io_uring_submit(r1, 0x0, &(0x7f00000001c0)=@IORING_OP_PROVIDE_BUFFERS={0x1f, 0x1, 0x0, 0x8, 0x2, &(0x7f0000000140)="10e8e6d73f8e97a04564912d4b0bee6921be05ed083e4d741dabdbce8c94949f57a5c9d9da73d0e5ad668714159e31498f181aad79547c645eefb456a7b8c4be765eb156b77cba8a752b90d7729b2c285893a10c3633d2485f48f30d247214c5e28a", 0x7, 0x0, 0x1, {0x1}}, 0x100) recvfrom$packet(0xffffffffffffffff, &(0x7f0000000200)=""/108, 0x6c, 0x2000, &(0x7f0000000300)={0x11, 0x16, 0x0, 0x1, 0x8, 0x6, @local}, 0x14) io_uring_setup(0x14ab, &(0x7f0000000480)={0x0, 0x5191, 0x20, 0x1, 0x3ba}) 11:42:43 executing program 4: openat$vcsa(0xffffffffffffff9c, &(0x7f0000000040), 0x81, 0x0) socket$inet_tcp(0x2, 0x1, 0x0) syz_genetlink_get_family_id$netlbl_mgmt(&(0x7f0000000440), 0xffffffffffffffff) syz_genetlink_get_family_id$netlbl_mgmt(&(0x7f0000000740), 0xffffffffffffffff) 11:42:43 executing program 6: ioprio_set$uid(0x0, 0xee01, 0x4004) syz_mount_image$msdos(&(0x7f0000000000), &(0x7f0000000040)='./file0\x00', 0x200, 0x1, &(0x7f00000000c0)=[{&(0x7f0000000080)="7c74c7bc99e778a0c971e6f50fbdd2b70fa0b038d18c7d5ac685833434d89dce684239293aa5d8b6f11bc5c4a033ad1dc68319fad36a1101aad751fd6f4f10", 0x3f, 0x7f}], 0x42000, &(0x7f0000000100)={[{@dots}], [{@obj_user}, {@dont_appraise}, {@uid_lt}, {@hash}, {@seclabel}]}) getsockopt$inet6_IPV6_XFRM_POLICY(0xffffffffffffffff, 0x29, 0x23, &(0x7f0000000240)={{{@in=@loopback, @in6=@empty, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, {{@in6=@local}, 0x0, @in6=@mcast1}}, &(0x7f0000000340)=0xe8) mount$9p_xen(&(0x7f0000000180), &(0x7f00000001c0)='./file0\x00', &(0x7f0000000200), 0x1121061, &(0x7f0000000380)={'trans=xen,', {[{@msize={'msize', 0x3d, 0xf6b3}}, {@debug={'debug', 0x3d, 0x7ff}}, {@posixacl}, {@aname={'aname', 0x3d, '*$-&'}}, {@uname={'uname', 0x3d, 'msdos\x00'}}], [{@seclabel}, {@euid_eq={'euid', 0x3d, r0}}, {@permit_directio}, {@appraise_type}]}}) syz_io_uring_setup(0x1d4a, &(0x7f0000000440)={0x0, 0xfa85, 0x0, 0x0, 0x285}, &(0x7f0000ffd000/0x1000)=nil, &(0x7f0000ffd000/0x2000)=nil, &(0x7f00000004c0)=0x0, &(0x7f0000000500)) syz_io_uring_submit(r1, 0x0, &(0x7f0000000740)=@IORING_OP_READ=@pass_buffer={0x16, 0x1, 0x2004, @fd_index=0xa, 0x7, &(0x7f0000000640)=""/227, 0xe3, 0xc, 0x1}, 0x9) openat$cgroup_devices(0xffffffffffffffff, &(0x7f00000007c0)='devices.allow\x00', 0x2, 0x0) syz_mount_image$nfs4(&(0x7f0000000800), &(0x7f0000000840)='./file0/file0\x00', 0xffffffffffffff01, 0x1, &(0x7f0000000900)=[{&(0x7f0000000880)="f19bd7cfef39dd2070dcb194f7bd90ce305e2a9644b9fb91cc1e75bca69ed6bbdd7636452963af395ea61189cce718ef43420310b6ff8db9f4a606d67217b1aa7bf6e1435682323aef92ef40d036c48fa3fc363c6ad63229bb37cd76a6db9879a39f", 0x62, 0x6}], 0x8400, &(0x7f0000000940)={[{'*+\\['}]}) accept(0xffffffffffffffff, 0x0, &(0x7f0000000980)) mount$9p_rdma(&(0x7f0000001040), &(0x7f0000001080)='./file0\x00', &(0x7f00000010c0), 0xa00800, &(0x7f0000001100)={'trans=rdma,', {'port', 0x3d, 0x4e20}, 0x2c, {[{@common=@aname={'aname', 0x3d, 'permit_directio'}}, {@sq={'sq', 0x3d, 0xffff}}], [{@fscontext={'fscontext', 0x3d, 'staff_u'}}]}}) 11:42:43 executing program 1: r0 = mmap$IORING_OFF_SQ_RING(&(0x7f0000ffd000/0x1000)=nil, 0x1000, 0x2000006, 0x40010, 0xffffffffffffffff, 0x0) syz_io_uring_submit(r0, 0x0, &(0x7f00000001c0)=@IORING_OP_PROVIDE_BUFFERS={0x1f, 0x1, 0x0, 0x8, 0x2, &(0x7f0000000140)="10e8e6d73f8e97a04564912d4b0bee6921be05ed083e4d741dabdbce8c94949f57a5c9d9da73d0e5ad668714159e31498f181aad79547c645eefb456a7b8c4be765eb156b77cba8a752b90d7729b2c285893a10c3633d2485f48f30d247214c5e28a", 0x7, 0x0, 0x1, {0x1}}, 0x100) recvfrom$packet(0xffffffffffffffff, &(0x7f0000000200)=""/108, 0x6c, 0x2000, &(0x7f0000000300)={0x11, 0x16, 0x0, 0x1, 0x8, 0x6, @local}, 0x14) io_uring_setup(0x14ab, &(0x7f0000000480)={0x0, 0x5191, 0x20, 0x1, 0x3ba}) shmget$private(0x0, 0x2000, 0x10, &(0x7f0000ffc000/0x2000)=nil) 11:42:43 executing program 0: setsockopt$inet_tcp_TCP_QUEUE_SEQ(0xffffffffffffffff, 0x6, 0x15, &(0x7f0000000000), 0x4) socket$inet_tcp(0x2, 0x1, 0x0) syz_genetlink_get_family_id$netlbl_mgmt(&(0x7f0000000440), 0xffffffffffffffff) syz_genetlink_get_family_id$netlbl_mgmt(&(0x7f0000000740), 0xffffffffffffffff) 11:42:43 executing program 3: ioctl$SG_SET_FORCE_PACK_ID(0xffffffffffffffff, 0x227b, &(0x7f0000000000)=0x1) ioctl$SG_SET_FORCE_PACK_ID(0xffffffffffffffff, 0x227b, &(0x7f0000000040)) ioctl$SG_GET_RESERVED_SIZE(0xffffffffffffffff, 0x2272, &(0x7f0000000080)) r0 = openat$vcsa(0xffffffffffffff9c, &(0x7f00000000c0), 0x4200, 0x0) ioctl$SCSI_IOCTL_SEND_COMMAND(r0, 0x1, &(0x7f0000000100)={0x17, 0x3, 0x1c00, "af36a59fb168d324fd8eaf833aeb82f60d75e8700d81d9"}) ioctl$SG_SET_TIMEOUT(r0, 0x2201, &(0x7f0000000140)=0x4) ioctl$SG_GET_REQUEST_TABLE(r0, 0x2286, &(0x7f00000001c0)) ioctl$SG_GET_TIMEOUT(r0, 0x2202, 0x0) r1 = syz_open_dev$sg(&(0x7f0000000340), 0x7fff, 0x40) ioctl$SG_EMULATED_HOST(r1, 0x2203, &(0x7f0000000380)) r2 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$inet6_tcp_TCP_CONGESTION(r2, 0x6, 0xd, &(0x7f0000000440)='scalable\x00', 0x9) 11:42:43 executing program 7: ioprio_set$uid(0x0, 0xee01, 0x4004) syz_mount_image$msdos(&(0x7f0000000000), &(0x7f0000000040)='./file0\x00', 0x200, 0x1, &(0x7f00000000c0)=[{&(0x7f0000000080)="7c74c7bc99e778a0c971e6f50fbdd2b70fa0b038d18c7d5ac685833434d89dce684239293aa5d8b6f11bc5c4a033ad1dc68319fad36a1101aad751fd6f4f10", 0x3f, 0x7f}], 0x42000, &(0x7f0000000100)={[{@dots}], [{@obj_user}, {@dont_appraise}, {@uid_lt}, {@hash}, {@seclabel}]}) getsockopt$inet6_IPV6_XFRM_POLICY(0xffffffffffffffff, 0x29, 0x23, &(0x7f0000000240)={{{@in=@loopback, @in6=@empty, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, {{@in6=@local}, 0x0, @in6=@mcast1}}, &(0x7f0000000340)=0xe8) mount$9p_xen(&(0x7f0000000180), &(0x7f00000001c0)='./file0\x00', &(0x7f0000000200), 0x1121061, &(0x7f0000000380)={'trans=xen,', {[{@msize={'msize', 0x3d, 0xf6b3}}, {@debug={'debug', 0x3d, 0x7ff}}, {@posixacl}, {@aname={'aname', 0x3d, '*$-&'}}, {@uname={'uname', 0x3d, 'msdos\x00'}}], [{@seclabel}, {@euid_eq={'euid', 0x3d, r0}}, {@permit_directio}, {@appraise_type}]}}) r1 = syz_io_uring_setup(0x1d4a, &(0x7f0000000440)={0x0, 0xfa85, 0x0, 0x0, 0x285}, &(0x7f0000ffd000/0x1000)=nil, &(0x7f0000ffd000/0x2000)=nil, &(0x7f00000004c0)=0x0, &(0x7f0000000500)) syz_io_uring_setup(0x3e5e, &(0x7f0000000540)={0x0, 0x5c61, 0x8, 0x2, 0x72}, &(0x7f0000ffd000/0x3000)=nil, &(0x7f0000ffc000/0x3000)=nil, &(0x7f00000005c0), &(0x7f0000000600)=0x0) syz_io_uring_submit(r2, r3, &(0x7f0000000740)=@IORING_OP_READ=@pass_buffer={0x16, 0x1, 0x2004, @fd_index=0xa, 0x7, &(0x7f0000000640)=""/227, 0xe3, 0xc, 0x1}, 0x9) ioctl$SECCOMP_IOCTL_NOTIF_ADDFD(0xffffffffffffffff, 0x40182103, &(0x7f0000000780)={0x0, 0x4, r1, 0x9, 0x80000}) mount$9p_rdma(&(0x7f0000001040), &(0x7f0000001080)='./file0\x00', &(0x7f00000010c0), 0xa00800, &(0x7f0000001100)={'trans=rdma,', {'port', 0x3d, 0x4e20}, 0x2c, {[{@common=@aname={'aname', 0x3d, 'permit_directio'}}, {@sq={'sq', 0x3d, 0xffff}}], [{@fscontext={'fscontext', 0x3d, 'staff_u'}}]}}) [ 256.014540] loop7: detected capacity change from 0 to 1 [ 256.028149] loop6: detected capacity change from 0 to 1 [ 256.039866] SELinux: security_context_str_to_sid (staff_u) failed with errno=-22 [ 256.043935] loop6: detected capacity change from 0 to 264192 [ 256.049392] nfs4: Unknown parameter '*+\[' [ 256.053561] SELinux: security_context_str_to_sid (staff_u) failed with errno=-22 11:42:43 executing program 7: ioprio_set$uid(0x0, 0xee01, 0x4004) syz_mount_image$msdos(&(0x7f0000000000), &(0x7f0000000040)='./file0\x00', 0x200, 0x1, &(0x7f00000000c0)=[{&(0x7f0000000080)="7c74c7bc99e778a0c971e6f50fbdd2b70fa0b038d18c7d5ac685833434d89dce684239293aa5d8b6f11bc5c4a033ad1dc68319fad36a1101aad751fd6f4f10", 0x3f, 0x7f}], 0x42000, &(0x7f0000000100)={[{@dots}], [{@obj_user}, {@dont_appraise}, {@uid_lt}, {@hash}, {@seclabel}]}) getsockopt$inet6_IPV6_XFRM_POLICY(0xffffffffffffffff, 0x29, 0x23, &(0x7f0000000240)={{{@in=@loopback, @in6=@empty, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, {{@in6=@local}, 0x0, @in6=@mcast1}}, &(0x7f0000000340)=0xe8) mount$9p_xen(&(0x7f0000000180), &(0x7f00000001c0)='./file0\x00', &(0x7f0000000200), 0x1121061, &(0x7f0000000380)={'trans=xen,', {[{@msize={'msize', 0x3d, 0xf6b3}}, {@debug={'debug', 0x3d, 0x7ff}}, {@posixacl}, {@aname={'aname', 0x3d, '*$-&'}}, {@uname={'uname', 0x3d, 'msdos\x00'}}], [{@seclabel}, {@euid_eq={'euid', 0x3d, r0}}, {@permit_directio}, {@appraise_type}]}}) r1 = syz_io_uring_setup(0x1d4a, &(0x7f0000000440)={0x0, 0xfa85, 0x0, 0x0, 0x285}, &(0x7f0000ffd000/0x1000)=nil, &(0x7f0000ffd000/0x2000)=nil, &(0x7f00000004c0)=0x0, &(0x7f0000000500)) syz_io_uring_setup(0x3e5e, &(0x7f0000000540)={0x0, 0x5c61, 0x8, 0x2, 0x72}, &(0x7f0000ffd000/0x3000)=nil, &(0x7f0000ffc000/0x3000)=nil, &(0x7f00000005c0), &(0x7f0000000600)=0x0) syz_io_uring_submit(r2, r3, &(0x7f0000000740)=@IORING_OP_READ=@pass_buffer={0x16, 0x1, 0x2004, @fd_index=0xa, 0x7, &(0x7f0000000640)=""/227, 0xe3, 0xc, 0x1}, 0x9) ioctl$SECCOMP_IOCTL_NOTIF_ADDFD(0xffffffffffffffff, 0x40182103, &(0x7f0000000780)={0x0, 0x4, r1, 0x9, 0x80000}) mount$9p_rdma(&(0x7f0000001040), &(0x7f0000001080)='./file0\x00', &(0x7f00000010c0), 0xa00800, &(0x7f0000001100)={'trans=rdma,', {'port', 0x3d, 0x4e20}, 0x2c, {[{@common=@aname={'aname', 0x3d, 'permit_directio'}}, {@sq={'sq', 0x3d, 0xffff}}], [{@fscontext={'fscontext', 0x3d, 'staff_u'}}]}}) 11:42:43 executing program 6: ioprio_set$uid(0x0, 0xee01, 0x4004) syz_mount_image$msdos(&(0x7f0000000000), &(0x7f0000000040)='./file0\x00', 0x200, 0x1, &(0x7f00000000c0)=[{&(0x7f0000000080)="7c74c7bc99e778a0c971e6f50fbdd2b70fa0b038d18c7d5ac685833434d89dce684239293aa5d8b6f11bc5c4a033ad1dc68319fad36a1101aad751fd6f4f10", 0x3f, 0x7f}], 0x42000, &(0x7f0000000100)={[{@dots}], [{@obj_user}, {@dont_appraise}, {@uid_lt}, {@hash}, {@seclabel}]}) getsockopt$inet6_IPV6_XFRM_POLICY(0xffffffffffffffff, 0x29, 0x23, &(0x7f0000000240)={{{@in=@loopback, @in6=@empty, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, {{@in6=@local}, 0x0, @in6=@mcast1}}, &(0x7f0000000340)=0xe8) mount$9p_xen(&(0x7f0000000180), &(0x7f00000001c0)='./file0\x00', &(0x7f0000000200), 0x1121061, &(0x7f0000000380)={'trans=xen,', {[{@msize={'msize', 0x3d, 0xf6b3}}, {@debug={'debug', 0x3d, 0x7ff}}, {@posixacl}, {@aname={'aname', 0x3d, '*$-&'}}, {@uname={'uname', 0x3d, 'msdos\x00'}}], [{@seclabel}, {@euid_eq={'euid', 0x3d, r0}}, {@permit_directio}, {@appraise_type}]}}) syz_io_uring_setup(0x1d4a, &(0x7f0000000440)={0x0, 0xfa85, 0x0, 0x0, 0x285}, &(0x7f0000ffd000/0x1000)=nil, &(0x7f0000ffd000/0x2000)=nil, &(0x7f00000004c0)=0x0, &(0x7f0000000500)) syz_io_uring_submit(r1, 0x0, &(0x7f0000000740)=@IORING_OP_READ=@pass_buffer={0x16, 0x1, 0x2004, @fd_index=0xa, 0x7, &(0x7f0000000640)=""/227, 0xe3, 0xc, 0x1}, 0x9) openat$cgroup_devices(0xffffffffffffffff, &(0x7f00000007c0)='devices.allow\x00', 0x2, 0x0) syz_mount_image$nfs4(&(0x7f0000000800), &(0x7f0000000840)='./file0/file0\x00', 0xffffffffffffff01, 0x1, &(0x7f0000000900)=[{&(0x7f0000000880)="f19bd7cfef39dd2070dcb194f7bd90ce305e2a9644b9fb91cc1e75bca69ed6bbdd7636452963af395ea61189cce718ef43420310b6ff8db9f4a606d67217b1aa7bf6e1435682323aef92ef40d036c48fa3fc363c6ad63229bb37cd76a6db9879a39f", 0x62, 0x6}], 0x8400, &(0x7f0000000940)={[{'*+\\['}]}) accept(0xffffffffffffffff, 0x0, &(0x7f0000000980)) mount$9p_rdma(&(0x7f0000001040), &(0x7f0000001080)='./file0\x00', &(0x7f00000010c0), 0xa00800, &(0x7f0000001100)={'trans=rdma,', {'port', 0x3d, 0x4e20}, 0x2c, {[{@common=@aname={'aname', 0x3d, 'permit_directio'}}, {@sq={'sq', 0x3d, 0xffff}}], [{@fscontext={'fscontext', 0x3d, 'staff_u'}}]}}) 11:42:43 executing program 5: r0 = shmget(0x2, 0x3000, 0x100, &(0x7f0000ffb000/0x3000)=nil) shmat(r0, &(0x7f0000ffa000/0x3000)=nil, 0x2000) shmat(r0, &(0x7f0000ffa000/0x4000)=nil, 0x3000) shmget(0x3, 0x1000, 0x100, &(0x7f0000ffd000/0x1000)=nil) syz_genetlink_get_family_id$netlbl_mgmt(&(0x7f0000000040), 0xffffffffffffffff) r1 = mmap$IORING_OFF_SQ_RING(&(0x7f0000ffd000/0x1000)=nil, 0x1000, 0x2000006, 0x40010, 0xffffffffffffffff, 0x0) syz_io_uring_submit(r1, 0x0, &(0x7f00000001c0)=@IORING_OP_PROVIDE_BUFFERS={0x1f, 0x1, 0x0, 0x8, 0x2, &(0x7f0000000140)="10e8e6d73f8e97a04564912d4b0bee6921be05ed083e4d741dabdbce8c94949f57a5c9d9da73d0e5ad668714159e31498f181aad79547c645eefb456a7b8c4be765eb156b77cba8a752b90d7729b2c285893a10c3633d2485f48f30d247214c5e28a", 0x7, 0x0, 0x1, {0x1}}, 0x100) io_uring_setup(0x14ab, &(0x7f0000000480)={0x0, 0x5191, 0x20, 0x1, 0x3ba}) 11:42:43 executing program 0: setsockopt$inet_tcp_TCP_QUEUE_SEQ(0xffffffffffffffff, 0x6, 0x15, &(0x7f0000000000), 0x4) socket$inet_tcp(0x2, 0x1, 0x0) syz_genetlink_get_family_id$netlbl_mgmt(&(0x7f0000000440), 0xffffffffffffffff) syz_genetlink_get_family_id$netlbl_mgmt(&(0x7f0000000740), 0xffffffffffffffff) 11:42:43 executing program 4: openat$vcsa(0xffffffffffffff9c, 0x0, 0x81, 0x0) socket$inet_tcp(0x2, 0x1, 0x0) syz_genetlink_get_family_id$netlbl_mgmt(&(0x7f0000000440), 0xffffffffffffffff) syz_genetlink_get_family_id$netlbl_mgmt(&(0x7f0000000740), 0xffffffffffffffff) 11:42:43 executing program 1: r0 = mmap$IORING_OFF_SQ_RING(&(0x7f0000ffd000/0x1000)=nil, 0x1000, 0x2000006, 0x40010, 0xffffffffffffffff, 0x0) syz_io_uring_submit(r0, 0x0, &(0x7f00000001c0)=@IORING_OP_PROVIDE_BUFFERS={0x1f, 0x1, 0x0, 0x8, 0x2, &(0x7f0000000140)="10e8e6d73f8e97a04564912d4b0bee6921be05ed083e4d741dabdbce8c94949f57a5c9d9da73d0e5ad668714159e31498f181aad79547c645eefb456a7b8c4be765eb156b77cba8a752b90d7729b2c285893a10c3633d2485f48f30d247214c5e28a", 0x7, 0x0, 0x1, {0x1}}, 0x100) recvfrom$packet(0xffffffffffffffff, &(0x7f0000000200)=""/108, 0x6c, 0x2000, &(0x7f0000000300)={0x11, 0x16, 0x0, 0x1, 0x8, 0x6, @local}, 0x14) io_uring_setup(0x14ab, &(0x7f0000000480)={0x0, 0x5191, 0x20, 0x1, 0x3ba}) shmget$private(0x0, 0x2000, 0x10, &(0x7f0000ffc000/0x2000)=nil) [ 256.172606] loop7: detected capacity change from 0 to 1 [ 256.175794] loop6: detected capacity change from 0 to 1 [ 256.192912] loop6: detected capacity change from 0 to 264192 [ 256.196532] nfs4: Unknown parameter '*+\[' [ 256.201708] SELinux: security_context_str_to_sid (staff_u) failed with errno=-22 11:42:43 executing program 1: r0 = mmap$IORING_OFF_SQ_RING(&(0x7f0000ffd000/0x1000)=nil, 0x1000, 0x0, 0x40010, 0xffffffffffffffff, 0x0) syz_io_uring_submit(r0, 0x0, &(0x7f00000001c0)=@IORING_OP_PROVIDE_BUFFERS={0x1f, 0x1, 0x0, 0x8, 0x2, &(0x7f0000000140)="10e8e6d73f8e97a04564912d4b0bee6921be05ed083e4d741dabdbce8c94949f57a5c9d9da73d0e5ad668714159e31498f181aad79547c645eefb456a7b8c4be765eb156b77cba8a752b90d7729b2c285893a10c3633d2485f48f30d247214c5e28a", 0x7, 0x0, 0x1, {0x1}}, 0x100) recvfrom$packet(0xffffffffffffffff, &(0x7f0000000200)=""/108, 0x6c, 0x2000, &(0x7f0000000300)={0x11, 0x16, 0x0, 0x1, 0x8, 0x6, @local}, 0x14) io_uring_setup(0x14ab, &(0x7f0000000480)={0x0, 0x5191, 0x20, 0x1, 0x3ba}) shmget$private(0x0, 0x2000, 0x10, &(0x7f0000ffc000/0x2000)=nil) 11:42:43 executing program 6: ioprio_set$uid(0x0, 0xee01, 0x4004) syz_mount_image$msdos(&(0x7f0000000000), &(0x7f0000000040)='./file0\x00', 0x200, 0x1, &(0x7f00000000c0)=[{&(0x7f0000000080)="7c74c7bc99e778a0c971e6f50fbdd2b70fa0b038d18c7d5ac685833434d89dce684239293aa5d8b6f11bc5c4a033ad1dc68319fad36a1101aad751fd6f4f10", 0x3f, 0x7f}], 0x42000, &(0x7f0000000100)={[{@dots}], [{@obj_user}, {@dont_appraise}, {@uid_lt}, {@hash}, {@seclabel}]}) getsockopt$inet6_IPV6_XFRM_POLICY(0xffffffffffffffff, 0x29, 0x23, &(0x7f0000000240)={{{@in=@loopback, @in6=@empty, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, {{@in6=@local}, 0x0, @in6=@mcast1}}, &(0x7f0000000340)=0xe8) mount$9p_xen(&(0x7f0000000180), &(0x7f00000001c0)='./file0\x00', &(0x7f0000000200), 0x1121061, &(0x7f0000000380)={'trans=xen,', {[{@msize={'msize', 0x3d, 0xf6b3}}, {@debug={'debug', 0x3d, 0x7ff}}, {@posixacl}, {@aname={'aname', 0x3d, '*$-&'}}, {@uname={'uname', 0x3d, 'msdos\x00'}}], [{@seclabel}, {@euid_eq={'euid', 0x3d, r0}}, {@permit_directio}, {@appraise_type}]}}) syz_io_uring_setup(0x1d4a, &(0x7f0000000440)={0x0, 0xfa85, 0x0, 0x0, 0x285}, &(0x7f0000ffd000/0x1000)=nil, &(0x7f0000ffd000/0x2000)=nil, &(0x7f00000004c0)=0x0, &(0x7f0000000500)) syz_io_uring_submit(r1, 0x0, &(0x7f0000000740)=@IORING_OP_READ=@pass_buffer={0x16, 0x1, 0x2004, @fd_index=0xa, 0x7, &(0x7f0000000640)=""/227, 0xe3, 0xc, 0x1}, 0x9) openat$cgroup_devices(0xffffffffffffffff, &(0x7f00000007c0)='devices.allow\x00', 0x2, 0x0) syz_mount_image$nfs4(&(0x7f0000000800), &(0x7f0000000840)='./file0/file0\x00', 0xffffffffffffff01, 0x1, &(0x7f0000000900)=[{&(0x7f0000000880)="f19bd7cfef39dd2070dcb194f7bd90ce305e2a9644b9fb91cc1e75bca69ed6bbdd7636452963af395ea61189cce718ef43420310b6ff8db9f4a606d67217b1aa7bf6e1435682323aef92ef40d036c48fa3fc363c6ad63229bb37cd76a6db9879a39f", 0x62, 0x6}], 0x8400, &(0x7f0000000940)={[{'*+\\['}]}) accept(0xffffffffffffffff, 0x0, &(0x7f0000000980)) mount$9p_rdma(&(0x7f0000001040), &(0x7f0000001080)='./file0\x00', &(0x7f00000010c0), 0xa00800, &(0x7f0000001100)={'trans=rdma,', {'port', 0x3d, 0x4e20}, 0x2c, {[{@common=@aname={'aname', 0x3d, 'permit_directio'}}, {@sq={'sq', 0x3d, 0xffff}}], [{@fscontext={'fscontext', 0x3d, 'staff_u'}}]}}) [ 256.252867] SELinux: security_context_str_to_sid (staff_u) failed with errno=-22 [ 256.287815] loop6: detected capacity change from 0 to 1 [ 256.298859] SELinux: security_context_str_to_sid (staff_u) failed with errno=-22 11:42:52 executing program 5: r0 = shmget(0x2, 0x3000, 0x100, &(0x7f0000ffb000/0x3000)=nil) shmat(r0, &(0x7f0000ffa000/0x3000)=nil, 0x2000) shmat(r0, &(0x7f0000ffa000/0x4000)=nil, 0x3000) shmget(0x3, 0x1000, 0x100, &(0x7f0000ffd000/0x1000)=nil) syz_genetlink_get_family_id$netlbl_mgmt(&(0x7f0000000040), 0xffffffffffffffff) mmap$IORING_OFF_SQ_RING(&(0x7f0000ffd000/0x1000)=nil, 0x1000, 0x2000006, 0x40010, 0xffffffffffffffff, 0x0) io_uring_setup(0x14ab, &(0x7f0000000480)={0x0, 0x5191, 0x20, 0x1, 0x3ba}) 11:42:52 executing program 3: ioctl$SG_SET_FORCE_PACK_ID(0xffffffffffffffff, 0x227b, &(0x7f0000000000)=0x1) ioctl$SG_SET_FORCE_PACK_ID(0xffffffffffffffff, 0x227b, &(0x7f0000000040)) ioctl$SG_GET_RESERVED_SIZE(0xffffffffffffffff, 0x2272, &(0x7f0000000080)) r0 = openat$vcsa(0xffffffffffffff9c, &(0x7f00000000c0), 0x4200, 0x0) ioctl$SCSI_IOCTL_SEND_COMMAND(r0, 0x1, &(0x7f0000000100)={0x17, 0x3, 0x1c00, "af36a59fb168d324fd8eaf833aeb82f60d75e8700d81d9"}) ioctl$SG_SET_TIMEOUT(r0, 0x2201, &(0x7f0000000140)=0x4) ioctl$SG_GET_REQUEST_TABLE(r0, 0x2286, &(0x7f00000001c0)) ioctl$SG_GET_TIMEOUT(r0, 0x2202, 0x0) r1 = syz_open_dev$sg(&(0x7f0000000340), 0x7fff, 0x40) ioctl$SG_EMULATED_HOST(r1, 0x2203, &(0x7f0000000380)) r2 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$inet6_tcp_TCP_CONGESTION(r2, 0x6, 0xd, &(0x7f0000000440)='scalable\x00', 0x9) 11:42:52 executing program 0: setsockopt$inet_tcp_TCP_QUEUE_SEQ(0xffffffffffffffff, 0x6, 0x15, &(0x7f0000000000), 0x4) socket$inet_tcp(0x2, 0x1, 0x0) syz_genetlink_get_family_id$netlbl_mgmt(&(0x7f0000000740), 0xffffffffffffffff) 11:42:52 executing program 4: openat$vcsa(0xffffffffffffff9c, 0x0, 0x81, 0x0) socket$inet_tcp(0x2, 0x1, 0x0) syz_genetlink_get_family_id$netlbl_mgmt(&(0x7f0000000440), 0xffffffffffffffff) syz_genetlink_get_family_id$netlbl_mgmt(&(0x7f0000000740), 0xffffffffffffffff) 11:42:52 executing program 1: r0 = mmap$IORING_OFF_SQ_RING(&(0x7f0000ffd000/0x1000)=nil, 0x1000, 0x0, 0x40010, 0xffffffffffffffff, 0x0) syz_io_uring_submit(r0, 0x0, &(0x7f00000001c0)=@IORING_OP_PROVIDE_BUFFERS={0x1f, 0x1, 0x0, 0x8, 0x2, &(0x7f0000000140)="10e8e6d73f8e97a04564912d4b0bee6921be05ed083e4d741dabdbce8c94949f57a5c9d9da73d0e5ad668714159e31498f181aad79547c645eefb456a7b8c4be765eb156b77cba8a752b90d7729b2c285893a10c3633d2485f48f30d247214c5e28a", 0x7, 0x0, 0x1, {0x1}}, 0x100) recvfrom$packet(0xffffffffffffffff, &(0x7f0000000200)=""/108, 0x6c, 0x2000, &(0x7f0000000300)={0x11, 0x16, 0x0, 0x1, 0x8, 0x6, @local}, 0x14) io_uring_setup(0x14ab, &(0x7f0000000480)={0x0, 0x5191, 0x20, 0x1, 0x3ba}) shmget$private(0x0, 0x2000, 0x10, &(0x7f0000ffc000/0x2000)=nil) 11:42:52 executing program 2: clock_nanosleep(0x7, 0x0, &(0x7f0000000000)={0x77359400}, &(0x7f0000000040)) getsockopt$inet6_IPV6_XFRM_POLICY(0xffffffffffffffff, 0x29, 0x23, &(0x7f0000000080)={{{@in6, @in6=@remote, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, {{@in6=@dev}, 0x0, @in=@initdev}}, &(0x7f0000000180)=0xe8) setsockopt$packet_add_memb(0xffffffffffffffff, 0x107, 0x1, &(0x7f00000001c0)={r0, 0x1, 0x6, @broadcast}, 0x10) getpeername$packet(0xffffffffffffffff, &(0x7f0000000200)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @dev}, &(0x7f0000000240)=0x14) openat$sr(0xffffffffffffff9c, &(0x7f0000005480), 0x428802, 0x0) 11:42:52 executing program 6: ioprio_set$uid(0x0, 0xee01, 0x4004) syz_mount_image$msdos(&(0x7f0000000000), &(0x7f0000000040)='./file0\x00', 0x200, 0x1, &(0x7f00000000c0)=[{&(0x7f0000000080)="7c74c7bc99e778a0c971e6f50fbdd2b70fa0b038d18c7d5ac685833434d89dce684239293aa5d8b6f11bc5c4a033ad1dc68319fad36a1101aad751fd6f4f10", 0x3f, 0x7f}], 0x42000, &(0x7f0000000100)={[{@dots}], [{@obj_user}, {@dont_appraise}, {@uid_lt}, {@hash}, {@seclabel}]}) getsockopt$inet6_IPV6_XFRM_POLICY(0xffffffffffffffff, 0x29, 0x23, &(0x7f0000000240)={{{@in=@loopback, @in6=@empty, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, {{@in6=@local}, 0x0, @in6=@mcast1}}, &(0x7f0000000340)=0xe8) mount$9p_xen(&(0x7f0000000180), &(0x7f00000001c0)='./file0\x00', &(0x7f0000000200), 0x1121061, &(0x7f0000000380)={'trans=xen,', {[{@msize={'msize', 0x3d, 0xf6b3}}, {@debug={'debug', 0x3d, 0x7ff}}, {@posixacl}, {@aname={'aname', 0x3d, '*$-&'}}, {@uname={'uname', 0x3d, 'msdos\x00'}}], [{@seclabel}, {@euid_eq={'euid', 0x3d, r0}}, {@permit_directio}, {@appraise_type}]}}) syz_io_uring_setup(0x3e5e, &(0x7f0000000540)={0x0, 0x5c61, 0x8, 0x2, 0x72}, &(0x7f0000ffd000/0x3000)=nil, &(0x7f0000ffc000/0x3000)=nil, &(0x7f00000005c0), &(0x7f0000000600)=0x0) syz_io_uring_submit(0x0, r1, &(0x7f0000000740)=@IORING_OP_READ=@pass_buffer={0x16, 0x1, 0x2004, @fd_index=0xa, 0x7, &(0x7f0000000640)=""/227, 0xe3, 0xc, 0x1}, 0x9) openat$cgroup_devices(0xffffffffffffffff, &(0x7f00000007c0)='devices.allow\x00', 0x2, 0x0) syz_mount_image$nfs4(&(0x7f0000000800), &(0x7f0000000840)='./file0/file0\x00', 0xffffffffffffff01, 0x1, &(0x7f0000000900)=[{&(0x7f0000000880)="f19bd7cfef39dd2070dcb194f7bd90ce305e2a9644b9fb91cc1e75bca69ed6bbdd7636452963af395ea61189cce718ef43420310b6ff8db9f4a606d67217b1aa7bf6e1435682323aef92ef40d036c48fa3fc363c6ad63229bb37cd76a6db9879a39f", 0x62, 0x6}], 0x8400, &(0x7f0000000940)={[{'*+\\['}]}) accept(0xffffffffffffffff, 0x0, &(0x7f0000000980)) mount$9p_rdma(&(0x7f0000001040), &(0x7f0000001080)='./file0\x00', &(0x7f00000010c0), 0xa00800, &(0x7f0000001100)={'trans=rdma,', {'port', 0x3d, 0x4e20}, 0x2c, {[{@common=@aname={'aname', 0x3d, 'permit_directio'}}, {@sq={'sq', 0x3d, 0xffff}}], [{@fscontext={'fscontext', 0x3d, 'staff_u'}}]}}) 11:42:52 executing program 7: ioprio_set$uid(0x0, 0xee01, 0x4004) syz_mount_image$msdos(&(0x7f0000000000), &(0x7f0000000040)='./file0\x00', 0x200, 0x1, &(0x7f00000000c0)=[{&(0x7f0000000080)="7c74c7bc99e778a0c971e6f50fbdd2b70fa0b038d18c7d5ac685833434d89dce684239293aa5d8b6f11bc5c4a033ad1dc68319fad36a1101aad751fd6f4f10", 0x3f, 0x7f}], 0x42000, &(0x7f0000000100)={[{@dots}], [{@obj_user}, {@dont_appraise}, {@uid_lt}, {@hash}, {@seclabel}]}) getsockopt$inet6_IPV6_XFRM_POLICY(0xffffffffffffffff, 0x29, 0x23, &(0x7f0000000240)={{{@in=@loopback, @in6=@empty, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, {{@in6=@local}, 0x0, @in6=@mcast1}}, &(0x7f0000000340)=0xe8) mount$9p_xen(&(0x7f0000000180), &(0x7f00000001c0)='./file0\x00', &(0x7f0000000200), 0x1121061, &(0x7f0000000380)={'trans=xen,', {[{@msize={'msize', 0x3d, 0xf6b3}}, {@debug={'debug', 0x3d, 0x7ff}}, {@posixacl}, {@aname={'aname', 0x3d, '*$-&'}}, {@uname={'uname', 0x3d, 'msdos\x00'}}], [{@seclabel}, {@euid_eq={'euid', 0x3d, r0}}, {@permit_directio}, {@appraise_type}]}}) syz_io_uring_setup(0x1d4a, &(0x7f0000000440)={0x0, 0xfa85, 0x0, 0x0, 0x285}, &(0x7f0000ffd000/0x1000)=nil, &(0x7f0000ffd000/0x2000)=nil, &(0x7f00000004c0)=0x0, &(0x7f0000000500)) syz_io_uring_setup(0x3e5e, &(0x7f0000000540)={0x0, 0x5c61, 0x8, 0x2, 0x72}, &(0x7f0000ffd000/0x3000)=nil, &(0x7f0000ffc000/0x3000)=nil, &(0x7f00000005c0), &(0x7f0000000600)=0x0) syz_io_uring_submit(r1, r2, &(0x7f0000000740)=@IORING_OP_READ=@pass_buffer={0x16, 0x1, 0x2004, @fd_index=0xa, 0x7, &(0x7f0000000640)=""/227, 0xe3, 0xc, 0x1}, 0x9) openat$cgroup_devices(0xffffffffffffffff, &(0x7f00000007c0)='devices.allow\x00', 0x2, 0x0) mount$9p_rdma(&(0x7f0000001040), &(0x7f0000001080)='./file0\x00', &(0x7f00000010c0), 0xa00800, &(0x7f0000001100)={'trans=rdma,', {'port', 0x3d, 0x4e20}, 0x2c, {[{@common=@aname={'aname', 0x3d, 'permit_directio'}}, {@sq={'sq', 0x3d, 0xffff}}], [{@fscontext={'fscontext', 0x3d, 'staff_u'}}]}}) [ 265.099434] loop6: detected capacity change from 0 to 1 [ 265.102975] loop7: detected capacity change from 0 to 1 [ 265.132077] loop6: detected capacity change from 0 to 264192 [ 265.138122] SELinux: security_context_str_to_sid (staff_u) failed with errno=-22 [ 265.144699] nfs4: Unknown parameter '*+\[' 11:42:52 executing program 4: openat$vcsa(0xffffffffffffff9c, 0x0, 0x81, 0x0) socket$inet_tcp(0x2, 0x1, 0x0) syz_genetlink_get_family_id$netlbl_mgmt(&(0x7f0000000440), 0xffffffffffffffff) syz_genetlink_get_family_id$netlbl_mgmt(&(0x7f0000000740), 0xffffffffffffffff) [ 265.159717] SELinux: security_context_str_to_sid (staff_u) failed with errno=-22 11:42:52 executing program 1: r0 = mmap$IORING_OFF_SQ_RING(&(0x7f0000ffd000/0x1000)=nil, 0x1000, 0x0, 0x10, 0xffffffffffffffff, 0x0) syz_io_uring_submit(r0, 0x0, &(0x7f00000001c0)=@IORING_OP_PROVIDE_BUFFERS={0x1f, 0x1, 0x0, 0x8, 0x2, &(0x7f0000000140)="10e8e6d73f8e97a04564912d4b0bee6921be05ed083e4d741dabdbce8c94949f57a5c9d9da73d0e5ad668714159e31498f181aad79547c645eefb456a7b8c4be765eb156b77cba8a752b90d7729b2c285893a10c3633d2485f48f30d247214c5e28a", 0x7, 0x0, 0x1, {0x1}}, 0x100) recvfrom$packet(0xffffffffffffffff, &(0x7f0000000200)=""/108, 0x6c, 0x2000, &(0x7f0000000300)={0x11, 0x16, 0x0, 0x1, 0x8, 0x6, @local}, 0x14) io_uring_setup(0x14ab, &(0x7f0000000480)={0x0, 0x5191, 0x20, 0x1, 0x3ba}) shmget$private(0x0, 0x2000, 0x10, &(0x7f0000ffc000/0x2000)=nil) 11:42:52 executing program 5: r0 = shmget(0x2, 0x3000, 0x100, &(0x7f0000ffb000/0x3000)=nil) shmat(r0, &(0x7f0000ffa000/0x3000)=nil, 0x2000) shmat(r0, &(0x7f0000ffa000/0x4000)=nil, 0x3000) shmget(0x3, 0x1000, 0x100, &(0x7f0000ffd000/0x1000)=nil) syz_genetlink_get_family_id$netlbl_mgmt(&(0x7f0000000040), 0xffffffffffffffff) io_uring_setup(0x14ab, &(0x7f0000000480)={0x0, 0x5191, 0x20, 0x1, 0x3ba}) 11:42:52 executing program 0: setsockopt$inet_tcp_TCP_QUEUE_SEQ(0xffffffffffffffff, 0x6, 0x15, &(0x7f0000000000), 0x4) socket$inet_tcp(0x2, 0x1, 0x0) syz_genetlink_get_family_id$netlbl_mgmt(&(0x7f0000000740), 0xffffffffffffffff) 11:42:52 executing program 7: ioprio_set$uid(0x0, 0xee01, 0x4004) syz_mount_image$msdos(&(0x7f0000000000), &(0x7f0000000040)='./file0\x00', 0x200, 0x1, &(0x7f00000000c0)=[{&(0x7f0000000080)="7c74c7bc99e778a0c971e6f50fbdd2b70fa0b038d18c7d5ac685833434d89dce684239293aa5d8b6f11bc5c4a033ad1dc68319fad36a1101aad751fd6f4f10", 0x3f, 0x7f}], 0x42000, &(0x7f0000000100)={[{@dots}], [{@obj_user}, {@dont_appraise}, {@uid_lt}, {@hash}, {@seclabel}]}) getsockopt$inet6_IPV6_XFRM_POLICY(0xffffffffffffffff, 0x29, 0x23, &(0x7f0000000240)={{{@in=@loopback, @in6=@empty, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, {{@in6=@local}, 0x0, @in6=@mcast1}}, &(0x7f0000000340)=0xe8) mount$9p_xen(&(0x7f0000000180), &(0x7f00000001c0)='./file0\x00', &(0x7f0000000200), 0x1121061, &(0x7f0000000380)={'trans=xen,', {[{@msize={'msize', 0x3d, 0xf6b3}}, {@debug={'debug', 0x3d, 0x7ff}}, {@posixacl}, {@aname={'aname', 0x3d, '*$-&'}}, {@uname={'uname', 0x3d, 'msdos\x00'}}], [{@seclabel}, {@euid_eq={'euid', 0x3d, r0}}, {@permit_directio}, {@appraise_type}]}}) syz_io_uring_setup(0x1d4a, &(0x7f0000000440)={0x0, 0xfa85, 0x0, 0x0, 0x285}, &(0x7f0000ffd000/0x1000)=nil, &(0x7f0000ffd000/0x2000)=nil, &(0x7f00000004c0), &(0x7f0000000500)) syz_io_uring_setup(0x3e5e, &(0x7f0000000540)={0x0, 0x5c61, 0x8, 0x2, 0x72}, &(0x7f0000ffd000/0x3000)=nil, &(0x7f0000ffc000/0x3000)=nil, &(0x7f00000005c0), &(0x7f0000000600)) openat$cgroup_devices(0xffffffffffffffff, &(0x7f00000007c0)='devices.allow\x00', 0x2, 0x0) mount$9p_rdma(&(0x7f0000001040), &(0x7f0000001080)='./file0\x00', &(0x7f00000010c0), 0xa00800, &(0x7f0000001100)={'trans=rdma,', {'port', 0x3d, 0x4e20}, 0x2c, {[{@common=@aname={'aname', 0x3d, 'permit_directio'}}, {@sq={'sq', 0x3d, 0xffff}}], [{@fscontext={'fscontext', 0x3d, 'staff_u'}}]}}) 11:42:52 executing program 6: ioprio_set$uid(0x0, 0xee01, 0x4004) syz_mount_image$msdos(&(0x7f0000000000), &(0x7f0000000040)='./file0\x00', 0x200, 0x1, &(0x7f00000000c0)=[{&(0x7f0000000080)="7c74c7bc99e778a0c971e6f50fbdd2b70fa0b038d18c7d5ac685833434d89dce684239293aa5d8b6f11bc5c4a033ad1dc68319fad36a1101aad751fd6f4f10", 0x3f, 0x7f}], 0x42000, &(0x7f0000000100)={[{@dots}], [{@obj_user}, {@dont_appraise}, {@uid_lt}, {@hash}, {@seclabel}]}) getsockopt$inet6_IPV6_XFRM_POLICY(0xffffffffffffffff, 0x29, 0x23, &(0x7f0000000240)={{{@in=@loopback, @in6=@empty, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, {{@in6=@local}, 0x0, @in6=@mcast1}}, &(0x7f0000000340)=0xe8) mount$9p_xen(&(0x7f0000000180), &(0x7f00000001c0)='./file0\x00', &(0x7f0000000200), 0x1121061, &(0x7f0000000380)={'trans=xen,', {[{@msize={'msize', 0x3d, 0xf6b3}}, {@debug={'debug', 0x3d, 0x7ff}}, {@posixacl}, {@aname={'aname', 0x3d, '*$-&'}}, {@uname={'uname', 0x3d, 'msdos\x00'}}], [{@seclabel}, {@euid_eq={'euid', 0x3d, r0}}, {@permit_directio}, {@appraise_type}]}}) syz_io_uring_setup(0x3e5e, &(0x7f0000000540)={0x0, 0x5c61, 0x8, 0x2, 0x72}, &(0x7f0000ffd000/0x3000)=nil, &(0x7f0000ffc000/0x3000)=nil, &(0x7f00000005c0), &(0x7f0000000600)=0x0) syz_io_uring_submit(0x0, r1, &(0x7f0000000740)=@IORING_OP_READ=@pass_buffer={0x16, 0x1, 0x2004, @fd_index=0xa, 0x7, &(0x7f0000000640)=""/227, 0xe3, 0xc, 0x1}, 0x9) openat$cgroup_devices(0xffffffffffffffff, &(0x7f00000007c0)='devices.allow\x00', 0x2, 0x0) syz_mount_image$nfs4(&(0x7f0000000800), &(0x7f0000000840)='./file0/file0\x00', 0xffffffffffffff01, 0x1, &(0x7f0000000900)=[{&(0x7f0000000880)="f19bd7cfef39dd2070dcb194f7bd90ce305e2a9644b9fb91cc1e75bca69ed6bbdd7636452963af395ea61189cce718ef43420310b6ff8db9f4a606d67217b1aa7bf6e1435682323aef92ef40d036c48fa3fc363c6ad63229bb37cd76a6db9879a39f", 0x62, 0x6}], 0x8400, &(0x7f0000000940)={[{'*+\\['}]}) accept(0xffffffffffffffff, 0x0, &(0x7f0000000980)) mount$9p_rdma(&(0x7f0000001040), &(0x7f0000001080)='./file0\x00', &(0x7f00000010c0), 0xa00800, &(0x7f0000001100)={'trans=rdma,', {'port', 0x3d, 0x4e20}, 0x2c, {[{@common=@aname={'aname', 0x3d, 'permit_directio'}}, {@sq={'sq', 0x3d, 0xffff}}], [{@fscontext={'fscontext', 0x3d, 'staff_u'}}]}}) 11:42:52 executing program 3: ioctl$SG_SET_FORCE_PACK_ID(0xffffffffffffffff, 0x227b, &(0x7f0000000000)=0x1) ioctl$SG_SET_FORCE_PACK_ID(0xffffffffffffffff, 0x227b, &(0x7f0000000040)) ioctl$SG_GET_RESERVED_SIZE(0xffffffffffffffff, 0x2272, &(0x7f0000000080)) r0 = openat$vcsa(0xffffffffffffff9c, &(0x7f00000000c0), 0x4200, 0x0) ioctl$SCSI_IOCTL_SEND_COMMAND(r0, 0x1, &(0x7f0000000100)={0x17, 0x3, 0x1c00, "af36a59fb168d324fd8eaf833aeb82f60d75e8700d81d9"}) ioctl$SG_SET_TIMEOUT(r0, 0x2201, &(0x7f0000000140)=0x4) ioctl$SG_GET_REQUEST_TABLE(r0, 0x2286, &(0x7f00000001c0)) ioctl$SG_GET_TIMEOUT(r0, 0x2202, 0x0) r1 = syz_open_dev$sg(&(0x7f0000000340), 0x7fff, 0x40) ioctl$SG_EMULATED_HOST(r1, 0x2203, &(0x7f0000000380)) r2 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$inet6_tcp_TCP_CONGESTION(r2, 0x6, 0xd, &(0x7f0000000440)='scalable\x00', 0x9) [ 265.300157] loop7: detected capacity change from 0 to 1 [ 265.322589] loop6: detected capacity change from 0 to 1 [ 265.324125] SELinux: security_context_str_to_sid (staff_u) failed with errno=-22 [ 265.345412] loop6: detected capacity change from 0 to 264192 [ 265.352611] nfs4: Unknown parameter '*+\[' [ 265.364803] SELinux: security_context_str_to_sid (staff_u) failed with errno=-22 11:42:52 executing program 5: r0 = shmget(0x2, 0x3000, 0x100, &(0x7f0000ffb000/0x3000)=nil) shmat(r0, &(0x7f0000ffa000/0x3000)=nil, 0x2000) shmat(r0, &(0x7f0000ffa000/0x4000)=nil, 0x3000) shmget(0x3, 0x1000, 0x100, &(0x7f0000ffd000/0x1000)=nil) syz_genetlink_get_family_id$netlbl_mgmt(&(0x7f0000000040), 0xffffffffffffffff) io_uring_setup(0x14ab, &(0x7f0000000480)={0x0, 0x5191, 0x20, 0x1, 0x3ba}) 11:42:52 executing program 4: openat$vcsa(0xffffffffffffff9c, &(0x7f0000000040), 0x0, 0x0) socket$inet_tcp(0x2, 0x1, 0x0) syz_genetlink_get_family_id$netlbl_mgmt(&(0x7f0000000440), 0xffffffffffffffff) syz_genetlink_get_family_id$netlbl_mgmt(&(0x7f0000000740), 0xffffffffffffffff) 11:42:52 executing program 7: ioprio_set$uid(0x0, 0xee01, 0x4004) syz_mount_image$msdos(&(0x7f0000000000), &(0x7f0000000040)='./file0\x00', 0x200, 0x1, &(0x7f00000000c0)=[{&(0x7f0000000080)="7c74c7bc99e778a0c971e6f50fbdd2b70fa0b038d18c7d5ac685833434d89dce684239293aa5d8b6f11bc5c4a033ad1dc68319fad36a1101aad751fd6f4f10", 0x3f, 0x7f}], 0x42000, &(0x7f0000000100)={[{@dots}], [{@obj_user}, {@dont_appraise}, {@uid_lt}, {@hash}, {@seclabel}]}) getsockopt$inet6_IPV6_XFRM_POLICY(0xffffffffffffffff, 0x29, 0x23, &(0x7f0000000240)={{{@in=@loopback, @in6=@empty, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, {{@in6=@local}, 0x0, @in6=@mcast1}}, &(0x7f0000000340)=0xe8) mount$9p_xen(&(0x7f0000000180), &(0x7f00000001c0)='./file0\x00', &(0x7f0000000200), 0x1121061, &(0x7f0000000380)={'trans=xen,', {[{@msize={'msize', 0x3d, 0xf6b3}}, {@debug={'debug', 0x3d, 0x7ff}}, {@posixacl}, {@aname={'aname', 0x3d, '*$-&'}}, {@uname={'uname', 0x3d, 'msdos\x00'}}], [{@seclabel}, {@euid_eq={'euid', 0x3d, r0}}, {@permit_directio}, {@appraise_type}]}}) syz_io_uring_setup(0x1d4a, &(0x7f0000000440)={0x0, 0xfa85, 0x0, 0x0, 0x285}, &(0x7f0000ffd000/0x1000)=nil, &(0x7f0000ffd000/0x2000)=nil, &(0x7f00000004c0), &(0x7f0000000500)) syz_io_uring_setup(0x3e5e, &(0x7f0000000540)={0x0, 0x5c61, 0x8, 0x2, 0x72}, &(0x7f0000ffd000/0x3000)=nil, &(0x7f0000ffc000/0x3000)=nil, &(0x7f00000005c0), &(0x7f0000000600)) openat$cgroup_devices(0xffffffffffffffff, &(0x7f00000007c0)='devices.allow\x00', 0x2, 0x0) mount$9p_rdma(&(0x7f0000001040), &(0x7f0000001080)='./file0\x00', &(0x7f00000010c0), 0xa00800, &(0x7f0000001100)={'trans=rdma,', {'port', 0x3d, 0x4e20}, 0x2c, {[{@common=@aname={'aname', 0x3d, 'permit_directio'}}, {@sq={'sq', 0x3d, 0xffff}}], [{@fscontext={'fscontext', 0x3d, 'staff_u'}}]}}) 11:42:52 executing program 6: ioprio_set$uid(0x0, 0xee01, 0x4004) syz_mount_image$msdos(&(0x7f0000000000), &(0x7f0000000040)='./file0\x00', 0x200, 0x1, &(0x7f00000000c0)=[{&(0x7f0000000080)="7c74c7bc99e778a0c971e6f50fbdd2b70fa0b038d18c7d5ac685833434d89dce684239293aa5d8b6f11bc5c4a033ad1dc68319fad36a1101aad751fd6f4f10", 0x3f, 0x7f}], 0x42000, &(0x7f0000000100)={[{@dots}], [{@obj_user}, {@dont_appraise}, {@uid_lt}, {@hash}, {@seclabel}]}) getsockopt$inet6_IPV6_XFRM_POLICY(0xffffffffffffffff, 0x29, 0x23, &(0x7f0000000240)={{{@in=@loopback, @in6=@empty, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, {{@in6=@local}, 0x0, @in6=@mcast1}}, &(0x7f0000000340)=0xe8) mount$9p_xen(&(0x7f0000000180), &(0x7f00000001c0)='./file0\x00', &(0x7f0000000200), 0x1121061, &(0x7f0000000380)={'trans=xen,', {[{@msize={'msize', 0x3d, 0xf6b3}}, {@debug={'debug', 0x3d, 0x7ff}}, {@posixacl}, {@aname={'aname', 0x3d, '*$-&'}}, {@uname={'uname', 0x3d, 'msdos\x00'}}], [{@seclabel}, {@euid_eq={'euid', 0x3d, r0}}, {@permit_directio}, {@appraise_type}]}}) syz_io_uring_setup(0x3e5e, &(0x7f0000000540)={0x0, 0x5c61, 0x8, 0x2, 0x72}, &(0x7f0000ffd000/0x3000)=nil, &(0x7f0000ffc000/0x3000)=nil, &(0x7f00000005c0), &(0x7f0000000600)=0x0) syz_io_uring_submit(0x0, r1, &(0x7f0000000740)=@IORING_OP_READ=@pass_buffer={0x16, 0x1, 0x2004, @fd_index=0xa, 0x7, &(0x7f0000000640)=""/227, 0xe3, 0xc, 0x1}, 0x9) openat$cgroup_devices(0xffffffffffffffff, &(0x7f00000007c0)='devices.allow\x00', 0x2, 0x0) syz_mount_image$nfs4(&(0x7f0000000800), &(0x7f0000000840)='./file0/file0\x00', 0xffffffffffffff01, 0x1, &(0x7f0000000900)=[{&(0x7f0000000880)="f19bd7cfef39dd2070dcb194f7bd90ce305e2a9644b9fb91cc1e75bca69ed6bbdd7636452963af395ea61189cce718ef43420310b6ff8db9f4a606d67217b1aa7bf6e1435682323aef92ef40d036c48fa3fc363c6ad63229bb37cd76a6db9879a39f", 0x62, 0x6}], 0x8400, &(0x7f0000000940)={[{'*+\\['}]}) accept(0xffffffffffffffff, 0x0, &(0x7f0000000980)) mount$9p_rdma(&(0x7f0000001040), &(0x7f0000001080)='./file0\x00', &(0x7f00000010c0), 0xa00800, &(0x7f0000001100)={'trans=rdma,', {'port', 0x3d, 0x4e20}, 0x2c, {[{@common=@aname={'aname', 0x3d, 'permit_directio'}}, {@sq={'sq', 0x3d, 0xffff}}], [{@fscontext={'fscontext', 0x3d, 'staff_u'}}]}}) 11:42:52 executing program 1: mmap$IORING_OFF_SQ_RING(&(0x7f0000ffd000/0x1000)=nil, 0x1000, 0x0, 0x10, 0xffffffffffffffff, 0x0) syz_io_uring_submit(0x0, 0x0, &(0x7f00000001c0)=@IORING_OP_PROVIDE_BUFFERS={0x1f, 0x1, 0x0, 0x8, 0x2, &(0x7f0000000140)="10e8e6d73f8e97a04564912d4b0bee6921be05ed083e4d741dabdbce8c94949f57a5c9d9da73d0e5ad668714159e31498f181aad79547c645eefb456a7b8c4be765eb156b77cba8a752b90d7729b2c285893a10c3633d2485f48f30d247214c5e28a", 0x7, 0x0, 0x1, {0x1}}, 0x100) recvfrom$packet(0xffffffffffffffff, &(0x7f0000000200)=""/108, 0x6c, 0x2000, &(0x7f0000000300)={0x11, 0x16, 0x0, 0x1, 0x8, 0x6, @local}, 0x14) io_uring_setup(0x14ab, &(0x7f0000000480)={0x0, 0x5191, 0x20, 0x1, 0x3ba}) shmget$private(0x0, 0x2000, 0x10, &(0x7f0000ffc000/0x2000)=nil) [ 265.549274] loop6: detected capacity change from 0 to 1 [ 265.595375] loop6: detected capacity change from 0 to 264192 [ 265.608009] nfs4: Unknown parameter '*+\[' [ 265.612881] SELinux: security_context_str_to_sid (staff_u) failed with errno=-22 11:43:00 executing program 2: clock_nanosleep(0x7, 0x0, &(0x7f0000000000)={0x77359400}, &(0x7f0000000040)) getsockopt$inet6_IPV6_XFRM_POLICY(0xffffffffffffffff, 0x29, 0x23, &(0x7f0000000080)={{{@in6, @in6=@remote, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, {{@in6=@dev}, 0x0, @in=@initdev}}, &(0x7f0000000180)=0xe8) setsockopt$packet_add_memb(0xffffffffffffffff, 0x107, 0x1, &(0x7f00000001c0)={r0, 0x1, 0x6, @broadcast}, 0x10) openat$sr(0xffffffffffffff9c, &(0x7f0000005480), 0x428802, 0x0) 11:43:00 executing program 6: ioprio_set$uid(0x0, 0xee01, 0x4004) syz_mount_image$msdos(&(0x7f0000000000), &(0x7f0000000040)='./file0\x00', 0x200, 0x1, &(0x7f00000000c0)=[{&(0x7f0000000080)="7c74c7bc99e778a0c971e6f50fbdd2b70fa0b038d18c7d5ac685833434d89dce684239293aa5d8b6f11bc5c4a033ad1dc68319fad36a1101aad751fd6f4f10", 0x3f, 0x7f}], 0x42000, &(0x7f0000000100)={[{@dots}], [{@obj_user}, {@dont_appraise}, {@uid_lt}, {@hash}, {@seclabel}]}) getsockopt$inet6_IPV6_XFRM_POLICY(0xffffffffffffffff, 0x29, 0x23, &(0x7f0000000240)={{{@in=@loopback, @in6=@empty}}, {{@in6=@local}, 0x0, @in6=@mcast1}}, &(0x7f0000000340)=0xe8) syz_io_uring_setup(0x1d4a, &(0x7f0000000440)={0x0, 0xfa85, 0x0, 0x0, 0x285}, &(0x7f0000ffd000/0x1000)=nil, &(0x7f0000ffd000/0x2000)=nil, &(0x7f00000004c0)=0x0, &(0x7f0000000500)) syz_io_uring_setup(0x3e5e, &(0x7f0000000540)={0x0, 0x5c61, 0x8, 0x2, 0x72}, &(0x7f0000ffd000/0x3000)=nil, &(0x7f0000ffc000/0x3000)=nil, &(0x7f00000005c0), &(0x7f0000000600)=0x0) syz_io_uring_submit(r0, r1, &(0x7f0000000740)=@IORING_OP_READ=@pass_buffer={0x16, 0x1, 0x2004, @fd_index=0xa, 0x7, &(0x7f0000000640)=""/227, 0xe3, 0xc, 0x1}, 0x9) openat$cgroup_devices(0xffffffffffffffff, &(0x7f00000007c0)='devices.allow\x00', 0x2, 0x0) syz_mount_image$nfs4(&(0x7f0000000800), &(0x7f0000000840)='./file0/file0\x00', 0xffffffffffffff01, 0x1, &(0x7f0000000900)=[{&(0x7f0000000880)="f19bd7cfef39dd2070dcb194f7bd90ce305e2a9644b9fb91cc1e75bca69ed6bbdd7636452963af395ea61189cce718ef43420310b6ff8db9f4a606d67217b1aa7bf6e1435682323aef92ef40d036c48fa3fc363c6ad63229bb37cd76a6db9879a39f", 0x62, 0x6}], 0x8400, &(0x7f0000000940)={[{'*+\\['}]}) accept(0xffffffffffffffff, 0x0, &(0x7f0000000980)) mount$9p_rdma(&(0x7f0000001040), &(0x7f0000001080)='./file0\x00', &(0x7f00000010c0), 0xa00800, &(0x7f0000001100)={'trans=rdma,', {'port', 0x3d, 0x4e20}, 0x2c, {[{@common=@aname={'aname', 0x3d, 'permit_directio'}}, {@sq={'sq', 0x3d, 0xffff}}], [{@fscontext={'fscontext', 0x3d, 'staff_u'}}]}}) 11:43:00 executing program 0: setsockopt$inet_tcp_TCP_QUEUE_SEQ(0xffffffffffffffff, 0x6, 0x15, &(0x7f0000000000), 0x4) socket$inet_tcp(0x2, 0x1, 0x0) syz_genetlink_get_family_id$netlbl_mgmt(&(0x7f0000000740), 0xffffffffffffffff) 11:43:00 executing program 5: r0 = shmget(0x2, 0x3000, 0x100, &(0x7f0000ffb000/0x3000)=nil) shmat(r0, &(0x7f0000ffa000/0x3000)=nil, 0x2000) shmat(r0, &(0x7f0000ffa000/0x4000)=nil, 0x3000) shmget(0x3, 0x1000, 0x100, &(0x7f0000ffd000/0x1000)=nil) syz_genetlink_get_family_id$netlbl_mgmt(&(0x7f0000000040), 0xffffffffffffffff) io_uring_setup(0x14ab, &(0x7f0000000480)={0x0, 0x5191, 0x20, 0x1, 0x3ba}) 11:43:00 executing program 3: ioctl$SG_SET_FORCE_PACK_ID(0xffffffffffffffff, 0x227b, &(0x7f0000000000)=0x1) ioctl$SG_SET_FORCE_PACK_ID(0xffffffffffffffff, 0x227b, &(0x7f0000000040)) ioctl$SG_GET_RESERVED_SIZE(0xffffffffffffffff, 0x2272, &(0x7f0000000080)) r0 = openat$vcsa(0xffffffffffffff9c, &(0x7f00000000c0), 0x4200, 0x0) ioctl$SCSI_IOCTL_SEND_COMMAND(r0, 0x1, &(0x7f0000000100)={0x17, 0x3, 0x1c00, "af36a59fb168d324fd8eaf833aeb82f60d75e8700d81d9"}) ioctl$SG_GET_VERSION_NUM(r0, 0x2282, &(0x7f0000000180)) ioctl$SG_GET_REQUEST_TABLE(r0, 0x2286, &(0x7f00000001c0)) ioctl$SG_GET_TIMEOUT(r0, 0x2202, 0x0) r1 = syz_open_dev$sg(&(0x7f0000000340), 0x7fff, 0x40) ioctl$SG_EMULATED_HOST(r1, 0x2203, &(0x7f0000000380)) r2 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$inet6_tcp_TCP_CONGESTION(r2, 0x6, 0xd, &(0x7f0000000440)='scalable\x00', 0x9) 11:43:00 executing program 4: openat$vcsa(0xffffffffffffff9c, &(0x7f0000000040), 0x0, 0x0) socket$inet_tcp(0x2, 0x1, 0x0) syz_genetlink_get_family_id$netlbl_mgmt(&(0x7f0000000440), 0xffffffffffffffff) syz_genetlink_get_family_id$netlbl_mgmt(&(0x7f0000000740), 0xffffffffffffffff) 11:43:00 executing program 7: ioprio_set$uid(0x0, 0xee01, 0x4004) syz_mount_image$msdos(&(0x7f0000000000), &(0x7f0000000040)='./file0\x00', 0x200, 0x1, &(0x7f00000000c0)=[{&(0x7f0000000080)="7c74c7bc99e778a0c971e6f50fbdd2b70fa0b038d18c7d5ac685833434d89dce684239293aa5d8b6f11bc5c4a033ad1dc68319fad36a1101aad751fd6f4f10", 0x3f, 0x7f}], 0x42000, &(0x7f0000000100)={[{@dots}], [{@obj_user}, {@dont_appraise}, {@uid_lt}, {@hash}, {@seclabel}]}) getsockopt$inet6_IPV6_XFRM_POLICY(0xffffffffffffffff, 0x29, 0x23, &(0x7f0000000240)={{{@in=@loopback, @in6=@empty, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, {{@in6=@local}, 0x0, @in6=@mcast1}}, &(0x7f0000000340)=0xe8) mount$9p_xen(&(0x7f0000000180), &(0x7f00000001c0)='./file0\x00', &(0x7f0000000200), 0x1121061, &(0x7f0000000380)={'trans=xen,', {[{@msize={'msize', 0x3d, 0xf6b3}}, {@debug={'debug', 0x3d, 0x7ff}}, {@posixacl}, {@aname={'aname', 0x3d, '*$-&'}}, {@uname={'uname', 0x3d, 'msdos\x00'}}], [{@seclabel}, {@euid_eq={'euid', 0x3d, r0}}, {@permit_directio}, {@appraise_type}]}}) syz_io_uring_setup(0x1d4a, &(0x7f0000000440)={0x0, 0xfa85, 0x0, 0x0, 0x285}, &(0x7f0000ffd000/0x1000)=nil, &(0x7f0000ffd000/0x2000)=nil, &(0x7f00000004c0), &(0x7f0000000500)) syz_io_uring_setup(0x3e5e, &(0x7f0000000540)={0x0, 0x5c61, 0x8, 0x2, 0x72}, &(0x7f0000ffd000/0x3000)=nil, &(0x7f0000ffc000/0x3000)=nil, &(0x7f00000005c0), &(0x7f0000000600)) openat$cgroup_devices(0xffffffffffffffff, &(0x7f00000007c0)='devices.allow\x00', 0x2, 0x0) mount$9p_rdma(&(0x7f0000001040), &(0x7f0000001080)='./file0\x00', &(0x7f00000010c0), 0xa00800, &(0x7f0000001100)={'trans=rdma,', {'port', 0x3d, 0x4e20}, 0x2c, {[{@common=@aname={'aname', 0x3d, 'permit_directio'}}, {@sq={'sq', 0x3d, 0xffff}}], [{@fscontext={'fscontext', 0x3d, 'staff_u'}}]}}) 11:43:00 executing program 1: mmap$IORING_OFF_SQ_RING(&(0x7f0000ffd000/0x1000)=nil, 0x1000, 0x0, 0x10, 0xffffffffffffffff, 0x0) syz_io_uring_submit(0x0, 0x0, 0x0, 0x100) recvfrom$packet(0xffffffffffffffff, &(0x7f0000000200)=""/108, 0x6c, 0x2000, &(0x7f0000000300)={0x11, 0x16, 0x0, 0x1, 0x8, 0x6, @local}, 0x14) io_uring_setup(0x14ab, &(0x7f0000000480)={0x0, 0x5191, 0x20, 0x1, 0x3ba}) shmget$private(0x0, 0x2000, 0x10, &(0x7f0000ffc000/0x2000)=nil) [ 273.598774] loop7: detected capacity change from 0 to 1 [ 273.609759] SELinux: security_context_str_to_sid (staff_u) failed with errno=-22 [ 273.625672] loop6: detected capacity change from 0 to 1 11:43:00 executing program 0: setsockopt$inet_tcp_TCP_QUEUE_SEQ(0xffffffffffffffff, 0x6, 0x15, &(0x7f0000000000), 0x4) syz_genetlink_get_family_id$netlbl_mgmt(&(0x7f0000000440), 0xffffffffffffffff) syz_genetlink_get_family_id$netlbl_mgmt(&(0x7f0000000740), 0xffffffffffffffff) 11:43:00 executing program 7: ioprio_set$uid(0x0, 0xee01, 0x4004) syz_mount_image$msdos(&(0x7f0000000000), &(0x7f0000000040)='./file0\x00', 0x200, 0x1, &(0x7f00000000c0)=[{&(0x7f0000000080)="7c74c7bc99e778a0c971e6f50fbdd2b70fa0b038d18c7d5ac685833434d89dce684239293aa5d8b6f11bc5c4a033ad1dc68319fad36a1101aad751fd6f4f10", 0x3f, 0x7f}], 0x42000, &(0x7f0000000100)={[{@dots}], [{@obj_user}, {@dont_appraise}, {@uid_lt}, {@hash}, {@seclabel}]}) getsockopt$inet6_IPV6_XFRM_POLICY(0xffffffffffffffff, 0x29, 0x23, &(0x7f0000000240)={{{@in=@loopback, @in6=@empty, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, {{@in6=@local}, 0x0, @in6=@mcast1}}, &(0x7f0000000340)=0xe8) mount$9p_xen(&(0x7f0000000180), &(0x7f00000001c0)='./file0\x00', &(0x7f0000000200), 0x1121061, &(0x7f0000000380)={'trans=xen,', {[{@msize={'msize', 0x3d, 0xf6b3}}, {@debug={'debug', 0x3d, 0x7ff}}, {@posixacl}, {@aname={'aname', 0x3d, '*$-&'}}, {@uname={'uname', 0x3d, 'msdos\x00'}}], [{@seclabel}, {@euid_eq={'euid', 0x3d, r0}}, {@permit_directio}, {@appraise_type}]}}) syz_io_uring_setup(0x1d4a, &(0x7f0000000440)={0x0, 0xfa85, 0x0, 0x0, 0x285}, &(0x7f0000ffd000/0x1000)=nil, &(0x7f0000ffd000/0x2000)=nil, &(0x7f00000004c0)=0x0, &(0x7f0000000500)) syz_io_uring_submit(r1, 0x0, &(0x7f0000000740)=@IORING_OP_READ=@pass_buffer={0x16, 0x1, 0x2004, @fd_index=0xa, 0x7, &(0x7f0000000640)=""/227, 0xe3, 0xc, 0x1}, 0x9) openat$cgroup_devices(0xffffffffffffffff, &(0x7f00000007c0)='devices.allow\x00', 0x2, 0x0) mount$9p_rdma(&(0x7f0000001040), &(0x7f0000001080)='./file0\x00', &(0x7f00000010c0), 0xa00800, &(0x7f0000001100)={'trans=rdma,', {'port', 0x3d, 0x4e20}, 0x2c, {[{@common=@aname={'aname', 0x3d, 'permit_directio'}}, {@sq={'sq', 0x3d, 0xffff}}], [{@fscontext={'fscontext', 0x3d, 'staff_u'}}]}}) [ 273.658254] loop6: detected capacity change from 0 to 264192 [ 273.673812] nfs4: Unknown parameter '*+\[' 11:43:00 executing program 5: r0 = shmget(0x2, 0x3000, 0x100, &(0x7f0000ffb000/0x3000)=nil) shmat(r0, &(0x7f0000ffa000/0x3000)=nil, 0x2000) shmat(r0, &(0x7f0000ffa000/0x4000)=nil, 0x3000) shmget(0x3, 0x1000, 0x100, &(0x7f0000ffd000/0x1000)=nil) mmap$IORING_OFF_SQ_RING(&(0x7f0000ffd000/0x1000)=nil, 0x1000, 0x2000006, 0x40010, 0xffffffffffffffff, 0x0) io_uring_setup(0x14ab, &(0x7f0000000480)={0x0, 0x5191, 0x20, 0x1, 0x3ba}) [ 273.699357] loop7: detected capacity change from 0 to 1 [ 273.700194] SELinux: security_context_str_to_sid (staff_u) failed with errno=-22 11:43:00 executing program 4: openat$vcsa(0xffffffffffffff9c, &(0x7f0000000040), 0x0, 0x0) socket$inet_tcp(0x2, 0x1, 0x0) syz_genetlink_get_family_id$netlbl_mgmt(&(0x7f0000000440), 0xffffffffffffffff) syz_genetlink_get_family_id$netlbl_mgmt(&(0x7f0000000740), 0xffffffffffffffff) [ 273.714499] SELinux: security_context_str_to_sid (staff_u) failed with errno=-22 11:43:09 executing program 6: ioprio_set$uid(0x0, 0xee01, 0x4004) syz_mount_image$msdos(&(0x7f0000000000), &(0x7f0000000040)='./file0\x00', 0x200, 0x1, &(0x7f00000000c0)=[{&(0x7f0000000080)="7c74c7bc99e778a0c971e6f50fbdd2b70fa0b038d18c7d5ac685833434d89dce684239293aa5d8b6f11bc5c4a033ad1dc68319fad36a1101aad751fd6f4f10", 0x3f, 0x7f}], 0x42000, &(0x7f0000000100)={[{@dots}], [{@obj_user}, {@dont_appraise}, {@uid_lt}, {@hash}, {@seclabel}]}) getsockopt$inet6_IPV6_XFRM_POLICY(0xffffffffffffffff, 0x29, 0x23, &(0x7f0000000240)={{{@in=@loopback, @in6=@empty}}, {{@in6=@local}, 0x0, @in6=@mcast1}}, &(0x7f0000000340)=0xe8) syz_io_uring_setup(0x1d4a, &(0x7f0000000440)={0x0, 0xfa85, 0x0, 0x0, 0x285}, &(0x7f0000ffd000/0x1000)=nil, &(0x7f0000ffd000/0x2000)=nil, &(0x7f00000004c0)=0x0, &(0x7f0000000500)) syz_io_uring_setup(0x3e5e, &(0x7f0000000540)={0x0, 0x5c61, 0x8, 0x2, 0x72}, &(0x7f0000ffd000/0x3000)=nil, &(0x7f0000ffc000/0x3000)=nil, &(0x7f00000005c0), &(0x7f0000000600)=0x0) syz_io_uring_submit(r0, r1, &(0x7f0000000740)=@IORING_OP_READ=@pass_buffer={0x16, 0x1, 0x2004, @fd_index=0xa, 0x7, &(0x7f0000000640)=""/227, 0xe3, 0xc, 0x1}, 0x9) openat$cgroup_devices(0xffffffffffffffff, &(0x7f00000007c0)='devices.allow\x00', 0x2, 0x0) syz_mount_image$nfs4(&(0x7f0000000800), &(0x7f0000000840)='./file0/file0\x00', 0xffffffffffffff01, 0x1, &(0x7f0000000900)=[{&(0x7f0000000880)="f19bd7cfef39dd2070dcb194f7bd90ce305e2a9644b9fb91cc1e75bca69ed6bbdd7636452963af395ea61189cce718ef43420310b6ff8db9f4a606d67217b1aa7bf6e1435682323aef92ef40d036c48fa3fc363c6ad63229bb37cd76a6db9879a39f", 0x62, 0x6}], 0x8400, &(0x7f0000000940)={[{'*+\\['}]}) accept(0xffffffffffffffff, 0x0, &(0x7f0000000980)) mount$9p_rdma(&(0x7f0000001040), &(0x7f0000001080)='./file0\x00', &(0x7f00000010c0), 0xa00800, &(0x7f0000001100)={'trans=rdma,', {'port', 0x3d, 0x4e20}, 0x2c, {[{@common=@aname={'aname', 0x3d, 'permit_directio'}}, {@sq={'sq', 0x3d, 0xffff}}], [{@fscontext={'fscontext', 0x3d, 'staff_u'}}]}}) 11:43:09 executing program 2: clock_nanosleep(0x7, 0x0, &(0x7f0000000000)={0x77359400}, &(0x7f0000000040)) getsockopt$inet6_IPV6_XFRM_POLICY(0xffffffffffffffff, 0x29, 0x23, &(0x7f0000000080)={{{@in6, @in6=@remote}}, {{@in6=@dev}, 0x0, @in=@initdev}}, &(0x7f0000000180)=0xe8) openat$sr(0xffffffffffffff9c, &(0x7f0000005480), 0x428802, 0x0) 11:43:09 executing program 4: openat$vcsa(0xffffffffffffff9c, &(0x7f0000000040), 0x81, 0x0) socket$inet_tcp(0x2, 0x1, 0x0) syz_genetlink_get_family_id$netlbl_mgmt(0x0, 0xffffffffffffffff) syz_genetlink_get_family_id$netlbl_mgmt(&(0x7f0000000740), 0xffffffffffffffff) 11:43:09 executing program 7: ioprio_set$uid(0x0, 0xee01, 0x4004) syz_mount_image$msdos(&(0x7f0000000000), &(0x7f0000000040)='./file0\x00', 0x200, 0x1, &(0x7f00000000c0)=[{&(0x7f0000000080)="7c74c7bc99e778a0c971e6f50fbdd2b70fa0b038d18c7d5ac685833434d89dce684239293aa5d8b6f11bc5c4a033ad1dc68319fad36a1101aad751fd6f4f10", 0x3f, 0x7f}], 0x42000, &(0x7f0000000100)={[{@dots}], [{@obj_user}, {@dont_appraise}, {@uid_lt}, {@hash}, {@seclabel}]}) getsockopt$inet6_IPV6_XFRM_POLICY(0xffffffffffffffff, 0x29, 0x23, &(0x7f0000000240)={{{@in=@loopback, @in6=@empty, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, {{@in6=@local}, 0x0, @in6=@mcast1}}, &(0x7f0000000340)=0xe8) mount$9p_xen(&(0x7f0000000180), &(0x7f00000001c0)='./file0\x00', &(0x7f0000000200), 0x1121061, &(0x7f0000000380)={'trans=xen,', {[{@msize={'msize', 0x3d, 0xf6b3}}, {@debug={'debug', 0x3d, 0x7ff}}, {@posixacl}, {@aname={'aname', 0x3d, '*$-&'}}, {@uname={'uname', 0x3d, 'msdos\x00'}}], [{@seclabel}, {@euid_eq={'euid', 0x3d, r0}}, {@permit_directio}, {@appraise_type}]}}) syz_io_uring_setup(0x1d4a, &(0x7f0000000440)={0x0, 0xfa85, 0x0, 0x0, 0x285}, &(0x7f0000ffd000/0x1000)=nil, &(0x7f0000ffd000/0x2000)=nil, &(0x7f00000004c0)=0x0, &(0x7f0000000500)) syz_io_uring_submit(r1, 0x0, &(0x7f0000000740)=@IORING_OP_READ=@pass_buffer={0x16, 0x1, 0x2004, @fd_index=0xa, 0x7, &(0x7f0000000640)=""/227, 0xe3, 0xc, 0x1}, 0x9) openat$cgroup_devices(0xffffffffffffffff, &(0x7f00000007c0)='devices.allow\x00', 0x2, 0x0) mount$9p_rdma(&(0x7f0000001040), &(0x7f0000001080)='./file0\x00', &(0x7f00000010c0), 0xa00800, &(0x7f0000001100)={'trans=rdma,', {'port', 0x3d, 0x4e20}, 0x2c, {[{@common=@aname={'aname', 0x3d, 'permit_directio'}}, {@sq={'sq', 0x3d, 0xffff}}], [{@fscontext={'fscontext', 0x3d, 'staff_u'}}]}}) 11:43:09 executing program 0: setsockopt$inet_tcp_TCP_QUEUE_SEQ(0xffffffffffffffff, 0x6, 0x15, &(0x7f0000000000), 0x4) syz_genetlink_get_family_id$netlbl_mgmt(&(0x7f0000000440), 0xffffffffffffffff) syz_genetlink_get_family_id$netlbl_mgmt(&(0x7f0000000740), 0xffffffffffffffff) 11:43:09 executing program 5: r0 = shmget(0x2, 0x3000, 0x100, &(0x7f0000ffb000/0x3000)=nil) shmat(r0, &(0x7f0000ffa000/0x3000)=nil, 0x2000) shmat(r0, &(0x7f0000ffa000/0x4000)=nil, 0x3000) shmget(0x3, 0x1000, 0x100, &(0x7f0000ffd000/0x1000)=nil) mmap$IORING_OFF_SQ_RING(&(0x7f0000ffd000/0x1000)=nil, 0x1000, 0x2000006, 0x40010, 0xffffffffffffffff, 0x0) io_uring_setup(0x14ab, &(0x7f0000000480)={0x0, 0x5191, 0x20, 0x1, 0x3ba}) 11:43:09 executing program 3: ioctl$SG_SET_FORCE_PACK_ID(0xffffffffffffffff, 0x227b, &(0x7f0000000000)=0x1) ioctl$SG_SET_FORCE_PACK_ID(0xffffffffffffffff, 0x227b, &(0x7f0000000040)) ioctl$SG_GET_RESERVED_SIZE(0xffffffffffffffff, 0x2272, &(0x7f0000000080)) r0 = openat$vcsa(0xffffffffffffff9c, &(0x7f00000000c0), 0x4200, 0x0) ioctl$SCSI_IOCTL_SEND_COMMAND(r0, 0x1, &(0x7f0000000100)={0x17, 0x3, 0x1c00, "af36a59fb168d324fd8eaf833aeb82f60d75e8700d81d9"}) ioctl$SG_GET_VERSION_NUM(r0, 0x2282, &(0x7f0000000180)) ioctl$SG_GET_REQUEST_TABLE(r0, 0x2286, &(0x7f00000001c0)) ioctl$SG_GET_TIMEOUT(r0, 0x2202, 0x0) r1 = syz_open_dev$sg(&(0x7f0000000340), 0x7fff, 0x40) ioctl$SG_EMULATED_HOST(r1, 0x2203, &(0x7f0000000380)) r2 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$inet6_tcp_TCP_CONGESTION(r2, 0x6, 0xd, &(0x7f0000000440)='scalable\x00', 0x9) 11:43:09 executing program 1: mmap$IORING_OFF_SQ_RING(&(0x7f0000ffd000/0x1000)=nil, 0x1000, 0x0, 0x10, 0xffffffffffffffff, 0x0) syz_io_uring_submit(0x0, 0x0, 0x0, 0x0) recvfrom$packet(0xffffffffffffffff, &(0x7f0000000200)=""/108, 0x6c, 0x2000, &(0x7f0000000300)={0x11, 0x16, 0x0, 0x1, 0x8, 0x6, @local}, 0x14) io_uring_setup(0x14ab, &(0x7f0000000480)={0x0, 0x5191, 0x20, 0x1, 0x3ba}) shmget$private(0x0, 0x2000, 0x10, &(0x7f0000ffc000/0x2000)=nil) 11:43:09 executing program 1: mmap$IORING_OFF_SQ_RING(&(0x7f0000ffd000/0x1000)=nil, 0x1000, 0x0, 0x10, 0xffffffffffffffff, 0x0) syz_io_uring_submit(0x0, 0x0, 0x0, 0x0) recvfrom$packet(0xffffffffffffffff, 0x0, 0x0, 0x2000, &(0x7f0000000300)={0x11, 0x16, 0x0, 0x1, 0x8, 0x6, @local}, 0x14) io_uring_setup(0x14ab, &(0x7f0000000480)={0x0, 0x5191, 0x20, 0x1, 0x3ba}) shmget$private(0x0, 0x2000, 0x10, &(0x7f0000ffc000/0x2000)=nil) 11:43:09 executing program 4: openat$vcsa(0xffffffffffffff9c, &(0x7f0000000040), 0x81, 0x0) socket$inet_tcp(0x2, 0x1, 0x0) syz_genetlink_get_family_id$netlbl_mgmt(0x0, 0xffffffffffffffff) syz_genetlink_get_family_id$netlbl_mgmt(&(0x7f0000000740), 0xffffffffffffffff) [ 282.402690] loop6: detected capacity change from 0 to 1 [ 282.405395] loop7: detected capacity change from 0 to 1 [ 282.421058] SELinux: security_context_str_to_sid (staff_u) failed with errno=-22 [ 282.431270] loop6: detected capacity change from 0 to 264192 [ 282.442825] nfs4: Unknown parameter '*+\[' 11:43:09 executing program 5: r0 = shmget(0x2, 0x3000, 0x100, &(0x7f0000ffb000/0x3000)=nil) shmat(r0, &(0x7f0000ffa000/0x3000)=nil, 0x2000) shmat(r0, &(0x7f0000ffa000/0x4000)=nil, 0x3000) shmget(0x3, 0x1000, 0x100, &(0x7f0000ffd000/0x1000)=nil) mmap$IORING_OFF_SQ_RING(&(0x7f0000ffd000/0x1000)=nil, 0x1000, 0x2000006, 0x40010, 0xffffffffffffffff, 0x0) io_uring_setup(0x14ab, &(0x7f0000000480)={0x0, 0x5191, 0x20, 0x1, 0x3ba}) [ 282.450976] SELinux: security_context_str_to_sid (staff_u) failed with errno=-22 11:43:09 executing program 7: ioprio_set$uid(0x0, 0xee01, 0x4004) syz_mount_image$msdos(&(0x7f0000000000), &(0x7f0000000040)='./file0\x00', 0x200, 0x1, &(0x7f00000000c0)=[{&(0x7f0000000080)="7c74c7bc99e778a0c971e6f50fbdd2b70fa0b038d18c7d5ac685833434d89dce684239293aa5d8b6f11bc5c4a033ad1dc68319fad36a1101aad751fd6f4f10", 0x3f, 0x7f}], 0x42000, &(0x7f0000000100)={[{@dots}], [{@obj_user}, {@dont_appraise}, {@uid_lt}, {@hash}, {@seclabel}]}) getsockopt$inet6_IPV6_XFRM_POLICY(0xffffffffffffffff, 0x29, 0x23, &(0x7f0000000240)={{{@in=@loopback, @in6=@empty, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, {{@in6=@local}, 0x0, @in6=@mcast1}}, &(0x7f0000000340)=0xe8) mount$9p_xen(&(0x7f0000000180), &(0x7f00000001c0)='./file0\x00', &(0x7f0000000200), 0x1121061, &(0x7f0000000380)={'trans=xen,', {[{@msize={'msize', 0x3d, 0xf6b3}}, {@debug={'debug', 0x3d, 0x7ff}}, {@posixacl}, {@aname={'aname', 0x3d, '*$-&'}}, {@uname={'uname', 0x3d, 'msdos\x00'}}], [{@seclabel}, {@euid_eq={'euid', 0x3d, r0}}, {@permit_directio}, {@appraise_type}]}}) syz_io_uring_submit(0x0, 0x0, &(0x7f0000000740)=@IORING_OP_READ=@pass_buffer={0x16, 0x1, 0x2004, @fd_index=0xa, 0x7, &(0x7f0000000640)=""/227, 0xe3, 0xc, 0x1}, 0x9) openat$cgroup_devices(0xffffffffffffffff, &(0x7f00000007c0)='devices.allow\x00', 0x2, 0x0) mount$9p_rdma(&(0x7f0000001040), &(0x7f0000001080)='./file0\x00', &(0x7f00000010c0), 0xa00800, &(0x7f0000001100)={'trans=rdma,', {'port', 0x3d, 0x4e20}, 0x2c, {[{@common=@aname={'aname', 0x3d, 'permit_directio'}}, {@sq={'sq', 0x3d, 0xffff}}], [{@fscontext={'fscontext', 0x3d, 'staff_u'}}]}}) 11:43:09 executing program 0: setsockopt$inet_tcp_TCP_QUEUE_SEQ(0xffffffffffffffff, 0x6, 0x15, &(0x7f0000000000), 0x4) syz_genetlink_get_family_id$netlbl_mgmt(&(0x7f0000000440), 0xffffffffffffffff) syz_genetlink_get_family_id$netlbl_mgmt(&(0x7f0000000740), 0xffffffffffffffff) 11:43:09 executing program 3: ioctl$SG_SET_FORCE_PACK_ID(0xffffffffffffffff, 0x227b, &(0x7f0000000000)=0x1) ioctl$SG_SET_FORCE_PACK_ID(0xffffffffffffffff, 0x227b, &(0x7f0000000040)) ioctl$SG_GET_RESERVED_SIZE(0xffffffffffffffff, 0x2272, &(0x7f0000000080)) r0 = openat$vcsa(0xffffffffffffff9c, &(0x7f00000000c0), 0x4200, 0x0) ioctl$SCSI_IOCTL_SEND_COMMAND(r0, 0x1, &(0x7f0000000100)={0x17, 0x3, 0x1c00, "af36a59fb168d324fd8eaf833aeb82f60d75e8700d81d9"}) ioctl$SG_GET_VERSION_NUM(r0, 0x2282, &(0x7f0000000180)) ioctl$SG_GET_REQUEST_TABLE(r0, 0x2286, &(0x7f00000001c0)) ioctl$SG_GET_TIMEOUT(r0, 0x2202, 0x0) r1 = syz_open_dev$sg(&(0x7f0000000340), 0x7fff, 0x40) ioctl$SG_EMULATED_HOST(r1, 0x2203, &(0x7f0000000380)) r2 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$inet6_tcp_TCP_CONGESTION(r2, 0x6, 0xd, &(0x7f0000000440)='scalable\x00', 0x9) 11:43:09 executing program 1: mmap$IORING_OFF_SQ_RING(&(0x7f0000ffd000/0x1000)=nil, 0x1000, 0x0, 0x10, 0xffffffffffffffff, 0x0) syz_io_uring_submit(0x0, 0x0, 0x0, 0x0) recvfrom$packet(0xffffffffffffffff, 0x0, 0x0, 0x2000, &(0x7f0000000300)={0x11, 0x16, 0x0, 0x1, 0x8, 0x6, @local}, 0x14) io_uring_setup(0x14ab, &(0x7f0000000480)={0x0, 0x5191, 0x20, 0x1, 0x3ba}) shmget$private(0x0, 0x2000, 0x10, &(0x7f0000ffc000/0x2000)=nil) 11:43:09 executing program 6: ioprio_set$uid(0x0, 0xee01, 0x4004) syz_mount_image$msdos(&(0x7f0000000000), &(0x7f0000000040)='./file0\x00', 0x200, 0x1, &(0x7f00000000c0)=[{&(0x7f0000000080)="7c74c7bc99e778a0c971e6f50fbdd2b70fa0b038d18c7d5ac685833434d89dce684239293aa5d8b6f11bc5c4a033ad1dc68319fad36a1101aad751fd6f4f10", 0x3f, 0x7f}], 0x42000, &(0x7f0000000100)={[{@dots}], [{@obj_user}, {@dont_appraise}, {@uid_lt}, {@hash}, {@seclabel}]}) getsockopt$inet6_IPV6_XFRM_POLICY(0xffffffffffffffff, 0x29, 0x23, &(0x7f0000000240)={{{@in=@loopback, @in6=@empty}}, {{@in6=@local}, 0x0, @in6=@mcast1}}, &(0x7f0000000340)=0xe8) syz_io_uring_setup(0x1d4a, &(0x7f0000000440)={0x0, 0xfa85, 0x0, 0x0, 0x285}, &(0x7f0000ffd000/0x1000)=nil, &(0x7f0000ffd000/0x2000)=nil, &(0x7f00000004c0)=0x0, &(0x7f0000000500)) syz_io_uring_setup(0x3e5e, &(0x7f0000000540)={0x0, 0x5c61, 0x8, 0x2, 0x72}, &(0x7f0000ffd000/0x3000)=nil, &(0x7f0000ffc000/0x3000)=nil, &(0x7f00000005c0), &(0x7f0000000600)=0x0) syz_io_uring_submit(r0, r1, &(0x7f0000000740)=@IORING_OP_READ=@pass_buffer={0x16, 0x1, 0x2004, @fd_index=0xa, 0x7, &(0x7f0000000640)=""/227, 0xe3, 0xc, 0x1}, 0x9) openat$cgroup_devices(0xffffffffffffffff, &(0x7f00000007c0)='devices.allow\x00', 0x2, 0x0) syz_mount_image$nfs4(&(0x7f0000000800), &(0x7f0000000840)='./file0/file0\x00', 0xffffffffffffff01, 0x1, &(0x7f0000000900)=[{&(0x7f0000000880)="f19bd7cfef39dd2070dcb194f7bd90ce305e2a9644b9fb91cc1e75bca69ed6bbdd7636452963af395ea61189cce718ef43420310b6ff8db9f4a606d67217b1aa7bf6e1435682323aef92ef40d036c48fa3fc363c6ad63229bb37cd76a6db9879a39f", 0x62, 0x6}], 0x8400, &(0x7f0000000940)={[{'*+\\['}]}) accept(0xffffffffffffffff, 0x0, &(0x7f0000000980)) mount$9p_rdma(&(0x7f0000001040), &(0x7f0000001080)='./file0\x00', &(0x7f00000010c0), 0xa00800, &(0x7f0000001100)={'trans=rdma,', {'port', 0x3d, 0x4e20}, 0x2c, {[{@common=@aname={'aname', 0x3d, 'permit_directio'}}, {@sq={'sq', 0x3d, 0xffff}}], [{@fscontext={'fscontext', 0x3d, 'staff_u'}}]}}) 11:43:09 executing program 4: openat$vcsa(0xffffffffffffff9c, &(0x7f0000000040), 0x81, 0x0) socket$inet_tcp(0x2, 0x1, 0x0) syz_genetlink_get_family_id$netlbl_mgmt(0x0, 0xffffffffffffffff) syz_genetlink_get_family_id$netlbl_mgmt(&(0x7f0000000740), 0xffffffffffffffff) [ 282.558624] loop7: detected capacity change from 0 to 1 [ 282.578784] SELinux: security_context_str_to_sid (staff_u) failed with errno=-22 [ 282.594117] loop6: detected capacity change from 0 to 1 [ 282.613629] loop6: detected capacity change from 0 to 264192 [ 282.615036] nfs4: Unknown parameter '*+\[' [ 282.617021] SELinux: security_context_str_to_sid (staff_u) failed with errno=-22 11:43:19 executing program 5: r0 = shmget(0x2, 0x3000, 0x100, &(0x7f0000ffb000/0x3000)=nil) shmat(r0, &(0x7f0000ffa000/0x3000)=nil, 0x2000) shmat(r0, &(0x7f0000ffa000/0x4000)=nil, 0x3000) syz_genetlink_get_family_id$netlbl_mgmt(&(0x7f0000000040), 0xffffffffffffffff) mmap$IORING_OFF_SQ_RING(&(0x7f0000ffd000/0x1000)=nil, 0x1000, 0x2000006, 0x40010, 0xffffffffffffffff, 0x0) io_uring_setup(0x14ab, &(0x7f0000000480)={0x0, 0x5191, 0x20, 0x1, 0x3ba}) 11:43:19 executing program 7: ioprio_set$uid(0x0, 0xee01, 0x4004) syz_mount_image$msdos(&(0x7f0000000000), &(0x7f0000000040)='./file0\x00', 0x200, 0x1, &(0x7f00000000c0)=[{&(0x7f0000000080)="7c74c7bc99e778a0c971e6f50fbdd2b70fa0b038d18c7d5ac685833434d89dce684239293aa5d8b6f11bc5c4a033ad1dc68319fad36a1101aad751fd6f4f10", 0x3f, 0x7f}], 0x42000, &(0x7f0000000100)={[{@dots}], [{@obj_user}, {@dont_appraise}, {@uid_lt}, {@hash}, {@seclabel}]}) getsockopt$inet6_IPV6_XFRM_POLICY(0xffffffffffffffff, 0x29, 0x23, &(0x7f0000000240)={{{@in=@loopback, @in6=@empty, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, {{@in6=@local}, 0x0, @in6=@mcast1}}, &(0x7f0000000340)=0xe8) mount$9p_xen(&(0x7f0000000180), &(0x7f00000001c0)='./file0\x00', &(0x7f0000000200), 0x1121061, &(0x7f0000000380)={'trans=xen,', {[{@msize={'msize', 0x3d, 0xf6b3}}, {@debug={'debug', 0x3d, 0x7ff}}, {@posixacl}, {@aname={'aname', 0x3d, '*$-&'}}, {@uname={'uname', 0x3d, 'msdos\x00'}}], [{@seclabel}, {@euid_eq={'euid', 0x3d, r0}}, {@permit_directio}, {@appraise_type}]}}) syz_io_uring_submit(0x0, 0x0, &(0x7f0000000740)=@IORING_OP_READ=@pass_buffer={0x16, 0x1, 0x2004, @fd_index=0xa, 0x7, &(0x7f0000000640)=""/227, 0xe3, 0xc, 0x1}, 0x9) openat$cgroup_devices(0xffffffffffffffff, &(0x7f00000007c0)='devices.allow\x00', 0x2, 0x0) mount$9p_rdma(&(0x7f0000001040), &(0x7f0000001080)='./file0\x00', &(0x7f00000010c0), 0xa00800, &(0x7f0000001100)={'trans=rdma,', {'port', 0x3d, 0x4e20}, 0x2c, {[{@common=@aname={'aname', 0x3d, 'permit_directio'}}, {@sq={'sq', 0x3d, 0xffff}}], [{@fscontext={'fscontext', 0x3d, 'staff_u'}}]}}) 11:43:19 executing program 1: mmap$IORING_OFF_SQ_RING(&(0x7f0000ffd000/0x1000)=nil, 0x1000, 0x0, 0x10, 0xffffffffffffffff, 0x0) syz_io_uring_submit(0x0, 0x0, 0x0, 0x0) recvfrom$packet(0xffffffffffffffff, 0x0, 0x0, 0x0, &(0x7f0000000300)={0x11, 0x16, 0x0, 0x1, 0x8, 0x6, @local}, 0x14) io_uring_setup(0x14ab, &(0x7f0000000480)={0x0, 0x5191, 0x20, 0x1, 0x3ba}) shmget$private(0x0, 0x2000, 0x10, &(0x7f0000ffc000/0x2000)=nil) 11:43:19 executing program 4: openat$vcsa(0xffffffffffffff9c, &(0x7f0000000040), 0x81, 0x0) socket$inet_tcp(0x2, 0x1, 0x0) syz_genetlink_get_family_id$netlbl_mgmt(&(0x7f0000000440), 0xffffffffffffffff) syz_genetlink_get_family_id$netlbl_mgmt(0x0, 0xffffffffffffffff) 11:43:19 executing program 0: socket$inet_tcp(0x2, 0x1, 0x0) syz_genetlink_get_family_id$netlbl_mgmt(&(0x7f0000000440), 0xffffffffffffffff) syz_genetlink_get_family_id$netlbl_mgmt(&(0x7f0000000740), 0xffffffffffffffff) 11:43:19 executing program 2: clock_nanosleep(0x7, 0x0, &(0x7f0000000000)={0x77359400}, &(0x7f0000000040)) openat$sr(0xffffffffffffff9c, &(0x7f0000005480), 0x428802, 0x0) 11:43:19 executing program 3: ioctl$SG_SET_FORCE_PACK_ID(0xffffffffffffffff, 0x227b, &(0x7f0000000000)=0x1) ioctl$SG_SET_FORCE_PACK_ID(0xffffffffffffffff, 0x227b, &(0x7f0000000040)) ioctl$SG_GET_RESERVED_SIZE(0xffffffffffffffff, 0x2272, &(0x7f0000000080)) r0 = openat$vcsa(0xffffffffffffff9c, &(0x7f00000000c0), 0x4200, 0x0) ioctl$SG_SET_TIMEOUT(r0, 0x2201, &(0x7f0000000140)=0x4) ioctl$SG_GET_VERSION_NUM(r0, 0x2282, &(0x7f0000000180)) ioctl$SG_GET_REQUEST_TABLE(r0, 0x2286, &(0x7f00000001c0)) ioctl$SG_GET_TIMEOUT(r0, 0x2202, 0x0) r1 = syz_open_dev$sg(&(0x7f0000000340), 0x7fff, 0x40) ioctl$SG_EMULATED_HOST(r1, 0x2203, &(0x7f0000000380)) r2 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$inet6_tcp_TCP_CONGESTION(r2, 0x6, 0xd, &(0x7f0000000440)='scalable\x00', 0x9) 11:43:19 executing program 6: ioprio_set$uid(0x0, 0xee01, 0x4004) syz_mount_image$msdos(&(0x7f0000000000), &(0x7f0000000040)='./file0\x00', 0x200, 0x1, &(0x7f00000000c0)=[{&(0x7f0000000080)="7c74c7bc99e778a0c971e6f50fbdd2b70fa0b038d18c7d5ac685833434d89dce684239293aa5d8b6f11bc5c4a033ad1dc68319fad36a1101aad751fd6f4f10", 0x3f, 0x7f}], 0x42000, &(0x7f0000000100)={[{@dots}], [{@obj_user}, {@dont_appraise}, {@uid_lt}, {@hash}, {@seclabel}]}) syz_io_uring_setup(0x1d4a, &(0x7f0000000440)={0x0, 0xfa85, 0x0, 0x0, 0x285}, &(0x7f0000ffd000/0x1000)=nil, &(0x7f0000ffd000/0x2000)=nil, &(0x7f00000004c0)=0x0, &(0x7f0000000500)) syz_io_uring_setup(0x3e5e, &(0x7f0000000540)={0x0, 0x5c61, 0x8, 0x2, 0x72}, &(0x7f0000ffd000/0x3000)=nil, &(0x7f0000ffc000/0x3000)=nil, &(0x7f00000005c0), &(0x7f0000000600)=0x0) syz_io_uring_submit(r0, r1, &(0x7f0000000740)=@IORING_OP_READ=@pass_buffer={0x16, 0x1, 0x2004, @fd_index=0xa, 0x7, &(0x7f0000000640)=""/227, 0xe3, 0xc, 0x1}, 0x9) openat$cgroup_devices(0xffffffffffffffff, &(0x7f00000007c0)='devices.allow\x00', 0x2, 0x0) syz_mount_image$nfs4(&(0x7f0000000800), &(0x7f0000000840)='./file0/file0\x00', 0xffffffffffffff01, 0x1, &(0x7f0000000900)=[{&(0x7f0000000880)="f19bd7cfef39dd2070dcb194f7bd90ce305e2a9644b9fb91cc1e75bca69ed6bbdd7636452963af395ea61189cce718ef43420310b6ff8db9f4a606d67217b1aa7bf6e1435682323aef92ef40d036c48fa3fc363c6ad63229bb37cd76a6db9879a39f", 0x62, 0x6}], 0x8400, &(0x7f0000000940)={[{'*+\\['}]}) accept(0xffffffffffffffff, 0x0, &(0x7f0000000980)) mount$9p_rdma(&(0x7f0000001040), &(0x7f0000001080)='./file0\x00', &(0x7f00000010c0), 0xa00800, &(0x7f0000001100)={'trans=rdma,', {'port', 0x3d, 0x4e20}, 0x2c, {[{@common=@aname={'aname', 0x3d, 'permit_directio'}}, {@sq={'sq', 0x3d, 0xffff}}], [{@fscontext={'fscontext', 0x3d, 'staff_u'}}]}}) [ 291.919930] loop7: detected capacity change from 0 to 1 [ 291.924571] loop6: detected capacity change from 0 to 1 [ 291.930576] SELinux: security_context_str_to_sid (staff_u) failed with errno=-22 [ 291.942958] loop6: detected capacity change from 0 to 264192 [ 291.946167] nfs4: Unknown parameter '*+\[' [ 291.957867] SELinux: security_context_str_to_sid (staff_u) failed with errno=-22 11:43:19 executing program 7: ioprio_set$uid(0x0, 0xee01, 0x4004) syz_mount_image$msdos(&(0x7f0000000000), &(0x7f0000000040)='./file0\x00', 0x200, 0x1, &(0x7f00000000c0)=[{&(0x7f0000000080)="7c74c7bc99e778a0c971e6f50fbdd2b70fa0b038d18c7d5ac685833434d89dce684239293aa5d8b6f11bc5c4a033ad1dc68319fad36a1101aad751fd6f4f10", 0x3f, 0x7f}], 0x42000, &(0x7f0000000100)={[{@dots}], [{@obj_user}, {@dont_appraise}, {@uid_lt}, {@hash}, {@seclabel}]}) getsockopt$inet6_IPV6_XFRM_POLICY(0xffffffffffffffff, 0x29, 0x23, &(0x7f0000000240)={{{@in=@loopback, @in6=@empty, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, {{@in6=@local}, 0x0, @in6=@mcast1}}, &(0x7f0000000340)=0xe8) mount$9p_xen(&(0x7f0000000180), &(0x7f00000001c0)='./file0\x00', &(0x7f0000000200), 0x1121061, &(0x7f0000000380)={'trans=xen,', {[{@msize={'msize', 0x3d, 0xf6b3}}, {@debug={'debug', 0x3d, 0x7ff}}, {@posixacl}, {@aname={'aname', 0x3d, '*$-&'}}, {@uname={'uname', 0x3d, 'msdos\x00'}}], [{@seclabel}, {@euid_eq={'euid', 0x3d, r0}}, {@permit_directio}, {@appraise_type}]}}) syz_io_uring_submit(0x0, 0x0, &(0x7f0000000740)=@IORING_OP_READ=@pass_buffer={0x16, 0x1, 0x2004, @fd_index=0xa, 0x7, &(0x7f0000000640)=""/227, 0xe3, 0xc, 0x1}, 0x9) openat$cgroup_devices(0xffffffffffffffff, &(0x7f00000007c0)='devices.allow\x00', 0x2, 0x0) mount$9p_rdma(&(0x7f0000001040), &(0x7f0000001080)='./file0\x00', &(0x7f00000010c0), 0xa00800, &(0x7f0000001100)={'trans=rdma,', {'port', 0x3d, 0x4e20}, 0x2c, {[{@common=@aname={'aname', 0x3d, 'permit_directio'}}, {@sq={'sq', 0x3d, 0xffff}}], [{@fscontext={'fscontext', 0x3d, 'staff_u'}}]}}) 11:43:19 executing program 6: ioprio_set$uid(0x0, 0xee01, 0x4004) syz_io_uring_setup(0x1d4a, &(0x7f0000000440)={0x0, 0xfa85, 0x0, 0x0, 0x285}, &(0x7f0000ffd000/0x1000)=nil, &(0x7f0000ffd000/0x2000)=nil, &(0x7f00000004c0)=0x0, &(0x7f0000000500)) syz_io_uring_setup(0x3e5e, &(0x7f0000000540)={0x0, 0x5c61, 0x8, 0x2, 0x72}, &(0x7f0000ffd000/0x3000)=nil, &(0x7f0000ffc000/0x3000)=nil, &(0x7f00000005c0), &(0x7f0000000600)=0x0) syz_io_uring_submit(r0, r1, &(0x7f0000000740)=@IORING_OP_READ=@pass_buffer={0x16, 0x1, 0x2004, @fd_index=0xa, 0x7, &(0x7f0000000640)=""/227, 0xe3, 0xc, 0x1}, 0x9) openat$cgroup_devices(0xffffffffffffffff, &(0x7f00000007c0)='devices.allow\x00', 0x2, 0x0) syz_mount_image$nfs4(&(0x7f0000000800), &(0x7f0000000840)='./file0/file0\x00', 0xffffffffffffff01, 0x1, &(0x7f0000000900)=[{&(0x7f0000000880)="f19bd7cfef39dd2070dcb194f7bd90ce305e2a9644b9fb91cc1e75bca69ed6bbdd7636452963af395ea61189cce718ef43420310b6ff8db9f4a606d67217b1aa7bf6e1435682323aef92ef40d036c48fa3fc363c6ad63229bb37cd76a6db9879a39f", 0x62, 0x6}], 0x8400, &(0x7f0000000940)={[{'*+\\['}]}) accept(0xffffffffffffffff, 0x0, &(0x7f0000000980)) mount$9p_rdma(&(0x7f0000001040), &(0x7f0000001080)='./file0\x00', &(0x7f00000010c0), 0xa00800, &(0x7f0000001100)={'trans=rdma,', {'port', 0x3d, 0x4e20}, 0x2c, {[{@common=@aname={'aname', 0x3d, 'permit_directio'}}, {@sq={'sq', 0x3d, 0xffff}}], [{@fscontext={'fscontext', 0x3d, 'staff_u'}}]}}) 11:43:19 executing program 0: socket$inet_tcp(0x2, 0x1, 0x0) syz_genetlink_get_family_id$netlbl_mgmt(0x0, 0xffffffffffffffff) syz_genetlink_get_family_id$netlbl_mgmt(&(0x7f0000000740), 0xffffffffffffffff) 11:43:19 executing program 4: openat$vcsa(0xffffffffffffff9c, &(0x7f0000000040), 0x81, 0x0) socket$inet_tcp(0x2, 0x1, 0x0) syz_genetlink_get_family_id$netlbl_mgmt(&(0x7f0000000440), 0xffffffffffffffff) syz_genetlink_get_family_id$netlbl_mgmt(0x0, 0xffffffffffffffff) 11:43:19 executing program 5: r0 = shmget(0x2, 0x3000, 0x100, &(0x7f0000ffb000/0x3000)=nil) shmat(r0, &(0x7f0000ffa000/0x3000)=nil, 0x2000) shmat(r0, &(0x7f0000ffa000/0x4000)=nil, 0x3000) syz_genetlink_get_family_id$netlbl_mgmt(&(0x7f0000000040), 0xffffffffffffffff) mmap$IORING_OFF_SQ_RING(&(0x7f0000ffd000/0x1000)=nil, 0x1000, 0x2000006, 0x40010, 0xffffffffffffffff, 0x0) io_uring_setup(0x14ab, &(0x7f0000000480)={0x0, 0x5191, 0x20, 0x1, 0x3ba}) [ 292.051225] loop7: detected capacity change from 0 to 1 11:43:19 executing program 3: ioctl$SG_SET_FORCE_PACK_ID(0xffffffffffffffff, 0x227b, &(0x7f0000000000)=0x1) ioctl$SG_SET_FORCE_PACK_ID(0xffffffffffffffff, 0x227b, &(0x7f0000000040)) ioctl$SG_GET_RESERVED_SIZE(0xffffffffffffffff, 0x2272, &(0x7f0000000080)) r0 = openat$vcsa(0xffffffffffffff9c, &(0x7f00000000c0), 0x4200, 0x0) ioctl$SG_SET_TIMEOUT(r0, 0x2201, &(0x7f0000000140)=0x4) ioctl$SG_GET_VERSION_NUM(r0, 0x2282, &(0x7f0000000180)) ioctl$SG_GET_REQUEST_TABLE(r0, 0x2286, &(0x7f00000001c0)) ioctl$SG_GET_TIMEOUT(r0, 0x2202, 0x0) r1 = syz_open_dev$sg(&(0x7f0000000340), 0x7fff, 0x40) ioctl$SG_EMULATED_HOST(r1, 0x2203, &(0x7f0000000380)) r2 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$inet6_tcp_TCP_CONGESTION(r2, 0x6, 0xd, &(0x7f0000000440)='scalable\x00', 0x9) [ 292.092751] SELinux: security_context_str_to_sid (staff_u) failed with errno=-22 11:43:19 executing program 1: mmap$IORING_OFF_SQ_RING(&(0x7f0000ffd000/0x1000)=nil, 0x1000, 0x0, 0x10, 0xffffffffffffffff, 0x0) syz_io_uring_submit(0x0, 0x0, 0x0, 0x0) recvfrom$packet(0xffffffffffffffff, 0x0, 0x0, 0x0, &(0x7f0000000300)={0x11, 0x16, 0x0, 0x1, 0x8, 0x6, @local}, 0x14) io_uring_setup(0x14ab, &(0x7f0000000480)={0x0, 0x5191, 0x20, 0x1, 0x3ba}) shmget$private(0x0, 0x2000, 0x10, &(0x7f0000ffc000/0x2000)=nil) [ 292.114899] loop6: detected capacity change from 0 to 264192 11:43:27 executing program 4: openat$vcsa(0xffffffffffffff9c, &(0x7f0000000040), 0x81, 0x0) socket$inet_tcp(0x2, 0x1, 0x0) syz_genetlink_get_family_id$netlbl_mgmt(&(0x7f0000000440), 0xffffffffffffffff) syz_genetlink_get_family_id$netlbl_mgmt(0x0, 0xffffffffffffffff) 11:43:27 executing program 0: socket$inet_tcp(0x2, 0x1, 0x0) syz_genetlink_get_family_id$netlbl_mgmt(0x0, 0xffffffffffffffff) syz_genetlink_get_family_id$netlbl_mgmt(&(0x7f0000000740), 0xffffffffffffffff) 11:43:27 executing program 5: r0 = shmget(0x2, 0x3000, 0x100, &(0x7f0000ffb000/0x3000)=nil) shmat(r0, &(0x7f0000ffa000/0x3000)=nil, 0x2000) syz_genetlink_get_family_id$netlbl_mgmt(&(0x7f0000000040), 0xffffffffffffffff) mmap$IORING_OFF_SQ_RING(&(0x7f0000ffd000/0x1000)=nil, 0x1000, 0x2000006, 0x40010, 0xffffffffffffffff, 0x0) io_uring_setup(0x14ab, &(0x7f0000000480)={0x0, 0x5191, 0x20, 0x1, 0x3ba}) 11:43:27 executing program 3: ioctl$SG_SET_FORCE_PACK_ID(0xffffffffffffffff, 0x227b, &(0x7f0000000000)=0x1) ioctl$SG_SET_FORCE_PACK_ID(0xffffffffffffffff, 0x227b, &(0x7f0000000040)) ioctl$SG_GET_RESERVED_SIZE(0xffffffffffffffff, 0x2272, &(0x7f0000000080)) r0 = openat$vcsa(0xffffffffffffff9c, &(0x7f00000000c0), 0x4200, 0x0) ioctl$SG_SET_TIMEOUT(r0, 0x2201, &(0x7f0000000140)=0x4) ioctl$SG_GET_VERSION_NUM(r0, 0x2282, &(0x7f0000000180)) ioctl$SG_GET_REQUEST_TABLE(r0, 0x2286, &(0x7f00000001c0)) ioctl$SG_GET_TIMEOUT(r0, 0x2202, 0x0) r1 = syz_open_dev$sg(&(0x7f0000000340), 0x7fff, 0x40) ioctl$SG_EMULATED_HOST(r1, 0x2203, &(0x7f0000000380)) r2 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$inet6_tcp_TCP_CONGESTION(r2, 0x6, 0xd, &(0x7f0000000440)='scalable\x00', 0x9) 11:43:27 executing program 7: ioprio_set$uid(0x0, 0xee01, 0x4004) syz_mount_image$msdos(&(0x7f0000000000), &(0x7f0000000040)='./file0\x00', 0x200, 0x1, &(0x7f00000000c0)=[{&(0x7f0000000080)="7c74c7bc99e778a0c971e6f50fbdd2b70fa0b038d18c7d5ac685833434d89dce684239293aa5d8b6f11bc5c4a033ad1dc68319fad36a1101aad751fd6f4f10", 0x3f, 0x7f}], 0x42000, &(0x7f0000000100)={[{@dots}], [{@obj_user}, {@dont_appraise}, {@uid_lt}, {@hash}, {@seclabel}]}) getsockopt$inet6_IPV6_XFRM_POLICY(0xffffffffffffffff, 0x29, 0x23, &(0x7f0000000240)={{{@in=@loopback, @in6=@empty}}, {{@in6=@local}, 0x0, @in6=@mcast1}}, &(0x7f0000000340)=0xe8) syz_io_uring_setup(0x1d4a, &(0x7f0000000440)={0x0, 0xfa85, 0x0, 0x0, 0x285}, &(0x7f0000ffd000/0x1000)=nil, &(0x7f0000ffd000/0x2000)=nil, &(0x7f00000004c0)=0x0, &(0x7f0000000500)) syz_io_uring_submit(r0, 0x0, &(0x7f0000000740)=@IORING_OP_READ=@pass_buffer={0x16, 0x1, 0x2004, @fd_index=0xa, 0x7, &(0x7f0000000640)=""/227, 0xe3, 0xc, 0x1}, 0x9) openat$cgroup_devices(0xffffffffffffffff, &(0x7f00000007c0)='devices.allow\x00', 0x2, 0x0) mount$9p_rdma(&(0x7f0000001040), &(0x7f0000001080)='./file0\x00', &(0x7f00000010c0), 0xa00800, &(0x7f0000001100)={'trans=rdma,', {'port', 0x3d, 0x4e20}, 0x2c, {[{@common=@aname={'aname', 0x3d, 'permit_directio'}}, {@sq={'sq', 0x3d, 0xffff}}], [{@fscontext={'fscontext', 0x3d, 'staff_u'}}]}}) 11:43:27 executing program 6: ioprio_set$uid(0x0, 0xee01, 0x4004) syz_io_uring_setup(0x1d4a, &(0x7f0000000440)={0x0, 0xfa85, 0x0, 0x0, 0x285}, &(0x7f0000ffd000/0x1000)=nil, &(0x7f0000ffd000/0x2000)=nil, &(0x7f00000004c0)=0x0, &(0x7f0000000500)) syz_io_uring_setup(0x3e5e, &(0x7f0000000540)={0x0, 0x5c61, 0x8, 0x2, 0x72}, &(0x7f0000ffd000/0x3000)=nil, &(0x7f0000ffc000/0x3000)=nil, &(0x7f00000005c0), &(0x7f0000000600)=0x0) syz_io_uring_submit(r0, r1, &(0x7f0000000740)=@IORING_OP_READ=@pass_buffer={0x16, 0x1, 0x2004, @fd_index=0xa, 0x7, &(0x7f0000000640)=""/227, 0xe3, 0xc, 0x1}, 0x9) openat$cgroup_devices(0xffffffffffffffff, &(0x7f00000007c0)='devices.allow\x00', 0x2, 0x0) syz_mount_image$nfs4(&(0x7f0000000800), &(0x7f0000000840)='./file0/file0\x00', 0xffffffffffffff01, 0x1, &(0x7f0000000900)=[{&(0x7f0000000880)="f19bd7cfef39dd2070dcb194f7bd90ce305e2a9644b9fb91cc1e75bca69ed6bbdd7636452963af395ea61189cce718ef43420310b6ff8db9f4a606d67217b1aa7bf6e1435682323aef92ef40d036c48fa3fc363c6ad63229bb37cd76a6db9879a39f", 0x62, 0x6}], 0x8400, &(0x7f0000000940)={[{'*+\\['}]}) accept(0xffffffffffffffff, 0x0, &(0x7f0000000980)) mount$9p_rdma(&(0x7f0000001040), &(0x7f0000001080)='./file0\x00', &(0x7f00000010c0), 0xa00800, &(0x7f0000001100)={'trans=rdma,', {'port', 0x3d, 0x4e20}, 0x2c, {[{@common=@aname={'aname', 0x3d, 'permit_directio'}}, {@sq={'sq', 0x3d, 0xffff}}], [{@fscontext={'fscontext', 0x3d, 'staff_u'}}]}}) 11:43:27 executing program 2: openat$sr(0xffffffffffffff9c, &(0x7f0000005480), 0x428802, 0x0) 11:43:27 executing program 1: mmap$IORING_OFF_SQ_RING(&(0x7f0000ffd000/0x1000)=nil, 0x1000, 0x0, 0x10, 0xffffffffffffffff, 0x0) syz_io_uring_submit(0x0, 0x0, 0x0, 0x0) recvfrom$packet(0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0) io_uring_setup(0x14ab, &(0x7f0000000480)={0x0, 0x5191, 0x20, 0x1, 0x3ba}) shmget$private(0x0, 0x2000, 0x10, &(0x7f0000ffc000/0x2000)=nil) [ 300.181872] loop7: detected capacity change from 0 to 1 [ 300.194091] SELinux: security_context_str_to_sid (staff_u) failed with errno=-22 11:43:27 executing program 4: ioprio_set$uid(0x0, 0xee01, 0x4004) syz_io_uring_setup(0x1d4a, &(0x7f0000000440)={0x0, 0xfa85, 0x0, 0x0, 0x285}, &(0x7f0000ffd000/0x1000)=nil, &(0x7f0000ffd000/0x2000)=nil, &(0x7f00000004c0)=0x0, &(0x7f0000000500)) syz_io_uring_setup(0x3e5e, &(0x7f0000000540)={0x0, 0x5c61, 0x8, 0x2, 0x72}, &(0x7f0000ffd000/0x3000)=nil, &(0x7f0000ffc000/0x3000)=nil, &(0x7f00000005c0), &(0x7f0000000600)=0x0) syz_io_uring_submit(r0, r1, &(0x7f0000000740)=@IORING_OP_READ=@pass_buffer={0x16, 0x1, 0x2004, @fd_index=0xa, 0x7, &(0x7f0000000640)=""/227, 0xe3, 0xc, 0x1}, 0x9) openat$cgroup_devices(0xffffffffffffffff, &(0x7f00000007c0)='devices.allow\x00', 0x2, 0x0) syz_mount_image$nfs4(&(0x7f0000000800), &(0x7f0000000840)='./file0/file0\x00', 0xffffffffffffff01, 0x1, &(0x7f0000000900)=[{&(0x7f0000000880)="f19bd7cfef39dd2070dcb194f7bd90ce305e2a9644b9fb91cc1e75bca69ed6bbdd7636452963af395ea61189cce718ef43420310b6ff8db9f4a606d67217b1aa7bf6e1435682323aef92ef40d036c48fa3fc363c6ad63229bb37cd76a6db9879a39f", 0x62, 0x6}], 0x8400, &(0x7f0000000940)={[{'*+\\['}]}) accept(0xffffffffffffffff, 0x0, &(0x7f0000000980)) mount$9p_rdma(&(0x7f0000001040), &(0x7f0000001080)='./file0\x00', &(0x7f00000010c0), 0xa00800, &(0x7f0000001100)={'trans=rdma,', {'port', 0x3d, 0x4e20}, 0x2c, {[{@common=@aname={'aname', 0x3d, 'permit_directio'}}, {@sq={'sq', 0x3d, 0xffff}}], [{@fscontext={'fscontext', 0x3d, 'staff_u'}}]}}) 11:43:27 executing program 7: ioprio_set$uid(0x0, 0xee01, 0x4004) syz_mount_image$msdos(&(0x7f0000000000), &(0x7f0000000040)='./file0\x00', 0x200, 0x1, &(0x7f00000000c0)=[{&(0x7f0000000080)="7c74c7bc99e778a0c971e6f50fbdd2b70fa0b038d18c7d5ac685833434d89dce684239293aa5d8b6f11bc5c4a033ad1dc68319fad36a1101aad751fd6f4f10", 0x3f, 0x7f}], 0x42000, &(0x7f0000000100)={[{@dots}], [{@obj_user}, {@dont_appraise}, {@uid_lt}, {@hash}, {@seclabel}]}) syz_io_uring_setup(0x1d4a, &(0x7f0000000440)={0x0, 0xfa85, 0x0, 0x0, 0x285}, &(0x7f0000ffd000/0x1000)=nil, &(0x7f0000ffd000/0x2000)=nil, &(0x7f00000004c0)=0x0, &(0x7f0000000500)) syz_io_uring_submit(r0, 0x0, &(0x7f0000000740)=@IORING_OP_READ=@pass_buffer={0x16, 0x1, 0x2004, @fd_index=0xa, 0x7, &(0x7f0000000640)=""/227, 0xe3, 0xc, 0x1}, 0x9) openat$cgroup_devices(0xffffffffffffffff, &(0x7f00000007c0)='devices.allow\x00', 0x2, 0x0) mount$9p_rdma(&(0x7f0000001040), &(0x7f0000001080)='./file0\x00', &(0x7f00000010c0), 0xa00800, &(0x7f0000001100)={'trans=rdma,', {'port', 0x3d, 0x4e20}, 0x2c, {[{@common=@aname={'aname', 0x3d, 'permit_directio'}}, {@sq={'sq', 0x3d, 0xffff}}], [{@fscontext={'fscontext', 0x3d, 'staff_u'}}]}}) [ 300.246314] loop6: detected capacity change from 0 to 264192 11:43:27 executing program 1: mmap$IORING_OFF_SQ_RING(&(0x7f0000ffd000/0x1000)=nil, 0x1000, 0x0, 0x10, 0xffffffffffffffff, 0x0) syz_io_uring_submit(0x0, 0x0, 0x0, 0x0) recvfrom$packet(0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0) io_uring_setup(0x0, &(0x7f0000000480)={0x0, 0x5191, 0x20, 0x1, 0x3ba}) shmget$private(0x0, 0x2000, 0x10, &(0x7f0000ffc000/0x2000)=nil) 11:43:27 executing program 3: ioctl$SG_SET_FORCE_PACK_ID(0xffffffffffffffff, 0x227b, &(0x7f0000000000)=0x1) ioctl$SG_SET_FORCE_PACK_ID(0xffffffffffffffff, 0x227b, &(0x7f0000000040)) ioctl$SG_GET_RESERVED_SIZE(0xffffffffffffffff, 0x2272, &(0x7f0000000080)) ioctl$SCSI_IOCTL_SEND_COMMAND(0xffffffffffffffff, 0x1, &(0x7f0000000100)={0x17, 0x3, 0x1c00, "af36a59fb168d324fd8eaf833aeb82f60d75e8700d81d9"}) ioctl$SG_SET_TIMEOUT(0xffffffffffffffff, 0x2201, &(0x7f0000000140)=0x4) ioctl$SG_GET_VERSION_NUM(0xffffffffffffffff, 0x2282, &(0x7f0000000180)) ioctl$SG_GET_REQUEST_TABLE(0xffffffffffffffff, 0x2286, &(0x7f00000001c0)) ioctl$SG_GET_TIMEOUT(0xffffffffffffffff, 0x2202, 0x0) r0 = syz_open_dev$sg(&(0x7f0000000340), 0x7fff, 0x40) ioctl$SG_EMULATED_HOST(r0, 0x2203, &(0x7f0000000380)) r1 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$inet6_tcp_TCP_CONGESTION(r1, 0x6, 0xd, &(0x7f0000000440)='scalable\x00', 0x9) 11:43:27 executing program 0: socket$inet_tcp(0x2, 0x1, 0x0) syz_genetlink_get_family_id$netlbl_mgmt(0x0, 0xffffffffffffffff) syz_genetlink_get_family_id$netlbl_mgmt(&(0x7f0000000740), 0xffffffffffffffff) 11:43:27 executing program 2: openat$sr(0xffffffffffffff9c, 0x0, 0x428802, 0x0) 11:43:27 executing program 6: ioprio_set$uid(0x0, 0xee01, 0x4004) syz_io_uring_setup(0x1d4a, &(0x7f0000000440)={0x0, 0xfa85, 0x0, 0x0, 0x285}, &(0x7f0000ffd000/0x1000)=nil, &(0x7f0000ffd000/0x2000)=nil, &(0x7f00000004c0)=0x0, &(0x7f0000000500)) syz_io_uring_setup(0x3e5e, &(0x7f0000000540)={0x0, 0x5c61, 0x8, 0x2, 0x72}, &(0x7f0000ffd000/0x3000)=nil, &(0x7f0000ffc000/0x3000)=nil, &(0x7f00000005c0), &(0x7f0000000600)=0x0) syz_io_uring_submit(r0, r1, &(0x7f0000000740)=@IORING_OP_READ=@pass_buffer={0x16, 0x1, 0x2004, @fd_index=0xa, 0x7, &(0x7f0000000640)=""/227, 0xe3, 0xc, 0x1}, 0x9) openat$cgroup_devices(0xffffffffffffffff, &(0x7f00000007c0)='devices.allow\x00', 0x2, 0x0) syz_mount_image$nfs4(&(0x7f0000000800), &(0x7f0000000840)='./file0/file0\x00', 0xffffffffffffff01, 0x1, &(0x7f0000000900)=[{&(0x7f0000000880)="f19bd7cfef39dd2070dcb194f7bd90ce305e2a9644b9fb91cc1e75bca69ed6bbdd7636452963af395ea61189cce718ef43420310b6ff8db9f4a606d67217b1aa7bf6e1435682323aef92ef40d036c48fa3fc363c6ad63229bb37cd76a6db9879a39f", 0x62, 0x6}], 0x8400, &(0x7f0000000940)={[{'*+\\['}]}) accept(0xffffffffffffffff, 0x0, &(0x7f0000000980)) mount$9p_rdma(&(0x7f0000001040), &(0x7f0000001080)='./file0\x00', &(0x7f00000010c0), 0xa00800, &(0x7f0000001100)={'trans=rdma,', {'port', 0x3d, 0x4e20}, 0x2c, {[{@common=@aname={'aname', 0x3d, 'permit_directio'}}, {@sq={'sq', 0x3d, 0xffff}}], [{@fscontext={'fscontext', 0x3d, 'staff_u'}}]}}) [ 300.316489] loop7: detected capacity change from 0 to 1 11:43:27 executing program 5: r0 = shmget(0x2, 0x3000, 0x100, &(0x7f0000ffb000/0x3000)=nil) shmat(r0, &(0x7f0000ffa000/0x3000)=nil, 0x2000) syz_genetlink_get_family_id$netlbl_mgmt(&(0x7f0000000040), 0xffffffffffffffff) mmap$IORING_OFF_SQ_RING(&(0x7f0000ffd000/0x1000)=nil, 0x1000, 0x2000006, 0x40010, 0xffffffffffffffff, 0x0) io_uring_setup(0x14ab, &(0x7f0000000480)={0x0, 0x5191, 0x20, 0x1, 0x3ba}) [ 300.329803] SELinux: security_context_str_to_sid (staff_u) failed with errno=-22 [ 300.330768] loop4: detected capacity change from 0 to 264192 [ 300.358649] loop6: detected capacity change from 0 to 264192 11:43:27 executing program 7: ioprio_set$uid(0x0, 0xee01, 0x4004) syz_mount_image$msdos(&(0x7f0000000000), &(0x7f0000000040)='./file0\x00', 0x200, 0x1, &(0x7f00000000c0)=[{&(0x7f0000000080)="7c74c7bc99e778a0c971e6f50fbdd2b70fa0b038d18c7d5ac685833434d89dce684239293aa5d8b6f11bc5c4a033ad1dc68319fad36a1101aad751fd6f4f10", 0x3f, 0x7f}], 0x42000, &(0x7f0000000100)={[{@dots}], [{@obj_user}, {@dont_appraise}, {@uid_lt}, {@hash}, {@seclabel}]}) syz_io_uring_setup(0x1d4a, &(0x7f0000000440)={0x0, 0xfa85, 0x0, 0x0, 0x285}, &(0x7f0000ffd000/0x1000)=nil, &(0x7f0000ffd000/0x2000)=nil, &(0x7f00000004c0)=0x0, &(0x7f0000000500)) syz_io_uring_submit(r0, 0x0, &(0x7f0000000740)=@IORING_OP_READ=@pass_buffer={0x16, 0x1, 0x2004, @fd_index=0xa, 0x7, &(0x7f0000000640)=""/227, 0xe3, 0xc, 0x1}, 0x9) openat$cgroup_devices(0xffffffffffffffff, &(0x7f00000007c0)='devices.allow\x00', 0x2, 0x0) mount$9p_rdma(&(0x7f0000001040), &(0x7f0000001080)='./file0\x00', &(0x7f00000010c0), 0xa00800, &(0x7f0000001100)={'trans=rdma,', {'port', 0x3d, 0x4e20}, 0x2c, {[{@common=@aname={'aname', 0x3d, 'permit_directio'}}, {@sq={'sq', 0x3d, 0xffff}}], [{@fscontext={'fscontext', 0x3d, 'staff_u'}}]}}) 11:43:27 executing program 0: socket$inet_tcp(0x2, 0x1, 0x0) syz_genetlink_get_family_id$netlbl_mgmt(&(0x7f0000000440), 0xffffffffffffffff) syz_genetlink_get_family_id$netlbl_mgmt(0x0, 0xffffffffffffffff) 11:43:27 executing program 6: syz_mount_image$msdos(&(0x7f0000000000), &(0x7f0000000040)='./file0\x00', 0x200, 0x1, &(0x7f00000000c0)=[{&(0x7f0000000080)="7c74c7bc99e778a0c971e6f50fbdd2b70fa0b038d18c7d5ac685833434d89dce684239293aa5d8b6f11bc5c4a033ad1dc68319fad36a1101aad751fd6f4f10", 0x3f, 0x7f}], 0x42000, &(0x7f0000000100)={[{@dots}], [{@obj_user}, {@dont_appraise}, {@uid_lt}, {@hash}, {@seclabel}]}) syz_io_uring_setup(0x1d4a, &(0x7f0000000440)={0x0, 0xfa85, 0x0, 0x0, 0x285}, &(0x7f0000ffd000/0x1000)=nil, &(0x7f0000ffd000/0x2000)=nil, &(0x7f00000004c0)=0x0, &(0x7f0000000500)) syz_io_uring_setup(0x3e5e, &(0x7f0000000540)={0x0, 0x5c61, 0x8, 0x2, 0x72}, &(0x7f0000ffd000/0x3000)=nil, &(0x7f0000ffc000/0x3000)=nil, &(0x7f00000005c0), &(0x7f0000000600)=0x0) syz_io_uring_submit(r0, r1, &(0x7f0000000740)=@IORING_OP_READ=@pass_buffer={0x16, 0x1, 0x2004, @fd_index=0xa, 0x7, &(0x7f0000000640)=""/227, 0xe3, 0xc, 0x1}, 0x9) openat$cgroup_devices(0xffffffffffffffff, &(0x7f00000007c0)='devices.allow\x00', 0x2, 0x0) syz_mount_image$nfs4(&(0x7f0000000800), &(0x7f0000000840)='./file0/file0\x00', 0xffffffffffffff01, 0x1, &(0x7f0000000900)=[{&(0x7f0000000880)="f19bd7cfef39dd2070dcb194f7bd90ce305e2a9644b9fb91cc1e75bca69ed6bbdd7636452963af395ea61189cce718ef43420310b6ff8db9f4a606d67217b1aa7bf6e1435682323aef92ef40d036c48fa3fc363c6ad63229bb37cd76a6db9879a39f", 0x62, 0x6}], 0x8400, &(0x7f0000000940)={[{'*+\\['}]}) accept(0xffffffffffffffff, 0x0, &(0x7f0000000980)) mount$9p_rdma(&(0x7f0000001040), &(0x7f0000001080)='./file0\x00', &(0x7f00000010c0), 0xa00800, &(0x7f0000001100)={'trans=rdma,', {'port', 0x3d, 0x4e20}, 0x2c, {[{@common=@aname={'aname', 0x3d, 'permit_directio'}}, {@sq={'sq', 0x3d, 0xffff}}], [{@fscontext={'fscontext', 0x3d, 'staff_u'}}]}}) [ 300.456275] loop6: detected capacity change from 0 to 1 [ 300.533810] loop6: detected capacity change from 0 to 264192 [ 300.538897] nfs4: Unknown parameter '*+\[' [ 300.542779] SELinux: security_context_str_to_sid (staff_u) failed with errno=-22 11:43:35 executing program 1: mmap$IORING_OFF_SQ_RING(&(0x7f0000ffd000/0x1000)=nil, 0x1000, 0x0, 0x10, 0xffffffffffffffff, 0x0) syz_io_uring_submit(0x0, 0x0, 0x0, 0x0) recvfrom$packet(0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0) io_uring_setup(0x0, 0x0) shmget$private(0x0, 0x2000, 0x10, &(0x7f0000ffc000/0x2000)=nil) 11:43:35 executing program 3: ioctl$SG_SET_FORCE_PACK_ID(0xffffffffffffffff, 0x227b, &(0x7f0000000000)=0x1) ioctl$SG_SET_FORCE_PACK_ID(0xffffffffffffffff, 0x227b, &(0x7f0000000040)) ioctl$SG_GET_RESERVED_SIZE(0xffffffffffffffff, 0x2272, &(0x7f0000000080)) ioctl$SCSI_IOCTL_SEND_COMMAND(0xffffffffffffffff, 0x1, &(0x7f0000000100)={0x17, 0x3, 0x1c00, "af36a59fb168d324fd8eaf833aeb82f60d75e8700d81d9"}) ioctl$SG_SET_TIMEOUT(0xffffffffffffffff, 0x2201, &(0x7f0000000140)=0x4) ioctl$SG_GET_VERSION_NUM(0xffffffffffffffff, 0x2282, &(0x7f0000000180)) ioctl$SG_GET_REQUEST_TABLE(0xffffffffffffffff, 0x2286, &(0x7f00000001c0)) ioctl$SG_GET_TIMEOUT(0xffffffffffffffff, 0x2202, 0x0) r0 = syz_open_dev$sg(&(0x7f0000000340), 0x7fff, 0x40) ioctl$SG_EMULATED_HOST(r0, 0x2203, &(0x7f0000000380)) r1 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$inet6_tcp_TCP_CONGESTION(r1, 0x6, 0xd, &(0x7f0000000440)='scalable\x00', 0x9) 11:43:35 executing program 6: syz_mount_image$msdos(&(0x7f0000000000), &(0x7f0000000040)='./file0\x00', 0x200, 0x1, &(0x7f00000000c0)=[{&(0x7f0000000080)="7c74c7bc99e778a0c971e6f50fbdd2b70fa0b038d18c7d5ac685833434d89dce684239293aa5d8b6f11bc5c4a033ad1dc68319fad36a1101aad751fd6f4f10", 0x3f, 0x7f}], 0x42000, &(0x7f0000000100)={[{@dots}], [{@obj_user}, {@dont_appraise}, {@uid_lt}, {@hash}, {@seclabel}]}) syz_io_uring_setup(0x1d4a, &(0x7f0000000440)={0x0, 0xfa85, 0x0, 0x0, 0x285}, &(0x7f0000ffd000/0x1000)=nil, &(0x7f0000ffd000/0x2000)=nil, &(0x7f00000004c0)=0x0, &(0x7f0000000500)) syz_io_uring_setup(0x3e5e, &(0x7f0000000540)={0x0, 0x5c61, 0x8, 0x2, 0x72}, &(0x7f0000ffd000/0x3000)=nil, &(0x7f0000ffc000/0x3000)=nil, &(0x7f00000005c0), &(0x7f0000000600)=0x0) syz_io_uring_submit(r0, r1, &(0x7f0000000740)=@IORING_OP_READ=@pass_buffer={0x16, 0x1, 0x2004, @fd_index=0xa, 0x7, &(0x7f0000000640)=""/227, 0xe3, 0xc, 0x1}, 0x9) openat$cgroup_devices(0xffffffffffffffff, &(0x7f00000007c0)='devices.allow\x00', 0x2, 0x0) syz_mount_image$nfs4(&(0x7f0000000800), &(0x7f0000000840)='./file0/file0\x00', 0xffffffffffffff01, 0x1, &(0x7f0000000900)=[{&(0x7f0000000880)="f19bd7cfef39dd2070dcb194f7bd90ce305e2a9644b9fb91cc1e75bca69ed6bbdd7636452963af395ea61189cce718ef43420310b6ff8db9f4a606d67217b1aa7bf6e1435682323aef92ef40d036c48fa3fc363c6ad63229bb37cd76a6db9879a39f", 0x62, 0x6}], 0x8400, &(0x7f0000000940)={[{'*+\\['}]}) accept(0xffffffffffffffff, 0x0, &(0x7f0000000980)) mount$9p_rdma(&(0x7f0000001040), &(0x7f0000001080)='./file0\x00', &(0x7f00000010c0), 0xa00800, &(0x7f0000001100)={'trans=rdma,', {'port', 0x3d, 0x4e20}, 0x2c, {[{@common=@aname={'aname', 0x3d, 'permit_directio'}}, {@sq={'sq', 0x3d, 0xffff}}], [{@fscontext={'fscontext', 0x3d, 'staff_u'}}]}}) 11:43:35 executing program 5: r0 = shmget(0x2, 0x3000, 0x100, &(0x7f0000ffb000/0x3000)=nil) shmat(r0, &(0x7f0000ffa000/0x3000)=nil, 0x2000) syz_genetlink_get_family_id$netlbl_mgmt(&(0x7f0000000040), 0xffffffffffffffff) mmap$IORING_OFF_SQ_RING(&(0x7f0000ffd000/0x1000)=nil, 0x1000, 0x2000006, 0x40010, 0xffffffffffffffff, 0x0) io_uring_setup(0x14ab, &(0x7f0000000480)={0x0, 0x5191, 0x20, 0x1, 0x3ba}) 11:43:35 executing program 2: openat$sr(0xffffffffffffff9c, 0x0, 0x0, 0x0) 11:43:35 executing program 7: ioprio_set$uid(0x0, 0xee01, 0x4004) syz_mount_image$msdos(&(0x7f0000000000), &(0x7f0000000040)='./file0\x00', 0x200, 0x1, &(0x7f00000000c0)=[{&(0x7f0000000080)="7c74c7bc99e778a0c971e6f50fbdd2b70fa0b038d18c7d5ac685833434d89dce684239293aa5d8b6f11bc5c4a033ad1dc68319fad36a1101aad751fd6f4f10", 0x3f, 0x7f}], 0x42000, &(0x7f0000000100)={[{@dots}], [{@obj_user}, {@dont_appraise}, {@uid_lt}, {@hash}, {@seclabel}]}) syz_io_uring_setup(0x1d4a, &(0x7f0000000440)={0x0, 0xfa85, 0x0, 0x0, 0x285}, &(0x7f0000ffd000/0x1000)=nil, &(0x7f0000ffd000/0x2000)=nil, &(0x7f00000004c0)=0x0, &(0x7f0000000500)) syz_io_uring_submit(r0, 0x0, &(0x7f0000000740)=@IORING_OP_READ=@pass_buffer={0x16, 0x1, 0x2004, @fd_index=0xa, 0x7, &(0x7f0000000640)=""/227, 0xe3, 0xc, 0x1}, 0x9) openat$cgroup_devices(0xffffffffffffffff, &(0x7f00000007c0)='devices.allow\x00', 0x2, 0x0) mount$9p_rdma(&(0x7f0000001040), &(0x7f0000001080)='./file0\x00', &(0x7f00000010c0), 0xa00800, &(0x7f0000001100)={'trans=rdma,', {'port', 0x3d, 0x4e20}, 0x2c, {[{@common=@aname={'aname', 0x3d, 'permit_directio'}}, {@sq={'sq', 0x3d, 0xffff}}], [{@fscontext={'fscontext', 0x3d, 'staff_u'}}]}}) 11:43:35 executing program 0: socket$inet_tcp(0x2, 0x1, 0x0) syz_genetlink_get_family_id$netlbl_mgmt(&(0x7f0000000440), 0xffffffffffffffff) syz_genetlink_get_family_id$netlbl_mgmt(0x0, 0xffffffffffffffff) 11:43:35 executing program 4: ioprio_set$uid(0x0, 0xee01, 0x4004) syz_io_uring_setup(0x1d4a, &(0x7f0000000440)={0x0, 0xfa85, 0x0, 0x0, 0x285}, &(0x7f0000ffd000/0x1000)=nil, &(0x7f0000ffd000/0x2000)=nil, &(0x7f00000004c0)=0x0, &(0x7f0000000500)) syz_io_uring_setup(0x3e5e, &(0x7f0000000540)={0x0, 0x5c61, 0x8, 0x2, 0x72}, &(0x7f0000ffd000/0x3000)=nil, &(0x7f0000ffc000/0x3000)=nil, &(0x7f00000005c0), &(0x7f0000000600)=0x0) syz_io_uring_submit(r0, r1, &(0x7f0000000740)=@IORING_OP_READ=@pass_buffer={0x16, 0x1, 0x2004, @fd_index=0xa, 0x7, &(0x7f0000000640)=""/227, 0xe3, 0xc, 0x1}, 0x9) openat$cgroup_devices(0xffffffffffffffff, &(0x7f00000007c0)='devices.allow\x00', 0x2, 0x0) syz_mount_image$nfs4(&(0x7f0000000800), &(0x7f0000000840)='./file0/file0\x00', 0xffffffffffffff01, 0x1, &(0x7f0000000900)=[{&(0x7f0000000880)="f19bd7cfef39dd2070dcb194f7bd90ce305e2a9644b9fb91cc1e75bca69ed6bbdd7636452963af395ea61189cce718ef43420310b6ff8db9f4a606d67217b1aa7bf6e1435682323aef92ef40d036c48fa3fc363c6ad63229bb37cd76a6db9879a39f", 0x62, 0x6}], 0x8400, &(0x7f0000000940)={[{'*+\\['}]}) accept(0xffffffffffffffff, 0x0, &(0x7f0000000980)) mount$9p_rdma(&(0x7f0000001040), &(0x7f0000001080)='./file0\x00', &(0x7f00000010c0), 0xa00800, &(0x7f0000001100)={'trans=rdma,', {'port', 0x3d, 0x4e20}, 0x2c, {[{@common=@aname={'aname', 0x3d, 'permit_directio'}}, {@sq={'sq', 0x3d, 0xffff}}], [{@fscontext={'fscontext', 0x3d, 'staff_u'}}]}}) [ 308.310575] loop6: detected capacity change from 0 to 1 [ 308.317922] loop7: detected capacity change from 0 to 1 [ 308.322977] loop4: detected capacity change from 0 to 264192 [ 308.328896] SELinux: security_context_str_to_sid (staff_u) failed with errno=-22 [ 308.331271] loop6: detected capacity change from 0 to 264192 [ 308.340177] nfs4: Unknown parameter '*+\[' [ 308.343216] SELinux: security_context_str_to_sid (staff_u) failed with errno=-22 11:43:35 executing program 4: ioprio_set$uid(0x0, 0xee01, 0x4004) syz_io_uring_setup(0x1d4a, &(0x7f0000000440)={0x0, 0xfa85, 0x0, 0x0, 0x285}, &(0x7f0000ffd000/0x1000)=nil, &(0x7f0000ffd000/0x2000)=nil, &(0x7f00000004c0)=0x0, &(0x7f0000000500)) syz_io_uring_setup(0x3e5e, &(0x7f0000000540)={0x0, 0x5c61, 0x8, 0x2, 0x72}, &(0x7f0000ffd000/0x3000)=nil, &(0x7f0000ffc000/0x3000)=nil, &(0x7f00000005c0), &(0x7f0000000600)=0x0) syz_io_uring_submit(r0, r1, &(0x7f0000000740)=@IORING_OP_READ=@pass_buffer={0x16, 0x1, 0x2004, @fd_index=0xa, 0x7, &(0x7f0000000640)=""/227, 0xe3, 0xc, 0x1}, 0x9) openat$cgroup_devices(0xffffffffffffffff, &(0x7f00000007c0)='devices.allow\x00', 0x2, 0x0) syz_mount_image$nfs4(&(0x7f0000000800), &(0x7f0000000840)='./file0/file0\x00', 0xffffffffffffff01, 0x1, &(0x7f0000000900)=[{&(0x7f0000000880)="f19bd7cfef39dd2070dcb194f7bd90ce305e2a9644b9fb91cc1e75bca69ed6bbdd7636452963af395ea61189cce718ef43420310b6ff8db9f4a606d67217b1aa7bf6e1435682323aef92ef40d036c48fa3fc363c6ad63229bb37cd76a6db9879a39f", 0x62, 0x6}], 0x8400, &(0x7f0000000940)={[{'*+\\['}]}) accept(0xffffffffffffffff, 0x0, &(0x7f0000000980)) mount$9p_rdma(&(0x7f0000001040), &(0x7f0000001080)='./file0\x00', &(0x7f00000010c0), 0xa00800, &(0x7f0000001100)={'trans=rdma,', {'port', 0x3d, 0x4e20}, 0x2c, {[{@common=@aname={'aname', 0x3d, 'permit_directio'}}, {@sq={'sq', 0x3d, 0xffff}}], [{@fscontext={'fscontext', 0x3d, 'staff_u'}}]}}) 11:43:35 executing program 7: ioprio_set$uid(0x0, 0xee01, 0x4004) syz_io_uring_setup(0x1d4a, &(0x7f0000000440)={0x0, 0xfa85, 0x0, 0x0, 0x285}, &(0x7f0000ffd000/0x1000)=nil, &(0x7f0000ffd000/0x2000)=nil, &(0x7f00000004c0)=0x0, &(0x7f0000000500)) syz_io_uring_submit(r0, 0x0, &(0x7f0000000740)=@IORING_OP_READ=@pass_buffer={0x16, 0x1, 0x2004, @fd_index=0xa, 0x7, &(0x7f0000000640)=""/227, 0xe3, 0xc, 0x1}, 0x9) openat$cgroup_devices(0xffffffffffffffff, &(0x7f00000007c0)='devices.allow\x00', 0x2, 0x0) mount$9p_rdma(&(0x7f0000001040), &(0x7f0000001080)='./file0\x00', &(0x7f00000010c0), 0xa00800, &(0x7f0000001100)={'trans=rdma,', {'port', 0x3d, 0x4e20}, 0x2c, {[{@common=@aname={'aname', 0x3d, 'permit_directio'}}, {@sq={'sq', 0x3d, 0xffff}}], [{@fscontext={'fscontext', 0x3d, 'staff_u'}}]}}) 11:43:35 executing program 1: mmap$IORING_OFF_SQ_RING(&(0x7f0000ffd000/0x1000)=nil, 0x1000, 0x0, 0x10, 0xffffffffffffffff, 0x0) syz_io_uring_submit(0x0, 0x0, 0x0, 0x0) recvfrom$packet(0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0) io_uring_setup(0x0, 0x0) shmget$private(0x0, 0x2000, 0x0, &(0x7f0000ffc000/0x2000)=nil) 11:43:35 executing program 0: socket$inet_tcp(0x2, 0x1, 0x0) syz_genetlink_get_family_id$netlbl_mgmt(&(0x7f0000000440), 0xffffffffffffffff) syz_genetlink_get_family_id$netlbl_mgmt(0x0, 0xffffffffffffffff) 11:43:35 executing program 2: openat$sr(0xffffffffffffff9c, 0x0, 0x0, 0x0) 11:43:35 executing program 6: syz_mount_image$msdos(&(0x7f0000000000), &(0x7f0000000040)='./file0\x00', 0x200, 0x1, &(0x7f00000000c0)=[{&(0x7f0000000080)="7c74c7bc99e778a0c971e6f50fbdd2b70fa0b038d18c7d5ac685833434d89dce684239293aa5d8b6f11bc5c4a033ad1dc68319fad36a1101aad751fd6f4f10", 0x3f, 0x7f}], 0x42000, &(0x7f0000000100)={[{@dots}], [{@obj_user}, {@dont_appraise}, {@uid_lt}, {@hash}, {@seclabel}]}) syz_io_uring_setup(0x1d4a, &(0x7f0000000440)={0x0, 0xfa85, 0x0, 0x0, 0x285}, &(0x7f0000ffd000/0x1000)=nil, &(0x7f0000ffd000/0x2000)=nil, &(0x7f00000004c0)=0x0, &(0x7f0000000500)) syz_io_uring_setup(0x3e5e, &(0x7f0000000540)={0x0, 0x5c61, 0x8, 0x2, 0x72}, &(0x7f0000ffd000/0x3000)=nil, &(0x7f0000ffc000/0x3000)=nil, &(0x7f00000005c0), &(0x7f0000000600)=0x0) syz_io_uring_submit(r0, r1, &(0x7f0000000740)=@IORING_OP_READ=@pass_buffer={0x16, 0x1, 0x2004, @fd_index=0xa, 0x7, &(0x7f0000000640)=""/227, 0xe3, 0xc, 0x1}, 0x9) openat$cgroup_devices(0xffffffffffffffff, &(0x7f00000007c0)='devices.allow\x00', 0x2, 0x0) syz_mount_image$nfs4(&(0x7f0000000800), &(0x7f0000000840)='./file0/file0\x00', 0xffffffffffffff01, 0x1, &(0x7f0000000900)=[{&(0x7f0000000880)="f19bd7cfef39dd2070dcb194f7bd90ce305e2a9644b9fb91cc1e75bca69ed6bbdd7636452963af395ea61189cce718ef43420310b6ff8db9f4a606d67217b1aa7bf6e1435682323aef92ef40d036c48fa3fc363c6ad63229bb37cd76a6db9879a39f", 0x62, 0x6}], 0x8400, &(0x7f0000000940)={[{'*+\\['}]}) accept(0xffffffffffffffff, 0x0, &(0x7f0000000980)) mount$9p_rdma(&(0x7f0000001040), &(0x7f0000001080)='./file0\x00', &(0x7f00000010c0), 0xa00800, &(0x7f0000001100)={'trans=rdma,', {'port', 0x3d, 0x4e20}, 0x2c, {[{@common=@aname={'aname', 0x3d, 'permit_directio'}}, {@sq={'sq', 0x3d, 0xffff}}], [{@fscontext={'fscontext', 0x3d, 'staff_u'}}]}}) 11:43:35 executing program 5: r0 = shmget(0x2, 0x3000, 0x100, &(0x7f0000ffb000/0x3000)=nil) shmat(r0, &(0x7f0000ffa000/0x4000)=nil, 0x3000) syz_genetlink_get_family_id$netlbl_mgmt(&(0x7f0000000040), 0xffffffffffffffff) mmap$IORING_OFF_SQ_RING(&(0x7f0000ffd000/0x1000)=nil, 0x1000, 0x2000006, 0x40010, 0xffffffffffffffff, 0x0) io_uring_setup(0x14ab, &(0x7f0000000480)={0x0, 0x5191, 0x20, 0x1, 0x3ba}) [ 308.464240] loop4: detected capacity change from 0 to 264192 [ 308.485713] loop6: detected capacity change from 0 to 1 11:43:35 executing program 7: ioprio_set$uid(0x0, 0xee01, 0x4004) syz_io_uring_setup(0x1d4a, &(0x7f0000000440)={0x0, 0xfa85, 0x0, 0x0, 0x285}, &(0x7f0000ffd000/0x1000)=nil, &(0x7f0000ffd000/0x2000)=nil, &(0x7f00000004c0)=0x0, &(0x7f0000000500)) syz_io_uring_submit(r0, 0x0, &(0x7f0000000740)=@IORING_OP_READ=@pass_buffer={0x16, 0x1, 0x2004, @fd_index=0xa, 0x7, &(0x7f0000000640)=""/227, 0xe3, 0xc, 0x1}, 0x9) openat$cgroup_devices(0xffffffffffffffff, &(0x7f00000007c0)='devices.allow\x00', 0x2, 0x0) mount$9p_rdma(&(0x7f0000001040), &(0x7f0000001080)='./file0\x00', &(0x7f00000010c0), 0xa00800, &(0x7f0000001100)={'trans=rdma,', {'port', 0x3d, 0x4e20}, 0x2c, {[{@common=@aname={'aname', 0x3d, 'permit_directio'}}, {@sq={'sq', 0x3d, 0xffff}}], [{@fscontext={'fscontext', 0x3d, 'staff_u'}}]}}) [ 308.501096] loop6: detected capacity change from 0 to 264192 [ 308.506132] nfs4: Unknown parameter '*+\[' [ 308.513474] SELinux: security_context_str_to_sid (staff_u) failed with errno=-22 11:43:44 executing program 6: ioprio_set$uid(0x0, 0xee01, 0x0) syz_mount_image$msdos(&(0x7f0000000000), &(0x7f0000000040)='./file0\x00', 0x200, 0x1, &(0x7f00000000c0)=[{&(0x7f0000000080)="7c74c7bc99e778a0c971e6f50fbdd2b70fa0b038d18c7d5ac685833434d89dce684239293aa5d8b6f11bc5c4a033ad1dc68319fad36a1101aad751fd6f4f10", 0x3f, 0x7f}], 0x42000, &(0x7f0000000100)={[{@dots}], [{@obj_user}, {@dont_appraise}, {@uid_lt}, {@hash}, {@seclabel}]}) syz_io_uring_setup(0x1d4a, &(0x7f0000000440)={0x0, 0xfa85, 0x0, 0x0, 0x285}, &(0x7f0000ffd000/0x1000)=nil, &(0x7f0000ffd000/0x2000)=nil, &(0x7f00000004c0)=0x0, &(0x7f0000000500)) syz_io_uring_setup(0x3e5e, &(0x7f0000000540)={0x0, 0x5c61, 0x8, 0x2, 0x72}, &(0x7f0000ffd000/0x3000)=nil, &(0x7f0000ffc000/0x3000)=nil, &(0x7f00000005c0), &(0x7f0000000600)=0x0) syz_io_uring_submit(r0, r1, &(0x7f0000000740)=@IORING_OP_READ=@pass_buffer={0x16, 0x1, 0x2004, @fd_index=0xa, 0x7, &(0x7f0000000640)=""/227, 0xe3, 0xc, 0x1}, 0x9) openat$cgroup_devices(0xffffffffffffffff, &(0x7f00000007c0)='devices.allow\x00', 0x2, 0x0) syz_mount_image$nfs4(&(0x7f0000000800), &(0x7f0000000840)='./file0/file0\x00', 0xffffffffffffff01, 0x1, &(0x7f0000000900)=[{&(0x7f0000000880)="f19bd7cfef39dd2070dcb194f7bd90ce305e2a9644b9fb91cc1e75bca69ed6bbdd7636452963af395ea61189cce718ef43420310b6ff8db9f4a606d67217b1aa7bf6e1435682323aef92ef40d036c48fa3fc363c6ad63229bb37cd76a6db9879a39f", 0x62, 0x6}], 0x8400, &(0x7f0000000940)={[{'*+\\['}]}) accept(0xffffffffffffffff, 0x0, &(0x7f0000000980)) mount$9p_rdma(&(0x7f0000001040), &(0x7f0000001080)='./file0\x00', &(0x7f00000010c0), 0xa00800, &(0x7f0000001100)={'trans=rdma,', {'port', 0x3d, 0x4e20}, 0x2c, {[{@common=@aname={'aname', 0x3d, 'permit_directio'}}, {@sq={'sq', 0x3d, 0xffff}}], [{@fscontext={'fscontext', 0x3d, 'staff_u'}}]}}) 11:43:44 executing program 4: ioprio_set$uid(0x0, 0xee01, 0x4004) syz_io_uring_setup(0x1d4a, &(0x7f0000000440)={0x0, 0xfa85, 0x0, 0x0, 0x285}, &(0x7f0000ffd000/0x1000)=nil, &(0x7f0000ffd000/0x2000)=nil, &(0x7f00000004c0)=0x0, &(0x7f0000000500)) syz_io_uring_setup(0x3e5e, &(0x7f0000000540)={0x0, 0x5c61, 0x8, 0x2, 0x72}, &(0x7f0000ffd000/0x3000)=nil, &(0x7f0000ffc000/0x3000)=nil, &(0x7f00000005c0), &(0x7f0000000600)=0x0) syz_io_uring_submit(r0, r1, &(0x7f0000000740)=@IORING_OP_READ=@pass_buffer={0x16, 0x1, 0x2004, @fd_index=0xa, 0x7, &(0x7f0000000640)=""/227, 0xe3, 0xc, 0x1}, 0x9) openat$cgroup_devices(0xffffffffffffffff, &(0x7f00000007c0)='devices.allow\x00', 0x2, 0x0) syz_mount_image$nfs4(&(0x7f0000000800), &(0x7f0000000840)='./file0/file0\x00', 0xffffffffffffff01, 0x1, &(0x7f0000000900)=[{&(0x7f0000000880)="f19bd7cfef39dd2070dcb194f7bd90ce305e2a9644b9fb91cc1e75bca69ed6bbdd7636452963af395ea61189cce718ef43420310b6ff8db9f4a606d67217b1aa7bf6e1435682323aef92ef40d036c48fa3fc363c6ad63229bb37cd76a6db9879a39f", 0x62, 0x6}], 0x8400, &(0x7f0000000940)={[{'*+\\['}]}) accept(0xffffffffffffffff, 0x0, &(0x7f0000000980)) 11:43:44 executing program 5: r0 = shmget(0x2, 0x3000, 0x100, &(0x7f0000ffb000/0x3000)=nil) shmat(r0, &(0x7f0000ffa000/0x4000)=nil, 0x3000) syz_genetlink_get_family_id$netlbl_mgmt(&(0x7f0000000040), 0xffffffffffffffff) mmap$IORING_OFF_SQ_RING(&(0x7f0000ffd000/0x1000)=nil, 0x1000, 0x2000006, 0x40010, 0xffffffffffffffff, 0x0) io_uring_setup(0x14ab, &(0x7f0000000480)={0x0, 0x5191, 0x20, 0x1, 0x3ba}) 11:43:44 executing program 0: ioprio_set$uid(0x0, 0xee01, 0x4004) syz_io_uring_setup(0x1d4a, &(0x7f0000000440)={0x0, 0xfa85, 0x0, 0x0, 0x285}, &(0x7f0000ffd000/0x1000)=nil, &(0x7f0000ffd000/0x2000)=nil, &(0x7f00000004c0)=0x0, &(0x7f0000000500)) syz_io_uring_submit(r0, 0x0, &(0x7f0000000740)=@IORING_OP_READ=@pass_buffer={0x16, 0x1, 0x2004, @fd_index=0xa, 0x7, &(0x7f0000000640)=""/227, 0xe3, 0xc, 0x1}, 0x9) openat$cgroup_devices(0xffffffffffffffff, &(0x7f00000007c0)='devices.allow\x00', 0x2, 0x0) mount$9p_rdma(&(0x7f0000001040), &(0x7f0000001080)='./file0\x00', &(0x7f00000010c0), 0xa00800, &(0x7f0000001100)={'trans=rdma,', {'port', 0x3d, 0x4e20}, 0x2c, {[{@common=@aname={'aname', 0x3d, 'permit_directio'}}, {@sq={'sq', 0x3d, 0xffff}}], [{@fscontext={'fscontext', 0x3d, 'staff_u'}}]}}) 11:43:44 executing program 2: openat$sr(0xffffffffffffff9c, 0x0, 0x0, 0x0) 11:43:44 executing program 1: syz_mount_image$msdos(&(0x7f0000000000), &(0x7f0000000040)='./file0\x00', 0x200, 0x1, &(0x7f00000000c0)=[{&(0x7f0000000080)="7c74c7bc99e778a0c971e6f50fbdd2b70fa0b038d18c7d5ac685833434d89dce684239293aa5d8b6f11bc5c4a033ad1dc68319fad36a1101aad751fd6f4f10", 0x3f, 0x7f}], 0x42000, &(0x7f0000000100)={[{@dots}], [{@obj_user}, {@dont_appraise}, {@uid_lt}, {@hash}, {@seclabel}]}) syz_io_uring_setup(0x1d4a, &(0x7f0000000440)={0x0, 0xfa85, 0x0, 0x0, 0x285}, &(0x7f0000ffd000/0x1000)=nil, &(0x7f0000ffd000/0x2000)=nil, &(0x7f00000004c0)=0x0, &(0x7f0000000500)) syz_io_uring_setup(0x3e5e, &(0x7f0000000540)={0x0, 0x5c61, 0x8, 0x2, 0x72}, &(0x7f0000ffd000/0x3000)=nil, &(0x7f0000ffc000/0x3000)=nil, &(0x7f00000005c0), &(0x7f0000000600)=0x0) syz_io_uring_submit(r0, r1, &(0x7f0000000740)=@IORING_OP_READ=@pass_buffer={0x16, 0x1, 0x2004, @fd_index=0xa, 0x7, &(0x7f0000000640)=""/227, 0xe3, 0xc, 0x1}, 0x9) openat$cgroup_devices(0xffffffffffffffff, &(0x7f00000007c0)='devices.allow\x00', 0x2, 0x0) syz_mount_image$nfs4(&(0x7f0000000800), &(0x7f0000000840)='./file0/file0\x00', 0xffffffffffffff01, 0x1, &(0x7f0000000900)=[{&(0x7f0000000880)="f19bd7cfef39dd2070dcb194f7bd90ce305e2a9644b9fb91cc1e75bca69ed6bbdd7636452963af395ea61189cce718ef43420310b6ff8db9f4a606d67217b1aa7bf6e1435682323aef92ef40d036c48fa3fc363c6ad63229bb37cd76a6db9879a39f", 0x62, 0x6}], 0x8400, &(0x7f0000000940)={[{'*+\\['}]}) accept(0xffffffffffffffff, 0x0, &(0x7f0000000980)) mount$9p_rdma(&(0x7f0000001040), &(0x7f0000001080)='./file0\x00', &(0x7f00000010c0), 0xa00800, &(0x7f0000001100)={'trans=rdma,', {'port', 0x3d, 0x4e20}, 0x2c, {[{@common=@aname={'aname', 0x3d, 'permit_directio'}}, {@sq={'sq', 0x3d, 0xffff}}], [{@fscontext={'fscontext', 0x3d, 'staff_u'}}]}}) 11:43:44 executing program 7: ioprio_set$uid(0x0, 0xee01, 0x4004) syz_io_uring_setup(0x1d4a, &(0x7f0000000440)={0x0, 0xfa85, 0x0, 0x0, 0x285}, &(0x7f0000ffd000/0x1000)=nil, &(0x7f0000ffd000/0x2000)=nil, &(0x7f00000004c0)=0x0, &(0x7f0000000500)) syz_io_uring_submit(r0, 0x0, &(0x7f0000000740)=@IORING_OP_READ=@pass_buffer={0x16, 0x1, 0x2004, @fd_index=0xa, 0x7, &(0x7f0000000640)=""/227, 0xe3, 0xc, 0x1}, 0x9) openat$cgroup_devices(0xffffffffffffffff, &(0x7f00000007c0)='devices.allow\x00', 0x2, 0x0) mount$9p_rdma(&(0x7f0000001040), &(0x7f0000001080)='./file0\x00', &(0x7f00000010c0), 0xa00800, &(0x7f0000001100)={'trans=rdma,', {'port', 0x3d, 0x4e20}, 0x2c, {[{@common=@aname={'aname', 0x3d, 'permit_directio'}}, {@sq={'sq', 0x3d, 0xffff}}], [{@fscontext={'fscontext', 0x3d, 'staff_u'}}]}}) 11:43:44 executing program 3: ioctl$SG_SET_FORCE_PACK_ID(0xffffffffffffffff, 0x227b, &(0x7f0000000000)=0x1) ioctl$SG_SET_FORCE_PACK_ID(0xffffffffffffffff, 0x227b, &(0x7f0000000040)) ioctl$SG_GET_RESERVED_SIZE(0xffffffffffffffff, 0x2272, &(0x7f0000000080)) ioctl$SCSI_IOCTL_SEND_COMMAND(0xffffffffffffffff, 0x1, &(0x7f0000000100)={0x17, 0x3, 0x1c00, "af36a59fb168d324fd8eaf833aeb82f60d75e8700d81d9"}) ioctl$SG_SET_TIMEOUT(0xffffffffffffffff, 0x2201, &(0x7f0000000140)=0x4) ioctl$SG_GET_VERSION_NUM(0xffffffffffffffff, 0x2282, &(0x7f0000000180)) ioctl$SG_GET_REQUEST_TABLE(0xffffffffffffffff, 0x2286, &(0x7f00000001c0)) ioctl$SG_GET_TIMEOUT(0xffffffffffffffff, 0x2202, 0x0) r0 = syz_open_dev$sg(&(0x7f0000000340), 0x7fff, 0x40) ioctl$SG_EMULATED_HOST(r0, 0x2203, &(0x7f0000000380)) r1 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$inet6_tcp_TCP_CONGESTION(r1, 0x6, 0xd, &(0x7f0000000440)='scalable\x00', 0x9) [ 317.148152] loop1: detected capacity change from 0 to 1 [ 317.180088] loop4: detected capacity change from 0 to 264192 [ 317.205970] loop6: detected capacity change from 0 to 1 11:43:44 executing program 0: ioprio_set$uid(0x0, 0xee01, 0x4004) syz_io_uring_setup(0x1d4a, &(0x7f0000000440)={0x0, 0xfa85, 0x0, 0x0, 0x285}, &(0x7f0000ffd000/0x1000)=nil, &(0x7f0000ffd000/0x2000)=nil, &(0x7f00000004c0)=0x0, &(0x7f0000000500)) syz_io_uring_submit(r0, 0x0, &(0x7f0000000740)=@IORING_OP_READ=@pass_buffer={0x16, 0x1, 0x2004, @fd_index=0xa, 0x7, &(0x7f0000000640)=""/227, 0xe3, 0xc, 0x1}, 0x9) openat$cgroup_devices(0xffffffffffffffff, &(0x7f00000007c0)='devices.allow\x00', 0x2, 0x0) mount$9p_rdma(&(0x7f0000001040), &(0x7f0000001080)='./file0\x00', &(0x7f00000010c0), 0xa00800, &(0x7f0000001100)={'trans=rdma,', {'port', 0x3d, 0x4e20}, 0x2c, {[{@common=@aname={'aname', 0x3d, 'permit_directio'}}, {@sq={'sq', 0x3d, 0xffff}}], [{@fscontext={'fscontext', 0x3d, 'staff_u'}}]}}) 11:43:44 executing program 7: syz_mount_image$msdos(&(0x7f0000000000), &(0x7f0000000040)='./file0\x00', 0x200, 0x1, &(0x7f00000000c0)=[{&(0x7f0000000080)="7c74c7bc99e778a0c971e6f50fbdd2b70fa0b038d18c7d5ac685833434d89dce684239293aa5d8b6f11bc5c4a033ad1dc68319fad36a1101aad751fd6f4f10", 0x3f, 0x7f}], 0x42000, &(0x7f0000000100)={[{@dots}], [{@obj_user}, {@dont_appraise}, {@uid_lt}, {@hash}, {@seclabel}]}) syz_io_uring_setup(0x1d4a, &(0x7f0000000440)={0x0, 0xfa85, 0x0, 0x0, 0x285}, &(0x7f0000ffd000/0x1000)=nil, &(0x7f0000ffd000/0x2000)=nil, &(0x7f00000004c0)=0x0, &(0x7f0000000500)) syz_io_uring_submit(r0, 0x0, &(0x7f0000000740)=@IORING_OP_READ=@pass_buffer={0x16, 0x1, 0x2004, @fd_index=0xa, 0x7, &(0x7f0000000640)=""/227, 0xe3, 0xc, 0x1}, 0x9) openat$cgroup_devices(0xffffffffffffffff, &(0x7f00000007c0)='devices.allow\x00', 0x2, 0x0) mount$9p_rdma(&(0x7f0000001040), &(0x7f0000001080)='./file0\x00', &(0x7f00000010c0), 0xa00800, &(0x7f0000001100)={'trans=rdma,', {'port', 0x3d, 0x4e20}, 0x2c, {[{@common=@aname={'aname', 0x3d, 'permit_directio'}}, {@sq={'sq', 0x3d, 0xffff}}], [{@fscontext={'fscontext', 0x3d, 'staff_u'}}]}}) 11:43:44 executing program 4: ioprio_set$uid(0x0, 0xee01, 0x4004) syz_io_uring_setup(0x1d4a, &(0x7f0000000440)={0x0, 0xfa85, 0x0, 0x0, 0x285}, &(0x7f0000ffd000/0x1000)=nil, &(0x7f0000ffd000/0x2000)=nil, &(0x7f00000004c0)=0x0, &(0x7f0000000500)) syz_io_uring_setup(0x3e5e, &(0x7f0000000540)={0x0, 0x5c61, 0x8, 0x2, 0x72}, &(0x7f0000ffd000/0x3000)=nil, &(0x7f0000ffc000/0x3000)=nil, &(0x7f00000005c0), &(0x7f0000000600)=0x0) syz_io_uring_submit(r0, r1, &(0x7f0000000740)=@IORING_OP_READ=@pass_buffer={0x16, 0x1, 0x2004, @fd_index=0xa, 0x7, &(0x7f0000000640)=""/227, 0xe3, 0xc, 0x1}, 0x9) openat$cgroup_devices(0xffffffffffffffff, &(0x7f00000007c0)='devices.allow\x00', 0x2, 0x0) syz_mount_image$nfs4(&(0x7f0000000800), &(0x7f0000000840)='./file0/file0\x00', 0xffffffffffffff01, 0x1, &(0x7f0000000900)=[{&(0x7f0000000880)="f19bd7cfef39dd2070dcb194f7bd90ce305e2a9644b9fb91cc1e75bca69ed6bbdd7636452963af395ea61189cce718ef43420310b6ff8db9f4a606d67217b1aa7bf6e1435682323aef92ef40d036c48fa3fc363c6ad63229bb37cd76a6db9879a39f", 0x62, 0x6}], 0x8400, &(0x7f0000000940)={[{'*+\\['}]}) accept(0xffffffffffffffff, 0x0, &(0x7f0000000980)) [ 317.232554] loop6: detected capacity change from 0 to 264192 [ 317.233660] loop1: detected capacity change from 0 to 264192 [ 317.238448] nfs4: Unknown parameter '*+\[' [ 317.249664] SELinux: security_context_str_to_sid (staff_u) failed with errno=-22 [ 317.250029] nfs4: Unknown parameter '*+\[' [ 317.269748] SELinux: security_context_str_to_sid (staff_u) failed with errno=-22 [ 317.280332] loop7: detected capacity change from 0 to 1 [ 317.291550] loop4: detected capacity change from 0 to 264192 11:43:44 executing program 2: mmap$IORING_OFF_SQ_RING(&(0x7f0000ffd000/0x1000)=nil, 0x1000, 0x0, 0x10, 0xffffffffffffffff, 0x0) syz_io_uring_submit(0x0, 0x0, 0x0, 0x0) recvfrom$packet(0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0) io_uring_setup(0x0, 0x0) shmget$private(0x0, 0x2000, 0x10, &(0x7f0000ffc000/0x2000)=nil) 11:43:44 executing program 5: r0 = shmget(0x2, 0x3000, 0x100, &(0x7f0000ffb000/0x3000)=nil) shmat(r0, &(0x7f0000ffa000/0x4000)=nil, 0x3000) syz_genetlink_get_family_id$netlbl_mgmt(&(0x7f0000000040), 0xffffffffffffffff) mmap$IORING_OFF_SQ_RING(&(0x7f0000ffd000/0x1000)=nil, 0x1000, 0x2000006, 0x40010, 0xffffffffffffffff, 0x0) io_uring_setup(0x14ab, &(0x7f0000000480)={0x0, 0x5191, 0x20, 0x1, 0x3ba}) 11:43:44 executing program 6: ioprio_set$uid(0x0, 0xee01, 0x0) syz_mount_image$msdos(&(0x7f0000000000), &(0x7f0000000040)='./file0\x00', 0x200, 0x1, &(0x7f00000000c0)=[{&(0x7f0000000080)="7c74c7bc99e778a0c971e6f50fbdd2b70fa0b038d18c7d5ac685833434d89dce684239293aa5d8b6f11bc5c4a033ad1dc68319fad36a1101aad751fd6f4f10", 0x3f, 0x7f}], 0x42000, &(0x7f0000000100)={[{@dots}], [{@obj_user}, {@dont_appraise}, {@uid_lt}, {@hash}, {@seclabel}]}) syz_io_uring_setup(0x1d4a, &(0x7f0000000440)={0x0, 0xfa85, 0x0, 0x0, 0x285}, &(0x7f0000ffd000/0x1000)=nil, &(0x7f0000ffd000/0x2000)=nil, &(0x7f00000004c0)=0x0, &(0x7f0000000500)) syz_io_uring_setup(0x3e5e, &(0x7f0000000540)={0x0, 0x5c61, 0x8, 0x2, 0x72}, &(0x7f0000ffd000/0x3000)=nil, &(0x7f0000ffc000/0x3000)=nil, &(0x7f00000005c0), &(0x7f0000000600)=0x0) syz_io_uring_submit(r0, r1, &(0x7f0000000740)=@IORING_OP_READ=@pass_buffer={0x16, 0x1, 0x2004, @fd_index=0xa, 0x7, &(0x7f0000000640)=""/227, 0xe3, 0xc, 0x1}, 0x9) openat$cgroup_devices(0xffffffffffffffff, &(0x7f00000007c0)='devices.allow\x00', 0x2, 0x0) syz_mount_image$nfs4(&(0x7f0000000800), &(0x7f0000000840)='./file0/file0\x00', 0xffffffffffffff01, 0x1, &(0x7f0000000900)=[{&(0x7f0000000880)="f19bd7cfef39dd2070dcb194f7bd90ce305e2a9644b9fb91cc1e75bca69ed6bbdd7636452963af395ea61189cce718ef43420310b6ff8db9f4a606d67217b1aa7bf6e1435682323aef92ef40d036c48fa3fc363c6ad63229bb37cd76a6db9879a39f", 0x62, 0x6}], 0x8400, &(0x7f0000000940)={[{'*+\\['}]}) accept(0xffffffffffffffff, 0x0, &(0x7f0000000980)) mount$9p_rdma(&(0x7f0000001040), &(0x7f0000001080)='./file0\x00', &(0x7f00000010c0), 0xa00800, &(0x7f0000001100)={'trans=rdma,', {'port', 0x3d, 0x4e20}, 0x2c, {[{@common=@aname={'aname', 0x3d, 'permit_directio'}}, {@sq={'sq', 0x3d, 0xffff}}], [{@fscontext={'fscontext', 0x3d, 'staff_u'}}]}}) [ 317.324821] SELinux: security_context_str_to_sid (staff_u) failed with errno=-22 [ 317.348769] loop6: detected capacity change from 0 to 1 [ 317.362512] loop6: detected capacity change from 0 to 264192 [ 317.365275] nfs4: Unknown parameter '*+\[' [ 317.373236] SELinux: security_context_str_to_sid (staff_u) failed with errno=-22 11:43:52 executing program 0: ioprio_set$uid(0x0, 0xee01, 0x4004) syz_io_uring_setup(0x1d4a, &(0x7f0000000440)={0x0, 0xfa85, 0x0, 0x0, 0x285}, &(0x7f0000ffd000/0x1000)=nil, &(0x7f0000ffd000/0x2000)=nil, &(0x7f00000004c0)=0x0, &(0x7f0000000500)) syz_io_uring_submit(r0, 0x0, &(0x7f0000000740)=@IORING_OP_READ=@pass_buffer={0x16, 0x1, 0x2004, @fd_index=0xa, 0x7, &(0x7f0000000640)=""/227, 0xe3, 0xc, 0x1}, 0x9) openat$cgroup_devices(0xffffffffffffffff, &(0x7f00000007c0)='devices.allow\x00', 0x2, 0x0) mount$9p_rdma(&(0x7f0000001040), &(0x7f0000001080)='./file0\x00', &(0x7f00000010c0), 0xa00800, &(0x7f0000001100)={'trans=rdma,', {'port', 0x3d, 0x4e20}, 0x2c, {[{@common=@aname={'aname', 0x3d, 'permit_directio'}}, {@sq={'sq', 0x3d, 0xffff}}], [{@fscontext={'fscontext', 0x3d, 'staff_u'}}]}}) 11:43:52 executing program 6: ioprio_set$uid(0x0, 0xee01, 0x0) syz_mount_image$msdos(&(0x7f0000000000), &(0x7f0000000040)='./file0\x00', 0x200, 0x1, &(0x7f00000000c0)=[{&(0x7f0000000080)="7c74c7bc99e778a0c971e6f50fbdd2b70fa0b038d18c7d5ac685833434d89dce684239293aa5d8b6f11bc5c4a033ad1dc68319fad36a1101aad751fd6f4f10", 0x3f, 0x7f}], 0x42000, &(0x7f0000000100)={[{@dots}], [{@obj_user}, {@dont_appraise}, {@uid_lt}, {@hash}, {@seclabel}]}) syz_io_uring_setup(0x1d4a, &(0x7f0000000440)={0x0, 0xfa85, 0x0, 0x0, 0x285}, &(0x7f0000ffd000/0x1000)=nil, &(0x7f0000ffd000/0x2000)=nil, &(0x7f00000004c0)=0x0, &(0x7f0000000500)) syz_io_uring_setup(0x3e5e, &(0x7f0000000540)={0x0, 0x5c61, 0x8, 0x2, 0x72}, &(0x7f0000ffd000/0x3000)=nil, &(0x7f0000ffc000/0x3000)=nil, &(0x7f00000005c0), &(0x7f0000000600)=0x0) syz_io_uring_submit(r0, r1, &(0x7f0000000740)=@IORING_OP_READ=@pass_buffer={0x16, 0x1, 0x2004, @fd_index=0xa, 0x7, &(0x7f0000000640)=""/227, 0xe3, 0xc, 0x1}, 0x9) openat$cgroup_devices(0xffffffffffffffff, &(0x7f00000007c0)='devices.allow\x00', 0x2, 0x0) syz_mount_image$nfs4(&(0x7f0000000800), &(0x7f0000000840)='./file0/file0\x00', 0xffffffffffffff01, 0x1, &(0x7f0000000900)=[{&(0x7f0000000880)="f19bd7cfef39dd2070dcb194f7bd90ce305e2a9644b9fb91cc1e75bca69ed6bbdd7636452963af395ea61189cce718ef43420310b6ff8db9f4a606d67217b1aa7bf6e1435682323aef92ef40d036c48fa3fc363c6ad63229bb37cd76a6db9879a39f", 0x62, 0x6}], 0x8400, &(0x7f0000000940)={[{'*+\\['}]}) accept(0xffffffffffffffff, 0x0, &(0x7f0000000980)) mount$9p_rdma(&(0x7f0000001040), &(0x7f0000001080)='./file0\x00', &(0x7f00000010c0), 0xa00800, &(0x7f0000001100)={'trans=rdma,', {'port', 0x3d, 0x4e20}, 0x2c, {[{@common=@aname={'aname', 0x3d, 'permit_directio'}}, {@sq={'sq', 0x3d, 0xffff}}], [{@fscontext={'fscontext', 0x3d, 'staff_u'}}]}}) 11:43:52 executing program 7: syz_mount_image$msdos(&(0x7f0000000000), &(0x7f0000000040)='./file0\x00', 0x200, 0x1, &(0x7f00000000c0)=[{&(0x7f0000000080)="7c74c7bc99e778a0c971e6f50fbdd2b70fa0b038d18c7d5ac685833434d89dce684239293aa5d8b6f11bc5c4a033ad1dc68319fad36a1101aad751fd6f4f10", 0x3f, 0x7f}], 0x42000, &(0x7f0000000100)={[{@dots}], [{@obj_user}, {@dont_appraise}, {@uid_lt}, {@hash}, {@seclabel}]}) syz_io_uring_setup(0x1d4a, &(0x7f0000000440)={0x0, 0xfa85, 0x0, 0x0, 0x285}, &(0x7f0000ffd000/0x1000)=nil, &(0x7f0000ffd000/0x2000)=nil, &(0x7f00000004c0)=0x0, &(0x7f0000000500)) syz_io_uring_submit(r0, 0x0, &(0x7f0000000740)=@IORING_OP_READ=@pass_buffer={0x16, 0x1, 0x2004, @fd_index=0xa, 0x7, &(0x7f0000000640)=""/227, 0xe3, 0xc, 0x1}, 0x9) openat$cgroup_devices(0xffffffffffffffff, &(0x7f00000007c0)='devices.allow\x00', 0x2, 0x0) mount$9p_rdma(&(0x7f0000001040), &(0x7f0000001080)='./file0\x00', &(0x7f00000010c0), 0xa00800, &(0x7f0000001100)={'trans=rdma,', {'port', 0x3d, 0x4e20}, 0x2c, {[{@common=@aname={'aname', 0x3d, 'permit_directio'}}, {@sq={'sq', 0x3d, 0xffff}}], [{@fscontext={'fscontext', 0x3d, 'staff_u'}}]}}) 11:43:52 executing program 5: shmat(0x0, &(0x7f0000ffa000/0x4000)=nil, 0x3000) syz_genetlink_get_family_id$netlbl_mgmt(&(0x7f0000000040), 0xffffffffffffffff) mmap$IORING_OFF_SQ_RING(&(0x7f0000ffd000/0x1000)=nil, 0x1000, 0x2000006, 0x40010, 0xffffffffffffffff, 0x0) io_uring_setup(0x14ab, &(0x7f0000000480)={0x0, 0x5191, 0x20, 0x1, 0x3ba}) 11:43:52 executing program 4: ioprio_set$uid(0x0, 0xee01, 0x4004) syz_io_uring_setup(0x1d4a, &(0x7f0000000440)={0x0, 0xfa85, 0x0, 0x0, 0x285}, &(0x7f0000ffd000/0x1000)=nil, &(0x7f0000ffd000/0x2000)=nil, &(0x7f00000004c0)=0x0, &(0x7f0000000500)) syz_io_uring_setup(0x3e5e, &(0x7f0000000540)={0x0, 0x5c61, 0x8, 0x2, 0x72}, &(0x7f0000ffd000/0x3000)=nil, &(0x7f0000ffc000/0x3000)=nil, &(0x7f00000005c0), &(0x7f0000000600)=0x0) syz_io_uring_submit(r0, r1, &(0x7f0000000740)=@IORING_OP_READ=@pass_buffer={0x16, 0x1, 0x2004, @fd_index=0xa, 0x7, &(0x7f0000000640)=""/227, 0xe3, 0xc, 0x1}, 0x9) openat$cgroup_devices(0xffffffffffffffff, &(0x7f00000007c0)='devices.allow\x00', 0x2, 0x0) syz_mount_image$nfs4(&(0x7f0000000800), &(0x7f0000000840)='./file0/file0\x00', 0xffffffffffffff01, 0x1, &(0x7f0000000900)=[{&(0x7f0000000880)="f19bd7cfef39dd2070dcb194f7bd90ce305e2a9644b9fb91cc1e75bca69ed6bbdd7636452963af395ea61189cce718ef43420310b6ff8db9f4a606d67217b1aa7bf6e1435682323aef92ef40d036c48fa3fc363c6ad63229bb37cd76a6db9879a39f", 0x62, 0x6}], 0x8400, &(0x7f0000000940)={[{'*+\\['}]}) accept(0xffffffffffffffff, 0x0, &(0x7f0000000980)) 11:43:52 executing program 1: syz_mount_image$msdos(&(0x7f0000000000), &(0x7f0000000040)='./file0\x00', 0x200, 0x1, &(0x7f00000000c0)=[{&(0x7f0000000080)="7c74c7bc99e778a0c971e6f50fbdd2b70fa0b038d18c7d5ac685833434d89dce684239293aa5d8b6f11bc5c4a033ad1dc68319fad36a1101aad751fd6f4f10", 0x3f, 0x7f}], 0x42000, &(0x7f0000000100)={[{@dots}], [{@obj_user}, {@dont_appraise}, {@uid_lt}, {@hash}, {@seclabel}]}) syz_io_uring_setup(0x1d4a, &(0x7f0000000440)={0x0, 0xfa85, 0x0, 0x0, 0x285}, &(0x7f0000ffd000/0x1000)=nil, &(0x7f0000ffd000/0x2000)=nil, &(0x7f00000004c0)=0x0, &(0x7f0000000500)) syz_io_uring_setup(0x3e5e, &(0x7f0000000540)={0x0, 0x5c61, 0x8, 0x2, 0x72}, &(0x7f0000ffd000/0x3000)=nil, &(0x7f0000ffc000/0x3000)=nil, &(0x7f00000005c0), &(0x7f0000000600)=0x0) syz_io_uring_submit(r0, r1, &(0x7f0000000740)=@IORING_OP_READ=@pass_buffer={0x16, 0x1, 0x2004, @fd_index=0xa, 0x7, &(0x7f0000000640)=""/227, 0xe3, 0xc, 0x1}, 0x9) openat$cgroup_devices(0xffffffffffffffff, &(0x7f00000007c0)='devices.allow\x00', 0x2, 0x0) syz_mount_image$nfs4(&(0x7f0000000800), &(0x7f0000000840)='./file0/file0\x00', 0xffffffffffffff01, 0x1, &(0x7f0000000900)=[{&(0x7f0000000880)="f19bd7cfef39dd2070dcb194f7bd90ce305e2a9644b9fb91cc1e75bca69ed6bbdd7636452963af395ea61189cce718ef43420310b6ff8db9f4a606d67217b1aa7bf6e1435682323aef92ef40d036c48fa3fc363c6ad63229bb37cd76a6db9879a39f", 0x62, 0x6}], 0x8400, &(0x7f0000000940)={[{'*+\\['}]}) accept(0xffffffffffffffff, 0x0, &(0x7f0000000980)) mount$9p_rdma(&(0x7f0000001040), &(0x7f0000001080)='./file0\x00', &(0x7f00000010c0), 0xa00800, &(0x7f0000001100)={'trans=rdma,', {'port', 0x3d, 0x4e20}, 0x2c, {[{@common=@aname={'aname', 0x3d, 'permit_directio'}}, {@sq={'sq', 0x3d, 0xffff}}], [{@fscontext={'fscontext', 0x3d, 'staff_u'}}]}}) 11:43:52 executing program 3: ioctl$SG_SET_FORCE_PACK_ID(0xffffffffffffffff, 0x227b, &(0x7f0000000000)=0x1) ioctl$SG_SET_FORCE_PACK_ID(0xffffffffffffffff, 0x227b, &(0x7f0000000040)) r0 = openat$vcsa(0xffffffffffffff9c, &(0x7f00000000c0), 0x4200, 0x0) ioctl$SCSI_IOCTL_SEND_COMMAND(r0, 0x1, &(0x7f0000000100)={0x17, 0x3, 0x1c00, "af36a59fb168d324fd8eaf833aeb82f60d75e8700d81d9"}) ioctl$SG_SET_TIMEOUT(r0, 0x2201, &(0x7f0000000140)=0x4) ioctl$SG_GET_VERSION_NUM(r0, 0x2282, &(0x7f0000000180)) ioctl$SG_GET_REQUEST_TABLE(r0, 0x2286, &(0x7f00000001c0)) ioctl$SG_GET_TIMEOUT(r0, 0x2202, 0x0) r1 = syz_open_dev$sg(&(0x7f0000000340), 0x7fff, 0x40) ioctl$SG_EMULATED_HOST(r1, 0x2203, &(0x7f0000000380)) r2 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$inet6_tcp_TCP_CONGESTION(r2, 0x6, 0xd, &(0x7f0000000440)='scalable\x00', 0x9) 11:43:52 executing program 2: mmap$IORING_OFF_SQ_RING(&(0x7f0000ffd000/0x1000)=nil, 0x1000, 0x0, 0x10, 0xffffffffffffffff, 0x0) syz_io_uring_submit(0x0, 0x0, 0x0, 0x0) recvfrom$packet(0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0) io_uring_setup(0x0, 0x0) shmget$private(0x0, 0x2000, 0x10, &(0x7f0000ffc000/0x2000)=nil) [ 325.269269] loop1: detected capacity change from 0 to 1 [ 325.276713] loop6: detected capacity change from 0 to 1 [ 325.278109] loop7: detected capacity change from 0 to 1 [ 325.295705] loop4: detected capacity change from 0 to 264192 [ 325.300214] SELinux: security_context_str_to_sid (staff_u) failed with errno=-22 [ 325.320895] loop1: detected capacity change from 0 to 264192 [ 325.334707] nfs4: Unknown parameter '*+\[' 11:43:52 executing program 2: mmap$IORING_OFF_SQ_RING(&(0x7f0000ffd000/0x1000)=nil, 0x1000, 0x0, 0x10, 0xffffffffffffffff, 0x0) syz_io_uring_submit(0x0, 0x0, 0x0, 0x0) recvfrom$packet(0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0) io_uring_setup(0x0, 0x0) shmget$private(0x0, 0x2000, 0x10, &(0x7f0000ffc000/0x2000)=nil) 11:43:52 executing program 5: shmat(0x0, &(0x7f0000ffa000/0x4000)=nil, 0x3000) syz_genetlink_get_family_id$netlbl_mgmt(&(0x7f0000000040), 0xffffffffffffffff) mmap$IORING_OFF_SQ_RING(&(0x7f0000ffd000/0x1000)=nil, 0x1000, 0x2000006, 0x40010, 0xffffffffffffffff, 0x0) io_uring_setup(0x14ab, &(0x7f0000000480)={0x0, 0x5191, 0x20, 0x1, 0x3ba}) 11:43:52 executing program 0: ioprio_set$uid(0x0, 0xee01, 0x4004) syz_io_uring_setup(0x1d4a, &(0x7f0000000440)={0x0, 0xfa85, 0x0, 0x0, 0x285}, &(0x7f0000ffd000/0x1000)=nil, &(0x7f0000ffd000/0x2000)=nil, &(0x7f00000004c0)=0x0, &(0x7f0000000500)) syz_io_uring_submit(r0, 0x0, &(0x7f0000000740)=@IORING_OP_READ=@pass_buffer={0x16, 0x1, 0x2004, @fd_index=0xa, 0x7, &(0x7f0000000640)=""/227, 0xe3, 0xc, 0x1}, 0x9) mount$9p_rdma(&(0x7f0000001040), &(0x7f0000001080)='./file0\x00', &(0x7f00000010c0), 0xa00800, &(0x7f0000001100)={'trans=rdma,', {'port', 0x3d, 0x4e20}, 0x2c, {[{@common=@aname={'aname', 0x3d, 'permit_directio'}}, {@sq={'sq', 0x3d, 0xffff}}], [{@fscontext={'fscontext', 0x3d, 'staff_u'}}]}}) [ 325.362670] SELinux: security_context_str_to_sid (staff_u) failed with errno=-22 [ 325.362734] loop6: detected capacity change from 0 to 264192 11:43:52 executing program 7: syz_mount_image$msdos(&(0x7f0000000000), &(0x7f0000000040)='./file0\x00', 0x200, 0x1, &(0x7f00000000c0)=[{&(0x7f0000000080)="7c74c7bc99e778a0c971e6f50fbdd2b70fa0b038d18c7d5ac685833434d89dce684239293aa5d8b6f11bc5c4a033ad1dc68319fad36a1101aad751fd6f4f10", 0x3f, 0x7f}], 0x42000, &(0x7f0000000100)={[{@dots}], [{@obj_user}, {@dont_appraise}, {@uid_lt}, {@hash}, {@seclabel}]}) syz_io_uring_setup(0x1d4a, &(0x7f0000000440)={0x0, 0xfa85, 0x0, 0x0, 0x285}, &(0x7f0000ffd000/0x1000)=nil, &(0x7f0000ffd000/0x2000)=nil, &(0x7f00000004c0)=0x0, &(0x7f0000000500)) syz_io_uring_submit(r0, 0x0, &(0x7f0000000740)=@IORING_OP_READ=@pass_buffer={0x16, 0x1, 0x2004, @fd_index=0xa, 0x7, &(0x7f0000000640)=""/227, 0xe3, 0xc, 0x1}, 0x9) openat$cgroup_devices(0xffffffffffffffff, &(0x7f00000007c0)='devices.allow\x00', 0x2, 0x0) mount$9p_rdma(&(0x7f0000001040), &(0x7f0000001080)='./file0\x00', &(0x7f00000010c0), 0xa00800, &(0x7f0000001100)={'trans=rdma,', {'port', 0x3d, 0x4e20}, 0x2c, {[{@common=@aname={'aname', 0x3d, 'permit_directio'}}, {@sq={'sq', 0x3d, 0xffff}}], [{@fscontext={'fscontext', 0x3d, 'staff_u'}}]}}) [ 325.386667] nfs4: Unknown parameter '*+\[' [ 325.412012] SELinux: security_context_str_to_sid (staff_u) failed with errno=-22 11:43:52 executing program 4: ioprio_set$uid(0x0, 0xee01, 0x4004) syz_io_uring_setup(0x1d4a, &(0x7f0000000440)={0x0, 0xfa85, 0x0, 0x0, 0x285}, &(0x7f0000ffd000/0x1000)=nil, &(0x7f0000ffd000/0x2000)=nil, &(0x7f00000004c0)=0x0, &(0x7f0000000500)) syz_io_uring_setup(0x3e5e, &(0x7f0000000540)={0x0, 0x5c61, 0x8, 0x2, 0x72}, &(0x7f0000ffd000/0x3000)=nil, &(0x7f0000ffc000/0x3000)=nil, &(0x7f00000005c0), &(0x7f0000000600)=0x0) syz_io_uring_submit(r0, r1, &(0x7f0000000740)=@IORING_OP_READ=@pass_buffer={0x16, 0x1, 0x2004, @fd_index=0xa, 0x7, &(0x7f0000000640)=""/227, 0xe3, 0xc, 0x1}, 0x9) openat$cgroup_devices(0xffffffffffffffff, &(0x7f00000007c0)='devices.allow\x00', 0x2, 0x0) syz_mount_image$nfs4(&(0x7f0000000800), &(0x7f0000000840)='./file0/file0\x00', 0xffffffffffffff01, 0x1, &(0x7f0000000900)=[{&(0x7f0000000880)="f19bd7cfef39dd2070dcb194f7bd90ce305e2a9644b9fb91cc1e75bca69ed6bbdd7636452963af395ea61189cce718ef43420310b6ff8db9f4a606d67217b1aa7bf6e1435682323aef92ef40d036c48fa3fc363c6ad63229bb37cd76a6db9879a39f", 0x62, 0x6}], 0x8400, &(0x7f0000000940)={[{'*+\\['}]}) 11:43:52 executing program 1: syz_mount_image$msdos(&(0x7f0000000000), &(0x7f0000000040)='./file0\x00', 0x200, 0x1, &(0x7f00000000c0)=[{&(0x7f0000000080)="7c74c7bc99e778a0c971e6f50fbdd2b70fa0b038d18c7d5ac685833434d89dce684239293aa5d8b6f11bc5c4a033ad1dc68319fad36a1101aad751fd6f4f10", 0x3f, 0x7f}], 0x42000, &(0x7f0000000100)={[{@dots}], [{@obj_user}, {@dont_appraise}, {@uid_lt}, {@hash}, {@seclabel}]}) syz_io_uring_setup(0x1d4a, &(0x7f0000000440)={0x0, 0xfa85, 0x0, 0x0, 0x285}, &(0x7f0000ffd000/0x1000)=nil, &(0x7f0000ffd000/0x2000)=nil, &(0x7f00000004c0)=0x0, &(0x7f0000000500)) syz_io_uring_setup(0x3e5e, &(0x7f0000000540)={0x0, 0x5c61, 0x8, 0x2, 0x72}, &(0x7f0000ffd000/0x3000)=nil, &(0x7f0000ffc000/0x3000)=nil, &(0x7f00000005c0), &(0x7f0000000600)=0x0) syz_io_uring_submit(r0, r1, &(0x7f0000000740)=@IORING_OP_READ=@pass_buffer={0x16, 0x1, 0x2004, @fd_index=0xa, 0x7, &(0x7f0000000640)=""/227, 0xe3, 0xc, 0x1}, 0x9) openat$cgroup_devices(0xffffffffffffffff, &(0x7f00000007c0)='devices.allow\x00', 0x2, 0x0) syz_mount_image$nfs4(&(0x7f0000000800), &(0x7f0000000840)='./file0/file0\x00', 0xffffffffffffff01, 0x1, &(0x7f0000000900)=[{&(0x7f0000000880)="f19bd7cfef39dd2070dcb194f7bd90ce305e2a9644b9fb91cc1e75bca69ed6bbdd7636452963af395ea61189cce718ef43420310b6ff8db9f4a606d67217b1aa7bf6e1435682323aef92ef40d036c48fa3fc363c6ad63229bb37cd76a6db9879a39f", 0x62, 0x6}], 0x8400, &(0x7f0000000940)={[{'*+\\['}]}) accept(0xffffffffffffffff, 0x0, &(0x7f0000000980)) mount$9p_rdma(&(0x7f0000001040), &(0x7f0000001080)='./file0\x00', &(0x7f00000010c0), 0xa00800, &(0x7f0000001100)={'trans=rdma,', {'port', 0x3d, 0x4e20}, 0x2c, {[{@common=@aname={'aname', 0x3d, 'permit_directio'}}, {@sq={'sq', 0x3d, 0xffff}}], [{@fscontext={'fscontext', 0x3d, 'staff_u'}}]}}) [ 325.508619] loop7: detected capacity change from 0 to 1 11:43:52 executing program 3: ioctl$SG_SET_FORCE_PACK_ID(0xffffffffffffffff, 0x227b, &(0x7f0000000000)=0x1) ioctl$SG_SET_FORCE_PACK_ID(0xffffffffffffffff, 0x227b, &(0x7f0000000040)) r0 = openat$vcsa(0xffffffffffffff9c, &(0x7f00000000c0), 0x4200, 0x0) ioctl$SCSI_IOCTL_SEND_COMMAND(r0, 0x1, &(0x7f0000000100)={0x17, 0x3, 0x1c00, "af36a59fb168d324fd8eaf833aeb82f60d75e8700d81d9"}) ioctl$SG_SET_TIMEOUT(r0, 0x2201, &(0x7f0000000140)=0x4) ioctl$SG_GET_VERSION_NUM(r0, 0x2282, &(0x7f0000000180)) ioctl$SG_GET_REQUEST_TABLE(r0, 0x2286, &(0x7f00000001c0)) ioctl$SG_GET_TIMEOUT(r0, 0x2202, 0x0) r1 = syz_open_dev$sg(&(0x7f0000000340), 0x7fff, 0x40) ioctl$SG_EMULATED_HOST(r1, 0x2203, &(0x7f0000000380)) r2 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$inet6_tcp_TCP_CONGESTION(r2, 0x6, 0xd, &(0x7f0000000440)='scalable\x00', 0x9) [ 325.534132] SELinux: security_context_str_to_sid (staff_u) failed with errno=-22 [ 325.540136] loop4: detected capacity change from 0 to 264192 [ 325.577512] loop1: detected capacity change from 0 to 1 [ 325.616826] loop1: detected capacity change from 0 to 264192 [ 325.629386] nfs4: Unknown parameter '*+\[' [ 325.643003] SELinux: security_context_str_to_sid (staff_u) failed with errno=-22 11:44:01 executing program 3: ioctl$SG_SET_FORCE_PACK_ID(0xffffffffffffffff, 0x227b, &(0x7f0000000000)=0x1) ioctl$SG_SET_FORCE_PACK_ID(0xffffffffffffffff, 0x227b, &(0x7f0000000040)) r0 = openat$vcsa(0xffffffffffffff9c, &(0x7f00000000c0), 0x4200, 0x0) ioctl$SCSI_IOCTL_SEND_COMMAND(r0, 0x1, &(0x7f0000000100)={0x17, 0x3, 0x1c00, "af36a59fb168d324fd8eaf833aeb82f60d75e8700d81d9"}) ioctl$SG_SET_TIMEOUT(r0, 0x2201, &(0x7f0000000140)=0x4) ioctl$SG_GET_VERSION_NUM(r0, 0x2282, &(0x7f0000000180)) ioctl$SG_GET_REQUEST_TABLE(r0, 0x2286, &(0x7f00000001c0)) ioctl$SG_GET_TIMEOUT(r0, 0x2202, 0x0) r1 = syz_open_dev$sg(&(0x7f0000000340), 0x7fff, 0x40) ioctl$SG_EMULATED_HOST(r1, 0x2203, &(0x7f0000000380)) r2 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$inet6_tcp_TCP_CONGESTION(r2, 0x6, 0xd, &(0x7f0000000440)='scalable\x00', 0x9) 11:44:01 executing program 0: ioprio_set$uid(0x0, 0xee01, 0x4004) syz_io_uring_setup(0x1d4a, &(0x7f0000000440)={0x0, 0xfa85, 0x0, 0x0, 0x285}, &(0x7f0000ffd000/0x1000)=nil, &(0x7f0000ffd000/0x2000)=nil, &(0x7f00000004c0), &(0x7f0000000500)) mount$9p_rdma(&(0x7f0000001040), &(0x7f0000001080)='./file0\x00', &(0x7f00000010c0), 0xa00800, &(0x7f0000001100)={'trans=rdma,', {'port', 0x3d, 0x4e20}, 0x2c, {[{@common=@aname={'aname', 0x3d, 'permit_directio'}}, {@sq={'sq', 0x3d, 0xffff}}], [{@fscontext={'fscontext', 0x3d, 'staff_u'}}]}}) 11:44:01 executing program 2: mmap$IORING_OFF_SQ_RING(&(0x7f0000ffd000/0x1000)=nil, 0x1000, 0x0, 0x10, 0xffffffffffffffff, 0x0) syz_io_uring_submit(0x0, 0x0, 0x0, 0x0) recvfrom$packet(0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0) io_uring_setup(0x0, 0x0) 11:44:01 executing program 6: ioprio_set$uid(0x0, 0xee01, 0x4004) syz_mount_image$msdos(0x0, &(0x7f0000000040)='./file0\x00', 0x200, 0x1, &(0x7f00000000c0)=[{&(0x7f0000000080)="7c74c7bc99e778a0c971e6f50fbdd2b70fa0b038d18c7d5ac685833434d89dce684239293aa5d8b6f11bc5c4a033ad1dc68319fad36a1101aad751fd6f4f10", 0x3f, 0x7f}], 0x42000, &(0x7f0000000100)={[{@dots}], [{@obj_user}, {@dont_appraise}, {@uid_lt}, {@hash}, {@seclabel}]}) syz_io_uring_setup(0x1d4a, &(0x7f0000000440)={0x0, 0xfa85, 0x0, 0x0, 0x285}, &(0x7f0000ffd000/0x1000)=nil, &(0x7f0000ffd000/0x2000)=nil, &(0x7f00000004c0)=0x0, &(0x7f0000000500)) syz_io_uring_setup(0x3e5e, &(0x7f0000000540)={0x0, 0x5c61, 0x8, 0x2, 0x72}, &(0x7f0000ffd000/0x3000)=nil, &(0x7f0000ffc000/0x3000)=nil, &(0x7f00000005c0), &(0x7f0000000600)=0x0) syz_io_uring_submit(r0, r1, &(0x7f0000000740)=@IORING_OP_READ=@pass_buffer={0x16, 0x1, 0x2004, @fd_index=0xa, 0x7, &(0x7f0000000640)=""/227, 0xe3, 0xc, 0x1}, 0x9) openat$cgroup_devices(0xffffffffffffffff, &(0x7f00000007c0)='devices.allow\x00', 0x2, 0x0) syz_mount_image$nfs4(&(0x7f0000000800), &(0x7f0000000840)='./file0/file0\x00', 0xffffffffffffff01, 0x1, &(0x7f0000000900)=[{&(0x7f0000000880)="f19bd7cfef39dd2070dcb194f7bd90ce305e2a9644b9fb91cc1e75bca69ed6bbdd7636452963af395ea61189cce718ef43420310b6ff8db9f4a606d67217b1aa7bf6e1435682323aef92ef40d036c48fa3fc363c6ad63229bb37cd76a6db9879a39f", 0x62, 0x6}], 0x8400, &(0x7f0000000940)={[{'*+\\['}]}) accept(0xffffffffffffffff, 0x0, &(0x7f0000000980)) mount$9p_rdma(&(0x7f0000001040), &(0x7f0000001080)='./file0\x00', &(0x7f00000010c0), 0xa00800, &(0x7f0000001100)={'trans=rdma,', {'port', 0x3d, 0x4e20}, 0x2c, {[{@common=@aname={'aname', 0x3d, 'permit_directio'}}, {@sq={'sq', 0x3d, 0xffff}}], [{@fscontext={'fscontext', 0x3d, 'staff_u'}}]}}) 11:44:01 executing program 5: shmat(0x0, &(0x7f0000ffa000/0x4000)=nil, 0x3000) syz_genetlink_get_family_id$netlbl_mgmt(&(0x7f0000000040), 0xffffffffffffffff) mmap$IORING_OFF_SQ_RING(&(0x7f0000ffd000/0x1000)=nil, 0x1000, 0x2000006, 0x40010, 0xffffffffffffffff, 0x0) io_uring_setup(0x14ab, &(0x7f0000000480)={0x0, 0x5191, 0x20, 0x1, 0x3ba}) 11:44:01 executing program 4: ioprio_set$uid(0x0, 0xee01, 0x4004) syz_io_uring_setup(0x1d4a, &(0x7f0000000440)={0x0, 0xfa85, 0x0, 0x0, 0x285}, &(0x7f0000ffd000/0x1000)=nil, &(0x7f0000ffd000/0x2000)=nil, &(0x7f00000004c0)=0x0, &(0x7f0000000500)) syz_io_uring_setup(0x3e5e, &(0x7f0000000540)={0x0, 0x5c61, 0x8, 0x2, 0x72}, &(0x7f0000ffd000/0x3000)=nil, &(0x7f0000ffc000/0x3000)=nil, &(0x7f00000005c0), &(0x7f0000000600)=0x0) syz_io_uring_submit(r0, r1, &(0x7f0000000740)=@IORING_OP_READ=@pass_buffer={0x16, 0x1, 0x2004, @fd_index=0xa, 0x7, &(0x7f0000000640)=""/227, 0xe3, 0xc, 0x1}, 0x9) openat$cgroup_devices(0xffffffffffffffff, &(0x7f00000007c0)='devices.allow\x00', 0x2, 0x0) syz_mount_image$nfs4(&(0x7f0000000800), &(0x7f0000000840)='./file0/file0\x00', 0xffffffffffffff01, 0x1, &(0x7f0000000900)=[{&(0x7f0000000880)="f19bd7cfef39dd2070dcb194f7bd90ce305e2a9644b9fb91cc1e75bca69ed6bbdd7636452963af395ea61189cce718ef43420310b6ff8db9f4a606d67217b1aa7bf6e1435682323aef92ef40d036c48fa3fc363c6ad63229bb37cd76a6db9879a39f", 0x62, 0x6}], 0x8400, &(0x7f0000000940)={[{'*+\\['}]}) 11:44:01 executing program 7: ioprio_set$uid(0x0, 0xee01, 0x0) syz_mount_image$msdos(&(0x7f0000000000), &(0x7f0000000040)='./file0\x00', 0x200, 0x1, &(0x7f00000000c0)=[{&(0x7f0000000080)="7c74c7bc99e778a0c971e6f50fbdd2b70fa0b038d18c7d5ac685833434d89dce684239293aa5d8b6f11bc5c4a033ad1dc68319fad36a1101aad751fd6f4f10", 0x3f, 0x7f}], 0x42000, &(0x7f0000000100)={[{@dots}], [{@obj_user}, {@dont_appraise}, {@uid_lt}, {@hash}, {@seclabel}]}) syz_io_uring_setup(0x1d4a, &(0x7f0000000440)={0x0, 0xfa85, 0x0, 0x0, 0x285}, &(0x7f0000ffd000/0x1000)=nil, &(0x7f0000ffd000/0x2000)=nil, &(0x7f00000004c0)=0x0, &(0x7f0000000500)) syz_io_uring_submit(r0, 0x0, &(0x7f0000000740)=@IORING_OP_READ=@pass_buffer={0x16, 0x1, 0x2004, @fd_index=0xa, 0x7, &(0x7f0000000640)=""/227, 0xe3, 0xc, 0x1}, 0x9) openat$cgroup_devices(0xffffffffffffffff, &(0x7f00000007c0)='devices.allow\x00', 0x2, 0x0) mount$9p_rdma(&(0x7f0000001040), &(0x7f0000001080)='./file0\x00', &(0x7f00000010c0), 0xa00800, &(0x7f0000001100)={'trans=rdma,', {'port', 0x3d, 0x4e20}, 0x2c, {[{@common=@aname={'aname', 0x3d, 'permit_directio'}}, {@sq={'sq', 0x3d, 0xffff}}], [{@fscontext={'fscontext', 0x3d, 'staff_u'}}]}}) 11:44:01 executing program 1: syz_mount_image$msdos(&(0x7f0000000000), &(0x7f0000000040)='./file0\x00', 0x200, 0x1, &(0x7f00000000c0)=[{&(0x7f0000000080)="7c74c7bc99e778a0c971e6f50fbdd2b70fa0b038d18c7d5ac685833434d89dce684239293aa5d8b6f11bc5c4a033ad1dc68319fad36a1101aad751fd6f4f10", 0x3f, 0x7f}], 0x42000, &(0x7f0000000100)={[{@dots}], [{@obj_user}, {@dont_appraise}, {@uid_lt}, {@hash}, {@seclabel}]}) syz_io_uring_setup(0x1d4a, &(0x7f0000000440)={0x0, 0xfa85, 0x0, 0x0, 0x285}, &(0x7f0000ffd000/0x1000)=nil, &(0x7f0000ffd000/0x2000)=nil, &(0x7f00000004c0)=0x0, &(0x7f0000000500)) syz_io_uring_setup(0x3e5e, &(0x7f0000000540)={0x0, 0x5c61, 0x8, 0x2, 0x72}, &(0x7f0000ffd000/0x3000)=nil, &(0x7f0000ffc000/0x3000)=nil, &(0x7f00000005c0), &(0x7f0000000600)=0x0) syz_io_uring_submit(r0, r1, &(0x7f0000000740)=@IORING_OP_READ=@pass_buffer={0x16, 0x1, 0x2004, @fd_index=0xa, 0x7, &(0x7f0000000640)=""/227, 0xe3, 0xc, 0x1}, 0x9) openat$cgroup_devices(0xffffffffffffffff, &(0x7f00000007c0)='devices.allow\x00', 0x2, 0x0) syz_mount_image$nfs4(&(0x7f0000000800), &(0x7f0000000840)='./file0/file0\x00', 0xffffffffffffff01, 0x1, &(0x7f0000000900)=[{&(0x7f0000000880)="f19bd7cfef39dd2070dcb194f7bd90ce305e2a9644b9fb91cc1e75bca69ed6bbdd7636452963af395ea61189cce718ef43420310b6ff8db9f4a606d67217b1aa7bf6e1435682323aef92ef40d036c48fa3fc363c6ad63229bb37cd76a6db9879a39f", 0x62, 0x6}], 0x8400, &(0x7f0000000940)={[{'*+\\['}]}) accept(0xffffffffffffffff, 0x0, &(0x7f0000000980)) [ 334.118760] loop7: detected capacity change from 0 to 1 [ 334.120270] loop6: detected capacity change from 0 to 1 [ 334.137709] loop1: detected capacity change from 0 to 1 [ 334.141859] SELinux: security_context_str_to_sid (staff_u) failed with errno=-22 [ 334.146917] loop4: detected capacity change from 0 to 264192 [ 334.148391] SELinux: security_context_str_to_sid (staff_u) failed with errno=-22 [ 334.171593] loop1: detected capacity change from 0 to 264192 [ 334.182617] nfs4: Unknown parameter '*+\[' 11:44:01 executing program 0: ioprio_set$uid(0x0, 0xee01, 0x4004) mount$9p_rdma(&(0x7f0000001040), &(0x7f0000001080)='./file0\x00', &(0x7f00000010c0), 0xa00800, &(0x7f0000001100)={'trans=rdma,', {'port', 0x3d, 0x4e20}, 0x2c, {[{@common=@aname={'aname', 0x3d, 'permit_directio'}}, {@sq={'sq', 0x3d, 0xffff}}], [{@fscontext={'fscontext', 0x3d, 'staff_u'}}]}}) 11:44:01 executing program 6: ioprio_set$uid(0x0, 0xee01, 0x4004) syz_mount_image$msdos(0x0, &(0x7f0000000040)='./file0\x00', 0x200, 0x1, &(0x7f00000000c0)=[{&(0x7f0000000080)="7c74c7bc99e778a0c971e6f50fbdd2b70fa0b038d18c7d5ac685833434d89dce684239293aa5d8b6f11bc5c4a033ad1dc68319fad36a1101aad751fd6f4f10", 0x3f, 0x7f}], 0x42000, &(0x7f0000000100)={[{@dots}], [{@obj_user}, {@dont_appraise}, {@uid_lt}, {@hash}, {@seclabel}]}) syz_io_uring_setup(0x1d4a, &(0x7f0000000440)={0x0, 0xfa85, 0x0, 0x0, 0x285}, &(0x7f0000ffd000/0x1000)=nil, &(0x7f0000ffd000/0x2000)=nil, &(0x7f00000004c0)=0x0, &(0x7f0000000500)) syz_io_uring_setup(0x3e5e, &(0x7f0000000540)={0x0, 0x5c61, 0x8, 0x2, 0x72}, &(0x7f0000ffd000/0x3000)=nil, &(0x7f0000ffc000/0x3000)=nil, &(0x7f00000005c0), &(0x7f0000000600)=0x0) syz_io_uring_submit(r0, r1, &(0x7f0000000740)=@IORING_OP_READ=@pass_buffer={0x16, 0x1, 0x2004, @fd_index=0xa, 0x7, &(0x7f0000000640)=""/227, 0xe3, 0xc, 0x1}, 0x9) openat$cgroup_devices(0xffffffffffffffff, &(0x7f00000007c0)='devices.allow\x00', 0x2, 0x0) syz_mount_image$nfs4(&(0x7f0000000800), &(0x7f0000000840)='./file0/file0\x00', 0xffffffffffffff01, 0x1, &(0x7f0000000900)=[{&(0x7f0000000880)="f19bd7cfef39dd2070dcb194f7bd90ce305e2a9644b9fb91cc1e75bca69ed6bbdd7636452963af395ea61189cce718ef43420310b6ff8db9f4a606d67217b1aa7bf6e1435682323aef92ef40d036c48fa3fc363c6ad63229bb37cd76a6db9879a39f", 0x62, 0x6}], 0x8400, &(0x7f0000000940)={[{'*+\\['}]}) accept(0xffffffffffffffff, 0x0, &(0x7f0000000980)) mount$9p_rdma(&(0x7f0000001040), &(0x7f0000001080)='./file0\x00', &(0x7f00000010c0), 0xa00800, &(0x7f0000001100)={'trans=rdma,', {'port', 0x3d, 0x4e20}, 0x2c, {[{@common=@aname={'aname', 0x3d, 'permit_directio'}}, {@sq={'sq', 0x3d, 0xffff}}], [{@fscontext={'fscontext', 0x3d, 'staff_u'}}]}}) 11:44:01 executing program 5: r0 = shmget(0x2, 0x3000, 0x0, &(0x7f0000ffb000/0x3000)=nil) shmat(r0, &(0x7f0000ffa000/0x4000)=nil, 0x3000) syz_genetlink_get_family_id$netlbl_mgmt(&(0x7f0000000040), 0xffffffffffffffff) mmap$IORING_OFF_SQ_RING(&(0x7f0000ffd000/0x1000)=nil, 0x1000, 0x2000006, 0x40010, 0xffffffffffffffff, 0x0) io_uring_setup(0x14ab, &(0x7f0000000480)={0x0, 0x5191, 0x20, 0x1, 0x3ba}) 11:44:01 executing program 7: ioprio_set$uid(0x0, 0xee01, 0x0) syz_mount_image$msdos(0x0, &(0x7f0000000040)='./file0\x00', 0x200, 0x1, &(0x7f00000000c0)=[{&(0x7f0000000080)="7c74c7bc99e778a0c971e6f50fbdd2b70fa0b038d18c7d5ac685833434d89dce684239293aa5d8b6f11bc5c4a033ad1dc68319fad36a1101aad751fd6f4f10", 0x3f, 0x7f}], 0x42000, &(0x7f0000000100)={[{@dots}], [{@obj_user}, {@dont_appraise}, {@uid_lt}, {@hash}, {@seclabel}]}) syz_io_uring_setup(0x1d4a, &(0x7f0000000440)={0x0, 0xfa85, 0x0, 0x0, 0x285}, &(0x7f0000ffd000/0x1000)=nil, &(0x7f0000ffd000/0x2000)=nil, &(0x7f00000004c0)=0x0, &(0x7f0000000500)) syz_io_uring_submit(r0, 0x0, &(0x7f0000000740)=@IORING_OP_READ=@pass_buffer={0x16, 0x1, 0x2004, @fd_index=0xa, 0x7, &(0x7f0000000640)=""/227, 0xe3, 0xc, 0x1}, 0x9) openat$cgroup_devices(0xffffffffffffffff, &(0x7f00000007c0)='devices.allow\x00', 0x2, 0x0) mount$9p_rdma(&(0x7f0000001040), &(0x7f0000001080)='./file0\x00', &(0x7f00000010c0), 0xa00800, &(0x7f0000001100)={'trans=rdma,', {'port', 0x3d, 0x4e20}, 0x2c, {[{@common=@aname={'aname', 0x3d, 'permit_directio'}}, {@sq={'sq', 0x3d, 0xffff}}], [{@fscontext={'fscontext', 0x3d, 'staff_u'}}]}}) [ 334.275177] [ 334.275491] ===================================== [ 334.276175] WARNING: bad unlock balance detected! [ 334.276895] 6.19.0-rc5-next-20260116 #1 Not tainted [ 334.277611] ------------------------------------- [ 334.278290] syz-executor.0/5126 is trying to release lock (rcu_read_lock) at: [ 334.279338] [] __wait_on_freeing_inode+0x105/0x350 [ 334.280275] but there are no more locks to release! [ 334.280996] [ 334.280996] other info that might help us debug this: [ 334.282250] 4 locks held by syz-executor.0/5126: [ 334.288743] #0: ffff88800f6f43f8 (sb_writers#3){.+.+}-{0:0}, at: filename_create+0xf7/0x400 [ 334.290029] #1: ffff8880284cc698 (&type->i_mutex_dir_key#3/1){+.+.}-{4:4}, at: filename_create+0x1b1/0x400 [ 334.291480] #2: ffff88800f6d8950 (jbd2_handle){++++}-{0:0}, at: start_this_handle+0xe32/0x12d0 [ 334.292786] #3: ffffffff85c16898 (inode_hash_lock){+.+.}-{3:3}, at: insert_inode_locked+0xf9/0x890 [ 334.294118] [ 334.294118] stack backtrace: [ 334.294773] CPU: 1 UID: 0 PID: 5126 Comm: syz-executor.0 Not tainted 6.19.0-rc5-next-20260116 #1 PREEMPT(lazy) [ 334.294799] Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.12.0-1 04/01/2014 [ 334.294812] Call Trace: [ 334.294820] [ 334.294828] dump_stack_lvl+0xca/0x120 [ 334.294865] ? __wait_on_freeing_inode+0x105/0x350 [ 334.294891] print_unlock_imbalance_bug+0x118/0x130 [ 334.294917] ? __wait_on_freeing_inode+0x105/0x350 [ 334.294943] lock_release+0x1ee/0x270 [ 334.294970] __wait_on_freeing_inode+0x10a/0x350 [ 334.294997] ? __pfx___wait_on_freeing_inode+0x10/0x10 [ 334.295025] ? __pfx_var_wake_function+0x10/0x10 [ 334.295056] ? lock_is_held_type+0x9e/0x120 [ 334.295076] insert_inode_locked+0x25f/0x890 [ 334.295107] __ext4_new_inode+0x223d/0x4cd0 [ 334.295137] ? __pfx___ext4_new_inode+0x10/0x10 [ 334.295163] ? __pfx___dquot_initialize+0x10/0x10 [ 334.295195] ? __pfx_avc_has_perm+0x10/0x10 [ 334.295223] ext4_symlink+0x623/0xb40 [ 334.295256] ? __pfx_ext4_symlink+0x10/0x10 [ 334.295285] ? security_inode_permission+0x72/0xe0 [ 334.295309] vfs_symlink+0x44b/0x840 [ 334.295338] filename_symlinkat+0x158/0x440 [ 334.295364] ? __pfx_filename_symlinkat+0x10/0x10 [ 334.295389] ? strncpy_from_user+0x21b/0x2f0 [ 334.295418] __x64_sys_symlink+0x82/0x110 [ 334.295442] do_syscall_64+0xbf/0x420 [ 334.295465] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 334.295488] RIP: 0033:0x7f547ddef427 [ 334.295504] Code: 73 01 c3 48 c7 c1 bc ff ff ff f7 d8 64 89 01 48 83 c8 ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 b8 58 00 00 00 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 bc ff ff ff f7 d8 64 89 01 48 [ 334.295523] RSP: 002b:00007ffea4a55958 EFLAGS: 00000202 ORIG_RAX: 0000000000000058 [ 334.295543] RAX: ffffffffffffffda RBX: 0000000000000000 RCX: 00007f547ddef427 [ 334.295556] RDX: 00007ffea4a55a37 RSI: 00007f547de4a019 RDI: 00007ffea4a55a20 [ 334.295570] RBP: 0000000000000000 R08: 0000000000000000 R09: 00007ffea4a557f0 [ 334.295583] R10: 00007ffea4a556a7 R11: 0000000000000202 R12: 0000000000000001 [ 334.295595] R13: 0000000000000000 R14: 0000000000000001 R15: 00007ffea4a55a20 [ 334.295614] [ 334.325359] ------------[ cut here ]------------ [ 334.326051] WARNING: kernel/rcu/tree_plugin.h:443 at __rcu_read_unlock+0x25f/0x5c0, CPU#1: syz-executor.0/5126 [ 334.327591] Modules linked in: [ 334.328112] CPU: 1 UID: 0 PID: 5126 Comm: syz-executor.0 Not tainted 6.19.0-rc5-next-20260116 #1 PREEMPT(lazy) [ 334.329542] Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.12.0-1 04/01/2014 [ 334.330702] RIP: 0010:__rcu_read_unlock+0x25f/0x5c0 [ 334.331530] Code: f2 02 00 00 c7 43 58 01 00 00 00 bf 09 00 00 00 e8 d6 b7 de ff 4d 85 f6 0f 84 73 fe ff ff e8 38 8a 20 00 fb e9 68 fe ff ff 90 <0f> 0b 90 5b 5d 41 5c 41 5d 41 5e e9 81 4d 74 03 e8 2c 5d 56 00 e9 [ 334.334104] RSP: 0018:ffff88806cf08cb8 EFLAGS: 00010086 [ 334.334862] RAX: 00000000ffffffff RBX: ffff8880166b1b80 RCX: ffffffff81893bc4 [ 334.335876] RDX: 0000000000000000 RSI: ffffffff81893bdb RDI: ffff8880166b1f7c [ 334.336896] RBP: ffff8880166b1b80 R08: 0000000000000000 R09: 0000000000000000 [ 334.337906] R10: 0000000000000000 R11: 000000000000018a R12: ffff8880166b1b80 [ 334.338915] R13: 0000000000000001 R14: ffff88806cf379c0 R15: ffff88806cf37a20 [ 334.339926] FS: 000055555656d400(0000) GS:ffff8880e5442000(0000) knlGS:0000000000000000 [ 334.341071] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 334.341912] CR2: 00007f547de6f540 CR3: 000000000a42d000 CR4: 0000000000350ef0 [ 334.342925] Call Trace: [ 334.343353] [ 334.344499] sched_tick+0x232/0x6e0 [ 334.346837] update_process_times+0x116/0x210 [ 334.348664] tick_nohz_handler+0x4ff/0x8c0 [ 334.350263] ? __pfx_tick_nohz_handler+0x10/0x10 [ 334.351220] ? enqueue_task_fair+0x45e/0x20a0 [ 334.352156] ? lock_release+0x1c7/0x270 [ 334.353674] ? __pfx_tick_nohz_handler+0x10/0x10 [ 334.355282] __hrtimer_run_queues+0x654/0xbb0 [ 334.358900] ? __pfx___hrtimer_run_queues+0x10/0x10 [ 334.359751] ? ktime_get_update_offsets_now+0x252/0x3c0 [ 334.362922] hrtimer_interrupt+0x369/0x830 [ 334.366807] __sysvec_apic_timer_interrupt+0xbb/0x300 [ 334.368209] sysvec_apic_timer_interrupt+0x6b/0x80 [ 334.369269] [ 334.369606] [ 334.370260] asm_sysvec_apic_timer_interrupt+0x1a/0x20 [ 334.371182] RIP: 0010:__sanitizer_cov_trace_pc+0x8/0x80 [ 334.372060] Code: 5c 03 48 c7 c0 f4 ff ff ff eb 92 0f 1f 80 00 00 00 00 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 f3 0f 1e fa 48 8b 34 24 <65> 48 8b 15 a8 5d 38 06 65 8b 05 b9 5d 38 06 a9 00 01 ff 00 74 27 [ 334.374630] RSP: 0018:ffff8880473cf748 EFLAGS: 00000287 [ 334.375398] RAX: 0000000000000000 RBX: ffffffff866811c0 RCX: ffffffff84c54bdf [ 334.376425] RDX: ffff8880166b1b80 RSI: ffffffff84c54bad RDI: 0000000000000006 [ 334.377484] RBP: ffffffff84d15d75 R08: 0000000000000000 R09: 0000000000000000 [ 334.378537] R10: ffffffff84d15d75 R11: 0000000000000000 R12: ffffffff815d742f [ 334.379568] R13: dffffc0000000000 R14: 0000000000000002 R15: 000000000000000b [ 334.381114] ? __rcu_read_unlock+0x25f/0x5c0 [ 334.381894] ? task_blocks_on_rt_mutex.constprop.0.isra.0+0x12e5/0x1f40 [ 334.383320] ? task_blocks_on_rt_mutex.constprop.0.isra.0+0x12e5/0x1f40 [ 334.384912] ? __report_bug+0x4cf/0x5b0 [ 334.385793] ? __report_bug+0x49d/0x5b0 [ 334.387559] ? __rcu_read_unlock+0x25f/0x5c0 [ 334.388339] __report_bug+0x49d/0x5b0 [ 334.389754] ? _printk+0xbe/0xf0 [ 334.390709] ? __pfx___report_bug+0x10/0x10 [ 334.393275] ? __is_insn_slot_addr+0x140/0x290 [ 334.394717] ? __is_insn_slot_addr+0x11b/0x290 [ 334.396493] ? __rcu_read_unlock+0x25f/0x5c0 [ 334.397733] report_bug+0x7c/0x120 [ 334.398591] ? __rcu_read_unlock+0x25f/0x5c0 [ 334.399525] handle_bug+0x2e8/0x4f0 [ 334.400390] ? trace_hardirqs_off_finish+0xe3/0x110 [ 334.402222] exc_invalid_op+0x35/0x80 [ 334.403434] asm_exc_invalid_op+0x1a/0x20 [ 334.404195] RIP: 0010:__rcu_read_unlock+0x25f/0x5c0 [ 334.405040] Code: f2 02 00 00 c7 43 58 01 00 00 00 bf 09 00 00 00 e8 d6 b7 de ff 4d 85 f6 0f 84 73 fe ff ff e8 38 8a 20 00 fb e9 68 fe ff ff 90 <0f> 0b 90 5b 5d 41 5c 41 5d 41 5e e9 81 4d 74 03 e8 2c 5d 56 00 e9 [ 334.407619] RSP: 0018:ffff8880473cf9a0 EFLAGS: 00010286 [ 334.408383] RAX: 00000000ffffffff RBX: ffff8880166b1b80 RCX: ffffffff815660f7 [ 334.409408] RDX: 0000000000000000 RSI: ffffffff81566100 RDI: ffff8880166b1f7c [ 334.410435] RBP: ffff8880166b1b80 R08: 0000000000000000 R09: fffffbfff0ba7040 [ 334.411454] R10: 0000000000000000 R11: 0000000000000001 R12: ffff8880166b1b80 [ 334.412492] R13: 0000000000000001 R14: ffffffff85c0fef0 R15: ffff88801c983c48 [ 334.415298] ? nbcon_cpu_emergency_exit+0x117/0x1c0 [ 334.416292] ? nbcon_cpu_emergency_exit+0x120/0x1c0 [ 334.418987] __wait_on_freeing_inode+0x10f/0x350 [ 334.420170] ? __pfx___wait_on_freeing_inode+0x10/0x10 [ 334.422027] ? __pfx_var_wake_function+0x10/0x10 [ 334.424132] ? lock_is_held_type+0x9e/0x120 [ 334.426011] insert_inode_locked+0x25f/0x890 [ 334.428794] __ext4_new_inode+0x223d/0x4cd0 [ 334.433026] ? __pfx___ext4_new_inode+0x10/0x10 [ 334.435120] ? __pfx___dquot_initialize+0x10/0x10 [ 334.436427] ? __pfx_avc_has_perm+0x10/0x10 [ 334.439459] ext4_symlink+0x623/0xb40 [ 334.443296] ? __pfx_ext4_symlink+0x10/0x10 [ 334.445027] ? security_inode_permission+0x72/0xe0 [ 334.447805] vfs_symlink+0x44b/0x840 [ 334.450005] filename_symlinkat+0x158/0x440 [ 334.451941] ? __pfx_filename_symlinkat+0x10/0x10 [ 334.453252] ? strncpy_from_user+0x21b/0x2f0 [ 334.456460] __x64_sys_symlink+0x82/0x110 [ 334.457726] do_syscall_64+0xbf/0x420 [ 334.459105] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 334.460014] RIP: 0033:0x7f547ddef427 [ 334.460672] Code: 73 01 c3 48 c7 c1 bc ff ff ff f7 d8 64 89 01 48 83 c8 ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 b8 58 00 00 00 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 bc ff ff ff f7 d8 64 89 01 48 [ 334.463243] RSP: 002b:00007ffea4a55958 EFLAGS: 00000202 ORIG_RAX: 0000000000000058 [ 334.464339] RAX: ffffffffffffffda RBX: 0000000000000000 RCX: 00007f547ddef427 [ 334.465392] RDX: 00007ffea4a55a37 RSI: 00007f547de4a019 RDI: 00007ffea4a55a20 [ 334.466419] RBP: 0000000000000000 R08: 0000000000000000 R09: 00007ffea4a557f0 [ 334.467450] R10: 00007ffea4a556a7 R11: 0000000000000202 R12: 0000000000000001 [ 334.468462] R13: 0000000000000000 R14: 0000000000000001 R15: 00007ffea4a55a20 [ 334.472948] [ 334.473296] irq event stamp: 183 [ 334.473789] hardirqs last enabled at (183): [] irqentry_exit+0x17b/0x650 [ 334.475111] hardirqs last disabled at (182): [] sysvec_apic_timer_interrupt+0xf/0x80 [ 334.476563] softirqs last enabled at (176): [] kernel_fpu_end+0x59/0x70 [ 334.477855] softirqs last disabled at (174): [] kernel_fpu_begin_mask+0x1bb/0x300 [ 334.479298] ---[ end trace 0000000000000000 ]--- [ 334.502264] loop6: detected capacity change from 0 to 1 [ 334.508829] SELinux: security_context_str_to_sid (staff_u) failed with errno=-22 11:44:01 executing program 2: mmap$IORING_OFF_SQ_RING(&(0x7f0000ffd000/0x1000)=nil, 0x1000, 0x0, 0x10, 0xffffffffffffffff, 0x0) syz_io_uring_submit(0x0, 0x0, 0x0, 0x0) io_uring_setup(0x0, 0x0) 11:44:01 executing program 4: ioprio_set$uid(0x0, 0xee01, 0x4004) syz_io_uring_setup(0x1d4a, &(0x7f0000000440)={0x0, 0xfa85, 0x0, 0x0, 0x285}, &(0x7f0000ffd000/0x1000)=nil, &(0x7f0000ffd000/0x2000)=nil, &(0x7f00000004c0)=0x0, &(0x7f0000000500)) syz_io_uring_setup(0x3e5e, &(0x7f0000000540)={0x0, 0x5c61, 0x8, 0x2, 0x72}, &(0x7f0000ffd000/0x3000)=nil, &(0x7f0000ffc000/0x3000)=nil, &(0x7f00000005c0), &(0x7f0000000600)=0x0) syz_io_uring_submit(r0, r1, &(0x7f0000000740)=@IORING_OP_READ=@pass_buffer={0x16, 0x1, 0x2004, @fd_index=0xa, 0x7, &(0x7f0000000640)=""/227, 0xe3, 0xc, 0x1}, 0x9) openat$cgroup_devices(0xffffffffffffffff, &(0x7f00000007c0)='devices.allow\x00', 0x2, 0x0) syz_mount_image$nfs4(&(0x7f0000000800), &(0x7f0000000840)='./file0/file0\x00', 0xffffffffffffff01, 0x1, &(0x7f0000000900)=[{&(0x7f0000000880)="f19bd7cfef39dd2070dcb194f7bd90ce305e2a9644b9fb91cc1e75bca69ed6bbdd7636452963af395ea61189cce718ef43420310b6ff8db9f4a606d67217b1aa7bf6e1435682323aef92ef40d036c48fa3fc363c6ad63229bb37cd76a6db9879a39f", 0x62, 0x6}], 0x8400, &(0x7f0000000940)={[{'*+\\['}]}) 11:44:01 executing program 3: ioctl$SG_SET_FORCE_PACK_ID(0xffffffffffffffff, 0x227b, &(0x7f0000000000)=0x1) ioctl$SG_GET_RESERVED_SIZE(0xffffffffffffffff, 0x2272, &(0x7f0000000080)) r0 = openat$vcsa(0xffffffffffffff9c, &(0x7f00000000c0), 0x4200, 0x0) ioctl$SCSI_IOCTL_SEND_COMMAND(r0, 0x1, &(0x7f0000000100)={0x17, 0x3, 0x1c00, "af36a59fb168d324fd8eaf833aeb82f60d75e8700d81d9"}) ioctl$SG_SET_TIMEOUT(r0, 0x2201, &(0x7f0000000140)=0x4) ioctl$SG_GET_VERSION_NUM(r0, 0x2282, &(0x7f0000000180)) ioctl$SG_GET_REQUEST_TABLE(r0, 0x2286, &(0x7f00000001c0)) ioctl$SG_GET_TIMEOUT(r0, 0x2202, 0x0) r1 = syz_open_dev$sg(&(0x7f0000000340), 0x7fff, 0x40) ioctl$SG_EMULATED_HOST(r1, 0x2203, &(0x7f0000000380)) r2 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$inet6_tcp_TCP_CONGESTION(r2, 0x6, 0xd, &(0x7f0000000440)='scalable\x00', 0x9) 11:44:01 executing program 1: syz_mount_image$msdos(&(0x7f0000000000), &(0x7f0000000040)='./file0\x00', 0x200, 0x1, &(0x7f00000000c0)=[{&(0x7f0000000080)="7c74c7bc99e778a0c971e6f50fbdd2b70fa0b038d18c7d5ac685833434d89dce684239293aa5d8b6f11bc5c4a033ad1dc68319fad36a1101aad751fd6f4f10", 0x3f, 0x7f}], 0x42000, &(0x7f0000000100)={[{@dots}], [{@obj_user}, {@dont_appraise}, {@uid_lt}, {@hash}, {@seclabel}]}) syz_io_uring_setup(0x1d4a, &(0x7f0000000440)={0x0, 0xfa85, 0x0, 0x0, 0x285}, &(0x7f0000ffd000/0x1000)=nil, &(0x7f0000ffd000/0x2000)=nil, &(0x7f00000004c0)=0x0, &(0x7f0000000500)) syz_io_uring_setup(0x3e5e, &(0x7f0000000540)={0x0, 0x5c61, 0x8, 0x2, 0x72}, &(0x7f0000ffd000/0x3000)=nil, &(0x7f0000ffc000/0x3000)=nil, &(0x7f00000005c0), &(0x7f0000000600)=0x0) syz_io_uring_submit(r0, r1, &(0x7f0000000740)=@IORING_OP_READ=@pass_buffer={0x16, 0x1, 0x2004, @fd_index=0xa, 0x7, &(0x7f0000000640)=""/227, 0xe3, 0xc, 0x1}, 0x9) openat$cgroup_devices(0xffffffffffffffff, &(0x7f00000007c0)='devices.allow\x00', 0x2, 0x0) syz_mount_image$nfs4(&(0x7f0000000800), &(0x7f0000000840)='./file0/file0\x00', 0xffffffffffffff01, 0x1, &(0x7f0000000900)=[{&(0x7f0000000880)="f19bd7cfef39dd2070dcb194f7bd90ce305e2a9644b9fb91cc1e75bca69ed6bbdd7636452963af395ea61189cce718ef43420310b6ff8db9f4a606d67217b1aa7bf6e1435682323aef92ef40d036c48fa3fc363c6ad63229bb37cd76a6db9879a39f", 0x62, 0x6}], 0x8400, &(0x7f0000000940)={[{'*+\\['}]}) [ 334.612253] loop7: detected capacity change from 0 to 1 [ 334.627538] SELinux: security_context_str_to_sid (staff_u) failed with errno=-22 [ 334.634595] loop1: detected capacity change from 0 to 1 11:44:01 executing program 2: mmap$IORING_OFF_SQ_RING(&(0x7f0000ffd000/0x1000)=nil, 0x1000, 0x0, 0x10, 0xffffffffffffffff, 0x0) syz_io_uring_submit(0x0, 0x0, 0x0, 0x0) io_uring_setup(0x0, 0x0) 11:44:01 executing program 6: ioprio_set$uid(0x0, 0xee01, 0x4004) syz_mount_image$msdos(0x0, &(0x7f0000000040)='./file0\x00', 0x200, 0x1, &(0x7f00000000c0)=[{&(0x7f0000000080)="7c74c7bc99e778a0c971e6f50fbdd2b70fa0b038d18c7d5ac685833434d89dce684239293aa5d8b6f11bc5c4a033ad1dc68319fad36a1101aad751fd6f4f10", 0x3f, 0x7f}], 0x42000, &(0x7f0000000100)={[{@dots}], [{@obj_user}, {@dont_appraise}, {@uid_lt}, {@hash}, {@seclabel}]}) syz_io_uring_setup(0x1d4a, &(0x7f0000000440)={0x0, 0xfa85, 0x0, 0x0, 0x285}, &(0x7f0000ffd000/0x1000)=nil, &(0x7f0000ffd000/0x2000)=nil, &(0x7f00000004c0)=0x0, &(0x7f0000000500)) syz_io_uring_setup(0x3e5e, &(0x7f0000000540)={0x0, 0x5c61, 0x8, 0x2, 0x72}, &(0x7f0000ffd000/0x3000)=nil, &(0x7f0000ffc000/0x3000)=nil, &(0x7f00000005c0), &(0x7f0000000600)=0x0) syz_io_uring_submit(r0, r1, &(0x7f0000000740)=@IORING_OP_READ=@pass_buffer={0x16, 0x1, 0x2004, @fd_index=0xa, 0x7, &(0x7f0000000640)=""/227, 0xe3, 0xc, 0x1}, 0x9) openat$cgroup_devices(0xffffffffffffffff, &(0x7f00000007c0)='devices.allow\x00', 0x2, 0x0) syz_mount_image$nfs4(&(0x7f0000000800), &(0x7f0000000840)='./file0/file0\x00', 0xffffffffffffff01, 0x1, &(0x7f0000000900)=[{&(0x7f0000000880)="f19bd7cfef39dd2070dcb194f7bd90ce305e2a9644b9fb91cc1e75bca69ed6bbdd7636452963af395ea61189cce718ef43420310b6ff8db9f4a606d67217b1aa7bf6e1435682323aef92ef40d036c48fa3fc363c6ad63229bb37cd76a6db9879a39f", 0x62, 0x6}], 0x8400, &(0x7f0000000940)={[{'*+\\['}]}) accept(0xffffffffffffffff, 0x0, &(0x7f0000000980)) mount$9p_rdma(&(0x7f0000001040), &(0x7f0000001080)='./file0\x00', &(0x7f00000010c0), 0xa00800, &(0x7f0000001100)={'trans=rdma,', {'port', 0x3d, 0x4e20}, 0x2c, {[{@common=@aname={'aname', 0x3d, 'permit_directio'}}, {@sq={'sq', 0x3d, 0xffff}}], [{@fscontext={'fscontext', 0x3d, 'staff_u'}}]}}) [ 334.643714] loop4: detected capacity change from 0 to 264192 [ 334.652134] loop1: detected capacity change from 0 to 264192 [ 334.657347] nfs4: Unknown parameter '*+\[' [ 334.701016] SELinux: security_context_str_to_sid (staff_u) failed with errno=-22 11:44:01 executing program 5: r0 = shmget(0x2, 0x3000, 0x0, &(0x7f0000ffb000/0x3000)=nil) shmat(r0, &(0x7f0000ffa000/0x4000)=nil, 0x3000) syz_genetlink_get_family_id$netlbl_mgmt(&(0x7f0000000040), 0xffffffffffffffff) mmap$IORING_OFF_SQ_RING(&(0x7f0000ffd000/0x1000)=nil, 0x1000, 0x2000006, 0x40010, 0xffffffffffffffff, 0x0) io_uring_setup(0x14ab, &(0x7f0000000480)={0x0, 0x5191, 0x20, 0x1, 0x3ba}) 11:44:08 executing program 0: ioprio_set$uid(0x0, 0xee01, 0x4004) mount$9p_rdma(&(0x7f0000001040), &(0x7f0000001080)='./file0\x00', &(0x7f00000010c0), 0xa00800, &(0x7f0000001100)={'trans=rdma,', {'port', 0x3d, 0x4e20}, 0x2c, {[{@common=@aname={'aname', 0x3d, 'permit_directio'}}, {@sq={'sq', 0x3d, 0xffff}}], [{@fscontext={'fscontext', 0x3d, 'staff_u'}}]}}) 11:44:08 executing program 5: r0 = shmget(0x2, 0x3000, 0x0, &(0x7f0000ffb000/0x3000)=nil) shmat(r0, &(0x7f0000ffa000/0x4000)=nil, 0x3000) syz_genetlink_get_family_id$netlbl_mgmt(&(0x7f0000000040), 0xffffffffffffffff) mmap$IORING_OFF_SQ_RING(&(0x7f0000ffd000/0x1000)=nil, 0x1000, 0x2000006, 0x40010, 0xffffffffffffffff, 0x0) io_uring_setup(0x14ab, &(0x7f0000000480)={0x0, 0x5191, 0x20, 0x1, 0x3ba}) 11:44:08 executing program 6: ioprio_set$uid(0x0, 0xee01, 0x4004) syz_mount_image$msdos(&(0x7f0000000000), 0x0, 0x200, 0x1, &(0x7f00000000c0)=[{&(0x7f0000000080)="7c74c7bc99e778a0c971e6f50fbdd2b70fa0b038d18c7d5ac685833434d89dce684239293aa5d8b6f11bc5c4a033ad1dc68319fad36a1101aad751fd6f4f10", 0x3f, 0x7f}], 0x42000, &(0x7f0000000100)={[{@dots}], [{@obj_user}, {@dont_appraise}, {@uid_lt}, {@hash}, {@seclabel}]}) syz_io_uring_setup(0x1d4a, &(0x7f0000000440)={0x0, 0xfa85, 0x0, 0x0, 0x285}, &(0x7f0000ffd000/0x1000)=nil, &(0x7f0000ffd000/0x2000)=nil, &(0x7f00000004c0)=0x0, &(0x7f0000000500)) syz_io_uring_setup(0x3e5e, &(0x7f0000000540)={0x0, 0x5c61, 0x8, 0x2, 0x72}, &(0x7f0000ffd000/0x3000)=nil, &(0x7f0000ffc000/0x3000)=nil, &(0x7f00000005c0), &(0x7f0000000600)=0x0) syz_io_uring_submit(r0, r1, &(0x7f0000000740)=@IORING_OP_READ=@pass_buffer={0x16, 0x1, 0x2004, @fd_index=0xa, 0x7, &(0x7f0000000640)=""/227, 0xe3, 0xc, 0x1}, 0x9) openat$cgroup_devices(0xffffffffffffffff, &(0x7f00000007c0)='devices.allow\x00', 0x2, 0x0) syz_mount_image$nfs4(&(0x7f0000000800), &(0x7f0000000840)='./file0/file0\x00', 0xffffffffffffff01, 0x1, &(0x7f0000000900)=[{&(0x7f0000000880)="f19bd7cfef39dd2070dcb194f7bd90ce305e2a9644b9fb91cc1e75bca69ed6bbdd7636452963af395ea61189cce718ef43420310b6ff8db9f4a606d67217b1aa7bf6e1435682323aef92ef40d036c48fa3fc363c6ad63229bb37cd76a6db9879a39f", 0x62, 0x6}], 0x8400, &(0x7f0000000940)={[{'*+\\['}]}) accept(0xffffffffffffffff, 0x0, &(0x7f0000000980)) mount$9p_rdma(&(0x7f0000001040), &(0x7f0000001080)='./file0\x00', &(0x7f00000010c0), 0xa00800, &(0x7f0000001100)={'trans=rdma,', {'port', 0x3d, 0x4e20}, 0x2c, {[{@common=@aname={'aname', 0x3d, 'permit_directio'}}, {@sq={'sq', 0x3d, 0xffff}}], [{@fscontext={'fscontext', 0x3d, 'staff_u'}}]}}) 11:44:08 executing program 1: syz_mount_image$msdos(&(0x7f0000000000), &(0x7f0000000040)='./file0\x00', 0x200, 0x1, &(0x7f00000000c0)=[{&(0x7f0000000080)="7c74c7bc99e778a0c971e6f50fbdd2b70fa0b038d18c7d5ac685833434d89dce684239293aa5d8b6f11bc5c4a033ad1dc68319fad36a1101aad751fd6f4f10", 0x3f, 0x7f}], 0x42000, &(0x7f0000000100)={[{@dots}], [{@obj_user}, {@dont_appraise}, {@uid_lt}, {@hash}, {@seclabel}]}) syz_io_uring_setup(0x1d4a, &(0x7f0000000440)={0x0, 0xfa85, 0x0, 0x0, 0x285}, &(0x7f0000ffd000/0x1000)=nil, &(0x7f0000ffd000/0x2000)=nil, &(0x7f00000004c0)=0x0, &(0x7f0000000500)) syz_io_uring_setup(0x3e5e, &(0x7f0000000540)={0x0, 0x5c61, 0x8, 0x2, 0x72}, &(0x7f0000ffd000/0x3000)=nil, &(0x7f0000ffc000/0x3000)=nil, &(0x7f00000005c0), &(0x7f0000000600)=0x0) syz_io_uring_submit(r0, r1, &(0x7f0000000740)=@IORING_OP_READ=@pass_buffer={0x16, 0x1, 0x2004, @fd_index=0xa, 0x7, &(0x7f0000000640)=""/227, 0xe3, 0xc, 0x1}, 0x9) openat$cgroup_devices(0xffffffffffffffff, &(0x7f00000007c0)='devices.allow\x00', 0x2, 0x0) 11:44:08 executing program 3: ioctl$SG_SET_FORCE_PACK_ID(0xffffffffffffffff, 0x227b, &(0x7f0000000000)=0x1) ioctl$SG_GET_RESERVED_SIZE(0xffffffffffffffff, 0x2272, &(0x7f0000000080)) r0 = openat$vcsa(0xffffffffffffff9c, &(0x7f00000000c0), 0x4200, 0x0) ioctl$SCSI_IOCTL_SEND_COMMAND(r0, 0x1, &(0x7f0000000100)={0x17, 0x3, 0x1c00, "af36a59fb168d324fd8eaf833aeb82f60d75e8700d81d9"}) ioctl$SG_SET_TIMEOUT(r0, 0x2201, &(0x7f0000000140)=0x4) ioctl$SG_GET_VERSION_NUM(r0, 0x2282, &(0x7f0000000180)) ioctl$SG_GET_REQUEST_TABLE(r0, 0x2286, &(0x7f00000001c0)) ioctl$SG_GET_TIMEOUT(r0, 0x2202, 0x0) r1 = syz_open_dev$sg(&(0x7f0000000340), 0x7fff, 0x40) ioctl$SG_EMULATED_HOST(r1, 0x2203, &(0x7f0000000380)) r2 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$inet6_tcp_TCP_CONGESTION(r2, 0x6, 0xd, &(0x7f0000000440)='scalable\x00', 0x9) 11:44:08 executing program 4: ioprio_set$uid(0x0, 0xee01, 0x4004) syz_io_uring_setup(0x1d4a, &(0x7f0000000440)={0x0, 0xfa85, 0x0, 0x0, 0x285}, &(0x7f0000ffd000/0x1000)=nil, &(0x7f0000ffd000/0x2000)=nil, &(0x7f00000004c0)=0x0, &(0x7f0000000500)) syz_io_uring_setup(0x3e5e, &(0x7f0000000540)={0x0, 0x5c61, 0x8, 0x2, 0x72}, &(0x7f0000ffd000/0x3000)=nil, &(0x7f0000ffc000/0x3000)=nil, &(0x7f00000005c0), &(0x7f0000000600)=0x0) syz_io_uring_submit(r0, r1, &(0x7f0000000740)=@IORING_OP_READ=@pass_buffer={0x16, 0x1, 0x2004, @fd_index=0xa, 0x7, &(0x7f0000000640)=""/227, 0xe3, 0xc, 0x1}, 0x9) syz_mount_image$nfs4(&(0x7f0000000800), &(0x7f0000000840)='./file0/file0\x00', 0xffffffffffffff01, 0x1, &(0x7f0000000900)=[{&(0x7f0000000880)="f19bd7cfef39dd2070dcb194f7bd90ce305e2a9644b9fb91cc1e75bca69ed6bbdd7636452963af395ea61189cce718ef43420310b6ff8db9f4a606d67217b1aa7bf6e1435682323aef92ef40d036c48fa3fc363c6ad63229bb37cd76a6db9879a39f", 0x62, 0x6}], 0x8400, &(0x7f0000000940)={[{'*+\\['}]}) accept(0xffffffffffffffff, 0x0, &(0x7f0000000980)) 11:44:08 executing program 2: mmap$IORING_OFF_SQ_RING(&(0x7f0000ffd000/0x1000)=nil, 0x1000, 0x0, 0x10, 0xffffffffffffffff, 0x0) syz_io_uring_submit(0x0, 0x0, 0x0, 0x0) io_uring_setup(0x0, 0x0) 11:44:08 executing program 7: ioprio_set$uid(0x0, 0xee01, 0x0) syz_mount_image$msdos(0x0, &(0x7f0000000040)='./file0\x00', 0x200, 0x1, &(0x7f00000000c0)=[{&(0x7f0000000080)="7c74c7bc99e778a0c971e6f50fbdd2b70fa0b038d18c7d5ac685833434d89dce684239293aa5d8b6f11bc5c4a033ad1dc68319fad36a1101aad751fd6f4f10", 0x3f, 0x7f}], 0x42000, &(0x7f0000000100)={[{@dots}], [{@obj_user}, {@dont_appraise}, {@uid_lt}, {@hash}, {@seclabel}]}) syz_io_uring_setup(0x1d4a, &(0x7f0000000440)={0x0, 0xfa85, 0x0, 0x0, 0x285}, &(0x7f0000ffd000/0x1000)=nil, &(0x7f0000ffd000/0x2000)=nil, &(0x7f00000004c0)=0x0, &(0x7f0000000500)) syz_io_uring_submit(r0, 0x0, &(0x7f0000000740)=@IORING_OP_READ=@pass_buffer={0x16, 0x1, 0x2004, @fd_index=0xa, 0x7, &(0x7f0000000640)=""/227, 0xe3, 0xc, 0x1}, 0x9) openat$cgroup_devices(0xffffffffffffffff, &(0x7f00000007c0)='devices.allow\x00', 0x2, 0x0) mount$9p_rdma(&(0x7f0000001040), &(0x7f0000001080)='./file0\x00', &(0x7f00000010c0), 0xa00800, &(0x7f0000001100)={'trans=rdma,', {'port', 0x3d, 0x4e20}, 0x2c, {[{@common=@aname={'aname', 0x3d, 'permit_directio'}}, {@sq={'sq', 0x3d, 0xffff}}], [{@fscontext={'fscontext', 0x3d, 'staff_u'}}]}}) [ 341.639084] set_capacity_and_notify: 1 callbacks suppressed [ 341.639114] loop6: detected capacity change from 0 to 1 [ 341.650642] loop7: detected capacity change from 0 to 1 11:44:08 executing program 3: ioctl$SG_SET_FORCE_PACK_ID(0xffffffffffffffff, 0x227b, &(0x7f0000000000)=0x1) ioctl$SG_GET_RESERVED_SIZE(0xffffffffffffffff, 0x2272, &(0x7f0000000080)) r0 = openat$vcsa(0xffffffffffffff9c, &(0x7f00000000c0), 0x4200, 0x0) ioctl$SCSI_IOCTL_SEND_COMMAND(r0, 0x1, &(0x7f0000000100)={0x17, 0x3, 0x1c00, "af36a59fb168d324fd8eaf833aeb82f60d75e8700d81d9"}) ioctl$SG_SET_TIMEOUT(r0, 0x2201, &(0x7f0000000140)=0x4) ioctl$SG_GET_VERSION_NUM(r0, 0x2282, &(0x7f0000000180)) ioctl$SG_GET_REQUEST_TABLE(r0, 0x2286, &(0x7f00000001c0)) ioctl$SG_GET_TIMEOUT(r0, 0x2202, 0x0) r1 = syz_open_dev$sg(&(0x7f0000000340), 0x7fff, 0x40) ioctl$SG_EMULATED_HOST(r1, 0x2203, &(0x7f0000000380)) r2 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$inet6_tcp_TCP_CONGESTION(r2, 0x6, 0xd, &(0x7f0000000440)='scalable\x00', 0x9) [ 341.660960] loop1: detected capacity change from 0 to 1 [ 341.678546] SELinux: security_context_str_to_sid (staff_u) failed with errno=-22 [ 341.693042] loop6: detected capacity change from 0 to 264192 [ 341.700399] loop4: detected capacity change from 0 to 264192 11:44:08 executing program 2: mmap$IORING_OFF_SQ_RING(&(0x7f0000ffd000/0x1000)=nil, 0x1000, 0x0, 0x10, 0xffffffffffffffff, 0x0) recvfrom$packet(0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0) io_uring_setup(0x0, 0x0) 11:44:08 executing program 5: shmget(0x2, 0x3000, 0x100, &(0x7f0000ffb000/0x3000)=nil) shmat(0x0, &(0x7f0000ffa000/0x4000)=nil, 0x3000) syz_genetlink_get_family_id$netlbl_mgmt(&(0x7f0000000040), 0xffffffffffffffff) mmap$IORING_OFF_SQ_RING(&(0x7f0000ffd000/0x1000)=nil, 0x1000, 0x2000006, 0x40010, 0xffffffffffffffff, 0x0) io_uring_setup(0x14ab, &(0x7f0000000480)={0x0, 0x5191, 0x20, 0x1, 0x3ba}) 11:44:08 executing program 1: syz_mount_image$msdos(&(0x7f0000000000), &(0x7f0000000040)='./file0\x00', 0x200, 0x1, &(0x7f00000000c0)=[{&(0x7f0000000080)="7c74c7bc99e778a0c971e6f50fbdd2b70fa0b038d18c7d5ac685833434d89dce684239293aa5d8b6f11bc5c4a033ad1dc68319fad36a1101aad751fd6f4f10", 0x3f, 0x7f}], 0x42000, &(0x7f0000000100)={[{@dots}], [{@obj_user}, {@dont_appraise}, {@uid_lt}, {@hash}, {@seclabel}]}) syz_io_uring_setup(0x1d4a, &(0x7f0000000440)={0x0, 0xfa85, 0x0, 0x0, 0x285}, &(0x7f0000ffd000/0x1000)=nil, &(0x7f0000ffd000/0x2000)=nil, &(0x7f00000004c0)=0x0, &(0x7f0000000500)) syz_io_uring_setup(0x3e5e, &(0x7f0000000540)={0x0, 0x5c61, 0x8, 0x2, 0x72}, &(0x7f0000ffd000/0x3000)=nil, &(0x7f0000ffc000/0x3000)=nil, &(0x7f00000005c0), &(0x7f0000000600)=0x0) syz_io_uring_submit(r0, r1, &(0x7f0000000740)=@IORING_OP_READ=@pass_buffer={0x16, 0x1, 0x2004, @fd_index=0xa, 0x7, &(0x7f0000000640)=""/227, 0xe3, 0xc, 0x1}, 0x9) 11:44:08 executing program 0: ioprio_set$uid(0x0, 0xee01, 0x4004) mount$9p_rdma(&(0x7f0000001040), &(0x7f0000001080)='./file0\x00', &(0x7f00000010c0), 0xa00800, &(0x7f0000001100)={'trans=rdma,', {'port', 0x3d, 0x4e20}, 0x2c, {[{@common=@aname={'aname', 0x3d, 'permit_directio'}}, {@sq={'sq', 0x3d, 0xffff}}], [{@fscontext={'fscontext', 0x3d, 'staff_u'}}]}}) 11:44:08 executing program 2: mmap$IORING_OFF_SQ_RING(&(0x7f0000ffd000/0x1000)=nil, 0x1000, 0x0, 0x10, 0xffffffffffffffff, 0x0) recvfrom$packet(0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0) io_uring_setup(0x0, 0x0) [ 341.808357] loop1: detected capacity change from 0 to 1 VM DIAGNOSIS: 11:44:01 Registers: info registers vcpu 0 RAX=0000000000000001 RBX=0000000000000001 RCX=ffffffff84d1a2ce RDX=fffffbfff0b82d11 RSI=0000000000000004 RDI=ffffffff85c16880 RBP=ffffffff85c16880 RSP=ffff88801ab67b38 R8 =0000000000000000 R9 =fffffbfff0b82d10 R10=ffffffff85c16883 R11=0000000000000000 R12=1ffff1100356cf69 R13=0000000000000003 R14=fffffbfff0b82d10 R15=ffff88801ab67b78 RIP=ffffffff81b3c9ef RFL=00000246 [---Z-P-] CPL=0 II=0 A20=1 SMM=0 HLT=0 ES =0000 0000000000000000 00000000 00000000 CS =0010 0000000000000000 ffffffff 00a09b00 DPL=0 CS64 [-RA] SS =0018 0000000000000000 ffffffff 00c09300 DPL=0 DS [-WA] DS =0000 0000000000000000 00000000 00000000 FS =0000 00005555860a8400 00000000 00000000 GS =0000 ffff8880e5342000 00000000 00000000 LDT=0000 fffffe6d00000000 00000000 00000000 TR =0040 fffffe0000003000 00004087 00008b00 DPL=0 TSS64-busy GDT= fffffe0000001000 0000007f IDT= fffffe0000000000 00000fff CR0=80050033 CR2=0000563e05568378 CR3=000000000d837000 CR4=00350ef0 DR0=0000000000000000 DR1=0000000000000000 DR2=0000000000000000 DR3=0000000000000000 DR6=00000000ffff0ff0 DR7=0000000000000400 EFER=0000000000000d01 FCW=037f FSW=0000 [ST=0] FTW=00 MXCSR=00001f80 FPR0=0000000000000000 0000 FPR1=0000000000000000 0000 FPR2=0000000000000000 0000 FPR3=0000000000000000 0000 FPR4=0000000000000000 0000 FPR5=0000000000000000 0000 FPR6=0000000000000000 0000 FPR7=0000000000000000 0000 XMM00=00000000a60ce07b00000000cec3662e XMM01=000000000000000003515b82db34ca11 XMM02=0000000000000000333bebdfd0a6a21d XMM03=00000000000000000000000000000000 XMM04=000000000000000000000000000000ff XMM05=00000000000000000000000000000000 XMM06=00000000000000000000000000000000 XMM07=00000000000000000000000000000000 XMM08=00000000000000000000000000000000 XMM09=00000000000000000000000000000000 XMM10=00000000000000000000000000000000 XMM11=00000000000000000000000000000000 XMM12=00000000000000000000000000000000 XMM13=00000000000000000000000000000000 XMM14=00000000000000000000000000000000 XMM15=00000000000000000000000000000000 info registers vcpu 1 RAX=0000000000000032 RBX=00000000000003f8 RCX=0000000000000000 RDX=00000000000003f8 RSI=ffffffff82975135 RDI=ffffffff889c19e0 RBP=ffffffff889c19a0 RSP=ffff8880473cf488 R8 =0000000000000000 R9 =ffffed1001de1046 R10=0000000000000032 R11=000000006f6c2034 R12=0000000000000032 R13=0000000000000010 R14=ffffffff889c19a0 R15=ffffffff82975120 RIP=ffffffff8297518d RFL=00000002 [-------] CPL=0 II=0 A20=1 SMM=0 HLT=0 ES =0000 0000000000000000 00000000 00000000 CS =0010 0000000000000000 ffffffff 00a09b00 DPL=0 CS64 [-RA] SS =0018 0000000000000000 ffffffff 00c09300 DPL=0 DS [-WA] DS =0000 0000000000000000 00000000 00000000 FS =0000 000055555656d400 00000000 00000000 GS =0000 ffff8880e5442000 00000000 00000000 LDT=0000 fffffe4900000000 00000000 00000000 TR =0040 fffffe000004a000 00004087 00008b00 DPL=0 TSS64-busy GDT= fffffe0000048000 0000007f IDT= fffffe0000000000 00000fff CR0=80050033 CR2=00007f547de6f540 CR3=000000000a42d000 CR4=00350ef0 DR0=0000000000000000 DR1=0000000000000000 DR2=0000000000000000 DR3=0000000000000000 DR6=00000000ffff0ff0 DR7=0000000000000400 EFER=0000000000000d01 FCW=037f FSW=0000 [ST=0] FTW=00 MXCSR=00001f80 FPR0=0000000000000000 0000 FPR1=0000000000000000 0000 FPR2=0000000000000000 0000 FPR3=0000000000000000 0000 FPR4=0000000000000000 0000 FPR5=0000000000000000 0000 FPR6=0000000000000000 0000 FPR7=0000000000000000 0000 XMM00=00000000a60ce07b00000000cec3662e XMM01=000000000000000003515b82db34ca11 XMM02=0000000000000000333bebdfd0a6a21d XMM03=00000000000000000000000000000000 XMM04=000000ff0000000000000000000000ff XMM05=00000000000000000000000000000000 XMM06=00000000000000000000000000000000 XMM07=00000000000000000000000000000000 XMM08=00000000000000000000000000000000 XMM09=00000000000000000000000000000000 XMM10=00000000000000000000000000000000 XMM11=00000000000000000000000000000000 XMM12=00000000000000000000000000000000 XMM13=00000000000000000000000000000000 XMM14=00000000000000000000000000000000 XMM15=00000000000000000000000000000000